diff --git a/.github/DISCUSSION_TEMPLATE/game-bring-up.yml b/.github/DISCUSSION_TEMPLATE/game-bring-up.yml
index afb5f3d3d3..ff08c3cca6 100644
--- a/.github/DISCUSSION_TEMPLATE/game-bring-up.yml
+++ b/.github/DISCUSSION_TEMPLATE/game-bring-up.yml
@@ -6,7 +6,7 @@ body:
         One thread per title, for every platform: search this category for the title ID first. If a thread exists, reply there, also when your OS or GPU differs from the one it reports.
         Name the discussion `Game name (title ID)`, for example `DOOM Shareware (PPSA99666)`, without the platform.
         Bug reports and implementation work belong in issues and pull requests; link them here as the blocker.
-        Per-game progress is also tracked on the [blocker map](https://alxcbtw.github.io/anyps5-roadmap/), built from public GitHub data. Only share material you have the right to distribute.
+        Only share material you have the right to distribute.
   - type: checkboxes
     id: searched
     attributes:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cab59565e5..7813e6b53e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,7 +33,7 @@ permissions:
 
 concurrency:
   group: build-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name != 'push' }}
 
 env:
   CONFIGURE: >-
@@ -641,7 +641,7 @@ jobs:
         uses: actions/cache/restore@v6
         with:
           path: configure-seed.cmake
-          key: configure-seed-${{ env.WINLIBS_ZIP }}-${{ steps.submodules.outputs.key }}-${{ hashFiles('CMakeLists.txt', 'cmake/**', 'core/libs/CMakeLists.txt', '.github/workflows/build.yml') }}
+          key: configure-seed-${{ env.WINLIBS_ZIP }}-${{ steps.submodules.outputs.key }}-${{ hashFiles('CMakeLists.txt', 'cmake/**', 'core/libs/CMakeLists.txt', 'tools/configure_seed.py', '.github/workflows/build.yml') }}
       - shell: cmd
         run: if exist configure-seed.cmake (cmake -C configure-seed.cmake -S . -B build %CONFIGURE% "-DANYPS5_AGC_EXECUTION_TESTS=F16ToF32Unpack;F64FmaSubnormals;RegistrationPrepareShutdown") else (cmake -S . -B build %CONFIGURE% "-DANYPS5_AGC_EXECUTION_TESTS=F16ToF32Unpack;F64FmaSubnormals;RegistrationPrepareShutdown")
       - if: steps.seed-cache.outputs.cache-hit != 'true'
diff --git a/.gitmodules b/.gitmodules
index 64a98a2f94..dcde427ae7 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -22,6 +22,9 @@
 [submodule "3rdparty/ffmpeg-core"]
 	path = 3rdparty/ffmpeg-core
 	url = https://github.com/KytyPS5/ext-ffmpeg-core.git
+[submodule "3rdparty/opus"]
+	path = 3rdparty/opus
+	url = https://github.com/xiph/opus.git
 [submodule "3rdparty/freetype"]
 	path = 3rdparty/freetype
 	url = https://github.com/freetype/freetype.git
@@ -52,3 +55,9 @@
 [submodule "3rdparty/vgmstream"]
 	path = 3rdparty/vgmstream
 	url = https://github.com/vgmstream/vgmstream.git
+[submodule "3rdparty/ogg"]
+	path = 3rdparty/ogg
+	url = https://github.com/xiph/ogg.git
+[submodule "3rdparty/vorbis"]
+	path = 3rdparty/vorbis
+	url = https://github.com/xiph/vorbis.git
diff --git a/3rdparty/ogg b/3rdparty/ogg
new file mode 160000
index 0000000000..be05b13e98
--- /dev/null
+++ b/3rdparty/ogg
@@ -0,0 +1 @@
+Subproject commit be05b13e98b048f0b5a0f5fa8ce514d56db5f822
diff --git a/3rdparty/opus b/3rdparty/opus
new file mode 160000
index 0000000000..22244de5a7
--- /dev/null
+++ b/3rdparty/opus
@@ -0,0 +1 @@
+Subproject commit 22244de5a79bd1d6d623c32e72bf1954b56235be
diff --git a/3rdparty/vorbis b/3rdparty/vorbis
new file mode 160000
index 0000000000..0657aee69d
--- /dev/null
+++ b/3rdparty/vorbis
@@ -0,0 +1 @@
+Subproject commit 0657aee69dec8508a0011f47f3b69d7538e9d262
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 9eaa66c8db..2d82cc1bec 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -6,13 +6,12 @@ endif()
 project(Relinker CXX)
 
 set(ANYPS5_TEST_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/tests")
-set(ANYPS5_WINDOWS_TEST_EXIT "${CMAKE_CURRENT_SOURCE_DIR}/cmake/WindowsTestExit.cpp")
 
 function(add_test_executable target)
     add_executable(${target} ${ARGN})
     set_target_properties(${target} PROPERTIES RUNTIME_OUTPUT_DIRECTORY "$<1:${ANYPS5_TEST_OUTPUT_DIRECTORY}>")
     if(MINGW)
-        target_sources(${target} PRIVATE "${ANYPS5_WINDOWS_TEST_EXIT}")
+        target_sources(${target} PRIVATE $<TARGET_OBJECTS:anyps5_windows_test_exit>)
         target_link_options(${target} PRIVATE LINKER:--wrap=main)
     endif()
 endfunction()
@@ -96,6 +95,10 @@ if(APPLE AND NOT ANYPS5_RELINKER_ONLY)
     add_link_options(-fexperimental-library)
 endif()
 
+if(MINGW)
+    add_library(anyps5_windows_test_exit OBJECT cmake/WindowsTestExit.cpp)
+endif()
+
 if(BUILD_TESTING)
     add_test_executable(shader_cache_file_read_tests
         ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/tests/CacheFileReadTests.cpp)
@@ -107,6 +110,7 @@ if(BUILD_TESTING)
         ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/tests/RequestSerializerTests.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp)
     target_include_directories(request_serializer_tests PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}/core/libs
         ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler
         ${CMAKE_CURRENT_SOURCE_DIR}/core/shader/recompiler/ControlFlow/include)
     add_test(NAME request_serializer COMMAND request_serializer_tests)
@@ -168,7 +172,7 @@ if(BUILD_TESTING)
             endif()
             add_test(NAME ${conventions_test_name} COMMAND ${Python3_EXECUTABLE}
                 ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_comments.py --shard ${shard}/12)
-            set_tests_properties(${conventions_test_name} PROPERTIES TIMEOUT 30)
+            set_tests_properties(${conventions_test_name} PROPERTIES TIMEOUT 120)
         endforeach()
         add_test(NAME conventions_wrapped_declarations COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_wrapped_declarations.py)
@@ -245,9 +249,15 @@ if(BUILD_TESTING)
         add_test(NAME env_reference COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_env_reference.py)
         set_tests_properties(env_reference PROPERTIES TIMEOUT 20)
-        add_test(NAME conventions_env_reference COMMAND ${Python3_EXECUTABLE}
-            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_env_reference.py)
-        set_tests_properties(conventions_env_reference PROPERTIES TIMEOUT 60)
+        set(env_reference_test_source "${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_env_reference.py")
+        set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS "${env_reference_test_source}")
+        file(STRINGS "${env_reference_test_source}" env_reference_cases REGEX "^    def test_")
+        foreach(test_case IN LISTS env_reference_cases)
+            string(REGEX REPLACE "^    def (test_[A-Za-z0-9_]+).*" "\\1" test_case "${test_case}")
+            add_test(NAME conventions_env_reference_${test_case} COMMAND ${Python3_EXECUTABLE}
+                "${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_env_reference.py" "EnvReferenceDiffTests.${test_case}")
+            set_tests_properties(conventions_env_reference_${test_case} PROPERTIES TIMEOUT 30)
+        endforeach()
         add_test(NAME conventions_body_bom COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_conventions_body_bom.py)
         add_test(NAME conventions_blob_reads COMMAND ${Python3_EXECUTABLE}
@@ -347,6 +357,7 @@ add_subdirectory(3rdparty/libusb-cmake EXCLUDE_FROM_ALL)
 set_target_properties(usb-1.0 PROPERTIES POSITION_INDEPENDENT_CODE ON)
 
 include(cmake/ZArchive.cmake)
+include(cmake/Opus.cmake)
 if(WIN32)
     set(MI_BUILD_SHARED ON CACHE BOOL "" FORCE)
     set(MI_BUILD_STATIC OFF CACHE BOOL "" FORCE)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 01783ee784..3ef4bf3ea9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -3,6 +3,7 @@
 ## Code
 
 - Follow the [coding conventions](docs/dev/CONVENTIONS.md): naming, no comments except [technical debt](docs/dev/TechnicalDebt.md), Conventional Commits.
+- **Every exported PS5 function with `APS5_VABI` must have exactly one declaration in a header reachable through the library's `<library>.hpp`. Duplicate declarations in headers, `.cpp` files and tests are forbidden. This is checked by the Python test [`public_headers`](core/libs/tests/test_public_headers.py).**
 - Every function either does exactly what it is supposed to or throws. Unimplemented exports call `NotImplemented_nid_no_patch(__func__)` (see [libSceAudioIn](core/libs/prx/libSceAudioIn/Export.cpp)).
 - Pull requests that add or change shader instruction semantics say where they come from: measured on hardware (which GPU and what was checked, e.g. with the [hardware oracle](docs/dev/HW_ORACLE.md)) or the exact source (ISA section, LLVM, ACO or Mesa file). Reviewers check the semantics on hardware. Cases the source doesn't settle throw, and behaviour not verified on hardware is recorded in [technical debt](docs/dev/TechnicalDebt.md).
 - An export's signature or behaviour taken from a title's call sites or from a library's disassembly follows [reading titles and libraries](docs/dev/REVERSE_ENGINEERING.md): a call site settles the arguments, not what the library does.
diff --git a/README.md b/README.md
index 3e7fc3ccf4..1a3a9ac30e 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ The [shader recompiler](core/shader/recompiler/Recompiler.cpp) successfully prod
 
 ## Compatibility
 
-Per-game progress (stage reached, open blockers, libraries and GPU coverage) is tracked on the [blocker map](https://alxcbtw.github.io/anyps5-roadmap/), a community project built from public GitHub data ([source](https://github.com/AlxcBTW/anyps5-roadmap)). Test reports go in the [Game bring-up](https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up) discussions, one thread per title.
+Per-game status and test reports live in the [Game bring-up](https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up) discussions, one thread per title.
 
 ## Input mapping
 
diff --git a/cmake/Opus.cmake b/cmake/Opus.cmake
new file mode 100644
index 0000000000..d6bc3e3f78
--- /dev/null
+++ b/cmake/Opus.cmake
@@ -0,0 +1,19 @@
+function(add_bundled_opus)
+    set(BUILD_SHARED_LIBS OFF)
+    set(BUILD_TESTING OFF)
+    set(OPUS_BUILD_SHARED_LIBRARY OFF)
+    set(OPUS_BUILD_TESTING OFF)
+    set(OPUS_BUILD_PROGRAMS OFF)
+    set(OPUS_INSTALL_PKG_CONFIG_MODULE OFF)
+    set(OPUS_INSTALL_CMAKE_CONFIG_MODULE OFF)
+    set(OPUS_STACK_PROTECTOR OFF)
+    set(OPUS_FORTIFY_SOURCE OFF)
+    add_subdirectory(3rdparty/opus EXCLUDE_FROM_ALL)
+    set_target_properties(opus PROPERTIES POSITION_INDEPENDENT_CODE ON C_VISIBILITY_PRESET hidden)
+    target_compile_definitions(opus PRIVATE OPUS_EXPORT=)
+    if(MINGW OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        target_link_options(opus INTERFACE LINKER:--exclude-libs,libopus.a)
+    endif()
+endfunction()
+
+add_bundled_opus()
diff --git a/core/Decoder/Png/src/Png.cpp b/core/Decoder/Png/src/Png.cpp
index 434a589d6c..8fb90270e9 100644
--- a/core/Decoder/Png/src/Png.cpp
+++ b/core/Decoder/Png/src/Png.cpp
@@ -48,6 +48,37 @@ bool isChunkType(const std::uint8_t* bytes, const char* type) {
     return std::equal(bytes, bytes + 4, type);
 }
 
+std::optional<std::uint16_t> readGrayscaleTransparencyKey(std::span<const std::uint8_t> png) {
+    std::size_t offset = SIGNATURE.size();
+    if (png.size() < offset || !std::equal(SIGNATURE.begin(), SIGNATURE.end(), png.begin())) return std::nullopt;
+    std::optional<std::uint16_t> key;
+    while (png.size() - offset >= CHUNK_OVERHEAD) {
+        const std::uint32_t length = readBigEndian32(&png[offset]);
+        const std::uint8_t* type = &png[offset + 4];
+        if (length > png.size() - offset - CHUNK_OVERHEAD) return std::nullopt;
+        if (isChunkType(type, "tRNS")) {
+            if (length != 2) return std::nullopt;
+            key = static_cast<std::uint16_t>(png[offset + 8] << 8 | png[offset + 9]);
+        }
+        if (isChunkType(type, "IDAT") || isChunkType(type, "IEND")) return key;
+        offset += CHUNK_OVERHEAD + length;
+    }
+    return std::nullopt;
+}
+
+void repairGrayscaleTransparency(const Header& header, std::span<const std::uint8_t> png, Image& image) {
+    if (header.colorType != ColorType::Grayscale || !header.hasTransparency) return;
+    if (header.bitDepth != 1 && header.bitDepth != 2 && header.bitDepth != 4) return;
+    const std::optional<std::uint16_t> key = readGrayscaleTransparencyKey(png);
+    if (!key.has_value()) return;
+    const std::uint16_t mask = static_cast<std::uint16_t>((1u << header.bitDepth) - 1);
+    if ((*key & 0xFF) == (*key & mask)) return;
+    const std::uint8_t transparent = static_cast<std::uint8_t>((*key & mask) * (255u / mask));
+    for (std::size_t offset = 3; offset < image.pixels.size(); offset += 4) {
+        image.pixels[offset] = static_cast<std::uint8_t>(image.pixels[offset - 3] == transparent ? 0 : 255);
+    }
+}
+
 bool isValidFormat(std::uint8_t bitDepth, std::uint8_t colorType) {
     switch (colorType) {
     case 0:
@@ -158,6 +189,8 @@ std::optional<Image> Decode(std::span<const std::uint8_t> png) {
 
     Image image{static_cast<std::uint32_t>(width), static_cast<std::uint32_t>(height), {}};
     image.pixels.assign(decoded.get(), decoded.get() + static_cast<std::size_t>(image.width) * image.height * 4);
+    const std::optional<Header> header = ParseHeader(png);
+    if (header.has_value()) repairGrayscaleTransparency(*header, png, image);
     return image;
 }
 
diff --git a/core/Decoder/Png/tests/Png.cpp b/core/Decoder/Png/tests/Png.cpp
index 0c1ac81d1e..fbd18d353f 100644
--- a/core/Decoder/Png/tests/Png.cpp
+++ b/core/Decoder/Png/tests/Png.cpp
@@ -3,6 +3,7 @@
 #include <algorithm>
 #include <cstdint>
 #include <cstdlib>
+#include <optional>
 #include <stdexcept>
 #include <vector>
 
@@ -50,6 +51,17 @@ static const std::uint8_t GRAY1[] = {
     0x42, 0x60, 0x82,
 };
 
+static const std::uint8_t GRAY1_TRNS[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0xDC, 0x59, 0x42,
+    0x27, 0x00, 0x00, 0x00, 0x02, 0x74, 0x52, 0x4E, 0x53, 0x00, 0x02, 0x98, 0x9D, 0xAC, 0x14, 0x00,
+    0x00, 0x00, 0x0A, 0x49, 0x44, 0x41, 0x54, 0x78, 0xDA, 0x63, 0x70, 0x00, 0x00, 0x00, 0x42, 0x00,
+    0x41, 0x84, 0xBF, 0x8E, 0x62, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60,
+    0x82,
+};
+
+static const std::uint8_t PNG_SIGNATURE[] = {0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A};
+
 static void AppendBigEndian32(std::vector<std::uint8_t>& bytes, std::uint32_t value) {
     for (int shift = 24; shift >= 0; shift -= 8) bytes.push_back(static_cast<std::uint8_t>(value >> shift));
 }
@@ -64,6 +76,130 @@ static std::vector<std::uint8_t> HeaderOnly(std::uint32_t width, std::uint32_t h
     return bytes;
 }
 
+static std::uint32_t Crc32(std::span<const std::uint8_t> bytes) {
+    std::uint32_t crc = 0xFFFFFFFFu;
+    for (const std::uint8_t byte : bytes) {
+        crc ^= byte;
+        for (int bit = 0; bit < 8; ++bit) crc = (crc >> 1) ^ ((crc & 1) != 0 ? 0xEDB88320u : 0u);
+    }
+    return ~crc;
+}
+
+static std::uint32_t Adler32(std::span<const std::uint8_t> bytes) {
+    std::uint32_t low = 1;
+    std::uint32_t high = 0;
+    for (const std::uint8_t byte : bytes) {
+        low = (low + byte) % 65521;
+        high = (high + low) % 65521;
+    }
+    return high << 16 | low;
+}
+
+static void AppendTestChunk(std::vector<std::uint8_t>& png, const char* type, std::span<const std::uint8_t> data) {
+    AppendBigEndian32(png, static_cast<std::uint32_t>(data.size()));
+    const std::size_t start = png.size();
+    png.insert(png.end(), type, type + 4);
+    png.insert(png.end(), data.begin(), data.end());
+    AppendBigEndian32(png, Crc32(std::span<const std::uint8_t>(png.data() + start, png.size() - start)));
+}
+
+static std::vector<std::uint8_t> ZlibStore(std::span<const std::uint8_t> bytes) {
+    Require(bytes.size() <= 0xFFFF);
+    const std::uint16_t length = static_cast<std::uint16_t>(bytes.size());
+    const std::uint16_t inverse = static_cast<std::uint16_t>(~length);
+    std::vector<std::uint8_t> output{0x78, 0x01, 0x01, static_cast<std::uint8_t>(length), static_cast<std::uint8_t>(length >> 8),
+                                     static_cast<std::uint8_t>(inverse), static_cast<std::uint8_t>(inverse >> 8)};
+    output.insert(output.end(), bytes.begin(), bytes.end());
+    AppendBigEndian32(output, Adler32(bytes));
+    return output;
+}
+
+static std::vector<std::uint8_t> GrayLowBitPng(std::uint8_t bitDepth, std::span<const std::uint8_t> samples,
+                                               std::optional<std::uint16_t> transparency,
+                                               std::optional<std::uint16_t> precedingTransparency = std::nullopt) {
+    Require(bitDepth == 1 || bitDepth == 2 || bitDepth == 4);
+    std::vector<std::uint8_t> rows(1 + (samples.size() * bitDepth + 7) / 8, 0);
+    std::size_t bit = 0;
+    for (const std::uint8_t sample : samples) {
+        Require(sample < (1u << bitDepth));
+        rows[1 + bit / 8] |= static_cast<std::uint8_t>(sample << (8 - bitDepth - bit % 8));
+        bit += bitDepth;
+    }
+
+    std::vector<std::uint8_t> ihdr;
+    AppendBigEndian32(ihdr, static_cast<std::uint32_t>(samples.size()));
+    AppendBigEndian32(ihdr, 1);
+    ihdr.insert(ihdr.end(), {bitDepth, 0, 0, 0, 0});
+
+    std::vector<std::uint8_t> png(PNG_SIGNATURE, PNG_SIGNATURE + sizeof(PNG_SIGNATURE));
+    AppendTestChunk(png, "IHDR", ihdr);
+    if (precedingTransparency.has_value()) {
+        const std::uint8_t key[2] = {static_cast<std::uint8_t>(*precedingTransparency >> 8), static_cast<std::uint8_t>(*precedingTransparency)};
+        AppendTestChunk(png, "tRNS", key);
+    }
+    if (transparency.has_value()) {
+        const std::uint8_t key[2] = {static_cast<std::uint8_t>(*transparency >> 8), static_cast<std::uint8_t>(*transparency)};
+        AppendTestChunk(png, "tRNS", key);
+    }
+    AppendTestChunk(png, "IDAT", ZlibStore(rows));
+    AppendTestChunk(png, "IEND", std::span<const std::uint8_t>());
+    return png;
+}
+
+static std::uint8_t GrayScale(std::uint8_t bitDepth) {
+    if (bitDepth == 1) return 255;
+    if (bitDepth == 2) return 85;
+    return 17;
+}
+
+static void RequireGrayTransparency(std::uint8_t bitDepth, std::span<const std::uint8_t> samples, std::uint16_t key,
+                                    std::uint8_t transparentSample, std::optional<std::uint16_t> precedingKey = std::nullopt) {
+    const std::vector<std::uint8_t> png = GrayLowBitPng(bitDepth, samples, key, precedingKey);
+    const std::vector<std::uint8_t> original = png;
+    const auto header = Decoder::Png::ParseHeader(png);
+    Require(header.has_value());
+    Require(header->width == static_cast<std::uint32_t>(samples.size()) && header->height == 1 && header->bitDepth == bitDepth);
+    Require(header->colorType == Decoder::Png::ColorType::Grayscale && header->hasTransparency);
+
+    const auto image = Decoder::Png::Decode(png);
+    Require(image.has_value() && image->pixels.size() == samples.size() * 4);
+    const std::uint8_t scale = GrayScale(bitDepth);
+    for (std::size_t i = 0; i < samples.size(); ++i) {
+        const std::uint8_t gray = static_cast<std::uint8_t>(samples[i] * scale);
+        Require(image->pixels[i * 4] == gray && image->pixels[i * 4 + 1] == gray && image->pixels[i * 4 + 2] == gray);
+        Require(image->pixels[i * 4 + 3] == (samples[i] == transparentSample ? 0 : 255));
+    }
+    Require(png == original);
+}
+
+static void RequireGrayOpaque(std::uint8_t bitDepth, std::span<const std::uint8_t> samples) {
+    const std::vector<std::uint8_t> png = GrayLowBitPng(bitDepth, samples, std::nullopt);
+    const std::vector<std::uint8_t> original = png;
+    const auto header = Decoder::Png::ParseHeader(png);
+    Require(header.has_value() && !header->hasTransparency);
+    const auto image = Decoder::Png::Decode(png);
+    Require(image.has_value() && image->pixels.size() == samples.size() * 4);
+    const std::uint8_t scale = GrayScale(bitDepth);
+    for (std::size_t i = 0; i < samples.size(); ++i) {
+        const std::uint8_t gray = static_cast<std::uint8_t>(samples[i] * scale);
+        Require(image->pixels[i * 4] == gray && image->pixels[i * 4 + 1] == gray && image->pixels[i * 4 + 2] == gray);
+        Require(image->pixels[i * 4 + 3] == 255);
+    }
+    Require(png == original);
+}
+
+static void RequireTruncatedTransparency() {
+    const std::uint8_t samples[] = {0, 1};
+    const std::vector<std::uint8_t> png = GrayLowBitPng(1, samples, 0x0002);
+    const std::size_t transparencyOffset = sizeof(PNG_SIGNATURE) + 25;
+    const std::vector<std::uint8_t> truncated(png.begin(), png.begin() + transparencyOffset + 9);
+    const std::vector<std::uint8_t> original = truncated;
+    const auto header = Decoder::Png::ParseHeader(truncated);
+    Require(header.has_value() && !header->hasTransparency);
+    (void)Decoder::Png::Decode(truncated);
+    Require(truncated == original);
+}
+
 static void RequireRoundTrip(std::uint32_t channels, Decoder::Png::ColorType colorType) {
     constexpr std::uint32_t width = 20;
     constexpr std::uint32_t height = 10;
@@ -176,6 +312,42 @@ int main() {
     const std::uint8_t levels[8] = {0, 255, 0, 255, 255, 0, 0, 255};
     for (int i = 0; i < 8; ++i) Require(gray1->pixels[i * 4] == levels[i] && gray1->pixels[i * 4 + 3] == 255);
 
+    const auto gray1TrnsHeader = Decoder::Png::ParseHeader(GRAY1_TRNS);
+    Require(gray1TrnsHeader.has_value());
+    Require(gray1TrnsHeader->width == 2 && gray1TrnsHeader->height == 1 && gray1TrnsHeader->bitDepth == 1);
+    Require(gray1TrnsHeader->colorType == Decoder::Png::ColorType::Grayscale && gray1TrnsHeader->hasTransparency);
+    const auto gray1Trns = Decoder::Png::Decode(GRAY1_TRNS);
+    Require(gray1Trns.has_value());
+    Require(gray1Trns->pixels == std::vector<std::uint8_t>({0, 0, 0, 0, 255, 255, 255, 255}));
+
+    const std::uint8_t gray1Samples[] = {0, 1, 0, 1, 1, 0, 0, 1};
+    RequireGrayTransparency(1, gray1Samples, 0x0000, 0);
+    RequireGrayTransparency(1, gray1Samples, 0x0002, 0);
+    RequireGrayTransparency(1, gray1Samples, 0x0100, 0);
+    RequireGrayTransparency(1, gray1Samples, 0xFF02, 0);
+    RequireGrayTransparency(1, gray1Samples, 0xFFFF, 1);
+    RequireGrayTransparency(1, gray1Samples, 0x0001, 1, 0x0002);
+    RequireGrayOpaque(1, gray1Samples);
+
+    const std::uint8_t gray2Samples[] = {0, 1, 2, 3};
+    RequireGrayTransparency(2, gray2Samples, 0x0001, 1);
+    RequireGrayTransparency(2, gray2Samples, 0x0005, 1);
+    RequireGrayTransparency(2, gray2Samples, 0x0100, 0);
+    RequireGrayTransparency(2, gray2Samples, 0x0101, 1);
+    RequireGrayTransparency(2, gray2Samples, 0xFF05, 1);
+    RequireGrayTransparency(2, gray2Samples, 0xFFFF, 3);
+    RequireGrayOpaque(2, gray2Samples);
+
+    const std::uint8_t gray4Samples[] = {0, 3, 10, 15, 1};
+    RequireGrayTransparency(4, gray4Samples, 0x0003, 3);
+    RequireGrayTransparency(4, gray4Samples, 0x0013, 3);
+    RequireGrayTransparency(4, gray4Samples, 0x0100, 0);
+    RequireGrayTransparency(4, gray4Samples, 0x0103, 3);
+    RequireGrayTransparency(4, gray4Samples, 0xFF13, 3);
+    RequireGrayTransparency(4, gray4Samples, 0xFFFF, 15);
+    RequireGrayOpaque(4, gray4Samples);
+    RequireTruncatedTransparency();
+
     const auto interlaced = Decoder::Png::ParseHeader(HeaderOnly(3, 4, 8, 6, 1));
     Require(interlaced.has_value() && interlaced->interlaced && !interlaced->hasTransparency);
     Require(!Decoder::Png::ParseHeader(HeaderOnly(0, 4, 8, 6, 0)).has_value());
diff --git a/core/libs/CMakeLists.txt b/core/libs/CMakeLists.txt
index ef468b08aa..728bf2a869 100644
--- a/core/libs/CMakeLists.txt
+++ b/core/libs/CMakeLists.txt
@@ -68,6 +68,18 @@ if(MINGW)
         string(REPLACE "${runtimeLinkFlag}" "" CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS}")
     endforeach()
 
+    if(NOT EXISTS "${CMAKE_RANLIB}")
+        if(EXISTS "${CMAKE_CXX_COMPILER_RANLIB}")
+            set(CMAKE_RANLIB "${CMAKE_CXX_COMPILER_RANLIB}")
+        else()
+            get_filename_component(_compiler_dir "${CMAKE_CXX_COMPILER}" DIRECTORY)
+            if(EXISTS "${_compiler_dir}/gcc-ranlib${CMAKE_EXECUTABLE_SUFFIX}")
+                set(CMAKE_RANLIB "${_compiler_dir}/gcc-ranlib${CMAKE_EXECUTABLE_SUFFIX}")
+            elseif(EXISTS "${_compiler_dir}/ranlib${CMAKE_EXECUTABLE_SUFFIX}")
+                set(CMAKE_RANLIB "${_compiler_dir}/ranlib${CMAKE_EXECUTABLE_SUFFIX}")
+            endif()
+        endif()
+    endif()
     if(NOT EXISTS "${CMAKE_RANLIB}")
         message(FATAL_ERROR "Stable import libraries require ranlib")
     endif()
@@ -218,7 +230,7 @@ if(TARGET mimalloc)
     target_compile_features(pe_import_first PRIVATE cxx_std_20)
     if(MINGW)
         target_compile_options(pe_import_first PRIVATE -fasynchronous-unwind-tables)
-        target_link_options(pe_import_first PRIVATE -static -static-libgcc -static-libstdc++)
+        target_link_options(pe_import_first PRIVATE -municode -static -static-libgcc -static-libstdc++)
     endif()
     add_custom_command(
             OUTPUT ${PATCHED_DIR}/mimalloc.dll
@@ -248,6 +260,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_posix_scalar_io PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_kernel_sys_sdk_version_tests tests/GuestKernelSysSdkVersion.cpp)
+    target_include_directories(guest_kernel_sys_sdk_version_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_sdk_version_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_sdk_version_tests)
+    add_test(NAME guest_kernel_sys_sdk_version COMMAND guest_kernel_sys_sdk_version_tests)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_sdk_version PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
     add_test_executable(nid_buffer_validation_tests nid/tests/BufferValidation.cpp)
     target_include_directories(nid_buffer_validation_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/nid/include)
     target_compile_features(nid_buffer_validation_tests PRIVATE cxx_std_20)
@@ -268,6 +289,25 @@ if(BUILD_TESTING)
 
     find_package(Python3 QUIET COMPONENTS Interpreter)
     if(Python3_Interpreter_FOUND)
+        set(public_header_compiler_args)
+        if(APPLE)
+            foreach(architecture IN LISTS CMAKE_OSX_ARCHITECTURES)
+                list(APPEND public_header_compiler_args --compiler-arg=-arch "--compiler-arg=${architecture}")
+            endforeach()
+            if(CMAKE_OSX_SYSROOT)
+                list(APPEND public_header_compiler_args --compiler-arg=-isysroot "--compiler-arg=${CMAKE_OSX_SYSROOT}")
+            endif()
+        endif()
+        set(public_header_manifest "${CMAKE_CURRENT_BINARY_DIR}/public_headers.json")
+        add_test(NAME public_headers COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tests/test_public_headers.py --audit-only --manifest "${public_header_manifest}")
+        set_tests_properties(public_headers PROPERTIES TIMEOUT 30 RUN_SERIAL TRUE FIXTURES_SETUP public_headers_manifest)
+        foreach(batch RANGE 0 63)
+            add_test(NAME public_headers_compile_${batch} COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_CURRENT_SOURCE_DIR}/tests/test_public_headers.py --compiler ${CMAKE_CXX_COMPILER} ${public_header_compiler_args}
+                --manifest "${public_header_manifest}" --batch-index ${batch} --batch-count 64)
+            set_tests_properties(public_headers_compile_${batch} PROPERTIES TIMEOUT 30 FIXTURES_REQUIRED public_headers_manifest)
+        endforeach()
         add_test(NAME nid_gnu_hash COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/nid/tests/test_gnu_hash.py $<TARGET_FILE:nid_patcher>)
         add_test(NAME nid_elf_duplicates COMMAND ${Python3_EXECUTABLE}
@@ -315,22 +355,53 @@ if(BUILD_TESTING)
     configure_windows_unwind(guest_kernel_sys_thread_defaults_tests)
     add_test(NAME guest_kernel_sys_thread_defaults COMMAND guest_kernel_sys_thread_defaults_tests)
     set_tests_properties(guest_kernel_sys_thread_defaults PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_kernel_sys_barrier_tests tests/GuestKernelSysBarrier.cpp)
+    target_include_directories(guest_kernel_sys_barrier_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_barrier_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_barrier_tests)
+    add_test(NAME guest_kernel_sys_barrier COMMAND guest_kernel_sys_barrier_tests)
+    set_tests_properties(guest_kernel_sys_barrier PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_kernel_sys_pthread_tests tests/GuestKernelSysPthread.cpp)
+    target_include_directories(guest_kernel_sys_pthread_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_pthread_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_pthread_tests)
+    add_test(NAME guest_kernel_sys_pthread COMMAND guest_kernel_sys_pthread_tests)
     if(Python3_Interpreter_FOUND)
         add_test(NAME nid_verneed COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/nid/tests/test_verneed.py $<TARGET_FILE:nid_patcher>)
     endif()
     if(WIN32)
-        set_tests_properties(guest_kernel_sys guest_kernel_sys_thread_defaults PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_kernel_sys guest_kernel_sys_thread_defaults guest_kernel_sys_barrier guest_kernel_sys_pthread PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
     endif()
+
+    add_test_executable(guest_gnm_neo_packets_tests tests/GuestGnmNeoPackets.cpp)
+    target_include_directories(guest_gnm_neo_packets_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_gnm_neo_packets_tests PRIVATE libSceGnmDriverForNeoMode libc)
+    configure_windows_unwind(guest_gnm_neo_packets_tests)
+    add_test(NAME guest_gnm_neo_packets COMMAND guest_gnm_neo_packets_tests)
+    if(WIN32)
+        set_tests_properties(guest_gnm_neo_packets PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
+    endif()
     if(APPLE)
         add_subdirectory(tests/write_watch)
         add_subdirectory(tests/guest_arena)
     endif()
+    add_test_executable(guest_kernel_sys_module_internal_tests tests/GuestKernelSysModuleInternal.cpp)
+    target_include_directories(guest_kernel_sys_module_internal_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_module_internal_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_module_internal_tests)
+    add_test(NAME guest_kernel_sys_module_internal COMMAND guest_kernel_sys_module_internal_tests)
+    set_tests_properties(guest_kernel_sys_module_internal PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_module_internal PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
     if(WIN32)
         add_test_executable(windows_write_watch_tests tests/WindowsWriteWatch.cpp)
         target_include_directories(windows_write_watch_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
-        target_compile_definitions(windows_write_watch_tests PRIVATE _WIN32_WINNT=0x0A00)
+        target_compile_definitions(windows_write_watch_tests PRIVATE _WIN32_WINNT=0x0A00 APS5_COUNT_MAPPING_QUERIES=1)
         if(MINGW)
             target_compile_options(windows_write_watch_tests PRIVATE -fasynchronous-unwind-tables)
         endif()
@@ -355,6 +426,16 @@ if(BUILD_TESTING)
         target_compile_options(crash_text_tests PRIVATE -fasynchronous-unwind-tables)
     endif()
     add_test(NAME crash_text COMMAND crash_text_tests)
+    add_test_executable(guest_kernel_sys_pselect_tests tests/GuestKernelSysPselect.cpp)
+    target_include_directories(guest_kernel_sys_pselect_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_pselect_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_pselect_tests)
+    add_test(NAME guest_kernel_sys_pselect COMMAND guest_kernel_sys_pselect_tests)
+    set_tests_properties(guest_kernel_sys_pselect PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_pselect PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
 
     if(WIN32)
         add_test_executable(windows_crash_text_tests tests/WindowsCrashText.cpp)
@@ -388,6 +469,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
     endif()
 
+    add_test_executable(guest_vr_tracker_devices_tests tests/GuestVrTrackerDevices.cpp)
+    target_include_directories(guest_vr_tracker_devices_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_vr_tracker_devices_tests PRIVATE libSceVrTracker libc)
+    configure_windows_unwind(guest_vr_tracker_devices_tests)
+    add_test(NAME guest_vr_tracker_devices COMMAND guest_vr_tracker_devices_tests)
+    if(WIN32)
+        set_tests_properties(guest_vr_tracker_devices PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVrTracker>")
+    endif()
+
     add_test_executable(guest_move_tests tests/GuestMove.cpp)
     target_include_directories(guest_move_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_move_tests PRIVATE libSceMove libc)
@@ -408,6 +499,40 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpParty>")
     endif()
 
+    add_test_executable(guest_np_ps4_imports_tests tests/GuestNpPs4Imports.cpp)
+    target_include_directories(guest_np_ps4_imports_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_ps4_imports_tests PRIVATE libSceNpMatching2 libSceNpSignaling libSceNpTrophy libc)
+    configure_windows_unwind(guest_np_ps4_imports_tests)
+    add_test(NAME guest_np_ps4_imports COMMAND guest_np_ps4_imports_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_ps4_imports PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpMatching2>")
+    endif()
+
+    add_test_executable(guest_np_common_tests tests/GuestNpCommon.cpp)
+    target_include_directories(guest_np_common_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_common_tests PRIVATE libSceNpCommon libkernel libc)
+    configure_windows_unwind(guest_np_common_tests)
+    foreach(testCase IN ITEMS ids sync clock)
+        add_test(NAME guest_np_common_${testCase} COMMAND guest_np_common_tests ${testCase})
+        set_tests_properties(guest_np_common_${testCase} PROPERTIES TIMEOUT 20)
+        if(WIN32)
+            set_tests_properties(guest_np_common_${testCase} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCommon>")
+        endif()
+    endforeach()
+
+    add_test_executable(guest_np_common_runtime_tests tests/GuestNpCommonRuntime.cpp)
+    target_include_directories(guest_np_common_runtime_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_common_runtime_tests PRIVATE libSceNpCommon libkernel libc)
+    configure_windows_unwind(guest_np_common_runtime_tests)
+    add_test(NAME guest_np_common_runtime COMMAND guest_np_common_runtime_tests)
+    set_tests_properties(guest_np_common_runtime PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_common_runtime PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCommon>")
+    endif()
+
     add_test_executable(guest_offline_imports_tests tests/GuestOfflineImports.cpp)
     target_include_directories(guest_offline_imports_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_offline_imports_tests PRIVATE libSceHttp libSceNpEntitlementAccess libSceRudp libSceVideoRecordingP libc)
@@ -422,6 +547,17 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceHttp>")
     endif()
 
+    add_test_executable(guest_entitlements_tests tests/GuestEntitlements.cpp)
+    target_include_directories(guest_entitlements_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_entitlements_tests PRIVATE libSceNpEntitlementAccess libc)
+    configure_windows_unwind(guest_entitlements_tests)
+    add_test(NAME guest_entitlements COMMAND guest_entitlements_tests)
+    add_test(NAME guest_entitlements_missing COMMAND guest_entitlements_tests missing)
+    if(WIN32)
+        set_tests_properties(guest_entitlements guest_entitlements_missing PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpEntitlementAccess>")
+    endif()
+
     add_test_executable(guest_signin_dialog_tests tests/GuestSigninDialog.cpp)
     target_include_directories(guest_signin_dialog_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_signin_dialog_tests PRIVATE libSceSigninDialog libc)
@@ -621,6 +757,26 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCppWebApi>")
     endif()
 
+    add_test_executable(guest_np_cpp_web_api_signed_out_tests tests/GuestNpCppWebApiSignedOut.cpp)
+    target_include_directories(guest_np_cpp_web_api_signed_out_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_cpp_web_api_signed_out_tests PRIVATE libSceNpCppWebApi libc)
+    configure_windows_unwind(guest_np_cpp_web_api_signed_out_tests)
+    add_test(NAME guest_np_cpp_web_api_signed_out COMMAND guest_np_cpp_web_api_signed_out_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_cpp_web_api_signed_out PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCppWebApi>")
+    endif()
+
+    add_test_executable(guest_np_cpp_web_api_offline_tests tests/GuestNpCppWebApiOffline.cpp)
+    target_include_directories(guest_np_cpp_web_api_offline_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_np_cpp_web_api_offline_tests PRIVATE libSceNpCppWebApi libc)
+    configure_windows_unwind(guest_np_cpp_web_api_offline_tests)
+    add_test(NAME guest_np_cpp_web_api_offline COMMAND guest_np_cpp_web_api_offline_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_cpp_web_api_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpCppWebApi>")
+    endif()
+
     add_test_executable(savedata_core_write_replacement_tests tests/SaveDataWriteReplacement.cpp)
     target_include_directories(savedata_core_write_replacement_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(savedata_core_write_replacement_tests PRIVATE libSceSaveData)
@@ -639,6 +795,17 @@ if(BUILD_TESTING)
     configure_windows_unwind(savedata_replace_file_failure_tests)
     add_test(NAME savedata_replace_file_failure COMMAND savedata_replace_file_failure_tests)
 
+    add_test_executable(guest_kernel_sys_ktimer_tests tests/GuestKernelSysKtimer.cpp)
+    target_include_directories(guest_kernel_sys_ktimer_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_ktimer_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_ktimer_tests)
+    add_test(NAME guest_kernel_sys_ktimer COMMAND guest_kernel_sys_ktimer_tests)
+    set_tests_properties(guest_kernel_sys_ktimer PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_ktimer PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
+
     add_test_executable(guest_crt_tests tests/GuestCrt.cpp)
     target_include_directories(guest_crt_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_crt_tests PRIVATE libSceAmpr libc)
@@ -661,6 +828,17 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSaveData.native>")
     endif()
 
+    add_test_executable(guest_kernel_sys_aio_tests tests/GuestKernelSysAio.cpp)
+    target_include_directories(guest_kernel_sys_aio_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_aio_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_aio_tests)
+    add_test(NAME guest_kernel_sys_aio COMMAND guest_kernel_sys_aio_tests)
+    set_tests_properties(guest_kernel_sys_aio PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_aio PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
+
     add_test_executable(guest_posix_random_tests tests/GuestPosixRandom.cpp)
     target_include_directories(guest_posix_random_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_posix_random_tests PRIVATE libScePosixForWebKit)
@@ -701,6 +879,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVoiceChat>")
     endif()
 
+    add_test_executable(guest_gnm_neo_embedded_tests tests/GuestGnmNeoEmbedded.cpp)
+    target_include_directories(guest_gnm_neo_embedded_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_gnm_neo_embedded_tests PRIVATE libSceGnmDriverForNeoMode libc)
+    configure_windows_unwind(guest_gnm_neo_embedded_tests)
+    add_test(NAME guest_gnm_neo_embedded COMMAND guest_gnm_neo_embedded_tests)
+    if(WIN32)
+        set_tests_properties(guest_gnm_neo_embedded PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
+    endif()
+
     add_test_executable(guest_np_game_intent_tests tests/GuestNpGameIntent.cpp)
     target_include_directories(guest_np_game_intent_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_link_libraries(guest_np_game_intent_tests PRIVATE libSceNpGameIntent libc)
@@ -711,13 +899,35 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpGameIntent>")
     endif()
 
+    add_test_executable(guest_gnm_neo_shaders_tests tests/GuestGnmNeoShaders.cpp)
+    target_include_directories(guest_gnm_neo_shaders_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_gnm_neo_shaders_tests PRIVATE libSceGnmDriverForNeoMode libc)
+    configure_windows_unwind(guest_gnm_neo_shaders_tests)
+    add_test(NAME guest_gnm_neo_shaders COMMAND guest_gnm_neo_shaders_tests)
+    if(WIN32)
+        set_tests_properties(guest_gnm_neo_shaders PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
+    endif()
+
     add_test_executable(guest_vorbis_dec_tests tests/GuestVorbisDec.cpp)
     target_include_directories(guest_vorbis_dec_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
-    target_link_libraries(guest_vorbis_dec_tests PRIVATE libSceVorbisDec libc)
+    target_compile_definitions(guest_vorbis_dec_tests PRIVATE OV_EXCLUDE_STATIC_CALLBACKS)
+    target_link_libraries(guest_vorbis_dec_tests PRIVATE libSceVorbisDec vorbisenc vorbisfile vorbis ogg libc)
     configure_windows_unwind(guest_vorbis_dec_tests)
     add_test(NAME guest_vorbis_dec COMMAND guest_vorbis_dec_tests)
+    set_tests_properties(guest_vorbis_dec PROPERTIES TIMEOUT 30)
     if(WIN32)
         set_tests_properties(guest_vorbis_dec PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVorbisDec>")
     endif()
+
+    add_test_executable(guest_gnm_neo_default_state_tests tests/GuestGnmNeoDefaultState.cpp)
+    target_include_directories(guest_gnm_neo_default_state_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_gnm_neo_default_state_tests PRIVATE libSceGnmDriverForNeoMode libc)
+    configure_windows_unwind(guest_gnm_neo_default_state_tests)
+    add_test(NAME guest_gnm_neo_default_state COMMAND guest_gnm_neo_default_state_tests)
+    if(WIN32)
+        set_tests_properties(guest_gnm_neo_default_state PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGnmDriverForNeoMode>")
+    endif()
 endif()
diff --git a/core/libs/SceTypes.hpp b/core/libs/SceTypes.hpp
index 4a61c38ed7..f51297c09b 100644
--- a/core/libs/SceTypes.hpp
+++ b/core/libs/SceTypes.hpp
@@ -655,6 +655,13 @@ struct AudioOutPortState {
     std::uint64_t activeState;
 };
 
+struct AudioOutSystemState {
+    float loudness;
+    std::uint8_t reserved8[4];
+    std::uint64_t reserved[3];
+};
+static_assert(sizeof(AudioOutSystemState) == 32);
+
 struct Audio3dOpenParameters {
     std::uint64_t size_this;
     std::uint32_t granularity;
diff --git a/core/libs/allocator/PeImportFirst.cpp b/core/libs/allocator/PeImportFirst.cpp
index 8e1ee93454..aa4b040ba2 100644
--- a/core/libs/allocator/PeImportFirst.cpp
+++ b/core/libs/allocator/PeImportFirst.cpp
@@ -5,6 +5,7 @@
 #include <cctype>
 #include <cstdint>
 #include <cstring>
+#include <filesystem>
 #include <fstream>
 #include <iterator>
 #include <stdexcept>
@@ -78,16 +79,16 @@ void MoveImportFirst(std::vector<unsigned char>& bytes, const std::string& dll)
     for (std::size_t index = 0; index < descriptors.size(); ++index) std::memcpy(bytes.data() + directory + index * DescriptorBytes, descriptors[index].data(), DescriptorBytes);
 }
 
-void MoveImportFirstInFile(const std::string& path, const std::string& dll) {
+void MoveImportFirstInFile(const std::filesystem::path& path, const std::string& dll) {
     std::vector<unsigned char> bytes;
     {
         std::ifstream input(path, std::ios::binary);
-        if (!input) throw std::runtime_error("cannot open " + path);
+        if (!input) throw std::runtime_error("cannot open " + path.string());
         bytes.assign(std::istreambuf_iterator<char>(input), std::istreambuf_iterator<char>());
     }
     MoveImportFirst(bytes, dll);
     std::ofstream output(path, std::ios::binary | std::ios::trunc);
-    if (!output || !output.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()))) throw std::runtime_error("cannot write " + path);
+    if (!output || !output.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()))) throw std::runtime_error("cannot write " + path.string());
 }
 
 }
diff --git a/core/libs/allocator/PeImportFirst.hpp b/core/libs/allocator/PeImportFirst.hpp
index 30aa18cf7d..54db5101fc 100644
--- a/core/libs/allocator/PeImportFirst.hpp
+++ b/core/libs/allocator/PeImportFirst.hpp
@@ -1,13 +1,14 @@
 #ifndef CORE_LIBS_ALLOCATOR_PEIMPORTFIRST_HPP
 #define CORE_LIBS_ALLOCATOR_PEIMPORTFIRST_HPP
 
+#include <filesystem>
 #include <string>
 #include <vector>
 
 namespace Allocator {
 
 void MoveImportFirst(std::vector<unsigned char>& image, const std::string& dll);
-void MoveImportFirstInFile(const std::string& path, const std::string& dll);
+void MoveImportFirstInFile(const std::filesystem::path& path, const std::string& dll);
 
 }
 
diff --git a/core/libs/allocator/PeImportFirstMain.cpp b/core/libs/allocator/PeImportFirstMain.cpp
index 02ace8e22e..359c357674 100644
--- a/core/libs/allocator/PeImportFirstMain.cpp
+++ b/core/libs/allocator/PeImportFirstMain.cpp
@@ -2,17 +2,37 @@
 
 #include <cstdio>
 #include <exception>
+#include <filesystem>
+#include <string>
 
-int main(int argc, char** argv) {
-    if (argc != 3) {
-        std::fprintf(stderr, "usage: pe_import_first <file> <dll>\n");
-        return 2;
-    }
+namespace {
+
+int Usage() {
+    std::fprintf(stderr, "usage: pe_import_first <file> <dll>\n");
+    return 2;
+}
+
+int Run(const std::filesystem::path& file, const std::string& dll) {
     try {
-        Allocator::MoveImportFirstInFile(argv[1], argv[2]);
+        Allocator::MoveImportFirstInFile(file, dll);
     } catch (const std::exception& error) {
-        std::fprintf(stderr, "pe_import_first: %s: %s\n", argv[1], error.what());
+        std::fprintf(stderr, "pe_import_first: %s: %s\n", file.string().c_str(), error.what());
         return 1;
     }
     return 0;
 }
+
+}
+
+#ifdef _WIN32
+int wmain(int argc, wchar_t** argv) {
+    if (argc != 3) return Usage();
+    const auto dll = std::filesystem::path(argv[2]).u8string();
+    return Run(argv[1], std::string(dll.begin(), dll.end()));
+}
+#else
+int main(int argc, char** argv) {
+    if (argc != 3) return Usage();
+    return Run(argv[1], argv[2]);
+}
+#endif
diff --git a/core/libs/allocator/tests/PeImportFirstTests.cpp b/core/libs/allocator/tests/PeImportFirstTests.cpp
index 4df8aceed5..5d40857cdc 100644
--- a/core/libs/allocator/tests/PeImportFirstTests.cpp
+++ b/core/libs/allocator/tests/PeImportFirstTests.cpp
@@ -113,7 +113,7 @@ void movesTheNamedImportFirst() {
 void movesTheImportInAFile(const std::filesystem::path& directory) {
     const auto path = directory / "moved.dll";
     writeFile(path, image({"kernel32.dll", "mimalloc-redirect.dll"}));
-    Allocator::MoveImportFirstInFile(path.string(), "mimalloc-redirect.dll");
+    Allocator::MoveImportFirstInFile(path, "mimalloc-redirect.dll");
     const auto moved = readFile(path);
     require(importName(moved, 0) == "mimalloc-redirect.dll" && importName(moved, 1) == "kernel32.dll", "the file's import did not move first");
 }
@@ -122,7 +122,7 @@ void failsWithoutTouchingTheFile(const std::filesystem::path& directory, const s
     const auto path = directory / (what + ".dll");
     writeFile(path, bytes);
     try {
-        Allocator::MoveImportFirstInFile(path.string(), "mimalloc-redirect.dll");
+        Allocator::MoveImportFirstInFile(path, "mimalloc-redirect.dll");
     } catch (const std::exception& error) {
         require(std::string(error.what()).find(expected) != std::string::npos, what + ": failed with another error: " + error.what());
         require(readFile(path) == bytes, what + ": the file changed although the move failed");
@@ -134,7 +134,8 @@ void failsWithoutTouchingTheFile(const std::filesystem::path& directory, const s
 }
 
 int main() {
-    const auto directory = std::filesystem::temp_directory_path() / ("aps5-pe-import-first-" + std::to_string(std::random_device{}()));
+    auto directory = std::filesystem::temp_directory_path() / std::filesystem::path(u8"aps5-pe-import-first-a\u00e7\u00e3o-\u65e5\u672c-");
+    directory += std::to_string(std::random_device{}());
     try {
         std::filesystem::create_directories(directory);
         movesTheNamedImportFirst();
diff --git a/core/libs/nid/src/ExportExclusions.cpp b/core/libs/nid/src/ExportExclusions.cpp
index 273f517d3b..b02cd0dd24 100644
--- a/core/libs/nid/src/ExportExclusions.cpp
+++ b/core/libs/nid/src/ExportExclusions.cpp
@@ -175,7 +175,7 @@ std::unordered_set<std::string> ReadExportExclusions(const std::string& path) {
 }
 
 std::unordered_set<std::string> ReadExportList(const std::string& path) {
-    std::ifstream input(path, std::ios::binary);
+    std::ifstream input(Internal::NativePath(path), std::ios::binary);
     if (!input) throw std::runtime_error("cannot open export list: " + path);
     const auto text = ReadText(path, input);
     if (text.empty() || text.back() != '\n') throw std::runtime_error("malformed export list: " + path);
@@ -192,8 +192,8 @@ std::unordered_set<std::string> ReadExportList(const std::string& path) {
 
 bool WriteExportList(const std::string& referencePath, const std::string& path) {
     const auto text = FormatExportList(ReadExportExclusions(referencePath));
-    if (std::ifstream existing(path, std::ios::binary); existing && ReadText(path, existing) == text) return false;
-    std::ofstream output(path, std::ios::binary | std::ios::trunc);
+    if (std::ifstream existing(Internal::NativePath(path), std::ios::binary); existing && ReadText(path, existing) == text) return false;
+    std::ofstream output(Internal::NativePath(path), std::ios::binary | std::ios::trunc);
     if (!output) throw std::runtime_error("cannot write export list: " + path);
     output.write(text.data(), static_cast<std::streamsize>(text.size()));
     output.close();
diff --git a/core/libs/nid/tests/test_macho_nids.py b/core/libs/nid/tests/test_macho_nids.py
index a4a239fcbc..e49dc26e67 100644
--- a/core/libs/nid/tests/test_macho_nids.py
+++ b/core/libs/nid/tests/test_macho_nids.py
@@ -271,7 +271,7 @@ def check_refusals(patcher, directory):
 
 def main():
     patcher = Path(sys.argv[1]).resolve()
-    with tempfile.TemporaryDirectory(prefix="anyps5-macho-nid-") as directory:
+    with tempfile.TemporaryDirectory(prefix="anyps5-macho-nid-a\u00e7\u00e3o-\u65e5\u672c-") as directory:
         check_shrinking(patcher, directory)
         check_growing(patcher, directory)
         check_preserved(patcher, directory)
diff --git a/core/libs/prx/libSceAbstractLocal/libSceAbstractLocal.hpp b/core/libs/prx/libSceAbstractLocal/libSceAbstractLocal.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractLocal/libSceAbstractLocal.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractStorage/libSceAbstractStorage.hpp b/core/libs/prx/libSceAbstractStorage/libSceAbstractStorage.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractStorage/libSceAbstractStorage.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractTcs/libSceAbstractTcs.hpp b/core/libs/prx/libSceAbstractTcs/libSceAbstractTcs.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractTcs/libSceAbstractTcs.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractTwitter/libSceAbstractTwitter.hpp b/core/libs/prx/libSceAbstractTwitter/libSceAbstractTwitter.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractTwitter/libSceAbstractTwitter.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAbstractYoutube/libSceAbstractYoutube.hpp b/core/libs/prx/libSceAbstractYoutube/libSceAbstractYoutube.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAbstractYoutube/libSceAbstractYoutube.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAc3Enc/Export.cpp b/core/libs/prx/libSceAc3Enc/Export.cpp
index 4ee193119b..13a2ad92a5 100644
--- a/core/libs/prx/libSceAc3Enc/Export.cpp
+++ b/core/libs/prx/libSceAc3Enc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAc3Enc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAc3Enc/include/Api.hpp b/core/libs/prx/libSceAc3Enc/include/Api.hpp
new file mode 100644
index 0000000000..02d6fc4467
--- /dev/null
+++ b/core/libs/prx/libSceAc3Enc/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAc3EncCreateEncoder();
+int APS5_VABI sceAc3EncDeleteEncoder();
+int APS5_VABI sceAc3EncEncode();
+int APS5_VABI sceAc3EncEncodeAsync();
+int APS5_VABI sceAc3EncFlush();
+int APS5_VABI sceAc3EncIsEncoding();
+int APS5_VABI sceAc3EncWaitEncode();
+
+}
diff --git a/core/libs/prx/libSceAc3Enc/libSceAc3Enc.hpp b/core/libs/prx/libSceAc3Enc/libSceAc3Enc.hpp
new file mode 100644
index 0000000000..7addfec629
--- /dev/null
+++ b/core/libs/prx/libSceAc3Enc/libSceAc3Enc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAc3Enc/include/Api.hpp"
diff --git a/core/libs/prx/libSceAcm/Export.cpp b/core/libs/prx/libSceAcm/Export.cpp
index 914d474f0b..ddbe893628 100644
--- a/core/libs/prx/libSceAcm/Export.cpp
+++ b/core/libs/prx/libSceAcm/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAcm/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -217,7 +218,6 @@ int APS5_VABI sceAcm_IFFT() {
     return 0;
 }
 
-
 int APS5_VABI sceAcmBatchJobNotification() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAcm/include/Api.hpp b/core/libs/prx/libSceAcm/include/Api.hpp
new file mode 100644
index 0000000000..c4da065395
--- /dev/null
+++ b/core/libs/prx/libSceAcm/include/Api.hpp
@@ -0,0 +1,20 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAcmBatchStartBuffer(AcmContextId context, const void* batchCommands, size_t batchSize, AcmBatchError* batchError, AcmBatchId* batch);
+int APS5_VABI sceAcmBatchStartBuffers(AcmContextId context, uint32_t batchInfoCount, const AcmBatchInfo* const batch_info[], AcmBatchError* batchError, AcmBatchId* batch);
+int APS5_VABI sceAcmBatchWait(AcmContextId context, AcmBatchId batch, uint32_t timeout);
+int APS5_VABI sceAcmContextCreate(AcmContextId* context);
+int APS5_VABI sceAcmContextDestroy(AcmContextId context);
+int APS5_VABI sceAcm_ConvReverb_SharedInput(AcmBatchInfo* batch, std::uint32_t mode, AcmReverbInput* input, std::uint32_t outputCount, const AcmReverbFilter* const* filters, const float* gains, const AcmReverbOutput* const* outputs);
+int APS5_VABI sceAcm_FFT(AcmBatchInfo* batch, std::int32_t transformSize, std::uint32_t transformCount, std::int32_t inputFormat, const void* const* inputs, std::int32_t outputFormat, void* const* outputs, std::int32_t flags);
+int APS5_VABI sceAcm_Panner(AcmBatchInfo* batch, std::uint32_t sourceCount, const void* const* sources, std::uint32_t sourceMode, std::uint32_t outputMode, std::uint32_t channelCount, const void* const* sourceParameters, const void* const* sourceMatrices, const void* const* inputChannels, void* const* outputChannels);
+int APS5_VABI sceAcmBatchJobPriority(AcmBatchInfo* batch, std::uint32_t priority);
+int APS5_VABI sceAcm_ConvReverb_SharedIr();
+int APS5_VABI sceAcm_IFFT();
+int APS5_VABI sceAcmBatchJobNotification();
+
+}
diff --git a/core/libs/prx/libSceAcm/libSceAcm.hpp b/core/libs/prx/libSceAcm/libSceAcm.hpp
new file mode 100644
index 0000000000..a8b95eefbf
--- /dev/null
+++ b/core/libs/prx/libSceAcm/libSceAcm.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAcm/include/Api.hpp"
diff --git a/core/libs/prx/libSceAgc/Acb/include/Control.hpp b/core/libs/prx/libSceAgc/Acb/include/Control.hpp
index c22dc4e61e..e1862076c3 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Control.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Control.hpp
@@ -1,4 +1,26 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_CONTROL_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_CONTROL_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcAcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode, std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask, std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
+std::uint32_t* APS5_VABI sceAgcAcbJump(CommandBuffer* buf, std::uint8_t cachePolicy, const std::uint32_t* target, std::uint32_t sizeInDwords);
+uint32_t APS5_VABI sceAgcAcbJumpGetSize(void);
+uint32_t* APS5_VABI sceAgcAcbResetQueue(CommandBuffer* buf, uint32_t op, uint32_t value);
+std::uint32_t* APS5_VABI sceAgcAcbRewind(CommandBuffer* buf, std::uint32_t initialState);
+std::uint32_t APS5_VABI sceAgcAcbRewindGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbWaitUntilSafeForRendering(CommandBuffer* buf, std::uint32_t videoOutHandle, std::uint32_t displayBufferIndex);
+std::uint32_t* APS5_VABI sceAgcAcbSetFlip(CommandBuffer* buf, std::uint32_t videoOutHandle, std::int32_t displayBufferIndex, std::uint32_t flipMode, std::int64_t flipArg);
+std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadsActive(CommandBuffer* buf, std::uint32_t streamId, const std::uint32_t* workloadIds, std::uint32_t workloadCount);
+std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadComplete(CommandBuffer* buf, std::uint32_t streamId, std::uint32_t workloadId);
+std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadStreamInactive(CommandBuffer* buf, std::uint32_t streamId);
+uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, uint32_t color);
+uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf);
+uint32_t* APS5_VABI sceAgcAcbSetMarker(CommandBuffer* buf, const char* str, uint32_t color);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp b/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp
index e207781ef7..0915d7aad8 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Dispatch.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_DISPATCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_DISPATCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcAcbDispatchIndirect(CommandBuffer* buf, const volatile void* indirectArgs, uint32_t modifier);
+std::uint32_t APS5_VABI sceAgcAcbDispatchIndirectGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/include/Memory.hpp b/core/libs/prx/libSceAgc/Acb/include/Memory.hpp
index 78e8668cb0..93949715e6 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Memory.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Memory.hpp
@@ -1,4 +1,24 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_MEMORY_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_MEMORY_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcAcbAcquireMem(CommandBuffer* buf, std::uint32_t gcrControl, const volatile void* base, std::uint64_t sizeBytes, std::uint32_t pollCycles);
+uint32_t APS5_VABI sceAgcAcbAcquireMemGetSize(void);
+uint32_t* APS5_VABI sceAgcAcbCopyData(CommandBuffer* buf, uint8_t dst, uint8_t dstCachePolicy, uint64_t dstAddress, uint8_t src, uint8_t srcCachePolicy, uint64_t srcAddressOrImmediate, uint8_t itemSize, uint8_t writeConfirm);
+std::uint64_t APS5_VABI sceAgcAcbCopyDataGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbDmaData(CommandBuffer* buf, std::uint8_t dst, std::uint8_t dstCachePolicy, std::uint64_t dstAddress, std::uint8_t src, std::uint8_t srcCachePolicy, std::uint64_t srcAddress, std::uint32_t numBytes, std::uint8_t waitForPrevious, std::uint8_t writeConfirm);
+std::uint32_t APS5_VABI sceAgcAcbDmaDataGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbAtomicMem(CommandBuffer* buf, std::uint8_t atomicOp, std::uint8_t command, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t srcData, std::uint64_t compareData, std::uint16_t loopInterval);
+std::uint32_t APS5_VABI sceAgcAcbAtomicMemGetSize();
+std::uint32_t APS5_VABI sceAgcAcbAtomicGdsGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbPrimeUtcl2(CommandBuffer* buf, const volatile void* address, std::uint32_t sizeInBytes);
+std::uint32_t APS5_VABI sceAgcAcbPrimeUtcl2GetSize();
+std::uint32_t* APS5_VABI sceAgcAcbWriteData(CommandBuffer* buf, std::uint8_t dst, std::uint8_t cachePolicy, std::uint64_t address, const void* data, std::uint32_t numDwords, std::uint8_t increment, std::uint8_t writeConfirm);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/include/Sync.hpp b/core/libs/prx/libSceAgc/Acb/include/Sync.hpp
index ca3084b8b8..fb7a826139 100644
--- a/core/libs/prx/libSceAgc/Acb/include/Sync.hpp
+++ b/core/libs/prx/libSceAgc/Acb/include/Sync.hpp
@@ -1,4 +1,20 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_SYNC_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_ACB_INCLUDE_SYNC_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcAcbCondExec(CommandBuffer* buf, const volatile uint32_t* address, uint32_t numDwords);
+uint32_t APS5_VABI sceAgcAcbCondExecGetSize(void);
+std::uint32_t* APS5_VABI sceAgcAcbWaitRegMem(CommandBuffer* buf, std::uint8_t size, std::uint8_t compareFunction, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t reference, std::uint64_t mask, std::uint32_t pollCycles);
+std::uint64_t APS5_VABI sceAgcAcbWaitOnAddressGetSize(std::uint8_t size);
+std::uint32_t* APS5_VABI sceAgcAcbEventWrite(CommandBuffer* buf, std::uint8_t eventType, const volatile void* address);
+std::uint64_t APS5_VABI sceAgcAcbEventWriteGetSize(std::uint8_t eventType);
+std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize();
+std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Acb/src/Control.cpp b/core/libs/prx/libSceAgc/Acb/src/Control.cpp
index 567bfd5e18..1dd0314800 100644
--- a/core/libs/prx/libSceAgc/Acb/src/Control.cpp
+++ b/core/libs/prx/libSceAgc/Acb/src/Control.cpp
@@ -102,6 +102,18 @@ uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, uin
     return Agc::Marker::Push(buf, str, __func__);
 }
 
+uint32_t* APS5_VABI sceAgcAcbPushMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    return Agc::Marker::PushSpan(buf, str, length, __func__);
+}
+
+uint32_t* APS5_VABI sceAgcAcbSetMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    auto* packet = Agc::Marker::PushSpan(buf, str, length, __func__);
+    Agc::Marker::Pop(buf, __func__);
+    return packet;
+}
+
 uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf) {
     return Agc::Marker::Pop(buf, __func__);
 }
diff --git a/core/libs/prx/libSceAgc/Acb/src/Sync.cpp b/core/libs/prx/libSceAgc/Acb/src/Sync.cpp
index eee05b37c4..cb4ff7f5a6 100644
--- a/core/libs/prx/libSceAgc/Acb/src/Sync.cpp
+++ b/core/libs/prx/libSceAgc/Acb/src/Sync.cpp
@@ -44,10 +44,7 @@ std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize() {
     return 32;
 }
 
-std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, std::uint8_t action, std::uint8_t clientCode, const volatile void* address) {
-    const std::uint8_t operation = action != 0 ? 7u : 6u;
-    const std::uint8_t signalType = clientCode & 1u;
-    const std::uint8_t waitForMailbox = (clientCode >> 1u) & 1u;
+std::uint32_t* APS5_VABI sceAgcAcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation) {
     return Agc::Command::WriteMemSemaphore(buf, address, waitForMailbox, signalType, operation, __func__);
 }
 
diff --git a/core/libs/prx/libSceAgc/CMakeLists.txt b/core/libs/prx/libSceAgc/CMakeLists.txt
index faf498b571..9c26307068 100644
--- a/core/libs/prx/libSceAgc/CMakeLists.txt
+++ b/core/libs/prx/libSceAgc/CMakeLists.txt
@@ -157,7 +157,7 @@ add_test_executable(agc_register_command_tests EXCLUDE_FROM_ALL
         Patch/src/IndirectRegisters.cpp
 )
 target_include_directories(agc_register_command_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_register_command_tests PRIVATE libc)
+target_link_libraries(agc_register_command_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_register_command_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_register_command_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -176,7 +176,7 @@ add_test_executable(agc_cb_cond_write_tests EXCLUDE_FROM_ALL
         Cb/src/Branch.cpp
 )
 target_include_directories(agc_cb_cond_write_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_cb_cond_write_tests PRIVATE libc)
+target_link_libraries(agc_cb_cond_write_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_cb_cond_write_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_cb_cond_write_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -220,7 +220,7 @@ add_test_executable(agc_branch_patch_tests EXCLUDE_FROM_ALL
         Patch/src/Branch.cpp
 )
 target_include_directories(agc_branch_patch_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_branch_patch_tests PRIVATE libc)
+target_link_libraries(agc_branch_patch_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_branch_patch_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_branch_patch_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -240,7 +240,7 @@ add_test_executable(agc_predication_tests EXCLUDE_FROM_ALL
         Predication/src/Predication.cpp
 )
 target_include_directories(agc_predication_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_predication_tests PRIVATE libc)
+target_link_libraries(agc_predication_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_predication_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_predication_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -267,6 +267,19 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+add_test_executable(agc_instrumentation_query_size_tests EXCLUDE_FROM_ALL tests/InstrumentationQuerySize.cpp)
+target_include_directories(agc_instrumentation_query_size_tests PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(agc_instrumentation_query_size_tests PRIVATE libSceAgc libc)
+configure_windows_unwind(agc_instrumentation_query_size_tests)
+if(BUILD_TESTING)
+    set_target_properties(agc_instrumentation_query_size_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
+    add_test(NAME agc_instrumentation_query_size_tests COMMAND agc_instrumentation_query_size_tests)
+    if(WIN32)
+        set_tests_properties(agc_instrumentation_query_size_tests PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 add_test_executable(agc_context_state_size_tests EXCLUDE_FROM_ALL tests/ContextStateSize.cpp)
 target_include_directories(agc_context_state_size_tests PRIVATE ${LIBS_INCLUDE_DIR})
 target_link_libraries(agc_context_state_size_tests PRIVATE libSceAgc libc)
@@ -357,7 +370,7 @@ add_test_executable(agc_dma_data_tests EXCLUDE_FROM_ALL
         DcbFlow/src/Memory.cpp
 )
 target_include_directories(agc_dma_data_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_dma_data_tests PRIVATE libc)
+target_link_libraries(agc_dma_data_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_dma_data_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_dma_data_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -377,7 +390,7 @@ add_test_executable(agc_write_data_patch_tests EXCLUDE_FROM_ALL
         Patch/src/WaitRegMem.cpp
 )
 target_include_directories(agc_write_data_patch_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_write_data_patch_tests PRIVATE libc)
+target_link_libraries(agc_write_data_patch_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_write_data_patch_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_write_data_patch_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -397,7 +410,7 @@ add_test_executable(agc_prime_utcl2_tests EXCLUDE_FROM_ALL
         DcbState/src/Display.cpp
 )
 target_include_directories(agc_prime_utcl2_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_prime_utcl2_tests PRIVATE libc)
+target_link_libraries(agc_prime_utcl2_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_prime_utcl2_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_prime_utcl2_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
@@ -418,7 +431,7 @@ add_test_executable(agc_cond_exec_patch_tests EXCLUDE_FROM_ALL
         Patch/src/CondExec.cpp
 )
 target_include_directories(agc_cond_exec_patch_tests PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(agc_cond_exec_patch_tests PRIVATE libc)
+target_link_libraries(agc_cond_exec_patch_tests PRIVATE libSceAgcDriver libc)
 configure_windows_unwind(agc_cond_exec_patch_tests)
 if(BUILD_TESTING)
     set_target_properties(agc_cond_exec_patch_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
diff --git a/core/libs/prx/libSceAgc/Cb/include/Branch.hpp b/core/libs/prx/libSceAgc/Cb/include/Branch.hpp
index 5c74f02461..855d78d8ee 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Branch.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Branch.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_BRANCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_BRANCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbBranch(CommandBuffer* buf, std::uint8_t mode, std::uint8_t compareFunction, const volatile std::uint64_t* compareAddress, std::uint64_t mask, std::uint64_t reference, std::uint8_t cachePolicy1, const volatile std::uint32_t* buffer1, std::uint32_t sizeInDwords1, std::uint8_t cachePolicy2, const volatile std::uint32_t* buffer2, std::uint32_t sizeInDwords2);
+std::uint32_t APS5_VABI sceAgcCbBranchGetSize();
+std::uint32_t* APS5_VABI sceAgcCbCondWrite(CommandBuffer* buf, std::uint32_t compareFunction, std::uint32_t writeSpace, const volatile void* writeAddress, std::uint32_t writeData, const volatile void* pollAddress, std::uint32_t reference, std::uint32_t mask);
+std::uint32_t APS5_VABI sceAgcCbCondWriteGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp b/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp
index 5881aaf5a9..9f741d7e2e 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Dispatch.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_DISPATCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_DISPATCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbDispatch(CommandBuffer* buf, std::uint32_t threadGroupX, std::uint32_t threadGroupY, std::uint32_t threadGroupZ, std::uint32_t modifier);
+uint32_t APS5_VABI sceAgcCbDispatchGetSize(void);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Cb/include/Registers.hpp b/core/libs/prx/libSceAgc/Cb/include/Registers.hpp
index e5634b8ad6..d41e1beb42 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Registers.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Registers.hpp
@@ -1,4 +1,20 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_REGISTERS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_CB_INCLUDE_REGISTERS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbSetUcRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
+std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
+uint32_t APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize(uint32_t numValues);
+std::uint32_t APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize(std::uint32_t numValues);
+std::uint32_t* APS5_VABI sceAgcCbSetShRegistersDirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcCbSetShRegistersDirectGetSize(std::uint32_t numRegs);
+std::uint32_t* APS5_VABI sceAgcCbSetUcRegistersDirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcCbSetUcRegistersDirectGetSize(std::uint32_t numRegs);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Cb/include/Sync.hpp b/core/libs/prx/libSceAgc/Cb/include/Sync.hpp
index a070c6a5fc..d3be5f9083 100644
--- a/core/libs/prx/libSceAgc/Cb/include/Sync.hpp
+++ b/core/libs/prx/libSceAgc/Cb/include/Sync.hpp
@@ -4,10 +4,19 @@
 #include "SceTypes.hpp"
 #include <cstdint>
 
-struct CommandBuffer;
-
 extern "C" {
 std::uint32_t* APS5_VABI sceAgcCbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint32_t operation, std::uint32_t modifier, std::uint32_t value);
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcCbNop_nid_postfix(CommandBuffer* buf, std::uint32_t sizeInDwords);
+uint32_t APS5_VABI sceAgcCbNopGetSize(uint32_t sizeInDwords);
+std::uint32_t APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize();
+std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer* buf, std::uint8_t action, std::uint16_t gcrControl, std::uint8_t dst, std::uint8_t cachePolicy, const volatile Label* address, std::uint8_t dataSelect, std::uint64_t data, std::uint16_t gdsOffset, std::uint16_t gdsSize, std::uint8_t interrupt, std::uint32_t interruptContextId);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Command/src/Packet.cpp b/core/libs/prx/libSceAgc/Command/src/Packet.cpp
index 6ec0e12165..be43fb7028 100644
--- a/core/libs/prx/libSceAgc/Command/src/Packet.cpp
+++ b/core/libs/prx/libSceAgc/Command/src/Packet.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -67,6 +68,7 @@ void Reserve(CommandBuffer* buffer, std::uint32_t count, const char* function) {
 std::uint32_t* Allocate(CommandBuffer* buffer, std::uint32_t count, const char* function) {
     Reserve(buffer, count, function);
     auto* result = buffer->cursor_up;
+    AgcDriverPrepareCommandWrite_nid_no_patch(reinterpret_cast<std::uint64_t>(result), static_cast<std::size_t>(count) * sizeof(std::uint32_t));
     buffer->cursor_up += count;
     return result;
 }
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp
index e134de925d..1eede737f2 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp
@@ -1,4 +1,24 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWINDEXED_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWINDEXED_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndex(CommandBuffer* buf, std::uint32_t indexCount, const volatile void* indexAddress, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndexAuto(CommandBuffer* buf, std::uint32_t indexCount, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexAutoGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndexOffset(CommandBuffer* buf, std::uint32_t indexOffset, std::uint32_t indexCount, std::uint64_t modifier);
+uint32_t APS5_VABI sceAgcDcbDrawIndexOffsetGetSize(void);
+uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirect(CommandBuffer* buf, uint32_t dataOffsetInBytes, uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexIndirectGetSize();
+uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirectMulti(CommandBuffer* buf, uint32_t dataOffsetInBytes, uint32_t countIndirect, uint32_t maxCountOrCount, const volatile void* countAddr, uint32_t strideInBytes, uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize();
+uint32_t* APS5_VABI sceAgcDcbDrawIndexMultiInstanced(CommandBuffer* buf, uint32_t indexCount, const volatile void* indexAddr, const volatile void* objectIds, uint32_t instanceCount, uint64_t modifier);
+uint32_t APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize(void);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp
index 19705ed1f2..5ee0a26dc5 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWNONINDEXED_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_DRAWNONINDEXED_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndirect(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndirectGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDrawIndirectMulti(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint32_t countIndirect, std::uint32_t maxCountOrCount, const volatile void* countAddress, std::uint32_t strideInBytes, std::uint64_t modifier);
+std::uint32_t APS5_VABI sceAgcDcbDrawIndirectMultiGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp
index b90a2a40d6..652629217a 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp
@@ -1,4 +1,21 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INDEXBUFFER_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INDEXBUFFER_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexBuffer(CommandBuffer* buf, std::uint64_t indexAddress);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexBufferGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexCount(CommandBuffer* buf, std::uint32_t indexCount);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexCountGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexSize(CommandBuffer* buf, std::uint8_t indexSize, std::uint8_t cachePolicy);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexSizeGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexSize_0600(CommandBuffer* buf, std::uint8_t indexSize, std::uint8_t cachePolicy, std::uint8_t perInstanceObjectId);
+std::uint32_t* APS5_VABI sceAgcDcbSetIndexIndirectArgs(CommandBuffer* buf, std::uint64_t attributeAddress, std::uint32_t attributeIndex);
+std::uint32_t APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp
index b67b2b5bac..8f74423854 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/Instancing.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INSTANCING_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_INSTANCING_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbSetNumInstances(CommandBuffer* buf, std::uint32_t numInstances);
+std::uint32_t APS5_VABI sceAgcDcbSetNumInstancesGetSize();
+uint32_t* APS5_VABI sceAgcDcbSetBaseIndirectArgs(CommandBuffer* buf, uint32_t shaderType, const volatile void* indirectBaseAddr);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp b/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp
index a2bd44d8bc..de4d9fcf72 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/include/Stats.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_STATS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBDRAW_INCLUDE_STATS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbGetLodStats(CommandBuffer* buf, std::uint8_t cachePolicy, const volatile void* buffer, std::uint32_t bufferSizeInBytes, std::uint32_t resetCount, std::uint8_t forceReset, std::uint8_t reportAndReset, std::uint32_t reportingIntervalIn100kClocks);
+std::uint32_t APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize(std::int32_t queryType);
+std::uint32_t APS5_VABI sceAgcDcbEndOcclusionQueryGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbDraw/src/Stats.cpp b/core/libs/prx/libSceAgc/DcbDraw/src/Stats.cpp
index 2681834e0b..5a8ebdd44d 100644
--- a/core/libs/prx/libSceAgc/DcbDraw/src/Stats.cpp
+++ b/core/libs/prx/libSceAgc/DcbDraw/src/Stats.cpp
@@ -22,13 +22,12 @@ std::uint32_t* APS5_VABI sceAgcDcbGetLodStats(CommandBuffer* buf, std::uint8_t c
 }
 
 std::uint32_t APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize(std::int32_t queryType) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (queryType == 1) return 0x120u;
+    return queryType == 0 ? 0x10u : 0u;
 }
 
 std::uint32_t APS5_VABI sceAgcDcbEndOcclusionQueryGetSize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 0x10u;
 }
 
 }
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp
index 6ded533662..2890339f5b 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Control.hpp
@@ -9,4 +9,18 @@ std::uint32_t* APS5_VABI sceAgcDcbAtomicGds(CommandBuffer* buf, std::uint32_t co
 std::uint32_t* APS5_VABI sceAgcDcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode, std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask, std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbJump(CommandBuffer* buf, uint8_t mode, uint8_t cachePolicy, const uint32_t* target, uint32_t sizeInDwords);
+std::uint32_t APS5_VABI sceAgcDcbJumpGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbResetQueue(CommandBuffer* buf, std::uint32_t op, std::uint32_t state);
+std::uint32_t* APS5_VABI sceAgcDcbClearState(CommandBuffer* buf, std::uint32_t command);
+uint32_t* APS5_VABI sceAgcDcbRewind(CommandBuffer* buf, uint32_t initialState);
+uint32_t APS5_VABI sceAgcDcbRewindGetSize(void);
+uint32_t* APS5_VABI sceAgcDcbWaitUntilSafeForRendering(CommandBuffer* buf, uint32_t videoOutHandle, uint32_t displayBufferIndex);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp
index 025f84ad5c..4266a8cf60 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Dispatch.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_DISPATCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_DISPATCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbDispatchIndirect(CommandBuffer* buf, uint32_t dataOffsetInBytes, uint32_t flags);
+std::uint32_t APS5_VABI sceAgcDcbDispatchIndirectGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp
index f089c9a83e..e9202cd6b5 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Memory.hpp
@@ -9,4 +9,20 @@ std::uint32_t* APS5_VABI sceAgcDcbAcquireMem(CommandBuffer* buf, std::uint8_t en
 std::uint32_t APS5_VABI sceAgcDcbAtomicGdsGetSize();
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceAgcDcbAcquireMemGetSize(void);
+uint32_t* APS5_VABI sceAgcDcbCopyData(CommandBuffer* buf, uint8_t dst, uint8_t dstCachePolicy, uint64_t dstAddress, uint8_t src, uint8_t srcCachePolicy, uint64_t srcAddressOrImmediate, uint8_t itemSize, uint8_t writeConfirm);
+std::uint64_t APS5_VABI sceAgcDcbCopyDataGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer* buf, std::uint8_t engine, std::uint8_t dst, std::uint8_t dstCachePolicy, std::uint64_t dstAddress, std::uint8_t src, std::uint8_t srcCachePolicy, std::uint64_t srcAddress, std::uint32_t numBytes, std::uint8_t waitForPrevious, std::uint8_t writeConfirm, std::uint8_t blockEngine);
+std::uint32_t APS5_VABI sceAgcDcbDmaDataGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbAtomicMem(CommandBuffer* buf, std::uint8_t atomicOp, std::uint8_t command, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t srcData, std::uint64_t compareData, std::uint16_t loopInterval);
+std::uint32_t APS5_VABI sceAgcDcbAtomicMemGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer* buf, std::uint8_t dst, std::uint8_t cachePolicy, std::uint64_t address, const void* data, std::uint32_t numDwords, std::uint8_t increment, std::uint8_t writeConfirm);
+uint32_t APS5_VABI sceAgcDcbWriteDataGetSize(uint32_t numDwords);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp b/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp
index 6cad00334a..fa07f43e62 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/include/Sync.hpp
@@ -1,5 +1,21 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_SYNC_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBFLOW_INCLUDE_SYNC_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbCondExec(CommandBuffer* buf, const volatile uint32_t* address, uint32_t numDwords);
+uint32_t APS5_VABI sceAgcDcbCondExecGetSize(void);
+std::uint32_t* APS5_VABI sceAgcDcbWaitRegMem(CommandBuffer* buf, std::uint8_t size, std::uint8_t compareFunction, std::uint8_t operation, std::uint8_t cachePolicy, const volatile void* address, std::uint64_t reference, std::uint64_t mask, std::uint32_t pollCycles);
+uint32_t APS5_VABI sceAgcDcbWaitOnAddressGetSize(uint32_t size);
+std::uint32_t* APS5_VABI sceAgcDcbEventWrite(CommandBuffer* buf, std::uint8_t eventType, const volatile void* address);
+std::uint64_t APS5_VABI sceAgcDcbEventWriteGetSize(std::uint8_t eventType);
+std::uint32_t* APS5_VABI sceAgcDcbStallCommandBufferParser(CommandBuffer* buf);
+std::uint32_t APS5_VABI sceAgcDcbStallCommandBufferParserGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation);
+
+}
 
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp b/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp
index 96c45f0d3c..d3fb4b534b 100644
--- a/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp
+++ b/core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp
@@ -52,10 +52,7 @@ std::uint32_t APS5_VABI sceAgcDcbStallCommandBufferParserGetSize() {
     return 8;
 }
 
-std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, std::uint8_t action, std::uint8_t clientCode, const volatile void* address) {
-    const std::uint8_t operation = action != 0 ? 7u : 6u;
-    const std::uint8_t signalType = clientCode & 1u;
-    const std::uint8_t waitForMailbox = (clientCode >> 1u) & 1u;
+std::uint32_t* APS5_VABI sceAgcDcbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint8_t waitForMailbox, std::uint8_t signalType, std::uint8_t operation) {
     return Agc::Command::WriteMemSemaphore(buf, address, waitForMailbox, signalType, operation, __func__);
 }
 
diff --git a/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp b/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp
index 99d37d3c6a..19d2e85ba7 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/ContextState.hpp
@@ -4,8 +4,6 @@
 #include "SceTypes.hpp"
 #include <cstdint>
 
-struct CommandBuffer;
-
 extern "C" {
 
 uint32_t* APS5_VABI sceAgcDcbContextStateOp(CommandBuffer* buf, uint32_t operation);
@@ -14,4 +12,15 @@ uint64_t APS5_VABI sceAgcDcbContextStateOpGetSize(uint32_t operation);
 
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t APS5_VABI sceAgcDcbSetBaseDispatchIndirectArgsGetSize();
+std::uint32_t APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize();
+std::uint32_t APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize();
+std::uint32_t APS5_VABI sceAgcDcbGetLodStatsGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Display.hpp b/core/libs/prx/libSceAgc/DcbState/include/Display.hpp
index 74fb8caf0d..e6868d17f4 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Display.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Display.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_DISPLAY_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_DISPLAY_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetFlip(CommandBuffer* buf, uint32_t videoOutHandle, int32_t displayBufferIndex, uint32_t flipMode, int64_t flipArg);
+uint32_t* APS5_VABI sceAgcDcbPrimeUtcl2(CommandBuffer* buf, const volatile void* address, uint32_t sizeInBytes);
+std::uint32_t APS5_VABI sceAgcDcbPrimeUtcl2GetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Init.hpp b/core/libs/prx/libSceAgc/DcbState/include/Init.hpp
index de641fea3d..8e278b3fc3 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Init.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Init.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_INIT_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_INIT_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcInit(std::uint32_t version);
+int APS5_VABI sceAgcInit_0090(std::uint32_t* state, std::uint32_t version);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp b/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp
index c0ccfdea02..bb626aa02e 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Marker.hpp
@@ -7,8 +7,19 @@
 namespace Agc::Marker {
 
 std::uint32_t* Push(CommandBuffer* buf, const char* str, const char* function);
+std::uint32_t* PushSpan(CommandBuffer* buf, const char* str, std::uint32_t length, const char* function);
 std::uint32_t* Pop(CommandBuffer* buf, const char* function);
 
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetMarker(CommandBuffer* buf, const char* str, uint32_t color);
+uint32_t* APS5_VABI sceAgcDcbPopMarker(CommandBuffer* buf);
+uint32_t* APS5_VABI sceAgcDcbPushMarker(CommandBuffer* buf, const char* str, uint32_t color);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp b/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp
index 65f64a14eb..5d56b7066a 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Predication.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_PREDICATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_PREDICATION_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetPredication(CommandBuffer* buf, uint8_t condition, uint8_t op, uint8_t waitOp, const volatile void* address, uint32_t countInDwords);
+std::uint32_t APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize();
+std::uint32_t APS5_VABI sceAgcDcbSetPredicationDisableGetSize();
+std::uint32_t APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp b/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp
index b7beea1499..015d0ed7b2 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Registers.hpp
@@ -1,4 +1,26 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_REGISTERS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_REGISTERS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
+uint32_t* APS5_VABI sceAgcDcbSetCxRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+uint32_t APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize(void);
+std::uint32_t* APS5_VABI sceAgcDcbSetCxRegistersIndirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize(std::uint32_t numRegs);
+uint32_t* APS5_VABI sceAgcDcbSetShRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+std::uint32_t APS5_VABI sceAgcDcbSetShRegisterDirectGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetShRegistersIndirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize(std::uint32_t numRegs);
+uint32_t* APS5_VABI sceAgcDcbSetUcRegisterDirect(CommandBuffer* buf, ShaderRegister reg);
+std::uint32_t APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize();
+std::uint32_t* APS5_VABI sceAgcDcbSetUcRegistersIndirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
+std::uint32_t APS5_VABI sceAgcDcbSetUcRegistersIndirectGetSize(std::uint32_t numRegs);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp b/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp
index 3d5d6cac71..562ab7678f 100644
--- a/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp
+++ b/core/libs/prx/libSceAgc/DcbState/include/Workload.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_WORKLOAD_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_DCBSTATE_INCLUDE_WORKLOAD_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t* APS5_VABI sceAgcDcbSetWorkloadComplete(CommandBuffer* buf, uint32_t streamId, uint32_t workloadId);
+uint32_t* APS5_VABI sceAgcDcbSetWorkloadsActive(CommandBuffer* buf, uint32_t streamId, const uint32_t* workloadIds, uint32_t workloadCount);
+uint32_t* APS5_VABI sceAgcDcbSetWorkloadStreamInactive(CommandBuffer* buf, uint32_t streamId);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp b/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp
index 7e88856ccc..12304f16a3 100644
--- a/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp
+++ b/core/libs/prx/libSceAgc/DcbState/src/Marker.cpp
@@ -22,13 +22,21 @@ namespace Agc::Marker {
 std::uint32_t* Push(CommandBuffer* buf, const char* str, const char* function) {
     Agc::Command::Require(buf != nullptr, function, "null command buffer");
     const char* text = str ? str : "";
-    const std::size_t bytes = std::strlen(text) + 1;
+    const std::size_t length = std::strlen(text);
+    Agc::Command::Require(length < 0x10000u, function, "marker text too long");
+    return PushSpan(buf, text, static_cast<std::uint32_t>(length), function);
+}
+
+std::uint32_t* PushSpan(CommandBuffer* buf, const char* str, std::uint32_t length, const char* function) {
+    Agc::Command::Require(buf != nullptr, function, "null command buffer");
+    Agc::Command::Require(str != nullptr || length == 0, function, "null marker text");
+    const std::size_t bytes = std::size_t{length} + 1;
     const auto payload = static_cast<std::uint32_t>((bytes + 3) / 4);
     Agc::Command::Require(payload <= 0x4000u, function, "marker text too long");
     auto* packet = Agc::Command::Allocate(buf, payload + 1, function);
     packet[0] = Agc::Command::Header(OpcodeNop, payload + 1, CustomPushMarker << 2);
     std::memset(packet + 1, 0, payload * sizeof(std::uint32_t));
-    std::memcpy(packet + 1, text, bytes);
+    if (length != 0) std::memcpy(packet + 1, str, length);
     return packet;
 }
 
@@ -60,4 +68,16 @@ uint32_t* APS5_VABI sceAgcDcbPushMarker(CommandBuffer* buf, const char* str, uin
     return Agc::Marker::Push(buf, str, __func__);
 }
 
+uint32_t* APS5_VABI sceAgcDcbPushMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    return Agc::Marker::PushSpan(buf, str, length, __func__);
+}
+
+uint32_t* APS5_VABI sceAgcDcbSetMarkerSpan(CommandBuffer* buf, const char* str, uint32_t length, uint32_t color) {
+    (void)color;
+    auto* packet = Agc::Marker::PushSpan(buf, str, length, __func__);
+    Agc::Marker::Pop(buf, __func__);
+    return packet;
+}
+
 }
diff --git a/core/libs/prx/libSceAgc/Export.cpp b/core/libs/prx/libSceAgc/Export.cpp
index 8e933ec1cf..3bab548078 100644
--- a/core/libs/prx/libSceAgc/Export.cpp
+++ b/core/libs/prx/libSceAgc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/include/Agc.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAgc/Misc/include/Debug.hpp b/core/libs/prx/libSceAgc/Misc/include/Debug.hpp
index 58286eb85c..6647ed5d6a 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Debug.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Debug.hpp
@@ -1,4 +1,15 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_DEBUG_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_DEBUG_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDebugRaiseException(std::uint32_t exceptionId);
+int APS5_VABI sceAgcSetShaderInstrumentation(std::uint32_t flags);
+std::uint32_t APS5_VABI sceAgcGetShaderInstrumentation();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp b/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp
index 04a3d07eb6..29d7253eee 100644
--- a/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/PacketInfo.hpp
@@ -14,4 +14,14 @@ int APS5_VABI sceAgcGetDataPacketPayloadAddress(uint32_t** addr, uint32_t* cmd,
 int APS5_VABI sceAgcGetDataPacketPayloadAddress_0090(uint32_t** addr, uint32_t* cmd, int type);
 }
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceAgcGetPacketSize(uint32_t* packet);
+int APS5_VABI sceAgcGetDataPacketPayloadRange(SceAgcMemoryRange* range, uint32_t* cmd, int type);
+int APS5_VABI sceAgcDcbGetSystemSoftwareVersion(uint32_t* destination, const uint32_t* packet);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/Platform.hpp b/core/libs/prx/libSceAgc/Misc/include/Platform.hpp
index fd07f976ab..37e71bb0bd 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Platform.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Platform.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_PLATFORM_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_PLATFORM_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcGetIsTrinityMode(bool* isTrinityMode);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp b/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp
index c7eb4fea76..f8934d9fb0 100644
--- a/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/RegisterDefaults.hpp
@@ -4,6 +4,18 @@
 #include <cstdint>
 
 extern "C" {
-int APS5_VABI sceAgcGetDefaultCxStateFlat(void* out_state, std::uint32_t size);
+int APS5_VABI sceAgcGetDefaultCxStateFlat(void* outState, std::uint32_t size);
 }
+
+#include "SceShaders.hpp"
+
+extern "C" {
+
+void* APS5_VABI sceAgcGetRegisterDefaults();
+void* APS5_VABI sceAgcGetRegisterDefaultsInternal();
+void* APS5_VABI sceAgcGetRegisterDefaults2(std::uint32_t version);
+void* APS5_VABI sceAgcGetRegisterDefaults2Internal(std::uint32_t version);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp b/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp
index 834dcdd962..3f0602453c 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Semaphore.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SEMAPHORE_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SEMAPHORE_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes);
+int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp b/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp
index 0927dc9e51..d90e4d427e 100644
--- a/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/ShaderFusion.hpp
@@ -10,7 +10,16 @@ struct SizeAlign {
     std::size_t m_align;
 };
 
-extern "C" int APS5_VABI sceAgcFuseShaderHalves_0200(Shader* fused_result, const Shader* front, const Shader* back, void* scratch_mem);
+extern "C" int APS5_VABI sceAgcFuseShaderHalves_0200(Shader* fusedResult, const Shader* front, const Shader* back, void* scratchMem);
 extern "C" int APS5_VABI sceAgcGetFusedShaderSize_0080(SizeAlign* dst, const Shader* front, const Shader* back);
 
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcFuseShaderHalves_nid_postfix(Shader* fusedResult, const Shader* front, const Shader* back, void* scratchMem);
+int APS5_VABI sceAgcUpdateInterpolantMapping_0100(ShaderRegister* regs, const Shader* vs, const Shader* ps);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp b/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp
index 25b2dd5bf7..295d3761ce 100644
--- a/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp
+++ b/core/libs/prx/libSceAgc/Misc/include/Suspend.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SUSPEND_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_MISC_INCLUDE_SUSPEND_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSuspendPoint(void);
+int APS5_VABI sceAgcSetSubmitMode(std::uint32_t mode);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Misc/src/Debug.cpp b/core/libs/prx/libSceAgc/Misc/src/Debug.cpp
index 8a321110ab..a211959181 100644
--- a/core/libs/prx/libSceAgc/Misc/src/Debug.cpp
+++ b/core/libs/prx/libSceAgc/Misc/src/Debug.cpp
@@ -1,9 +1,16 @@
 #include "prx/libSceAgc/Misc/include/Debug.hpp"
 
+#include <atomic>
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+std::atomic<std::uint32_t> shaderInstrumentation{0};
+
+}
+
 extern "C" {
 
 int APS5_VABI sceAgcDebugRaiseException(std::uint32_t exceptionId) {
@@ -11,4 +18,13 @@ int APS5_VABI sceAgcDebugRaiseException(std::uint32_t exceptionId) {
     return 0;
 }
 
+int APS5_VABI sceAgcSetShaderInstrumentation(std::uint32_t flags) {
+    shaderInstrumentation.store(flags, std::memory_order_relaxed);
+    return 0;
+}
+
+std::uint32_t APS5_VABI sceAgcGetShaderInstrumentation() {
+    return shaderInstrumentation.load(std::memory_order_relaxed);
+}
+
 }
diff --git a/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp b/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp
index 3ff95978d3..c7ec65c170 100644
--- a/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp
+++ b/core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp
@@ -11,37 +11,55 @@
 
 namespace {
 
+constexpr int GRAPHICS5_ERROR_INVALID_ALIGNMENT = static_cast<int>(0x8a6c0002u);
+constexpr int GRAPHICS5_ERROR_OUT_OF_RANGE = static_cast<int>(0x8a6c000bu);
+constexpr int GRAPHICS5_ERROR_SEMAPHORE_MEMORY_REGISTERED = static_cast<int>(0x8a6c0048u);
+constexpr int GRAPHICS5_ERROR_SEMAPHORE_MEMORY_UNREGISTERED = static_cast<int>(0x8a6c0049u);
 constexpr std::uint64_t semaphoreMemoryAlignment = 0x4000u;
+constexpr std::uint64_t semaphoreMemoryLimit = 0x40000000u;
 constexpr std::uint64_t semaphoreLabelBytes = 32u;
 
 std::mutex semaphoreMutex;
 std::uint8_t* semaphoreMemory = nullptr;
 std::uint64_t semaphoreBytes = 0;
 
+bool aligned(std::uint64_t value) {
+    return (value & (semaphoreMemoryAlignment - 1u)) == 0;
+}
 
+int registerSemaphoreMemory(void* memory, std::uint64_t sizeInBytes, bool limited, const char* name) {
+    const auto address = reinterpret_cast<std::uintptr_t>(memory);
+    std::lock_guard lock(semaphoreMutex);
+    if (semaphoreBytes != 0) return GRAPHICS5_ERROR_SEMAPHORE_MEMORY_REGISTERED;
+    if (!aligned(sizeInBytes)) return GRAPHICS5_ERROR_INVALID_ALIGNMENT;
+    if (limited && sizeInBytes > semaphoreMemoryLimit) return GRAPHICS5_ERROR_OUT_OF_RANGE;
+    if (!aligned(address)) return GRAPHICS5_ERROR_INVALID_ALIGNMENT;
+    if (sizeInBytes != 0) {
+        Agc::Command::Require(memory != nullptr, name, "null semaphore memory with a non-zero size");
+        Agc::Command::Require(sizeInBytes - 1u <= std::numeric_limits<std::uintptr_t>::max() - address, name, "semaphore memory wraps the address space");
+        std::memset(memory, 0, sizeInBytes);
+    }
+    semaphoreMemory = static_cast<std::uint8_t*>(memory);
+    semaphoreBytes = sizeInBytes;
+    return 0;
+}
 
 }
 
 extern "C" {
 
 int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes) {
-    const auto address = reinterpret_cast<std::uintptr_t>(memory);
-    std::lock_guard lock(semaphoreMutex);
-    if (semaphoreBytes != 0) return static_cast<int>(0x8a6c0048u);
-    if (((address | sizeInBytes) & (semaphoreMemoryAlignment - 1u)) != 0) return static_cast<int>(0x8a6c0002u);
-    Agc::Command::Require(memory != nullptr && sizeInBytes != 0, __func__, "null or empty AMM semaphore memory; the console's error is unknown");
-    Agc::Command::Require(sizeInBytes - 1u <= std::numeric_limits<std::uintptr_t>::max() - address, __func__, "AMM semaphore memory wraps the address space");
-    auto* labels = static_cast<std::uint8_t*>(memory);
-    std::memset(labels, 0, sizeInBytes);
-    semaphoreMemory = labels;
-    semaphoreBytes = sizeInBytes;
-    return 0;
+    return registerSemaphoreMemory(memory, sizeInBytes, false, __func__);
+}
+
+int APS5_VABI sceAgcSetSemaphoreMemory(void* memory, std::uint64_t sizeInBytes) {
+    return registerSemaphoreMemory(memory, sizeInBytes, true, __func__);
 }
 
 int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label) {
     std::lock_guard lock(semaphoreMutex);
-    if (semaphoreBytes == 0) return static_cast<int>(0x8a6c0049u);
-    if (index >= semaphoreBytes / semaphoreLabelBytes) return static_cast<int>(0x8a6c000bu);
+    if (semaphoreBytes == 0) return GRAPHICS5_ERROR_SEMAPHORE_MEMORY_UNREGISTERED;
+    if (index >= semaphoreBytes / semaphoreLabelBytes) return GRAPHICS5_ERROR_OUT_OF_RANGE;
     Agc::Command::Require(label != nullptr, __func__, "null semaphore label output");
     *label = semaphoreMemory + static_cast<std::uint64_t>(index) * semaphoreLabelBytes;
     return 0;
diff --git a/core/libs/prx/libSceAgc/Patch/include/Branch.hpp b/core/libs/prx/libSceAgc/Patch/include/Branch.hpp
index f4b7c44624..2e13cbeab4 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Branch.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Branch.hpp
@@ -1,4 +1,17 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_BRANCH_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_BRANCH_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcBranchPatchSetCompareAddress(std::uint32_t* cmd, const volatile std::uint64_t* compareAddress);
+int APS5_VABI sceAgcBranchPatchSetThenTarget(std::uint32_t* cmd, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+int APS5_VABI sceAgcBranchPatchSetElseTarget(std::uint32_t* cmd, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+int APS5_VABI sceAgcBranchPatchSetThenTarget_0300(std::uint32_t* cmd, std::uint8_t cachePolicy, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+int APS5_VABI sceAgcBranchPatchSetElseTarget_0300(std::uint32_t* cmd, std::uint8_t cachePolicy, const volatile std::uint32_t* target, std::uint32_t sizeInDwords);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp b/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp
index 8d81efe673..6db4bcedb9 100644
--- a/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/CondExec.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_CONDEXEC_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_CONDEXEC_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCondExecPatchSetCommandAddress(uint32_t* cmd, const volatile uint32_t* command);
+int APS5_VABI sceAgcCondExecPatchSetEnd(uint32_t* cmd, const volatile uint32_t* buffer);
+int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress(std::uint32_t* cmd, const volatile std::uint32_t* command);
+int APS5_VABI sceAgcAsyncCondExecPatchSetEnd(std::uint32_t* cmd, const volatile std::uint32_t* buffer);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Dma.hpp b/core/libs/prx/libSceAgc/Patch/include/Dma.hpp
index d28d24df89..50dfc239b6 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Dma.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Dma.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_DMA_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_DMA_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset(std::uint32_t* cmd, std::uint64_t address);
+int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate(std::uint32_t* cmd, std::uint64_t address);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp b/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp
index 72863129b7..9de388c582 100644
--- a/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/IndirectRegisters.hpp
@@ -1,4 +1,21 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_INDIRECTREGISTERS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_INDIRECTREGISTERS_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress(std::uint32_t* cmd, const volatile ShaderRegister* regs);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress(std::uint32_t* cmd, const volatile ShaderRegister* regs);
+int APS5_VABI sceAgcSetShRegIndirectPatchSetNumRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetUcRegIndirectPatchAddRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress(std::uint32_t* cmd, const volatile ShaderRegister* regs);
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetNumRegisters(std::uint32_t* cmd, std::uint32_t numRegs);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Jump.hpp b/core/libs/prx/libSceAgc/Patch/include/Jump.hpp
index b5820f260d..1d6ba6899e 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Jump.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Jump.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_JUMP_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_JUMP_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcJumpPatchSetTarget(uint32_t* cmd, const volatile uint32_t* target, uint32_t sizeInDwords);
+int APS5_VABI sceAgcJumpPatchSetTarget_0300(uint32_t* cmd, uint64_t cachePolicy, const volatile uint32_t* target, uint32_t sizeInDwords);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Nop.hpp b/core/libs/prx/libSceAgc/Patch/include/Nop.hpp
index 9958a2cbc6..390c3de34c 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Nop.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Nop.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_NOP_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_NOP_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+std::uint32_t* APS5_VABI sceAgcSetNop(CommandBuffer* buf, std::uint32_t sizeDw);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp b/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp
index eb06c3a58d..7c7d61b7cc 100644
--- a/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp
@@ -1,4 +1,16 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_QUEUEENDOFPIPEACTION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_QUEUEENDOFPIPEACTION_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress(std::uint32_t* cmd, const volatile Label* address);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchData(uint32_t* cmd, uint64_t data);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl(std::uint32_t* cmd, std::uint16_t gcrControl);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchType(std::uint32_t* cmd, std::uint8_t action);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp b/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp
index 52e1bc2625..9752bd43da 100644
--- a/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/Rewind.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_REWIND_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_REWIND_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcRewindPatchSetRewindState(uint32_t* cmd, uint8_t state);
+int APS5_VABI sceAgcAsyncRewindPatchSetRewindState(std::uint32_t* cmd, std::uint8_t state);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp b/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp
index 8e14191a5e..0bdd3d5fd6 100644
--- a/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp
+++ b/core/libs/prx/libSceAgc/Patch/include/WaitRegMem.hpp
@@ -1,4 +1,22 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_WAITREGMEM_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PATCH_INCLUDE_WAITREGMEM_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcWaitRegMemPatchAddress(std::uint32_t* cmd, const volatile void* address);
+int APS5_VABI sceAgcWaitRegMemPatchReference(std::uint32_t* cmd, std::uint32_t reference);
+int APS5_VABI sceAgcWaitRegMemPatchMask(std::uint32_t* cmd, std::uint32_t mask);
+int APS5_VABI sceAgcWaitRegMemPatchCompareFunction(std::uint32_t* cmd, std::uint8_t compareFunction);
+int APS5_VABI sceAgcWriteDataPatchSetAddressOrOffset(std::uint32_t* cmd, std::uint64_t address);
+int APS5_VABI sceAgcAsyncWriteDataPatchSetAddressOrOffset(std::uint32_t* cmd, std::uint64_t address);
+int APS5_VABI sceAgcWriteDataPatchSetDst(std::uint32_t* cmd, std::uint8_t dst);
+int APS5_VABI sceAgcAsyncWriteDataPatchSetDst(std::uint32_t* cmd, std::uint8_t dst);
+int APS5_VABI sceAgcWriteDataPatchSetCachePolicy(std::uint32_t* cmd, std::uint8_t cachePolicy);
+int APS5_VABI sceAgcAsyncWriteDataPatchSetCachePolicy(std::uint32_t* cmd, std::uint8_t cachePolicy);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Predication/include/Predication.hpp b/core/libs/prx/libSceAgc/Predication/include/Predication.hpp
index 7ae84c8a76..cad10cd236 100644
--- a/core/libs/prx/libSceAgc/Predication/include/Predication.hpp
+++ b/core/libs/prx/libSceAgc/Predication/include/Predication.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_PREDICATION_INCLUDE_PREDICATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_PREDICATION_INCLUDE_PREDICATION_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSetPacketPredication(uint32_t* packet, uint32_t predication);
+int APS5_VABI sceAgcSetRangePredication(uint32_t* start, const volatile uint32_t* end, uint32_t predication);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp b/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp
index 68117f4735..044d288596 100644
--- a/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp
+++ b/core/libs/prx/libSceAgc/Shader/include/CreateShader.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_CREATESHADER_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_CREATESHADER_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCreateShader(Shader** dst, void* header, const volatile void* code);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/include/GsOversubscription.hpp b/core/libs/prx/libSceAgc/Shader/include/GsOversubscription.hpp
new file mode 100644
index 0000000000..b454416920
--- /dev/null
+++ b/core/libs/prx/libSceAgc/Shader/include/GsOversubscription.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcGetGsOversubscription(ShaderRegister* regs, const Shader* gs, std::uint32_t budget, float factor);
+
+}
diff --git a/core/libs/prx/libSceAgc/Shader/include/GsPrimPayload.hpp b/core/libs/prx/libSceAgc/Shader/include/GsPrimPayload.hpp
new file mode 100644
index 0000000000..d72b485767
--- /dev/null
+++ b/core/libs/prx/libSceAgc/Shader/include/GsPrimPayload.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcGetGsPrimPayload(std::uint32_t* payload, const Shader* gs);
+
+}
diff --git a/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp b/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp
index 91ffb9eeb8..7085d35fe0 100644
--- a/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp
+++ b/core/libs/prx/libSceAgc/Shader/include/InterpolantMapping.hpp
@@ -1,4 +1,17 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_INTERPOLANTMAPPING_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_INTERPOLANTMAPPING_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcCreateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcUpdateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+int APS5_VABI sceAgcUpdateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/include/LinkShaders.hpp b/core/libs/prx/libSceAgc/Shader/include/LinkShaders.hpp
new file mode 100644
index 0000000000..99d9e328a3
--- /dev/null
+++ b/core/libs/prx/libSceAgc/Shader/include/LinkShaders.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcLinkShaders(ShaderRegister* context, ShaderRegister* primitive, const void* reserved, const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
+
+}
diff --git a/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp b/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp
index 1dda27a825..090a9a78e6 100644
--- a/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp
+++ b/core/libs/prx/libSceAgc/Shader/include/PrimState.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_PRIMSTATE_HPP
 #define CORE_LIBS_PRX_LIBSCEAGC_SHADER_INCLUDE_PRIMSTATE_HPP
 
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcCreatePrimState(ShaderRegister* cxRegs, ShaderRegister* ucRegs, const Shader* hs, const Shader* gs, std::uint32_t primType);
+int APS5_VABI sceAgcUpdatePrimState(ShaderRegister* cxRegs, ShaderRegister* ucRegs, std::uint32_t primType);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp b/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp
index 029ec1c099..79209401f3 100644
--- a/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsOversubscription.hpp"
 #include <algorithm>
 #include <cmath>
 #include <cstdint>
diff --git a/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp b/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp
index 722ade98c6..2815c5a02b 100644
--- a/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/GsPrimPayload.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsPrimPayload.hpp"
 #include <cstdint>
 #include <stdexcept>
 #include <string>
diff --git a/core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp b/core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp
index 8e56d4c0c8..65b337d335 100644
--- a/core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp
@@ -53,12 +53,9 @@ std::uint32_t CreateInterpolantValueSplitF16(std::uint32_t psWord, const ShaderS
         : CreateInterpolantValue(psWord, gsSemantic);
 }
 
-std::uint32_t UpdateInterpolantValue(std::uint32_t psWord, const ShaderSemantic* gsSemantic) {
-    const std::uint32_t f16 = (psWord >> 20u) & 0x3u;
-    if (f16 != 0 && f16 != InterpolantF16HiOnly && ((psWord >> 28u) & 0x3u) != ((psWord >> 30u) & 0x3u)) {
-        throw std::runtime_error(std::string(__func__) + ": DEFAULT_VAL of an f16 input with different low and high defaults is unknown");
-    }
-    return CreateInterpolantValueSplitF16(psWord, gsSemantic);
+std::uint32_t CreateInterpolantValueFlatDefault(std::uint32_t psWord, const ShaderSemantic* gsSemantic) {
+    const std::uint32_t value = CreateInterpolantValue(psWord, gsSemantic);
+    return ((psWord & 0x00700000u) == 0x00400000u) ? (value | 0x00000020u) : value;
 }
 
 int CreateInterpolantMapping(const char* fn, ShaderRegister* regs, const Shader* gs, const Shader* ps, CreateInterpolantValueFn createValue, bool fillIdentityTail) {
@@ -132,7 +129,15 @@ int APS5_VABI sceAgcCreateInterpolantMapping_10000(ShaderRegister* regs, const S
 }
 
 int APS5_VABI sceAgcUpdateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps) {
-    return CreateInterpolantMapping(__func__, regs, gs, ps, UpdateInterpolantValue, false);
+    return CreateInterpolantMapping(__func__, regs, gs, ps, CreateInterpolantValueSplitF16, false);
+}
+
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps) {
+    return CreateInterpolantMapping(__func__, regs, gs, ps, CreateInterpolantValueFlatDefault, true);
+}
+
+int APS5_VABI sceAgcUpdateInterpolantMapping_nid_postfix(ShaderRegister* regs, const Shader* gs, const Shader* ps) {
+    return CreateInterpolantMapping(__func__, regs, gs, ps, CreateInterpolantValueFlatDefault, false);
 }
 
 }
diff --git a/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp b/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp
index 59a43354c8..8b6a8ff132 100644
--- a/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp
+++ b/core/libs/prx/libSceAgc/Shader/src/LinkShaders.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Shader/include/PrimState.hpp"
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
 #include "SceShaders.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ShaderPreparationScope.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -6,9 +9,6 @@
 #include <array>
 #include <algorithm>
 
-extern "C" int APS5_VABI sceAgcCreatePrimState(ShaderRegister*, ShaderRegister*, const Shader*, const Shader*, std::uint32_t);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister*, const Shader*, const Shader*);
-
 extern "C" int APS5_VABI sceAgcLinkShaders(ShaderRegister* context, ShaderRegister* primitive,
     const void* reserved, const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) {
     using namespace ShaderRegs;
diff --git a/core/libs/prx/libSceAgc/Unimplemented.cpp b/core/libs/prx/libSceAgc/Unimplemented.cpp
index 02dcc73aca..919f2d8b77 100644
--- a/core/libs/prx/libSceAgc/Unimplemented.cpp
+++ b/core/libs/prx/libSceAgc/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/include/Agc.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,49 +6,19 @@
 
 extern "C" {
 
-std::uint32_t* APS5_VABI sceAgcAcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-std::uint32_t* APS5_VABI sceAgcAcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
 int APS5_VABI sceAgcAcquireMemSetEngine(std::uint32_t* packet, std::uint8_t engine) {
  NotImplemented_nid_no_patch(__func__);
  return 0;
 }
 
-std::uint32_t* APS5_VABI sceAgcDcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-std::uint32_t* APS5_VABI sceAgcDcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-int APS5_VABI sceAgcSetSemaphoreMemory(void* memory, std::uint64_t size) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
 std::uint32_t* APS5_VABI sceAgcCbMemsetExclusive(CommandBuffer* buffer, void* destination, const void* pattern, std::uint64_t size) {
  NotImplemented_nid_no_patch(__func__);
  return 0;
 }
 
-int APS5_VABI sceAgcSetShaderInstrumentation(std::uint32_t flags) {
- NotImplemented_nid_no_patch(__func__);
- return 0;
-}
-
-int APS5_VABI sceAgcGetShaderInstrumentation() {
- NotImplemented_nid_no_patch(__func__);
- return 0;
+int APS5_VABI sceAgcAcbInitializeDefaultHardwareState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
 }
 
 }
diff --git a/core/libs/prx/libSceAgc/include/Agc.hpp b/core/libs/prx/libSceAgc/include/Agc.hpp
new file mode 100644
index 0000000000..e600558de3
--- /dev/null
+++ b/core/libs/prx/libSceAgc/include/Agc.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "SceShaders.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcSuspendPointAndCheckStatus(void);
+std::uint32_t* APS5_VABI sceAgcAcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+std::uint32_t* APS5_VABI sceAgcAcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+int APS5_VABI sceAgcAcquireMemSetEngine(std::uint32_t* packet, std::uint8_t engine);
+std::uint32_t* APS5_VABI sceAgcDcbPushMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+std::uint32_t* APS5_VABI sceAgcDcbSetMarkerSpan(CommandBuffer* buffer, const char* text, std::uint32_t length, std::uint32_t color);
+int APS5_VABI sceAgcSetSemaphoreMemory(void* memory, std::uint64_t size);
+std::uint32_t* APS5_VABI sceAgcCbMemsetExclusive(CommandBuffer* buffer, void* destination, const void* pattern, std::uint64_t size);
+
+int APS5_VABI sceAgcAcbInitializeDefaultHardwareState();
+
+}
diff --git a/core/libs/prx/libSceAgc/libSceAgc.hpp b/core/libs/prx/libSceAgc/libSceAgc.hpp
new file mode 100644
index 0000000000..407e5b809c
--- /dev/null
+++ b/core/libs/prx/libSceAgc/libSceAgc.hpp
@@ -0,0 +1,51 @@
+#pragma once
+
+#include "prx/libSceAgc/Acb/include/Control.hpp"
+#include "prx/libSceAgc/Acb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
+#include "prx/libSceAgc/Cb/include/Branch.hpp"
+#include "prx/libSceAgc/Cb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawNonIndexed.hpp"
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Instancing.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Stats.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Control.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Dispatch.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
+#include "prx/libSceAgc/DcbState/include/Display.hpp"
+#include "prx/libSceAgc/DcbState/include/Init.hpp"
+#include "prx/libSceAgc/DcbState/include/Marker.hpp"
+#include "prx/libSceAgc/DcbState/include/Predication.hpp"
+#include "prx/libSceAgc/DcbState/include/Registers.hpp"
+#include "prx/libSceAgc/DcbState/include/Workload.hpp"
+#include "prx/libSceAgc/include/Agc.hpp"
+#include "prx/libSceAgc/Misc/include/Debug.hpp"
+#include "prx/libSceAgc/Misc/include/PacketInfo.hpp"
+#include "prx/libSceAgc/Misc/include/Platform.hpp"
+#include "prx/libSceAgc/Misc/include/RegisterDefaults.hpp"
+#include "prx/libSceAgc/Misc/include/Semaphore.hpp"
+#include "prx/libSceAgc/Misc/include/ShaderFusion.hpp"
+#include "prx/libSceAgc/Misc/include/StaticBuffer.hpp"
+#include "prx/libSceAgc/Misc/include/Suspend.hpp"
+#include "prx/libSceAgc/Patch/include/Branch.hpp"
+#include "prx/libSceAgc/Patch/include/CondExec.hpp"
+#include "prx/libSceAgc/Patch/include/Dma.hpp"
+#include "prx/libSceAgc/Patch/include/IndirectRegisters.hpp"
+#include "prx/libSceAgc/Patch/include/Jump.hpp"
+#include "prx/libSceAgc/Patch/include/Nop.hpp"
+#include "prx/libSceAgc/Patch/include/QueueEndOfPipeAction.hpp"
+#include "prx/libSceAgc/Patch/include/Rewind.hpp"
+#include "prx/libSceAgc/Patch/include/WaitRegMem.hpp"
+#include "prx/libSceAgc/Predication/include/Predication.hpp"
+#include "prx/libSceAgc/Shader/include/CreateShader.hpp"
+#include "prx/libSceAgc/Shader/include/GsOversubscription.hpp"
+#include "prx/libSceAgc/Shader/include/GsPrimPayload.hpp"
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
+#include "prx/libSceAgc/Shader/include/PrimState.hpp"
diff --git a/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp b/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp
index bbc5416bd3..3315cd1312 100644
--- a/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp
+++ b/core/libs/prx/libSceAgc/tests/AtomicGdsSize.cpp
@@ -1,14 +1,11 @@
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <array>
 #include <cstdio>
 #include <cstdint>
 
-extern "C" std::uint32_t APS5_VABI sceAgcAcbAtomicGdsGetSize();
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode,
-    std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask,
-    std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
-
 int main() {
     constexpr std::uint32_t expectedSize = 11u * sizeof(std::uint32_t);
     if (sceAgcAcbAtomicGdsGetSize() != expectedSize) {
diff --git a/core/libs/prx/libSceAgc/tests/BranchPatch.cpp b/core/libs/prx/libSceAgc/tests/BranchPatch.cpp
index 58afe9b1c9..24c0f213b0 100644
--- a/core/libs/prx/libSceAgc/tests/BranchPatch.cpp
+++ b/core/libs/prx/libSceAgc/tests/BranchPatch.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/Patch/include/Branch.hpp"
+#include "prx/libSceAgc/Cb/include/Branch.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,16 +9,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcCbBranch(CommandBuffer*, std::uint8_t, std::uint8_t, const volatile std::uint64_t*, std::uint64_t, std::uint64_t, std::uint8_t, const volatile std::uint32_t*, std::uint32_t, std::uint8_t, const volatile std::uint32_t*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbBranchGetSize();
-int APS5_VABI sceAgcBranchPatchSetCompareAddress(std::uint32_t*, const volatile std::uint64_t*);
-int APS5_VABI sceAgcBranchPatchSetThenTarget(std::uint32_t*, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcBranchPatchSetElseTarget(std::uint32_t*, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcBranchPatchSetThenTarget_0300(std::uint32_t*, std::uint8_t, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcBranchPatchSetElseTarget_0300(std::uint32_t*, std::uint8_t, const volatile std::uint32_t*, std::uint32_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp b/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp
index 69186e10ba..f08ab6e67b 100644
--- a/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp
+++ b/core/libs/prx/libSceAgc/tests/CbCondWrite.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Cb/include/Branch.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <array>
@@ -5,11 +6,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcCbCondWrite(CommandBuffer*, std::uint32_t, std::uint32_t, const volatile void*, std::uint32_t, const volatile void*, std::uint32_t, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbCondWriteGetSize();
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/Commands.cpp b/core/libs/prx/libSceAgc/tests/Commands.cpp
index 88badb2189..a9ec29ed76 100644
--- a/core/libs/prx/libSceAgc/tests/Commands.cpp
+++ b/core/libs/prx/libSceAgc/tests/Commands.cpp
@@ -1,3 +1,23 @@
+#include "prx/libSceAgc/include/Agc.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Registration.hpp"
+#include "prx/libSceAgc/Patch/include/WaitRegMem.hpp"
+#include "prx/libSceAgc/Patch/include/Nop.hpp"
+#include "prx/libSceAgc/Misc/include/Suspend.hpp"
+#include "prx/libSceAgc/Misc/include/RegisterDefaults.hpp"
+#include "prx/libSceAgc/Misc/include/PacketInfo.hpp"
+#include "prx/libSceAgc/Misc/include/Debug.hpp"
+#include "prx/libSceAgc/DcbState/include/Workload.hpp"
+#include "prx/libSceAgc/DcbState/include/Marker.hpp"
+#include "prx/libSceAgc/DcbState/include/Init.hpp"
+#include "prx/libSceAgc/DcbState/include/Display.hpp"
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Control.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Instancing.hpp"
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libSceAgc/Command/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/RegisterDefaults.hpp"
@@ -10,53 +30,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbEventWrite(CommandBuffer* buf, std::uint8_t eventType, const volatile void* address);
-extern "C" std::uint64_t APS5_VABI sceAgcDcbEventWriteGetSize(std::uint8_t eventType);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbResetQueue(CommandBuffer* buf, std::uint32_t op, std::uint32_t state);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbClearState(CommandBuffer* buf, std::uint32_t command);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetFlip(CommandBuffer* buf, std::uint32_t handle, std::int32_t index, std::uint32_t mode, std::int64_t argument);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbWaitUntilSafeForRendering(CommandBuffer* buf, std::uint32_t handle, std::uint32_t index);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetFlip(CommandBuffer* buf, std::uint32_t handle, std::int32_t index, std::uint32_t mode, std::int64_t argument);
-extern "C" int APS5_VABI sceAgcSuspendPoint();
-extern "C" int APS5_VABI sceAgcInit(std::uint32_t version);
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults();
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults2(std::uint32_t version);
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaultsInternal();
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults2Internal(std::uint32_t version);
-extern "C" int APS5_VABI sceAgcGetDefaultCxStateFlat(void* out_state, std::uint32_t size);
-extern "C" int APS5_VABI sceAgcInit_0090(std::uint32_t* state, std::uint32_t version);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbDrawIndexAuto(CommandBuffer* buf, std::uint32_t indexCount, std::uint64_t modifier);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirect(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint64_t modifier);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbDrawIndexIndirectMulti(CommandBuffer* buf, std::uint32_t dataOffsetInBytes, std::uint32_t countIndirect, std::uint32_t maxCountOrCount, const volatile void* countAddress, std::uint32_t strideInBytes, std::uint64_t modifier);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchAddress(std::uint32_t* cmd, const volatile void* address);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchCompareFunction(std::uint32_t* cmd, std::uint8_t compareFunction);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchReference(std::uint32_t* cmd, std::uint32_t reference);
-extern "C" int APS5_VABI sceAgcWaitRegMemPatchMask(std::uint32_t* cmd, std::uint32_t mask);
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadAddress_0090(std::uint32_t** addr, std::uint32_t* cmd, int type);
-extern "C" std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbContextStateOp_0100(CommandBuffer* buf, std::uint32_t operation);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbPushMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbPopMarker(CommandBuffer* buf);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetWorkloadComplete(CommandBuffer* buf, std::uint32_t stream_id, std::uint32_t workload_id);
-extern "C" int APS5_VABI sceAgcDriverRegisterWorkloadStream(std::uint32_t stream_id, const void* stream);
-extern "C" int APS5_VABI sceAgcDriverUnregisterWorkloadStream(std::uint32_t stream_id);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetWorkloadsActive(CommandBuffer* buf, std::uint32_t stream_id, const std::uint32_t* workload_ids, std::uint32_t workload_count);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetWorkloadStreamInactive(CommandBuffer* buf, std::uint32_t streamId);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadsActive(CommandBuffer* buf, std::uint32_t streamId, const std::uint32_t* workloadIds, std::uint32_t workloadCount);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadComplete(CommandBuffer* buf, std::uint32_t streamId, std::uint32_t workloadId);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetWorkloadStreamInactive(CommandBuffer* buf, std::uint32_t streamId);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbSetMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetIndexBuffer(CommandBuffer* buf, std::uint64_t indexAddress);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetIndexIndirectArgs(CommandBuffer* buf, std::uint64_t attributeAddress, std::uint32_t attributeIndex);
-extern "C" std::uint32_t APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize();
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbSetBaseIndirectArgs(CommandBuffer* buf, std::uint32_t shaderType, const volatile void* indirectBaseAddr);
-extern "C" std::uint32_t* APS5_VABI sceAgcSetNop(CommandBuffer* buf, std::uint32_t sizeDw);
-extern "C" int APS5_VABI sceAgcDebugRaiseException(std::uint32_t exceptionId);
-extern "C" std::uint32_t* APS5_VABI sceAgcAcbAtomicGds_0900(CommandBuffer* buf, std::uint32_t control, std::uint32_t mode, std::uint32_t gdsOp, std::uint32_t src, std::uint16_t offset, std::uint16_t index, std::uint32_t mask, std::uint32_t data, std::uint64_t compareData, std::uint64_t extraData);
-
 namespace {
 
 void check(bool condition, const char* message) {
@@ -225,6 +198,29 @@ void testMarkers() {
     expectFailure([] { sceAgcAcbSetMarker(nullptr, "frame", 0); });
 }
 
+void testMarkerSpans() {
+    Storage dcb;
+    Storage acb;
+    const char text[] = "framebuffer";
+    const auto* acbPush = sceAgcAcbPushMarkerSpan(&acb.buffer, text, 5, 0x00ff00u);
+    const auto* dcbPush = sceAgcDcbPushMarkerSpan(&dcb.buffer, text, 5, 0xff0000u);
+    check(acbPush == acb.words.data() && acbPush[0] == Agc::Command::Header(0x10, 3, 0x0bu << 2u), "ACB push marker span header mismatch");
+    check(std::strcmp(reinterpret_cast<const char*>(acbPush + 1), "frame") == 0, "ACB push marker span does not stop at its length");
+    check(dcbPush == dcb.words.data(), "DCB push marker span did not return its packet");
+    const auto* acbSet = sceAgcAcbSetMarkerSpan(&acb.buffer, nullptr, 0, 0);
+    const auto* dcbSet = sceAgcDcbSetMarkerSpan(&dcb.buffer, nullptr, 0, 0);
+    check(acbSet == acb.words.data() + 3 && dcbSet == dcb.words.data() + 3, "set marker span did not return its push packet");
+    check(acbSet[0] == Agc::Command::Header(0x10, 2, 0x0bu << 2u) && acbSet[1] == 0 && acbSet[2] == Agc::Command::Header(0x10, 2, 0x0cu << 2u), "ACB set marker span is not a push and pop pair");
+    check(dcb.words == acb.words && acb.buffer.cursor_up == acb.words.data() + 7, "ACB and DCB marker spans differ");
+    Storage plain;
+    sceAgcAcbPushMarker(&plain.buffer, "frame", 0);
+    check(std::equal(plain.words.begin(), plain.words.begin() + 3, acb.words.begin()), "marker span differs from the same text pushed whole");
+    expectFailure([] { sceAgcAcbPushMarkerSpan(nullptr, "frame", 5, 0); });
+    expectFailure([] { sceAgcAcbPushMarker(nullptr, reinterpret_cast<const char*>(std::uintptr_t{0x10}), 0); });
+    expectFailure([] { sceAgcDcbSetMarkerSpan(nullptr, "frame", 5, 0); });
+    expectFailure([&] { sceAgcDcbPushMarkerSpan(&dcb.buffer, nullptr, 4, 0); });
+}
+
 void testWorkloads() {
     Storage dcb;
     const std::uint32_t ids[2] = {3, 4};
@@ -703,15 +699,13 @@ void testDefaults() {
     expectFailure([] { Agc::Command::GetRegisterDefaults(0xffffffffu, true, __func__); });
 }
 
-struct DefaultsType {
-    std::uint32_t key;
-    std::uint32_t bankIndex;
-};
+constexpr std::size_t PairEntryBytes = 8;
+constexpr std::size_t CompactEntryBytes = 12;
 
-std::uint32_t colourTargetBlock(const void* root) {
+std::uint32_t colourTargetBlock(const void* root, std::size_t entryBytes) {
     const auto* bytes = static_cast<const unsigned char*>(root);
     ShaderRegister** contextBlocks = nullptr;
-    const DefaultsType* types = nullptr;
+    const unsigned char* types = nullptr;
     std::uint32_t count = 0;
     std::memcpy(&contextBlocks, bytes, sizeof(contextBlocks));
     std::memcpy(&types, bytes + 0x30, sizeof(types));
@@ -721,12 +715,17 @@ std::uint32_t colourTargetBlock(const void* root) {
     std::uint32_t matches = 0;
     std::uint32_t block = 0;
     for (std::uint32_t entry = 0; entry < count; ++entry) {
-        if ((types[entry].bankIndex & 3u) == 0)
+        std::uint32_t key = 0;
+        std::uint32_t bankIndex = 0;
+        std::memcpy(&key, types + entry * entryBytes, sizeof(key));
+        std::memcpy(&bankIndex, types + entry * entryBytes + 4, sizeof(bankIndex));
+        bankIndex &= 0x3ffu;
+        if ((bankIndex & 3u) == 0)
             ++contexts;
-        if (types[entry].key != 0x38e92c91u)
+        if (key != 0x38e92c91u)
             continue;
-        check((types[entry].bankIndex & 3u) == 0, "MRT0 defaults are not in the context bank");
-        block = types[entry].bankIndex >> 2;
+        check((bankIndex & 3u) == 0, "MRT0 defaults are not in the context bank");
+        block = bankIndex >> 2;
         ++matches;
     }
     check(matches == 1 && block < contexts && contextBlocks[block] != nullptr, "MRT0 defaults key is missing, repeated or outside the context blocks");
@@ -739,7 +738,11 @@ std::uint32_t colourTargetBlock(const void* root) {
 void testDefaultsTypes() {
     const auto* legacy = sceAgcGetRegisterDefaults();
     check(legacy != sceAgcGetRegisterDefaults2(13), "legacy register defaults reused the compact versioned table");
-    check(colourTargetBlock(legacy) == 78, "MRT0 defaults are not block 78 of the 137-entry table");
+    check(colourTargetBlock(legacy, PairEntryBytes) == 78, "MRT0 defaults are not block 78 of the 137-entry table");
+    check(colourTargetBlock(sceAgcGetRegisterDefaults2(13), CompactEntryBytes) == 78, "versioned MRT0 defaults are not block 78 of the compact 137-entry table");
+    check(colourTargetBlock(sceAgcGetRegisterDefaults2(10), CompactEntryBytes) == 73, "versioned MRT0 defaults are not block 73 of the compact 128-entry table");
+    for (std::uint32_t version = 4; version < 14; ++version)
+        colourTargetBlock(sceAgcGetRegisterDefaults2(version), CompactEntryBytes);
 
     const auto checkCompactTypes = [](const void* root, std::uint32_t count, std::uint32_t key,
                                       std::uint32_t packedType, std::uint32_t extra) {
@@ -815,6 +818,7 @@ int main(int argc, char** argv) {
         testClearState();
         testIndexedIndirectDraws();
         testMarkers();
+        testMarkerSpans();
         testWorkloads();
         testWorkloadStreams();
         testIndexBuffer();
diff --git a/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp b/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp
index 762f40b1a7..b5939e0c46 100644
--- a/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp
+++ b/core/libs/prx/libSceAgc/tests/CondExecPatch.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Patch/include/CondExec.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,15 +10,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbCondExec(CommandBuffer*, const volatile std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcAcbCondExec(CommandBuffer*, const volatile std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcCondExecPatchSetCommandAddress(std::uint32_t*, const volatile std::uint32_t*);
-int APS5_VABI sceAgcCondExecPatchSetEnd(std::uint32_t*, const volatile std::uint32_t*);
-int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress(std::uint32_t*, const volatile std::uint32_t*);
-int APS5_VABI sceAgcAsyncCondExecPatchSetEnd(std::uint32_t*, const volatile std::uint32_t*);
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp b/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp
index 3de0a5eda6..6d2e583e47 100644
--- a/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp
+++ b/core/libs/prx/libSceAgc/tests/ContextStateSize.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -7,10 +8,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" std::uint64_t APS5_VABI sceAgcDcbContextStateOpGetSize(std::uint32_t operation);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbContextStateOp(CommandBuffer* buf, std::uint32_t operation);
-extern "C" std::uint32_t* APS5_VABI sceAgcDcbContextStateOp_0100(CommandBuffer* buf, std::uint32_t operation);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/DmaData.cpp b/core/libs/prx/libSceAgc/tests/DmaData.cpp
index 77c80988f2..880035d394 100644
--- a/core/libs/prx/libSceAgc/tests/DmaData.cpp
+++ b/core/libs/prx/libSceAgc/tests/DmaData.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,13 +9,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcAcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t APS5_VABI sceAgcAcbDmaDataGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t, std::uint8_t);
-std::uint32_t APS5_VABI sceAgcDcbDmaDataGetSize();
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp b/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp
index cf78ada4a3..5421cb5733 100644
--- a/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp
+++ b/core/libs/prx/libSceAgc/tests/EndOfShaderActionSize.cpp
@@ -1,3 +1,8 @@
+#include "prx/libSceAgc/DcbState/include/ContextState.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Control.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -8,15 +13,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize();
-std::uint32_t APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize();
-std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer*, std::uint8_t, std::uint16_t, std::uint8_t, std::uint8_t, const volatile Label*, std::uint8_t, std::uint64_t, std::uint16_t, std::uint16_t, std::uint8_t, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbAtomicGdsGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbAtomicGds_0900(CommandBuffer*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint16_t, std::uint16_t, std::uint32_t, std::uint32_t, std::uint64_t, std::uint64_t);
-std::uint32_t* APS5_VABI sceAgcDcbAtomicGds(CommandBuffer*, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint16_t, std::uint16_t, std::uint32_t, std::uint32_t, std::uint64_t, std::uint64_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp b/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp
index 7c312c879d..3666a2d338 100644
--- a/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp
+++ b/core/libs/prx/libSceAgc/tests/GsOversubscription.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsOversubscription.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -11,8 +12,6 @@
 #include <limits>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceAgcGetGsOversubscription(ShaderRegister* regs, const Shader* gs, std::uint32_t budget, float factor);
-
 namespace {
 
 using Registers = std::array<ShaderRegister, 2>;
diff --git a/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp b/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp
index 60f3d29b77..396311e9ee 100644
--- a/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp
+++ b/core/libs/prx/libSceAgc/tests/GsPrimPayload.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/GsPrimPayload.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -9,8 +10,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" int APS5_VABI sceAgcGetGsPrimPayload(std::uint32_t* payload, const Shader* gs);
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xccccccccu;
diff --git a/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp b/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp
new file mode 100644
index 0000000000..66e572d0b6
--- /dev/null
+++ b/core/libs/prx/libSceAgc/tests/InstrumentationQuerySize.cpp
@@ -0,0 +1,43 @@
+#include "prx/libSceAgc/Misc/include/Debug.hpp"
+#include "prx/libSceAgc/DcbDraw/include/Stats.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libc/include/Shutdown.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <stdexcept>
+
+namespace {
+
+void check(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void testShaderInstrumentation() {
+    check(sceAgcGetShaderInstrumentation() == 0, "shader instrumentation starts cleared");
+    check(sceAgcSetShaderInstrumentation(0x80000005u) == 0, "setting shader instrumentation failed");
+    check(sceAgcGetShaderInstrumentation() == 0x80000005u, "shader instrumentation flags were not kept");
+    check(sceAgcSetShaderInstrumentation(0) == 0 && sceAgcGetShaderInstrumentation() == 0, "shader instrumentation was not cleared");
+}
+
+void testOcclusionQuerySizes() {
+    check(sceAgcDcbBeginOcclusionQueryGetSize(0) == 0x10u, "begin occlusion query size for type 0");
+    check(sceAgcDcbBeginOcclusionQueryGetSize(1) == 0x120u, "begin occlusion query size for type 1");
+    check(sceAgcDcbBeginOcclusionQueryGetSize(2) == 0, "begin occlusion query size for an unknown type");
+    check(sceAgcDcbEndOcclusionQueryGetSize() == 0x10u, "end occlusion query size");
+}
+
+}
+
+int main() {
+    try {
+        testShaderInstrumentation();
+        testOcclusionQuerySizes();
+        LibcRunShutdown_nid_postfix();
+        std::puts("AGC shader instrumentation and occlusion query size tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp b/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp
index 652eacfea7..2fbd372623 100644
--- a/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp
+++ b/core/libs/prx/libSceAgc/tests/InterpolantMapping.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -11,10 +12,6 @@
 #include <stdexcept>
 #include <span>
 
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-extern "C" int APS5_VABI sceAgcUpdateInterpolantMapping_10000(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-
 namespace {
 
 using Registers = std::array<ShaderRegister, 32>;
@@ -158,13 +155,46 @@ void testUpdateMapping() {
     check(std::memcmp(create.data(), update.data(), written) == 0, "update differs from the split f16 mapping");
     checkIdentity(create, static_cast<std::uint32_t>(inputs.size()), "unused interpolants are not the identity");
 
-    for (const std::uint32_t index : {1u, 3u}) {
-        inputs[index].default_value = 0;
-        update = filled();
-        expectFailure([&] { sceAgcUpdateInterpolantMapping_10000(update.data(), &gs, &ps); });
-        check(std::memcmp(update.data(), untouched.data(), sizeof(update)) == 0, "rejected update wrote registers");
-        inputs[index].default_value = inputs[index].default_value_hi;
+    inputs[1].default_value = 0;
+    inputs[3].default_value = 0;
+    update = filled();
+    check(sceAgcUpdateInterpolantMapping_10000(update.data(), &gs, &ps) == 0, "update with split f16 defaults failed");
+    check(update[1].value == 0x01380007u && update[3].value == 0x03680409u, "f16 DEFAULT_VAL does not come from the low default");
+}
+
+void testUnversionedMapping() {
+    std::array<ShaderSemantic, 5> inputs{
+        semantic(1, 0, 2), semantic(2, 0, 2), semantic(5, 0, 2), semantic(3, 0, 0), semantic(4, 0, 3)};
+    inputs[0].is_flat_shaded = 1;
+    inputs[0].default_value = 1;
+    inputs[0].default_value_hi = 3;
+    inputs[1].default_value_hi = 1;
+    inputs[2].is_flat_shaded = 1;
+    inputs[2].default_value_hi = 2;
+    inputs[3].is_flat_shaded = 1;
+    inputs[3].default_value = 2;
+    std::array<ShaderSemantic, 4> outputs{semantic(1, 7, 3), semantic(2, 4, 1), semantic(3, 9, 0), semantic(4, 2, 1)};
+    Shader gs{};
+    gs.output_semantics = outputs.data();
+    gs.num_output_semantics = static_cast<std::uint16_t>(outputs.size());
+    Shader ps{};
+    ps.input_semantics = inputs.data();
+    ps.num_input_semantics = static_cast<std::uint32_t>(inputs.size());
+    const std::array<std::uint32_t, 5> flatDefault{0x02680527u, 0x02380024u, 0x02580020u, 0x00000629u, 0x03180002u};
+    const std::size_t written = inputs.size() * sizeof(ShaderRegister);
+    const auto untouched = filled();
+
+    auto create = filled();
+    check(sceAgcCreateInterpolantMapping_nid_postfix(create.data(), &gs, &ps) == 0, "unversioned mapping failed");
+    for (std::uint32_t i = 0; i < inputs.size(); ++i) {
+        check(create[i].offset == ShaderRegs::SPI_PS_INPUT_CNTL_0 + i && create[i].value == flatDefault[i], "unversioned mapping changed");
     }
+    checkIdentity(create, static_cast<std::uint32_t>(inputs.size()), "unused interpolants are not the identity");
+
+    auto update = filled();
+    check(sceAgcUpdateInterpolantMapping_nid_postfix(update.data(), &gs, &ps) == 0, "unversioned update failed");
+    check(std::memcmp(update.data(), create.data(), written) == 0, "unversioned update differs from its mapping");
+    check(std::memcmp(update.data() + inputs.size(), untouched.data(), sizeof(update) - written) == 0, "unversioned update wrote past its inputs");
 }
 
 void testRejections() {
@@ -208,8 +238,9 @@ int main() {
         testIdentity();
         testMapping();
         testUpdateMapping();
+        testUnversionedMapping();
         testRejections();
-        check(mappings == 7u && links == 5u, "mapping preparation call count changed");
+        check(mappings == 10u && links == 8u, "mapping preparation call count changed");
         LibcRunShutdown_nid_postfix();
         std::puts("AGC interpolant mapping tests passed");
         return 0;
diff --git a/core/libs/prx/libSceAgc/tests/PacketInfo.cpp b/core/libs/prx/libSceAgc/tests/PacketInfo.cpp
index 5e95906b5a..9054c828ba 100644
--- a/core/libs/prx/libSceAgc/tests/PacketInfo.cpp
+++ b/core/libs/prx/libSceAgc/tests/PacketInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Misc/include/PacketInfo.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 
@@ -7,8 +8,6 @@
 #include <stdexcept>
 #include <utility>
 
-extern "C" std::uint32_t APS5_VABI sceAgcGetPacketSize(std::uint32_t* packet);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/PayloadRange.cpp b/core/libs/prx/libSceAgc/tests/PayloadRange.cpp
index f920eb0384..d070135e43 100644
--- a/core/libs/prx/libSceAgc/tests/PayloadRange.cpp
+++ b/core/libs/prx/libSceAgc/tests/PayloadRange.cpp
@@ -8,10 +8,6 @@
 #include <stdexcept>
 #include <tuple>
 
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadRange(SceAgcMemoryRange* range, std::uint32_t* cmd, int type);
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadAddress(std::uint32_t** addr, std::uint32_t* cmd, int type);
-extern "C" int APS5_VABI sceAgcGetDataPacketPayloadAddress_0090(std::uint32_t** addr, std::uint32_t* cmd, int type);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/Platform.cpp b/core/libs/prx/libSceAgc/tests/Platform.cpp
index daa0634cf3..5ed2b2aea1 100644
--- a/core/libs/prx/libSceAgc/tests/Platform.cpp
+++ b/core/libs/prx/libSceAgc/tests/Platform.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Misc/include/Platform.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 
@@ -5,8 +6,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceAgcGetIsTrinityMode(bool* isTrinityMode);
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/Predication.cpp b/core/libs/prx/libSceAgc/tests/Predication.cpp
index 32a6619ed5..7d9511f10f 100644
--- a/core/libs/prx/libSceAgc/tests/Predication.cpp
+++ b/core/libs/prx/libSceAgc/tests/Predication.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Predication/include/Predication.hpp"
+#include "prx/libSceAgc/DcbState/include/Predication.hpp"
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <array>
@@ -5,17 +8,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbSetPredication(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, const volatile void*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetPredicationDisableGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbSetIndexCount(CommandBuffer*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetIndexBuffer(CommandBuffer*, std::uint64_t);
-int APS5_VABI sceAgcSetPacketPredication(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetRangePredication(std::uint32_t*, const volatile std::uint32_t*, std::uint32_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp b/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp
index b1e702d246..4e7791491c 100644
--- a/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp
+++ b/core/libs/prx/libSceAgc/tests/PrimeUtcl2.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/DcbState/include/Display.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,13 +9,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcAcbPrimeUtcl2(CommandBuffer*, const volatile void*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcAcbPrimeUtcl2GetSize();
-std::uint32_t* APS5_VABI sceAgcDcbPrimeUtcl2(CommandBuffer*, const volatile void*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbPrimeUtcl2GetSize();
-}
-
 namespace {
 
 constexpr std::uint32_t Sentinel = 0xabcdef01u;
diff --git a/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp b/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp
index 5e6be0c709..985ed914f6 100644
--- a/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp
+++ b/core/libs/prx/libSceAgc/tests/RegisterCommands.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Patch/include/IndirectRegisters.hpp"
+#include "prx/libSceAgc/DcbState/include/Registers.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -5,35 +8,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t* APS5_VABI sceAgcDcbSetCfRegisterRangeDirect(CommandBuffer*, std::uint32_t, const std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer*, std::uint32_t, const std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbSetUcRegisterRangeDirect(CommandBuffer*, std::uint32_t, const std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetCxRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t* APS5_VABI sceAgcDcbSetShRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t* APS5_VABI sceAgcDcbSetUcRegisterDirect(CommandBuffer*, ShaderRegister);
-std::uint32_t APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetShRegisterDirectGetSize();
-std::uint32_t APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbSetCxRegistersIndirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetShRegistersIndirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbSetUcRegistersIndirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetUcRegistersIndirectGetSize(std::uint32_t);
-int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetShRegIndirectPatchSetNumRegisters(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetUcRegIndirectPatchSetNumRegisters(std::uint32_t*, std::uint32_t);
-int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress(std::uint32_t*, const volatile ShaderRegister*);
-int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress(std::uint32_t*, const volatile ShaderRegister*);
-int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress(std::uint32_t*, const volatile ShaderRegister*);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegistersDirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbSetUcRegistersDirect(CommandBuffer*, const volatile ShaderRegister*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbSetShRegistersDirectGetSize(std::uint32_t);
-std::uint32_t APS5_VABI sceAgcCbSetUcRegistersDirectGetSize(std::uint32_t);
-}
-
 namespace {
 
 void check(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgc/tests/Semaphore.cpp b/core/libs/prx/libSceAgc/tests/Semaphore.cpp
index 789a303ad8..3d4ff1c16d 100644
--- a/core/libs/prx/libSceAgc/tests/Semaphore.cpp
+++ b/core/libs/prx/libSceAgc/tests/Semaphore.cpp
@@ -1,3 +1,8 @@
+#include "prx/libSceAgc/include/Agc.hpp"
+#include "prx/libSceAgc/Misc/include/Semaphore.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -12,20 +17,19 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" int APS5_VABI sceAgcSetAmmSemaphoreMemory(void* memory, std::uint64_t sizeInBytes);
-extern "C" int APS5_VABI sceAgcGetSemaphoreLabel(std::uint32_t index, void** label);
-extern "C" std::uint32_t* APS5_VABI sceAgcCbMemSemaphore(CommandBuffer* buf, const volatile void* address, std::uint32_t operation, std::uint32_t modifier, std::uint32_t value);
-
 namespace {
 
 constexpr std::uint64_t blockBytes = 0x4000u;
 constexpr std::uint64_t labelBytes = 32u;
-constexpr std::uint64_t counterBytes = 8u;
 constexpr std::uint64_t memoryBytes = 2u * blockBytes;
 constexpr std::uint64_t storageBytes = 4u * blockBytes;
 constexpr std::uint32_t labelCount = static_cast<std::uint32_t>(memoryBytes / labelBytes);
 constexpr std::uint8_t guardByte = 0xa5u;
-constexpr std::uint8_t counterByte = 0x5au;
+constexpr std::uint8_t labelByte = 0x5au;
+constexpr int InvalidAlignment = static_cast<int>(0x8a6c0002u);
+constexpr int OutOfRange = static_cast<int>(0x8a6c000bu);
+constexpr int AlreadyRegistered = static_cast<int>(0x8a6c0048u);
+constexpr int NotRegistered = static_cast<int>(0x8a6c0049u);
 
 struct AlignedRelease {
     void operator()(std::uint8_t* memory) const { ::operator delete(memory, std::align_val_t{blockBytes}); }
@@ -62,28 +66,28 @@ void checkUnchanged(const std::vector<std::uint8_t>& before, const char* message
 
 void fillStorage() {
     std::fill(storage.get(), storage.get() + storageBytes, guardByte);
-    for (std::uint64_t label = 0; label < memoryBytes; label += labelBytes) {
-        std::fill(memory() + label, memory() + label + counterBytes, counterByte);
-        std::fill(memory() + label + counterBytes, memory() + label + labelBytes, std::uint8_t{0});
-    }
+    std::fill(memory(), memory() + memoryBytes, labelByte);
 }
 
 void testUnregistered() {
     std::array<void*, 3> labels{storage.get(), storage.get(), storage.get()};
-    check(sceAgcGetSemaphoreLabel(0, &labels[1]) == static_cast<int>(0x8a6c0049u), "unregistered label error mismatch");
-    check(sceAgcGetSemaphoreLabel(0, nullptr) == static_cast<int>(0x8a6c0049u), "unregistered null label error mismatch");
+    check(sceAgcGetSemaphoreLabel(0, &labels[1]) == NotRegistered, "a lookup before registration was not rejected as unregistered");
+    check(sceAgcGetSemaphoreLabel(0, nullptr) == NotRegistered, "a null lookup before registration was not rejected as unregistered");
     check(labels[0] == storage.get() && labels[1] == storage.get() && labels[2] == storage.get(), "a rejected semaphore label changed the output");
 }
 
 void testRegistrationRejections() {
     const auto before = snapshot();
     expectFailure([] { sceAgcSetAmmSemaphoreMemory(nullptr, memoryBytes); });
-    expectFailure([] { sceAgcSetAmmSemaphoreMemory(nullptr, 0); });
-    expectFailure([] { sceAgcSetAmmSemaphoreMemory(memory(), 0); });
-    check(sceAgcSetAmmSemaphoreMemory(memory() + 1, memoryBytes) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(memory() + labelBytes, blockBytes) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes - 1u) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes + labelBytes) == static_cast<int>(0x8a6c0002u), "unaligned semaphore memory error mismatch");
+    check(sceAgcSetAmmSemaphoreMemory(memory() + 1, memoryBytes) == InvalidAlignment, "unaligned memory was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(memory() + labelBytes, blockBytes) == InvalidAlignment, "memory aligned only to a label was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes - 1u) == InvalidAlignment, "an unaligned size was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(memory(), blockBytes + labelBytes) == InvalidAlignment, "a size aligned only to a label was not rejected");
+    check(sceAgcSetSemaphoreMemory(memory() + 1, blockBytes) == InvalidAlignment, "unaligned memory was not rejected by the non-AMM call");
+    check(sceAgcSetSemaphoreMemory(memory(), 0x40000000u + blockBytes) == OutOfRange, "a size above 1 GiB was not rejected by the non-AMM call");
+    check(sceAgcSetSemaphoreMemory(memory() + 1, 0x40000000u + blockBytes) == OutOfRange, "the size limit was not checked before the memory alignment");
+    check(sceAgcSetSemaphoreMemory(memory(), blockBytes - 1u) == InvalidAlignment, "the size alignment was not checked first");
+    check(sceAgcSetAmmSemaphoreMemory(nullptr, 0) == 0, "an empty registration was rejected");
     expectFailure([] {
         const auto top = std::numeric_limits<std::uintptr_t>::max() & ~static_cast<std::uintptr_t>(blockBytes - 1u);
         sceAgcSetAmmSemaphoreMemory(reinterpret_cast<void*>(top), memoryBytes);
@@ -96,7 +100,7 @@ void testRegistration() {
     std::fill(memory(), memory() + memoryBytes, std::uint8_t{0x77});
     const auto before = snapshot();
     check(sceAgcSetAmmSemaphoreMemory(memory(), memoryBytes) == 0, "registering the AMM semaphore memory failed");
-    check(std::all_of(memory(), memory() + memoryBytes, [](std::uint8_t byte) { return byte == 0; }), "registration did not clear the semaphore counters");
+    check(std::all_of(memory(), memory() + memoryBytes, [](std::uint8_t byte) { return byte == 0; }), "registration did not clear the whole semaphore memory");
     check(std::equal(before.begin(), before.begin() + blockBytes, storage.get()), "registration wrote before the semaphore memory");
     check(std::equal(before.begin() + blockBytes + memoryBytes, before.end(), memory() + memoryBytes), "registration wrote past the semaphore memory");
 }
@@ -113,7 +117,7 @@ void testLabels() {
 void testLabelRejections() {
     for (const std::uint32_t index : {labelCount, labelCount + 1u, std::numeric_limits<std::uint32_t>::max()}) {
         void* label = storage.get();
-        check(sceAgcGetSemaphoreLabel(index, &label) == static_cast<int>(0x8a6c000bu), "out-of-range label error mismatch");
+        check(sceAgcGetSemaphoreLabel(index, &label) == OutOfRange, "a label past the semaphore memory was not rejected");
         check(label == storage.get(), "a rejected semaphore label changed the output");
     }
     expectFailure([] { sceAgcGetSemaphoreLabel(0, nullptr); });
@@ -122,9 +126,10 @@ void testLabelRejections() {
 void testRepeatedRegistration() {
     std::fill(memory(), memory() + memoryBytes, std::uint8_t{0x3c});
     const auto before = snapshot();
-    check(sceAgcSetAmmSemaphoreMemory(memory(), memoryBytes) == static_cast<int>(0x8a6c0048u), "repeated registration error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(storage.get(), blockBytes) == static_cast<int>(0x8a6c0048u), "repeated registration error mismatch");
-    check(sceAgcSetAmmSemaphoreMemory(nullptr, 0) == static_cast<int>(0x8a6c0048u), "repeated registration error mismatch");
+    check(sceAgcSetAmmSemaphoreMemory(memory(), memoryBytes) == AlreadyRegistered, "a repeated registration was not rejected");
+    check(sceAgcSetAmmSemaphoreMemory(storage.get() + 1, blockBytes) == AlreadyRegistered, "registration was not checked before alignment");
+    check(sceAgcSetSemaphoreMemory(storage.get(), blockBytes) == AlreadyRegistered, "the non-AMM call did not share the registration");
+    check(sceAgcSetAmmSemaphoreMemory(nullptr, 0) == AlreadyRegistered, "an empty registration was not rejected once memory is registered");
     checkUnchanged(before, "a repeated registration changed memory");
     void* label = nullptr;
     check(sceAgcGetSemaphoreLabel(labelCount - 1u, &label) == 0 && label == memory() + memoryBytes - labelBytes, "a repeated registration replaced the semaphore memory");
@@ -180,6 +185,40 @@ void testMemSemaphore() {
     expectFailure([&] { sceAgcCbMemSemaphore(nullptr, label, 0, 0, 0); });
 }
 
+using QueueMemSemaphore = std::uint32_t* APS5_VABI (*)(CommandBuffer*, const volatile void*, std::uint8_t, std::uint8_t, std::uint8_t);
+
+void testQueueMemSemaphore(QueueMemSemaphore write) {
+    const auto* semaphore = reinterpret_cast<const volatile void*>(0x102f221d98ull);
+
+    {
+        std::array<std::uint32_t, 16> words{};
+        words.fill(0xdeadbeefu);
+        CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+        const auto* packet = write(&buffer, semaphore, 0, 1, 6);
+        check(packet == words.data(), "packet address mismatch");
+        check(packet[0] == 0xc0023900u, "MEM_SEMAPHORE header opcode mismatch");
+        check(packet[1] == 0x2f221d98u, "MEM_SEMAPHORE address low mismatch");
+        check(packet[2] == 0x10u, "MEM_SEMAPHORE address high mismatch");
+        check(packet[3] == 0xc0100000u, "MEM_SEMAPHORE signal control word mismatch");
+        check(buffer.cursor_up == words.data() + 4, "cursor did not advance by 4 words");
+        check(words[4] == 0xdeadbeefu, "words past packet modified");
+    }
+
+    {
+        std::array<std::uint32_t, 16> words{};
+        words.fill(0xdeadbeefu);
+        CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+        const auto* packet = write(&buffer, semaphore, 1, 0, 7);
+        check(packet[3] == 0xe0010000u, "MEM_SEMAPHORE wait control word mismatch");
+    }
+
+    std::array<std::uint32_t, 16> words{};
+    CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+    expectFailure([&] { write(&buffer, reinterpret_cast<const volatile void*>(1ull), 0, 1, 6); });
+    expectFailure([&] { write(&buffer, semaphore, 0, 1, 5); });
+    expectFailure([&] { write(&buffer, semaphore, 2, 0, 7); });
+}
+
 }
 
 int main() {
@@ -191,6 +230,8 @@ int main() {
         testRegistration();
         testLabels();
         testMemSemaphore();
+        testQueueMemSemaphore(sceAgcAcbMemSemaphore);
+        testQueueMemSemaphore(sceAgcDcbMemSemaphore);
         testLabelRejections();
         testRepeatedRegistration();
         storage.reset();
diff --git a/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp b/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp
index 46f7c3c8e8..6c842de199 100644
--- a/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp
+++ b/core/libs/prx/libSceAgc/tests/ShaderHelpers.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
 #include "SceShaders.hpp"
 #include "prx/libSceAgc/Shader/include/PrimState.hpp"
 #include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
@@ -11,10 +12,6 @@
 #include <string>
 #include <iostream>
 
-extern "C" int APS5_VABI sceAgcLinkShaders(ShaderRegister*, ShaderRegister*, const void*, const Shader*, const Shader*, std::uint32_t);
-extern "C" int APS5_VABI sceAgcCreatePrimState(ShaderRegister*, ShaderRegister*, const Shader*, const Shader*, std::uint32_t);
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister*, const Shader*, const Shader*);
-
 namespace {
 std::array<ShaderRegister, 2> preparedContext;
 std::array<ShaderRegister, 3> preparedPrimitive;
diff --git a/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp b/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp
index 5f543c8707..a8307962a4 100644
--- a/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp
+++ b/core/libs/prx/libSceAgc/tests/WriteDataPatch.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgc/Patch/include/WaitRegMem.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
 #include "prx/libSceAgc/Command/include/Packet.hpp"
 
 #include <algorithm>
@@ -7,17 +10,6 @@
 #include <cstdio>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcAcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAgcWriteDataPatchSetAddressOrOffset(std::uint32_t*, std::uint64_t);
-int APS5_VABI sceAgcAsyncWriteDataPatchSetAddressOrOffset(std::uint32_t*, std::uint64_t);
-int APS5_VABI sceAgcWriteDataPatchSetDst(std::uint32_t*, std::uint8_t);
-int APS5_VABI sceAgcAsyncWriteDataPatchSetDst(std::uint32_t*, std::uint8_t);
-int APS5_VABI sceAgcWriteDataPatchSetCachePolicy(std::uint32_t*, std::uint8_t);
-int APS5_VABI sceAgcAsyncWriteDataPatchSetCachePolicy(std::uint32_t*, std::uint8_t);
-}
-
 namespace {
 
 constexpr std::array<std::uint32_t, 3> Payload{0x11111111u, 0x22222222u, 0x33333333u};
diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index 4a6440642d..613780e647 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -142,28 +142,6 @@ add_custom_command(
         VERBATIM
 )
 
-set(agcDepthSampleShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/shaders/DepthSample.comp)
-foreach(agcDepthSampleKind IN ITEMS Single Multisample)
-    string(TOUPPER ${agcDepthSampleKind} agcDepthSampleSymbol)
-    if(agcDepthSampleKind STREQUAL "Multisample")
-        set(agcDepthSampleMultisampled 1)
-    else()
-        set(agcDepthSampleMultisampled 0)
-    endif()
-    set(agcDepthSampleShaderSpv ${agcTextureDetileGeneratedDir}/DepthSample${agcDepthSampleKind}.spv)
-    set(agcDepthSampleShaderHeader ${agcTextureDetileGeneratedDir}/DepthSample${agcDepthSampleKind}_spv.h)
-    add_custom_command(
-            OUTPUT "${agcDepthSampleShaderHeader}"
-            COMMAND ${CMAKE_COMMAND} -E make_directory "${agcTextureDetileGeneratedDir}"
-            COMMAND "$<TARGET_FILE:glslang-standalone>" -V --target-env vulkan1.1 -DMULTISAMPLED=${agcDepthSampleMultisampled} -o "${agcDepthSampleShaderSpv}" "${agcDepthSampleShaderSource}"
-            COMMAND ${CMAKE_COMMAND} -DINPUT=${agcDepthSampleShaderSpv} -DOUTPUT=${agcDepthSampleShaderHeader}
-            -DSYMBOL=DEPTH_SAMPLE_${agcDepthSampleSymbol}_SPV -P "${CMAKE_CURRENT_SOURCE_DIR}/embed_spirv.cmake"
-            DEPENDS "${agcDepthSampleShaderSource}" glslang-standalone
-            VERBATIM
-    )
-    list(APPEND agcDepthSampleShaderHeaders ${agcDepthSampleShaderHeader})
-endforeach()
-
 set(agcSampleCounterShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/shaders/SampleCounter.comp)
 set(agcSampleCounterShaderSpv ${agcTextureDetileGeneratedDir}/SampleCounter.spv)
 set(agcSampleCounterShaderHeader ${agcTextureDetileGeneratedDir}/SampleCounter_spv.h)
@@ -225,6 +203,22 @@ foreach(agcSampleOrderVariant IN ITEMS "R8;comp;-DTEXEL_FORMAT=r8ui" "R16;comp;-
     )
     list(APPEND agcSampleOrderShaderHeaders ${agcSampleOrderShaderHeader})
 endforeach()
+foreach(agcFirstSampleClass IN ITEMS Float Uint Sint)
+    string(TOUPPER "${agcFirstSampleClass}" agcFirstSampleSymbol)
+    set(agcFirstSampleShaderSource ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/shaders/FirstSample.frag)
+    set(agcFirstSampleShaderSpv ${agcTextureDetileGeneratedDir}/FirstSample${agcFirstSampleClass}.spv)
+    set(agcFirstSampleShaderHeader ${agcTextureDetileGeneratedDir}/FirstSample${agcFirstSampleClass}_spv.h)
+    add_custom_command(
+            OUTPUT "${agcFirstSampleShaderHeader}"
+            COMMAND ${CMAKE_COMMAND} -E make_directory "${agcTextureDetileGeneratedDir}"
+            COMMAND "$<TARGET_FILE:glslang-standalone>" -V --target-env vulkan1.1 -D${agcFirstSampleSymbol}_SAMPLES=1 -o "${agcFirstSampleShaderSpv}" "${agcFirstSampleShaderSource}"
+            COMMAND ${CMAKE_COMMAND} -DINPUT=${agcFirstSampleShaderSpv} -DOUTPUT=${agcFirstSampleShaderHeader}
+            -DSYMBOL=FIRST_SAMPLE_${agcFirstSampleSymbol}_SPV -P "${CMAKE_CURRENT_SOURCE_DIR}/embed_spirv.cmake"
+            DEPENDS "${agcFirstSampleShaderSource}" glslang-standalone
+            VERBATIM
+    )
+    list(APPEND agcPresentationShaderHeaders ${agcFirstSampleShaderHeader})
+endforeach()
 foreach(agcOverlayStage IN ITEMS Vert Frag)
     string(TOLOWER "${agcOverlayStage}" agcOverlayExtension)
     string(TOUPPER "${agcOverlayStage}" agcOverlaySymbol)
@@ -313,6 +307,8 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/ShaderDeviceProfile.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/Pm4.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/SubmissionCapture.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FrameCapture.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FrameRecorder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/VulkanDevice.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/FloatFlushProbe.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Execution/src/AspectFit.cpp
@@ -323,6 +319,7 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Draw.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/DepthSurface.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/MultisampleTarget.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/FirstSampleCopy.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ColorTargetLayout.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ColorTargetTransfer.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Pipeline.cpp
@@ -337,6 +334,7 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ShaderResources.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ShaderAddressResources.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/GuestBufferMemory.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ResidentMirror.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/BdaResources.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/BufferAddress.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ShaderValidation.cpp
@@ -361,7 +359,6 @@ set(agcDriverSources
         ${agcReadbackHeaders}
         ${agcMultisampleUploadHeader}
         ${agcCmaskClearShaderHeader}
-        ${agcDepthSampleShaderHeaders}
         ${agcMeshArgumentsShaderHeader}
         ${agcTextureDetileImageShaderHeader}
         ${agcTextureRepackShaderHeader}
@@ -423,6 +420,7 @@ target_link_libraries(libSceAgcDriver PRIVATE
         libc
         libkernel
         jpeg_turbo
+        libzstd_static
         ${CMAKE_DL_LIBS}
 )
 if(APS5_ENABLE_TRACY)
@@ -433,6 +431,16 @@ if(MINGW OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
 endif()
 
 if(BUILD_TESTING)
+    add_test_executable(agc_driver_unsupported_diagnostics_tests tests/UnsupportedDiagnostics.cpp)
+    target_include_directories(agc_driver_unsupported_diagnostics_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_driver_unsupported_diagnostics_tests PRIVATE libSceAgcDriver)
+    configure_windows_unwind(agc_driver_unsupported_diagnostics_tests)
+    add_test(NAME agc_driver_unsupported_diagnostics COMMAND agc_driver_unsupported_diagnostics_tests)
+    if(WIN32)
+        set_tests_properties(agc_driver_unsupported_diagnostics PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgcDriver>")
+    endif()
+
     add_test_executable(agc_driver_draw_program_trace_tests
             tests/DrawProgramTrace.cpp
             Execution/src/Driver/Draw/DrawProgramTrace.cpp
@@ -459,6 +467,16 @@ if(WIN32)
 endif()
 
 if(BUILD_TESTING)
+    add_test_executable(agc_driver_nop_data_packet_tests tests/NopDataWritePacket.cpp)
+    target_include_directories(agc_driver_nop_data_packet_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_driver_nop_data_packet_tests PRIVATE libSceAgcDriver)
+    configure_windows_unwind(agc_driver_nop_data_packet_tests)
+    add_test(NAME agc_driver_nop_data_packet COMMAND agc_driver_nop_data_packet_tests)
+    if(WIN32)
+        set_tests_properties(agc_driver_nop_data_packet PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
     add_test_executable(agc_frame_dump_io_tests tests/FrameDumpIo.cpp)
     target_include_directories(agc_frame_dump_io_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(agc_frame_dump_io_tests PRIVATE libc)
@@ -470,6 +488,18 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 
+    add_test_executable(agc_frame_capture_tests tests/FrameCapture.cpp Execution/src/FrameCapture.cpp)
+    target_include_directories(agc_frame_capture_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_frame_capture_tests PRIVATE libc libzstd_static)
+    set_target_properties(agc_frame_capture_tests PROPERTIES CXX_EXTENSIONS OFF)
+    configure_windows_unwind(agc_frame_capture_tests)
+    add_test(NAME agc_frame_capture COMMAND agc_frame_capture_tests)
+    set_tests_properties(agc_frame_capture PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_frame_capture PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
     add_test_executable(agc_write_watch_coverage_tests tests/WriteWatchCoverage.cpp)
     target_include_directories(agc_write_watch_coverage_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(agc_write_watch_coverage_tests PRIVATE libc)
@@ -535,6 +565,42 @@ if(BUILD_TESTING)
         set_tests_properties(agc_handoff_spin PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+
+    add_test_executable(agc_capture_trace_tests tests/CaptureTrace.cpp)
+    target_include_directories(agc_capture_trace_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_capture_trace_tests PRIVATE libc)
+    configure_windows_unwind(agc_capture_trace_tests)
+    set(agcCaptureTraceDirectory ${CMAKE_CURRENT_BINARY_DIR}/capture_trace_tests)
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/default")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/explicit")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/failure")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/best-effort")
+    file(MAKE_DIRECTORY "${agcCaptureTraceDirectory}/disabled")
+    set(agcCaptureTraceExplicitPath "${agcCaptureTraceDirectory}/explicit/trace.log")
+    set(agcCaptureTraceFailurePath "${agcCaptureTraceDirectory}/failure/missing-parent/trace.log")
+    set(agcCaptureTraceBestEffortPath "${agcCaptureTraceDirectory}/best-effort/trace.log")
+    add_test(NAME agc_capture_trace_path_default COMMAND agc_capture_trace_tests path-default)
+    add_test(NAME agc_capture_trace_path_empty COMMAND agc_capture_trace_tests path-empty)
+    set_tests_properties(agc_capture_trace_path_empty PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE_PATH=")
+    add_test(NAME agc_capture_trace_path_explicit COMMAND agc_capture_trace_tests path-explicit)
+    set_tests_properties(agc_capture_trace_path_explicit PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceExplicitPath}")
+    add_test(NAME agc_capture_trace_explicit_writes COMMAND agc_capture_trace_tests explicit-writes)
+    set_tests_properties(agc_capture_trace_explicit_writes PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceExplicitPath}")
+    add_test(NAME agc_capture_trace_default_writes COMMAND agc_capture_trace_tests default-writes)
+    set_tests_properties(agc_capture_trace_default_writes PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1" WORKING_DIRECTORY "${agcCaptureTraceDirectory}/default")
+    add_test(NAME agc_capture_trace_open_failure COMMAND agc_capture_trace_tests open-failure)
+    set_tests_properties(agc_capture_trace_open_failure PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceFailurePath}" WORKING_DIRECTORY "${agcCaptureTraceDirectory}/failure")
+    add_test(NAME agc_capture_trace_best_effort_overflow COMMAND agc_capture_trace_tests best-effort-overflow)
+    set_tests_properties(agc_capture_trace_best_effort_overflow PROPERTIES ENVIRONMENT "APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcCaptureTraceBestEffortPath}" WORKING_DIRECTORY "${agcCaptureTraceDirectory}/best-effort")
+    add_test(NAME agc_capture_trace_disabled COMMAND agc_capture_trace_tests disabled)
+    set_tests_properties(agc_capture_trace_disabled PROPERTIES WORKING_DIRECTORY "${agcCaptureTraceDirectory}/disabled")
+    if(WIN32)
+        set_tests_properties(agc_capture_trace_path_default agc_capture_trace_path_empty
+                agc_capture_trace_path_explicit agc_capture_trace_explicit_writes
+                agc_capture_trace_default_writes agc_capture_trace_open_failure agc_capture_trace_best_effort_overflow
+                agc_capture_trace_disabled PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
 
 if(WIN32)
@@ -693,6 +759,28 @@ target_link_libraries(agc_shared_write_tests PRIVATE libSceAgcDriver libkernel l
 set_target_properties(agc_shared_write_tests PROPERTIES CXX_EXTENSIONS OFF)
 configure_windows_unwind(agc_shared_write_tests)
 
+if(BUILD_TESTING AND WIN32)
+    add_test_executable(agc_page_state_tests tests/PageStates.cpp)
+    target_include_directories(agc_page_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_page_state_tests PRIVATE libSceAgcDriver libc)
+    configure_windows_unwind(agc_page_state_tests)
+    add_test(NAME agc_page_states COMMAND agc_page_state_tests)
+    add_test(NAME agc_page_state_metadata COMMAND agc_page_state_tests --metadata)
+    set_tests_properties(agc_page_states agc_page_state_metadata PROPERTIES
+        TIMEOUT 30 ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+endif()
+
+add_test_executable(agc_locks_tests EXCLUDE_FROM_ALL tests/Locks.cpp)
+target_include_directories(agc_locks_tests PRIVATE
+        ${LIBS_INCLUDE_DIR}
+        ${CMAKE_SOURCE_DIR}/core/shader/recompiler
+        ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR}
+        ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR}
+)
+target_link_libraries(agc_locks_tests PRIVATE libSceAgcDriver libc)
+set_target_properties(agc_locks_tests PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_locks_tests)
+
 add_test_executable(agc_write_tracking_tests EXCLUDE_FROM_ALL
         tests/WriteTracking.cpp
         Execution/src/GuestMemory.cpp
@@ -711,11 +799,30 @@ if(BUILD_TESTING)
         set_tests_properties(agc_write_tracking_metadata_commit PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
         add_test(NAME agc_resident_direct_remap COMMAND agc_write_tracking_tests --resident-direct-remap)
         set_tests_properties(agc_resident_direct_remap PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
-        set_tests_properties(agc_write_tracking agc_write_tracking_metadata_commit agc_resident_direct_remap PROPERTIES ENVIRONMENT_MODIFICATION
+        add_test(NAME agc_rewatched_direct_shared COMMAND agc_write_tracking_tests --rewatched-direct-shared)
+        set_tests_properties(agc_rewatched_direct_shared PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        add_test(NAME agc_import_alias_shared COMMAND agc_write_tracking_tests --import-alias-shared)
+        set_tests_properties(agc_import_alias_shared PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        add_test(NAME agc_compared_shared_generations COMMAND agc_write_tracking_tests --compared-shared-generations)
+        set_tests_properties(agc_compared_shared_generations PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 20)
+        set_tests_properties(agc_write_tracking agc_write_tracking_metadata_commit agc_resident_direct_remap agc_rewatched_direct_shared agc_import_alias_shared agc_compared_shared_generations PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 endif()
 
+if(BUILD_TESTING AND NOT WIN32)
+    add_test_executable(agc_collect_memo_generation_tests
+            tests/CollectMemoGeneration.cpp
+            Execution/src/GuestMemory.cpp
+            Execution/src/PerformanceTraceThread.cpp
+    )
+    target_include_directories(agc_collect_memo_generation_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_collect_memo_generation_tests PRIVATE shader_recompiler_agc_driver libc)
+    set_target_properties(agc_collect_memo_generation_tests PROPERTIES CXX_EXTENSIONS OFF)
+    add_test(NAME agc_collect_memo_generation COMMAND agc_collect_memo_generation_tests)
+    set_tests_properties(agc_collect_memo_generation PROPERTIES TIMEOUT 30)
+endif()
+
 add_test_executable(agc_thread_priority_tests EXCLUDE_FROM_ALL
         tests/ThreadPriority.cpp
         Execution/src/ThreadPriority.cpp
@@ -1130,6 +1237,17 @@ if(BUILD_TESTING)
 endif()
 
 add_test_executable(agc_buffer_pool_tests EXCLUDE_FROM_ALL tests/BufferPool.cpp)
+
+if(BUILD_TESTING)
+    add_test_executable(agc_snapshot_copy_failure_tests tests/SnapshotCopyFailure.cpp tests/AllocationFailure.cpp)
+    target_include_directories(agc_snapshot_copy_failure_tests PRIVATE ${LIBS_INCLUDE_DIR} ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
+    if(MINGW)
+        target_compile_options(agc_snapshot_copy_failure_tests PRIVATE -fasynchronous-unwind-tables)
+    endif()
+    configure_windows_unwind(agc_snapshot_copy_failure_tests)
+    add_test(NAME agc_snapshot_copy_failure COMMAND agc_snapshot_copy_failure_tests)
+    set_tests_properties(agc_snapshot_copy_failure PROPERTIES TIMEOUT 10)
+endif()
 target_sources(agc_buffer_pool_tests PRIVATE Graphics/src/BufferPool.cpp tests/AllocationFailure.cpp)
 target_include_directories(agc_buffer_pool_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
 target_link_libraries(agc_buffer_pool_tests PRIVATE libSceAgcDriver libc)
@@ -1403,6 +1521,7 @@ target_include_directories(agc_driver_recorder_tests PRIVATE
 )
 
 target_link_libraries(agc_driver_recorder_tests PRIVATE
+        libSceAgc
         libkernel
         libSceAgcDriver
         SDL2-static
@@ -1422,8 +1541,20 @@ if(BUILD_TESTING)
         set_tests_properties(agc_recorder_device_selection agc_gpu_timing_complete agc_gpu_timing_incomplete PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_command_memory_reuse COMMAND agc_driver_recorder_tests --command-reuse-only)
+    set_tests_properties(agc_command_memory_reuse PROPERTIES SKIP_RETURN_CODE 77)
+    if(WIN32)
+        set_tests_properties(agc_command_memory_reuse PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_pipeline_cache COMMAND agc_driver_recorder_tests --pipeline-cache-only)
     add_test(NAME agc_pipeline_cache_file COMMAND agc_driver_recorder_tests --pipeline-cache-file-only)
+    add_test(NAME agc_pipeline_cache_header COMMAND agc_driver_recorder_tests --pipeline-cache-header-only)
+    set_tests_properties(agc_pipeline_cache_header PROPERTIES TIMEOUT 30 SKIP_RETURN_CODE 77)
+    if(WIN32)
+        set_tests_properties(agc_pipeline_cache_header PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_pipeline_library COMMAND agc_driver_recorder_tests --pipeline-library-only)
     add_test(NAME agc_pipeline_library_off COMMAND agc_driver_recorder_tests --pipeline-library-only)
     set_tests_properties(agc_pipeline_library agc_pipeline_library_off PROPERTIES SKIP_RETURN_CODE 77)
@@ -1446,6 +1577,13 @@ if(BUILD_TESTING)
         set_tests_properties(agc_import_watch_other_family PROPERTIES SKIP_RETURN_CODE 77)
         add_test(NAME agc_import_settle_deferred COMMAND agc_driver_recorder_tests --deferred-settle-only)
         add_test(NAME agc_import_settle_deferred_other_family COMMAND agc_driver_recorder_tests --deferred-settle-other-family-only)
+        add_test(NAME agc_import_settle_write_order COMMAND agc_driver_recorder_tests --settle-write-order-only)
+        add_test(NAME agc_import_settle_write_order_other_family COMMAND agc_driver_recorder_tests --settle-write-order-other-family-only)
+        add_test(NAME agc_import_settle_wait_failure COMMAND agc_driver_recorder_tests --settle-wait-failure-only)
+        set_tests_properties(agc_import_settle_write_order agc_import_settle_write_order_other_family agc_import_settle_wait_failure PROPERTIES
+            SKIP_RETURN_CODE 77 TIMEOUT 30
+            FAIL_REGULAR_EXPRESSION "SYNC-HAZARD-|VUID-"
+            ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         add_test(NAME agc_import_settle_first_use COMMAND agc_driver_recorder_tests --settle-first-use-only)
         add_test(NAME agc_import_settle_earlier_import COMMAND agc_driver_recorder_tests --settle-earlier-import-only)
         add_test(NAME agc_import_settle_retire COMMAND agc_driver_recorder_tests --settle-retire-only)
@@ -1528,6 +1666,12 @@ if(BUILD_TESTING)
         set_tests_properties(agc_storage_baseline_settled PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_bda_staging COMMAND agc_driver_recorder_tests --bda-staging-only)
+    set_tests_properties(agc_bda_staging PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_bda_staging PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_read_written_staging COMMAND agc_driver_recorder_tests --read-written-staging-only)
     set_tests_properties(agc_read_written_staging PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     if(WIN32)
@@ -1592,6 +1736,20 @@ if(BUILD_TESTING)
     set_tests_properties(agc_unit_shadow PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30 ENVIRONMENT "APS5_PIN_WAIT_MS=3000")
     add_test(NAME agc_idle_publish_wait COMMAND agc_driver_recorder_tests --idle-publish-wait-only)
     set_tests_properties(agc_idle_publish_wait PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30 ENVIRONMENT "APS5_PIN_WAIT_MS=3000;APS5_WRITE_WATCH_IMPORTS=watch")
+    add_test(NAME agc_driver_bda_reads_shadowed_results COMMAND agc_driver_recorder_tests --bda-shadowed-results-only)
+    add_test(NAME agc_driver_bda_reads_shadowed_results_per_build COMMAND agc_driver_recorder_tests --bda-shadowed-results-only)
+    set_tests_properties(agc_driver_bda_reads_shadowed_results agc_driver_bda_reads_shadowed_results_per_build PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    set_tests_properties(agc_driver_bda_reads_shadowed_results_per_build PROPERTIES ENVIRONMENT "APS5_NO_ADDRESS_SPACE_CACHE=1")
+    if(WIN32)
+        set_tests_properties(agc_driver_bda_reads_shadowed_results agc_driver_bda_reads_shadowed_results_per_build PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_unit_shadow_completion_store COMMAND agc_driver_recorder_tests --completion-store-shadow-only)
+    set_tests_properties(agc_unit_shadow_completion_store PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_unit_shadow_completion_store PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     if(WIN32)
         add_test(NAME agc_storage_cpu_snapshot COMMAND agc_driver_recorder_tests --storage-cpu-snapshot-only)
         set_tests_properties(agc_storage_cpu_snapshot PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" TIMEOUT 30 SKIP_RETURN_CODE 77
@@ -1637,10 +1795,12 @@ if(BUILD_TESTING)
     set_tests_properties(agc_shadowed_key_stores PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     add_test(NAME agc_sample_dumps COMMAND agc_driver_recorder_tests --sample-dumps-only)
     set_tests_properties(agc_sample_dumps PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    add_test(NAME agc_uncounted_passes COMMAND agc_driver_recorder_tests --uncounted-passes-only)
+    set_tests_properties(agc_uncounted_passes PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     add_test(NAME agc_draw_descriptors COMMAND agc_driver_recorder_tests --draw-descriptors-only)
     set_tests_properties(agc_draw_descriptors PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 60)
     if(WIN32)
-        set_tests_properties(agc_pending_key_stores agc_shadowed_key_stores agc_sample_dumps agc_draw_descriptors PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_pending_key_stores agc_shadowed_key_stores agc_sample_dumps agc_uncounted_passes agc_draw_descriptors PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_driver_host_import_lifetime COMMAND agc_driver_recorder_tests --host-import-lifetime-only)
@@ -1653,9 +1813,17 @@ if(BUILD_TESTING)
         ENVIRONMENT "APS5_PIN_WAIT_MS=2000" SKIP_RETURN_CODE 77 TIMEOUT 30)
     set_tests_properties(agc_driver_unit_shadow_budget PROPERTIES
         ENVIRONMENT "APS5_PIN_WAIT_MS=2000;APS5_UNIT_SHADOW_MIB=8" SKIP_RETURN_CODE 77 TIMEOUT 30)
+    add_test(NAME agc_recorder_completion_labels COMMAND agc_driver_recorder_tests --completion-labels-only)
+    set_tests_properties(agc_recorder_completion_labels PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    add_test(NAME agc_recorder_cmask COMMAND agc_driver_recorder_tests --cmask-only)
+    set_tests_properties(agc_recorder_cmask PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    add_test(NAME agc_recorder_cube COMMAND agc_driver_recorder_tests --cube-only)
+    set_tests_properties(agc_recorder_cube PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
     if(WIN32)
         set_tests_properties(agc_driver_host_import_lifetime agc_driver_host_import_mutation_race agc_driver_unit_shadow agc_driver_unit_shadow_budget PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_recorder_completion_labels agc_recorder_cmask agc_recorder_cube PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_property(TEST agc_driver_host_import_lifetime APPEND PROPERTY ENVIRONMENT_MODIFICATION
         "APS5_RELEASE_UNDER_LOCK=unset:" "APS5_RELEASE_ON_UNLOCK=unset:")
@@ -1832,6 +2000,7 @@ add_test_executable(agc_driver_graphics_tests EXCLUDE_FROM_ALL
         tests/GuestSamplerResource.cpp
         tests/TextureDetiler.cpp
         tests/DepthSurfaceReuse.cpp
+        tests/LastRecordIndices.cpp
 )
 
 if(BUILD_TESTING)
@@ -1982,6 +2151,7 @@ foreach(agcExecutionTestSource IN LISTS agcExecutionTestSources)
     add_test_executable(${agcExecutionTest} EXCLUDE_FROM_ALL ${agcExecutionTestSource})
     target_include_directories(${agcExecutionTest} PRIVATE
             ${LIBS_INCLUDE_DIR}
+            $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>
             ${CMAKE_SOURCE_DIR}/core/shader/recompiler
             ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR}
             ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR}
@@ -1998,6 +2168,19 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_address_passes_targets_split PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    set_target_properties(agc_driver_rcp_hardware_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    add_test(NAME agc_driver_rcp_hardware_exact COMMAND agc_driver_rcp_hardware_tests)
+    set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT "APS5_EXACT_RCP=1;ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 60)
+    if(WIN32)
+        set_tests_properties(agc_driver_rcp_hardware_exact PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_depth_plane_sampling_evicting COMMAND agc_driver_depth_plane_sampling_tests --evicting)
+    set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT "APS5_DEPTH_PLANE_COPY_MIB=1" SKIP_RETURN_CODE 77 TIMEOUT 120)
+    if(WIN32)
+        set_tests_properties(agc_driver_depth_plane_sampling_evicting PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
 foreach(agcExecutionTestName IN LISTS ANYPS5_AGC_EXECUTION_TESTS)
     if(NOT EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/tests/execution/${agcExecutionTestName}.cpp)
@@ -2023,6 +2206,9 @@ if(NOT ANYPS5_AGC_EXECUTION_TESTS OR "PooledBufferRange" IN_LIST ANYPS5_AGC_EXEC
 endif()
 
 target_link_libraries(agc_driver_gpu_map_on_fiber_tests PRIVATE libSceFiber)
+if(ANYPS5_ENABLE_SPIRV_TOOLS)
+    target_link_libraries(agc_driver_optimize_on_fiber_tests PRIVATE libSceFiber shader_recompiler_agc_driver)
+endif()
 
 target_link_libraries(agc_driver_rect_list_corner_tests PRIVATE shader_recompiler_agc_driver)
 target_link_libraries(agc_driver_queue_zero_late_interrupt_tests PRIVATE libkernel)
@@ -2039,17 +2225,45 @@ target_include_directories(agc_driver_image_table_cache_bounds_tests PRIVATE $<T
 
 target_include_directories(agc_driver_draw_cache_relocation_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+if(BUILD_TESTING)
+    add_test(NAME agc_submit_progress COMMAND agc_driver_submit_progress_tests)
+    set_tests_properties(agc_submit_progress PROPERTIES
+            ENVIRONMENT "APS5_SUBMIT_PROGRESS=1;ANYPS5_REQUIRE_VULKAN=1" TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_submit_progress PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgcDriver>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_submit_progress_no_timeline COMMAND agc_driver_submit_progress_tests --fallback-only)
+    set_tests_properties(agc_submit_progress_no_timeline PROPERTIES
+            ENVIRONMENT "APS5_SUBMIT_PROGRESS=1;APS5_NO_TIMELINE=1;ANYPS5_REQUIRE_VULKAN=1"
+            TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_submit_progress_no_timeline PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAgcDriver>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 if(BUILD_TESTING)
     add_test(NAME agc_driver_store_pending_identity COMMAND agc_driver_store_over_untracked_tests --pending-identity)
     set_tests_properties(agc_driver_store_pending_identity PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_store_idle_results_wake COMMAND agc_driver_store_idle_results_tests --idle-epoch-wake)
+    set_tests_properties(agc_driver_store_idle_results_wake PROPERTIES
+            ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     if(WIN32)
         set_tests_properties(agc_driver_store_pending_identity PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_driver_store_idle_results_wake PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 endif()
 
 if(BUILD_TESTING)
+    add_test(NAME agc_driver_native_fmask COMMAND agc_driver_sample_multisample_target_tests --native-fmask)
+    set_tests_properties(agc_driver_native_fmask PROPERTIES TIMEOUT 30 ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_native_fmask PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_native_msaa_vertex_input COMMAND agc_driver_sample_multisample_target_tests --native-vertex-input)
     set_tests_properties(agc_driver_native_msaa_vertex_input PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
@@ -2087,6 +2301,7 @@ if(BUILD_TESTING)
     endif()
 endif()
 target_include_directories(agc_driver_native_multisample_depth_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+target_include_directories(agc_driver_partially_resident_snapshot_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
 foreach(agcReadbackTestKind IN ITEMS Vertex Uint Depth)
     string(TOUPPER ${agcReadbackTestKind} agcReadbackTestSymbol)
@@ -2127,8 +2342,16 @@ target_link_libraries(agc_driver_job_manager_compute_tests PRIVATE libSceJobMana
 
 target_include_directories(agc_driver_packed_unorm_color_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+target_include_directories(agc_driver_packed_unorm4444_color_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
+target_include_directories(agc_driver_packed_unorm4444_partial_write_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
+target_include_directories(agc_driver_packed_unorm4444_multisample_partial_write_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
 target_include_directories(agc_driver_color1555_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
+target_include_directories(agc_driver_color_logic_op_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
+
 target_include_directories(agc_driver_color565_target_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
 
 target_include_directories(agc_driver_depth_range_remap_draw_tests PRIVATE $<TARGET_PROPERTY:shader_recompiler_agc_driver,INTERFACE_INCLUDE_DIRECTORIES>)
@@ -2198,6 +2421,14 @@ target_include_directories(agc_driver_prepared_shaders_tests PRIVATE
 
 if(BUILD_TESTING)
     set_target_properties(agc_shader_mode_register_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    foreach(packedStorageFormat IN ITEMS 133 134 136)
+        set(packedStorageTest agc_driver_image_packed16_storage_${packedStorageFormat})
+        add_test(NAME ${packedStorageTest} COMMAND agc_driver_image_converted_unorm_tests --packed16 ${packedStorageFormat})
+        set_tests_properties(${packedStorageTest} PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30)
+        if(WIN32)
+            set_tests_properties(${packedStorageTest} PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
     foreach(prebuildPolicyMode IN ITEMS unset 0 1)
         set(prebuildPolicyTest agc_driver_prepared_graphics_prebuild_${prebuildPolicyMode})
         add_test(NAME ${prebuildPolicyTest} COMMAND agc_driver_prepared_graphics_tests --prebuild-${prebuildPolicyMode})
@@ -2270,8 +2501,8 @@ if(BUILD_TESTING)
     if(WIN32)
         set_tests_properties(agc_shader_bindless agc_shader_selected_records_image_limit agc_shader_selected_records_pair_limit agc_shader_selected_records_direct_image_limit agc_shader_selected_records_direct_pair_limit agc_shader_srt_read_patching agc_shader_type_zero_image_materialization agc_shader_frontend_pair agc_shader_frontend_pair_off agc_shader_layout_pair agc_shader_layout_pair_off agc_shader_entry_lane_proof_budget PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
-    foreach(agcTest IN ITEMS agc_vertex_input_tests agc_mesh_output_budget_tests agc_shared_write_tests agc_driver_tests agc_shader_memory_tests agc_structurizer_tests agc_spirv_module_tests agc_dpp_write_tests agc_masked_select_tests agc_ir_reclaim_tests agc_vector_window_tests agc_constant_bit_test_tests agc_integer_narrowing_tests agc_scalar_select_mask_tests agc_vertex_input_validation_tests agc_vop1_control_decode_tests agc_validate_program_tests agc_pass_hazards_tests agc_barrier_batch_tests agc_shader_disk_cache_tests agc_screenshot_tests agc_shader_device_profile_tests agc_placeholder_images_tests agc_shader_control_flow_tests agc_driver_flip_tests agc_driver_pm4_tests agc_driver_graphics_tests agc_driver_bda_device_tests agc_driver_mesh_tests agc_driver_cmask_fast_clear_tests agc_formatted_buffer_once_tests agc_formatted_buffer_byte_stores_tests ${agcExecutionTests} agc_fma_mix_once_tests agc_f16_single_convert_tests)
-        if(agcTest STREQUAL "agc_driver_constant_store_tests" OR agcTest STREQUAL "agc_driver_flat_apertures_tests" OR agcTest STREQUAL "agc_driver_pipeline_optimized_readback_tests")
+    foreach(agcTest IN ITEMS agc_vertex_input_tests agc_mesh_output_budget_tests agc_shared_write_tests agc_locks_tests agc_driver_tests agc_shader_memory_tests agc_structurizer_tests agc_spirv_module_tests agc_dpp_write_tests agc_masked_select_tests agc_ir_reclaim_tests agc_vector_window_tests agc_constant_bit_test_tests agc_integer_narrowing_tests agc_scalar_select_mask_tests agc_vertex_input_validation_tests agc_vop1_control_decode_tests agc_validate_program_tests agc_pass_hazards_tests agc_barrier_batch_tests agc_shader_disk_cache_tests agc_screenshot_tests agc_shader_device_profile_tests agc_placeholder_images_tests agc_shader_control_flow_tests agc_driver_flip_tests agc_driver_pm4_tests agc_driver_graphics_tests agc_driver_bda_device_tests agc_driver_mesh_tests agc_driver_cmask_fast_clear_tests agc_formatted_buffer_once_tests agc_formatted_buffer_byte_stores_tests ${agcExecutionTests} agc_fma_mix_once_tests agc_f16_single_convert_tests)
+        if(agcTest STREQUAL "agc_driver_constant_store_tests" OR agcTest STREQUAL "agc_driver_flat_apertures_tests" OR agcTest STREQUAL "agc_driver_pipeline_optimized_readback_tests" OR agcTest STREQUAL "agc_driver_rcp_hardware_tests")
             continue()
         endif()
         string(REGEX REPLACE "_tests$" "" agcTestName "${agcTest}")
@@ -2304,15 +2535,33 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_draw_unsupported_buffer_type_skip_refused PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_period_copy_no_hle COMMAND agc_driver_period_copy_tests)
+    set_tests_properties(agc_driver_period_copy_no_hle PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_COPY_HLE=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_period_copy_no_hle PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_sparse_indirect_indices_unreadable COMMAND agc_driver_sparse_indirect_indices_tests --unreadable)
-    set_tests_properties(agc_driver_sparse_indirect_indices agc_driver_sparse_indirect_indices_unreadable PROPERTIES
+    add_test(NAME agc_driver_sparse_indirect_indices_no_size COMMAND agc_driver_sparse_indirect_indices_tests --no-size)
+    add_test(NAME agc_driver_sparse_indirect_indices_no_size_unreadable COMMAND agc_driver_sparse_indirect_indices_tests --no-size-unreadable)
+    add_test(NAME agc_driver_sparse_indirect_indices_no_size_unreadable_record COMMAND agc_driver_sparse_indirect_indices_tests --no-size-unreadable-record)
+    set_tests_properties(agc_driver_sparse_indirect_indices agc_driver_sparse_indirect_indices_unreadable agc_driver_sparse_indirect_indices_no_size agc_driver_sparse_indirect_indices_no_size_unreadable agc_driver_sparse_indirect_indices_no_size_unreadable_record PROPERTIES
         ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 30 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     if(WIN32)
-        set_tests_properties(agc_driver_sparse_indirect_indices_unreadable PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_driver_sparse_indirect_indices_unreadable agc_driver_sparse_indirect_indices_no_size agc_driver_sparse_indirect_indices_no_size_unreadable agc_driver_sparse_indirect_indices_no_size_unreadable_record PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_draw_cache_relocation_evicted COMMAND agc_driver_draw_cache_relocation_tests --evicted)
+    add_test(NAME agc_driver_draw_cache_relocation_kept COMMAND agc_driver_draw_cache_relocation_tests --kept)
+    set_tests_properties(agc_driver_draw_cache_relocation_evicted agc_driver_draw_cache_relocation_kept PROPERTIES
+        ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_DRAW_CACHE_ENTRIES=2" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_draw_cache_relocation_evicted agc_driver_draw_cache_relocation_kept PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_driver_pixel_implicit_derivatives PROPERTIES TIMEOUT 30)
     set_tests_properties(agc_driver_storage_file_write PROPERTIES TIMEOUT 30 ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_SUSPEND_DRAIN=1")
+    set_tests_properties(agc_driver_clamped_global_fill PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_LABEL_READBACK_STORE=1")
     set_tests_properties(agc_driver_draw_pipeline_trace PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_PIPELINED_DRAWS=8;APS5_TRACE_FRAMES=0:1;APS5_TRACE_EVENTS=64" TIMEOUT 30)
     set_property(TEST agc_driver_draw_pipeline_trace APPEND PROPERTY ENVIRONMENT_MODIFICATION
@@ -2321,11 +2570,38 @@ if(BUILD_TESTING)
             --unset=APS5_TRACE_FRAMES --unset=APS5_TRACE_SECONDS --unset=APS5_TRACE_SUMMARY_EVERY
             $<TARGET_FILE:agc_driver_draw_pipeline_trace_tests> disabled)
     set_tests_properties(agc_driver_draw_pipeline_trace_disabled PROPERTIES ENVIRONMENT "APS5_PIPELINED_DRAWS=8" SKIP_RETURN_CODE 77 TIMEOUT 30)
+    add_test(NAME agc_driver_draw_finisher_trace COMMAND agc_driver_draw_pipeline_trace_tests finisher)
+    set_tests_properties(agc_driver_draw_finisher_trace PROPERTIES
+            ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_DRAW_PIPELINE=1;APS5_PIPELINED_DRAWS=8;APS5_TRACE_FRAMES=0:1;APS5_TRACE_EVENTS=64" SKIP_RETURN_CODE 77 TIMEOUT 30)
+    set_property(TEST agc_driver_draw_finisher_trace APPEND PROPERTY ENVIRONMENT_MODIFICATION
+            "APS5_TRACE_SECONDS=unset:" "APS5_TRACE_SUMMARY_EVERY=unset:")
+    add_test(NAME agc_driver_draw_finisher_trace_disabled COMMAND ${CMAKE_COMMAND} -E env
+            --unset=APS5_TRACE_FRAMES --unset=APS5_TRACE_SECONDS --unset=APS5_TRACE_SUMMARY_EVERY
+            $<TARGET_FILE:agc_driver_draw_pipeline_trace_tests> finisher-disabled)
+    set_tests_properties(agc_driver_draw_finisher_trace_disabled PROPERTIES ENVIRONMENT "APS5_DRAW_PIPELINE=1;APS5_PIPELINED_DRAWS=8" SKIP_RETURN_CODE 77 TIMEOUT 30)
     if(WIN32)
-        set_tests_properties(agc_driver_draw_pipeline_trace_disabled PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_driver_draw_pipeline_trace_disabled agc_driver_draw_finisher_trace agc_driver_draw_finisher_trace_disabled PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_copied_writer_label_order_drain COMMAND agc_driver_copied_writer_label_order_tests)
+    set_tests_properties(agc_driver_copied_writer_label_order_drain PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_DRAIN_COMPLETION_LABELS=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_driver_copied_writer_label_order_drain PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_lazy_resolved_abi_switch_set COMMAND agc_driver_lazy_resolved_abi_tests)
+    set_tests_properties(agc_driver_lazy_resolved_abi_switch_set PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_LAZY_SHADER_PREPARE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_lazy_resolved_abi_switch_set PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     set_tests_properties(agc_driver_queued_raw_shader PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_PIPELINED_DRAWS=8" TIMEOUT 30)
+    set(agcDrawPipelineTests agc_driver_draw_write_ranges agc_driver_draw_unsupported_buffer_type agc_driver_bda_span_reads agc_driver_copied_writer_copy agc_driver_image_table_reuse agc_driver_depth_storage_reuse agc_driver_staged_clear_sampled_read agc_driver_storage_write_back_overhang agc_driver_write_data_written_ahead agc_driver_gated_dispatch_capture agc_driver_buffer_load_store agc_driver_pipelined_dma agc_driver_pipelined_fill agc_driver_pipelined_predication_read agc_driver_pipelined_predicated_label_order agc_driver_pipelined_metadata_pass agc_driver_draw_cache_reuse agc_driver_draw_cache_relocation agc_driver_draw_data_hit_user_words agc_driver_finisher_label_order agc_driver_same_queue_label_wait agc_driver_unimported_label_order)
+    foreach(agcTestName IN LISTS agcDrawPipelineTests)
+        add_test(NAME ${agcTestName}_draw_pipeline COMMAND ${agcTestName}_tests)
+        set_tests_properties(${agcTestName}_draw_pipeline PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_DRAW_PIPELINE=1;APS5_PIPELINED_DRAWS=32;APS5_PIPELINE_DISPATCH=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+        if(WIN32)
+            set_tests_properties(${agcTestName}_draw_pipeline PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
     add_test(NAME agc_driver_partially_resident_pending_stores COMMAND agc_driver_partially_resident_snapshot_tests --pending-stores)
     set_tests_properties(agc_driver_multisample_readback PROPERTIES TIMEOUT 20)
     foreach(agcReadbackCase IN ITEMS uint8 uint16 uint64 uint128 depth upload retile depth_retile)
@@ -2394,6 +2670,9 @@ if(BUILD_TESTING)
         add_test(NAME agc_driver_untracked_snapshot_hint COMMAND agc_driver_partially_resident_snapshot_tests --untracked-hint)
         set_tests_properties(agc_driver_untracked_snapshot_hint PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30
             ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        add_test(NAME agc_driver_compared_shared_snapshot COMMAND agc_driver_partially_resident_snapshot_tests --compared-shared)
+        set_tests_properties(agc_driver_compared_shared_snapshot PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30
+            ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_driver_registration_trace PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_TRACE_FRAMES=0:1;APS5_TRACE_EVENTS=64" TIMEOUT 30)
@@ -2459,12 +2738,13 @@ if(BUILD_TESTING)
     add_test(NAME agc_heap_mirror_unwatch_no_space_cache COMMAND agc_driver_graphics_tests --heap-mirror-unwatch)
     add_test(NAME agc_sparse_heap_mirror_unwatch COMMAND agc_driver_graphics_tests --sparse-heap-mirror-unwatch)
     add_test(NAME agc_sparse_heap_mirror_unwatch_no_space_cache COMMAND agc_driver_graphics_tests --sparse-heap-mirror-unwatch)
+    add_test(NAME agc_sparse_heap_mirror_budget COMMAND agc_driver_graphics_tests --sparse-heap-mirror-budget)
     add_test(NAME agc_heap_mirror_run_unwatch COMMAND agc_driver_graphics_tests --heap-mirror-run-unwatch)
     add_test(NAME agc_heap_mirror_run_unwatch_no_space_cache COMMAND agc_driver_graphics_tests --heap-mirror-run-unwatch)
     set_tests_properties(agc_heap_mirror_unwatch_no_space_cache agc_sparse_heap_mirror_unwatch_no_space_cache agc_heap_mirror_run_unwatch_no_space_cache PROPERTIES ENVIRONMENT "APS5_NO_ADDRESS_SPACE_CACHE=1")
-    set_tests_properties(agc_heap_mirror_unwatch agc_heap_mirror_unwatch_no_space_cache agc_sparse_heap_mirror_unwatch agc_sparse_heap_mirror_unwatch_no_space_cache agc_heap_mirror_run_unwatch agc_heap_mirror_run_unwatch_no_space_cache PROPERTIES TIMEOUT 30)
+    set_tests_properties(agc_heap_mirror_unwatch agc_heap_mirror_unwatch_no_space_cache agc_sparse_heap_mirror_unwatch agc_sparse_heap_mirror_unwatch_no_space_cache agc_heap_mirror_run_unwatch agc_heap_mirror_run_unwatch_no_space_cache agc_sparse_heap_mirror_budget PROPERTIES TIMEOUT 30)
     if(WIN32)
-        set_tests_properties(agc_heap_mirror_unwatch agc_heap_mirror_unwatch_no_space_cache agc_sparse_heap_mirror_unwatch agc_sparse_heap_mirror_unwatch_no_space_cache agc_heap_mirror_run_unwatch agc_heap_mirror_run_unwatch_no_space_cache PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_heap_mirror_unwatch agc_heap_mirror_unwatch_no_space_cache agc_sparse_heap_mirror_unwatch agc_sparse_heap_mirror_unwatch_no_space_cache agc_heap_mirror_run_unwatch agc_heap_mirror_run_unwatch_no_space_cache agc_sparse_heap_mirror_budget PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     else()
         add_test(NAME agc_heap_mirror_unwatched_import COMMAND agc_driver_graphics_tests --heap-mirror-unwatched-import)
         set_tests_properties(agc_heap_mirror_unwatched_import PROPERTIES TIMEOUT 30)
@@ -2546,6 +2826,28 @@ if(BUILD_TESTING)
     if(WIN32)
         set_tests_properties(agc_driver_f16_to_f32_unpack_spirv PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    set(agcDrawShaderFailureTraceDirectory ${CMAKE_CURRENT_BINARY_DIR}/draw_shader_failure_tests)
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/failure")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/success")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/disabled")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/failure_correlation_disabled")
+    set_tests_properties(agc_driver_draw_shader_failure PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_TRACE_SHADER_CORRELATION=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/failure/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_successful COMMAND agc_driver_draw_shader_failure_tests successful-draw)
+    set_tests_properties(agc_driver_draw_shader_failure_successful PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_TRACE_SHADER_CORRELATION=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/success/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_correlation_disabled COMMAND agc_driver_draw_shader_failure_tests disabled-correlation)
+    set_tests_properties(agc_driver_draw_shader_failure_correlation_disabled PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/disabled/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_request_correlation_disabled COMMAND agc_driver_draw_shader_failure_tests request-failure-correlation-disabled)
+    set_tests_properties(agc_driver_draw_shader_failure_request_correlation_disabled PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/failure_correlation_disabled/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/materialization")
+    file(MAKE_DIRECTORY "${agcDrawShaderFailureTraceDirectory}/materialization_correlation_disabled")
+    add_test(NAME agc_driver_draw_shader_failure_materialization COMMAND agc_driver_draw_shader_failure_tests materialization-failure)
+    set_tests_properties(agc_driver_draw_shader_failure_materialization PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_TRACE_SHADER_CORRELATION=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/materialization/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    add_test(NAME agc_driver_draw_shader_failure_materialization_correlation_disabled COMMAND agc_driver_draw_shader_failure_tests materialization-failure-correlation-disabled)
+    set_tests_properties(agc_driver_draw_shader_failure_materialization_correlation_disabled PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_CAPTURE_TRACE=1;APS5_CAPTURE_TRACE_PATH=${agcDrawShaderFailureTraceDirectory}/materialization_correlation_disabled/trace.log" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_draw_shader_failure agc_driver_draw_shader_failure_successful agc_driver_draw_shader_failure_correlation_disabled agc_driver_draw_shader_failure_request_correlation_disabled agc_driver_draw_shader_failure_materialization agc_driver_draw_shader_failure_materialization_correlation_disabled PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_structurizer_intersection_off COMMAND agc_structurizer_tests)
     set_tests_properties(agc_structurizer_intersection_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_PERF_DOM_INTERSECTION=1" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
     add_test(NAME agc_structurizer_iteration_selection_off COMMAND agc_structurizer_tests)
@@ -2651,6 +2953,15 @@ if(BUILD_TESTING)
         set_tests_properties(agc_sampled_cache_device_selection agc_driver_sampled_cache_device_selection PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    foreach(imageRecoveryMode IN ITEMS sampled storage srgb repack)
+        add_test(NAME agc_driver_recover_${imageRecoveryMode}_allocation COMMAND agc_driver_sampled_cache_budget_tests recover-${imageRecoveryMode})
+        set_tests_properties(agc_driver_recover_${imageRecoveryMode}_allocation PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 TIMEOUT 30)
+        if(WIN32)
+            set_tests_properties(agc_driver_recover_${imageRecoveryMode}_allocation PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
+    set_property(TEST agc_driver_recover_srgb_allocation APPEND PROPERTY ENVIRONMENT_MODIFICATION "APS5_SRGB_SHADER_DECODE=set:copy")
     add_test(NAME agc_driver_resource_cache_storage_admission COMMAND agc_driver_sampled_cache_budget_tests resource-admission)
     add_test(NAME agc_driver_resource_cache_oversized_storage_admission COMMAND agc_driver_sampled_cache_budget_tests resource-oversized)
     add_test(NAME agc_driver_resource_cache_storage_clear COMMAND agc_driver_sampled_cache_budget_tests resource-clear)
@@ -2720,18 +3031,32 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_flip_compute agc_driver_present_mode agc_driver_worker_failure_log PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test(NAME agc_driver_linear_readback_label_off COMMAND agc_driver_linear_readback_label_tests)
+    set_tests_properties(agc_driver_linear_readback_label_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_LABEL_READBACK_STORE=1" WILL_FAIL TRUE TIMEOUT 60)
+    if(WIN32)
+        set_tests_properties(agc_driver_linear_readback_label_off PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_draw_cache_reuse_off COMMAND agc_driver_draw_cache_reuse_tests)
     set_tests_properties(agc_driver_draw_cache_reuse_off PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_GPL=1" SKIP_RETURN_CODE 77)
     add_test(NAME agc_driver_draw_cache_reuse_verify COMMAND agc_driver_draw_cache_reuse_tests)
     set_tests_properties(agc_driver_draw_cache_reuse_verify PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_VERIFY_DRAW_DATA_HITS=1" SKIP_RETURN_CODE 77)
+    add_test(NAME agc_driver_draw_cache_reuse_entry_verify COMMAND agc_driver_draw_cache_reuse_tests)
+    set_tests_properties(agc_driver_draw_cache_reuse_entry_verify PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_VERIFY_DRAW_ENTRIES=1" SKIP_RETURN_CODE 77 FAIL_REGULAR_EXPRESSION "FATAL:")
+    if(WIN32)
+        set_tests_properties(agc_driver_draw_cache_reuse_entry_verify PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_draw_cache_reuse_inline COMMAND agc_driver_draw_cache_reuse_tests)
     set_tests_properties(agc_driver_draw_cache_reuse_inline PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_PIPELINED_DRAWS=0;APS5_VERIFY_DRAW_RECIPE=1;APS5_VERIFY_REGISTER_KEYS=1" SKIP_RETURN_CODE 77)
     set_tests_properties(agc_driver_draw_cache_reuse agc_driver_draw_cache_reuse_off agc_driver_draw_cache_reuse_verify agc_driver_draw_cache_reuse_inline PROPERTIES FAIL_REGULAR_EXPRESSION "FATAL:")
     set_property(TEST agc_driver_draw_cache_reuse agc_driver_draw_cache_reuse_off APPEND PROPERTY ENVIRONMENT "APS5_VERIFY_DRAW_RECIPE=1" "APS5_VERIFY_REGISTER_KEYS=1")
     add_test(NAME agc_driver_draw_data_hit_user_words_verify COMMAND agc_driver_draw_data_hit_user_words_tests)
     set_tests_properties(agc_driver_draw_data_hit_user_words_verify PROPERTIES ENVIRONMENT "APS5_VERIFY_DRAW_DATA_HITS=1" SKIP_RETURN_CODE 77)
+    add_test(NAME agc_driver_draw_data_hit_user_words_refresh COMMAND agc_driver_draw_data_hit_user_words_tests)
+    set_tests_properties(agc_driver_draw_data_hit_user_words_refresh PROPERTIES ENVIRONMENT "APS5_DRAW_PIPELINE=1" SKIP_RETURN_CODE 77)
     if(WIN32)
-        set_tests_properties(agc_driver_draw_cache_reuse_off agc_driver_draw_cache_reuse_verify agc_driver_draw_cache_reuse_inline agc_driver_draw_data_hit_user_words_verify PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_driver_draw_cache_reuse_off agc_driver_draw_cache_reuse_verify agc_driver_draw_cache_reuse_inline agc_driver_draw_data_hit_user_words_verify agc_driver_draw_data_hit_user_words_refresh PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 
@@ -2779,6 +3104,13 @@ if(BUILD_TESTING)
             endif()
         endforeach()
     endforeach()
+    add_test(NAME agc_driver_depth_plane_partial_store_unimported COMMAND agc_driver_depth_plane_partial_store_tests)
+    set_tests_properties(agc_driver_depth_plane_partial_store_unimported PROPERTIES
+            ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_HOST_IMPORT=1" TIMEOUT 30 SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_depth_plane_partial_store_unimported PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test(NAME agc_driver_array_layer_target_cpu COMMAND agc_driver_array_layer_target_tests)
     set_tests_properties(agc_driver_array_layer_target_cpu PROPERTIES
             ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_HOST_IMPORT=1" TIMEOUT 30 SKIP_RETURN_CODE 77)
@@ -2827,15 +3159,26 @@ if(BUILD_TESTING)
         endif()
     endforeach()
     add_test(NAME agc_driver_shutdown_threads_joined COMMAND agc_driver_shutdown_threads_tests --joined)
+    add_test(NAME agc_driver_shutdown_threads_queued_prebuilds COMMAND agc_driver_shutdown_threads_tests --queued-prebuilds)
     add_test(NAME agc_driver_shutdown_threads_compare_helpers COMMAND agc_driver_shutdown_threads_tests --compare-helpers)
     add_test(NAME agc_driver_shutdown_threads_draw_committer COMMAND agc_driver_shutdown_threads_tests --draw-committer)
     add_test(NAME agc_driver_shutdown_threads_shader_cache_writer COMMAND agc_driver_shutdown_threads_tests --shader-cache-writer)
     add_test(NAME agc_driver_shutdown_threads_late_shader_cache COMMAND agc_driver_shutdown_threads_tests --late-shader-cache)
     add_test(NAME agc_driver_shutdown_threads_async_log_held COMMAND agc_driver_shutdown_threads_tests --async-log-held)
     add_test(NAME agc_driver_shutdown_threads_exit_after_start COMMAND agc_driver_shutdown_threads_tests --exit-after-start)
-    set_tests_properties(agc_driver_shutdown_threads_joined agc_driver_shutdown_threads_compare_helpers agc_driver_shutdown_threads_draw_committer agc_driver_shutdown_threads_shader_cache_writer agc_driver_shutdown_threads_late_shader_cache agc_driver_shutdown_threads_async_log_held agc_driver_shutdown_threads_exit_after_start PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30)
+    set_tests_properties(agc_driver_shutdown_threads_joined agc_driver_shutdown_threads_queued_prebuilds agc_driver_shutdown_threads_compare_helpers agc_driver_shutdown_threads_draw_committer agc_driver_shutdown_threads_shader_cache_writer agc_driver_shutdown_threads_late_shader_cache agc_driver_shutdown_threads_async_log_held agc_driver_shutdown_threads_exit_after_start PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30)
     if(WIN32)
-        set_tests_properties(agc_driver_shutdown_threads_joined agc_driver_shutdown_threads_compare_helpers agc_driver_shutdown_threads_draw_committer agc_driver_shutdown_threads_shader_cache_writer agc_driver_shutdown_threads_late_shader_cache agc_driver_shutdown_threads_async_log_held agc_driver_shutdown_threads_exit_after_start PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_driver_shutdown_threads_joined agc_driver_shutdown_threads_queued_prebuilds agc_driver_shutdown_threads_compare_helpers agc_driver_shutdown_threads_draw_committer agc_driver_shutdown_threads_shader_cache_writer agc_driver_shutdown_threads_late_shader_cache agc_driver_shutdown_threads_async_log_held agc_driver_shutdown_threads_exit_after_start PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_prepared_shaders_abi_deferred_concurrent_lazy COMMAND agc_driver_prepared_shaders_tests --abi-deferred-concurrent)
+    set_tests_properties(agc_driver_prepared_shaders_abi_deferred_concurrent_lazy PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_FAILURE_MEMO=1;APS5_LAZY_SHADER_PREPARE=1;APS5_SUSPEND_DRAIN=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_prepared_shaders_abi_deferred_concurrent_lazy PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test(NAME agc_driver_prepared_shaders_abi_deferred_compute_lazy COMMAND agc_driver_prepared_shaders_tests --abi-deferred-compute)
+    set_tests_properties(agc_driver_prepared_shaders_abi_deferred_compute_lazy PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_NO_FAILURE_MEMO=1;APS5_LAZY_SHADER_PREPARE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
+    if(WIN32)
+        set_tests_properties(agc_driver_prepared_shaders_abi_deferred_compute_lazy PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_driver_compute_user_data_calls_registered COMMAND agc_driver_compute_user_data_calls_tests --registered)
     set_tests_properties(agc_driver_compute_user_data_calls_registered PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1" SKIP_RETURN_CODE 77 WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}")
@@ -2953,6 +3296,16 @@ set_target_properties(agc_shader_replay PROPERTIES CXX_EXTENSIONS OFF)
 configure_windows_unwind(agc_shader_replay)
 
 if(BUILD_TESTING)
+    foreach(optimizer IN ITEMS none full)
+        if(optimizer STREQUAL "full" AND NOT ANYPS5_ENABLE_SPIRV_TOOLS)
+            continue()
+        endif()
+        add_test(NAME agc_shader_specialized_bda_abi_${optimizer} COMMAND agc_shader_memory_tests --specialized-bda-abi)
+        set_tests_properties(agc_shader_specialized_bda_abi_${optimizer} PROPERTIES ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_SPIRV_OPT=${optimizer}" WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}" TIMEOUT 30)
+        if(WIN32)
+            set_tests_properties(agc_shader_specialized_bda_abi_${optimizer} PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
     add_test_executable(agc_shader_replay_requests_tests tests/ShaderReplayRequests.cpp)
     target_link_libraries(agc_shader_replay_requests_tests PRIVATE shader_recompiler_agc_driver libc)
     set_target_properties(agc_shader_replay_requests_tests PROPERTIES CXX_EXTENSIONS OFF)
@@ -2971,6 +3324,18 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+add_executable(agc_frame_replay EXCLUDE_FROM_ALL
+        tools/FrameReplay.cpp
+        Execution/src/FrameCapture.cpp
+)
+target_include_directories(agc_frame_replay PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(agc_frame_replay PRIVATE libSceAgcDriver libkernel libc libzstd_static)
+if(WIN32)
+    target_link_options(agc_frame_replay PRIVATE LINKER:--image-base=0x500000000000)
+endif()
+set_target_properties(agc_frame_replay PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_frame_replay)
+
 add_executable(agc_pm4_replay EXCLUDE_FROM_ALL
         tools/Pm4Replay.cpp
         tools/Pm4Analysis.cpp
@@ -3017,6 +3382,58 @@ if(BUILD_TESTING)
         set_tests_properties(agc_driver_pm4_replay agc_driver_pm4_replay_tool PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+
+    if(WIN32)
+        add_test_executable(agc_driver_frame_capture_eop_tests tests/FrameCaptureEop.cpp Execution/src/FrameCapture.cpp)
+        target_include_directories(agc_driver_frame_capture_eop_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR} ${ANYPS5_SPIRV_HEADERS_INCLUDE_DIR})
+        target_link_libraries(agc_driver_frame_capture_eop_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static)
+        set_target_properties(agc_driver_frame_capture_eop_tests PROPERTIES CXX_EXTENSIONS OFF)
+        configure_windows_unwind(agc_driver_frame_capture_eop_tests)
+        add_test(NAME agc_driver_frame_capture_eop COMMAND agc_driver_frame_capture_eop_tests)
+        set_tests_properties(agc_driver_frame_capture_eop PROPERTIES
+                ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-capture-eop;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=3"
+                TIMEOUT 120)
+        set_tests_properties(agc_driver_frame_capture_eop PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
+    add_test_executable(agc_driver_frame_replay_state_tests tests/FrameReplayState.cpp Execution/src/FrameCapture.cpp)
+    target_include_directories(agc_driver_frame_replay_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(agc_driver_frame_replay_state_tests PRIVATE libSceAgcDriver libkernel libc libzstd_static)
+    set_target_properties(agc_driver_frame_replay_state_tests PROPERTIES CXX_EXTENSIONS OFF)
+    configure_windows_unwind(agc_driver_frame_replay_state_tests)
+    set(agcFrameReplayModes order tokens blocking)
+    if(WIN32)
+        list(APPEND agcFrameReplayModes zero shader shader_host)
+    endif()
+    foreach(mode IN LISTS agcFrameReplayModes)
+        set(capture "${CMAKE_CURRENT_BINARY_DIR}/frame-replay-${mode}")
+        add_test(NAME agc_driver_frame_replay_${mode} COMMAND agc_driver_frame_replay_state_tests ${mode} "${capture}")
+        set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES TIMEOUT 30)
+        if(mode MATCHES "^shader")
+            set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES ENVIRONMENT
+                    "APS5_FRAME_CAPTURE=${capture};APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=1")
+        endif()
+        if(WIN32)
+            set_tests_properties(agc_driver_frame_replay_${mode} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
+
+    if(WIN32)
+        add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp)
+        target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static)
+        set_target_properties(agc_driver_frame_replay_tests PROPERTIES CXX_EXTENSIONS OFF)
+        configure_windows_unwind(agc_driver_frame_replay_tests)
+        add_dependencies(agc_driver_frame_replay_tests agc_frame_replay)
+        add_test(NAME agc_driver_frame_replay COMMAND agc_driver_frame_replay_tests $<TARGET_FILE:agc_frame_replay>)
+        set_tests_properties(agc_driver_frame_replay PROPERTIES
+                ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=2"
+                TIMEOUT 120)
+        set_tests_properties(agc_driver_frame_replay PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
 endif()
 
 add_executable(agc_compute_pipeline_replay EXCLUDE_FROM_ALL tools/ComputePipelineReplay.cpp)
@@ -3042,12 +3459,15 @@ if(BUILD_TESTING)
     set_tests_properties(agc_driver_covered_centroid_state PROPERTIES TIMEOUT 30)
     add_test(NAME agc_driver_sample_location_grid_fallback COMMAND agc_driver_graphics_tests --sample-location-grid-fallback)
     set_tests_properties(agc_driver_sample_location_grid_fallback PROPERTIES TIMEOUT 30)
+    add_test(NAME agc_driver_unobserved_provoking_vertex COMMAND agc_driver_graphics_tests --unobserved-provoking-vertex)
+    set_tests_properties(agc_driver_unobserved_provoking_vertex PROPERTIES TIMEOUT 30)
     add_test(NAME agc_driver_sample_order_planning COMMAND agc_driver_graphics_tests --sample-order)
     set_tests_properties(agc_driver_sample_order_planning PROPERTIES TIMEOUT 30)
     if(WIN32)
         set_tests_properties(agc_compute_descriptor_layout_flags PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         set_tests_properties(agc_driver_covered_centroid_state PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         set_tests_properties(agc_driver_sample_location_grid_fallback PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        set_tests_properties(agc_driver_unobserved_provoking_vertex PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         set_tests_properties(agc_driver_sample_order_planning PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test(NAME agc_compute_pipeline_capture COMMAND agc_compute_pipeline_capture_tests)
@@ -3264,6 +3684,14 @@ if(BUILD_TESTING)
         set_tests_properties(scalar_call PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(ir_dump_memory_tests ${LIBS_INCLUDE_DIR}/tests/IrDumpMemory.cpp)
+    target_link_libraries(ir_dump_memory_tests PRIVATE shader_recompiler_agc_driver libc)
+    configure_windows_unwind(ir_dump_memory_tests)
+    add_test(NAME ir_dump_memory COMMAND ir_dump_memory_tests)
+    if(WIN32)
+        set_tests_properties(ir_dump_memory PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(image_sample_gather_tests ${LIBS_INCLUDE_DIR}/tests/ImageSampleGather.cpp)
     target_link_libraries(image_sample_gather_tests PRIVATE shader_recompiler_agc_driver libc)
     configure_windows_unwind(image_sample_gather_tests)
@@ -3365,6 +3793,19 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+add_test_executable(agc_gcn_decode_tests EXCLUDE_FROM_ALL tests/GcnDecode.cpp)
+target_link_libraries(agc_gcn_decode_tests PRIVATE shader_recompiler_agc_driver libc)
+set_target_properties(agc_gcn_decode_tests PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_gcn_decode_tests)
+if(BUILD_TESTING)
+    set_target_properties(agc_gcn_decode_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    add_test(NAME agc_gcn_decode COMMAND agc_gcn_decode_tests)
+    if(WIN32)
+        set_tests_properties(agc_gcn_decode PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 add_test_executable(agc_pixel_position_export_tests EXCLUDE_FROM_ALL tests/PixelPositionExport.cpp)
 target_link_libraries(agc_pixel_position_export_tests PRIVATE shader_recompiler_agc_driver libc)
 set_target_properties(agc_pixel_position_export_tests PROPERTIES CXX_EXTENSIONS OFF)
@@ -3490,6 +3931,16 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+if(BUILD_TESTING)
+    add_test_executable(agc_flat_scratch_tests tests/FlatScratch.cpp)
+    target_link_libraries(agc_flat_scratch_tests PRIVATE shader_recompiler_agc_driver libc)
+    configure_windows_unwind(agc_flat_scratch_tests)
+    add_test(NAME agc_flat_scratch COMMAND agc_flat_scratch_tests)
+    set_tests_properties(agc_flat_scratch PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(agc_flat_scratch PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
 add_test_executable(agc_constant_select_tests EXCLUDE_FROM_ALL tests/ConstantSelect.cpp)
 target_link_libraries(agc_constant_select_tests PRIVATE shader_recompiler_agc_driver libc)
 set_target_properties(agc_constant_select_tests PROPERTIES CXX_EXTENSIONS OFF)
diff --git a/core/libs/prx/libSceAgcDriver/Eq/src/Event.cpp b/core/libs/prx/libSceAgcDriver/Eq/src/Event.cpp
index 80774d7216..d7f5463eae 100644
--- a/core/libs/prx/libSceAgcDriver/Eq/src/Event.cpp
+++ b/core/libs/prx/libSceAgcDriver/Eq/src/Event.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 
 #include <algorithm>
 #include <cstdint>
@@ -20,7 +21,7 @@ struct Registration {
     int id;
 };
 
-std::mutex g_mutex;
+AgcDriver::Mutex g_mutex;
 std::vector<Registration> g_registrations;
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp
index 56dd9215f3..501c86b224 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp
@@ -13,6 +13,12 @@
 
 namespace AgcDriver {
 
+inline const char* CaptureTracePath() {
+    const char* configuredPath = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    if (configuredPath != nullptr && configuredPath[0] != '\0') return configuredPath;
+    return "capture-trace.log";
+}
+
 class CaptureTrace {
 public:
     static bool Enabled() {
@@ -30,6 +36,14 @@ public:
         trace.append(std::string(line.data(), static_cast<std::size_t>(size)));
     }
 
+    template<typename... TArgs>
+    static void LogBestEffort(const char* format, TArgs... args) noexcept {
+        try {
+            Log(format, args...);
+        } catch (...) {
+        }
+    }
+
 private:
     static CaptureTrace& instance() {
         static CaptureTrace trace;
@@ -37,8 +51,13 @@ private:
     }
 
     CaptureTrace() {
+        const char* path = CaptureTracePath();
+        output.open(path, std::ios::binary);
+        if (!output.is_open()) {
+            std::fprintf(stderr, "Capture trace open failed for %s\n", path);
+            return;
+        }
         output.exceptions(std::ios::badbit | std::ios::failbit);
-        output.open("capture-trace.log", std::ios::binary);
         worker = std::thread([this] { run(); });
     }
 
@@ -48,10 +67,11 @@ private:
             stopping = true;
         }
         changed.notify_one();
-        worker.join();
+        if (worker.joinable()) worker.join();
     }
 
     void append(std::string line) {
+        if (!output.is_open()) return;
         const auto elapsed = std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::steady_clock::now() - start).count();
         std::lock_guard lock(mutex);
         if (pending.size() + line.size() + 64 > 16 * 1024 * 1024) throw std::runtime_error("Capture trace queue exceeded 16 MiB");
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp
index 558a25bde7..4646531f5a 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/DeviceFault.hpp
@@ -6,6 +6,8 @@
 #endif
 #include <vulkan/vulkan.h>
 #include <algorithm>
+#include <array>
+#include <atomic>
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
@@ -14,6 +16,17 @@
 
 namespace AgcDriver {
 
+struct DeviceDiagnostics {
+    bool config = false;
+    bool checkpoints = false;
+    VkDeviceDiagnosticsConfigFlagsNV flags = 0;
+};
+
+inline DeviceDiagnostics ChooseDeviceDiagnostics(bool requested, bool configSupported, bool checkpointsSupported) {
+    if (!requested || !configSupported) return {};
+    return {true, checkpointsSupported, VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_DEBUG_INFO_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_RESOURCE_TRACKING_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_AUTOMATIC_CHECKPOINTS_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_ERROR_REPORTING_BIT_NV};
+}
+
 inline const char* DeviceFaultAddressKind(VkDeviceFaultAddressTypeEXT type) {
     switch (type) {
     case VK_DEVICE_FAULT_ADDRESS_TYPE_NONE_EXT: return "none";
@@ -74,6 +87,62 @@ inline std::vector<std::string> DeviceFaultReport(VkDevice device, PFN_vkGetDevi
     return lines;
 }
 
+class BufferMarkerLog {
+public:
+    static constexpr std::uint32_t Capacity = 4096;
+    static constexpr std::uint32_t Listed = 8;
+
+    std::uint32_t Next(std::uint64_t program) {
+        std::uint32_t id = 0;
+        while (id == 0) id = next.fetch_add(1, std::memory_order_relaxed) + 1;
+        auto& slot = slots[id % Capacity];
+        slot.program.store(program, std::memory_order_relaxed);
+        slot.id.store(id, std::memory_order_release);
+        return id;
+    }
+
+    std::vector<std::string> Report(std::uint32_t reached, std::uint32_t finished) const {
+        std::vector<std::string> lines;
+        if (reached == 0 && finished == 0) {
+            lines.emplace_back("[device-fault] no buffer marker reached");
+            return lines;
+        }
+        lines.push_back(Line("last dispatch reached", reached));
+        if (finished == 0) lines.emplace_back("[device-fault] no dispatch finished");
+        else lines.push_back(Line("last dispatch finished", finished));
+        const std::uint32_t pending = reached - finished;
+        if (pending == 0 || pending > Capacity) return lines;
+        const auto listed = std::min(pending, Listed);
+        for (std::uint32_t i = 1; i <= listed; ++i) lines.push_back(Line("unfinished dispatch", finished + i));
+        if (pending > listed) {
+            char line[96];
+            std::snprintf(line, sizeof(line), "[device-fault] %u more unfinished dispatches", pending - listed);
+            lines.emplace_back(line);
+        }
+        return lines;
+    }
+
+private:
+    struct Slot {
+        std::atomic<std::uint32_t> id{0};
+        std::atomic<std::uint64_t> program{0};
+    };
+
+    std::string Line(const char* what, std::uint32_t id) const {
+        char line[128];
+        const auto& slot = slots[id % Capacity];
+        if (id != 0 && slot.id.load(std::memory_order_acquire) == id) {
+            std::snprintf(line, sizeof(line), "[device-fault] %s: marker %u, program 0x%llx", what, id, static_cast<unsigned long long>(slot.program.load(std::memory_order_relaxed)));
+        } else {
+            std::snprintf(line, sizeof(line), "[device-fault] %s: marker %u, program not in the log", what, id);
+        }
+        return line;
+    }
+
+    std::atomic<std::uint32_t> next{0};
+    std::array<Slot, Capacity> slots{};
+};
+
 }
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
index b599b88f95..e02db9f381 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
@@ -1,8 +1,10 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_HPP
 
+#include <cstddef>
 #include <cstdint>
 #include <span>
+#include <cstddef>
 #include "SceTypes.hpp"
 #include "SceShaders.hpp"
 
@@ -10,8 +12,17 @@ namespace AgcDriver {
 
 void Submit(const Packet* packet, std::uint32_t queue);
 
+struct AwaitedWait {
+    std::uint64_t address = 0;
+    std::uint64_t reference = 0;
+    std::uint64_t mask = 0;
+    std::uint32_t function = 0;
+    std::uint32_t bytes = 0;
+};
+
 }
 
+extern "C" void AgcDriverPrepareCommandWrite_nid_no_patch(std::uint64_t address, std::size_t bytes);
 extern "C" void AgcDriverWaitIdle_nid_postfix();
 extern "C" void AgcDriverRaiseWorkerThreadPriority_nid_postfix(const char* role);
 extern "C" void AgcDriverLockVulkanLoader_nid_postfix();
@@ -19,6 +30,8 @@ extern "C" void AgcDriverUnlockVulkanLoader_nid_postfix();
 extern "C" void AgcDriverShutdown_nid_postfix();
 extern "C" void AgcDriverRequestScreenshot_nid_postfix();
 extern "C" void AgcDriverSuspendPoint_nid_postfix();
+extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std::uint64_t* completed);
+extern "C" std::size_t AgcDriverAwaitedWaits_nid_postfix(AgcDriver::AwaitedWait* waits, std::size_t capacity);
 extern "C" std::uint64_t AgcDriverDispatchesAdoptedAhead_nid_postfix();
 extern "C" void AgcDriverRegisterShader_nid_postfix(const Shader* shader);
 extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp
index 3bd84a70db..2e33081f07 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp
@@ -3,10 +3,9 @@
 
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include <atomic>
-#include <condition_variable>
 #include <cstddef>
+#include <cstdint>
 #include <memory>
-#include <mutex>
 #include "prx/libc/include/general/AtomicSharedPtr.hpp"
 
 namespace AgcDriver::DriverDetail {
@@ -33,10 +32,8 @@ public:
     void unlock();
 
 private:
-    std::mutex mutex;
-    std::condition_variable changed;
-    std::size_t users = 0;
-    bool replacing = false;
+    static constexpr std::uint32_t Replacing = 0x80000000u;
+    std::atomic<std::uint32_t> state{0};
 };
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawCache.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawCache.hpp
index 3e1f59e9f4..d3f3da21fa 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawCache.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawCache.hpp
@@ -4,6 +4,7 @@
 #include "UserDataUse.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Dispatch/DispatchCache.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
 #include <array>
 #include <atomic>
 #include <chrono>
@@ -11,6 +12,7 @@
 #include <cstdint>
 #include <list>
 #include <memory>
+#include <span>
 #include <utility>
 #include <vector>
 #include "prx/libc/include/general/AtomicSharedPtr.hpp"
@@ -45,6 +47,7 @@ struct DrawDecode {
 void ReadUserWords(const QueueState& queue, DrawProgram& program, bool staticAbi);
 void InitializeMerged(const QueueState& queue, DrawProgram& program, std::uint32_t pointerBase, bool pointerRequired, bool staticAbi);
 void DecodeGraphicsPrograms(DrawDecode& decoded, const QueueState& queue, const ShaderRegistry& registry, bool staticAbi, bool includeFragment);
+ShaderRecompiler::ShaderVertexStageInfo DecodeOrderedVertexStageInfo(std::span<const std::byte> header, std::uint64_t headerAddress, std::span<const std::uint32_t> userData, std::vector<Graphics::DecodeRead>& reads, std::uint32_t hiddenUserWords);
 
 void AppendProgramMemory(std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<DrawProgram>& programs);
 std::vector<std::pair<std::size_t, std::size_t>> UserDataWords(const std::vector<DrawProgram>& programs, const std::vector<ShaderRecompiler::ProgramRole>& roles, std::uint32_t location);
@@ -88,7 +91,7 @@ struct StageDataHit {
 enum class DrawMiss : std::size_t { FrontDiffering, FragmentDiffering, OtherDiffering, Layout, Gate, Stages, Count };
 
 struct DrawEntryCounters {
-    std::uint64_t lookups = 0, absent = 0, hits = 0, stageValidations = 0, stageEqual = 0, variantsCompared = 0, inserts = 0, variantsInserted = 0, variantsEvicted = 0, present = 0, unstable = 0, touches = 0, verifyHits = 0, verifyMismatches = 0;
+    std::uint64_t lookups = 0, absent = 0, hits = 0, stageValidations = 0, stageEqual = 0, variantsCompared = 0, inserts = 0, shapeUpdates = 0, variantsInserted = 0, variantsEvicted = 0, present = 0, unstable = 0, touches = 0, verifyHits = 0, verifyMismatches = 0;
     std::array<std::uint64_t, static_cast<std::size_t>(DrawMiss::Count)> misses{};
     std::array<std::uint64_t, MaxDispatchVariants> variantHitsByRank{};
     double validateUs = 0;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp
index 9ca8b03dd5..50844922e8 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp
@@ -13,6 +13,8 @@
 #include <mutex>
 #include <optional>
 #include <thread>
+#include <span>
+#include <string>
 #include <utility>
 #include <vector>
 
@@ -22,6 +24,11 @@ class DrawPipeline {
 public:
     using Commit = std::function<void()>;
     using Range = std::pair<std::uint64_t, std::uint64_t>;
+    struct Watch {
+        std::uint64_t retired = 0;
+        std::size_t items = 0;
+        std::vector<Range> writes;
+    };
     enum class DrainReason : std::uint8_t { Packet, Flush, Labels, Capture, Indirect, Submission, Count };
 
     static DrawPipeline& Queue0();
@@ -32,17 +39,27 @@ public:
     static void FollowEpoch(std::uint64_t token);
     static unsigned Committers();
 
-    void Enqueue(Commit commit, std::vector<Range> writes, std::uint64_t labelAddress = 0, std::vector<std::byte> labelBytes = {}, std::vector<Range> reads = {});
+    void Enqueue(Commit commit, std::vector<Range> writes, std::uint64_t labelAddress = 0, std::vector<std::byte> labelBytes = {}, std::vector<Range> reads = {}, bool draw = false);
     void Drain(DrainReason reason, std::uint32_t opcode = 0x100);
     void Stop();
+    void ReleaseRetired();
     static std::uint64_t DrainRequestsByOpcode(std::uint32_t opcode);
-    bool Busy() const { return outstanding.load(std::memory_order_acquire) != 0; }
+    bool Busy() const;
     std::size_t Outstanding() const { return outstanding.load(std::memory_order_acquire); }
     bool Overlaps(std::uint64_t address, std::size_t bytes);
+    bool OverlapsAny(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges);
+    Watch WatchWrites();
+    bool WrittenSince(const Watch& watch, const std::vector<Range>& reads);
+    std::uint64_t Retired() const { return retiredItems.load(std::memory_order_acquire); }
+    void NoteDecodeDrain() { decodeDrains.fetch_add(1, std::memory_order_relaxed); }
+    std::uint64_t DecodeDrains() const { return decodeDrains.load(std::memory_order_relaxed); }
     std::optional<std::uint64_t> PendingLabel(std::uint64_t address, std::size_t bytes);
     static bool HeldReads(std::uint64_t address, std::size_t bytes);
     void ReleaseRunningReads();
 
+    static bool MetadataPassesPipelined();
+    static void CountPipelinedMetadataPass();
+    static std::uint64_t PipelinedMetadataPasses();
 private:
     struct Item {
         Commit commit;
@@ -50,22 +67,32 @@ private:
         std::uint64_t labelAddress = 0;
         std::vector<std::byte> labelBytes;
         std::vector<Range> reads;
+        bool draw = false;
     };
     DrawPipeline() = default;
     void run();
     void rethrowFailure();
     void report(std::chrono::steady_clock::time_point now);
+    void countWrites(const std::vector<Range>& writes, bool added);
 
     std::mutex mutex;
     std::condition_variable wake;
     std::condition_variable idle;
     std::deque<Item> items;
+    std::vector<std::pair<Range, std::uint32_t>> queuedWrites;
+    std::vector<Item> retired;
     std::exception_ptr failure;
     std::atomic<std::size_t> outstanding{0};
+    std::atomic<std::uint64_t> retiredItems{0};
+    std::atomic<std::uint64_t> decodeDrains{0};
+    std::uint64_t reportedDecodeDrains = 0;
     std::uint32_t idleWaiters = 0;
+    std::size_t resumeAt = 0;
     bool committerWaiting = false;
     bool stopped = false;
     bool closing = false;
+    std::uint64_t wakes = 0;
+    std::uint64_t lockWaitNs = 0;
     std::thread thread;
     std::uint64_t commits = 0;
     std::uint64_t commitNs = 0;
@@ -80,6 +107,54 @@ private:
     std::chrono::steady_clock::time_point lastReport = std::chrono::steady_clock::now();
 };
 
+class DrawFinisher {
+public:
+    using Job = std::function<void()>;
+    using Range = std::pair<std::uint64_t, std::uint64_t>;
+    struct Pending {
+        std::uint64_t key = 0;
+        std::uint64_t shape = 0;
+        bool unknown = true;
+        std::vector<Range> writes;
+        std::uint64_t labelAddress = 0;
+        std::vector<std::byte> labelBytes;
+    };
+    enum class LabelLookup : std::uint8_t { NotHeld, Value, Unknown };
+    static bool Overlap();
+    bool PendingOverlaps(std::uint64_t begin, std::uint64_t end);
+    LabelLookup PendingLabel(std::uint64_t address, std::size_t bytes, std::uint64_t& value);
+    bool PendingOverlapsAny(std::span<const Range> ranges);
+    bool PendingKey(std::uint64_t key, std::uint64_t shape);
+    enum class DrainSite : std::uint32_t { Lookup, Reads, Packet, Kept, Count };
+    static void NoteDrain(DrainSite site, bool drained);
+    static std::string DrainText();
+    static void NoteDrainedOpcode(std::uint32_t opcode, bool besideCommits);
+    static DrawFinisher& Get();
+    static bool Enabled();
+    static bool OnFinisherThread();
+    static bool Busy() { return outstanding.load(std::memory_order_acquire) != 0; }
+    void Enqueue(Job job);
+    void Enqueue(Job job, Pending held);
+    void Drain();
+    void Settle();
+    void ReleaseRan();
+
+private:
+    DrawFinisher() = default;
+    void run();
+    inline static std::atomic<std::size_t> outstanding{0};
+    std::mutex mutex;
+    std::condition_variable wake;
+    std::condition_variable idle;
+    std::deque<Job> jobs;
+    std::deque<Pending> pending;
+    std::vector<Job> ran;
+    std::exception_ptr failure;
+    bool running = false;
+    bool sleeping = false;
+    std::thread thread;
+};
+
 }
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
index 3fb9f473b3..18303f9f7b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
@@ -2,6 +2,7 @@
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_DRIVER_HPP
 
 #include "prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionRing.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Packets/PacketHistory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Dispatch/DispatchCache.hpp"
@@ -17,6 +18,7 @@
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include <array>
 #include <atomic>
@@ -41,8 +43,14 @@
 #include <utility>
 #include <vector>
 
+namespace AgcDriver {
+class PerformanceTimer;
+}
+
 namespace AgcDriver::DriverDetail {
 
+struct DrawTail;
+
 class Driver {
 public:
     static Driver& Get();
@@ -57,6 +65,12 @@ public:
     void SubmitFlip(const FlipInfo& info);
     void SuspendPoint();
     std::uint32_t ReserveEopFlip(const FlipInfo& info);
+    std::uint32_t ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token);
+    std::vector<std::uint32_t> PendingEopFlipTokens();
+    std::pair<std::uint64_t, std::uint64_t> SerialProgress();
+    std::uint64_t FlipSubmissions() const;
+    std::vector<AwaitedWait> AwaitedWaits();
+    bool WaitIdleFor(std::chrono::milliseconds timeout);
     void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output);
     void UnregisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output);
     void AttachWindow(const PresentationWindow& window);
@@ -67,6 +81,17 @@ public:
     void ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
     void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
     void SettleShaderPreparations(std::span<const Shader* const> stages);
+    [[nodiscard]] std::size_t PreparedEntries(const Shader* shader);
+    struct DeferredAbiUseCounts {
+        std::uint64_t firstUses;
+        std::uint64_t found;
+        std::uint64_t own;
+        std::uint64_t entries;
+        std::uint64_t unmatchedEntries;
+    };
+    [[nodiscard]] static DeferredAbiUseCounts DeferredAbiUses();
+    [[nodiscard]] std::vector<std::array<std::uint64_t, 2>> PreparedEntryHashes(const Shader* shader);
+    [[nodiscard]] std::array<std::uint64_t, 4> PrebuiltLibraries();
     static void FoldDrawOffsets(const ShaderRecompiler::RecompileResult& result, const DrawProgram& program, Pm4::DrawParameters& parameters);
     static std::optional<Graphics::IndirectDrawPath> ClassifyIndirectDraw(const ShaderRecompiler::RecompileResult& result, const Graphics::State& graphics, const DrawProgram& frontProgram, const std::shared_ptr<VulkanDevice>& localDevice, Pm4::DrawParameters& drawParameters, bool traceIndirect);
     static void tagVariantRuns(DispatchVariant& variant, std::span<const ShaderRecompiler::MemoryRegion> regions, const ShaderRecompiler::SrtUserDataUse& use, bool eligible, std::uint32_t hiddenWords, std::span<const std::shared_ptr<const ShaderRecompiler::SrtGuestWords>> supplied = {});
@@ -86,10 +111,12 @@ private:
     friend class SampledReadScope;
     friend struct PendingView;
     friend struct PacketTimer;
+    friend struct DriverTestAccess;
     void stop();
     Driver();
     void rethrowFailure() const;
     void checkStopping() const;
+    std::uint32_t reserveEopFlip(const FlipInfo& info, std::uint32_t token);
     static bool& onWorkerThread();
     static void copyCommands(Submission& submission, const std::uint32_t* guest, std::size_t words);
     static bool copySegment(Submission& submission, const std::uint32_t* guest, std::size_t words, std::size_t& budget);
@@ -107,9 +134,9 @@ private:
     static void forgetUnfinishedWrites(QueueWorker& worker, std::span<const std::uint64_t> labelWrites);
     static bool& completionDeferred();
     void deferCompletion(const Submission& submission);
-    void submitOpenWork();
+    void submitOpenWork(const std::shared_ptr<SubmissionProgress>& progress = {});
     void wakeQueueZeroForCompletions();
-    void completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites);
+    void completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites, const std::shared_ptr<SubmissionProgress>& progress);
     static bool waitFree(const Submission& submission);
     bool queue0Before(std::uint64_t received) const;
     bool orderReleased(std::uint32_t queue, std::uint64_t received) const;
@@ -140,7 +167,7 @@ private:
     static bool verifyDrawRecipe();
     static std::size_t drawCacheEntries();
     void accountDrawVariant(const DispatchVariant& variant, bool added);
-    void insertDrawEntry(std::uint64_t key, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::shared_ptr<const DrawDecode> decode, std::uint64_t shape = 0);
+    void insertDrawEntry(std::uint64_t key, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::shared_ptr<const DrawDecode> decode, std::uint64_t shape = 0, bool replaceShape = false);
     bool admitDrawKey(std::uint64_t key, std::uint64_t shape);
     void eraseDrawEntry(std::uint64_t key, const std::shared_ptr<DrawEntry>& expected);
     std::shared_ptr<const DrawRecipe> findDrawRecipe(std::uint64_t key, const std::vector<std::shared_ptr<DispatchVariant>>& stages);
@@ -164,13 +191,14 @@ private:
     std::shared_ptr<DrawDecode> decodeDraw(const QueueState& queue, const Submission& submission, const Graphics::Context& context);
     void resolveDrawDecode(const QueueState& queue, const Submission& submission, const Graphics::Context& context, std::shared_ptr<const DrawDecode>& decode, bool registerKey, std::uint64_t drawKey, bool profile);
     void lookupDraw(const Submission& submission, const std::shared_ptr<VulkanDevice>& localDevice, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<DrawProgram>& programs, const std::vector<ShaderRecompiler::ProgramRole>& roles, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, bool useDrawEntries, bool registerKey, bool profile, std::uint64_t& drawKey, std::shared_ptr<DrawEntry>& entry, std::vector<std::shared_ptr<DispatchVariant>>& matched, std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool& drawHit, bool& verifyHit, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, const std::shared_ptr<DrawEntry>& dataEntry, DrawDataCandidates& dataCandidates, std::vector<StageDataHit>& stageData);
-    std::shared_ptr<const ShaderRecompiler::RecompileResult> materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics);
+    std::shared_ptr<const ShaderRecompiler::RecompileResult> materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::uint64_t traceToken, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics);
     static void recordStageDataPositions(DispatchVariant& variant, const ShaderRecompiler::ResourceCapture& capture, const std::vector<Graphics::DecodeRead>& decodeReads);
-    void cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey);
+    void cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<StageDataHit>& stageData, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey, bool shapeNeedsEntry = false);
     static bool drawPrecheck();
-    std::optional<DrawVerdict> precheckDraw(const QueueState& queue, const Submission& submission, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect);
+    std::optional<DrawVerdict> precheckDraw(const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect);
     static std::uint32_t drawUserWord(const DrawProgram& program, std::int32_t sgpr);
-    DrawVerdict draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::string& rejected);
+    DrawVerdict draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::size_t packetOffset, std::string& rejected);
+    DrawVerdict finishDraw(DrawTail& tail, PerformanceTimer& timing);
     void addDriverPhases(DispatchClass which, const std::array<double, DriverPhaseCount>& ms, bool hit, bool validated);
     static PendingDispatchPhases& pendingDispatchPhases();
     static std::chrono::steady_clock::time_point& packetStartedAt();
@@ -242,7 +270,8 @@ private:
     void noteForeignWriter(std::uint64_t begin, std::uint64_t end, std::uint32_t queue);
     void noteDrawWriters(std::span<const Graphics::CompiledShader> stages, std::uint32_t queue);
     static std::vector<std::pair<std::uint64_t, std::uint64_t>> drawWriteRanges(const Graphics::State& graphics, std::span<const Graphics::CompiledShader> stages);
-    void commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey);
+    void commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey, VulkanDevice::DrawTraceContext trace = {});
+    bool labelPacketQueues(std::span<const std::uint32_t> packet, std::uint32_t opcode);
     bool enqueueLabelPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue);
     bool enqueueDmaPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue, const QueueState& state);
     void commitDmaStore(std::uint32_t queue, std::uint64_t address, std::span<const std::byte> bytes);
@@ -338,7 +367,7 @@ private:
     void run(std::uint32_t id) noexcept;
 
     std::mutex mutex;
-    std::mutex shutdownMutex;
+    AgcDriver::Mutex shutdownMutex;
     std::condition_variable changed;
 
     std::map<std::uint32_t, QueueWorker> workers;
@@ -346,6 +375,14 @@ private:
     std::shared_ptr<FrameTiming> pendingFrameTiming;
 
     std::atomic<std::uint64_t> flipsCounted{0};
+    struct AwaitedSlot {
+        std::atomic<std::uint64_t> address{0};
+        std::atomic<std::uint64_t> reference{0};
+        std::atomic<std::uint64_t> mask{0};
+        std::atomic<std::uint64_t> shape{0};
+    };
+    std::array<AwaitedSlot, SubmissionQueueEnd - 0x20 + 1> awaitedSlots{};
+    void noteWaitFields(std::uint32_t queue, std::span<const std::uint32_t> packet);
     std::atomic<std::uint64_t> flipSerial{0};
     std::atomic<std::uint64_t> flipBatchesUnsignaled{0};
 
@@ -361,7 +398,7 @@ private:
     std::unordered_map<std::uint64_t, std::shared_ptr<DispatchEntry>> dispatchCache;
 
     std::list<std::uint64_t> dispatchOrder;
-    std::mutex dispatchCacheMutex;
+    AgcDriver::Mutex dispatchCacheMutex;
     std::uint64_t dispatchCacheHits = 0;
     std::uint64_t dispatchCacheEvictions = 0;
 
@@ -379,22 +416,22 @@ private:
     std::unordered_set<std::uint64_t> traceShapes, traceKeysSeen, traceKeysEvicted;
     std::list<std::uint64_t> drawOrder;
     std::unordered_map<std::uint64_t, std::shared_ptr<const DrawRelocation>> drawRelocations;
-    std::unordered_map<std::uint64_t, std::shared_ptr<DrawEntry>> drawAliases;
+    std::unordered_map<std::uint64_t, std::uint64_t> drawAliases;
     DrawRelocationPending drawRelocationPending;
     std::unordered_map<std::uint64_t, DrawRelocationTrial> drawRelocationTrials;
     DrawRelocationCounters drawRelocationCounters;
-    std::mutex drawCacheMutex;
+    AgcDriver::Mutex drawCacheMutex;
     std::uint64_t drawCacheHits = 0, drawCacheEvictions = 0, drawCacheVariants = 0, drawCacheVariantBytes = 0;
     std::optional<DrawKeySightings> drawKeySightings;
     std::optional<DrawKeySightings> drawShapeSightings;
 
     DrawEntryCounters drawEntryCounters;
 
-    std::mutex driverPhasesMutex;
+    AgcDriver::Mutex driverPhasesMutex;
     std::array<DriverPhaseTotals, DispatchClassCount> driverPhaseTotals{};
     std::chrono::steady_clock::time_point driverPhasesReport = std::chrono::steady_clock::now();
 
-    std::mutex drawPhasesMutex;
+    AgcDriver::Mutex drawPhasesMutex;
     DrawPhaseTotals drawPhaseTotals;
 
     std::map<std::uint32_t, QueueState> queues;
@@ -407,7 +444,7 @@ private:
     std::uint32_t nextEopToken = EopFlipTokenBase;
     DevicePointer device;
 
-    std::mutex labelStoresMutex;
+    AgcDriver::Mutex labelStoresMutex;
     std::unordered_map<std::uint64_t, std::array<LabelStore, LabelStoreHistory>> labelStores;
 
     std::vector<std::shared_ptr<VulkanDevice>> replacedDevices;
@@ -438,7 +475,7 @@ private:
     std::atomic<std::uint64_t> evidenceValidations{0};
     std::atomic<std::uint64_t> dispatchesAdoptedAhead{0};
 
-    std::mutex writtenBuffersMutex;
+    AgcDriver::Mutex writtenBuffersMutex;
     std::deque<WrittenBuffer> writtenBuffers;
     std::uint64_t writtenBufferSerial = 0;
     std::unordered_map<std::uint64_t, DwordEvidence> dwordEvidence;
@@ -448,7 +485,7 @@ private:
     std::atomic<std::uint64_t> observationsNoWait{0};
     std::atomic<std::uint64_t> observationsNotReached{0};
 
-    std::mutex validateMutex;
+    AgcDriver::Mutex validateMutex;
     ValidateCounters validateCounters;
 
 };
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp
index 0c72dfd1f1..fa3e284410 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp
@@ -28,6 +28,8 @@ struct StreamCopy {
 
 bool MatchesStreamCopyKernel(std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData, const ShaderRecompiler::ShaderComputeStageInfo& compute);
 std::optional<StreamCopy> StreamCopyRange(const std::vector<std::uint32_t>& userData, std::uint32_t groups);
+bool MatchesIndexedCopyKernel(std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData, const ShaderRecompiler::ShaderComputeStageInfo& compute);
+std::optional<StreamCopy> IndexedCopyRange(const std::vector<std::uint32_t>& userData, std::uint32_t groups, std::uint32_t count, std::uint32_t sourceOffset, std::uint32_t destinationOffset);
 
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp
index e71457e0f3..e45f794362 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp
@@ -3,6 +3,7 @@
 
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstddef>
@@ -22,6 +23,7 @@ struct Submission {
     std::uint64_t serial;
     std::uint32_t queue;
     std::vector<std::uint32_t> commands;
+    std::shared_ptr<SubmissionProgress> progress;
 
     std::shared_ptr<const ShaderRegistry> shaders;
     std::map<std::size_t, std::shared_ptr<IFlipRequest>> flips;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp
new file mode 100644
index 0000000000..5194af7ce4
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp
@@ -0,0 +1,44 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_QUEUES_SUBMISSIONPROGRESS_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_DRIVER_QUEUES_SUBMISSIONPROGRESS_HPP
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <utility>
+
+namespace AgcDriver { class VulkanDevice; }
+
+namespace AgcDriver::DriverDetail {
+
+class SubmissionProgress {
+public:
+    using Clock = std::chrono::steady_clock;
+    using Ready = std::pair<std::shared_ptr<VulkanDevice>, std::uint64_t>;
+
+    void Publish(std::shared_ptr<VulkanDevice> device, std::uint64_t epoch) {
+        {
+            std::lock_guard lock(mutex);
+            result = {std::move(device), epoch};
+            ready = true;
+        }
+        changed.notify_one();
+    }
+
+    Ready WaitUntil(Clock::time_point deadline) {
+        std::unique_lock lock(mutex);
+        if (!changed.wait_until(lock, deadline, [&] { return ready; })) return {};
+        return result;
+    }
+
+private:
+    std::mutex mutex;
+    std::condition_variable changed;
+    Ready result;
+    bool ready = false;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp
index 203940d7c3..b1907257c4 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp
@@ -127,6 +127,8 @@ struct PreparedShaderState {
     struct Entry {
         std::size_t codeOffset;
         std::shared_ptr<const ShaderRecompiler::SourceHandle> handle;
+        bool fromDeferredAbi = false;
+        bool matched = false;
     };
     struct Rectangle {
         std::uint64_t vertexId;
@@ -153,6 +155,14 @@ struct PreparedShaderState {
     bool deferred = false;
 };
 struct PreparedShaders : PreparedShaderState {
+    struct DeferredAbi {
+        std::vector<std::uint64_t> key;
+        std::vector<std::pair<std::uint32_t, std::uint32_t>> context;
+        std::vector<std::pair<std::uint32_t, std::uint32_t>> primitive;
+        std::weak_ptr<VulkanDevice> device;
+    };
+    std::vector<DeferredAbi> deferredAbis;
+    bool deferredPreparing = false;
     std::mutex mutex;
     std::condition_variable settled;
     std::exception_ptr failure;
@@ -165,6 +175,8 @@ struct RegisteredShaderState {
     Registers shader;
     Registers context;
     Registers userConfig;
+
+    bool operator==(const RegisteredShaderState&) const = default;
 };
 
 struct ShaderSnapshot {
@@ -177,6 +189,7 @@ struct ShaderSnapshot {
     std::shared_ptr<const RegisteredShaderState> registeredState;
     std::shared_ptr<std::atomic<std::uint8_t>> workgroupUse = std::make_shared<std::atomic<std::uint8_t>>(0u);
     std::shared_ptr<std::atomic<std::uint8_t>> positionVectorUse = std::make_shared<std::atomic<std::uint8_t>>(0u);
+    std::shared_ptr<std::atomic<std::uint8_t>> memoryWrites = std::make_shared<std::atomic<std::uint8_t>>(0u);
     std::shared_ptr<std::atomic<bool>> rawGraphicsNoted = std::make_shared<std::atomic<bool>>(false);
     std::optional<std::uint32_t> userDataTailRegister;
 };
@@ -189,6 +202,7 @@ void NoteRawGraphicsDraw(const ShaderSnapshot& snapshot);
 bool RawGraphicsDrawn();
 bool RawGraphicsDrawnIn(std::uint64_t begin, std::uint64_t end);
 bool ProgramUsesWorkgroup(const ShaderSnapshot& snapshot, std::size_t codeOffset);
+bool ProgramWritesMemory(const ShaderSnapshot& snapshot, std::size_t codeOffset);
 // The PA_CL_VS_OUT_CNTL position export bits a vertex program is compiled with: none for a program
 // without pos1..pos3 exports, so its artifact does not depend on them.
 std::uint32_t PositionExportLayout(const ShaderSnapshot* snapshot, std::size_t codeOffset, std::span<const std::uint32_t> code, std::uint32_t paClVsOutCntl, const ShaderSnapshot* continuation = nullptr);
@@ -198,6 +212,9 @@ std::shared_ptr<const ShaderRecompiler::SourceHandle> PrepareShaderWithDiagnosti
 
 std::uint64_t NullPixelProgramAddress();
 ShaderSnapshot PrepareNullPixelProgram(const VulkanDevice& device);
+std::uint64_t DepthCopyPixelProgramAddress(bool multisampled);
+std::uint32_t DepthCopyPixelUserWords(bool multisampled);
+ShaderSnapshot PrepareDepthCopyPixelProgram(bool multisampled);
 std::optional<ShaderRecompiler::ShaderFloatMode> RegisteredFloatMode(const ShaderSnapshot& snapshot);
 std::optional<ShaderRecompiler::ShaderFloatMode> DispatchFloatMode(const ShaderSnapshot& snapshot, const Registers& live);
 std::shared_ptr<const ShaderSnapshot> RegisteredHeader(const ShaderRegistry& registry, const Shader* shader);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp
new file mode 100644
index 0000000000..b3721a17d5
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameCapture.hpp
@@ -0,0 +1,138 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMECAPTURE_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMECAPTURE_HPP
+
+#include "SceShaders.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <mutex>
+#include <span>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace AgcDriver {
+
+enum class FrameCallKind : std::uint32_t {
+    RegisterShader = 1,
+    ResolveShaderAbi,
+    ResolveGraphicsAbi,
+    ResolveGraphicsStagesAbi,
+    RegisterVideoOutput,
+    SetTessellationFactorRing,
+    Submit,
+    Flip,
+    ReserveEopFlip,
+    Suspend,
+    Memory,
+    FrameStart,
+    End,
+    DisplayBuffer,
+    UnregisterVideoOutput,
+};
+
+struct FrameCall {
+    FrameCallKind kind = FrameCallKind::End;
+    std::uint64_t ordinal = 0;
+    std::uint64_t timeNs = 0;
+    std::uint64_t thread = 0;
+    std::uint64_t accepted = 0;
+    std::uint64_t completed = 0;
+    std::uint32_t queue = 0;
+    std::uint32_t flags = 0;
+    bool cpuFlip = false;
+    std::uint64_t address = 0;
+    std::uint64_t size = 0;
+    std::vector<std::uint64_t> values;
+    std::vector<ShaderRegister> context;
+    std::vector<ShaderRegister> primitive;
+};
+
+enum class FrameMemoryKind : std::uint32_t { Range = 1, Snapshot, Delta, Reference };
+
+enum class FrameRangeKind : std::uint32_t { Watched = 1, Unwatched, Section, Alias, File, Host };
+
+struct FrameRangeAccess {
+    static constexpr std::uint32_t Readable = 1;
+    static constexpr std::uint32_t Writable = 2;
+    static constexpr std::uint32_t Gpu = 4;
+};
+
+struct FrameMemoryChunk {
+    FrameMemoryKind kind = FrameMemoryKind::Range;
+    FrameRangeKind rangeKind = FrameRangeKind::Watched;
+    std::uint32_t protection = 0;
+    std::uint32_t access = 0;
+    std::uint64_t group = 0;
+    std::uint64_t completed = 0;
+    std::uint64_t address = 0;
+    std::uint64_t bytes = 0;
+    std::uint64_t compressedBytes = 0;
+    std::uint64_t offset = 0;
+};
+
+class FrameCaptureWriter {
+public:
+    static constexpr std::string_view CallsName = "calls.bin";
+    static constexpr std::string_view MemoryName = "memory.bin";
+    static constexpr std::string_view HeaderName = "capture.json";
+    static constexpr std::string_view CallsMagic = "aps5-frame-calls 1\n";
+    static constexpr std::string_view MemoryMagic = "aps5-frame-memory 1\n";
+    static constexpr std::size_t BlockBytes = 64u * 1024u;
+    static constexpr std::size_t ChunkBytes = 4u * 1024u * 1024u;
+
+    explicit FrameCaptureWriter(const std::filesystem::path& directory, int level = 1);
+    FrameCaptureWriter(const FrameCaptureWriter&) = delete;
+    FrameCaptureWriter& operator=(const FrameCaptureWriter&) = delete;
+
+    void WriteCall(const FrameCall& call);
+    void WriteRange(std::uint64_t address, std::uint64_t bytes, FrameRangeKind kind, std::uint32_t protection, std::uint32_t access);
+    std::uint64_t WriteSnapshot(std::uint64_t address, std::span<const std::byte> bytes);
+    void WriteDelta(std::uint64_t group, std::uint64_t completed, std::uint64_t address, std::span<const std::byte> bytes);
+    void WriteReference(std::uint64_t index, std::uint64_t address, std::span<const std::byte> pixels);
+    void Finish(std::string_view header);
+
+    std::uint64_t RawBytes() const;
+    std::uint64_t StoredBytes() const;
+    const std::filesystem::path& Directory() const;
+
+private:
+    void writeChunk(const FrameMemoryChunk& chunk, std::span<const std::byte> payload);
+    std::vector<std::byte> compress(std::span<const std::byte> bytes) const;
+
+    std::filesystem::path directory;
+    int level;
+    mutable std::mutex mutex;
+    std::ofstream calls;
+    std::ofstream memory;
+    std::uint64_t rawBytes = 0;
+    std::uint64_t storedBytes = 0;
+    bool finished = false;
+};
+
+class FrameCaptureReader {
+public:
+    explicit FrameCaptureReader(const std::filesystem::path& directory);
+
+    const std::vector<FrameCall>& Calls() const;
+    const std::vector<FrameMemoryChunk>& Chunks() const;
+    const std::string& Header() const;
+    bool Truncated() const;
+    void Read(const FrameMemoryChunk& chunk, std::span<std::byte> destination) const;
+    std::vector<std::byte> Read(const FrameMemoryChunk& chunk) const;
+
+private:
+    std::filesystem::path directory;
+    std::vector<FrameCall> calls;
+    std::vector<FrameMemoryChunk> chunks;
+    std::string header;
+    bool truncated = false;
+};
+
+std::string_view FrameCallName(FrameCallKind kind);
+bool AllZero(std::span<const std::byte> bytes);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
new file mode 100644
index 0000000000..bad806af09
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
@@ -0,0 +1,113 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMERECORDER_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_FRAMERECORDER_HPP
+
+#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "SceShaders.hpp"
+#include "SceTypes.hpp"
+#include <chrono>
+#include <cstdint>
+#include <deque>
+#include <filesystem>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+class FrameRecorder {
+public:
+    static constexpr std::uint64_t DefaultFrames = 10;
+    static constexpr std::size_t ReservationHistory = 256;
+    static constexpr std::size_t SnapshotPieceBytes = 64u * 1024u * 1024u;
+    static constexpr std::uint64_t MinimumFreeBytes = std::uint64_t{4} << 30;
+    static constexpr std::size_t HostPageBytes = 4096;
+
+    static FrameRecorder* Active();
+
+    void RegisterShader(const Shader* shader);
+    void ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
+    void ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
+    void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
+    void RegisterVideoOutput(std::uint32_t handle);
+    void UnregisterVideoOutput(std::uint32_t handle);
+    void Submit(const Packet& packet, std::uint32_t queue);
+    void Flip(const FlipInfo& info);
+    void ReserveEopFlip(const FlipInfo& info, std::uint32_t token);
+    void Suspend();
+    void PresentBuffer(const DisplayBuffer& buffer);
+    void FrameBoundary();
+
+private:
+    enum class State { Waiting, Recording, Done };
+
+    struct Range {
+        std::uint64_t address = 0;
+        std::uint64_t bytes = 0;
+        FrameRangeKind kind = FrameRangeKind::Watched;
+        std::uint32_t protection = 0;
+        std::uint32_t access = 0;
+        bool readable = false;
+    };
+
+    FrameRecorder(std::filesystem::path directory, std::filesystem::path trigger, std::uint64_t atBoundary, std::uint64_t frames);
+    struct Span {
+        std::uint64_t address = 0;
+        std::uint64_t bytes = 0;
+        std::uint64_t since = 0;
+    };
+
+    FrameCall make(FrameCallKind kind);
+    void record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders = {});
+    void emitDelta();
+    void emitShaderDelta(std::span<const Shader* const> shaders);
+    void writeDelta(std::span<const Span> spans, std::span<const std::uint64_t> hostPages, std::span<const Range> added = {});
+    bool triggered();
+    void start();
+    void finish();
+    void snapshot(const Range& range);
+    void writeReferenceFrames();
+    bool abandonIfDiskLow();
+    std::string header() const;
+    std::vector<Range> committedRanges();
+    std::vector<Range> newRanges();
+
+    std::filesystem::path directory;
+    std::filesystem::path trigger;
+    std::uint64_t atBoundary = 0;
+    std::uint64_t frames = DefaultFrames;
+    std::mutex mutex;
+    State state = State::Waiting;
+    std::unique_ptr<FrameCaptureWriter> writer;
+    std::vector<FrameCall> prologue;
+    std::deque<FrameCall> reservations;
+    std::vector<Range> ranges;
+    std::map<std::uint64_t, std::uint64_t> shaderMarks;
+    std::map<std::uint64_t, std::uint64_t> hostPageHashes;
+    std::mutex displayMutex;
+    std::map<std::uint64_t, DisplayBuffer> displayBuffers;
+    std::uint64_t ordinal = 0;
+    std::uint64_t boundaries = 0;
+    std::uint64_t startBoundary = 0;
+    std::uint64_t recordedFrames = 0;
+    std::uint64_t generation = 0;
+    std::uint64_t deltaGroups = 0;
+    std::uint64_t deltaBytes = 0;
+    std::uint64_t snapshotBytes = 0;
+    std::uint64_t recordedCalls = 0;
+    std::uint64_t startAttempts = 0;
+    std::uint64_t unreadableBytes = 0;
+    std::uint64_t allocationsGeneration = 0;
+    std::uint64_t lateRanges = 0;
+    std::vector<std::string> warnings;
+    std::chrono::steady_clock::time_point origin;
+    std::chrono::steady_clock::time_point startedAt;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp
index efa0e9d031..c360a6a579 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/GuestMemory.hpp
@@ -1,6 +1,7 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_GUESTMEMORY_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_GUESTMEMORY_HPP
 
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
@@ -80,10 +81,13 @@ struct UnchangedQuery {
 bool WrittenSince(std::uint64_t address, std::size_t bytes, std::uint64_t generation);
 bool UnchangedSinceAll(std::span<const UnchangedQuery> queries);
 std::uint64_t CollectCommittedWrites(std::uint64_t address, std::size_t bytes, std::vector<std::pair<std::uint64_t, std::uint64_t>>& ranges);
+std::uint64_t WriteGeneration();
+std::uint64_t CollectWrittenBlocks(std::uint64_t address, std::size_t bytes, std::uint64_t since, std::vector<std::pair<std::uint64_t, std::uint64_t>>& written);
 bool UnchangedCommittedSince(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges, std::uint64_t generation);
 // Returns the generation the blocks were stamped with (0 when the arena is not write-watched):
 // UnchangedSince(range, it) holds until the next store over the range.
 std::uint64_t MarkWritten(std::uint64_t address, std::size_t bytes);
+std::uint64_t MarkPossiblyWritten(std::uint64_t address, std::size_t bytes);
 std::uint64_t StoreOwnBytes(std::uint64_t address, std::size_t bytes, const std::function<void()>& store);
 std::uint64_t StoreOwnBytes(std::uint64_t address, std::span<const std::byte> source);
 bool StoredOver(std::uint64_t address, std::size_t bytes, std::uint64_t generation);
@@ -105,6 +109,9 @@ bool StoredAllSince_nid_no_patch(std::uint64_t address, std::size_t bytes, std::
 // workers bump before every packet as before. CollectEpochBumps counts the bumps ([guestmem] line).
 void BumpCollectEpoch();
 void AdoptLatestCollectEpoch();
+std::uint64_t ProofSerial();
+void BreakProofs();
+void MarkProofThread();
 std::uint64_t CollectEpoch();
 std::uint64_t CollectEpochBumps();
 std::uint64_t ThreadCollectEpoch();
@@ -152,8 +159,10 @@ public:
     std::uint32_t DepthOnThisThread() const;
 
 private:
+    void enter();
+    bool tryEnter();
     void acquired();
-    std::recursive_mutex mutex;
+    Mutex mutex;
     // The holder's thread token and recursion depth, written by the holder only; another thread
     // reads the owner just to see that it is not itself.
     std::atomic<const void*> owner{nullptr};
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Mutex.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Mutex.hpp
new file mode 100644
index 0000000000..182fb1e757
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Mutex.hpp
@@ -0,0 +1,65 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_MUTEX_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_EXECUTION_INCLUDE_MUTEX_HPP
+
+#include <atomic>
+#include <cstdint>
+
+namespace AgcDriver {
+
+inline void WaitWhile(const std::atomic<std::uint32_t>& word, std::uint32_t value) noexcept {
+    word.wait(value, std::memory_order_relaxed);
+}
+
+inline void WakeOne(std::atomic<std::uint32_t>& word) noexcept {
+    word.notify_one();
+}
+
+inline void WakeAll(std::atomic<std::uint32_t>& word) noexcept {
+    word.notify_all();
+}
+
+class Mutex {
+public:
+    constexpr Mutex() noexcept = default;
+    Mutex(const Mutex&) = delete;
+    Mutex& operator=(const Mutex&) = delete;
+
+    void lock() noexcept {
+        if (!try_lock()) lockContended();
+    }
+
+    bool try_lock() noexcept {
+        std::uint32_t expected = Unlocked;
+        return state.compare_exchange_strong(expected, Locked, std::memory_order_acquire, std::memory_order_relaxed);
+    }
+
+    void unlock() noexcept {
+        if (state.exchange(Unlocked, std::memory_order_release) == Contended) WakeOne(state);
+    }
+
+private:
+    static constexpr std::uint32_t Unlocked = 0;
+    static constexpr std::uint32_t Locked = 1;
+    static constexpr std::uint32_t Contended = 2;
+
+    [[gnu::noinline]] void lockContended() noexcept {
+        while (state.exchange(Contended, std::memory_order_acquire) != Unlocked) WaitWhile(state, Contended);
+    }
+
+    std::atomic<std::uint32_t> state{Unlocked};
+};
+
+inline const void* CurrentThreadToken() noexcept {
+#if defined(_WIN32) && defined(__x86_64__) && defined(__GNUC__)
+    const void* block;
+    __asm__("movq %%gs:0x30, %0" : "=r"(block));
+    return block;
+#else
+    thread_local char token;
+    return &token;
+#endif
+}
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp
index 28ccc5c2df..c674c5731e 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp
@@ -3,6 +3,7 @@
 
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/TracyZone.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <algorithm>
 #include <chrono>
 #include <cstddef>
@@ -206,7 +207,7 @@ private:
         return std::chrono::duration<double, std::milli>(elapsed).count();
     }
 
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     bool localMetrics = false;
     std::map<std::pair<std::string_view, std::string_view>, Metric> metrics;
     std::map<std::pair<std::string_view, std::string_view>, Metric> asyncMetrics;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp
index 909b403e26..0b9bc1f9f8 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Pm4.hpp
@@ -46,6 +46,7 @@ struct DrawParameters {
         std::uint32_t drawIndexLocation;
         bool drawIndexEnabled;
         std::uint32_t indxOffset;
+        bool indexLimitKnown = true;
         enum class Rule : std::uint8_t { InPlace, Constant };
         Rule vertexRule = Rule::Constant;
         Rule instanceRule = Rule::Constant;
@@ -154,6 +155,7 @@ inline bool CopyDataImmediate(std::uint32_t source) { return source >= 10 && sou
 inline bool CopyDataToRegister(std::span<const std::uint32_t> packet) { return ((packet[1] >> 8u) & 0xfu) == 0; }
 inline std::size_t CopyDataBytes(std::span<const std::uint32_t> packet) { return (packet[1] & 0x10000u) != 0 ? 8 : 4; }
 inline constexpr std::uint32_t RewindValid = 0x80000000u;
+inline constexpr std::uint32_t RewindOffloadEnable = 0x01000000u;
 struct WaitFields {
     std::uint32_t function;
     std::uint64_t address;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp
index 3954c462a3..7c10d006f5 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp
@@ -221,7 +221,7 @@ inline Registers BuildInitialContextRegisters() {
     Registers result{
         {0x200, 0}, {0x201, 0}, {0x202, 0xcc0010}, {0x203, 0},
         {0x204, 0}, {0x205, 0}, {0x206, 1087}, {0x207, 0},
-        {0x0, 0}, {0x2, 0}, {0x3, 0}, {0x4, 0}, {0x8, 0}, {0x9, 0x3f800000}, {0xa, 0}, {0xb, 0},
+        {0x0, 0}, {0x2, 0}, {0x3, 0}, {0x4, 0}, {0x8, 0}, {0x9, 0x3f800000}, {0xa, 0}, {0xb, 0}, {0x10, 0}, {0x11, 0},
         {0x80, 0}, {0x83, 0xffff}, {0x8c, 0xaa99aaaa}, {0x8d, 0}, {0x8e, 0}, {0x8f, 0},
         {0xc, 0}, {0xd, 0x40004000}, {0x81, 0x80000000}, {0x82, 0x40004000},
         {0x90, 0x80000000}, {0x91, 0x40004000},
@@ -272,7 +272,7 @@ struct QueueState {
     std::uint64_t indexBase = 0;
     std::uint64_t drawIndirectBase = 0;
     std::uint64_t dispatchIndirectBase = 0;
-    std::uint32_t indexBufferSize = 0;
+    std::optional<std::uint32_t> indexBufferSize;
     std::uint32_t indexType = 0;
     std::uint32_t instanceCount = 1;
     std::vector<std::string> markers;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp
index 98fd3cbadd..70d81c98a5 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/ShaderPreparation.hpp
@@ -16,6 +16,7 @@ public:
     ShaderPreparationTransaction& operator=(const ShaderPreparationTransaction&) = delete;
     PreparedShaderState& Edit(const ShaderSnapshot& snapshot);
     const PreparedShaderState& Read(const ShaderSnapshot& snapshot) const;
+    bool Tracks(const ShaderSnapshot& snapshot) const;
     void Hold();
     void Commit();
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp
index 30f42ba2ab..8675650a20 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp
@@ -9,6 +9,10 @@ inline bool SubgroupControlBarrierUsable(VkDriverId driver) {
     return driver != VK_DRIVER_ID_AMD_PROPRIETARY;
 }
 
+inline bool WorkgroupScopeFenceUsable(VkDriverId driver) {
+    return driver != VK_DRIVER_ID_AMD_PROPRIETARY;
+}
+
 }
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp
index 2c7443e9a5..c642371e8e 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/VideoOutput.hpp
@@ -55,6 +55,7 @@ public:
 
 extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info);
 extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info);
+extern "C" std::uint32_t AgcDriverReserveEopFlipAt_nid_postfix(const AgcDriver::FlipInfo& info, std::uint32_t token);
 
 extern "C" void AgcDriverRegisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr<AgcDriver::IVideoOutput>& output);
 extern "C" void AgcDriverUnregisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr<AgcDriver::IVideoOutput>& output);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
index 6562238c9e..8dbf80c316 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
@@ -16,7 +16,9 @@
 #include <functional>
 #include <memory>
 #include <optional>
+#include <span>
 #include <string>
+#include <utility>
 
 namespace AgcDriver {
 
@@ -31,9 +33,22 @@ struct ComputePipelineObjects;
 struct RecipeHit;
 // The record tail shared by an ordinary dispatch and a recipe hit (VulkanDevice::recordDispatch).
 struct RecordedDispatch;
+struct DispatchCompletion;
 // The module, layout and pipeline a compute dispatch binds (VulkanDevice::createComputePipeline).
 struct ComputePipelineObjects;
 
+struct DeviceQueuePlan {
+    std::uint32_t mainCount = 1;
+    bool settle = false;
+    std::uint32_t settleFamily = 0;
+    std::uint32_t settleIndex = 0;
+    bool sparseBinding = false;
+    std::uint32_t sparseFamily = VK_QUEUE_FAMILY_IGNORED;
+    std::uint32_t sparseIndex = 0;
+};
+
+DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> families, std::uint32_t family, bool settles, bool sparseBinding);
+
 class VulkanDevice {
 public:
     explicit VulkanDevice(const PresentationWindow* window = nullptr);
@@ -90,16 +105,18 @@ public:
     bool CanWaitUnlocked() const;
     std::uint64_t SubmitAndEpoch();
     void WaitRecorded(std::uint64_t serial);
+    std::uint64_t SubmittedEpoch() const;
+    bool WaitRecordedFor(std::uint64_t serial, std::uint64_t timeoutNanos);
     void ReapRecorded(std::uint64_t serial);
     // Completes the batches that already finished (non-blocking); under the mutex.
     void ReapRecorded();
     // Records a store of `bytes` at a guest address behind the recorded work, so the value appears
     // once that work completed; the batch is submitted by the queue worker's flush rules (or at once
     // with APS5_LABEL_SUBMIT_NOW=1). `stamp` is the record-order stamp and `queue` the recording
-    // queue for the recorder's pending-label table. Returns 0 when recorded on the GPU, 5 when kept
-    // as a completion action behind pending write-backs, else why the CPU must write it:
-    // 1 nothing recorded (the write is already ordered), 2 write-backs pending and 3 memory not
-    // imported, 4 unsuitable size or alignment.
+    // queue for the recorder's pending-label table. Returns 0 when recorded on the GPU, 5 when stored
+    // by a completion behind pending CPU write-backs or completion stores, else why the CPU must
+    // write it: 1 nothing recorded (the write is already ordered), 2 write-backs pending (only with
+    // APS5_DRAIN_COMPLETION_LABELS=1) and 3 memory not imported, 4 unsuitable size or alignment.
     // `reapFirst` retires finished batches before the checks; a caller recording a group of labels
     // under one lock passes it for the first label only.
     int WriteLabelOnGpu(std::uint64_t address, std::span<const std::byte> bytes, std::uint64_t stamp, std::uint32_t queue, bool reapFirst = true);
@@ -273,7 +290,7 @@ public:
     // `recipe`, when given, receives the Recipe a successful call built for its dispatch-cache
     // variant (design_cpu_final M4): only when the resource cache served or took the object
     // (reusable, cacheable) and recipes are on (APS5_NO_DISPATCH_RECIPE=1 builds none); else null.
-    void Dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::span<const Graphics::GuestMemorySnapshot> snapshots = {}, std::uint64_t programAddress = 0, std::shared_ptr<PreparedDispatch> prepared = nullptr, std::shared_ptr<const Recipe>* recipe = nullptr);
+    void Dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::span<const Graphics::GuestMemorySnapshot> snapshots = {}, std::uint64_t programAddress = 0, std::shared_ptr<PreparedDispatch> prepared = nullptr, std::shared_ptr<const Recipe>* recipe = nullptr, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear = std::nullopt);
     struct IndirectOutcome {
         int cpuReason;
         double argumentReadMs;
@@ -317,17 +334,17 @@ public:
     static void NoteRecipe(RecipeEvent event, RecipeKind kind);
     enum class DrawRecipePrecheck : std::size_t { NoRecipe, Device };
     static void NoteDrawRecipeMiss(DrawRecipePrecheck miss);
+    using DrawTraceContext = Graphics::DrawTraceContext;
     // `recipe`, when given, receives the DrawRecipe a recorded, cacheable, reusable, direct draw
     // built for its draw-cache entry (design_cpu_final M8); null otherwise.
-    void Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr);
+    void Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr, const DrawTraceContext* trace = nullptr);
     bool DrawInputsInPlace() const;
     std::optional<std::string> KnownDrawRejection(const Graphics::State& graphics, std::span<const Graphics::CompiledShader> shaders) const;
     void ColorMetadataPass(const Graphics::ColorMetadataPass& pass);
-    void DepthCopyPass(const Graphics::DepthCopyPass& pass);
     // A draw-cache hit recorded from its recipe (Graphics::DrawWithRecipe), under the mutex after
     // the packet's labels; Rebuild when the recipe's device is not this one or DrawWithRecipe
     // missed (nothing recorded: the caller runs Draw with the hit's stages and re-attaches).
-    RecipeOutcome DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe);
+    RecipeOutcome DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const DrawTraceContext* trace = nullptr);
     // The indirect draw features the device enabled, for the driver's decision whether an indirect
     // draw's records can be read by the GPU (Graphics::Draw) or must be resolved on the CPU.
     struct IndirectDrawSupport {
@@ -357,7 +374,8 @@ private:
     ShaderRecompiler::SpirvTarget buildTarget() const;
     Graphics::Context buildContext() const;
     // Body of Dispatch and DispatchIndirect: `arguments` 0 dispatches x, y, z groups.
-    IndirectOutcome dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipe, const std::array<std::uint32_t, 3>& threadGroup = {});
+    IndirectOutcome dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipe, const std::array<std::uint32_t, 3>& threadGroup = {}, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear = std::nullopt);
+    IndirectOutcome recordCompletedDispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::uint64_t programAddress, std::shared_ptr<const Recipe>* recipeOut, const std::array<std::uint32_t, 3>& threadGroup, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear, DispatchCompletion& completion);
     // The stage-A pre-sync over `surfaces` (see PrepareDispatch): the serial waited for, 0 none.
     std::uint64_t presync(std::span<const Graphics::PresyncSurface> surfaces);
     std::shared_ptr<ComputePipelineObjects> computePipeline(const Graphics::Context& context, const ShaderRecompiler::RecompileResult& shader, VkDescriptorSetLayout setLayout, std::span<const std::uint32_t> layoutKey, VkShaderStageFlags pushStages, std::uint64_t programAddress);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/DeviceAccess.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/DeviceAccess.cpp
index a7a14931a5..15b84d7b96 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/DeviceAccess.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/DeviceAccess.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 
 namespace AgcDriver::DriverDetail {
 
@@ -21,27 +22,37 @@ DevicePointer::operator bool() const { return Load() != nullptr; }
 bool DevicePointer::operator==(std::nullptr_t) const { return Load() == nullptr; }
 
 void DeviceUseGate::lock_shared() {
-    std::unique_lock lock(mutex);
-    changed.wait(lock, [&] { return !replacing; });
-    ++users;
+    auto value = state.load(std::memory_order_relaxed);
+    for (;;) {
+        if ((value & Replacing) != 0) {
+            WaitWhile(state, value);
+            value = state.load(std::memory_order_relaxed);
+        } else if (state.compare_exchange_weak(value, value + 1, std::memory_order_acquire, std::memory_order_relaxed)) {
+            return;
+        }
+    }
 }
 
 void DeviceUseGate::unlock_shared() {
-    std::lock_guard lock(mutex);
-    if (--users == 0) changed.notify_all();
+    if (state.fetch_sub(1, std::memory_order_release) == (Replacing | 1)) WakeAll(state);
 }
 
 void DeviceUseGate::lock() {
-    std::unique_lock lock(mutex);
-    changed.wait(lock, [&] { return !replacing; });
-    replacing = true;
-    changed.wait(lock, [&] { return users == 0; });
+    auto value = state.load(std::memory_order_relaxed);
+    for (;;) {
+        if ((value & Replacing) != 0) {
+            WaitWhile(state, value);
+            value = state.load(std::memory_order_relaxed);
+        } else if (state.compare_exchange_weak(value, value | Replacing, std::memory_order_acquire, std::memory_order_relaxed)) {
+            break;
+        }
+    }
+    for (value = state.load(std::memory_order_acquire); value != Replacing; value = state.load(std::memory_order_acquire)) WaitWhile(state, value);
 }
 
 void DeviceUseGate::unlock() {
-    std::lock_guard lock(mutex);
-    replacing = false;
-    changed.notify_all();
+    state.fetch_and(~Replacing, std::memory_order_release);
+    WakeAll(state);
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
index ccdc67b4aa..8110338e83 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
@@ -16,7 +16,9 @@
 #include "Optimization/ResourceProgram.hpp"
 #include <algorithm>
 #include <cstdlib>
+#include <optional>
 #include <stdexcept>
+#include <utility>
 
 namespace AgcDriver::DriverDetail {
 
@@ -117,12 +119,13 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
     if (indirectArguments == 0 && (packet[4] & 0x2u) != 0) {
         partialGroups = Pm4::PartialGroupThreads({packet[1], packet[2], packet[3]}, {readRegister(queue.shader, 0x207), readRegister(queue.shader, 0x208), readRegister(queue.shader, 0x209)});
     }
-    const bool pipelineCandidate = !resolving && !fromAhead && DispatchItemsEnabled() && DrawPipeline::Active() && indirectArguments == 0 && deferredLabels().labels.empty() && !matchesCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute) && !MatchesStreamCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute);
+    const bool pipelineCandidate = !resolving && !fromAhead && DispatchItemsEnabled() && DrawPipeline::Active() && indirectArguments == 0 && deferredLabels().labels.empty() && !matchesCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute) && !MatchesStreamCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute) && !MatchesIndexedCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute);
     const bool partialLastGroup = partialGroups != std::array<std::uint32_t, 3>{};
+    std::optional<std::pair<std::uint64_t, std::size_t>> htileClearCompletion;
     if (resolving) {
         if (indirectArguments == 0 && Graphics::MatchMultisampledSingleClear(std::span(snapshot.code).subspan(codeOffset), userData, compute.numThreads)) return;
         if (!partialLastGroup && matchesFillKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute)) return;
-        if (!partialLastGroup && indirectArguments == 0 && (matchesCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute) || MatchesStreamCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute))) return;
+        if (!partialLastGroup && indirectArguments == 0 && (matchesCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute) || MatchesStreamCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute) || MatchesIndexedCopyKernel(std::span(snapshot.code).subspan(codeOffset), userData, compute))) return;
     } else {
         if (indirectArguments == 0 && Graphics::TakeMultisampledSingleClear(std::span(snapshot.code).subspan(codeOffset), userData, compute.numThreads)) {
             pendingDispatchPhases().outcome = DispatchOutcome::FillHle;
@@ -139,7 +142,8 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
         if (const auto htile = Graphics::HtileDepthClearAddress(std::span(snapshot.code).subspan(codeOffset), userData, compute.numThreads); htile != 0) {
             const auto threads = (packet[4] & 0x20u) != 0 ? static_cast<std::uint64_t>(packet[1]) : static_cast<std::uint64_t>(packet[1]) * compute.numThreads[0];
             const auto nativeBytes = Graphics::HtileDepthClearBytes_nid_no_patch(std::span(snapshot.code).subspan(codeOffset), userData, compute, packet, indirectArguments);
-            Graphics::NoteHtileDepthClear(htile, static_cast<std::size_t>(threads * 16u), nativeBytes);
+            const auto bytes = static_cast<std::size_t>(threads * 16u);
+            if (Graphics::NoteHtileDepthClear(htile, bytes, nativeBytes)) htileClearCompletion = std::pair{htile, bytes};
         }
         if (!partialLastGroup && indirectArguments == 0 && copyBuffer(queue, submission.queue, packet, std::span(snapshot.code).subspan(codeOffset), userData, compute, localDevice, address)) {
             pendingDispatchPhases().outcome = DispatchOutcome::CopyHle;
@@ -462,18 +466,18 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
         const auto epoch = DrawPipeline::EpochToken().load(std::memory_order_relaxed);
         const auto queueId = submission.queue;
         itemCommits.fetch_add(1, std::memory_order_relaxed);
-        DrawPipeline::Queue0().Enqueue([this, localDevice = std::move(localDevice), result = compiledResult, snapshots = std::move(snapshots), liveWords = std::move(liveWords), groups, address, queueId, recipe, keepVariant, dataHit, epoch] {
+        DrawPipeline::Queue0().Enqueue([this, localDevice = std::move(localDevice), result = compiledResult, snapshots = std::move(snapshots), liveWords = std::move(liveWords), groups, address, queueId, recipe, keepVariant, dataHit, epoch, htileClearCompletion] {
             DrawPipeline::FollowEpoch(epoch);
             GuestMemory::SetCurrentPacket(0x15, queueId);
             const auto& compiledCommit = *result;
             const bool noteWrites = writeEvidenceEnabled() || traceCapSync();
             try {
-                std::shared_ptr<RecipeHit> recipeHit = localDevice->PrepareRecipe(recipe, false);
+                std::shared_ptr<RecipeHit> recipeHit = htileClearCompletion.has_value() ? nullptr : localDevice->PrepareRecipe(recipe, false);
                 std::shared_ptr<const Recipe> builtRecipe;
                 bool writersNoted = false;
                 for (;;) {
                     std::shared_ptr<PreparedDispatch> prepared;
-                    if (recipeHit == nullptr || VulkanDevice::VerifyRecipes()) prepared = localDevice->PrepareDispatch(compiledCommit, snapshots);
+                    if (recipeHit == nullptr || VulkanDevice::VerifyRecipes() || htileClearCompletion.has_value()) prepared = localDevice->PrepareDispatch(compiledCommit, snapshots);
                     GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Dispatch);
                     std::lock_guard gpuLock(GuestMemory::GpuMutex());
                     recordLabelsForPacket(localDevice.get(), queueId);
@@ -491,7 +495,7 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
                             continue;
                         }
                     } else {
-                        localDevice->Dispatch(compiledCommit, groups[0], groups[1], groups[2], snapshots, address, std::move(prepared), &builtRecipe);
+                        localDevice->Dispatch(compiledCommit, groups[0], groups[1], groups[2], snapshots, address, std::move(prepared), htileClearCompletion.has_value() ? nullptr : &builtRecipe, htileClearCompletion);
                     }
                     break;
                 }
@@ -517,7 +521,7 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
 
     std::shared_ptr<RecipeHit> recipeHit;
     if (cached && keepVariant != nullptr && !stampValidate()) {
-        recipeHit = localDevice->PrepareRecipe(keepVariant->recipe.load(std::memory_order_acquire), indirectArguments != 0);
+        recipeHit = htileClearCompletion.has_value() ? nullptr : localDevice->PrepareRecipe(keepVariant->recipe.load(std::memory_order_acquire), indirectArguments != 0);
         phaseTiming.Phase(PhaseRecipePrecheck);
     }
 
@@ -595,7 +599,7 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
                 const auto outcome = localDevice->DispatchIndirect(compiled, indirectArguments, snapshots, address, std::move(prepared), attachTo != nullptr ? &builtRecipe : nullptr, threadGroup);
                 countIndirect(outcome.cpuReason, outcome.argumentReadMs);
             } else {
-                localDevice->Dispatch(compiled, groups[0], groups[1], groups[2], snapshots, address, std::move(prepared), attachTo != nullptr ? &builtRecipe : nullptr);
+                localDevice->Dispatch(compiled, groups[0], groups[1], groups[2], snapshots, address, std::move(prepared), htileClearCompletion.has_value() ? nullptr : (attachTo != nullptr ? &builtRecipe : nullptr), htileClearCompletion);
             }
         } catch (const std::exception& error) {
             if (rethrow(error)) return;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
index 0b6f1f0eb0..6391881462 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/DeferredLabels.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
@@ -107,6 +108,7 @@ void Driver::resolveGroupAhead(const Submission& submission, const QueueState& l
     if (!allQueues && submission.queue == 0) return;
     auto& resolved = resolvedAhead();
     if (resolved.contains(from) || device.Load() == nullptr) return;
+    if (submission.queue == 0 && DrawPipeline::Depth() != 0 && DrawPipeline::Queue0().Busy()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, (submission.commands[from] >> 8u) & 0xffu);
     auto& stats = groupCaptureStats();
     const auto begin = std::chrono::steady_clock::now();
     ++stats.runs;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/IndirectDispatch.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/IndirectDispatch.cpp
index 65057babfa..121a1bedde 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/IndirectDispatch.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/IndirectDispatch.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <cstdio>
 #include <cstdlib>
 
@@ -30,7 +31,7 @@ const char* IndirectPathName(int path) {
 void Driver::countIndirect(int path, double readMs) {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     if (!profile || path < 0 || path >= IndirectPaths) return;
-    static std::mutex countsMutex;
+    static AgcDriver::Mutex countsMutex;
     static std::uint64_t counts[IndirectPaths] = {};
     static double readWaitedMs = 0;
     static auto lastReport = std::chrono::steady_clock::now();
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/VariantValidation.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/VariantValidation.cpp
index e4136cbebe..99c7b35426 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/VariantValidation.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/VariantValidation.cpp
@@ -93,7 +93,7 @@ EntryOutcome Driver::validateVariant(std::uint64_t program, std::uint32_t queue,
     if (live != nullptr) live->clear();
     if (DrawPipeline::Active()) {
         auto& pipeline = DrawPipeline::Queue0();
-        if (pipeline.Busy() && std::any_of(variant.runs.begin(), variant.runs.end(), [&](const auto& run) { return pipeline.Overlaps(run.first, static_cast<std::size_t>(run.second - run.first)); })) pipeline.Drain(DrawPipeline::DrainReason::Capture);
+        if (pipeline.Busy() && pipeline.OverlapsAny(variant.runs)) pipeline.Drain(DrawPipeline::DrainReason::Capture);
     }
     const bool masked = live != nullptr && !variant.dataPositions.empty();
     const DataMask mask{variant.dataPositions, live};
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp
index dd0231145e..477c943f72 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp
@@ -1,28 +1,322 @@
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Memory/DrawWriteRanges.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawProgramTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Memory/DrawWriteRanges.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/DeferredLabels.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "Optimization/ResourceProgram.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
+#include <atomic>
+#include <array>
 #include <algorithm>
 #include <bit>
+#include <chrono>
+#include <cstdio>
+#include <unordered_set>
+#include <cstdlib>
+#include <algorithm>
 #include <cstdlib>
 #include <cstdio>
 #include <cstring>
+#include <unordered_map>
+#include <atomic>
+#include <exception>
+#include <mutex>
+#include <set>
+#include <string>
+#include <string_view>
+#include <typeinfo>
 
 namespace AgcDriver::DriverDetail {
 
-DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::string& rejected) {
-    PerformanceTimer timing("Driver.Draw");
-    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+namespace {
+
+bool TraceShaderCorrelation() {
+    static const bool enabled = std::getenv("APS5_TRACE_SHADER_CORRELATION") != nullptr;
+    return enabled && AgcDriver::CaptureTrace::Enabled();
+}
+
+std::atomic<std::uint64_t>& NextDrawTraceToken() {
+    static std::atomic<std::uint64_t> next{0};
+    return next;
+}
+
+std::string ExceptionReason(const std::exception_ptr& failure) {
+    try {
+        if (failure != nullptr) std::rethrow_exception(failure);
+    } catch (const std::exception& error) {
+        return error.what();
+    } catch (...) {
+    }
+    return "unknown exception";
+}
+
+const char* ExceptionType(const std::exception_ptr& failure) {
+    try {
+        if (failure != nullptr) std::rethrow_exception(failure);
+    } catch (const std::exception& error) {
+        return typeid(error).name();
+    } catch (...) {
+    }
+    return "unknown";
+}
+
+void TraceMaterializationFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, const char* phase, std::size_t completedSubdraws, const std::exception_ptr& failure) {
+    if (token == 0) return;
+    try {
+        const auto reason = ExceptionReason(failure);
+        AgcDriver::CaptureTrace::Log("draw-materialization-failed token=%llu submission=%llu queue=%x offset=%zu phase=%s exception=%s reason=%.256s completedSubdraws=%zu",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset, phase, ExceptionType(failure), reason.c_str(), completedSubdraws);
+    } catch (...) {
+
+    }
+}
+
+void TraceSubmissionFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, std::size_t completedSubdraws, const std::exception_ptr& failure) {
+    if (token == 0) return;
+    try {
+        const auto reason = ExceptionReason(failure);
+        AgcDriver::CaptureTrace::Log("draw-submission-failed token=%llu submission=%llu queue=%x offset=%zu exception=%s reason=%.256s completedSubdraws=%zu",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset, ExceptionType(failure), reason.c_str(), completedSubdraws);
+    } catch (...) {
+
+    }
+}
+
+void TraceDrawAttemptFailure(std::uint64_t token, const char* phase, const char* outcome, std::uint64_t submission, std::uint32_t queue, std::size_t packetOffset, std::string_view reason, std::string_view exceptionType = "none") {
+    if (token == 0) return;
+        AgcDriver::CaptureTrace::LogBestEffort("draw-attempt-failed token=%llu phase=%s outcome=%s submission=%llu queue=%x offset=%zu exception=%s reason=%.256s",
+            static_cast<unsigned long long>(token), phase, outcome, static_cast<unsigned long long>(submission), queue, packetOffset, exceptionType.data(), reason.data());
+}
+
+void TraceDrawAttemptException(std::uint64_t token, const char* phase, std::uint64_t submission, std::uint32_t queue, std::size_t packetOffset, const std::exception_ptr& failure) noexcept {
+    try {
+        TraceDrawAttemptFailure(token, phase, "exception", submission, queue, packetOffset, ExceptionReason(failure), ExceptionType(failure));
+    } catch (...) {
+
+    }
+}
+
+const char* DrawVerdictName(DrawVerdict verdict) {
+    switch (verdict) {
+        case DrawVerdict::Drawn: return "Drawn";
+        case DrawVerdict::Nothing: return "Nothing";
+        case DrawVerdict::Rejected: return "Rejected";
+    }
+    return "Unknown";
+}
+
+std::string_view TrimmedReason(std::string_view reason) {
+    if (reason.size() > 200) reason = reason.substr(0, 200);
+    return reason;
+    }
+
+}
+
+
+struct DrawTail {
+    using GpuLock = std::unique_lock<std::remove_reference_t<decltype(GuestMemory::GpuMutex())>>;
+    bool profile = false;
     std::array<double, DrawDriverPhaseCount> phaseMs{};
     std::uint64_t captures = 0;
-    auto phaseLap = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
-    DrawPhaseTiming phaseTiming{profile, phaseMs, phaseLap};
+    std::chrono::steady_clock::time_point phaseLap{};
+    DrawPhaseTiming phaseTiming{false, phaseMs, phaseLap};
+    Pm4::DrawParameters drawParameters{};
+    bool pipelined = false;
+    bool traceIndirect = false;
+    std::uint64_t dumpTarget = 0;
+    std::uint64_t dumpSlot1 = 0;
+    std::shared_ptr<VulkanDevice> localDevice;
+    bool registerKey = false;
+    std::uint64_t drawKey = 0;
+    std::shared_ptr<DrawEntry> entry;
+    std::shared_ptr<const DrawDecode> decode;
+    std::shared_ptr<const DrawDecode> relocatedDecode;
+    std::shared_ptr<DrawEntry> dataEntry;
+    std::uint64_t shapeKey = 0;
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    std::vector<DrawProgram> writablePrograms;
+    const std::vector<DrawProgram>* programs = nullptr;
+    std::vector<ShaderRecompiler::MemoryRegion> memory;
+    std::vector<ShaderRecompiler::LinkedProgram> linked;
+    std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>> vertexInfos;
+    std::vector<std::vector<Graphics::DecodeRead>> decodeReads;
+    std::unique_ptr<ShaderMemory> shaderMemory;
+    std::vector<ShaderRecompiler::RecompileResult> results;
+    std::vector<std::shared_ptr<const ShaderRecompiler::RecompileResult>> compiledStages;
+    std::vector<Graphics::CompiledShader> stages;
+    std::uint32_t pushCursorBytes = 0;
+    std::vector<const ShaderRecompiler::RecompileResult*> programResults;
+    std::vector<StageCapture> stageCaptures;
+    std::vector<std::shared_ptr<DispatchVariant>> matched;
+    std::vector<std::vector<ShaderRecompiler::MemoryRegion>> matchedRegions;
+    std::vector<std::shared_ptr<DispatchVariant>> fresh;
+    std::vector<bool> recompiled;
+    DrawDataCandidates dataCandidates;
+    std::vector<bool> reused;
+    std::vector<StageDataHit> stageData;
+    bool drawHit = false;
+    bool verifyHit = false;
+    bool stageEntries = false;
+    bool patchedStages = false;
+    const Submission* submission = nullptr;
+    std::uint32_t submissionQueue = 0;
+    std::uint64_t submissionSerial = 0;
+    std::size_t packetOffset = 0;
+    std::uint32_t packetOpcode = 0;
+    std::uint32_t reg207 = 0;
+    std::uint64_t epoch = 0;
+    QueueState* queue = nullptr;
+    std::span<const std::uint32_t> packet;
+    std::string* rejected = nullptr;
+    std::uint64_t traceToken = 0;
+    VulkanDevice::DrawTraceContext trace{};
+    std::string ownRejected;
+    GpuLock* gpuLock = nullptr;
+    GpuLock ownLock{GuestMemory::GpuMutex(), std::defer_lock};
+};
+
+namespace {
+
+void noteFinisherHandOff(bool handed) {
+    static std::atomic<std::uint64_t> handedOff{0}, kept{0};
+    static std::atomic<std::int64_t> reportedAt{0};
+    (handed ? handedOff : kept).fetch_add(1, std::memory_order_relaxed);
+    static const bool stats = std::getenv("APS5_PIPELINE_STATS") != nullptr || std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (!stats) return;
+    const auto tenSeconds = std::chrono::duration_cast<std::chrono::seconds>(std::chrono::steady_clock::now().time_since_epoch()).count() / 10;
+    if (reportedAt.exchange(tenSeconds, std::memory_order_relaxed) == tenSeconds) return;
+    AgcDriver::ProfilePrint_nid_no_patch("[finisher] draws (10 s): %llu handed to the draw finisher, %llu finished on the worker%s\n", static_cast<unsigned long long>(handedOff.exchange(0)), static_cast<unsigned long long>(kept.exchange(0)), DrawFinisher::DrainText().c_str());
+}
+
+}
+
+namespace {
+
+enum class HeldReason : std::size_t { Known, NoDecode, Size, NullVertex, NullFragment, NullOther, Bda, Buffer, Storage, Count };
+std::array<std::atomic<std::uint64_t>, static_cast<std::size_t>(HeldReason::Count)> heldReasons{};
+
+void noteHeld(HeldReason reason) {
+    heldReasons[static_cast<std::size_t>(reason)].fetch_add(1, std::memory_order_relaxed);
+    static const bool profile = std::getenv("APS5_PIPELINE_STATS") != nullptr || std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (!profile) return;
+    static std::atomic<std::uint64_t> total{0};
+    const auto count = ++total;
+    if (count % 262144u != 0u && (count > 262144u || (count & (count - 1u)) != 0u)) return;
+    constexpr std::array<const char*, static_cast<std::size_t>(HeldReason::Count)> names{"targets only", "no decode", "stage count", "no variant (vertex)", "no variant (fragment)", "no variant (other)", "BDA stores", "written buffer", "storage image"};
+    std::string text;
+    for (std::size_t i = 0; i < names.size(); ++i) {
+        char item[64];
+        std::snprintf(item, sizeof(item), "%s %s %llu", i == 0 ? "" : ",", names[i], static_cast<unsigned long long>(count >= 262144u ? heldReasons[i].exchange(0) : heldReasons[i].load()));
+        text += item;
+    }
+    std::fprintf(stderr, "[finisher-held] held draws' writes:%s\n", text.c_str());
+}
+
+std::optional<HeldReason> writesBeyondTargets(const ShaderRecompiler::RecompileResult& compiled) {
+    using Role = ShaderRecompiler::DescriptorRole;
+    for (const auto& binding : compiled.bindings) {
+        if (binding.role == Role::BdaPagetable && Graphics::ShaderStoresThroughAddresses(compiled.spirv)) return HeldReason::Bda;
+        if (binding.role == Role::GuestBuffers) {
+            for (std::uint32_t element = 0; element < binding.count; ++element) {
+                if (element >= binding.bufferWritten.size() || binding.bufferWritten[element]) return HeldReason::Buffer;
+            }
+        }
+        if (binding.role == Role::GuestImages && binding.kind == ShaderRecompiler::DescriptorKind::StorageImage) {
+            for (std::uint32_t element = 0; element < binding.count; ++element) {
+                if (element >= binding.imageWritten.size() || binding.imageWritten[element]) return HeldReason::Storage;
+            }
+        }
+    }
+    return std::nullopt;
+}
+
+DrawFinisher::Pending heldWrites(const DrawTail& tail) {
+    DrawFinisher::Pending held;
+    held.key = tail.drawKey;
+    held.shape = tail.shapeKey;
+    if (tail.decode == nullptr) {
+        noteHeld(HeldReason::NoDecode);
+        return held;
+    }
+    if (tail.matched.size() != tail.programs->size()) {
+        noteHeld(HeldReason::Size);
+        return held;
+    }
+    const auto& roles = tail.decode->roles;
+    for (std::size_t i = 0; i < tail.matched.size(); ++i) {
+        if (i < roles.size() && roles[i] == ShaderRecompiler::ProgramRole::GeometryBack) continue;
+        const auto& variant = tail.matched[i];
+        if (variant == nullptr || variant->compiled == nullptr) {
+            const bool candidates = !tail.drawHit && i < tail.dataCandidates.size() && !tail.dataCandidates[i].empty();
+            const auto& program = (*tail.programs)[i];
+            if (!candidates && program.snapshot != nullptr && !ProgramWritesMemory(*program.snapshot, program.codeOffset) && (program.tailContinuation == nullptr || !ProgramWritesMemory(*program.tailContinuation, 0))) continue;
+            if (!candidates) {
+                const auto stage = (*tail.programs)[i].binary.stage;
+                noteHeld(stage == ShaderRecompiler::ShaderStage::Fragment ? HeldReason::NullFragment : stage == ShaderRecompiler::ShaderStage::Vertex ? HeldReason::NullVertex : HeldReason::NullOther);
+                return held;
+            }
+            for (const auto& [candidate, regions] : tail.dataCandidates[i]) {
+                if (candidate == nullptr || candidate->compiled == nullptr) {
+                    noteHeld(HeldReason::NullOther);
+                    return held;
+                }
+                if (const auto reason = writesBeyondTargets(*candidate->compiled)) {
+                    noteHeld(*reason);
+                    return held;
+                }
+            }
+            continue;
+        }
+        if (const auto reason = writesBeyondTargets(*variant->compiled)) {
+            noteHeld(*reason);
+            return held;
+        }
+        if (i < tail.stageData.size() && tail.stageData[i].compiled != nullptr) {
+            if (const auto reason = writesBeyondTargets(*tail.stageData[i].compiled)) {
+                noteHeld(*reason);
+                return held;
+            }
+        }
+    }
+    noteHeld(HeldReason::Known);
+    held.writes = DrawWriteRanges(tail.decode->state, {}, ExactDrawWrites());
+    held.unknown = false;
+    return held;
+}
+
+bool EmptyIndirectSkip() {
+    static const bool enabled = std::getenv("APS5_NO_EMPTY_INDIRECT_SKIP") == nullptr;
+    return enabled;
+}
+
+struct CpuIndirectProgramsStorage {};
+
+std::unordered_map<std::uint64_t, bool>& CpuIndirectPrograms() {
+    return HostThreadLocal<std::unordered_map<std::uint64_t, bool>, CpuIndirectProgramsStorage>();
+}
+
+}
+
+DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packet, const Submission& submission, std::size_t packetOffset, std::string& rejected) {
+    PerformanceTimer timing("Driver.Draw");
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    auto tailHolder = std::make_shared<DrawTail>();
+    auto& tail = *tailHolder;
+    auto& phaseMs = tail.phaseMs;
+    auto& captures = tail.captures;
+    auto& phaseLap = tail.phaseLap;
+    phaseLap = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
+    tail.profile = profile;
+    tail.phaseTiming.profile = profile;
+    auto& phaseTiming = tail.phaseTiming;
     if (profile && packetStartedAt() != std::chrono::steady_clock::time_point{}) phaseMs[DrawRowPrologue] = std::chrono::duration<double, std::milli>(phaseLap - packetStartedAt()).count();
 
     const auto drawn = [&] {
@@ -35,8 +329,20 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         pending.tailAt = phaseLap;
         return DrawVerdict::Drawn;
     };
-    auto drawParameters = Pm4::ResolveDraw(packet, queue);
-    const bool pipelined = DrawPipeline::Active();
+    const std::uint64_t traceToken = TraceShaderCorrelation() ? NextDrawTraceToken().fetch_add(1, std::memory_order_relaxed) + 1 : 0;
+    if (traceToken != 0) {
+        AgcDriver::CaptureTrace::LogBestEffort("draw-attempt token=%llu submission=%llu queue=%x offset=%zu",
+                static_cast<unsigned long long>(traceToken), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset);
+    }
+    auto& drawParameters = tail.drawParameters;
+    try {
+        drawParameters = Pm4::ResolveDraw(packet, queue);
+    } catch (...) {
+        TraceDrawAttemptException(traceToken, "resolve-draw", submission.serial, submission.queue, packetOffset, std::current_exception());
+        throw;
+    }
+    tail.pipelined = DrawPipeline::Active();
+    const bool pipelined = tail.pipelined;
     static const bool pipelinedIndirect = std::getenv("APS5_NO_PIPELINED_INDIRECT") == nullptr;
     if (pipelined && drawParameters.indirect) {
         const auto& indirect = *drawParameters.indirect;
@@ -44,11 +350,11 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         const bool overlaps = pipeline.Busy() && (pipeline.Overlaps(indirect.arguments, static_cast<std::size_t>(std::max<std::uint64_t>(indirect.RangeBytes(), indirect.recordBytes))) || (indirect.countIndirect && pipeline.Overlaps(indirect.countAddress, 4)));
         if (!pipelinedIndirect || overlaps) pipeline.Drain(DrawPipeline::DrainReason::Indirect);
     }
-    const auto drainBeforeInline = [&] {
-        if (pipelined && DrawPipeline::Queue0().Busy()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Indirect);
-    };
-    bool traceIndirect = false;
-    if (const auto verdict = precheckDraw(queue, submission, packet, drawParameters, rejected, traceIndirect)) return *verdict;
+    auto& traceIndirect = tail.traceIndirect;
+    if (const auto verdict = precheckDraw(queue, submission, packetOffset, packet, drawParameters, rejected, traceIndirect)) {
+        TraceDrawAttemptFailure(traceToken, "precheck", "rejected", submission.serial, submission.queue, packetOffset, rejected);
+        return *verdict;
+    }
     phaseTiming.Phase(DrawRowPrecheck);
     using Stage = ShaderRecompiler::ShaderStage;
     using Role = ShaderRecompiler::ProgramRole;
@@ -59,7 +365,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
 
     static const bool lockedPrepare = std::getenv("APS5_LOCKED_DRAW_PREPARE") != nullptr;
     std::unique_lock gpuLock(GuestMemory::GpuMutex(), std::defer_lock);
-    std::shared_ptr<VulkanDevice> localDevice;
+    auto& localDevice = tail.localDevice;
     if (lockedPrepare) {
 
         GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
@@ -81,13 +387,14 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     phaseTiming.Phase(DrawRowVectors);
 
     const bool useDrawEntries = drawEntries() && !ShaderRecompiler::DebugProbeActive() && dumpTarget == 0 && dumpSlot1 == 0;
-    const bool registerKey = useDrawEntries && registerKeyEnabled();
-    std::uint64_t drawKey = 0;
+    tail.registerKey = useDrawEntries && registerKeyEnabled();
+    const bool registerKey = tail.registerKey;
+    auto& drawKey = tail.drawKey;
     std::array<std::uint64_t, 5> drawKeyComponents{};
-    std::shared_ptr<DrawEntry> entry;
-    std::shared_ptr<const DrawDecode> decode;
-    std::shared_ptr<DrawEntry> dataEntry;
-    std::uint64_t shapeKey = 0;
+    auto& entry = tail.entry;
+    auto& decode = tail.decode;
+    auto& dataEntry = tail.dataEntry;
+    auto& shapeKey = tail.shapeKey;
     std::uint64_t drawIdentity = 0, drawAlias = 0;
     std::vector<DrawUserPatch> userPatches;
     if (registerKey) {
@@ -95,6 +402,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         std::shared_ptr<const DrawRelocation> relocation;
         bool aliasFirst = false;
         if (drawRelocationEnabled()) {
+            if (DrawFinisher::Busy() && drawRelocationPending.key != 0) DrawFinisher::Get().Drain();
             drawIdentity = drawIdentityKey(queue, *submission.shaders);
             std::lock_guard cacheLock(drawCacheMutex);
             learnPendingRelocation();
@@ -107,6 +415,17 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
             }
         }
         drawKey = drawRegisterKey(queue, *submission.shaders, localDevice->Serial(), &shapeKey, traceDrawCache() ? &drawKeyComponents : nullptr, aliasFirst ? relocation.get() : nullptr, aliasFirst ? &drawAlias : nullptr);
+        if (DrawFinisher::Busy()) {
+            bool shapeMatters = false;
+            if (DrawFinisher::Overlap() && drawDataHits()) {
+                std::lock_guard peekLock(drawCacheMutex);
+                const auto shape = drawShapes.find(shapeKey);
+                shapeMatters = !drawCache.contains(drawKey) && (shape == drawShapes.end() || !drawCache.contains(shape->second));
+            }
+            const bool drain = !DrawFinisher::Overlap() || DrawFinisher::Get().PendingKey(drawKey, shapeMatters ? shapeKey : 0);
+            if (drain) DrawFinisher::Get().Drain();
+            if (DrawFinisher::Overlap()) DrawFinisher::NoteDrain(DrawFinisher::DrainSite::Lookup, drain);
+        }
         std::unique_lock cacheLock(drawCacheMutex);
         ++drawEntryCounters.lookups;
         ++drawEntryCounters.registerKeyLookups;
@@ -184,15 +503,41 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         }
         decode = std::move(refreshed);
     }
-    resolveDrawDecode(queue, submission, localDevice->graphicsContext(), decode, registerKey, drawKey, profile);
+    try {
+        resolveDrawDecode(queue, submission, localDevice->graphicsContext(), decode, registerKey, drawKey, profile);
+    } catch (...) {
+        TraceDrawAttemptFailure(traceToken, "decode", "exception", submission.serial, submission.queue, packetOffset, ExceptionReason(std::current_exception()));
+        throw;
+    }
     const auto& graphics = decode->state;
-    auto pixel = decode->pixel;
+    auto& pixel = tail.pixel;
+    pixel = decode->pixel;
     const bool writesPrograms = graphics.stages.mesh || drawParameters.indirect || !userPatches.empty();
-    std::vector<DrawProgram> writablePrograms;
+    auto& writablePrograms = tail.writablePrograms;
     if (writesPrograms) writablePrograms = decode->programs;
     for (const auto& patch : userPatches) writablePrograms[patch.program].userData[patch.index] = patch.value;
-    const std::vector<DrawProgram>& programs = writesPrograms ? writablePrograms : decode->programs;
+    tail.programs = writesPrograms ? &writablePrograms : &decode->programs;
+    const auto& programs = *tail.programs;
     if (const auto skipped = SkippedShader(); skipped != 0 && std::any_of(programs.begin(), programs.end(), [skipped](const DrawProgram& program) { return program.binary.codeAddress == skipped; })) return drawn();
+    const bool emptyIndirectSkip = EmptyIndirectSkip();
+    auto& cpuIndirectPrograms = CpuIndirectPrograms();
+    const auto recordDraws = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || !drawParameters.indirect->indexLimitKnown || arguments.firstVertexOrIndex < drawParameters.indexCount); };
+    if (emptyIndirectSkip && drawParameters.indirect && !programs.empty()) {
+        const auto known = cpuIndirectPrograms.find(programs.front().binary.codeAddress);
+        if (known != cpuIndirectPrograms.end() && known->second) {
+            const auto& indirect = *drawParameters.indirect;
+            recordQueuedLabelsBeforeRead(submission.queue);
+            const auto readStart = std::chrono::steady_clock::now();
+            const auto count = std::min(indirect.countIndirect ? Pm4::ReadDrawCount(indirect) : indirect.count, indirect.count);
+            bool any = false;
+            for (std::uint32_t record = 0; record < count && !any; ++record) any = recordDraws(Pm4::ReadDrawArguments(indirect, record));
+            if (!any) {
+                Graphics::CountEmptyIndirectDraw(std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - readStart).count());
+                timing.Mark("empty_indirect_skipped");
+                return drawn();
+            }
+        }
+    }
     const auto setMeshIndexBuffer = [&](const Pm4::DrawParameters& parameters) {
         if (!graphics.stages.mesh) return;
         auto& words = writablePrograms.front().userData;
@@ -231,10 +576,15 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         indirect.startInstanceSgpr = sgprOf(indirect.startInstanceLocation);
         indirect.drawIndexSgpr = sgprOf(indirect.drawIndexLocation);
     }
-    std::vector<ShaderRecompiler::MemoryRegion> memory;
+    if (DrawFinisher::Busy()) {
+        const bool drain = !DrawFinisher::Overlap();
+        if (drain) DrawFinisher::Get().Drain();
+        else DrawFinisher::NoteDrain(DrawFinisher::DrainSite::Reads, false);
+    }
+    auto& memory = tail.memory;
+    auto& linked = tail.linked;
     memory.reserve(2 * programs.size() + 32);
     AppendProgramMemory(memory, programs);
-    std::vector<ShaderRecompiler::LinkedProgram> linked;
     linked.reserve(programs.size());
     for (std::size_t i = 0; i < programs.size(); ++i) {
         const auto& program = programs[i];
@@ -243,48 +593,64 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     timing.Mark("prepare");
     phaseTiming.Phase(DrawRowProgramPrepare);
 
-    std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>> vertexInfos(programs.size());
-    std::vector<std::vector<Graphics::DecodeRead>> decodeReads(programs.size());
+    auto& vertexInfos = tail.vertexInfos;
+    vertexInfos.resize(programs.size());
+    auto& decodeReads = tail.decodeReads;
+    decodeReads.resize(programs.size());
     const auto decodeVertexInfo = [&](std::size_t i) {
         const auto& program = programs[i];
         if (program.binary.stage == Stage::Fragment || roles[i] == Role::GeometryBack) return;
-        decodeReads[i].clear();
-        vertexInfos[i] = Graphics::DecodeVertexStageInfo(program.binary.header, program.binary.headerAddress, program.userData, &decodeReads[i], false, 8u - program.firstUserSgpr);
-        if (vertexInfos[i]) vertexInfos[i]->paClVsOutCntl = PositionExportLayout(program.snapshot.get(), program.codeOffset, program.binary.code, readRegister(queue.context, 0x207), program.tailContinuation.get()) | graphics.layerExports;
+        vertexInfos[i] = DecodeOrderedVertexStageInfo(program.binary.header, program.binary.headerAddress, program.userData, decodeReads[i], 8u - program.firstUserSgpr);
         if (vertexInfos[i]) {
+            vertexInfos[i]->paClVsOutCntl = PositionExportLayout(program.snapshot.get(), program.codeOffset, program.binary.code, readRegister(queue.context, 0x207), program.tailContinuation.get()) | graphics.layerExports;
             vertexInfos[i]->depthRemapMode = graphics.depthRemap.mode;
+            Graphics::ApplyPointSize(graphics, *vertexInfos[i]);
         }
     };
     if (!registerKey) {
         for (std::size_t i = 0; i < programs.size(); ++i) decodeVertexInfo(i);
         phaseTiming.Phase(DrawRowDecode);
     }
-    auto shaderMemory = std::make_unique<ShaderMemory>(memory, &queryPendingWrite, &observePendingWrite, hookWaitCounter(), &QueryPendingSpan);
-    std::vector<ShaderRecompiler::RecompileResult> results;
-    std::vector<std::shared_ptr<const ShaderRecompiler::RecompileResult>> compiledStages;
+    auto& shaderMemory = tail.shaderMemory;
+    shaderMemory = std::make_unique<ShaderMemory>(memory, &queryPendingWrite, &observePendingWrite, hookWaitCounter(), &QueryPendingSpan);
+    auto& results = tail.results;
+    auto& compiledStages = tail.compiledStages;
     compiledStages.reserve(programs.size());
-    std::vector<Graphics::CompiledShader> stages;
-    results.reserve(programs.size() + 2u);
+    auto& stages = tail.stages;
     stages.reserve(programs.size());
-    std::uint32_t pushCursorBytes = 0;
+    auto& pushCursorBytes = tail.pushCursorBytes;
 
-    std::vector<const ShaderRecompiler::RecompileResult*> programResults(programs.size(), nullptr);
+    auto& programResults = tail.programResults;
+    programResults.assign(programs.size(), nullptr);
 
-    std::vector<StageCapture> stageCaptures(programs.size());
-    std::vector<std::shared_ptr<DispatchVariant>> matched(programs.size());
-    std::vector<std::vector<ShaderRecompiler::MemoryRegion>> matchedRegions(programs.size());
+    auto& stageCaptures = tail.stageCaptures;
+    stageCaptures.resize(programs.size());
+    auto& matched = tail.matched;
+    matched.resize(programs.size());
+    auto& matchedRegions = tail.matchedRegions;
+    matchedRegions.resize(programs.size());
 
-    std::vector<std::shared_ptr<DispatchVariant>> fresh(programs.size());
+    auto& fresh = tail.fresh;
+    fresh.resize(programs.size());
 
-    std::vector<bool> recompiled(programs.size(), false);
-    std::vector<std::vector<std::pair<std::shared_ptr<DispatchVariant>, std::vector<ShaderRecompiler::MemoryRegion>>>> dataCandidates(programs.size());
-    std::vector<bool> reused(programs.size(), false);
-    std::vector<StageDataHit> stageData(programs.size());
-    std::uint64_t dataStagesReused = 0, dataStagesCompiled = 0, dataVerified = 0;
-    bool drawHit = false;
-    bool verifyHit = false;
-    const bool stageEntries = useDrawEntries && !(graphics.stages.tessellation && !drawParameters.indirect && drawParameters.instanceCount > 1u);
-    lookupDraw(submission, localDevice, graphics, pixel, programs, roles, vertexInfos, stageEntries, registerKey, profile, drawKey, entry, matched, matchedRegions, drawHit, verifyHit, phaseTiming, phaseMs, dataEntry, dataCandidates, stageData);
+    auto& recompiled = tail.recompiled;
+    recompiled.assign(programs.size(), false);
+    auto& dataCandidates = tail.dataCandidates;
+    dataCandidates.resize(programs.size());
+    auto& reused = tail.reused;
+    reused.assign(programs.size(), false);
+    auto& stageData = tail.stageData;
+    stageData.resize(programs.size());
+    auto& drawHit = tail.drawHit;
+    auto& verifyHit = tail.verifyHit;
+    tail.stageEntries = useDrawEntries && !(graphics.stages.tessellation && !drawParameters.indirect && drawParameters.instanceCount > 1u);
+    const bool stageEntries = tail.stageEntries;
+    try {
+        lookupDraw(submission, localDevice, graphics, pixel, programs, roles, vertexInfos, stageEntries, registerKey, profile, drawKey, entry, matched, matchedRegions, drawHit, verifyHit, phaseTiming, phaseMs, dataEntry, dataCandidates, stageData);
+    } catch (...) {
+        TraceDrawAttemptException(traceToken, "lookup", submission.serial, submission.queue, packetOffset, std::current_exception());
+        throw;
+    }
     for (std::size_t i = 0; i < matched.size(); ++i) {
         if (matched[i] == nullptr || matched[i]->shaderDataPatches.empty()) continue;
         applyShaderDataPatches(*matched[i]);
@@ -296,6 +662,14 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         if (drawHit || verifyHit) {
             ++drawRelocationCounters.hits;
             ++drawRelocationTrials[drawIdentity].hits;
+            if (const auto alias = drawAliases.find(drawAlias); alias != drawAliases.end()) {
+                const auto donor = drawCache.find(alias->second);
+                if (donor != drawCache.end() && drawCacheHits - donor->second->touched > drawCacheEntries() / 8) {
+                    drawOrder.splice(drawOrder.begin(), drawOrder, donor->second->order);
+                    donor->second->touched = drawCacheHits;
+                    ++drawEntryCounters.touches;
+                }
+            }
         }
         if (profile && drawRelocationCounters.lookups >= 100000) reportDrawRelocation();
     }
@@ -304,8 +678,24 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         for (const auto& patch : userPatches) current->programs[patch.program].userData[patch.index] = patch.value;
         decode = std::move(current);
     }
-    const bool patchedStages = std::any_of(stageData.begin(), stageData.end(), [](const StageDataHit& hit) { return hit.compiled != nullptr; });
+    tail.patchedStages = std::any_of(stageData.begin(), stageData.end(), [](const StageDataHit& hit) { return hit.compiled != nullptr; });
+    tail.relocatedDecode = relocatedDecode;
     std::uint64_t stageDataVerified = 0;
+    const auto target = graphics.hasColorTarget ? graphics.color.address : 0;
+    const VulkanDevice::DrawTraceContext trace{traceToken, submission.serial, submission.queue, packetOffset, target};
+    const auto* tracePtr = trace.token != 0 ? &trace : nullptr;
+    tail.traceToken = traceToken;
+    tail.trace = trace;
+    if (trace.token != 0) {
+        for (std::size_t i = 0; i < programs.size(); ++i) {
+            const auto& program = programs[i];
+            AgcDriver::CaptureTrace::LogBestEffort("draw-selected token=%llu submission=%llu queue=%x offset=%zu snapshot=0x%llx code=%llx entryOffset=%zu entry=%llx stage=%u role=%u drawCacheHit=%u variantHit=%u target=%llx",
+                    static_cast<unsigned long long>(trace.token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset,
+                    static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(program.snapshot.get())), static_cast<unsigned long long>(program.snapshot->codeAddress), program.codeOffset,
+                    static_cast<unsigned long long>(program.snapshot->codeAddress + program.codeOffset), static_cast<unsigned>(program.binary.stage), static_cast<unsigned>(roles[i]),
+                    drawHit ? 1u : 0u, matched[i] != nullptr ? 1u : 0u, static_cast<unsigned long long>(target));
+        }
+    }
 
     if (registerKey) {
 
@@ -330,6 +720,144 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         phaseTiming.Phase(DrawRowDecode);
     }
 
+    tail.submission = &submission;
+    tail.submissionQueue = submission.queue;
+    tail.packetOpcode = (packet[0] >> 8u) & 0xffu;
+    tail.reg207 = readRegister(queue.context, 0x207);
+    tail.dumpTarget = dumpTarget;
+    tail.dumpSlot1 = dumpSlot1;
+    tail.packetOffset = packetOffset;
+    const bool handOff = pipelined && !drawParameters.indirect && !profile && !lockedPrepare && dumpTarget == 0 && dumpSlot1 == 0 && !tracePrograms && !verifyDrawDataHits() && deferredLabels().labels.empty() && DrawFinisher::Enabled();
+    if (handOff) {
+        tail.epoch = DrawPipeline::EpochToken().load(std::memory_order_relaxed);
+        tail.submissionSerial = submission.serial;
+        tail.packetOffset = static_cast<std::size_t>(packet.data() - submission.commands.data());
+        noteFinisherHandOff(true);
+        DrawFinisher::Pending held;
+        if (DrawFinisher::Overlap()) held = heldWrites(tail);
+        DrawFinisher::Get().Enqueue([this, tailHolder] {
+            auto& job = *tailHolder;
+            DrawPipeline::FollowEpoch(job.epoch);
+            GuestMemory::SetCurrentPacket(job.packetOpcode, job.submissionQueue);
+            PerformanceTimer finishTiming("Driver.DrawFinish");
+            try {
+                if (finishDraw(job, finishTiming) == DrawVerdict::Rejected) throw std::runtime_error(job.ownRejected);
+            } catch (const std::exception& error) {
+                CaptureTrace::Log("draw-error submission=%llu offset=%zu finisher=1 reason=%.256s", static_cast<unsigned long long>(job.submissionSerial), job.packetOffset, error.what());
+                throw std::runtime_error("draw at submission " + std::to_string(job.submissionSerial) + " offset " + std::to_string(job.packetOffset) + " (finished on the draw finisher): " + error.what());
+            }
+        }, std::move(held));
+        timing.Mark("draw_handed_off");
+        return drawn();
+    }
+    noteFinisherHandOff(false);
+    if (DrawFinisher::Busy()) {
+        DrawFinisher::Get().Drain();
+        if (DrawFinisher::Overlap()) DrawFinisher::NoteDrain(DrawFinisher::DrainSite::Kept, true);
+    }
+    tail.queue = &queue;
+    tail.packet = packet;
+    tail.rejected = &rejected;
+    tail.gpuLock = &gpuLock;
+    return finishDraw(tail, timing);
+}
+
+DrawVerdict Driver::finishDraw(DrawTail& tail, PerformanceTimer& timing) {
+    using Stage = ShaderRecompiler::ShaderStage;
+    using Role = ShaderRecompiler::ProgramRole;
+    const bool profile = tail.profile;
+    const auto traceToken = tail.traceToken;
+    const auto& trace = tail.trace;
+    const auto* tracePtr = trace.token != 0 ? &trace : nullptr;
+    const auto packetOffset = tail.packetOffset;
+    const auto packet = tail.packet;
+    auto& phaseMs = tail.phaseMs;
+    auto& phaseLap = tail.phaseLap;
+    auto& captures = tail.captures;
+    auto& phaseTiming = tail.phaseTiming;
+    auto& drawParameters = tail.drawParameters;
+    const bool pipelined = tail.pipelined;
+    static const bool pipelinedIndirect = std::getenv("APS5_NO_PIPELINED_INDIRECT") == nullptr;
+    const auto drainBeforeInline = [&] {
+        if (pipelined && DrawPipeline::Queue0().Busy()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Indirect);
+    };
+    auto& traceIndirect = tail.traceIndirect;
+    const auto dumpTarget = tail.dumpTarget;
+    const auto dumpSlot1 = tail.dumpSlot1;
+    auto& gpuLock = tail.gpuLock != nullptr ? *tail.gpuLock : tail.ownLock;
+    auto& localDevice = tail.localDevice;
+    const bool registerKey = tail.registerKey;
+    auto& drawKey = tail.drawKey;
+    auto& entry = tail.entry;
+    auto& decode = tail.decode;
+    auto& dataEntry = tail.dataEntry;
+    auto& shapeKey = tail.shapeKey;
+    const auto& graphics = decode->state;
+    auto& pixel = tail.pixel;
+    auto& writablePrograms = tail.writablePrograms;
+    const auto& programs = *tail.programs;
+    const std::vector<Role>& roles = decode->roles;
+    auto& memory = tail.memory;
+    auto& linked = tail.linked;
+    auto& vertexInfos = tail.vertexInfos;
+    auto& decodeReads = tail.decodeReads;
+    auto& shaderMemory = tail.shaderMemory;
+    auto& results = tail.results;
+    auto& compiledStages = tail.compiledStages;
+    auto& stages = tail.stages;
+    auto& pushCursorBytes = tail.pushCursorBytes;
+    auto& programResults = tail.programResults;
+    auto& stageCaptures = tail.stageCaptures;
+    auto& matched = tail.matched;
+    auto& matchedRegions = tail.matchedRegions;
+    auto& fresh = tail.fresh;
+    auto& recompiled = tail.recompiled;
+    auto& dataCandidates = tail.dataCandidates;
+    auto& reused = tail.reused;
+    auto& stageData = tail.stageData;
+    std::uint64_t dataStagesReused = 0, dataStagesCompiled = 0, dataVerified = 0;
+    auto& drawHit = tail.drawHit;
+    auto& verifyHit = tail.verifyHit;
+    const bool stageEntries = tail.stageEntries;
+    const bool patchedStages = tail.patchedStages;
+    std::uint64_t stageDataVerified = 0;
+    const Submission& submission = *tail.submission;
+    std::string& rejected = tail.rejected != nullptr ? *tail.rejected : tail.ownRejected;
+    static const QueueState noQueue{};
+    const QueueState& queue = tail.queue != nullptr ? *tail.queue : noQueue;
+    const auto drawn = [&] {
+        phaseTiming.Phase(DrawRowVectors);
+        if (!profile) return DrawVerdict::Drawn;
+        auto& pending = pendingDrawPhases();
+        pending.phases = true;
+        pending.captures = captures;
+        pending.ms = phaseMs;
+        pending.tailAt = phaseLap;
+        return DrawVerdict::Drawn;
+    };
+    const auto setMeshIndexBuffer = [&](const Pm4::DrawParameters& parameters) {
+        if (!graphics.stages.mesh) return;
+        auto& words = writablePrograms.front().userData;
+        require(programs.front().firstUserSgpr == 0 && words.size() >= ShaderRecompiler::MeshIndexBufferUserWord + 4, "mesh program lacks the hidden user words");
+        const auto descriptor = Graphics::MeshIndexBufferDescriptor(parameters);
+        std::copy(descriptor.begin(), descriptor.end(), words.begin() + ShaderRecompiler::MeshIndexBufferUserWord);
+    };
+    const auto locate = [&](std::uint32_t location) -> std::optional<std::pair<std::size_t, std::size_t>> {
+        if (location == 0x280u) return std::nullopt;
+        for (std::size_t i = 0; i < programs.size(); ++i) {
+            if (roles[i] == Role::Fragment || roles[i] == Role::GeometryBack || location < programs[i].userDataBase) continue;
+            const auto word = location - programs[i].userDataBase + (8u - programs[i].firstUserSgpr);
+            if (word < programs[i].userData.size()) return std::make_pair(i, static_cast<std::size_t>(word));
+        }
+        return std::nullopt;
+    };
+    const auto decodeVertexInfo = [&](std::size_t i) {
+        const auto& program = programs[i];
+        if (program.binary.stage == Stage::Fragment || roles[i] == Role::GeometryBack) return;
+        decodeReads[i].clear();
+        vertexInfos[i] = Graphics::DecodeVertexStageInfo(program.binary.header, program.binary.headerAddress, program.userData, &decodeReads[i], false, 8u - program.firstUserSgpr);
+        if (vertexInfos[i]) vertexInfos[i]->paClVsOutCntl = PositionExportLayout(program.snapshot.get(), program.codeOffset, program.binary.code, tail.reg207, program.tailContinuation.get()) | graphics.layerExports;
+    };
     const auto fold = [&](const ShaderRecompiler::RecompileResult& main, Pm4::DrawParameters& parameters) { FoldDrawOffsets(main, programs.front(), parameters); };
 
     const auto freshRuns = [&](std::size_t i, std::vector<std::pair<std::uint64_t, std::uint64_t>>& runs, std::vector<std::uint32_t>& words) {
@@ -373,6 +901,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         throw std::runtime_error(message);
     };
     std::optional<Graphics::IndirectDrawPath> indirectCpu;
+    std::size_t completedSubdraws = 0;
     std::vector<std::uint32_t> pushOffsets(programs.size(), 0);
     std::optional<ShaderRecompiler::MeshBarycentricLayout> meshBarycentrics;
     std::vector<std::size_t> resultIndex(programs.size(), 0);
@@ -402,7 +931,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
                         break;
                     }
                 }
-                compiledStages.push_back(materializeDrawStage(i, pushCursorBytes, queue, submission, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
+                compiledStages.push_back(materializeDrawStage(i, pushCursorBytes, queue, submission, packetOffset, trace.token, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
                 if (!rejected.empty()) return DrawVerdict::Rejected;
                 programResults[i] = compiledStages.back().get();
                 if (candidate != dataCandidates[i].end()) verifyDataStage(i, *candidate->first);
@@ -414,13 +943,19 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         const auto& result = *programResults[i];
         if (i == 0 && drawParameters.indirect) {
             indirectCpu = ClassifyIndirectDraw(result, graphics, programs.front(), localDevice, drawParameters, traceIndirect);
+            if (EmptyIndirectSkip()) CpuIndirectPrograms()[programs.front().binary.codeAddress] = indirectCpu.has_value();
         } else if (i == 0) {
             fold(result, drawParameters);
         }
-        const auto slotEnd = (pushCursorBytes / Graphics::PipelinePushSlotBytes + 1u) * Graphics::PipelinePushSlotBytes;
-        require(result.pushConstants.size() <= slotEnd - pushCursorBytes, "stage push constants exceed the pipeline push constant block");
-        stages.push_back({program.binary.stage, &result, result.pushConstants.empty() ? 0u : pushCursorBytes});
-        pushCursorBytes += static_cast<std::uint32_t>(result.pushConstants.size());
+        try {
+            const auto slotEnd = (pushCursorBytes / Graphics::PipelinePushSlotBytes + 1u) * Graphics::PipelinePushSlotBytes;
+            require(result.pushConstants.size() <= slotEnd - pushCursorBytes, "stage push constants exceed the pipeline push constant block");
+            stages.push_back({program.binary.stage, &result, result.pushConstants.empty() ? 0u : pushCursorBytes});
+            pushCursorBytes += static_cast<std::uint32_t>(result.pushConstants.size());
+        } catch (...) {
+            TraceMaterializationFailure(trace.token, submission, packetOffset, "push-constant-validation", completedSubdraws, std::current_exception());
+            throw;
+        }
     }
 
     if (stageDataVerified != 0) {
@@ -433,37 +968,64 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         drawEntryCounters.dataStagesCompiled += dataStagesCompiled;
         drawEntryCounters.dataVerified += dataVerified;
     }
-    cacheDrawStages(stageEntries, drawHit, drawParameters, indirectCpu, programs, stageCaptures, vertexInfos, decodeReads, verifyHit, matched, fresh, drawKey, registerKey, decode, phaseTiming, reused, entry, shapeKey);
+    const bool shapeRefresh = Graphics::DrawPipelineEnabled();
+    const auto refreshSeenTwice = [&] {
+        std::uint64_t data = shapeKey;
+        bool stored = false;
+        const auto mix = [&data](std::uint64_t value) {
+            data ^= value + 0x9e3779b97f4a7c15ull + (data << 6u) + (data >> 2u);
+        };
+        for (std::size_t i = 0; i < programs.size(); ++i) {
+            const auto& capture = stageCaptures[i];
+            if (reused[i] || capture.compiled == nullptr || !CacheableResult(*capture.compiled)) continue;
+            stored = true;
+            const auto& words = programs[i].userData;
+            for (std::size_t w = 0; w < words.size(); ++w) {
+                if (w >= 64u || (capture.userDataMask >> w & 1u) != 0) mix((static_cast<std::uint64_t>(i) << 40u) ^ (static_cast<std::uint64_t>(w) << 32u) ^ words[w]);
+            }
+        }
+        if (!stored) return false;
+        static std::array<std::atomic<std::uint64_t>, 4096> lastData{};
+        return lastData[shapeKey % lastData.size()].exchange(data, std::memory_order_relaxed) == data;
+    };
+    const bool shapeNeedsEntry = shapeRefresh && registerKey && shapeKey != 0 && drawDataHits() && !drawParameters.indirect && dataEntry != nullptr && dataStagesCompiled != 0 && refreshSeenTwice();
+    cacheDrawStages(stageEntries, drawHit, drawParameters, indirectCpu, programs, stageCaptures, vertexInfos, decodeReads, verifyHit, matched, stageData, fresh, drawKey, registerKey, decode, phaseTiming, reused, entry, shapeKey, shapeNeedsEntry);
     timing.Mark("shader_compile_and_link");
 
     for (const auto& reads : decodeReads) {
         for (const auto& read : reads) memory.push_back({read.address, read.Bytes()});
     }
 
-    if (pipelined && !deferredLabels().labels.empty()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Labels);
-    if (recordQueuedLabelsAfterCapture(submission.queue, memory)) return draw(queue, packet, submission, rejected);
+    if (tail.queue != nullptr && pipelined && !deferredLabels().labels.empty()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Labels);
+    if (recordQueuedLabelsAfterCapture(submission.queue, memory)) return draw(*tail.queue, packet, submission, packetOffset, rejected);
 
     bool rectListBuilt = false;
 
     std::size_t rectIndex = 0;
     const auto buildRectList = [&] {
-        phaseTiming.Phase(DrawRowVectors);
-        require(programs.size() == 2 && programResults[0] != nullptr && programResults[1] != nullptr, "rect-list requires vertex and fragment programs");
-        auto rectangle = DrawRectangle(*programs[0].snapshot, programs[1].snapshot, programResults[0]->variantId, programResults[1]->variantId, localDevice->Target());
-        auto& control = graphics.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT ? rectangle.lastVertexControl : rectangle.control;
-        if (rectListBuilt) {
-            results[rectIndex] = std::move(control);
-            results[rectIndex + 1] = std::move(rectangle.evaluation);
+        try {
+            phaseTiming.Phase(DrawRowVectors);
+            require(programs.size() == 2 && programResults[0] != nullptr && programResults[1] != nullptr, "rect-list requires vertex and fragment programs");
+            auto rectangle = DrawRectangle(*programs[0].snapshot, programs[1].snapshot, programResults[0]->variantId, programResults[1]->variantId, localDevice->Target());
+            auto& control = graphics.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT ? rectangle.lastVertexControl : rectangle.control;
+            if (rectListBuilt) {
+                results[rectIndex] = std::move(control);
+                results[rectIndex + 1] = std::move(rectangle.evaluation);
+                phaseTiming.Phase(DrawRowRectList);
+                return;
+            }
+            require(stages.size() == 2, "rect-list requires vertex and fragment programs");
+            results.reserve(programs.size() + 2u);
+            rectIndex = results.size();
+            results.push_back(std::move(control));
+            results.push_back(std::move(rectangle.evaluation));
+            stages.insert(stages.begin() + 1, {{Stage::TessellationControl, &results[rectIndex], 0}, {Stage::TessellationEvaluation, &results[rectIndex + 1], 0}});
+            rectListBuilt = true;
             phaseTiming.Phase(DrawRowRectList);
-            return;
+        } catch (...) {
+            TraceMaterializationFailure(trace.token, submission, packetOffset, "rect-list", completedSubdraws, std::current_exception());
+            throw;
         }
-        require(stages.size() == 2, "rect-list requires vertex and fragment programs");
-        rectIndex = results.size();
-        results.push_back(std::move(control));
-        results.push_back(std::move(rectangle.evaluation));
-        stages.insert(stages.begin() + 1, {{Stage::TessellationControl, &results[rectIndex], 0}, {Stage::TessellationEvaluation, &results[rectIndex + 1], 0}});
-        rectListBuilt = true;
-        phaseTiming.Phase(DrawRowRectList);
     };
     if (graphics.rectList) buildRectList();
     if (!programs.empty() && programResults.back() != nullptr && programResults.back()->barycentricEmulation.active && graphics.stages.path == Graphics::ShaderPath::Geometry) {
@@ -473,21 +1035,22 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         if (programResults[0]->meshBarycentrics != meshBarycentrics) {
             const auto pushBytes = programResults[0]->pushConstants.size();
             const auto exports = programResults[0]->parameterExports;
-            compiledStages.push_back(materializeDrawStage(0, pushOffsets[0], queue, submission, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
+            compiledStages.push_back(materializeDrawStage(0, pushOffsets[0], queue, submission, packetOffset, traceToken, programs, graphics, pixel, vertexInfos, memory, linked, drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics));
             if (!rejected.empty()) return DrawVerdict::Rejected;
             programResults[0] = compiledStages.back().get();
             stages[0].program = programResults[0];
             require(programResults[0]->pushConstants.size() == pushBytes && programResults[0]->parameterExports == exports, "pairing the mesh program with its pixel shader changed the push constants or the parameter exports the pixel shader was built for");
         }
         require(programResults[0]->meshBarycentrics == meshBarycentrics, "the mesh program was compiled for a different barycentric layout than its pixel shader");
-    } else if (!programs.empty() && programResults.back() != nullptr && programResults.back()->barycentricEmulation.active) {
-        require(!graphics.rectList && graphics.stages.path == Graphics::ShaderPath::Vertex && programs.size() == 2 && programResults[0] != nullptr && stages.size() == 2, "a pixel shader that reads barycentrics without VK_KHR_fragment_shader_barycentric needs a vertex shader before it");
+    } else if (!graphics.rectList && !programs.empty() && programResults.back() != nullptr && programResults.back()->barycentricEmulation.active) {
+        require(graphics.stages.path == Graphics::ShaderPath::Vertex && programs.size() == 2 && programResults[0] != nullptr && stages.size() == 2, "a pixel shader that reads barycentrics without VK_KHR_fragment_shader_barycentric needs a vertex shader before it");
         const auto geometryLimits = localDevice->GeometryLimits();
+        results.reserve(programs.size() + 2u);
         if (geometryLimits || !localDevice->Target().tessellation) {
             results.push_back(ShaderRecompiler::BuildBarycentricGeometryShader(*programResults[0], *programResults[1], localDevice->Target(), geometryLimits));
             stages.insert(stages.begin() + 1, Graphics::CompiledShader{Stage::Geometry, &results.back(), 0});
         } else {
-            require(graphics.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST && !graphics.primitiveRestart, "a pixel shader that reads barycentrics without VK_KHR_fragment_shader_barycentric or geometry shaders needs a triangle list without primitive restart");
+            require((graphics.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST || graphics.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP) && !graphics.primitiveRestart, "a pixel shader that reads barycentrics without VK_KHR_fragment_shader_barycentric or geometry shaders needs a triangle list or strip without primitive restart");
             auto patches = ShaderRecompiler::BuildBarycentricTessellationShaders(*programResults[0], *programResults[1], localDevice->Target(), localDevice->MaxFragmentInputComponents(), graphics.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT ? 2u : 0u);
             const auto first = results.size();
             results.push_back(std::move(patches.control));
@@ -504,6 +1067,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     snapshot();
     timing.Mark("post_compile_prepare");
     const auto lockForDraw = [&] {
+        require(tail.queue != nullptr, "the draw finisher reached a draw it cannot commit through the pipeline");
         if (gpuLock.owns_lock()) return;
         phaseTiming.Phase(DrawRowVectors);
         GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
@@ -523,6 +1087,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     if (drawParameters.indirect && indirectCpu) {
 
         const auto indirect = *drawParameters.indirect;
+        results.reserve(programs.size() + 2u);
         for (std::size_t i = 0; i < programs.size(); ++i) {
             if (programResults[i] == nullptr) continue;
             resultIndex[i] = results.size();
@@ -541,7 +1106,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         const auto baseVertexWords = UserDataWords(programs, roles, indirect.baseVertexLocation);
         const auto startInstanceWords = UserDataWords(programs, roles, indirect.startInstanceLocation);
         const auto drawIndexWords = indirect.drawIndexEnabled ? UserDataWords(programs, roles, indirect.drawIndexLocation) : std::vector<std::pair<std::size_t, std::size_t>>{};
-        const auto drawable = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || arguments.firstVertexOrIndex < drawParameters.indexCount); };
+        const auto drawable = [&](const Pm4::DrawArguments& arguments) { return arguments.count != 0 && arguments.instances != 0 && (!drawParameters.indexed || !indirect.indexLimitKnown || arguments.firstVertexOrIndex < drawParameters.indexCount); };
         std::size_t lastDrawable = records.size();
         for (std::size_t record = 0; record < records.size(); ++record) {
             if (drawable(records[record])) lastDrawable = record;
@@ -567,10 +1132,16 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
             }
             Pm4::DrawParameters direct{0, arguments.count, 0, arguments.instances, drawParameters.flags, drawParameters.indexed, 0, 0};
             if (drawParameters.indexed) {
-
-                if (arguments.firstVertexOrIndex >= drawParameters.indexCount) continue;
+                if (indirect.indexLimitKnown) {
+                    if (arguments.firstVertexOrIndex >= drawParameters.indexCount) continue;
+                    direct.indexCount = std::min(arguments.count, drawParameters.indexCount - arguments.firstVertexOrIndex);
+                } else {
+                    const auto end = static_cast<std::uint64_t>(arguments.firstVertexOrIndex) + arguments.count;
+                    require(end <= std::numeric_limits<std::uint32_t>::max(), "indirect draw index range overflow");
+                    require(end * drawParameters.indexSize <= std::numeric_limits<std::uint64_t>::max() - drawParameters.indexAddress, "indirect draw index range address overflow");
+                    direct.indexCount = arguments.count;
+                }
                 direct.indexAddress = drawParameters.indexAddress + static_cast<std::uint64_t>(arguments.firstVertexOrIndex) * drawParameters.indexSize;
-                direct.indexCount = std::min(arguments.count, drawParameters.indexCount - arguments.firstVertexOrIndex);
                 direct.indexSize = drawParameters.indexSize;
             } else {
                 direct.firstVertex = indirect.indxOffset;
@@ -583,7 +1154,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
                 auto& result = results[resultIndex[programIndex]];
                 const auto pushBytes = result.pushConstants.size();
                 decodeVertexInfo(programIndex);
-                result = *materializeDrawStage(programIndex, pushOffsets[programIndex], queue, submission, programs, graphics, pixel, vertexInfos, memory, linked, programs[programIndex].binary.stage == Stage::TessellationControl || programs[programIndex].binary.stage == Stage::TessellationEvaluation ? direct : drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics);
+                result = *materializeDrawStage(programIndex, pushOffsets[programIndex], queue, submission, packetOffset, trace.token, programs, graphics, pixel, vertexInfos, memory, linked, programs[programIndex].binary.stage == Stage::TessellationControl || programs[programIndex].binary.stage == Stage::TessellationEvaluation ? direct : drawParameters, localDevice, *shaderMemory, stageCaptures, recompiled, drawHit, matched, matchedRegions, profile, dumpTarget, dumpSlot1, captures, phaseTiming, phaseMs, rejected, meshBarycentrics);
                 if (!rejected.empty()) return DrawVerdict::Rejected;
                 require(result.pushConstants.size() == pushBytes, "patched program changed its push constant layout");
             }
@@ -598,9 +1169,9 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
                 phaseTiming.Phase(DrawRowVectors);
                 auto writes = drawWriteRanges(graphics, stages);
                 const auto commitQueue = submission.queue;
-                const auto commitPacket = (packet[0] >> 8u) & 0xffu;
+                const auto commitPacket = tail.packetOpcode;
                 const auto epoch = DrawPipeline::EpochToken().load(std::memory_order_relaxed);
-                auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), direct, stages = std::move(stages), snapshots = std::move(snapshots), commitQueue, commitPacket, epoch, programs = std::move(programs), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)] {
+                auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), direct, stages = std::move(stages), snapshots = std::move(snapshots), commitQueue, commitPacket, epoch, writablePrograms = std::move(writablePrograms), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)] {
                     DrawPipeline::FollowEpoch(epoch);
                     GuestMemory::SetCurrentPacket(commitPacket, commitQueue);
                     commitDraw(localDevice, commitQueue, decode->state, direct, stages, snapshots, nullptr, {}, 0);
@@ -615,7 +1186,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
             lockForDraw();
             noteDrawWriters(stages, submission.queue);
             phaseTiming.Phase(DrawRowVectors);
-            localDevice->Draw(graphics, direct, stages, snapshots);
+            localDevice->Draw(graphics, direct, stages, snapshots, nullptr, tracePtr);
             phaseTiming.Phase(DrawRowGraphics);
         }
         timing.Mark("draw_and_resource_release");
@@ -639,20 +1210,20 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
             return DrawVerdict::Rejected;
         }
     }
-    if (pipelined && !drawParameters.indirect && deferredLabels().labels.empty()) {
+    if (pipelined && !drawParameters.indirect && (tail.queue == nullptr || deferredLabels().labels.empty())) {
         phaseTiming.Phase(DrawRowVectors);
         auto writes = drawWriteRanges(graphics, stages);
         const auto commitQueue = submission.queue;
-        const auto commitPacket = (packet[0] >> 8u) & 0xffu;
-        const auto epoch = DrawPipeline::EpochToken().load(std::memory_order_relaxed);
+        const auto commitPacket = tail.packetOpcode;
+        const auto epoch = DrawFinisher::OnFinisherThread() ? tail.epoch : DrawPipeline::EpochToken().load(std::memory_order_relaxed);
         auto reads = QueuedDrawReadRanges(drawParameters, stages);
-        auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), drawParameters, stages = std::move(stages), snapshots = std::move(snapshots), recipe = std::move(recipe), recipeStages = std::move(recipeStages), drawKey, commitQueue, commitPacket, epoch, programs = std::move(programs), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)] {
+        auto commit = [this, localDevice = std::move(localDevice), decode = std::move(decode), drawParameters, stages = std::move(stages), snapshots = std::move(snapshots), recipe = std::move(recipe), recipeStages = std::move(recipeStages), drawKey, commitQueue, commitPacket, epoch, trace = trace, writablePrograms = std::move(writablePrograms), results = std::move(results), memory = std::move(memory), linked = std::move(linked), stageCaptures = std::move(stageCaptures), matched = std::move(matched), matchedRegions = std::move(matchedRegions), fresh = std::move(fresh), decodeReads = std::move(decodeReads), shaderMemory = std::move(shaderMemory), entry = std::move(entry), dataEntry = std::move(dataEntry), compiledStages = std::move(compiledStages), stageData = std::move(stageData)]() mutable {
             DrawPipeline::FollowEpoch(epoch);
             GuestMemory::SetCurrentPacket(commitPacket, commitQueue);
-            commitDraw(localDevice, commitQueue, decode->state, drawParameters, stages, snapshots, recipe, recipeStages, drawKey);
+            commitDraw(localDevice, commitQueue, decode->state, drawParameters, stages, snapshots, recipe, recipeStages, drawKey, trace);
         };
         auto held = std::make_shared<decltype(commit)>(std::move(commit));
-        DrawPipeline::Queue0().Enqueue([held] { (*held)(); }, std::move(writes), 0, {}, std::move(reads));
+        DrawPipeline::Queue0().Enqueue([held] { (*held)(); }, std::move(writes), 0, {}, std::move(reads), true);
         phaseTiming.Phase(DrawRowLockWait);
         timing.Mark("draw_enqueued");
         return drawn();
@@ -662,7 +1233,7 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
     noteDrawWriters(stages, submission.queue);
     phaseTiming.Phase(DrawRowVectors);
     if (recipe != nullptr) {
-        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe) == RecipeOutcome::Recorded) {
+        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe, tracePtr) == RecipeOutcome::Recorded) {
             phaseTiming.Phase(DrawRowGraphics);
             timing.Mark("draw_and_resource_release");
             return drawn();
@@ -671,14 +1242,15 @@ DrawVerdict Driver::draw(QueueState& queue, std::span<const std::uint32_t> packe
         VulkanDevice::NoteRecipe(VulkanDevice::RecipeEvent::Restart, VulkanDevice::RecipeKind::Draw);
     }
     std::shared_ptr<const DrawRecipe> built;
-    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built);
+    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built, tracePtr);
     phaseTiming.Phase(DrawRowGraphics);
     if (built != nullptr) attachDrawRecipe(drawKey, recipeStages, std::move(built));
     timing.Mark("draw_and_resource_release");
     return drawn();
 }
 
-void Driver::commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey) {
+void Driver::commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t queue, const Graphics::State& graphics, const Pm4::DrawParameters& drawParameters, std::span<const Graphics::CompiledShader> stages, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const std::vector<std::shared_ptr<DispatchVariant>>& recipeStages, std::uint64_t drawKey, VulkanDevice::DrawTraceContext trace) {
+    const auto* tracePtr = trace.token != 0 ? &trace : nullptr;
     GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
     std::lock_guard gpuLock(GuestMemory::GpuMutex());
     if (auto current = device.Load(); current != nullptr && current != localDevice) localDevice = std::move(current);
@@ -692,11 +1264,11 @@ void Driver::commitDraw(std::shared_ptr<VulkanDevice> localDevice, std::uint32_t
     recordLabelsForPacket(localDevice.get(), queue);
     noteDrawWriters(stages, queue);
     if (recipe != nullptr) {
-        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe) == RecipeOutcome::Recorded) return;
+        if (localDevice->DrawFromRecipe(graphics, drawParameters, stages, snapshots, recipe, tracePtr) == RecipeOutcome::Recorded) return;
         VulkanDevice::NoteRecipe(VulkanDevice::RecipeEvent::Restart, VulkanDevice::RecipeKind::Draw);
     }
     std::shared_ptr<const DrawRecipe> built;
-    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built);
+    localDevice->Draw(graphics, drawParameters, stages, snapshots, recipeStages.empty() ? nullptr : &built, tracePtr);
     if (built != nullptr) attachDrawRecipe(drawKey, recipeStages, std::move(built));
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp
index 1d76a6a338..8d05f4693f 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp
@@ -123,10 +123,24 @@ bool Driver::admitDrawKey(std::uint64_t key, std::uint64_t shape) {
     return drawShapeSightings->SeenBefore(shape);
 }
 
-void Driver::insertDrawEntry(std::uint64_t key, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::shared_ptr<const DrawDecode> decode, std::uint64_t shape) {
+void Driver::insertDrawEntry(std::uint64_t key, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::shared_ptr<const DrawDecode> decode, std::uint64_t shape, bool replaceShape) {
     std::lock_guard cacheLock(drawCacheMutex);
     auto& counters = drawEntryCounters;
-    ++counters.inserts;
+    if (replaceShape && shape != 0) {
+        ++counters.shapeUpdates;
+        if (const auto shapeOf = drawShapes.find(shape); shapeOf != drawShapes.end() && shapeOf->second != key) {
+            if (const auto previous = drawCache.find(shapeOf->second); previous != drawCache.end()) {
+                for (const auto& variants : previous->second->stages) {
+                    for (const auto& variant : variants) accountDrawVariant(*variant, false);
+                }
+                drawOrder.erase(previous->second->order);
+                drawCache.erase(previous);
+            }
+            drawShapes.erase(shapeOf);
+        }
+    } else {
+        ++counters.inserts;
+    }
     const auto found = drawCache.find(key);
     auto replacement = std::make_shared<DrawEntry>();
     replacement->stages.resize(fresh.size());
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCacheStatistics.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCacheStatistics.cpp
index 3e1094adfb..b1f3dc2a02 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCacheStatistics.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCacheStatistics.cpp
@@ -62,7 +62,7 @@ std::string Driver::profileDrawCacheLines(const DrawEntryCounters& counters) {
         std::snprintf(item, sizeof(item), "%s%llu", rank == 0 ? "" : " / ", count(counters.variantHitsByRank[rank]));
         ranks += item;
     }
-    append("[draw-cache] %llu lookups (10 s): %llu no entry, %llu validated in %.1f us each (key, lookup and every stage): %llu hits (every stage equal; stage hits by variant rank 1..k %s), misses by reason: front stage differing %llu, fragment differing %llu, other stage differing %llu, layout (push offset) %llu, gate %llu, stage count %llu; %llu stage validations (%llu equal, %.2f variants compared each); %llu inserts (%llu variants inserted, %llu evicted beyond k, %llu already present, %llu unstable), %zu entries (%llu variants, ~%.1f MiB), %llu evictions in total, %llu LRU moves; verify: %llu hits captured again, %llu stages differed\n", count(counters.lookups), count(counters.absent), count(validated), validated != 0 ? counters.validateUs / static_cast<double>(validated) : 0.0, count(counters.hits), ranks.c_str(), miss(DrawMiss::FrontDiffering), miss(DrawMiss::FragmentDiffering), miss(DrawMiss::OtherDiffering), miss(DrawMiss::Layout), miss(DrawMiss::Gate), miss(DrawMiss::Stages), count(counters.stageValidations), count(counters.stageEqual), counters.stageValidations != 0 ? static_cast<double>(counters.variantsCompared) / static_cast<double>(counters.stageValidations) : 0.0, count(counters.inserts), count(counters.variantsInserted), count(counters.variantsEvicted), count(counters.present), count(counters.unstable), drawCache.size(), count(drawCacheVariants), static_cast<double>(drawCacheVariantBytes) / (1024.0 * 1024.0), count(drawCacheEvictions), count(counters.touches), count(counters.verifyHits), count(counters.verifyMismatches));
+    append("[draw-cache] %llu lookups (10 s): %llu no entry, %llu validated in %.1f us each (key, lookup and every stage): %llu hits (every stage equal; stage hits by variant rank 1..k %s), misses by reason: front stage differing %llu, fragment differing %llu, other stage differing %llu, layout (push offset) %llu, gate %llu, stage count %llu; %llu stage validations (%llu equal, %.2f variants compared each); %llu inserts (%llu shape updates, %llu variants inserted, %llu evicted beyond k, %llu already present, %llu unstable), %zu entries (%llu variants, ~%.1f MiB), %llu evictions in total, %llu LRU moves; verify: %llu hits captured again, %llu stages differed\n", count(counters.lookups), count(counters.absent), count(validated), validated != 0 ? counters.validateUs / static_cast<double>(validated) : 0.0, count(counters.hits), ranks.c_str(), miss(DrawMiss::FrontDiffering), miss(DrawMiss::FragmentDiffering), miss(DrawMiss::OtherDiffering), miss(DrawMiss::Layout), miss(DrawMiss::Gate), miss(DrawMiss::Stages), count(counters.stageValidations), count(counters.stageEqual), counters.stageValidations != 0 ? static_cast<double>(counters.variantsCompared) / static_cast<double>(counters.stageValidations) : 0.0, count(counters.inserts), count(counters.shapeUpdates), count(counters.variantsInserted), count(counters.variantsEvicted), count(counters.present), count(counters.unstable), drawCache.size(), count(drawCacheVariants), static_cast<double>(drawCacheVariantBytes) / (1024.0 * 1024.0), count(drawCacheEvictions), count(counters.touches), count(counters.verifyHits), count(counters.verifyMismatches));
     append("[draw-cache] register key (10 s): %llu lookups, %llu hits, key build %.1f us each; decode skipped %llu, partial (state/pixel/programs from the entry) %llu; facade log != table %llu; verify: %llu decodes compared, %llu differed\n", count(counters.registerKeyLookups), count(counters.registerKeyHits), counters.registerKeyLookups != 0 ? counters.keyUs / static_cast<double>(counters.registerKeyLookups) : 0.0, count(counters.decodeSkipped), count(counters.decodePartial), count(counters.facadeMismatches), count(counters.verifyDecodes), count(counters.verifyDecodeMismatches));
     append("[draw-cache] stage data hits (10 s): %llu stages (%llu words refreshed), verified %llu; stage inserts with data positions %llu (%.1f positions each)\n", count(counters.stageDataHits), count(counters.stageDataWords), count(counters.stageDataVerified), count(counters.stageDataInserts), counters.stageDataInserts != 0 ? static_cast<double>(counters.stageDataPositions) / static_cast<double>(counters.stageDataInserts) : 0.0);
     return text;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp
index c13d57f4a8..a6f6b5ebd9 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
@@ -11,10 +12,55 @@
 #include <span>
 #include <sstream>
 #include <stdexcept>
+#include <exception>
+#include <typeinfo>
 
 namespace AgcDriver::DriverDetail {
 
-std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics) try {
+namespace {
+
+void TraceMaterializationFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, std::size_t stage, const char* phase, const std::exception_ptr& failure) {
+    if (token == 0) return;
+    const char* type = "unknown";
+    std::string reason = "unknown exception";
+    try {
+        if (failure != nullptr) std::rethrow_exception(failure);
+    } catch (const std::exception& error) {
+        type = typeid(error).name();
+        reason = error.what();
+    } catch (...) {
+    }
+    try {
+        AgcDriver::CaptureTrace::Log("draw-materialization-failed token=%llu submission=%llu queue=%x offset=%zu stage=%zu phase=%s exception=%s reason=%.256s",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset, stage, phase, type, reason.c_str());
+    } catch (...) {
+    }
+}
+
+void TraceShaderRequestFailure(std::uint64_t token, const Submission& submission, std::size_t packetOffset, const DrawProgram& program, const std::exception_ptr& failure) noexcept {
+    if (token == 0) return;
+    try {
+        std::string reason = "unknown exception";
+        const char* type = "unknown";
+        try {
+            if (failure != nullptr) std::rethrow_exception(failure);
+        } catch (const std::exception& error) {
+            type = typeid(error).name();
+            reason = error.what();
+        } catch (...) {
+        }
+        AgcDriver::CaptureTrace::LogBestEffort("draw-shader-request-failed token=%llu submission=%llu queue=%x offset=%zu snapshot=0x%llx code=%llx codeOffset=%zu stage=%u type=%u reason=%.256s",
+                static_cast<unsigned long long>(token), static_cast<unsigned long long>(submission.serial), submission.queue, packetOffset,
+                static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(program.snapshot.get())),
+                static_cast<unsigned long long>(program.snapshot->codeAddress), program.codeOffset,
+                static_cast<unsigned>(program.binary.stage), static_cast<unsigned>(program.snapshot->type), reason.c_str());
+    } catch (...) {
+    }
+}
+
+}
+
+std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDrawStage(std::size_t i, std::uint32_t pushOffset, const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::uint64_t traceToken, const std::vector<DrawProgram>& programs, const Graphics::State& graphics, const ShaderRecompiler::ShaderPixelStageInfo& pixel, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, std::vector<ShaderRecompiler::MemoryRegion>& memory, const std::vector<ShaderRecompiler::LinkedProgram>& linked, const Pm4::DrawParameters& drawParameters, const std::shared_ptr<VulkanDevice>& localDevice, ShaderMemory& shaderMemory, std::vector<StageCapture>& stageCaptures, std::vector<bool>& recompiled, bool drawHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<std::vector<ShaderRecompiler::MemoryRegion>>& matchedRegions, bool profile, std::uint64_t dumpTarget, std::uint64_t dumpSlot1, std::uint64_t& captures, DrawPhaseTiming& phaseTiming, std::array<double, DrawDriverPhaseCount>& phaseMs, std::string& rejected, const std::optional<ShaderRecompiler::MeshBarycentricLayout>& meshBarycentrics) try {
     PerformanceTimer timing("Shader.DrawStage");
     using Stage = ShaderRecompiler::ShaderStage;
     phaseTiming.Phase(DrawRowVectors);
@@ -28,7 +74,14 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
         ShaderRecompiler::GraphicsCompileContext{program.firstUserSgpr, linked, graphics.stages.mesh, graphics.stages.tessellation, {drawParameters.indexAddress, drawParameters.indexCount, drawParameters.indexSize, drawParameters.instanceCount}, program.binary.stage == Stage::Mesh ? meshBarycentrics : std::nullopt}
     };
     const auto waitedBefore = traceCapSync() || profile ? Graphics::Recorder::ThreadWaitedMs() : 0.0;
-    auto invocation = InvocationFor(*program.snapshot, program.codeOffset, request);
+    auto invocation = [&] {
+        try {
+            return InvocationFor(*program.snapshot, program.codeOffset, request);
+        } catch (...) {
+            TraceShaderRequestFailure(traceToken, submission, packetOffset, program, std::current_exception());
+            throw;
+        }
+    }();
     timing.Mark("prepared_invocation");
     auto& stageCapture = stageCaptures[i];
     stageCapture.forgetSerial = GuestMemory::ForgetSerial();
@@ -73,16 +126,16 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
         ++captures;
         phaseTiming.Phase(DrawRowCapture);
 
-        const auto waited = std::min(Graphics::Recorder::ThreadWaitedMs() - waitedBefore, phaseMs[DrawRowCapture]);
-        phaseMs[DrawRowCapture] -= waited;
-        phaseMs[DrawRowCaptureHookWaits] += waited;
-    }
-    if (dumpTarget != 0) {
+            const auto waited = std::min(Graphics::Recorder::ThreadWaitedMs() - waitedBefore, phaseMs[DrawRowCapture]);
+            phaseMs[DrawRowCapture] -= waited;
+            phaseMs[DrawRowCaptureHookWaits] += waited;
+        }
+        if (dumpTarget != 0) {
 
         const auto slot0 = (static_cast<std::uint64_t>(readRegister(queue.context, 0x390)) << 40u) | (static_cast<std::uint64_t>(readRegister(queue.context, 0x318)) << 8u);
         if ((graphics.hasColorTarget && graphics.color.address == dumpTarget) || slot0 == dumpTarget) static_cast<void>(dumpRequest(program.binary.codeAddress, request));
-    }
-    if (dumpSlot1 != 0) {
+        }
+        if (dumpSlot1 != 0) {
         const auto value = [&](std::uint32_t offset) -> std::uint64_t { const auto it = queue.context.find(offset); return it == queue.context.end() ? 0u : it->second; };
         const auto slot1 = (value(0x391) << 40u) | (value(0x327) << 8u);
         if (slot1 == dumpSlot1) {
@@ -94,17 +147,18 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
                 std::fclose(file);
             }
         }
-    }
+        }
 
-    phaseTiming.Phase(DrawRowCapture);
+        phaseTiming.Phase(DrawRowCapture);
 
     timing.Mark("capture_resources");
     try {
         stageCapture.compiled = invocation.Materialize(*capture);
+        stageCapture.capture = capture;
     } catch (const std::exception& error) {
+        TraceMaterializationFailure(traceToken, submission, packetOffset, i, "capture-or-materialize", std::current_exception());
         throw named(error, request.context.memory);
     }
-    stageCapture.capture = capture;
     timing.Mark("materialize");
     const auto walked = capture->userDataUse.asValue | capture->userDataUse.asBase;
     auto mask = walked == 0 ? ~std::uint64_t{0} : walked | stageCapture.compiled->userDataRegisterReads;
@@ -152,8 +206,11 @@ void Driver::recordStageDataPositions(DispatchVariant& variant, const ShaderReco
     variant.dataSlots.resize(kept);
 }
 
-void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey) {
-    if (useDrawEntries && !drawHit && !(drawParameters.indirect && indirectCpu) && (verifyHit || admitDrawKey(drawKey, registerKey && drawDataHits() ? shapeKey : 0))) {
+void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawParameters& drawParameters, const std::optional<Graphics::IndirectDrawPath>& indirectCpu, const std::vector<DrawProgram>& programs, const std::vector<StageCapture>& stageCaptures, const std::vector<std::optional<ShaderRecompiler::ShaderVertexStageInfo>>& vertexInfos, const std::vector<std::vector<Graphics::DecodeRead>>& decodeReads, bool verifyHit, const std::vector<std::shared_ptr<DispatchVariant>>& matched, const std::vector<StageDataHit>& stageData, std::vector<std::shared_ptr<DispatchVariant>>& fresh, std::uint64_t drawKey, bool registerKey, const std::shared_ptr<const DrawDecode>& decode, DrawPhaseTiming& phaseTiming, const std::vector<bool>& reused, const std::shared_ptr<DrawEntry>& entry, std::uint64_t shapeKey, bool shapeNeedsEntry) {
+    const bool cacheable = useDrawEntries && !drawHit && !(drawParameters.indirect && indirectCpu);
+    const bool admitted = cacheable && (verifyHit || admitDrawKey(drawKey, registerKey && drawDataHits() ? shapeKey : 0));
+    const bool replaceShape = cacheable && !admitted && shapeNeedsEntry;
+    if (admitted || replaceShape) {
         phaseTiming.Phase(DrawRowVectors);
         std::uint64_t unstable = 0, mismatches = 0, differingSameRuns = 0, differingWords = 0, differingRunsChanged = 0;
         for (std::size_t i = 0; i < programs.size(); ++i) {
@@ -189,17 +246,17 @@ void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawP
                     ++differingRunsChanged;
                 }
             }
-            const auto sameContent = [](const DispatchVariant& a, const DispatchVariant& b) {
-                const auto flatten = [](const DispatchVariant& source) {
+            const auto sameContent = [](const DispatchVariant& a, const std::vector<std::uint32_t>& words, const DispatchVariant& b) {
+                const auto flatten = [](const DispatchVariant& source, const std::vector<std::uint32_t>& values) {
                     std::vector<std::pair<std::uint64_t, std::uint32_t>> flat;
                     std::size_t word = 0;
                     for (const auto& [begin, end] : source.runs) {
-                        for (auto address = begin; address < end && word < source.words.size(); address += sizeof(std::uint32_t)) flat.emplace_back(address, source.words[word++]);
+                        for (auto address = begin; address < end && word < values.size(); address += sizeof(std::uint32_t)) flat.emplace_back(address, values[word++]);
                     }
                     std::sort(flat.begin(), flat.end());
                     return flat;
                 };
-                return (a.runs == b.runs && a.words == b.words) || flatten(a) == flatten(b);
+                return (a.runs == b.runs && words == b.words) || flatten(a, words) == flatten(b, b.words);
             };
             const auto sameForwardedWords = [](const ShaderRecompiler::RecompileResult& a, const ShaderRecompiler::RecompileResult& b, std::uint32_t hidden) {
                 if (a.pushConstants.size() != b.pushConstants.size() || a.shaderDataUserWords != b.shaderDataUserWords) return false;
@@ -208,10 +265,14 @@ void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawP
                 }
                 return true;
             };
-            if (verifyHit && matched[i] != nullptr && (!sameContent(*matched[i], *variant) || !sameForwardedWords(*matched[i]->compiled, *variant->compiled, programs[i].hiddenUserWords))) {
-                ++mismatches;
-                static std::atomic<std::uint64_t> reports{0};
-                if (reports.fetch_add(1) < 20) std::fprintf(stderr, "[draw-cache] verify: stage %zu (program 0x%llx) of a hit captured differently: %zu runs / %zu words matched, %zu / %zu fresh\n", i, static_cast<unsigned long long>(programs[i].binary.codeAddress), matched[i]->runs.size(), matched[i]->words.size(), variant->runs.size(), variant->words.size());
+            if (verifyHit && matched[i] != nullptr) {
+                const auto& words = stageData[i].compiled != nullptr ? stageData[i].words : matched[i]->words;
+                const auto& compiled = stageData[i].compiled != nullptr ? *stageData[i].compiled : *matched[i]->compiled;
+                if (!sameContent(*matched[i], words, *variant) || !sameForwardedWords(compiled, *variant->compiled, programs[i].hiddenUserWords)) {
+                    ++mismatches;
+                    static std::atomic<std::uint64_t> reports{0};
+                    if (reports.fetch_add(1) < 20) std::fprintf(stderr, "[draw-cache] verify: stage %zu (program 0x%llx) of a hit captured differently: %zu runs / %zu words matched, %zu / %zu fresh\n", i, static_cast<unsigned long long>(programs[i].binary.codeAddress), matched[i]->runs.size(), words.size(), variant->runs.size(), variant->words.size());
+                }
             }
             if (insertCompare()) {
                 const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::DrawCache);
@@ -222,7 +283,7 @@ void Driver::cacheDrawStages(bool useDrawEntries, bool drawHit, const Pm4::DrawP
             }
             fresh[i] = std::move(variant);
         }
-        insertDrawEntry(drawKey, fresh, registerKey ? decode : nullptr, registerKey && drawDataHits() ? shapeKey : 0);
+        insertDrawEntry(drawKey, fresh, registerKey ? decode : nullptr, registerKey && drawDataHits() ? shapeKey : 0, replaceShape);
         std::uint64_t dataInserts = 0, dataPositions = 0;
         for (std::size_t i = 0; i < programs.size(); ++i) {
             if (fresh[i] == nullptr || reused[i] || fresh[i]->dataPositions.empty()) continue;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp
index 8208e0805d..0672150150 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawDecode.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include <algorithm>
 #include <spirv/unified1/spirv.hpp>
@@ -30,6 +31,25 @@ void ReadUserWords(const QueueState& queue, DrawProgram& program, bool staticAbi
     if ((program.binary.stage == ShaderRecompiler::ShaderStage::Vertex || program.binary.stage == ShaderRecompiler::ShaderStage::Fragment) && program.snapshot->header.empty() && program.snapshot->userDataTailRegister) program.tailContinuation = ReadUserDataTailContinuation(program.binary.code, program.firstUserSgpr, program.userData);
 }
 
+ShaderRecompiler::ShaderVertexStageInfo DecodeOrderedVertexStageInfo(std::span<const std::byte> header, std::uint64_t headerAddress, std::span<const std::uint32_t> userData, std::vector<Graphics::DecodeRead>& reads, std::uint32_t hiddenUserWords) {
+    const auto decode = [&] {
+        reads.clear();
+        return Graphics::DecodeVertexStageInfo(header, headerAddress, userData, &reads, false, hiddenUserWords);
+    };
+    if (!DrawPipeline::Active()) return decode();
+    auto& queue = DrawPipeline::Queue0();
+    const auto watch = queue.WatchWrites();
+    auto info = decode();
+    if (watch.items == 0 && !queue.Busy() && queue.Retired() == watch.retired) return info;
+    std::vector<DrawPipeline::Range> ranges;
+    ranges.reserve(reads.size());
+    for (const auto& read : reads) ranges.emplace_back(read.address, read.address + read.size);
+    if (!queue.WrittenSince(watch, ranges)) return info;
+    queue.NoteDecodeDrain();
+    queue.Drain(DrawPipeline::DrainReason::Capture);
+    return decode();
+}
+
 void InitializeMerged(const QueueState& queue, DrawProgram& program, std::uint32_t pointerBase, bool pointerRequired, bool staticAbi) {
     program.merged = true;
     program.mergedPointer = pointerBase;
@@ -159,12 +179,14 @@ std::shared_ptr<DrawDecode> Driver::decodeDraw(const QueueState& queue, const Su
     auto product = std::make_shared<DrawDecode>();
     product->state = Graphics::DecodeState(queue, VertexWorkgroupRequired(queue, *submission.shaders));
     DecodeGraphicsPrograms(*product, queue, *submission.shaders, false, true);
+    product->state.depthCopySource = std::ranges::any_of(product->programs, [](const DrawProgram& program) { return program.binary.codeAddress == DepthCopyPixelProgramAddress(true); });
     product->pixel = Graphics::DecodePixelStageInfo(queue.context, Graphics::ExportMappings(product->state), Graphics::PixelProgramSkipped(queue));
     Graphics::NormalizeUnusedViewportDepth(product->state, product->pixel);
     Graphics::ApplyDepthRemap(context, product->state);
     product->pixel.targetExportPacking = Graphics::ExportPackings(product->state);
     product->pixel.dualSourceBlend = product->state.dualSourceBlend;
     product->pixel.reversedBlend = product->state.reversedBlend;
+    product->pixel.targetMerge = Graphics::ExportTargetMerge(product->state);
     product->pixel.alphaToCoverage = product->state.alphaToCoverage;
     product->pixel.quadPixelMask = Graphics::QuadPixelMask(product->state);
     if (product->state.sampleLocationGrid) {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp
index 6bfa9b1fb4..ec65e9734e 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawLookup.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include <algorithm>
+#include <bit>
 
 namespace AgcDriver::DriverDetail {
 
@@ -51,6 +52,10 @@ void Driver::lookupDraw(const Submission& submission, const std::shared_ptr<Vulk
                 mix(vertex.fetchBufferReg);
                 mix(vertex.fetchEmbedded);
                 mix(vertex.paClVsOutCntl);
+                mix(vertex.pointList);
+                mix(std::bit_cast<std::uint32_t>(vertex.pointSize));
+                mix(std::bit_cast<std::uint32_t>(vertex.pointSizeMin));
+                mix(std::bit_cast<std::uint32_t>(vertex.pointSizeMax));
                 for (std::uint32_t r = 0; r < vertex.resourcesNum; ++r) {
                     for (const auto field : vertex.resources[r].fields) mix(field);
                     const auto& destination = vertex.resourcesDst[r];
@@ -74,6 +79,12 @@ void Driver::lookupDraw(const Submission& submission, const std::shared_ptr<Vulk
             for (const auto value : pixel.targetExportPacking) mix(static_cast<std::uint64_t>(value));
             mix(pixel.dualSourceBlend);
             mix(pixel.reversedBlend);
+            mix(pixel.targetMerge.target);
+            mix(pixel.targetMerge.mask);
+            mix(pixel.targetMerge.samples);
+            for (const auto word : pixel.targetMerge.descriptor) mix(word);
+            mix(pixel.targetMerge.depthStencilWrites);
+            mix(pixel.targetMerge.depthStencilTests);
             mix(pixel.alphaToCoverage);
             mix(static_cast<std::uint64_t>(pixel.rasterPrimitive));
             mix(pixel.ditheredAlphaToCoverage);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp
index 9ba7b4a1db..a1a5ebaab1 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp
@@ -3,8 +3,13 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/HandoffSpin.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/WorkerSampler.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
 #include <algorithm>
+#include <array>
+#include <limits>
+#include <string>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
@@ -29,6 +34,212 @@ std::atomic<std::uint64_t> heldReadHits{0};
 
 }
 
+namespace {
+thread_local bool finisherThread = false;
+thread_local bool finisherProducer = false;
+}
+
+DrawFinisher& DrawFinisher::Get() {
+    static DrawFinisher* finisher = new DrawFinisher();
+    return *finisher;
+}
+
+bool DrawFinisher::Enabled() {
+    return Graphics::DrawPipelineEnabled();
+}
+
+bool DrawPipeline::MetadataPassesPipelined() {
+    return Graphics::DrawPipelineEnabled();
+}
+
+namespace {
+std::atomic<std::uint64_t> pipelinedMetadataPasses{0};
+}
+
+std::uint64_t DrawPipeline::PipelinedMetadataPasses() {
+    return pipelinedMetadataPasses.load(std::memory_order_relaxed);
+}
+
+void DrawPipeline::CountPipelinedMetadataPass() {
+    pipelinedMetadataPasses.fetch_add(1, std::memory_order_relaxed);
+}
+
+bool DrawFinisher::Overlap() {
+    return Graphics::DrawPipelineEnabled();
+}
+
+bool DrawFinisher::PendingOverlaps(std::uint64_t begin, std::uint64_t end) {
+    if (!Busy() || !finisherProducer) return false;
+    std::lock_guard lock(mutex);
+    for (const auto& held : pending) {
+        if (held.unknown) return true;
+        for (const auto& [first, last] : held.writes) {
+            if (begin < last && first < end) return true;
+        }
+    }
+    return false;
+}
+
+DrawFinisher::LabelLookup DrawFinisher::PendingLabel(std::uint64_t address, std::size_t bytes, std::uint64_t& value) {
+    if (!Busy() || !finisherProducer) return LabelLookup::NotHeld;
+    const auto end = address + bytes;
+    std::lock_guard lock(mutex);
+    for (auto held = pending.rbegin(); held != pending.rend(); ++held) {
+        if (held->unknown) return LabelLookup::Unknown;
+        const bool overlaps = std::any_of(held->writes.begin(), held->writes.end(), [&](const Range& range) { return address < range.second && range.first < end; });
+        if (!overlaps) continue;
+        if (held->labelBytes.empty() || address < held->labelAddress || end > held->labelAddress + held->labelBytes.size()) return LabelLookup::Unknown;
+        value = 0;
+        std::memcpy(&value, held->labelBytes.data() + (address - held->labelAddress), bytes);
+        return LabelLookup::Value;
+    }
+    return LabelLookup::NotHeld;
+}
+
+bool DrawFinisher::PendingOverlapsAny(std::span<const Range> ranges) {
+    if (!Busy() || !finisherProducer) return false;
+    std::lock_guard lock(mutex);
+    for (const auto& held : pending) {
+        if (held.unknown) return true;
+        for (const auto& [first, last] : held.writes) {
+            for (const auto& [begin, end] : ranges) {
+                if (begin < last && first < end) return true;
+            }
+        }
+    }
+    return false;
+}
+
+bool DrawFinisher::PendingKey(std::uint64_t key, std::uint64_t shape) {
+    if (!Busy() || !finisherProducer) return false;
+    std::lock_guard lock(mutex);
+    return std::any_of(pending.begin(), pending.end(), [&](const Pending& held) { return held.key == key || (shape != 0 && held.shape == shape); });
+}
+
+namespace {
+std::array<std::atomic<std::uint64_t>, static_cast<std::size_t>(DrawFinisher::DrainSite::Count)> finisherDrains{}, finisherSkips{};
+}
+
+void DrawFinisher::NoteDrain(DrainSite site, bool drained) {
+    (drained ? finisherDrains : finisherSkips)[static_cast<std::size_t>(site)].fetch_add(1, std::memory_order_relaxed);
+}
+
+namespace {
+std::array<std::atomic<std::uint64_t>, 257> drainedOpcodes{}, drainedBeside{};
+}
+
+void DrawFinisher::NoteDrainedOpcode(std::uint32_t opcode, bool besideCommits) {
+    drainedOpcodes[std::min<std::uint32_t>(opcode, 256u)].fetch_add(1, std::memory_order_relaxed);
+    if (besideCommits) drainedBeside[std::min<std::uint32_t>(opcode, 256u)].fetch_add(1, std::memory_order_relaxed);
+}
+
+std::string DrawFinisher::DrainText() {
+    constexpr std::array<const char*, static_cast<std::size_t>(DrainSite::Count)> names{"lookup", "reads", "packet", "kept draw"};
+    std::string text = "; worker drains of the finisher (drained/skipped):";
+    for (std::size_t i = 0; i < names.size(); ++i) {
+        char item[64];
+        std::snprintf(item, sizeof(item), " %s %llu/%llu", names[i], static_cast<unsigned long long>(finisherDrains[i].exchange(0)), static_cast<unsigned long long>(finisherSkips[i].exchange(0)));
+        text += item;
+    }
+    text += "; drained by opcode (of them beside commits):";
+    for (int shown = 0; shown < 6; ++shown) {
+        std::size_t top = 0;
+        for (std::size_t i = 1; i < drainedOpcodes.size(); ++i) {
+            if (drainedOpcodes[i].load() > drainedOpcodes[top].load()) top = i;
+        }
+        const auto count = drainedOpcodes[top].exchange(0);
+        if (count == 0) break;
+        char item[48];
+        std::snprintf(item, sizeof(item), " 0x%02zx x%llu (%llu)", top, static_cast<unsigned long long>(count), static_cast<unsigned long long>(drainedBeside[top].exchange(0)));
+        text += item;
+    }
+    return text;
+}
+
+bool DrawFinisher::OnFinisherThread() {
+    return finisherThread;
+}
+
+void DrawFinisher::Enqueue(Job job) {
+    Enqueue(std::move(job), Pending{});
+}
+
+void DrawFinisher::Enqueue(Job job, Pending held) {
+    finisherProducer = true;
+    constexpr std::size_t depth = 16;
+    struct ReclaimStorage {};
+    auto& reclaim = HostThreadLocal<std::vector<Job>, ReclaimStorage>();
+    reclaim.clear();
+    std::unique_lock lock(mutex);
+    if (!ran.empty()) std::swap(ran, reclaim);
+    if (failure != nullptr) std::rethrow_exception(std::exchange(failure, nullptr));
+    if (jobs.size() >= depth && GuestMemory::GpuMutex().HeldByThisThread()) throw std::runtime_error("draw finisher full while the enqueuing thread holds the GPU lock");
+    idle.wait(lock, [&] { return jobs.size() < depth; });
+    jobs.push_back(std::move(job));
+    pending.push_back(std::move(held));
+    outstanding.fetch_add(1, std::memory_order_release);
+    if (!running) {
+        running = true;
+        thread = std::thread([this] {
+            finisherThread = true;
+            run();
+        });
+    }
+    if (sleeping) wake.notify_one();
+}
+
+void DrawFinisher::run() {
+    PerformanceTrace::BindThread("draw finisher");
+    for (;;) {
+        Job* job = nullptr;
+        bool failed = false;
+        SpinUntil(HandoffSpinWindow(), [&] { return outstanding.load(std::memory_order_acquire) != 0; });
+        {
+            std::unique_lock lock(mutex);
+            sleeping = true;
+            wake.wait(lock, [&] { return !jobs.empty(); });
+            sleeping = false;
+            job = &jobs.front();
+            failed = failure != nullptr;
+        }
+        std::exception_ptr error;
+        try {
+            if (!failed) (*job)();
+        } catch (...) {
+            error = std::current_exception();
+        }
+        std::lock_guard lock(mutex);
+        if (error != nullptr && failure == nullptr) failure = error;
+        ran.push_back(std::move(jobs.front()));
+        jobs.pop_front();
+        pending.pop_front();
+        outstanding.fetch_sub(1, std::memory_order_release);
+        idle.notify_all();
+    }
+}
+
+void DrawFinisher::Settle() {
+    if (!Busy() || OnFinisherThread()) return;
+    if (GuestMemory::GpuMutex().HeldByThisThread()) throw std::runtime_error("draw finisher settle under the GPU lock");
+    std::unique_lock lock(mutex);
+    idle.wait(lock, [&] { return jobs.empty(); });
+}
+
+void DrawFinisher::Drain() {
+    if (OnFinisherThread()) return;
+    if (Busy() && GuestMemory::GpuMutex().HeldByThisThread()) throw std::runtime_error("draw finisher drain under the GPU lock");
+    SpinUntil(HandoffSpinWindow() * 2, [&] { return outstanding.load(std::memory_order_acquire) == 0; });
+    std::unique_lock lock(mutex);
+    if (!jobs.empty()) idle.wait(lock, [&] { return jobs.empty(); });
+    if (failure != nullptr) std::rethrow_exception(std::exchange(failure, nullptr));
+}
+
+void DrawFinisher::ReleaseRan() {
+    std::vector<Job> done;
+    std::lock_guard lock(mutex);
+    std::swap(done, ran);
+}
+
 DrawPipeline& DrawPipeline::Queue0() {
     static DrawPipeline* pipeline = new DrawPipeline();
     return *pipeline;
@@ -78,9 +289,16 @@ void DrawPipeline::rethrowFailure() {
     std::rethrow_exception(error);
 }
 
-void DrawPipeline::Enqueue(Commit commit, std::vector<Range> writes, std::uint64_t labelAddress, std::vector<std::byte> labelBytes, std::vector<Range> reads) {
+void DrawPipeline::Enqueue(Commit commit, std::vector<Range> writes, std::uint64_t labelAddress, std::vector<std::byte> labelBytes, std::vector<Range> reads, bool draw) {
+    if (DrawFinisher::Busy() && !DrawFinisher::OnFinisherThread()) DrawFinisher::Get().Drain();
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    struct ReclaimStorage {};
+    auto& reclaim = HostThreadLocal<std::vector<Item>, ReclaimStorage>();
+    reclaim.clear();
+    const auto lockStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
     std::unique_lock lock(mutex);
+    if (!retired.empty()) std::swap(retired, reclaim);
+    if (profile) lockWaitNs += elapsedNs(lockStart);
     rethrowFailure();
     if (closing) {
         lock.unlock();
@@ -90,23 +308,33 @@ void DrawPipeline::Enqueue(Commit commit, std::vector<Range> writes, std::uint64
     if (items.size() >= Depth()) {
         if (GuestMemory::GpuMutex().HeldByThisThread()) throw std::runtime_error("draw pipeline full while the enqueuing thread holds the GPU lock");
         const auto start = std::chrono::steady_clock::now();
+        resumeAt = Depth() - 1;
         ++idleWaiters;
-        idle.wait(lock, [&] { return items.size() < Depth(); });
+        idle.wait(lock, [&] { return items.size() <= resumeAt; });
         --idleWaiters;
+        resumeAt = 0;
         fullWaitNs += elapsedNs(start);
         rethrowFailure();
     }
     depthSum += items.size();
     ++enqueued;
     heldReadRanges.fetch_add(reads.size(), std::memory_order_relaxed);
-    items.push_back({std::move(commit), std::move(writes), labelAddress, std::move(labelBytes), std::move(reads)});
+    countWrites(writes, true);
+    items.push_back({std::move(commit), std::move(writes), labelAddress, std::move(labelBytes), std::move(reads), draw});
     outstanding.fetch_add(1, std::memory_order_release);
     if (!thread.joinable()) {
-        thread = std::thread([this] { run(); });
+        thread = std::thread([this] {
+            GuestMemory::MarkProofThread();
+            run();
+        });
         runningCommitters.fetch_add(1, std::memory_order_acq_rel);
     }
-    if (committerWaiting) wake.notify_one();
-    if (!profile) return;
+    if (committerWaiting) {
+        ++wakes;
+        wake.notify_one();
+    }
+    static const bool stats = std::getenv("APS5_PIPELINE_STATS") != nullptr;
+    if (!profile && !stats) return;
     const auto now = std::chrono::steady_clock::now();
     if (now - lastReport >= std::chrono::seconds(10)) report(now);
 }
@@ -132,20 +360,24 @@ void DrawPipeline::report(std::chrono::steady_clock::time_point now) {
     const auto perCommit = commits == 0 ? 0.0 : static_cast<double>(commitNs) / 1e3 / static_cast<double>(commits);
     const auto perDraw = enqueued == 0 ? 0.0 : static_cast<double>(fullWaitNs) / 1e3 / static_cast<double>(enqueued);
     const auto queued = enqueued == 0 ? 0.0 : static_cast<double>(depthSum) / static_cast<double>(enqueued);
-    char reads[64];
-    std::snprintf(reads, sizeof(reads), " %llu read ranges, %llu stores held", static_cast<unsigned long long>(heldReadRanges.load(std::memory_order_relaxed)), static_cast<unsigned long long>(heldReadHits.exchange(0, std::memory_order_relaxed)));
+    const auto decodeDrainCount = decodeDrains.load(std::memory_order_relaxed);
+    char reads[96];
+    std::snprintf(reads, sizeof(reads), " %llu read ranges, %llu stores held, %llu decode drains", static_cast<unsigned long long>(heldReadRanges.load(std::memory_order_relaxed)), static_cast<unsigned long long>(heldReadHits.exchange(0, std::memory_order_relaxed)), static_cast<unsigned long long>(decodeDrainCount - reportedDecodeDrains));
+    reportedDecodeDrains = decodeDrainCount;
     drainText += reads;
-    std::fprintf(stderr, "[draw] pipelined (10 s, depth %zu): %llu commits at %.1f us each on the committer, %llu failed; %llu enqueued behind %.2f on average, waiting %.1f us per draw for room;%s; drains:%s\n", Depth(), static_cast<unsigned long long>(commits), perCommit, static_cast<unsigned long long>(commitErrors), static_cast<unsigned long long>(enqueued), queued, perDraw, reads, drainText.c_str());
-    commits = commitNs = commitErrors = enqueued = fullWaitNs = depthSum = 0;
+    AgcDriver::ProfilePrint_nid_no_patch("[draw] pipelined (10 s, depth %zu): %llu commits at %.1f us each on the committer, %llu failed; %llu enqueued behind %.2f on average, waiting %.1f us per draw for room, %.2f us for the lock; %llu committer wakes;%s; drains:%s\n", Depth(), static_cast<unsigned long long>(commits), perCommit, static_cast<unsigned long long>(commitErrors), static_cast<unsigned long long>(enqueued), queued, perDraw, enqueued == 0 ? 0.0 : static_cast<double>(lockWaitNs) / 1e3 / static_cast<double>(enqueued), static_cast<unsigned long long>(wakes), reads, drainText.c_str());
+    commits = commitNs = commitErrors = enqueued = fullWaitNs = depthSum = wakes = lockWaitNs = 0;
     drains = {};
     drainWaitNs = {};
 }
 
+
 void DrawPipeline::run() {
     PerformanceTrace::BindThread("draw committer");
     StartCommitterSampler();
     for (;;) {
         Commit* commit = nullptr;
+        bool isDraw = false;
         SpinUntil(HandoffSpinWindow(), [&] { return outstanding.load(std::memory_order_acquire) != 0; });
         {
             std::unique_lock lock(mutex);
@@ -154,6 +386,7 @@ void DrawPipeline::run() {
             committerWaiting = false;
             if (items.empty()) break;
             commit = stopped ? nullptr : &items.front().commit;
+            isDraw = items.front().draw;
         }
         const auto start = std::chrono::steady_clock::now();
         std::exception_ptr fatal;
@@ -161,6 +394,7 @@ void DrawPipeline::run() {
         bool shutdown = false;
         try {
             if (commit != nullptr) (*commit)();
+            if (!isDraw) GuestMemory::BreakProofs();
         } catch (const std::exception&) {
             failed = true;
             fatal = std::current_exception();
@@ -176,13 +410,16 @@ void DrawPipeline::run() {
             if (!shutdown) Driver::Get().ReportFailure(fatal);
         }
         std::lock_guard lock(mutex);
+        countWrites(items.front().writes, false);
+        retired.push_back(std::move(items.front()));
         items.pop_front();
+        retiredItems.fetch_add(1, std::memory_order_release);
         ++commits;
         commitNs += spent;
         if (failed) ++commitErrors;
         if (fatal != nullptr && failure == nullptr) failure = fatal;
         outstanding.fetch_sub(1, std::memory_order_release);
-        if (idleWaiters != 0) idle.notify_all();
+        if (idleWaiters != 0 && (items.empty() || items.size() <= resumeAt)) idle.notify_all();
     }
     runningCommitters.fetch_sub(1, std::memory_order_acq_rel);
 }
@@ -200,10 +437,18 @@ void DrawPipeline::Stop() {
     else committer.join();
 }
 
+void DrawPipeline::ReleaseRetired() {
+    std::vector<Item> done;
+    std::lock_guard lock(mutex);
+    std::swap(done, retired);
+}
+
 void DrawPipeline::Drain(DrainReason reason, std::uint32_t opcode) {
     drainRequests[std::min<std::uint32_t>(opcode, 0x100)].fetch_add(1, std::memory_order_relaxed);
+    const bool finisherBusy = DrawFinisher::Busy() && !DrawFinisher::OnFinisherThread();
+    if ((finisherBusy || Busy()) && GuestMemory::GpuMutex().HeldByThisThread()) throw std::runtime_error("draw pipeline drain under the GPU lock (reason " + std::to_string(static_cast<unsigned>(reason)) + ", opcode " + std::to_string(opcode) + ")");
+    if (finisherBusy) DrawFinisher::Get().Drain();
     if (!Busy()) return;
-    if (GuestMemory::GpuMutex().HeldByThisThread()) throw std::runtime_error("draw pipeline drain under the GPU lock (reason " + std::to_string(static_cast<unsigned>(reason)) + ", opcode " + std::to_string(opcode) + ")");
     const auto start = std::chrono::steady_clock::now();
     SpinUntil(HandoffSpinWindow() * 2, [&] { return !Busy(); });
     std::unique_lock lock(mutex);
@@ -244,6 +489,12 @@ void DrawPipeline::ReleaseRunningReads() {
 
 std::optional<std::uint64_t> DrawPipeline::PendingLabel(std::uint64_t address, std::size_t bytes) {
     if (bytes == 0 || bytes > 8) return std::nullopt;
+    if (DrawFinisher::Overlap()) {
+        std::uint64_t held = 0;
+        const auto lookup = DrawFinisher::Get().PendingLabel(address, bytes, held);
+        if (lookup == DrawFinisher::LabelLookup::Value) return held;
+        if (lookup == DrawFinisher::LabelLookup::Unknown) return std::nullopt;
+    }
     const auto end = address + bytes;
     std::lock_guard lock(mutex);
     for (auto item = items.rbegin(); item != items.rend(); ++item) {
@@ -257,15 +508,64 @@ std::optional<std::uint64_t> DrawPipeline::PendingLabel(std::uint64_t address, s
     return std::nullopt;
 }
 
-bool DrawPipeline::Overlaps(std::uint64_t address, std::size_t bytes) {
-    const auto end = address + bytes;
+void DrawPipeline::countWrites(const std::vector<Range>& writes, bool added) {
+    for (const auto& range : writes) {
+        const auto found = std::find_if(queuedWrites.begin(), queuedWrites.end(), [&](const auto& entry) { return entry.first == range; });
+        if (added) {
+            if (found != queuedWrites.end()) ++found->second;
+            else queuedWrites.emplace_back(range, 1u);
+        } else if (found != queuedWrites.end() && --found->second == 0) {
+            *found = queuedWrites.back();
+            queuedWrites.pop_back();
+        }
+    }
+}
+
+DrawPipeline::Watch DrawPipeline::WatchWrites() {
+    if (!Busy()) return {Retired(), 0, {}};
     std::lock_guard lock(mutex);
-    for (const auto& item : items) {
-        for (const auto& [begin, limit] : item.writes) {
-            if (address < limit && begin < end) return true;
+    Watch watch{retiredItems.load(std::memory_order_relaxed), items.size(), {}};
+    for (const auto& item : items) watch.writes.insert(watch.writes.end(), item.writes.begin(), item.writes.end());
+    return watch;
+}
+
+bool DrawPipeline::WrittenSince(const Watch& watch, const std::vector<Range>& reads) {
+    const auto overlaps = [&reads](const std::vector<Range>& writes) {
+        return std::any_of(reads.begin(), reads.end(), [&writes](const Range& read) {
+            return std::any_of(writes.begin(), writes.end(), [&read](const Range& write) { return read.first < write.second && write.first < read.second; });
+        });
+    };
+    if (DrawFinisher::Overlap() && DrawFinisher::Get().PendingOverlapsAny(reads)) return true;
+    std::lock_guard lock(mutex);
+    if (std::any_of(items.begin(), items.end(), [&](const Item& item) { return overlaps(item.writes); })) return true;
+    const auto retiredNow = retiredItems.load(std::memory_order_relaxed);
+    if (retiredNow == watch.retired) return false;
+    return retiredNow - watch.retired > watch.items || overlaps(watch.writes);
+}
+
+bool DrawPipeline::Busy() const {
+    return outstanding.load(std::memory_order_acquire) != 0 || (finisherProducer && DrawFinisher::Busy() && DrawFinisher::Overlap());
+}
+
+bool DrawPipeline::OverlapsAny(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
+    if (DrawFinisher::Overlap() && DrawFinisher::Get().PendingOverlapsAny(ranges)) return true;
+    std::lock_guard lock(mutex);
+    for (const auto& [range, count] : queuedWrites) {
+        for (const auto& [address, end] : ranges) {
+            if (address < range.second && range.first < end) return true;
         }
     }
     return false;
 }
 
+bool DrawPipeline::Overlaps(std::uint64_t address, std::size_t bytes) {
+    const auto end = address + bytes;
+    if (DrawFinisher::Overlap() && DrawFinisher::Get().PendingOverlaps(address, end)) return true;
+    std::lock_guard lock(mutex);
+    for (const auto& [range, count] : queuedWrites) {
+        if (address < range.second && range.first < end) return true;
+    }
+    return false;
+}
+
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp
index 6311d6461f..033f0313a8 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp
@@ -1,21 +1,70 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/DeferredLabels.hpp"
 #include <cstdlib>
 
 namespace AgcDriver::DriverDetail {
 
+namespace {
+
+QueueState DepthCopyDraw(const QueueState& queue, const Graphics::DepthCopyPass& copy) {
+    const bool multisampled = copy.source.samples != 1u;
+    const auto address = DepthCopyPixelProgramAddress(multisampled);
+    const auto words = Graphics::DepthCopySourceWords(copy.source);
+    QueueState draw = queue;
+    draw.context.insert_or_assign(0x000u, 0u);
+    draw.shader.insert_or_assign(0x008u, static_cast<std::uint32_t>(address >> 8u));
+    draw.shader.insert_or_assign(0x009u, static_cast<std::uint32_t>(address >> 40u));
+    draw.shader.insert_or_assign(0x00au, 0u);
+    draw.shader.insert_or_assign(0x00bu, DepthCopyPixelUserWords(multisampled) << 1u);
+    for (std::uint32_t index = 0; index < words.size(); ++index) draw.shader.insert_or_assign(0x00cu + index, words[index]);
+    if (multisampled) draw.shader.insert_or_assign(0x014u, copy.sample);
+    draw.context.insert_or_assign(0x1b3u, 0x8002u);
+    draw.context.insert_or_assign(0x1b4u, 0x8002u);
+    draw.context.insert_or_assign(0x1b6u, 0u);
+    draw.context.insert_or_assign(0x1c4u, 0u);
+    draw.context.insert_or_assign(0x1c5u, 1u);
+    draw.context.insert_or_assign(0x08fu, 1u);
+    draw.context.insert_or_assign(0x203u, 0u);
+    if (const auto alpha = draw.context.find(0x2dcu); alpha != draw.context.end()) draw.context.insert_or_assign(0x2dcu, alpha->second & ~1u);
+    return draw;
+}
+
+}
+
 bool Driver::drawPrecheck() {
     static const bool precheck = std::getenv("APS5_NO_DRAW_PRECHECK") == nullptr;
     return precheck;
 }
 
-std::optional<DrawVerdict> Driver::precheckDraw(const QueueState& queue, const Submission& submission, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect) {
+std::optional<DrawVerdict> Driver::precheckDraw(const QueueState& queue, const Submission& submission, std::size_t packetOffset, std::span<const std::uint32_t> packet, const Pm4::DrawParameters& drawParameters, std::string& rejected, bool& traceIndirect) {
     if (!drawParameters.indirect && !drawParameters.indexed && (drawParameters.indexCount == 0 || drawParameters.instanceCount == 0)) return DrawVerdict::Nothing;
     if (const auto pass = Graphics::DecodeColorMetadataPass(queue)) {
         require(!drawParameters.indirect, "indirect CB metadata passes are unsupported");
+        if (DrawPipeline::Active() && DrawPipeline::MetadataPassesPipelined() && deferredLabels().labels.empty()) {
+            auto writes = Graphics::PipelinedColorMetadataPassWrites(*pass);
+            const auto localDevice = device.Load();
+            if (!writes.empty() && localDevice != nullptr) {
+                const auto queueId = submission.queue;
+                const auto opcode = (packet[0] >> 8u) & 0xffu;
+                DrawPipeline::Queue0().Enqueue([this, localDevice, queueId, opcode, pass = *pass] {
+                    GuestMemory::SetCurrentPacket(opcode, queueId);
+                    GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
+                    std::lock_guard gpuLock(GuestMemory::GpuMutex());
+                    auto current = device.Load();
+                    const auto& target = current != nullptr ? current : localDevice;
+                    recordLabelsForPacket(target.get(), queueId);
+                    target->ColorMetadataPass(pass);
+                }, std::move(writes));
+                DrawPipeline::CountPipelinedMetadataPass();
+                return DrawVerdict::Drawn;
+            }
+        }
         if (DrawPipeline::Active()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, (packet[0] >> 8u) & 0xffu);
         GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
         std::lock_guard gpuLock(GuestMemory::GpuMutex());
@@ -27,14 +76,8 @@ std::optional<DrawVerdict> Driver::precheckDraw(const QueueState& queue, const S
     }
     if (const auto copy = Graphics::DecodeDepthCopyPass(queue)) {
         require(!drawParameters.indirect, "indirect DB depth copies are unsupported");
-        if (DrawPipeline::Active()) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, (packet[0] >> 8u) & 0xffu);
-        GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::Draw);
-        std::lock_guard gpuLock(GuestMemory::GpuMutex());
-        if (device == nullptr) device = std::make_shared<VulkanDevice>();
-        const std::shared_ptr<VulkanDevice> localDevice = device;
-        recordLabelsForPacket(localDevice.get(), submission.queue);
-        localDevice->DepthCopyPass(*copy);
-        return DrawVerdict::Drawn;
+        auto copyDraw = DepthCopyDraw(queue, *copy);
+        return draw(copyDraw, packet, submission, packetOffset, rejected);
     }
     if (Graphics::DepthResummarizeDrawsNothing(queue)) return DrawVerdict::Nothing;
     rejected = Graphics::DepthMaintenanceRejection(queue);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp
index dd66e54ebf..7acaf98715 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp
@@ -213,7 +213,7 @@ void Driver::traceDrawKeyLookup(const std::array<std::uint64_t, 5>& components,
 }
 
 bool Driver::sameVertexInfo(const ShaderRecompiler::ShaderVertexStageInfo& a, const ShaderRecompiler::ShaderVertexStageInfo& b) {
-    if (a.resourcesNum != b.resourcesNum || a.fetchAttribReg != b.fetchAttribReg || a.fetchBufferReg != b.fetchBufferReg || a.fetchEmbedded != b.fetchEmbedded || a.paClVsOutCntl != b.paClVsOutCntl) return false;
+    if (a.resourcesNum != b.resourcesNum || a.fetchAttribReg != b.fetchAttribReg || a.fetchBufferReg != b.fetchBufferReg || a.fetchEmbedded != b.fetchEmbedded || a.paClVsOutCntl != b.paClVsOutCntl || a.pointList != b.pointList || a.pointSize != b.pointSize || a.pointSizeMin != b.pointSizeMin || a.pointSizeMax != b.pointSizeMax) return false;
     if (a.depthRemapMode != b.depthRemapMode) return false;
     for (std::uint32_t i = 0; i < a.resourcesNum && i < a.resources.size(); ++i) {
         if (a.resources[i].fields != b.resources[i].fields) return false;
@@ -228,7 +228,7 @@ bool Driver::sameDecode(const DrawDecode& a, const DrawDecode& b) {
     const auto& s = a.state;
     const auto& t = b.state;
     const auto sameColor = [](const Graphics::ColorTarget& x, const Graphics::ColorTarget& y) {
-        return x.address == y.address && x.extent.width == y.extent.width && x.extent.height == y.extent.height && x.format == y.format && x.bytes == y.bytes && x.componentMapping == y.componentMapping && x.tileMode == y.tileMode && x.elementBytes == y.elementBytes && x.dccAddress == y.dccAddress && x.dccAlphaOnMsb == y.dccAlphaOnMsb && x.slot == y.slot && x.exportIndex == y.exportIndex;
+        return x.address == y.address && x.extent.width == y.extent.width && x.extent.height == y.extent.height && x.format == y.format && x.bytes == y.bytes && x.componentMapping == y.componentMapping && x.tileMode == y.tileMode && x.elementBytes == y.elementBytes && x.dccAddress == y.dccAddress && x.dccAlphaOnMsb == y.dccAlphaOnMsb && x.slot == y.slot && x.exportIndex == y.exportIndex && x.partialWriteMask == y.partialWriteMask;
     };
     const auto sameBlend = [](const VkPipelineColorBlendAttachmentState& x, const VkPipelineColorBlendAttachmentState& y) {
         return x.blendEnable == y.blendEnable && x.srcColorBlendFactor == y.srcColorBlendFactor && x.dstColorBlendFactor == y.dstColorBlendFactor && x.colorBlendOp == y.colorBlendOp && x.srcAlphaBlendFactor == y.srcAlphaBlendFactor && x.dstAlphaBlendFactor == y.dstAlphaBlendFactor && x.alphaBlendOp == y.alphaBlendOp && x.colorWriteMask == y.colorWriteMask;
@@ -251,7 +251,7 @@ bool Driver::sameDecode(const DrawDecode& a, const DrawDecode& b) {
     for (std::size_t i = 0; i < s.blends.size(); ++i) {
         if (!sameBlend(s.blends[i], t.blends[i])) return false;
     }
-    if (s.hasColorTarget != t.hasColorTarget || s.rectList != t.rectList || s.renderExtent.width != t.renderExtent.width || s.renderExtent.height != t.renderExtent.height || s.topology != t.topology || s.negativeOneToOne != t.negativeOneToOne || s.depthClamp != t.depthClamp || s.conservativeRasterization != t.conservativeRasterization || s.perSampleShading != t.perSampleShading || s.cullMode != t.cullMode || s.polygonMode != t.polygonMode || s.frontFace != t.frontFace || !sameBlend(s.blend, t.blend) || s.blendConstants != t.blendConstants) return false;
+    if (s.colorRop != t.colorRop || s.hasColorTarget != t.hasColorTarget || s.rectList != t.rectList || s.renderExtent.width != t.renderExtent.width || s.renderExtent.height != t.renderExtent.height || s.topology != t.topology || s.negativeOneToOne != t.negativeOneToOne || s.depthClamp != t.depthClamp || s.conservativeRasterization != t.conservativeRasterization || s.perSampleShading != t.perSampleShading || s.cullMode != t.cullMode || s.polygonMode != t.polygonMode || s.frontFace != t.frontFace || !sameBlend(s.blend, t.blend) || s.blendConstants != t.blendConstants) return false;
     if (std::memcmp(&s.viewport, &t.viewport, sizeof(VkViewport)) != 0 || std::memcmp(&s.scissor, &t.scissor, sizeof(VkRect2D)) != 0) return false;
     const auto& p = a.pixel;
     const auto& q = b.pixel;
@@ -262,8 +262,8 @@ bool Driver::sameDecode(const DrawDecode& a, const DrawDecode& b) {
         const auto& y = b.programs[i];
         if (x.binary.stage != y.binary.stage || x.binary.codeAddress != y.binary.codeAddress || x.userDataBase != y.userDataBase || x.firstUserSgpr != y.firstUserSgpr || x.userData != y.userData || x.snapshot != y.snapshot || x.codeOffset != y.codeOffset || x.tailContinuation != y.tailContinuation) return false;
     }
-    if (p.targetExportPacking != q.targetExportPacking || p.dualSourceBlend != q.dualSourceBlend || p.reversedBlend != q.reversedBlend || p.alphaToCoverage != q.alphaToCoverage || p.rasterPrimitive != q.rasterPrimitive || p.ditheredAlphaToCoverage != q.ditheredAlphaToCoverage || p.quadPixelMask != q.quadPixelMask || p.quadSampleMask != q.quadSampleMask || p.iteratesSamples != q.iteratesSamples || p.positionLocation != q.positionLocation || p.sampleLocations != q.sampleLocations || p.sampleOrder != q.sampleOrder) return false;
-    if (s.samples != t.samples || s.mergedCoverage != t.mergedCoverage || s.quadSampleMask != t.quadSampleMask || s.pixelEarlyZ != t.pixelEarlyZ) return false;
+    if (p.targetExportPacking != q.targetExportPacking || p.dualSourceBlend != q.dualSourceBlend || p.reversedBlend != q.reversedBlend || p.targetMerge != q.targetMerge || p.alphaToCoverage != q.alphaToCoverage || p.rasterPrimitive != q.rasterPrimitive || p.ditheredAlphaToCoverage != q.ditheredAlphaToCoverage || p.quadPixelMask != q.quadPixelMask || p.quadSampleMask != q.quadSampleMask || p.iteratesSamples != q.iteratesSamples || p.positionLocation != q.positionLocation || p.sampleLocations != q.sampleLocations || p.sampleOrder != q.sampleOrder) return false;
+    if (s.samples != t.samples || s.mergedCoverage != t.mergedCoverage || s.truncatedCoverage != t.truncatedCoverage || s.quadSampleMask != t.quadSampleMask || s.pixelEarlyZ != t.pixelEarlyZ || s.pixelKill != t.pixelKill) return false;
     return true;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp
index 33665a380c..c03e05baea 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRelocate.cpp
@@ -173,15 +173,21 @@ void Driver::learnPendingRelocation() {
     }
     if (pending.alias == 0) return;
     if (drawAliases.size() >= MaxAliases) drawRelocationCounters.evicted += dropEveryOther(drawAliases);
-    drawAliases[pending.alias] = inserted->second;
+    drawAliases[pending.alias] = pending.key;
 }
 
 void Driver::relocateDrawEntry(const QueueState& queue, std::uint64_t alias, std::shared_ptr<DrawEntry>& entry, std::shared_ptr<const DrawDecode>& decode, std::vector<DrawUserPatch>& patches) {
     auto& counters = drawRelocationCounters;
     ++counters.lookups;
     const auto found = drawAliases.find(alias);
-    if (found == drawAliases.end() || found->second->decode == nullptr) return;
-    const auto donor = found->second;
+    if (found == drawAliases.end()) return;
+    const auto cached = drawCache.find(found->second);
+    if (cached == drawCache.end()) {
+        drawAliases.erase(found);
+        return;
+    }
+    if (cached->second->decode == nullptr) return;
+    const auto donor = cached->second;
     const auto& programs = donor->decode->programs;
     if (donor->stages.size() != programs.size()) return;
     struct Move {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp
index d3049765aa..fa1676e68c 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp
@@ -29,7 +29,8 @@ std::optional<Graphics::IndirectDrawPath> Driver::ClassifyIndirectDraw(const Sha
     using Path = Graphics::IndirectDrawPath;
     const auto support = localDevice->DrawIndirectSupport();
     const auto fail = [&](Path reason) { if (!indirectCpu) indirectCpu = reason; };
-    if (drawParameters.indexed && !GuestMemory::Accessible(reinterpret_cast<const void*>(drawParameters.indexAddress), static_cast<std::size_t>(drawParameters.indexCount) * drawParameters.indexSize)) fail(Path::IndexRange);
+    if (drawParameters.indexed && !indirect.indexLimitKnown) fail(Path::IndexLimitUnknown);
+    else if (drawParameters.indexed && !GuestMemory::Accessible(reinterpret_cast<const void*>(drawParameters.indexAddress), static_cast<std::size_t>(drawParameters.indexCount) * drawParameters.indexSize)) fail(Path::IndexRange);
     constexpr std::uint32_t NoLocation = 0x280u;
     const bool meshPath = graphics.stages.mesh.has_value() && !graphics.stages.tessellation && !graphics.rectList;
     const bool meshGpuSide = meshPath && drawParameters.indexed && indirect.count == 1 && !indirect.countIndirect && indirect.baseVertexLocation == NoLocation && indirect.startInstanceLocation == NoLocation && (!indirect.drawIndexEnabled || indirect.drawIndexLocation == NoLocation);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
index 04a1f72a02..af6202cb08 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
@@ -1,14 +1,28 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ThreadPriority.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Screenshot.hpp"
 #include "prx/libkernel/Time/include/SleepWake.hpp"
+#include <algorithm>
 #include <mutex>
 
 namespace AgcDriver {
 
 void Submit(const Packet* packet, std::uint32_t queue) try {
     KernelNoteGpuSubmit_nid_no_patch();
-    DriverDetail::Driver::Get().Submit(packet, queue);
+    auto& driver = DriverDetail::Driver::Get();
+    auto* const recorder = FrameRecorder::Active();
+    if (recorder == nullptr) {
+        driver.Submit(packet, queue);
+        return;
+    }
+    GuestMemory::CheckRange(packet, sizeof(Packet), alignof(Packet));
+    recorder->Submit(*packet, queue);
+    const auto flips = driver.FlipSubmissions();
+    driver.Submit(packet, queue);
+    if (driver.FlipSubmissions() != flips) recorder->FrameBoundary();
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
@@ -22,18 +36,22 @@ void Shutdown() {
 }
 
 void RegisterShader(const Shader* shader) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->RegisterShader(shader);
     DriverDetail::Driver::Get().RegisterShader(shader);
 }
 
 void SuspendPoint() {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->Suspend();
     DriverDetail::Driver::Get().SuspendPoint();
 }
 
 void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->RegisterVideoOutput(handle);
     DriverDetail::Driver::Get().RegisterVideoOutput(handle, output);
 }
 
 void UnregisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->UnregisterVideoOutput(handle);
     DriverDetail::Driver::Get().UnregisterVideoOutput(handle, output);
 }
 
@@ -46,6 +64,7 @@ void PresentClear(const PresentationWindow& window, bool opaque, void (*gpuReady
 }
 
 void PresentBuffer(const PresentationWindow& window, const DisplayBuffer& buffer, void (*gpuReady)(void*), void* context) {
+    if (auto* const recorder = FrameRecorder::Active()) recorder->PresentBuffer(buffer);
     DriverDetail::Driver::Get().Present(window, &buffer, true, gpuReady, context);
 }
 
@@ -103,11 +122,33 @@ extern "C" void AgcDriverSuspendPoint_nid_postfix() try {
 }
 
 extern "C" std::uint32_t AgcDriverReserveEopFlip_nid_postfix(const AgcDriver::FlipInfo& info) {
-    return AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info);
+    const auto token = AgcDriver::DriverDetail::Driver::Get().ReserveEopFlip(info);
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active(); recorder != nullptr && token != 0) recorder->ReserveEopFlip(info, token);
+    return token;
+}
+
+extern "C" std::uint32_t AgcDriverReserveEopFlipAt_nid_postfix(const AgcDriver::FlipInfo& info, std::uint32_t token) {
+    return AgcDriver::DriverDetail::Driver::Get().ReserveEopFlipAt(info, token);
+}
+
+extern "C" std::size_t AgcDriverAwaitedWaits_nid_postfix(AgcDriver::AwaitedWait* waits, std::size_t capacity) {
+    const auto awaited = AgcDriver::DriverDetail::Driver::Get().AwaitedWaits();
+    const auto count = std::min(capacity, awaited.size());
+    std::copy_n(awaited.begin(), count, waits);
+    return count;
+}
+
+extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std::uint64_t* completed) {
+    const auto [submitted, done] = AgcDriver::DriverDetail::Driver::Get().SerialProgress();
+    *accepted = submitted;
+    *completed = done;
 }
 
 extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info) try {
+    auto* const recorder = AgcDriver::FrameRecorder::Active();
+    if (recorder != nullptr) recorder->Flip(info);
     AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info);
+    if (recorder != nullptr) recorder->FrameBoundary();
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
@@ -145,18 +186,26 @@ extern "C" void AgcDriverReportFailure_nid_postfix(std::exception_ptr error) {
 }
 
 extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) try {
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveShaderAbi(shader, context, primitive);
     AgcDriver::DriverDetail::Driver::Get().ResolveShaderAbi(shader, context, primitive);
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
 
 extern "C" void AgcDriverResolveGraphicsAbi_nid_postfix(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) try {
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveGraphicsAbi(vertex, pixel, primitiveType);
     AgcDriver::DriverDetail::Driver::Get().ResolveGraphicsAbi(vertex, pixel, primitiveType);
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
 extern "C" void AgcDriverResolveGraphicsStagesAbi_nid_postfix(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) try {
+    if (auto* const recorder = AgcDriver::FrameRecorder::Active()) recorder->ResolveGraphicsStagesAbi(stages, context, primitive);
     AgcDriver::DriverDetail::Driver::Get().ResolveGraphicsStagesAbi(stages, context, primitive);
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
+
+extern "C" void AgcDriverPrepareCommandWrite_nid_no_patch(std::uint64_t address, std::size_t bytes) {
+    if (AgcDriver::Graphics::Recorder::SnapshotWriteOverlaps(address, bytes))
+        AgcDriver::GuestMemory::FlushGpuWrites(address, bytes);
+}
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp
index abad85855e..ba19bb4a60 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp
@@ -14,6 +14,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "ShaderDiskCache.hpp"
 #include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
@@ -87,6 +88,9 @@ void MapDriverMemory() {
     auto* slot = reinterpret_cast<std::uint64_t*>(FsTableAddress);
     slot[0] = (FsRoutineTableAddress & 0xffffffffffffull) | 16ull << 48u;
     slot[1] = FsTableDword3 << 32u | FsRoutineRecords;
+#ifndef _WIN32
+    GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(mapped, DriverMemoryBytes);
+#endif
     GuestAllocations::Mutation mutation;
     mutation.Add(mapped, DriverMemoryBytes, true, true, true);
 }
@@ -161,7 +165,13 @@ void Driver::stop() {
     for (auto& [queue, worker] : workers) {
         if (worker.thread.joinable()) worker.thread.join();
     }
+    try {
+        DrawFinisher::Get().Drain();
+    } catch (...) {
+    }
     DrawPipeline::Queue0().Stop();
+    DrawPipeline::Queue0().ReleaseRetired();
+    DrawFinisher::Get().ReleaseRan();
     StopWorkerSampler();
     CloseRegistrationPreparation();
     Graphics::StopPipelineLibraryWorker();
@@ -223,14 +233,52 @@ Driver::Driver() {
 }
 
 void Driver::WaitIdle() {
+    require(!onWorkerThread(), "worker cannot wait for itself");
+    {
+        std::unique_lock lock(mutex);
+        const auto target = accepted;
+        ++idleWaiters;
+        changed.wait(lock, [&] { return failure != nullptr || stopping || completed >= target; });
+        --idleWaiters;
+        rethrowFailure();
+        checkStopping();
+    }
+    std::lock_guard gpuLock(GuestMemory::GpuMutex());
+    if (const auto localDevice = device.Load()) localDevice->WaitIdle();
+}
+
+bool Driver::WaitIdleFor(std::chrono::milliseconds timeout) {
     require(!onWorkerThread(), "worker cannot wait for itself");
     std::unique_lock lock(mutex);
     const auto target = accepted;
     ++idleWaiters;
-    changed.wait(lock, [&] { return failure != nullptr || stopping || completed >= target; });
+    const bool idle = changed.wait_for(lock, timeout, [&] { return failure != nullptr || stopping || completed >= target; });
     --idleWaiters;
     rethrowFailure();
     checkStopping();
+    return idle;
+}
+
+std::vector<AwaitedWait> Driver::AwaitedWaits() {
+    std::vector<AwaitedWait> result;
+    for (const auto& slot : awaitedSlots) {
+        const auto address = slot.address.load(std::memory_order_acquire);
+        if (address == 0) continue;
+        AwaitedWait wait;
+        wait.address = address;
+        wait.reference = slot.reference.load(std::memory_order_relaxed);
+        wait.mask = slot.mask.load(std::memory_order_relaxed);
+        const auto shape = slot.shape.load(std::memory_order_relaxed);
+        wait.function = static_cast<std::uint32_t>(shape);
+        wait.bytes = static_cast<std::uint32_t>(shape >> 32u);
+        if (slot.address.load(std::memory_order_acquire) == address) result.push_back(wait);
+    }
+    return result;
+}
+
+std::pair<std::uint64_t, std::uint64_t> Driver::SerialProgress() {
+    std::lock_guard lock(mutex);
+    return {accepted, completed};
 }
 
 void Driver::CheckFailure() {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp
index 6a76867635..9e8ca4fe94 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp
@@ -2,6 +2,8 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <algorithm>
 #include <cstdlib>
 #include <cstring>
@@ -16,14 +18,14 @@ bool Driver::matchesCopyKernel(std::span<const std::uint32_t> code, const std::v
     static const bool enabled = std::getenv("APS5_NO_COPY_HLE") == nullptr;
     if (!enabled || userData.size() != 12 || compute.numThreads[0] != 64 || compute.numThreads[1] != 1 || compute.numThreads[2] != 1 || !compute.groupIdEnable[0]) return false;
     static constexpr std::size_t copyKernelWords = 38;
-    static constexpr std::uint64_t copyKernelHash = 0x6ec00fe8aa95f99aull;
+    static constexpr std::array<std::uint64_t, 2> copyKernelHashes{0x6ec00fe8aa95f99aull, 0xc771c42e4d069d62ull};
     if (code.size() < copyKernelWords || code[0] != 0xbfa00002u || code[copyKernelWords - 1] != 0xbf810000u) return false;
     std::uint64_t hash = 0xcbf29ce484222325ull;
     for (const auto word : code.first(copyKernelWords)) {
         hash ^= word;
         hash *= 0x100000001b3ull;
     }
-    if (hash != copyKernelHash) return false;
+    if (std::find(copyKernelHashes.begin(), copyKernelHashes.end(), hash) == copyKernelHashes.end()) return false;
     const auto stride = [&](std::size_t word) { return (userData[word] >> 16u) & 0x3fffu; };
     const auto swizzled = [&](std::size_t word) { return ((userData[word] >> 31u) & 1u) != 0; };
     return userData[3] == 0x00014004u && userData[7] == 0x00014004u && userData[11] == 0x0004dfacu && stride(1) == 4 && stride(5) == 4 && stride(9) == 16 && !swizzled(1) && !swizzled(5) && !swizzled(9) && userData[10] >= 1;
@@ -52,13 +54,35 @@ std::optional<StreamCopy> StreamCopyRange(const std::vector<std::uint32_t>& user
     return copy;
 }
 
+bool MatchesIndexedCopyKernel(std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData, const ShaderRecompiler::ShaderComputeStageInfo& compute) {
+    static const bool enabled = std::getenv("APS5_NO_COPY_HLE") == nullptr;
+    if (!enabled || userData.size() != 12 || compute.numThreads[0] != 64 || compute.numThreads[1] != 1 || compute.numThreads[2] != 1 || !compute.groupIdEnable[0]) return false;
+    static constexpr std::array<std::uint32_t, 19> kernel{0xbfa00001u, 0xd7460000u, 0x04010c0cu, 0xf4201a84u, 0xfa000000u, 0xbf8cc07fu, 0x7da8006au, 0xbf88000au, 0xf4241a84u, 0xfa000004u, 0xbf8cc07fu, 0x4a08006bu, 0x4a00006au, 0xe0382000u, 0x80000000u, 0xbf8c3f70u, 0xe0782000u, 0x80010004u, 0xbf810000u};
+    if (code.size() < kernel.size() || !std::equal(kernel.begin(), kernel.end(), code.begin())) return false;
+    const auto stride = [&](std::size_t word) { return (userData[word] >> 16u) & 0x3fffu; };
+    const auto swizzled = [&](std::size_t word) { return ((userData[word] >> 31u) & 1u) != 0; };
+    const bool addTid = ((userData[3] >> 23u) & 1u) != 0;
+    const auto outOfBounds = (userData[3] >> 28u) & 3u;
+    const auto type = userData[3] >> 30u;
+    return stride(1) == 16 && stride(5) == 16 && stride(9) == 16 && !swizzled(1) && !swizzled(5) && !swizzled(9) && userData[3] == userData[7] && type == 0 && !addTid && outOfBounds == 0 && userData[10] >= 1;
+}
+
+std::optional<StreamCopy> IndexedCopyRange(const std::vector<std::uint32_t>& userData, std::uint32_t groups, std::uint32_t count, std::uint32_t sourceOffset, std::uint32_t destinationOffset) {
+    const auto base = [&](std::size_t word) { return userData[word] | (static_cast<std::uint64_t>(userData[word + 1] & 0xffffu) << 32u); };
+    const auto elements = std::min<std::uint64_t>(std::uint64_t{groups} * 64u, count);
+    if (elements == 0 || std::uint64_t{sourceOffset} + elements > userData[2] || std::uint64_t{destinationOffset} + elements > userData[6]) return std::nullopt;
+    const StreamCopy copy{base(0) + std::uint64_t{sourceOffset} * 16u, base(4) + std::uint64_t{destinationOffset} * 16u, static_cast<std::size_t>(elements) * 16u};
+    if (copy.bytes > (16u << 20u) || copy.source % 16 != 0 || copy.destination % 16 != 0) return std::nullopt;
+    return copy;
+}
+
 void Driver::countCopy(int path, std::size_t bytes, std::chrono::steady_clock::time_point started, std::chrono::steady_clock::time_point locked, const VulkanDevice::CopyOutcome* outcome) {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     if (path < 0 || path >= CopyPaths) return;
     copyPathCounts[path].fetch_add(1, std::memory_order_relaxed);
     if (!profile) return;
     using Outcome = VulkanDevice::CopyOutcome;
-    static std::mutex countsMutex;
+    static AgcDriver::Mutex countsMutex;
     static std::uint64_t counts[CopyPaths] = {};
     static std::uint64_t refused[Outcome::Refusals] = {};
     static std::uint64_t cpuBytes = 0, gpuBytes = 0, aliasedBytes = 0, syncs = 0, settledBySignal = 0, sourceWaits = 0;
@@ -119,7 +143,9 @@ bool Driver::knownValueVerify() {
 }
 
 bool Driver::copyBuffer(QueueState& queue, std::uint32_t queueId, std::span<const std::uint32_t> packet, std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData, const ShaderRecompiler::ShaderComputeStageInfo& compute, const std::shared_ptr<VulkanDevice>& localDevice, std::uint64_t programAddress) {
-    const bool stream = !matchesCopyKernel(code, userData, compute);
+    const bool hashed = matchesCopyKernel(code, userData, compute);
+    const bool indexed = !hashed && MatchesIndexedCopyKernel(code, userData, compute);
+    const bool stream = !hashed && !indexed;
     if (stream && !MatchesStreamCopyKernel(code, userData, compute)) return false;
     const auto started = std::chrono::steady_clock::now();
     static const std::size_t cpuMax = [] {
@@ -132,8 +158,8 @@ bool Driver::copyBuffer(QueueState& queue, std::uint32_t queueId, std::span<cons
         return text ? static_cast<std::size_t>(std::strtoull(text, nullptr, 10)) : std::numeric_limits<std::size_t>::max();
     }();
     const auto base = [&](std::size_t word) { return userData[word] | (static_cast<std::uint64_t>(userData[word + 1] & 0xffffu) << 32u); };
-    const auto source = base(0);
-    const auto destination = base(4);
+    auto source = base(0);
+    auto destination = base(4);
     const auto record = stream ? std::uint64_t{0} : base(8);
     std::array<std::uint32_t, 3> groups{packet[1], packet[2], packet[3]};
     if ((packet[4] & 0x20u) != 0) {
@@ -168,6 +194,28 @@ bool Driver::copyBuffer(QueueState& queue, std::uint32_t queueId, std::span<cons
             return false;
         }
         bytes = range->bytes;
+    } else if (indexed) {
+        Graphics::FinishLeaseWork();
+        const bool recordAccessible = GuestMemory::Accessible(reinterpret_cast<const void*>(record), 12);
+
+        bool published = false;
+        if (!recordAccessible || Graphics::Recorder::SnapshotWriteOverlaps(record, 12) || Graphics::StorageTexture::FlushPending(record, 12, nullptr, "indexed copy record", Graphics::PublishScope::Whole, &published) || published || labelPending(record, 12)) {
+            if (traceCopy()) traceCopyPending(recordAccessible ? "copy record" : "inaccessible copy record", record, 12, source, destination, 0, localDevice);
+            countCopy(CopyRecordPending, 0, started, locked);
+            return false;
+        }
+        std::uint32_t count = 0, sourceOffset = 0, destinationOffset = 0;
+        std::memcpy(&count, reinterpret_cast<const void*>(record), 4);
+        std::memcpy(&sourceOffset, reinterpret_cast<const void*>(record + 4), 4);
+        std::memcpy(&destinationOffset, reinterpret_cast<const void*>(record + 8), 4);
+        const auto range = IndexedCopyRange(userData, groups[0], count, sourceOffset, destinationOffset);
+        if (!range || (record < range->destination + range->bytes && range->destination < record + 12)) {
+            countCopy(CopyShape, range ? range->bytes : 0, started, locked);
+            return false;
+        }
+        source = range->source;
+        destination = range->destination;
+        bytes = range->bytes;
     } else {
         const bool recordAccessible = GuestMemory::Accessible(reinterpret_cast<const void*>(record), 8);
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp
index e410cb88d3..bd1b6112de 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferFill.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Memory/DwordPatternFill.hpp"
@@ -186,7 +187,7 @@ void Driver::fillClearCount(const Graphics::StorageTexture::FillCoverage& covera
     if (!profile) return;
     using FillCover = Graphics::StorageTexture::FillCover;
     static constexpr std::array<const char*, 8> names{"none", "exact", "inside", "around", "straddle", "several", "keys", "layer"};
-    static std::mutex countsMutex;
+    static AgcDriver::Mutex countsMutex;
     static std::array<std::uint64_t, 8> counts{}, coverBytes{};
     static std::map<std::uint32_t, std::uint64_t> coveredFormats;
     static std::map<std::string, std::uint64_t> refusals;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp
index ce9a656cb7..6328766099 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp
@@ -34,6 +34,24 @@ bool pipelineDma() {
     return enabled;
 }
 
+bool keepsDrawFinisher(std::uint32_t header, std::uint32_t opcode) {
+    if (header == FlipPacketHeader || header == RenderingWaitPacketHeader) return false;
+    if (Pm4::DrawOpcode(opcode)) return true;
+    switch (opcode) {
+        case 0x13: case 0x26: case 0x2a: case 0x2f: case 0x69: case 0x76: case 0x79: return true;
+        case 0x10: return ((header >> 2u) & 0x3fu) == 0;
+        default: return false;
+    }
+}
+
+bool waitTakesPendingLabel(std::span<const std::uint32_t> packet) {
+    if (packet.size() < 5) return false;
+    const auto awaitedBytes = Pm4::WaitAwaitedBytes(packet);
+    const std::uint64_t awaited = (packet[2] & (awaitedBytes == 8 ? ~7u : ~3u)) | (static_cast<std::uint64_t>(packet[3]) << 32u);
+    const auto value = DrawPipeline::Queue0().PendingLabel(awaited, awaitedBytes);
+    return value.has_value() && Pm4::WaitComparesValue(packet, *value);
+}
+
 bool keepsDrawPipeline(std::span<const std::uint32_t> packet, std::uint32_t header, std::uint32_t opcode) {
     if (header == FlipPacketHeader || header == RenderingWaitPacketHeader) return false;
     if (Pm4::DrawOpcode(opcode)) return true;
@@ -108,13 +126,17 @@ void Driver::deliverFlipEopInterrupt(std::uint32_t queue) {
 
 template <typename TWork>
 void Driver::timed(double WorkerProfile::*bucket, TWork&& work) {
+    static const bool report = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (!report) {
+        work();
+        return;
+    }
     static thread_local WorkerProfile profile;
     const auto begin = std::chrono::steady_clock::now();
     work();
     const auto end = std::chrono::steady_clock::now();
     profile.*bucket += std::chrono::duration<double, std::milli>(end - begin).count();
-    static const bool report = std::getenv("APS5_PROFILE_DRAW") != nullptr;
-    if (report && end - profile.reported > std::chrono::seconds(10)) {
+    if (end - profile.reported > std::chrono::seconds(10)) {
         profile.reported = end;
         AgcDriver::ProfilePrint_nid_no_patch( "[gpu] worker at %.0f s: dispatch %.1f s, draw %.1f s, wait %.1f s\n", std::chrono::duration<double>(end - profile.start).count(), profile.dispatchMs / 1000, profile.drawMs / 1000, profile.waitMs / 1000);
     }
@@ -226,6 +248,12 @@ void Driver::execute(const Submission& submission) {
     struct ClearAhead {
         ~ClearAhead() { clearResolvedAhead(); }
     } clearAhead;
+    struct SettleFinisher {
+        bool queue0;
+        ~SettleFinisher() {
+            if (queue0) DrawFinisher::Get().Settle();
+        }
+    } settleFinisher{submission.queue == 0};
     for (std::size_t cursor = 0; cursor < submission.commands.size();) {
         if (packetEpoch()) bumpEpoch(&EpochBumps::packets);
         CheckFailure();
@@ -235,10 +263,20 @@ void Driver::execute(const Submission& submission) {
         const auto packet = std::span(submission.commands).subspan(cursor, count);
         const auto opcode = (header >> 8u) & 0xffu;
         auto nextCursor = cursor + count;
+        const bool predicated = Pm4::Predicated(header) && queue.predication.operation != 0;
+        if (submission.queue == 0 && DrawFinisher::Busy() && !keepsDrawFinisher(header, opcode)) {
+            const bool queuesLabel = pipelined && !predicated && header != FlipPacketHeader && header != RenderingWaitPacketHeader && !submission.flips.contains(cursor) && labelPacketQueues(packet, opcode);
+            const bool heldLabelWait = pipelined && !predicated && orderedWaits && (opcode == 0x3c || opcode == 0x93) && header != RenderingWaitPacketHeader && waitTakesPendingLabel(packet);
+            const bool beside = DrawFinisher::Overlap() && opcode != 0x15 && (queuesLabel || heldLabelWait || keepsDrawPipeline(packet, header, opcode));
+            if (!beside) DrawFinisher::Get().Drain();
+            if (DrawFinisher::Overlap()) {
+                DrawFinisher::NoteDrain(DrawFinisher::DrainSite::Packet, !beside);
+                if (!beside) DrawFinisher::NoteDrainedOpcode(header == FlipPacketHeader ? 0xffu : opcode, keepsDrawPipeline(packet, header, opcode));
+            }
+        }
         if (APS5_ENABLE_TIMING_LOG && submission.queue == 0 && pendingFrameTiming == nullptr) includeTimingSubmission(submission, false);
         PerformanceContext timingContext(submission.queue == 0 ? pendingFrameTiming.get() : FrameTiming::Async());
         PerformanceTimer timing("Driver.Packet");
-        const bool predicated = Pm4::Predicated(header) && queue.predication.operation != 0;
         if (pipelined && !predicated && header != FlipPacketHeader && header != RenderingWaitPacketHeader && !submission.flips.contains(cursor) && (enqueueLabelPacket(packet, opcode, submission.queue) || enqueueDmaPacket(packet, opcode, submission.queue, queue))) {
             traceLabel(packet, submission.queue);
             recent.Record(cursor);
@@ -265,8 +303,10 @@ void Driver::execute(const Submission& submission) {
                 continue;
             }
         }
+        timing.Mark("pipeline_prepare");
         if (pipelined && DrawPipeline::Queue0().Busy() && !keepsDrawPipeline(packet, header, opcode)) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, header == FlipPacketHeader ? 0xffu : opcode);
         if (pipelined && predicated && DrawPipeline::Queue0().Busy() && DrawPipeline::Queue0().Overlaps(queue.predication.address, queue.predication.operation == 3 ? 8 : 4)) DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Packet, opcode);
+        timing.Mark("pipeline_drain");
         std::shared_lock deviceUse(deviceReplacement, std::defer_lock);
         if (opcode != 0x3c && opcode != 0x93 && header != RenderingWaitPacketHeader && header != FlipPacketHeader) deviceUse.lock();
 
@@ -289,7 +329,7 @@ void Driver::execute(const Submission& submission) {
         const auto flushStart = profilePackets ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
         flushBetweenPackets(submission.queue, header, opcode == 0x49 || opcode == 0x37);
         timing.Mark("flush_between_packets");
-        PacketTimer packetTimer{profilePackets, header == FlipPacketHeader ? 0xffffu : opcode, submission.queue, packetProfile, std::chrono::steady_clock::now()};
+        PacketTimer packetTimer{profilePackets, header == FlipPacketHeader ? 0xffffu : opcode, submission.queue, packetProfile, profilePackets ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{}};
 
         if (profilePackets) {
             packetStartedAt() = packetTimer.start;
@@ -404,7 +444,7 @@ void Driver::execute(const Submission& submission) {
             finishDispatchPacket(opcode == 0x16);
         } else if (opcode == 0x3c || opcode == 0x93) {
             static const bool traceGpu = std::getenv("APS5_TRACE_GPU") != nullptr;
-            const auto waitStart = std::chrono::steady_clock::now();
+            const auto waitStart = traceGpu ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
             timed(&WorkerProfile::waitMs, [&] { waitMemory(packet, submission.queue, recent, submission.received, submission.heldAtSubmit.contains(cursor)); });
             gateOpened() = true;
             if (traceGpu && std::chrono::steady_clock::now() - waitStart > std::chrono::milliseconds(200)) {
@@ -435,7 +475,7 @@ void Driver::execute(const Submission& submission) {
 
                 try {
                     std::string rejected;
-                    const auto verdict = draw(queue, packet, submission, rejected);
+                    const auto verdict = draw(queue, packet, submission, cursor, rejected);
                     drawn = verdict == DrawVerdict::Drawn;
                     CaptureTrace::Log("draw submission=%llu queue=%x offset=%zu target=%llx mask=%x verdict=%d reason=%.256s", static_cast<unsigned long long>(submission.serial), submission.queue, cursor, static_cast<unsigned long long>(color), readRegister(queue.context, 0x8e), static_cast<int>(verdict), rejected.c_str());
                     if (verdict == DrawVerdict::Rejected) {
@@ -519,6 +559,7 @@ void Driver::execute(const Submission& submission) {
         cursor = nextCursor;
     }
 
+    if (submission.queue == 0) DrawFinisher::Get().Drain();
     PerformanceContext endContext(submission.queue == 0 ? frameTiming() : FrameTiming::Async());
     PerformanceTimer endTiming("Driver.EndSubmission");
     static const bool submitAtEnd = std::getenv("APS5_SUBMIT_AT_END") != nullptr;
@@ -528,8 +569,8 @@ void Driver::execute(const Submission& submission) {
             return;
         }
         if ((std::atomic_ref<std::uint32_t>(*const_cast<std::uint32_t*>(submission.rewindTail - 1)).load(std::memory_order_acquire) & 0x80000000u) != 0) {
-            DrawPipeline::Queue0().Enqueue([this] {
-                submitOpenWork();
+            DrawPipeline::Queue0().Enqueue([this, progress = submission.progress] {
+                submitOpenWork(progress);
                 wakeQueueZeroForCompletions();
             }, {});
             endTiming.Finish();
@@ -553,7 +594,10 @@ void Driver::execute(const Submission& submission) {
         if (localDevice != nullptr) localDevice->SubmitRecorded(submission.queue == 0);
     }
     endTiming.Finish();
-    if (submission.rewindTail != nullptr) executeRewindTail(submission);
+    if (submission.rewindTail != nullptr) {
+        if (submission.progress) submitOpenWork(submission.progress);
+        executeRewindTail(submission);
+    }
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp
index d65d4bf795..5c2cc06454 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp
@@ -52,6 +52,7 @@ bool Driver::preparePacketMemory(const Submission& submission, QueueState& queue
                 countLabelOutcome(reason);
                 ++immediateLabels;
             } else {
+                if (localDevice != nullptr) Graphics::StorageTexture::StoreReadbackBeforeLabel("readback before interrupt");
                 ++noOpLabels;
             }
             if (reason == 0 || reason == 5) {
@@ -380,9 +381,15 @@ void Driver::commitDmaStore(std::uint32_t queue, std::uint64_t address, std::spa
     Graphics::Recorder::CloseLabelGroup(GuestMemory::TrackerGeneration());
 }
 
-bool Driver::enqueueLabelPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue) {
+bool Driver::labelPacketQueues(std::span<const std::uint32_t> packet, std::uint32_t opcode) {
     static const bool ordered = std::getenv("APS5_PIPELINE_DRAIN_LABELS") == nullptr;
     if (!ordered || !DeferLabels() || (opcode != 0x49 && opcode != 0x37) || !deferredLabels().labels.empty()) return false;
+    if (Pm4::DecodeLabelWrite(packet).has_value()) return true;
+    return opcode == 0x49 && ((packet[2] >> 29u) == 0 || (packet[3] | (static_cast<std::uint64_t>(packet[4]) << 32u)) == 0);
+}
+
+bool Driver::enqueueLabelPacket(std::span<const std::uint32_t> packet, std::uint32_t opcode, std::uint32_t queue) {
+    if (!labelPacketQueues(packet, opcode)) return false;
     const auto interruptSelect = opcode == 0x49 ? (packet[2] >> 24u) & 7u : 0u;
     const bool endOfPipeInterrupt = interruptSelect != 0 && interruptSelect != 3;
     const auto label = Pm4::DecodeLabelWrite(packet);
@@ -406,10 +413,23 @@ bool Driver::enqueueLabelPacket(std::span<const std::uint32_t> packet, std::uint
     }
     if (endOfPipeInterrupt) bumpEpoch(&EpochBumps::drains);
     auto stored = bytes;
-    DrawPipeline::Queue0().Enqueue([this, queue, opcode, address, bytes = std::move(bytes), endOfPipeInterrupt] {
-        GuestMemory::SetCurrentPacket(opcode, queue);
-        commitLabel(queue, address, bytes, endOfPipeInterrupt);
-    }, std::move(writes), address, std::move(stored));
+    auto labelBytes = bytes;
+    auto enqueue =[this, queue, opcode, address, bytes = std::move(bytes), endOfPipeInterrupt, writes, stored = std::move(stored)]() mutable {
+        DrawPipeline::Queue0().Enqueue([this, queue, opcode, address, bytes = std::move(bytes), endOfPipeInterrupt] {
+            GuestMemory::SetCurrentPacket(opcode, queue);
+            commitLabel(queue, address, bytes, endOfPipeInterrupt);
+        }, std::move(writes), address, std::move(stored));
+    };
+    if (queue == 0 && DrawFinisher::Overlap() && DrawFinisher::Busy()) {
+        DrawFinisher::Pending held;
+        held.unknown = false;
+        held.writes = std::move(writes);
+        held.labelAddress = address;
+        held.labelBytes = std::move(labelBytes);
+        DrawFinisher::Get().Enqueue(std::move(enqueue), std::move(held));
+        return true;
+    }
+    enqueue();
     return true;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
index d071d049fc..a2fa486528 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
@@ -12,19 +12,35 @@ namespace AgcDriver::DriverDetail {
 
 std::uint32_t Driver::ReserveEopFlip(const FlipInfo& info) {
     std::lock_guard lock(mutex);
+    require(nextEopToken <= EopFlipTokenLimit, "EOP flip token space exhausted");
+    return reserveEopFlip(info, nextEopToken);
+}
+
+std::uint32_t Driver::ReserveEopFlipAt(const FlipInfo& info, std::uint32_t token) {
+    std::lock_guard lock(mutex);
+    return reserveEopFlip(info, token);
+}
+
+std::uint32_t Driver::reserveEopFlip(const FlipInfo& info, std::uint32_t token) {
     rethrowFailure();
     checkStopping();
-    require(nextEopToken <= EopFlipTokenLimit, "EOP flip token space exhausted");
+    require(token >= EopFlipTokenBase && token <= EopFlipTokenLimit && !eopFlips.contains(token), "EOP flip token is not free");
     const auto output = outputs.find(info.handle);
     require(output != outputs.end(), "EOP flip references an unregistered video output");
     auto request = output->second->TryReserve(info);
     if (!request) return 0;
-    const auto token = nextEopToken;
     eopFlips.emplace(token, EopFlip{info.handle, std::move(request)});
-    ++nextEopToken;
+    nextEopToken = std::max(nextEopToken, token + 1);
     return token;
 }
 
+std::vector<std::uint32_t> Driver::PendingEopFlipTokens() {
+    std::lock_guard lock(mutex);
+    std::vector<std::uint32_t> tokens;
+    for (const auto& [token, flip] : eopFlips) tokens.push_back(token);
+    return tokens;
+}
+
 void Driver::RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
     require(output != nullptr, "null video output");
     std::lock_guard lock(mutex);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp
index ed1cb37640..546be83644 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/QueueWorker.cpp
@@ -70,19 +70,23 @@ void Driver::deferCompletion(const Submission& submission) {
         queue0Uncommitted.push_back(received);
     }
     completionDeferred() = true;
-    DrawPipeline::Queue0().Enqueue([this, serial = submission.serial, received, labelWrites = submission.labelWrites] {
-        completeSubmission(serial, received, labelWrites);
+    DrawPipeline::Queue0().Enqueue([this, serial = submission.serial, received, labelWrites = submission.labelWrites, progress = submission.progress] {
+        completeSubmission(serial, received, labelWrites, progress);
     }, {});
 }
 
-void Driver::submitOpenWork() {
-    if (deferredLabels().labels.empty() && !Graphics::Recorder::PendingLabelSince().has_value() && Graphics::Recorder::RecordedWorkSinceSubmit() == 0) return;
+void Driver::submitOpenWork(const std::shared_ptr<SubmissionProgress>& progress) {
+    const bool work = !deferredLabels().labels.empty() || Graphics::Recorder::PendingLabelSince().has_value() || Graphics::Recorder::RecordedWorkSinceSubmit() != 0;
+    if (!work && !progress) return;
     ++submissionCosts(0).endSubmits;
     GuestMemory::TagGpuLockSite(GuestMemory::GpuLockSite::End);
     std::lock_guard gpuLock(GuestMemory::GpuMutex());
     const auto localDevice = device.Load();
-    recordDeferredLabels(localDevice.get(), 0);
-    if (localDevice != nullptr) localDevice->SubmitRecorded(true);
+    if (work) {
+        recordDeferredLabels(localDevice.get(), 0);
+        if (localDevice != nullptr) localDevice->SubmitRecorded(true);
+    }
+    if (progress) progress->Publish(localDevice, localDevice ? localDevice->SubmittedEpoch() : 0);
 }
 
 void Driver::wakeQueueZeroForCompletions() {
@@ -91,7 +95,7 @@ void Driver::wakeQueueZeroForCompletions() {
     changed.notify_all();
 }
 
-void Driver::completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites) {
+void Driver::completeSubmission(std::uint64_t serial, std::uint64_t received, std::span<const std::uint64_t> labelWrites, const std::shared_ptr<SubmissionProgress>& progress) {
     struct Complete {
         Driver& driver;
         std::uint64_t serial, received;
@@ -109,7 +113,7 @@ void Driver::completeSubmission(std::uint64_t serial, std::uint64_t received, st
             if (notify) driver.changed.notify_all();
         }
     } complete{*this, serial, received, labelWrites};
-    submitOpenWork();
+    submitOpenWork(progress);
 }
 
 const std::atomic<std::uint64_t>*& Driver::workerQueued() {
@@ -261,6 +265,7 @@ void Driver::run(std::uint32_t id) noexcept {
                 if (profile && submission.enqueuedAt != std::chrono::steady_clock::time_point{}) costs.dequeueNs += static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - submission.enqueuedAt).count());
             }
             execute(submission);
+            if (submission.progress && submission.rewindTail == nullptr && !completionDeferred()) submitOpenWork(submission.progress);
             if (traceGpu) std::fprintf(stderr, "[gpu] %.1f done serial=%llu queue=0x%x\n", TraceMs(), static_cast<unsigned long long>(submission.serial), id);
             const auto completeStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
             PerformanceContext completionContext(id == 0 ? frameTiming() : FrameTiming::Async());
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp
index 13d45c0f36..eeaea3e126 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Queues/Submission.hpp"
@@ -21,6 +22,61 @@ namespace AgcDriver::DriverDetail {
 
 namespace {
 
+bool& submitsQueue0() {
+    struct SubmitsQueue0Storage {};
+    return HostThreadLocal<bool, SubmitsQueue0Storage>();
+}
+
+std::uint64_t& flipSubmissionsOfThread() {
+    struct FlipSubmissionsStorage {};
+    return HostThreadLocal<std::uint64_t, FlipSubmissionsStorage>();
+}
+
+bool progressEligible(const Submission& submission) {
+    if (submission.queue != 0 || !submission.flips.empty()
+        || !submission.renderingWaits.empty() || !submission.conditionalEnds.empty()) return false;
+    bool terminalRelease = false;
+    std::optional<Pm4::LabelWrite> knownWrite;
+    for (std::size_t at = 0; at < submission.commands.size();) {
+        const auto packet = std::span(submission.commands).subspan(at);
+        const auto count = Pm4::PacketWords(packet[0]);
+        if (count == 0 || count > packet.size()) return false;
+        const auto opcode = (packet[0] >> 8u) & 0xffu;
+        const bool type3 = (packet[0] >> 30u) == 3;
+        if (type3 && (opcode == 0x3c || opcode == 0x93)) {
+            if (!knownWrite || Pm4::Predicated(packet[0]) || ((packet[1] >> 4u) & 3u) != 1u) return false;
+            const auto wait = Pm4::DecodeWait(packet.first(count));
+            const auto bytes = knownWrite->Bytes();
+            if (wait.address < knownWrite->address) return false;
+            const auto offset = wait.address - knownWrite->address;
+            if (offset > bytes.size() || wait.bytes > bytes.size() - offset) return false;
+            std::uint64_t value = 0;
+            std::memcpy(&value, bytes.data() + offset, wait.bytes);
+            if (!Pm4::WaitComparesValue(packet.first(count), value)) return false;
+            terminalRelease = false;
+            at += count;
+            continue;
+        }
+        if (type3 && opcode == 0x59 && submission.rewindTail != nullptr && at + count == submission.commands.size()) {
+            at += count;
+            continue;
+        }
+        if (!Pm4::FillerPacket(packet[0]) && !(type3 && opcode == 0x10) && !Pm4::IsTagMarker(packet.first(count))) {
+            if (type3 && (opcode == 0x49 || opcode == 0x37)) {
+                const auto write = Pm4::DecodeLabelWrite(packet.first(count));
+                terminalRelease = opcode == 0x49 && write.has_value();
+                if (write && !Pm4::Predicated(packet[0]) && (opcode == 0x37 || (packet[2] >> 29u) < 3)) knownWrite = *write;
+                else if (opcode != 0x49 || (packet[2] >> 29u) != 0) knownWrite.reset();
+            } else {
+                terminalRelease = false;
+                if (!type3 || (opcode != 0x42 && opcode != 0x58)) knownWrite.reset();
+            }
+        }
+        at += count;
+    }
+    return terminalRelease;
+}
+
 std::uint64_t captureTime() {
     return static_cast<std::uint64_t>(std::llround(TraceMs() * 1000.0));
 }
@@ -38,11 +94,10 @@ bool EopRelease(std::span<const std::uint32_t> words) {
     return words.size() >= 8 && (words[0] >> 30u) == 3u && Pm4::PacketWords(words[0]) == 8u && ((words[0] >> 8u) & 0xffu) == 0x49u && ((words[2] >> 24u) & 7u) == 2u;
 }
 
-bool& submitsQueue0() {
-    struct SubmitsQueue0Storage {};
-    return HostThreadLocal<bool, SubmitsQueue0Storage>();
 }
 
+std::uint64_t Driver::FlipSubmissions() const {
+    return flipSubmissionsOfThread();
 }
 
 std::deque<const std::uint32_t*>& Driver::releasedTails() {
@@ -282,6 +337,7 @@ void Driver::executeRewindTail(const Submission& stalled) {
             checkStopping();
             noteAwaitingTitle(stalled.queue, reinterpret_cast<std::uint64_t>(stalled.rewindTail - 1));
             stall.Check("REWIND at", reinterpret_cast<std::uint64_t>(stalled.rewindTail - 1));
+            if (stalled.queue == 0 && completionsPending()) reapCompletionLabels();
             PollSleep();
         }
     }
@@ -366,6 +422,10 @@ void Driver::Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip) {
     const auto validated = profile ? std::chrono::steady_clock::now() : start;
     auto* const capture = SubmissionCapture::Active();
     auto captured = capture != nullptr ? SubmissionCapture::Prepare(queue, SubmissionKind::Submit, submission.commands, submission.conditionalEnds) : CapturedSubmission{};
+    static const bool progressEnabled = std::getenv("APS5_SUBMIT_PROGRESS") != nullptr;
+    const auto progress = progressEnabled && progressEligible(submission) ? std::make_shared<SubmissionProgress>() : nullptr;
+    submission.progress = progress;
+    const auto progressDeadline = progress ? std::chrono::steady_clock::now() + std::chrono::milliseconds(2) : std::chrono::steady_clock::time_point{};
     {
         std::unique_lock lock(mutex);
         rethrowFailure();
@@ -401,11 +461,31 @@ void Driver::Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip) {
             submission.holdsFlip = true;
             flipsAhead.fetch_add(1, std::memory_order_acq_rel);
         }
+        if (!submission.flips.empty()) ++flipSubmissionsOfThread();
         enqueue(std::move(submission));
         ++accepted;
     }
     changed.notify_all();
     if (capture != nullptr) writeCaptured(*this, *capture, captured);
+    if (progress) {
+        PerformanceTimer timing("Driver.SubmitProgress");
+        const auto [localDevice, epoch] = progress->WaitUntil(progressDeadline);
+        const auto now = std::chrono::steady_clock::now();
+        bool gpuReady = false;
+        if (localDevice && epoch != 0 && now < progressDeadline) {
+            const auto remaining = std::chrono::duration_cast<std::chrono::nanoseconds>(progressDeadline - now).count();
+            gpuReady = localDevice->WaitRecordedFor(epoch, static_cast<std::uint64_t>(remaining));
+        }
+        if (profile) {
+            static std::atomic<std::uint64_t> eligible{0}, ready{0}, expired{0};
+            if (gpuReady) ready.fetch_add(1, std::memory_order_relaxed);
+            else expired.fetch_add(1, std::memory_order_relaxed);
+            const auto count = eligible.fetch_add(1, std::memory_order_relaxed) + 1;
+            if (count % 1000 == 0) AgcDriver::ProfilePrint_nid_no_patch("[submit-progress] %llu eligible terminal releases, %llu GPU-ready returns, %llu expired or unsupported\n",
+                static_cast<unsigned long long>(count), static_cast<unsigned long long>(ready.load()), static_cast<unsigned long long>(expired.load()));
+        }
+        CheckFailure();
+    }
 }
 
 void Driver::SuspendPoint() {
@@ -465,7 +545,18 @@ bool Driver::orderReleased(std::uint32_t queue, std::uint64_t received) const {
     return runningWorkers.load(std::memory_order_acquire) == 0 && !completionsPending() && !Graphics::Recorder::SnapshotWriteOverlaps(awaited, 4);
 }
 
+void Driver::noteWaitFields(std::uint32_t queue, std::span<const std::uint32_t> packet) {
+    const auto fields = Pm4::DecodeWait(packet);
+    auto& slot = awaitedSlots[queue == 0 ? 0 : queue - 0x20 + 1];
+    slot.reference.store(fields.reference, std::memory_order_relaxed);
+    slot.mask.store(fields.mask, std::memory_order_relaxed);
+    slot.shape.store(static_cast<std::uint64_t>(fields.function) | static_cast<std::uint64_t>(fields.bytes) << 32u, std::memory_order_relaxed);
+}
+
 void Driver::noteWaitBlocked(std::uint32_t queue, std::uint64_t awaited, bool blocked) {
+    auto& slot = awaitedSlots[queue == 0 ? 0 : queue - 0x20 + 1];
+    if (!blocked) slot.shape.store(0, std::memory_order_relaxed);
+    slot.address.store(blocked ? awaited : 0, std::memory_order_release);
     if (blocked) {
         if (runningWorkers.fetch_sub(1, std::memory_order_acq_rel) == 1) {
             idleEpoch.fetch_add(1, std::memory_order_release);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp
index 52f65cc2d0..91b97871d7 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "ControlFlow/RequestSerializer.hpp"
 #include <cstdlib>
 #include <functional>
@@ -7,7 +8,7 @@
 namespace AgcDriver::DriverDetail {
 
 void Driver::reportSkip(const char* kind, const std::string& what) {
-    static std::mutex reportedMutex;
+    static AgcDriver::Mutex reportedMutex;
     static std::set<std::size_t> reported;
     static std::map<std::string, int> requestDumps;
 
@@ -50,7 +51,7 @@ void Driver::reportSkip(const char* kind, const std::string& what) {
 }
 
 std::string Driver::dumpRequest(std::uint64_t address, const ShaderRecompiler::RecompileRequest& request, std::string_view suffix) {
-    static std::mutex dumpMutex;
+    static AgcDriver::Mutex dumpMutex;
     static std::set<std::string> dumped;
     char hex[32];
     std::snprintf(hex, sizeof(hex), "%llx", static_cast<unsigned long long>(address));
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
index b69bccd8fe..cccf175abf 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
@@ -1,9 +1,11 @@
 #include "prx/libc/include/general/LogMacros.hpp"
 #include "ControlFlow/GraphBuilder.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/PipelineLibrary.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Diagnostics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "CacheKey.hpp"
@@ -220,6 +222,24 @@ bool CommittedAbi(const ShaderSnapshot& snapshot, std::span<const std::uint64_t>
     return std::ranges::any_of(snapshot.prepared->registeredAbis, [&](const auto& abi) { return std::ranges::equal(abi, key); });
 }
 
+std::optional<std::vector<std::weak_ptr<const ShaderSnapshot>>> CommittedGraphicsAbi(const ShaderSnapshot& owner, std::span<const std::uint64_t> key, const std::shared_ptr<const ShaderRegistry>& registry) {
+    std::unique_lock lock(owner.prepared->mutex);
+    AwaitRegisteredPreparation(*owner.prepared, lock);
+    const auto& abis = owner.prepared->graphicsAbis;
+    const auto found = std::ranges::find_if(abis, [&](const auto& abi) { return std::ranges::equal(abi.key, key) && abi.registry.lock() == registry; });
+    if (found == abis.end()) return std::nullopt;
+    return found->stages;
+}
+
+bool CommittedLink(const ShaderSnapshot& front, const std::shared_ptr<const ShaderSnapshot>& fragment, std::uint32_t primitiveType) {
+    if (primitiveType == 7 || primitiveType == 17) return false;
+    std::unique_lock lock(front.prepared->mutex);
+    AwaitRegisteredPreparation(*front.prepared, lock);
+    const auto& fragments = front.prepared->fragments;
+    if (front.prepared->rectangleRequested || std::ranges::any_of(fragments, [](const auto& entry) { return entry.expired(); })) return false;
+    return fragment == nullptr || std::ranges::any_of(fragments, [&](const auto& entry) { return entry.lock() == fragment; });
+}
+
 }
 
 bool ProgramUsesWorkgroup(const ShaderSnapshot& snapshot, std::size_t codeOffset) {
@@ -236,6 +256,216 @@ bool ProgramUsesWorkgroup(const ShaderSnapshot& snapshot, std::size_t codeOffset
     return used;
 }
 
+namespace {
+
+bool readOnlyMemoryOp(ShaderRecompiler::RdnaOpcode op) {
+    using Op = ShaderRecompiler::RdnaOpcode;
+    switch (op) {
+        case Op::SLoadDword:
+        case Op::SLoadDwordx2:
+        case Op::SLoadDwordx4:
+        case Op::SLoadDwordx8:
+        case Op::SLoadDwordx16:
+        case Op::BufferLoadFormatX:
+        case Op::BufferLoadFormatXy:
+        case Op::BufferLoadFormatXyz:
+        case Op::BufferLoadFormatXyzw:
+        case Op::BufferLoadDword:
+        case Op::BufferLoadDwordx2:
+        case Op::BufferLoadDwordx4:
+        case Op::ImageSample:
+        case Op::ImageSampleLz:
+        case Op::ImageSampleBCl:
+        case Op::ImageSampleBClO:
+        case Op::ImageSampleBO:
+        case Op::ImageSampleC:
+        case Op::ImageSampleCB:
+        case Op::ImageSampleCBCl:
+        case Op::ImageSampleCBClO:
+        case Op::ImageSampleCBO:
+        case Op::ImageSampleCCl:
+        case Op::ImageSampleCClO:
+        case Op::ImageSampleCD:
+        case Op::ImageSampleCDCl:
+        case Op::ImageSampleCDClO:
+        case Op::ImageSampleCDO:
+        case Op::ImageSampleCL:
+        case Op::ImageSampleCLzO:
+        case Op::ImageSampleCLO:
+        case Op::ImageSampleCO:
+        case Op::ImageSampleCl:
+        case Op::ImageSampleClO:
+        case Op::ImageSampleD:
+        case Op::ImageSampleDCl:
+        case Op::ImageSampleDO:
+        case Op::ImageSampleLzO:
+        case Op::ImageSampleO:
+        case Op::ImageSampleCd:
+        case Op::ImageSampleCdCl:
+        case Op::ImageSampleCCd:
+        case Op::ImageSampleCCdCl:
+        case Op::ImageSampleCdO:
+        case Op::ImageSampleCdClO:
+        case Op::ImageSampleCCdO:
+        case Op::ImageSampleCCdClO:
+        case Op::ImageSampleDG16:
+        case Op::ImageSampleDClG16:
+        case Op::ImageSampleCDG16:
+        case Op::ImageSampleCDClG16:
+        case Op::ImageSampleDOG16:
+        case Op::ImageSampleDClOG16:
+        case Op::ImageSampleCDOG16:
+        case Op::ImageSampleCDClOG16:
+        case Op::ImageSampleCdG16:
+        case Op::ImageSampleCdClG16:
+        case Op::ImageSampleCCdG16:
+        case Op::ImageSampleCCdClG16:
+        case Op::ImageSampleCdOG16:
+        case Op::ImageSampleCdClOG16:
+        case Op::ImageSampleCCdOG16:
+        case Op::ImageSampleCCdClOG16:
+        case Op::ImageLoad:
+        case Op::ImageGetResinfo:
+        case Op::SBufferLoadDword:
+        case Op::SBufferLoadDwordx2:
+        case Op::SBufferLoadDwordx4:
+        case Op::SBufferLoadDwordx8:
+        case Op::SBufferLoadDwordx16:
+        case Op::SScratchLoadDword:
+        case Op::SScratchLoadDwordx2:
+        case Op::SScratchLoadDwordx4:
+        case Op::BufferLoadUbyte:
+        case Op::BufferLoadSbyte:
+        case Op::BufferLoadUshort:
+        case Op::BufferLoadSshort:
+        case Op::BufferLoadDwordx3:
+        case Op::BufferLoadUbyteD16:
+        case Op::BufferLoadUbyteD16Hi:
+        case Op::BufferLoadSbyteD16:
+        case Op::BufferLoadSbyteD16Hi:
+        case Op::BufferLoadShortD16:
+        case Op::BufferLoadShortD16Hi:
+        case Op::TbufferLoadFormatX:
+        case Op::TbufferLoadFormatXy:
+        case Op::TbufferLoadFormatXyz:
+        case Op::TbufferLoadFormatXyzw:
+        case Op::TbufferLoadFormatD16X:
+        case Op::TbufferLoadFormatD16Xy:
+        case Op::TbufferLoadFormatD16Xyz:
+        case Op::TbufferLoadFormatD16Xyzw:
+        case Op::BufferLoadFormatD16X:
+        case Op::BufferLoadFormatD16Xy:
+        case Op::BufferLoadFormatD16Xyz:
+        case Op::BufferLoadFormatD16Xyzw:
+        case Op::BufferLoadFormatD16HiX:
+        case Op::FlatLoadUbyte:
+        case Op::FlatLoadSbyte:
+        case Op::FlatLoadUshort:
+        case Op::FlatLoadSshort:
+        case Op::FlatLoadDword:
+        case Op::FlatLoadDwordx2:
+        case Op::FlatLoadDwordx3:
+        case Op::FlatLoadDwordx4:
+        case Op::GlobalLoadDwordAddtid:
+        case Op::FlatLoadUbyteD16:
+        case Op::FlatLoadUbyteD16Hi:
+        case Op::FlatLoadSbyteD16:
+        case Op::FlatLoadSbyteD16Hi:
+        case Op::FlatLoadShortD16:
+        case Op::FlatLoadShortD16Hi:
+        case Op::ImageGetLod:
+        case Op::ImageLoadMip:
+        case Op::ImageLoadPck:
+        case Op::ImageLoadPckSgn:
+        case Op::ImageLoadMipPck:
+        case Op::ImageLoadMipPckSgn:
+        case Op::ImageLoadBy2:
+        case Op::ImageLoadBy4:
+        case Op::ImageLoadMipBy2:
+        case Op::ImageLoadMipBy4:
+        case Op::ImageLoadPck2:
+        case Op::ImageLoadPck4:
+        case Op::ImageLoadMipPck2:
+        case Op::ImageLoadMipPck4:
+        case Op::ImageMsaaLoad:
+        case Op::ImageGather4Lz:
+        case Op::ImageGather4C:
+        case Op::ImageGather4CLz:
+        case Op::ImageGather4LzO:
+        case Op::ImageGather4CO:
+        case Op::ImageGather4CLzO:
+        case Op::ImageGather4h:
+        case Op::ImageGather4hPck:
+        case Op::ImageGather4:
+        case Op::ImageGather4B:
+        case Op::ImageGather4BCl:
+        case Op::ImageGather4BClO:
+        case Op::ImageGather4BO:
+        case Op::ImageGather4Cl:
+        case Op::ImageGather4ClO:
+        case Op::ImageGather4CB:
+        case Op::ImageGather4CBCl:
+        case Op::ImageGather4CBClO:
+        case Op::ImageGather4CBO:
+        case Op::ImageGather4CCl:
+        case Op::ImageGather4CClO:
+        case Op::ImageGather4CL:
+        case Op::ImageGather4CLO:
+        case Op::ImageGather4L:
+        case Op::ImageGather4LO:
+        case Op::ImageGather4O:
+        case Op::ImageBvhIntersectRay:
+        case Op::SGl1Inv:
+        case Op::SDcacheInv:
+        case Op::SDcacheWb:
+        case Op::SMemtime:
+        case Op::SMemrealtime:
+        case Op::SDcacheDiscard:
+        case Op::SDcacheDiscardX2:
+        case Op::BufferGl0Inv:
+        case Op::BufferGl1Inv:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool decodedWritesMemory(std::span<const std::uint32_t> code) {
+    using Family = ShaderRecompiler::RdnaInstructionFamily;
+    using Op = ShaderRecompiler::RdnaOpcode;
+    try {
+        const auto decoded = ShaderRecompiler::RdnaInstructionDecoder{}.Decode(code);
+        return std::any_of(decoded.instructions.begin(), decoded.instructions.end(), [](const auto& instruction) {
+            switch (instruction.family) {
+            case Family::MUBUF: case Family::MTBUF: case Family::FLAT: case Family::MIMG: case Family::SMEM:
+                return !readOnlyMemoryOp(instruction.op);
+            case Family::DS:
+                return instruction.gds || instruction.op == Op::DsGwsInit || instruction.op == Op::DsGwsBarrier || instruction.op == Op::DsGwsSemaV || instruction.op == Op::DsGwsSemaP || instruction.op == Op::DsGwsSemaBr || instruction.op == Op::DsGwsSemaReleaseAll || instruction.op == Op::DsOrderedCount || instruction.op == Op::DsAppend || instruction.op == Op::DsConsume;
+            case Family::Unknown:
+                return true;
+            default:
+                return instruction.op == Op::SSetpcB64 || instruction.op == Op::SSwappcB64 || instruction.op == Op::SRfeB64;
+            }
+        });
+    } catch (const std::exception&) {
+        return true;
+    }
+}
+
+}
+
+bool ProgramWritesMemory(const ShaderSnapshot& snapshot, std::size_t codeOffset) {
+    constexpr std::uint8_t Unknown = 0, Reads = 1, Writes = 2;
+    if (codeOffset == 0) {
+        const auto cached = snapshot.memoryWrites->load(std::memory_order_acquire);
+        if (cached != Unknown) return cached == Writes;
+    }
+    if (codeOffset > snapshot.code.size()) return true;
+    const bool writes = decodedWritesMemory(std::span(snapshot.code).subspan(codeOffset));
+    if (codeOffset == 0) snapshot.memoryWrites->store(writes ? Writes : Reads, std::memory_order_release);
+    return writes;
+}
+
 std::uint32_t PositionExportLayout(const ShaderSnapshot* snapshot, std::size_t codeOffset, std::span<const std::uint32_t> code, std::uint32_t paClVsOutCntl, const ShaderSnapshot* continuation) {
     constexpr std::uint8_t Unknown = 0, Unused = 1, Used = 2;
     const auto bits = paClVsOutCntl & Graphics::PositionExportLayoutBits;
@@ -351,6 +581,10 @@ const PreparedShaderState& ShaderPreparationTransaction::Read(const ShaderSnapsh
     return changes.emplace(snapshot.prepared.get(), State::Change{snapshot.prepared, *snapshot.prepared, false, snapshot.prepared->entries.size(), snapshot.prepared->registeredAbis.size()}).first->second.prepared;
 }
 
+bool ShaderPreparationTransaction::Tracks(const ShaderSnapshot& snapshot) const {
+    return root->changes.contains(snapshot.prepared.get());
+}
+
 void ShaderPreparationTransaction::Hold() {
     require(!committed, "shader preparation transaction is already committed");
     root->Hold();
@@ -591,6 +825,65 @@ void PublishRegisteredShader(std::shared_ptr<ShaderRegistry>& registry, const st
 
 namespace {
 
+bool LazyShaderPreparation() {
+    static const bool lazy = std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr;
+    return lazy;
+}
+
+using PreparedAtUse = std::optional<std::vector<const ShaderRecompiler::SourceHandle*>>;
+
+PreparedAtUse PrepareDeferredAbis(const ShaderSnapshot& snapshot, std::unique_lock<std::mutex>& lock);
+
+struct DeferredAbiUseCounters {
+    std::atomic<std::uint64_t> firstUses{0};
+    std::atomic<std::uint64_t> found{0};
+    std::atomic<std::uint64_t> own{0};
+    std::atomic<std::uint64_t> entries{0};
+    std::atomic<std::uint64_t> matchedEntries{0};
+    std::atomic<std::int64_t> lastReport{0};
+};
+
+DeferredAbiUseCounters& DeferredAbiCounters() {
+    static DeferredAbiUseCounters counters;
+    return counters;
+}
+
+void ReportDeferredAbiUses() {
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (!profile) return;
+    auto& counters = DeferredAbiCounters();
+    const auto now = std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now().time_since_epoch()).count();
+    auto previous = counters.lastReport.load(std::memory_order_relaxed);
+    if ((previous != 0 && now - previous < 60000) || !counters.lastReport.compare_exchange_strong(previous, now, std::memory_order_relaxed)) return;
+    const auto entries = counters.entries.load(std::memory_order_relaxed);
+    const auto matched = counters.matchedEntries.load(std::memory_order_relaxed);
+    AgcDriver::ProfilePrint_nid_no_patch("[shaders] deferred ABIs: %llu prepared at first use, %llu found their artifact there, %llu prepared their own; %llu of the %llu entries prepared from them never matched a use\n", static_cast<unsigned long long>(counters.firstUses.load(std::memory_order_relaxed)), static_cast<unsigned long long>(counters.found.load(std::memory_order_relaxed)), static_cast<unsigned long long>(counters.own.load(std::memory_order_relaxed)), static_cast<unsigned long long>(entries - std::min(entries, matched)), static_cast<unsigned long long>(entries));
+}
+
+void NoteMatchedEntry(PreparedShaders::Entry& entry, const PreparedAtUse& preparedAtUse) {
+    auto& counters = DeferredAbiCounters();
+    bool changed = false;
+    if (entry.fromDeferredAbi && !entry.matched) {
+        entry.matched = true;
+        counters.matchedEntries.fetch_add(1, std::memory_order_relaxed);
+        changed = true;
+    }
+    if (preparedAtUse) {
+        counters.firstUses.fetch_add(1, std::memory_order_relaxed);
+        if (std::ranges::find(*preparedAtUse, entry.handle.get()) != preparedAtUse->end()) counters.found.fetch_add(1, std::memory_order_relaxed);
+        changed = true;
+    }
+    if (changed) ReportDeferredAbiUses();
+}
+
+void NoteOwnPreparation(const PreparedAtUse& preparedAtUse) {
+    if (!preparedAtUse) return;
+    auto& counters = DeferredAbiCounters();
+    counters.firstUses.fetch_add(1, std::memory_order_relaxed);
+    counters.own.fetch_add(1, std::memory_order_relaxed);
+    ReportDeferredAbiUses();
+}
+
 void ReportPreparedAtUse(const ShaderSnapshot& snapshot, const ShaderRecompiler::RecompileRequest& request) {
     if (request.context.convertedSamples) {
         APS5_LOG_OUT_DEBUG("Shader 0x%llx samples a converted image; preparing its converted-sample variant at use", static_cast<unsigned long long>(request.shader.codeAddress));
@@ -626,9 +919,15 @@ std::shared_ptr<const ShaderRecompiler::SourceHandle> SourceHandleFor(const Shad
     ShaderRecompiler::BuildPreparedShaderKey(request, key);
     std::unique_lock lock(snapshot.prepared->mutex);
     AwaitRegisteredPreparation(*snapshot.prepared, lock);
-    for (const auto& entry : snapshot.prepared->entries) {
-        if (entry.codeOffset == codeOffset && ShaderRecompiler::MatchesPreparedShader(request, *entry.handle, key)) return entry.handle;
+    PreparedAtUse preparedAtUse;
+    if (!snapshot.prepared->deferredAbis.empty() || snapshot.prepared->deferredPreparing) preparedAtUse = PrepareDeferredAbis(snapshot, lock);
+    for (auto& entry : snapshot.prepared->entries) {
+        if (entry.codeOffset == codeOffset && ShaderRecompiler::MatchesPreparedShader(request, *entry.handle, key)) {
+            NoteMatchedEntry(entry, preparedAtUse);
+            return entry.handle;
+        }
     }
+    NoteOwnPreparation(preparedAtUse);
     ReportPreparedAtUse(snapshot, request);
     auto handle = PrepareShaderWithDiagnostics(request);
     snapshot.prepared->entries.push_back({codeOffset, handle});
@@ -779,12 +1078,18 @@ ShaderRecompiler::PreparedShaderInvocation InvocationFor(const ShaderSnapshot& s
     struct PreparedKeyStorage {};
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, PreparedKeyStorage>();
     ShaderRecompiler::BuildPreparedShaderKey(source, key);
-    for (const auto& entry : snapshot.prepared->entries) {
+    PreparedAtUse preparedAtUse;
+    if (!snapshot.prepared->deferredAbis.empty() || snapshot.prepared->deferredPreparing) preparedAtUse = PrepareDeferredAbis(snapshot, lock);
+    for (auto& entry : snapshot.prepared->entries) {
         if (entry.codeOffset != codeOffset) continue;
         invocationRequest.shader.code = ShaderRecompiler::GetPreparedCode(*entry.handle);
         if (!linked.code.empty() && !std::ranges::equal(invocationRequest.shader.code, linked.code)) continue;
-        if (auto invocation = ShaderRecompiler::PreparedShaderInvocation::TryCreate(invocationRequest, entry.handle, key)) return std::move(*invocation);
+        if (auto invocation = ShaderRecompiler::PreparedShaderInvocation::TryCreate(invocationRequest, entry.handle, key)) {
+            NoteMatchedEntry(entry, preparedAtUse);
+            return std::move(*invocation);
+        }
     }
+    NoteOwnPreparation(preparedAtUse);
     ReportPreparedAtUse(snapshot, source);
     auto handle = PrepareShaderWithDiagnostics(source);
     invocationRequest = source;
@@ -1071,6 +1376,60 @@ std::vector<PreparedShaders::Entry> PrepareRegistered(const ShaderSnapshot& snap
     return plan != nullptr ? PrepareRegistered(*plan) : std::vector<PreparedShaders::Entry>{};
 }
 
+PreparedAtUse PrepareDeferredAbis(const ShaderSnapshot& snapshot, std::unique_lock<std::mutex>& lock) {
+    auto& prepared = *snapshot.prepared;
+    if (prepared.deferredPreparing) {
+        prepared.settled.wait(lock, [&] { return !prepared.deferredPreparing; });
+        return std::nullopt;
+    }
+    if (prepared.deferredAbis.empty()) return std::nullopt;
+    std::vector<PreparedShaders::DeferredAbi> deferred;
+    deferred.swap(prepared.deferredAbis);
+    prepared.deferredPreparing = true;
+    struct Preparing {
+        PreparedShaders& prepared;
+        std::unique_lock<std::mutex>& lock;
+        ~Preparing() {
+            if (!lock.owns_lock()) lock.lock();
+            prepared.deferredPreparing = false;
+            prepared.settled.notify_all();
+        }
+    } preparing{prepared, lock};
+    lock.unlock();
+    std::vector<PreparedShaders::Entry> entries;
+    for (const auto& abi : deferred) {
+        const auto device = abi.device.lock();
+        if (device == nullptr || snapshot.registeredState == nullptr) continue;
+        QueueState state{};
+        state.shader = snapshot.registeredState->shader;
+        state.context = snapshot.registeredState->context;
+        state.userConfig = snapshot.registeredState->userConfig;
+        for (const auto& [offset, value] : abi.context) state.context[offset] = value;
+        for (const auto& [offset, value] : abi.primitive) state.userConfig[offset] = value;
+        try {
+            const auto plan = PlanRegistered(snapshot, *device, state, false);
+            if (plan == nullptr) continue;
+            plan->prebuildDevice = device;
+            auto made = PrepareRegistered(*plan);
+            std::ranges::move(made, std::back_inserter(entries));
+        } catch (const std::exception& error) {
+            APS5_LOG_ERR("Shader 0x%llx could not be prepared at its first use for its resolved ABI (%s); preparing it for the use instead", static_cast<unsigned long long>(snapshot.codeAddress), error.what());
+            continue;
+        }
+    }
+    lock.lock();
+    std::vector<const ShaderRecompiler::SourceHandle*> added;
+    for (auto& entry : entries) {
+        const auto duplicate = std::ranges::any_of(prepared.entries, [&](const auto& existing) { return existing.codeOffset == entry.codeOffset && existing.handle->artifact == entry.handle->artifact; });
+        if (duplicate) continue;
+        entry.fromDeferredAbi = true;
+        added.push_back(entry.handle.get());
+        prepared.entries.push_back(std::move(entry));
+    }
+    DeferredAbiCounters().entries.fetch_add(added.size(), std::memory_order_relaxed);
+    return added;
+}
+
 void DeferPipelineStage(PreparedShaderState& prepared, const ShaderSnapshot& snapshot, const char* reason) {
     if (!prepared.deferred) APS5_LOG_ERR("Shader 0x%llx could not be prepared when the title created its pipeline (%s); preparing it when it is used", static_cast<unsigned long long>(snapshot.codeAddress), reason);
     prepared.deferred = true;
@@ -1146,9 +1505,8 @@ public:
             Closing() = true;
             pools = {Existing(), ExistingPrebuild()};
         }
-        for (auto* pool : pools) {
-            if (pool != nullptr) pool->Close();
-        }
+        if (pools[0] != nullptr) pools[0]->Close(false);
+        if (pools[1] != nullptr) pools[1]->Close(true);
     }
 
 private:
@@ -1204,11 +1562,17 @@ public:
         idle.wait(lock, [&] { return unfinished.empty() || *unfinished.begin() > ticket; });
     }
 
-    void Close() {
+    void Close(bool dropQueued) {
         std::vector<Worker> joined;
+        std::deque<Task> dropped;
         {
             std::unique_lock lock(mutex);
             closed = true;
+            if (dropQueued) {
+                dropped.swap(tasks);
+                for (const auto& task : dropped) unfinished.erase(task.sequence);
+                idle.notify_all();
+            }
             idle.wait(lock, [&] { return tasks.empty() && running == 0; });
             joined.swap(workers);
         }
@@ -1338,7 +1702,7 @@ void PrepareRegisteredInBackground(std::shared_ptr<const ShaderSnapshot> snapsho
         try {
             entries = PrepareRegistered(*plan);
         } catch (const std::exception& error) {
-            APS5_LOG_ERR("Shader 0x%llx could not be prepared after registration: %s", static_cast<unsigned long long>(snapshot->codeAddress), error.what());
+            APS5_LOG_ERR("Shader 0x%llx snapshot=0x%llx could not be prepared after registration: %s", static_cast<unsigned long long>(snapshot->codeAddress), static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(snapshot.get())), error.what());
             failure = std::current_exception();
         } catch (...) {
             failure = std::current_exception();
@@ -1435,7 +1799,10 @@ std::vector<PreparedGraphicsStage> PrepareGraphicsStages(const DrawDecode& decod
             prepared.push_back({program.snapshot, {program.codeOffset, nullptr}, program.binary.stage, offset, nullptr});
             continue;
         }
-        if (vertex) vertex->paClVsOutCntl = PositionExportLayout(program.snapshot.get(), program.codeOffset, program.binary.code, decoded.state.paClVsOutCntl, program.tailContinuation.get()) | decoded.state.layerExports;
+        if (vertex) {
+            vertex->paClVsOutCntl = PositionExportLayout(program.snapshot.get(), program.codeOffset, program.binary.code, decoded.state.paClVsOutCntl, program.tailContinuation.get()) | decoded.state.layerExports;
+            Graphics::ApplyPointSize(decoded.state, *vertex);
+        }
         ShaderRecompiler::RecompileRequest request{program.binary, {wave, program.firstUserSgpr, program.userData, {}, fragment ? std::optional(decoded.pixel) : std::nullopt, vertex, memory, RegisteredFloatMode(*program.snapshot)}, target, {0, 0, offset, room}, ShaderRecompiler::GraphicsCompileContext{program.firstUserSgpr, linked, decoded.state.stages.mesh, decoded.state.stages.tessellation, {}}};
         std::vector<std::uint64_t> key;
         ShaderRecompiler::BuildPreparedShaderKey(request, key);
@@ -1531,14 +1898,23 @@ void Driver::ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, GraphicsAbiKeyStorage>();
     BuildRegisteredAbiKey(state, *localDevice, key);
     const auto primitiveType = state.userConfig.find(0x242u);
-    for (const auto& abi : transaction.Read(*owner).graphicsAbis) {
-        if (abi.key != key || abi.registry.lock() != registry) continue;
-        for (const auto& stage : abi.stages) {
+    const auto resolveStages = [&](const std::vector<std::weak_ptr<const ShaderSnapshot>>& stages) {
+        for (const auto& stage : stages) {
             const auto snapshot = stage.lock();
             require(snapshot != nullptr, "prepared graphics ABI lost a registered stage");
             if (snapshot->type != 1) ResolvePreparedGraphics(*snapshot, {}, primitiveType == state.userConfig.end() ? 0u : primitiveType->second, localDevice->Target(), true);
         }
         transaction.Commit();
+    };
+    if (!transaction.Tracks(*owner)) {
+        if (const auto committed = CommittedGraphicsAbi(*owner, key, registry)) {
+            resolveStages(*committed);
+            return;
+        }
+    }
+    for (const auto& abi : transaction.Read(*owner).graphicsAbis) {
+        if (abi.key != key || abi.registry.lock() != registry) continue;
+        resolveStages(abi.stages);
         return;
     }
     DrawDecode decoded{};
@@ -1574,6 +1950,55 @@ void Driver::ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std
     transaction.Commit();
 }
 
+std::size_t Driver::PreparedEntries(const Shader* shader) {
+    std::shared_ptr<const ShaderSnapshot> snapshot;
+    {
+        std::lock_guard lock(mutex);
+        if (shaders == nullptr) return 0;
+        snapshot = RegisteredHeader(*shaders, shader);
+    }
+    if (snapshot == nullptr) return 0;
+    std::unique_lock lock(snapshot->prepared->mutex);
+    AwaitRegisteredPreparation(*snapshot->prepared, lock);
+    return snapshot->prepared->entries.size();
+}
+
+Driver::DeferredAbiUseCounts Driver::DeferredAbiUses() {
+    auto& counters = DeferredAbiCounters();
+    const auto entries = counters.entries.load(std::memory_order_relaxed);
+    const auto matched = counters.matchedEntries.load(std::memory_order_relaxed);
+    return {counters.firstUses.load(std::memory_order_relaxed), counters.found.load(std::memory_order_relaxed), counters.own.load(std::memory_order_relaxed), entries, entries - std::min(entries, matched)};
+}
+
+std::vector<std::array<std::uint64_t, 2>> Driver::PreparedEntryHashes(const Shader* shader) {
+    std::shared_ptr<const ShaderSnapshot> snapshot;
+    {
+        std::lock_guard lock(mutex);
+        if (shaders == nullptr) return {};
+        snapshot = RegisteredHeader(*shaders, shader);
+    }
+    if (snapshot == nullptr) return {};
+    std::unique_lock lock(snapshot->prepared->mutex);
+    AwaitRegisteredPreparation(*snapshot->prepared, lock);
+    std::vector<std::array<std::uint64_t, 2>> hashes;
+    for (const auto& entry : snapshot->prepared->entries) {
+        if (entry.handle == nullptr || entry.handle->artifact == nullptr) continue;
+        const auto hash = entry.handle->artifact->artifact.spirv.ContentHash();
+        std::uint64_t key = 0xcbf29ce484222325ull;
+        for (const auto word : entry.handle->staticKey) key = (key ^ word) * 0x100000001b3ull;
+        hashes.push_back({hash.low, hash.high ^ key});
+    }
+    std::ranges::sort(hashes);
+    return hashes;
+}
+
+std::array<std::uint64_t, 4> Driver::PrebuiltLibraries() {
+    if (auto* pool = RegistrationPreparePool::ExistingPrebuild()) pool->AwaitSubmitted();
+    const auto localDevice = device.Load();
+    if (localDevice == nullptr) return {};
+    return Graphics::PipelineLibraryCountersOf(localDevice->Device()).built;
+}
+
 void Driver::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) {
     BindTitleThread();
     PerformanceContext timingContext(FrameTiming::Preparation());
@@ -1611,6 +2036,31 @@ void Driver::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegist
     struct RegisteredAbiKeyStorage {};
     auto& key = HostThreadLocal<std::vector<std::uint64_t>, RegisteredAbiKeyStorage>();
     BuildRegisteredAbiKey(state, *localDevice, key);
+    if (LazyShaderPreparation()) {
+        const auto& resolved = transaction.Read(*snapshot).registeredAbis;
+        if (std::ranges::find(resolved, key) != resolved.end()) {
+            transaction.Commit();
+            return;
+        }
+        std::optional<std::string> invalid;
+        try {
+            static_cast<void>(PlanRegistered(*snapshot, *localDevice, state, false));
+        } catch (const std::exception& error) {
+            invalid = error.what();
+        }
+        auto& prepared = transaction.Edit(*snapshot);
+        if (invalid) DeferPipelineStage(prepared, *snapshot, invalid->c_str());
+        prepared.registeredAbis.push_back(key);
+        prepared.deferred = true;
+        transaction.Commit();
+        if (invalid) return;
+        PreparedShaders::DeferredAbi deferred{key, {}, {}, localDevice};
+        for (const auto reg : context) deferred.context.emplace_back(reg.offset, reg.value);
+        for (const auto reg : primitive) deferred.primitive.emplace_back(reg.offset, reg.value);
+        std::lock_guard lock(snapshot->prepared->mutex);
+        snapshot->prepared->deferredAbis.push_back(std::move(deferred));
+        return;
+    }
     std::optional<std::string> deferral;
     const auto prepare = [&] {
         try {
@@ -1624,6 +2074,10 @@ void Driver::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegist
         }
     };
     const bool committedAbi = CommittedAbi(*snapshot, key);
+    if (committedAbi && !transaction.Tracks(*snapshot)) {
+        transaction.Commit();
+        return;
+    }
     auto entries = committedAbi ? std::vector<PreparedShaders::Entry>{} : prepare();
     const auto& registeredAbis = transaction.Read(*snapshot).registeredAbis;
     if (std::ranges::find(registeredAbis, key) != registeredAbis.end()) {
@@ -1657,6 +2111,37 @@ std::uint64_t NullPixelProgramAddress() {
     return reinterpret_cast<std::uintptr_t>(NullPixelCode);
 }
 
+alignas(256) static const std::uint32_t DepthCopyMultisamplePixelCode[64] = {0x360604ffu, 0x0000ffffu, 0x2c080490u, 0x7e0a0208u, 0xf0000130u, 0x00000603u, 0xbf8c3f70u, 0xf8001801u, 0x00000006u, 0xbf810000u};
+alignas(256) static const std::uint32_t DepthCopySinglePixelCode[64] = {0x360604ffu, 0x0000ffffu, 0x2c080490u, 0xf0000108u, 0x00000603u, 0xbf8c3f70u, 0xf8001801u, 0x00000006u, 0xbf810000u};
+static const Shader DepthCopyMultisamplePixelShader = [] {
+    Shader shader{};
+    shader.file_header = 0x34333231u;
+    shader.version = 0x18u;
+    shader.code = DepthCopyMultisamplePixelCode;
+    shader.header_size = sizeof(Shader);
+    shader.shader_size = sizeof(DepthCopyMultisamplePixelCode);
+    shader.type = 1;
+    return shader;
+}();
+static const Shader DepthCopySinglePixelShader = [] {
+    Shader shader{};
+    shader.file_header = 0x34333231u;
+    shader.version = 0x18u;
+    shader.code = DepthCopySinglePixelCode;
+    shader.header_size = sizeof(Shader);
+    shader.shader_size = sizeof(DepthCopySinglePixelCode);
+    shader.type = 1;
+    return shader;
+}();
+
+std::uint64_t DepthCopyPixelProgramAddress(bool multisampled) {
+    return reinterpret_cast<std::uintptr_t>(multisampled ? DepthCopyMultisamplePixelCode : DepthCopySinglePixelCode);
+}
+
+std::uint32_t DepthCopyPixelUserWords(bool multisampled) {
+    return multisampled ? 9u : 8u;
+}
+
 void Driver::ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) {
     BindTitleThread();
     PerformanceContext timingContext(FrameTiming::Preparation());
@@ -1709,6 +2194,10 @@ void ResolvePreparedGraphics(const ShaderSnapshot& front, const std::shared_ptr<
             return;
         }
     }
+    if (!transaction.Tracks(front) && CommittedLink(front, fragment, primitiveType)) {
+        transaction.Commit();
+        return;
+    }
     std::vector<std::shared_ptr<const ShaderSnapshot>> fragments;
     {
         const auto& current = transaction.Read(front);
@@ -1793,6 +2282,25 @@ ShaderSnapshot PrepareNullPixelProgram(const VulkanDevice& device) {
     return null;
 }
 
+ShaderSnapshot PrepareDepthCopyPixelProgram(bool multisampled) {
+    const auto& shader = multisampled ? DepthCopyMultisamplePixelShader : DepthCopySinglePixelShader;
+    const auto* code = multisampled ? DepthCopyMultisamplePixelCode : DepthCopySinglePixelCode;
+    ShaderSnapshot copy{DepthCopyPixelProgramAddress(multisampled), reinterpret_cast<std::uintptr_t>(&shader), shader.type, {}, {}};
+    copy.code.assign(code, code + 64);
+    copy.header.resize(sizeof(Shader));
+    std::memcpy(copy.header.data(), &shader, sizeof(Shader));
+    auto state = DecodeRegisteredState(copy);
+    state.shader.insert_or_assign(0x008u, static_cast<std::uint32_t>(copy.codeAddress >> 8u));
+    state.shader.insert_or_assign(0x009u, static_cast<std::uint32_t>(copy.codeAddress >> 40u));
+    state.shader.insert_or_assign(0x00bu, DepthCopyPixelUserWords(multisampled) << 1u);
+    state.context.insert_or_assign(0x1b3u, 0x8002u);
+    state.context.insert_or_assign(0x1b4u, 0x8002u);
+    state.context.insert_or_assign(0x1c5u, 1u);
+    copy.registeredState = std::make_shared<const RegisteredShaderState>(std::move(state));
+    copy.prepared->deferred = true;
+    return copy;
+}
+
 std::shared_ptr<const ShaderRegistry> Driver::RegisteredShaders() {
     std::lock_guard lock(mutex);
     return shaders;
@@ -1846,13 +2354,24 @@ void Driver::RegisterShader(const Shader* shader) {
         localDevice = device;
     }
     snapshot.registeredState = std::make_shared<const RegisteredShaderState>(DecodeRegisteredState(snapshot));
+    {
+        std::lock_guard lock(mutex);
+        if (shaders != nullptr) {
+            if (const auto found = shaders->find(snapshot.codeAddress); found != shaders->end()) {
+                for (const auto& current : found->second) {
+                    if (current->registeredState == nullptr || current->type != snapshot.type || current->code != snapshot.code || *current->registeredState != *snapshot.registeredState) continue;
+                    snapshot.registeredState = current->registeredState;
+                    break;
+                }
+            }
+        }
+    }
     QueueState registered{};
     registered.shader = snapshot.registeredState->shader;
     registered.context = snapshot.registeredState->context;
     registered.userConfig = snapshot.registeredState->userConfig;
     std::shared_ptr<RegisteredPreparation> preparation;
-    static const bool lazy = std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr;
-    if (lazy) {
+    if (LazyShaderPreparation()) {
         static_cast<void>(PlanRegistered(snapshot, *localDevice, registered, true, &snapshot.prepared->deferred));
         snapshot.prepared->deferred = true;
     } else if (AsyncRegistrationPrepare()) {
@@ -1890,6 +2409,9 @@ void Driver::RegisterShader(const Shader* shader) {
     if (shaders->find(NullPixelProgramAddress()) == shaders->end()) {
         PublishRegisteredShader(shaders, std::make_shared<const ShaderSnapshot>(PrepareNullPixelProgram(*localDevice)));
     }
+    for (const bool multisampled : {false, true}) {
+        if (shaders->find(DepthCopyPixelProgramAddress(multisampled)) == shaders->end()) PublishRegisteredShader(shaders, std::make_shared<const ShaderSnapshot>(PrepareDepthCopyPixelProgram(multisampled)));
+    }
     transaction.Commit();
     if (preparation != nullptr) PrepareRegisteredInBackground(published, std::move(preparation));
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp
index 858cada5e4..b43a5c49b2 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp
@@ -2,14 +2,20 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/DeferredLabels.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/SynchronizationStatistics.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/HostThreadSlot.hpp"
 #include "ThreadOwned.hpp"
 #include <cstdlib>
 
 namespace AgcDriver::DriverDetail {
 
 DeferredLabels& deferredLabels() {
-    static thread_local DeferredLabels* deferred = nullptr;
-    return ShaderRecompiler::ThreadOwned(deferred);
+    struct Slot {};
+    auto* deferred = HostThreadSlot<DeferredLabels*, Slot>::Get();
+    if (deferred == nullptr) {
+        ShaderRecompiler::ThreadOwned(deferred);
+        HostThreadSlot<DeferredLabels*, Slot>::Set(deferred);
+    }
+    return *deferred;
 }
 
 bool DeferLabels() {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/LabelHistory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/LabelHistory.cpp
index 2720b91265..fe15539222 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/LabelHistory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/LabelHistory.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <cstdlib>
 #include <cstring>
 #include <string_view>
@@ -60,7 +61,7 @@ void Driver::traceLabel(std::span<const std::uint32_t> packet, std::uint32_t que
     }
     if (kind == nullptr) return;
     if (std::string_view(kind) != "WAIT_REG_MEM") {
-        static std::mutex historyMutex;
+        static AgcDriver::Mutex historyMutex;
         std::lock_guard lock(historyMutex);
         auto& entry = writeHistory()[writeCursor()++ % writeHistory().size()];
         entry = {target, length, queue, opcode};
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp
index 6aead1a2cc..f1b7df1757 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp
@@ -322,6 +322,7 @@ void Driver::waitMemory(std::span<const std::uint32_t> packet, std::uint32_t que
 
     if (entryTryFailed && pollService(false)) return;
 
+    noteWaitFields(queue, packet);
     noteWaitBlocked(queue, awaited, true);
     struct BlockedWait {
         Driver& driver;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp
new file mode 100644
index 0000000000..7505860321
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameCapture.cpp
@@ -0,0 +1,455 @@
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include <zstd.h>
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstring>
+#include <future>
+#include <iterator>
+#include <stdexcept>
+#include <system_error>
+#include <thread>
+
+namespace AgcDriver {
+namespace {
+
+static_assert(std::endian::native == std::endian::little, "frame captures are stored in little-endian order");
+
+constexpr std::size_t ChunkHeaderBytes = 64;
+
+void requireCapture(bool condition, const std::string& reason) {
+    if (!condition) throw std::runtime_error("frame capture: " + reason);
+}
+
+class Encoder {
+public:
+    template <typename TValue>
+    void Put(TValue value) {
+        const auto at = bytes.size();
+        bytes.resize(at + sizeof(TValue));
+        std::memcpy(bytes.data() + at, &value, sizeof(TValue));
+    }
+
+    std::vector<std::byte> bytes;
+};
+
+class Decoder {
+public:
+    explicit Decoder(std::span<const std::byte> bytes) : bytes(bytes) {}
+
+    template <typename TValue>
+    TValue Take(const char* what) {
+        requireCapture(sizeof(TValue) <= bytes.size() - at, std::string("record ends inside ") + what);
+        TValue value{};
+        std::memcpy(&value, bytes.data() + at, sizeof(TValue));
+        at += sizeof(TValue);
+        return value;
+    }
+
+    std::size_t Count(std::size_t elementBytes, const char* what) {
+        const auto count = Take<std::uint32_t>(what);
+        requireCapture(count <= (bytes.size() - at) / elementBytes, std::string("count of ") + what + " exceeds its record");
+        return count;
+    }
+
+    bool Done() const { return at == bytes.size(); }
+
+private:
+    std::span<const std::byte> bytes;
+    std::size_t at = 0;
+};
+
+void putRegisters(Encoder& encoder, const std::vector<ShaderRegister>& registers) {
+    encoder.Put(static_cast<std::uint32_t>(registers.size()));
+    for (const auto& value : registers) {
+        encoder.Put(value.offset);
+        encoder.Put(value.value);
+    }
+}
+
+std::vector<ShaderRegister> takeRegisters(Decoder& decoder) {
+    std::vector<ShaderRegister> registers(decoder.Count(8, "registers"));
+    for (auto& value : registers) {
+        value.offset = decoder.Take<std::uint32_t>("register offset");
+        value.value = decoder.Take<std::uint32_t>("register value");
+    }
+    return registers;
+}
+
+std::vector<std::byte> encodeCall(const FrameCall& call) {
+    Encoder encoder;
+    encoder.Put(call.ordinal);
+    encoder.Put(call.timeNs);
+    encoder.Put(call.thread);
+    encoder.Put(call.accepted);
+    encoder.Put(call.completed);
+    encoder.Put(call.queue);
+    encoder.Put(call.flags);
+    encoder.Put(static_cast<std::uint32_t>(call.cpuFlip ? 1u : 0u));
+    encoder.Put(call.address);
+    encoder.Put(call.size);
+    encoder.Put(static_cast<std::uint32_t>(call.values.size()));
+    for (const auto value : call.values) encoder.Put(value);
+    putRegisters(encoder, call.context);
+    putRegisters(encoder, call.primitive);
+    return std::move(encoder.bytes);
+}
+
+FrameCall decodeCall(FrameCallKind kind, std::span<const std::byte> payload) {
+    Decoder decoder(payload);
+    FrameCall call;
+    call.kind = kind;
+    call.ordinal = decoder.Take<std::uint64_t>("ordinal");
+    call.timeNs = decoder.Take<std::uint64_t>("time");
+    call.thread = decoder.Take<std::uint64_t>("thread");
+    call.accepted = decoder.Take<std::uint64_t>("accepted serial");
+    call.completed = decoder.Take<std::uint64_t>("completed serial");
+    call.queue = decoder.Take<std::uint32_t>("queue");
+    call.flags = decoder.Take<std::uint32_t>("flags");
+    const auto cpuFlip = decoder.Take<std::uint32_t>("cpu flip");
+    requireCapture(cpuFlip <= 1, "cpu flip is not 0 or 1");
+    call.cpuFlip = cpuFlip == 1;
+    call.address = decoder.Take<std::uint64_t>("address");
+    call.size = decoder.Take<std::uint64_t>("size");
+    call.values.resize(decoder.Count(8, "values"));
+    for (auto& value : call.values) value = decoder.Take<std::uint64_t>("value");
+    call.context = takeRegisters(decoder);
+    call.primitive = takeRegisters(decoder);
+    requireCapture(decoder.Done(), "call record has trailing bytes");
+    return call;
+}
+
+bool knownCall(std::uint32_t kind) {
+    return kind >= static_cast<std::uint32_t>(FrameCallKind::RegisterShader) && kind <= static_cast<std::uint32_t>(FrameCallKind::UnregisterVideoOutput);
+}
+
+std::vector<std::byte> readFile(const std::filesystem::path& path) {
+    std::ifstream file(path, std::ios::binary);
+    requireCapture(file.is_open(), "cannot open " + path.string());
+    std::vector<std::byte> bytes;
+    file.seekg(0, std::ios::end);
+    bytes.resize(static_cast<std::size_t>(file.tellg()));
+    file.seekg(0);
+    file.read(reinterpret_cast<char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+    requireCapture(file.good() || bytes.empty(), "cannot read " + path.string());
+    return bytes;
+}
+
+void requireMagic(std::span<const std::byte> bytes, std::string_view magic, const std::filesystem::path& path) {
+    requireCapture(bytes.size() >= magic.size() && std::memcmp(bytes.data(), magic.data(), magic.size()) == 0, path.string() + " is not a frame capture file");
+}
+
+struct Run {
+    std::uint64_t address;
+    std::span<const std::byte> bytes;
+};
+
+}
+
+bool AllZero(std::span<const std::byte> bytes) {
+    constexpr std::size_t Word = sizeof(std::uint64_t);
+    std::size_t at = 0;
+    for (; at + Word <= bytes.size(); at += Word) {
+        std::uint64_t value = 0;
+        std::memcpy(&value, bytes.data() + at, Word);
+        if (value != 0) return false;
+    }
+    return std::all_of(bytes.begin() + static_cast<std::ptrdiff_t>(at), bytes.end(), [](std::byte value) { return value == std::byte{0}; });
+}
+
+std::string_view FrameCallName(FrameCallKind kind) {
+    switch (kind) {
+    case FrameCallKind::RegisterShader: return "register-shader";
+    case FrameCallKind::ResolveShaderAbi: return "resolve-shader-abi";
+    case FrameCallKind::ResolveGraphicsAbi: return "resolve-graphics-abi";
+    case FrameCallKind::ResolveGraphicsStagesAbi: return "resolve-graphics-stages-abi";
+    case FrameCallKind::RegisterVideoOutput: return "register-video-output";
+    case FrameCallKind::UnregisterVideoOutput: return "unregister-video-output";
+    case FrameCallKind::SetTessellationFactorRing: return "set-tf-ring";
+    case FrameCallKind::Submit: return "submit";
+    case FrameCallKind::Flip: return "flip";
+    case FrameCallKind::ReserveEopFlip: return "reserve-eop-flip";
+    case FrameCallKind::Suspend: return "suspend";
+    case FrameCallKind::Memory: return "memory";
+    case FrameCallKind::FrameStart: return "frame-start";
+    case FrameCallKind::End: return "end";
+    case FrameCallKind::DisplayBuffer: return "display-buffer";
+    }
+    throw std::runtime_error("frame capture: unknown call kind " + std::to_string(static_cast<std::uint32_t>(kind)));
+}
+
+FrameCaptureWriter::FrameCaptureWriter(const std::filesystem::path& directory, int level) : directory(directory), level(level) {
+    std::error_code error;
+    std::filesystem::create_directories(directory, error);
+    requireCapture(!error && std::filesystem::is_directory(directory), "cannot create the directory " + directory.string());
+    for (const auto name : {CallsName, MemoryName, HeaderName}) std::filesystem::remove(directory / name, error);
+    calls.open(directory / CallsName, std::ios::binary | std::ios::trunc);
+    memory.open(directory / MemoryName, std::ios::binary | std::ios::trunc);
+    requireCapture(calls.is_open() && memory.is_open(), "cannot create the capture files in " + directory.string());
+    calls.write(CallsMagic.data(), static_cast<std::streamsize>(CallsMagic.size()));
+    memory.write(MemoryMagic.data(), static_cast<std::streamsize>(MemoryMagic.size()));
+    requireCapture(calls.good() && memory.good(), "cannot write the capture files in " + directory.string());
+}
+
+void FrameCaptureWriter::WriteCall(const FrameCall& call) {
+    FrameCallName(call.kind);
+    const auto payload = encodeCall(call);
+    requireCapture(payload.size() <= UINT32_MAX, "call record too large");
+    std::lock_guard lock(mutex);
+    requireCapture(!finished, "call written after the capture finished");
+    const auto kind = static_cast<std::uint32_t>(call.kind);
+    const auto bytes = static_cast<std::uint32_t>(payload.size());
+    calls.write(reinterpret_cast<const char*>(&kind), sizeof(kind));
+    calls.write(reinterpret_cast<const char*>(&bytes), sizeof(bytes));
+    calls.write(reinterpret_cast<const char*>(payload.data()), static_cast<std::streamsize>(payload.size()));
+    requireCapture(calls.good(), "cannot write " + (directory / CallsName).string());
+}
+
+void FrameCaptureWriter::WriteRange(std::uint64_t address, std::uint64_t bytes, FrameRangeKind kind, std::uint32_t protection, std::uint32_t access) {
+    FrameMemoryChunk chunk;
+    chunk.kind = FrameMemoryKind::Range;
+    chunk.rangeKind = kind;
+    chunk.protection = protection;
+    chunk.access = access;
+    chunk.address = address;
+    chunk.bytes = bytes;
+    std::lock_guard lock(mutex);
+    writeChunk(chunk, {});
+}
+
+std::uint64_t FrameCaptureWriter::WriteSnapshot(std::uint64_t address, std::span<const std::byte> bytes) {
+    std::vector<Run> runs;
+    for (std::size_t at = 0; at < bytes.size();) {
+        const auto block = bytes.subspan(at, std::min(BlockBytes, bytes.size() - at));
+        if (AllZero(block)) {
+            at += block.size();
+            continue;
+        }
+        if (!runs.empty() && runs.back().address + runs.back().bytes.size() == address + at && runs.back().bytes.size() + block.size() <= ChunkBytes) {
+            runs.back().bytes = bytes.subspan(runs.back().address - address, runs.back().bytes.size() + block.size());
+        } else {
+            runs.push_back({address + at, block});
+        }
+        at += block.size();
+    }
+    const auto workers = std::max<std::size_t>(1, std::thread::hardware_concurrency() / 2);
+    std::uint64_t stored = 0;
+    for (std::size_t first = 0; first < runs.size(); first += workers) {
+        const auto last = std::min(runs.size(), first + workers);
+        std::vector<std::future<std::vector<std::byte>>> compressed;
+        for (auto index = first; index < last; ++index) {
+            compressed.push_back(std::async(std::launch::async, [this, run = runs[index]] { return compress(run.bytes); }));
+        }
+        std::lock_guard lock(mutex);
+        for (auto index = first; index < last; ++index) {
+            const auto payload = compressed[index - first].get();
+            FrameMemoryChunk chunk;
+            chunk.kind = FrameMemoryKind::Snapshot;
+            chunk.address = runs[index].address;
+            chunk.bytes = runs[index].bytes.size();
+            chunk.compressedBytes = payload.size();
+            writeChunk(chunk, payload);
+            stored += chunk.bytes;
+        }
+    }
+    return stored;
+}
+
+void FrameCaptureWriter::WriteDelta(std::uint64_t group, std::uint64_t completed, std::uint64_t address, std::span<const std::byte> bytes) {
+    for (std::size_t at = 0; at < bytes.size(); at += ChunkBytes) {
+        const auto part = bytes.subspan(at, std::min(ChunkBytes, bytes.size() - at));
+        const auto payload = compress(part);
+        FrameMemoryChunk chunk;
+        chunk.kind = FrameMemoryKind::Delta;
+        chunk.group = group;
+        chunk.completed = completed;
+        chunk.address = address + at;
+        chunk.bytes = part.size();
+        chunk.compressedBytes = payload.size();
+        std::lock_guard lock(mutex);
+        writeChunk(chunk, payload);
+    }
+}
+
+void FrameCaptureWriter::WriteReference(std::uint64_t index, std::uint64_t address, std::span<const std::byte> pixels) {
+    const auto payload = compress(pixels);
+    FrameMemoryChunk chunk;
+    chunk.kind = FrameMemoryKind::Reference;
+    chunk.group = index;
+    chunk.address = address;
+    chunk.bytes = pixels.size();
+    chunk.compressedBytes = payload.size();
+    std::lock_guard lock(mutex);
+    writeChunk(chunk, payload);
+}
+
+void FrameCaptureWriter::Finish(std::string_view header) {
+    std::lock_guard lock(mutex);
+    requireCapture(!finished, "capture finished twice");
+    finished = true;
+    calls.flush();
+    memory.flush();
+    requireCapture(calls.good() && memory.good(), "cannot flush the capture files in " + directory.string());
+    calls.close();
+    memory.close();
+    std::ofstream file(directory / HeaderName, std::ios::binary | std::ios::trunc);
+    file.write(header.data(), static_cast<std::streamsize>(header.size()));
+    file.flush();
+    requireCapture(file.good(), "cannot write " + (directory / HeaderName).string());
+}
+
+std::uint64_t FrameCaptureWriter::RawBytes() const {
+    std::lock_guard lock(mutex);
+    return rawBytes;
+}
+
+std::uint64_t FrameCaptureWriter::StoredBytes() const {
+    std::lock_guard lock(mutex);
+    return storedBytes;
+}
+
+const std::filesystem::path& FrameCaptureWriter::Directory() const {
+    return directory;
+}
+
+void FrameCaptureWriter::writeChunk(const FrameMemoryChunk& chunk, std::span<const std::byte> payload) {
+    requireCapture(!finished, "memory written after the capture finished");
+    Encoder encoder;
+    encoder.Put(static_cast<std::uint32_t>(chunk.kind));
+    encoder.Put(static_cast<std::uint32_t>(chunk.rangeKind));
+    encoder.Put(chunk.protection);
+    encoder.Put(chunk.access);
+    encoder.Put(chunk.group);
+    encoder.Put(chunk.completed);
+    encoder.Put(chunk.address);
+    encoder.Put(chunk.bytes);
+    encoder.Put(static_cast<std::uint64_t>(payload.size()));
+    encoder.Put(std::uint64_t{0});
+    memory.write(reinterpret_cast<const char*>(encoder.bytes.data()), static_cast<std::streamsize>(encoder.bytes.size()));
+    memory.write(reinterpret_cast<const char*>(payload.data()), static_cast<std::streamsize>(payload.size()));
+    requireCapture(memory.good(), "cannot write " + (directory / MemoryName).string());
+    if (chunk.kind != FrameMemoryKind::Range) rawBytes += chunk.bytes;
+    storedBytes += payload.size();
+}
+
+std::vector<std::byte> FrameCaptureWriter::compress(std::span<const std::byte> bytes) const {
+    std::vector<std::byte> output(ZSTD_compressBound(bytes.size()));
+    const auto written = ZSTD_compress(output.data(), output.size(), bytes.data(), bytes.size(), level);
+    requireCapture(ZSTD_isError(written) == 0, std::string("zstd: ") + ZSTD_getErrorName(written));
+    output.resize(written);
+    return output;
+}
+
+FrameCaptureReader::FrameCaptureReader(const std::filesystem::path& directory) : directory(directory) {
+    const auto callsPath = directory / FrameCaptureWriter::CallsName;
+    const auto callBytes = readFile(callsPath);
+    requireMagic(callBytes, FrameCaptureWriter::CallsMagic, callsPath);
+    std::size_t at = FrameCaptureWriter::CallsMagic.size();
+    while (at < callBytes.size()) {
+        if (callBytes.size() - at < 8) {
+            truncated = true;
+            break;
+        }
+        std::uint32_t kind = 0;
+        std::uint32_t bytes = 0;
+        std::memcpy(&kind, callBytes.data() + at, 4);
+        std::memcpy(&bytes, callBytes.data() + at + 4, 4);
+        requireCapture(knownCall(kind), callsPath.string() + ": unknown call kind " + std::to_string(kind) + " at byte " + std::to_string(at));
+        if (callBytes.size() - at - 8 < bytes) {
+            truncated = true;
+            break;
+        }
+        calls.push_back(decodeCall(static_cast<FrameCallKind>(kind), std::span(callBytes).subspan(at + 8, bytes)));
+        at += 8 + static_cast<std::size_t>(bytes);
+    }
+
+    const auto memoryPath = directory / FrameCaptureWriter::MemoryName;
+    std::ifstream memory(memoryPath, std::ios::binary);
+    requireCapture(memory.is_open(), "cannot open " + memoryPath.string());
+    memory.seekg(0, std::ios::end);
+    const auto size = static_cast<std::uint64_t>(memory.tellg());
+    std::string magic(FrameCaptureWriter::MemoryMagic.size(), '\0');
+    memory.seekg(0);
+    memory.read(magic.data(), static_cast<std::streamsize>(magic.size()));
+    requireCapture(memory.good() && magic == FrameCaptureWriter::MemoryMagic, memoryPath.string() + " is not a frame capture file");
+    std::uint64_t offset = magic.size();
+    while (offset < size) {
+        if (size - offset < ChunkHeaderBytes) {
+            truncated = true;
+            break;
+        }
+        std::array<std::byte, ChunkHeaderBytes> raw{};
+        memory.seekg(static_cast<std::streamoff>(offset));
+        memory.read(reinterpret_cast<char*>(raw.data()), static_cast<std::streamsize>(raw.size()));
+        requireCapture(memory.good(), "cannot read " + memoryPath.string());
+        Decoder decoder(raw);
+        FrameMemoryChunk chunk;
+        const auto kind = decoder.Take<std::uint32_t>("memory kind");
+        const auto rangeKind = decoder.Take<std::uint32_t>("range kind");
+        requireCapture(kind >= 1 && kind <= 4 && rangeKind >= 1 && rangeKind <= 6, memoryPath.string() + ": corrupt chunk header at byte " + std::to_string(offset));
+        chunk.kind = static_cast<FrameMemoryKind>(kind);
+        chunk.rangeKind = static_cast<FrameRangeKind>(rangeKind);
+        chunk.protection = decoder.Take<std::uint32_t>("protection");
+        chunk.access = decoder.Take<std::uint32_t>("access");
+        chunk.group = decoder.Take<std::uint64_t>("group");
+        chunk.completed = decoder.Take<std::uint64_t>("completed serial");
+        chunk.address = decoder.Take<std::uint64_t>("address");
+        chunk.bytes = decoder.Take<std::uint64_t>("bytes");
+        chunk.compressedBytes = decoder.Take<std::uint64_t>("compressed bytes");
+        requireCapture((chunk.kind == FrameMemoryKind::Range) == (chunk.compressedBytes == 0), memoryPath.string() + ": chunk payload does not match its kind at byte " + std::to_string(offset));
+        chunk.offset = offset + ChunkHeaderBytes;
+        if (size - chunk.offset < chunk.compressedBytes) {
+            truncated = true;
+            break;
+        }
+        chunks.push_back(chunk);
+        offset = chunk.offset + chunk.compressedBytes;
+    }
+
+    const auto headerPath = directory / FrameCaptureWriter::HeaderName;
+    if (std::filesystem::exists(headerPath)) {
+        const auto bytes = readFile(headerPath);
+        header.assign(reinterpret_cast<const char*>(bytes.data()), bytes.size());
+    } else {
+        truncated = true;
+    }
+}
+
+const std::vector<FrameCall>& FrameCaptureReader::Calls() const {
+    return calls;
+}
+
+const std::vector<FrameMemoryChunk>& FrameCaptureReader::Chunks() const {
+    return chunks;
+}
+
+const std::string& FrameCaptureReader::Header() const {
+    return header;
+}
+
+bool FrameCaptureReader::Truncated() const {
+    return truncated;
+}
+
+void FrameCaptureReader::Read(const FrameMemoryChunk& chunk, std::span<std::byte> destination) const {
+    requireCapture(chunk.kind != FrameMemoryKind::Range, "a range chunk has no bytes");
+    requireCapture(destination.size() == chunk.bytes, "destination size does not match the chunk");
+    const auto path = directory / FrameCaptureWriter::MemoryName;
+    std::ifstream memory(path, std::ios::binary);
+    requireCapture(memory.is_open(), "cannot open " + path.string());
+    std::vector<std::byte> compressed(chunk.compressedBytes);
+    memory.seekg(static_cast<std::streamoff>(chunk.offset));
+    memory.read(reinterpret_cast<char*>(compressed.data()), static_cast<std::streamsize>(compressed.size()));
+    requireCapture(memory.good(), "cannot read " + path.string());
+    const auto written = ZSTD_decompress(destination.data(), destination.size(), compressed.data(), compressed.size());
+    requireCapture(ZSTD_isError(written) == 0, std::string("zstd: ") + ZSTD_getErrorName(written));
+    requireCapture(written == chunk.bytes, "chunk at " + std::to_string(chunk.address) + " decompressed to the wrong size");
+}
+
+std::vector<std::byte> FrameCaptureReader::Read(const FrameMemoryChunk& chunk) const {
+    std::vector<std::byte> bytes(chunk.bytes);
+    Read(chunk, bytes);
+    return bytes;
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
new file mode 100644
index 0000000000..8d34708b90
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
@@ -0,0 +1,586 @@
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/TraceRevision.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/General.hpp"
+#include <algorithm>
+#include <array>
+#include <charconv>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <fstream>
+#include <functional>
+#include <limits>
+#include <set>
+#include <stdexcept>
+#include <thread>
+#include <tuple>
+#include <utility>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <unistd.h>
+#endif
+
+namespace AgcDriver {
+namespace {
+
+std::uint64_t readNumber(const char* text, std::uint64_t fallback) {
+    if (text == nullptr || *text == '\0') return fallback;
+    std::uint64_t value = 0;
+    const std::string_view view(text);
+    const auto [last, error] = std::from_chars(view.data(), view.data() + view.size(), value);
+    if (error != std::errc{} || last != view.data() + view.size()) throw std::runtime_error("frame capture: '" + std::string(view) + "' is not a number");
+    return value;
+}
+
+std::string jsonString(std::string_view text) {
+    std::string result = "\"";
+    for (const char character : text) {
+        if (character == '"' || character == '\\') {
+            result += '\\';
+            result += character;
+        } else if (static_cast<unsigned char>(character) < 0x20) {
+            char escaped[8];
+            std::snprintf(escaped, sizeof(escaped), "\\u%04x", static_cast<unsigned>(static_cast<unsigned char>(character)));
+            result += escaped;
+        } else {
+            result += character;
+        }
+    }
+    return result + "\"";
+}
+
+std::vector<std::pair<std::string, std::string>> captureEnvironment() {
+#ifdef _WIN32
+    char** entries = _environ;
+#else
+    char** entries = environ;
+#endif
+    std::vector<std::pair<std::string, std::string>> result;
+    for (; entries != nullptr && *entries != nullptr; ++entries) {
+        const std::string_view entry = *entries;
+        const auto equals = entry.find('=');
+        if (!entry.starts_with("APS5_") || equals == std::string_view::npos) continue;
+        result.emplace_back(std::string(entry.substr(0, equals)), std::string(entry.substr(equals + 1)));
+    }
+    std::sort(result.begin(), result.end());
+    return result;
+}
+
+std::uint64_t threadId() {
+    return static_cast<std::uint64_t>(std::hash<std::thread::id>{}(std::this_thread::get_id()));
+}
+
+std::vector<ShaderRegister> copyRegisters(std::span<const ShaderRegister> registers) {
+    return {registers.begin(), registers.end()};
+}
+
+std::uint64_t pointer(const void* value) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(value));
+}
+
+std::uint64_t flipValue(std::int64_t value) {
+    return static_cast<std::uint64_t>(value);
+}
+
+std::uint64_t contentHash(std::span<const std::byte> bytes) {
+    std::uint64_t hash = 0xcbf29ce484222325ull;
+    for (const auto value : bytes) hash = (hash ^ static_cast<std::uint64_t>(value)) * 0x100000001b3ull;
+    return hash == 0 ? 1 : hash;
+}
+
+}
+
+FrameRecorder* FrameRecorder::Active() {
+    static FrameRecorder* const recorder = []() -> FrameRecorder* {
+        const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+        if (directory == nullptr || *directory == '\0') return nullptr;
+        const char* trigger = std::getenv("APS5_FRAME_CAPTURE_TRIGGER");
+        const auto atBoundary = readNumber(std::getenv("APS5_FRAME_CAPTURE_AT_FLIP"), 0);
+        const auto frames = readNumber(std::getenv("APS5_FRAME_CAPTURE_FRAMES"), DefaultFrames);
+        if (frames == 0) throw std::runtime_error("frame capture: APS5_FRAME_CAPTURE_FRAMES must be at least 1");
+        return new FrameRecorder(directory, trigger != nullptr ? trigger : "", atBoundary, frames);
+    }();
+    return recorder;
+}
+
+FrameRecorder::FrameRecorder(std::filesystem::path directory, std::filesystem::path trigger, std::uint64_t atBoundary, std::uint64_t frames)
+    : directory(std::move(directory)), trigger(std::move(trigger)), atBoundary(atBoundary), frames(frames), origin(std::chrono::steady_clock::now()) {}
+
+FrameCall FrameRecorder::make(FrameCallKind kind) {
+    FrameCall call;
+    call.kind = kind;
+    call.timeNs = static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - origin).count());
+    call.thread = threadId();
+    return call;
+}
+
+void FrameRecorder::RegisterShader(const Shader* shader) {
+    auto call = make(FrameCallKind::RegisterShader);
+    call.address = pointer(shader);
+    const std::array<const Shader*, 1> shaders{shader};
+    record(std::move(call), true, shaders);
+}
+
+void FrameRecorder::ResolveShaderAbi(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) {
+    auto call = make(FrameCallKind::ResolveShaderAbi);
+    call.address = pointer(shader);
+    call.context = copyRegisters(context);
+    call.primitive = copyRegisters(primitive);
+    const std::array<const Shader*, 1> shaders{shader};
+    record(std::move(call), true, shaders);
+}
+
+void FrameRecorder::ResolveGraphicsStagesAbi(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive) {
+    auto call = make(FrameCallKind::ResolveGraphicsStagesAbi);
+    for (const auto* stage : stages) call.values.push_back(pointer(stage));
+    call.context = copyRegisters(context);
+    call.primitive = copyRegisters(primitive);
+    record(std::move(call), true, stages);
+}
+
+void FrameRecorder::ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType) {
+    auto call = make(FrameCallKind::ResolveGraphicsAbi);
+    call.values = {pointer(vertex), pointer(pixel), primitiveType};
+    const std::array<const Shader*, 2> shaders{vertex, pixel};
+    record(std::move(call), true, shaders);
+}
+
+void FrameRecorder::RegisterVideoOutput(std::uint32_t handle) {
+    auto call = make(FrameCallKind::RegisterVideoOutput);
+    call.values = {handle};
+    record(std::move(call), true);
+}
+
+void FrameRecorder::UnregisterVideoOutput(std::uint32_t handle) {
+    auto call = make(FrameCallKind::UnregisterVideoOutput);
+    call.values = {handle};
+    record(std::move(call), true);
+}
+
+void FrameRecorder::Submit(const Packet& packet, std::uint32_t queue) {
+    auto call = make(FrameCallKind::Submit);
+    call.queue = queue;
+    call.address = pointer(packet.addr);
+    call.size = packet.dw_num;
+    call.flags = packet.flags;
+    record(std::move(call), false);
+}
+
+void FrameRecorder::Flip(const FlipInfo& info) {
+    auto call = make(FrameCallKind::Flip);
+    call.cpuFlip = true;
+    call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument)};
+    record(std::move(call), false);
+}
+
+void FrameRecorder::ReserveEopFlip(const FlipInfo& info, std::uint32_t token) {
+    auto call = make(FrameCallKind::ReserveEopFlip);
+    call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument), token};
+    std::lock_guard lock(mutex);
+    if (state == State::Waiting) {
+        call.ordinal = ++ordinal;
+        reservations.push_back(std::move(call));
+        if (reservations.size() > ReservationHistory) reservations.pop_front();
+        return;
+    }
+    if (state != State::Recording) return;
+    emitDelta();
+    if (state != State::Recording) return;
+    call.ordinal = ++ordinal;
+    std::tie(call.accepted, call.completed) = DriverDetail::Driver::Get().SerialProgress();
+    writer->WriteCall(call);
+    ++recordedCalls;
+}
+
+void FrameRecorder::Suspend() {
+    record(make(FrameCallKind::Suspend), false);
+}
+
+void FrameRecorder::PresentBuffer(const DisplayBuffer& buffer) {
+    std::lock_guard lock(displayMutex);
+    displayBuffers[buffer.address] = buffer;
+}
+
+void FrameRecorder::writeReferenceFrames() {
+    std::map<std::uint64_t, DisplayBuffer> presented;
+    {
+        std::lock_guard lock(displayMutex);
+        presented = displayBuffers;
+    }
+    if (presented.empty()) return;
+    if (!DriverDetail::Driver::Get().WaitIdleFor(std::chrono::seconds(10))) {
+        warnings.push_back("no reference frames: the driver did not go idle after the last frame");
+        return;
+    }
+    std::uint64_t index = 0;
+    for (const auto& [address, buffer] : presented) {
+        try {
+            const auto pixels = ReadDisplayBuffer(buffer);
+            writer->WriteReference(index, address, pixels);
+        } catch (const std::exception& failure) {
+            warnings.push_back(std::string("no reference frame for a display buffer: ") + failure.what());
+            continue;
+        }
+        auto call = make(FrameCallKind::DisplayBuffer);
+        call.ordinal = ++ordinal;
+        call.address = buffer.address;
+        call.values = {index, buffer.pixelFormat, buffer.width, buffer.height, buffer.tilingMode, buffer.pitchInPixel, buffer.dccAddress, buffer.dccClearColor, buffer.alignment};
+        writer->WriteCall(call);
+        ++index;
+    }
+}
+
+void FrameRecorder::record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders) {
+    std::lock_guard lock(mutex);
+    if (state == State::Waiting) {
+        if (!prologueCall) return;
+        call.ordinal = ++ordinal;
+        prologue.push_back(std::move(call));
+        return;
+    }
+    if (state != State::Recording) return;
+    if (prologueCall) emitShaderDelta(shaders);
+    else emitDelta();
+    if (state != State::Recording) return;
+    call.ordinal = ++ordinal;
+    std::tie(call.accepted, call.completed) = DriverDetail::Driver::Get().SerialProgress();
+    writer->WriteCall(call);
+    ++recordedCalls;
+}
+
+void FrameRecorder::FrameBoundary() {
+    std::lock_guard lock(mutex);
+    ++boundaries;
+    if (state == State::Recording) {
+        if (++recordedFrames >= frames) finish();
+        return;
+    }
+    if (state == State::Waiting && triggered()) start();
+}
+
+bool FrameRecorder::triggered() {
+    if (!trigger.empty()) {
+        std::error_code error;
+        if (!std::filesystem::exists(trigger, error)) return false;
+        std::ifstream file(trigger);
+        std::uint64_t requested = 0;
+        if (file >> requested && requested != 0) frames = requested;
+        return true;
+    }
+    return boundaries >= std::max<std::uint64_t>(atBoundary, 1);
+}
+
+void FrameRecorder::emitDelta() {
+    std::vector<Span> spans;
+    for (const auto& range : ranges) {
+        if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) spans.push_back({range.address, range.bytes, generation});
+    }
+    const auto mark = GuestMemory::WriteGeneration();
+    const auto added = newRanges();
+    writeDelta(spans, {}, added);
+    generation = mark;
+    shaderMarks.clear();
+}
+
+std::vector<FrameRecorder::Range> FrameRecorder::newRanges() {
+    const auto current = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    if (current == allocationsGeneration) return {};
+    allocationsGeneration = current;
+    std::map<std::uint64_t, std::uint64_t> covered;
+    for (const auto& range : ranges) {
+        auto& end = covered[range.address];
+        end = std::max(end, range.address + range.bytes);
+    }
+    std::vector<Range> added;
+    for (const auto& range : committedRanges()) {
+        const auto end = range.address + range.bytes;
+        for (auto at = range.address; at < end;) {
+            const auto next = covered.upper_bound(at);
+            if (next != covered.begin() && std::prev(next)->second > at) {
+                at = std::prev(next)->second;
+                continue;
+            }
+            auto piece = range;
+            piece.address = at;
+            piece.bytes = (next == covered.end() ? end : std::min(end, next->first)) - at;
+            added.push_back(piece);
+            at += piece.bytes;
+        }
+    }
+    return added;
+}
+
+void FrameRecorder::emitShaderDelta(std::span<const Shader* const> shaders) {
+    std::set<std::uint64_t> blocks;
+    std::set<std::uint64_t> hostPages;
+    std::uintptr_t arenaBase = 0;
+    std::size_t arenaBytes = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes);
+    const auto note = [&](const void* address, std::uint64_t bytes = 0) {
+        if (address == nullptr) return;
+        const auto at = pointer(address);
+        const bool arena = at >= arenaBase && at - arenaBase < arenaBytes;
+        const auto blockBytes = arena ? FrameCaptureWriter::BlockBytes : HostPageBytes;
+        const auto begin = at & ~std::uint64_t{blockBytes - 1};
+        const auto count = bytes != 0 ? (at - begin + bytes + blockBytes - 1) / blockBytes : 2;
+        auto& pages = arena ? blocks : hostPages;
+        for (std::uint64_t index = 0; index < count; ++index) pages.insert(begin + index * blockBytes);
+    };
+    for (const auto* shader : shaders) {
+        if (shader == nullptr || !GuestMemory::Accessible(shader, sizeof(Shader))) continue;
+        note(shader);
+        note(const_cast<const void*>(shader->code), shader->shader_size);
+        note(shader->user_data);
+        note(shader->cx_registers);
+        note(shader->sh_registers);
+        note(shader->specials);
+        note(shader->input_semantics);
+        note(shader->output_semantics);
+        if (shader->user_data == nullptr || !GuestMemory::Accessible(shader->user_data, sizeof(ShaderUserData))) continue;
+        note(shader->user_data->direct_resource_offset);
+        for (const auto* sharps : shader->user_data->sharp_resource_offset) note(sharps);
+    }
+    if (blocks.empty() && hostPages.empty()) return;
+    const auto mark = GuestMemory::WriteGeneration();
+    std::vector<Span> spans;
+    for (const auto block : blocks) {
+        const auto found = shaderMarks.find(block);
+        spans.push_back({block, FrameCaptureWriter::BlockBytes, found != shaderMarks.end() ? std::max(found->second, generation) : generation});
+    }
+    const std::vector<std::uint64_t> pages(hostPages.begin(), hostPages.end());
+    writeDelta(spans, pages);
+    for (const auto block : blocks) shaderMarks[block] = mark;
+}
+
+void FrameRecorder::writeDelta(std::span<const Span> spans, std::span<const std::uint64_t> hostPages, std::span<const Range> added) {
+    if (abandonIfDiskLow()) return;
+    const auto [accepted, completed] = DriverDetail::Driver::Get().SerialProgress();
+    const auto group = deltaGroups + 1;
+    bool any = false;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> written;
+    std::vector<std::byte> bytes;
+    for (const auto& range : added) {
+        writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access);
+        ranges.push_back(range);
+        ++lateRanges;
+        if (!range.readable) {
+            unreadableBytes += range.bytes;
+            continue;
+        }
+        for (std::uint64_t at = 0; at < range.bytes;) {
+            bytes.resize(static_cast<std::size_t>(std::min<std::uint64_t>(FrameCaptureWriter::BlockBytes, range.bytes - at)));
+            GuestMemory::ReadCommittedUnsynced(range.address + at, bytes);
+            const bool zero = std::all_of(bytes.begin(), bytes.end(), [](std::byte value) { return value == std::byte{0}; });
+            if (!zero) {
+                writer->WriteDelta(group, completed, range.address + at, bytes);
+                deltaBytes += bytes.size();
+                any = true;
+            }
+            at += bytes.size();
+        }
+    }
+    for (const auto page : hostPages) {
+        if (!GuestMemory::Accessible(reinterpret_cast<const void*>(static_cast<std::uintptr_t>(page)), HostPageBytes)) continue;
+        bytes.resize(HostPageBytes);
+        std::memcpy(bytes.data(), reinterpret_cast<const void*>(static_cast<std::uintptr_t>(page)), HostPageBytes);
+        const auto hash = contentHash(bytes);
+        auto& known = hostPageHashes[page];
+        if (known == hash) continue;
+        known = hash;
+        writer->WriteDelta(group, completed, page, bytes);
+        deltaBytes += bytes.size();
+        any = true;
+    }
+    for (const auto& span : spans) {
+        GuestMemory::CollectWrittenBlocks(span.address, static_cast<std::size_t>(span.bytes), span.since, written);
+        for (const auto& [begin, end] : written) {
+            bytes.resize(static_cast<std::size_t>(end - begin));
+            GuestMemory::ReadCommittedUnsynced(begin, bytes);
+            writer->WriteDelta(group, completed, begin, bytes);
+            deltaBytes += bytes.size();
+            any = true;
+        }
+    }
+    if (!any) return;
+    deltaGroups = group;
+    auto call = make(FrameCallKind::Memory);
+    call.ordinal = ++ordinal;
+    call.accepted = accepted;
+    call.completed = completed;
+    call.values = {group};
+    writer->WriteCall(call);
+}
+
+void FrameRecorder::snapshot(const Range& range) {
+    writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access);
+    if (!range.readable) {
+        unreadableBytes += range.bytes;
+        return;
+    }
+    std::vector<std::byte> bytes;
+    for (std::uint64_t at = 0; at < range.bytes; at += SnapshotPieceBytes) {
+        if (abandonIfDiskLow()) return;
+        bytes.resize(static_cast<std::size_t>(std::min<std::uint64_t>(SnapshotPieceBytes, range.bytes - at)));
+        GuestMemory::ReadCommitted(range.address + at, bytes);
+        snapshotBytes += writer->WriteSnapshot(range.address + at, bytes);
+    }
+}
+
+bool FrameRecorder::abandonIfDiskLow() {
+    std::error_code error;
+    const auto space = std::filesystem::space(directory, error);
+    if (error || space.available >= MinimumFreeBytes) return false;
+    warnings.push_back("stopped: less than 4 GiB free on the capture volume");
+    std::fprintf(stderr, "[frame-capture] stopped: less than 4 GiB free on the capture volume\n");
+    try {
+        writer->Finish(header());
+    } catch (const std::exception& failure) {
+        std::fprintf(stderr, "[frame-capture] %s\n", failure.what());
+    }
+    writer.reset();
+    state = State::Done;
+    return true;
+}
+
+void FrameRecorder::start() {
+    ++startAttempts;
+    auto& driver = DriverDetail::Driver::Get();
+    if (!driver.WaitIdleFor(std::chrono::seconds(10))) {
+        std::fprintf(stderr, "[frame-capture] the driver did not go idle within 10 s at frame boundary %llu (attempt %llu)\n", static_cast<unsigned long long>(boundaries), static_cast<unsigned long long>(startAttempts));
+        if (startAttempts >= 5) {
+            std::fprintf(stderr, "[frame-capture] giving up: no idle frame boundary\n");
+            state = State::Done;
+        }
+        return;
+    }
+    startedAt = std::chrono::steady_clock::now();
+    startBoundary = boundaries;
+    allocationsGeneration = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    ranges = committedRanges();
+    writer = std::make_unique<FrameCaptureWriter>(directory);
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> written;
+    for (const auto& range : ranges) {
+        if (range.kind == FrameRangeKind::Watched || range.kind == FrameRangeKind::Unwatched) GuestMemory::CollectWrittenBlocks(range.address, static_cast<std::size_t>(range.bytes), std::numeric_limits<std::uint64_t>::max(), written);
+    }
+    generation = GuestMemory::WriteGeneration();
+    for (const auto& range : ranges) {
+        snapshot(range);
+        if (!writer) return;
+    }
+    for (const auto& call : prologue) writer->WriteCall(call);
+    std::uintptr_t ringBase = 0;
+    std::uint32_t ringSize = 0;
+    sceAgcDriverGetTFRing(&ringBase, &ringSize);
+    auto ring = make(FrameCallKind::SetTessellationFactorRing);
+    ring.ordinal = ++ordinal;
+    ring.address = ringBase;
+    ring.size = ringSize;
+    writer->WriteCall(ring);
+    const auto pending = driver.PendingEopFlipTokens();
+    const std::set<std::uint64_t> open(pending.begin(), pending.end());
+    for (const auto& call : reservations) {
+        if (open.contains(call.values.back())) writer->WriteCall(call);
+    }
+    auto begin = make(FrameCallKind::FrameStart);
+    begin.ordinal = ++ordinal;
+    std::tie(begin.accepted, begin.completed) = driver.SerialProgress();
+    begin.values = {boundaries};
+    writer->WriteCall(begin);
+    state = State::Recording;
+    recordedFrames = 0;
+    std::fprintf(stderr, "[frame-capture] started at frame boundary %llu: %zu ranges, %.1f MiB snapshot in %.1f s\n", static_cast<unsigned long long>(boundaries), ranges.size(),
+                 static_cast<double>(snapshotBytes) / (1024.0 * 1024.0), std::chrono::duration<double>(std::chrono::steady_clock::now() - startedAt).count());
+}
+
+void FrameRecorder::finish() {
+    emitDelta();
+    if (!writer) return;
+    auto end = make(FrameCallKind::End);
+    end.ordinal = ++ordinal;
+    std::tie(end.accepted, end.completed) = DriverDetail::Driver::Get().SerialProgress();
+    writer->WriteCall(end);
+    writeReferenceFrames();
+    writer->Finish(header());
+    std::fprintf(stderr, "[frame-capture] %llu frames, %llu calls, %llu memory deltas (%.1f MiB), %.1f MiB raw, %.1f MiB stored in %s\n", static_cast<unsigned long long>(recordedFrames),
+                 static_cast<unsigned long long>(recordedCalls), static_cast<unsigned long long>(deltaGroups), static_cast<double>(deltaBytes) / (1024.0 * 1024.0),
+                 static_cast<double>(writer->RawBytes()) / (1024.0 * 1024.0), static_cast<double>(writer->StoredBytes()) / (1024.0 * 1024.0), directory.string().c_str());
+    writer.reset();
+    state = State::Done;
+}
+
+std::string FrameRecorder::header() const {
+    std::uintptr_t arenaBase = 0;
+    std::size_t arenaBytes = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&arenaBase, &arenaBytes);
+    std::string text = "{\"magic\":\"aps5-frame-capture 1\"";
+    text += ",\"commit\":" + jsonString(APS5_TRACE_COMMIT);
+    text += std::string(",\"dirty\":") + (APS5_TRACE_DIRTY < 0 ? "null" : APS5_TRACE_DIRTY != 0 ? "true" : "false");
+    text += ",\"arena_base\":" + std::to_string(arenaBase) + ",\"arena_bytes\":" + std::to_string(arenaBytes);
+    text += ",\"start_boundary\":" + std::to_string(startBoundary) + ",\"frames\":" + std::to_string(recordedFrames);
+    text += ",\"calls\":" + std::to_string(recordedCalls) + ",\"prologue_calls\":" + std::to_string(prologue.size());
+    text += ",\"ranges\":" + std::to_string(ranges.size()) + ",\"late_ranges\":" + std::to_string(lateRanges) + ",\"snapshot_bytes\":" + std::to_string(snapshotBytes) + ",\"unreadable_bytes\":" + std::to_string(unreadableBytes);
+    text += ",\"memory_groups\":" + std::to_string(deltaGroups) + ",\"delta_bytes\":" + std::to_string(deltaBytes);
+    text += ",\"capture_seconds\":" + std::to_string(std::chrono::duration<double>(std::chrono::steady_clock::now() - startedAt).count());
+    text += ",\"env\":{";
+    bool first = true;
+    for (const auto& [name, value] : captureEnvironment()) {
+        text += (first ? "" : ",") + jsonString(name) + ":" + jsonString(value);
+        first = false;
+    }
+    text += "},\"warnings\":[";
+    first = true;
+    for (const auto& warning : warnings) {
+        text += (first ? "" : ",") + jsonString(warning);
+        first = false;
+    }
+    return text + "]}\n";
+}
+
+std::vector<FrameRecorder::Range> FrameRecorder::committedRanges() {
+#ifdef _WIN32
+    std::uintptr_t base = 0;
+    std::size_t size = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&base, &size);
+    if (size == 0) throw std::runtime_error("frame capture: the guest arena is not reserved");
+    std::vector<Range> result;
+    for (const auto& allocation : GuestAllocations::GuestAllocationsAcquireAll_nid_postfix()) {
+        if (!allocation->readable) continue;
+        const auto first = allocation->address;
+        const auto end = first + allocation->bytes;
+        const bool host = first < base || end > base + size;
+        const auto access = FrameRangeAccess::Readable | (allocation->writable ? FrameRangeAccess::Writable : 0u) | (allocation->gpu ? FrameRangeAccess::Gpu : 0u);
+        for (auto address = first; address < end;) {
+            MEMORY_BASIC_INFORMATION info{};
+            if (VirtualQuery(reinterpret_cast<const void*>(static_cast<std::uintptr_t>(address)), &info, sizeof(info)) == 0) throw std::runtime_error("frame capture: VirtualQuery failed inside the guest arena");
+            const auto regionEnd = std::min<std::uint64_t>(end, reinterpret_cast<std::uintptr_t>(info.BaseAddress) + info.RegionSize);
+            if (info.State == MEM_COMMIT) {
+                Range range;
+                range.address = address;
+                range.bytes = regionEnd - address;
+                range.protection = info.Protect;
+                range.access = access;
+                const auto page = info.Protect & 0xffu;
+                range.readable = (info.Protect & PAGE_GUARD) == 0 && (page == PAGE_READONLY || page == PAGE_READWRITE || page == PAGE_WRITECOPY || page == PAGE_EXECUTE_READ || page == PAGE_EXECUTE_READWRITE || page == PAGE_EXECUTE_WRITECOPY);
+                if (host) range.kind = FrameRangeKind::Host;
+                else if (info.Type == MEM_PRIVATE) range.kind = GuestMemory::Watched(range.address, static_cast<std::size_t>(range.bytes)) ? FrameRangeKind::Watched : FrameRangeKind::Unwatched;
+                else range.kind = FrameRangeKind::Section;
+                auto& last = result.empty() ? range : result.back();
+                if (!result.empty() && last.address + last.bytes == range.address && last.kind == range.kind && last.protection == range.protection && last.readable == range.readable && last.access == range.access) last.bytes += range.bytes;
+                else result.push_back(range);
+            }
+            address = regionEnd;
+        }
+    }
+    return result;
+#else
+    throw std::runtime_error("frame capture: guest memory capture is implemented on Windows only");
+#endif
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
index cf5b1a1676..fe8241fcfc 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
@@ -1,12 +1,14 @@
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/HandoffSpin.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/WriteWatchCoverage.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "prx/libc/include/HostThreadSlot.hpp"
 #include <mutex>
 #include <array>
 #include <chrono>
@@ -19,7 +21,9 @@
 #include <cstdlib>
 #include <cstring>
 #include <limits>
+#include <map>
 #include <memory>
+#include <new>
 #include <stdexcept>
 #include <string>
 #include <tuple>
@@ -152,13 +156,13 @@ struct MemoryCounters {
 };
 
 struct MemoryProfile {
-    std::mutex threadsMutex;
+    AgcDriver::Mutex threadsMutex;
     std::vector<const MemoryCounters*> threads;
     MemoryCounters retired;
     MemoryCounters shared;
     std::atomic<std::int64_t> lastReport{0};
     // Sampled callers of Read and Write (module offsets), to name what touches guest memory most.
-    std::mutex callersMutex;
+    AgcDriver::Mutex callersMutex;
     std::array<std::pair<unsigned long long, std::uint64_t>, 16> callers{};
     std::array<std::pair<unsigned long long, std::uint64_t>, 16> writeCallers{};
 };
@@ -222,19 +226,19 @@ void CountCaller(std::array<std::pair<unsigned long long, std::uint64_t>, 16>& c
     }
 }
 
-// Attribution tags (see the header): the packet a queue worker executes and the read site the
-// driver code named. Plain thread-locals; a store per packet costs nothing measurable.
-thread_local PacketTag currentPacket{NoPacket, 0xffffffffu};
-thread_local ReadSite currentReadSite = ReadSite::Unknown;
+struct CurrentPacketSlot {};
+struct CurrentReadSiteSlot {};
+constexpr std::uint64_t NoPacketBits = NoPacket | (std::uint64_t{0xffffffffu} << 32u);
 // Sampled reads by site (every 256th Read/ReadCommitted, like the callers), for the [guestmem] line.
 std::atomic<std::uint64_t> readSiteSamples[static_cast<std::size_t>(ReadSite::Count)] = {};
 
 void SetCurrentPacket(std::uint32_t opcode, std::uint32_t queue) {
-    currentPacket = {opcode, queue};
+    HostThreadSlot<std::uint64_t, CurrentPacketSlot>::Set((opcode | (std::uint64_t{queue} << 32u)) ^ NoPacketBits);
 }
 
 PacketTag CurrentPacket() {
-    return currentPacket;
+    const auto bits = HostThreadSlot<std::uint64_t, CurrentPacketSlot>::Get() ^ NoPacketBits;
+    return {static_cast<std::uint32_t>(bits), static_cast<std::uint32_t>(bits >> 32u)};
 }
 
 const char* ReadSiteName(ReadSite site) {
@@ -244,11 +248,13 @@ const char* ReadSiteName(ReadSite site) {
 }
 
 ReadSite SetReadSite(ReadSite site) {
-    return std::exchange(currentReadSite, site);
+    const auto previous = HostThreadSlot<ReadSite, CurrentReadSiteSlot>::Get();
+    HostThreadSlot<ReadSite, CurrentReadSiteSlot>::Set(site);
+    return previous;
 }
 
 ReadSite CurrentReadSite() {
-    return currentReadSite;
+    return HostThreadSlot<ReadSite, CurrentReadSiteSlot>::Get();
 }
 
 std::size_t CaptureCallerOffsets(std::span<unsigned long long> frames, unsigned skip) {
@@ -289,7 +295,7 @@ std::size_t CaptureCallerOffsets(std::span<unsigned long long> frames, unsigned
 void CountReadCaller(const void* returnAddress) {
     thread_local std::uint32_t sampled = 0;
     // Sampled at the same rate as the callers, in step with them (CountCaller advances the counter).
-    if ((sampled + 1) % 256 == 0) readSiteSamples[static_cast<std::size_t>(currentReadSite)].fetch_add(256, std::memory_order_relaxed);
+    if ((sampled + 1) % 256 == 0) readSiteSamples[static_cast<std::size_t>(CurrentReadSite())].fetch_add(256, std::memory_order_relaxed);
     CountCaller(Profile().callers, sampled, 256, returnAddress);
 }
 
@@ -368,18 +374,38 @@ struct PageSpan {
     std::size_t size = 0;
     // Per page: access flags, zero while unknown.
     std::uint8_t* pages = nullptr;
+    static constexpr std::size_t ChunkEntries = 65536;
+    struct alignas(8) Chunk { std::array<std::uint8_t, ChunkEntries> entries{}; };
+    std::atomic<Chunk*>* chunks = nullptr;
+
+    std::uint8_t* chunkData(std::size_t index, bool create) const {
+        auto* chunk = chunks[index].load(std::memory_order_acquire);
+        if (chunk == nullptr && create) {
+            auto fresh = std::unique_ptr<Chunk>(new (std::nothrow) Chunk{});
+            if (fresh != nullptr && chunks[index].compare_exchange_strong(chunk, fresh.get(), std::memory_order_acq_rel, std::memory_order_acquire)) chunk = fresh.release();
+        }
+        return chunk == nullptr ? nullptr : chunk->entries.data();
+    }
+
+    std::uint8_t* entry(std::size_t index, bool create) const {
+        if (chunks == nullptr) return pages + index;
+        auto* data = chunkData(index / ChunkEntries, create);
+        return data == nullptr ? nullptr : data + index % ChunkEntries;
+    }
 
-    // Reserves and commits the table; untouched table pages cost nothing until a guest page is recorded.
     bool allocate() {
         if (size == 0) return false;
         const auto count = (size / PageBytes + 8) & ~static_cast<std::size_t>(7);
 #ifdef _WIN32
-        pages = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, count, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        const auto chunkCount = (count + ChunkEntries - 1) / ChunkEntries;
+        chunks = new (std::nothrow) std::atomic<Chunk*>[chunkCount]{};
+        if (chunks == nullptr) size = 0;
+        return chunks != nullptr;
 #else
         pages = static_cast<std::uint8_t*>(std::calloc(count, 1));
-#endif
         if (pages == nullptr) size = 0;
         return pages != nullptr;
+#endif
     }
 
     bool covers(std::uintptr_t address) const {
@@ -387,11 +413,23 @@ struct PageSpan {
     }
 
     std::uint8_t load(std::uintptr_t address) const {
-        return std::atomic_ref<std::uint8_t>(const_cast<std::uint8_t&>(pages[(address - base) / PageBytes])).load(std::memory_order_relaxed);
+        auto* value = entry((address - base) / PageBytes, false);
+        return value == nullptr ? 0 : std::atomic_ref<std::uint8_t>(*value).load(std::memory_order_relaxed);
     }
 
     void store(std::uintptr_t address, std::uint8_t value) {
-        std::atomic_ref<std::uint8_t>(pages[(address - base) / PageBytes]).store(value, std::memory_order_relaxed);
+        if (auto* at = entry((address - base) / PageBytes, value != 0 && value != PageInaccessible)) std::atomic_ref<std::uint8_t>(*at).store(value, std::memory_order_relaxed);
+    }
+
+    void store(std::uintptr_t first, std::uintptr_t last, std::uint8_t value) {
+        auto index = (first - base) / PageBytes;
+        const auto stop = (last - 1 - base) / PageBytes + 1;
+        while (index < stop) {
+            const auto next = std::min(stop, (index / ChunkEntries + 1) * ChunkEntries);
+            if (auto* at = entry(index, value != 0 && value != PageInaccessible)) {
+                for (; index < next; ++index, ++at) std::atomic_ref<std::uint8_t>(*at).store(value, std::memory_order_relaxed);
+            } else index = next;
+        }
     }
 
     // End of the run of pages equal to `value` that starts at `address`, at most `limit`.
@@ -400,11 +438,17 @@ struct PageSpan {
         const auto stop = std::min<std::uintptr_t>((std::min(limit, base + size) - base + PageBytes - 1) / PageBytes, size / PageBytes);
         const std::uint64_t wide = 0x0101010101010101ull * value;
         while (index < stop) {
-            if (index % 8 == 0 && index + 8 <= stop && std::atomic_ref<std::uint64_t>(*reinterpret_cast<std::uint64_t*>(const_cast<std::uint8_t*>(pages + index))).load(std::memory_order_relaxed) == wide) {
+            auto* at = entry(index, false);
+            if (at == nullptr) {
+                if (value != 0) break;
+                index = std::min(stop, (index / ChunkEntries + 1) * ChunkEntries);
+                continue;
+            }
+            if (index % 8 == 0 && index + 8 <= stop && std::atomic_ref<std::uint64_t>(*reinterpret_cast<std::uint64_t*>(at)).load(std::memory_order_relaxed) == wide) {
                 index += 8;
                 continue;
             }
-            if (std::atomic_ref<std::uint8_t>(const_cast<std::uint8_t&>(pages[index])).load(std::memory_order_relaxed) != value) break;
+            if (std::atomic_ref<std::uint8_t>(*at).load(std::memory_order_relaxed) != value) break;
             ++index;
         }
         return std::min(limit, base + index * PageBytes);
@@ -414,7 +458,7 @@ struct PageSpan {
         if (size == 0 || bytes == 0 || address >= base + size || address + bytes <= base) return;
         const auto first = (std::max(address, base) - base) / PageBytes;
         const auto last = (std::min(address + bytes, base + size) - 1 - base) / PageBytes;
-        for (auto page = first; page <= last; ++page) std::atomic_ref<std::uint8_t>(pages[page]).store(0, std::memory_order_relaxed);
+        store(base + first * PageBytes, base + (last + 1) * PageBytes, 0);
     }
 };
 
@@ -445,7 +489,7 @@ struct PageStates {
             const std::uint8_t value = readable ? static_cast<std::uint8_t>(PageReadable | (writable ? PageWritable : 0u)) : PageInaccessible;
             const auto first = std::max(base, span->base);
             const auto last = std::min(regionEnd, span->base + span->size);
-            for (auto at = first; at < last; at += PageBytes) span->store(at, value);
+            span->store(first, last, value);
             if (GuestAllocations::GuestAllocationsGeneration_nid_postfix() != generation || accessSerial.load(std::memory_order_acquire) != access) span->forget(first, static_cast<std::size_t>(last - first));
         }
     }
@@ -848,7 +892,7 @@ void watchPrivateMapping(std::uintptr_t address, std::size_t bytes, std::uint64_
 #endif
 
 struct WriteTracker {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     bool initialized = false;
     bool watched = false;
     static constexpr std::size_t CoarseBlocks = 64;
@@ -874,6 +918,7 @@ struct WriteTracker {
     // bumps, or an image refreshed after a stamp would keep failing UnchangedSince until the next
     // walk of its range and re-upload at every use of the epoch.
     std::atomic<std::uint32_t> generation{1};
+    std::atomic<std::uint32_t> stable{1};
     std::vector<void*> pages;
     // Collect memo: page-rounded ranges walked during the current epoch (see BumpCollectEpoch). A
     // collect fully inside one skips GetWriteWatch, whose cost is proportional to the range's pages,
@@ -971,8 +1016,10 @@ struct WriteTracker {
     struct DriverPieces {
         std::uint32_t whole = 0;
         std::uint32_t dropped = 0;
-        std::uint32_t next = 0;
         std::array<DriverPiece, 4> pieces{};
+        std::uint32_t possibleWhole = 0;
+        std::uint32_t possibleDropped = 0;
+        std::array<DriverPiece, 4> possiblePieces{};
 
         bool covers(std::uint32_t begin, std::uint32_t end, std::uint64_t generation) const {
             if (generation == 0 || begin >= end || dropped > generation) return false;
@@ -995,6 +1042,7 @@ struct WriteTracker {
     };
     std::unordered_map<std::uint64_t, CpuPages> cpuPages;
     std::unordered_map<std::uint64_t, CpuPages> walkPages;
+    std::map<std::uint64_t, std::uint32_t> refused;
 
     void noteCpuStore(std::uint64_t begin, std::uint64_t end, std::uint32_t stampGeneration) {
         notePages(cpuPages, begin, end, stampGeneration);
@@ -1025,7 +1073,7 @@ struct WriteTracker {
 #endif
     }
 
-    void stampWatchedPart(std::uint64_t address, std::uint64_t end, std::uint32_t stampGeneration) {
+    void stampWatchedPart(std::uint64_t address, std::uint64_t end, std::uint32_t stampGeneration, bool complete) {
 #ifdef _WIN32
         address = std::max<std::uint64_t>(address, base);
         end = std::min<std::uint64_t>(end, base + size);
@@ -1039,24 +1087,45 @@ struct WriteTracker {
             const auto stop = std::min<std::uint64_t>(end, blockBegin(block) + WriteBlockBytes);
             if (!blockPartWatched(first, stop)) continue;
             stamp(block, stampGeneration, StampKind::Driver);
-            noteDriverStore(block, address, end, stampGeneration);
+            noteDriverStore(block, address, end, stampGeneration, complete);
         }
     }
 
-    void noteDriverStore(std::uint64_t block, std::uint64_t address, std::uint64_t end, std::uint32_t stampGeneration) {
+    void noteDriverStore(std::uint64_t block, std::uint64_t address, std::uint64_t end, std::uint32_t stampGeneration, bool complete) {
         const auto begin = blockBegin(block);
         const auto from = static_cast<std::uint32_t>(std::max(address, begin) - begin);
         const auto to = static_cast<std::uint32_t>(std::min<std::uint64_t>(end, begin + WriteBlockBytes) - begin);
         if (from == 0 && to == WriteBlockBytes) {
             auto& entry = driverPieces[block];
-            entry = DriverPieces{};
-            entry.whole = stampGeneration;
+            if (complete) {
+                entry = DriverPieces{};
+                entry.whole = stampGeneration;
+            } else {
+                entry.possibleWhole = stampGeneration;
+                entry.possibleDropped = 0;
+                entry.possiblePieces = {};
+            }
             return;
         }
         auto& entry = driverPieces[block];
-        auto& slot = entry.pieces[entry.next++ % entry.pieces.size()];
-        entry.dropped = std::max(entry.dropped, slot.generation);
-        slot = {stampGeneration, from, to};
+        auto& pieces = complete ? entry.pieces : entry.possiblePieces;
+        auto& dropped = complete ? entry.dropped : entry.possibleDropped;
+        DriverPiece* contained = nullptr;
+        for (auto& piece : pieces) {
+            if (piece.generation == 0 || piece.begin < from || piece.end > to) continue;
+            if (contained == nullptr) contained = &piece;
+            else piece = {};
+        }
+        if (contained != nullptr) {
+            *contained = {stampGeneration, from, to};
+            return;
+        }
+        auto* oldest = &pieces.front();
+        for (auto& piece : pieces) {
+            if (piece.generation < oldest->generation) oldest = &piece;
+        }
+        dropped = std::max(dropped, oldest->generation);
+        *oldest = {stampGeneration, from, to};
     }
 
     Leaf& leafFor(std::uint64_t block) {
@@ -1167,15 +1236,27 @@ struct WriteTracker {
                 continue;
             }
             const auto& entry = found->second;
-            if (entry.whole > generation || entry.dropped > generation) return true;
+            if (entry.whole > generation || entry.dropped > generation || entry.possibleWhole > generation || entry.possibleDropped > generation) return true;
             for (const auto& piece : entry.pieces) {
                 if (piece.generation > generation && piece.begin < to && from < piece.end) return true;
             }
+            for (const auto& piece : entry.possiblePieces) {
+                if (piece.generation > generation && piece.begin < to && from < piece.end) return true;
+            }
+        }
+        return false;
+    }
+
+    bool refusedSince(std::uint64_t address, std::uint64_t end, std::uint64_t since) const {
+        const auto last = blockOf(end - 1);
+        for (auto it = refused.lower_bound(blockOf(address)); it != refused.end() && it->first <= last; ++it) {
+            if (it->second > since) return true;
         }
         return false;
     }
 
     bool rangeUnchanged(std::uint64_t address, std::size_t bytes, std::uint64_t since) const {
+        if (refusedSince(address, address + bytes, since)) return false;
         return unchanged(blockOf(address), blockOf(address + bytes - 1), since) || !storedOver(address, address + bytes, since, true);
     }
 
@@ -1199,16 +1280,51 @@ WriteTracker& Tracker() {
 
 // Takes the tracker mutex; under APS5_PROFILE_DRAW an acquisition that found it held is counted
 // ('tracker waits N / M' in [guestmem]), which says whether walking outside the lock would pay.
-std::unique_lock<std::mutex> lockTracker(WriteTracker& tracker) {
-    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
-    if (!profile) return std::unique_lock(tracker.mutex);
-    std::unique_lock lock(tracker.mutex, std::try_to_lock);
-    if (!lock.owns_lock()) {
-        trackerWaits.fetch_add(1, std::memory_order_relaxed);
+class TrackerLock {
+public:
+    explicit TrackerLock(WriteTracker& tracker) : tracker(tracker), lock(tracker.mutex, std::defer_lock) {
+        static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+        if (!profile) {
+            lock.lock();
+            return;
+        }
+        if (!lock.try_lock()) {
+            trackerWaits.fetch_add(1, std::memory_order_relaxed);
+            lock.lock();
+        }
+        trackerAcquisitions.fetch_add(1, std::memory_order_relaxed);
+    }
+    ~TrackerLock() {
+        if (lock.owns_lock()) publish();
+    }
+    TrackerLock(const TrackerLock&) = delete;
+    TrackerLock& operator=(const TrackerLock&) = delete;
+
+    void Unlock() {
+        publish();
+        lock.unlock();
+    }
+
+    void Suspend() {
+        lock.unlock();
+    }
+
+    void Resume() {
         lock.lock();
     }
-    trackerAcquisitions.fetch_add(1, std::memory_order_relaxed);
-    return lock;
+
+private:
+    void publish() {
+        const auto current = tracker.generation.load(std::memory_order_relaxed);
+        if (tracker.stable.load(std::memory_order_relaxed) != current) tracker.stable.store(current, std::memory_order_release);
+    }
+
+    WriteTracker& tracker;
+    std::unique_lock<AgcDriver::Mutex> lock;
+};
+
+TrackerLock lockTracker(WriteTracker& tracker) {
+    return TrackerLock(tracker);
 }
 
 #ifdef _WIN32
@@ -1234,11 +1350,11 @@ void watchPrivateMapping(std::uintptr_t address, std::size_t bytes, std::uint64_
 // thread that never bumped is given a new epoch for every collect: its walks are never reused (the
 // presenter, game threads inside the flush hook), as nothing orders the CPU's writes for it.
 std::atomic<std::uint64_t> nextCollectEpoch{1};
-thread_local std::uint64_t threadCollectEpoch = 0;
+struct CollectEpochSlot {};
 std::atomic<std::uint64_t> lastBumpedEpoch{0};
 
 std::uint64_t currentCollectEpoch() {
-    if (threadCollectEpoch != 0) return threadCollectEpoch;
+    if (const auto epoch = HostThreadSlot<std::uint64_t, CollectEpochSlot>::Get(); epoch != 0) return epoch;
     return nextCollectEpoch.fetch_add(1, std::memory_order_relaxed) + 1;
 }
 
@@ -1255,7 +1371,15 @@ struct ThreadCollectMemo {
     std::array<WriteTracker::Memo, 64> entries{};
     std::size_t next = 0;
 };
-thread_local ThreadCollectMemo threadCollectMemo;
+ThreadCollectMemo& threadCollectMemo() {
+    struct Slot {};
+    auto* memo = HostThreadSlot<ThreadCollectMemo*, Slot>::Get();
+    if (memo == nullptr) {
+        ShaderRecompiler::ThreadOwned(memo);
+        HostThreadSlot<ThreadCollectMemo*, Slot>::Set(memo);
+    }
+    return *memo;
+}
 
 struct EpochCollectMap {
     std::uint64_t epoch = 0;
@@ -1337,13 +1461,32 @@ bool collectWindowsWrites(StampRuns& runs, std::uint64_t first, std::uint64_t st
     if (runs.stamped != 0) collectDirty.fetch_add(1, std::memory_order_relaxed);
     return fresh || singlePass || runs.stamped == 0 || walk(true);
 }
+
+void noteRefusedWalk(WriteTracker& tracker, std::uint64_t first, std::uint64_t stop) {
+    const auto pagesOf = [&](auto list, auto&& each) {
+        auto cursor = first;
+        while (cursor < stop) {
+            std::size_t count = tracker.pages.size();
+            list(static_cast<std::uintptr_t>(cursor), static_cast<std::size_t>(stop - cursor), tracker.pages.data(), &count);
+            for (std::size_t i = 0; i < count; ++i) each(reinterpret_cast<std::uintptr_t>(tracker.pages[i]));
+            if (count < tracker.pages.size()) break;
+            cursor = reinterpret_cast<std::uintptr_t>(tracker.pages[count - 1]) + WritePageBytes;
+        }
+    };
+    StampRuns runs{tracker, StampKind::Cpu};
+    pagesOf(&GuestArena::GuestArenaTakeUnreportedPages_nid_no_patch, [&](std::uintptr_t page) { stampWrittenRun(&runs, page, page + WritePageBytes); });
+    const auto generation = tracker.generation.load(std::memory_order_relaxed);
+    pagesOf(&GuestArena::GuestArenaComparedPages_nid_no_patch, [&](std::uintptr_t page) { tracker.refused[tracker.blockOf(page)] = generation; });
+}
 #endif
 
 bool walkWrites(WriteTracker& tracker, std::uint64_t first, std::uint64_t stop, StampKind kind, bool armedOnly = false, const WindowCopy* window = nullptr) {
     ++tracker.generation;
     StampRuns runs{tracker, kind, 0, window};
 #ifdef _WIN32
-    return collectWindowsWrites(runs, first, stop, armedOnly);
+    if (collectWindowsWrites(runs, first, stop, armedOnly)) return true;
+    noteRefusedWalk(tracker, first, stop);
+    return false;
 #else
     const auto dirtyRuns = collectDirtyRuns.load(std::memory_order_relaxed);
     const auto collect = armedOnly ? &GuestWriteWatch::GuestWriteWatchCollectArmed_nid_postfix : &GuestWriteWatch::GuestWriteWatchCollect_nid_postfix;
@@ -1373,16 +1516,16 @@ std::uint64_t collectWrites(std::uint64_t address, std::size_t bytes, bool memoi
             const auto& map = epochCollectMap(epoch);
             if (const auto found = map.ranges.find(first); found != map.ranges.end() && found->second.unwatched == unwatched && found->second.mapping == mapping && stop <= found->second.end) {
                 collectMemoHits.fetch_add(1, std::memory_order_relaxed);
-                return tracker.generation.load(std::memory_order_relaxed);
+                return tracker.stable.load(std::memory_order_acquire);
             }
         }
-        for (const auto& entry : threadCollectMemo.entries) {
+        for (const auto& entry : threadCollectMemo().entries) {
             if (entry.epoch == epoch && entry.unwatched == unwatched && entry.mapping == mapping && entry.begin <= first && stop <= entry.end) {
                 // The current generation, not the memoized one: blocks stamped since (MarkWritten, an
                 // overlapping collect) were written before this caller reads, and an older value would
                 // make every later UnchangedSince fail until the epoch ends.
                 collectMemoHits.fetch_add(1, std::memory_order_relaxed);
-                return tracker.generation.load(std::memory_order_relaxed);
+                return tracker.stable.load(std::memory_order_acquire);
             }
         }
     }
@@ -1400,7 +1543,7 @@ std::uint64_t collectWrites(std::uint64_t address, std::size_t bytes, bool memoi
     }
     const TimedAccess timed(CounterCollect, bytes);
 #ifndef _WIN32
-    if (useMemo && threadCollectEpoch != 0 && bytes <= WriteBlockBytes) {
+    if (useMemo && HostThreadSlot<std::uint64_t, CollectEpochSlot>::Get() != 0 && bytes <= WriteBlockBytes) {
         const auto begin = first & ~(WriteBlockBytes - 1);
         const auto end = (stop + WriteBlockBytes - 1) & ~(WriteBlockBytes - 1);
         if (end > begin && tracker.covers(begin, end - begin)) {
@@ -1415,7 +1558,8 @@ std::uint64_t collectWrites(std::uint64_t address, std::size_t bytes, bool memoi
         const auto serial = unwatchSerial.load(std::memory_order_relaxed);
         if (sharedCollectMemo()) tracker.memo[tracker.nextMemo++ % tracker.memo.size()] = {first, stop, epoch, serial, mapping};
         else {
-            threadCollectMemo.entries[threadCollectMemo.next++ % threadCollectMemo.entries.size()] = {first, stop, epoch, serial, mapping};
+            auto& memo = threadCollectMemo();
+            memo.entries[memo.next++ % memo.entries.size()] = {first, stop, epoch, serial, mapping};
             if (epochCollectMapEnabled()) {
                 auto& entry = epochCollectMap(epoch).ranges[first];
                 if (entry.unwatched != serial || entry.mapping != mapping || entry.end < stop) entry = {first, stop, epoch, serial, mapping};
@@ -1435,15 +1579,81 @@ std::uint64_t CollectWritesUncached(std::uint64_t address, std::size_t bytes) {
     return collectWrites(address, bytes, false);
 }
 
+std::uint64_t WriteGeneration() {
+    return Tracker().generation.load(std::memory_order_acquire);
+}
+
+std::uint64_t CollectWrittenBlocks(std::uint64_t address, std::size_t bytes, std::uint64_t since, std::vector<std::pair<std::uint64_t, std::uint64_t>>& written) {
+    written.clear();
+    if (bytes == 0 || bytes > std::numeric_limits<std::uint64_t>::max() - address) return 0;
+    auto& tracker = Tracker();
+    const auto lock = lockTracker(tracker);
+    tracker.initialize();
+    if (!tracker.watched) return 0;
+#ifdef _WIN32
+    if (address < tracker.base || bytes > tracker.size || address - tracker.base > tracker.size - bytes) return 0;
+#endif
+    const auto end = address + bytes;
+    const auto first = tracker.blockOf(address);
+    const auto last = tracker.blockOf(end - 1);
+    const auto clip = [&](std::uint64_t block) {
+        const auto begin = tracker.blockBegin(block);
+        return std::pair{std::max(address, begin), std::min<std::uint64_t>(end, begin + WriteBlockBytes)};
+    };
+    std::uint64_t spanBegin = 0;
+    std::uint64_t spanEnd = 0;
+    const auto walkSpan = [&] {
+        if (spanEnd > spanBegin) walkWrites(tracker, spanBegin & ~std::uint64_t{WritePageBytes - 1}, (spanEnd + WritePageBytes - 1) & ~std::uint64_t{WritePageBytes - 1}, StampKind::Cpu);
+        spanBegin = spanEnd = 0;
+    };
+    for (auto block = first; block <= last; ++block) {
+        const auto [begin, stop] = clip(block);
+        if (!tracker.covers(begin, stop - begin)) {
+            walkSpan();
+            continue;
+        }
+        if (spanEnd != begin) {
+            walkSpan();
+            spanBegin = begin;
+        }
+        spanEnd = stop;
+    }
+    walkSpan();
+    const auto append = [&](std::uint64_t begin, std::uint64_t stop) {
+        if (!written.empty() && written.back().second == begin) written.back().second = stop;
+        else written.emplace_back(begin, stop);
+    };
+    for (auto block = first; block <= last; ++block) {
+        if (tracker.cpuStampOf(block) <= since) continue;
+        const auto [begin, stop] = clip(block);
+        const auto pages = tracker.cpuPages.find(block);
+        bool any = false;
+        if (pages != tracker.cpuPages.end()) {
+            const auto blockStart = tracker.blockBegin(block);
+            for (std::size_t page = 0; page < WritePagesPerBlock; ++page) {
+                if (pages->second.pages[page] <= since) continue;
+                const auto pageBegin = std::max<std::uint64_t>(begin, blockStart + page * WritePageBytes);
+                const auto pageEnd = std::min<std::uint64_t>(stop, blockStart + (page + 1) * WritePageBytes);
+                if (pageBegin >= pageEnd) continue;
+                append(pageBegin, pageEnd);
+                any = true;
+            }
+        }
+        if (!any) append(begin, stop);
+    }
+    return tracker.generation.load(std::memory_order_relaxed);
+}
+
 void BumpCollectEpoch() {
-    threadCollectEpoch = nextCollectEpoch.fetch_add(1, std::memory_order_relaxed) + 1;
+    const auto epoch = nextCollectEpoch.fetch_add(1, std::memory_order_relaxed) + 1;
+    HostThreadSlot<std::uint64_t, CollectEpochSlot>::Set(epoch);
     auto last = lastBumpedEpoch.load(std::memory_order_relaxed);
-    while (last < threadCollectEpoch && !lastBumpedEpoch.compare_exchange_weak(last, threadCollectEpoch, std::memory_order_release, std::memory_order_relaxed)) {}
+    while (last < epoch && !lastBumpedEpoch.compare_exchange_weak(last, epoch, std::memory_order_release, std::memory_order_relaxed)) {}
     collectEpochBumps.fetch_add(1, std::memory_order_relaxed);
 }
 
 std::uint64_t ThreadCollectEpoch() {
-    return collectMemoEnabled() ? threadCollectEpoch : 0;
+    return collectMemoEnabled() ? HostThreadSlot<std::uint64_t, CollectEpochSlot>::Get() : 0;
 }
 
 std::uint64_t UnwatchSerial() {
@@ -1452,15 +1662,32 @@ std::uint64_t UnwatchSerial() {
 
 void AdoptLatestCollectEpoch() {
     const auto latest = lastBumpedEpoch.load(std::memory_order_acquire);
-    if (latest > threadCollectEpoch) threadCollectEpoch = latest;
+    if (latest > HostThreadSlot<std::uint64_t, CollectEpochSlot>::Get()) HostThreadSlot<std::uint64_t, CollectEpochSlot>::Set(latest);
 }
 
 std::uint64_t CollectEpochBumps() {
     return collectEpochBumps.load(std::memory_order_relaxed);
 }
 
+namespace {
+std::atomic<std::uint64_t> proofSerial{1};
+thread_local bool proofThread = false;
+}
+
+std::uint64_t ProofSerial() {
+    return proofSerial.load(std::memory_order_acquire);
+}
+
+void BreakProofs() {
+    proofSerial.fetch_add(1, std::memory_order_acq_rel);
+}
+
+void MarkProofThread() {
+    proofThread = true;
+}
+
 std::uint64_t CollectEpoch() {
-    return collectMemoEnabled() ? threadCollectEpoch : 0;
+    return collectMemoEnabled() ? HostThreadSlot<std::uint64_t, CollectEpochSlot>::Get() : 0;
 }
 
 namespace {
@@ -1526,7 +1753,9 @@ void Rewatch(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
     for (const auto& [begin, end] : ranges) {
         if (end <= begin || begin < tracker.base || end - tracker.base > tracker.size || (begin - tracker.base) % WriteBlockBytes != 0 || (end - tracker.base) % WriteBlockBytes != 0) continue;
         const auto bytes = static_cast<std::size_t>(end - begin);
-        if (tracker.coverage.Covers(begin, bytes) || !walkWrites(tracker, begin, end, StampKind::Cpu) || !tracker.coverage.Restore(begin, bytes)) continue;
+        if (tracker.coverage.Covers(begin, bytes)) continue;
+        GuestArena::GuestArenaCompareWhenShared_nid_no_patch(static_cast<std::uintptr_t>(begin), bytes);
+        if (!walkWrites(tracker, begin, end, StampKind::Cpu) || !tracker.coverage.Restore(begin, bytes)) continue;
         ++tracker.generation;
         tracker.noteCpuStore(begin, end, tracker.generation);
         for (auto block = tracker.blockOf(begin); block <= tracker.blockOf(end - 1); ++block) {
@@ -1552,7 +1781,7 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
     auto lock = lockTracker(tracker);
     tracker.initialize();
     if (!tracker.watched) {
-        lock.unlock();
+        lock.Unlock();
         return import();
     }
     constexpr std::uint64_t page = 4096;
@@ -1597,6 +1826,9 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
     auto unwatchedFrom = first;
     for (const auto& [begin, end] : spans) {
         if (!walkWrites(tracker, begin, end, StampKind::Cpu, true, &window)) continue;
+#ifdef _WIN32
+        GuestArena::GuestArenaCompareResidentWhenShared_nid_no_patch(static_cast<std::uintptr_t>(begin), static_cast<std::size_t>(end - begin));
+#endif
         if (unwatchedFrom < begin) unwatchLocked(tracker, unwatchedFrom, static_cast<std::size_t>(begin - unwatchedFrom));
         unwatchedFrom = end;
     }
@@ -1659,24 +1891,25 @@ bool UnchangedCommittedSince(std::span<const std::pair<std::uint64_t, std::uint6
     tracker.initialize();
     if (!tracker.watched || generation == 0) return false;
     for (const auto& [begin, end] : ranges) {
-        if (end <= begin || !tracker.covers(begin, static_cast<std::size_t>(end - begin)) || tracker.newestStamp(begin, end) > generation) return false;
+        if (end <= begin || !tracker.covers(begin, static_cast<std::size_t>(end - begin)) || tracker.newestStamp(begin, end) > generation || tracker.refusedSince(begin, end, generation)) return false;
     }
     return true;
 }
 
 std::uint64_t storeOwn(std::uint64_t address, std::size_t bytes, const std::function<std::pair<std::uint64_t, std::uint64_t>()>& store) {
     if (bytes == 0) return 0;
+    BreakProofs();
     const auto stampStored = [](WriteTracker& tracker, std::pair<std::uint64_t, std::uint64_t> stored) -> std::uint64_t {
         if (stored.second <= stored.first) return 0;
         ++tracker.generation;
         if (!tracker.watched || !tracker.covers(stored.first, static_cast<std::size_t>(stored.second - stored.first))) {
             tracker.noteUnstampedStore(stored.first, stored.second);
-            if (tracker.watched) tracker.stampWatchedPart(stored.first, stored.second, tracker.generation);
+            if (tracker.watched) tracker.stampWatchedPart(stored.first, stored.second, tracker.generation, true);
             return 0;
         }
         for (auto block = tracker.blockOf(stored.first); block <= tracker.blockOf(stored.second - 1); ++block) {
             tracker.stamp(block, tracker.generation, StampKind::Driver);
-            tracker.noteDriverStore(block, stored.first, stored.second, tracker.generation);
+            tracker.noteDriverStore(block, stored.first, stored.second, tracker.generation, true);
         }
         return tracker.generation;
     };
@@ -1709,7 +1942,8 @@ std::uint64_t StoreOwnBytes(std::uint64_t address, std::span<const std::byte> so
     });
 }
 
-std::uint64_t MarkWritten(std::uint64_t address, std::size_t bytes) {
+static std::uint64_t markWritten(std::uint64_t address, std::size_t bytes, bool complete) {
+    BreakProofs();
     auto& tracker = Tracker();
     auto lock = lockTracker(tracker);
     tracker.initialize();
@@ -1717,7 +1951,7 @@ std::uint64_t MarkWritten(std::uint64_t address, std::size_t bytes) {
     ++tracker.generation;
     if (!tracker.watched || !tracker.covers(address, bytes)) {
         tracker.noteUnstampedStore(address, address + bytes);
-        if (tracker.watched) tracker.stampWatchedPart(address, address + bytes, tracker.generation);
+        if (tracker.watched) tracker.stampWatchedPart(address, address + bytes, tracker.generation, complete);
         return 0;
     }
     {
@@ -1725,14 +1959,14 @@ std::uint64_t MarkWritten(std::uint64_t address, std::size_t bytes) {
         const auto blockStop = (address + bytes + WriteBlockBytes - 1) & ~(std::uint64_t{WriteBlockBytes} - 1);
         StampRuns runs{tracker, StampKind::Fresh};
 #ifdef _WIN32
-        const bool complete = collectWindowsWrites(runs, blockFirst, blockStop, false);
+        const bool collected = collectWindowsWrites(runs, blockFirst, blockStop, false);
 #else
-        const bool complete = GuestWriteWatch::GuestWriteWatchCollectFresh_nid_postfix(static_cast<std::uintptr_t>(blockFirst), static_cast<std::size_t>(blockStop - blockFirst), &stampWrittenRun, &runs);
+        const bool collected = GuestWriteWatch::GuestWriteWatchCollectFresh_nid_postfix(static_cast<std::uintptr_t>(blockFirst), static_cast<std::size_t>(blockStop - blockFirst), &stampWrittenRun, &runs);
 #endif
-        if (!complete) {
-            lock.unlock();
+        if (!collected) {
+            lock.Suspend();
             beforeUnwatch(blockFirst, static_cast<std::size_t>(blockStop - blockFirst));
-            lock.lock();
+            lock.Resume();
             unwatchLocked(tracker, blockFirst, static_cast<std::size_t>(blockStop - blockFirst));
             tracker.noteUnstampedStore(address, address + bytes);
             return 0;
@@ -1743,11 +1977,19 @@ std::uint64_t MarkWritten(std::uint64_t address, std::size_t bytes) {
     const auto last = tracker.blockOf(address + bytes - 1);
     for (auto block = first; block <= last; ++block) {
         tracker.stamp(block, tracker.generation, StampKind::Driver);
-        tracker.noteDriverStore(block, address, address + bytes, tracker.generation);
+        tracker.noteDriverStore(block, address, address + bytes, tracker.generation, complete);
     }
     return tracker.generation;
 }
 
+std::uint64_t MarkWritten(std::uint64_t address, std::size_t bytes) {
+    return markWritten(address, bytes, true);
+}
+
+std::uint64_t MarkPossiblyWritten(std::uint64_t address, std::size_t bytes) {
+    return markWritten(address, bytes, false);
+}
+
 bool StoredOver(std::uint64_t address, std::size_t bytes, std::uint64_t generation) {
     auto& tracker = Tracker();
     const auto lock = lockTracker(tracker);
@@ -2053,24 +2295,29 @@ std::string WaitedBehindReport(const HolderMatrixValues& waited) {
 
 }
 
-// The owner token is a thread-local's address: unique per live thread and free to read.
 namespace {
-const void* ThreadToken() {
-    thread_local char token;
-    return &token;
-}
-
 std::atomic<std::uint64_t> gpuHoldSerial{0};
 }
 
+void GpuMutexType::enter() {
+    if (!HeldByThisThread()) LockSpinning(mutex, HandoffSpinWindow());
+}
+
+bool GpuMutexType::tryEnter() {
+    return HeldByThisThread() || mutex.try_lock();
+}
+
 void GpuMutexType::acquired() {
-    owner.store(ThreadToken(), std::memory_order_relaxed);
-    if (++depth == 1) gpuHoldSerial.fetch_add(1, std::memory_order_relaxed);
+    owner.store(CurrentThreadToken(), std::memory_order_relaxed);
+    if (++depth == 1) {
+        gpuHoldSerial.fetch_add(1, std::memory_order_relaxed);
+        if (!proofThread) BreakProofs();
+    }
 }
 
 bool GpuMutexType::try_lock() {
     if (!GpuLockProfiled()) {
-        if (!mutex.try_lock()) return false;
+        if (!tryEnter()) return false;
         acquired();
         return true;
     }
@@ -2079,7 +2326,7 @@ bool GpuMutexType::try_lock() {
     auto& stats = LockStats();
     const auto tagged = std::exchange(stats.nextSite, GpuLockSite::Other);
     ++stats.tries;
-    if (!mutex.try_lock()) {
+    if (!tryEnter()) {
         ++stats.triesFailed;
         return false;
     }
@@ -2106,8 +2353,8 @@ void GpuMutexType::unlock() {
         owner.store(nullptr, std::memory_order_relaxed);
         // Still the holder here: the hold ends when the mutex is given up, not before.
         if (GpuHoldProfiled()) EndHold();
+        mutex.unlock();
     }
-    mutex.unlock();
     // After the release, so what the hook does (destroying a batch's kept objects) is neither part
     // of the hold nor waited for by the next holder.
     if (outermost) {
@@ -2116,7 +2363,7 @@ void GpuMutexType::unlock() {
 }
 
 bool GpuMutexType::HeldByThisThread() const {
-    return owner.load(std::memory_order_relaxed) == ThreadToken();
+    return owner.load(std::memory_order_relaxed) == CurrentThreadToken();
 }
 
 std::uint32_t GpuMutexType::DepthOnThisThread() const {
@@ -2135,10 +2382,10 @@ void GpuMutexType::lock() {
     if (!GpuLockProfiled()) {
         auto* trace = PerformanceTrace::Recording() ? PerformanceTrace::Thread() : nullptr;
         if (trace == nullptr) {
-            LockSpinning(mutex, HandoffSpinWindow());
+            enter();
         } else {
             const auto site = static_cast<std::size_t>(std::exchange(LockStats().nextSite, GpuLockSite::Other));
-            if (!mutex.try_lock()) {
+            if (!tryEnter()) {
                 const auto start = std::chrono::steady_clock::now();
                 LockSpinning(mutex, HandoffSpinWindow());
                 trace->Add("GpuMutex.wait", GpuLockSiteNames[site], start, std::chrono::steady_clock::now());
@@ -2153,7 +2400,7 @@ void GpuMutexType::lock() {
     ++stats.siteAcquisitions[site];
     // An uncontended (or recursive) acquisition costs no clock reads for the wait; only a wait is
     // timed. The hold timer (outermost acquisitions only) starts once the mutex is held.
-    if (!mutex.try_lock()) {
+    if (!tryEnter()) {
         const bool holders = GpuHoldProfiled();
         HolderMatrixValues before{};
         if (holders) Holders().Snapshot(before);
@@ -2420,6 +2667,7 @@ void WriteChangedCommitted(std::uint64_t address, std::span<const std::byte> cur
 
 void WriteChanged(std::uint64_t address, std::span<const std::byte> current, std::span<const std::byte> original) {
     require(current.size() == original.size(), "write-back snapshot sizes differ");
+    BreakProofs();
     if (current.empty()) return;
     // A store: the hook sync it makes orders this write after a pending GPU write, whatever a read
     // site above it was doing (the [hooksync] line counts stores apart).
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp
index cbbb9c549d..d33999f9e3 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/HostAllocator.cpp
@@ -24,6 +24,41 @@ struct Cache {
     std::uint16_t counts[Classes];
 };
 
+constexpr std::uint16_t KeptLists = 8;
+
+struct Depot {
+    SRWLOCK lock = SRWLOCK_INIT;
+    void* lists = nullptr;
+    std::uint16_t count = 0;
+};
+
+Depot depots[Classes];
+
+bool KeepList(std::size_t sizeClass, void* list) noexcept {
+    auto& depot = depots[sizeClass];
+    AcquireSRWLockExclusive(&depot.lock);
+    const bool kept = depot.count < KeptLists;
+    if (kept) {
+        static_cast<void**>(list)[1] = depot.lists;
+        depot.lists = list;
+        ++depot.count;
+    }
+    ReleaseSRWLockExclusive(&depot.lock);
+    return kept;
+}
+
+void* TakeList(std::size_t sizeClass) noexcept {
+    auto& depot = depots[sizeClass];
+    AcquireSRWLockExclusive(&depot.lock);
+    void* list = depot.lists;
+    if (list != nullptr) {
+        depot.lists = static_cast<void**>(list)[1];
+        --depot.count;
+    }
+    ReleaseSRWLockExclusive(&depot.lock);
+    return list;
+}
+
 Cache* const Closed = reinterpret_cast<Cache*>(std::uintptr_t{1});
 
 constexpr unsigned long TlsSlotsOffset = 0x1480;
@@ -114,6 +149,12 @@ void* TryAllocate(std::size_t bytes) noexcept {
     if (bytes <= LargestCached) {
         const auto sizeClass = (bytes - 1) / Granule;
         if (auto* cache = CurrentCache()) {
+            if (cache->heads[sizeClass] == nullptr) {
+                if (void* list = TakeList(sizeClass)) {
+                    cache->heads[sizeClass] = list;
+                    cache->counts[sizeClass] = Depth(sizeClass);
+                }
+            }
             if (void* block = cache->heads[sizeClass]) {
                 cache->heads[sizeClass] = *static_cast<void**>(block);
                 --cache->counts[sizeClass];
@@ -140,6 +181,10 @@ void Release(void* block, std::size_t bytes = 0) noexcept {
         const auto usable = bytes != 0 && bytes % Granule == 0 ? bytes : _msize(block);
         if (usable >= Granule && usable < LargestCached + Granule) {
             const auto sizeClass = usable / Granule - 1;
+            if (cache->counts[sizeClass] == Depth(sizeClass) && KeepList(sizeClass, cache->heads[sizeClass])) {
+                cache->heads[sizeClass] = nullptr;
+                cache->counts[sizeClass] = 0;
+            }
             if (cache->counts[sizeClass] < Depth(sizeClass)) {
                 *static_cast<void**>(block) = cache->heads[sizeClass];
                 cache->heads[sizeClass] = block;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp
index 20b73f581a..09dda98153 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp
@@ -1,8 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/PreciseWait.hpp"
 #include <algorithm>
+#include <atomic>
 #include <thread>
 #include <chrono>
 #include <cstdio>
@@ -12,8 +14,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-
 namespace AgcDriver::Pm4 {
 
 std::uint64_t GdsAddress() {
@@ -114,7 +114,6 @@ std::vector<std::byte> copySource(std::uint64_t source, std::size_t bytes, bool
     return data;
 }
 
-
 bool gdsRange(std::uint64_t offset, std::size_t bytes) {
     return offset <= GdsBytes && bytes <= GdsBytes - offset;
 }
@@ -226,8 +225,7 @@ std::string_view UnsupportedReason(std::uint32_t header) {
             return "graphics draw, shader stages and guest render-target materialization are not implemented";
         case 0x33: case 0x3f: return "nested command buffers, branching and nested flip reservation are not implemented";
         case 0x3c: case 0x93: return {};
-        case 0x39:
-            return "cooperative command-queue waits are not implemented";
+        case 0x39: return {};
         case 0x59: return {};
         case 0x84: case 0x85: case 0x86: case 0x88:
             return "separate CE/DE execution and counter synchronization are not implemented";
@@ -450,7 +448,7 @@ void Validate(std::span<const std::uint32_t> packet, std::uint32_t queue) {
         }
         case 0x59:
             size(2);
-            require((packet[1] & 0x7fffffffu) == 0, "unsupported REWIND payload bits");
+            require((packet[1] & ~(RewindValid | RewindOffloadEnable)) == 0, "unsupported REWIND payload bits");
             break;
         case 0x3c: case 0x93: {
             size(opcode == 0x3c ? 7 : 9);
@@ -458,6 +456,12 @@ void Validate(std::span<const std::uint32_t> packet, std::uint32_t queue) {
             require((packet[1] & 7u) <= 6u, "invalid WAIT_REG_MEM compare function");
             break;
         }
+        case 0x39:
+            size(4);
+            require((packet[3] >> 29u) == 6u || (packet[3] >> 29u) == 7u, "invalid MEM_SEMAPHORE operation");
+            require(address(packet[1], packet[2]) != 0 && (packet[1] & 7u) == 0, "null or misaligned MEM_SEMAPHORE address");
+            require((packet[3] & 0x10000u) == 0, "MEM_SEMAPHORE mailbox waits are not implemented");
+            break;
         case 0x45: {
             size(9);
             require((packet[1] & ~0x317u) == 0, "COND_WRITE reserved fields are not implemented");
@@ -716,6 +720,7 @@ std::vector<PacketStore> DecodeStores(std::span<const std::uint32_t> packet) {
             if (!label.has_value()) return {};
             return {known(label->address, label->Bytes())};
         }
+        case 0x39: return {runTime(address(packet[1], packet[2]), 8)};
         case 0x40: {
             require(packet.size() == 6, "invalid COPY_DATA size");
             if (CopyDataToRegister(packet)) return {};
@@ -771,7 +776,7 @@ bool UsesGpuCacheBarrier(std::span<const std::uint32_t> packet) {
 
 bool AccessesMemory(std::uint32_t header) {
     switch ((header >> 8u) & 0xffu) {
-        case 0x22: case 0x27: case 0x3c: case 0x93: case 0x49: case 0x16: case 0x2d: case 0x35: case 0x24: case 0x25: case 0x2c: case 0x38: case 0x37: case 0x40: case 0x45: case 0x50: case 0x63: case 0x64: case 0x83: case 0x91: case 0x9f: return true;
+        case 0x22: case 0x27: case 0x39: case 0x3c: case 0x93: case 0x49: case 0x16: case 0x2d: case 0x35: case 0x24: case 0x25: case 0x2c: case 0x38: case 0x37: case 0x40: case 0x45: case 0x50: case 0x63: case 0x64: case 0x83: case 0x91: case 0x9f: return true;
         default: return false;
     }
 }
@@ -846,7 +851,7 @@ DrawParameters resolveIndirectDraw(std::span<const std::uint32_t> packet, const
     indirect.drawIndexLocation = multi ? location(packet[4] & 0xffffu) : 0x280u;
     indirect.drawIndexEnabled = multi && (packet[4] >> 31u) != 0;
     indirect.indxOffset = 0;
-    require(indirect.count <= (std::numeric_limits<std::uint64_t>::max() - indirect.arguments - indirect.recordBytes) / indirect.stride, "indirect draw record range overflow");
+    require(indirect.RangeBytes() <= std::numeric_limits<std::uint64_t>::max() - indirect.arguments, "indirect draw record range overflow");
     // The counts are unknown here (the CP takes them from the record; NUM_INSTANCES is ignored).
     DrawParameters draw{0, 0, 0, 0, packet.back() & 0x20u, indexed, 0, 0};
     if (!indexed) {
@@ -856,12 +861,17 @@ DrawParameters resolveIndirectDraw(std::span<const std::uint32_t> packet, const
         indirect.indxOffset = offset->second;
     } else {
         const auto indexSize = indexSizeOf(queue);
-        require(queue.indexBufferSize != 0, "INDEX_BUFFER_SIZE has not been set");
-        const auto bytes = static_cast<std::uint64_t>(queue.indexBufferSize) * indexSize;
-        require(bytes <= std::numeric_limits<std::size_t>::max() && bytes <= std::numeric_limits<std::uint64_t>::max() - queue.indexBase, "index range size overflow");
         draw.indexAddress = queue.indexBase;
-        draw.indexCount = queue.indexBufferSize;
         draw.indexSize = indexSize;
+        if (queue.indexBufferSize) {
+            require(*queue.indexBufferSize != 0, "INDEX_BUFFER_SIZE is zero");
+            const auto bytes = static_cast<std::uint64_t>(*queue.indexBufferSize) * indexSize;
+            require(bytes <= std::numeric_limits<std::size_t>::max() && bytes <= std::numeric_limits<std::uint64_t>::max() - queue.indexBase, "index range size overflow");
+            draw.indexCount = *queue.indexBufferSize;
+        } else {
+            draw.indexCount = 0;
+            indirect.indexLimitKnown = false;
+        }
     }
     draw.indirect = indirect;
     return draw;
@@ -1072,6 +1082,47 @@ void Execute(std::span<const std::uint32_t> packet, QueueState& queue) {
             }
             return;
         }
+        case 0x39: {
+            const auto semaphore = address(packet[1], packet[2]);
+            auto* word = reinterpret_cast<std::uint64_t*>(semaphore);
+            std::atomic_ref<std::uint64_t> shared(*word);
+            const auto prepare = [&] {
+                GuestMemory::GuardRead(semaphore, sizeof(*word));
+                GuestMemory::FlushGpuWrites(semaphore, sizeof(*word));
+                GuestMemory::CheckRange(word, sizeof(*word), std::atomic_ref<std::uint64_t>::required_alignment, true);
+            };
+            if ((packet[3] >> 29u) == 6u) {
+                prepare();
+                const bool set = (packet[3] & 0x100000u) != 0;
+                GuestMemory::StoreOwnBytes(semaphore, sizeof(*word), [&] {
+                    if (set) shared.store(1, std::memory_order_release);
+                    else shared.fetch_add(1, std::memory_order_acq_rel);
+                });
+                return;
+            }
+            const auto start = std::chrono::steady_clock::now();
+            bool warned = false;
+            for (;;) {
+                {
+                    const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::Wait);
+                    prepare();
+                }
+                auto value = shared.load(std::memory_order_acquire);
+                if (value != 0) {
+                    bool taken = false;
+                    GuestMemory::StoreOwnBytes(semaphore, sizeof(*word), [&] {
+                        taken = shared.compare_exchange_strong(value, value - 1, std::memory_order_acq_rel);
+                    });
+                    if (taken) return;
+                    continue;
+                }
+                PreciseSleepUs(50);
+                if (!warned && std::chrono::steady_clock::now() - start > std::chrono::seconds(5)) {
+                    warned = true;
+                    std::fprintf(stderr, "[gpu] MEM_SEMAPHORE wait at 0x%llx still waiting after 5s\n", static_cast<unsigned long long>(semaphore));
+                }
+            }
+        }
         case 0x49: {
             // Earlier work has drained by the time the driver reaches this packet, so the end-of-pipe
             // write can happen immediately.
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Screenshot.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Screenshot.cpp
index 6a930d4e30..9e60cbac8c 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Screenshot.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Screenshot.cpp
@@ -16,8 +16,12 @@ namespace {
 std::atomic<bool> requested{false};
 
 std::filesystem::path directory() {
+#ifdef _WIN32
+    const wchar_t* configured = _wgetenv(L"ANYPS5_SCREENSHOTS");
+#else
     const char* configured = std::getenv("ANYPS5_SCREENSHOTS");
-    if (configured != nullptr && configured[0] != '\0') return configured;
+#endif
+    if (configured != nullptr && configured[0] != 0) return configured;
     const std::unique_ptr<char, decltype(&SDL_free)> basePath(SDL_GetBasePath(), SDL_free);
     if (!basePath) throw std::runtime_error(std::string("Screenshot: cannot locate the executable: ") + SDL_GetError());
     return std::filesystem::path(reinterpret_cast<const char8_t*>(basePath.get())) / "anyps5-screenshots";
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp
index 253d832b7c..4fc0fb89bc 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/ShaderMemory.cpp
@@ -18,6 +18,8 @@
 #include <memory>
 #include <stdexcept>
 #include <vector>
+#include <mutex>
+#include <unordered_map>
 
 namespace AgcDriver {
 namespace {
@@ -130,6 +132,23 @@ std::vector<std::unique_ptr<TPage>>& pagePool() {
 
 constexpr std::size_t PagePoolLimit = 64;
 
+bool sharedPagePools() {
+    static const bool enabled = std::getenv("APS5_DRAW_PIPELINE") != nullptr;
+    return enabled;
+}
+
+template<typename TPage>
+struct SharedPagePool {
+    std::mutex mutex;
+    std::vector<std::unique_ptr<TPage>> pages;
+};
+
+template<typename TPage>
+SharedPagePool<TPage>& sharedPagePool() {
+    static auto* pool = new SharedPagePool<TPage>();
+    return *pool;
+}
+
 }
 
 void ShaderMemory::SetWaitedMsProvider(WaitedMsProvider provider) {
@@ -144,6 +163,15 @@ ShaderMemory::ShaderMemory(std::span<const ShaderRecompiler::MemoryRegion> regio
 }
 
 ShaderMemory::~ShaderMemory() {
+    if (sharedPagePools() && !pages.empty()) {
+        auto& shared = sharedPagePool<Page>();
+        std::lock_guard lock(shared.mutex);
+        for (const auto& [base, page] : pages) {
+            if (shared.pages.size() < 1024) shared.pages.emplace_back(page);
+            else delete page;
+        }
+        return;
+    }
     auto& pool = pagePool<Page>();
     for (const auto& [base, page] : pages) {
         if (pool.size() < PagePoolLimit) pool.emplace_back(page);
@@ -191,6 +219,14 @@ std::size_t ShaderMemory::pageAtOrAfter(std::uint64_t base) const {
 
 ShaderMemory::Page& ShaderMemory::addPage(std::size_t position, std::uint64_t base) {
     auto& pool = pagePool<Page>();
+    if (pool.empty() && sharedPagePools()) {
+        auto& shared = sharedPagePool<Page>();
+        std::lock_guard lock(shared.mutex);
+        for (std::size_t i = 0; i < 32 && !shared.pages.empty(); ++i) {
+            pool.push_back(std::move(shared.pages.back()));
+            shared.pages.pop_back();
+        }
+    }
     std::unique_ptr<Page> owned;
     if (pool.empty()) {
         owned = std::make_unique<Page>();
@@ -356,7 +392,7 @@ bool ShaderMemory::readWords(void* context, std::uint64_t address, std::uint32_t
                 }
                 auto last = first + BlockWords;
                 while (last < end && !page->valid.TestBlock(last)) last += BlockWords;
-                std::memcpy(&page->words[first], reinterpret_cast<const void*>(base + first * sizeof(std::uint32_t)), (last - first) * sizeof(std::uint32_t));
+                GuestMemory::CopyGuestBytes(&page->words[first], reinterpret_cast<const void*>(base + first * sizeof(std::uint32_t)), (last - first) * sizeof(std::uint32_t));
                 page->valid.SetRun(first, last - first);
                 first = last;
             }
@@ -459,8 +495,8 @@ bool ShaderMemory::place(std::uint64_t address, const std::uint32_t* values, std
                 if (!page.valid.Test(index + word)) page.words[index + word] = values[word];
             }
         }
-        if (headOpen && head < index) std::memcpy(&page.words[head], reinterpret_cast<const void*>(base + head * sizeof(std::uint32_t)), (index - head) * sizeof(std::uint32_t));
-        if (tailOpen && index + words < tail) std::memcpy(&page.words[index + words], reinterpret_cast<const void*>(base + (index + words) * sizeof(std::uint32_t)), (tail - index - words) * sizeof(std::uint32_t));
+        if (headOpen && head < index) GuestMemory::CopyGuestBytes(&page.words[head], reinterpret_cast<const void*>(base + head * sizeof(std::uint32_t)), (index - head) * sizeof(std::uint32_t));
+        if (tailOpen && index + words < tail) GuestMemory::CopyGuestBytes(&page.words[index + words], reinterpret_cast<const void*>(base + (index + words) * sizeof(std::uint32_t)), (tail - index - words) * sizeof(std::uint32_t));
         page.valid.SetRun(page.lazy ? head : index, page.lazy ? tail - head : words);
         page.read.SetRun(index, words);
         if (recent) page.recent.SetRun(index, words);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp
index 217e5b0c81..9caddde7bd 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/SubmissionCapture.cpp
@@ -101,8 +101,12 @@ SubmissionCapture::SubmissionCapture(const std::filesystem::path& directory) : d
 
 SubmissionCapture* SubmissionCapture::Active() {
     static SubmissionCapture* const capture = [] {
+#ifdef _WIN32
+        const wchar_t* directory = _wgetenv(L"APS5_DUMP_SUBMITS");
+#else
         const char* directory = std::getenv("APS5_DUMP_SUBMITS");
-        return directory != nullptr && *directory != '\0' ? new SubmissionCapture(directory) : nullptr;
+#endif
+        return directory != nullptr && *directory != 0 ? new SubmissionCapture(directory) : nullptr;
     }();
     return capture;
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
index 89ad6e3157..70fdef29e3 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Execution/include/FrameDumpIo.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineSpecialization.hpp"
 #include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "BdaAbi.hpp"
 #if ANYPS5_ENABLE_SPIRV_TOOLS
 #include "SpirvBackend/SpirvOptimizer.hpp"
@@ -28,6 +29,7 @@
 #include "prx/libSceAgcDriver/Execution/include/Screenshot.hpp"
 #include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PlaceholderImages.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
 #include "prx/libSceAgcDriver/Execution/include/DisplayFormat.hpp"
@@ -80,6 +82,44 @@
 #include <utility>
 
 namespace AgcDriver {
+
+DeviceQueuePlan PlanDeviceQueues(std::span<const VkQueueFamilyProperties> families, std::uint32_t family, bool settles, bool sparseBinding) {
+    DeviceQueuePlan plan;
+    const auto count = static_cast<std::uint32_t>(families.size());
+    if (settles) {
+        if (family < count && families[family].queueCount >= 2) {
+            plan.mainCount = 2;
+            plan.settle = true;
+            plan.settleFamily = family;
+            plan.settleIndex = 1;
+        } else {
+            const auto copies = [&](std::uint32_t index) { return index != family && families[index].queueCount != 0 && (families[index].queueFlags & (VK_QUEUE_TRANSFER_BIT | VK_QUEUE_COMPUTE_BIT | VK_QUEUE_GRAPHICS_BIT)) != 0; };
+            for (std::uint32_t i = 0; i < count && !plan.settle; ++i) {
+                if (copies(i) && (families[i].queueFlags & (VK_QUEUE_COMPUTE_BIT | VK_QUEUE_GRAPHICS_BIT)) == 0) plan.settle = true, plan.settleFamily = i;
+            }
+            for (std::uint32_t i = 0; i < count && !plan.settle; ++i) {
+                if (copies(i)) plan.settle = true, plan.settleFamily = i;
+            }
+        }
+    }
+    if (!sparseBinding) return plan;
+    const auto taken = [&](std::uint32_t index) { return plan.settle && index == plan.settleFamily ? plan.settleIndex + 1 : 0u; };
+    const auto binds = [&](std::uint32_t index) { return index != family && families[index].queueCount > taken(index) && (families[index].queueFlags & VK_QUEUE_SPARSE_BINDING_BIT) != 0; };
+    for (std::uint32_t i = 0; i < count && plan.sparseFamily == VK_QUEUE_FAMILY_IGNORED; ++i) {
+        if (binds(i) && families[i].queueFlags == VK_QUEUE_SPARSE_BINDING_BIT) plan.sparseFamily = i;
+    }
+    for (std::uint32_t i = 0; i < count && plan.sparseFamily == VK_QUEUE_FAMILY_IGNORED; ++i) {
+        if (binds(i)) plan.sparseFamily = i;
+    }
+    if (plan.sparseFamily != VK_QUEUE_FAMILY_IGNORED) {
+        plan.sparseIndex = taken(plan.sparseFamily);
+        plan.sparseBinding = true;
+    } else {
+        plan.sparseBinding = family < count && (families[family].queueFlags & VK_QUEUE_SPARSE_BINDING_BIT) != 0;
+    }
+    return plan;
+}
+
 namespace {
 
 void check(VkResult result, const char* operation) {
@@ -129,6 +169,12 @@ void CreateComputePipeline(VkDevice device, PFN_vkCreateComputePipelines create,
     PerformanceCounters::CountPipeline();
 }
 
+#ifdef _WIN32
+const wchar_t* ComputePipelineDumpDirectory() { return _wgetenv(L"APS5_DUMP_COMPUTE_PIPELINES"); }
+#else
+const char* ComputePipelineDumpDirectory() { return std::getenv("APS5_DUMP_COMPUTE_PIPELINES"); }
+#endif
+
 bool CaptureComputePipeline(std::size_t words) {
     const char* minimum = std::getenv("APS5_DUMP_COMPUTE_MIN_WORDS");
     if (minimum == nullptr) return true;
@@ -302,9 +348,16 @@ struct VulkanDevice::State {
     VkDeviceSize uploadSize = 0;
     VkPhysicalDeviceProperties properties{};
     std::string driverInfo;
+    VkDriverId driverId = VK_DRIVER_ID_MAX_ENUM;
+    std::uint32_t pixelFunctionStorageDwords = 4096u;
     bool individuallyFreeDescriptorSets = false;
     PFN_vkGetCalibratedTimestampsKHR calibratedTimestamps = nullptr;
     PFN_vkCmdSetCheckpointNV checkpointMarker = nullptr;
+    PFN_vkCmdWriteBufferMarkerAMD bufferMarker = nullptr;
+    VkBuffer markerBuffer = VK_NULL_HANDLE;
+    VkDeviceMemory markerMemory = VK_NULL_HANDLE;
+    void* markerMapping = nullptr;
+    BufferMarkerLog markerLog;
     bool deviceLostHook = false;
     VkTimeDomainKHR hostTimeDomain = VK_TIME_DOMAIN_DEVICE_KHR;
     VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
@@ -315,7 +368,9 @@ struct VulkanDevice::State {
     bool meshShader = false;
     bool fragmentShaderBarycentric = false;
     bool shaderTerminateInvocation = false;
+    bool fusedExactArithmetic = false;
     bool geometryShader = false;
+    bool largePoints = false;
     bool sampleRateShading = false;
     bool storageImageMultisample = false;
     bool storageImageWriteWithoutFormat = false;
@@ -333,6 +388,7 @@ struct VulkanDevice::State {
     bool earlyFragmentSampleMaskTestBeforeSampleCounting = false;
     bool robustBufferAccess2 = false;
     bool subgroupControlBarriers = true;
+    bool workgroupScopeFences = true;
     // VK_EXT_descriptor_indexing with non-uniform image array indexing (bindless image tables in
     // graphics stages, and compute workgroups wider than a wave).
     bool descriptorIndexing = false;
@@ -345,6 +401,7 @@ struct VulkanDevice::State {
     bool imageInt64Atomics = false;
     bool bufferInt64Atomics = false;
     bool viewportIndexLayer = false;
+    bool imageFormatList = false;
     bool primitiveListRestart = false;
     bool depthClipControl = false;
     bool graphicsPipelineLibrary = false;
@@ -365,13 +422,17 @@ struct VulkanDevice::State {
     bool depthBounds = false;
     bool depthBiasClamp = false;
     bool dualSrcBlend = false;
+    bool logicOp = false;
     bool occlusionQueryPrecise = false;
     VkDeviceSize hostImportAlignment = 0;
     bool drawInputsInPlace = true;
     bool dmaBufImport = false;
     bool sparseBinding = false;
+    bool sparseResidencyBuffer = false;
+    bool sparseResidencyAliased = false;
     std::uint32_t queueFamily = 0;
     std::uint32_t sparseFamily = VK_QUEUE_FAMILY_IGNORED;
+    std::uint32_t sparseIndex = 0;
     VkQueue sparseQueue = VK_NULL_HANDLE;
     std::mutex sparseQueueMutex;
     VkQueue settleQueue = VK_NULL_HANDLE;
@@ -385,6 +446,8 @@ struct VulkanDevice::State {
     bool samplerFilterMinmax = false;
     bool nonSeamlessCubeMap = false;
     VkSampleCountFlags mergedCoverageSampleCounts = 0;
+    VkSampleCountFlags truncatedCoverageSampleCounts = 0;
+    bool mixedAttachmentSamples = false;
     bool fragmentShaderPixelInterlock = false;
     bool conservativeRasterization = false;
     bool provokingVertexLast = false;
@@ -417,7 +480,7 @@ struct VulkanDevice::State {
     // Compute pipeline objects by variant (and push-constant use), under their own mutex: the
     // dispatch's find-or-insert and the verify switch's lookups touch the map, recipes hold weak
     // references to its objects.
-    std::mutex computePipelinesMutex;
+    AgcDriver::Mutex computePipelinesMutex;
     std::map<ComputePipelineKey, std::shared_ptr<ComputePipelineObjects>> computePipelines;
     std::map<ComputePipelineKey, std::shared_future<std::shared_ptr<ComputePipelineObjects>>> computePipelinesBuilding;
     // The journal replay building this device's pipelines on its own threads; drained first at teardown.
@@ -498,7 +561,7 @@ struct VulkanDevice::State {
         std::uint64_t throughSerial;
     };
     std::deque<RetiredRange> retiredRanges;
-    std::mutex presentMutex;
+    AgcDriver::Mutex presentMutex;
     // The presentation present() submitted and QueuePresent has not handed to the swapchain.
     bool queuePending = false;
     std::uint32_t queueIndex = 0;
@@ -573,6 +636,33 @@ struct VulkanDevice::State {
         return workgroupMemory;
     }
 
+    void CreateMarkerBuffer() {
+        bufferMarker = DeviceFunction<PFN_vkCmdWriteBufferMarkerAMD>("vkCmdWriteBufferMarkerAMD");
+        VkBufferCreateInfo buffer{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO};
+        buffer.size = 2 * sizeof(std::uint32_t);
+        buffer.usage = VK_BUFFER_USAGE_TRANSFER_DST_BIT;
+        buffer.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
+        check(DeviceFunction<PFN_vkCreateBuffer>("vkCreateBuffer")(device, &buffer, nullptr, &markerBuffer), "vkCreateBuffer buffer markers");
+        VkMemoryRequirements requirements{};
+        DeviceFunction<PFN_vkGetBufferMemoryRequirements>("vkGetBufferMemoryRequirements")(device, markerBuffer, &requirements);
+        std::uint32_t memoryType = memoryProperties.memoryTypeCount;
+        const auto flags = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT;
+        for (std::uint32_t i = 0; i < memoryProperties.memoryTypeCount; ++i) {
+            if ((requirements.memoryTypeBits & (1u << i)) != 0 && (memoryProperties.memoryTypes[i].propertyFlags & flags) == flags) {
+                memoryType = i;
+                break;
+            }
+        }
+        require(memoryType < memoryProperties.memoryTypeCount, "coherent host memory for buffer markers is unavailable");
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = requirements.size;
+        allocation.memoryTypeIndex = memoryType;
+        check(DeviceFunction<PFN_vkAllocateMemory>("vkAllocateMemory")(device, &allocation, nullptr, &markerMemory), "vkAllocateMemory buffer markers");
+        check(DeviceFunction<PFN_vkBindBufferMemory>("vkBindBufferMemory")(device, markerBuffer, markerMemory, 0), "vkBindBufferMemory buffer markers");
+        check(DeviceFunction<PFN_vkMapMemory>("vkMapMemory")(device, markerMemory, 0, buffer.size, 0, &markerMapping), "vkMapMemory buffer markers");
+        std::memset(markerMapping, 0, buffer.size);
+    }
+
     void Upload(std::span<const std::byte> pixels) {
         if (uploadSize < pixels.size()) {
             if (uploadMapping) DeviceFunction<PFN_vkUnmapMemory>("vkUnmapMemory")(device, uploadMemory);
@@ -833,6 +923,9 @@ struct VulkanDevice::State {
             if (uploadMapping) reinterpret_cast<PFN_vkUnmapMemory>(deviceProc(device, "vkUnmapMemory"))(device, uploadMemory);
             if (uploadBuffer) reinterpret_cast<PFN_vkDestroyBuffer>(deviceProc(device, "vkDestroyBuffer"))(device, uploadBuffer, nullptr);
             if (uploadMemory) reinterpret_cast<PFN_vkFreeMemory>(deviceProc(device, "vkFreeMemory"))(device, uploadMemory, nullptr);
+            if (markerMapping) reinterpret_cast<PFN_vkUnmapMemory>(deviceProc(device, "vkUnmapMemory"))(device, markerMemory);
+            if (markerBuffer) reinterpret_cast<PFN_vkDestroyBuffer>(deviceProc(device, "vkDestroyBuffer"))(device, markerBuffer, nullptr);
+            if (markerMemory) reinterpret_cast<PFN_vkFreeMemory>(deviceProc(device, "vkFreeMemory"))(device, markerMemory, nullptr);
             if (swapchain) reinterpret_cast<PFN_vkDestroySwapchainKHR>(deviceProc(device, "vkDestroySwapchainKHR"))(device, swapchain, nullptr);
             const auto destroyPool = reinterpret_cast<PFN_vkDestroyCommandPool>(deviceProc(device, "vkDestroyCommandPool"));
             const auto destroyDevice = reinterpret_cast<PFN_vkDestroyDevice>(deviceProc(device, "vkDestroyDevice"));
@@ -1179,8 +1272,22 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &driverProperties);
         driverId = driver.driverID;
         state->driverInfo = std::string(driver.driverName) + " " + driver.driverInfo;
+        state->driverId = driver.driverID;
         state->individuallyFreeDescriptorSets = driver.driverID == VK_DRIVER_ID_MESA_LLVMPIPE;
+        state->fusedExactArithmetic = driver.driverID == VK_DRIVER_ID_MOLTENVK;
         state->subgroupControlBarriers = SubgroupControlBarrierUsable(driver.driverID);
+        state->workgroupScopeFences = WorkgroupScopeFenceUsable(driver.driverID);
+    }
+    if (driverId == VK_DRIVER_ID_NVIDIA_PROPRIETARY && hasExtension(VK_NV_SHADER_SM_BUILTINS_EXTENSION_NAME)) {
+        VkPhysicalDeviceShaderSMBuiltinsPropertiesNV smBuiltins{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SHADER_SM_BUILTINS_PROPERTIES_NV};
+        VkPhysicalDeviceProperties2 smProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &smBuiltins};
+        state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &smProperties);
+        const auto subgroup = state->subgroup.subgroupSize;
+        if (smBuiltins.shaderSMCount != 0u && smBuiltins.shaderWarpsPerSM != 0u && subgroup != 0u) {
+            const auto invocations = static_cast<std::uint64_t>(smBuiltins.shaderSMCount) * smBuiltins.shaderWarpsPerSM * subgroup;
+            const auto budgetDwords = (4ull << 30) / (invocations * 4ull);
+            if (budgetDwords < state->pixelFunctionStorageDwords) state->pixelFunctionStorageDwords = static_cast<std::uint32_t>(budgetDwords);
+        }
     }
     auto byteFeatures = QueryBdaByteFeatures(selected, state->InstanceFunction<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2"), availableExtensions);
     auto bdaFeatures = QueryBdaFeatures(selected, state->InstanceFunction<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2"), availableExtensions);
@@ -1316,6 +1423,10 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         state->spirvExtensions.push_back("SPV_EXT_shader_viewport_index_layer");
         state->viewportIndexLayer = true;
     }
+    if (hasExtension(VK_KHR_IMAGE_FORMAT_LIST_EXTENSION_NAME)) {
+        deviceExtensions.push_back(VK_KHR_IMAGE_FORMAT_LIST_EXTENSION_NAME);
+        state->imageFormatList = true;
+    }
     if (state->demoteToHelperInvocation) {
         deviceExtensions.push_back(VK_EXT_SHADER_DEMOTE_TO_HELPER_INVOCATION_EXTENSION_NAME);
         state->capabilities.push_back(spv::CapabilityDemoteToHelperInvocation);
@@ -1412,7 +1523,8 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     // Guest memory is host memory: importing it lets address-based shaders use it in place instead of
     // copying every registered allocation per draw.
     if (hasExtension(VK_EXT_EXTERNAL_MEMORY_HOST_EXTENSION_NAME) && std::getenv("APS5_NO_HOST_IMPORT") == nullptr) {
-        VkPhysicalDeviceDriverProperties driverProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DRIVER_PROPERTIES};
+        VkPhysicalDeviceMaintenance3Properties maintenance3{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MAINTENANCE_3_PROPERTIES};
+        VkPhysicalDeviceDriverProperties driverProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DRIVER_PROPERTIES, &maintenance3};
         VkPhysicalDeviceExternalMemoryHostPropertiesEXT hostProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_EXTERNAL_MEMORY_HOST_PROPERTIES_EXT, &driverProperties};
         VkPhysicalDeviceProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &hostProperties};
         state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &properties);
@@ -1424,6 +1536,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
 #endif
         state->drawInputsInPlace = std::getenv("APS5_NO_DRAW_INPUTS_IN_PLACE") == nullptr && (std::getenv("APS5_DRAW_INPUTS_IN_PLACE") != nullptr || DrawInputsInPlaceUsable(driverProperties.driverID, windows));
         if (!compileOnly) Graphics::SetHostImportWindow(8ull << 20u);
+        if (!compileOnly) Graphics::SetHostImportMaxBytes(maintenance3.maxMemoryAllocationSize);
 #ifdef _WIN32
         // Imported pages are locked; locking is bounded by the process working-set minimum.
         if (const char* value = std::getenv("APS5_WORKING_SET_MIB"); value != nullptr && !compileOnly) {
@@ -1510,12 +1623,17 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
             check(combinations(selected, &count, supported.data()), "vkGetPhysicalDeviceSupportedFramebufferMixedSamplesCombinationsNV");
             for (const auto& combination : supported) {
                 if (combination.coverageReductionMode == VK_COVERAGE_REDUCTION_MODE_MERGE_NV && combination.colorSamples == VK_SAMPLE_COUNT_1_BIT && combination.depthStencilSamples == 0) state->mergedCoverageSampleCounts |= combination.rasterizationSamples;
+                if (combination.coverageReductionMode == VK_COVERAGE_REDUCTION_MODE_TRUNCATE_NV && combination.colorSamples == VK_SAMPLE_COUNT_1_BIT && combination.depthStencilSamples == combination.rasterizationSamples) state->truncatedCoverageSampleCounts |= combination.rasterizationSamples;
             }
         }
-        if (state->mergedCoverageSampleCounts != 0) {
+        if (state->mergedCoverageSampleCounts != 0 || state->truncatedCoverageSampleCounts != 0) {
             deviceExtensions.push_back(VK_NV_FRAMEBUFFER_MIXED_SAMPLES_EXTENSION_NAME);
             deviceExtensions.push_back(VK_NV_COVERAGE_REDUCTION_MODE_EXTENSION_NAME);
         }
+    } else if (hasExtension(VK_AMD_MIXED_ATTACHMENT_SAMPLES_EXTENSION_NAME)) {
+        state->mixedAttachmentSamples = true;
+        state->truncatedCoverageSampleCounts = state->properties.limits.framebufferDepthSampleCounts & state->properties.limits.framebufferColorSampleCounts & ~static_cast<VkSampleCountFlags>(VK_SAMPLE_COUNT_1_BIT);
+        deviceExtensions.push_back(VK_AMD_MIXED_ATTACHMENT_SAMPLES_EXTENSION_NAME);
     }
     coverageReductionFeatures = {VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_COVERAGE_REDUCTION_MODE_FEATURES_NV};
     coverageReductionFeatures.coverageReductionMode = VK_TRUE;
@@ -1565,35 +1683,18 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     queueInfo.queueCount = 1;
     queueInfo.pQueuePriorities = &priority;
     const float priorities[2]{1.0f, 1.0f};
-    bool settleQueue = false;
-    std::uint32_t settleFamily = family;
-    std::uint32_t settleIndex = 0;
-    std::vector<VkQueueFamilyProperties> queues;
 #ifdef _WIN32
     const bool settles = true;
 #else
     const bool settles = state->dmaBufImport;
 #endif
-    if (settles) {
+    std::vector<VkQueueFamilyProperties> queues;
+    {
         std::uint32_t families = 0;
         auto getFamilies = state->InstanceFunction<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
         getFamilies(selected, &families, nullptr);
         queues.resize(families);
         getFamilies(selected, &families, queues.data());
-        if (family < families && queues[family].queueCount >= 2) {
-            queueInfo.queueCount = 2;
-            queueInfo.pQueuePriorities = priorities;
-            settleQueue = true;
-            settleIndex = 1;
-        } else {
-            const auto copies = [&](std::uint32_t index) { return index != family && queues[index].queueCount != 0 && (queues[index].queueFlags & (VK_QUEUE_TRANSFER_BIT | VK_QUEUE_COMPUTE_BIT | VK_QUEUE_GRAPHICS_BIT)) != 0; };
-            for (std::uint32_t i = 0; i < families && !settleQueue; ++i) {
-                if (copies(i) && (queues[i].queueFlags & (VK_QUEUE_COMPUTE_BIT | VK_QUEUE_GRAPHICS_BIT)) == 0) settleFamily = i, settleQueue = true;
-            }
-            for (std::uint32_t i = 0; i < families && !settleQueue; ++i) {
-                if (copies(i)) settleFamily = i, settleQueue = true;
-            }
-        }
     }
     VkDeviceCreateInfo deviceInfo{VK_STRUCTURE_TYPE_DEVICE_CREATE_INFO};
     deviceInfo.queueCreateInfoCount = 1;
@@ -1628,50 +1729,38 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     // Guest shaders routinely read past descriptor ranges; robust access turns that into zeros
     // instead of a GPU fault that loses the device.
     enabled.robustBufferAccess = available.robustBufferAccess;
+    const auto plan = PlanDeviceQueues(queues, family, settles, available.sparseBinding == VK_TRUE);
+    const bool settleQueue = plan.settle;
+    const auto settleFamily = plan.settleFamily;
+    const auto settleIndex = plan.settleIndex;
     VkDeviceQueueCreateInfo queueInfos[3]{queueInfo, {VK_STRUCTURE_TYPE_DEVICE_QUEUE_CREATE_INFO}, {VK_STRUCTURE_TYPE_DEVICE_QUEUE_CREATE_INFO}};
-    if (available.sparseBinding && state->dmaBufImport) {
-        std::uint32_t families = 0;
-        auto getFamilies = state->InstanceFunction<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
-        getFamilies(selected, &families, nullptr);
-        std::vector<VkQueueFamilyProperties> queues(families);
-        getFamilies(selected, &families, queues.data());
-        const auto binds = [&](std::uint32_t index) { return index != family && queues[index].queueCount != 0 && (queues[index].queueFlags & VK_QUEUE_SPARSE_BINDING_BIT) != 0; };
-        std::uint32_t sparseFamily = families;
-        for (std::uint32_t i = 0; i < families && sparseFamily == families; ++i) {
-            if (binds(i) && queues[i].queueFlags == VK_QUEUE_SPARSE_BINDING_BIT) sparseFamily = i;
+    queueInfos[0].queueCount = plan.mainCount;
+    queueInfos[0].pQueuePriorities = plan.mainCount == 2 ? priorities : &priority;
+    deviceInfo.queueCreateInfoCount = 1;
+    const auto addQueue = [&](std::uint32_t queueFamily, std::uint32_t index) {
+        for (std::uint32_t info = 1; info < deviceInfo.queueCreateInfoCount; ++info) {
+            if (queueInfos[info].queueFamilyIndex != queueFamily) continue;
+            queueInfos[info].queueCount = std::max(queueInfos[info].queueCount, index + 1);
+            queueInfos[info].pQueuePriorities = queueInfos[info].queueCount == 2 ? priorities : &priority;
+            return;
         }
-        for (std::uint32_t i = 0; i < families && sparseFamily == families; ++i) {
-            if (binds(i)) sparseFamily = i;
-        }
-        if (sparseFamily != families) {
-            queueInfos[1].queueFamilyIndex = sparseFamily;
-            queueInfos[1].queueCount = 1;
-            queueInfos[1].pQueuePriorities = &priority;
-            deviceInfo.queueCreateInfoCount = 2;
-            state->sparseFamily = sparseFamily;
-            state->sparseBinding = true;
-        } else {
-            state->sparseBinding = family < families && (queues[family].queueFlags & VK_QUEUE_SPARSE_BINDING_BIT) != 0;
-        }
-        enabled.sparseBinding = state->sparseBinding ? VK_TRUE : VK_FALSE;
-    }
+        auto& added = queueInfos[deviceInfo.queueCreateInfoCount++];
+        added = {VK_STRUCTURE_TYPE_DEVICE_QUEUE_CREATE_INFO};
+        added.queueFamilyIndex = queueFamily;
+        added.queueCount = index + 1;
+        added.pQueuePriorities = added.queueCount == 2 ? priorities : &priority;
+    };
+    if (plan.settle && plan.settleFamily != family) addQueue(plan.settleFamily, plan.settleIndex);
+    if (plan.sparseFamily != VK_QUEUE_FAMILY_IGNORED) addQueue(plan.sparseFamily, plan.sparseIndex);
     deviceInfo.pQueueCreateInfos = queueInfos;
-    if (settleQueue && settleFamily != family) {
-        if (deviceInfo.queueCreateInfoCount == 2 && queueInfos[1].queueFamilyIndex == settleFamily) {
-            settleQueue = queues[settleFamily].queueCount >= 2;
-            if (settleQueue) {
-                queueInfos[1].queueCount = 2;
-                queueInfos[1].pQueuePriorities = priorities;
-                settleIndex = 1;
-            }
-        } else {
-            auto& settleInfo = queueInfos[deviceInfo.queueCreateInfoCount++];
-            settleInfo = {VK_STRUCTURE_TYPE_DEVICE_QUEUE_CREATE_INFO};
-            settleInfo.queueFamilyIndex = settleFamily;
-            settleInfo.queueCount = 1;
-            settleInfo.pQueuePriorities = &priority;
-        }
-    }
+    state->sparseFamily = plan.sparseFamily;
+    state->sparseIndex = plan.sparseIndex;
+    state->sparseBinding = plan.sparseBinding;
+    enabled.sparseBinding = state->sparseBinding ? VK_TRUE : VK_FALSE;
+    enabled.sparseResidencyBuffer = state->sparseBinding ? available.sparseResidencyBuffer : VK_FALSE;
+    enabled.sparseResidencyAliased = state->sparseBinding ? available.sparseResidencyAliased : VK_FALSE;
+    state->sparseResidencyBuffer = enabled.sparseResidencyBuffer == VK_TRUE;
+    state->sparseResidencyAliased = enabled.sparseResidencyAliased == VK_TRUE;
     // Indirect draw records with a non-zero first instance, and several records per call.
     enabled.drawIndirectFirstInstance = available.drawIndirectFirstInstance;
     enabled.multiDrawIndirect = available.multiDrawIndirect;
@@ -1687,6 +1776,8 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     enabled.depthBiasClamp = available.depthBiasClamp;
     state->depthBiasClamp = enabled.depthBiasClamp == VK_TRUE;
     enabled.dualSrcBlend = available.dualSrcBlend;
+    enabled.logicOp = available.logicOp;
+    state->logicOp = enabled.logicOp == VK_TRUE;
     state->dualSrcBlend = enabled.dualSrcBlend == VK_TRUE;
     enabled.occlusionQueryPrecise = available.occlusionQueryPrecise;
     state->occlusionQueryPrecise = enabled.occlusionQueryPrecise == VK_TRUE;
@@ -1706,6 +1797,8 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     enabled.sampleRateShading = available.sampleRateShading;
     enabled.geometryShader = available.geometryShader;
     state->geometryShader = enabled.geometryShader == VK_TRUE;
+    enabled.largePoints = available.largePoints;
+    state->largePoints = enabled.largePoints == VK_TRUE;
     state->sampleRateShading = enabled.sampleRateShading == VK_TRUE;
     if (enabled.sampleRateShading) state->capabilities.push_back(spv::CapabilityInterpolationFunction);
     if (enabled.geometryShader) state->capabilities.push_back(spv::CapabilityGeometry);
@@ -1806,7 +1899,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         nonSeamlessCubeFeatures.pNext = const_cast<void*>(deviceInfo.pNext);
         deviceInfo.pNext = &nonSeamlessCubeFeatures;
     }
-    if (state->mergedCoverageSampleCounts != 0) {
+    if (!state->mixedAttachmentSamples && (state->mergedCoverageSampleCounts != 0 || state->truncatedCoverageSampleCounts != 0)) {
         coverageReductionFeatures.pNext = const_cast<void*>(deviceInfo.pNext);
         deviceInfo.pNext = &coverageReductionFeatures;
     }
@@ -1935,12 +2028,37 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         faultFeatures.pNext = byteFeatures.pNext;
         byteFeatures.pNext = &faultFeatures;
     }
-    const bool checkpoints = std::getenv("APS5_GPU_CHECKPOINTS") != nullptr && hasExtension(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME);
-    if (checkpoints) {
-        deviceExtensions.push_back(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME);
+    const bool checkpointsRequested = std::getenv("APS5_GPU_CHECKPOINTS") != nullptr;
+    const bool checkpoints = checkpointsRequested && hasExtension(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME);
+    const bool bufferMarkers = checkpointsRequested && !checkpoints && hasExtension(VK_AMD_BUFFER_MARKER_EXTENSION_NAME);
+    if (checkpoints || bufferMarkers) {
+        deviceExtensions.push_back(checkpoints ? VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME : VK_AMD_BUFFER_MARKER_EXTENSION_NAME);
         deviceInfo.enabledExtensionCount = static_cast<std::uint32_t>(deviceExtensions.size());
         deviceInfo.ppEnabledExtensionNames = deviceExtensions.data();
     }
+    const bool diagnosticsRequested = std::getenv("APS5_NV_DIAGNOSTICS") != nullptr;
+    VkPhysicalDeviceDiagnosticsConfigFeaturesNV diagnosticsFeatures{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DIAGNOSTICS_CONFIG_FEATURES_NV};
+    if (diagnosticsRequested && hasExtension(VK_NV_DEVICE_DIAGNOSTICS_CONFIG_EXTENSION_NAME)) {
+        VkPhysicalDeviceFeatures2 features{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_FEATURES_2, &diagnosticsFeatures};
+        state->InstanceFunction<PFN_vkGetPhysicalDeviceFeatures2>("vkGetPhysicalDeviceFeatures2")(selected, &features);
+    }
+    const auto diagnostics = ChooseDeviceDiagnostics(diagnosticsRequested, diagnosticsFeatures.diagnosticsConfig == VK_TRUE, hasExtension(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME));
+    VkDeviceDiagnosticsConfigCreateInfoNV diagnosticsConfig{VK_STRUCTURE_TYPE_DEVICE_DIAGNOSTICS_CONFIG_CREATE_INFO_NV};
+    if (diagnostics.config) {
+        diagnosticsFeatures = {VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_DIAGNOSTICS_CONFIG_FEATURES_NV};
+        diagnosticsFeatures.diagnosticsConfig = VK_TRUE;
+        diagnosticsConfig.flags = diagnostics.flags;
+        deviceExtensions.push_back(VK_NV_DEVICE_DIAGNOSTICS_CONFIG_EXTENSION_NAME);
+        if (diagnostics.checkpoints && !checkpoints) deviceExtensions.push_back(VK_NV_DEVICE_DIAGNOSTIC_CHECKPOINTS_EXTENSION_NAME);
+        deviceInfo.enabledExtensionCount = static_cast<std::uint32_t>(deviceExtensions.size());
+        deviceInfo.ppEnabledExtensionNames = deviceExtensions.data();
+        diagnosticsConfig.pNext = byteFeatures.pNext;
+        diagnosticsFeatures.pNext = &diagnosticsConfig;
+        byteFeatures.pNext = &diagnosticsFeatures;
+        std::fprintf(stderr, "[gpu] APS5_NV_DIAGNOSTICS: VK_NV_device_diagnostics_config enabled (shader debug info, resource tracking, automatic checkpoints, shader error reporting)\n");
+    } else if (diagnosticsRequested) {
+        std::fprintf(stderr, "[gpu] APS5_NV_DIAGNOSTICS: the device does not support VK_NV_device_diagnostics_config\n");
+    }
     bdaFeatures.pNext = &byteFeatures;
     VkPhysicalDeviceRobustness2FeaturesEXT robustness2{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_ROBUSTNESS_2_FEATURES_EXT};
     if (hasExtension(VK_EXT_ROBUSTNESS_2_EXTENSION_NAME)) {
@@ -1989,12 +2107,18 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         state->settleFamily = settleFamily;
         state->DeviceFunction<PFN_vkGetDeviceQueue>("vkGetDeviceQueue")(state->device, settleFamily, settleIndex, &state->settleQueue);
     }
-    if (state->sparseFamily != VK_QUEUE_FAMILY_IGNORED) state->DeviceFunction<PFN_vkGetDeviceQueue>("vkGetDeviceQueue")(state->device, state->sparseFamily, 0, &state->sparseQueue);
+    if (state->sparseFamily != VK_QUEUE_FAMILY_IGNORED) state->DeviceFunction<PFN_vkGetDeviceQueue>("vkGetDeviceQueue")(state->device, state->sparseFamily, state->sparseIndex, &state->sparseQueue);
     if (checkpoints) state->checkpointMarker = state->DeviceFunction<PFN_vkCmdSetCheckpointNV>("vkCmdSetCheckpointNV");
-    if (deviceFault || checkpoints) {
+    if (bufferMarkers) state->CreateMarkerBuffer();
+    if (deviceFault || checkpoints || bufferMarkers) {
         const auto faultInfo = deviceFault ? state->DeviceFunction<PFN_vkGetDeviceFaultInfoEXT>("vkGetDeviceFaultInfoEXT") : nullptr;
         const auto checkpointData = checkpoints ? state->DeviceFunction<PFN_vkGetQueueCheckpointDataNV>("vkGetQueueCheckpointDataNV") : nullptr;
-        Graphics::DeviceLostHook() = [device = state->device, queue = state->queue, faultInfo, checkpointData] {
+        Graphics::DeviceLostHook() = [device = state->device, queue = state->queue, faultInfo, checkpointData, owner = state.get()] {
+            if (owner->markerMapping != nullptr) {
+                std::uint32_t words[2];
+                std::memcpy(words, owner->markerMapping, sizeof(words));
+                for (const auto& line : owner->markerLog.Report(words[0], words[1])) std::fprintf(stderr, "%s\n", line.c_str());
+            }
             for (const auto& line : DeviceFaultReport(device, faultInfo, queue, checkpointData)) std::fprintf(stderr, "%s\n", line.c_str());
         };
         Graphics::DeviceLostOwner() = state.get();
@@ -2209,6 +2333,7 @@ void VulkanDevice::WaitIdle() {
         state->recorder->Sync();
     }
     check(state->DeviceFunction<PFN_vkDeviceWaitIdle>("vkDeviceWaitIdle")(state->device), "vkDeviceWaitIdle");
+    Graphics::CheckPixelFunctionLds(graphicsContext());
     APS5_LOG_CHARS_OUT_DEBUG("VulkanDevice::WaitIdle complete");
 }
 
@@ -2255,6 +2380,14 @@ void VulkanDevice::WaitRecorded(std::uint64_t serial) {
     if (state->recorder) state->recorder->WaitSerial(serial);
 }
 
+std::uint64_t VulkanDevice::SubmittedEpoch() const {
+    return state->recorder ? state->recorder->NewestSubmitted() : 0;
+}
+
+bool VulkanDevice::WaitRecordedFor(std::uint64_t serial, std::uint64_t timeoutNanos) {
+    return state->recorder && state->recorder->WaitSerialFor(serial, timeoutNanos);
+}
+
 void VulkanDevice::ReapRecorded(std::uint64_t serial) {
     if (!state->recorder) return;
     // The drain's site in the [recorder] table is this call's caller (Driver::execute's drain,
@@ -2296,6 +2429,7 @@ bool VulkanDevice::StoresPendingOver(std::uint64_t address, std::size_t bytes) c
 int VulkanDevice::WriteLabelOnGpu(std::uint64_t address, std::span<const std::byte> bytes, std::uint64_t stamp, std::uint32_t queue, bool reapFirst) {
     static const bool storeAtLabel = Graphics::StorageTexture::StoreAtLabelRequested(std::getenv("APS5_STORE_AT_LABEL"));
     if (storeAtLabel) Graphics::StorageTexture::FlushAllPending("label");
+    Graphics::StorageTexture::StoreReadbackBeforeLabel("readback before label");
     if (!state->recorder || bytes.empty() || bytes.size() > 65536 || address % 4 != 0 || bytes.size() % 4 != 0) return 4;
     auto& recorder = *state->recorder;
     // Batches that already finished are retired before the checks: their completions ran, so they
@@ -2321,10 +2455,37 @@ int VulkanDevice::WriteLabelOnGpu(std::uint64_t address, std::span<const std::by
     // stores of a run against each other and against the work before and after, the queued DCC
     // key stores included).
     const auto recordStore = [&] { recorder.RecordStore(import->buffer, Graphics::HostImportOffset(*import, address), bytes, address); };
-    // Only a write-back that can land over these bytes (a listed copied writer of the range, as
-    // FillBuffer tests) puts the label behind the completions; any other pending completion
-    // stores elsewhere. Debug aid: APS5_LABEL_GATE_ALL=1 gates on any completion, as before (a
-    // completion label there registered its own completion, so every later label followed).
+    // On the console every store a queue made before a label is in memory once the label is
+    // visible. A listed copied writer (a dispatch or draw whose written buffer the device holds as a
+    // CPU copy) is written back by the CPU when its batch is reaped, after the GPU already ran any
+    // store recorded here, so a title polling the label could rewrite the written region and have
+    // the late write-back land over its bytes (a title that rebuilds its command buffer there sees
+    // a stale packet). While one is listed, a label of 8 bytes or less (every RELEASE_MEM, the fence
+    // WRITE_DATAs) is therefore not recorded on the GPU at all: a completion action of the open (or
+    // newest in-flight) batch stores it when that batch is reaped. Completions run in push order and
+    // batches finish front-first, so it lands after every earlier write-back, whatever range that
+    // one wrote. The GPU store plus completion re-store below would not do: its GPU store is
+    // visible before the write-back, and its re-store runs only over a write-back that overlapped
+    // the label. While such a completion store is pending (PendingCompletionStores: no end-of-pipe
+    // delivery and no write-back counts there), later small labels follow it even after every
+    // writer was written back, or a GPU store would become visible before the earlier completion
+    // store lands (#1458), or land under it at the reap when both are at one address. Larger stores
+    // (DUMP_CONST_RAM, COPY_DATA and DMA_DATA payloads that later GPU work reads through the import)
+    // stay on the GPU and follow only a pending completion store over their own range. Readers of a
+    // range stored this way sync through its batch first (the label is a pending write of its batch
+    // and counted in PendingCompletionLabels). Debug aid: APS5_DRAIN_COMPLETION_LABELS=1 drains
+    // (reason 2) instead and stores the label on the CPU.
+    const bool listed = !state->copiedWriters->empty() || !Graphics::DrawCopiedWriters()->empty();
+    if (drain) {
+        if (listed) return 2;
+    } else if (const bool storesPending = Graphics::Recorder::PendingCompletionStores() != 0; bytes.size() <= 8 ? (listed || storesPending) : (storesPending && recorder.CompletionLabelIn(address, bytes.size()))) {
+        recorder.AfterCompletions(address, bytes, stamp, queue, false);
+        return 5;
+    }
+    // A larger store over a listed copied writer's range (as FillBuffer tests it) goes behind the
+    // completions too, below; any other one stores on the GPU. Debug aid: APS5_LABEL_GATE_ALL=1
+    // gates on any completion, as before (a completion label there registered its own completion,
+    // so every later label followed).
     static const bool gateAll = std::getenv("APS5_LABEL_GATE_ALL") != nullptr;
     if (gateAll ? recorder.HasCompletions() : state->CopiedWriterOverlaps(address, bytes.size())) {
         // A copied buffer's write-back is still to run: the store must land after it. It is stored
@@ -3576,6 +3737,7 @@ double VulkanDevice::RetirePresents(std::size_t keepInFlight) {
     const auto status = state->DeviceFunction<PFN_vkGetFenceStatus>("vkGetFenceStatus");
     auto inFlight = static_cast<std::size_t>(std::count_if(slots.begin(), slots.end(), [](const auto& slot) { return slot.inFlight; }));
     double waitedMs = 0;
+    bool retired = false;
     // Oldest first from the cursor; the fences of one queue signal in submission order, so the
     // first unsignaled one ends the scan, and the ones beyond the bound are the oldest.
     for (std::size_t i = 0; i < slots.size() && inFlight != 0; ++i) {
@@ -3594,9 +3756,11 @@ double VulkanDevice::RetirePresents(std::size_t keepInFlight) {
         }
         const bool dump = slot.dumpRecorded;
         state->RetireSlot(slot);
+        retired = true;
         if (dump) timing.Mark("dump");
         --inFlight;
     }
+    if (retired) Graphics::CheckPixelFunctionLds(graphicsContext());
     return waitedMs;
 }
 
@@ -3679,6 +3843,7 @@ ShaderRecompiler::SpirvTarget VulkanDevice::Target() const {
     require(state->shaderProfile != nullptr, "shader device profile is unavailable");
     auto target = state->shaderProfile->Target();
     target.float32FlushToZero = state->float32FlushToZero;
+    target.fusedExactArithmetic = state->fusedExactArithmetic;
     target.float32DenormPreserve = state->float32DenormPreserve;
     return target;
 }
@@ -3702,6 +3867,9 @@ ShaderRecompiler::SpirvTarget VulkanDevice::buildTarget() const {
     target.registrationModules = state->graphicsPipelineLibrary;
     target.robustBufferAccess2 = state->robustBufferAccess2;
     target.waveLdsMemoryBarriers = !state->subgroupControlBarriers;
+    target.largePixelFunctionLdsBuffer = state->driverId == VK_DRIVER_ID_NVIDIA_PROPRIETARY;
+    target.pixelFunctionStorageDwords = state->pixelFunctionStorageDwords;
+    target.deviceScopeLdsMemoryBarriers = !state->workgroupScopeFences;
     target.srgbDecodeFormats = state->srgbDecodeFormats & ~state->srgbCopyFormats;
     target.vertexSubgroups = (state->subgroup.supportedStages & VK_SHADER_STAGE_VERTEX_BIT) != 0;
     if (state->meshShader) {
@@ -3789,6 +3957,8 @@ Graphics::Context VulkanDevice::buildContext() const {
     context.individuallyFreeDescriptorSets = state->individuallyFreeDescriptorSets;
     context.dmaBufImport = state->dmaBufImport;
     context.sparseBinding = state->sparseBinding;
+    context.sparseResidencyBuffer = state->sparseResidencyBuffer;
+    context.sparseResidencyAliased = state->sparseResidencyAliased;
     context.queueFamily = state->queueFamily;
     context.sparseFamily = state->sparseFamily;
     context.sparseQueue = state->sparseQueue;
@@ -3804,17 +3974,21 @@ Graphics::Context VulkanDevice::buildContext() const {
     context.drawIndirectFirstInstance = state->drawIndirectFirstInstance;
     context.multiDrawIndirect = state->multiDrawIndirect;
     context.dualSrcBlend = state->dualSrcBlend;
+    context.logicOp = state->logicOp;
     context.depthBounds = state->depthBounds;
     context.depthBiasClamp = state->depthBiasClamp;
     context.samplerFilterMinmax = state->samplerFilterMinmax;
     context.nonSeamlessCubeMap = state->nonSeamlessCubeMap;
     context.mergedCoverageSampleCounts = state->mergedCoverageSampleCounts;
+    context.truncatedCoverageSampleCounts = state->truncatedCoverageSampleCounts;
+    context.mixedAttachmentSamples = state->mixedAttachmentSamples;
     context.conservativeRasterization = state->conservativeRasterization;
     context.meshWave32 = state->meshWave32;
     context.provokingVertexLast = state->provokingVertexLast;
     context.graphicsPipelineLibrary = state->graphicsPipelineLibrary;
     context.pipelineLinkTimeOptimization = state->pipelineLinkTimeOptimization;
     context.drawInputsInPlace = state->drawInputsInPlace;
+    context.discreteGpu = state->properties.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU;
     context.provokingVertexModePerPipeline = state->provokingVertexModePerPipeline;
     context.drawIndirectCount = state->drawIndirectCount;
     context.occlusionQueryPrecise = state->occlusionQueryPrecise;
@@ -3833,6 +4007,7 @@ Graphics::Context VulkanDevice::buildContext() const {
     context.imageTableUpdateAfterBind = ImageTableUpdateAfterBind(context);
     context.samplerTableUpdateAfterBind = SamplerTableUpdateAfterBind(context);
     context.geometryShader = state->geometryShader;
+    context.largePoints = state->largePoints;
     context.sampleRateShading = state->sampleRateShading;
     context.fillModeNonSolid = state->fillModeNonSolid;
     context.maintenance5 = state->maintenance5;
@@ -3845,6 +4020,7 @@ Graphics::Context VulkanDevice::buildContext() const {
     context.bufferInt64Atomics = state->bufferInt64Atomics;
     context.placeholderImages = state->placeholderImages.get();
     context.viewportIndexLayer = state->viewportIndexLayer;
+    context.imageFormatList = state->imageFormatList;
     context.demoteToHelperInvocation = state->demoteToHelperInvocation;
     context.earlyFragmentSampleMaskTestBeforeSampleCounting = state->earlyFragmentSampleMaskTestBeforeSampleCounting;
     context.primitiveListRestart = state->primitiveListRestart;
@@ -3870,10 +4046,6 @@ std::optional<std::string> VulkanDevice::KnownDrawRejection(const Graphics::Stat
     return Graphics::KnownValidationFailure(graphicsContext(), shaders, graphics);
 }
 
-void VulkanDevice::DepthCopyPass(const Graphics::DepthCopyPass& pass) {
-    Graphics::RunDepthCopyPass(graphicsContext(), pass);
-}
-
 void VulkanDevice::ColorMetadataPass(const Graphics::ColorMetadataPass& pass) {
     Graphics::RunColorMetadataPass(graphicsContext(), pass);
 }
@@ -3916,7 +4088,7 @@ bool VulkanDevice::PrebuildGraphicsLibraries(const Graphics::ShaderStages& stage
     return Graphics::Pipeline::Prebuild(context, state, Graphics::VertexInputLayout{}, layouts.View(), group);
 }
 
-void VulkanDevice::Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipe) {
+void VulkanDevice::Draw(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipe, const DrawTraceContext* trace) {
     startJournalReplay();
     for (const auto& shader : shaders) {
         require(shader.program != nullptr, "missing compiled shader");
@@ -3924,11 +4096,11 @@ void VulkanDevice::Draw(const Graphics::State& graphics, const Pm4::DrawParamete
     }
     // Two stdout lines per draw cost ~1.3 ms per frame of the queue-0 worker (part of it under the
     // GPU mutex); APS5_TRACE_DRAWS=1 restores them.
-    static const bool trace = std::getenv("APS5_TRACE_DRAWS") != nullptr;
-    if (trace) APS5_LOG_OUT("VulkanDevice::Draw indices=%u instances=%u indexSize=%u address=0x%llx shaders=%zu colorTarget=%u", draw.indexCount, draw.instanceCount, draw.indexSize, static_cast<unsigned long long>(draw.indexAddress), shaders.size(), static_cast<unsigned>(graphics.hasColorTarget));
+    static const bool traceDraws = std::getenv("APS5_TRACE_DRAWS") != nullptr;
+    if (traceDraws) APS5_LOG_OUT("VulkanDevice::Draw indices=%u instances=%u indexSize=%u address=0x%llx shaders=%zu colorTarget=%u", draw.indexCount, draw.instanceCount, draw.indexSize, static_cast<unsigned long long>(draw.indexAddress), shaders.size(), static_cast<unsigned>(graphics.hasColorTarget));
     const auto context = graphicsContext();
-    Graphics::Draw(context, graphics, draw, shaders, snapshots, recipe);
-    if (trace) APS5_LOG_CHARS_OUT("VulkanDevice::Draw complete");
+    Graphics::Draw(context, graphics, draw, shaders, snapshots, recipe, trace);
+    if (traceDraws) APS5_LOG_CHARS_OUT("VulkanDevice::Draw complete");
 }
 
 bool VulkanDevice::DrawInputsInPlace() const {
@@ -4093,7 +4265,7 @@ void WatchMemory(std::uint64_t programAddress) {
         return parsed;
     }();
     if (ranges.empty()) return;
-    static std::mutex mutex;
+    static AgcDriver::Mutex mutex;
     static std::deque<std::pair<std::uint64_t, std::vector<std::uint8_t>>> history;
     static bool written = false;
     std::lock_guard lock(mutex);
@@ -4406,6 +4578,7 @@ struct RecordedDispatch {
     // A template hit's revalidate time, charged to the [rescache] refresh accounting.
     double revalidateMs;
     DispatchTimer* timer;
+    std::optional<std::pair<std::uint64_t, std::size_t>> htileClear;
     // Whether the data refresh recorded anything.
     bool refreshed = false;
     bool resourceKeyMatched = false;
@@ -4416,6 +4589,24 @@ struct RecordedDispatch {
     std::array<std::uint32_t, 3> threadLimit{};
 };
 
+struct DispatchCompletion {
+    const Graphics::Context& context;
+    const std::array<Graphics::CompiledShader, 1>& shaders;
+    VkShaderStageFlags pushStages;
+    const std::array<std::byte, Graphics::PipelinePushConstantBytes>& pushBytes;
+    const std::shared_ptr<ComputePipelineObjects>& objects;
+    const std::shared_ptr<Graphics::ShaderResources>& resources;
+    const ResourceCache::Key& contentKey;
+    bool cacheable;
+    bool fromCache;
+    double revalidateMs;
+    const std::shared_ptr<Graphics::ShaderResources::DrawBindings>& overlay;
+    std::uint64_t lookupsBefore;
+    DispatchTimer& timer;
+    PerformanceTimer& timing;
+    char* groupsText;
+};
+
 VkDevice VulkanDevice::Device() const {
     return state->device;
 }
@@ -4458,7 +4649,7 @@ void VulkanDevice::NoteDrawRecipeMiss(DrawRecipePrecheck miss) {
     counters.precheckMisses[miss == DrawRecipePrecheck::NoRecipe ? MissNoRecipe : MissDevice].fetch_add(1, std::memory_order_relaxed);
 }
 
-RecipeOutcome VulkanDevice::DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe) {
+RecipeOutcome VulkanDevice::DrawFromRecipe(const Graphics::State& graphics, const Pm4::DrawParameters& draw, std::span<const Graphics::CompiledShader> shaders, std::span<const Graphics::GuestMemorySnapshot> snapshots, const std::shared_ptr<const DrawRecipe>& recipe, const DrawTraceContext* trace) {
     PerformanceTimer timing("Vulkan.DrawFromRecipe");
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     auto& counters = Recipes().kinds[static_cast<std::size_t>(RecipeKind::Draw)];
@@ -4469,7 +4660,7 @@ RecipeOutcome VulkanDevice::DrawFromRecipe(const Graphics::State& graphics, cons
         return RecipeOutcome::Rebuild;
     }
     const auto context = graphicsContext();
-    const auto outcome = Graphics::DrawWithRecipe(context, graphics, draw, shaders, snapshots, *recipe);
+    const auto outcome = Graphics::DrawWithRecipe(context, graphics, draw, shaders, snapshots, *recipe, trace);
     if (!outcome.recorded) {
         switch (outcome.miss) {
             case Graphics::DrawRecipeMiss::NotRecordable: counters.precheckMisses[MissNotRecordable].fetch_add(1, std::memory_order_relaxed); break;
@@ -4666,8 +4857,8 @@ std::shared_ptr<RecipeHit> VulkanDevice::PrepareRecipe(const std::shared_ptr<con
     return hit;
 }
 
-void VulkanDevice::Dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipe) {
-    static_cast<void>(dispatch(shader, x, y, z, 0, snapshots, programAddress, std::move(prepared), recipe));
+void VulkanDevice::Dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipe, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear) {
+    static_cast<void>(dispatch(shader, x, y, z, 0, snapshots, programAddress, std::move(prepared), recipe, {}, htileClear));
 }
 
 VulkanDevice::IndirectOutcome VulkanDevice::DispatchIndirect(const ShaderRecompiler::RecompileResult& shader, std::uint64_t arguments, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipe, const std::array<std::uint32_t, 3>& threadGroup) {
@@ -4889,6 +5080,8 @@ void VulkanDevice::recordDispatch(RecordedDispatch& record) {
     }
     const auto gpuTiming = recorder.BeginGpuTiming(record.programAddress != 0 ? record.programAddress : record.shader->program->variantId);
     if (state->checkpointMarker != nullptr) state->checkpointMarker(commands, reinterpret_cast<const void*>(static_cast<std::uintptr_t>(record.programAddress)));
+    const auto marker = state->bufferMarker != nullptr ? state->markerLog.Next(record.programAddress) : 0u;
+    if (marker != 0) state->bufferMarker(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, state->markerBuffer, 0, marker);
     if (argumentImport != nullptr) {
         context.Resolved(&Graphics::DeviceFunctions::cmdDispatchIndirect, "vkCmdDispatchIndirect")(commands, indirectBuffer, indirectOffset);
     } else {
@@ -4921,6 +5114,7 @@ void VulkanDevice::recordDispatch(RecordedDispatch& record) {
         }
     }
     recorder.EndGpuTiming(gpuTiming);
+    if (marker != 0) state->bufferMarker(commands, VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT, state->markerBuffer, sizeof(std::uint32_t), marker);
     const auto trailingTiming = recorder.BeginGpuTiming(CommandClass::DispatchTrailing);
     constexpr VkAccessFlags dispatchedAccess = VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_READ_BIT;
     Graphics::RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_SHADER_WRITE_BIT, dispatchedAccess);
@@ -4928,21 +5122,31 @@ void VulkanDevice::recordDispatch(RecordedDispatch& record) {
     recorder.EndGpuTiming(trailingTiming);
     recorder.MarkCovered(dispatchedAccess);
     recordStep(PhaseRecordBind);
+    if (record.htileClear.has_value()) Graphics::ArmHtileDepthClear(record.htileClear->first, record.htileClear->second);
     resources.MarkGpuWrites(recorder);
+    if (record.htileClear.has_value()) {
+        Graphics::QueueHtileDepthClear(record.htileClear->first, record.htileClear->second);
+        recorder.NotePendingWrite(record.htileClear->first, record.htileClear->second);
+    }
     recordStep(PhaseRecordMarks);
     // Only copied written buffers (and BDA fault checks) need work once the GPU is done; without them
     // the batch can signal its labels from the GPU.
-    if (resources.NeedsCompletion() && resources.Reusable()) {
+    const bool completionNeeded = resources.NeedsCompletion() || record.htileClear.has_value();
+    if (completionNeeded && resources.Reusable()) {
         auto kept = record.resources;
-        recorder.OnComplete([kept] { kept->CheckFaults(); });
-    } else if (resources.NeedsCompletion()) {
+        recorder.OnComplete([kept, htileClear = record.htileClear] {
+            kept->CheckFaults();
+            if (htileClear.has_value()) Graphics::CompleteHtileDepthClear(htileClear->first, htileClear->second);
+        });
+    } else if (completionNeeded) {
         // Listed for DispatchIndirect until the write-back ran (a non-reusable object, so once).
         auto writers = state->copiedWriters;
         auto kept = record.resources;
-        recorder.OnComplete([kept, writers] {
+        recorder.OnComplete([kept, writers, htileClear = record.htileClear] {
             // Delisted before the write-back: one that fails must not keep indirect dispatches on the CPU.
             writers->erase(std::remove(writers->begin(), writers->end(), kept), writers->end());
             kept->WriteBackBuffers();
+            if (htileClear.has_value()) Graphics::CompleteHtileDepthClear(htileClear->first, htileClear->second);
         });
         // Listed after the registration: a throw there leaves nothing that would pin the CPU path forever.
         if (resources.HasCopiedWrites()) writers->push_back(kept);
@@ -4976,7 +5180,7 @@ std::shared_ptr<ComputePipelineObjects> VulkanDevice::createComputePipeline(cons
     const Graphics::PipelineSpecialization specialization(shader);
     const auto subgroupSize = computeSubgroupSize(shader);
     const auto stageFlags = computeStageFlags(shader);
-    if (const char* directory = std::getenv("APS5_DUMP_COMPUTE_PIPELINES"); directory != nullptr && *directory != '\0' && ComputePipelineCapture::OptionalEnabled() && CaptureComputePipeline(shader.spirv.size())) {
+    if (const auto* directory = ComputePipelineDumpDirectory(); directory != nullptr && *directory != 0 && !state->probingFloatControls && ComputePipelineCapture::OptionalEnabled() && CaptureComputePipeline(shader.spirv.size())) {
         ComputePipelineCapture capture;
         capture.spirv = shader.spirv.Copy();
         ComputeDescriptorSetLayout resourcesLayout;
@@ -5073,7 +5277,7 @@ std::shared_ptr<ComputePipelineObjects> VulkanDevice::computePipeline(const Grap
     return finish(std::move(objects), nullptr);
 }
 
-VulkanDevice::IndirectOutcome VulkanDevice::dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipeOut, const std::array<std::uint32_t, 3>& threadGroup) {
+VulkanDevice::IndirectOutcome VulkanDevice::dispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::span<const Graphics::GuestMemorySnapshot> snapshots, std::uint64_t programAddress, std::shared_ptr<PreparedDispatch> prepared, std::shared_ptr<const Recipe>* recipeOut, const std::array<std::uint32_t, 3>& threadGroup, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear) {
     startJournalReplay();
     for (const auto& binding : shader.bindings) {
         if (binding.role != ShaderRecompiler::DescriptorRole::GuestBuffers) continue;
@@ -5321,11 +5525,32 @@ VulkanDevice::IndirectOutcome VulkanDevice::dispatch(const ShaderRecompiler::Rec
         timing.Mark("pipeline_create");
         timer.phase(PhasePipeline);
     }
+    DispatchCompletion completion{context, shaders, pushStages, pushBytes, objects, resources, contentKey, cacheable, fromCache, revalidateMs, overlay, lookupsBefore, timer, timing, groupsText};
+    return recordCompletedDispatch(shader, x, y, z, arguments, programAddress, recipeOut, threadGroup, htileClear, completion);
+}
+
+VulkanDevice::IndirectOutcome VulkanDevice::recordCompletedDispatch(const ShaderRecompiler::RecompileResult& shader, std::uint32_t x, std::uint32_t y, std::uint32_t z, std::uint64_t arguments, std::uint64_t programAddress, std::shared_ptr<const Recipe>* recipeOut, const std::array<std::uint32_t, 3>& threadGroup, std::optional<std::pair<std::uint64_t, std::size_t>> htileClear, DispatchCompletion& completion) {
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    const auto& context = completion.context;
+    const auto& shaders = completion.shaders;
+    const auto pushStages = completion.pushStages;
+    const auto& pushBytes = completion.pushBytes;
+    const auto& objects = completion.objects;
+    const auto& resources = completion.resources;
+    const auto& contentKey = completion.contentKey;
+    const bool cacheable = completion.cacheable;
+    const bool fromCache = completion.fromCache;
+    const double revalidateMs = completion.revalidateMs;
+    const auto& overlay = completion.overlay;
+    const auto lookupsBefore = completion.lookupsBefore;
+    auto& timer = completion.timer;
+    auto& timing = completion.timing;
+    auto* groupsText = completion.groupsText;
     // Recorded into the device's open batch: the CPU moves on to the next command while the GPU
     // works; the batch is waited for where the guest expects results (labels, flips, CPU reads).
     auto& recorder = *state->recorder;
     IndirectOutcome outcome{0, 0};
-    RecordedDispatch record{&context, &shaders[0], resources, objects, pushStages, &pushBytes, x, y, z, arguments, nullptr, programAddress, fromCache && TemplateDataRefresh() ? RecordedDispatch::DataRefresh::Words : RecordedDispatch::DataRefresh::None, 0, revalidateMs, &timer};
+    RecordedDispatch record{&context, &shaders[0], resources, objects, pushStages, &pushBytes, x, y, z, arguments, nullptr, programAddress, fromCache && TemplateDataRefresh() ? RecordedDispatch::DataRefresh::Words : RecordedDispatch::DataRefresh::None, 0, revalidateMs, &timer, htileClear};
     record.resourceKeyMatched = fromCache;
     record.bindings = overlay;
     record.threadGroup = threadGroup;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp
index 7bbca06017..f95ac3a62f 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/WorkerSampler.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Execution/include/WorkerSampler.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
@@ -43,7 +44,7 @@ struct Sampler {
     std::uint64_t stackHigh = 0;
     std::vector<DwarfFrames> modules;
     std::uint64_t pendingModule = 0;
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::map<std::uint64_t, std::pair<std::uint64_t, std::uint64_t>> counts;
     CollapsedStacks stacks;
     std::uint64_t samples = 0;
diff --git a/core/libs/prx/libSceAgcDriver/Export.cpp b/core/libs/prx/libSceAgcDriver/Export.cpp
index 18cd1da5d8..fd98ebbdb5 100644
--- a/core/libs/prx/libSceAgcDriver/Export.cpp
+++ b/core/libs/prx/libSceAgcDriver/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp
index 657c5351c4..01a9c04191 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/BufferPool.hpp
@@ -3,6 +3,7 @@
 
 #include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
 #include <chrono>
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <cstdint>
 #include <deque>
 #include <list>
@@ -65,13 +66,14 @@ public:
     // The size a buffer for `bytes` is created with: its size class, or `bytes` itself when large.
     static std::size_t Capacity(std::size_t bytes, VkMemoryPropertyFlags properties);
     static VkBufferUsageFlags Usage(VkBufferUsageFlags usage, VkMemoryPropertyFlags properties);
-    VkDeviceMemory AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr);
+    VkDeviceMemory AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr, bool newImage = false);
     static VkDeviceSize ImageBudget(VkDeviceSize deviceBudget);
-    VkDeviceMemory TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr);
+    VkDeviceMemory TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType = std::nullopt, std::uint32_t* allocatedType = nullptr, bool newImage = false);
     void PutImageMemory(VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept;
     std::size_t RetainedImages();
     std::optional<BufferAllocation> Take(std::size_t bytes, VkBufferUsageFlags usage, VkMemoryPropertyFlags properties = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT);
     void Put(const BufferAllocation& allocation) noexcept;
+    VkDeviceSize ReclaimIdleDevice(VkDeviceSize bytes, std::chrono::steady_clock::time_point now);
     static bool SlabEligible(std::size_t capacity, VkDeviceSize alignment, VkDeviceSize size, VkDeviceSize atom);
     static VkDeviceSize SlabBlockBytes(std::size_t capacity);
     SlabSlot TakeSlot(const Context& context, std::uint32_t memoryType, std::size_t capacity, bool addressable);
@@ -142,7 +144,7 @@ private:
     // The retained-slot bound of each tier (APS5_BUFFER_POOL_SLOTS, default `defaultSlots`), read once.
     static std::size_t MaxSlots();
     std::size_t maxSlots;
-    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes);
+    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes, bool newImage);
     VkDevice device;
     PFN_vkUnmapMemory unmap;
     PFN_vkDestroyBuffer destroyBuffer;
@@ -152,7 +154,7 @@ private:
     VkPhysicalDevice physical = VK_NULL_HANDLE;
     VkPhysicalDeviceMemoryProperties memoryProperties{};
     PFN_vkGetPhysicalDeviceMemoryProperties2 memoryProperties2 = nullptr;
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     // Not `small`/`large`: <rpcndr.h> (via <windows.h>) defines `small` as a macro.
     Tier smallTier;
     Tier largeTier;
@@ -167,7 +169,11 @@ private:
     std::uint64_t imageEvictions = 0;
     std::list<Slot*> imageOrder;
     std::uint64_t clock = 0;
-    std::mutex slabMutex;
+    std::optional<std::chrono::steady_clock::time_point> idleRead;
+    std::uint64_t idleClock = 0;
+    std::uint64_t reclaimBefore = 0;
+    std::uint64_t scannedIdleClock = 0;
+    AgcDriver::Mutex slabMutex;
     std::unordered_map<std::uint64_t, Slab> slabs;
     std::unordered_map<VkDeviceMemory, std::unique_ptr<SlabBlock>> slabBlocks;
     static constexpr VkDeviceSize budget = 512ull * 1024 * 1024;
@@ -181,7 +187,7 @@ private:
 };
 
 std::shared_ptr<BufferPool> GetBufferPool(const Context& context);
-VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType = nullptr);
+VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType = nullptr, bool newImage = false);
 void ReleaseImageMemory(const Context& context, VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept;
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp
index 1ac783d39e..7e0e07d07b 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Context.hpp
@@ -180,8 +180,11 @@ struct Context {
     // Nonzero when VK_EXT_external_memory_host is enabled: the required host pointer alignment.
     VkDeviceSize hostImportAlignment = 0;
     bool drawInputsInPlace = true;
+    bool discreteGpu = false;
     bool dmaBufImport = false;
     bool sparseBinding = false;
+    bool sparseResidencyBuffer = false;
+    bool sparseResidencyAliased = false;
     std::uint32_t queueFamily = 0;
     std::uint32_t sparseFamily = VK_QUEUE_FAMILY_IGNORED;
     VkQueue sparseQueue = VK_NULL_HANDLE;
@@ -191,7 +194,7 @@ struct Context {
     std::uint32_t settleFamily = 0;
     std::mutex* settleQueueMutex = nullptr;
     PFN_vkGetPhysicalDeviceMemoryProperties2 memoryProperties2 = nullptr;
-    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes) = nullptr;
+    VkDeviceSize (*cacheReclaim)(VkDeviceSize bytes, bool newImage) = nullptr;
     RenderCache* renderCache = nullptr;
     DrawQueue* drawQueue = nullptr;
     GraphicsPipelineCache* graphicsPipelines = nullptr;
@@ -210,9 +213,12 @@ struct Context {
     bool depthBounds = false;
     bool depthBiasClamp = false;
     bool dualSrcBlend = false;
+    bool logicOp = false;
     bool samplerFilterMinmax = false;
     bool nonSeamlessCubeMap = false;
     VkSampleCountFlags mergedCoverageSampleCounts = 0;
+    VkSampleCountFlags truncatedCoverageSampleCounts = 0;
+    bool mixedAttachmentSamples = false;
     bool conservativeRasterization = false;
     bool meshWave32 = false;
     VkBuffer emptyBuffer = VK_NULL_HANDLE;
@@ -237,11 +243,13 @@ struct Context {
     bool imageTableUpdateAfterBind = false;
     bool samplerTableUpdateAfterBind = false;
     bool geometryShader = false;
+    bool largePoints = false;
     bool sampleRateShading = false;
     bool fillModeNonSolid = false;
     bool maintenance5 = false;
     bool storageImageMultisample = false;
     bool storageImageWriteWithoutFormat = false;
+    bool imageFormatList = false;
     bool shaderClipDistance = false;
     bool shaderCullDistance = false;
     bool nullDescriptors = false;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp
index 7f05d121a2..b0c9a79d39 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp
@@ -81,6 +81,16 @@ struct DccKeyProof {
 // APS5_NO_KEY_FAST_PATH=1 scans on every call and stores nothing.
 DccKeys ProvedClearKeys(const GuestTextureResource& resource, std::uint64_t guestBytes, DccKeyProof& proof);
 bool KeyFastPath();
+bool SingleKeysReadable(const GuestTextureResource& resource);
+bool ReadSingleElement(const GuestTextureResource& resource, std::span<std::byte> element);
+struct DccSingleProof {
+    std::uint64_t address = 0;
+    std::uint64_t bytes = 0;
+    std::uint64_t generation = 0;
+    std::uint32_t format = 0;
+    bool uniform = false;
+};
+bool ProvedSingleUniform(const GuestTextureResource& resource, std::uint64_t guestBytes, std::uint64_t collected, DccSingleProof& proof);
 // Cumulative outcomes of ProvedClearKeys: calls answered by a proof, scans made, and scans not kept.
 struct DccKeyProofCounts {
     std::uint64_t proved;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp
index f507ddd3a1..ef9852b1e0 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp
@@ -29,6 +29,7 @@ struct DepthPlaneStoreStatistics {
     std::uint64_t bytes = 0;
 };
 DepthPlaneStoreStatistics DepthPlaneStoreCounts();
+void NoteDepthSurfaceWrite(const Context& context, const DepthTarget& target);
 bool SampleLocationsCompatibleDepth(const Context& context, VkFormat format, std::uint32_t samples);
 std::uint64_t DepthSurfacesSerial();
 std::uint64_t DepthSurfacesReleased();
@@ -54,7 +55,10 @@ bool DepthSurfaceOverlaps(VkDevice device, std::uint64_t address, std::uint64_t
 bool DepthSurfaceAt(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource);
 std::uint64_t HtileDepthClearAddress(std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData, const std::array<std::uint32_t, 3>& numThreads);
 std::size_t HtileDepthClearBytes_nid_no_patch(std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData, const ShaderRecompiler::ShaderComputeStageInfo& compute, std::span<const std::uint32_t> packet, std::uint64_t indirectArguments);
-void NoteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes, std::size_t nativeBytes = 0u);
+bool NoteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes, std::size_t nativeBytes = 0u);
+void ArmHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes);
+void QueueHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes);
+void CompleteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes);
 struct MemoryValueFill {
     std::uint64_t address;
     std::size_t bytes;
@@ -68,11 +72,22 @@ VkImageAspectFlags HtileFillClears(std::uint32_t pattern, bool stencilInHtile);
 std::uint64_t HtileMetadataBytes(VkExtent2D extent);
 bool HtileFillCovers(std::uint64_t htile, VkExtent2D extent, std::uint64_t address, std::size_t bytes);
 std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D);
+std::size_t DepthPlaneCopyCount();
 VkFormat HostDepthFormat(const Context& context, VkFormat format);
 float HostDepthBiasConstant(const Context& context, VkFormat format, float constant);
 std::shared_ptr<StorageTexture> DepthSurfaceStorage(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource, std::uint32_t mip);
 bool DepthSurfaceStoreBack(const Context& context, const StorageTexture& storage);
-void CopyDepthSample(const Context& context, std::uint64_t depthAddress, std::uint32_t samples, std::uint32_t sample, StorageTexture& destination, VkImageView destinationView, VkExtent2D extent);
+std::array<std::uint32_t, 8> DepthCopySourceWords(const DepthTarget& target);
+class DepthCopySourceScope {
+public:
+    explicit DepthCopySourceScope(bool active);
+    ~DepthCopySourceScope();
+    DepthCopySourceScope(const DepthCopySourceScope&) = delete;
+    DepthCopySourceScope& operator=(const DepthCopySourceScope&) = delete;
+
+private:
+    bool previous;
+};
 
 struct StorageImageClear {
     std::array<std::uint32_t, 8> image{};
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp
index b79528bf72..ea02167400 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Draw.hpp
@@ -14,10 +14,29 @@ namespace AgcDriver::Graphics {
 
 struct HostImport;
 
+struct DrawTraceContext {
+    std::uint64_t token = 0;
+    std::uint64_t submission = 0;
+    std::uint32_t queue = 0;
+    std::size_t offset = 0;
+    std::uint64_t target = 0;
+};
+
 // `recipe`, when given, receives the DrawRecipe a recorded, cacheable, reusable, non-indirect draw
 // built for its draw-cache entry (design_cpu_final M8; null otherwise, and always under
 // APS5_NO_DRAW_RECIPE=1).
-void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr);
+void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots = {}, std::shared_ptr<const DrawRecipe>* recipe = nullptr, const DrawTraceContext* trace = nullptr);
+
+struct PixelFunctionLdsLayouts {
+    VkDescriptorSetLayout empty = VK_NULL_HANDLE;
+    VkDescriptorSetLayout buffer = VK_NULL_HANDLE;
+};
+
+PixelFunctionLdsLayouts PixelFunctionLdsSetLayouts(const Context& context);
+void PreparePixelFunctionLds(const Context& context, VkCommandBuffer commands, std::uint32_t subgroupSize);
+void BindPixelFunctionLds(const Context& context, VkCommandBuffer commands, VkPipelineLayout layout);
+void CheckPixelFunctionLds(const Context& context);
+void ReleasePixelFunctionLds(VkDevice device);
 std::optional<std::string> KnownValidationFailure(const Context& context, std::span<const CompiledShader> shaders, const State& state);
 std::uint64_t DrawRenderPassKey(const Context& context, const State& state, std::span<const VkImageView> targetViews);
 
@@ -81,7 +100,7 @@ struct DrawRecipeOutcome {
 // the template's proof (ProveCurrent) with the alias checks repeated, the pipeline and framebuffer
 // from the recipe, then the record as Draw's (pass continued or begun, Kept, MarkGpuWrites). A
 // miss records nothing.
-DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe);
+DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe, const DrawTraceContext* trace = nullptr);
 // Whether recorded draws build recipes and draw-cache hits use them (APS5_NO_DRAW_RECIPE unset).
 bool DrawRecipes();
 
@@ -91,9 +110,11 @@ bool DrawRecipes();
 // draw index, the vertex ranges, the device features, APS5_NO_GPU_INDIRECT_DRAW) or under the device
 // lock in Draw (the memory state of the records). `readMs` is the CPU read's time (its sync);
 // `rewritten` counts a GPU-side draw whose records were copied and patched with a constant.
-enum class IndirectDrawPath : std::uint8_t { Gpu, NotFolded, FetchUnknown, NonVertexPath, IndxOffset, DrawIndex, VertexRange, FeatureGap, PendingImage, PendingLabelOrCopy, NotImported, Disabled, IndexRange, Count };
+enum class IndirectDrawPath : std::uint8_t { Gpu, NotFolded, FetchUnknown, NonVertexPath, IndxOffset, DrawIndex, VertexRange, FeatureGap, PendingImage, PendingLabelOrCopy, NotImported, Disabled, IndexRange, IndexLimitUnknown, Count };
 void CountIndirectDraw(IndirectDrawPath path, double readMs, bool rewritten = false);
 std::array<std::uint64_t, static_cast<std::size_t>(IndirectDrawPath::Count)> IndirectDrawCounts();
+void CountEmptyIndirectDraw(double readMs);
+std::uint64_t EmptyIndirectDrawCount();
 
 struct DrawPassCounts {
     std::uint64_t draws = 0;
@@ -127,7 +148,9 @@ void CountDrawSkip(DrawSkip kind, double us);
 std::shared_ptr<std::vector<std::shared_ptr<ShaderResources>>> DrawCopiedWriters();
 
 void RunColorMetadataPass(const Context& context, const ColorMetadataPass& pass);
-void RunDepthCopyPass(const Context& context, const DepthCopyPass& pass);
+std::vector<std::pair<std::uint64_t, std::uint64_t>> PipelinedColorMetadataPassWrites(const ColorMetadataPass& pass);
+bool DrawPipelineEnabled();
+bool CommitTrims();
 
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp
new file mode 100644
index 0000000000..4f973ff75e
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp
@@ -0,0 +1,40 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_FIRSTSAMPLECOPY_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_FIRSTSAMPLECOPY_HPP
+
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+
+namespace AgcDriver::Graphics {
+
+class Recorder;
+
+class FirstSampleCopy {
+public:
+    FirstSampleCopy(const Context& context, VkFormat format, VkExtent2D extent);
+    ~FirstSampleCopy();
+    FirstSampleCopy(const FirstSampleCopy&) = delete;
+    FirstSampleCopy& operator=(const FirstSampleCopy&) = delete;
+
+    void Record(Recorder& recorder, VkImageView source, VkImageLayout layout);
+    VkImage Image() const { return image; }
+
+private:
+    void release() noexcept;
+
+    Context context;
+    VkExtent2D extent;
+    VkImage image = VK_NULL_HANDLE;
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    VkImageView view = VK_NULL_HANDLE;
+    VkSampler sampler = VK_NULL_HANDLE;
+    VkDescriptorSetLayout descriptorLayout = VK_NULL_HANDLE;
+    VkPipelineLayout pipelineLayout = VK_NULL_HANDLE;
+    VkRenderPass renderPass = VK_NULL_HANDLE;
+    VkFramebuffer framebuffer = VK_NULL_HANDLE;
+    VkShaderModule vertex = VK_NULL_HANDLE;
+    VkShaderModule fragment = VK_NULL_HANDLE;
+    VkPipeline pipeline = VK_NULL_HANDLE;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp
index fa552ac524..9fe4caae06 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp
@@ -113,6 +113,7 @@ void SetHostImportDeferredSettles(bool enabled);
 // The larger of 6 GiB and half the physical memory, at most the largest host heap less the larger of 2 GiB and half
 // that heap: the other half stays for the buffers, mirrors and textures that share it.
 std::uint64_t HostImportBudget(const VkPhysicalDeviceMemoryProperties& memory, std::uint64_t physicalBytes);
+void SetHostImportMaxBytes(std::uint64_t bytes);
 std::uint64_t HostImportLiveBytes();
 std::uint64_t HostImportBudgetRemaining(const Context& context);
 struct HostImportSettleCounts {
@@ -248,6 +249,11 @@ struct MirrorStats {
 };
 MirrorStats MirrorCounters();
 std::uint64_t SnapshotMismatches();
+struct HeapMirrorHold {
+    std::uint64_t mirrors = 0;
+    std::uint64_t bytes = 0;
+};
+HeapMirrorHold HeapMirrorsWithin(std::uint64_t begin, std::uint64_t end);
 void ClearSnapshotCopies(VkDevice device);
 std::vector<std::uint64_t> AddressTableKey(std::span<const std::pair<std::uint64_t, std::uint64_t>> writes, std::span<const ShaderRecompiler::BdaAbi::Range> own);
 void ClearImageMirrors(VkDevice device);
@@ -285,6 +291,7 @@ public:
     // calls RecordCopyBacks (a dispatch), since a staged region's results reach guest memory by
     // that copy alone. Call before Upload.
     void AllowDeviceStaging() { stagingAllowed = true; }
+    void DisallowAddressStaging() { addressStaging = false; }
     void AllowAdjustedRegions() { adjustedRegions = true; }
     // Records the copy-in of every staged region anew for another use of this upload (a resource
     // cache hit, from ShaderResources::Revalidate, under GuestMemory::GpuMutex, once the imports
@@ -421,6 +428,7 @@ private:
         // The device refused the shadow (memory or allocations exhausted): the region takes the
         // path it would take without staging, in both upload stages.
         bool unstaged = false;
+        bool overlay = false;
     };
 
     // How [begin, end) lies against the space's base regions.
@@ -462,10 +470,12 @@ private:
     // APS5_GPU_COPY_MAX_KIB allows, and APS5_CPU_COPIES unset.
     bool gpuCopyEligible(const Region& region) const;
     // Whether a region inside a host import is staged in device memory instead of bound in place
-    // (see GuestBufferMemory.cpp): staging allowed, not address-based, a written element inside,
-    // and an atomic element or a size within the written-shadow window. Independent of the import,
-    // so UploadPrepare and UploadFinish decide alike.
+    // (see GuestBufferMemory.cpp): staging allowed, not address-based unless an overlay region, a
+    // written element inside, and an atomic element or a size within the written-shadow window.
+    // Independent of the import, so UploadPrepare and UploadFinish decide alike.
     bool stagingEligible(const Region& region, bool addressable) const;
+    bool overlayCandidate(const Region& inside, bool readOnly) const;
+    void resolveOverlays();
     bool bindableInPlace(std::uint64_t offset, bool addressable) const;
     // Records the import-to-buffer copies of the given gpuCopy regions into the open batch, with
     // the barriers that order them after earlier recorded writes and before the shaders reading them.
@@ -473,6 +483,7 @@ private:
     void takeHeapReferences();
     Context context;
     bool stagingAllowed = false;
+    bool addressStaging = true;
     bool adjustedRegions = false;
     GuestAllocations::Lease lease;
     // The cached address space this build maps through (its lease pins the ranges); `regions` then
@@ -491,11 +502,14 @@ private:
     bool regionsOverlap = false;
     std::vector<std::pair<std::uint64_t, std::uint64_t>> writes;
     std::vector<std::pair<std::uint64_t, std::uint64_t>> readsOverBase;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> servedInsideBase;
     std::vector<std::pair<std::uint64_t, std::vector<std::byte>>> heapReferences;
+    std::vector<std::pair<std::uint64_t, std::shared_ptr<Buffer>>> heapReadbacks;
     // UploadPrepare ran (regions are frozen); `uploaded` once UploadFinish ran.
     bool prepared = false;
     bool uploaded = false;
     bool committed = false;
+    mutable std::uint64_t directWritesGeneration = 0;
 };
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp
index 6f40129b56..17b5f7cb3b 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp
@@ -90,12 +90,14 @@ struct GuestTextureResource {
     std::uint32_t minLod = 0;
     std::uint32_t allocatedMipCount = 0;
     std::uint32_t samples = 1;
+    std::uint64_t fmaskCmaskAddress = 0;
 };
 
 float EffectiveMinLod(const GuestTextureResource& resource);
 
 bool IsNullTextureResource(std::span<const std::uint32_t> words);
 GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words);
+std::array<std::uint32_t, 8> EncodeTextureResource(const GuestTextureResource& resource);
 bool DescriptorSingleLevel(std::span<const std::uint32_t> words);
 bool FirstLayerDescriptor(std::span<const std::uint32_t> words, std::array<std::uint32_t, 8>& narrowed);
 bool MatchesGuestDimension(ShaderRecompiler::DescriptorImageShape shape, TextureDimension dimension);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp
index c8a8800703..04f7e5ccbd 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp
@@ -67,6 +67,7 @@ bool TakeMultisampledSingleClear(std::span<const std::uint32_t> code, std::span<
 bool TakeMultisampledClear(MultisampledCmask& cmask, MultisampledColorFill& colorFill, const ColorTarget& use, VkClearColorValue& clear);
 SampleOrderTarget MultisampleTargetOrderTarget(const Context& context, const ColorTarget& target);
 std::shared_ptr<Texture> MultisampleTargetTexture(const Context& context, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType viewType = VK_IMAGE_VIEW_TYPE_2D);
+std::shared_ptr<Texture> MultisampleTargetFirstSample(const Context& context, const GuestTextureResource& resource, VkComponentMapping components);
 VkImageView MultisampleTargetView(const Context& context, const ColorTarget& target, VkImage* image = nullptr);
 VkImageView MultisampleTargetView(const Context& context, const ColorTarget& target, std::shared_ptr<void>& owner, VkImage* image = nullptr);
 void KeepMultisampleTarget_nid_no_patch(const std::shared_ptr<void>& owner);
@@ -76,9 +77,11 @@ bool MultisampleTargetStorable(const Context& context, const ColorTarget& target
 void ResolveMultisampleTarget(const Context& context, const ColorTarget& source, StorageTexture& destination, VkImageView destinationView);
 bool MultisampledColorFillAbsorbs(std::uint64_t address, std::size_t bytes, std::uint32_t pattern);
 void NoteColorMetadataFill(std::uint64_t address, std::size_t bytes, std::uint32_t pattern);
+std::shared_ptr<Texture> MultisampleTargetFmaskTexture_nid_no_patch(const Context& context, const GuestTextureResource& resource, VkComponentMapping components);
 void ClearMultisampleTargets(VkDevice device);
 void InstallResidentImageReadGuard_nid_no_patch();
 void UpdateResidentImageUnmapObserver_nid_no_patch();
+void GuardOneFragmentFmask(const Context& context, const ColorTarget& target);
 void RequireNoMultisampleTarget(std::uint64_t address, std::size_t bytes, const char* access);
 void RequireNoMultisampleColorTarget(std::uint64_t address, std::size_t bytes, const char* access);
 
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp
index 1ee631c131..abfb3226a6 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Pipeline.hpp
@@ -87,6 +87,8 @@ private:
     VkPipeline secondChannel = VK_NULL_HANDLE;
     std::size_t attachments = 0;
     std::size_t colorAttachments = 0;
+    std::vector<bool> boundAttachments;
+    std::uint32_t boundColorAttachments = 0;
     bool depthBounds = false;
     bool depthBias = false;
     bool libraries = false;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp
index c2cf90476e..d905e217cf 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp
@@ -61,11 +61,14 @@ struct PipelineJournalCounters {
     std::uint64_t replayFailed = 0;
     double replayMs = 0;
     std::uint32_t replayThreads = 0;
+    std::uint64_t replayHeldPeakBytes = 0;
     std::uint64_t recordedGraphics = 0;
     std::uint64_t recordedCompute = 0;
     std::uint64_t recordedModules = 0;
     std::uint64_t writtenBytes = 0;
     std::uint64_t writeFailures = 0;
+    std::uint64_t evictedRecords = 0;
+    std::uint64_t evictedBytes = 0;
 };
 
 // A decimal switch of the pipeline store or journal, or its default when unset; anything else throws.
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp
index 6ef4b5cf08..8f1c131eba 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Recorder.hpp
@@ -4,6 +4,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/BarrierBatch.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PassHazards.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <unordered_map>
 #include <atomic>
 #include <chrono>
@@ -106,7 +107,8 @@ public:
     static constexpr std::size_t DrawInputEntries = 16384;
     std::shared_ptr<Buffer> UnwrittenDrawSnapshot(std::uint64_t address, std::size_t bytes, const std::array<std::uint64_t, 3>& stamp, VkDeviceSize* offset = nullptr);
     void NoteUnwrittenDrawSnapshot(std::uint64_t address, std::size_t bytes, const std::array<std::uint64_t, 3>& stamp, std::shared_ptr<Buffer> buffer, VkDeviceSize offset = 0);
-    std::shared_ptr<Buffer> ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use = SnapshotUse::Storage, std::uint32_t* derived = nullptr, std::uint64_t generation = 0);
+    std::shared_ptr<Buffer> ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use = SnapshotUse::Storage, std::uint32_t* derived = nullptr, std::uint64_t generation = 0, VkDeviceSize* offset = nullptr);
+    static constexpr std::size_t ContainingSnapshotProbes = 16;
     void KeepDrawSnapshot(std::uint64_t address, std::size_t bytes, std::uint64_t generation, std::uint64_t registryGeneration, std::shared_ptr<Buffer> buffer, SnapshotUse use = SnapshotUse::Storage, std::uint32_t derived = 0);
     static constexpr std::size_t DrawUploadChunk = std::size_t{1} << 20u;
     struct UploadSlice {
@@ -201,25 +203,30 @@ public:
     // Submits the open batch and returns the serial of the newest submitted batch (0 when nothing was
     // ever submitted); WaitSerial(serial) then covers all recorded work.
     std::uint64_t SubmitAndEpoch();
+    std::uint64_t OpenBatchSerial();
     bool HasTimeline() const { return timeline != VK_NULL_HANDLE; }
     bool RecordDispatchArguments(VkCommandBuffer commands, VkDeviceAddress source, VkDeviceAddress arguments, const std::array<std::uint32_t, 3>* threadGroup = nullptr);
     // Waits until every batch up to `serial` completed on the GPU. Called WITHOUT GuestMemory::GpuMutex:
     // it touches only the immutable timeline semaphore (the caller keeps the device alive). Requires
     // HasTimeline(); the debug switch APS5_NO_TIMELINE makes the device create the recorder without one.
     void WaitSerial(std::uint64_t serial);
+    bool WaitSerialFor(std::uint64_t serial, std::uint64_t timeoutNanos);
     // Under the mutex: finishes (completions, release) the in-flight batches up to `serial`, from the
     // front only; tolerates batches another thread finished meanwhile. Later batches stay in flight.
     void FinishUpTo(std::uint64_t serial);
     // Submits and waits for every batch, running completions in order.
     void Sync();
     void CountSamples();
+    bool CountingSamples() const { return countingSamples; }
     bool RecordMeshArguments(VkCommandBuffer commands, VkDeviceAddress record, VkDeviceAddress arguments, std::span<const std::uint32_t, 7> rules);
     std::uint64_t SamplesTotal();
     bool DumpSamples(VkDeviceAddress target, std::uint64_t address = 0);
     void NoteSampledDraw(VkCommandBuffer commands);
+    void NoteDrawTraceToken(std::uint64_t token) noexcept;
     bool QueuesSampleDumps() const;
     void PrepareSampleSlot();
     void EndPassSamples();
+    void RecordUncounted(const std::function<void(VkCommandBuffer)>& record);
     struct SampleDumpStatistics {
         std::uint64_t queued;
         std::uint64_t queuedInPass;
@@ -402,6 +409,7 @@ public:
     static std::uint64_t PublishGeneration();
     // labels waiting in completion actions (the CPU must reap their batch for them to land);
     static std::uint64_t PendingCompletionLabels();
+    static std::uint64_t PendingCompletionStores();
     // write-back completions (OnComplete) of unfinished batches: a reaper retires them when every
     // worker sleeps, as for the labels above;
     static std::uint64_t PendingWriteBackCompletions();
@@ -578,6 +586,7 @@ private:
         VkQueryPool queries = VK_NULL_HANDLE;
         VkQueryPool samples = VK_NULL_HANDLE;
         std::shared_ptr<void> samplePool;
+        std::vector<VkQueryPool> endedSamples;
         bool sampleActive = false;
         bool samplesDrawn = false;
         VkQueryPool segments = VK_NULL_HANDLE;
@@ -599,6 +608,7 @@ private:
         // Labels stored by this batch's completion actions (see AfterCompletions); subtracted from
         // the lock-free pending count when the batch finishes, whether or not its completions ran.
         std::uint32_t completionLabelCount = 0;
+        std::uint32_t completionStoreCount = 0;
         // Write-back completions (OnComplete), likewise.
         std::uint32_t writeBackCompletionCount = 0;
         // The ranges of the completion labels also stored on the GPU, and whether each entered the
@@ -671,6 +681,8 @@ private:
             std::uint64_t end;
         };
         std::vector<KeyStore> keyStores;
+        std::vector<std::uint64_t> drawTraceTokens;
+        std::unordered_set<std::uint64_t> drawTraceTokenSet;
     };
     struct LabelEntry {
         std::uint32_t value;
@@ -796,7 +808,7 @@ private:
     // Whether a write-back noted after `sequence` overlapped [begin, end); true when the ring no
     // longer reaches back to `sequence` (conservative: the store runs as before).
     bool writtenBackSince(std::uint64_t sequence, std::uint64_t begin, std::uint64_t end);
-    std::mutex writtenBackMutex;
+    AgcDriver::Mutex writtenBackMutex;
     std::deque<std::array<std::uint64_t, 3>> writtenBack;
     std::uint64_t writtenBackSequence = 0;
     // PendingLabel without the table mutex (the caller holds it, or the GPU mutex).
@@ -844,7 +856,7 @@ private:
     // frame would otherwise allocate and free their objects each time).
     std::vector<std::pair<VkCommandBuffer, VkFence>> spare;
     std::vector<VkQueryPool> sparePools;
-    mutable std::mutex completedMutex;
+    mutable AgcDriver::Mutex completedMutex;
     std::array<Completed, CompletedRingSize> completed;
     std::uint64_t newestSubmitted = 0;
     std::chrono::steady_clock::time_point newestSubmittedAt{};
@@ -881,6 +893,7 @@ private:
     std::map<DrawSnapshotKey, IndexRange> indexRanges;
     std::list<DrawSnapshotKey> indexRangeRecency;
     bool refreshDrawSnapshot(DrawSnapshot& entry, std::uint64_t address, std::size_t bytes);
+    std::shared_ptr<Buffer> containingDrawSnapshot(std::uint64_t address, std::size_t bytes, VkDeviceSize* offset);
     mutable std::weak_ptr<const WriteRanges> publishedWriteRanges;
     mutable bool publishedWriteRangesValid = false;
 };
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/ResidentMirror.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/ResidentMirror.hpp
new file mode 100644
index 0000000000..f6c10579b9
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/ResidentMirror.hpp
@@ -0,0 +1,77 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_RESIDENTMIRROR_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_RESIDENTMIRROR_HPP
+
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <utility>
+#include <vector>
+
+namespace AgcDriver::Graphics {
+
+class Buffer;
+class ResidentMemory;
+
+using GuestRuns = std::vector<std::pair<std::uint64_t, std::uint64_t>>;
+
+GuestRuns GuestNonzeroBlocks(const GuestRuns& candidates);
+bool GuestBytesZero(std::uint64_t begin, std::uint64_t end);
+void SetResidentAddressSpaceLimit(std::uint64_t bytes);
+
+class ResidentBuffer : public std::enable_shared_from_this<ResidentBuffer> {
+public:
+    static constexpr std::uint64_t BlockBytes = 65536;
+
+    static std::shared_ptr<ResidentBuffer> Create(const Context& context, std::uint64_t base, std::uint64_t bytes, const GuestRuns& backed);
+    ~ResidentBuffer();
+    ResidentBuffer(const ResidentBuffer&) = delete;
+    ResidentBuffer& operator=(const ResidentBuffer&) = delete;
+
+    VkBuffer Handle() const { return buffer; }
+    VkDeviceAddress DeviceAddress() const { return address + lead; }
+    std::uint64_t Origin() const { return origin; }
+    std::uint64_t BoundBytes() const { return bound * BlockBytes; }
+    std::uint32_t MemoryType() const { return type; }
+    std::byte* Block(std::uint64_t guest) const;
+    std::uint64_t UnboundBytes(const GuestRuns& runs) const;
+    void Bind(const GuestRuns& runs);
+    void MarkChanged(std::uint64_t begin, std::uint64_t end);
+    void Read(std::uint64_t guest, std::span<std::byte> out) const;
+    void Store(std::uint64_t guest, std::span<const std::byte> bytes);
+    std::shared_ptr<Buffer> RecordReadback(VkCommandBuffer commands, std::uint64_t guest, std::uint64_t bytes) const;
+    void ReadDevice(std::uint64_t guest, std::span<std::byte> out);
+    static void FlushChanged(const Context& context);
+
+private:
+    struct Slot {
+        void* slab = nullptr;
+        std::uint32_t index = 0;
+        std::byte* host = nullptr;
+    };
+    ResidentBuffer(const Context& context, std::uint64_t base, std::uint64_t bytes, const GuestRuns& backed);
+    std::size_t blockIndex(std::uint64_t guest) const;
+    void submit(const std::vector<VkSparseMemoryBind>& binds);
+    void flush();
+    std::shared_ptr<Buffer> readbackBatch(std::uint64_t guest, std::uint64_t bytes);
+    void release() noexcept;
+
+    Context context;
+    std::shared_ptr<ResidentMemory> memory;
+    VkBuffer buffer = VK_NULL_HANDLE;
+    VkDeviceAddress address = 0;
+    std::uint32_t type = 0;
+    std::uint64_t origin = 0;
+    std::uint64_t lead = 0;
+    std::uint64_t size = 0;
+    std::uint64_t bound = 0;
+    std::vector<Slot> slots;
+    std::mutex changedMutex;
+    GuestRuns changed;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Sampler.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Sampler.hpp
index ad2f347b21..7212fb40c6 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Sampler.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Sampler.hpp
@@ -3,6 +3,7 @@
 
 #include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestSamplerResource.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <array>
 #include <cstdint>
 #include <map>
@@ -59,7 +60,7 @@ private:
         std::shared_ptr<Sampler> sampler;
         std::uint64_t lastUse;
     };
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::map<std::array<std::uint32_t, 5>, Entry> entries;
     std::uint64_t clock = 0;
     std::size_t capacity;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp
index 5321104605..b3d8776df4 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp
@@ -5,6 +5,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/BdaResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Sampler.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "Recompiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Shaders.hpp"
 #include <array>
@@ -29,16 +30,19 @@ class Recorder;
 
 void FlushCachedTextures(VkDevice device);
 void ClearCachedTextures(VkDevice device);
-std::uint64_t ReleaseTextureCaches(std::uint64_t bytes);
+std::uint64_t ReleaseTextureCaches(std::uint64_t bytes, bool newImage = false);
 std::uint64_t TextureCacheBudget(const VkPhysicalDeviceMemoryProperties& memory);
 std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t sampledBytes, std::uint64_t storageBytes);
-std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes);
+std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes, std::uint64_t storageBytes = 0);
 bool SampledBudgetReportDue(std::uint64_t reported, std::uint64_t budget, std::chrono::steady_clock::duration sinceReport);
 std::optional<std::uint32_t> LargestDeviceLocalHeap(const VkPhysicalDeviceMemoryProperties& memory);
 std::uint64_t StorageTextureCacheBudget(const Context& context);
+inline constexpr std::uint64_t SpareSnapshotPresents = 16;
 struct TextureCacheUse {
     std::size_t sampledEntries = 0;
+    std::size_t spareEntries = 0;
     std::uint64_t sampledBytes = 0;
+    std::uint64_t spareBytes = 0;
     std::uint64_t storageBytes = 0;
 };
 TextureCacheUse TextureCacheUsage();
@@ -46,8 +50,11 @@ void OverrideCacheBudgetForTest(std::uint64_t bytes);
 std::uint64_t SampledTextureCacheBudget(const Context& context);
 std::shared_ptr<Texture> CachedSampledTexture(const Context& context, std::span<const std::uint32_t> words, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D);
 bool SampledTexturesShareEntry(std::span<const std::uint32_t> first, std::span<const std::uint32_t> second);
+bool AnyPendingCpuWrites(const Context& context);
 bool CompletePendingCpuWrites(const Context& context, std::uint64_t address, std::size_t bytes);
 bool SpirvStoresThroughAddresses(std::span<const std::uint32_t> words);
+bool ShaderStoresThroughAddresses(const ShaderRecompiler::SharedSpirv& spirv);
+void LastRecordIndices(std::span<const void* const> logged, std::span<const void* const> objects, std::vector<std::size_t>& indices);
 
 // The cached storage image of a surface (render targets use it as their resident image); brought up
 // to date with guest memory before it is returned.
@@ -119,7 +126,7 @@ private:
     PFN_vkDestroyDescriptorPool destroyPool;
     PFN_vkResetDescriptorPool resetPool;
     PFN_vkFreeDescriptorSets freeDescriptorSets = nullptr;
-    mutable std::mutex mutex;
+    mutable AgcDriver::Mutex mutex;
     std::map<std::vector<std::uint32_t>, VkDescriptorSetLayout> layouts;
     struct Pool {
         VkDescriptorPool handle = VK_NULL_HANDLE;
@@ -146,6 +153,7 @@ struct ImageTableReuseCounts {
     std::uint64_t writesMade = 0;
 };
 ImageTableReuseCounts ImageTableReuses();
+std::uint64_t SampledLookupKeyScans();
 
 struct PresyncSurface {
     std::uint64_t address;
@@ -292,6 +300,7 @@ public:
         ProofFailure failure = ProofFailure::None;
     };
     bool Revalidate(std::span<const CompiledShader> shaders, ProofReport* report = nullptr);
+    static bool EpochProofs();
     bool Revalidate(const CompiledShader& shader, ProofReport* report = nullptr) { return Revalidate(std::span<const CompiledShader>(&shader, 1), report); }
     // The proof a recipe hit runs on its template (design_cpu_final M4): Revalidate by that name.
     bool ProveCurrent(std::span<const CompiledShader> shaders, ProofReport* report = nullptr) { return Revalidate(shaders, report); }
@@ -472,6 +481,7 @@ private:
         std::array<std::uint32_t, 8> words{};
         bool depthCompare = false;
         VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D;
+        bool firstSample = false;
         std::shared_ptr<Texture> texture;
     };
     PreviousSampled previousSampled;
@@ -632,6 +642,10 @@ private:
     // no image other than the object's own sources has results pending over its surfaces and
     // regions, so those checks are skipped (see fastRevalidate).
     std::uint64_t pendingSerialSeen = 0;
+    std::uint64_t provedEpoch = 0;
+    std::uint64_t provedProof = 0;
+    std::uint64_t provedPending = 0;
+    bool revalidateFull(std::span<const CompiledShader> shaders, ProofReport* report);
     // The import table's identity when the direct regions' serials were last proved.
     HostImportsProof importsProof;
     // FNV-1a offset basis: the hash of no data buffers (DataWordsHash).
@@ -697,6 +711,7 @@ public:
     // meanwhile by another worker stays).
     void Remove(const Key& key, const ShaderResources* object = nullptr);
     void RemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted = nullptr);
+    bool TryRemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted = nullptr);
     // Moves the entry to the front of the LRU (a recipe hit uses its template without Find, and a
     // hot template must not age out under the recipes that depend on it); false when no entry.
     bool Touch(const Key& key);
@@ -719,14 +734,32 @@ private:
     void noteEvicted(const Key& key);
     void noteReturn(const Key& key);
     void noteUse(const Key& key);
+    void removeImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted);
     struct KeyHash {
         std::size_t operator()(const Key& key) const noexcept {
-            std::uint64_t hash = 14695981039346656037ull;
-            for (const auto word : key) hash = (hash ^ word) * 1099511628211ull;
+            constexpr std::uint64_t Prime = 0x9e3779b97f4a7c15ull;
+            std::uint64_t lanes[4] = {0x243f6a8885a308d3ull, 0x13198a2e03707344ull, 0xa4093822299f31d0ull, 0x082efa98ec4e6c89ull};
+            const auto* words = key.data();
+            const auto count = key.size();
+            std::size_t at = 0;
+            for (; at + 8u <= count; at += 8u) {
+                for (std::size_t lane = 0; lane < 4u; ++lane) {
+                    const auto value = static_cast<std::uint64_t>(words[at + lane * 2u]) | static_cast<std::uint64_t>(words[at + lane * 2u + 1u]) << 32u;
+                    lanes[lane] = (lanes[lane] ^ value) * Prime;
+                    lanes[lane] ^= lanes[lane] >> 29u;
+                }
+            }
+            std::uint64_t hash = lanes[0] ^ (lanes[1] << 17u | lanes[1] >> 47u) ^ (lanes[2] << 31u | lanes[2] >> 33u) ^ (lanes[3] << 47u | lanes[3] >> 17u) ^ count;
+            for (; at < count; ++at) hash = (hash ^ words[at]) * Prime;
+            hash ^= hash >> 33u;
+            hash *= 0xff51afd7ed558ccdull;
+            hash ^= hash >> 33u;
+            hash *= 0xc4ceb9fe1a85ec53ull;
+            hash ^= hash >> 33u;
             return static_cast<std::size_t>(hash);
         }
     };
-    mutable std::mutex mutex;
+    mutable AgcDriver::Mutex mutex;
     std::list<std::pair<Key, std::shared_ptr<ShaderResources>>> entries;
     std::unordered_map<Key, decltype(entries)::iterator, KeyHash> index;
     std::size_t capacity = 0;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/SnapshotCopies.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/SnapshotCopies.hpp
new file mode 100644
index 0000000000..3b0b3b94f4
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/SnapshotCopies.hpp
@@ -0,0 +1,56 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_SNAPSHOTCOPIES_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_SNAPSHOTCOPIES_HPP
+
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <iterator>
+#include <list>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <tuple>
+#include <vector>
+
+namespace AgcDriver::Graphics {
+class Buffer;
+
+namespace Detail {
+struct SnapshotCopies {
+    using Key = std::tuple<std::uint64_t, std::size_t, VkBufferUsageFlags>;
+    static constexpr std::size_t Budget = std::size_t{16} << 20u;
+    static constexpr std::size_t MaxEntries = 1024;
+    AgcDriver::Mutex mutex;
+    VkDevice device = VK_NULL_HANDLE;
+    struct Entry {
+        std::shared_ptr<Buffer> buffer;
+        std::vector<std::byte> bytes;
+        std::list<Key>::iterator recent;
+    };
+    std::map<Key, Entry> entries;
+    std::list<Key> recency;
+    std::size_t bytes = 0;
+
+    void Insert(const Key& key, const std::shared_ptr<Buffer>& buffer, std::span<const std::byte> data) {
+        recency.push_back(key);
+        try {
+            entries.emplace(key, Entry{buffer, {data.begin(), data.end()}, std::prev(recency.end())});
+        } catch (...) {
+            recency.pop_back();
+            throw;
+        }
+        bytes += data.size();
+    }
+
+    void Clear() {
+        entries.clear();
+        recency.clear();
+        bytes = 0;
+    }
+};
+}
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp
index f8b9d16afe..4e7174f582 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp
@@ -67,7 +67,11 @@ struct ColorTarget {
     bool uintExport = false;
     std::uint32_t pipeBankXor = 0;
     std::uint32_t samples = 1;
+    std::uint32_t coverageSamples = 1;
     std::uint32_t dccControl = 0;
+    std::uint64_t fmaskAddress = 0;
+    std::uint32_t fmaskPipeBankXor = 0;
+    std::uint16_t partialWriteMask = 0;
 };
 
 struct DepthTarget {
@@ -95,6 +99,7 @@ struct State {
     std::optional<DepthTarget> depth;
     bool depthTest = false;
     bool depthWrite = false;
+    bool depthCopySource = false;
     VkCompareOp depthCompare = VK_COMPARE_OP_ALWAYS;
     bool depthBoundsTest = false;
     float minDepthBounds = 0.0f;
@@ -140,6 +145,7 @@ struct State {
     bool ditheredAlphaToCoverage = false;
     bool perSampleShading = false;
     bool mergedCoverage = false;
+    bool truncatedCoverage = false;
     VkConservativeRasterizationModeEXT conservativeRasterization = VK_CONSERVATIVE_RASTERIZATION_MODE_DISABLED_EXT;
     VkRect2D scissor;
     VkCullModeFlags cullMode;
@@ -148,20 +154,30 @@ struct State {
     VkProvokingVertexModeEXT provokingVertexMode = VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT;
     VkPipelineColorBlendAttachmentState blend;
     std::array<float, 4> blendConstants;
+    std::uint8_t colorRop = 0xccu;
     std::uint32_t samples = 1;
     std::array<std::uint8_t, 32> sampleLocations{};
     bool customSampleLocations = false;
     bool sampleLocationGrid = false;
     std::uint32_t paClVsOutCntl = 0;
+    bool vertexPoints = false;
+    float pointSize = 1.0f;
+    float pointSizeMin = 0.0f;
+    float pointSizeMax = 0.0f;
     std::array<std::uint16_t, 4> quadSampleMask{0xffffu, 0xffffu, 0xffffu, 0xffffu};
     bool pixelEarlyZ = false;
+    bool pixelKill = false;
 };
 
 // PA_CL_VS_OUT_CNTL bits that place position exports (clip and cull distances, the misc and the two
 // distance vectors); a vertex program that exports pos1..pos3 depends on them.
 inline constexpr std::uint32_t PositionExportLayoutBits = 0xffffu | (1u << 21u) | (1u << 22u) | (1u << 23u);
 
+inline constexpr std::uint8_t CopyRop = 0xccu;
+VkLogicOp LogicOpFromRop(std::uint8_t rop);
+
 ShaderStages DecodeShaderStages(const QueueState& queue, bool vertexWorkgroup = false);
+void ApplyPointSize(const State& state, ShaderRecompiler::ShaderVertexStageInfo& vertex);
 State DecodeState(const QueueState& queue, bool vertexWorkgroup = false);
 void ApplyDepthRemap(const Context& context, State& state);
 void NormalizeUnusedViewportDepth(State& state, const ShaderRecompiler::ShaderPixelStageInfo& pixel);
@@ -178,6 +194,11 @@ bool SampleMaskFollowsOrder(const State& state, const SampleOrder& order);
 std::array<std::uint16_t, 4> QuadSampleMasks(const State& state, const SampleOrder& order);
 std::array<std::uint8_t, 8> ExportMappings(const State& state);
 std::array<ShaderRecompiler::ColorExportPacking, 8> ExportPackings(const State& state);
+std::uint16_t PackedWriteMask(std::uint8_t componentMapping, std::uint32_t exportedMask);
+GuestTextureResource TargetMergeSurface(const ColorTarget& color);
+bool DepthStencilWrites(const State& state);
+bool DepthStencilTests(const State& state);
+ShaderRecompiler::TargetMerge ExportTargetMerge(const State& state);
 ShaderRecompiler::RasterPrimitive RasterPrimitiveOf(const State& state);
 bool PartialSampleMask(const State& state);
 bool UniformSampleMask(const State& state);
@@ -202,9 +223,7 @@ struct ColorMetadataPass {
 };
 std::optional<ColorMetadataPass> DecodeColorMetadataPass(const QueueState& queue);
 struct DepthCopyPass {
-    std::uint64_t depthAddress;
-    VkExtent2D extent;
-    std::uint32_t samples;
+    DepthTarget source;
     std::uint32_t sample;
     ColorTarget color;
 };
@@ -278,7 +297,7 @@ inline constexpr std::array<DrawKeyRange, 50> DrawKeyRegisters{{
     // PA_SU_VTX_CNTL, the sample masks, PA_SC_CONSERVATIVE_RASTERIZATION_CNTL.
     {RegisterBank::Context, 0x200, 8}, {RegisterBank::Context, 0x286, 2}, {RegisterBank::Context, 0x292, 2}, {RegisterBank::Context, 0x29b, 1}, {RegisterBank::Context, 0x2ab, 1}, {RegisterBank::Context, 0x2af, 1}, {RegisterBank::Context, 0x2ce, 1}, {RegisterBank::Context, 0x2d5, 2}, {RegisterBank::Context, 0x2db, 2}, {RegisterBank::Context, 0x2de, 6}, {RegisterBank::Context, 0x2f8, 2}, {RegisterBank::Context, 0x2fe, 16}, {RegisterBank::Context, 0x30e, 2}, {RegisterBank::Context, 0x313, 1},
     // CB_COLOR0..7_BASE .. DCC_BASE (15 words a slot), CB_COLOR0..7_BASE_EXT, DCC_BASE_EXT, ATTRIB2, ATTRIB3.
-    {RegisterBank::Context, 0x318, 0x78}, {RegisterBank::Context, 0x390, 8}, {RegisterBank::Context, 0x398, 8}, {RegisterBank::Context, 0x3a8, 0x18},
+    {RegisterBank::Context, 0x318, 0x78}, {RegisterBank::Context, 0x390, 8}, {RegisterBank::Context, 0x398, 0x10}, {RegisterBank::Context, 0x3a8, 0x18},
     // The pixel program address, RSRC2 and user words; the geometry-back user pointer and program
     // address; the vertex/geometry-front RSRC1/RSRC2 and user words; the vertex program address;
     // the hull user pointer, program address, RSRC2 and user words; the local program address.
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp
index 87a9416e87..0c6aec2abf 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/Texture.hpp
@@ -11,6 +11,7 @@
 #include <atomic>
 #include <chrono>
 #include <cstddef>
+#include <functional>
 #include <map>
 #include <memory>
 #include <mutex>
@@ -47,7 +48,7 @@ struct OwnedImage {
     OwnedImage(const OwnedImage&) = delete;
     OwnedImage& operator=(const OwnedImage&) = delete;
     ~OwnedImage();
-    void Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation);
+    void Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, bool newImage = false);
     Context context;
     VkImage image;
     VkDeviceMemory memory;
@@ -212,12 +213,13 @@ public:
     // any unit was: a reader of the import must sync for a publish as for a store. Only images
     // with a pending unit inside the range are stored (APS5_NO_FLUSH_PRETEST=1 lists every
     // overlapping pending image, as before).
-    static bool FlushPending(std::uint64_t address, std::size_t bytes, const StorageTexture* except = nullptr, const char* reason = "memory access", PublishScope scope = PublishScope::Whole, bool* published = nullptr);
+    static bool FlushPending(std::uint64_t address, std::size_t bytes, const StorageTexture* except = nullptr, const char* reason = "memory access", PublishScope scope = PublishScope::Whole, bool* published = nullptr, bool waited = false);
     static void FlushAllPending(const char* reason);
     static bool WaitForFlushing(std::uint64_t address, std::size_t bytes, const StorageTexture* except = nullptr);
     static void SaveBeforeUnwatch(std::uint64_t address, std::size_t bytes);
     static constexpr std::uint64_t SmallStoreBytes = 64 * 1024;
     static std::size_t StoreSmallPending(const char* reason);
+    static void StoreReadbackBeforeLabel(const char* reason);
     static bool AnyPending();
     static void FlushDumpSelected(const char* reason);
     static bool StoreAtFlipRequested(const char* value);
@@ -229,6 +231,7 @@ public:
     // any of the [begin, end) ranges: one acquisition of the registry's mutex.
     static bool AnyPendingOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges);
     static bool AnyLiveOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges);
+    static std::uint64_t StampKeepingNewerResults(std::uint64_t address, std::size_t bytes, std::uint64_t recorded, const std::function<std::uint64_t()>& stamp);
     // Moves with every change of the pending registry (an image marked dirty, stored, flushed or
     // dropped; after the store for a flush), bumped under the registry's mutex with the change, so
     // a reader that loads it before and after its own reads knows the registry it consulted stayed
@@ -277,7 +280,7 @@ public:
     // FlushPending's publish of the unit shadows over the range without the image stores (what it
     // does when it lists no image, and all an access AccessKeptByCpu approved needs): whether any
     // unit was published.
-    static bool PublishShadowsOnly(std::uint64_t address, std::size_t bytes, PublishScope scope, const char* reason = "memory access");
+    static bool PublishShadowsOnly(std::uint64_t address, std::size_t bytes, PublishScope scope, const char* reason = "memory access", bool waited = false);
     // For the [hooksync] recorded-store line: images a FlushPending stored after a hook skip of
     // theirs (AccessKeptByCpu), of which by the hook for the same read site as the last skip; 10 s deltas.
     struct HookSkipCounts {
@@ -370,6 +373,7 @@ public:
     // Keeps the image current with guest memory (see GuestMemory::CollectWrites).
     bool Refresh();
     bool RefreshLayers(std::uint32_t first, std::uint32_t count);
+    inline static std::atomic<std::uint64_t> epochRefreshes{0};
     static std::uint64_t SinglePassMoves();
     static std::uint64_t SlabRetiles();
     static std::uint64_t RefreshesProved();
@@ -383,6 +387,9 @@ public:
     VkDeviceSize AllocationBytes() const { return memoryBytes; }
 
 private:
+    std::atomic<std::uint64_t> provedEpoch{0};
+    std::atomic<std::uint64_t> provedProof{0};
+    std::atomic<std::uint64_t> provedPending{0};
     StorageTexture(const Context& context, TextureDetiler& detiler, const GuestTextureResource& descriptor, std::uint32_t mipLevel);
     // The regions of every array layer, or of the tracked layers `layers` selects.
     std::vector<VkBufferImageCopy> CopyRegions(const std::vector<bool>* layers = nullptr) const;
@@ -576,6 +583,7 @@ private:
     mutable DccKeys filledKeys = DccKeys::Uncompressed;
     mutable DccKeyProof keyProof;
     mutable DccRangeProof targetKeyProof;
+    DccSingleProof singleProof;
     struct RefreshProof {
         std::uint64_t generation = 0;
         std::uint64_t pendingSerial = 0;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp
index e0dc3531e4..d0b15ac51c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp
@@ -56,7 +56,6 @@ namespace AgcDriver::Graphics {
         void DispatchCmaskClear(VkCommandBuffer commands, VkBuffer cmask, std::uint64_t cmaskOffset, std::size_t cmaskBytes, VkImageView view, std::uint32_t width, std::uint32_t height, std::uint32_t elementBytes, const std::array<std::uint32_t, 2>& clearWords, bool write);
         std::uint32_t CmaskErrors();
         void DispatchMultisampleReadback(VkCommandBuffer commands, VkFormat format, VkBuffer destination, std::uint64_t offset, std::uint64_t bytes, VkImageView arrayView, std::uint32_t width, std::uint32_t height, std::uint32_t layers, std::uint32_t fragments, std::uint32_t firstElement, std::uint32_t elements);
-        void DispatchDepthSample(VkCommandBuffer commands, VkImageView depth, bool multisampled, VkImageView target, std::uint32_t width, std::uint32_t height, std::uint32_t sample);
         void DispatchMultisampleImage(VkCommandBuffer commands, std::uint32_t elementBytes, VkBuffer source, std::uint64_t offset, std::uint64_t bytes, VkImageView arrayView, std::uint32_t width, std::uint32_t height, std::uint32_t layers, std::uint32_t fragments, std::uint32_t firstElement, std::uint32_t elements);
 
     private:
@@ -85,11 +84,6 @@ namespace AgcDriver::Graphics {
         VkPipelineLayout cmaskPipelineLayout = VK_NULL_HANDLE;
         VkPipeline cmaskPipeline = VK_NULL_HANDLE;
         DescriptorRing cmaskDescriptorSets;
-        VkDescriptorSetLayout depthSampleLayout = VK_NULL_HANDLE;
-        VkPipelineLayout depthSamplePipelineLayout = VK_NULL_HANDLE;
-        std::array<VkPipeline, 2> depthSamplePipelines{};
-        VkSampler depthSampler = VK_NULL_HANDLE;
-        DescriptorRing depthSampleSets;
         std::unique_ptr<Buffer> cmaskErrors;
         VkDescriptorSetLayout imageDescriptorLayout = VK_NULL_HANDLE;
         VkPipelineLayout imagePipelineLayout = VK_NULL_HANDLE;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/UnitShadow.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/UnitShadow.hpp
index 4c8124f513..6d69206ae4 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/UnitShadow.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/UnitShadow.hpp
@@ -48,7 +48,7 @@ bool UnitShadowEnabled();
 // byte of the range; PartialUnits: a writer of the range (only units it covers partly are published,
 // so the neighbours' results in the rest of the unit reach the import before the write stamps it).
 enum class PublishScope : std::uint8_t { None, Whole, PartialUnits };
-enum class PublishReason : std::uint8_t { Hook, Region, Indirect, CopySource, CopyDestination, Fill, FillClear, Label, Keys, Scanout, Validate, Upload, TailMip, Evict, Retire, Teardown, Count };
+enum class PublishReason : std::uint8_t { Hook, Region, Indirect, CopySource, CopyDestination, Fill, FillClear, Label, Keys, Scanout, Validate, Upload, TailMip, Evict, Retire, Teardown, Address, Count };
 // The reason for a FlushPending reason string ("memory access" -> Hook, ...).
 PublishReason PublishReasonFor(const char* flushReason);
 
@@ -90,7 +90,7 @@ struct ShadowedRange {
 // published, clears stale ones. Returns the units copied. Inside a completion action a store's
 // publish records nothing (the store's own stamp makes the unit stale; a recorded publish would land
 // over the store later).
-std::size_t PublishShadow(std::uint64_t address, std::size_t bytes, PublishScope scope, PublishReason reason);
+std::size_t PublishShadow(std::uint64_t address, std::size_t bytes, PublishScope scope, PublishReason reason, bool waited = false);
 // No GpuMutex, no tracker: conservative (a unit with a generation and no publish counts), for
 // hook-free readers and a build's stage A.
 bool AnyShadowedOverlaps(std::uint64_t address, std::size_t bytes);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp
index aad386bfc1..85f0dbd804 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp
@@ -8,6 +8,7 @@
 #include <mutex>
 #include <unordered_map>
 #include <cstring>
+#include <cstdio>
 #include <limits>
 #include <optional>
 #include <set>
@@ -29,13 +30,13 @@ inline bool NullVertexDescriptor(const ShaderRecompiler::VertexAttribute& attrib
     return fields[0] == 0 && fields[1] == 0 && fields[2] == 0 && fields[3] == 0;
 }
 
-inline VertexFormat DecodeVertexFormat(const ShaderRecompiler::VertexAttribute& attribute) {
+inline VertexFormat DecodeVertexFormat(const ShaderRecompiler::VertexAttribute& attribute, std::uint32_t minimumComponents = 0u) {
     Require(attribute.components >= 1 && attribute.components <= 4, "invalid vertex attribute component count");
     if (NullVertexDescriptor(attribute)) {
         const std::array formats{VK_FORMAT_R32_SFLOAT, VK_FORMAT_R32G32_SFLOAT, VK_FORMAT_R32G32B32_SFLOAT, VK_FORMAT_R32G32B32A32_SFLOAT};
         return {formats[attribute.components - 1], attribute.components * 4u, 4u, "f32"};
     }
-    const auto components = attribute.formatComponents == 0u ? attribute.components : attribute.formatComponents;
+    const auto components = std::max(attribute.formatComponents == 0u ? attribute.components : attribute.formatComponents, minimumComponents);
     Require(components >= 1u && components <= 4u, "invalid vertex format component count");
     const auto format = (attribute.resource.fields[3] >> 12u) & 0x7fu;
     switch (format) {
@@ -106,11 +107,27 @@ inline std::string VertexAttributeSignature(const ShaderRecompiler::VertexAttrib
     return std::string(format.scalar) + (attribute.components == 1 ? "" : "x" + std::to_string(attribute.components));
 }
 
+inline std::uint32_t VertexReadBytes(const ShaderRecompiler::VertexAttribute& attribute, VkFormat host) {
+    for (auto components = 1u; components <= 4u; ++components) {
+        const auto format = DecodeVertexFormat(attribute, components);
+        if (format.format == host) return format.bytes;
+    }
+    throw std::runtime_error("AGC graphics: vertex format " + std::to_string(host) + " is not a form of the attribute's buffer format");
+}
+
 struct VertexInputLayout {
     std::vector<VkVertexInputBindingDescription> bindings;
     std::vector<VkVertexInputAttributeDescription> attributes;
 };
 
+inline std::array<char, 160> VertexDescriptorFlagsMessage(const ShaderRecompiler::VertexAttribute& attribute) {
+    std::array<char, 160> message{};
+    const auto& fields = attribute.resource.fields;
+    std::snprintf(message.data(), message.size(), "unsupported vertex buffer descriptor flags at location %u (V#=[%08x %08x %08x %08x])",
+        attribute.location, fields[0], fields[1], fields[2], fields[3]);
+    return message;
+}
+
 inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::span<const ShaderRecompiler::VertexAttribute> attributes) {
     Require(attributes.size() <= context.limits.maxVertexInputBindings && attributes.size() <= context.limits.maxVertexInputAttributes, "vertex input count exceeds device limits");
     VertexInputLayout result;
@@ -120,18 +137,29 @@ inline VertexInputLayout BuildVertexInputLayout(const Context& context, std::spa
         const auto format = DecodeVertexFormat(attribute);
         Require(attribute.location < context.limits.maxVertexInputAttributes && locations.insert(attribute.location).second, "invalid or duplicate vertex attribute location");
         Require(attribute.fetchIndex <= 1, "unsupported vertex fetch index");
-        Require((fields[1] & 0x80000000u) == 0 && (fields[3] & 0x00800000u) == 0 && (fields[3] >> 30u) == 0, "unsupported vertex buffer descriptor flags");
+        if ((fields[1] & 0x80000000u) != 0 || (fields[3] & 0x00800000u) != 0 || (fields[3] >> 30u) != 0) {
+            Require(false, VertexDescriptorFlagsMessage(attribute).data());
+        }
         const auto stride = (fields[1] >> 16u) & 0x3fffu;
         const auto address = fields[0] | (static_cast<std::uint64_t>(fields[1] & 0xffffu) << 32u);
         Require(NullVertexDescriptor(attribute) || (address != 0 && address % format.alignment == 0 && stride % format.alignment == 0), "unaligned vertex buffer");
         Require(stride <= context.limits.maxVertexInputBindingStride, "vertex stride exceeds device limits");
         Require(context.formatProperties != nullptr, "missing vertex format property query");
-        VkFormatProperties properties{};
-        context.formatProperties(context.physical, format.format, &properties);
-        Require((properties.bufferFeatures & VK_FORMAT_FEATURE_VERTEX_BUFFER_BIT) != 0, "device does not support vertex format " + std::to_string(format.format));
+        const auto supported = [&](VkFormat candidate) {
+            VkFormatProperties properties{};
+            context.formatProperties(context.physical, candidate, &properties);
+            return (properties.bufferFeatures & VK_FORMAT_FEATURE_VERTEX_BUFFER_BIT) != 0;
+        };
+        auto host = format.format;
+        auto hostSupported = supported(host);
+        for (auto components = 1u; !hostSupported && components <= 4u; ++components) {
+            host = DecodeVertexFormat(attribute, components).format;
+            hostSupported = supported(host);
+        }
+        Require(hostSupported, "device does not support vertex format " + std::to_string(format.format));
         const auto binding = static_cast<std::uint32_t>(result.bindings.size());
         result.bindings.push_back({binding, stride, attribute.fetchIndex == 0 ? VK_VERTEX_INPUT_RATE_VERTEX : VK_VERTEX_INPUT_RATE_INSTANCE});
-        result.attributes.push_back({attribute.location, binding, format.format, 0});
+        result.attributes.push_back({attribute.location, binding, host, 0});
     }
     return result;
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/shaders/DepthSample.comp b/core/libs/prx/libSceAgcDriver/Graphics/shaders/DepthSample.comp
deleted file mode 100644
index 36f1883556..0000000000
--- a/core/libs/prx/libSceAgcDriver/Graphics/shaders/DepthSample.comp
+++ /dev/null
@@ -1,27 +0,0 @@
-#version 450
-
-layout(local_size_x = 8, local_size_y = 8) in;
-
-#if MULTISAMPLED
-layout(set = 0, binding = 0) uniform sampler2DMS depth;
-#else
-layout(set = 0, binding = 0) uniform sampler2D depth;
-#endif
-layout(set = 0, binding = 1, r32f) writeonly uniform image2D target;
-
-layout(push_constant) uniform Push {
-    uint width;
-    uint height;
-    int sampleIndex;
-} push;
-
-void main() {
-    uvec2 pixel = gl_GlobalInvocationID.xy;
-    if (pixel.x >= push.width || pixel.y >= push.height) return;
-#if MULTISAMPLED
-    float value = texelFetch(depth, ivec2(pixel), push.sampleIndex).r;
-#else
-    float value = texelFetch(depth, ivec2(pixel), 0).r;
-#endif
-    imageStore(target, ivec2(pixel), vec4(value, 0.0, 0.0, 0.0));
-}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/shaders/FirstSample.frag b/core/libs/prx/libSceAgcDriver/Graphics/shaders/FirstSample.frag
new file mode 100644
index 0000000000..287527d25a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/shaders/FirstSample.frag
@@ -0,0 +1,16 @@
+#version 450
+
+#if defined(UINT_SAMPLES)
+layout(set = 0, binding = 0) uniform usampler2DMS source;
+layout(location = 0) out uvec4 color;
+#elif defined(SINT_SAMPLES)
+layout(set = 0, binding = 0) uniform isampler2DMS source;
+layout(location = 0) out ivec4 color;
+#else
+layout(set = 0, binding = 0) uniform sampler2DMS source;
+layout(location = 0) out vec4 color;
+#endif
+
+void main() {
+    color = texelFetch(source, ivec2(gl_FragCoord.xy), 0);
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp
index 1da043f87f..aa267a27f6 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceAgcDriver/Graphics/include/BdaResources.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "ImageTableAbi.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include <algorithm>
@@ -43,7 +44,7 @@ struct TableEntry {
 };
 
 struct TableCache {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     VkDevice device = VK_NULL_HANDLE;
     std::list<TableEntry> entries;
     std::uint64_t hits = 0;
@@ -282,6 +283,10 @@ void BdaResources::CheckFault() const {
         message << "shader stage " << report.stage << " called address 0x" << std::hex << report.address << " at program counter 0x" << report.instruction << ", which no linked callee of that call matches";
         throw std::runtime_error(message.str());
     }
+    if (report.reason == ShaderRecompiler::BdaAbi::FaultReason::WindowLaneSpill) {
+        message << "shader stage " << report.stage << ": a relative write stored " << report.bytes << " in lane " << (report.address >> 32u) << " of vector window slot " << (report.address & 0xffffffffu) << ", which holds a scalar spilled with v_writelane_b32 that a later v_readlane_b32 was replaced with";
+        throw std::runtime_error(message.str());
+    }
     message << "BDA access failed: address=0x" << std::hex << report.address << " instruction=0x" << report.instruction << std::dec << " bytes=" << report.bytes << " stage=" << report.stage << " reason=" << static_cast<std::uint32_t>(report.reason);
     if (report.reason == ShaderRecompiler::BdaAbi::FaultReason::Permission && table != nullptr) {
         const auto bytes = table->Bytes();
@@ -347,7 +352,7 @@ void BdaResources::markWrittenPages() const {
                 Require(false, message.str());
             }
         }
-        GuestMemory::MarkWritten(begin, bytes);
+        GuestMemory::MarkPossiblyWritten(begin, bytes);
     }), "invalid BDA written-page record");
     for (std::uint32_t claim = 0; claim < count; ++claim) {
         const auto slot = words[Abi::WrittenListWord + claim];
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp
index 128970a898..9b22e6a5b5 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp
@@ -57,7 +57,7 @@ BufferPool::~BufferPool() {
     for (auto& [memory, block] : slabBlocks) freeBlock(*block);
 }
 
-VkDeviceMemory BufferPool::AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType) {
+VkDeviceMemory BufferPool::AllocateMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType, bool newImage) {
     if (allocatedType != nullptr) *allocatedType = allocation.memoryTypeIndex;
     VkDeviceMemory memory = VK_NULL_HANDLE;
     auto result = allocateMemory(device, &allocation, nullptr, &memory);
@@ -75,7 +75,7 @@ VkDeviceMemory BufferPool::AllocateMemory(const VkMemoryAllocateInfo& allocation
         }
     }
     if (exhausted(result)) {
-        if (cacheReclaim != nullptr) released = cacheReclaim(ReclaimTarget(allocation.allocationSize));
+        if (cacheReclaim != nullptr) released = cacheReclaim(ReclaimTarget(allocation.allocationSize), newImage);
         if (released != 0) {
             reclaimed += trim();
             memory = VK_NULL_HANDLE;
@@ -146,7 +146,7 @@ bool BufferPool::heapOverBudget() {
     return heapOver;
 }
 
-VkDeviceMemory BufferPool::TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType) {
+VkDeviceMemory BufferPool::TakeImageMemory(const VkMemoryAllocateInfo& allocation, const char* operation, std::optional<std::uint32_t> hostType, std::uint32_t* allocatedType, bool newImage) {
     const auto type = allocation.memoryTypeIndex;
     if (imagePooled(allocation.allocationSize, type)) {
         std::lock_guard lock(mutex);
@@ -168,7 +168,7 @@ VkDeviceMemory BufferPool::TakeImageMemory(const VkMemoryAllocateInfo& allocatio
         }
         ++imageMisses;
     }
-    return AllocateMemory(allocation, operation, hostType, allocatedType);
+    return AllocateMemory(allocation, operation, hostType, allocatedType, newImage);
 }
 
 void BufferPool::PutImageMemory(VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept {
@@ -217,7 +217,9 @@ std::size_t BufferPool::RetainedImages() {
 }
 
 VkDeviceSize BufferPool::ReclaimTarget(VkDeviceSize bytes) {
-    return bytes + std::max<VkDeviceSize>(bytes, VkDeviceSize{256} << 20u);
+    const auto reserve = std::max<VkDeviceSize>(bytes, VkDeviceSize{256} << 20u);
+    const auto limit = std::numeric_limits<VkDeviceSize>::max();
+    return bytes > limit - reserve ? limit : bytes + reserve;
 }
 
 bool BufferPool::SlabEligible(std::size_t capacity, VkDeviceSize alignment, VkDeviceSize size, VkDeviceSize atom) {
@@ -454,6 +456,56 @@ bool BufferPool::evictOldestImage(std::vector<BufferAllocation>& evicted) {
     return true;
 }
 
+VkDeviceSize BufferPool::ReclaimIdleDevice(VkDeviceSize bytes, std::chrono::steady_clock::time_point now) {
+    if (bytes == 0) return 0;
+    const auto heaps = std::min<std::uint32_t>(memoryProperties.memoryHeapCount, VK_MAX_MEMORY_HEAPS);
+    if (std::count_if(memoryProperties.memoryHeaps, memoryProperties.memoryHeaps + heaps, [](const auto& heap) { return (heap.flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) != 0; }) != 1) return 0;
+    std::vector<BufferAllocation> evicted;
+    {
+        std::lock_guard lock(mutex);
+        if (!idleRead) {
+            idleRead = now;
+            idleClock = clock;
+            return 0;
+        }
+        if (now < *idleRead) return 0;
+        if (now - *idleRead >= std::chrono::seconds(1)) {
+            reclaimBefore = idleClock;
+            idleClock = clock;
+            idleRead = now;
+        }
+        if (reclaimBefore <= scannedIdleClock) return 0;
+        VkDeviceSize selected = 0;
+        while (selected < bytes) {
+            auto oldest = deviceTier.free.end();
+            for (auto it = deviceTier.free.begin(); it != deviceTier.free.end(); ++it) {
+                if (it->second.empty()) continue;
+                const auto& slot = it->second.front();
+                if (slot.allocation.buffer == VK_NULL_HANDLE || slot.allocation.slab || slot.lastUse > reclaimBefore) continue;
+                if (oldest == deviceTier.free.end() || slot.lastUse < oldest->second.front().lastUse) oldest = it;
+            }
+            if (oldest == deviceTier.free.end()) {
+                scannedIdleClock = reclaimBefore;
+                break;
+            }
+            if (evicted.empty()) evicted.reserve(deviceTier.slots);
+            const auto allocation = oldest->second.front().allocation;
+            evicted.push_back(allocation);
+            selected += allocation.allocationBytes;
+            deviceTier.retainedBytes -= allocation.allocationBytes;
+            oldest->second.pop_front();
+            if (oldest->second.empty()) deviceTier.free.erase(oldest);
+            --deviceTier.slots;
+            ++deviceTier.evictions;
+        }
+    }
+    VkDeviceSize released = 0;
+    for (const auto& allocation : evicted) released += destroy(allocation);
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (profile && released != 0) AgcDriver::ProfilePrint_nid_no_patch("[bufferpool] idle device reclaim: %llu bytes released for %llu bytes of storage-cache pressure\n", static_cast<unsigned long long>(released), static_cast<unsigned long long>(bytes));
+    return released;
+}
+
 std::size_t BufferPool::MaxSlots() {
     // APS5_BUFFER_POOL_SLOTS=<n> bounds the retained allocations; 64 is the capacity the pool had
     // before least-recently-used retention, for A/B runs.
@@ -533,8 +585,8 @@ std::shared_ptr<BufferPool> GetBufferPool(const Context& context) {
     return context.bufferPool;
 }
 
-VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType) {
-    return GetBufferPool(context)->TakeImageMemory(allocation, operation, context.RefusedDeviceMemoryFallback(mask, allocation.memoryTypeIndex), allocatedType);
+VkDeviceMemory AllocateImageMemory(const Context& context, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, std::uint32_t* allocatedType, bool newImage) {
+    return GetBufferPool(context)->TakeImageMemory(allocation, operation, context.RefusedDeviceMemoryFallback(mask, allocation.memoryTypeIndex), allocatedType, newImage);
 }
 
 void ReleaseImageMemory(const Context& context, VkDeviceMemory memory, VkDeviceSize bytes, std::uint32_t memoryType) noexcept {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp
index eee078cba1..963da7f4ef 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp
@@ -5,6 +5,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/UnitShadow.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <algorithm>
 #include <atomic>
 #include <chrono>
@@ -57,10 +58,6 @@ DccKeys ByteKeys(std::uint8_t key) {
     }
 }
 
-bool SingleKeysReadable(const GuestTextureResource& resource) {
-    return KeyBytes % BytesPerElement(resource.format) == 0;
-}
-
 void ExpandSingleBlocks(std::span<std::byte> bytes, std::size_t elementBytes) {
     for (std::size_t block = 0; block < bytes.size(); block += KeyBytes) {
         const auto blockBytes = std::min<std::size_t>(KeyBytes, bytes.size() - block);
@@ -162,7 +159,7 @@ struct GpuKeyStore {
 };
 
 struct KeyStoreMemo {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::vector<GpuKeyStore> entries;
     const Recorder* recorder = nullptr;
 };
@@ -527,7 +524,7 @@ DccKeys textureClearKeys(const GuestTextureResource& resource, std::uint64_t gue
     if (IsConvertedTextureFormat(resource.format) && (keys == DccKeys::Clear0001 || keys == DccKeys::Clear1110)) throw std::runtime_error(std::string("AGC graphics: DCC clear code ") + DccKeysName(keys) + " of converted texture format " + std::to_string(resource.format) + " is not implemented");
     std::byte probe[16]{};
     if (!IsDccClear(keys) || !FillDccClear(ResolveTextureFormat(resource.format), keys, resource.dccAlphaOnMsb, std::span(probe, std::min<std::size_t>(sizeof(probe), BytesPerElement(resource.format))))) {
-        static std::mutex reportedMutex;
+        static AgcDriver::Mutex reportedMutex;
         static std::set<std::pair<std::uint64_t, int>> reported;
         std::lock_guard lock(reportedMutex);
         if (reported.size() < 32 && reported.insert({resource.baseAddress, static_cast<int>(keys)}).second) std::fprintf(stderr, "[gpu] texture 0x%llx (format %u) has %s DCC keys at 0x%llx; its texels are read as stored\n", static_cast<unsigned long long>(resource.baseAddress), resource.format, DccKeysName(keys), static_cast<unsigned long long>(resource.dccAddress));
@@ -668,7 +665,10 @@ bool FillDccClear(VkFormat format, DccKeys keys, bool alphaOnMsb, std::span<std:
         return true;
     }
     Layout layout{};
-    if (!IsDccClear(keys) || keys == DccKeys::ClearRegister || !LayoutFor(format, layout)) return false;
+    if (!IsDccClear(keys) || keys == DccKeys::ClearRegister || !LayoutFor(format, layout)) {
+        std::fill(bytes.begin(), bytes.end(), std::byte{0});
+        return false;
+    }
     const bool color = keys == DccKeys::Clear1110 || keys == DccKeys::Clear1111;
     const bool alpha = keys == DccKeys::Clear0001 || keys == DccKeys::Clear1111;
     const int alphaChannel = layout.channels == 3 ? -1 : alphaOnMsb ? static_cast<int>(layout.channels) - 1 : 0;
@@ -683,7 +683,9 @@ bool FillDccClear(VkFormat format, DccKeys keys, bool alphaOnMsb, std::span<std:
             if (((value >> i) & 1u) != 0) element[bit / 8u] |= static_cast<std::byte>(1u << (bit % 8u));
         }
     }
-    for (std::size_t offset = 0; offset + element.size() <= bytes.size(); offset += element.size()) std::memcpy(bytes.data() + offset, element.data(), element.size());
+    std::size_t offset = 0;
+    for (; offset + element.size() <= bytes.size(); offset += element.size()) std::memcpy(bytes.data() + offset, element.data(), element.size());
+    std::fill(bytes.begin() + offset, bytes.end(), std::byte{0});
     return true;
 }
 
@@ -778,6 +780,44 @@ void ReadTextureSurface(const GuestTextureResource& resource, DccKeys keys, std:
     if (keys == DccKeys::ClearSingle) ExpandSingleBlocks(bytes, BytesPerElement(resource.format));
 }
 
+bool SingleKeysReadable(const GuestTextureResource& resource) {
+    return KeyBytes % BytesPerElement(resource.format) == 0;
+}
+
+bool ReadSingleElement(const GuestTextureResource& resource, std::span<std::byte> element) {
+    if (!SingleKeysReadable(resource)) return false;
+    const auto bytes = BytesPerElement(resource.format);
+    if (element.size() < bytes) return false;
+    const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::TextureRead);
+    GuestMemory::ReadCommitted(resource.baseAddress, element.subspan(0, bytes));
+    return true;
+}
+
+bool ProvedSingleUniform(const GuestTextureResource& resource, std::uint64_t guestBytes, std::uint64_t collected, DccSingleProof& proof) {
+    if (!SingleKeysReadable(resource) || guestBytes < KeyBytes) return false;
+    const auto bytes = BytesPerElement(resource.format);
+    if (bytes == 0 || bytes > 16) return false;
+    const auto blocks = static_cast<std::size_t>(guestBytes / KeyBytes);
+    if (proof.generation != 0 && proof.address == resource.baseAddress && proof.bytes == guestBytes && proof.format == resource.format && collected != 0 && GuestMemory::UnchangedSince(resource.baseAddress, static_cast<std::size_t>(guestBytes), proof.generation)) return proof.uniform;
+    std::byte first[16]{};
+    bool uniform = true;
+    std::vector<std::byte> buffer(std::min<std::uint64_t>(guestBytes, std::uint64_t(1) << 20));
+    {
+        const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::TextureRead);
+        GuestMemory::ReadCommitted(resource.baseAddress, std::span(first, bytes));
+        for (std::size_t block = 1; block < blocks && uniform;) {
+            const auto offset = block * KeyBytes;
+            const auto size = static_cast<std::size_t>(std::min<std::uint64_t>(buffer.size(), guestBytes - offset));
+            GuestMemory::ReadCommitted(resource.baseAddress + offset, std::span(buffer).first(size));
+            const auto covered = size / KeyBytes;
+            for (std::size_t index = 0; index < covered && uniform; ++index) uniform = std::equal(first, first + bytes, buffer.begin() + index * KeyBytes);
+            block += covered;
+        }
+    }
+    proof = collected != 0 ? DccSingleProof{resource.baseAddress, guestBytes, collected, resource.format, uniform} : DccSingleProof{};
+    return uniform;
+}
+
 namespace {
 
 DccKeys EncodedKeys(const GuestTextureResource& resource, DccKeys keys) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
index 9090b5952b..7273cb82e3 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
@@ -10,6 +10,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include <algorithm>
 #include <array>
@@ -58,6 +59,7 @@ struct DepthGuard {
     std::size_t bytes;
     std::shared_ptr<std::atomic<bool>> active;
     std::vector<GuestMemory::UnchangedQuery> live;
+    std::shared_ptr<std::atomic<bool>> hostWritten;
 };
 
 std::shared_mutex& depthGuardMutex() {
@@ -338,6 +340,7 @@ public:
         const auto clearLease = clearGeneration == 0u ? GuestAllocations::Lease{} : GuestAllocations::GuestAllocationsAcquireAll_nid_postfix();
         Require(active->load(std::memory_order_acquire), "the native multisample depth owner was released");
         Require(sampling.refusal.empty(), sampling.refusal);
+        Require(!clearPending, "native multisample depth clear has not been recorded");
         for (const auto& range : sampling.initial) {
             Require(GuestMemory::Accessible(reinterpret_cast<const void*>(range.address), range.bytes) && GuestMemory::Watched(range.address, range.bytes), "native multisample depth requires watched accessible guest memory");
             if (const auto* recorder = RecorderFor(context)) Require(!recorder->PendingWriteOverlaps(range.address, range.bytes), "external GPU writes over native multisample depth are not implemented");
@@ -424,8 +427,8 @@ public:
         return (ResolveTextureFormat(resource.format) == expected || depthBits || UnormStencilView(resource)) && oneSlice && resource.width == target.extent.width && resource.height == target.extent.height && resource.baseLevel == 0 && resource.lastLevel == 0 && resource.baseArray == 0;
     }
 
-    std::shared_ptr<Texture> Sampled(std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, bool drawn = false, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D) {
-        CheckCurrent();
+    std::shared_ptr<Texture> Sampled(std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, bool drawn = false, VkImageViewType multisampleViewType = VK_IMAGE_VIEW_TYPE_2D, bool copySource = false) {
+        if (!copySource) CheckCurrent();
         CheckResource(resource);
         std::array<std::uint32_t, 13> key{};
         std::copy_n(words.begin(), std::min<std::size_t>(words.size(), 8), key.begin());
@@ -465,7 +468,7 @@ public:
         const auto sampledImage = useSampleShadow ? sampleShadow : owned;
         auto texture = std::make_shared<Texture>(context, useSampleShadow ? sampleShadow->image : image, hostFormat, stencil ? VK_IMAGE_ASPECT_STENCIL_BIT : VK_IMAGE_ASPECT_DEPTH_BIT, components, viewType, 0, sampledImage);
         if (multisampled) {
-            Require(samplingActive, "native multisample depth sampling requires its creation-time owner");
+            Require(copySource || samplingActive, "native multisample depth sampling requires its creation-time owner");
             texture->MarkRefreshedPerUse();
         }
         textures.emplace(key, texture);
@@ -491,6 +494,7 @@ public:
 
     void CopyAspectFrom(const DepthSurface& source, VkImageAspectFlagBits aspect) {
         ForgetClear(aspect);
+        NoteHostWrite();
         auto* recorder = RecorderFor(context);
         std::unique_ptr<CommandBatch> batch;
         if (recorder == nullptr) batch = std::make_unique<CommandBatch>(context);
@@ -507,30 +511,6 @@ public:
         else Recorder::CountBarriers(Recorder::CommandClass::Draw, 2);
     }
 
-    void CopySample(std::uint32_t sample, StorageTexture& destination, VkImageView destinationView) {
-        auto* recorder = Recorder::Active();
-        Require(recorder != nullptr, "depth sample copies need an active recorder");
-        Require(sampleable, "DB depth copy from a depth surface the device cannot sample at its sample count");
-        ApplyFastClear();
-        if (useSampleShadow) {
-            if (sampleShadow == nullptr) createSampleShadow();
-            refreshSampleShadow(false);
-            recorder->Keep(sampleShadow);
-        }
-        if (depthView == VK_NULL_HANDLE) {
-            VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
-            viewInfo.image = useSampleShadow ? sampleShadow->image : image;
-            viewInfo.viewType = VK_IMAGE_VIEW_TYPE_2D;
-            viewInfo.format = hostFormat;
-            viewInfo.subresourceRange = {VK_IMAGE_ASPECT_DEPTH_BIT, 0, 1, 0, 1};
-            Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &depthView), "vkCreateImageView depth sample copy");
-        }
-        Require(context.detiler != nullptr, "depth sample copies need the texture detiler");
-        context.detiler->DispatchDepthSample(recorder->Commands(), depthView, target.samples > 1, destinationView, target.extent.width, target.extent.height, sample);
-        Recorder::CountBarriers(Recorder::CommandClass::Copy, 2);
-        destination.MarkDirty();
-    }
-
     bool Holds(const Texture* texture) const {
         const auto held = [&](const auto& entry) { return entry.second.get() == texture; };
         return std::any_of(textures.begin(), textures.end(), held) || std::any_of(stencilCopy.textures.begin(), stencilCopy.textures.end(), held);
@@ -540,7 +520,12 @@ public:
         return std::any_of(textures.begin(), textures.end(), [](const auto& entry) { return entry.second.use_count() > 1; });
     }
 
+    void NoteHostWrite() {
+        hostWritten->store(true, std::memory_order_release);
+    }
+
     std::uint64_t written = ++depthWrites;
+    std::shared_ptr<std::atomic<bool>> hostWritten = std::make_shared<std::atomic<bool>>(false);
     bool retired = false;
 
     bool Overlaps(std::uint64_t address, std::uint64_t bytes) const {
@@ -690,6 +675,7 @@ public:
             if (plane.storage.get() == &candidate) {
                 if (stencil || !StoreOverwrite(candidate)) copyPlane(plane, plane.storage, stencil, false);
                 written = ++depthWrites;
+                NoteHostWrite();
                 return true;
             }
             if (std::none_of(plane.replaced.begin(), plane.replaced.end(), [&](const auto& old) { return old.lock().get() == &candidate; })) continue;
@@ -707,6 +693,7 @@ public:
             const auto source = std::const_pointer_cast<StorageTexture>(candidate.shared_from_this());
             copyPlane(plane, source, stencil, false);
             written = ++depthWrites;
+            NoteHostWrite();
             return true;
         }
         return false;
@@ -904,13 +891,14 @@ public:
     const VkFormat hostFormat;
     VkImage image = VK_NULL_HANDLE;
     VkImageView view = VK_NULL_HANDLE;
-    VkImageView depthView = VK_NULL_HANDLE;
     VkDeviceMemory memory = VK_NULL_HANDLE;
     std::shared_ptr<std::atomic<bool>> active = std::make_shared<std::atomic<bool>>(true);
     bool sampleable = true;
     bool samplingActive = false;
     DepthSamplingState sampling;
+    bool clearPending = false;
     std::uint64_t clearGeneration = 0u;
+    bool clearCompletionQueued = false;
     std::shared_ptr<OwnedImage> owned;
     std::shared_ptr<OwnedImage> sampleShadow;
     bool useSampleShadow = false;
@@ -1162,7 +1150,6 @@ private:
         releaseStencilCopy();
         mirrorPlane = {};
         textures.clear();
-        if (depthView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, depthView, nullptr);
         if (view) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, view, nullptr);
         if (owned != nullptr) owned.reset();
         else {
@@ -1205,8 +1192,8 @@ public:
             allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
             memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth plane copy");
             Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory depth plane copy");
-            stagingSize = static_cast<std::size_t>(sliceBytes()) * layers;
-            staging = std::make_unique<DeviceBuffer>(context, stagingSize, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+            imageBytes = requirements.size;
+            owned = std::make_shared<OwnedImage>(context, image, memory);
         } catch (...) {
             release();
             throw;
@@ -1225,12 +1212,7 @@ public:
             std::snprintf(text, sizeof(text), "AGC graphics: depth plane copy geometry does not match its layers (copy %ux%u, %u layers, %llu bytes a slice; texture %ux%u guest format %u, dimension %d, tile mode %u, %u layers, %llu bytes a slice, %zu mips)", extent.width, extent.height, layers, static_cast<unsigned long long>(sliceBytes()), resource.width, resource.height, resource.format, static_cast<int>(resource.dimension), resource.tileMode, geometry.layers, static_cast<unsigned long long>(geometry.sliceLinearBytes), geometry.mips.size());
             throw std::runtime_error(text);
         }
-        const auto stagingBytes = static_cast<std::size_t>(geometry.sliceLinearBytes) * layers;
-        if (stagingBytes > stagingSize) {
-            retiredStaging.push_back(std::move(staging));
-            staging = std::make_unique<DeviceBuffer>(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
-            stagingSize = stagingBytes;
-        }
+        const auto stagingBytes = std::max<std::size_t>(static_cast<std::size_t>(geometry.sliceLinearBytes), static_cast<std::size_t>(sliceBytes())) * layers;
         std::vector<std::shared_ptr<Buffer>> uploads;
         std::vector<std::uint32_t> uploadLayers;
         std::vector<std::uint32_t> copiedLayers;
@@ -1256,11 +1238,14 @@ public:
             uploadLayers.push_back(layer);
             held = current;
         }
-        if (!copiedLayers.empty() || !uploads.empty()) record(slices, resource, geometry, copiedLayers, uploads, uploadLayers);
+        if (!copiedLayers.empty() || !uploads.empty()) {
+            if (staging == nullptr || stagingBytes > staging->Size()) staging = std::make_shared<DeviceBuffer>(context, stagingBytes, VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+            record(slices, resource, geometry, copiedLayers, uploads, uploadLayers, staging);
+        }
         const std::array<std::uint32_t, 6> key{static_cast<std::uint32_t>(components.r), static_cast<std::uint32_t>(components.g), static_cast<std::uint32_t>(components.b), static_cast<std::uint32_t>(components.a), static_cast<std::uint32_t>(viewType), baseLayer};
         auto& texture = textures[key];
         if (texture == nullptr) {
-            texture = std::make_shared<Texture>(context, image, format, aspect(), components, viewType, baseLayer);
+            texture = std::make_shared<Texture>(context, image, format, aspect(), components, viewType, baseLayer, owned);
             texture->MarkRefreshedPerUse();
         }
         return texture;
@@ -1270,6 +1255,9 @@ public:
     const VkExtent2D extent;
     const VkFormat format;
     const std::uint32_t layers;
+    VkDeviceSize imageBytes = 0;
+    std::uint64_t lastUse = 0;
+    VkDeviceSize HeldBytes() const { return imageBytes + (staging != nullptr ? staging->Size() : 0u); }
 
 private:
     struct GuestLayer {
@@ -1282,15 +1270,14 @@ private:
 
     VkImage image = VK_NULL_HANDLE;
     VkDeviceMemory memory = VK_NULL_HANDLE;
-    std::unique_ptr<DeviceBuffer> staging;
-    std::size_t stagingSize = 0;
-    std::vector<std::unique_ptr<DeviceBuffer>> retiredStaging;
+    std::shared_ptr<OwnedImage> owned;
+    std::shared_ptr<DeviceBuffer> staging;
     std::map<std::array<std::uint32_t, 6>, std::shared_ptr<Texture>> textures;
     std::vector<GuestLayer> guestLayers;
     std::vector<DepthPlaneSlice> surfaceLayers;
     bool filled = false;
 
-    void record(std::span<const DepthPlaneSlice> slices, const GuestTextureResource& resource, const SurfaceGeometry& geometry, std::span<const std::uint32_t> copiedLayers, std::span<const std::shared_ptr<Buffer>> uploads, std::span<const std::uint32_t> uploadLayers) {
+    void record(std::span<const DepthPlaneSlice> slices, const GuestTextureResource& resource, const SurfaceGeometry& geometry, std::span<const std::uint32_t> copiedLayers, std::span<const std::shared_ptr<Buffer>> uploads, std::span<const std::uint32_t> uploadLayers, const std::shared_ptr<DeviceBuffer>& staging) {
         if (!uploads.empty()) {
             Require(context.detiler != nullptr, "depth plane copy requires a texture detiler");
             context.detiler->BeginBatch();
@@ -1347,7 +1334,11 @@ private:
         barrier(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral);
         filled = true;
         if (batch) batch->SubmitAndWait();
-        else Recorder::CountBarriers(Recorder::CommandClass::Draw, 3);
+        else {
+            Recorder::CountBarriers(Recorder::CommandClass::Draw, 3);
+            recorder->Keep(staging, staging->Size());
+            if (owned != nullptr) recorder->Keep(owned);
+        }
     }
 
     VkDeviceSize sliceBytes() const {
@@ -1361,8 +1352,11 @@ private:
     void release() noexcept {
         textures.clear();
         staging.reset();
-        if (image) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, image, nullptr);
-        if (memory) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+        if (owned != nullptr) owned.reset();
+        else {
+            if (image) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, image, nullptr);
+            if (memory) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+        }
         image = VK_NULL_HANDLE;
         memory = VK_NULL_HANDLE;
     }
@@ -1373,6 +1367,32 @@ std::map<std::tuple<VkDevice, std::uint64_t, std::uint32_t, std::uint32_t, VkFor
     return *copies;
 }
 
+std::uint64_t& planeCopyClock() {
+    static std::uint64_t clock = 0;
+    return clock;
+}
+
+void evictPlaneCopies(const std::tuple<VkDevice, std::uint64_t, std::uint32_t, std::uint32_t, VkFormat, std::uint32_t>& keep) {
+    static const VkDeviceSize budget = [] {
+        const char* text = std::getenv("APS5_DEPTH_PLANE_COPY_MIB");
+        return static_cast<VkDeviceSize>(text != nullptr ? std::strtoull(text, nullptr, 10) : 256ull) << 20u;
+    }();
+    if (budget == 0) return;
+    auto& copies = planeCopies();
+    VkDeviceSize total = 0;
+    for (const auto& entry : copies) total += entry.second->HeldBytes();
+    while (total > budget) {
+        auto oldest = copies.end();
+        for (auto it = copies.begin(); it != copies.end(); ++it) {
+            if (it->first == keep) continue;
+            if (oldest == copies.end() || it->second->lastUse < oldest->second->lastUse) oldest = it;
+        }
+        if (oldest == copies.end()) break;
+        total -= oldest->second->HeldBytes();
+        copies.erase(oldest);
+    }
+}
+
 struct LayeredSlice {
     DepthSurface* surface;
     std::uint32_t layer;
@@ -1382,6 +1402,7 @@ class LayeredDepthStorage {
 public:
     LayeredDepthStorage(const Context& context, const GuestTextureResource& resource, const DepthTarget& base, std::uint32_t bytesPerTexel, std::uint32_t firstLayer, std::uint32_t layers) : context(context), base(base), extent(base.extent), bytesPerTexel(bytesPerTexel), firstLayer(firstLayer), layers(layers) {
         const auto bytes = DescribeSurface(resource).guestBytes;
+        layerPitchBytes = DescribeSurface(resource).GuestLayerOffset(1);
         StorageTexture::FlushPending(resource.baseAddress, static_cast<std::size_t>(bytes), nullptr, "storage image creation", PublishScope::None);
         storage = StorageTexture::Create(context, *context.detiler, resource, 0);
         Require(storage->ImageLayers() == layers, "a layered depth storage view's image does not hold its layers");
@@ -1435,6 +1456,7 @@ public:
     const std::uint32_t bytesPerTexel;
     const std::uint32_t firstLayer;
     const std::uint32_t layers;
+    std::uint64_t layerPitchBytes = 0;
     std::shared_ptr<StorageTexture> storage;
 
 private:
@@ -1527,6 +1549,21 @@ DepthSurface* planeSurface(VkDevice device, std::uint64_t address) {
     return found == list.rend() ? nullptr : found->get();
 }
 
+void settlePendingHtileClear(const Context& context, std::uint64_t address) {
+    if (Recorder::InCompletion()) return;
+    auto* recorder = RecorderFor(context);
+    if (recorder == nullptr) return;
+    std::pair<std::uint64_t, std::size_t> metadata;
+    {
+        std::lock_guard lock(surfacesMutex());
+        const auto* surface = planeSurface(context.device, address);
+        if (surface == nullptr || !surface->samplingActive || surface->clearGeneration == 0u || !surface->clearCompletionQueued || !surface->sampling.refusal.empty()) return;
+        const auto& range = surface->sampling.initial[1];
+        metadata = {range.address, range.bytes};
+    }
+    if (recorder->PendingWriteOverlaps(metadata.first, metadata.second)) recorder->SyncThrough(metadata.first, metadata.second);
+}
+
 std::map<std::uint64_t, std::size_t>& clearedHtiles() {
     static auto* cleared = new std::map<std::uint64_t, std::size_t>();
     return *cleared;
@@ -1826,8 +1863,28 @@ std::uint64_t MultisampledDepthBytes_nid_no_patch(VkExtent2D extent, std::uint32
 void RequireNoResidentDepthRead_nid_no_patch(std::uint64_t address, std::size_t bytes) {
     if (bytes == 0u || !anyDepthGuard().load(std::memory_order_acquire)) return;
     Require(address <= std::numeric_limits<std::uint64_t>::max() - bytes, "native depth read range overflows");
-    std::shared_lock lock(depthGuardMutex());
-    for (const auto& range : depthGuards()) Require(address >= range.address + range.bytes || range.address >= address + bytes, "sample-preserving guest publication of native multisample depth is not implemented");
+    const auto overlaps = [&](const DepthGuard& range) { return address < range.address + range.bytes && range.address < address + bytes; };
+    {
+        std::shared_lock lock(depthGuardMutex());
+        if (std::ranges::none_of(depthGuards(), overlaps)) return;
+    }
+    std::unique_lock lock(depthGuardMutex());
+    for (const auto& range : depthGuards()) {
+        if (overlaps(range)) Require(!range.hostWritten->load(std::memory_order_acquire), "sample-preserving guest publication of native multisample depth is not implemented");
+    }
+    for (const auto& range : depthGuards()) {
+        if (overlaps(range)) range.active->store(false, std::memory_order_release);
+    }
+    std::erase_if(depthGuards(), [](const auto& range) { return !range.active->load(std::memory_order_acquire); });
+    anyDepthGuard().store(!depthGuards().empty(), std::memory_order_release);
+}
+
+void NoteDepthSurfaceWrite(const Context& context, const DepthTarget& target) {
+    if (target.samples == 1u || !anyDepthGuard().load(std::memory_order_acquire)) return;
+    std::lock_guard lock(surfacesMutex());
+    for (const auto& surface : surfaces()) {
+        if (surface->active->load(std::memory_order_acquire) && surface->context.device == context.device && sameSurface(surface->target, target)) surface->NoteHostWrite();
+    }
 }
 
 bool HasResidentDepthGuards_nid_no_patch() {
@@ -1873,7 +1930,7 @@ bool SampleLocationsCompatibleDepth(const Context& context, VkFormat format, std
 
 VkFormat HostDepthFormat(const Context& context, VkFormat format) {
     if (format != VK_FORMAT_D16_UNORM_S8_UINT) return format;
-    static std::mutex mutex;
+    static AgcDriver::Mutex mutex;
     static std::map<VkPhysicalDevice, VkFormat> chosen;
     std::lock_guard lock(mutex);
     if (const auto found = chosen.find(context.physical); found != chosen.end()) return found->second;
@@ -1900,6 +1957,7 @@ float HostDepthBiasConstant(const Context& context, VkFormat format, float const
 VkImageView DepthSurfaceView(const Context& context, const DepthTarget& target, bool depthWritten) {
     const auto htileCleared = RoutesToNativeDepthOwner(target) ? VkImageAspectFlags{0} : storeBackClearedHtile(context, target);
     std::lock_guard gpu(GuestMemory::GpuMutex());
+    settlePendingHtileClear(context, target.address);
     std::unique_lock lock(surfacesMutex());
     const bool cleared = takeClearedHtile(target);
     DepthSurface* surface = nullptr;
@@ -1936,7 +1994,7 @@ VkImageView DepthSurfaceView(const Context& context, const DepthTarget& target,
         auto& fresh = *surfaces().back();
         if (target.samples != 1u && fresh.sampleable && fresh.sampling.refusal.empty()) {
             std::unique_lock guardLock(depthGuardMutex());
-            for (const auto& range : fresh.sampling.initial) depthGuards().push_back({context.device, range.address, range.bytes, fresh.active, {{range.address, range.bytes, 0u}}});
+            for (const auto& range : fresh.sampling.initial) depthGuards().push_back({context.device, range.address, range.bytes, fresh.active, {{range.address, range.bytes, 0u}}, fresh.hostWritten});
             anyDepthGuard().store(true, std::memory_order_release);
             InstallResidentImageReadGuard_nid_no_patch();
             fresh.samplingActive = true;
@@ -2047,6 +2105,12 @@ std::vector<std::pair<std::uint64_t, std::uint64_t>> FlushDepthPlanes(std::uint6
             const bool overlapped = !surface->syncing && plane < end && address < plane + planeBytes;
             if (overlapped && (surface->pendingClear & VK_IMAGE_ASPECT_DEPTH_BIT) != 0) surface->MarkAllStale(planeBytes);
             if (overlapped && (scope == DepthPlaneScope::Whole || anyUnit(surface->StaleUnitsIn(planeBytes, address, end)))) {
+                if (GuestMemory::CommittedRanges(plane, static_cast<std::size_t>(planeBytes)).empty()) {
+                    static std::atomic<bool> reported{false};
+                    if (!reported.exchange(true)) std::fprintf(stderr, "[gpu] depth plane 0x%llx+0x%llx was unmapped with GPU results pending; they are dropped\n", static_cast<unsigned long long>(plane), static_cast<unsigned long long>(planeBytes));
+                    surface->ClearStale();
+                    continue;
+                }
                 surface->SyncFromMemory(resource);
                 auto units = scope == DepthPlaneScope::Whole ? surface->staleUnits : surface->StaleUnitsIn(planeBytes, address, end);
                 if (anyUnit(units)) {
@@ -2184,17 +2248,22 @@ std::size_t HtileDepthClearBytes_nid_no_patch(std::span<const std::uint32_t> cod
     return address <= std::numeric_limits<std::uint64_t>::max() - bytes ? static_cast<std::size_t>(bytes) : 0u;
 }
 
-void NoteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes, std::size_t nativeBytes) {
+bool NoteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes, std::size_t nativeBytes) {
     std::lock_guard lock(surfacesMutex());
     forgetHtileReads(htileAddress, bytes);
     bool existing = false;
+    bool completionCandidate = false;
     for (const auto& surface : surfaces()) {
         if (!surface->active->load(std::memory_order_acquire)) continue;
         if (surface->samplingActive && surface->target.htileAddress == htileAddress) {
             const auto& metadata = surface->sampling.initial[1];
             if (nativeBytes != bytes || nativeBytes < metadata.bytes || !GuestMemory::Accessible(reinterpret_cast<const void*>(metadata.address), metadata.bytes) || !GuestMemory::Watched(metadata.address, metadata.bytes)) surface->sampling.Refuse("native multisample depth incomplete or unproven fast-clear transition is not implemented");
-            else if (surface->clearGeneration != 0u) surface->sampling.Refuse("overlapping native multisample depth clear transitions are not implemented");
-            else surface->clearGeneration = GuestMemory::CollectWritesUncached(metadata.address, metadata.bytes);
+            else if (surface->clearPending || surface->clearGeneration != 0u) surface->sampling.Refuse("overlapping native multisample depth clear transitions are not implemented");
+            else {
+                surface->clearPending = true;
+                surface->clearCompletionQueued = false;
+                completionCandidate = true;
+            }
             existing = true;
             continue;
         }
@@ -2204,6 +2273,39 @@ void NoteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes, std::siz
         existing = true;
     }
     if (!existing) clearedHtiles()[htileAddress] = bytes;
+    return completionCandidate;
+}
+
+void ArmHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes) {
+    std::lock_guard lock(surfacesMutex());
+    for (const auto& surface : surfaces()) {
+        if (!surface->active->load(std::memory_order_acquire) || !surface->samplingActive || surface->target.htileAddress != htileAddress || !surface->clearPending) continue;
+        const auto& metadata = surface->sampling.initial[1];
+        if (bytes < metadata.bytes) continue;
+        surface->clearGeneration = GuestMemory::CollectWritesUncached(metadata.address, metadata.bytes);
+        surface->clearPending = false;
+        if (surface->clearGeneration == 0u) surface->sampling.Refuse("native multisample depth clear requires tracked HTILE generations");
+    }
+}
+
+void QueueHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes) {
+    std::lock_guard lock(surfacesMutex());
+    for (const auto& surface : surfaces()) {
+        if (!surface->active->load(std::memory_order_acquire) || !surface->samplingActive || surface->target.htileAddress != htileAddress || surface->clearGeneration == 0u || !surface->sampling.refusal.empty()) continue;
+        if (bytes >= surface->sampling.initial[1].bytes) surface->clearCompletionQueued = true;
+    }
+}
+
+void CompleteHtileDepthClear(std::uint64_t htileAddress, std::size_t bytes) {
+    std::lock_guard lock(surfacesMutex());
+    for (const auto& surface : surfaces()) {
+        if (!surface->active->load(std::memory_order_acquire) || !surface->samplingActive || surface->target.htileAddress != htileAddress || surface->clearGeneration == 0u) continue;
+        const auto& metadata = surface->sampling.initial[1];
+        if (bytes < metadata.bytes) continue;
+        Require(GuestMemory::UnchangedSinceCollected(metadata.address, metadata.bytes, surface->clearGeneration), "CPU writes raced native multisample depth clear");
+        GuestMemory::MarkWritten(metadata.address, metadata.bytes);
+        surface->clearCompletionQueued = false;
+    }
 }
 
 void ClearDepthSurfaces(VkDevice device) {
@@ -2222,6 +2324,16 @@ void ClearDepthSurfaces(VkDevice device) {
     UpdateResidentImageUnmapObserver_nid_no_patch();
 }
 
+std::size_t DepthPlaneCopyCount() {
+    return planeCopies().size();
+}
+
+namespace {
+
+thread_local bool depthCopySourceActive = false;
+
+}
+
 std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<const std::uint32_t> words, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType multisampleViewType) {
     const auto held = [&](const auto& surface) {
         return surface->active->load(std::memory_order_acquire) && surface->context.device == context.device && !surface->retired && (surface->target.address == resource.baseAddress || (surface->target.stencilAddress != 0 && surface->target.stencilAddress == resource.baseAddress));
@@ -2231,6 +2343,7 @@ std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<c
         if (std::none_of(surfaces().begin(), surfaces().end(), held)) return nullptr;
     }
     std::lock_guard gpu(GuestMemory::GpuMutex());
+    settlePendingHtileClear(context, resource.baseAddress);
     std::lock_guard lock(surfacesMutex());
     auto* found = planeSurface(context.device, resource.baseAddress);
     if (found == nullptr) return nullptr;
@@ -2241,12 +2354,17 @@ std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<c
         Require(base.samples > 1u, "multisample reader overlaps a single-sample depth attachment");
         auto* recorder = RecorderFor(context);
         Require(recorder != nullptr, "a native multisampled depth target is sampled only by recorded draws and dispatches");
-        found->CheckCurrent();
-        found->CheckResource(resource);
-        Require(found->pendingClear == 0u, "native multisample depth fast-clear transition is not implemented");
+        if (depthCopySourceActive) {
+            found->CheckResource(resource);
+            found->ApplyFastClear();
+        } else {
+            found->CheckCurrent();
+            found->CheckResource(resource);
+            Require(found->pendingClear == 0u, "native multisample depth fast-clear transition is not implemented");
+        }
         RecordMemoryBarrier(context, recorder->Commands(), VK_PIPELINE_STAGE_EARLY_FRAGMENT_TESTS_BIT | VK_PIPELINE_STAGE_LATE_FRAGMENT_TESTS_BIT | VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT);
         Recorder::CountBarriers(Recorder::CommandClass::Draw, 1);
-        return found->Sampled(words, resource, components, found == drawnDepth, multisampleViewType);
+        return found->Sampled(words, resource, components, found == drawnDepth, multisampleViewType, depthCopySourceActive);
     }
     if (resource.width != base.extent.width || resource.height != base.extent.height || resource.baseLevel != 0) return nullptr;
     const bool d16 = base.format == VK_FORMAT_D16_UNORM || base.format == VK_FORMAT_D16_UNORM_S8_UINT;
@@ -2282,21 +2400,25 @@ std::shared_ptr<Texture> DepthSurfaceTexture(const Context& context, std::span<c
         else slices.push_back({slice->image, slice == drawnDepth ? 0u : slice->written});
     }
     const auto imageFormat = integer ? VK_FORMAT_R16_UINT : d16 ? VK_FORMAT_D16_UNORM : VK_FORMAT_D32_SFLOAT;
-    auto& copy = planeCopies()[{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers}];
-    if (copy == nullptr) {
-        copy = std::make_unique<DepthPlaneCopy>(context, base.extent, imageFormat, layers);
-    }
-    return copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u);
+    auto& copies = planeCopies();
+    const std::tuple<VkDevice, std::uint64_t, std::uint32_t, std::uint32_t, VkFormat, std::uint32_t> copyKey{context.device, base.address, base.extent.width, base.extent.height, imageFormat, layers};
+    auto& copy = copies[copyKey];
+    if (copy == nullptr) copy = std::make_unique<DepthPlaneCopy>(context, base.extent, imageFormat, layers);
+    copy->lastUse = ++planeCopyClock();
+    auto texture = copy->Refresh(slices, resource, components, cube || resource.dimension == TextureDimension::k2DArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D, layered && !cube ? resource.baseArray : 0u);
+    evictPlaneCopies(copyKey);
+    return texture;
 }
 
 bool DepthSurfaceHolds(const Context& context, const GuestTextureResource& resource, const Texture* texture) {
     if ((resource.dimension != TextureDimension::k2D && resource.dimension != TextureDimension::k2DMsaa) || resource.baseArray != 0) return false;
     std::lock_guard gpu(GuestMemory::GpuMutex());
     const auto address = resource.baseAddress;
+    settlePendingHtileClear(context, address);
     std::lock_guard lock(surfacesMutex());
     auto* found = planeSurface(context.device, address);
     if (found == nullptr || !found->Holds(texture)) return false;
-    found->CheckCurrent();
+    if (!depthCopySourceActive) found->CheckCurrent();
     found->CheckResource(resource);
     return true;
 }
@@ -2392,7 +2514,7 @@ std::vector<LayeredSlice> layeredSlices(const Context& context, const LayeredDep
     std::vector<LayeredSlice> slices;
     const auto& list = surfaces();
     for (std::uint32_t layer = storage.firstLayer; layer < storage.layers; ++layer) {
-        const auto address = base.address + static_cast<std::uint64_t>(layer) * DepthSliceBytes(base.extent, storage.bytesPerTexel);
+        const auto address = base.address + static_cast<std::uint64_t>(layer) * storage.layerPitchBytes;
         const auto slice = std::find_if(list.rbegin(), list.rend(), [&](const auto& surface) { return surface->context.device == context.device && !surface->retired && surface->target.address == address && surface->target.extent.width == base.extent.width && surface->target.extent.height == base.extent.height && surface->target.format == base.format && surface->target.samples == 1; });
         if (slice != list.rend()) slices.push_back({slice->get(), layer});
     }
@@ -2405,12 +2527,6 @@ std::shared_ptr<StorageTexture> layeredDepthStorage(const Context& context, Dept
     const bool d16 = target.format == VK_FORMAT_D16_UNORM || target.format == VK_FORMAT_D16_UNORM_S8_UINT;
     const auto bytesPerTexel = d16 ? 2u : 4u;
     surface.RequireStorable(resource);
-    const auto geometry = DescribeSurface(resource);
-    if (layers > 1 && geometry.GuestLayerOffset(1) != DepthSliceBytes(target.extent, bytesPerTexel)) {
-        char text[256];
-        std::snprintf(text, sizeof(text), "AGC graphics: storage image access to the depth planes of depth surface 0x%llx with a layer pitch of 0x%llx bytes, not the depth slice size 0x%llx, is not implemented", static_cast<unsigned long long>(target.address), static_cast<unsigned long long>(geometry.GuestLayerOffset(1)), static_cast<unsigned long long>(DepthSliceBytes(target.extent, bytesPerTexel)));
-        throw std::runtime_error(text);
-    }
     auto& entry = layeredStorages()[{context.device, resource.baseAddress, resource.width, resource.height, layers, resource.format, static_cast<int>(resource.tileMode), static_cast<int>(resource.dimension), resource.baseArray}];
     if (entry == nullptr) entry = std::make_unique<LayeredDepthStorage>(context, resource, target, bytesPerTexel, resource.baseArray, layers);
     else static_cast<void>(entry->storage->Refresh());
@@ -2437,15 +2553,23 @@ std::shared_ptr<StorageTexture> DepthSurfaceStorage(const Context& context, std:
     return layeredDepthStorage(context, surface, resource, mip);
 }
 
-void CopyDepthSample(const Context& context, std::uint64_t depthAddress, std::uint32_t samples, std::uint32_t sample, StorageTexture& destination, VkImageView destinationView, VkExtent2D extent) {
-    std::lock_guard lock(surfacesMutex());
-    auto* found = planeSurface(context.device, depthAddress);
-    Require(found != nullptr && found->target.address == depthAddress, "DB depth copy from a depth plane no draw rendered");
-    Require(found->target.format == VK_FORMAT_D32_SFLOAT || found->target.format == VK_FORMAT_D32_SFLOAT_S8_UINT, "DB depth copy from a depth surface that is not 32-bit float");
-    Require(found->target.samples == samples, "DB depth copy from a depth surface of another sample count");
-    Require(found->target.extent.width == extent.width && found->target.extent.height == extent.height, "DB depth copy from a depth surface of another size");
-    Require(sample < found->target.samples, "DB depth copy of a sample the depth surface does not have");
-    found->CopySample(sample, destination, destinationView);
+DepthCopySourceScope::DepthCopySourceScope(bool active) : previous(depthCopySourceActive) {
+    depthCopySourceActive = active;
+}
+
+DepthCopySourceScope::~DepthCopySourceScope() {
+    depthCopySourceActive = previous;
+}
+
+std::array<std::uint32_t, 8> DepthCopySourceWords(const DepthTarget& target) {
+    const bool multisampled = target.samples != 1u;
+    const auto base = (target.address | target.pipeBankXor) >> 8u;
+    const auto metadata = multisampled ? target.htileAddress >> 8u : 0u;
+    const auto count = static_cast<std::uint32_t>(std::countr_zero(target.samples));
+    const auto width = target.extent.width - 1u, height = target.extent.height - 1u;
+    const auto type = multisampled ? 14u : 9u;
+    const auto word6 = (multisampled && target.iterate256 ? 1u << 10u : 0u) | (multisampled && target.htilePipeAligned ? 1u << 19u : 0u) | (metadata != 0 ? 1u << 21u : 0u) | (static_cast<std::uint32_t>(metadata & 255u) << 24u);
+    return {static_cast<std::uint32_t>(base), static_cast<std::uint32_t>((base >> 32u) & 255u) | (22u << 20u) | ((width & 3u) << 30u), (width >> 2u) | (height << 14u), (type << 28u) | (target.depthSwizzle << 20u) | (count << 16u) | 0x204u, 0u, count << 4u, word6, static_cast<std::uint32_t>(metadata >> 8u)};
 }
 
 bool DepthSurfaceStoreBack(const Context& context, const StorageTexture& storage) {
@@ -2454,7 +2578,10 @@ bool DepthSurfaceStoreBack(const Context& context, const StorageTexture& storage
         if (std::get<0>(key) != context.device || entry->storage.get() != &storage) continue;
         const auto slices = layeredSlices(context, *entry);
         entry->Copy(slices, false);
-        for (const auto& slice : slices) slice.surface->written = ++depthWrites;
+        for (const auto& slice : slices) {
+            slice.surface->written = ++depthWrites;
+            slice.surface->NoteHostWrite();
+        }
         return true;
     }
     for (const auto& surface : surfaces()) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp
index 90c38e18c1..a91fc9d2ff 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp
@@ -15,11 +15,15 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "Optimization/include/Optimization/ShaderStageInputInfo.hpp"
+#include "SpirvBackend/SpirvAnalysis.hpp"
 #include "ThreadOwned.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -40,6 +44,184 @@
 
 namespace AgcDriver::Graphics {
 
+namespace {
+
+struct PixelFunctionLdsPool {
+    Context context{};
+    VkBuffer buffer = VK_NULL_HANDLE;
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    VkDescriptorPool descriptorPool = VK_NULL_HANDLE;
+    VkDescriptorSet set = VK_NULL_HANDLE;
+    VkDescriptorSetLayout empty = VK_NULL_HANDLE;
+    VkDescriptorSetLayout bufferLayout = VK_NULL_HANDLE;
+    std::uint32_t* header = nullptr;
+    std::uint32_t subgroupSize = 0;
+    std::uint32_t slots = 0;
+    bool announced = false;
+};
+
+std::mutex& PixelLdsMutex() {
+    static std::mutex mutex;
+    return mutex;
+}
+
+std::unordered_map<VkDevice, PixelFunctionLdsPool>& PixelLdsPools() {
+    static std::unordered_map<VkDevice, PixelFunctionLdsPool> pools;
+    return pools;
+}
+
+void DestroyPixelFunctionLds(PixelFunctionLdsPool& pool) {
+    if (pool.header != nullptr) pool.context.Function<PFN_vkUnmapMemory>("vkUnmapMemory")(pool.context.device, pool.memory);
+    if (pool.descriptorPool != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(pool.context.device, pool.descriptorPool, nullptr);
+    if (pool.buffer != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(pool.context.device, pool.buffer, nullptr);
+    if (pool.memory != VK_NULL_HANDLE) pool.context.Function<PFN_vkFreeMemory>("vkFreeMemory")(pool.context.device, pool.memory, nullptr);
+    if (pool.bufferLayout != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(pool.context.device, pool.bufferLayout, nullptr);
+    if (pool.empty != VK_NULL_HANDLE) pool.context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(pool.context.device, pool.empty, nullptr);
+    pool.header = nullptr;
+    pool.descriptorPool = VK_NULL_HANDLE;
+    pool.set = VK_NULL_HANDLE;
+    pool.buffer = VK_NULL_HANDLE;
+    pool.memory = VK_NULL_HANDLE;
+    pool.bufferLayout = VK_NULL_HANDLE;
+    pool.empty = VK_NULL_HANDLE;
+}
+
+}
+
+PixelFunctionLdsLayouts PixelFunctionLdsSetLayouts(const Context& context) {
+    std::lock_guard lock(PixelLdsMutex());
+    auto& pool = PixelLdsPools()[context.device];
+    if (pool.bufferLayout == VK_NULL_HANDLE) {
+        pool.context = context;
+        VkDescriptorSetLayoutCreateInfo emptyInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &emptyInfo, nullptr, &pool.empty), "vkCreateDescriptorSetLayout pixel function LDS empty");
+        const VkDescriptorSetLayoutBinding binding{0u, VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u, VK_SHADER_STAGE_FRAGMENT_BIT, nullptr};
+        VkDescriptorSetLayoutCreateInfo info{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+        info.bindingCount = 1u;
+        info.pBindings = &binding;
+        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &info, nullptr, &pool.bufferLayout), "vkCreateDescriptorSetLayout pixel function LDS");
+    }
+    return {pool.empty, pool.bufferLayout};
+}
+
+void PreparePixelFunctionLds(const Context& context, VkCommandBuffer commands, std::uint32_t subgroupSize) {
+    const auto operations = VK_SUBGROUP_FEATURE_BASIC_BIT | VK_SUBGROUP_FEATURE_BALLOT_BIT;
+    Require((context.subgroup.supportedStages & VK_SHADER_STAGE_FRAGMENT_BIT) != 0 && (context.subgroup.supportedOperations & operations) == operations, "pixel function LDS needs fragment subgroup elect, ballot and broadcast");
+    Require(subgroupSize != 0u && subgroupSize == context.subgroup.subgroupSize, "pixel function LDS subgroup size does not match the device");
+    std::lock_guard lock(PixelLdsMutex());
+    auto& pool = PixelLdsPools()[context.device];
+    Require(pool.bufferLayout != VK_NULL_HANDLE, "pixel function LDS descriptor set layout was not created");
+    if (pool.buffer == VK_NULL_HANDLE) {
+        const auto stride = static_cast<std::uint64_t>(subgroupSize) * ShaderRecompiler::FunctionLdsDwordLimit * 4ull;
+        const auto budget = std::min<std::uint64_t>(context.limits.maxStorageBufferRange, 2ull << 30);
+        Require(budget > 16ull + stride, "pixel function LDS does not fit in the device storage buffer range");
+        pool.slots = static_cast<std::uint32_t>((budget - 16ull) / stride);
+        pool.subgroupSize = subgroupSize;
+        const auto bytes = 16ull + stride * pool.slots;
+        VkBufferCreateInfo bufferInfo{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO};
+        bufferInfo.size = bytes;
+        bufferInfo.usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT;
+        bufferInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
+        Check(context.Function<PFN_vkCreateBuffer>("vkCreateBuffer")(context.device, &bufferInfo, nullptr, &pool.buffer), "vkCreateBuffer pixel function LDS");
+        VkMemoryRequirements requirements{};
+        context.Function<PFN_vkGetBufferMemoryRequirements>("vkGetBufferMemoryRequirements")(context.device, pool.buffer, &requirements);
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = requirements.size;
+        constexpr auto hostCoherent = VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT;
+        constexpr auto deviceLocalHost = hostCoherent | VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT;
+        std::optional<std::uint32_t> deviceLocalType;
+        std::optional<std::uint32_t> hostOnlyType;
+        for (std::uint32_t i = 0; i < context.memory.memoryTypeCount; ++i) {
+            if ((requirements.memoryTypeBits & (1u << i)) == 0) continue;
+            const auto flags = context.memory.memoryTypes[i].propertyFlags;
+            const auto heap = context.memory.memoryTypes[i].heapIndex;
+            if (!deviceLocalType && (flags & deviceLocalHost) == deviceLocalHost && context.memory.memoryHeaps[heap].size >= requirements.size) {
+                deviceLocalType = i;
+            }
+            if (!hostOnlyType && (flags & hostCoherent) == hostCoherent && (flags & VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT) == 0) {
+                hostOnlyType = i;
+            }
+        }
+        const auto hostType = hostOnlyType.value_or(context.MemoryType(requirements.memoryTypeBits, hostCoherent));
+        allocation.memoryTypeIndex = deviceLocalType.value_or(hostType);
+        auto allocated = context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &pool.memory);
+        if (allocated != VK_SUCCESS && deviceLocalType && allocation.memoryTypeIndex == *deviceLocalType && hostType != *deviceLocalType) {
+            allocation.memoryTypeIndex = hostType;
+            allocated = context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &pool.memory);
+        }
+        if (allocated != VK_SUCCESS) {
+            context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(context.device, pool.buffer, nullptr);
+            pool.buffer = VK_NULL_HANDLE;
+            pool.memory = VK_NULL_HANDLE;
+            Check(allocated, "vkAllocateMemory pixel function LDS");
+        }
+        Check(context.Function<PFN_vkBindBufferMemory>("vkBindBufferMemory")(context.device, pool.buffer, pool.memory, 0), "vkBindBufferMemory pixel function LDS");
+        Check(context.Function<PFN_vkMapMemory>("vkMapMemory")(context.device, pool.memory, 0, 16, 0, reinterpret_cast<void**>(&pool.header)), "vkMapMemory pixel function LDS");
+        pool.header[0] = 0u;
+        pool.header[1] = 0u;
+        pool.header[2] = pool.slots;
+        const VkDescriptorPoolSize size{VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u};
+        VkDescriptorPoolCreateInfo poolInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO};
+        poolInfo.maxSets = 1u;
+        poolInfo.poolSizeCount = 1u;
+        poolInfo.pPoolSizes = &size;
+        Check(context.Function<PFN_vkCreateDescriptorPool>("vkCreateDescriptorPool")(context.device, &poolInfo, nullptr, &pool.descriptorPool), "vkCreateDescriptorPool pixel function LDS");
+        VkDescriptorSetAllocateInfo sets{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_ALLOCATE_INFO};
+        sets.descriptorPool = pool.descriptorPool;
+        sets.descriptorSetCount = 1u;
+        sets.pSetLayouts = &pool.bufferLayout;
+        Check(context.Function<PFN_vkAllocateDescriptorSets>("vkAllocateDescriptorSets")(context.device, &sets, &pool.set), "vkAllocateDescriptorSets pixel function LDS");
+        const VkDescriptorBufferInfo buffer{pool.buffer, 0, bytes};
+        VkWriteDescriptorSet write{VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET};
+        write.dstSet = pool.set;
+        write.dstBinding = 0u;
+        write.descriptorCount = 1u;
+        write.descriptorType = VK_DESCRIPTOR_TYPE_STORAGE_BUFFER;
+        write.pBufferInfo = &buffer;
+        context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, 1u, &write, 0u, nullptr);
+        std::fprintf(stderr, "[gpu] pixel function LDS pool: %u subgroups, %llu MiB, stride %u lanes\n", pool.slots, static_cast<unsigned long long>(bytes >> 20u), subgroupSize);
+        pool.announced = true;
+    }
+    Require(pool.subgroupSize == subgroupSize, "pixel function LDS subgroup size does not match the pool");
+    const VkMemoryBarrier beforeFill{VK_STRUCTURE_TYPE_MEMORY_BARRIER, nullptr, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT};
+    context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_FRAGMENT_SHADER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 1, &beforeFill, 0, nullptr, 0, nullptr);
+    context.Resolved(&DeviceFunctions::cmdFillBuffer, "vkCmdFillBuffer")(commands, pool.buffer, 0, 4, 0u);
+    const VkMemoryBarrier afterFill{VK_STRUCTURE_TYPE_MEMORY_BARRIER, nullptr, VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT};
+    context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TRANSFER_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_FRAGMENT_SHADER_BIT, 0, 1, &afterFill, 0, nullptr, 0, nullptr);
+}
+
+std::uint32_t PixelFunctionLdsSubgroup(std::span<const CompiledShader> shaders) {
+    std::uint32_t subgroup = 0u;
+    for (const auto& shader : shaders) {
+        if (shader.program != nullptr && shader.program->functionLdsBuffer) subgroup = shader.program->hostSubgroupSize;
+    }
+    return subgroup;
+}
+
+void BindPixelFunctionLds(const Context& context, VkCommandBuffer commands, VkPipelineLayout layout) {
+    std::lock_guard lock(PixelLdsMutex());
+    const auto& pool = PixelLdsPools().at(context.device);
+    Require(pool.set != VK_NULL_HANDLE, "pixel function LDS buffer was not prepared");
+    context.Resolved(&DeviceFunctions::cmdBindDescriptorSets, "vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, layout, ShaderRecompiler::PixelFunctionLdsDescriptorSet, 1, &pool.set, 0, nullptr);
+}
+
+void CheckPixelFunctionLds(const Context& context) {
+    std::lock_guard lock(PixelLdsMutex());
+    const auto found = PixelLdsPools().find(context.device);
+    if (found == PixelLdsPools().end() || found->second.header == nullptr) return;
+    const auto exhausted = found->second.header[1] != 0u;
+    found->second.header[1] = 0u;
+    if (exhausted) throw std::runtime_error("AGC graphics: pixel function LDS subgroup slots exhausted");
+}
+
+void ReleasePixelFunctionLds(VkDevice device) {
+    std::lock_guard lock(PixelLdsMutex());
+    const auto found = PixelLdsPools().find(device);
+    if (found == PixelLdsPools().end()) return;
+    DestroyPixelFunctionLds(found->second);
+    PixelLdsPools().erase(found);
+}
+
 std::uint64_t DrawRenderPassKey(const Context& context, const State& state, std::span<const VkImageView> targetViews) {
     std::uint64_t key = 14695981039346656037ull;
     const auto mix = [&](std::uint64_t value) {
@@ -51,10 +233,14 @@ std::uint64_t DrawRenderPassKey(const Context& context, const State& state, std:
         mix(state.blends.size());
         for (const auto& color : state.colors) mix(color.exportIndex);
     }
+    for (const auto& color : state.colors) {
+        if (color.partialWriteMask != 0u) mix(0x6d65726765000000ull | color.exportIndex);
+    }
     mix(state.renderExtent.width);
     mix(state.renderExtent.height);
     mix(state.samples);
     mix(state.mergedCoverage);
+    mix(state.truncatedCoverage);
     mix(state.customSampleLocations);
     if (state.customSampleLocations) {
         mix(state.sampleLocationGrid);
@@ -81,6 +267,10 @@ GuestTextureResource ArraySurfaceForTarget(const ColorTarget& color) {
 
 namespace {
 
+bool writesDepthTarget(const State& state) {
+    return state.depthWrite || (state.stencilTest && (state.stencilFront.writeMask != 0u || state.stencilBack.writeMask != 0u));
+}
+
 std::size_t colorKeyCount(const ColorTarget& color, std::size_t bytes) {
     if (color.mipCount != 1 || color.depth != 1 || !color.dccPipeAligned) return DccKeyBytes(bytes);
     return DccKeyCount(ColorTextureTileMode(color.tileMode), color.elementBytes, color.extent.width, color.extent.height, bytes);
@@ -172,8 +362,8 @@ struct CmaskProof {
     std::uint64_t generation = 0;
 };
 
-std::mutex& cmaskProofMutex() {
-    static std::mutex mutex;
+AgcDriver::Mutex& cmaskProofMutex() {
+    static AgcDriver::Mutex mutex;
     return mutex;
 }
 
@@ -219,6 +409,19 @@ CmaskState readCmask(const ColorTarget& color, const CmaskLayout& layout, std::v
     std::vector<std::byte> mask(bytes);
     GuestMemory::Read(address, mask, CmaskLayout::Alignment);
     const auto uniform = [&](std::byte value) { return std::all_of(mask.begin(), mask.end(), [&](std::byte entry) { return entry == value; }); };
+    if (color.coverageSamples > color.samples) {
+        for (std::uint32_t tileY = 0; tileY < layout.TilesY(); ++tileY) {
+            for (std::uint32_t tileX = 0; tileX < layout.TilesX(); ++tileX) {
+                const auto nibble = layout.Nibble(tileX, tileY);
+                const auto code = (std::to_integer<std::uint32_t>(mask[nibble / 2u]) >> ((nibble % 2u) * 4u)) & 0xfu;
+                if (code != 0u && (code >> 2u) != 3u) {
+                    char text[128];
+                    std::snprintf(text, sizeof(text), "AGC graphics: CMASK code 0x%x of a one-fragment color target is not implemented", code);
+                    throw std::runtime_error(text);
+                }
+            }
+        }
+    }
     if (uniform(std::byte{0xff})) return CmaskState::Expanded;
     if (uniform(std::byte{0})) return CmaskState::Cleared;
     for (std::uint32_t tileY = 0; tileY < layout.TilesY(); ++tileY) {
@@ -275,6 +478,10 @@ bool materializeCmaskClear(const Context& context, const ColorTarget& color, con
     const auto bytes = layout.Bytes();
     Require(color.cmaskBytes == bytes, "CMASK size differs from the color target's CMASK layout");
     if (cmaskProved(color.cmaskAddress, bytes)) return false;
+    if (color.coverageSamples > color.samples) {
+        std::vector<std::uint32_t> codes;
+        static_cast<void>(readCmask(color, layout, codes));
+    }
     auto* recorder = Recorder::Active();
     if (resident != nullptr && context.detiler != nullptr && recorder != nullptr && GuestMemory::GpuMutex().HeldByThisThread()) {
         const auto* import = HostImportFor(context, color.cmaskAddress, bytes);
@@ -347,7 +554,7 @@ constexpr std::array<const char*, PhaseCount> DrawPhaseNames{"validate", "vertex
 enum SyncReason : std::size_t { SyncNone, SyncNotResident, SyncNoRecorder, SyncDisabled, SyncCopiedWrites, SyncLease, SyncCount };
 constexpr std::array<const char*, SyncCount> SyncReasonNames{"none", "non-resident target", "no recorder", "disabled", "copied writes", "lease"};
 constexpr std::size_t IndirectPathCount = static_cast<std::size_t>(IndirectDrawPath::Count);
-constexpr std::array<const char*, IndirectPathCount> IndirectDrawPathNames{"gpu-side", "patched SGPR not folded", "fetch offset unknown", "non-vertex path", "GE_INDX_OFFSET", "draw index", "vertex range too large", "feature gap", "pending image results", "pending label or copied write", "not imported", "disabled", "index range not fully readable"};
+constexpr std::array<const char*, IndirectPathCount> IndirectDrawPathNames{"gpu-side", "patched SGPR not folded", "fetch offset unknown", "non-vertex path", "GE_INDX_OFFSET", "draw index", "vertex range too large", "feature gap", "pending image results", "pending label or copied write", "not imported", "disabled", "index range not fully readable", "index limit unknown"};
 
 // What became of one draw, for the totals.
 struct DrawOutcome {
@@ -399,7 +606,7 @@ enum DrawKind : std::size_t { KindRecipeHit, KindTemplateHit, KindBuild, KindBda
 constexpr std::array<const char*, KindCount> DrawKindNames{"recipe hit", "template hit", "build", "BDA"};
 
 struct DrawProfile {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::array<double, KindCount> kindUs{};
     std::array<std::uint64_t, KindCount> kindCounts{};
     std::uint64_t fullScissorLookups = 0;
@@ -461,6 +668,7 @@ struct DrawProfile {
     // with a constant, and the time of the CPU record reads (their syncs).
     std::array<std::uint64_t, IndirectPathCount> indirect{};
     std::uint64_t indirectRewritten = 0;
+    std::uint64_t indirectEmpty = 0;
     double indirectReadUs = 0;
     // Draw packets that drew nothing, by DrawSkip, and their time.
     std::array<std::uint64_t, static_cast<std::size_t>(DrawSkip::Count)> skips{};
@@ -558,12 +766,12 @@ void reportDraw(const std::array<double, PhaseCount>& us, const ShaderResources:
     if (room()) n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), "; hook waits inside draws %.1f ms (max %.1f; the draws' own syncs, %.1f ms, not counted)", profile.hookWaitUs / 1000.0, profile.maxHookWaitUs / 1000.0, profile.ownSyncUs / 1000.0);
     std::uint64_t indirectCpu = 0;
     for (std::size_t i = 1; i < IndirectPathCount; ++i) indirectCpu += profile.indirect[i];
-    if ((profile.indirect[0] != 0 || indirectCpu != 0) && room()) {
+    if ((profile.indirect[0] != 0 || indirectCpu != 0 || profile.indirectEmpty != 0) && room()) {
         n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), "; indirect: gpu-side %llu (%llu rewritten), cpu-side %llu (", static_cast<unsigned long long>(profile.indirect[0]), static_cast<unsigned long long>(profile.indirectRewritten), static_cast<unsigned long long>(indirectCpu));
         for (std::size_t i = 1; i < IndirectPathCount && room(); ++i) {
             if (profile.indirect[i] != 0) n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), " %s %llu", IndirectDrawPathNames[i], static_cast<unsigned long long>(profile.indirect[i]));
         }
-        if (room()) n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), "), argument reads %.1f ms", profile.indirectReadUs / 1000.0);
+        if (room()) n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), "), empty skipped before their stages %llu, argument reads %.1f ms", static_cast<unsigned long long>(profile.indirectEmpty), profile.indirectReadUs / 1000.0);
     }
     if (room()) n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), "; skipped packets:");
     for (std::size_t i = 0; i < profile.skips.size() && room(); ++i) {
@@ -573,8 +781,8 @@ void reportDraw(const std::array<double, PhaseCount>& us, const ShaderResources:
     for (std::size_t i = 1; i < profile.recipeMisses.size() && room(); ++i) {
         n += std::snprintf(line + n, sizeof(line) - static_cast<std::size_t>(n), " %s %llu", DrawRecipeMissName(static_cast<DrawRecipeMiss>(i)), static_cast<unsigned long long>(profile.recipeMisses[i]));
     }
-    std::fprintf(stderr, "%s\n", line);
-    std::fprintf(stderr, "[rescache] draws: %llu hits, %llu misses, %llu invalidated, %llu uncacheable; validation memo %llu hits / %llu misses (which key words the misses differ in: the miss churn line)\n", static_cast<unsigned long long>(profile.cacheHits), static_cast<unsigned long long>(profile.cacheMisses), static_cast<unsigned long long>(profile.cacheInvalidated), static_cast<unsigned long long>(profile.uncacheable), static_cast<unsigned long long>(profile.validateHits), static_cast<unsigned long long>(profile.validateMisses));
+    AgcDriver::ProfilePrint_nid_no_patch("%s\n", line);
+    AgcDriver::ProfilePrint_nid_no_patch("[rescache] draws: %llu hits, %llu misses, %llu invalidated, %llu uncacheable; validation memo %llu hits / %llu misses (which key words the misses differ in: the miss churn line)\n", static_cast<unsigned long long>(profile.cacheHits), static_cast<unsigned long long>(profile.cacheMisses), static_cast<unsigned long long>(profile.cacheInvalidated), static_cast<unsigned long long>(profile.uncacheable), static_cast<unsigned long long>(profile.validateHits), static_cast<unsigned long long>(profile.validateMisses));
     profile.totalsUs.fill(0);
     profile.maxUs.fill(0);
     profile.maxDrawUs = profile.hookWaitUs = profile.maxHookWaitUs = profile.ownSyncUs = 0;
@@ -666,6 +874,7 @@ bool ValidationKey(const Context& context, std::span<const CompiledShader> shade
         add(context.viewportIndexLayer);
         add(context.shaderTerminateInvocation);
         add(state.paClVsOutCntl);
+        add(state.vertexPoints);
         add(state.stages.mesh.has_value());
         if (state.stages.mesh) {
             const auto& mesh = *state.stages.mesh;
@@ -695,8 +904,8 @@ bool ValidationKey(const Context& context, std::span<const CompiledShader> shade
     return keyed;
 }
 
-std::mutex& validationMutex() {
-    static std::mutex mutex;
+AgcDriver::Mutex& validationMutex() {
+    static AgcDriver::Mutex mutex;
     return mutex;
 }
 
@@ -718,11 +927,26 @@ std::uint32_t CachedFragmentOutputs(const Context& context, std::span<const Comp
     auto& key = validationKeyScratch();
     const bool keyed = ValidationKey(context, shaders, state, key);
     static std::map<std::vector<std::uint64_t>, std::uint32_t> memo;
+    struct LastKeyStorage {};
+    auto& lastKey = HostThreadLocal<std::vector<std::uint64_t>, LastKeyStorage>();
+    thread_local std::uint32_t lastOutputs = 0;
+    thread_local bool lastValid = false;
+    const bool trims = keyed && CommitTrims();
+    if (trims && lastValid && key == lastKey) {
+        memoized = true;
+        hit = true;
+        return lastOutputs;
+    }
     if (keyed) {
         memoized = true;
         std::lock_guard lock(validationMutex());
         if (const auto found = memo.find(key); found != memo.end()) {
             hit = true;
+            if (trims) {
+                lastKey = key;
+                lastOutputs = found->second;
+                lastValid = true;
+            }
             return found->second;
         }
     }
@@ -777,10 +1001,16 @@ ResourceCache::Key DrawResourceKey(const Context& context, std::span<const Compi
     append64(reinterpret_cast<std::uint64_t>(context.device));
     key.push_back(static_cast<std::uint32_t>(shaders.size()));
     for (const auto& shader : shaders) {
-        const auto at = key.size();
-        key.push_back(0);
-        ShaderResources::AppendContentKey(shader, true, MovableBuffers(), key);
-        key[at] = static_cast<std::uint32_t>(key.size() - at - 1);
+        const auto sizeAt = key.size();
+        key.push_back(0u);
+        auto& memo = shader.program->drawKeyMemo.words;
+        if (auto words = memo.load(std::memory_order_acquire); words != nullptr) {
+            key.insert(key.end(), words->begin(), words->end());
+        } else {
+            ShaderResources::AppendContentKey(shader, true, MovableBuffers(), key);
+            memo.store(std::make_shared<const std::vector<std::uint32_t>>(key.begin() + static_cast<std::ptrdiff_t>(sizeAt + 1u), key.end()), std::memory_order_release);
+        }
+        key[sizeAt] = static_cast<std::uint32_t>(key.size() - sizeAt - 1u);
     }
     key.push_back(colorAttachments);
     if (ranges) {
@@ -872,6 +1102,21 @@ std::array<std::uint64_t, IndirectPathCount> IndirectDrawCounts() {
     return stats.indirect;
 }
 
+void CountEmptyIndirectDraw(double readMs) {
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    if (!profile) return;
+    auto& stats = Profile();
+    std::lock_guard lock(stats.mutex);
+    ++stats.indirectEmpty;
+    stats.indirectReadUs += readMs * 1000.0;
+}
+
+std::uint64_t EmptyIndirectDrawCount() {
+    auto& stats = Profile();
+    std::lock_guard lock(stats.mutex);
+    return stats.indirectEmpty;
+}
+
 std::array<DrawPassCounts, 2> DrawPassTotals() {
     auto& stats = Profile();
     std::lock_guard lock(stats.mutex);
@@ -1043,11 +1288,16 @@ struct DrawInputs {
     VkPipelineStageFlags shaderStages = 0;
     std::uint32_t meshGroups = 0;
     std::vector<std::uint32_t> restartTable;
+    std::uint32_t expandedIndexCount = 0;
     const VertexInputLayout& VertexLayout() const { return retainedVertexInput != nullptr ? *retainedVertexInput : vertexInput; }
 };
 
-std::shared_ptr<Buffer> zeroVertexBuffer(const Context& context, const ShaderRecompiler::VertexAttribute& attribute) {
-    auto zero = std::make_shared<Buffer>(context, DecodeVertexFormat(attribute).bytes, VK_BUFFER_USAGE_VERTEX_BUFFER_BIT);
+bool StripPatches(const State& state, std::span<const CompiledShader> shaders) {
+    return state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP && BarycentricPatches(state, shaders);
+}
+
+std::shared_ptr<Buffer> zeroVertexBuffer(const Context& context, std::size_t bytes) {
+    auto zero = std::make_shared<Buffer>(context, bytes, VK_BUFFER_USAGE_VERTEX_BUFFER_BIT);
     std::fill(zero->Bytes().begin(), zero->Bytes().end(), std::byte{0});
     return zero;
 }
@@ -1093,6 +1343,10 @@ DrawInputs prepareDrawInputs(const Context& context, const State& state, const P
     APS5_LOG_CHARS_OUT_DEBUG("Index buffer range OK");
     Require(!draw.indexed || !state.hasColorTarget || draw.indexAddress + indexBytes <= state.color.address || state.color.address + state.color.bytes <= draw.indexAddress, "index buffer aliases the render target");
     if (draw.indexed) RequireNoMultisampleTarget(draw.indexAddress, static_cast<std::size_t>(indexBytes), "an index buffer read");
+    if (state.pixelKill && !state.pixelEarlyZ && std::ranges::any_of(state.colors, [](const ColorTarget& color) { return color.partialWriteMask != 0; })) {
+        const auto* recorder = Recorder::Active();
+        Require(recorder == nullptr || !recorder->CountingSamples(), "a partial write of a packed color target merges inside the pixel shader after early depth and stencil tests, which a shader that kills pixels under late tests cannot use while occlusion queries count samples: the early tests would count the pixels it kills");
+    }
     APS5_LOG_CHARS_OUT_DEBUG("ValidateShaders");
     if (recipe != nullptr) {
         inputs.fragmentOutputs = recipe->fragmentOutputs;
@@ -1129,19 +1383,58 @@ DrawInputs prepareDrawInputs(const Context& context, const State& state, const P
     ValidateSampleMask(context, state, shaders);
     timer.phase(PhaseValidate);
     inputs.maxIndex = draw.indexed ? 0u : draw.firstVertex + draw.indexCount - 1u;
-    if (state.quadList) {
-        Require(!draw.indirect, "indirect quad-list draw is unsupported");
-        const std::uint32_t quadCount = draw.indexCount / 4u;
-        if (quadCount == 0u || draw.instanceCount == 0u) {
+    if (state.quadList || StripPatches(state, shaders)) {
+        Require(!draw.indirect, state.quadList ? "indirect quad-list draw is unsupported" : "an indirect triangle strip through emulated barycentric patches is unsupported");
+        const std::uint32_t primitives = state.quadList ? draw.indexCount / 4u : draw.indexCount >= 3u ? draw.indexCount - 2u : 0u;
+        if (primitives == 0u || draw.instanceCount == 0u) {
             inputs.nothing = true;
             return inputs;
         }
-        const std::uint32_t outputIndexCount = quadCount * 6u;
-        const std::size_t quadIndexBytes = static_cast<std::size_t>(outputIndexCount) * sizeof(std::uint32_t);
-        auto indexCopy = std::make_shared<Buffer>(context, quadIndexBytes, VK_BUFFER_USAGE_INDEX_BUFFER_BIT);
+        const std::uint32_t corners = state.quadList ? 6u : 3u;
+        const std::uint32_t outputIndexCount = primitives * corners;
+        const std::size_t expandedIndexBytes = static_cast<std::size_t>(outputIndexCount) * sizeof(std::uint32_t);
+        auto indexCopy = std::make_shared<Buffer>(context, expandedIndexBytes, VK_BUFFER_USAGE_INDEX_BUFFER_BIT);
         auto* outIndices = reinterpret_cast<std::uint32_t*>(indexCopy->Bytes().data());
         std::uint32_t maxIdx = 0;
         const bool lastProvoking = state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT;
+        const auto expand = [&](const auto& source) {
+            for (std::uint32_t primitive = 0; primitive < primitives; ++primitive) {
+                auto* out = outIndices + static_cast<std::size_t>(primitive) * corners;
+                if (state.quadList) {
+                    const auto i0 = source(primitive * 4u + 0u);
+                    const auto i1 = source(primitive * 4u + 1u);
+                    const auto i2 = source(primitive * 4u + 2u);
+                    const auto i3 = source(primitive * 4u + 3u);
+                    if (lastProvoking) {
+                        out[0] = i0;
+                        out[1] = i1;
+                        out[2] = i3;
+                        out[3] = i1;
+                        out[4] = i2;
+                        out[5] = i3;
+                    } else {
+                        out[0] = i0;
+                        out[1] = i1;
+                        out[2] = i2;
+                        out[3] = i0;
+                        out[4] = i2;
+                        out[5] = i3;
+                    }
+                } else {
+                    const std::uint32_t odd = primitive & 1u;
+                    if (lastProvoking) {
+                        out[0] = source(primitive + odd);
+                        out[1] = source(primitive + 1u - odd);
+                        out[2] = source(primitive + 2u);
+                    } else {
+                        out[0] = source(primitive);
+                        out[1] = source(primitive + 1u + odd);
+                        out[2] = source(primitive + 2u - odd);
+                    }
+                }
+                for (std::uint32_t corner = 0; corner < corners; ++corner) maxIdx = std::max(maxIdx, out[corner]);
+            }
+        };
         if (draw.indexed) {
             GuestMemory::FlushGpuWrites(draw.indexAddress, static_cast<std::size_t>(indexBytes));
             GuestMemory::CheckRange(reinterpret_cast<const void*>(draw.indexAddress), static_cast<std::size_t>(indexBytes), draw.indexSize);
@@ -1156,59 +1449,18 @@ DrawInputs prepareDrawInputs(const Context& context, const State& state, const P
                     return v;
                 }
             };
-            for (std::uint32_t q = 0; q < quadCount; ++q) {
-                const auto i0 = readIndex(q * 4u + 0u);
-                const auto i1 = readIndex(q * 4u + 1u);
-                const auto i2 = readIndex(q * 4u + 2u);
-                const auto i3 = readIndex(q * 4u + 3u);
-                maxIdx = std::max({maxIdx, i0, i1, i2, i3});
-                if (lastProvoking) {
-                    outIndices[q * 6u + 0u] = i0;
-                    outIndices[q * 6u + 1u] = i1;
-                    outIndices[q * 6u + 2u] = i3;
-                    outIndices[q * 6u + 3u] = i1;
-                    outIndices[q * 6u + 4u] = i2;
-                    outIndices[q * 6u + 5u] = i3;
-                } else {
-                    outIndices[q * 6u + 0u] = i0;
-                    outIndices[q * 6u + 1u] = i1;
-                    outIndices[q * 6u + 2u] = i2;
-                    outIndices[q * 6u + 3u] = i0;
-                    outIndices[q * 6u + 4u] = i2;
-                    outIndices[q * 6u + 5u] = i3;
-                }
-            }
+            expand(readIndex);
             Require(draw.firstVertex <= std::numeric_limits<std::uint32_t>::max() - maxIdx, "indexed draw vertex range overflow");
-            inputs.maxIndex = maxIdx + draw.firstVertex;
         } else {
-            maxIdx = quadCount * 4u - 1u;
-            Require(draw.firstVertex <= std::numeric_limits<std::uint32_t>::max() - maxIdx, "auto draw vertex range overflow");
-            for (std::uint32_t q = 0; q < quadCount; ++q) {
-                const auto i0 = q * 4u + 0u;
-                const auto i1 = q * 4u + 1u;
-                const auto i2 = q * 4u + 2u;
-                const auto i3 = q * 4u + 3u;
-                if (lastProvoking) {
-                    outIndices[q * 6u + 0u] = i0;
-                    outIndices[q * 6u + 1u] = i1;
-                    outIndices[q * 6u + 2u] = i3;
-                    outIndices[q * 6u + 3u] = i1;
-                    outIndices[q * 6u + 4u] = i2;
-                    outIndices[q * 6u + 5u] = i3;
-                } else {
-                    outIndices[q * 6u + 0u] = i0;
-                    outIndices[q * 6u + 1u] = i1;
-                    outIndices[q * 6u + 2u] = i2;
-                    outIndices[q * 6u + 3u] = i0;
-                    outIndices[q * 6u + 4u] = i2;
-                    outIndices[q * 6u + 5u] = i3;
-                }
-            }
-            inputs.maxIndex = maxIdx + draw.firstVertex;
+            const std::uint32_t lastVertex = state.quadList ? primitives * 4u - 1u : primitives + 1u;
+            Require(draw.firstVertex <= std::numeric_limits<std::uint32_t>::max() - lastVertex, "auto draw vertex range overflow");
+            expand([](std::uint32_t idx) { return idx; });
         }
+        inputs.maxIndex = maxIdx + draw.firstVertex;
         Require(inputs.maxIndex <= context.limits.maxDrawIndexedIndexValue, "index exceeds the device's indexed draw limit");
         inputs.indexHandle = indexCopy->Handle();
         inputs.indexOffset = 0;
+        inputs.expandedIndexCount = outputIndexCount;
         inputs.indices = std::move(indexCopy);
     } else if (draw.indexed) {
         const bool listTopology = state.topology == VK_PRIMITIVE_TOPOLOGY_POINT_LIST || state.topology == VK_PRIMITIVE_TOPOLOGY_LINE_LIST || state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
@@ -1290,14 +1542,19 @@ DrawInputs prepareDrawInputs(const Context& context, const State& state, const P
     fetchValid.reserve(attributes.size());
     std::vector<std::size_t> fetchOf(attributes.size(), 0);
     std::vector<std::shared_ptr<Buffer>> zeroed(attributes.size());
+    const auto& layout = inputs.VertexLayout();
     for (std::size_t i = 0; i < attributes.size(); ++i) {
         const auto& attribute = attributes[i];
+        const auto described = std::find_if(layout.attributes.begin(), layout.attributes.end(), [&](const auto& entry) { return entry.location == attribute.location; });
+        Require(described != layout.attributes.end(), "vertex attribute missing from its input layout");
+        const auto narrow = DecodeVertexFormat(attribute);
+        const std::size_t widened = described->format == narrow.format ? 0u : VertexReadBytes(attribute, described->format) - narrow.bytes;
         if (NullVertexDescriptor(attribute) || VertexFetchOutOfRange(attribute)) {
-            zeroed[i] = zeroVertexBuffer(context, attribute);
+            zeroed[i] = zeroVertexBuffer(context, narrow.bytes + widened);
             continue;
         }
         // An indirect draw's counts are unknown here: the descriptor's whole range is copied.
-        const auto bytes = args != nullptr ? VertexBufferExtent(attribute) : VertexBufferReadSize(attribute, inputs.maxIndex, draw.instanceCount, draw.firstInstance);
+        const auto bytes = (args != nullptr ? VertexBufferExtent(attribute) : VertexBufferReadSize(attribute, inputs.maxIndex, draw.instanceCount, draw.firstInstance)) + widened;
         const auto& fields = attribute.resource.fields;
         const auto address = fields[0] | (static_cast<std::uint64_t>(fields[1] & 0xffffu) << 32u);
         const auto firstByte = args == nullptr ? VertexBufferReadOffset(attribute, draw.firstVertex, draw.firstInstance) : 0;
@@ -1382,7 +1639,7 @@ std::shared_ptr<StorageTexture> refreshResidentTarget(const Context& context, co
         resident = lookup();
         if (resident != nullptr) materializeRegisterClear(context, color, *resident);
     } catch (const std::exception& error) {
-        static std::mutex reportMutex;
+        static AgcDriver::Mutex reportMutex;
         static std::set<std::uint64_t> reported;
         std::lock_guard lock(reportMutex);
         if (reported.insert(color.address).second) std::fprintf(stderr, "[gpu] color target 0x%llx stays non-resident: %s\n", static_cast<unsigned long long>(color.address), error.what());
@@ -1478,28 +1735,41 @@ struct IndirectRecord {
 
 // The draw commands of one draw: the vertex and index buffer binds, then the direct draw, the
 // GPU-side indirect draw from `argumentBuffer` or the CPU-read records with the driver's rules.
-void recordDrawCommands(const Context& context, VkCommandBuffer commands, const State& state, const Pm4::DrawParameters& draw, const DrawInputs& inputs, const IndirectRecord* indirect, VkBuffer argumentBuffer, VkDeviceSize argumentOffset, std::uint32_t firstIndex = 0) {
+void recordDrawCommands(const Context& context, VkCommandBuffer commands, const State& state, const Pm4::DrawParameters& draw, const DrawInputs& inputs, const IndirectRecord* indirect, VkBuffer argumentBuffer, VkDeviceSize argumentOffset, const DrawTraceContext* trace, std::uint32_t& subdraw, std::uint32_t firstIndex = 0) {
     if (context.recorder != nullptr) context.recorder->NoteSampledDraw(commands);
+    const auto recorded = [&](std::uint32_t index) {
+        if (trace != nullptr && context.recorder != nullptr) {
+            context.recorder->NoteDrawTraceToken(trace->token);
+            CaptureTrace::Log("draw-recorded token=%llu batch=%llu submission=%llu queue=%u offset=%zu target=%llx subdraw=%u", static_cast<unsigned long long>(trace->token), static_cast<unsigned long long>(context.recorder->OpenBatchSerial()), static_cast<unsigned long long>(trace->submission), trace->queue, trace->offset, static_cast<unsigned long long>(trace->target), index);
+        }
+    };
     const auto* args = indirect != nullptr ? indirect->args : nullptr;
     if (state.stages.mesh && args != nullptr) {
         context.Function<PFN_vkCmdDrawMeshTasksIndirectEXT>("vkCmdDrawMeshTasksIndirectEXT")(commands, argumentBuffer, argumentOffset, 1, sizeof(VkDrawMeshTasksIndirectCommandEXT));
+        recorded(subdraw++);
         return;
     }
     if (state.stages.mesh) {
         APS5_LOG_OUT_DEBUG("vkCmdDrawMeshTasksEXT groups=%u instances=%u", inputs.meshGroups, draw.instanceCount);
         context.Function<PFN_vkCmdDrawMeshTasksEXT>("vkCmdDrawMeshTasksEXT")(commands, inputs.meshGroups, draw.instanceCount, 1);
+        recorded(subdraw++);
         return;
     }
     if (!inputs.vertexHandles.empty()) context.Resolved(&DeviceFunctions::cmdBindVertexBuffers, "vkCmdBindVertexBuffers")(commands, 0, static_cast<std::uint32_t>(inputs.vertexHandles.size()), inputs.vertexHandles.data(), inputs.vertexOffsets.data());
-    if (state.quadList) {
+    if (inputs.expandedIndexCount != 0u) {
         context.Resolved(&DeviceFunctions::cmdBindIndexBuffer, "vkCmdBindIndexBuffer")(commands, inputs.indexHandle, inputs.indexOffset, VK_INDEX_TYPE_UINT32);
-        context.Resolved(&DeviceFunctions::cmdDrawIndexed, "vkCmdDrawIndexed")(commands, (draw.indexCount / 4u) * 6u, draw.instanceCount, 0, static_cast<std::int32_t>(draw.firstVertex), draw.firstInstance);
+        context.Resolved(&DeviceFunctions::cmdDrawIndexed, "vkCmdDrawIndexed")(commands, inputs.expandedIndexCount, draw.instanceCount, 0, static_cast<std::int32_t>(draw.firstVertex), draw.firstInstance);
         return;
     }
     if (draw.indexed) context.Resolved(&DeviceFunctions::cmdBindIndexBuffer, "vkCmdBindIndexBuffer")(commands, inputs.indexHandle, inputs.indexOffset, draw.indexSize == 2 ? VK_INDEX_TYPE_UINT16 : VK_INDEX_TYPE_UINT32);
     if (args == nullptr) {
-        if (draw.indexed) context.Resolved(&DeviceFunctions::cmdDrawIndexed, "vkCmdDrawIndexed")(commands, draw.indexCount, draw.instanceCount, firstIndex, static_cast<std::int32_t>(draw.firstVertex), draw.firstInstance);
-        else context.Resolved(&DeviceFunctions::cmdDraw, "vkCmdDraw")(commands, draw.indexCount, draw.instanceCount, draw.firstVertex, draw.firstInstance);
+        if (draw.indexed) {
+            context.Resolved(&DeviceFunctions::cmdDrawIndexed, "vkCmdDrawIndexed")(commands, draw.indexCount, draw.instanceCount, firstIndex, static_cast<std::int32_t>(draw.firstVertex), draw.firstInstance);
+            recorded(subdraw++);
+        } else {
+            context.Resolved(&DeviceFunctions::cmdDraw, "vkCmdDraw")(commands, draw.indexCount, draw.instanceCount, draw.firstVertex, draw.firstInstance);
+            recorded(subdraw++);
+        }
     } else if (indirect->path == IndirectDrawPath::Gpu) {
         if (args->countIndirect) {
             if (draw.indexed) context.Function<PFN_vkCmdDrawIndexedIndirectCountKHR>("vkCmdDrawIndexedIndirectCountKHR")(commands, argumentBuffer, argumentOffset, indirect->countImport->buffer, HostImportOffset(*indirect->countImport, args->countAddress), args->count, args->stride);
@@ -1686,6 +1956,7 @@ void keepRecordedDraw(Recorder& recorder, const std::shared_ptr<ShaderResources>
             resources->WriteBackBuffers();
         });
         writers->push_back(resources);
+        GuestMemory::BreakProofs();
     } else if (completion) {
         if (resources->Reusable()) recorder.OnComplete([resources] { resources->CheckFaults(); });
         else recorder.OnComplete([resources] { resources->WriteBackBuffers(); });
@@ -1751,6 +2022,7 @@ void recordStencilReplay(const Context& context, VkCommandBuffer commands, const
     const auto referenceOffset = fragment->pushConstantOffset + fragment->program->stencilReferenceDword * sizeof(std::uint32_t);
     Require(referenceOffset <= block.size() - sizeof(std::uint32_t), "stencil replay reference exceeds the push block");
     const auto run = [&](const Pm4::DrawParameters& piece, std::uint32_t firstIndex) {
+        std::uint32_t unusedSubdraw = 0;
         for (const auto& [reference, pipeline] : replay) {
             selected.stencilReplayReference = reference;
             selected.stencilFront.reference = reference;
@@ -1758,7 +2030,7 @@ void recordStencilReplay(const Context& context, VkCommandBuffer commands, const
             context.Resolved(&DeviceFunctions::cmdSetStencilReference, "vkCmdSetStencilReference")(commands, VK_STENCIL_FACE_FRONT_AND_BACK, reference);
             std::memcpy(block.data() + referenceOffset, &reference, sizeof(reference));
             pipeline->PushConstants(commands, stages, block);
-            recordDrawCommands(context, commands, selected, piece, inputs, nullptr, VK_NULL_HANDLE, 0, firstIndex);
+            recordDrawCommands(context, commands, selected, piece, inputs, nullptr, VK_NULL_HANDLE, 0, nullptr, unusedSubdraw, firstIndex);
         }
     };
     if (replay.size() == 1u) {
@@ -1891,7 +2163,8 @@ bool WriteOnlyPasses() {
     return enabled;
 }
 
-void recordDraw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, DrawInputs& inputs, RecordedDraw& record, DrawOutcome& outcome, DrawTimer& timer, double& ownWaitedMs) {
+void recordDraw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, DrawInputs& inputs, RecordedDraw& record, DrawOutcome& outcome, DrawTimer& timer, double& ownWaitedMs, const DrawTraceContext* trace = nullptr) {
+    std::uint32_t subdraw = 0;
     auto* recorder = record.recorder;
     auto& resources = *record.resources;
     const auto* args = record.indirect != nullptr ? record.indirect->args : nullptr;
@@ -1972,7 +2245,7 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
     }
     const PassAccess passAccess{passReads, passWrites, passImages, passAttachments, unknownMemory, unknownWrites, passWriteOnly};
     const bool fenced = state.depth.has_value() || !record.proxies.empty();
-    const auto start = recorder->StartDrawPass(passKey, capture || readsTarget || gpuIndirect || meshIndirect, fenced, passAccess);
+    const auto start = recorder->StartDrawPass(passKey, capture || readsTarget || gpuIndirect || meshIndirect || PixelFunctionLdsSubgroup(shaders) != 0u, fenced, passAccess);
     for (const auto& target : record.multisampleTargets) KeepMultisampleTarget_nid_no_patch(target);
     const bool continued = start.continued;
     outcome.passContinued = continued;
@@ -2019,6 +2292,8 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
             RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_VERTEX_INPUT_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT, VK_ACCESS_VERTEX_ATTRIBUTE_READ_BIT);
             countBarrier(1);
         }
+        const auto pixelLdsSubgroup = PixelFunctionLdsSubgroup(shaders);
+        if (pixelLdsSubgroup != 0u) PreparePixelFunctionLds(context, commands, pixelLdsSubgroup);
         if (meshIndirect) {
             meshArguments = recordMeshArguments(context, commands, recorder, true, state, draw, *record.indirect, countBarrier, inputs.restartTable);
             argumentBuffer = meshArguments->Handle();
@@ -2044,21 +2319,22 @@ void recordDraw(const Context& context, const State& state, const Pm4::DrawParam
     } else {
         resources.Bind(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, record.pipeline->Layout());
     }
+    if (std::ranges::any_of(shaders, [](const CompiledShader& shader) { return shader.program != nullptr && shader.program->functionLdsBuffer; })) BindPixelFunctionLds(context, commands, record.pipeline->Layout());
     APS5_LOG_CHARS_OUT_DEBUG("Resources bound");
     pushDrawConstants(*record.pipeline, commands, state, draw, shaders, resources, record.pushBytes, record.pushStages, meshArguments != nullptr ? meshArguments->DeviceAddress() : 0, !inputs.restartTable.empty());
     APS5_LOG_CHARS_OUT_DEBUG("Push constants recorded");
-    if (record.stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset);
+    if (record.stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset, trace, subdraw);
     else {
         recordStencilReplay(context, commands, state, draw, inputs, record.stencilReplay, shaders, resources, record.pushBytes, record.pushStages);
         for (const auto& [reference, pipeline] : record.stencilReplay) recorder->Keep(pipeline);
     }
     if (record.pipeline->SplitsFaces()) {
         record.pipeline->ContinueBackFaces(commands, state);
-        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset, trace, subdraw);
     }
     if (record.pipeline->SplitsSecondChannel()) {
         record.pipeline->ContinueSecondChannel(commands);
-        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, record.indirect, argumentBuffer, argumentOffset, trace, subdraw);
     }
     if (meshArguments != nullptr) recorder->Keep(meshArguments);
     if (args != nullptr) CountIndirectDraw(record.indirect->path, record.indirect->readMs, rewritten);
@@ -2148,8 +2424,67 @@ std::optional<std::string> KnownValidationFailure(const Context& context, std::s
     return std::nullopt;
 }
 
-void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipeOut) {
+namespace {
+
+struct TargetBinding {
+    ColorTarget color;
+    bool gpuTiling = false;
+    std::shared_ptr<StorageTexture> resident;
+    bool proxied = false;
+    std::unique_ptr<Buffer> transfer;
+    std::unique_ptr<Buffer> tiled;
+    std::unique_ptr<DeviceBuffer> tiledDevice;
+    std::unique_ptr<DeviceBuffer> linearDevice;
+    std::vector<std::byte> original;
+    TileMipLayout mip{};
+    std::unique_ptr<RenderTarget> target;
+    bool multisampled = false;
+    VkImage multisampleImage = VK_NULL_HANDLE;
+    std::shared_ptr<void> multisampleOwner;
+    std::unique_ptr<Buffer> dump;
+};
+
+struct PreparedDraw {
+    explicit PreparedDraw(bool profile) : timer(profile) {}
+    PreparedDraw(const PreparedDraw&) = delete;
+    PreparedDraw& operator=(const PreparedDraw&) = delete;
+    std::shared_ptr<const DrawRecipe>* recipeOut = nullptr;
+    const DrawTraceContext* trace = nullptr;
     std::vector<std::uint32_t> stencilReferences;
+    std::optional<PerformanceTimer> timing;
+    DrawTimer timer;
+    DrawOutcome outcome;
+    const ShaderResources::BuildTiming* built = nullptr;
+    double waitedBefore = 0;
+    double ownWaitedMs = 0;
+    DrawInputs inputs;
+    const Pm4::DrawParameters::IndirectDraw* args = nullptr;
+    int dumpLimit = 0;
+    std::vector<TargetBinding> targets;
+    std::vector<VkImageView> targetViews;
+    Recorder* recorder = nullptr;
+    ResolvedResources resolved;
+    IndirectRecord indirect;
+    std::vector<Pm4::DrawArguments> records;
+    bool completion = false;
+    bool listed = false;
+    bool recorded = false;
+    bool lean = false;
+    bool multisampled = false;
+    std::optional<State> masked;
+    std::vector<std::pair<std::uint32_t, std::shared_ptr<Pipeline>>> stencilReplay;
+    std::shared_ptr<Pipeline> pipeline;
+    std::vector<std::shared_ptr<StorageTexture>> owners;
+    std::vector<std::shared_ptr<void>> framebufferOwners;
+    std::shared_ptr<Framebuffer> framebuffer;
+    std::vector<SampleOrderTarget> reordered;
+    SampleOrderPass reorderPass;
+    std::optional<DepthSampleLocations> depthLocations;
+};
+
+bool prepareDraw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, PreparedDraw& prepared) {
+    auto*& recipeOut = prepared.recipeOut;
+    auto& stencilReferences = prepared.stencilReferences;
     for (const auto& shader : shaders) {
         if (shader.program != nullptr && !shader.program->stencilReferences.empty()) {
             Require(shader.stage == ShaderRecompiler::ShaderStage::Fragment && stencilReferences.empty(), "stencil replay requires exactly one fragment stage");
@@ -2172,60 +2507,37 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         Require(state.samples == 1u && (!state.depth || HasStencil(state.depth->format)), "stencil replay requires single-sample rendering and an eight-bit stencil format");
         recipeOut = nullptr;
     }
-    if (state.quadList) recipeOut = nullptr;
+    if (state.quadList || StripPatches(state, shaders)) recipeOut = nullptr;
     if (context.recorder != nullptr) context.recorder->BoundKeptBytes();
-    PerformanceTimer timing("Graphics.Draw");
+    auto& timing = prepared.timing.emplace("Graphics.Draw");
     // APS5_PROFILE_DRAW prints the time of each phase of the draw (microseconds) and the [draws] totals.
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
-    DrawTimer timer(profile);
+    auto& timer = prepared.timer;
+    timer = DrawTimer(profile);
     // APS5_TRACE_DRAWS (together with APS5_PROFILE_DRAW; alone it only enables Driver.cpp's own
     // [draw] lines) additionally prints one line per draw with its phases and, for synchronous
     // draws, their inputs: per-draw string building at ~1400 draws per 10 s is itself a cost the
     // totals must not carry.
     static const bool traceDraws = std::getenv("APS5_TRACE_DRAWS") != nullptr;
-    DrawOutcome outcome;
-    const ShaderResources::BuildTiming* built = nullptr;
+    auto& outcome = prepared.outcome;
+    auto& built = prepared.built;
     // The thread's GPU waits so far: the difference at the report, less the draw's own syncs
     // (`ownWaitedMs`, sampled around them), is what this draw waited for through the flush hook
     // (nested in the draw's hold, see DrawOutcome::hookWaitUs).
-    const auto waitedBefore = profile ? Recorder::ThreadWaitedMs() : 0.0;
-    double ownWaitedMs = 0;
+    const auto waitedBefore = prepared.waitedBefore = profile ? Recorder::ThreadWaitedMs() : 0.0;
+    auto& ownWaitedMs = prepared.ownWaitedMs;
     const auto report = [&](const char* suffix) { reportDrawEnd(state, timer, built, outcome, waitedBefore, ownWaitedMs, suffix); };
-    auto inputs = prepareDrawInputs(context, state, draw, shaders, outcome, timer, nullptr);
-    if (inputs.nothing) return;
-    const auto* args = draw.indirect ? &*draw.indirect : nullptr;
+    auto& inputs = prepared.inputs;
+    inputs = prepareDrawInputs(context, state, draw, shaders, outcome, timer, nullptr);
+    if (inputs.nothing) return false;
+    const auto* args = prepared.args = draw.indirect ? &*draw.indirect : nullptr;
     const auto indexBytes = inputs.indexBytes;
     timing.Mark("validate");
     timing.Mark("index_upload");
-    // One binding per color attachment. Tiled targets are detiled and retiled on the GPU in video memory;
-    // only changed guest blocks are stored back.
-    struct TargetBinding {
-        ColorTarget color;
-        bool gpuTiling = false;
-        // Resident target: the surface's cached storage image is attached directly and marked dirty
-        // afterwards, so nothing is copied in or out per draw.
-        std::shared_ptr<StorageTexture> resident;
-        bool proxied = false;
-        // Linear pixels converted on the CPU, for targets the GPU detiler does not handle.
-        std::unique_ptr<Buffer> transfer;
-        // Guest bytes in host memory, and their device-local copies for the detiler.
-        std::unique_ptr<Buffer> tiled;
-        std::unique_ptr<DeviceBuffer> tiledDevice;
-        std::unique_ptr<DeviceBuffer> linearDevice;
-        std::vector<std::byte> original;
-        TileMipLayout mip{};
-        std::unique_ptr<RenderTarget> target;
-        bool multisampled = false;
-        VkImage multisampleImage = VK_NULL_HANDLE;
-        std::shared_ptr<void> multisampleOwner;
-        // APS5_DUMP_TARGETS: the rendered linear pixels, read back for target_<address>_<n>.raw.
-        std::unique_ptr<Buffer> dump;
-    };
-    const int dumpLimit = DumpTargetLimit();
-    static std::mutex dumpMutex;
-    static std::map<std::uint64_t, int> dumped;
-    std::vector<TargetBinding> targets(state.colors.size());
-    std::vector<VkImageView> targetViews;
+    const int dumpLimit = prepared.dumpLimit = DumpTargetLimit();
+    auto& targets = prepared.targets;
+    targets.resize(state.colors.size());
+    auto& targetViews = prepared.targetViews;
     for (std::size_t index = 0; index < state.colors.size(); ++index) {
         auto& binding = targets[index];
         binding.color = state.colors[index];
@@ -2234,6 +2546,10 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         if (color.samples > 1) {
             binding.multisampled = true;
             timer.phase(PhaseSetup);
+            if (color.partialWriteMask != 0) {
+                static_cast<void>(MultisampleTargetView(context, color));
+                static_cast<void>(MultisampleTargetStorageView(context, TargetMergeSurface(color)));
+            }
             targetViews.push_back(MultisampleTargetView(context, color, binding.multisampleOwner, &binding.multisampleImage));
             timer.phase(PhaseReadTarget);
             continue;
@@ -2242,6 +2558,7 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         const ColorTargetLayout colorLayout(color.extent.width, color.extent.height, color.tileMode, color.elementBytes);
         static_cast<void>(FlushDepthPlanes(color.address, colorLayout.Bytes(), DepthPlaneScope::Whole));
         RetireDepthSurfaces(context.device, color.address, colorLayout.Bytes());
+        if (color.fmaskAddress != 0) GuardOneFragmentFmask(context, color);
         constexpr VkBufferUsageFlags copies = VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT;
         timer.phase(PhaseSetup);
         // Debug aid: APS5_NO_RESIDENT_TARGETS=1 copies every target in and out again.
@@ -2317,12 +2634,16 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         binding.target = std::make_unique<RenderTarget>(context, color, state.blends.at(color.exportIndex).blendEnable != 0);
         targetViews.push_back(binding.target->View());
     }
-    if (state.depth) targetViews.push_back(DepthSurfaceView(context, *state.depth, state.depthWrite));
+    if (state.depth) {
+        targetViews.push_back(DepthSurfaceView(context, *state.depth, state.depthWrite));
+        if (writesDepthTarget(state)) NoteDepthSurfaceWrite(context, *state.depth);
+    }
     timer.phase(PhasePrepare);
     const bool recordDraws = RecordDraws();
-    auto* recorder = Recorder::Active();
+    auto* recorder = prepared.recorder = Recorder::Active();
     bool recordable = recordDraws && recorder != nullptr && dumpLimit == 0 && std::all_of(targets.begin(), targets.end(), [](const TargetBinding& binding) { return binding.resident != nullptr || binding.multisampled; });
-    auto resolved = resolveDrawResources(context, state, draw, shaders, snapshots, indexBytes, recordable, outcome, timer);
+    auto& resolved = prepared.resolved;
+    resolved = resolveDrawResources(context, state, draw, shaders, snapshots, indexBytes, recordable, outcome, timer);
     auto& resources = resolved.resources;
     if (!stencilReferences.empty() && resources->ChecksFaults()) recordable = false;
     if (!stencilReferences.empty()) {
@@ -2362,9 +2683,9 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
     // and records plain draws with the same per-dimension rules. The import pointer stays valid:
     // refreshImports runs only under GuestMemory::GpuMutex, held here, and a retired import's
     // buffer is kept while the recorder is busy.
-    IndirectRecord indirect;
+    auto& indirect = prepared.indirect;
     indirect.args = args;
-    std::vector<Pm4::DrawArguments> records;
+    auto& records = prepared.records;
     if (args != nullptr) {
         static const bool gpuIndirectDraws = std::getenv("APS5_NO_GPU_INDIRECT_DRAW") == nullptr;
         const auto decide = [&](std::uint64_t address, std::size_t bytes, const HostImport*& import) {
@@ -2385,7 +2706,7 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         const auto rangeBytes = args->RangeBytes();
         if (rangeBytes == 0) {
             report(" indirect draw without records");
-            return;
+            return false;
         }
         Require(rangeBytes <= std::numeric_limits<std::size_t>::max(), "indirect draw record range overflow");
         if (!gpuIndirectDraws) indirect.path = IndirectDrawPath::Disabled;
@@ -2406,7 +2727,7 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
             if (std::none_of(records.begin(), records.end(), [](const Pm4::DrawArguments& record) { return record.count != 0 && record.instances != 0; })) {
                 CountIndirectDraw(indirect.path, indirect.readMs);
                 report(" indirect draw with empty records");
-                return;
+                return false;
             }
         }
     }
@@ -2431,14 +2752,14 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
     static const bool syncCompletionDraws = std::getenv("APS5_SYNC_COMPLETION_DRAWS") != nullptr;
     static const bool recorderSyncDraws = std::getenv("APS5_NO_RECORDER_SYNC_DRAWS") == nullptr;
     static const bool recordCopiedDraws = std::getenv("APS5_NO_RECORD_COPIED_DRAWS") == nullptr;
-    const bool completion = resources->NeedsCompletion();
+    const bool completion = prepared.completion = resources->NeedsCompletion();
     const bool copiedWrites = completion && resources->HasCopiedWrites();
     // A lease only forces the wait when deferred release is off.
     const bool lease = resources->HoldsLease() && SyncLeaseWork();
     outcome.completion = completion;
     outcome.recorded = recordable;
     // Whether the copied write-back is listed in DrawCopiedWriters instead of waited for.
-    bool listed = false;
+    auto& listed = prepared.listed;
     if (!recordable) {
         outcome.reason = !recordDraws || dumpLimit != 0 ? SyncDisabled : recorder == nullptr ? SyncNoRecorder : SyncNotResident;
     } else if (completion && (syncCompletionDraws || copiedWrites || lease)) {
@@ -2448,7 +2769,7 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         else if (recorderSyncDraws) outcome.waited = true;
         else outcome.recorded = false;
     }
-    const bool recorded = outcome.recorded;
+    const bool recorded = prepared.recorded = outcome.recorded;
     // A build this recorded draw can share with later identical ones goes into the cache (a cache
     // hit is reusable by construction, so `recorded` holds for it; one with completion work is
     // never reusable).
@@ -2457,11 +2778,22 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
     // aid: APS5_DRAW_TRANSITIONS=1 keeps the per-draw upload and download barriers, the layout
     // transitions of every target and one pass per draw, as before.
     static const bool drawTransitions = std::getenv("APS5_DRAW_TRANSITIONS") != nullptr;
-    const bool lean = recorded && !drawTransitions;
-    const bool multisampled = std::any_of(targets.begin(), targets.end(), [](const TargetBinding& binding) { return binding.multisampled; });
+    const bool lean = prepared.lean = recorded && !drawTransitions;
+    const bool multisampled = prepared.multisampled = std::any_of(targets.begin(), targets.end(), [](const TargetBinding& binding) { return binding.multisampled; });
     Require(lean || !multisampled, "multisampled draws are only rendered as recorded draws");
     for (const auto& binding : targets) {
-        if (binding.multisampled) Require(std::find(resources->MultisampleSources().begin(), resources->MultisampleSources().end(), binding.color.surfaceAddress) == resources->MultisampleSources().end(), "sampling a multisampled color target the draw renders to is not implemented");
+        if (!binding.multisampled) continue;
+        const auto& sources = resources->MultisampleSources();
+        const auto reads = std::count(sources.begin(), sources.end(), binding.color.surfaceAddress);
+        Require(reads == 0 || (reads == 1 && binding.color.partialWriteMask != 0), "sampling a multisampled color target the draw renders to is not implemented");
+        Require(binding.color.partialWriteMask == 0 || (reads == 1 && MultisampleTargetStorable(context, binding.color)), "the partial write of a multisampled packed color target does not store into the target's image");
+        if (binding.color.partialWriteMask != 0) static_cast<void>(MultisampleTargetStorageView(context, TargetMergeSurface(binding.color)));
+    }
+    for (const auto& binding : targets) {
+        if (binding.color.partialWriteMask == 0 || binding.multisampled) continue;
+        Require(lean && binding.resident != nullptr && !binding.proxied, "a partial write of a packed color target is merged into its resident image by a recorded draw only");
+        const auto images = resources->StorageImages();
+        Require(std::ranges::any_of(images, [&](const std::pair<VkImage, bool>& image) { return image.first == binding.resident->Image() && image.second; }), "the partial write of a packed color target does not store into the target's resident image");
     }
     if (!lean && !resolved.moved.empty()) {
         resolved.resources = std::make_shared<ShaderResources>(context, shaders, state.color, static_cast<std::uint32_t>(state.colors.size()), draw.indexAddress, static_cast<std::size_t>(indexBytes), snapshots);
@@ -2470,7 +2802,8 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
     if (state.depth) RequireNoNativeDepthFeedback_nid_no_patch(context, *state.depth, resources->SampledTextures());
     APS5_LOG_CHARS_OUT_DEBUG("Creating Pipeline");
     // The state is copied only when a mask must change.
-    auto masked = maskedState(state, inputs.fragmentOutputs);
+    auto& masked = prepared.masked;
+    masked = maskedState(state, inputs.fragmentOutputs);
     if (std::any_of(targets.begin(), targets.end(), [](const TargetBinding& binding) { return binding.proxied; })) recipeOut = nullptr;
     for (std::size_t index = 0; index < targets.size(); ++index) {
         if (!targets[index].proxied) continue;
@@ -2485,7 +2818,7 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         const auto built = resources->SetLayouts();
         Require(described.layouts.main == built.main && described.layouts.fragment == built.fragment && described.layouts.split == built.split && std::ranges::equal(described.mainKey, built.mainKey) && std::ranges::equal(described.fragmentKey, built.fragmentKey), "set layouts described from the shaders differ from the draw's");
     }
-    std::vector<std::pair<std::uint32_t, std::shared_ptr<Pipeline>>> stencilReplay;
+    auto& stencilReplay = prepared.stencilReplay;
     for (const auto reference : stencilReferences) {
         auto selected = pipelineState;
         selected.stencilReplayReference = reference;
@@ -2495,20 +2828,22 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         Require(!selectedPipeline->SplitsFaces() && !selectedPipeline->SplitsSecondChannel(), "stencil replay refuses pipeline face or channel splits");
         stencilReplay.emplace_back(reference, std::move(selectedPipeline));
     }
-    auto pipeline = stencilReplay.empty() ? CachedPipeline(context, pipelineState, inputs.VertexLayout(), *resources, shaders, lean ? VK_IMAGE_LAYOUT_GENERAL : VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL) : stencilReplay.front().second;
+    auto& pipeline = prepared.pipeline;
+    pipeline = stencilReplay.empty() ? CachedPipeline(context, pipelineState, inputs.VertexLayout(), *resources, shaders, lean ? VK_IMAGE_LAYOUT_GENERAL : VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL) : stencilReplay.front().second;
     // Resident targets' views are stable while their storage image lives, so the framebuffer is
     // reused with the pipeline; a per-draw RenderTarget gets a framebuffer of its own.
-    std::vector<std::shared_ptr<StorageTexture>> owners;
+    auto& owners = prepared.owners;
     owners.reserve(targets.size());
-    std::vector<std::shared_ptr<void>> framebufferOwners;
+    auto& framebufferOwners = prepared.framebufferOwners;
     framebufferOwners.reserve(targets.size());
     for (const auto& binding : targets) {
         owners.push_back(binding.resident);
         framebufferOwners.push_back(binding.multisampled ? binding.multisampleOwner : binding.resident);
     }
-    auto framebuffer = pipeline->AcquireFramebuffer(targetViews, framebufferOwners, state.renderExtent, state.renderLayers);
-    std::vector<SampleOrderTarget> reordered;
-    SampleOrderPass reorderPass;
+    auto& framebuffer = prepared.framebuffer;
+    framebuffer = pipeline->AcquireFramebuffer(targetViews, framebufferOwners, state.renderExtent, state.renderLayers);
+    auto& reordered = prepared.reordered;
+    auto& reorderPass = prepared.reorderPass;
     if (pipeline->ReordersSamples()) {
         reorderPass = SampleOrderPassFor(context, pipelineState, pipeline->HostSampleOrder());
         for (const auto& step : PlanSampleOrder(context, state, pipeline->HostSampleOrder())) {
@@ -2517,9 +2852,50 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
             Require(reordered.back().method == step.method, "a reordered attachment's surface disagrees with the planned way of putting its samples in order");
         }
     }
-    const auto depthLocations = passDepthLocations(context, pipelineState, *pipeline);
+    prepared.depthLocations = passDepthLocations(context, pipelineState, *pipeline);
     timer.phase(PhasePipeline);
     APS5_LOG_CHARS_OUT_DEBUG("Pipeline created");
+    return true;
+}
+
+void recordPreparedDraw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, PreparedDraw& prepared) {
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    static const bool traceDraws = std::getenv("APS5_TRACE_DRAWS") != nullptr;
+    static AgcDriver::Mutex dumpMutex;
+    static std::map<std::uint64_t, int> dumped;
+    auto& timing = *prepared.timing;
+    auto& timer = prepared.timer;
+    auto& outcome = prepared.outcome;
+    const auto* built = prepared.built;
+    const auto waitedBefore = prepared.waitedBefore;
+    auto& ownWaitedMs = prepared.ownWaitedMs;
+    const auto report = [&](const char* suffix) { reportDrawEnd(state, timer, built, outcome, waitedBefore, ownWaitedMs, suffix); };
+    auto* recipeOut = prepared.recipeOut;
+    const auto& stencilReferences = prepared.stencilReferences;
+    auto& inputs = prepared.inputs;
+    const auto* args = prepared.args;
+    const int dumpLimit = prepared.dumpLimit;
+    auto& targets = prepared.targets;
+    const auto& targetViews = prepared.targetViews;
+    auto* recorder = prepared.recorder;
+    auto& resolved = prepared.resolved;
+    auto& resources = resolved.resources;
+    const auto& contentKey = resolved.contentKey;
+    const bool cacheable = resolved.cacheable;
+    auto& indirect = prepared.indirect;
+    const bool completion = prepared.completion;
+    const bool listed = prepared.listed;
+    const bool recorded = prepared.recorded;
+    const bool lean = prepared.lean;
+    const bool multisampled = prepared.multisampled;
+    const auto& masked = prepared.masked;
+    const auto& stencilReplay = prepared.stencilReplay;
+    const auto& pipeline = prepared.pipeline;
+    const auto& owners = prepared.owners;
+    const auto& framebuffer = prepared.framebuffer;
+    const auto& reordered = prepared.reordered;
+    const auto& reorderPass = prepared.reorderPass;
+    const auto& depthLocations = prepared.depthLocations;
     if (lean) {
         RecordedDraw record;
         record.recorder = recorder;
@@ -2545,7 +2921,7 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         record.reordered = reordered;
         record.reorderPass = reorderPass;
         record.depthLocations = depthLocations;
-        recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs);
+        recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs, prepared.trace);
         // The recipe for the caller's draw-cache entry (design_cpu_final M8, rule R3 for draws):
         // only a template the resource cache serves under this content key (reusable: no lease,
         // no copied writes, every direct region import- or mirror-served) of a direct draw, so a
@@ -2634,6 +3010,8 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_VERTEX_INPUT_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT, VK_ACCESS_VERTEX_ATTRIBUTE_READ_BIT);
         countBarrier();
     }
+    const auto pixelLdsSubgroup = PixelFunctionLdsSubgroup(shaders);
+    if (pixelLdsSubgroup != 0u) PreparePixelFunctionLds(context, commands, pixelLdsSubgroup);
     std::shared_ptr<Buffer> meshArguments;
     if (state.stages.mesh && args != nullptr) {
         meshArguments = recordMeshArguments(context, commands, recorder, recorded, state, draw, indirect, countBarrier, inputs.restartTable);
@@ -2675,21 +3053,23 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
     pipeline->Begin(commands, *framebuffer, state.renderExtent, state);
     APS5_LOG_CHARS_OUT_DEBUG("Pipeline Begin OK");
     resources->Bind(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline->Layout());
+    if (pixelLdsSubgroup != 0u) BindPixelFunctionLds(context, commands, pipeline->Layout());
     APS5_LOG_CHARS_OUT_DEBUG("Resources bound");
     pushDrawConstants(*pipeline, commands, state, draw, shaders, *resources, nullptr, 0, meshArguments != nullptr ? meshArguments->DeviceAddress() : 0, !inputs.restartTable.empty());
     APS5_LOG_CHARS_OUT_DEBUG("Push constants recorded");
-    if (stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset);
+    std::uint32_t subdraw = 0;
+    if (stencilReplay.empty()) recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset, prepared.trace, subdraw);
     else {
         recordStencilReplay(context, commands, state, draw, inputs, stencilReplay, shaders, *resources);
         if (recorded) for (const auto& [reference, selectedPipeline] : stencilReplay) recorder->Keep(selectedPipeline);
     }
     if (pipeline->SplitsFaces()) {
         pipeline->ContinueBackFaces(commands, state);
-        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset, prepared.trace, subdraw);
     }
     if (pipeline->SplitsSecondChannel()) {
         pipeline->ContinueSecondChannel(commands);
-        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset);
+        recordDrawCommands(context, commands, state, draw, inputs, args != nullptr ? &indirect : nullptr, argumentBuffer, argumentOffset, prepared.trace, subdraw);
     }
     if (meshArguments != nullptr && recorded) recorder->Keep(meshArguments);
     if (args != nullptr) CountIndirectDraw(indirect.path, indirect.readMs, rewritten);
@@ -2844,7 +3224,19 @@ void Draw(const Context& context, const State& state, const Pm4::DrawParameters&
     APS5_LOG_CHARS_OUT_DEBUG("Draw finished");
 }
 
-DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe) {
+}
+
+void Draw(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, std::shared_ptr<const DrawRecipe>* recipeOut, const DrawTraceContext* trace) {
+    const DepthCopySourceScope depthCopySource(state.depthCopySource);
+    static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+    PreparedDraw prepared(profile);
+    prepared.recipeOut = recipeOut;
+    prepared.trace = trace;
+    if (prepareDraw(context, state, draw, shaders, snapshots, prepared)) recordPreparedDraw(context, state, draw, shaders, prepared);
+}
+
+DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, const Pm4::DrawParameters& draw, std::span<const CompiledShader> shaders, std::span<const GuestMemorySnapshot> snapshots, const DrawRecipe& recipe, const DrawTraceContext* trace) {
+    const DepthCopySourceScope depthCopySource(state.depthCopySource);
     if (context.recorder != nullptr) context.recorder->BoundKeptBytes();
     static_cast<void>(snapshots);
     PerformanceTimer timing("Graphics.DrawWithRecipe");
@@ -2866,7 +3258,7 @@ DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, con
     };
     Require(!draw.indirect, "a draw recipe covers direct draws only");
     auto* recorder = Recorder::Active();
-    if (state.quadList || !RecordDraws() || recorder == nullptr || DumpTargetLimit() != 0) return miss(DrawRecipeMiss::NotRecordable);
+    if (state.quadList || StripPatches(state, shaders) || !RecordDraws() || recorder == nullptr || DumpTargetLimit() != 0) return miss(DrawRecipeMiss::NotRecordable);
     if (recipe.hasDepth != state.depth.has_value()) return miss(DrawRecipeMiss::TargetGone);
     const std::size_t expectedViews = state.colors.size() + (recipe.hasDepth ? 1u : 0u);
     Require(recipe.targets.size() == state.colors.size() && recipe.targetViews.size() == expectedViews, "draw recipe targets do not match the state");
@@ -2885,6 +3277,7 @@ DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, con
     targets.reserve(recipe.targets.size());
     for (std::size_t index = 0; index < recipe.targets.size(); ++index) {
         timer.phase(PhaseSetup);
+        if (state.colors[index].fmaskAddress != 0) GuardOneFragmentFmask(context, state.colors[index]);
         auto stored = recipe.targets[index].lock();
         if (stored == nullptr || !StorageImageCached(context, stored.get()) || !StorageImageServesKeys(*stored, state.colors[index].dccAddress)) return miss(DrawRecipeMiss::TargetGone);
         auto resident = refreshResidentTarget(context, state, state.colors[index], outcome, profile, [&] {
@@ -2899,6 +3292,7 @@ DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, con
     if (recipe.hasDepth) {
         timer.phase(PhaseSetup);
         const auto depthView = DepthSurfaceView(context, *state.depth, state.depthWrite);
+        if (writesDepthTarget(state)) NoteDepthSurfaceWrite(context, *state.depth);
         timer.phase(PhaseReadTarget);
         if (recipe.targetViews.back() != depthView) return miss(DrawRecipeMiss::TargetGone);
     }
@@ -2951,7 +3345,7 @@ DrawRecipeOutcome DrawWithRecipe(const Context& context, const State& state, con
     record.pushBytes = &recipe.pushBytes;
     record.pushStages = recipe.pushStages;
     record.depthLocations = passDepthLocations(context, state, *record.pipeline);
-    recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs);
+    recordDraw(context, state, draw, shaders, inputs, record, outcome, timer, ownWaitedMs, trace);
     if (profile) {
         result.recordUs = std::chrono::duration<double, std::micro>(std::chrono::steady_clock::now() - recordStart).count();
         auto& stats = Profile();
@@ -2974,10 +3368,24 @@ std::shared_ptr<StorageTexture> metadataPassResident(const Context& context, con
 
 }
 
-void RunDepthCopyPass(const Context& context, const DepthCopyPass& pass) {
-    Require(pass.color.tileMode != ColorTileMode::Linear && context.detiler != nullptr, "DB depth copy into a target without a resident image is not implemented");
-    const auto resident = CachedStorageSurface(context, SurfaceForTarget(pass.color));
-    CopyDepthSample(context, pass.depthAddress, pass.samples, pass.sample, *resident, resident->StorageView(0, false), pass.extent);
+std::vector<std::pair<std::uint64_t, std::uint64_t>> PipelinedColorMetadataPassWrites(const ColorMetadataPass& pass) {
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> writes;
+    if (pass.mode == ColorMetadataPass::Mode::Resolve) {
+        if (!pass.source.has_value() || pass.targets.size() != 1) return writes;
+        const auto& destination = pass.targets.front();
+        if (destination.samples != 1u || destination.bytes == 0 || destination.cmaskAddress != 0) return writes;
+        writes.emplace_back(destination.address, destination.address + destination.bytes);
+        if (destination.dccAddress != 0) writes.emplace_back(destination.dccAddress, destination.dccAddress + std::max<std::size_t>(colorKeyCount(destination, destination.bytes), 1u));
+        return writes;
+    }
+    if (pass.mode != ColorMetadataPass::Mode::EliminateFastClear && pass.mode != ColorMetadataPass::Mode::DccDecompress) return writes;
+    for (const auto& color : pass.targets) {
+        if (color.samples != 1u || color.bytes == 0) return {};
+        writes.emplace_back(color.address, color.address + color.bytes);
+        if (color.cmaskAddress != 0) writes.emplace_back(color.cmaskAddress, color.cmaskAddress + std::max<std::size_t>(color.cmaskBytes, 1u));
+        if (color.dccAddress != 0) writes.emplace_back(color.dccAddress, color.dccAddress + std::max<std::size_t>(colorKeyCount(color, color.bytes), 1u));
+    }
+    return writes;
 }
 
 void RunColorMetadataPass(const Context& context, const ColorMetadataPass& pass) {
@@ -3024,4 +3432,13 @@ void RunColorMetadataPass(const Context& context, const ColorMetadataPass& pass)
     }
 }
 
+bool DrawPipelineEnabled() {
+    static const bool enabled = std::getenv("APS5_DRAW_PIPELINE") != nullptr;
+    return enabled;
+}
+
+bool CommitTrims() {
+    return DrawPipelineEnabled();
+}
+
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp
new file mode 100644
index 0000000000..3a33f8bc0d
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp
@@ -0,0 +1,252 @@
+#include "prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/shaders/FirstSampleFloat_spv.h"
+#include "prx/libSceAgcDriver/Graphics/shaders/FirstSampleSint_spv.h"
+#include "prx/libSceAgcDriver/Graphics/shaders/FirstSampleUint_spv.h"
+#include "prx/libSceAgcDriver/Graphics/shaders/PresentationPassVert_spv.h"
+#include <memory>
+#include <span>
+
+namespace AgcDriver::Graphics {
+namespace {
+
+bool sintFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R8_SINT: case VK_FORMAT_R8G8_SINT: case VK_FORMAT_R8G8B8A8_SINT: case VK_FORMAT_B8G8R8A8_SINT:
+        case VK_FORMAT_A8B8G8R8_SINT_PACK32: case VK_FORMAT_A2B10G10R10_SINT_PACK32: case VK_FORMAT_R16_SINT: case VK_FORMAT_R16G16_SINT:
+        case VK_FORMAT_R16G16B16A16_SINT: case VK_FORMAT_R32_SINT: case VK_FORMAT_R32G32_SINT: case VK_FORMAT_R32G32B32A32_SINT:
+            return true;
+        default: return false;
+    }
+}
+
+bool uintFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R8_UINT: case VK_FORMAT_R8G8_UINT: case VK_FORMAT_R8G8B8A8_UINT: case VK_FORMAT_B8G8R8A8_UINT:
+        case VK_FORMAT_A8B8G8R8_UINT_PACK32: case VK_FORMAT_A2R10G10B10_UINT_PACK32: case VK_FORMAT_A2B10G10R10_UINT_PACK32: case VK_FORMAT_R16_UINT:
+        case VK_FORMAT_R16G16_UINT: case VK_FORMAT_R16G16B16A16_UINT: case VK_FORMAT_R32_UINT: case VK_FORMAT_R32G32_UINT: case VK_FORMAT_R32G32B32A32_UINT:
+            return true;
+        default: return false;
+    }
+}
+
+std::span<const std::uint32_t> fragmentCode(VkFormat format) {
+    if (sintFormat(format)) return FIRST_SAMPLE_SINT_SPV;
+    if (uintFormat(format)) return FIRST_SAMPLE_UINT_SPV;
+    return FIRST_SAMPLE_FLOAT_SPV;
+}
+
+struct DescriptorPool {
+    DescriptorPool(const Context& context, VkDescriptorPool pool) : context(context), pool(pool) {}
+    ~DescriptorPool() { context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr); }
+    DescriptorPool(const DescriptorPool&) = delete;
+    DescriptorPool& operator=(const DescriptorPool&) = delete;
+    Context context;
+    VkDescriptorPool pool;
+};
+
+}
+
+FirstSampleCopy::FirstSampleCopy(const Context& context, VkFormat format, VkExtent2D extent) : context(context), extent(extent) {
+    try {
+        VkImageCreateInfo imageInfo{VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO};
+        imageInfo.imageType = VK_IMAGE_TYPE_2D;
+        imageInfo.format = format;
+        imageInfo.extent = {extent.width, extent.height, 1};
+        imageInfo.mipLevels = 1;
+        imageInfo.arrayLayers = 1;
+        imageInfo.samples = VK_SAMPLE_COUNT_1_BIT;
+        imageInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+        imageInfo.usage = VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT | VK_IMAGE_USAGE_SAMPLED_BIT;
+        imageInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
+        imageInfo.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+        Check(context.Function<PFN_vkCreateImage>("vkCreateImage")(context.device, &imageInfo, nullptr, &image), "vkCreateImage first sample");
+        VkMemoryRequirements requirements{};
+        context.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(context.device, image, &requirements);
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = requirements.size;
+        allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
+        memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory first sample");
+        Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory first sample");
+        VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
+        viewInfo.image = image;
+        viewInfo.viewType = VK_IMAGE_VIEW_TYPE_2D;
+        viewInfo.format = format;
+        viewInfo.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+        Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &view), "vkCreateImageView first sample");
+
+        VkSamplerCreateInfo samplerInfo{VK_STRUCTURE_TYPE_SAMPLER_CREATE_INFO};
+        samplerInfo.magFilter = VK_FILTER_NEAREST;
+        samplerInfo.minFilter = VK_FILTER_NEAREST;
+        samplerInfo.mipmapMode = VK_SAMPLER_MIPMAP_MODE_NEAREST;
+        samplerInfo.addressModeU = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
+        samplerInfo.addressModeV = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
+        samplerInfo.addressModeW = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
+        Check(context.Function<PFN_vkCreateSampler>("vkCreateSampler")(context.device, &samplerInfo, nullptr, &sampler), "vkCreateSampler first sample");
+        VkDescriptorSetLayoutBinding binding{};
+        binding.binding = 0;
+        binding.descriptorType = VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER;
+        binding.descriptorCount = 1;
+        binding.stageFlags = VK_SHADER_STAGE_FRAGMENT_BIT;
+        binding.pImmutableSamplers = &sampler;
+        VkDescriptorSetLayoutCreateInfo descriptorInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+        descriptorInfo.bindingCount = 1;
+        descriptorInfo.pBindings = &binding;
+        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &descriptorInfo, nullptr, &descriptorLayout), "vkCreateDescriptorSetLayout first sample");
+        VkPipelineLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
+        layoutInfo.setLayoutCount = 1;
+        layoutInfo.pSetLayouts = &descriptorLayout;
+        Check(context.Function<PFN_vkCreatePipelineLayout>("vkCreatePipelineLayout")(context.device, &layoutInfo, nullptr, &pipelineLayout), "vkCreatePipelineLayout first sample");
+
+        VkAttachmentDescription attachment{};
+        attachment.format = format;
+        attachment.samples = VK_SAMPLE_COUNT_1_BIT;
+        attachment.loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
+        attachment.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
+        attachment.stencilLoadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
+        attachment.stencilStoreOp = VK_ATTACHMENT_STORE_OP_DONT_CARE;
+        attachment.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+        attachment.finalLayout = VK_IMAGE_LAYOUT_GENERAL;
+        const VkAttachmentReference reference{0, VK_IMAGE_LAYOUT_GENERAL};
+        VkSubpassDescription subpass{};
+        subpass.pipelineBindPoint = VK_PIPELINE_BIND_POINT_GRAPHICS;
+        subpass.colorAttachmentCount = 1;
+        subpass.pColorAttachments = &reference;
+        const VkSubpassDependency dependencies[2] = {
+            {VK_SUBPASS_EXTERNAL, 0, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, 0, VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, 0},
+            {0, VK_SUBPASS_EXTERNAL, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT, 0},
+        };
+        VkRenderPassCreateInfo renderPassInfo{VK_STRUCTURE_TYPE_RENDER_PASS_CREATE_INFO};
+        renderPassInfo.attachmentCount = 1;
+        renderPassInfo.pAttachments = &attachment;
+        renderPassInfo.subpassCount = 1;
+        renderPassInfo.pSubpasses = &subpass;
+        renderPassInfo.dependencyCount = 2;
+        renderPassInfo.pDependencies = dependencies;
+        Check(context.Function<PFN_vkCreateRenderPass>("vkCreateRenderPass")(context.device, &renderPassInfo, nullptr, &renderPass), "vkCreateRenderPass first sample");
+        VkFramebufferCreateInfo framebufferInfo{VK_STRUCTURE_TYPE_FRAMEBUFFER_CREATE_INFO};
+        framebufferInfo.renderPass = renderPass;
+        framebufferInfo.attachmentCount = 1;
+        framebufferInfo.pAttachments = &view;
+        framebufferInfo.width = extent.width;
+        framebufferInfo.height = extent.height;
+        framebufferInfo.layers = 1;
+        Check(context.Function<PFN_vkCreateFramebuffer>("vkCreateFramebuffer")(context.device, &framebufferInfo, nullptr, &framebuffer), "vkCreateFramebuffer first sample");
+
+        vertex = CreateShaderModule(context, PRESENTATION_PASS_VERT_SPV, sizeof(PRESENTATION_PASS_VERT_SPV), "vkCreateShaderModule first sample vertex");
+        const auto code = fragmentCode(format);
+        fragment = CreateShaderModule(context, code.data(), code.size_bytes(), "vkCreateShaderModule first sample fragment");
+        VkPipelineShaderStageCreateInfo stages[2]{{VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO}, {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO}};
+        stages[0].stage = VK_SHADER_STAGE_VERTEX_BIT;
+        stages[0].module = vertex;
+        stages[0].pName = "main";
+        stages[1].stage = VK_SHADER_STAGE_FRAGMENT_BIT;
+        stages[1].module = fragment;
+        stages[1].pName = "main";
+        VkPipelineVertexInputStateCreateInfo vertexInput{VK_STRUCTURE_TYPE_PIPELINE_VERTEX_INPUT_STATE_CREATE_INFO};
+        VkPipelineInputAssemblyStateCreateInfo assembly{VK_STRUCTURE_TYPE_PIPELINE_INPUT_ASSEMBLY_STATE_CREATE_INFO};
+        assembly.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+        const VkViewport viewportRect{0.0f, 0.0f, static_cast<float>(extent.width), static_cast<float>(extent.height), 0.0f, 1.0f};
+        const VkRect2D scissor{{0, 0}, extent};
+        VkPipelineViewportStateCreateInfo viewport{VK_STRUCTURE_TYPE_PIPELINE_VIEWPORT_STATE_CREATE_INFO};
+        viewport.viewportCount = 1;
+        viewport.pViewports = &viewportRect;
+        viewport.scissorCount = 1;
+        viewport.pScissors = &scissor;
+        VkPipelineRasterizationStateCreateInfo rasterization{VK_STRUCTURE_TYPE_PIPELINE_RASTERIZATION_STATE_CREATE_INFO};
+        rasterization.polygonMode = VK_POLYGON_MODE_FILL;
+        rasterization.cullMode = VK_CULL_MODE_NONE;
+        rasterization.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+        rasterization.lineWidth = 1.0f;
+        VkPipelineMultisampleStateCreateInfo multisample{VK_STRUCTURE_TYPE_PIPELINE_MULTISAMPLE_STATE_CREATE_INFO};
+        multisample.rasterizationSamples = VK_SAMPLE_COUNT_1_BIT;
+        VkPipelineColorBlendAttachmentState blendAttachment{};
+        blendAttachment.colorWriteMask = VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT;
+        VkPipelineColorBlendStateCreateInfo blend{VK_STRUCTURE_TYPE_PIPELINE_COLOR_BLEND_STATE_CREATE_INFO};
+        blend.attachmentCount = 1;
+        blend.pAttachments = &blendAttachment;
+        VkGraphicsPipelineCreateInfo pipelineInfo{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO};
+        pipelineInfo.stageCount = 2;
+        pipelineInfo.pStages = stages;
+        pipelineInfo.pVertexInputState = &vertexInput;
+        pipelineInfo.pInputAssemblyState = &assembly;
+        pipelineInfo.pViewportState = &viewport;
+        pipelineInfo.pRasterizationState = &rasterization;
+        pipelineInfo.pMultisampleState = &multisample;
+        pipelineInfo.pColorBlendState = &blend;
+        pipelineInfo.layout = pipelineLayout;
+        pipelineInfo.renderPass = renderPass;
+        Check(context.Function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines")(context.device, VK_NULL_HANDLE, 1, &pipelineInfo, nullptr, &pipeline), "vkCreateGraphicsPipelines first sample");
+    } catch (...) {
+        release();
+        throw;
+    }
+}
+
+FirstSampleCopy::~FirstSampleCopy() {
+    release();
+}
+
+void FirstSampleCopy::release() noexcept {
+    if (pipeline) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, pipeline, nullptr);
+    if (fragment) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, fragment, nullptr);
+    if (vertex) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, vertex, nullptr);
+    if (framebuffer) context.Function<PFN_vkDestroyFramebuffer>("vkDestroyFramebuffer")(context.device, framebuffer, nullptr);
+    if (renderPass) context.Function<PFN_vkDestroyRenderPass>("vkDestroyRenderPass")(context.device, renderPass, nullptr);
+    if (pipelineLayout) context.Function<PFN_vkDestroyPipelineLayout>("vkDestroyPipelineLayout")(context.device, pipelineLayout, nullptr);
+    if (descriptorLayout) context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(context.device, descriptorLayout, nullptr);
+    if (sampler) context.Function<PFN_vkDestroySampler>("vkDestroySampler")(context.device, sampler, nullptr);
+    if (view) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, view, nullptr);
+    if (image) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, image, nullptr);
+    if (memory) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+    pipeline = VK_NULL_HANDLE;
+    fragment = vertex = VK_NULL_HANDLE;
+    framebuffer = VK_NULL_HANDLE;
+    renderPass = VK_NULL_HANDLE;
+    pipelineLayout = VK_NULL_HANDLE;
+    descriptorLayout = VK_NULL_HANDLE;
+    sampler = VK_NULL_HANDLE;
+    view = VK_NULL_HANDLE;
+    image = VK_NULL_HANDLE;
+    memory = VK_NULL_HANDLE;
+}
+
+void FirstSampleCopy::Record(Recorder& recorder, VkImageView source, VkImageLayout layout) {
+    const VkDescriptorPoolSize size{VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER, 1};
+    VkDescriptorPoolCreateInfo poolInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO};
+    poolInfo.maxSets = 1;
+    poolInfo.poolSizeCount = 1;
+    poolInfo.pPoolSizes = &size;
+    VkDescriptorPool created = VK_NULL_HANDLE;
+    Check(context.Function<PFN_vkCreateDescriptorPool>("vkCreateDescriptorPool")(context.device, &poolInfo, nullptr, &created), "vkCreateDescriptorPool first sample");
+    const auto pool = std::make_shared<DescriptorPool>(context, created);
+    VkDescriptorSetAllocateInfo allocation{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_ALLOCATE_INFO};
+    allocation.descriptorPool = pool->pool;
+    allocation.descriptorSetCount = 1;
+    allocation.pSetLayouts = &descriptorLayout;
+    VkDescriptorSet set = VK_NULL_HANDLE;
+    Check(context.Function<PFN_vkAllocateDescriptorSets>("vkAllocateDescriptorSets")(context.device, &allocation, &set), "vkAllocateDescriptorSets first sample");
+    const VkDescriptorImageInfo imageInfo{VK_NULL_HANDLE, source, layout};
+    VkWriteDescriptorSet write{VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET};
+    write.dstSet = set;
+    write.dstBinding = 0;
+    write.descriptorCount = 1;
+    write.descriptorType = VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER;
+    write.pImageInfo = &imageInfo;
+    context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, 1, &write, 0, nullptr);
+    recorder.Keep(pool);
+    recorder.RecordUncounted([&](VkCommandBuffer commands) {
+        VkRenderPassBeginInfo begin{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
+        begin.renderPass = renderPass;
+        begin.framebuffer = framebuffer;
+        begin.renderArea = {{0, 0}, extent};
+        context.Resolved(&DeviceFunctions::cmdBeginRenderPass, "vkCmdBeginRenderPass")(commands, &begin, VK_SUBPASS_CONTENTS_INLINE);
+        context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
+        context.Function<PFN_vkCmdBindDescriptorSets>("vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipelineLayout, 0, 1, &set, 0, nullptr);
+        context.Function<PFN_vkCmdDraw>("vkCmdDraw")(commands, 3, 1, 0, 0);
+        context.Resolved(&DeviceFunctions::cmdEndRenderPass, "vkCmdEndRenderPass")(commands);
+    });
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
index 074681e607..12939ea058 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
@@ -1,10 +1,13 @@
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "ThreadOwned.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/SnapshotCopies.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BdaResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ResidentMirror.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/UnitShadow.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
@@ -12,6 +15,7 @@
 #include "prx/libc/include/CpuTopology.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
 #include "prx/libc/include/general/AtomicSharedPtr.hpp"
 #ifdef _WIN32
 #include <windows.h>
@@ -71,6 +75,9 @@ struct ImageMirror {
     std::vector<std::uint64_t> generations;
     std::weak_ptr<const GuestAllocations::Range> range;
     std::shared_ptr<Buffer> buffer;
+    std::shared_ptr<ResidentBuffer> resident;
+    std::uint64_t accounted = 0;
+    bool listed = false;
     // Writable ranges only: the guest bytes the mirror holds, compared on refresh and at write-back.
     std::vector<std::byte> shadow;
     // Identity for the life of this mirror (see ImageMirrorSerial); the top bit keeps mirror serials
@@ -116,7 +123,7 @@ struct GuestBufferMemory::AddressSpace {
     // The BDA table entries of `base`, in its order.
     std::vector<ShaderRecompiler::BdaAbi::Range> ranges;
     std::shared_ptr<const std::vector<std::pair<std::uint64_t, std::uint64_t>>> directReads;
-    mutable std::mutex tableMutex;
+    mutable AgcDriver::Mutex tableMutex;
     struct Table {
         std::uint64_t serial;
         std::shared_ptr<const std::vector<ShaderRecompiler::BdaAbi::Range>> ranges;
@@ -227,7 +234,7 @@ struct ImportSettle {
 // Imports persist across draws, keyed by allocation base, and are dropped when their allocation leaves
 // the registered set; a dropped import is destroyed once the recorded work that may read it completed.
 struct HostImports {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     VkDevice device = VK_NULL_HANDLE;
     PFN_vkDestroyBuffer destroyBuffer = nullptr;
     PFN_vkFreeMemory freeMemory = nullptr;
@@ -238,6 +245,7 @@ struct HostImports {
     std::map<std::uint64_t, ImportFailure> failedJoins;
     std::map<std::uint64_t, std::uint64_t> sparseRunEnds;
     std::map<std::uint64_t, std::uint32_t> sparseRunJoins;
+    std::set<std::pair<std::uint64_t, std::size_t>> importedAtMap;
     std::map<std::pair<std::uint64_t, std::uint64_t>, ImportFailure> failedBlocks;
     std::map<std::pair<std::uint64_t, std::uint64_t>, ImportRefusal> refusals;
     std::map<std::pair<std::uint64_t, std::uint64_t>, EvictingRefusal> evictingRefusals;
@@ -286,7 +294,7 @@ HostImports& Imports() {
 
 #ifdef _WIN32
 void waitSettleBatch(const ImportSettle& settle, VkDevice device, const SettleBatch& batch) {
-    if (batch.busy && settle.waitForFences != nullptr) static_cast<void>(settle.waitForFences(device, 1, &batch.fence, VK_TRUE, 10'000'000'000ull));
+    if (batch.busy && settle.waitForFences != nullptr) Check(settle.waitForFences(device, 1, &batch.fence, VK_TRUE, 60'000'000'000ull), "vkWaitForFences (settle batch)");
 }
 
 bool settleBatchRunning(const ImportSettle& settle, VkDevice device, const SettleBatch& batch) {
@@ -582,7 +590,7 @@ struct ImportChunk {
 };
 
 struct ImportChunks {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     VkDevice device = VK_NULL_HANDLE;
     std::map<std::tuple<dev_t, ino_t, std::uint64_t>, std::weak_ptr<ImportChunk>> chunks;
 };
@@ -980,7 +988,7 @@ const char* prepareSettleBatch(const Context& context, ImportSettle& settle, Set
     }
     if (batch.commands == VK_NULL_HANDLE) {
         VkCommandBufferAllocateInfo allocate{VK_STRUCTURE_TYPE_COMMAND_BUFFER_ALLOCATE_INFO};
-        allocate.commandPool = context.settlePool;
+        allocate.commandPool = context.pool;
         allocate.level = VK_COMMAND_BUFFER_LEVEL_PRIMARY;
         allocate.commandBufferCount = 1;
         if ((result = context.Function<PFN_vkAllocateCommandBuffers>("vkAllocateCommandBuffers")(context.device, &allocate, &batch.commands)) != VK_SUCCESS) {
@@ -1030,9 +1038,7 @@ void submitSettleBatch(const Context& context, HostImports& state) {
     begin.flags = VK_COMMAND_BUFFER_USAGE_ONE_TIME_SUBMIT_BIT;
     if ((result = context.Function<PFN_vkBeginCommandBuffer>("vkBeginCommandBuffer")(batch.commands, &begin)) != VK_SUCCESS) return fail("vkBeginCommandBuffer (settle batch)");
     const auto copy = context.Resolved(&DeviceFunctions::cmdCopyBuffer, "vkCmdCopyBuffer");
-    const bool otherFamily = context.settleFamily != context.queueFamily;
-    const auto createBuffer = otherFamily ? context.Function<PFN_vkCreateBuffer>("vkCreateBuffer") : nullptr;
-    const auto bindBufferMemory = otherFamily ? context.Function<PFN_vkBindBufferMemory>("vkBindBufferMemory") : nullptr;
+    RecordMemoryBarrier(context, batch.commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
     std::size_t consumed = 0;
     for (; consumed < state.settleWanted.size() && batch.bases.size() < settleBatchCopies; ++consumed) {
         const auto base = state.settleWanted[consumed];
@@ -1043,38 +1049,19 @@ void submitSettleBatch(const Context& context, HostImports& state) {
             state.pendingSettles.erase(settle);
             continue;
         }
-        VkBuffer source = import->second.buffer;
-        if (otherFamily) {
-            VkExternalMemoryBufferCreateInfo external{VK_STRUCTURE_TYPE_EXTERNAL_MEMORY_BUFFER_CREATE_INFO};
-            external.handleTypes = VK_EXTERNAL_MEMORY_HANDLE_TYPE_HOST_ALLOCATION_BIT_EXT;
-            VkBufferCreateInfo aliasInfo{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO, &external};
-            aliasInfo.size = std::min<VkDeviceSize>(import->second.bytes, 65536);
-            aliasInfo.usage = VK_BUFFER_USAGE_TRANSFER_SRC_BIT;
-            VkBuffer alias = VK_NULL_HANDLE;
-            if (createBuffer(context.device, &aliasInfo, nullptr, &alias) != VK_SUCCESS) {
-                state.pendingSettles.erase(settle);
-                continue;
-            }
-            if (bindBufferMemory(context.device, alias, import->second.memory, 0) != VK_SUCCESS) {
-                destroyBuffer(context.device, alias, nullptr);
-                state.pendingSettles.erase(settle);
-                continue;
-            }
-            batch.aliases.push_back(alias);
-            source = alias;
-        }
         const VkBufferCopy region{0, (VkDeviceSize{index} * settleBatchCopies + batch.bases.size()) * 4u, 4};
-        copy(batch.commands, source, deviceSettle.batchTarget, 1, &region);
+        copy(batch.commands, import->second.buffer, deviceSettle.batchTarget, 1, &region);
         settle->second = PendingSettle{SettlePhase::Submitted, index, context.device};
         batch.bases.push_back(base);
     }
     state.settleWanted.erase(state.settleWanted.begin(), state.settleWanted.begin() + static_cast<std::ptrdiff_t>(consumed));
+    RecordMemoryBarrier(context, batch.commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_WRITE_BIT);
     if ((result = context.Function<PFN_vkEndCommandBuffer>("vkEndCommandBuffer")(batch.commands)) != VK_SUCCESS) return fail("vkEndCommandBuffer (settle batch)");
     if (batch.bases.empty()) return;
     VkSubmitInfo submit{VK_STRUCTURE_TYPE_SUBMIT_INFO};
     submit.commandBufferCount = 1;
     submit.pCommandBuffers = &batch.commands;
-    if ((result = context.Function<PFN_vkQueueSubmit>("vkQueueSubmit")(context.settleQueue, 1, &submit, batch.fence)) != VK_SUCCESS) return fail("vkQueueSubmit (settle batch)");
+    if ((result = context.Function<PFN_vkQueueSubmit>("vkQueueSubmit")(context.queue, 1, &submit, batch.fence)) != VK_SUCCESS) return fail("vkQueueSubmit (settle batch)");
     batch.busy = true;
     state.settlesSubmitted += batch.bases.size();
 }
@@ -1255,9 +1242,45 @@ bool stillRefused(const HostImports& state, const ImportRefusal* refusal, std::u
     return refusal != nullptr && budget != 0 && budget <= refusal->budget && state.liveBytes >= refusal->liveBytes;
 }
 
-ImportRun importRun(const GuestAllocations::Lease& lease, std::uint64_t address, std::uint64_t largest = std::numeric_limits<std::uint64_t>::max(), std::uint64_t budget = 0) {
+struct RunBounds {
+    std::size_t first = 0;
+    std::size_t last = 0;
+    bool found = false;
+};
+
+std::pair<std::size_t, std::size_t> walkRun(const GuestAllocations::Lease& lease, std::size_t index, std::uint64_t low, std::uint64_t high) {
+    auto first = index;
+    while (first > 0 && lease[first - 1]->address >= low && continuesRun(*lease[first - 1], *lease[first])) --first;
+    auto last = index;
+    while (last + 1 < lease.size() && lease[last + 1]->address + lease[last + 1]->bytes <= high && continuesRun(*lease[last], *lease[last + 1])) ++last;
+    return {first, last};
+}
+
+std::pair<std::size_t, std::size_t> continuedRun(const GuestAllocations::Lease& lease, std::size_t index, std::uint64_t window, std::uint64_t low, std::uint64_t high) {
+    static const bool memo = std::getenv("APS5_NO_RUN_MEMO") == nullptr;
+    if (!memo) return walkRun(lease, index, low, high);
+    struct Memo {
+        std::weak_ptr<const GuestAllocations::Lease::Ranges> snapshot;
+        std::size_t index = 0;
+        std::uint64_t window = 0;
+        std::uint64_t low = 0;
+        std::pair<std::size_t, std::size_t> run;
+    };
+    struct MemoStorage {};
+    auto& memos = HostThreadLocal<std::array<Memo, 1024>, MemoStorage>();
+    const auto& snapshot = lease.Snapshot();
+    const auto block = window != 0 ? low / window : 0;
+    const auto slot = (reinterpret_cast<std::uintptr_t>(snapshot.get()) / 16u ^ index * 0x9e3779b1u ^ block * 0x85ebca6bu) % memos.size();
+    auto& entry = memos[slot];
+    if (!entry.snapshot.owner_before(snapshot) && !snapshot.owner_before(entry.snapshot) && entry.index == index && entry.window == window && entry.low == low) return entry.run;
+    entry = Memo{snapshot, index, window, low, walkRun(lease, index, low, high)};
+    return entry.run;
+}
+
+RunBounds importRunBounds(const GuestAllocations::Lease& lease, std::uint64_t address, std::uint64_t largest = std::numeric_limits<std::uint64_t>::max(), std::uint64_t budget = 0) {
     const auto index = leasedIndexContaining(lease, address);
     if (index == lease.size()) return {};
+    const RunBounds single{index, index, true};
     const auto& containing = *lease[index];
     const auto& state = Imports();
     const auto window = importWindow.load(std::memory_order_relaxed);
@@ -1266,14 +1289,11 @@ ImportRun importRun(const GuestAllocations::Lease& lease, std::uint64_t address,
     if (window != 0) {
         low = address / window * window;
         high = low + window;
-        if (containing.address < low || containing.address + containing.bytes > high) return leasedRun(lease, index, index);
+        if (containing.address < low || containing.address + containing.bytes > high) return single;
     }
-    auto first = index;
-    while (first > 0 && lease[first - 1]->address >= low && continuesRun(*lease[first - 1], *lease[first])) --first;
-    auto last = index;
-    while (last + 1 < lease.size() && lease[last + 1]->address + lease[last + 1]->bytes <= high && continuesRun(*lease[last], *lease[last + 1])) ++last;
+    const auto [first, last] = continuedRun(lease, index, window, low, high);
     const auto skipped = [&](std::size_t from, std::size_t to) { return rememberedRun(state.failedBlocks, lease, from, to) != nullptr || stillRefused(state, rememberedRun(state.refusals, lease, from, to), budget); };
-    if (window == 0) return first == last || lease[last]->address + lease[last]->bytes - lease[first]->address > largest || skipped(first, last) ? leasedRun(lease, index, index) : leasedRun(lease, first, last);
+    if (window == 0) return first == last || lease[last]->address + lease[last]->bytes - lease[first]->address > largest || skipped(first, last) ? single : RunBounds{first, last, true};
     const auto bounding = [&](std::size_t from, std::size_t to, std::uint64_t value, bool start) {
         const auto found = std::lower_bound(lease.begin() + static_cast<std::ptrdiff_t>(from), lease.begin() + static_cast<std::ptrdiff_t>(to) + 1, value, [start](const auto& range, std::uint64_t wanted) { return (start ? range->address : range->address + range->bytes) < wanted; });
         const auto position = static_cast<std::size_t>(found - lease.begin());
@@ -1290,9 +1310,23 @@ ImportRun importRun(const GuestAllocations::Lease& lease, std::uint64_t address,
         if (blockFirst == lease.size() || blockLast == lease.size()) continue;
         if (blockFirst == blockLast) break;
         if (skipped(blockFirst, blockLast)) continue;
-        return leasedRun(lease, blockFirst, blockLast);
+        return {blockFirst, blockLast, true};
     }
-    return leasedRun(lease, index, index);
+    return single;
+}
+
+ImportRun importRun(const GuestAllocations::Lease& lease, std::uint64_t address, std::uint64_t largest = std::numeric_limits<std::uint64_t>::max(), std::uint64_t budget = 0) {
+    const auto bounds = importRunBounds(lease, address, largest, budget);
+    return bounds.found ? leasedRun(lease, bounds.first, bounds.last) : ImportRun{};
+}
+
+template<typename Entry>
+bool sameRun(const Entry& entry, const GuestAllocations::Lease& lease, const RunBounds& bounds) {
+    if (!bounds.found || lease[bounds.first]->address != entry.base || lease[bounds.last]->address + lease[bounds.last]->bytes - entry.base != entry.bytes || bounds.last - bounds.first + 1 != entry.ranges.size()) return false;
+    for (std::size_t index = 0; index < entry.ranges.size(); ++index) {
+        if (entry.ranges[index].owner_before(lease[bounds.first + index]) || lease[bounds.first + index].owner_before(entry.ranges[index])) return false;
+    }
+    return true;
 }
 
 ImportRun exactRun(const GuestAllocations::Lease& lease, std::uint64_t base, std::uint64_t bytes) {
@@ -1307,8 +1341,8 @@ ImportRun exactRun(const GuestAllocations::Lease& lease, std::uint64_t base, std
 }
 
 bool runCovers(const GuestAllocations::Lease& lease, std::uint64_t begin, std::uint64_t end) {
-    const auto run = importRun(lease, begin);
-    return !run.ranges.empty() && end <= run.base + run.bytes;
+    const auto bounds = importRunBounds(lease, begin);
+    return bounds.found && end <= lease[bounds.last]->address + lease[bounds.last]->bytes;
 }
 
 ImportRun crossedRun(const GuestAllocations::Lease& lease, std::uint64_t begin, std::uint64_t end) {
@@ -1331,7 +1365,7 @@ ImportRun joinedRun(const GuestAllocations::Lease& lease, std::uint64_t begin, s
     auto run = crossedRun(lease, begin, end);
     if (run.ranges.empty()) return run;
     if (std::all_of(run.ranges.begin(), run.ranges.end(), [window](const auto& range) { return range->bytes > window; })) return run;
-    if (begin == run.base && end == run.base + run.bytes) return run;
+    if (begin == run.base) return run;
     return {};
 }
 
@@ -1363,7 +1397,7 @@ bool wouldRetireImport(const HostImports& state, const ImportRun& run) {
 bool sameRange(const ImportFailure& entry, const GuestAllocations::Lease& lease, std::uint64_t budget = 0) {
     const auto current = entry.ranges.size() == 1 ? leasedRangeOwner(lease, entry.base, entry.base + entry.bytes) : nullptr;
     if (current != nullptr && entry.bytes < current->bytes) return !entry.ranges.front().owner_before(current) && !current.owner_before(entry.ranges.front());
-    return sameRun(entry, importRun(lease, entry.base, std::numeric_limits<std::uint64_t>::max(), budget));
+    return sameRun(entry, lease, importRunBounds(lease, entry.base, std::numeric_limits<std::uint64_t>::max(), budget));
 }
 
 bool sameRange(const HostImport& entry, const GuestAllocations::Lease& lease, std::uint64_t budget = 0) {
@@ -1371,7 +1405,8 @@ bool sameRange(const HostImport& entry, const GuestAllocations::Lease& lease, st
         const auto current = leasedRangeOwner(lease, entry.base, entry.base + entry.bytes);
         return current != nullptr && !entry.ranges.front().owner_before(current) && !current.owner_before(entry.ranges.front());
     }
-    return sameRun(entry, entry.joined ? joinedRun(lease, entry.base, entry.base + entry.bytes) : importRun(lease, entry.base, std::numeric_limits<std::uint64_t>::max(), budget));
+    if (entry.joined) return sameRun(entry, joinedRun(lease, entry.base, entry.base + entry.bytes));
+    return sameRun(entry, lease, importRunBounds(lease, entry.base, std::numeric_limits<std::uint64_t>::max(), budget));
 }
 
 std::uint64_t effectiveUse(const HostImports& state, const HostImport& entry) {
@@ -1491,20 +1526,29 @@ std::string budgetSource(const Context& context, const HostImports& state, std::
 }
 
 std::atomic<std::uint64_t> rangeImportWindow{64ull << 20u};
+std::atomic<std::uint64_t> importMaxBytes{0};
 
 // The import of an access to a registered range larger than the range window: the cells the access touches, grown to
 // the union of the range's imports it overlaps, so accesses across neighbouring cell edges share one import instead of
 // replacing each other's.
-ImportRun windowRun(const HostImports& state, ImportRun run, std::uint64_t begin, std::uint64_t end, std::uint64_t alignment) {
+std::optional<std::pair<std::uint64_t, std::uint64_t>> importWindowBounds(const GuestAllocations::Range& range, std::uint64_t begin, std::uint64_t end, std::uint64_t alignment) {
     const auto window = rangeImportWindow.load(std::memory_order_relaxed);
-    if (run.ranges.size() != 1 || window == 0 || alignment == 0 || window % alignment != 0) return run;
-    const auto& range = *run.ranges.front();
-    if (range.bytes <= window || begin < range.address || end > range.address + range.bytes || end <= begin) return run;
+    if (window == 0 || alignment == 0 || window % alignment != 0 || range.bytes <= window || begin < range.address || end > range.address + range.bytes || end <= begin) return std::nullopt;
     const auto lastCell = range.bytes / window - 1;
     const auto cell = [&](std::uint64_t address) { return std::min((address - range.address) / window, lastCell); };
-    auto windowBegin = range.address + cell(begin) * window;
+    const auto windowBegin = range.address + cell(begin) * window;
     const auto endCell = cell(end - 1);
-    auto windowEnd = endCell == lastCell ? range.address + range.bytes : range.address + (endCell + 1) * window;
+    const auto windowEnd = endCell == lastCell ? range.address + range.bytes : range.address + (endCell + 1) * window;
+    if (windowBegin % alignment != 0 || (windowEnd - windowBegin) % alignment != 0) return std::nullopt;
+    return std::pair{windowBegin, windowEnd};
+}
+
+ImportRun windowRun(const HostImports& state, ImportRun run, std::uint64_t begin, std::uint64_t end, std::uint64_t alignment) {
+    if (run.ranges.size() != 1) return run;
+    const auto& range = *run.ranges.front();
+    const auto bounds = importWindowBounds(range, begin, end, alignment);
+    if (!bounds) return run;
+    auto [windowBegin, windowEnd] = *bounds;
     for (bool grown = true; grown;) {
         grown = false;
         auto it = state.imports.upper_bound(windowBegin);
@@ -1579,31 +1623,99 @@ const HostImport* importAllocation(const Context& context, HostImports& state, s
         }
     }
     const auto budget = evict ? 0 : effectiveBudget(context, state);
-    if (const auto index = leasedIndexContaining(lease, address); budget != 0 && index != lease.size() && stillRefused(state, rememberedRun(state.refusals, lease, index, index), budget) && findImport(state, address, address + 1) == nullptr) {
+    const auto index = leasedIndexContaining(lease, address);
+    const auto windowBounds = index != lease.size() && end != 0 ? importWindowBounds(*lease[index], address, end, context.hostImportAlignment) : std::nullopt;
+    const bool complete = !windowBounds || (windowBounds->first == lease[index]->address && windowBounds->second == lease[index]->address + lease[index]->bytes);
+    if (budget != 0 && index != lease.size() && complete && stillRefused(state, rememberedRun(state.refusals, lease, index, index), budget) && findImport(state, address, address + 1) == nullptr) {
         auto& counts = state.counts[static_cast<std::size_t>(requester)];
         ++counts.refused;
         counts.refusedBytes += lease[index]->bytes;
         ++counts.remembered;
         return nullptr;
     }
-    auto run = importRun(lease, address, largest, budget);
+    const auto bounds = importRunBounds(lease, address, largest, budget);
     // Without an end the caller views the whole run through the import (AcquireRegistered): a window that holds the
     // first byte is shorter than that, so only an import of the whole run is a hit; a window is replaced below.
     if (fresh && end == 0) {
-        if (const auto* current = findImport(state, address, run.ranges.empty() ? address + 1 : run.base + run.bytes)) return current;
+        if (const auto* current = findImport(state, address, bounds.found ? lease[bounds.last]->address + lease[bounds.last]->bytes : address + 1)) return current;
     }
+    auto run = bounds.found ? leasedRun(lease, bounds.first, bounds.last) : ImportRun{};
     if (end != 0) run = windowRun(state, std::move(run), address, end, context.hostImportAlignment);
     if (run.ranges.empty()) return nullptr;
     return importRunAt(context, state, std::move(run), false, address, lease, end, evict, requester);
 }
 
+struct ImportPiece {
+    std::uint64_t begin;
+    std::uint64_t end;
+    const HostImport* entry;
+};
+
+std::vector<ImportPiece> importPieces(const Context& context, HostImports& state, const GuestAllocations::Range& range, const GuestAllocations::Lease& lease) {
+    const auto limit = importMaxBytes.load(std::memory_order_relaxed);
+    const auto window = rangeImportWindow.load(std::memory_order_relaxed);
+    const auto alignment = context.hostImportAlignment;
+    if (limit < 2 * window || window == 0 || alignment == 0 || window % alignment != 0 || range.address % alignment != 0) return {};
+    const auto step = (limit / window - 1) * window;
+    const auto end = range.address + range.bytes;
+    std::vector<ImportPiece> pieces;
+    for (auto cursor = range.address; cursor < end;) {
+        const auto wanted = end - cursor < step + window ? end : cursor + step;
+        const auto* entry = importAllocation(context, state, cursor, lease, ImportRequester::Build, wanted, false);
+        if (entry == nullptr || entry->base > cursor || entry->bytes > limit) return {};
+        const auto to = std::min(end, entry->base + entry->bytes);
+        if (to <= cursor) return {};
+        pieces.push_back({cursor, to, entry});
+        cursor = to;
+    }
+    return pieces;
+}
+
+std::vector<ImportPiece> budgetedImportPieces(const Context& context, HostImports& state, const GuestAllocations::Range& range, const GuestAllocations::Lease& lease) {
+    const auto window = rangeImportWindow.load(std::memory_order_relaxed);
+    const auto alignment = context.hostImportAlignment;
+    if (!range.releasable || !GuestMemory::Watched(range.address, range.bytes) || window == 0 || alignment == 0 || window % alignment != 0 || range.address % alignment != 0 || range.bytes <= window) return {};
+    const auto end = range.address + range.bytes;
+    std::vector<ImportPiece> pieces;
+    for (auto cursor = range.address; cursor < end;) {
+        const HostImport* entry = nullptr;
+        if (const auto* previous = peekImport(state, cursor, cursor + 1); previous != nullptr && previous->base >= range.address && previous->base + previous->bytes <= end) {
+            entry = importAllocation(context, state, cursor, lease, ImportRequester::Build, std::min(end, previous->base + previous->bytes), false);
+        }
+        if (entry == nullptr) {
+            const auto budget = effectiveBudget(context, state);
+            auto room = budget - std::min(budget, state.liveBytes);
+            if (const auto limit = importMaxBytes.load(std::memory_order_relaxed); limit != 0) room = std::min(room, limit);
+            if (room < window) break;
+            auto wanted = cursor + std::min(end - cursor, window);
+            if (const auto bounds = importWindowBounds(range, cursor, wanted, alignment); bounds && bounds->second - bounds->first > room) {
+                wanted = range.address + (range.bytes / window - 1) * window;
+                if (wanted <= cursor) break;
+            }
+            entry = importAllocation(context, state, cursor, lease, ImportRequester::Build, wanted, false);
+        }
+        if (entry == nullptr || entry->base > cursor) break;
+        const auto to = std::min(end, entry->base + entry->bytes);
+        if (to <= cursor) break;
+        pieces.push_back({cursor, to, entry});
+        cursor = to;
+    }
+    if (pieces.empty()) return {};
+    if (pieces.back().end != end) pieces.push_back({pieces.back().end, end, nullptr});
+    return pieces;
+}
+
 const HostImport* importJoined(const Context& context, HostImports& state, std::uint64_t begin, std::uint64_t end, const GuestAllocations::Lease& lease) {
     if (const auto* low = peekImport(state, begin, begin + 1); low != nullptr && low->joined) begin = low->base;
     if (const auto* high = peekImport(state, end - 1, end); high != nullptr && high->joined) end = high->base + high->bytes;
     auto run = joinedRun(lease, begin, end);
     if (run.ranges.empty()) return nullptr;
     if (const auto failed = state.failedJoins.find(run.base); failed != state.failedJoins.end() && sameRun(failed->second, run)) return nullptr;
-    return importRunAt(context, state, std::move(run), true, begin, lease, end, true, ImportRequester::Join);
+    const auto existing = state.imports.find(run.base);
+    const bool existed = existing != state.imports.end() && sameRun(existing->second, run);
+    const auto* entry = importRunAt(context, state, std::move(run), true, begin, lease, end, true, ImportRequester::Join);
+    if (entry != nullptr && !existed) ++state.epoch;
+    return entry;
 }
 
 const HostImport* importRunAt(const Context& context, HostImports& state, ImportRun run, bool joined, std::uint64_t address, const GuestAllocations::Lease& lease, std::uint64_t end, bool evict, ImportRequester requester) {
@@ -1622,6 +1734,7 @@ const HostImport* importRunAt(const Context& context, HostImports& state, Import
         return &found->second;
     }
     if (alignment == 0 || base % alignment != 0 || bytes % alignment != 0) return nullptr;
+    if (const auto limit = importMaxBytes.load(std::memory_order_relaxed); limit != 0 && bytes > limit) return nullptr;
     if (const auto failed = failures.find(base); !stepDown && failed != failures.end()) {
         if (sameRun(failed->second, run)) return nullptr;
         failures.erase(failed);
@@ -1888,6 +2001,7 @@ void refreshImports(const Context& context, HostImports& state, const GuestAlloc
         state.reportNoted = 0;
         state.sparseRunEnds.clear();
         state.sparseRunJoins.clear();
+        state.importedAtMap.clear();
         state.device = context.device;
         state.destroyBuffer = context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer");
         state.freeMemory = context.Function<PFN_vkFreeMemory>("vkFreeMemory");
@@ -1955,7 +2069,7 @@ bool importsStale(const Context& context, const HostImports& state) {
 // GuestMemory::GpuMutex only (every completion and every stage B holds it). APS5_NO_LEASE_MIRROR=1
 // restores copies.
 struct ImageMirrors {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     VkDevice device = VK_NULL_HANDLE;
     std::map<std::uint64_t, std::shared_ptr<ImageMirror>> entries;
     std::set<std::uint64_t> failed;
@@ -2001,7 +2115,7 @@ AddressBuildTiming& ThreadAddressTiming() {
 }
 
 struct AddressBuildTotals {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::uint64_t builds = 0;
     AddressBuildTiming sums;
     double snapshotsUs = 0;
@@ -2020,26 +2134,7 @@ ImageMirrors& Mirrors() {
     return mirrors;
 }
 
-struct SnapshotCopies {
-    using Key = std::tuple<std::uint64_t, std::size_t, VkBufferUsageFlags>;
-    static constexpr std::size_t Budget = std::size_t{16} << 20u;
-    static constexpr std::size_t MaxEntries = 1024;
-    std::mutex mutex;
-    VkDevice device = VK_NULL_HANDLE;
-    struct Entry {
-        std::shared_ptr<Buffer> buffer;
-        std::vector<std::byte> bytes;
-        std::list<Key>::iterator recent;
-    };
-    std::map<Key, Entry> entries;
-    std::list<Key> recency;
-    std::size_t bytes = 0;
-    void clear() {
-        entries.clear();
-        recency.clear();
-        bytes = 0;
-    }
-};
+using SnapshotCopies = Detail::SnapshotCopies;
 
 SnapshotCopies& SnapshotCopyCache() {
     static SnapshotCopies copies;
@@ -2050,7 +2145,7 @@ std::shared_ptr<Buffer> snapshotCopy(const Context& context, std::uint64_t addre
     auto& copies = SnapshotCopyCache();
     std::lock_guard lock(copies.mutex);
     if (copies.device != context.device) {
-        copies.clear();
+        copies.Clear();
         copies.device = context.device;
     }
     const SnapshotCopies::Key key{address, bytes.size(), usage};
@@ -2072,9 +2167,7 @@ std::shared_ptr<Buffer> snapshotCopy(const Context& context, std::uint64_t addre
         copies.entries.erase(oldest);
         copies.recency.pop_front();
     }
-    copies.recency.push_back(key);
-    copies.entries.emplace(key, SnapshotCopies::Entry{buffer, {bytes.begin(), bytes.end()}, std::prev(copies.recency.end())});
-    copies.bytes += bytes.size();
+    copies.Insert(key, buffer, bytes);
     return buffer;
 }
 
@@ -2091,25 +2184,104 @@ std::uint64_t heapMirrorBudget() {
     return bytes;
 }
 
-std::string heapMirrorError(const GuestAllocations::Range& range, std::uint64_t held, std::string_view reason) {
+std::string heapMirrorError(std::uint64_t address, std::uint64_t bytes, std::uint64_t held, std::string_view reason) {
     constexpr std::string_view prefix = "AGC graphics: ";
     if (reason.starts_with(prefix)) reason.remove_prefix(prefix.size());
     char where[64];
-    std::snprintf(where, sizeof(where), "heap mirror of 0x%llx+0x%llx: ", static_cast<unsigned long long>(range.address), static_cast<unsigned long long>(range.bytes));
+    std::snprintf(where, sizeof(where), "heap mirror of 0x%llx+0x%llx: ", static_cast<unsigned long long>(address), static_cast<unsigned long long>(bytes));
     char holding[96];
     std::snprintf(holding, sizeof(holding), "; heap mirrors hold %llu MiB of %llu MiB (APS5_HEAP_MIRROR_MIB)", static_cast<unsigned long long>(held >> 20u), static_cast<unsigned long long>(heapMirrorBudget() >> 20u));
     return std::string(prefix) + where + std::string(reason) + holding;
 }
 
-std::uint64_t heapMirrorsBeside(const GuestAllocations::Range& range) {
-    auto& state = Mirrors();
-    std::lock_guard lock(state.mutex);
-    std::uint64_t held = state.heapBytes;
-    if (const auto found = state.entries.find(range.address); found != state.entries.end() && found->second->heap) held -= found->second->bytes;
-    return held;
+void sweepMirrors();
+
+void unlistMirror(ImageMirrors& state, ImageMirror& mirror) {
+    if (!mirror.listed) return;
+    state.heapBytes -= mirror.accounted;
+    mirror.listed = false;
 }
 
-void sweepMirrors();
+std::uint64_t blockBytes(const GuestRuns& runs) {
+    constexpr std::uint64_t block = ResidentBuffer::BlockBytes;
+    std::uint64_t blocks = 0;
+    std::uint64_t last = 0;
+    bool any = false;
+    for (const auto& [first, end] : runs) {
+        if (first >= end) continue;
+        auto index = first / block;
+        if (any && index == last) ++index;
+        if (index <= (end - 1) / block) blocks += (end - 1) / block - index + 1;
+        last = (end - 1) / block;
+        any = true;
+    }
+    return blocks * block;
+}
+
+void reserveHeapBytes(std::uint64_t address, std::uint64_t bytes, std::uint64_t need) {
+    auto& state = Mirrors();
+    for (int attempt = 0;; ++attempt) {
+        {
+            std::lock_guard lock(state.mutex);
+            std::uint64_t held = state.heapBytes;
+            if (const auto found = state.entries.find(address); found != state.entries.end() && found->second->heap && found->second->listed) held -= found->second->accounted;
+            if (held + need <= heapMirrorBudget()) {
+                state.heapBytes += need;
+                return;
+            }
+            if (attempt != 0) throw std::runtime_error(heapMirrorError(address, bytes, held, "past the budget"));
+        }
+        sweepMirrors();
+    }
+}
+
+void growResident(ImageMirror& mirror, const GuestRuns& runs) {
+    if (mirror.resident == nullptr) return;
+    const auto need = mirror.resident->UnboundBytes(runs);
+    if (need == 0) return;
+    auto& state = Mirrors();
+    bool counted = false;
+    for (int attempt = 0; !counted; ++attempt) {
+        {
+            std::lock_guard lock(state.mutex);
+            if (!mirror.listed) break;
+            if (state.heapBytes + need <= heapMirrorBudget()) {
+                state.heapBytes += need;
+                mirror.accounted += need;
+                counted = true;
+                break;
+            }
+            if (attempt != 0) throw std::runtime_error(heapMirrorError(mirror.base, mirror.reserved, state.heapBytes, "past the budget"));
+        }
+        sweepMirrors();
+    }
+    try {
+        mirror.resident->Bind(runs);
+    } catch (const std::runtime_error& error) {
+        std::uint64_t held = 0;
+        {
+            std::lock_guard lock(state.mutex);
+            if (counted && mirror.listed) {
+                state.heapBytes -= need;
+                mirror.accounted -= need;
+            }
+            held = state.heapBytes;
+        }
+        throw std::runtime_error(heapMirrorError(mirror.base, mirror.reserved, held, error.what()));
+    }
+}
+
+std::uint64_t mirrorStart(const ImageMirror& mirror) {
+    return mirror.resident != nullptr ? mirror.resident->Origin() : mirror.base;
+}
+
+VkBuffer mirrorHandle(const ImageMirror& mirror) {
+    return mirror.resident != nullptr ? mirror.resident->Handle() : mirror.buffer->Handle();
+}
+
+VkDeviceAddress mirrorAddress(const ImageMirror& mirror) {
+    return mirror.resident != nullptr ? mirror.resident->DeviceAddress() : mirror.buffer->DeviceAddress();
+}
 
 bool sameRange(const std::weak_ptr<const GuestAllocations::Range>& mirrored, const std::shared_ptr<const GuestAllocations::Range>& range) {
     return !mirrored.owner_before(range) && !range.owner_before(mirrored);
@@ -2131,6 +2303,16 @@ constexpr std::uint8_t SparseZero = 2;
 bool compareBlock(const RefreshBlock& block) {
     const auto offset = static_cast<std::size_t>(block.address - block.mirror->base);
     const auto* guest = reinterpret_cast<const std::byte*>(block.address);
+    if (block.mirror->resident != nullptr) {
+        auto* target = block.mirror->resident->Block(block.address);
+        if (block.fill == SparseZero) {
+            if (target != nullptr) std::memset(target, 0, block.length);
+            return true;
+        }
+        if (target != nullptr) std::memcpy(target, guest, block.length);
+        if (block.fill == 0) block.mirror->generations[static_cast<std::size_t>(block.address / 65536 - block.mirror->base / 65536)] = block.generation;
+        return target != nullptr;
+    }
     if (block.fill != 0) {
         auto* target = block.mirror->buffer->Bytes().data() + offset;
         if (block.fill == SparseZero) std::memset(target, 0, block.length);
@@ -2228,7 +2410,7 @@ private:
 
     inline static RefreshPool* instance = nullptr;
     unsigned helpers = 0;
-    std::mutex runMutex;
+    AgcDriver::Mutex runMutex;
     std::mutex mutex;
     std::condition_variable_any wake;
     std::condition_variable done;
@@ -2282,9 +2464,33 @@ void appendBlocks(std::vector<RefreshBlock>& blocks, ImageMirror& mirror, std::u
 }
 
 // Compares the gathered blocks (of one or many mirrors) and counts them.
+void bindHeapBlocks(std::span<const RefreshBlock> blocks) {
+    std::vector<std::pair<ImageMirror*, GuestRuns>> wanted;
+    for (const auto& block : blocks) {
+        if (block.mirror->resident == nullptr || block.fill == SparseZero) continue;
+        if (block.mirror->resident->Block(block.address) == nullptr && GuestBytesZero(block.address, block.address + block.length)) continue;
+        if (wanted.empty() || wanted.back().first != block.mirror) {
+            const auto found = std::find_if(wanted.begin(), wanted.end(), [&](const auto& entry) { return entry.first == block.mirror; });
+            if (found == wanted.end()) wanted.emplace_back(block.mirror, GuestRuns{});
+            else std::rotate(found, std::next(found), wanted.end());
+        }
+        auto& runs = wanted.back().second;
+        if (!runs.empty() && runs.back().second == block.address) runs.back().second = block.address + block.length;
+        else runs.emplace_back(block.address, block.address + block.length);
+    }
+    for (auto& [mirror, runs] : wanted) {
+        std::sort(runs.begin(), runs.end());
+        growResident(*mirror, runs);
+    }
+}
+
 void compareBlocks(std::span<const RefreshBlock> blocks) {
     if (blocks.empty()) return;
+    bindHeapBlocks(blocks);
     const auto copied = RefreshPool::Get().Run(blocks);
+    for (const auto& block : blocks) {
+        if (block.mirror->resident != nullptr && block.mirror->resident->Block(block.address) != nullptr) block.mirror->resident->MarkChanged(block.address, block.address + block.length);
+    }
     auto& state = Mirrors();
     state.blocksCompared += blocks.size();
     state.blocksCopied += copied;
@@ -2505,44 +2711,52 @@ bool importsNow(const Context& context, HostImports& state, const GuestAllocatio
 // The mirror for a leased image range: the existing one, or a new one when none exists or the
 // registered Range object changed (a protection change). Null when the range cannot be mirrored. An
 // existing writable mirror's blocks are appended to `blocks` for the caller's one compare of every
-std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::shared_ptr<const GuestAllocations::Range>& range, std::vector<RefreshBlock>& blocks, bool heap) {
+std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::shared_ptr<const GuestAllocations::Range>& range, std::vector<RefreshBlock>& blocks, bool heap, std::uint64_t begin = 0, std::uint64_t bytes = 0) {
+    auto selected = *range;
+    if (bytes != 0) {
+        Require(begin >= range->address && bytes <= range->bytes && begin - range->address <= range->bytes - bytes, "heap mirror selection exceeds its registered range");
+        selected.address = begin;
+        selected.bytes = static_cast<std::size_t>(bytes);
+    }
     auto& state = Mirrors();
     std::shared_ptr<ImageMirror> mirror;
     {
         std::lock_guard lock(state.mutex);
         if (state.device != context.device) {
+            for (auto& [base, entry] : state.entries) entry->listed = false;
             state.entries.clear();
             state.failed.clear();
             state.heapBytes = 0;
             state.device = context.device;
             ++state.version;
         }
-        if (state.failed.contains(range->address)) return nullptr;
-        const auto found = state.entries.find(range->address);
-        if (found != state.entries.end() && sameRange(found->second->range, range) && found->second->reserved == range->bytes && found->second->writable == range->writable && found->second->heap == heap) mirror = found->second;
+        if (state.failed.contains(selected.address)) return nullptr;
+        const auto found = state.entries.find(selected.address);
+        if (found != state.entries.end() && sameRange(found->second->range, range) && found->second->reserved == selected.bytes && found->second->writable == range->writable && found->second->heap == heap) mirror = found->second;
     }
     if (mirror != nullptr) {
         if (!mirror->sparse) {
-            if (!heap && prepareRefresh(*mirror, range->address, range->bytes)) appendBlocks(blocks, *mirror, range->address, range->bytes);
+            if (!heap && prepareRefresh(*mirror, selected.address, selected.bytes)) appendBlocks(blocks, *mirror, selected.address, selected.bytes);
             return mirror;
         }
         if (refreshSparseMirror(*mirror, blocks)) return mirror;
     }
     Pieces pieces;
-    if (!GuestMemory::Accessible(reinterpret_cast<const void*>(range->address), range->bytes, range->writable && !heap)) {
+    if (!GuestMemory::Accessible(reinterpret_cast<const void*>(selected.address), selected.bytes, range->writable && !heap)) {
         if (!heap || !sparseMirrorsEnabled()) return nullptr;
-        pieces = GuestMemory::DescribeCommitted(range->address, range->bytes).ranges;
+        pieces = GuestMemory::DescribeCommitted(selected.address, selected.bytes).ranges;
         if (pieces.empty()) return nullptr;
     }
     const bool sparse = !pieces.empty();
     mirror = std::make_shared<ImageMirror>();
-    mirror->base = range->address;
-    mirror->bytes = sparse ? sparseExtent(range->address, range->bytes, pieces) : range->bytes;
-    mirror->reserved = range->bytes;
+    mirror->base = selected.address;
+    mirror->bytes = sparse ? sparseExtent(selected.address, selected.bytes, pieces) : selected.bytes;
+    mirror->reserved = selected.bytes;
     mirror->sparse = sparse;
     mirror->writable = range->writable;
     mirror->heap = heap;
     mirror->range = range;
+    GuestRuns backed;
     if (heap) {
         std::uint64_t generation = 0;
         const auto serial = GuestMemory::UnwatchSerial();
@@ -2550,8 +2764,8 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
             syncRange(mirror->base, mirror->bytes);
             if (GuestMemory::Watched(mirror->base, static_cast<std::size_t>(mirror->bytes))) generation = collectPieces(pieces);
         } else {
-            prepareRefresh(*mirror, range->address, range->bytes);
-            generation = GuestMemory::CollectWrites(range->address, range->bytes);
+            prepareRefresh(*mirror, selected.address, selected.bytes);
+            generation = GuestMemory::CollectWrites(selected.address, selected.bytes);
         }
         constexpr std::uint64_t block = 65536;
         mirror->generations.assign(static_cast<std::size_t>(((mirror->base + mirror->bytes + block - 1) / block) - mirror->base / block), generation);
@@ -2559,8 +2773,8 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
             std::shared_ptr<ImageMirror> stale;
             std::lock_guard lock(state.mutex);
             ++state.heapUnwatched;
-            if (const auto found = state.entries.find(range->address); found != state.entries.end() && found->second->heap) {
-                state.heapBytes -= found->second->bytes;
+            if (const auto found = state.entries.find(selected.address); found != state.entries.end() && found->second->heap) {
+                unlistMirror(state, *found->second);
                 stale = std::move(found->second);
                 state.entries.erase(found);
                 ++state.version;
@@ -2568,18 +2782,67 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
             return nullptr;
         }
         mirror->watchedSerial.store(serial, std::memory_order_relaxed);
-        if (heapMirrorsBeside(*range) + mirror->bytes > heapMirrorBudget()) {
-            sweepMirrors();
-            if (const auto held = heapMirrorsBeside(*range); held + mirror->bytes > heapMirrorBudget()) throw std::runtime_error(heapMirrorError(*range, held, "past the budget"));
+        if (context.sparseBinding && context.sparseResidencyBuffer && context.sparseResidencyAliased) backed = GuestNonzeroBlocks(sparse ? clipPieces(pieces, mirror->base, mirror->base + mirror->bytes) : GuestRuns{{mirror->base, mirror->base + mirror->bytes}});
+        auto need = blockBytes(backed);
+        reserveHeapBytes(selected.address, selected.bytes, need);
+        try {
+            mirror->resident = ResidentBuffer::Create(context, mirror->base, mirror->bytes, backed);
+        } catch (const std::runtime_error& error) {
+            std::uint64_t held = 0;
+            {
+                std::lock_guard lock(state.mutex);
+                state.heapBytes -= need;
+                held = state.heapBytes;
+            }
+            throw std::runtime_error(heapMirrorError(selected.address, selected.bytes, held, error.what()));
         }
+        if (mirror->resident == nullptr) {
+            {
+                std::lock_guard lock(state.mutex);
+                state.heapBytes -= need;
+            }
+            need = mirror->bytes;
+            reserveHeapBytes(selected.address, selected.bytes, need);
+        }
+        mirror->accounted = need;
+    }
+    if (mirror->resident != nullptr) {
+        {
+            const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::MirrorRefresh);
+            for (const auto& [first, last] : backed) {
+                for (auto at = first; at < last;) {
+                    const auto next = std::min(last, (at / ResidentBuffer::BlockBytes + 1) * ResidentBuffer::BlockBytes);
+                    GuestMemory::Read(at, std::span<std::byte>(mirror->resident->Block(at), static_cast<std::size_t>(next - at)));
+                    at = next;
+                }
+                mirror->resident->MarkChanged(first / ResidentBuffer::BlockBytes * ResidentBuffer::BlockBytes, (last + ResidentBuffer::BlockBytes - 1) / ResidentBuffer::BlockBytes * ResidentBuffer::BlockBytes);
+            }
+        }
+        mirror->committed = std::move(pieces);
+        std::lock_guard lock(state.mutex);
+        ++state.rebuilds;
+        mirror->serial = (1ull << 63u) | ++state.serials;
+        if (const auto found = state.entries.find(selected.address); found != state.entries.end() && found->second->heap) unlistMirror(state, *found->second);
+        mirror->listed = true;
+        state.entries[selected.address] = mirror;
+        ++state.version;
+        return mirror;
     }
     try {
         mirror->buffer = std::make_shared<Buffer>(context, static_cast<std::size_t>(mirror->bytes), VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_SHADER_DEVICE_ADDRESS_BIT);
     } catch (const std::runtime_error& error) {
-        if (heap) throw std::runtime_error(heapMirrorError(*range, heapMirrorsBeside(*range), error.what()));
-        std::fprintf(stderr, "[gpu] image mirror of 0x%llx+0x%llx failed: %s; falling back to copies\n", static_cast<unsigned long long>(range->address), static_cast<unsigned long long>(range->bytes), error.what());
+        if (heap) {
+            std::uint64_t held = 0;
+            {
+                std::lock_guard lock(state.mutex);
+                state.heapBytes -= mirror->accounted;
+                held = state.heapBytes;
+            }
+            throw std::runtime_error(heapMirrorError(selected.address, selected.bytes, held, error.what()));
+        }
+        std::fprintf(stderr, "[gpu] image mirror of 0x%llx+0x%llx failed: %s; falling back to copies\n", static_cast<unsigned long long>(selected.address), static_cast<unsigned long long>(selected.bytes), error.what());
         std::lock_guard lock(state.mutex);
-        state.failed.insert(range->address);
+        state.failed.insert(selected.address);
         return nullptr;
     }
     // Read stores GPU results pending in the range first (write-backs of earlier copies of it);
@@ -2587,7 +2850,7 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
     {
         const GuestMemory::ReadSiteScope site(GuestMemory::ReadSite::MirrorRefresh);
         const auto target = mirror->buffer->Bytes().first(static_cast<std::size_t>(mirror->bytes));
-        if (!sparse) GuestMemory::Read(range->address, target);
+        if (!sparse) GuestMemory::Read(selected.address, target);
         std::size_t cursor = 0;
         for (const auto& [first, last] : pieces) {
             const auto at = static_cast<std::size_t>(first - mirror->base);
@@ -2603,9 +2866,9 @@ std::shared_ptr<ImageMirror> acquireMirror(const Context& context, const std::sh
     ++state.rebuilds;
     mirror->serial = (1ull << 63u) | ++state.serials;
     // A replaced mirror lives on in the regions of recorded work that bound it.
-    if (const auto found = state.entries.find(range->address); found != state.entries.end() && found->second->heap) state.heapBytes -= found->second->bytes;
-    if (heap) state.heapBytes += mirror->bytes;
-    state.entries[range->address] = mirror;
+    if (const auto found = state.entries.find(selected.address); found != state.entries.end() && found->second->heap) unlistMirror(state, *found->second);
+    mirror->listed = heap;
+    state.entries[selected.address] = mirror;
     ++state.version;
     return mirror;
 }
@@ -2640,7 +2903,7 @@ void sweepMirrors() {
             ++it;
             continue;
         }
-        if (it->second->heap) state.heapBytes -= it->second->bytes;
+        if (it->second->heap) unlistMirror(state, *it->second);
         it = state.entries.erase(it);
         ++state.version;
     }
@@ -2648,20 +2911,28 @@ void sweepMirrors() {
     state.pinnedVersion = state.version;
 }
 
-void releaseImportedMirrors(const Context& context, const std::vector<std::uint64_t>& imported) {
+void releaseImportedMirrors(const Context& context, std::span<const std::pair<std::uint64_t, std::uint64_t>> imported) {
     if (imported.empty()) return;
     std::vector<std::shared_ptr<ImageMirror>> released;
     auto& state = Mirrors();
     std::lock_guard lock(state.mutex);
     if (state.device != context.device || state.entries.empty()) return;
-    for (const auto base : imported) {
-        const auto found = state.entries.find(base);
-        if (found == state.entries.end() || !found->second->heap) continue;
-        state.heapBytes -= found->second->bytes;
-        ++state.heapImported;
-        state.heapImportedBytes += found->second->bytes;
-        released.push_back(std::move(found->second));
-        state.entries.erase(found);
+    for (const auto& [begin, end] : imported) {
+        auto it = state.entries.upper_bound(begin);
+        if (it != state.entries.begin()) --it;
+        while (it != state.entries.end() && it->first < end) {
+            const auto& mirror = it->second;
+            if (!mirror->heap || mirror->base + mirror->bytes <= begin) {
+                ++it;
+                continue;
+            }
+            ++state.heapImported;
+            state.heapImportedBytes += mirror->accounted;
+            unlistMirror(state, *mirror);
+            released.push_back(std::move(it->second));
+            it = state.entries.erase(it);
+            ++state.version;
+        }
     }
 }
 
@@ -2709,7 +2980,7 @@ void reportMirrors() {
 // waiter yields instead when its own thread holds the device lock (a driver thread mutating the
 // registry mid-packet, as the plain spin did) and reports whether it finished any work.
 struct LeaseState {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     LeaseStats stats;
     std::chrono::steady_clock::time_point lastReport = std::chrono::steady_clock::now();
     // Under GuestMemory::GpuMutex: the recorder whose batches hold leases (serials restart with a
@@ -2982,6 +3253,18 @@ std::uint64_t SnapshotMismatches() {
     return Snapshots().mismatched.load(std::memory_order_relaxed);
 }
 
+HeapMirrorHold HeapMirrorsWithin(std::uint64_t begin, std::uint64_t end) {
+    auto& state = Mirrors();
+    std::lock_guard lock(state.mutex);
+    HeapMirrorHold hold;
+    for (auto it = state.entries.lower_bound(begin); it != state.entries.end() && it->first < end; ++it) {
+        if (!it->second->heap || it->second->range.expired()) continue;
+        ++hold.mirrors;
+        if (it->second->listed) hold.bytes += it->second->accounted;
+    }
+    return hold;
+}
+
 std::vector<std::uint64_t> AddressTableKey(std::span<const std::pair<std::uint64_t, std::uint64_t>> writes, std::span<const ShaderRecompiler::BdaAbi::Range> own) {
     std::vector<std::uint64_t> key;
     key.reserve(writes.size() * 2u + 1u + own.size() * 4u);
@@ -2995,7 +3278,7 @@ void ClearSnapshotCopies(VkDevice device) {
     auto& copies = SnapshotCopyCache();
     std::lock_guard lock(copies.mutex);
     if (copies.device != device) return;
-    copies.clear();
+    copies.Clear();
     copies.device = VK_NULL_HANDLE;
 }
 
@@ -3010,6 +3293,7 @@ void ClearImageMirrors(VkDevice device) {
         std::lock_guard lock(state.mutex);
         if (state.device != device) return;
         entries.swap(state.entries);
+        for (auto& [base, entry] : entries) entry->listed = false;
         state.failed.clear();
         state.heapBytes = 0;
         state.device = VK_NULL_HANDLE;
@@ -3020,6 +3304,7 @@ void ClearHostImports(VkDevice device) {
     auto& state = Imports();
     std::lock_guard lock(state.mutex);
     state.parked.erase(device);
+    state.importedAtMap.clear();
 #ifdef _WIN32
     if (device == state.device) drainSettles(state);
 #endif
@@ -3282,6 +3567,10 @@ void SetHostImportRangeWindow(std::uint64_t bytes) {
     rangeImportWindow.store(bytes, std::memory_order_relaxed);
 }
 
+void SetHostImportMaxBytes(std::uint64_t bytes) {
+    importMaxBytes.store(bytes, std::memory_order_relaxed);
+}
+
 void SetHostImportBudget(std::uint64_t bytes) {
     budgetOverride.store(bytes, std::memory_order_relaxed);
     auto& state = Imports();
@@ -3441,16 +3730,18 @@ bool ImportMappedRanges(const Context& context, const GuestAllocations::Mapped&
     } else if (state.refreshedGeneration > generation) {
         return true;
     }
-    if (!adopting) current = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
     for (const auto& mapped : ranges) {
         const auto range = mapped.lock();
-        if (range == nullptr || leasedRangeOwner(current, range->address) != range) continue;
+        if (range == nullptr || range->bytes <= 0x10000) continue;
+        if (current.empty()) current = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
+        if (leasedRangeOwner(current, range->address) != range) continue;
         try {
             if (!GuestMemory::GpuMutex().HeldByThisThread()) {
                 const auto run = importRun(current, range->address, std::numeric_limits<std::uint64_t>::max(), effectiveBudget(context, state));
                 const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> span{{{run.base, run.base + run.bytes}}};
                 if (wouldRetireImport(state, run) || StorageTexture::AnyPendingOverlaps(span)) return false;
             }
+            if (!state.importedAtMap.emplace(range->address, range->bytes).second && findImport(state, range->address, range->address + range->bytes) == nullptr) continue;
             importAllocation(context, state, range->address, current, ImportRequester::Map, 0, false);
         } catch (const std::exception& error) {
             std::fprintf(stderr, "[gpu] import of GPU memory mapped at 0x%llx+0x%zx failed: %s\n", static_cast<unsigned long long>(range->address), range->bytes, error.what());
@@ -3635,7 +3926,7 @@ void GuestBufferMemory::AcquireRegistered() {
         // must not happen under it.
         regions.reserve(lease.size());
         std::vector<AddressCopy> copies;
-        std::vector<std::uint64_t> imported;
+        std::vector<std::pair<std::uint64_t, std::uint64_t>> imported;
         const HostImport* covering = nullptr;
         std::uint64_t coveredBegin = 0;
         std::uint64_t coveredEnd = 0;
@@ -3644,8 +3935,14 @@ void GuestBufferMemory::AcquireRegistered() {
             validate(range->address, range->bytes);
             Region region{range->address, range->address + range->bytes, range->writable, {}, nullptr};
             const HostImport* entry = nullptr;
+            std::vector<ImportPiece> pieces;
+            const auto limit = importMaxBytes.load(std::memory_order_relaxed);
             if (importable && covering != nullptr && range->address >= coveredBegin && range->address + range->bytes <= coveredEnd) {
                 entry = covering;
+            } else if (importable && limit != 0 && range->bytes > limit) {
+                auto& state = Imports();
+                std::lock_guard lock(state.mutex);
+                pieces = importPieces(context, state, *range, lease);
             } else if (importable) {
                 auto& state = Imports();
                 std::lock_guard lock(state.mutex);
@@ -3656,13 +3953,41 @@ void GuestBufferMemory::AcquireRegistered() {
                     coveredEnd = entry->base + entry->bytes;
                 }
             }
+            if (importable && mirrorsEnabled() && entry == nullptr && pieces.empty()) {
+                auto& state = Imports();
+                std::lock_guard lock(state.mutex);
+                pieces = budgetedImportPieces(context, state, *range, lease);
+            }
             lap(timing.importsUs, at);
+            if (!pieces.empty()) {
+                const auto firstImported = imported.size();
+                for (const auto& piece : pieces) if (piece.entry != nullptr) imported.emplace_back(piece.begin, piece.end);
+                releaseImportedMirrors(context, std::span(imported).subspan(firstImported));
+                for (const auto& piece : pieces) {
+                    Region part{piece.begin, piece.end, range->writable, {}, nullptr};
+                    if (piece.entry != nullptr) {
+                        part.hostBacked = true;
+                        part.direct = piece.entry;
+                    } else {
+                        part.mirror = acquireMirror(context, range, blocks, true, piece.begin, piece.end - piece.begin);
+                        lap(timing.mirrorsUs, at);
+                        Require(part.mirror != nullptr, "a partial heap import has no mirror for its remaining bytes");
+                        mirrored = true;
+                        if (part.mirror->sparse) {
+                            part.sparse = true;
+                            part.backed = part.mirror->committed;
+                        } else heaps.push_back(part.mirror.get());
+                    }
+                    regions.push_back(std::move(part));
+                }
+                continue;
+            }
             if (entry != nullptr) {
                 region.hostBacked = true;
                 // Reused by Upload while no import was dropped since (see importsEpoch).
                 region.direct = entry;
                 regions.push_back(std::move(region));
-                imported.push_back(range->address);
+                imported.emplace_back(range->address, range->address + range->bytes);
                 continue;
             }
             if (mirrorsEnabled()) {
@@ -3873,6 +4198,11 @@ const GuestBufferMemory::Region* GuestBufferMemory::owner(std::uint64_t address,
 
 namespace {
 
+bool bdaStagingEnabled() {
+    static const bool disabled = std::getenv("APS5_NO_BDA_STAGING") != nullptr;
+    return !disabled;
+}
+
 template<typename Regions>
 bool mirrorOverlaps(const Regions& base, std::uint64_t begin, std::uint64_t end) {
     auto found = std::upper_bound(base.begin(), base.end(), begin, [](std::uint64_t value, const auto& region) { return value < region.begin; });
@@ -3890,12 +4220,18 @@ void GuestBufferMemory::addDescriptorRegion(std::uint64_t address, std::size_t b
     const auto begin = address & ~std::uint64_t{3};
     const auto end = begin == address ? address + bytes : (address + bytes + 3) & ~std::uint64_t{3};
     const Region* inside = nullptr;
+    bool overlay = false;
     switch (baseOverlap(begin, end, &inside)) {
         case BaseOverlap::Inside:
             if (!servesView(*inside, begin)) {
                 dissolveSpace(false);
                 break;
             }
+            if (overlayCandidate(*inside, readOnly) && GuestMemory::DescribeCommitted(begin, static_cast<std::size_t>(end - begin)).whole) {
+                overlay = true;
+                break;
+            }
+            if (bdaStagingEnabled() && stagingAllowed) servedInsideBase.emplace_back(begin, end);
             return;
         case BaseOverlap::Partial:
             if (readOnly && !mirrorOverlaps(space->base, begin, end) && !WritesOverlap(begin, static_cast<std::size_t>(end - begin))) {
@@ -3914,6 +4250,7 @@ void GuestBufferMemory::addDescriptorRegion(std::uint64_t address, std::size_t b
     region.atomic = atomic;
     region.swept = swept;
     region.lastView = begin;
+    region.overlay = overlay;
     auto committed = GuestMemory::DescribeCommitted(begin, static_cast<std::size_t>(end - begin));
     if (!committed.whole) {
         // A GPU heap bound whole while the guest commits its pages on demand, or a descriptor left
@@ -3952,7 +4289,7 @@ bool GuestBufferMemory::bindSparseMirror(Region& region, const GuestAllocations:
         refreshHeapMirrors(whole, blocks);
     }
     compareBlocks(blocks);
-    if (mirror == nullptr || !mirror->heap || region.begin < mirror->base || (region.begin - mirror->base) % context.limits.minStorageBufferOffsetAlignment != 0) return false;
+    if (mirror == nullptr || !mirror->heap || region.begin < mirror->base || (region.begin - mirrorStart(*mirror)) % context.limits.minStorageBufferOffsetAlignment != 0) return false;
     region.mirror = std::move(mirror);
     if (!servesView(region, std::max(region.lastView, region.begin))) {
         region.mirror = nullptr;
@@ -4035,7 +4372,7 @@ void GuestBufferMemory::AddSnapshot(const GuestMemorySnapshot& snapshot) {
             std::snprintf(text, sizeof(text), "guest snapshot differs from registered memory: snapshot 0x%llx+0x%zx (%s region 0x%llx+0x%llx%s%s%s) differs first at +0x%zx", static_cast<unsigned long long>(snapshot.address), snapshot.bytes.size(), live ? "live" : "snapshot-backed", static_cast<unsigned long long>(owner->begin), static_cast<unsigned long long>(owner->end - owner->begin), owner->writable ? ", writable" : "", owner->hostBacked ? ", host-backed" : "", owner->mirror != nullptr ? ", mirrored" : "", first);
             static const bool fatal = std::getenv("APS5_SNAPSHOT_CHECK_FATAL") != nullptr;
             if (!live || fatal) throw std::runtime_error(text);
-            static std::mutex reportMutex;
+            static AgcDriver::Mutex reportMutex;
             static auto lastReport = std::chrono::steady_clock::now() - std::chrono::seconds(60);
             std::lock_guard lock(reportMutex);
             const auto mismatches = Snapshots().mismatched.fetch_add(1, std::memory_order_relaxed) + 1;
@@ -4108,18 +4445,23 @@ VkBufferUsageFlags gpuCopyUsage(bool addressable) {
 // copied back by RecordCopyBacks after the work, with the pending-write note and the direct-write
 // marks of an in-place write. Only builds whose every use records the work and calls
 // RecordCopyBacks take it (dispatches, see AllowDeviceStaging; a synchronous draw would store the
-// staging bytes from the CPU, which a device-local buffer cannot serve), and never address-based
-// ones (their pointers read the import in place, and AddressRanges needs a device address). The
+// staging bytes from the CPU, which a device-local buffer cannot serve). In an address-based build
+// a written element inside one direct import region of the space becomes an overlay region
+// (resolveOverlays), and AddressRanges cuts the import's range around it so that its pointers reach
+// the shadow as its descriptor does. The
 // shadow is per use, not resident: a reused build records its copy-in anew (RecordStagingCopies).
 // Accepted trade-off, as for the misaligned copies above: a CPU write into a staged range between
 // the copy-in and the copy-back is rolled back by the copy-back (the whole written element range,
 // since store extents are not known), for the batch's latency; the staging window keeps the
 // exposure to the elements named on the [buffers] staging line and APS5_TRACE_STAGING.
 // APS5_NO_WRITTEN_SHADOW=1 and APS5_NO_ATOMIC_STAGING=1 bind those elements in place as before;
-// APS5_WRITTEN_SHADOW_MIN_KIB / APS5_WRITTEN_SHADOW_MAX_KIB (16 / 2048) bound the written window
-// (a kernel streaming once through a large buffer, the engine's memcpy kernel over 4-8 MiB video
-// frames, would only gain the two copies), APS5_ATOMIC_STAGE_MAX_KIB (1024) the atomic one.
+// APS5_WRITTEN_SHADOW_MIN_KIB / APS5_WRITTEN_SHADOW_MAX_KIB (16 / 2048, 8192 on a discrete GPU) bound
+// the written window: on an integrated GPU a kernel streaming once through a large buffer (the
+// engine's memcpy kernel over 4-8 MiB video frames) would only gain the two copies, while on a
+// discrete GPU its stores into the host import cross the bus and cost more than the copies, so the
+// window takes those elements there. APS5_ATOMIC_STAGE_MAX_KIB (1024) bounds the atomic one.
 constexpr std::uint64_t SweptShadowMax = std::uint64_t{16} << 20u;
+constexpr std::uint64_t DiscreteWrittenShadowMax = std::uint64_t{8} << 20u;
 
 bool writtenShadowEnabled() {
     static const bool disabled = std::getenv("APS5_NO_WRITTEN_SHADOW") != nullptr;
@@ -4141,9 +4483,10 @@ std::uint64_t writtenShadowMin() {
     return bytes;
 }
 
-std::uint64_t writtenShadowMax() {
-    static const std::uint64_t bytes = kibSetting("APS5_WRITTEN_SHADOW_MAX_KIB", 2048);
-    return bytes;
+std::uint64_t writtenShadowMax(bool discreteGpu) {
+    static const std::uint64_t setting = kibSetting("APS5_WRITTEN_SHADOW_MAX_KIB", 0);
+    if (setting != 0) return setting;
+    return discreteGpu ? DiscreteWrittenShadowMax : std::uint64_t{2048} << 10u;
 }
 
 std::uint64_t atomicStageMax() {
@@ -4207,7 +4550,7 @@ std::shared_ptr<Buffer> stagingBuffer(const Context& context, std::size_t bytes,
 void traceStaged(std::uint64_t begin, std::uint64_t end, bool atomic) {
     static const bool trace = std::getenv("APS5_TRACE_STAGING") != nullptr;
     if (!trace) return;
-    static std::mutex mutex;
+    static AgcDriver::Mutex mutex;
     static std::set<std::pair<std::uint64_t, std::uint64_t>> seen;
     std::lock_guard lock(mutex);
     if (!seen.insert({begin, end}).second) return;
@@ -4257,16 +4600,56 @@ bool GuestBufferMemory::bindableInPlace(std::uint64_t offset, bool addressable)
 }
 
 bool GuestBufferMemory::stagingEligible(const Region& region, bool addressable) const {
-    if (!stagingAllowed || addressable || region.unstaged || !gpuCopiesEnabled() || region.sparse || region.mirror != nullptr) return false;
+    if (!stagingAllowed || (addressable && !region.overlay) || region.unstaged || !gpuCopiesEnabled() || region.sparse || region.mirror != nullptr) return false;
     const auto bytes = region.end - region.begin;
     if (!WritesOverlap(region.begin, static_cast<std::size_t>(bytes))) return false;
     if (region.atomic && atomicStagingEnabled() && bytes <= atomicStageMax()) return true;
-    return writtenShadowEnabled() && bytes >= writtenShadowMin() && bytes <= (region.swept ? std::max(writtenShadowMax(), SweptShadowMax) : writtenShadowMax());
+    return writtenShadowEnabled() && bytes >= writtenShadowMin() && bytes <= (region.swept ? std::max(writtenShadowMax(context.discreteGpu), SweptShadowMax) : writtenShadowMax(context.discreteGpu));
+}
+
+bool GuestBufferMemory::overlayCandidate(const Region& inside, bool readOnly) const {
+    return !readOnly && bdaStagingEnabled() && stagingAllowed && addressStaging && gpuCopiesEnabled() && writtenShadowEnabled() && inside.direct != nullptr && inside.mirror == nullptr && !inside.sparse && Recorder::Active() != nullptr;
+}
+
+void GuestBufferMemory::resolveOverlays() {
+    std::vector<std::size_t> members;
+    for (std::size_t index = 0; index < regions.size(); ++index) {
+        if (regions[index].overlay) members.push_back(index);
+    }
+    if (members.empty()) return;
+    std::vector<bool> drop(regions.size(), space == nullptr);
+    std::sort(members.begin(), members.end(), [&](std::size_t left, std::size_t right) { return regions[left].begin < regions[right].begin; });
+    for (std::size_t first = 0; space != nullptr && first < members.size();) {
+        Region cluster{regions[members[first]].begin, regions[members[first]].end, true, {}, nullptr};
+        cluster.overlay = true;
+        auto last = first;
+        for (; last < members.size() && (last == first || regions[members[last]].begin < cluster.end); ++last) {
+            cluster.end = std::max(cluster.end, regions[members[last]].end);
+            cluster.atomic = cluster.atomic || regions[members[last]].atomic;
+            cluster.swept = cluster.swept || regions[members[last]].swept;
+        }
+        const auto crosses = [&](std::uint64_t begin, std::uint64_t end) { return begin < cluster.end && cluster.begin < end && (begin < cluster.begin || end > cluster.end); };
+        const Region* inside = nullptr;
+        bool keep = baseOverlap(cluster.begin, cluster.end, &inside) == BaseOverlap::Inside && inside != nullptr && inside->direct != nullptr && inside->mirror == nullptr && stagingEligible(cluster, true);
+        keep = keep && std::none_of(servedInsideBase.begin(), servedInsideBase.end(), [&](const auto& range) { return crosses(range.first, range.second); });
+        keep = keep && std::none_of(regions.begin(), regions.end(), [&](const Region& region) { return !region.overlay && region.begin < cluster.end && cluster.begin < region.end; });
+        for (auto member = first; member < last; ++member) drop[members[member]] = !keep;
+        first = last;
+    }
+    std::size_t kept = 0;
+    for (std::size_t index = 0; index < regions.size(); ++index) {
+        if (drop[index]) continue;
+        if (kept != index) regions[kept] = std::move(regions[index]);
+        ++kept;
+    }
+    regions.erase(regions.begin() + static_cast<std::ptrdiff_t>(kept), regions.end());
 }
 
 void GuestBufferMemory::UploadPrepare(bool addressable) {
     Require(!prepared && !uploaded, "guest memory was already uploaded");
     prepared = true;
+    resolveOverlays();
+    servedInsideBase.clear();
     std::vector<std::uint32_t> order(regions.size());
     std::iota(order.begin(), order.end(), 0u);
     std::sort(order.begin(), order.end(), [&](std::uint32_t left, std::uint32_t right) { return regions[left].begin < regions[right].begin; });
@@ -4435,7 +4818,7 @@ void GuestBufferMemory::UploadPrepare(bool addressable) {
 
 void GuestBufferMemory::completeSpaceWrites() const {
     auto* recorder = Recorder::Active();
-    if (recorder == nullptr || Recorder::InCompletion()) return;
+    if (recorder == nullptr || Recorder::InCompletion() || !AnyPendingCpuWrites(context)) return;
     const auto& base = space->base;
     std::vector<std::pair<std::uint64_t, std::uint64_t>> writes;
     std::vector<std::size_t> candidates;
@@ -4529,6 +4912,12 @@ void GuestBufferMemory::UploadFinish(bool addressable) {
     const auto loopStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
     std::uint64_t refreshUs = 0;
     std::uint64_t copyUs = 0;
+    std::uint64_t heapsBegin = std::numeric_limits<std::uint64_t>::max();
+    std::uint64_t heapsEnd = 0;
+    if (addressable && space != nullptr && !space->base.empty()) {
+        heapsBegin = space->base.front().begin;
+        heapsEnd = space->base.back().end;
+    }
     for (auto& region : regions) {
         if (!region.pending) continue;
         region.pending = false;
@@ -4613,7 +5002,12 @@ void GuestBufferMemory::UploadFinish(bool addressable) {
             // an address-based shader maps are exempt (they hold every pending image, and such shaders
             // do not read texture memory through pointers); APS5_BDA_FLUSH=1 flushes for them too.
             static const bool bdaFlush = std::getenv("APS5_BDA_FLUSH") != nullptr;
-            if (!(addressable && region.hostBacked) || bdaFlush) StorageTexture::FlushPending(region.begin, static_cast<std::size_t>(bytes), nullptr, "imported buffer region");
+            if (!(addressable && region.hostBacked) || bdaFlush) {
+                StorageTexture::FlushPending(region.begin, static_cast<std::size_t>(bytes), nullptr, "imported buffer region");
+            } else {
+                heapsBegin = std::min(heapsBegin, region.begin);
+                heapsEnd = std::max(heapsEnd, region.end);
+            }
             continue;
         }
         if (copyOnGpu) {
@@ -4644,8 +5038,10 @@ void GuestBufferMemory::UploadFinish(bool addressable) {
         copyRegion(region, addressable);
         if (profile) copyUs += microsecondsSince(copyStart);
     }
+    if (heapsEnd > heapsBegin) StorageTexture::PublishShadowsOnly(heapsBegin, static_cast<std::size_t>(heapsEnd - heapsBegin), PublishScope::Whole, "address-based heaps");
     if (!gpuCopies.empty()) recordGpuCopies(gpuCopies, addressable);
     takeHeapReferences();
+    ResidentBuffer::FlushChanged(context);
     if (!profile) return;
     const auto loopUs = microsecondsSince(loopStart);
     readUs.fetch_add(refreshUs, std::memory_order_relaxed);
@@ -4679,7 +5075,7 @@ void GuestBufferMemory::UploadFinish(bool addressable) {
 void GuestBufferMemory::copyRegion(Region& region, bool addressable) {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     const auto bytes = region.end - region.begin;
-    const auto usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | (addressable ? VK_BUFFER_USAGE_SHADER_DEVICE_ADDRESS_BIT : 0u);
+    const auto usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT | (addressable ? VK_BUFFER_USAGE_SHADER_DEVICE_ADDRESS_BIT : 0u);
     std::uint64_t readBytes = 0;
     bool inImport = false;
     if (profile && context.hostImportAlignment != 0) {
@@ -4736,7 +5132,7 @@ void GuestBufferMemory::copyRegion(Region& region, bool addressable) {
     region.snapshot.clear();
     if (profile) readUs.fetch_add(microsecondsSince(readStart), std::memory_order_relaxed);
     if (profile) {
-        static std::mutex reasonsMutex;
+        static AgcDriver::Mutex reasonsMutex;
         static std::uint64_t uploads = 0, noImport = 0, noImportBytes = 0, misaligned = 0, misalignedBytes = 0, snapshotOnly = 0, snapshotBytes = 0;
         static std::uint64_t logicalBytes = 0, readTotalBytes = 0;
         static std::map<std::uint64_t, std::pair<std::uint64_t, std::uint64_t>> outside;
@@ -4880,16 +5276,36 @@ void GuestBufferMemory::RecordCopyBacks(Recorder& recorder) {
     VkCommandBuffer commands = VK_NULL_HANDLE;
     auto timing = Recorder::NoTiming;
     std::uint64_t copiedBytes = 0;
+    if (!writes.empty()) {
+        auto sorted = writes;
+        std::sort(sorted.begin(), sorted.end());
+        for (const auto& range : sorted) {
+            if (!merged.empty() && range.first < merged.back().second) merged.back().second = std::max(merged.back().second, range.second);
+            else merged.push_back(range);
+        }
+    }
+    for (const auto& [begin, end] : merged) {
+        const auto* found = owner(begin, end);
+        if (found == nullptr || found->mirror == nullptr || !found->mirror->heap || !found->mirror->writable || found->mirror->resident == nullptr) continue;
+        const auto& region = *found;
+        {
+            const auto from = begin;
+            const auto to = std::min(end, servedEnd(region));
+            if (from >= to || std::any_of(heapReadbacks.begin(), heapReadbacks.end(), [&](const auto& entry) { return entry.first == from; })) continue;
+            if (!recording) {
+                commands = recorder.Commands();
+                timing = recorder.BeginGpuTiming(StagingCopyBackKey);
+                RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_SHADER_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT);
+                Recorder::CountBarriers(Recorder::CommandClass::StagingOut);
+                recording = true;
+            }
+            heapReadbacks.emplace_back(from, region.mirror->resident->RecordReadback(commands, from, to - from));
+            recorder.Keep(heapReadbacks.back().second);
+            copiedBytes += to - from;
+        }
+    }
     for (auto& region : regions) {
         if (!region.gpuCopy || region.copiedBack) continue;
-        if (merged.empty() && !writes.empty()) {
-            auto sorted = writes;
-            std::sort(sorted.begin(), sorted.end());
-            for (const auto& range : sorted) {
-                if (!merged.empty() && range.first < merged.back().second) merged.back().second = std::max(merged.back().second, range.second);
-                else merged.push_back(range);
-            }
-        }
         for (const auto& [begin, end] : merged) {
             const auto from = std::max(begin, region.begin);
             const auto to = std::min(end, region.end);
@@ -4946,7 +5362,7 @@ VkDescriptorBufferInfo GuestBufferMemory::Descriptor(std::uint64_t address, std:
         return std::string(text);
     };
     if (!(address >= region.begin && address + bytes <= region.end && (region.buffer != nullptr || region.direct != nullptr || region.mirror != nullptr))) Require(false, describe("exceeds"));
-    const auto base = region.direct != nullptr ? region.direct->base - region.direct->lead : region.mirror != nullptr ? region.mirror->base : region.begin;
+    const auto base = region.direct != nullptr ? region.direct->base - region.direct->lead : region.mirror != nullptr ? mirrorStart(*region.mirror) : region.begin;
     const auto offset = address - base;
     Require(context.limits.minStorageBufferOffsetAlignment != 0, "no storage buffer offset alignment");
     Require(base % 4 == 0, "a guest buffer view in a GPU owner that does not start at a DWORD boundary is not implemented");
@@ -4960,7 +5376,7 @@ VkDescriptorBufferInfo GuestBufferMemory::Descriptor(std::uint64_t address, std:
     }
     if (address - adjustment + range > end) Require(false, describe("rounded up to its view range exceeds"));
     Require(range <= context.limits.maxStorageBufferRange, "guest buffer view exceeds descriptor range limit");
-    const auto handle = region.direct != nullptr ? region.direct->buffer : region.mirror != nullptr ? region.mirror->buffer->Handle() : region.buffer->Handle();
+    const auto handle = region.direct != nullptr ? region.direct->buffer : region.mirror != nullptr ? mirrorHandle(*region.mirror) : region.buffer->Handle();
     return {handle, offset - adjustment, range};
 }
 
@@ -4973,7 +5389,7 @@ std::uint64_t GuestBufferMemory::ViewBytes(std::uint64_t bytes, std::uint32_t ad
 
 ShaderRecompiler::BdaAbi::Range GuestBufferMemory::addressRange(const Region& region) {
     Require(region.buffer != nullptr || region.direct != nullptr || region.mirror != nullptr, "incomplete guest GPU upload");
-    const auto address = region.direct != nullptr ? region.direct->address + (region.begin - region.direct->base) : region.mirror != nullptr ? region.mirror->buffer->DeviceAddress() + (region.begin - region.mirror->base) : region.buffer->DeviceAddress();
+    const auto address = region.direct != nullptr ? region.direct->address + (region.begin - region.direct->base) : region.mirror != nullptr ? mirrorAddress(*region.mirror) + (region.begin - region.mirror->base) : region.buffer->DeviceAddress();
     Require(region.end - region.begin <= std::numeric_limits<std::uint64_t>::max() - address, "GPU address range overflow");
     const auto permissions = ShaderRecompiler::BdaAbi::Read | (region.direct != nullptr && region.writable ? ShaderRecompiler::BdaAbi::Write : 0u);
     return {region.begin, region.direct != nullptr ? inPlaceEnd(region) : servedEnd(region), address, permissions, 0};
@@ -5031,12 +5447,20 @@ std::vector<ShaderRecompiler::BdaAbi::Range> GuestBufferMemory::AddressRanges()
     std::vector<ShaderRecompiler::BdaAbi::Range> result;
     if (space != nullptr) {
         std::vector<ShaderRecompiler::BdaAbi::Range> own;
+        std::vector<ShaderRecompiler::BdaAbi::Range> overlays;
         own.reserve(regions.size());
-        for (const auto& region : regions) own.push_back(addressRange(region));
+        for (const auto& region : regions) (region.overlay ? overlays : own).push_back(addressRange(region));
         std::vector<ShaderRecompiler::BdaAbi::Range> uncovered;
         uncovered.reserve(own.size());
         AppendUncovered(own, space->ranges, uncovered);
         result = MergeByBegin(space->ranges, uncovered);
+        if (!overlays.empty()) {
+            std::sort(overlays.begin(), overlays.end(), [](const auto& left, const auto& right) { return left.begin < right.begin; });
+            std::vector<ShaderRecompiler::BdaAbi::Range> cut;
+            cut.reserve(result.size() + overlays.size());
+            AppendUncovered(result, overlays, cut);
+            result = MergeByBegin(cut, overlays);
+        }
     } else if (regionsOverlap) {
         std::vector<ShaderRecompiler::BdaAbi::Range> live;
         std::vector<ShaderRecompiler::BdaAbi::Range> copies;
@@ -5173,7 +5597,10 @@ void GuestBufferMemory::MarkDirectWrites() const {
         const auto* found = owner(begin, end);
         if (found == nullptr) continue;
         const auto& region = *found;
-        if (region.direct != nullptr || (region.gpuCopy && region.copiedBack)) GuestMemory::MarkWritten(begin, static_cast<std::size_t>(end - begin));
+        if (region.direct != nullptr || (region.gpuCopy && region.copiedBack)) {
+            const auto generation = GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin));
+            if (generation != 0) directWritesGeneration = std::max(directWritesGeneration, generation);
+        }
     }
 }
 
@@ -5236,15 +5663,19 @@ std::vector<std::pair<std::uint64_t, std::uint64_t>> mergeWrites(std::vector<std
 
 void GuestBufferMemory::takeHeapReferences() {
     heapReferences.clear();
+    heapReadbacks.clear();
     for (const auto& [begin, end] : mergeWrites(writes)) {
         const auto* found = owner(begin, end);
         if (found == nullptr || found->mirror == nullptr || !found->mirror->heap || !found->mirror->writable) continue;
         Require(end <= found->end, "written range exceeds its heap mirror");
-        const auto& mirror = *found->mirror;
+        auto& mirror = *found->mirror;
         const auto served = std::min(end, servedEnd(*found));
         if (begin >= served) continue;
-        const auto bytes = mirror.buffer->Bytes().subspan(static_cast<std::size_t>(begin - mirror.base), static_cast<std::size_t>(served - begin));
-        heapReferences.emplace_back(begin, std::vector<std::byte>(bytes.begin(), bytes.end()));
+        growResident(mirror, {{begin, served}});
+        std::vector<std::byte> bytes(static_cast<std::size_t>(served - begin));
+        if (mirror.resident != nullptr) mirror.resident->Read(begin, bytes);
+        else std::memcpy(bytes.data(), mirror.buffer->Bytes().data() + (begin - mirror.base), bytes.size());
+        heapReferences.emplace_back(begin, std::move(bytes));
     }
 }
 
@@ -5261,7 +5692,7 @@ void GuestBufferMemory::WriteBack() {
         if (region.direct == nullptr && !(region.gpuCopy && (region.copiedBack || region.deviceLocal)) && !(region.mirror != nullptr && !region.mirror->writable)) Recorder::NoteWrittenBack(begin, static_cast<std::size_t>(end - begin));
         if (region.direct != nullptr) {
             // The GPU wrote imported guest memory directly; page write watching did not see it.
-            GuestMemory::MarkWritten(begin, static_cast<std::size_t>(end - begin));
+            StorageTexture::StampKeepingNewerResults(begin, static_cast<std::size_t>(end - begin), directWritesGeneration, [&] { return GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin)); });
             continue;
         }
         if (region.mirror != nullptr) {
@@ -5274,14 +5705,28 @@ void GuestBufferMemory::WriteBack() {
             const auto served = std::min(end, servedEnd(region));
             if (mirror.heap && begin >= served) continue;
             const auto length = static_cast<std::size_t>((mirror.heap ? served : end) - begin);
-            const auto current = mirror.buffer->Bytes().subspan(offset, length);
             if (mirror.heap) {
                 const auto reference = std::find_if(heapReferences.begin(), heapReferences.end(), [&](const auto& entry) { return entry.first == begin; });
                 Require(reference != heapReferences.end() && reference->second.size() == length, "heap mirror write-back has no reference");
+                if (mirror.resident == nullptr) {
+                    const auto current = mirror.buffer->Bytes().subspan(offset, length);
+                    if (mirror.sparse) storeSparse(mirror, begin, current, reference->second);
+                    else storeChanged(begin, current, reference->second);
+                    continue;
+                }
+                std::vector<std::byte> current(length);
+                if (const auto readback = std::find_if(heapReadbacks.begin(), heapReadbacks.end(), [&](const auto& entry) { return entry.first == begin; }); readback != heapReadbacks.end()) {
+                    Require(readback->second->Bytes().size() == length, "heap mirror readback does not match its write-back");
+                    std::memcpy(current.data(), readback->second->Bytes().data(), length);
+                } else {
+                    mirror.resident->ReadDevice(begin, current);
+                }
+                mirror.resident->Store(begin, current);
                 if (mirror.sparse) storeSparse(mirror, begin, current, reference->second);
                 else storeChanged(begin, current, reference->second);
                 continue;
             }
+            const auto current = mirror.buffer->Bytes().subspan(offset, length);
             GuestMemory::WriteChanged(begin, current, std::span<const std::byte>(mirror.shadow).subspan(offset, length));
             std::memcpy(mirror.shadow.data() + offset, current.data(), length);
             continue;
@@ -5291,7 +5736,7 @@ void GuestBufferMemory::WriteBack() {
             if (region.copiedBack) {
                 // The GPU copied the written sub-range back into the import; page write watching
                 // did not see it.
-                GuestMemory::MarkWritten(begin, static_cast<std::size_t>(end - begin));
+                StorageTexture::StampKeepingNewerResults(begin, static_cast<std::size_t>(end - begin), directWritesGeneration, [&] { return GuestMemory::MarkPossiblyWritten(begin, static_cast<std::size_t>(end - begin)); });
                 continue;
             }
             static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
@@ -5332,6 +5777,7 @@ void GuestBufferMemory::WriteBack() {
     lease.clear();
     space.reset();
     heapReferences.clear();
+    heapReadbacks.clear();
 }
 
 std::optional<std::vector<std::pair<std::uint64_t, std::uint64_t>>> GuestBufferMemory::DirectRegions() const {
@@ -5428,6 +5874,7 @@ std::vector<std::pair<std::uint64_t, std::uint64_t>> GuestBufferMemory::DeviceRe
 }
 
 void GuestBufferMemory::RecordStagingCopies(Recorder& recorder) {
+    ResidentBuffer::FlushChanged(context);
     if (!uploaded || committed) return;
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     std::vector<Region*> copies;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp
index 3c81c9c97e..7a7788c964 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp
@@ -5,6 +5,9 @@
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include <algorithm>
+#include <array>
+#include <bit>
+#include <optional>
 #include <stdexcept>
 #include <string>
 
@@ -50,6 +53,45 @@ TextureDimension resolveDimension(std::uint32_t raw) {
     }
 }
 
+bool ZeroTail(std::span<const std::uint32_t> words) {
+    return words[4] == 0u && words[5] == 0u && words[6] == 0u && words[7] == 0u;
+}
+
+bool SameLevels(const TileMipLayout& a, const TileMipLayout& b) {
+    return a.tiledOffset == b.tiledOffset && a.tiledSize == b.tiledSize && a.width == b.width && a.height == b.height && a.blocksPerRow == b.blocksPerRow && a.pitchBytes == b.pitchBytes && a.tail == b.tail && a.tailX == b.tailX && a.tailY == b.tailY;
+}
+
+std::optional<std::array<std::uint32_t, 8>> R128ResidentLevelWords(std::span<const std::uint32_t> words) {
+    const auto baseLevel = (words[3] >> 12u) & 0xfu;
+    const auto lastLevel = (words[3] >> 16u) & 0xfu;
+    const auto typeRaw = (words[3] >> 28u) & 0xfu;
+    if (baseLevel == 0u || baseLevel > lastLevel || (typeRaw != 8u && typeRaw != 9u)) return std::nullopt;
+    const std::array<std::uint32_t, 8> chainWords{words[0], words[1], words[2], words[3], 0u, lastLevel << 4u, 0u, 0u};
+    const auto width = (((words[1] >> 30u) & 0x3u) | ((words[2] & 0xfffu) << 2u)) + 1u;
+    const auto height = ((words[2] >> 14u) & 0x3fffu) + 1u;
+    const auto minLod = (words[1] >> 8u) & 0xfffu;
+    const auto widthMinus1 = std::max(width >> baseLevel, 1u) - 1u;
+    const auto heightMinus1 = std::max(height >> baseLevel, 1u) - 1u;
+    const auto rebasedMinLod = minLod > baseLevel * 256u ? minLod - baseLevel * 256u : 0u;
+    const auto levels = lastLevel - baseLevel;
+    auto rebased = chainWords;
+    rebased[1] = (words[1] & ~((0xfffu << 8u) | (0x3u << 30u))) | (rebasedMinLod << 8u) | ((widthMinus1 & 0x3u) << 30u);
+    rebased[2] = (words[2] & ~(0xfffu | (0x3fffu << 14u))) | ((widthMinus1 >> 2u) & 0xfffu) | ((heightMinus1 & 0x3fffu) << 14u);
+    rebased[3] = (words[3] & ~(0xffu << 12u)) | (levels << 16u);
+    rebased[5] = levels << 4u;
+    try {
+        const auto chain = DescribeSurface(DecodeTextureResource(chainWords));
+        const auto view = DescribeSurface(DecodeTextureResource(rebased));
+        if (chain.mips.size() != lastLevel + 1u || view.mips.size() != levels + 1u || chain.layers != view.layers) return std::nullopt;
+        for (std::uint32_t level = baseLevel; level <= lastLevel; ++level) {
+            if (!SameLevels(chain.mips[level], view.mips[level - baseLevel])) return std::nullopt;
+        }
+    } catch (const std::exception&) {
+        return std::nullopt;
+    }
+    return rebased;
+}
+
 }
 
 bool IsNullTextureResource(std::span<const std::uint32_t> words) {
@@ -138,11 +180,15 @@ GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words)
     Require(baseLevel <= lastLevel, "guest texture descriptor has a base mip level past its last mip level");
 
     const bool fmask = ShaderRecompiler::IsFmaskTextureFormat(static_cast<ShaderRecompiler::IrBufferFormat>(format));
+    const auto fmaskLayout = ShaderRecompiler::FmaskLayoutOf(static_cast<ShaderRecompiler::IrBufferFormat>(format));
     if (fmask) {
-        Require(format == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Fmask32_S8_F8), "guest FMASK format is not implemented");
-        Require(!metaCompress && !writeCompress, "FMASK CMASK compression is not implemented");
+        Require(fmaskLayout.has_value(), "guest FMASK format is not implemented");
+        Require(!writeCompress && (!metaCompress || metaAddr != 0u), "FMASK CMASK compression is not implemented without readable metadata");
+        Require(!metaCompress || metaPipeAligned, "FMASK CMASK metadata must be pipe aligned");
+        Require(!metaCompress || format == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Fmask32_S8_F8), "FMASK CMASK compression is implemented only for 8-sample, 8-fragment FMASK");
         Require((typeRaw == 9u || typeRaw == 13u) && tileModeRaw == 24u && baseLevel == 0u && lastLevel == 0u && maxMip == 0u, "FMASK reads require a single-mip 2D or 2D-array Z_64KB_X surface");
-        for (const auto selector : {dstSelX, dstSelY, dstSelZ, dstSelW}) Require(selector == 0u || selector == 1u || selector == 4u, "FMASK destination channel selector is not implemented");
+        const bool identity = format != static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Fmask32_S8_F8) && dstSelX == 4u && dstSelY == 5u && dstSelZ == 6u && dstSelW == 7u;
+        for (const auto selector : {dstSelX, dstSelY, dstSelZ, dstSelW}) Require(identity || selector == 0u || selector == 1u || selector == 4u, "FMASK destination channel selector is not implemented");
     }
 
     const auto describe = [&] { return " (format " + std::to_string(format) + ", " + std::to_string(width) + "x" + std::to_string(height) + "x" + std::to_string(depth + 1) + ", type " + std::to_string(typeRaw) + ", tile " + std::to_string(tileModeRaw) + ", mips " + std::to_string(baseLevel) + ".." + std::to_string(lastLevel) + " of " + std::to_string(maxMip + 1) + ")"; };
@@ -223,25 +269,67 @@ GuestTextureResource DecodeTextureResource(std::span<const std::uint32_t> words)
     result.lastLevel = lastLevel;
     result.tileMode = tileMode;
     result.dimension = dimension;
-    result.format = fmask ? static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format32UInt) : format;
+    result.format = !fmask ? format : static_cast<std::uint32_t>(fmaskLayout->storageBits == 8u ? ShaderRecompiler::IrBufferFormat::Format8UInt : fmaskLayout->storageBits == 16u ? ShaderRecompiler::IrBufferFormat::Format16UInt : ShaderRecompiler::IrBufferFormat::Format32UInt);
     result.dstSelX = static_cast<std::uint8_t>(dstSelX);
     result.dstSelY = static_cast<std::uint8_t>(dstSelY);
     result.dstSelZ = static_cast<std::uint8_t>(dstSelZ);
     result.dstSelW = static_cast<std::uint8_t>(dstSelW);
     result.bcSwizzle = static_cast<std::uint8_t>(bcSwizzle);
-    result.dccAddress = metaCompress ? metaAddr << 8u : 0u;
+    result.dccAddress = metaCompress && !fmask ? metaAddr << 8u : 0u;
+    result.fmaskCmaskAddress = metaCompress && fmask ? metaAddr << 8u : 0u;
     result.dccAlphaOnMsb = dccAlphaPos;
     result.dccPipeAligned = metaPipeAligned;
     result.iterate256 = iterate256;
     result.minLod = minLod;
     result.samples = samples;
     if (baseLevel > maxMip) {
-        Require(LevelsFitAllocation(result, lastLevel + 1u), "guest texture descriptor starts past the surface's last mip level at levels that would move the surface's own" + describe());
+        const bool fits = LevelsFitAllocation(result, lastLevel + 1u);
+        if (!fits && ZeroTail(words)) {
+            if (const auto resident = R128ResidentLevelWords(words)) return DecodeTextureResource(*resident);
+        }
+        Require(fits, "guest texture descriptor starts past the surface's last mip level at levels that would move the surface's own" + describe());
         result.mipCount = lastLevel + 1u;
     }
     return result;
 }
 
+std::array<std::uint32_t, 8> EncodeTextureResource(const GuestTextureResource& resource) {
+    const bool multisampled = resource.dimension == TextureDimension::k2DMsaa;
+    Require((resource.dimension == TextureDimension::k2D && resource.samples == 1u) || (multisampled && resource.samples >= 2u && resource.samples <= 16u && std::has_single_bit(resource.samples)), "only 2D and multisampled 2D surfaces have a texture descriptor encoding");
+    Require(resource.mipCount == 1u && resource.allocatedMipCount <= 1u && resource.baseLevel == 0u && resource.lastLevel == 0u && resource.depthOrLastArray == 0u && resource.baseArray == 0u && resource.dccAddress == 0u && resource.minLod == 0u && !resource.iterate256 && resource.bcSwizzle == 0u, "only single-level, single-layer surfaces without metadata have a texture descriptor encoding");
+    Require(resource.width >= 1u && resource.width <= 0x4000u && resource.height >= 1u && resource.height <= 0x4000u && resource.format < 0x200u, "the surface's extent or format has no texture descriptor encoding");
+    const auto xorMask = resource.tileMode == TextureTileMode::kS4KBX || resource.tileMode == TextureTileMode::kD4KBX ? 0xfffull : 0xffffull;
+    Require(XorSwizzleMode(resource.tileMode) != 0 ? (resource.baseAddress & xorMask) == 0 && (resource.pipeBankXor & ~xorMask) == 0 : resource.pipeBankXor == 0, "the surface's pipe and bank XOR has no texture descriptor encoding");
+    const auto base = (resource.baseAddress | resource.pipeBankXor) >> 8u;
+    Require(base != 0 && (resource.baseAddress & 0xffu) == 0 && base <= 0xffffffffffull, "the surface's address has no texture descriptor encoding");
+    std::uint32_t tileMode = 0;
+    switch (resource.tileMode) {
+        case TextureTileMode::kLinear: tileMode = 0x00; break;
+        case TextureTileMode::kStandard256B: tileMode = 0x01; break;
+        case TextureTileMode::kD256B: tileMode = 0x02; break;
+        case TextureTileMode::kStandard4KB: tileMode = 0x05; break;
+        case TextureTileMode::kD4KB: tileMode = 0x06; break;
+        case TextureTileMode::kStandard64KB: tileMode = 0x09; break;
+        case TextureTileMode::kD64KB: tileMode = 0x0a; break;
+        case TextureTileMode::kS64KBT: tileMode = 0x11; break;
+        case TextureTileMode::kD64KBT: tileMode = 0x12; break;
+        case TextureTileMode::kS4KBX: tileMode = 0x15; break;
+        case TextureTileMode::kD4KBX: tileMode = 0x16; break;
+        case TextureTileMode::kZ64KBX: tileMode = 0x18; break;
+        case TextureTileMode::kS64KBX: tileMode = 0x19; break;
+        case TextureTileMode::kD64KBX: tileMode = 0x1a; break;
+        case TextureTileMode::kR64KBX: tileMode = 0x1b; break;
+    }
+    const auto sampleLevel = static_cast<std::uint32_t>(std::countr_zero(resource.samples));
+    std::array<std::uint32_t, 8> words{};
+    words[0] = static_cast<std::uint32_t>(base);
+    words[1] = static_cast<std::uint32_t>(base >> 32u) | (resource.format << 20u) | (((resource.width - 1u) & 3u) << 30u);
+    words[2] = ((resource.width - 1u) >> 2u) | ((resource.height - 1u) << 14u);
+    words[3] = resource.dstSelX | (resource.dstSelY << 3u) | (resource.dstSelZ << 6u) | (resource.dstSelW << 9u) | (sampleLevel << 16u) | (tileMode << 20u) | ((multisampled ? 14u : 9u) << 28u);
+    words[5] = sampleLevel << 4u;
+    return words;
+}
+
 float EffectiveMinLod(const GuestTextureResource& resource) {
     if (resource.minLod <= resource.baseLevel * 256u) return 0.0f;
     return std::min(static_cast<float>(resource.minLod) / 256.0f, static_cast<float>(resource.lastLevel));
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp
index 8911499a06..0520466262 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/FirstSampleCopy.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
@@ -9,6 +10,8 @@
 #include "prx/libSceAgcDriver/Graphics/include/SampleOrder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
+#include "IntermediateRepresentation/IrMetadata/BufferFormat.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include <algorithm>
@@ -45,10 +48,57 @@ std::uint64_t collectBlocks(std::uint64_t address, std::size_t bytes) {
     return generation != 0 ? generation : GuestMemory::CollectWritesUncached(address, bytes);
 }
 
+GuestTextureResource fmaskSnapshotResource(const GuestTextureResource& resource) {
+    Require(resource.format == static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format32UInt) && resource.fmaskCmaskAddress != 0u, "FMASK image format read semantics are not implemented");
+    Require(resource.dimension == TextureDimension::k2D || resource.dimension == TextureDimension::k2DArray, "FMASK image dimension is not implemented");
+    Require(resource.tileMode == TextureTileMode::kZ64KBX && (resource.pipeBankXor & ~0xcf00u) == 0u, "FMASK image swizzle or pipe/bank XOR is not implemented");
+    Require(resource.width != 0u && resource.width <= 16384u && resource.height != 0u && resource.height <= 16384u && resource.depthOrLastArray < 8192u && resource.baseArray <= resource.depthOrLastArray, "invalid FMASK image extent or layer range");
+    Require(resource.dimension == TextureDimension::k2DArray || (resource.depthOrLastArray == 0u && resource.baseArray == 0u), "FMASK 2D image has an array range");
+    Require(resource.mipCount == 1u && resource.allocatedMipCount == 1u && resource.baseLevel == 0u && resource.lastLevel == 0u && resource.minLod == 0u, "FMASK image mip fields are not implemented");
+    Require(resource.fmaskCmaskAddress == 0u || resource.dccPipeAligned, "FMASK image CMASK must be pipe aligned");
+    for (const auto selector : {resource.dstSelX, resource.dstSelY, resource.dstSelZ, resource.dstSelW}) Require(selector == 0u || selector == 1u || selector == 4u, "FMASK image selects an unverified channel");
+    auto snapshot = resource;
+    snapshot.format = static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format32UInt);
+    snapshot.tileMode = TextureTileMode::kLinear;
+    snapshot.pipeBankXor = 0u;
+    snapshot.dccAddress = 0u;
+    snapshot.fmaskCmaskAddress = 0u;
+    snapshot.dccAlphaOnMsb = false;
+    snapshot.dccPipeAligned = false;
+    return snapshot;
+}
+
+GuestTextureResource fmaskResource(const ColorTarget& target) {
+    GuestTextureResource resource{};
+    resource.baseAddress = target.fmaskAddress;
+    resource.width = target.extent.width;
+    resource.height = target.extent.height;
+    resource.mipCount = 1u;
+    resource.allocatedMipCount = 1u;
+    resource.tileMode = TextureTileMode::kZ64KBX;
+    resource.dimension = TextureDimension::k2D;
+    resource.format = static_cast<std::uint32_t>(ShaderRecompiler::IrBufferFormat::Format32UInt);
+    resource.dstSelX = 4u;
+    resource.pipeBankXor = target.fmaskPipeBankXor;
+    resource.fmaskCmaskAddress = target.cmaskAddress;
+    resource.dccPipeAligned = true;
+    return resource;
+}
+
 bool sameTarget(const ColorTarget& a, const ColorTarget& b) {
     return a.surfaceAddress == b.surfaceAddress && a.format == b.format && a.extent.width == b.extent.width && a.extent.height == b.extent.height && a.samples == b.samples;
 }
 
+constexpr VkImageUsageFlags twinViewUsage = VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT | VK_IMAGE_USAGE_TRANSFER_DST_BIT;
+
+VkFormat colorTwinFormat(const Context& context, VkFormat format) {
+    if (const auto srgb = SrgbTwinFormat(context, format); srgb != VK_FORMAT_UNDEFINED) return srgb;
+    for (const auto unorm : {VK_FORMAT_R8_UNORM, VK_FORMAT_R8G8_UNORM, VK_FORMAT_R8G8B8A8_UNORM, VK_FORMAT_B8G8R8A8_UNORM, VK_FORMAT_A8B8G8R8_UNORM_PACK32}) {
+        if (SrgbTwinFormat(context, unorm) == format) return unorm;
+    }
+    return VK_FORMAT_UNDEFINED;
+}
+
 bool recreated(const ColorTarget& resident, const ColorTarget& use) {
     return use.dccAddress != 0 && use.pipeBankXor != resident.pipeBankXor && use.address == resident.address && use.dccAddress == resident.dccAddress && use.dccControl == resident.dccControl && use.dccAlphaOnMsb == resident.dccAlphaOnMsb && use.dccPipeAligned == resident.dccPipeAligned && use.cmaskAddress == resident.cmaskAddress && use.cmaskBytes == resident.cmaskBytes && use.tileMode == resident.tileMode && use.elementBytes == resident.elementBytes;
 }
@@ -101,6 +151,13 @@ public:
             return context.imageFormatProperties(context.physical, format, VK_IMAGE_TYPE_2D, VK_IMAGE_TILING_OPTIMAL, formatUsage, flags, &properties) == VK_SUCCESS && (properties.sampleCounts & samples) != 0;
         };
         if (storageFormat != VK_FORMAT_UNDEFINED && (!context.storageImageMultisample || !storageSupports(storageFormat, VK_IMAGE_USAGE_STORAGE_BIT, 0u) || !storageSupports(target.format, usage | VK_IMAGE_USAGE_STORAGE_BIT, storageFlags))) storageFormat = VK_FORMAT_UNDEFINED;
+        twinFormat = colorTwinFormat(context, target.format);
+        if (twinFormat != VK_FORMAT_UNDEFINED) {
+            VkFormatProperties twinProperties{};
+            context.formatProperties(context.physical, twinFormat, &twinProperties);
+            const VkImageCreateFlags twinFlags = orderFlags | VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT;
+            if ((twinProperties.optimalTilingFeatures & VK_FORMAT_FEATURE_COLOR_ATTACHMENT_BIT) == 0 || !storageSupports(target.format, usage, twinFlags) || !storageSupports(twinFormat, twinViewUsage, twinFlags)) twinFormat = VK_FORMAT_UNDEFINED;
+        }
         try {
             const auto created = allocate(usage, orderFlags);
             image = created.image;
@@ -135,6 +192,16 @@ public:
         try {
             VkImageCreateInfo info{VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO};
             info.flags = flags;
+            const std::array<VkFormat, 2> viewFormats{target.format, twinFormat};
+            VkImageFormatListCreateInfo formatList{VK_STRUCTURE_TYPE_IMAGE_FORMAT_LIST_CREATE_INFO};
+            if (twinFormat != VK_FORMAT_UNDEFINED) {
+                if ((flags & VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT) == 0 && context.imageFormatList) {
+                    formatList.viewFormatCount = static_cast<std::uint32_t>(viewFormats.size());
+                    formatList.pViewFormats = viewFormats.data();
+                    info.pNext = &formatList;
+                }
+                info.flags |= VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT;
+            }
             info.imageType = VK_IMAGE_TYPE_2D;
             info.format = target.format;
             info.extent = {target.extent.width, target.extent.height, 1};
@@ -161,7 +228,7 @@ public:
             viewInfo.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
             VkImageViewUsageCreateInfo viewUsage{VK_STRUCTURE_TYPE_IMAGE_VIEW_USAGE_CREATE_INFO};
             viewUsage.usage = imageUsage & ~VK_IMAGE_USAGE_STORAGE_BIT;
-            if (orderFormat != VK_FORMAT_UNDEFINED) viewInfo.pNext = &viewUsage;
+            if ((imageUsage & VK_IMAGE_USAGE_STORAGE_BIT) != 0) viewInfo.pNext = &viewUsage;
             Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &created.view), "vkCreateImageView multisampled target");
         } catch (...) {
             destroy(created);
@@ -203,6 +270,7 @@ public:
         Recorder::CountBarriers(Recorder::CommandClass::Draw, 3);
         for (auto& [key, texture] : textures) retiredTextures.push_back(std::move(texture));
         textures.clear();
+        retired.push_back({VK_NULL_HANDLE, VK_NULL_HANDLE, std::exchange(twinView, VK_NULL_HANDLE)});
         retired.push_back({image, memory, view});
         image = storable.image;
         memory = storable.memory;
@@ -212,6 +280,28 @@ public:
         recorder.Keep(shared_from_this(), static_cast<std::size_t>(storable.bytes));
     }
 
+    std::shared_ptr<Texture> FmaskSampled(const GuestTextureResource& resource, VkComponentMapping components) {
+        const auto snapshot = fmaskSnapshotResource(resource);
+        Require(target.samples == 8u && target.dccAddress != 0u && fmaskRange.has_value(), "native FMASK sampling requires a tracked eight-fragment DCC target");
+        Require(target.tileMode == ColorTileMode::RenderTarget && target.depth == 1u && target.depthSlice == 0u && target.layers == 1u && target.arrayLastSlice == 0u && target.arraySlice == 0u && target.mip == 0u && target.mipCount == 1u, "native FMASK target layout is not implemented");
+        Require(target.fmaskAddress == resource.baseAddress && target.fmaskPipeBankXor == resource.pipeBankXor && target.cmaskAddress == resource.fmaskCmaskAddress, "native FMASK descriptor does not match its resident target");
+        Require(target.extent.width == resource.width && target.extent.height == resource.height && resource.baseArray == 0u && resource.depthOrLastArray == 0u, "native FMASK extent or subresource does not match its resident target");
+        auto* recorder = Recorder::Active();
+        Require(recorder != nullptr && recorder->Device() == context.device && !Recorder::InCompletion(), "native FMASK sampling requires its device's active recorder outside completion");
+        ApplyFastClear(target);
+        Keep();
+        const std::array<std::uint32_t, 5> key{static_cast<std::uint32_t>(components.r), static_cast<std::uint32_t>(components.g), static_cast<std::uint32_t>(components.b), static_cast<std::uint32_t>(components.a), static_cast<std::uint32_t>(resource.dimension)};
+        auto& texture = fmaskTextures[key];
+        if (texture == nullptr) {
+            const auto geometry = DescribeSurface(snapshot);
+            std::vector<std::byte> bytes(geometry.guestBytes);
+            constexpr std::uint32_t expanded = 0x76543210u;
+            for (std::size_t offset = 0; offset < bytes.size(); offset += sizeof(expanded)) std::memcpy(bytes.data() + offset, &expanded, sizeof(expanded));
+            texture = std::make_unique<Texture>(context, *context.detiler, snapshot, components, bytes);
+        }
+        return {shared_from_this(), texture.get()};
+    }
+
     void Keep() {
         if (auto* recorder = Recorder::Active(); recorder != nullptr && recorder->Device() == context.device) {
             recorder->Keep(shared_from_this());
@@ -241,6 +331,7 @@ public:
         colorFill = MultisampledColorFill(use);
         fromTexture = false;
         dccRanges.clear();
+        fmaskRange.reset();
         metadataValid = std::make_shared<std::atomic<bool>>(true);
         const auto initial = initialDccClear(use);
         recordCommands(context, [&](VkCommandBuffer commands, Recorder* recorder) {
@@ -336,14 +427,52 @@ public:
         return {shared_from_this(), texture.get()};
     }
 
-    VkRenderPass ResolvePass() {
+    std::shared_ptr<Texture> FirstSample(VkComponentMapping components) {
+        const auto source = Sampled({});
+        if (firstSampleCopy == nullptr) firstSampleCopy = std::make_unique<FirstSampleCopy>(context, target.format, target.extent);
+        firstSampleCopy->Record(*Recorder::Active(), source->View(), source->Layout());
+        const std::array<std::uint32_t, 4> key{static_cast<std::uint32_t>(components.r), static_cast<std::uint32_t>(components.g), static_cast<std::uint32_t>(components.b), static_cast<std::uint32_t>(components.a)};
+        auto& texture = firstSampleTextures[key];
+        if (texture == nullptr) {
+            texture = std::make_shared<Texture>(context, firstSampleCopy->Image(), target.format, VK_IMAGE_ASPECT_COLOR_BIT, components);
+            texture->MarkRefreshedPerUse();
+        }
+        return {shared_from_this(), texture.get()};
+    }
+
+    VkImageView View(VkFormat format) {
+        if (format == target.format) return view;
+        Require(twinFormat != VK_FORMAT_UNDEFINED && format == twinFormat, "a multisampled color target is only viewed in its own format or its sRGB twin");
+        if (twinView == VK_NULL_HANDLE) {
+            VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
+            viewInfo.image = image;
+            viewInfo.viewType = VK_IMAGE_VIEW_TYPE_2D;
+            viewInfo.format = twinFormat;
+            viewInfo.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+            VkImageViewUsageCreateInfo viewUsage{VK_STRUCTURE_TYPE_IMAGE_VIEW_USAGE_CREATE_INFO};
+            viewUsage.usage = twinViewUsage;
+            viewInfo.pNext = &viewUsage;
+            Check(context.Function<PFN_vkCreateImageView>("vkCreateImageView")(context.device, &viewInfo, nullptr, &twinView), "vkCreateImageView multisampled target twin");
+        }
+        return twinView;
+    }
+
+    bool Serves(const ColorTarget& use) const {
+        if (use.format == target.format) return sameTarget(target, use);
+        auto twin = use;
+        twin.format = target.format;
+        return twinFormat != VK_FORMAT_UNDEFINED && use.format == twinFormat && sameTarget(target, twin);
+    }
+
+    VkRenderPass ResolvePass(VkFormat format) {
+        auto& resolvePass = resolvePasses[format];
         if (resolvePass != VK_NULL_HANDLE) return resolvePass;
         std::array<VkAttachmentDescription, 2> attachments{};
-        attachments[0].format = target.format;
+        attachments[0].format = format;
         attachments[0].samples = static_cast<VkSampleCountFlagBits>(target.samples);
         attachments[0].loadOp = VK_ATTACHMENT_LOAD_OP_LOAD;
         attachments[0].storeOp = VK_ATTACHMENT_STORE_OP_STORE;
-        attachments[1].format = target.format;
+        attachments[1].format = format;
         attachments[1].samples = VK_SAMPLE_COUNT_1_BIT;
         attachments[1].loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
         attachments[1].storeOp = VK_ATTACHMENT_STORE_OP_STORE;
@@ -376,7 +505,7 @@ public:
     VkImage image = VK_NULL_HANDLE;
     VkDeviceMemory memory = VK_NULL_HANDLE;
     VkImageView view = VK_NULL_HANDLE;
-    VkRenderPass resolvePass = VK_NULL_HANDLE;
+    std::map<VkFormat, VkRenderPass> resolvePasses;
     MultisampledCmask cmask;
     MultisampledColorFill colorFill;
     bool fromTexture = false;
@@ -391,12 +520,18 @@ private:
     VkImageUsageFlags usage = 0;
     VkFormat storageFormat = VK_FORMAT_UNDEFINED;
     VkImageCreateFlags storageFlags = 0;
+    VkFormat twinFormat = VK_FORMAT_UNDEFINED;
+    VkImageView twinView = VK_NULL_HANDLE;
     std::vector<Allocation> retired;
     VkImageView storageView = VK_NULL_HANDLE;
     bool storageWritten = false;
     VkDeviceSize allocationBytes = 0;
+    std::optional<GuestMemory::UnchangedQuery> fmaskRange;
+    std::map<std::array<std::uint32_t, 5>, std::unique_ptr<Texture>> fmaskTextures;
     std::map<std::array<std::uint32_t, 5>, std::shared_ptr<Texture>> textures;
     std::vector<std::shared_ptr<Texture>> retiredTextures;
+    std::unique_ptr<FirstSampleCopy> firstSampleCopy;
+    std::map<std::array<std::uint32_t, 4>, std::shared_ptr<Texture>> firstSampleTextures;
     std::vector<GuestMemory::UnchangedQuery> dccRanges;
     std::optional<std::uint32_t> dccFill;
     std::optional<std::uint32_t> cmaskFill;
@@ -450,18 +585,29 @@ private:
                 Require(a.address >= b.address + b.bytes || b.address >= a.address + a.bytes, "overlapping multisampled DCC color or metadata ranges are not implemented");
             }
         }
+        if (use.samples == 8u && use.fmaskAddress != 0u && use.cmaskAddress != 0u) {
+            const auto resource = fmaskResource(use);
+            static_cast<void>(fmaskSnapshotResource(resource));
+            fmaskRange = GuestMemory::UnchangedQuery{use.fmaskAddress, static_cast<std::size_t>(DescribeSurface(resource).guestBytes), 0};
+            auto& range = *fmaskRange;
+            GuestMemory::CheckRange(reinterpret_cast<const void*>(range.address), range.bytes, 65536u);
+            Require(GuestMemory::Watched(range.address, range.bytes), "native FMASK contents require watched guest memory");
+            range.generation = GuestMemory::CollectWritesUncached(range.address, range.bytes);
+            Require(range.generation != 0, "native FMASK contents have no write generation");
+            for (const auto& other : dccRanges) Require(range.address >= other.address + other.bytes || other.address >= range.address + range.bytes, "native FMASK overlaps its color or metadata planes");
+        }
         std::vector<std::byte> dcc(dccRanges[1].bytes);
         GuestMemory::Read(use.dccAddress, dcc);
         std::vector<std::byte> cmask(use.cmaskBytes);
         if (!cmask.empty()) GuestMemory::Read(use.cmaskAddress, cmask);
         const auto clear = MultisampledDccClear(use, dcc, cmask);
-        Require(GuestMemory::UnchangedSinceAll(dccRanges), "initial multisampled DCC contents changed during import");
+        Require(GuestMemory::UnchangedSinceAll(dccRanges) && (!fmaskRange || GuestMemory::UnchangedSinceAll(std::span(&*fmaskRange, 1u))), "initial multisampled DCC contents changed during import");
         return clear;
     }
 
     void requireDccRange(bool valid, const GuestMemory::UnchangedQuery& range, const char* reason) const {
         if (valid) return;
-        const auto* plane = range.address == target.address ? "color" : range.address == target.dccAddress ? "DCC" : "CMASK";
+        const auto* plane = range.address == target.address ? "color" : range.address == target.dccAddress ? "DCC" : range.address == target.fmaskAddress ? "FMASK" : "CMASK";
         char text[384];
         std::snprintf(text, sizeof(text), "%s (%s range 0x%llx+0x%zx, %u samples)", reason, plane, static_cast<unsigned long long>(range.address), range.bytes, target.samples);
         Require(false, text);
@@ -482,13 +628,25 @@ private:
             requireDccRange(GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || !GuestMemory::StoredOver(range.address, range.bytes, range.generation), range, "writes to a resident multisampled DCC target or its metadata are not implemented");
             if (auto* recorder = Recorder::Active(); recorder != nullptr) requireDccRange(!recorder->PendingWriteOverlaps(range.address, range.bytes), range, "pending writes to a resident multisampled DCC target or its metadata are not implemented");
         }
+        if (fmaskRange) {
+            Require(use.fmaskAddress == target.fmaskAddress && use.fmaskPipeBankXor == target.fmaskPipeBankXor, "native FMASK target layout changed");
+            const auto& range = *fmaskRange;
+            requireDccRange(GuestMemory::Watched(range.address, range.bytes), range, "native FMASK sampling requires watched guest memory");
+            GuestMemory::CollectWritesUncached(range.address, range.bytes);
+            requireDccRange(GuestMemory::UnchangedSince(range.address, range.bytes, range.generation) || !GuestMemory::StoredOver(range.address, range.bytes, range.generation), range, "writes to a resident native FMASK are not implemented");
+            if (auto* recorder = Recorder::Active(); recorder != nullptr) requireDccRange(!recorder->PendingWriteOverlaps(range.address, range.bytes), range, "pending writes to a resident native FMASK are not implemented");
+        }
     }
 
     void release() noexcept {
+        fmaskTextures.clear();
         textures.clear();
         retiredTextures.clear();
-        if (resolvePass) context.Function<PFN_vkDestroyRenderPass>("vkDestroyRenderPass")(context.device, resolvePass, nullptr);
+        firstSampleTextures.clear();
+        firstSampleCopy.reset();
+        for (const auto& [format, resolvePass] : resolvePasses) context.Function<PFN_vkDestroyRenderPass>("vkDestroyRenderPass")(context.device, resolvePass, nullptr);
         if (orderView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, orderView, nullptr);
+        if (twinView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, twinView, nullptr);
         if (storageView) context.Function<PFN_vkDestroyImageView>("vkDestroyImageView")(context.device, storageView, nullptr);
         destroy({image, memory, view});
         for (const auto& allocation : retired) destroy(allocation);
@@ -502,6 +660,7 @@ struct GuardedRange {
     std::uint32_t samples;
     std::shared_ptr<std::atomic<bool>> active;
     std::shared_ptr<std::atomic<bool>> metadataValid;
+    bool fmask = false;
 };
 
 class PrimedSharedMutex : public std::shared_mutex {
@@ -591,6 +750,7 @@ void guard(const Context& context, const ColorTarget& target, const std::shared_
     if (target.dccAddress != 0) {
         guarded().push_back({context.device, target.dccAddress, MultisampledDccBytes(target), target.samples, active, metadataValid});
         if (target.cmaskAddress != 0) guarded().push_back({context.device, target.cmaskAddress, target.cmaskBytes, target.samples, active, metadataValid});
+        if (target.samples == 8u && target.fmaskAddress != 0u && target.cmaskAddress != 0u) guarded().push_back({context.device, target.fmaskAddress, DescribeSurface(fmaskResource(target)).guestBytes, target.samples, active, metadataValid});
     }
     anyGuarded().store(true, std::memory_order_release);
     InstallResidentImageReadGuard_nid_no_patch();
@@ -610,11 +770,13 @@ void discardRetiredTargets() {
     std::erase_if(targets(), [](const auto& target) { return !target->active->load(std::memory_order_acquire); });
 }
 
-MultisampleTarget& acquire(const Context& context, const ColorTarget& use) {
+MultisampleTarget& acquire(const Context& context, const ColorTarget& requested) {
     discardRetiredTargets();
     for (const auto& target : targets()) {
         if (!target->active->load(std::memory_order_acquire)) continue;
-        if (target->context.device != context.device || !sameTarget(target->target, use)) continue;
+        if (target->context.device != context.device || !target->Serves(requested)) continue;
+        auto use = requested;
+        use.format = target->target.format;
         if (recreated(target->target, use)) {
             {
                 std::unique_lock lock(guardedMutex());
@@ -636,6 +798,7 @@ MultisampleTarget& acquire(const Context& context, const ColorTarget& use) {
         target->ApplyFastClear(use);
         return *target;
     }
+    const auto& use = requested;
     auto target = std::make_shared<MultisampleTarget>(context, use);
     target->Keep();
     targets().push_back(std::move(target));
@@ -871,7 +1034,7 @@ VkClearColorValue MultisampledDccClear(const ColorTarget& target, std::span<cons
     Require(dcc.size() == MultisampledDccBytes(target), "multisampled DCC metadata snapshot size mismatch");
     Require(std::ranges::all_of(dcc, [&](std::byte key) { return key == dcc.front(); }), "mixed multisampled DCC metadata is not implemented");
     Require(target.cmaskAddress == 0 ? cmask.empty() && target.cmaskBytes == 0 : cmask.size() == target.cmaskBytes && target.cmaskBytes == CmaskBytes(target.extent.width, target.extent.height), "multisampled DCC CMASK snapshot size mismatch");
-    if (!cmask.empty()) {
+    if (!cmask.empty() && target.cmaskFastClear) {
         const auto code = std::to_integer<std::uint32_t>(cmask.front());
         const auto expanded = target.samples == 2 ? 0xddu : target.samples == 4 ? 0xeeu : 0xffu;
         Require(std::ranges::all_of(cmask, [&](std::byte key) { return key == cmask.front(); }) && (code == 0xccu || code == expanded), "multisampled DCC CMASK compression or register clear is not implemented");
@@ -956,9 +1119,9 @@ SampleOrderTarget MultisampleTargetOrderTarget(const Context& context, const Col
 
 VkImageView MultisampleTargetView(const Context& context, const ColorTarget& target, VkImage* image) {
     std::lock_guard lock(targetsMutex());
-    const auto& acquired = acquire(context, target);
+    auto& acquired = acquire(context, target);
     if (image != nullptr) *image = acquired.image;
-    return acquired.view;
+    return acquired.View(target.format);
 }
 
 VkImageView MultisampleTargetView(const Context& context, const ColorTarget& target, std::shared_ptr<void>& owner, VkImage* image) {
@@ -966,7 +1129,7 @@ VkImageView MultisampleTargetView(const Context& context, const ColorTarget& tar
     auto& acquired = acquire(context, target);
     owner = acquired.shared_from_this();
     if (image != nullptr) *image = acquired.image;
-    return acquired.view;
+    return acquired.View(target.format);
 }
 
 void KeepMultisampleTarget_nid_no_patch(const std::shared_ptr<void>& owner) {
@@ -990,6 +1153,12 @@ VkComponentMapping swapRedBlue(VkComponentMapping components) {
     return {swapped(components.r, VK_COMPONENT_SWIZZLE_R), swapped(components.g, VK_COMPONENT_SWIZZLE_G), swapped(components.b, VK_COMPONENT_SWIZZLE_B), swapped(components.a, VK_COMPONENT_SWIZZLE_A)};
 }
 
+bool sameStorageForm(const Context& context, VkFormat rendered, VkFormat requested) {
+    if (rendered == requested) return true;
+    const auto storage = HostStorageFormat(context, rendered);
+    return storage != VK_FORMAT_UNDEFINED && storage == HostStorageFormat(context, requested);
+}
+
 }
 
 std::shared_ptr<Texture> MultisampleTargetTexture(const Context& context, const GuestTextureResource& resource, VkComponentMapping components, VkImageViewType viewType) {
@@ -1015,6 +1184,29 @@ std::shared_ptr<Texture> MultisampleTargetTexture(const Context& context, const
     throw std::runtime_error(text);
 }
 
+std::shared_ptr<Texture> MultisampleTargetFirstSample(const Context& context, const GuestTextureResource& resource, VkComponentMapping components) {
+    std::lock_guard lock(targetsMutex());
+    discardRetiredTargets();
+    const auto format = ResolveTextureFormat(resource.format);
+    const MultisampleTarget* other = nullptr;
+    for (const auto& target : targets()) {
+        if (!target->active->load(std::memory_order_acquire)) continue;
+        if (target->context.device != context.device || target->target.surfaceAddress != resource.baseAddress) continue;
+        const auto& rendered = target->target;
+        const bool sameShape = rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0;
+        if (sameShape && rendered.format == format) return target->FirstSample(components);
+        if (sameShape && redBlueSwapped(rendered.format, format)) return target->FirstSample(swapRedBlue(components));
+        other = target.get();
+    }
+    if (other == nullptr) {
+        Require(Recorder::Active() != nullptr, "a multisampled texture is only sampled by recorded draws and dispatches");
+        return createFilled(context, resource, format, "sampling").FirstSample(components);
+    }
+    char text[320];
+    std::snprintf(text, sizeof(text), "AGC graphics: reading sample 0 of multisampled color target 0x%llx (%ux%u, %u samples, vk format %d) as a %ux%u texture of %u samples and guest format %u (vk %d) is not implemented", static_cast<unsigned long long>(resource.baseAddress), other->target.extent.width, other->target.extent.height, other->target.samples, static_cast<int>(other->target.format), resource.width, resource.height, resource.samples, resource.format, static_cast<int>(format));
+    throw std::runtime_error(text);
+}
+
 void MaterializeMultisampleTargetClear(const Context& context, const ColorTarget& target) {
     std::lock_guard lock(targetsMutex());
     acquire(context, target);
@@ -1029,7 +1221,7 @@ VkImageView MultisampleTargetStorageView(const Context& context, const GuestText
         if (!target->active->load(std::memory_order_acquire)) continue;
         if (target->context.device != context.device || target->target.surfaceAddress != resource.baseAddress) continue;
         const auto& rendered = target->target;
-        if (rendered.format == format && rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0) return target->Storage(StorageFormatForGuest(context, resource.format));
+        if (sameStorageForm(context, rendered.format, format) && rendered.extent.width == resource.width && rendered.extent.height == resource.height && rendered.samples == resource.samples && rendered.mip == 0) return target->Storage(StorageFormatForGuest(context, resource.format));
         other = target.get();
     }
     if (other == nullptr) {
@@ -1052,12 +1244,12 @@ void ResolveMultisampleTarget(const Context& context, const ColorTarget& source,
     std::lock_guard lock(targetsMutex());
     auto& target = acquire(context, source);
     target.Keep();
-    const std::array<VkImageView, 2> views{target.view, destinationView};
-    auto framebuffer = std::make_shared<Framebuffer>(context, target.ResolvePass(), views, source.extent);
+    const std::array<VkImageView, 2> views{target.View(source.format), destinationView};
+    auto framebuffer = std::make_shared<Framebuffer>(context, target.ResolvePass(source.format), views, source.extent);
     recordCommands(context, [&](VkCommandBuffer commands, Recorder* recorder) {
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_COLOR_ATTACHMENT_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT);
         VkRenderPassBeginInfo begin{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
-        begin.renderPass = target.ResolvePass();
+        begin.renderPass = target.ResolvePass(source.format);
         begin.framebuffer = framebuffer->Handle();
         begin.renderArea = {{0, 0}, source.extent};
         context.Resolved(&DeviceFunctions::cmdBeginRenderPass, "vkCmdBeginRenderPass")(commands, &begin, VK_SUBPASS_CONTENTS_INLINE);
@@ -1107,6 +1299,20 @@ void NoteColorMetadataFill(std::uint64_t address, std::size_t bytes, std::uint32
     }
 }
 
+std::shared_ptr<Texture> MultisampleTargetFmaskTexture_nid_no_patch(const Context& context, const GuestTextureResource& resource, VkComponentMapping components) {
+    std::lock_guard lock(targetsMutex());
+    discardRetiredTargets();
+    std::shared_ptr<MultisampleTarget> owner;
+    for (const auto& candidate : targets()) {
+        if (!candidate->active->load(std::memory_order_acquire) || candidate->context.device != context.device) continue;
+        const auto& target = candidate->target;
+        if (target.fmaskAddress != resource.baseAddress && (resource.fmaskCmaskAddress == 0u || target.cmaskAddress != resource.fmaskCmaskAddress)) continue;
+        Require(owner == nullptr, "FMASK descriptor refers to more than one resident target");
+        owner = candidate;
+    }
+    return owner != nullptr ? owner->FmaskSampled(resource, components) : nullptr;
+}
+
 void ClearMultisampleTargets(VkDevice device) {
     std::lock_guard lock(targetsMutex());
     std::erase_if(targets(), [&](const auto& target) { return target->context.device == device; });
@@ -1116,6 +1322,17 @@ void ClearMultisampleTargets(VkDevice device) {
     UpdateResidentImageUnmapObserver_nid_no_patch();
 }
 
+void GuardOneFragmentFmask(const Context& context, const ColorTarget& target) {
+    const auto bits = static_cast<std::uint64_t>(target.extent.width) * target.extent.height * target.coverageSamples;
+    const auto bytes = std::max<std::uint64_t>((bits / 8u + 0xffffu) & ~0xffffull, 0x10000u);
+    std::unique_lock lock(guardedMutex());
+    const bool known = std::ranges::any_of(guarded(), [&](const auto& range) { return range.fmask && range.device == context.device && range.address == target.fmaskAddress && range.bytes == bytes; });
+    if (!known) guarded().push_back({context.device, target.fmaskAddress, bytes, target.coverageSamples, std::make_shared<std::atomic<bool>>(true), nullptr, true});
+    anyGuarded().store(true, std::memory_order_release);
+    lock.unlock();
+    InstallResidentImageReadGuard_nid_no_patch();
+}
+
 void RequireNoMultisampleTarget(std::uint64_t address, std::size_t bytes, const char* access) {
     RequireNoResidentDepthRead_nid_no_patch(address, bytes);
     RequireNoMultisampleColorTarget(address, bytes, access);
@@ -1127,6 +1344,10 @@ void RequireNoMultisampleColorTarget(std::uint64_t address, std::size_t bytes, c
     for (const auto& range : guarded()) {
         if (address >= range.address + range.bytes || range.address >= address + bytes) continue;
         char text[256];
+        if (range.fmask) {
+            std::snprintf(text, sizeof(text), "AGC graphics: %s of 0x%llx+0x%zx overlaps the FMASK 0x%llx+0x%llx of a one-fragment color target of %u samples drawn on the host, which does not write it: guest access to it is not implemented", access, static_cast<unsigned long long>(address), bytes, static_cast<unsigned long long>(range.address), static_cast<unsigned long long>(range.bytes), range.samples);
+            throw std::runtime_error(text);
+        }
         std::snprintf(text, sizeof(text), "AGC graphics: %s of 0x%llx+0x%zx overlaps multisampled color target 0x%llx+0x%llx (%u samples), whose samples are only on the host: guest access to it is not implemented", access, static_cast<unsigned long long>(address), bytes, static_cast<unsigned long long>(range.address), static_cast<unsigned long long>(range.bytes), range.samples);
         throw std::runtime_error(text);
     }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp
index faae8726e5..fcad4ff7bf 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Execution/include/PerformanceOverlay.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineLibrary.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
@@ -9,6 +10,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/SampleOrder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/VertexInput.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -18,6 +20,7 @@
 #include <cstdlib>
 #include <list>
 #include <mutex>
+#include <spirv/unified1/spirv.hpp>
 #include <string_view>
 #include <type_traits>
 #include <unordered_map>
@@ -25,6 +28,34 @@
 
 namespace AgcDriver::Graphics {
 
+namespace {
+
+bool LogicOpFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R8_UNORM:
+        case VK_FORMAT_R8G8_UNORM:
+        case VK_FORMAT_R8G8B8A8_UNORM:
+        case VK_FORMAT_B8G8R8A8_UNORM:
+        case VK_FORMAT_A2B10G10R10_UNORM_PACK32:
+        case VK_FORMAT_A2R10G10B10_UNORM_PACK32:
+        case VK_FORMAT_R16_UNORM:
+        case VK_FORMAT_R16G16_UNORM:
+        case VK_FORMAT_R16G16B16A16_UNORM:
+        case VK_FORMAT_R8_UINT:
+        case VK_FORMAT_R8G8_UINT:
+        case VK_FORMAT_R8G8B8A8_UINT:
+        case VK_FORMAT_R16_UINT:
+        case VK_FORMAT_R16G16_UINT:
+        case VK_FORMAT_R16G16B16A16_UINT:
+        case VK_FORMAT_R32_UINT:
+        case VK_FORMAT_R32G32_UINT:
+        case VK_FORMAT_R32G32B32A32_UINT: return true;
+        default: return false;
+    }
+}
+
+}
+
 void LogPipelineStatistics_nid_no_patch(const Context& context, VkPipeline pipeline) {
     if (!context.pipelineExecutableInfo) return;
     const auto getProperties = context.Function<PFN_vkGetPipelineExecutablePropertiesKHR>("vkGetPipelineExecutablePropertiesKHR");
@@ -103,6 +134,18 @@ bool BarycentricPatches(const State& state, std::span<const CompiledShader> shad
     return !state.rectList && state.stages.path == ShaderPath::Vertex && std::any_of(shaders.begin(), shaders.end(), [](const CompiledShader& shader) { return shader.stage == ShaderRecompiler::ShaderStage::TessellationControl; });
 }
 
+bool FragmentInterlock(std::span<const CompiledShader> shaders) {
+    return std::any_of(shaders.begin(), shaders.end(), [](const CompiledShader& shader) {
+        if (shader.stage != ShaderRecompiler::ShaderStage::Fragment || shader.program == nullptr) return false;
+        const auto words = shader.program->spirv.Words();
+        for (std::size_t cursor = 5; cursor + 1 < words.size() && (words[cursor] & 0xffffu) == spv::OpCapability && (words[cursor] >> 16u) == 2u; cursor += 2) {
+            const auto capability = words[cursor + 1];
+            if (capability == spv::CapabilityFragmentShaderPixelInterlockEXT || capability == spv::CapabilityFragmentShaderSampleInterlockEXT || capability == spv::CapabilityFragmentShaderShadingRateInterlockEXT) return true;
+        }
+        return false;
+    });
+}
+
 void ValidateProvokingVertex(const Context& context, const State& state, std::span<const CompiledShader> shaders) {
     Require(state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT || state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT, "invalid provoking vertex mode");
     if (state.provokingVertexMode == VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT) {
@@ -112,6 +155,10 @@ void ValidateProvokingVertex(const Context& context, const State& state, std::sp
         }
         return;
     }
+    for (const auto& shader : shaders) {
+        if (shader.stage != ShaderRecompiler::ShaderStage::Fragment || shader.program == nullptr) continue;
+        Require(std::none_of(shader.program->fragmentParameters.begin(), shader.program->fragmentParameters.end(), [](const ShaderRecompiler::FragmentParameter& parameter) { return parameter.flatP20; }), "v_interp_mov p20 of a flat input with the last provoking vertex is not measured");
+    }
     if (BarycentricPatches(state, shaders)) {
         for (const auto& shader : shaders) {
             if (shader.stage != ShaderRecompiler::ShaderStage::Fragment || shader.program == nullptr) continue;
@@ -119,6 +166,70 @@ void ValidateProvokingVertex(const Context& context, const State& state, std::sp
         }
         return;
     }
+    struct Decorations {
+        std::unordered_map<std::uint64_t, std::uint32_t> builtIns;
+        std::vector<std::uint64_t> perVertexValues;
+        std::vector<std::uint64_t> perPrimitiveValues;
+    };
+    const auto readDecorations = [](const ShaderRecompiler::RecompileResult& program, Decorations& decorations) {
+        const auto words = program.spirv.Words();
+        if (words.size() < 5) return false;
+        constexpr std::uint32_t NoMember = 0xffffffffu;
+        const auto key = [](std::uint32_t target, std::uint32_t member) { return (static_cast<std::uint64_t>(target) << 32u) | member; };
+        for (std::size_t cursor = 5; cursor < words.size();) {
+            const auto count = words[cursor] >> 16u;
+            if (count == 0 || count > words.size() - cursor) return false;
+            const auto op = static_cast<spv::Op>(words[cursor] & 0xffffu);
+            const std::size_t decoration = op == spv::OpDecorate ? 2 : op == spv::OpMemberDecorate ? 3 : 0;
+            if (decoration != 0 && count > decoration) {
+                const auto target = key(words[cursor + 1], op == spv::OpMemberDecorate ? words[cursor + 2] : NoMember);
+                if (words[cursor + decoration] == spv::DecorationFlat || words[cursor + decoration] == spv::DecorationPerVertexKHR) decorations.perVertexValues.push_back(target);
+                if (words[cursor + decoration] == spv::DecorationPerPrimitiveEXT) decorations.perPrimitiveValues.push_back(target);
+                if (words[cursor + decoration] == spv::DecorationBuiltIn && count > decoration + 1) decorations.builtIns[target] = words[cursor + decoration + 1];
+            }
+            cursor += count;
+        }
+        return true;
+    };
+    const auto readsProvokingVertex = [&](const ShaderRecompiler::RecompileResult& program) {
+        if (std::any_of(program.fragmentParameters.begin(), program.fragmentParameters.end(), [](const ShaderRecompiler::FragmentParameter& parameter) {
+            return parameter.flat || parameter.perVertex || parameter.custom || parameter.flatP10;
+        })) return true;
+        Decorations decorations;
+        if (!readDecorations(program, decorations)) return true;
+        const auto& builtIns = decorations.builtIns;
+        return std::any_of(decorations.perVertexValues.begin(), decorations.perVertexValues.end(), [&](std::uint64_t target) {
+            const auto builtIn = builtIns.find(target);
+            if (builtIn == builtIns.end()) return true;
+            switch (builtIn->second) {
+            case spv::BuiltInFragCoord:
+            case spv::BuiltInPointCoord:
+            case spv::BuiltInFrontFacing:
+            case spv::BuiltInSampleId:
+            case spv::BuiltInSamplePosition:
+            case spv::BuiltInSampleMask:
+            case spv::BuiltInHelperInvocation:
+            case spv::BuiltInSubgroupSize:
+            case spv::BuiltInSubgroupLocalInvocationId:
+                return false;
+            default:
+                return true;
+            }
+        });
+    };
+    const auto writesProvokingVertexBuiltIn = [&](const ShaderRecompiler::RecompileResult& program) {
+        Decorations decorations;
+        if (!readDecorations(program, decorations)) return true;
+        return std::any_of(decorations.builtIns.begin(), decorations.builtIns.end(), [&](const auto& builtIn) {
+            return (builtIn.second == spv::BuiltInLayer || builtIn.second == spv::BuiltInViewportIndex) &&
+                   std::find(decorations.perPrimitiveValues.begin(), decorations.perPrimitiveValues.end(), builtIn.first) == decorations.perPrimitiveValues.end();
+        });
+    };
+    const bool observed = std::any_of(shaders.begin(), shaders.end(), [&](const CompiledShader& shader) {
+        if (shader.stage == ShaderRecompiler::ShaderStage::Fragment) return shader.program == nullptr || readsProvokingVertex(*shader.program);
+        return shader.program != nullptr && writesProvokingVertexBuiltIn(*shader.program);
+    });
+    if (!context.provokingVertexLast && !observed) return;
     Require(context.provokingVertexLast, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
     const bool meshPrimitives = state.stages.path == ShaderPath::Geometry && state.stages.mesh;
     Require(!state.stages.tessellation && (meshPrimitives || (state.stages.path == ShaderPath::Vertex && !state.stages.mesh)), "last provoking vertex is unsupported for generated primitive pipelines");
@@ -162,8 +273,10 @@ bool ShadersWriteMemory(std::span<const CompiledShader> shaders) {
                 if (binding.kind == ShaderRecompiler::DescriptorKind::StorageImage && any(binding.imageWritten, binding.count)) return true;
                 break;
             case ShaderRecompiler::DescriptorRole::Gds:
-            case ShaderRecompiler::DescriptorRole::BdaPagetable:
                 return true;
+            case ShaderRecompiler::DescriptorRole::BdaPagetable:
+                if (shader.program->bdaWrites) return true;
+                break;
             case ShaderRecompiler::DescriptorRole::GuestSamplers:
             case ShaderRecompiler::DescriptorRole::FaultBuffer:
             case ShaderRecompiler::DescriptorRole::FlattenedSrt:
@@ -208,7 +321,7 @@ void appendKey(std::vector<std::byte>& key, const TValue& value) {
 
 bool libraryKeys(PipelineLibraryKeys& keys, const Context& context, const State& state, const VertexInputLayout& input, const PipelineSetLayouts& resources, std::span<const CompiledShader> shaders) {
     using Stage = ShaderRecompiler::ShaderStage;
-    if (!context.graphicsPipelineLibrary || context.pipelineExecutableInfo || state.depthBiasPerFace || state.rectList || BarycentricPatches(state, shaders) || SplitsAlternateAlpha(state)) return false;
+    if (!context.graphicsPipelineLibrary || context.pipelineExecutableInfo || state.depthBiasPerFace || state.rectList || BarycentricPatches(state, shaders) || SplitsAlternateAlpha(state) || std::ranges::any_of(shaders, [](const CompiledShader& shader) { return shader.program != nullptr && shader.program->functionLdsBuffer; }) || FragmentInterlock(shaders)) return false;
     keys = {};
     for (const auto& shader : shaders) {
         const auto identity = shader.program->Identity();
@@ -259,6 +372,8 @@ bool libraryKeys(PipelineLibraryKeys& keys, const Context& context, const State&
     appendKey(keys.fragmentOutput, state.perSampleShading);
     appendKey(keys.fragmentShader, state.mergedCoverage);
     appendKey(keys.fragmentOutput, state.mergedCoverage);
+    appendKey(keys.fragmentShader, state.truncatedCoverage);
+    appendKey(keys.fragmentOutput, state.truncatedCoverage);
     const auto sampleLocationsEnabled = ValidateSampleLocations(context, state);
     appendKey(keys.fragmentShader, sampleLocationsEnabled);
     appendKey(keys.fragmentOutput, sampleLocationsEnabled);
@@ -276,11 +391,13 @@ bool libraryKeys(PipelineLibraryKeys& keys, const Context& context, const State&
         }
     }
     for (const auto& blend : state.blends) appendKey(keys.fragmentOutput, blend);
+    appendKey(keys.fragmentOutput, state.colorRop);
     for (const auto value : state.blendConstants) appendKey(keys.fragmentOutput, value);
     appendKey(keys.renderPass, state.blends.size());
     for (const auto& color : state.colors) {
         appendKey(keys.renderPass, color.format);
         appendKey(keys.renderPass, color.exportIndex);
+        appendKey(keys.renderPass, color.partialWriteMask != 0u);
     }
     appendKey(keys.renderPass, state.depth.has_value());
     if (state.depth) appendKey(keys.renderPass, state.depth->format);
@@ -323,6 +440,8 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
 
 Pipeline::Pipeline(const Context& context, const State& state, const VertexInputLayout& vertexInput, const PipelineSetLayouts& resources, std::span<const CompiledShader> shaders, VkImageLayout attachmentLayout) : context(context), _modules(shaders.size()), attachments(state.colors.size() + (state.depth ? 1u : 0u)), colorAttachments(state.colors.size()), depthBounds(state.depth.has_value() && state.depthBoundsTest), depthBias(state.depth.has_value() && state.depthBias), dynamicRendering(context.graphicsPipelineLibrary) {
     PerformanceTimer timing("Vulkan.GraphicsPipeline");
+    for (const auto& color : state.colors) boundAttachments.push_back(color.partialWriteMask == 0u);
+    if (state.depth) boundAttachments.push_back(true);
     sampleLocationsEnabled = ValidateSampleLocations(context, state);
     const auto host = HostSampleLocationsFor(context, state);
     sampleLocationGrid = host.grid;
@@ -332,20 +451,25 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
     this->context.bufferPool.reset();
     Require(state.blends.size() == (state.colors.empty() ? 0u : state.colors.back().exportIndex + 1u) && state.colors.size() <= state.blends.size(), "blend states do not match decoded color state");
     Require(state.blends.size() <= context.limits.maxColorAttachments, "color targets exceed device attachment limits");
-    Require(state.hasColorTarget || (context.limits.framebufferNoAttachmentsSampleCounts & static_cast<VkSampleCountFlagBits>(state.samples)) != 0, "device does not support rendering without attachments at the draw's sample count");
+    const bool boundColor = std::ranges::any_of(state.colors, [](const ColorTarget& color) { return color.partialWriteMask == 0u; });
+    Require((state.hasColorTarget && (boundColor || state.colors.empty() || state.depth.has_value())) || (context.limits.framebufferNoAttachmentsSampleCounts & static_cast<VkSampleCountFlagBits>(state.samples)) != 0, "device does not support rendering without attachments at the draw's sample count");
     Require(state.samples == 1 || !state.depth.has_value() || (context.limits.framebufferDepthSampleCounts & static_cast<VkSampleCountFlagBits>(state.samples)) != 0, "device does not support depth targets with the draw's sample count");
     Require(!depthBounds || context.depthBounds, "device does not support the depth bounds test");
     Require(!depthBias || state.depthBiasClamp == 0.0f || context.depthBiasClamp, "device does not support depth bias clamping");
     Require(!state.dualSourceBlend || (context.dualSrcBlend && state.blends.size() <= context.limits.maxFragmentDualSrcAttachments), "device does not support dual-source blending into this many attachments");
     Require(state.reversedBlend == 0 || (context.dualSrcBlend && state.blends.size() <= context.limits.maxFragmentDualSrcAttachments), "blending into a color target with a reversed component order through a second source color needs dual-source blending, which the device does not support");
+    Require(LogicOpFromRop(state.colorRop) == VK_LOGIC_OP_COPY || context.logicOp, "device does not support color logic operations");
+    Require(LogicOpFromRop(state.colorRop) == VK_LOGIC_OP_COPY || std::ranges::all_of(state.colors, [](const ColorTarget& color) { return LogicOpFormat(color.format); }), "color logic operations on a color target that is not a normalized or integer format are not implemented");
     Require(!state.negativeOneToOne || context.depthClipControl, "negative-one-to-one depth clipping requires VK_EXT_depth_clip_control with depthClipControl enabled");
     Require(!state.perSampleShading || context.sampleRateShading, "per-sample pixel shading requires the sampleRateShading device feature");
     Require(!state.mergedCoverage || (context.mergedCoverageSampleCounts & state.samples) != 0, "an overrasterized draw (a multisampled rasterizer into one-sample color targets) requires VK_NV_framebuffer_mixed_samples with merged coverage reduction");
+    Require(!(state.vertexPoints || (state.stages.mesh.has_value() && state.stages.mesh->outputPrimitiveSize == 1u)) || context.largePoints || (state.pointSize == 1.0f && ((state.paClVsOutCntl & (1u << 16u)) == 0 || (state.pointSizeMin == 1.0f && state.pointSizeMax == 1.0f))), "points of a size other than one pixel require the largePoints device feature");
+    Require(!state.truncatedCoverage || (context.truncatedCoverageSampleCounts & state.samples) != 0, "one-sample color targets beside a multisampled depth target require VK_AMD_mixed_attachment_samples or VK_NV_framebuffer_mixed_samples with truncated coverage reduction");
     Require(state.conservativeRasterization == VK_CONSERVATIVE_RASTERIZATION_MODE_DISABLED_EXT || context.conservativeRasterization, "conservative rasterization requires VK_EXT_conservative_rasterization with at most 1/256 pixel of overestimation and degenerate triangles rasterized");
     ValidateProvokingVertex(context, state, shaders);
     if (state.rectList) Require(context.tessellationShader && context.limits.maxTessellationPatchSize >= 4, "rect-list requires tessellation with four output control points");
     const bool barycentricPatches = BarycentricPatches(state, shaders);
-    if (barycentricPatches) Require(context.tessellationShader && state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST && !state.primitiveRestart, "emulated barycentrics through tessellation require a triangle list without primitive restart");
+    if (barycentricPatches) Require(context.tessellationShader && (state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST || state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP) && !state.primitiveRestart, "emulated barycentrics through tessellation require a triangle list or strip without primitive restart");
     if (std::any_of(shaders.begin(), shaders.end(), [](const CompiledShader& shader) { return shader.stage == ShaderRecompiler::ShaderStage::Geometry; })) Require(context.geometryShader, "device does not support geometry shaders");
     if (state.stages.tessellation) {
         Require(context.tessellationShader, "device does not support tessellation shaders");
@@ -388,12 +512,14 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         }
         // A descriptor set layout with the same bindings as this one is compatible with the pipeline
         // layout, so later draws bind their own ShaderResources' set under it.
-        const std::array<VkDescriptorSetLayout, 2> setLayouts{resources.main, resources.fragment};
+        const bool pixelLds = std::ranges::any_of(shaders, [](const CompiledShader& shader) { return shader.program != nullptr && shader.program->functionLdsBuffer; });
+        const auto pixelLdsLayouts = pixelLds ? PixelFunctionLdsSetLayouts(context) : PixelFunctionLdsLayouts{};
+        const std::array<VkDescriptorSetLayout, 3> setLayouts{resources.main, pixelLds && !resources.split ? pixelLdsLayouts.empty : resources.fragment, pixelLdsLayouts.buffer};
         const VkPushConstantRange push{pushStages, 0, PipelinePushSlotBytes};
         const std::array<VkPushConstantRange, 2> slots{{{pushStagesOf(context), 0, PipelinePushSlotBytes}, {VK_SHADER_STAGE_FRAGMENT_BIT, PipelinePushSlotBytes, PipelinePushSlotBytes}}};
         VkPipelineLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
-        layoutInfo.flags = resources.split ? VK_PIPELINE_LAYOUT_CREATE_INDEPENDENT_SETS_BIT_EXT : 0;
-        layoutInfo.setLayoutCount = resources.split ? 2u : 1u;
+        layoutInfo.flags = pixelLds || !resources.split ? 0 : VK_PIPELINE_LAYOUT_CREATE_INDEPENDENT_SETS_BIT_EXT;
+        layoutInfo.setLayoutCount = pixelLds ? 3u : resources.split ? 2u : 1u;
         layoutInfo.pSetLayouts = setLayouts.data();
         layoutInfo.pushConstantRangeCount = dynamicRendering ? static_cast<std::uint32_t>(slots.size()) : pushStages != 0 ? 1 : 0;
         layoutInfo.pPushConstantRanges = dynamicRendering ? slots.data() : pushStages != 0 ? &push : nullptr;
@@ -401,18 +527,20 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         std::vector<VkAttachmentDescription> colors;
         std::vector<VkAttachmentReference> references(state.blends.size(), VkAttachmentReference{VK_ATTACHMENT_UNUSED, attachmentLayout});
         for (std::uint32_t index = 0; index < state.colors.size(); ++index) {
+            if (state.colors[index].partialWriteMask != 0u) continue;
             VkAttachmentDescription color{};
             color.format = state.colors[index].format;
-            color.samples = state.mergedCoverage ? VK_SAMPLE_COUNT_1_BIT : static_cast<VkSampleCountFlagBits>(state.samples);
+            color.samples = state.mergedCoverage || state.truncatedCoverage ? VK_SAMPLE_COUNT_1_BIT : static_cast<VkSampleCountFlagBits>(state.samples);
             color.loadOp = VK_ATTACHMENT_LOAD_OP_LOAD;
             color.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
             color.stencilLoadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
             color.stencilStoreOp = VK_ATTACHMENT_STORE_OP_DONT_CARE;
             color.initialLayout = attachmentLayout;
             color.finalLayout = attachmentLayout;
+            references.at(state.colors[index].exportIndex) = {static_cast<std::uint32_t>(colors.size()), attachmentLayout};
             colors.push_back(color);
-            references.at(state.colors[index].exportIndex) = {index, attachmentLayout};
         }
+        boundColorAttachments = static_cast<std::uint32_t>(colors.size());
         VkSubpassDescription subpass{};
         subpass.pipelineBindPoint = VK_PIPELINE_BIND_POINT_GRAPHICS;
         subpass.colorAttachmentCount = static_cast<std::uint32_t>(references.size());
@@ -432,7 +560,9 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
             subpass.pDepthStencilAttachment = &depthReference;
         }
         std::vector<VkFormat> renderingColors(state.blends.size(), VK_FORMAT_UNDEFINED);
-        for (const auto& color : state.colors) renderingColors.at(color.exportIndex) = color.format;
+        for (const auto& color : state.colors) {
+            if (color.partialWriteMask == 0u) renderingColors.at(color.exportIndex) = color.format;
+        }
         VkPipelineRenderingCreateInfoKHR rendering{VK_STRUCTURE_TYPE_PIPELINE_RENDERING_CREATE_INFO_KHR};
         rendering.colorAttachmentCount = static_cast<std::uint32_t>(renderingColors.size());
         rendering.pColorAttachmentFormats = renderingColors.empty() ? nullptr : renderingColors.data();
@@ -440,7 +570,8 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         VkAttachmentSampleCountInfoNV attachmentSamples{VK_STRUCTURE_TYPE_ATTACHMENT_SAMPLE_COUNT_INFO_NV};
         attachmentSamples.colorAttachmentCount = static_cast<std::uint32_t>(mergedColorSamples.size());
         attachmentSamples.pColorAttachmentSamples = mergedColorSamples.empty() ? nullptr : mergedColorSamples.data();
-        if (state.mergedCoverage) rendering.pNext = &attachmentSamples;
+        if (state.truncatedCoverage) attachmentSamples.depthStencilAttachmentSamples = static_cast<VkSampleCountFlagBits>(state.samples);
+        if (state.mergedCoverage || state.truncatedCoverage) rendering.pNext = &attachmentSamples;
         if (state.depth) {
             rendering.depthAttachmentFormat = HostDepthFormat(context, state.depth->format);
             if (HasStencil(state.depth->format)) rendering.stencilAttachmentFormat = rendering.depthAttachmentFormat;
@@ -448,7 +579,9 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         if (dynamicRendering) {
             depthFormat = state.depth ? HostDepthFormat(context, state.depth->format) : VK_FORMAT_UNDEFINED;
             colorSlots.assign(state.blends.size(), ~0u);
-            for (std::uint32_t index = 0; index < state.colors.size(); ++index) colorSlots.at(state.colors[index].exportIndex) = index;
+            for (std::uint32_t index = 0; index < state.colors.size(); ++index) {
+                if (state.colors[index].partialWriteMask == 0u) colorSlots.at(state.colors[index].exportIndex) = index;
+            }
             this->attachmentLayout = attachmentLayout;
         }
         VkRenderPassCreateInfo passInfo{VK_STRUCTURE_TYPE_RENDER_PASS_CREATE_INFO};
@@ -514,8 +647,8 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
         sampleLocations.sampleLocationsInfo = {VK_STRUCTURE_TYPE_SAMPLE_LOCATIONS_INFO_EXT, nullptr, samples.rasterizationSamples, grid, state.samples * grid.width * grid.height, locations.data()};
         if (sampleLocationsEnabled) samples.pNext = &sampleLocations;
         VkPipelineCoverageReductionStateCreateInfoNV coverageReduction{VK_STRUCTURE_TYPE_PIPELINE_COVERAGE_REDUCTION_STATE_CREATE_INFO_NV};
-        coverageReduction.coverageReductionMode = VK_COVERAGE_REDUCTION_MODE_MERGE_NV;
-        if (state.mergedCoverage) {
+        coverageReduction.coverageReductionMode = state.truncatedCoverage ? VK_COVERAGE_REDUCTION_MODE_TRUNCATE_NV : VK_COVERAGE_REDUCTION_MODE_MERGE_NV;
+        if (state.mergedCoverage || (state.truncatedCoverage && !context.mixedAttachmentSamples)) {
             coverageReduction.pNext = samples.pNext;
             samples.pNext = &coverageReduction;
         }
@@ -550,6 +683,10 @@ Pipeline::Pipeline(const Context& context, const State& state, const VertexInput
                 secondChannels[index].colorBlendOp = state.blends[index].alphaBlendOp;
             }
         }
+        if (const auto logicOp = LogicOpFromRop(state.colorRop); logicOp != VK_LOGIC_OP_COPY) {
+            blend.logicOpEnable = VK_TRUE;
+            blend.logicOp = logicOp;
+        }
         blend.attachmentCount = static_cast<std::uint32_t>(firstChannels.size());
         blend.pAttachments = firstChannels.empty() ? nullptr : firstChannels.data();
         std::copy(state.blendConstants.begin(), state.blendConstants.end(), blend.blendConstants);
@@ -694,7 +831,11 @@ std::shared_ptr<Framebuffer> Pipeline::AcquireFramebuffer(std::span<const VkImag
             return framebuffers.back().framebuffer;
         }
     }
-    auto framebuffer = std::make_shared<Framebuffer>(context, renderPass, targets, extent, layers);
+    std::vector<VkImageView> boundViews;
+    for (std::size_t i = 0; i < targets.size(); ++i) {
+        if (boundAttachments[i]) boundViews.push_back(targets[i]);
+    }
+    auto framebuffer = std::make_shared<Framebuffer>(context, renderPass, renderPass == VK_NULL_HANDLE ? targets : std::span<const VkImageView>(boundViews), extent, layers);
     if (!resident) return framebuffer;
     // Beyond the bound the least recently used unreferenced entry goes.
     constexpr std::size_t bound = 8;
@@ -752,7 +893,7 @@ void Pipeline::Begin(VkCommandBuffer commands, const Framebuffer& framebuffer, V
     const auto locations = SampleLocations(state);
     const auto grid = sampleLocationGrid;
     const VkSampleLocationsInfoEXT info{VK_STRUCTURE_TYPE_SAMPLE_LOCATIONS_INFO_EXT, nullptr, static_cast<VkSampleCountFlagBits>(state.samples), grid, state.samples * grid.width * grid.height, locations.data()};
-    const VkAttachmentSampleLocationsEXT initial{static_cast<std::uint32_t>(state.colors.size()), info};
+    const VkAttachmentSampleLocationsEXT initial{boundColorAttachments, info};
     const VkSubpassSampleLocationsEXT post{0, info};
     VkRenderPassSampleLocationsBeginInfoEXT sampleLocations{VK_STRUCTURE_TYPE_RENDER_PASS_SAMPLE_LOCATIONS_BEGIN_INFO_EXT};
     sampleLocations.attachmentInitialSampleLocationsCount = state.depth ? 1 : 0;
@@ -889,10 +1030,12 @@ void pipelineKey(std::vector<std::byte>& key, const Context& context, const Stat
     append(key, state.conservativeRasterization);
     append(key, state.blends.size());
     for (const auto& blend : state.blends) append(key, blend);
+    append(key, state.colorRop);
     for (const auto value : state.blendConstants) append(key, value);
     append(key, state.samples);
     append(key, state.perSampleShading);
     append(key, state.mergedCoverage);
+    append(key, state.truncatedCoverage);
     append(key, state.customSampleLocations);
     if (state.customSampleLocations) {
         append(key, state.sampleLocationGrid);
@@ -902,6 +1045,7 @@ void pipelineKey(std::vector<std::byte>& key, const Context& context, const Stat
     for (const auto& color : state.colors) {
         append(key, color.format);
         append(key, color.componentMapping);
+        append(key, color.partialWriteMask != 0u);
     }
     if (state.blends.size() != state.colors.size()) {
         for (const auto& color : state.colors) append(key, color.exportIndex);
@@ -972,7 +1116,7 @@ struct PipelineStore {
         std::vector<std::byte> key;
         std::shared_ptr<Pipeline> pipeline;
     };
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     // Least recently used first.
     std::list<Entry> entries;
     std::unordered_map<std::uint64_t, std::list<Entry>::iterator> index;
@@ -1155,6 +1299,7 @@ void ClearCachedPipelines(VkDevice device) {
         it = store.entries.erase(it);
     }
     ClearPipelineLibraries(device);
+    ReleasePixelFunctionLds(device);
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp
index 73fac4402d..28df53956c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp
@@ -197,7 +197,7 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         settledBytes = liveBytes;
         settledFile = file;
     };
-    const auto disk = fileUnchanged ? File{} : readFile();
+    auto disk = fileUnchanged ? File{} : readFile();
     if (disk.state == FileState::Unreadable) {
         std::fprintf(stderr, "[pipeline-cache] cannot read %s; not saving over it\n", path.string().c_str());
         settle(readHeader());
@@ -206,12 +206,16 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
     if (disk.state == FileState::Invalid) std::fprintf(stderr, "[pipeline-cache] replacing %s: %s\n", path.string().c_str(), disk.invalidReason);
     std::size_t floor = fileUnchanged ? std::max<std::size_t>(loadedBytes, settledFile->dataBytes) : 0;
     VkPipelineCache merged = VK_NULL_HANDLE;
+    bool mergedWithFile = false;
     struct DestroyMerged {
         const Context& context;
-        const VkPipelineCache& cache;
-        ~DestroyMerged() {
-            if (cache != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipelineCache>("vkDestroyPipelineCache")(context.device, cache, nullptr);
+        VkPipelineCache& cache;
+        void Reset() {
+            if (cache == VK_NULL_HANDLE) return;
+            context.Function<PFN_vkDestroyPipelineCache>("vkDestroyPipelineCache")(context.device, cache, nullptr);
+            cache = VK_NULL_HANDLE;
         }
+        ~DestroyMerged() { Reset(); }
     } destroyMerged{context, merged};
     if (disk.state == FileState::Valid) {
         const auto data = disk.Payload();
@@ -221,11 +225,13 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         const auto result = context.Function<PFN_vkCreatePipelineCache>("vkCreatePipelineCache")(context.device, &info, nullptr, &merged);
         if (result == VK_SUCCESS) {
             floor = std::max(loadedBytes, data.size());
+            mergedWithFile = true;
         } else {
             merged = VK_NULL_HANDLE;
             std::fprintf(stderr, "[pipeline-cache] replacing %s: the driver refused it (Vulkan result %d)\n", path.string().c_str(), static_cast<int>(result));
         }
     }
+    std::vector<std::byte>().swap(disk.contents);
     if (merged != VK_NULL_HANDLE) {
         auto synchronizationLock = snapshot();
         if (!synchronizationLock.owns_lock()) return;
@@ -251,6 +257,7 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         if (result != VK_SUCCESS && result != VK_INCOMPLETE) return;
         file.resize(sizeof(FileHeader) + size);
     }
+    destroyMerged.Reset();
     if (size < floor) {
         std::fprintf(stderr, "[pipeline-cache] keeping %s: the merged cache has %.1f KiB, less than the %.1f KiB on disk or loaded at start\n", path.string().c_str(), static_cast<double>(size) / 1024.0, static_cast<double>(floor) / 1024.0);
         settle(fileUnchanged ? *settledFile : disk.header);
@@ -263,7 +270,7 @@ void PipelineCache::save(bool final, bool waitForPipelines) {
         return;
     }
     settle(header);
-    if (final || profiling()) std::fprintf(stderr, "[pipeline-cache] saved %.1f KiB to %s in %.1f ms%s%s\n", static_cast<double>(size) / 1024.0, path.string().c_str(), std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count(), merged != VK_NULL_HANDLE ? " (merged with the file)" : "", final ? " (teardown)" : "");
+    if (final || profiling()) std::fprintf(stderr, "[pipeline-cache] saved %.1f KiB to %s in %.1f ms%s%s\n", static_cast<double>(size) / 1024.0, path.string().c_str(), std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count(), mergedWithFile ? " (merged with the file)" : "", final ? " (teardown)" : "");
 }
 
 void PipelineCache::SaveNow() {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp
index d0669ed238..7eba2c79ac 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp
@@ -1,11 +1,13 @@
 #include "prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
 #include "ShaderCacheDirectory.hpp"
 #include "ShaderDiskCache.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
+#include <cerrno>
 #include <chrono>
 #include <condition_variable>
 #include <cstdlib>
@@ -23,6 +25,7 @@
 #else
 #include <fcntl.h>
 #include <sys/file.h>
+#include <sys/stat.h>
 #include <unistd.h>
 #endif
 
@@ -35,7 +38,7 @@ static_assert(sizeof(VkStencilOpState) == 28, "VkStencilOpState changed: update
 static_assert(sizeof(VkVertexInputBindingDescription) == 12, "VkVertexInputBindingDescription changed: update the recipe codec");
 static_assert(sizeof(VkVertexInputAttributeDescription) == 16, "VkVertexInputAttributeDescription changed: update the recipe codec");
 #if defined(__linux__) && defined(__x86_64__) && defined(__GLIBCXX__)
-static_assert(sizeof(State) == 784, "State changed: update CanonicalPipelineState and the recipe codec");
+static_assert(sizeof(State) == 832, "State changed: update CanonicalPipelineState and the recipe codec");
 static_assert(sizeof(ShaderStages) == 112, "ShaderStages changed: update the recipe codec");
 static_assert(sizeof(ShaderRecompiler::MeshConfiguration) == 40, "MeshConfiguration changed: update the recipe codec");
 static_assert(sizeof(ShaderRecompiler::TessellationConfiguration) == 40, "TessellationConfiguration changed: update the recipe codec");
@@ -44,7 +47,7 @@ static_assert(sizeof(ShaderRecompiler::TessellationConfiguration) == 40, "Tessel
 constexpr std::uint32_t FileMagic = 0x4c4a5041u;
 // Bumped when the recipe codec, CanonicalPipelineState or the store key change in a way the
 // layout guards above do not catch (a field renumbered or reinterpreted at the same size).
-constexpr std::uint32_t FileFormat = 6u;
+constexpr std::uint32_t FileFormat = 10u;
 constexpr std::uint32_t ModuleRecord = 1u;
 constexpr std::uint32_t GraphicsRecord = 2u;
 constexpr std::uint32_t ComputeRecord = 3u;
@@ -195,6 +198,7 @@ void encodeState(Writer& writer, const State& state) {
         writer.U32(static_cast<std::uint32_t>(color.format));
         writer.U32(color.exportIndex);
         writer.Raw(color.componentMapping);
+        writer.Raw(color.partialWriteMask);
     }
     writer.Raws(std::span<const VkPipelineColorBlendAttachmentState>(state.blends));
     for (const auto value : state.blendConstants) writer.Raw(value);
@@ -202,6 +206,7 @@ void encodeState(Writer& writer, const State& state) {
     writer.Bool(state.rectList);
     writer.Bool(state.dualSourceBlend);
     writer.U32(state.reversedBlend);
+    writer.U32(state.colorRop);
     writer.U32(static_cast<std::uint32_t>(state.topology));
     writer.Bool(state.primitiveRestart);
     writer.Bool(state.negativeOneToOne);
@@ -217,8 +222,13 @@ void encodeState(Writer& writer, const State& state) {
     writer.Bool(state.sampleLocationGrid);
     writer.Bool(state.perSampleShading);
     writer.Bool(state.mergedCoverage);
+    writer.Bool(state.truncatedCoverage);
     for (const auto mask : state.quadSampleMask) writer.Raw(mask);
     writer.U32(state.depthRemap.mode);
+    writer.Bool(state.vertexPoints);
+    writer.Raw(state.pointSize);
+    writer.Raw(state.pointSizeMin);
+    writer.Raw(state.pointSizeMax);
 }
 
 void decodeState(Reader& reader, State& state) {
@@ -255,6 +265,7 @@ void decodeState(Reader& reader, State& state) {
         color.format = static_cast<VkFormat>(reader.U32());
         color.exportIndex = reader.U32();
         color.componentMapping = reader.Raw<std::uint8_t>();
+        color.partialWriteMask = reader.Raw<std::uint16_t>();
         state.colors.push_back(color);
     }
     reader.Raws(state.blends, 8u);
@@ -263,6 +274,7 @@ void decodeState(Reader& reader, State& state) {
     state.rectList = reader.Bool();
     state.dualSourceBlend = reader.Bool();
     state.reversedBlend = reader.U32();
+    state.colorRop = static_cast<std::uint8_t>(reader.U32());
     state.topology = static_cast<VkPrimitiveTopology>(reader.U32());
     state.primitiveRestart = reader.Bool();
     state.negativeOneToOne = reader.Bool();
@@ -278,8 +290,13 @@ void decodeState(Reader& reader, State& state) {
     state.sampleLocationGrid = reader.Bool();
     state.perSampleShading = reader.Bool();
     state.mergedCoverage = reader.Bool();
+    state.truncatedCoverage = reader.Bool();
     for (auto& mask : state.quadSampleMask) mask = reader.Raw<std::uint16_t>();
     state.depthRemap.mode = reader.U32();
+    state.vertexPoints = reader.Bool();
+    state.pointSize = reader.Raw<float>();
+    state.pointSizeMin = reader.Raw<float>();
+    state.pointSizeMax = reader.Raw<float>();
 }
 
 void encodeRecipe(Writer& writer, const GraphicsPipelineRecipe& recipe) {
@@ -327,6 +344,10 @@ std::uint64_t padded(std::uint64_t bytes) {
     return (bytes + RecordAlignment - 1u) / RecordAlignment * RecordAlignment;
 }
 
+std::uint64_t recordBytes(std::uint64_t payloadBytes) {
+    return padded(sizeof(RecordHeader) + payloadBytes);
+}
+
 bool profiling() {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     return profile;
@@ -347,6 +368,16 @@ std::uint64_t configured(const char* name, std::uint64_t fallback) {
 // second run of the same install) takes the same lock file, so its appends and this run's never
 // interleave and neither cuts a record the other is writing. Taken before the journal's mutex,
 // never while holding it.
+bool replaceFile(const std::filesystem::path& temporary, const std::filesystem::path& target) {
+#ifdef _WIN32
+    return ::MoveFileExW(temporary.c_str(), target.c_str(), MOVEFILE_REPLACE_EXISTING | MOVEFILE_WRITE_THROUGH) != 0;
+#else
+    std::error_code error;
+    std::filesystem::rename(temporary, target, error);
+    return !error;
+#endif
+}
+
 class FileLock {
 public:
     explicit FileLock(const std::filesystem::path& path) {
@@ -397,13 +428,100 @@ private:
 #endif
 };
 
+class JournalFile {
+public:
+    explicit JournalFile(const std::filesystem::path& path) {
+#ifdef _WIN32
+        handle = CreateFileW(path.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, nullptr);
+        LARGE_INTEGER length{};
+        if (handle != INVALID_HANDLE_VALUE && GetFileSizeEx(handle, &length) && length.QuadPart >= 0) {
+            size = static_cast<std::uint64_t>(length.QuadPart);
+        } else if (handle != INVALID_HANDLE_VALUE) {
+            CloseHandle(handle);
+            handle = INVALID_HANDLE_VALUE;
+        }
+#else
+        descriptor = ::open(path.c_str(), O_RDONLY | O_CLOEXEC);
+        struct stat status{};
+        if (descriptor >= 0 && ::fstat(descriptor, &status) == 0 && status.st_size >= 0) {
+            size = static_cast<std::uint64_t>(status.st_size);
+        } else if (descriptor >= 0) {
+            ::close(descriptor);
+            descriptor = -1;
+        }
+#endif
+    }
+
+    ~JournalFile() {
+#ifdef _WIN32
+        if (handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
+#else
+        if (descriptor >= 0) ::close(descriptor);
+#endif
+    }
+
+    JournalFile(const JournalFile&) = delete;
+    JournalFile& operator=(const JournalFile&) = delete;
+
+#ifdef _WIN32
+    [[nodiscard]] bool Open() const { return handle != INVALID_HANDLE_VALUE; }
+#else
+    [[nodiscard]] bool Open() const { return descriptor >= 0; }
+#endif
+    [[nodiscard]] std::uint64_t Size() const { return size; }
+
+    bool Read(std::uint64_t offset, std::span<std::byte> bytes) const {
+        for (std::size_t done = 0; done < bytes.size();) {
+            const auto position = offset + done;
+#ifdef _WIN32
+            struct ReadEvent {
+                HANDLE event = CreateEventW(nullptr, TRUE, FALSE, nullptr);
+                ~ReadEvent() {
+                    if (event != nullptr) CloseHandle(event);
+                }
+            };
+            auto& completion = HostThreadLocal<ReadEvent, ReadEvent>();
+            if (completion.event == nullptr) return false;
+            OVERLAPPED at{};
+            at.Offset = static_cast<DWORD>(position);
+            at.OffsetHigh = static_cast<DWORD>(position >> 32u);
+            at.hEvent = completion.event;
+            DWORD count = 0;
+            if (!ReadFile(handle, bytes.data() + done, static_cast<DWORD>(std::min<std::size_t>(bytes.size() - done, MAXDWORD)), nullptr, &at) && GetLastError() != ERROR_IO_PENDING) return false;
+            if (!GetOverlappedResult(handle, &at, &count, TRUE) || count == 0) return false;
+#else
+            const auto count = ::pread(descriptor, bytes.data() + done, bytes.size() - done, static_cast<off_t>(position));
+            if (count < 0 && errno == EINTR) continue;
+            if (count <= 0) return false;
+#endif
+            done += static_cast<std::size_t>(count);
+        }
+        return true;
+    }
+
+    template<typename TValue>
+    bool ReadValue(std::uint64_t offset, TValue& value) const requires std::is_trivially_copyable_v<TValue> {
+        return Read(offset, std::as_writable_bytes(std::span(&value, 1)));
+    }
+
+private:
+#ifdef _WIN32
+    HANDLE handle = INVALID_HANDLE_VALUE;
+#else
+    int descriptor = -1;
+#endif
+    std::uint64_t size = 0;
+};
+
 // The end of the last whole record in [from, size) of the file: records another process appended
 // after this one loaded the file are kept, the torn tail of a record a crashed run left is cut.
 std::uint64_t validTail(const std::filesystem::path& path, std::uint64_t from, std::uint64_t size);
 
 struct LoadedModule {
     ShaderRecompiler::ShaderStage stage;
-    std::shared_ptr<const ShaderRecompiler::RecompileResult> result;
+    std::uint64_t payloadOffset = 0;
+    std::uint64_t payloadBytes = 0;
+    std::uint64_t payloadHash = 0;
 };
 
 struct LoadedEntry {
@@ -414,6 +532,7 @@ struct LoadedEntry {
 };
 
 struct LoadedJournal {
+    std::shared_ptr<const JournalFile> file;
     std::map<ShaderRecompiler::PipelineIdentity, LoadedModule> modules;
     std::vector<LoadedEntry> entries;
     std::set<ShaderRecompiler::PipelineIdentity> indexModules;
@@ -424,6 +543,178 @@ struct LoadedJournal {
     bool headerValid = false;
 };
 
+struct RecordSpan {
+    std::uint64_t offset = 0;
+    std::uint64_t bytes = 0;
+    std::uint32_t kind = 0;
+    std::uint64_t hash = 0;
+    ShaderRecompiler::PipelineIdentity identity{};
+    std::vector<ShaderRecompiler::PipelineIdentity> needs;
+    bool decodable = false;
+};
+
+class PayloadHash {
+public:
+    explicit PayloadHash(std::uint64_t bytes) : hash(bytes * Multiplier) {}
+
+    void Update(std::span<const std::byte> bytes) {
+        while (!bytes.empty()) {
+            const auto take = std::min(bytes.size(), carry.size() - carryBytes);
+            std::memcpy(carry.data() + carryBytes, bytes.data(), take);
+            carryBytes += take;
+            bytes = bytes.subspan(take);
+            if (carryBytes == carry.size()) {
+                std::uint64_t chunk = 0;
+                std::memcpy(&chunk, carry.data(), sizeof(chunk));
+                Mix(chunk);
+                carryBytes = 0;
+            }
+        }
+    }
+
+    [[nodiscard]] std::uint64_t Finish() {
+        if (carryBytes != 0) {
+            std::uint64_t chunk = 0;
+            std::memcpy(&chunk, carry.data(), carryBytes);
+            Mix(chunk ^ 0x8000000000000000ull);
+            carryBytes = 0;
+        }
+        hash ^= hash >> 33u;
+        hash *= 0xff51afd7ed558ccdull;
+        hash ^= hash >> 33u;
+        hash *= 0xc4ceb9fe1a85ec53ull;
+        hash ^= hash >> 33u;
+        return hash;
+    }
+
+private:
+    static constexpr std::uint64_t Multiplier = 0x9e3779b97f4a7c15ull;
+
+    void Mix(std::uint64_t chunk) {
+        chunk *= 0xff51afd7ed558ccdull;
+        chunk ^= chunk >> 32u;
+        hash = (hash ^ chunk) * Multiplier;
+        hash = (hash << 27u) | (hash >> 37u);
+    }
+
+    std::uint64_t hash;
+    std::array<std::byte, 8> carry{};
+    std::size_t carryBytes = 0;
+};
+
+struct SpanScan {
+    bool headerValid = false;
+    std::vector<RecordSpan> spans;
+};
+
+bool readSpanPayload(std::ifstream& file, const RecordHeader& record, std::array<std::byte, 20>& prefix, std::vector<std::byte>& graphics, std::uint64_t& hash) {
+    constexpr std::uint64_t MaxGraphicsBytes = 16u * 1024u * 1024u;
+    PayloadHash hasher(record.payloadBytes);
+    std::array<std::byte, 64u * 1024u> chunk{};
+    const bool capture = record.kind == GraphicsRecord && record.payloadBytes <= MaxGraphicsBytes;
+    if (capture) graphics.resize(static_cast<std::size_t>(record.payloadBytes));
+    std::size_t copied = 0;
+    std::uint64_t left = record.payloadBytes;
+    while (left != 0) {
+        const auto take = static_cast<std::size_t>(std::min<std::uint64_t>(left, chunk.size()));
+        file.read(reinterpret_cast<char*>(chunk.data()), static_cast<std::streamsize>(take));
+        if (file.gcount() != static_cast<std::streamsize>(take)) return false;
+        const auto bytes = std::span<const std::byte>(chunk.data(), take);
+        hasher.Update(bytes);
+        const auto prefixBytes = std::min(take, prefix.size() - copied);
+        std::memcpy(prefix.data() + copied, bytes.data(), prefixBytes);
+        if (prefixBytes < take) copied = prefix.size();
+        else copied += take;
+        if (capture) std::memcpy(graphics.data() + (static_cast<std::size_t>(record.payloadBytes) - static_cast<std::size_t>(left)), bytes.data(), take);
+        left -= take;
+    }
+    hash = hasher.Finish();
+    return true;
+}
+
+bool scanSpans(const std::filesystem::path& path, std::uint64_t device, SpanScan& scan) {
+    std::error_code error;
+    const auto fileSize = std::filesystem::file_size(path, error);
+    if (error) return false;
+    std::ifstream file(path, std::ios::binary);
+    if (!file) return false;
+    FileHeader header{};
+    file.read(reinterpret_cast<char*>(&header), sizeof(header));
+    if (file.gcount() != sizeof(header)) return false;
+    if (header.magic != FileMagic || header.format != FileFormat || header.runtimeAbi != ShaderRecompiler::RuntimeAbi::Version ||
+        header.sourceVersion != ShaderRecompiler::ShaderDiskCache::SourceVersion() || header.device != device) return false;
+    scan.headerValid = true;
+    auto cursor = padded(sizeof(FileHeader));
+    while (cursor + sizeof(RecordHeader) <= fileSize) {
+        file.clear();
+        file.seekg(static_cast<std::streamoff>(cursor), std::ios::beg);
+        RecordHeader record{};
+        file.read(reinterpret_cast<char*>(&record), sizeof(record));
+        if (file.gcount() != sizeof(record) || record.kind == 0 || record.kind > ComputeRecord) break;
+        const auto payloadOffset = cursor + sizeof(RecordHeader);
+        if (record.payloadBytes > fileSize - payloadOffset) break;
+        const auto end = padded(payloadOffset + record.payloadBytes);
+        if (end > fileSize) break;
+        std::array<std::byte, 20> prefix{};
+        std::vector<std::byte> graphics;
+        std::uint64_t hash = 0;
+        if (!readSpanPayload(file, record, prefix, graphics, hash) || hash != record.payloadHash) break;
+        RecordSpan span;
+        span.offset = cursor;
+        span.bytes = end - cursor;
+        span.kind = record.kind;
+        span.hash = record.payloadHash;
+        if (record.kind == ModuleRecord) {
+            if (record.payloadBytes < 20u) break;
+            std::memcpy(&span.identity.low, prefix.data(), sizeof(span.identity.low));
+            std::memcpy(&span.identity.high, prefix.data() + 8, sizeof(span.identity.high));
+        } else if (record.kind == ComputeRecord) {
+            if (record.payloadBytes >= 16u) {
+                std::memcpy(&span.identity.low, prefix.data(), sizeof(span.identity.low));
+                std::memcpy(&span.identity.high, prefix.data() + 8, sizeof(span.identity.high));
+                span.needs.push_back(span.identity);
+                span.decodable = true;
+            }
+        } else {
+            GraphicsPipelineRecipe recipe;
+            if (!graphics.empty() && DecodeGraphicsPipelineRecipe(graphics, recipe)) {
+                for (const auto& stage : recipe.stages) span.needs.push_back(stage.identity);
+                span.decodable = true;
+            }
+        }
+        scan.spans.push_back(std::move(span));
+        cursor = end;
+    }
+    return true;
+}
+
+bool copySpans(const std::filesystem::path& path, const SpanScan& scan, const std::set<std::size_t>& kept, const std::filesystem::path& temporary) {
+    std::ifstream source(path, std::ios::binary);
+    if (!source) return false;
+    std::ofstream out(temporary, std::ios::binary | std::ios::trunc);
+    if (!out) return false;
+    std::array<std::byte, 64u * 1024u> chunk{};
+    source.read(reinterpret_cast<char*>(chunk.data()), static_cast<std::streamsize>(padded(sizeof(FileHeader))));
+    if (source.gcount() != static_cast<std::streamsize>(padded(sizeof(FileHeader)))) return false;
+    out.write(reinterpret_cast<const char*>(chunk.data()), static_cast<std::streamsize>(padded(sizeof(FileHeader))));
+    for (std::size_t position = 0; position < scan.spans.size(); ++position) {
+        if (!kept.contains(position)) continue;
+        const auto& span = scan.spans[position];
+        source.clear();
+        source.seekg(static_cast<std::streamoff>(span.offset), std::ios::beg);
+        auto left = span.bytes;
+        while (left != 0) {
+            const auto take = static_cast<std::size_t>(std::min<std::uint64_t>(left, chunk.size()));
+            source.read(reinterpret_cast<char*>(chunk.data()), static_cast<std::streamsize>(take));
+            if (source.gcount() != static_cast<std::streamsize>(take)) return false;
+            out.write(reinterpret_cast<const char*>(chunk.data()), static_cast<std::streamsize>(take));
+            left -= take;
+        }
+    }
+    out.flush();
+    return !out.fail();
+}
+
 class Journal {
 public:
     static Journal& Instance() {
@@ -452,20 +743,19 @@ public:
         return false;
     }
 
-    // Reads the whole file (modules keep views into the buffer, which lives as long as they do),
-    // fills the dedupe index, and remembers how many bytes parsed so a torn tail is cut before the
-    // next append.
+    // Parses the file a record at a time and keeps it open for the replay, fills the dedupe index,
+    // and remembers how many bytes parsed so a torn tail is cut before the next append.
     LoadedJournal Load() {
         LoadedJournal loaded;
         if (!Enabled() || !bound.load(std::memory_order_acquire)) return loaded;
         const auto started = std::chrono::steady_clock::now();
-        auto file = std::make_shared<std::vector<std::byte>>();
         bool read = false;
         {
             FileLock fileLock(lockPath);
-            read = ShaderRecompiler::ReadWholeFile(path, *file);
+            auto file = std::make_shared<const JournalFile>(path);
+            read = file->Open() && parse(*file, loaded, true);
+            if (read) loaded.file = std::move(file);
         }
-        if (read) parse(*file, file, loaded, true);
         const auto ms = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - started).count();
         {
             std::lock_guard lock(mutex);
@@ -531,12 +821,15 @@ public:
         totals.recordedModules = counters.recordedModules.load(std::memory_order_relaxed);
         totals.writtenBytes = counters.writtenBytes.load(std::memory_order_relaxed);
         totals.writeFailures = counters.writeFailures.load(std::memory_order_relaxed);
+        totals.evictedRecords = counters.evictedRecords.load(std::memory_order_relaxed);
+        totals.evictedBytes = counters.evictedBytes.load(std::memory_order_relaxed);
         return totals;
     }
 
     struct Counters {
         std::atomic<std::uint64_t> loadedRecipes{0}, loadedModules{0}, loadedBytes{0}, droppedRecords{0};
         std::atomic<std::uint64_t> recordedGraphics{0}, recordedCompute{0}, recordedModules{0}, writtenBytes{0}, writeFailures{0};
+        std::atomic<std::uint64_t> evictedRecords{0}, evictedBytes{0};
     };
 
 private:
@@ -582,27 +875,30 @@ private:
     // Parses the file: with `loaded` set every record is decoded, otherwise only the index (the
     // module identities and record hashes) is built. Stops at the first record that does not
     // parse; the bytes before it stay valid.
-    void parse(const std::vector<std::byte>& file, const std::shared_ptr<const std::vector<std::byte>>& owner, LoadedJournal& loaded, bool decode) {
+    bool parse(const JournalFile& file, LoadedJournal& loaded, bool decode, std::vector<RecordSpan>* spans = nullptr) {
         std::uint64_t valid = 0;
         bool header = false;
         std::uint64_t dropped = 0;
-        const auto bytes = std::span<const std::byte>(file);
-        if (bytes.size() >= sizeof(FileHeader)) {
+        const auto size = file.Size();
+        if (size >= sizeof(FileHeader)) {
             FileHeader fileHeader;
-            std::memcpy(&fileHeader, bytes.data(), sizeof(fileHeader));
+            if (!file.ReadValue(0, fileHeader)) return false;
             header = fileHeader.magic == FileMagic && fileHeader.format == FileFormat && fileHeader.runtimeAbi == ShaderRecompiler::RuntimeAbi::Version && fileHeader.sourceVersion == ShaderRecompiler::ShaderDiskCache::SourceVersion() && fileHeader.device == device.load(std::memory_order_relaxed);
         }
         if (header) {
             valid = padded(sizeof(FileHeader));
             std::uint64_t cursor = valid;
-            while (cursor + sizeof(RecordHeader) <= bytes.size()) {
+            std::vector<std::byte> bytes;
+            while (cursor + sizeof(RecordHeader) <= size) {
                 RecordHeader record;
-                std::memcpy(&record, bytes.data() + cursor, sizeof(record));
+                if (!file.ReadValue(cursor, record)) return false;
                 const auto payloadOffset = cursor + sizeof(RecordHeader);
-                if (record.payloadBytes > bytes.size() - payloadOffset) break;
+                if (record.payloadBytes > size - payloadOffset) break;
                 const auto end = padded(payloadOffset + record.payloadBytes);
-                if (end > bytes.size()) break;
-                const auto payload = bytes.subspan(static_cast<std::size_t>(payloadOffset), static_cast<std::size_t>(record.payloadBytes));
+                if (end > size) break;
+                bytes.resize(static_cast<std::size_t>(record.payloadBytes));
+                if (!file.Read(payloadOffset, bytes)) return false;
+                const auto payload = std::span<const std::byte>(bytes);
                 if (ShaderRecompiler::HashBytes(payload) != record.payloadHash) break;
                 if (record.kind == ModuleRecord) {
                     if (payload.size() < 20u) break;
@@ -613,15 +909,24 @@ private:
                     std::memcpy(&stage, payload.data() + 16, sizeof(stage));
                     bool decoded = !decode;
                     if (decode && !loaded.indexModules.contains(identity)) {
-                        auto result = std::make_shared<ShaderRecompiler::RecompileResult>();
-                        decoded = ShaderRecompiler::ShaderDiskCache::DecodeResult(payload.subspan(20), *result, owner) && result->Identity() == identity;
-                        if (decoded) loaded.modules.emplace(identity, LoadedModule{static_cast<ShaderRecompiler::ShaderStage>(stage), std::move(result)});
+                        ShaderRecompiler::RecompileResult result;
+                        decoded = ShaderRecompiler::ShaderDiskCache::DecodeResult(payload.subspan(20), result) && result.Identity() == identity;
+                        if (decoded) loaded.modules.emplace(identity, LoadedModule{static_cast<ShaderRecompiler::ShaderStage>(stage), payloadOffset, record.payloadBytes, record.payloadHash});
                         else ++dropped;
                     }
                     if (decoded) loaded.indexModules.insert(identity);
+                    if (spans != nullptr) {
+                        RecordSpan span;
+                        span.offset = cursor;
+                        span.bytes = end - cursor;
+                        span.kind = record.kind;
+                        span.hash = record.payloadHash;
+                        span.identity = identity;
+                        spans->push_back(std::move(span));
+                    }
                 } else if (record.kind == GraphicsRecord || record.kind == ComputeRecord) {
                     if (decode && !loaded.indexRecords.contains(record.payloadHash)) {
-                        LoadedEntry entry;
+                        LoadedEntry entry{};
                         entry.kind = record.kind;
                         bool decoded = false;
                         if (record.kind == GraphicsRecord) {
@@ -638,6 +943,28 @@ private:
                         else ++dropped;
                     }
                     loaded.indexRecords.insert(record.payloadHash);
+                    if (spans != nullptr) {
+                        RecordSpan span;
+                        span.offset = cursor;
+                        span.bytes = end - cursor;
+                        span.kind = record.kind;
+                        span.hash = record.payloadHash;
+                        if (record.kind == ComputeRecord) {
+                            if (payload.size() >= 16u) {
+                                std::memcpy(&span.identity.low, payload.data(), sizeof(span.identity.low));
+                                std::memcpy(&span.identity.high, payload.data() + 8, sizeof(span.identity.high));
+                                span.needs.push_back(span.identity);
+                                span.decodable = true;
+                            }
+                        } else {
+                            GraphicsPipelineRecipe recipe;
+                            if (DecodeGraphicsPipelineRecipe(payload, recipe)) {
+                                for (const auto& stage : recipe.stages) span.needs.push_back(stage.identity);
+                                span.decodable = true;
+                            }
+                        }
+                        spans->push_back(std::move(span));
+                    }
                 } else {
                     break;
                 }
@@ -645,11 +972,12 @@ private:
                 cursor = end;
             }
         }
-        if (valid < bytes.size()) ++dropped;
+        if (valid < size) ++dropped;
         loaded.validBytes = valid;
-        loaded.bytes = bytes.size();
+        loaded.bytes = size;
         loaded.dropped = dropped;
         loaded.headerValid = header;
+        return true;
     }
 
     // The index the writer dedupes against, replaced from the file: what it holds and where it
@@ -657,12 +985,12 @@ private:
     // written until it can be (the next record tries again) and the file is never started over for
     // a read failure.
     bool indexLocked() {
-        std::vector<std::byte> file;
         LoadedJournal index;
         std::error_code error;
-        const bool exists = std::filesystem::exists(path, error);
-        if (exists && !ShaderRecompiler::ReadWholeFile(path, file)) return false;
-        if (exists) parse(file, nullptr, index, false);
+        if (std::filesystem::exists(path, error)) {
+            const JournalFile file(path);
+            if (!file.Open() || !parse(file, index, false)) return false;
+        }
         std::lock_guard lock(mutex);
         indexed = true;
         validBytes = index.validBytes;
@@ -723,43 +1051,119 @@ private:
     // tail of a crashed run (bytes past the last parsed record) was cut.
     void write(const Pending& pending) {
         if (!ensureIndexed()) throw std::runtime_error("the journal could not be read");
-        for (unsigned attempt = 0; attempt < 2; ++attempt) {
+        for (unsigned attempt = 0; attempt < 3; ++attempt) {
             if (append(pending)) return;
         }
         throw std::runtime_error("the journal keeps changing under this run");
     }
 
+    bool evictUnderLock(std::uint64_t reserve) {
+        SpanScan scan;
+        if (!scanSpans(path, device.load(std::memory_order_relaxed), scan) || !scan.headerValid) return false;
+        const auto& spans = scan.spans;
+        std::map<ShaderRecompiler::PipelineIdentity, std::size_t> moduleSpans;
+        for (std::size_t position = 0; position < spans.size(); ++position) {
+            if (spans[position].kind == ModuleRecord) moduleSpans[spans[position].identity] = position;
+        }
+        const auto headerBytes = padded(sizeof(FileHeader));
+        const auto target = maxBytes - maxBytes / 4u;
+        auto budget = target > reserve ? target - reserve : headerBytes;
+        if (budget < headerBytes) budget = headerBytes;
+        std::set<ShaderRecompiler::PipelineIdentity> keptModules;
+        std::set<std::size_t> kept;
+        std::uint64_t used = headerBytes;
+        for (std::size_t position = spans.size(); position-- > 0;) {
+            const auto& span = spans[position];
+            if (span.kind == ModuleRecord) continue;
+            if (!span.decodable) continue;
+            std::uint64_t added = span.bytes;
+            std::vector<std::size_t> modules;
+            bool complete = true;
+            for (const auto& identity : span.needs) {
+                if (keptModules.contains(identity)) continue;
+                const auto found = moduleSpans.find(identity);
+                if (found == moduleSpans.end()) {
+                    complete = false;
+                    break;
+                }
+                modules.push_back(found->second);
+                added += spans[found->second].bytes;
+            }
+            if (!complete) continue;
+            if (used + added > budget) break;
+            used += added;
+            for (const auto module : modules) keptModules.insert(spans[module].identity);
+            kept.insert(position);
+        }
+        for (const auto& identity : keptModules) kept.insert(moduleSpans[identity]);
+        const auto temporary = path.string() + ".evict";
+        if (!copySpans(path, scan, kept, temporary)) {
+            std::error_code error;
+            std::filesystem::remove(temporary, error);
+            return false;
+        }
+        if (!replaceFile(temporary, path)) {
+            std::error_code error;
+            std::filesystem::remove(temporary, error);
+            return false;
+        }
+        std::uint64_t evicted = 0;
+        std::uint64_t evictedBytes = 0;
+        {
+            std::lock_guard lock(mutex);
+            for (std::size_t position = 0; position < spans.size(); ++position) {
+                if (kept.contains(position)) continue;
+                ++evicted;
+                evictedBytes += spans[position].bytes;
+            }
+            writtenModules.clear();
+            writtenRecords.clear();
+            for (const auto& identity : keptModules) writtenModules.insert(identity);
+            for (const auto position : kept) {
+                if (spans[position].kind != ModuleRecord) writtenRecords.insert(spans[position].hash);
+            }
+            validBytes = used;
+            headerValid = true;
+        }
+        counters.evictedRecords.fetch_add(evicted, std::memory_order_relaxed);
+        counters.evictedBytes.fetch_add(evictedBytes, std::memory_order_relaxed);
+        std::fprintf(stderr, "[pipeline-journal] %s reached its size cap; %llu records (%.1f MiB) were dropped and the file was rewritten to %.1f MiB\n", path.string().c_str(), static_cast<unsigned long long>(evicted), static_cast<double>(evictedBytes) / (1024.0 * 1024.0), static_cast<double>(used) / (1024.0 * 1024.0));
+        return true;
+    }
+
+    std::vector<std::byte> EncodeModule(const PendingModule& module) {
+        std::vector<std::byte> payload;
+        Writer writer(payload);
+        writer.U64(module.identity.low);
+        writer.U64(module.identity.high);
+        writer.U32(static_cast<std::uint32_t>(module.stage));
+        ShaderRecompiler::ShaderDiskCache::EncodeResult(*module.result, payload);
+        return payload;
+    }
+
     // One attempt: false when the file was cut or replaced by someone else since it was indexed
-    // (it is indexed again, and the batch is rebuilt against that index).
+    // (it is indexed again, and the batch is rebuilt against that index), or when the file was
+    // rewritten to make room for the record (the batch is rebuilt against that file).
     bool append(const Pending& pending) {
         const auto recordHash = ShaderRecompiler::HashBytes(pending.payload);
-        std::vector<std::byte> batch;
-        std::vector<ShaderRecompiler::PipelineIdentity> newModules;
+        std::vector<ShaderRecompiler::PipelineIdentity> missing;
         {
             std::lock_guard lock(mutex);
             if (writtenRecords.contains(recordHash)) return true;
             for (const auto& module : pending.modules) {
-                if (!writtenModules.contains(module.identity) && std::ranges::find(newModules, module.identity) == newModules.end()) newModules.push_back(module.identity);
+                if (writtenModules.contains(module.identity)) continue;
+                if (std::ranges::find(missing, module.identity) != missing.end()) continue;
+                missing.push_back(module.identity);
             }
         }
-        const auto appendRecord = [&](std::uint32_t kind, std::span<const std::byte> payload) {
-            const RecordHeader header{kind, 0u, payload.size(), ShaderRecompiler::HashBytes(payload)};
-            Writer writer(batch);
-            writer.Raw(header);
-            batch.insert(batch.end(), payload.begin(), payload.end());
-            batch.resize(static_cast<std::size_t>(padded(batch.size())));
-        };
-        for (const auto& identity : newModules) {
+        std::vector<std::vector<std::byte>> missingPayloads;
+        missingPayloads.reserve(missing.size());
+        for (const auto& identity : missing) {
             const auto module = std::ranges::find_if(pending.modules, [&](const PendingModule& candidate) { return candidate.identity == identity; });
-            std::vector<std::byte> payload;
-            Writer writer(payload);
-            writer.U64(identity.low);
-            writer.U64(identity.high);
-            writer.U32(static_cast<std::uint32_t>(module->stage));
-            ShaderRecompiler::ShaderDiskCache::EncodeResult(*module->result, payload);
-            appendRecord(ModuleRecord, payload);
+            missingPayloads.push_back(EncodeModule(*module));
         }
-        appendRecord(pending.kind, pending.payload);
+        std::uint64_t batchSize = recordBytes(pending.payload.size());
+        for (const auto& payload : missingPayloads) batchSize += recordBytes(payload.size());
         std::error_code error;
         std::filesystem::create_directories(path.parent_path(), error);
         FileLock fileLock(lockPath);
@@ -770,6 +1174,7 @@ private:
             return true;
         }
         bool fresh = false;
+        bool overCap = false;
         {
             std::lock_guard lock(mutex);
             fresh = !headerValid;
@@ -783,13 +1188,41 @@ private:
                     else validBytes = tail;
                 }
             }
-            if (!fresh && validBytes + batch.size() > maxBytes) {
+            overCap = !fresh && validBytes + batchSize > maxBytes;
+        }
+        if (overCap) {
+            std::uint64_t needed = batchSize;
+            std::vector<ShaderRecompiler::PipelineIdentity> held;
+            for (const auto& module : pending.modules) {
+                if (std::ranges::find(missing, module.identity) != missing.end()) continue;
+                if (std::ranges::find(held, module.identity) != held.end()) continue;
+                held.push_back(module.identity);
+                needed += recordBytes(EncodeModule(module).size());
+            }
+            if (needed + padded(sizeof(FileHeader)) > maxBytes) {
+                static std::atomic<bool> reported{false};
+                if (!reported.exchange(true)) std::fprintf(stderr, "[pipeline-journal] %s cannot hold a record of %llu bytes under APS5_PIPELINE_JOURNAL_MAX_MIB; it is not recorded\n", path.string().c_str(), static_cast<unsigned long long>(needed));
+                counters.writeFailures.fetch_add(1, std::memory_order_relaxed);
+                return true;
+            }
+            if (!evictUnderLock(needed)) {
                 static std::atomic<bool> reported{false};
                 if (!reported.exchange(true)) std::fprintf(stderr, "[pipeline-journal] %s reached APS5_PIPELINE_JOURNAL_MAX_MIB; later pipelines are not recorded\n", path.string().c_str());
                 counters.writeFailures.fetch_add(1, std::memory_order_relaxed);
                 return true;
             }
+            return false;
         }
+        std::vector<std::byte> batch;
+        const auto appendRecord = [&](std::uint32_t kind, std::span<const std::byte> payload) {
+            const RecordHeader header{kind, 0u, payload.size(), ShaderRecompiler::HashBytes(payload)};
+            Writer writer(batch);
+            writer.Raw(header);
+            batch.insert(batch.end(), payload.begin(), payload.end());
+            batch.resize(static_cast<std::size_t>(padded(batch.size())));
+        };
+        for (const auto& payload : missingPayloads) appendRecord(ModuleRecord, payload);
+        appendRecord(pending.kind, pending.payload);
         if (!fresh) {
             const auto size = std::filesystem::file_size(path, error);
             if (!error && size < validBytes) {
@@ -813,9 +1246,9 @@ private:
         std::lock_guard lock(mutex);
         headerValid = true;
         validBytes = (fresh ? padded(sizeof(FileHeader)) : validBytes) + batch.size();
-        for (const auto& identity : newModules) writtenModules.insert(identity);
+        for (const auto& identity : missing) writtenModules.insert(identity);
         writtenRecords.insert(recordHash);
-        counters.recordedModules.fetch_add(newModules.size(), std::memory_order_relaxed);
+        counters.recordedModules.fetch_add(missing.size(), std::memory_order_relaxed);
         if (pending.kind == GraphicsRecord) counters.recordedGraphics.fetch_add(1, std::memory_order_relaxed);
         else counters.recordedCompute.fetch_add(1, std::memory_order_relaxed);
         counters.writtenBytes.fetch_add(prefix.size() + batch.size(), std::memory_order_relaxed);
@@ -869,6 +1302,7 @@ std::uint64_t validTail(const std::filesystem::path& path, std::uint64_t from, s
 
 struct ReplayCounters {
     std::atomic<std::uint64_t> graphics{0}, compute{0}, present{0}, skipped{0}, rejected{0}, failed{0};
+    std::atomic<std::uint64_t> held{0}, heldPeak{0};
     std::atomic<std::uint32_t> threads{0};
     std::atomic<double> ms{0};
 };
@@ -889,6 +1323,7 @@ public:
     Replay(Context context, PipelineJournalHooks hooks, unsigned threads) : context(std::move(context)), hooks(std::move(hooks)), active(threads) {
         started = std::chrono::steady_clock::now();
         replayCounters().threads.store(threads, std::memory_order_relaxed);
+        replayCounters().heldPeak.store(0, std::memory_order_relaxed);
         workers.reserve(threads);
         for (unsigned index = 0; index < threads; ++index) workers.emplace_back([this] { run(); });
     }
@@ -915,7 +1350,7 @@ private:
             try {
                 auto journal = Journal::Instance().Load();
                 const auto limit = configured("APS5_PIPELINE_JOURNAL_ENTRIES", 1024u);
-                if (journal.entries.size() > limit) journal.entries.resize(static_cast<std::size_t>(limit));
+                if (journal.entries.size() > limit) journal.entries.erase(journal.entries.begin(), journal.entries.end() - static_cast<std::ptrdiff_t>(limit));
                 loaded = std::move(journal);
             } catch (const std::exception& error) {
                 std::fprintf(stderr, "[pipeline-journal] cannot load %s: %s\n", Journal::Instance().Path().string().c_str(), error.what());
@@ -942,6 +1377,27 @@ private:
         }
     }
 
+    std::shared_ptr<const ShaderRecompiler::RecompileResult> readModule(const ShaderRecompiler::PipelineIdentity& identity, const LoadedModule& module) const {
+        auto bytes = std::make_shared<std::vector<std::byte>>(static_cast<std::size_t>(module.payloadBytes));
+        if (loaded.file == nullptr || !loaded.file->Read(module.payloadOffset, *bytes) || ShaderRecompiler::HashBytes(*bytes) != module.payloadHash) return nullptr;
+        auto result = std::make_shared<ShaderRecompiler::RecompileResult>();
+        if (!ShaderRecompiler::ShaderDiskCache::DecodeResult(std::span<const std::byte>(*bytes).subspan(20), *result, bytes) || !(result->Identity() == identity)) return nullptr;
+        return result;
+    }
+
+    struct Held {
+        explicit Held(std::uint64_t bytes) : bytes(bytes) {
+            auto& counters = replayCounters();
+            const auto now = counters.held.fetch_add(bytes, std::memory_order_relaxed) + bytes;
+            auto peak = counters.heldPeak.load(std::memory_order_relaxed);
+            while (peak < now && !counters.heldPeak.compare_exchange_weak(peak, now, std::memory_order_relaxed)) {}
+        }
+        ~Held() { replayCounters().held.fetch_sub(bytes, std::memory_order_relaxed); }
+        Held(const Held&) = delete;
+        Held& operator=(const Held&) = delete;
+        std::uint64_t bytes;
+    };
+
     void replay(const LoadedEntry& entry) {
         struct Replaying {
             Replaying() { replayingHere = true; }
@@ -954,19 +1410,27 @@ private:
                 counters.rejected.fetch_add(1, std::memory_order_relaxed);
                 return;
             }
-            (hooks.compute(*module->second.result, entry.pushConstants) ? counters.compute : counters.present).fetch_add(1, std::memory_order_relaxed);
+            const Held held(module->second.payloadBytes);
+            const auto result = readModule(module->first, module->second);
+            if (result == nullptr) {
+                counters.rejected.fetch_add(1, std::memory_order_relaxed);
+                return;
+            }
+            (hooks.compute(*result, entry.pushConstants) ? counters.compute : counters.present).fetch_add(1, std::memory_order_relaxed);
             return;
         }
-        std::vector<CompiledShader> shaders;
+        std::vector<const std::pair<const ShaderRecompiler::PipelineIdentity, LoadedModule>*> modules;
+        std::uint64_t bytes = 0;
         for (const auto& stage : entry.graphics.stages) {
             const auto module = loaded.modules.find(stage.identity);
             if (module == loaded.modules.end() || module->second.stage != stage.stage) {
                 counters.rejected.fetch_add(1, std::memory_order_relaxed);
                 return;
             }
-            shaders.push_back({stage.stage, module->second.result.get(), stage.pushConstantOffset});
+            modules.push_back(&*module);
+            bytes += module->second.payloadBytes;
         }
-        if (shaders.empty() || context.descriptorCache == nullptr) {
+        if (modules.empty() || context.descriptorCache == nullptr) {
             counters.rejected.fetch_add(1, std::memory_order_relaxed);
             return;
         }
@@ -975,6 +1439,18 @@ private:
             counters.skipped.fetch_add(1, std::memory_order_relaxed);
             return;
         }
+        const Held held(bytes);
+        std::vector<std::shared_ptr<const ShaderRecompiler::RecompileResult>> results;
+        std::vector<CompiledShader> shaders;
+        for (std::size_t index = 0; index < modules.size(); ++index) {
+            auto result = readModule(modules[index]->first, modules[index]->second);
+            if (result == nullptr) {
+                counters.rejected.fetch_add(1, std::memory_order_relaxed);
+                return;
+            }
+            shaders.push_back({entry.graphics.stages[index].stage, result.get(), entry.graphics.stages[index].pushConstantOffset});
+            results.push_back(std::move(result));
+        }
         const auto layouts = DescribeSetLayouts(context, shaders);
         if (!std::ranges::equal(layouts.mainKey, entry.graphics.mainLayoutKey) || !std::ranges::equal(layouts.fragmentKey, entry.graphics.fragmentLayoutKey) || layouts.layouts.split != entry.graphics.splitSets) {
             counters.rejected.fetch_add(1, std::memory_order_relaxed);
@@ -1028,6 +1504,7 @@ State CanonicalPipelineState(const State& state) {
         canonicalColor.format = color.format;
         canonicalColor.exportIndex = color.exportIndex;
         canonicalColor.componentMapping = color.componentMapping;
+        canonicalColor.partialWriteMask = color.partialWriteMask;
         canonical.colors.push_back(canonicalColor);
     }
     canonical.blends = state.blends;
@@ -1036,6 +1513,7 @@ State CanonicalPipelineState(const State& state) {
     canonical.rectList = state.rectList;
     canonical.dualSourceBlend = state.dualSourceBlend;
     canonical.reversedBlend = state.reversedBlend;
+    canonical.colorRop = state.colorRop;
     canonical.topology = state.topology;
     canonical.primitiveRestart = state.primitiveRestart;
     canonical.negativeOneToOne = state.negativeOneToOne;
@@ -1051,8 +1529,13 @@ State CanonicalPipelineState(const State& state) {
     canonical.sampleLocationGrid = state.sampleLocationGrid;
     canonical.perSampleShading = state.perSampleShading;
     canonical.mergedCoverage = state.mergedCoverage;
+    canonical.truncatedCoverage = state.truncatedCoverage;
     canonical.quadSampleMask = state.quadSampleMask;
     canonical.depthRemap.mode = state.depthRemap.mode;
+    canonical.vertexPoints = state.vertexPoints;
+    canonical.pointSize = state.pointSize;
+    canonical.pointSizeMin = state.pointSizeMin;
+    canonical.pointSizeMax = state.pointSizeMax;
     return canonical;
 }
 
@@ -1115,6 +1598,7 @@ PipelineJournalCounters PipelineJournalTotals() {
     totals.replayFailed = replay.failed.load(std::memory_order_relaxed);
     totals.replayMs = replay.ms.load(std::memory_order_relaxed);
     totals.replayThreads = replay.threads.load(std::memory_order_relaxed);
+    totals.replayHeldPeakBytes = replay.heldPeak.load(std::memory_order_relaxed);
     return totals;
 }
 
@@ -1134,10 +1618,10 @@ void FlushPipelineJournal() {
 void ReportPipelineJournal() {
     if (!profiling() || !Journal::Instance().Enabled()) return;
     const auto totals = PipelineJournalTotals();
-    AgcDriver::ProfilePrint_nid_no_patch("[pipeline-journal] loaded %llu pipelines, %llu modules (%.1f MiB, %.0f ms); replay on %u threads: %llu graphics and %llu compute built, %llu present, %llu skipped (store full), %llu rejected, %llu failed in %.0f ms; recorded this run: %llu graphics, %llu compute, %llu modules (%.1f MiB), %llu write failures\n",
+    AgcDriver::ProfilePrint_nid_no_patch("[pipeline-journal] loaded %llu pipelines, %llu modules (%.1f MiB, %.0f ms); replay on %u threads: %llu graphics and %llu compute built, %llu present, %llu skipped (store full), %llu rejected, %llu failed in %.0f ms, holding at most %.1f MiB of modules; recorded this run: %llu graphics, %llu compute, %llu modules (%.1f MiB), %llu write failures, %llu records evicted (%.1f MiB)\n",
                                          static_cast<unsigned long long>(totals.loadedRecipes), static_cast<unsigned long long>(totals.loadedModules), static_cast<double>(totals.loadedBytes) / (1024.0 * 1024.0), totals.loadMs, totals.replayThreads,
-                                         static_cast<unsigned long long>(totals.replayedGraphics), static_cast<unsigned long long>(totals.replayedCompute), static_cast<unsigned long long>(totals.replayPresent), static_cast<unsigned long long>(totals.replaySkipped), static_cast<unsigned long long>(totals.replayRejected), static_cast<unsigned long long>(totals.replayFailed), totals.replayMs,
-                                         static_cast<unsigned long long>(totals.recordedGraphics), static_cast<unsigned long long>(totals.recordedCompute), static_cast<unsigned long long>(totals.recordedModules), static_cast<double>(totals.writtenBytes) / (1024.0 * 1024.0), static_cast<unsigned long long>(totals.writeFailures));
+                                         static_cast<unsigned long long>(totals.replayedGraphics), static_cast<unsigned long long>(totals.replayedCompute), static_cast<unsigned long long>(totals.replayPresent), static_cast<unsigned long long>(totals.replaySkipped), static_cast<unsigned long long>(totals.replayRejected), static_cast<unsigned long long>(totals.replayFailed), totals.replayMs, static_cast<double>(totals.replayHeldPeakBytes) / (1024.0 * 1024.0),
+                                         static_cast<unsigned long long>(totals.recordedGraphics), static_cast<unsigned long long>(totals.recordedCompute), static_cast<unsigned long long>(totals.recordedModules), static_cast<double>(totals.writtenBytes) / (1024.0 * 1024.0), static_cast<unsigned long long>(totals.writeFailures), static_cast<unsigned long long>(totals.evictedRecords), static_cast<double>(totals.evictedBytes) / (1024.0 * 1024.0));
 }
 
 std::uint64_t PipelineJournalDeviceFingerprint(const VkPhysicalDeviceProperties& properties) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
index 7670cde694..77119254d5 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
@@ -255,10 +255,24 @@ VkPipeline LinkPipelineFromLibraries(const Context& context, const VkGraphicsPip
     }
     if (partsOnly) return VK_NULL_HANDLE;
     PerformanceTimer timing("Vulkan.GraphicsPipelineLink");
+    std::optional<std::pair<std::vector<VkSampleCountFlagBits>, VkSampleCountFlagBits>> sampleCounts;
+    for (auto* next = static_cast<const VkBaseInStructure*>(rendering.pNext); next != nullptr; next = next->pNext) {
+        if (next->sType != VK_STRUCTURE_TYPE_ATTACHMENT_SAMPLE_COUNT_INFO_NV) continue;
+        const auto& counts = *reinterpret_cast<const VkAttachmentSampleCountInfoNV*>(next);
+        sampleCounts.emplace(std::vector<VkSampleCountFlagBits>(counts.pColorAttachmentSamples, counts.pColorAttachmentSamples + counts.colorAttachmentCount), counts.depthStencilAttachmentSamples);
+    }
+    const auto attachmentSamples = [](const std::pair<std::vector<VkSampleCountFlagBits>, VkSampleCountFlagBits>& counts) {
+        return VkAttachmentSampleCountInfoNV{VK_STRUCTURE_TYPE_ATTACHMENT_SAMPLE_COUNT_INFO_NV, nullptr, static_cast<std::uint32_t>(counts.first.size()), counts.first.empty() ? nullptr : counts.first.data(), counts.second};
+    };
+    auto linkedSamples = sampleCounts ? attachmentSamples(*sampleCounts) : VkAttachmentSampleCountInfoNV{};
     VkPipelineLibraryCreateInfoKHR linked{VK_STRUCTURE_TYPE_PIPELINE_LIBRARY_CREATE_INFO_KHR};
     linked.libraryCount = static_cast<std::uint32_t>(libraries.size());
     linked.pLibraries = libraries.data();
     VkGraphicsPipelineCreateInfo create{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO, &linked};
+    if (sampleCounts) {
+        linkedSamples.pNext = create.pNext;
+        create.pNext = &linkedSamples;
+    }
     create.layout = info.layout;
     VkPipeline pipeline = VK_NULL_HANDLE;
     lock.unlock();
@@ -277,12 +291,17 @@ VkPipeline LinkPipelineFromLibraries(const Context& context, const VkGraphicsPip
         const auto cache = context.pipelineCache;
         const auto cacheSynchronization = context.pipelineCacheSynchronization;
         const auto libraryLayout = fullLayout;
-        std::function<void()> relink = [slot, createPipelines, cache, cacheSynchronization, libraryLayout, libraries, &store, devicePointer = &device] {
+        std::function<void()> relink = [slot, createPipelines, cache, cacheSynchronization, libraryLayout, libraries, sampleCounts, attachmentSamples, &store, devicePointer = &device] {
             if (slot->released.load()) return;
+            auto linkedSamples = sampleCounts ? attachmentSamples(*sampleCounts) : VkAttachmentSampleCountInfoNV{};
             VkPipelineLibraryCreateInfoKHR linked{VK_STRUCTURE_TYPE_PIPELINE_LIBRARY_CREATE_INFO_KHR};
             linked.libraryCount = static_cast<std::uint32_t>(libraries.size());
             linked.pLibraries = libraries.data();
             VkGraphicsPipelineCreateInfo create{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO, &linked};
+            if (sampleCounts) {
+                linkedSamples.pNext = create.pNext;
+                create.pNext = &linkedSamples;
+            }
             create.flags = VK_PIPELINE_CREATE_LINK_TIME_OPTIMIZATION_BIT_EXT;
             create.layout = libraryLayout;
             VkPipeline result = VK_NULL_HANDLE;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
index 9f03343a67..80eb8c355d 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceAgcDriver/Execution/include/AsyncLog.hpp"
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libkernel/Time/include/SleepWake.hpp"
@@ -31,6 +32,7 @@
 #include <map>
 #include <mutex>
 #include <string>
+#include <string_view>
 #include <thread>
 #include <tuple>
 #include <unordered_map>
@@ -128,7 +130,7 @@ struct ThreadSyncs {
     std::array<double, 5> waitedMs;
 };
 std::vector<ThreadSyncs> threadSyncs;
-std::mutex threadSyncsMutex;
+AgcDriver::Mutex threadSyncsMutex;
 
 // This thread's fence and timeline waits in total (Recorder::ThreadWaitedMs): a caller times a span
 // of its own work and reads the difference to learn how much of it was waiting for the GPU.
@@ -176,7 +178,7 @@ std::atomic<int> unlockedWaiters[WaiterSlots]{};
 std::atomic<int>& WaitersOf(std::uint64_t id) { return unlockedWaiters[id % WaiterSlots]; }
 // Recorders alive, by id (own mutex, taken under the GpuMutex or with nothing held): a thread that
 // released the GpuMutex around a wait learns whether its recorder still exists before touching it.
-std::mutex liveRecordersMutex;
+AgcDriver::Mutex liveRecordersMutex;
 std::vector<std::uint64_t> liveRecorders;
 std::atomic<std::uint64_t> nextRecorderId{1};
 std::atomic<std::uint64_t> samplesPassed{0};
@@ -193,7 +195,7 @@ std::atomic<std::uint64_t> dumpsQueued{0}, dumpsQueuedInPass{0}, dumpsAtOnce{0},
 struct SamplePoolCache {
     VkDevice device;
     PFN_vkDestroyQueryPool destroy;
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::vector<VkQueryPool> free;
     bool closed = false;
     void put(VkQueryPool pool) {
@@ -416,7 +418,7 @@ struct ReleaseQueue {
     // Set by a joiner under `mutex` until the thread was joined: the thread leaves once the queue
     // is empty, and hand-offs meanwhile destroy inline (nothing may be queued without a taker).
     bool stop = false;
-    std::mutex joinMutex;
+    AgcDriver::Mutex joinMutex;
 };
 
 ReleaseQueue& ReleaseThreadQueue() {
@@ -515,6 +517,7 @@ std::atomic<std::int64_t> pendingLabelSince{NoPendingLabel};
 std::atomic<std::uint64_t> writeGeneration{0};
 std::atomic<std::uint64_t> publishGeneration{0};
 std::atomic<std::uint64_t> completionLabels{0};
+std::atomic<std::uint64_t> completionStores{0};
 std::atomic<std::uint64_t> writeBackCompletions{0};
 std::atomic<std::uint64_t> completionStoresSkipped{0};
 std::atomic<std::uint64_t> completionStoresRun{0};
@@ -541,7 +544,7 @@ bool ProcTable() {
 // instead of queueing behind a dispatch. `labelTableOwner` is the active recorder while it lives,
 // set and cleared under this mutex, so a lookup never touches a table being destroyed. Nothing
 // under this mutex takes the GPU mutex (no lock-order cycle).
-std::mutex labelTableMutex;
+AgcDriver::Mutex labelTableMutex;
 Recorder* labelTableOwner = nullptr;
 // The ranges of the calling worker's queued labels (NoteQueuedLabel, cleared by
 // ForgetQueuedLabels): the flush hook, on the same thread, has them recorded before an access that
@@ -898,7 +901,7 @@ struct RecordedStoreTotals {
 };
 
 struct RecordedStoreStats {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::map<HookSyncKey, RecordedStoreTotals> byKey;
     RecordedStoreTotals totals;
     std::chrono::steady_clock::time_point lastReport = std::chrono::steady_clock::now();
@@ -1040,11 +1043,9 @@ void FlushForAccess(std::uint64_t address, std::size_t bytes) {
             recorder->SyncThrough(address, bytes, true);
         }
     }
-    // A reader takes every shadowed unit of the range; a store only the units it covers partly
-    // (its own stamp makes the others stale). Inside a completion action a store has no publish
-    // recorded: the batch is not waited for, and the copy would land over the store later.
     const auto site = GuestMemory::CurrentReadSite();
-    const auto scope = site != GuestMemory::ReadSite::Store ? PublishScope::Whole : completionDepth != 0 ? PublishScope::None : PublishScope::PartialUnits;
+    const auto scope = site != GuestMemory::ReadSite::Store ? PublishScope::Whole : PublishScope::PartialUnits;
+    const bool waited = completionDepth != 0;
     bool published = false;
     // The classification is made before the store (the store changes what it measures); profile only.
     StorageTexture::AccessClassification classification{};
@@ -1059,12 +1060,12 @@ void FlushForAccess(std::uint64_t address, std::size_t bytes) {
     const bool kept = !HookFlushCpuBlocks() && StorageTexture::AccessKeptByCpu(address, bytes, &images, &evicted);
     if (kept || (images == 0 && !HookFlushCpuBlocks())) {
         stored = StorageTexture::WaitForFlushing(address, bytes);
-        published = StorageTexture::PublishShadowsOnly(address, bytes, scope);
+        published = StorageTexture::PublishShadowsOnly(address, bytes, scope, "memory access", waited);
         if (kept && HookSyncProfiled()) CountRecordedStoreSkip(RecordedStoreKey(), evicted);
     } else {
-        stored = StorageTexture::FlushPending(address, bytes, nullptr, "memory access", scope, &published);
+        stored = StorageTexture::FlushPending(address, bytes, nullptr, "memory access", scope, &published, waited);
     }
-    if (stored || published) {
+    if (stored || published || (completionDepth == 0 && SnapshotOverlaps(address, bytes))) {
         // Stores into imported memory were only recorded; the CPU is about to read them. The wait
         // targets the batch holding them (the open one: SyncThrough submits it) and runs with the
         // mutex released when this acquisition is the outermost; a nested hook waits locked through
@@ -1192,6 +1193,7 @@ Recorder::~Recorder() {
         publishGeneration.fetch_add(1, std::memory_order_release);
         pendingLabelSince.store(NoPendingLabel, std::memory_order_release);
         completionLabels.store(0, std::memory_order_release);
+        completionStores.store(0, std::memory_order_release);
         writeBackCompletions.store(0, std::memory_order_release);
         workSinceSubmit.store(0, std::memory_order_release);
     }
@@ -1267,6 +1269,10 @@ std::uint64_t Recorder::PendingCompletionLabels() {
     return completionLabels.load(std::memory_order_acquire);
 }
 
+std::uint64_t Recorder::PendingCompletionStores() {
+    return completionStores.load(std::memory_order_acquire);
+}
+
 std::uint64_t Recorder::PendingWriteBackCompletions() {
     return writeBackCompletions.load(std::memory_order_acquire);
 }
@@ -1846,7 +1852,7 @@ std::atomic<std::uint64_t> timingPresents{0};
 std::atomic<std::uint64_t> presentSerial{0};
 std::atomic<std::uint64_t> timingDropped{0};
 struct TimingTotals { std::uint64_t count = 0; double ms = 0; std::uint64_t bytes = 0; };
-std::mutex timingMutex;
+AgcDriver::Mutex timingMutex;
 std::map<std::uint64_t, TimingTotals> timingByKey;
 double timingProgramMs = 0, timingClassMs = 0, timingUnionMs = 0, timingBatchMs = 0;
 std::uint64_t timingBatches = 0;
@@ -2129,6 +2135,22 @@ void Recorder::NoteSampledDraw(VkCommandBuffer commands) {
     if (open->sampleActive) open->samplesDrawn = true;
 }
 
+void Recorder::NoteDrawTraceToken(std::uint64_t token) noexcept {
+    if (token == 0 || open == nullptr) return;
+    try {
+        auto inserted = open->drawTraceTokenSet.insert(token);
+        if (!inserted.second) return;
+        try {
+            open->drawTraceTokens.push_back(token);
+        } catch (...) {
+            open->drawTraceTokenSet.erase(inserted.first);
+            throw;
+        }
+    } catch (...) {
+        AgcDriver::CaptureTrace::Log("draw-token-note-failed token=%llu", static_cast<unsigned long long>(token));
+    }
+}
+
 bool Recorder::gpuSampleCounter() {
     if (sampleCounterState != 0) return sampleCounterState > 0;
     sampleCounterState = -1;
@@ -2282,6 +2304,20 @@ void Recorder::EndPassSamples() {
     if (open != nullptr && open->segmentActive) endSegment(*open);
 }
 
+void Recorder::RecordUncounted(const std::function<void(VkCommandBuffer)>& record) {
+    const auto commands = Commands();
+    if (open->segmentActive) endSegment(*open);
+    const bool counted = open->sampleActive;
+    if (counted) {
+        open->endedSamples.reserve(open->endedSamples.size() + 1);
+        endSamples(*open);
+        open->endedSamples.push_back(open->samples);
+        open->samples = VK_NULL_HANDLE;
+    }
+    record(commands);
+    if (counted) beginSamples(*open);
+}
+
 void Recorder::takeSegmentPool(Batch& batch) {
     auto cache = std::static_pointer_cast<SamplePoolCache>(segmentPools);
     if (cache == nullptr) {
@@ -2572,9 +2608,15 @@ void Recorder::beginSamples(Batch& batch) {
 void Recorder::readSamples(Batch& batch) {
     if (sampleCounterState > 0) return;
     if (batch.samples == VK_NULL_HANDLE || !batch.submitted) return;
+    std::uint64_t total = 0;
+    for (const auto pool : batch.endedSamples) {
+        std::uint64_t samples = 0;
+        Check(context.Function<PFN_vkGetQueryPoolResults>("vkGetQueryPoolResults")(context.device, pool, 0, 1, sizeof(samples), &samples, sizeof(samples), VK_QUERY_RESULT_64_BIT | VK_QUERY_RESULT_WAIT_BIT), "vkGetQueryPoolResults occlusion");
+        total += samples;
+    }
     std::uint64_t samples = 0;
     Check(context.Function<PFN_vkGetQueryPoolResults>("vkGetQueryPoolResults")(context.device, batch.samples, 0, 1, sizeof(samples), &samples, sizeof(samples), VK_QUERY_RESULT_64_BIT | VK_QUERY_RESULT_WAIT_BIT), "vkGetQueryPoolResults occlusion");
-    samplesPassed.fetch_add(samples, std::memory_order_acq_rel);
+    samplesPassed.fetch_add(total + samples, std::memory_order_acq_rel);
 }
 
 void Recorder::readGpuTiming(Batch& batch) {
@@ -2769,9 +2811,13 @@ void Recorder::NoteUnwrittenDrawSnapshot(std::uint64_t address, std::size_t byte
     unwrittenBytes += bytes;
 }
 
-std::shared_ptr<Buffer> Recorder::ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use, std::uint32_t* derived, std::uint64_t generation) {
+std::shared_ptr<Buffer> Recorder::ReusableDrawSnapshot(std::uint64_t address, std::size_t bytes, SnapshotUse use, std::uint32_t* derived, std::uint64_t generation, VkDeviceSize* offset) {
     auto found = use == SnapshotUse::Vertex ? drawSnapshots.lower_bound({address, use, bytes}) : drawSnapshots.find({address, use, bytes});
-    if (found == drawSnapshots.end() || std::get<0>(found->first) != address || std::get<1>(found->first) != use) return {};
+    if (found == drawSnapshots.end() || std::get<0>(found->first) != address || std::get<1>(found->first) != use) {
+        if (use != SnapshotUse::Storage || offset == nullptr) return {};
+        return containingDrawSnapshot(address, bytes, offset);
+    }
+    if (offset != nullptr) *offset = 0;
     const bool sameRegistry = found->second.registryGeneration == GuestAllocations::GuestAllocationsGeneration_nid_postfix();
     if (!sameRegistry || !GuestMemory::UnchangedSince(address, bytes, found->second.generation)) {
         if (!sameRegistry || generation == 0 || use != SnapshotUse::Storage || !refreshDrawSnapshot(found->second, address, bytes)) {
@@ -2786,6 +2832,23 @@ std::shared_ptr<Buffer> Recorder::ReusableDrawSnapshot(std::uint64_t address, st
     return found->second.buffer;
 }
 
+std::shared_ptr<Buffer> Recorder::containingDrawSnapshot(std::uint64_t address, std::size_t bytes, VkDeviceSize* offset) {
+    const VkDeviceSize alignment = std::max<VkDeviceSize>(context.limits.minStorageBufferOffsetAlignment, 4);
+    const auto registry = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    auto entry = drawSnapshots.upper_bound({address, SnapshotUse::Storage, std::numeric_limits<std::size_t>::max()});
+    for (std::size_t probe = 0; probe < ContainingSnapshotProbes && entry != drawSnapshots.begin(); ++probe) {
+        --entry;
+        const auto& [start, use, held] = entry->first;
+        if (use != SnapshotUse::Storage || start + held < address + bytes || (address - start) % alignment != 0) continue;
+        if (entry->second.registryGeneration != registry || !GuestMemory::UnchangedSince(address, bytes, entry->second.generation)) continue;
+        auto& recency = drawSnapshotPools[SnapshotPool(use)].recency;
+        recency.splice(recency.end(), recency, entry->second.recent);
+        *offset = address - start;
+        return entry->second.buffer;
+    }
+    return {};
+}
+
 bool Recorder::refreshDrawSnapshot(DrawSnapshot& entry, std::uint64_t address, std::size_t bytes) {
     const auto held = entry.buffer->Bytes();
     if (held.size() != bytes || bytes == 0) return false;
@@ -3451,6 +3514,9 @@ void Recorder::AfterCompletions(std::uint64_t address, std::span<const std::byte
     } else {
         ++batch.completionLabelCount;
         completionLabels.fetch_add(1, std::memory_order_acq_rel);
+        ++batch.completionStoreCount;
+        completionStores.fetch_add(1, std::memory_order_acq_rel);
+        GuestMemory::BreakProofs();
     }
     // The table entry before the write note: the note bumps the generation a poller watches, and a
     // poller that sees the bump then finds the label without the GPU mutex.
@@ -3467,6 +3533,7 @@ bool Recorder::AfterRecordedWork(std::function<void()> action) {
     batch.completions.push_back(std::move(action));
     ++batch.completionLabelCount;
     completionLabels.fetch_add(1, std::memory_order_acq_rel);
+        GuestMemory::BreakProofs();
     if (&batch == open.get() && activeRecorder == this && pendingLabelSince.load(std::memory_order_relaxed) == NoPendingLabel) {
         pendingLabelSince.store(std::chrono::steady_clock::now().time_since_epoch().count(), std::memory_order_release);
     }
@@ -3494,7 +3561,10 @@ void Recorder::NoteWrittenBack(std::uint64_t address, std::size_t bytes) {
             label.counted = true;
             ++batch.completionLabelCount;
             completionLabels.fetch_add(1, std::memory_order_acq_rel);
+        GuestMemory::BreakProofs();
             completionLabelsCountedLate.fetch_add(1, std::memory_order_relaxed);
+            ++batch.completionStoreCount;
+            completionStores.fetch_add(1, std::memory_order_acq_rel);
             recorder->markBehindCompletion(batch, label.begin, label.end);
         }
     };
@@ -3564,7 +3634,13 @@ void Recorder::Submit() {
     submission.pCommandBuffers = &batch->commands;
     // The timeline reaches this batch's serial when it completes (see WaitSerial).
     const std::uint64_t serial = submissions + 1;
-    CaptureTrace::Log("submit batch=%llu reads=%zu writes=%zu", static_cast<unsigned long long>(serial), batch->reads.size(), batch->writes.size());
+    std::string tokensStr = "[";
+    for (std::size_t i = 0; i < batch->drawTraceTokens.size(); ++i) {
+        if (i > 0) tokensStr += ",";
+        tokensStr += std::to_string(batch->drawTraceTokens[i]);
+    }
+    tokensStr += "]";
+    CaptureTrace::Log("submit batch=%llu tokens=%s", static_cast<unsigned long long>(serial), tokensStr.c_str());
     VkTimelineSemaphoreSubmitInfoKHR timelineInfo{VK_STRUCTURE_TYPE_TIMELINE_SEMAPHORE_SUBMIT_INFO_KHR};
     const VkSemaphore hold = std::exchange(submitHold, VK_NULL_HANDLE);
     const std::uint64_t holdValue = submitHoldValue;
@@ -3593,6 +3669,7 @@ void Recorder::Submit() {
     batch->submitted = true;
     batch->serial = ++submissions;
     batch->submittedAt = std::chrono::steady_clock::now();
+    CaptureTrace::Log("submit-confirmed batch=%llu tokens=%s", static_cast<unsigned long long>(batch->serial), tokensStr.c_str());
     if (DrawProfiled()) {
         const auto us = std::chrono::duration<double, std::micro>(batch->submittedAt - submitStart).count();
         ++submitCount;
@@ -3622,6 +3699,10 @@ std::uint64_t Recorder::SubmitAndEpoch() {
     return inFlight.empty() ? 0 : submissions;
 }
 
+std::uint64_t Recorder::OpenBatchSerial() {
+    return open != nullptr ? submissions + 1 : 0;
+}
+
 namespace {
 
 // One thread's registration as a timeline waiter (see `unlockedWaiters`): constructed while the
@@ -3675,6 +3756,20 @@ void Recorder::WaitSerial(std::uint64_t serial) {
     Check(result, "vkWaitSemaphoresKHR recorder");
 }
 
+bool Recorder::WaitSerialFor(std::uint64_t serial, std::uint64_t timeoutNanos) {
+    PerformanceTimer frameTiming("Recorder.WaitSerialFor");
+    if (timeline == VK_NULL_HANDLE || serial == 0) return false;
+    const UnlockedWaiter waiter{id};
+    VkSemaphoreWaitInfoKHR wait{VK_STRUCTURE_TYPE_SEMAPHORE_WAIT_INFO_KHR};
+    wait.semaphoreCount = 1;
+    wait.pSemaphores = &timeline;
+    wait.pValues = &serial;
+    const auto result = context.Function<PFN_vkWaitSemaphoresKHR>("vkWaitSemaphoresKHR")(context.device, &wait, timeoutNanos);
+    if (result == VK_TIMEOUT) return false;
+    Check(result, "vkWaitSemaphoresKHR submission progress");
+    return true;
+}
+
 void Recorder::FinishUpTo(std::uint64_t serial) {
     // A drain: the wait already happened (unlocked), the fences are signaled, so the source-0 wait
     // recorded here is the bookkeeping only (a caller that did not wait first, WaitForLeases, shows
@@ -3999,6 +4094,7 @@ void Recorder::finish(std::unique_ptr<Batch> batch, bool wait, int source, bool
             list.erase(std::remove(list.begin(), list.end(), batch), list.end());
             // The batch's completion labels have landed, or never will (fence failure below).
             if (batch->completionLabelCount != 0) completionLabels.fetch_sub(batch->completionLabelCount, std::memory_order_acq_rel);
+            if (batch->completionStoreCount != 0) completionStores.fetch_sub(batch->completionStoreCount, std::memory_order_acq_rel);
             if (batch->writeBackCompletionCount != 0) writeBackCompletions.fetch_sub(batch->writeBackCompletionCount, std::memory_order_acq_rel);
             // This also runs while the fence-failure throw unwinds: an allocation failure in the
             // rebuild keeps the previous snapshot, which is a superset (a stale entry only causes a
@@ -4143,6 +4239,7 @@ void Recorder::finish(std::unique_ptr<Batch> batch, bool wait, int source, bool
 void Recorder::discard(std::unique_ptr<Batch> batch) noexcept {
     removeLabels(*batch);
     if (batch->completionLabelCount != 0) completionLabels.fetch_sub(batch->completionLabelCount, std::memory_order_acq_rel);
+    if (batch->completionStoreCount != 0) completionStores.fetch_sub(batch->completionStoreCount, std::memory_order_acq_rel);
     if (batch->writeBackCompletionCount != 0) writeBackCompletions.fetch_sub(batch->writeBackCompletionCount, std::memory_order_acq_rel);
     if (activeRecorder == this) pendingLabelSince.store(NoPendingLabel, std::memory_order_release);
     release(*batch);
@@ -4181,6 +4278,8 @@ void Recorder::release(Batch& batch) noexcept {
     if (batch.samples != VK_NULL_HANDLE && batch.samplePool == nullptr) context.Function<PFN_vkDestroyQueryPool>("vkDestroyQueryPool")(context.device, batch.samples, nullptr);
     batch.samples = VK_NULL_HANDLE;
     batch.samplePool.reset();
+    for (const auto pool : batch.endedSamples) context.Function<PFN_vkDestroyQueryPool>("vkDestroyQueryPool")(context.device, pool, nullptr);
+    batch.endedSamples.clear();
     batch.segments = VK_NULL_HANDLE;
     batch.segmentPool.reset();
     // A completed (or never submitted) batch's objects are kept for reuse: the fence is signaled or
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ResidentMirror.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ResidentMirror.cpp
new file mode 100644
index 0000000000..3913660efc
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ResidentMirror.cpp
@@ -0,0 +1,659 @@
+#include "prx/libSceAgcDriver/Graphics/include/ResidentMirror.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#ifndef _WIN32
+#include <fcntl.h>
+#include <sys/types.h>
+#include <unistd.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cerrno>
+#include <cstdio>
+#include <cstring>
+#include <fstream>
+#include <map>
+#include <mutex>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <tuple>
+
+namespace AgcDriver::Graphics {
+
+namespace {
+
+constexpr std::uint64_t BlockSize = ResidentBuffer::BlockBytes;
+constexpr std::uint64_t SlabBytes = std::uint64_t{16} << 20u;
+constexpr std::uint32_t SlabBlocks = static_cast<std::uint32_t>(SlabBytes / BlockSize);
+constexpr std::uint64_t ZeroBytes = SlabBytes;
+constexpr VkAccessFlags TransferredAccess = VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_UNIFORM_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_INDIRECT_COMMAND_READ_BIT;
+
+[[noreturn]] void fail(const char* step, VkResult result) {
+    char text[160];
+    std::snprintf(text, sizeof(text), "%s failed (%d)", step, static_cast<int>(result));
+    throw std::runtime_error(text);
+}
+
+struct TransientBuffer {
+    TransientBuffer(const Context& context, VkBuffer buffer) : context(context), buffer(buffer) {}
+    ~TransientBuffer() { context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(context.device, buffer, nullptr); }
+    TransientBuffer(const TransientBuffer&) = delete;
+    TransientBuffer& operator=(const TransientBuffer&) = delete;
+    Context context;
+    VkBuffer buffer;
+};
+
+template<typename Work>
+void recordTransfer(const Context& context, Work&& work) {
+    GuestMemory::AssertGpuLockHeld("heap mirror transfer");
+    std::vector<std::shared_ptr<void>> kept;
+    if (auto* recorder = Recorder::Active(); recorder != nullptr) {
+        const auto commands = recorder->Commands();
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
+        work(commands, kept);
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, TransferredAccess);
+        for (auto& object : kept) recorder->Keep(std::move(object));
+        recorder->MarkCovered(TransferredAccess);
+        return;
+    }
+    CommandBatch batch(context);
+    RecordMemoryBarrier(context, batch.Handle(), VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
+    work(batch.Handle(), kept);
+    RecordMemoryBarrier(context, batch.Handle(), VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, TransferredAccess);
+    batch.SubmitAndWait();
+}
+
+}
+
+class ResidentMemory {
+public:
+    struct Slab {
+        VkDeviceMemory memory = VK_NULL_HANDLE;
+        std::unique_ptr<std::byte[]> host;
+        std::vector<std::uint32_t> free;
+    };
+
+    ResidentMemory(const Context& context, std::uint32_t type) : context(context), type(type) {
+        zero = allocate(ZeroBytes, "vkAllocateMemory of the heap mirrors' zero block");
+    }
+
+    ~ResidentMemory() {
+        const auto freeMemory = context.Function<PFN_vkFreeMemory>("vkFreeMemory");
+        for (auto& slab : slabs) freeMemory(context.device, slab->memory, nullptr);
+        freeMemory(context.device, zero, nullptr);
+    }
+
+    ResidentMemory(const ResidentMemory&) = delete;
+    ResidentMemory& operator=(const ResidentMemory&) = delete;
+
+    VkDeviceMemory Zero() const { return zero; }
+    bool Zeroed() const { return zeroed.load(std::memory_order_acquire); }
+
+    void FillZero(VkCommandBuffer commands, std::vector<std::shared_ptr<void>>& kept) {
+        if (Zeroed()) return;
+        VkBufferCreateInfo info{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO};
+        info.size = ZeroBytes;
+        info.usage = VK_BUFFER_USAGE_TRANSFER_DST_BIT;
+        VkBuffer buffer = VK_NULL_HANDLE;
+        if (const auto result = context.Function<PFN_vkCreateBuffer>("vkCreateBuffer")(context.device, &info, nullptr, &buffer); result != VK_SUCCESS) fail("vkCreateBuffer of the heap mirrors' zero fill", result);
+        auto transient = std::make_shared<TransientBuffer>(context, buffer);
+        VkMemoryRequirements requirements{};
+        context.Function<PFN_vkGetBufferMemoryRequirements>("vkGetBufferMemoryRequirements")(context.device, buffer, &requirements);
+        if ((requirements.memoryTypeBits & (1u << type)) == 0 || requirements.size > ZeroBytes) throw std::runtime_error("the heap mirrors' zero block memory cannot back a transfer buffer to fill it");
+        if (const auto result = context.Function<PFN_vkBindBufferMemory>("vkBindBufferMemory")(context.device, buffer, zero, 0); result != VK_SUCCESS) fail("vkBindBufferMemory of the heap mirrors' zero fill", result);
+        context.Function<PFN_vkCmdFillBuffer>("vkCmdFillBuffer")(commands, buffer, 0, VK_WHOLE_SIZE, 0);
+        kept.push_back(std::move(transient));
+        zeroed.store(true, std::memory_order_release);
+    }
+
+    std::tuple<Slab*, std::uint32_t> Take() {
+        std::lock_guard lock(mutex);
+        for (auto& slab : slabs) {
+            if (slab->free.empty()) continue;
+            const auto index = slab->free.back();
+            slab->free.pop_back();
+            return {slab.get(), index};
+        }
+        auto slab = std::make_unique<Slab>();
+        slab->memory = allocate(SlabBytes, "vkAllocateMemory of a heap mirror slab");
+        slab->host = std::unique_ptr<std::byte[]>(new std::byte[SlabBytes]);
+        for (std::uint32_t index = SlabBlocks; index-- > 1;) slab->free.push_back(index);
+        slabs.push_back(std::move(slab));
+        return {slabs.back().get(), 0u};
+    }
+
+    void Put(Slab* slab, std::uint32_t index) noexcept {
+        std::lock_guard lock(mutex);
+        slab->free.push_back(index);
+        if (slab->free.size() != SlabBlocks) return;
+        const auto found = std::find_if(slabs.begin(), slabs.end(), [&](const auto& held) { return held.get() == slab; });
+        context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, slab->memory, nullptr);
+        slabs.erase(found);
+    }
+
+private:
+    VkDeviceMemory allocate(std::uint64_t bytes, const char* operation) {
+        const VkMemoryAllocateFlagsInfo flags{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_FLAGS_INFO, nullptr, VK_MEMORY_ALLOCATE_DEVICE_ADDRESS_BIT, 0};
+        VkMemoryAllocateInfo info{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO, context.bufferDeviceAddress ? &flags : nullptr};
+        info.allocationSize = bytes;
+        info.memoryTypeIndex = type;
+        if (context.bufferPool != nullptr) return context.bufferPool->AllocateMemory(info, operation);
+        VkDeviceMemory memory = VK_NULL_HANDLE;
+        if (const auto result = context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &info, nullptr, &memory); result != VK_SUCCESS) fail(operation, result);
+        return memory;
+    }
+
+    Context context;
+    std::uint32_t type;
+    VkDeviceMemory zero = VK_NULL_HANDLE;
+    std::atomic<bool> zeroed{false};
+    std::mutex mutex;
+    std::vector<std::unique_ptr<Slab>> slabs;
+};
+
+namespace {
+
+struct ResidentDevices {
+    std::mutex mutex;
+    std::map<std::tuple<VkDevice, std::uint32_t>, std::weak_ptr<ResidentMemory>> memories;
+    std::map<VkDevice, std::uint64_t> addressSpace;
+    std::uint64_t limit = 0;
+    std::mutex pendingMutex;
+    std::vector<std::weak_ptr<ResidentBuffer>> pending;
+};
+
+ResidentDevices& Devices() {
+    static ResidentDevices devices;
+    return devices;
+}
+
+std::shared_ptr<ResidentMemory> residentMemory(const Context& context, std::uint32_t type) {
+    auto& devices = Devices();
+    std::lock_guard lock(devices.mutex);
+    auto& slot = devices.memories[{context.device, type}];
+    if (auto held = slot.lock()) return held;
+    auto made = std::make_shared<ResidentMemory>(context, type);
+    slot = made;
+    return made;
+}
+
+struct Candidate {
+    std::uint64_t begin = 0;
+    std::uint64_t end = 0;
+    bool readable = true;
+};
+
+bool allZero(std::uint64_t begin, std::uint64_t end) {
+    const auto* at = reinterpret_cast<const unsigned char*>(begin);
+    const auto* stop = reinterpret_cast<const unsigned char*>(end);
+    while (at < stop && reinterpret_cast<std::uintptr_t>(at) % sizeof(std::uint64_t) != 0) {
+        if (*at++ != 0) return false;
+    }
+    while (stop - at >= static_cast<std::ptrdiff_t>(sizeof(std::uint64_t))) {
+        std::uint64_t word = 0;
+        std::memcpy(&word, at, sizeof(word));
+        if (word != 0) return false;
+        at += sizeof(word);
+    }
+    while (at < stop) {
+        if (*at++ != 0) return false;
+    }
+    return true;
+}
+
+#ifndef _WIN32
+struct Mapping {
+    std::uint64_t begin = 0;
+    std::uint64_t end = 0;
+    bool readable = false;
+    bool privateAnonymous = false;
+};
+
+std::vector<Mapping> mappings(std::uint64_t begin, std::uint64_t end) {
+    std::ifstream maps("/proc/self/maps");
+    Require(static_cast<bool>(maps), "cannot read /proc/self/maps for a heap mirror's pages");
+    std::vector<Mapping> found;
+    std::string line;
+    while (std::getline(maps, line)) {
+        std::istringstream fields(line);
+        std::string span, permissions, offset, device;
+        unsigned long long inode = 0;
+        fields >> span >> permissions >> offset >> device >> inode;
+        const auto dash = span.find('-');
+        Require(dash != std::string::npos && permissions.size() == 4, "unexpected /proc/self/maps line: " + line);
+        const auto first = std::stoull(span.substr(0, dash), nullptr, 16);
+        const auto last = std::stoull(span.substr(dash + 1), nullptr, 16);
+        if (last <= begin || first >= end) continue;
+        found.push_back({std::max<std::uint64_t>(first, begin), std::min<std::uint64_t>(last, end), permissions[0] == 'r', inode == 0 && permissions[3] == 'p'});
+    }
+    return found;
+}
+
+void fileData(std::vector<Candidate>& maybe, const Mapping& mapping, int file, std::uint64_t offset) {
+    const auto end = offset + (mapping.end - mapping.begin);
+    auto at = static_cast<off_t>(offset);
+    while (static_cast<std::uint64_t>(at) < end) {
+        const auto data = lseek(file, at, SEEK_DATA);
+        if (data < 0) {
+            Require(errno == ENXIO, "SEEK_DATA on a heap mirror's shared backing failed");
+            return;
+        }
+        if (static_cast<std::uint64_t>(data) >= end) return;
+        const auto hole = lseek(file, data, SEEK_HOLE);
+        Require(hole >= 0, "SEEK_HOLE on a heap mirror's shared backing failed");
+        const auto stop = std::min<std::uint64_t>(static_cast<std::uint64_t>(hole), end);
+        maybe.push_back({mapping.begin + (static_cast<std::uint64_t>(data) - offset), mapping.begin + (stop - offset), mapping.readable});
+        at = static_cast<off_t>(stop);
+    }
+}
+
+void populatedPages(std::vector<Candidate>& maybe, const Mapping& mapping) {
+    static const auto page = static_cast<std::uint64_t>(sysconf(_SC_PAGESIZE));
+    const int file = open("/proc/self/pagemap", O_RDONLY | O_CLOEXEC);
+    Require(file >= 0, "cannot open /proc/self/pagemap for a heap mirror's pages");
+    constexpr std::size_t Entries = 4096;
+    std::array<std::uint64_t, Entries> entries{};
+    const auto first = mapping.begin / page;
+    const auto last = (mapping.end + page - 1) / page;
+    for (auto at = first; at < last;) {
+        const auto count = static_cast<std::size_t>(std::min<std::uint64_t>(Entries, last - at));
+        const auto read = pread(file, entries.data(), count * sizeof(std::uint64_t), static_cast<off_t>(at * sizeof(std::uint64_t)));
+        if (read != static_cast<ssize_t>(count * sizeof(std::uint64_t))) {
+            close(file);
+            throw std::runtime_error("reading /proc/self/pagemap for a heap mirror's pages failed");
+        }
+        for (std::size_t index = 0; index < count; ++index) {
+            constexpr std::uint64_t present = std::uint64_t{1} << 63u;
+            constexpr std::uint64_t swapped = std::uint64_t{1} << 62u;
+            if ((entries[index] & (present | swapped)) == 0) continue;
+            const auto address = (at + index) * page;
+            const auto from = std::max(address, mapping.begin);
+            const auto to = std::min(address + page, mapping.end);
+            if (!maybe.empty() && maybe.back().end == from && maybe.back().readable == mapping.readable) maybe.back().end = to;
+            else maybe.push_back({from, to, mapping.readable});
+        }
+        at += count;
+    }
+    close(file);
+}
+#endif
+
+std::vector<Candidate> possiblyNonzero(std::uint64_t begin, std::uint64_t end) {
+    std::vector<Candidate> maybe;
+#ifdef _WIN32
+    maybe.push_back({begin, end, true});
+#else
+    for (const auto& mapping : mappings(begin, end)) {
+        int file = -1;
+        std::uint64_t offset = 0;
+        if (GuestArena::GuestArenaSharedBacking_nid_postfix(static_cast<std::uintptr_t>(mapping.begin), static_cast<std::size_t>(mapping.end - mapping.begin), &file, &offset)) {
+            try {
+                fileData(maybe, mapping, file, offset);
+            } catch (...) {
+                close(file);
+                throw;
+            }
+            close(file);
+        } else if (mapping.privateAnonymous) {
+            populatedPages(maybe, mapping);
+        } else {
+            maybe.push_back({mapping.begin, mapping.end, mapping.readable});
+        }
+    }
+#endif
+    return maybe;
+}
+
+}
+
+bool GuestBytesZero(std::uint64_t begin, std::uint64_t end) {
+    return allZero(begin, end);
+}
+
+GuestRuns GuestNonzeroBlocks(const GuestRuns& candidates) {
+    GuestRuns runs;
+    for (const auto& [first, last] : candidates) {
+        if (first >= last) continue;
+        const auto maybe = possiblyNonzero(first, last);
+        std::size_t at = 0;
+        for (auto block = first / BlockSize * BlockSize; block < last; block += BlockSize) {
+            const auto from = std::max(first, block);
+            const auto to = std::min(last, block + BlockSize);
+            while (at < maybe.size() && maybe[at].end <= from) ++at;
+            bool nonzero = false;
+            for (auto next = at; !nonzero && next < maybe.size() && maybe[next].begin < to; ++next) {
+                const auto low = std::max(from, maybe[next].begin);
+                const auto high = std::min(to, maybe[next].end);
+                if (low < high) nonzero = !maybe[next].readable || !allZero(low, high);
+            }
+            if (!nonzero) continue;
+            if (!runs.empty() && runs.back().second == from) runs.back().second = to;
+            else runs.emplace_back(from, to);
+        }
+    }
+    return runs;
+}
+
+void SetResidentAddressSpaceLimit(std::uint64_t bytes) {
+    auto& devices = Devices();
+    std::lock_guard lock(devices.mutex);
+    devices.limit = bytes;
+}
+
+std::shared_ptr<ResidentBuffer> ResidentBuffer::Create(const Context& context, std::uint64_t base, std::uint64_t bytes, const GuestRuns& backed) {
+    if (!context.sparseBinding || !context.sparseResidencyBuffer || !context.sparseResidencyAliased) return nullptr;
+    const auto first = base / BlockSize * BlockSize;
+    const auto size = (base - first + bytes + BlockSize - 1) / BlockSize * BlockSize;
+    {
+        auto& devices = Devices();
+        std::lock_guard lock(devices.mutex);
+        const auto limit = devices.limit != 0 ? std::min(devices.limit, context.limits.sparseAddressSpaceSize) : context.limits.sparseAddressSpaceSize;
+        auto& used = devices.addressSpace[context.device];
+        if (size > limit || used > limit - size) return nullptr;
+        used += size;
+    }
+    return std::shared_ptr<ResidentBuffer>(new ResidentBuffer(context, base, bytes, backed));
+}
+
+ResidentBuffer::ResidentBuffer(const Context& context, std::uint64_t base, std::uint64_t bytes, const GuestRuns& backed) : context(context) {
+    origin = base / BlockSize * BlockSize;
+    lead = base - origin;
+    size = (lead + bytes + BlockSize - 1) / BlockSize * BlockSize;
+    try {
+        VkBufferCreateInfo info{VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO};
+        info.flags = VK_BUFFER_CREATE_SPARSE_BINDING_BIT | VK_BUFFER_CREATE_SPARSE_ALIASED_BIT;
+        info.size = size;
+        info.usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_SHADER_DEVICE_ADDRESS_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT | VK_BUFFER_USAGE_TRANSFER_DST_BIT;
+        const std::array<std::uint32_t, 2> families{context.queueFamily, context.sparseFamily};
+        if (context.sparseQueue != VK_NULL_HANDLE && context.sparseFamily != context.queueFamily) {
+            info.sharingMode = VK_SHARING_MODE_CONCURRENT;
+            info.queueFamilyIndexCount = static_cast<std::uint32_t>(families.size());
+            info.pQueueFamilyIndices = families.data();
+        }
+        if (const auto result = context.Function<PFN_vkCreateBuffer>("vkCreateBuffer")(context.device, &info, nullptr, &buffer); result != VK_SUCCESS) fail("vkCreateBuffer of a resident heap mirror", result);
+        VkMemoryRequirements requirements{};
+        context.Function<PFN_vkGetBufferMemoryRequirements>("vkGetBufferMemoryRequirements")(context.device, buffer, &requirements);
+        if (requirements.alignment == 0 || requirements.alignment > BlockSize || BlockSize % requirements.alignment != 0) {
+            char text[160];
+            std::snprintf(text, sizeof(text), "the device's sparse buffer block of %llu bytes does not divide a heap mirror's 64 KiB block", static_cast<unsigned long long>(requirements.alignment));
+            throw std::runtime_error(text);
+        }
+        type = context.DeviceMemoryType(requirements.memoryTypeBits, SlabBytes, "a resident heap mirror slab");
+        memory = residentMemory(context, type);
+        slots.resize(static_cast<std::size_t>(size / BlockSize));
+        std::vector<bool> wanted(slots.size(), false);
+        for (const auto& [first, last] : backed) {
+            if (first >= last) continue;
+            for (auto index = blockIndex(first); index <= blockIndex(last - 1); ++index) wanted[index] = true;
+        }
+        std::vector<VkSparseMemoryBind> binds;
+        for (std::size_t index = 0; index < slots.size();) {
+            if (wanted[index]) {
+                auto [slab, at] = memory->Take();
+                slots[index] = {slab, at, slab->host.get() + at * BlockSize};
+                std::memset(slots[index].host, 0, static_cast<std::size_t>(BlockSize));
+                binds.push_back({index * BlockSize, BlockSize, slab->memory, at * BlockSize, 0});
+                ++bound;
+                ++index;
+                continue;
+            }
+            auto last = index;
+            while (last < slots.size() && !wanted[last] && (last - index + 1) * BlockSize <= ZeroBytes) ++last;
+            binds.push_back({index * BlockSize, (last - index) * BlockSize, memory->Zero(), 0, 0});
+            index = last;
+        }
+        submit(binds);
+        const VkBufferDeviceAddressInfo addressInfo{VK_STRUCTURE_TYPE_BUFFER_DEVICE_ADDRESS_INFO, nullptr, buffer};
+        address = context.Function<PFN_vkGetBufferDeviceAddressKHR>("vkGetBufferDeviceAddressKHR")(context.device, &addressInfo);
+        if (address == 0) fail("vkGetBufferDeviceAddressKHR of a resident heap mirror", VK_ERROR_UNKNOWN);
+    } catch (...) {
+        release();
+        throw;
+    }
+}
+
+ResidentBuffer::~ResidentBuffer() {
+    release();
+}
+
+void ResidentBuffer::release() noexcept {
+    if (buffer != VK_NULL_HANDLE) context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(context.device, buffer, nullptr);
+    buffer = VK_NULL_HANDLE;
+    for (auto& slot : slots) {
+        if (slot.host != nullptr) memory->Put(static_cast<ResidentMemory::Slab*>(slot.slab), slot.index);
+        slot = {};
+    }
+    auto& devices = Devices();
+    std::lock_guard lock(devices.mutex);
+    if (const auto found = devices.addressSpace.find(context.device); found != devices.addressSpace.end()) found->second -= std::min(found->second, size);
+    size = 0;
+}
+
+std::size_t ResidentBuffer::blockIndex(std::uint64_t guest) const {
+    Require(guest >= origin && guest - origin < size, "guest address outside its resident heap mirror");
+    return static_cast<std::size_t>((guest - origin) / BlockSize);
+}
+
+std::byte* ResidentBuffer::Block(std::uint64_t guest) const {
+    const auto& slot = slots[blockIndex(guest)];
+    return slot.host == nullptr ? nullptr : slot.host + (guest - origin) % BlockSize;
+}
+
+std::uint64_t ResidentBuffer::UnboundBytes(const GuestRuns& runs) const {
+    std::vector<std::size_t> seen;
+    for (const auto& [first, last] : runs) {
+        if (first >= last) continue;
+        for (auto index = blockIndex(first); index <= blockIndex(last - 1); ++index) {
+            if (slots[index].host == nullptr) seen.push_back(index);
+        }
+    }
+    std::sort(seen.begin(), seen.end());
+    return static_cast<std::uint64_t>(std::unique(seen.begin(), seen.end()) - seen.begin()) * BlockSize;
+}
+
+void ResidentBuffer::Bind(const GuestRuns& runs) {
+    std::vector<VkSparseMemoryBind> binds;
+    std::vector<std::size_t> made;
+    for (const auto& [first, last] : runs) {
+        if (first >= last) continue;
+        for (auto index = blockIndex(first); index <= blockIndex(last - 1); ++index) {
+            if (slots[index].host != nullptr) continue;
+            auto [slab, at] = memory->Take();
+            slots[index] = {slab, at, slab->host.get() + at * BlockSize};
+            std::memset(slots[index].host, 0, static_cast<std::size_t>(BlockSize));
+            binds.push_back({index * BlockSize, BlockSize, slab->memory, at * BlockSize, 0});
+            made.push_back(index);
+        }
+    }
+    if (binds.empty()) return;
+    if (auto* recorder = Recorder::Active(); recorder != nullptr) recorder->Sync();
+    try {
+        submit(binds);
+    } catch (...) {
+        for (const auto index : made) {
+            memory->Put(static_cast<ResidentMemory::Slab*>(slots[index].slab), slots[index].index);
+            slots[index] = {};
+        }
+        throw;
+    }
+    bound += made.size();
+    for (const auto index : made) MarkChanged(origin + index * BlockSize, origin + (index + 1) * BlockSize);
+}
+
+void ResidentBuffer::MarkChanged(std::uint64_t begin, std::uint64_t end) {
+    if (begin >= end) return;
+    bool first = false;
+    {
+        std::lock_guard lock(changedMutex);
+        first = changed.empty();
+        if (!changed.empty() && changed.back().second == begin) changed.back().second = end;
+        else changed.emplace_back(begin, end);
+    }
+    if (!first) return;
+    auto& devices = Devices();
+    std::lock_guard lock(devices.pendingMutex);
+    devices.pending.push_back(weak_from_this());
+}
+
+void ResidentBuffer::Read(std::uint64_t guest, std::span<std::byte> out) const {
+    std::size_t done = 0;
+    while (done < out.size()) {
+        const auto at = guest + done;
+        const auto within = static_cast<std::size_t>((at - origin) % BlockSize);
+        const auto length = std::min<std::size_t>(out.size() - done, static_cast<std::size_t>(BlockSize) - within);
+        if (const auto* source = Block(at); source != nullptr) std::memcpy(out.data() + done, source, length);
+        else std::memset(out.data() + done, 0, length);
+        done += length;
+    }
+}
+
+void ResidentBuffer::Store(std::uint64_t guest, std::span<const std::byte> bytes) {
+    std::size_t done = 0;
+    while (done < bytes.size()) {
+        const auto at = guest + done;
+        const auto within = static_cast<std::size_t>((at - origin) % BlockSize);
+        const auto length = std::min<std::size_t>(bytes.size() - done, static_cast<std::size_t>(BlockSize) - within);
+        if (auto* target = Block(at); target != nullptr) std::memcpy(target, bytes.data() + done, length);
+        else Require(GuestBytesZero(reinterpret_cast<std::uintptr_t>(bytes.data() + done), reinterpret_cast<std::uintptr_t>(bytes.data() + done + length)), "the GPU wrote a heap mirror block that holds no memory");
+        done += length;
+    }
+}
+
+std::shared_ptr<Buffer> ResidentBuffer::RecordReadback(VkCommandBuffer commands, std::uint64_t guest, std::uint64_t bytes) const {
+    Require(guest >= origin && bytes <= size && guest - origin <= size - bytes, "heap mirror readback outside its buffer");
+    auto staging = std::make_shared<Buffer>(context, static_cast<std::size_t>(bytes), VK_BUFFER_USAGE_TRANSFER_DST_BIT);
+    CopyBuffer(context, commands, buffer, guest - origin, staging->Handle(), 0, bytes);
+    return staging;
+}
+
+void ResidentBuffer::ReadDevice(std::uint64_t guest, std::span<std::byte> out) {
+    GuestMemory::AssertGpuLockHeld("heap mirror device read");
+    Require(!Recorder::InCompletion(), "heap mirror device read inside a GPU completion: its write-back needs a recorded readback");
+    auto staging = readbackBatch(guest, out.size());
+    std::memcpy(out.data(), staging->Bytes().data(), out.size());
+}
+
+std::shared_ptr<Buffer> ResidentBuffer::readbackBatch(std::uint64_t guest, std::uint64_t bytes) {
+    CommandBatch batch(context);
+    RecordMemoryBarrier(context, batch.Handle(), VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT);
+    auto staging = RecordReadback(batch.Handle(), guest, bytes);
+    RecordMemoryBarrier(context, batch.Handle(), VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_HOST_READ_BIT);
+    batch.SubmitAndWait();
+    return staging;
+}
+
+void ResidentBuffer::flush() {
+    GuestRuns runs;
+    {
+        std::lock_guard lock(changedMutex);
+        runs.swap(changed);
+    }
+    if (runs.empty()) return;
+    try {
+        std::sort(runs.begin(), runs.end());
+        std::vector<VkBufferCopy> regions;
+        std::uint64_t total = 0;
+        std::uint64_t cursor = 0;
+        for (const auto& [first, last] : runs) {
+            for (auto at = std::max(first, cursor); at < last;) {
+                const auto next = std::min(last, (at / BlockSize + 1) * BlockSize);
+                if (slots[blockIndex(at)].host != nullptr) {
+                    if (!regions.empty() && regions.back().dstOffset + regions.back().size == at - origin) regions.back().size += next - at;
+                    else regions.push_back({total, at - origin, next - at});
+                    total += next - at;
+                }
+                at = next;
+            }
+            cursor = std::max(cursor, last);
+        }
+        if (regions.empty()) return;
+        auto staging = std::make_shared<Buffer>(context, static_cast<std::size_t>(total), VK_BUFFER_USAGE_TRANSFER_SRC_BIT);
+        for (const auto& region : regions) {
+            for (VkDeviceSize done = 0; done < region.size;) {
+                const auto at = origin + region.dstOffset + done;
+                const auto length = std::min<VkDeviceSize>(region.size - done, BlockSize - (at - origin) % BlockSize);
+                std::memcpy(staging->Bytes().data() + region.srcOffset + done, Block(at), static_cast<std::size_t>(length));
+                done += length;
+            }
+        }
+        recordTransfer(context, [&](VkCommandBuffer commands, std::vector<std::shared_ptr<void>>& kept) {
+            context.Function<PFN_vkCmdCopyBuffer>("vkCmdCopyBuffer")(commands, staging->Handle(), buffer, static_cast<std::uint32_t>(regions.size()), regions.data());
+            kept.push_back(staging);
+            kept.push_back(shared_from_this());
+        });
+    } catch (...) {
+        {
+            std::lock_guard lock(changedMutex);
+            changed.insert(changed.begin(), runs.begin(), runs.end());
+        }
+        auto& devices = Devices();
+        std::lock_guard lock(devices.pendingMutex);
+        devices.pending.push_back(weak_from_this());
+        throw;
+    }
+}
+
+void ResidentBuffer::FlushChanged(const Context& context) {
+    auto& devices = Devices();
+    std::vector<std::shared_ptr<ResidentMemory>> unzeroed;
+    {
+        std::lock_guard lock(devices.mutex);
+        for (const auto& [key, held] : devices.memories) {
+            if (std::get<0>(key) != context.device) continue;
+            if (auto memory = held.lock(); memory != nullptr && !memory->Zeroed()) unzeroed.push_back(std::move(memory));
+        }
+    }
+    for (auto& memory : unzeroed) recordTransfer(context, [&](VkCommandBuffer commands, std::vector<std::shared_ptr<void>>& kept) { memory->FillZero(commands, kept); });
+    std::vector<std::weak_ptr<ResidentBuffer>> waiting;
+    {
+        std::lock_guard lock(devices.pendingMutex);
+        waiting.swap(devices.pending);
+    }
+    for (std::size_t index = 0; index < waiting.size(); ++index) {
+        const auto held = waiting[index].lock();
+        if (held == nullptr) continue;
+        if (held->context.device != context.device) {
+            std::lock_guard lock(devices.pendingMutex);
+            devices.pending.push_back(waiting[index]);
+            continue;
+        }
+        try {
+            held->flush();
+        } catch (...) {
+            std::lock_guard lock(devices.pendingMutex);
+            devices.pending.insert(devices.pending.end(), waiting.begin() + static_cast<std::ptrdiff_t>(index) + 1, waiting.end());
+            throw;
+        }
+    }
+}
+
+void ResidentBuffer::submit(const std::vector<VkSparseMemoryBind>& binds) {
+    const bool ownQueue = context.sparseQueue != VK_NULL_HANDLE && context.sparseQueueMutex != nullptr;
+    const VkSparseBufferMemoryBindInfo bufferBinds{buffer, static_cast<std::uint32_t>(binds.size()), binds.data()};
+    VkBindSparseInfo bind{VK_STRUCTURE_TYPE_BIND_SPARSE_INFO};
+    bind.bufferBindCount = 1;
+    bind.pBufferBinds = &bufferBinds;
+    const VkFenceCreateInfo fenceInfo{VK_STRUCTURE_TYPE_FENCE_CREATE_INFO};
+    VkFence fence = VK_NULL_HANDLE;
+    if (const auto result = context.Function<PFN_vkCreateFence>("vkCreateFence")(context.device, &fenceInfo, nullptr, &fence); result != VK_SUCCESS) fail("vkCreateFence of a resident heap mirror bind", result);
+    VkResult submitted = VK_SUCCESS;
+    VkResult waited = VK_SUCCESS;
+    {
+        std::unique_lock<std::mutex> queueLock;
+        std::unique_lock<GuestMemory::GpuMutexType> gpuLock;
+        if (ownQueue) queueLock = std::unique_lock(*context.sparseQueueMutex);
+        else gpuLock = std::unique_lock(GuestMemory::GpuMutex());
+        submitted = context.Function<PFN_vkQueueBindSparse>("vkQueueBindSparse")(ownQueue ? context.sparseQueue : context.queue, 1, &bind, fence);
+        if (submitted == VK_SUCCESS) waited = context.Function<PFN_vkWaitForFences>("vkWaitForFences")(context.device, 1, &fence, VK_TRUE, UINT64_MAX);
+    }
+    context.Function<PFN_vkDestroyFence>("vkDestroyFence")(context.device, fence, nullptr);
+    if (submitted != VK_SUCCESS) fail("vkQueueBindSparse of a resident heap mirror", submitted);
+    if (waited != VK_SUCCESS) fail("vkWaitForFences of a resident heap mirror bind", waited);
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp
index dfcef91efc..647b38274c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/SampleOrder.cpp
@@ -185,6 +185,7 @@ public:
         auto copy = copyFor(target.format, target.samples, target.extent, stencil);
         kept.push_back(copy);
         const VkImageAspectFlags aspects = VK_IMAGE_ASPECT_DEPTH_BIT | (stencil ? VK_IMAGE_ASPECT_STENCIL_BIT : 0u);
+        const VkImageAspectFlags layoutAspects = VK_IMAGE_ASPECT_DEPTH_BIT | (HasStencil(target.format) ? VK_IMAGE_ASPECT_STENCIL_BIT : 0u);
         if (!copy->general) {
             VkImageMemoryBarrier toGeneral{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
             toGeneral.dstAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
@@ -193,7 +194,7 @@ public:
             toGeneral.srcQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
             toGeneral.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
             toGeneral.image = copy->image;
-            toGeneral.subresourceRange = {aspects, 0, 1, 0, 1};
+            toGeneral.subresourceRange = {layoutAspects, 0, 1, 0, 1};
             context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral);
             copy->general = true;
         }
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp
index 2915b76a5a..5bfb9d604e 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderAddressResources.cpp
@@ -93,6 +93,10 @@ bool storesThroughAddressesCached(const ShaderRecompiler::SharedSpirv& spirv) {
 
 }
 
+bool ShaderStoresThroughAddresses(const ShaderRecompiler::SharedSpirv& spirv) {
+    return storesThroughAddressesCached(spirv);
+}
+
 bool SpirvStoresThroughAddresses(std::span<const std::uint32_t> words) {
     if (words.size() < 5 || words[0] != spv::MagicNumber) return true;
     std::unordered_set<std::uint32_t> pointerTypes;
@@ -134,7 +138,7 @@ void ShaderResources::prepareAddressBindings(std::span<const CompiledShader> sha
         if (tables != 0 && storesThroughAddressesCached(shader.program->spirv)) bdaReadOnly = false;
         usesFaultBuffer = usesFaultBuffer || faults != 0;
         const bool tableFaultsOnly = std::any_of(shader.program->bindings.begin(), shader.program->bindings.end(), [](const ShaderRecompiler::DescriptorBinding& binding) { return binding.role == ShaderRecompiler::DescriptorRole::ImageTableMap; });
-        faultChecks = faultChecks || tables != 0 || (faults != 0 && (!tableFaultsOnly || shader.program->imageTableFaults != 0 || shader.program->poisonedSrtReads != 0 || loopGuarded));
+        faultChecks = faultChecks || tables != 0 || (faults != 0 && (!tableFaultsOnly || shader.program->imageTableFaults != 0 || shader.program->poisonedSrtReads != 0 || shader.program->windowLaneGuards != 0 || loopGuarded));
     }
     if (usesBda) {
         Require(context.bufferDeviceAddress, "buffer device address is not enabled");
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp
index 3859fc17d0..30ea580803 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgc/Shader/include/ShaderConstants.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/State.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/HostThreadLocal.hpp"
 #include <algorithm>
 #include <array>
 #include <cstddef>
@@ -244,6 +245,48 @@ ShaderRecompiler::ShaderVertexStageInfo DecodeVertexStageInfo(std::span<const st
         read.size = static_cast<std::uint32_t>(bytes.size());
     };
     if (reads != nullptr) reads->reserve(reads->size() + 2u * shader.num_input_semantics);
+    std::array<std::uint32_t, ShaderRecompiler::ShaderVertexStageInfo::MaxResources> attribWords{};
+    std::array<std::array<std::uint32_t, 4>, ShaderRecompiler::ShaderVertexStageInfo::MaxResources> sharpWords{};
+    if (!staticAbi) {
+        std::uint32_t firstSemantic = ~0u, lastSemantic = 0;
+        for (std::uint32_t i = 0; i < shader.num_input_semantics; ++i) {
+            firstSemantic = std::min<std::uint32_t>(firstSemantic, semantics[i].semantic);
+            lastSemantic = std::max<std::uint32_t>(lastSemantic, semantics[i].semantic);
+        }
+        const auto readWords = [](std::uint64_t base, std::uint32_t stride, std::uint32_t first, std::uint32_t last, std::vector<std::uint32_t>& words, auto&& wanted) {
+            const auto wordsPer = stride / 4u;
+            words.assign(static_cast<std::size_t>(last - first + 1u) * wordsPer, 0u);
+            const auto begin = base + static_cast<std::uint64_t>(first) * stride;
+            if (AgcDriver::GuestMemory::Accessible(reinterpret_cast<const void*>(begin), words.size() * 4u)) {
+                AgcDriver::GuestMemory::Read(begin, std::as_writable_bytes(std::span(words)), 4);
+                return;
+            }
+            for (std::uint32_t entry = first; entry <= last; ++entry) {
+                if (!wanted(entry)) continue;
+                AgcDriver::GuestMemory::Read(base + static_cast<std::uint64_t>(entry) * stride, std::as_writable_bytes(std::span(words).subspan(static_cast<std::size_t>(entry - first) * wordsPer, wordsPer)), 4);
+            }
+        };
+        struct TableStorage {};
+        auto& table = HostThreadLocal<std::vector<std::uint32_t>, TableStorage>();
+        readWords(attribTableAddr, 4u, firstSemantic, lastSemantic, table, [&](std::uint32_t semantic) { return std::any_of(semantics.begin(), semantics.begin() + shader.num_input_semantics, [&](const ShaderSemantic& candidate) { return candidate.semantic == semantic; }); });
+        std::uint32_t firstIndex = ~0u, lastIndex = 0;
+        for (std::uint32_t i = 0; i < shader.num_input_semantics; ++i) {
+            attribWords[i] = table[semantics[i].semantic - firstSemantic];
+            const auto index = attribWords[i] & 0x1fu;
+            if (index >= ShaderRecompiler::ShaderVertexStageInfo::MaxResources) throw std::runtime_error("AGC graphics: vertex buffer index exceeds the supported domain");
+            firstIndex = std::min(firstIndex, index);
+            lastIndex = std::max(lastIndex, index);
+        }
+        if (shader.num_input_semantics != 0) {
+            struct SharpsStorage {};
+            auto& sharps = HostThreadLocal<std::vector<std::uint32_t>, SharpsStorage>();
+            readWords(bufferTableAddr, 16u, firstIndex, lastIndex, sharps, [&](std::uint32_t index) { return std::any_of(attribWords.begin(), attribWords.begin() + shader.num_input_semantics, [&](std::uint32_t word) { return (word & 0x1fu) == index; }); });
+            for (std::uint32_t i = 0; i < shader.num_input_semantics; ++i) {
+                const auto index = attribWords[i] & 0x1fu;
+                std::copy_n(sharps.begin() + static_cast<std::ptrdiff_t>((index - firstIndex) * 4u), 4, sharpWords[i].begin());
+            }
+        }
+    }
     for (std::uint32_t i = 0; i < shader.num_input_semantics; ++i) {
         const auto& semantic = semantics[i];
         if (semantic.static_vb_index == 1 || semantic.static_attribute == 1) throw std::runtime_error("AGC graphics: statically bound vertex attributes are not implemented");
@@ -256,10 +299,9 @@ ShaderRecompiler::ShaderVertexStageInfo DecodeVertexStageInfo(std::span<const st
         }
         std::array<std::byte, 4> attribWordBytes{};
         const auto attribWordAddress = attribTableAddr + static_cast<std::uint64_t>(semantic.semantic) * 4u;
-        AgcDriver::GuestMemory::Read(attribWordAddress, attribWordBytes, 4);
+        std::memcpy(attribWordBytes.data(), &attribWords[i], 4);
         record(attribWordAddress, attribWordBytes);
-        std::uint32_t attribWord;
-        std::memcpy(&attribWord, attribWordBytes.data(), 4);
+        const std::uint32_t attribWord = attribWords[i];
         const auto index = attribWord & 0x1fu;
         const auto format = (attribWord >> 5u) & 0x1ffu;
         const auto offset = (attribWord >> 14u) & 0xfffu;
@@ -267,7 +309,7 @@ ShaderRecompiler::ShaderVertexStageInfo DecodeVertexStageInfo(std::span<const st
         if (index >= ShaderRecompiler::ShaderVertexStageInfo::MaxResources) throw std::runtime_error("AGC graphics: vertex buffer index exceeds the supported domain");
         std::array<std::byte, 16> sharpBytes{};
         const auto sharpAddress = bufferTableAddr + static_cast<std::uint64_t>(index) * 16u;
-        AgcDriver::GuestMemory::Read(sharpAddress, sharpBytes, 4);
+        std::memcpy(sharpBytes.data(), sharpWords[i].data(), 16);
         record(sharpAddress, sharpBytes);
         std::array<std::uint32_t, 4> sharp{};
         std::memcpy(sharp.data(), sharpBytes.data(), 16);
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
index d6d84cd4aa..84bc841971 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
@@ -1,12 +1,15 @@
 #include "prx/libSceAgcDriver/Execution/include/ProfileOutput.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "ThreadOwned.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PlaceholderImages.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
@@ -14,12 +17,12 @@
 #include <atomic>
 #include <memory>
 #include <mutex>
-#include <thread>
 #include <array>
 #include <chrono>
 #include <cstdio>
 #include <cstdlib>
 #include <exception>
+#include <functional>
 #include <stdexcept>
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
@@ -127,10 +130,12 @@ struct CachedTexture {
 // eviction takes the back. APS5_NO_TEXTURE_HASH=1 finds entries by scanning the list (the index is
 // still kept), the linear lookup of before.
 struct TextureCache {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::list<CachedTexture> entries;
     std::unordered_map<TextureKey, std::list<CachedTexture>::iterator, TextureKeyHash> index;
     std::unordered_multimap<const StorageTexture*, std::list<CachedTexture>::iterator> views;
+    std::vector<std::pair<std::vector<std::byte>, std::uint64_t>> spare;
+    std::uint64_t spareBytes = 0;
     std::uint64_t bytes = 0;
     std::size_t passed = 0;
     std::chrono::steady_clock::time_point passedSince{};
@@ -160,6 +165,8 @@ TextureCache& Textures() {
 
 thread_local unsigned sampledCacheHeld = 0;
 thread_local unsigned storageCacheHeld = 0;
+thread_local unsigned sampledCacheReclaimable = 0;
+thread_local unsigned storageCacheReclaimable = 0;
 
 struct CacheHold {
     unsigned& depth;
@@ -169,17 +176,8 @@ struct CacheHold {
     CacheHold& operator=(const CacheHold&) = delete;
 };
 
-bool AcquireCache(std::mutex& mutex) {
-    const auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(20);
-    do {
-        if (mutex.try_lock()) return true;
-        std::this_thread::yield();
-    } while (std::chrono::steady_clock::now() < deadline);
-    return false;
-}
-
 struct UncachedImages {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::vector<std::weak_ptr<StorageTexture>> images;
     std::atomic<bool> any{false};
 };
@@ -265,6 +263,39 @@ void touchTexture(TextureCache& cache, std::list<CachedTexture>::iterator it) {
     it->present = Recorder::Presents();
 }
 
+constexpr std::uint64_t SpareSnapshotBytes = 256ull << 20;
+
+void parkSnapshot(TextureCache& cache, std::vector<std::byte>& bytes) {
+    const auto size = bytes.size();
+    if (size == 0) return;
+    const auto present = Recorder::Presents();
+    while (!cache.spare.empty() && (present - cache.spare.front().second > SpareSnapshotPresents || cache.spareBytes + size > SpareSnapshotBytes)) {
+        cache.spareBytes -= cache.spare.front().first.size();
+        cache.spare.erase(cache.spare.begin());
+    }
+    if (cache.spareBytes + size <= SpareSnapshotBytes) {
+        cache.spareBytes += size;
+        cache.spare.emplace_back(std::move(bytes), present);
+    }
+    bytes = std::vector<std::byte>{};
+}
+
+std::vector<std::byte> spareSnapshot(TextureCache& cache, std::size_t bytes) {
+    const auto present = Recorder::Presents();
+    while (!cache.spare.empty() && present - cache.spare.front().second > SpareSnapshotPresents) {
+        cache.spareBytes -= cache.spare.front().first.size();
+        cache.spare.erase(cache.spare.begin());
+    }
+    for (auto spare = cache.spare.begin(); spare != cache.spare.end(); ++spare) {
+        if (spare->first.size() != bytes) continue;
+        cache.spareBytes -= bytes;
+        std::vector<std::byte> taken = std::move(spare->first);
+        cache.spare.erase(spare);
+        return taken;
+    }
+    return {};
+}
+
 bool admitTexture(TextureCache& cache, const TextureKey& key, std::uint64_t incoming, std::uint64_t budget) {
     if (cache.bytes + incoming <= budget) return true;
     if (const auto now = std::chrono::steady_clock::now(); now - cache.passedSince >= std::chrono::seconds(1)) {
@@ -394,6 +425,8 @@ TextureCounters& TextureCounts() {
     return counters;
 }
 
+thread_local std::uint64_t sampledLookupKeyScans = 0;
+
 void reportTextureCounters() {
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
     if (!profile) return;
@@ -513,7 +546,7 @@ std::uint64_t DepthCopyMinBytes() {
 // they were when it failed (the allocation generation): pages committed later, or another surface
 // at the address, get a fresh attempt.
 struct StorageFailures {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::map<std::pair<std::uint64_t, std::uint64_t>, std::uint64_t> generations;
 };
 
@@ -570,26 +603,35 @@ std::uint64_t forcedCacheBudget() {
     return forced;
 }
 
-std::uint64_t storageBudget(const Context& context) {
+std::uint64_t storageBudget(const Context& context, std::uint64_t required = 0) {
     const auto forced = forcedCacheBudget();
     if (forced != 0) return forced;
     if (context.memoryProperties2 == nullptr || context.physical == VK_NULL_HANDLE) return TextureCacheBudget(context.memory);
     static struct {
-        std::mutex mutex;
+        AgcDriver::Mutex mutex;
         VkPhysicalDevice device{VK_NULL_HANDLE};
         std::chrono::steady_clock::time_point read{};
         std::uint64_t budget{0};
+        std::uint64_t ceiling{0};
     } cached;
     const auto now = std::chrono::steady_clock::now();
     std::lock_guard lock(cached.mutex);
-    if (cached.device == context.physical && now - cached.read < std::chrono::seconds(1)) return cached.budget;
-    VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
-    VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2};
-    properties.pNext = &reported;
-    context.memoryProperties2(context.physical, &properties);
-    cached.device = context.physical;
-    cached.read = now;
-    cached.budget = StorageTextureBudget(context.memory, &reported, SampledTextureMemory(), storageCacheBytes());
+    const auto read = [&] {
+        VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
+        VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2};
+        properties.pNext = &reported;
+        context.memoryProperties2(context.physical, &properties);
+        cached.device = context.physical;
+        cached.read = now;
+        cached.budget = StorageTextureBudget(context.memory, &reported, SampledTextureMemory(), storageCacheBytes());
+        cached.ceiling = cached.budget;
+        if (const auto heap = largestDeviceLocalHeap(context.memory); heap && reported.heapBudget[*heap] != 0) {
+            cached.ceiling = std::max<std::uint64_t>(512ull << 20u, std::min<std::uint64_t>(TextureCacheBudget(context.memory), reported.heapBudget[*heap] / 4u));
+        }
+    };
+    if (cached.device != context.physical || now - cached.read >= std::chrono::seconds(1)) read();
+    const auto needed = std::min(required, cached.ceiling);
+    if (needed > cached.budget && context.bufferPool != nullptr && context.bufferPool->ReclaimIdleDevice(needed - cached.budget, now) != 0) read();
     return cached.budget;
 }
 
@@ -604,7 +646,7 @@ std::uint64_t sampledBudget(const Context& context, TextureCache& cache) {
     context.memoryProperties2(context.physical, &properties);
     const auto sampled = SampledTextureMemory();
     const auto storage = storageCacheBytes();
-    const auto budget = SampledTextureBudget(context.memory, &reported, sampled + storage);
+    const auto budget = SampledTextureBudget(context.memory, &reported, sampled + storage, storage);
     const bool fresh = cache.budgetDevice != context.physical;
     const auto storageLimit = storageBudget(context);
     if (const auto heap = largestDeviceLocalHeap(context.memory); heap && (fresh || SampledBudgetReportDue(cache.reportedBudget, budget, now - cache.reportedAt) || SampledBudgetReportDue(cache.reportedStorage, storageLimit, now - cache.reportedAt))) {
@@ -682,6 +724,14 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
         logLookup({target.get(), resource, 0, DccKeys::Uncompressed, 0, nullptr, true});
         return target;
     }
+    if (resource.fmaskCmaskAddress != 0u) {
+        Require(!depthCompare, "FMASK depth comparison sampling is not implemented");
+        Require(resource.baseArray == 0u && resource.depthOrLastArray == 0u, "native FMASK array sampling is not implemented");
+        CompletePendingCpuWrites(context, resource.fmaskCmaskAddress, CmaskBytes(resource.width, resource.height));
+        auto native = MultisampleTargetFmaskTexture_nid_no_patch(context, resource, components);
+        Require(native != nullptr, "compressed FMASK sampling without a matching resident native target is not implemented");
+        return native;
+    }
     CaptureTrace::Log("sampled-lookup address=%llx width=%u height=%u dcc=%llx", static_cast<unsigned long long>(resource.baseAddress), resource.width, resource.height, static_cast<unsigned long long>(resource.dccAddress));
     RequireNoMultisampleTarget(resource.baseAddress, guestBytes != 0 ? static_cast<std::size_t>(guestBytes) : 1u, "a texture read");
     if (auto* recorder = Recorder::Active(); recorder != nullptr) recorder->BoundKeptBytes();
@@ -720,11 +770,14 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
     static const bool disabled = std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
     const bool profile = LookupOutcomes::Profiled();
     const auto start = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
+    std::optional<DccKeys> scanned;
     const auto scanKeys = [&] {
+        if (scanned.has_value()) return *scanned;
         const auto scanStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
-        const auto keys = TextureClearKeys(resource, guestBytes);
+        scanned = TextureClearKeys(resource, guestBytes);
+        if (resource.dccAddress != 0) ++sampledLookupKeyScans;
         if (profile && resource.dccAddress != 0) LookupOutcomes::Add(LookupOutcomes::DccScan, scanStart);
-        return keys;
+        return *scanned;
     };
     auto& counters = TextureCounts();
     const auto address = resource.baseAddress;
@@ -780,6 +833,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
             auto candidate = sampledStorageSource(context, resource, guestBytes);
             if (candidate != nullptr && candidate->Descriptor().dccAddress == resource.dccAddress) source = std::move(candidate);
         }
+        scanned.reset();
         // The lookup's Refresh may have flushed another image's results over the memory (which
         // marks the keys uncompressed): a surface that stays a snapshot re-reads them behind that
         // flush, as it does behind its own. APS5_NO_KEYS_RESCAN=1 keeps the keys scanned above.
@@ -795,15 +849,19 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
     if (source != nullptr && !GuestMemory::UnchangedSince(address, bytes, source->GenerationFor(address, bytes))) {
         // The CPU wrote the memory while results were pending: Refresh merges them the usual way.
         refreshForView(*source, resource);
+        scanned.reset();
     }
     // Results stored to guest memory just now are stamped newer than `generation`; a snapshot read
     // after them is current at the generation of a second (memoized) collect. The store marks the
     // surface's DCC keys uncompressed, so the keys are read after it.
     const auto flushStart = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
-    const auto observedKeys = keys.has_value() ? *keys : scanKeys();
-    const bool stagedClear = source != nullptr && resource.dccAddress != 0 && (IsDccClear(observedKeys) || observedKeys == DccKeys::ClearSingle);
+    const bool stagedClear = source != nullptr && resource.dccAddress != 0 && [&] {
+        const auto observedKeys = keys.has_value() ? *keys : scanKeys();
+        return IsDccClear(observedKeys) || observedKeys == DccKeys::ClearSingle;
+    }();
     bool stagedFlushed = false;
-    if ((source == nullptr || stagedClear) && !clearThroughKeys && StorageTexture::FlushPending(address, bytes, nullptr, "sampled texture")) {
+    const bool flushAsked = (source == nullptr || stagedClear) && !clearThroughKeys;
+    if (flushAsked && StorageTexture::FlushPending(address, bytes, nullptr, "sampled texture")) {
         if (profile) LookupOutcomes::Add(LookupOutcomes::PendingFlush, flushStart);
         generation = GuestMemory::CollectWrites(address, bytes);
         if (stagedClear) {
@@ -814,6 +872,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
         }
         if (stagedFlushed) source.reset();
     }
+    if (flushAsked) scanned.reset();
     if (!keys.has_value()) keys = scanKeys();
     if (disabled) {
         if (source != nullptr && depthCompare) {
@@ -856,6 +915,7 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
     std::lock_guard lock(cache.mutex);
     const CacheHold held(sampledCacheHeld);
     dropUncachedViews(cache);
+    std::vector<std::byte> recycled;
     if (auto it = findTexture(cache, key); it != cache.entries.end()) {
         if (it->source != nullptr) {
             // The view follows the storage image, whatever the GPU wrote to it since; guest memory
@@ -902,29 +962,37 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
                 return it->texture;
             }
         }
+        if (it->bytes.size() == bytes) recycled = std::move(it->bytes);
+        else parkSnapshot(cache, it->bytes);
         eraseTexture(cache, it);
         ++cache.counts.stale;
     }
-    CachedTexture entry{key, address, std::vector<std::byte>(source != nullptr ? 0u : bytes), nullptr, *keys, snapshotGeneration};
+    if (source != nullptr) parkSnapshot(cache, recycled);
+    else if (recycled.empty()) recycled = spareSnapshot(cache, bytes);
+    CachedTexture entry{key, address, source != nullptr ? std::vector<std::byte>{} : (recycled.empty() ? std::vector<std::byte>(bytes) : std::move(recycled)), nullptr, *keys, snapshotGeneration};
     entry.committed = std::move(committed);
     entry.surfaceBytes = bytes;
+    const auto createTexture = [&](auto&&... args) {
+        const CacheHold reclaimable(sampledCacheReclaimable);
+        return std::make_shared<Texture>(context, std::forward<decltype(args)>(args)...);
+    };
     if (source != nullptr) {
         entry.source = source;
         entry.sourceVersion = source->Version();
         if (depthCompare) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::DepthCopyTag{});
+            entry.texture = createTexture(source, resource, components, Texture::DepthCopyTag{});
             entry.texture->RefreshDepthCopy();
         } else if (blockCopy) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::BlockCopyTag{});
+            entry.texture = createTexture(source, resource, components, Texture::BlockCopyTag{});
             entry.texture->RefreshDepthCopy();
         } else if (IsRepackedTextureFormat(resource.format)) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::RepackCopyTag{});
+            entry.texture = createTexture(source, resource, components, Texture::RepackCopyTag{});
             entry.texture->RefreshDepthCopy();
         } else if (srgbExpand) {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components, Texture::SrgbExpandTag{});
+            entry.texture = createTexture(source, resource, components, Texture::SrgbExpandTag{});
             entry.texture->RefreshDepthCopy();
         } else {
-            entry.texture = std::make_shared<Texture>(context, source, resource, components);
+            entry.texture = createTexture(source, resource, components);
         }
         entry.accounted = source->Cached() ? 0u : heldBytes(*source);
         counters.fromStorage.fetch_add(1, std::memory_order_relaxed);
@@ -940,10 +1008,10 @@ std::shared_ptr<Texture> cachedTexture(const Context& context, std::span<const s
             for (std::size_t i = 0; i < entry.bytes.size(); i += 64) nonzero += entry.bytes[i] != std::byte{0};
             std::fprintf(stderr, "[texture] 0x%llx %ux%u format %u tile %d: %zu of %zu sampled bytes nonzero\n", static_cast<unsigned long long>(resource.baseAddress), resource.width, resource.height, resource.format, static_cast<int>(resource.tileMode), nonzero, entry.bytes.size() / 64);
         }
-        entry.texture = std::make_shared<Texture>(context, *context.detiler, resource, components, entry.bytes, depthCompare);
+        entry.texture = createTexture(*context.detiler, resource, components, entry.bytes, depthCompare);
         entry.accounted = entry.texture->AllocationBytes();
         constexpr std::size_t SnapshotCompareBytes = 256u << 10u;
-        if (entry.bytes.size() > SnapshotCompareBytes && (entry.generation != 0 || entry.untracked[0] != 0)) std::vector<std::byte>().swap(entry.bytes);
+        if (entry.bytes.size() > SnapshotCompareBytes && (entry.generation != 0 || entry.untracked[0] != 0)) parkSnapshot(cache, entry.bytes);
         counters.snapshots.fetch_add(1, std::memory_order_relaxed);
     }
     const auto budget = sampledBudget(context, cache);
@@ -992,7 +1060,7 @@ struct CachedStorageTexture {
 
 // As TextureCache: use order with a hash index by key, plus one by image for StorageImageCached.
 struct StorageTextureCache {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::list<CachedStorageTexture> entries;
     std::unordered_map<StorageKey, std::list<CachedStorageTexture>::iterator, StorageKeyHash> index;
     std::unordered_map<const StorageTexture*, std::list<CachedStorageTexture>::iterator> byImage;
@@ -1051,7 +1119,7 @@ std::array<std::uint32_t, 8> SurfaceKey(const Context& context, const GuestTextu
 }
 
 struct ExtendedSurfaces {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::map<std::array<std::uint32_t, 8>, std::uint32_t> levels;
     std::atomic<bool> any{false};
 };
@@ -1128,12 +1196,12 @@ std::shared_ptr<StorageTexture> cachedStorageTexture(const Context& context, std
             reportGuestAllocation(viewed, viewedBytes);
         }
     }
-    if (DepthPlanesStale() || written) static_cast<void>(FlushDepthPlanes(viewed.baseAddress, static_cast<std::size_t>(viewedBytes), written ? DepthPlaneScope::Whole : DepthPlaneScope::Overlapped));
+    static const bool disabled = std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
+    if ((DepthPlanesStale() || written) && (written || !layers || disabled)) static_cast<void>(FlushDepthPlanes(viewed.baseAddress, static_cast<std::size_t>(viewedBytes), written ? DepthPlaneScope::Whole : DepthPlaneScope::Overlapped));
     if (written && DepthSurfaceOverlaps(context.device, viewed.baseAddress, viewedBytes)) {
         const auto storage = WrittenStorageBytes(viewed, mip);
         RetireCoveredDepthSurfaces(context.device, storage.bytes, storage.extents);
     }
-    static const bool disabled = std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
     if (disabled) return StorageTexture::Create(context, *context.detiler, viewed, mip);
     static_cast<void>(words);
     if (auto* recorder = Recorder::Active(); recorder != nullptr) recorder->BoundKeptBytes();
@@ -1168,11 +1236,16 @@ std::shared_ptr<StorageTexture> cachedStorageTexture(const Context& context, std
         } else {
             if (guestBytes == 0) guestBytes = DescribeSurface(resource).guestBytes;
             if (StorageTexture::FlushPending(resource.baseAddress, static_cast<std::size_t>(guestBytes), nullptr, "storage image creation", PublishScope::None) && profile) start = LookupOutcomes::Add(LookupOutcomes::PendingFlush, start);
-            CachedStorageTexture entry{key, mip, StorageTexture::Create(context, *context.detiler, resource, mip)};
+            std::shared_ptr<StorageTexture> created;
+            {
+                const CacheHold reclaimable(storageCacheReclaimable);
+                created = StorageTexture::Create(context, *context.detiler, resource, mip);
+            }
+            CachedStorageTexture entry{key, mip, std::move(created)};
             static const bool keepNew = std::getenv("APS5_NO_KEEP_NEW_STORAGE") == nullptr;
             if (auto* recorder = Recorder::Active(); keepNew && recorder != nullptr && GuestMemory::GpuMutex().HeldByThisThread() && recorder->Recording()) recorder->Keep(entry.texture);
             entry.accounted = heldBytes(*entry.texture);
-            const auto budget = storageBudget(context);
+            const auto budget = storageBudget(context, cache.bytes + entry.accounted);
             while (!cache.entries.empty() && cache.bytes + entry.accounted > budget) evicted.push_back(evictStorage(cache, std::prev(cache.entries.end())));
             cache.bytes += entry.accounted;
             texture = entry.texture;
@@ -1216,16 +1289,16 @@ std::uint64_t StorageTextureBudget(const VkPhysicalDeviceMemoryProperties& memor
     const auto budget = reported->heapBudget[*heap];
     const auto usage = reported->heapUsage[*heap];
     const auto reserved = usage - std::min<std::uint64_t>(usage, sampledBytes + storageBytes) + sampledBytes + budget / 8u;
-    const auto cap = std::min<std::uint64_t>(TextureCacheBudget(memory), budget / 4u);
+    const auto cap = std::min<std::uint64_t>(memory.memoryHeaps[*heap].size / 2u, budget / 2u);
     return std::max<std::uint64_t>(512ull << 20u, std::min<std::uint64_t>(cap, budget > reserved ? budget - reserved : 0u));
 }
 
-std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes) {
+std::uint64_t SampledTextureBudget(const VkPhysicalDeviceMemoryProperties& memory, const VkPhysicalDeviceMemoryBudgetPropertiesEXT* reported, std::uint64_t textureBytes, std::uint64_t storageBytes) {
     const auto heap = largestDeviceLocalHeap(memory);
     if (reported == nullptr || !heap || reported->heapBudget[*heap] == 0) return TextureCacheBudget(memory);
     const auto budget = reported->heapBudget[*heap];
     const auto usage = reported->heapUsage[*heap];
-    const auto reserved = usage - std::min<std::uint64_t>(usage, textureBytes) + TextureCacheBudget(memory) + budget / 8u;
+    const auto reserved = usage - std::min<std::uint64_t>(usage, textureBytes) + std::max(TextureCacheBudget(memory), storageBytes) + budget / 8u;
     return std::max<std::uint64_t>(2048ull << 20u, budget > reserved ? budget - reserved : 0u);
 }
 
@@ -1254,6 +1327,8 @@ TextureCacheUse TextureCacheUsage() {
         dropUncachedViews(sampled);
         use.sampledEntries = sampled.entries.size();
         use.sampledBytes = sampled.bytes;
+        use.spareEntries = sampled.spare.size();
+        use.spareBytes = sampled.spareBytes;
     }
     use.storageBytes = storageCacheBytes();
     return use;
@@ -1283,6 +1358,7 @@ void FlushCachedTextures(VkDevice device) {
     GuestMemory::AssertGpuLockHeld("FlushCachedTextures");
     auto& cache = StorageTextures();
     std::lock_guard lock(cache.mutex);
+    const CacheHold held(storageCacheHeld);
     for (const auto& entry : cache.entries) {
         if (entry.key.device == device) entry.texture->Flush();
     }
@@ -1293,15 +1369,19 @@ void ClearCachedTextures(VkDevice device) {
     auto& sampled = Textures();
     {
         std::lock_guard lock(sampled.mutex);
+        const CacheHold held(sampledCacheHeld);
         for (auto it = sampled.entries.begin(); it != sampled.entries.end();) {
             if (it->key.device == device) eraseTexture(sampled, it++);
             else ++it;
         }
+        sampled.spare.clear();
+        sampled.spareBytes = 0;
     }
     auto& storage = StorageTextures();
     std::vector<std::shared_ptr<StorageTexture>> cleared;
     {
         std::lock_guard lock(storage.mutex);
+        const CacheHold held(storageCacheHeld);
         for (auto it = storage.entries.begin(); it != storage.entries.end();) {
             if (it->key.device != device) {
                 ++it;
@@ -1328,7 +1408,7 @@ void ClearCachedTextures(VkDevice device) {
     }
 }
 
-std::uint64_t ReleaseTextureCaches(std::uint64_t bytes) {
+std::uint64_t ReleaseTextureCaches(std::uint64_t bytes, bool newImage) {
     thread_local bool releasing = false;
     if (releasing) return 0;
     releasing = true;
@@ -1344,63 +1424,67 @@ std::uint64_t ReleaseTextureCaches(std::uint64_t bytes) {
     bool storageSkipped = false;
     {
         auto& cache = Textures();
-        if (sampledCacheHeld != 0 || !AcquireCache(cache.mutex)) {
+        std::unique_lock lock(cache.mutex, std::defer_lock);
+        const bool inherited = sampledCacheHeld != 0;
+        if ((inherited && (!newImage || sampledCacheReclaimable == 0)) || (!inherited && !lock.try_lock())) {
             sampledSkipped = true;
         } else {
-            std::lock_guard lock(cache.mutex, std::adopt_lock);
-            dropUncachedViews(cache);
-            while (freed < bytes && !cache.entries.empty()) {
-                const auto back = std::prev(cache.entries.end());
-                const auto accounted = back->accounted;
-                const bool last = back->texture.use_count() == 1;
-                eraseTexture(cache, back);
+            for (auto it = cache.entries.end(); it != cache.entries.begin() && freed < bytes;) {
+                --it;
+                if (it->texture.use_count() != 1 || (it->source != nullptr && it->source->Dirty())) continue;
+                const auto allocated = it->texture->AllocationBytes();
+                const auto sourceBytes = it->source != nullptr ? it->source->AllocationBytes() : 0u;
+                const std::weak_ptr<StorageTexture> source = it->source;
+                const auto next = std::next(it);
+                eraseTexture(cache, it);
                 ++cache.counts.evicted;
                 ++sampledEntries;
-                if (last) freed += accounted;
+                freed += allocated;
+                if (source.expired()) freed += sourceBytes;
+                it = next;
             }
         }
     }
     if (freed < bytes) {
         auto& cache = StorageTextures();
         std::unique_lock<GuestMemory::GpuMutexType> gpu(GuestMemory::GpuMutex(), std::defer_lock);
-        if (storageCacheHeld != 0 || !gpu.try_lock()) {
+        const bool inherited = storageCacheHeld != 0;
+        if ((inherited && (!newImage || storageCacheReclaimable == 0)) || !gpu.try_lock()) {
             storageSkipped = true;
         } else {
             try {
                 while (freed < bytes) {
-                    std::vector<std::pair<std::shared_ptr<StorageTexture>, std::uint64_t>> evicted;
+                    std::shared_ptr<StorageTexture> image;
                     {
-                        if (!AcquireCache(cache.mutex)) {
+                        std::unique_lock lock(cache.mutex, std::defer_lock);
+                        if (!inherited && !lock.try_lock()) {
                             storageSkipped = true;
                             break;
                         }
-                        std::lock_guard lock(cache.mutex, std::adopt_lock);
-                        std::uint64_t batch = 0;
                         storageKept = 0;
-                        for (auto it = cache.entries.end(); it != cache.entries.begin() && batch + freed < bytes;) {
+                        for (auto it = cache.entries.end(); it != cache.entries.begin();) {
                             --it;
                             if (it->texture->Dirty()) {
                                 ++storageKept;
                                 continue;
                             }
-                            const auto accounted = it->accounted;
-                            const auto next = std::next(it);
-                            evicted.emplace_back(evictStorage(cache, it), accounted);
-                            batch += accounted;
-                            it = next;
+                            image = evictStorage(cache, it);
+                            break;
                         }
-                        if (evicted.empty()) break;
+                        if (image == nullptr) break;
                     }
-                    for (auto& [image, accounted] : evicted) {
-                        std::vector<std::shared_ptr<ShaderResources>> resources;
-                        SharedResourceCache().RemoveImage(image.get(), &resources);
-                        if (auto* recorder = Recorder::Active(); recorder != nullptr && recorder->Recording()) {
-                            for (auto& resource : resources) recorder->Keep(std::move(resource));
-                        }
-                        resources.clear();
-                        ++storageEntries;
-                        if (image.use_count() == 1) freed += accounted;
-                        image.reset();
+                    std::vector<std::shared_ptr<ShaderResources>> resources;
+                    const bool removed = SharedResourceCache().TryRemoveImage(image.get(), &resources);
+                    if (auto* recorder = Recorder::Active(); recorder != nullptr && recorder->Recording()) {
+                        for (auto& resource : resources) recorder->Keep(std::move(resource));
+                    }
+                    resources.clear();
+                    ++storageEntries;
+                    if (image.use_count() == 1) freed += image->AllocationBytes();
+                    image.reset();
+                    if (!removed) {
+                        storageSkipped = true;
+                        break;
                     }
                 }
             } catch (const std::exception& error) {
@@ -1537,6 +1621,11 @@ ShaderResources::ShaderResources(const Context& context, const CompiledShader& c
     // Every use of a compute build is a recorded dispatch that calls MarkGpuWrites, which staged
     // buffers need (a synchronous draw's use would not).
     guestMemory.AllowDeviceStaging();
+    static const std::uint64_t addressStagingMinThreads = [] {
+        const char* value = std::getenv("APS5_BDA_STAGING_MIN_THREADS");
+        return value != nullptr ? std::strtoull(value, nullptr, 10) : 512ull;
+    }();
+    if (dispatchThreads != 0 && dispatchThreads < addressStagingMinThreads) guestMemory.DisallowAddressStaging();
     const std::span<const CompiledShader> shaders(&deferredCompute, 1);
     if (!deferred) {
         prepareAddressBindings(shaders, snapshots);
@@ -1623,7 +1712,7 @@ constexpr std::size_t BuildPhaseCount = static_cast<std::size_t>(ShaderResources
 constexpr std::array<const char*, BuildPhaseCount> BuildPhaseNames{"bindings", "precollect", "guest memory upload", "descriptors", "stage A", "images", "bda", "stage B"};
 
 struct BuildProfile {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::array<double, BuildPhaseCount> ms{};
     std::uint64_t builds = 0;
 };
@@ -2356,7 +2445,7 @@ void ShaderResources::buildComplete() {
                         for (auto element = first; element < last; ++element) {
                             const auto index = binding.imageAllocations[element];
                             if (binding.layout.descriptorType == VK_DESCRIPTOR_TYPE_SAMPLER) images.push_back({samplers[index]->Handle(), VK_NULL_HANDLE, VK_IMAGE_LAYOUT_UNDEFINED});
-                            else if (binding.layout.descriptorType == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE) images.push_back({VK_NULL_HANDLE, storageTextures[index]->StorageView(storageMips[index], storageFirstLayer[index]), VK_IMAGE_LAYOUT_GENERAL});
+                            else if (binding.layout.descriptorType == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE) images.push_back({VK_NULL_HANDLE, storageAtomic[index] ? storageTextures[index]->AtomicView(storageMips[index], storageFirstLayer[index]) : storageTextures[index]->StorageView(storageMips[index], storageFirstLayer[index]), VK_IMAGE_LAYOUT_GENERAL});
                             else images.push_back({VK_NULL_HANDLE, textureFirstLayer[index] ? textures[index]->FirstLayerView() : textures[index]->View(), textures[index]->Layout()});
                         }
                         if (recorded) runs.emplace_back(write.dstArrayElement, write.descriptorCount);
@@ -2544,7 +2633,7 @@ bool ShaderResources::NeverReusable(std::span<const CompiledShader> shaders) {
 
 // APS5_PROFILE_DRAW: the per-device descriptor caches' counters, every 10 s.
 void ShaderResources::reportDescriptorCaches() const {
-    static std::mutex reportMutex;
+    static AgcDriver::Mutex reportMutex;
     static auto lastReport = std::chrono::steady_clock::now();
     const auto now = std::chrono::steady_clock::now();
     std::lock_guard lock(reportMutex);
@@ -2896,21 +2985,57 @@ bool TemplateAuditDue(std::chrono::steady_clock::time_point last) {
 
 }
 
+void LastRecordIndices(std::span<const void* const> logged, std::span<const void* const> objects, std::vector<std::size_t>& indices) {
+    indices.assign(objects.size(), logged.size());
+    thread_local std::vector<std::pair<const void*, std::size_t>>* wantedSlot = nullptr;
+    auto& wanted = ShaderRecompiler::ThreadOwned(wantedSlot);
+    wanted.clear();
+    for (std::size_t i = 0; i < objects.size(); ++i) wanted.emplace_back(objects[i], i);
+    const auto byObject = [](const std::pair<const void*, std::size_t>& left, const std::pair<const void*, std::size_t>& right) { return std::less<const void*>{}(left.first, right.first); };
+    std::sort(wanted.begin(), wanted.end(), byObject);
+    std::size_t open = wanted.size();
+    for (auto at = logged.size(); at-- > 0 && open != 0;) {
+        const auto [first, last] = std::equal_range(wanted.begin(), wanted.end(), std::pair<const void*, std::size_t>{logged[at], 0}, byObject);
+        if (first == last || indices[first->second] != logged.size()) continue;
+        for (auto it = first; it != last; ++it) indices[it->second] = at;
+        open -= static_cast<std::size_t>(last - first);
+    }
+    if (wanted.capacity() > LookupLogBound + LookupLogBound / 2) {
+        wanted.clear();
+        wanted.shrink_to_fit();
+    }
+}
+
 // Turns the lookups' records into this object's per-texture validation records (see
 // ValidatedSurface); the last record of an object is the freshest.
 void ShaderResources::captureValidation() {
-    const auto record = [](const void* object) -> const LookupRecord* {
-        const auto& log = lookupLog();
-        for (auto it = log.rbegin(); it != log.rend(); ++it) {
-            if (it->object == object) return &*it;
-        }
-        return nullptr;
-    };
+    const auto& log = lookupLog();
+    thread_local std::vector<const void*>* loggedSlot = nullptr;
+    auto& logged = ShaderRecompiler::ThreadOwned(loggedSlot);
+    thread_local std::vector<const void*>* objectsSlot = nullptr;
+    auto& objects = ShaderRecompiler::ThreadOwned(objectsSlot);
+    thread_local std::vector<std::size_t>* indicesSlot = nullptr;
+    auto& indices = ShaderRecompiler::ThreadOwned(indicesSlot);
+    logged.clear();
+    for (const auto& entry : log) logged.push_back(entry.object);
+    objects.clear();
+    for (const auto& texture : textures) objects.push_back(texture.get());
+    LastRecordIndices(logged, objects, indices);
     validatedTextures.assign(textures.size(), {});
     for (std::size_t i = 0; i < textures.size(); ++i) {
-        if (const auto* found = record(textures[i].get())) validatedTextures[i] = {found->resource, found->bytes, found->keys, found->generation, 0, found->source, found->depth, true};
+        if (indices[i] == log.size()) continue;
+        const auto& found = log[indices[i]];
+        validatedTextures[i] = {found.resource, found.bytes, found.keys, found.generation, 0, found.source, found.depth, true};
     }
     lookupLog().clear();
+    const auto trim = [](auto& scratch) {
+        if (scratch.capacity() <= LookupLogBound + LookupLogBound / 2) return;
+        scratch.clear();
+        scratch.shrink_to_fit();
+    };
+    trim(logged);
+    trim(objects);
+    trim(indices);
 }
 
 std::size_t ShaderResources::LookupLogCapacity() {
@@ -3243,6 +3368,11 @@ ShaderResources::OwnRefreshFallback ShaderResources::refreshOwnObjects(std::span
     return OwnRefreshFallback::Count;
 }
 
+bool AnyPendingCpuWrites(const Context& context) {
+    if (Recorder::InCompletion() || Recorder::Active() == nullptr) return false;
+    return (context.copiedWriters != nullptr && !context.copiedWriters->empty()) || !DrawCopiedWriters()->empty() || Recorder::PendingCompletionLabels() != 0;
+}
+
 bool CompletePendingCpuWrites(const Context& context, std::uint64_t address, std::size_t bytes) {
     if (bytes == 0 || Recorder::InCompletion()) return false;
     auto* recorder = Recorder::Active();
@@ -3272,7 +3402,54 @@ const ShaderRecompiler::DescriptorBinding* ShaderResources::tableImages(std::spa
     return nullptr;
 }
 
+bool ShaderResources::EpochProofs() {
+    return DrawPipelineEnabled();
+}
+
+namespace {
+void noteEpochProof(bool reused, bool verified, bool failed) {
+    static std::atomic<std::uint64_t> reuses{0}, proofs{0}, checks{0}, failures{0};
+    if (verified) checks.fetch_add(1, std::memory_order_relaxed);
+    if (failed) failures.fetch_add(1, std::memory_order_relaxed);
+    const auto count = (reused ? reuses : proofs).fetch_add(1, std::memory_order_relaxed) + 1u;
+    static const bool report = std::getenv("APS5_PROFILE_DRAW") != nullptr || std::getenv("APS5_VERIFY_DRAW_PIPELINE") != nullptr;
+    if (!report) return;
+    if (count % 262144u == 0u || (count & (count - 1u)) == 0u) std::fprintf(stderr, "[epoch-proofs] resource proofs: %llu reused the epoch's, %llu proved; verify: %llu checked, %llu failed; storage refreshes reused %llu\n", static_cast<unsigned long long>(reuses.load()), static_cast<unsigned long long>(proofs.load()), static_cast<unsigned long long>(checks.load()), static_cast<unsigned long long>(failures.load()), static_cast<unsigned long long>(StorageTexture::epochRefreshes.load()));
+}
+}
+
 bool ShaderResources::Revalidate(std::span<const CompiledShader> shaders, ProofReport* report) {
+    if (EpochProofs()) {
+        const auto epoch = GuestMemory::CollectEpoch();
+        const auto proof = GuestMemory::ProofSerial();
+        const auto pending = StorageTexture::PendingSerial();
+        if (epoch != 0 && provedEpoch == epoch && provedProof == proof && provedPending == pending) {
+            static const bool verify = std::getenv("APS5_VERIFY_DRAW_PIPELINE") != nullptr;
+            thread_local std::uint64_t reuses = 0;
+            if (verify && ++reuses % 64u == 0u) {
+                const bool ok = revalidateFull(shaders, report);
+                noteEpochProof(true, true, !ok);
+                return ok;
+            }
+            if (report != nullptr) *report = {ProofPath::Full, ProofFailure::None};
+            noteEpochProof(true, false, false);
+            return true;
+        }
+        const bool ok = revalidateFull(shaders, report);
+        noteEpochProof(false, false, false);
+        if (ok) {
+            provedEpoch = epoch;
+            provedProof = proof;
+            provedPending = pending;
+        } else {
+            provedEpoch = 0;
+        }
+        return ok;
+    }
+    return revalidateFull(shaders, report);
+}
+
+bool ShaderResources::revalidateFull(std::span<const CompiledShader> shaders, ProofReport* report) {
     if (report != nullptr) *report = {ProofPath::Full, ProofFailure::Other};
     if (!reusable || shaders.empty()) return false;
     static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
@@ -3543,7 +3720,7 @@ struct ChurnCounts {
 
 // Dispatch keys and draw keys are counted apart: what churns a draw's key decides the draw steps.
 struct ChurnProfile {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::unordered_map<std::uint64_t, ResourceCache::Key> lastByVariant;
     ChurnCounts dispatch;
     ChurnCounts draws;
@@ -3844,6 +4021,17 @@ void ResourceCache::Remove(const Key& key, const ShaderResources* object) {
 
 void ResourceCache::RemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted) {
     std::lock_guard lock(mutex);
+    removeImage(image, evicted);
+}
+
+bool ResourceCache::TryRemoveImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted) {
+    std::unique_lock lock(mutex, std::try_to_lock);
+    if (!lock.owns_lock()) return false;
+    removeImage(image, evicted);
+    return true;
+}
+
+void ResourceCache::removeImage(const StorageTexture* image, std::vector<std::shared_ptr<ShaderResources>>* evicted) {
     for (auto it = entries.begin(); it != entries.end();) {
         if (!it->second->ReadsImage(image)) {
             ++it;
@@ -4649,18 +4837,23 @@ void ShaderResources::resolveImageBinding(const ShaderRecompiler::DescriptorBind
             const bool depthCompare = !binding.imageDepthCompare.empty() && binding.imageDepthCompare.at(element);
             const bool firstLayer = binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2D && (resource.dimension == TextureDimension::k2DArray || (depthCompare && resource.dimension == TextureDimension::k1DArray));
             const bool depth1D = depthCompare && ((binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2D && resource.dimension == TextureDimension::k1D) || (binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2DArray && resource.dimension == TextureDimension::k1DArray));
-            if (!firstLayer && !depth1D && !MatchesGuestDimension(*binding.imageShape, resource.dimension)) throw std::runtime_error("AGC graphics: guest texture dimension disagrees with the shader's declared image shape (shape " + std::to_string(static_cast<int>(*binding.imageShape)) + ", dimension " + std::to_string(static_cast<int>(resource.dimension)) + ")");
+            const bool firstSample = binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2D && resource.dimension == TextureDimension::k2DMsaa;
+            if (!firstLayer && !depth1D && !firstSample && !MatchesGuestDimension(*binding.imageShape, resource.dimension)) throw std::runtime_error("AGC graphics: guest texture dimension disagrees with the shader's declared image shape (shape " + std::to_string(static_cast<int>(*binding.imageShape)) + ", dimension " + std::to_string(static_cast<int>(resource.dimension)) + ")");
             const VkComponentMapping components = ViewComponents(resource);
             const auto guestBytes = record != nullptr && record->decoded ? record->guestBytes : DescribeSurface(resource).guestBytes;
             CompletePendingCpuWrites(context, resource.baseAddress, static_cast<std::size_t>(guestBytes));
             if (resource.dccAddress != 0) CompletePendingCpuWrites(context, resource.dccAddress, DccKeyBytes(guestBytes));
             std::shared_ptr<Texture> texture;
             const VkImageViewType multisampleViewType = binding.imageShape == ShaderRecompiler::DescriptorImageShape::Image2DMultisampleArray ? VK_IMAGE_VIEW_TYPE_2D_ARRAY : VK_IMAGE_VIEW_TYPE_2D;
-            if (previousSampled.texture != nullptr && previousSampled.depthCompare == depthCompare && previousSampled.multisampleViewType == multisampleViewType && words.size() == 8 && std::equal(words.begin(), words.end(), previousSampled.words.begin())) texture = previousSampled.texture;
-            if (texture == nullptr && record != nullptr && record->texture != nullptr) {
+            if (previousSampled.texture != nullptr && previousSampled.depthCompare == depthCompare && previousSampled.multisampleViewType == multisampleViewType && previousSampled.firstSample == firstSample && words.size() == 8 && std::equal(words.begin(), words.end(), previousSampled.words.begin())) texture = previousSampled.texture;
+            if (texture == nullptr && !firstSample && record != nullptr && record->texture != nullptr) {
                 texture = fastTexture(*record);
                 (texture != nullptr ? counters.fastHits : counters.fastMisses).fetch_add(1, std::memory_order_relaxed);
             }
+            if (texture == nullptr && firstSample) {
+                Require(!depthCompare && !DepthSurfaceAt(resource.baseAddress), "reading sample 0 of a multisampled depth surface through a 2D image is not implemented");
+                texture = MultisampleTargetFirstSample(context, resource, components);
+            }
             if (texture == nullptr) texture = cachedTexture(context, words, resource, components, guestBytes, depthCompare, multisampleViewType);
             if (resource.dimension == TextureDimension::k2DMsaa) multisampleSources.push_back(resource.baseAddress);
             bool baseLevel = false;
@@ -4688,6 +4881,7 @@ void ShaderResources::resolveImageBinding(const ShaderRecompiler::DescriptorBind
                 std::copy(words.begin(), words.end(), previousSampled.words.begin());
                 previousSampled.depthCompare = depthCompare;
                 previousSampled.multisampleViewType = multisampleViewType;
+                previousSampled.firstSample = firstSample;
                 previousSampled.texture = texture;
             }
             textures.push_back(std::move(texture));
@@ -5032,7 +5226,7 @@ void ShaderResources::resolveImageTables() {
                 storageKeys.push_back(resource.dccAddress);
                 storageFirstLayer.push_back(firstLayer);
                 storageWritten.push_back(true);
-                storageAtomic.push_back(false);
+                storageAtomic.push_back(element < binding.imageAtomic.size() && binding.imageAtomic[element]);
                 storageAtomic64.push_back(false);
                 describedRanges.push_back({"storage", resource.baseAddress, guestBytes, resource.width, resource.height, resource.format, static_cast<int>(resource.tileMode), resource.dccAddress, true});
                 bindings[storageBinding].imageAllocations[absolute] = storageTextures.size() - 1u;
@@ -5091,6 +5285,10 @@ void ShaderResources::resolveImageTables() {
     reportTextureCounters();
 }
 
+std::uint64_t SampledLookupKeyScans() {
+    return sampledLookupKeyScans;
+}
+
 ImageTableReuseCounts ImageTableReuses() {
     const auto& counters = TextureCounts();
     return {counters.tablesReused.load(std::memory_order_relaxed) + counters.tablesReplayed.load(std::memory_order_relaxed), counters.tablesResolved.load(std::memory_order_relaxed), counters.tablesReplayed.load(std::memory_order_relaxed), counters.tableWritesKept.load(std::memory_order_relaxed), counters.tableWritesMade.load(std::memory_order_relaxed)};
@@ -5473,8 +5671,9 @@ std::shared_ptr<ShaderResources::DrawBindings> ShaderResources::PrepareDrawBindi
         if (verifySnapshots && buffer != nullptr) {
             static std::atomic<std::uint64_t> checked{0}, differing{0};
             const auto fast = buffer->Bytes().subspan(static_cast<std::size_t>(offset), bytes);
-            const auto slow = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, GuestMemory::CollectWrites(begin, bytes));
-            const bool same = slow == buffer || (slow != nullptr && slow->Bytes().size() == fast.size() && std::memcmp(slow->Bytes().data(), fast.data(), fast.size()) == 0) || (slow == nullptr && std::memcmp(fast.data(), reinterpret_cast<const void*>(begin), bytes) == 0);
+            VkDeviceSize slowOffset = 0;
+            const auto slow = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, GuestMemory::CollectWrites(begin, bytes), &slowOffset);
+            const bool same = (slow == buffer && slowOffset == offset) || (slow != nullptr && slow->Bytes().size() >= slowOffset + fast.size() && std::memcmp(slow->Bytes().data() + slowOffset, fast.data(), fast.size()) == 0) || (slow == nullptr && std::memcmp(fast.data(), reinterpret_cast<const void*>(begin), bytes) == 0);
             if (!same) differing.fetch_add(1);
             if (checked.fetch_add(1) % 200000 == 199999) std::fprintf(stderr, "[draw-snapshots] verify: %llu fast answers checked, %llu differing%c", static_cast<unsigned long long>(checked.load()), static_cast<unsigned long long>(differing.load()), 10);
         }
@@ -5487,7 +5686,7 @@ std::shared_ptr<ShaderResources::DrawBindings> ShaderResources::PrepareDrawBindi
                 offset = slice.offset;
             } else {
                 const auto generation = GuestMemory::CollectWrites(begin, bytes);
-                buffer = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, generation);
+                buffer = recorder.ReusableDrawSnapshot(begin, bytes, Recorder::SnapshotUse::Storage, nullptr, generation, &offset);
                 if (buffer == nullptr) {
                     buffer = std::make_shared<Buffer>(context, bytes, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT);
                     std::memcpy(buffer->Bytes().data(), reinterpret_cast<const void*>(begin), bytes);
@@ -5586,6 +5785,7 @@ void ShaderResources::WriteBack() {
     } catch (const BdaUnalignedAccess&) {
         unaligned = std::current_exception();
     }
+    if (!guestMemory.Writes().empty() || std::find(storageWritten.begin(), storageWritten.end(), true) != storageWritten.end() || (usesBda && !bdaReadOnly)) GuestMemory::BreakProofs();
     if (!SkipWriteBack()) {
         for (std::size_t index = 0; index < storageTextures.size(); ++index) {
             if (!storageWritten[index] || storageTextures[index] == nullptr) continue;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp
index f9912af9f9..7dd97e4370 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderValidation.cpp
@@ -1,4 +1,5 @@
 #include "BdaAbi.hpp"
+#include "SpirvBackend/SpirvAnalysis.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Pipeline.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PipelineSpecialization.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/VertexInput.hpp"
@@ -53,6 +54,8 @@ struct Module {
     bool layerOutput = false;
     bool meshCapability = false;
     std::uint32_t primitiveInputs = 0;
+    bool pointSizeOutput = false;
+    bool pointSize = false;
     std::map<std::uint32_t, std::vector<std::uint32_t>> modes;
 
     const std::vector<std::uint32_t>& Type(std::uint32_t id) const {
@@ -138,6 +141,10 @@ struct Module {
                 Require(input && (clipInput || (value == spv::BuiltInPosition && signature == "f32x4") || (value == spv::BuiltInTessCoord && stage == Stage::TessellationEvaluation && signature == "f32x3") || ((value == spv::BuiltInInvocationId || value == spv::BuiltInPrimitiveId || value == spv::BuiltInPatchVertices) && (signature == "i32" || signature == "u32"))), "unsupported tessellation built-in");
                 return;
             }
+            if (!input && value == spv::BuiltInPointSize && pointSizeOutput && signature == "f32" && !pointSize) {
+                pointSize = true;
+                return;
+            }
             if (!input && value == spv::BuiltInPrimitivePointIndicesEXT) primitiveIndices = 1u;
             if (!input && value == spv::BuiltInPrimitiveLineIndicesEXT) primitiveIndices = 2u;
             if (!input && value == spv::BuiltInPrimitiveTriangleIndicesEXT) primitiveIndices = 3u;
@@ -149,6 +156,10 @@ struct Module {
             Require((value == spv::BuiltInVertexIndex || value == spv::BuiltInInstanceIndex || value == spv::BuiltInBaseInstance) && signature == "i32", "unsupported vertex built-in input");
         } else if (vertex && storage == spv::StorageClassOutput) {
             if (value == spv::BuiltInLayer && layerOutput && (signature == "u32" || signature == "i32")) return;
+            if (value == spv::BuiltInPointSize && pointSizeOutput && signature == "f32" && !pointSize) {
+                pointSize = true;
+                return;
+            }
             Require(value == spv::BuiltInPosition && signature == "f32x4" && !position, "unsupported or duplicate vertex built-in output");
             position = true;
         } else {
@@ -186,6 +197,7 @@ Module Inspect(const CompiledShader& compiled, const State& state, const VkPhysi
     Require(words[4] == 0, "unsupported SPIR-V schema: " + std::to_string(words[4]));
 
     Module module;
+    module.pointSizeOutput = (state.vertexPoints && stage == Stage::Vertex) || (mesh && state.stages.mesh.has_value() && state.stages.mesh->outputPrimitiveSize == 1u);
     std::uint32_t entries = 0;
     std::uint32_t memoryModels = 0;
     std::uint32_t entryPoint = 0;
@@ -583,6 +595,10 @@ Module Inspect(const CompiledShader& compiled, const State& state, const VkPhysi
         } else {
             Require(variable.storage == spv::StorageClassStorageBuffer && decoration.set && decoration.binding, "unsupported or unbound shader resource");
             const auto key = std::make_pair(*decoration.set, *decoration.binding);
+            if (*decoration.set == ShaderRecompiler::PixelFunctionLdsDescriptorSet) {
+                Require(fragment && *decoration.binding == 0u, "pixel function LDS buffer binding is wrong");
+                continue;
+            }
             const auto binding = std::find_if(shader.bindings.begin(), shader.bindings.end(), [&](const auto& item) { return item.descriptorSet == key.first && item.binding == key.second; });
             const bool array = binding != shader.bindings.end() && binding->role == ShaderRecompiler::DescriptorRole::GuestBuffers;
             const auto [view, first] = bufferViews.emplace(key, decoration.aliased);
@@ -659,7 +675,7 @@ std::set<std::uint32_t> ValidateShaders(std::span<const CompiledShader> shaders,
     const bool geometry = state.stages.path == ShaderPath::Vertex && !state.rectList && shaders.size() == 3u;
     const bool patches = BarycentricPatches(state, shaders) && shaders.back().program != nullptr && shaders.back().program->barycentricEmulation.active;
     Require(geometry || shaders.size() == (tessellation || state.rectList || patches ? 4u : 2u), "incorrect graphics stage count");
-    if (patches) Require(state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST, "emulated barycentrics through tessellation require a triangle list");
+    if (patches) Require(state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST || state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP, "emulated barycentrics through tessellation require a triangle list or strip");
     if (geometry) {
         Require(shaders.back().program != nullptr && shaders.back().program->barycentricEmulation.active, "a geometry stage is generated only for emulated barycentrics");
         Require(state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST || state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP || state.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN, "emulated barycentrics require triangle primitives");
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
index 44bc19a7d6..de94232f92 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
@@ -190,6 +190,37 @@ std::uint32_t inactiveVertexPointSize(const QueueState& queue) {
     }
 }
 
+bool pointOutput(const QueueState& queue) {
+    const auto stages = find(queue.context, 0x2d5);
+    const auto primitive = find(queue.userConfig, 0x242, RegisterBank::UserConfig);
+    if (stages == queue.context.end()) return false;
+    if ((stages->second & 0x24u) == 0) return primitive != queue.userConfig.end() && primitive->second == 1u;
+    const auto output = find(queue.context, 0x29b);
+    return (stages->second & 0x24u) == 0x20u && output != queue.context.end() && output->second == 0u;
+}
+
+void decodePointSize(const QueueState& queue, State& result) {
+    const auto& cx = queue.context;
+    const auto size = read(cx, 0x280);
+    const auto limits = read(cx, 0x281);
+    const bool fromVertex = (result.paClVsOutCntl & (1u << 16u)) != 0;
+    Require(!fromVertex || (result.paClVsOutCntl & (1u << 21u)) != 0, "USE_VTX_POINT_SIZE without VS_OUT_MISC_VEC_ENA is unsupported");
+    Require(fromVertex || (size & 0xffffu) == size >> 16u, "points whose PA_SU_POINT_SIZE width and height differ are unsupported");
+    Require(fromVertex || (size & 0xffffu) != 0, "points of size 0 (PA_SU_POINT_SIZE 0) are unsupported");
+    Require((limits & 0xffffu) <= limits >> 16u, "PA_SU_POINT_MINMAX with a minimum above its maximum is unsupported");
+    Require(!fromVertex || (limits >> 16u) != 0, "a vertex point size clamped to 0 (PA_SU_POINT_MINMAX maximum 0) is unsupported");
+    result.pointSize = static_cast<float>(size & 0xffffu) / 8.0f;
+    result.pointSizeMin = static_cast<float>(limits & 0xffffu) / 8.0f;
+    result.pointSizeMax = static_cast<float>(limits >> 16u) / 8.0f;
+    const auto interpolation = find(cx, 0x1b5);
+    const auto inputs = find(cx, 0x1b6);
+    if (interpolation == cx.end() || (interpolation->second & 2u) == 0 || inputs == cx.end()) return;
+    for (std::uint32_t input = 0; input < (inputs->second & 0x3fu); ++input) {
+        const auto control = find(cx, 0x191 + input);
+        Require(control == cx.end() || (control->second & 0x820000u) == 0, "point sprite texture coordinates (SPI_PS_INPUT_CNTL PT_SPRITE_TEX) are not implemented");
+    }
+}
+
 constexpr std::uint32_t DepthControlMask = ~0x007007f0u;
 // EXEC_ON_HIER_FAIL / EXEC_ON_NOOP / EXEC_IF_OVERLAPPED (bits 9, 10, 17) only force the pixel shader
 // to run, which it always does here.
@@ -351,30 +382,19 @@ VkStencilOpState stencilFace(std::uint32_t compare, std::uint32_t ops, std::uint
     return face;
 }
 
-void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValExport, bool opValExport, State& result) {
-    const bool opValReference = opValExport && StencilOperationValueReplaces(cx);
-    zero(cx, 0x000, 0x0000101cu, "depth copy, resummarize or decompress draws (DB_RENDER_CONTROL)");
-    const bool depthClear = (read(cx, 0x000) & 1u) != 0;
-    const bool stencilClear = (read(cx, 0x000) & 2u) != 0;
-    const auto view = read(cx, 0x002);
-    zero(cx, 0x010, 0x00001000u, "partially resident depth (DB_Z_INFO)");
+DepthTarget decodeDepthPlane(const Registers& cx) {
+    const auto viewRegister = find(cx, 0x002);
+    const auto view = viewRegister == cx.end() ? 0u : viewRegister->second;
     const auto viewMip = (view >> 26u) & 0xfu;
     const auto maxMip = (read(cx, 0x010) >> 16u) & 0xfu;
-    zero(cx, 0x011, 0x00001000u, "partially resident stencil (DB_STENCIL_INFO)");
     const auto zFormat = read(cx, 0x010) & 3u;
-    const bool stencil = (read(cx, 0x011) & 1u) != 0;
-    Require(zFormat != 2, "Z_24 depth is unsupported");
-    if (zFormat == 0) depthControl &= ~6u;
-    if (!stencil) depthControl &= ~1u;
+    const auto stencilRegister = find(cx, 0x011);
+    const auto stencilInfo = stencilRegister == cx.end() ? 0u : stencilRegister->second;
+    const bool stencil = (stencilInfo & 1u) != 0;
     const auto base = [&](std::uint32_t low, std::uint32_t highOffset) {
         const auto high = find(cx, highOffset);
         return (high == cx.end() ? 0ull : static_cast<std::uint64_t>(high->second & 0xffu) << 40u) | (static_cast<std::uint64_t>(read(cx, low)) << 8u);
     };
-    const bool depthReadOnly = (view & 0x01000000u) != 0;
-    const bool stencilReadOnly = (view & 0x02000000u) != 0;
-    Require(!stencilClear || (stencil && !stencilReadOnly), "stencil clear requires a writable stencil plane");
-    Require(!stencilClear || !testValExport, "stencil clear with a pixel shader that exports the stencil test value is unsupported");
-    Require(!depthClear || (zFormat != 0 && !depthReadOnly), "depth clear requires a writable depth plane");
     DepthTarget depth{};
     depth.samples = 1u << ((read(cx, 0x010) >> 2u) & 3u);
     depth.depthSwizzle = (read(cx, 0x010) >> 4u) & 31u;
@@ -383,9 +403,6 @@ void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValEx
     depth.lastSlice = (view >> 13u) & 0x7ffu;
     depth.address = zFormat != 0 ? base(0x012, 0x01a) : 0;
     depth.stencilAddress = stencil ? base(0x013, 0x01b) : 0;
-    const bool depthWritten = zFormat != 0 && !depthReadOnly && (depthClear || (depthControl & 6u) == 6u || (read(cx, 0x000) & 0x60u) != 0);
-    Require(!depthWritten || base(0x014, 0x01c) == depth.address, "depth read and written at different addresses is unsupported");
-    Require(!stencil || stencilReadOnly || base(0x015, 0x01d) == depth.stencilAddress, "stencil read and written at different addresses is unsupported");
     if (depth.samples != 1u) {
         depth.pipeBankXor = static_cast<std::uint32_t>(depth.address & 65535u);
         depth.address &= ~std::uint64_t{65535u};
@@ -422,13 +439,44 @@ void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValEx
         if (depth.stencilAddress != 0) depth.stencilAddress += static_cast<std::uint64_t>(slice) * DepthSliceBytes(depth.extent, 1u);
     }
     depth.format = zFormat == 1 ? (stencil ? VK_FORMAT_D16_UNORM_S8_UINT : VK_FORMAT_D16_UNORM) : (stencil ? VK_FORMAT_D32_SFLOAT_S8_UINT : VK_FORMAT_D32_SFLOAT);
-    depth.clearDepth = readFloat(cx, 0x00b);
-    depth.clearStencil = static_cast<std::uint8_t>(read(cx, 0x00a) & 0xffu);
-    depth.htileDepthOnly = (read(cx, 0x011) & (1u << 29u)) != 0u;
+    depth.htileDepthOnly = (stencilInfo & (1u << 29u)) != 0u;
     if (const auto htile = find(cx, 0x005); zFormat != 0 && htile != cx.end() && htile->second != 0 && (read(cx, 0x010) & (1u << 29u)) != 0) {
         depth.htileAddress = base(0x005, 0x01e) + static_cast<std::uint64_t>(view & 0x1fffu) * HtileMetadataBytes(depth.extent);
         depth.htileStencil = stencil && !depth.htileDepthOnly;
     }
+    return depth;
+}
+
+void decodeDepth(const Registers& cx, std::uint32_t depthControl, bool testValExport, bool opValExport, State& result) {
+    const bool opValReference = opValExport && StencilOperationValueReplaces(cx);
+    zero(cx, 0x000, 0x0000101cu, "depth copy, resummarize or decompress draws (DB_RENDER_CONTROL)");
+    const bool depthClear = (read(cx, 0x000) & 1u) != 0;
+    const auto view = read(cx, 0x002);
+    zero(cx, 0x010, 0x00001000u, "partially resident depth (DB_Z_INFO)");
+    zero(cx, 0x011, 0x00001000u, "partially resident stencil (DB_STENCIL_INFO)");
+    const auto zFormat = read(cx, 0x010) & 3u;
+    const bool stencil = (read(cx, 0x011) & 1u) != 0;
+    const bool stencilClear = stencil && (read(cx, 0x000) & 2u) != 0;
+    Require(zFormat != 2, "Z_24 depth is unsupported");
+    if (zFormat == 0) depthControl &= ~6u;
+    if (!stencil) depthControl &= ~1u;
+    const auto base = [&](std::uint32_t low, std::uint32_t highOffset) {
+        const auto high = find(cx, highOffset);
+        return (high == cx.end() ? 0ull : static_cast<std::uint64_t>(high->second & 0xffu) << 40u) | (static_cast<std::uint64_t>(read(cx, low)) << 8u);
+    };
+    const bool depthReadOnly = (view & 0x01000000u) != 0;
+    const bool stencilReadOnly = (view & 0x02000000u) != 0;
+    Require(!stencilClear || !stencilReadOnly, "stencil clear requires a writable stencil plane");
+    Require(!stencilClear || !testValExport, "stencil clear with a pixel shader that exports the stencil test value is unsupported");
+    Require(!depthClear || (zFormat != 0 && !depthReadOnly), "depth clear requires a writable depth plane");
+    const auto readAddress = zFormat != 0 ? base(0x012, 0x01a) : 0;
+    const auto stencilReadAddress = stencil ? base(0x013, 0x01b) : 0;
+    const bool depthWritten = zFormat != 0 && !depthReadOnly && (depthClear || (depthControl & 6u) == 6u || (read(cx, 0x000) & 0x60u) != 0);
+    Require(!depthWritten || base(0x014, 0x01c) == readAddress, "depth read and written at different addresses is unsupported");
+    Require(!stencil || stencilReadOnly || base(0x015, 0x01d) == stencilReadAddress, "stencil read and written at different addresses is unsupported");
+    auto depth = decodeDepthPlane(cx);
+    depth.clearDepth = readFloat(cx, 0x00b);
+    depth.clearStencil = static_cast<std::uint8_t>(read(cx, 0x00a) & 0xffu);
     result.depth = depth;
     result.depthTest = (depthControl & 2u) != 0;
     result.depthWrite = result.depthTest && (depthControl & 4u) != 0 && !depthReadOnly;
@@ -559,6 +607,11 @@ constexpr std::uint32_t CoveredCentroidIsCenter = 1u << 29u;
 constexpr std::uint32_t SampleZeroRefusedInputs = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveCentroid) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::LinearCentroid) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage);
 constexpr std::uint32_t CentroidInputs = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveCentroid) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::LinearCentroid);
 
+bool staticAnchors(const Registers& cx, std::uint32_t depthSamples) {
+    const auto eqaa = find(cx, 0x201);
+    return eqaa != cx.end() && (eqaa->second & 7u) == static_cast<std::uint32_t>(std::countr_zero(depthSamples)) && (eqaa->second & 0x100000u) != 0;
+}
+
 bool overrasterized(const Registers& cx, std::uint32_t samples) {
     const auto eqaa = find(cx, 0x201);
     const auto mode = find(cx, 0x292);
@@ -574,6 +627,25 @@ bool sampleCoverageSupported(const QueueState& queue, std::uint32_t samples, boo
     return (inputs & PixelSampleCoverageInput) == 0u || (!perSampleShading && (inputs & PixelSampleRateInputs) == 0u);
 }
 
+bool pixelRateInputsKept(const QueueState& queue, const State& state) {
+    using ShaderRecompiler::PixelInput;
+    using ShaderRecompiler::PixelInputBit;
+    constexpr std::uint32_t numbered = PixelInputBit(PixelInput::Ancillary) | PixelInputBit(PixelInput::SampleCoverage);
+    constexpr std::uint32_t located = PixelInputBit(PixelInput::PerspectiveSample) | PixelInputBit(PixelInput::PerspectiveCentroid) | PixelInputBit(PixelInput::PerspectivePullModel) | PixelInputBit(PixelInput::LinearSample) | PixelInputBit(PixelInput::LinearCentroid) | PixelInputBit(PixelInput::PositionZ) | PixelInputBit(PixelInput::PositionW);
+    const bool centred = state.customSampleLocations && std::ranges::all_of(state.sampleLocations, [](std::uint8_t location) { return location == 0u; });
+    const auto moving = numbered | (centred ? 0u : located);
+    if (PixelProgramSkipped(queue)) return true;
+    const auto ena = find(queue.context, 0x1b3);
+    const auto addr = find(queue.context, 0x1b4);
+    if (ena == queue.context.end() || addr == queue.context.end()) return true;
+    const auto inputs = ena->second & addr->second;
+    if ((inputs & moving) != 0u) return false;
+    if (centred || (inputs & (PixelInputBit(PixelInput::PositionX) | PixelInputBit(PixelInput::PositionY))) == 0u) return true;
+    const auto position = find(queue.context, 0x1b8);
+    const auto control = position == queue.context.end() ? 0u : position->second;
+    return (control & 0x100000u) != 0u || ((control >> 16u) & 3u) == 0u;
+}
+
 bool coveredCentroidSupported(const QueueState& queue) {
     const auto config = find(queue.context, 0x2f8);
     if (config == queue.context.end() || (config->second & CoveredCentroidIsCenter) == 0 || PixelProgramSkipped(queue)) return true;
@@ -663,15 +735,19 @@ void rasterizeSampleZero(State& state) {
     state.sampleLocationGrid = sampleZero[8] != sampleZero[0] || sampleZero[16] != sampleZero[0] || sampleZero[24] != sampleZero[0];
 }
 
+bool documentedRop(std::uint32_t rop) {
+    return (rop >> 4u) == (rop & 0xfu) || ((rop >> 2u) & 0x33u) == (rop & 0x33u);
+}
+
 bool colorControlSupported(std::uint32_t colorControl, bool hasColorTarget) {
     colorControl &= ~1u;
-    return colorControl == 0xcc0010u || ((colorControl >> 4u) & 7u) == 0u || (!hasColorTarget && (colorControl & ~0x70u) == 0xcc0000u);
+    return ((colorControl & ~0xff0000u) == 0x10u && documentedRop((colorControl >> 16u) & 0xffu)) || ((colorControl >> 4u) & 7u) == 0u || (!hasColorTarget && (colorControl & ~0x70u) == 0xcc0000u);
 }
 
 std::string colorControlMessage(std::uint32_t colorControl) {
     static constexpr const char* modes[8] = {"disable", "normal", "eliminate fast clear", "resolve", "decompress", "FMASK decompress", "DCC decompress", "reserved"};
     char text[160];
-    std::snprintf(text, sizeof(text), "AGC graphics: only normal color rendering with copy ROP is supported (CB_COLOR_CONTROL 0x%08x, mode %s)", colorControl, modes[(colorControl >> 4u) & 7u]);
+    std::snprintf(text, sizeof(text), "AGC graphics: only normal color rendering with a ROP3 code of the source or brush form is supported (CB_COLOR_CONTROL 0x%08x, mode %s)", colorControl, modes[(colorControl >> 4u) & 7u]);
     return text;
 }
 
@@ -876,6 +952,7 @@ struct DecodedColorFormat {
 };
 
 const char* PackedColorTargetName(ShaderRecompiler::ColorExportPacking packing) {
+    if (packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4) return "4_4_4_4 unorm";
     return packing == ShaderRecompiler::ColorExportPacking::Float11_11_10 ? "11_11_10 float" : "10_11_11 unorm";
 }
 
@@ -889,7 +966,7 @@ DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number,
     };
     const bool alternate = swap == 1;
     const auto single = [&](VkFormat vkFormat, std::uint32_t bytes) { return DecodedColorFormat{vkFormat, bytes, static_cast<std::uint8_t>((0xe4u & ~3u) | swap)}; };
-    if (swap > 1 && format != 1 && format != 2 && format != 4 && format != 7 && format != 10 && format != 12 && format != 16) return fail();
+    if (swap > 1 && format != 1 && format != 2 && format != 4 && format != 7 && format != 10 && format != 12 && format != 16 && format != 19) return fail();
     switch (format) {
         case 1:
             if (number == unorm) return single(VK_FORMAT_R8_UNORM, 1);
@@ -929,8 +1006,8 @@ DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number,
             if (number == unorm) return {VK_FORMAT_R32_UINT, 4, 0xe4u, ShaderRecompiler::ColorExportPacking::Unorm10_11_11};
             return {VK_FORMAT_B10G11R11_UFLOAT_PACK32, 4};
         case 7:
-            if (swap != 2 || number != floating) return fail();
-            return {VK_FORMAT_R32_UINT, 4, 0xc6u, ShaderRecompiler::ColorExportPacking::Float11_11_10};
+            if ((swap != 0 && swap != 2) || number != floating) return fail();
+            return {VK_FORMAT_R32_UINT, 4, static_cast<std::uint8_t>(swap == 2 ? 0xc6u : 0xe4u), ShaderRecompiler::ColorExportPacking::Float11_11_10};
         case 9:
             // COLOR_2_10_10_10 keeps red in the low bits, the Vulkan A2B10G10R10 packing.
             if (number != unorm) return fail();
@@ -967,6 +1044,9 @@ DecodedColorFormat DecodeColorFormat(std::uint32_t format, std::uint32_t number,
         case 17:
             if (swap != 0 || number != unorm) return fail();
             return {VK_FORMAT_A1R5G5B5_UNORM_PACK16, 2, 0xc6u};
+        case 19:
+            if (swap != 2 || number != unorm) return fail();
+            return {VK_FORMAT_R16_UINT, 2, 0x1bu, ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4};
         default:
             return fail();
     }
@@ -1041,6 +1121,21 @@ std::array<std::uint16_t, 4> QuadSampleMasks(const State& state, const SampleOrd
     return {mask, mask, mask, mask};
 }
 
+VkLogicOp LogicOpFromRop(std::uint8_t rop) {
+    if (!documentedRop(rop)) {
+        char text[96];
+        std::snprintf(text, sizeof(text), "AGC graphics: ROP3 code 0x%02x combines source and brush, which is not implemented", rop);
+        throw std::runtime_error(text);
+    }
+    static constexpr std::array<VkLogicOp, 16> operations{
+        VK_LOGIC_OP_CLEAR, VK_LOGIC_OP_NOR, VK_LOGIC_OP_AND_INVERTED, VK_LOGIC_OP_COPY_INVERTED,
+        VK_LOGIC_OP_AND_REVERSE, VK_LOGIC_OP_INVERT, VK_LOGIC_OP_XOR, VK_LOGIC_OP_NAND,
+        VK_LOGIC_OP_AND, VK_LOGIC_OP_EQUIVALENT, VK_LOGIC_OP_NO_OP, VK_LOGIC_OP_OR_INVERTED,
+        VK_LOGIC_OP_COPY, VK_LOGIC_OP_OR_REVERSE, VK_LOGIC_OP_OR, VK_LOGIC_OP_SET};
+    const std::uint32_t index = (rop & 3u) | ((rop >> 4u) & 4u) | ((rop >> 4u) & 8u);
+    return operations[index];
+}
+
 std::array<VkSampleLocationEXT, 32> SampleLocations(const State& state) {
     Require(state.samples == 1 || state.samples == 2 || state.samples == 4 || state.samples == 8, "invalid sample count");
     std::array<VkSampleLocationEXT, 32> locations{};
@@ -1067,7 +1162,8 @@ std::array<std::uint8_t, 32> PixelSampleLocations(const State& state, const Shad
     std::array<std::uint8_t, 32> locations{};
     const bool sampleBarycentrics = (pixel.inputAddr & (PixelInputBit(PixelInput::PerspectiveSample) | PixelInputBit(PixelInput::LinearSample))) != 0u;
     const bool samplePosition = !state.perSampleShading && (pixel.posX || pixel.posY) && pixel.positionLocation == ShaderRecompiler::PixelPositionLocation::Sample;
-    if (!sampleBarycentrics && !samplePosition) return locations;
+    const bool mergedCentres = pixel.targetMerge.samples > 1u && (pixel.inputAddr & (PixelInputBit(PixelInput::PerspectiveCenter) | PixelInputBit(PixelInput::LinearCenter))) != 0u;
+    if (!sampleBarycentrics && !samplePosition && !mergedCentres) return locations;
     const auto samples = state.perSampleShading ? state.samples : 1u;
     for (std::uint32_t pixelIndex = 0; pixelIndex < 4u; ++pixelIndex) {
         for (std::uint32_t sample = 0; sample < samples; ++sample) {
@@ -1082,6 +1178,15 @@ std::array<std::uint8_t, 32> PixelSampleLocations(const State& state, const Shad
     return locations;
 }
 
+void ApplyPointSize(const State& state, ShaderRecompiler::ShaderVertexStageInfo& vertex) {
+    if (!state.vertexPoints && !(state.stages.mesh.has_value() && state.stages.mesh->outputPrimitiveSize == 1u)) return;
+    vertex.paClVsOutCntl |= state.paClVsOutCntl & (1u << 16u);
+    vertex.pointList = true;
+    vertex.pointSize = state.pointSize;
+    vertex.pointSizeMin = state.pointSizeMin;
+    vertex.pointSizeMax = state.pointSizeMax;
+}
+
 ShaderStages DecodeShaderStages(const QueueState& queue, bool vertexWorkgroup) {
     const auto value = read(queue.context, 0x2d5);
     const auto validate = [&](bool condition, const char* reason) {
@@ -1256,7 +1361,11 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     const auto primitive = read(queue.userConfig, 0x242, RegisterBank::UserConfig);
     APS5_LOG_OUT_DEBUG("DecodeState primitive=%u path=%u vertexWave=%u", primitive, static_cast<unsigned>(result.stages.path), result.stages.vertexWaveSize);
     switch (primitive) {
-        case 1: Require(result.stages.mesh.has_value(), "point-list vertex rendering requires point-size output support"); result.topology = VK_PRIMITIVE_TOPOLOGY_POINT_LIST; break;
+        case 1:
+            Require(result.stages.mesh.has_value() || result.stages.path == ShaderPath::Vertex, "point lists are only drawn through the vertex and geometry paths");
+            result.topology = VK_PRIMITIVE_TOPOLOGY_POINT_LIST;
+            result.vertexPoints = result.stages.path == ShaderPath::Vertex;
+            break;
         case 2: result.topology = VK_PRIMITIVE_TOPOLOGY_LINE_LIST; break;
         case 3: result.topology = VK_PRIMITIVE_TOPOLOGY_LINE_STRIP; break;
         case 7:
@@ -1281,9 +1390,10 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     }
     APS5_LOG_OUT_DEBUG("Topology=%u", static_cast<unsigned>(result.topology));
     result.primitiveRestart = read(queue.userConfig, 0x24b, RegisterBank::UserConfig) != 0 && !result.rectList && !result.quadList && result.topology != VK_PRIMITIVE_TOPOLOGY_PATCH_LIST;
-    zero(cx, 0x207, ~(LayerExports | ClipCullExports | inactiveVertexPointSize(queue)), "layer, viewport or auxiliary vertex exports");
+    zero(cx, 0x207, ~(LayerExports | ClipCullExports | ((result.vertexPoints || (result.stages.mesh.has_value() && result.stages.mesh->outputPrimitiveSize == 1u)) ? 1u << 16u : inactiveVertexPointSize(queue))), "layer, viewport or auxiliary vertex exports");
     Require(std::popcount(read(cx, 0x207) & 0xffffu) <= 8, "more than eight clip and cull distances are unsupported");
     result.paClVsOutCntl = read(cx, 0x207);
+    if (result.vertexPoints || (result.stages.mesh.has_value() && result.stages.mesh->outputPrimitiveSize == 1u)) decodePointSize(queue, result);
     result.samples = decodeSamples(cx);
     Require(coveredCentroidSupported(queue), "COVERED_CENTROID_IS_CENTER with active or unspecified centroid inputs is not implemented");
     decodeSampleLocations(cx, result);
@@ -1326,16 +1436,16 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     zero(cx, 0x292, ScanModeMask & ~1u, "scan conversion mode");
     if (depthKeepsSampleZero && (read(cx, 0x292) & 1u) == 0) {
         const bool filled = result.topology != VK_PRIMITIVE_TOPOLOGY_POINT_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_STRIP;
-        const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage));
-        Require(filled && !result.alphaToCoverage && (PixelProgramSkipped(queue) || sampleInputs == 0) && (read(cx, 0x203) & 0x100u) == 0 && (read(cx, 0x201) & 0x0f0c0000u) == 0, "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA Z interpolation or overrasterization");
+        const auto sampleIndex = (read(cx, 0x293) & PixelShaderIteratesSamples) != 0u ? ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) : 0u;
+        const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (sampleIndex | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage));
+        Require(filled && !result.alphaToCoverage && (PixelProgramSkipped(queue) || sampleInputs == 0) && (read(cx, 0x203) & 0x100u) == 0 && (read(cx, 0x201) & 0x0f080000u) == 0, "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index input under PS_ITER_SAMPLE, a coverage input, a sample-mask export, or DB_EQAA source Z interpolation or overrasterization");
         result.samples = 1;
         result.customSampleLocations = false;
         result.sampleLocations.fill(0);
         result.sampleLocationGrid = false;
     }
     if (result.samples > 1 && (read(cx, 0x292) & 1u) == 0) {
-        const bool filled = result.topology != VK_PRIMITIVE_TOPOLOGY_POINT_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_LIST && result.topology != VK_PRIMITIVE_TOPOLOGY_LINE_STRIP;
-        Require(filled && !result.alphaToCoverage, "multisampled targets rasterized without MSAA_ENABLE are unsupported for points, lines or alpha-to-coverage");
+        Require(RasterPrimitiveOf(result) != ShaderRecompiler::RasterPrimitive::Point && !result.alphaToCoverage, "multisampled targets rasterized without MSAA_ENABLE are unsupported for points or alpha-to-coverage");
         if (const auto eqaa = find(cx, 0x201); result.depth && eqaa != cx.end() && (eqaa->second & 0x0f0c0000u) != 0) throw std::runtime_error(zeroMessage(0x201, eqaa->second, "a multisampled depth target rasterized without MSAA_ENABLE with Z interpolation or overrasterization (DB_EQAA)"));
         if (const auto control = find(cx, 0x203); result.depth && control != cx.end() && (control->second & 0x100u) != 0) throw std::runtime_error(zeroMessage(0x203, control->second, "a multisampled depth target rasterized without MSAA_ENABLE with a sample-mask export"));
         result.customSampleLocations = true;
@@ -1369,7 +1479,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     if (auto reason = sampleMaskRejection(queue, read(cx, 0x2f8), read(cx, 0x30e), read(cx, 0x30f)); !reason.empty()) throw std::runtime_error(reason);
     const auto viewportControl = read(cx, 0x206);
     if (viewportControl != 0x43fu) throw std::runtime_error(vteMessage(viewportControl));
-    zero(cx, 0x204, ClipControlMask, "unsupported PA_CL_CLIP_CNTL flags");
+    zero(cx, 0x204, ClipControlMask, "a PA_CL_CLIP_CNTL flag");
     result.depthClamp = (read(cx, 0x204) & 0x0c000000u) != 0;
     result.negativeOneToOne = (read(cx, 0x204) & 0x80000u) == 0;
     const auto raster = read(cx, 0x205);
@@ -1406,6 +1516,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
 
     // CB_COLOR_CONTROL mode 0 disables color writes, which only matters when a target is written.
     if (const auto colorControl = read(cx, 0x202); !colorControlSupported(colorControl, result.hasColorTarget)) throw std::runtime_error(colorControlMessage(colorControl));
+    if (const auto colorControl = read(cx, 0x202); ((colorControl >> 4u) & 7u) == 1u) result.colorRop = static_cast<std::uint8_t>(colorControl >> 16u);
     zero(cx, 0x1c4, zFormatSupported(read(cx, 0x1c4)) ? 0u : ~0u, "depth or sample-mask export");
     const auto exportFormat = result.hasColorTarget ? read(cx, 0x1c5) : 0u;
     APS5_LOG_OUT_DEBUG("Export format=%u", exportFormat);
@@ -1424,9 +1535,10 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
         color.uintExport = slotExport == 7;
         if (color.samples == 1 && result.samples > 1 && result.colors.empty() && !result.depth && (read(cx, 0x292) & 1u) == 0) {
             const auto sampleInputs = read(cx, 0x1b3) & read(cx, 0x1b4) & (ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage));
-            Require(!result.perSampleShading && sampleInputs == 0 && (read(cx, 0x203) & 0x100u) == 0, "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with PS_ITER_SAMPLE, a sample index or coverage input, or a sample-mask export");
+            Require(sampleInputs == 0 && (read(cx, 0x203) & 0x100u) == 0, "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with a sample index or coverage input, or a sample-mask export");
             result.samples = 1;
             result.customSampleLocations = false;
+            result.perSampleShading = false;
         }
         if (color.samples > 1 && result.samples == 1 && result.colors.empty() && !result.depth && !result.alphaToCoverage && (read(cx, 0x292) & 1u) == 0) {
             Require(result.conservativeRasterization == VK_CONSERVATIVE_RASTERIZATION_MODE_DISABLED_EXT || (read(cx, 0x1b3) & 0x44u) == 0, "conservative rasterization with centroid interpolation of a draw raised to a multisampled target is unsupported");
@@ -1434,10 +1546,14 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
             result.customSampleLocations = true;
             result.sampleLocations.fill(0);
         }
-        const bool merged = color.samples == 1u && !result.depth && !result.perSampleShading && (result.colors.empty() || result.mergedCoverage) && overrasterized(cx, result.samples);
-        if (!merged && color.samples == 1 && result.colors.empty() && !result.depth && rasterizesSampleZeroOnly(cx, result)) rasterizeSampleZero(result);
-        Require((color.samples == result.samples && !result.mergedCoverage) || merged, "a color target's sample count differs from the rasterizer's");
+        const bool merged = color.samples == 1u && color.coverageSamples == 1u && !result.depth && !result.perSampleShading && (result.colors.empty() || result.mergedCoverage) && overrasterized(cx, result.samples);
+        if (!merged && color.samples == 1 && color.coverageSamples == 1u && result.colors.empty() && !result.depth && rasterizesSampleZeroOnly(cx, result)) rasterizeSampleZero(result);
+        Require(color.coverageSamples == color.samples || color.coverageSamples == result.samples || (result.samples == 1u && (read(cx, 0x292) & 1u) == 0), "a one-fragment color target's sample count differs from the rasterizer's");
+        const bool truncated = color.samples == 1u && result.samples > 1u && result.depth && result.depth->samples == result.samples && (result.colors.empty() || result.truncatedCoverage) && !overrasterized(cx, result.samples);
+        Require((color.samples == result.samples && !result.mergedCoverage && !result.truncatedCoverage) || merged || truncated, "a color target's sample count differs from the rasterizer's");
+        Require(color.coverageSamples == color.samples || result.samples == 1u || staticAnchors(cx, result.depth->samples), "a one-fragment color target is supported only with static DB_EQAA anchors at the depth target's sample count");
         result.mergedCoverage = merged;
+        result.truncatedCoverage = truncated;
         APS5_LOG_OUT_DEBUG("Color %u address=0x%llx extent=%ux%u bytes=%llu VkFormat=%u", slot, static_cast<unsigned long long>(color.address), color.extent.width, color.extent.height, static_cast<unsigned long long>(color.bytes), static_cast<unsigned>(color.format));
         if (result.colors.empty()) {
             result.renderExtent = color.extent;
@@ -1465,6 +1581,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     }
     result.quadSampleMask = decodeQuadSampleMask(cx, result.samples);
     result.pixelEarlyZ = !PixelProgramSkipped(queue) && PixelEarlyZ(read(cx, 0x203));
+    result.pixelKill = !PixelProgramSkipped(queue) && (read(cx, 0x203) & 0x40u) != 0;
     if ((read(cx, 0x207) & LayerExports & ~result.layerExports & ~(1u << 21u)) != 0) {
         static bool reported = false;
         if (!reported) {
@@ -1510,7 +1627,7 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     result.blends.assign(exportCount, VkPipelineColorBlendAttachmentState{});
     std::array<float, 3> requiredBlendConstants{};
     std::uint32_t requiredBlendMask = 0;
-    for (const auto& color : result.colors) {
+    for (auto& color : result.colors) {
         const auto slot = color.slot;
         const auto blend = read(cx, 0x1e0 + slot);
         APS5_LOG_OUT_DEBUG("Blend %u control=0x%x", slot, blend);
@@ -1578,7 +1695,25 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
             const auto slotExport = (exportFormat >> (4u * color.exportIndex)) & 0xfu;
             if (slotExport == 5 || slotExport == 6) throw std::runtime_error("AGC graphics: color export format " + std::to_string(slotExport) + " into " + packed + " target is unsupported");
             Require(!state.blendEnable, "blending into " + packed + " color target is unsupported");
-            Require((exportedMask & 7u) == 7u, "partial writes of " + packed + " color target are unsupported");
+            const bool nibbles = color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4;
+            const std::uint32_t packedMask = nibbles ? 0xfu : 7u;
+            Require(nibbles || (exportedMask & packedMask) == packedMask, "partial writes of " + packed + " color target are unsupported");
+            if ((exportedMask & packedMask) != packedMask) {
+                Require(color.mipCount == 1u && color.depth == 1u && color.layers == 1u && color.arrayLastSlice == 0u, "partial writes of a mipmapped, volume or array " + std::string(PackedColorTargetName(color.packing)) + " color target are not implemented");
+                Require(std::ranges::none_of(result.colors, [](const ColorTarget& other) { return other.partialWriteMask != 0; }), "partial writes of more than one packed color target are not implemented");
+                color.partialWriteMask = PackedWriteMask(mapping, exportedMask);
+                state.colorWriteMask = 0;
+                if (color.samples > 1u) {
+                    Require(sampleCoverageSupported(queue, result.samples, true), "SAMPLE_COVERAGE in a multisampled pixel shader that runs per sample, or reads sample-rate or ancillary inputs, is unsupported (the input holds the whole pixel's coverage, gl_SampleMaskIn only the invocation's samples)");
+                    if (!result.perSampleShading && !pixelRateInputsKept(queue, result)) {
+                        const auto value = [&](std::uint32_t offset) { const auto it = queue.context.find(offset); return it == queue.context.end() ? 0u : it->second; };
+                        char detail[160];
+                        std::snprintf(detail, sizeof(detail), " (SPI_PS_INPUT_ENA 0x%x, SPI_PS_INPUT_ADDR 0x%x, SPI_BARYC_CNTL 0x%x, sample 1 location 0x%02x)", value(0x1b3), value(0x1b4), value(0x1b8), result.sampleLocations[1]);
+                        Require(false, std::string("partial writes of a multisampled 4_4_4_4 unorm color target run the pixel shader once per sample, so a shader the guest runs once per pixel cannot read the ancillary word or, unless every sample sits at the pixel centre, centroid, sample-located or pull-model barycentrics, Z, 1/W or a position at the centroid or a sample: they would follow the invocation's sample") + detail);
+                    }
+                    result.perSampleShading = true;
+                }
+            }
         }
         if (state.blendEnable && !reversed && (secondSource(state.srcColorBlendFactor) || secondSource(state.dstColorBlendFactor) || secondSource(state.srcAlphaBlendFactor) || secondSource(state.dstAlphaBlendFactor))) {
             const auto addition = [](VkBlendOp op) { return op == VK_BLEND_OP_ADD || op == VK_BLEND_OP_SUBTRACT || op == VK_BLEND_OP_REVERSE_SUBTRACT; };
@@ -1595,7 +1730,14 @@ State DecodeState(const QueueState& queue, bool vertexWorkgroup) {
     for (std::uint32_t i = 0; i < 3; ++i) {
         if ((requiredBlendMask & (1u << i)) != 0) result.blendConstants[i] = requiredBlendConstants[i];
     }
-    if (!result.colors.empty()) result.blend = result.blends[result.colors.front().exportIndex];
+    Require((!result.mergedCoverage && !result.truncatedCoverage) || std::ranges::none_of(result.colors, [](const ColorTarget& color) { return color.partialWriteMask != 0; }), "partial writes of a 4_4_4_4 unorm color target under merged or truncated coverage (a one-sample target under a multisampled rasterizer) are not implemented");
+    if (!result.colors.empty()) {
+        result.color = result.colors.front();
+        result.blend = result.blends[result.colors.front().exportIndex];
+    }
+    if (LogicOpFromRop(result.colorRop) != VK_LOGIC_OP_COPY) {
+        for (const auto& blend : result.blends) Require(blend.blendEnable == VK_FALSE, "a color logic operation together with blending is not implemented");
+    }
     Require(result.reversedBlend == 0 || (exportSlots.size() == 1 && exportCount == 1), "blending into a color target with a reversed component order through a second source color needs that target to be the shader's only color export");
     if (result.dualSourceBlend) {
         Require(exportSlots.size() == 2 && exportSlots[0] == 0 && exportSlots[1] == 1 && exportCount == 1, "dual-source blending needs pixel exports to MRT slots 0 and 1 and color writes to slot 0 alone");
@@ -1622,6 +1764,50 @@ std::array<ShaderRecompiler::ColorExportPacking, 8> ExportPackings(const State&
     return packings;
 }
 
+std::uint16_t PackedWriteMask(std::uint8_t componentMapping, std::uint32_t exportedMask) {
+    std::uint16_t mask = 0;
+    for (std::uint32_t component = 0; component < 4; ++component) {
+        if (((exportedMask >> ((componentMapping >> (2u * component)) & 3u)) & 1u) != 0) mask = static_cast<std::uint16_t>(mask | (0xfu << (4u * component)));
+    }
+    return mask;
+}
+
+GuestTextureResource TargetMergeSurface(const ColorTarget& color) {
+    auto surface = SurfaceForTarget(color);
+    if (color.samples > 1u) {
+        Require(surface.baseAddress == color.surfaceAddress, "a merged multisampled color target does not start at its surface");
+        surface.dimension = TextureDimension::k2DMsaa;
+        surface.samples = color.samples;
+    }
+    return surface;
+}
+
+bool DepthStencilWrites(const State& state) {
+    if (!state.depth) return false;
+    const auto writes = [](const VkStencilOpState& face) { return (face.writeMask & 0xffu) != 0 && (face.failOp != VK_STENCIL_OP_KEEP || face.passOp != VK_STENCIL_OP_KEEP || face.depthFailOp != VK_STENCIL_OP_KEEP); };
+    return state.depthWrite || (state.stencilTest && (writes(state.stencilFront) || writes(state.stencilBack)));
+}
+
+bool DepthStencilTests(const State& state) {
+    return state.depth.has_value() && (state.depthTest || state.stencilTest || state.depthBoundsTest);
+}
+
+ShaderRecompiler::TargetMerge ExportTargetMerge(const State& state) {
+    ShaderRecompiler::TargetMerge merge;
+    for (const auto& color : state.colors) {
+        if (color.partialWriteMask == 0) continue;
+        Require(merge.mask == 0 && color.exportIndex < 8u && color.samples <= 8u, "a draw merges into one packed color target at most");
+        Require(color.samples == 1u || state.perSampleShading, "a merged multisampled color target needs per-sample shading");
+        merge.target = static_cast<std::uint8_t>(color.exportIndex);
+        merge.mask = color.partialWriteMask;
+        merge.samples = static_cast<std::uint8_t>(color.samples);
+        merge.descriptor = EncodeTextureResource(TargetMergeSurface(color));
+        merge.depthStencilWrites = DepthStencilWrites(state);
+        merge.depthStencilTests = DepthStencilTests(state);
+    }
+    return merge;
+}
+
 bool PartialSampleMask(const State& state) {
     const auto full = (1u << state.samples) - 1u;
     return std::ranges::any_of(state.quadSampleMask, [&](std::uint16_t mask) { return (mask & full) != full; });
@@ -1744,10 +1930,12 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
     const auto decoded = DecodeColorFormat(format, number, swap);
     const auto attrib = read(cx, 0x31d + stride);
     zero(cx, 0x31d + stride, ~0x3f000u, "color destination alpha override or other CB_COLOR_ATTRIB modes");
-    color.samples = 1u << ((attrib >> 12u) & 7u);
-    Require(color.samples <= 8u, "color targets with more than eight samples are unsupported");
-    Require((1u << ((attrib >> 15u) & 3u)) == color.samples, "color targets with fewer fragments than samples (EQAA) are unsupported");
-    const auto multisampleInfo = color.samples > 1 ? 0x0c006000u : 0u;
+    color.coverageSamples = 1u << ((attrib >> 12u) & 7u);
+    Require(color.coverageSamples <= 8u, "color targets with more than eight samples are unsupported");
+    color.samples = 1u << ((attrib >> 15u) & 3u);
+    Require(color.samples <= color.coverageSamples, "color targets with more fragments than samples are unsupported");
+    Require(color.samples == color.coverageSamples || color.samples == 1u, "color targets with more than one but fewer fragments than samples (EQAA) are unsupported");
+    const auto multisampleInfo = color.coverageSamples > 1 ? 0x0c006000u : 0u;
     // ROUND_MODE (bit 18) only affects unorm rounding and packed float truncation. With DCC_ENABLE (bit 28) the target is written
     if ((info & ~(0x00039f7cu | 0x00040000u | 0x10000000u | 0x00002000u | multisampleInfo)) != 0) throw std::runtime_error("AGC graphics: color compression, DCC, endian conversion, nonstandard rounding or color optimization is unsupported (CB_COLOR_INFO 0x" + [&] { char text[16]; std::snprintf(text, sizeof(text), "%08x", info); return std::string(text); }() + ")");
     Require((info & 0x8000u) != 0 || number <= 1u || number == 7 || number == 4 || number == 5, "unclamped normalized color is unsupported");
@@ -1839,6 +2027,7 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
     color.packing = decoded.packing;
     if (color.packing != ShaderRecompiler::ColorExportPacking::None && (info & 0x10000000u) != 0) throw std::runtime_error("AGC graphics: DCC-compressed " + std::string(PackedColorTargetName(color.packing)) + " color targets are unsupported");
     Require(color.packing != ShaderRecompiler::ColorExportPacking::Unorm10_11_11 || (info & 0x00040000u) == 0, "truncating (ROUND_MODE) 10_11_11 unorm color targets are unsupported");
+    Require(color.packing != ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 || (info & 0x00040000u) == 0, "truncating (ROUND_MODE) 4_4_4_4 unorm color targets are unsupported");
     Require(color.packing != ShaderRecompiler::ColorExportPacking::Float11_11_10 || (info & 0x00040000u) != 0, "rounding (ROUND_MODE 0) 11_11_10 float color targets are unsupported");
     for (std::uint32_t word = 0; word < 2; ++word) {
         const auto clear = find(cx, 0x323 + word + stride);
@@ -1877,6 +2066,19 @@ ColorTarget DecodeColorBuffer(const Registers& cx, std::uint32_t slot, bool allo
             if (color.samples == 1) GuestMemory::CheckRange(reinterpret_cast<const void*>(cmask), totalCmaskBytes, CmaskLayout::Alignment, true);
         }
         color.cmaskFastClear = (info & 0x2000u) != 0;
+        if (const auto fmask = find(cx, 0x321 + stride); color.samples > 1u && fmask != cx.end()) {
+            const auto high = find(cx, 0x3a0 + slot);
+            const auto fmaskHigh = high == cx.end() ? 0u : high->second;
+            Require((fmaskHigh & ~0xffu) == 0u, "invalid FMASK address extension");
+            const auto address = (static_cast<std::uint64_t>(fmaskHigh) << 40u) | (static_cast<std::uint64_t>(fmask->second) << 8u);
+            color.fmaskPipeBankXor = static_cast<std::uint32_t>(address & 0xffffu);
+            color.fmaskAddress = address - color.fmaskPipeBankXor;
+        }
+    }
+    if (color.coverageSamples > color.samples && (info & 0x4000u) != 0) {
+        const auto fmaskHigh = find(cx, 0x3a0 + slot);
+        color.fmaskAddress = (((fmaskHigh == cx.end() ? 0ull : static_cast<std::uint64_t>(fmaskHigh->second & 0xffu)) << 40u) | (static_cast<std::uint64_t>(read(cx, 0x321 + stride)) << 8u)) & ~0xffffull;
+        Require(color.fmaskAddress != 0, "a compressed one-fragment color target without an FMASK address is unsupported");
     }
     if ((info & 0x10000000u) != 0) {
         if (maxMip == 0) {
@@ -1934,28 +2136,20 @@ std::optional<DepthCopyPass> DecodeDepthCopyPass(const QueueState& queue) {
     Require((control->second & ~0xf84u) == 0, "DB depth copy combined with a stencil copy, clear, resummarize or decompress");
     Require((read(cx, 0x200) & 0xfu) == 0, "DB depth copy with depth or stencil tests");
     Require((read(cx, 0x010) & 3u) == 3u, "DB depth copy from a depth plane that is not Z_32_FLOAT");
-    Require(ColorWriteMask(cx) == 1u, "DB depth copy into anything but the red channel of color target 0");
     const auto viewRegister = find(cx, 0x002);
-    const auto view = viewRegister == cx.end() ? 0u : viewRegister->second;
-    Require((read(cx, 0x010) & 0x000f1000u) == 0 && (view & 0x3c000000u) == 0, "DB depth copy from a mipmapped or partially resident depth plane");
+    Require((read(cx, 0x010) & 0x000f1000u) == 0 && ((viewRegister == cx.end() ? 0u : viewRegister->second) & 0x3c000000u) == 0, "DB depth copy from a mipmapped or partially resident depth plane");
+    Require(ColorWriteMask(cx) == 1u, "DB depth copy into anything but the red channel of color target 0");
+    Require((read(cx, 0x1e0) & (1u << 30u)) == 0, "DB depth copy with color target 0 blending is unsupported");
     DepthCopyPass pass{};
-    const auto high = find(cx, 0x01a);
-    pass.depthAddress = (high == cx.end() ? 0ull : static_cast<std::uint64_t>(high->second & 0xffu) << 40u) | (static_cast<std::uint64_t>(read(cx, 0x012)) << 8u);
-    const auto size = read(cx, 0x007);
-    pass.extent = {(size & 0x3fffu) + 1u, ((size >> 16u) & 0x3fffu) + 1u};
-    pass.samples = 1u << ((read(cx, 0x010) >> 2u) & 3u);
-    if (pass.samples != 1u) pass.depthAddress &= ~std::uint64_t{65535u};
-    if (const auto slice = view & 0x1fffu; slice != 0) pass.depthAddress += static_cast<std::uint64_t>(slice) * DepthSliceBytes(pass.extent, 4u);
+    pass.source = decodeDepthPlane(cx);
     const auto maskLow = find(cx, 0x30e);
     const auto maskHigh = find(cx, 0x30f);
     Require((maskLow == cx.end() || maskLow->second == 0xffffffffu) && (maskHigh == cx.end() || maskHigh->second == 0xffffffffu), "DB depth copy with a sample mask is unsupported");
     pass.sample = (control->second & 0x80u) != 0 ? 0u : (control->second >> 8u) & 0xfu;
-    Require(pass.sample < pass.samples, "DB depth copy of a sample the depth plane does not have");
+    Require(pass.sample < pass.source.samples, "DB depth copy of a sample the depth plane does not have");
     pass.color = DecodeColorBuffer(cx, 0);
     Require(pass.color.format == VK_FORMAT_R32_SFLOAT && pass.color.samples == 1 && pass.color.mip == 0 && pass.color.layers == 1, "DB depth copy into a color target that is not a single-sample R32 float");
-    Require(pass.color.extent.width == pass.extent.width && pass.color.extent.height == pass.extent.height, "DB depth copy into a color target of another size");
-    Require(pass.color.cmaskAddress == 0, "DB depth copy into a color target with CMASK fast clears is unsupported");
-    Require(drawCovers(cx, pass.extent), "DB depth copy over part of the depth surface");
+    Require(pass.color.extent.width == pass.source.extent.width && pass.color.extent.height == pass.source.extent.height, "DB depth copy into a color target of another size");
     return pass;
 }
 
@@ -2044,15 +2238,16 @@ std::string DrawRejection(const QueueState& queue, bool indexed) {
         if (value(queue.userConfig, 0x242, primitive) && (primitive & 0x3fu) != 1 && (primitive & 0x3fu) != 2 && (primitive & 0x3fu) != 3 && (primitive & 0x3fu) != 4 && (primitive & 0x3fu) != 5 && (primitive & 0x3fu) != 6 && (primitive & 0x3fu) != 21) return "AGC graphics: primitive restart is only supported for point, line and triangle topologies";
         if (value(cx, 0x103, resetIndex) && (resetIndex & 0xffffu) != 0xffffu) return "AGC graphics: primitive restart index other than all ones is unsupported";
     }
-    if (auto reason = nonzero(cx, 0x207, ~(LayerExports | ClipCullExports | inactiveVertexPointSize(queue)), "layer, viewport or auxiliary vertex exports"); !reason.empty()) return reason;
+    if (auto reason = nonzero(cx, 0x207, ~(LayerExports | ClipCullExports | (pointOutput(queue) ? 1u << 16u : inactiveVertexPointSize(queue))), "layer, viewport or auxiliary vertex exports"); !reason.empty()) return reason;
     if (value(cx, 0x207, word) && std::popcount(word & 0xffffu) > 8) return require(false, "more than eight clip and cull distances are unsupported");
     if (value(cx, 0x200, word)) {
         const auto renderControl = find(cx, 0x000);
         const bool depthClear = renderControl != cx.end() && (renderControl->second & 1u) != 0;
-        const bool stencilClear = renderControl != cx.end() && (renderControl->second & 2u) != 0;
+        std::uint32_t stencilInfo = 0;
+        const bool stencilClear = renderControl != cx.end() && (renderControl->second & 2u) != 0 && !(value(cx, 0x011, stencilInfo) && (stencilInfo & 1u) == 0);
         if (stencilClear && !depthPlanesAbsent(cx)) {
-            std::uint32_t stencil = 0, view = 0;
-            if ((value(cx, 0x011, stencil) && (stencil & 1u) == 0) || (value(cx, 0x002, view) && (view & 0x02000000u) != 0)) return require(false, "stencil clear requires a writable stencil plane");
+            std::uint32_t view = 0;
+            if (value(cx, 0x002, view) && (view & 0x02000000u) != 0) return require(false, "stencil clear requires a writable stencil plane");
         }
         if (depthClear && !depthPlanesAbsent(cx)) {
             std::uint32_t z = 0, view = 0;
@@ -2102,7 +2297,7 @@ std::string DrawRejection(const QueueState& queue, bool indexed) {
         if (auto reason = sampleMaskRejection(queue, config, word, other); !reason.empty()) return reason;
     }
     if (value(cx, 0x206, word) && word != 0x43fu) return vteMessage(word);
-    if (auto reason = nonzero(cx, 0x204, ClipControlMask, "unsupported PA_CL_CLIP_CNTL flags"); !reason.empty()) return reason;
+    if (auto reason = nonzero(cx, 0x204, ClipControlMask, "a PA_CL_CLIP_CNTL flag"); !reason.empty()) return reason;
     std::uint32_t targetMask = 0, shaderMask = 0;
     if (value(cx, 0x8e, targetMask) && value(cx, 0x8f, shaderMask) && value(cx, 0x202, word) && !colorControlSupported(word, ColorWriteMask(cx) != 0)) return colorControlMessage(word);
     if (auto reason = nonzero(cx, 0x1c4, zFormatSupported(zFormat) ? 0u : ~0u, "depth or sample-mask export"); !reason.empty()) return reason;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp
index 1e10ed8d97..d8394b6c5e 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp
@@ -5,10 +5,12 @@
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/SlimMutex.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
 // For the declaration of PendingStorageOverlaps, defined below.
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
@@ -46,8 +48,8 @@ OwnedImage::~OwnedImage() {
     ReleaseImageMemory(context, memory, memoryBytes, memoryType);
 }
 
-void OwnedImage::Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation) {
-    memory = AllocateImageMemory(device, allocation, mask, operation, &memoryType);
+void OwnedImage::Allocate(const Context& device, const VkMemoryAllocateInfo& allocation, std::uint32_t mask, const char* operation, bool newImage) {
+    memory = AllocateImageMemory(device, allocation, mask, operation, &memoryType, newImage);
     memoryBytes = allocation.allocationSize;
     context.bufferPool = device.bufferPool;
 }
@@ -117,7 +119,7 @@ std::atomic<std::uint64_t> refreshesProved{0};
 std::atomic<std::uint64_t> untrackedCompares{0};
 
 struct StorageTraffic {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::map<std::string, std::pair<std::uint64_t, std::uint64_t>> writeBacks;
     std::array<std::pair<std::uint64_t, std::uint64_t>, 4> uploads{};
     std::map<std::string, std::pair<std::uint64_t, std::uint64_t>> uploadReasons;
@@ -187,7 +189,7 @@ void countStorageWriteBack(std::uint64_t bytes, bool direct) {
 // Every storage image alive, for the fill HLE's cover check (StorageTexture::ClassifyFill): the
 // storage cache indexes surfaces by key, not by address range. Its mutex is a leaf.
 struct LiveImages {
-    std::mutex mutex;
+    AgcDriver::Mutex mutex;
     std::vector<StorageTexture*> textures;
 };
 
@@ -280,7 +282,7 @@ ExpandImage CreateExpandImage(const Context& context, const GuestTextureResource
     VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
     allocation.allocationSize = requirements.size;
     allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "texture");
-    result.owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory sRGB copy");
+    result.owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory sRGB copy", true);
     Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, result.image, result.owned->memory, 0), "vkBindImageMemory sRGB copy");
     result.bytes = requirements.size;
     return result;
@@ -364,7 +366,7 @@ Texture::Texture(const Context& context, TextureDetiler& detiler, const GuestTex
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "texture");
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory texture");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory texture", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory");
 
         const VkImage uploadImage = image;
@@ -518,7 +520,7 @@ Texture::Texture(const Context& context, TextureDetiler& detiler, const GuestTex
             else ++Profile().recordedUploads;
             if (profile) Profile().gpu += timer.lap();
             if (dump) {
-                static std::mutex dumpMutex;
+                static AgcDriver::Mutex dumpMutex;
                 static std::map<std::uint64_t, int> dumped;
                 std::lock_guard lock(dumpMutex);
                 auto& count = dumped[descriptor.baseAddress];
@@ -640,7 +642,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory repacked copy");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory repacked copy", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory repacked copy");
 
         const auto viewLevelCount = std::min(descriptor.lastLevel, descriptor.mipCount - 1u) - descriptor.baseLevel + 1u;
@@ -687,6 +689,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         imageInfo.arrayLayers = copyLayers;
         imageInfo.samples = VK_SAMPLE_COUNT_1_BIT;
         imageInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+        imageInfo.flags = SrgbTwinFormat(context, blockFormat) != VK_FORMAT_UNDEFINED ? VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT : 0u;
         imageInfo.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_SAMPLED_BIT;
         imageInfo.sharingMode = VK_SHARING_MODE_EXCLUSIVE;
         imageInfo.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
@@ -698,7 +701,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory block copy");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory block copy", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory block copy");
 
         const auto viewLevelCount = std::min(descriptor.lastLevel, descriptor.mipCount - 1u) - descriptor.baseLevel + 1u;
@@ -716,6 +719,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         viewRange = {viewInfo.viewType, viewInfo.subresourceRange.levelCount, viewInfo.subresourceRange.layerCount};
         createFirstLayerView(descriptor, viewInfo);
         prepareBaseLevelView(descriptor, viewInfo);
+        prepareSrgbView(descriptor, viewInfo);
     } catch (...) {
         release();
         throw;
@@ -756,7 +760,7 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         allocation.allocationSize = requirements.size;
         allocationBytes = requirements.size;
         allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth copy");
+        owned->Allocate(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory depth copy", true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, owned->memory, 0), "vkBindImageMemory depth copy");
 
         const auto viewLevelCount = std::min(descriptor.lastLevel, descriptor.mipCount - 1u) - descriptor.baseLevel + 1u;
@@ -1035,6 +1039,9 @@ Texture::Texture(const Context& context, const std::shared_ptr<StorageTexture>&
         }
         VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
         viewInfo.image = source->Image();
+        VkImageViewUsageCreateInfo usage{VK_STRUCTURE_TYPE_IMAGE_VIEW_USAGE_CREATE_INFO};
+        usage.usage = VK_IMAGE_USAGE_SAMPLED_BIT;
+        viewInfo.pNext = &usage;
         viewInfo.viewType = ViewTypeFor(descriptor.dimension, viewLayerCount);
         viewInfo.format = vkFormat;
         viewFormat = vkFormat;
@@ -1192,13 +1199,24 @@ VkBufferMemoryBarrier WholeBufferBarrier(VkBuffer buffer, VkAccessFlags from, Vk
     return barrier;
 }
 
+VkFormat PackedStorageViewFormat(VkFormat format) {
+    switch (format) {
+        case VK_FORMAT_R5G6B5_UNORM_PACK16:
+        case VK_FORMAT_A1R5G5B5_UNORM_PACK16:
+        case VK_FORMAT_B4G4R4A4_UNORM_PACK16:
+            return VK_FORMAT_R16_UINT;
+        default:
+            return VK_FORMAT_UNDEFINED;
+    }
+}
+
 // Storage images cannot use sRGB formats; the shader works on the raw encoded values either way.
 // The answer is a property of the physical device, so it is computed once per format (every storage
 // image lookup asks: a live vkGetPhysicalDeviceFormatProperties call each time was measurable) and
 // remembered as VK_FORMAT_UNDEFINED when the format has no storage form.
 VkFormat StorageFormatOrUndefined(const Context& context, VkFormat format) {
     struct Table {
-        std::mutex mutex;
+        AgcDriver::Mutex mutex;
         std::unordered_map<std::uint64_t, VkFormat> formats;
     };
     static Table table;
@@ -1215,7 +1233,10 @@ VkFormat StorageFormatOrUndefined(const Context& context, VkFormat format) {
         return (properties.optimalTilingFeatures & VK_FORMAT_FEATURE_STORAGE_IMAGE_BIT) != 0;
     };
     VkFormat storage = VK_FORMAT_UNDEFINED;
-    if (supports(format)) {
+    const auto packed = PackedStorageViewFormat(format);
+    if (packed != VK_FORMAT_UNDEFINED) {
+        if (supports(packed)) storage = format;
+    } else if (supports(format)) {
         storage = format;
     } else {
         VkFormat linear = VK_FORMAT_UNDEFINED;
@@ -1312,7 +1333,10 @@ VkFormat SrgbTwinFormat(const Context& context, VkFormat format) {
     switch (format) {
         case VK_FORMAT_R8_UNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8_SRGB;
         case VK_FORMAT_R8G8_UNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8_8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8G8_SRGB;
-        case VK_FORMAT_R8G8B8A8_UNORM: return VK_FORMAT_R8G8B8A8_SRGB;
+        case VK_FORMAT_R8_SNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8_SRGB;
+        case VK_FORMAT_R8G8_SNORM: return decoded(ShaderRecompiler::IrBufferFormat::Format8_8Srgb) ? VK_FORMAT_UNDEFINED : VK_FORMAT_R8G8_SRGB;
+        case VK_FORMAT_R8G8B8A8_UNORM:
+        case VK_FORMAT_R8G8B8A8_SNORM: return VK_FORMAT_R8G8B8A8_SRGB;
         case VK_FORMAT_B8G8R8A8_UNORM: return VK_FORMAT_B8G8R8A8_SRGB;
         case VK_FORMAT_A8B8G8R8_UNORM_PACK32: return VK_FORMAT_A8B8G8R8_SRGB_PACK32;
         case VK_FORMAT_BC1_RGB_UNORM_BLOCK: return VK_FORMAT_BC1_RGB_SRGB_BLOCK;
@@ -1327,7 +1351,7 @@ VkFormat SrgbTwinFormat(const Context& context, VkFormat format) {
 VkFormat AttachmentProxyFormat(const Context& context, VkFormat format) {
     if (format != VK_FORMAT_R8_SRGB) return VK_FORMAT_UNDEFINED;
     struct Table {
-        std::mutex mutex;
+        AgcDriver::Mutex mutex;
         std::unordered_map<VkPhysicalDevice, VkFormat> formats;
     };
     static Table table;
@@ -1431,7 +1455,7 @@ StorageTexture::StorageTexture(const Context& context, TextureDetiler& detiler,
         allocation.allocationSize = requirements.size;
         memoryBytes = requirements.size;
         allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "storage texture");
-        memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory storage texture", &memoryType);
+        memory = AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory storage texture", &memoryType, true);
         Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, image, memory, 0), "vkBindImageMemory storage");
     } catch (...) {
         release();
@@ -1698,7 +1722,7 @@ bool AdjacentGenerationEnabled() {
 }
 
 bool ClearKeepsDenormals(const Context& context, VkFormat format) {
-    static std::mutex mutex;
+    static AgcDriver::Mutex mutex;
     static std::map<std::pair<VkDevice, VkFormat>, bool> known;
     std::lock_guard lock(mutex);
     if (const auto found = known.find({context.device, format}); found != known.end()) return found->second;
@@ -1793,9 +1817,10 @@ VkImageView StorageTexture::createView(std::uint32_t mip, bool firstLayer, VkFor
     Require(!firstLayer || descriptor.dimension == TextureDimension::k2DArray, "a first-layer storage view needs a 2D array surface");
     const auto viewLayerCount = firstLayer ? 1u : geometry.imageLayers - descriptor.baseArray;
     VkImageViewUsageCreateInfo usage{VK_STRUCTURE_TYPE_IMAGE_VIEW_USAGE_CREATE_INFO};
-    usage.usage = VK_IMAGE_USAGE_STORAGE_BIT;
+    const bool packed = PackedStorageViewFormat(storageFormat) != VK_FORMAT_UNDEFINED;
+    usage.usage = packed && format == storageFormat ? VK_IMAGE_USAGE_SAMPLED_BIT | (attachable ? VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT : 0u) : VK_IMAGE_USAGE_STORAGE_BIT;
     VkImageViewCreateInfo viewInfo{VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO};
-    viewInfo.pNext = format == storageFormat ? nullptr : &usage;
+    viewInfo.pNext = format == storageFormat && !packed ? nullptr : &usage;
     viewInfo.image = image;
     // Storage views address one mip; cube faces are written as array layers.
     viewInfo.viewType = firstLayer ? VK_IMAGE_VIEW_TYPE_2D : descriptor.dimension == TextureDimension::k1D ? VK_IMAGE_VIEW_TYPE_1D : descriptor.dimension == TextureDimension::k2D ? VK_IMAGE_VIEW_TYPE_2D : descriptor.dimension == TextureDimension::k3D ? VK_IMAGE_VIEW_TYPE_3D : descriptor.dimension == TextureDimension::k1DArray ? VK_IMAGE_VIEW_TYPE_1D_ARRAY : VK_IMAGE_VIEW_TYPE_2D_ARRAY;
@@ -1971,7 +1996,8 @@ VkImageView StorageTexture::FirstLayerView(std::uint32_t mip) {
 }
 
 VkImageView StorageTexture::StorageView(std::uint32_t mip, bool firstLayer) {
-    const auto format = UintFormatOfSint(storageFormat);
+    const auto packed = PackedStorageViewFormat(storageFormat);
+    const auto format = packed != VK_FORMAT_UNDEFINED ? packed : UintFormatOfSint(storageFormat);
     if (format == VK_FORMAT_UNDEFINED) return firstLayer ? FirstLayerView(mip) : View(mip);
     if (format == VK_FORMAT_R32_UINT) return AtomicView(mip, firstLayer);
     const auto found = uintViews.find({mip, firstLayer});
@@ -2040,16 +2066,22 @@ bool StorageTexture::Refresh() {
 }
 
 bool StorageTexture::RefreshLayers(std::uint32_t first, std::uint32_t count) {
-    if (count == 0 || geometry.thick || geometry.imageLayers <= 1 || first >= geometry.imageLayers || count > geometry.imageLayers - first || geometry.layerBytes == 0 || trackedLayerBytes == 0 || descriptor.dccAddress != 0) return Refresh();
+    const auto whole = [this] {
+        static_cast<void>(FlushDepthPlanes(descriptor.baseAddress, static_cast<std::size_t>(guestBytes)));
+        return Refresh();
+    };
+    if (count == 0 || geometry.thick || geometry.imageLayers <= 1 || first >= geometry.imageLayers || count > geometry.imageLayers - first || geometry.layerBytes == 0 || trackedLayerBytes == 0 || descriptor.dccAddress != 0) return whole();
     const auto begin = geometry.GuestLayerOffset(first);
     const auto end = geometry.GuestLayerOffset(first + count - 1) + geometry.layerBytes;
     const auto firstLayer = static_cast<std::uint32_t>(begin / trackedLayerBytes);
     const auto lastLayer = static_cast<std::uint32_t>(std::min<std::uint64_t>((end + trackedLayerBytes - 1) / trackedLayerBytes, trackedLayers));
-    if (firstLayer >= lastLayer || (firstLayer == 0 && lastLayer == trackedLayers)) return Refresh();
+    if (firstLayer >= lastLayer || (firstLayer == 0 && lastLayer == trackedLayers)) return whole();
     for (std::uint32_t layer = 0; layer < trackedLayers; ++layer) {
-        if (layerPending[layer] && (layer < firstLayer || layer >= lastLayer)) return Refresh();
+        if (layerPending[layer] && (layer < firstLayer || layer >= lastLayer)) return whole();
     }
-    if (pendingAlias() != nullptr) return Refresh();
+    if (pendingAlias() != nullptr) return whole();
+    const auto scopeBegin = layerBegin(firstLayer);
+    static_cast<void>(FlushDepthPlanes(scopeBegin, static_cast<std::size_t>(layerBegin(lastLayer - 1) + layerBytes(lastLayer - 1) - scopeBegin)));
     return refresh(firstLayer, lastLayer);
 }
 
@@ -2057,10 +2089,25 @@ bool StorageTexture::refresh(std::uint32_t firstLayer, std::uint32_t lastLayer)
     const bool profile = LookupOutcomes::Profiled();
     auto start = profile ? std::chrono::steady_clock::now() : std::chrono::steady_clock::time_point{};
     const bool scoped = firstLayer != 0 || lastLayer != trackedLayers;
+    const bool epochProofs = ShaderResources::EpochProofs();
+    const auto epoch = epochProofs ? GuestMemory::CollectEpoch() : 0;
+    if (epoch != 0 && provedEpoch.load(std::memory_order_relaxed) == epoch && provedProof.load(std::memory_order_relaxed) == GuestMemory::ProofSerial() && provedPending.load(std::memory_order_relaxed) == PendingSerial()) {
+        NoteProved();
+        refreshesProved.fetch_add(1, std::memory_order_relaxed);
+        epochRefreshes.fetch_add(1, std::memory_order_relaxed);
+        return true;
+    }
+    const auto proofBefore = GuestMemory::ProofSerial();
+    const auto pendingBefore = PendingSerial();
     CompletePendingCpuWrites(context, descriptor.baseAddress, static_cast<std::size_t>(guestBytes));
     if (descriptor.dccAddress != 0) CompletePendingCpuWrites(context, descriptor.dccAddress, DccKeyBytes(guestBytes));
     if (refreshProved()) {
         layerBehind.clear();
+        if (epoch != 0) {
+            provedEpoch.store(epoch, std::memory_order_relaxed);
+            provedProof.store(proofBefore, std::memory_order_relaxed);
+            provedPending.store(pendingBefore, std::memory_order_relaxed);
+        }
         NoteProved();
         refreshesProved.fetch_add(1, std::memory_order_relaxed);
         if (profile) LookupOutcomes::Add(LookupOutcomes::RefreshProved, start);
@@ -2533,6 +2580,17 @@ bool StorageTexture::compareUntracked(std::uint64_t address, std::size_t bytes,
 
 constexpr std::uint64_t GenerationBaselineBytes = 1ull << 20;
 
+bool SingleKeyColorFor(const GuestTextureResource& resource, std::uint64_t guestBytes, std::uint64_t collected, DccSingleProof& proof, VkFormat format, DccKeys keys, VkClearColorValue& clear) {
+    if (keys != DccKeys::ClearSingle || !ProvedSingleUniform(resource, guestBytes, collected, proof)) return false;
+    const auto elementBytes = BytesPerElement(resource.format);
+    if (elementBytes == 0 || elementBytes > sizeof(std::uint32_t) * 4) return false;
+    std::uint32_t pattern[4]{};
+    auto* bytes = reinterpret_cast<std::byte*>(pattern);
+    if (!ReadSingleElement(resource, std::span(bytes, elementBytes))) return false;
+    for (std::size_t at = elementBytes; at < sizeof(pattern); at += elementBytes) std::memcpy(bytes + at, bytes, elementBytes);
+    return FillClearColor(format, elementBytes, pattern, clear);
+}
+
 std::vector<bool> StorageTexture::cpuUploadLayers(const std::vector<bool>& units) const {
     if (descriptor.dimension != TextureDimension::k2DArray || descriptor.mipCount != 1 || descriptor.dccAddress != 0 || IsBlockCompressed(descriptor.format) || geometry.thick || arrayLayers <= 1 || geometry.imageLayers != arrayLayers || trackedLayerBytes == 0 || units.size() != trackedLayers) return {};
     std::vector<bool> selected(arrayLayers, false);
@@ -2581,7 +2639,8 @@ void StorageTexture::upload(const std::vector<bool>* layers) {
     uploadedKeys = ProvedClearKeys(descriptor, guestBytes, keyProof);
     filledKeys = DccKeys::Uncompressed;
     VkClearColorValue clearValue{};
-    if (IsDccClear(uploadedKeys) && ClearColorFor(storageFormat, uploadedKeys, clearValue)) {
+    const bool fastClear = IsDccClear(uploadedKeys) || uploadedKeys == DccKeys::ClearSingle;
+    if (fastClear && (ClearColorFor(storageFormat, uploadedKeys, clearValue) || SingleKeyColorFor(descriptor, guestBytes, now, singleProof, storageFormat, uploadedKeys, clearValue))) {
         // A fast-cleared surface is cleared on the GPU; its texel memory is neither read nor filled.
         // The clear is recorded into the open batch like a direct upload (the image kept by it): a
         // batch of its own submitted the recorder's work first and waited for all of it, 25-40 ms
@@ -3535,7 +3594,7 @@ std::uint64_t StorageTexture::writeBackWindows(std::span<const ImportSegment> se
         toRead.dstAccessMask = VK_ACCESS_SHADER_READ_BIT;
         toRead.newLayout = VK_IMAGE_LAYOUT_GENERAL;
         const BarrierMask ready{VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, importReady.srcAccessMask | toRead.srcAccessMask, importReady.dstAccessMask | toRead.dstAccessMask, toRead.oldLayout != toRead.newLayout, toRead.srcQueueFamilyIndex != toRead.dstQueueFamilyIndex};
-        const bool ordered = recorder != nullptr && seeds.empty() && padding.copies.empty() && Recorder::ElideCovered(Recorder::CommandClass::StorageWriteBack, ready, covered);
+        const bool ordered = recorder != nullptr && seeds.empty() && padding.copies.empty() && holeCopies.empty() && Recorder::ElideCovered(Recorder::CommandClass::StorageWriteBack, ready, covered);
         if (!ordered) context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, 0, 1, &importReady, 0, nullptr, 1, &toRead);
         for (std::size_t i = 0; i < windows.size(); ++i) {
             const auto& window = windows[i];
@@ -3730,11 +3789,19 @@ void StorageTexture::markLayersPending(std::uint32_t first, std::uint32_t count)
     CaptureTrace::Log("image-write image=%llx first=%u count=%u generation=%llu", static_cast<unsigned long long>(descriptor.baseAddress), first, count, static_cast<unsigned long long>(generation));
     ++writes;
     static const bool eager = std::getenv("APS5_EAGER_WRITEBACK") != nullptr || std::getenv("APS5_NO_TEXTURE_CACHE") != nullptr;
-    std::vector<bool> unsaved(trackedLayers, false);
+    std::vector<bool> unsaved;
     bool anyUnsaved = false;
-    for (std::uint32_t layer = first; layer < first + count; ++layer) {
-        unsaved[layer] = !layerPending[layer] && !layerOriginal[layer] && layerGeneration[layer] == 0;
-        anyUnsaved = anyUnsaved || unsaved[layer];
+    const bool trims = CommitTrims();
+    if (trims) {
+        for (std::uint32_t layer = first; layer < first + count && !anyUnsaved; ++layer) anyUnsaved = !layerPending[layer] && !layerOriginal[layer] && layerGeneration[layer] == 0;
+    }
+    if (!trims || anyUnsaved) {
+        unsaved.assign(trackedLayers, false);
+        anyUnsaved = false;
+        for (std::uint32_t layer = first; layer < first + count; ++layer) {
+            unsaved[layer] = !layerPending[layer] && !layerOriginal[layer] && layerGeneration[layer] == 0;
+            anyUnsaved = anyUnsaved || unsaved[layer];
+        }
     }
     if (anyUnsaved && !GuestMemory::Watched(descriptor.baseAddress, static_cast<std::size_t>(guestBytes))) captureGuestBytes(&unsaved);
     for (std::uint32_t layer = first; layer < first + count; ++layer) layerPending[layer] = true;
@@ -3844,7 +3911,7 @@ void waitForIdlePublish(const char* reason) {
 
 }
 
-bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, const StorageTexture* except, const char* reason, PublishScope scope, bool* published) {
+bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, const StorageTexture* except, const char* reason, PublishScope scope, bool* published, bool waited) {
     static_cast<void>(FlushDepthPlanes(address, bytes));
     if (published != nullptr) *published = false;
     if (AgcDriver::DriverDetail::DrawPipeline::HeldReads(address, bytes)) {
@@ -3883,12 +3950,12 @@ bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, cons
         if (!flush.empty()) BumpPendingSerial();
     }
     if (flush.empty()) {
-        const bool waited = WaitForFlushing(address, bytes, except);
+        const bool stored = WaitForFlushing(address, bytes, except);
         // Units shadowed over the range (another image's results retiled into the import's unit
         // shadow, or an earlier flush's) still reach the import as the scope asks.
-        const bool units = PublishShadowsOnly(address, bytes, scope, reason);
+        const bool units = PublishShadowsOnly(address, bytes, scope, reason, waited || stored);
         if (published != nullptr) *published = units;
-        return waited;
+        return stored;
     }
     struct Unregister {
         const std::vector<std::shared_ptr<StorageTexture>>& flush;
@@ -3936,7 +4003,7 @@ bool StorageTexture::FlushPending(std::uint64_t address, std::size_t bytes, cons
     // The stores above went into the unit shadows where slabs took them: the consumer reads the
     // import, so they are published under the same hold, after every store.
     if (scope != PublishScope::None) {
-        const auto units = PublishShadow(address, bytes, scope, PublishReasonFor(reason));
+        const auto units = PublishShadow(address, bytes, scope, PublishReasonFor(reason), waited);
         if (units != 0) waitForIdlePublish(reason);
         if (published != nullptr) *published = units != 0;
     }
@@ -4100,10 +4167,10 @@ void StorageTexture::awaitStoredSave(const std::vector<bool>* layers) {
     if (outstanding()) recorder->Sync();
 }
 
-bool StorageTexture::PublishShadowsOnly(std::uint64_t address, std::size_t bytes, PublishScope scope, const char* reason) {
+bool StorageTexture::PublishShadowsOnly(std::uint64_t address, std::size_t bytes, PublishScope scope, const char* reason, bool waited) {
     if (scope == PublishScope::None || !AnyShadowedOverlaps(address, bytes)) return false;
     std::lock_guard gpu(GuestMemory::GpuMutex());
-    if (PublishShadow(address, bytes, scope, PublishReasonFor(reason)) == 0) return false;
+    if (PublishShadow(address, bytes, scope, PublishReasonFor(reason), waited) == 0) return false;
     waitForIdlePublish(reason);
     return true;
 }
@@ -4177,6 +4244,20 @@ std::size_t StorageTexture::StoreSmallPending(const char* reason) {
     return stored;
 }
 
+void StorageTexture::StoreReadbackBeforeLabel(const char* reason) {
+    static const bool disabled = std::getenv("APS5_NO_LABEL_READBACK_STORE") != nullptr;
+    if (disabled) return;
+    std::vector<std::pair<std::uint64_t, std::size_t>> ranges;
+    {
+        auto& pending = Pending();
+        std::lock_guard lock(pending.mutex);
+        for (const auto* texture : pending.textures) {
+            if (texture->descriptor.tileMode == TextureTileMode::kLinear || texture->guestBytes <= SmallStoreBytes) ranges.emplace_back(texture->descriptor.baseAddress, static_cast<std::size_t>(texture->guestBytes));
+        }
+    }
+    for (const auto& [address, bytes] : ranges) static_cast<void>(FlushPending(address, bytes, nullptr, reason));
+}
+
 bool StorageTexture::AnyPending() {
     auto& pending = Pending();
     std::lock_guard lock(pending.mutex);
@@ -4242,6 +4323,42 @@ bool PendingStorageOverlaps(std::uint64_t address, std::size_t bytes, const Stor
     return false;
 }
 
+std::uint64_t StorageTexture::StampKeepingNewerResults(std::uint64_t address, std::size_t bytes, std::uint64_t recorded, const std::function<std::uint64_t()>& stamp) {
+    std::vector<std::pair<std::shared_ptr<StorageTexture>, std::uint32_t>> kept;
+    if (recorded != 0 && bytes != 0) {
+        auto& pending = Pending();
+        std::lock_guard lock(pending.mutex);
+        for (auto* texture : pending.textures) {
+            if (!texture->blockUnits || !texture->overlaps(address, bytes)) continue;
+            auto alive = texture->weak_from_this().lock();
+            if (alive == nullptr) continue;
+            for (std::uint32_t unit = 0; unit < texture->trackedLayers; ++unit) {
+                const auto begin = texture->layerBegin(unit);
+                const auto unitBytes = texture->layerBytes(unit);
+                if (!texture->layerPending[unit] || begin >= address + bytes || address >= begin + unitBytes) continue;
+                if (texture->layerGeneration[unit] >= recorded) kept.emplace_back(alive, unit);
+            }
+        }
+    }
+    std::erase_if(kept, [](const auto& entry) {
+        const auto& [texture, unit] = entry;
+        const auto begin = texture->layerBegin(unit);
+        const auto unitBytes = static_cast<std::size_t>(texture->layerBytes(unit));
+        GuestMemory::CollectWritesUncached(begin, unitBytes);
+        return !GuestMemory::UnchangedSince(begin, unitBytes, texture->layerGeneration[unit]);
+    });
+    const auto generation = stamp();
+    if (generation == 0 || kept.empty()) return generation;
+    auto& pending = Pending();
+    std::lock_guard lock(pending.mutex);
+    for (const auto& [texture, unit] : kept) {
+        if (!texture->layerPending[unit]) continue;
+        texture->layerGeneration[unit] = generation;
+        texture->refreshGeneration();
+    }
+    return generation;
+}
+
 bool StorageTexture::AnyPendingOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
     if (ranges.empty()) return false;
     auto& pending = Pending();
@@ -4252,8 +4369,10 @@ bool StorageTexture::AnyPendingOverlaps(std::span<const std::pair<std::uint64_t,
         }
         return false;
     };
-    for (const auto* texture : pending.textures) {
-        if (overlapsAny(texture)) return true;
+    if (std::any_of(ranges.begin(), ranges.end(), [&](const auto& range) { return range.second > range.first && pending.textures.MayOverlap(range.first, static_cast<std::size_t>(range.second - range.first)); })) {
+        for (const auto* texture : pending.textures) {
+            if (overlapsAny(texture)) return true;
+        }
     }
     for (const auto* texture : pending.flushing) {
         if (overlapsAny(texture)) return true;
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp
index c571bd1710..344d80c594 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp
@@ -4,8 +4,6 @@
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libSceAgcDriver/Graphics/shaders/TextureDetile_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/CmaskClear_spv.h"
-#include "prx/libSceAgcDriver/Graphics/shaders/DepthSampleMultisample_spv.h"
-#include "prx/libSceAgcDriver/Graphics/shaders/DepthSampleSingle_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/TextureDetileImage_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/TextureRepack_spv.h"
 #include <algorithm>
@@ -120,11 +118,6 @@ void TextureDetiler::release() noexcept {
     cmaskErrors.reset();
     for (const auto pool : descriptorSets.pools) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
     for (const auto pool : imageDescriptorSets.pools) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
-    for (const auto pool : depthSampleSets.pools) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
-    for (const auto pipeline : depthSamplePipelines) if (pipeline) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, pipeline, nullptr);
-    if (depthSamplePipelineLayout) context.Function<PFN_vkDestroyPipelineLayout>("vkDestroyPipelineLayout")(context.device, depthSamplePipelineLayout, nullptr);
-    if (depthSampleLayout) context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(context.device, depthSampleLayout, nullptr);
-    if (depthSampler) context.Function<PFN_vkDestroySampler>("vkDestroySampler")(context.device, depthSampler, nullptr);
     if (imageModule) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, imageModule, nullptr);
     if (repackPipeline) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, repackPipeline, nullptr);
     if (repackModule) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, repackModule, nullptr);
@@ -402,79 +395,6 @@ void TextureDetiler::DispatchCmaskClear(VkCommandBuffer commands, VkBuffer cmask
     barrier(VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, anyAccess);
 }
 
-void TextureDetiler::DispatchDepthSample(VkCommandBuffer commands, VkImageView depth, bool multisampled, VkImageView target, std::uint32_t width, std::uint32_t height, std::uint32_t sample) {
-    Require(commands != VK_NULL_HANDLE && depth != VK_NULL_HANDLE && target != VK_NULL_HANDLE, "a depth sample copy needs a command buffer, the depth view and the target view");
-    if (depthSamplePipelineLayout == VK_NULL_HANDLE) {
-        VkSamplerCreateInfo samplerInfo{VK_STRUCTURE_TYPE_SAMPLER_CREATE_INFO};
-        samplerInfo.magFilter = VK_FILTER_NEAREST;
-        samplerInfo.minFilter = VK_FILTER_NEAREST;
-        samplerInfo.addressModeU = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
-        samplerInfo.addressModeV = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
-        samplerInfo.addressModeW = VK_SAMPLER_ADDRESS_MODE_CLAMP_TO_EDGE;
-        Check(context.Function<PFN_vkCreateSampler>("vkCreateSampler")(context.device, &samplerInfo, nullptr, &depthSampler), "vkCreateSampler depth sample copy");
-        std::array<VkDescriptorSetLayoutBinding, 2> bindings{};
-        bindings[0] = {0, VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER, 1, VK_SHADER_STAGE_COMPUTE_BIT, &depthSampler};
-        bindings[1] = {1, VK_DESCRIPTOR_TYPE_STORAGE_IMAGE, 1, VK_SHADER_STAGE_COMPUTE_BIT, nullptr};
-        VkDescriptorSetLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
-        layoutInfo.bindingCount = static_cast<std::uint32_t>(bindings.size());
-        layoutInfo.pBindings = bindings.data();
-        Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &layoutInfo, nullptr, &depthSampleLayout), "vkCreateDescriptorSetLayout depth sample copy");
-        const VkPushConstantRange pushRange{VK_SHADER_STAGE_COMPUTE_BIT, 0, 3 * sizeof(std::uint32_t)};
-        VkPipelineLayoutCreateInfo pipelineLayoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
-        pipelineLayoutInfo.setLayoutCount = 1;
-        pipelineLayoutInfo.pSetLayouts = &depthSampleLayout;
-        pipelineLayoutInfo.pushConstantRangeCount = 1;
-        pipelineLayoutInfo.pPushConstantRanges = &pushRange;
-        Check(context.Function<PFN_vkCreatePipelineLayout>("vkCreatePipelineLayout")(context.device, &pipelineLayoutInfo, nullptr, &depthSamplePipelineLayout), "vkCreatePipelineLayout depth sample copy");
-    }
-    auto& depthSamplePipeline = depthSamplePipelines[multisampled ? 1u : 0u];
-    if (depthSamplePipeline == VK_NULL_HANDLE) {
-        VkShaderModuleCreateInfo moduleInfo{VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO};
-        moduleInfo.codeSize = multisampled ? sizeof(DEPTH_SAMPLE_MULTISAMPLE_SPV) : sizeof(DEPTH_SAMPLE_SINGLE_SPV);
-        moduleInfo.pCode = multisampled ? DEPTH_SAMPLE_MULTISAMPLE_SPV : DEPTH_SAMPLE_SINGLE_SPV;
-        VkShaderModule depthModule = VK_NULL_HANDLE;
-        Check(context.Function<PFN_vkCreateShaderModule>("vkCreateShaderModule")(context.device, &moduleInfo, nullptr, &depthModule), "vkCreateShaderModule depth sample copy");
-        VkComputePipelineCreateInfo pipelineInfo{VK_STRUCTURE_TYPE_COMPUTE_PIPELINE_CREATE_INFO};
-        pipelineInfo.stage = {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO};
-        pipelineInfo.stage.stage = VK_SHADER_STAGE_COMPUTE_BIT;
-        pipelineInfo.stage.module = depthModule;
-        pipelineInfo.stage.pName = "main";
-        pipelineInfo.layout = depthSamplePipelineLayout;
-        const auto created = context.Function<PFN_vkCreateComputePipelines>("vkCreateComputePipelines")(context.device, context.pipelineCache, 1, &pipelineInfo, nullptr, &depthSamplePipeline);
-        context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, depthModule, nullptr);
-        Check(created, "vkCreateComputePipelines depth sample copy");
-    }
-    const auto set = allocateFrom(depthSampleSets, depthSampleLayout, {{VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER, 64}, {VK_DESCRIPTOR_TYPE_STORAGE_IMAGE, 64}}, "vkCreateDescriptorPool depth sample copy", "vkAllocateDescriptorSets depth sample copy", "vkResetDescriptorPool depth sample copy");
-    const VkDescriptorImageInfo depthInfo{VK_NULL_HANDLE, depth, VK_IMAGE_LAYOUT_GENERAL};
-    const VkDescriptorImageInfo targetInfo{VK_NULL_HANDLE, target, VK_IMAGE_LAYOUT_GENERAL};
-    std::array<VkWriteDescriptorSet, 2> writes{};
-    for (std::uint32_t index = 0; index < writes.size(); ++index) {
-        writes[index].sType = VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET;
-        writes[index].dstSet = set;
-        writes[index].dstBinding = index;
-        writes[index].descriptorCount = 1;
-        writes[index].descriptorType = index == 0 ? VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER : VK_DESCRIPTOR_TYPE_STORAGE_IMAGE;
-    }
-    writes[0].pImageInfo = &depthInfo;
-    writes[1].pImageInfo = &targetInfo;
-    context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, static_cast<std::uint32_t>(writes.size()), writes.data(), 0, nullptr);
-    const auto barrier = [&](VkPipelineStageFlags source, VkPipelineStageFlags destination, VkAccessFlags sourceAccess, VkAccessFlags destinationAccess) {
-        VkMemoryBarrier memory{VK_STRUCTURE_TYPE_MEMORY_BARRIER};
-        memory.srcAccessMask = sourceAccess;
-        memory.dstAccessMask = destinationAccess;
-        context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, source, destination, 0, 1, &memory, 0, nullptr, 0, nullptr);
-    };
-    constexpr VkAccessFlags anyWrite = VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_WRITE_BIT | VK_ACCESS_HOST_WRITE_BIT;
-    constexpr VkAccessFlags anyAccess = anyWrite | VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_READ_BIT | VK_ACCESS_DEPTH_STENCIL_ATTACHMENT_READ_BIT | VK_ACCESS_HOST_READ_BIT;
-    barrier(VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, anyWrite, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT);
-    context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, depthSamplePipeline);
-    context.Function<PFN_vkCmdBindDescriptorSets>("vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, depthSamplePipelineLayout, 0, 1, &set, 0, nullptr);
-    const std::array<std::uint32_t, 3> push{width, height, sample};
-    context.Function<PFN_vkCmdPushConstants>("vkCmdPushConstants")(commands, depthSamplePipelineLayout, VK_SHADER_STAGE_COMPUTE_BIT, 0, sizeof(push), push.data());
-    context.Function<PFN_vkCmdDispatch>("vkCmdDispatch")(commands, (width + 7u) / 8u, (height + 7u) / 8u, 1);
-    barrier(VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_SHADER_WRITE_BIT, anyAccess);
-}
-
 void TextureDetiler::DispatchImage(VkCommandBuffer commands, TextureTileMode tileMode, std::uint32_t elementBytes, VkBuffer tiled, std::uint64_t tiledOffset, VkImageView view, const TileMipLayout& layout, bool retile, std::uint32_t slice, const DetileWindow& window) {
     Require(commands != VK_NULL_HANDLE, "texture detiling requires an active command buffer");
     Require(window.rangeBegin < window.rangeEnd && window.tiledBase <= window.rangeBegin, "texture detiling window is empty");
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/UnitShadow.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/UnitShadow.cpp
index cd2998c06b..94b0655305 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/UnitShadow.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/UnitShadow.cpp
@@ -22,7 +22,7 @@ namespace {
 
 constexpr std::uint64_t UnitBytes = 65536;
 constexpr std::size_t ReasonCount = static_cast<std::size_t>(PublishReason::Count);
-constexpr const char* ReasonNames[ReasonCount] = {"hook", "region", "indirect", "copy-src", "copy-dst", "fill", "fill-clear", "label", "keys", "scanout", "validate", "upload", "tail", "evict", "retire", "teardown"};
+constexpr const char* ReasonNames[ReasonCount] = {"hook", "region", "indirect", "copy-src", "copy-dst", "fill", "fill-clear", "label", "keys", "scanout", "validate", "upload", "tail", "evict", "retire", "teardown", "address"};
 
 std::uint64_t BudgetBytes() {
     static const std::uint64_t budget = [] {
@@ -454,6 +454,7 @@ PublishReason PublishReasonFor(const char* flushReason) {
     if (is("packet store")) return PublishReason::Label;
     if (is("buffer copy count") || is("dispatch-cache entry")) return PublishReason::Validate;
     if (is("storage image creation") || is("storage refresh")) return PublishReason::Upload;
+    if (is("address-based heaps")) return PublishReason::Address;
     return PublishReason::Hook;
 }
 
@@ -472,9 +473,9 @@ ShadowSlabPin::~ShadowSlabPin() {
     slab->pins.fetch_sub(1, std::memory_order_relaxed);
 }
 
-std::size_t PublishShadow(std::uint64_t address, std::size_t bytes, PublishScope scope, PublishReason reason) {
+std::size_t PublishShadow(std::uint64_t address, std::size_t bytes, PublishScope scope, PublishReason reason, bool waited) {
     if (!UnitShadowEnabled() || scope == PublishScope::None || bytes == 0) return 0;
-    if (Recorder::InCompletion() && GuestMemory::CurrentReadSite() == GuestMemory::ReadSite::Store) {
+    if (!waited && Recorder::InCompletion() && GuestMemory::CurrentReadSite() == GuestMemory::ReadSite::Store) {
         // The store's own stamp makes the unit stale; a publish recorded now would land over the
         // store when the batch runs (the completion is not waited for).
         Stats().skippedInCompletion.fetch_add(1, std::memory_order_relaxed);
@@ -492,11 +493,11 @@ std::size_t PublishShadow(std::uint64_t address, std::size_t bytes, PublishScope
     return units;
 }
 
-bool AnyShadowedOverlaps(std::uint64_t address, std::size_t bytes) {
-    if (!UnitShadowEnabled() || bytes == 0) return false;
+namespace {
+
+bool anyShadowedLocked(const Shadows& registry, std::uint64_t address, std::size_t bytes) {
+    if (bytes == 0) return false;
     const auto end = bytes > std::numeric_limits<std::uint64_t>::max() - address ? std::numeric_limits<std::uint64_t>::max() : address + bytes;
-    auto& registry = Registry();
-    std::lock_guard lock(registry.mutex);
     return anyOverlapping(registry, address, end, [&](const std::shared_ptr<UnitShadow>& shadow) {
         if (shadow->liveUnits == 0) return false;
         const auto begin = std::max(address, shadow->importBase);
@@ -508,10 +509,21 @@ bool AnyShadowedOverlaps(std::uint64_t address, std::size_t bytes) {
     });
 }
 
+}
+
+bool AnyShadowedOverlaps(std::uint64_t address, std::size_t bytes) {
+    if (!UnitShadowEnabled() || bytes == 0) return false;
+    auto& registry = Registry();
+    std::lock_guard lock(registry.mutex);
+    return anyShadowedLocked(registry, address, bytes);
+}
+
 bool AnyShadowedOverlaps(std::span<const std::pair<std::uint64_t, std::uint64_t>> ranges) {
-    if (!UnitShadowEnabled()) return false;
+    if (!UnitShadowEnabled() || ranges.empty()) return false;
+    auto& registry = Registry();
+    std::lock_guard lock(registry.mutex);
     for (const auto& [begin, end] : ranges) {
-        if (end > begin && AnyShadowedOverlaps(begin, static_cast<std::size_t>(end - begin))) return true;
+        if (end > begin && anyShadowedLocked(registry, begin, static_cast<std::size_t>(end - begin))) return true;
     }
     return false;
 }
diff --git a/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp b/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp
index d2485e8727..8d49017a87 100644
--- a/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp
+++ b/core/libs/prx/libSceAgcDriver/Resource/include/Lifecycle.hpp
@@ -1,4 +1,13 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_RESOURCE_INCLUDE_LIFECYCLE_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_RESOURCE_INCLUDE_LIFECYCLE_HPP
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceAgcDriverInitResourceRegistration(void);
+uint32_t APS5_VABI sceAgcDriverQueryResourceRegistrationUserMemoryRequirements(uint64_t* sizeInBytes);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp b/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp
index d30f27839a..6cbdcce863 100644
--- a/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp
+++ b/core/libs/prx/libSceAgcDriver/Resource/include/Registration.hpp
@@ -5,4 +5,33 @@
 
 extern "C" bool AgcDriverWorkloadStreamRegistered_nid_postfix(std::uint32_t streamId);
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDriverRegisterOwner(uint32_t* ownerHandle, const char* name);
+int APS5_VABI sceAgcDriverRegisterResource(uint32_t* resourceHandle, uint32_t ownerHandle, const void* memory, size_t size, const char* name, uint32_t type, uint64_t userData);
+int APS5_VABI sceAgcDriverRegisterMultipleResources(uint32_t* resourceHandle, uint32_t ownerHandle, const void* resources, uint32_t resourceCount);
+int APS5_VABI sceAgcDriverRegisterWorkloadStream(uint32_t streamId, const void* stream);
+int APS5_VABI sceAgcDriverUnregisterOwnerAndResources(uint32_t ownerHandle);
+int APS5_VABI sceAgcDriverUnregisterResource(uint32_t resourceHandle);
+int APS5_VABI sceAgcDriverRegisterGdsResource(uint32_t* resourceHandle, uint32_t ownerHandle, uint32_t gdsOffset, uint32_t gdsSize, const char* name, uint32_t type, uint64_t userData);
+int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(uint32_t ownerHandle);
+int APS5_VABI sceAgcDriverUnregisterWorkloadStream(uint32_t streamId);
+int APS5_VABI sceAgcDriverGetDefaultOwner(uint32_t* ownerHandle);
+int APS5_VABI sceAgcDriverGetResourceRegistrationMaxNameLength(uint32_t* maxLength);
+int APS5_VABI sceAgcDriverGetOwnerName(uint32_t ownerHandle, const char** name);
+int APS5_VABI sceAgcDriverGetResourceName(uint32_t resourceHandle, const char** name);
+int APS5_VABI sceAgcDriverGetResourceType(uint32_t resourceHandle, uint32_t* type);
+int APS5_VABI sceAgcDriverGetResourceUserData(uint32_t resourceHandle, uint64_t* userData);
+int APS5_VABI sceAgcDriverSetResourceUserData(uint32_t resourceHandle, uint64_t userData);
+int APS5_VABI sceAgcDriverGetResourceBaseAddressAndSizeInBytes(uint32_t resourceHandle, void** memory, size_t* size);
+int APS5_VABI sceAgcDriverGetResourceShaderGuid(uint32_t resourceHandle, void* guid);
+int APS5_VABI sceAgcDriverFindResourcesPublic(const void* callback, void* userData);
+int APS5_VABI sceAgcDriverRegisterOwnerForSystem();
+int APS5_VABI sceAgcDriverInitResourceRegistrationInterface();
+int APS5_VABI sceAgcDriverSetResourceRegistrationInfo();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp b/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp
index f3fbd0ba67..7cae8c3afb 100644
--- a/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp
+++ b/core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp
@@ -9,6 +9,9 @@
 // Resource registration feeds GPU debugging tools, none of which are attached; the game treats this code as benign.
 static constexpr int SCE_AGC_ERROR_RESOURCE_REGISTRATION_UNAVAILABLE = static_cast<int>(0x8A6C9018);
 static constexpr uint32_t RESOURCE_REGISTRATION_MAX_NAME_LENGTH = 0xfc;
+static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID = static_cast<int>(0x8A6C0033);
+static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_NULL = static_cast<int>(0x8A6C0035);
+static constexpr int SCE_AGC_ERROR_WORKLOAD_STREAM_NOT_REGISTERED = static_cast<int>(0x8A6C003A);
 static constexpr uint32_t WORKLOAD_STREAM_MIN_ID = 1;
 static constexpr uint32_t WORKLOAD_STREAM_MAX_ID = 31;
 
@@ -49,10 +52,11 @@ int APS5_VABI sceAgcDriverRegisterMultipleResources(uint32_t* resourceHandle, ui
 }
 
 int APS5_VABI sceAgcDriverRegisterWorkloadStream(uint32_t stream_id, const void* stream) {
- if (stream != nullptr && stream_id >= WORKLOAD_STREAM_MIN_ID && stream_id <= WORKLOAD_STREAM_MAX_ID) {
-  std::lock_guard lock(g_workloadStreamLock);
-  g_workloadStreams |= 1u << stream_id;
- }
+ if (stream_id < WORKLOAD_STREAM_MIN_ID || stream_id > WORKLOAD_STREAM_MAX_ID) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID;
+ std::lock_guard lock(g_workloadStreamLock);
+ if ((g_workloadStreams & (1u << stream_id)) != 0) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID;
+ if (stream == nullptr) return SCE_AGC_ERROR_WORKLOAD_STREAM_NULL;
+ g_workloadStreams |= 1u << stream_id;
  return 0;
 }
 
@@ -83,10 +87,10 @@ int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(uint32_t owner_handle)
 }
 
 int APS5_VABI sceAgcDriverUnregisterWorkloadStream(uint32_t stream_id) {
-    if (stream_id >= WORKLOAD_STREAM_MIN_ID && stream_id <= WORKLOAD_STREAM_MAX_ID) {
-        std::lock_guard lock(g_workloadStreamLock);
-        g_workloadStreams &= ~(1u << stream_id);
-    }
+    if (stream_id < WORKLOAD_STREAM_MIN_ID || stream_id > WORKLOAD_STREAM_MAX_ID) return SCE_AGC_ERROR_WORKLOAD_STREAM_INVALID_ID;
+    std::lock_guard lock(g_workloadStreamLock);
+    if ((g_workloadStreams & (1u << stream_id)) == 0) return SCE_AGC_ERROR_WORKLOAD_STREAM_NOT_REGISTERED;
+    g_workloadStreams &= ~(1u << stream_id);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp b/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp
index aadd076ce7..54c8fc2cca 100644
--- a/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp
+++ b/core/libs/prx/libSceAgcDriver/State/include/Configuration.hpp
@@ -1,4 +1,14 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_CONFIGURATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_CONFIGURATION_HPP
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDriverSetHsOffchipParam(uint64_t value0, uint64_t value1, uint64_t value2);
+int APS5_VABI sceAgcDriverSetTFRing(const volatile void* base, uint32_t size);
+int APS5_VABI sceAgcDriverGetTFRing(uintptr_t* base, uint32_t* size);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/State/include/Status.hpp b/core/libs/prx/libSceAgcDriver/State/include/Status.hpp
index d7184e323f..822d5016ab 100644
--- a/core/libs/prx/libSceAgcDriver/State/include/Status.hpp
+++ b/core/libs/prx/libSceAgcDriver/State/include/Status.hpp
@@ -1,4 +1,17 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_STATUS_HPP
 #define CORE_LIBS_PRX_LIBSCEAGCDRIVER_STATE_INCLUDE_STATUS_HPP
 
+#include "SceTypes.hpp"
+
+extern "C" {
+
+bool APS5_VABI sceAgcDriverIsCaptureInProgress(void);
+bool APS5_VABI sceAgcDriverIsTraceInProgress(void);
+bool APS5_VABI sceAgcDriverIsSubmitValidationEnabled(void);
+int APS5_VABI sceAgcDriverRequestCaptureStart(const char* path);
+int APS5_VABI sceAgcDriverRequestCaptureStop();
+int APS5_VABI sceAgcDriverTriggerCapture();
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/State/src/Status.cpp b/core/libs/prx/libSceAgcDriver/State/src/Status.cpp
index ae1a8543f7..825a9e9001 100644
--- a/core/libs/prx/libSceAgcDriver/State/src/Status.cpp
+++ b/core/libs/prx/libSceAgcDriver/State/src/Status.cpp
@@ -5,6 +5,12 @@
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int CAPTURE_UNAVAILABLE = static_cast<int>(0x8A6C1000);
+
+}
+
 extern "C" {
 
 bool APS5_VABI sceAgcDriverIsCaptureInProgress(void) {
@@ -21,18 +27,15 @@ bool APS5_VABI sceAgcDriverIsSubmitValidationEnabled(void) {
 
 int APS5_VABI sceAgcDriverRequestCaptureStart(const char* path) {
     (void)path;
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return CAPTURE_UNAVAILABLE;
 }
 
 int APS5_VABI sceAgcDriverRequestCaptureStop() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return CAPTURE_UNAVAILABLE;
 }
 
 int APS5_VABI sceAgcDriverTriggerCapture() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return CAPTURE_UNAVAILABLE;
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp b/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp
index d6d7244c58..d39b6ce6e9 100644
--- a/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp
+++ b/core/libs/prx/libSceAgcDriver/Submit/include/Acb.hpp
@@ -4,6 +4,6 @@
 #include "SceTypes.hpp"
 
 extern "C" int APS5_VABI sceAgcDriverSubmitAcb(std::uint32_t queue, const Packet* packet);
-extern "C" int APS5_VABI sceAgcDriverSubmitMultiAcbs(std::uint32_t queue, std::uint32_t* const* acbs, const std::uint32_t* sizes_in_dwords, std::uint32_t count);
+extern "C" int APS5_VABI sceAgcDriverSubmitMultiAcbs(std::uint32_t queue, std::uint32_t* const* acbs, const std::uint32_t* sizesInDwords, std::uint32_t count);
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp b/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp
index 52fb4cb31d..bf355fbe65 100644
--- a/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp
+++ b/core/libs/prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp
@@ -4,12 +4,10 @@
 #include "SceTypes.hpp"
 #include <cstdint>
 
-struct Packet;
-
 extern "C" {
 
-int APS5_VABI sceAgcDriverSubmitCommandBuffer(void* queue_context, const Packet* packet);
-int APS5_VABI sceAgcDriverSubmitMultiCommandBuffers(void* queue_context, uint32_t* const* command_buffers, const uint32_t* sizes_in_dwords, uint32_t count);
+int APS5_VABI sceAgcDriverSubmitCommandBuffer(void* queueContext, const Packet* packet);
+int APS5_VABI sceAgcDriverSubmitMultiCommandBuffers(void* queueContext, uint32_t* const* commandBuffers, const uint32_t* sizesInDwords, uint32_t count);
 
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp b/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp
index 9e8fe9fdf7..78cfda269b 100644
--- a/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp
+++ b/core/libs/prx/libSceAgcDriver/Submit/include/Dcb.hpp
@@ -18,4 +18,15 @@ extern "C" int APS5_VABI sceAgcDriverAgrSubmitDcb(const Packet* packet);
 extern "C" int APS5_VABI sceAgcDriverSubmitMultiDcbs(std::uint32_t* const* dcbGpuAddrs, const std::uint32_t* dcbSizesInDwords, std::uint32_t count);
 extern "C" int APS5_VABI sceAgcDriverAgrSubmitMultiDcbs(std::uint32_t* const* dcbGpuAddrs, const std::uint32_t* dcbSizesInDwords, std::uint32_t count);
 
+extern "C" {
+
+std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadsActivePacketSize();
+std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadCompletePacketSize();
+std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadStreamInactivePacketSize();
+std::uint32_t APS5_VABI sceAgcDriverNopDataGetPacketSize(std::uint32_t bytes);
+std::uint32_t APS5_VABI sceAgcDriverUserDataGetPacketSize(std::uint32_t bytes);
+std::uint32_t APS5_VABI sceAgcDriverWaitUntilSafeForRendering(std::uint32_t** command, std::uint32_t capacity, std::uint32_t mode, std::uint32_t handle, int index);
+
+}
+
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/Unimplemented.cpp b/core/libs/prx/libSceAgcDriver/Unimplemented.cpp
index be639faf70..f361aacbe8 100644
--- a/core/libs/prx/libSceAgcDriver/Unimplemented.cpp
+++ b/core/libs/prx/libSceAgcDriver/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -57,6 +58,16 @@ int APS5_VABI sceAgcDriverGetHsOffchipParam(uint16_t* first, uint16_t* second) {
     return 0;
 }
 
+int APS5_VABI sceAgcDriverNopDataWritePacket(void* destination, uint32_t address, const void* data, uint32_t bytes) {
+    const auto alignedBytes = (static_cast<std::uint64_t>(bytes) + 3) & ~std::uint64_t{3};
+    const auto totalBytes = alignedBytes + 8;
+    std::memset(destination, 0, static_cast<std::size_t>(totalBytes));
+    const auto header = (static_cast<std::uint32_t>(totalBytes) << 14) + 0x3ffe0000U | 0xc0001000U;
+    std::memcpy(destination, &header, sizeof(header));
+    std::memcpy(static_cast<std::byte*>(destination) + 4, &address, sizeof(address));
+    if (data != nullptr && bytes != 0) std::memcpy(static_cast<std::byte*>(destination) + 8, data, bytes);
+    return data == nullptr || bytes == 0 ? 2 : static_cast<int>(totalBytes / 4);
+}
 
 int APS5_VABI sceAgcDriverSetValidationDisabled() {
     return DEBUG_UNAVAILABLE;
@@ -154,9 +165,8 @@ int APS5_VABI sceAgcDriverAcquireHDRScopesACQ() {
     return 0;
 }
 
-int APS5_VABI sceAgcDriverGetCoredumpAddress() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI sceAgcDriverGetCoredumpAddress() {
+    return nullptr;
 }
 
 int APS5_VABI sceAgcDriverHp3dLockEnd() {
@@ -174,19 +184,13 @@ int APS5_VABI sceAgcDriverIsEsvmProcess() {
     return 0;
 }
 
-int APS5_VABI sceAgcDriverNopDataWritePacket() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAgcDriverReleaseHDRScopesACQ() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceAgcDriverSetTargetRingForDiag() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return DRIVER_FEATURE_UNAVAILABLE;
 }
 
 int APS5_VABI sceAgcDriverSetValueToSharedGds() {
diff --git a/core/libs/prx/libSceAgcDriver/include/AgcDriver.hpp b/core/libs/prx/libSceAgcDriver/include/AgcDriver.hpp
new file mode 100644
index 0000000000..6c6e8fea9b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/include/AgcDriver.hpp
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDriverAcquireRazorACQ(void);
+int APS5_VABI sceAgcDriverCreateQueue(void);
+int APS5_VABI sceAgcDriverCwsrResumeAcq(void);
+int APS5_VABI sceAgcDriverCwsrSuspendAcq(void);
+int APS5_VABI sceAgcDriverDebugHardwareStatus(void);
+int APS5_VABI sceAgcDriverDestroyQueue(void);
+int APS5_VABI sceAgcDriverGetPaDebugInterfaceVersion(void);
+int APS5_VABI sceAgcDriverGetRegShadowInfo(void);
+int APS5_VABI sceAgcDriverGetRegShadowInfoAgr(void);
+int APS5_VABI sceAgcDriverGetReservedDmemForAgc(void);
+int APS5_VABI sceAgcDriverGetWorkloadStreamInfo(void);
+int APS5_VABI sceAgcDriverIDHSSubmit(void);
+int APS5_VABI sceAgcDriverModuleRegistration(void);
+int APS5_VABI sceAgcDriverNotifyDefaultStates(void);
+int APS5_VABI sceAgcDriverPassInfoDownward(void);
+int APS5_VABI sceAgcDriverPatchClearState(void);
+int APS5_VABI sceAgcDriverSetFlip(void);
+int APS5_VABI sceAgcDriverSetHsOffchipParamDirect(void);
+int APS5_VABI sceAgcDriverSetWorkloadComplete(void);
+int APS5_VABI sceAgcDriverSetWorkloadsActive(void);
+int APS5_VABI sceAgcDriverSetupAsyncGraphics(void);
+int APS5_VABI sceAgcDriverSetupRegisterShadow(void);
+int APS5_VABI sceAgcDriverSubmitMultiCommandBuffersDirect(void);
+int APS5_VABI sceAgcDriverSubmitToHDRScopesACQ(void);
+int APS5_VABI sceAgcDriverSubmitToRazorACQ(void);
+int APS5_VABI sceAgcDriverSuspendPointSubmit(void);
+int APS5_VABI sceAgcDriverSuspendPointSubmitDirect(void);
+int APS5_VABI sceAgcDriverSysEnableSubmitDone45Exception(void);
+int APS5_VABI sceAgcDriverSysGetClientNumber(void);
+int APS5_VABI sceAgcDriverSysIsGameClosed(void);
+int APS5_VABI sceAgcDriverTmpInitIdhs(void);
+int APS5_VABI sceAgcDriverUserDataWritePacket(void);
+int APS5_VABI sceAgcDriverUserDataWritePopMarker(void);
+int APS5_VABI sceAgcDriverUserDataWritePushMarker(void);
+int APS5_VABI sceAgcDriverUserDataWriteSetMarker(void);
+int APS5_VABI sceAgcDriverGetShaderDebuggingStatus();
+int APS5_VABI sceAgcDriverRegisterDefaultOwner(uint32_t owner);
+int APS5_VABI sceAgcDriverSetValidationErrorOutputFrequency(uint32_t frequency);
+int APS5_VABI sceAgcDriverSetSubmitValidationMode(uint32_t mode);
+int APS5_VABI sceAgcDriverGetSubmitValidationConfig(void* config);
+int APS5_VABI sceAgcDriverGetSubmitValidationMode(uint32_t* mode);
+int APS5_VABI sceAgcDriverSetSubmitValidationConfig(const void* config);
+int APS5_VABI sceAgcDriverGetHsOffchipParam(uint16_t* first, uint16_t* second);
+int APS5_VABI sceAgcDriverNopDataWritePacket(void* destination, uint32_t address, const void* data, uint32_t bytes);
+int APS5_VABI sceAgcDriverSetValidationDisabled();
+int APS5_VABI sceAgcDriverGetCaptureConfig();
+int APS5_VABI sceAgcDriverSetCaptureConfig();
+int APS5_VABI sceAgcDriverGetGpuPrintfWorkArea();
+int APS5_VABI sceAgcDriverSetGpuPrintfEnabled();
+int APS5_VABI sceAgcDriverDbgReadRegister();
+int APS5_VABI sceAgcDriverDbgWriteRegister();
+int APS5_VABI sceAgcDriverGetGpuRefClks();
+int APS5_VABI sceAgcDriverIsSuspendPointInFlight();
+int APS5_VABI sceAgcDriverIsPaDebug();
+int APS5_VABI sceAgcDriverGetExceptionStatus();
+int APS5_VABI sceAgcDriverGetTraceInitiator();
+int APS5_VABI sceAgcDriverRegisterGpuResetCallbacks();
+int APS5_VABI sceAgcDriverUnregisterGpuResetCallbacks();
+int APS5_VABI sceAgdResetGpu();
+int APS5_VABI sceAgcDriverSysSubmitFlipHandleProxy();
+int APS5_VABI sceAgcDriverUserDataImmediateWrite();
+int APS5_VABI sceAgcDriverUserDataImmediateWritePacket();
+int APS5_VABI sceAgcDriverGetCoredumpMode(uint32_t* mode);
+int APS5_VABI sceAgcDriverAllocateToolMemoryForGpuReset(uint64_t, uint64_t, uint64_t, void* range);
+int APS5_VABI sceAgcDriverGetAllocatedToolMemoryForGpuReset(uint64_t, void* range);
+int APS5_VABI sceAgcDriverAcquireHDRScopesACQ();
+void* APS5_VABI sceAgcDriverGetCoredumpAddress();
+int APS5_VABI sceAgcDriverHp3dLockEnd();
+int APS5_VABI sceAgcDriverHp3dLockStart();
+int APS5_VABI sceAgcDriverIsEsvmProcess();
+int APS5_VABI sceAgcDriverReleaseHDRScopesACQ();
+int APS5_VABI sceAgcDriverSetTargetRingForDiag();
+int APS5_VABI sceAgcDriverSetValueToSharedGds();
+int APS5_VABI sceAgcDriverSetWorkloadStreamInactive();
+int APS5_VABI sceAgcDriverSubmitReprojectionAcb();
+int APS5_VABI sceAgcDriverSuspendPointSubmitCdbg();
+int APS5_VABI sceAgcDriverSysGetGfxAppGpuResetStatus();
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/libSceAgcDriver.hpp b/core/libs/prx/libSceAgcDriver/libSceAgcDriver.hpp
new file mode 100644
index 0000000000..342610270a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/libSceAgcDriver.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgcDriver/Eq/include/Query.hpp"
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Lifecycle.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Registration.hpp"
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
+#include "prx/libSceAgcDriver/State/include/Status.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include "prx/libSceAgcDriver/Submit/include/CommandBuffer.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
diff --git a/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp b/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp
index f334f4b036..a370fe2802 100644
--- a/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/AsyncLog.cpp
@@ -243,7 +243,12 @@ void FullQueueBlocksCaller() {
 constexpr int ChildLines = 50;
 
 [[noreturn]] void EndChild(const std::string& mode, const char* output) {
-    std::FILE* file = std::fopen(output, "wb");
+    const auto path = std::filesystem::temp_directory_path() / output;
+#ifdef _WIN32
+    std::FILE* file = _wfopen(path.c_str(), L"wb");
+#else
+    std::FILE* file = std::fopen(path.c_str(), "wb");
+#endif
     Check(file != nullptr, "child output file");
 #ifdef _WIN32
     SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
@@ -288,12 +293,18 @@ std::string Quote(const std::string& text) {
 
 void LinesSurviveEnd(const std::string& self, const std::string& mode) {
     const auto output = std::filesystem::temp_directory_path() / ("aps5-async-log-" + mode + "-" + std::to_string(Clock::now().time_since_epoch().count()) + ".txt");
-    std::string command = Quote(self) + " child " + mode + " " + Quote(output.string());
 #ifdef _WIN32
-    command = Quote(command);
-#endif
+    (void)self;
+    std::wstring executable(32768, L'\0');
+    executable.resize(GetModuleFileNameW(nullptr, executable.data(), static_cast<DWORD>(executable.size())));
+    const std::wstring command = L"\"\"" + executable + L"\" child " + std::filesystem::path(mode).wstring() + L" \"" + output.filename().wstring() + L"\"\"";
+    const auto start = Clock::now();
+    const int status = _wsystem(command.c_str());
+#else
+    const std::string command = Quote(self) + " child " + mode + " " + Quote(output.filename().string());
     const auto start = Clock::now();
     const int status = std::system(command.c_str());
+#endif
     const auto lived = Clock::now() - start;
     std::error_code error;
     const bool started = std::filesystem::exists(output, error);
diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
index e4ea60da83..c2c44c6aed 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
@@ -237,6 +237,77 @@ void importSpanTests(const Context& context) {
     ::operator delete(block, std::align_val_t{piece});
 }
 
+void importRunGrowthTests(const Context& context) {
+    constexpr std::size_t piece = 65536;
+    void* block = ::operator new(2 * piece, std::align_val_t{piece});
+    auto* guest = static_cast<std::uint8_t*>(block);
+    const auto first = reinterpret_cast<std::uintptr_t>(block);
+    std::memset(block, 0x3c, 2 * piece);
+    auto importing = context;
+    importing.hostImportAlignment = piece;
+    const auto change = [&](void* range, std::size_t bytes, bool add) {
+        GuestAllocations::Mutation mutation;
+        if (add) mutation.Add(range, bytes, true, false, true);
+        else mutation.Remove(range);
+    };
+    const auto build = [&](std::size_t pieces, const std::string& step) {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.AddReadable(first + 64, 16);
+        leased.Upload(true);
+        const auto ranges = leased.AddressRanges();
+        leased.WriteBack();
+        Require(std::any_of(ranges.begin(), ranges.end(), [&](const auto& range) { return range.begin <= first && first + pieces * piece <= range.end; }), "the import of a run does not cover its " + std::to_string(pieces) + " registered pieces " + step);
+    };
+    change(guest, piece, true);
+    build(1, "before its neighbour was registered");
+    change(guest + piece, piece, true);
+    build(2, "after its neighbour was registered");
+    change(guest, 0, false);
+    change(guest + piece, 0, false);
+    ::operator delete(block, std::align_val_t{piece});
+}
+
+void importRunReplacedTests(const Context& context) {
+    constexpr std::size_t piece = 65536;
+    void* block = ::operator new(3 * piece, std::align_val_t{piece});
+    auto* guest = static_cast<std::uint8_t*>(block);
+    const auto first = reinterpret_cast<std::uintptr_t>(block);
+    std::memset(block, 0x3c, 3 * piece);
+    auto importing = context;
+    importing.hostImportAlignment = piece;
+    const auto add = [&](void* range, bool writable) {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(range, piece, true, writable, true);
+    };
+    const auto remove = [&](void* range) {
+        GuestAllocations::Mutation mutation;
+        mutation.Remove(range);
+    };
+    const auto build = [&](std::size_t pieces, const std::string& step) {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.AddReadable(first + 64, 16);
+        leased.Upload(true);
+        const auto ranges = leased.AddressRanges();
+        leased.WriteBack();
+        Require(std::any_of(ranges.begin(), ranges.end(), [&](const auto& range) { return range.begin <= first && first + pieces * piece <= range.end; }), "the import of a run does not cover its " + std::to_string(pieces) + " registered pieces " + step);
+    };
+    add(guest, true);
+    add(guest + piece, false);
+    add(guest + 2 * piece, true);
+    build(1, "while the read-only middle piece ends it");
+    for (int round = 0; round < 4; ++round) {
+        remove(guest + piece);
+        add(guest + piece, round % 2 == 0);
+        build(round % 2 == 0 ? 3 : 1, "after the middle piece was replaced by one that " + std::string(round % 2 == 0 ? "continues" : "ends") + " the run, with as many ranges registered as before");
+    }
+    remove(guest);
+    remove(guest + piece);
+    remove(guest + 2 * piece);
+    ::operator delete(block, std::align_val_t{piece});
+}
+
 void spaceWritableWritesTests(const Context& context) {
     if (!AddressSpaceCounters().enabled) return;
     constexpr std::size_t piece = 65536;
@@ -531,6 +602,9 @@ void importJoinTests(const Context& context) {
     Require(pieces != nullptr && pieces->base == heapBase && pieces->bytes == 2 * piece && piecesBuffer == pieces->buffer && piecesCopied == 0, "a buffer bound exactly over two pieces no larger than the import window was not imported as one");
     change(heap + 2 * piece, piece, true);
     static_cast<void>(bind(heapBase + 2 * piece - 16));
+    const auto [prefixBuffer, prefixCopied] = bind(heapBase, 2 * piece + 16);
+    const auto* prefix = HostImportFor(importing, heapBase, 2 * piece + 16);
+    Require(prefix != nullptr && prefix->base == heapBase && prefix->bytes == 3 * piece && prefixBuffer == prefix->buffer && prefixCopied == 0, "a buffer bound from the first of three pieces into the last was not imported over the pieces it crosses");
     const auto* kept = HostImportFor(importing, first, 16);
     Require(kept != nullptr && kept->buffer == joinedBuffer && kept->bytes == 2 * large, "a registry change elsewhere re-imported the joined ranges");
     change(guest + 2 * large, large, true);
@@ -809,7 +883,7 @@ private:
 
 void importMappedFailureGenerationTests(const Context& context) {
     ClearHostImports(context.device);
-    WindowedRange range(context, WindowedRange::piece, 1);
+    WindowedRange range(context, 2 * WindowedRange::piece, 1);
     ImportAllocationProbe probe(range.importing);
     probe.failure = VK_ERROR_INVALID_EXTERNAL_HANDLE;
     GuestAllocations::Mapped mapped;
@@ -840,8 +914,10 @@ void importMappedFailureGenerationTests(const Context& context) {
     {
         std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
         Require(ImportMappedRanges(range.importing, mapped, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true), "the replacement owner map import was deferred");
-        Require(probe.calls.size() == 2u, "a replacement owner did not retry its predecessor's failed import");
+        Require(probe.calls.size() == 1u, "a replacement owner was imported again at map instead of on first use");
     }
+    HostImportFor(range.importing, range.First(), range.bytes);
+    Require(probe.calls.size() == 2u, "a replacement owner did not retry its predecessor's failed import on first use");
     ClearHostImports(context.device);
 }
 
@@ -950,6 +1026,34 @@ void importRefusedWholeRangeTests(const Context& context) {
     Require(kept != nullptr && kept->buffer == buffer, "the range's window was imported again after a refused whole-range import");
 }
 
+void importPiecesOverAllocationLimitTests(const Context& context) {
+    WindowedRange range(context, 2 * WindowedRange::piece, 5);
+    const auto first = range.First();
+    const auto limit = 3 * range.window;
+    SetHostImportMaxBytes(limit);
+    {
+        GuestBufferMemory leased(range.importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        std::uint64_t covered = first;
+        for (const auto& entry : leased.AddressRanges()) {
+            if (entry.end <= first || entry.begin >= first + range.bytes) continue;
+            Require(entry.begin == covered, "the pieces of a range over the allocation limit leave a gap or overlap in the BDA table");
+            Require(entry.end - entry.begin <= limit, "a BDA table entry of a range over the allocation limit is larger than the limit");
+            const auto* piece = ExistingHostImportFor(range.importing, entry.begin, static_cast<std::size_t>(entry.end - entry.begin));
+            Require(piece != nullptr && piece->bytes <= limit && entry.deviceAddress == piece->address + (entry.begin - piece->base), "a BDA table entry of a range over the allocation limit is not served in place by an import within the limit");
+            covered = entry.end;
+        }
+        Require(covered == first + range.bytes, "the pieces of a range over the allocation limit do not cover it");
+        for (std::uint64_t at = first; at < first + range.bytes; at += range.window) {
+            const auto* piece = ExistingHostImportFor(range.importing, at, 16);
+            Require(piece != nullptr && piece->bytes <= limit, "a range over the allocation limit has an import larger than the limit");
+        }
+        leased.WriteBack();
+    }
+    SetHostImportMaxBytes(0);
+}
+
 // Two uses across neighbouring cell edges of one range, each in a build of its own, share one import: the second grows
 // the first's window to their union, and later rounds of both keep it. Before, each replaced the other's window at
 // every use.
@@ -979,7 +1083,8 @@ void importNeighbouringEdgesTests(const Context& context) {
 // A range mapped while the imports are at the budget is refused at map time without retiring an import: the map
 // observer holds no GPU lock, so it must not evict (before, it evicted the least recently used import to fit).
 void importAtMapOverBudgetTests(const Context& context) {
-    constexpr std::size_t bytes = 65536;
+    ClearHostImports(context.device);
+    constexpr std::size_t bytes = 2 * 65536;
     auto importing = context;
     importing.hostImportAlignment = bytes;
     void* kept = ::operator new(bytes, std::align_val_t{bytes});
@@ -1023,6 +1128,7 @@ void importAtMapOverBudgetTests(const Context& context) {
 }
 
 void importRequesterTests(const Context& context, const BdaTestAccess& access) {
+    ClearHostImports(context.device);
     constexpr std::size_t piece = 65536;
     constexpr std::size_t pieces = 8;
     auto* block = static_cast<std::uint8_t*>(::operator new(pieces * piece, std::align_val_t{piece}));
@@ -1039,17 +1145,32 @@ void importRequesterTests(const Context& context, const BdaTestAccess& access) {
     const auto counted = [](ImportRequester requester) { return HostImportCounters().requesters[static_cast<std::size_t>(requester)]; };
     const auto made = [&](ImportRequester requester) { return counted(requester).made; };
     Require(std::string(ImportRequesterName(ImportRequester::Map)) == "map" && std::string(ImportRequesterName(ImportRequester::Build)) == "build" && std::string(ImportRequesterName(ImportRequester::Access)) == "access" && std::string(ImportRequesterName(ImportRequester::Join)) == "join" && std::string(ImportRequesterName(ImportRequester::Segment)) == "segment", "an import requester has the wrong name");
-    change(0, true);
-    {
+    const auto mappedRange = [&](std::size_t index) {
         GuestAllocations::Mapped ranges;
         const auto lease = GuestAllocations::GuestAllocationsAcquire_nid_postfix();
         for (const auto& range : lease) {
-            if (range->address == address(0)) ranges.push_back(range);
+            if (range->address == address(index)) ranges.push_back(range);
         }
         Require(ranges.size() == 1, "the requester test's mapped range is not registered");
+        return ranges;
+    };
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block + 6 * piece, 2 * piece, true, true, true);
+    }
+    {
         const auto before = made(ImportRequester::Map);
-        static_cast<void>(ImportMappedRanges(importing, ranges, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true));
-        Require(made(ImportRequester::Map) == before + 1 && HostImportCovers(importing, address(0), piece), "a range imported at map time was not counted for the map requester");
+        static_cast<void>(ImportMappedRanges(importing, mappedRange(6), GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true));
+        Require(made(ImportRequester::Map) == before + 1 && HostImportCovers(importing, address(6), 2 * piece), "a range imported at map time was not counted for the map requester");
+    }
+    change(0, true);
+    {
+        const auto map = made(ImportRequester::Map);
+        const auto access = made(ImportRequester::Access);
+        static_cast<void>(ImportMappedRanges(importing, mappedRange(0), GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true));
+        Require(made(ImportRequester::Map) == map && !HostImportCovers(importing, address(0), 16), "a range of 64 KiB was imported at map time");
+        Require(HostImportFor(importing, address(0), 16) != nullptr && HostImportCovers(importing, address(0), piece) && made(ImportRequester::Access) == access + 1 && made(ImportRequester::Map) == map,
+            "a range of 64 KiB left to its first GPU use was not imported there, or not counted for that use's requester");
     }
     change(1, true);
     {
@@ -1127,6 +1248,10 @@ void importRequesterTests(const Context& context, const BdaTestAccess& access) {
     const auto counts = HostImportCounters();
     Require(counts.live >= 4 && counts.liveBytes == HostImportLiveBytes(), "the live import counts disagree with the live bytes");
     for (std::size_t index = 0; index < 6; ++index) change(index, false);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Remove(block + 6 * piece);
+    }
     ClearHostImports(importing.device);
     ::operator delete(block, std::align_val_t{piece});
 }
@@ -1148,7 +1273,7 @@ public:
     static constexpr std::size_t Window = std::size_t{8} << 20u;
 
     explicit PieceWindow(const Context& context, bool views = false) : importing(context) {
-#ifndef _WIN32
+#ifdef __linux__
         if (views) {
             reserved = mmap(nullptr, 2 * Window, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
             Require(reserved != MAP_FAILED, "cannot reserve the block of 16 KiB views");
@@ -1331,6 +1456,18 @@ void importBlockFailureTests(const Context& context, const BdaTestAccess& access
     Require(window.Imports(0, PieceWindow::Window) == 1 && window.Block(0, PieceWindow::Window), "a block that failed was not tried again after one of its ranges was mapped again: " + blockText(window, 0, PieceWindow::Window));
 }
 
+void importRunFailureShrinkTests(const Context& context, const BdaTestAccess& access) {
+    PieceWindow window(context);
+    constexpr auto half = PieceWindow::Window / 2;
+    window.AddPieces(0, PieceWindow::Window);
+    Require(HostImportFor(window.importing, window.Address(0), 16) != nullptr && window.Block(0, PieceWindow::Window), "a window of registered pieces was not imported as one 8 MiB block: " + blockText(window, 0, PieceWindow::Window));
+    ClearHostImports(window.importing.device);
+    access.limitImports(half);
+    Require(HostImportFor(window.importing, window.Address(0), 16) != nullptr && window.Block(0, half), "a lookup on an unchanged registry whose 8 MiB block failed after an earlier lookup did not shrink to the 4 MiB block: " + blockText(window, 0, PieceWindow::Window));
+    access.limitImports(std::nullopt);
+    Require(HostImportFor(window.importing, window.Address(half), 16) != nullptr && window.Block(0, half) && window.Block(half, half), "a lookup on an unchanged registry after its 8 MiB block failed imported the failed block again: " + blockText(window, 0, PieceWindow::Window));
+}
+
 void importBlockBudgetTests(const Context& context) {
     PieceWindow window(context);
     constexpr std::size_t MiB = std::size_t{1} << 20u;
@@ -2055,6 +2192,119 @@ ShaderRecompiler::DescriptorBinding binding(Role role, std::uint32_t slot) {
     return {ShaderRecompiler::DescriptorKind::StorageBuffer, role, 0, slot, 1, {}, false};
 }
 
+void partialHeapImportBudgetCase(const Context& context, const BdaTestAccess& access, std::size_t bytes, std::size_t budgetBytes, std::size_t prefixBytes) {
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) return;
+    constexpr std::size_t window = 2 * 65536;
+    const auto allocated = bytes + 65536;
+    void* block = GuestArena::GuestArenaAllocate_nid_postfix(allocated, 65536);
+#ifdef _WIN32
+    GuestArena::GuestArenaCommit_nid_postfix(block, allocated, PAGE_READWRITE, allocated);
+#endif
+    auto* guest = static_cast<std::uint8_t*>(block);
+    std::memset(block, 0x39, bytes);
+    std::memset(guest + bytes, 0xa7, allocated - bytes);
+    const auto first = reinterpret_cast<std::uintptr_t>(block);
+    auto importing = context;
+    importing.hostImportAlignment = 65536;
+    const auto live = HostImportLiveBytes();
+    const auto before = MirrorCounters();
+    SetHostImportRangeWindow(window);
+    SetHostImportBudget(live + budgetBytes);
+    const auto registry = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, block, bytes, true, true, true);
+        else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, block);
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    registry(true);
+    {
+        auto withoutImports = context;
+        withoutImports.hostImportAlignment = 0;
+        GuestBufferMemory leased(withoutImports);
+        leased.AcquireRegistered();
+        leased.AddWritable(first + bytes - 16, 4);
+        leased.Upload(true);
+        std::uint32_t adjustment = 0;
+        const auto view = leased.Descriptor(first + bytes - 16, 4, adjustment);
+        access.bytes(view.buffer)[view.offset + adjustment] = std::byte{0x43};
+        leased.WriteBack();
+    }
+    Require(MirrorCounters().heapBytes == before.heapBytes + bytes && guest[bytes - 16] == 0x43, "the partial-import fixture did not start with a valid full heap mirror");
+    GuestAllocations::GuestAllocationsEnd_nid_postfix(GuestAllocations::GuestAllocationsBegin_nid_postfix());
+    const auto build = [&](bool write) {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        if (write) {
+            leased.AddWritable(first + 16, 32);
+            leased.AddWritable(first + bytes - 48, 32);
+        }
+        leased.Upload(true);
+        const auto* prefix = ExistingHostImportFor(importing, first, window);
+        Require(prefix != nullptr, "a heap exceeding the import budget did not import its fitting prefix");
+        Require(HostImportLiveBytes() <= live + budgetBytes, "partial heap imports exceeded the configured budget");
+        Require(MirrorCounters().heapBytes == before.heapBytes + bytes - prefixBytes, "a partially imported heap mirrored bytes already imported in place");
+        auto covered = first;
+        for (const auto& entry : leased.AddressRanges()) {
+            if (entry.end <= first || entry.begin >= first + bytes) continue;
+            Require(entry.begin == covered && entry.end <= first + bytes, "partial heap BDA ranges have a gap or overlap");
+            if (entry.end <= first + prefixBytes) {
+                const auto* imported = ExistingHostImportFor(importing, entry.begin, static_cast<std::size_t>(entry.end - entry.begin));
+                Require(imported != nullptr && imported->bytes <= window && entry.deviceAddress == imported->address + entry.begin - imported->base, "the partial heap prefix is not served by bounded imports");
+            }
+            if (entry.begin >= first + prefixBytes) {
+                std::uint32_t adjustment = 0;
+                const auto view = leased.Descriptor(entry.begin, static_cast<std::size_t>(entry.end - entry.begin), adjustment);
+                const auto data = access.bytes(view.buffer).subspan(view.offset + adjustment);
+                Require(data[0] == static_cast<std::byte>(guest[entry.begin - first]) && data[entry.end - entry.begin - 1] == static_cast<std::byte>(guest[entry.end - first - 1]), "a partial heap mirror lost its first or last bytes");
+            }
+            covered = entry.end;
+        }
+        Require(covered == first + bytes, "a partially imported heap does not cover its registered range");
+        if (write) {
+            for (const auto at : {first + 16, first + bytes - 48}) {
+                if (at < first + prefixBytes) guest[at - first] = 0x71;
+                else {
+                    std::uint32_t adjustment = 0;
+                    const auto view = leased.Descriptor(at, 32, adjustment);
+                    access.bytes(view.buffer)[view.offset + adjustment] = std::byte{0x71};
+                }
+                guest[at - first + 8] = 0x52;
+            }
+        }
+        leased.WriteBack();
+    };
+    build(true);
+    Require(guest[16] == 0x71 && guest[24] == 0x52 && guest[bytes - 48] == 0x71 && guest[bytes - 40] == 0x52, "partial heap write-back lost GPU or genuine CPU stores");
+    guest[bytes - 1] = 0x67;
+    build(false);
+    const auto quiet = MirrorCounters();
+    guest[bytes + 9] = 0x8a;
+    build(false);
+    Require(MirrorCounters().blocksCopied == quiet.blocksCopied, "a neighboring CPU write refreshed an unrelated partial heap mirror");
+    Require(guest[bytes + 9] == 0x8a && guest[bytes] == 0xa7 && guest[allocated - 1] == 0xa7, "partial heap uses changed unregistered neighboring memory");
+    registry(false);
+    {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        leased.WriteBack();
+    }
+    Require(MirrorCounters().heapBytes == before.heapBytes, "a partial heap mirror outlived its registered range");
+    SetHostImportBudget(0);
+    SetHostImportRangeWindow(std::uint64_t{64} << 20u);
+    GuestArena::GuestArenaReset_nid_postfix(block, allocated);
+    GuestArena::GuestArenaRelease_nid_postfix(block, allocated);
+}
+
+void partialHeapImportBudgetTests(const Context& context, const BdaTestAccess& access) {
+    constexpr std::size_t window = 2 * 65536;
+    partialHeapImportBudgetCase(context, access, 3 * window, 2 * window, 2 * window);
+    partialHeapImportBudgetCase(context, access, 3 * window + 65536, 3 * window, 2 * window);
+    SetHostImportMaxBytes(window);
+    partialHeapImportBudgetCase(context, access, 3 * window, 2 * window, 2 * window);
+    SetHostImportMaxBytes(0);
+}
+
 void importedHeapMirrorTests(const Context& context, const BdaTestAccess& access) {
     if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
         std::cout << "guest arena unavailable or not write-watched: heap mirrors of imported ranges not tested\n";
@@ -2813,7 +3063,7 @@ bool RunSparseBufferHoleTests(const Context& context, const BdaTestAccess& acces
                 std::memset(reservation.data + 2 * unit, 0x72, unit);
                 VkBuffer seeded = VK_NULL_HANDLE;
                 {
-                    Buffer seed(context, copied, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+                    Buffer seed(context, copied, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT);
                     std::fill(seed.Bytes().begin(), seed.Bytes().end(), std::byte{0xa5});
                     seeded = seed.Handle();
                 }
@@ -3048,6 +3298,63 @@ void RunSparseHeapMirrorUnwatchTests(const Context& context, const BdaTestAccess
     std::cout << "an address-based build keeps and refreshes a sparse heap's mirror once its range has left the write watch\n";
 }
 
+void RunSparseHeapMirrorBudgetTests(const Context& context, const BdaTestAccess& access) {
+    constexpr std::size_t block = 65536;
+    constexpr std::size_t reserved = 128 * block;
+    constexpr std::size_t committed = 80 * block;
+#ifdef _WIN32
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
+        std::cout << "guest arena unavailable or not write-watched: sparse heaps past the heap mirror budget not tested\n";
+        return;
+    }
+    auto* guest = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(reserved, block));
+    Require(guest != nullptr, "cannot allocate the sparse heap in the guest arena");
+    GuestArena::GuestArenaCommit_nid_postfix(guest, committed, PAGE_READWRITE, block);
+#else
+    if (!GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) {
+        std::cout << "write watch unavailable: sparse heaps past the heap mirror budget not tested\n";
+        return;
+    }
+    auto* guest = reserveSparse(reserved, committed);
+    GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(guest, reserved);
+#endif
+    std::memset(guest, 0x5a, committed);
+    const auto base = reinterpret_cast<std::uintptr_t>(guest);
+    const auto registry = [&](bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, guest, reserved, true, true, true);
+        else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, guest);
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    registry(true);
+    const auto before = MirrorCounters();
+    {
+        GuestBufferMemory memory(context);
+        memory.AddWritable(base, reserved);
+        memory.Upload(false);
+        std::uint32_t adjustment = 0;
+        const auto view = memory.Descriptor(base, reserved, adjustment);
+        const auto bytes = access.bytes(view.buffer);
+        Require(adjustment == 0 && view.range >= committed && bytes[view.offset + committed - 1] == std::byte{0x5a}, "a sparse heap past the heap mirror budget was not copied up to its last committed byte");
+        bytes[view.offset + 8] = std::byte{0x77};
+        memory.WriteBack();
+    }
+    Require(guest[8] == std::byte{0x77}, "a store to a sparse heap copied past the heap mirror budget was not written back");
+    const auto after = MirrorCounters();
+    Require(after.sparseBinds == before.sparseBinds && after.heapMirrors == before.heapMirrors && after.heapBytes == before.heapBytes, "a sparse heap past the heap mirror budget was mirrored or left heap mirror bytes held");
+    registry(false);
+    ClearImageMirrors(context.device);
+    ClearSnapshotCopies(context.device);
+#ifdef _WIN32
+    GuestArena::GuestArenaReset_nid_postfix(guest, reserved);
+    GuestArena::GuestArenaRelease_nid_postfix(guest, reserved);
+#else
+    GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(guest, reserved);
+    releaseSparse(guest, reserved);
+#endif
+    std::cout << "a sparse heap whose mirror would pass the heap mirror budget is copied\n";
+}
+
 void RunHeapMirrorRunUnwatchTests(const Context& context, const BdaTestAccess& access) {
     constexpr std::size_t block = 65536;
     constexpr std::size_t heapBytes = 32 * block;
@@ -3482,6 +3789,8 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     addressTableKeyTests();
     snapshotTableTests(context, access);
     importSpanTests(context);
+    importRunGrowthTests(context);
+    importRunReplacedTests(context);
     failedImportRemapTests(context, access);
     spaceImportRunTests(context);
     spaceWritableWritesTests(context);
@@ -3499,12 +3808,13 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     importMappedFailureGenerationTests(context);
     importStaleProbeTests(context, access);
     importRefusedWholeRangeTests(context);
+    importPiecesOverAllocationLimitTests(context);
     importNeighbouringEdgesTests(context);
     importAtMapOverBudgetTests(context);
     importRequesterTests(context, access);
     hostImportReportTests();
     importBlockMapTests(context, false);
-#ifndef _WIN32
+#ifdef __linux__
     importBlockMapTests(context, true);
 #endif
     importBlockBuildTests(context);
@@ -3513,6 +3823,7 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     importBlockFlagTests(context);
     importBlockRemapTests(context);
     importBlockFailureTests(context, access);
+    importRunFailureShrinkTests(context, access);
     importBlockBudgetTests(context);
     importRefusalMemoryTests(context);
     evictingRefusalMemoryTests(context);
@@ -3530,6 +3841,7 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     importReportRefusalMemoryTests(context, access);
     sparseImportedHeapTests(context, access);
     heapMirrorTests(context, access);
+    partialHeapImportBudgetTests(context, access);
     importedHeapMirrorTests(context, access);
     importWatchTests();
     importedFreshTests(context);
diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp b/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp
index 6aea082fff..49cd994d6e 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BdaTests.hpp
@@ -19,6 +19,7 @@ void RunBdaResourceTests(const AgcDriver::Graphics::Context& context, const BdaT
 bool RunSparseBufferHoleTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
 void RunHeapMirrorUnwatchTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access, bool throughImport);
 void RunSparseHeapMirrorUnwatchTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
+void RunSparseHeapMirrorBudgetTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
 void RunHeapMirrorRunUnwatchTests(const AgcDriver::Graphics::Context& context, const BdaTestAccess& access);
 void RunGuestAllocationTests();
 void RunGuestLeaseWaitTests();
diff --git a/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp b/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp
index abdf8f0166..66ec1aa305 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BufferPool.cpp
@@ -11,6 +11,7 @@
 #include <deque>
 #include <initializer_list>
 #include <map>
+#include <limits>
 #include <memory>
 #include <new>
 #include <set>
@@ -675,6 +676,7 @@ struct ReclaimMock {
     VkDeviceSize externalBytes = 0;
     std::uint64_t requests = 0;
     VkDeviceSize asked = 0;
+    bool newImage = false;
 };
 
 ReclaimMock reclaimMock;
@@ -689,7 +691,8 @@ VkDeviceMemory ExternalAllocation(VkDeviceSize bytes) {
     return memory;
 }
 
-VkDeviceSize mockCacheReclaim(VkDeviceSize bytes) {
+VkDeviceSize mockCacheReclaim(VkDeviceSize bytes, bool newImage) {
+    Expect(newImage == reclaimMock.newImage, "an allocation used the wrong image-creation cache access");
     ++reclaimMock.requests;
     reclaimMock.asked = bytes;
     if (reclaimMock.external == VK_NULL_HANDLE) return 0;
@@ -701,6 +704,10 @@ VkDeviceSize mockCacheReclaim(VkDeviceSize bytes) {
 void CacheReclaimRecovery() {
     Expect(BufferPool::ReclaimTarget(4 * MiB) == 260 * MiB, "a 4 MiB request does not ask the caches for 256 MiB on top of itself");
     Expect(BufferPool::ReclaimTarget(512 * MiB) == 1024 * MiB, "a 512 MiB request does not ask the caches for twice its size");
+    const auto limit = std::numeric_limits<VkDeviceSize>::max();
+    Expect(BufferPool::ReclaimTarget(limit / 2u) == limit - 1u, "the largest doubled request without overflow lost its reserve");
+    Expect(BufferPool::ReclaimTarget(limit / 2u + 1u) == limit, "a reclaim target wrapped when twice the request overflowed");
+    Expect(BufferPool::ReclaimTarget(limit) == limit, "the largest reclaim request wrapped to a smaller target");
     constexpr auto usage = VK_BUFFER_USAGE_STORAGE_BUFFER_BIT;
     mock = MockDevice{};
     reclaimMock = ReclaimMock{};
@@ -775,18 +782,23 @@ void ImageCacheReclaim() {
     VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
     allocation.allocationSize = 8 * MiB;
     allocation.memoryTypeIndex = 0;
-    const auto refuse = [&](std::initializer_list<VkResult> results) {
+    const auto refuse = [&](std::initializer_list<VkResult> results, bool newImage = false) {
         ExternalAllocation(4 * MiB);
+        reclaimMock.newImage = newImage;
         mock.results = results;
         const auto requests = reclaimMock.requests;
-        const auto memory = AllocateImageMemory(context, allocation, 3, "vkAllocateMemory texture");
+        const auto before = mock.attempts;
+        const auto memory = AllocateImageMemory(context, allocation, 3, "vkAllocateMemory texture", nullptr, newImage);
         Expect(reclaimMock.requests == requests + 1 && reclaimMock.external == VK_NULL_HANDLE, "a texture refused device memory did not release the texture caches before retrying");
+        Expect(mock.attempts == before + results.size() + 1, "image recovery or host fallback exceeded its bounded attempts");
         const auto type = mock.memoryTypes.at(memory);
         mockFreeMemory(VK_NULL_HANDLE, memory, nullptr);
         return type;
     };
     Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY}) == 0, "a texture was placed in host memory although releasing the texture caches made room in device memory");
     Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY, VK_ERROR_OUT_OF_DEVICE_MEMORY}) == 1, "a texture still refused device memory after releasing the texture caches was not placed in host memory");
+    Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY}, true) == 0, "a new image was placed in host memory before retrying after cache release");
+    Expect(refuse({VK_ERROR_OUT_OF_DEVICE_MEMORY, VK_ERROR_OUT_OF_DEVICE_MEMORY}, true) == 1, "a new image refused device memory after cache release lost its host fallback");
     Expect(mock.liveBytes == 0, "a texture allocation leaked memory");
 }
 
@@ -832,6 +844,103 @@ void AllocationFailureReportsHeapBudgets() {
     Expect(diagnosticBudgetQueries == 0, "missing-extension fallback attempted a memory budget query");
 }
 
+Context reclaimContext() {
+    auto context = mockContext();
+    context.memory.memoryHeapCount = 2;
+    context.memory.memoryHeaps[0] = {4096 * MiB, VK_MEMORY_HEAP_DEVICE_LOCAL_BIT};
+    context.memory.memoryHeaps[1] = {8192 * MiB, 0};
+    context.memory.memoryTypes[1].heapIndex = 1;
+    return context;
+}
+
+void IdleDeviceReclaim() {
+    mock = MockDevice{};
+    {
+        auto context = reclaimContext();
+        VkBuffer cold;
+        VkBuffer nextCold;
+        VkBuffer hot;
+        VkBuffer host;
+        VkBuffer small;
+        { DeviceBuffer buffer(context, 2 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); cold = buffer.Handle(); }
+        { DeviceBuffer buffer(context, 3 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); nextCold = buffer.Handle(); }
+        { DeviceBuffer buffer(context, 4 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); hot = buffer.Handle(); }
+        { Buffer buffer(context, 8 * MiB, VK_BUFFER_USAGE_TRANSFER_SRC_BIT); host = buffer.Handle(); }
+        { Buffer buffer(context, 1024, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT); small = buffer.Handle(); }
+        DeviceBuffer active(context, 16 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+        auto& pool = *context.bufferPool;
+        const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+        Expect(pool.ReclaimIdleDevice(MiB, start) == 0, "the first pressure observation reclaimed a buffer without an idle interval");
+        Expect(pool.ReclaimIdleDevice(MiB, start + std::chrono::milliseconds(999)) == 0, "a partial idle interval reclaimed a buffer");
+        {
+            DeviceBuffer reused(context, 4 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+            Expect(reused.Handle() == hot, "the warm device buffer was not reused");
+        }
+        const auto next = start + std::chrono::seconds(1);
+        SetAllocationFailureCountdown(0);
+        bool threw = false;
+        try {
+            pool.ReclaimIdleDevice(MiB, next);
+        } catch (const std::bad_alloc&) {
+            threw = true;
+        }
+        SetAllocationFailureCountdown(-1);
+        Expect(threw && mock.liveBuffers.contains(cold) && mock.liveBuffers.contains(nextCold), "a failed reclaim collection lost ownership of an allocation");
+        Expect(pool.ReclaimIdleDevice(MiB, next) == 2 * MiB, "reclaim did not release exactly the oldest complete idle allocation");
+        Expect(!mock.liveBuffers.contains(cold) && mock.liveBuffers.contains(nextCold), "bounded reclaim released the wrong allocation or exceeded its request");
+        Expect(pool.ReclaimIdleDevice(0, next) == 0, "zero pressure released a buffer");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next) == 3 * MiB, "reclaim counted a hot, live, host or slab allocation as idle device memory");
+        for (const auto buffer : {hot, host, small, active.Handle()}) Expect(mock.liveBuffers.contains(buffer), "reclaim destroyed a protected buffer");
+        SetAllocationFailureCountdown(0);
+        const auto empty = pool.ReclaimIdleDevice(32 * MiB, next);
+        SetAllocationFailureCountdown(-1);
+        Expect(empty == 0, "an unchanged empty eligible set did not stay empty");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, start) == 0, "a backwards time observation reclaimed a buffer");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next + std::chrono::seconds(1)) == 4 * MiB, "a device buffer did not become reclaimable after a complete idle interval");
+        Expect(mock.liveBuffers.contains(active.Handle()), "reclaim touched an allocation still in use");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next + std::chrono::seconds(2)) == 0, "an empty device tier reported reclaimed memory");
+    }
+    Expect(mock.liveBytes == 0 && mock.liveBuffers.empty(), "idle device reclaim leaked an allocation");
+}
+
+void IdleReclaimPreservesWorkingSet() {
+    mock = MockDevice{};
+    {
+        auto context = reclaimContext();
+        const auto useWorkingSet = [&] {
+            std::vector<std::unique_ptr<DeviceBuffer>> buffers;
+            for (unsigned i = 0; i < 4; ++i) buffers.push_back(std::make_unique<DeviceBuffer>(context, 96 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT));
+        };
+        useWorkingSet();
+        const auto allocations = mock.allocations;
+        const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+        auto& pool = *context.bufferPool;
+        Expect(pool.ReclaimIdleDevice(1024 * MiB, start) == 0, "initial pressure discarded the working set");
+        for (unsigned second = 1; second <= 4; ++second) {
+            useWorkingSet();
+            Expect(pool.ReclaimIdleDevice(1024 * MiB, start + std::chrono::seconds(second)) == 0, "pressure discarded buffers reused during the observation interval");
+            Expect(mock.allocations == allocations && mock.liveBytes == 384 * MiB, "a reusable working set larger than 128 MiB was recreated or shrunk");
+        }
+        Expect(pool.ReclaimIdleDevice(1024 * MiB, start + std::chrono::seconds(5)) == 384 * MiB, "the former working set remained retained after becoming idle");
+        Expect(mock.liveBytes == 0, "reclaim did not return the idle working set to the device");
+    }
+    Expect(mock.liveBuffers.empty(), "working-set reclaim leaked a buffer");
+    for (const auto heaps : {0u, 2u}) {
+        mock = MockDevice{};
+        {
+            auto context = reclaimContext();
+            context.memory.memoryHeapCount = heaps;
+            context.memory.memoryHeaps[1].flags = VK_MEMORY_HEAP_DEVICE_LOCAL_BIT;
+            { DeviceBuffer buffer(context, 2 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); }
+            auto& pool = *context.bufferPool;
+            const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+            Expect(pool.ReclaimIdleDevice(4 * MiB, start) == 0 && pool.ReclaimIdleDevice(4 * MiB, start + std::chrono::seconds(1)) == 0, "reclaim assumed a device heap without unambiguous ownership");
+            Expect(mock.liveBytes == 2 * MiB, "reclaim released memory from an unknown or different local heap");
+        }
+        Expect(mock.liveBytes == 0 && mock.liveBuffers.empty(), "unsupported-heap reclaim leaked an allocation");
+    }
+}
+
 void SuccessfulAllocationKeepsPool() {
     mock = MockDevice{};
     {
@@ -900,7 +1009,7 @@ void DeviceBindingFailures() {
 VkDeviceMemory reclaimImage = VK_NULL_HANDLE;
 const Context* reclaimImageContext = nullptr;
 
-VkDeviceSize mockImageReclaim(VkDeviceSize) {
+VkDeviceSize mockImageReclaim(VkDeviceSize, bool) {
     if (reclaimImage == VK_NULL_HANDLE) return 0;
     ReleaseImageMemory(*reclaimImageContext, reclaimImage, 10 * MiB, 0);
     reclaimImage = VK_NULL_HANDLE;
@@ -1001,10 +1110,50 @@ void ImageMemoryReuse() {
     Expect(mock.frees == 35 && context.bufferPool->RetainedImages() == 1, "the pool retains image memory again after a trim");
 }
 
+void IdleReclaimPreservesImages() {
+    mock = MockDevice{};
+    {
+        auto context = reclaimContext();
+        VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+        allocation.allocationSize = 4 * MiB;
+        allocation.memoryTypeIndex = 0;
+        std::uint32_t type = 99;
+        const auto image = AllocateImageMemory(context, allocation, 1u, "test idle image", &type);
+        ReleaseImageMemory(context, image, 4 * MiB, type);
+        VkBuffer buffer;
+        { DeviceBuffer idle(context, 2 * MiB, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT); buffer = idle.Handle(); }
+        auto& pool = *context.bufferPool;
+        const auto start = std::chrono::steady_clock::time_point{std::chrono::seconds(1)};
+        Expect(pool.RetainedImages() == 1 && mock.liveBytes == 6 * MiB, "the mixed pool fixture was not retained");
+        Expect(pool.ReclaimIdleDevice(MiB, start) == 0, "initial pressure reclaimed mixed pool memory");
+        const auto next = start + std::chrono::seconds(1);
+        const auto released = pool.ReclaimIdleDevice(MiB, next);
+        Expect(released == 2 * MiB, "idle buffer reclaim selected image memory instead of the oldest buffer");
+        if (released != 2 * MiB) return;
+        Expect(!mock.liveBuffers.contains(buffer) && mock.liveBytes == 4 * MiB && pool.RetainedImages() == 1, "buffer reclaim changed image ownership or accounting");
+        Expect(pool.ReclaimIdleDevice(32 * MiB, next) == 0, "an image-only pool was reclaimed as idle buffers");
+        SetAllocationFailureCountdown(0);
+        const auto empty = pool.ReclaimIdleDevice(32 * MiB, next);
+        SetAllocationFailureCountdown(-1);
+        Expect(empty == 0, "a repeated image-only scan allocated or reclaimed memory");
+        const auto allocations = mock.allocations;
+        const auto reused = AllocateImageMemory(context, allocation, 1u, "test idle image", &type);
+        Expect(reused == image && mock.allocations == allocations && pool.RetainedImages() == 0, "the retained image was not reusable after buffer reclaim");
+        ReleaseImageMemory(context, reused, 4 * MiB, type);
+        Expect(pool.RetainedImages() == 1 && mock.liveBytes == 4 * MiB, "the reused image was not retained exactly once");
+    }
+    Expect(mock.liveBytes == 0 && mock.liveBuffers.empty() && mock.frees == 2, "mixed pool cleanup leaked or freed an allocation twice");
+}
+
+
 int main(int argc, char** argv) {
     try {
         if (argc == 2 && std::string_view(argv[1]) == "--small-device-retention") {
             SmallDeviceRetention();
+            if (std::getenv("APS5_STAGING_POOL_MIB") == nullptr) {
+                IdleDeviceReclaim();
+                IdleReclaimPreservesWorkingSet();
+            }
             return failures == 0 ? 0 : 1;
         }
         if (argc == 2) {
@@ -1040,6 +1189,9 @@ int main(int argc, char** argv) {
         AllocationFailure(VK_ERROR_OUT_OF_DEVICE_MEMORY, VK_ERROR_DEVICE_LOST, true);
         AllocationFailureReportsHeapBudgets();
         SuccessfulAllocationKeepsPool();
+        IdleDeviceReclaim();
+        IdleReclaimPreservesWorkingSet();
+        IdleReclaimPreservesImages();
         PartialSlabDoesNotRetry();
         CacheReclaimRecovery();
         ImageCacheReclaim();
diff --git a/core/libs/prx/libSceAgcDriver/tests/CaptureTrace.cpp b/core/libs/prx/libSceAgcDriver/tests/CaptureTrace.cpp
new file mode 100644
index 0000000000..b263f9e7b1
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/CaptureTrace.cpp
@@ -0,0 +1,160 @@
+#if !defined(_WIN32) && !defined(_POSIX_C_SOURCE)
+#define _POSIX_C_SOURCE 200809L
+#endif
+
+#include "prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp"
+
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <thread>
+
+namespace {
+
+void Check(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void RemoveEnvironmentVariable(const char* name) {
+#ifdef _WIN32
+    _putenv_s(name, "");
+#else
+    unsetenv(name);
+#endif
+}
+
+bool FileExists(const char* path) {
+    std::error_code error;
+    return std::filesystem::exists(path, error) && !error;
+}
+
+std::string ReadFile(const char* path) {
+    std::ifstream stream(path, std::ios::binary);
+    Check(stream.is_open(), "the trace file was not created at the expected path");
+    std::ostringstream buffer;
+    buffer << stream.rdbuf();
+    return buffer.str();
+}
+
+bool WaitForRecord(const char* path, const std::string& record) {
+    for (int attempt = 0; attempt < 100; ++attempt) {
+        if (FileExists(path) && ReadFile(path).find(record) != std::string::npos) return true;
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+    return false;
+}
+
+const char* RequiredPathVariable() {
+    const char* configured = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    Check(configured != nullptr && configured[0] != '\0',
+          "this case requires a non-empty APS5_CAPTURE_TRACE_PATH");
+    return configured;
+}
+
+void PathDefault() {
+    RemoveEnvironmentVariable("APS5_CAPTURE_TRACE_PATH");
+    Check(std::string(AgcDriver::CaptureTracePath()) == "capture-trace.log",
+          "an absent APS5_CAPTURE_TRACE_PATH must select capture-trace.log");
+}
+
+void PathEmpty() {
+    const char* configured = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    Check(configured != nullptr && configured[0] == '\0',
+          "this case requires an empty APS5_CAPTURE_TRACE_PATH");
+    Check(std::string(AgcDriver::CaptureTracePath()) == "capture-trace.log",
+          "an empty APS5_CAPTURE_TRACE_PATH must select capture-trace.log");
+}
+
+void PathExplicit() {
+    const char* configured = RequiredPathVariable();
+    Check(std::string(AgcDriver::CaptureTracePath()) == std::string(configured),
+          "a non-empty APS5_CAPTURE_TRACE_PATH must be selected verbatim");
+}
+
+void ExplicitWrites() {
+    const char* configured = RequiredPathVariable();
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    AgcDriver::CaptureTrace::Log("capture-trace-explicit label=%d", 7);
+    Check(WaitForRecord(configured, "capture-trace-explicit label=7"),
+          "the configured trace path did not receive the capture record");
+    std::remove(configured);
+}
+
+void DefaultWrites() {
+    RemoveEnvironmentVariable("APS5_CAPTURE_TRACE_PATH");
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    Check(std::string(AgcDriver::CaptureTracePath()) == "capture-trace.log",
+          "an absent APS5_CAPTURE_TRACE_PATH must keep the default path");
+    AgcDriver::CaptureTrace::Log("capture-trace-default label=%d", 5);
+    Check(WaitForRecord("capture-trace.log", "capture-trace-default label=5"),
+          "the default trace path did not receive the capture record");
+    std::remove("capture-trace.log");
+}
+
+void OpenFailure() {
+    const char* configured = RequiredPathVariable();
+    Check(!FileExists(configured), "the configured trace path must not already exist");
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    bool threw = false;
+    try {
+        AgcDriver::CaptureTrace::Log("capture-trace-failure label=%d", 9);
+    } catch (const std::exception& error) {
+        threw = true;
+        std::cerr << "unexpected exception: " << error.what() << '\n';
+    }
+    Check(!threw, "an unopenable trace path must not throw from Log");
+    Check(!FileExists(configured), "an unopenable trace path must not create the requested file");
+    Check(!FileExists("capture-trace.log"),
+          "an unopenable trace path must not fall back to capture-trace.log");
+}
+
+void BestEffortOverflow() {
+    const char* configured = RequiredPathVariable();
+    Check(AgcDriver::CaptureTrace::Enabled(), "APS5_CAPTURE_TRACE must enable capture tracing");
+    const std::string oversized(4096, 'x');
+    bool threw = false;
+    try {
+        AgcDriver::CaptureTrace::LogBestEffort("capture-trace-best-effort payload=%s", oversized.c_str());
+    } catch (...) {
+        threw = true;
+    }
+    Check(!threw, "best-effort capture logging must not propagate formatting failures");
+    std::remove(configured);
+}
+
+void Disabled() {
+    RemoveEnvironmentVariable("APS5_CAPTURE_TRACE");
+    Check(!AgcDriver::CaptureTrace::Enabled(),
+          "capture tracing must stay disabled when APS5_CAPTURE_TRACE is absent");
+    AgcDriver::CaptureTrace::Log("capture-trace-disabled label=%d", 3);
+    Check(!FileExists("capture-trace.log"),
+          "disabled tracing must not initialize or write capture-trace.log");
+}
+
+}
+
+int main(int argc, char** argv) {
+    try {
+        if (argc != 2) throw std::runtime_error("expected exactly one test mode argument");
+        const std::string mode = argv[1];
+        if (mode == "path-default") PathDefault();
+        else if (mode == "path-empty") PathEmpty();
+        else if (mode == "path-explicit") PathExplicit();
+        else if (mode == "explicit-writes") ExplicitWrites();
+        else if (mode == "default-writes") DefaultWrites();
+        else if (mode == "open-failure") OpenFailure();
+        else if (mode == "best-effort-overflow") BestEffortOverflow();
+        else if (mode == "disabled") Disabled();
+        else throw std::runtime_error("unknown capture trace test mode: " + mode);
+        std::cout << "capture trace tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp b/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp
index dfadd4aabe..5cf4e302e4 100644
--- a/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/CmaskFastClear.cpp
@@ -155,6 +155,32 @@ void unknownCode(AgcDriver::VulkanDevice& device) {
     expect(device, color, [](std::uint32_t, std::uint32_t) { return Clear; }, "fast-cleared target eliminated after a CMASK code 3");
 }
 
+void expectRefused(const std::function<void()>& action, const std::string& message, const std::string& what) {
+    try {
+        action();
+    } catch (const std::exception& error) {
+        Require(std::string(error.what()).find(message) != std::string::npos, what + ": refused with " + error.what());
+        return;
+    }
+    throw std::runtime_error(what + ": was not refused");
+}
+
+void oneFragment(AgcDriver::VulkanDevice& device) {
+    auto color = target(ColorTileMode::RenderTarget);
+    color.coverageSamples = 4;
+    prepare(color, [](std::uint32_t tileX, std::uint32_t tileY) { return tileX == 2 && tileY == 0; }, 3);
+    expectRefused([&] { eliminate(device, color); }, "CMASK code 0x3 of a one-fragment color target is not implemented", "a one-fragment target with CMASK code 3");
+    prepare(color, [](std::uint32_t, std::uint32_t) { return true; });
+    eliminate(device, color);
+    expect(device, color, [](std::uint32_t, std::uint32_t) { return Clear; }, "a fast-cleared one-fragment target eliminated");
+    prepare(color, [](std::uint32_t tileX, std::uint32_t tileY) { return tileX == 7 && tileY == 1; });
+    eliminate(device, color);
+    expect(device, color, [](std::uint32_t x, std::uint32_t y) { return x >= 56 && y >= 8 ? Clear : Stale; }, "a one-fragment target with one fast-cleared tile eliminated");
+    prepare(color, [](std::uint32_t tileX, std::uint32_t) { return tileX < 4; }, 0xc);
+    eliminate(device, color);
+    expect(device, color, [](std::uint32_t, std::uint32_t) { return Stale; }, "a one-fragment target with CMASK codes 0xc and 0xf eliminated");
+}
+
 }
 
 int main() {
@@ -175,6 +201,7 @@ int main() {
         run(*device, ColorTileMode::Linear, "linear");
         run(*device, ColorTileMode::RenderTarget, "SW_64KB_R_X");
         unknownCode(*device);
+        oneFragment(*device);
         device->WaitIdle();
         device.reset();
         {
diff --git a/core/libs/prx/libSceAgcDriver/tests/CollectMemoGeneration.cpp b/core/libs/prx/libSceAgcDriver/tests/CollectMemoGeneration.cpp
new file mode 100644
index 0000000000..90d5e8a215
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/CollectMemoGeneration.cpp
@@ -0,0 +1,127 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include <algorithm>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <iostream>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace {
+
+constexpr std::uint64_t Block = 65536;
+constexpr std::uint64_t Page = 4096;
+constexpr std::uint64_t Base = std::uint64_t{1} << 32;
+constexpr std::chrono::seconds Patience{10};
+
+struct FakeWatch {
+    std::mutex mutex;
+    std::condition_variable changed;
+    std::vector<std::pair<std::uintptr_t, std::uintptr_t>> written;
+    bool holdNextWalk = false;
+    bool holding = false;
+    bool released = false;
+    bool timedOut = false;
+};
+
+FakeWatch& Fake() {
+    static FakeWatch fake;
+    return fake;
+}
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+}
+
+namespace GuestWriteWatch {
+
+extern "C" {
+
+bool GuestWriteWatchAvailable_nid_postfix() {
+    return true;
+}
+
+bool GuestWriteWatchCovers_nid_postfix(std::uintptr_t address, std::size_t bytes) {
+    return address >= Base && bytes <= 2 * Block && address - Base <= 2 * Block - bytes;
+}
+
+bool GuestWriteWatchCollect_nid_postfix(std::uintptr_t address, std::size_t bytes, void (*written)(void* context, std::uintptr_t begin, std::uintptr_t end), void* context) {
+    auto& fake = Fake();
+    const auto end = address + bytes;
+    std::vector<std::pair<std::uintptr_t, std::uintptr_t>> runs;
+    {
+        std::unique_lock lock(fake.mutex);
+        if (fake.holdNextWalk) {
+            fake.holdNextWalk = false;
+            fake.holding = true;
+            fake.changed.notify_all();
+            fake.timedOut = !fake.changed.wait_for(lock, Patience, [&] { return fake.released; });
+        }
+        for (auto it = fake.written.begin(); it != fake.written.end();) {
+            if (it->first < end && address < it->second) {
+                runs.emplace_back(std::max(it->first, address), std::min(it->second, end));
+                it = fake.written.erase(it);
+            } else ++it;
+        }
+    }
+    for (const auto& [from, to] : runs) written(context, from, to);
+    return true;
+}
+
+}
+
+}
+
+namespace {
+
+using namespace AgcDriver::GuestMemory;
+
+void CheckMemoHitDuringWalk() {
+    auto& fake = Fake();
+    BumpCollectEpoch();
+    const auto collected = CollectWrites(Base, Block);
+    Require(collected != 0 && UnchangedSince(Base, Block, collected), "the block was not collected");
+    {
+        const std::lock_guard lock(fake.mutex);
+        fake.written.emplace_back(Base + Page, Base + 2 * Page);
+        fake.holdNextWalk = true;
+    }
+    std::thread walker([] { CollectWritesUncached(Base, 2 * Block); });
+    bool holding = false;
+    {
+        std::unique_lock lock(fake.mutex);
+        holding = fake.changed.wait_for(lock, Patience, [&] { return fake.holding; });
+    }
+    const auto memoized = holding ? CollectWrites(Base, Block) : 0;
+    {
+        const std::lock_guard lock(fake.mutex);
+        fake.released = true;
+    }
+    fake.changed.notify_all();
+    walker.join();
+    Require(holding, "the second walk did not reach the write watch");
+    Require(!fake.timedOut, "the memoized collect waited for the walk in progress");
+    Require(!UnchangedSince(Base + Page, Page, memoized), "a memoized collect returned the generation a walk in progress then stamped a write with");
+    BumpCollectEpoch();
+    Require(CollectWrites(Base, Block) > memoized && !UnchangedSince(Base, Block, memoized), "a later epoch trusts the write stamped by the walk in progress");
+}
+
+}
+
+int main() {
+    try {
+        CheckMemoHitDuringWalk();
+    } catch (const std::exception& error) {
+        std::cerr << "collect memo generation test failed: " << error.what() << "\n";
+        return 1;
+    }
+    std::cout << "collect memo generation test passed\n";
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/ConstantBitTest.cpp b/core/libs/prx/libSceAgcDriver/tests/ConstantBitTest.cpp
index 06d73e6578..d7bac76983 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ConstantBitTest.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ConstantBitTest.cpp
@@ -1,6 +1,7 @@
 #include "IntermediateRepresentation/IrBuilder.hpp"
 #include "Optimization/ConstantFolder.hpp"
 #include "Optimization/DeadCodeEliminator.hpp"
+#include <array>
 #include <cstdint>
 #include <cstdio>
 #include <exception>
@@ -203,6 +204,71 @@ bool vertexProjection(std::uint32_t low, std::uint32_t hostSubgroup, std::uint32
     return retainedLane;
 }
 
+enum class QuadMask {
+    Expanded,
+    Intersected,
+    Nested,
+    SeparateHalves,
+    RealOnly,
+    Partial,
+    WrongHalf,
+    Divergent,
+};
+
+bool quadProjection(std::uint32_t wave, QuadMask shape, bool expected, IrShaderStage stage = IrShaderStage::Pixel) {
+    IrProgram program;
+    program.Resources().stage = stage;
+    program.SetWaveSize(wave);
+    auto& block = program.CreateBlock();
+    program.SetEntryBlock(block);
+    program.BlockOrder().push_back(&block);
+    IrBuilder builder(program);
+    builder.SetInsertionPoint(block);
+    auto& lane = builder.Emit(IrOpcode::LaneId, IrType::U32, {});
+    if (shape == QuadMask::Divergent) {
+        auto& taken = program.CreateBlock();
+        auto& other = program.CreateBlock();
+        program.BlockOrder().push_back(&taken);
+        program.BlockOrder().push_back(&other);
+        builder.BranchConditional(builder.ULessThan(lane, builder.Constant(16u)), taken, other);
+        builder.SetInsertionPoint(other);
+        static_cast<void>(builder.Emit(IrOpcode::Return, IrType::Void, {}));
+        builder.SetInsertionPoint(taken);
+    }
+    const auto ballot = [&](IrValue& condition) {
+        auto& mask = builder.Emit(IrOpcode::Ballot, IrType::U32x4, {&condition});
+        return std::array<IrValue*, 2>{&builder.CompositeExtract(mask, 0u), wave == 64u ? &builder.CompositeExtract(mask, 1u) : &builder.Constant(0u)};
+    };
+    const auto expand = [&](const std::array<IrValue*, 2>& words) {
+        auto& wide = builder.ConstructU64(*words[0], *words[1]);
+        auto& mask = builder.Emit(IrOpcode::WqmU64, IrType::U64, {&wide});
+        return std::array<IrValue*, 2>{&builder.CompositeExtract(mask, 0u), &builder.CompositeExtract(mask, 1u)};
+    };
+    auto& helper = builder.Emit(IrOpcode::GetBuiltin, IrType::U32, {&builder.Constant(static_cast<std::uint32_t>(StageInputKind::HelperInvocation)), &builder.Constant(0u)});
+    const auto real = ballot(builder.IEqual(helper, builder.Constant(0u)));
+    const auto quads = expand(real);
+    const auto host = expand(ballot(builder.ConstantBool(true)));
+    auto words = quads;
+    if (shape == QuadMask::Intersected || shape == QuadMask::Nested || shape == QuadMask::SeparateHalves || shape == QuadMask::RealOnly) {
+        const auto highHost = shape == QuadMask::SeparateHalves ? expand(ballot(builder.ConstantBool(true))) : host;
+        const auto source = shape == QuadMask::Nested || shape == QuadMask::RealOnly ? real : quads;
+        words = {&builder.BitwiseAnd(*source[0], *host[0]), &builder.BitwiseAnd(*source[1], *highHost[1])};
+        if (shape == QuadMask::Nested) words = expand(words);
+    }
+    if (shape == QuadMask::Partial) {
+        words = {&builder.BitwiseAnd(*words[0], builder.Constant(0x0000ffffu)), &builder.Constant(0u)};
+    }
+    if (shape == QuadMask::WrongHalf) words[1] = words[0];
+    IrValue& word = wave == 64u ? builder.Select(builder.ULessThan(lane, builder.Constant(32u)), *words[0], *words[1]) : *words[0];
+    auto& shifted = builder.ShiftRightLogical(word, builder.BitwiseAnd(lane, builder.Constant(31u)));
+    auto& test = builder.INotEqual(builder.BitwiseAnd(shifted, builder.Constant(1u)), builder.Constant(0u));
+    auto& user = builder.Emit(IrOpcode::Reference, IrType::Void, {&test});
+    static_cast<void>(builder.Emit(IrOpcode::Return, IrType::Void, {}));
+    ConstantFolder{}.Fold(program);
+    const auto* result = user.Argument(0)->Resolve();
+    return expected ? result->HasImmediate() && result->ImmediateBool() : !result->HasImmediate();
+}
+
 bool run(const char* name, bool passed) {
     if (!passed) std::fprintf(stderr, "%s\n", name);
     return passed;
@@ -213,6 +279,17 @@ bool run(const char* name, bool passed) {
 int main() {
     try {
         bool passed = true;
+        for (const auto wave : {32u, 64u}) {
+            passed &= run("a whole-quad entry mask covers pixel helpers", quadProjection(wave, QuadMask::Expanded, true));
+            passed &= run("intersecting whole-quad entry masks preserves pixel helpers", quadProjection(wave, QuadMask::Intersected, true));
+            passed &= run("a nested whole-quad entry mask covers pixel helpers", quadProjection(wave, QuadMask::Nested, true));
+            passed &= run("independent low and high whole-quad masks cover pixel helpers", quadProjection(wave, QuadMask::SeparateHalves, true));
+            passed &= run("an unexpanded entry mask must keep the helper bit test", quadProjection(wave, QuadMask::RealOnly, false));
+            passed &= run("a partial whole-quad mask must keep the lane bit test", quadProjection(wave, QuadMask::Partial, false));
+            passed &= run("a divergent whole-quad ballot must keep the lane bit test", quadProjection(wave, QuadMask::Divergent, false));
+            passed &= run("whole-quad entry proofs do not apply to other stages", quadProjection(wave, QuadMask::Intersected, false, IrShaderStage::Vertex));
+        }
+        passed &= run("a low word cannot prove the high-half helper bits", quadProjection(64u, QuadMask::WrongHalf, false));
         passed &= run("an all-zero word must fold the lane bit test to false", foldsTo(0u, false, true));
         passed &= run("an all-one word must fold the lane bit test to true", foldsTo(0xffffffffu, true, true));
         passed &= run("a mixed word must keep the lane bit test", foldsTo(0x0000ffffu, false, true));
diff --git a/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp b/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp
index 2cc4a8b370..09ef9b6dac 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ConstantPhi.cpp
@@ -79,6 +79,83 @@ void CheckDiamond(unsigned mode) {
     }
 }
 
+void CheckUnobservedPhiCycles() {
+    IrProgram empty;
+    DeadCodeEliminator{}.EliminateUnobservedPhis(empty);
+    IrProgram program;
+    for (std::uint32_t id = 0; id < 4u; ++id) {
+        auto& block = program.CreateBlock();
+        program.BlockOrder().push_back(&block);
+        BlockInfo info;
+        info.id = id;
+        info.terminator.kind = TerminatorKind::Return;
+        program.Metadata().blockInfo.push_back(info);
+    }
+    auto& entry = *program.BlockOrder()[0];
+    auto& header = *program.BlockOrder()[1];
+    auto& latch = *program.BlockOrder()[2];
+    auto& exit = *program.BlockOrder()[3];
+    program.SetEntryBlock(entry);
+    entry.AddBranch(&header);
+    header.AddBranch(&latch);
+    header.AddBranch(&exit);
+    latch.AddBranch(&header);
+    program.Metadata().blockInfo[0].terminator.kind = TerminatorKind::Branch;
+    program.Metadata().blockInfo[0].terminator.trueBlock = 1u;
+    auto& headerInfo = program.Metadata().blockInfo[1];
+    headerInfo.terminator.kind = TerminatorKind::ConditionalBranch;
+    headerInfo.terminator.trueBlock = 2u;
+    headerInfo.terminator.falseBlock = 3u;
+    program.Metadata().blockInfo[2].terminator.kind = TerminatorKind::Branch;
+    program.Metadata().blockInfo[2].terminator.trueBlock = 1u;
+    IrBuilder builder(program);
+    builder.SetInsertionPoint(entry);
+    auto& zero = builder.Constant(0u);
+    auto& producer = builder.Emit(IrOpcode::LaneId, IrType::U32, {});
+    const auto phi = [&](IrBlock& block, IrType type = IrType::U32) -> IrValue& {
+        auto& value = program.CreateValue(IrOpcode::Phi, type);
+        block.AppendInstruction(&value);
+        return value;
+    };
+    auto& first = phi(header);
+    auto& second = phi(latch);
+    auto& tail = phi(header);
+    auto& self = phi(header);
+    auto& liveFirst = phi(header);
+    auto& liveSecond = phi(latch);
+    auto& condition = phi(header, IrType::Bool);
+    first.AddPhiOperand(&entry, &producer);
+    first.AddPhiOperand(&latch, &second);
+    second.AddPhiOperand(&header, &first);
+    tail.AddPhiOperand(&entry, &zero);
+    tail.AddPhiOperand(&latch, &second);
+    self.AddPhiOperand(&entry, &zero);
+    self.AddPhiOperand(&latch, &self);
+    liveFirst.AddPhiOperand(&entry, &zero);
+    liveFirst.AddPhiOperand(&latch, &liveSecond);
+    liveSecond.AddPhiOperand(&header, &liveFirst);
+    condition.AddPhiOperand(&entry, &builder.ConstantBool(true));
+    condition.AddPhiOperand(&latch, &condition);
+    headerInfo.condition = &condition;
+    builder.SetInsertionPoint(header);
+    static_cast<void>(builder.Emit(IrOpcode::Reference, IrType::Void, {&condition}));
+    builder.SetInsertionPoint(latch);
+    auto& store = builder.Emit(IrOpcode::StoreVectorWindow, IrType::Void, {&zero, &liveSecond});
+    ValidateProgram(program, true);
+    DeadCodeEliminator{}.EliminateUnobservedPhis(program);
+    ValidateProgram(program, true);
+    Require(first.Parent() == nullptr && second.Parent() == nullptr && tail.Parent() == nullptr && self.Parent() == nullptr, "phi cycles: an unobserved cycle or its tail survived");
+    Require(!first.HasUses() && !second.HasUses() && !tail.HasUses() && !self.HasUses(), "phi cycles: a removed cycle retained uses");
+    Require(liveFirst.Parent() == &header && liveSecond.Parent() == &latch && liveFirst.Argument(1) == &liveSecond && liveSecond.Argument(0) == &liveFirst, "phi cycles: an observed cycle was changed");
+    Require(store.Parent() == &latch && store.Argument(1) == &liveSecond, "phi cycles: an observable store was changed");
+    Require(condition.Parent() == &header && headerInfo.condition == &condition && condition.Argument(1) == &condition, "phi cycles: a branch condition was changed");
+    DeadCodeEliminator{}.Eliminate(program);
+    Require(producer.Parent() == nullptr && !producer.HasUses(), "phi cycles: ordinary DCE retained a released producer");
+    DeadCodeEliminator{}.EliminateUnobservedPhis(program);
+    ValidateProgram(program, true);
+    Require(entry.Instructions().empty() && header.Instructions().size() == 3u && latch.Instructions().size() == 2u, "phi cycles: repeated elimination changed the live graph");
+}
+
 void CheckLongAncillaryForwarding() {
     IrProgram program;
     auto& block = program.CreateBlock();
@@ -127,6 +204,7 @@ int main() {
     try {
         for (unsigned mode = 0; mode < 5u; ++mode) CheckDiamond(mode);
         CheckLongAncillaryForwarding();
+        CheckUnobservedPhiCycles();
         std::puts("constant phi dominance tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp b/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp
index 3febba4f40..b59161ab49 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp
@@ -445,6 +445,26 @@ void verifyProgram(const Program& program) {
     }
 }
 
+const std::vector<std::uint32_t> TestedHeaderLatchStore{
+    0xbe880380u, 0x7e020280u, 0xbf0a8408u, 0xbf840004u, 0xe0700000u, 0x80000100u, 0x80088108u, 0xbf82fffau, 0xbf810000u};
+const std::vector<std::uint32_t> SelfLoopLatchStore{
+    0xbe880380u, 0x7e020280u, 0xe0700000u, 0x80000100u, 0x80088108u, 0xbf0a8408u, 0xbf85fffbu, 0xbf810000u};
+
+void verifyEmptyLoopContinues() {
+    for (const auto& [name, code] : {std::pair{"a loop whose latch stores behind a tested header", &TestedHeaderLatchStore}, std::pair{"a single-block loop that stores", &SelfLoopLatchStore}}) {
+        auto graph = GraphBuilder{}.Build(RdnaInstructionDecoder{}.Decode(*code));
+        Structurizer{}.Structurize(graph);
+        bool loops = false;
+        for (const auto& block : graph.blocks) {
+            if (!block.terminator.loopHeader) continue;
+            loops = true;
+            const auto& continueTarget = graph.FindBlock(block.terminator.continueBlock);
+            require(continueTarget.instructionBegin == continueTarget.instructionEnd, std::string(name) + ": the continue block " + std::to_string(continueTarget.id) + " of the loop at block " + std::to_string(block.id) + " holds instructions");
+        }
+        require(loops, std::string(name) + ": no loop was structured");
+    }
+}
+
 const std::vector<std::uint32_t> DwordTableGetpcFirst{
     0xbe8c1f00u, 0x800cff0cu, 0x00000058u, 0x820d800du, 0x83928202u, 0xd4c40016u, 0x02000500u, 0x8f128212u, 0xf4000386u, 0x24000000u,
     0xbf8cc07fu, 0x7d820003u, 0x808c0e0cu, 0x828d800du, 0xbefd210cu, 0x7e020281u, 0xbf820003u, 0x7e020282u, 0xbf820001u, 0x7e020283u,
@@ -711,6 +731,18 @@ loop:
   s_cbranch_scc1 loop
   s_endpgm)",
          {0xbe880380u, 0x7e020280u, 0xe0700000u, 0x80000100u, 0x80088108u, 0xbf0a8408u, 0xbf85fffbu, 0xbf810000u}, Split::None},
+        {"memory access in a loop latch behind a tested header", R"(
+  s_mov_b32 s8, 0
+  v_mov_b32 v1, 0
+loop:
+  s_cmp_lt_u32 s8, 4
+  s_cbranch_scc0 done
+  buffer_store_dword v1, off, s[0:3], 0
+  s_add_u32 s8, s8, 1
+  s_branch loop
+done:
+  s_endpgm)",
+         TestedHeaderLatchStore, Split::None},
         {"shared tail in a loop", R"(
   s_mov_b32 s8, 0
   v_mov_b32 v1, 0
@@ -1421,6 +1453,7 @@ done:
         verifyCallLinkMaskReadByScalarInstruction();
         verifyLargeLoopExitFallback();
         verifyNestedExitForwarders();
+        verifyEmptyLoopContinues();
         verifyIrreducibleLoopEntry();
     } catch (const std::exception& error) {
         std::fprintf(stderr, "%s\n", error.what());
diff --git a/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp b/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp
index 79878c2766..cd876ad472 100644
--- a/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/DepthSurfaceReuse.cpp
@@ -1,4 +1,5 @@
 #include "GraphicsTests.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
@@ -13,6 +14,14 @@
 #include <tuple>
 #include <utility>
 #include <vector>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
 
 namespace {
 
@@ -417,6 +426,62 @@ void TestRetiredSurfaceRelease(const Context& context) {
     ClearDepthSurfaces(context.device);
 }
 
+void TestUnmappedStalePlaneFlush(const Context& context) {
+    ClearDepthSurfaces(context.device);
+    constexpr VkExtent2D extent{256, 256};
+    constexpr std::uint64_t unmapped = 0xa0000000;
+    DepthTarget target{unmapped, 0, extent, VK_FORMAT_D32_SFLOAT, 1.0f, 0};
+    target.depthSwizzle = XorSwizzleMode(TextureTileMode::kZ64KBX);
+    Require(DepthSurfaceView(context, target, true) != VK_NULL_HANDLE, "a mirrorable depth surface must render");
+    Require(DepthPlanesStale(), "a written mirrorable depth surface must leave its plane stale");
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> stored;
+    try {
+        stored = FlushDepthPlanes(unmapped, DepthSliceBytes(extent, 4u));
+    } catch (const std::exception& error) {
+        Require(false, std::string("flushing a depth plane whose guest memory is not mapped must drop its results: ") + error.what());
+    }
+    Require(stored.empty(), "a depth plane without mapped guest memory must not be stored");
+    Require(!DepthPlanesStale(), "a dropped depth plane must not stay stale");
+    ClearDepthSurfaces(context.device);
+}
+
+void TestReadOnlyStalePlaneFlush(const Context& context) {
+    ClearDepthSurfaces(context.device);
+    constexpr std::size_t bytes = 1024 * 1024;
+#ifdef _WIN32
+    const auto release = [](void* pointer) { VirtualFree(pointer, 0, MEM_RELEASE); };
+    std::unique_ptr<void, decltype(release)> mapping(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READONLY), release);
+    Require(mapping != nullptr, "cannot map a read-only depth plane");
+#else
+    const auto release = [](void* pointer) { munmap(pointer, bytes); };
+    std::unique_ptr<void, decltype(release)> mapping(mmap(nullptr, bytes, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0), release);
+    Require(mapping.get() != MAP_FAILED, "cannot map a read-only depth plane");
+#endif
+    const auto address = (reinterpret_cast<std::uintptr_t>(mapping.get()) + 65535u) & ~std::uintptr_t{65535u};
+    constexpr VkExtent2D extent{256, 256};
+    const auto planeBytes = DepthSliceBytes(extent, 4u);
+    Require(!AgcDriver::GuestMemory::CommittedRanges(address, planeBytes).empty(), "a read-only depth plane must remain readable");
+    Require(AgcDriver::GuestMemory::CommittedRanges(address, planeBytes, true).empty(), "a read-only depth plane must not be writable");
+    auto storageContext = context;
+    storageContext.formatProperties = [](VkPhysicalDevice, VkFormat, VkFormatProperties* properties) {
+        *properties = {};
+        properties->optimalTilingFeatures = VK_FORMAT_FEATURE_DEPTH_STENCIL_ATTACHMENT_BIT | VK_FORMAT_FEATURE_SAMPLED_IMAGE_BIT | VK_FORMAT_FEATURE_STORAGE_IMAGE_BIT;
+    };
+    DepthTarget target{address, 0, extent, VK_FORMAT_D32_SFLOAT, 1.0f, 0};
+    target.depthSwizzle = XorSwizzleMode(TextureTileMode::kZ64KBX);
+    Require(DepthSurfaceView(storageContext, target, true) != VK_NULL_HANDLE, "a read-only depth plane must render");
+    Require(DepthPlanesStale(), "the read-only depth plane must have pending results");
+    bool rejected = false;
+    try {
+        static_cast<void>(FlushDepthPlanes(address, planeBytes));
+    } catch (const std::runtime_error& error) {
+        rejected = std::string_view(error.what()).find("storage texture has no committed guest pages") != std::string_view::npos;
+    }
+    Require(rejected, "a mapped read-only depth plane must retain the unsupported-store rejection");
+    Require(DepthPlanesStale(), "a mapped read-only depth plane must retain its pending results");
+    ClearDepthSurfaces(context.device);
+}
+
 void RunDepthSurfaceReuseTests() {
     static int deviceTag = 0;
     Context context{};
@@ -432,6 +497,8 @@ void RunDepthSurfaceReuseTests() {
     TestMultisampleDepthOwnership(context);
     TestMultisampleStencilAliases(context);
     TestStencilUnormView(context);
+    TestUnmappedStalePlaneFlush(context);
+    TestReadOnlyStalePlaneFlush(context);
     constexpr std::uint64_t depth32 = 0x40000000;
     constexpr std::uint64_t depth16 = 0x50000000;
     constexpr std::uint64_t depthStencil = 0x60000000;
diff --git a/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp b/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp
index 67475a41de..b2df523ef9 100644
--- a/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/DeviceFault.cpp
@@ -60,6 +60,25 @@ VkQueue FakeQueue() {
     return reinterpret_cast<VkQueue>(static_cast<std::uintptr_t>(0x2000));
 }
 
+void Diagnostics() {
+    using AgcDriver::ChooseDeviceDiagnostics;
+    constexpr VkDeviceDiagnosticsConfigFlagsNV all = VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_DEBUG_INFO_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_RESOURCE_TRACKING_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_AUTOMATIC_CHECKPOINTS_BIT_NV | VK_DEVICE_DIAGNOSTICS_CONFIG_ENABLE_SHADER_ERROR_REPORTING_BIT_NV;
+    for (const bool configSupported : {false, true}) {
+        for (const bool checkpointsSupported : {false, true}) {
+            const auto off = ChooseDeviceDiagnostics(false, configSupported, checkpointsSupported);
+            Require(!off.config && !off.checkpoints && off.flags == 0, "diagnostics were chosen without APS5_NV_DIAGNOSTICS");
+        }
+    }
+    for (const bool checkpointsSupported : {false, true}) {
+        const auto unsupported = ChooseDeviceDiagnostics(true, false, checkpointsSupported);
+        Require(!unsupported.config && !unsupported.checkpoints && unsupported.flags == 0, "diagnostics were chosen on a device without VK_NV_device_diagnostics_config");
+    }
+    const auto alone = ChooseDeviceDiagnostics(true, true, false);
+    Require(alone.config && !alone.checkpoints && alone.flags == all, "the diagnostics config without checkpoint support did not enable every crash-dump flag alone");
+    const auto both = ChooseDeviceDiagnostics(true, true, true);
+    Require(both.config && both.checkpoints && both.flags == all, "the diagnostics config did not add the diagnostic checkpoints the device supports");
+}
+
 void FaultInfo() {
     faultCalls = 0;
     faultFails = false;
@@ -97,6 +116,35 @@ void Nothing() {
     Require(faultCalls == 0, "the fault info was queried without the extension");
 }
 
+void BufferMarkers() {
+    AgcDriver::BufferMarkerLog log;
+    Require(log.Report(0, 0) == std::vector<std::string>{"[device-fault] no buffer marker reached"}, "an untouched marker buffer was not reported");
+    Require(log.Next(0x10000) == 1 && log.Next(0x10100) == 2 && log.Next(0x10200) == 3, "markers are not numbered from 1");
+    const auto lines = log.Report(3, 1);
+    Require(lines.size() == 4, "a hang two markers past the last finished one does not get four lines");
+    Require(lines[0] == "[device-fault] last dispatch reached: marker 3, program 0x10200", "the reached line changed");
+    Require(lines[1] == "[device-fault] last dispatch finished: marker 1, program 0x10000", "the finished line changed");
+    Require(lines[2] == "[device-fault] unfinished dispatch: marker 2, program 0x10100", "the first unfinished line changed");
+    Require(lines[3] == "[device-fault] unfinished dispatch: marker 3, program 0x10200", "the second unfinished line changed");
+    Require(log.Report(3, 3).size() == 2, "a finished queue listed unfinished dispatches");
+    const auto first = log.Report(1, 0);
+    Require(first.size() == 3 && first[1] == "[device-fault] no dispatch finished" && first[2] == "[device-fault] unfinished dispatch: marker 1, program 0x10000", "a hang in the first dispatch was not reported as nothing finished");
+    Require(log.Report(2, 3).size() == 2, "markers finished past the reached one listed unfinished dispatches");
+}
+
+void BufferMarkersWrap() {
+    AgcDriver::BufferMarkerLog log;
+    for (std::uint32_t i = 0; i <= AgcDriver::BufferMarkerLog::Capacity; ++i) static_cast<void>(log.Next(0x20000 + i));
+    const auto lines = log.Report(AgcDriver::BufferMarkerLog::Capacity + 1, 1);
+    Require(lines[0] == "[device-fault] last dispatch reached: marker 4097, program 0x21000", "the newest marker was not kept");
+    Require(lines[1] == "[device-fault] last dispatch finished: marker 1, program not in the log", "an overwritten marker kept a program");
+    Require(lines.size() == 2 + AgcDriver::BufferMarkerLog::Listed + 1 && lines.back() == "[device-fault] 4088 more unfinished dispatches", "a full log of unfinished markers was not listed and counted");
+    Require(log.Report(AgcDriver::BufferMarkerLog::Capacity + 1, 0).size() == 2, "more unfinished markers than the log holds were listed");
+    const auto pending = log.Report(AgcDriver::BufferMarkerLog::Capacity + 1, AgcDriver::BufferMarkerLog::Capacity - 19);
+    Require(pending.size() == 2 + AgcDriver::BufferMarkerLog::Listed + 1, "a long unfinished run was not cut to the listed count");
+    Require(pending.back() == "[device-fault] 12 more unfinished dispatches", "the count of unlisted unfinished dispatches changed");
+}
+
 void AddressKinds() {
     Require(std::strcmp(AgcDriver::DeviceFaultAddressKind(VK_DEVICE_FAULT_ADDRESS_TYPE_NONE_EXT), "none") == 0, "none");
     Require(std::strcmp(AgcDriver::DeviceFaultAddressKind(VK_DEVICE_FAULT_ADDRESS_TYPE_WRITE_INVALID_EXT), "write invalid") == 0, "write invalid");
@@ -110,11 +158,14 @@ void AddressKinds() {
 
 int main() {
     try {
+        Diagnostics();
         FaultInfo();
         FaultInfoFails();
         Checkpoints();
         Nothing();
         AddressKinds();
+        BufferMarkers();
+        BufferMarkersWrap();
     } catch (const std::exception& error) {
         std::fprintf(stderr, "agc_device_fault: %s\n", error.what());
         return 1;
diff --git a/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp b/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp
index 0f3fe85da7..f47e2d0ebc 100644
--- a/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/F32DenormPreserve.cpp
@@ -4,6 +4,7 @@
 #include <cstdint>
 #include <cstdio>
 #include <exception>
+#include <optional>
 #include <span>
 #include <stdexcept>
 #include <string>
@@ -19,17 +20,19 @@ void require(bool condition, const std::string& message) {
 }
 
 constexpr std::array<std::uint32_t, 4> CvtF16F32Store{0x7e021500u, 0xe0700000u, 0x80000100u, 0xbf810000u};
+constexpr std::array<std::uint32_t, 4> MovStore{0x7e020300u, 0xe0700000u, 0x80000100u, 0xbf810000u};
 
-std::vector<std::uint32_t> recompile(bool preserve, bool flush, bool flushCapability = true) {
+std::vector<std::uint32_t> recompile(bool preserve, bool flush, bool flushCapability = true, std::optional<ShaderFloatMode> floatMode = std::nullopt, std::span<const std::uint32_t> code = CvtF16F32Store) {
     const std::array<std::uint32_t, 4> capabilities{spv::CapabilityShader, spv::CapabilityGroupNonUniform, spv::CapabilityDenormPreserve, spv::CapabilityDenormFlushToZero};
     const std::array<std::uint32_t, 4> userData{0x10000000u, 0x00100000u, 0x40u, 0x00027facu};
     const std::array<std::string_view, 2> extensions{"SPV_KHR_storage_buffer_storage_class", "SPV_KHR_float_controls"};
     RecompileRequest request{};
-    request.shader = {ShaderStage::Compute, 0x20000u, CvtF16F32Store, 0, {}};
+    request.shader = {ShaderStage::Compute, 0x20000u, code, 0, {}};
     request.context.waveSize = 64;
     request.context.userDataBaseRegister = 0;
     request.context.userData = userData;
     request.context.compute = ShaderComputeStageInfo{{64u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.context.floatMode = floatMode;
     request.target.vulkanVersion = 0x00403000u;
     request.target.spirvVersion = 0x00010600u;
     request.target.subgroupSize = 64;
@@ -79,6 +82,16 @@ void verify() {
     require(flushed.flush32 && !flushed.preserve32, "the hardware 32-bit flush did not take precedence over the preserve flag");
     const auto nativeFlush = scan(recompile(true, true, false));
     require(!nativeFlush.preserve32 && !nativeFlush.flush32, "a hardware flush without the DenormFlushToZero capability declared a 32-bit denormal execution mode");
+    const auto flushingMode = scan(recompile(true, true, true, ShaderFloatMode{0xc0u, true, false, false}, MovStore));
+    require(flushingMode.flush32 && !flushingMode.preserve32, "FLOAT_MODE 0xc0 flushes f32 denormals but the module did not take the hardware flush");
+    for (const std::uint32_t mode : {0xd0u, 0xe0u, 0xf0u}) {
+        char name[64];
+        std::snprintf(name, sizeof(name), "FLOAT_MODE 0x%02x keeps f32 denormals", mode);
+        const auto kept = scan(recompile(true, true, true, ShaderFloatMode{mode, true, false, false}, MovStore));
+        require(kept.preserve32 && kept.preserveCapability && !kept.flush32, std::string(name) + ", but the module did not declare DenormPreserve 32 instead of the hardware flush");
+        const auto unpreserved = scan(recompile(false, true, true, ShaderFloatMode{mode, true, false, false}, MovStore));
+        require(!unpreserved.flush32 && !unpreserved.preserve32, std::string(name) + ", but the module took the hardware flush on a device that cannot preserve them");
+    }
 }
 
 }
@@ -90,6 +103,6 @@ int main() {
         std::fprintf(stderr, "F32DenormPreserve: %s\n", error.what());
         return 1;
     }
-    std::puts("F32DenormPreserve: the 32-bit DenormPreserve execution mode follows the target flag and yields to the hardware flush");
+    std::puts("F32DenormPreserve: the 32-bit DenormPreserve execution mode follows the target flag and yields to the hardware flush in shaders that flush f32 denormals");
     return 0;
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/FlatScratch.cpp b/core/libs/prx/libSceAgcDriver/tests/FlatScratch.cpp
new file mode 100644
index 0000000000..73aef4bdf0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FlatScratch.cpp
@@ -0,0 +1,118 @@
+#include "RdnaDecoder/RdnaMemoryOpDecoder.hpp"
+#include "Translation/TranslationContext.hpp"
+#include <array>
+#include <cstdio>
+#include <stdexcept>
+using namespace ShaderRecompiler;
+static unsigned tests = 0;
+#define Require(value)                                                         \
+  do {                                                                         \
+    if (!(value)) {                                                            \
+      std::fprintf(stderr, "flat scratch assertion line %u: %s\n", __LINE__,   \
+                   #value);                                                    \
+      throw std::runtime_error("flat scratch regression");                     \
+    }                                                                          \
+  } while (false)
+static RdnaInstruction Decode(unsigned seg, unsigned saddr, unsigned addr,
+                              unsigned offset = 0, unsigned opcode = 12) {
+  const std::array<unsigned, 2> code{(0x37u << 26) | (opcode << 18) |
+                                         (seg << 14) | offset,
+                                     (2u << 24) | (saddr << 16) | addr};
+  return DecodeRdnaFlat(0x154cu, code, 0);
+}
+static void Reject(unsigned seg, unsigned saddr, unsigned addr) {
+  try {
+    (void)Decode(seg, saddr, addr);
+  } catch (const std::runtime_error &) {
+    ++tests;
+    return;
+  }
+  throw std::runtime_error("invalid FLAT accepted");
+}
+static void Scratch(unsigned saddr, unsigned addr, unsigned expectedVector,
+                    unsigned expectedScalar) {
+  auto op = Decode(1, saddr, addr, 0xffcu);
+  Require(op.memorySegment == 1 && op.memoryOffset == -4 &&
+          op.sourceCount == 2);
+  Require(op.source0.kind == (expectedVector
+                                  ? RdnaOperandKind::VectorRegister
+                                  : RdnaOperandKind::IntegerInlineConstant));
+  Require(op.source1.kind == (expectedScalar
+                                  ? RdnaOperandKind::ScalarRegister
+                                  : RdnaOperandKind::IntegerInlineConstant));
+  if (expectedVector)
+    Require(op.source0.reg == addr);
+  else
+    Require(op.source0.value == 0);
+  if (expectedScalar)
+    Require(op.source1.reg == saddr);
+  else
+    Require(op.source1.value == 0);
+  IrProgram program;
+  auto &block = program.CreateBlock();
+  program.SetEntryBlock(block);
+  TranslationContext context(program, block, 256);
+  context.TranslateInstruction(op);
+  unsigned vectors = 0, addressReads = 0, destinationReads = 0, scalars = 0,
+           loads = 0, scratch = 0;
+  for (auto *inst : block.Instructions()) {
+    if (inst->Opcode() == IrOpcode::GetVectorRegister) {
+      ++vectors;
+      auto reg = inst->Arguments().at(0)->Register().index;
+      Require(reg < 256);
+      if (reg == addr)
+        ++addressReads;
+      if (reg == 2)
+        ++destinationReads;
+    }
+    if (inst->Opcode() == IrOpcode::GetScalarRegister)
+      ++scalars;
+    if (inst->Opcode() == IrOpcode::LoadAddressU32)
+      ++loads;
+    if (inst->Opcode() == IrOpcode::GetScratchResource)
+      ++scratch;
+  }
+  std::printf(
+      "SV/SS/ST saddr=%u addr=%u vector=%u scalar=%u loads=%u scratch=%u\n",
+      saddr, addr, vectors, scalars, loads, scratch);
+  std::fflush(stdout);
+  Require(vectors == expectedVector + 1 && addressReads == expectedVector &&
+          destinationReads == 1 && scalars == expectedScalar && loads == 1 &&
+          scratch == 1);
+  ++tests;
+}
+int main() {
+
+  const std::array<unsigned, 2> code{0xdc304000u, 0x027d00ffu};
+  auto actual = DecodeRdnaFlat(0x154cu, code, 0);
+  Require(actual.destination.reg == 2 && actual.source0.reg == 255 &&
+          actual.source1.value == 0);
+  ++tests;
+  Scratch(125, 255, 1, 0);
+  Scratch(125, 254, 1, 0);
+  Scratch(0, 255, 0, 1);
+  Scratch(105, 255, 0, 1);
+  Scratch(127, 255, 0, 0);
+  Reject(0, 125, 255);
+  Reject(2, 125, 255);
+  Reject(2, 127, 255);
+  Reject(1, 108, 0);
+  Reject(3, 0, 0);
+  auto flat = Decode(0, 125, 254);
+  Require(flat.source1.kind == RdnaOperandKind::VectorRegister &&
+          flat.source1.reg == 255);
+  ++tests;
+  auto global = Decode(2, 0, 255);
+  Require(global.source0.reg == 255 &&
+          global.source1.kind == RdnaOperandKind::ScalarRegister);
+  ++tests;
+  try {
+    const std::array<unsigned, 1> truncated{0xdc304000u};
+    (void)DecodeRdnaFlat(0, truncated, 0);
+    throw std::logic_error("truncated accepted");
+  } catch (const std::out_of_range &) {
+    ++tests;
+  }
+  std::printf("PASS %u flat scratch decode/IR and invalid boundary cases\n",
+              tests);
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/Flip.cpp b/core/libs/prx/libSceAgcDriver/tests/Flip.cpp
index ec73dea01a..9e89fdd61c 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Flip.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Flip.cpp
@@ -355,7 +355,11 @@ void testFailureLog() {
     std::fflush(stderr);
     const int saved = APS5_DUP(APS5_FILENO(stderr));
     check(saved >= 0, "stderr could not be saved");
-    check(std::freopen(path.string().c_str(), "wb", stderr) != nullptr, "stderr could not be redirected");
+#ifdef _WIN32
+    check(_wfreopen(path.wstring().c_str(), L"wb", stderr) != nullptr, "stderr could not be redirected");
+#else
+    check(std::freopen(path.c_str(), "wb", stderr) != nullptr, "stderr could not be redirected");
+#endif
     std::string message;
     std::string error;
     try {
diff --git a/core/libs/prx/libSceAgcDriver/tests/FormattedBufferOnce.cpp b/core/libs/prx/libSceAgcDriver/tests/FormattedBufferOnce.cpp
index 0eba15d628..86b372cf72 100644
--- a/core/libs/prx/libSceAgcDriver/tests/FormattedBufferOnce.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/FormattedBufferOnce.cpp
@@ -19,8 +19,8 @@ void Check(bool condition, const std::string& message) {
 }
 
 SpirvTarget Target() {
-    static constexpr std::array<std::uint32_t, 4> capabilities{
-        spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess, spv::CapabilityClipDistance,
+    static constexpr std::array<std::uint32_t, 5> capabilities{
+        spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess, spv::CapabilityClipDistance, spv::CapabilityInt64Atomics,
     };
     static constexpr std::array<std::string_view, 4> extensions{
         "SPV_EXT_descriptor_indexing", "SPV_KHR_8bit_storage", "SPV_KHR_float_controls", "SPV_KHR_physical_storage_buffer",
@@ -31,6 +31,7 @@ SpirvTarget Target() {
 
 struct Counts {
     std::size_t words = 0;
+    std::size_t arrayLengths = 0;
     std::size_t switches = 0;
     std::size_t calls = 0;
     std::size_t functions = 0;
@@ -46,6 +47,7 @@ Counts Count(std::span<const std::uint32_t> words) {
         Check(count != 0 && count <= words.size() - offset, "formatted buffer once: malformed SPIR-V instruction");
         const auto opcode = words[offset] & spv::OpCodeMask;
         if (opcode == spv::OpSwitch) ++counts.switches;
+        if (opcode == spv::OpArrayLength) ++counts.arrayLengths;
         if (opcode == spv::OpFunctionCall) ++counts.calls;
         if (opcode == spv::OpAtomicCompareExchange) ++counts.compareExchanges;
         if (opcode == spv::OpFunction) {
@@ -57,9 +59,10 @@ Counts Count(std::span<const std::uint32_t> words) {
     return counts;
 }
 
-Counts Compile(std::size_t loads, bool formattedStores = false, bool gpu = false, bool vertex = false, bool registration = false) {
+Counts Compile(std::size_t loads, bool formattedStores = false, bool gpu = false, bool vertex = false, bool registration = false, bool atomicBeforeLoads = false) {
     std::vector<std::uint32_t> code;
     if (gpu) code.push_back(0x7e160500u);
+    if (atomicBeforeLoads) code.insert(code.end(), {0xe1705000u, 0x80012803u, 0xbf8c3f70u});
     for (std::uint32_t load = 0; load < loads; ++load) code.insert(code.end(), {0xe0000000u | (load * 4u), 0x80020000u | ((10u + load) << 8u)});
     code.push_back(0xbf8c3f70u);
     for (std::uint32_t load = 0; load < loads; ++load) code.insert(code.end(), {(formattedStores ? 0xe0100000u : 0xe0700000u) | (load * 4u), 0x80010000u | ((10u + load) << 8u)});
@@ -83,6 +86,32 @@ Counts Compile(std::size_t loads, bool formattedStores = false, bool gpu = false
     return Count(Recompile(request).spirv.Words());
 }
 
+Counts CompileScalarReads(std::size_t loads) {
+    std::array<std::uint32_t, 8> userData{};
+    RecompileRequest request{};
+    request.shader = {ShaderStage::Compute, 0u, {}, 0, {}};
+    request.target = Target();
+    request.layout = {0, 0, 0, 128};
+    request.context.waveSize = 32;
+    request.context.userDataBaseRegister = 0;
+    request.context.userData = userData;
+    request.context.compute = ShaderComputeStageInfo{{32u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.useCache = false;
+    std::vector<std::uint32_t> code;
+    for (std::uint32_t load = 0; load < loads; ++load) {
+        code.insert(code.end(), {0xf4000200u | (load * 4u), 0xfa000004u, 0x7e040208u | (load << 8u)});
+    }
+    code.push_back(0xbf8c3f70u);
+    for (std::uint32_t load = 0; load < loads; ++load) code.insert(code.end(), {0xe0701000u | (load * 4u), 0x80010000u | ((10u + load) << 8u)});
+    code.push_back(0xbf810000u);
+    const std::span<const std::uint32_t> words(code);
+    const std::array<MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(words.data()), std::as_bytes(words)}}};
+    request.shader.codeAddress = reinterpret_cast<std::uintptr_t>(words.data());
+    request.shader.code = words;
+    request.context.memory = memory;
+    return Count(Recompile(request).spirv.Words());
+}
+
 }
 
 int main() {
@@ -90,6 +119,9 @@ int main() {
         const auto none = Compile(0);
         const auto one = Compile(1);
         const auto three = Compile(3);
+        const auto scalarOne = CompileScalarReads(1);
+        const auto scalarThree = CompileScalarReads(3);
+        const auto atomicThenLoad = Compile(1, false, false, false, false, true);
         const auto gpuOne = Compile(1, false, true);
         const auto vertexSpecialized = Compile(1, false, false, true, false);
         const auto vertexRegistration = Compile(1, false, false, true, true);
@@ -105,6 +137,12 @@ int main() {
         Check(storeOne.functions == none.functions + 2 && storeOne.calls == none.calls + 2, "formatted buffer once: a formatted load and a formatted store to another resource emitted " + std::to_string(storeOne.functions - none.functions) + " functions and " + std::to_string(storeOne.calls - none.calls) + " calls more than none, expected one function and one call each");
         Check(storeThree.functions == storeOne.functions && storeThree.calls == storeOne.calls + 4 && storeThree.switches == storeOne.switches, "formatted buffer once: two more formatted loads and stores emitted " + std::to_string(storeThree.functions - storeOne.functions) + " functions, " + std::to_string(storeThree.calls - storeOne.calls) + " calls and " + std::to_string(storeThree.switches - storeOne.switches) + " switches more, expected four calls only");
         Check(three.words - one.words < (one.words - none.words) / 2u, "formatted buffer once: 2 more formatted loads added " + std::to_string(three.words - one.words) + " SPIR-V words, as many as the first one with its shared function (" + std::to_string(one.words - none.words) + ")");
+#if ANYPS5_ENABLE_SPIRV_TOOLS
+        Check(atomicThenLoad.words > 5u, "a 64-bit buffer atomic followed by a buffer read did not produce a SPIR-V module");
+#else
+        Check(scalarOne.arrayLengths == 1u && scalarThree.arrayLengths == 3u, "scalar buffer reads across generated labels emitted " + std::to_string(scalarThree.arrayLengths) + " OpArrayLength instructions for 3 reads (expected one per label)");
+        Check(atomicThenLoad.arrayLengths > 1u, "a buffer query inside the 64-bit atomic path was reused after its merge (expected at least 2 OpArrayLength instructions, got " + std::to_string(atomicThenLoad.arrayLengths) + ")");
+#endif
         const auto gpuThree = Compile(3, false, true);
         Check(gpuThree.functions == gpuOne.functions && gpuThree.calls > gpuOne.calls, "formatted buffer once: two more formatted loads from a GPU-selected descriptor emitted " + std::to_string(gpuThree.functions - gpuOne.functions) + " more functions, expected calls to the shared one");
         Check(gpuThree.switches == gpuOne.switches, "formatted buffer once: two more formatted loads from a GPU-selected descriptor emitted " + std::to_string(gpuThree.switches - gpuOne.switches) + " more format switches");
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp
new file mode 100644
index 0000000000..63bfa42046
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameCapture.cpp
@@ -0,0 +1,238 @@
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+#ifdef _WIN32
+#include <process.h>
+#define getpid _getpid
+#else
+#include <unistd.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCall;
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+using AgcDriver::FrameCaptureWriter;
+using AgcDriver::FrameMemoryChunk;
+using AgcDriver::FrameMemoryKind;
+using AgcDriver::FrameRangeKind;
+
+void check(bool condition, const std::string& message) {
+    if (!condition) {
+        std::fprintf(stderr, "FAILED: %s\n", message.c_str());
+        std::exit(1);
+    }
+}
+
+template <typename TFunction>
+void checkThrows(TFunction&& function, const std::string& message) {
+    try {
+        function();
+    } catch (const std::runtime_error&) {
+        return;
+    }
+    check(false, message);
+}
+
+bool sameRegisters(const std::vector<ShaderRegister>& left, const std::vector<ShaderRegister>& right) {
+    if (left.size() != right.size()) return false;
+    for (std::size_t index = 0; index < left.size(); ++index) {
+        if (left[index].offset != right[index].offset || left[index].value != right[index].value) return false;
+    }
+    return true;
+}
+
+bool sameCall(const FrameCall& left, const FrameCall& right) {
+    return left.kind == right.kind && left.ordinal == right.ordinal && left.timeNs == right.timeNs && left.thread == right.thread && left.accepted == right.accepted && left.completed == right.completed && left.queue == right.queue &&
+           left.flags == right.flags && left.cpuFlip == right.cpuFlip && left.address == right.address && left.size == right.size && left.values == right.values && sameRegisters(left.context, right.context) &&
+           sameRegisters(left.primitive, right.primitive);
+}
+
+std::vector<FrameCall> sampleCalls() {
+    std::vector<FrameCall> calls;
+    FrameCall shader;
+    shader.kind = FrameCallKind::RegisterShader;
+    shader.ordinal = 1;
+    shader.address = 0x2000010000;
+    calls.push_back(shader);
+    FrameCall abi;
+    abi.kind = FrameCallKind::ResolveGraphicsStagesAbi;
+    abi.ordinal = 2;
+    abi.values = {0x2000010000, 0x2000020000, 0};
+    abi.context = {{0x1a0, 7}, {0x1a1, 0xffffffffu}};
+    abi.primitive = {{0x242, 3}};
+    calls.push_back(abi);
+    FrameCall submit;
+    submit.kind = FrameCallKind::Submit;
+    submit.ordinal = 3;
+    submit.timeNs = 123456789;
+    submit.thread = 4242;
+    submit.accepted = 20;
+    submit.completed = 17;
+    submit.queue = 0x21;
+    submit.address = 0x2000030000;
+    submit.size = 4096;
+    calls.push_back(submit);
+    FrameCall flip;
+    flip.kind = FrameCallKind::Flip;
+    flip.ordinal = 4;
+    flip.cpuFlip = true;
+    flip.values = {1, 2, 0, static_cast<std::uint64_t>(-5)};
+    calls.push_back(flip);
+    FrameCall unregister;
+    unregister.kind = FrameCallKind::UnregisterVideoOutput;
+    unregister.ordinal = 5;
+    unregister.values = {1};
+    calls.push_back(unregister);
+    FrameCall end;
+    end.kind = FrameCallKind::End;
+    end.ordinal = 6;
+    calls.push_back(end);
+    return calls;
+}
+
+std::vector<std::byte> sampleMemory() {
+    constexpr std::size_t Block = FrameCaptureWriter::BlockBytes;
+    std::vector<std::byte> memory(Block * 150 + 4096);
+    for (std::size_t block = 0; block < 150; ++block) {
+        if (block % 3 == 1 || (block >= 10 && block < 90)) {
+            for (std::size_t at = 0; at < Block; at += 97) memory[block * Block + at] = static_cast<std::byte>((block * 131 + at) & 0xff);
+        }
+    }
+    memory[memory.size() - 1] = std::byte{0x5a};
+    return memory;
+}
+
+void truncateFile(const std::filesystem::path& path, std::uintmax_t removed) {
+    const auto size = std::filesystem::file_size(path);
+    std::filesystem::resize_file(path, size - removed);
+}
+
+void testRoundTrip(const std::filesystem::path& directory) {
+    constexpr std::uint64_t Base = 0x2000000000;
+    const auto calls = sampleCalls();
+    const auto memory = sampleMemory();
+    std::vector<std::byte> delta(8192);
+    for (std::size_t at = 0; at < delta.size(); ++at) delta[at] = static_cast<std::byte>(at * 7);
+    std::uint64_t stored = 0;
+    {
+        FrameCaptureWriter writer(directory);
+        writer.WriteRange(Base, memory.size(), FrameRangeKind::Watched, 3, AgcDriver::FrameRangeAccess::Readable | AgcDriver::FrameRangeAccess::Gpu);
+        stored = writer.WriteSnapshot(Base, memory);
+        for (const auto& call : calls) writer.WriteCall(call);
+        writer.WriteDelta(1, 17, Base + 0x3000, delta);
+        writer.Finish("{\"magic\":\"aps5-frame-capture 1\"}\n");
+        check(writer.RawBytes() == stored + delta.size(), "raw byte count does not add the snapshot and the delta");
+    }
+    std::size_t nonzero = 0;
+    for (std::size_t at = 0; at < memory.size(); at += FrameCaptureWriter::BlockBytes) {
+        const auto bytes = std::min(FrameCaptureWriter::BlockBytes, memory.size() - at);
+        if (!AgcDriver::AllZero(std::span(memory).subspan(at, bytes))) nonzero += bytes;
+    }
+    check(stored == nonzero, "the snapshot stored zero blocks or lost data blocks");
+
+    const FrameCaptureReader reader(directory);
+    check(!reader.Truncated(), "a finished capture reads as truncated");
+    check(reader.Header() == "{\"magic\":\"aps5-frame-capture 1\"}\n", "header does not round-trip");
+    check(reader.Calls().size() == calls.size(), "call count does not round-trip");
+    for (std::size_t index = 0; index < calls.size(); ++index) check(sameCall(reader.Calls()[index], calls[index]), "call " + std::to_string(index) + " does not round-trip");
+
+    std::vector<std::byte> restored(memory.size());
+    std::size_t ranges = 0, snapshots = 0, deltas = 0;
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Range) {
+            ++ranges;
+            check(chunk.address == Base && chunk.bytes == memory.size() && chunk.rangeKind == FrameRangeKind::Watched && chunk.protection == 3 &&
+                      chunk.access == (AgcDriver::FrameRangeAccess::Readable | AgcDriver::FrameRangeAccess::Gpu), "range does not round-trip");
+            continue;
+        }
+        if (chunk.kind == FrameMemoryKind::Snapshot) {
+            ++snapshots;
+            check(chunk.bytes <= FrameCaptureWriter::ChunkBytes, "snapshot chunk is larger than the chunk limit");
+            check(chunk.address >= Base && chunk.address - Base + chunk.bytes <= restored.size(), "snapshot chunk outside its range");
+            reader.Read(chunk, std::span(restored).subspan(chunk.address - Base, chunk.bytes));
+            continue;
+        }
+        ++deltas;
+        check(chunk.group == 1 && chunk.completed == 17 && chunk.address == Base + 0x3000, "delta header does not round-trip");
+        check(reader.Read(chunk) == delta, "delta bytes do not round-trip");
+    }
+    check(ranges == 1 && deltas == 1 && snapshots >= 2, "unexpected chunk counts");
+    check(restored == memory, "snapshot does not restore the memory");
+    std::vector<std::byte> wrong(1);
+    checkThrows([&] { reader.Read(reader.Chunks()[1], wrong); }, "a read into a wrongly sized destination does not throw");
+}
+
+void testTruncated(const std::filesystem::path& source, const std::filesystem::path& directory) {
+    std::filesystem::remove_all(directory);
+    std::filesystem::copy(source, directory, std::filesystem::copy_options::recursive);
+    truncateFile(directory / FrameCaptureWriter::CallsName, 3);
+    truncateFile(directory / FrameCaptureWriter::MemoryName, 10);
+    std::filesystem::remove(directory / FrameCaptureWriter::HeaderName);
+    const FrameCaptureReader reader(directory);
+    const auto calls = sampleCalls();
+    check(reader.Truncated(), "a cut capture does not read as truncated");
+    check(reader.Calls().size() == calls.size() - 1, "a cut call record is not dropped");
+    check(reader.Chunks().back().kind != FrameMemoryKind::Delta, "a cut memory chunk is not dropped");
+}
+
+void testCorrupt(const std::filesystem::path& source, const std::filesystem::path& directory) {
+    std::filesystem::remove_all(directory);
+    std::filesystem::copy(source, directory, std::filesystem::copy_options::recursive);
+    {
+        std::fstream file(directory / FrameCaptureWriter::CallsName, std::ios::binary | std::ios::in | std::ios::out);
+        file.seekp(static_cast<std::streamoff>(FrameCaptureWriter::CallsMagic.size()));
+        const std::uint32_t kind = 99;
+        file.write(reinterpret_cast<const char*>(&kind), sizeof(kind));
+    }
+    checkThrows([&] { FrameCaptureReader reader(directory); }, "an unknown call kind does not throw");
+    std::ofstream(directory / FrameCaptureWriter::CallsName, std::ios::binary | std::ios::trunc) << "not a capture";
+    checkThrows([&] { FrameCaptureReader reader(directory); }, "a file without the magic does not throw");
+}
+
+void testWriter(const std::filesystem::path& directory) {
+    FrameCaptureWriter writer(directory);
+    writer.Finish("{}");
+    FrameCall call;
+    call.kind = FrameCallKind::Suspend;
+    checkThrows([&] { writer.WriteCall(call); }, "a call after Finish does not throw");
+    checkThrows([&] { writer.Finish("{}"); }, "a second Finish does not throw");
+    FrameCall unknown;
+    unknown.kind = static_cast<FrameCallKind>(77);
+    FrameCaptureWriter other(directory / "other");
+    checkThrows([&] { other.WriteCall(unknown); }, "an unknown call kind is written");
+}
+
+void testAllZero() {
+    std::vector<std::byte> bytes(37);
+    check(AgcDriver::AllZero(bytes), "zero bytes are not all zero");
+    check(AgcDriver::AllZero({}), "an empty span is not all zero");
+    bytes[36] = std::byte{1};
+    check(!AgcDriver::AllZero(bytes), "a nonzero tail byte is missed");
+    bytes[36] = std::byte{0};
+    bytes[3] = std::byte{1};
+    check(!AgcDriver::AllZero(bytes), "a nonzero word is missed");
+}
+
+}
+
+int main() {
+    const auto root = std::filesystem::temp_directory_path() / ("aps5-frame-capture-test-" + std::to_string(getpid()));
+    std::filesystem::remove_all(root);
+    testAllZero();
+    testRoundTrip(root / "capture");
+    testTruncated(root / "capture", root / "truncated");
+    testCorrupt(root / "capture", root / "corrupt");
+    testWriter(root / "writer");
+    std::filesystem::remove_all(root);
+    std::puts("frame capture tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp
new file mode 100644
index 0000000000..88d8cb144e
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameCaptureEop.cpp
@@ -0,0 +1,143 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+
+constexpr std::uint32_t Handle = 7;
+constexpr std::size_t BlockBytes = 1u << 20;
+constexpr std::size_t Frames = 6;
+constexpr std::size_t CapturedFrames = 3;
+
+void check(bool condition, const std::string& reason) {
+    if (!condition) throw std::runtime_error(reason);
+}
+
+class Request final : public AgcDriver::IFlipRequest {
+public:
+    explicit Request(std::atomic<int>& ready) : ready(ready) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { ++ready; }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+
+private:
+    std::atomic<int>& ready;
+};
+
+class Output final : public AgcDriver::IVideoOutput {
+public:
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<Request>(ready); }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+    std::atomic<int> ready = 0;
+};
+
+std::byte* allocate() {
+    auto* const block = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536));
+    check(block != nullptr, "cannot allocate guest memory");
+    GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 0x04, BlockBytes);
+    GuestAllocations::Mutation mutation;
+    mutation.Add(block, BlockBytes, true, true, true);
+    return block;
+}
+
+void submitEopFrame(std::byte* block, std::size_t frame) {
+    const auto token = AgcDriverReserveEopFlip_nid_postfix(AgcDriver::FlipInfo{Handle, 0, 1, static_cast<std::int64_t>(frame)});
+    check(token != 0, "the EOP flip of frame " + std::to_string(frame) + " was not reserved");
+    auto* const words = reinterpret_cast<std::uint32_t*>(block + frame * 256);
+    const auto label = reinterpret_cast<std::uintptr_t>(block + BlockBytes / 2 + frame * 8);
+    const std::array<std::uint32_t, 8> release{0xc0064900u, 0x06200504u, 0x42010000u, static_cast<std::uint32_t>(label), static_cast<std::uint32_t>(label >> 32u), 1u, 0u, token};
+    std::memcpy(words, release.data(), sizeof(release));
+    Packet packet{words, static_cast<std::uint32_t>(release.size()), 0, {}};
+    check(sceAgcDriverSubmitDcb(&packet) == 0, "the EOP submission of frame " + std::to_string(frame) + " failed");
+}
+
+void testEopFramesCountOnce() {
+    const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+    check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set");
+    auto* const block = allocate();
+    auto output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+    for (std::size_t frame = 0; frame < Frames; ++frame) submitEopFrame(block, frame);
+    AgcDriverWaitIdle_nid_postfix();
+    check(output->ready.load() == static_cast<int>(Frames), "the driver presented " + std::to_string(output->ready.load()) + " of the EOP flips");
+
+    const FrameCaptureReader reader{std::filesystem::path(directory)};
+    check(!reader.Truncated(), "the capture is truncated");
+    check(reader.Header().find("\"frames\":" + std::to_string(CapturedFrames)) != std::string::npos, "the capture header does not record " + std::to_string(CapturedFrames) + " frames: " + reader.Header());
+    const auto& calls = reader.Calls();
+    const auto start = std::find_if(calls.begin(), calls.end(), [](const auto& call) { return call.kind == FrameCallKind::FrameStart; });
+    check(start != calls.end(), "the capture has no frame start");
+    std::size_t submits = 0, reservations = 0;
+    FrameCallKind first = FrameCallKind::End;
+    for (auto call = start + 1; call != calls.end(); ++call) {
+        if (call->kind == FrameCallKind::Submit || call->kind == FrameCallKind::ReserveEopFlip) {
+            if (first == FrameCallKind::End) first = call->kind;
+            submits += call->kind == FrameCallKind::Submit;
+            reservations += call->kind == FrameCallKind::ReserveEopFlip;
+        }
+    }
+    check(first == FrameCallKind::ReserveEopFlip, "the capture started between a reservation and the submission that flips it");
+    check(submits == CapturedFrames && reservations == CapturedFrames,
+          "the captured frames hold " + std::to_string(submits) + " submissions and " + std::to_string(reservations) + " reservations, expected " + std::to_string(CapturedFrames) + " of each");
+}
+
+void testFlipsCountPerThread() {
+    auto* const block = allocate();
+    const auto& driver = AgcDriver::DriverDetail::Driver::Get();
+    const auto before = driver.FlipSubmissions();
+    std::uint64_t otherBefore = 0, otherAfter = 0;
+    std::exception_ptr failure;
+    std::thread submitter([&] {
+        try {
+            otherBefore = driver.FlipSubmissions();
+            submitEopFrame(block, 0);
+            otherAfter = driver.FlipSubmissions();
+        } catch (...) {
+            failure = std::current_exception();
+        }
+    });
+    submitter.join();
+    if (failure) std::rethrow_exception(failure);
+    AgcDriverWaitIdle_nid_postfix();
+    check(otherAfter == otherBefore + 1, "the flipping submission did not count on the thread that made it");
+    check(driver.FlipSubmissions() == before, "a flip submitted on another thread changed this thread's flip count, so a submission of this thread that overlaps it would end a captured frame");
+}
+
+}
+
+int main() {
+    try {
+        testEopFramesCountOnce();
+        testFlipsCountPerThread();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "FAILED: %s\n", error.what());
+        return 1;
+    }
+    std::puts("frame capture EOP tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp
index ec52e5f1d9..f6b12a62e6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameDumpIo.cpp
@@ -120,13 +120,15 @@ void DisableAfterFailure() {
     AgcDriver::FrameDumpOutput output;
     const std::array<std::byte, 16> pixels{};
     Check(output.Enabled_nid_no_patch(), "BMP output was disabled before any failure");
-    const auto blocked = directory.string();
+    const auto previous = std::filesystem::current_path();
+    std::filesystem::current_path(directory.parent_path());
+    const auto blocked = directory.filename().string();
     Check(!output.Write_nid_no_patch(blocked.c_str(), 2, 2, pixels), "BMP output accepted a directory as a file");
     Check(!output.Enabled_nid_no_patch(), "failed BMP output remained enabled");
-    const auto skipped = directory / "must-not-exist.bmp";
-    const auto path = skipped.string();
+    const auto path = (directory.filename() / "must-not-exist.bmp").string();
     for (unsigned i = 0; i < 64; ++i) Check(!output.Write_nid_no_patch(path.c_str(), 2, 2, pixels), "disabled BMP output wrote another file");
-    Check(!std::filesystem::exists(skipped), "disabled BMP output created a file");
+    std::filesystem::current_path(previous);
+    Check(!std::filesystem::exists(directory / "must-not-exist.bmp"), "disabled BMP output created a file");
     Check(std::filesystem::remove(directory), "cannot remove empty fixture directory");
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
new file mode 100644
index 0000000000..dc652cddfe
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
@@ -0,0 +1,205 @@
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <atomic>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+using AgcDriver::FrameMemoryKind;
+
+constexpr std::uint32_t Handle = 7;
+constexpr std::uint8_t GraphicsMemory = 0x0a;
+constexpr std::uint8_t DmaMemory = 0;
+constexpr std::size_t BlockBytes = 1u << 20;
+constexpr std::size_t CommandBytes = 64u * 1024u;
+constexpr std::size_t DataBytes = 4096;
+constexpr std::uint32_t Done = 1;
+
+void check(bool condition, const std::string& reason) {
+    if (!condition) throw std::runtime_error(reason);
+}
+
+std::uint64_t at(const volatile void* pointer) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(pointer));
+}
+
+class Request final : public AgcDriver::IFlipRequest {
+public:
+    explicit Request(std::atomic<int>& ready) : ready(ready) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { ++ready; }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+
+private:
+    std::atomic<int>& ready;
+};
+
+class Output final : public AgcDriver::IVideoOutput {
+public:
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<Request>(ready); }
+    void Fail(std::exception_ptr error) noexcept override {
+        if (!error) std::terminate();
+    }
+    std::atomic<int> ready = 0;
+};
+
+struct Layout {
+    std::byte* base = nullptr;
+    std::uint32_t* firstCommands = nullptr;
+    std::uint32_t* secondCommands = nullptr;
+    std::byte* source = nullptr;
+    std::byte* firstTarget = nullptr;
+    std::byte* secondTarget = nullptr;
+    std::uint32_t* label = nullptr;
+};
+
+Layout allocate() {
+    auto* const block = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536));
+    check(block != nullptr, "cannot allocate guest memory");
+    GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, 0x04, BlockBytes);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, BlockBytes, true, true, true);
+    }
+    Layout layout;
+    layout.base = block;
+    layout.firstCommands = reinterpret_cast<std::uint32_t*>(block);
+    layout.secondCommands = reinterpret_cast<std::uint32_t*>(block + CommandBytes);
+    layout.source = block + 2 * CommandBytes;
+    layout.firstTarget = layout.source + DataBytes;
+    layout.secondTarget = layout.firstTarget + DataBytes;
+    layout.label = reinterpret_cast<std::uint32_t*>(layout.secondTarget + DataBytes);
+    return layout;
+}
+
+std::vector<std::byte> pattern(std::uint8_t seed) {
+    std::vector<std::byte> bytes(DataBytes);
+    for (std::size_t index = 0; index < bytes.size(); ++index) bytes[index] = static_cast<std::byte>((index * 31 + seed) & 0xff);
+    return bytes;
+}
+
+void copyFrame(std::uint32_t* words, const Layout& layout, std::byte* target) {
+    CommandBuffer buffer{words, words + CommandBytes / sizeof(std::uint32_t), words, words + CommandBytes / sizeof(std::uint32_t), nullptr, nullptr, 0};
+    sceAgcDcbDmaData(&buffer, 0, DmaMemory, 0, at(target), DmaMemory, 0, at(layout.source), DataBytes, 0, 1, 0);
+    sceAgcDcbWriteData(&buffer, GraphicsMemory, 0, at(layout.label), &Done, 1, 0, 1);
+    Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
+    check(sceAgcDriverSubmitDcb(&packet) == 0, "submission failed");
+}
+
+void flip() {
+    AgcDriverSubmitFlip_nid_postfix(AgcDriver::FlipInfo{Handle, -1, 1, 0});
+}
+
+std::vector<std::byte> readFile(const std::filesystem::path& path) {
+    std::ifstream file(path, std::ios::binary);
+    check(file.is_open(), "cannot open " + path.string());
+    std::vector<char> bytes((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
+    std::vector<std::byte> result(bytes.size());
+    std::memcpy(result.data(), bytes.data(), bytes.size());
+    return result;
+}
+
+bool equal(const std::byte* bytes, const std::vector<std::byte>& expected) {
+    return std::memcmp(bytes, expected.data(), expected.size()) == 0;
+}
+
+void testCaptureAndReplay(const std::filesystem::path& tool) {
+    const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+    check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set");
+    const std::filesystem::path capture(directory);
+    const auto layout = allocate();
+    const auto first = pattern(3);
+    const auto second = pattern(101);
+    auto output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+    AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output);
+    output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+
+    flip();
+    std::memcpy(layout.source, first.data(), first.size());
+    copyFrame(layout.firstCommands, layout, layout.firstTarget);
+    flip();
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriverUnregisterVideoOutput_nid_postfix(Handle, output);
+    output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+    const auto late = allocate();
+    std::memcpy(late.source, second.data(), second.size());
+    copyFrame(late.firstCommands, late, late.firstTarget);
+    flip();
+    AgcDriverWaitIdle_nid_postfix();
+    check(equal(layout.firstTarget, first) && equal(late.firstTarget, second), "the driver did not run the copies while capturing");
+
+    const FrameCaptureReader reader(capture);
+    check(!reader.Truncated(), "the capture is truncated");
+    check(reader.Header().find("\"frames\":2") != std::string::npos, "the capture header does not record two frames: " + reader.Header());
+    std::size_t submits = 0, flips = 0, memory = 0, starts = 0, registrations = 0, unregistrations = 0;
+    for (const auto& call : reader.Calls()) {
+        submits += call.kind == FrameCallKind::Submit;
+        flips += call.kind == FrameCallKind::Flip;
+        memory += call.kind == FrameCallKind::Memory;
+        starts += call.kind == FrameCallKind::FrameStart;
+        registrations += call.kind == FrameCallKind::RegisterVideoOutput;
+        unregistrations += call.kind == FrameCallKind::UnregisterVideoOutput;
+    }
+    check(starts == 1 && submits == 2 && flips == 2, "the capture holds " + std::to_string(submits) + " submits and " + std::to_string(flips) + " flips after " + std::to_string(starts) + " frame starts");
+    check(memory >= 2, "the CPU writes before each copy were not recorded as memory deltas");
+    check(registrations == 3 && unregistrations == 2, "video output close and reopen was not recorded before and during capture");
+    const auto recorded = [&](const std::byte* base) {
+        return std::any_of(reader.Chunks().begin(), reader.Chunks().end(), [&](const auto& chunk) {
+            return chunk.kind == FrameMemoryKind::Range && chunk.address <= at(base) && at(base) + BlockBytes <= chunk.address + chunk.bytes;
+        });
+    };
+    check(recorded(layout.base), "the guest block is not in the snapshot ranges");
+    check(recorded(late.base), "the block committed during the capture is not in its ranges");
+    check(reader.Header().find("\"late_ranges\":1") != std::string::npos, "the capture header does not count one range committed during the capture: " + reader.Header());
+
+    const auto firstDump = capture / "first.bin";
+    const auto secondDump = capture / "second.bin";
+    const auto command = "\"\"" + tool.string() + "\" \"" + capture.string() + "\" --strict --dump " + std::to_string(at(layout.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + firstDump.string() +
+                         "\" --dump " + std::to_string(at(late.firstTarget)) + ":" + std::to_string(DataBytes) + ":\"" + secondDump.string() + "\"\"";
+    const auto code = std::system(command.c_str());
+    check(code == 0, "agc_frame_replay exited with " + std::to_string(code));
+    check(readFile(firstDump) == first, "the replay did not reproduce the first copy");
+    check(readFile(secondDump) == second, "the replay did not reproduce the second copy");
+}
+
+}
+
+int main(int argc, char** argv) {
+    if (argc != 2) {
+        std::fprintf(stderr, "usage: agc_driver_frame_replay_tests <agc_frame_replay>\n");
+        return 2;
+    }
+    try {
+        testCaptureAndReplay(argv[1]);
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "FAILED: %s\n", error.what());
+        return 1;
+    }
+    std::puts("frame replay tests passed");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp
new file mode 100644
index 0000000000..c54b01466a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplayState.cpp
@@ -0,0 +1,241 @@
+#define main frameReplayToolMain
+#include "../tools/FrameReplay.cpp"
+#undef main
+#include "prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp"
+#include <barrier>
+
+namespace {
+
+using AgcDriver::FrameCaptureWriter;
+
+void check(bool condition, const char* reason) {
+    if (!condition) throw std::runtime_error(reason);
+}
+
+std::uint64_t address(const void* pointer) {
+    return reinterpret_cast<std::uintptr_t>(pointer);
+}
+
+std::byte* allocate(std::size_t size, bool gpu = true) {
+    auto* bytes = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(size, 65536));
+    check(bytes != nullptr, "guest allocation failed");
+    GuestArena::GuestArenaCommit_nid_postfix(bytes, size, 0x04, size);
+    GuestAllocations::Mutation mutation;
+    mutation.Add(bytes, size, true, true, gpu);
+    return bytes;
+}
+
+void collectGroups(Replay& replay) {
+    for (const auto& chunk : replay.reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Delta) replay.groups[chunk.group].push_back(&chunk);
+    }
+}
+
+FrameCall memoryCall(std::uint64_t group, std::uint64_t thread) {
+    FrameCall call;
+    call.kind = FrameCallKind::Memory;
+    call.values = {group};
+    call.thread = thread;
+    return call;
+}
+
+void testMemoryOrder(const std::filesystem::path& directory) {
+    constexpr std::size_t Size = 64u * 1024u * 1024u;
+    auto* bytes = allocate(Size);
+    const std::vector<std::byte> first(Size, std::byte{0x11});
+    const std::vector<std::byte> second(4096, std::byte{0x22});
+    FrameCaptureWriter writer(directory);
+    writer.WriteDelta(1, 0, address(bytes), first);
+    writer.WriteDelta(2, 0, address(bytes + Size - second.size()), second);
+    writer.Finish("{}");
+    const FrameCaptureReader reader(directory);
+    Options options;
+    options.release = false;
+    Replay replay{options, reader};
+    replay.recording = true;
+    collectGroups(replay);
+    const std::array calls{memoryCall(1, 1), memoryCall(2, 2)};
+    replay.runWindow(calls);
+    check(std::all_of(bytes, bytes + Size - second.size(), [](std::byte value) { return value == std::byte{0x11}; }), "first delta was not restored");
+    check(std::equal(second.begin(), second.end(), bytes + Size - second.size()), "an earlier delta overwrote the later thread's delta");
+}
+
+void testReusedMemory(const std::filesystem::path& directory) {
+#ifdef _WIN32
+    constexpr std::size_t Size = 2 * FrameCaptureWriter::BlockBytes;
+    auto* bytes = allocate(Size);
+    auto* cpu = allocate(FrameCaptureWriter::BlockBytes, false);
+    std::fill_n(bytes, Size, std::byte{0x7f});
+    std::fill_n(cpu, FrameCaptureWriter::BlockBytes, std::byte{0x55});
+    std::vector<std::byte> expected(Size);
+    std::fill(expected.begin() + FrameCaptureWriter::BlockBytes, expected.end(), std::byte{0x22});
+    std::uintptr_t base = 0;
+    std::size_t arenaSize = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&base, &arenaSize);
+    FrameCaptureWriter writer(directory);
+    writer.WriteRange(address(bytes), Size, FrameRangeKind::Watched, PAGE_READWRITE, FrameRangeAccess::Readable | FrameRangeAccess::Writable | FrameRangeAccess::Gpu);
+    writer.WriteRange(address(cpu), FrameCaptureWriter::BlockBytes, FrameRangeKind::Unwatched, PAGE_READWRITE, FrameRangeAccess::Readable | FrameRangeAccess::Writable);
+    check(writer.WriteSnapshot(address(bytes), expected) == FrameCaptureWriter::BlockBytes, "zero snapshot block was not elided");
+    writer.Finish("{\"arena_base\":" + std::to_string(base) + "}");
+    const FrameCaptureReader reader(directory);
+    const auto skipped = restoreMemory(reader);
+    check(std::equal(expected.begin(), expected.end(), bytes), "reused GPU memory did not restore zero and nonzero snapshot blocks");
+    check(skipped.bytes == FrameCaptureWriter::BlockBytes, "unexpected skipped memory");
+    check(std::all_of(cpu, cpu + FrameCaptureWriter::BlockBytes, [](std::byte value) { return value == std::byte{0x55}; }), "reused CPU memory was overwritten");
+#endif
+}
+
+void testEopTokens() {
+    Frames frames;
+    auto output = std::make_shared<ReplayOutput>(frames);
+    AgcDriverRegisterVideoOutput_nid_postfix(7, output);
+    std::barrier together(2);
+    std::atomic<int> wrong{0};
+    const auto worker = [&](int lane) {
+        for (int round = 0; round < 2000; ++round) {
+            const auto requested = AgcDriver::EopFlipTokenBase + round * 8 + lane * 2;
+            together.arrive_and_wait();
+            try {
+                if (AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, requested) != requested) ++wrong;
+            } catch (const std::exception&) { ++wrong; }
+        }
+    };
+    std::thread first(worker, 0), second(worker, 1);
+    first.join();
+    second.join();
+    check(wrong.load() == 0, "concurrent explicit EOP reservations returned the wrong token");
+    const auto high = AgcDriver::EopFlipTokenBase + 20000;
+    check(AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high) == high, "explicit high token was not reserved");
+    check(AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high - 1) == high - 1, "explicit lower token was not reserved");
+    check(AgcDriverReserveEopFlip_nid_postfix({7, -1, 1, 0}) == high + 1, "ordinary reservation reused an explicit token");
+    bool rejected = false;
+    try { AgcDriverReserveEopFlipAt_nid_postfix({7, -1, 1, 0}, high); }
+    catch (const std::runtime_error&) { rejected = true; }
+    check(rejected, "duplicate explicit token was not rejected");
+    AgcDriverUnregisterVideoOutput_nid_postfix(7, output);
+}
+
+class WaitingOutput final : public AgcDriver::IVideoOutput {
+public:
+    WaitingOutput(Frames& frames, const std::uint32_t* label) : frames(frames), label(label) {}
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override {
+        const auto deadline = Clock::now() + std::chrono::seconds(2);
+        while (*static_cast<const volatile std::uint32_t*>(label) == 0) {
+            check(Clock::now() < deadline, "a blocking driver call prevented the later memory update");
+            std::this_thread::yield();
+        }
+        return std::make_shared<ReplayFlip>(frames);
+    }
+    void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); }
+
+private:
+    Frames& frames;
+    const std::uint32_t* label;
+};
+
+void testBlockingSubmission(const std::filesystem::path& directory) {
+    auto* bytes = allocate(FrameCaptureWriter::BlockBytes);
+    auto* label = reinterpret_cast<std::uint32_t*>(bytes);
+    const std::uint32_t ready = 1;
+    FrameCaptureWriter writer(directory);
+    writer.WriteDelta(1, 0, address(label), std::as_bytes(std::span(&ready, 1)));
+    writer.Finish("{}");
+    const FrameCaptureReader reader(directory);
+    Options options;
+    options.pace = false;
+    options.release = false;
+    Replay replay{options, reader};
+    collectGroups(replay);
+    auto output = std::make_shared<WaitingOutput>(replay.frames, label);
+    AgcDriverRegisterVideoOutput_nid_postfix(7, output);
+    std::array<std::uint32_t, AgcDriver::FlipPacketWords> words{AgcDriver::FlipPacketHeader, 7, 0xffffffffu, 1, 0, 0};
+    for (const auto kind : {FrameCallKind::Submit, FrameCallKind::Flip, FrameCallKind::ReserveEopFlip}) {
+        *label = 0;
+        FrameCall submit;
+        submit.kind = kind;
+        submit.thread = 1;
+        submit.address = address(words.data());
+        submit.size = words.size();
+        submit.values = {7, static_cast<std::uint64_t>(-1), 1, 0, AgcDriver::EopFlipTokenBase};
+        const std::array calls{submit, memoryCall(1, 2)};
+        replay.runWindow(calls);
+        check(*label == ready && replay.unfinished == 0, "blocking submission did not complete");
+    }
+    check(replay.frames.Times().size() == 2, "blocking submissions lost a flip");
+    AgcDriverUnregisterVideoOutput_nid_postfix(7, output);
+}
+
+void testShaderCode(const std::filesystem::path& directory, bool host) {
+    auto* bytes = allocate(1u << 20);
+    auto* shader = reinterpret_cast<Shader*>(bytes);
+    auto* code = bytes + (1u << 19) + 256;
+    constexpr std::size_t CodeBytes = 3 * FrameCaptureWriter::BlockBytes;
+#ifdef _WIN32
+    if (host) {
+        auto* memory = static_cast<std::byte*>(VirtualAlloc(nullptr, CodeBytes + 4096, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        check(memory != nullptr, "host shader allocation failed");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(memory, CodeBytes + 4096, true, true, true);
+        code = memory + 256;
+    }
+#endif
+    *shader = {};
+    shader->file_header = 0x34333231u;
+    shader->version = 0x18u;
+    shader->header_size = sizeof(Shader);
+    shader->shader_size = CodeBytes;
+    shader->code = code;
+    auto* recorder = AgcDriver::FrameRecorder::Active();
+    check(recorder != nullptr, "frame recorder is disabled");
+    recorder->FrameBoundary();
+    std::vector<std::byte> expected(CodeBytes);
+    for (std::size_t i = 0; i < expected.size(); ++i) expected[i] = static_cast<std::byte>(i * 31 + 17);
+    std::memcpy(code, expected.data(), expected.size());
+    recorder->RegisterShader(shader);
+    recorder->FrameBoundary();
+    const FrameCaptureReader reader(directory);
+    std::vector<std::byte> captured(CodeBytes);
+    const auto apply = [&](const FrameMemoryChunk& chunk) {
+        const auto begin = std::max(address(code), chunk.address);
+        const auto end = std::min(address(code) + CodeBytes, chunk.address + chunk.bytes);
+        if (begin >= end) return;
+        const auto data = reader.Read(chunk);
+        std::memcpy(captured.data() + begin - address(code), data.data() + begin - chunk.address, end - begin);
+    };
+    for (const auto& chunk : reader.Chunks()) if (chunk.kind == FrameMemoryKind::Snapshot) apply(chunk);
+    bool registered = false;
+    for (const auto& call : reader.Calls()) {
+        if (call.kind == FrameCallKind::RegisterShader) {
+            registered = true;
+            break;
+        }
+        if (call.kind != FrameCallKind::Memory) continue;
+        for (const auto& chunk : reader.Chunks()) {
+            if (chunk.kind == FrameMemoryKind::Delta && chunk.group == call.values.at(0)) apply(chunk);
+        }
+    }
+    check(registered && captured == expected, "the complete separate shader code was not captured before registration");
+}
+
+}
+
+int main(int argc, char** argv) {
+    try {
+        check(argc == 3, "expected a test name and capture directory");
+        const std::string mode = argv[1];
+        const std::filesystem::path directory = argv[2];
+        if (mode == "order") testMemoryOrder(directory);
+        else if (mode == "zero") testReusedMemory(directory);
+        else if (mode == "tokens") testEopTokens();
+        else if (mode == "blocking") testBlockingSubmission(directory);
+        else if (mode == "shader" || mode == "shader_host") testShaderCode(directory, mode == "shader_host");
+        else throw std::runtime_error("unknown test");
+        AgcDriverShutdown_nid_postfix();
+        std::puts("frame replay state test passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        try { AgcDriverShutdown_nid_postfix(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/GcnDecode.cpp b/core/libs/prx/libSceAgcDriver/tests/GcnDecode.cpp
new file mode 100644
index 0000000000..855c0aecdb
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/GcnDecode.cpp
@@ -0,0 +1,45 @@
+#include "RdnaDecoder/RdnaInstructionDecoder.hpp"
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <exception>
+#include <span>
+
+using namespace ShaderRecompiler;
+
+namespace {
+
+int failures = 0;
+
+void Check(bool condition, const char* what) {
+    if (condition) return;
+    std::fprintf(stderr, "%s\n", what);
+    ++failures;
+}
+
+RdnaInstruction Decode(std::span<const std::uint32_t> words) {
+    return DecodeGcnInstruction(0u, words, 0u);
+}
+
+void SetregImmKeepsItsLiteral() {
+    const std::array<std::uint32_t, 3> setreg{0xba80f801u, 0x12345678u, 0xbf810000u};
+    const auto instruction = Decode(setreg);
+    Check(instruction.op == RdnaOpcode::SSetregImm32B32, "s_setreg_imm32_b32 did not decode as its RDNA opcode");
+    Check(instruction.wordCount == 2u, "a GCN s_setreg_imm32_b32 is not two words");
+    Check(instruction.source0.value == 0x12345678u, "s_setreg_imm32_b32 lost its literal");
+    const std::array<std::uint32_t, 2> movk{0xb0001234u, 0xbf810000u};
+    Check(Decode(movk).wordCount == 1u, "s_movk_i32 took a literal word");
+}
+
+}
+
+int main() {
+    try {
+        SetregImmKeepsItsLiteral();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+    if (failures == 0) std::puts("GCN decode tests passed");
+    return failures == 0 ? 0 : 1;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
index 9f97985dcf..95080d73f9 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "BdaTests.hpp"
 #include "GraphicsTests.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
@@ -10,7 +11,6 @@
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "ShaderDiskCache.hpp"
 #include "ShaderCacheDirectory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp"
@@ -65,8 +65,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" std::terminate_handler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(std::terminate_handler handler);
-
 namespace {
 
 using AgcDriver::Graphics::Require;
@@ -163,9 +161,15 @@ void inactiveVertexPointSizeTests() {
         }
         throw std::runtime_error("potentially active point size passed the state decoder");
     };
-    for (const auto primitive : {1u, 9u}) {
+    {
         auto queue = pointSizeState();
-        queue.userConfig[0x242] = primitive;
+        queue.userConfig[0x242] = 9;
+        rejected(queue);
+    }
+    {
+        auto queue = pointSizeState();
+        queue.userConfig[0x242] = 1;
+        queue.context[0x2d5] = 0x2020;
         rejected(queue);
     }
     for (const auto stages : {0x2004u, 0x2020u}) {
@@ -222,6 +226,73 @@ void PolygonPrimitiveTests() {
     Require(indexedState.topology == VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN && indexedState.primitiveRestart, "indexed polygon decoding did not keep primitive restart");
 }
 
+void vertexPointListTests() {
+    const auto pointState = [](std::uint32_t control, std::uint32_t size, std::uint32_t limits) {
+        auto queue = makeState();
+        queue.userConfig[0x242] = 1;
+        queue.context[0x1b3] = queue.context[0x1b4] = 2;
+        queue.context[0x207] = control;
+        queue.context[0x280] = size;
+        queue.context[0x281] = limits;
+        return queue;
+    };
+    {
+        const auto queue = pointState(0x01210000u, 0x00080008u, 0x00080008u);
+        const auto rejection = AgcDriver::Graphics::DrawRejection(queue, false);
+        Require(rejection.empty(), "a vertex-path point list with a vertex point size failed the draw precheck: " + rejection);
+        const auto state = AgcDriver::Graphics::DecodeState(queue);
+        Require(state.topology == VK_PRIMITIVE_TOPOLOGY_POINT_LIST && state.paClVsOutCntl == 0x01210000u, "a vertex-path point list with a vertex point size did not decode as a point list");
+        Require(AgcDriver::Graphics::RasterPrimitiveOf(state) == ShaderRecompiler::RasterPrimitive::Point, "a vertex-path point list is not rasterized as points");
+        Require(state.vertexPoints && state.pointSize == 1.0f && state.pointSizeMin == 1.0f && state.pointSizeMax == 1.0f, "PA_SU_POINT_SIZE and PA_SU_POINT_MINMAX of 8 did not decode as one-pixel points");
+        ShaderRecompiler::ShaderVertexStageInfo vertex{};
+        vertex.paClVsOutCntl = 1u << 21u;
+        AgcDriver::Graphics::ApplyPointSize(state, vertex);
+        Require(vertex.pointList && vertex.paClVsOutCntl == ((1u << 16u) | (1u << 21u)) && vertex.pointSize == 1.0f && vertex.pointSizeMin == 1.0f && vertex.pointSizeMax == 1.0f, "the vertex stage did not receive the vertex point size");
+    }
+    {
+        const auto state = AgcDriver::Graphics::DecodeState(pointState(0, 0x00200020u, 0x00100004u));
+        Require(state.vertexPoints && state.pointSize == 4.0f && state.pointSizeMin == 0.5f && state.pointSizeMax == 2.0f, "a register point size did not decode as diameters");
+        ShaderRecompiler::ShaderVertexStageInfo vertex{};
+        vertex.paClVsOutCntl = 1u << 21u;
+        AgcDriver::Graphics::ApplyPointSize(state, vertex);
+        Require(vertex.pointList && vertex.paClVsOutCntl == (1u << 21u) && vertex.pointSize == 4.0f, "a register point size turned on the vertex point size");
+    }
+    {
+        const auto state = AgcDriver::Graphics::DecodeState(pointState(0x01210000u, 0x00200010u, 0x00400000u));
+        Require(state.pointSizeMin == 0.0f && state.pointSizeMax == 8.0f, "a vertex point size refused a register size whose width and height differ");
+    }
+    {
+        auto queue = makeState();
+        queue.context[0x1b3] = queue.context[0x1b4] = 2;
+        queue.context[0x207] = 0x01210000u;
+        const auto state = AgcDriver::Graphics::DecodeState(queue);
+        Require(!state.vertexPoints, "a triangle draw decoded as vertex points");
+        ShaderRecompiler::ShaderVertexStageInfo vertex{};
+        AgcDriver::Graphics::ApplyPointSize(state, vertex);
+        Require(!vertex.pointList && vertex.paClVsOutCntl == 0, "a triangle draw received a point size");
+    }
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(pointState(0, 0x00200010u, 0x00080008u)); }, "points whose PA_SU_POINT_SIZE width and height differ are unsupported");
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(pointState(0, 0x00080008u, 0x00080010u)); }, "PA_SU_POINT_MINMAX with a minimum above its maximum is unsupported");
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(pointState(1u << 16u, 0x00080008u, 0x00080008u)); }, "USE_VTX_POINT_SIZE without VS_OUT_MISC_VEC_ENA is unsupported");
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(pointState(0, 0, 0x00080008u)); }, "points of size 0 (PA_SU_POINT_SIZE 0) are unsupported");
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(pointState(0x01210000u, 0x00080008u, 0)); }, "a vertex point size clamped to 0 (PA_SU_POINT_MINMAX maximum 0) is unsupported");
+    {
+        const auto state = AgcDriver::Graphics::DecodeState(pointState(0x01210000u, 0, 0x00200000u));
+        Require(state.pointSize == 0.0f && state.pointSizeMin == 0.0f && state.pointSizeMax == 4.0f, "a vertex point size refused a zero register size or a zero clamp minimum");
+        static_cast<void>(AgcDriver::Graphics::DecodeState(pointState(0, 0x00080008u, 0)));
+    }
+    for (const auto sprite : {1u << 17u, 1u << 23u}) {
+        auto queue = pointState(0x01210000u, 0x00080008u, 0x00080008u);
+        queue.context[0x1b5] = 0x486bu;
+        queue.context[0x1b6] = 2;
+        queue.context[0x191] = 0;
+        queue.context[0x192] = sprite;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "point sprite texture coordinates (SPI_PS_INPUT_CNTL PT_SPRITE_TEX) are not implemented");
+        queue.context[0x1b5] = 0x4869u;
+        Require(AgcDriver::Graphics::DecodeState(queue).vertexPoints, "PT_SPRITE_TEX was refused with point sprites off");
+    }
+}
+
 void retainedPixelStageTests() {
     using namespace AgcDriver::Graphics;
     auto queue = makeState();
@@ -751,7 +822,7 @@ void msaaEnableClearOneSampleTargetTests() {
     queue = drawC();
     queue.context[0x1b3] |= ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
     requireOneSample(queue, "draw C with an enabled but unaddressed ANCILLARY input");
-    constexpr std::string_view refused = "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with PS_ITER_SAMPLE, a sample index or coverage input, or a sample-mask export";
+    constexpr std::string_view refused = "a one-sample color target under a multisampled rasterizer without MSAA_ENABLE is unsupported with a sample index or coverage input, or a sample-mask export";
     for (const auto input : {ShaderRecompiler::PixelInput::Ancillary, ShaderRecompiler::PixelInput::SampleCoverage}) {
         queue = drawC();
         queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(input);
@@ -759,6 +830,10 @@ void msaaEnableClearOneSampleTargetTests() {
     }
     queue = drawC();
     queue.context[0x293] = 0x10000u;
+    queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveSample);
+    requireOneSample(queue, "draw C with PS_ITER_SAMPLE and a sample-interpolated input");
+    Require(!DecodeState(queue).perSampleShading, "PS_ITER_SAMPLE into a one-sample color target without MSAA_ENABLE asked for sample shading");
+    queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
     expectFailure([&] { DecodeState(queue); }, refused);
     queue = drawC();
     queue.context[0x1c4] = 9;
@@ -766,10 +841,12 @@ void msaaEnableClearOneSampleTargetTests() {
     expectFailure([&] { DecodeState(queue); }, refused);
     queue = drawC();
     queue.context[0x2dc] = 0x0000aa01u;
-    expectFailure([&] { DecodeState(queue); }, "without MSAA_ENABLE are unsupported for points, lines");
-    queue = drawC();
-    queue.userConfig[0x242] = 2;
-    expectFailure([&] { DecodeState(queue); }, "without MSAA_ENABLE are unsupported for points, lines");
+    expectFailure([&] { DecodeState(queue); }, "without MSAA_ENABLE are unsupported for points or alpha-to-coverage");
+    for (const auto primitive : {2u, 3u}) {
+        queue = drawC();
+        queue.userConfig[0x242] = primitive;
+        requireOneSample(queue, "a line list or strip into PPSA18216's draw C target");
+    }
     const auto twoTargets = [&](std::uint32_t first, std::uint32_t second) {
         auto pair = drawC();
         for (const auto offset : {0x318u, 0x31bu, 0x31cu}) pair.context[offset + 0xfu] = pair.context.at(offset);
@@ -831,36 +908,24 @@ void msaaEnableClearOneSampleTargetTests() {
     queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage);
     Require(AgcDriver::Graphics::PixelProgramSkipped(queue), "the depth-only draw did not skip its pixel program");
     requireOneSampleDepth(queue, 0, "a one-sample depth target whose skipped pixel program has PS_ITER_SAMPLE and sample index and coverage inputs");
-    constexpr std::string_view depthRefused = "a one-sample depth target under a multisampled rasterizer without MSAA_ENABLE is unsupported for points or lines and with alpha-to-coverage, a sample index or coverage input, a sample-mask export, or DB_EQAA Z interpolation or overrasterization";
     for (const bool color : {false, true}) {
-        for (const auto input : {ShaderRecompiler::PixelInput::Ancillary, ShaderRecompiler::PixelInput::SampleCoverage}) {
-            queue = depthTarget(color);
-            queue.context[0x203] |= 0x40u;
-            queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(input);
-            expectFailure([&] { DecodeState(queue); }, depthRefused);
-        }
+        queue = depthTarget(color);
+        queue.context[0x203] |= 0x40u;
+        queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
+        Require(!AgcDriver::Graphics::PixelProgramSkipped(queue), "the ANCILLARY draw skipped its pixel program");
+        requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target whose running pixel program reads ANCILLARY without PS_ITER_SAMPLE");
+        queue.context[0x1b3] = queue.context[0x1b4] = 0x2b01u;
+        requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target whose running pixel program reads PERSP_SAMPLE, the position and ANCILLARY without PS_ITER_SAMPLE");
         queue = depthTarget(color);
         queue.context[0x203] |= 0x40u;
         queue.context[0x293] = 0x10000u;
         Require(!AgcDriver::Graphics::PixelProgramSkipped(queue), "the PS_ITER_SAMPLE draw skipped its pixel program");
         requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target whose running pixel program has PS_ITER_SAMPLE and no sample index or coverage input");
         Require(!DecodeState(queue).perSampleShading, "a PS_ITER_SAMPLE program drawn as one sample still shades per sample");
-        queue.context[0x1b3] = queue.context[0x1b4] = 2u | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary);
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        queue = depthTarget(color);
-        queue.context[0x1c4] = 9;
-        queue.context[0x203] |= 0x100u;
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        queue = depthTarget(color);
-        queue.context[0x2dc] = 0x0000aa01u;
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        queue = depthTarget(color);
-        queue.userConfig[0x242] = 2;
-        expectFailure([&] { DecodeState(queue); }, depthRefused);
-        for (const auto eqaa : {0x00050002u, 0x00090002u, 0x01010002u, 0x08010002u}) {
+        for (const auto eqaa : {0x00040000u, 0x00050000u}) {
             queue = depthTarget(color);
             queue.context[0x201] = eqaa;
-            expectFailure([&] { DecodeState(queue); }, depthRefused);
+            requireOneSampleDepth(queue, color ? 1u : 0u, "a one-sample depth target under a 4x PA_SC_AA_CONFIG without MSAA_ENABLE with DB_EQAA INTERPOLATE_COMP_Z");
         }
     }
     queue = depthTarget(true);
@@ -868,6 +933,57 @@ void msaaEnableClearOneSampleTargetTests() {
     expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
 }
 
+void UnwrittenDepthPlaneTests() {
+    using AgcDriver::Graphics::DecodeState;
+    using AgcDriver::Graphics::DrawRejection;
+    const auto fresh = [](std::uint32_t depthControl) {
+        auto written = makeState();
+        written.context[0x200] = depthControl;
+        written.context[0x1b3] = 2;
+        written.context[0x1b4] = 2;
+        AgcDriver::QueueState queue;
+        queue.shader = written.shader;
+        queue.userConfig = written.userConfig;
+        written.context.ForEach([&](std::uint32_t offset, std::uint32_t value) { queue.context[offset] = value; });
+        return queue;
+    };
+    auto queue = fresh(0x777);
+    auto state = DecodeState(queue);
+    Require(!state.depth && !state.depthTest && !state.depthWrite && !state.stencilTest, "depth and stencil tests on unwritten depth and stencil planes were kept (PPSA24040's DB_DEPTH_CONTROL)");
+    auto rejection = DrawRejection(queue, false);
+    Require(rejection.empty(), "the precheck refused depth and stencil tests on unwritten depth and stencil planes: " + rejection);
+    queue = fresh(0x77f);
+    state = DecodeState(queue);
+    Require(!state.depth && !state.depthBoundsTest, "a depth bounds test on unwritten depth and stencil planes was kept");
+    rejection = DrawRejection(queue, false);
+    Require(rejection.empty(), "the precheck refused a depth bounds test on unwritten depth and stencil planes: " + rejection);
+    queue = fresh(0x007007b3);
+    queue.context[0x010] = 0x80000183;
+    queue.context[0x012] = 0x00001000;
+    queue.context[0x014] = 0x00001000;
+    queue.context[0x007] = 0x0001001f;
+    queue.context[0x00b] = 0x3f800000;
+    state = DecodeState(queue);
+    Require(state.depth && state.depthTest && !state.stencilTest && state.renderExtent.width == 32 && state.renderExtent.height == 2, "a depth plane beside an unwritten DB_STENCIL_INFO did not decode as depth only");
+    rejection = DrawRejection(queue, false);
+    Require(rejection.empty(), "the precheck refused a depth plane beside an unwritten DB_STENCIL_INFO: " + rejection);
+    queue = fresh(0x007007b3);
+    queue.context[0x011] = 0x20000181;
+    queue.context[0x013] = 0x00002000;
+    queue.context[0x015] = 0x00002000;
+    queue.context[0x007] = 0x003f003f;
+    queue.context[0x00b] = 0x3f800000;
+    queue.context[0x10c] = 0x01ffff00;
+    queue.context[0x10d] = 0x01ffff00;
+    state = DecodeState(queue);
+    Require(!state.depthTest && state.stencilTest, "a stencil plane beside an unwritten DB_Z_INFO kept the depth test or lost the stencil test");
+    rejection = DrawRejection(queue, false);
+    Require(rejection.empty(), "the precheck refused a stencil plane beside an unwritten DB_Z_INFO: " + rejection);
+    queue.context[0x010] = 0x80000183;
+    queue.ClearContext();
+    for (const auto offset : {0x010u, 0x011u}) Require(queue.context.contains(offset) && queue.context.at(offset) == 0, "CLEAR_STATE did not reset DB_Z_INFO and DB_STENCIL_INFO to their clear-state value 0");
+}
+
 void MsaaEnableSingleSampleTests() {
     using AgcDriver::Graphics::DecodeState;
     using AgcDriver::Graphics::DrawRejection;
@@ -1076,11 +1192,30 @@ void ShaderStageTests() {
         lines.context[0x29b] = 1;
         Require(AgcDriver::Graphics::DecodeState(lines).stages.mesh->provokingVertex == 1, "a last-vertex geometry draw does not take its flat inputs and layer from the second vertex of each output line");
         lines.context[0x29b] = 0;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(lines); }, "missing register in context bank at DWORD 0x280");
+        lines.context[0x280] = 0x00080008u;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(lines); }, "missing register in context bank at DWORD 0x281");
+        lines.context[0x281] = 0xffff0000u;
         state = AgcDriver::Graphics::DecodeState(lines);
         mesh = *state.stages.mesh;
         Require(mesh.outputPrimitiveSize == 1 && mesh.maxPrimitives == 255 && AgcDriver::Graphics::RasterPrimitiveOf(state) == ShaderRecompiler::RasterPrimitive::Point, "a point-list subgroup did not decode as points");
         Require(mesh.provokingVertex == 0, "a point draw has provoking vertex 0");
+        Require(state.pointSize == 1.0f && state.pointSizeMin == 0.0f && state.pointSizeMax == 8191.875f, "geometry points did not decode the queue's default point size and limits");
         lines.context[0x205] = raster;
+        auto points = lines;
+        points.userConfig[0x242] = 6;
+        points.userConfig[0x25b] = 0x5c2e;
+        points.context[0x1ff] = 0x8a;
+        points.context[0x2ce] = 3;
+        points.context[0x29b] = 0;
+        points.context[0x280] = 0x00180018u;
+        points.context[0x281] = 0x00400008u;
+        const auto pointState = AgcDriver::Graphics::DecodeState(points);
+        const auto& pointMesh = *pointState.stages.mesh;
+        ShaderRecompiler::ShaderVertexStageInfo pointInfo{};
+        AgcDriver::Graphics::ApplyPointSize(pointState, pointInfo);
+        Require(pointInfo.pointList && pointInfo.pointSize == 3.0f && pointInfo.pointSizeMin == 1.0f && pointInfo.pointSizeMax == 8.0f, "geometry points lost their register sizes");
+        Require(pointMesh.outputPrimitiveSize == 1u && pointMesh.primitivesPerGroup == 44u && pointMesh.verticesPerGroup == 46u && pointMesh.maxVertices == 138u && pointMesh.maxPrimitives == 138u && pointMesh.threadsPerGroup == 192u && AgcDriver::Graphics::RasterPrimitiveOf(pointState) == ShaderRecompiler::RasterPrimitive::Point, "triangle-strip input with point output did not decode the reported subgroup");
         lines.context[0x29b] = 1;
         lines.context[0x2ce] = 1;
         expectFailure([&] { AgcDriver::Graphics::DecodeState(lines); }, "unsupported geometry input or output assembly");
@@ -1789,8 +1924,35 @@ void TuningFieldTests() {
     Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "DISABLE_DUAL_QUAD was rejected");
     Require(state.hasColorTarget && state.blend.colorWriteMask == baseline.blend.colorWriteMask, "DISABLE_DUAL_QUAD changed color output");
     queue.context[0x202] = 0xcc0013;
-    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "copy ROP");
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "source or brush form");
+    queue.context[0x202] = 0x5b0010;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "source or brush form");
+    queue.context[0x202] = 0x5a0010;
+    state = AgcDriver::Graphics::DecodeState(queue);
+    Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "an XOR ROP was rejected");
+    Require(state.hasColorTarget && state.colorRop == 0x5a && AgcDriver::Graphics::LogicOpFromRop(state.colorRop) == VK_LOGIC_OP_XOR, "an XOR ROP did not decode");
     queue.context[0x202] = 0xcc0010;
+    Require(AgcDriver::Graphics::DecodeState(queue).colorRop == AgcDriver::Graphics::CopyRop, "the copy ROP did not decode as the copy operation");
+    const std::array<std::pair<std::uint8_t, VkLogicOp>, 14> ropOperations{{
+        {0x0f, VK_LOGIC_OP_COPY_INVERTED}, {0xa0, VK_LOGIC_OP_AND}, {0xf0, VK_LOGIC_OP_COPY}, {0xfa, VK_LOGIC_OP_OR},
+        {0x00, VK_LOGIC_OP_CLEAR}, {0x11, VK_LOGIC_OP_NOR}, {0x33, VK_LOGIC_OP_COPY_INVERTED}, {0x55, VK_LOGIC_OP_INVERT}, {0x66, VK_LOGIC_OP_XOR},
+        {0x88, VK_LOGIC_OP_AND}, {0xaa, VK_LOGIC_OP_NO_OP}, {0xcc, VK_LOGIC_OP_COPY}, {0xee, VK_LOGIC_OP_OR}, {0xff, VK_LOGIC_OP_SET}}};
+    for (const auto& [rop, operation] : ropOperations) Require(AgcDriver::Graphics::LogicOpFromRop(rop) == operation, "a ROP3 code mapped to the wrong logic operation");
+    std::uint32_t documentedRops = 0;
+    for (std::uint32_t rop = 0; rop < 256u; ++rop) {
+        try {
+            static_cast<void>(AgcDriver::Graphics::LogicOpFromRop(static_cast<std::uint8_t>(rop)));
+            ++documentedRops;
+        } catch (const std::runtime_error&) {
+        }
+    }
+    Require(documentedRops == 28u, "a ROP3 code outside the source and brush forms was accepted, or one inside them was refused");
+    auto blendedLogic = queue;
+    blendedLogic.context[0x202] = 0x5a0010;
+    blendedLogic.context[0x1e0] = 0x40000101u;
+    for (std::uint32_t index = 0; index < 4u; ++index) blendedLogic.context[0x105 + index] = 0u;
+    blendedLogic.context[0x31c] |= 0x8000u;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(blendedLogic); }, "logic operation together with blending");
     for (const auto groups : {1u, 2u, 15u}) {
         queue.context[0x2d5] = 0x2000u | (groups << 15u);
         state = AgcDriver::Graphics::DecodeState(queue);
@@ -2396,10 +2558,12 @@ void DepthStencilTests() {
         queue.context[0x000] = 0x22u | control;
         expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "DB_RENDER_CONTROL");
     }
-    queue.context[0x000] = 0x22;
+    queue.context[0x000] = 0x23;
     queue.context[0x011] = 0;
-    expectFailure([&] { AgcDriver::Graphics::DecodeState(queue); }, "writable stencil plane");
-    Require(AgcDriver::Graphics::DrawRejection(queue, false).find("writable stencil plane") != std::string::npos, "precheck accepted clear without a stencil plane");
+    state = AgcDriver::Graphics::DecodeState(queue);
+    Require(state.depthWrite && state.depthCompare == VK_COMPARE_OP_ALWAYS && !state.stencilTest && state.colors.size() == 2, "a depth and stencil clear without a stencil plane does not clear depth alone");
+    Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "precheck rejected a stencil clear without a stencil plane");
+    queue.context[0x000] = 0x22;
     queue.context[0x010] = 0;
     state = AgcDriver::Graphics::DecodeState(queue);
     Require(!state.depth && !state.depthTest && !state.depthWrite && !state.stencilTest && state.colors.size() == 2, "clear flags without depth/stencil planes changed color-only rendering");
@@ -2828,7 +2992,12 @@ void depthCopyPassTests() {
     queue.context[0x31c] = 0x40710;
     queue.context[0x8e] = 1;
     auto pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->depthAddress == 0x100000 && pass->samples == 2 && pass->sample == 0 && pass->extent.width == 64 && pass->extent.height == 4, "a centroid DB depth copy of a two-sample depth plane decoded differently");
+    Require(pass.has_value() && pass->source.address == 0x100000 && pass->source.samples == 2 && pass->sample == 0 && pass->source.extent.width == 64 && pass->source.extent.height == 4, "a centroid DB depth copy of a two-sample depth plane decoded differently");
+    {
+        const auto words = AgcDriver::Graphics::DepthCopySourceWords(pass->source);
+        const auto resource = AgcDriver::Graphics::DecodeTextureResource(words);
+        Require(resource.baseAddress == pass->source.address && resource.dimension == AgcDriver::Graphics::TextureDimension::k2DMsaa && resource.samples == 2 && resource.width == 64 && resource.height == 4 && resource.tileMode == AgcDriver::Graphics::TextureTileMode::kZ64KBX && resource.pipeBankXor == pass->source.pipeBankXor && resource.dccAddress == pass->source.htileAddress, "the DB depth copy source descriptor of a two-sample plane decoded differently");
+    }
     Require(pass->color.format == VK_FORMAT_R32_SFLOAT && pass->color.samples == 1 && pass->color.address == reinterpret_cast<std::uintptr_t>(colorMemory.data()), "the DB depth copy target decoded differently");
     queue.context[0x000] = 0x104;
     Require(DecodeDepthCopyPass(queue)->sample == 1, "COPY_SAMPLE without COPY_CENTROID did not select the sample");
@@ -2853,23 +3022,31 @@ void depthCopyPassTests() {
     expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "single-sample R32 float");
     queue.context[0x31c] = 0x40710;
     queue.context[0x10f] = std::bit_cast<std::uint32_t>(16.0f);
-    expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "over part of the depth surface");
+    Require(DecodeDepthCopyPass(queue).has_value(), "a DB depth copy whose viewport covers part of the depth surface was refused");
     queue.context[0x10f] = std::bit_cast<std::uint32_t>(32.0f);
+    queue.context[0x1e0] = 1u << 30u;
+    expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "blending");
+    queue.context[0x1e0] = 0;
     queue.context[0x010] = 0x80001187;
     expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "mipmapped or partially resident");
     queue.context[0x010] = 0x80000187;
     queue.context[0x012] = 0x00001003;
     pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->depthAddress == 0x100000, "a DB depth copy kept the pipe-bank XOR of a two-sample depth plane in its address");
+    Require(pass.has_value() && pass->source.address == 0x100000 && pass->source.pipeBankXor == 0x300, "a DB depth copy kept the pipe-bank XOR of a two-sample depth plane in its address");
     queue.context[0x012] = 0x00001000;
     queue.context[0x002] = 1u | (1u << 13u);
     pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->depthAddress == 0x100000 + AgcDriver::Graphics::DepthSliceBytes({64, 4}, 4u), "a DB depth copy of slice 1 did not address the slice the depth surface registers");
+    Require(pass.has_value() && pass->source.address == 0x100000 + AgcDriver::Graphics::DepthSliceBytes({64, 4}, 4u), "a DB depth copy of slice 1 did not address the slice the depth surface registers");
     queue.context[0x002] = 0;
     Require(DecodeDepthCopyPass(queue).has_value(), "the restored DB depth copy was refused");
     queue.context[0x010] = 0x80000183;
     pass = DecodeDepthCopyPass(queue);
-    Require(pass.has_value() && pass->samples == 1 && pass->sample == 0, "a centroid DB depth copy of a one-sample depth plane decoded differently");
+    Require(pass.has_value() && pass->source.samples == 1 && pass->sample == 0, "a centroid DB depth copy of a one-sample depth plane decoded differently");
+    {
+        const auto words = AgcDriver::Graphics::DepthCopySourceWords(pass->source);
+        const auto resource = AgcDriver::Graphics::DecodeTextureResource(words);
+        Require(resource.baseAddress == pass->source.address && resource.dimension == AgcDriver::Graphics::TextureDimension::k2D && resource.samples == 1 && resource.width == 64 && resource.height == 4 && resource.dccAddress == 0, "the DB depth copy source descriptor of a one-sample plane decoded differently");
+    }
     queue.context[0x000] = 0x104;
     expectFailure([&] { (void)DecodeDepthCopyPass(queue); }, "a sample the depth plane does not have");
 }
@@ -3349,6 +3526,43 @@ void msaaEnableClearDepthTests() {
     state = DecodeState(queue);
     Require(state.colors.empty(), "a depth-only 4x draw without MSAA_ENABLE decoded a color target");
     requireCentered(state, "a 4x depth target rasterized without MSAA_ENABLE");
+    for (const auto primitive : {2u, 3u}) {
+        queue = drawB();
+        queue.userConfig[0x242] = primitive;
+        state = DecodeState(queue);
+        Require(state.topology == (primitive == 2u ? VK_PRIMITIVE_TOPOLOGY_LINE_LIST : VK_PRIMITIVE_TOPOLOGY_LINE_STRIP) && state.colors.size() == 1 && state.colors[0].samples == 4, "PPSA18216's line list or strip into its 4x depth and color pair lost its topology or color target");
+        requireCentered(state, "a line list or strip into PPSA18216's 4x depth and color pair without MSAA_ENABLE");
+        Require(!state.sampleLocationGrid && !state.perSampleShading, "a line list or strip without MSAA_ENABLE kept a sample location grid or sample shading");
+        Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "the precheck refused a line list or strip into PPSA18216's 4x depth and color pair");
+    }
+    queue = drawB();
+    queue.userConfig[0x242] = 1;
+    queue.context[0x2d5] = 0x2030;
+    queue.userConfig[0x25b] = 0x6633;
+    queue.context[0x1ff] = 255;
+    queue.context[0x2ce] = 5;
+    queue.context[0x29b] = 2;
+    queue.context[0x2ab] = 4;
+    queue.shader[0x8a] = 3u << 29u;
+    queue.shader[0x8b] = 3u << 16u;
+    state = DecodeState(queue);
+    Require(state.topology == VK_PRIMITIVE_TOPOLOGY_POINT_LIST && state.stages.mesh && state.stages.mesh->outputPrimitiveSize == 3u && AgcDriver::Graphics::RasterPrimitiveOf(state) == ShaderRecompiler::RasterPrimitive::Triangle && state.colors.size() == 1 && state.colors[0].samples == 4, "a point list into a geometry program that outputs triangle strips into PPSA18216's 4x depth and color pair did not decode as triangles");
+    requireCentered(state, "triangles a geometry program makes from a point list into PPSA18216's 4x depth and color pair without MSAA_ENABLE");
+    for (const auto primitive : {4u, 2u, 1u}) {
+        queue = drawB();
+        queue.userConfig[0x242] = primitive;
+        queue.context[0x2d5] = 0x2030;
+        queue.userConfig[0x25b] = 0x6633;
+        queue.context[0x1ff] = 255;
+        queue.context[0x2ce] = 5;
+        queue.context[0x29b] = 0;
+        queue.context[0x2ab] = 4;
+        queue.context[0x280] = 0x00080008u;  // point-output geometry programs decode PA_SU_POINT_SIZE / PA_SU_POINT_MINMAX before this rejection
+        queue.context[0x281] = 0x00080008u;
+        queue.shader[0x8a] = 3u << 29u;
+        queue.shader[0x8b] = 3u << 16u;
+        expectFailure([&] { DecodeState(queue); }, "multisampled targets rasterized without MSAA_ENABLE are unsupported for points or alpha-to-coverage");
+    }
     for (const auto eqaa : {0x00050002u, 0x00090002u, 0x01010002u, 0x08010002u}) {
         queue = drawB();
         queue.context[0x201] = eqaa;
@@ -3360,7 +3574,7 @@ void msaaEnableClearDepthTests() {
     expectFailure([&] { DecodeState(queue); }, "a multisampled depth target rasterized without MSAA_ENABLE with a sample-mask export");
     queue = drawB();
     queue.context[0x2dc] = 0x0000aa01u;
-    expectFailure([&] { DecodeState(queue); }, "multisampled targets rasterized without MSAA_ENABLE are unsupported for points, lines or alpha-to-coverage");
+    expectFailure([&] { DecodeState(queue); }, "multisampled targets rasterized without MSAA_ENABLE are unsupported for points or alpha-to-coverage");
     queue = drawB();
     queue.context[0x010] = 0xa2900987;
     expectFailure([&] { DecodeState(queue); }, "the depth target's sample count differs from the rasterizer's");
@@ -3656,7 +3870,7 @@ void multisampleTests() {
     }
     queue = multisampled();
     queue.context[0x31d] = 0x1000;
-    expectFailure([&] { DecodeState(queue); }, "fewer fragments than samples");
+    expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
     queue.context[0x31d] = 0;
     queue.context[0x293] = 0x10000u;
     Require(DecodeState(queue).samples == 1 && !DecodeState(queue).perSampleShading, "PS_ITER_SAMPLE into a one-sample target did not rasterize sample 0 alone");
@@ -3667,7 +3881,7 @@ void multisampleTests() {
     const auto aliased = AgcDriver::Graphics::SampleLocations(state);
     for (std::uint32_t sample = 0; sample < state.samples; ++sample) Require(aliased[sample].x == 0.5f && aliased[sample].y == 0.5f, "a 2x target rasterized without MSAA_ENABLE did not place every sample at the pixel center");
     queue.context[0x2dc] = 0x0000aa01u;
-    expectFailure([&] { DecodeState(queue); }, "without MSAA_ENABLE are unsupported for points, lines or alpha-to-coverage");
+    expectFailure([&] { DecodeState(queue); }, "without MSAA_ENABLE are unsupported for points or alpha-to-coverage");
     queue = multisampled();
     queue.context[0x292] = 2;
     queue.context[0x302] = 0x44cc;
@@ -4045,6 +4259,24 @@ void multisampleDccStateTests() {
         changed.context[0x3b0] |= 1u << 28u;
         expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "multisampled color mips");
     }
+    for (const auto samples : {2u, 4u, 8u}) {
+        AgcDriver::Graphics::ColorTarget target{};
+        target.extent = {64, 64};
+        target.format = VK_FORMAT_R8G8B8A8_UNORM;
+        target.tileMode = AgcDriver::Graphics::ColorTileMode::RenderTarget;
+        target.samples = samples;
+        target.dccAddress = 0x200000u;
+        target.dccPipeAligned = true;
+        target.cmaskAddress = 0x300000u;
+        target.cmaskBytes = AgcDriver::Graphics::CmaskBytes(64, 64);
+        const std::vector<std::byte> dcc(AgcDriver::Graphics::MultisampledDccBytes(target), std::byte{0x00});
+        std::vector<std::byte> cmask(target.cmaskBytes);
+        for (std::size_t index = 0; index < cmask.size(); ++index) cmask[index] = std::byte{static_cast<std::uint8_t>(index * 37u)};
+        const auto clear = AgcDriver::Graphics::MultisampledDccClear(target, dcc, cmask);
+        Require(clear.float32[0] == 0.0f && clear.float32[1] == 0.0f && clear.float32[2] == 0.0f && clear.float32[3] == 0.0f, "a uniform 0000 DCC clear of a multisampled target without CMASK fast clears did not import as 0000");
+        target.cmaskFastClear = true;
+        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::MultisampledDccClear(target, dcc, cmask)); }, "multisampled DCC CMASK compression or register clear");
+    }
 }
 
 void multisampledDepthTests() {
@@ -4110,6 +4342,76 @@ void multisampledDepthTests() {
     Require(!DecodeState(queue).perSampleShading, "PS_ITER_SAMPLE requested sample shading for a single-sample scan");
     queue = singleSampleScan();
     queue.context[0x31d] = 0;
+    state = DecodeState(queue);
+    Require(state.truncatedCoverage && !state.mergedCoverage && state.colors.size() == 1 && state.colors[0].samples == 1, "a single-sample scan into a 4x depth target and a one-sample color target did not take the color from sample 0");
+    requireCentered(state, "a single-sample scan into a 4x depth target and a one-sample color target");
+    const auto truncatedTwoSample = [&] {
+        auto queue = singleSampleScan();
+        queue.context[0x2f8] = 0x00100001;
+        queue.context[0x292] = 3;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) queue.context[0x2fe + pixel * 4u] = 0xcc44;
+        queue.context[0x010] = 0x22900987;
+        queue.context[0x31d] = 0;
+        return queue;
+    };
+    queue = truncatedTwoSample();
+    state = DecodeState(queue);
+    Require(state.samples == 2 && state.depth && state.depth->samples == 2 && state.colors.size() == 1 && state.colors[0].samples == 1 && state.truncatedCoverage && !state.mergedCoverage && !state.perSampleShading, "a one-sample color target beside a 2x depth target under a 2x rasterizer with MSAA_ENABLE (PPSA02225's registers) did not take the color from sample 0");
+    Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "the precheck refused a one-sample color target beside a 2x depth target");
+    queue = truncatedTwoSample();
+    queue.context[0x293] = 0x10000u;
+    queue.context[0x1b3] = queue.context[0x1b4] = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveSample) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::FrontFace);
+    state = DecodeState(queue);
+    Require(state.truncatedCoverage && state.perSampleShading && state.samples == 2 && state.colors[0].samples == 1, "PS_ITER_SAMPLE into a one-sample color target beside a 2x depth target (PPSA02225's registers) did not run per sample with sample 0's color");
+    queue = truncatedTwoSample();
+    queue.context[0x31d] = 0x12000;
+    expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
+    const auto oneFragment = [&] {
+        auto queue = singleSampleScan();
+        queue.context[0x2f8] = 0x00210002;
+        queue.context[0x292] = 3;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) queue.context[0x2fe + pixel * 4u] = 0x622ae6ae;
+        queue.context[0x31d] = 0x2000;
+        queue.context[0x201] = 0x112202;
+        return queue;
+    };
+    queue = oneFragment();
+    state = DecodeState(queue);
+    Require(state.samples == 4 && !state.customSampleLocations && state.depth && state.depth->samples == 4 && state.colors.size() == 1 && state.colors[0].samples == 1 && state.truncatedCoverage && !state.mergedCoverage && !state.perSampleShading, "a 4-sample color target with one fragment beside a 4x depth target (PPSA02015's registers) did not keep sample 0's color in its one fragment");
+    Require(AgcDriver::Graphics::DrawRejection(queue, false).empty(), "the precheck refused a 4-sample color target with one fragment beside a 4x depth target");
+    queue = oneFragment();
+    queue.context[0x31c] |= 0x4000u;
+    queue.context[0x321] = 0x00c3a1b2u;
+    queue.context[0x3a0] = 0x01u;
+    state = DecodeState(queue);
+    Require(state.colors.size() == 1 && state.colors[0].fmaskAddress == ((1ull << 40u) | 0xc3a10000ull), "a compressed one-fragment color target did not decode its FMASK address");
+    queue.context[0x321] = 0u;
+    queue.context[0x3a0] = 0u;
+    expectFailure([&] { DecodeState(queue); }, "a compressed one-fragment color target without an FMASK address is unsupported");
+    queue.context[0x321] = 0xa5u;
+    expectFailure([&] { DecodeState(queue); }, "a compressed one-fragment color target without an FMASK address is unsupported");
+    queue = oneFragment();
+    Require(DecodeState(queue).colors[0].fmaskAddress == 0u, "an uncompressed one-fragment color target noted an FMASK address");
+    queue = oneFragment();
+    queue.context[0x31d] = 0xa000;
+    expectFailure([&] { DecodeState(queue); }, "color targets with more than one but fewer fragments than samples (EQAA) are unsupported");
+    queue = oneFragment();
+    queue.context[0x31d] = 0x8000;
+    expectFailure([&] { DecodeState(queue); }, "color targets with more fragments than samples are unsupported");
+    queue = oneFragment();
+    queue.context[0x201] = 0x012202;
+    expectFailure([&] { DecodeState(queue); }, "a one-fragment color target is supported only with static DB_EQAA anchors at the depth target's sample count");
+    queue = oneFragment();
+    queue.context[0x201] = 0x112201;
+    expectFailure([&] { DecodeState(queue); }, "a one-fragment color target is supported only with static DB_EQAA anchors at the depth target's sample count");
+    queue = oneFragment();
+    queue.context[0x2f8] = 0x00100001;
+    queue.context[0x010] = 0x22900987;
+    for (std::uint32_t pixel = 0; pixel < 4; ++pixel) queue.context[0x2fe + pixel * 4u] = 0xcc44;
+    expectFailure([&] { DecodeState(queue); }, "a one-fragment color target's sample count differs from the rasterizer's");
+    queue = oneFragment();
+    queue.context[0x010] = 0;
+    queue.context[0x011] = 0;
     expectFailure([&] { DecodeState(queue); }, "a color target's sample count differs from the rasterizer's");
     queue = singleSampleScan();
     queue.context[0x010] = 0x22900983;
@@ -5677,6 +5979,7 @@ void descriptorPoolResetFailureTest() {
     });
     cache.Free(allocation);
     _ZSt13set_terminatePFvvE_nid_postfix(previous);
+
 }
 
 void pushConstantTests() {
@@ -6687,8 +6990,37 @@ void sampledTextureBudgetTests() {
     Require(SampledTextureBudget(memory, &reported, 5 * GiB) == 5 * GiB + 128 * MiB, "a 15 GiB budget with 4 GiB used outside the texture caches does not leave 5 GiB 128 MiB after the 4 GiB storage cache and 1 GiB 896 MiB of headroom");
     reported.heapUsage[2] = 3 * GiB;
     Require(SampledTextureBudget(memory, &reported, 5 * GiB) == 9 * GiB + 128 * MiB, "usage below the cached bytes is not read as no other device memory in use");
+    reported.heapUsage[2] = 9 * GiB;
+    Require(SampledTextureBudget(memory, &reported, 5 * GiB, 4 * GiB + 512 * MiB) == 4 * GiB + 640 * MiB, "a storage image cache larger than TextureCacheBudget was not reserved in full");
+    Require(SampledTextureBudget(memory, &reported, 5 * GiB, 1 * GiB) == 5 * GiB + 128 * MiB, "a storage image cache smaller than TextureCacheBudget did not keep the TextureCacheBudget reservation");
     reported.heapUsage[2] = 12 * GiB;
     Require(SampledTextureBudget(memory, &reported, 1 * GiB) == 2 * GiB, "a heap whose other users leave no room does not keep the 2 GiB floor");
+    {
+        using AgcDriver::Graphics::StorageTextureBudget;
+        auto small = memory;
+        small.memoryHeaps[2].size = 8 * GiB;
+        VkPhysicalDeviceMemoryBudgetPropertiesEXT example{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
+        example.heapBudget[2] = 7373 * MiB;
+        example.heapUsage[2] = 2 * GiB + 3686 * MiB;
+        Require(SampledTextureBudget(small, &example, 3686 * MiB, 3686 * MiB) == 2 * GiB, "3686 MiB of storage images on an 8 GiB heap with a 7373 MiB budget and 2 GiB of other use left the sampled cache above its floor");
+        for (const auto heapGiB : {8u, 16u}) {
+            small.memoryHeaps[2].size = heapGiB * GiB;
+            for (std::uint64_t budget = 4 * GiB; budget <= heapGiB * GiB; budget += GiB) {
+                example.heapBudget[2] = budget;
+                for (std::uint64_t other = 0; other <= budget; other += GiB) {
+                    for (std::uint64_t sampled = 0; sampled <= 4 * GiB; sampled += 512 * MiB) {
+                        for (std::uint64_t storage = 0; storage <= heapGiB * GiB / 2u; storage += 512 * MiB) {
+                            example.heapUsage[2] = other + sampled + storage;
+                            const auto sampledLimit = SampledTextureBudget(small, &example, sampled + storage, storage);
+                            const auto storageLimit = StorageTextureBudget(small, &example, sampled, storage);
+                            if (sampledLimit > 2 * GiB) Require(other + storage + sampledLimit + budget / 8u <= budget, "the sampled cache budget and the storage images held exceed the reported budget less its eighth");
+                            if (storageLimit > 512 * MiB) Require(other + sampled + storageLimit + budget / 8u <= budget, "the storage cache budget and the sampled textures held exceed the reported budget less its eighth");
+                        }
+                    }
+                }
+            }
+        }
+    }
     memory.memoryHeaps[0].flags = 0;
     memory.memoryHeaps[2].flags = 0;
     Require(SampledTextureBudget(memory, &reported, 0) == 2 * GiB, "a device without a device-local heap does not keep 2 GiB of sampled textures");
@@ -6709,29 +7041,29 @@ void storageTextureBudgetTests() {
     reported.heapBudget[1] = 100 * GiB;
     Require(StorageTextureBudget(memory, &reported, 0, 0) == 4 * GiB, "a zero budget for the largest device-local heap did not fall back to a quarter of the heap");
     reported.heapBudget[2] = 10 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 0, 0) == 2560 * MiB, "a 10 GiB budget on the 16 GiB heap does not limit the storage image cache to a quarter of the budget");
+    Require(StorageTextureBudget(memory, &reported, 0, 0) == 5 * GiB, "a 10 GiB budget on the 16 GiB heap does not limit the storage image cache to half of the budget");
     reported.heapUsage[2] = 5 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2560 * MiB, "2 GiB used outside the texture caches on a 10 GiB budget lowered the storage image cache below its quarter");
+    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 5 * GiB, "2 GiB used outside the texture caches on a 10 GiB budget lowered the storage image cache below its half");
     reported.heapUsage[2] = 8 * GiB + 512 * MiB;
     Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2304 * MiB, "a 10 GiB budget with 5632 MiB used outside the texture caches does not leave 2304 MiB after 1 GiB of sampled textures and 1280 MiB of headroom");
     reported.heapUsage[2] = 9 * GiB;
     Require(StorageTextureBudget(memory, &reported, 3 * GiB, 2 * GiB) == 1792 * MiB, "3 GiB of sampled textures were not reserved in full");
     reported.heapUsage[2] = 1 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 2560 * MiB, "usage below the cached bytes is not read as no other device memory in use");
+    Require(StorageTextureBudget(memory, &reported, 1 * GiB, 2 * GiB) == 5 * GiB, "usage below the cached bytes is not read as no other device memory in use");
     Require(StorageTextureBudget(memory, &reported, 7 * GiB, 1 * GiB) == 1792 * MiB, "7 GiB of sampled textures with the usage below the cached bytes do not leave 1792 MiB after their reservation and 1280 MiB of headroom");
     reported.heapUsage[2] = 9 * GiB + 512 * MiB;
     Require(StorageTextureBudget(memory, &reported, 2 * GiB, 512 * MiB) == 512 * MiB, "a heap whose other users leave no room does not keep the 512 MiB floor");
     reported.heapUsage[2] = 0;
     reported.heapBudget[2] = 6 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 0, 0) == 1536 * MiB, "a 6 GiB budget on the 16 GiB heap does not limit the storage image cache to a quarter of the budget");
+    Require(StorageTextureBudget(memory, &reported, 0, 0) == 3 * GiB, "a 6 GiB budget on the 16 GiB heap does not limit the storage image cache to half of the budget");
     reported.heapBudget[2] = 1 * GiB;
     Require(StorageTextureBudget(memory, &reported, 0, 0) == 512 * MiB, "a 1 GiB budget does not keep the 512 MiB floor");
     reported.heapBudget[2] = 40 * GiB;
-    Require(StorageTextureBudget(memory, &reported, 0, 0) == 4 * GiB, "a budget above the heap size raised the storage image cache past a quarter of the heap");
+    Require(StorageTextureBudget(memory, &reported, 0, 0) == 8 * GiB, "a budget above the heap size raised the storage image cache past half of the heap");
     memory.memoryHeaps[2].size = 8 * GiB;
     reported.heapBudget[2] = 7189 * MiB;
     reported.heapUsage[2] = 4491 * MiB;
-    Require(StorageTextureBudget(memory, &reported, 49 * MiB, 506 * MiB) == 7189 * MiB / 4u, "49 MiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches held the storage image cache below a quarter of the budget");
+    Require(StorageTextureBudget(memory, &reported, 49 * MiB, 506 * MiB) == 7189 * MiB - 3936 * MiB - 49 * MiB - 7189 * MiB / 8u, "49 MiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches did not leave the storage image cache what the budget has left after them and its eighth");
     reported.heapUsage[2] = 6490 * MiB;
     Require(StorageTextureBudget(memory, &reported, 2 * GiB, 506 * MiB) == 512 * MiB, "2 GiB of sampled textures on an 8 GiB heap with a 7189 MiB budget and 3936 MiB used outside the texture caches did not take the storage image cache back to its 512 MiB floor");
     memory.memoryHeaps[2].size = 10 * GiB;
@@ -6748,8 +7080,8 @@ void storageTextureBudgetTests() {
                     reported.heapUsage[2] = outside + sampled + 512 * MiB;
                     const auto limit = StorageTextureBudget(memory, &reported, sampled, 512 * MiB);
                     Require(limit >= 512 * MiB, "pressure sweep lost the storage cache floor");
-                    Require(limit <= std::max<std::uint64_t>(512 * MiB, budget / 4u), "pressure sweep exceeded a quarter of the reported budget above the floor");
-                    Require(limit <= std::max<std::uint64_t>(2 * GiB, heapGiB * GiB / 4u), "pressure sweep exceeded the heap storage cache cap");
+                    Require(limit <= std::max<std::uint64_t>(512 * MiB, budget / 2u), "pressure sweep exceeded half of the reported budget above the floor");
+                    Require(limit <= std::max<std::uint64_t>(512 * MiB, heapGiB * GiB / 2u), "pressure sweep exceeded half of the heap");
                     if (outside != 0) Require(limit <= previous, "additional non-cache memory usage grew the storage cache budget");
                     if (limit > 512 * MiB) Require(outside + sampled + budget / 8u + limit <= budget, "storage cache budget consumed live sampled memory or pressure headroom");
                     previous = limit;
@@ -7811,6 +8143,9 @@ void barycentricEmulationTests() {
     const std::array<FragmentParameter, 3> parameters{{{0u, 0u, false, false}, {1u, 1u, false, true}, {2u, 2u, true, false}}};
     const auto layout = LayoutBarycentricEmulation(parameters, {true, true, true});
     Require(layout.smoothLocation == 1u && layout.linearLocation == 3u && layout.perVertexLocations == std::vector<std::pair<std::uint32_t, std::uint32_t>>{{1u, 4u}}, "emulated barycentrics did not take the free locations in order");
+    const auto offsetLayout = LayoutBarycentricEmulation(parameters, {true, true, false, true});
+    Require(offsetLayout.smoothLocation == 1u && offsetLayout.reciprocalWLocation == 3u && offsetLayout.perVertexLocations == std::vector<std::pair<std::uint32_t, std::uint32_t>>{{1u, 4u}}, "perspective offset emulation did not reserve reciprocal-w inputs");
+    Require(LayoutBarycentricEmulation(parameters, {true, true, false}).reciprocalWLocation == BarycentricEmulationLayout::NoLocation, "non-offset perspective barycentrics reserved reciprocal-w inputs");
     Require(LayoutBarycentricEmulation(parameters, {}).perVertexLocations.empty() && LayoutBarycentricEmulation(parameters, {}).smoothLocation == BarycentricEmulationLayout::NoLocation, "an inactive emulation was given locations");
     std::vector<FragmentParameter> crowded;
     for (std::uint32_t location = 0; location < 11u; ++location) crowded.push_back({location, location, false, true});
@@ -7927,9 +8262,11 @@ void barycentricEmulationTests() {
     Require(BarycentricPatches(state, patchShaders) && !BarycentricPatches(state, shaders), "generated tessellation stages were not recognised as barycentric patches");
     state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
     ValidateShaders(patchShaders, state, subgroup, false);
-    for (const auto topology : {VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN, VK_PRIMITIVE_TOPOLOGY_POINT_LIST}) {
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP;
+    ValidateShaders(patchShaders, state, subgroup, false);
+    for (const auto topology : {VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN, VK_PRIMITIVE_TOPOLOGY_POINT_LIST}) {
         state.topology = topology;
-        expectFailure([&] { ValidateShaders(patchShaders, state, subgroup, false); }, "require a triangle list");
+        expectFailure([&] { ValidateShaders(patchShaders, state, subgroup, false); }, "require a triangle list or strip");
     }
     state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
     const std::array<CompiledShader, 4> plainPatchShaders{{{ShaderStage::Vertex, &vertex, 0}, {ShaderStage::TessellationControl, &patches.control, 0}, {ShaderStage::TessellationEvaluation, &patches.evaluation, 0}, {ShaderStage::Fragment, &plain, 0}}};
@@ -8477,6 +8814,24 @@ std::string interlockShape(std::span<const std::uint32_t> words) {
     return shape;
 }
 
+bool coherentImageRead(std::span<const std::uint32_t> words) {
+    std::map<std::uint32_t, std::uint32_t> sources;
+    std::set<std::uint32_t> coherent;
+    std::uint32_t image = 0;
+    for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+        const auto op = static_cast<spv::Op>(words[at] & 0xffffu);
+        if (op == spv::OpDecorate && words[at + 2] == spv::DecorationCoherent) coherent.insert(words[at + 1]);
+        if (op == spv::OpLoad || op == spv::OpAccessChain || op == spv::OpInBoundsAccessChain) sources[words[at + 2]] = words[at + 3];
+        if (op == spv::OpImageRead) image = words[at + 3];
+    }
+    for (std::size_t step = 0; image != 0 && step < 8u; ++step) {
+        if (coherent.contains(image)) return true;
+        const auto source = sources.find(image);
+        image = source == sources.end() ? 0u : source->second;
+    }
+    return false;
+}
+
 std::string interlockExits(std::span<const std::uint32_t> words, std::size_t& kills, std::size_t& terminates) {
     struct Block {
         std::vector<spv::Op> ops;
@@ -9140,7 +9495,7 @@ void ProvokingVertexTests() {
     ValidateProvokingVertex(unsupported, first);
     auto last = first;
     last.provokingVertexMode = VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT;
-    expectFailure([&] { ValidateProvokingVertex(unsupported, last); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+    ValidateProvokingVertex(unsupported, last);
     auto supported = unsupported;
     supported.provokingVertexLast = true;
     ValidateProvokingVertex(supported, last);
@@ -9169,6 +9524,14 @@ void ProvokingVertexTests() {
     const std::array<CompiledShader, 1> flatP10Shaders{{{ShaderRecompiler::ShaderStage::Fragment, &flatP10Pixel, 0}}};
     ValidateProvokingVertex(supported, last, flatP10Shaders);
     expectFailure([&] { ValidateProvokingVertex(supported, first, flatP10Shaders); }, "v_interp_mov p10 of a flat input with the first provoking vertex is not measured");
+    const std::array<std::uint32_t, 7> flatP20Color{0xc8120001u, 0xc8160101u, 0xc81a0201u, 0xc81e0301u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+    const auto flatP20Pixel = recompilePixel({0x400u}, flatP20Color);
+    const auto p20Inputs = locatedInputs(flatP20Pixel.spirv.Words());
+    Require(p20Inputs.size() == 1 && p20Inputs[0].location == 0 && p20Inputs[0].flat && !p20Inputs[0].perVertex, "flat v_interp_mov P20 did not compile to a flat input");
+    Require(flatP20Pixel.fragmentParameters.size() == 1 && flatP20Pixel.fragmentParameters[0].flatP20 && !flatP20Pixel.fragmentParameters[0].flatP10 && !flatP20Pixel.fragmentParameters[0].perVertex && !flatP10Pixel.fragmentParameters[0].flatP20, "flat v_interp_mov P20 was not recorded apart from P10");
+    const std::array<CompiledShader, 1> flatP20Shaders{{{ShaderRecompiler::ShaderStage::Fragment, &flatP20Pixel, 0}}};
+    ValidateProvokingVertex(supported, first, flatP20Shaders);
+    expectFailure([&] { ValidateProvokingVertex(supported, last, flatP20Shaders); }, "v_interp_mov p20 of a flat input with the last provoking vertex is not measured");
     auto lastStrip = last;
     lastStrip.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP;
     auto lastList = last;
@@ -9255,6 +9618,105 @@ void ProvokingVertexTests() {
     expectFailure([&] { ValidateProvokingVertex(supported, last); }, "invalid provoking vertex mode");
 }
 
+void UnobservedProvokingVertexTests() {
+    using namespace AgcDriver::Graphics;
+    auto last = DecodeState(makeState());
+    last.provokingVertexMode = VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT;
+    const Context unsupported{};
+    const auto module = [](std::initializer_list<std::uint32_t> instructions) {
+        std::vector<std::uint32_t> words{spv::MagicNumber, 0x10300u, 0u, 4u, 0u};
+        words.insert(words.end(), instructions);
+        return words;
+    };
+    ShaderRecompiler::RecompileResult fragment{};
+    const std::array<CompiledShader, 1> shaders{{{ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}}};
+    const ShaderRecompiler::FragmentParameter smooth{0, 0, false, false};
+    const auto refused = [&](const State& state) {
+        expectFailure([&] { ValidateProvokingVertex(unsupported, state, shaders); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+    };
+    for (const auto topology : {VK_PRIMITIVE_TOPOLOGY_POINT_LIST, VK_PRIMITIVE_TOPOLOGY_LINE_LIST, VK_PRIMITIVE_TOPOLOGY_LINE_STRIP, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN}) {
+        auto state = last;
+        state.topology = topology;
+        ValidateProvokingVertex(unsupported, state);
+        fragment.fragmentParameters.clear();
+        fragment.spirv = module({});
+        ValidateProvokingVertex(unsupported, state, shaders);
+        fragment.fragmentParameters = {smooth};
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationLocation, 0u});
+        ValidateProvokingVertex(unsupported, state, shaders);
+        for (std::uint32_t read = 0; read < 4; ++read) {
+            const ShaderRecompiler::FragmentParameter observed{1, 1, read == 0, read == 1, read == 2, read == 3, false};
+            fragment.fragmentParameters = {smooth, observed};
+            refused(state);
+        }
+        fragment.fragmentParameters = {smooth};
+        for (const std::uint32_t decoration : {static_cast<std::uint32_t>(spv::DecorationFlat), static_cast<std::uint32_t>(spv::DecorationPerVertexKHR)}) {
+            fragment.spirv = module({(3u << 16u) | spv::OpDecorate, 1u, decoration});
+            refused(state);
+            fragment.spirv = module({(4u << 16u) | spv::OpMemberDecorate, 1u, 0u, decoration});
+            refused(state);
+        }
+        fragment.spirv = module({(5u << 16u) | spv::OpDecorate, 1u, spv::DecorationLocation});
+        refused(state);
+        fragment.spirv = std::vector<std::uint32_t>{};
+        refused(state);
+    }
+    fragment.fragmentParameters = {smooth};
+    for (const std::uint32_t generated : {static_cast<std::uint32_t>(spv::BuiltInSampleId), static_cast<std::uint32_t>(spv::BuiltInFrontFacing), static_cast<std::uint32_t>(spv::BuiltInSubgroupLocalInvocationId)}) {
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, generated, (3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat});
+        ValidateProvokingVertex(unsupported, last, shaders);
+        fragment.spirv = module({(3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat, (4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, generated});
+        ValidateProvokingVertex(unsupported, last, shaders);
+        fragment.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, generated, (4u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationFlat});
+        ValidateProvokingVertex(unsupported, last, shaders);
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, generated, (3u << 16u) | spv::OpDecorate, 2u, spv::DecorationFlat});
+        refused(last);
+        fragment.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, generated, (4u << 16u) | spv::OpMemberDecorate, 1u, 1u, spv::DecorationFlat});
+        refused(last);
+    }
+    for (const std::uint32_t passed : {static_cast<std::uint32_t>(spv::BuiltInLayer), static_cast<std::uint32_t>(spv::BuiltInViewportIndex), static_cast<std::uint32_t>(spv::BuiltInPrimitiveId)}) {
+        fragment.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, passed, (3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat});
+        refused(last);
+        fragment.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, passed, (4u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationFlat});
+        refused(last);
+    }
+    ShaderRecompiler::RecompileResult vertex{};
+    vertex.fragmentParameters = {{0, 0, true, true, true, true, true}};
+    vertex.spirv = module({(3u << 16u) | spv::OpDecorate, 1u, spv::DecorationFlat});
+    fragment.fragmentParameters = {smooth};
+    fragment.spirv = module({});
+    const std::array<CompiledShader, 2> stages{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}}};
+    ValidateProvokingVertex(unsupported, last, stages);
+    Context supported{};
+    supported.provokingVertexLast = true;
+    for (const auto stage : {ShaderRecompiler::ShaderStage::Vertex, ShaderRecompiler::ShaderStage::TessellationEvaluation, ShaderRecompiler::ShaderStage::Geometry, ShaderRecompiler::ShaderStage::Mesh}) {
+        ShaderRecompiler::RecompileResult writer{};
+        const std::array<CompiledShader, 2> written{{{stage, &writer, 0}, {ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}}};
+        const auto refusedWrite = [&] {
+            expectFailure([&] { ValidateProvokingVertex(unsupported, last, written); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+            ValidateProvokingVertex(supported, last, written);
+        };
+        for (const std::uint32_t selected : {static_cast<std::uint32_t>(spv::BuiltInLayer), static_cast<std::uint32_t>(spv::BuiltInViewportIndex)}) {
+            writer.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, selected});
+            refusedWrite();
+            writer.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, selected});
+            refusedWrite();
+            writer.spirv = module({(5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, selected, (4u << 16u) | spv::OpMemberDecorate, 1u, 1u, spv::DecorationPerPrimitiveEXT});
+            refusedWrite();
+            writer.spirv = module({(4u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationPerPrimitiveEXT, (5u << 16u) | spv::OpMemberDecorate, 1u, 0u, spv::DecorationBuiltIn, selected});
+            ValidateProvokingVertex(unsupported, last, written);
+            writer.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, selected, (3u << 16u) | spv::OpDecorate, 1u, spv::DecorationPerPrimitiveEXT});
+            ValidateProvokingVertex(unsupported, last, written);
+        }
+        writer.spirv = module({(4u << 16u) | spv::OpDecorate, 1u, spv::DecorationBuiltIn, spv::BuiltInPosition, (5u << 16u) | spv::OpMemberDecorate, 2u, 0u, spv::DecorationBuiltIn, spv::BuiltInPointSize});
+        ValidateProvokingVertex(unsupported, last, written);
+        writer.spirv = std::vector<std::uint32_t>{};
+        refusedWrite();
+    }
+    const std::array<CompiledShader, 1> missing{{{ShaderRecompiler::ShaderStage::Fragment, nullptr, 0}}};
+    expectFailure([&] { ValidateProvokingVertex(unsupported, last, missing); }, "last provoking vertex requires VK_EXT_provoking_vertex with provokingVertexLast enabled");
+}
+
 void ProvokingVertexRenderPassTests() {
     using namespace AgcDriver::Graphics;
     const auto first = DecodeState(makeState());
@@ -9313,6 +9775,8 @@ void ConservativeRasterizationTests() {
     geometry.context[0x2ce] = 3;
     geometry.context[0x29b] = 2;
     geometry.context[0x2ab] = 4;
+    geometry.context[0x280] = 0x00080008u;  // PA_SU_POINT_SIZE and PA_SU_POINT_MINMAX: a point-output geometry program decodes them
+    geometry.context[0x281] = 0x00080008u;
     geometry.shader[0x8a] = 3u << 29u;
     geometry.shader[0x8b] = 3u << 16u;
     for (const auto input : {1u, 2u, 4u}) {
@@ -9519,6 +9983,332 @@ void unorm10_11_11TargetTests() {
     expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(uintExport)); }, "fragment output 0 has no color export packing path");
 }
 
+void unorm4_4_4_4TargetTests() {
+    using ShaderRecompiler::ColorExportPacking;
+    auto queue = makeState();
+    queue.context[0x31c] = (queue.context.at(0x31c) & ~((0x1fu << 2u) | (7u << 8u) | (3u << 11u))) | (19u << 2u) | (2u << 11u);
+    queue.context[0x1b3] = 2;
+    queue.context[0x1b4] = 2;
+    const auto state = AgcDriver::Graphics::DecodeState(queue);
+    Require(state.color.format == VK_FORMAT_R16_UINT && state.color.elementBytes == 2 && state.color.componentMapping == 0x1bu && state.color.packing == ColorExportPacking::Unorm4_4_4_4, "a 4_4_4_4 unorm target did not decode to an R16_UINT attachment with reversed exports");
+    const auto packings = AgcDriver::Graphics::ExportPackings(state);
+    Require(packings[0] == ColorExportPacking::Unorm4_4_4_4 && std::all_of(packings.begin() + 1, packings.end(), [](ColorExportPacking packing) { return packing == ColorExportPacking::None; }), "export 0 did not carry the 4_4_4_4 unorm packing");
+    Require(state.color.partialWriteMask == 0u && state.blends[0].colorWriteMask == 0xfu && AgcDriver::Graphics::ExportTargetMerge(state).mask == 0u, "a full write of a 4_4_4_4 unorm target merged into the target");
+    auto changed = queue;
+    for (const auto& [targetMask, wordMask] : {std::pair{1u, 0xf000u}, std::pair{7u, 0xfff0u}, std::pair{8u, 0x000fu}, std::pair{0xau, 0x0f0fu}}) {
+        changed.context[0x8e] = targetMask;
+        Require(AgcDriver::Graphics::DrawRejection(changed, false).empty(), "the draw precheck refused CB_TARGET_MASK " + std::to_string(targetMask) + " of a 4_4_4_4 unorm target");
+        const auto partial = AgcDriver::Graphics::DecodeState(changed);
+        Require(partial.color.partialWriteMask == wordMask && partial.colors.front().partialWriteMask == wordMask && partial.blends[0].colorWriteMask == 0u && partial.blend.colorWriteMask == 0u, "CB_TARGET_MASK " + std::to_string(targetMask) + " of a 4_4_4_4 unorm target did not merge its nibbles behind a closed write mask");
+        const auto merge = AgcDriver::Graphics::ExportTargetMerge(partial);
+        const auto expected = AgcDriver::Graphics::SurfaceForTarget(partial.color);
+        const auto surface = AgcDriver::Graphics::DecodeTextureResource(merge.descriptor);
+        Require(merge.target == 0u && merge.mask == wordMask && merge.samples == 1u && !merge.depthStencilWrites && surface.baseAddress == expected.baseAddress && surface.pipeBankXor == expected.pipeBankXor && surface.width == expected.width && surface.height == expected.height && surface.format == expected.format && surface.tileMode == expected.tileMode && surface.dimension == AgcDriver::Graphics::TextureDimension::k2D && surface.mipCount == 1u && surface.samples == 1u, "the merge descriptor of CB_TARGET_MASK " + std::to_string(targetMask) + " does not decode to the target's surface");
+    }
+    {
+        auto depthQueue = queue;
+        depthQueue.context[0x8e] = 1;
+        depthQueue.context[0x000] = 0;
+        depthQueue.context[0x002] = 0;
+        depthQueue.context[0x007] = (1u << 16u) | 3u;
+        depthQueue.context[0x00a] = 7;
+        depthQueue.context[0x00b] = 0;
+        depthQueue.context[0x010] = 0x22900983;
+        depthQueue.context[0x011] = 0x20000181;
+        for (const auto offset : {0x012u, 0x014u}) depthQueue.context[offset] = 0x100;
+        for (const auto offset : {0x013u, 0x015u}) depthQueue.context[offset] = 0x200;
+        depthQueue.context[0x005] = 0x300;
+        depthQueue.context[0x01e] = 0x1;
+        depthQueue.context[0x008] = std::bit_cast<std::uint32_t>(0.25f);
+        depthQueue.context[0x009] = std::bit_cast<std::uint32_t>(0.75f);
+        struct DepthStencilCase {
+            std::uint32_t control;
+            std::uint32_t ops;
+            std::uint32_t masks;
+            bool writes;
+        };
+        for (const auto& [control, ops, masks, writes] : {DepthStencilCase{0x00700710u, 0x00050050u, 0x01ffff01u, false}, DepthStencilCase{0x00700712u, 0x00050050u, 0x01ffff01u, false}, DepthStencilCase{0x00700714u, 0x00050050u, 0x01ffff01u, false}, DepthStencilCase{0x00700716u, 0x00050050u, 0x01ffff01u, true}, DepthStencilCase{0x00700711u, 0x00050050u, 0x01ffff01u, true}, DepthStencilCase{0x00700711u, 0u, 0x01ffff01u, false}, DepthStencilCase{0x00700711u, 0x00050050u, 0x0100ff01u, false}, DepthStencilCase{0x00700713u, 0u, 0x01ffff01u, false}, DepthStencilCase{0x00700718u, 0x00050050u, 0x01ffff01u, false}}) {
+            depthQueue.context[0x200] = control;
+            depthQueue.context[0x10b] = ops;
+            depthQueue.context[0x10c] = depthQueue.context[0x10d] = masks;
+            const auto what = "DB_DEPTH_CONTROL " + std::to_string(control) + " with stencil operations " + std::to_string(ops) + " and masks " + std::to_string(masks);
+            Require(AgcDriver::Graphics::DrawRejection(depthQueue, false).empty(), "the draw precheck refused a partial 4_4_4_4 write under " + what);
+            const auto partial = AgcDriver::Graphics::DecodeState(depthQueue);
+            const auto merge = AgcDriver::Graphics::ExportTargetMerge(partial);
+            Require(partial.depth.has_value() == ((control & 0xbu) != 0u) && partial.depthBoundsTest == ((control & 8u) != 0u) && merge.mask == 0xf000u && AgcDriver::Graphics::DepthStencilWrites(partial) == writes && merge.depthStencilWrites == writes && merge.depthStencilTests == ((control & 0xbu) != 0u), "a partial 4_4_4_4 write under " + what + (writes ? " did not report" : " reported") + " depth or stencil writes");
+        }
+        auto truncated = depthQueue;
+        truncated.context[0x200] = 0x00700712u;
+        truncated.context[0x010] = 0x22900987u;
+        truncated.context[0x2f8] = 0x00100001u;
+        truncated.context[0x292] = 3;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) truncated.context[0x2fe + pixel * 4u] = 0xcc44;
+        truncated.context[0x31d] = truncated.context.at(0x31d) & ~0x3f000u;
+        truncated.context[0x8e] = 0xf;
+        const auto full = AgcDriver::Graphics::DecodeState(truncated);
+        Require(full.samples == 2 && full.truncatedCoverage && !full.mergedCoverage && full.color.samples == 1 && full.color.partialWriteMask == 0u, "a full write of a one-sample 4_4_4_4 unorm target beside a 2x depth target did not decode as truncated coverage");
+        truncated.context[0x8e] = 1;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(truncated); }, "under merged or truncated coverage");
+    }
+    {
+        auto smoothed = queue;
+        smoothed.context[0x2f8] = 0x0020c002u;
+        smoothed.context[0x292] = 3;
+        smoothed.context[0x3b8] = 0x0dc00000u;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) smoothed.context[0x2fe + pixel * 4u] = 0xcc44;
+        smoothed.context[0x31d] = smoothed.context.at(0x31d) & ~0x3f000u;
+        smoothed.context[0x201] = 0x02130000u;
+        const auto merged = AgcDriver::Graphics::DecodeState(smoothed);
+        Require(merged.samples == 4 && merged.mergedCoverage && merged.color.samples == 1 && merged.color.partialWriteMask == 0u, "a full write of a one-sample 4_4_4_4 unorm target under OVERRASTERIZATION_AMOUNT 2 did not decode as merged coverage");
+        smoothed.context[0x8e] = 1;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(smoothed); }, "under merged or truncated coverage");
+    }
+    {
+        changed.context[0x8e] = 1;
+        const auto partial = AgcDriver::Graphics::DecodeState(changed);
+        auto killQueue = changed;
+        killQueue.context[0x203] = 0x40u;
+        const auto killState = AgcDriver::Graphics::DecodeState(killQueue);
+        killQueue.context[0x203] = 0x10u;
+        const auto earlyState = AgcDriver::Graphics::DecodeState(killQueue);
+        Require(killState.pixelKill && !killState.pixelEarlyZ && !earlyState.pixelKill && earlyState.pixelEarlyZ, "DB_SHADER_CONTROL.KILL_ENABLE of a 4_4_4_4 merge did not decode as a kill under late tests");
+        constexpr std::array<std::uint32_t, 3> mergeCode{0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto merging = packedExportRequest(changed, partial, mergeCode);
+        merging.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(partial);
+        const std::array<std::uint32_t, 3> capabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat};
+        merging.target.supportedCapabilities = capabilities;
+        merging.target.registrationWordLimit = 1u << 20u;
+        const ShaderRecompiler::RequestSerializer mergeSerializer;
+        Require(mergeSerializer.Deserialize(mergeSerializer.Serialize(merging)).request.context.pixel->targetMerge == merging.context.pixel->targetMerge, "the 4_4_4_4 target merge was lost in serialization");
+        auto unmerged = merging;
+        unmerged.context.pixel->targetMerge = {};
+        auto moved = merging;
+        moved.context.pixel->targetMerge.descriptor[0] += 0x100u;
+        std::vector<std::uint64_t> mergedKey, unmergedKey, movedKey;
+        ShaderRecompiler::RecompileCacheKey::BuildInterface(merging, mergedKey);
+        ShaderRecompiler::RecompileCacheKey::BuildInterface(unmerged, unmergedKey);
+        ShaderRecompiler::RecompileCacheKey::BuildInterface(moved, movedKey);
+        Require(mergedKey != unmergedKey && mergedKey == movedKey, "the static shader key does not separate merging from plain writes, or depends on the merged target's address");
+        for (const bool registration : {false, true}) {
+            merging.target.registrationModules = registration;
+            const auto merged = ShaderRecompiler::Recompile(merging);
+            const auto words = merged.spirv.Copy();
+            std::size_t reads = 0, writes = 0;
+            for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+                reads += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageRead ? 1u : 0u;
+                writes += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageWrite ? 1u : 0u;
+            }
+            const auto what = std::string(registration ? "a registration" : "a specialized") + " 4_4_4_4 merge module";
+            Require(merged.registrationModule == registration && reads == 1u && writes == 1u && interlockShape(words) == "capability extension ordered begin end " && declaresEarlyFragmentTests(merging), what + " did not read and write the target once inside a pixel interlock after early tests: " + interlockShape(words));
+            Require(coherentImageRead(words), what + " does not read the target through a Coherent image variable");
+            const auto bound = std::ranges::any_of(merged.bindings, [&](const ShaderRecompiler::DescriptorBinding& binding) {
+                if (binding.role != ShaderRecompiler::DescriptorRole::GuestImages || binding.kind != ShaderRecompiler::DescriptorKind::StorageImage) return false;
+                for (std::size_t offset = 0; offset + 8u <= binding.guestDescriptor.size(); offset += 8u) {
+                    if (std::equal(merging.context.pixel->targetMerge.descriptor.begin(), merging.context.pixel->targetMerge.descriptor.end(), binding.guestDescriptor.begin() + static_cast<std::ptrdiff_t>(offset))) return true;
+                }
+                return false;
+            });
+            Require(bound, what + " does not bind the merged target as a storage image");
+            ShaderRecompiler::RecompileResult vertex;
+            vertex.spirv = makeModule({});
+            const VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
+            const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &merged, 0}}};
+            Require(AgcDriver::Graphics::ValidateShaders(shaders, partial, subgroup, false) == std::set<std::uint32_t>{0u}, what + " lost its export to attachment 0");
+        }
+        auto lacking = merging;
+        const std::array<std::uint32_t, 2> noInterlock{spv::CapabilityShader, spv::CapabilityStorageImageReadWithoutFormat};
+        lacking.target.supportedCapabilities = noInterlock;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(lacking)); }, "fragmentShaderPixelInterlock");
+        auto unformatted = merging;
+        const std::array<std::uint32_t, 2> noFormatlessReads{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT};
+        unformatted.target.supportedCapabilities = noFormatlessReads;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(unformatted)); }, "storage image reads without a format");
+        auto killing = merging;
+        killing.context.pixel->pixelKillEnable = true;
+        killing.context.pixel->earlyZ = false;
+        for (const bool registration : {false, true}) {
+            killing.target.registrationModules = registration;
+            const auto words = ShaderRecompiler::Recompile(killing).spirv.Copy();
+            std::size_t reads = 0, writes = 0;
+            for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+                reads += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageRead ? 1u : 0u;
+                writes += static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpImageWrite ? 1u : 0u;
+            }
+            Require(reads == 1u && writes == 1u && interlockShape(words) == "capability extension ordered begin end " && declaresEarlyFragmentTests(killing), "a killing 4_4_4_4 merge module under late tests of a draw without depth or stencil writes did not merge inside a pixel interlock after early tests");
+        }
+        killing.context.pixel->targetMerge.depthStencilWrites = true;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(killing)); }, "kills pixels under late tests of a draw writing depth or stencil");
+        auto earlyKilling = killing;
+        earlyKilling.context.pixel->earlyZ = true;
+        static_cast<void>(ShaderRecompiler::Recompile(earlyKilling));
+        auto exporting = merging;
+        exporting.context.pixel->depthExportEnable = true;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(exporting)); }, "exports depth");
+        alignas(16) static std::array<std::uint32_t, 4> counted{};
+        static const std::array<std::uint32_t, 4> counter{static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data())), static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data()) >> 32u) & 0xffffu, 16u, 0x31016facu};
+        constexpr std::array<std::uint32_t, 6> countingCode{0x7e000281u, 0xe0c80000u, 0x80000000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto counting = packedExportRequest(changed, partial, countingCode);
+        counting.context.userData = counter;
+        counting.context.pixel->targetMerge = merging.context.pixel->targetMerge;
+        counting.target = merging.target;
+        counting.target.registrationModules = false;
+        counting.target.bdaAbiVersion = ShaderRecompiler::BdaAbi::Version;
+        static const std::array<std::uint32_t, 4> atomicCapabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityInt64};
+        counting.target.supportedCapabilities = atomicCapabilities;
+        counting.context.pixel->earlyZ = false;
+        static_cast<void>(ShaderRecompiler::Recompile(counting));
+        counting.context.pixel->targetMerge.depthStencilTests = true;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(counting)); }, "writes guest memory (stores, atomics or GDS) under late tests");
+        counting.context.pixel->earlyZ = true;
+        const auto earlyWords = ShaderRecompiler::Recompile(counting).spirv.Copy();
+        std::size_t atomics = 0;
+        for (std::size_t at = 5; at < earlyWords.size() && (earlyWords[at] >> 16u) != 0; at += earlyWords[at] >> 16u) atomics += static_cast<spv::Op>(earlyWords[at] & 0xffffu) == spv::OpAtomicIAdd ? 1u : 0u;
+        Require(atomics == 1u && interlockShape(earlyWords) == "capability extension ordered begin end " && declaresEarlyFragmentTests(counting), "a 4_4_4_4 merge whose shader adds to a counter under early tests did not keep its one atomic add beside the merge");
+        constexpr std::array<std::uint32_t, 9> gdsReadCode{0xbefc03ffu, 0x00000100u, 0x7e000280u, 0xd8da0000u, 0x04000000u, 0xbf8c0000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto gdsReading = packedExportRequest(changed, partial, gdsReadCode);
+        gdsReading.context.pixel->targetMerge = counting.context.pixel->targetMerge;
+        gdsReading.context.pixel->earlyZ = false;
+        gdsReading.target = counting.target;
+        static_cast<void>(ShaderRecompiler::Recompile(gdsReading));
+        constexpr std::array<std::uint32_t, 9> gdsAddCode{0xbefc03ffu, 0x00000100u, 0x7e000280u, 0xd8020000u, 0x00000000u, 0xbf8c0000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto gdsAdding = gdsReading;
+        gdsAdding.shader.code = gdsAddCode;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(gdsAdding)); }, "writes guest memory (stores, atomics or GDS) under late tests");
+        auto lateMerge = counting;
+        lateMerge.context.pixel->earlyZ = false;
+        lateMerge.context.pixel->targetMerge = {};
+        static_cast<void>(ShaderRecompiler::Recompile(lateMerge));
+    }
+    changed = queue;
+    changed.context[0x8e] = 1u;
+    changed.context[0x31d] = (changed.context.at(0x31d) & ~0x3f000u) | (1u << 12u) | (1u << 15u);
+    {
+        const auto multisampled = AgcDriver::Graphics::DecodeState(changed);
+        Require(multisampled.samples == 2u && multisampled.color.samples == 2u && multisampled.color.partialWriteMask == 0xf000u && multisampled.blends[0].colorWriteMask == 0u && multisampled.perSampleShading, "a partial write of a 2-sample 4_4_4_4 unorm target did not merge per sample behind a closed write mask");
+        auto coverage = changed;
+        coverage.context[0x1b3] = 0x4002u;
+        coverage.context[0x1b4] = 0x4002u;
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(coverage); }, "SAMPLE_COVERAGE in a multisampled pixel shader that runs per sample");
+        coverage.context[0x8e] = 0xfu;
+        Require(!AgcDriver::Graphics::DecodeState(coverage).perSampleShading, "a full write of a 2-sample 4_4_4_4 unorm target with a SAMPLE_COVERAGE input was refused or ran per sample");
+        struct InputCase {
+            std::uint32_t inputs;
+            std::uint32_t position;
+            const char* what;
+        };
+        auto rasterized = changed;
+        rasterized.context[0x2f8] = 0x00100001u;
+        rasterized.context[0x292] = 3;
+        rasterized.context[0x3b8] = 0x0dc00000u;
+        for (std::uint32_t pixel = 0; pixel < 4; ++pixel) rasterized.context[0x2fe + pixel * 4u] = 0xcc44;
+        const auto inputState = [](AgcDriver::QueueState queue, std::uint32_t inputs, std::uint32_t position) {
+            queue.context[0x1b3] = inputs;
+            queue.context[0x1b4] = inputs;
+            queue.context[0x1b8] = position;
+            return queue;
+        };
+        for (const auto& [inputs, position, what] : {InputCase{0x0004u, 0u, "PERSP_CENTROID"}, InputCase{0x0040u, 0u, "LINEAR_CENTROID"}, InputCase{0x0001u, 0u, "PERSP_SAMPLE"}, InputCase{0x0008u, 0u, "PERSP_PULL_MODEL"}, InputCase{0x2002u, 0u, "ANCILLARY"}, InputCase{0x0402u, 0u, "POS_Z_FLOAT"}, InputCase{0x0802u, 0u, "POS_W_FLOAT"}, InputCase{0x0302u, 0x20000u, "POS_X_FLOAT and POS_Y_FLOAT at a sample"}, InputCase{0x0102u, 0x10000u, "POS_X_FLOAT at the centroid"}}) {
+            auto moved = inputState(rasterized, inputs, position);
+            expectFailure([&] { AgcDriver::Graphics::DecodeState(moved); }, "cannot read the ancillary word or, unless every sample sits at the pixel centre");
+            moved.context[0x293] = moved.context.at(0x293) | 0x10000u;
+            Require(AgcDriver::Graphics::DecodeState(moved).perSampleShading, std::string("a partial write of a 2-sample 4_4_4_4 unorm target whose shader the guest runs per sample was refused for reading ") + what);
+            if (inputs == 0x2002u) {
+                expectFailure([&] { AgcDriver::Graphics::DecodeState(inputState(changed, inputs, position)); }, "cannot read the ancillary word");
+                continue;
+            }
+            Require(AgcDriver::Graphics::DecodeState(inputState(changed, inputs, position)).perSampleShading, std::string("a partial write of a 2-sample 4_4_4_4 unorm target raised from a one-sample rasterizer, every sample at the pixel centre, was refused for reading ") + what);
+        }
+        for (const auto& [inputs, position, what] : {InputCase{0x0302u, 0u, "POS_X_FLOAT and POS_Y_FLOAT at the centre"}, InputCase{0x0302u, 0x100000u, "POS_X_FLOAT and POS_Y_FLOAT at the upper-left corner"}, InputCase{0x9022u, 0u, "PERSP_CENTER, LINEAR_CENTER, FRONT_FACE and POS_FIXED_PT"}}) {
+            Require(AgcDriver::Graphics::DecodeState(inputState(rasterized, inputs, position)).perSampleShading, std::string("a partial write of a 2-sample 4_4_4_4 unorm target whose pixel-rate shader reads ") + what + " was refused");
+        }
+        const auto merge = AgcDriver::Graphics::ExportTargetMerge(multisampled);
+        const auto surface = AgcDriver::Graphics::DecodeTextureResource(merge.descriptor);
+        Require(merge.samples == 2u && merge.mask == 0xf000u && surface.dimension == AgcDriver::Graphics::TextureDimension::k2DMsaa && surface.samples == 2u && surface.baseAddress == multisampled.color.surfaceAddress && surface.width == multisampled.color.extent.width && surface.height == multisampled.color.extent.height && surface.format == AgcDriver::Graphics::TargetMergeSurface(multisampled.color).format, "the merge descriptor of a 2-sample 4_4_4_4 unorm target does not decode to its multisampled surface");
+        auto unshaded = multisampled;
+        unshaded.perSampleShading = false;
+        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::ExportTargetMerge(unshaded)); }, "needs per-sample shading");
+        constexpr std::array<std::uint32_t, 3> mergeCode{0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto merging = packedExportRequest(changed, multisampled, mergeCode);
+        merging.context.pixel->targetMerge = merge;
+        const std::array<std::uint32_t, 5> capabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityStorageImageMultisample, spv::CapabilityInterpolationFunction};
+        merging.target.supportedCapabilities = capabilities;
+        merging.target.fragmentShaderBarycentricEnabled = true;
+        const auto words = ShaderRecompiler::Recompile(merging).spirv.Copy();
+        std::size_t sampled = 0;
+        bool sampleRate = false;
+        for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+            const auto op = static_cast<spv::Op>(words[at] & 0xffffu);
+            if (op == spv::OpCapability && words[at + 1] == spv::CapabilitySampleRateShading) sampleRate = true;
+            if (op == spv::OpImageRead && (words[at] >> 16u) == 7u && words[at + 5] == spv::ImageOperandsSampleMask) ++sampled;
+            if (op == spv::OpImageWrite && (words[at] >> 16u) == 6u && words[at + 4] == spv::ImageOperandsSampleMask) ++sampled;
+        }
+        Require(sampleRate && sampled == 2u && interlockShape(words) == "capability extension ordered begin end ", "a 2-sample 4_4_4_4 merge module does not read and write the shaded sample inside a pixel interlock");
+        auto single = merging;
+        const std::array<std::uint32_t, 4> noMultisampleStorage{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityInterpolationFunction};
+        single.target.supportedCapabilities = noMultisampleStorage;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(single)); }, "storage image multisampling");
+        auto centred = merging;
+        centred.target.fragmentShaderBarycentricEnabled = false;
+        centred.context.pixel->sampleLocations = AgcDriver::Graphics::PixelSampleLocations(multisampled, *centred.context.pixel);
+        Require(std::ranges::all_of(centred.context.pixel->sampleLocations, [](std::uint8_t location) { return location == 0u; }), "a merge raised from a one-sample rasterizer did not keep every sample at the pixel centre");
+        static_cast<void>(ShaderRecompiler::Recompile(centred));
+        const auto rasterizedState = AgcDriver::Graphics::DecodeState(rasterized);
+        auto offCentre = packedExportRequest(rasterized, rasterizedState, mergeCode);
+        offCentre.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(rasterizedState);
+        offCentre.context.pixel->iteratesSamples = rasterizedState.perSampleShading;
+        offCentre.context.pixel->sampleLocations = AgcDriver::Graphics::PixelSampleLocations(rasterizedState, *offCentre.context.pixel);
+        Require(std::ranges::any_of(offCentre.context.pixel->sampleLocations, [](std::uint8_t location) { return location != 0u; }), "a 2-sample rasterizer's merge did not pass its off-centre sample locations");
+        offCentre.target.supportedCapabilities = capabilities;
+        offCentre.target.fragmentShaderBarycentricEnabled = false;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(offCentre)); }, "its centre-located barycentrics would follow the sample");
+        offCentre.target.fragmentShaderBarycentricEnabled = true;
+        static_cast<void>(ShaderRecompiler::Recompile(offCentre));
+        alignas(16) static std::array<std::uint32_t, 4> counted{};
+        static const std::array<std::uint32_t, 4> counter{static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data())), static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(counted.data()) >> 32u) & 0xffffu, 16u, 0x31016facu};
+        constexpr std::array<std::uint32_t, 6> countingCode{0x7e000281u, 0xe0c80000u, 0x80000000u, 0xf800180fu, 0x07060504u, 0xbf810000u};
+        auto counting = packedExportRequest(changed, multisampled, countingCode);
+        counting.context.userData = counter;
+        counting.context.pixel->targetMerge = merge;
+        counting.context.pixel->iteratesSamples = true;
+        counting.context.pixel->earlyZ = true;
+        counting.target = merging.target;
+        counting.target.bdaAbiVersion = ShaderRecompiler::BdaAbi::Version;
+        static const std::array<std::uint32_t, 6> atomicCapabilities{spv::CapabilityShader, spv::CapabilityFragmentShaderPixelInterlockEXT, spv::CapabilityStorageImageReadWithoutFormat, spv::CapabilityStorageImageMultisample, spv::CapabilityInterpolationFunction, spv::CapabilityInt64};
+        counting.target.supportedCapabilities = atomicCapabilities;
+        expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(counting)); }, "each covered sample would repeat its writes");
+        auto unmergedCounting = counting;
+        unmergedCounting.context.pixel->targetMerge = {};
+        static_cast<void>(ShaderRecompiler::Recompile(unmergedCounting));
+    }
+    for (const auto& [number, swap] : {std::pair{1u, 2u}, std::pair{4u, 2u}, std::pair{0u, 0u}, std::pair{0u, 1u}, std::pair{0u, 3u}}) {
+        changed = queue;
+        changed.context[0x31c] = (changed.context[0x31c] & ~((7u << 8u) | (3u << 11u))) | (number << 8u) | (swap << 11u);
+        expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "unsupported color format 19 number type " + std::to_string(number) + " component swap " + std::to_string(swap));
+    }
+    changed = queue;
+    changed.context[0x31c] |= 0x10000000u;
+    changed.context[0x325] = 0x1234;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "DCC-compressed 4_4_4_4 unorm color targets");
+    changed = queue;
+    changed.context[0x31c] |= 0x40000u;
+    expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "truncating (ROUND_MODE) 4_4_4_4 unorm color targets");
+
+    constexpr std::array<std::uint32_t, 3> code{0xf800180fu, 0x07060504u, 0xbf810000u};
+    const auto request = packedExportRequest(queue, state, code);
+    auto plain = request;
+    plain.context.pixel->targetExportPacking.fill(ColorExportPacking::None);
+    const ShaderRecompiler::RequestSerializer serializer;
+    Require(serializer.Deserialize(serializer.Serialize(request)).request.context.pixel->targetExportPacking == request.context.pixel->targetExportPacking, "the 4_4_4_4 unorm packing was lost in serialization");
+    const auto packed = ShaderRecompiler::Recompile(request);
+    const auto unpacked = ShaderRecompiler::Recompile(plain);
+    Require(packed.PipelineVariantId() != unpacked.PipelineVariantId() && !(packed.spirv == unpacked.spirv), "the 4_4_4_4 export packing did not specialize the module");
+    ShaderRecompiler::RecompileResult vertex;
+    vertex.spirv = makeModule({});
+    const VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &packed, 0}}};
+    Require(AgcDriver::Graphics::ValidateShaders(shaders, state, subgroup, false) == std::set<std::uint32_t>{0u}, "the 4_4_4_4 packed export did not reach attachment 0");
+}
+
 void float11_11_10TargetTests() {
     using ShaderRecompiler::ColorExportPacking;
     auto queue = makeState();
@@ -9533,7 +10323,12 @@ void float11_11_10TargetTests() {
     auto changed = queue;
     changed.context[0x31c] &= ~0x40000u;
     expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "rounding (ROUND_MODE 0) 11_11_10 float color targets");
-    for (const auto swap : {0u, 1u, 3u}) {
+    changed = queue;
+    changed.context[0x31c] &= ~0x1800u;
+    const auto standard = AgcDriver::Graphics::DecodeState(changed);
+    Require(standard.color.format == VK_FORMAT_R32_UINT && standard.color.componentMapping == 0xe4u && standard.color.packing == ColorExportPacking::Float11_11_10, "an 11_11_10 float target with the standard component order did not decode");
+    Require(AgcDriver::Graphics::ExportMappings(standard)[0] == 0xe4u, "export 0 reordered its components into the standard-order 11_11_10 float target");
+    for (const auto swap : {1u, 3u}) {
         changed = queue;
         changed.context[0x31c] = (changed.context[0x31c] & ~0x1800u) | (swap << 11u);
         expectFailure([&] { AgcDriver::Graphics::DecodeState(changed); }, "unsupported color format 7 number type 7 component swap " + std::to_string(swap));
@@ -9580,7 +10375,7 @@ void float11_11_10TargetTests() {
     const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, {ShaderRecompiler::ShaderStage::Fragment, &packed, 0}}};
     Require(AgcDriver::Graphics::ValidateShaders(shaders, state, subgroup, false) == std::set<std::uint32_t>{0u}, "the packed float export did not reach attachment 0");
     auto invalid = request;
-    invalid.context.pixel->targetExportPacking[0] = static_cast<ColorExportPacking>(3);
+    invalid.context.pixel->targetExportPacking[0] = static_cast<ColorExportPacking>(4);
     expectFailure([&] { static_cast<void>(ShaderRecompiler::Recompile(invalid)); }, "invalid prepared fragment export packing");
 }
 
@@ -10019,6 +10814,21 @@ void validationTests() {
         attribute.components = 2;
         attribute.resource.fields[1] |= 0x80000000u;
         expectFailure([&] { AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1)); }, "descriptor flags");
+        attribute.resource.fields = {0x1000, 8u << 16u, 3, 71u << 12u};
+        attribute.components = 3;
+        context.formatProperties = [](VkPhysicalDevice, VkFormat format, VkFormatProperties* properties) {
+            *properties = {};
+            if (format == VK_FORMAT_R16G16B16A16_SFLOAT || format == VK_FORMAT_R8G8B8A8_UNORM) properties->bufferFeatures = VK_FORMAT_FEATURE_VERTEX_BUFFER_BIT;
+        };
+        Require(AgcDriver::Graphics::DecodeVertexFormat(attribute).format == VK_FORMAT_R16G16B16_SFLOAT && AgcDriver::Graphics::DecodeVertexFormat(attribute).bytes == 6, "a 3-component 16_16_16_16 float attribute was not decoded as 3 components");
+        const auto widened = AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1));
+        Require(widened.attributes[0].format == VK_FORMAT_R16G16B16A16_SFLOAT && widened.bindings[0].stride == 8 && AgcDriver::Graphics::VertexReadBytes(attribute, widened.attributes[0].format) == 8, "a 3-component 16_16_16_16 float attribute was not widened to the format the device supports");
+        Require(AgcDriver::Graphics::VertexAttributeSignature(attribute) == "f32x3", "widening the vertex format changed the shader input");
+        attribute.resource.fields = {0x1000, 4u << 16u, 3, 56u << 12u};
+        Require(AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1)).attributes[0].format == VK_FORMAT_R8G8B8A8_UNORM, "a 3-component 8_8_8_8 unorm attribute was not widened to the format the device supports");
+        attribute.resource.fields = {0x1000, 12u << 16u, 3, 74u << 12u};
+        expectFailure([&] { AgcDriver::Graphics::BuildVertexInputLayout(context, std::span(&attribute, 1)); }, "device does not support vertex format 106");
+        expectFailure([&] { AgcDriver::Graphics::VertexReadBytes(attribute, VK_FORMAT_R32G32B32A32_SFLOAT); }, "is not a form of");
     }
     for (const auto capability : {spv::CapabilityInt64Atomics, spv::CapabilityInt64ImageEXT}) {
         ShaderRecompiler::RecompileResult vertex;
@@ -10152,7 +10962,6 @@ void validationTests() {
     }
 }
 
-
 }
 
 bool recompilesDebugBranch(std::uint32_t opcode) {
@@ -10719,6 +11528,39 @@ void pipelineJournalTests(bool longPath = false, bool extended = false) {
         const PipelineSetLayouts decodedLayouts{layouts.layouts.main, layouts.layouts.fragment, decoded.splitSets, decoded.mainLayoutKey, decoded.fragmentLayoutKey};
         BuildPipelineStoreKey(replayed, context, decoded.state, decoded.vertexInput, decodedLayouts, shaders, decoded.attachmentLayout);
         Require(!original.empty() && original == canonical && original == replayed, "the canonical or the decoded state keys another pipeline");
+        auto fmaskState = state;
+        fmaskState.samples = 8;
+        fmaskState.color.samples = 8;
+        fmaskState.color.fmaskAddress = 0x30000;
+        fmaskState.color.fmaskPipeBankXor = 0x1200;
+        for (auto& target : fmaskState.colors) {
+            target.samples = 8;
+            target.fmaskAddress = 0x40000;
+            target.fmaskPipeBankXor = 0x2300;
+        }
+        const auto fmaskRecipe = MakeGraphicsPipelineRecipe(fmaskState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
+        Require(fmaskRecipe.state.color.fmaskAddress == 0 && fmaskRecipe.state.color.fmaskPipeBankXor == 0, "the canonical state kept the primary target's FMASK location");
+        for (const auto& canonicalColor : fmaskRecipe.state.colors) {
+            Require(canonicalColor.fmaskAddress == 0 && canonicalColor.fmaskPipeBankXor == 0, "the canonical state kept an attachment's FMASK location");
+        }
+        const auto fmaskBytes = EncodeGraphicsPipelineRecipe(fmaskRecipe);
+        GraphicsPipelineRecipe fmaskDecoded;
+        Require(DecodeGraphicsPipelineRecipe(fmaskBytes, fmaskDecoded) && EncodeGraphicsPipelineRecipe(fmaskDecoded) == fmaskBytes, "the FMASK pipeline recipe did not round-trip byte for byte");
+        std::vector<std::byte> fmaskKey, fmaskReplayedKey;
+        BuildPipelineStoreKey(fmaskKey, context, fmaskState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
+        BuildPipelineStoreKey(fmaskReplayedKey, context, fmaskDecoded.state, fmaskDecoded.vertexInput, layouts.View(), shaders, fmaskDecoded.attachmentLayout);
+        Require(fmaskKey != original && fmaskKey == fmaskReplayedKey, "the decoded FMASK state keys another pipeline");
+        auto relocatedFmask = fmaskState;
+        relocatedFmask.color.fmaskAddress += 0x10000;
+        relocatedFmask.color.fmaskPipeBankXor ^= 0x100;
+        for (auto& target : relocatedFmask.colors) {
+            target.fmaskAddress += 0x20000;
+            target.fmaskPipeBankXor ^= 0x200;
+        }
+        std::vector<std::byte> relocatedFmaskKey;
+        BuildPipelineStoreKey(relocatedFmaskKey, context, relocatedFmask, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
+        Require(relocatedFmaskKey == fmaskKey, "the FMASK resource location changed the pipeline key");
+        Require(EncodeGraphicsPipelineRecipe(MakeGraphicsPipelineRecipe(relocatedFmask, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL)) == fmaskBytes, "the FMASK resource location changed the journal recipe");
         auto gridState = state;
         gridState.samples = 2;
         gridState.customSampleLocations = true;
@@ -10737,6 +11579,22 @@ void pipelineJournalTests(bool longPath = false, bool extended = false) {
         GraphicsPipelineRecipe lineDecoded;
         Require(DecodeGraphicsPipelineRecipe(EncodeGraphicsPipelineRecipe(MakeGraphicsPipelineRecipe(lineState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL)), lineDecoded), "the line strip mesh recipe does not decode");
         Require(lineDecoded.state.stages.mesh && lineDecoded.state.stages.mesh->outputPrimitiveSize == 2u && lineDecoded.state.stages.mesh->esgsItemSize == 4u, "the recipe dropped the mesh output primitive size");
+        auto pointState = state;
+        pointState.vertexPoints = true;
+        pointState.pointSize = 4.0f;
+        pointState.pointSizeMin = 0.5f;
+        pointState.pointSizeMax = 8.0f;
+        GraphicsPipelineRecipe pointDecoded;
+        Require(DecodeGraphicsPipelineRecipe(EncodeGraphicsPipelineRecipe(MakeGraphicsPipelineRecipe(pointState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL)), pointDecoded), "the point list recipe does not decode");
+        Require(pointDecoded.state.vertexPoints && pointDecoded.state.pointSize == 4.0f && pointDecoded.state.pointSizeMin == 0.5f && pointDecoded.state.pointSizeMax == 8.0f, "the recipe dropped the vertex point list or its point sizes");
+        auto meshPointState = pointState;
+        meshPointState.vertexPoints = false;
+        meshPointState.stages.mesh = *lineState.stages.mesh;
+        meshPointState.stages.mesh->outputPrimitiveSize = 1u;
+        meshPointState.stages.mesh->provokingVertex = 0u;
+        GraphicsPipelineRecipe meshPointDecoded;
+        Require(DecodeGraphicsPipelineRecipe(EncodeGraphicsPipelineRecipe(MakeGraphicsPipelineRecipe(meshPointState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL)), meshPointDecoded), "the mesh point recipe does not decode");
+        Require(!meshPointDecoded.state.vertexPoints && meshPointDecoded.state.stages.mesh && meshPointDecoded.state.stages.mesh->outputPrimitiveSize == 1u && meshPointDecoded.state.pointSize == 4.0f && meshPointDecoded.state.pointSizeMin == 0.5f && meshPointDecoded.state.pointSizeMax == 8.0f, "the recipe dropped mesh points or their sizes without the vertex point flag");
         auto fourSampleState = state;
         fourSampleState.samples = 4;
         auto maskState = fourSampleState;
@@ -10760,6 +11618,15 @@ void pipelineJournalTests(bool longPath = false, bool extended = false) {
         BuildPipelineStoreKey(mergedKey, context, mergedState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
         BuildPipelineStoreKey(mergedReplayed, context, mergedDecoded.state, mergedDecoded.vertexInput, layouts.View(), shaders, mergedDecoded.attachmentLayout);
         Require(mergedKey != fourSamples && mergedKey == mergedReplayed, "the decoded merged coverage state keys another pipeline");
+        auto partialState = state;
+        partialState.colors[0].partialWriteMask = 0xf000u;
+        GraphicsPipelineRecipe partialDecoded;
+        Require(DecodeGraphicsPipelineRecipe(EncodeGraphicsPipelineRecipe(MakeGraphicsPipelineRecipe(partialState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL)), partialDecoded), "the partial write recipe does not decode");
+        Require(partialDecoded.state.colors.size() == partialState.colors.size() && partialDecoded.state.colors[0].partialWriteMask == 0xf000u, "the recipe dropped the merged target's partial write mask");
+        std::vector<std::byte> partialKey, partialReplayed;
+        BuildPipelineStoreKey(partialKey, context, partialState, input, layouts.View(), shaders, VK_IMAGE_LAYOUT_GENERAL);
+        BuildPipelineStoreKey(partialReplayed, context, partialDecoded.state, partialDecoded.vertexInput, layouts.View(), shaders, partialDecoded.attachmentLayout);
+        Require(partialKey != original && partialKey == partialReplayed, "the decoded partial write state keys another pipeline");
         auto movedState = state;
         movedState.viewport.x = 5;
         movedState.colors[0].address = 0x9000;
@@ -11012,6 +11879,23 @@ int main(int argc, char** argv) {
             Require(mock.live == 0, "the sparse heap mirror unwatch test leaked Vulkan objects");
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--sparse-heap-mirror-budget") {
+            {
+                mock = MockVulkan{};
+                auto context = mockContext();
+                context.bufferDeviceAddress = true;
+                context.limits.maxStorageBufferRange = 1u << 27;
+                RunSparseHeapMirrorBudgetTests(context, {
+                    [](VkBuffer buffer) -> std::span<std::byte> { return mockBufferMemory(buffer); },
+                    {},
+                    {},
+                    {},
+                    {}
+                });
+            }
+            Require(mock.live == 0, "the sparse heap mirror budget test leaked Vulkan objects");
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--heap-mirror-run-unwatch") {
             {
                 mock = MockVulkan{};
@@ -11102,6 +11986,12 @@ int main(int argc, char** argv) {
             std::cerr << "descriptor pool reset failure did not terminate\n";
             return 1;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--unobserved-provoking-vertex") {
+            UnobservedProvokingVertexTests();
+            ProvokingVertexTests();
+            std::cout << "Unobserved provoking vertex checks passed\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--covered-centroid-state") {
             multisampleTests();
             std::cout << "Covered-centroid and multisample state checks passed\n";
@@ -11170,6 +12060,7 @@ int main(int argc, char** argv) {
         ZExportTests();
         unorm10_11_11TargetTests();
         float11_11_10TargetTests();
+        unorm4_4_4_4TargetTests();
         DepthBoundsBiasTests();
         conservativeZExportTests();
         earlyFragmentTestsTests();
@@ -11211,6 +12102,7 @@ int main(int argc, char** argv) {
         UnwrittenSampleLocationTests();
         sampleLocationGridFallbackTests();
         sampleOrderTests();
+        UnwrittenDepthPlaneTests();
         depthCopyFormatTests();
         quadPixelMaskTests();
         ShaderStageTests();
@@ -11218,6 +12110,7 @@ int main(int argc, char** argv) {
         NggVertexWorkgroupTests();
         inactiveVertexPointSizeTests();
         PolygonPrimitiveTests();
+        vertexPointListTests();
         TuningFieldTests();
         PixelInputLayoutTests();
         UnexportedPixelInputTests();
@@ -11302,6 +12195,7 @@ int main(int argc, char** argv) {
         RunGuestTextureResourceTests();
         RunDepthSurfaceReuseTests();
         RunGuestSamplerResourceTests();
+        RunLastRecordIndicesTests();
         mock = MockVulkan{};
         auto textureDetilerContext = mockContext();
         textureDetilerContext.limits.minStorageBufferOffsetAlignment = 16;
diff --git a/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp b/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp
index 28a442b75d..95dcc30770 100644
--- a/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp
+++ b/core/libs/prx/libSceAgcDriver/tests/GraphicsTests.hpp
@@ -36,6 +36,7 @@ void RunTextureTilingTests();
 void RunGuestTextureResourceTests();
 void RunDepthSurfaceReuseTests();
 void RunGuestSamplerResourceTests();
+void RunLastRecordIndicesTests();
 void RunTextureDetilerTests(const AgcDriver::Graphics::Context& context, const TextureDetilerTestAccess& access);
 
 #endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp b/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp
index db38d183f5..ab7db93b7a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/GuestTextureResource.cpp
@@ -95,6 +95,52 @@ void rejectFields(const Fields& f, std::string_view reason) {
 
 }
 
+static void RunR128TextureTests() {
+    constexpr std::array<std::uint32_t, 8> streamed{0xa0c18800u, 0xcad00000u, 0x01ffc1ffu, 0x905b2facu, 0u, 0u, 0u, 0u};
+    const auto view = DecodeTextureResource(streamed);
+    Require(view.baseAddress == 0xa0c1880000ull && view.format == 173u && view.tileMode == TextureTileMode::kStandard4KB && view.width == 512u && view.height == 512u && view.baseLevel == 0u && view.lastLevel == 9u && view.mipCount == 10u && view.allocatedMipCount == 10u && view.minLod == 0u,
+        "a 128-bit BC3 T# (2048x2048, levels 2..11, words 4-7 zero) must read as the 512x512 chain of its 10 resident levels, got " + std::to_string(view.width) + "x" + std::to_string(view.height) + " levels " + std::to_string(view.baseLevel) + ".." + std::to_string(view.lastLevel) + " of " + std::to_string(view.mipCount));
+    auto chainWords = streamed;
+    chainWords[3] &= ~(0xfu << 12u);
+    chainWords[5] = 11u << 4u;
+    const auto full = DecodeTextureResource(chainWords);
+    Require(full.width == 2048u && full.mipCount == 12u, "the same surface with MAX_MIP 11 must be the 12-level 2048x2048 chain");
+    const auto chain = DescribeSurface(full);
+    const auto resident = DescribeSurface(view);
+    Require(chain.mips.size() == 12u && resident.mips.size() == 10u, "the chain and the resident levels must have 12 and 10 levels");
+    for (std::uint32_t level = 0; level < 10u; ++level) {
+        const auto& a = chain.mips[level + 2u];
+        const auto& b = resident.mips[level];
+        Require(a.tiledOffset == b.tiledOffset && a.tiledSize == b.tiledSize && a.width == b.width && a.height == b.height && a.blocksPerRow == b.blocksPerRow && a.tail == b.tail && a.tailX == b.tailX && a.tailY == b.tailY, "resident level " + std::to_string(level) + " must be level " + std::to_string(level + 2u) + " of the 12-level chain");
+    }
+    Require(resident.guestBytes <= chain.mips[1].tiledOffset && chain.mips[0].tiledOffset > chain.mips[1].tiledOffset, "the resident levels must end before the chain's levels 1 and 0, which come last in a GFX10 swizzled chain");
+    auto levelZero = streamed;
+    levelZero[3] &= ~(0xfu << 12u);
+    const auto single = DecodeTextureResource(levelZero);
+    Require(single.mipCount == 1u && single.lastLevel == 0u, "a T# with words 4-7 zero that starts at level 0 must stay one level");
+    auto tailed = streamed;
+    tailed[5] = 4u << 20u;
+    reject([&] { DecodeTextureResource(tailed); }, "would move the surface's own");
+
+    constexpr std::array<std::uint32_t, 8> tall{0xa0c1de00u, 0xcad00000u, 0x01ffc0ffu, 0x905b4facu, 0u, 0u, 0u, 0u};
+    const auto tallView = DecodeTextureResource(tall);
+    Require(tallView.width == 64u && tallView.height == 128u && tallView.lastLevel == 7u && tallView.mipCount == 8u, "a 128-bit 1024x2048 T# of levels 4..11 must read as its 64x128 chain of 8 levels");
+
+    Fields clamped;
+    clamped.base40 = 0x55ea000ull;
+    clamped.format = 20;
+    clamped.width = 1024;
+    clamped.height = 1024;
+    clamped.tileModeRaw = 0x1b;
+    clamped.baseLevel = 2;
+    clamped.lastLevel = 10;
+    clamped.minLod = 2u * 256u + 64u;
+    const auto clampedView = DecodeTextureResource(pack(clamped));
+    Require(clampedView.width == 256u && clampedView.mipCount == 9u && clampedView.minLod == 64u, "reading a 128-bit T# from its resident levels must move its MIN_LOD clamp with the base level");
+    clamped.minLod = 256u;
+    Require(DecodeTextureResource(pack(clamped)).minLod == 0u, "a MIN_LOD clamp below the base level must vanish when read from the resident levels");
+}
+
 void RunGuestTextureResourceTests() {
     Fields base;
     const auto baseWords = pack(base);
@@ -123,14 +169,44 @@ void RunGuestTextureResourceTests() {
     fmask.dstSelY = fmask.dstSelZ = fmask.dstSelW = 0u;
     const auto fmaskResource = DecodeTextureResource(pack(fmask));
     Require(fmaskResource.format == 20u && fmaskResource.dimension == TextureDimension::k2D && fmaskResource.tileMode == TextureTileMode::kZ64KBX, "uncompressed 32-bit FMASK did not use an integer Z surface");
+    auto compressedFmask = fmask;
+    compressedFmask.metaCompress = compressedFmask.metaPipeAligned = true;
+    compressedFmask.metaAddr = 0x123456789aull;
+    const auto compressedResource = DecodeTextureResource(pack(compressedFmask));
+    Require(compressedResource.fmaskCmaskAddress == compressedFmask.metaAddr << 8u && compressedResource.dccAddress == 0u && compressedResource.dccPipeAligned, "compressed FMASK CMASK was interpreted as color DCC");
+    compressedFmask.metaPipeAligned = false;
+    rejectFields(compressedFmask, "FMASK CMASK metadata must be pipe aligned");
+    compressedFmask.metaPipeAligned = compressedFmask.writeCompress = true;
+    rejectFields(compressedFmask, "FMASK CMASK compression is not implemented");
     Fields fmaskArray = fmask;
     fmaskArray.typeRaw = 13u;
     fmaskArray.depth = 2u;
     fmaskArray.baseArray = 1u;
     const auto fmaskArrayResource = DecodeTextureResource(pack(fmaskArray));
     Require(fmaskArrayResource.format == 20u && fmaskArrayResource.baseArray == 1u && fmaskArrayResource.depthOrLastArray == 2u, "FMASK normalization changed the array view");
-    for (std::uint32_t format = 156u; format <= 168u; ++format) {
-        if (format == 166u) continue;
+    constexpr std::array<std::pair<std::uint32_t, std::uint32_t>, 8> narrowFormats{{{156u, 5u}, {157u, 5u}, {158u, 5u}, {159u, 5u}, {160u, 5u}, {161u, 5u}, {163u, 11u}, {165u, 20u}}};
+    for (const auto& [format, surface] : narrowFormats) {
+        auto narrow = fmask;
+        narrow.format = format;
+        const auto narrowResource = DecodeTextureResource(pack(narrow));
+        Require(narrowResource.format == surface && narrowResource.tileMode == TextureTileMode::kZ64KBX, "FMASK " + std::to_string(format) + " did not use an integer Z surface of its storage width");
+        narrow.dstSelX = 4u;
+        narrow.dstSelY = 5u;
+        narrow.dstSelZ = 6u;
+        narrow.dstSelW = 7u;
+        Require(DecodeTextureResource(pack(narrow)).format == surface, "an expanded FMASK " + std::to_string(format) + " view with identity selectors was refused");
+        auto compressedNarrow = narrow;
+        compressedNarrow.metaCompress = compressedNarrow.metaPipeAligned = true;
+        compressedNarrow.metaAddr = 0x123456789aull;
+        rejectFields(compressedNarrow, "FMASK CMASK compression is implemented only for 8-sample, 8-fragment FMASK");
+    }
+    auto identityWord = fmask;
+    identityWord.dstSelX = 4u;
+    identityWord.dstSelY = 5u;
+    identityWord.dstSelZ = 6u;
+    identityWord.dstSelW = 7u;
+    rejectFields(identityWord, "FMASK destination channel selector is not implemented");
+    for (const auto format : {162u, 164u, 167u, 168u}) {
         auto unsupported = fmask;
         unsupported.format = format;
         rejectFields(unsupported, "FMASK format is not implemented");
@@ -620,6 +696,7 @@ void RunGuestTextureResourceTests() {
     pastUntailed.maxMip = 0;
     pastUntailed.baseLevel = 1;
     pastUntailed.lastLevel = 1;
+    pastUntailed.perfMod = 4;
     rejectFields(pastUntailed, "would move the surface's own");
     auto untailedChain = tailView;
     untailedChain.mipCount = 1;
@@ -627,6 +704,8 @@ void RunGuestTextureResourceTests() {
     untailedChain.mipCount = 2;
     Require(untailedAllocated == 0xff0000u && DescribeSurface(untailedChain).guestBytes == 0x1470000u, "a second level must grow a 1920x1080 64 bpp SW_64KB_R_X surface from addrlib's 0xff0000 to 0x1470000 bytes");
 
+    RunR128TextureTests();
+
     std::array<std::uint32_t, 4> shortWords{};
     reject([&] { DecodeTextureResource(shortWords); }, "8 dwords");
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp b/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp
index e6b6ff60c5..43c38ce262 100644
--- a/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/HostAllocator.cpp
@@ -5,6 +5,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <memory>
+#include <mutex>
 #include <sstream>
 #include <string>
 #include <thread>
@@ -112,6 +113,50 @@ std::size_t PrivateBytes() {
 #endif
 }
 
+void BlocksFlowToAnotherThread() {
+    constexpr int rounds = 12;
+    constexpr int perRound = 200000;
+    std::size_t afterEarlyRounds = 0;
+    for (int round = 0; round < rounds; ++round) {
+        std::mutex lock;
+        std::vector<unsigned char*> handed;
+        std::atomic<bool> done{false};
+        std::thread freer([&] {
+            std::vector<unsigned char*> taken;
+            for (;;) {
+                const bool finished = done.load(std::memory_order_acquire);
+                {
+                    std::lock_guard guard(lock);
+                    taken.swap(handed);
+                }
+                for (auto* block : taken) {
+                    const auto size = static_cast<std::size_t>(block[0]) * 4 + 1;
+                    Check(block[size - 1] == block[0], "a block freed on another thread keeps its bytes until then");
+                    ::operator delete(block);
+                }
+                taken.clear();
+                if (finished) break;
+                std::this_thread::yield();
+            }
+        });
+        for (int i = 0; i < perRound; ++i) {
+            const auto seed = static_cast<unsigned char>(i % 256);
+            const auto size = static_cast<std::size_t>(seed) * 4 + 1;
+            auto* block = static_cast<unsigned char*>(::operator new(size));
+            block[0] = seed;
+            block[size - 1] = seed;
+            std::lock_guard guard(lock);
+            handed.push_back(block);
+        }
+        done.store(true, std::memory_order_release);
+        freer.join();
+        if (round == 3) afterEarlyRounds = PrivateBytes();
+    }
+    const auto afterLastRound = PrivateBytes();
+    std::printf("private bytes after 4 and after %d rounds of blocks freed on another thread: %zu, %zu\n", rounds, afterEarlyRounds, afterLastRound);
+    Check(afterLastRound < afterEarlyRounds + (64u << 20), "blocks freed on another thread do not pile up");
+}
+
 void ThreadsEndWithCachedBlocks() {
     constexpr int waves = 24;
     std::size_t afterEarlyWaves = 0;
@@ -144,6 +189,7 @@ int main() {
     SizedDeletesKeepTheirClass();
     BlocksCrossIntoLibstdcxx();
     BlocksMoveBetweenThreads();
+    BlocksFlowToAnotherThread();
     ThreadsEndWithCachedBlocks();
     if (failures != 0) {
         std::fprintf(stderr, "%d host allocator checks failed\n", failures);
diff --git a/core/libs/prx/libSceAgcDriver/tests/LastRecordIndices.cpp b/core/libs/prx/libSceAgcDriver/tests/LastRecordIndices.cpp
new file mode 100644
index 0000000000..75b7a3ee21
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/LastRecordIndices.cpp
@@ -0,0 +1,64 @@
+#include "GraphicsTests.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include <array>
+#include <cstddef>
+#include <random>
+#include <string>
+#include <vector>
+
+namespace {
+
+using namespace AgcDriver::Graphics;
+
+std::vector<std::size_t> BackwardScan(const std::vector<const void*>& logged, const std::vector<const void*>& objects) {
+    std::vector<std::size_t> indices(objects.size(), logged.size());
+    for (std::size_t i = 0; i < objects.size(); ++i) {
+        for (auto at = logged.size(); at-- > 0;) {
+            if (logged[at] == objects[i]) {
+                indices[i] = at;
+                break;
+            }
+        }
+    }
+    return indices;
+}
+
+void CheckIndices(const std::vector<const void*>& logged, const std::vector<const void*>& objects, const std::string& what) {
+    std::vector<std::size_t> indices;
+    LastRecordIndices(logged, objects, indices);
+    Require(indices == BackwardScan(logged, objects), "last record indices, " + what + ": an object did not get the index of its last record");
+}
+
+}
+
+void RunLastRecordIndicesTests() {
+    std::array<int, 4096> pool{};
+    const auto object = [&pool](std::size_t index) -> const void* { return &pool[index]; };
+
+    CheckIndices({object(0), object(1), object(0), object(2)}, {object(0), object(1), object(2), object(3), object(0), nullptr}, "repeated records and objects");
+    CheckIndices({}, {object(0), nullptr}, "an empty log");
+    CheckIndices({object(0), nullptr, object(1)}, {}, "no objects");
+    CheckIndices({nullptr, object(0)}, {nullptr, object(0)}, "a null object");
+
+    std::vector<const void*> table;
+    for (std::size_t texture = 0; texture < 1500; ++texture) table.push_back(object(texture));
+    CheckIndices(table, table, "a table of 1500 textures over its own records in table order");
+    std::vector<const void*> repeated = table;
+    repeated.insert(repeated.end(), table.begin(), table.begin() + 548);
+    CheckIndices(repeated, table, "a table of 1500 textures whose first 548 were looked up twice");
+    std::vector<const void*> missing(table.begin() + 476, table.end());
+    CheckIndices(missing, table, "a table of 1500 textures over a log without its first 476 records");
+
+    std::mt19937 generator(0x5eed);
+    for (const std::size_t records : {std::size_t{1}, std::size_t{7}, std::size_t{64}, std::size_t{1023}, std::size_t{1024}, std::size_t{1500}, std::size_t{2048}}) {
+        for (const std::size_t textures : {std::size_t{1}, std::size_t{5}, std::size_t{300}, std::size_t{1500}}) {
+            for (const std::size_t distinct : {std::size_t{8}, pool.size()}) {
+                std::vector<const void*> logged(records);
+                for (auto& entry : logged) entry = object(generator() % distinct);
+                std::vector<const void*> objects(textures);
+                for (auto& entry : objects) entry = object(generator() % distinct);
+                CheckIndices(logged, objects, std::to_string(records) + " records, " + std::to_string(textures) + " objects of " + std::to_string(distinct));
+            }
+        }
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp
index d409fc1d07..55c6fc91b1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/LdsLockBudget.cpp
@@ -114,7 +114,7 @@ void verify(std::uint32_t waveSize, std::uint32_t limit, bool int64Atomics) {
     const bool native = int64Atomics && limit < 68u;
     require(widths.contains(64u) == native, native ? "device-memory LDS did not use a 64-bit compare exchange" : "a 64-bit compare exchange appeared without device-memory LDS and shaderBufferInt64Atomics");
     require(widths.contains(32u) != native, native ? "device-memory LDS with shaderBufferInt64Atomics kept the workgroup lock" : "the 64-bit LDS atomic lost its workgroup lock");
-    require(result.bdaAbiVersion == (limit < 68u ? 1u : 0u), "the fault buffer for a misaligned 64-bit LDS atomic does not follow device-memory LDS at limit " + std::to_string(limit));
+    require(result.bdaAbiVersion == 1u, "a 64-bit LDS atomic did not get the fault buffer for a misaligned address at limit " + std::to_string(limit));
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/Locks.cpp b/core/libs/prx/libSceAgcDriver/tests/Locks.cpp
new file mode 100644
index 0000000000..6c660949ac
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/Locks.cpp
@@ -0,0 +1,221 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/DeviceAccess.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Mutex.hpp"
+#include "prx/libc/include/HostThreadSlot.hpp"
+#ifdef _WIN32
+#include <windows.h>
+#endif
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <mutex>
+#include <shared_mutex>
+#include <thread>
+#include <vector>
+
+namespace {
+
+int failures = 0;
+
+void Check(bool condition, const char* what) {
+    if (condition) return;
+    std::fprintf(stderr, "FAIL: %s\n", what);
+    ++failures;
+}
+
+void MutexCounts(int threads, int iterations, int holdSpins) {
+    AgcDriver::Mutex mutex;
+    std::uint64_t counter = 0;
+    std::vector<std::thread> workers;
+    for (int t = 0; t < threads; ++t) {
+        workers.emplace_back([&] {
+            for (int i = 0; i < iterations; ++i) {
+                std::lock_guard lock(mutex);
+                const auto seen = counter;
+                for (volatile int spin = 0; spin < holdSpins; spin = spin + 1) {
+                }
+                counter = seen + 1;
+            }
+        });
+    }
+    for (auto& worker : workers) worker.join();
+    Check(counter == static_cast<std::uint64_t>(threads) * static_cast<std::uint64_t>(iterations), "every increment under the mutex counted");
+}
+
+void MutexTryLock() {
+    AgcDriver::Mutex mutex;
+    Check(mutex.try_lock(), "try_lock takes a free mutex");
+    bool taken = true;
+    std::thread other([&] { taken = mutex.try_lock(); });
+    other.join();
+    Check(!taken, "try_lock fails while another thread holds the mutex");
+    mutex.unlock();
+    std::thread again([&] {
+        taken = mutex.try_lock();
+        if (taken) mutex.unlock();
+    });
+    again.join();
+    Check(taken, "try_lock takes the mutex once released");
+}
+
+void MutexWakesSleeper() {
+    AgcDriver::Mutex mutex;
+    mutex.lock();
+    std::atomic<bool> acquired{false};
+    std::thread waiter([&] {
+        std::lock_guard lock(mutex);
+        acquired = true;
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(50));
+    Check(!acquired, "lock() waits while the mutex is held");
+    mutex.unlock();
+    waiter.join();
+    Check(acquired, "the waiting thread took the mutex after the release");
+}
+
+void DeviceGate() {
+    AgcDriver::DriverDetail::DeviceUseGate gate;
+    std::atomic<int> users{0};
+    std::atomic<int> replacements{0};
+    std::atomic<bool> overlap{false};
+    std::atomic<bool> stop{false};
+    std::atomic<std::uint64_t> uses{0};
+    std::vector<std::thread> threads;
+    for (int t = 0; t < 6; ++t) {
+        threads.emplace_back([&] {
+            while (!stop.load(std::memory_order_relaxed)) {
+                std::shared_lock use(gate);
+                users.fetch_add(1);
+                if (replacements.load() != 0) overlap = true;
+                users.fetch_sub(1);
+                uses.fetch_add(1, std::memory_order_relaxed);
+            }
+        });
+    }
+    for (int r = 0; r < 2; ++r) {
+        threads.emplace_back([&] {
+            for (int i = 0; i < 300; ++i) {
+                std::unique_lock replacing(gate);
+                if (replacements.fetch_add(1) != 0 || users.load() != 0) overlap = true;
+                std::this_thread::yield();
+                if (users.load() != 0) overlap = true;
+                replacements.fetch_sub(1);
+            }
+        });
+    }
+    threads[6].join();
+    threads[7].join();
+    stop = true;
+    for (int t = 0; t < 6; ++t) threads[static_cast<std::size_t>(t)].join();
+    Check(!overlap, "no user inside the gate during a replacement, one replacement at a time");
+    Check(uses.load() != 0, "users got through between replacements");
+}
+
+void GpuMutexRecursion() {
+    auto& mutex = AgcDriver::GuestMemory::GpuMutex();
+    Check(!mutex.HeldByThisThread(), "the GPU mutex starts free");
+    mutex.lock();
+    mutex.lock();
+    Check(mutex.HeldByThisThread() && mutex.DepthOnThisThread() == 2, "a nested lock counts the depth");
+    bool taken = true;
+    std::thread other([&] {
+        taken = mutex.try_lock();
+        if (taken) mutex.unlock();
+    });
+    other.join();
+    Check(!taken, "another thread cannot take the held GPU mutex");
+    Check(mutex.try_lock() && mutex.DepthOnThisThread() == 3, "the holder's try_lock nests");
+    mutex.unlock();
+    mutex.unlock();
+    other = std::thread([&] {
+        taken = mutex.try_lock();
+        if (taken) mutex.unlock();
+    });
+    other.join();
+    Check(!taken, "the GPU mutex stays held until the outermost unlock");
+    mutex.unlock();
+    Check(!mutex.HeldByThisThread() && mutex.DepthOnThisThread() == 0, "the outermost unlock releases the GPU mutex");
+    std::uint64_t counter = 0;
+    std::vector<std::thread> workers;
+    for (int t = 0; t < 4; ++t) {
+        workers.emplace_back([&] {
+            for (int i = 0; i < 20000; ++i) {
+                std::lock_guard outer(mutex);
+                std::lock_guard inner(mutex);
+                ++counter;
+            }
+        });
+    }
+    for (auto& worker : workers) worker.join();
+    Check(counter == 80000, "every nested increment under the GPU mutex counted");
+}
+
+template<typename TTag>
+void SlotIsolation(const char* what) {
+    using Slot = HostThreadSlot<std::uint64_t, TTag>;
+    bool ok = Slot::Get() == 0;
+    Slot::Set(0x1234567890abcdefull);
+    std::uint64_t seen = 1;
+    std::thread other([&] {
+        seen = Slot::Get();
+        Slot::Set(99);
+    });
+    other.join();
+    ok = ok && seen == 0 && Slot::Get() == 0x1234567890abcdefull;
+    Slot::Set(0);
+    Check(ok, what);
+}
+
+struct DirectSlot {};
+struct ExpansionSlot {};
+struct PointerSlot {};
+
+void ThreadSlots() {
+    SlotIsolation<DirectSlot>("a thread slot starts at zero on every thread and keeps its own value");
+    int object = 0;
+    HostThreadSlot<int*, PointerSlot>::Set(&object);
+    Check(HostThreadSlot<int*, PointerSlot>::Get() == &object, "a pointer round-trips through a thread slot");
+#ifdef _WIN32
+    std::vector<DWORD> held;
+    for (DWORD index = TlsAlloc(); index != TLS_OUT_OF_INDEXES; index = TlsAlloc()) {
+        held.push_back(index);
+        if (index >= 64) break;
+    }
+    SlotIsolation<ExpansionSlot>("an expansion thread slot starts at zero on every thread and keeps its own value");
+    for (const auto index : held) TlsFree(index);
+#endif
+    AgcDriver::GuestMemory::PacketTag fresh{};
+    AgcDriver::GuestMemory::ReadSite freshSite = AgcDriver::GuestMemory::ReadSite::Count;
+    std::thread other([&] {
+        fresh = AgcDriver::GuestMemory::CurrentPacket();
+        freshSite = AgcDriver::GuestMemory::CurrentReadSite();
+    });
+    other.join();
+    Check(fresh.opcode == AgcDriver::GuestMemory::NoPacket && fresh.queue == 0xffffffffu, "a thread that ran no packet reads NoPacket");
+    Check(freshSite == AgcDriver::GuestMemory::ReadSite::Unknown, "a thread that named no read site reads Unknown");
+    AgcDriver::GuestMemory::SetCurrentPacket(0xffffu, 0x2au);
+    const auto packet = AgcDriver::GuestMemory::CurrentPacket();
+    Check(packet.opcode == 0xffffu && packet.queue == 0x2au, "the packet tag reads back what was set");
+    const auto previous = AgcDriver::GuestMemory::SetReadSite(AgcDriver::GuestMemory::ReadSite::Scanout);
+    Check(previous == AgcDriver::GuestMemory::ReadSite::Unknown && AgcDriver::GuestMemory::CurrentReadSite() == AgcDriver::GuestMemory::ReadSite::Scanout, "SetReadSite returns the previous site and sets the new one");
+    AgcDriver::GuestMemory::SetReadSite(previous);
+}
+
+}
+
+int main() {
+    MutexCounts(8, 100000, 0);
+    MutexCounts(4, 2000, 20000);
+    MutexTryLock();
+    MutexWakesSleeper();
+    DeviceGate();
+    GpuMutexRecursion();
+    ThreadSlots();
+    if (failures != 0) {
+        std::fprintf(stderr, "%d lock check(s) failed\n", failures);
+        return 1;
+    }
+    std::printf("lock tests passed\n");
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp b/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp
index ff2a3e40a7..a77f88d58f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/MaskedSelect.cpp
@@ -1066,6 +1066,38 @@ int main() {
         return StencilReplaySafe(b.program);
     });
 
+    passed &= run("read-only BDA reads can be replayed and BDA writes cannot", [] {
+        Builder b;
+        b.program.Info().usesDma = true;
+        if (!StencilReplaySafe(b.program)) return false;
+        b.program.Info().bdaWrites = true;
+        return !StencilReplaySafe(b.program);
+    });
+
+    const auto execCopy = [](Builder& b, IrValue& low, IrValue& high) -> IrValue& {
+        auto& active = b.emit(IrOpcode::Ballot, IrType::U32x4, {&b.truth()});
+        auto& lanes = b.emit(IrOpcode::CompositeConstructU64, IrType::U64, {&b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&active, &b.constant(0u)}), &b.emit(IrOpcode::CompositeExtractU32x4, IrType::U32, {&active, &b.constant(1u)})});
+        auto& wqm = b.emit(IrOpcode::WqmU64, IrType::U64, {&lanes});
+        return b.threadBit(b.wordAnd(low, b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(0u)})), b.wordAnd(high, b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(1u)})));
+    };
+
+    passed &= run("an exec copy masked by the whole-quad active lanes is a stable export guard", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        const auto [low, high] = b.ballotWords(pixelPredicate(b));
+        exportUnder(b, execCopy(b, *low, *high), true, true);
+        return StencilReplaySafe(b.program);
+    });
+
+    passed &= run("an exec copy does not hide helper participation in a whole-quad expansion", [&] {
+        Builder b;
+        b.program.Resources().stage = IrShaderStage::Pixel;
+        const auto [low, high] = b.ballotWords(helperPredicate(b, true));
+        auto& wqm = b.emit(IrOpcode::WqmU64, IrType::U64, {&b.emit(IrOpcode::CompositeConstructU64, IrType::U64, {low, high})});
+        stencilByMask(b, execCopy(b, b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(0u)}), b.emit(IrOpcode::CompositeExtractU64, IrType::U32, {&wqm, &b.constant(1u)})));
+        return !StencilReplaySafe(b.program);
+    });
+
     passed &= run("only guarded read-only SRT diagnostics can be replayed", [] {
         Builder b;
         b.program.Info().usesFaultBuffer = true;
diff --git a/core/libs/prx/libSceAgcDriver/tests/Mesh.cpp b/core/libs/prx/libSceAgcDriver/tests/Mesh.cpp
index a3c2a13217..ce6f2d65f3 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Mesh.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Mesh.cpp
@@ -5,6 +5,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include <algorithm>
 #include <array>
+#include <bit>
 #include <cmath>
 #include <cstdio>
 #include <cstdlib>
@@ -144,6 +145,7 @@ struct MeshDraw {
     VkCullModeFlags cull = VK_CULL_MODE_NONE;
     std::span<const std::uint32_t> code = {};
     std::uint32_t stagesRegister = 0x20u;
+    ShaderRecompiler::ShaderVertexStageInfo vertex{};
 };
 
 bool ReadsNumWorkgroups(std::span<const std::uint32_t> words) {
@@ -176,7 +178,7 @@ void DrawMesh(AgcDriver::VulkanDevice& device, const MeshDraw& setup) {
     const std::array<ShaderRecompiler::MemoryRegion, 1> geometryMemory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(std::span(code))}}};
     ShaderRecompiler::RecompileRequest geometry{
         {ShaderStage::Mesh, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
-        {setup.waveSize, 0, userData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, geometryMemory},
+        {setup.waveSize, 0, userData, std::nullopt, std::nullopt, setup.vertex, geometryMemory},
         target,
         {0, 0, 0, setup.geometryPushBytes},
         ShaderRecompiler::GraphicsCompileContext{0, {}, setup.mesh, std::nullopt, {setup.draw.indexAddress, setup.draw.indexCount, setup.draw.indexSize, setup.draw.instanceCount}}
@@ -207,6 +209,10 @@ void DrawMesh(AgcDriver::VulkanDevice& device, const MeshDraw& setup) {
 
     AgcDriver::Graphics::State state{};
     state.stages = {AgcDriver::Graphics::ShaderPath::Geometry, setup.stagesRegister, setup.waveSize, 64, setup.mesh, std::nullopt};
+    state.pointSize = setup.vertex.pointSize;
+    state.pointSizeMin = setup.vertex.pointSizeMin;
+    state.pointSizeMax = setup.vertex.pointSizeMax;
+    state.paClVsOutCntl = setup.vertex.paClVsOutCntl;
     state.color = {reinterpret_cast<std::uintptr_t>(Pixels.data()), {Width, Height}, VK_FORMAT_R8G8B8A8_UNORM, Pixels.size(), 0xe4u};
     state.colors = {state.color};
     state.hasColorTarget = true;
@@ -394,6 +400,63 @@ int main() {
             }
         }
 
+        ClearPixels();
+        auto pointSubgroup = SmallSubgroup;
+        pointSubgroup.outputPrimitiveSize = 1u;
+        for (const auto pointWave : {32u, 64u}) {
+            ClearPixels();
+            DrawMesh(device, {pointSubgroup, {0, static_cast<std::uint32_t>(Ordered.size()), 0, 1, 0, false}, VertexBufferDescriptor(Ordered.data(), static_cast<std::uint32_t>(Ordered.size())), ShaderRecompiler::MeshDrawPushOffsetBytes, false, pointWave});
+            for (std::uint32_t triangle = 0; triangle < Triangles; ++triangle) {
+                const auto& position = Ordered[3u * triangle].position;
+                const auto x = static_cast<std::uint32_t>((position[0] + 1.0f) * 0.5f * Width);
+                const auto y = static_cast<std::uint32_t>((1.0f - position[1]) * 0.5f * Height);
+                const auto offset = (static_cast<std::size_t>(y) * Width + x) * 4u;
+                Require(PixelIs(offset, TriangleColor(triangle)), "mesh point missing at first exported index for primitive " + std::to_string(triangle));
+                Require(PixelIs(CellPixel(triangle), Background), "mesh point output filled the interior of its packed triangle");
+            }
+        }
+
+        for (const auto pointWave : {32u, 64u}) {
+            for (const auto size : {3.0f, 4.0f}) {
+                ClearPixels();
+                MeshDraw points{pointSubgroup, {0, static_cast<std::uint32_t>(Ordered.size()), 0, 1, 0, false}, VertexBufferDescriptor(Ordered.data(), static_cast<std::uint32_t>(Ordered.size()))};
+                points.waveSize = pointWave;
+                points.vertex.pointSize = size;
+                DrawMesh(device, points);
+                for (std::uint32_t primitive = 0; primitive < Triangles; ++primitive) {
+                    std::uint32_t covered = 0;
+                    for (std::size_t pixel = 0; pixel < Pixels.size(); pixel += 4u) covered += PixelIs(pixel, TriangleColor(primitive));
+                    Require(covered == static_cast<std::uint32_t>(size * size), "mesh point did not cover its register-sized square");
+                }
+            }
+            for (const auto exportedSize : {6.0f, -3.0f}) {
+                ClearPixels();
+                const auto& baseCode = pointWave == 32u ? Wave32GeometryCode : GeometryCode;
+                std::array<std::uint32_t, GeometryCode.size() + 4u> sizedCode{};
+                std::copy_n(baseCode.begin(), 101u, sizedCode.begin());
+                sizedCode[92] = 0xbf88000eu;
+                sizedCode[99] = 0xf80000cfu;
+                sizedCode[101] = 0x7e6802ffu;
+                sizedCode[102] = std::bit_cast<std::uint32_t>(exportedSize);
+                sizedCode[103] = 0xf80008d1u;
+                sizedCode[104] = 0x00000034u;
+                std::copy(baseCode.begin() + 101u, baseCode.end(), sizedCode.begin() + 105u);
+                MeshDraw exported{pointSubgroup, {0, static_cast<std::uint32_t>(Ordered.size()), 0, 1, 0, false}, VertexBufferDescriptor(Ordered.data(), static_cast<std::uint32_t>(Ordered.size()))};
+                exported.waveSize = pointWave;
+                exported.code = sizedCode;
+                exported.vertex.paClVsOutCntl = (1u << 16u) | (1u << 21u);
+                exported.vertex.pointSizeMin = 3.0f;
+                exported.vertex.pointSizeMax = 4.0f;
+                DrawMesh(device, exported);
+                for (std::uint32_t primitive = 0; primitive < Triangles; ++primitive) {
+                    std::uint32_t covered = 0;
+                    for (std::size_t pixel = 0; pixel < Pixels.size(); pixel += 4u) covered += PixelIs(pixel, TriangleColor(primitive));
+                    const auto side = exportedSize < 3.0f ? 3u : 4u;
+                    Require(covered == side * side, "mesh point ignored its exported size or clamp");
+                }
+            }
+        }
+
         ClearPixels();
         auto lineSubgroup = FastLaunchSubgroup;
         lineSubgroup.maxPrimitives = 2u;
diff --git a/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp b/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp
new file mode 100644
index 0000000000..d3e4092bd2
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/NopDataWritePacket.cpp
@@ -0,0 +1,37 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+int main() {
+    std::array<std::byte, 24> storage;
+    storage.fill(std::byte{0xaa});
+    const std::array<std::byte, 5> data{std::byte{0x11}, std::byte{0x22}, std::byte{0x33}, std::byte{0x44}, std::byte{0x55}};
+    const auto words = sceAgcDriverNopDataWritePacket(storage.data() + 4, 0x12345678, data.data(), static_cast<std::uint32_t>(data.size()));
+    std::uint32_t header = 0;
+    std::uint32_t address = 0;
+    std::memcpy(&header, storage.data() + 4, sizeof(header));
+    std::memcpy(&address, storage.data() + 8, sizeof(address));
+    if (words != 4 || header != 0xc0021000U || address != 0x12345678U) return 1;
+    if (!std::equal(data.begin(), data.end(), storage.begin() + 12)) return 2;
+    if (storage[17] != std::byte{0} || storage[18] != std::byte{0} || storage[19] != std::byte{0}) return 3;
+    if (storage[3] != std::byte{0xaa} || storage[20] != std::byte{0xaa}) return 4;
+
+    storage.fill(std::byte{0xaa});
+    const auto emptyWords = sceAgcDriverNopDataWritePacket(storage.data() + 4, 0x87654321, nullptr, 5);
+    std::memcpy(&header, storage.data() + 4, sizeof(header));
+    std::memcpy(&address, storage.data() + 8, sizeof(address));
+    if (emptyWords != 2 || header != 0xc0021000U || address != 0x87654321U) return 5;
+    if (storage[12] != std::byte{0} || storage[19] != std::byte{0} || storage[20] != std::byte{0xaa}) return 6;
+
+    storage.fill(std::byte{0xaa});
+    const auto zeroBytesWords = sceAgcDriverNopDataWritePacket(storage.data() + 4, 0x01020304, data.data(), 0);
+    std::memcpy(&header, storage.data() + 4, sizeof(header));
+    std::memcpy(&address, storage.data() + 8, sizeof(address));
+    if (zeroBytesWords != 2 || header != 0xc0001000U || address != 0x01020304U) return 7;
+    if (storage[12] != std::byte{0xaa}) return 8;
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/PageStates.cpp b/core/libs/prx/libSceAgcDriver/tests/PageStates.cpp
new file mode 100644
index 0000000000..fb92db485c
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/PageStates.cpp
@@ -0,0 +1,145 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdio>
+#include <cstring>
+#include <stdexcept>
+#include <string_view>
+#include <thread>
+#include <vector>
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#include <psapi.h>
+
+namespace {
+using namespace AgcDriver::GuestMemory;
+constexpr std::size_t Unit = 65536;
+constexpr std::size_t ChunkGuestBytes = 256ull << 20u;
+
+void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+class Range {
+public:
+    explicit Range(std::size_t bytes) : bytes(bytes) {
+        data = static_cast<std::byte*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, ChunkGuestBytes));
+        Require(data != nullptr, "cannot reserve page-state fixture");
+    }
+
+    ~Range() {
+        {
+            GuestAllocations::Mutation mutation;
+            for (const auto offset : committed) mutation.Remove(data + offset);
+        }
+        GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+        GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+    }
+
+    std::byte* Commit(std::size_t offset) {
+        auto* at = data + offset;
+        GuestArena::GuestArenaCommit_nid_postfix(at, Unit, PAGE_READWRITE, Unit);
+        std::memset(at, 0x5b, Unit);
+        GuestAllocations::Mutation mutation;
+        mutation.Add(at, Unit, true, true, true);
+        committed.push_back(offset);
+        return at;
+    }
+
+    std::byte* Data() const { return data; }
+
+private:
+    std::byte* data = nullptr;
+    std::size_t bytes;
+    std::vector<std::size_t> committed;
+};
+
+std::size_t PrivateBytes() {
+    PROCESS_MEMORY_COUNTERS_EX counters{};
+    Require(K32GetProcessMemoryInfo(GetCurrentProcess(), reinterpret_cast<PROCESS_MEMORY_COUNTERS*>(&counters), sizeof(counters)), "cannot query page-state fixture private commit");
+    return counters.PrivateUsage;
+}
+
+void CheckMetadata() {
+    Range range(3 * ChunkGuestBytes);
+    auto* data = range.Commit(0);
+    const auto before = PrivateBytes();
+    Require(Accessible(data, Unit, true), "committed fixture is inaccessible");
+    const auto after = PrivateBytes();
+    const auto added = after > before ? after - before : 0;
+    std::printf("page-permission initialization: %zu bytes of private commit\n", added);
+    Require(added < (16ull << 20u), "page permissions committed a dense arena table");
+    const auto queried = PrivateBytes();
+    Require(!Accessible(range.Data() + 2 * ChunkGuestBytes, Unit), "reserved fixture tail is accessible");
+    Require(PrivateBytes() < queried + (4ull << 20u), "querying reserved pages allocated untouched metadata chunks");
+}
+
+void CheckBoundaries() {
+    constexpr auto span = 3 * ChunkGuestBytes;
+    Range range(span);
+    const std::array<std::size_t, 4> offsets{0, ChunkGuestBytes - Unit, ChunkGuestBytes, 2 * ChunkGuestBytes + Unit};
+    for (const auto offset : offsets) range.Commit(offset);
+    auto* block = range.Data();
+    std::atomic<bool> begin{false};
+    std::atomic<unsigned> errors{0};
+    std::vector<std::thread> readers;
+    for (unsigned reader = 0; reader < 8; ++reader) {
+        readers.emplace_back([&] {
+            while (!begin.load(std::memory_order_acquire)) std::this_thread::yield();
+            for (unsigned round = 0; round < 500; ++round) {
+                if (!Accessible(block + offsets.back(), Unit, true)) errors.fetch_add(1, std::memory_order_relaxed);
+            }
+        });
+    }
+    begin.store(true, std::memory_order_release);
+    for (auto& reader : readers) reader.join();
+    Require(errors.load() == 0, "concurrent page-state publication changed access");
+    for (const auto offset : offsets) {
+        std::array<std::byte, 16> copy{};
+        Read(reinterpret_cast<std::uint64_t>(block + offset), copy);
+        Require(std::all_of(copy.begin(), copy.end(), [](std::byte value) { return value == std::byte{0x5b}; }), "page cache changed guest bytes");
+    }
+    Require(Accessible(block + ChunkGuestBytes - Unit, 2 * Unit, true), "adjacent chunks lost their boundary pages");
+    const auto described = DescribeCommitted(reinterpret_cast<std::uint64_t>(block), span, true);
+    std::uint64_t total = 0;
+    for (const auto& [first, last] : described.ranges) total += last - first;
+    Require(!described.whole && total == offsets.size() * Unit, "reserved holes were reported committed");
+    auto* changed = block + offsets[1];
+    const auto protect = [&](bool writable) {
+        GuestAllocations::Mutation mutation;
+        mutation.Protect(changed, Unit, true, writable, true, [&] {
+            const DWORD protection = writable ? PAGE_READWRITE : PAGE_READONLY;
+            DWORD previous = 0;
+            Require(VirtualProtect(changed, Unit, protection, &previous) != 0, "cannot protect page-state fixture");
+            GuestArena::GuestArenaSetProtection_nid_postfix(reinterpret_cast<std::uintptr_t>(changed), Unit, protection);
+        });
+    };
+    protect(false);
+    Require(Accessible(changed, Unit) && !Accessible(changed, Unit, true), "protection invalidation retained writable state");
+    protect(true);
+    Require(Accessible(changed, Unit, true), "restored writable state was not discovered");
+    GuestArena::GuestArenaReset_nid_postfix(block, Unit);
+    GuestAllocations::GuestAllocationsInvalidate_nid_postfix(reinterpret_cast<std::uintptr_t>(block), Unit);
+    Require(!Accessible(block, Unit), "decommitted pages remained readable");
+    GuestArena::GuestArenaCommit_nid_postfix(block, Unit, PAGE_READWRITE, Unit);
+    Require(Accessible(block, Unit, true), "access observer did not invalidate inaccessible state after commit");
+    std::puts("page-state boundaries, publication, holes and invalidation passed");
+}
+}
+
+int main(int argc, char** argv) {
+    try {
+        Require(GuestArena::GuestArenaAvailable_nid_postfix(), "page-state fixture needs the guest arena");
+        if (argc == 2 && std::string_view(argv[1]) == "--metadata") CheckMetadata();
+        else CheckBoundaries();
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp b/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp
index b5db144ac8..2c138fecf3 100644
--- a/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/PerformanceOverlay.cpp
@@ -105,6 +105,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -116,6 +118,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
diff --git a/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp b/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp
index fd239f7c00..a95329f86d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Pm4.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -40,8 +41,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceKernelAvailableFlexibleMemorySize(size_t* size);
-
 namespace {
 
 void check(bool condition, const char* reason) {
@@ -192,9 +191,9 @@ void testContextAndBases() {
     check(state.context.contains(0x280) && state.context.at(0x280) == 0x00080008u && state.context.contains(0x281) && state.context.at(0x281) == 0xffff0000u, "initial point context differs from the SDK defaults");
     execute(state, makePacket(0x69, {0x280, 0x00180018u, 0x00400008u}));
     check(state.context.at(0x280) == 0x00180018u && state.context.at(0x281) == 0x00400008u, "explicit point size and limits were not stored");
-    for (const auto offset : {0x10bu, 0x10cu, 0x10du}) execute(state, makePacket(0x69, {offset, 0xffffffffu}));
+    for (const auto offset : {0x010u, 0x011u, 0x10bu, 0x10cu, 0x10du}) execute(state, makePacket(0x69, {offset, 0xffffffffu}));
     execute(state, makePacket(0x12, {0}));
-    for (const auto offset : {0x10bu, 0x10cu, 0x10du}) check(state.context.at(offset) == 0, "CLEAR_STATE did not restore stencil defaults");
+    for (const auto offset : {0x010u, 0x011u, 0x10bu, 0x10cu, 0x10du}) check(state.context.at(offset) == 0, "CLEAR_STATE did not restore depth and stencil defaults");
     check(state.context.at(0x280) == 0x00080008u && state.context.at(0x281) == 0xffff0000u, "CLEAR_STATE did not restore point size and limits");
     execute(state, makePacket(0x69, {0x10, 17}));
     execute(state, makePacket(0x76, {0x20c, 2}));
@@ -322,6 +321,45 @@ void testIndexedDraw() {
     expectFailure([&] { AgcDriver::Pm4::ResolveDraw(packet, state); }, "guest");
 }
 
+void testIndirectDrawRange() {
+    AgcDriver::QueueState state;
+    alignas(4) std::array<std::uint32_t, 1> indices{};
+    state.indexBase = reinterpret_cast<std::uintptr_t>(indices.data());
+    state.indexBufferSize = 1;
+    state.indexType = 1;
+    state.userConfig[0x24a] = 0;
+    for (const auto opcode : {0x24u, 0x25u, 0x2cu, 0x38u}) {
+        const bool indexed = opcode == 0x25 || opcode == 0x38;
+        const bool multi = opcode == 0x2c || opcode == 0x38;
+        const std::uint32_t recordBytes = indexed ? 20u : 16u;
+        const std::uint32_t initiator = indexed ? 0u : 2u;
+        state.drawIndirectBase = std::numeric_limits<std::uint64_t>::max() - 3;
+        const auto wrapping = multi ? makePacket(opcode, {0, 0x280, 0x280, 0x280, 1, 0, 0, recordBytes, initiator})
+                                    : makePacket(opcode, {0, 0x280, 0x280, initiator});
+        expectFailure([&] { AgcDriver::Pm4::ResolveDraw(wrapping, state); }, "record range overflow");
+        for (const auto count : {1u, 3u, std::numeric_limits<std::uint32_t>::max()}) {
+            if (!multi && count != 1) continue;
+            for (const auto stride : {recordBytes, 64u, 0xfffffffcu}) {
+                if (!multi && stride != recordBytes) continue;
+                const auto packet = multi ? makePacket(opcode, {0, 0x280, 0x280, 0x280, count, 0, 0, stride, initiator})
+                                          : makePacket(opcode, {0, 0x280, 0x280, initiator});
+                const auto bytes = static_cast<std::uint64_t>(count - 1) * stride + recordBytes;
+                state.drawIndirectBase = (std::numeric_limits<std::uint64_t>::max() - bytes) & ~std::uint64_t{3};
+                const auto draw = AgcDriver::Pm4::ResolveDraw(packet, state);
+                check(draw.indirect.has_value() && draw.indirect->RangeBytes() == bytes, "indirect draw rejected or changed a fitting record range");
+                state.drawIndirectBase += 4;
+                expectFailure([&] { AgcDriver::Pm4::ResolveDraw(packet, state); }, "record range overflow");
+            }
+        }
+        state.drawIndirectBase = std::numeric_limits<std::uint64_t>::max() - 3;
+        if (multi) {
+            const auto empty = makePacket(opcode, {0, 0x280, 0x280, 0x280, 0, 0, 0, recordBytes, initiator});
+            const auto draw = AgcDriver::Pm4::ResolveDraw(empty, state);
+            check(draw.indirect.has_value() && draw.indirect->RangeBytes() == 0, "empty indirect draw consumed a record");
+        }
+    }
+}
+
 void testIndirectDraw() {
     check(AgcDriver::Pm4::AccessesMemory(0xc0032400u) && AgcDriver::Pm4::AccessesMemory(0xc0083800u), "indirect draws must synchronize guest memory");
     check(AgcDriver::Pm4::UnsupportedReason(0xc0032400u).empty() && AgcDriver::Pm4::UnsupportedReason(0xc0082c00u).empty(), "indirect draws are rejected");
@@ -363,8 +401,17 @@ void testIndirectDraw() {
     alignas(4) std::array<std::uint16_t, 8> indices{};
     state.indexBase = reinterpret_cast<std::uintptr_t>(indices.data());
     state.indexType = 0;
+    state.indexBufferSize.reset();
+    const auto unlimited = AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state);
+    check(unlimited.indexed && unlimited.indirect && !unlimited.indirect->indexLimitKnown && unlimited.indexCount == 0 && unlimited.indexAddress == state.indexBase && unlimited.indexSize == 2 && unlimited.indirect->recordBytes == 20, "an indexed indirect draw without INDEX_BUFFER_SIZE did not resolve with an unknown limit");
+    const auto unlimitedMulti = AgcDriver::Pm4::ResolveDraw(makePacket(0x38, {0, 0x8c, 0x280, 0x280, 3, 0, 0, 20, 0}), state);
+    check(unlimitedMulti.indirect && !unlimitedMulti.indirect->indexLimitKnown && unlimitedMulti.indirect->count == 3 && unlimitedMulti.indirect->stride == 20, "a multi indexed indirect draw without INDEX_BUFFER_SIZE did not resolve with an unknown limit");
+    execute(state, makePacket(0x13, {0}));
+    check(state.indexBufferSize.has_value() && *state.indexBufferSize == 0, "INDEX_BUFFER_SIZE of zero was not recorded as written");
     expectFailure([&] { AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state); }, "INDEX_BUFFER_SIZE");
+    expectFailure([&] { AgcDriver::Pm4::ResolveDraw(makePacket(0x38, {0, 0x8c, 0x280, 0x280, 3, 0, 0, 20, 0}), state); }, "INDEX_BUFFER_SIZE");
     state.indexBufferSize = 8;
+    check(AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state).indirect->indexLimitKnown, "a written INDEX_BUFFER_SIZE resolved with an unknown limit");
     const auto indexed = AgcDriver::Pm4::ResolveDraw(makePacket(0x25, {0, 0x8c, 0x280, 0}), state);
     check(indexed.indexed && indexed.indexAddress == state.indexBase && indexed.indexCount == 8 && indexed.indexSize == 2 && indexed.indirect->recordBytes == 20 && indexed.indirect->stride == 20 && indexed.firstVertex == 0 && indexed.indirect->indxOffset == 0, "indexed indirect draw mismatch");
     check(indexed.indirect->VertexDwordOffset() == 12 && indexed.indirect->InstanceDwordOffset() == 16, "indexed record geometry mismatch");
@@ -1021,8 +1068,9 @@ void testInvalidRegisterListEntries() {
     check(!AgcDriver::Pm4::IndirectRegistersValid(std::array<std::uint32_t, 2>{0xffffffffu, 0}), "the sentinel was taken as a register offset");
     check(AgcDriver::Pm4::IndirectRegistersValid(std::array<std::uint32_t, 4>{0x10, 1, 0x70000011u, 2}), "a valid register list was rejected");
     AgcDriver::QueueState state;
+    const auto initial = state.context;
     expectFailure([&] { AgcDriver::Pm4::ExecuteIndirectRegisters(packet, pairs, state); }, "extended register");
-    check(!state.context.contains(0x10) && !state.context.contains(0x11), "a rejected register list partially changed state");
+    check(state.context == initial, "a rejected register list partially changed state");
     AgcDriver::Pm4::ExecuteIndirectRegisters(packet, pairs, state, true);
     check(state.context.at(0x10) == 41 && state.context.at(0x11) == 42 && !state.context.contains(0x38f), "skipping an invalid entry lost the valid ones or wrote the invalid one");
 }
@@ -1088,6 +1136,63 @@ void testReleaseMemDataSelects() {
     for (const auto select : {6u, 7u}) expectFailure([&] { AgcDriver::Pm4::Validate(release(select), 0); }, "reserved RELEASE_MEM DATA_SEL");
 }
 
+void testMemSemaphore() {
+    alignas(8) static std::uint64_t semaphore = 0;
+    alignas(8) static std::uint32_t marker = 0;
+    const auto packet = [](std::uint32_t control) { return makePacket(0x39, {low(&semaphore), high(&semaphore), control}); };
+    check(AgcDriver::Pm4::AccessesMemory(packet(0xc0100000u)[0]), "MEM_SEMAPHORE must synchronize guest memory");
+    for (const auto queue : {0u, 0x20u}) {
+        AgcDriver::Pm4::Validate(packet(0xc0100000u), queue);
+        AgcDriver::Pm4::Validate(packet(0xe0000000u), queue);
+    }
+    expectFailure([&] { AgcDriver::Pm4::Validate(packet(0xe0010000u), 0); }, "mailbox");
+    expectFailure([&] { AgcDriver::Pm4::Validate(packet(0xa0000000u), 0); }, "MEM_SEMAPHORE operation");
+    expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x39, {low(&semaphore), high(&semaphore), 0xc0100000u, 0}), 0); }, "packet size");
+    expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x39, {0, 0, 0xc0100000u}), 0); }, "MEM_SEMAPHORE address");
+    expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x39, {low(&semaphore) + 4, high(&semaphore), 0xc0100000u}), 0); }, "MEM_SEMAPHORE address");
+
+    semaphore = 0x500000000ull;
+    auto words = packet(0xc0100000u);
+    submitWords(words);
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 1, "a MEM_SEMAPHORE signal of type 1 did not write 1");
+
+    semaphore = 5;
+    words = packet(0xc0000000u);
+    submitWords(words);
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 6, "a MEM_SEMAPHORE signal of type 0 did not increment");
+
+    constexpr std::uint64_t queueSignals = 2000, cpuSignals = 200000;
+    semaphore = 0;
+    std::vector<std::uint32_t> graphicsWords, computeWords;
+    for (std::uint64_t index = 0; index < queueSignals; ++index) {
+        const auto signal = packet(0xc0000000u);
+        graphicsWords.insert(graphicsWords.end(), signal.begin(), signal.end());
+        computeWords.insert(computeWords.end(), signal.begin(), signal.end());
+    }
+    std::thread cpu([] {
+        for (std::uint64_t index = 0; index < cpuSignals; ++index) std::atomic_ref<std::uint64_t>(semaphore).fetch_add(1);
+    });
+    submitWords(graphicsWords);
+    submitWords(computeWords, 0x20);
+    cpu.join();
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 2 * queueSignals + cpuSignals, "competing MEM_SEMAPHORE signals of type 0 lost an increment");
+
+    semaphore = 0;
+    marker = 0;
+    words = joinPackets({packet(0xe0000000u), makePacket(0x49, {0x0030c514, 0x20000000, low(&marker), high(&marker), 1, 0, 0})});
+    submitWords(words);
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    check(std::atomic_ref<std::uint32_t>(marker).load() == 0, "a MEM_SEMAPHORE wait passed a zero semaphore");
+    std::atomic_ref<std::uint64_t>(semaphore).store(2);
+    for (int waited = 0; waited < 2000 && std::atomic_ref<std::uint32_t>(marker).load() == 0; ++waited) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    AgcDriverWaitIdle_nid_postfix();
+    check(std::atomic_ref<std::uint32_t>(marker).load() == 1, "work after a signalled MEM_SEMAPHORE wait never ran");
+    check(std::atomic_ref<std::uint64_t>(semaphore).load() == 1, "a MEM_SEMAPHORE wait did not take one from the semaphore");
+}
+
 void testSuspendPointWritesQueuedLabels() {
     alignas(8) static std::uint32_t gate = 0, marker = 0;
     gate = 0;
@@ -1170,6 +1275,11 @@ void testConditionalSubmission() {
     check(results[13] == 0, "a rejected conditional submission executed a guarded packet");
 }
 
+void testRewindPayloadBits() {
+    for (const auto payload : {0x00000000u, 0x80000000u, 0x01000000u, 0x81000000u}) AgcDriver::Pm4::Validate(makePacket(0x59, {payload}), 0);
+    for (const auto payload : {0x82000000u, 0x80000001u, 0x00800000u}) expectFailure([&] { AgcDriver::Pm4::Validate(makePacket(0x59, {payload}), 0); }, "unsupported REWIND payload bits");
+}
+
 void testNopPadSubmission() {
     alignas(8) static std::uint32_t zero = 0;
     static std::array<std::uint32_t, 3> results{};
@@ -1936,6 +2046,7 @@ int main(int argc, char** argv) {
         }
         testCatalog();
         testNopPad();
+        testRewindPayloadBits();
         testWriteChangedKeepsUntouchedBytes();
         testWriteChangedStoresExactlyTheChangedRuns();
         testRegisters();
@@ -1943,6 +2054,7 @@ int main(int argc, char** argv) {
         testContextAndBases();
         testIndexedDraw();
         testAutoDraw();
+        testIndirectDrawRange();
         testIndirectDraw();
         testIndexAttributesIndirect();
         testMemory();
@@ -1968,6 +2080,7 @@ int main(int argc, char** argv) {
         testPredicatedSubmission();
         testConditionalSubmission();
         testSuspendPointWritesQueuedLabels();
+        testMemSemaphore();
         testNopPadSubmission();
         testBranchSubmission();
         testWaitRegMemMasking();
diff --git a/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp b/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp
index 98cf833fd3..7359bc4598 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Pm4Replay.cpp
@@ -1,3 +1,10 @@
+#include "prx/libSceAgc/Patch/include/Rewind.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Sync.hpp"
+#include "prx/libSceAgc/DcbFlow/include/Memory.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include "../tools/Pm4Analysis.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/LabelStores.hpp"
@@ -21,18 +28,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcAcbWriteData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint64_t, const void*, std::uint32_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcDcbWaitRegMem(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint8_t, const volatile void*, std::uint64_t, std::uint64_t, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcAcbWaitRegMem(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, const volatile void*, std::uint64_t, std::uint64_t, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer*, std::uint8_t, std::uint16_t, std::uint8_t, std::uint8_t, const volatile Label*, std::uint8_t, std::uint64_t, std::uint16_t, std::uint16_t, std::uint8_t, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcDcbDmaData(CommandBuffer*, std::uint8_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint32_t, std::uint8_t, std::uint8_t, std::uint8_t);
-std::uint32_t* APS5_VABI sceAgcDcbCondExec(CommandBuffer*, const volatile std::uint32_t*, std::uint32_t);
-std::uint32_t* APS5_VABI sceAgcAcbRewind(CommandBuffer*, std::uint32_t);
-int APS5_VABI sceAgcAsyncRewindPatchSetRewindState(std::uint32_t*, std::uint8_t);
-}
-
 namespace {
 
 using AgcDriver::CapturedSubmission;
@@ -693,8 +688,12 @@ void testCorrupt(const std::filesystem::path& directory) {
 int main() {
     std::filesystem::path scratch;
     try {
+#ifdef _WIN32
+        const wchar_t* captured = _wgetenv(L"APS5_DUMP_SUBMITS");
+#else
         const char* captured = std::getenv("APS5_DUMP_SUBMITS");
-        check(captured != nullptr && *captured != '\0', "set APS5_DUMP_SUBMITS to the capture directory of this test");
+#endif
+        check(captured != nullptr && *captured != 0, "set APS5_DUMP_SUBMITS to the capture directory of this test");
         const std::filesystem::path directory = captured;
         std::filesystem::remove_all(directory);
         scratch = std::filesystem::temp_directory_path() / ("anyps5-pm4-replay-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
diff --git a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
index f55704d524..11915c8575 100644
--- a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
@@ -7,6 +7,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
+#include "execution/FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <algorithm>
 #include <array>
@@ -38,6 +39,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -49,6 +52,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -56,7 +65,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
             queues(context.physical, &count, nullptr);
             std::vector<VkQueueFamilyProperties> families(count);
diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
index 97f02e7f2f..58cc914302 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceAgc/Command/include/Packet.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PipelineLinkOptimization.hpp"
 #include "Triangle_frag_spv.h"
 #include "Triangle_vert_spv.h"
@@ -30,6 +32,7 @@
 #include "ResidentPresent.hpp"
 #include "ImageTableAbi.hpp"
 #include "HostImportLifetime.hpp"
+#include "ShaderCacheDirectory.hpp"
 #include "SampleLod_spv.h"
 #include "BufferUpdate_spv.h"
 #include "SampleArray_spv.h"
@@ -77,14 +80,6 @@
 
 namespace {
 
-extern "C" {
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-}
-
 using namespace AgcDriver::Graphics;
 using AgcDriver::GuestMemory::GpuMutex;
 
@@ -384,6 +379,7 @@ public:
                 VkPhysicalDeviceProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &hostProperties};
                 function<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(context.physical, &properties);
                 context.hostImportAlignment = hostProperties.minImportedHostPointerAlignment;
+                context.discreteGpu = properties.properties.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU;
             }
             if (driverProperties.driverID != VK_DRIVER_ID_NVIDIA_PROPRIETARY && hasExtension(VK_KHR_EXTERNAL_MEMORY_FD_EXTENSION_NAME) && hasExtension(VK_EXT_EXTERNAL_MEMORY_DMA_BUF_EXTENSION_NAME)) {
                 extensionsEnabled.push_back(VK_KHR_EXTERNAL_MEMORY_FD_EXTENSION_NAME);
@@ -1221,8 +1217,10 @@ void completionCountTests(const Device& device, Recorder& recorder) {
     recorder.AfterCompletions(base, value, 3, 0, true);
     recorder.AfterCompletions(base + 8, value, 4, 0, true);
     Require(Recorder::PendingCompletionLabels() == registered, "a GPU-stored completion label counts before any write-back");
+    Require(Recorder::PendingCompletionStores() == registered, "a GPU-stored completion label counts as a completion store before any write-back");
     recorder.AfterCompletions(base + 0x40, value, 5, 0, false);
     Require(Recorder::PendingCompletionLabels() == registered + 1, "a label the GPU has no view of is not pending");
+    Require(Recorder::PendingCompletionStores() == registered + 1, "a label the GPU has no view of is not a pending completion store");
     // A late lookup (stamp <= afterStamp) of a label whose value reaches memory only through the
     // batch's completion action is refused as BehindCompletion (a poller reaps for it); a GPU-stored
     // one keeps the ordinary reason (unclosed group, or trust off) until a write-back overlaps it.
@@ -1238,16 +1236,20 @@ void completionCountTests(const Device& device, Recorder& recorder) {
     Recorder::NoteWrittenBack(base + 2, 4);
     const std::uint64_t counted = countAll ? 3 : 2;
     Require(Recorder::PendingCompletionLabels() == counted, "a write-back over a GPU-stored label did not count it exactly once");
+    Require(Recorder::PendingCompletionStores() == counted, "a write-back over a GPU-stored label did not make it a completion store exactly once");
+    int delivered = 0;
+    Require(recorder.AfterRecordedWork([&] { ++delivered; }), "an action after recorded work was refused");
+    Require(Recorder::PendingCompletionLabels() == counted + 1 && Recorder::PendingCompletionStores() == counted, "an action after recorded work counted as a completion store");
     Require(!Recorder::LookupLabel(base, 4, 3, &refusal).has_value() && refusal == Refusal::BehindCompletion, "a written-back GPU-stored label is not refused as behind a completion");
     Require(!Recorder::LookupLabel(base + 8, 4, 4, &refusal).has_value() && refusal == (countAll ? Refusal::BehindCompletion : ordinary), "an untouched GPU-stored label became behind a completion");
     recorder.Submit();
     device.WaitQueue();
-    Require(Recorder::PendingCompletionLabels() == counted && Recorder::PendingWriteBackCompletions() == 1, "counts dropped before the batch finished");
+    Require(Recorder::PendingCompletionLabels() == counted + 1 && Recorder::PendingCompletionStores() == counted && Recorder::PendingWriteBackCompletions() == 1, "counts dropped before the batch finished");
     memory[0] = 7;
     memory[2] = 7;
     memory[16] = 7;
     recorder.Sync();
-    Require(ran == 1 && Recorder::PendingCompletionLabels() == 0 && Recorder::PendingWriteBackCompletions() == 0 && recorder.Idle(), "counts did not return to 0 at finish");
+    Require(ran == 1 && delivered == 1 && Recorder::PendingCompletionLabels() == 0 && Recorder::PendingCompletionStores() == 0 && Recorder::PendingWriteBackCompletions() == 0 && recorder.Idle(), "counts did not return to 0 at finish");
     const bool storeAlways = std::getenv("APS5_LABEL_STORE_ALWAYS") != nullptr;
     Require(memory[0] == 1 && memory[2] == (storeAlways ? 1u : 7u) && memory[16] == 1, "completion stores ran for the wrong labels (overlapped and not-imported ones store, the untouched GPU-stored one skips)");
 }
@@ -1322,7 +1324,7 @@ void directCompletionLabelTests(Recorder& recorder) {
         std::int64_t physical = -1;
         ~Release() {
             recorder.Sync();
-            if (mapping != nullptr) sceKernelMunmap(mapping, size);
+            if (mapping != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), size);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, size);
         }
     } release{recorder};
@@ -1838,6 +1840,16 @@ void storeRunTests(const Device& device, Recorder& recorder) {
     Require(words[0] == 1 && words[1] == 2 && words[2] == 5 && words[4] == 4 && words[3] == 0, "the stores did not land (or the later store of a dword lost)");
     const auto after = Recorder::StoreCounts();
     Require(after.stores == before.stores + 1 && after.replaced == before.replaced + 0 && after.joined == before.joined + 0, "store counters are off");
+    store(8, 1);
+    recorder.NotePendingWrite(address + 32, 4);
+    auto* commandWords = static_cast<std::uint32_t*>(block);
+    CommandBuffer disjoint{commandWords + 12, commandWords + 16, commandWords + 12, nullptr, nullptr, nullptr, 0};
+    Agc::Command::Emit(&disjoint, 0x7a, {0x20000243, 0x400}, __func__);
+    Require(recorder.Recording(), "a disjoint command allocation drained the GPU store");
+    CommandBuffer reused{commandWords + 6, commandWords + 10, commandWords + 6, nullptr, nullptr, nullptr, 0};
+    Agc::Command::Emit(&reused, 0x7a, {0x20000243, 0x400}, __func__);
+    recorder.Sync();
+    Require(words[8] == 0x400, "a pending GPU label overwrote a reused command word");
     // The covered-access mask: reported once by the next Commands() call, then cleared.
     VkAccessFlags covered = 0xffffffffu;
     recorder.Commands(&covered);
@@ -2027,7 +2039,10 @@ bool settleFirstUseRaced(const Context& context, int copies) {
     const auto* import = HostImportFor(context, address, unit);
     Require(import != nullptr && import->unwatched && !Watched(address, unit), "(f) a 64 KiB import was not compared at first");
     const auto commands = recorder.Commands();
-    for (int copy = 0; copy < copies; ++copy) CopyBuffer(context, commands, import->buffer, 0, scratch.Handle(), 0, unit);
+    for (int copy = 0; copy < copies; ++copy) {
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+        CopyBuffer(context, commands, import->buffer, 0, scratch.Handle(), 0, unit);
+    }
     recorder.Submit();
     const auto submittedAt = std::chrono::steady_clock::now();
     const auto deadline = submittedAt + std::chrono::seconds(5);
@@ -2066,6 +2081,177 @@ bool settleFirstUseRaced(const Context& context, int copies) {
     return racing;
 }
 
+bool settleWriteOrderTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    const auto& context = device.GetContext();
+    constexpr std::size_t unit = 65536;
+    if (context.hostImportAlignment == 0 || context.hostImportAlignment > unit || context.settleQueue == VK_NULL_HANDLE || !WriteWatched()) {
+        std::cout << "host imports within 64 KiB, a settle queue or write watching unavailable: settle write order not tested\n";
+        return false;
+    }
+    std::unique_lock gpu(GpuMutex());
+    PrepareImportWatch(context);
+    if (!settledImportsWatchPrivate(context)) {
+        std::cout << "this device compares every Windows import: settle write order not tested\n";
+        return false;
+    }
+    void* block = AllocateWatched(unit, unit);
+    struct Release {
+        void* block;
+        ~Release() { ReleaseWatched(block, unit); }
+    } release{block};
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, unit, true, true, true);
+    }
+    Recorder recorder(context);
+    recorder.Activate();
+    const auto* import = HostImportFor(context, address, unit);
+    Require(import != nullptr && import->unwatched, "the write-order import was not initially compared");
+    const auto fill = [&](std::uint32_t value) {
+        const auto commands = recorder.Commands();
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+        context.Function<PFN_vkCmdFillBuffer>("vkCmdFillBuffer")(commands, import->buffer, HostImportOffset(*import, address), unit, value);
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT | VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT);
+        recorder.NotePendingWrite(address, unit);
+        recorder.Submit();
+    };
+    const auto before = HostImportSettles().submitted;
+    fill(0x22222222u);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (HostImportSettles().submitted == before && std::chrono::steady_clock::now() < deadline) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        Require(HostImportFor(context, address, unit) == import, "the write-order import changed while settling");
+    }
+    Require(HostImportSettles().submitted > before, "the write-order import did not submit a settle");
+    fill(0x33333333u);
+    recorder.Sync();
+    while (!Watched(address, unit) && std::chrono::steady_clock::now() < deadline) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        HostImportFor(context, address, unit);
+    }
+    Require(Watched(address, unit), "the write-order import did not return to the write watch");
+    const auto* bytes = static_cast<const std::uint8_t*>(block);
+    Require(std::all_of(bytes, bytes + unit, [](std::uint8_t value) { return value == 0x33; }), "the GPU store after the settle did not preserve its bytes");
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Remove(block);
+    }
+    HostImportFor(context, address, unit);
+    std::cout << "settle read between main-queue GPU writes passed\n";
+    return true;
+}
+
+struct SettleWaitFailure {
+    PFN_vkGetDeviceProcAddr resolve;
+    VkBuffer buffer = VK_NULL_HANDLE;
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    VkResult result = VK_SUCCESS;
+    std::uint64_t timeout = 0;
+    unsigned waits = 0;
+    unsigned destroys = 0;
+    unsigned frees = 0;
+};
+
+SettleWaitFailure* settleWaitFailure = nullptr;
+
+VKAPI_ATTR VkResult VKAPI_CALL settleWaitForFences(VkDevice device, std::uint32_t count, const VkFence* fences, VkBool32 all, std::uint64_t timeout) {
+    auto& failure = *settleWaitFailure;
+    if (failure.result != VK_SUCCESS) {
+        failure.timeout = timeout;
+        ++failure.waits;
+        return failure.result;
+    }
+    return reinterpret_cast<PFN_vkWaitForFences>(failure.resolve(device, "vkWaitForFences"))(device, count, fences, all, timeout);
+}
+
+VKAPI_ATTR void VKAPI_CALL settleDestroyBuffer(VkDevice device, VkBuffer buffer, const VkAllocationCallbacks* allocator) {
+    auto& failure = *settleWaitFailure;
+    if (buffer == failure.buffer) ++failure.destroys;
+    reinterpret_cast<PFN_vkDestroyBuffer>(failure.resolve(device, "vkDestroyBuffer"))(device, buffer, allocator);
+}
+
+VKAPI_ATTR void VKAPI_CALL settleFreeMemory(VkDevice device, VkDeviceMemory memory, const VkAllocationCallbacks* allocator) {
+    auto& failure = *settleWaitFailure;
+    if (memory == failure.memory) ++failure.frees;
+    reinterpret_cast<PFN_vkFreeMemory>(failure.resolve(device, "vkFreeMemory"))(device, memory, allocator);
+}
+
+PFN_vkVoidFunction VKAPI_CALL settleWaitDeviceProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkWaitForFences") == 0) return reinterpret_cast<PFN_vkVoidFunction>(settleWaitForFences);
+    if (std::strcmp(name, "vkDestroyBuffer") == 0) return reinterpret_cast<PFN_vkVoidFunction>(settleDestroyBuffer);
+    if (std::strcmp(name, "vkFreeMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(settleFreeMemory);
+    return settleWaitFailure->resolve(device, name);
+}
+
+bool settleWaitFailureTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    auto context = device.GetContext();
+    constexpr std::size_t unit = 65536;
+    if (context.hostImportAlignment == 0 || context.hostImportAlignment > unit || context.settleQueue == VK_NULL_HANDLE || !WriteWatched()) return false;
+    std::lock_guard gpu(GpuMutex());
+    PrepareImportWatch(context);
+    if (!settledImportsWatchPrivate(context)) return false;
+    ClearHostImports(context.device);
+    SettleWaitFailure failure{context.deviceProc};
+    settleWaitFailure = &failure;
+    context.deviceProc = settleWaitDeviceProc;
+    context.functions = nullptr;
+    void* block = AllocateWatched(unit, unit);
+    Require(block != nullptr, "no watched block for settle wait failure");
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, unit, true, true, true);
+    }
+    struct Release {
+        Context& context;
+        SettleWaitFailure& failure;
+        void* block;
+        ~Release() {
+            failure.result = VK_SUCCESS;
+            ClearHostImports(context.device);
+            {
+                GuestAllocations::Mutation mutation;
+                mutation.Remove(block);
+            }
+            ReleaseWatched(block, unit);
+            settleWaitFailure = nullptr;
+        }
+    } release{context, failure, block};
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    const auto* import = HostImportFor(context, address, unit);
+    Require(import != nullptr && import->unwatched, "wait failure import was not initially compared");
+    failure.buffer = import->buffer;
+    failure.memory = import->memory;
+    const auto before = HostImportSettles().submitted;
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (HostImportSettles().submitted == before && std::chrono::steady_clock::now() < deadline) {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        HostImportFor(context, address, unit);
+    }
+    Require(HostImportSettles().submitted > before, "wait failure did not submit a settle");
+    Check(context.Function<PFN_vkDeviceWaitIdle>("vkDeviceWaitIdle")(context.device), "vkDeviceWaitIdle before settle failure");
+    for (const auto result : {VK_TIMEOUT, VK_ERROR_DEVICE_LOST}) {
+        failure.result = result;
+        const auto waits = failure.waits;
+        std::string error;
+        try {
+            ClearHostImports(context.device);
+        } catch (const std::runtime_error& caught) {
+            error = caught.what();
+        }
+        failure.result = VK_SUCCESS;
+        Require(failure.waits == waits + 1 && failure.timeout > 0 && failure.timeout <= 60'000'000'000ull, "settle retirement did not use a bounded fence wait");
+        Require(error == "AGC graphics: vkWaitForFences (settle batch): Vulkan result " + std::to_string(result), "settle retirement did not propagate its Vulkan failure");
+        Require(failure.destroys == 0 && failure.frees == 0 && HostImportCovers(context, address, unit), "failed settle wait released its host import");
+    }
+    ClearHostImports(context.device);
+    Require(failure.destroys == 1 && failure.frees == 1, "successful settle retirement did not release the retained import exactly once");
+    std::cout << "bounded settle wait preserves imports on timeout and device loss; successful retry releases once\n";
+    return true;
+}
+
 bool settleFirstUseTests(const Device& device) {
     using namespace AgcDriver::GuestMemory;
     const auto& context = device.GetContext();
@@ -2080,15 +2266,9 @@ bool settleFirstUseTests(const Device& device) {
         std::cout << "this device compares every Windows import: the first use of a settled import not tested\n";
         return false;
     }
-    for (int copies = 4096; copies <= 65536; copies *= 4) {
-        if (settleFirstUseRaced(context, copies)) {
-            std::cout << "settled import first use tests passed\n";
-            return true;
-        }
-        std::cout << "(f) the main-queue copies had finished before the import returned to the write watch, so its read did not race them\n";
-    }
-    std::cout << "(f) the main-queue copies finished first in every round: the first use of a settled import not tested\n";
-    return false;
+    Require(!settleFirstUseRaced(context, 4096), "(f) the import returned to the write watch while its earlier main-queue reads were still in flight");
+    std::cout << "settled import first use ordering tests passed\n";
+    return true;
 }
 
 bool settleEarlierImportTests(const Device& device) {
@@ -2127,7 +2307,10 @@ bool settleEarlierImportTests(const Device& device) {
     const auto* earlier = HostImportFor(context, address, 16);
     Require(earlier != nullptr && earlier->base == address && earlier->bytes == unit && earlier->unwatched, "(e) the first window of the range was not imported compared");
     const auto commands = recorder.Commands();
-    for (int copy = 0; copy < copies; ++copy) CopyBuffer(context, commands, earlier->buffer, 0, scratch.Handle(), 0, unit);
+    for (int copy = 0; copy < copies; ++copy) {
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+        CopyBuffer(context, commands, earlier->buffer, 0, scratch.Handle(), 0, unit);
+    }
     const auto* whole = HostImportFor(context, address + unit - 16, 32);
     Require(whole != nullptr && whole->base == address && whole->bytes == 2 * unit && whole->unwatched, "(e) an access across the windows did not replace the first window's import");
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
@@ -2371,7 +2554,7 @@ void remappedImportTests(const Device& device) {
 
 void hostImportRetirementTests(const Device& device) {
     const auto& context = device.GetContext();
-    constexpr std::size_t UnitBytes = 65536;
+    constexpr std::size_t UnitBytes = 2 * 65536;
     constexpr std::size_t AllocationBytes = 4 * UnitBytes;
     constexpr std::size_t CopyBytes = 256;
 #ifdef _WIN32
@@ -2504,8 +2687,8 @@ void secondMappingImportTests(const Device& device) {
         void* alias = nullptr;
         std::int64_t physical = -1;
         ~Release() {
-            if (alias != nullptr) sceKernelMunmap(alias, page);
-            if (mapping != nullptr) sceKernelMunmap(mapping, bytes);
+            if (alias != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page);
+            if (mapping != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), bytes);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, bytes);
         }
     } release;
@@ -2576,7 +2759,7 @@ int reimportBench(const Device& device) {
         void* mapping = nullptr;
         std::int64_t physical = -1;
         ~Release() {
-            if (mapping != nullptr) sceKernelMunmap(mapping, bytes);
+            if (mapping != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), bytes);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, bytes);
         }
     };
@@ -2726,8 +2909,8 @@ int hostImportCutTests(const Device& device) {
         std::size_t holeBytes = 0;
         ~Backing() {
             auto* memory = static_cast<std::byte*>(mapping);
-            if (memory != nullptr && hole != 0) sceKernelMunmap(memory, hole);
-            if (memory != nullptr && hole + holeBytes < bytes) sceKernelMunmap(memory + hole + holeBytes, bytes - hole - holeBytes);
+            if (memory != nullptr && hole != 0) sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), hole);
+            if (memory != nullptr && hole + holeBytes < bytes) sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory + hole + holeBytes), bytes - hole - holeBytes);
             if (physical >= 0) sceKernelReleaseDirectMemory(physical, bytes);
         }
     };
@@ -2756,7 +2939,7 @@ int hostImportCutTests(const Device& device) {
         auto* cut = memory + test.offset;
         gpu.unlock();
         if (test.unmap) {
-            Require(sceKernelMunmap(cut, test.length) == 0, name + ": the unmap failed");
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(cut), test.length) == 0, name + ": the unmap failed");
             backing.hole = test.offset;
             backing.holeBytes = test.length;
         } else {
@@ -2806,7 +2989,7 @@ int hostImportCutTests(const Device& device) {
         Require(whole != nullptr && whole->base == address && whole->bytes == bytes && whole->alias == nullptr && !whole->unwatched, name + ": the range was not imported whole, settled and watched");
         gpu.unlock();
         Require(sceKernelMprotect(memory, run, 0x03) == 0, name + ": the protection of the head failed");
-        Require(sceKernelMunmap(memory + run, bytes - run) == 0, name + ": the unmap of the kept side failed");
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory + run), bytes - run) == 0, name + ": the unmap of the kept side failed");
         backing.hole = run;
         backing.holeBytes = bytes - run;
         void* again = memory + run;
@@ -3126,13 +3309,121 @@ void resourceReadTests(const Device& device, Recorder& recorder) {
     HostImportFor(context, address, bytes);
 }
 
+bool bdaStagingTests(const Device& device, Recorder& recorder) {
+    const auto& context = device.GetContext();
+    if (context.hostImportAlignment == 0 || !context.bufferDeviceAddress || !AddressSpaceCounters().enabled || std::getenv("APS5_NO_BDA_STAGING") != nullptr) {
+        std::cout << "skipped, host imports are unavailable (no device addresses or address space cache)\n";
+        return false;
+    }
+    constexpr std::size_t bytes = 4u << 20u;
+#ifdef _WIN32
+    void* block = VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+#else
+    void* block = std::aligned_alloc(65536, bytes);
+#endif
+    Require(block != nullptr, "cannot allocate the test block");
+    std::memset(block, 0x11, bytes);
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, bytes, true, true, true);
+    }
+    const auto* import = HostImportFor(context, address, bytes);
+    if (import == nullptr || import->address == 0) {
+        std::cout << "skipped, host imports are unavailable: the test block's import was refused\n";
+        return false;
+    }
+    const auto importBase = import->base;
+    const auto importAddress = import->address;
+    const auto importBuffer = import->buffer;
+    auto* words = static_cast<std::uint32_t*>(block);
+    const auto fill = context.Function<PFN_vkCmdFillBuffer>("vkCmdFillBuffer");
+    const auto element = address + 8192;
+    constexpr std::size_t elementBytes = 64u << 10u;
+    constexpr std::size_t first = 8192 / 4;
+    const auto checkTable = [&](const std::vector<ShaderRecompiler::BdaAbi::Range>& ranges, bool staged) {
+        for (std::size_t index = 1; index < ranges.size(); ++index) Require(ranges[index - 1].end <= ranges[index].begin, "the BDA table of a staged build has overlapping or unsorted ranges");
+        bool covered = false;
+        std::uint64_t reached = address;
+        for (const auto& range : ranges) {
+            if (range.end <= address || range.begin >= address + bytes) continue;
+            Require(range.begin == reached, "the BDA table leaves a hole in the registered block");
+            reached = range.end;
+            const bool inImport = range.deviceAddress == importAddress + (range.begin - importBase);
+            const bool overElement = range.begin < element + elementBytes && element < range.end;
+            covered = covered || overElement;
+            if (overElement && staged) {
+                Require(range.begin == element && range.end == element + elementBytes && !inImport, "the staged element's BDA range does not send its addresses to the shadow");
+                Require((range.permissions & ShaderRecompiler::BdaAbi::Write) != 0u, "the staged element's BDA range is not writable");
+            } else {
+                Require(inImport, "a BDA range outside the staged element left the import");
+            }
+        }
+        Require(covered, "no BDA range covers the written element");
+        Require(reached == address + bytes, "the BDA table does not reach the end of the registered block");
+    };
+    {
+        GuestBufferMemory memory(context);
+        memory.AllowDeviceStaging();
+        memory.AcquireRegistered();
+        memory.AddWritable(element, elementBytes, false, false);
+        memory.AddReadable(element + 16, 64);
+        memory.AddReadable(address + (1u << 20u), 64);
+        memory.Upload(true);
+        checkTable(memory.AddressRanges(), true);
+        const auto cached = memory.CachedAddressTable();
+        Require(cached.has_value() && cached->ranges != nullptr && cached->ranges->size() == memory.AddressRanges().size(), "the cached BDA table of a staged build differs from its ranges");
+        std::uint32_t adjustment = 0;
+        const auto view = memory.Descriptor(element, elementBytes, adjustment);
+        Require(view.buffer != importBuffer, "the written element of an address-based build is bound in place");
+        std::uint32_t innerAdjustment = 0;
+        Require(memory.Descriptor(element + 16, 64, innerAdjustment).buffer == view.buffer, "a read inside the staged element does not read its shadow");
+        recorder.Sync();
+        auto commands = recorder.Commands();
+        fill(commands, view.buffer, view.offset + adjustment + 64u * 4u, 64, 0x22222222u);
+        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_TRANSFER_READ_BIT);
+        memory.RecordCopyBacks(recorder);
+        recorder.Sync();
+        memory.MarkDirectWrites();
+        std::size_t wrong = 0;
+        for (std::size_t index = 0; index < bytes / 4u; ++index) {
+            const auto at = index >= first ? index - first : bytes;
+            const auto expected = at >= 64 && at < 80 ? 0x22222222u : 0x11111111u;
+            if (words[index] != expected && wrong++ < 8) std::cout << "address-based staging copy-back dword " << index << " holds 0x" << std::hex << words[index] << ", expected 0x" << expected << std::dec << "\n";
+        }
+        Require(wrong == 0, "an address-based staged copy-back left the wrong guest bytes");
+        memory.WriteBack();
+    }
+    std::memset(block, 0x11, bytes);
+    {
+        GuestBufferMemory memory(context);
+        memory.AllowDeviceStaging();
+        memory.AcquireRegistered();
+        memory.AddReadable(element - 16, 64);
+        memory.AddWritable(element, elementBytes, false, false);
+        memory.Upload(true);
+        checkTable(memory.AddressRanges(), false);
+        std::uint32_t adjustment = 0;
+        Require(memory.Descriptor(element, elementBytes, adjustment).buffer == importBuffer, "an element crossed by an in-place read was staged");
+        memory.RecordCopyBacks(recorder);
+        recorder.Sync();
+        memory.WriteBack();
+    }
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Remove(block);
+    }
+    HostImportFor(context, address, bytes);
+    return true;
+}
+
 bool readWrittenStagingTests(const Device& device, Recorder& recorder) {
     const auto& context = device.GetContext();
     if (context.hostImportAlignment == 0) {
         std::cout << "host imports unavailable: read and written staging not tested\n";
         return false;
     }
-    constexpr std::size_t bytes = 8u << 20u;
+    constexpr std::size_t bytes = 16u << 20u;
 #ifdef _WIN32
     void* block = VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
 #else
@@ -3162,11 +3453,12 @@ bool readWrittenStagingTests(const Device& device, Recorder& recorder) {
         return direct;
     };
     Require(!boundInPlace(address + 4096, 1u << 20u, false), "a written 1 MiB element was not staged");
-    Require(boundInPlace(address + 4096, 4u << 20u, false), "a written-only 4 MiB element was staged past the written window");
+    Require(boundInPlace(address + 4096, 4u << 20u, false) != context.discreteGpu, context.discreteGpu ? "a written-only 4 MiB element was bound in place on a discrete GPU" : "a written-only 4 MiB element was staged past the written window");
+    Require(boundInPlace(address + 4096, 12u << 20u, false), "a written-only 12 MiB element was staged past the discrete written window");
     Require(!boundInPlace(address + 4096, 4u << 20u, true), "a read and written 4 MiB element was bound in place");
     const auto buildInPlace = [&](std::uint64_t dispatchThreads, bool read, std::uint32_t stride, std::uint32_t extent) {
         const auto element = address + 4096;
-        constexpr std::uint32_t elementBytes = 4u << 20u;
+        constexpr std::uint32_t elementBytes = 12u << 20u;
         const std::uint32_t records = stride != 0 ? elementBytes / stride : elementBytes;
         ShaderRecompiler::RecompileResult program;
         ShaderRecompiler::DescriptorBinding binding;
@@ -3188,13 +3480,13 @@ bool readWrittenStagingTests(const Device& device, Recorder& recorder) {
         recorder.Sync();
         return direct;
     };
-    Require(!buildInPlace((4u << 20u) / 16u, true, 16, 0), "a dispatch sweeping a read and written 4 MiB element bound it in place");
-    Require(buildInPlace(1024, true, 16, 0), "a dispatch touching 16 KiB of a read and written 4 MiB element staged all of it");
-    Require(buildInPlace(0, true, 16, 0), "a dispatch of unknown size staged a read and written 4 MiB element");
-    Require(buildInPlace((4u << 20u) / 16u, false, 16, 0), "a dispatch sweeping a written-only 4 MiB element staged it");
-    Require(!buildInPlace((4u << 20u) / 32u, true, 0, 32), "a dispatch sweeping a read and written 4 MiB raw element bound it in place");
-    Require(buildInPlace(1024, true, 0, 32), "a dispatch touching 32 KiB of a read and written 4 MiB raw element staged all of it");
-    Require(buildInPlace((4u << 20u) / 32u, true, 0, 0), "a raw element without an access extent was staged");
+    Require(!buildInPlace((12u << 20u) / 16u, true, 16, 0), "a dispatch sweeping a read and written 12 MiB element bound it in place");
+    Require(buildInPlace(1024, true, 16, 0), "a dispatch touching 16 KiB of a read and written 12 MiB element staged all of it");
+    Require(buildInPlace(0, true, 16, 0), "a dispatch of unknown size staged a read and written 12 MiB element");
+    Require(buildInPlace((12u << 20u) / 16u, false, 16, 0), "a dispatch sweeping a written-only 12 MiB element staged it");
+    Require(!buildInPlace((12u << 20u) / 32u, true, 0, 32), "a dispatch sweeping a read and written 12 MiB raw element bound it in place");
+    Require(buildInPlace(1024, true, 0, 32), "a dispatch touching 32 KiB of a read and written 12 MiB raw element staged all of it");
+    Require(buildInPlace((12u << 20u) / 32u, true, 0, 0), "a raw element without an access extent was staged");
     Require(std::all_of(static_cast<const std::byte*>(block), static_cast<const std::byte*>(block) + bytes, [](std::byte value) { return value == std::byte{0x11}; }), "a staged copy-back changed the guest bytes");
     {
         GuestAllocations::Mutation mutation;
@@ -3656,10 +3948,11 @@ void drawSnapshotTableSetTests(const Device& device, Recorder& recorder) {
     }
     constexpr std::uint32_t width = 4;
     constexpr std::uint32_t height = 4;
-    alignas(256) static std::array<float, width * height> texels{};
+    alignas(256) static std::array<float, width * height * 16u> texels{};
     texels.fill(1.0f);
     const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texels.data()));
     const std::array<std::uint32_t, 8> texture{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (22u << 20u) | (((width - 1u) & 3u) << 30u), ((width - 1u) >> 2u) | ((height - 1u) << 14u), 0xfacu | (9u << 28u), 0u, 0u, 0u, 0u};
+    Require(DescribeSurface(DecodeTextureResource(texture)).guestBytes <= sizeof(texels), "the draw snapshot table set test T# reads past its texels");
     constexpr auto bindingCount = static_cast<std::uint32_t>(ShaderRecompiler::RuntimeAbi::Binding::Count);
     const auto addTable = [&](ShaderRecompiler::RecompileResult& program, ShaderRecompiler::RuntimeAbi::Stage stage, std::uint32_t set, std::uint32_t elements) {
         ShaderRecompiler::DescriptorBinding map{};
@@ -4253,6 +4546,46 @@ void drawSnapshotEvictionTests(const Device& device) {
     Require(cache.ReusableDrawSnapshot(address, 16) == nullptr && cache.ReusableDrawSnapshot(address, 16) == nullptr, "a snapshot outlived a CPU store");
 }
 
+void containingSnapshotTests(const Device& device) {
+    using namespace AgcDriver::GuestMemory;
+    constexpr std::size_t bytes = 131072;
+    void* block = WriteWatched() ? AllocateWatched(bytes, 65536) : nullptr;
+    if (block == nullptr) {
+        std::cout << "write watching unavailable: containing draw snapshots not tested\n";
+        return;
+    }
+    struct Release {
+        void* block;
+        ~Release() { ReleaseWatched(block, bytes); }
+    } release{block};
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    const VkDeviceSize alignment = std::max<VkDeviceSize>(device.GetContext().limits.minStorageBufferOffsetAlignment, 4);
+    Recorder cache(device.GetContext());
+    const auto whole = std::make_shared<Buffer>(device.GetContext(), bytes, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+    const auto exact = std::make_shared<Buffer>(device.GetContext(), 4096, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+    const auto registry = GuestAllocations::GuestAllocationsGeneration_nid_postfix();
+    const auto generation = CollectWrites(address, bytes);
+    Require(generation != 0, "the watched block has no generation");
+    cache.KeepDrawSnapshot(address, bytes, generation, registry, whole);
+    const auto inner = address + 65536 + 16 * alignment;
+    VkDeviceSize offset = 1;
+    Require(cache.ReusableDrawSnapshot(inner, 4096) == nullptr, "a lookup without an offset took a containing snapshot");
+    Require(cache.ReusableDrawSnapshot(inner, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == whole && offset == inner - address, "an unchanged range inside a kept snapshot was not taken from it at its offset");
+    Require(cache.ReusableDrawSnapshot(inner, address + bytes - inner + 4, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a range past the end of a kept snapshot was taken from it");
+    Require(cache.ReusableDrawSnapshot(inner + alignment / 2, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a misaligned range was taken from a kept snapshot");
+    Require(cache.ReusableDrawSnapshot(inner, 4096, Recorder::SnapshotUse::Vertex, nullptr, 0, &offset) == nullptr, "a vertex lookup took a storage snapshot");
+    cache.KeepDrawSnapshot(inner, 4096, generation, registry, exact);
+    offset = 1;
+    Require(cache.ReusableDrawSnapshot(inner, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == exact && offset == 0, "an exact snapshot lost to a containing one");
+    std::memset(block, 0x5a, 16);
+    CollectWrites(address, 16);
+    Require(cache.ReusableDrawSnapshot(inner + 4096, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == whole && offset == inner + 4096 - address, "a store outside the range stopped it from being taken from a containing snapshot");
+    Require(cache.ReusableDrawSnapshot(address, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a range over a CPU store was taken from a containing snapshot");
+    std::memset(reinterpret_cast<void*>(inner + 4096), 0x5a, 16);
+    CollectWrites(inner + 4096, 16);
+    Require(cache.ReusableDrawSnapshot(inner + 4096, 4096, Recorder::SnapshotUse::Storage, nullptr, 0, &offset) == nullptr, "a containing snapshot outlived a CPU store into the range");
+}
+
 void unwrittenSnapshotTests(const Device& device) {
     Recorder cache(device.GetContext());
     const auto buffer = std::make_shared<Buffer>(device.GetContext(), 16, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
@@ -4642,6 +4975,9 @@ bool unitShadowTests(const Device& device, Recorder& recorder) {
     retile(*half, unit3, unit / 2, 0x22, true);
     Require(AnyShadowedOverlaps(unit3, 1) && AnyShadowedOverlaps(unit4 - 1, 1) && AnyShadowedOverlaps(unit3 + 1000, 64), "a fresh unit is not seen as shadowed");
     Require(!AnyShadowedOverlaps(unit3 - 1, 1) && !AnyShadowedOverlaps(unit4, unit) && !AnyShadowedOverlaps(address, 3 * unit), "a range outside the unit is seen as shadowed");
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 2> outside{{{unit3 - 8, unit3}, {unit4, unit4 + unit}}};
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 2> reaching{{{unit3 - 8, unit3}, {unit4 - 4, unit4}}};
+    Require(!AnyShadowedOverlaps(outside) && AnyShadowedOverlaps(reaching), "a set of ranges around the fresh unit was answered wrongly");
     {
         // An upload's runs over units 2..4 split at unit 3's freshness; the fresh piece reads the slab.
         const std::pair<std::uint64_t, std::uint64_t> run{2 * unit, 5 * unit};
@@ -4804,11 +5140,14 @@ void idlePublishWaitTests(const Device& device, Recorder& recorder) {
     recorder.Sync();
     Require(words[2 * unit] == 0x44 && words[4 * unit - 1] == 0x45, "a CPU store made after the idle flush returned was overwritten by its publish");
     Require(words[2 * unit + 1] == 0x22 && words[3 * unit - 1] == 0x22 && words[3 * unit] == 0x33 && words[1 * unit] == 0x11 && words[4 * unit] == 0x11, "the idle publish's bytes are wrong");
+    words[5 * unit] = 0x11;
+    CollectWritesUncached(address, bytes);
     retile(address + 5 * unit, 0x55);
     StorageTexture::FlushAllPending("label");
-    Require(recorder.PendingWriteOverlaps(address + 5 * unit, unit), "a publish of a flush other than the idle one was waited");
+    const bool pending = recorder.PendingWriteOverlaps(address + 5 * unit, unit);
     recorder.Sync();
-    Require(words[5 * unit] == 0x55 && words[6 * unit - 1] == 0x55, "the label flush's publish did not land");
+    Require(words[5 * unit] == 0x55 && words[6 * unit - 1] == 0x55, "the label flush's publish did not land: the unit read as written after its retile, so the publish dropped it as stale");
+    Require(pending, "a publish of a flush other than the idle one was waited");
     std::cout << "idle publish wait verified\n";
 }
 
@@ -4982,6 +5321,271 @@ void storageRefreshTests(const Device& device, Recorder& recorder, bool watched)
     recorder.Sync();
 }
 
+bool addressShadowTests(const Device& device, Recorder& recorder) {
+    const auto& base = device.GetContext();
+    if (!UnitShadowEnabled() || base.hostImportAlignment == 0) {
+        std::cout << "skipped, unit shadows or host imports are unavailable\n";
+        return false;
+    }
+    const auto decided = PrepareImportWatch(base);
+#ifndef _WIN32
+    const auto probe = ProbeImportWriteProtection(base);
+    if (probe.failure != nullptr || probe.writtenAtImport != 0 || probe.writtenAfterSubmit != 0) {
+        std::cout << "skipped, the device reports watched host memory written when it imports or reads it\n";
+        return false;
+    }
+    SetImportWatch(base, ImportWatch::Watch);
+#endif
+    struct Restore {
+        const Context& context;
+        ImportWatch decided;
+        ~Restore() { SetImportWatch(context, decided); }
+    } restore{base, decided};
+    constexpr std::uint32_t width = 1024;
+    constexpr std::uint32_t height = 512;
+    constexpr std::size_t bytes = width * height * 4;
+    constexpr std::size_t allocated = bytes + 65536;
+    void* block = AllocateWatched(allocated, 65536);
+    if (block == nullptr) {
+        std::cout << "skipped, no write watching\n";
+        return false;
+    }
+    struct Release {
+        void* block;
+        ~Release() { ReleaseWatched(block, allocated); }
+    } release{block};
+    std::memset(block, 0x55, bytes);
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, bytes, true, true, true);
+    }
+    struct Unregister {
+        const Context& context;
+        void* block;
+        std::uint64_t address;
+        ~Unregister() {
+            {
+                GuestAllocations::Mutation mutation;
+                mutation.Remove(block);
+            }
+            HostImportFor(context, address, bytes);
+        }
+    } unregister{base, block, address};
+    if (HostImportFor(base, address, bytes) == nullptr || !AgcDriver::GuestMemory::Watched(address, bytes)) {
+        std::cout << "skipped, the heap is not imported or not watched\n";
+        return false;
+    }
+    TextureDetiler detiler(base);
+    auto context = base;
+    context.detiler = &detiler;
+    GuestTextureResource resource{};
+    resource.baseAddress = address;
+    resource.width = width;
+    resource.height = height;
+    resource.mipCount = 1;
+    resource.tileMode = TextureTileMode::kR64KBX;
+    resource.dimension = TextureDimension::k2D;
+    resource.format = 56;
+    resource.dstSelX = 4;
+    resource.dstSelY = 5;
+    resource.dstSelZ = 6;
+    resource.dstSelW = 7;
+    Require(DescribeSurface(resource).guestBytes == bytes, "the heap's surface has an unexpected size");
+    const auto* words = static_cast<const std::uint8_t*>(block);
+    const auto holds = [&](std::array<std::uint8_t, 4> texel) {
+        for (std::size_t i = 0; i < bytes; ++i) {
+            if (words[i] != texel[i % 4]) return false;
+        }
+        return true;
+    };
+    const auto settle = [&] {
+        recorder.Submit();
+        device.WaitQueue();
+        recorder.Sync();
+    };
+    struct Build {
+        bool copied;
+        bool current;
+    };
+    const auto build = [&](std::array<std::uint8_t, 4> texel) {
+        GuestBufferMemory leased(context);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        Build result{recorder.PendingWriteOverlaps(address, bytes), false};
+        recorder.Submit();
+        device.WaitQueue();
+        result.current = holds(texel);
+        leased.WriteBack();
+        recorder.Sync();
+        return result;
+    };
+    const auto none = build({0x55, 0x55, 0x55, 0x55});
+    Require(!none.copied && none.current, "an address-based build over a heap with no shadowed units recorded a copy");
+    {
+        auto image = StorageTexture::Create(context, detiler, resource, 0);
+        const VkImageSubresourceRange range{VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+        const auto draw = [&](VkClearColorValue value) {
+            const auto commands = recorder.Commands();
+            recorder.Keep(image);
+            RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+            context.Function<PFN_vkCmdClearColorImage>("vkCmdClearColorImage")(commands, image->Image(), VK_IMAGE_LAYOUT_GENERAL, &value, 1, &range);
+            RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
+            image->MarkDirty();
+        };
+        draw({{1.0f, 0.0f, 0.0f, 1.0f}});
+        StorageTexture::FlushPending(address, bytes, nullptr, "storage refresh", PublishScope::None);
+        settle();
+        if (!AnyShadowedOverlaps(address, bytes)) {
+            std::cout << "skipped, the image's write-back did not retile into the unit shadow\n";
+            return false;
+        }
+        Require(holds({0x55, 0x55, 0x55, 0x55}), "a write-back into the unit shadow reached the import");
+        static_cast<void>(ShadowReport());
+        const auto shadowed = build({255, 0, 0, 255});
+        const auto report = ShadowReport();
+        Require(shadowed.current, "an address-based build over a heap left the unit shadow's stored results unpublished: the import held the earlier bytes at its submission");
+        Require(shadowed.copied && !AnyShadowedOverlaps(address, bytes), "an address-based build published the heap's shadowed units without noting the copy, or left some unpublished");
+        Require(report.find(" address 1/") != std::string::npos, "the address-based build's publish was not counted under its own reason:" + report);
+        const auto again = build({255, 0, 0, 255});
+        Require(!again.copied && again.current, "a second address-based build with nothing newly retiled recorded another copy");
+        draw({{0.0f, 1.0f, 0.0f, 1.0f}});
+        const auto pending = build({255, 0, 0, 255});
+        Require(StorageTexture::FindPending(address, bytes) == image, "an address-based build stored the pending results of an image over its heap");
+        Require(!pending.copied && pending.current, "an address-based build changed the heap while an image's results were pending");
+        StorageTexture::FlushPending(address, bytes, nullptr, "memory access");
+        settle();
+    }
+    recorder.Sync();
+    std::cout << "address-based builds read the unit shadow's stored results (address space cache " << (std::getenv("APS5_NO_ADDRESS_SPACE_CACHE") != nullptr ? "off" : "on") << ")\n";
+    return true;
+}
+
+bool completionStoreShadowTests(const Device& device, Recorder& recorder) {
+    const auto& base = device.GetContext();
+    if (!UnitShadowEnabled() || base.hostImportAlignment == 0) {
+        std::cout << "skipped, unit shadows or host imports are unavailable\n";
+        return false;
+    }
+    const auto decided = PrepareImportWatch(base);
+#ifndef _WIN32
+    const auto probe = ProbeImportWriteProtection(base);
+    if (probe.failure != nullptr || probe.writtenAtImport != 0 || probe.writtenAfterSubmit != 0) {
+        std::cout << "skipped, the device reports watched host memory written when it imports or reads it\n";
+        return false;
+    }
+    SetImportWatch(base, ImportWatch::Watch);
+#endif
+    struct Restore {
+        const Context& context;
+        ImportWatch decided;
+        ~Restore() { SetImportWatch(context, decided); }
+    } restore{base, decided};
+    constexpr std::uint32_t width = 1024;
+    constexpr std::uint32_t height = 512;
+    constexpr std::size_t bytes = width * height * 4;
+    constexpr std::size_t allocated = bytes + 65536;
+    constexpr std::size_t storedOffset = 16;
+    void* block = AllocateWatched(allocated, 65536);
+    if (block == nullptr) {
+        std::cout << "skipped, no write watching\n";
+        return false;
+    }
+    struct Release {
+        void* block;
+        ~Release() { ReleaseWatched(block, allocated); }
+    } release{block};
+    std::memset(block, 0x55, bytes);
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, bytes, true, true, true);
+    }
+    struct Unregister {
+        const Context& context;
+        void* block;
+        std::uint64_t address;
+        ~Unregister() {
+            {
+                GuestAllocations::Mutation mutation;
+                mutation.Remove(block);
+            }
+            HostImportFor(context, address, bytes);
+        }
+    } unregister{base, block, address};
+    if (HostImportFor(base, address, bytes) == nullptr || !AgcDriver::GuestMemory::Watched(address, bytes)) {
+        std::cout << "skipped, the heap is not imported or not watched\n";
+        return false;
+    }
+    TextureDetiler detiler(base);
+    auto context = base;
+    context.detiler = &detiler;
+    GuestTextureResource resource{};
+    resource.baseAddress = address;
+    resource.width = width;
+    resource.height = height;
+    resource.mipCount = 1;
+    resource.tileMode = TextureTileMode::kR64KBX;
+    resource.dimension = TextureDimension::k2D;
+    resource.format = 56;
+    resource.dstSelX = 4;
+    resource.dstSelY = 5;
+    resource.dstSelZ = 6;
+    resource.dstSelW = 7;
+    Require(DescribeSurface(resource).guestBytes == bytes, "the heap's surface has an unexpected size");
+    const auto settle = [&] {
+        recorder.Submit();
+        device.WaitQueue();
+        recorder.Sync();
+    };
+    constexpr std::array<std::byte, 4> stored{std::byte{0x77}, std::byte{0x77}, std::byte{0x77}, std::byte{0x77}};
+    std::vector<std::byte> read(bytes);
+    const auto run = [&](bool shadowed) {
+        std::memset(block, 0x55, bytes);
+        {
+            auto image = StorageTexture::Create(context, detiler, resource, 0);
+            const VkImageSubresourceRange range{VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+            const auto commands = recorder.Commands();
+            recorder.Keep(image);
+            RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_WRITE_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_ACCESS_TRANSFER_WRITE_BIT);
+            const VkClearColorValue red{{1.0f, 0.0f, 0.0f, 1.0f}};
+            context.Function<PFN_vkCmdClearColorImage>("vkCmdClearColorImage")(commands, image->Image(), VK_IMAGE_LAYOUT_GENERAL, &red, 1, &range);
+            RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
+            image->MarkDirty();
+            settle();
+            Require(StorageTexture::FindPending(address, bytes) == image, "the cleared image's results are not pending");
+            if (shadowed) {
+                StorageTexture::FlushPending(address, bytes, nullptr, "storage refresh", PublishScope::None);
+                settle();
+                if (!AnyShadowedOverlaps(address, bytes)) return false;
+                Require(StorageTexture::FindPending(address, bytes) == nullptr, "the image's results stayed pending after their write-back into the unit shadow");
+            }
+            recorder.OnComplete([&] { AgcDriver::GuestMemory::Write(address + storedOffset, stored, 4); });
+            settle();
+            AgcDriver::GuestMemory::Read(address, read, 4);
+            settle();
+        }
+        recorder.Sync();
+        const std::string over = shadowed ? "a shadowed unit" : "a pending image";
+        Require(std::equal(stored.begin(), stored.end(), read.begin() + storedOffset), "a CPU store inside a completion did not reach guest memory over " + over);
+        std::size_t lost = 0;
+        for (std::size_t i = 0; i < bytes; ++i) {
+            if (i >= storedOffset && i < storedOffset + stored.size()) continue;
+            const auto expected = std::array<std::uint8_t, 4>{255, 0, 0, 255}[i % 4];
+            if (static_cast<std::uint8_t>(read[i]) != expected) ++lost;
+        }
+        Require(lost == 0, "a CPU store inside a completion over " + over + " lost " + std::to_string(lost) + " bytes of the image's results around it");
+        return true;
+    };
+    run(false);
+    if (!run(true)) {
+        std::cout << "skipped, the image's write-back did not retile into the unit shadow\n";
+        return false;
+    }
+    std::cout << "a CPU store inside a completion keeps the results of a pending image and of a shadowed unit around it\n";
+    return true;
+}
+
 bool writtenBufferOrderTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
     if (base.hostImportAlignment == 0) {
@@ -6333,7 +6937,6 @@ void refreshProofTests(const Device& device, Recorder& recorder) {
     recorder.Sync();
 }
 
-
 void unchangedCpuStampTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
     constexpr std::uint32_t side = 256;
@@ -6417,6 +7020,9 @@ void unchangedCpuStampTests(const Device& device, Recorder& recorder) {
                 context.Function<PFN_vkCmdClearColorImage>("vkCmdClearColorImage")(commands, image->Image(), VK_IMAGE_LAYOUT_GENERAL, &value, 1, &range);
                 RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
                 image->MarkDirty();
+                const std::array<std::pair<std::uint64_t, std::uint64_t>, 2> beside{{{address - 64, address - 16}, {address + surfaceBytes, address + surfaceBytes + 64}}};
+                const std::array<std::pair<std::uint64_t, std::uint64_t>, 2> touching{{{address - 64, address - 16}, {address + surfaceBytes - 4, address + surfaceBytes}}};
+                Require(!StorageTexture::AnyPendingOverlaps(beside) && StorageTexture::AnyPendingOverlaps(touching), "(c) " + what + ": a set of ranges beside the pending image or touching its last word was answered wrongly");
                 for (std::size_t i = 0; i < 4096; ++i) memory[offset + i] = pattern(offset + i);
                 if (changed) memory[offset + 16] = static_cast<std::uint8_t>(~pattern(offset + 16));
                 AgcDriver::GuestMemory::CollectWritesUncached(blockAddress, bytes);
@@ -6480,7 +7086,7 @@ void keptUnitSettleTests(const Device& device, Recorder& recorder) {
                     return;
                 }
                 if (direct) {
-                    if (block != nullptr) sceKernelMunmap(block, surfaceBytes);
+                    if (block != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(block), surfaceBytes);
                     if (physical >= 0) sceKernelReleaseDirectMemory(physical, surfaceBytes);
                     return;
                 }
@@ -7029,35 +7635,7 @@ public:
         const auto commands = start.commands;
         if (!continued) {
             recorder.PrepareSampleSlot();
-            if (context.graphicsPipelineLibrary) {
-                if (!transitioned) {
-                    transitioned = true;
-                    VkImageMemoryBarrier barrier{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
-                    barrier.dstAccessMask = VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT;
-                    barrier.oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
-                    barrier.newLayout = VK_IMAGE_LAYOUT_GENERAL;
-                    barrier.image = target.Image();
-                    barrier.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
-                    context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, 0, 0, nullptr, 0, nullptr, 1, &barrier);
-                }
-                VkRenderingAttachmentInfoKHR attachment{VK_STRUCTURE_TYPE_RENDERING_ATTACHMENT_INFO_KHR};
-                attachment.imageView = target.View();
-                attachment.imageLayout = VK_IMAGE_LAYOUT_GENERAL;
-                attachment.loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
-                attachment.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
-                VkRenderingInfoKHR rendering{VK_STRUCTURE_TYPE_RENDERING_INFO_KHR};
-                rendering.renderArea = {{0, 0}, {8, 8}};
-                rendering.layerCount = 1;
-                rendering.colorAttachmentCount = 1;
-                rendering.pColorAttachments = &attachment;
-                context.Resolved(&DeviceFunctions::cmdBeginRendering, "vkCmdBeginRenderingKHR")(commands, &rendering);
-            } else {
-                VkRenderPassBeginInfo begin{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
-                begin.renderPass = renderPass;
-                begin.framebuffer = framebuffer;
-                begin.renderArea = {{0, 0}, {8, 8}};
-                context.Function<PFN_vkCmdBeginRenderPass>("vkCmdBeginRenderPass")(commands, &begin, VK_SUBPASS_CONTENTS_INLINE);
-            }
+            begin(commands);
         }
         context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
         recorder.NoteSampledDraw(commands);
@@ -7066,10 +7644,48 @@ public:
         return continued;
     }
 
+    void Record(VkCommandBuffer commands) const {
+        begin(commands);
+        context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_GRAPHICS, pipeline);
+        context.Function<PFN_vkCmdDraw>("vkCmdDraw")(commands, 3, 1, 0, 0);
+        EndRenderPass(context, commands);
+    }
+
     static constexpr std::uint64_t Samples = 64;
 
 private:
     static constexpr std::uint64_t PassKey = 0xc0de;
+    void begin(VkCommandBuffer commands) const {
+        if (context.graphicsPipelineLibrary) {
+            if (!transitioned) {
+                transitioned = true;
+                VkImageMemoryBarrier barrier{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
+                barrier.dstAccessMask = VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT;
+                barrier.oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+                barrier.newLayout = VK_IMAGE_LAYOUT_GENERAL;
+                barrier.image = target.Image();
+                barrier.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+                context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, 0, 0, nullptr, 0, nullptr, 1, &barrier);
+            }
+            VkRenderingAttachmentInfoKHR attachment{VK_STRUCTURE_TYPE_RENDERING_ATTACHMENT_INFO_KHR};
+            attachment.imageView = target.View();
+            attachment.imageLayout = VK_IMAGE_LAYOUT_GENERAL;
+            attachment.loadOp = VK_ATTACHMENT_LOAD_OP_DONT_CARE;
+            attachment.storeOp = VK_ATTACHMENT_STORE_OP_STORE;
+            VkRenderingInfoKHR rendering{VK_STRUCTURE_TYPE_RENDERING_INFO_KHR};
+            rendering.renderArea = {{0, 0}, {8, 8}};
+            rendering.layerCount = 1;
+            rendering.colorAttachmentCount = 1;
+            rendering.pColorAttachments = &attachment;
+            context.Resolved(&DeviceFunctions::cmdBeginRendering, "vkCmdBeginRenderingKHR")(commands, &rendering);
+        } else {
+            VkRenderPassBeginInfo info{VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO};
+            info.renderPass = renderPass;
+            info.framebuffer = framebuffer;
+            info.renderArea = {{0, 0}, {8, 8}};
+            context.Function<PFN_vkCmdBeginRenderPass>("vkCmdBeginRenderPass")(commands, &info, VK_SUBPASS_CONTENTS_INLINE);
+        }
+    }
     void release() noexcept {
         const auto device = context.device;
         if (pipeline != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(device, pipeline, nullptr);
@@ -7417,6 +8033,24 @@ void sampleDumpTests(const Device& device, Recorder& recorder) {
     inPassSampleDumpTests(recorder, context, cover, words, address, target);
 }
 
+void uncountedPassTests(const Device& device) {
+    auto context = device.GetContext();
+    context.bufferDeviceAddress = false;
+    Recorder recorder(context);
+    CoverPass cover(context);
+    recorder.CountSamples();
+    Require(!recorder.QueuesSampleDumps(), "a recorder without buffer device addresses counted samples in segments");
+    const auto base = recorder.SamplesTotal();
+    cover.Draw(recorder);
+    recorder.RecordUncounted([&](VkCommandBuffer commands) { cover.Record(commands); });
+    cover.Draw(recorder);
+    recorder.Submit();
+    recorder.Sync();
+    const auto counted = recorder.SamplesTotal() - base;
+    Require(counted != 0, "the draws around an uncounted pass were not counted");
+    if (context.occlusionQueryPrecise) Require(counted == 2 * CoverPass::Samples, "the batch-wide occlusion query counted " + std::to_string(counted) + " samples, not the " + std::to_string(2 * CoverPass::Samples) + " of the two draws around an uncounted pass");
+}
+
 void cmaskPassTests(const Device& device, Recorder& recorder) {
     namespace GuestMemory = AgcDriver::GuestMemory;
     auto context = device.GetContext();
@@ -8110,6 +8744,106 @@ void multisampleGuestAccessTests(const Device& device, Recorder& recorder) {
     std::cout << "Multisampled target guest access tests passed\n";
 }
 
+void oneFragmentFmaskGuardTests(const Device& device) {
+    const auto& base = device.GetContext();
+    if (!device.NullDescriptors()) {
+        std::cout << "nullDescriptor unavailable: one-fragment FMASK guard not tested\n";
+        return;
+    }
+    constexpr std::uint32_t side = 64;
+    constexpr std::size_t bytes = 3u * 65536u;
+#ifdef _WIN32
+    void* block = VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+#else
+    void* block = std::aligned_alloc(65536, bytes);
+#endif
+    Require(block != nullptr, "cannot allocate the one-fragment FMASK block");
+    std::memset(block, 0, bytes);
+    const auto address = reinterpret_cast<std::uint64_t>(block);
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Add(block, bytes, true, true, true);
+    }
+    struct Unregister {
+        const Context& context;
+        void* block;
+        ~Unregister() {
+            ClearMultisampleTargets(context.device);
+            ClearCachedTextures(context.device);
+            {
+                GuestAllocations::Mutation mutation;
+                mutation.Remove(block);
+            }
+#ifdef _WIN32
+            VirtualFree(block, 0, MEM_RELEASE);
+#else
+            std::free(block);
+#endif
+        }
+    } unregister{base, block};
+    TextureDetiler detiler(base);
+    auto context = base;
+    context.detiler = &detiler;
+    context.nullDescriptors = true;
+    TextureCache cache(context);
+    context.textureCache = &cache;
+    const auto refused = [](const std::function<void()>& access, const std::string& what) {
+        std::string message;
+        try {
+            access();
+        } catch (const std::exception& error) {
+            message = error.what();
+        }
+        Require(message.find("FMASK") != std::string::npos && message.find("one-fragment color target") != std::string::npos, what + " of a host-drawn one-fragment target's FMASK did not throw: " + message);
+    };
+    ColorTarget target{};
+    target.extent = {128, 128};
+    target.samples = 1;
+    target.coverageSamples = 4;
+    target.fmaskAddress = address;
+    GuardOneFragmentFmask(context, target);
+    GuardOneFragmentFmask(context, target);
+    std::array<std::byte, 64> words{};
+    refused([&] { AgcDriver::GuestMemory::Read(address + 256u, words); }, "a CPU read");
+    refused([&] { RequireNoMultisampleTarget(address + 65535u, 1u, "a DMA copy"); }, "a DMA copy of the last guarded byte");
+    RequireNoMultisampleTarget(address + 65536u, 64u, "a DMA copy");
+    ShaderRecompiler::RecompileResult program;
+    ShaderRecompiler::DescriptorBinding binding;
+    binding.kind = ShaderRecompiler::DescriptorKind::SampledImage;
+    binding.role = ShaderRecompiler::DescriptorRole::GuestImages;
+    binding.descriptorSet = 0;
+    binding.binding = ShaderRecompiler::RuntimeAbi::FirstImageBinding;
+    binding.count = 1;
+    binding.imageShape = ShaderRecompiler::DescriptorImageShape::Image2D;
+    binding.imageSamplers = {0};
+    binding.guestDescriptor = {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (56u << 20u) | (((side - 1u) & 3u) << 30u),
+        ((side - 1u) >> 2u) | ((side - 1u) << 14u),
+        0xfacu | (9u << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+    program.bindings.push_back(binding);
+    const CompiledShader compute{ShaderRecompiler::ShaderStage::Compute, &program, 0};
+    for (const char* what : {"a texture read", "a repeated texture read"}) {
+        refused([&] {
+            std::lock_guard gpu(GpuMutex());
+            ShaderResources resources(context, compute);
+        }, what);
+    }
+    {
+        GuestAllocations::Mutation mutation;
+        mutation.Unmap(block, bytes, [](const void*, std::size_t, const void*, bool) {});
+        mutation.Add(block, bytes, true, true, true);
+    }
+    AgcDriver::GuestMemory::Read(address + 256u, words);
+    RequireNoMultisampleTarget(address, 65536u, "a DMA copy");
+    std::cout << "One-fragment FMASK guard tests passed\n";
+}
+
 void fmaskDecompressMsaaTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
     if ((base.limits.framebufferColorSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0 || base.hostImportAlignment == 0) {
@@ -9151,6 +9885,109 @@ void pipelineCacheTests(const Device& device, bool benchmark) {
     std::cout << "Pipeline cache key and retained lifetime tests passed\n";
 }
 
+struct PipelineCacheFileProbe {
+    Context& context;
+    PFN_vkGetDeviceProcAddr resolver;
+    std::atomic<std::uint32_t> creations{0};
+    static inline PipelineCacheFileProbe* active = nullptr;
+    explicit PipelineCacheFileProbe(Context& context) : context(context), resolver(context.deviceProc) {
+        Require(active == nullptr, "pipeline cache file probe is already active");
+        active = this;
+        context.deviceProc = resolve;
+    }
+    ~PipelineCacheFileProbe() {
+        context.deviceProc = resolver;
+        active = nullptr;
+    }
+    static VKAPI_ATTR VkResult VKAPI_CALL createCache(VkDevice device, const VkPipelineCacheCreateInfo* info, const VkAllocationCallbacks* callbacks, VkPipelineCache* created) {
+        ++active->creations;
+        return reinterpret_cast<PFN_vkCreatePipelineCache>(active->resolver(device, "vkCreatePipelineCache"))(device, info, callbacks, created);
+    }
+    static VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL resolve(VkDevice device, const char* name) {
+        if (std::strcmp(name, "vkCreatePipelineCache") == 0) return reinterpret_cast<PFN_vkVoidFunction>(createCache);
+        return active->resolver(device, name);
+    }
+};
+
+void pipelineCacheHeaderTests(const Device& device) {
+    const auto root = std::filesystem::temp_directory_path() / ("aps5-pipeline-header-test-" + std::to_string(std::random_device{}()));
+    Require(root.native().size() < 225, "the pipeline cache header test requires a temporary root shorter than 225 characters");
+#ifdef _WIN32
+    std::error_code cleanupError;
+    const auto cleanupRoot = ShaderRecompiler::NativeCachePath_nid_no_patch(root, cleanupError);
+    Require(!cleanupError, "the pipeline cache header test could not resolve its cleanup directory");
+#else
+    const auto& cleanupRoot = root;
+#endif
+    struct RemoveDirectory {
+        std::filesystem::path directory;
+        ~RemoveDirectory() {
+            std::error_code error;
+            std::filesystem::remove_all(directory, error);
+        }
+    } removeDirectory{cleanupRoot};
+    auto directory = root;
+    char version[17];
+    std::snprintf(version, sizeof(version), "%016llx", static_cast<unsigned long long>(ShaderRecompiler::ShaderDiskCache::Generated::SourceVersion));
+    while ((directory / version).native().size() < 220) {
+        const auto length = (directory / version).native().size();
+        const auto remaining = 245 > length ? 245 - length : 1;
+        const auto chunk = std::min<std::size_t>(remaining, 16);
+        directory /= std::string(chunk, 'd');
+    }
+    const auto versionDirectory = directory / version;
+    Require(versionDirectory.native().size() >= 220 && versionDirectory.native().size() <= 249, "the pipeline cache directory is not between 220 and 249 characters");
+#ifdef _WIN32
+    _putenv_s("ANYPS5_NO_SHADER_CACHE", "0");
+    _putenv_s("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str());
+#else
+    setenv("ANYPS5_NO_SHADER_CACHE", "0", 1);
+    setenv("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str(), 1);
+#endif
+    auto context = device.GetContext();
+    PipelineCacheFileProbe probe(context);
+    PipelineCache cache(context, device.Properties());
+    cache.SaveNow();
+    std::vector<std::filesystem::path> files;
+    for (const auto& entry : std::filesystem::directory_iterator(versionDirectory)) files.push_back(entry.path());
+    Require(files.size() == 1 && files.front().filename().string().starts_with("vk-pipelines-"), "the long pipeline cache directory does not hold exactly one cache file");
+    Require(files.front().native().size() > 260, "the pipeline cache header test did not exceed MAX_PATH");
+    std::vector<std::byte> stored;
+    Require(ShaderRecompiler::ReadWholeFile(files.front(), stored) && !stored.empty(), "the long pipeline cache file was not persisted");
+    const auto creations = probe.creations.load();
+    for (int repeat = 0; repeat < 3; ++repeat) cache.SaveNow();
+    Require(probe.creations.load() == creations, "an unchanged long-path pipeline cache was reloaded for an idle save");
+    std::vector<std::byte> after;
+    Require(ShaderRecompiler::ReadWholeFile(files.front(), after) && after == stored, "an idle save changed the long pipeline cache file");
+#ifdef _WIN32
+    std::error_code lockError;
+    const auto lockNative = ShaderRecompiler::NativeCachePath_nid_no_patch(files.front(), lockError);
+    Require(!lockError, "could not resolve long cache path");
+    struct FileLockGuard {
+        HANDLE handle = INVALID_HANDLE_VALUE;
+        ~FileLockGuard() {
+            if (handle != INVALID_HANDLE_VALUE) CloseHandle(handle);
+        }
+    } lockGuard{CreateFileW(lockNative.c_str(), GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr)};
+    Require(lockGuard.handle != INVALID_HANDLE_VALUE, "could not lock pipeline cache file");
+    std::string capturedStderr;
+    {
+        StderrCapture capture;
+        PipelineCache lockedCache(context, device.Properties());
+        lockedCache.SaveNow();
+        capturedStderr = capture.Finish();
+    }
+    Require(capturedStderr.find("cannot read") != std::string::npos, "an unreadable long pipeline cache file did not report the cannot read diagnostic");
+    if (lockGuard.handle != INVALID_HANDLE_VALUE) {
+        CloseHandle(lockGuard.handle);
+        lockGuard.handle = INVALID_HANDLE_VALUE;
+    }
+    std::vector<std::byte> retained;
+    Require(ShaderRecompiler::ReadWholeFile(files.front(), retained) && retained == stored, "an unreadable long pipeline cache file was overwritten");
+#endif
+    std::cout << "long-path pipeline cache header reused without reloading\n";
+}
+
 int pipelineCacheFileTests(const Device& device) {
     const auto& context = device.GetContext();
     const auto directory = std::filesystem::temp_directory_path() / ("aps5-pipeline-cache-file-test-" + std::to_string(std::random_device{}()));
@@ -9163,7 +10000,7 @@ int pipelineCacheFileTests(const Device& device) {
     } removeDirectory{directory};
 #ifdef _WIN32
     _putenv_s("ANYPS5_NO_SHADER_CACHE", "0");
-    _putenv_s("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str());
+    _wputenv_s(L"ANYPS5_SHADER_CACHE_DIR", directory.wstring().c_str());
 #else
     setenv("ANYPS5_NO_SHADER_CACHE", "0", 1);
     setenv("ANYPS5_SHADER_CACHE_DIR", directory.string().c_str(), 1);
@@ -10110,7 +10947,7 @@ int main(int argc, char** argv) {
         }
         std::unique_ptr<Device> created;
         try {
-            created = std::make_unique<Device>(argc == 2 && (std::string_view(argv[1]) == "--import-watch-other-family-only" || std::string_view(argv[1]) == "--deferred-settle-other-family-only" || std::string_view(argv[1]) == "--host-import-lifetime-other-family-only"));
+            created = std::make_unique<Device>(argc == 2 && (std::string_view(argv[1]) == "--import-watch-other-family-only" || std::string_view(argv[1]) == "--deferred-settle-other-family-only" || std::string_view(argv[1]) == "--host-import-lifetime-other-family-only" || std::string_view(argv[1]) == "--settle-write-order-other-family-only"));
         } catch (const std::exception& error) {
             if (std::getenv("ANYPS5_REQUIRE_VULKAN") != nullptr) throw;
             std::cout << "skipped, no usable Vulkan device: " << error.what() << '\n';
@@ -10149,6 +10986,14 @@ int main(int argc, char** argv) {
             }
             return deferredSettleTests(device) ? 0 : 77;
         }
+        if (argc == 2 && (std::string_view(argv[1]) == "--settle-write-order-only" || std::string_view(argv[1]) == "--settle-write-order-other-family-only")) {
+            if (std::string_view(argv[1]) == "--settle-write-order-other-family-only" && device.GetContext().settleFamily == device.GetContext().queueFamily) {
+                std::cout << "skipped, no other queue family to settle imports on\n";
+                return 77;
+            }
+            return settleWriteOrderTests(device) ? 0 : 77;
+        }
+        if (argc == 2 && std::string_view(argv[1]) == "--settle-wait-failure-only") return settleWaitFailureTests(device) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--settle-first-use-only") return settleFirstUseTests(device) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--settle-earlier-import-only") return settleEarlierImportTests(device) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--settle-retire-only") return settleRetireTests(device) ? 0 : 77;
@@ -10192,6 +11037,11 @@ int main(int argc, char** argv) {
             return pipelineCacheFileTests(device);
         }
 
+        if (argc == 2 && std::string_view(argv[1]) == "--pipeline-cache-header-only") {
+            pipelineCacheHeaderTests(device);
+            return 0;
+        }
+
         if (argc == 2 && std::string_view(argv[1]) == "--descriptor-pool-only") {
             descriptorPoolTests(device);
             return 0;
@@ -10212,6 +11062,12 @@ int main(int argc, char** argv) {
         std::cout << "host imports " << (PrepareImportWatch(device.GetContext()) == ImportWatch::Unwatch ? "are compared" : "stay watched") << '\n';
         Recorder recorder(device.GetContext());
         recorder.Activate();
+        if (argc == 2 && std::string_view(argv[1]) == "--command-reuse-only") {
+            if (device.GetContext().hostImportAlignment == 0) return 77;
+            const auto before = Recorder::StoreCounts().stores;
+            storeRunTests(device, recorder);
+            return Recorder::StoreCounts().stores != before ? 0 : 77;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--copied-direct-only") {
             copiedDirectOrderingTests(device, recorder);
             return 0;
@@ -10281,6 +11137,11 @@ int main(int argc, char** argv) {
             std::cout << "Completion label storage and ordering tests passed\n";
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--bda-staging-only") {
+            if (!bdaStagingTests(device, recorder)) return 77;
+            std::cout << "address-based staging tests passed\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--read-written-staging-only") {
             if (!readWrittenStagingTests(device, recorder)) return 77;
             std::cout << "read and written staging tests passed\n";
@@ -10338,6 +11199,12 @@ int main(int argc, char** argv) {
             }
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--bda-shadowed-results-only") {
+            return addressShadowTests(device, recorder) ? 0 : 77;
+        }
+        if (argc == 2 && std::string_view(argv[1]) == "--completion-store-shadow-only") {
+            return completionStoreShadowTests(device, recorder) ? 0 : 77;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--split-writeback-only") {
             if (device.GetContext().hostImportAlignment == 0) {
                 std::cout << "skipped, host imports are unavailable\n";
@@ -10402,6 +11269,15 @@ int main(int argc, char** argv) {
             std::cout << "Occlusion counter dump tests passed\n";
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--uncounted-passes-only") {
+            if (!device.Graphics()) {
+                std::cout << "skipped, the test queue has no graphics\n";
+                return 77;
+            }
+            uncountedPassTests(device);
+            std::cout << "Uncounted pass tests passed\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--shadowed-key-stores-only") {
             if (!shadowedKeyStoreTests(device, recorder)) {
                 std::cout << "skipped, the device imports no watched host memory under a unit shadow\n";
@@ -10422,6 +11298,7 @@ int main(int argc, char** argv) {
         }
         if (argc == 2 && std::string_view(argv[1]) == "--multisample-only") {
             multisampleGuestAccessTests(device, recorder);
+            oneFragmentFmaskGuardTests(device);
             fmaskDecompressMsaaTests(device, recorder);
             return 0;
         }
@@ -10440,6 +11317,7 @@ int main(int argc, char** argv) {
         }
         if (argc == 2 && std::string_view(argv[1]) == "--draw-snapshot-cap-only") {
             drawSnapshotCapTests(device, recorder);
+            containingSnapshotTests(device);
             unwrittenSnapshotTests(device);
             drawSnapshotUploadTests(device, recorder);
             std::cout << "Draw snapshot cap tests passed\n";
@@ -10479,8 +11357,10 @@ int main(int argc, char** argv) {
         refreshProofTests(device, recorder);
         resourceReadTests(device, recorder);
         readWrittenStagingTests(device, recorder);
+        bdaStagingTests(device, recorder);
         depthSurfaceProofTests(device, recorder);
         multisampleGuestAccessTests(device, recorder);
+        oneFragmentFmaskGuardTests(device);
         tiledResolveTests(device, recorder);
         fmaskDecompressMsaaTests(device, recorder);
         misalignedSnapshotTests(device, recorder);
@@ -10491,6 +11371,7 @@ int main(int argc, char** argv) {
         imageTableFirstLayerRevalidateTests(device, recorder);
         drawSnapshotCapTests(device, recorder);
         drawSnapshotEvictionTests(device);
+        containingSnapshotTests(device);
         unwrittenSnapshotTests(device);
         drawSnapshotUploadTests(device, recorder);
         drawInputReuseTests(device, recorder);
diff --git a/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp b/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp
index a17b7cf87d..8dfde5e87e 100644
--- a/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/RedundantValueElimination.cpp
@@ -1,4 +1,5 @@
 #include "IntermediateRepresentation/IrProgram.hpp"
+#include "Optimization/DeadCodeEliminator.hpp"
 #include "Optimization/RedundantValueEliminator.hpp"
 #include "Recompiler.hpp"
 #include <array>
@@ -324,6 +325,149 @@ int main() {
         return b.eliminate() == 1u && !dominated.HasUses() && first.UseCount() == 2u && AllUsed({&thenOnly, &sibling, &merged});
     });
 
+    passed &= run("GetSrtResource and ReadConst with the same operands merge in a dominated block, while another slot or a sibling block stays", [] {
+        Builder b;
+        IrBlock& head = *b.block;
+        IrBlock& then = b.newBlock();
+        IrBlock& otherwise = b.newBlock();
+        IrBlock& merge = b.newBlock();
+        head.AddBranch(&then);
+        head.AddBranch(&otherwise);
+        then.AddBranch(&merge);
+        otherwise.AddBranch(&merge);
+        auto& srtHead = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(0u)});
+        auto& readHead = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtHead, &b.constant(2u)});
+        b.keep(readHead);
+        b.block = &then;
+        auto& srtDominated = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(0u)});
+        auto& readDominated = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtDominated, &b.constant(2u)});
+        auto& readOtherSlot = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtDominated, &b.constant(3u)});
+        auto& srtThenOnly = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(1u)});
+        auto& readThenOnly = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtThenOnly, &b.constant(4u)});
+        b.keep(readDominated);
+        b.keep(readOtherSlot);
+        b.keep(readThenOnly);
+        b.block = &otherwise;
+        auto& srtSibling = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(1u)});
+        auto& readSibling = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtSibling, &b.constant(4u)});
+        b.keep(readSibling);
+        b.block = &merge;
+        auto& srtMerge = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {&b.constant(0u)});
+        auto& readMerge = b.emit(IrOpcode::ReadConst, IrType::U32, {&srtMerge, &b.constant(2u)});
+        b.keep(readMerge);
+        return b.eliminate() == 4u && !srtDominated.HasUses() && !readDominated.HasUses() && !srtMerge.HasUses() && !readMerge.HasUses() && srtHead.UseCount() == 4u && readHead.UseCount() == 3u && AllUsed({&readOtherSlot, &srtThenOnly, &readThenOnly, &srtSibling, &readSibling});
+    });
+
+    passed &= run("two ReadConst instructions of the same slot separated by a store to the table address stay", [] {
+        Builder b;
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& first = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        auto& second = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(first);
+        b.keep(second);
+        return b.eliminate() == 0u && AllUsed({&first, &second});
+    });
+
+    passed &= run("a store on one branch keeps ReadConst in the merge block while the clean sibling branch reuses the head read", [] {
+        Builder b;
+        IrBlock& head = *b.block;
+        IrBlock& then = b.newBlock();
+        IrBlock& otherwise = b.newBlock();
+        IrBlock& merge = b.newBlock();
+        head.AddBranch(&then);
+        head.AddBranch(&otherwise);
+        then.AddBranch(&merge);
+        otherwise.AddBranch(&merge);
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& readHead = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readHead);
+        b.block = &then;
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        auto& readThenAfterStore = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readThenAfterStore);
+        b.block = &otherwise;
+        auto& readOtherwise = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readOtherwise);
+        b.block = &merge;
+        auto& readMerge = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(readMerge);
+        return b.eliminate() == 1u && !readOtherwise.HasUses() && readHead.UseCount() == 2u && AllUsed({&readHead, &readThenAfterStore, &readMerge});
+    });
+
+    passed &= run("a store on a loop backedge prevents reusing a pre-loop ReadConst in the loop header", [] {
+        Builder b;
+        IrBlock& header = b.newBlock();
+        IrBlock& body = b.newBlock();
+        IrBlock& exit = b.newBlock();
+        b.block->AddBranch(&header);
+        header.AddBranch(&body);
+        header.AddBranch(&exit);
+        body.AddBranch(&header);
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& beforeLoop = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(beforeLoop);
+        b.block = &header;
+        auto& inHeader = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inHeader);
+        b.block = &body;
+        auto& inBodyBeforeStore = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        auto& inBodyAfterStore = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inBodyBeforeStore);
+        b.keep(inBodyAfterStore);
+        b.block = &exit;
+        auto& afterLoop = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(afterLoop);
+        return b.eliminate() == 2u && !inBodyBeforeStore.HasUses() && !afterLoop.HasUses() && beforeLoop.UseCount() == 1u && inHeader.UseCount() == 3u && AllUsed({&beforeLoop, &inHeader, &inBodyAfterStore});
+    });
+
+    passed &= run("a store in an inner loop propagates to the outer loop header across fixed-point iterations", [] {
+        Builder b;
+        IrBlock& outerHeader = b.newBlock();
+        IrBlock& innerHeader = b.newBlock();
+        IrBlock& innerBody = b.newBlock();
+        IrBlock& outerLatch = b.newBlock();
+        IrBlock& exit = b.newBlock();
+        b.block->AddBranch(&outerHeader);
+        outerHeader.AddBranch(&innerHeader);
+        outerHeader.AddBranch(&exit);
+        innerHeader.AddBranch(&innerBody);
+        innerHeader.AddBranch(&outerLatch);
+        innerBody.AddBranch(&innerHeader);
+        outerLatch.AddBranch(&outerHeader);
+        auto& tableAddress = b.emit(IrOpcode::GetAddressResource, IrType::AddressResource, {&b.constant(0x1000u), &b.constant(0u)});
+        auto& tableRead = b.emit(IrOpcode::LoadAddressU32, IrType::U32, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.truth()});
+        b.program.Resources().srtReads.push_back({&tableRead, 0u});
+        auto& srt = b.emit(IrOpcode::GetSrtResource, IrType::SrtResource, {});
+        auto& beforeOuter = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(beforeOuter);
+        b.block = &outerHeader;
+        auto& inOuterHeader = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inOuterHeader);
+        b.block = &innerHeader;
+        auto& inInnerHeader = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inInnerHeader);
+        b.block = &innerBody;
+        static_cast<void>(b.emit(IrOpcode::StoreAddressU32, IrType::Void, {&tableAddress, &b.constant(8u), &b.constant(0u), &b.constant(7u), &b.truth()}));
+        b.block = &outerLatch;
+        auto& inOuterLatch = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inOuterLatch);
+        b.block = &exit;
+        auto& inExit = b.emit(IrOpcode::ReadConst, IrType::U32, {&srt, &b.constant(0u)});
+        b.keep(inExit);
+        return b.eliminate() == 2u && !inOuterLatch.HasUses() && !inExit.HasUses() && beforeOuter.UseCount() == 1u && inOuterHeader.UseCount() == 2u && inInnerHeader.UseCount() == 2u && AllUsed({&beforeOuter, &inOuterHeader, &inInnerHeader});
+    });
+
     passed &= run("a loop body reuses a value of its header, the loop exit does not reuse a value of the body", [] {
         Builder b;
         IrBlock& header = b.newBlock();
@@ -362,6 +506,55 @@ int main() {
         return b.eliminate() == 1u && b.program.Metadata().blockInfo.front().condition == &first;
     });
 
+    passed &= run("descriptor dwords name the surviving values after redundancy and dead code elimination", [] {
+        Builder b;
+        auto& input = b.unknown();
+        DescriptorSource descriptor;
+        descriptor.dwordCount = 8u;
+        std::array<IrValue*, 8> kept{};
+        std::array<IrValue*, 8> removed{};
+        for (std::uint32_t index = 0; index < 8u; ++index) {
+            auto& first = b.emit(IrOpcode::IAdd32, IrType::U32, {&input, &b.constant(index + 1u)});
+            auto& second = b.emit(IrOpcode::IAdd32, IrType::U32, {&input, &b.constant(index + 1u)});
+            b.keep(first);
+            b.keep(second);
+            descriptor.dwords[index] = &second;
+            kept[index] = &first;
+            removed[index] = &second;
+        }
+        b.program.Resources().descriptorSources.push_back(descriptor);
+        b.program.Resources().descriptorSources.emplace_back();
+        if (b.eliminate() != 8u) return false;
+        DeadCodeEliminator{}.Eliminate(b.program);
+        const auto& descriptors = b.program.Resources().descriptorSources;
+        for (std::size_t index = 0; index < kept.size(); ++index) {
+            if (descriptors[0].dwords[index] != kept[index] || kept[index]->Parent() != b.block || removed[index]->Parent() != nullptr || descriptors[1].dwords[index] != nullptr) return false;
+        }
+        return true;
+    });
+
+    passed &= run("a selected table column keeps its surviving runtime offset", [] {
+        Builder b;
+        auto& input = b.unknown();
+        auto& first = b.emit(IrOpcode::IMul32, IrType::U32, {&input, &b.constant(48u)});
+        auto& second = b.emit(IrOpcode::IMul32, IrType::U32, {&input, &b.constant(48u)});
+        b.keep(first);
+        b.keep(second);
+        DescriptorSource selection;
+        selection.dwordCount = 1u;
+        selection.dwords[0] = &second;
+        DescriptorSource image;
+        image.tableColumn.emplace();
+        image.tableColumn->selected = true;
+        image.tableColumn->selection = 0u;
+        b.program.Resources().descriptorSources = {selection, image};
+        if (b.eliminate() != 1u) return false;
+        DeadCodeEliminator{}.Eliminate(b.program);
+        const auto& descriptors = b.program.Resources().descriptorSources;
+        const auto selected = descriptors[1].tableColumn->selection;
+        return descriptors[selected].dwords[0] == &first && first.Parent() == b.block && second.Parent() == nullptr;
+    });
+
     passed &= run("lane reads are not merged", [] {
         Builder b;
         auto& first = b.unknown();
diff --git a/core/libs/prx/libSceAgcDriver/tests/SavedExecMaskLoop.hpp b/core/libs/prx/libSceAgcDriver/tests/SavedExecMaskLoop.hpp
new file mode 100644
index 0000000000..d6aa73bc18
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/SavedExecMaskLoop.hpp
@@ -0,0 +1,19 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_SAVEDEXECMASKLOOP_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_SAVEDEXECMASKLOOP_HPP
+
+#include <cstdint>
+#include <vector>
+
+namespace AgcTest {
+
+inline std::vector<std::uint32_t> SavedExecMaskLoop(std::uint32_t rounds) {
+    std::vector<std::uint32_t> code{0xbea2047eu, 0xbea40380u};
+    for (std::uint32_t step = 0; step < rounds; ++step) code.insert(code.end(), {0xbefe0422u, 0x7c080080u, 0x8aa26a7eu});
+    const auto branch = 0xbf850000u | static_cast<std::uint16_t>(2 - static_cast<int>(code.size() + 3));
+    code.insert(code.end(), {0x80248124u, 0xbf0a8424u, branch, 0xbefe0422u});
+    return code;
+}
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/Screenshot.cpp b/core/libs/prx/libSceAgcDriver/tests/Screenshot.cpp
index e6202ceb1a..4adf0c824d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Screenshot.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Screenshot.cpp
@@ -21,9 +21,9 @@ void require(bool condition, const char* message) {
 
 void setScreenshotDirectory(const std::filesystem::path& directory) {
 #ifdef _WIN32
-    require(_putenv_s("ANYPS5_SCREENSHOTS", directory.string().c_str()) == 0, "set ANYPS5_SCREENSHOTS");
+    require(_wputenv_s(L"ANYPS5_SCREENSHOTS", directory.wstring().c_str()) == 0, "set ANYPS5_SCREENSHOTS");
 #else
-    require(::setenv("ANYPS5_SCREENSHOTS", directory.string().c_str(), 1) == 0, "set ANYPS5_SCREENSHOTS");
+    require(::setenv("ANYPS5_SCREENSHOTS", directory.c_str(), 1) == 0, "set ANYPS5_SCREENSHOTS");
 #endif
 }
 
@@ -73,7 +73,7 @@ void rejectsInvalidFrames() {
 
 int main() try {
     const auto root = std::filesystem::temp_directory_path() / ("anyps5_screenshot-" + std::to_string(std::random_device{}()));
-    const auto directory = root / "nested";
+    const auto directory = root / std::filesystem::path(u8"nested-a\u00e7\u00e3o-\u65e5\u672c");
     std::filesystem::remove_all(root);
     setScreenshotDirectory(directory);
     requestsMerge();
diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp
index 8ef8dfde37..cc86441030 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ShaderDiskCache.cpp
@@ -62,11 +62,19 @@ void setEnvironment(const char* name, const std::string& value) {
 #endif
 }
 
+void setPathEnvironment(const char* name, const std::filesystem::path& value) {
+#ifdef _WIN32
+    _wputenv_s(std::filesystem::path(name).wstring().c_str(), value.wstring().c_str());
+#else
+    setenv(name, value.c_str(), 1);
+#endif
+}
+
 #ifdef _WIN32
 void verifyHostStandardError() {
     const auto directory = std::filesystem::temp_directory_path() / ("aps5-shader-host-stderr-" + std::to_string(std::random_device{}()));
     setEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
-    setEnvironment("ANYPS5_SHADER_CACHE_DIR", directory.string());
+    setPathEnvironment("ANYPS5_SHADER_CACHE_DIR", directory);
     int capture[2], guest[2];
     require(::_pipe(capture, 65536, _O_BINARY) == 0, "cannot create host capture");
     require(::_pipe(guest, 65536, _O_BINARY) == 0, "cannot create guest capture");
@@ -148,6 +156,7 @@ void requireSameArtifact(const CompiledShaderArtifact& left, const CompiledShade
     require(left.parameterExports == right.parameterExports, prefix + "parameter exports differ");
     require(left.stencilReferences == right.stencilReferences, prefix + "stencil reference set differs");
     require(left.stencilReplaySafe == right.stencilReplaySafe, prefix + "stencil replay proof differs");
+    require(left.bdaWrites == right.bdaWrites, prefix + "BDA write flag differs");
     require(left.stencilReferenceDword == right.stencilReferenceDword, prefix + "stencil replay push offset differs");
     require(left.fragmentParameters.size() == right.fragmentParameters.size(), prefix + "fragment parameter count differs");
     for (std::size_t i = 0; i < left.fragmentParameters.size(); ++i) {
@@ -259,6 +268,7 @@ RecompileResult sampleResult() {
     result.fragmentParameters = {{0, 1, true, false, true}, {2, 3, false, true}};
     result.stencilReferences = {0u, 17u, 255u};
     result.stencilReplaySafe = true;
+    result.bdaWrites = true;
     result.stencilReferenceDword = 23u;
     result.poisonedSrtReads = 3;
     result.shaderDataUserWords = {2u, 0xffffffffu, 9u};
@@ -322,6 +332,7 @@ CompiledVariant sampleVariant() {
     image.volumeArraySampleCompatible = true;
     image.flatLineCompatible = false;
     image.flatVolumeLineCompatible = false;
+    image.dimensionQueryOnly = false;
     image.foldTexelOffsetsOnly = true;
     image.remappedDepth1D = true;
     image.byElements = 4;
@@ -748,6 +759,7 @@ void verifyKeySensitivity() {
     changes("spanned waves", [](SampleRequest& sample) { sample.request.target.spannedWaves = true; });
     changes("robust buffer access 2", [](SampleRequest& sample) { sample.request.target.robustBufferAccess2 = true; });
     changes("wave LDS memory barriers", [](SampleRequest& sample) { sample.request.target.waveLdsMemoryBarriers = true; });
+    changes("device-scope LDS memory barriers", [](SampleRequest& sample) { sample.request.target.deviceScopeLdsMemoryBarriers = true; });
     changes("the workgroup size limit", [](SampleRequest& sample) { sample.request.target.maxWorkgroupSize[2] = 128; });
     changes("the invocation limit", [](SampleRequest& sample) { sample.request.target.maxWorkgroupInvocations = 512; });
     changes("the shared memory limit", [](SampleRequest& sample) { sample.request.target.maxWorkgroupSharedMemoryBytes = 32768; });
@@ -1070,7 +1082,7 @@ void verifyLongHostPaths() {
     const auto extended = [](const auto& path) { return std::filesystem::path(L"\\\\?\\" + path.native()); };
     std::filesystem::create_directories(extended(directory));
     setEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
-    setEnvironment("ANYPS5_SHADER_CACHE_DIR", directory.string());
+    setPathEnvironment("ANYPS5_SHADER_CACHE_DIR", directory);
     std::vector<std::filesystem::path> files;
     std::filesystem::path entries;
     struct Cleanup {
@@ -2117,6 +2129,36 @@ void verifyMalformedPlans() {
     require(!ShaderDiskCache::EncodePlan(unblocked, bytes), "a phi without predecessor blocks was encoded");
 }
 
+void verifySharedPlans() {
+    auto fixture = planFixtures().front();
+    const auto request = fixture.Request(false);
+    const auto plan = GetResourcePlan(request);
+    const std::vector<std::byte> first{std::byte{0x5a}, std::byte{0x01}, std::byte{0x02}};
+    const std::vector<std::byte> second{std::byte{0x5a}, std::byte{0x01}, std::byte{0x03}};
+    for (const auto* key : {&first, &second}) {
+        const auto entry = ShaderDiskCache::EncodePlanEntry(*key, *plan);
+        require(WriteFileAtomically(ShaderDiskCache::EntryDirectory() / ShaderDiskCache::EntryName(*key), entry), "cannot write the shared plan entries");
+    }
+    constexpr std::uint64_t address = 0x7000u;
+    IrResourcePlan expected;
+    require(ShaderDiskCache::DecodePlan(encodedPlan(*plan), expected), "the shared plan fixture does not decode");
+    expected.shaderHash = address;
+    const auto hits = ShaderDiskCache::Totals().planHits;
+    auto a = ShaderDiskCache::LoadSharedPlan(first, address);
+    auto b = ShaderDiskCache::LoadSharedPlan(second, address);
+    require(a != nullptr && b != nullptr && ShaderDiskCache::Totals().planHits == hits + 2u, "the shared plan entries did not load");
+    require(a.get() == b.get(), "two plan entries with the same payload for one shader decoded into separate plans");
+    require(samePlan(*a, expected), "a shared plan differs from the stored plan");
+    const auto other = ShaderDiskCache::LoadSharedPlan(second, address + 0x100u);
+    require(other != nullptr && other.get() != a.get() && other->shaderHash == address + 0x100u && a->shaderHash == address, "a plan of another shader address was shared");
+    const std::weak_ptr<const IrResourcePlan> released = a;
+    a.reset();
+    b.reset();
+    require(released.expired(), "the shared plan table kept a plan no source uses");
+    const auto again = ShaderDiskCache::LoadSharedPlan(first, address);
+    require(again != nullptr && samePlan(*again, expected), "a released shared plan did not load again");
+}
+
 void verifyPlanRoundTrip() {
     const auto handBuilt = handBuiltPlan();
     const auto handBytes = encodedPlan(handBuilt);
@@ -2496,7 +2538,7 @@ int main(int argc, char** argv) {
         std::filesystem::remove_all(directory);
         verifyDefaultDirectory(argv[0]);
         setEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
-        setEnvironment("ANYPS5_SHADER_CACHE_DIR", directory.string());
+        setPathEnvironment("ANYPS5_SHADER_CACHE_DIR", directory);
         verifyAtomicReplacement(directory);
         verifyResultRoundTrip();
         verifyEntryRoundTrip();
@@ -2507,6 +2549,7 @@ int main(int argc, char** argv) {
         verifyFloatModeSerialization();
         verifyPlanRoundTrip();
         verifyPlanKey();
+        verifySharedPlans();
         verifyStore();
         verifyPersist();
         verifyAcrossProcesses(argv[0]);
diff --git a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp
index 16e54ee281..4d7e4dc551 100644
--- a/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/ShaderMemory.cpp
@@ -20,6 +20,7 @@
 #include "IntermediateRepresentation/IrBuilder.hpp"
 #include "IntermediateRepresentation/IrProgram.hpp"
 #include "SpirvBackend/SpirvAnalysis.hpp"
+#include "SavedExecMaskLoop.hpp"
 #if ANYPS5_ENABLE_SPIRV_TOOLS
 #include "SpirvBackend/SpirvOptimizer.hpp"
 #endif
@@ -30,6 +31,7 @@
 #include "ShaderDiskCache.hpp"
 #include <spirv/unified1/spirv.hpp>
 #include <algorithm>
+#include <set>
 #include <array>
 #include <cstddef>
 #include <cstdlib>
@@ -168,7 +170,6 @@ void verifyFrontendIdentity() {
     require((preparation.AcquireFrontend(partial) == first) == reuse, "frontend pair: partial-thread state changed the frontend identity");
     auto target = request;
     target.target.subgroupSize = 64u;
-    target.context.waveSize = 32u;
     target.context.compute->numThreads = {32u, 2u, 1u};
     require((preparation.AcquireFrontend(target) == first) == reuse, "frontend pair: translation-only state changed the frontend identity");
     const std::array<std::uint32_t, 2> changedUserData{1u, 2u};
@@ -197,6 +198,10 @@ void verifyFrontendIdentity() {
     changed.context.userDataBaseRegister = 4u;
     verifyMiss(changed, "frontend pair: changed user-data base reused the frontend");
     changed = request;
+    changed.context.waveSize = 32u;
+    changed.context.compute->numThreads = {32u, 2u, 1u};
+    verifyMiss(changed, "frontend pair: a different wave size reused the frontend");
+    changed = request;
     changed.context.userData = std::span<const std::uint32_t>(userData).first(1u);
     verifyMiss(changed, "frontend pair: changed user-data count reused the frontend");
     changed = request;
@@ -222,6 +227,25 @@ void verifyFrontendIdentity() {
     require((preparation.AcquireFrontend(request) == first) == reuse, "frontend pair: a failed miss replaced the prior frontend");
 }
 
+void verifyFrontendWaveSizeCalls() {
+    using namespace ShaderRecompiler;
+    const std::vector<std::uint32_t> code{
+        0xbb0e0005u,
+        0xd4c2000eu, 0x00020300u,
+        0xd5010002u, 0x003a0300u,
+        0xbf820001u,
+        0xbe80200eu,
+        0xbf810000u};
+    const std::array<std::uint32_t, 2> userData{};
+    for (const std::uint32_t waveSize : {32u, 64u}) {
+        auto request = FrontendRequest(code, userData);
+        request.context.waveSize = waveSize;
+        request.context.compute->numThreads = {waveSize, 1u, 1u};
+        ShaderPreparationContext preparation;
+        require(preparation.AcquireFrontend(request) != nullptr, "frontend wave size: a mask write that reuses the link pair and its v_cndmask read were refused");
+    }
+}
+
 void verifyFrontendProgram(const ShaderRecompiler::IrProgram& reused, const ShaderRecompiler::IrProgram& fresh) {
     using namespace ShaderRecompiler;
     require(ProgramToString(reused) == ProgramToString(fresh), "frontend pair: reused frontend changed the IR");
@@ -256,6 +280,7 @@ void verifyFrontendProgram(const ShaderRecompiler::IrProgram& reused, const Shad
 void verifyFrontendPair() {
     using namespace ShaderRecompiler;
     verifyFrontendIdentity();
+    verifyFrontendWaveSizeCalls();
     const bool reuse = std::getenv("APS5_NO_PERF_FRONTEND_PAIR") == nullptr;
     const std::vector<std::uint32_t> code{0xe0700000u, 0x80000000u, 0xbf810000u};
     const std::array<std::uint32_t, 4> buffer{0x10000000u, 0u, 0x40u, 0x00027facu};
@@ -318,7 +343,7 @@ void verifyFrontendPair() {
         const auto freshChanged = PrepareResourceProgram(translated);
         verifyFrontendProgram(changed, freshChanged);
         require(changed.WaveSize() != freshFull.WaveSize(), "frontend pair: changed translation inputs were ignored");
-        require((preparation.AcquireFrontend(request) == retained) == reuse, "frontend pair: translating a variant replaced the frontend");
+        require(preparation.AcquireFrontend(request) != retained, "frontend pair: a variant with another wave size reused the frontend");
     }
 
     for (const bool partialFirst : {false, true}) {
@@ -542,6 +567,297 @@ void verifyRegisterSources() {
     require(!EquivalentValue(plan, &samplerRegister, &firstVector), "different register types were merged");
 }
 
+void verifyPlanConditionPruning() {
+    using namespace ShaderRecompiler;
+    std::vector<std::unique_ptr<IrValue>> values;
+    std::uint32_t ids = 0;
+    const auto make = [&](IrOpcode opcode, IrType type) -> IrValue& {
+        values.push_back(std::make_unique<IrValue>(opcode, type, ids++));
+        return *values.back();
+    };
+    const auto constant = [&](std::uint32_t value) -> IrValue& {
+        auto& immediate = make(IrOpcode::Void, IrType::U32);
+        immediate.SetImmediateU32(value);
+        return immediate;
+    };
+    const auto userData = [&](std::uint32_t index) -> IrValue& {
+        auto& reg = make(IrOpcode::Void, IrType::ScalarReg);
+        reg.SetRegister({RegisterBank::Scalar, index});
+        auto& read = make(IrOpcode::GetUserData, IrType::U32);
+        read.AddArgument(&reg);
+        return read;
+    };
+    const auto equal = [&](IrValue& left, IrValue& right) -> IrValue& {
+        auto& compare = make(IrOpcode::IEqual32, IrType::Bool);
+        compare.AddArgument(&left);
+        compare.AddArgument(&right);
+        return compare;
+    };
+    constexpr std::uint32_t Additions = 64;
+    IrValue* address = &userData(0);
+    for (std::uint32_t index = 0; index < Additions; ++index) {
+        auto& sum = make(IrOpcode::IAdd32, IrType::U32);
+        sum.AddArgument(address);
+        sum.AddArgument(&constant(4));
+        address = &sum;
+    }
+    auto& load = make(IrOpcode::LoadBufferU32, IrType::U32);
+    load.AddArgument(address);
+    auto& pair = make(IrOpcode::CompositeConstructU32x2, IrType::U32x2);
+    pair.AddArgument(&userData(1));
+    pair.AddArgument(&load);
+    auto& low = make(IrOpcode::CompositeExtractU32x2, IrType::U32);
+    low.AddArgument(&pair);
+    low.AddArgument(&constant(0));
+    static std::uint32_t word = 5;
+    const auto wordAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(&word));
+    auto& handle = make(IrOpcode::CompositeConstructU64, IrType::U64);
+    handle.AddArgument(&userData(2));
+    handle.AddArgument(&userData(3));
+    auto& read = make(IrOpcode::LoadAddressU32, IrType::U32);
+    read.SetFlags(MemoryFlags{0, 0});
+    read.AddArgument(&handle);
+    read.AddArgument(&constant(0));
+    IrProgram program;
+    auto& resources = program.Resources();
+    resources.srtPlanComplete = true;
+    resources.resourceTrackingComplete = true;
+    MemoryInfo memory;
+    memory.kind = ResourceKind::ScalarAddress;
+    resources.memoryInfo.push_back(memory);
+    resources.controlFlow.push_back({&equal(load, constant(0)), {1, 2}, {}, {}});
+    resources.controlFlow.push_back({&equal(low, constant(7)), {3, 4}, {}, {}});
+    resources.controlFlow.push_back({&equal(read, constant(5)), {5, 6}, {}, {}});
+    auto& choice = make(IrOpcode::SelectU32, IrType::U32);
+    choice.AddArgument(&equal(userData(4), constant(0)));
+    choice.AddArgument(&load);
+    choice.AddArgument(&constant(1));
+    resources.controlFlow.push_back({&equal(choice, constant(1)), {7, 8}, {}, {}});
+    const auto plan = ResourceMaterializer{}.ExtractPlan(program);
+    const auto copied = std::ranges::count_if(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::IAdd32; });
+    require(copied == 0, "plan pruning: the address computation under a load the evaluator cannot read was copied");
+    require(plan.controlFlow[0].condition == nullptr && plan.controlFlow[3].condition == nullptr, "plan pruning: a condition the evaluator can never read was kept");
+    require(plan.controlFlow[1].condition != nullptr && plan.controlFlow[2].condition != nullptr, "plan pruning: a condition the evaluator can read was dropped");
+    const auto copiedLoad = std::ranges::find_if(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::LoadBufferU32; });
+    require(copiedLoad != plan.valueStorage.end() && copiedLoad->ArgumentCount() == 0u, "plan pruning: the unevaluable load was not kept as a leaf");
+    require(std::ranges::all_of(plan.valueStorage, [](const IrValue& value) { return !value.HasUses() && value.OperandUses().empty() && value.Arguments().capacity() == value.ArgumentCount(); }), "plan compaction: a plan value keeps use lists or spare operand capacity");
+    const std::array<std::uint32_t, 4> data{0x100u, 7u, static_cast<std::uint32_t>(wordAddress), static_cast<std::uint32_t>(wordAddress >> 32u)};
+    SrtRuntime runtime{data};
+    Detail::Evaluator evaluator(plan, runtime);
+    std::uint32_t result = 0;
+    require(evaluator.Evaluate(Detail::IrNode(plan.controlFlow[1].condition), result) && result == 1u, "plan pruning: a condition read through an extracted pair was not evaluated");
+    require(evaluator.Evaluate(Detail::IrNode(plan.controlFlow[2].condition), result) && result == 1u, "plan pruning: a condition on a raw read lost its handle");
+}
+
+struct PlanWalk {
+    std::vector<ShaderRecompiler::DescriptorValue> results;
+    std::vector<std::uint32_t> flat;
+    std::vector<std::uint8_t> active;
+};
+
+PlanWalk walkPlan(const ShaderRecompiler::IrResourcePlan& plan, std::span<const std::uint32_t> sources, std::span<const std::uint8_t> cleanFlatSlots, const ShaderRecompiler::SrtRuntime& runtime) {
+    PlanWalk walk;
+    ShaderRecompiler::SrtWalker{}.EvaluateRuntimeSources(plan, sources, runtime, walk.results, walk.flat, cleanFlatSlots, walk.active);
+    return walk;
+}
+
+bool readFive(void*, std::uint64_t, std::uint32_t* value) {
+    *value = 5u;
+    return true;
+}
+
+void verifyPlanRetention() {
+    using namespace ShaderRecompiler;
+    std::vector<std::unique_ptr<IrValue>> values;
+    std::uint32_t ids = 0;
+    const auto make = [&](IrOpcode opcode, IrType type) -> IrValue& {
+        values.push_back(std::make_unique<IrValue>(opcode, type, ids++));
+        return *values.back();
+    };
+    const auto constant = [&](std::uint32_t value) -> IrValue& {
+        auto& immediate = make(IrOpcode::Void, IrType::U32);
+        immediate.SetImmediateU32(value);
+        return immediate;
+    };
+    const auto userData = [&](std::uint32_t index) -> IrValue& {
+        auto& reg = make(IrOpcode::Void, IrType::ScalarReg);
+        reg.SetRegister({RegisterBank::Scalar, index});
+        auto& read = make(IrOpcode::GetUserData, IrType::U32);
+        read.AddArgument(&reg);
+        return read;
+    };
+    const auto binary = [&](IrOpcode opcode, IrType type, IrValue& left, IrValue& right) -> IrValue& {
+        auto& value = make(opcode, type);
+        value.AddArgument(&left);
+        value.AddArgument(&right);
+        return value;
+    };
+    constexpr std::uint32_t Chain = 64;
+    IrValue* address = &userData(4);
+    for (std::uint32_t step = 0; step < Chain; ++step) address = &binary(IrOpcode::IAdd32, IrType::U32, *address, constant(1));
+    auto& load = make(IrOpcode::LoadBufferU32, IrType::U32);
+    load.AddArgument(address);
+    auto& low = binary(IrOpcode::CompositeExtractU32x2, IrType::U32, binary(IrOpcode::CompositeConstructU32x2, IrType::U32x2, userData(1), load), constant(0));
+    auto& mask = binary(IrOpcode::IEqual32, IrType::Bool, userData(5), constant(0));
+    auto& choice = make(IrOpcode::SelectU32, IrType::U32);
+    choice.AddArgument(&mask);
+    choice.AddArgument(&userData(6));
+    choice.AddArgument(&load);
+    auto& offset = binary(IrOpcode::ReadFirstLane, IrType::U32, choice, mask);
+    auto& read = binary(IrOpcode::LoadAddressU32, IrType::U32, binary(IrOpcode::CompositeConstructU64, IrType::U64, userData(2), userData(3)), offset);
+    read.SetFlags(MemoryFlags{0, 0});
+    IrProgram program;
+    auto& resources = program.Resources();
+    resources.srtPlanComplete = true;
+    resources.resourceTrackingComplete = true;
+    MemoryInfo memory;
+    memory.kind = ResourceKind::ScalarAddress;
+    resources.memoryInfo.push_back(memory);
+    for (std::uint32_t source = 0; source < 2u; ++source) {
+        DescriptorSource descriptor;
+        descriptor.dwordCount = 4;
+        for (std::uint32_t dword = 0; dword < 4u; ++dword) descriptor.dwords[dword] = &userData(10u + source * 4u + dword);
+        resources.descriptorSources.push_back(descriptor);
+        BufferResource buffer;
+        buffer.source = source;
+        resources.info.buffers.push_back(buffer);
+    }
+    resources.controlFlow.push_back({&binary(IrOpcode::IEqual32, IrType::Bool, low, constant(7)), {1, 2}, {0}, {}});
+    resources.controlFlow.push_back({&binary(IrOpcode::IEqual32, IrType::Bool, read, constant(5)), {3, 4}, {}, {}});
+    resources.controlFlow.push_back({nullptr, {}, {}, {}});
+    resources.controlFlow.push_back({nullptr, {}, {}, {}});
+    resources.controlFlow.push_back({nullptr, {}, {1}, {}});
+    const auto plan = ResourceMaterializer{}.ExtractPlan(program);
+    constexpr std::size_t Read = 40;
+    require(plan.valueStorage.Size() == Read, ("plan retention: the plan keeps " + std::to_string(plan.valueStorage.Size()) + " values; its conditions and descriptor sources read " + std::to_string(Read)).c_str());
+    require(std::ranges::none_of(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::IAdd32; }), "plan retention: the address under a vector load was copied");
+    const auto copiedLoad = std::ranges::find_if(plan.valueStorage, [](const IrValue& value) { return value.Opcode() == IrOpcode::LoadBufferU32; });
+    require(copiedLoad != plan.valueStorage.end() && copiedLoad->ArgumentCount() == 0u, "plan retention: the vector load was not kept as a leaf");
+    std::array<std::uint32_t, 18> userWords{};
+    userWords[1] = 7u;
+    userWords[2] = 0x1000u;
+    userWords[6] = 8u;
+    for (std::uint32_t word = 10; word < userWords.size(); ++word) userWords[word] = 0x100u + word;
+    SrtRuntime runtime{userWords};
+    runtime.readMemory = readFive;
+    runtime.readSpecializationMemory = readFive;
+    const auto copiedWalk = walkPlan(plan, plan.materializationSources, plan.cleanFlatSlots, runtime);
+    const std::array<std::uint32_t, 2> sources{0u, 1u};
+    const auto wholeWalk = walkPlan(program.Resources(), sources, {}, runtime);
+    require(wholeWalk.active == std::vector<std::uint8_t>{1u, 0u}, "plan retention: the program's walk did not decide both conditions");
+    require(copiedWalk.active == wholeWalk.active && copiedWalk.results == wholeWalk.results && copiedWalk.flat == wholeWalk.flat, "plan retention: the plan's walk differs from the program's");
+}
+
+void verifyPlanRetentionChains() {
+    using namespace ShaderRecompiler;
+    std::vector<std::size_t> kept;
+    std::vector<std::size_t> conditions;
+    for (const std::uint32_t chain : {1u, 16u, 64u}) {
+        std::vector<std::uint32_t> code{0xf4080600u, 0xfa000060u, 0xbf8cc07fu, 0x7e140300u};
+        code.insert(code.end(), chain, 0x4a141481u);
+        code.insert(code.end(), {0x34141482u, 0xe0301000u, 0x80060b0au, 0xbf8c0000u, 0x7e28050bu, 0xf4000540u, 0x28000000u, 0xf4080700u, 0xfa000020u, 0xbf8c0000u, 0xbf078015u, 0xbf840002u, 0xe0700000u, 0x80070000u, 0xbf810000u});
+        const std::array<std::uint32_t, 2> userData{0x10000u, 0u};
+        const auto plan = GetResourcePlan(FrontendRequest(code, userData));
+        kept.push_back(plan->valueStorage.Size());
+        conditions.push_back(static_cast<std::size_t>(std::ranges::count_if(plan->controlFlow, [](const ResourceBlock& block) { return block.condition != nullptr; })));
+    }
+    require(conditions.front() != 0u, "plan retention: the program's plan keeps no branch condition, so the test does not reach the condition's values");
+    require(kept[0] == kept[1] && kept[1] == kept[2], ("plan retention: the plan keeps " + std::to_string(kept[0]) + ", " + std::to_string(kept[1]) + " and " + std::to_string(kept[2]) + " values for vector chains of 1, 16 and 64 steps before the scalar load its branch condition reads; it must keep only what the condition's evaluation can reach").c_str());
+}
+
+void verifyPlanCopyAnswers() {
+    using namespace ShaderRecompiler;
+    std::vector<std::unique_ptr<IrValue>> values;
+    std::vector<std::unique_ptr<IrBlock>> blocks;
+    std::uint32_t ids = 0;
+    const auto make = [&](IrOpcode opcode, IrType type) -> IrValue& {
+        values.push_back(std::make_unique<IrValue>(opcode, type, ids++));
+        return *values.back();
+    };
+    const auto constant = [&](std::uint32_t value) -> IrValue& {
+        auto& immediate = make(IrOpcode::Void, IrType::U32);
+        immediate.SetImmediateU32(value);
+        return immediate;
+    };
+    const auto userData = [&](std::uint32_t index) -> IrValue& {
+        auto& reg = make(IrOpcode::Void, IrType::ScalarReg);
+        reg.SetRegister({RegisterBank::Scalar, index});
+        auto& read = make(IrOpcode::GetUserData, IrType::U32);
+        read.AddArgument(&reg);
+        return read;
+    };
+    const auto binary = [&](IrOpcode opcode, IrType type, IrValue& left, IrValue& right) -> IrValue& {
+        auto& value = make(opcode, type);
+        value.AddArgument(&left);
+        value.AddArgument(&right);
+        return value;
+    };
+    const auto vectorLoad = [&](IrValue& address) -> IrValue& {
+        auto& load = make(IrOpcode::LoadBufferU32, IrType::U32);
+        load.AddArgument(&address);
+        return load;
+    };
+    const auto rawRead = [&](IrValue& low, IrValue& high, IrValue& offset) -> IrValue& {
+        auto& read = binary(IrOpcode::LoadAddressU32, IrType::U32, binary(IrOpcode::CompositeConstructU64, IrType::U64, low, high), offset);
+        read.SetFlags(MemoryFlags{0, 0});
+        return read;
+    };
+    const auto walks = [&](IrProgram& program, IrValue& read, const std::array<std::uint32_t, 14>& userWords, std::uint8_t expected, const char* what) {
+        auto& resources = program.Resources();
+        resources.srtPlanComplete = true;
+        resources.resourceTrackingComplete = true;
+        MemoryInfo memory;
+        memory.kind = ResourceKind::ScalarAddress;
+        resources.memoryInfo.push_back(memory);
+        DescriptorSource descriptor;
+        descriptor.dwordCount = 4;
+        for (std::uint32_t dword = 0; dword < 4u; ++dword) descriptor.dwords[dword] = &userData(10u + dword);
+        resources.descriptorSources.push_back(descriptor);
+        BufferResource buffer;
+        resources.info.buffers.push_back(buffer);
+        resources.controlFlow.push_back({&binary(IrOpcode::IEqual32, IrType::Bool, read, constant(5)), {1, 2}, {}, {}});
+        resources.controlFlow.push_back({nullptr, {}, {}, {}});
+        resources.controlFlow.push_back({nullptr, {}, {0}, {}});
+        const auto plan = ResourceMaterializer{}.ExtractPlan(program);
+        SrtRuntime runtime{userWords};
+        runtime.readMemory = readFive;
+        runtime.readSpecializationMemory = readFive;
+        const std::array<std::uint32_t, 1> sources{0u};
+        const auto whole = walkPlan(resources, sources, {}, runtime);
+        const auto taped = walkPlan(plan, plan.materializationSources, plan.cleanFlatSlots, runtime);
+        const auto interpreted = walkPlan(plan, sources, {}, runtime);
+        require(whole.active == std::vector<std::uint8_t>{expected}, what);
+        require(taped.active == whole.active && taped.results == whole.results, what);
+        require(interpreted.active == whole.active && interpreted.results == whole.results, what);
+    };
+    std::array<std::uint32_t, 14> userWords{};
+    for (std::uint32_t word = 10; word < userWords.size(); ++word) userWords[word] = 0x100u + word;
+
+    IrProgram phiProgram;
+    auto& shared = userData(1);
+    const auto low = [&](IrValue& hidden) -> IrValue& {
+        return binary(IrOpcode::CompositeExtractU32x2, IrType::U32, binary(IrOpcode::CompositeConstructU32x2, IrType::U32x2, shared, hidden), constant(0));
+    };
+    auto& left = *blocks.emplace_back(std::make_unique<IrBlock>(1u));
+    auto& right = *blocks.emplace_back(std::make_unique<IrBlock>(2u));
+    auto& phi = make(IrOpcode::Phi, IrType::U32);
+    phi.AddPhiOperand(&left, &low(vectorLoad(userData(4))));
+    phi.AddPhiOperand(&right, &low(vectorLoad(userData(5))));
+    userWords[1] = 8u;
+    userWords[2] = 0x1000u;
+    walks(phiProgram, rawRead(userData(2), userData(3), phi), userWords, 1u, "plan copy: a phi whose incoming values differ below a vector load resolved in the plan, not in the program");
+
+    IrProgram rootProgram;
+    auto& mask = binary(IrOpcode::IEqual32, IrType::Bool, userData(5), constant(0));
+    auto& choice = make(IrOpcode::SelectU32, IrType::U32);
+    choice.AddArgument(&mask);
+    choice.AddArgument(&userData(2));
+    choice.AddArgument(&vectorLoad(rawRead(userData(8), userData(9), constant(0))));
+    userWords[1] = 0u;
+    userWords[2] = 0u;
+    walks(rootProgram, rawRead(binary(IrOpcode::ReadFirstLane, IrType::U32, choice, mask), userData(3), constant(0)), userWords, 0u, "plan copy: a read from a null base loaded from memory only below a vector load counted as a null root in the plan, not in the program");
+}
+
 void verifySignedMinimum() {
     using namespace ShaderRecompiler;
     IrResourcePlan plan;
@@ -945,6 +1261,135 @@ void verifyPureFlatSlots() {
     require(Detail::ComputePureFlatSlots(plan) == Pure{0, 0, 0, 0}, "pure flat slots: an incomplete plan was classified");
 }
 
+void verifyLaneMaskGuardedDescriptorSources() {
+    using namespace ShaderRecompiler;
+    constexpr std::uint32_t Format8888UNorm = 56;
+    constexpr std::uint32_t Type2D = 9;
+    constexpr std::uint32_t Zero = 0x00000000u;
+    constexpr std::uint32_t NegativeZero = 0x80000000u;
+    constexpr std::uint32_t One = 0x3f800000u;
+    struct alignas(256) Texture { std::array<std::uint8_t, 256> bytes{}; };
+    static Texture texture;
+    const auto base = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texture.bytes.data()));
+    const std::array<std::uint32_t, 8> valid{static_cast<std::uint32_t>(base >> 8u), static_cast<std::uint32_t>((base >> 40u) & 0xffu) | (Format8888UNorm << 20u) | (3u << 30u), 3u << 14u, 0xfacu | (Type2D << 28u), 0u, 0u, 0u, 0u};
+    const std::array<std::uint32_t, 8> invalid{0x43700000u, 0x43070000u, 0x3b888889u, 0x3bf2b9d6u, 0x3b088889u, 0x3b72b9d6u, 0x3f7f7777u, 0x3f7f0d46u};
+    const std::array<std::uint32_t, 4> sampler{0u, 0u, 0u, 0u};
+    std::array<std::uint32_t, 4> output{};
+    const auto outputAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(output.data()));
+    const std::array<std::uint32_t, 4> outputV{static_cast<std::uint32_t>(outputAddress), static_cast<std::uint32_t>((outputAddress >> 32u) & 0xffffu), 16u, 0xfacu};
+    std::array<std::uint32_t, 32> srt{};
+    const auto fill = [&](const std::array<std::uint32_t, 8>& image, std::uint32_t mode) {
+        std::copy(image.begin(), image.end(), srt.begin());
+        std::copy(sampler.begin(), sampler.end(), srt.begin() + 8);
+        std::copy(outputV.begin(), outputV.end(), srt.begin() + 16);
+        srt[20] = mode;
+    };
+    const auto srtAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(srt.data()));
+    const std::array<std::uint32_t, 2> userData{static_cast<std::uint32_t>(srtAddress), static_cast<std::uint32_t>(srtAddress >> 32u)};
+    const std::array<std::uint32_t, 4> capabilities{29u, spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess};
+    const std::array<std::string_view, 2> extensions{"SPV_KHR_physical_storage_buffer", "SPV_KHR_8bit_storage"};
+    RecompileRequest request{};
+    const std::vector<std::uint32_t> code{0xf4000400u, 0xfa000050u, 0xf4080500u, 0xfa000020u, 0xf4080600u, 0xfa000040u, 0xbf8cc07fu, 0xd40d006au, 0x00002080u, 0xbf860006u, 0xf40c0200u, 0xfa000000u, 0xbf8cc07fu, 0xf09c0f08u, 0x00a20000u, 0xbf8c3f70u, 0xe0700000u, 0x80060000u, 0xbf810000u};
+    request.shader = {ShaderStage::Compute, 0x24000u, code, 0, {}};
+    request.context.waveSize = 32;
+    request.context.userDataBaseRegister = 0;
+    request.context.userData = userData;
+    request.context.compute = ShaderComputeStageInfo{{32u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.target.vulkanVersion = 0x00401000u;
+    request.target.spirvVersion = 0x00010300u;
+    request.target.subgroupSize = 32;
+    request.target.supportedCapabilities = capabilities;
+    request.target.supportedExtensions = extensions;
+    request.target.bdaAbiVersion = BdaAbi::Version;
+    request.target.fragmentShaderBarycentricEnabled = false;
+    request.layout.pushConstantSizeBytes = 128;
+
+    fill(invalid, Zero);
+    const auto plan = GetResourcePlan(request);
+    require(plan->info.images.size() == 1u && plan->info.samplers.size() == 1u, "lane-mask guarded sources: the image and its sampler were not planned");
+    require(!plan->controlFlow.empty() && std::ranges::any_of(plan->controlFlow, [](const ResourceBlock& block) { return block.condition != nullptr; }), "lane-mask guarded sources: the VCC branch around the image kept no condition");
+    for (const auto mode : {Zero, NegativeZero}) {
+        fill(invalid, mode);
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::ranges::all_of(capture->snapshot.images[0].dwords, [](std::uint32_t word) { return word == 0u; }), "lane-mask guarded sources: the T# behind a branch no lane takes was not left null");
+    }
+    fill(invalid, One);
+    {
+        AgcDriver::ShaderMemory memory({});
+        expectFailure([&] { static_cast<void>(memory.Capture(request)); }, "runtime image descriptor is invalid", "lane-mask guarded sources: an invalid T# behind a branch the lanes may take was accepted");
+    }
+    fill(valid, One);
+    {
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::equal(valid.begin(), valid.end(), capture->snapshot.images[0].dwords.begin()), "lane-mask guarded sources: the T# behind a branch the lanes may take was not read");
+    }
+}
+
+void verifyExecGuardedDescriptorSources() {
+    using namespace ShaderRecompiler;
+    constexpr std::uint32_t Format8888UNorm = 56;
+    constexpr std::uint32_t Type2D = 9;
+    struct alignas(256) Texture { std::array<std::uint8_t, 256> bytes{}; };
+    static Texture texture;
+    const auto base = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texture.bytes.data()));
+    const std::array<std::uint32_t, 8> valid{static_cast<std::uint32_t>(base >> 8u), static_cast<std::uint32_t>((base >> 40u) & 0xffu) | (Format8888UNorm << 20u) | (3u << 30u), 3u << 14u, 0xfacu | (Type2D << 28u), 0u, 0u, 0u, 0u};
+    const std::array<std::uint32_t, 8> invalid{0x43700000u, 0x43070000u, 0x3b888889u, 0x3bf2b9d6u, 0x3b088889u, 0x3b72b9d6u, 0x3f7f7777u, 0x3f7f0d46u};
+    const std::array<std::uint32_t, 4> sampler{0u, 0u, 0u, 0u};
+    std::array<std::uint32_t, 4> output{};
+    const auto outputAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(output.data()));
+    const std::array<std::uint32_t, 4> outputV{static_cast<std::uint32_t>(outputAddress), static_cast<std::uint32_t>((outputAddress >> 32u) & 0xffffu), 16u, 0xfacu};
+    std::array<std::uint32_t, 32> srt{};
+    const auto fill = [&](const std::array<std::uint32_t, 8>& image, std::uint32_t mode) {
+        std::copy(image.begin(), image.end(), srt.begin());
+        std::copy(sampler.begin(), sampler.end(), srt.begin() + 8);
+        std::copy(outputV.begin(), outputV.end(), srt.begin() + 16);
+        srt[20] = mode;
+    };
+    const auto srtAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(srt.data()));
+    const std::array<std::uint32_t, 2> userData{static_cast<std::uint32_t>(srtAddress), static_cast<std::uint32_t>(srtAddress >> 32u)};
+    const std::array<std::uint32_t, 4> capabilities{29u, spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess};
+    const std::array<std::string_view, 2> extensions{"SPV_KHR_physical_storage_buffer", "SPV_KHR_8bit_storage"};
+    RecompileRequest request{};
+    const std::vector<std::uint32_t> code{0xf4000400u, 0xfa000050u, 0xf4080500u, 0xfa000020u, 0xf4080600u, 0xfa000040u, 0xbf8cc07fu, 0x7da80010u, 0xbf880006u, 0xf40c0200u, 0xfa000000u, 0xbf8cc07fu, 0xf09c0f08u, 0x00a20000u, 0xbf8c3f70u, 0xe0700000u, 0x80060000u, 0xbf810000u};
+    request.shader = {ShaderStage::Compute, 0x24000u, code, 0, {}};
+    request.context.waveSize = 32;
+    request.context.userDataBaseRegister = 0;
+    request.context.userData = userData;
+    request.context.compute = ShaderComputeStageInfo{{32u, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    request.target.vulkanVersion = 0x00401000u;
+    request.target.spirvVersion = 0x00010300u;
+    request.target.subgroupSize = 32;
+    request.target.supportedCapabilities = capabilities;
+    request.target.supportedExtensions = extensions;
+    request.target.bdaAbiVersion = BdaAbi::Version;
+    request.target.fragmentShaderBarycentricEnabled = false;
+    request.layout.pushConstantSizeBytes = 128;
+
+    fill(invalid, 0u);
+    const auto plan = GetResourcePlan(request);
+    require(plan->info.images.size() == 1u && plan->info.samplers.size() == 1u, "exec guarded sources: the image and its sampler were not planned");
+    require(!plan->controlFlow.empty() && std::ranges::any_of(plan->controlFlow, [](const ResourceBlock& block) { return block.condition != nullptr; }), "exec guarded sources: the EXEC branch around the image kept no condition");
+    {
+        fill(invalid, 0u);
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::ranges::all_of(capture->snapshot.images[0].dwords, [](std::uint32_t word) { return word == 0u; }), "exec guarded sources: the T# behind a branch no lane takes was not left null");
+    }
+    fill(invalid, 1u);
+    {
+        AgcDriver::ShaderMemory memory({});
+        expectFailure([&] { static_cast<void>(memory.Capture(request)); }, "runtime image descriptor is invalid", "exec guarded sources: an invalid T# behind a branch the lanes may take was accepted");
+    }
+    fill(valid, 1u);
+    {
+        AgcDriver::ShaderMemory memory({});
+        const auto capture = memory.Capture(request);
+        require(capture->snapshot.images.size() == 1u && std::equal(valid.begin(), valid.end(), capture->snapshot.images[0].dwords.begin()), "exec guarded sources: the T# behind a branch the lanes may take was not read");
+    }
+}
+
 void verifyGuardedDescriptorSources() {
     using namespace ShaderRecompiler;
     constexpr std::uint32_t Format8888UNorm = 56;
@@ -1248,6 +1693,7 @@ constexpr std::uint32_t TableFormat8888UNorm = 56;
 constexpr std::uint32_t TableFormat32UInt = 20;
 constexpr std::uint32_t TableFormat16SInt = 12;
 constexpr std::uint32_t TableFormat11_11_10UInt = 34;
+constexpr std::uint32_t TableFormat32_32UInt = 62;
 constexpr std::uint32_t TableType2D = 9;
 constexpr std::uint32_t TableType3D = 10;
 
@@ -1330,6 +1776,41 @@ std::array<std::uint32_t, 8> TableSelected(const ShaderRecompiler::ImageTableSna
     return column.words.at(column.codes[0]).dwords;
 }
 
+void verifyTargetFeatureKey() {
+    using namespace ShaderRecompiler;
+    static constexpr std::array<std::uint32_t, 1> code{0xbf810000u};
+    RecompileRequest request{};
+    request.shader = {ShaderStage::Compute, 0x10000u, code, 0, {}};
+    request.context.waveSize = 64;
+    const std::vector<std::uint32_t> capabilities{1u, 4448u, 5347u};
+    const std::vector<std::string_view> extensions{"SPV_KHR_8bit_storage", "SPV_KHR_physical_storage_buffer"};
+    const auto build = [&](std::span<const std::uint32_t> capabilityList, std::span<const std::string_view> extensionList) {
+        auto keyed = request;
+        keyed.target.supportedCapabilities = capabilityList;
+        keyed.target.supportedExtensions = extensionList;
+        std::vector<std::uint64_t> key;
+        RecompileCacheKey::Build(keyed, key);
+        return key;
+    };
+    const auto base = build(capabilities, extensions);
+    const std::vector<std::uint32_t> capabilityCopy = capabilities;
+    const std::vector<std::string> extensionStorage{"SPV_KHR_8bit_storage", "SPV_KHR_physical_storage_buffer"};
+    const std::vector<std::string_view> extensionCopy{extensionStorage[0], extensionStorage[1]};
+    require(build(capabilityCopy, extensionCopy) == base, "target feature key: equal capability and extension lists in other storage gave another key");
+    auto renamed = extensionStorage;
+    renamed[1].back() = 'X';
+    const std::vector<std::string_view> renamedViews{renamed[0], renamed[1]};
+    require(build(capabilities, renamedViews) != base, "target feature key: an extension name that differs in its last byte gave the same key");
+    const std::vector<std::string_view> moved{"SPV_KHR_8bit_storageS", "PV_KHR_physical_storage_buffer"};
+    require(build(capabilities, moved) != base, "target feature key: a byte moved between two extension names gave the same key");
+    const std::vector<std::uint32_t> more{1u, 4448u, 5347u, 11u};
+    require(build(more, extensions) != base, "target feature key: an added capability gave the same key");
+    std::vector<std::string> many;
+    for (std::uint32_t index = 0; index < 40u; ++index) many.push_back("SPV_EXT_descriptor_indexing_" + std::to_string(index));
+    const std::vector<std::string_view> manyViews(many.begin(), many.end());
+    require(build(capabilities, manyViews).size() == base.size(), "target feature key: the key grows with the device's extension names");
+}
+
 void verifyImageTableKeys() {
     using namespace ShaderRecompiler;
     namespace Abi = ImageTableAbi;
@@ -2873,7 +3354,17 @@ void verifyImageTableRegistration() {
     const auto* storeTable = TableBinding(*store.result, DescriptorRole::ImageStorageTable);
     require((storeFault & Abi::PoisonFlag) == 0u && storeTable != nullptr && storeTable->count != 0u && std::all_of(storeTable->imageWritten.begin(), storeTable->imageWritten.end(), [](bool written) { return written; }), "image table registration: the store's table was not bound as written storage elements");
     require(TableBinding(*store.result, DescriptorRole::ImageTable) == nullptr || TableBinding(*store.result, DescriptorRole::ImageTable)->count == 0u, "image table registration: a store-only table bound sampled elements");
-    const std::array<std::pair<std::uint32_t, const char*>, 3> unsupportedStores{{{0xf0240f08u, "image_store_mip"}, {0xf0280f08u, "image_store_pck"}, {0xf0440108u, "image_atomic_add"}}};
+    auto atomicCode = storeCode;
+    atomicCode[8] = 0xf0440108u;
+    const auto atomic = CompileTable(TableRequest(atomicCode, userData));
+    const auto& atomicPlan = *atomic.capture->plan;
+    require(atomicPlan.info.images.size() == 1u && atomicPlan.info.images[0].table == 0u && atomicPlan.info.images[0].tableOperation == TableOperation::Supported, "image table registration: a table T# feeding image_atomic_add was not a supported table operation");
+    const auto& atomicMap = TableMap(*atomic.result);
+    const auto atomicFault = atomicMap[Abi::TableHeader(0) + Abi::TableFault];
+    const auto* atomicTable = TableBinding(*atomic.result, DescriptorRole::ImageStorageTable);
+    require((atomicFault & Abi::PoisonFlag) == 0u && atomicTable != nullptr && atomicTable->count != 0u && atomicTable->imageAtomic.size() == atomicTable->count && std::all_of(atomicTable->imageWritten.begin(), atomicTable->imageWritten.end(), [](bool written) { return written; }) && std::all_of(atomicTable->imageAtomic.begin(), atomicTable->imageAtomic.end(), [](bool atomic) { return atomic; }), "image table registration: the image_atomic_add table was not bound as atomic storage elements");
+    require(TableBinding(*atomic.result, DescriptorRole::ImageTable) == nullptr || TableBinding(*atomic.result, DescriptorRole::ImageTable)->count == 0u, "image table registration: an atomic-only table bound sampled elements");
+    const std::array<std::pair<std::uint32_t, const char*>, 2> unsupportedStores{{{0xf0240f08u, "image_store_mip"}, {0xf0280f08u, "image_store_pck"}}};
     for (const auto& [instruction, name] : unsupportedStores) {
         auto code = storeCode;
         code[8] = instruction;
@@ -3062,6 +3553,18 @@ void verifyPointerImageTable() {
     require(!TableTouched(narrowTable.regions, root + (Palette + 32u) / 4u, 32u) && !TableTouched(narrowTable.regions, root + Committed / 4u, Reserved - Committed), "pointer image table: a record outside the key domain was read");
     const std::vector<std::pair<std::uint64_t, std::uint64_t>> narrowReads{{base + Palette, 32u}, {base + Palette + 2u * 32u, 32u}, {base + Palette + 255u * 32u, 32u}, {base + Palette + 0x102u * 32u, 32u}};
     require(narrowSnapshot.readRanges == narrowReads && narrowTable.result->imageTableReadRanges.size() == 1u && narrowTable.result->imageTableReadRanges[0] == narrowReads, "pointer image table: consumed ranges include skipped keys or the key-domain buffer");
+
+    auto phiCode = maskedCode;
+    phiCode.erase(phiCode.begin() + 8, phiCode.begin() + 10);
+    phiCode.insert(phiCode.begin() + 8, {
+        0xbf068010u, 0xbf850003u, 0xf4200444u, 0x20000000u, 0xbf820002u, 0xf4200444u, 0x20000000u
+    });
+    const auto phiRequest = request(phiCode, 0x36000u);
+    const auto phiPlan = GetResourcePlan(phiRequest);
+    require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer image table: a pointer read through a phi was not planned as a table");
+    const auto phiTable = CompileTable(phiRequest);
+    require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer image table: a pointer read through a phi captured different records");
+
     keys = {};
 #ifdef _WIN32
     VirtualFree(block, 0, MEM_RELEASE);
@@ -3279,7 +3782,7 @@ void verifySelectedRecordDirectOperations() {
     FillTableSrt(guest, heap.data(), 32u, 4u);
     guest.srt[16] = 2u;
     const auto userData = TableUserData(guest);
-    const std::array<std::tuple<const char*, std::uint32_t, std::uint32_t>, 4> operations{{{"image_store", 0xf0200f08u, TableFormat32UInt}, {"image_atomic_add", 0xf0440108u, TableFormat32UInt}, {"image_load_pck", 0xf0080f08u, TableFormat32UInt}, {"image_load_by2", 0xf1080308u, TableFormat16UNorm}}};
+    const std::array<std::tuple<const char*, std::uint32_t, std::uint32_t>, 5> operations{{{"image_store", 0xf0200f08u, TableFormat32UInt}, {"image_atomic_add", 0xf0440108u, TableFormat32UInt}, {"image_atomic64_add", 0xf0440308u, TableFormat32_32UInt}, {"image_load_pck", 0xf0080f08u, TableFormat32UInt}, {"image_load_by2", 0xf1080308u, TableFormat16UNorm}}};
     for (const auto& [name, word0, format] : operations) {
         const auto what = std::string("selected record direct operations: ") + name;
         heap[2] = TableT(textures[1].bytes.data(), format, TableType2D);
@@ -3287,11 +3790,11 @@ void verifySelectedRecordDirectOperations() {
         const auto request = TableRequest(code, userData);
         const auto plan = GetResourcePlan(request);
         require(plan->info.images.size() == 1u && plan->info.images[0].table == NoTable && !plan->descriptorSources.at(plan->info.images[0].source).tableColumn.has_value(), (what + " through a T# whose record the CPU evaluates was planned through an image table").c_str());
-        const auto compiled = CompileTable(request);
-        require(TableBinding(*compiled.result, DescriptorRole::ImageTable) == nullptr && compiled.result->imageTableFaults == 0u && TableCovered(compiled.regions, &heap[2], sizeof(heap[2])), (what + " through a T# whose record the CPU evaluates was not bound from its record").c_str());
+        const auto compiled = word0 == 0xf0440308u ? TableCompiled{} : CompileTable(request);
+        require(word0 == 0xf0440308u || (TableBinding(*compiled.result, DescriptorRole::ImageTable) == nullptr && compiled.result->imageTableFaults == 0u && TableCovered(compiled.regions, &heap[2], sizeof(heap[2]))), (what + " through a T# whose record the CPU evaluates was not bound from its record").c_str());
         const auto wholeCode = WithImageOperation(TableWholeCode, word0, false);
         const auto whole = GetResourcePlan(TableRequest(wholeCode, userData));
-        require(whole->info.images.size() == 1u && whole->info.images[0].table == 0u && whole->info.images[0].tableOperation == (word0 == 0xf0200f08u ? TableOperation::Supported : TableOperation::Unsupported), (what + " through a T# keyed per lane left the image table or has the wrong table operation").c_str());
+        require(whole->info.images.size() == 1u && whole->info.images[0].table == 0u && whole->info.images[0].tableOperation == (word0 == 0xf0200f08u || word0 == 0xf0440108u ? TableOperation::Supported : TableOperation::Unsupported), (what + " through a T# keyed per lane left the image table or has the wrong table operation").c_str());
     }
     const auto mixedCode = WithImageOperation(TableSrtKeyCode, 0xf0200f08u, true);
     const auto mixed = GetResourcePlan(TableRequest(mixedCode, userData));
@@ -3465,6 +3968,45 @@ void verifyPointerChainImageTable() {
     static_cast<void>(ValidateAndOptimizeSpirv(compiled.result->spirv, request.target.vulkanVersion, request.target.spirvVersion));
 #endif
     store(links[1].data() + 4u, address(descriptors[1].data()));
+
+    auto phiCode = code;
+    phiCode.erase(phiCode.begin() + 15, phiCode.begin() + 17);
+    phiCode.insert(phiCode.begin() + 15, {
+        0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000008u
+    });
+    auto phiRequest = TableRequest(phiCode, userData);
+    phiRequest.shader.codeAddress = 0x38000u;
+    const auto phiPlan = GetResourcePlan(phiRequest);
+    require(phiPlan->info.images.size() == 1u && phiPlan->info.images[0].table == 0u, "pointer chain image table: a pointer read through a phi was not planned as a table");
+    const auto phiTable = CompileTable(phiRequest);
+    require(phiTable.capture->snapshot.tables.tables.at(0).codes == snapshot.codes, "pointer chain image table: a pointer read through a phi captured different records");
+
+    auto divergentCode = code;
+    divergentCode.erase(divergentCode.begin() + 15, divergentCode.begin() + 17);
+    divergentCode.insert(divergentCode.begin() + 15, {
+        0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xf4240b02u, 0x24000018u
+    });
+    auto divergentRequest = TableRequest(divergentCode, userData);
+    divergentRequest.shader.codeAddress = 0x39000u;
+    expectFailure([&] { static_cast<void>(GetResourcePlan(divergentRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi reading different table offsets was planned as a table");
+
+    auto nonTableCode = code;
+    nonTableCode.erase(nonTableCode.begin() + 15, nonTableCode.begin() + 17);
+    nonTableCode.insert(nonTableCode.begin() + 15, {
+        0xbf068010u, 0xbf850003u, 0xf4240b02u, 0x24000008u, 0xbf820002u, 0xbe960380u, 0xbe970380u
+    });
+    auto nonTableRequest = TableRequest(nonTableCode, userData);
+    nonTableRequest.shader.codeAddress = 0x3a000u;
+    expectFailure([&] { static_cast<void>(GetResourcePlan(nonTableRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi with a non-table branch was planned as a table");
+
+    auto armOffsetCode = code;
+    armOffsetCode.erase(armOffsetCode.begin() + 14, armOffsetCode.begin() + 17);
+    armOffsetCode.insert(armOffsetCode.begin() + 14, {
+        0xbf068010u, 0xbf850004u, 0x8f128411u, 0xf4240b02u, 0x24000008u, 0xbf820003u, 0x8f128411u, 0xf4240b02u, 0x24000008u
+    });
+    auto armOffsetRequest = TableRequest(armOffsetCode, userData);
+    armOffsetRequest.shader.codeAddress = 0x3b000u;
+    expectFailure([&] { static_cast<void>(GetResourcePlan(armOffsetRequest)); }, "GetImageResource dword 0 is not a valid runtime value", "pointer chain image table: a phi whose arms compute their own table offset was planned as a table");
 }
 
 void verifyWaterfallImageTable() {
@@ -4002,6 +4544,51 @@ void verifyLanesOutsideHostSubgroup() {
     require(pixel(permlanex16, 32u) && pixel(permlane16, 8u), "host lanes: a v_permlane16_b32 row that the host subgroup may hold did not build");
 }
 
+void verifyFusedExactArithmetic() {
+    using namespace ShaderRecompiler;
+    const auto pixel = [](bool fused) {
+        static const std::vector<std::uint32_t> code{0x7e000200u, 0x10020100u, 0x06040101u, 0x08060302u, 0x7e000303u, 0xf800180fu, 0u, 0xbf810000u};
+        ShaderPixelStageInfo info{};
+        info.inputAddr = PixelInputBit(PixelInput::PositionX);
+        info.posX = true;
+        info.targetOutputMode[0] = 9u;
+        info.targetExportMapping.fill(0xe4u);
+        RecompileRequest request{};
+        request.shader = {ShaderStage::Fragment, 0x30000u, code, 0, {}};
+        request.context.waveSize = 64;
+        request.context.pixel = info;
+        request.target.vulkanVersion = 0x00401000u;
+        request.target.spirvVersion = 0x00010300u;
+        request.target.subgroupSize = 64;
+        request.target.fusedExactArithmetic = fused;
+        request.layout.pushConstantSizeBytes = 128;
+        request.useCache = false;
+        return Recompile(request).spirv;
+    };
+    struct Counts {
+        std::uint32_t exactArithmetic = 0;
+        std::uint32_t fmas = 0;
+    };
+    const auto count = [](std::span<const std::uint32_t> spirv) {
+        std::set<std::uint32_t> exact;
+        std::vector<std::uint32_t> arithmetic;
+        Counts result;
+        for (std::size_t cursor = 5; cursor < spirv.size() && (spirv[cursor] >> 16u) != 0u; cursor += spirv[cursor] >> 16u) {
+            const auto op = spirv[cursor] & 0xffffu;
+            const auto words = spirv[cursor] >> 16u;
+            if (op == spv::OpDecorate && words == 3u && spirv[cursor + 2] == spv::DecorationNoContraction) exact.insert(spirv[cursor + 1]);
+            if (op == spv::OpFAdd || op == spv::OpFSub || op == spv::OpFMul) arithmetic.push_back(spirv[cursor + 2]);
+            if (op == spv::OpExtInst && words >= 5u && spirv[cursor + 4] == 50u) ++result.fmas;
+        }
+        result.exactArithmetic = static_cast<std::uint32_t>(std::count_if(arithmetic.begin(), arithmetic.end(), [&](std::uint32_t id) { return exact.contains(id); }));
+        return result;
+    };
+    const auto plain = count(pixel(false));
+    const auto fused = count(pixel(true));
+    require(plain.exactArithmetic >= 3u, "fused exact arithmetic: the f32 multiply, add and subtract were not exact operations without the flag");
+    require(fused.exactArithmetic == 0u && fused.fmas >= plain.fmas + 3u, "fused exact arithmetic: the f32 multiply, add and subtract did not become fused multiply-adds with the flag");
+}
+
 void verifyHalfWaveReduction() {
     using namespace ShaderRecompiler;
     static constexpr std::array<std::uint32_t, 5> capabilities{spv::CapabilityGroupNonUniform, spv::CapabilityGroupNonUniformBallot, spv::CapabilityGroupNonUniformShuffle, spv::CapabilityGroupNonUniformArithmetic, spv::CapabilityClipDistance};
@@ -4088,6 +4675,18 @@ void verifyHalfWaveReduction() {
         {0u, 0x38000000u, 0x88000000u, spv::OpGroupNonUniformBitwiseOr, "half-wave reduction: the wave64 OR scan did not read lane 31 as a subgroup OR on 32 lanes"},
     }};
     for (const auto& reduction : scans) require(reductions(pixel(scan(reduction.identity, reduction.vector, reduction.scalar), 32u, true), reduction.reduce) == 1u, reduction.message);
+    auto loopScan = scan(0xffffffffu, 0x26000000u, 0x83800000u);
+    const auto savedMaskLoop = AgcTest::SavedExecMaskLoop(8u);
+    loopScan.insert(loopScan.begin(), savedMaskLoop.begin(), savedMaskLoop.end());
+    auto helperLoop = loopScan;
+    helperLoop[0] = 0xbea204c1u;
+    expectFailure([&] { static_cast<void>(pixel(helperLoop, 32u, true)); }, "v_readlane_b32 of lane 63 is outside the 32-lane host subgroup", "half-wave reduction: a loop initialized with helper lanes was proven to exclude them");
+    auto upperHelperLoop = loopScan;
+    upperHelperLoop[0] = 0xbea2037eu;
+    upperHelperLoop.insert(upperHelperLoop.begin() + 1, 0xbea303c1u);
+    expectFailure([&] { static_cast<void>(pixel(upperHelperLoop, 32u, true)); }, "v_readlane_b32 of lane 63 is outside the 32-lane host subgroup", "half-wave reduction: the low-word loop proof was reused for helper-inclusive upper lanes");
+    require(reductions(pixel(loopScan, 32u, true), spv::OpGroupNonUniformUMin) == 1u, "half-wave reduction: a loop-carried saved EXEC mask exhausted the entry-lane proof on 32 lanes");
+    require(halves(pixel(loopScan, 64u, true), spv::OpGroupNonUniformUMin, 0xffffffffu), "half-wave reduction: a loop-carried saved EXEC mask did not preserve the two half-wave UMin reductions");
     auto comparedScan = scan(0u, 0x38000000u, 0x88000000u);
     *std::find(comparedScan.begin(), comparedScan.end(), 0xbe98047eu) = 0x8a986a7eu;
     comparedScan.insert(comparedScan.begin(), 0x7c080080u);
@@ -4500,13 +5099,15 @@ void verifyMeshConfiguration() {
     RecompileCacheKey::Build(other, key);
     require(key != first && RecompileCacheKey::ContextHash(request) != RecompileCacheKey::ContextHash(other), "the cache keys ignore the mesh configuration");
     require(mesh.outputPrimitiveSize == 3u && replay.request.graphics->mesh->outputPrimitiveSize == 3u, "a mesh configuration does not output triangles by default");
-    otherMesh = mesh;
-    otherMesh.outputPrimitiveSize = 2u;
-    other.graphics = GraphicsCompileContext{0u, {}, otherMesh, std::nullopt, {}};
-    const auto lineReplay = RequestSerializer{}.Deserialize(RequestSerializer{}.Serialize(other));
-    require(lineReplay.request.graphics.has_value() && lineReplay.request.graphics->mesh.has_value() && lineReplay.request.graphics->mesh->outputPrimitiveSize == 2u, "the mesh output primitive size was lost in serialization");
-    RecompileCacheKey::Build(other, key);
-    require(key != first && RecompileCacheKey::ContextHash(request) != RecompileCacheKey::ContextHash(other), "the cache keys ignore the mesh output primitive size");
+    for (const auto primitiveSize : {1u, 2u}) {
+        otherMesh = mesh;
+        otherMesh.outputPrimitiveSize = primitiveSize;
+        other.graphics = GraphicsCompileContext{0u, {}, otherMesh, std::nullopt, {}};
+        const auto primitiveReplay = RequestSerializer{}.Deserialize(RequestSerializer{}.Serialize(other));
+        require(primitiveReplay.request.graphics.has_value() && primitiveReplay.request.graphics->mesh.has_value() && primitiveReplay.request.graphics->mesh->outputPrimitiveSize == primitiveSize, "the mesh output primitive size was lost in serialization");
+        RecompileCacheKey::Build(other, key);
+        require(key != first && RecompileCacheKey::ContextHash(request) != RecompileCacheKey::ContextHash(other), "the cache keys ignore the mesh output primitive size");
+    }
     RecompileRequest hull{};
     hull.shader = {ShaderStage::TessellationControl, 0x10000u, code, 0, {}};
     hull.context.waveSize = 64;
@@ -4781,7 +5382,7 @@ void verifyPixelRequestSerialization() {
                         value.posZ, value.posW, value.frontFace, value.frontFaceAllBits, value.ancillary, value.sampleShading,
                         value.noPerspective, value.linearCentroid, value.pixelKillEnable, value.depthExportEnable,
                         value.sampleMaskExportEnable, value.earlyZ, value.executeOnNoop, value.conservativeZExport, value.orderedPixelShader,
-                        value.targetOutputMode, value.targetExportMapping, value.alphaToCoverage, value.stencilRefExportEnable, value.rasterPrimitive, value.layerExported, value.ditheredAlphaToCoverage, value.reversedBlend);
+                        value.targetOutputMode, value.targetExportMapping, value.alphaToCoverage, value.stencilRefExportEnable, value.rasterPrimitive, value.layerExported, value.ditheredAlphaToCoverage, value.reversedBlend, value.targetMerge);
     };
     const std::array<std::uint32_t, 1> code{0xbf810000u};
     const std::array<std::uint32_t, 3> userData{0x12345678u, 0xabcdef01u, 0x87654321u};
@@ -4829,6 +5430,7 @@ void verifyPixelRequestSerialization() {
     pixel.stencilRefExportEnable = true;
     pixel.ditheredAlphaToCoverage = true;
     pixel.reversedBlend = 0x570001u;
+    pixel.targetMerge = {1u, 0x0ff0u, 1u, {0x100u, 0x2u, 0x3u, 0x4u, 0x5u, 0x6u, 0x7u, 0x8u}};
     const std::array<std::array<std::uint8_t, 8>, 3> mappings{{
         {0x00u, 0xe4u, 0xc6u, 0x1bu, 0xffu, 0x80u, 0x55u, 0xaau},
         {0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u},
@@ -4861,6 +5463,22 @@ void verifyPixelRequestSerialization() {
         withoutReversedBlend.context.pixel->reversedBlend = 0u;
         RecompileCacheKey::Build(withoutReversedBlend, replayKey);
         require(key == replayKey && RecompileCacheKey::ContextHash(request) == RecompileCacheKey::ContextHash(withoutReversedBlend), "the reversed-order blend code changed the static shader identity");
+        auto movedMerge = request;
+        movedMerge.context.pixel->targetMerge.descriptor[0] = 0x200u;
+        RecompileCacheKey::Build(movedMerge, replayKey);
+        require(key == replayKey, "the merged target's descriptor changed the static shader identity");
+        auto depthWritingMerge = request;
+        depthWritingMerge.context.pixel->targetMerge.depthStencilWrites = true;
+        RecompileCacheKey::Build(depthWritingMerge, replayKey);
+        require(key != replayKey, "the merge draw's depth or stencil writes did not change the static shader identity");
+        auto depthTestingMerge = request;
+        depthTestingMerge.context.pixel->targetMerge.depthStencilTests = true;
+        RecompileCacheKey::Build(depthTestingMerge, replayKey);
+        require(key != replayKey, "the merge draw's depth or stencil tests did not change the static shader identity");
+        auto withoutMerge = request;
+        withoutMerge.context.pixel->targetMerge = {};
+        RecompileCacheKey::Build(withoutMerge, replayKey);
+        require(key != replayKey, "a color target merge did not change the static shader identity");
         auto withoutCoverage = request;
         withoutCoverage.context.pixel->alphaToCoverage = false;
         RecompileCacheKey::Build(withoutCoverage, replayKey);
@@ -4883,7 +5501,7 @@ void verifyPixelRequestSerialization() {
     minimal.context.pixel->layerExported = true;
     minimal.context.pixel->ditheredAlphaToCoverage = true;
     const auto encoded = serializer.Serialize(minimal);
-    require(requestPrefix(encoded, 8u) == "NVNQQSoAAAA=", "new requests did not use serialization version 42");
+    require(requestPrefix(encoded, 8u) == "NVNQQS4AAAA=", "new requests did not use serialization version 46");
     const std::array<std::uint32_t, 2> fallbacks{0x40u, 0x1ac4u};
     auto withFallbacks = minimal;
     withFallbacks.context.linkedCallFallbacks = fallbacks;
@@ -5001,7 +5619,7 @@ void verifyPixelRequestSerialization() {
     for (std::size_t bytes = 0; bytes < 45u; ++bytes) {
         expectFailure([&] { static_cast<void>(serializer.Deserialize(requestPrefix(encoded, mappingOffset + bytes))); }, "truncated data", "a truncated pixel mapping, packing, dual-source, alpha-to-coverage, stencil reference export flag, primitive class, layer export, dither or front-face flag, quad pixel mask or quad sample mask was accepted");
     }
-    for (const auto unsupported : {"NVNQQQAAAAA=", "NVNQQSsAAAA="}) {
+    for (const auto unsupported : {"NVNQQQAAAAA=", "NVNQQS8AAAA="}) {
         expectFailure([&] { static_cast<void>(serializer.Deserialize(unsupported)); }, "serialization version", "an unsupported request version was accepted");
     }
     static constexpr std::string_view version18Request{
@@ -5092,6 +5710,8 @@ void verifyVertexInfoVersion19() {
     require(offset + 4u <= plain.size() && flagged[offset] == 0xefu && flagged[offset + 1u] == 0xcdu && flagged[offset + 2u] == 0xabu && flagged[offset + 3u] == 0x89u, "PA_CL_VS_OUT_CNTL is not the four bytes the version 20 vertex info adds");
     require(std::equal(plain.begin() + offset + 4u, plain.end(), flagged.begin() + offset + 4u), "PA_CL_VS_OUT_CNTL moved the fields after it");
     auto version20Vertex = flagged;
+    version20Vertex.resize(version20Vertex.size() - sizeof(std::uint32_t));
+    version20Vertex.pop_back();
     version20Vertex.pop_back();
     version20Vertex.pop_back();
     version20Vertex.pop_back();
@@ -5103,6 +5723,8 @@ void verifyVertexInfoVersion19() {
     const auto layered = serializer.Deserialize(serializer.Serialize(vertex));
     require(layered.request.context.vertex.has_value() && layered.request.context.vertex->paClVsOutCntl == vertex.context.vertex->paClVsOutCntl, "a layered vertex info lost its clip distances or render target index");
     auto legacy = plain;
+    legacy.resize(legacy.size() - sizeof(std::uint32_t));
+    legacy.pop_back();
     legacy.pop_back();
     legacy.pop_back();
     legacy.pop_back();
@@ -5141,15 +5763,39 @@ void verifyVertexInfoVersion19() {
     while (allBitsOffset < plainPixel.size() && plainPixel[allBitsOffset] == allBitsBytes[allBitsOffset]) ++allBitsOffset;
     require(allBitsOffset == flagOffset + 2u, "the front-face all-bits flag does not follow the dithered coverage flag");
     require(blendOffset == allBitsOffset + 18u, "the reversed-order blend code is not serialized after the front-face all-bits flag, quad pixel mask and quad sample masks");
-    constexpr std::size_t sampleMaskBytes = 16u;
     constexpr std::size_t iterationBytes = 35u;
     constexpr std::size_t sampleOrderBytes = 16u;
+    constexpr std::size_t mergeBytes = 40u;
+    constexpr std::size_t sampleMaskBytes = 16u;
     const auto orderOffset = blendOffset + 4u + iterationBytes;
+    const auto mergeOffset = static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes);
+    auto merging = pixel;
+    merging.context.pixel->targetMerge = {3u, 0xf00fu, 2u, {1u, 2u, 3u, 4u, 5u, 6u, 7u, 0x89abcdefu}, true, true};
+    const auto mergingBytes = decodeBase64(serializer.Serialize(merging));
+    require(mergingBytes.size() == plainPixel.size() && std::equal(plainPixel.begin(), plainPixel.begin() + mergeOffset, mergingBytes.begin()) && mergingBytes[mergeOffset] == 3u && mergingBytes[mergeOffset + 1] == 0x0fu && mergingBytes[mergeOffset + 2] == 0xf0u && mergingBytes[mergeOffset + 5] == 2u && mergingBytes[mergeOffset + 6] == 1u && mergingBytes[mergeOffset + 34] == 0xefu && mergingBytes[mergeOffset + 37] == 0x89u && mergingBytes[mergeOffset + 38] == 1u && mergingBytes[mergeOffset + 39] == 1u && std::equal(plainPixel.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes), plainPixel.end(), mergingBytes.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes)), "the color target merge is not the 40 bytes the version 46 pixel info adds after the sample order");
+    require(serializer.Deserialize(serializer.Serialize(merging)).request.context.pixel->targetMerge == merging.context.pixel->targetMerge, "a serialized request lost its color target merge");
+    // A version 43 request: no color target merge, and no fused arithmetic flag, pixel function LDS flag or storage size at the end.
+    const auto version43Bytes = [&](std::vector<std::uint8_t> bytes) {
+        require(bytes.end() - bytes.begin() > mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes) && std::equal(plainPixel.begin() + mergeOffset, plainPixel.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes), bytes.begin() + mergeOffset), "a replay fixture does not hold the default color target merge after the sample order");
+        bytes.erase(bytes.begin() + mergeOffset, bytes.begin() + mergeOffset + static_cast<std::ptrdiff_t>(mergeBytes));
+        bytes.resize(bytes.size() - sizeof(std::uint32_t) - 2u);
+        return bytes;
+    };
+    auto version42 = version43Bytes(plainPixel);
+    version42[4] = 42u;
+    const auto replay42 = serializer.Deserialize(encodeBase64(version42));
+    require(replay42.request.context.pixel.has_value() && replay42.request.context.pixel->targetMerge == TargetMerge{} && serializer.Serialize(replay42.request) == encodedPixel, "a version 42 request read a color target merge or misread the fields after it");
+    auto version39 = version42;
+    version39.pop_back();
+    version39.erase(version39.begin() + static_cast<std::ptrdiff_t>(orderOffset), version39.begin() + mergeOffset);
+    version39[4] = 39u;
+    const auto replay39 = serializer.Deserialize(encodeBase64(version39));
+    require(replay39.request.context.pixel.has_value() && replay39.request.context.pixel->targetMerge == TargetMerge{} && replay39.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{} && serializer.Serialize(replay39.request) == encodedPixel, "a version 39 request read a sample order or color target merge, or misread the fields after them");
     auto ordered = pixel;
     ordered.context.pixel->sampleOrder = {0x76543210u, 0x76543210u, 0x76543201u, 0x76543201u};
     const auto orderedBytes = decodeBase64(serializer.Serialize(ordered));
     require(orderedBytes.size() == plainPixel.size() && std::equal(plainPixel.begin(), plainPixel.begin() + static_cast<std::ptrdiff_t>(orderOffset), orderedBytes.begin()) && orderedBytes[orderOffset] == 0x10u && orderedBytes[orderOffset + 11u] == 0x76u && orderedBytes[orderOffset + 12u] == 0x01u && std::equal(plainPixel.begin() + static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes), plainPixel.end(), orderedBytes.begin() + static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes)), "the sample order is not the four words the version 42 pixel info adds after the stencil operation value export flag");
-    auto orderedVersion34 = orderedBytes;
+    auto orderedVersion34 = version43Bytes(orderedBytes);
     orderedVersion34.pop_back();
     orderedVersion34.pop_back();
     orderedVersion34.pop_back();
@@ -5157,7 +5803,7 @@ void verifyVertexInfoVersion19() {
     orderedVersion34[4] = 34u;
     const auto orderedReplay34 = serializer.Deserialize(encodeBase64(orderedVersion34));
     require(orderedReplay34.request.context.pixel.has_value() && orderedReplay34.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{} && serializer.Serialize(orderedReplay34.request) == encodedPixel, "a version 34 request read a sample order, or misread the fields after its pixel iteration fields");
-    auto orderedVersion30 = orderedBytes;
+    auto orderedVersion30 = version43Bytes(orderedBytes);
     orderedVersion30.resize(orderedVersion30.size() - 4u);
     orderedVersion30.erase(orderedVersion30.begin() + static_cast<std::ptrdiff_t>(blendOffset + 4u), orderedVersion30.begin() + static_cast<std::ptrdiff_t>(orderOffset + sampleOrderBytes));
     orderedVersion30[4] = 30u;
@@ -5165,7 +5811,7 @@ void verifyVertexInfoVersion19() {
     require(orderedReplay30.request.context.pixel.has_value() && orderedReplay30.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{} && serializer.Serialize(orderedReplay30.request) == encodedPixel, "a version 30 request read a sample order, or misread the fields after its reversed-order blend code");
     auto orderedSpanned = ordered;
     orderedSpanned.target.spannedWaves = true;
-    auto orderedVersion32 = decodeBase64(serializer.Serialize(orderedSpanned));
+    auto orderedVersion32 = version43Bytes(decodeBase64(serializer.Serialize(orderedSpanned)));
     orderedVersion32.pop_back();
     require(orderedVersion32.size() > 2u && orderedVersion32.back() == 0u && orderedVersion32[orderedVersion32.size() - 2u] == 0u && orderedVersion32[orderedVersion32.size() - 3u] == 1u, "the spanned-waves flag is not the byte before the depth remap flag");
     orderedVersion32.pop_back();
@@ -5186,7 +5832,7 @@ void verifyVertexInfoVersion19() {
     sampledPixel.context.pixel->quadSampleMask = {0x1u, 0x2u, 0x4u, 0x8u};
     const auto sampledBytes = decodeBase64(serializer.Serialize(sampledPixel));
     require(std::equal(maskedBytes.begin(), maskedBytes.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u), sampledBytes.begin()) && sampledBytes[maskOffset + 1u] == 0x1u && sampledBytes[maskOffset + 5u] == 0x2u && sampledBytes[maskOffset + 9u] == 0x4u && sampledBytes[maskOffset + 13u] == 0x8u, "the quad sample masks are not the four words after the quad pixel mask");
-    auto version30 = sampledBytes;
+    auto version30 = version43Bytes(sampledBytes);
     version30.pop_back();
     version30.pop_back();
     version30.pop_back();
@@ -5197,7 +5843,7 @@ void verifyVertexInfoVersion19() {
     require(replay30.request.context.pixel.has_value() && !replay30.request.context.pixel->iteratesSamples && replay30.request.context.pixel->positionLocation == PixelPositionLocation::Center && replay30.request.context.pixel->sampleLocations == std::array<std::uint8_t, 32>{} && decodeBase64(serializer.Serialize(replay30.request)) == sampledBytes, "a version 30 request read pixel iteration, a position location or sample locations, or misread the fields after its reversed-order blend code");
     auto spanned = sampledPixel;
     spanned.target.spannedWaves = true;
-    auto version32 = decodeBase64(serializer.Serialize(spanned));
+    auto version32 = version43Bytes(decodeBase64(serializer.Serialize(spanned)));
     version32.pop_back();
     require(version32.size() > 2u && version32.back() == 0u && version32[version32.size() - 2u] == 0u && version32[version32.size() - 3u] == 1u, "the spanned-waves flag is not the byte before the depth remap flag");
     version32.pop_back();
@@ -5206,13 +5852,13 @@ void verifyVertexInfoVersion19() {
     version32[4] = 32u;
     const auto replay32 = serializer.Deserialize(encodeBase64(version32));
     require(replay32.request.context.pixel.has_value() && !replay32.request.context.pixel->iteratesSamples && replay32.request.context.pixel->sampleLocations == std::array<std::uint8_t, 32>{} && replay32.request.target.spannedWaves && serializer.Serialize(replay32.request) == serializer.Serialize(spanned), "a version 32 request read pixel iteration or sample locations, or lost its spanned-waves flag");
-    auto version29 = sampledBytes;
+    auto version29 = version43Bytes(sampledBytes);
     version29.pop_back();
     version29.pop_back();
     version29.pop_back();
     version29.pop_back();
     version29.erase(version29.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes), version29.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes + 4u + iterationBytes + sampleOrderBytes));
-    auto version36 = sampledBytes;
+    auto version36 = version43Bytes(sampledBytes);
     version36.pop_back();
     version36.erase(version36.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes + 4u + iterationBytes - 1u), version36.begin() + static_cast<std::ptrdiff_t>(maskOffset + 1u + sampleMaskBytes + 4u + iterationBytes + sampleOrderBytes));
     version36[4] = 36u;
@@ -5221,7 +5867,7 @@ void verifyVertexInfoVersion19() {
     version29[4] = 29u;
     const auto replay29 = serializer.Deserialize(encodeBase64(version29));
     require(replay29.request.context.pixel.has_value() && replay29.request.context.pixel->quadSampleMask == std::array<std::uint16_t, 4>{0x1u, 0x2u, 0x4u, 0x8u} && replay29.request.context.pixel->reversedBlend == 0u && decodeBase64(serializer.Serialize(replay29.request)) == sampledBytes, "a version 29 request read a reversed-order blend code or misread the fields after the quad sample masks");
-    auto version28 = sampledBytes;
+    auto version28 = version43Bytes(sampledBytes);
     version28.pop_back();
     version28.pop_back();
     version28.pop_back();
@@ -5230,7 +5876,7 @@ void verifyVertexInfoVersion19() {
     version28[4] = 28u;
     const auto replay28 = serializer.Deserialize(encodeBase64(version28));
     require(replay28.request.context.pixel.has_value() && replay28.request.context.pixel->quadPixelMask == 0x2u && replay28.request.context.pixel->quadSampleMask == std::array<std::uint16_t, 4>{0xffffu, 0xffffu, 0xffffu, 0xffffu} && replay28.request.context.pixel->reversedBlend == 0u && decodeBase64(serializer.Serialize(replay28.request)) == maskedBytes, "a version 28 request read quad sample masks or a reversed-order blend code, or misread the fields after them");
-    auto version27 = maskedBytes;
+    auto version27 = version43Bytes(maskedBytes);
     version27.pop_back();
     version27.pop_back();
     version27.pop_back();
@@ -5239,7 +5885,7 @@ void verifyVertexInfoVersion19() {
     version27[4] = 27u;
     const auto replay27 = serializer.Deserialize(encodeBase64(version27));
     require(replay27.request.context.pixel.has_value() && replay27.request.context.pixel->quadPixelMask == 0xfu && replay27.request.context.pixel->reversedBlend == 0u && serializer.Serialize(replay27.request) == encodedPixel, "a version 27 request read a quad pixel mask or reversed-order blend code, or misread the fields after it");
-    auto legacyPixel = plainPixel;
+    auto legacyPixel = version43Bytes(plainPixel);
     legacyPixel.pop_back();
     legacyPixel.pop_back();
     legacyPixel.pop_back();
@@ -5290,26 +5936,33 @@ void verifyDepthRemapRequests() {
     const auto replay = serializer.Deserialize(remapped);
     require(replay.request.target.depthRangeRemap && replay.request.context.vertex.has_value() && replay.request.context.vertex->paClVsOutCntl == 0x89abcdefu, "the depth remap target flag or the vertex info did not round-trip");
     require(replay.request.context.vertex->depthRemapMode == 2u, "the depth remap mode did not round-trip");
-    require(serializer.Serialize(replay.request) == remapped, "a version 35 depth remap request changed on re-serialization");
+    require(serializer.Serialize(replay.request) == remapped, "the depth remap request changed on re-serialization");
     const auto plainBytes = decodeBase64(plain);
     const auto remappedBytes = decodeBase64(remapped);
-    require(plainBytes.size() == remappedBytes.size() && plainBytes.size() > 5u && std::equal(plainBytes.begin(), plainBytes.end() - 7, remappedBytes.begin()), "the depth remap flag and mode are not the 6 bytes before the f32 flush and denormal preserve flags of a vertex request");
+    constexpr std::size_t pointTailBytes = 13u;
+    require(plainBytes.size() == remappedBytes.size() && plainBytes.size() > 13u + pointTailBytes && std::equal(plainBytes.begin(), plainBytes.end() - 13 - pointTailBytes, remappedBytes.begin()) && std::equal(plainBytes.end() - 6 - pointTailBytes, plainBytes.end(), remappedBytes.end() - 6 - pointTailBytes), "the depth remap flag and mode are not the 6 bytes before the f32 flush and denormal preserve flags, the point tail, the fused arithmetic flag, the pixel function LDS flag and the pixel function storage size of a vertex request");
     for (const std::uint8_t legacyVersion : {32u, 34u}) {
         auto legacyBytes = remappedBytes;
+        legacyBytes.resize(legacyBytes.size() - sizeof(std::uint32_t));
+        legacyBytes.pop_back();
+        legacyBytes.pop_back();
         legacyBytes.pop_back();
         legacyBytes[4] = legacyVersion;
-        legacyBytes.resize(legacyBytes.size() - 6u);
+        legacyBytes.resize(legacyBytes.size() - 6u - pointTailBytes);
         const auto legacy = serializer.Deserialize(encodeBase64(legacyBytes));
         require(!legacy.request.target.depthRangeRemap && legacy.request.context.vertex.has_value() && legacy.request.context.vertex->depthRemapMode == 0u, ("a version " + std::to_string(legacyVersion) + " vertex request read depth remap fields").c_str());
         require(serializer.Serialize(legacy.request) == plain, ("a version " + std::to_string(legacyVersion) + " vertex request misread the fields before the depth remap").c_str());
     }
     auto version35 = remappedBytes;
+    version35.resize(version35.size() - sizeof(std::uint32_t));
+    version35.pop_back();
+    version35.pop_back();
     version35.pop_back();
     version35[4] = 35u;
-    version35.pop_back();
+    version35.resize(version35.size() - 1u - pointTailBytes);
     const auto replay35 = serializer.Deserialize(encodeBase64(version35));
     require(replay35.request.target.depthRangeRemap && replay35.request.context.vertex->depthRemapMode == 2u && !replay35.request.target.float32FlushToZero && serializer.Serialize(replay35.request) == remapped, "a version 35 request misread the depth remap fields or read an f32 flush flag");
-    auto truncated = remappedBytes;
+    auto truncated = version35;
     truncated.resize(truncated.size() - 2u);
     expectFailure([&] { static_cast<void>(serializer.Deserialize(encodeBase64(truncated))); }, "truncated data", "a truncated depth remap mode was accepted");
     auto trailing = remappedBytes;
@@ -5350,9 +6003,12 @@ void verifyMergedHullConfiguration() {
     const auto replay = serializer.Deserialize(merged);
     require(replay.request.graphics.has_value() && replay.request.graphics->tessellation.has_value() && replay.request.graphics->tessellation->mergedHull, "a merged hull configuration was lost in serialization");
     require(!serializer.Deserialize(separate).request.graphics->tessellation->mergedHull, "a separate hull configuration was read as merged");
+    constexpr std::size_t pointTailBytes = 13u;
     auto legacy = decodeBase64(merged);
+    require(legacy.size() > 54u + pointTailBytes && legacy[4] == 46u, "a merged hull request did not use serialization version 46");
+    legacy.resize(legacy.size() - sizeof(std::uint32_t) - 2u - pointTailBytes);
     legacy.pop_back();
-    require(legacy.size() > 52u && legacy[legacy.size() - 52u] == 1u, "the merged hull flag is not the last byte of the tessellation configuration");
+    require(legacy[legacy.size() - 52u] == 1u, "the merged hull flag is not the last byte of the tessellation configuration");
     legacy.erase(legacy.end() - 52);
     for (const auto version : {30u, 31u, 32u, 34u, 35u, 36u, 37u, 38u}) {
         auto older = legacy;
@@ -5820,10 +6476,10 @@ void verifyInt64AtomicCapabilities() {
     require(declares(compile(imageAtomic, spv::CapabilityInt64ImageEXT), spv::CapabilityInt64ImageEXT), "64-bit atomics: an image_atomic_swap on a 32_32 image does not declare Int64ImageEXT");
 }
 
-void verifySpecializedBufferAtomicBindings() {
+void verifySpecializedBufferAtomicBindings(bool finalAbiOnly = false) {
     using namespace ShaderRecompiler;
     const std::array<std::string_view, 2> extensions{"SPV_KHR_physical_storage_buffer", "SPV_KHR_8bit_storage"};
-    const std::array<std::uint32_t, 3> capabilities{spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess};
+    const std::array<std::uint32_t, 4> capabilities{spv::CapabilityInt64, spv::CapabilityPhysicalStorageBufferAddresses, spv::CapabilityStorageBuffer8BitAccess, spv::CapabilityInt64Atomics};
     alignas(256) static std::array<std::uint32_t, 64> buffer{};
     const auto bufferAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(buffer.data()));
     const std::array<std::uint32_t, 16> userData{
@@ -5831,8 +6487,8 @@ void verifySpecializedBufferAtomicBindings() {
         static_cast<std::uint32_t>(bufferAddress), static_cast<std::uint32_t>((bufferAddress >> 32u) & 0xffffu), 256u, 0x31016facu,
         0u, 0u, 0u, 0u,
         0u, 0u, 0u, 0u};
-    const std::vector<std::uint32_t> code{0xe0f05000u, 0x80012803u, 0xbf810000u};
-    const auto compile = [&](std::span<const std::uint32_t> supported) {
+    const auto compile = [&](std::span<const std::uint32_t> supported, std::uint32_t opcode = 0xe0f05000u) {
+        const std::array<std::uint32_t, 3> code{opcode, 0x80012803u, 0xbf810000u};
         RecompileRequest request{};
         request.shader = {ShaderStage::Compute, 0x58800u, code, 0, {}};
         request.context.waveSize = 32;
@@ -5850,6 +6506,16 @@ void verifySpecializedBufferAtomicBindings() {
         request.useCache = false;
         return Recompile(request);
     };
+    if (finalAbiOnly) {
+        for (const auto opcode : {0xe0f05000u, 0xe1705000u}) {
+            const auto result = compile(capabilities, opcode);
+            const auto faults = std::ranges::count_if(result.bindings, [](const DescriptorBinding& binding) { return binding.role == DescriptorRole::FaultBuffer; });
+            require(faults <= 1, "specialized buffer atomic: duplicate fault buffers");
+            require(result.bdaAbiVersion == (faults == 0 ? 0u : BdaAbi::Version), "specialized buffer atomic: final fault binding and BDA ABI disagree");
+            if (opcode == 0xe1705000u) require(faults == 1, "specialized buffer atomic: a 64-bit atomic lost its live fault buffer");
+        }
+        return;
+    }
     const auto result = compile(capabilities);
     std::size_t tables = 0;
     std::size_t faults = 0;
@@ -7466,8 +8132,19 @@ void verifyFmaskImageMode() {
     const auto modes = ResourceMaterializer::RuntimeImageModes(image);
     const auto selected = ResourceMaterializer::RuntimeImageMode(image, descriptor, modes);
     require(modes[selected].numericClass == IrTextureNumericClass::Uint && modes[selected].packedFormat == IrBufferFormat::Invalid && !modes[selected].constantSwizzle, "FMASK did not select a bound integer image mode");
-    for (std::uint32_t format = 156u; format <= 168u; ++format) {
-        if (format == 166u) continue;
+    for (const auto format : {156u, 157u, 158u, 159u, 160u, 161u, 163u, 165u}) {
+        descriptor.dwords[1] = format << 20u;
+        const auto expanded = ResourceMaterializer::RuntimeImageMode(image, descriptor, modes);
+        require(expanded != selected && modes[expanded].numericClass == IrTextureNumericClass::Uint && modes[expanded].conversionFormat == FmaskExpansion && modes[expanded].dimension == RdnaImageDimension::Dim2D, "an FMASK format of up to 8 samples did not select the FMASK expansion mode");
+    }
+    require(std::ranges::count_if(modes, [](const ImageResource& mode) { return mode.conversionFormat == FmaskExpansion; }) == 1, "FMASK expansion needs exactly one runtime image mode");
+    for (const auto format : {161u, 166u}) {
+        descriptor.dwords[1] = format << 20u;
+        descriptor.dwords[3] = 0x91800005u;
+        expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(image, descriptor, modes)); }, "FMASK destination channel selector is not implemented", "an FMASK load selecting Y was accepted");
+    }
+    descriptor.dwords[3] = 0x91800004u;
+    for (const auto format : {162u, 164u, 167u, 168u}) {
         descriptor.dwords[1] = format << 20u;
         expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(image, descriptor, modes)); }, "FMASK format is not implemented", "an unsupported FMASK format was accepted");
     }
@@ -7525,6 +8202,37 @@ void verifyVolumeArrayLoadMode() {
     expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(store, descriptor, ResourceMaterializer::RuntimeImageModes(store))); }, "incompatible with the static runtime image interface", "2D-array image atomic on a 3D T# was accepted");
 }
 
+void verifyMultisamplePlaneReadMode() {
+    using namespace ShaderRecompiler;
+    const DescriptorValue descriptor{{0x02754d00u, 0xc3800000u, 0x00cbc167u, 0xe1b20facu, 0u, 0x00700020u, 0u, 0u}, 8u};
+    ImageResource image{};
+    image.resourceClass = ImageResourceClass::Sampled;
+    image.dimension = RdnaImageDimension::Dim2D;
+    const auto modes = ResourceMaterializer::RuntimeImageModes(image);
+    const auto selected = ResourceMaterializer::RuntimeImageMode(image, descriptor, modes);
+    require(modes[selected].dimension == RdnaImageDimension::Dim2D && !modes[selected].cube && modes[selected].numericClass == IrTextureNumericClass::Float, "a 2D read of a 2D MSAA T# (PPSA18216's) did not select a 2D runtime mode");
+    for (const auto& [word1, word3, word5, numericClass] : std::array<std::tuple<std::uint32_t, std::uint32_t, std::uint32_t, IrTextureNumericClass>, 4>{{{0xc0100000u, 0xe1b20facu, 0x00700020u, IrTextureNumericClass::Float}, {0xc0500000u, 0xe1810facu, 0x00700010u, IrTextureNumericClass::Uint}, {0xc0c00000u, 0xe1b20facu, 0x00700020u, IrTextureNumericClass::Sint}, {0xc0d00000u, 0xe1830facu, 0x00700030u, IrTextureNumericClass::Float}}}) {
+        const DescriptorValue narrow{{0x02754d00u, word1, 0x00cbc167u, word3, 0u, word5, 0u, 0u}, 8u};
+        const auto mode = ResourceMaterializer::RuntimeImageMode(image, narrow, modes);
+        require(modes[mode].dimension == RdnaImageDimension::Dim2D && !modes[mode].cube && modes[mode].numericClass == numericClass, "a 2D read of a 2D MSAA T# with 8-bit or 16-bit texels did not select a 2D runtime mode");
+    }
+    const DescriptorValue depthBits{{0x02754d00u, 0xc0b00000u, 0x00cbc167u, 0xe1820facu, 0u, 0x00700020u, 0u, 0u}, 8u};
+    expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(image, depthBits, modes)); }, "incompatible with the static runtime image interface", "a 2D read of a 16_UINT SW_64KB_Z_X 2D MSAA T#, read as depth bits, was accepted");
+    const auto refused = [&](const ImageResource& access, const char* what) {
+        expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(access, descriptor, ResourceMaterializer::RuntimeImageModes(access))); }, "incompatible with the static runtime image interface", what);
+    };
+    auto other = image;
+    other.cubeFaceCompatible = false;
+    refused(other, "a 2D read of a 2D MSAA T# through a mip, gather, bias, gradient or offset access was accepted");
+    other = image;
+    other.depthCompare = true;
+    refused(other, "a 2D depth comparison of a 2D MSAA T# was accepted");
+    other = image;
+    other.resourceClass = ImageResourceClass::Storage;
+    other.written = true;
+    refused(other, "a 2D storage access to a 2D MSAA T# was accepted");
+}
+
 void verifyVolumeBiasTableRejection() {
     using namespace ShaderRecompiler;
     namespace Abi = ImageTableAbi;
@@ -7568,6 +8276,85 @@ void verifyVolumeBiasTableRejection() {
     }
 }
 
+void verifySamplerTableDeduplication() {
+    using namespace ShaderRecompiler;
+    namespace Abi = ImageTableAbi;
+    SamplerResource sampler0{};
+    sampler0.table = 0u;
+    SamplerResource sampler1{};
+    sampler1.table = 1u;
+    ShaderInfo info{};
+    info.samplers.push_back(sampler0);
+    info.samplers.push_back(sampler1);
+    ResourceSnapshot snapshot{};
+    snapshot.tables.tables.resize(2u);
+    const DescriptorValue s0{{0x00000600u, 0x00fff000u, 0x06f03fa0u, 0u}, 4u};
+    const DescriptorValue s1{{0x00000700u, 0x00fff000u, 0x06f03fa0u, 0u}, 4u};
+    const DescriptorValue s2{{0x00000800u, 0x00fff000u, 0x06f03fa0u, 0u}, 4u};
+    std::vector<std::uint32_t> codes(300u);
+    for (std::size_t i = 0; i < 300u; ++i) codes[i] = static_cast<std::uint32_t>(i % 3u);
+    for (std::uint32_t table = 0u; table < 2u; ++table) {
+        auto& column = snapshot.tables.tables[table];
+        column.records = 300u;
+        column.keys = 300u;
+        column.codes = SharedValues<std::uint32_t>(codes);
+        column.words = SharedValues<DescriptorValue>(std::vector<DescriptorValue>{s0, s1, s2});
+    }
+    const auto resolved = ResourceMaterializer::ResolveImageTables(info, snapshot);
+    require(resolved.samplers.size() == (3u + 1u) * Abi::SamplerEntryElements, "sampler table deduplication: duplicate sampler entries across tables were not deduplicated");
+    for (std::uint32_t table = 0u; table < 2u; ++table) {
+        const auto mapStart = resolved.map.at(Abi::TableHeader(table) + Abi::TableMapStart);
+        for (std::uint32_t key = 0; key < 300u; ++key) {
+            const auto record = resolved.map.at(mapStart + key);
+            const auto element = resolved.map.at(record + Abi::SamplerRecordElement);
+            require(element == (key % 3u) * Abi::SamplerEntryElements, "sampler table deduplication: record points to the wrong deduplicated sampler element");
+            require((resolved.map.at(record + Abi::SamplerRecordFlags) & Abi::PoisonFlag) == 0u, "sampler table deduplication: deduplicated sampler was poisoned");
+        }
+    }
+
+    constexpr std::uint32_t MaxUnique = Abi::SamplerElementBudget / Abi::SamplerEntryElements;
+    std::vector<DescriptorValue> budgetWords;
+    budgetWords.reserve(MaxUnique + 1u);
+    for (std::uint32_t i = 0; i < MaxUnique + 1u; ++i) {
+        budgetWords.push_back(DescriptorValue{{0x00000600u, 0x00fff000u, 0x06f03fa0u, i + 1u}, 4u});
+    }
+    std::vector<std::uint32_t> budgetCodes(MaxUnique + 2u);
+    for (std::uint32_t i = 0; i < MaxUnique; ++i) budgetCodes[i] = i;
+    budgetCodes[MaxUnique] = 0u;
+    budgetCodes[MaxUnique + 1u] = MaxUnique;
+
+    ShaderInfo budgetInfo{};
+    SamplerResource budgetSampler{};
+    budgetSampler.table = 0u;
+    budgetInfo.samplers.push_back(budgetSampler);
+    ResourceSnapshot budgetSnapshot{};
+    budgetSnapshot.tables.tables.resize(1u);
+    auto& budgetColumn = budgetSnapshot.tables.tables[0];
+    budgetColumn.records = static_cast<std::uint32_t>(budgetCodes.size());
+    budgetColumn.keys = static_cast<std::uint32_t>(budgetCodes.size());
+    budgetColumn.codes = SharedValues<std::uint32_t>(budgetCodes);
+    budgetColumn.words = SharedValues<DescriptorValue>(budgetWords);
+
+    const auto budgetResolved = ResourceMaterializer::ResolveImageTables(budgetInfo, budgetSnapshot);
+    require(budgetResolved.samplers.size() == Abi::SamplerElementBudget, "sampler table budget: valid unique samplers did not fill budget");
+    const auto budgetMapStart = budgetResolved.map.at(Abi::TableHeader(0) + Abi::TableMapStart);
+
+    const auto dupRecord = budgetResolved.map.at(budgetMapStart + MaxUnique);
+    const auto dupFlags = budgetResolved.map.at(dupRecord + Abi::SamplerRecordFlags);
+    require((dupFlags & Abi::PoisonFlag) == 0u, "sampler table budget: duplicate of existing sampler was poisoned when budget is full");
+    require(budgetResolved.map.at(dupRecord + Abi::SamplerRecordElement) == 0u, "sampler table budget: duplicate sampler did not reuse existing element");
+
+    const auto overflowRecord = budgetResolved.map.at(budgetMapStart + MaxUnique + 1u);
+    const auto overflowFlags = budgetResolved.map.at(overflowRecord + Abi::SamplerRecordFlags);
+    require((overflowFlags & Abi::PoisonFlag) != 0u, "sampler table budget: exceeding sampler budget did not poison record");
+    require(budgetResolved.poison.at(overflowFlags & ~Abi::PoisonFlag).reason == Abi::PoisonReason::Budget, "sampler table budget: poisoned reason is not Budget");
+
+    const auto outsideRecord = budgetResolved.map.at(Abi::TableHeader(0) + Abi::TableOutsideCode);
+    const auto outsideFlags = budgetResolved.map.at(outsideRecord + Abi::SamplerRecordFlags);
+    require((outsideFlags & Abi::PoisonFlag) != 0u, "sampler table budget: TableOutsideCode did not poison when budget is full");
+    require(budgetResolved.poison.at(outsideFlags & ~Abi::PoisonFlag).reason == Abi::PoisonReason::Budget, "sampler table budget: TableOutsideCode poisoned reason is not Budget");
+}
+
 void verifyDynamicStorageMipChain() {
     using namespace ShaderRecompiler;
     ImageResource image{};
@@ -7587,6 +8374,24 @@ void verifyDynamicStorageMipChain() {
     require(ResourceMaterializer::TryRuntimeImageMode(image, allLevels, modes).mode.has_value(), "a dynamic-mip storage image with sixteen levels was rejected");
 }
 
+void verifyArrayVolumeStoreMode() {
+    using namespace ShaderRecompiler;
+    const DescriptorValue descriptor{{0x11800100u, 0xc3800000u, 0x0003c003u, 0xd0900facu, 0u, 0x00700000u, 0u, 0u}, 8u};
+    ImageResource store{};
+    store.resourceClass = ImageResourceClass::Storage;
+    store.dimension = RdnaImageDimension::Dim3D;
+    store.written = true;
+    store.fmaskCompatible = false;
+    const auto modes = ResourceMaterializer::RuntimeImageModes(store);
+    require(modes[ResourceMaterializer::RuntimeImageMode(store, descriptor, modes)].dimension == RdnaImageDimension::Dim2DArray, "3D image store on a 2D-array T# did not select an array runtime mode");
+    store.read = true;
+    expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(store, descriptor, ResourceMaterializer::RuntimeImageModes(store))); }, "incompatible with the static runtime image interface", "3D image load and store on a 2D-array T# was accepted");
+    store.read = false;
+    store.atomic = true;
+    const DescriptorValue uintDescriptor{{0x11800100u, 0xc1400000u, 0x0003c003u, 0xd0900facu, 0u, 0x00700000u, 0u, 0u}, 8u};
+    expectFailure([&] { static_cast<void>(ResourceMaterializer::RuntimeImageMode(store, uintDescriptor, ResourceMaterializer::RuntimeImageModes(store))); }, "incompatible with the static runtime image interface", "3D image atomic on a 2D-array T# was accepted");
+}
+
 void verifySrgbDepthCompareModes() {
     using namespace ShaderRecompiler;
     for (const auto decodeFormats : {0u, 1u, 2u, 3u}) {
@@ -7613,6 +8418,11 @@ int main(int argc, char** argv) {
         setenv("ANYPS5_NO_SHADER_CACHE", "1", 1);
 #endif
         using namespace ShaderRecompiler;
+        if (argc == 2 && std::string_view(argv[1]) == "--specialized-bda-abi") {
+            verifySpecializedBufferAtomicBindings(true);
+            std::cout << "Specialized programs retain the BDA ABI only while a fault buffer remains\n";
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--quad-mask-no-demote") {
             verifyQuadMaskNeighbourReads();
             std::cout << "Quad masks preserve neighbour-lane helpers or refuse without demote\n";
@@ -7709,8 +8519,15 @@ int main(int argc, char** argv) {
         verifySignedMinimum();
         verifyMayEvaluate();
         verifyPureFlatSlots();
+        verifyPlanConditionPruning();
+        verifyPlanRetention();
+        verifyPlanRetentionChains();
+        verifyPlanCopyAnswers();
         verifyGuardedDescriptorSources();
+        verifyLaneMaskGuardedDescriptorSources();
+        verifyExecGuardedDescriptorSources();
         verifySrtTape();
+        verifyTargetFeatureKey();
         verifyImageTableKeys();
         verifyImageTables();
         verifyImageTableRegistration();
@@ -7727,6 +8544,7 @@ int main(int argc, char** argv) {
         verifyProgramCounterRelativeData();
         verifyLanesOutsideHostSubgroup();
         verifyHalfWaveReduction();
+        verifyFusedExactArithmetic();
         verifyNarrowVertexWave();
         verifySingleLaneVertexWave();
         verifyMeshConfiguration();
@@ -7761,7 +8579,10 @@ int main(int argc, char** argv) {
         verifyFmaskImageMode();
         verifyCubeDepthCompareMode();
         verifyVolumeArrayLoadMode();
+        verifyArrayVolumeStoreMode();
+        verifyMultisamplePlaneReadMode();
         verifyVolumeBiasTableRejection();
+        verifySamplerTableDeduplication();
         verifyDynamicStorageMipChain();
         verifySrgbDepthCompareModes();
         verifyQuadMaskNeighbourReads();
diff --git a/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp b/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp
index f1fe06c422..496fb288c5 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SharedWrites.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
 #include "prx/libc/include/GuestArena.hpp"
@@ -17,14 +18,6 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-}
-
 namespace {
 using namespace AgcDriver::GuestMemory;
 void require(bool condition, const char* reason) { if (!condition) throw std::runtime_error(reason); }
@@ -36,13 +29,14 @@ struct Mapping {
         require(sceKernelAllocateDirectMemory(0, 0x10000000000ll, size, 65536, 3, &physical) == 0, "allocate direct memory failed");
         if (sceKernelMapDirectMemory(&data, size, 3, 0, physical, 65536) != 0) {
             sceKernelReleaseDirectMemory(physical, size);
+
             throw std::runtime_error("map direct memory failed");
         }
     }
     Mapping(const Mapping&) = delete;
     Mapping& operator=(const Mapping&) = delete;
     ~Mapping() {
-        if (data != nullptr) sceKernelMunmap(data, size);
+        if (data != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), size);
         if (physical >= 0) sceKernelReleaseDirectMemory(physical, size);
     }
     std::uint64_t Address() const { return reinterpret_cast<std::uint64_t>(data); }
@@ -180,7 +174,7 @@ void partialCollect() {
     require(collect(alias, 0, mapping.size, 4, true) == std::vector<std::size_t>{page, page * 2}, "writes to two pages were not reported apart");
     require(collect(mapping.data, 0, mapping.size, 4, true) == std::vector<std::size_t>{page, page * 2}, "writes to two pages were not reported for their own view");
     require(collect(mapping.data, 0, mapping.size, 4, false).empty() && collect(alias, 0, mapping.size, 4, false).empty(), "page tracking did not settle");
-    require(sceKernelMunmap(alias, mapping.size) == 0, "partial collect alias unmap failed");
+    require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), mapping.size) == 0, "partial collect alias unmap failed");
 #endif
     std::cout << "Partial shared write collection tests passed\n";
 }
@@ -253,14 +247,14 @@ void run() {
         require(std::memcmp(replacement.data, across.data() + part, part) == 0, "physical alias did not see the write");
         require(std::all_of(static_cast<std::byte*>(originalAlias), static_cast<std::byte*>(originalAlias) + part, [](auto x) { return x == std::byte{29}; }), "replaced virtual range wrote the old backing");
 #ifndef _WIN32
-        require(sceKernelMunmap(middle, part) == 0, "partial unmap failed");
+        require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(middle), part) == 0, "partial unmap failed");
         const auto saved = bytes[0];
         across[0] = std::byte{99};
         require(!GuestArena::GuestArenaWriteSharedBacking_nid_no_patch(mapping.Address(), across.data(), across.size()), "writer accepted an unmapped gap");
         require(bytes[0] == saved, "failed shared write changed its prefix");
 #endif
         require(sceKernelMapDirectMemory(&middle, part, 3, 0x10, mapping.physical + part, part) == 0, "original backing restore failed");
-        require(sceKernelMunmap(originalAlias, part) == 0, "alias unmap failed");
+        require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(originalAlias), part) == 0, "alias unmap failed");
     }
     std::vector<std::thread> threads;
     for (unsigned i = 0; i < 8; ++i) threads.emplace_back([&, i] {
diff --git a/core/libs/prx/libSceAgcDriver/tests/SnapshotCopyFailure.cpp b/core/libs/prx/libSceAgcDriver/tests/SnapshotCopyFailure.cpp
new file mode 100644
index 0000000000..f302ebf9af
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/SnapshotCopyFailure.cpp
@@ -0,0 +1,74 @@
+#include "prx/libSceAgcDriver/Graphics/include/SnapshotCopies.hpp"
+#include "AllocationFailure.hpp"
+#include <array>
+#include <cstdio>
+#include <new>
+
+namespace {
+using AgcDriver::Graphics::Detail::SnapshotCopies;
+using AgcDriver::Tests::SetAllocationFailureCountdown;
+
+bool Consistent(const SnapshotCopies& copies) {
+    if (copies.entries.size() != copies.recency.size()) return false;
+    std::size_t bytes = 0;
+    for (auto it = copies.recency.begin(); it != copies.recency.end(); ++it) {
+        const auto found = copies.entries.find(*it);
+        if (found == copies.entries.end() || found->second.recent != it) return false;
+        bytes += found->second.bytes.size();
+    }
+    return bytes == copies.bytes;
+}
+
+void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void CheckInsertionFailures() {
+    const std::array<std::byte, 64> data{std::byte{0x37}};
+    unsigned failures = 0;
+    for (int point = 0; point < 4; ++point) {
+        SnapshotCopies copies;
+        const SnapshotCopies::Key first{0x1000, data.size(), VK_BUFFER_USAGE_STORAGE_BUFFER_BIT};
+        const SnapshotCopies::Key second{0x2000, data.size(), VK_BUFFER_USAGE_STORAGE_BUFFER_BIT};
+        auto owner = std::make_shared<int>(7);
+        const std::shared_ptr<AgcDriver::Graphics::Buffer> buffer(owner, nullptr);
+        copies.Insert(first, buffer, data);
+        bool failed = false;
+        SetAllocationFailureCountdown(point);
+        try {
+            copies.Insert(second, buffer, data);
+        } catch (const std::bad_alloc&) {
+            failed = true;
+            ++failures;
+        }
+        SetAllocationFailureCountdown(-1);
+        Require(Consistent(copies), "failed snapshot insertion left inconsistent eviction metadata");
+        Require(copies.entries.at(first).bytes == std::vector<std::byte>(data.begin(), data.end()), "failed insertion changed an existing snapshot");
+        Require(owner.use_count() == (failed ? 3 : 4), "snapshot insertion leaked or lost a buffer reference");
+        if (failed) {
+            Require(copies.entries.size() == 1 && copies.bytes == data.size(), "failed insertion changed cache accounting");
+            copies.Insert(second, buffer, data);
+        }
+        Require(Consistent(copies) && copies.entries.size() == 2, "cache could not recover after allocation failure");
+        const auto oldest = copies.entries.find(copies.recency.front());
+        copies.bytes -= oldest->second.bytes.size();
+        copies.entries.erase(oldest);
+        copies.recency.pop_front();
+        Require(Consistent(copies) && copies.entries.contains(second), "eviction after insertion failure corrupted another snapshot");
+        copies.Clear();
+        Require(Consistent(copies) && copies.bytes == 0 && owner.use_count() == 2, "snapshot teardown retained buffers or stale accounting");
+    }
+    Require(failures == 3, "did not exercise every snapshot insertion allocation");
+}
+}
+
+int main() {
+    try {
+        CheckInsertionFailures();
+        std::puts("Snapshot insertion allocation failures preserve eviction metadata and buffer ownership");
+    } catch (const std::exception& error) {
+        SetAllocationFailureCountdown(-1);
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp
index 8155564e0b..2bb13e5283 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SpirvLdsAtomicLock.cpp
@@ -77,10 +77,18 @@ Usage Scan(std::span<const std::uint32_t> words) {
     std::uint32_t laneZeroBody = 0u;
     std::uint32_t lockPointer = 0u;
     std::map<std::uint32_t, std::uint32_t> constants;
+    std::uint32_t faultFunction = 0u;
+    bool inFaultFunction = false;
     for (std::size_t cursor = 5; cursor < words.size();) {
         const auto count = words[cursor] >> spv::WordCountShift;
         const auto op = static_cast<spv::Op>(words[cursor] & spv::OpCodeMask);
         Require(count != 0 && cursor + count <= words.size(), "truncated SPIR-V instruction");
+        if (op == spv::OpName && count >= 3u && std::string_view(reinterpret_cast<const char*>(words.data() + cursor + 2u)) == "record_bda_fault") faultFunction = words[cursor + 1u];
+        if (op == spv::OpFunction && count >= 3u) inFaultFunction = words[cursor + 2u] == faultFunction;
+        if (inFaultFunction) {
+            cursor += count;
+            continue;
+        }
         if (op == spv::OpDecorate && count >= 4u && words[cursor + 2u] == spv::DecorationBuiltIn && words[cursor + 3u] == spv::BuiltInLocalInvocationIndex) {
             localIndexVariable = words[cursor + 1u];
         }
diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp
index 1be75623e3..05d848cdf2 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SpirvModule.cpp
@@ -1,5 +1,7 @@
 #include "SpirvBackend/SpirvModule.hpp"
 #include "SpirvBackend/SpirvSpecialization.hpp"
+#include "Recompiler.hpp"
+#include <algorithm>
 #include <array>
 #include <cstdio>
 #include <exception>
@@ -298,6 +300,92 @@ void testIdsBeyondTheBoundAreRejected() {
     check(rejected, "a module whose ids reach its bound was specialized");
 }
 
+void testPrivateCompositeTableLoadFolding() {
+    for (const auto storageClass : {spv::StorageClassPrivate, spv::StorageClassFunction}) {
+        for (const auto accessOp : {spv::OpAccessChain, spv::OpInBoundsAccessChain}) {
+            const auto build = [&](bool dynamicIndex, bool storeThroughChain) {
+                SpirvModule module;
+                module.EmitCapability(spv::CapabilityShader);
+                const auto typeVoid = module.Type(spv::OpTypeVoid);
+                const auto typeBool = module.Type(spv::OpTypeBool);
+                const auto typeU32 = module.Type(spv::OpTypeInt, 32u, 0u);
+                const auto falseVal = module.Constant(spv::OpConstantFalse, typeBool);
+                const auto zero = module.Constant(spv::OpConstant, typeU32, 0u);
+                const auto one = module.Constant(spv::OpConstant, typeU32, 1u);
+                const auto three = module.Constant(spv::OpConstant, typeU32, 3u);
+                const auto sixteen = module.Constant(spv::OpConstant, typeU32, 16u);
+                const auto twenty = module.Constant(spv::OpConstant, typeU32, 20u);
+                const auto thirty = module.Constant(spv::OpConstant, typeU32, 30u);
+                const auto typeArray = module.Type(spv::OpTypeArray, typeU32, three);
+                const auto initial = module.Constant(spv::OpConstantComposite, typeArray, std::vector<std::uint32_t>{sixteen, twenty, thirty});
+                const auto typeInputPtr = module.Type(spv::OpTypePointer, spv::StorageClassInput, typeU32);
+                const auto typeTablePtr = module.Type(spv::OpTypePointer, storageClass, typeArray);
+                const auto typeElementPtr = module.Type(spv::OpTypePointer, storageClass, typeU32);
+                const auto typePrivatePtr = module.Type(spv::OpTypePointer, spv::StorageClassPrivate, typeU32);
+                const auto typeFunction = module.Type(spv::OpTypeFunction, typeVoid);
+                const auto input = module.DefineGlobalVariable(typeInputPtr, spv::StorageClassInput);
+                const auto table = storageClass == spv::StorageClassPrivate
+                    ? module.DefineInitializedGlobalVariable(typeTablePtr, spv::StorageClassPrivate, initial)
+                    : module.AllocateId();
+                const auto output = module.DefineGlobalVariable(typePrivatePtr, spv::StorageClassPrivate);
+                const auto mainId = module.AllocateId();
+                const auto lane = module.AllocateId();
+                const auto rawCond = module.AllocateId();
+                const auto cond = module.AllocateId();
+                const auto baseIndex = module.AllocateId();
+                const auto index = module.AllocateId();
+                const auto element = module.AllocateId();
+                const auto loaded = module.AllocateId();
+                const auto sum = module.AllocateId();
+                module.AddFunction(spv::OpFunction, typeVoid, mainId, spv::FunctionControlMaskNone, typeFunction);
+                module.AddFunction(spv::OpLabel, module.AllocateId());
+                if (storageClass == spv::StorageClassFunction) module.AddFunction(spv::OpVariable, typeTablePtr, table, spv::StorageClassFunction, initial);
+                module.AddFunction(spv::OpLoad, typeU32, lane, input);
+                if (storeThroughChain) {
+                    const auto writePtr = module.AllocateId();
+                    module.AddFunction(accessOp, typeElementPtr, writePtr, table, zero);
+                    module.AddFunction(spv::OpStore, writePtr, lane);
+                }
+                module.AddFunction(spv::OpUGreaterThan, typeBool, rawCond, lane, zero);
+                module.AddFunction(spv::OpLogicalOr, typeBool, cond, rawCond, falseVal);
+                module.AddFunction(spv::OpIAdd, typeU32, baseIndex, one, one);
+                module.AddFunction(spv::OpSelect, typeU32, index, cond, baseIndex, baseIndex);
+                module.AddFunction(accessOp, typeElementPtr, element, table, dynamicIndex ? lane : index);
+                module.AddFunction(spv::OpLoad, typeU32, loaded, element);
+                module.AddFunction(spv::OpIAdd, typeU32, sum, lane, loaded);
+                module.AddFunction(spv::OpStore, output, sum);
+                module.AddFunction(spv::OpReturn);
+                module.AddFunction(spv::OpFunctionEnd);
+                return std::pair{ShaderRecompiler::SpecializeSpirv(module.Finalize()), thirty};
+            };
+            const auto [folded, expectedConstant] = build(false, false);
+            const auto foldedCounts = opcodeCounts(folded);
+            check(!foldedCounts.contains(accessOp), "a constant-index composite table access chain was not removed");
+            check(!foldedCounts.contains(spv::OpLogicalOr), "a right-false OpLogicalOr was not simplified");
+            check(!foldedCounts.contains(spv::OpSelect), "an identical-arm OpSelect was not simplified");
+            check(foldedCounts.contains(spv::OpLoad) && foldedCounts.at(spv::OpLoad) == 1u, "a constant-index composite table load was not folded");
+            bool addedThirty = false;
+            for (std::size_t cursor = 5; cursor < folded.size(); cursor += folded[cursor] >> 16u) {
+                if ((folded[cursor] >> 16u) == 0u) break;
+                if ((folded[cursor] & 0xffffu) == spv::OpIAdd && folded[cursor + 4u] == expectedConstant) addedThirty = true;
+            }
+            check(addedThirty, "a constant-index composite table load did not fold to its element constant");
+
+            const auto [dynamic, unusedDynamic] = build(true, false);
+            static_cast<void>(unusedDynamic);
+            const auto dynamicCounts = opcodeCounts(dynamic);
+            check(dynamicCounts.contains(accessOp) && dynamicCounts.at(accessOp) == 1u, "a dynamic-index composite table access chain was removed");
+            check(dynamicCounts.contains(spv::OpLoad) && dynamicCounts.at(spv::OpLoad) == 2u, "a dynamic-index composite table load was folded");
+
+            const auto [mutated, unusedMutated] = build(false, true);
+            static_cast<void>(unusedMutated);
+            const auto mutatedCounts = opcodeCounts(mutated);
+            check(mutatedCounts.contains(accessOp) && mutatedCounts.at(accessOp) == 2u, "a mutated composite table access chain was removed");
+            check(mutatedCounts.contains(spv::OpLoad) && mutatedCounts.at(spv::OpLoad) == 2u, "a mutated composite table load was folded despite a store through an access chain");
+        }
+    }
+}
+
 void testBlockBallotsOfOnePredicateShareOneBallot() {
     SpirvModule module;
     const auto typeBool = module.Type(spv::OpTypeBool);
@@ -356,10 +444,27 @@ void testBlockBallotsOfOnePredicateShareOneBallot() {
     check(ballotSources.contains(afterLabel), "a ballot in a later block reused one from an earlier block");
 }
 
+void testInternedSpirvSharesEqualWords() {
+    const std::vector<std::uint32_t> words{spv::MagicNumber, 0x00010400u, 0u, 7u, 0u, (2u << 16u) | spv::OpCapability, spv::CapabilityShader};
+    auto changed = words;
+    changed.back() = spv::CapabilityInt64;
+    const auto first = InternSpirv(words);
+    const auto second = InternSpirv(words);
+    const auto other = InternSpirv(changed);
+    check(std::ranges::equal(first.Words(), words) && std::ranges::equal(other.Words(), changed), "interned SPIR-V changed its words");
+    check(first.data() == second.data(), "two equal specialized modules kept separate copies of their words");
+    check(first.data() != other.data(), "different SPIR-V was interned into one copy");
+    auto edited = second;
+    edited[6] = spv::CapabilityFloat64;
+    const auto again = InternSpirv(words);
+    check(edited[6] == spv::CapabilityFloat64 && first[6] == spv::CapabilityShader && again.data() == first.data(), "a write to one holder of interned SPIR-V changed the others");
+}
+
 int main() {
     testFoldingLeavesNoDeadBlocksOrConstants();
     testIdsBeyondTheBoundAreRejected();
     testStructExtractsAreNotShuffled();
+    testPrivateCompositeTableLoadFolding();
     testRepeatedTypesShareOneId();
     testOperandShapesDoNotCollide();
     testOperandKindsAgree();
@@ -371,6 +476,7 @@ int main() {
     testIdsStayUniqueBeyondCacheCapacity();
     testEmittedWordsAreStable();
     testBlockBallotsOfOnePredicateShareOneBallot();
+    testInternedSpirvSharesEqualWords();
     if (failures != 0) {
         std::fprintf(stderr, "%d check(s) failed\n", failures);
         return 1;
diff --git a/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp b/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp
index eb5a967d31..b50010c578 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SpirvOptimizer.cpp
@@ -396,6 +396,7 @@ std::optional<std::pair<std::uint32_t, std::uint32_t>> storedLaneFunction(const
         switch (opcode) {
         case spv::OpFunction:
         case spv::OpLabel:
+        case spv::OpVariable:
         case spv::OpReturn:
         case spv::OpFunctionEnd:
             break;
@@ -936,6 +937,95 @@ OpStore %slot2 %second
     check(opcodeCount(acrossCall, spv::OpGroupNonUniformBallot) == 2, "a ballot was shared across a function call");
 }
 
+std::string privateTableModuleSource(const std::string& body, bool functionTable = false) {
+    const std::string storage = functionTable ? "Function" : "Private";
+    const std::string globalTable = functionTable ? "" : "%table = OpVariable %tableArray Private %initial\n";
+    const std::string localTable = functionTable ? "%table = OpVariable %tableArray Function %initial\n" : "";
+    return R"(OpCapability Shader
+OpMemoryModel Logical GLSL450
+OpEntryPoint GLCompute %main "main" %index
+OpExecutionMode %main LocalSize 8 1 1
+OpDecorate %index BuiltIn LocalInvocationIndex
+%void = OpTypeVoid
+%bool = OpTypeBool
+%uint = OpTypeInt 32 0
+%false = OpConstantFalse %bool
+%zero = OpConstant %uint 0
+%one = OpConstant %uint 1
+%three = OpConstant %uint 3
+%sixteen = OpConstant %uint 16
+%twenty = OpConstant %uint 20
+%thirty = OpConstant %uint 30
+%array = OpTypeArray %uint %three
+%initial = OpConstantComposite %array %sixteen %twenty %thirty
+%input = OpTypePointer Input %uint
+%tableArray = OpTypePointer )" + storage + R"( %array
+%tableElement = OpTypePointer )" + storage + R"( %uint
+%private = OpTypePointer Private %uint
+%function = OpTypeFunction %void
+%index = OpVariable %input Input
+)" + globalTable + R"(%output = OpVariable %private Private
+%main = OpFunction %void None %function
+%entry = OpLabel
+)" + localTable + R"(%lane = OpLoad %uint %index
+)" + body + R"(OpReturn
+OpFunctionEnd
+)";
+}
+
+void testSpecializedPrivateCompositeTableLoad() {
+    for (const bool functionTable : {false, true}) {
+        for (const bool inBounds : {false, true}) {
+            const auto accessName = inBounds ? "OpInBoundsAccessChain" : "OpAccessChain";
+            const auto accessOp = inBounds ? spv::OpInBoundsAccessChain : spv::OpAccessChain;
+            const std::string label = std::string(accessName) + (functionTable ? " (Function)" : " (Private)");
+            try {
+                const auto folded = assemble(privateTableModuleSource(
+                    "%rawCond = OpUGreaterThan %bool %lane %zero\n"
+                    "%cond = OpLogicalOr %bool %rawCond %false\n"
+                    "%baseOffset = OpIAdd %uint %one %one\n"
+                    "%offset = OpSelect %uint %cond %baseOffset %baseOffset\n"
+                    "%element = " + std::string(accessName) + " %tableElement %table %offset\n"
+                    "%loaded = OpLoad %uint %element\n"
+                    "%sum = OpIAdd %uint %lane %loaded\n"
+                    "OpStore %output %sum\n", functionTable));
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(folded, Vulkan11, Spirv13, false, false));
+                const auto specializedFolded = ShaderRecompiler::SpecializeSpirv(folded);
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(specializedFolded, Vulkan11, Spirv13, false, false));
+                check(opcodeCount(specializedFolded, accessOp) == 0u, label + ": constant-index table access chain was not removed");
+                check(opcodeCount(specializedFolded, spv::OpLogicalOr) == 0u, label + ": right-false OpLogicalOr was not simplified");
+                check(opcodeCount(specializedFolded, spv::OpSelect) == 0u, label + ": identical-arm OpSelect was not simplified");
+                check(opcodeCount(specializedFolded, spv::OpLoad) == 1u, label + ": constant-index table load was not folded");
+                check(storedLaneFunction(specializedFolded) == std::optional<std::pair<std::uint32_t, std::uint32_t>>({1u, 30u}), label + ": constant-index table load folded to the wrong value");
+
+                const auto dynamic = assemble(privateTableModuleSource(
+                    "%element = " + std::string(accessName) + " %tableElement %table %lane\n"
+                    "%loaded = OpLoad %uint %element\n"
+                    "OpStore %output %loaded\n", functionTable));
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(dynamic, Vulkan11, Spirv13, false, false));
+                const auto specializedDynamic = ShaderRecompiler::SpecializeSpirv(dynamic);
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(specializedDynamic, Vulkan11, Spirv13, false, false));
+                check(opcodeCount(specializedDynamic, accessOp) == 1u, label + ": dynamic-index table access chain was removed");
+                check(opcodeCount(specializedDynamic, spv::OpLoad) == 2u, label + ": dynamic-index table load was folded");
+
+                const auto mutated = assemble(privateTableModuleSource(
+                    "%writeElement = " + std::string(accessName) + " %tableElement %table %zero\n"
+                    "OpStore %writeElement %lane\n"
+                    "%readElement = " + std::string(accessName) + " %tableElement %table %one\n"
+                    "%loaded = OpLoad %uint %readElement\n"
+                    "OpStore %output %loaded\n", functionTable));
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(mutated, Vulkan11, Spirv13, false, false));
+                const auto specializedMutated = ShaderRecompiler::SpecializeSpirv(mutated);
+                static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(specializedMutated, Vulkan11, Spirv13, false, false));
+                check(opcodeCount(specializedMutated, accessOp) == 2u, label + ": mutated table access chain was removed");
+                check(opcodeCount(specializedMutated, spv::OpLoad) == 2u, label + ": mutated table load was folded despite a store through an access chain");
+            } catch (const std::exception& error) {
+                check(false, label + " table specialization: " + error.what());
+            }
+        }
+    }
+}
+
 }
 
 int main() {
@@ -953,6 +1043,7 @@ int main() {
     testFoldedConstantUsedByUndecodedInstructionIsKept();
     testSharedConstantsAreNotCopiedForUndecodedUsers();
     testSharedBooleanConstantsKeepTheirValues();
+    testSpecializedPrivateCompositeTableLoad();
     testBallotsMergedIntoOneBlockShareOneBallot(optimizationEnabled);
     if (failures != 0) {
         std::fprintf(stderr, "%d optimizer check(s) failed\n", failures);
@@ -961,3 +1052,4 @@ int main() {
     std::puts("SPIR-V optimizer checks passed");
     return 0;
 }
+
diff --git a/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp b/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp
index 272e5ed914..0578ee283d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/SubgroupBarrier.cpp
@@ -5,10 +5,12 @@
 #include <cstdint>
 #include <cstdio>
 #include <exception>
+#include <span>
 #include <stdexcept>
 #include <string>
 #include <string_view>
 #include <unordered_map>
+#include <utility>
 
 namespace {
 
@@ -34,6 +36,10 @@ constexpr std::array<std::uint32_t, 19> BranchedLdsStep{
     0xbf8cc07fu, 0xbf8a0000u, 0xbf810000u,
 };
 
+constexpr std::array<std::uint32_t, 5> LdsHalfStore{0x34040082u, 0xd87c0400u, 0x00000102u, 0xbf8cc07fu, 0xbf810000u};
+constexpr std::array<std::uint32_t, 5> LdsAtomicAdd{0x34040082u, 0xd8000400u, 0x00000102u, 0xbf8cc07fu, 0xbf810000u};
+constexpr std::array<std::uint32_t, 5> LdsAtomicMax{0x34040082u, 0xd84c0400u, 0x00000102u, 0xbf8cc07fu, 0xbf810000u};
+
 struct Barriers {
     std::uint32_t subgroupControl = 0;
     std::uint32_t subgroupMemory = 0;
@@ -43,14 +49,19 @@ void require(bool condition, const std::string& message) {
     if (!condition) throw std::runtime_error(message);
 }
 
-Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
+struct MemoryBarriers {
+    std::uint32_t workgroup = 0;
+    std::uint32_t device = 0;
+};
+
+ShaderRecompiler::RecompileResult recompileProgram(std::span<const std::uint32_t> code, std::uint32_t threads, bool waveLdsMemoryBarriers, bool deviceScopeLdsMemoryBarriers) {
     using namespace ShaderRecompiler;
     const std::array<std::uint32_t, 2> capabilities{spv::CapabilityShader, spv::CapabilityGroupNonUniform};
     const std::array<std::string_view, 1> extensions{"SPV_KHR_storage_buffer_storage_class"};
     RecompileRequest request{};
-    request.shader = {ShaderStage::Compute, 0x20000u, BranchedLdsStep, 0, {}};
+    request.shader = {ShaderStage::Compute, 0x20000u, code, 0, {}};
     request.context.waveSize = 32;
-    request.context.compute = ShaderComputeStageInfo{{threads, 1u, 1u}, 256u, {false, false, false}, false, 1u};
+    request.context.compute = ShaderComputeStageInfo{{threads, 1u, 1u}, 512u, {false, false, false}, false, 1u};
     request.target.vulkanVersion = 0x00403000u;
     request.target.spirvVersion = 0x00010600u;
     request.target.subgroupSize = 32;
@@ -61,15 +72,42 @@ Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
     request.target.maxWorkgroupInvocations = 1024;
     request.target.maxWorkgroupSharedMemoryBytes = 49152;
     request.target.waveLdsMemoryBarriers = waveLdsMemoryBarriers;
+    request.target.deviceScopeLdsMemoryBarriers = deviceScopeLdsMemoryBarriers;
     request.layout = {0, 0, 0, 128};
     request.useCache = false;
-    const auto result = Recompile(request);
-    const auto& words = result.spirv.Words();
+    return Recompile(request);
+}
+
+std::unordered_map<std::uint32_t, std::uint32_t> constantsOf(std::span<const std::uint32_t> words) {
     std::unordered_map<std::uint32_t, std::uint32_t> constants;
+    for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+        if (static_cast<spv::Op>(words[at] & 0xffffu) == spv::OpConstant && (words[at] >> 16u) == 4u) constants[words[at + 2]] = words[at + 3];
+    }
+    return constants;
+}
+
+MemoryBarriers memoryBarriers(std::span<const std::uint32_t> code, bool deviceScopeLdsMemoryBarriers) {
+    const auto result = recompileProgram(code, 128, false, deviceScopeLdsMemoryBarriers);
+    const auto& words = result.spirv.Words();
+    const auto constants = constantsOf(words);
+    MemoryBarriers barriers;
+    for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
+        if (static_cast<spv::Op>(words[at] & 0xffffu) != spv::OpMemoryBarrier) continue;
+        const auto scope = constants.find(words[at + 1]);
+        require(scope != constants.end(), "a memory barrier scope is not a 32-bit constant");
+        if (scope->second == spv::ScopeWorkgroup) ++barriers.workgroup;
+        if (scope->second == spv::ScopeDevice) ++barriers.device;
+    }
+    return barriers;
+}
+
+Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
+    const auto result = recompileProgram(BranchedLdsStep, threads, waveLdsMemoryBarriers, false);
+    const auto& words = result.spirv.Words();
+    const auto constants = constantsOf(words);
     Barriers barriers;
     for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
         const auto op = static_cast<spv::Op>(words[at] & 0xffffu);
-        if (op == spv::OpConstant && (words[at] >> 16u) == 4u) constants[words[at + 2]] = words[at + 3];
         if (op != spv::OpControlBarrier && op != spv::OpMemoryBarrier) continue;
         const auto scope = constants.find(words[at + 1]);
         require(scope != constants.end(), "a barrier scope is not a 32-bit constant");
@@ -83,6 +121,17 @@ Barriers recompile(std::uint32_t threads, bool waveLdsMemoryBarriers) {
 void verifyDriverQuirk() {
     for (const auto& item : Cases) {
         require(AgcDriver::SubgroupControlBarrierUsable(item.driver) == item.usable, "driver " + std::to_string(static_cast<int>(item.driver)) + ": expected subgroup control barriers to be " + (item.usable ? "usable" : "unusable"));
+        require(AgcDriver::WorkgroupScopeFenceUsable(item.driver) == item.usable, "driver " + std::to_string(static_cast<int>(item.driver)) + ": expected workgroup-scope fences to be " + (item.usable ? "usable" : "unusable"));
+    }
+}
+
+void verifyLdsMemoryBarrierScope() {
+    const std::array<std::pair<const char*, std::span<const std::uint32_t>>, 3> programs{{{"ds_write_b16", LdsHalfStore}, {"ds_add_u32", LdsAtomicAdd}, {"ds_max_f32", LdsAtomicMax}}};
+    for (const auto& [name, code] : programs) {
+        const auto workgroup = memoryBarriers(code, false);
+        require(workgroup.workgroup == 1 && workgroup.device == 0, std::string(name) + " did not order its LDS update with one workgroup-scope OpMemoryBarrier");
+        const auto device = memoryBarriers(code, true);
+        require(device.workgroup == 0 && device.device == 1, std::string(name) + " with device-scope LDS memory barriers did not order its LDS update with one device-scope OpMemoryBarrier");
     }
 }
 
@@ -101,6 +150,7 @@ int main() {
     try {
         verifyDriverQuirk();
         verifyEmittedBarriers();
+        verifyLdsMemoryBarrierScope();
         std::puts("subgroup barrier tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/Submit.cpp b/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
index d97862941b..3f531ade83 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "execution/VulkanTestDevice.hpp"
 #include "prx/libSceAgcDriver/Execution/include/QueueState.hpp"
@@ -31,9 +32,6 @@
 #include <windows.h>
 #endif
 
-extern "C" int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-extern "C" int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-
 static_assert(sizeof(Packet) == 16);
 static_assert(offsetof(Packet, addr) == 0);
 static_assert(offsetof(Packet, dw_num) == 8);
diff --git a/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp b/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp
index f302a0d119..c6bbb71920 100644
--- a/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/TessellationFactorRing.cpp
@@ -1,14 +1,10 @@
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceAgcDriverSetTFRing(const volatile void* base, uint32_t size);
-int APS5_VABI sceAgcDriverGetTFRing(uintptr_t* base, uint32_t* size);
-}
-
 namespace {
 
 constexpr uint32_t Canary = 0xa5a5a5a5;
diff --git a/core/libs/prx/libSceAgcDriver/tests/TessellationLowering.cpp b/core/libs/prx/libSceAgcDriver/tests/TessellationLowering.cpp
index 1b1ec2d0da..2ccb9129ac 100644
--- a/core/libs/prx/libSceAgcDriver/tests/TessellationLowering.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/TessellationLowering.cpp
@@ -1,11 +1,16 @@
 #include "IntermediateRepresentation/IrBuilder.hpp"
 #include "IntermediateRepresentation/IrProgram.hpp"
+#include "Optimization/ShaderStageInputInfo.hpp"
 #include "Optimization/TessellationLowering.hpp"
+#include "SpirvBackend/SpirvEmitter.hpp"
+#include <spirv/unified1/spirv.hpp>
 #include <cstdint>
 #include <cstdio>
 #include <exception>
 #include <functional>
+#include <stdexcept>
 #include <string>
+#include <unordered_map>
 
 using namespace ShaderRecompiler;
 
@@ -135,6 +140,52 @@ bool RefusedBecause(IrProgram& program, const char* reason) {
     return !outcome.lowered && outcome.reason.find(reason) != std::string::npos;
 }
 
+std::uint32_t EmittedEvaluationControlPoint(std::uint32_t address) {
+    constexpr std::uint32_t ControlStride = 16u;
+    IrProgram program;
+    IrBuilder builder{program};
+    program.SetWaveSize(64);
+    program.Resources().stage = IrShaderStage::TessellationEvaluation;
+    program.Resources().srtPlanComplete = true;
+    program.Resources().resourceTrackingComplete = true;
+    program.Metadata().shaderInfoComplete = true;
+    program.Metadata().bindingLayoutComplete = true;
+    program.Metadata().tessellationControlStride = ControlStride;
+    auto& block = program.CreateBlock();
+    program.SetEntryBlock(block);
+    program.BlockOrder().push_back(&block);
+    BlockInfo info;
+    info.id = block.Id();
+    program.Metadata().blockInfo.push_back(info);
+    builder.SetInsertionPoint(block);
+    auto& read = builder.Emit(IrOpcode::GetTessellationAttribute, IrType::U32, {&builder.Constant(static_cast<std::uint32_t>(TessellationAttribute::EvaluationInput)), &builder.Constant(address), &builder.ConstantBool(true)});
+    static_cast<void>(builder.Emit(IrOpcode::ReferenceU32, IrType::Void, {&read}));
+    ShaderVertexInputInfo vertex;
+    vertex.tess.inputControlPoints = InputControlPoints;
+    vertex.tess.outputControlPoints = InputControlPoints;
+    vertex.tess.domain = 1u;
+    vertex.tess.partitioning = 2u;
+    vertex.tess.outputTopology = 2u;
+    ShaderStageInputInfo inputs;
+    inputs.vertex = &vertex;
+    CompiledBindingLayout bindings;
+    bindings.layout = program.Metadata().bindings;
+    SpirvTargetOptions target{};
+    target.vulkanVersion = 0x00401000;
+    target.spirvVersion = 0x00010300;
+    target.subgroupSize = 64;
+    const auto words = SpirvEmitter().Emit(program, inputs, bindings, target);
+    std::unordered_map<std::uint32_t, std::uint32_t> constants;
+    for (std::size_t at = 5; at < words.size(); at += words[at] >> 16u) {
+        const auto count = words[at] >> 16u;
+        if (count == 0u || at + count > words.size()) throw std::runtime_error("the domain program compiled to a malformed SPIR-V instruction");
+        const auto opcode = words[at] & 0xffffu;
+        if (opcode == spv::OpConstant && count == 4u) constants[words[at + 2u]] = words[at + 3u];
+        if (opcode == spv::OpAccessChain && count == 7u) return constants.at(words[at + 4u]);
+    }
+    throw std::runtime_error("the domain program reads no control point attribute");
+}
+
 bool run(const char* name, const std::function<bool()>& body) {
     bool passed = false;
     try {
@@ -206,5 +257,9 @@ int main() {
         return patch->Opcode() == IrOpcode::IMul32 && patch->Argument(1)->Resolve()->ImmediateU32() == PatchStride;
     });
 
+    passed &= run("a domain read at an immediate address past the last control point reads the last control point", [] {
+        return EmittedEvaluationControlPoint(InputControlPoints * 16u) == InputControlPoints - 1u;
+    });
+
     return passed ? 0 : 1;
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp b/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp
index 31ff43033e..3a13ee2d9e 100644
--- a/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/TextureFormat.cpp
@@ -63,6 +63,7 @@ void srgbTwinTests() {
     Require(SrgbTwinFormat(context, VK_FORMAT_R8_UNORM) == VK_FORMAT_UNDEFINED, "a device that decodes 8_SRGB in the shader must not give R8 an sRGB twin");
     Require(SrgbTwinFormat(context, VK_FORMAT_R8G8B8A8_UNORM) == VK_FORMAT_R8G8B8A8_SRGB && SrgbTwinFormat(context, VK_FORMAT_BC7_UNORM_BLOCK) == VK_FORMAT_BC7_SRGB_BLOCK, "formats without a shader decode must keep their sRGB twins");
     Require(SrgbTwinFormat(context, VK_FORMAT_R32_SFLOAT) == VK_FORMAT_UNDEFINED, "formats without an sRGB counterpart have no twin");
+    Require(SrgbTwinFormat(context, VK_FORMAT_R8G8B8A8_SNORM) == VK_FORMAT_R8G8B8A8_SRGB, "8_8_8_8 SNORM must read its bytes through the sRGB twin");
 }
 
 template<typename TAction>
@@ -143,6 +144,25 @@ void repackedFormatTests() {
     Require(TextureComponentChannel(guest, VK_COMPONENT_SWIZZLE_A) == VK_COMPONENT_SWIZZLE_A && TextureComponentChannel(guest, VK_COMPONENT_SWIZZLE_ZERO) == VK_COMPONENT_SWIZZLE_ZERO, "format 43 keeps alpha and constant selectors");
 }
 
+void gcnBufferFormatTests() {
+    using ShaderRecompiler::IrBufferFormat;
+    const auto& formats = ShaderRecompiler::GcnBufferFormats();
+    const auto gcn = [&](std::uint32_t data, std::uint32_t number) { return static_cast<IrBufferFormat>(formats[(data << 3u) | number]); };
+    std::array<std::uint32_t, 78> seen{};
+    for (const auto format : formats) ++seen[format];
+    for (std::uint32_t format = 1; format < seen.size(); ++format) Require(seen[format] == 1u, "unified buffer format " + std::to_string(format) + " must come from exactly one GCN format pair");
+    Require(gcn(0u, 4u) == IrBufferFormat::Invalid && gcn(15u, 7u) == IrBufferFormat::Invalid, "GCN DATA_FORMAT 0 and 15 have no buffer form");
+    Require(gcn(1u, 7u) == IrBufferFormat::Invalid && gcn(4u, 0u) == IrBufferFormat::Invalid, "8-bit float and 32-bit UNORM have no buffer form");
+    Require(gcn(1u, 0u) == IrBufferFormat::Format8UNorm && gcn(2u, 7u) == IrBufferFormat::Format16Float, "8 and 16-bit pairs must map");
+    Require(gcn(4u, 4u) == IrBufferFormat::Format32UInt && gcn(4u, 7u) == IrBufferFormat::Format32Float, "32-bit pairs must map");
+    Require(gcn(6u, 7u) == IrBufferFormat::Format11_11_10Float && gcn(7u, 7u) == IrBufferFormat::Format10_11_11Float, "GCN 10_11_11 and 11_11_10 must map by bit layout");
+    Require(gcn(8u, 0u) == IrBufferFormat::Format2_10_10_10UNorm && gcn(9u, 0u) == IrBufferFormat::Format10_10_10_2UNorm, "GCN 10_10_10_2 and 2_10_10_10 must map by bit layout");
+    Require(gcn(10u, 0u) == IrBufferFormat::Format8_8_8_8UNorm && gcn(14u, 7u) == IrBufferFormat::Format32_32_32_32Float, "four-channel pairs must map");
+    const std::uint32_t word3 = 0x00000facu | (7u << 12u) | (14u << 15u) | (7u << 27u);
+    Require(ShaderRecompiler::GcnBufferWord3(16u << 16u, word3) == (0x00000facu | (77u << 12u) | (1u << 28u)), "a strided GCN V# must check its index range");
+    Require(ShaderRecompiler::GcnBufferWord3(0u, word3) == (0x00000facu | (77u << 12u) | (3u << 28u)), "a GCN V# without a stride must check its byte range");
+}
+
 void convertedDccClearTests() {
     alignas(64) std::array<std::uint8_t, 16> keys{};
     GuestTextureResource resource{};
@@ -204,6 +224,22 @@ void packedFloatDccClearTests() {
     Require(TextureClearKeys(resource, 1024) == DccKeys::Clear1111, "packed float texture discarded its white fast-clear keys");
 }
 
+void fillContractTests() {
+    std::array<std::uint32_t, 4> texels;
+    texels.fill(0xdeadbeefu);
+    auto span = std::as_writable_bytes(std::span(texels));
+    Require(!FillDccClear(VK_FORMAT_R8G8B8A8_UNORM, DccKeys::ClearRegister, false, span), "a register clear encoded a texel");
+    for (const auto texel : texels) Require(texel == 0u, "a declined clear left its span untouched");
+    texels.fill(0xdeadbeefu);
+    Require(!FillDccClear(VK_FORMAT_R8G8B8A8_UNORM, DccKeys::Uncompressed, false, span), "an uncompressed code encoded a texel");
+    for (const auto texel : texels) Require(texel == 0u, "a declined clear left its span untouched");
+    std::array<std::byte, 10> partial;
+    partial.fill(std::byte{0x5a});
+    Require(FillDccClear(VK_FORMAT_B10G11R11_UFLOAT_PACK32, DccKeys::Clear1111, false, partial), "packed float fast clear was not encoded");
+    const std::array<std::byte, 4> white{std::byte{0xc0}, std::byte{0x03}, std::byte{0x1e}, std::byte{0x78}};
+    for (std::size_t index = 0; index < partial.size(); ++index) Require(partial[index] == (index < 8u ? white[index % 4u] : std::byte{0}), "a clear fill over a partial trailing element did not zero the tail");
+}
+
 }
 
 void RunTextureFormatTests() {
@@ -268,4 +304,6 @@ void RunTextureFormatTests() {
     convertedDccClearTests();
     singleDccKeysTests();
     packedFloatDccClearTests();
+    fillContractTests();
+    gcnBufferFormatTests();
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp b/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp
new file mode 100644
index 0000000000..3217dc0eb1
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/UnsupportedDiagnostics.cpp
@@ -0,0 +1,8 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
+#include "SceTypes.hpp"
+
+int main() {
+    if (sceAgcDriverGetCoredumpAddress() != nullptr) return 1;
+    if (sceAgcDriverSetTargetRingForDiag() != static_cast<int>(0x8A6D0001)) return 2;
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp b/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp
index a69e325898..0efed550e8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/VectorWindow.cpp
@@ -40,6 +40,13 @@ constexpr std::uint32_t SampleV8V2S0S8 = 0x00400802u;
 constexpr std::uint32_t AddV8V1V8 = 0x4a101101u;
 constexpr std::uint32_t BufferStoreDword = 0xe0700000u;
 constexpr std::uint32_t StoreV8WithS12 = 0x80030800u;
+constexpr std::uint32_t AndM0GroupXOne = 0x877c8104u;
+constexpr std::uint32_t MovreldV2V0 = 0x7e048500u;
+constexpr std::uint32_t MoveS16Two = 0xbe900382u;
+constexpr std::uint32_t BranchForwardTwo = 0xbf820002u;
+constexpr std::uint32_t SubtractS16One = 0x80908110u;
+constexpr std::uint32_t CompareS16NotZero = 0xbf078010u;
+constexpr std::uint32_t BranchBackFourOnScc = 0xbf85fffcu;
 
 struct Shape {
     std::size_t functionArrays = 0;
@@ -137,6 +144,57 @@ std::size_t WindowStores(std::span<const std::uint32_t> words) {
     return stores;
 }
 
+constexpr std::array<std::uint32_t, 34> WindowInit{
+    0x34020086, 0x34060088, 0x4a140680, 0x4a160681, 0x4a180682, 0x4a1a0683, 0x4a1c0684, 0x4a1e0685,
+    0x4a200686, 0x4a220687, 0x4a240688, 0x4a260689, 0x4a28068a, 0x4a2a068b, 0x4a2c068c, 0x4a2e068d,
+    0x4a30068e, 0x4a32068f, 0x4a340690, 0x4a360691, 0x4a380692, 0x4a3a0693, 0x4a3c0694, 0x4a3e0695,
+    0x4a400696, 0x4a420697, 0x4a440698, 0x4a460699, 0x4a48069a, 0x4a4a069b, 0x4a4c069c, 0x4a4e069d,
+    0x4a50069e, 0x4a52069f,
+};
+constexpr std::uint32_t MoveM0BoundedS8 = 0x877c8308u;
+constexpr std::uint32_t MoveM0S9 = 0xbefc0309u;
+constexpr std::uint32_t MovrelsV4V10 = 0x7e08870au;
+
+std::vector<std::uint32_t> NarrowingProgram(std::uint32_t unbounded) {
+    std::vector<std::uint32_t> code(WindowInit.begin(), WindowInit.end());
+    code.push_back(MoveM0BoundedS8);
+    code.push_back(MovrelsV4V10);
+    code.push_back(0xe0701ffcu);
+    code.push_back(0x80010401u);
+    code.push_back(MoveM0S9);
+    for (std::uint32_t read = 0; read < unbounded; ++read) {
+        const std::uint32_t destination = 42u + read % 100u;
+        code.push_back((MovrelsV4V10 & ~(0xffu << 17u)) | (destination << 17u));
+        code.push_back(0xe0701000u | ((read * 4u) & 0xfffu));
+        code.push_back(0x80010001u | destination << 8u);
+    }
+    code.push_back(EndProgram);
+    return code;
+}
+
+std::vector<std::uint32_t> RecompileNarrowing(std::uint32_t unbounded) {
+    std::array<std::uint32_t, 10> userData{0u, 0u, 0u, 0u, 0x10000000u, 0u, 0x40u, 0x31016facu, 3u, 5u};
+    return RecompileProgram(NarrowingProgram(unbounded), userData);
+}
+
+struct Narrowing {
+    std::uint32_t functionVariables = 0;
+    std::uint32_t switchCases = 0;
+};
+
+Narrowing ScanNarrowing(std::span<const std::uint32_t> words) {
+    Narrowing result;
+    for (std::size_t cursor = 5; cursor < words.size();) {
+        const auto count = words[cursor] >> spv::WordCountShift;
+        const auto op = static_cast<spv::Op>(words[cursor] & spv::OpCodeMask);
+        Require(count != 0 && cursor + count <= words.size(), "truncated SPIR-V instruction");
+        if (op == spv::OpVariable && words[cursor + 3] == spv::StorageClassFunction) ++result.functionVariables;
+        if (op == spv::OpSwitch) result.switchCases += (count - 3u) / 2u;
+        cursor += count;
+    }
+    return result;
+}
+
 IrProgram TranslateStage(ShaderStageKind stage, std::uint32_t waveSize, std::uint32_t base = 0u, std::uint32_t fetchStart = 0u, std::uint32_t fetchCount = 0u) {
     ShaderComputeInputInfo compute{};
     compute.threadIdsNum = 3;
@@ -306,6 +364,35 @@ int main(int argc, char** argv) {
         return shape.functionArrays == 0 && shape.accessChains == 0;
     });
 
+    passed &= run("a sampler dword spilled into a window register with ordinary writes keeps its definition past a relative write", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 14> spilled{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, MoveV4One, WritelaneV4, FromS8Lane0, MovreldV2V0, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        return Scan(RecompileProgram(spilled, userData)).functionArrays == 1;
+    });
+
+    passed &= run("a sampler dword spilled into a window register and overwritten by an ordinary write before its v_readlane stays a run-time value", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 14> overwritten{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, WritelaneV4, FromS8Lane0, MovreldV2V0, MoveV4One, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        try {
+            RecompileProgram(overwritten, userData);
+        } catch (const std::exception& error) {
+            return std::string_view(error.what()).find("GetSamplerResource dword 0 is not a valid runtime value; chain: ReadLane(LoadVectorWindow(Immediate), Immediate)") != std::string_view::npos;
+        }
+        return false;
+    });
+
+    passed &= run("a sampler dword spilled into a window register before a loop entered at its condition keeps its definition past the loop's relative write", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 18> code{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, WritelaneV4, FromS8Lane0, MoveS16Two, BranchForwardTwo, MovreldV2V0, SubtractS16One, CompareS16NotZero, BranchBackFourOnScc, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        return Scan(RecompileProgram(code, userData)).functionArrays == 1;
+    });
+
+    passed &= run("a sampler dword spilled into a window register with ordinary writes before a loop entered at its condition keeps its definition past the loop's relative write", [] {
+        const std::array<std::uint32_t, 16> userData{};
+        const std::array<std::uint32_t, 19> code{AndM0GroupXOne, MoveV2Zero, MoveV3Zero, MoveV4One, WritelaneV4, FromS8Lane0, MoveS16Two, BranchForwardTwo, MovreldV2V0, SubtractS16One, CompareS16NotZero, BranchBackFourOnScc, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, BufferStoreDword, StoreV8WithS12, EndProgram};
+        return Scan(RecompileProgram(code, userData)).functionArrays == 1;
+    });
+
     passed &= run("a sampler dword spilled into a relatively read register keeps its definition through v_readlane", [] {
         const std::array<std::uint32_t, 14> code{MoveM0GroupX, MoveV2Zero, MoveV3Zero, WritelaneV4, FromS8Lane0, MovrelsV1V4, ReadlaneS8, FromV4Lane0, ImageSampleLz2d, SampleV8V2S0S8, AddV8V1V8, BufferStoreDword, StoreV8WithS12, EndProgram};
         const std::array<std::uint32_t, 16> userData{};
@@ -322,6 +409,19 @@ int main(int argc, char** argv) {
         return twice == single && single >= 3u;
     });
 
+    passed &= run("a window with a few unproven relative reads keeps its unindexed slots out of the array", [] {
+        const auto few = ScanNarrowing(RecompileNarrowing(2));
+        if (few.functionVariables <= 8u || few.switchCases == 0u) std::fprintf(stderr, "  two unproven reads: %u function variables, %u switch cases\n", few.functionVariables, few.switchCases);
+        return few.functionVariables > 8u && few.switchCases != 0u;
+    });
+
+    passed &= run("a window with hundreds of unproven relative reads does not grow a switch for each of them", [] {
+        const auto many = ScanNarrowing(RecompileNarrowing(300));
+        const auto few = ScanNarrowing(RecompileNarrowing(2));
+        if (many.switchCases > 4096u || many.functionVariables >= few.functionVariables) std::fprintf(stderr, "  300 unproven reads: %u function variables, %u switch cases (2 reads: %u, %u)\n", many.functionVariables, many.switchCases, few.functionVariables, few.switchCases);
+        return many.switchCases <= 4096u && many.functionVariables < few.functionVariables;
+    });
+
     if (passed) std::puts("Vector window shape and SSA control tests passed");
     return passed ? 0 : 1;
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp
index 5d56b47f05..48d26f71df 100644
--- a/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/VertexInput.cpp
@@ -58,8 +58,36 @@ template<class TAction> void fails(TAction&& fn) {
     Require(failed, "invalid vertex input was accepted");
 }
 
+void descriptorDiagnostics(const Context& ctx) {
+    auto input = attribute(7);
+    input.resource.fields = {0x89abcde0u, 0x0010abcdu, 0x12345678u, 0x0104dfacu};
+    Require(BuildVertexInputLayout(ctx, std::span(&input, 1)).attributes.size() == 1, "valid diagnostic control was rejected");
+    struct Case {
+        unsigned field;
+        std::uint32_t bits;
+        const char* words;
+    };
+    constexpr std::array cases{
+        Case{1, 0x80000000u, "V#=[89abcde0 8010abcd 12345678 0104dfac]"},
+        Case{3, 0x00800000u, "V#=[89abcde0 0010abcd 12345678 0184dfac]"},
+        Case{3, 0x40000000u, "V#=[89abcde0 0010abcd 12345678 4104dfac]"},
+        Case{3, 0x80000000u, "V#=[89abcde0 0010abcd 12345678 8104dfac]"},
+        Case{3, 0xc0800000u, "V#=[89abcde0 0010abcd 12345678 c184dfac]"}
+    };
+    for (const auto& value : cases) {
+        auto described = input;
+        described.resource.fields[value.field] |= value.bits;
+        const auto before = described.resource.fields;
+        const std::string message(VertexDescriptorFlagsMessage(described).data());
+        Require(message.find("unsupported vertex buffer descriptor flags at location 7") != std::string::npos && message.find(value.words) != std::string::npos,
+            "vertex flag message did not identify the attribute and all four descriptor words: " + message);
+        Require(described.resource.fields == before, "formatting changed the descriptor");
+    }
+}
+
 void run() {
     auto ctx = context();
+    descriptorDiagnostics(ctx);
     VertexInputCache cache(ctx, 2);
     std::array attributes{attribute(0), attribute(1)};
     auto first = get(cache, ctx, 1, attributes);
diff --git a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
index e7ad973bba..af8efbc48e 100644
--- a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
@@ -15,6 +15,7 @@
 #ifdef __GLIBC__
 #include <malloc.h>
 #endif
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstring>
@@ -35,6 +36,9 @@ constexpr std::size_t Block = 65536;
 #ifdef _WIN32
 constexpr wchar_t HostHoleMode[] = L"--host-hole";
 constexpr wchar_t ResidentRemapMode[] = L"--resident-direct-remap";
+constexpr wchar_t RewatchedSharedMode[] = L"--rewatched-direct-shared";
+constexpr wchar_t ImportAliasSharedMode[] = L"--import-alias-shared";
+constexpr wchar_t SharedGenerationsMode[] = L"--compared-shared-generations";
 #endif
 
 void Require(bool condition, const std::string& message) {
@@ -174,6 +178,21 @@ void CheckSharedBlock() {
     if (!Watched(outside, unwatched.size())) Require(StoredOver(outside, unwatched.size(), TrackerGeneration()), "an unwatched range reads as not stored over");
 }
 
+void CheckStoredOverUsesPageEvidence() {
+    constexpr std::size_t Page = 4096;
+    auto* memory = static_cast<std::uint8_t*>(AllocateWatched(2 * Block));
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    std::memset(memory, 0x11, 2 * Block);
+    const auto before = CollectWritesUncached(base, 2 * Block);
+    Require(before != 0, "the stored-over page fixture was not collected");
+
+    static_cast<volatile std::uint8_t*>(memory)[0] = 0x22;
+    const auto after = CollectWritesUncached(base, Block);
+    Require(after > before, "the page-local CPU write was not collected");
+    Require(StoredOver(base, Page, before), "a collected CPU write on a page was not reported as stored over");
+    Require(!StoredOver(base + Page, Page, before), "a page-local CPU write made an untouched page in the same block count as stored over");
+}
+
 void CheckStoredAllSince() {
     constexpr std::size_t bytes = 4 * Block;
     auto* memory = static_cast<std::uint8_t*>(AllocateWatched(bytes));
@@ -217,6 +236,39 @@ void CheckStoredAllSince() {
     MarkWritten(base, 64);
     Require(StoredAllSince_nid_no_patch(base, 64, before), "a complete non-block-aligned range store is absent");
 
+    before = TrackerGeneration();
+    MarkPossiblyWritten(base + 2048, 16);
+    Require(StoredOver(base + 2048, 16, before), "a possible driver write did not invalidate its exact range");
+    Require(!StoredOver(base + 2064, 16, before), "a possible driver write invalidated an adjacent range");
+    Require(!UnchangedSince(base + 2048, 16, before), "a possible driver write left its exact range unchanged");
+    Require(UnchangedSince(base + 2064, 16, before), "a possible driver write changed an adjacent range");
+    Require(!StoredAllSince_nid_no_patch(base + 2048, 16, before), "a possible driver write proved complete byte coverage");
+    for (unsigned repeat = 0; repeat < 6; ++repeat) MarkPossiblyWritten(base + 2048, 16);
+    Require(StoredOver(base + 2048, 16, before), "repeated possible writes lost their overlap evidence");
+    Require(!StoredOver(base + 2064, 16, before), "repeated possible writes invalidated an adjacent range");
+    Require(!StoredAllSince_nid_no_patch(base + 2048, 16, before), "repeated possible writes proved complete byte coverage");
+
+    before = TrackerGeneration();
+    constexpr unsigned PossibleIntervals = 8;
+    auto beforeNewest = before;
+    for (unsigned interval = 0; interval < PossibleIntervals; ++interval) {
+        beforeNewest = TrackerGeneration();
+        MarkPossiblyWritten(base + 4096 + static_cast<std::uint64_t>(interval) * 32, 16);
+    }
+    Require(StoredOver(base + 4096, 16, before), "an evicted possible-write interval was forgotten instead of marking its block");
+    Require(StoredOver(base + 4096 + 16, 16, before), "an evicted possible write did not mark the rest of its block");
+    Require(StoredOver(base + 4096 + (PossibleIntervals - 1) * 32, 16, beforeNewest), "the newest possible-write interval was evicted");
+    const auto beforeRecord = TrackerGeneration();
+    MarkPossiblyWritten(base + 4096, 16);
+    Require(StoredOver(base + 4096, 16, beforeRecord), "a possible-write interval was not retained after being re-recorded");
+    Require(!StoredAllSince_nid_no_patch(base + 4096, 16, before), "possible-write eviction or re-recording proved complete byte coverage");
+
+    before = TrackerGeneration();
+    MarkWritten(base + 2560, 16);
+    MarkPossiblyWritten(base, Block);
+    Require(StoredAllSince_nid_no_patch(base + 2560, 16, before), "a possible whole-block range erased an exact partial-store proof");
+    Require(!StoredAllSince_nid_no_patch(base, Block, before), "a possible whole-block range proved complete block coverage");
+
     before = TrackerGeneration();
     MarkWritten(base + 512, 16);
     MarkWritten(base + 544, 16);
@@ -348,6 +400,42 @@ void CheckSharedBlockProofs() {
     Require(!UnchangedSince(base + Block + 14 * page + 0x800, 16, beforeNeighbour), "a range in the page an own store dirtied reads as unchanged");
 }
 
+void CheckRepeatedPossibleStores() {
+    void* memory = AllocateWatched(3 * Block);
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto boundary = base + 2 * Block - 0x9000;
+    std::memset(memory, 0x11, 3 * Block);
+
+    const auto synced = CollectWrites(base, 3 * Block);
+    Require(synced != 0, "the test block is not collected");
+
+    const auto exact = TrackerGeneration();
+    MarkWritten(base + Block, 0x100);
+    for (std::uint64_t store = 0; store < 5; ++store) MarkPossiblyWritten(boundary + store * 0x1000, 0x100);
+    Require(StoredAllSince_nid_no_patch(base + Block, 0x100, exact), "possible writes beyond the ring forgot an exact store's coverage");
+
+    void* fresh = AllocateWatched(2 * Block);
+    const auto freshBase = reinterpret_cast<std::uint64_t>(fresh);
+    std::memset(fresh, 0x11, 2 * Block);
+    const auto freshSynced = CollectWrites(freshBase, 2 * Block);
+    const auto neighbour = freshBase + Block - 0x9000;
+    MarkPossiblyWritten(neighbour, 0x100);
+    const auto secondStored = MarkPossiblyWritten(neighbour + 0x1000, 0x100);
+    const auto thirdStored = MarkPossiblyWritten(neighbour + 0x2000, 0x100);
+    MarkPossiblyWritten(neighbour + 0x3000, 0x100);
+    const auto settled = TrackerGeneration();
+    MarkPossiblyWritten(neighbour, 0x100);
+    MarkPossiblyWritten(neighbour, 0x100);
+    MarkPossiblyWritten(neighbour + 0x5000, 0x100);
+    Require(!StoredOver(freshBase, static_cast<std::size_t>(neighbour - freshBase), secondStored), "a full possible ring evicted a newer piece instead of its oldest");
+    Require(StoredOver(freshBase, static_cast<std::size_t>(neighbour - freshBase), freshSynced), "an evicted possible write is not taken as a store over the rest of the block");
+
+    const auto partial = TrackerGeneration();
+    MarkPossiblyWritten(neighbour + 0x5080, 0x100);
+    Require(StoredOver(neighbour + 0x5000, 0x10, settled) && StoredOver(neighbour + 0x5100, 0x10, partial), "a possible write that overlaps an earlier piece without containing it replaced it");
+    Require(!StoredOver(freshBase, static_cast<std::size_t>(neighbour - freshBase), thirdStored), "a possible write that overlaps without containing evicted a newer piece instead of the oldest");
+}
+
 void CheckOwnStore() {
     void* memory = AllocateWatched(2 * Block);
     const auto base = reinterpret_cast<std::uint64_t>(memory);
@@ -652,6 +740,243 @@ void CheckRewatch() {
     GuestArena::GuestArenaRelease_nid_postfix(memory, 4 * Block);
 }
 
+void CheckRewatchedDirectMemoryComparedWhenShared() {
+    constexpr std::size_t bytes = 2 * Block;
+    auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, Block));
+    Require(memory != nullptr, "cannot reserve the compared sharing fixture");
+    struct Cleanup {
+        std::uint8_t* memory;
+        HANDLE section = nullptr;
+        ~Cleanup() {
+            GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+            if (section == nullptr) return;
+            GuestArena::GuestArenaForgetSection_nid_postfix(section);
+            CloseHandle(section);
+        }
+    } cleanup{memory};
+    cleanup.section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+    Require(cleanup.section != nullptr, "cannot create the compared sharing backing");
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto native = [](const std::uint8_t* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query the compared sharing fixture");
+        return info;
+    };
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_PRIVATE && Watched(base, bytes), "the direct memory is not resident and watched");
+    Unwatch(base, Block);
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> imported{{{base, base + Block}}};
+    Rewatch(imported);
+    Require(Watched(base, Block), "the rewatched direct memory is not watched");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) != 0, "rewatched resident direct memory is not collected");
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + bytes, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_MAPPED && native(memory + bytes).Type == MEM_MAPPED, "a second mapping kept the direct memory resident");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) == 0 && CollectWritesUncached(base + bytes, Block) == 0, "rewatched direct memory was collected once shared");
+    Require(native(memory).Protect == PAGE_READWRITE && native(memory + bytes).Protect == PAGE_READWRITE, "rewatched direct memory was armed once shared");
+    memory[8] = 0x5a;
+    Require(memory[bytes + 8] == 0x5a, "the second mapping does not see a store into the first");
+    Require(CollectWritesUncached(base + Block, Block) != 0, "shared direct memory that never left the watch stopped being collected");
+    std::cout << "rewatched direct memory: compared once shared, not armed; other shared direct memory still collected\n";
+}
+
+struct ComparedSharing {
+    static constexpr std::size_t bytes = 2 * Block;
+    std::uint8_t* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, Block));
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+    std::uint64_t base = reinterpret_cast<std::uint64_t>(memory);
+
+    ComparedSharing() {
+        Require(memory != nullptr && section != nullptr, "cannot create the compared sharing generation fixture");
+        GuestArena::GuestArenaForgetSection_nid_postfix(section);
+        GuestArena::GuestArenaMapDirect_nid_postfix(memory, bytes, section, 0, PAGE_READWRITE);
+        Require(Watched(base, bytes), "the compared sharing generation fixture is not watched");
+        Unwatch(base, Block);
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> imported{{{base, base + Block}}};
+        Rewatch(imported);
+        Require(Watched(base, Block), "the rewatched direct memory of the generation fixture is not watched");
+        BumpCollectEpoch();
+        Require(CollectWritesUncached(base, Block) != 0, "rewatched resident direct memory of the generation fixture is not collected");
+    }
+    ~ComparedSharing() {
+        GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+        GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+        GuestArena::GuestArenaForgetSection_nid_postfix(section);
+        CloseHandle(section);
+    }
+    ComparedSharing(const ComparedSharing&) = delete;
+    ComparedSharing& operator=(const ComparedSharing&) = delete;
+
+    void Share() {
+        GuestArena::GuestArenaMapDirect_nid_postfix(memory + bytes, bytes, section, 0, PAGE_READWRITE);
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(memory, &info, sizeof(info)) == sizeof(info) && info.Type == MEM_MAPPED, "a second mapping kept the generation fixture resident");
+    }
+    std::uint64_t Collect(std::uint64_t address) {
+        BumpCollectEpoch();
+        return CollectWrites(address, Block);
+    }
+};
+
+void CheckComparedSharingGenerations() {
+    {
+        ComparedSharing fixture;
+        const auto g0 = TrackerGeneration();
+        Require(UnchangedSince(fixture.base, Block, g0) && !WrittenSince(fixture.base, Block, g0), "rewatched resident direct memory reads as written before any store");
+        fixture.memory[16] = 0x21;
+        Require(fixture.Collect(fixture.base) != 0 && !UnchangedSince(fixture.base, Block, g0) && WrittenSince(fixture.base, Block, g0), "a store into rewatched resident direct memory was missed before it was shared");
+        const auto cached = TrackerGeneration();
+        Require(UnchangedSince(fixture.base, Block, cached), "rewatched resident direct memory reads as changed after its collect");
+        fixture.Share();
+        fixture.memory[8] = 0x5a;
+        Require(fixture.memory[ComparedSharing::bytes + 8] == 0x5a, "the second mapping does not see the store into the generation fixture");
+        Require(fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected once shared");
+        Require(!UnchangedSince(fixture.base, Block, cached), "a store into rewatched direct memory once shared reads as unchanged since a generation before the sharing");
+        Require(WrittenSince(fixture.base, Block, cached), "a store into rewatched direct memory once shared reads as not written since a generation before the sharing");
+    }
+    {
+        ComparedSharing fixture;
+        const auto g0 = TrackerGeneration();
+        fixture.Share();
+        Require(fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected once shared, before any store");
+        Require(!UnchangedSince(fixture.base, Block, g0) && WrittenSince(fixture.base, Block, g0), "sharing rewatched direct memory did not report it written once");
+        const auto g1 = TrackerGeneration();
+        Require(fixture.Collect(fixture.base) == 0 && fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected again once shared");
+        std::array<std::uint64_t, 1> generations{g1};
+        std::array<std::uint8_t, 1> changed{};
+        std::array<std::uint8_t, 1> cpu{};
+        Require(!WrittenSince(fixture.base, Block, g1) && ChangedBlocks(fixture.base, Block, generations, changed, cpu) && changed[0] == BlockUnchanged && cpu[0] == 0, "refused collects of shared compared memory reported it written again without a store");
+        Require(!UnchangedSince(fixture.base, Block, g1), "shared compared memory read as unchanged since a generation taken after a refused collect");
+        const auto neighbour = fixture.Collect(fixture.base + Block);
+        const auto spanned = std::max(fixture.Collect(fixture.base), neighbour);
+        Require(spanned != 0 && UnchangedSince(fixture.base + Block, Block, spanned), "shared direct memory that never left the watch is not collected beside compared memory");
+        fixture.memory[24] = 0x3c;
+        Require(fixture.Collect(fixture.base) == 0, "rewatched direct memory was collected once shared, after a store");
+        Require(!UnchangedSince(fixture.base, Block, g1), "a store into shared compared memory reads as unchanged since a generation taken after a refused collect");
+        Require(!UnchangedSince(fixture.base, Block, spanned), "a store into shared compared memory reads as unchanged since the newest generation of a collect over several ranges");
+        Require(fixture.Collect(fixture.base + Block) != 0 && UnchangedSince(fixture.base + Block, Block, spanned), "a refused collect of compared memory made its never-compared neighbour read as changed");
+        const std::array<UnchangedQuery, 2> queries{{{fixture.base + Block, Block, spanned}, {fixture.base, Block, spanned}}};
+        Require(!UnchangedSinceAll(queries), "a batch of queries over shared compared memory read as unchanged");
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> committed{{{fixture.base, fixture.base + Block}}};
+        Require(!UnchangedCommittedSince(committed, spanned), "committed ranges over shared compared memory read as unchanged");
+    }
+    std::cout << "shared compared memory: reported written once at the sharing, never unchanged since an older generation, its neighbour still trusted\n";
+}
+
+void CheckImportedDirectMemoryComparedWhenShared() {
+    constexpr std::size_t bytes = 2 * Block;
+    auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, Block));
+    Require(memory != nullptr, "cannot reserve the imported sharing fixture");
+    struct Cleanup {
+        std::uint8_t* memory;
+        HANDLE section = nullptr;
+        ~Cleanup() {
+            GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+            if (section == nullptr) return;
+            GuestArena::GuestArenaForgetSection_nid_postfix(section);
+            CloseHandle(section);
+        }
+    } cleanup{memory};
+    cleanup.section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+    Require(cleanup.section != nullptr, "cannot create the imported sharing backing");
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto native = [](const std::uint8_t* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query the imported sharing fixture");
+        return info;
+    };
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_PRIVATE && Watched(base, bytes), "the imported direct memory is not resident and watched");
+    Require(ImportWatched(base, Block, [] { return true; }), "the watched import of resident direct memory failed");
+    Require(Watched(base, Block), "a watched import of resident direct memory left the write watch");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) != 0, "imported resident direct memory is not collected");
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + bytes, bytes, cleanup.section, 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_MAPPED && native(memory + bytes).Type == MEM_MAPPED, "a second mapping kept the imported direct memory resident");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, Block) == 0 && CollectWritesUncached(base + bytes, Block) == 0, "imported direct memory was collected once shared");
+    Require(native(memory).Protect == PAGE_READWRITE && native(memory + bytes).Protect == PAGE_READWRITE, "imported direct memory was armed once shared");
+    memory[8] = 0x5a;
+    Require(memory[bytes + 8] == 0x5a, "the second mapping does not see a store into the imported first");
+    Require(CollectWritesUncached(base + Block, Block) != 0, "shared direct memory that was never imported stopped being collected");
+    std::cout << "imported direct memory: compared once shared, not armed; unimported shared direct memory still collected\n";
+}
+
+void CheckImportAliasDemotedComparedWhenShared() {
+    constexpr std::size_t page = 0x4000;
+    auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(5 * Block, Block));
+    Require(memory != nullptr, "cannot reserve the import alias fixture");
+    struct Cleanup {
+        std::uint8_t* memory;
+        std::array<HANDLE, 3> sections{};
+        std::array<void*, 3> aliases{};
+        ~Cleanup() {
+            for (const auto alias : aliases) GuestArena::GuestArenaUnmapAlias_nid_postfix(alias);
+            GuestArena::GuestArenaReset_nid_postfix(memory, 5 * Block);
+            GuestArena::GuestArenaRelease_nid_postfix(memory, 5 * Block);
+            for (const auto section : sections) {
+                if (section == nullptr) continue;
+                GuestArena::GuestArenaForgetSection_nid_postfix(section);
+                CloseHandle(section);
+            }
+        }
+    } cleanup{memory};
+    for (auto& section : cleanup.sections) {
+        section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, Block, nullptr);
+        Require(section != nullptr, "cannot create the import alias backing");
+        GuestArena::GuestArenaForgetSection_nid_postfix(section);
+    }
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    const auto native = [](const std::uint8_t* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "cannot query the import alias fixture");
+        return info;
+    };
+    const auto clearingCollect = [](std::uint64_t address) {
+        std::array<void*, 4> pages{};
+        std::size_t count = pages.size();
+        return GuestArena::GuestArenaCollectWrites_nid_postfix(static_cast<std::uintptr_t>(address), page, pages.data(), &count, true);
+    };
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory, page, cleanup.sections[0], 0, PAGE_READWRITE);
+    Require(native(memory).Type == MEM_PRIVATE && Watched(base, page), "the aliased direct memory is not resident and watched");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, page) != 0, "resident direct memory is not collected before its import");
+    cleanup.aliases[0] = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base), page);
+    Require(cleanup.aliases[0] != nullptr && native(memory).Type == MEM_MAPPED, "the import alias did not demote the resident run");
+    Require(ImportWatched(base, page, [] { return true; }) && Watched(base, page), "the import of aliased direct memory did not stay watched");
+    Require(native(memory).Protect == PAGE_READWRITE, "memory an import's alias demoted was armed by the import");
+    Require(!clearingCollect(base), "a clearing collect over memory an import's alias demoted was not refused");
+    Require(native(memory).Protect == PAGE_READWRITE, "memory an import's alias demoted was armed by a clearing collect");
+    BumpCollectEpoch();
+    Require(CollectWritesUncached(base, page) == 0, "memory an import's alias demoted was collected once shared");
+    memory[8] = 0x5a;
+    Require(static_cast<const std::uint8_t*>(cleanup.aliases[0])[8] == 0x5a, "the import alias does not see a store into the guest view");
+
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + Block, page, cleanup.sections[1], 0, PAGE_READWRITE);
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + 2 * Block, page, cleanup.sections[1], 0, PAGE_READWRITE);
+    Require(native(memory + Block).Type == MEM_MAPPED && native(memory + 2 * Block).Type == MEM_MAPPED, "a second mapping kept the control direct memory resident");
+    cleanup.aliases[1] = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base + Block), page);
+    Require(cleanup.aliases[1] != nullptr, "the control import alias was refused");
+    Require(ImportWatched(base + Block, page, [] { return true; }) && Watched(base + Block, page), "the control import did not stay watched");
+    Require(clearingCollect(base + Block), "memory shared by a second mapping before its import alias stopped being collected");
+    Require(native(memory + Block).Protect == PAGE_READONLY && native(memory + 2 * Block).Protect == PAGE_READONLY, "memory shared by a second mapping before its import alias was not armed");
+
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + 3 * Block, page, cleanup.sections[2], 0, PAGE_READWRITE);
+    auto* failed = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base + 3 * Block), page);
+    Require(failed != nullptr && native(memory + 3 * Block).Type == MEM_MAPPED, "the alias of a failed import did not demote the resident run");
+    GuestArena::GuestArenaUnmapAlias_nid_postfix(failed);
+    GuestArena::GuestArenaMapDirect_nid_postfix(memory + 4 * Block, page, cleanup.sections[2], 0, PAGE_READWRITE);
+    cleanup.aliases[2] = GuestArena::GuestArenaMapAlias_nid_postfix(static_cast<std::uintptr_t>(base + 3 * Block), page);
+    Require(cleanup.aliases[2] != nullptr, "the import alias after a second mapping was refused");
+    Require(ImportWatched(base + 3 * Block, page, [] { return true; }) && Watched(base + 3 * Block, page), "the import after a second mapping did not stay watched");
+    Require(clearingCollect(base + 3 * Block), "memory a second mapping shared after an earlier alias demoted it stopped being collected");
+    Require(native(memory + 3 * Block).Protect == PAGE_READONLY && native(memory + 4 * Block).Protect == PAGE_READONLY, "memory a second mapping shared after an earlier alias demoted it was not armed");
+    std::cout << "direct memory an import's alias demoted: compared once shared, not armed; memory shared before the alias still collected\n";
+}
+
 void CheckResidentDirectMappingReuse() {
     constexpr std::size_t bytes = 5 * Block;
     auto* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, Block));
@@ -1448,10 +1773,25 @@ int main() {
             CheckResidentDirectMappingReuse();
             return 0;
         }
+        if (std::wstring_view(GetCommandLineW()).ends_with(RewatchedSharedMode)) {
+            CheckRewatchedDirectMemoryComparedWhenShared();
+            CheckImportedDirectMemoryComparedWhenShared();
+            return 0;
+        }
+        if (std::wstring_view(GetCommandLineW()).ends_with(ImportAliasSharedMode)) {
+            CheckImportAliasDemotedComparedWhenShared();
+            return 0;
+        }
+        if (std::wstring_view(GetCommandLineW()).ends_with(SharedGenerationsMode)) {
+            CheckComparedSharingGenerations();
+            return 0;
+        }
 #endif
         CheckSharedBlock();
+        CheckStoredOverUsesPageEvidence();
         CheckStoredAllSince();
         CheckSharedBlockProofs();
+        CheckRepeatedPossibleStores();
         CheckOwnStore();
         CheckUnwatch();
         CheckNewestStamp();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp
index 23eeb6dcf7..216bfbc31d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/BcBlockCopy.cpp
@@ -35,6 +35,7 @@ constexpr std::uint32_t Format32x2Uint = 62;
 constexpr std::uint32_t Format32x4Uint = 75;
 constexpr std::uint32_t FormatBc1Unorm = 169;
 constexpr std::uint32_t FormatBc7Unorm = 181;
+constexpr std::uint32_t ForceDegamma = 1u << 20u;
 constexpr std::uint32_t Type2D = 9;
 constexpr std::uint32_t ClampEdge = 2;
 constexpr std::size_t BlockBytes = 1u << 20u;
@@ -130,8 +131,8 @@ std::array<std::uint32_t, 8> TextureDescriptor(const void* data, const Shape& sh
     };
 }
 
-std::array<std::uint32_t, 4> SamplerDescriptor() {
-    return {ClampEdge | (ClampEdge << 3u) | (ClampEdge << 6u), 0u, 0u, 0u};
+std::array<std::uint32_t, 4> SamplerDescriptor(std::uint32_t forced) {
+    return {ClampEdge | (ClampEdge << 3u) | (ClampEdge << 6u) | forced, 0u, 0u, 0u};
 }
 
 ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData) {
@@ -167,12 +168,12 @@ void Settle(AgcDriver::VulkanDevice& device, std::uint8_t* texels, std::uint64_t
     AgcDriver::GuestMemory::CollectWritesUncached(reinterpret_cast<std::uintptr_t>(texels), bytes);
 }
 
-std::vector<std::uint32_t> Sample(AgcDriver::VulkanDevice& device, std::uint8_t* texels, const Shape& shape) {
+std::vector<std::uint32_t> Sample(AgcDriver::VulkanDevice& device, std::uint8_t* texels, const Shape& shape, std::uint32_t forced = 0u) {
     std::vector<std::uint32_t> userData(24, 0u);
     const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size_bytes()));
     const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size_bytes()));
     const auto texture = TextureDescriptor(texels, shape);
-    const auto sampler = SamplerDescriptor();
+    const auto sampler = SamplerDescriptor(forced);
     std::copy(input.begin(), input.end(), userData.begin());
     std::copy(output.begin(), output.end(), userData.begin() + 4);
     std::copy(texture.begin(), texture.end(), userData.begin() + 8);
@@ -189,12 +190,12 @@ std::vector<std::uint32_t> Sample(AgcDriver::VulkanDevice& device, std::uint8_t*
     return {Output.begin(), Output.end()};
 }
 
-std::vector<std::uint32_t> Reference(AgcDriver::VulkanDevice& device, const Case& test, std::uint32_t value) {
+std::vector<std::uint32_t> Reference(AgcDriver::VulkanDevice& device, const Case& test, std::uint32_t value, std::uint32_t forced = 0u) {
     GuestBlock block;
     auto* texels = block.Data();
     Store(device, texels, test, value);
     Settle(device, texels, SurfaceBytes(texels, test.blocks));
-    return Sample(device, texels, test.compressed);
+    return Sample(device, texels, test.compressed, forced);
 }
 
 void RequireSame(const std::vector<std::uint32_t>& sampled, const std::vector<std::uint32_t>& expected, const std::string& what) {
@@ -208,7 +209,11 @@ void PendingBlocksCase(AgcDriver::VulkanDevice& device, const Case& test) {
     constexpr std::uint32_t Second = 0x9bdf6840u;
     const auto first = Reference(device, test, First);
     const auto second = Reference(device, test, Second);
+    const auto forcedFirst = Reference(device, test, First, ForceDegamma);
+    const auto forcedSecond = Reference(device, test, Second, ForceDegamma);
     Require(first != second, test.name + ": the two block patterns sample alike");
+    Require(forcedFirst != first && forcedSecond != second, test.name + ": a sampler that forces sRGB decoding samples the stored blocks like a plain one");
+    Require(forcedFirst != forcedSecond, test.name + ": the two block patterns sample alike through a sampler that forces sRGB decoding");
     GuestBlock block;
     auto* texels = block.Data();
     const auto bytes = SurfaceBytes(texels, test.compressed);
@@ -222,6 +227,9 @@ void PendingBlocksCase(AgcDriver::VulkanDevice& device, const Case& test) {
     RequireSame(pending, second, test.name + ": sample of pending blocks");
     Store(device, texels, test, First);
     RequireSame(Sample(device, texels, test.compressed), first, test.name + ": sample of blocks stored again");
+    Store(device, texels, test, Second);
+    RequireSame(Sample(device, texels, test.compressed, ForceDegamma), forcedSecond, test.name + ": sRGB-forced sample of pending blocks");
+    Require(AgcDriver::Graphics::StorageTexture::FindPending(reinterpret_cast<std::uintptr_t>(texels), bytes) != nullptr, test.name + ": the sRGB-forced sample stored the pending blocks to guest memory");
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp
index 99a286d6ac..01b015a01b 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicsFloat.cpp
@@ -149,6 +149,7 @@ void Run(AgcDriver::VulkanDevice& device) {
         {0, 0, 0, 128}
     };
     request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false};
     const auto result = ShaderRecompiler::Recompile(request);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp
index 7ba31cd239..7394269e39 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/BufferFormat.cpp
@@ -171,6 +171,96 @@ void Check() {
     }
 }
 
+constexpr std::array<std::uint32_t, 5> SubwordWord3{0x31005facu, 0x31006facu, 0x3100bfacu, 0x3100cfacu, 0x31012facu};
+
+constexpr const char* SubwordNames[16] = {
+    "buffer_load_format_x 8_UINT +1",
+    "buffer_load_format_x 8_UINT +2",
+    "buffer_load_format_x 8_UINT +3",
+    "buffer_load_format_x 8_SINT +1",
+    "buffer_load_format_x 8_SINT +2",
+    "buffer_load_format_x 8_SINT +3",
+    "buffer_load_format_x 16_UINT +1",
+    "buffer_load_format_x 16_UINT +2",
+    "buffer_load_format_x 16_UINT +3",
+    "buffer_load_format_x 16_SINT +1",
+    "buffer_load_format_x 16_SINT +2",
+    "buffer_load_format_x 16_SINT +3",
+    "buffer_load_format_xy 8_8_UINT +1 x",
+    "buffer_load_format_xy 8_8_UINT +1 y",
+    "buffer_load_format_xy 8_8_UINT +2 x",
+    "buffer_load_format_xy 8_8_UINT +2 y",
+};
+
+std::vector<std::uint32_t> SubwordCode() {
+    std::vector<std::uint32_t> code{0x34060087u, 0x34500085u};
+    std::uint32_t vdata = 10u;
+    const auto emitLoad = [&](std::uint32_t op, std::uint32_t srsrc, std::uint32_t offset, std::uint32_t words) {
+        code.push_back(0xe0001000u | (op << 18u) | offset);
+        code.push_back(0x80000028u | (srsrc << 16u) | (vdata << 8u));
+        vdata += words;
+    };
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 2u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 3u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 4u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 3u; ++offset) emitLoad(0u, 5u, offset, 1u);
+    for (std::uint32_t offset = 1u; offset <= 2u; ++offset) emitLoad(1u, 6u, offset, 2u);
+    code.push_back(0xbf8c3f70u);
+    for (std::uint32_t index = 0u; index < 16u; ++index) {
+        code.push_back(0xe0701000u | (index * 4u));
+        code.push_back(0x80010003u | ((10u + index) << 8u));
+    }
+    code.push_back(0xbf810000u);
+    return code;
+}
+
+void RunSubwordOffsets(AgcDriver::VulkanDevice& device) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) std::copy(std::begin(Rows[tid]), std::end(Rows[tid]), &Input[tid * Inputs]);
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8u + 4u * SubwordWord3.size(), 0u);
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u), 0x31016facu);
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    for (std::size_t index = 0; index < SubwordWord3.size(); ++index) {
+        const auto descriptor = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u), SubwordWord3[index]);
+        std::copy(descriptor.begin(), descriptor.end(), userData.begin() + 8 + 4 * index);
+    }
+    static const auto program = SubwordCode();
+    const std::span<const std::uint32_t> code(program);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void CheckSubwordOffsets() {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const std::uint32_t word = Rows[tid][0];
+        const auto u8 = [&](std::uint32_t offset) { return (word >> (offset * 8u)) & 0xffu; };
+        const auto s8 = [&](std::uint32_t offset) { return static_cast<std::uint32_t>(static_cast<std::int32_t>(static_cast<std::int8_t>(u8(offset)))); };
+        const auto u16 = [&](std::uint32_t offset) { return (word >> (offset * 8u)) & 0xffffu; };
+        const auto s16 = [&](std::uint32_t offset) { return static_cast<std::uint32_t>(static_cast<std::int32_t>(static_cast<std::int16_t>(u16(offset)))); };
+        const std::array<std::uint32_t, 16> expected{
+            u8(1u), u8(2u), u8(3u),
+            s8(1u), s8(2u), s8(3u),
+            u16(1u), u16(2u), u16(3u),
+            s16(1u), s16(2u), s16(3u),
+            u8(1u), u8(2u),
+            u8(2u), u8(3u),
+        };
+        for (std::uint32_t index = 0; index < expected.size(); ++index) {
+            Expect(tid, Output[tid * Results + index], expected[index], SubwordNames[index]);
+        }
+    }
+}
+
 }
 
 int main() {
@@ -179,6 +269,8 @@ int main() {
         if (!device) return VulkanTestSkipped;
         Run(*device);
         Check();
+        RunSubwordOffsets(*device);
+        CheckSubwordOffsets();
         std::puts("buffer format tests passed");
         return 0;
     } catch (const std::exception& error) {
@@ -186,3 +278,4 @@ int main() {
         return 1;
     }
 }
+
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ColorLogicOp.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ColorLogicOp.cpp
new file mode 100644
index 0000000000..89963aafb1
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ColorLogicOp.cpp
@@ -0,0 +1,155 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <cstdio>
+#include <iostream>
+#include <cstdint>
+#include <span>
+#include <string>
+#include <stdexcept>
+#include <string_view>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::uint32_t WaveSize = 64;
+alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> PixelCode{
+    0x7e0802ff, 0x3e4ccccd, 0x7e0a02ff, 0x3ecccccd, 0x7e0c02ff, 0x3f19999a, 0x7e0e02ff, 0x3f4ccccd,
+    0xf800180f, 0x07060504, 0xbf810000,
+};
+
+constexpr std::array<std::uint8_t, 4> Source{0x33, 0x66, 0x99, 0xcc};
+
+constexpr std::array<std::array<float, 4>, 3> Vertices{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+alignas(256) std::array<std::array<float, 4>, 3> VertexStorage = Vertices;
+std::array<std::byte, Width * Height * 4> Before{};
+
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+void Draw(AgcDriver::VulkanDevice& device, std::uint8_t rop) {
+    for (std::size_t index = 0; index < Pixels.size(); ++index) Before[index] = Pixels[index] = static_cast<std::byte>((index * 37u + 11u) & 0xffu);
+    const auto target = device.Target();
+
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(VertexStorage.data(), 16u, static_cast<std::uint32_t>(VertexStorage.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {WaveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionX) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionY);
+    pixel.posX = true;
+    pixel.posY = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(PixelCode.data()), std::as_bytes(std::span(PixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(PixelCode.data()), PixelCode, 0, {}},
+        {WaveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, WaveSize, WaveSize, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(Pixels.data()), {Width, Height}, VK_FORMAT_R8G8B8A8_UNORM, Pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.colorRop = rop;
+    state.scissor = {{0, 0}, {Width, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(VertexStorage.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+    device.WaitIdle();
+}
+
+std::uint8_t Combine(std::uint8_t rop, std::uint8_t destination, std::uint8_t source) {
+    switch (rop) {
+        case 0xcc: return source;
+        case 0x5a: return static_cast<std::uint8_t>(destination ^ source);
+        case 0x88: return static_cast<std::uint8_t>(destination & source);
+        case 0xee: return static_cast<std::uint8_t>(destination | source);
+        default: throw std::runtime_error("the test has no expectation for this ROP");
+    }
+}
+
+void Check(std::uint8_t rop, std::string_view what) {
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                const auto index = (y * Width + x) * 4u + channel;
+                const auto expected = Combine(rop, static_cast<std::uint8_t>(Before[index]), Source[channel]);
+                const auto actual = static_cast<std::uint8_t>(Pixels[index]);
+                Require(actual == expected, std::string(what) + ": pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel) + " is " + std::to_string(actual) + ", expected " + std::to_string(expected));
+            }
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        for (const std::uint8_t rop : {0xcc, 0x5a, 0x88, 0xee, 0xcc}) {
+            try {
+                Draw(*device, rop);
+            } catch (const std::exception& error) {
+                Require(std::string_view(error.what()).find("device does not support color logic operations") != std::string_view::npos, std::string("unexpected rejection: ") + error.what());
+                std::puts("skipped, the device has no logicOp feature");
+                return VulkanTestSkipped;
+            }
+            char what[48];
+            std::snprintf(what, sizeof(what), "ROP3 0x%02x into an 8_8_8_8 unorm target", rop);
+            Check(rop, what);
+        }
+        std::puts("color logic operation tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp
index a5395d5661..d2013c8b53 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeFsTableCalls.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
 #include "SceShaders.hpp"
 #include "VulkanTestDevice.hpp"
 #include <array>
@@ -21,6 +22,8 @@ constexpr std::uint32_t Threads = 64;
 constexpr std::uint32_t Untouched = 0xcafebabeu;
 constexpr std::uint32_t Marker = 0x55u;
 constexpr std::uint64_t FsTable = 0xfe0040000ull;
+constexpr std::uint64_t DriverMemory = 0xfe0000000ull;
+constexpr std::size_t DriverMemoryBytes = 2u << 20u;
 
 alignas(256) constexpr std::array<std::uint32_t, 32> Caller{
     0x34040082u, 0x7e0202ffu, 0x00000055u, 0xbeea03ffu, 0xe0040000u, 0xbeeb038fu, 0xf4080235u, 0xfa000000u, 0xbf8cc07fu, 0xf4240384u,
@@ -84,6 +87,9 @@ void CheckTable() {
     Require(AgcDriver::GuestMemory::Accessible(reinterpret_cast<const void*>(table[2]), sizeof(routine)), "the FS routine is not readable");
     std::memcpy(routine.data(), reinterpret_cast<const void*>(table[2]), sizeof(routine));
     Require(routine[0] == 0xbe80200eu, "the FS routine does not start with s_setpc_b64 s[14:15]");
+#ifndef _WIN32
+    if (GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) Require(AgcDriver::GuestMemory::Watched(DriverMemory, DriverMemoryBytes), "the AGC driver memory at 0xfe0000000 is not write-watched, so a refused import copies it on every address-based build");
+#endif
 }
 
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
index d9a6a8aa1d..f85c5c7d8a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ComputeTableCalls.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "SceShaders.hpp"
 #include "VulkanTestDevice.hpp"
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstdio>
@@ -32,10 +33,14 @@ alignas(256) constexpr std::array<std::uint32_t, 64> HoistedCaller{
     0x7e020280u, 0xf4080400u, 0xfa000000u, 0xbf8cc07fu, 0xbf068203u, 0xbf850001u, 0x7e020280u, 0x8f148402u,
     0xf4280208u, 0x28000000u, 0xbf8cc07fu, 0xbe8e0308u, 0xbe8f0309u, 0xbf068103u, 0xbe8e210eu, 0x34040082u,
     0xe0701000u, 0x80010102u, 0xbf810000u, 0xbf9f0000u, 0x30306c73u, 0x00000040u, 0x00000008u};
+alignas(256) constexpr std::array<std::uint32_t, 64> SliceCaller{
+    0x7e020280u, 0xf40c0600u, 0xfa000010u, 0x8f148402u, 0xbf8cc07fu, 0xf428020eu, 0x28000000u, 0xbf8cc07fu,
+    0xbe8e0308u, 0xbe8f0309u, 0xbf068103u, 0xbe8e210eu, 0x34040082u, 0xe0701000u, 0x80010102u, 0xbf810000u,
+    0xbf9f0000u, 0x30306c73u, 0x00000040u, 0x00000008u};
 alignas(256) constexpr std::array<std::uint32_t, 3> SelectSixteen{0x85159091u, 0x7e020215u, 0xbe80200eu};
 alignas(256) constexpr std::array<std::uint32_t, 3> SelectThirtyTwo{0x8515a0a1u, 0x7e020215u, 0xbe80200eu};
 alignas(16) std::array<std::uint32_t, 8> Table{};
-alignas(16) std::array<std::uint32_t, 4> Descriptors{};
+alignas(16) std::array<std::uint32_t, 12> Descriptors{};
 alignas(256) std::array<std::uint32_t, Threads> Output{};
 
 void Fill() {
@@ -43,7 +48,10 @@ void Fill() {
     const auto second = reinterpret_cast<std::uintptr_t>(SelectThirtyTwo.data());
     Table = {static_cast<std::uint32_t>(first), static_cast<std::uint32_t>(first >> 32u), 0u, 0u, static_cast<std::uint32_t>(second), static_cast<std::uint32_t>(second >> 32u), 0u, 0u};
     const auto table = reinterpret_cast<std::uintptr_t>(Table.data());
-    Descriptors = {static_cast<std::uint32_t>(table), static_cast<std::uint32_t>((table >> 32u) & 0xffffu) | (16u << 16u), 2u, 0x31016facu};
+    const std::array<std::uint32_t, 4> descriptor{static_cast<std::uint32_t>(table), static_cast<std::uint32_t>((table >> 32u) & 0xffffu) | (16u << 16u), 2u, 0x31016facu};
+    Descriptors = {};
+    std::copy(descriptor.begin(), descriptor.end(), Descriptors.begin());
+    std::copy(descriptor.begin(), descriptor.end(), Descriptors.begin() + 8);
 }
 
 std::array<std::uint32_t, 8> UserData(std::uint32_t index, bool scc) {
@@ -149,6 +157,8 @@ int main() {
             Check(1u, true, wave32, 33u, "the second record's callee with SCC 1");
             Check(0u, false, wave32, 16u, "the first record's callee through a descriptor loaded before a branch", HoistedCaller.data());
             Check(1u, true, wave32, 33u, "the second record's callee through a descriptor loaded before a branch", HoistedCaller.data());
+            Check(0u, false, wave32, 16u, "the first record's callee through the second half of an s_load_dwordx8", SliceCaller.data());
+            Check(1u, true, wave32, 33u, "the second record's callee through the second half of an s_load_dwordx8", SliceCaller.data());
             const auto log = Dispatch(2u, false, wave32);
             Require(log.find("called address 0x0 at program counter") != std::string::npos && log.find("which no linked callee of that call matches") != std::string::npos,
                 std::string("a record past the table did not report an unlinked call") + (wave32 ? " (wave32)" : " (wave64)") + ": " + log);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/CopiedWriterLabelOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/CopiedWriterLabelOrder.cpp
new file mode 100644
index 0000000000..f143769c82
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/CopiedWriterLabelOrder.cpp
@@ -0,0 +1,270 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <mutex>
+#include <span>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Recorder;
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t RecordBytes = 16;
+constexpr std::size_t StoredOffset = 8;
+constexpr std::size_t CopiedRecordOffset = 0x1004;
+constexpr std::size_t DirectRecordOffset = 0x1000;
+constexpr std::uint32_t CpuValue = 0xc0001000u;
+constexpr std::uint32_t GpuValue = 1;
+constexpr std::uint32_t LabelValue = 1;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> StoreCode{
+    0x7e000281u, 0x7e020288u, 0xe0701000u, 0x80000001u, 0xbf810000u, 0xbf810000u,
+};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "copied writer label order: cannot allocate a guest block");
+        std::memset(block, 0, BlockBytes);
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    volatile std::uint32_t* Word(std::size_t offset) const { return reinterpret_cast<volatile std::uint32_t*>(block + offset); }
+    std::uint64_t Address() const { return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(block)); }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+void RecordDispatch(AgcDriver::VulkanDevice& device, std::uint64_t record) {
+    std::vector<std::uint32_t> userData(16, 0u);
+    const std::array<std::uint32_t, 4> descriptor{static_cast<std::uint32_t>(record), static_cast<std::uint32_t>((record >> 32u) & 0xffffu), RecordBytes, 0x31016facu};
+    std::copy(descriptor.begin(), descriptor.end(), userData.begin());
+    const std::span<const std::uint32_t> code(StoreCode);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderRecompiler::ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+}
+
+bool Drains() {
+    return std::getenv("APS5_DRAIN_COMPLETION_LABELS") != nullptr;
+}
+
+VkDeviceSize StorageAlignment(AgcDriver::VulkanDevice& device) {
+    return device.graphicsContext().limits.minStorageBufferOffsetAlignment;
+}
+
+std::array<std::byte, 4> LabelBytes(std::uint32_t value) {
+    std::array<std::byte, 4> bytes{};
+    std::memcpy(bytes.data(), &value, sizeof(value));
+    return bytes;
+}
+
+void WaitForGpu(AgcDriver::VulkanDevice& device, std::uint64_t epoch) {
+    if (device.CanWaitUnlocked()) device.WaitRecorded(epoch);
+    else std::this_thread::sleep_for(std::chrono::milliseconds(50));
+}
+
+std::uint64_t SubmitLocked(AgcDriver::VulkanDevice& device) {
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    return device.SubmitAndEpoch();
+}
+
+int LabelPass(AgcDriver::VulkanDevice& device, const GuestBlock& records, std::size_t recordOffset, const GuestBlock& labels, std::size_t labelOffset, std::uint64_t stamp, std::uint64_t writeBacks, int expectedReason, const std::string& what) {
+    volatile std::uint32_t* stored = records.Word(recordOffset + StoredOffset);
+    volatile std::uint32_t* label = labels.Word(labelOffset);
+    *stored = CpuValue;
+    *label = 0;
+    RecordDispatch(device, records.Address() + recordOffset);
+    const auto pending = Recorder::PendingWriteBackCompletions();
+    if (writeBacks != 0 && pending == 0 && recordOffset % StorageAlignment(device) == 0) {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.WaitIdle();
+        return VulkanTestSkipped;
+    }
+    Require(pending == writeBacks, what + ": " + std::to_string(pending) + " write-back completions are pending after the dispatch, expected " + std::to_string(writeBacks));
+    const auto bytes = LabelBytes(LabelValue);
+    int reason = 0;
+    std::uint64_t epoch = 0;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        reason = device.WriteLabelOnGpu(labels.Address() + labelOffset, bytes, stamp, 0, false);
+        if (reason == 3) {
+            device.WaitIdle();
+            return 1;
+        }
+        Require(reason == expectedReason, what + ": the label after the dispatch was handled with reason " + std::to_string(reason) + ", expected " + std::to_string(expectedReason));
+        if (reason >= 1 && reason <= 4) {
+            if (reason != 1) device.WaitIdle();
+            AgcDriver::GuestMemory::Write(labels.Address() + labelOffset, bytes, 4);
+        } else if (reason == 5) {
+            Require(Recorder::PendingWriteBackCompletions() == 1 && Recorder::PendingCompletionStores() == 1, what + ": the label behind the write-back drained the device or is not a pending completion store");
+            const std::array<std::byte, 16> wide{};
+            Require(device.WriteLabelOnGpu(labels.Address() + labelOffset + 0x100, wide, stamp, 0, false) == 0, what + ": a 16-byte store away from the copied writer and the pending completion store was not recorded on the GPU");
+            epoch = device.SubmitAndEpoch();
+        } else {
+            device.SubmitRecorded(true);
+        }
+    }
+    if (reason == 5) {
+        WaitForGpu(device, epoch);
+        Require(*label == 0, what + ": the label is visible before the batch that writes back the dispatch's record was reaped");
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.ReapRecorded(epoch);
+        Require(Recorder::PendingCompletionStores() == 0 && Recorder::PendingWriteBackCompletions() == 0, what + ": completions outlived the reap of their batch");
+    }
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (*label != LabelValue) {
+        Require(std::chrono::steady_clock::now() < deadline, what + ": the label never landed");
+        std::this_thread::sleep_for(std::chrono::microseconds(100));
+    }
+    const std::uint32_t seen = *stored;
+    Require(seen == GpuValue, what + ": the label is visible but the record holds " + Hex(seen) + ", the dispatch stored " + Hex(GpuValue));
+    *stored = CpuValue;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.WaitIdle();
+    }
+    const std::uint32_t kept = *stored;
+    Require(kept == CpuValue, what + ": the record holds " + Hex(kept) + " after the drain, a write-back landed over the value the CPU wrote after the label (" + Hex(CpuValue) + ")");
+    Require(Recorder::PendingWriteBackCompletions() == 0, what + ": write-back completions outlived the drain");
+    return 0;
+}
+
+void StreamOrderPass(AgcDriver::VulkanDevice& device, const GuestBlock& copied, const GuestBlock& direct, const GuestBlock& labels, std::uint64_t stamp) {
+    constexpr std::uint32_t First = 0x11u;
+    constexpr std::uint32_t Second = 0x22u;
+    const std::uint64_t address = labels.Address() + 0x4000;
+    volatile std::uint32_t* label = labels.Word(0x4000);
+    *label = 0;
+    *copied.Word(CopiedRecordOffset + StoredOffset) = CpuValue;
+    RecordDispatch(device, copied.Address() + CopiedRecordOffset);
+    Require(Recorder::PendingWriteBackCompletions() == 1, "stream order: the copied dispatch has no pending write-back");
+    const auto copiedEpoch = SubmitLocked(device);
+    RecordDispatch(device, direct.Address() + DirectRecordOffset);
+    std::uint64_t firstEpoch = 0;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        Require(Recorder::PendingWriteBackCompletions() == 1, "stream order: the copied writer was written back before the first label");
+        const int reason = device.WriteLabelOnGpu(address, LabelBytes(First), stamp, 0, false);
+        Require(reason == 5, "stream order: the first label behind the copied writer was handled with reason " + std::to_string(reason) + ", expected 5");
+        firstEpoch = device.SubmitAndEpoch();
+    }
+    WaitForGpu(device, firstEpoch);
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.ReapRecorded(copiedEpoch);
+        Require(Recorder::PendingWriteBackCompletions() == 0, "stream order: the copied writer was not written back by the reap of its batch");
+        Require(Recorder::PendingCompletionStores() == 1, "stream order: the first label's completion store is not pending after the copied writer's reap");
+        Require(*label == 0, "stream order: the first label landed before its batch was reaped");
+    }
+    RecordDispatch(device, direct.Address() + DirectRecordOffset);
+    std::uint64_t secondEpoch = 0;
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        const int reason = device.WriteLabelOnGpu(address, LabelBytes(Second), stamp + 1, 0, false);
+        Require(reason == 5, "stream order: a later label to the address of a pending completion store was handled with reason " + std::to_string(reason) + ", expected 5");
+        secondEpoch = device.SubmitAndEpoch();
+        Require(secondEpoch > firstEpoch, "stream order: the second label went into the first label's batch");
+    }
+    WaitForGpu(device, secondEpoch);
+    const std::uint32_t early = *label;
+    Require(early != Second, "stream order: the later label is visible while the earlier completion store to its address has not landed");
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    device.ReapRecorded(firstEpoch);
+    Require(*label == First, "stream order: the label holds " + Hex(*label) + " after the first label's batch was reaped, expected " + Hex(First));
+    device.ReapRecorded(secondEpoch);
+    const std::uint32_t last = *label;
+    Require(last == Second, "stream order: the label holds " + Hex(last) + " after the reap, the later label stored " + Hex(Second));
+    Require(Recorder::PendingCompletionStores() == 0 && Recorder::PendingCompletionLabels() == 0, "stream order: completion stores outlived the reap of their batches");
+    device.WaitIdle();
+}
+
+}
+
+int main() {
+    try {
+#ifdef _WIN32
+        _putenv_s("APS5_CPU_COPIES", "1");
+        _putenv_s("APS5_NO_OPPORTUNISTIC_REAP", "1");
+#else
+        setenv("APS5_CPU_COPIES", "1", 1);
+        setenv("APS5_NO_OPPORTUNISTIC_REAP", "1", 1);
+#endif
+        const GuestBlock copied;
+        const GuestBlock direct;
+        const GuestBlock labels;
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const int copiedPass = LabelPass(*device, copied, CopiedRecordOffset, labels, 0x2000, 1, 1, Drains() ? 2 : 5, "copied writer");
+        if (copiedPass == VulkanTestSkipped) {
+            std::printf("skipped, the device reports a minStorageBufferOffsetAlignment of %llu, so the dispatch binds its record at +0x%zx in place and nothing is written back; the test needs an alignment above 4\n",
+                static_cast<unsigned long long>(StorageAlignment(*device)), CopiedRecordOffset);
+            return VulkanTestSkipped;
+        }
+        if (copiedPass != 0 || LabelPass(*device, direct, DirectRecordOffset, labels, 0x3000, 2, 0, 0, "direct writer") != 0) {
+            std::puts("skipped, the device imports no host memory");
+            return VulkanTestSkipped;
+        }
+        if (!Drains()) StreamOrderPass(*device, copied, direct, labels, 3);
+        std::puts("copied writer label order tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp
index bed49aed8f..6fcb25ce6f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeyPresync.cpp
@@ -234,6 +234,22 @@ void RunKnownKeys(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
     RequireSampledClear(scenario, "a dispatch behind a pending fill of the keys");
 }
 
+void RunOneKeyReadPerLookup(AgcDriver::VulkanDevice& device, const Scenario& scenario, const char* what) {
+    Reset(scenario);
+    const auto sample = Compile(device, SampleSecondTexelCode, scenario.sampleData);
+    auto prepared = device.PrepareDispatch(sample, {}, Threads, reinterpret_cast<std::uintptr_t>(SampleSecondTexelCode.data()));
+    const auto before = AgcDriver::Graphics::SampledLookupKeyScans();
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        device.Dispatch(sample, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(SampleSecondTexelCode.data()), std::move(prepared));
+        device.WaitIdle();
+    }
+    const auto scans = AgcDriver::Graphics::SampledLookupKeyScans() - before;
+    char message[192];
+    std::snprintf(message, sizeof(message), "%s scanned the keys of its sampled texture %llu times with nothing written between the scans, expected at most once", what, static_cast<unsigned long long>(scans));
+    Require(scans <= 1u, message);
+}
+
 void RunNoWriter(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
     const auto sample = Compile(device, SampleSecondTexelCode, scenario.sampleData);
     const auto before = AgcDriver::VulkanDevice::PresyncCounts();
@@ -273,6 +289,11 @@ int main() {
         RunLockedSync(*device, control);
         RunPresync(*device, changed);
         RunNoWriter(*device, changed);
+        GuestBlock single;
+        GuestBlock singleOutput;
+        const auto reads = Prepare(single.Data(), singleOutput.Data());
+        RunOneKeyReadPerLookup(*device, reads, "a dispatch's first lookup");
+        RunOneKeyReadPerLookup(*device, reads, "a dispatch's repeated lookup");
         RunKnownKeys(*device, fills);
         std::puts("DCC key pre-sync tests passed");
         return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp
index 9f844dd5cc..6faa64b11e 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DccKeysFirstWrite.cpp
@@ -47,6 +47,7 @@ struct VulkanDeviceTestAccess {
 namespace {
 
 using AgcDriver::Graphics::DccKeys;
+using AgcDriver::Graphics::LookupOutcomes;
 using AgcDriver::Graphics::Require;
 using AgcDriver::Graphics::StorageTexture;
 using ShaderRecompiler::ShaderStage;
@@ -451,6 +452,46 @@ void RunSingleKeys(AgcDriver::VulkanDevice& device, std::uint8_t* block) {
     Require(wrong == 0, message);
 }
 
+void RunUniformSingleClear(AgcDriver::VulkanDevice& device, std::uint8_t* block) {
+    auto* texels = block;
+    auto* keys = block + KeysOffset;
+    const auto surface = AddressOf(texels);
+    const std::uint32_t color = 0x11223344u;
+    std::memset(texels, 0x55, SurfaceBytes);
+    for (std::size_t offset = 0; offset < SurfaceBytes; offset += 256) std::memcpy(texels + offset, &color, 4);
+    std::memset(keys, 0x10, KeyBytes);
+    AgcDriver::GuestMemory::BumpCollectEpoch();
+    const auto texture = TextureDescriptor(texels, keys);
+    std::vector<std::uint32_t> writeData(16, 0u);
+    std::copy(texture.begin(), texture.end(), writeData.begin() + 4);
+    const auto uploads = AgcDriver::Graphics::ThreadLookupOutcomes().counts;
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    Dispatch(device, WriteCode, writeData);
+    const auto image = StorageTexture::FindPending(surface, SurfaceBytes);
+    Require(image != nullptr && image->UploadedKeys() == DccKeys::Uncompressed, "uniform single-key clear: the first write did not store the keys uncompressed");
+    const auto& uploaded = AgcDriver::Graphics::ThreadLookupOutcomes().counts;
+    Require(uploaded[LookupOutcomes::UploadClear] == uploads[LookupOutcomes::UploadClear] + 1 && uploaded[LookupOutcomes::UploadCpu] == uploads[LookupOutcomes::UploadCpu], "uniform single-key clear: the first write read the surface and uploaded it instead of clearing it on the GPU");
+    const bool stillWatched = AgcDriver::GuestMemory::Watched(surface, SurfaceBytes);
+    Require(image->GuestSnapshotValid() == !stillWatched, stillWatched ? "uniform single-key clear: the upload of write-watched memory kept a guest snapshot, so the surface was read rather than cleared" : "uniform single-key clear: the upload of untracked memory kept no guest bytes to compare");
+    StorageTexture::FlushPending(surface, SurfaceBytes, nullptr, "test uniform single-key clear");
+    device.WaitIdle();
+    RequireKeys(keys, 0xff, "uniform single-key clear: the keys after the write-back");
+    const AgcDriver::Graphics::ColorTargetLayout layout(Side, Side, AgcDriver::Graphics::ColorTileMode::RenderTarget, 4);
+    std::size_t wrong = 0;
+    for (std::uint32_t y = 0; y < Side; ++y) {
+        for (std::uint32_t x = 0; x < Side; ++x) {
+            const auto offset = layout.Offset(x, y);
+            std::uint32_t texel = 0;
+            std::memcpy(&texel, texels + offset, 4);
+            const auto expected = y == 0 && x < Threads ? 0xffffffffu : color;
+            if (texel != expected) ++wrong;
+        }
+    }
+    char message[256];
+    std::snprintf(message, sizeof(message), "uniform single-key clear: %zu of %u written-back texels are neither the kernel's write nor the proved clear color 0x%08x", wrong, Side * Side, color);
+    Require(wrong == 0, message);
+}
+
 void RunSingleKeysSampled(AgcDriver::VulkanDevice& device, std::uint8_t* block, std::uint8_t* outputBlock, const char* memory) {
     auto* texels = block;
     auto* keys = block + KeysOffset;
@@ -787,6 +828,11 @@ void RunSharedImport(AgcDriver::VulkanDevice& device, std::uint8_t* block) {
 
 int main() {
     try {
+#ifdef _WIN32
+        _putenv_s("APS5_PROFILE_DRAW", "1");
+#else
+        setenv("APS5_PROFILE_DRAW", "1", 1);
+#endif
         std::optional<GuestBlock> block;
         std::optional<GuestBlock> watched;
         std::optional<GuestBlock> untracked;
@@ -806,6 +852,9 @@ int main() {
         std::optional<GuestBlock> single;
         single.emplace(false);
         RunSingleKeys(*device, single->Data());
+        std::optional<GuestBlock> uniformClear;
+        uniformClear.emplace(false);
+        RunUniformSingleClear(*device, uniformClear->Data());
         std::optional<GuestBlock> sampled;
         sampled.emplace(false);
         std::optional<GuestBlock> sampledOutput;
@@ -828,6 +877,9 @@ int main() {
             std::optional<GuestBlock> sampledWatched;
             sampledWatched.emplace(true);
             RunSingleKeysSampled(*device, sampledWatched->Data(), sampledOutput->Data(), "write-watched");
+            std::optional<GuestBlock> uniformClearWatched;
+            uniformClearWatched.emplace(true);
+            RunUniformSingleClear(*device, uniformClearWatched->Data());
 #ifdef _WIN32
             pendingSingle.emplace(true, true);
 #else
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthCopyDraw.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthCopyDraw.cpp
new file mode 100644
index 0000000000..b7c8199b67
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthCopyDraw.cpp
@@ -0,0 +1,166 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <exception>
+#include <initializer_list>
+#include <iostream>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 4;
+constexpr float DrawnDepth = 0.25f;
+constexpr float MemoryDepth = 0.75f;
+constexpr float Untouched = -1.0f;
+
+alignas(256) constexpr std::array<std::uint32_t, 16> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060280u, 0x7e0802f2u, 0xf80008cfu, 0x04030201u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u,
+};
+alignas(256) constexpr std::array<std::uint32_t, 4> WhitePixelCode{0x7e0e02f2u, 0xf800180fu, 0x07070707u, 0xbf810000u};
+alignas(256) std::array<float, Width * Height> CopyTarget{};
+alignas(256) std::array<float, Width * Height> ReferenceTarget{};
+constexpr std::size_t DepthFloats = 16384;
+constexpr std::size_t DepthAlignment = 65536;
+std::array<float, DepthFloats + DepthAlignment / sizeof(float)> DepthStorage{};
+const std::span<float, DepthFloats> DepthMemory{reinterpret_cast<float*>((reinterpret_cast<std::uintptr_t>(DepthStorage.data()) + DepthAlignment - 1) & ~(DepthAlignment - 1)), DepthFloats};
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+    std::array<ShaderRegister, 4> registers{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    if (type == 1) {
+        const auto address = reinterpret_cast<std::uintptr_t>(code);
+        header.registers = {{{0x008, static_cast<std::uint32_t>(address >> 8u)}, {0x009, static_cast<std::uint32_t>(address >> 40u)}, {0x00b, 0}, {0x00a, 0}}};
+        header.shader.sh_registers = header.registers.data();
+        header.shader.num_sh_registers = header.registers.size();
+    }
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+struct DrawOptions {
+    float* color = nullptr;
+    std::uint32_t targetMask = 1;
+    std::uint32_t renderControl = 0;
+    std::uint32_t depthControl = 0;
+};
+
+void AppendDraw(std::vector<std::uint32_t>& commands, const DrawOptions& options) {
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(WhitePixelCode.data());
+    const auto color = reinterpret_cast<std::uintptr_t>(options.color);
+    const auto depth = reinterpret_cast<std::uintptr_t>(DepthMemory.data());
+    Require(depth % DepthAlignment == 0, "the test depth plane is not 64 KiB aligned");
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b3, 0x2}, {0x1b4, 0x2}, {0x1b6, 0}, {0x207, 0}, {0x200, options.depthControl}, {0x203, 0},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, options.targetMask}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 1}, {0x1c3, 4}, {0x31c, 0x8710},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, ((Width - 1u) << 14u) | (Height - 1u)},
+        {0x3b8, 0x9000000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, (Height << 16u) | Width},
+        {0x81, 0x80000000}, {0x82, (Height << 16u) | Width},
+        {0x90, 0x80000000}, {0x91, (Height << 16u) | Width},
+        {0x94, 0x80000000}, {0x95, (Height << 16u) | Width},
+        {0x10f, std::bit_cast<std::uint32_t>(Width / 2.0f)}, {0x110, std::bit_cast<std::uint32_t>(Width / 2.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-(Height / 2.0f))}, {0x112, std::bit_cast<std::uint32_t>(Height / 2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, std::bit_cast<std::uint32_t>(DrawnDepth)},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)}, {0x292, 2},
+        {0x000, options.renderControl}, {0x002, 0}, {0x007, ((Height - 1u) << 16u) | (Width - 1u)},
+        {0x008, 0}, {0x009, std::bit_cast<std::uint32_t>(1.0f)}, {0x00a, 0}, {0x00b, 0},
+        {0x010, 3}, {0x011, 0},
+        {0x012, static_cast<std::uint32_t>(depth >> 8u)}, {0x014, static_cast<std::uint32_t>(depth >> 8u)},
+        {0x01a, static_cast<std::uint32_t>(depth >> 40u)}, {0x01c, static_cast<std::uint32_t>(depth >> 40u)},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 1u << 1u}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00a, 0}, {0x00b, 0},
+    };
+    Append(commands, 0x79, {0x242, 4});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x2d, {3, 2});
+}
+
+void CopyCoversTheDraw() {
+    CopyTarget.fill(Untouched);
+    ReferenceTarget.fill(Untouched);
+    std::ranges::fill(DepthMemory, MemoryDepth);
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, WhitePixelCode.data(), sizeof(WhitePixelCode), 1);
+    std::vector<std::uint32_t> commands;
+    AppendDraw(commands, {.color = CopyTarget.data(), .targetMask = 0, .depthControl = 0x76});
+    AppendDraw(commands, {.color = CopyTarget.data(), .renderControl = 0x84});
+    AppendDraw(commands, {.color = ReferenceTarget.data()});
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "the depth write, DB depth copy and reference draws were not submitted");
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(CopyTarget.data()), sizeof(CopyTarget));
+    AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(ReferenceTarget.data()), sizeof(ReferenceTarget));
+    std::size_t covered = 0;
+    for (std::size_t index = 0; index < CopyTarget.size(); ++index) {
+        const bool drawn = ReferenceTarget[index] == 1.0f;
+        Require(drawn || ReferenceTarget[index] == Untouched, "the reference draw wrote " + std::to_string(ReferenceTarget[index]) + " at texel " + std::to_string(index));
+        covered += drawn;
+        const auto expected = drawn ? DrawnDepth : Untouched;
+        Require(CopyTarget[index] == expected, "the DB depth copy holds " + std::to_string(CopyTarget[index]) + " at texel " + std::to_string(index) + ", expected " + std::to_string(expected) + (drawn ? " (the triangle covers it)" : " (outside the triangle)"));
+    }
+    Require(covered != 0 && covered != CopyTarget.size(), "the triangle covered " + std::to_string(covered) + " of " + std::to_string(CopyTarget.size()) + " texels, expected an edge through the target");
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        CopyCoversTheDraw();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("the DB depth copy wrote the drawn depth exactly where its draw rasterized");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp
index cdb94c5363..4145b544b5 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneGuestLayers.cpp
@@ -7,6 +7,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -75,6 +76,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -86,6 +89,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -93,7 +102,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto extensions = function<PFN_vkEnumerateDeviceExtensionProperties>("vkEnumerateDeviceExtensionProperties");
             Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties");
             std::vector<VkExtensionProperties> available(count);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp
index 43b8815b56..8bcdfb60dc 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlanePartialStore.cpp
@@ -2,6 +2,9 @@
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
@@ -225,6 +228,62 @@ int main() {
             for (std::size_t unit = 1; unit < Units; ++unit) RequireUnit(loose, unit, 1.0f, UnitTexels, "unwatched plane after a read of the first unit, a unit it does not overlap");
             Require(draw(unwatched, {.minDepth = 0.6f, .maxDepth = 0.6f}) == 0u, "a draw at depth 0.6 passed LESS over unwatched units still holding depth 0.5 on the GPU");
         }
+
+        auto* arrayBlocks = static_cast<std::byte*>(AllocateBlocks(3u * PlaneBytes, true));
+        auto* layerPlane = reinterpret_cast<float*>(arrayBlocks + PlaneBytes);
+        AgcDriver::Graphics::GuestTextureResource array{};
+        array.baseAddress = reinterpret_cast<std::uintptr_t>(arrayBlocks);
+        array.width = PlaneWidth;
+        array.height = PlaneHeight;
+        array.depthOrLastArray = 2;
+        array.mipCount = 1;
+        array.tileMode = AgcDriver::Graphics::TextureTileMode::kR64KBX;
+        array.dimension = AgcDriver::Graphics::TextureDimension::k2DArray;
+        array.format = 22;
+        array.dstSelX = 4;
+        array.dstSelY = 5;
+        array.dstSelZ = 6;
+        array.dstSelW = 7;
+        Require(AgcDriver::Graphics::DescribeSurface(array).layerBytes == PlaneBytes, "a layer of the 384x200 R32 array is not six 64 KiB tiles");
+        const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+        const auto lookup = [&](std::uint32_t first, std::uint32_t count) {
+            std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+            return AgcDriver::Graphics::CachedStorageLayers(context, array, first, count);
+        };
+        Fill(layerPlane, 1.0f);
+        const auto arrayImage = lookup(0, 1);
+        device->WaitIdle();
+        const auto provedBefore = AgcDriver::Graphics::StorageTexture::RefreshesProved();
+        Require(lookup(0, 1) == arrayImage && lookup(0, 1) == arrayImage, "a lookup of the first layer of an unchanged array replaced its cached image");
+        if (!AgcDriver::GuestMemory::WriteWatched() || !AgcDriver::GuestMemory::Watched(array.baseAddress, 3u * PlaneBytes)) {
+            std::puts("guest memory is not write-watched here: lookups of array layers through a refresh proof are not exercised");
+        } else {
+            Require(AgcDriver::Graphics::StorageTexture::RefreshesProved() != provedBefore, "repeated lookups of the first layer of an unchanged array proved no refresh");
+        }
+        const Surface layerDepth{reinterpret_cast<std::uintptr_t>(layerPlane), 0, 0, false, VK_FORMAT_D32_SFLOAT, 0, 0, swizzle};
+        Require(draw(layerDepth, writeHalf) == PlaneTexels, "the draw writing depth 0.5 over the second layer of an array did not cover the plane");
+        before = AgcDriver::Graphics::DepthPlaneStoreCounts();
+        Require(lookup(0, 1) == arrayImage, "a depth draw over the second layer of an array replaced the array's cached image");
+        device->WaitIdle();
+        stored = Since(before);
+        Require(stored.stores == 0, "a lookup of the first layer of an array stored the depth plane over its second layer");
+        for (std::size_t unit = 0; unit < Units; ++unit) RequireUnit(layerPlane, unit, 1.0f, UnitTexels, "a lookup of the first layer of an array, the depth plane over its second layer");
+        Require(AgcDriver::Graphics::DepthPlanesStale(), "a lookup of the first layer of an array left no stale plane");
+
+        before = AgcDriver::Graphics::DepthPlaneStoreCounts();
+        static_cast<void>(lookup(0, 2));
+        device->WaitIdle();
+        stored = Since(before);
+        Require(stored.stores == 1 && stored.units == Units, "a lookup of the first two layers of a three-layer array did not store the depth plane over its second layer");
+        for (std::size_t unit = 0; unit < Units; ++unit) RequireUnit(layerPlane, unit, 0.5f, Texels(unit), "a lookup of the first two layers of a three-layer array, the depth plane over its second layer");
+
+        Require(draw(layerDepth, {.depthWrite = true, .depthCompare = VK_COMPARE_OP_ALWAYS, .minDepth = 0.25f, .maxDepth = 0.25f}) == PlaneTexels, "the draw writing depth 0.25 over the second layer of an array did not cover the plane");
+        before = AgcDriver::Graphics::DepthPlaneStoreCounts();
+        static_cast<void>(lookup(0, 3));
+        device->WaitIdle();
+        stored = Since(before);
+        Require(stored.stores == 1 && stored.units == Units, "a lookup of every layer of an array did not store the depth plane over its second layer");
+        for (std::size_t unit = 0; unit < Units; ++unit) RequireUnit(layerPlane, unit, 0.25f, Texels(unit), "a lookup of every layer of an array, the depth plane over its second layer");
         std::puts("depth plane partial store tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp
index 33c6cfdb6b..f77432e092 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthPlaneSampling.cpp
@@ -434,8 +434,9 @@ void RefusalCase(AgcDriver::VulkanDevice& device, GuestBlock& block) {
 }
 }
 
-int main() {
+int main(int argc, char** argv) {
     try {
+        const bool evicting = argc > 1 && std::string(argv[1]) == "--evicting";
         GuestBlock block;
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
@@ -452,6 +453,10 @@ int main() {
         PaddedD16CubeCase(*device, block, output);
         BaseSliceCase(*device, block, output);
         RefusalCase(*device, block);
+        if (evicting) {
+            const auto kept = AgcDriver::Graphics::DepthPlaneCopyCount();
+            Require(kept >= 1 && kept < 8, std::to_string(kept) + " depth plane copies were kept with a 1 MiB budget, expected at least the newest and fewer than the 8 an unbounded cache keeps");
+        }
         std::puts("depth plane sampling tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp
index 27236f4199..0c706f407d 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthStorage.cpp
@@ -1,15 +1,13 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/BdaFeatures.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/DepthSurface.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
-#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <vector>
 #include <algorithm>
@@ -32,7 +30,6 @@ using namespace AgcDriver::Graphics;
 constexpr std::uint32_t Side = 64;
 constexpr std::size_t BlockBytes = 65536;
 alignas(4096) std::array<std::uint8_t, BlockBytes * 2> Storage{};
-alignas(4096) std::array<std::uint8_t, BlockBytes * 2> CopyStorage{};
 constexpr std::uint32_t Format32Float = 22;
 constexpr std::uint32_t Format8Uint = 5;
 
@@ -41,6 +38,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -52,6 +51,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -59,7 +64,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto extensions = function<PFN_vkEnumerateDeviceExtensionProperties>("vkEnumerateDeviceExtensionProperties");
             Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties");
             std::vector<VkExtensionProperties> available(count);
@@ -254,9 +259,17 @@ void Run(Context context, std::uint8_t* block) {
     layeredStencil.depthOrLastArray = 1;
     ExpectFailure([&] { static_cast<void>(DepthSurfaceStorage(context, {}, layeredStencil, 0)); }, "storage image access to depth/stencil surface", "a two-layer 2D array view of the stencil plane was accepted");
     layeredDepth.depthOrLastArray = 1;
-    ExpectFailure([&] { static_cast<void>(DepthSurfaceStorage(context, {}, layeredDepth, 0)); }, "with a layer pitch of", "a two-layer 2D array view of the depth plane with a layer pitch other than the depth slice size was accepted");
+    const auto layerPitch = static_cast<std::uint64_t>(DescribeSurface(layeredDepth).GuestLayerOffset(1));
+    const auto sliceBytes = DepthSliceBytes({Side, Side}, 4u);
+    Require(layerPitch != sliceBytes, "the test's layered depth view has the depth slice size as its layer pitch");
+    const auto layered = DepthSurfaceStorage(context, {}, layeredDepth, 0);
+    Require(layered != nullptr && layered->ImageLayers() == 2, "a two-layer 2D array view over the depth plane's guest layer pitch was not taken as a storage image");
+    submit(recorder);
+    readBack(*layered);
+    Require(CountFloats(block + layerPitch, 0.f) == Side * Side, "the two-layer 2D array view did not take the layer that only overlaps the depth slice from guest memory");
+    Require(CountFloats(block, 0.5f) == Side * Side, "the two-layer 2D array view did not receive the layer the depth surface holds");
     layeredDepth.baseArray = 1;
-    ExpectFailure([&] { static_cast<void>(DepthSurfaceStorage(context, {}, layeredDepth, 0)); }, "with a layer pitch of", "a 2D array view of layer 1 of the depth plane with a layer pitch other than the depth slice size was accepted");
+    Require(DepthSurfaceStorage(context, {}, layeredDepth, 0) != nullptr, "a 2D array view from layer 1 of the depth plane was not taken as a storage image");
     const auto own = StorageTexture::Create(context, *context.detiler, PlaneResource(address, Format32Float), 0);
     const std::array<std::uint32_t, 4> eighth{std::bit_cast<std::uint32_t>(0.125f), std::bit_cast<std::uint32_t>(0.125f), std::bit_cast<std::uint32_t>(0.125f), std::bit_cast<std::uint32_t>(0.125f)};
     Require(own->FillClear(eighth, StorageTexture::WholeImage, refusal), refusal != nullptr ? refusal : "the storage image could not be filled");
@@ -267,6 +280,24 @@ void Run(Context context, std::uint8_t* block) {
     submit(recorder);
     readBack(*reread);
     Require(CountFloats(block, 0.125f) == Side * Side, "a storage image written over the depth plane did not reach the depth surface");
+    const float overlapping = 0.375f;
+    for (std::size_t i = 0; i < Side * Side; ++i) std::memcpy(block + layerPitch + i * sizeof(overlapping), &overlapping, sizeof(overlapping));
+    auto swizzled = PlaneResource(address, Format32Float);
+    swizzled.tileMode = TextureTileMode::kStandard64KB;
+    const auto tiled = DepthSurfaceStorage(context, {}, swizzled, 0);
+    Require(tiled != nullptr, "a 64 KiB depth plane has no storage image");
+    const std::array<std::uint32_t, 4> pendingFill{std::bit_cast<std::uint32_t>(0.75f), std::bit_cast<std::uint32_t>(0.75f), std::bit_cast<std::uint32_t>(0.75f), std::bit_cast<std::uint32_t>(0.75f)};
+    Require(tiled->FillClear(pendingFill, StorageTexture::WholeImage, refusal), refusal != nullptr ? refusal : "the 64 KiB depth plane's storage image could not be filled");
+    submit(recorder);
+    auto spanning = layeredDepth;
+    spanning.baseArray = 0;
+    spanning.depthOrLastArray = 3;
+    const auto spanningView = DepthSurfaceStorage(context, {}, spanning, 0);
+    Require(spanningView != nullptr && spanningView->ImageLayers() == 4, "a four-layer 2D array view over a 64 KiB depth plane was not taken as a storage image");
+    Require(CountFloats(block, 0.75f) == Side * Side, "the pending depth result was not stored into guest memory before the layered view was created");
+    submit(recorder);
+    readBack(*spanningView);
+    Require(CountFloats(block + layerPitch, overlapping) == Side * Side, "the layer that only overlaps the depth surface did not hold the guest bytes that were there");
     Require(!DepthSurfaceStoreBack(context, *StorageTexture::Create(context, *context.detiler, PlaneResource(address, Format32Float, Side / 2), 0)), "a storage image of another extent over the depth memory was stored into the depth surface");
 }
 
@@ -305,69 +336,6 @@ void RunPairings(Context context, std::uint8_t* block) {
     ExpectFailure([&] { static_cast<void>(DepthSurfaceStoreBack(context, *depth)); }, "through a view that another view of the plane", "a store back through a replaced view was taken by an older pairing that covers the plane");
 }
 
-void DepthCopyCase(Context context, std::uint8_t* block) {
-    const auto colorAddress = reinterpret_cast<std::uint64_t>(block);
-    const auto depthAddress = colorAddress + BlockBytes / 4;
-    Recorder recorder(context);
-    recorder.Activate();
-    const auto submit = [&] {
-        recorder.Submit();
-        Check(context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle")(context.queue), "vkQueueWaitIdle");
-    };
-    ColorTarget color{};
-    color.address = colorAddress;
-    color.surfaceAddress = colorAddress;
-    color.extent = {Side, Side};
-    color.surfaceExtent = color.extent;
-    color.format = VK_FORMAT_R32_SFLOAT;
-    color.elementBytes = 4;
-    color.tileMode = ColorTileMode::RenderTarget;
-    color.bytes = ColorTargetLayout(Side, Side, ColorTileMode::RenderTarget, 4).Bytes();
-    const auto copy = [&](std::uint32_t samples, std::uint32_t sample, VkExtent2D extent) {
-        RunDepthCopyPass(context, DepthCopyPass{depthAddress, extent, samples, sample, color});
-        submit();
-        const auto resident = CachedStorageSurface(context, SurfaceForTarget(color));
-        resident->MarkDirty();
-        resident->WriteBack();
-        submit();
-    };
-    const auto countBlock = [&](float value) {
-        std::size_t count = 0;
-        for (std::size_t offset = 0; offset < BlockBytes; offset += sizeof(float)) {
-            float texel = 0;
-            std::memcpy(&texel, block + offset, sizeof(texel));
-            if (texel == value) ++count;
-        }
-        return count;
-    };
-    std::fill(block, block + BlockBytes, std::uint8_t{0});
-    ExpectFailure([&] { copy(1, 0, {Side, Side}); }, "no draw rendered", "a DB depth copy from memory without a depth surface was accepted");
-    const auto sampledCounts = context.limits.sampledImageDepthSampleCounts & context.limits.framebufferDepthSampleCounts;
-    const std::uint32_t samples = (sampledCounts & VK_SAMPLE_COUNT_2_BIT) != 0 ? 2u : (sampledCounts & VK_SAMPLE_COUNT_4_BIT) != 0 ? 4u : 0u;
-    if (samples != 0) {
-        Require(DepthSurfaceView(context, DepthTarget{depthAddress, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 0.375f, 0, 0, false, samples}) != VK_NULL_HANDLE, "the multisample depth surface was not created");
-        for (std::uint32_t sample = 0; sample < samples; ++sample) {
-            std::fill(block, block + BlockBytes, std::uint8_t{0});
-            copy(samples, sample, {Side, Side});
-            Require(countBlock(0.375f) == Side * Side, "the DB depth copy of sample " + std::to_string(sample) + " of " + std::to_string(samples) + " did not store the cleared depth in every texel of the R32 float target");
-        }
-        ExpectFailure([&] { copy(samples, samples, {Side, Side}); }, "does not have", "a DB depth copy of a sample past the last of a multisample surface was accepted");
-        ExpectFailure([&] { copy(samples, 0, {Side / 2, Side / 2}); }, "of another size", "a DB depth copy of another extent than the depth surface was accepted");
-        ClearDepthSurfaces(context.device);
-    }
-    if ((context.limits.sampledImageDepthSampleCounts & VK_SAMPLE_COUNT_2_BIT) == 0) {
-        Require(DepthSurfaceView(context, DepthTarget{depthAddress, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 0.375f, 0, 0, false, 2}) != VK_NULL_HANDLE, "the unsampleable two-sample depth surface was not created");
-        ExpectFailure([&] { copy(2, 0, {Side, Side}); }, "cannot sample at its sample count", "a DB depth copy from an unsampleable two-sample depth surface was accepted");
-        ClearDepthSurfaces(context.device);
-        std::puts("DB depth copy: unsupported two-sample source refused cleanly");
-    }
-    Require(DepthSurfaceView(context, DepthTarget{depthAddress, 0, {Side, Side}, VK_FORMAT_D32_SFLOAT, 0.625f, 0, 0, false, 1}) != VK_NULL_HANDLE, "the one-sample depth surface was not created");
-    std::fill(block, block + BlockBytes, std::uint8_t{0});
-    copy(1, 0, {Side, Side});
-    Require(countBlock(0.625f) == Side * Side, "the DB depth copy of a one-sample depth surface did not store the cleared depth in every texel of the R32 float target");
-    ExpectFailure([&] { copy(1, 1, {Side, Side}); }, "does not have", "a DB depth copy of a second sample of a one-sample surface was accepted");
-}
-
 }
 
 int main() {
@@ -388,11 +356,6 @@ int main() {
         {
             std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
             Run(context, block);
-            auto* copyBlock = CopyStorage.data() + (BlockBytes - reinterpret_cast<std::uintptr_t>(CopyStorage.data()) % BlockBytes) % BlockBytes;
-            GuestAllocations::Mutation().Add(copyBlock, BlockBytes, true, true, true);
-            DepthCopyCase(context, copyBlock);
-            ClearCachedTextures(context.device);
-            GuestAllocations::Mutation().Remove(copyBlock);
             ClearDepthSurfaces(context.device);
             RunPairings(context, block);
             ClearDepthSurfaces(context.device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp
index b7f809f6ee..cdb726b3bd 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DepthSurfaceLastWriter.cpp
@@ -4,6 +4,7 @@
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -36,6 +37,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -47,6 +50,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -54,7 +63,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
             queues(context.physical, &count, nullptr);
             std::vector<VkQueueFamilyProperties> families(count);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp
new file mode 100644
index 0000000000..ca3c05ab27
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DeviceQueuePlan.cpp
@@ -0,0 +1,71 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include <cstdio>
+#include <iostream>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr VkQueueFlags Graphics = VK_QUEUE_GRAPHICS_BIT | VK_QUEUE_COMPUTE_BIT | VK_QUEUE_TRANSFER_BIT;
+constexpr VkQueueFlags Sparse = VK_QUEUE_SPARSE_BINDING_BIT;
+constexpr std::uint32_t Own = VK_QUEUE_FAMILY_IGNORED;
+
+struct Case {
+    const char* name;
+    std::vector<VkQueueFamilyProperties> families;
+    bool settles;
+    std::uint32_t mainCount;
+    bool settle;
+    std::uint32_t settleFamily;
+    std::uint32_t settleIndex;
+    bool sparseBinding;
+    std::uint32_t sparseFamily;
+    std::uint32_t sparseIndex;
+};
+
+VkQueueFamilyProperties family(VkQueueFlags flags, std::uint32_t queues) {
+    VkQueueFamilyProperties properties{};
+    properties.queueFlags = flags;
+    properties.queueCount = queues;
+    return properties;
+}
+
+std::string describe(const AgcDriver::DeviceQueuePlan& plan) {
+    return "main " + std::to_string(plan.mainCount) + " queues, settle " + (plan.settle ? std::to_string(plan.settleFamily) + ":" + std::to_string(plan.settleIndex) : std::string("none")) + ", sparse " + (!plan.sparseBinding ? std::string("none") : plan.sparseFamily == Own ? std::string("on the main queue") : std::to_string(plan.sparseFamily) + ":" + std::to_string(plan.sparseIndex));
+}
+
+void check(const Case& test) {
+    const auto plan = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, true);
+    const auto dense = AgcDriver::PlanDeviceQueues(test.families, 0, test.settles, false);
+    Require(plan.mainCount == dense.mainCount && plan.settle == dense.settle && plan.settleFamily == dense.settleFamily && plan.settleIndex == dense.settleIndex, std::string("device queue plan, ") + test.name + ": sparse binding changed the queues: " + describe(dense) + " without it, " + describe(plan) + " with it");
+    Require(!dense.sparseBinding && dense.sparseFamily == Own, std::string("device queue plan, ") + test.name + ": a device without sparse binding got a sparse queue: " + describe(dense));
+    const bool expected = plan.mainCount == test.mainCount && plan.settle == test.settle && (!test.settle || (plan.settleFamily == test.settleFamily && plan.settleIndex == test.settleIndex)) && plan.sparseBinding == test.sparseBinding && plan.sparseFamily == test.sparseFamily && (test.sparseFamily == Own || plan.sparseIndex == test.sparseIndex);
+    Require(expected, std::string("device queue plan, ") + test.name + ": got " + describe(plan));
+}
+
+}
+
+int main() {
+    try {
+        const std::vector<Case> cases{
+            {"one family with one queue", {family(Graphics | Sparse, 1)}, true, 1, false, 0, 0, true, Own, 0},
+            {"one family with one queue, no settles", {family(Graphics | Sparse, 1)}, false, 1, false, 0, 0, true, Own, 0},
+            {"settle family with one queue that also binds", {family(Graphics | Sparse, 1), family(VK_QUEUE_TRANSFER_BIT | Sparse, 1)}, true, 1, true, 1, 0, true, Own, 0},
+            {"settle family with two queues that also binds", {family(Graphics, 1), family(VK_QUEUE_TRANSFER_BIT | Sparse, 2)}, true, 1, true, 1, 0, true, 1, 1},
+            {"settle on the main family", {family(Graphics | Sparse, 2), family(VK_QUEUE_TRANSFER_BIT | Sparse, 1)}, true, 2, true, 0, 1, true, 1, 0},
+            {"sparse-only family preferred", {family(Graphics | Sparse, 16), family(VK_QUEUE_TRANSFER_BIT | Sparse, 2), family(Sparse, 1)}, true, 2, true, 0, 1, true, 2, 0},
+            {"no settles, a second family binds", {family(Graphics | Sparse, 1), family(VK_QUEUE_TRANSFER_BIT | Sparse, 1)}, false, 1, false, 0, 0, true, 1, 0},
+            {"no queue binds", {family(Graphics, 1), family(VK_QUEUE_TRANSFER_BIT, 1)}, true, 1, true, 1, 0, false, Own, 0},
+            {"only the settle queue binds", {family(Graphics, 1), family(VK_QUEUE_TRANSFER_BIT | Sparse, 1)}, true, 1, true, 1, 0, false, Own, 0},
+        };
+        for (const auto& test : cases) check(test);
+        std::puts("device queue plan tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DirectWriteCompletion.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DirectWriteCompletion.cpp
new file mode 100644
index 0000000000..889e5f46cb
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DirectWriteCompletion.cpp
@@ -0,0 +1,266 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using AgcDriver::Graphics::StorageTexture;
+constexpr std::uint32_t Side = 256;
+constexpr std::uint32_t Format32UInt = 20;
+constexpr std::uint32_t TileR64KBX = 0x1b;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::size_t Block = 0x10000;
+constexpr std::size_t SurfaceBytes = 4 * Block;
+constexpr std::size_t SettledImportBytes = 64 * Block;
+constexpr std::uint32_t Untouched = 0xdeadbeefu;
+constexpr std::uint32_t Stored = 0x12345678u;
+constexpr std::uint32_t Filled = 0x9abcdef0u;
+constexpr std::uint32_t Written = 0x0badf00du;
+
+alignas(256) constexpr std::array<std::uint32_t, 7> StoreCode{
+    0x7e040300, 0x7e060280, 0x7e0202ff, Stored, 0xf0200108, 0x00020102, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> FillCode{
+    0xd7460004, 0x04010c08, 0x7e000204, 0x7e020205, 0x7e040206, 0x7e060207, 0xe01c2000, 0x80000004, 0xe01c2000, 0x80020004, 0xbf810000,
+};
+
+std::uint64_t AddressOf(const void* data) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+}
+
+std::array<std::uint32_t, 8> TextureDescriptor(const std::uint32_t* texels) {
+    const auto address = AddressOf(texels);
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32UInt << 20u) | (((Side - 1u) & 3u) << 30u),
+        ((Side - 1u) >> 2u) | ((Side - 1u) << 14u),
+        0xfacu | (TileR64KBX << 20u) | (Type2D << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+void Dispatch(std::vector<std::uint32_t>& words, std::span<const std::uint32_t> code, std::uint32_t threads, std::uint32_t resource, std::span<const std::uint32_t> userData, std::uint32_t groups) {
+    const auto registers = [&](const std::uint32_t first, const std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{threads, 1, 1};
+    registers(0x207, shape);
+    const auto address = AddressOf(code.data());
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> layout{resource};
+    registers(0x213, layout);
+    registers(0x240, userData);
+    words.insert(words.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+}
+
+void Store(std::vector<std::uint32_t>& words, const std::uint32_t* texels) {
+    std::array<std::uint32_t, 16> userData{};
+    const auto texture = TextureDescriptor(texels);
+    std::copy(texture.begin(), texture.end(), userData.begin() + 8);
+    Dispatch(words, StoreCode, 8, static_cast<std::uint32_t>(userData.size()) << 1u, userData, 1);
+}
+
+void Fill(std::vector<std::uint32_t>& words, const std::uint32_t* texels, const std::uint32_t* copied) {
+    const auto address = AddressOf(texels);
+    const auto other = AddressOf(copied);
+    const std::array<std::uint32_t, 12> userData{
+        static_cast<std::uint32_t>(address),
+        static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u),
+        static_cast<std::uint32_t>(SurfaceBytes / 16u),
+        0x4bfacu,
+        Filled,
+        Filled,
+        Filled,
+        Filled,
+        static_cast<std::uint32_t>(other),
+        static_cast<std::uint32_t>((other >> 32u) & 0xffffu) | (16u << 16u),
+        static_cast<std::uint32_t>(SurfaceBytes / 16u),
+        0x4bfacu,
+    };
+    Dispatch(words, FillCode, 64, (static_cast<std::uint32_t>(userData.size()) << 1u) | 0x80u, userData, static_cast<std::uint32_t>(SurfaceBytes / 1024u));
+}
+
+class Surface {
+public:
+    Surface() {
+#ifdef _WIN32
+        region = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(SurfaceBytes, Block));
+        if (region != nullptr) GuestArena::GuestArenaCommit_nid_postfix(region, SurfaceBytes, PAGE_READWRITE, SurfaceBytes);
+#else
+        void* mapped = mmap(nullptr, SurfaceBytes + Block, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (mapped != MAP_FAILED) {
+            const auto begin = reinterpret_cast<std::uintptr_t>(mapped);
+            const auto aligned = (begin + Block - 1) & ~std::uintptr_t{Block - 1};
+            if (aligned != begin) munmap(mapped, aligned - begin);
+            if (aligned != begin + Block) munmap(reinterpret_cast<void*>(aligned + SurfaceBytes), begin + Block - aligned);
+            region = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(region, SurfaceBytes);
+        }
+#endif
+        Require(region != nullptr, "direct write completion: cannot allocate the guest surface");
+        texels = reinterpret_cast<std::uint32_t*>(region);
+        std::fill(texels, texels + SurfaceBytes / 4u, Untouched);
+        GuestAllocations::Mutation().Add(region, SurfaceBytes, true, true, true);
+    }
+
+    ~Surface() {
+        GuestAllocations::Mutation().Remove(region);
+#ifdef _WIN32
+        GuestArena::GuestArenaReset_nid_postfix(region, SurfaceBytes);
+        GuestArena::GuestArenaRelease_nid_postfix(region, SurfaceBytes);
+#else
+        munmap(region, SurfaceBytes);
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(region, SurfaceBytes);
+#endif
+    }
+
+    Surface(const Surface&) = delete;
+    Surface& operator=(const Surface&) = delete;
+
+    std::uint32_t* Texels() const { return texels; }
+
+private:
+    std::uint8_t* region = nullptr;
+    std::uint32_t* texels = nullptr;
+};
+
+enum class Outcome { Kept, Dropped, Missed };
+
+void WriteOnceRecorded(const Surface& surface) {
+    const auto address = AddressOf(surface.Texels());
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    for (;;) {
+        {
+            std::unique_lock hold(AgcDriver::GuestMemory::GpuMutex());
+            if (StorageTexture::FindPending(address, SurfaceBytes) != nullptr) {
+                surface.Texels()[0] = Written;
+                return;
+            }
+        }
+        Require(std::chrono::steady_clock::now() < deadline, "direct write completion: the image store was never recorded");
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+}
+
+Outcome StoreAfterFill(const Surface& surface, bool cpuWrite) {
+    std::vector<std::uint32_t> copied(SurfaceBytes / 4u, Untouched);
+    GuestAllocations::Mutation().Add(copied.data(), SurfaceBytes, true, true, true);
+    struct Unregister {
+        void* data;
+        ~Unregister() { GuestAllocations::Mutation().Remove(data); }
+    } unregister{copied.data()};
+    std::vector<std::uint32_t> words;
+    Fill(words, surface.Texels(), copied.data());
+    Store(words, surface.Texels());
+    alignas(8) static std::uint32_t gate = 0;
+    gate = 0;
+    if (cpuWrite) {
+        const auto at = AddressOf(&gate);
+        words.insert(words.end(), {0xc0053c00u, 0x13u, static_cast<std::uint32_t>(at), static_cast<std::uint32_t>(at >> 32u), 1u, 0xffffffffu, 0x19u});
+    }
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+    if (cpuWrite) {
+        WriteOnceRecorded(surface);
+        std::atomic_ref<std::uint32_t>(gate).store(1);
+    }
+    AgcDriverWaitIdle_nid_postfix();
+    std::vector<std::byte> landed(SurfaceBytes);
+    AgcDriver::GuestMemory::Read(AddressOf(copied.data()), landed);
+    const auto address = AddressOf(surface.Texels());
+    std::unique_lock hold(AgcDriver::GuestMemory::GpuMutex());
+    const auto image = StorageTexture::FindPending(address, SurfaceBytes);
+    if (image == nullptr) return Outcome::Missed;
+    const bool current = image->Refresh();
+    const bool pending = StorageTexture::FindPending(address, SurfaceBytes) == image;
+    StorageTexture::FlushPending(address, SurfaceBytes, nullptr, "direct write completion fixture");
+    return current && pending ? Outcome::Kept : Outcome::Dropped;
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        struct ShutdownGuard {
+            ~ShutdownGuard() { try { AgcDriverShutdown_nid_postfix(); } catch (...) {} }
+        } shutdown;
+        {
+            Surface probe;
+            Require(AgcDriver::Graphics::DescribeSurface(AgcDriver::Graphics::DecodeTextureResource(TextureDescriptor(probe.Texels()))).guestBytes == SurfaceBytes, "direct write completion: unexpected surface size");
+        }
+        {
+            constexpr std::size_t Runs = SettledImportBytes / SurfaceBytes - 1;
+            std::vector<std::unique_ptr<Surface>> surfaces;
+            for (std::size_t index = 0; index <= 2 * Runs + 1; ++index) surfaces.push_back(std::make_unique<Surface>());
+            static_cast<void>(StoreAfterFill(*surfaces[0], false));
+            std::size_t kept = 0;
+            std::size_t dropped = 0;
+            for (std::size_t run = 1; run <= Runs; ++run) {
+                const auto outcome = StoreAfterFill(*surfaces[run], false);
+                kept += outcome == Outcome::Kept;
+                dropped += outcome == Outcome::Dropped;
+            }
+            AgcDriverWaitIdle_nid_postfix();
+            std::printf("[direct write completion] %zu of %zu runs held the image results pending, %zu dropped them\n", kept + dropped, Runs, dropped);
+            Require(kept + dropped != 0, "direct write completion: no run held the image results pending");
+            Require(dropped == 0, "direct write completion: the completion of a buffer write dropped image results recorded after it");
+            static_cast<void>(StoreAfterFill(*surfaces[Runs + 1], false));
+            std::size_t keptOverWrite = 0;
+            std::size_t lostWrites = 0;
+            for (std::size_t run = Runs + 2; run <= 2 * Runs + 1; ++run) {
+                keptOverWrite += StoreAfterFill(*surfaces[run], true) == Outcome::Kept;
+                lostWrites += surfaces[run]->Texels()[0] != Written;
+            }
+            AgcDriverWaitIdle_nid_postfix();
+            std::printf("[direct write completion] %zu of %zu runs with a CPU write before the completion kept the image results, %zu lost the write\n", keptOverWrite, Runs, lostWrites);
+            Require(keptOverWrite == 0, "direct write completion: image results were kept over a CPU write made before the completion");
+            Require(lostWrites == 0, "direct write completion: a CPU write made before the completion was lost");
+        }
+        AgcDriverShutdown_nid_postfix();
+        std::puts("direct write completion tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp
index a82e34a36a..45f1e60352 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheRelocation.cpp
@@ -135,6 +135,69 @@ void MovedDataHitsTheCache(bool libraries) {
     Require(again.lookups == 10 && again.hits == 5, mode + ": a draw at an address seen before did not reuse the cached draw (" + std::to_string(again.hits) + " hits)");
 }
 
+void EvictedEntriesServeNoRelocation(bool libraries) {
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+    Registered(SecondVertexHeader, SecondVertexCode.data(), sizeof(SecondVertexCode), 2);
+    const auto mode = std::string(libraries ? "with" : "without") + " graphics pipeline libraries";
+    const auto draw = [&](const float* source, const std::uint32_t* vertexCode) {
+        auto commands = DrawFrom({source}, vertexCode);
+        Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+        Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission failed");
+        AgcDriverWaitIdle_nid_postfix();
+        return AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    };
+    static std::array<std::array<float, 4>, 6> same{};
+    for (auto& entry : same) entry = {1.0f, 0.0f, 0.0f, 0.0f};
+    alignas(16) static std::array<std::array<float, 4>, 3> others{};
+    for (std::size_t i = 0; i < others.size(); ++i) others[i] = {0.25f + 0.03125f * static_cast<float>(i), 0.0f, 0.0f, 0.0f};
+    AgcDriver::DriverDetail::DrawEntryCounters counters{};
+    for (std::size_t i = 0; i < 4; ++i) counters = draw(same[i].data(), VertexCode.data());
+    Require(counters.lookups == 4 && counters.hits == 0 && counters.inserts == 2, mode + ": the draws that teach the moved pointer and its contents made " + std::to_string(counters.hits) + " hits and " + std::to_string(counters.inserts) + " inserts, expected 0 and 2");
+    const auto relocated = draw(same[4].data(), VertexCode.data());
+    Require(relocated.hits == 1, mode + ": a draw whose data moved after the teaching draws did not reuse the cached draw (" + std::to_string(relocated.hits) + " hits)");
+    auto evicted = relocated;
+    for (const auto& entry : others) {
+        draw(entry.data(), SecondVertexCode.data());
+        evicted = draw(entry.data(), SecondVertexCode.data());
+    }
+    Require(evicted.evictions - relocated.evictions >= 2 && evicted.inserts - relocated.inserts >= 2, mode + ": draws of another vertex shader did not evict the two taught entries from the draw cache (" + std::to_string(evicted.inserts - relocated.inserts) + " inserts, " + std::to_string(evicted.evictions - relocated.evictions) + " evictions; run with APS5_DRAW_CACHE_ENTRIES=2)");
+    const auto after = draw(same[5].data(), VertexCode.data());
+    Require(after.lookups == evicted.lookups + 1 && after.hits == evicted.hits, mode + ": a draw whose data moved reused a draw the cache had evicted, through its relocation alias (" + std::to_string(after.hits - evicted.hits) + " hits)");
+}
+
+void RelocatingDrawsKeepTheirDonor(bool libraries) {
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+    Registered(SecondVertexHeader, SecondVertexCode.data(), sizeof(SecondVertexCode), 2);
+    const auto mode = std::string(libraries ? "with" : "without") + " graphics pipeline libraries";
+    const auto draw = [&](const float* source, const std::uint32_t* vertexCode) {
+        auto commands = DrawFrom({source}, vertexCode);
+        Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+        Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission failed");
+        AgcDriverWaitIdle_nid_postfix();
+        return AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    };
+    constexpr std::size_t Rounds = 3;
+    alignas(16) static std::array<std::array<float, 4>, Rounds> others{};
+    for (std::size_t i = 0; i < others.size(); ++i) others[i] = {0.25f + 0.03125f * static_cast<float>(i), 0.0f, 0.0f, 0.0f};
+    static std::array<std::array<float, 4>, 5 + Rounds> same{};
+    for (auto& entry : same) entry = {1.0f, 0.0f, 0.0f, 0.0f};
+    AgcDriver::DriverDetail::DrawEntryCounters counters{};
+    for (std::size_t i = 0; i < 4; ++i) counters = draw(same[i].data(), VertexCode.data());
+    Require(counters.lookups == 4 && counters.hits == 0 && counters.inserts == 2, mode + ": the draws that teach the moved pointer and its contents made " + std::to_string(counters.hits) + " hits and " + std::to_string(counters.inserts) + " inserts, expected 0 and 2");
+    const auto start = draw(same[4].data(), VertexCode.data());
+    Require(start.hits == 1, mode + ": a draw whose data moved after the teaching draws did not reuse the cached draw (" + std::to_string(start.hits) + " hits)");
+    auto relocated = start;
+    for (std::size_t i = 0; i < others.size(); ++i) {
+        draw(others[i].data(), SecondVertexCode.data());
+        const auto inserted = draw(others[i].data(), SecondVertexCode.data());
+        relocated = draw(same[5 + i].data(), VertexCode.data());
+        Require(relocated.hits == inserted.hits + 1, mode + ": a draw whose data moved again lost the cached draw it reused before each of " + std::to_string(i + 1) + " rounds of another vertex shader's draws (" + std::to_string(inserted.inserts - start.inserts) + " inserts, " + std::to_string(inserted.evictions - start.evictions) + " evictions)");
+    }
+    Require(relocated.evictions - start.evictions >= 2, mode + ": draws of another vertex shader evicted " + std::to_string(relocated.evictions - start.evictions) + " entries, expected at least 2 (run with APS5_DRAW_CACHE_ENTRIES=2)");
+}
+
 void SplitRunsNameTheirSharedWords() {
     alignas(16) static std::array<std::uint32_t, 4> data{1u, 2u, 3u, 4u};
     auto table = std::make_shared<ShaderRecompiler::SrtGuestWords>();
@@ -228,9 +291,11 @@ void MovedForwardedWordReachesStageDataHit(bool libraries) {
 
 }
 
-int main() {
+int main(int argc, char** argv) {
     try {
-        SplitRunsNameTheirSharedWords();
+        const bool evicted = argc == 2 && std::string(argv[1]) == "--evicted";
+        const bool kept = argc == 2 && std::string(argv[1]) == "--kept";
+        if (!evicted && !kept) SplitRunsNameTheirSharedWords();
         bool libraries = false;
         {
             const auto device = OpenVulkanTestDevice();
@@ -238,6 +303,18 @@ int main() {
             libraries = device->GraphicsPipelineLibraries();
         }
         if (!libraries && std::getenv("APS5_NO_GPL") == nullptr) return VulkanTestSkipped;
+        if (evicted) {
+            EvictedEntriesServeNoRelocation(libraries);
+            AgcDriverShutdown_nid_postfix();
+            std::cout << "An evicted draw served no relocation " << (libraries ? "with" : "without") << " graphics pipeline libraries\n";
+            return 0;
+        }
+        if (kept) {
+            RelocatingDrawsKeepTheirDonor(libraries);
+            AgcDriverShutdown_nid_postfix();
+            std::cout << "A draw relocated from a cached draw kept it cached " << (libraries ? "with" : "without") << " graphics pipeline libraries\n";
+            return 0;
+        }
         MovedDataHitsTheCache(libraries);
         UnrelocatedAliasesStayOut(libraries);
         MovedForwardedWordReachesStageDataHit(libraries);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp
index ab9818c6ba..41ff2d9a50 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawCacheReuse.cpp
@@ -183,6 +183,20 @@ void StageDataHitsRefreshTheirWords(bool libraries) {
     Require(BrightestColorByte() == 255, mode + ": the draw of constant 1.0 wrote " + std::to_string(BrightestColorByte()) + ", expected 255");
 }
 
+void RefreshedStageDataVerifies() {
+    Registered(TriangleVertexHeader, TriangleVertexCode.data(), sizeof(TriangleVertexCode), 2);
+    Registered(ConstantPixelHeader, ConstantPixelCode.data(), sizeof(ConstantPixelCode), 1);
+    ColorMemory.fill(std::byte{0});
+    PixelConstant[0] = 0.25f;
+    const auto cached = SubmitConstantDraws(3);
+    Require(BrightestColorByte() == 64, "draw-entry verification: the initial constant did not render");
+    PixelConstant[0] = 1.0f;
+    const auto refreshed = SubmitConstantDraws(1);
+    Require(refreshed.verifyHits - cached.verifyHits == 1 && refreshed.stageDataHits - cached.stageDataHits == 1, "draw-entry verification: the refreshed constant did not exercise a verified stage data hit");
+    Require(refreshed.verifyMismatches == cached.verifyMismatches, "draw-entry verification: refreshed stage data differed from a fresh capture");
+    Require(BrightestColorByte() == 255, "draw-entry verification: the refreshed constant did not render");
+}
+
 void RetainedPixelCacheTransitions() {
     auto commands = Draws(32.0f, VertexCode.data(), 1, PixelCode.data(), 1, {});
     Append(commands, 0x76, {0x00c, std::bit_cast<std::uint32_t>(1.0f)});
@@ -239,10 +253,14 @@ int main() {
             libraries = device->GraphicsPipelineLibraries();
         }
         if (!libraries && std::getenv("APS5_NO_GPL") == nullptr) return VulkanTestSkipped;
-        ThirdDrawHitsTheCache(libraries);
-        UserDataDrawsReuseTheirShape(libraries);
-        StageDataHitsRefreshTheirWords(libraries);
-        RetainedPixelCacheTransitions();
+        if (std::getenv("APS5_VERIFY_DRAW_ENTRIES") != nullptr) {
+            RefreshedStageDataVerifies();
+        } else {
+            ThirdDrawHitsTheCache(libraries);
+            UserDataDrawsReuseTheirShape(libraries);
+            StageDataHitsRefreshTheirWords(libraries);
+            RetainedPixelCacheTransitions();
+        }
         AgcDriverShutdown_nid_postfix();
         Require(AgcDriver::Graphics::PipelineLibraryWorkers() == 0, "the driver's shutdown left the pipeline library worker running");
         std::cout << "A repeated draw reused the cached draw " << (libraries ? "with" : "without") << " graphics pipeline libraries\n";
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp
index 13d67731a9..ed4b5280c1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawDataHitUserWords.cpp
@@ -34,6 +34,7 @@ alignas(256) constexpr std::array<std::uint32_t, 16> TriangleVertexCode{
     0x7e060280u, 0x7e0802f2u, 0xf80008cfu, 0x04030201u, 0xbf810000u,
 };
 alignas(256) constexpr std::array<std::uint32_t, 10> ArithmeticPixelCode{0xf4000100u, 0xfa000000u, 0xbf8cc07fu, 0x7e000204u, 0x06000002u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 8> DirectBufferPixelCode{0xe0300000u, 0x80000000u, 0xbf8c3f70u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u};
 alignas(256) std::array<float, 4> PixelConstant{};
 alignas(256) std::array<std::byte, 1024> ColorMemory{};
 
@@ -47,6 +48,7 @@ struct Header {
 alignas(8) Header VertexHeader{};
 alignas(8) Header PixelHeader{};
 alignas(8) Header ArithmeticPixelHeader{};
+alignas(8) Header DirectBufferPixelHeader{};
 
 void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
     header.shader.file_header = 0x34333231u;
@@ -83,10 +85,10 @@ void PixelUserData(std::vector<std::uint32_t>& commands, const std::uint32_t* po
     Append(commands, 0x76, {0x00e, unread});
 }
 
-std::vector<std::uint32_t> Setup(bool triangle = false) {
+std::vector<std::uint32_t> Setup(bool triangle = false, const std::uint32_t* pixelCode = nullptr, std::uint32_t pixelUserSgprs = 3) {
     const auto color = reinterpret_cast<std::uintptr_t>(ColorMemory.data());
     const auto vertex = reinterpret_cast<std::uintptr_t>(triangle ? TriangleVertexCode.data() : VertexCode.data());
-    const auto pixel = reinterpret_cast<std::uintptr_t>(triangle ? ArithmeticPixelCode.data() : PixelCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(pixelCode ? pixelCode : triangle ? ArithmeticPixelCode.data() : PixelCode.data());
     std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
         {0x2d5, 0x2000},
         {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
@@ -110,7 +112,7 @@ std::vector<std::uint32_t> Setup(bool triangle = false) {
     };
     const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
         {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, triangle ? 0u : 1u << 1u}, {0x8c, 0},
-        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 3u << 1u},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, pixelUserSgprs << 1u},
     };
     if (triangle) context.insert(context.end(), {{0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0}});
     std::vector<std::uint32_t> commands;
@@ -177,6 +179,21 @@ void UnreadUserWordsKeepTheStage(bool verify) {
     Require(counters.dataHits == moved.dataHits + 1, "a draw that pointed the pixel stage at another buffer descriptor was not a data-only hit: " + Counts(counters));
     Require(counters.dataStagesCompiled - moved.dataStagesCompiled >= 1, "a draw that pointed the pixel stage at another buffer descriptor reused the pixel stage: " + Counts(counters));
     if (!verify) Require(counters.dataStagesReused - moved.dataStagesReused == 1, "a draw that changed only the pixel stage's descriptor pointer did not reuse the vertex stage: " + Counts(counters));
+
+    const bool refresh = std::getenv("APS5_DRAW_PIPELINE") != nullptr;
+    for (const std::uint32_t unread : {0x33u, 0x44u}) {
+        commands.clear();
+        PixelUserData(commands, second, unread);
+        Append(commands, 0x2d, {3, 2});
+        const auto last = counters;
+        counters = Submit(std::move(commands));
+        Require(counters.dataHits == last.dataHits + 1 && counters.inserts == last.inserts, "a draw at the moved pointer with a new unread word: " + Counts(counters));
+        if (verify) continue;
+        const auto compiled = counters.dataStagesCompiled - last.dataStagesCompiled;
+        const bool expectReuse = refresh && unread == 0x44u;
+        Require(compiled == (expectReuse ? 0u : 1u), std::string(expectReuse ? "after a refresh, the draw at the moved pointer compiled its pixel stage again: " : "the draw at the moved pointer did not compile its pixel stage: ") + Counts(counters));
+        Require(counters.shapeUpdates - last.shapeUpdates == (refresh && unread == 0x33u ? 1u : 0u), "shape refreshes: " + std::to_string(counters.shapeUpdates - last.shapeUpdates) + " (" + Counts(counters) + ")");
+    }
 }
 
 unsigned BrightestColorByte() {
@@ -208,6 +225,39 @@ void ReadUserWordsChangeTheOutput() {
     Require(closeTo(second, 191), "a pixel stage adding user word 2 changed to 0.5 wrote " + std::to_string(second) + ", expected 191 (" + Counts(after) + ", before: " + Counts(before) + ")");
 }
 
+void DirectBufferBaseMovesWithItsPayload() {
+    Registered(VertexHeader, TriangleVertexCode.data(), sizeof(TriangleVertexCode), 2);
+    Registered(DirectBufferPixelHeader, DirectBufferPixelCode.data(), sizeof(DirectBufferPixelCode), 1);
+    auto* ring = GuestBlock();
+    ColorMemory.fill(std::byte{0});
+    const auto slot = [&](std::size_t index, float value) {
+        auto* data = ring + 1024 + index * 64;
+        data[0] = std::bit_cast<std::uint32_t>(value);
+        return data;
+    };
+    const auto draw = [&](const std::uint32_t* data, bool setup) {
+        auto commands = setup ? Setup(true, DirectBufferPixelCode.data(), 4) : std::vector<std::uint32_t>{};
+        const auto address = reinterpret_cast<std::uintptr_t>(data);
+        Append(commands, 0x76, {0x00c, static_cast<std::uint32_t>(address)});
+        Append(commands, 0x76, {0x00d, static_cast<std::uint32_t>(address >> 32u) & 0xffffu});
+        Append(commands, 0x76, {0x00e, 16});
+        Append(commands, 0x76, {0x00f, 0x3004bfacu});
+        Append(commands, 0x2d, {3, 2});
+        Submit(std::move(commands));
+        return BrightestColorByte();
+    };
+    const auto first = slot(0, 0.25f);
+    const auto second = slot(1, 1.0f);
+    draw(first, true);
+    const auto repeated = draw(first, false);
+    const auto before = AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    const auto moved = draw(second, false);
+    const auto after = AgcDriver::DriverDetail::Driver::Get().DrawCacheCounters();
+    Require(moved > repeated, "a draw whose descriptor base and payload both moved read the old payload: " + std::to_string(repeated) + " then " + std::to_string(moved) + " (" + Counts(after) + ", before: " + Counts(before) + ")");
+    Require(after.dataHits == before.dataHits + 1, "a draw whose descriptor base and payload moved was not a data-only hit (" + Counts(after) + ", before: " + Counts(before) + ")");
+    Require(after.dataStagesCompiled - before.dataStagesCompiled >= 1, "a draw whose descriptor base moved reused the pixel stage built for the old base: the rebuild this test documents is gone, flip it to a reuse check (" + Counts(after) + ", before: " + Counts(before) + ")");
+}
+
 }
 
 int main() {
@@ -222,6 +272,7 @@ int main() {
         const bool verify = std::getenv("APS5_VERIFY_DRAW_DATA_HITS") != nullptr;
         UnreadUserWordsKeepTheStage(verify);
         ReadUserWordsChangeTheOutput();
+        DirectBufferBaseMovesWithItsPayload();
         AgcDriverShutdown_nid_postfix();
         std::cout << "Data-only hits " << (verify ? "verified" : "reused") << " the stages whose read user words did not change\n";
         return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawPipelineTrace.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawPipelineTrace.cpp
index 31456ae51f..e3a7f4cc80 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawPipelineTrace.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawPipelineTrace.cpp
@@ -11,35 +11,46 @@ int main(int argc, char** argv) {
     try {
         using namespace AgcDriver;
         using DriverDetail::DrawPipeline;
+        using DriverDetail::DrawFinisher;
         if (DrawPipeline::Depth() == 0) return 77;
-        const bool disabled = argc > 1 && std::string_view(argv[1]) == "disabled";
+        const auto mode = argc > 1 ? std::string_view(argv[1]) : std::string_view{};
+        const bool disabled = mode == "disabled" || mode == "finisher-disabled";
+        const bool finisher = mode.starts_with("finisher");
+        const char* worker = finisher ? "draw finisher" : "draw committer";
+        if (finisher && !DrawFinisher::Enabled()) throw std::runtime_error("draw finisher is disabled");
         if (PerformanceTrace::Configured() == disabled) throw std::runtime_error("unexpected trace configuration");
         if (!disabled) PerformanceTrace::Present(1, 1, nullptr);
         bool checked = false;
         const char* failure = nullptr;
-        DrawPipeline::Queue0().Enqueue([&] {
+        const auto checkWorker = [&] {
             auto* trace = PerformanceTrace::Thread();
             if (disabled) {
-                if (trace != nullptr) { failure = "unconfigured draw committer allocated a trace buffer"; return; }
+                if (trace != nullptr) { failure = "unconfigured draw worker allocated a trace buffer"; return; }
                 checked = true;
                 return;
             }
-            if (trace == nullptr) { failure = "draw committer CPU spans are absent from the trace"; return; }
+            if (trace == nullptr) { failure = "draw worker CPU spans are absent from the trace"; return; }
             {
                 PerformanceTimer timer("DrawPipeline.TraceRegression");
                 std::this_thread::sleep_for(std::chrono::milliseconds(1));
             }
             const auto snapshot = trace->Collect();
-            if (snapshot.name != "draw committer" || snapshot.dropped) { failure = "draw committer trace identity or capacity is incorrect"; return; }
+            if (snapshot.name != worker || snapshot.dropped) { failure = "draw worker trace identity or capacity is incorrect"; return; }
             const auto found = [](const auto& event) { return event.scope != nullptr && std::string_view(event.scope) == "DrawPipeline.TraceRegression" && event.stage == nullptr && event.length > std::chrono::steady_clock::duration::zero(); };
             if (std::none_of(snapshot.slices.begin(), snapshot.slices.end(), found) || std::none_of(snapshot.totals.begin(), snapshot.totals.end(), found))
-                { failure = "committed work was missing from trace slices or totals"; return; }
+                { failure = "draw work was missing from trace slices or totals"; return; }
             checked = true;
-        }, {});
-        DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Submission);
+        };
+        if (finisher) {
+            DrawFinisher::Get().Enqueue(checkWorker);
+            DrawFinisher::Get().Drain();
+        } else {
+            DrawPipeline::Queue0().Enqueue(checkWorker, {});
+            DrawPipeline::Queue0().Drain(DrawPipeline::DrainReason::Submission);
+        }
         if (failure != nullptr) throw std::runtime_error(failure);
-        if (!checked) throw std::runtime_error("draw committer did not run the trace check");
-        std::cout << "Draw committer tracing checked\n";
+        if (!checked) throw std::runtime_error("draw worker did not run the trace check");
+        std::cout << worker << " tracing checked\n";
         return 0;
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawShaderFailure.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawShaderFailure.cpp
new file mode 100644
index 0000000000..2051585c2d
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawShaderFailure.cpp
@@ -0,0 +1,355 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <bit>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <cstdlib>
+#include <exception>
+#include <fstream>
+#include <initializer_list>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 2> FailingVertexCode{0xbe800200u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 4> RequestFailureVertexCode{0xbe901f00u, 0x809010c0u, 0xbe802010u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 8> ValidVertexCode{0x7e000208u, 0x7e020280u, 0x7e040280u, 0x7e0602f2u, 0xf80008cfu, 0x03020100u, 0xbf810000u, 0xbf810000u};
+alignas(256) constexpr std::array<std::uint32_t, 8> PixelCode{0x7e000200u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u};
+
+struct ColorBuffer {
+    static constexpr std::size_t Size = 65536;
+    ColorBuffer() {
+#ifdef _WIN32
+        data = static_cast<std::byte*>(VirtualAlloc(nullptr, Size, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        Require(data != nullptr, "cannot allocate the color target");
+#else
+        void* raw = mmap(nullptr, 2 * Size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(raw != MAP_FAILED, "cannot map the color target");
+        const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+        const auto aligned = (begin + Size - 1) & ~(static_cast<std::uintptr_t>(Size) - 1);
+        if (aligned != begin) munmap(raw, aligned - begin);
+        if (aligned + Size != begin + 2 * Size) munmap(reinterpret_cast<void*>(aligned + Size), begin + 2 * Size - (aligned + Size));
+        data = reinterpret_cast<std::byte*>(aligned);
+#endif
+        std::memset(data, 0, Size);
+        GuestAllocations::Mutation().Add(data, Size, true, true, true);
+    }
+    ~ColorBuffer() {
+        if (data != nullptr) {
+            GuestAllocations::Mutation().Remove(data);
+#ifdef _WIN32
+            VirtualFree(data, 0, MEM_RELEASE);
+#else
+            munmap(data, Size);
+#endif
+            data = nullptr;
+        }
+    }
+    ColorBuffer(const ColorBuffer&) = delete;
+    ColorBuffer& operator=(const ColorBuffer&) = delete;
+
+    std::byte* data = nullptr;
+};
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+const Shader* Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+    return &header.shader;
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+std::vector<std::uint32_t> DrawPacket(std::uintptr_t color, const std::uint32_t* vertex, const std::uint32_t* pixel) {
+    const auto vertexAddress = reinterpret_cast<std::uintptr_t>(vertex);
+    const auto pixelAddress = reinterpret_cast<std::uintptr_t>(pixel);
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x4dc6c000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)},
+        {0x10f, std::bit_cast<std::uint32_t>(32.0f)}, {0x110, std::bit_cast<std::uint32_t>(32.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertexAddress >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertexAddress >> 40u)}, {0x8b, 1u << 1u}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixelAddress >> 8u)}, {0x009, static_cast<std::uint32_t>(pixelAddress >> 40u)}, {0x00b, 1u << 1u}, {0x00c, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    std::vector<std::uint32_t> commands;
+    Append(commands, 0x79, {0x242, 4});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x2d, {3, 2});
+    return commands;
+}
+
+std::string ReadTraceFile(const char* path) {
+    std::ifstream stream(path, std::ios::binary);
+    if (!stream.is_open()) return {};
+    std::ostringstream buffer;
+    buffer << stream.rdbuf();
+    return buffer.str();
+}
+
+bool WaitForTraceRecord(const char* path, const std::string& record) {
+    for (int attempt = 0; attempt < 200; ++attempt) {
+        if (ReadTraceFile(path).find(record) != std::string::npos) return true;
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    }
+    return false;
+}
+
+std::string TraceLine(const std::string& trace, const std::string& record) {
+    const auto position = trace.find(record);
+    if (position == std::string::npos) return {};
+    const auto end = trace.find('\n', position);
+    return trace.substr(position, end == std::string::npos ? std::string::npos : end - position);
+}
+
+std::string TraceField(const std::string& line, const char* name) {
+    const auto field = line.find(std::string(name) + "=");
+    if (field == std::string::npos) return {};
+    const auto start = field + std::strlen(name) + 1;
+    const auto end = line.find(' ', start);
+    return line.substr(start, end == std::string::npos ? std::string::npos : end - start);
+}
+
+std::string SubmissionSerialOf(const std::string& trace, const std::string& record) {
+    const auto position = trace.find(record);
+    if (position == std::string::npos) return {};
+    const auto field = trace.find("submission=", position);
+    if (field == std::string::npos) return {};
+    const auto start = field + std::string("submission=").size();
+    const auto end = trace.find(' ', start);
+    return trace.substr(start, end == std::string::npos ? std::string::npos : end - start);
+}
+
+void SubmitDraw(std::uintptr_t color, const std::uint32_t* vertex, const std::uint32_t* pixel) {
+    auto commands = DrawPacket(color, vertex, pixel);
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission was not accepted");
+}
+
+void FailingShaderDecodeRecordsTheDraw(const char* tracePath, bool correlationExpected = true) {
+    ColorBuffer color;
+    Registered(VertexHeader, FailingVertexCode.data(), FailingVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), FailingVertexCode.data(), PixelCode.data());
+    std::string failure;
+    try {
+        AgcDriverWaitIdle_nid_postfix();
+        Require(false, "the failing shader request did not fail the submission");
+    } catch (const std::exception& error) {
+        failure = error.what();
+    }
+    Require(failure.find("unsupported SOP1 opcode 2") != std::string::npos, "the submission failure lost the original shader-request error: " + failure);
+    if (!correlationExpected) {
+        const auto trace = ReadTraceFile(tracePath);
+        Require(trace.find("draw-attempt") == std::string::npos, "correlation-disabled failure emitted draw-attempt");
+        Require(trace.find("draw-shader-request-failed") == std::string::npos, "correlation-disabled failure emitted draw-shader-request-failed");
+        Require(trace.find("draw-materialization-failed") == std::string::npos, "correlation-disabled failure emitted draw-materialization-failed");
+        Require(trace.find("draw-submission-failed") == std::string::npos, "correlation-disabled failure emitted draw-submission-failed");
+        Require(trace.find("draw-selected") == std::string::npos, "correlation-disabled failure emitted draw-selected");
+        Require(trace.find("draw-recorded") == std::string::npos, "correlation-disabled failure emitted draw-recorded");
+        return;
+    }
+    Require(WaitForTraceRecord(tracePath, "draw-attempt-failed"), "the capture trace received no draw-attempt-failed record");
+    const auto trace = ReadTraceFile(tracePath);
+    const auto attempt = TraceLine(trace, "draw-attempt ");
+    Require(!attempt.empty(), "the failed draw emitted no draw-attempt record");
+    const auto token = TraceField(attempt, "token");
+    Require(!token.empty() && token != "0", "the draw-attempt record carries no draw token");
+    const auto failed = TraceLine(trace, "draw-attempt-failed");
+    Require(!failed.empty(), "the failed draw emitted no draw-attempt-failed record");
+    Require(failed.find("token=" + token) != std::string::npos, "the decode failure lost the draw token");
+    Require(failed.find("phase=decode") != std::string::npos, "the SOP1 failure was not classified at the decode stage");
+    Require(failed.find("offset=" + TraceField(attempt, "offset")) != std::string::npos, "the decode failure lost the packet offset");
+    Require(failed.find("unsupported SOP1 opcode 2") != std::string::npos, "the decode failure lost the shader-decoder reason");
+    Require(trace.find("draw-selected") == std::string::npos, "a pre-selection decode failure emitted draw-selected");
+    Require(trace.find("draw-shader-request-failed") == std::string::npos, "a pre-request decode failure emitted draw-shader-request-failed");
+    Require(trace.find("draw-recorded token=" + token) == std::string::npos, "a failed draw emitted draw-recorded");
+    Require(trace.find("tokens=[" + token + "]") == std::string::npos, "a failed draw token was attributed to a submitted batch");
+    const auto errorSerial = SubmissionSerialOf(trace, "draw-error");
+    Require(!errorSerial.empty(), "the draw-error record carries no submission serial");
+    Require(errorSerial == SubmissionSerialOf(trace, "draw-attempt"), "the draw-error record (submission " + errorSerial + ") does not correlate with the draw attempt");
+    Require(trace.find("draw-error submission=" + errorSerial + " offset=" + TraceField(attempt, "offset")) != std::string::npos, "the draw-error record lost the attempted packet offset");
+    Require(trace.find("unsupported SOP1 opcode 2") != std::string::npos, "the trace lost the shader-decoder reason");
+}
+
+void FailingShaderMaterializationRecordsTheDraw(const char* tracePath, bool correlationExpected = true) {
+    ColorBuffer color;
+    Registered(VertexHeader, RequestFailureVertexCode.data(), RequestFailureVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), RequestFailureVertexCode.data(), PixelCode.data());
+    std::string failure;
+    try {
+        AgcDriverWaitIdle_nid_postfix();
+        Require(false, "the failing shader request did not fail the submission");
+    } catch (const std::exception& error) {
+        failure = error.what();
+    }
+    Require(failure.find("unsupported dynamic s_setpc_b64") != std::string::npos, "the submission failure lost the original shader-request error: " + failure);
+    if (!correlationExpected) {
+        const auto trace = ReadTraceFile(tracePath);
+        Require(trace.find("draw-attempt") == std::string::npos, "correlation-disabled failure emitted draw-attempt");
+        Require(trace.find("draw-shader-request-failed") == std::string::npos, "correlation-disabled failure emitted draw-shader-request-failed");
+        Require(trace.find("draw-materialization-failed") == std::string::npos, "correlation-disabled failure emitted draw-materialization-failed");
+        Require(trace.find("draw-submission-failed") == std::string::npos, "correlation-disabled failure emitted draw-submission-failed");
+        Require(trace.find("draw-selected") == std::string::npos, "correlation-disabled failure emitted draw-selected");
+        Require(trace.find("draw-recorded") == std::string::npos, "correlation-disabled failure emitted draw-recorded");
+        return;
+    }
+    Require(WaitForTraceRecord(tracePath, "draw-shader-request-failed"), "the capture trace received no draw-shader-request-failed record");
+    const auto trace = ReadTraceFile(tracePath);
+    const auto attempt = TraceLine(trace, "draw-attempt ");
+    Require(!attempt.empty(), "the failed draw emitted no draw-attempt record");
+    const auto token = TraceField(attempt, "token");
+    Require(!token.empty() && token != "0", "the draw-attempt record carries no draw token");
+    const auto request = TraceLine(trace, "draw-shader-request-failed");
+    Require(!request.empty(), "the failed draw emitted no request-failure line");
+    Require(request.find("token=" + token) != std::string::npos, "the request failure lost the draw token");
+    Require(request.find("offset=" + TraceField(attempt, "offset")) != std::string::npos, "the request failure lost the packet offset");
+    const auto snapshot = TraceField(request, "snapshot");
+    Require(!snapshot.empty() && snapshot != "0x0", "the request failure carries no snapshot identity");
+    const auto selected = TraceLine(trace, "draw-selected token=" + token);
+    Require(!selected.empty(), "the failed draw emitted no draw-selected record for its token");
+    Require(selected.find("stage=1") != std::string::npos, "the first selected program is not the failing vertex stage");
+    Require(selected.find("snapshot=" + snapshot) != std::string::npos, "the request failure lost the selected snapshot identity");
+    Require(trace.find("draw-recorded token=" + token) == std::string::npos, "a failed draw emitted draw-recorded");
+    char codeAddress[19];
+    std::snprintf(codeAddress, sizeof(codeAddress), "%llx", static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(RequestFailureVertexCode.data())));
+    Require(request.find(std::string("code=") + codeAddress + " codeOffset=0 stage=1 type=2") != std::string::npos, "the draw-shader-request-failed record does not identify the failing vertex shader");
+    Require(trace.find("tokens=[" + token + "]") == std::string::npos, "a failed draw token was attributed to a submitted batch");
+    const auto requestSerial = SubmissionSerialOf(trace, "draw-shader-request-failed");
+    Require(!requestSerial.empty(), "the draw-shader-request-failed record carries no submission serial");
+    const auto errorSerial = SubmissionSerialOf(trace, "draw-error");
+    Require(requestSerial == errorSerial, "the draw-shader-request-failed record (submission " + requestSerial + ") does not correlate with the draw-error record (submission " + errorSerial + ")");
+    Require(trace.find("draw-error submission=" + requestSerial + " offset=" + TraceField(attempt, "offset")) != std::string::npos, "the draw-error record lost the attempted packet offset");
+    Require(trace.find("unsupported dynamic s_setpc_b64") != std::string::npos, "the draw-shader-request-failed record lost the shader-request reason");
+}
+
+void SuccessfulDrawEmitsNoFailureRecord(const char* tracePath) {
+    ColorBuffer color;
+    Registered(VertexHeader, ValidVertexCode.data(), ValidVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), ValidVertexCode.data(), PixelCode.data());
+    AgcDriverWaitIdle_nid_postfix();
+    Require(WaitForTraceRecord(tracePath, "draw submission="), "the capture trace received no draw submission record");
+    const auto trace = ReadTraceFile(tracePath);
+    const auto selected = TraceLine(trace, "draw-selected");
+    const auto attempt = TraceLine(trace, "draw-attempt");
+    Require(!selected.empty(), "the successful draw emitted no draw-selected record");
+    Require(!attempt.empty(), "the successful draw emitted no draw-attempt record");
+    const auto token = TraceField(selected, "token");
+    Require(!token.empty() && token != "0", "the successful selection record carries no draw token");
+    Require(attempt.find("token=" + token) != std::string::npos, "the successful draw-attempt record lost the draw token");
+    Require(WaitForTraceRecord(tracePath, "draw-recorded token=" + token), "the selected draw emitted no draw-recorded record");
+    const auto recorded = TraceLine(ReadTraceFile(tracePath), "draw-recorded token=" + token);
+    const auto batch = TraceField(recorded, "batch");
+    Require(!batch.empty() && batch != "0", "the draw-recorded record carries no actual batch serial");
+    Require(ReadTraceFile(tracePath).find("submit batch=" + batch + " ") != std::string::npos, "the recorded batch was not submitted");
+    const auto submit = TraceLine(ReadTraceFile(tracePath), "submit batch=" + batch + " ");
+    Require(submit == "submit batch=" + batch + " tokens=[" + token + "]", "the submit record lost the draw token set");
+    Require(ReadTraceFile(tracePath).find("submit-confirmed batch=" + batch + " tokens=[" + token + "]") != std::string::npos, "the confirmed submit record lost the draw token set");
+    Require(trace.find("draw-shader-request-failed") == std::string::npos, "a successful draw emitted a draw-shader-request-failed record");
+}
+
+void DisabledCorrelationTraceLeavesDrawBehaviorUnchanged(const char* tracePath) {
+    ColorBuffer color;
+    Registered(VertexHeader, ValidVertexCode.data(), ValidVertexCode.size() * sizeof(std::uint32_t), 2);
+    Registered(PixelHeader, PixelCode.data(), PixelCode.size() * sizeof(std::uint32_t), 1);
+    SubmitDraw(reinterpret_cast<std::uintptr_t>(color.data), ValidVertexCode.data(), PixelCode.data());
+    AgcDriverWaitIdle_nid_postfix();
+    Require(WaitForTraceRecord(tracePath, "draw submission="), "the disabled-trace draw did not complete");
+    const auto trace = ReadTraceFile(tracePath);
+    Require(trace.find("draw-attempt") == std::string::npos, "the disabled trace emitted draw-attempt");
+    Require(trace.find("draw-materialization-failed") == std::string::npos, "the disabled trace emitted draw-materialization-failed");
+    Require(trace.find("draw-submission-failed") == std::string::npos, "the disabled trace emitted draw-submission-failed");
+    Require(trace.find("draw-selected") == std::string::npos, "the disabled trace emitted draw-selected");
+    Require(trace.find("draw-recorded") == std::string::npos, "the disabled trace emitted draw-recorded");
+}
+
+}
+
+int main(int argc, char** argv) {
+    const std::string mode = argc > 1 ? argv[1] : "request-failure";
+    const bool expectFailure = mode != "successful-draw" && mode != "disabled-correlation";
+    const char* tracePath = std::getenv("APS5_CAPTURE_TRACE_PATH");
+    try {
+        if (!tracePath || tracePath[0] == '\0') throw std::runtime_error("this case requires a non-empty APS5_CAPTURE_TRACE_PATH");
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (mode == "request-failure") FailingShaderDecodeRecordsTheDraw(tracePath);
+        else if (mode == "request-failure-correlation-disabled") FailingShaderDecodeRecordsTheDraw(tracePath, false);
+        else if (mode == "materialization-failure") FailingShaderMaterializationRecordsTheDraw(tracePath);
+        else if (mode == "materialization-failure-correlation-disabled") FailingShaderMaterializationRecordsTheDraw(tracePath, false);
+        else if (mode == "successful-draw") SuccessfulDrawEmitsNoFailureRecord(tracePath);
+        else if (mode == "disabled-correlation") DisabledCorrelationTraceLeavesDrawBehaviorUnchanged(tracePath);
+        else throw std::runtime_error("unknown draw shader failure test mode: " + mode);
+        try {
+            AgcDriverShutdown_nid_postfix();
+            Require(!expectFailure, "the failed draw was not rethrown at driver shutdown");
+        } catch (const std::exception&) {
+            Require(expectFailure, "driver shutdown failed unexpectedly");
+        }
+        std::cout << "draw shader failure tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            AgcDriverShutdown_nid_postfix();
+        } catch (...) {
+        }
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DrawUnsupportedBufferType.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DrawUnsupportedBufferType.cpp
index c0a50d0476..61a0e679ee 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/DrawUnsupportedBufferType.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DrawUnsupportedBufferType.cpp
@@ -6,6 +6,7 @@
 #include <bit>
 #include <cstdint>
 #include <cstdio>
+#include <cstdlib>
 #include <exception>
 #include <initializer_list>
 #include <iostream>
@@ -92,6 +93,7 @@ void NamesShaderAndDescriptor() {
         Require(message.find("buffer descriptor uses an unsupported type") != std::string::npos, "draw failed for another reason: " + message);
         Require(message.find(shader) != std::string::npos, std::string("draw error does not name ") + shader + ": " + message);
         Require(message.find(words) != std::string::npos, std::string("draw error does not name ") + words + ": " + message);
+        if (std::getenv("APS5_DRAW_PIPELINE") != nullptr) Require(message.find("draw at submission ") != std::string::npos && message.find("(finished on the draw finisher)") != std::string::npos, "a draw finished on the draw finisher does not name its submission and offset: " + message);
         return;
     }
     throw std::runtime_error("a pixel shader read a buffer through a descriptor of type 2");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/EmptyIndirectSkip.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/EmptyIndirectSkip.cpp
new file mode 100644
index 0000000000..6a85e68f65
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/EmptyIndirectSkip.cpp
@@ -0,0 +1,162 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <exception>
+#include <initializer_list>
+#include <iostream>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::byte Kept{0x40};
+constexpr std::uint32_t BaseVertexLocation = 0x8c;
+
+alignas(256) constexpr std::array<std::uint32_t, 20> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060208u, 0x7e0802f2u, 0x7e0a02ffu, 0x44800000u, 0xf80000d1u, 0x00000005u, 0xf80008cfu, 0x04030201u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u,
+};
+alignas(256) constexpr std::array<std::uint32_t, 8> PixelCode{0x7e000200u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u, 0xbf810000u, 0xbf810000u};
+alignas(256) std::array<std::byte, 1024> FirstMemory{};
+alignas(256) std::array<std::byte, 1024> NoInstancesMemory{};
+alignas(256) std::array<std::byte, 1024> NoVerticesMemory{};
+alignas(256) std::array<std::byte, 1024> LastMemory{};
+alignas(256) std::array<std::uint32_t, 16> Records{3, 1, 0, 0, 3, 0, 0, 0, 0, 1, 0, 0, 3, 1, 0, 0};
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+std::vector<std::uint32_t> DrawFour() {
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(PixelCode.data());
+    const auto records = reinterpret_cast<std::uintptr_t>(Records.data());
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0x01200000}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x10f, std::bit_cast<std::uint32_t>(32.0f)}, {0x110, std::bit_cast<std::uint32_t>(32.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 1u << 1u},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 1u << 1u}, {0x00c, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    std::vector<std::uint32_t> commands;
+    Append(commands, 0x79, {0x242, 4});
+    Append(commands, 0x79, {0x24a, 0});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    Append(commands, 0x11, {1, static_cast<std::uint32_t>(records), static_cast<std::uint32_t>(records >> 32u)});
+    const auto draw = [&](std::array<std::byte, 1024>& memory, std::uint32_t recordOffset) {
+        const auto color = reinterpret_cast<std::uintptr_t>(memory.data());
+        Append(commands, 0x69, {0x318, static_cast<std::uint32_t>(color >> 8u)});
+        Append(commands, 0x69, {0x390, static_cast<std::uint32_t>(color >> 40u)});
+        Append(commands, 0x76, {BaseVertexLocation, 0});
+        Append(commands, 0x24, {recordOffset, BaseVertexLocation, 0, 2});
+    };
+    draw(FirstMemory, 0);
+    draw(NoInstancesMemory, 16);
+    draw(NoVerticesMemory, 32);
+    draw(LastMemory, 48);
+    return commands;
+}
+
+std::size_t Covered(const std::array<std::byte, 1024>& memory) {
+    return static_cast<std::size_t>(std::count_if(memory.begin(), memory.end(), [](std::byte value) { return value != Kept; }));
+}
+
+void EmptyIndirectDrawsSkipTheirStages() {
+    FirstMemory.fill(Kept);
+    NoInstancesMemory.fill(Kept);
+    NoVerticesMemory.fill(Kept);
+    LastMemory.fill(Kept);
+    Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+    Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+    auto commands = DrawFour();
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission failed");
+    AgcDriverWaitIdle_nid_postfix();
+    const auto first = Covered(FirstMemory);
+    Require(first != 0, "the first indirect draw, whose record draws 3 vertices, covered nothing");
+    Require(Covered(NoInstancesMemory) == 0, "the indirect draw whose record has no instances covered " + std::to_string(Covered(NoInstancesMemory)) + " bytes, expected none");
+    Require(Covered(NoVerticesMemory) == 0, "the indirect draw whose record has no vertices covered " + std::to_string(Covered(NoVerticesMemory)) + " bytes, expected none");
+    for (std::size_t index = 0; index < FirstMemory.size(); ++index) {
+        Require(LastMemory[index] == FirstMemory[index], "byte " + std::to_string(index) + " of the indirect draw after the empty ones is " + std::to_string(static_cast<unsigned>(LastMemory[index])) + ", the first indirect draw wrote " + std::to_string(static_cast<unsigned>(FirstMemory[index])));
+    }
+    const auto empty = AgcDriver::Graphics::EmptyIndirectDrawCount();
+    Require(empty == 2, std::to_string(empty) + " of the 2 indirect draws whose records draw nothing were skipped before their stages were built");
+    const auto counts = AgcDriver::Graphics::IndirectDrawCounts();
+    std::uint64_t cpu = 0;
+    for (std::size_t path = 1; path < counts.size(); ++path) cpu += counts[path];
+    Require(counts[0] == 0 && cpu == 2, "the drawing indirect draws took the GPU-side path " + std::to_string(counts[0]) + " times and the CPU path " + std::to_string(cpu) + " times, expected the CPU path twice");
+}
+
+}
+
+int main() {
+    try {
+#ifdef _WIN32
+        _putenv_s("APS5_PROFILE_DRAW", "1");
+#else
+        setenv("APS5_PROFILE_DRAW", "1", 1);
+#endif
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        EmptyIndirectDrawsSkipTheirStages();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("CPU-path indirect draws whose records draw nothing were skipped before their stages were built");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32AddMulDenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32AddMulDenormalModes.cpp
new file mode 100644
index 0000000000..7b5780067d
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32AddMulDenormalModes.cpp
@@ -0,0 +1,244 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 96;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t Results = 16;
+constexpr std::uint32_t Instructions = 7;
+constexpr std::uint32_t FirstMultiply = 3;
+constexpr std::uint32_t FirstConstantFactor = 5;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 20> Code{
+    0x34020084u, 0x34040086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x06140b04u, 0x08160b04u, 0x0a180b04u,
+    0x101a0b04u, 0x0e1c0b04u, 0x101e08ffu, 0x3fc00000u, 0xd5070010u, 0x0001ff04u, 0x3fc00000u, 0xe0781000u,
+    0x80010a02u, 0xe07c1010u, 0x80010e02u, 0xbf810000u,
+};
+
+constexpr const char* Names[Instructions] = {"v_add_f32", "v_sub_f32", "v_subrev_f32", "v_mul_f32", "v_mul_legacy_f32", "v_mul_f32 1.5", "v_mul_legacy_f32 1.5"};
+
+template <std::uint32_t Count>
+struct Vector {
+    std::uint32_t operands[2];
+    std::uint32_t outputsFlushed[Count];
+    std::uint32_t inputsFlushed[Count];
+};
+
+constexpr std::array<Vector<FirstMultiply + 2>, 40> ArithmeticVectors{{
+    {{0x00000000u, 0x00000001u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x00000001u, 0x00800002u}, {0x00800003u, 0x80800001u, 0x00800001u, 0x00000000u, 0x00000000u}, {0x00800002u, 0x80800002u, 0x00800002u, 0x00000000u, 0x00000000u}},
+    {{0x00000001u, 0x81000001u}, {0x81000000u, 0x01000002u, 0x81000002u, 0x80000000u, 0x80000000u}, {0x81000001u, 0x01000001u, 0x81000001u, 0x80000000u, 0x00000000u}},
+    {{0x00000002u, 0x3f800000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}},
+    {{0x00000002u, 0xff7fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0xb57fffffu, 0xb57fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x80000000u, 0x00000000u}},
+    {{0x00000003u, 0x80000001u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u}},
+    {{0x00400000u, 0x00000002u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x00400000u, 0x807fffffu}, {0x80000000u, 0x00bfffffu, 0x80bfffffu, 0x80000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u}},
+    {{0x007fffffu, 0x00800000u}, {0x00ffffffu, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00800000u, 0x80800000u, 0x00800000u, 0x00000000u, 0x00000000u}},
+    {{0x007fffffu, 0x80800002u}, {0x80000000u, 0x01000000u, 0x81000000u, 0x80000000u, 0x80000000u}, {0x80800002u, 0x00800002u, 0x80800002u, 0x80000000u, 0x00000000u}},
+    {{0x00800000u, 0x80000001u}, {0x00000000u, 0x00800001u, 0x80800001u, 0x80000000u, 0x80000000u}, {0x00800000u, 0x00800000u, 0x80800000u, 0x80000000u, 0x00000000u}},
+    {{0x00800001u, 0x33800000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x00000000u, 0x00000000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x00000001u, 0x00000001u}},
+    {{0x00800002u, 0x00800000u}, {0x01000001u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}, {0x01000001u, 0x00000002u, 0x80000002u, 0x00000000u, 0x00000000u}},
+    {{0x00ffffffu, 0x00000002u}, {0x01000000u, 0x00fffffdu, 0x80fffffdu, 0x00000000u, 0x00000000u}, {0x00ffffffu, 0x00ffffffu, 0x80ffffffu, 0x00000000u, 0x00000000u}},
+    {{0x00ffffffu, 0x80800002u}, {0x00000000u, 0x01400000u, 0x81400000u, 0x80000000u, 0x80000000u}, {0x007ffffdu, 0x01400000u, 0x81400000u, 0x80000000u, 0x80000000u}},
+    {{0x01000000u, 0x80000003u}, {0x00fffffdu, 0x01000002u, 0x81000002u, 0x80000000u, 0x80000000u}, {0x01000000u, 0x01000000u, 0x81000000u, 0x80000000u, 0x00000000u}},
+    {{0x01000001u, 0x80000001u}, {0x01000000u, 0x01000002u, 0x81000002u, 0x80000000u, 0x80000000u}, {0x01000001u, 0x01000001u, 0x81000001u, 0x80000000u, 0x00000000u}},
+    {{0x3f800000u, 0x807fffffu}, {0x3f800000u, 0x3f800000u, 0xbf800000u, 0x80000000u, 0x80000000u}, {0x3f800000u, 0x3f800000u, 0xbf800000u, 0x80000000u, 0x00000000u}},
+    {{0x34000000u, 0x00800001u}, {0x34000000u, 0x34000000u, 0xb4000000u, 0x00000000u, 0x00000000u}, {0x34000000u, 0x34000000u, 0xb4000000u, 0x00000001u, 0x00000001u}},
+    {{0x7f7fffffu, 0x00000003u}, {0x7f7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x35bfffffu, 0x35bfffffu}, {0x7f7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {{0x80000000u, 0x00000001u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x80000001u, 0x00800002u}, {0x00800001u, 0x80800003u, 0x00800003u, 0x80000000u, 0x80000000u}, {0x00800002u, 0x80800002u, 0x00800002u, 0x80000000u, 0x00000000u}},
+    {{0x80000001u, 0x80ffffffu}, {0x81000000u, 0x00fffffeu, 0x80fffffeu, 0x00000000u, 0x00000000u}, {0x80ffffffu, 0x00ffffffu, 0x80ffffffu, 0x00000000u, 0x00000000u}},
+    {{0x80000002u, 0x3f800000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x80000000u, 0x80000000u}, {0x3f800000u, 0xbf800000u, 0x3f800000u, 0x80000000u, 0x00000000u}},
+    {{0x80000002u, 0xff7fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x357fffffu, 0x357fffffu}, {0xff7fffffu, 0x7f7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {{0x80000003u, 0x7f800000u}, {0x7f800000u, 0xff800000u, 0x7f800000u, 0xff800000u, 0xff800000u}, {0x7f800000u, 0xff800000u, 0x7f800000u, 0xffc00000u, 0x00000000u}},
+    {{0x80400000u, 0x00000002u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u}, {0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u}},
+    {{0x80400000u, 0x80000003u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {{0x807fffffu, 0x00800000u}, {0x00000000u, 0x80ffffffu, 0x00ffffffu, 0x80000000u, 0x80000000u}, {0x00800000u, 0x80800000u, 0x00800000u, 0x80000000u, 0x00000000u}},
+    {{0x807fffffu, 0x80800001u}, {0x81000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}, {0x80800001u, 0x00800001u, 0x80800001u, 0x00000000u, 0x00000000u}},
+    {{0x80800000u, 0x80000001u}, {0x80800001u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80800000u, 0x80800000u, 0x00800000u, 0x00000000u, 0x00000000u}},
+    {{0x80800001u, 0x33800000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x80000000u, 0x80000000u}, {0x33800000u, 0xb3800000u, 0x33800000u, 0x80000001u, 0x80000001u}},
+    {{0x80800002u, 0x00800000u}, {0x80000000u, 0x81000001u, 0x01000001u, 0x80000000u, 0x80000000u}, {0x80000002u, 0x81000001u, 0x01000001u, 0x80000000u, 0x80000000u}},
+    {{0x80ffffffu, 0x00000002u}, {0x80fffffdu, 0x81000000u, 0x01000000u, 0x80000000u, 0x80000000u}, {0x80ffffffu, 0x80ffffffu, 0x00ffffffu, 0x80000000u, 0x00000000u}},
+    {{0x80ffffffu, 0x80800002u}, {0x81400000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x81400000u, 0x807ffffdu, 0x007ffffdu, 0x00000000u, 0x00000000u}},
+    {{0x81000000u, 0x80000003u}, {0x81000002u, 0x80fffffdu, 0x00fffffdu, 0x00000000u, 0x00000000u}, {0x81000000u, 0x81000000u, 0x01000000u, 0x00000000u, 0x00000000u}},
+    {{0x81000001u, 0x80000001u}, {0x81000002u, 0x81000000u, 0x01000000u, 0x00000000u, 0x00000000u}, {0x81000001u, 0x81000001u, 0x01000001u, 0x00000000u, 0x00000000u}},
+    {{0xbf800000u, 0x807fffffu}, {0xbf800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}, {0xbf800000u, 0xbf800000u, 0x3f800000u, 0x00000000u, 0x00000000u}},
+    {{0xb4000000u, 0x00000003u}, {0xb4000000u, 0xb4000000u, 0x34000000u, 0x80000000u, 0x80000000u}, {0xb4000000u, 0xb4000000u, 0x34000000u, 0x80000000u, 0x00000000u}},
+    {{0xff7fffffu, 0x00000003u}, {0xff7fffffu, 0xff7fffffu, 0x7f7fffffu, 0xb5bfffffu, 0xb5bfffffu}, {0xff7fffffu, 0xff7fffffu, 0x7f7fffffu, 0x80000000u, 0x00000000u}},
+}};
+
+constexpr std::array<Vector<2>, 24> TinyProductVectors{{
+    {{0x3f7ffffeu, 0x00800001u}, {0x00800000u, 0x00800000u}, {0x00800000u, 0x00800000u}},
+    {{0x3f7ffffeu, 0x80800001u}, {0x80800000u, 0x80800000u}, {0x80800000u, 0x80800000u}},
+    {{0xbf7ffffeu, 0x00800001u}, {0x80800000u, 0x80800000u}, {0x80800000u, 0x80800000u}},
+    {{0xbf7ffffeu, 0x80800001u}, {0x00800000u, 0x00800000u}, {0x00800000u, 0x00800000u}},
+    {{0x3f800001u, 0x007fffffu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f800001u, 0x807fffffu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800001u, 0x007fffffu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800001u, 0x807fffffu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f800002u, 0x007ffffeu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f800002u, 0x807ffffeu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800002u, 0x007ffffeu}, {0x80800000u, 0x80800000u}, {0x80000000u, 0x00000000u}},
+    {{0xbf800002u, 0x807ffffeu}, {0x00800000u, 0x00800000u}, {0x00000000u, 0x00000000u}},
+    {{0x3f7ffffeu, 0x00800000u}, {0x00000000u, 0x00000000u}, {0x007fffffu, 0x007fffffu}},
+    {{0xbf7fffffu, 0x00400000u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x3f800001u, 0x80000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0xbfffffffu, 0x00400000u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x3f400000u, 0x00800000u}, {0x00000000u, 0x00000000u}, {0x00600000u, 0x00600000u}},
+    {{0x40000000u, 0x807fffffu}, {0x80fffffeu, 0x80fffffeu}, {0x80000000u, 0x00000000u}},
+    {{0xcb000000u, 0x007ffffeu}, {0x8bfffffcu, 0x8bfffffcu}, {0x80000000u, 0x00000000u}},
+    {{0xcb7fffffu, 0x807ffffeu}, {0x0c7ffffbu, 0x0c7ffffbu}, {0x00000000u, 0x00000000u}},
+    {{0x5f800000u, 0x00400000u}, {0x20000000u, 0x20000000u}, {0x00000000u, 0x00000000u}},
+    {{0x7f000000u, 0x80400000u}, {0xbf800000u, 0xbf800000u}, {0x80000000u, 0x00000000u}},
+    {{0xb3800000u, 0x00ffffffu}, {0x80000000u, 0x80000000u}, {0x80000001u, 0x80000001u}},
+    {{0xb4000000u, 0x80800000u}, {0x00000000u, 0x00000000u}, {0x00000001u, 0x00000001u}},
+}};
+
+constexpr std::array<Vector<2>, 32> ConstantFactorVectors{{
+    {{0x00000001u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00000002u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00000003u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00155555u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x003fffffu, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00400000u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00400001u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x00555555u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x007ffffeu, 0x00000001u}, {0x00bffffdu, 0x00bffffdu}, {0x00000000u, 0x00000000u}},
+    {{0x007fffffu, 0x00000001u}, {0x00bffffeu, 0x00bffffeu}, {0x00000000u, 0x00000000u}},
+    {{0x00800000u, 0x00000001u}, {0x00c00000u, 0x00c00000u}, {0x00c00000u, 0x00c00000u}},
+    {{0x00800001u, 0x00000001u}, {0x00c00002u, 0x00c00002u}, {0x00c00002u, 0x00c00002u}},
+    {{0x00aaaaabu, 0x00000001u}, {0x01000000u, 0x01000000u}, {0x01000000u, 0x01000000u}},
+    {{0x00ffffffu, 0x00000001u}, {0x013fffffu, 0x013fffffu}, {0x013fffffu, 0x013fffffu}},
+    {{0x01000000u, 0x00000001u}, {0x01400000u, 0x01400000u}, {0x01400000u, 0x01400000u}},
+    {{0x3f800000u, 0x00000001u}, {0x3fc00000u, 0x3fc00000u}, {0x3fc00000u, 0x3fc00000u}},
+    {{0x00000000u, 0x00000001u}, {0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u}},
+    {{0x80000001u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80000002u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80000003u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80155555u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x803fffffu, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80400000u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80400001u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x80555555u, 0x00000001u}, {0x80000000u, 0x80000000u}, {0x80000000u, 0x00000000u}},
+    {{0x807ffffeu, 0x00000001u}, {0x80bffffdu, 0x80bffffdu}, {0x80000000u, 0x00000000u}},
+    {{0x807fffffu, 0x00000001u}, {0x80bffffeu, 0x80bffffeu}, {0x80000000u, 0x00000000u}},
+    {{0x80800000u, 0x00000001u}, {0x80c00000u, 0x80c00000u}, {0x80c00000u, 0x80c00000u}},
+    {{0x80800001u, 0x00000001u}, {0x80c00002u, 0x80c00002u}, {0x80c00002u, 0x80c00002u}},
+    {{0x80aaaaabu, 0x00000001u}, {0x81000000u, 0x81000000u}, {0x81000000u, 0x81000000u}},
+    {{0x80ffffffu, 0x00000001u}, {0x813fffffu, 0x813fffffu}, {0x813fffffu, 0x813fffffu}},
+    {{0x81000000u, 0x00000001u}, {0x81400000u, 0x81400000u}, {0x81400000u, 0x81400000u}},
+}};
+
+constexpr std::uint32_t FirstTinyProductLane = static_cast<std::uint32_t>(ArithmeticVectors.size());
+constexpr std::uint32_t FirstConstantFactorLane = FirstTinyProductLane + static_cast<std::uint32_t>(TinyProductVectors.size());
+static_assert(FirstConstantFactorLane + ConstantFactorVectors.size() <= Threads);
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+template <std::uint32_t Count, std::size_t Size>
+void Fill(const std::array<Vector<Count>, Size>& vectors, std::uint32_t firstLane) {
+    for (std::uint32_t row = 0; row < Size; ++row) {
+        Input[(firstLane + row) * Inputs] = vectors[row].operands[0];
+        Input[(firstLane + row) * Inputs + 1u] = vectors[row].operands[1];
+    }
+}
+
+bool Run(AgcDriver::VulkanDevice& device, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    Fill(ArithmeticVectors, 0u);
+    Fill(TinyProductVectors, FirstTinyProductLane);
+    Fill(ConstantFactorVectors, FirstConstantFactorLane);
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    std::optional<decltype(ShaderRecompiler::Recompile(request))> result;
+    try {
+        result.emplace(ShaderRecompiler::Recompile(request));
+    } catch (const std::exception& error) {
+        const std::string message = error.what();
+        const bool keepsDenormals = request.target.float32DenormPreserve && !request.target.float32FlushToZero;
+        Require(!keepsDenormals && message.find("needs DenormPreserve 32") != std::string::npos, "f32 add and multiply FLOAT_MODE " + Hex(floatMode.floatMode) + ": " + message);
+        return false;
+    }
+    device.Dispatch(*result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return true;
+}
+
+template <std::uint32_t Count, std::size_t Size>
+void Check(const std::array<Vector<Count>, Size>& vectors, std::uint32_t firstLane, std::uint32_t firstInstruction, std::uint32_t denormals, bool ieee) {
+    for (std::uint32_t row = 0; row < Size; ++row) {
+        const auto& vector = vectors[row];
+        for (std::uint32_t index = 0; index < Count; ++index) {
+            const std::uint32_t instruction = firstInstruction + index;
+            const auto actual = Output[(firstLane + row) * Results + instruction];
+            const auto expected = denormals == 1u ? vector.outputsFlushed[index] : vector.inputsFlushed[index];
+            Require(actual == expected, std::string(Names[instruction]) + " f32 denormal mode " + std::to_string(denormals) + (ieee ? ", IEEE=1" : ", IEEE=0") + " of " +
+                                            Hex(vector.operands[0]) + ", " + Hex(vector.operands[1]) + " is " + Hex(actual) + ", expected " + Hex(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        std::uint32_t checked = 0u;
+        for (const std::uint32_t denormals : {1u, 2u}) {
+            for (const bool ieee : {false, true}) {
+                if (!Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u, true, ieee, false})) continue;
+                ++checked;
+                Check(ArithmeticVectors, 0u, 0u, denormals, ieee);
+                Check(TinyProductVectors, FirstTinyProductLane, FirstMultiply, denormals, ieee);
+                Check(ConstantFactorVectors, FirstConstantFactorLane, FirstConstantFactor, denormals, ieee);
+            }
+        }
+        std::printf("f32 add and multiply denormal mode 1 and 2 tests passed (%u of 4 modes run; the others need DenormPreserve 32)\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32ArithmeticNan.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32ArithmeticNan.cpp
index c78f91002f..a4b48e2c5e 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/F32ArithmeticNan.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32ArithmeticNan.cpp
@@ -23,6 +23,7 @@ constexpr std::uint32_t Inputs = 4;
 constexpr std::uint32_t Results = 16;
 alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
 alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+bool FusedExactArithmetic = false;
 
 alignas(256) constexpr std::array<std::uint32_t, 57> Code{
     0x34020084u, 0x34060086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x7e140280u, 0x7e160280u, 0x7e180280u,
@@ -172,7 +173,7 @@ std::string Hex(std::uint32_t value) {
 }
 
 void Expect(std::uint32_t tid, std::uint32_t actual, std::uint32_t expected, const char* name) {
-    Require(actual == expected, std::string("f32 arithmetic nan: lane ") + std::to_string(tid) + " " + name + " is " + Hex(actual) + ", expected " + Hex(expected));
+    Require(actual == expected, std::string("f32 arithmetic nan: ") + (FusedExactArithmetic ? "fused " : "") + "lane " + std::to_string(tid) + " " + name + " is " + Hex(actual) + ", expected " + Hex(expected));
 }
 
 bool IsNan32(std::uint32_t value) {
@@ -202,6 +203,7 @@ void Run(AgcDriver::VulkanDevice& device, const std::optional<ShaderRecompiler::
     };
     request.useCache = false;
     request.context.floatMode = floatMode;
+    request.target.fusedExactArithmetic = FusedExactArithmetic;
     const auto result = ShaderRecompiler::Recompile(request);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
@@ -223,12 +225,16 @@ int main() {
     try {
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
-        Run(*device, std::nullopt);
-        Check(ExpectedNoIeee, "no float mode");
-        Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u, true, false, false});
-        Check(ExpectedNoIeee, "IEEE=0");
-        Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u, true, true, false});
-        Check(ExpectedIeee, "IEEE=1");
+        for (const bool fused : {false, true}) {
+            if (!fused && device->Target().fusedExactArithmetic) continue;
+            FusedExactArithmetic = fused;
+            Run(*device, std::nullopt);
+            Check(ExpectedNoIeee, "no float mode");
+            Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u, true, false, false});
+            Check(ExpectedNoIeee, "IEEE=0");
+            Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u, true, true, false});
+            Check(ExpectedIeee, "IEEE=1");
+        }
         std::puts("f32 arithmetic nan tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp
index 19beb4db4c..bb4aa369e0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp
@@ -382,8 +382,10 @@ std::string Hex(std::uint32_t value) {
     return text;
 }
 
+bool FusedExactArithmetic = false;
+
 void Expect(std::uint32_t tid, std::uint32_t actual, std::uint32_t expected, const char* name) {
-    Require(actual == expected, std::string("f32 denormal flush: lane ") + std::to_string(tid) + " " + name + " is " + Hex(actual) + ", expected " + Hex(expected));
+    Require(actual == expected, std::string("f32 denormal flush: ") + (FusedExactArithmetic ? "fused " : "") + "lane " + std::to_string(tid) + " " + name + " is " + Hex(actual) + ", expected " + Hex(expected));
 }
 
 bool IsNan(std::uint32_t value) {
@@ -434,6 +436,7 @@ void Run(AgcDriver::VulkanDevice& device, const std::optional<ShaderRecompiler::
     request.useCache = false;
     request.context.floatMode = floatMode;
     request.target.float32FlushToZero = HardwareFlush;
+    request.target.fusedExactArithmetic = FusedExactArithmetic;
     const auto result = ShaderRecompiler::Recompile(request);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
@@ -451,7 +454,7 @@ void Check(const char* mode) {
             if (hostSplits && tid == TinyProductLane && (i == 4u || i == 5u)) continue;
             const bool floatResult = i < 12u || i >= 15u;
             if (floatResult && IsNan(Expected[tid][i])) {
-                Require(IsNan(out[i]), std::string("f32 denormal flush: lane ") + std::to_string(tid) + " " + mode + " " + Names[i] + " is " + Hex(out[i]) + ", expected a NaN");
+                Require(IsNan(out[i]), std::string("f32 denormal flush: ") + (FusedExactArithmetic ? "fused " : "") + "lane " + std::to_string(tid) + " " + mode + " " + Names[i] + " is " + Hex(out[i]) + ", expected a NaN");
                 continue;
             }
             Expect(tid, out[i], Expected[tid][i], (std::string(mode) + " " + Names[i]).c_str());
@@ -516,9 +519,12 @@ int main() {
             Require(!softwareDeclares && hardwareDeclares == declared, declared ? "f32 denormal flush: only the hardware-flush module declares DenormFlushToZero 32" : "f32 denormal flush: a module flushed natively declares DenormFlushToZero 32 without the device capability");
             Require(hardwareWords < software, "f32 denormal flush: the hardware-flush module is " + std::to_string(hardwareWords) + " words, the emulated one " + std::to_string(software));
         }
-        for (const bool flush : {false, true}) {
+        for (const std::uint32_t variant : {0u, 1u, 2u, 3u}) {
+            const bool flush = (variant & 1u) != 0u;
             if (flush && !hardware) continue;
+            if ((variant & 2u) == 0u && device->Target().fusedExactArithmetic) continue;
             HardwareFlush = flush;
+            FusedExactArithmetic = (variant & 2u) != 0u;
             Run(*device, std::nullopt);
             Check("no float mode");
             Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u, true, false, false});
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32MinMaxDenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32MinMaxDenormalModes.cpp
new file mode 100644
index 0000000000..a9d0238d0b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32MinMaxDenormalModes.cpp
@@ -0,0 +1,181 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t Results = 16;
+constexpr std::uint32_t Instructions = 5;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 18> Code{
+    0x34020084u, 0x34040086u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x1e140b04u, 0x20160b04u, 0xd551000cu,
+    0x041a0b04u, 0xd554000du, 0x041a0b04u, 0xd557000eu, 0x041a0b04u, 0xe0781000u, 0x80010a02u, 0xe0701010u,
+    0x80010e02u, 0xbf810000u,
+};
+
+constexpr const char* Names[Instructions] = {"v_min_f32", "v_max_f32", "v_min3_f32", "v_max3_f32", "v_med3_f32"};
+
+struct MinMaxVector {
+    std::uint32_t operands[3];
+    std::uint32_t inputsKept[Instructions];
+    std::uint32_t inputsFlushed[Instructions];
+};
+
+constexpr std::array<MinMaxVector, 56> Vectors{{
+    {0x00000000u, 0x00000000u, 0x00000001u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000001u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {0x00000000u, 0x80000001u, 0x80000000u, {0x80000001u, 0x00000000u, 0x80000001u, 0x00000000u, 0x80000000u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x00000000u, 0x007fffffu, 0x7f800000u, {0x00000000u, 0x007fffffu, 0x00000000u, 0x7f800000u, 0x007fffffu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x7f800000u, 0x00000000u}},
+    {0x00000000u, 0x80800000u, 0x807fffffu, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x807fffffu}, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x80000000u}},
+    {0x80000000u, 0x80000000u, 0x00000001u, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000001u, 0x80000000u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x80000000u, 0x80000001u, 0x807fffffu, {0x80000001u, 0x80000000u, 0x807fffffu, 0x80000000u, 0x80000001u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u}},
+    {0x80000000u, 0x807fffffu, 0x00000001u, {0x807fffffu, 0x80000000u, 0x807fffffu, 0x00000001u, 0x80000000u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x80000000u, 0x3f800000u, 0x807fffffu, {0x80000000u, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x80000000u}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x00000001u, 0x00000000u, 0x3f800000u, {0x00000000u, 0x00000001u, 0x00000000u, 0x3f800000u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x3f800000u, 0x00000000u}},
+    {0x00000001u, 0x00000001u, 0x807fffffu, {0x00000001u, 0x00000001u, 0x807fffffu, 0x00000001u, 0x00000001u}, {0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}},
+    {0x00000001u, 0x007fffffu, 0x00000001u, {0x00000001u, 0x007fffffu, 0x00000001u, 0x007fffffu, 0x00000001u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}},
+    {0x00000001u, 0x807fffffu, 0xff800000u, {0x807fffffu, 0x00000001u, 0xff800000u, 0x00000001u, 0x807fffffu}, {0x80000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000000u}},
+    {0x00000001u, 0x80800000u, 0x3f800000u, {0x80800000u, 0x00000001u, 0x80800000u, 0x3f800000u, 0x00000001u}, {0x80800000u, 0x00000000u, 0x80800000u, 0x3f800000u, 0x00000000u}},
+    {0x00000001u, 0xbf800000u, 0x807fffffu, {0xbf800000u, 0x00000001u, 0xbf800000u, 0x00000001u, 0x807fffffu}, {0xbf800000u, 0x00000000u, 0xbf800000u, 0x00000000u, 0x80000000u}},
+    {0x00000001u, 0xff800000u, 0x00000001u, {0xff800000u, 0x00000001u, 0xff800000u, 0x00000001u, 0x00000001u}, {0xff800000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x00000000u}},
+    {0x80000001u, 0x00000000u, 0xff800000u, {0x80000001u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000001u}, {0x80000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000000u}},
+    {0x80000001u, 0x00000001u, 0x3f800000u, {0x80000001u, 0x00000001u, 0x80000001u, 0x3f800000u, 0x00000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x3f800000u, 0x00000000u}},
+    {0x80000001u, 0x007fffffu, 0x807fffffu, {0x80000001u, 0x007fffffu, 0x807fffffu, 0x007fffffu, 0x80000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x80000001u, 0x00800000u, 0x00000001u, {0x80000001u, 0x00800000u, 0x80000001u, 0x00800000u, 0x00000001u}, {0x80000000u, 0x00800000u, 0x80000000u, 0x00800000u, 0x00000000u}},
+    {0x80000001u, 0x80800000u, 0xff800000u, {0x80800000u, 0x80000001u, 0xff800000u, 0x80000001u, 0x80800000u}, {0x80800000u, 0x80000000u, 0xff800000u, 0x80000000u, 0x80800000u}},
+    {0x80000001u, 0xbf800000u, 0x3f800000u, {0xbf800000u, 0x80000001u, 0xbf800000u, 0x3f800000u, 0x80000001u}, {0xbf800000u, 0x80000000u, 0xbf800000u, 0x3f800000u, 0x80000000u}},
+    {0x80000001u, 0xff800000u, 0x807fffffu, {0xff800000u, 0x80000001u, 0xff800000u, 0x80000001u, 0x807fffffu}, {0xff800000u, 0x80000000u, 0xff800000u, 0x80000000u, 0x80000000u}},
+    {0x007fffffu, 0x80000000u, 0x00000001u, {0x80000000u, 0x007fffffu, 0x80000000u, 0x007fffffu, 0x00000001u}, {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u}},
+    {0x007fffffu, 0x00000001u, 0xff800000u, {0x00000001u, 0x007fffffu, 0xff800000u, 0x007fffffu, 0x00000001u}, {0x00000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x00000000u}},
+    {0x007fffffu, 0x007fffffu, 0x3f800000u, {0x007fffffu, 0x007fffffu, 0x007fffffu, 0x3f800000u, 0x007fffffu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x3f800000u, 0x00000000u}},
+    {0x007fffffu, 0x00800000u, 0x807fffffu, {0x007fffffu, 0x00800000u, 0x807fffffu, 0x00800000u, 0x007fffffu}, {0x00000000u, 0x00800000u, 0x80000000u, 0x00800000u, 0x00000000u}},
+    {0x007fffffu, 0x3f800000u, 0x00000001u, {0x007fffffu, 0x3f800000u, 0x00000001u, 0x3f800000u, 0x007fffffu}, {0x00000000u, 0x3f800000u, 0x00000000u, 0x3f800000u, 0x00000000u}},
+    {0x007fffffu, 0xbf800000u, 0xff800000u, {0xbf800000u, 0x007fffffu, 0xff800000u, 0x007fffffu, 0xbf800000u}, {0xbf800000u, 0x00000000u, 0xff800000u, 0x00000000u, 0xbf800000u}},
+    {0x007fffffu, 0xff800000u, 0x3f800000u, {0xff800000u, 0x007fffffu, 0xff800000u, 0x3f800000u, 0x007fffffu}, {0xff800000u, 0x00000000u, 0xff800000u, 0x3f800000u, 0x00000000u}},
+    {0x807fffffu, 0x80000000u, 0x807fffffu, {0x807fffffu, 0x80000000u, 0x807fffffu, 0x80000000u, 0x807fffffu}, {0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u, 0x80000000u}},
+    {0x807fffffu, 0x80000001u, 0x00000001u, {0x807fffffu, 0x80000001u, 0x807fffffu, 0x00000001u, 0x80000001u}, {0x80000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}},
+    {0x807fffffu, 0x007fffffu, 0xff800000u, {0x807fffffu, 0x007fffffu, 0xff800000u, 0x007fffffu, 0x807fffffu}, {0x80000000u, 0x00000000u, 0xff800000u, 0x00000000u, 0x80000000u}},
+    {0x807fffffu, 0x00800000u, 0x3f800000u, {0x807fffffu, 0x00800000u, 0x807fffffu, 0x3f800000u, 0x00800000u}, {0x80000000u, 0x00800000u, 0x80000000u, 0x3f800000u, 0x00800000u}},
+    {0x807fffffu, 0x3f800000u, 0x807fffffu, {0x807fffffu, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x807fffffu}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x807fffffu, 0x7f800000u, 0x00000001u, {0x807fffffu, 0x7f800000u, 0x807fffffu, 0x7f800000u, 0x00000001u}, {0x80000000u, 0x7f800000u, 0x80000000u, 0x7f800000u, 0x00000000u}},
+    {0x807fffffu, 0xff800000u, 0xff800000u, {0xff800000u, 0x807fffffu, 0xff800000u, 0x807fffffu, 0xff800000u}, {0xff800000u, 0x80000000u, 0xff800000u, 0x80000000u, 0xff800000u}},
+    {0x00800000u, 0x80000001u, 0x00000000u, {0x80000001u, 0x00800000u, 0x80000001u, 0x00800000u, 0x00000000u}, {0x80000000u, 0x00800000u, 0x80000000u, 0x00800000u, 0x00000000u}},
+    {0x00800000u, 0x007fffffu, 0xbf800000u, {0x007fffffu, 0x00800000u, 0xbf800000u, 0x00800000u, 0x007fffffu}, {0x00000000u, 0x00800000u, 0xbf800000u, 0x00800000u, 0x00000000u}},
+    {0x00800000u, 0x80800000u, 0x007fffffu, {0x80800000u, 0x00800000u, 0x80800000u, 0x00800000u, 0x007fffffu}, {0x80800000u, 0x00800000u, 0x80800000u, 0x00800000u, 0x00000000u}},
+    {0x80800000u, 0x00000000u, 0x807fffffu, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x807fffffu}, {0x80800000u, 0x00000000u, 0x80800000u, 0x00000000u, 0x80000000u}},
+    {0x80800000u, 0x80000001u, 0x007fffffu, {0x80800000u, 0x80000001u, 0x80800000u, 0x007fffffu, 0x80000001u}, {0x80800000u, 0x80000000u, 0x80800000u, 0x00000000u, 0x80000000u}},
+    {0x80800000u, 0x807fffffu, 0x80000000u, {0x80800000u, 0x807fffffu, 0x80800000u, 0x80000000u, 0x807fffffu}, {0x80800000u, 0x80000000u, 0x80800000u, 0x80000000u, 0x80000000u}},
+    {0x80800000u, 0x3f800000u, 0x007fffffu, {0x80800000u, 0x3f800000u, 0x80800000u, 0x3f800000u, 0x007fffffu}, {0x80800000u, 0x3f800000u, 0x80800000u, 0x3f800000u, 0x00000000u}},
+    {0x3f800000u, 0x80000000u, 0x807fffffu, {0x80000000u, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x80000000u}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x3f800000u, 0x80000001u, 0x3f800000u, {0x80000001u, 0x3f800000u, 0x80000001u, 0x3f800000u, 0x3f800000u}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x3f800000u}},
+    {0x3f800000u, 0x807fffffu, 0x807fffffu, {0x807fffffu, 0x3f800000u, 0x807fffffu, 0x3f800000u, 0x807fffffu}, {0x80000000u, 0x3f800000u, 0x80000000u, 0x3f800000u, 0x80000000u}},
+    {0x3f800000u, 0xbf800000u, 0x007fffffu, {0xbf800000u, 0x3f800000u, 0xbf800000u, 0x3f800000u, 0x007fffffu}, {0xbf800000u, 0x3f800000u, 0xbf800000u, 0x3f800000u, 0x00000000u}},
+    {0xbf800000u, 0x00000001u, 0x80000001u, {0xbf800000u, 0x00000001u, 0xbf800000u, 0x00000001u, 0x80000001u}, {0xbf800000u, 0x00000000u, 0xbf800000u, 0x00000000u, 0x80000000u}},
+    {0xbf800000u, 0x007fffffu, 0x00000000u, {0xbf800000u, 0x007fffffu, 0xbf800000u, 0x007fffffu, 0x00000000u}, {0xbf800000u, 0x00000000u, 0xbf800000u, 0x00000000u, 0x00000000u}},
+    {0xbf800000u, 0x807fffffu, 0xbf800000u, {0xbf800000u, 0x807fffffu, 0xbf800000u, 0x807fffffu, 0xbf800000u}, {0xbf800000u, 0x80000000u, 0xbf800000u, 0x80000000u, 0xbf800000u}},
+    {0xbf800000u, 0x7f800000u, 0x007fffffu, {0xbf800000u, 0x7f800000u, 0xbf800000u, 0x7f800000u, 0x007fffffu}, {0xbf800000u, 0x7f800000u, 0xbf800000u, 0x7f800000u, 0x00000000u}},
+    {0x7f800000u, 0x00000001u, 0x80800000u, {0x00000001u, 0x7f800000u, 0x80800000u, 0x7f800000u, 0x00000001u}, {0x00000000u, 0x7f800000u, 0x80800000u, 0x7f800000u, 0x00000000u}},
+    {0x7f800000u, 0x007fffffu, 0x007fffffu, {0x007fffffu, 0x7f800000u, 0x007fffffu, 0x7f800000u, 0x007fffffu}, {0x00000000u, 0x7f800000u, 0x00000000u, 0x7f800000u, 0x00000000u}},
+    {0x7f800000u, 0x00800000u, 0x80000001u, {0x00800000u, 0x7f800000u, 0x80000001u, 0x7f800000u, 0x00800000u}, {0x00800000u, 0x7f800000u, 0x80000000u, 0x7f800000u, 0x00800000u}},
+    {0x7f800000u, 0xff800000u, 0x007fffffu, {0xff800000u, 0x7f800000u, 0xff800000u, 0x7f800000u, 0x007fffffu}, {0xff800000u, 0x7f800000u, 0xff800000u, 0x7f800000u, 0x00000000u}},
+    {0xff800000u, 0x00000001u, 0xff800000u, {0xff800000u, 0x00000001u, 0xff800000u, 0x00000001u, 0xff800000u}, {0xff800000u, 0x00000000u, 0xff800000u, 0x00000000u, 0xff800000u}},
+}};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+bool Run(AgcDriver::VulkanDevice& device, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        std::copy(std::begin(Vectors[lane].operands), std::end(Vectors[lane].operands), Input.begin() + lane * Inputs);
+    }
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    std::optional<decltype(ShaderRecompiler::Recompile(request))> result;
+    try {
+        result.emplace(ShaderRecompiler::Recompile(request));
+    } catch (const std::exception& error) {
+        const std::string message = error.what();
+        const bool keepsDenormals = request.target.float32DenormPreserve && !request.target.float32FlushToZero;
+        Require(!keepsDenormals && ((floatMode.floatMode >> 4u) & 3u) == 1u && message.find("needs DenormPreserve 32") != std::string::npos,
+                "f32 min/max FLOAT_MODE " + Hex(floatMode.floatMode) + ": " + message);
+        return false;
+    }
+    device.Dispatch(*result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return true;
+}
+
+void Check(std::uint32_t denormals, bool ieee) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        const auto& vector = Vectors[lane];
+        for (std::uint32_t instruction = 0; instruction < Instructions; ++instruction) {
+            const auto actual = Output[lane * Results + instruction];
+            const auto expected = denormals == 1u ? vector.inputsKept[instruction] : vector.inputsFlushed[instruction];
+            Require(actual == expected, std::string(Names[instruction]) + " f32 denormal mode " + std::to_string(denormals) + (ieee ? ", IEEE=1" : ", IEEE=0") + " of " +
+                                            Hex(vector.operands[0]) + ", " + Hex(vector.operands[1]) + ", " + Hex(vector.operands[2]) + " is " + Hex(actual) +
+                                            ", expected " + Hex(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        std::uint32_t checked = 0u;
+        for (const std::uint32_t denormals : {1u, 2u}) {
+            for (const bool ieee : {false, true}) {
+                if (!Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u | denormals << 4u, true, ieee, false})) continue;
+                ++checked;
+                Check(denormals, ieee);
+            }
+        }
+        std::printf("f32 min/max denormal mode 1 and 2 tests passed (%u of 4 modes run; mode 1 needs DenormPreserve 32)\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/F32SeparateRounding.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/F32SeparateRounding.cpp
new file mode 100644
index 0000000000..3556b0538b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/F32SeparateRounding.cpp
@@ -0,0 +1,177 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t Results = 8;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results> Output{};
+bool FusedExactArithmetic = false;
+
+alignas(256) constexpr std::array<std::uint32_t, 18> Code{
+    0x34020084u, 0x34060085u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x10140b04u, 0x06160d0au, 0x08180d0au,
+    0x0a1a0d0au, 0x061c1506u, 0x081e1506u, 0x06200d04u, 0x10220b10u, 0xe0781000u, 0x80010a03u, 0xe0781010u,
+    0x80010e03u, 0xbf810000u,
+};
+
+constexpr std::uint32_t Rows[32][4] = {
+    {0x3f800800u, 0x3f800c00u, 0xbf801401u, 0x00000000u},
+    {0x3f801800u, 0x3f801400u, 0xbf802c04u, 0x00000000u},
+    {0x3f802800u, 0x3f801c00u, 0xbf804409u, 0x00000000u},
+    {0x3f803800u, 0x3f802400u, 0xbf805c10u, 0x00000000u},
+    {0x3f804800u, 0x3f802c00u, 0xbf807419u, 0x00000000u},
+    {0x3f805800u, 0x3f803400u, 0xbf808c24u, 0x00000000u},
+    {0x3f806800u, 0x3f803c00u, 0xbf80a431u, 0x00000000u},
+    {0x3f807800u, 0x3f804400u, 0xbf80bc40u, 0x00000000u},
+    {0x3f808800u, 0x3f804c00u, 0xbf80d451u, 0x00000000u},
+    {0x3f809800u, 0x3f805400u, 0xbf80ec64u, 0x00000000u},
+    {0x3f80a800u, 0x3f805c00u, 0xbf810479u, 0x00000000u},
+    {0x3f80b800u, 0x3f806400u, 0xbf811c90u, 0x00000000u},
+    {0x3d801000u, 0xc1001800u, 0x3f002804u, 0x00000000u},
+    {0x3e005000u, 0xc0803800u, 0x3f008822u, 0x00000000u},
+    {0x3e809000u, 0xc0005800u, 0x3f00e864u, 0x00000000u},
+    {0x3f00d000u, 0xbf807800u, 0x3f0148c2u, 0x00000000u},
+    {0x3f811000u, 0xbf009800u, 0x3f01a944u, 0x00000000u},
+    {0x40015000u, 0xbe80b800u, 0x3f0209e2u, 0x00000000u},
+    {0x40819000u, 0xbe00d800u, 0x3f026aa4u, 0x00000000u},
+    {0x4101d000u, 0xbd80f800u, 0x3f02cb82u, 0x00000000u},
+    {0x40400000u, 0x3eaaaaabu, 0xbf800000u, 0x00000000u},
+    {0x40540000u, 0x3eabaaabu, 0xc0000000u, 0x00000000u},
+    {0x40680000u, 0x3eacaaabu, 0xc0400000u, 0x00000000u},
+    {0x407c0000u, 0x3eadaaabu, 0xc0800000u, 0x00000000u},
+    {0x40880000u, 0x3eaeaaabu, 0xc0a00000u, 0x00000000u},
+    {0x40920000u, 0x3eafaaabu, 0xc0c00000u, 0x00000000u},
+    {0x00000000u, 0xbf800000u, 0x00000000u, 0x00000000u},
+    {0x80000000u, 0x3f800000u, 0x80000000u, 0x00000000u},
+    {0x3f800000u, 0x3f800000u, 0xbf800000u, 0x00000000u},
+    {0x4e800001u, 0x4e7ffffeu, 0xdd800000u, 0x00000000u},
+    {0x3f800001u, 0x3f7fffffu, 0xbf800000u, 0x00000000u},
+    {0xbfc00000u, 0x35800000u, 0x35000000u, 0x00000000u},
+};
+constexpr std::uint32_t Expected[32][8] = {
+    {0x3f801401u, 0x00000000u, 0x40001401u, 0xc0001401u, 0x00000000u, 0xc0001401u, 0xb9c01000u, 0xb9c02202u},
+    {0x3f802c04u, 0x00000000u, 0x40002c04u, 0xc0002c04u, 0x00000000u, 0xc0002c04u, 0xba202000u, 0xba203905u},
+    {0x3f804409u, 0x00000000u, 0x40004409u, 0xc0004409u, 0x00000000u, 0xc0004409u, 0xba604800u, 0xba607910u},
+    {0x3f805c10u, 0x00000000u, 0x40005c10u, 0xc0005c10u, 0x00000000u, 0xc0005c10u, 0xba904000u, 0xba906892u},
+    {0x3f807419u, 0x00000000u, 0x40007419u, 0xc0007419u, 0x00000000u, 0xc0007419u, 0xbab06400u, 0xbab0a0a2u},
+    {0x3f808c24u, 0x00000000u, 0x40008c24u, 0xc0008c24u, 0x00000000u, 0xc0008c24u, 0xbad09000u, 0xbad0e4bau},
+    {0x3f80a431u, 0x00000000u, 0x4000a431u, 0xc000a431u, 0x00000000u, 0xc000a431u, 0xbaf0c400u, 0xbaf134dcu},
+    {0x3f80bc40u, 0x00000000u, 0x4000bc40u, 0xc000bc40u, 0x00000000u, 0xc000bc40u, 0xbb088000u, 0xbb08c884u},
+    {0x3f80d451u, 0x00000000u, 0x4000d451u, 0xc000d451u, 0x00000000u, 0xc000d451u, 0xbb18a200u, 0xbb18fca0u},
+    {0x3f80ec64u, 0x00000000u, 0x4000ec64u, 0xc000ec64u, 0x00000000u, 0xc000ec64u, 0xbb28c800u, 0xbb2936c3u},
+    {0x3f810479u, 0x00000000u, 0x40010479u, 0xc0010479u, 0x00000000u, 0xc0010479u, 0xbb38f200u, 0xbb3976eeu},
+    {0x3f811c90u, 0x00000000u, 0x40011c90u, 0xc0011c90u, 0x00000000u, 0xc0011c90u, 0xbb492000u, 0xbb49bd21u},
+    {0xbf002803u, 0x33800000u, 0xbf802804u, 0x3f802804u, 0x33800000u, 0x3f802804u, 0x3f102a04u, 0xc090450cu},
+    {0xbf008823u, 0xb3800000u, 0xbf808822u, 0x3f808822u, 0xb3800000u, 0x3f808822u, 0x3f209c22u, 0xc020e266u},
+    {0xbf00e863u, 0x33800000u, 0xbf80e864u, 0x3f80e864u, 0x33800000u, 0x3f80e864u, 0x3f413064u, 0xbfc1b535u},
+    {0xbf0148c3u, 0xb3800000u, 0xbf8148c2u, 0x3f8148c2u, 0xb3800000u, 0x3f8148c2u, 0x3f810c61u, 0xbf81855du},
+    {0xbf01a943u, 0x33800000u, 0xbf81a944u, 0x3f81a944u, 0x33800000u, 0x3f81a944u, 0x3fc1e4a2u, 0xbf42cae2u},
+    {0xbf0209e3u, 0xb3800000u, 0xbf8209e2u, 0x3f8209e2u, 0xb3800000u, 0x3f8209e2u, 0x4021d278u, 0xbf22bb17u},
+    {0xbf026aa3u, 0x33800000u, 0xbf826aa4u, 0x3f826aa4u, 0x33800000u, 0x3f826aa4u, 0x4091dd54u, 0xbf12d379u},
+    {0xbf02cb83u, 0xb3800000u, 0xbf82cb82u, 0x3f82cb82u, 0xb3800000u, 0x3f82cb82u, 0x4109fcb8u, 0xbf0b0812u},
+    {0x3f800000u, 0x00000000u, 0x40000000u, 0xc0000000u, 0x00000000u, 0xc0000000u, 0x40000000u, 0x3f2aaaabu},
+    {0x3f8e2956u, 0xbf63ad54u, 0x404714abu, 0xc04714abu, 0xbf63ad54u, 0xc04714abu, 0x3fa80000u, 0x3ee15000u},
+    {0x3f9c7aabu, 0xbfe38555u, 0x40871eabu, 0xc0871eabu, 0xbfe38555u, 0xc0871eabu, 0x3f200000u, 0x3e57d556u},
+    {0x3faaf400u, 0xc02a8600u, 0x40aabd00u, 0xc0aabd00u, 0xc02a8600u, 0xc0aabd00u, 0xbd800000u, 0xbcadaaabu},
+    {0x3fb99556u, 0xc0633555u, 0x40ce6556u, 0xc0ce6556u, 0xc0633555u, 0xc0ce6556u, 0xbf400000u, 0xbe830000u},
+    {0x3fc85eabu, 0xc08de855u, 0x40f217abu, 0xc0f217abu, 0xc08de855u, 0xc0f217abu, 0xbfb80000u, 0xbefc8556u},
+    {0x80000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x80000000u},
+    {0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x00000000u, 0x80000000u, 0x80000000u},
+    {0x3f800000u, 0x00000000u, 0x40000000u, 0xc0000000u, 0x00000000u, 0xc0000000u, 0x00000000u, 0x00000000u},
+    {0x5d800000u, 0x00000000u, 0x5e000000u, 0xde000000u, 0x00000000u, 0xde000000u, 0xdd800000u, 0xec7ffffeu},
+    {0x3f800000u, 0x00000000u, 0x40000000u, 0xc0000000u, 0x00000000u, 0xc0000000u, 0x34000000u, 0x33ffffffu},
+    {0xb5c00000u, 0xb5800000u, 0xb6000000u, 0x36000000u, 0xb5800000u, 0x36000000u, 0xbfbffffcu, 0xb5bffffcu},
+};
+
+constexpr const char* Names[Results] = {
+    "v_mul_f32 v10, v4, v5",
+    "v_add_f32 v11, v10, v6",
+    "v_sub_f32 v12, v10, v6",
+    "v_subrev_f32 v13, v10, v6",
+    "v_add_f32 v14, v6, v10",
+    "v_sub_f32 v15, v6, v10",
+    "v_add_f32 v16, v4, v6",
+    "v_mul_f32 v17, v16, v5",
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+void Run(AgcDriver::VulkanDevice& device, const std::optional<ShaderRecompiler::ShaderFloatMode>& floatMode) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) std::copy(std::begin(Rows[tid]), std::end(Rows[tid]), &Input[tid * Inputs]);
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    request.target.fusedExactArithmetic = FusedExactArithmetic;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void Check(const char* mode) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        for (std::uint32_t i = 0; i < Results; ++i) {
+            const auto actual = Output[tid * Results + i];
+            Require(actual == Expected[tid][i], std::string("f32 separate rounding: ") + (FusedExactArithmetic ? "fused " : "") + "lane " + std::to_string(tid) + " " + mode + " " + Names[i] + " is " + Hex(actual) + ", expected " + Hex(Expected[tid][i]));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        for (const bool fused : {false, true}) {
+            if (!fused && device->Target().fusedExactArithmetic) continue;
+            FusedExactArithmetic = fused;
+            Run(*device, std::nullopt);
+            Check("no float mode");
+            Run(*device, ShaderRecompiler::ShaderFloatMode{0xc0u, true, true, false});
+            Check("IEEE=1");
+        }
+        std::puts("f32 separate rounding tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FinisherLabelOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/FinisherLabelOrder.cpp
new file mode 100644
index 0000000000..80e9c72dba
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FinisherLabelOrder.cpp
@@ -0,0 +1,153 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <exception>
+#include <initializer_list>
+#include <iostream>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 16> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060280u, 0x7e0802f2u, 0xf80008cfu, 0x04030201u, 0xbf810000u,
+};
+alignas(256) constexpr std::array<std::uint32_t, 10> PixelCode{0xf4000100u, 0xfa000000u, 0xbf8cc07fu, 0x7e000204u, 0x06000002u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u, 0xbf810000u};
+alignas(256) std::array<float, 4> PixelConstant{};
+alignas(256) std::array<std::byte, 1024> ColorMemory{};
+constexpr std::uint32_t Labels = 8;
+alignas(256) std::array<std::uint32_t, Labels> LabelMemory{};
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Registered(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+std::vector<std::uint32_t> Setup() {
+    const auto color = reinterpret_cast<std::uintptr_t>(ColorMemory.data());
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto pixel = reinterpret_cast<std::uintptr_t>(PixelCode.data());
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)},
+        {0x10f, std::bit_cast<std::uint32_t>(32.0f)}, {0x110, std::bit_cast<std::uint32_t>(32.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+    };
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 0}, {0x8c, 0},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 3u << 1u},
+    };
+    std::vector<std::uint32_t> commands;
+    Append(commands, 0x79, {0x242, 4});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    const auto table = reinterpret_cast<std::uintptr_t>(PixelConstant.data());
+    Append(commands, 0x76, {0x00c, static_cast<std::uint32_t>(table)});
+    Append(commands, 0x76, {0x00d, static_cast<std::uint32_t>(table >> 32u)});
+    Append(commands, 0x76, {0x00e, std::bit_cast<std::uint32_t>(0.25f)});
+    return commands;
+}
+
+void WriteLabel(std::vector<std::uint32_t>& commands, std::uint32_t index, std::uint32_t value) {
+    const auto address = reinterpret_cast<std::uintptr_t>(&LabelMemory[index]);
+    commands.insert(commands.end(), {0xc0033700u, 0x00100200u, static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u), value});
+}
+
+void WaitLabel(std::vector<std::uint32_t>& commands, std::uint32_t index, std::uint32_t value) {
+    const auto address = reinterpret_cast<std::uintptr_t>(&LabelMemory[index]);
+    commands.insert(commands.end(), {0xc0053c00u, 0x13u, static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u), value, 0xffffffffu, 0x19u});
+}
+
+}
+
+int main() {
+    try {
+        bool libraries = false;
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+            libraries = device->GraphicsPipelineLibraries();
+        }
+        if (!libraries && std::getenv("APS5_NO_GPL") == nullptr) return VulkanTestSkipped;
+        using AgcDriver::DriverDetail::DrawFinisher;
+        const bool finisher = DrawFinisher::Enabled() && DrawFinisher::Overlap();
+        Registered(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+        Registered(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+        PixelConstant[0] = 0.25f;
+        static_cast<void>(DrawFinisher::DrainText());
+        auto commands = Setup();
+        for (std::uint32_t index = 0; index < Labels; ++index) {
+            Append(commands, 0x2d, {3, 2});
+            WriteLabel(commands, index, 0x100u + index);
+            WaitLabel(commands, index, 0x100u + index);
+        }
+        Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+        Require(sceAgcDriverSubmitDcb(&packet) == 0, "the draw submission failed");
+        AgcDriverWaitIdle_nid_postfix();
+        const auto drains = DrawFinisher::DrainText();
+        AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(LabelMemory.data()), sizeof(LabelMemory));
+        AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(ColorMemory.data()), ColorMemory.size());
+        for (std::uint32_t index = 0; index < Labels; ++index) {
+            Require(LabelMemory[index] == 0x100u + index, "label " + std::to_string(index) + " is " + std::to_string(LabelMemory[index]) + " after the draws before it, expected " + std::to_string(0x100u + index));
+        }
+        unsigned brightest = 0;
+        for (const auto value : ColorMemory) brightest = std::max(brightest, static_cast<unsigned>(std::to_integer<std::uint8_t>(value)));
+        Require(brightest + 2 >= 128 && brightest <= 130, "the draws before the labels wrote " + std::to_string(brightest) + ", expected 128");
+        if (finisher) Require(drains.find(" 0x37 x") == std::string::npos, "a WRITE_DATA label after a draw handed to the finisher drained the finisher:" + drains);
+        if (finisher) Require(drains.find(" 0x3c x") == std::string::npos, "a WAIT_REG_MEM on a label the finisher holds drained the finisher:" + drains);
+        AgcDriverShutdown_nid_postfix();
+        std::cout << "labels after finisher draws " << (finisher ? "queued through the finisher" : "written in order") << "\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp
new file mode 100644
index 0000000000..5d3e6ebf24
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.cpp
@@ -0,0 +1,106 @@
+#include "FixtureDeviceSelection.hpp"
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void SetRequest(const char* value) {
+#ifdef _WIN32
+    if (_putenv_s("ANYPS5_GPU", value) != 0) throw std::runtime_error("cannot set ANYPS5_GPU");
+#else
+    if (setenv("ANYPS5_GPU", value, 1) != 0) throw std::runtime_error("cannot set ANYPS5_GPU");
+#endif
+}
+
+VkPhysicalDeviceProperties Properties(const char* name, VkPhysicalDeviceType type) {
+    VkPhysicalDeviceProperties result{};
+    result.apiVersion = VK_API_VERSION_1_1;
+    result.deviceType = type;
+    std::memcpy(result.deviceName, name, std::strlen(name) + 1u);
+    return result;
+}
+
+std::array<VkPhysicalDeviceProperties, 3> described{
+    Properties("llvmpipe (LLVM 20.1.2, 256 bits)", VK_PHYSICAL_DEVICE_TYPE_CPU),
+    Properties("AMD Radeon(TM) Graphics", VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU),
+    Properties("NVIDIA GeForce RTX 5080", VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU),
+};
+
+VkPhysicalDevice Handle(std::size_t index) {
+    return reinterpret_cast<VkPhysicalDevice>(static_cast<std::uintptr_t>(index + 1u));
+}
+
+void VKAPI_CALL Describe(VkPhysicalDevice device, VkPhysicalDeviceProperties* properties) {
+    *properties = described[reinterpret_cast<std::uintptr_t>(device) - 1u];
+}
+
+std::string SelectionError(const char* request) {
+    SetRequest(request);
+    try {
+        static_cast<void>(SelectFixturePhysicalDevice(std::array{Handle(0), Handle(1), Handle(2)}, Describe));
+    } catch (const std::runtime_error& error) {
+        return error.what();
+    }
+    throw std::runtime_error(std::string("ANYPS5_GPU=\"") + request + "\" selected a device");
+}
+
+void SelectionTests() {
+    std::array devices = described;
+    Require(!SelectFixtureDevice({}, {}).has_value(), "an empty device list selected a device");
+    Require(SelectFixtureDevice(devices, {}) == 2u, "default selection did not prefer the discrete GPU");
+    Require(SelectFixtureDevice(std::span(devices).first(2), {}) == 1u, "default selection did not prefer the integrated GPU to the CPU device");
+    Require(SelectFixtureDevice(devices, "AMD") == 1u, "an AMD request lost to the discrete GPU");
+    Require(SelectFixtureDevice(devices, "aMd rAdEoN") == 1u, "GPU name matching was not case-insensitive");
+    Require(SelectFixtureDevice(devices, "RTX 5080") == 2u, "partial GPU name matching failed");
+    Require(SelectFixtureDevice(devices, "llvmpipe") == 0u, "a requested CPU device was not selected");
+    Require(!SelectFixtureDevice(devices, "missing device").has_value(), "an unmatched GPU request selected a device");
+    Require(!SelectFixtureDevice(devices, "NVIDIA GeForce RTX 5080 with a longer name").has_value(), "a request longer than the device name matched");
+    const std::array radeons{
+        Properties("AMD Radeon(TM) Graphics", VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU),
+        Properties("AMD Radeon RX 7900 XTX", VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU),
+    };
+    Require(SelectFixtureDevice(radeons, {}) == 1u, "default selection did not prefer the discrete Radeon");
+    Require(SelectFixtureDevice(radeons, "radeon") == 0u, "a request matching an integrated and a later discrete GPU did not take the first match");
+    devices[0] = devices[1];
+    Require(SelectFixtureDevice(devices, "AMD") == 0u, "equally ranked matches did not keep enumeration order");
+    devices[1].apiVersion = VK_API_VERSION_1_0;
+    devices[2].apiVersion = VK_API_VERSION_1_0;
+    Require(!SelectFixtureDevice(devices, "NVIDIA").has_value(), "a requested device without Vulkan 1.1 was selected");
+}
+
+void EnvironmentTests() {
+    const std::array handles{Handle(0), Handle(1), Handle(2)};
+    SetRequest("");
+    Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(2), "an empty ANYPS5_GPU did not select the discrete GPU");
+    SetRequest("radeon");
+    Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(1), "ANYPS5_GPU=radeon did not select the integrated GPU");
+    SetRequest("LLVMPIPE");
+    Require(SelectFixturePhysicalDevice(handles, Describe) == Handle(0), "ANYPS5_GPU=LLVMPIPE did not select the CPU device");
+    const std::string error = SelectionError("no such device 1d3d154f");
+    Require(error == "no Vulkan 1.1 device whose name contains ANYPS5_GPU=\"no such device 1d3d154f\"; devices: llvmpipe (LLVM 20.1.2, 256 bits), AMD Radeon(TM) Graphics, NVIDIA GeForce RTX 5080", "unexpected error: " + error);
+}
+
+}
+
+int main() {
+    try {
+        SelectionTests();
+        EnvironmentTests();
+        std::puts("fixture device selection tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp
new file mode 100644
index 0000000000..7bc494e0ec
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FixtureDeviceSelection.hpp
@@ -0,0 +1,57 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_EXECUTION_FIXTUREDEVICESELECTION_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_TESTS_EXECUTION_FIXTUREDEVICESELECTION_HPP
+
+#include <vulkan/vulkan.h>
+#include <algorithm>
+#include <cctype>
+#include <cstddef>
+#include <cstdlib>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <vector>
+
+inline std::optional<std::size_t> SelectFixtureDevice(std::span<const VkPhysicalDeviceProperties> devices, std::string_view request) {
+    const auto rankDeviceType = [](VkPhysicalDeviceType type) {
+        switch (type) {
+            case VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU: return 3;
+            case VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU: return 2;
+            case VK_PHYSICAL_DEVICE_TYPE_VIRTUAL_GPU: return 1;
+            default: return 0;
+        }
+    };
+    std::optional<std::size_t> selected;
+    int selectedRank = -1;
+    for (std::size_t index = 0; index < devices.size(); ++index) {
+        const auto& candidate = devices[index];
+        if (candidate.apiVersion < VK_API_VERSION_1_1) continue;
+        const std::string_view name(candidate.deviceName);
+        if (!request.empty() && std::search(name.begin(), name.end(), request.begin(), request.end(), [](char left, char right) {
+            return std::tolower(static_cast<unsigned char>(left)) == std::tolower(static_cast<unsigned char>(right));
+        }) == name.end()) continue;
+        const int rank = request.empty() ? rankDeviceType(candidate.deviceType) : 4;
+        if (rank <= selectedRank) continue;
+        selected = index;
+        selectedRank = rank;
+    }
+    return selected;
+}
+
+inline VkPhysicalDevice SelectFixturePhysicalDevice(std::span<const VkPhysicalDevice> devices, PFN_vkGetPhysicalDeviceProperties physicalProperties) {
+    std::vector<VkPhysicalDeviceProperties> properties(devices.size());
+    for (std::size_t index = 0; index < devices.size(); ++index) physicalProperties(devices[index], &properties[index]);
+    const char* requestedName = std::getenv("ANYPS5_GPU");
+    const std::string_view request = requestedName != nullptr ? requestedName : "";
+    if (const auto selected = SelectFixtureDevice(properties, request)) return devices[*selected];
+    if (request.empty()) throw std::runtime_error("no Vulkan 1.1 device");
+    std::string names;
+    for (const auto& candidate : properties) {
+        if (!names.empty()) names += ", ";
+        names += candidate.deviceName;
+    }
+    throw std::runtime_error("no Vulkan 1.1 device whose name contains ANYPS5_GPU=\"" + std::string(request) + "\"; devices: " + names);
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp
index b76ffe2a6d..e4b54fc027 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/FmaskImageReads.cpp
@@ -32,9 +32,9 @@ std::array<std::uint32_t, 4> Buffer(const void* data, std::uint32_t bytes) {
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u) & 0xffffu, bytes, 0x31016facu};
 }
 
-std::array<std::uint32_t, 8> Image(bool layered, std::uint32_t pipeXor, std::uint32_t swizzle = 4u) {
+std::array<std::uint32_t, 8> Image(bool layered, std::uint32_t pipeXor, std::uint32_t swizzle = 4u, std::uint32_t format = 166u) {
     const auto address = reinterpret_cast<std::uintptr_t>(Texels.data()) + pipeXor;
-    return {static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u) | (166u << 20u) | (3u << 30u), 31u | ((Height - 1u) << 14u), swizzle | (24u << 20u) | ((layered ? 13u : 9u) << 28u), layered ? 2u | (1u << 16u) : 0u, 0u, 0u, 0u};
+    return {static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u) | (format << 20u) | (3u << 30u), 31u | ((Height - 1u) << 14u), swizzle | (24u << 20u) | ((layered ? 13u : 9u) << 28u), layered ? 2u | (1u << 16u) : 0u, 0u, 0u, 0u};
 }
 
 std::uint32_t Mapping(std::uint32_t x, std::uint32_t y, std::uint32_t layer, std::uint32_t round) {
@@ -56,15 +56,16 @@ std::uint64_t EquationOffset(const TextureSwizzleEquation& equation, std::uint32
     return offset;
 }
 
-void Fill(bool layered, std::uint32_t pipeXor, std::uint32_t round) {
+template<typename TValue>
+void FillWith(bool layered, std::uint32_t pipeXor, std::uint32_t surfaceFormat, std::uint32_t bytes, TValue valueAt) {
     auto words = Image(layered, pipeXor);
-    words[1] = (words[1] & ~(0x1ffu << 20u)) | (20u << 20u);
+    words[1] = (words[1] & ~(0x1ffu << 20u)) | (surfaceFormat << 20u);
     const auto resource = DecodeTextureResource(words);
     const auto geometry = DescribeSurface(resource);
     Require(geometry.guestBytes <= Texels.size(), "FMASK fixture exceeds its allocation");
     const auto& mip = geometry.mips.at(0);
-    const auto block = ThinBlockLayout(resource.tileMode, 4u);
-    const auto* equation = FindTextureSwizzleEquation(24u, 4u);
+    const auto block = ThinBlockLayout(resource.tileMode, bytes);
+    const auto* equation = FindTextureSwizzleEquation(24u, bytes);
     Require(equation != nullptr, "FMASK fixture has no Z swizzle equation");
     std::ranges::fill(Texels, std::byte{0});
     for (std::uint32_t layer = 0; layer < geometry.layers; ++layer) {
@@ -73,14 +74,18 @@ void Fill(bool layered, std::uint32_t pipeXor, std::uint32_t round) {
                 auto offset = geometry.GuestLayerOffset(layer) + mip.tiledOffset;
                 if (mip.tail) offset += EquationOffset(*equation, x + mip.tailX, y + mip.tailY, layer) ^ pipeXor;
                 else offset += (static_cast<std::uint64_t>(y / block[2]) * mip.blocksPerRow + x / block[1]) * block[0] + (EquationOffset(*equation, x, y, layer) ^ pipeXor);
-                const auto value = Mapping(x, y, layer, round);
-                Require(offset + sizeof(value) <= Texels.size(), "FMASK fixture addresses outside its allocation");
-                std::memcpy(Texels.data() + offset, &value, sizeof(value));
+                const std::uint32_t value = valueAt(x, y, layer);
+                Require(offset + bytes <= Texels.size(), "FMASK fixture addresses outside its allocation");
+                std::memcpy(Texels.data() + offset, &value, bytes);
             }
         }
     }
 }
 
+void Fill(bool layered, std::uint32_t pipeXor, std::uint32_t round) {
+    FillWith(layered, pipeXor, 20u, 4u, [round](std::uint32_t x, std::uint32_t y, std::uint32_t layer) { return Mapping(x, y, layer, round); });
+}
+
 ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::span<const std::uint32_t> image, bool registration) {
     std::vector<std::uint32_t> userData(16u);
     const auto input = Buffer(Input.data(), sizeof(Input));
@@ -140,6 +145,68 @@ void Run(AgcDriver::VulkanDevice& device, bool layered, bool registration, std::
     }
 }
 
+struct NarrowFmask {
+    std::uint32_t format;
+    std::uint32_t surfaceFormat;
+    std::uint32_t bytes;
+    std::uint32_t samples;
+    std::uint32_t fragments;
+    std::uint32_t sampleBits;
+    std::uint32_t identity;
+    std::uint32_t expandedIdentity;
+};
+
+constexpr std::array<NarrowFmask, 8> NarrowFormats{{
+    {156u, 5u, 1u, 2u, 1u, 1u, 0x02u, 0x80u},
+    {157u, 5u, 1u, 4u, 1u, 1u, 0x0eu, 0x8880u},
+    {158u, 5u, 1u, 8u, 1u, 1u, 0xfeu, 0x88888880u},
+    {159u, 5u, 1u, 2u, 2u, 1u, 0x02u, 0x10u},
+    {160u, 5u, 1u, 4u, 2u, 2u, 0xa4u, 0x8810u},
+    {161u, 5u, 1u, 4u, 4u, 2u, 0xe4u, 0x3210u},
+    {163u, 11u, 2u, 8u, 2u, 2u, 0xaaa4u, 0x88888810u},
+    {165u, 20u, 4u, 8u, 4u, 4u, 0x44443210u, 0x88883210u},
+}};
+
+std::uint32_t Stored(const NarrowFmask& fmask, std::uint32_t x, std::uint32_t y, std::uint32_t layer, std::uint32_t round) {
+    if (round == 0u) return fmask.identity;
+    const auto value = (x * 0x9e3779b1u) ^ (y * 0x85ebca77u) ^ (layer * 0xc2b2ae3du) ^ (fmask.format * 0x27d4eb2fu);
+    return fmask.bytes == 4u ? value : value & ((1u << (fmask.bytes * 8u)) - 1u);
+}
+
+std::uint32_t Expanded(const NarrowFmask& fmask, std::uint32_t stored) {
+    std::uint32_t expanded = 0;
+    for (std::uint32_t sample = 0; sample < fmask.samples; ++sample) {
+        const auto fragment = (stored >> (sample * fmask.sampleBits)) & ((1u << fmask.sampleBits) - 1u);
+        expanded |= (fragment >= fmask.fragments ? 8u : fragment) << (sample * 4u);
+    }
+    return expanded;
+}
+
+void RunNarrow(AgcDriver::VulkanDevice& device, const NarrowFmask& fmask, bool layered, bool registration) {
+    auto code = Code;
+    if (layered) code[4] = 0xf0001f28u;
+    Require(Expanded(fmask, fmask.identity) == fmask.expandedIdentity, "FMASK " + std::to_string(fmask.format) + " reference does not expand PAL's identity value");
+    for (std::uint32_t round = 0; round < 2u; ++round) {
+        FillWith(layered, 0u, fmask.surfaceFormat, fmask.bytes, [&](std::uint32_t x, std::uint32_t y, std::uint32_t layer) { return Stored(fmask, x, y, layer, round); });
+        for (std::uint32_t lane = 0; lane < Threads; ++lane) {
+            Input[lane * 4u] = (lane * 37u + 11u) % Width;
+            Input[lane * 4u + 1u] = (lane * 23u + 5u) % Height;
+            Input[lane * 4u + 2u] = layered ? lane & 1u : 0u;
+            Input[lane * 4u + 3u] = 0u;
+        }
+        Output.fill(Sentinel);
+        const auto shader = Compile(device, code, Image(layered, 0u, 4u, fmask.format), registration);
+        device.Dispatch(shader, 1u, 1u, 1u);
+        device.WaitIdle();
+        for (std::uint32_t lane = 0; lane < Threads; ++lane) {
+            const auto stored = Stored(fmask, Input[lane * 4u], Input[lane * 4u + 1u], layered ? Input[lane * 4u + 2u] + 1u : 0u, round);
+            const std::array expected{Expanded(fmask, stored), 0u, 0u, 0u};
+            for (std::uint32_t component = 0; component < 4u; ++component) Require(Output[lane * 4u + component] == expected[component], "FMASK " + std::to_string(fmask.format) + " load did not expand its mapping: round " + std::to_string(round) + ", lane " + std::to_string(lane) + ", component " + std::to_string(component) + ", read " + std::to_string(Output[lane * 4u + component]) + ", expected " + std::to_string(expected[component]));
+        }
+        Require(std::all_of(Output.begin() + Threads * 4u, Output.end(), [](auto value) { return value == Sentinel; }), "FMASK load wrote outside its output");
+    }
+}
+
 }
 
 int main() {
@@ -149,9 +216,10 @@ int main() {
         for (const bool registration : {false, true}) {
             for (const bool layered : {false, true}) {
                 for (const auto pipeXor : {0u, 0xf00u}) Run(*device, layered, registration, pipeXor);
+                for (const auto& fmask : NarrowFormats) RunNarrow(*device, fmask, layered, registration);
             }
         }
-        std::cout << "FMASK image reads passed: 40 dispatches, 5120 component checks, 8 compression refusals\n";
+        std::cout << "FMASK image reads passed: 104 dispatches, 13312 component checks, 8 compression refusals\n";
         return 0;
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp
index 503ccf662f..b4827a3b53 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GlobalAtomicsFloat.cpp
@@ -684,6 +684,7 @@ void Dispatch(AgcDriver::VulkanDevice& device, std::uint32_t waveSize, const std
         {0, 0, 0, 128}
     };
     request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false};
     const auto result = ShaderRecompiler::Recompile(request);
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp
index 5a4da94b89..6137424eba 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GpuMapOnFiber.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFiber/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -17,15 +18,6 @@
 #include <iostream>
 #include <string>
 
-using GuestFiberEntry = void (APS5_VABI*)(std::uint64_t, std::uint64_t);
-
-extern "C" {
-std::int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject*, const char*, GuestFiberEntry, std::uint64_t, void*, std::uint64_t, const void*, std::uint32_t);
-std::int32_t APS5_VABI sceFiberFinalize(FiberObject*);
-std::int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject*, std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberReturnToThread(std::uint64_t, std::uint64_t*);
-}
-
 namespace {
 
 using AgcDriver::DriverDetail::Driver;
@@ -77,6 +69,7 @@ void MapForGpu() {
 void APS5_VABI MapOnFiber(std::uint64_t, std::uint64_t) {
     MapForGpu();
     sceFiberReturnToThread(0, nullptr);
+
 }
 
 void ReleaseMapping() {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp
index 172c6a26aa..d05f480585 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GuardedNullPointer.cpp
@@ -270,7 +270,7 @@ void RunTests(AgcDriver::VulkanDevice& device) {
     Require(!Faulted(someLanes), "guarded pointer: a mapped pointer under EXEC faulted:\n" + someLanes.log);
     RequireWords(someLanes, 5u, Payload, "guarded pointer: a mapped pointer read under EXEC");
     const auto noLanes = Run(device, ExecCode, 0u, 0u);
-    Require(!Faulted(noLanes) && noLanes.poisoned == 1u, "guarded pointer: a null pointer read skipped by s_cbranch_execz faulted:\n" + noLanes.log);
+    Require(!Faulted(noLanes) && noLanes.poisoned == 0u && noLanes.cacheable, "guarded pointer: a null pointer read skipped by s_cbranch_execz under an EXEC decided empty at capture faulted, was poisoned or left the caches:\n" + noLanes.log);
     RequireWords(noLanes, 0u, 0u, "guarded pointer: a read skipped by s_cbranch_execz");
     const auto oneLane = Run(device, ExecCode, 0u, 1u);
     Require(Faulted(oneLane) && oneLane.log.find(Fault(0u, 0x34u)) != std::string::npos, "guarded pointer: a null pointer read with one EXEC lane did not fault:\n" + oneLane.log);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp
index 2d737ebc4e..7d6a257711 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/GuestMemoryLifetime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
@@ -17,19 +19,6 @@
 #include <stdexcept>
 #include <string_view>
 
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-void* APS5_VABI memalign_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI realloc_nid_postfix(void*, std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-}
-
 namespace {
 
 constexpr std::size_t BlockBytes = 65536;
@@ -141,12 +130,14 @@ void CheckHeap(AgcDriver::VulkanDevice& device) {
     Require(!Imported(device, allocation), "host import survived guest realloc");
     CheckPattern(replacement);
     free_nid_postfix(replacement);
+
     for (int iteration = 0; iteration < 3; ++iteration) {
         allocation = memalign_nid_postfix(BlockBytes, BlockBytes);
         Require(allocation != nullptr, "guest heap reuse allocation failed");
         std::memset(allocation, 0, BlockBytes);
         Fill(device, allocation);
         free_nid_postfix(allocation);
+
         Require(!Imported(device, allocation), "host import survived guest free or heap cache eviction");
     }
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp
index 00a4f23f96..6bc76a11e1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportAtMap.cpp
@@ -147,7 +147,13 @@ int main() {
         remapped.Unregister();
         remapped.Register();
         Import(*device, remapped.Ranges());
-        Require(Imported(handle, remapped.Address(), AllocationBytes), "host import at map: a range mapped again was not imported");
+        Require(!Imported(handle, remapped.Address(), AllocationBytes), "host import at map: a range mapped again was imported at map instead of on first use");
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            const std::array<std::uint32_t, 4> pattern{9u, 10u, 11u, 12u};
+            Require(device->FillBuffer(remapped.Address(), BlockBytes, pattern), "host import at map: the first use of a range mapped again was not imported");
+            device->WaitIdle();
+        }
         GuestAllocation gone;
         const auto goneRanges = gone.Ranges();
         gone.Unregister();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp
index e6d9bd6b30..35e4f777cd 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/HostImportWindows.cpp
@@ -21,6 +21,14 @@
 #include <mutex>
 #include <string>
 
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
 namespace {
 
 namespace Graphics = AgcDriver::Graphics;
@@ -163,6 +171,41 @@ Outcome ResidentMappingsImportAfterCollection() {
     return Outcome::Passed;
 }
 
+Outcome SmallMappingsImportOnFirstUse() {
+    GuestBlock small(GuestAlignment);
+    GuestBlock large(2 * GuestAlignment);
+    auto device = OpenVulkanTestDevice();
+    if (!device) return Outcome::NoDevice;
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+    if (context.hostImportAlignment == 0) return Outcome::NoImport;
+    for (auto* guest : {&small, &large}) {
+        Graphics::ClearHostImports(device->Device());
+        GuestAllocations::Mapped ranges;
+        for (const auto& range : GuestAllocations::GuestAllocationsAcquire_nid_postfix()) {
+            if (range->address == guest->Address()) ranges.push_back(range);
+        }
+        Require(ranges.size() == 1, "mapped import test lost its registered range");
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            Require(Graphics::ImportMappedRanges(context, ranges, GuestAllocations::GuestAllocationsGeneration_nid_postfix(), true), "mapped import test could not adopt the device");
+        }
+        Require(Graphics::HostImportCovers(context, guest->Address(), ProbeBytes) == (guest == &large), "mapping did not defer exactly the small import");
+        Require(Fill(*device, guest->Address()), "first GPU use could not import the mapped buffer");
+        Require(Graphics::HostImportCovers(context, guest->Address(), ProbeBytes), "first GPU use left the mapped buffer unimported");
+        constexpr std::array<std::uint32_t, 4> pattern{0x11111111u, 0x22222222u, 0x33333333u, 0x44444444u};
+        for (std::size_t offset = 0; offset < ProbeBytes; offset += sizeof(std::uint32_t)) {
+            std::uint32_t actual = 0;
+            std::memcpy(&actual, guest->Data() + offset, sizeof(actual));
+            Require(actual == pattern[(offset / sizeof(actual)) % pattern.size()], "first GPU use changed the fill result");
+        }
+        for (std::size_t offset = ProbeBytes; offset < GuestAlignment; ++offset) {
+            Require(guest->Data()[offset] == 0, "first GPU use overwrote bytes outside the fill");
+        }
+    }
+    Graphics::ClearHostImports(device->Device());
+    return Outcome::Passed;
+}
+
 }
 
 int main() {
@@ -176,6 +219,7 @@ int main() {
         const auto windows = WindowsFollowTheirRange();
         Require(windows == Outcome::Passed, "host import windows: the device stopped importing guest memory between two scenarios");
         Require(ResidentMappingsImportAfterCollection() == Outcome::Passed, "resident import test failed");
+        Require(SmallMappingsImportOnFirstUse() == Outcome::Passed, "mapped import test lost its Vulkan device or host import support");
         std::puts("host import windows tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageArrayWindowPastLayerLimit.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageArrayWindowPastLayerLimit.cpp
index 528cad640e..d6a5e73941 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageArrayWindowPastLayerLimit.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageArrayWindowPastLayerLimit.cpp
@@ -120,7 +120,7 @@ void Run(AgcDriver::VulkanDevice& device, std::uint32_t baseArray = BaseArray) {
     device.WaitIdle();
     for (std::uint32_t tid = 0; tid < Threads; ++tid) {
         const float u = std::bit_cast<float>(Input[tid * 4u + 0u]);
-        const float layer = std::clamp(std::nearbyint(std::bit_cast<float>(Input[tid * 4u + 1u])), 0.0f, static_cast<float>(Layers - 1u));
+        const float layer = std::clamp(std::nearbyint(std::bit_cast<float>(Input[tid * 4u + 1u])), 0.0f, static_cast<float>(LastArray - baseArray));
         const auto x = static_cast<std::uint32_t>(std::clamp(static_cast<int>(std::floor(u * static_cast<float>(Width))), 0, static_cast<int>(Width) - 1));
         Expect(tid, "image_sample_lz on a window of a 1D array past maxImageArrayLayers", &Output[tid * 8u], Texel(x, baseArray + static_cast<std::uint32_t>(layer)));
         Expect(tid, "image_load on a window of a 1D array past maxImageArrayLayers", &Output[tid * 8u + 4u], Texel(Input[tid * 4u + 2u], baseArray + Input[tid * 4u + 3u]));
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp
index a7b492f8e8..78b36356c7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageAtomicsFloat.cpp
@@ -504,6 +504,7 @@ ShaderRecompiler::RecompileResult Compile(std::uint32_t waveSize, const ShaderRe
         {0, 0, 0, 128}
     };
     request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false};
     return ShaderRecompiler::Recompile(request);
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp
index 94de1a8025..f840ade501 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageConvertedUnorm.cpp
@@ -442,14 +442,92 @@ void RequireRefused(AgcDriver::VulkanDevice& device, std::span<const std::uint32
     Require(refusal.find(reason) != std::string::npos, what + " of a converted image was not refused: " + refusal);
 }
 
+void CheckPacked16(AgcDriver::VulkanDevice& device, std::uint8_t* texels, std::uint32_t format) {
+    const std::array<std::uint32_t, 4> widths = format == 133u ? std::array{5u, 6u, 5u, 0u} : format == 134u ? std::array{5u, 5u, 5u, 1u} : std::array{4u, 4u, 4u, 4u};
+    const std::array<std::uint32_t, 4> offsets = format == 133u ? std::array{0u, 5u, 11u, 0u} : format == 134u ? std::array{0u, 5u, 10u, 15u} : std::array{0u, 4u, 8u, 12u};
+    for (std::uint32_t index = 0; index < LoadWidth; ++index) {
+        const auto value = static_cast<std::uint16_t>(index * 4051u + 0x39d7u);
+        std::memcpy(texels + index * 2u, &value, 2u);
+    }
+    Run(device, LoadXyzw, TextureDescriptor(texels, format, SwizzleXYZW, LoadWidth), {}, LoadGroups);
+    for (std::uint32_t index = 0; index < LoadWidth; ++index) {
+        const auto value = static_cast<std::uint16_t>(index * 4051u + 0x39d7u);
+        for (std::uint32_t component = 0; component < 4u; ++component) {
+            const auto bits = widths[component] == 0u ? widths[0] : widths[component];
+            const auto maximum = (1u << bits) - 1u;
+            const auto actual = Output[index * 4u + component];
+            Require(std::isfinite(std::bit_cast<float>(actual)) && StoreField(actual, maximum) == ((value >> offsets[component]) & maximum), "packed image_load has the wrong channel for format " + std::to_string(format));
+        }
+    }
+    auto* target = texels + RoundTripOffset;
+    alignas(256) static constexpr std::array<std::uint32_t, 10> roundTrip{
+        0x7e080218u, 0x343c0885u, 0x4a3c3d00u, 0x7e3e0280u, 0xf0001f08u, 0x00010a1eu, 0xbf8c3f70u, 0xf0201f08u,
+        0x00040a1eu, 0xbf810000u,
+    };
+    Run(device, roundTrip, TextureDescriptor(texels, format, SwizzleXYZW, LoadWidth), {}, LoadGroups, TextureDescriptor(target, format, SwizzleXYZW, LoadWidth));
+    AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(target), LoadWidth * 2u, nullptr, "test");
+    device.WaitIdle();
+    Require(std::memcmp(texels, target, LoadWidth * 2u) == 0, "packed image load/store changed guest bytes for format " + std::to_string(format));
+    alignas(256) static constexpr auto store = StoreCode(0xfu, 0u);
+    auto* written = texels + StoreOffset;
+    alignas(256) static constexpr auto storeHalf = StoreCode(0xfu, D16);
+    constexpr std::array halfValues{0x0000u, 0x3c00u, 0x3800u, 0x3400u, 0xbc00u, 0x4000u, 0x7c00u, 0x7e00u};
+    constexpr std::array halfFloats{0.0f, 1.0f, 0.5f, 0.25f, -1.0f, 2.0f, INFINITY, NAN};
+    for (std::uint32_t pass = 0; pass < 5u; ++pass) {
+        const auto swizzle = pass == 3u ? SwizzleZYX1 : SwizzleXYZW;
+        const auto dmask = pass == 4u ? 0x5u : 0xfu;
+        std::array<std::uint16_t, Threads> expected{};
+        Input.fill(0u);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            std::uint32_t slot = 0;
+            for (std::uint32_t component = 0; component < 4u; ++component) {
+                if (((dmask >> component) & 1u) == 0u) continue;
+                auto value = StoreValues[(tid + component * 3u + pass * 4u) % StoreValues.size()];
+                if (tid == 0u) value = std::bit_cast<std::uint32_t>(pass == 0u ? std::array{1.0f, 0.5f, 0.25f, 1.0f}[component] : std::array{0.25f, 1.0f, 0.5f, 0.0f}[component]);
+                if (pass == 2u) {
+                    const auto index = (tid + component * 3u) % halfValues.size();
+                    value = std::bit_cast<std::uint32_t>(halfFloats[index]);
+                    Input[tid * 4u + slot / 2u] |= halfValues[index] << ((slot % 2u) * 16u);
+                } else {
+                    Input[tid * 4u + slot] = value;
+                }
+                ++slot;
+                const auto selected = (swizzle >> (component * 3u)) & 7u;
+                if (selected >= 4u && widths[selected - 4u] != 0u) expected[tid] |= static_cast<std::uint16_t>(StoreField(value, (1u << widths[selected - 4u]) - 1u) << offsets[selected - 4u]);
+            }
+        }
+        auto* reference = texels + FloatOffset;
+        std::memcpy(reference, expected.data(), Threads * 2u);
+        Run(device, SampleLz, TextureDescriptor(reference, format, SwizzleXYZW, Threads), PointSampler, 1);
+        std::array<std::uint32_t, 4> sampled{};
+        std::copy_n(Output.begin(), 4u, sampled.begin());
+        const auto descriptor = TextureDescriptor(written, format, SwizzleXYZW, Threads);
+        Run(device, pass == 2u ? storeHalf : pass == 4u ? StoreXz : store, TextureDescriptor(written, format, swizzle, Threads), BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u)), 1);
+        Run(device, SampleLz, descriptor, PointSampler, 1);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            for (std::uint32_t component = 0; component < 4u; ++component) Require(Output[tid * 4u + component] == sampled[component], "sample after packed store differs for format " + std::to_string(format));
+        }
+        AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(written), Threads * 2u, nullptr, "test");
+        device.WaitIdle();
+        Require(std::memcmp(written, expected.data(), Threads * 2u) == 0, "packed image_store write-back differs for format " + std::to_string(format));
+    }
 }
 
-int main() {
+}
+
+int main(int argc, char** argv) {
     try {
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
         GuestBlock block;
         auto* texels = block.Data();
+        if (argc == 3 && std::string(argv[1]) == "--packed16") {
+            const auto format = static_cast<std::uint32_t>(std::stoul(argv[2]));
+            Require(format == 133u || format == 134u || format == 136u, "unsupported packed storage test format");
+            CheckPacked16(*device, texels, format);
+            std::cout << "Packed 16-bit storage image tests passed\n";
+            return 0;
+        }
         for (std::uint32_t index = 0; index < LoadWidth; ++index) {
             const auto texel = LoadTexel(index);
             std::memcpy(texels + index * 4u, &texel, 4u);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageResinfoDimension.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageResinfoDimension.cpp
new file mode 100644
index 0000000000..01fd310101
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageResinfoDimension.cpp
@@ -0,0 +1,108 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Size = 8;
+constexpr std::uint32_t Format32Float = 22;
+constexpr std::uint32_t Type3D = 10;
+constexpr std::uint32_t TypeCube = 11;
+constexpr std::uint32_t Type2DArray = 13;
+alignas(256) std::array<std::uint32_t, Threads * 4> Output{};
+alignas(256) std::array<std::uint8_t, 65536> Texels{};
+
+constexpr std::array<std::uint32_t, 8> Code(std::uint32_t dim) {
+    return {0x34060084u, 0x7e020280u, 0xf0380f00u | (dim << 3u), 0x00010a01u, 0xbf8c3f70u, 0xe0781000u, 0x80000a03u, 0xbf810000u};
+}
+
+alignas(256) constexpr auto Query1D = Code(0u);
+alignas(256) constexpr auto Query3D = Code(2u);
+alignas(256) constexpr auto QueryCube = Code(3u);
+alignas(256) constexpr auto Query2DArray = Code(5u);
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> Descriptor(std::uint32_t type, std::uint32_t depth) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(Texels.data()));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32Float << 20u) | (((Size - 1u) & 3u) << 30u),
+        ((Size - 1u) >> 2u) | ((Size - 1u) << 14u),
+        0xfacu | (type << 28u),
+        depth - 1u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+std::array<std::uint32_t, 4> Query(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::array<std::uint32_t, 8>& texture) {
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(output.begin(), output.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    for (std::uint32_t tid = 1; tid < Threads; ++tid) {
+        Require(std::equal(Output.begin(), Output.begin() + 4, Output.begin() + tid * 4u), "image_get_resinfo: lanes disagree");
+    }
+    return {Output[0], Output[1], Output[2], Output[3]};
+}
+
+std::string Text(const std::array<std::uint32_t, 4>& value) {
+    return std::to_string(value[0]) + "x" + std::to_string(value[1]) + "x" + std::to_string(value[2]) + " levels " + std::to_string(value[3]);
+}
+
+using Result = std::array<std::uint32_t, 4>;
+
+void Check(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> native, const std::array<std::uint32_t, 8>& texture, const char* what, const Result& own, const Result& oneDimensional) {
+    const auto nativeResult = Query(device, native, texture);
+    Require(nativeResult == own, std::string("image_get_resinfo: the ") + what + " query returned " + Text(nativeResult) + ", RDNA 2 returns " + Text(own));
+    const auto lineResult = Query(device, Query1D, texture);
+    Require(lineResult == oneDimensional, std::string("image_get_resinfo: DIM 1D on a ") + what + " T# returned " + Text(lineResult) + ", RDNA 2 returns " + Text(oneDimensional));
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        Check(*device, QueryCube, Descriptor(TypeCube, 6u), "cube", {Size, Size, 6u, 1u}, {Size, Size, 0u, 1u});
+        Check(*device, Query3D, Descriptor(Type3D, 4u), "3D", {Size, Size, 4u, 1u}, {Size, Size, 4u, 1u});
+        Check(*device, Query2DArray, Descriptor(Type2DArray, 3u), "2D array", {Size, Size, 3u, 1u}, {Size, Size, 0u, 1u});
+        std::puts("image resinfo dimension tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp
index 331882d14a..0178717e94 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageSampleForceDegamma.cpp
@@ -27,6 +27,7 @@ constexpr std::uint32_t Format8888Srgb = 130;
 constexpr std::uint32_t Format32Float = 22;
 constexpr std::uint32_t Format8888SNorm = 57;
 constexpr std::uint32_t FormatBc4UNorm = 175;
+constexpr std::uint32_t Format32UInt = 20;
 constexpr std::uint32_t Type2D = 9;
 constexpr std::uint32_t FilterPoint = 0;
 constexpr std::uint32_t FilterBilinear = 1;
@@ -177,7 +178,11 @@ int main() {
         RequireSame(Sample(*device, Format8888UNorm, FilterBilinear, ForceDegamma), forcedBilinear, "8_8_8_8_UNORM, bilinear", "through FORCE_DEGAMMA", "as 8_8_8_8_SRGB");
         RequireSame(Sample(*device, Format32Float, FilterPoint, ForceDegamma), Sample(*device, Format32Float, FilterPoint, 0u), "32_FLOAT, point");
         RequireSame(Sample(*device, FormatBc4UNorm, FilterPoint, ForceDegamma), Sample(*device, FormatBc4UNorm, FilterPoint, 0u), "BC4_UNORM, point");
-        Reject(*device, Format8888SNorm, "guest format 57, which is not sRGB and has no sRGB view, is sampled through a sampler that forces sRGB decoding");
+        FillInput(true);
+        RequireSame(Sample(*device, Format8888SNorm, FilterPoint, ForceDegamma), forcedPoint, "8_8_8_8_SNORM, point", "through FORCE_DEGAMMA", "as 8_8_8_8_SRGB");
+        FillInput(false);
+        RequireSame(Sample(*device, Format8888SNorm, FilterBilinear, ForceDegamma), forcedBilinear, "8_8_8_8_SNORM, bilinear", "through FORCE_DEGAMMA", "as 8_8_8_8_SRGB");
+        Reject(*device, Format32UInt, "guest format 20, which is not sRGB and has no sRGB view, is sampled through a sampler that forces sRGB decoding");
         std::puts("image sample force degamma tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreVolumeThroughArray.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreVolumeThroughArray.cpp
new file mode 100644
index 0000000000..b82fa4ba07
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreVolumeThroughArray.cpp
@@ -0,0 +1,173 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Size = 4;
+constexpr std::uint32_t Depth = 2;
+constexpr std::uint32_t Format32UInt = 20;
+constexpr std::uint32_t Type2DArray = 13;
+constexpr std::uint32_t IdentitySwizzle = 0xfacu;
+constexpr std::size_t TexelBytes = 16384;
+constexpr std::size_t BlockBytes = 65536;
+
+alignas(256) std::array<std::uint32_t, Threads * 4> Input{};
+
+alignas(256) constexpr std::array<std::uint32_t, 10> StoreCode{
+    0x34020084, 0xe0381000, 0x80001401, 0xbf8c3f70, 0xf0201110, 0x00011714, 0x7e2c0282, 0xf0201110,
+    0x00011714, 0xbf810000,
+};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "image store volume through array: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint8_t* Data() { return block; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::uint32_t Value(std::uint32_t tid) {
+    return (tid + 1u) * 0x9e3779b1u;
+}
+
+std::vector<std::uint8_t> Initial() {
+    std::vector<std::uint8_t> bytes(TexelBytes);
+    for (std::size_t index = 0; index < bytes.size(); ++index) bytes[index] = static_cast<std::uint8_t>(0x80u + 37u * index + 11u * (index >> 4u));
+    return bytes;
+}
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> ArrayDescriptor(const void* data) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32UInt << 20u) | (((Size - 1u) & 3u) << 30u),
+        ((Size - 1u) >> 2u) | ((Size - 1u) << 14u),
+        IdentitySwizzle | (Type2DArray << 28u),
+        Depth - 1u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+void Dispatch(AgcDriver::VulkanDevice& device, std::uint8_t* texels, std::size_t bytes) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const std::array<std::uint32_t, 4> words{tid % Size, (tid / Size) % Size, tid / (Size * Size), Value(tid)};
+        std::copy(words.begin(), words.end(), Input.begin() + tid * 4u);
+    }
+    const auto initial = Initial();
+    std::copy(initial.begin(), initial.end(), texels);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto buffer = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto texture = ArrayDescriptor(texels);
+    std::copy(buffer.begin(), buffer.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(StoreCode);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(texels), bytes, nullptr, "test");
+    device.WaitIdle();
+}
+
+void Check(const std::uint8_t* texels) {
+    const auto geometry = AgcDriver::Graphics::DescribeSurface(AgcDriver::Graphics::DecodeTextureResource(ArrayDescriptor(texels)));
+    const auto& mip = geometry.mips.at(0);
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const auto x = tid % Size;
+        const auto y = (tid / Size) % Size;
+        const auto z = tid / (Size * Size);
+        std::uint32_t actual = 0;
+        std::memcpy(&actual, texels + geometry.GuestLayerOffset(z) + mip.tiledOffset + static_cast<std::uint64_t>(y) * mip.pitchBytes + x * 4u, 4u);
+        Require(actual == Value(tid), "image_store 3d through a 2D-array T#: texel (" + std::to_string(x) + ", " + std::to_string(y) + ", " + std::to_string(z) + ") is " + Hex(actual) + ", expected " + Hex(Value(tid)));
+    }
+    const auto initial = Initial();
+    Require(std::equal(texels + geometry.guestBytes, texels + TexelBytes, initial.begin() + static_cast<std::ptrdiff_t>(geometry.guestBytes)), "image_store 3d through a 2D-array T#: a slice past the array changed bytes after it");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        GuestBlock block;
+        auto* texels = block.Data();
+        const auto geometry = AgcDriver::Graphics::DescribeSurface(AgcDriver::Graphics::DecodeTextureResource(ArrayDescriptor(texels)));
+        Require(geometry.guestBytes <= TexelBytes, "image store volume through array: the array does not fit the texel storage");
+        Dispatch(*device, texels, geometry.guestBytes);
+        Check(texels);
+        std::puts("image store volume through array tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp
index d353e82b93..d5a89a1586 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageTable.cpp
@@ -203,6 +203,22 @@ alignas(256) constexpr std::array<std::uint32_t, 16> StoreLaneTableCode{
     0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0xf0208f08u, 0x00090401u, 0xbf810000u,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 16> AtomicAddLaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0xf0448108u, 0x00090401u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 16> AtomicSwapLaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0xf03c8108u, 0x00090401u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 18> AtomicCmpSwapLaneTableCode{
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
+    0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7e080301u, 0x7e0a0304u, 0x3a080881u, 0xf0408308u,
+    0x00090401u, 0xbf810000u,
+};
+
 alignas(256) constexpr std::array<std::uint32_t, 17> StoreTableCutCode{
     0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0x8f108202u, 0xf4200444u, 0x20000000u, 0x9312b011u,
     0xf42c0802u, 0x24000000u, 0x360200bfu, 0x7e040280u, 0x7da400ffu, 0x00001000u, 0xf0208f08u, 0x00090401u,
@@ -1117,6 +1133,41 @@ void RunStoreTests(AgcDriver::VulkanDevice& device) {
     Require(untouched(), "image table store: a store through a null entry reached an image:\n" + null.log);
 }
 
+void RunAtomicTests(AgcDriver::VulkanDevice& device) {
+    struct Registration {
+        void* data;
+        Registration(void* data, std::size_t bytes) : data(data) { GuestAllocations::Mutation().Add(data, bytes, true, true, true); }
+        ~Registration() { GuestAllocations::Mutation().Remove(data); }
+    } registeredUint(UintTexels.data(), sizeof(UintTexels)), registeredFloat(FloatTexels.data(), sizeof(FloatTexels)), registeredSint(SintTexels.data(), sizeof(SintTexels));
+    SetClassRecords();
+    for (std::uint32_t x = 0; x < Width; ++x) UintTexels[x] = 0x5000u + x;
+    for (std::uint32_t x = 0; x < Width; ++x) FloatTexels[x] = 1.0f;
+    Keys = {};
+    Keys[0] = 1;
+    const auto added = Run(device, AtomicAddLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(added), "image table atomic: an add through a table faulted:\n" + added.log);
+    Require(added.imageTableCount != 0u, "image table atomic: the add bound no storage table elements");
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == 0x5000u + x + x, "image table atomic: texel " + std::to_string(x) + " of the selected image is " + Hex(UintTexels[x]) + ", expected " + Hex(0x5000u + x + x));
+    const auto swapped = Run(device, AtomicSwapLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(swapped), "image table atomic: an exchange through a table faulted:\n" + swapped.log);
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == x, "image table atomic: texel " + std::to_string(x) + " of the selected image is " + Hex(UintTexels[x]) + ", expected " + Hex(x));
+    const auto compared = Run(device, AtomicCmpSwapLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(compared), "image table atomic: a compare exchange through a table faulted:\n" + compared.log);
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == (x ^ 1u), "image table atomic: texel " + std::to_string(x) + " of the selected image is " + Hex(UintTexels[x]) + ", expected " + Hex(x ^ 1u));
+    Keys[0] = 8;
+    const auto addedFloat = Run(device, AtomicAddLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    Require(!Faulted(addedFloat), "image table atomic: an add on a float record through a table faulted:\n" + addedFloat.log);
+    for (std::uint32_t x = 0; x < Width; ++x) Require(std::bit_cast<std::uint32_t>(FloatTexels[x]) == 0x3f800000u + x, "image table atomic: float texel " + std::to_string(x) + " is " + Hex(std::bit_cast<std::uint32_t>(FloatTexels[x])) + ", expected " + Hex(0x3f800000u + x));
+    Keys[0] = 6;
+    const auto null = Run(device, AtomicAddLaneTableCode, 1, Lanes, 64);
+    AgcDriver::Graphics::StorageTexture::FlushAllPending("image table atomic test");
+    for (std::uint32_t x = 0; x < Width; ++x) Require(UintTexels[x] == (x ^ 1u) && std::bit_cast<std::uint32_t>(FloatTexels[x]) == 0x3f800000u + x, "image table atomic: an add through a null entry reached an image:\n" + null.log);
+}
+
 void RunSelectedStoreTests(AgcDriver::VulkanDevice& device) {
     alignas(256) static std::array<std::uint32_t, Width * Height> storeTexels{};
     struct Registration {
@@ -1509,6 +1560,7 @@ int main() {
         RunSelectedRecordTests(*device);
         RunModeTests(*device);
         RunStoreTests(*device);
+        RunAtomicTests(*device);
         RunSelectedStoreTests(*device);
         RunPointerTests(*device);
         RunPointerRecordTests(*device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/IndexedCopy.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/IndexedCopy.cpp
new file mode 100644
index 0000000000..43966bcf5b
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/IndexedCopy.cpp
@@ -0,0 +1,187 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using AgcDriver::DriverDetail::IndexedCopyRange;
+using AgcDriver::DriverDetail::MatchesIndexedCopyKernel;
+
+alignas(256) constexpr std::array<std::uint32_t, 19> Code{0xbfa00001u, 0xd7460000u, 0x04010c0cu, 0xf4201a84u, 0xfa000000u, 0xbf8cc07fu, 0x7da8006au, 0xbf88000au, 0xf4241a84u, 0xfa000004u, 0xbf8cc07fu, 0x4a08006bu, 0x4a00006au, 0xe0382000u, 0x80000000u, 0xbf8c3f70u, 0xe0782000u, 0x80010004u, 0xbf810000u};
+constexpr std::uint32_t Untouched = 0xcafebabeu;
+constexpr std::uint32_t Format = 0x00005204u;
+constexpr std::uint32_t RecordFormat = 0x0004dfacu;
+constexpr std::uint32_t LargeGroups = 16385;
+constexpr std::size_t Words = (std::size_t{LargeGroups} * 64u + 64u) * 4u;
+alignas(256) std::array<std::uint32_t, Words> Source{};
+alignas(256) std::array<std::uint32_t, Words> Destination{};
+alignas(256) std::array<std::uint32_t, 4> Record{};
+
+std::vector<std::uint32_t> UserData(const std::uint32_t* source, std::uint32_t sourceRecords, const std::uint32_t* destination, std::uint32_t destinationRecords, const std::uint32_t* record = Record.data(), std::uint32_t sourceStride = 16, std::uint32_t destinationStride = 16, std::uint32_t recordStride = 16) {
+    const auto from = reinterpret_cast<std::uintptr_t>(source);
+    const auto to = reinterpret_cast<std::uintptr_t>(destination);
+    const auto at = reinterpret_cast<std::uintptr_t>(record);
+    return {static_cast<std::uint32_t>(from), static_cast<std::uint32_t>((from >> 32u) & 0xffffu) | (sourceStride << 16u), sourceRecords, Format,
+            static_cast<std::uint32_t>(to), static_cast<std::uint32_t>((to >> 32u) & 0xffffu) | (destinationStride << 16u), destinationRecords, Format,
+            static_cast<std::uint32_t>(at), static_cast<std::uint32_t>((at >> 32u) & 0xffffu) | (recordStride << 16u), 1u, RecordFormat};
+}
+
+void MatchTests() {
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{64, 1, 1}, 0, {true, false, false}, false, 1};
+    const auto data = UserData(Source.data(), 512, Destination.data(), 512);
+    Require(MatchesIndexedCopyKernel(Code, data, compute), "the indexed copy kernel was not recognized");
+    for (std::size_t word = 0; word < Code.size(); ++word) {
+        auto altered = Code;
+        altered[word] ^= 1u;
+        Require(!MatchesIndexedCopyKernel(altered, data, compute), "a different shader matched the indexed copy kernel (word " + std::to_string(word) + ")");
+    }
+    Require(!MatchesIndexedCopyKernel(std::span(Code).first(18), data, compute), "a truncated shader matched");
+    Require(!MatchesIndexedCopyKernel(Code, UserData(Source.data(), 512, Destination.data(), 512, Record.data(), 4), compute), "a source stride other than 16 matched");
+    Require(!MatchesIndexedCopyKernel(Code, UserData(Source.data(), 512, Destination.data(), 512, Record.data(), 16, 4), compute), "a destination stride other than 16 matched");
+    Require(!MatchesIndexedCopyKernel(Code, UserData(Source.data(), 512, Destination.data(), 512, Record.data(), 16, 16, 4), compute), "a record stride other than 16 matched");
+    auto swizzled = data;
+    swizzled[5] |= 0x80000000u;
+    Require(!MatchesIndexedCopyKernel(Code, swizzled, compute), "a swizzled destination matched");
+    auto formats = data;
+    formats[7] ^= 0x1000u;
+    Require(!MatchesIndexedCopyKernel(Code, formats, compute), "descriptors of different formats matched");
+    const auto both = [&](std::uint32_t word3) {
+        auto changed = data;
+        changed[3] = changed[7] = word3;
+        return MatchesIndexedCopyKernel(Code, changed, compute);
+    };
+    Require(!both(Format | 0x00800000u), "an add-tid descriptor matched");
+    Require(!both(Format | 0x30000000u), "a raw out-of-bounds mode matched");
+    Require(!both(Format | 0x40000000u), "a descriptor of another type matched");
+    auto noRecords = data;
+    noRecords[10] = 0;
+    Require(!MatchesIndexedCopyKernel(Code, noRecords, compute), "a record descriptor without records matched");
+    auto extra = data;
+    extra.push_back(0);
+    Require(!MatchesIndexedCopyKernel(Code, extra, compute), "a different user SGPR count matched (the group id moves)");
+    auto wave32 = compute;
+    wave32.numThreads[0] = 32;
+    Require(!MatchesIndexedCopyKernel(Code, data, wave32), "a group of 32 threads matched");
+    auto noGroup = compute;
+    noGroup.groupIdEnable[0] = false;
+    Require(!MatchesIndexedCopyKernel(Code, data, noGroup), "a dispatch without the group id matched");
+
+    const auto source = reinterpret_cast<std::uintptr_t>(Source.data());
+    const auto destination = reinterpret_cast<std::uintptr_t>(Destination.data());
+    const auto copy = IndexedCopyRange(data, 4, 256, 0, 0);
+    Require(copy && copy->source == source && copy->destination == destination && copy->bytes == 4096, "4 groups were not taken as a copy of 256 elements");
+    const auto offset = IndexedCopyRange(data, 4, 200, 16, 300);
+    Require(offset && offset->source == source + 256 && offset->destination == destination + 4800 && offset->bytes == 3200, "the offsets were not applied in elements");
+    const auto launched = IndexedCopyRange(data, 4, 300, 0, 0);
+    Require(launched && launched->bytes == 4096, "the copy exceeded the launched threads");
+    const auto fewer = IndexedCopyRange(data, 4, 100, 0, 0);
+    Require(fewer && fewer->bytes == 1600, "a count below the launch was not taken as the copy");
+    Require(!IndexedCopyRange(data, 4, 256, 300, 0), "a source window past the records was taken");
+    Require(!IndexedCopyRange(data, 4, 256, 0, 300), "a destination window past the records was taken");
+    Require(!IndexedCopyRange(data, 4, 0, 0, 0), "a copy of 0 elements was taken");
+    Require(!IndexedCopyRange(data, 0, 256, 0, 0), "a copy of 0 groups was taken");
+    Require(IndexedCopyRange(UserData(Source.data(), 16384u * 64u, Destination.data(), 16384u * 64u), 16384, 16384u * 64u, 0, 0).has_value(), "a copy of 16 MiB was refused");
+    Require(!IndexedCopyRange(UserData(Source.data(), LargeGroups * 64u, Destination.data(), LargeGroups * 64u), LargeGroups, LargeGroups * 64u, 0, 0), "a copy above 16 MiB was taken");
+    Require(!IndexedCopyRange(UserData(Source.data() + 1, 512, Destination.data(), 512), 4, 256, 0, 0), "a source not aligned to 16 bytes was taken");
+    Require(!IndexedCopyRange(UserData(Source.data(), 512, Destination.data() + 1, 512), 4, 256, 0, 0), "a destination not aligned to 16 bytes was taken");
+}
+
+std::vector<std::uint32_t> Commands(const std::vector<std::uint32_t>& data, std::uint32_t groups) {
+    std::vector<std::uint32_t> words;
+    const auto registers = [&](std::uint32_t first, std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{64, 1, 1};
+    registers(0x207, shape);
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> resource{(static_cast<std::uint32_t>(data.size()) << 1u) | (1u << 7u)};
+    registers(0x213, resource);
+    registers(0x240, data);
+    words.insert(words.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+    return words;
+}
+
+std::uint64_t Taken() {
+    using namespace AgcDriver::DriverDetail;
+    return copyPathCounts[CopyCpu].load() + copyPathCounts[CopyGpu].load() + copyPathCounts[CopyAliased].load();
+}
+
+void ExecuteTests() {
+    using AgcDriver::DriverDetail::copyPathCounts;
+    using AgcDriver::DriverDetail::CopyShape;
+    struct Case {
+        const char* name;
+        std::uint32_t groups, count, sourceOffset, destinationOffset, sourceRecords, destinationRecords;
+        bool hle;
+    };
+    constexpr std::array<Case, 8> cases{{
+        {"4 groups", 4, 256, 0, 0, 512, 512, true},
+        {"16 groups", 16, 1024, 0, 0, 2048, 2048, true},
+        {"offsets", 4, 200, 16, 300, 512, 512, true},
+        {"count below the launch", 4, 100, 0, 0, 512, 512, true},
+        {"count above the launch", 4, 300, 0, 0, 512, 512, true},
+        {"source window past the records", 4, 256, 300, 0, 512, 512, false},
+        {"destination window past the records", 4, 256, 0, 300, 512, 512, false},
+        {"above 16 MiB", LargeGroups, LargeGroups * 64u, 0, 0, LargeGroups * 64u, LargeGroups * 64u, false},
+    }};
+    const bool hleEnabled = std::getenv("APS5_NO_COPY_HLE") == nullptr;
+    for (const auto& item : cases) {
+        const bool hle = item.hle && hleEnabled;
+        for (std::size_t i = 0; i < Source.size(); ++i) Source[i] = static_cast<std::uint32_t>(i) * 2654435761u + 1u;
+        Destination.fill(Untouched);
+        Record = {item.count, item.sourceOffset, item.destinationOffset, 0u};
+        const auto taken = Taken();
+        const auto refused = copyPathCounts[CopyShape].load();
+        const auto words = Commands(UserData(Source.data(), item.sourceRecords, Destination.data(), item.destinationRecords), item.groups);
+        Packet packet{const_cast<std::uint32_t*>(words.data()), static_cast<std::uint32_t>(words.size()), 0, {}};
+        AgcDriver::Submit(&packet, 0);
+        AgcDriverWaitIdle_nid_postfix();
+        AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(Destination.data()), sizeof(Destination));
+        const std::string where = std::string(" (") + item.name + ")";
+        Require(Taken() - taken == (hle ? 1u : 0u), (hle ? "the copy did not take the HLE path" : "the copy took the HLE path") + where);
+        Require(copyPathCounts[CopyShape].load() - refused == (hle || !hleEnabled ? 0u : 1u), (hle ? "the copy was refused for its shape" : "the copy was not refused for its shape") + where);
+        const auto elements = std::min(item.groups * 64u, item.count);
+        for (std::size_t i = 0; i < Destination.size(); ++i) {
+            const auto element = i / 4u;
+            const bool written = element >= item.destinationOffset && element < std::uint64_t{item.destinationOffset} + elements && element < item.destinationRecords;
+            const auto sourceElement = element - item.destinationOffset + item.sourceOffset;
+            const auto expected = !written ? Untouched : sourceElement < item.sourceRecords ? Source[sourceElement * 4u + i % 4u] : 0u;
+            Require(Destination[i] == expected, "indexed copy mismatch at word " + std::to_string(i) + where + ": got " + std::to_string(Destination[i]) + ", expected " + std::to_string(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        if (std::getenv("APS5_NO_COPY_HLE") == nullptr) MatchTests();
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        ExecuteTests();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("indexed copy tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/IndexedCopyGpuParameters.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/IndexedCopyGpuParameters.cpp
new file mode 100644
index 0000000000..b2878fc79a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/IndexedCopyGpuParameters.cpp
@@ -0,0 +1,150 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <cstdint>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 19> Code{
+    0xbfa00001u, 0xd7460000u, 0x04010c0cu, 0xf4201a84u, 0xfa000000u,
+    0xbf8cc07fu, 0x7da8006au, 0xbf88000au, 0xf4241a84u, 0xfa000004u,
+    0xbf8cc07fu, 0x4a08006bu, 0x4a00006au, 0xe0382000u, 0x80000000u,
+    0xbf8c3f70u, 0xe0782000u, 0x80010004u, 0xbf810000u};
+constexpr std::uint32_t Untouched = 0xcafebabeu;
+constexpr std::size_t Prefix = 16;
+constexpr std::size_t Records = 256;
+alignas(256) std::array<std::uint32_t, Records * 4 + Prefix * 2> Source{}, Destination{};
+alignas(16) std::array<std::uint32_t, 4> Parameters{};
+alignas(256) constexpr std::array<std::uint32_t, 7> AddressWriterCode{0x7e000202u, 0x7e020203u, 0x7e040204u, 0x7e060280u, 0xdc7c8000u, 0x00000003u, 0xbf810000u};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        data = static_cast<std::uint32_t*>(VirtualAlloc(nullptr, Bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        data = static_cast<std::uint32_t*>(std::aligned_alloc(Bytes, Bytes));
+#endif
+        Require(data != nullptr, "cannot allocate parameters");
+        std::fill_n(data, Bytes / 4, 0);
+        GuestAllocations::Mutation().Add(data, Bytes, true, true, true);
+    }
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(data);
+#ifdef _WIN32
+        VirtualFree(data, 0, MEM_RELEASE);
+#else
+        std::free(data);
+#endif
+    }
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+    std::uint32_t* Data() const { return data; }
+
+private:
+    static constexpr std::size_t Bytes = 65536;
+    std::uint32_t* data = nullptr;
+};
+
+std::vector<std::uint32_t> UserData(std::uint32_t sourceRecords, std::uint32_t destinationRecords, const void* parameters = Parameters.data()) {
+    std::vector<std::uint32_t> words;
+    const auto descriptor = [&](const void* pointer, std::uint32_t records, std::uint32_t format) {
+        const auto address = reinterpret_cast<std::uintptr_t>(pointer);
+        words.insert(words.end(), {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), records, format});
+    };
+    descriptor(Source.data() + Prefix, sourceRecords, 0x00005204u);
+    descriptor(Destination.data() + Prefix, destinationRecords, 0x00005204u);
+    descriptor(parameters, 1, 0x0004dfacu);
+    return words;
+}
+
+std::uint64_t Taken() {
+    using namespace AgcDriver::DriverDetail;
+    return copyPathCounts[CopyCpu].load() + copyPathCounts[CopyGpu].load() + copyPathCounts[CopyAliased].load();
+}
+
+std::vector<std::uint32_t> Commands(const std::vector<std::uint32_t>& data, std::uint32_t groups, const void* code = Code.data(), std::uint32_t threads = 64, bool groupId = true) {
+    std::vector<std::uint32_t> words;
+    const auto registers = [&](std::uint32_t first, std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{threads, 1, 1};
+    registers(0x207, shape);
+    const auto address = reinterpret_cast<std::uintptr_t>(code);
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> resource{(static_cast<std::uint32_t>(data.size()) << 1u) | (static_cast<std::uint32_t>(groupId) << 7u)};
+    registers(0x213, resource);
+    registers(0x240, data);
+    words.insert(words.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+    return words;
+}
+
+void GpuParameters() {
+    GuestBlock parameters;
+    parameters.Data()[0] = 1;
+    Destination.fill(Untouched);
+    for (std::size_t i = 0; i < Source.size(); ++i) Source[i] = static_cast<std::uint32_t>(i) * 2654435761u + 1u;
+    const auto address = reinterpret_cast<std::uintptr_t>(parameters.Data());
+    auto words = Commands({static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u), 23, 17, 29}, 1, AddressWriterCode.data(), 1, false);
+    const auto copy = Commands(UserData(Records, Records, parameters.Data()), 1);
+    words.insert(words.end(), copy.begin(), copy.end());
+    const auto taken = Taken();
+    const auto deferred = AgcDriver::Graphics::LeaseCounters().deferred;
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(Destination.data()), sizeof(Destination));
+    const auto deferredAfter = AgcDriver::Graphics::LeaseCounters().deferred;
+    const auto takenAfter = Taken();
+    AgcDriverShutdown_nid_postfix();
+    Require(deferredAfter > deferred, "parameter producer was not deferred");
+    Require(parameters.Data()[0] == 23 && parameters.Data()[1] == 17 && parameters.Data()[2] == 29, "GPU parameter store differs");
+    Require(takenAfter - taken == (std::getenv("APS5_NO_COPY_HLE") == nullptr ? 1u : 0u), "GPU parameter copy did not take the expected path");
+    for (std::size_t i = 0; i < Destination.size(); ++i) {
+        const bool copied = i >= Prefix + 29 * 4 && i < Prefix + (29 + 23) * 4;
+        const auto expected = copied ? Source[i - (29 - 17) * 4] : Untouched;
+        Require(Destination[i] == expected, "GPU parameter copy differs at word " + std::to_string(i));
+    }
+    std::puts("PASS: copy consumes parameters written by a preceding address-based GPU store");
+}
+
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        GpuParameters();
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp
index 9c332e8aaa..913426408a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/InterpolationModes.cpp
@@ -262,6 +262,7 @@ struct Generator {
         if (half) return bits;
         const auto value = std::bit_cast<float>(bits);
         if (!std::isfinite(value) || std::fabs(value) > 65504.0f) return Half();
+        if (value == 0.0f) return bits;
         const auto exponent = std::max(std::ilogb(value) - 10, -24);
         return std::bit_cast<std::uint32_t>(static_cast<float>(std::ldexp(std::nearbyint(std::ldexp(value, -exponent)), exponent)));
     }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp
index c149aa41a9..dd5588f04c 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/JobManagerCompute.cpp
@@ -1,5 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceJobManager/include/Api.hpp"
 #include "VulkanTestDevice.hpp"
 #include "SceTypes.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include <algorithm>
 #include <array>
 #include <atomic>
 #include <chrono>
@@ -11,62 +15,10 @@
 #include <stdexcept>
 #include <string>
 #include <thread>
+#include <vector>
 
 extern "C" void AgcDriverShutdown_nid_postfix();
 
-struct MemorySizeQueryParams {
-    std::uint32_t version;
-    std::uint32_t workers;
-    std::uint32_t sequences;
-    std::uint32_t invocations;
-    std::uint32_t dispatches;
-    std::uint32_t syncPoints;
-    std::uint32_t waits;
-    std::uint32_t computeSequences;
-    std::uint64_t computeQueueMask;
-};
-
-struct ConfigParams {
-    std::uint32_t version;
-    std::uint32_t threadFlags;
-    std::uint32_t stackSize;
-    std::uint32_t priority;
-    const char* threadName;
-    std::uint32_t spinMicroseconds;
-    std::uint32_t computeAffinity;
-    std::uint32_t computePriority;
-    std::uint32_t reserved;
-};
-
-using JobEntry = void (APS5_VABI*)(void*, std::uint32_t);
-
-struct Sequence {
-    APS5_VABI virtual int Dispatch(JobEntry, void*, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int SyncPoint() = 0;
-    APS5_VABI virtual int Wait() = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-    APS5_VABI virtual int DispatchCompute(const void*, void*, std::int32_t, std::int32_t, std::int32_t, const char*) = 0;
-    APS5_VABI virtual int DispatchComputeIndirect(const void*, void*, const void*, const char*) = 0;
-};
-
-struct SequenceFactory {
-    APS5_VABI virtual int Create(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int Destroy(Sequence*) = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-    APS5_VABI virtual int CreateCompute(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int DestroyCompute(Sequence*) = 0;
-};
-
-extern "C" {
-void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void*);
-std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams*);
-int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void*, void*, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint64_t, const ConfigParams*);
-int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void*);
-SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void*, std::uint32_t);
-}
-
 #define Construct _ZN3sce3Job10JobManagerC1Ev
 #define RequiredSize _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE
 #define Initialize _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE
@@ -94,10 +46,10 @@ alignas(256) volatile std::uint32_t Output[4]{};
 alignas(256) std::array<std::uint32_t, 4> OutputDescriptor{};
 alignas(32) std::array<std::uint32_t, 8> IndirectArguments{1, 1, 1, 0, 0, 0, 0, 0};
 alignas(16) std::array<std::uint32_t, 8> Specials{};
-alignas(16) std::array<std::uint32_t, 8> SpecialsWithoutDispatch{};
+alignas(16) std::array<std::uint32_t, 8> SpecialsDefaultModifier{};
 std::array<ShaderRegister, 9> Registers{};
 alignas(16) std::array<unsigned char, 0x80> Shader{};
-alignas(16) std::array<unsigned char, 0x80> ShaderWithoutDispatch{};
+alignas(16) std::array<unsigned char, 0x80> ShaderDefaultModifier{};
 
 std::uint32_t Low(const volatile void* pointer) {
     return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(pointer));
@@ -115,8 +67,8 @@ void BuildShader() {
                   {0x242, Low(OutputDescriptor.data())}, {0x243, High(OutputDescriptor.data())}}};
     Specials[4] = 1;
     const ShaderRegister* registers = Registers.data();
-    for (auto* shader : {&Shader, &ShaderWithoutDispatch}) {
-        const std::uint32_t* specials = shader == &Shader ? Specials.data() : SpecialsWithoutDispatch.data();
+    for (auto* shader : {&Shader, &ShaderDefaultModifier}) {
+        const std::uint32_t* specials = shader == &Shader ? Specials.data() : SpecialsDefaultModifier.data();
         std::memcpy(shader->data() + 0x20, &registers, sizeof(registers));
         std::memcpy(shader->data() + 0x28, &specials, sizeof(specials));
         (*shader)[0x5c] = static_cast<unsigned char>(Registers.size());
@@ -144,10 +96,10 @@ void APS5_VABI Nothing(void*, std::uint32_t) {
 
 void SizeCase() {
     Require(SizeFor(0, 0, false) == 0x10d0 && SizeFor(0, 0, true) == 0x14c0, "size without compute sequences");
-    Require(SizeFor(1, 1, false) == 0x24fd8 && SizeFor(1, 1, true) == 0x253c8, "size with one compute sequence");
-    Require(SizeFor(2, 3, false) == 0x48e20 && SizeFor(2, 3, true) == 0x49210, "size with two compute sequences");
-    Require(SizeFor(3, 7, false) == 0x6cb68, "size with three compute sequences");
-    Require(SizeFor(1, 3, true) == 0x491c8, "size with two queues for one compute sequence");
+    Require(SizeFor(1, 1, false) == 0x29fd8 && SizeFor(1, 1, true) == 0x2a3c8, "size with one compute sequence");
+    Require(SizeFor(2, 3, false) == 0x52de0 && SizeFor(2, 3, true) == 0x531d0, "size with two compute sequences");
+    Require(SizeFor(3, 7, false) == 0x7bb28, "size with three compute sequences");
+    Require(SizeFor(1, 3, true) == 0x53188, "size with two queues for one compute sequence");
     Require(SizeFor(2, 1, true) == 0, "size with fewer queues than compute sequences");
 }
 
@@ -165,9 +117,9 @@ void RunCase() {
     Require(Initialize(manager, memory, size, 2, 1, 1, 2, &wideAffinity) == InvalidArgument, "a handler affinity beyond 13 cores was accepted");
     Require(Initialize(manager, memory, size, 2, 1, 0xffffffffu, 2, nullptr) == InvalidArgument, "a sequence count that wraps was accepted");
     Require(Initialize(manager, memory, size, 2, 1, 1, 2, nullptr) == 0, "initialize with one compute sequence failed");
-    SequenceFactory* factory = Factories(manager, 0);
-    Sequence* sequence = nullptr;
-    Sequence* other = nullptr;
+    ISequenceFactory* factory = Factories(manager, 0);
+    ISequence* sequence = nullptr;
+    ISequence* other = nullptr;
     Require(factory->CreateCompute(&sequence, 100, 4, 4, 2, "compute") == 0, "the compute sequence was not created");
     Require(factory->CreateCompute(&other, 1, 1, 1, 1, "second") == NoneFree, "a second compute sequence was created");
     Require(factory->Create(&other, 1, 1, 1, 1, "cpu") == 0, "the CPU sequence was not created");
@@ -192,24 +144,30 @@ void RunCase() {
     Require(Output[0] == 0x22220002u, "the indirect compute dispatch had not run when the wait returned: " + std::to_string(Output[0]));
 
     Value[0] = 0x33330003u;
-    Require(sequence->DispatchCompute(ShaderWithoutDispatch.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the dispatch of a shader without the dispatch bit failed");
-    Require(sequence->Wait() == 0, "the wait after a shader without the dispatch bit failed");
-    Require(Output[0] == 0x22220002u, "a shader without the dispatch bit ran");
+    Require(sequence->DispatchCompute(ShaderDefaultModifier.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the dispatch with a default modifier failed");
+    Require(sequence->Wait() == 0, "the wait after a default modifier dispatch failed");
+    Require(Output[0] == 0x33330003u, "a default modifier dispatch did not run");
 
+    Value[0] = 0x33330004u;
+    Require(sequence->DispatchComputeIndirect(ShaderDefaultModifier.data(), Table.data(), IndirectArguments.data(), nullptr) == 0, "the indirect dispatch with a default modifier failed");
+    Require(sequence->Wait() == 0, "the wait after an indirect default modifier dispatch failed");
+    Require(Output[0] == 0x33330004u, "an indirect default modifier dispatch did not run");
+
+    Value[0] = 0x33330005u;
     Require(sequence->Dispatch(BlockingJob, nullptr, 1, "blocking") == 0, "the blocking job was not dispatched");
     Require(sequence->SyncPoint() == 0, "the sync point failed");
     Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the compute dispatch behind a sync point failed");
     std::this_thread::sleep_for(std::chrono::milliseconds(200));
-    Require(Output[0] == 0x22220002u, "a compute dispatch ran before the CPU job ahead of its sync point finished");
+    Require(Output[0] == 0x33330004u, "a compute dispatch ran before the CPU job ahead of its sync point finished");
     Released = true;
     Require(sequence->SyncPoint() == 0, "the second sync point failed");
     Require(sequence->Dispatch(ReadOutputJob, nullptr, 1, "reader") == 0, "the reading job was not dispatched");
     Require(sequence->Wait() == 0, "the wait after the ordered dispatches failed");
-    Require(Output[0] == 0x33330003u, "the compute dispatch behind a sync point did not run");
-    Require(SeenByJob == 0x33330003u, "a CPU job behind a sync point ran before the compute dispatch ahead of it finished");
+    Require(Output[0] == 0x33330005u, "the compute dispatch behind a sync point did not run");
+    Require(SeenByJob == 0x33330005u, "a CPU job behind a sync point ran before the compute dispatch ahead of it finished");
 
     Value[0] = 0x44440004u;
-    Require(sequence->DispatchCompute(ShaderWithoutDispatch.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the leading dispatch failed");
+    Require(sequence->DispatchCompute(ShaderDefaultModifier.data(), Table.data(), 1, 1, 1, nullptr) == 0, "the leading dispatch failed");
     Require(sequence->SyncPoint() == 0, "the sync point between compute dispatches failed");
     Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, "behind") == 0, "the compute dispatch behind a compute dispatch failed");
     Require(sequence->Wait() == 0, "the wait after chained compute dispatches failed");
@@ -229,16 +187,127 @@ void RunCase() {
     ::operator delete(memory, std::align_val_t{256});
 }
 
+void CapacityCase() {
+    std::array<ShaderRegister, 255> registers;
+    registers.fill(Registers[2]);
+    std::copy(Registers.begin(), Registers.end(), registers.begin());
+    auto shader = Shader;
+    const ShaderRegister* data = registers.data();
+    std::memcpy(shader.data() + 0x20, &data, sizeof(data));
+    shader[0x5c] = static_cast<unsigned char>(registers.size());
+    const std::string marker(65535, 'm');
+    const MemorySizeQueryParams query{1, 1, 0, 0, 2, 0, 1, 1, 1};
+    const auto size = RequiredSize(&query);
+    const auto allocationSize = (size + 255) & ~std::uint64_t{255};
+    auto* memory = static_cast<std::uint8_t*>(::operator new(allocationSize, std::align_val_t{256}));
+    std::memset(memory, 0, allocationSize);
+    std::memset(memory + size, 0xa5, allocationSize - size);
+    alignas(64) unsigned char manager[0x100]{};
+    Construct(manager);
+    Require(Initialize(manager, memory, size, 1, 0, 1, 1, nullptr) == 0, "capacity manager initialization failed");
+    auto* factory = Factories(manager, 0);
+    ISequence* sequence = nullptr;
+    Require(factory->CreateCompute(&sequence, 0, 2, 0, 1, nullptr) == 0, "capacity sequence creation failed");
+    for (std::uint32_t round = 0; round < 2; ++round) {
+        Value[0] = 0xabcd0000u + round;
+        for (int dispatch = 0; dispatch < 2; ++dispatch)
+            Require(sequence->DispatchCompute(shader.data(), Table.data(), 1, 1, 1, marker.c_str()) == 0, "maximum register and marker dispatch failed");
+        Require(sequence->Wait() == 0, "maximum packet wait failed");
+        Require(Output[0] == Value[0], "maximum packet dispatch did not finish");
+        const auto* words = reinterpret_cast<const std::uint32_t*>(memory);
+        std::uint32_t markers = 0;
+        for (std::size_t offset = 0; offset + 0x4001 <= size / 4; ++offset) {
+            if (words[offset] != 0xffff102cu) continue;
+            Require(std::memcmp(words + offset + 1, marker.c_str(), marker.size() + 1) == 0, "maximum marker was truncated");
+            ++markers;
+        }
+        Require(markers == 2, "the maximum markers were not stored in the command area");
+    }
+    Require(factory->DestroyCompute(sequence) == 0, "capacity sequence destruction failed");
+    Require(Shutdown(manager) == 0, "capacity manager shutdown failed");
+    for (auto offset = size; offset < allocationSize; ++offset)
+        Require(memory[offset] == 0xa5, "maximum packets escaped the supplied work area");
+    ::operator delete(memory, std::align_val_t{256});
 }
 
-int main() {
+void StorageCase(bool directMemory) {
+    constexpr std::uint64_t mask = (1u << 1) | (1u << 5) | (1u << 8);
+    const MemorySizeQueryParams query{1, 2, 0, 0, 32, 8, 4, 2, mask};
+    const auto size = RequiredSize(&query);
+    const auto allocationSize = (size + 0xffff) & ~std::uint64_t{0xffff};
+    std::int64_t physical = 0;
+    void* memory = nullptr;
+    if (directMemory) {
+        Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, allocationSize, 0x10000, 0, &physical) == 0, "direct work area allocation failed");
+        Require(sceKernelMapDirectMemory(&memory, allocationSize, 0x33, 0, physical, 0x10000) == 0, "direct work area mapping failed");
+    } else {
+        memory = ::operator new(allocationSize, std::align_val_t{256});
+    }
+    {
+        const GuestArena::HostWrite destination(memory, allocationSize);
+        std::memset(memory, 0, allocationSize);
+        std::memset(static_cast<std::uint8_t*>(memory) + size, 0xa5, allocationSize - size);
+    }
+    alignas(64) unsigned char manager[0x100]{};
+    Construct(manager);
+    Require(Initialize(manager, memory, size, 2, 0, 2, mask, nullptr) == 0, "storage manager initialization failed");
+    auto* factory = Factories(manager, 0);
+    std::array<ISequence*, 2> sequences{};
+    for (auto& sequence : sequences) Require(factory->CreateCompute(&sequence, 0, 16, 4, 2, nullptr) == 0, "storage sequence creation failed");
+    for (std::uint32_t round = 0; round < 3; ++round) {
+        for (auto* sequence : sequences) {
+            Value[0] = 0x56780000u + round;
+            for (int dispatch = 0; dispatch < 8; ++dispatch)
+                Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, "batch") == 0, "batched dispatch failed");
+            Require(sequence->Wait() == 0, "batched wait failed");
+            Require(Output[0] == Value[0], "batched work was not visible after wait");
+            Require(sequence->Wait() == 0, "empty wait after a batch failed");
+        }
+        const auto* words = static_cast<const std::uint32_t*>(memory);
+        const auto base = reinterpret_cast<std::uintptr_t>(memory);
+        std::vector<std::uintptr_t> labels;
+        for (std::size_t index = 0; index + 8 <= size / 4; ++index) {
+            if (words[index] != 0xc0064900u || (words[index + 2] & 0xe7000000u) != 0x22000000u) continue;
+            const auto address = words[index + 3] | (std::uint64_t{words[index + 4]} << 32);
+            Require(address >= base && address + 8 <= base + size && (address & 7) == 0, "a completion label is outside the caller's work area");
+            Require(words[index + 5] == 8 * (round + 1) && words[index + 6] == 0, "a completion did not publish the batched 32-bit count");
+            Require(*reinterpret_cast<const volatile std::uint64_t*>(address) == words[index + 5], "a published batch was not retired");
+            labels.push_back(address);
+        }
+        Require(labels.size() == 2 && labels[0] != labels[1], "each queue must store one batch completion in the caller's work area");
+    }
+    for (auto* sequence : sequences) Require(factory->DestroyCompute(sequence) == 0, "storage sequence destruction failed");
+    for (auto& sequence : sequences) {
+        Require(factory->CreateCompute(&sequence, 0, 16, 4, 2, nullptr) == 0, "storage sequence reuse failed");
+        Require(sequence->DispatchCompute(Shader.data(), Table.data(), 1, 1, 1, nullptr) == 0, "dispatch after sequence reuse failed");
+        Require(factory->DestroyCompute(sequence) == 0, "destroy did not wait for reused sequence work");
+    }
+    Require(Shutdown(manager) == 0, "storage manager shutdown failed");
+    const auto* bytes = static_cast<const std::uint8_t*>(memory);
+    for (auto offset = size; offset < allocationSize; ++offset)
+        Require(bytes[offset] == 0xa5, "the manager wrote beyond its supplied work area");
+    if (directMemory) Require(sceKernelReleaseDirectMemory(physical, allocationSize) == 0, "direct work area release failed");
+    else ::operator delete(memory, std::align_val_t{256});
+}
+
+}
+
+int RunJobManagerCase(const char* name) {
     try {
+        Require(std::strcmp(name, "compute") == 0 || std::strcmp(name, "size") == 0 || std::strcmp(name, "execution") == 0 || std::strcmp(name, "storage") == 0 || std::strcmp(name, "capacity") == 0, "unknown compute fixture");
+#ifndef ANYPS5_JOB_MANAGER_REFERENCE
         auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
         device.reset();
+#endif
         BuildShader();
-        SizeCase();
-        RunCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "size") == 0) SizeCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "execution") == 0) RunCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "capacity") == 0) CapacityCase();
+        if (std::strcmp(name, "compute") == 0 || std::strcmp(name, "storage") == 0) {
+            StorageCase(false);
+            StorageCase(true);
+        }
         AgcDriverShutdown_nid_postfix();
         std::cout << "job manager compute test passed\n";
         return 0;
@@ -252,3 +321,10 @@ int main() {
         return 1;
     }
 }
+
+#ifndef ANYPS5_JOB_MANAGER_REFERENCE
+int main(int argc, char** argv) {
+    if (argc > 2) return 2;
+    return RunJobManagerCase(argc == 2 ? argv[1] : "compute");
+}
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LazyResolvedAbi.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LazyResolvedAbi.cpp
new file mode 100644
index 0000000000..aad7c87ddb
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LazyResolvedAbi.cpp
@@ -0,0 +1,636 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/ShaderPreparationScope.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <chrono>
+#include <random>
+#include <set>
+#include <sstream>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <initializer_list>
+#include <iostream>
+#include <iterator>
+#include <map>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Textures = 16;
+constexpr std::uint32_t VertexBuffers = 3;
+constexpr std::uint32_t MaxDraws = 2048;
+constexpr std::uint32_t Format8888UNorm = 56;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::uint32_t ClampEdge = 2;
+constexpr std::uint32_t TexelByte = 4;
+constexpr std::size_t SrtOffset = 0;
+constexpr std::size_t SamplerOffset = 0x200;
+constexpr std::size_t FrameConstantsOffset = 0x210;
+constexpr std::size_t VertexTableOffset = 0x300;
+constexpr std::size_t FrameDataOffset = 0x400;
+constexpr std::size_t VertexDataOffset = 0x800;
+constexpr std::size_t TextureOffset = 0x1000;
+constexpr std::size_t TextureBytes = 4096;
+constexpr std::size_t ObjectOffset = TextureOffset + Textures * TextureBytes;
+constexpr std::size_t ObjectBytes = 256;
+constexpr std::size_t ColorOffset = (ObjectOffset + MaxDraws * ObjectBytes + 65535) & ~static_cast<std::size_t>(65535);
+constexpr std::size_t ColorBytes = 65536;
+constexpr std::uint32_t RenderTargetTileMode = 0x1b;
+constexpr std::size_t BlockBytes = (ColorOffset + ColorBytes + 65535) & ~static_cast<std::size_t>(65535);
+
+alignas(256) constexpr std::array<std::uint32_t, 40> VertexCode{
+    0x7e000d05u, 0x080200f4u, 0x10020300u, 0x100202f4u, 0x060202f3u, 0x060400f3u, 0x10040500u, 0x060404f3u,
+    0x7e060280u, 0x7e0802f2u,
+    0xf4080100u, 0xfa000000u, 0xf4080200u, 0xfa000010u, 0xf4080300u, 0xfa000020u,
+    0xbf8cc07fu,
+    0xe00c2000u, 0x80010a05u, 0xe00c2000u, 0x80020e05u, 0xe00c2000u, 0x80031205u,
+    0xbf8c3f70u,
+    0x0602030au, 0x0604050bu, 0x0606070cu, 0x0608090du,
+    0x0602030eu, 0x0604050fu, 0x06060710u, 0x06080911u,
+    0x06020312u, 0x06040513u, 0x06060714u, 0x06080915u,
+    0xf80008cfu, 0x04030201u,
+    0xbf810000u, 0xbf810000u,
+};
+
+constexpr std::size_t PixelWords = 10 + Textures * 10 + 5 + 8 + 3;
+
+constexpr std::array<std::uint32_t, PixelWords> MakePixelCode() {
+    std::array<std::uint32_t, PixelWords> code{};
+    std::size_t n = 0;
+    for (const auto word : {0xf4080200u, 0xfa000200u, 0xf4080300u, 0xfa000210u, 0x7e0002f0u, 0x7e0202f0u, 0x7e100280u, 0x7e120280u, 0x7e140280u, 0x7e160280u}) code[n++] = word;
+    for (std::uint32_t texture = 0; texture < Textures; ++texture) {
+        for (const auto word : {0xf40c0400u, 0xfa000000u | (texture * 32u), 0xbf8cc07fu, 0xf09c0f08u, 0x00440400u, 0xbf8c3f70u, 0x06101104u, 0x06121305u, 0x06141506u, 0x06161707u}) code[n++] = word;
+    }
+    for (const auto word : {0xf4200606u, 0xfa000000u, 0xf4200642u, 0xfa000000u, 0xbf8cc07fu}) code[n++] = word;
+    for (const auto word : {0x10101018u, 0x10121218u, 0x10141418u, 0x10161618u, 0x10101019u, 0x10121219u, 0x10141419u, 0x10161619u}) code[n++] = word;
+    for (const auto word : {0xf800180fu, 0x0b0a0908u, 0xbf810000u}) code[n++] = word;
+    return code;
+}
+
+alignas(256) constexpr std::array<std::uint32_t, PixelWords> PixelCode = MakePixelCode();
+
+struct Header {
+    Shader shader{};
+    ShaderUserData userData{};
+};
+
+alignas(8) Header VertexHeader{};
+alignas(8) Header PixelHeader{};
+
+void Register(Header& header, const std::uint32_t* code, std::size_t bytes, std::uint8_t type) {
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(Header);
+    header.shader.shader_size = static_cast<std::uint32_t>(bytes);
+    header.shader.code = code;
+    header.shader.type = type;
+    header.shader.user_data = &header.userData;
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(BlockBytes, 65536));
+        if (block != nullptr) GuestArena::GuestArenaCommit_nid_postfix(block, BlockBytes, PAGE_READWRITE, BlockBytes);
+#else
+        constexpr std::uintptr_t alignment = 65536;
+        void* mapped = mmap(nullptr, BlockBytes + alignment, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (mapped != MAP_FAILED) {
+            const auto begin = reinterpret_cast<std::uintptr_t>(mapped);
+            const auto aligned = (begin + alignment - 1) & ~(alignment - 1);
+            if (aligned != begin) munmap(mapped, aligned - begin);
+            if (aligned + BlockBytes != begin + BlockBytes + alignment) munmap(reinterpret_cast<void*>(aligned + BlockBytes), begin + alignment - aligned);
+            block = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(block, BlockBytes);
+        }
+#endif
+        Require(block != nullptr, "lazy resolved ABI: cannot allocate the guest block");
+        std::memset(block, 0, BlockBytes);
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint64_t At(std::size_t offset) const { return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(block + offset)); }
+    std::uint8_t* Bytes(std::size_t offset) const { return block + offset; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+struct Layout {
+    const GuestBlock& data;
+    const GuestBlock& textures;
+    const GuestBlock& target;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(std::uint64_t address, std::uint32_t stride, std::uint32_t records, std::uint32_t word3) {
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), records, word3};
+}
+
+void Prepare(const Layout& layout) {
+    const auto& block = layout.data;
+    for (std::uint32_t texture = 0; texture < Textures; ++texture) {
+        const auto address = layout.textures.At(TextureOffset + texture * TextureBytes);
+        std::memset(layout.textures.Bytes(TextureOffset + texture * TextureBytes), static_cast<int>(TexelByte), TextureBytes);
+        const std::array<std::uint32_t, 8> words{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format8888UNorm << 20u) | (3u << 30u), 7u << 14u, 0xfacu | (Type2D << 28u), 0u, 0u, 0u, 0u};
+        std::memcpy(block.Bytes(SrtOffset + texture * 32u), words.data(), sizeof(words));
+    }
+    const std::array<std::uint32_t, 4> sampler{ClampEdge | (ClampEdge << 3u) | (ClampEdge << 6u), 0u, 0u, 0u};
+    std::memcpy(block.Bytes(SamplerOffset), sampler.data(), sizeof(sampler));
+    const auto frame = BufferDescriptor(block.At(FrameDataOffset), 0, 256, 0x31016facu);
+    std::memcpy(block.Bytes(FrameConstantsOffset), frame.data(), sizeof(frame));
+    const float one = 1.0f;
+    std::memcpy(block.Bytes(FrameDataOffset), &one, sizeof(one));
+    for (std::uint32_t buffer = 0; buffer < VertexBuffers; ++buffer) {
+        const auto vertices = BufferDescriptor(block.At(VertexDataOffset + buffer * 0x100u), 16, 3, 0x0104dfacu);
+        std::memcpy(block.Bytes(VertexTableOffset + buffer * 16u), vertices.data(), sizeof(vertices));
+    }
+    for (std::uint32_t draw = 0; draw < MaxDraws; ++draw) std::memcpy(block.Bytes(ObjectOffset + draw * ObjectBytes), &one, sizeof(one));
+}
+
+void Append(std::vector<std::uint32_t>& commands, std::uint32_t opcode, std::initializer_list<std::uint32_t> payload) {
+    commands.push_back(0xc0000000u | (static_cast<std::uint32_t>(payload.size() - 1) << 16u) | (opcode << 8u));
+    commands.insert(commands.end(), payload);
+}
+
+constexpr std::pair<std::uint32_t, std::uint32_t> PrimitiveType{0x242, 4};
+
+std::vector<std::pair<std::uint32_t, std::uint32_t>> DrawContext(const Layout& layout, std::uint32_t blend = 0) {
+    const auto color = layout.target.At(ColorOffset);
+    const float scale = 32.0f;
+    return {
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000u | (RenderTargetTileMode << 14u)}, {0x1e0, blend},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x318, static_cast<std::uint32_t>(color >> 8u)}, {0x390, static_cast<std::uint32_t>(color >> 40u)},
+        {0x10f, std::bit_cast<std::uint32_t>(scale)}, {0x110, std::bit_cast<std::uint32_t>(scale)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+        {0x2fe, 0}, {0x302, 0}, {0x306, 0}, {0x30a, 0},
+    };
+}
+
+std::vector<std::uint32_t> Commands(const Layout& layout, std::uint32_t draws, std::uintptr_t pixel = reinterpret_cast<std::uintptr_t>(PixelCode.data()), std::uint32_t blend = 0) {
+    const auto& block = layout.data;
+    const auto vertex = reinterpret_cast<std::uintptr_t>(VertexCode.data());
+    const auto srt = block.At(SrtOffset);
+    const auto table = block.At(VertexTableOffset);
+    const auto context = DrawContext(layout, blend);
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> shader{
+        {0xc8, static_cast<std::uint32_t>(vertex >> 8u)}, {0xc9, static_cast<std::uint32_t>(vertex >> 40u)}, {0x8b, 2u << 1u},
+        {0x8c, static_cast<std::uint32_t>(table)}, {0x8d, static_cast<std::uint32_t>(table >> 32u)},
+        {0x008, static_cast<std::uint32_t>(pixel >> 8u)}, {0x009, static_cast<std::uint32_t>(pixel >> 40u)}, {0x00b, 8u << 1u},
+        {0x00c, static_cast<std::uint32_t>(srt)}, {0x00d, static_cast<std::uint32_t>(srt >> 32u)}, {0x00e, 0}, {0x00f, 0},
+    };
+    std::vector<std::uint32_t> commands;
+    Append(commands, 0x79, {PrimitiveType.first, PrimitiveType.second});
+    for (const auto& [offset, value] : context) Append(commands, 0x69, {offset, value});
+    for (const auto& [offset, value] : shader) Append(commands, 0x76, {offset, value});
+    for (std::uint32_t draw = 0; draw < draws; ++draw) {
+        const auto object = BufferDescriptor(block.At(ObjectOffset + draw * ObjectBytes), 0, 16, 0x31016facu);
+        Append(commands, 0x76, {0x010, object[0], object[1], object[2], object[3]});
+        Append(commands, 0x2d, {3, 2});
+    }
+    return commands;
+}
+
+double Submit(std::vector<std::uint32_t>& commands) {
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0, {}};
+    const auto start = std::chrono::steady_clock::now();
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "lazy resolved ABI: the draw submission failed");
+    AgcDriverWaitIdle_nid_postfix();
+    return std::chrono::duration<double, std::micro>(std::chrono::steady_clock::now() - start).count();
+}
+
+unsigned ColorByte(const GuestBlock& block) {
+    AgcDriver::GuestMemory::FlushGpuWrites(static_cast<std::uintptr_t>(block.At(ColorOffset)), ColorBytes);
+    unsigned brightest = 0;
+    for (std::size_t i = 0; i < ColorBytes; ++i) brightest = std::max(brightest, static_cast<unsigned>(block.Bytes(ColorOffset)[i]));
+    return brightest;
+}
+
+void Check(const Layout& layout) {
+    std::memset(layout.target.Bytes(ColorOffset), 0, ColorBytes);
+    auto commands = Commands(layout, 16);
+    Submit(commands);
+    const auto byte = ColorByte(layout.target);
+    Require(byte == Textures * TexelByte, "lazy resolved ABI: 16 draws sampling 16 textures of byte " + std::to_string(TexelByte) + " wrote " + std::to_string(byte) + ", expected " + std::to_string(Textures * TexelByte));
+}
+
+
+std::vector<std::uint32_t> SyntheticPixelCode(std::uint32_t index, std::uint32_t blocks) {
+    std::vector<std::uint32_t> code;
+    code.reserve(PixelCode.size() + 2 + blocks * 8);
+    code.push_back(0x7e1802ffu);
+    code.push_back(0x3f800000u + index);
+    for (const auto word : PixelCode) {
+        if (word == 0xf800180fu) {
+            for (std::uint32_t block = 0; block < blocks; ++block) {
+                for (const auto multiply : {0x10101018u, 0x10121218u, 0x10141418u, 0x10161618u, 0x10101019u, 0x10121219u, 0x10141419u, 0x10161619u}) code.push_back(multiply);
+            }
+        }
+        code.push_back(word);
+    }
+    return code;
+}
+
+struct SyntheticHeader {
+    Shader shader{};
+    ShaderUserData userData{};
+    std::array<ShaderRegister, 4> registers{};
+    std::array<ShaderRegister, 1> context{{{0x1b6, 0}}};
+};
+
+struct Synthetic {
+    SyntheticHeader header;
+    std::uint32_t* code = nullptr;
+};
+
+class ProgramArena {
+public:
+    explicit ProgramArena(std::size_t size) : bytes((size + 65535u) & ~std::size_t{65535}) {
+#ifdef _WIN32
+        base = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, 65536));
+        if (base != nullptr) GuestArena::GuestArenaCommit_nid_postfix(base, bytes, PAGE_READWRITE, bytes);
+#else
+        void* mapped = mmap(nullptr, bytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        base = mapped != MAP_FAILED ? static_cast<std::uint8_t*>(mapped) : nullptr;
+#endif
+        Require(base != nullptr, "lazy resolved ABI: cannot allocate the program arena");
+        GuestAllocations::Mutation().Add(base, bytes, true, true, true);
+    }
+    ProgramArena(const ProgramArena&) = delete;
+    ProgramArena& operator=(const ProgramArena&) = delete;
+    std::uint32_t* Place(std::span<const std::uint32_t> code) {
+        const auto aligned = (used + 255u) & ~std::size_t{255};
+        Require(aligned + code.size_bytes() <= bytes, "lazy resolved ABI: the program arena is full");
+        auto* destination = reinterpret_cast<std::uint32_t*>(base + aligned);
+        std::memcpy(destination, code.data(), code.size_bytes());
+        used = aligned + code.size_bytes();
+        return destination;
+    }
+
+private:
+    std::size_t bytes;
+    std::size_t used = 0;
+    std::uint8_t* base = nullptr;
+};
+
+void RegisterHeader(Synthetic& program, std::uint32_t* code, std::size_t words) {
+    program.code = code;
+    const auto address = reinterpret_cast<std::uintptr_t>(program.code);
+    auto& header = program.header;
+    header.registers = {{{0x008, static_cast<std::uint32_t>(address >> 8u)}, {0x009, static_cast<std::uint32_t>(address >> 40u)}, {0x00b, 8u << 1u}, {0x00a, 0}}};
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18u;
+    header.shader.header_size = sizeof(SyntheticHeader);
+    header.shader.shader_size = static_cast<std::uint32_t>(words * sizeof(std::uint32_t));
+    header.shader.code = program.code;
+    header.shader.type = 1;
+    header.shader.user_data = &header.userData;
+    header.shader.sh_registers = header.registers.data();
+    header.shader.num_sh_registers = static_cast<std::uint32_t>(header.registers.size());
+    header.shader.cx_registers = header.context.data();
+    header.shader.num_cx_registers = static_cast<std::uint32_t>(header.context.size());
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+}
+
+void RegisterSynthetic(Synthetic& program, ProgramArena& arena, const std::vector<std::uint32_t>& code) {
+    RegisterHeader(program, arena.Place(code), code.size());
+}
+
+constexpr std::uint32_t Programs = 4;
+constexpr std::uint32_t Drawn = 2;
+
+void SetEnvironment(const char* name, const std::string& value) {
+#ifdef _WIN32
+    _putenv_s(name, value.c_str());
+#else
+    setenv(name, value.c_str(), 1);
+#endif
+}
+
+void ClearEnvironment(const char* name) {
+#ifdef _WIN32
+    _putenv_s(name, "");
+#else
+    unsetenv(name);
+#endif
+}
+
+void Settle(std::span<const Synthetic> programs) {
+    std::vector<const Shader*> registered;
+    for (const auto& program : programs) registered.push_back(&program.header.shader);
+    AgcDriverEndShaderPreparation_nid_postfix(AgcDriverBeginShaderPreparation_nid_postfix(registered.data(), registered.size()));
+    AgcDriverWaitIdle_nid_postfix();
+}
+
+std::vector<std::uint8_t> Draw(const Layout& layout, const Synthetic& program) {
+    std::memset(layout.target.Bytes(ColorOffset), 0, ColorBytes);
+    auto commands = Commands(layout, 1, reinterpret_cast<std::uintptr_t>(program.code));
+    Submit(commands);
+    AgcDriver::GuestMemory::FlushGpuWrites(static_cast<std::uintptr_t>(layout.target.At(ColorOffset)), ColorBytes);
+    return {layout.target.Bytes(ColorOffset), layout.target.Bytes(ColorOffset) + ColorBytes};
+}
+
+std::size_t Entries(const Synthetic& program) {
+    return AgcDriver::DriverDetail::Driver::Get().PreparedEntries(&program.header.shader);
+}
+
+std::string Uses(const AgcDriver::DriverDetail::Driver::DeferredAbiUseCounts& uses) {
+    return std::to_string(uses.firstUses) + " first uses, " + std::to_string(uses.found) + " found, " + std::to_string(uses.own) + " own, " + std::to_string(uses.unmatchedEntries) + " of " + std::to_string(uses.entries) + " entries unmatched";
+}
+
+constexpr std::uint32_t Matching = Programs;
+constexpr std::uint32_t Twice = Programs + 1;
+constexpr std::uint32_t Replaced = Programs + 2;
+constexpr std::uint32_t Replacement = Programs + 3;
+constexpr std::array<std::uint32_t, 6> DrawnPrograms{0, 1, Matching, Twice, Replaced, Replacement};
+
+bool RegistrationAbi(std::uint32_t index) {
+    return index < Programs || index == Twice;
+}
+
+using Report = std::map<std::string, std::string>;
+
+std::string Text(std::span<const std::array<std::uint64_t, 2>> hashes) {
+    std::string text = std::to_string(hashes.size());
+    char word[40];
+    for (const auto& hash : hashes) {
+        std::snprintf(word, sizeof(word), " %016llx%016llx", static_cast<unsigned long long>(hash[1]), static_cast<unsigned long long>(hash[0]));
+        text += word;
+    }
+    return text;
+}
+
+std::string Text(const std::array<std::uint64_t, 4>& libraries) {
+    std::string text;
+    for (const auto count : libraries) text += (text.empty() ? "" : " ") + std::to_string(count);
+    return text;
+}
+
+std::size_t Count(const std::string& text) {
+    return static_cast<std::size_t>(std::stoull(text.substr(0, text.find(' '))));
+}
+
+std::vector<std::string> Prints(const std::string& text) {
+    std::vector<std::string> prints;
+    std::istringstream stream(text);
+    std::string word;
+    stream >> word;
+    while (stream >> word) prints.push_back(word);
+    std::ranges::sort(prints);
+    return prints;
+}
+
+std::string Joined(std::span<const std::string> prints) {
+    std::string text = std::to_string(prints.size());
+    for (const auto& print : prints) text += " " + print;
+    return text;
+}
+
+std::vector<std::string> EagerResolutionEntries(const Report& eager, std::uint32_t index) {
+    const auto id = std::to_string(index);
+    const auto registered = Prints(eager.at("registered " + id));
+    const auto drawn = Prints(eager.at("drawn " + id));
+    if (RegistrationAbi(index)) return drawn;
+    std::vector<std::string> made;
+    std::ranges::set_difference(drawn, registered, std::back_inserter(made));
+    return made;
+}
+
+Report Scenario(const Layout& layout, std::vector<std::uint8_t>& first, std::array<AgcDriver::DriverDetail::Driver::DeferredAbiUseCounts, 3>* uses = nullptr) {
+    auto& driver = AgcDriver::DriverDetail::Driver::Get();
+    Report report;
+    report["libraries before"] = Text(driver.PrebuiltLibraries());
+    ProgramArena arena(1u << 20u);
+    std::vector<Synthetic> programs(Replacement + 1);
+    const auto record = [&](const char* phase, std::uint32_t index) {
+        report[std::string(phase) + " " + std::to_string(index)] = Text(driver.PreparedEntryHashes(&programs[index].header.shader));
+    };
+    const auto resolved = std::span(programs).first(Replaced + 1);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) RegisterSynthetic(programs[index], arena, SyntheticPixelCode(index + 1, 0));
+    Settle(resolved);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) record("registered", index);
+    std::vector<ShaderRegister> context;
+    for (const auto& [offset, value] : DrawContext(layout)) context.push_back({offset, value});
+    std::array<ShaderRegister, 1> primitive{{{PrimitiveType.first, PrimitiveType.second}}};
+    for (std::uint32_t index = 0; index < Programs; ++index) AgcDriverResolveShaderAbi_nid_postfix(&programs[index].header.shader, {}, {});
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Matching].header.shader, context, primitive);
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Twice].header.shader, {}, {});
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Twice].header.shader, context, primitive);
+    AgcDriverResolveShaderAbi_nid_postfix(&programs[Replaced].header.shader, context, primitive);
+    for (auto& reg : context) reg.value = ~reg.value;
+    primitive.front().value = ~primitive.front().value;
+    Settle(resolved);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) record("resolved", index);
+    report["libraries resolved"] = Text(driver.PrebuiltLibraries());
+    RegisterHeader(programs[Replacement], programs[Replaced].code, programs[Replaced].header.shader.shader_size / sizeof(std::uint32_t));
+    Settle(std::span(programs).subspan(Replacement, 1));
+    record("registered", Replacement);
+    const auto draw = [&](std::uint32_t index, const Synthetic& program) {
+        auto bytes = Draw(layout, program);
+        Require(std::ranges::any_of(bytes, [](std::uint8_t byte) { return byte != 0; }), "lazy resolved ABI: drawn shader " + std::to_string(index) + " wrote nothing");
+        if (index == 0) first = std::move(bytes);
+    };
+    const auto count = [&](std::size_t slot) {
+        if (uses != nullptr) (*uses)[slot] = AgcDriver::DriverDetail::Driver::DeferredAbiUses();
+    };
+    count(0);
+    for (const auto index : {0u, 1u}) draw(index, programs[index]);
+    count(1);
+    draw(Matching, programs[Matching]);
+    count(2);
+    draw(Twice, programs[Twice]);
+    draw(Replacement, programs[Replacement]);
+    AgcDriverRegisterShader_nid_postfix(&programs[Replaced].header.shader);
+    draw(Replaced, programs[Replaced]);
+    for (std::uint32_t index = 0; index <= Replacement; ++index) record("drawn", index);
+    report["libraries drawn"] = Text(driver.PrebuiltLibraries());
+    return report;
+}
+
+std::filesystem::path ReportPath(const std::filesystem::path& reference) {
+    auto path = reference;
+    path += ".report";
+    return path;
+}
+
+std::set<std::string> CacheFiles(const std::filesystem::path& cache) {
+    std::set<std::string> files;
+    for (const auto& entry : std::filesystem::recursive_directory_iterator(cache)) {
+        if (entry.is_regular_file() && entry.path().filename().string().rfind("vk-pipelines-", 0) != 0) files.insert(std::filesystem::relative(entry.path(), cache).generic_string());
+    }
+    return files;
+}
+
+void EagerReference(const Layout& layout, const std::filesystem::path& output) {
+    std::vector<std::uint8_t> bytes;
+    const auto report = Scenario(layout, bytes);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) Require(Count(report.at("resolved " + std::to_string(index))) != 0, "lazy resolved ABI: eager preparation left resolved shader " + std::to_string(index) + " unprepared");
+    std::ofstream file(output, std::ios::binary | std::ios::trunc);
+    file.write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+    Require(file.good(), "lazy resolved ABI: cannot write the eager reference");
+    std::ofstream text(ReportPath(output), std::ios::trunc);
+    for (const auto& [key, value] : report) text << key << '=' << value << '\n';
+    Require(text.good(), "lazy resolved ABI: cannot write the eager report");
+}
+
+void LazyResolution(const Layout& layout, const std::filesystem::path& reference, const std::set<std::string>& cached, const std::filesystem::path& cache) {
+    std::vector<std::uint8_t> expected(ColorBytes);
+    {
+        std::ifstream file(reference, std::ios::binary);
+        file.read(reinterpret_cast<char*>(expected.data()), static_cast<std::streamsize>(expected.size()));
+        Require(file.gcount() == static_cast<std::streamsize>(expected.size()), "lazy resolved ABI: the eager reference is missing or short");
+    }
+    Report eager;
+    {
+        std::ifstream text(ReportPath(reference));
+        for (std::string line; std::getline(text, line);) {
+            const auto split = line.find('=');
+            if (split != std::string::npos) eager[line.substr(0, split)] = line.substr(split + 1);
+        }
+        Require(eager.contains("libraries drawn"), "lazy resolved ABI: the eager report is missing or short");
+    }
+    std::vector<std::uint8_t> first;
+    std::array<AgcDriver::DriverDetail::Driver::DeferredAbiUseCounts, 3> uses{};
+    const auto lazy = Scenario(layout, first, &uses);
+    for (std::uint32_t index = 0; index <= Replaced; ++index) {
+        const auto key = "resolved " + std::to_string(index);
+        Require(Count(lazy.at(key)) == 0, "lazy resolved ABI: ResolveShaderAbi prepared " + std::to_string(Count(lazy.at(key))) + " entries for shader " + std::to_string(index) + " under APS5_LAZY_SHADER_PREPARE");
+    }
+    Require(lazy.at("libraries resolved") == lazy.at("libraries before"), "lazy resolved ABI: ResolveShaderAbi built pipeline libraries under APS5_LAZY_SHADER_PREPARE (" + lazy.at("libraries before") + " before, " + lazy.at("libraries resolved") + " after)");
+    for (std::uint32_t index = 0; index <= Replacement; ++index) Require(Count(lazy.at("registered " + std::to_string(index))) == 0, "lazy resolved ABI: registration prepared shader " + std::to_string(index) + " under APS5_LAZY_SHADER_PREPARE");
+    for (const auto index : DrawnPrograms) {
+        const auto expected = EagerResolutionEntries(eager, index);
+        const auto held = Prints(lazy.at("drawn " + std::to_string(index)));
+        Require(held == expected, "lazy resolved ABI: drawn shader " + std::to_string(index) + " holds other prepared entries than eager resolution and its draw made (eager " + Joined(expected) + "; lazy " + Joined(held) + ")");
+    }
+    for (std::uint32_t index = Drawn; index < Programs; ++index) {
+        const auto key = "drawn " + std::to_string(index);
+        Require(Count(lazy.at(key)) == 0, "lazy resolved ABI: shader " + std::to_string(index) + ", which never drew, holds " + std::to_string(Count(lazy.at(key))) + " prepared entries");
+    }
+    const auto& [start, unmatched, matched] = uses;
+    Require(unmatched.firstUses - start.firstUses == Drawn && unmatched.own - start.own == Drawn && unmatched.found == start.found, "lazy resolved ABI: draws whose state differs from the resolved ABI did not count as preparing their own artifact (before: " + Uses(start) + "; after: " + Uses(unmatched) + ")");
+    Require(unmatched.entries > start.entries && unmatched.unmatchedEntries - start.unmatchedEntries == unmatched.entries - start.entries, "lazy resolved ABI: entries prepared for an ABI no draw used do not count as unmatched (before: " + Uses(start) + "; after: " + Uses(unmatched) + ")");
+    Require(matched.firstUses == unmatched.firstUses + 1 && matched.found == unmatched.found + 1 && matched.own == unmatched.own, "lazy resolved ABI: a draw whose state matches the resolved ABI did not count as finding its artifact (before: " + Uses(unmatched) + "; after: " + Uses(matched) + ")");
+    Require(matched.entries > unmatched.entries && matched.unmatchedEntries == unmatched.unmatchedEntries + (matched.entries - unmatched.entries) - 1, "lazy resolved ABI: the entry a matching draw used still counts as unmatched (before: " + Uses(unmatched) + "; after: " + Uses(matched) + ")");
+    for (const auto index : {Matching, Twice, Replaced}) Require(eager.at("drawn " + std::to_string(index)) == eager.at("resolved " + std::to_string(index)), "lazy resolved ABI: shader " + std::to_string(index) + ", drawn with its resolved ABI's state, did not find the ABI's entries with eager preparation");
+    for (std::uint32_t index = 0; index < Drawn; ++index) Require(Count(eager.at("drawn " + std::to_string(index))) == Count(eager.at("resolved " + std::to_string(index))) + 1, "lazy resolved ABI: a draw whose state differs from its resolved ABI did not prepare its own entry with eager preparation");
+    Require(Count(eager.at("drawn " + std::to_string(Replacement))) == Count(eager.at("registered " + std::to_string(Replacement))) + 1, "lazy resolved ABI: the header registered over a resolved one did not prepare its own entry at its draw with eager preparation");
+    Require(lazy.at("libraries drawn") == eager.at("libraries drawn"), "lazy resolved ABI: the pipeline libraries built differ from eager preparation (eager " + eager.at("libraries drawn") + "; lazy " + lazy.at("libraries drawn") + ")");
+    Require(first == expected, "lazy resolved ABI: the shader prepared at its first draw drew other bytes than with eager preparation");
+    AgcDriverWaitIdle_nid_postfix();
+    const auto files = CacheFiles(cache);
+    std::vector<std::string> added;
+    std::ranges::set_difference(files, cached, std::back_inserter(added));
+    Require(added.empty(), "lazy resolved ABI: preparation at first use wrote " + std::to_string(added.size()) + " shader cache files eager preparation had not, the first " + (added.empty() ? std::string() : added.front()));
+    std::printf("lazy resolved ABI: %u shaders drew, %u of them ABI-resolved; the %u resolved ones that never drew hold no prepared entries; the drawn ones hold the entries eager resolution and their draws made: drawn with their ABI's state they found them, with the ABI register arrays overwritten after resolution (one resolved with two ABIs, one whose header was registered over and again before its draw), drawn with another state they prepared their own; the pipeline libraries built match eager's (%s), a drawn one drew the same %zu bytes, and the lazy run wrote none of the %zu shader cache files eager wrote again\n", static_cast<unsigned>(DrawnPrograms.size()), static_cast<unsigned>(DrawnPrograms.size() - 1), Programs - Drawn, lazy.at("libraries drawn").c_str(), first.size(), cached.size());
+}
+
+}
+
+int main(int argc, char** argv) {
+    const bool eager = argc == 2 && std::string(argv[1]) == "--eager-reference";
+    std::filesystem::path reference;
+    std::filesystem::path cache;
+    std::set<std::string> cached;
+    const auto clean = [&] {
+        if (eager) return;
+        std::error_code ignored;
+        if (!reference.empty()) {
+            std::filesystem::remove(reference, ignored);
+            std::filesystem::remove(ReportPath(reference), ignored);
+        }
+        if (!cache.empty()) std::filesystem::remove_all(cache, ignored);
+    };
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        if (eager) {
+            const char* path = std::getenv("LAZY_RESOLVED_ABI_REFERENCE");
+            Require(path != nullptr, "lazy resolved ABI: the eager child has no reference path");
+            reference = path;
+        } else {
+            const auto run = std::to_string(std::random_device{}());
+            reference = std::filesystem::temp_directory_path() / ("aps5-lazy-resolved-abi-" + run + ".bin");
+            cache = std::filesystem::temp_directory_path() / ("aps5-lazy-resolved-abi-cache-" + run);
+            std::filesystem::create_directories(cache);
+            SetEnvironment("LAZY_RESOLVED_ABI_REFERENCE", reference.string());
+            SetEnvironment("ANYPS5_NO_SHADER_CACHE", "0");
+            SetEnvironment("ANYPS5_SHADER_CACHE_DIR", cache.string());
+            SetEnvironment("APS5_NO_PIPELINE_JOURNAL", "1");
+            ClearEnvironment("APS5_LAZY_SHADER_PREPARE");
+            const std::string command = "\"" + std::string(argv[0]) + "\" --eager-reference";
+            Require(std::system(command.c_str()) == 0, "lazy resolved ABI: the eager reference process failed");
+            cached = CacheFiles(cache);
+            Require(!cached.empty(), "lazy resolved ABI: the eager reference process wrote no shader cache files");
+            SetEnvironment("APS5_LAZY_SHADER_PREPARE", "1");
+        }
+        Register(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
+        Register(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
+        GuestBlock data;
+        GuestBlock textures;
+        GuestBlock target;
+        const Layout layout{data, textures, target};
+        Prepare(layout);
+        Check(layout);
+        if (eager) EagerReference(layout, reference);
+        else LazyResolution(layout, reference, cached, cache);
+        AgcDriverShutdown_nid_postfix();
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            AgcDriverShutdown_nid_postfix();
+        } catch (...) {
+        }
+        clean();
+        return 1;
+    }
+    clean();
+    return 0;
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp
index 1f8032e93c..250f80264a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LdsMixedWidthAtomics.cpp
@@ -325,8 +325,9 @@ void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, c
     if (expectedDeviceDwords) std::printf("lds lock budget: %s GPU readback verified across 256 lanes\n", name);
 }
 
-void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords) {
+void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords, const char* lds) {
     const auto result = Compile(device, MisalignedCode, ldsDwords);
+    Output.fill(0xdeadbeefu);
     StderrCapture capture;
     try {
         device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(MisalignedCode.data()));
@@ -336,8 +337,9 @@ void Misaligned(AgcDriver::VulkanDevice& device, std::uint32_t ldsDwords) {
         throw;
     }
     const auto log = capture.Finish();
-    Require(log.find("BDA access failed: address=0x4 instruction=0x2c bytes=8 ") != std::string::npos && log.find("reason=7") != std::string::npos, "lds lock budget: misaligned ds_add_u64 on device-backed LDS did not fault");
-    std::puts("lds lock budget: misaligned ds_add_u64 faulted");
+    Require(log.find("BDA access failed: address=0x4 instruction=0x2c bytes=8 ") != std::string::npos && log.find("reason=7") != std::string::npos, std::string("lds lock budget: misaligned ds_add_u64 on ") + lds + " LDS did not fault");
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) Require(Output[tid * 2u] == 0u && Output[tid * 2u + 1u] == 0u, std::string("lds lock budget: misaligned ds_add_u64 on ") + lds + " LDS changed the slot: lane " + std::to_string(tid) + " read " + Hex(Output[tid * 2u] | (static_cast<std::uint64_t>(Output[tid * 2u + 1u]) << 32u)));
+    std::printf("lds lock budget: misaligned ds_add_u64 on %s LDS faulted\n", lds);
 }
 
 void LockBudget(AgcDriver::VulkanDevice& device) {
@@ -349,7 +351,8 @@ void LockBudget(AgcDriver::VulkanDevice& device) {
     const auto operations = static_cast<std::uint64_t>(Threads) * Iterations;
     Run(device, UniformCode, "limit", operations, 1, limit / 4u, (limit / 4u + 2u) & ~1u);
     const auto& capabilities = target.supportedCapabilities;
-    if (std::find(capabilities.begin(), capabilities.end(), static_cast<std::uint32_t>(spv::CapabilityInt64Atomics)) != capabilities.end()) Misaligned(device, limit / 4u);
+    if (std::find(capabilities.begin(), capabilities.end(), static_cast<std::uint32_t>(spv::CapabilityInt64Atomics)) != capabilities.end()) Misaligned(device, limit / 4u, "device-backed");
+    Misaligned(device, LdsDwords, "workgroup");
     Run(device, UniformCode, "limit-4", operations, 1, (limit - 4u) / 4u, 0u);
     std::puts("lds lock budget tests passed");
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp
new file mode 100644
index 0000000000..ae9d55e2c0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp
@@ -0,0 +1,92 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 128;
+constexpr std::uint32_t BranchThreads = 64;
+constexpr std::uint32_t Iterations = 0x1000;
+constexpr std::uint32_t Rounds = 16;
+constexpr std::uint32_t LdsDwords = 512;
+alignas(256) std::array<std::uint32_t, 2u * Threads> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 36> BranchCode{
+    0x34040082, 0xe0301000, 0x80000102, 0xbf8c3f70, 0xbe86037e, 0x7da800c0, 0xbf880002, 0xd87c0400,
+    0x00000102, 0xbefe0306, 0x7e0e0500, 0xbf0ac007, 0x850580ff, 0x00001000, 0x7e0c0300, 0xbf068005,
+    0xbf850005, 0xd5430006, 0x02050706, 0x80858105, 0xbf078005, 0xbf85fffb, 0xe0701200, 0x80000602,
+    0xd8340000, 0x00000102, 0xbf8cc07f, 0xbf8a0000, 0x3a0604ff, 0x00000100, 0xd8d80000, 0x04000003,
+    0xbf8cc07f, 0xe0701000, 0x80000402, 0xbf810000,
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::uint32_t BranchResult(std::uint32_t thread) {
+    std::uint32_t value = thread;
+    for (std::uint32_t iteration = 0; iteration < Iterations; ++iteration) value = (value & 0xffffffu) * 3u + 1u;
+    return value;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto target = device->ComputeTarget(32);
+        if (target.subgroupSize != 32u) {
+            std::printf("skipped, wave32 programs do not run on 32-lane subgroups (%u lanes)\n", target.subgroupSize);
+            return VulkanTestSkipped;
+        }
+        std::vector<std::uint32_t> userData(4, 0u);
+        const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+        std::copy(output.begin(), output.end(), userData.begin());
+        const std::span<const std::uint32_t> code(BranchCode);
+        const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+        const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, LdsDwords, {false, false, false}, false, 1};
+        ShaderRecompiler::RecompileRequest request{
+            {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+            {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+            target,
+            {0, 0, 0, 128}
+        };
+        request.useCache = false;
+        const auto result = ShaderRecompiler::Recompile(request);
+        std::array<std::uint32_t, Threads> input{};
+        for (std::uint32_t round = 0; round < Rounds; ++round) {
+            for (std::uint32_t thread = 0; thread < Threads; ++thread) input[thread] = (round + 1u) * 0x10000u + thread;
+            Output.fill(0xdeadbeefu);
+            std::copy(input.begin(), input.end(), Output.begin());
+            device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+            device->WaitIdle();
+            for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+                const auto expected = input[thread ^ BranchThreads];
+                Require(Output[thread] == expected, "LDS exchange after a 16-bit LDS store in a branch that waves 0-1 take, round " + std::to_string(round) + ": thread " + std::to_string(thread) + " (wave " + std::to_string(thread / 32u) + ") read " + std::to_string(Output[thread]) + ", expected " + std::to_string(expected));
+            }
+            for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+                const auto expected = thread < BranchThreads ? BranchResult(thread) : thread;
+                Require(Output[Threads + thread] == expected, "loop result of thread " + std::to_string(thread) + " in round " + std::to_string(round));
+            }
+        }
+        std::puts("LDS subword store branch tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/LinearReadbackLabel.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/LinearReadbackLabel.cpp
new file mode 100644
index 0000000000..36105a9e93
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/LinearReadbackLabel.cpp
@@ -0,0 +1,238 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Width = 32;
+constexpr std::uint32_t Height = 8;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::uint32_t Format8888Uint = 60;
+constexpr std::uint32_t TexelBytes = 4;
+constexpr std::uint32_t IdentitySwizzle = 0xfacu;
+constexpr std::size_t BlockBytes = 0x20000;
+constexpr std::size_t LabelOffset = 0x8000;
+constexpr std::uint32_t LabelValue = 0x5eedf00du;
+constexpr std::uint32_t TiledThreads = 8;
+constexpr std::uint32_t TiledSide = 16;
+constexpr std::uint32_t Format32Uint = 20;
+constexpr std::uint32_t TileR64KBX = 0x1b;
+constexpr std::size_t TiledOffset = 0x10000;
+constexpr std::size_t TiledLabelOffset = 0x8100;
+constexpr std::uint32_t Untouched = 0xdeadbeefu;
+constexpr std::uint32_t Written = 0x12345678u;
+
+alignas(256) constexpr std::array<std::uint32_t, 24> StoreCode{
+    0x4a500081, 0xd5690014, 0x0201ff28, 0x9e3779b1, 0x4a2a28ff, 0x7f4a7c15, 0x4a2c28ff, 0xfe94f82a,
+    0x4a2e28ff, 0x7ddf743f, 0x7e3c0300, 0x7e3e0280, 0xf0281f08, 0x0001141e, 0x7e3e0281, 0xf0281508,
+    0x0001141e, 0x7e3e0282, 0xf0281a08, 0x0001141e, 0x7e3e0283, 0xf0281808, 0x0001141e, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> TiledStoreCode{
+    0x7e040300, 0x7e060280, 0x7e0202ff, Written, 0xf0200108, 0x00020102, 0xbf810000,
+};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "linear readback label: cannot allocate the guest block");
+        std::memset(block, 0, BlockBytes);
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint8_t* Data() { return block; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::uint32_t Data(std::uint32_t tid, std::uint32_t index) {
+    return (tid + 1u) * 0x9e3779b1u + index * 0x7f4a7c15u;
+}
+
+AgcDriver::Graphics::TileMipLayout Layout() {
+    return AgcDriver::Graphics::ComputeMipLayout(AgcDriver::Graphics::TextureTileMode::kLinear, Format8888Uint, Width, Height, 1).front();
+}
+
+std::vector<std::uint8_t> Expected(const std::vector<std::uint8_t>& initial) {
+    const auto mip = Layout();
+    auto bytes = initial;
+    constexpr std::array<std::uint32_t, 4> Dmasks{0xfu, 0x5u, 0xau, 0x8u};
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        for (std::uint32_t row = 0; row < Dmasks.size(); ++row) {
+            std::array<std::uint32_t, 4> words{};
+            std::uint32_t next = 0;
+            for (std::uint32_t word = 0; word < 4u; ++word) {
+                if (((Dmasks[row] >> word) & 1u) != 0u) words[word] = Data(tid, next++);
+            }
+            std::memcpy(bytes.data() + mip.tiledOffset + static_cast<std::uint64_t>(row) * mip.pitchBytes + static_cast<std::uint64_t>(tid) * TexelBytes, words.data(), TexelBytes);
+        }
+    }
+    return bytes;
+}
+
+std::array<std::uint32_t, 16> UserData(const void* texels) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texels));
+    std::array<std::uint32_t, 16> data{};
+    data[4] = static_cast<std::uint32_t>(address >> 8u);
+    data[5] = static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format8888Uint << 20u) | (((Width - 1u) & 3u) << 30u);
+    data[6] = ((Width - 1u) >> 2u) | ((Height - 1u) << 14u);
+    data[7] = IdentitySwizzle | (Type2D << 28u);
+    return data;
+}
+
+std::array<std::uint32_t, 8> TiledDescriptor(const void* texels) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(texels));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32Uint << 20u) | (((TiledSide - 1u) & 3u) << 30u),
+        ((TiledSide - 1u) >> 2u) | ((TiledSide - 1u) << 14u),
+        IdentitySwizzle | (TileR64KBX << 20u) | (Type2D << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+std::array<std::uint32_t, 16> TiledUserData(const void* texels) {
+    std::array<std::uint32_t, 16> data{};
+    const auto texture = TiledDescriptor(texels);
+    std::copy(texture.begin(), texture.end(), data.begin() + 8);
+    return data;
+}
+
+std::vector<std::uint32_t> Commands(std::span<const std::uint32_t> code, std::uint32_t threads, std::span<const std::uint32_t> userData, const void* label) {
+    std::vector<std::uint32_t> words;
+    const auto registers = [&](std::uint32_t first, std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{threads, 1, 1};
+    registers(0x207, shape);
+    const auto address = reinterpret_cast<std::uintptr_t>(code.data());
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> resource{static_cast<std::uint32_t>(userData.size()) << 1u};
+    registers(0x213, resource);
+    registers(0x240, userData);
+    words.insert(words.end(), {0xc0031500u, 1, 1, 1, 0x41u | 0x8000u});
+    const auto at = reinterpret_cast<std::uintptr_t>(label);
+    words.insert(words.end(), {0xc0064900u, 0x514u, (1u << 29u) | (2u << 24u), static_cast<std::uint32_t>(at), static_cast<std::uint32_t>(at >> 32u), LabelValue, 0, 0});
+    return words;
+}
+
+void SubmitAndWait(std::vector<std::uint32_t> words, std::uint32_t* label, const char* what) {
+    *label = 0;
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    AgcDriver::Submit(&packet, 0);
+    const auto start = std::chrono::steady_clock::now();
+    while (std::atomic_ref<std::uint32_t>(*label).load(std::memory_order_acquire) != LabelValue) {
+        Require(std::chrono::steady_clock::now() - start < std::chrono::seconds(20), std::string(what) + ": the label after the dispatch never landed");
+        std::this_thread::sleep_for(std::chrono::microseconds(100));
+    }
+}
+
+void ReadAfterLabel(std::uint8_t* block) {
+    auto* texels = block;
+    auto* label = reinterpret_cast<std::uint32_t*>(block + LabelOffset);
+    const auto mip = Layout();
+    const auto bytes = static_cast<std::size_t>(mip.tiledOffset + mip.pitchBytes * Height);
+    std::vector<std::uint8_t> initial(bytes);
+    for (std::size_t index = 0; index < initial.size(); ++index) initial[index] = static_cast<std::uint8_t>(0x80u + 37u * index + 11u * (index >> 4u));
+    std::memcpy(texels, initial.data(), initial.size());
+    const auto userData = UserData(texels);
+    SubmitAndWait(Commands(StoreCode, Threads, userData, label), label, "linear readback label");
+    const auto expected = Expected(initial);
+    for (std::uint32_t row = 0; row < Height; ++row) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto offset = mip.tiledOffset + static_cast<std::uint64_t>(row) * mip.pitchBytes + static_cast<std::uint64_t>(x) * TexelBytes;
+            std::uint32_t actual = 0;
+            std::uint32_t wanted = 0;
+            std::memcpy(&actual, texels + offset, TexelBytes);
+            std::memcpy(&wanted, expected.data() + offset, TexelBytes);
+            Require(actual == wanted, "linear readback label: texel (" + std::to_string(x) + ", " + std::to_string(row) + ") read after the label is 0x" + [&] { char text[16]; std::snprintf(text, sizeof(text), "%08x", actual); return std::string(text); }() + ", the dispatch before the label stored a different value");
+        }
+    }
+}
+
+void ReadTiledAfterLabel(std::uint8_t* block) {
+    auto* texels = reinterpret_cast<std::uint32_t*>(block + TiledOffset);
+    auto* label = reinterpret_cast<std::uint32_t*>(block + TiledLabelOffset);
+    const auto bytes = AgcDriver::Graphics::DescribeSurface(AgcDriver::Graphics::DecodeTextureResource(TiledDescriptor(texels))).guestBytes;
+    Require(bytes <= AgcDriver::Graphics::StorageTexture::SmallStoreBytes && bytes <= BlockBytes - TiledOffset, "tiled readback label: the test image is larger than a small image");
+    std::fill(texels, texels + bytes / 4u, Untouched);
+    const auto userData = TiledUserData(texels);
+    SubmitAndWait(Commands(TiledStoreCode, TiledThreads, userData, label), label, "tiled readback label");
+    const volatile std::uint32_t* cpu = texels;
+    std::uint32_t written = 0;
+    for (std::size_t index = 0; index < bytes / 4u; ++index) written += cpu[index] == Written ? 1u : 0u;
+    Require(written == TiledThreads, "tiled readback label: " + std::to_string(written) + " texels of a small tiled image read after the label hold the value the dispatch before it stored, expected " + std::to_string(TiledThreads));
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        GuestBlock block;
+        ReadAfterLabel(block.Data());
+        ReadTiledAfterLabel(block.Data());
+        AgcDriverWaitIdle_nid_postfix();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("linear readback label tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MemoryFloatAtomicModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MemoryFloatAtomicModes.cpp
new file mode 100644
index 0000000000..572e59d66f
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MemoryFloatAtomicModes.cpp
@@ -0,0 +1,447 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Inputs = 12;
+constexpr std::uint32_t Results = 32;
+constexpr std::uint32_t TargetDwords = 512;
+constexpr std::uint32_t Format32Float = 22;
+constexpr std::uint32_t Type2D = 9;
+constexpr std::size_t BlockBytes = 4096;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * Results + TargetDwords> Output{};
+alignas(4096) std::array<std::uint32_t, 4096> Texels{};
+
+alignas(256) constexpr std::array<std::uint32_t, 112> BufferCode{
+    0x160200b0u, 0x34180087u, 0xe0381000u, 0x80000201u, 0xe0381010u, 0x80000601u, 0xe0341020u, 0x80000a01u,
+    0xbf8c3f70u, 0x341a0082u, 0x4a1a1affu, 0x00001000u, 0x341c0083u, 0x4a1c1cffu, 0x00001200u, 0xe0701000u,
+    0x8001020du, 0xbbfd0000u, 0x7e200303u, 0x7e220304u, 0xe0fc5000u, 0x8001100du, 0xbf8c3f70u, 0xe0305000u,
+    0x8001120du, 0xbf8c3f70u, 0xe0701000u, 0x8001100cu, 0xe0701004u, 0x8001120cu, 0xe0701080u, 0x8001020du,
+    0xbbfd0000u, 0x7e200303u, 0x7e220304u, 0xe1005080u, 0x8001100du, 0xbf8c3f70u, 0xe0305080u, 0x8001120du,
+    0xbf8c3f70u, 0xe0701008u, 0x8001100cu, 0xe070100cu, 0x8001120cu, 0xe0701100u, 0x8001020du, 0xbbfd0000u,
+    0x7e200303u, 0x7e220304u, 0xe0f85100u, 0x8001100du, 0xbf8c3f70u, 0xe0305100u, 0x8001120du, 0xbf8c3f70u,
+    0xe0701010u, 0x8001100cu, 0xe0701014u, 0x8001120cu, 0xe0741000u, 0x8001060eu, 0xbbfd0000u, 0x7e280308u,
+    0x7e2a0309u, 0x7e2c030au, 0x7e2e030bu, 0xe17c5000u, 0x8001140eu, 0xbf8c3f70u, 0xe0345000u, 0x8001180eu,
+    0xbf8c3f70u, 0xe0741018u, 0x8001140cu, 0xe0741020u, 0x8001180cu, 0xe0741100u, 0x8001060eu, 0xbbfd0000u,
+    0x7e280308u, 0x7e2a0309u, 0x7e2c030au, 0x7e2e030bu, 0xe1805100u, 0x8001140eu, 0xbf8c3f70u, 0xe0345100u,
+    0x8001180eu, 0xbf8c3f70u, 0xe0741028u, 0x8001140cu, 0xe0741030u, 0x8001180cu, 0xe0741200u, 0x8001060eu,
+    0xbbfd0000u, 0x7e280308u, 0x7e2a0309u, 0x7e2c030au, 0x7e2e030bu, 0xe1785200u, 0x8001140eu, 0xbf8c3f70u,
+    0xe0345200u, 0x8001180eu, 0xbf8c3f70u, 0xe0741038u, 0x8001140cu, 0xe0741040u, 0x8001180cu, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 59> ImageCode{
+    0x160200b0u, 0x34180087u, 0xe0381000u, 0x80000201u, 0xe0381010u, 0x80000601u, 0xe0341020u, 0x80000a01u,
+    0xbf8c3f70u, 0x7e3c0300u, 0x7e3e0280u, 0x7e260302u, 0xf03c0108u, 0x0002131eu, 0x7e200303u, 0x7e220304u,
+    0xf0782108u, 0x0002101eu, 0x7e240280u, 0xf0442108u, 0x0002121eu, 0xbf8c3f70u, 0xe0701000u, 0x8001100cu,
+    0xe0701004u, 0x8001120cu, 0x7e3e0281u, 0x7e260302u, 0xf03c0108u, 0x0002131eu, 0x7e200303u, 0x7e220304u,
+    0xf07c2108u, 0x0002101eu, 0x7e240280u, 0xf0442108u, 0x0002121eu, 0xbf8c3f70u, 0xe0701008u, 0x8001100cu,
+    0xe070100cu, 0x8001120cu, 0x7e3e0282u, 0x7e260302u, 0xf03c0108u, 0x0002131eu, 0x7e200303u, 0x7e220304u,
+    0xf0742308u, 0x0002101eu, 0x7e240280u, 0xf0442108u, 0x0002121eu, 0xbf8c3f70u, 0xe0701010u, 0x8001100cu,
+    0xe0701014u, 0x8001120cu, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 52> GlobalCode{
+    0x160200b0u, 0x34180087u, 0xe0381000u, 0x80000201u, 0xe0381010u, 0x80000601u, 0xe0341020u, 0x80000a01u,
+    0xbf8c3f70u, 0x34340082u, 0xd70f6a1au, 0x00023408u, 0x7e360209u, 0x50363680u, 0x34380083u, 0xd70f6a1cu,
+    0x00023808u, 0x7e3a0209u, 0x503a3a80u, 0xdc708000u, 0x007d021au, 0xbbfd0000u, 0x7e200303u, 0x7e220304u,
+    0xdcfd8000u, 0x137d101au, 0xbf8c3f70u, 0xdc318000u, 0x127d001au, 0xbf8c3f70u, 0xe0701000u, 0x8001130cu,
+    0xe0701004u, 0x8001120cu, 0xdc748200u, 0x007d061cu, 0xbbfd0000u, 0x7e280308u, 0x7e2a0309u, 0x7e2c030au,
+    0x7e2e030bu, 0xdd7d8200u, 0x207d141cu, 0xbf8c3f70u, 0xdc358200u, 0x187d001cu, 0xbf8c3f70u, 0xe0741018u,
+    0x8001200cu, 0xe0741020u, 0x8001180cu, 0xbf810000u,
+};
+
+constexpr std::uint32_t Rows32[Threads][3] = {
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x80000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0x00000000u, 0x00000001u, 0x00000000u},
+    {0x00000000u, 0x80000001u, 0x80000001u},
+    {0x00000001u, 0x00000000u, 0x00000001u},
+    {0x00000001u, 0x3f800000u, 0x3f800000u},
+    {0x80000001u, 0x80000000u, 0x80000000u},
+    {0x00000001u, 0x80000001u, 0x80000001u},
+    {0x007fffffu, 0x00800000u, 0x007fffffu},
+    {0x807fffffu, 0xbf800000u, 0x807fffffu},
+    {0x7fc00000u, 0x00000001u, 0x7fc00000u},
+    {0x00000001u, 0x7fc00000u, 0x00000001u},
+    {0x7f800001u, 0x00000001u, 0x7f800001u},
+    {0x00000001u, 0x7f800001u, 0x00000001u},
+    {0x3f800000u, 0xbf800000u, 0x3f800000u},
+    {0x7f800000u, 0xff800000u, 0xff800000u},
+    {0x80000000u, 0x00000001u, 0x80000000u},
+    {0x7fc12345u, 0x7fc00000u, 0x7fc12345u},
+    {0xffc00000u, 0x3f800000u, 0x3f800000u},
+    {0x7fa00000u, 0x3f800000u, 0x3f800000u},
+    {0x40490fdbu, 0x007fffffu, 0x40490fdbu},
+    {0x807fffffu, 0x80000001u, 0x80000001u},
+    {0x00800000u, 0x007fffffu, 0x00800000u},
+    {0x00000000u, 0xff800001u, 0xff800001u},
+    {0x80000001u, 0x00000001u, 0x80000001u},
+    {0x7f7fffffu, 0xff7fffffu, 0xff7fffffu},
+    {0x00000001u, 0x00000001u, 0x00000001u},
+    {0x007fffffu, 0x80000000u, 0x80000000u},
+    {0xff800000u, 0x80000001u, 0x80000001u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x3f800000u, 0x00000001u, 0x3f800000u}
+};
+
+constexpr std::uint64_t Rows64[Threads][3] = {
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000001ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x0000000000000001ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x0000000000000001ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull},
+    {0x8000000000000001ull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0x0000000000000001ull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x000fffffffffffffull, 0x0010000000000000ull, 0x000fffffffffffffull},
+    {0x800fffffffffffffull, 0xbff0000000000000ull, 0x800fffffffffffffull},
+    {0x7ff8000000000000ull, 0x0000000000000001ull, 0x7ff8000000000000ull},
+    {0x0000000000000001ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x7ff0000000000001ull, 0x0000000000000001ull, 0x7ff0000000000001ull},
+    {0x0000000000000001ull, 0x7ff0000000000001ull, 0x7ff0000000000001ull},
+    {0x3ff0000000000000ull, 0xbff0000000000000ull, 0x3ff0000000000000ull},
+    {0x7ff0000000000000ull, 0xfff0000000000000ull, 0x7ff0000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000001ull, 0x8000000000000000ull},
+    {0x7ff8000000012345ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0xfff8000000000000ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull},
+    {0xfff0000000000001ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull},
+    {0x400921fb54442d18ull, 0x000fffffffffffffull, 0x400921fb54442d18ull},
+    {0x800fffffffffffffull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x0010000000000000ull, 0x000fffffffffffffull, 0x0010000000000000ull},
+    {0x0000000000000000ull, 0xfff0000000000001ull, 0x0000000000000000ull},
+    {0x8000000000000001ull, 0x0000000000000001ull, 0x8000000000000001ull},
+    {0x7fefffffffffffffull, 0xfff0000000000000ull, 0x7fefffffffffffffull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x000fffffffffffffull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0xfff0000000000000ull, 0x8000000000000001ull, 0x8000000000000001ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x3ff0000000000000ull, 0x0000000000000001ull, 0x3ff0000000000000ull}
+};
+
+constexpr std::uint32_t Flushed32[Threads][3] = {
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x00000000u, 0x00000001u},
+    {0x80000000u, 0x00000000u, 0x80000001u},
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x3f800000u, 0x00000001u},
+    {0x80000000u, 0x80000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x80000001u},
+    {0x00000000u, 0x00800000u, 0x00800000u},
+    {0xbf800000u, 0x80000000u, 0xbf800000u},
+    {0x00000000u, 0x00000000u, 0x7fc00000u},
+    {0x00000000u, 0x00000000u, 0x7fc00000u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0xbf800000u, 0x3f800000u, 0xbf800000u},
+    {0xff800000u, 0x7f800000u, 0x7f800000u},
+    {0x80000000u, 0x00000000u, 0x00000001u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc12345u},
+    {0x3f800000u, 0x3f800000u, 0xffc00000u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fa00000u},
+    {0x00000000u, 0x40490fdbu, 0x007fffffu},
+    {0x80000000u, 0x80000000u, 0x80000001u},
+    {0x00000000u, 0x00800000u, 0x007fffffu},
+    {0xffc00001u, 0xffc00001u, 0x00000000u},
+    {0x80000000u, 0x00000000u, 0x00000001u},
+    {0xff7fffffu, 0x7f7fffffu, 0x7f7fffffu},
+    {0x00000000u, 0x00000000u, 0x00000001u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0xff800000u, 0x80000000u, 0xff800000u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x00000000u, 0x3f800000u, 0x00000001u}
+};
+
+constexpr std::uint32_t Kept32[Threads][3] = {
+    {0x00000000u, 0x00000000u, 0x00000000u},
+    {0x80000000u, 0x00000000u, 0x80000000u},
+    {0x80000000u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x00000001u, 0x00000001u},
+    {0x80000001u, 0x00000000u, 0x00000000u},
+    {0x00000000u, 0x00000001u, 0x00000000u},
+    {0x00000001u, 0x3f800000u, 0x00000001u},
+    {0x80000001u, 0x80000000u, 0x80000001u},
+    {0x80000001u, 0x00000001u, 0x00000001u},
+    {0x007fffffu, 0x00800000u, 0x00800000u},
+    {0xbf800000u, 0x807fffffu, 0xbf800000u},
+    {0x00000001u, 0x00000001u, 0x7fc00000u},
+    {0x00000001u, 0x00000001u, 0x7fc00000u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0x7fc00001u, 0x7fc00001u, 0x7f800001u},
+    {0xbf800000u, 0x3f800000u, 0xbf800000u},
+    {0xff800000u, 0x7f800000u, 0x7f800000u},
+    {0x80000000u, 0x00000001u, 0x00000001u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc12345u},
+    {0x3f800000u, 0x3f800000u, 0xffc00000u},
+    {0x7fe00000u, 0x7fe00000u, 0x7fa00000u},
+    {0x007fffffu, 0x40490fdbu, 0x007fffffu},
+    {0x807fffffu, 0x80000001u, 0x807fffffu},
+    {0x007fffffu, 0x00800000u, 0x007fffffu},
+    {0xffc00001u, 0xffc00001u, 0x00000000u},
+    {0x80000001u, 0x00000001u, 0x00000001u},
+    {0xff7fffffu, 0x7f7fffffu, 0x7f7fffffu},
+    {0x00000001u, 0x00000001u, 0x00000001u},
+    {0x80000000u, 0x007fffffu, 0x007fffffu},
+    {0xff800000u, 0x80000001u, 0xff800000u},
+    {0x7fc00000u, 0x7fc00000u, 0x7fc00000u},
+    {0x00000001u, 0x3f800000u, 0x00000001u}
+};
+
+constexpr std::uint64_t Flushed64[Threads][3] = {
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000001ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x3ff0000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x8000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000001ull},
+    {0x0000000000000000ull, 0x0010000000000000ull, 0x0010000000000000ull},
+    {0xbff0000000000000ull, 0x8000000000000000ull, 0xbff0000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x7ff8000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x7ff0000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x0000000000000001ull},
+    {0xbff0000000000000ull, 0x3ff0000000000000ull, 0xbff0000000000000ull},
+    {0xfff0000000000000ull, 0x7ff0000000000000ull, 0xfff0000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000012345ull},
+    {0x3ff0000000000000ull, 0x3ff0000000000000ull, 0xfff8000000000000ull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x0000000000000000ull, 0x400921fb54442d18ull, 0x000fffffffffffffull},
+    {0x8000000000000000ull, 0x8000000000000000ull, 0x8000000000000001ull},
+    {0x0000000000000000ull, 0x0010000000000000ull, 0x000fffffffffffffull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0xfff0000000000000ull, 0x7fefffffffffffffull, 0xfff0000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0xfff0000000000000ull, 0x8000000000000000ull, 0xfff0000000000000ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x0000000000000000ull, 0x3ff0000000000000ull, 0x0000000000000001ull}
+};
+
+constexpr std::uint64_t Kept64[Threads][3] = {
+    {0x0000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x8000000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x8000000000000001ull, 0x0000000000000000ull, 0x0000000000000000ull},
+    {0x0000000000000000ull, 0x0000000000000001ull, 0x0000000000000000ull},
+    {0x0000000000000001ull, 0x3ff0000000000000ull, 0x0000000000000001ull},
+    {0x8000000000000001ull, 0x8000000000000000ull, 0x8000000000000001ull},
+    {0x8000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x000fffffffffffffull, 0x0010000000000000ull, 0x0010000000000000ull},
+    {0xbff0000000000000ull, 0x800fffffffffffffull, 0xbff0000000000000ull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x7ff8000000000000ull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x7ff0000000000001ull},
+    {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0x0000000000000001ull},
+    {0xbff0000000000000ull, 0x3ff0000000000000ull, 0xbff0000000000000ull},
+    {0xfff0000000000000ull, 0x7ff0000000000000ull, 0xfff0000000000000ull},
+    {0x8000000000000000ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000012345ull},
+    {0x3ff0000000000000ull, 0x3ff0000000000000ull, 0xfff8000000000000ull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x000fffffffffffffull, 0x400921fb54442d18ull, 0x000fffffffffffffull},
+    {0x800fffffffffffffull, 0x8000000000000001ull, 0x800fffffffffffffull},
+    {0x000fffffffffffffull, 0x0010000000000000ull, 0x000fffffffffffffull},
+    {0xfff8000000000001ull, 0xfff8000000000001ull, 0xfff0000000000001ull},
+    {0x8000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0xfff0000000000000ull, 0x7fefffffffffffffull, 0xfff0000000000000ull},
+    {0x0000000000000001ull, 0x0000000000000001ull, 0x0000000000000001ull},
+    {0x8000000000000000ull, 0x000fffffffffffffull, 0x000fffffffffffffull},
+    {0xfff0000000000000ull, 0x8000000000000001ull, 0xfff0000000000000ull},
+    {0x7ff8000000000000ull, 0x7ff8000000000000ull, 0x7ff8000000000000ull},
+    {0x0000000000000001ull, 0x3ff0000000000000ull, 0x0000000000000001ull}
+};
+
+constexpr std::array<const char*, 3> Names{"fmin", "fmax", "fcmpswap"};
+
+enum class Kind { Buffer, Image, Global };
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "memory float atomic modes: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+    }
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+    std::uint8_t* Data() { return block; }
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> TextureDescriptor(const void* data) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32Float << 20u) | (((Threads - 1u) & 3u) << 30u),
+        ((Threads - 1u) >> 2u) | (2u << 14u),
+        0xfacu | (Type2D << 28u),
+        0u, 0u, 0u, 0u,
+    };
+}
+
+std::string Hex(std::uint64_t value, int digits) {
+    char text[24];
+    std::snprintf(text, sizeof(text), "0x%0*llx", digits, static_cast<unsigned long long>(value));
+    return text;
+}
+
+const char* KindName(Kind kind) {
+    return kind == Kind::Buffer ? "buffer" : kind == Kind::Image ? "image" : "global";
+}
+
+void FillInput() {
+    Input.fill(0u);
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        auto* row = &Input[tid * Inputs];
+        row[0] = Rows32[tid][0];
+        row[1] = Rows32[tid][1];
+        row[2] = Rows32[tid][2];
+        for (std::uint32_t i = 0; i < 3u; ++i) {
+            row[4u + 2u * i] = static_cast<std::uint32_t>(Rows64[tid][i]);
+            row[5u + 2u * i] = static_cast<std::uint32_t>(Rows64[tid][i] >> 32u);
+        }
+    }
+}
+
+void Run(AgcDriver::VulkanDevice& device, Kind kind, GuestBlock& guest, const std::optional<ShaderRecompiler::ShaderFloatMode>& floatMode) {
+    Output.fill(0xdeadbeefu);
+    Texels.fill(0xdeadbeefu);
+    std::memset(guest.Data(), 0xcd, BlockBytes);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    if (kind == Kind::Image) {
+        const auto texture = TextureDescriptor(Texels.data());
+        std::copy(texture.begin(), texture.end(), userData.begin() + 8);
+    } else if (kind == Kind::Global) {
+        const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(guest.Data()));
+        userData[8] = static_cast<std::uint32_t>(address);
+        userData[9] = static_cast<std::uint32_t>(address >> 32u);
+    }
+    const std::span<const std::uint32_t> code = kind == Kind::Buffer ? std::span<const std::uint32_t>(BufferCode) : kind == Kind::Image ? std::span<const std::uint32_t>(ImageCode) : std::span<const std::uint32_t>(GlobalCode);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void Check(Kind kind, const char* mode, bool flush32, bool flush64) {
+    const auto where = std::string("memory float atomic modes: ") + KindName(kind) + ", " + mode + ", lane ";
+    const std::uint32_t ops = kind == Kind::Global ? 1u : 3u;
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        const std::uint32_t* out = &Output[tid * Results];
+        for (std::uint32_t op = 0; op < ops; ++op) {
+            const std::uint32_t expected = flush32 ? Flushed32[tid][op] : Kept32[tid][op];
+            Require(out[2u * op] == Rows32[tid][0], where + std::to_string(tid) + " " + Names[op] + " returned " + Hex(out[2u * op], 8) + ", expected " + Hex(Rows32[tid][0], 8));
+            Require(out[2u * op + 1u] == expected, where + std::to_string(tid) + " " + Names[op] + " stored " + Hex(out[2u * op + 1u], 8) + ", expected " + Hex(expected, 8));
+        }
+        if (kind == Kind::Image) continue;
+        for (std::uint32_t op = 0; op < ops; ++op) {
+            const std::uint64_t returned = out[6u + 4u * op] | (static_cast<std::uint64_t>(out[7u + 4u * op]) << 32u);
+            const std::uint64_t stored = out[8u + 4u * op] | (static_cast<std::uint64_t>(out[9u + 4u * op]) << 32u);
+            const std::uint64_t expected = flush64 ? Flushed64[tid][op] : Kept64[tid][op];
+            Require(returned == Rows64[tid][0], where + std::to_string(tid) + " " + Names[op] + "_x2 returned " + Hex(returned, 16) + ", expected " + Hex(Rows64[tid][0], 16));
+            Require(stored == expected, where + std::to_string(tid) + " " + Names[op] + "_x2 stored " + Hex(stored, 16) + ", expected " + Hex(expected, 16));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!TargetHasCapability(device->Target(), spv::CapabilityInt64Atomics)) {
+            std::puts("skipped, the device has no shaderBufferInt64Atomics");
+            return VulkanTestSkipped;
+        }
+        GuestBlock guest;
+        FillInput();
+        struct Mode {
+            std::optional<ShaderRecompiler::ShaderFloatMode> floatMode;
+            const char* name;
+            bool flush32;
+            bool flush64;
+            bool global;
+        };
+        const std::array<Mode, 6> modes{{
+            {std::nullopt, "no float mode", true, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0xc0u, true, false, false}, "FLOAT_MODE 0xc0", true, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0xf0u, true, false, false}, "FLOAT_MODE 0xf0", false, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0x00u, true, false, false}, "FLOAT_MODE 0x00", true, true, true},
+            {ShaderRecompiler::ShaderFloatMode{0x50u, true, false, false}, "FLOAT_MODE 0x50", false, false, false},
+            {ShaderRecompiler::ShaderFloatMode{0xa0u, true, false, false}, "FLOAT_MODE 0xa0", true, true, false},
+        }};
+        for (const auto kind : {Kind::Buffer, Kind::Image, Kind::Global}) {
+            for (const auto& mode : modes) {
+                if (kind == Kind::Global && !mode.global) continue;
+                Run(*device, kind, guest, mode.floatMode);
+                Check(kind, mode.name, mode.flush32, mode.flush64);
+            }
+        }
+        std::puts("memory float atomic modes tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MullitF32DenormalModes.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MullitF32DenormalModes.cpp
new file mode 100644
index 0000000000..2dd9886984
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MullitF32DenormalModes.cpp
@@ -0,0 +1,226 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+constexpr std::uint32_t ConstantForms = 4;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads * ConstantForms> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> MullitCode{
+    0x34020084u, 0x34040082u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0x7e140280u, 0xd550000au, 0x041a0b04u,
+    0xe0701000u, 0x80010a02u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 17> ConstantMullitCode{
+    0x34020084u, 0x34040084u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0xd550000au, 0x041a08f2u, 0xd550000bu,
+    0x0419e904u, 0xd550000cu, 0x041a0a81u, 0xd550000du, 0x041a08ffu, 0x3fc00000u, 0xe0781000u, 0x80010a02u,
+    0xbf810000u,
+};
+
+constexpr const char* ConstantNames[ConstantForms] = {"v_mullit_f32 1.0, v4, v6", "v_mullit_f32 v4, 2.0, v6", "v_mullit_f32 0x1, v5, v6", "v_mullit_f32 0x3fc00000, v4, v6"};
+
+struct Vector {
+    std::uint32_t lhs;
+    std::uint32_t rhs;
+    std::uint32_t limit;
+    std::uint32_t expected[8];
+};
+
+constexpr Vector Vectors[] = {
+    {0x00000000u, 0x00000000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00000000u, 0x00800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00000001u, 0x80000001u, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u}},
+    {0x00000001u, 0x3f800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000001u, 0x00000001u}},
+    {0x00000001u, 0x3f800000u, 0x00800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000001u, 0x00000001u}},
+    {0x00000001u, 0xbf800000u, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000001u, 0x80000001u}},
+    {0x00000001u, 0x7f7fffffu, 0x00800000u, {0x00000000u, 0x00000000u, 0x34ffffffu, 0x34ffffffu, 0x00000000u, 0x00000000u, 0x34ffffffu, 0x34ffffffu}},
+    {0x00800000u, 0x00000000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00800000u, 0x80000001u, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u}},
+    {0x00800000u, 0x00800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u}},
+    {0x00800000u, 0x3f000000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00400000u, 0x00400000u}},
+    {0x00800000u, 0x3f000000u, 0x00800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00400000u, 0x00400000u, 0x00400000u, 0x00400000u}},
+    {0x3f000000u, 0x007fffffu, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x00000000u, 0x00000000u, 0xff7fffffu, 0xff7fffffu, 0x00400000u, 0x00400000u}},
+    {0x3f000000u, 0x007fffffu, 0x00800000u, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u, 0x00400000u, 0x00400000u}},
+    {0x3f000000u, 0x807fffffu, 0x00800000u, {0x00000000u, 0x00000000u, 0x80000000u, 0x80000000u, 0x00000000u, 0x00000000u, 0x80400000u, 0x80400000u}},
+    {0x7f800001u, 0x00000001u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u, 0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u}},
+    {0x7f800001u, 0x00000001u, 0x00800000u, {0x00000000u, 0x00000000u, 0x7f800001u, 0x7fc00001u, 0x00000000u, 0x00000000u, 0x7f800001u, 0x7fc00001u}},
+    {0x7f800001u, 0x00800000u, 0x00000001u, {0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u, 0xff7fffffu, 0xff7fffffu, 0x7f800001u, 0x7fc00001u}},
+    {0x7f800001u, 0x00800000u, 0x00800000u, {0x7f800001u, 0x7fc00001u, 0x7f800001u, 0x7fc00001u, 0x7f800001u, 0x7fc00001u, 0x7f800001u, 0x7fc00001u}},
+    {0x3f800000u, 0x40000000u, 0x3f800000u, {0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u, 0x40000000u}},
+    {0x3f800000u, 0xff7fffffu, 0x3f800000u, {0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu}},
+    {0x3f800000u, 0x3f800000u, 0x80000000u, {0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu, 0xff7fffffu}},
+    {0x7f7fffffu, 0x7f7fffffu, 0x3f800000u, {0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u, 0x7f800000u}},
+};
+
+struct ConstantVector {
+    std::uint32_t inputs[3];
+    std::uint32_t expected[4][ConstantForms];
+};
+
+constexpr ConstantVector ConstantVectors[] = {
+    {{0x00000001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000001u, 0x00000002u, 0x00000000u, 0x00000002u}}},
+    {{0x00000001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000001u, 0x00000002u, 0x00000000u, 0x00000002u}}},
+    {{0x00000002u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000002u, 0x00000004u, 0x00000000u, 0x00000003u}}},
+    {{0x00000002u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000002u, 0x00000004u, 0x00000000u, 0x00000003u}}},
+    {{0x00000003u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000003u, 0x00000006u, 0x00000000u, 0x00000004u}}},
+    {{0x00000003u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000003u, 0x00000006u, 0x00000000u, 0x00000004u}}},
+    {{0x00155555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00155555u, 0x002aaaaau, 0x00000000u, 0x00200000u}}},
+    {{0x00155555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00155555u, 0x002aaaaau, 0x00000000u, 0x00200000u}}},
+    {{0x003fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x003fffffu, 0x007ffffeu, 0x00000000u, 0x005ffffeu}}},
+    {{0x003fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x003fffffu, 0x007ffffeu, 0x00000000u, 0x005ffffeu}}},
+    {{0x00400000u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400000u, 0x00800000u, 0x00000000u, 0x00600000u}}},
+    {{0x00400000u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400000u, 0x00800000u, 0x00000000u, 0x00600000u}}},
+    {{0x00400001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800002u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400001u, 0x00800002u, 0x00000000u, 0x00600002u}}},
+    {{0x00400001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00800002u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00400001u, 0x00800002u, 0x00000000u, 0x00600002u}}},
+    {{0x00555555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00aaaaaau, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00555555u, 0x00aaaaaau, 0x00000000u, 0x00800000u}}},
+    {{0x00555555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00aaaaaau, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00555555u, 0x00aaaaaau, 0x00000000u, 0x00800000u}}},
+    {{0x007ffffeu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffcu, 0x00000000u, 0x00bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007ffffeu, 0x00fffffcu, 0x00000000u, 0x00bffffdu}}},
+    {{0x007ffffeu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffcu, 0x00000000u, 0x00bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007ffffeu, 0x00fffffcu, 0x00000000u, 0x00bffffdu}}},
+    {{0x007fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffeu, 0x00000000u, 0x00bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007fffffu, 0x00fffffeu, 0x00000000u, 0x00bffffeu}}},
+    {{0x007fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x00000000u, 0x00fffffeu, 0x00000000u, 0x00bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x007fffffu, 0x00fffffeu, 0x00000000u, 0x00bffffeu}}},
+    {{0x80000001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000001u, 0x80000002u, 0x00000000u, 0x80000002u}}},
+    {{0x80000001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000001u, 0x80000002u, 0x00000000u, 0x80000002u}}},
+    {{0x80000002u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000002u, 0x80000004u, 0x00000000u, 0x80000003u}}},
+    {{0x80000002u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000002u, 0x80000004u, 0x00000000u, 0x80000003u}}},
+    {{0x80000003u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000003u, 0x80000006u, 0x00000000u, 0x80000004u}}},
+    {{0x80000003u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000003u, 0x80000006u, 0x00000000u, 0x80000004u}}},
+    {{0x80155555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80155555u, 0x802aaaaau, 0x00000000u, 0x80200000u}}},
+    {{0x80155555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80155555u, 0x802aaaaau, 0x00000000u, 0x80200000u}}},
+    {{0x803fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x803fffffu, 0x807ffffeu, 0x00000000u, 0x805ffffeu}}},
+    {{0x803fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x803fffffu, 0x807ffffeu, 0x00000000u, 0x805ffffeu}}},
+    {{0x80400000u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400000u, 0x80800000u, 0x00000000u, 0x80600000u}}},
+    {{0x80400000u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800000u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400000u, 0x80800000u, 0x00000000u, 0x80600000u}}},
+    {{0x80400001u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800002u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400001u, 0x80800002u, 0x00000000u, 0x80600002u}}},
+    {{0x80400001u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80800002u, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80400001u, 0x80800002u, 0x00000000u, 0x80600002u}}},
+    {{0x80555555u, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80aaaaaau, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80555555u, 0x80aaaaaau, 0x00000000u, 0x80800000u}}},
+    {{0x80555555u, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80aaaaaau, 0x00000000u, 0x80000000u}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80555555u, 0x80aaaaaau, 0x00000000u, 0x80800000u}}},
+    {{0x807ffffeu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffcu, 0x00000000u, 0x80bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807ffffeu, 0x80fffffcu, 0x00000000u, 0x80bffffdu}}},
+    {{0x807ffffeu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffcu, 0x00000000u, 0x80bffffdu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807ffffeu, 0x80fffffcu, 0x00000000u, 0x80bffffdu}}},
+    {{0x807fffffu, 0x00000001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffeu, 0x00000000u, 0x80bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807fffffu, 0x80fffffeu, 0x00000000u, 0x80bffffeu}}},
+    {{0x807fffffu, 0x00800001u, 0x3f800000u}, {{0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x80000000u, 0x80fffffeu, 0x00000000u, 0x80bffffeu}, {0x00000000u, 0x00000000u, 0x00000000u, 0x00000000u}, {0x807fffffu, 0x80fffffeu, 0x00000000u, 0x80bffffeu}}},
+};
+
+static_assert(std::size(Vectors) <= Threads && std::size(ConstantVectors) <= Threads);
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+bool KeepsDenormals(const AgcDriver::VulkanDevice& device) {
+    const auto target = device.Target();
+    return target.float32DenormPreserve && !target.float32FlushToZero;
+}
+
+bool Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::uint32_t denorm32, bool ieee) {
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = ShaderRecompiler::ShaderFloatMode{(denorm32 << 4u) | (3u << 6u), true, ieee, false};
+    std::optional<decltype(ShaderRecompiler::Recompile(request))> result;
+    try {
+        result.emplace(ShaderRecompiler::Recompile(request));
+    } catch (const std::exception& error) {
+        const std::string message = error.what();
+        Require(!KeepsDenormals(device) && (denorm32 == 1u || denorm32 == 2u) && message.find("needs DenormPreserve 32") != std::string::npos,
+                "v_mullit_f32 denorm32 " + std::to_string(denorm32) + ": " + message);
+        return false;
+    }
+    device.Dispatch(*result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    return true;
+}
+
+void CheckRegisters(std::uint32_t denorm32, bool ieee) {
+    for (std::uint32_t row = 0; row < std::size(Vectors); ++row) {
+        const auto& vector = Vectors[row];
+        const auto actual = Output[row];
+        const auto expected = vector.expected[denorm32 * 2u + (ieee ? 1u : 0u)];
+        Require(actual == expected, "v_mullit_f32 denorm32 " + std::to_string(denorm32) + (ieee ? " ieee" : " no ieee") + " inputs " + Hex(vector.lhs) + " " + Hex(vector.rhs) + " " +
+                                        Hex(vector.limit) + " is " + Hex(actual) + ", expected " + Hex(expected));
+    }
+}
+
+void CheckConstants(std::uint32_t denorm32, bool ieee) {
+    for (std::uint32_t row = 0; row < std::size(ConstantVectors); ++row) {
+        const auto& vector = ConstantVectors[row];
+        for (std::uint32_t form = 0; form < ConstantForms; ++form) {
+            const auto actual = Output[row * ConstantForms + form];
+            const auto expected = vector.expected[denorm32][form];
+            Require(actual == expected, std::string(ConstantNames[form]) + " denorm32 " + std::to_string(denorm32) + (ieee ? " ieee" : " no ieee") + " inputs " + Hex(vector.inputs[0]) + " " +
+                                            Hex(vector.inputs[1]) + " " + Hex(vector.inputs[2]) + " is " + Hex(actual) + ", expected " + Hex(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const bool keeps = KeepsDenormals(*device);
+        std::uint32_t checked = 0u;
+        for (std::uint32_t denorm32 = 0u; denorm32 < 4u; ++denorm32) {
+            if (denorm32 == 3u && !keeps) continue;
+            for (const bool ieee : {false, true}) {
+                Input.fill(0u);
+                for (std::uint32_t row = 0; row < std::size(Vectors); ++row) {
+                    Input[row * Inputs] = Vectors[row].lhs;
+                    Input[row * Inputs + 1] = Vectors[row].rhs;
+                    Input[row * Inputs + 2] = Vectors[row].limit;
+                }
+                if (Run(*device, MullitCode, denorm32, ieee)) {
+                    CheckRegisters(denorm32, ieee);
+                    ++checked;
+                }
+                Input.fill(0u);
+                for (std::uint32_t row = 0; row < std::size(ConstantVectors); ++row) std::copy(std::begin(ConstantVectors[row].inputs), std::end(ConstantVectors[row].inputs), Input.begin() + row * Inputs);
+                if (Run(*device, ConstantMullitCode, denorm32, ieee)) {
+                    CheckConstants(denorm32, ieee);
+                    ++checked;
+                }
+            }
+        }
+        std::printf("v_mullit_f32 denormal mode tests passed (%u of 16 runs checked; denormal modes 1 and 2 need DenormPreserve 32, mode 3 is checked only where the device keeps f32 denormals)\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleCenteredLines.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleCenteredLines.cpp
new file mode 100644
index 0000000000..a5e2dfc7f6
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleCenteredLines.cpp
@@ -0,0 +1,330 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <iostream>
+#include <memory>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Side = 16;
+constexpr std::uint32_t Samples = 4;
+constexpr std::uint32_t SampleShift = 2;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t WaveSize = 64;
+constexpr std::uint32_t Float16x4Info = 0x0730u;
+constexpr std::uint32_t MultisampledAttrib = (SampleShift << 12u) | (SampleShift << 15u);
+constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
+constexpr std::uint32_t AaConfig4x = 0x0020c002u;
+constexpr std::uint32_t MsaaEnableClear = 2;
+constexpr std::uint32_t StandardLocations4x = 0x622ae6aeu;
+constexpr std::uint32_t Format16161616Float = 71;
+constexpr std::uint32_t Type2DMsaa = 14;
+constexpr std::uint32_t TileRenderTarget = 0x1b;
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Words = 32;
+constexpr std::uint32_t LoadResult = 12;
+constexpr std::array<std::uint32_t, 2> Primitives{2u, 3u};
+constexpr std::array<float, 4> Drawn{0.25f, 0.5f, 0.125f, 1.0f};
+constexpr std::array<std::byte, 4> DrawnBytes{std::byte{64}, std::byte{128}, std::byte{32}, std::byte{255}};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> PixelCode{
+    0x7e0802ff, 0x3e800000, 0x7e0a02ff, 0x3f000000, 0x7e0c02ff, 0x3e000000, 0x7e0e02ff, 0x3f800000, 0xf800180f, 0x07060504, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 11> Unorm8PixelCode{
+    0x7e0802ff, std::bit_cast<std::uint32_t>(64.0f / 255.0f), 0x7e0a02ff, std::bit_cast<std::uint32_t>(128.0f / 255.0f), 0x7e0c02ff, std::bit_cast<std::uint32_t>(32.0f / 255.0f), 0x7e0e02ff, std::bit_cast<std::uint32_t>(1.0f), 0xf800180f, 0x07060504, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 26> LoadCode{
+    0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
+    0x80000501, 0xe0301010, 0x80000601, 0xe0301014, 0x80000701, 0xbf8c3f70, 0xf0001f30, 0x00011005,
+    0xbf8c3f70, 0xe0701030, 0x80001001, 0xe0701034, 0x80001101, 0xe0701038, 0x80001201, 0xe070103c,
+    0x80001301, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::array<float, 4>, 4> Lines{{
+    {-0.828125f, -0.4375f, 0.5f, 1.0f}, {0.90625f, 0.140625f, 0.5f, 1.0f},
+    {-0.265625f, 0.90625f, 0.5f, 1.0f}, {0.34375f, -0.921875f, 0.5f, 1.0f},
+}};
+
+alignas(256) std::array<std::uint32_t, Threads * Words> Buffer{};
+alignas(256) std::array<std::array<std::byte, 4096>, Primitives.size()> LinePixels{};
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes) {
+#ifdef _WIN32
+        data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+#endif
+        Require(data != nullptr, "cannot allocate the multisampled color target");
+        std::memset(data, 0, bytes);
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        VirtualFree(data, 0, MEM_RELEASE);
+#else
+        std::free(data);
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::QueueState LineQueue(const Block& block, std::uint32_t primitive) {
+    const auto half = std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f);
+    const auto extent = (Side << 16u) | Side;
+    AgcDriver::QueueState queue;
+    queue.userConfig[0x242] = primitive;
+    queue.context = {
+        {0x2d5, 0x2000}, {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, AaConfig4x}, {0x292, MsaaEnableClear}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4},
+        {0x318, static_cast<std::uint32_t>(block.Address() >> 8u)}, {0x390, static_cast<std::uint32_t>(block.Address() >> 40u)},
+        {0x31b, 0}, {0x31c, Float16x4Info}, {0x31d, MultisampledAttrib},
+        {0x3b0, ((Side - 1u) << 14u) | (Side - 1u)}, {0x3b8, TiledAttrib3}, {0x1e0, 0},
+        {0xc, 0}, {0xd, extent}, {0x81, 0x80000000}, {0x82, extent},
+        {0x90, 0x80000000}, {0x91, extent}, {0x94, 0x80000000}, {0x95, extent},
+        {0x10f, half}, {0x110, half}, {0x111, std::bit_cast<std::uint32_t>(-static_cast<float>(Side) / 2.0f)}, {0x112, half},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0}, {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)}
+    };
+    for (std::uint32_t offset = 0x2fe; offset <= 0x30d; ++offset) queue.context[offset] = (offset - 0x2feu) % 4u == 0 ? StandardLocations4x : 0u;
+    queue.shader[0x008] = 0x100;
+    queue.shader[0x009] = 0;
+    return queue;
+}
+
+AgcDriver::Graphics::State DecodeLines(const Block& block, std::uint32_t primitive) {
+    const auto state = AgcDriver::Graphics::DecodeState(LineQueue(block, primitive));
+    const auto& color = state.color;
+    Require(state.topology == (primitive == 2u ? VK_PRIMITIVE_TOPOLOGY_LINE_LIST : VK_PRIMITIVE_TOPOLOGY_LINE_STRIP), "VGT_PRIMITIVE_TYPE " + std::to_string(primitive) + " did not decode as a line list or strip");
+    Require(state.colors.size() == 1 && color.address == block.Address() && color.format == VK_FORMAT_R16G16B16A16_SFLOAT && color.samples == Samples && color.extent.width == Side && color.extent.height == Side, "the target did not decode as a 16x16 RGBA16F surface of 4 samples");
+    Require(state.samples == Samples && !state.depth && !state.perSampleShading && !state.alphaToCoverage, "the lines did not decode as a 4x draw without depth, sample shading or alpha-to-coverage");
+    const auto locations = AgcDriver::Graphics::SampleLocations(state);
+    for (std::uint32_t sample = 0; sample < Samples; ++sample) Require(locations[sample].x == 0.5f && locations[sample].y == 0.5f, "the decoded 4x line state does not put every sample at the pixel center");
+    Require(state.viewport.x == 0.0f && state.viewport.y == static_cast<float>(Side) && state.viewport.width == static_cast<float>(Side) && state.viewport.height == -static_cast<float>(Side) && state.scissor.offset.x == 0 && state.scissor.offset.y == 0 && state.scissor.extent.width == Side && state.scissor.extent.height == Side, "the decoded viewport or scissor does not cover the 16x16 target");
+    return state;
+}
+
+AgcDriver::Graphics::State OneSample(AgcDriver::Graphics::State state, std::span<std::byte> pixels, const AgcDriver::Graphics::ColorTargetLayout& linear) {
+    state.color = {reinterpret_cast<std::uintptr_t>(pixels.data()), {Side, Side}, VK_FORMAT_R8G8B8A8_UNORM, linear.Bytes(), 0xe4u};
+    state.colors = {state.color};
+    state.samples = 1;
+    state.customSampleLocations = false;
+    state.sampleLocations.fill(0);
+    state.sampleLocationGrid = false;
+    return state;
+}
+
+void DrawLines(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::State& state, std::span<const std::uint32_t> pixelCode) {
+    const auto target = device.Target();
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(Lines.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(Lines.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {WaveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionX) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionY);
+    pixel.posX = true;
+    pixel.posY = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    const std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {WaveSize, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Lines.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+    device.WaitIdle();
+}
+
+std::vector<std::array<float, 4>> LoadSamples(AgcDriver::VulkanDevice& device, const Block& block) {
+    const auto address = block.Address();
+    const std::array<std::uint32_t, 8> texture{
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format16161616Float << 20u) | (((Side - 1u) & 3u) << 30u),
+        ((Side - 1u) >> 2u) | ((Side - 1u) << 14u),
+        0xfacu | (SampleShift << 16u) | (TileRenderTarget << 20u) | (Type2DMsaa << 28u),
+        0u,
+        SampleShift << 4u,
+        0u,
+        0u,
+    };
+    const auto bufferAddress = reinterpret_cast<std::uintptr_t>(Buffer.data());
+    const std::array<std::uint32_t, 4> buffer{static_cast<std::uint32_t>(bufferAddress), static_cast<std::uint32_t>((bufferAddress >> 32u) & 0xffffu), static_cast<std::uint32_t>(Buffer.size() * 4u), 0x31016facu};
+    std::vector<std::uint32_t> userData(16, 0u);
+    std::copy(buffer.begin(), buffer.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(LoadCode.data()), std::as_bytes(std::span(LoadCode))}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(LoadCode.data()), LoadCode, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto program = ShaderRecompiler::Recompile(request);
+    std::vector<std::array<float, 4>> loaded(Side * Side * Samples);
+    for (std::uint32_t first = 0; first < loaded.size(); first += Threads) {
+        Buffer.fill(0xdeadbeefu);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto index = first + tid;
+            const auto pixel = index / Samples;
+            const std::array<std::uint32_t, 6> words{0u, 0u, 0u, pixel % Side, pixel / Side, index % Samples};
+            std::copy(words.begin(), words.end(), &Buffer[tid * Words]);
+        }
+        device.Dispatch(program, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(LoadCode.data()));
+        device.WaitIdle();
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            for (std::uint32_t component = 0; component < 4u; ++component) loaded[first + tid][component] = std::bit_cast<float>(Buffer[tid * Words + LoadResult + component]);
+        }
+    }
+    return loaded;
+}
+
+bool NearEndpoint(std::uint32_t x, std::uint32_t y) {
+    return std::any_of(Lines.begin(), Lines.end(), [&](const std::array<float, 4>& vertex) {
+        const double px = (static_cast<double>(vertex[0]) + 1.0) * 0.5 * Side;
+        const double py = Side - (static_cast<double>(vertex[1]) + 1.0) * 0.5 * Side;
+        return std::fabs(x + 0.5 - px) < 1.5 && std::fabs(y + 0.5 - py) < 1.5;
+    });
+}
+
+void CompareLines(AgcDriver::VulkanDevice& device, const Block& block, std::uint32_t primitive, std::span<std::byte> pixels) {
+    const auto decoded = DecodeLines(block, primitive);
+    DrawLines(device, decoded, PixelCode);
+    const auto loaded = LoadSamples(device, block);
+    const AgcDriver::Graphics::ColorTargetLayout linear(Side, Side, AgcDriver::Graphics::ColorTileMode::Linear, 4u);
+    Require(linear.Bytes() <= pixels.size(), "the one-sample line target does not fit its memory");
+    std::fill(pixels.begin(), pixels.end(), std::byte{0});
+    DrawLines(device, OneSample(decoded, pixels, linear), Unorm8PixelCode);
+    std::uint32_t covered = 0;
+    std::uint32_t single = 0;
+    std::uint32_t compared = 0;
+    std::uint32_t differing = 0;
+    for (std::uint32_t y = 0; y < Side; ++y) {
+        for (std::uint32_t x = 0; x < Side; ++x) {
+            char where[80];
+            std::snprintf(where, sizeof(where), "VGT_PRIMITIVE_TYPE %u: pixel (%u, %u)", primitive, x, y);
+            std::uint32_t drawn = 0;
+            for (std::uint32_t sample = 0; sample < Samples; ++sample) {
+                const auto& texel = loaded[(y * Side + x) * Samples + sample];
+                Require(texel == Drawn || texel == std::array<float, 4>{}, std::string(where) + " of the 4x target holds neither the line color nor the cleared value");
+                drawn += texel == Drawn ? 1u : 0u;
+            }
+            Require(drawn == 0u || drawn == Samples, std::string(where) + " has " + std::to_string(drawn) + " of its 4 samples covered by a line with every sample at the pixel center");
+            const auto bytes = pixels.begin() + static_cast<std::ptrdiff_t>(linear.Offset(x, y));
+            const bool oneSample = std::equal(DrawnBytes.begin(), DrawnBytes.end(), bytes);
+            Require(oneSample || std::all_of(bytes, bytes + 4, [](std::byte value) { return value == std::byte{0}; }), std::string(where) + " of the one-sample target holds neither the line color nor zero");
+            covered += drawn == Samples ? 1u : 0u;
+            single += oneSample ? 1u : 0u;
+            if (NearEndpoint(x, y)) continue;
+            ++compared;
+            differing += (drawn == Samples) != oneSample ? 1u : 0u;
+            Require(!oneSample || drawn == Samples, std::string(where) + " is drawn by the one-sample line but not covered in the 4x target");
+        }
+    }
+    Require(covered >= 20u && covered <= 2u * single && compared >= 200u, "VGT_PRIMITIVE_TYPE " + std::to_string(primitive) + ": the 4x lines covered " + std::to_string(covered) + " pixels and the one-sample lines " + std::to_string(single) + ", with " + std::to_string(compared) + " pixels compared");
+    std::printf("VGT_PRIMITIVE_TYPE %u: 4x lines with every sample at the pixel center covered %u pixels in full and none in part; the one-sample lines drew %u; %u of the %u pixels away from the endpoints differ\n", primitive, covered, single, differing, compared);
+}
+
+}
+
+int main() {
+    try {
+        auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).storageImageMultisample) {
+            std::puts("skipped, the device has no shaderStorageImageMultisample to load the samples of a 4x target");
+            return VulkanTestSkipped;
+        }
+        if ((AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).sampleLocationSampleCounts & Samples) == 0u) {
+            std::puts("skipped, the device has no VK_EXT_sample_locations at 4 samples to put every sample at the pixel center");
+            return VulkanTestSkipped;
+        }
+        Block listTarget(4u * BlockBytes);
+        Block stripTarget(4u * BlockBytes);
+        struct ReleaseDevice {
+            std::unique_ptr<AgcDriver::VulkanDevice>& value;
+            ~ReleaseDevice() { value.reset(); }
+        } releaseDevice{device};
+        const std::array<const Block*, Primitives.size()> targets{&listTarget, &stripTarget};
+        for (std::size_t index = 0; index < Primitives.size(); ++index) CompareLines(*device, *targets[index], Primitives[index], LinePixels[index]);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp
index b603cc7326..5cc437a819 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleRetirement.cpp
@@ -14,6 +14,7 @@
 #else
 #include <sys/mman.h>
 #endif
+#include <algorithm>
 #include <chrono>
 #include <condition_variable>
 #include <cstdint>
@@ -66,6 +67,15 @@ PFN_vkDestroyImageView realDestroyImageView = nullptr;
 PFN_vkCmdClearColorImage realClearColorImage = nullptr;
 PFN_vkCmdCopyImage realCopyImage = nullptr;
 
+[[noreturn]] void FailViewOutlivesImage() {
+    std::fputs("an MSAA image would be destroyed before one of its views; stopping\n", stderr);
+    std::fflush(stderr);
+#ifdef _WIN32
+    TerminateProcess(GetCurrentProcess(), 1);
+#endif
+    std::_Exit(1);
+}
+
 [[noreturn]] void FailPendingImage() {
     std::fputs("an unsubmitted MSAA image would be destroyed; stopping without submitting it\n", stderr);
     std::fflush(stderr);
@@ -104,6 +114,7 @@ VKAPI_ATTR void VKAPI_CALL CountDestroyImage(VkDevice device, VkImage image, con
         for (const auto& [pending, generation] : pendingImages) {
             if (pending == image && images.at(image).generation == generation) FailPendingImage();
         }
+        if (std::any_of(views.begin(), views.end(), [&](const auto& entry) { return entry.second == image; })) FailViewOutlivesImage();
         realDestroyImage(device, image, callbacks);
         images.erase(image);
         ++destroyed;
@@ -254,11 +265,11 @@ private:
     bool mapped = false;
 };
 
-ColorTarget Target(const GuestBlock& block) {
+ColorTarget Target(const GuestBlock& block, VkFormat format = VK_FORMAT_R8G8B8A8_UNORM) {
     ColorTarget target{};
     target.address = target.surfaceAddress = block.Address();
     target.extent = target.surfaceExtent = {Side, Side};
-    target.format = VK_FORMAT_R8G8B8A8_UNORM;
+    target.format = format;
     target.elementBytes = 4;
     target.samples = 4;
     target.tileMode = ColorTileMode::RenderTarget;
@@ -514,6 +525,67 @@ public:
         AwaitImages(0, "promoted MSAA targets were not fully released");
     }
 
+    void StorageTwin() {
+        GuestBlock block;
+        const auto target = Target(block);
+        auto twin = target;
+        twin.format = VK_FORMAT_R8G8B8A8_SRGB;
+        const auto resource = Resource(block);
+        VkImage renderedImage = VK_NULL_HANDLE, twinImage = VK_NULL_HANDLE, promotedImage = VK_NULL_HANDLE, promotedTwinImage = VK_NULL_HANDLE;
+        Image rendered{}, promoted{};
+        VkImageView twinView = VK_NULL_HANDLE;
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            rendered = ImageFor(MultisampleTargetView(context, target), &renderedImage);
+            twinView = MultisampleTargetView(context, twin);
+            ImageFor(twinView, &twinImage);
+            Require(twinImage == renderedImage, "an sRGB use of an MSAA surface rendered as UNORM does not reach its samples");
+        }
+        Sync();
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            promoted = ImageFor(MultisampleTargetStorageView(context, resource), &promotedImage);
+            Require(promoted.generation != rendered.generation, "MSAA storage promotion kept the rendered image");
+            const auto promotedTwin = MultisampleTargetView(context, twin);
+            ImageFor(promotedTwin, &promotedTwinImage);
+            Require(promotedTwinImage == promotedImage, "after storage promotion an sRGB use of the MSAA surface still views the retired image");
+        }
+        Sync();
+        block.Unmap();
+        Clear();
+        AwaitImages(0, "MSAA targets with twin views were not fully released");
+    }
+
+    void StorageSrgbTwin() {
+        if (!context.storageImageMultisample || HostStorageFormat(context, VK_FORMAT_R8G8B8A8_SRGB) != VK_FORMAT_R8G8B8A8_UNORM) {
+            std::puts("the device has no UNORM storage form for a multisampled sRGB target; its storage twin case is skipped");
+            return;
+        }
+        GuestBlock block;
+        const auto target = Target(block, VK_FORMAT_R8G8B8A8_SRGB);
+        auto resource = Resource(block);
+        VkImageView storageView = VK_NULL_HANDLE;
+        {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            MultisampleTargetView(context, target);
+            storageView = MultisampleTargetStorageView(context, resource);
+            Require(storageView != VK_NULL_HANDLE, "a UNORM storage access to a multisampled sRGB target has no view");
+            Require(MultisampleTargetStorageView(context, resource) == storageView, "a repeated UNORM storage access to a multisampled sRGB target changed its view");
+            resource.format = 60;
+            bool refused = false;
+            try {
+                MultisampleTargetStorageView(context, resource);
+            } catch (const std::exception&) {
+                refused = true;
+            }
+            Require(refused, "a storage access in an unrelated format reached a multisampled sRGB target");
+        }
+        Sync();
+        block.Unmap();
+        Clear();
+        AwaitImages(0, "the sRGB storage twin targets were not fully released");
+    }
+
 private:
     AgcDriver::VulkanDevice& device;
     Context context;
@@ -532,7 +604,9 @@ int main() {
         run.RecordedRemap();
         run.SampledRemap();
         run.StorageRemap();
+        run.StorageSrgbTwin();
         run.OrderRemap();
+        if (context.storageImageMultisample) run.StorageTwin();
         std::puts("retired MSAA allocations stay bounded, recorded clears and storage promotions retain their images, sampled aliases release their parents after the last batch, and sample-order targets keep their retired images until their batch completes");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleSrgbTwin.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleSrgbTwin.cpp
new file mode 100644
index 0000000000..a28966b839
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/MultisampleSrgbTwin.cpp
@@ -0,0 +1,247 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/MultisampleTarget.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/Shutdown.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <initializer_list>
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <stdexcept>
+#include <utility>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::ColorTarget;
+using AgcDriver::Graphics::Require;
+
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Side = 64;
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::byte*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::byte*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "multisampled sRGB twin: cannot allocate a guest block");
+        std::memset(block, 0, BlockBytes);
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint64_t Address() const { return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(block)); }
+
+private:
+    std::byte* block = nullptr;
+};
+
+GuestBlock& NewBlock() {
+    static auto* blocks = new std::deque<GuestBlock>();
+    return blocks->emplace_back();
+}
+
+ColorTarget MultisampledTarget(const GuestBlock& color, VkFormat format) {
+    ColorTarget target{};
+    target.address = color.Address();
+    target.surfaceAddress = target.address;
+    target.extent = {Side, Side};
+    target.surfaceExtent = target.extent;
+    target.format = format;
+    target.tileMode = AgcDriver::Graphics::ColorTileMode::RenderTarget;
+    target.elementBytes = 4;
+    target.bytes = BlockBytes / 4;
+    target.samples = 4;
+    return target;
+}
+
+struct Acquired {
+    VkImageView view = VK_NULL_HANDLE;
+    VkImage image = VK_NULL_HANDLE;
+    std::shared_ptr<void> owner;
+};
+
+Acquired Acquire(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::Context& context, const ColorTarget& target) {
+    std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+    Acquired acquired;
+    acquired.view = AgcDriver::Graphics::MultisampleTargetView(context, target, acquired.owner, &acquired.image);
+    Require(acquired.view != VK_NULL_HANDLE && acquired.image != VK_NULL_HANDLE && acquired.owner != nullptr, "the multisampled target has no view");
+    device.SubmitRecorded(true);
+    device.WaitIdle();
+    return acquired;
+}
+
+std::array<std::byte, 4> UniformTexel(const AgcDriver::Graphics::Context& context, VkImage multisampled, VkFormat format) {
+    VkImageCreateInfo info{VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO};
+    info.imageType = VK_IMAGE_TYPE_2D;
+    info.format = format;
+    info.extent = {Side, Side, 1};
+    info.mipLevels = 1;
+    info.arrayLayers = 1;
+    info.samples = VK_SAMPLE_COUNT_1_BIT;
+    info.tiling = VK_IMAGE_TILING_OPTIMAL;
+    info.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT;
+    info.initialLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+    VkImage resolved = VK_NULL_HANDLE;
+    AgcDriver::Graphics::Check(context.Function<PFN_vkCreateImage>("vkCreateImage")(context.device, &info, nullptr, &resolved), "vkCreateImage resolved texels");
+    VkMemoryRequirements requirements{};
+    context.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(context.device, resolved, &requirements);
+    VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
+    allocation.allocationSize = requirements.size;
+    allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
+    VkDeviceMemory memory = VK_NULL_HANDLE;
+    AgcDriver::Graphics::Check(context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &memory), "vkAllocateMemory resolved texels");
+    AgcDriver::Graphics::Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, resolved, memory, 0), "vkBindImageMemory resolved texels");
+    AgcDriver::Graphics::Buffer readback(context, static_cast<std::size_t>(Side) * Side * 4u, VK_BUFFER_USAGE_TRANSFER_DST_BIT);
+    {
+        AgcDriver::Graphics::CommandBatch batch(context);
+        const auto commands = batch.Handle();
+        std::array<VkImageMemoryBarrier, 2> barriers{};
+        for (auto& barrier : barriers) {
+            barrier.sType = VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER;
+            barrier.srcQueueFamilyIndex = barrier.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+            barrier.subresourceRange = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
+        }
+        barriers[0].image = multisampled;
+        barriers[0].srcAccessMask = VK_ACCESS_MEMORY_WRITE_BIT;
+        barriers[0].dstAccessMask = VK_ACCESS_TRANSFER_READ_BIT;
+        barriers[0].oldLayout = barriers[0].newLayout = VK_IMAGE_LAYOUT_GENERAL;
+        barriers[1].image = resolved;
+        barriers[1].dstAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+        barriers[1].oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+        barriers[1].newLayout = VK_IMAGE_LAYOUT_GENERAL;
+        context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 0, nullptr, 0, nullptr, static_cast<std::uint32_t>(barriers.size()), barriers.data());
+        VkImageResolve region{};
+        region.srcSubresource = region.dstSubresource = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 0, 1};
+        region.extent = {Side, Side, 1};
+        context.Function<PFN_vkCmdResolveImage>("vkCmdResolveImage")(commands, multisampled, VK_IMAGE_LAYOUT_GENERAL, resolved, VK_IMAGE_LAYOUT_GENERAL, 1, &region);
+        VkMemoryBarrier toCopy{VK_STRUCTURE_TYPE_MEMORY_BARRIER};
+        toCopy.srcAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+        toCopy.dstAccessMask = VK_ACCESS_TRANSFER_READ_BIT;
+        context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 1, &toCopy, 0, nullptr, 0, nullptr);
+        VkBufferImageCopy copy{};
+        copy.imageSubresource = {VK_IMAGE_ASPECT_COLOR_BIT, 0, 0, 1};
+        copy.imageExtent = {Side, Side, 1};
+        context.Function<PFN_vkCmdCopyImageToBuffer>("vkCmdCopyImageToBuffer")(commands, resolved, VK_IMAGE_LAYOUT_GENERAL, readback.Handle(), 1, &copy);
+        VkMemoryBarrier toHost{VK_STRUCTURE_TYPE_MEMORY_BARRIER};
+        toHost.srcAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+        toHost.dstAccessMask = VK_ACCESS_HOST_READ_BIT;
+        context.Function<PFN_vkCmdPipelineBarrier>("vkCmdPipelineBarrier")(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_HOST_BIT, 0, 1, &toHost, 0, nullptr, 0, nullptr);
+        batch.SubmitAndWait();
+    }
+    readback.Invalidate();
+    const auto bytes = readback.Bytes();
+    std::array<std::byte, 4> texel{};
+    std::copy_n(bytes.begin(), texel.size(), texel.begin());
+    for (std::size_t offset = 0; offset < bytes.size(); offset += texel.size()) Require(std::equal(texel.begin(), texel.end(), bytes.begin() + static_cast<std::ptrdiff_t>(offset)), "a cleared multisampled target holds different texels");
+    context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, resolved, nullptr);
+    context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, memory, nullptr);
+    return texel;
+}
+
+std::array<std::byte, 4> Bytes(std::uint32_t pattern) {
+    std::array<std::byte, 4> bytes{};
+    std::memcpy(bytes.data(), &pattern, bytes.size());
+    return bytes;
+}
+
+void FillTakenThroughTwin(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::Context& context, VkFormat created, VkFormat used, std::uint32_t pattern) {
+    auto& color = NewBlock();
+    const auto target = MultisampledTarget(color, created);
+    const auto rendered = Acquire(device, context, target);
+    const auto bytes = static_cast<std::size_t>(AgcDriver::Graphics::MultisampledColorBytes(target));
+    Require(AgcDriver::Graphics::MultisampledColorFillAbsorbs(color.Address(), bytes, pattern), "the color fill is not taken as the target's clear in its creation format");
+    AgcDriver::Graphics::NoteColorMetadataFill(color.Address(), bytes, pattern);
+    const auto twin = Acquire(device, context, MultisampledTarget(color, used));
+    Require(twin.image == rendered.image, "the twin use of the filled target does not reach its samples");
+    std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+    Require(UniformTexel(context, twin.image, created) == Bytes(pattern), "a fill taken as a clear through the twin format does not store the guest's bytes");
+}
+
+bool TwinFormatsShareTheirSamples(AgcDriver::VulkanDevice& device) {
+    const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(device);
+    if ((context.limits.framebufferColorSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0) {
+        std::cout << "skipped, the device has no 4x color targets\n";
+        return false;
+    }
+    struct ClearTargets {
+        AgcDriver::VulkanDevice& device;
+        VkDevice handle;
+        ~ClearTargets() {
+            std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+            device.SubmitRecorded(true);
+            device.WaitIdle();
+            AgcDriver::Graphics::ClearMultisampleTargets(handle);
+        }
+    } clearTargets{device, context.device};
+    for (const auto [first, second] : {std::pair{VK_FORMAT_B8G8R8A8_SRGB, VK_FORMAT_B8G8R8A8_UNORM}, std::pair{VK_FORMAT_R8G8B8A8_UNORM, VK_FORMAT_R8G8B8A8_SRGB}}) {
+        if (AgcDriver::Graphics::SrgbTwinFormat(context, first) != second && AgcDriver::Graphics::SrgbTwinFormat(context, second) != first) continue;
+        auto& color = NewBlock();
+        const auto rendered = Acquire(device, context, MultisampledTarget(color, first));
+        const auto twin = Acquire(device, context, MultisampledTarget(color, second));
+        Require(twin.image == rendered.image && twin.owner == rendered.owner, "a use of a multisampled surface in its sRGB twin format does not reach the samples rendered in the other format");
+        Require(twin.view != rendered.view, "a use of a multisampled surface in its sRGB twin format is given the view of the other format");
+        const auto again = Acquire(device, context, MultisampledTarget(color, first));
+        Require(again.image == rendered.image && again.view == rendered.view, "returning to the first format does not give back the first format's view");
+    }
+    if (AgcDriver::Graphics::SrgbTwinFormat(context, VK_FORMAT_R8G8B8A8_UNORM) == VK_FORMAT_R8G8B8A8_SRGB) {
+        FillTakenThroughTwin(device, context, VK_FORMAT_R8G8B8A8_UNORM, VK_FORMAT_R8G8B8A8_SRGB, 0x80808080u);
+        FillTakenThroughTwin(device, context, VK_FORMAT_R8G8B8A8_SRGB, VK_FORMAT_R8G8B8A8_UNORM, 0xff0000ffu);
+    }
+    auto& other = NewBlock();
+    const auto unorm = Acquire(device, context, MultisampledTarget(other, VK_FORMAT_R8G8B8A8_UNORM));
+    const auto floating = Acquire(device, context, MultisampledTarget(other, VK_FORMAT_R16G16_SFLOAT));
+    Require(floating.image != unorm.image, "a multisampled surface used in an unrelated format of the same size shares the other format's samples");
+    return true;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const bool tested = TwinFormatsShareTheirSamples(*device);
+        LibcRunShutdown_nid_postfix();
+        if (!tested) return VulkanTestSkipped;
+        std::cout << "multisampled sRGB twin tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            LibcRunShutdown_nid_postfix();
+        } catch (...) {
+        }
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/NativeDepthBdaClear.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/NativeDepthBdaClear.cpp
index d1564e3562..6df1dfa361 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/NativeDepthBdaClear.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/NativeDepthBdaClear.cpp
@@ -25,7 +25,9 @@
 #include <cstring>
 #include <exception>
 #include <mutex>
+#include <optional>
 #include <span>
+#include <utility>
 
 namespace AgcDriver {
 
@@ -93,7 +95,9 @@ private:
 #endif
 };
 
-int RunNativeClear(AgcDriver::VulkanDevice& device) {
+enum class ClearConsumer { Owner, Texture, Attachment };
+
+int RunNativeClear(AgcDriver::VulkanDevice& device, ClearConsumer consumer) {
     using namespace ShaderRecompiler;
     using namespace AgcDriver::Graphics;
     const std::lock_guard lock(Memory::GpuMutex());
@@ -153,10 +157,28 @@ int RunNativeClear(AgcDriver::VulkanDevice& device) {
     device.WaitIdle();
     target.clearDepth = 1.0f;
     Require(DepthSurfaceView(context, target) == view, "changing the native clear value replaced its attachment");
-    NoteHtileDepthClear(target.htileAddress, metadataBytes, metadataBytes);
+    std::optional<std::pair<std::uint64_t, std::size_t>> htileClear;
+    if (NoteHtileDepthClear(target.htileAddress, metadataBytes, metadataBytes)) htileClear.emplace(target.htileAddress, metadataBytes);
+    Require(htileClear.has_value(), "the full BDA clear was not registered for completion");
     const auto generation = Memory::TrackerGeneration();
     userData[4] = 0xfffffff0u;
-    device.Dispatch(compile(), groups, 1u, 1u, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.Dispatch(compile(), groups, 1u, 1u, {}, reinterpret_cast<std::uintptr_t>(code.data()), nullptr, nullptr, htileClear);
+    std::puts("Native full BDA clear: checking sampled owner before explicit WaitIdle");
+    Require(context.recorder->PendingWriteOverlaps(target.htileAddress, metadataBytes), "the recognized HTILE clear is missing its pending write range");
+    switch (consumer) {
+        case ClearConsumer::Owner:
+            Require(DepthSurfaceHolds(context, DecodeTextureResource(words), sampled.get()), "a pending full BDA clear lost its native sampled owner");
+            break;
+        case ClearConsumer::Texture:
+            Require(CachedSampledTexture(context, words) == sampled, "a pending full BDA clear lost its native sampled view");
+            break;
+        case ClearConsumer::Attachment:
+            Require(DepthSurfaceView(context, target) == view, "a pending full BDA clear lost its native attachment");
+            break;
+    }
+    std::printf("Native full BDA clear: consumer=%u settled the recognized clear before WaitIdle\n", static_cast<unsigned>(consumer));
+    Require(!context.recorder->PendingWriteOverlaps(target.htileAddress, metadataBytes), "the native HTILE consumer did not settle its clear's pending write");
+    Require(Memory::StoredAllSince_nid_no_patch(target.htileAddress, metadataBytes, generation), "the native HTILE consumer did not complete its recognized clear");
     device.WaitIdle();
     for (std::size_t offset = 0; offset < BlockBytes; offset += 4u) {
         std::uint32_t value = 0;
@@ -164,6 +186,7 @@ int RunNativeClear(AgcDriver::VulkanDevice& device) {
         Require(value == (offset < metadataBytes ? 0xfffffff0u : 0u), "the native GPU clear did not write its exact metadata range");
     }
     std::printf("Native full BDA clear: exact %zu-byte metadata readback passed; complete=%d\n", metadataBytes, Memory::StoredAllSince_nid_no_patch(target.htileAddress, metadataBytes, generation));
+    Require(Memory::StoredAllSince_nid_no_patch(target.htileAddress, metadataBytes, generation), "the completed recognized native clear did not record exact coverage");
     Require(CachedSampledTexture(context, words) == sampled, "a completed full BDA clear lost its native sampled view");
     Require(DepthSurfaceView(context, target) == view, "a completed full BDA clear replaced its native attachment");
     device.WaitIdle();
@@ -178,7 +201,11 @@ int main() {
     try {
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
-        return RunNativeClear(*device);
+        for (const auto consumer : {ClearConsumer::Owner, ClearConsumer::Texture, ClearConsumer::Attachment}) {
+            const auto result = RunNativeClear(*device, consumer);
+            if (result != 0) return result;
+        }
+        return 0;
     } catch (const std::exception& error) {
         std::fprintf(stderr, "%s\n", error.what());
         return 1;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
index cda5b9280a..5548d5d7fa 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
@@ -7,11 +7,15 @@
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
 #include "SpirvBackend/SpirvModule.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <algorithm>
 #include <array>
@@ -21,6 +25,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <memory>
+#include <mutex>
 #include <optional>
 #include <span>
 #include <string>
@@ -35,6 +40,12 @@
 #include <sys/mman.h>
 #endif
 
+namespace AgcDriver::DriverDetail {
+struct DriverTestAccess {
+    static std::shared_ptr<VulkanDevice> GetDevice() { return Driver::Get().device.Load(); }
+};
+}
+
 namespace {
 
 using namespace AgcDriver::Graphics;
@@ -44,6 +55,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -55,26 +68,22 @@ public:
             app.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &app;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0u;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
             Check(enumerate(instance, &count, nullptr), "vkEnumeratePhysicalDevices");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            int selected = -1;
-            for (const auto physical : devices) {
-                VkPhysicalDeviceProperties properties{};
-                function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties")(physical, &properties);
-                if (const auto* wanted = std::getenv("ANYPS5_GPU"); wanted != nullptr && std::string(properties.deviceName).find(wanted) == std::string::npos) continue;
-                const int rank = properties.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU ? 3 : properties.deviceType == VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU ? 2 : 1;
-                if (properties.apiVersion < VK_API_VERSION_1_1 || rank <= selected) continue;
-                context.physical = physical;
-                context.limits = properties.limits;
-                selected = rank;
-            }
-            Require(context.physical != VK_NULL_HANDLE, "no Vulkan 1.1 device");
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             VkPhysicalDeviceProperties selectedProperties{};
             function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties")(context.physical, &selectedProperties);
+            context.limits = selectedProperties.limits;
             std::printf("Selected GPU name=%s vendor=0x%x device=0x%x driver=%u\n", selectedProperties.deviceName, selectedProperties.vendorID, selectedProperties.deviceID, selectedProperties.driverVersion);
             const auto queues = function<PFN_vkGetPhysicalDeviceQueueFamilyProperties>("vkGetPhysicalDeviceQueueFamilyProperties");
             queues(context.physical, &count, nullptr);
@@ -137,7 +146,7 @@ private:
 
 class TargetMemory {
 public:
-    explicit TargetMemory(std::size_t bytes) : bytes(bytes) {
+    explicit TargetMemory(std::size_t bytes, bool registerAllocation = false) : bytes(bytes), registered(registerAllocation) {
 #ifdef _WIN32
         pointer = GuestArena::GuestArenaAllocate_nid_postfix(bytes, 65536u);
         GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, PAGE_READWRITE, bytes);
@@ -153,8 +162,10 @@ public:
 #endif
         Require(pointer != nullptr, "multisample target fixture allocation failed");
         std::memset(pointer, 0xa5, bytes);
+        if (registered) GuestAllocations::Mutation().Add(pointer, bytes, true, true, true);
     }
     ~TargetMemory() {
+        if (registered) GuestAllocations::Mutation().Remove(pointer);
 #ifdef _WIN32
         GuestArena::GuestArenaReset_nid_postfix(pointer, bytes);
         GuestArena::GuestArenaRelease_nid_postfix(pointer, bytes);
@@ -168,8 +179,49 @@ public:
 private:
     void* pointer = nullptr;
     std::size_t bytes;
+    bool registered = false;
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 17> HtileMaskKernel{
+    0xd7460000u, 0x04010c06u, 0x34000084u, 0xdc388000u, 0x04020000u, 0xbf8c3f70u, 0xd7710008u, 0x00120805u,
+    0xd7710009u, 0x00120a05u, 0xd771000au, 0x00120c05u, 0xd771000bu, 0x00120e05u, 0xdc788000u, 0x00020800u,
+    0xbf810000u,
+};
+
+std::vector<std::uint32_t> DriverPm4Packet(std::uint32_t opcode, std::initializer_list<std::uint32_t> body) {
+    std::vector<std::uint32_t> words{0xc0000000u | (static_cast<std::uint32_t>(body.size() - 1u) << 16u) | (opcode << 8u)};
+    words.insert(words.end(), body);
+    return words;
+}
+
+Context SubmitDriverHtileClear(std::uint64_t address, std::unique_lock<AgcDriver::GuestMemory::GpuMutexType>& gpuLock) {
+    const auto shader = reinterpret_cast<std::uintptr_t>(HtileMaskKernel.data());
+    std::vector<std::uint32_t> commands;
+    const auto append = [&commands](std::vector<std::uint32_t> packet) { commands.insert(commands.end(), packet.begin(), packet.end()); };
+    append(DriverPm4Packet(0x76u, {0x20cu, static_cast<std::uint32_t>(shader >> 8u)}));
+    append(DriverPm4Packet(0x76u, {0x20du, static_cast<std::uint32_t>(shader >> 40u) & 0xffu}));
+    append(DriverPm4Packet(0x76u, {0x207u, 64u}));
+    append(DriverPm4Packet(0x76u, {0x208u, 1u}));
+    append(DriverPm4Packet(0x76u, {0x209u, 1u}));
+    append(DriverPm4Packet(0x76u, {0x213u, (6u << 1u) | 0x80u}));
+    append(DriverPm4Packet(0x76u, {0x240u, 0u}));
+    append(DriverPm4Packet(0x76u, {0x241u, 0u}));
+    append(DriverPm4Packet(0x76u, {0x242u, static_cast<std::uint32_t>(address)}));
+    append(DriverPm4Packet(0x76u, {0x243u, static_cast<std::uint32_t>(address >> 32u)}));
+    append(DriverPm4Packet(0x76u, {0x244u, 0xfffc00f0u}));
+    append(DriverPm4Packet(0x76u, {0x245u, 0u}));
+    append(DriverPm4Packet(0x15u, {32u, 1u, 1u, 0x41u}));
+    Packet packet{commands.data(), static_cast<std::uint32_t>(commands.size()), 0u, {}};
+    Require(sceAgcDriverSubmitDcb(&packet) == 0, "native depth HTILE clear: PM4 submission failed");
+    gpuLock.unlock();
+    try { AgcDriverWaitIdle_nid_postfix(); }
+    catch (...) { gpuLock.lock(); throw; }
+    gpuLock.lock();
+    const auto driverDevice = AgcDriver::DriverDetail::DriverTestAccess::GetDevice();
+    Require(driverDevice != nullptr, "HTILE clear driver device is missing");
+    return driverDevice->graphicsContext();
+}
+
 template<typename Action>
 void TargetRefuses(Action action, std::string_view expected) {
     std::string message;
@@ -548,7 +600,8 @@ void CheckDrawFeedback() {
     Require(device != nullptr, "native depth draw feedback requires Vulkan");
     constexpr VkExtent2D extent{5u, 3u};
     constexpr std::uint32_t samples = 4u;
-    TargetMemory memory(static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, 4u, samples))), metadata(65536u);
+    const auto depthBytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, 4u, samples));
+    TargetMemory memory(depthBytes), metadata(65536u);
     std::memset(metadata.Data(), 0, 65536u);
     DepthTarget depth{memory.Address(), 0u, extent, VK_FORMAT_D32_SFLOAT, 0.0f, 0u, metadata.Address(), false, samples};
     depth.depthSwizzle = 24u;
@@ -581,6 +634,9 @@ void CheckDrawFeedback() {
     const std::array<CompiledShader, 2> initial{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0u}, {ShaderRecompiler::ShaderStage::Fragment, &producer, pixelOffset}}};
     device->Draw(state, draw, initial);
     device->WaitIdle();
+    std::array<std::byte, 1> probe{};
+    TargetRefuses([&] { AgcDriver::GuestMemory::Read(depth.address, probe); }, "sample-preserving guest publication");
+    Require(DepthSurfaceAt(depth.address), "a refused guest read retired a native depth surface a draw wrote");
     reader.spirv = DepthFeedbackFragmentShader(binding, true);
     reader.variantId = 3u;
     const auto words = DepthSampleWords(depth);
@@ -597,10 +653,25 @@ void CheckDrawFeedback() {
     const std::array<CompiledShader, 2> shaders{{{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0u}, {ShaderRecompiler::ShaderStage::Fragment, &reader, pixelOffset}}};
     TargetRefuses([&] { device->Draw(state, draw, shaders); }, "sampling a native multisampled depth target the draw attaches");
     device->WaitIdle();
-    std::puts("Native depth feedback refused through the draw resource path");
+    TargetMemory testedMemory(depthBytes), testedMetadata(65536u);
+    std::memset(testedMetadata.Data(), 0, 65536u);
+    const auto guestByte = [](std::size_t offset) { return static_cast<std::byte>(offset * 7u + 3u); };
+    for (std::size_t offset = 0u; offset < depthBytes; ++offset) testedMemory.Data()[offset] = guestByte(offset);
+    auto tested = depth;
+    tested.address = testedMemory.Address();
+    tested.htileAddress = testedMetadata.Address();
+    state.depth = tested;
+    state.depthWrite = false;
+    device->Draw(state, draw, initial);
+    device->WaitIdle();
+    Require(DepthSurfaceAt(tested.address), "a depth-test-only draw left no resident native depth surface");
+    AgcDriver::GuestMemory::Read(tested.address + depthBytes - 1u, probe);
+    Require(probe[0] == guestByte(depthBytes - 1u), "a guest read after a depth-test-only draw did not return its guest bytes");
+    Require(!DepthSurfaceAt(tested.address), "a guest read left a native depth surface only depth-tested resident");
+    std::puts("Native depth feedback refused through the draw resource path; a written surface refused and a depth-tested one retired on guest read");
 }
 
-enum class ClearFault { None, PartialStore, CpuWrite, DepthWrite, BadMetadata, UnprovenDispatch, PendingWrite, Overlap };
+enum class ClearFault { None, PartialStore, CpuWrite, DepthWrite, BadMetadata, UnprovenDispatch, PendingWrite, Overlap, PossibleStore, CompletedPossibleStore, DriverDispatch, ImportWindowWrite };
 
 void CheckClearDispatch() {
     const std::array<std::uint32_t, 17> code{
@@ -609,7 +680,7 @@ void CheckClearDispatch() {
         0xd771000a, 0x00120c05, 0xd771000b, 0x00120e05,
         0xdc788000, 0x00020800, 0xbf810000,
     };
-    const std::array<std::uint32_t, 6> userData{0u, 0u, 65536u, 0u, 0xf0u, 0xf0u};
+    const std::array<std::uint32_t, 6> userData{0u, 0u, 65536u, 0u, 0xfffc00f0u, 0u};
     const ShaderRecompiler::ShaderComputeStageInfo compute{{64u, 1u, 1u}, 0u, {true, false, false}, false, 1u};
     const std::array<std::uint32_t, 5> packet{0u, 32u, 1u, 1u, 1u};
     Require(HtileDepthClearBytes_nid_no_patch(code, userData, compute, packet, 0u) == 32768u, "complete HTILE mask dispatch was not recognized");
@@ -649,10 +720,10 @@ void CheckClearDispatch() {
     }
 }
 
-void CheckDepthTarget(Context context, VkFormat format, std::uint32_t fragments, bool one, bool clearing = false, std::optional<bool> depthOnlyOverride = std::nullopt, ClearFault fault = ClearFault::None, bool iterate256 = true) {
+void CheckDepthTarget(Context context, VkFormat format, std::uint32_t fragments, bool one, bool clearing, std::optional<bool> depthOnlyOverride, ClearFault fault, std::unique_lock<AgcDriver::GuestMemory::GpuMutexType>& gpuLock, bool iterate256 = true) {
     const VkExtent2D extent{5u, 3u};
     const auto bytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, format == VK_FORMAT_D16_UNORM ? 2u : 4u, fragments));
-    TargetMemory memory(bytes), metadata(65536u);
+    TargetMemory memory(bytes), metadata(65536u, fault == ClearFault::DriverDispatch);
     const auto metadataBytes = HtileMetadataBytes(extent);
     const bool depthOnly = depthOnlyOverride.value_or(one);
     const std::uint32_t pattern = one ? (depthOnly ? 0xfffffff0u : 0xfffc00f0u) : 0u;
@@ -679,6 +750,7 @@ void CheckDepthTarget(Context context, VkFormat format, std::uint32_t fragments,
     }
     const auto view = DepthSurfaceView(context, target);
     Require(DepthSurfaceView(context, target) == view, "native depth attachment did not reuse its image");
+    NoteDepthSurfaceWrite(context, target);
     std::array<std::byte, 1> beforeSampling{};
     TargetRefuses([&] { AgcDriver::GuestMemory::Read(target.address + bytes - 1u, beforeSampling); }, "sample-preserving guest publication");
     TargetRefuses([&] { RequireNoMultisampleTarget(target.htileAddress + metadataBytes - 1u, 1u, "a DMA copy"); }, "sample-preserving guest publication");
@@ -770,17 +842,65 @@ void CheckDepthTarget(Context context, VkFormat format, std::uint32_t fragments,
                 target.clearDepth = clearOne ? 1.0f : 0.0f;
                 Require(DepthSurfaceView(context, target) == view, "updating the native clear value replaced its attachment");
                 const std::uint32_t clearPattern = clearOne ? (depthOnly ? 0xfffffff0u : 0xfffc00f0u) : 0u;
-                const auto nativeBytes = fault == ClearFault::UnprovenDispatch ? 0u : static_cast<std::size_t>(metadataBytes);
-                NoteHtileDepthClear(target.htileAddress, static_cast<std::size_t>(metadataBytes), nativeBytes);
-                if (fault == ClearFault::Overlap) NoteHtileDepthClear(target.htileAddress, static_cast<std::size_t>(metadataBytes), nativeBytes);
-                const auto storedBytes = fault == ClearFault::PartialStore ? 4u : static_cast<std::size_t>(metadataBytes);
-                AgcDriver::GuestMemory::StoreOwnBytes(target.htileAddress, storedBytes, [&] {
-                    for (std::size_t i = 0u; i < storedBytes / 4u; ++i) std::memcpy(metadata.Data() + i * 4u, &clearPattern, 4u);
-                    if (fault == ClearFault::BadMetadata) metadata.Data()[0] = std::byte{0x0f};
-                });
-                if (fault == ClearFault::CpuWrite) metadata.Data()[metadataBytes - 1u] ^= std::byte{0x01};
-                if (fault == ClearFault::DepthWrite) memory.Data()[bytes - 1u] ^= std::byte{0x01};
-                if (fault == ClearFault::PendingWrite) QueueTargetByteWrite(context, recorder, target.htileAddress, std::byte{0});
+                if (fault == ClearFault::DriverDispatch && clearOne) {
+                    struct ShutdownDriver {
+                        ~ShutdownDriver() {
+                            try { AgcDriverShutdown_nid_postfix(); } catch (...) {}
+                        }
+                    } shutdownDriver;
+                    const auto generation = AgcDriver::GuestMemory::TrackerGeneration();
+                    const auto driverContext = SubmitDriverHtileClear(target.htileAddress, gpuLock);
+                    recorder.Activate();
+                    Require(Recorder::Active() == &recorder, "driver idle did not restore the native depth fixture recorder");
+                    if (!AgcDriver::GuestMemory::Watched(target.htileAddress, metadataBytes)) {
+                        Require(PrepareImportWatch(driverContext) == ImportWatch::Unwatch,
+                                "the HTILE metadata range lost write-watch coverage on a device whose host imports stay watched");
+                        std::puts("skipped native HTILE write-coverage assertion: the write tracker does not cover the imported metadata range; the production depth-sampling path may still decline this clear");
+                        TargetRefuses([&] { Require(DepthSurfaceHolds(context, DecodeTextureResource(words), texture.get()), "native depth owner was not retained"); },
+                                      "native multisample depth clear requires tracked HTILE generations");
+                        return;
+                    } else {
+                        const bool storedAll = AgcDriver::GuestMemory::StoredAllSince_nid_no_patch(target.htileAddress, metadataBytes, generation);
+                        Require(storedAll, "driver idle returned before recording the completed HTILE dispatch");
+                    }
+                } else {
+                    const auto nativeBytes = fault == ClearFault::UnprovenDispatch ? 0u : static_cast<std::size_t>(metadataBytes);
+                    if (fault == ClearFault::PartialStore || fault == ClearFault::PossibleStore || fault == ClearFault::CompletedPossibleStore) {
+                        for (std::size_t i = 0u; i < metadataBytes / 4u; ++i) std::memcpy(metadata.Data() + i * 4u, &clearPattern, 4u);
+                    }
+                    const bool completionCandidate = NoteHtileDepthClear(target.htileAddress, static_cast<std::size_t>(metadataBytes), nativeBytes);
+                    if (fault == ClearFault::ImportWindowWrite) {
+                        const auto beforeImport = AgcDriver::GuestMemory::TrackerGeneration();
+                        Require(AgcDriver::GuestMemory::ImportWatched(target.htileAddress, static_cast<std::size_t>(metadataBytes), [&] {
+                            metadata.Data()[0] ^= std::byte{0x01};
+                            return true;
+                        }), "HTILE host import simulation failed");
+                        Require(AgcDriver::GuestMemory::CollectWritesUncached(target.htileAddress, static_cast<std::size_t>(metadataBytes)) > beforeImport, "HTILE import window did not stamp its changed page");
+                    }
+                    if (completionCandidate) ArmHtileDepthClear(target.htileAddress, static_cast<std::size_t>(metadataBytes));
+                    if (fault == ClearFault::Overlap) NoteHtileDepthClear(target.htileAddress, static_cast<std::size_t>(metadataBytes), nativeBytes);
+                    const auto storedBytes = fault == ClearFault::PartialStore ? 4u : static_cast<std::size_t>(metadataBytes);
+                    if (fault == ClearFault::PossibleStore || fault == ClearFault::CompletedPossibleStore) {
+                        const auto generation = AgcDriver::GuestMemory::TrackerGeneration();
+                        AgcDriver::GuestMemory::MarkPossiblyWritten(target.htileAddress, metadataBytes);
+                        Require(!AgcDriver::GuestMemory::StoredAllSince_nid_no_patch(target.htileAddress, metadataBytes, generation), "a possible HTILE range proved complete coverage");
+                        if (fault == ClearFault::CompletedPossibleStore) CompleteHtileDepthClear(target.htileAddress, static_cast<std::size_t>(metadataBytes));
+                    } else AgcDriver::GuestMemory::StoreOwnBytes(target.htileAddress, storedBytes, [&] {
+                        for (std::size_t i = 0u; i < storedBytes / 4u; ++i) std::memcpy(metadata.Data() + i * 4u, &clearPattern, 4u);
+                        if (fault == ClearFault::BadMetadata) metadata.Data()[0] = std::byte{0x0f};
+                    });
+                    if (fault == ClearFault::CpuWrite) metadata.Data()[metadataBytes - 1u] ^= std::byte{0x01};
+                    if (fault == ClearFault::DepthWrite) memory.Data()[bytes - 1u] ^= std::byte{0x01};
+                    if (fault == ClearFault::PendingWrite) {
+                        QueueTargetByteWrite(context, recorder, target.htileAddress, std::byte{0});
+                        std::string pendingRefusal;
+                        try { CachedSampledTexture(context, words); }
+                        catch (const std::exception& error) { pendingRefusal = error.what(); }
+                        const bool refused = pendingRefusal.find("external GPU writes") != std::string::npos;
+                        if (!refused) std::fprintf(stderr, "Pending HTILE texture refusal: %s\n", pendingRefusal.c_str());
+                        Require(refused, "an unrecognized pending HTILE write was accepted or refused for another reason");
+                    }
+                }
                 Require(DepthSurfaceHolds(context, DecodeTextureResource(words), texture.get()), "completed native depth clear lost its sampled view");
                 recorder.Sync();
                 Require(DepthSurfaceView(context, target) == view && CachedSampledTexture(context, words) == texture, "completed native depth clear replaced an attachment or cached view");
@@ -843,6 +963,59 @@ void CheckDepthTarget(Context context, VkFormat format, std::uint32_t fragments,
     std::printf("Native depth format=%u samples=%u clear=%u iterate256=%u: imported, rasterized twice, sampled and refused conflicts\n", static_cast<std::uint32_t>(format), fragments, one, iterate256);
 }
 
+void CheckUnwrittenGuestAccess(Context context, VkFormat format, std::uint32_t fragments) {
+    const VkExtent2D extent{5u, 3u};
+    const auto bytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, format == VK_FORMAT_D16_UNORM ? 2u : 4u, fragments));
+    const auto metadataBytes = static_cast<std::size_t>(HtileMetadataBytes(extent));
+    TargetMemory memory(bytes), metadata(65536u), unrelated(65536u);
+    const auto guestByte = [](std::size_t offset) { return static_cast<std::byte>(offset * 7u + 3u); };
+    for (std::size_t offset = 0u; offset < bytes; ++offset) memory.Data()[offset] = guestByte(offset);
+    std::memset(metadata.Data(), 0, metadataBytes);
+    DepthTarget target{memory.Address(), 0u, extent, format, 0.0f, 0u, metadata.Address(), false, fragments};
+    target.depthSwizzle = 24u;
+    target.iterate256 = target.htilePipeAligned = target.htileDepthOnly = true;
+    Recorder recorder(context);
+    recorder.Activate();
+    struct Cleanup {
+        Recorder& recorder;
+        Context context;
+        ~Cleanup() { recorder.Sync(); ClearCachedTextures(context.device); ClearDepthSurfaces(context.device); }
+    } cleanup{recorder, context};
+    const auto resident = [&] { return HasResidentDepthGuards_nid_no_patch() && DepthSurfaceAt(target.address); };
+    auto view = DepthSurfaceView(context, target);
+    Require(view != VK_NULL_HANDLE && resident(), "unwritten native depth fixture has no resident owner");
+    auto otherDevice = context;
+    otherDevice.device = VK_NULL_HANDLE;
+    NoteDepthSurfaceWrite(otherDevice, target);
+    auto unattached = target;
+    unattached.address += 65536u;
+    NoteDepthSurfaceWrite(context, unattached);
+    std::array<std::byte, 1> probe{};
+    AgcDriver::GuestMemory::Read(unrelated.Address(), probe);
+    Require(resident(), "an unrelated guest read retired a native depth surface");
+    for (const bool readMetadata : {false, true}) {
+        if (readMetadata) RequireNoMultisampleTarget(target.htileAddress + metadataBytes - 1u, 1u, "a DMA copy");
+        else {
+            AgcDriver::GuestMemory::Read(target.address + bytes - 1u, probe);
+            Require(probe[0] == guestByte(bytes - 1u), "a guest read over an unwritten native depth surface did not return its guest bytes");
+        }
+        Require(!resident(), "a guest access left an unwritten native depth surface resident");
+        RequireNoResidentDepthRead_nid_no_patch(target.address, bytes);
+        RequireNoResidentDepthRead_nid_no_patch(target.htileAddress, metadataBytes);
+        recorder.Sync();
+        const auto rebound = DepthSurfaceView(context, target);
+        Require(rebound != VK_NULL_HANDLE && rebound != view && resident(), "rebinding after a guest access did not import a new native depth surface");
+        view = rebound;
+    }
+    NoteDepthSurfaceWrite(context, target);
+    TargetRefuses([&] { AgcDriver::GuestMemory::Read(target.address, probe); }, "sample-preserving guest publication");
+    TargetRefuses([&] { RequireNoMultisampleTarget(target.htileAddress, 1u, "a DMA copy"); }, "sample-preserving guest publication");
+    Require(resident(), "a refused guest access retired a written native depth surface");
+    for (std::size_t offset = 0u; offset < bytes; ++offset) Require(memory.Data()[offset] == guestByte(offset), "retiring an unwritten native depth surface changed its guest bytes");
+    Require(std::all_of(metadata.Data(), metadata.Data() + metadataBytes, [](std::byte value) { return value == std::byte{0}; }), "retiring an unwritten native depth surface changed its HTILE");
+    std::printf("Native depth format=%u samples=%u: guest access retired the unwritten surface and refused the written one\n", static_cast<std::uint32_t>(format), fragments);
+}
+
 void CheckHtileRouting(Context context, VkFormat format, std::uint32_t fragments) {
     const VkExtent2D extent{5u, 3u};
     const auto bytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, format == VK_FORMAT_D16_UNORM ? 2u : 4u, fragments));
@@ -1031,6 +1204,7 @@ void CheckRetirement(Context context, VkFormat format, std::uint32_t samples, st
     const auto words = DepthSampleWords(target);
     const auto resource = DecodeTextureResource(words);
     const auto firstView = DepthSurfaceView(context, target);
+    NoteDepthSurfaceWrite(context, target);
     auto firstTexture = DepthSurfaceTexture(context, words, resource, VkComponentMapping{});
     Require(firstTexture != nullptr, "retirement fixture has no native sampled view");
     ColorTarget color{colorMemory.Address(), extent, VK_FORMAT_R8G8B8A8_UNORM, extent.width * extent.height * 4u, 0u};
@@ -1129,7 +1303,7 @@ int main(int argc, char** argv) {
         }
         CheckDrawFeedback();
         const auto context = device->GetContext();
-        const std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+        std::unique_lock lock(AgcDriver::GuestMemory::GpuMutex());
         Require(DepthSupported(context, VK_FORMAT_D32_SFLOAT, 4u), "the native depth regression requires sampled D32 with four samples");
         if (argc == 2 && std::string_view(argv[1]) == "--clear-refusals") {
             for (const auto& [fault, expected] : std::array{
@@ -1137,10 +1311,11 @@ int main(int argc, char** argv) {
                      std::pair{ClearFault::CpuWrite, "CPU writes raced"},
                      std::pair{ClearFault::DepthWrite, "guest writes"},
                      std::pair{ClearFault::BadMetadata, "does not prove its clear value"},
+                     std::pair{ClearFault::PossibleStore, "no complete tracked HTILE store"},
                      std::pair{ClearFault::UnprovenDispatch, "incomplete or unproven"},
                      std::pair{ClearFault::PendingWrite, "external GPU writes"},
                      std::pair{ClearFault::Overlap, "overlapping native multisample depth"}}) {
-                TargetRefuses([&] { CheckDepthTarget(context, VK_FORMAT_D32_SFLOAT, 4u, false, true, false, fault); }, expected);
+                TargetRefuses([&] { CheckDepthTarget(context, VK_FORMAT_D32_SFLOAT, 4u, false, true, false, fault, lock); }, expected);
                 std::printf("Native depth clear fault=%u refused: %s\n", static_cast<std::uint32_t>(fault), expected);
             }
             return 0;
@@ -1152,10 +1327,16 @@ int main(int argc, char** argv) {
                 for (const auto samples : {2u, 4u, 8u}) {
                     if (!DepthSupported(context, format, samples)) { unavailable += 4u; continue; }
                     for (const bool depthOnly : {false, true}) {
-                        for (const bool one : {false, true}) { CheckDepthTarget(context, format, samples, one, true, depthOnly); ++checked; }
+                        for (const bool one : {false, true}) { CheckDepthTarget(context, format, samples, one, true, depthOnly, ClearFault::None, lock); ++checked; }
                     }
                 }
             }
+            CheckDepthTarget(context, VK_FORMAT_D32_SFLOAT, 4u, false, true, false, ClearFault::CompletedPossibleStore, lock);
+            ++checked;
+            CheckDepthTarget(context, VK_FORMAT_D32_SFLOAT, 4u, false, true, false, ClearFault::ImportWindowWrite, lock);
+            ++checked;
+            CheckDepthTarget(context, VK_FORMAT_D32_SFLOAT, 4u, false, true, false, ClearFault::DriverDispatch, lock);
+            ++checked;
             std::printf("Native depth completed clear cases checked=%u unavailable=%u\n", checked, unavailable);
             return 0;
         }
@@ -1176,9 +1357,10 @@ int main(int argc, char** argv) {
             for (const auto samples : {2u, 4u, 8u}) {
                 if (!DepthSupported(context, format, samples)) { unavailable += 4u; continue; }
                 for (const bool one : {false, true}) {
-                    for (const bool iterate256 : {true, false}) { CheckDepthTarget(context, format, samples, one, false, std::nullopt, ClearFault::None, iterate256); ++checked; }
+                    for (const bool iterate256 : {true, false}) { CheckDepthTarget(context, format, samples, one, false, std::nullopt, ClearFault::None, lock, iterate256); ++checked; }
                 }
                 CheckHtileRouting(context, format, samples);
+                CheckUnwrittenGuestAccess(context, format, samples);
             }
         }
         CheckEligibility(context);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/OptimizeOnFiber.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/OptimizeOnFiber.cpp
new file mode 100644
index 0000000000..68f3ccb6a6
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/OptimizeOnFiber.cpp
@@ -0,0 +1,140 @@
+#include "prx/libSceFiber/include/Api.hpp"
+#if defined(ANYPS5_ENABLE_SPIRV_TOOLS) && ANYPS5_ENABLE_SPIRV_TOOLS
+#include "SpirvBackend/SpirvOptimizer.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
+#include <array>
+#include <cstdint>
+#include <exception>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+constexpr std::size_t ContextBytes = 64 * 1024;
+constexpr std::size_t FiberStackLimit = 8 * 1024;
+constexpr std::uint32_t VulkanVersion = 0x00401000u;
+constexpr std::uint32_t SpirvVersion = 0x00010300u;
+constexpr std::uint64_t Fill = 0x5aa5c33c5aa5c33cull;
+
+alignas(16) std::array<std::uint64_t, ContextBytes / sizeof(std::uint64_t)> FiberContext;
+struct alignas(8) FiberStorage {
+    unsigned char bytes[0x100];
+};
+FiberStorage FiberObjectStorage;
+
+constexpr std::array<std::uint32_t, 410> Module{
+    0x07230203u, 0x00010300u, 0x0008000bu, 0x00000044u, 0x00000000u, 0x00020011u, 0x00000001u, 0x0006000bu,
+    0x00000001u, 0x4c534c47u, 0x6474732eu, 0x3035342eu, 0x00000000u, 0x0003000eu, 0x00000000u, 0x00000001u,
+    0x0006000fu, 0x00000005u, 0x00000004u, 0x6e69616du, 0x00000000u, 0x0000000bu, 0x00060010u, 0x00000004u,
+    0x00000011u, 0x00000040u, 0x00000001u, 0x00000001u, 0x00030003u, 0x00000002u, 0x000001c2u, 0x00040005u,
+    0x00000004u, 0x6e69616du, 0x00000000u, 0x00040005u, 0x00000008u, 0x65646e69u, 0x00000078u, 0x00080005u,
+    0x0000000bu, 0x475f6c67u, 0x61626f6cu, 0x766e496cu, 0x7461636fu, 0x496e6f69u, 0x00000044u, 0x00030005u,
+    0x00000010u, 0x006d7573u, 0x00040005u, 0x00000011u, 0x74617473u, 0x00000065u, 0x00040005u, 0x00000013u,
+    0x61746144u, 0x00000000u, 0x00050006u, 0x00000013u, 0x00000000u, 0x756c6176u, 0x00007365u, 0x00030005u,
+    0x00000015u, 0x00000000u, 0x00030005u, 0x0000001cu, 0x00000069u, 0x00040047u, 0x0000000bu, 0x0000000bu,
+    0x0000001cu, 0x00040047u, 0x00000012u, 0x00000006u, 0x00000004u, 0x00030047u, 0x00000013u, 0x00000002u,
+    0x00050048u, 0x00000013u, 0x00000000u, 0x00000023u, 0x00000000u, 0x00040047u, 0x00000015u, 0x00000021u,
+    0x00000000u, 0x00040047u, 0x00000015u, 0x00000022u, 0x00000000u, 0x00040047u, 0x00000043u, 0x0000000bu,
+    0x00000019u, 0x00020013u, 0x00000002u, 0x00030021u, 0x00000003u, 0x00000002u, 0x00040015u, 0x00000006u,
+    0x00000020u, 0x00000000u, 0x00040020u, 0x00000007u, 0x00000007u, 0x00000006u, 0x00040017u, 0x00000009u,
+    0x00000006u, 0x00000003u, 0x00040020u, 0x0000000au, 0x00000001u, 0x00000009u, 0x0004003bu, 0x0000000au,
+    0x0000000bu, 0x00000001u, 0x0004002bu, 0x00000006u, 0x0000000cu, 0x00000000u, 0x00040020u, 0x0000000du,
+    0x00000001u, 0x00000006u, 0x0003001du, 0x00000012u, 0x00000006u, 0x0003001eu, 0x00000013u, 0x00000012u,
+    0x00040020u, 0x00000014u, 0x0000000cu, 0x00000013u, 0x0004003bu, 0x00000014u, 0x00000015u, 0x0000000cu,
+    0x00040015u, 0x00000016u, 0x00000020u, 0x00000001u, 0x0004002bu, 0x00000016u, 0x00000017u, 0x00000000u,
+    0x00040020u, 0x00000019u, 0x0000000cu, 0x00000006u, 0x0004002bu, 0x00000006u, 0x00000023u, 0x00000010u,
+    0x00020014u, 0x00000024u, 0x0004002bu, 0x00000006u, 0x00000027u, 0x00000001u, 0x0004002bu, 0x00000006u,
+    0x00000038u, 0x0019660du, 0x0004002bu, 0x00000006u, 0x0000003au, 0x3c6ef35fu, 0x0004002bu, 0x00000016u,
+    0x0000003du, 0x00000001u, 0x0004002bu, 0x00000006u, 0x00000042u, 0x00000040u, 0x0006002cu, 0x00000009u,
+    0x00000043u, 0x00000042u, 0x00000027u, 0x00000027u, 0x00050036u, 0x00000002u, 0x00000004u, 0x00000000u,
+    0x00000003u, 0x000200f8u, 0x00000005u, 0x0004003bu, 0x00000007u, 0x00000008u, 0x00000007u, 0x0004003bu,
+    0x00000007u, 0x00000010u, 0x00000007u, 0x0004003bu, 0x00000007u, 0x00000011u, 0x00000007u, 0x0004003bu,
+    0x00000007u, 0x0000001cu, 0x00000007u, 0x00050041u, 0x0000000du, 0x0000000eu, 0x0000000bu, 0x0000000cu,
+    0x0004003du, 0x00000006u, 0x0000000fu, 0x0000000eu, 0x0003003eu, 0x00000008u, 0x0000000fu, 0x0003003eu,
+    0x00000010u, 0x0000000cu, 0x0004003du, 0x00000006u, 0x00000018u, 0x00000008u, 0x00060041u, 0x00000019u,
+    0x0000001au, 0x00000015u, 0x00000017u, 0x00000018u, 0x0004003du, 0x00000006u, 0x0000001bu, 0x0000001au,
+    0x0003003eu, 0x00000011u, 0x0000001bu, 0x0003003eu, 0x0000001cu, 0x0000000cu, 0x000200f9u, 0x0000001du,
+    0x000200f8u, 0x0000001du, 0x000400f6u, 0x0000001fu, 0x00000020u, 0x00000000u, 0x000200f9u, 0x00000021u,
+    0x000200f8u, 0x00000021u, 0x0004003du, 0x00000006u, 0x00000022u, 0x0000001cu, 0x000500b0u, 0x00000024u,
+    0x00000025u, 0x00000022u, 0x00000023u, 0x000400fau, 0x00000025u, 0x0000001eu, 0x0000001fu, 0x000200f8u,
+    0x0000001eu, 0x0004003du, 0x00000006u, 0x00000026u, 0x00000011u, 0x000500c7u, 0x00000006u, 0x00000028u,
+    0x00000026u, 0x00000027u, 0x000500abu, 0x00000024u, 0x00000029u, 0x00000028u, 0x0000000cu, 0x000300f7u,
+    0x0000002bu, 0x00000000u, 0x000400fau, 0x00000029u, 0x0000002au, 0x00000031u, 0x000200f8u, 0x0000002au,
+    0x0004003du, 0x00000006u, 0x0000002cu, 0x00000011u, 0x0004003du, 0x00000006u, 0x0000002du, 0x0000001cu,
+    0x00050084u, 0x00000006u, 0x0000002eu, 0x0000002cu, 0x0000002du, 0x0004003du, 0x00000006u, 0x0000002fu,
+    0x00000010u, 0x00050080u, 0x00000006u, 0x00000030u, 0x0000002fu, 0x0000002eu, 0x0003003eu, 0x00000010u,
+    0x00000030u, 0x000200f9u, 0x0000002bu, 0x000200f8u, 0x00000031u, 0x0004003du, 0x00000006u, 0x00000032u,
+    0x00000011u, 0x0004003du, 0x00000006u, 0x00000033u, 0x0000001cu, 0x00050080u, 0x00000006u, 0x00000034u,
+    0x00000032u, 0x00000033u, 0x0004003du, 0x00000006u, 0x00000035u, 0x00000010u, 0x000500c6u, 0x00000006u,
+    0x00000036u, 0x00000035u, 0x00000034u, 0x0003003eu, 0x00000010u, 0x00000036u, 0x000200f9u, 0x0000002bu,
+    0x000200f8u, 0x0000002bu, 0x0004003du, 0x00000006u, 0x00000037u, 0x00000011u, 0x00050084u, 0x00000006u,
+    0x00000039u, 0x00000037u, 0x00000038u, 0x00050080u, 0x00000006u, 0x0000003bu, 0x00000039u, 0x0000003au,
+    0x0003003eu, 0x00000011u, 0x0000003bu, 0x000200f9u, 0x00000020u, 0x000200f8u, 0x00000020u, 0x0004003du,
+    0x00000006u, 0x0000003cu, 0x0000001cu, 0x00050080u, 0x00000006u, 0x0000003eu, 0x0000003cu, 0x0000003du,
+    0x0003003eu, 0x0000001cu, 0x0000003eu, 0x000200f9u, 0x0000001du, 0x000200f8u, 0x0000001fu, 0x0004003du,
+    0x00000006u, 0x0000003fu, 0x00000008u, 0x0004003du, 0x00000006u, 0x00000040u, 0x00000010u, 0x00060041u,
+    0x00000019u, 0x00000041u, 0x00000015u, 0x00000017u, 0x0000003fu, 0x0003003eu, 0x00000041u, 0x00000040u,
+    0x000100fdu, 0x00010038u
+};
+
+std::vector<std::uint32_t> Optimized;
+std::exception_ptr Failure;
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+std::vector<std::uint32_t> Optimize() {
+    return ShaderRecompiler::ValidateAndOptimizeSpirv(Module, VulkanVersion, SpirvVersion);
+}
+
+void APS5_VABI OptimizeOnFiber(std::uint64_t, std::uint64_t) {
+    try {
+        Optimized = Optimize();
+    } catch (...) {
+        Failure = std::current_exception();
+    }
+    sceFiberReturnToThread(0, nullptr);
+}
+
+std::size_t FiberStackUsed() {
+    std::size_t untouched = 0;
+    while (untouched < FiberContext.size() && FiberContext[untouched] == Fill) ++untouched;
+    return (FiberContext.size() - untouched) * sizeof(std::uint64_t);
+}
+
+}
+
+int main() {
+    try {
+        FiberContext.fill(Fill);
+        auto* fiber = reinterpret_cast<FiberObject*>(&FiberObjectStorage);
+        Require(_sceFiberInitializeImpl_nid_postfix(fiber, "optimize", OptimizeOnFiber, 0, FiberContext.data(), ContextBytes, nullptr, 0) == 0, "SPIR-V optimization on a fiber: the fiber was not initialized");
+        const auto before = ShaderRecompiler::OptimizerHostThreads();
+        Require(sceFiberRun_nid_postfix(fiber, 0, nullptr) == 0, "SPIR-V optimization on a fiber: the fiber did not run");
+        const auto onFiber = ShaderRecompiler::OptimizerHostThreads() - before;
+        Require(sceFiberFinalize(fiber) == 0, "SPIR-V optimization on a fiber: the fiber was not finalized");
+        if (Failure) std::rethrow_exception(Failure);
+        const auto used = FiberStackUsed();
+        const auto beforeThread = ShaderRecompiler::OptimizerHostThreads();
+        const auto onThreadResult = Optimize();
+        const auto onThread = ShaderRecompiler::OptimizerHostThreads() - beforeThread;
+        Require(Optimized == onThreadResult, "SPIR-V optimization on a fiber returned another module than on the thread");
+        Require(used <= FiberStackLimit, "SPIR-V optimization on a fiber running on its context used " + std::to_string(used) + " bytes of it, more than " + std::to_string(FiberStackLimit) + ": the optimizer ran on it");
+        Require(onFiber == 1, "SPIR-V optimization on a fiber running on its context started " + std::to_string(onFiber) + " host threads instead of one");
+        Require(onThread == 0, "SPIR-V optimization on an ordinary thread started " + std::to_string(onThread) + " host threads instead of optimizing on its own stack");
+        std::cout << "SPIR-V optimization on a fiber used " << used << " bytes of its context\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
+#else
+int main() {
+    return 77;
+}
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp
index 8984302a91..213d8c7aaf 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/OversizedDescriptorSets.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #include <array>
 #include <cstdint>
@@ -50,15 +51,7 @@ public:
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
             const auto properties = function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties");
-            context.physical = devices.front();
-            for (const auto candidate : devices) {
-                VkPhysicalDeviceProperties described{};
-                properties(candidate, &described);
-                if (described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU) {
-                    context.physical = candidate;
-                    break;
-                }
-            }
+            context.physical = SelectFixturePhysicalDevice(devices, properties);
             VkPhysicalDeviceProperties selected{};
             properties(context.physical, &selected);
             context.limits = selected.limits;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedFloatColorTarget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedFloatColorTarget.cpp
index 9b322cb6d0..238cb5ce89 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PackedFloatColorTarget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedFloatColorTarget.cpp
@@ -45,6 +45,7 @@ constexpr std::uint32_t Height = 128;
 constexpr std::uint32_t ScissorWidth = 128;
 constexpr std::size_t BlockBytes = 65536;
 constexpr std::uint32_t Float11_11_10Info = 0x4171cu;
+constexpr std::uint32_t StandardOrderInfo = Float11_11_10Info & ~0x1800u;
 constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
 constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
 constexpr std::uint32_t Float32Export = 9;
@@ -58,7 +59,7 @@ constexpr std::array<std::array<float, 4>, 3> Triangle{{
     {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
 }};
 
-alignas(256) std::array<std::array<std::uint32_t, 64>, 32> Programs{};
+alignas(256) std::array<std::array<std::uint32_t, 64>, 64> Programs{};
 std::size_t programCount = 0;
 
 std::uint32_t SmallFloat(float value, std::uint32_t mantissaBits) {
@@ -78,7 +79,8 @@ std::uint32_t SmallFloat(float value, std::uint32_t mantissaBits) {
     return (static_cast<std::uint32_t>(exponent - 1 + 15) << mantissaBits) | static_cast<std::uint32_t>(std::floor((fraction * 2.0 - 1.0) * scale));
 }
 
-std::uint32_t Packed(std::array<float, 3> rgb) {
+std::uint32_t Packed(std::array<float, 3> rgb, bool standardOrder) {
+    if (standardOrder) return SmallFloat(rgb[0], 5) | (SmallFloat(rgb[1], 6) << 10u) | (SmallFloat(rgb[2], 6) << 21u);
     return SmallFloat(rgb[2], 5) | (SmallFloat(rgb[1], 6) << 10u) | (SmallFloat(rgb[0], 6) << 21u);
 }
 
@@ -170,17 +172,17 @@ struct Block {
     std::uint8_t* data = nullptr;
 };
 
-AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t attrib3) {
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t attrib3, bool standardOrder) {
     AgcDriver::Registers cx;
     cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
     cx[0x31b] = 0;
-    cx[0x31c] = Float11_11_10Info;
+    cx[0x31c] = standardOrder ? StandardOrderInfo : Float11_11_10Info;
     cx[0x31d] = 0;
     cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
     cx[0x3b8] = attrib3;
     cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
     auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
-    Require(color.format == VK_FORMAT_R32_UINT && color.elementBytes == 4 && color.componentMapping == 0xc6u && color.packing == ShaderRecompiler::ColorExportPacking::Float11_11_10 && color.bytes == block.bytes, "the 11_11_10 float target did not decode as a packed R32_UINT surface");
+    Require(color.format == VK_FORMAT_R32_UINT && color.elementBytes == 4 && color.componentMapping == (standardOrder ? 0xe4u : 0xc6u) && color.packing == ShaderRecompiler::ColorExportPacking::Float11_11_10 && color.bytes == block.bytes, "the 11_11_10 float target did not decode as a packed R32_UINT surface");
     return color;
 }
 
@@ -290,10 +292,10 @@ std::string Describe(std::array<float, 3> rgb) {
     return text;
 }
 
-void TargetTests(AgcDriver::VulkanDevice& device, Block& block, std::uint32_t attrib3, ColorTileMode mode, const char* kind) {
+void TargetTests(AgcDriver::VulkanDevice& device, Block& block, std::uint32_t attrib3, ColorTileMode mode, const char* kind, bool standardOrder) {
     const ColorTargetLayout layout(Width, Height, mode, 4);
     Require(layout.Bytes() == block.bytes, "the test surface size disagrees with its layout");
-    const auto color = DecodeTarget(block, attrib3);
+    const auto color = DecodeTarget(block, attrib3, standardOrder);
     auto before = Fill(block);
     const float nan = std::numeric_limits<float>::quiet_NaN();
     const float infinity = std::numeric_limits<float>::infinity();
@@ -311,12 +313,12 @@ void TargetTests(AgcDriver::VulkanDevice& device, Block& block, std::uint32_t at
     }};
     for (const auto& rgb : cases) {
         Draw(device, color, Float32Export, Float32Program(rgb));
-        ExpectSurface(device, block, layout, before, Packed(rgb), std::string("a 32_ABGR export of ") + Describe(rgb) + " into a " + kind + " 11_11_10 float target");
+        ExpectSurface(device, block, layout, before, Packed(rgb, standardOrder), std::string("a 32_ABGR export of ") + Describe(rgb) + " into a " + kind + " 11_11_10 float target");
         before = ReadBack(device, block);
     }
     const std::array<float, 3> halves{0.5f, 0.75f, 0.125f};
     Draw(device, color, Float16Export, Float16Program(halves));
-    ExpectSurface(device, block, layout, before, Packed(halves), std::string("an FP16_ABGR export of ") + Describe(halves) + " into a " + kind + " 11_11_10 float target");
+    ExpectSurface(device, block, layout, before, Packed(halves, standardOrder), std::string("an FP16_ABGR export of ") + Describe(halves) + " into a " + kind + " 11_11_10 float target");
 }
 
 }
@@ -327,8 +329,10 @@ int main() {
         if (!device) return VulkanTestSkipped;
         Block tiled(ColorTargetLayout(Width, Height, ColorTileMode::RenderTarget, 4).Bytes());
         Block linear(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 4).Bytes());
-        TargetTests(*device, tiled, TiledAttrib3, ColorTileMode::RenderTarget, "tiled");
-        TargetTests(*device, linear, LinearAttrib3, ColorTileMode::Linear, "linear");
+        for (const bool standardOrder : {false, true}) {
+            TargetTests(*device, tiled, TiledAttrib3, ColorTileMode::RenderTarget, standardOrder ? "tiled standard-order" : "tiled", standardOrder);
+            TargetTests(*device, linear, LinearAttrib3, ColorTileMode::Linear, standardOrder ? "linear standard-order" : "linear", standardOrder);
+        }
         std::puts("11_11_10 float color target tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444ColorTarget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444ColorTarget.cpp
new file mode 100644
index 0000000000..85326136cf
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444ColorTarget.cpp
@@ -0,0 +1,330 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <limits>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::ColorTargetLayout;
+using AgcDriver::Graphics::ColorTileMode;
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::uint32_t ScissorWidth = 128;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Unorm4_4_4_4Info = 0x8000u | (19u << 2u) | (2u << 11u);
+constexpr std::uint32_t LinearAttrib3 = 0x09000000u;
+constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Float16Export = 4;
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 64>, 32> Programs{};
+std::size_t programCount = 0;
+
+struct Golden {
+    std::array<float, 4> rgba;
+    std::uint16_t word;
+};
+
+std::uint32_t Half(float value) {
+    Require(value == 0.0f || (value >= 0.0625f && value <= 1.0f), "the test's half values are normal and at most 1");
+    if (value == 0.0f) return 0;
+    const auto bits = std::bit_cast<std::uint32_t>(value);
+    Require((bits & 0x1fffu) == 0, "the test's half values are exact");
+    return ((((bits >> 23u) & 0xffu) - 112u) << 10u) | ((bits >> 13u) & 0x3ffu);
+}
+
+std::span<const std::uint32_t> Program(const std::array<std::uint32_t, 4>& vgprs, bool compressed) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    for (std::uint32_t vgpr = 0; vgpr < (compressed ? 2u : 4u); ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = vgprs[vgpr];
+    }
+    code[at++] = compressed ? 0xf8001c0fu : 0xf800180fu;
+    code[at++] = compressed ? 0x00000504u : 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+std::span<const std::uint32_t> Float32Program(std::array<float, 4> rgba) {
+    return Program({std::bit_cast<std::uint32_t>(rgba[0]), std::bit_cast<std::uint32_t>(rgba[1]), std::bit_cast<std::uint32_t>(rgba[2]), std::bit_cast<std::uint32_t>(rgba[3])}, false);
+}
+
+std::span<const std::uint32_t> Float16Program(std::array<float, 4> rgba) {
+    return Program({Half(rgba[0]) | (Half(rgba[1]) << 16u), Half(rgba[2]) | (Half(rgba[3]) << 16u), 0, 0}, true);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t attrib3) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Unorm4_4_4_4Info;
+    cx[0x31d] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = attrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R16_UINT && color.elementBytes == 2 && color.componentMapping == 0x1bu && color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 && color.bytes == block.bytes, "the 4_4_4_4 unorm target did not decode as a packed R16_UINT target");
+    return color;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::uint32_t exportFormat, std::span<const std::uint32_t> pixelCode) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(Triangle.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(Triangle.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {ScissorWidth, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.colorWriteMask = VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, exportFormat}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto materialize = [&](const ShaderRecompiler::RecompileRequest& request) {
+        const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, request);
+        return invocation.Materialize(*invocation.Capture(runtime));
+    };
+    const auto pixelResult = materialize(fragment);
+    auto unpacked = fragment;
+    unpacked.context.pixel->targetExportPacking.fill(ShaderRecompiler::ColorExportPacking::None);
+    const auto plain = materialize(unpacked);
+    Require(pixelResult->variantId == ShaderRecompiler::GetPreparedArtifact(*handle).variantId && plain->variantId == pixelResult->variantId, "the draw did not use the registered pixel shader");
+    Require(plain->PipelineVariantId() != pixelResult->PipelineVariantId() && materialize(fragment)->PipelineVariantId() == pixelResult->PipelineVariantId(), "the 4_4_4_4 unorm packing did not key its own specialization");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::vector<std::uint16_t> ReadBack(AgcDriver::VulkanDevice& device, const Block& block) {
+    AgcDriver::Graphics::StorageTexture::FlushPending(block.Address(), block.bytes, nullptr, "test read-back");
+    device.WaitIdle();
+    std::vector<std::uint16_t> stored(block.bytes / 2u);
+    AgcDriver::GuestMemory::Read(block.Address(), std::as_writable_bytes(std::span(stored)), 1);
+    return stored;
+}
+
+void ExpectSurface(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& before, std::uint32_t word, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            const bool inside = x < ScissorWidth;
+            const std::uint32_t expected = inside ? word : before[index];
+            if (stored[index] == expected) continue;
+            char detail[160];
+            std::snprintf(detail, sizeof(detail), ": pixel (%u, %u) %s the scissor holds 0x%04x, expected 0x%04x", x, y, inside ? "inside" : "outside", stored[index], expected);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+std::vector<std::uint16_t> Fill(Block& block) {
+    std::vector<std::uint16_t> words(block.bytes / 2u);
+    for (std::size_t index = 0; index < words.size(); ++index) words[index] = static_cast<std::uint16_t>((index * 0x9e3779b9u) >> 11u);
+    std::memcpy(block.data, words.data(), block.bytes);
+    return words;
+}
+
+std::string Describe(std::array<float, 4> rgba) {
+    char text[112];
+    std::snprintf(text, sizeof(text), "(%.9g, %.9g, %.9g, %.9g)", rgba[0], rgba[1], rgba[2], rgba[3]);
+    return text;
+}
+
+void TargetTests(AgcDriver::VulkanDevice& device, Block& block, std::uint32_t attrib3, ColorTileMode mode, const char* kind) {
+    const ColorTargetLayout layout(Width, Height, mode, 2);
+    Require(layout.Bytes() == block.bytes, "the test surface size disagrees with its layout");
+    const auto color = DecodeTarget(block, attrib3);
+    auto before = Fill(block);
+    const float nan = std::numeric_limits<float>::quiet_NaN();
+    const float infinity = std::numeric_limits<float>::infinity();
+    const std::array<Golden, 11> float32Cases{{
+        {{1.0f, 0.0f, 0.0f, 0.0f}, 0xf000u},
+        {{0.0f, 1.0f, 0.0f, 0.0f}, 0x0f00u},
+        {{0.0f, 0.0f, 1.0f, 0.0f}, 0x00f0u},
+        {{0.0f, 0.0f, 0.0f, 1.0f}, 0x000fu},
+        {{1.0f, 1.0f, 1.0f, 1.0f}, 0xffffu},
+        {{1.0f, 0.5f, 0.0f, 0.25f}, 0xf804u},
+        {{0.0f, 1.0f, 0.5f, 0.25f}, 0x0f84u},
+        {{nan, -1.0f, 2.0f, infinity}, 0x00ffu},
+        {{1.0f / 15.0f, 2.0f / 15.0f, 7.0f / 15.0f, 14.0f / 15.0f}, 0x127eu},
+        {{0.1f, 0.7f, 0.9f, 0.3f}, 0x2ad5u},
+        {{-infinity, std::numeric_limits<float>::min(), 0.999999940f, std::numeric_limits<float>::denorm_min()}, 0x00f0u},
+    }};
+    for (const auto& golden : float32Cases) {
+        Draw(device, color, Float32Export, Float32Program(golden.rgba));
+        ExpectSurface(device, block, layout, before, golden.word, std::string("a 32_ABGR export of ") + Describe(golden.rgba) + " into a " + kind + " 4_4_4_4 unorm target");
+        before = ReadBack(device, block);
+    }
+    const std::array<Golden, 7> float16Cases{{
+        {{1.0f, 0.0f, 0.0f, 0.0f}, 0xf000u},
+        {{0.0f, 1.0f, 0.0f, 0.0f}, 0x0f00u},
+        {{0.0f, 0.0f, 1.0f, 0.0f}, 0x00f0u},
+        {{0.0f, 0.0f, 0.0f, 1.0f}, 0x000fu},
+        {{1.0f, 1.0f, 1.0f, 1.0f}, 0xffffu},
+        {{1.0f, 0.5f, 0.0f, 0.25f}, 0xf804u},
+        {{0.5f, 0.75f, 0.125f, 0.25f}, 0x8b24u},
+    }};
+    for (const auto& golden : float16Cases) {
+        Draw(device, color, Float16Export, Float16Program(golden.rgba));
+        ExpectSurface(device, block, layout, before, golden.word, std::string("an FP16_ABGR export of ") + Describe(golden.rgba) + " into a " + kind + " 4_4_4_4 unorm target");
+        before = ReadBack(device, block);
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        Block linear(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 2).Bytes());
+        TargetTests(*device, linear, LinearAttrib3, ColorTileMode::Linear, "linear");
+        std::puts("4_4_4_4 unorm color target tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp
new file mode 100644
index 0000000000..894ccc375a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp
@@ -0,0 +1,427 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <memory>
+#include <numeric>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context ContextOf(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Side = 16;
+constexpr std::array<std::uint32_t, 3> SampleCounts{2, 4, 8};
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Unorm4_4_4_4Info = 0x8000u | (19u << 2u) | (2u << 11u);
+constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
+constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Words = 32;
+constexpr std::uint32_t LoadResult = 12;
+constexpr double EdgeMargin = 1.0 / 32.0;
+constexpr std::array<float, 4> First{0.2f, 0.4f, 0.6f, 0.8f};
+constexpr std::array<float, 4> Second{13.0f / 15.0f, 0.0f, 1.0f, 0.0f};
+constexpr std::array<float, 4> Third{1.0f / 15.0f, 1.0f, 0.0f, 4.0f / 15.0f};
+constexpr std::array<float, 4> Fourth{0.0f, 7.0f / 15.0f, 0.0f, 11.0f / 15.0f};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 26> LoadCode{
+    0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
+    0x80000501, 0xe0301010, 0x80000601, 0xe0301014, 0x80000701, 0xbf8c3f70, 0xf0001f30, 0x00011005,
+    0xbf8c3f70, 0xe0701030, 0x80001001, 0xe0701034, 0x80001101, 0xe0701038, 0x80001201, 0xe070103c,
+    0x80001301, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Covering{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+constexpr std::array<std::array<float, 4>, 3> Cutting{{
+    {-0.93f, -1.0f, 0.5f, 1.0f}, {0.37f, -1.0f, 0.5f, 1.0f}, {-0.21f, 0.94f, 0.5f, 1.0f}
+}};
+
+constexpr std::array<std::array<float, 4>, 3> Crossing{{
+    {-0.6f, -0.2f, 0.5f, 1.0f}, {0.9f, -0.85f, 0.5f, 1.0f}, {0.5f, 0.9f, 0.5f, 1.0f}
+}};
+
+constexpr std::array<std::array<float, 4>, 3> Overlapping{{
+    {-0.08f, -0.47f, 0.5f, 1.0f}, {1.0f, -0.13f, 0.5f, 1.0f}, {0.29f, 1.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 24> Programs{};
+std::size_t programCount = 0;
+alignas(256) std::array<std::uint32_t, Threads * Words> Buffer{};
+
+std::uint32_t MultisampledAttrib(std::uint32_t samples) {
+    const auto shift = static_cast<std::uint32_t>(std::countr_zero(samples));
+    return (shift << 12u) | (shift << 15u);
+}
+
+std::uint32_t Unorm(float value) {
+    if (!(value > 0.0f)) return 0;
+    if (value >= 1.0f) return 15;
+    return static_cast<std::uint32_t>(std::nearbyint(static_cast<double>(value) * 15.0));
+}
+
+std::uint32_t Packed(std::array<float, 4> rgba) {
+    return Unorm(rgba[3]) | (Unorm(rgba[2]) << 4u) | (Unorm(rgba[1]) << 8u) | (Unorm(rgba[0]) << 12u);
+}
+
+std::span<const std::uint32_t> Float32Program(std::array<float, 4> rgba) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    for (std::uint32_t vgpr = 0; vgpr < 4u; ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = std::bit_cast<std::uint32_t>(rgba[vgpr]);
+    }
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes) {
+#ifdef _WIN32
+        data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+#endif
+        Require(data != nullptr, "cannot allocate the multisampled color target");
+        std::memset(data, 0, bytes);
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        VirtualFree(data, 0, MEM_RELEASE);
+#else
+        std::free(data);
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t samples) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Unorm4_4_4_4Info;
+    cx[0x31d] = MultisampledAttrib(samples);
+    cx[0x3b0] = ((Side - 1u) << 14u) | (Side - 1u);
+    cx[0x3b8] = TiledAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    const auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R16_UINT && color.componentMapping == 0x1bu && color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 && color.samples == samples && color.extent.width == Side && color.extent.height == Side, "the target did not decode as a 16x16 packed R16_UINT surface of " + std::to_string(samples) + " samples");
+    return color;
+}
+
+AgcDriver::QueueState Queue(const Block& block, std::uint32_t targetMask, std::uint32_t samples) {
+    AgcDriver::QueueState queue;
+    queue.userConfig[0x242] = 4;
+    queue.context = {
+        {0x2d5, 0x2000}, {0x1b6, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, targetMask}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, Float32Export}, {0x1c3, 4},
+        {0x318, static_cast<std::uint32_t>(block.Address() >> 8u)}, {0x390, static_cast<std::uint32_t>(block.Address() >> 40u)},
+        {0x31b, 0}, {0x31c, Unorm4_4_4_4Info}, {0x31d, MultisampledAttrib(samples)},
+        {0x3b0, ((Side - 1u) << 14u) | (Side - 1u)}, {0x3b8, TiledAttrib3}, {0x1e0, 0},
+        {0xc, 0}, {0xd, (Side << 16u) | Side},
+        {0x81, 0x80000000}, {0x82, (Side << 16u) | Side},
+        {0x90, 0x80000000}, {0x91, (Side << 16u) | Side},
+        {0x94, 0x80000000}, {0x95, (Side << 16u) | Side},
+        {0x10f, std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f)}, {0x110, std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-static_cast<float>(Side) / 2.0f)}, {0x112, std::bit_cast<std::uint32_t>(static_cast<float>(Side) / 2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0},
+        {0xb4, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)}
+    };
+    queue.shader[0x008] = 0x100;
+    queue.shader[0x009] = 0;
+    return queue;
+}
+
+AgcDriver::Graphics::State TargetState(const Block& block, std::uint32_t exportedMask, std::uint32_t samples) {
+    const bool partial = exportedMask != 0xfu;
+    const auto decoded = AgcDriver::Graphics::DecodeState(Queue(block, exportedMask, samples));
+    const auto& color = decoded.colors.front();
+    char detail[256];
+    std::snprintf(detail, sizeof(detail), "CB_TARGET_MASK 0x%x of the %u-sample 4_4_4_4 target decoded %zu targets, %u samples, word mask 0x%04x, write mask 0x%x and %s shading", exportedMask, samples, decoded.colors.size(), decoded.samples, color.partialWriteMask, decoded.blends.front().colorWriteMask, decoded.perSampleShading ? "per-sample" : "pixel-rate");
+    Require(decoded.colors.size() == 1u && decoded.samples == samples && color.samples == samples && color.partialWriteMask == (partial ? AgcDriver::Graphics::PackedWriteMask(color.componentMapping, exportedMask) : 0u) && decoded.blends.size() == 1u && decoded.blends.front().colorWriteMask == (partial ? 0u : 0xfu) && decoded.blend.colorWriteMask == decoded.blends.front().colorWriteMask && decoded.perSampleShading == partial, detail);
+    const auto merge = AgcDriver::Graphics::ExportTargetMerge(decoded);
+    Require(merge.mask == color.partialWriteMask && merge.samples == (partial ? samples : 1u) && !merge.depthStencilWrites && merge.descriptor == (partial ? AgcDriver::Graphics::EncodeTextureResource(AgcDriver::Graphics::TargetMergeSurface(color)) : std::array<std::uint32_t, 8>{}), "the decoded " + std::to_string(samples) + "-sample target exported another merge than its own surface");
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, 64u, 64u, std::nullopt, std::nullopt};
+    state.colors = decoded.colors;
+    state.color = decoded.color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Side, Side};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Side), static_cast<float>(Side), -static_cast<float>(Side), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {Side, Side}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blends = decoded.blends;
+    state.blend = decoded.blend;
+    state.blendConstants = {};
+    state.samples = decoded.samples;
+    state.perSampleShading = decoded.perSampleShading;
+    return state;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::State& state, const std::array<std::array<float, 4>, 3>& triangle, std::span<const std::uint32_t> pixelCode) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(triangle.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(triangle.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, Float32Export}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    fragment.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(state);
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, fragment);
+    const auto pixelResult = invocation.Materialize(*invocation.Capture(runtime));
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(triangle.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+}
+
+std::vector<std::uint32_t> LoadSamples(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, std::uint32_t samples) {
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(Buffer.data());
+    const std::array<std::uint32_t, 4> buffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), static_cast<std::uint32_t>(Buffer.size() * 4u), 0x31016facu};
+    std::copy(buffer.begin(), buffer.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(LoadCode.data()), std::as_bytes(std::span(LoadCode))}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(LoadCode.data()), LoadCode, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto program = ShaderRecompiler::Recompile(request);
+    std::vector<std::uint32_t> loaded(Side * Side * samples);
+    for (std::uint32_t first = 0; first < loaded.size(); first += Threads) {
+        Buffer.fill(0xdeadbeefu);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto index = first + tid;
+            const auto pixel = index / samples;
+            const std::array<std::uint32_t, 6> words{0u, 0u, 0u, pixel % Side, pixel / Side, index % samples};
+            std::copy(words.begin(), words.end(), &Buffer[tid * Words]);
+        }
+        device.Dispatch(program, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(LoadCode.data()));
+        device.WaitIdle();
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) loaded[first + tid] = Buffer[tid * Words + LoadResult];
+    }
+    return loaded;
+}
+
+double EdgeDistance(const std::array<std::array<float, 4>, 3>& triangle, double x, double y, std::size_t from) {
+    const auto pixels = [](const std::array<float, 4>& vertex) {
+        return std::array<double, 2>{(static_cast<double>(vertex[0]) + 1.0) * 0.5 * Side, Side - (static_cast<double>(vertex[1]) + 1.0) * 0.5 * Side};
+    };
+    const auto a = pixels(triangle[from]);
+    const auto b = pixels(triangle[(from + 1u) % triangle.size()]);
+    const auto c = pixels(triangle[(from + 2u) % triangle.size()]);
+    const auto length = std::hypot(b[0] - a[0], b[1] - a[1]);
+    const auto side = [&](double px, double py) { return ((b[0] - a[0]) * (py - a[1]) - (b[1] - a[1]) * (px - a[0])) / length; };
+    return side(c[0], c[1]) < 0 ? -side(x, y) : side(x, y);
+}
+
+double Inside(const std::array<std::array<float, 4>, 3>& triangle, double x, double y) {
+    return std::min({EdgeDistance(triangle, x, y, 0), EdgeDistance(triangle, x, y, 1), EdgeDistance(triangle, x, y, 2)});
+}
+
+void RunSamples(AgcDriver::VulkanDevice& device, const Block& block, std::uint32_t samples) {
+    const auto color = DecodeTarget(block, samples);
+    const auto full = TargetState(block, 0xfu, samples);
+    Draw(device, full, Covering, Float32Program(First));
+    const auto merged = TargetState(block, 0x1u, samples);
+    Require(merged.colors.front().partialWriteMask == 0xf000u, "an X write of the 4_4_4_4 target did not merge bits 15..12");
+    Draw(device, merged, Cutting, Float32Program(Second));
+    Draw(device, full, Overlapping, Float32Program(Third));
+    const auto texture = AgcDriver::Graphics::EncodeTextureResource(AgcDriver::Graphics::TargetMergeSurface(color));
+    const auto loaded = LoadSamples(device, texture, samples);
+    const auto background = Packed(First);
+    const auto written = (background & 0x0fffu) | (Packed(Second) & 0xf000u);
+    const auto over = Packed(Third);
+    Require(written != background && over != written && over != background, "the test colors do not differ in the merged nibble");
+    const auto locations = AgcDriver::Graphics::SampleLocations(merged);
+    std::vector<std::uint32_t> pixelsByCoverage(samples + 1u);
+    std::uint32_t checked = 0;
+    std::uint32_t overdrawn = 0;
+    std::uint32_t mergedAfterOverdraw = 0;
+    for (std::uint32_t y = 0; y < Side; ++y) {
+        for (std::uint32_t x = 0; x < Side; ++x) {
+            std::uint32_t covered = 0;
+            for (std::uint32_t sample = 0; sample < samples; ++sample) {
+                const auto word = loaded[(y * Side + x) * samples + sample];
+                char where[160];
+                std::snprintf(where, sizeof(where), "sample %u of pixel (%u, %u) holds 0x%04x", sample, x, y, word);
+                Require(word == written || word == background || word == over, std::string(where) + ", neither the merged word, the first draw's word nor the last draw's word");
+                covered += word == written ? 1u : 0u;
+                const auto px = x + static_cast<double>(locations[sample].x);
+                const auto py = y + static_cast<double>(locations[sample].y);
+                const auto distance = Inside(Cutting, px, py);
+                const auto overDistance = Inside(Overlapping, px, py);
+                if (std::fabs(distance) < EdgeMargin || std::fabs(overDistance) < EdgeMargin) continue;
+                ++checked;
+                const auto expected = overDistance > 0 ? over : distance > 0 ? written : background;
+                overdrawn += overDistance > 0 && distance > 0 ? 1u : 0u;
+                mergedAfterOverdraw += overDistance <= 0 && distance > 0 ? 1u : 0u;
+                Require(word == expected, std::string(where) + (overDistance > 0 ? ", which the last full write covers" : distance > 0 ? ", which only the merging triangle covers" : ", which no later triangle covers"));
+            }
+            ++pixelsByCoverage[covered];
+        }
+    }
+    const auto partlyMerged = std::accumulate(pixelsByCoverage.begin() + 1, pixelsByCoverage.end() - 1, 0u);
+    Require(checked >= Side * Side * samples * 8u / 10u, "fewer than eight in ten samples are clear of the triangles' edges");
+    Require(pixelsByCoverage[0] != 0 && pixelsByCoverage[samples] != 0 && partlyMerged != 0, "the merged samples do not leave pixels unmerged, merged and partly merged");
+    Require(overdrawn != 0 && mergedAfterOverdraw != 0, "the last full write does not cover some merged samples and leave others");
+    Draw(device, full, Covering, Float32Program(First));
+    const auto lowMerged = TargetState(block, 0x8u, samples);
+    Require(lowMerged.colors.front().partialWriteMask == 0x000fu, "a W write of the 4_4_4_4 target did not merge bits 3..0");
+    Draw(device, merged, Cutting, Float32Program(Second));
+    Draw(device, lowMerged, Crossing, Float32Program(Fourth));
+    const auto twice = LoadSamples(device, texture, samples);
+    std::uint32_t checkedTwice = 0;
+    std::uint32_t mergedTwice = 0;
+    for (std::uint32_t y = 0; y < Side; ++y) {
+        for (std::uint32_t x = 0; x < Side; ++x) {
+            for (std::uint32_t sample = 0; sample < samples; ++sample) {
+                const auto px = x + static_cast<double>(locations[sample].x);
+                const auto py = y + static_cast<double>(locations[sample].y);
+                const auto high = Inside(Cutting, px, py);
+                const auto low = Inside(Crossing, px, py);
+                if (std::fabs(high) < EdgeMargin || std::fabs(low) < EdgeMargin) continue;
+                ++checkedTwice;
+                mergedTwice += high > 0 && low > 0 ? 1u : 0u;
+                auto expected = background;
+                if (high > 0) expected = (expected & 0x0fffu) | (Packed(Second) & 0xf000u);
+                if (low > 0) expected = (expected & 0xfff0u) | (Packed(Fourth) & 0x000fu);
+                const auto word = twice[(y * Side + x) * samples + sample];
+                char where[192];
+                std::snprintf(where, sizeof(where), "after an X merge and a W merge drawn back to back, sample %u of pixel (%u, %u) holds 0x%04x, expected 0x%04x", sample, x, y, word, expected);
+                Require(word == expected, where);
+            }
+        }
+    }
+    Require(checkedTwice >= Side * Side * samples * 8u / 10u && mergedTwice != 0, "the back-to-back merges leave fewer than eight in ten samples clear of their edges, or no sample inside both");
+    std::printf("4_4_4_4 unorm %u-sample partial write tests passed: %u partly merged pixels kept bits 15..12 merged into their covered samples only, a full write drawn right after covered %u merged samples, and %u samples kept both of two merges drawn back to back\n", samples, partlyMerged, overdrawn, mergedTwice);
+}
+
+bool SupportsSamples(const AgcDriver::Graphics::Context& context, std::uint32_t samples) {
+    VkImageFormatProperties properties{};
+    const VkImageUsageFlags usage = VK_IMAGE_USAGE_COLOR_ATTACHMENT_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT | VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_STORAGE_BIT;
+    return (context.limits.framebufferColorSampleCounts & samples) != 0u && context.imageFormatProperties(context.physical, VK_FORMAT_R16_UINT, VK_IMAGE_TYPE_2D, VK_IMAGE_TILING_OPTIMAL, usage, 0, &properties) == VK_SUCCESS && (properties.sampleCounts & samples) != 0u;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+        for (const auto& [present, feature] : {std::pair{context.storageImageMultisample, "shaderStorageImageMultisample"}, std::pair{context.sampleRateShading, "sampleRateShading"}, std::pair{TargetHasCapability(device->Target(), spv::CapabilityFragmentShaderPixelInterlockEXT), "fragmentShaderPixelInterlock"}}) {
+            if (present) continue;
+            std::printf("skipped, the device lacks %s\n", feature);
+            return VulkanTestSkipped;
+        }
+        std::vector<std::unique_ptr<Block>> blocks;
+        std::uint32_t tested = 0;
+        for (const auto samples : SampleCounts) {
+            if (!SupportsSamples(context, samples)) {
+                std::printf("%u-sample R16_UINT storage color targets skipped, the device lacks them\n", samples);
+                continue;
+            }
+            blocks.push_back(std::make_unique<Block>(4u * BlockBytes));
+            RunSamples(*device, *blocks.back(), samples);
+            ++tested;
+        }
+        if (tested == 0) return VulkanTestSkipped;
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444PartialWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444PartialWrite.cpp
new file mode 100644
index 0000000000..1acad9581f
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444PartialWrite.cpp
@@ -0,0 +1,531 @@
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "Optimization/ResourceProgram.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <array>
+#include <bit>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <map>
+#include <mutex>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::ColorTargetLayout;
+using AgcDriver::Graphics::ColorTileMode;
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 256;
+constexpr std::uint32_t Height = 128;
+constexpr std::uint32_t ScissorWidth = 128;
+constexpr std::size_t BlockBytes = 65536;
+constexpr std::uint32_t Unorm4_4_4_4Info = 0x8000u | (19u << 2u) | (2u << 11u);
+constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
+constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Float16Export = 4;
+constexpr std::uint32_t PositionInputs = 0x300u;
+constexpr std::uint32_t DepthInput = 0x400u;
+constexpr std::uint32_t LateKill = 0x40u;
+constexpr std::array<std::uint32_t, 5> CheckerboardKill{0x7e040f00u, 0x7e060f01u, 0x3a040702u, 0x36040481u, 0x7da40480u};
+
+enum class Kill { None, BeforeExport, AfterExport };
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+constexpr std::array<std::array<float, 4>, 3> Triangle{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 64>, 64> Programs{};
+std::size_t programCount = 0;
+
+std::uint32_t Unorm(float value) {
+    if (!(value > 0.0f)) return 0;
+    if (value >= 1.0f) return 15;
+    return static_cast<std::uint32_t>(std::nearbyint(static_cast<double>(value) * 15.0));
+}
+
+std::uint32_t Packed(std::array<float, 4> rgba) {
+    return Unorm(rgba[3]) | (Unorm(rgba[2]) << 4u) | (Unorm(rgba[1]) << 8u) | (Unorm(rgba[0]) << 12u);
+}
+
+std::uint32_t Half(float value) {
+    Require(value == 0.0f || (value >= 0.0625f && value <= 1.0f), "the test's half values are normal and at most 1");
+    if (value == 0.0f) return 0;
+    const auto bits = std::bit_cast<std::uint32_t>(value);
+    Require((bits & 0x1fffu) == 0, "the test's half values are exact");
+    return ((((bits >> 23u) & 0xffu) - 112u) << 10u) | ((bits >> 13u) & 0x3ffu);
+}
+
+std::span<const std::uint32_t> Program(const std::array<std::uint32_t, 4>& vgprs, bool compressed, Kill kill = Kill::None) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    if (kill == Kill::BeforeExport) {
+        for (const auto word : CheckerboardKill) code[at++] = word;
+    }
+    for (std::uint32_t vgpr = 0; vgpr < (compressed ? 2u : 4u); ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = vgprs[vgpr];
+    }
+    if (kill == Kill::AfterExport) {
+        code[at++] = compressed ? 0xf800040fu : 0xf800000fu;
+        code[at++] = compressed ? 0x00000504u : 0x07060504u;
+        for (const auto word : CheckerboardKill) code[at++] = word;
+        code[at++] = 0xf8001890u;
+        code[at++] = 0u;
+    } else {
+        code[at++] = compressed ? 0xf8001c0fu : 0xf800180fu;
+        code[at++] = compressed ? 0x00000504u : 0x07060504u;
+    }
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+std::span<const std::uint32_t> Float32Program(std::array<float, 4> rgba, Kill kill = Kill::None) {
+    return Program({std::bit_cast<std::uint32_t>(rgba[0]), std::bit_cast<std::uint32_t>(rgba[1]), std::bit_cast<std::uint32_t>(rgba[2]), std::bit_cast<std::uint32_t>(rgba[3])}, false, kill);
+}
+
+std::span<const std::uint32_t> Float16Program(std::array<float, 4> rgba) {
+    return Program({Half(rgba[0]) | (Half(rgba[1]) << 16u), Half(rgba[2]) | (Half(rgba[3]) << 16u), 0, 0}, true);
+}
+
+std::span<const std::uint32_t> DepthAsXProgram(std::array<float, 4> rgba) {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    code[at++] = 0x7e080300u;
+    for (std::uint32_t vgpr = 1; vgpr < 4u; ++vgpr) {
+        code[at++] = 0x7e0002ffu | ((4u + vgpr) << 17u);
+        code[at++] = std::bit_cast<std::uint32_t>(rgba[vgpr]);
+    }
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x07060504u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
+const std::array<std::array<float, 4>, 3>& TriangleAt(float z) {
+    static std::map<float, std::array<std::array<float, 4>, 3>> triangles;
+    return triangles.try_emplace(z, std::array<std::array<float, 4>, 3>{{{-1.0f, -1.0f, z, 1.0f}, {3.0f, -1.0f, z, 1.0f}, {-1.0f, 3.0f, z, 1.0f}}}).first->second;
+}
+
+struct DrawSetup {
+    std::uint32_t inputs = 0;
+    std::uint32_t shaderControl = 0;
+    std::span<const std::array<float, 4>> vertices = Triangle;
+    std::uint64_t depth = 0;
+    bool depthWrite = false;
+};
+
+struct Block {
+    explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
+#ifdef _WIN32
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
+#else
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
+#endif
+        Require(data != nullptr, "cannot allocate the color target");
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
+        GuestAllocations::Mutation mutation;
+        mutation.Add(data, bytes, true, true, true);
+    }
+    ~Block() {
+        AgcDriver::Graphics::StorageTexture::FlushPending(Address(), bytes, nullptr, "test release");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(data);
+        }
+#ifdef _WIN32
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
+#else
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
+#endif
+    }
+    Block(const Block&) = delete;
+    Block& operator=(const Block&) = delete;
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
+    std::size_t bytes;
+    bool watched;
+    std::uint8_t* data = nullptr;
+};
+
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Unorm4_4_4_4Info;
+    cx[0x31d] = 0;
+    cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
+    cx[0x3b8] = TiledAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R16_UINT && color.componentMapping == 0x1bu && color.packing == ShaderRecompiler::ColorExportPacking::Unorm4_4_4_4 && color.tileMode == ColorTileMode::RenderTarget && color.bytes == block.bytes, "the tiled 4_4_4_4 unorm target did not decode as a packed R16_UINT target");
+    return color;
+}
+
+std::uint32_t Draw(AgcDriver::VulkanDevice& device, AgcDriver::Graphics::ColorTarget color, std::uint32_t exportedMask, std::uint32_t exportFormat, std::span<const std::uint32_t> pixelCode, const DrawSetup& setup = {}) {
+    const auto target = device.Target();
+    constexpr std::uint32_t waveSize = 64;
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto address = reinterpret_cast<std::uintptr_t>(setup.vertices.data());
+    const std::array<std::uint32_t, 4> vertexBuffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), static_cast<std::uint32_t>(setup.vertices.size()), 0x01016facu};
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+
+    const bool partial = exportedMask != 0xfu;
+    color.partialWriteMask = partial ? AgcDriver::Graphics::PackedWriteMask(color.componentMapping, exportedMask) : 0u;
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.colors = {color};
+    state.color = color;
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {ScissorWidth, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    VkPipelineColorBlendAttachmentState blend{};
+    blend.colorWriteMask = partial ? 0u : VK_COLOR_COMPONENT_R_BIT | VK_COLOR_COMPONENT_G_BIT | VK_COLOR_COMPONENT_B_BIT | VK_COLOR_COMPONENT_A_BIT;
+    state.blends = {blend};
+    state.blend = blend;
+    state.blendConstants = {};
+    state.pixelKill = (setup.shaderControl & LateKill) != 0u;
+    if (setup.depth != 0) {
+        state.depth = AgcDriver::Graphics::DepthTarget{setup.depth, 0, {Width, Height}, VK_FORMAT_D32_SFLOAT, 1.0f, 0, 0, false};
+        state.depthTest = true;
+        state.depthWrite = setup.depthWrite;
+        state.depthCompare = VK_COMPARE_OP_LESS;
+    }
+
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, setup.inputs}, {0x1b4, setup.inputs}, {0x203, setup.shaderControl}, {0x1c5, exportFormat}};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
+        {waveSize, 0, {}, std::nullopt, AgcDriver::Graphics::DecodePixelStageInfo(context, {}), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    const auto handle = ShaderRecompiler::PrepareShader(fragment);
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{codeAddress, 0, 1, {pixelCode.begin(), pixelCode.end()}, {}};
+    snapshot.prepared->entries.push_back({0, handle});
+    fragment.shader.code = snapshot.code;
+    fragment.context.pixel = AgcDriver::Graphics::DecodePixelStageInfo(context, AgcDriver::Graphics::ExportMappings(state));
+    fragment.context.pixel->targetExportPacking = AgcDriver::Graphics::ExportPackings(state);
+    fragment.context.pixel->targetMerge = AgcDriver::Graphics::ExportTargetMerge(state);
+    Require(fragment.context.pixel->pixelKillEnable == ((setup.shaderControl & LateKill) != 0u) && !fragment.context.pixel->earlyZ && fragment.context.pixel->targetMerge.depthStencilWrites == (partial && setup.depth != 0 && setup.depthWrite), "the draw's pixel kill under late tests or its depth and stencil writes did not decode");
+    Require((fragment.context.pixel->targetMerge.mask != 0u) == partial && fragment.context.pixel->targetMerge.mask == color.partialWriteMask, "the draw's target merge disagrees with its write mask");
+    const ShaderRecompiler::SrtRuntime runtime{};
+    const auto invocation = AgcDriver::DriverDetail::InvocationFor(snapshot, 0, fragment);
+    const auto pixelResult = invocation.Materialize(*invocation.Capture(runtime));
+    const bool registered = pixelResult->variantId == ShaderRecompiler::GetPreparedArtifact(*handle).variantId;
+    Require(registered != partial, partial ? "the merging draw reused the registered pixel shader" : "the full write did not use the registered pixel shader");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, pixelResult.get(), PixelPushOffset(vertexPush, target)}
+    }};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(setup.vertices.size()), 0, 1, 0, false};
+    device.Draw(state, draw, shaders);
+    return color.partialWriteMask;
+}
+
+std::vector<std::uint16_t> ReadBack(AgcDriver::VulkanDevice& device, const Block& block) {
+    AgcDriver::Graphics::StorageTexture::FlushPending(block.Address(), block.bytes, nullptr, "test read-back");
+    device.WaitIdle();
+    std::vector<std::uint16_t> stored(block.bytes / 2u);
+    AgcDriver::GuestMemory::Read(block.Address(), std::as_writable_bytes(std::span(stored)), 1);
+    return stored;
+}
+
+void ExpectSurface(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& before, std::uint32_t word, std::uint32_t wordMask, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            const bool inside = x < ScissorWidth;
+            const std::uint32_t expected = inside ? (before[index] & ~wordMask) | (word & wordMask) : before[index];
+            if (stored[index] == expected) continue;
+            char detail[192];
+            std::snprintf(detail, sizeof(detail), ": pixel (%u, %u) %s the scissor holds 0x%04x, expected 0x%04x (it held 0x%04x)", x, y, inside ? "inside" : "outside", stored[index], expected, before[index]);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+std::vector<std::uint16_t> Fill(Block& block, std::uint32_t seed) {
+    std::vector<std::uint16_t> words(block.bytes / 2u);
+    for (std::size_t index = 0; index < words.size(); ++index) words[index] = static_cast<std::uint16_t>(((index + seed) * 0x9e3779b9u) >> 11u);
+    std::memcpy(block.data, words.data(), block.bytes);
+    return words;
+}
+
+struct Case {
+    std::uint32_t mask;
+    std::uint32_t wordMask;
+    std::array<float, 4> rgba;
+};
+
+std::uint32_t DrawCase(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::uint32_t mask, std::uint32_t wordMask, std::uint32_t exportFormat, std::span<const std::uint32_t> pixelCode, const DrawSetup& setup = {}) {
+    const auto drawn = Draw(device, color, mask, exportFormat, pixelCode, setup);
+    char detail[160];
+    std::snprintf(detail, sizeof(detail), "CB_TARGET_MASK 0x%x merged the word mask 0x%04x, not 0x%04x", mask, drawn, mask == 0xfu ? 0u : wordMask);
+    Require(drawn == (mask == 0xfu ? 0u : wordMask), detail);
+    return wordMask;
+}
+
+void ExpectWords(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& expected, const std::vector<std::uint16_t>& before, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            if (stored[index] == expected[index]) continue;
+            char detail[192];
+            std::snprintf(detail, sizeof(detail), ": pixel (%u, %u) holds 0x%04x, expected 0x%04x (it held 0x%04x)", x, y, stored[index], expected[index], before[index]);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+void BackToBack(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color, std::span<const Case> draws, std::uint32_t seed, const std::string& what) {
+    const auto before = Fill(block, seed);
+    auto expected = before;
+    for (const auto& [mask, wordMask, rgba] : draws) {
+        DrawCase(device, color, mask, wordMask, Float32Export, Float32Program(rgba));
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < ScissorWidth; ++x) {
+                auto& word = expected[layout.Offset(x, y) / 2u];
+                word = static_cast<std::uint16_t>((word & ~wordMask) | (Packed(rgba) & wordMask));
+            }
+        }
+    }
+    ExpectWords(device, block, layout, expected, before, what);
+}
+
+void SameDrawOverdraw(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color, float first, float last, std::uint32_t seed) {
+    constexpr std::uint32_t Layers = 16;
+    static std::map<float, std::vector<std::array<float, 4>>> stacks;
+    auto& vertices = stacks[last];
+    for (std::uint32_t layer = 0; layer < Layers; ++layer) {
+        const auto& triangle = TriangleAt(layer % 2u == Layers % 2u ? first : last);
+        vertices.insert(vertices.end(), triangle.begin(), triangle.end());
+    }
+    const auto before = Fill(block, seed);
+    auto expected = before;
+    const std::uint32_t nibble = static_cast<std::uint32_t>(std::nearbyint(static_cast<double>(last) * 15.0));
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < ScissorWidth; ++x) {
+            auto& word = expected[layout.Offset(x, y) / 2u];
+            word = static_cast<std::uint16_t>((word & 0x0fffu) | (nibble << 12u));
+        }
+    }
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, DepthAsXProgram({0.0f, 0.4f, 0.6f, 1.0f}), {DepthInput, 0u, vertices});
+    char what[160];
+    std::snprintf(what, sizeof(what), "one draw of %u full-screen triangles alternating z %.2f and %.2f, merging z into X", Layers, first, last);
+    ExpectWords(device, block, layout, expected, before, what);
+}
+
+void DepthRejection(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color) {
+    Block depth(static_cast<std::size_t>(Width) * Height * 4u);
+    const std::vector<float> cleared(depth.bytes / 4u, 1.0f);
+    std::memcpy(depth.data, cleared.data(), depth.bytes);
+    const std::array<float, 4> nearer{0.6f, 0.2f, 0.8f, 0.4f};
+    const std::array<float, 4> behind{0.0f, 1.0f, 1.0f, 1.0f};
+    const std::array<float, 4> front{1.0f, 0.0f, 0.0f, 1.0f / 15.0f};
+    auto before = Fill(block, 301u);
+    auto expected = before;
+    const auto inside = [](std::uint32_t x) { return x < ScissorWidth; };
+    const auto survivor = [&](std::uint32_t x, std::uint32_t y) { return inside(x) && ((x ^ y) & 1u) == 0u; };
+    const auto expect = [&](const auto& select, std::uint32_t word, std::uint32_t wordMask) {
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < Width; ++x) {
+                if (!select(x, y)) continue;
+                auto& stored = expected[layout.Offset(x, y) / 2u];
+                stored = static_cast<std::uint16_t>((stored & ~wordMask) | (word & wordMask));
+            }
+        }
+    };
+    DrawCase(device, color, 0xfu, 0xffffu, Float32Export, Float32Program(nearer, Kill::BeforeExport), {PositionInputs, LateKill, TriangleAt(0.5f), depth.Address(), true});
+    expect(survivor, Packed(nearer), 0xffffu);
+    ExpectWords(device, block, layout, expected, before, "a full write at z 0.5 that kills a checkerboard and writes depth");
+    before = expected;
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(behind), {0u, 0u, TriangleAt(0.75f), depth.Address(), false});
+    expect([&](std::uint32_t x, std::uint32_t y) { return inside(x) && !survivor(x, y); }, Packed(behind), 0xf000u);
+    ExpectWords(device, block, layout, expected, before, "an X merge at z 0.75 behind the depth 0.5 the surviving pixels hold");
+    before = expected;
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(front), {0u, 0u, TriangleAt(0.25f), depth.Address(), false});
+    expect([&](std::uint32_t x, std::uint32_t) { return inside(x); }, Packed(front), 0xf000u);
+    ExpectWords(device, block, layout, expected, before, "an X merge at z 0.25 in front of every stored depth");
+}
+
+void CountedKill(AgcDriver::VulkanDevice& device, Block& block, const ColorTargetLayout& layout, const AgcDriver::Graphics::ColorTarget& color) {
+    {
+        std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+        auto* recorder = AgcDriver::Graphics::Recorder::Active();
+        Require(recorder != nullptr, "the test device has no command recorder to count samples");
+        recorder->CountSamples();
+    }
+    const auto before = Fill(block, 501u);
+    const std::array<float, 4> rgba{0.6f, 0.2f, 0.8f, 0.4f};
+    std::string refusal;
+    try {
+        DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(rgba, Kill::BeforeExport), {PositionInputs, LateKill});
+    } catch (const std::exception& error) {
+        refusal = error.what();
+    }
+    Require(refusal.find("while occlusion queries count samples") != std::string::npos, "a merge that kills under late tests drew while occlusion queries count samples" + (refusal.empty() ? std::string() : ": " + refusal));
+    DrawCase(device, color, 0x1u, 0xf000u, Float32Export, Float32Program(rgba));
+    ExpectSurface(device, block, layout, before, Packed(rgba), 0xf000u, "a merged X write that kills nothing while occlusion queries count samples");
+}
+
+void ExpectKilled(AgcDriver::VulkanDevice& device, const Block& block, const ColorTargetLayout& layout, const std::vector<std::uint16_t>& before, std::uint32_t word, std::uint32_t wordMask, const std::string& what) {
+    const auto stored = ReadBack(device, block);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto index = layout.Offset(x, y) / 2u;
+            const bool kept = x < ScissorWidth && ((x ^ y) & 1u) == 0u;
+            const std::uint32_t expected = kept ? (before[index] & ~wordMask) | (word & wordMask) : before[index];
+            if (stored[index] == expected) continue;
+            char detail[192];
+            std::snprintf(detail, sizeof(detail), ": %s pixel (%u, %u) holds 0x%04x, expected 0x%04x (it held 0x%04x)", kept ? "a surviving" : x < ScissorWidth ? "a killed" : "an unscissored", x, y, stored[index], expected, before[index]);
+            throw std::runtime_error(what + detail);
+        }
+    }
+}
+
+std::string Describe(std::uint32_t mask, std::array<float, 4> rgba) {
+    char text[160];
+    std::snprintf(text, sizeof(text), "CB_TARGET_MASK 0x%x write of (%.9g, %.9g, %.9g, %.9g)", mask, rgba[0], rgba[1], rgba[2], rgba[3]);
+    return text;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!TargetHasCapability(device->Target(), spv::CapabilityFragmentShaderPixelInterlockEXT)) {
+            std::puts("skipped, the device lacks fragmentShaderPixelInterlock");
+            return VulkanTestSkipped;
+        }
+        const ColorTargetLayout layout(Width, Height, ColorTileMode::RenderTarget, 2);
+        Block block(layout.Bytes());
+        const auto color = DecodeTarget(block);
+        Require(AgcDriver::Graphics::PackedWriteMask(color.componentMapping, 1u) == 0xf000u && AgcDriver::Graphics::PackedWriteMask(color.componentMapping, 8u) == 0x000fu && AgcDriver::Graphics::PackedWriteMask(color.componentMapping, 5u) == 0xf0f0u, "the export components did not map to the guest nibbles (X in 15..12, W in 3..0)");
+        const std::array<Case, 9> cases{{
+            {0x1u, 0xf000u, {1.0f, 0.0f, 0.0f, 0.0f}},
+            {0x1u, 0xf000u, {7.0f / 15.0f, 1.0f, 1.0f, 1.0f}},
+            {0x5u, 0xf0f0u, {0.2f, 0.4f, 0.6f, 0.8f}},
+            {0x2u, 0x0f00u, {0.0f, 2.0f / 15.0f, 1.0f, 1.0f}},
+            {0x8u, 0x000fu, {1.0f, 1.0f, 1.0f, 11.0f / 15.0f}},
+            {0x6u, 0x0ff0u, {0.0f, 0.0f, 0.0f, 0.0f}},
+            {0xeu, 0x0fffu, {0.0f, 1.0f, 0.5f, 0.25f}},
+            {0xfu, 0xffffu, {0.1f, 0.7f, 0.9f, 0.3f}},
+            {0x1u, 0xf000u, {0.0f, 0.0f, 0.0f, 0.0f}},
+        }};
+        const std::array<std::uint16_t, 9> goldens{0xf000u, 0x7fffu, 0x369cu, 0x02ffu, 0xfffbu, 0x0000u, 0x0f84u, 0x2ad5u, 0x0000u};
+        auto before = Fill(block, 0);
+        for (std::size_t index = 0; index < cases.size(); ++index) {
+            const auto& [mask, wordMask, rgba] = cases[index];
+            DrawCase(*device, color, mask, wordMask, Float32Export, Float32Program(rgba));
+            ExpectSurface(*device, block, layout, before, goldens[index], wordMask, "a 32_ABGR " + Describe(mask, rgba) + " into a tiled 4_4_4_4 unorm target");
+            before = ReadBack(*device, block);
+        }
+        const std::array<float, 4> b{2.0f / 15.0f, 1.0f, 1.0f, 1.0f};
+        const std::array<float, 4> c{0.6f, 0.2f, 0.8f, 0.4f};
+        const std::array<float, 4> d{1.0f, 0.0f, 9.0f / 15.0f, 0.0f};
+        const std::array<Case, 2> mergeThenFull{{{0x1u, 0xf000u, b}, {0xfu, 0xffffu, c}}};
+        const std::array<Case, 2> fullThenMerge{{{0xfu, 0xffffu, c}, {0x1u, 0xf000u, b}}};
+        const std::array<Case, 3> mergeThenMerge{{{0x1u, 0xf000u, b}, {0x4u, 0x00f0u, d}, {0x8u, 0x000fu, c}}};
+        BackToBack(*device, block, layout, color, mergeThenFull, 11, "a merged X write followed at once by a full write");
+        BackToBack(*device, block, layout, color, fullThenMerge, 12, "a full write followed at once by a merged X write");
+        BackToBack(*device, block, layout, color, mergeThenMerge, 13, "merged X, Z and W writes drawn back to back");
+        before = Fill(block, 77);
+        const std::array<float, 4> halves{0.5f, 0.75f, 0.125f, 0.25f};
+        const auto wordMask = DrawCase(*device, color, 0x9u, 0xf00fu, Float16Export, Float16Program(halves));
+        ExpectSurface(*device, block, layout, before, Packed(halves), wordMask, "an FP16_ABGR " + Describe(0x9u, halves) + " into a tiled 4_4_4_4 unorm target");
+        for (const auto kill : {Kill::BeforeExport, Kill::AfterExport}) {
+            for (const auto& [mask, wordMask, rgba] : {Case{0x1u, 0xf000u, {0.6f, 0.2f, 0.8f, 0.4f}}, Case{0x6u, 0x0ff0u, {1.0f, 2.0f / 15.0f, 13.0f / 15.0f, 0.0f}}}) {
+                before = Fill(block, 91u + mask);
+                const auto killedMask = DrawCase(*device, color, mask, wordMask, Float32Export, Float32Program(rgba, kill), {PositionInputs, LateKill});
+                ExpectKilled(*device, block, layout, before, Packed(rgba), killedMask, std::string(kill == Kill::BeforeExport ? "a late-test checkerboard kill before " : "a late-test checkerboard kill after ") + Describe(mask, rgba) + " into a tiled 4_4_4_4 unorm target");
+            }
+        }
+        SameDrawOverdraw(*device, block, layout, color, 0.2f, 0.8f, 401u);
+        SameDrawOverdraw(*device, block, layout, color, 0.8f, 0.2f, 402u);
+        DepthRejection(*device, block, layout, color);
+        CountedKill(*device, block, layout, color);
+        std::printf("4_4_4_4 unorm partial write tests passed: %zu masked draws, 3 back-to-back sequences, 4 checkerboard-killing draws, 2 same-draw overdraws of 16 layers, a depth-rejected merge and a refused killing merge while samples are counted, into a %ux%u tiled target, the killed, rejected and unscissored pixels kept\n", cases.size() + 1u, Width, Height);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp
index 0afb33266f..7d4ab406e6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PartiallyResidentSnapshot.cpp
@@ -2,13 +2,16 @@
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestTextureResource.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "SpirvBackend/SpirvModule.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -18,6 +21,7 @@
 #else
 #include <sys/mman.h>
 #endif
+#include <algorithm>
 #include <array>
 #include <atomic>
 #include <cstddef>
@@ -29,6 +33,7 @@
 #include <memory>
 #include <mutex>
 #include <optional>
+#include <span>
 #include <stdexcept>
 #include <string>
 #include <string_view>
@@ -54,6 +59,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -65,6 +72,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -72,7 +85,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            context.physical = devices.front();
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             const auto extensions = function<PFN_vkEnumerateDeviceExtensionProperties>("vkEnumerateDeviceExtensionProperties");
             Check(extensions(context.physical, nullptr, &count, nullptr), "vkEnumerateDeviceExtensionProperties");
             std::vector<VkExtensionProperties> available(count);
@@ -353,6 +366,201 @@ void UntrackedHint(const Context& context, ReservedSurface& surface) {
 }
 #endif
 
+#ifdef _WIN32
+std::vector<std::uint32_t> TexelFetchShader(std::uint32_t side) {
+    ShaderRecompiler::SpirvModule module;
+    module.EmitCapability(spv::CapabilityShader);
+    module.AddMemoryModel(spv::AddressingModelLogical, spv::MemoryModelGLSL450);
+    const auto u32 = module.Type(spv::OpTypeInt, 32u, 0u);
+    const auto i32 = module.Type(spv::OpTypeInt, 32u, 1u);
+    const auto v4 = module.Type(spv::OpTypeVector, u32, 4u);
+    const auto v3 = module.Type(spv::OpTypeVector, u32, 3u);
+    const auto v2 = module.Type(spv::OpTypeVector, i32, 2u);
+    const auto voidType = module.Type(spv::OpTypeVoid);
+    const auto constant = [&](std::uint32_t value) { return module.Constant(spv::OpConstant, u32, value); };
+    const auto array = module.Type(spv::OpTypeRuntimeArray, v4);
+    module.AddAnnotation(spv::OpDecorate, array, spv::DecorationArrayStride, 16u);
+    const auto block = module.Type(spv::OpTypeStruct, array);
+    module.AddAnnotation(spv::OpDecorate, block, spv::DecorationBlock);
+    module.AddAnnotation(spv::OpMemberDecorate, block, 0u, spv::DecorationOffset, 0u);
+    const auto buffer = module.DefineGlobalVariable(module.Type(spv::OpTypePointer, spv::StorageClassStorageBuffer, block), spv::StorageClassStorageBuffer);
+    module.AddAnnotation(spv::OpDecorate, buffer, spv::DecorationDescriptorSet, 0u);
+    module.AddAnnotation(spv::OpDecorate, buffer, spv::DecorationBinding, 1u);
+    const auto imageType = module.Type(spv::OpTypeImage, u32, spv::Dim2D, 0u, 0u, 0u, 1u, spv::ImageFormatUnknown);
+    const auto image = module.DefineGlobalVariable(module.Type(spv::OpTypePointer, spv::StorageClassUniformConstant, imageType), spv::StorageClassUniformConstant);
+    module.AddAnnotation(spv::OpDecorate, image, spv::DecorationDescriptorSet, 0u);
+    module.AddAnnotation(spv::OpDecorate, image, spv::DecorationBinding, 0u);
+    const auto group = module.DefineGlobalVariable(module.Type(spv::OpTypePointer, spv::StorageClassInput, v3), spv::StorageClassInput);
+    module.AddAnnotation(spv::OpDecorate, group, spv::DecorationBuiltIn, spv::BuiltInWorkgroupId);
+    const auto main = module.AllocateId();
+    module.AddFunction(spv::OpFunction, voidType, main, spv::FunctionControlMaskNone, module.Type(spv::OpTypeFunction, voidType));
+    module.AddFunction(spv::OpLabel, module.AllocateId());
+    const auto loaded = module.AllocateId();
+    module.AddFunction(spv::OpLoad, v3, loaded, group);
+    const auto index = module.AllocateId();
+    module.AddFunction(spv::OpCompositeExtract, u32, index, loaded, 0u);
+    const auto binary = [&](spv::Op op, std::uint32_t a, std::uint32_t b) {
+        const auto result = module.AllocateId();
+        module.AddFunction(op, u32, result, a, b);
+        return result;
+    };
+    const auto signedValue = [&](std::uint32_t value) {
+        const auto result = module.AllocateId();
+        module.AddFunction(spv::OpBitcast, i32, result, value);
+        return result;
+    };
+    const auto coordinate = module.AllocateId();
+    module.AddFunction(spv::OpCompositeConstruct, v2, coordinate, signedValue(binary(spv::OpUMod, index, constant(side))), signedValue(binary(spv::OpUDiv, index, constant(side))));
+    const auto object = module.AllocateId();
+    module.AddFunction(spv::OpLoad, imageType, object, image);
+    const auto value = module.AllocateId();
+    module.AddFunction(spv::OpImageFetch, v4, value, object, coordinate, spv::ImageOperandsLodMask, constant(0u));
+    const auto pointer = module.AllocateId();
+    module.AddFunction(spv::OpAccessChain, module.Type(spv::OpTypePointer, spv::StorageClassStorageBuffer, v4), pointer, buffer, constant(0u), index);
+    module.AddFunction(spv::OpStore, pointer, value);
+    module.AddFunction(spv::OpReturn);
+    module.AddFunction(spv::OpFunctionEnd);
+    module.EmitEntryPoint(spv::ExecutionModelGLCompute, main, "main", {group});
+    module.AddExecutionMode(main, spv::ExecutionModeLocalSize, 1u, 1u, 1u);
+    return module.Finalize();
+}
+
+class TexelFetch {
+public:
+    TexelFetch(const Context& context, const Texture& texture, Buffer& output, std::span<const std::uint32_t> code) : context(context) {
+        try {
+            const std::array<VkDescriptorSetLayoutBinding, 2> bindings{{{0u, VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE, 1u, VK_SHADER_STAGE_COMPUTE_BIT, nullptr}, {1u, VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u, VK_SHADER_STAGE_COMPUTE_BIT, nullptr}}};
+            VkDescriptorSetLayoutCreateInfo info{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_LAYOUT_CREATE_INFO};
+            info.bindingCount = 2u;
+            info.pBindings = bindings.data();
+            Check(context.Function<PFN_vkCreateDescriptorSetLayout>("vkCreateDescriptorSetLayout")(context.device, &info, nullptr, &setLayout), "texel fetch descriptor layout");
+            const std::array<VkDescriptorPoolSize, 2> sizes{{{VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE, 1u}, {VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, 1u}}};
+            VkDescriptorPoolCreateInfo poolInfo{VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO};
+            poolInfo.maxSets = 1u;
+            poolInfo.poolSizeCount = 2u;
+            poolInfo.pPoolSizes = sizes.data();
+            Check(context.Function<PFN_vkCreateDescriptorPool>("vkCreateDescriptorPool")(context.device, &poolInfo, nullptr, &pool), "texel fetch descriptor pool");
+            const VkDescriptorSetAllocateInfo allocate{VK_STRUCTURE_TYPE_DESCRIPTOR_SET_ALLOCATE_INFO, nullptr, pool, 1u, &setLayout};
+            Check(context.Function<PFN_vkAllocateDescriptorSets>("vkAllocateDescriptorSets")(context.device, &allocate, &set), "texel fetch descriptor set");
+            const VkDescriptorImageInfo image{VK_NULL_HANDLE, texture.View(), texture.Layout()};
+            const VkDescriptorBufferInfo buffer{output.Handle(), 0u, output.Bytes().size()};
+            const std::array<VkWriteDescriptorSet, 2> writes{{{VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET, nullptr, set, 0u, 0u, 1u, VK_DESCRIPTOR_TYPE_SAMPLED_IMAGE, &image, nullptr, nullptr}, {VK_STRUCTURE_TYPE_WRITE_DESCRIPTOR_SET, nullptr, set, 1u, 0u, 1u, VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, nullptr, &buffer, nullptr}}};
+            context.Function<PFN_vkUpdateDescriptorSets>("vkUpdateDescriptorSets")(context.device, 2u, writes.data(), 0u, nullptr);
+            VkPipelineLayoutCreateInfo layoutInfo{VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO};
+            layoutInfo.setLayoutCount = 1u;
+            layoutInfo.pSetLayouts = &setLayout;
+            Check(context.Function<PFN_vkCreatePipelineLayout>("vkCreatePipelineLayout")(context.device, &layoutInfo, nullptr, &layout), "texel fetch pipeline layout");
+            VkShaderModuleCreateInfo shaderInfo{VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO};
+            shaderInfo.codeSize = code.size_bytes();
+            shaderInfo.pCode = code.data();
+            Check(context.Function<PFN_vkCreateShaderModule>("vkCreateShaderModule")(context.device, &shaderInfo, nullptr, &module), "texel fetch shader module");
+            VkComputePipelineCreateInfo pipelineInfo{VK_STRUCTURE_TYPE_COMPUTE_PIPELINE_CREATE_INFO};
+            pipelineInfo.layout = layout;
+            pipelineInfo.stage = {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO, nullptr, 0u, VK_SHADER_STAGE_COMPUTE_BIT, module, "main", nullptr};
+            Check(context.Function<PFN_vkCreateComputePipelines>("vkCreateComputePipelines")(context.device, VK_NULL_HANDLE, 1u, &pipelineInfo, nullptr, &pipeline), "texel fetch pipeline");
+        } catch (...) {
+            release();
+            throw;
+        }
+    }
+    ~TexelFetch() { release(); }
+    TexelFetch(const TexelFetch&) = delete;
+    TexelFetch& operator=(const TexelFetch&) = delete;
+
+    void Run(VkCommandBuffer commands, std::uint32_t groups) const {
+        context.Function<PFN_vkCmdBindPipeline>("vkCmdBindPipeline")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, pipeline);
+        context.Function<PFN_vkCmdBindDescriptorSets>("vkCmdBindDescriptorSets")(commands, VK_PIPELINE_BIND_POINT_COMPUTE, layout, 0u, 1u, &set, 0u, nullptr);
+        context.Function<PFN_vkCmdDispatch>("vkCmdDispatch")(commands, groups, 1u, 1u);
+    }
+
+private:
+    void release() noexcept {
+        if (pipeline != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipeline>("vkDestroyPipeline")(context.device, pipeline, nullptr);
+        if (module != VK_NULL_HANDLE) context.Function<PFN_vkDestroyShaderModule>("vkDestroyShaderModule")(context.device, module, nullptr);
+        if (layout != VK_NULL_HANDLE) context.Function<PFN_vkDestroyPipelineLayout>("vkDestroyPipelineLayout")(context.device, layout, nullptr);
+        if (pool != VK_NULL_HANDLE) context.Function<PFN_vkDestroyDescriptorPool>("vkDestroyDescriptorPool")(context.device, pool, nullptr);
+        if (setLayout != VK_NULL_HANDLE) context.Function<PFN_vkDestroyDescriptorSetLayout>("vkDestroyDescriptorSetLayout")(context.device, setLayout, nullptr);
+    }
+
+    Context context;
+    VkDescriptorSetLayout setLayout = VK_NULL_HANDLE;
+    VkDescriptorPool pool = VK_NULL_HANDLE;
+    VkDescriptorSet set = VK_NULL_HANDLE;
+    VkPipelineLayout layout = VK_NULL_HANDLE;
+    VkShaderModule module = VK_NULL_HANDLE;
+    VkPipeline pipeline = VK_NULL_HANDLE;
+};
+
+std::vector<std::uint32_t> FetchTexels(const Context& context, const Texture& texture, std::uint32_t side) {
+    const auto count = side * side;
+    Buffer output(context, std::size_t{count} * 16u, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+    std::memset(output.Bytes().data(), 0xa5, output.Bytes().size());
+    const TexelFetch fetch(context, texture, output, TexelFetchShader(side));
+    CommandBatch batch(context);
+    fetch.Run(batch.Handle(), count);
+    RecordMemoryBarrier(context, batch.Handle(), VK_PIPELINE_STAGE_COMPUTE_SHADER_BIT, VK_PIPELINE_STAGE_HOST_BIT, VK_ACCESS_SHADER_WRITE_BIT, VK_ACCESS_HOST_READ_BIT);
+    batch.SubmitAndWait();
+    output.Invalidate();
+    std::vector<std::uint32_t> texels(count);
+    for (std::uint32_t index = 0; index < count; ++index) std::memcpy(&texels[index], output.Bytes().data() + std::size_t{index} * 16u, sizeof(std::uint32_t));
+    return texels;
+}
+
+void ComparedShared(const Context& context) {
+    constexpr std::uint32_t side = 128;
+    constexpr std::size_t bytes = 2 * BlockBytes;
+    constexpr std::uint32_t before = 0x5a5a5a5au;
+    constexpr std::uint32_t stored = 0x13579bdfu;
+    struct Direct {
+        std::uint8_t* memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(2 * bytes, BlockBytes));
+        HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE, 0, bytes, nullptr);
+        bool registered = false;
+        ~Direct() {
+            if (registered) GuestAllocations::Mutation().Remove(memory);
+            if (memory != nullptr) {
+                GuestArena::GuestArenaReset_nid_postfix(memory, 2 * bytes);
+                GuestArena::GuestArenaRelease_nid_postfix(memory, 2 * bytes);
+            }
+            if (section == nullptr) return;
+            GuestArena::GuestArenaForgetSection_nid_postfix(section);
+            CloseHandle(section);
+        }
+    } direct;
+    Require(direct.memory != nullptr && direct.section != nullptr, "compared shared snapshot: cannot create the direct memory");
+    GuestArena::GuestArenaForgetSection_nid_postfix(direct.section);
+    GuestArena::GuestArenaMapDirect_nid_postfix(direct.memory, bytes, direct.section, 0, PAGE_READWRITE);
+    GuestAllocations::Mutation().Add(direct.memory, bytes, true, true, true);
+    direct.registered = true;
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(direct.memory));
+    std::fill_n(reinterpret_cast<std::uint32_t*>(direct.memory), bytes / sizeof(std::uint32_t), before);
+    Require(AgcDriver::GuestMemory::Watched(address, bytes), "compared shared snapshot: the direct memory is not watched");
+    AgcDriver::GuestMemory::Unwatch(address, BlockBytes);
+    const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> imported{{{address, address + BlockBytes}}};
+    AgcDriver::GuestMemory::Rewatch(imported);
+    Require(AgcDriver::GuestMemory::Watched(address, BlockBytes), "compared shared snapshot: the rewatched block is not watched");
+    const auto words = Descriptor(address, side);
+    Require(DescribeSurface(DecodeTextureResource(words)).guestBytes == BlockBytes, "compared shared snapshot: the descriptor does not describe the rewatched block");
+    const auto lookup = [&] {
+        AgcDriver::GuestMemory::BumpCollectEpoch();
+        return CachedSampledTexture(context, words);
+    };
+    const auto cached = lookup();
+    Require(cached != nullptr && !cached->ViewsStorageImage(), "compared shared snapshot: the rewatched block was not sampled through a snapshot");
+    Require(lookup() == cached, "compared shared snapshot: the unchanged rewatched block did not reuse its snapshot");
+    const auto initial = FetchTexels(context, *cached, side);
+    Require(std::all_of(initial.begin(), initial.end(), [](std::uint32_t texel) { return texel == before; }), "compared shared snapshot: the GPU did not read the cached texels");
+    GuestArena::GuestArenaMapDirect_nid_postfix(direct.memory + bytes, bytes, direct.section, 0, PAGE_READWRITE);
+    *reinterpret_cast<volatile std::uint32_t*>(direct.memory) = stored;
+    const auto fresh = lookup();
+    Require(fresh != nullptr && fresh != cached, "the first lookup after a CPU store into shared compared memory returned the snapshot cached before the sharing");
+    const auto texels = FetchTexels(context, *fresh, side);
+    Require(texels.front() == stored, "the GPU read the old texel on the first lookup after a CPU store into shared compared memory");
+    Require(std::all_of(texels.begin() + 1, texels.end(), [](std::uint32_t texel) { return texel == before; }), "the GPU read texels the CPU store into shared compared memory did not write");
+    Require(lookup() == fresh, "the snapshot of shared compared memory was not reused after its compare");
+    ClearCachedTextures(context.device);
+}
+#endif
+
 void PendingStores(const Context& context, ReservedSurface& surface) {
     const auto address = surface.Address();
     const auto words = Descriptor(address);
@@ -421,6 +629,14 @@ int main(int argc, char** argv) {
                 LargeTracked(context, surface, LargeSurfaceBytes);
                 LargeTracked(context, surface, BlockBytes);
             } else if (argc == 2 && std::string_view(argv[1]) == "--pending-stores") PendingStores(context, surface);
+            else if (argc == 2 && std::string_view(argv[1]) == "--compared-shared") {
+#ifdef _WIN32
+                ComparedShared(context);
+#else
+                std::puts("skipped, only Windows direct memory is compared once shared");
+                return Skipped;
+#endif
+            }
             else if (argc == 2 && std::string_view(argv[1]) == "--untracked-hint") {
 #ifdef _WIN32
                 UntrackedHint(context, surface);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PeriodCopy.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PeriodCopy.cpp
new file mode 100644
index 0000000000..0c4fecdb35
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PeriodCopy.cpp
@@ -0,0 +1,116 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Memory/BufferCopy.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "VulkanTestDevice.hpp"
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+
+alignas(256) constexpr std::array<std::uint32_t, 38> Code{
+    0xbfa00002u, 0xd7460000u, 0x04010c0cu, 0xf4201a84u, 0xfa000000u, 0xbf8cc07fu, 0x7da8006au, 0xbf88001du,
+    0xf4200204u, 0xfa000004u, 0xbf8cc07fu, 0x7e020c08u, 0x81ea0880u, 0x7e025701u, 0x100202ffu, 0x4f7ffffeu,
+    0x7e020f01u, 0x7ed60501u, 0x936a6b6au, 0x9aea6b6au, 0x4a02026au, 0xd56a0001u, 0x00020101u, 0xd5690001u,
+    0x00020208u, 0x4c020300u, 0x7d860208u, 0x4e040208u, 0x02020501u, 0x7d860208u, 0x4e040208u, 0x02020501u,
+    0xe0002000u, 0x80000101u, 0xbf8c3f70u, 0xe0102000u, 0x80010100u, 0xbf810000u};
+constexpr std::uint32_t Untouched = 0xcafebabeu;
+constexpr std::uint32_t ElementFormat = 0x00014004u;
+constexpr std::uint32_t RecordFormat = 0x0004dfacu;
+constexpr std::uint32_t Elements = 8192;
+alignas(256) std::array<std::uint32_t, Elements> Source{};
+alignas(256) std::array<std::uint32_t, Elements> Destination{};
+alignas(256) std::array<std::uint32_t, 4> Record{};
+
+void AppendDescriptor(std::vector<std::uint32_t>& data, const void* base, std::uint32_t stride, std::uint32_t records, std::uint32_t format) {
+    const auto address = reinterpret_cast<std::uintptr_t>(base);
+    data.insert(data.end(), {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), records, format});
+}
+
+std::vector<std::uint32_t> Commands(std::uint32_t groups) {
+    std::vector<std::uint32_t> data;
+    AppendDescriptor(data, Source.data(), 4, Elements, ElementFormat);
+    AppendDescriptor(data, Destination.data(), 4, Elements, ElementFormat);
+    AppendDescriptor(data, Record.data(), 16, 1, RecordFormat);
+    std::vector<std::uint32_t> words;
+    const auto registers = [&](std::uint32_t first, std::span<const std::uint32_t> values) {
+        words.push_back(0xc0007600u | (static_cast<std::uint32_t>(values.size()) << 16u));
+        words.push_back(first);
+        words.insert(words.end(), values.begin(), values.end());
+    };
+    const std::array<std::uint32_t, 3> shape{64, 1, 1};
+    registers(0x207, shape);
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    const std::array<std::uint32_t, 2> program{static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u)};
+    registers(0x20c, program);
+    const std::array<std::uint32_t, 1> resource{(static_cast<std::uint32_t>(data.size()) << 1u) | (1u << 7u)};
+    registers(0x213, resource);
+    registers(0x240, data);
+    words.insert(words.end(), {0xc0031500u, groups, 1, 1, 0x41u});
+    return words;
+}
+
+std::uint64_t Taken() {
+    using namespace AgcDriver::DriverDetail;
+    return copyPathCounts[CopyCpu].load() + copyPathCounts[CopyGpu].load() + copyPathCounts[CopyAliased].load();
+}
+
+void ExecuteTests() {
+    struct Case {
+        const char* name;
+        std::uint32_t count, period, groups;
+        bool hle;
+    };
+    constexpr std::array<Case, 5> cases{{
+        {"one full group", 64, 64, 1, true},
+        {"a period above the count", 1000, 4096, 16, true},
+        {"a partial last group", 100, 100, 2, true},
+        {"a period below the count", 300, 7, 5, false},
+        {"more groups than the count needs", 64, 64, 2, false},
+    }};
+    const bool hleEnabled = std::getenv("APS5_NO_COPY_HLE") == nullptr;
+    for (const auto& item : cases) {
+        const bool hle = item.hle && hleEnabled;
+        for (std::size_t i = 0; i < Source.size(); ++i) Source[i] = static_cast<std::uint32_t>(i) * 2654435761u + 1u;
+        Destination.fill(Untouched);
+        Record = {item.count, item.period, 0, 0};
+        const auto taken = Taken();
+        const auto words = Commands(item.groups);
+        Packet packet{const_cast<std::uint32_t*>(words.data()), static_cast<std::uint32_t>(words.size()), 0, {}};
+        AgcDriver::Submit(&packet, 0);
+        AgcDriverWaitIdle_nid_postfix();
+        AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(Destination.data()), sizeof(Destination));
+        const std::string where = std::string(" (") + item.name + ")";
+        Require(Taken() - taken == (hle ? 1u : 0u), (hle ? "the copy did not take the HLE path" : "the copy took the HLE path") + where);
+        for (std::size_t i = 0; i < Destination.size(); ++i) {
+            const auto expected = i < item.count ? Source[i % item.period] : Untouched;
+            Require(Destination[i] == expected, "copy mismatch at element " + std::to_string(i) + where + ": got " + std::to_string(Destination[i]) + ", expected " + std::to_string(expected));
+        }
+    }
+}
+
+}
+
+int main() {
+    try {
+        {
+            const auto device = OpenVulkanTestDevice();
+            if (!device) return VulkanTestSkipped;
+        }
+        ExecuteTests();
+        AgcDriverShutdown_nid_postfix();
+        std::puts("period copy tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        AgcDriverShutdown_nid_postfix();
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp
index 16d3742761..403380ca02 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineJournal.cpp
@@ -11,6 +11,7 @@
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
+#include "ShaderCacheDirectory.hpp"
 #include "../NarrowConstantStoreFixture.hpp"
 #include "Recompiler.hpp"
 #include "Optimization/ResourceProgram.hpp"
@@ -31,6 +32,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <filesystem>
+#include <fstream>
 #include <iostream>
 #include <random>
 #include <span>
@@ -149,7 +151,7 @@ AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block) {
     return color;
 }
 
-void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode) {
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::span<const std::uint32_t> pixelCode, std::uint32_t colorWriteMask = 0xf) {
     const auto target = device.Target();
     constexpr std::uint32_t waveSize = 64;
     std::vector<std::uint32_t> vertexUserData(4, 0u);
@@ -180,7 +182,7 @@ void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarge
     state.cullMode = VK_CULL_MODE_NONE;
     state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
     VkPipelineColorBlendAttachmentState blend{};
-    blend.colorWriteMask = 0xf;
+    blend.colorWriteMask = colorWriteMask;
     state.blends = {blend};
     state.blend = blend;
     state.blendConstants = {};
@@ -344,6 +346,36 @@ void JournalTests() {
     }
 }
 
+void HeldModuleTests() {
+    using namespace NarrowConstantStoreFixture;
+    constexpr std::uint32_t programs = 16;
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    std::vector<std::vector<std::uint32_t>> codes;
+    for (std::uint32_t salt = 1; salt <= programs; ++salt) codes.push_back(ComputeCode(salt));
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "no device to record the compute programs");
+        device->WaitForPipelineJournalReplay();
+        std::vector<ShaderRecompiler::RecompileResult> results;
+        for (const auto& code : codes) results.push_back(CompileCompute(*device, code, words, 32));
+        for (std::size_t index = 0; index < results.size(); ++index) device->Dispatch(results[index], 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(codes[index].data()));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    SetEnvironment("APS5_PIPELINE_JOURNAL_THREADS", "1");
+    const auto before = Snapshot();
+    const auto device = OpenVulkanTestDevice();
+    Require(device != nullptr, "no device to replay the compute programs");
+    device->WaitForPipelineJournalReplay();
+    const auto replayed = Snapshot();
+    SetEnvironment("APS5_PIPELINE_JOURNAL_THREADS", "2");
+    Require(replayed.journal.loadedRecipes == programs + 2 && replayed.journal.loadedModules == programs + 3 && replayed.journal.droppedRecords == 0, "the journal does not hold the 16 compute programs beside the first two pipelines");
+    Require(replayed.journal.replayedCompute - before.journal.replayedCompute == programs + 1 && replayed.journal.replayedGraphics - before.journal.replayedGraphics == 1 && replayed.journal.replayRejected == before.journal.replayRejected && replayed.journal.replayFailed == before.journal.replayFailed, "the one-thread replay did not build every recorded pipeline");
+    const auto held = replayed.journal.replayHeldPeakBytes;
+    Require(held > 0 && held * 4 < replayed.journal.loadedBytes, "the one-thread replay held " + std::to_string(held) + " bytes of modules at once from a " + std::to_string(replayed.journal.loadedBytes) + "-byte journal");
+}
+
 // --benchmark [count]: `count` distinct compute programs, dispatched for the first time on three
 // devices in turn. The first device starts without the driver's pipeline cache file (a driver with
 // an on-disk shader cache of its own, lavapipe's Mesa cache here, still serves from it unless that
@@ -395,6 +427,272 @@ void Benchmark(std::uint32_t count) {
     std::printf("  warm driver cache, journal:     %llu pipelines built by the replay in %.1f ms of replay work (%.1f ms from the device opening), then %llu built at their dispatches, %u dispatches in %.1f ms (%.2f ms each)\n", static_cast<unsigned long long>(replayed.journal.replayedCompute), replayed.journal.replayMs, replayed.openMs, static_cast<unsigned long long>(replayed.created), count, replayed.dispatchMs, replayed.dispatchMs / count);
 }
 
+struct JournalRecordHeader {
+    std::uint32_t kind;
+    std::uint32_t reserved;
+    std::uint64_t payloadBytes;
+    std::uint64_t payloadHash;
+};
+static_assert(sizeof(JournalRecordHeader) == 24);
+
+constexpr std::uint32_t JournalModuleRecord = 1u;
+constexpr std::uint32_t JournalComputeRecord = 3u;
+constexpr std::uint32_t JournalHeaderBytes = 32u;
+
+void AppendJournalRecord(std::vector<std::byte>& file, std::uint32_t kind, const std::vector<std::byte>& payload) {
+    const JournalRecordHeader header{kind, 0u, payload.size(), ShaderRecompiler::HashBytes(payload)};
+    const auto offset = file.size();
+    file.resize(offset + sizeof(header) + payload.size());
+    std::memcpy(file.data() + offset, &header, sizeof(header));
+    std::memcpy(file.data() + offset + sizeof(header), payload.data(), payload.size());
+    while ((file.size() - offset - sizeof(header)) % 8u != 0) file.push_back(std::byte{0});
+}
+
+std::vector<ShaderRecompiler::PipelineIdentity> ReadJournalComputeIdentities(const std::filesystem::path& path) {
+    std::vector<std::byte> file;
+    std::ifstream input(path, std::ios::binary);
+    const std::vector<char> bytes((std::istreambuf_iterator<char>(input)), std::istreambuf_iterator<char>());
+    file.reserve(bytes.size());
+    for (const auto byte : bytes) file.push_back(static_cast<std::byte>(byte));
+    std::vector<ShaderRecompiler::PipelineIdentity> identities;
+    std::size_t cursor = JournalHeaderBytes;
+    while (cursor + sizeof(JournalRecordHeader) <= file.size()) {
+        JournalRecordHeader header{};
+        std::memcpy(&header, file.data() + cursor, sizeof(header));
+        const auto payload = cursor + sizeof(header);
+        if (header.payloadBytes > file.size() - payload) break;
+        if (header.kind == JournalComputeRecord && header.payloadBytes >= 17u) {
+            ShaderRecompiler::PipelineIdentity identity;
+            std::memcpy(&identity.low, file.data() + payload, sizeof(identity.low));
+            std::memcpy(&identity.high, file.data() + payload + 8, sizeof(identity.high));
+            identities.push_back(identity);
+        }
+        cursor = payload + header.payloadBytes;
+        while (cursor % 8u != 0) ++cursor;
+    }
+    return identities;
+}
+
+void NewestEntriesTests() {
+    using namespace NarrowConstantStoreFixture;
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    const auto recorded = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the newest entries test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        for (std::uint32_t salt = 1; salt <= 3; ++salt) {
+            const auto code = ComputeCode(salt);
+            const auto result = CompileCompute(*device, code, words, 32);
+            device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+        }
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+        const auto after = Snapshot();
+        Require(after.journal.recordedCompute == recorded.journal.recordedCompute + 3, "the three compute pipelines were not recorded");
+    }
+    SetEnvironment("APS5_PIPELINE_JOURNAL_ENTRIES", "2");
+    const auto before = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the newest entries replay could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto replayed = Snapshot();
+        Require(replayed.journal.replayedCompute == before.journal.replayedCompute + 2, "the replay did not build the two newest entries: built " + std::to_string(replayed.journal.replayedCompute - before.journal.replayedCompute) + " compute and " + std::to_string(replayed.journal.replayedGraphics - before.journal.replayedGraphics) + " graphics, " + std::to_string(replayed.journal.replayRejected - before.journal.replayRejected) + " rejected, " + std::to_string(replayed.journal.replayPresent - before.journal.replayPresent) + " present, " + std::to_string(replayed.journal.replaySkipped - before.journal.replaySkipped) + " skipped");
+        Require(replayed.journal.replayedGraphics == before.journal.replayedGraphics, "the replay built an entry that is not among the newest");
+        const auto created = device->ComputePipelinesCreated();
+        const auto newest = ComputeCode(3);
+        const auto result = CompileCompute(*device, newest, words, 32);
+        device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(newest.data()));
+        device->WaitIdle();
+        Require(device->ComputePipelinesCreated() == created, "the newest pipeline was not built by the replay");
+        const auto oldest = ComputeCode(0);
+        const auto old = CompileCompute(*device, oldest, words, 32);
+        device->Dispatch(old, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(oldest.data()));
+        device->WaitIdle();
+        Require(device->ComputePipelinesCreated() == created + 1, "the oldest pipeline was built by the replay");
+    }
+    SetEnvironment("APS5_PIPELINE_JOURNAL_ENTRIES", "1024");
+}
+
+void EvictionTests() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    AgcDriver::Graphics::FlushPipelineJournal();
+    constexpr std::size_t Modules = 24;
+    constexpr std::size_t ModuleBytes = 64u * 1024u;
+    std::vector<std::byte> file;
+    for (std::size_t index = 0; index < Modules; ++index) {
+        std::vector<std::byte> module(20u + ModuleBytes, std::byte{0x5a});
+        const std::uint64_t low = index + 1u;
+        const std::uint64_t high = 0u;
+        std::memcpy(module.data(), &low, sizeof(low));
+        std::memcpy(module.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalModuleRecord, module);
+        std::vector<std::byte> compute(17u, std::byte{0});
+        std::memcpy(compute.data(), &low, sizeof(low));
+        std::memcpy(compute.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalComputeRecord, compute);
+    }
+    {
+        std::ofstream out(path, std::ios::binary | std::ios::app);
+        Require(static_cast<bool>(out), "the synthetic journal records could not be written");
+        out.write(reinterpret_cast<const char*>(file.data()), static_cast<std::streamsize>(file.size()));
+        out.flush();
+        Require(!out.fail(), "the synthetic journal records could not be written");
+    }
+    Require(std::filesystem::file_size(path) > 1024u * 1024u, "the journal is smaller than the cap");
+    const auto before = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the eviction test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        Block compute(BlockBytes);
+        Block target(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 2).Bytes());
+        const auto words = AddressWords(compute);
+        const auto code = ComputeCode(7);
+        const auto result = CompileCompute(*device, code, words, 32);
+        device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+        device->WaitIdle();
+        std::memset(target.data, 0, target.bytes);
+        Draw(*device, DecodeTarget(target), Program(std::array<float, 4>{1.0f, 0.0f, 0.0f, 1.0f}));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto after = Snapshot();
+    Require(after.journal.evictedRecords > before.journal.evictedRecords, "the journal was not rewritten when it reached its cap: " + std::to_string(after.journal.evictedRecords) + " records evicted, " + std::to_string(after.journal.writeFailures - before.journal.writeFailures) + " write failures");
+    const auto size = std::filesystem::file_size(path);
+    Require(size <= 1024u * 1024u + 64u * 1024u, "the rewritten journal is larger than the cap");
+    const auto identities = ReadJournalComputeIdentities(path);
+    Require(!identities.empty(), "the rewritten journal holds no compute pipeline");
+    bool newest = false;
+    for (const auto& identity : identities) {
+        if (identity.low == Modules) newest = true;
+        Require(identity.low != 1u, "the oldest pipeline survived the rewrite");
+    }
+    Require(newest, "the newest pipeline did not survive the rewrite");
+}
+
+void EvictionWatermarkTests() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    const auto before = Snapshot();
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the eviction watermark test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        for (std::uint32_t salt = 8; salt <= 10; ++salt) {
+            auto result = CompileCompute(*device, ComputeCode(salt), words, 32);
+            result.shaderDataUserWords.assign(16u * 1024u, salt);
+            AgcDriver::Graphics::RecordComputePipeline(result, true);
+        }
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto after = Snapshot();
+    Require(after.journal.recordedCompute == before.journal.recordedCompute + 3, "the records after the rewrite were not recorded");
+    Require(after.journal.writeFailures == before.journal.writeFailures, "the records after the rewrite failed to write");
+    Require(after.journal.evictedRecords == before.journal.evictedRecords, "three consecutive records after a rewrite triggered another rewrite");
+    Require(std::filesystem::file_size(path) <= 1024u * 1024u, "the journal exceeded its cap after the consecutive records");
+}
+
+void EvictionKeepsPendingModules() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    Block target(ColorTargetLayout(Width, Height, ColorTileMode::Linear, 2).Bytes());
+    const auto color = DecodeTarget(target);
+    const std::array<float, 4> red{1.0f, 0.0f, 0.0f, 1.0f};
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the pending module test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        std::memset(target.data, 0, target.bytes);
+        Draw(*device, color, Program(red));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    constexpr std::size_t FillerBytes = 600u * 1024u;
+    {
+        std::vector<std::byte> file;
+        std::vector<std::byte> module(20u + FillerBytes, std::byte{0x5a});
+        const std::uint64_t low = 0x5a5au;
+        const std::uint64_t high = 0u;
+        std::memcpy(module.data(), &low, sizeof(low));
+        std::memcpy(module.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalModuleRecord, module);
+        std::vector<std::byte> compute(17u + FillerBytes, std::byte{0});
+        std::memcpy(compute.data(), &low, sizeof(low));
+        std::memcpy(compute.data() + 8, &high, sizeof(high));
+        AppendJournalRecord(file, JournalComputeRecord, compute);
+        std::ofstream out(path, std::ios::binary | std::ios::app);
+        Require(static_cast<bool>(out), "the filler records could not be written");
+        out.write(reinterpret_cast<const char*>(file.data()), static_cast<std::streamsize>(file.size()));
+        out.flush();
+        Require(!out.fail(), "the filler records could not be written");
+    }
+    Require(std::filesystem::file_size(path) > 1024u * 1024u, "the journal is smaller than the cap");
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the pending module test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        std::memset(target.data, 0, target.bytes);
+        Draw(*device, color, Program(red), 0x7);
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto before = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the pending module replay could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto replayed = Snapshot();
+        Require(replayed.journal.replayedGraphics == before.journal.replayedGraphics + 1, "the record written after the eviction was not replayed: " + std::to_string(replayed.journal.replayedGraphics - before.journal.replayedGraphics) + " graphics built, " + std::to_string(replayed.journal.replayRejected - before.journal.replayRejected) + " rejected");
+        Require(replayed.journal.replayRejected == before.journal.replayRejected, "the record written after the eviction was rejected: the eviction dropped a module it needed");
+    }
+}
+
+void OversizedRecordKeepsTheJournal() {
+    using namespace NarrowConstantStoreFixture;
+    const auto path = AgcDriver::Graphics::PipelineJournalPath();
+    Block compute(BlockBytes);
+    const auto words = AddressWords(compute);
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the oversized record test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto code = ComputeCode(0);
+        const auto result = CompileCompute(*device, code, words, 32);
+        device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+        device->WaitIdle();
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto before = Snapshot();
+    const auto sizeBefore = std::filesystem::file_size(path);
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the oversized record test could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto code = ComputeCode(2);
+        auto result = CompileCompute(*device, code, words, 32);
+        result.shaderDataUserWords.assign(400000u, 0u);
+        AgcDriver::Graphics::RecordComputePipeline(result, false);
+        AgcDriver::Graphics::FlushPipelineJournal();
+    }
+    const auto after = Snapshot();
+    Require(after.journal.writeFailures == before.journal.writeFailures + 1, "the oversized record was not counted as a write failure");
+    Require(std::filesystem::file_size(path) == sizeBefore, "the oversized record emptied the journal: " + std::to_string(sizeBefore) + " bytes became " + std::to_string(std::filesystem::file_size(path)));
+    const auto before2 = Snapshot();
+    {
+        const auto device = OpenVulkanTestDevice();
+        Require(device != nullptr, "the device for the oversized record replay could not be opened");
+        device->WaitForPipelineJournalReplay();
+        const auto replayed = Snapshot();
+        Require(replayed.journal.replayedCompute == before2.journal.replayedCompute + 1, "the record that was in the journal did not survive the oversized one");
+    }
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -406,6 +704,7 @@ int main(int argc, char** argv) {
         SetEnvironment("APS5_NO_PIPELINE_JOURNAL", "0");
         SetEnvironment("APS5_VERIFY_SET_LAYOUTS", "1");
         SetEnvironment("APS5_PIPELINE_JOURNAL_THREADS", "2");
+        SetEnvironment("APS5_PIPELINE_JOURNAL_MAX_MIB", "1");
         struct Cleanup {
             std::filesystem::path directory;
             ~Cleanup() {
@@ -422,6 +721,12 @@ int main(int argc, char** argv) {
             return 0;
         }
         JournalTests();
+        NewestEntriesTests();
+        EvictionTests();
+        EvictionWatermarkTests();
+        EvictionKeepsPendingModules();
+        OversizedRecordKeepsTheJournal();
+        HeldModuleTests();
         std::puts("pipeline journal record and replay passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedFill.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedFill.cpp
index 1c13bc169d..c501698a57 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedFill.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedFill.cpp
@@ -11,6 +11,7 @@
 #include <cstdlib>
 #include <future>
 #include <iostream>
+#include <memory>
 #include <mutex>
 #include <string>
 #include <thread>
@@ -75,16 +76,29 @@ void AppendLabel(std::vector<std::uint32_t>& words, std::uint32_t* target, std::
 }
 
 struct Blocker {
-    std::atomic<bool> release{false};
+    struct State {
+        std::atomic<bool> release{false};
+        std::atomic<bool> done{false};
+    };
+    std::shared_ptr<State> state = std::make_shared<State>();
     std::uint32_t* target = nullptr;
-    ~Blocker() { release = true; }
+    ~Blocker() { Release(); }
+    void Release() { state->release = true; }
     void Enqueue(std::vector<DrawPipeline::Range> writes = {}) {
-        DrawPipeline::Queue0().Enqueue([this] {
-            while (!release.load()) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        DrawPipeline::Queue0().Enqueue([state = state, target = target] {
+            while (!state->release.load()) std::this_thread::sleep_for(std::chrono::milliseconds(1));
             if (target != nullptr) std::atomic_ref<std::uint32_t>(*target).store(1);
-            std::lock_guard gpuLock(AgcDriver::GuestMemory::GpuMutex());
+            { std::lock_guard gpuLock(AgcDriver::GuestMemory::GpuMutex()); }
+            state->done = true;
         }, std::move(writes));
     }
+    void Join() const {
+        const auto start = std::chrono::steady_clock::now();
+        while (!state->done.load()) {
+            Require(std::chrono::steady_clock::now() - start < std::chrono::seconds(20), "the blocker never ran");
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        }
+    }
 };
 
 void SubmitBehind(Blocker& blocker, std::vector<std::uint32_t>& words) {
@@ -107,7 +121,7 @@ void ReleaseWhen(Blocker& blocker, std::size_t reached, std::size_t passed) {
         Require(now - start < std::chrono::seconds(20), "the queue worker never reached the fill");
         std::this_thread::sleep_for(std::chrono::milliseconds(1));
     }
-    blocker.release = true;
+    blocker.Release();
 }
 
 void Finish() {
@@ -118,6 +132,11 @@ void Finish() {
         std::_Exit(1);
     }
     idle.get();
+    const auto start = std::chrono::steady_clock::now();
+    while (DrawPipeline::Queue0().Outstanding() != 0) {
+        Require(std::chrono::steady_clock::now() - start < std::chrono::seconds(20), "the draw pipeline kept an item after the queue went idle");
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
     AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(Output.data()), sizeof(Output));
     AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(Scratch.data()), sizeof(Scratch));
 }
@@ -135,6 +154,7 @@ void InputsAfterQueuedLabels() {
     SubmitBehind(blocker, words);
     ReleaseWhen(blocker, 4, 5);
     Finish();
+    blocker.Join();
     for (std::size_t i = 0; i < Output.size(); ++i) {
         const auto expected = i < 128 ? 0xababababu : 0xcafebabeu;
         Require(Output[i] == expected, "a fill read its control or pattern before the queued labels that write them, at " + std::to_string(i));
@@ -156,6 +176,7 @@ void FillIntoFullPipeline() {
     SubmitBehind(blocker, words);
     ReleaseWhen(blocker, depth, depth + 1);
     Finish();
+    blocker.Join();
     for (std::size_t i = 0; i + 2 < depth; ++i) Require(Labels[i] == i + 1, "a queued label was not stored");
     for (std::size_t i = 0; i < Output.size(); ++i) Require(Output[i] == (i < 256 ? 0x5a5a5a5au : 0xcafebabeu), "a fill behind a full draw pipeline did not land at " + std::to_string(i));
 }
@@ -180,8 +201,9 @@ void SatisfiedWaitKeepsUnrelatedQueuedWork() {
     while (DrawPipeline::Queue0().Outstanding() < 2 && std::chrono::steady_clock::now() < deadline)
         std::this_thread::sleep_for(std::chrono::milliseconds(1));
     const bool keptQueued = DrawPipeline::Queue0().Outstanding() >= 2;
-    blocker.release = true;
+    blocker.Release();
     Finish();
+    blocker.Join();
     Require(keptQueued, "a satisfied WAIT_REG_MEM drained unrelated queued work");
     Require(marker == 1, "a label after a satisfied WAIT_REG_MEM did not execute");
 }
@@ -211,11 +233,12 @@ void SatisfiedWaitDrainsOverlappingQueuedWork() {
         std::this_thread::sleep_for(std::chrono::milliseconds(1));
     const bool drained = DrawPipeline::DrainRequestsByOpcode(0x3c) > drainsBefore;
     const bool labelQueuedEarly = DrawPipeline::Queue0().Outstanding() >= 2;
-    blocker.release = true;
+    blocker.Release();
     Require(submitted.wait_for(std::chrono::seconds(20)) == std::future_status::ready,
             "WAIT_REG_MEM submission did not finish after the overlapping write");
     submitted.get();
     Finish();
+    blocker.Join();
     Require(drained && !labelQueuedEarly, "a satisfied WAIT_REG_MEM skipped an overlapping queued write");
     Require(marker == 1, "a label after an overlapping WAIT_REG_MEM did not execute");
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp
new file mode 100644
index 0000000000..7fa9eb1f07
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelinedMetadataPass.cpp
@@ -0,0 +1,173 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ColorTargetLayout.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/Shutdown.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <thread>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <mutex>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+
+namespace {
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 4;
+constexpr std::uint32_t Stale = 0x5a5a5a5au;
+constexpr std::uint32_t Clear = 0x11223344u;
+
+constexpr std::size_t MemoryBytes = 65536;
+
+std::byte* allocateMemory() {
+#ifdef _WIN32
+    auto* memory = static_cast<std::byte*>(VirtualAlloc(nullptr, MemoryBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+    auto* memory = static_cast<std::byte*>(std::aligned_alloc(MemoryBytes, MemoryBytes));
+#endif
+    if (memory == nullptr) throw std::runtime_error("pipelined metadata pass: cannot allocate the surface memory");
+    std::memset(memory, 0, MemoryBytes);
+    return memory;
+}
+
+std::byte* const Memory = allocateMemory();
+const std::span<std::uint32_t, Width * Height> Surface{reinterpret_cast<std::uint32_t*>(Memory), Width * Height};
+const std::span<std::uint8_t, 4096> Cmask{reinterpret_cast<std::uint8_t*>(Memory + 4096), 4096};
+
+void check(bool condition, const std::string& what) {
+    if (!condition) throw std::runtime_error("pipelined metadata pass: " + what);
+}
+
+void setContext(std::vector<std::uint32_t>& words, std::uint32_t offset, std::uint32_t value) {
+    words.insert(words.end(), {0xc0016900u, offset, value});
+}
+
+void dmaFill(std::vector<std::uint32_t>& words, std::uint32_t data, const void* destination, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(destination);
+    words.insert(words.end(), {0xc0055000u, 2u << 29u, data, 0u, static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u), bytes});
+}
+
+void eliminate(std::vector<std::uint32_t>& words) {
+    const auto surface = reinterpret_cast<std::uintptr_t>(Surface.data());
+    const auto cmask = reinterpret_cast<std::uintptr_t>(Cmask.data());
+    words.insert(words.end(), {0xc0017900u, 0x242u, 4u});
+    words.insert(words.end(), {0xc0017600u, 0x008u, 0x100u, 0xc0017600u, 0x009u, 0u});
+    const std::vector<std::pair<std::uint32_t, std::uint32_t>> context{
+        {0x2d5, 0x2000}, {0x1b6, 0}, {0x1b8, 0}, {0x207, 0}, {0x200, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0020},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028u | 0x2000u},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000u | (0x18u << 19u) | 0x4000000u}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x318, static_cast<std::uint32_t>(surface >> 8u)}, {0x390, static_cast<std::uint32_t>(surface >> 40u)},
+        {0x31f, static_cast<std::uint32_t>(cmask >> 8u)}, {0x398, static_cast<std::uint32_t>(cmask >> 40u)},
+        {0x323, Clear}, {0x324, 0},
+        {0x0, 0}, {0xb4, 0},
+        {0x10f, std::bit_cast<std::uint32_t>(32.0f)}, {0x110, std::bit_cast<std::uint32_t>(32.0f)},
+        {0x111, std::bit_cast<std::uint32_t>(-2.0f)}, {0x112, std::bit_cast<std::uint32_t>(2.0f)},
+        {0x113, std::bit_cast<std::uint32_t>(1.0f)}, {0x114, 0}, {0xb5, std::bit_cast<std::uint32_t>(1.0f)},
+    };
+    for (const auto& [offset, value] : context) setContext(words, offset, value);
+    words.insert(words.end(), {0xc0002f00u, 1u});
+    words.insert(words.end(), {0xc0012d00u, 3u, 2u});
+}
+
+void submit(std::vector<std::uint32_t>& words) {
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    check(sceAgcDriverSubmitDcb(&packet) == 0, "submission failed");
+    AgcDriverWaitIdle_nid_postfix();
+}
+
+void expectEliminated(const std::string& what) {
+    {
+        std::lock_guard lock(AgcDriver::GuestMemory::GpuMutex());
+        AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(Surface.data()), Surface.size_bytes(), nullptr, "test");
+    }
+    for (std::size_t i = 0; i < Surface.size(); ++i) check(Surface[i] == Clear, what + ": texel " + std::to_string(i) + " holds " + std::to_string(Surface[i]));
+    const auto cmaskBytes = AgcDriver::Graphics::CmaskLayout(Width, Height).Bytes();
+    for (std::size_t i = 0; i < cmaskBytes; ++i) check(Cmask[i] == 0xffu, what + ": the CMASK was not left expanded");
+}
+
+}
+
+int main() {
+#ifdef _WIN32
+    _putenv_s("APS5_PIPELINED_DRAWS", "1");
+    _putenv_s("APS5_PIPELINE_DMA", "1");
+    _putenv_s("APS5_DRAW_PIPELINE", "1");
+#else
+    setenv("APS5_PIPELINED_DRAWS", "1", 1);
+    setenv("APS5_PIPELINE_DMA", "1", 1);
+    setenv("APS5_DRAW_PIPELINE", "1", 1);
+#endif
+    try {
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Add(Surface.data(), Surface.size_bytes(), true, true, true);
+            mutation.Add(Cmask.data(), Cmask.size(), true, true, true);
+        }
+        using AgcDriver::DriverDetail::DrawPipeline;
+        std::fill(Surface.begin(), Surface.end(), Stale);
+        std::fill(Cmask.begin(), Cmask.end(), std::uint8_t{0});
+        std::vector<std::uint32_t> first;
+        eliminate(first);
+        submit(first);
+        expectEliminated("the first eliminate");
+        const auto before = DrawPipeline::PipelinedMetadataPasses();
+        std::vector<std::uint32_t> second;
+        std::atomic<bool> release{false};
+        DrawPipeline::Queue0().Enqueue([&release] {
+            while (!release.load(std::memory_order_acquire)) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        }, {});
+        std::thread releaser([&release] {
+            std::this_thread::sleep_for(std::chrono::milliseconds(300));
+            release.store(true, std::memory_order_release);
+        });
+        dmaFill(second, Stale, Surface.data(), static_cast<std::uint32_t>(Surface.size_bytes()));
+        dmaFill(second, 0, Cmask.data(), static_cast<std::uint32_t>(Cmask.size()));
+        eliminate(second);
+        submit(second);
+        releaser.join();
+        check(DrawPipeline::PipelinedMetadataPasses() == before + 1u, "the second eliminate was not ordered with the commits (" + std::to_string(DrawPipeline::PipelinedMetadataPasses() - before) + " pipelined)");
+        expectEliminated("the eliminate after the queued stores");
+        {
+            GuestAllocations::Mutation mutation;
+            mutation.Remove(Surface.data());
+            mutation.Remove(Cmask.data());
+        }
+        LibcRunShutdown_nid_postfix();
+        std::puts("pipelined metadata pass tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try { LibcRunShutdown_nid_postfix(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp
index f9813bbe14..6eb4c60d13 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelBarycentricEmulation.cpp
@@ -49,11 +49,31 @@ struct Vertex {
     float w;
 };
 
-constexpr std::array<Vertex, 3> Corners{{{-0.8f, -0.8f, 1.0f}, {0.9f, -0.6f, 2.5f}, {-0.5f, 0.85f, 0.5f}}};
+constexpr std::array<Vertex, 3> TriangleCorners{{{-0.8f, -0.8f, 1.0f}, {0.9f, -0.6f, 2.5f}, {-0.5f, 0.85f, 0.5f}}};
+constexpr std::array<Vertex, 3> RectangleCorners{{{-0.8f, -0.8f, 1.5f}, {0.7f, -0.8f, 1.5f}, {-0.8f, 0.6f, 1.5f}}};
 
-std::array<std::array<float, 4>, 3> ClipPositions() {
+enum class Emulation {
+    Geometry,
+    Tessellation,
+    RectList,
+};
+
+const std::array<Vertex, 3>& Corners(Emulation emulation) {
+    return emulation == Emulation::RectList ? RectangleCorners : TriangleCorners;
+}
+
+std::array<std::array<float, 4>, 3> ClipPositions(Emulation emulation) {
+    const auto& corners = Corners(emulation);
     std::array<std::array<float, 4>, 3> positions{};
-    for (std::size_t i = 0; i < Corners.size(); ++i) positions[i] = {Corners[i].x * Corners[i].w, Corners[i].y * Corners[i].w, 0.5f * Corners[i].w, Corners[i].w};
+    for (std::size_t i = 0; i < corners.size(); ++i) positions[i] = {corners[i].x * corners[i].w, corners[i].y * corners[i].w, 0.5f * corners[i].w, corners[i].w};
+    return positions;
+}
+
+constexpr std::array<Vertex, 4> StripCorners{{{-0.8f, -0.8f, 1.0f}, {0.8f, -0.8f, 1.0f}, {-0.8f, 0.8f, 1.0f}, {0.8f, 0.8f, 1.0f}}};
+
+std::array<std::array<float, 4>, 4> StripPositions() {
+    std::array<std::array<float, 4>, 4> positions{};
+    for (std::size_t i = 0; i < StripCorners.size(); ++i) positions[i] = {StripCorners[i].x, StripCorners[i].y, 0.5f, 1.0f};
     return positions;
 }
 
@@ -62,16 +82,14 @@ std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t st
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
 }
 
-enum class Emulation {
-    Geometry,
-    Tessellation,
-};
-
-ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulation emulation, std::span<const std::uint32_t> pixelCode, std::uint32_t inputs, VkCullModeFlags cullMode = VK_CULL_MODE_NONE, bool flat = false, VkProvokingVertexModeEXT provoking = VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT) {
+ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulation emulation, std::span<const std::uint32_t> pixelCode, std::uint32_t inputs, VkCullModeFlags cullMode = VK_CULL_MODE_NONE, bool flat = false, VkProvokingVertexModeEXT provoking = VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT, bool strip = false) {
     Pixels.fill(Unwritten);
     auto target = device.Target();
     target.fragmentShaderBarycentricEnabled = false;
-    static const auto positions = ClipPositions();
+    static const auto trianglePositions = ClipPositions(Emulation::Geometry);
+    static const auto rectanglePositions = ClipPositions(Emulation::RectList);
+    static const auto stripPositions = StripPositions();
+    const auto positions = strip ? std::span<const std::array<float, 4>>(stripPositions) : std::span<const std::array<float, 4>>(emulation == Emulation::RectList ? rectanglePositions : trianglePositions);
 
     std::vector<std::uint32_t> vertexUserData(4, 0u);
     const auto vertexBuffer = BufferDescriptor(positions.data(), 16u, static_cast<std::uint32_t>(positions.size()));
@@ -109,7 +127,12 @@ ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulatio
     std::vector<AgcDriver::Graphics::CompiledShader> shaders{{ShaderStage::Vertex, &vertexResult, 0}};
     ShaderRecompiler::RecompileResult geometry;
     ShaderRecompiler::BarycentricTessellationShaders patches;
-    if (pixelResult.barycentricEmulation.active && emulation == Emulation::Geometry) {
+    ShaderRecompiler::RectListShaders rectangle;
+    if (emulation == Emulation::RectList) {
+        rectangle = ShaderRecompiler::BuildRectListShaders(vertexResult, pixelResult, target);
+        shaders.push_back({ShaderStage::TessellationControl, &rectangle.control, 0});
+        shaders.push_back({ShaderStage::TessellationEvaluation, &rectangle.evaluation, 0});
+    } else if (pixelResult.barycentricEmulation.active && emulation == Emulation::Geometry) {
         geometry = ShaderRecompiler::BuildBarycentricGeometryShader(vertexResult, pixelResult, target, device.GeometryLimits());
         shaders.push_back({ShaderStage::Geometry, &geometry, 0});
     } else if (pixelResult.barycentricEmulation.active) {
@@ -125,7 +148,8 @@ ShaderRecompiler::RecompileResult Draw(AgcDriver::VulkanDevice& device, Emulatio
     state.colors = {state.color};
     state.hasColorTarget = true;
     state.renderExtent = {Width, Height};
-    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.topology = strip ? VK_PRIMITIVE_TOPOLOGY_TRIANGLE_STRIP : emulation == Emulation::RectList ? VK_PRIMITIVE_TOPOLOGY_PATCH_LIST : VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.rectList = emulation == Emulation::RectList;
     state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
     state.negativeOneToOne = false;
     state.scissor = {{0, 0}, {Width, Height}};
@@ -147,9 +171,10 @@ struct Expected {
     std::array<float, 3> perspective;
 };
 
-Expected Barycentrics(std::uint32_t x, std::uint32_t y, bool snapped) {
+Expected Barycentrics(Emulation emulation, std::uint32_t x, std::uint32_t y, bool snapped) {
+    const auto& corners = Corners(emulation);
     std::array<std::array<double, 2>, 3> window{};
-    for (std::size_t i = 0; i < Corners.size(); ++i) window[i] = {(Corners[i].x + 1.0) * Width / 2.0, (1.0 - Corners[i].y) * Height / 2.0};
+    for (std::size_t i = 0; i < corners.size(); ++i) window[i] = {(corners[i].x + 1.0) * Width / 2.0, (1.0 - corners[i].y) * Height / 2.0};
     if (snapped) {
         for (auto& corner : window) {
             for (auto& coordinate : corner) coordinate = std::round(coordinate * 256.0) / 256.0;
@@ -160,22 +185,23 @@ Expected Barycentrics(std::uint32_t x, std::uint32_t y, bool snapped) {
     const auto edge = [](const std::array<double, 2>& a, const std::array<double, 2>& b, double cx, double cy) { return (b[0] - a[0]) * (cy - a[1]) - (b[1] - a[1]) * (cx - a[0]); };
     const double area = edge(window[0], window[1], window[2][0], window[2][1]);
     const std::array<double, 3> b{edge(window[1], window[2], px, py) / area, edge(window[2], window[0], px, py) / area, edge(window[0], window[1], px, py) / area};
-    Expected expected{std::min({b[0], b[1], b[2]}) > 0.02, {}, {}};
+    const bool inside = emulation == Emulation::RectList ? std::min(b[1], b[2]) > 0.02 && std::max(b[1], b[2]) < 0.98 : std::min({b[0], b[1], b[2]}) > 0.02;
+    Expected expected{inside, {}, {}};
     double sum = 0.0;
-    for (std::size_t i = 0; i < 3; ++i) sum += b[i] / Corners[i].w;
+    for (std::size_t i = 0; i < 3; ++i) sum += b[i] / corners[i].w;
     for (std::size_t i = 0; i < 3; ++i) {
         expected.linear[i] = static_cast<float>(b[i]);
-        expected.perspective[i] = static_cast<float>(b[i] / Corners[i].w / sum);
+        expected.perspective[i] = static_cast<float>(b[i] / corners[i].w / sum);
     }
     return expected;
 }
 
-Expected BarycentricsUnsnapped(std::uint32_t x, std::uint32_t y) {
-    return Barycentrics(x, y, false);
+Expected BarycentricsUnsnapped(Emulation emulation, std::uint32_t x, std::uint32_t y) {
+    return Barycentrics(emulation, x, y, false);
 }
 
-Expected BarycentricsSnapped(std::uint32_t x, std::uint32_t y) {
-    return Barycentrics(x, y, true);
+Expected BarycentricsSnapped(Emulation emulation, std::uint32_t x, std::uint32_t y) {
+    return Barycentrics(emulation, x, y, true);
 }
 
 bool MatchesEither(float value, float unsnapped, float snapped) {
@@ -186,13 +212,15 @@ float Pixel(std::uint32_t x, std::uint32_t y, std::uint32_t channel) {
     return Pixels[(y * Width + x) * 4u + channel];
 }
 
-std::uint32_t CheckBarycentrics(const std::string& what, bool perspective) {
+std::uint32_t CheckBarycentrics(Emulation emulation, const std::string& what, bool perspective) {
     std::uint32_t checked = 0;
+    std::uint32_t beyond = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            const auto expected = BarycentricsUnsnapped(x, y);
+            const auto expected = BarycentricsUnsnapped(emulation, x, y);
             if (!expected.inside) continue;
-            const auto snapped = BarycentricsSnapped(x, y);
+            const auto snapped = BarycentricsSnapped(emulation, x, y);
+            if (expected.linear[0] < -0.02f) ++beyond;
             const auto& weights = perspective ? expected.perspective : expected.linear;
             const auto& snappedWeights = perspective ? snapped.perspective : snapped.linear;
             for (std::uint32_t channel = 0; channel < 4; ++channel) {
@@ -205,17 +233,18 @@ std::uint32_t CheckBarycentrics(const std::string& what, bool perspective) {
         }
     }
     Require(checked > 200u, what + ": too few interior pixels were checked");
+    Require(emulation != Emulation::RectList || beyond > 200u, what + ": too few pixels past the rectangle's diagonal were checked");
     return checked;
 }
 
-void CheckVertexValues() {
-    const auto positions = ClipPositions();
+void CheckVertexValues(Emulation emulation) {
+    const auto positions = ClipPositions(emulation);
     const auto p0 = positions[0][0];
     const std::array<float, 3> expected{positions[1][0] - p0, positions[2][0] - p0, p0};
     std::uint32_t checked = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            if (!BarycentricsUnsnapped(x, y).inside) continue;
+            if (!BarycentricsUnsnapped(emulation, x, y).inside) continue;
             for (std::uint32_t channel = 0; channel < 3; ++channel) {
                 Require(Pixel(x, y, channel) == expected[channel], "v_interp_mov: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)) + ", expected " + std::to_string(expected[channel]));
             }
@@ -225,14 +254,14 @@ void CheckVertexValues() {
     Require(checked > 200u, "v_interp_mov: too few interior pixels were checked");
 }
 
-void CheckInterpolated() {
-    const auto positions = ClipPositions();
+void CheckInterpolated(Emulation emulation) {
+    const auto positions = ClipPositions(emulation);
     std::uint32_t checked = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            const auto expected = BarycentricsUnsnapped(x, y);
+            const auto expected = BarycentricsUnsnapped(emulation, x, y);
             if (!expected.inside) continue;
-            const auto snapped = BarycentricsSnapped(x, y);
+            const auto snapped = BarycentricsSnapped(emulation, x, y);
             float reference = 0.0f;
             float snappedReference = 0.0f;
             for (std::size_t i = 0; i < 3; ++i) {
@@ -249,13 +278,13 @@ void CheckInterpolated() {
 }
 
 void CheckFlat(const std::string& what, std::size_t provoking) {
-    const auto positions = ClipPositions();
+    const auto positions = ClipPositions(Emulation::Geometry);
     std::uint32_t checked = 0;
     for (std::uint32_t y = 0; y < Height; ++y) {
         for (std::uint32_t x = 0; x < Width; ++x) {
-            const auto expected = BarycentricsUnsnapped(x, y);
+            const auto expected = BarycentricsUnsnapped(Emulation::Geometry, x, y);
             if (!expected.inside) continue;
-            const auto snapped = BarycentricsSnapped(x, y);
+            const auto snapped = BarycentricsSnapped(Emulation::Geometry, x, y);
             for (std::uint32_t channel = 0; channel < 2; ++channel) {
                 Require(MatchesEither(Pixel(x, y, channel), expected.perspective[1u + channel], snapped.perspective[1u + channel]), what + ": pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") weight " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)));
             }
@@ -282,31 +311,116 @@ void CheckWinding(AgcDriver::VulkanDevice& device, Emulation emulation, const st
     }
 }
 
+struct StripPixel {
+    bool inside;
+    std::array<std::size_t, 3> order;
+    std::array<double, 3> weights;
+};
+
+StripPixel StripBarycentrics(std::uint32_t x, std::uint32_t y, bool snapped) {
+    std::array<std::array<double, 2>, 4> window{};
+    for (std::size_t i = 0; i < StripCorners.size(); ++i) {
+        window[i] = {(StripCorners[i].x + 1.0) * Width / 2.0, (1.0 - StripCorners[i].y) * Height / 2.0};
+        if (snapped) {
+            for (auto& coordinate : window[i]) coordinate = std::round(coordinate * 256.0) / 256.0;
+        }
+    }
+    const double px = x + 0.5;
+    const double py = y + 0.5;
+    const auto edge = [](const std::array<double, 2>& a, const std::array<double, 2>& b, double cx, double cy) { return (b[0] - a[0]) * (cy - a[1]) - (b[1] - a[1]) * (cx - a[0]); };
+    for (const std::array<std::size_t, 3> order : {std::array<std::size_t, 3>{0, 1, 2}, std::array<std::size_t, 3>{1, 3, 2}}) {
+        const auto& a = window[order[0]];
+        const auto& b = window[order[1]];
+        const auto& c = window[order[2]];
+        const double area = edge(a, b, c[0], c[1]);
+        const std::array<double, 3> weights{edge(b, c, px, py) / area, edge(c, a, px, py) / area, edge(a, b, px, py) / area};
+        if (std::min({weights[0], weights[1], weights[2]}) > 0.02) return {true, order, weights};
+    }
+    return {false, {}, {}};
+}
+
+void CheckStrip(AgcDriver::VulkanDevice& device, Emulation emulation, const std::string& name) {
+    Draw(device, emulation, BarycentricPixelCode, PixelInputBit(PixelInput::LinearCenter), VK_CULL_MODE_NONE, false, VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT, true);
+    std::array<std::uint32_t, 2> checked{};
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto expected = StripBarycentrics(x, y, false);
+            if (!expected.inside) continue;
+            const auto snapped = StripBarycentrics(x, y, true);
+            for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                const auto reference = static_cast<float>(expected.weights[1u + (channel & 1u)]);
+                const auto snappedReference = snapped.inside && snapped.order == expected.order ? static_cast<float>(snapped.weights[1u + (channel & 1u)]) : reference;
+                Require(MatchesEither(Pixel(x, y, channel), reference, snappedReference), name + " triangle strip: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)) + ", expected " + std::to_string(reference));
+            }
+            ++checked[expected.order[0]];
+        }
+    }
+    Require(checked[0] > 200u && checked[1] > 200u, name + " triangle strip: too few pixels of each triangle were checked");
+    static const auto positions = StripPositions();
+    Draw(device, emulation, VertexValuePixelCode, PixelInputBit(PixelInput::PerspectiveCenter), VK_CULL_MODE_NONE, false, VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT, true);
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto expected = StripBarycentrics(x, y, false);
+            if (!expected.inside) continue;
+            const auto first = positions[expected.order[0]][0];
+            const std::array<float, 3> values{positions[expected.order[1]][0] - first, positions[expected.order[2]][0] - first, first};
+            for (std::uint32_t channel = 0; channel < 3; ++channel) {
+                Require(Pixel(x, y, channel) == values[channel], name + " triangle strip v_interp_mov: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)) + ", expected " + std::to_string(values[channel]));
+            }
+        }
+    }
+    std::printf("barycentric emulation through the %s passed for a triangle strip: %u and %u pixels of its even and odd triangle\n", name.c_str(), checked[0], checked[1]);
+}
+
+void CheckStripFlatLast(AgcDriver::VulkanDevice& device, Emulation emulation, const std::string& name) {
+    Draw(device, emulation, FlatBarycentricPixelCode, PixelInputBit(PixelInput::PerspectiveCenter), VK_CULL_MODE_NONE, true, VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT, true);
+    const auto positions = StripPositions();
+    std::array<std::uint32_t, 2> checked{};
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto expected = StripBarycentrics(x, y, false);
+            if (!expected.inside) continue;
+            const auto triangle = expected.order[0];
+            const auto provoking = triangle == 0u ? 2u : 3u;
+            for (std::uint32_t channel = 2; channel < 4; ++channel) {
+                Require(Pixel(x, y, channel) == positions[provoking][0], name + " flat last-provoking strip: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") flat channel " + std::to_string(channel) + " is " + std::to_string(Pixel(x, y, channel)) + ", expected vertex " + std::to_string(provoking) + " value " + std::to_string(positions[provoking][0]));
+            }
+            ++checked[triangle];
+        }
+    }
+    Require(checked[0] > 200u && checked[1] > 200u, name + " flat last-provoking strip: too few pixels of each triangle were checked");
+    std::printf("flat last-provoking strip through %s passed: %u and %u pixels of its even and odd triangle\n", name.c_str(), checked[0], checked[1]);
+}
+
 void RunEmulation(AgcDriver::VulkanDevice& device, Emulation emulation) {
-    const std::string name = emulation == Emulation::Geometry ? "geometry stage" : "tessellation stages";
+    const std::string name = emulation == Emulation::Geometry ? "geometry stage" : emulation == Emulation::Tessellation ? "tessellation stages" : "rect-list stages";
     const auto perspective = PixelInputBit(PixelInput::PerspectiveCenter);
     const auto linear = PixelInputBit(PixelInput::LinearCenter);
     auto result = Draw(device, emulation, BarycentricPixelCode, perspective);
     Require(result.barycentricEmulation.active && result.barycentricEmulation.smooth && !result.barycentricEmulation.linear, "reading PERSP_CENTER I/J did not emulate perspective barycentrics");
-    const auto smooth = CheckBarycentrics(name + " PERSP_CENTER I/J", true);
+    const auto smooth = CheckBarycentrics(emulation, name + " PERSP_CENTER I/J", true);
     result = Draw(device, emulation, BarycentricPixelCode, linear);
     Require(result.barycentricEmulation.active && !result.barycentricEmulation.smooth && result.barycentricEmulation.linear, "reading LINEAR_CENTER I/J did not emulate linear barycentrics");
-    const auto noPerspective = CheckBarycentrics(name + " LINEAR_CENTER I/J", false);
+    const auto noPerspective = CheckBarycentrics(emulation, name + " LINEAR_CENTER I/J", false);
     result = Draw(device, emulation, VertexValuePixelCode, perspective);
     Require(result.barycentricEmulation.active && result.fragmentParameters.size() == 1 && result.fragmentParameters[0].perVertex, "v_interp_mov of P10 and P20 did not emulate per-vertex parameters");
-    CheckVertexValues();
+    CheckVertexValues(emulation);
     result = Draw(device, emulation, InterpolatedPixelCode, perspective);
     Require(!result.barycentricEmulation.active, "plain v_interp_p1/p2 needed a generated stage");
-    CheckInterpolated();
-    CheckWinding(device, emulation, name);
-    result = Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true);
-    Require(result.barycentricEmulation.active && std::any_of(result.fragmentParameters.begin(), result.fragmentParameters.end(), [](const auto& parameter) { return parameter.flat && !parameter.perVertex; }), "a flat P0 read beside raw I/J did not pass a flat parameter through the emulation");
-    CheckFlat(name + " flat input, first provoking vertex", 0u);
-    if (emulation == Emulation::Tessellation) {
-        Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true, VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT);
-        CheckFlat(name + " flat input, last provoking vertex", 2u);
+    CheckInterpolated(emulation);
+    if (emulation != Emulation::RectList) {
+        CheckWinding(device, emulation, name);
+        result = Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true);
+        Require(result.barycentricEmulation.active && std::any_of(result.fragmentParameters.begin(), result.fragmentParameters.end(), [](const auto& parameter) { return parameter.flat && !parameter.perVertex; }), "a flat P0 read beside raw I/J did not pass a flat parameter through the emulation");
+        CheckFlat(name + " flat input, first provoking vertex", 0u);
+        if (emulation == Emulation::Tessellation) {
+            Draw(device, emulation, FlatBarycentricPixelCode, perspective, VK_CULL_MODE_NONE, true, VK_PROVOKING_VERTEX_MODE_LAST_VERTEX_EXT);
+            CheckFlat(name + " flat input, last provoking vertex", 2u);
+            CheckStripFlatLast(device, emulation, name);
+        }
+        CheckStrip(device, emulation, name);
     }
-    std::printf("barycentric emulation through the %s passed: %u perspective and %u linear I/J pixels, raw vertex values, host interpolation, face culling and flat inputs\n", name.c_str(), smooth, noPerspective);
+    std::printf("barycentric emulation through the %s passed: %u perspective and %u linear I/J pixels, raw vertex values, host interpolation%s\n", name.c_str(), smooth, noPerspective, emulation == Emulation::RectList ? "" : ", face culling, flat inputs and triangle strips");
 }
 
 }
@@ -323,8 +437,12 @@ int main() {
         }
         if (geometry) RunEmulation(*device, Emulation::Geometry);
         else std::puts("geometry stage skipped, the device lacks geometryShader");
-        if (tessellation) RunEmulation(*device, Emulation::Tessellation);
-        else std::puts("tessellation stages skipped, the device lacks tessellationShader");
+        if (tessellation) {
+            RunEmulation(*device, Emulation::Tessellation);
+            RunEmulation(*device, Emulation::RectList);
+        } else {
+            std::puts("tessellation and rect-list stages skipped, the device lacks tessellationShader");
+        }
         return 0;
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelExecInterpolation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelExecInterpolation.cpp
new file mode 100644
index 0000000000..f9d09c28f4
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelExecInterpolation.cpp
@@ -0,0 +1,159 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 48;
+alignas(256) std::array<float, Width * Height * 4> Pixels{};
+constexpr std::array<std::array<float, 3>, 3> Corners{{{-0.8f, -0.8f, 1.0f}, {0.9f, -0.6f, 2.5f}, {-0.5f, 0.85f, 0.5f}}};
+
+alignas(256) constexpr std::array<std::uint32_t, 8> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf800020f, 0x03020100, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 8> ExecCopyPixelCode{
+    0xbefe0a7e, 0xc8080000, 0xbe80047e, 0xbefe0400, 0xc8090001, 0xf800180f, 0x02020202, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> RepeatedWqmPixelCode{
+    0xbefe0a7e, 0xc8080000, 0xbefe0a7e, 0xc8090001, 0xf800180f, 0x02020202, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> ExpandedExecPixelCode{
+    0xc8080000, 0xbefe0a7e, 0xc8090001, 0xf800180f, 0x02020202, 0xbf810000,
+};
+
+std::array<std::array<float, 4>, 3> ClipPositions() {
+    std::array<std::array<float, 4>, 3> positions{};
+    for (std::size_t i = 0; i < Corners.size(); ++i) positions[i] = {Corners[i][0] * Corners[i][2], Corners[i][1] * Corners[i][2], 0.5f * Corners[i][2], Corners[i][2]};
+    return positions;
+}
+
+struct Expected {
+    bool inside;
+    float value;
+};
+
+Expected Interpolated(std::uint32_t x, std::uint32_t y, bool snapped) {
+    std::array<std::array<double, 2>, 3> window{};
+    for (std::size_t i = 0; i < Corners.size(); ++i) window[i] = {(Corners[i][0] + 1.0) * Width / 2.0, (1.0 - Corners[i][1]) * Height / 2.0};
+    if (snapped) {
+        for (auto& corner : window) for (auto& coordinate : corner) coordinate = std::round(coordinate * 256.0) / 256.0;
+    }
+    const double px = x + 0.5;
+    const double py = y + 0.5;
+    const auto edge = [](const std::array<double, 2>& a, const std::array<double, 2>& b, double cx, double cy) { return (b[0] - a[0]) * (cy - a[1]) - (b[1] - a[1]) * (cx - a[0]); };
+    const double area = edge(window[0], window[1], window[2][0], window[2][1]);
+    const std::array<double, 3> weights{edge(window[1], window[2], px, py) / area, edge(window[2], window[0], px, py) / area, edge(window[0], window[1], px, py) / area};
+    double denominator = 0.0;
+    for (std::size_t i = 0; i < Corners.size(); ++i) denominator += weights[i] / Corners[i][2];
+    const auto positions = ClipPositions();
+    double value = 0.0;
+    for (std::size_t i = 0; i < Corners.size(); ++i) value += weights[i] / Corners[i][2] / denominator * positions[i][0];
+    return {std::min({weights[0], weights[1], weights[2]}) > 0.02, static_cast<float>(value)};
+}
+
+std::uint32_t CheckPixels() {
+    std::uint32_t checked = 0;
+    for (std::uint32_t y = 0; y < Height; ++y) {
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            const auto expected = Interpolated(x, y, false);
+            if (!expected.inside) continue;
+            const auto snapped = Interpolated(x, y, true);
+            for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                const auto value = Pixels[(y * Width + x) * 4u + channel];
+                Require(std::fabs(value - expected.value) <= 1e-4f || std::fabs(value - snapped.value) <= 1e-4f, "EXEC interpolation: incorrect pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") channel " + std::to_string(channel));
+            }
+            ++checked;
+        }
+    }
+    Require(checked > 200u, "EXEC interpolation: too few interior pixels were checked");
+    return checked;
+}
+
+void Run(AgcDriver::VulkanDevice& device, std::uint32_t waveSize) {
+    auto target = device.Target();
+    target.fragmentShaderBarycentricEnabled = false;
+    static const auto positions = ClipPositions();
+    const auto address = reinterpret_cast<std::uintptr_t>(positions.data());
+    const std::array<std::uint32_t, 4> vertexUserData{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (16u << 16u), 3u, 0x01016facu};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {waveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target, {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.wave32 = waveSize == 32u;
+    pixel.interpolatorCount = 1;
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveCenter);
+    pixel.hasPerspectiveCenterVgpr = true;
+    pixel.executeOnNoop = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    const auto compile = [&](std::span<const std::uint32_t> code) {
+        const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+        ShaderRecompiler::RecompileRequest fragment{
+            {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+            {waveSize, 0, {}, std::nullopt, pixel, std::nullopt, memory}, target, PixelPushLayout(vertexPush, target)
+        };
+        fragment.useCache = false;
+        return ShaderRecompiler::Recompile(fragment);
+    };
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, waveSize, waveSize, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(Pixels.data()), {Width, Height}, VK_FORMAT_R32G32B32A32_SFLOAT, sizeof(Pixels), 0xe4u, AgcDriver::Graphics::ColorTileMode::Linear, 16u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {Width, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    for (const auto code : {std::span<const std::uint32_t>(ExecCopyPixelCode), std::span<const std::uint32_t>(RepeatedWqmPixelCode)}) {
+        const auto result = compile(code);
+        Require(!result.barycentricEmulation.active, "changing EXEC between v_interp_p1/p2 needed a generated stage");
+        Pixels.fill(-7.0f);
+        const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderStage::Vertex, &vertexResult, 0}, {ShaderStage::Fragment, &result, PixelPushOffset(vertexPush, target)}}};
+        device.Draw(state, {0, 3, 0, 1, 0, false}, shaders);
+        device.WaitIdle();
+        std::printf("wave%u %zu words: host interpolation matched %u pixels\n", waveSize, code.size(), CheckPixels());
+    }
+    Require(compile(ExpandedExecPixelCode).barycentricEmulation.active, "a partial interpolation written before WQM incorrectly used host interpolation");
+    std::printf("wave%u: expanded EXEC keeps barycentric emulation\n", waveSize);
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        for (const auto wave : {32u, 64u}) Run(*device, wave);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp
index 116235fa11..74adeac4c0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelInterlock.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/PipelineLibrary.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "Recompiler.hpp"
 #include "VulkanTestDevice.hpp"
@@ -228,6 +229,7 @@ int main() {
             Draw(*device, waveSize);
             Check(waveSize, 3);
         }
+        Require(!device->GraphicsPipelineLibraries() || AgcDriver::Graphics::PipelineLibraryCountersOf(device->Device()).linked == 0, "pixel interlock: a primitive-ordered pixel shader's pipeline was linked from graphics pipeline libraries");
         std::printf("pixel interlock tests passed: 10 draws of %u overlapping triangles over %u pixels, 2 of them with a killed BDA fault in every %uth column\n", Layers, Width * Height, FaultColumns);
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelLdsLimit.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelLdsLimit.cpp
new file mode 100644
index 0000000000..594281d148
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelLdsLimit.cpp
@@ -0,0 +1,181 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 32;
+constexpr std::uint32_t High = 0x11110000u;
+constexpr std::uint32_t Last = 0x22220000u;
+constexpr std::uint32_t Past = 0x33330000u;
+alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
+alignas(256) std::array<std::uint32_t, Width * Height * 4> Results{};
+constexpr std::uint32_t Overflow = 256u;
+alignas(256) std::array<std::byte, Overflow * Overflow * 4> OverflowPixels{};
+alignas(256) std::array<std::uint32_t, Overflow * Overflow * 4> OverflowResults{};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+std::vector<std::uint32_t> PixelCode(std::uint32_t width) {
+    std::vector<std::uint32_t> code{0x7e040f00, 0x7e060f01, 0xd5430006, 0x0409ff03, width};
+    const auto mov = [&](std::uint32_t reg, std::uint32_t literal) {
+        code.push_back(0x7e0002ffu | (reg << 17u));
+        code.push_back(literal);
+    };
+    const auto shl = [&](std::uint32_t dest, std::uint32_t source) {
+        code.push_back(0x34000000u | (dest << 17u) | (source << 9u) | 0x82u);
+    };
+    const auto write = [&](std::uint32_t index, std::uint32_t value) {
+        mov(16u, index);
+        shl(17u, 16u);
+        mov(18u, value);
+        code.push_back(0xd8340000u);
+        code.push_back((18u << 8u) | 17u);
+    };
+    write(8000u, High);
+    write(8191u, Last);
+    write(8192u, Past);
+    code.push_back(0xbf8cc07fu);
+    const auto read = [&](std::uint32_t index, std::uint32_t dest) {
+        mov(16u, index);
+        shl(17u, 16u);
+        code.push_back(0xd8d80000u);
+        code.push_back((dest << 24u) | 17u);
+    };
+    read(8000u, 10u);
+    read(8191u, 11u);
+    read(8192u, 12u);
+    shl(15u, 3u);
+    code.push_back(0xd8d80000u);
+    code.push_back((13u << 24u) | 15u);
+    code.push_back(0xbf8cc07fu);
+    for (std::uint32_t slot = 0; slot < 4u; ++slot) {
+        code.push_back(0xe0702000u | (slot * 4u));
+        code.push_back(0x80010006u | ((10u + slot) << 8u));
+    }
+    code.insert(code.end(), {0x7e0e02f2, 0xf800180f, 0x07070707, 0xbf810000});
+    return code;
+}
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+constexpr std::array<std::array<float, 4>, 3> Triangles{{
+    {-1.0f, -1.0f, 0.5f, 1.0f}, {3.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 3.0f, 0.5f, 1.0f}
+}};
+
+void Draw(AgcDriver::VulkanDevice& device, std::uint32_t width, std::uint32_t height, std::span<std::byte> pixels, std::span<std::uint32_t> results, std::uint32_t draws = 1u) {
+    const auto pixelCode = PixelCode(width);
+    std::fill(pixels.begin(), pixels.end(), std::byte{0});
+    std::fill(results.begin(), results.end(), 0u);
+    const auto target = device.Target();
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Triangles.data(), 16u, static_cast<std::uint32_t>(Triangles.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {64u, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    const auto vertexResult = ShaderRecompiler::Recompile(vertex);
+    const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
+    ShaderRecompiler::ShaderPixelStageInfo pixel{};
+    pixel.wave32 = false;
+    pixel.inputAddr = ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionX) | ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PositionY);
+    pixel.posX = true;
+    pixel.posY = true;
+    pixel.targetOutputMode[0] = 9;
+    pixel.targetExportMapping.fill(0xe4u);
+    std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const auto stored = BufferDescriptor(results.data(), 16u, width * height);
+    std::copy(stored.begin(), stored.end(), pixelUserData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(std::span(pixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
+        {64u, 0, pixelUserData, std::nullopt, pixel, std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    const auto pixelResult = ShaderRecompiler::Recompile(fragment);
+    Require(pixelResult.functionLdsBuffer == target.largePixelFunctionLdsBuffer, target.largePixelFunctionLdsBuffer ? "pixel LDS limit: the full array was not backed by a buffer" : "pixel LDS limit: a driver that keeps the function array used the buffer");
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{
+        {ShaderStage::Vertex, &vertexResult, 0},
+        {ShaderStage::Fragment, &pixelResult, PixelPushOffset(vertexPush, target)}
+    }};
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, 64u, 64u, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(pixels.data()), {width, height}, VK_FORMAT_R8G8B8A8_UNORM, pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.renderExtent = {width, height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(height), static_cast<float>(width), -static_cast<float>(height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {width, height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(Triangles.size()), 0, 1, 0, false};
+    for (std::uint32_t n = 0; n < draws; ++n) device.Draw(state, draw, shaders);
+    device.WaitIdle();
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (device->Target().subgroupSize < 32u) {
+            std::printf("skipped, subgroup size %u cannot hold a wave32\n", device->Target().subgroupSize);
+            return VulkanTestSkipped;
+        }
+        Draw(*device, Width, Height, Pixels, Results, 2u);
+        for (std::uint32_t pixel = 0; pixel < Width * Height; ++pixel) {
+            for (std::uint32_t channel = 0; channel < 4u; ++channel) Require(Pixels[pixel * 4u + channel] == std::byte{255}, "pixel LDS limit: missing color");
+            const auto base = pixel * 4u;
+            Require(Results[base] == High, "pixel LDS limit: dword 8000 expected " + std::to_string(High) + " got " + std::to_string(Results[base]));
+            Require(Results[base + 1u] == Last, "pixel LDS limit: dword 8191 expected " + std::to_string(Last) + " got " + std::to_string(Results[base + 1u]));
+            Require(Results[base + 2u] == 0u, "pixel LDS limit: dword 8192 wrote " + std::to_string(Results[base + 2u]));
+        }
+        std::puts("pixel LDS limit passed: dword 8000 and 8191, 2048 pixels, two draws");
+        if (device->Target().largePixelFunctionLdsBuffer) {
+            bool threw = false;
+            try {
+                Draw(*device, Overflow, Overflow, OverflowPixels, OverflowResults);
+            } catch (const std::exception& error) {
+                threw = std::string_view(error.what()) == "AGC graphics: pixel function LDS subgroup slots exhausted";
+                if (!threw) throw;
+            }
+            Require(threw, "pixel LDS limit: a draw past the subgroup slots did not throw");
+            std::puts("pixel LDS limit overflow passed");
+        }
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp
index 7c6d5398c2..f3e0672a31 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PixelSampleCoverage.cpp
@@ -20,6 +20,7 @@
 #include <algorithm>
 #include <array>
 #include <bit>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -30,6 +31,14 @@
 #include <string_view>
 #include <vector>
 
+namespace AgcDriver {
+
+struct VulkanDeviceTestAccess {
+    static Graphics::Context Context(const VulkanDevice& device) { return device.graphicsContext(); }
+};
+
+}
+
 namespace {
 
 using AgcDriver::Graphics::Require;
@@ -54,7 +63,12 @@ constexpr std::array<std::array<float, 4>, 3> HalfTriangle{{
     {-1.0f, -1.0f, 0.5f, 1.0f}, {1.0f, -1.0f, 0.5f, 1.0f}, {-1.0f, 1.0f, 0.5f, 1.0f}
 }};
 
-alignas(256) std::array<std::array<std::uint32_t, 16>, 4> Programs{};
+constexpr std::array<std::array<float, 4>, 3> OtherHalfTriangle{{
+    {1.0f, -1.0f, 0.5f, 1.0f}, {1.0f, 1.0f, 0.5f, 1.0f}, {-1.0f, 1.0f, 0.5f, 1.0f}
+}};
+
+alignas(256) std::array<std::array<std::uint32_t, 16>, 16> Programs{};
+alignas(256) std::array<std::byte, 256 * 1024> DepthMemory{};
 std::size_t programCount = 0;
 
 std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
@@ -76,6 +90,22 @@ std::span<const std::uint32_t> Program(std::uint32_t coverageVgpr) {
     return std::span<const std::uint32_t>(code.data(), at);
 }
 
+std::span<const std::uint32_t> SampleIndexProgram() {
+    Require(programCount < Programs.size(), "too many test programs");
+    auto& code = Programs[programCount++];
+    std::size_t at = 0;
+    code[at++] = 0xd5480018u;
+    code[at++] = 0x02111100u;
+    code[at++] = 0x7e000c00u | (20u << 17u) | (256u + 24u);
+    code[at++] = 0x7e000280u | (21u << 17u);
+    code[at++] = 0x7e000280u | (22u << 17u);
+    code[at++] = 0x7e0002f2u | (23u << 17u);
+    code[at++] = 0xf800180fu;
+    code[at++] = 0x17161514u;
+    code[at++] = 0xbf810000u;
+    return std::span<const std::uint32_t>(code.data(), at);
+}
+
 struct Block {
     explicit Block(std::size_t bytes) : bytes(bytes), watched(AgcDriver::GuestMemory::WriteWatched()) {
 #ifdef _WIN32
@@ -134,12 +164,12 @@ struct Block {
     std::uint8_t* data = nullptr;
 };
 
-AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t info) {
+AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t info, std::uint32_t attrib = 0) {
     AgcDriver::Registers cx;
     cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
     cx[0x31b] = 0;
     cx[0x31c] = info;
-    cx[0x31d] = 0;
+    cx[0x31d] = attrib;
     cx[0x323] = 0;
     cx[0x324] = 0;
     cx[0x3b0] = ((Width - 1u) << 14u) | (Height - 1u);
@@ -150,7 +180,7 @@ AgcDriver::Graphics::ColorTarget DecodeTarget(const Block& block, std::uint32_t
     return color;
 }
 
-void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::uint32_t inputAddr, std::span<const std::uint32_t> pixelCode, std::span<const std::array<float, 4>, 3> triangle = Triangle, std::uint32_t rasterSamples = 1) {
+void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarget& color, std::uint32_t inputAddr, std::span<const std::uint32_t> pixelCode, std::span<const std::array<float, 4>, 3> triangle = Triangle, std::uint32_t rasterSamples = 1, const AgcDriver::Graphics::DepthTarget* depth = nullptr, bool perSample = false) {
     const auto target = device.Target();
     constexpr std::uint32_t waveSize = 64;
     std::vector<std::uint32_t> vertexUserData(4, 0u);
@@ -171,6 +201,8 @@ void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarge
     pixel.inputAddr = inputAddr;
     pixel.ancillary = (inputAddr & ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary)) != 0u;
     pixel.hasPerspectiveCenterVgpr = (inputAddr & ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::PerspectiveCenter)) != 0u;
+    pixel.sampleShading = perSample;
+    pixel.iteratesSamples = perSample;
     pixel.targetOutputMode.at(0) = Float32AbgrExport;
     pixel.targetExportMapping.fill(0xe4u);
     const std::vector<std::uint32_t> pixelUserData(8, 0u);
@@ -207,7 +239,15 @@ void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::ColorTarge
     state.blend = blend;
     state.blendConstants = {};
     state.samples = rasterSamples;
-    state.mergedCoverage = rasterSamples > 1;
+    state.mergedCoverage = rasterSamples > 1 && depth == nullptr;
+    state.truncatedCoverage = rasterSamples > 1 && depth != nullptr;
+    state.perSampleShading = perSample;
+    if (depth != nullptr) {
+        state.depth = *depth;
+        state.depthTest = true;
+        state.depthWrite = false;
+        state.depthCompare = VK_COMPARE_OP_ALWAYS;
+    }
     const AgcDriver::Pm4::DrawParameters draw{0, static_cast<std::uint32_t>(triangle.size()), 0, 1, 0, false};
     device.Draw(state, draw, shaders);
 }
@@ -273,6 +313,112 @@ bool ExpectMerged(AgcDriver::VulkanDevice& device) {
     return true;
 }
 
+std::string ExpectTruncated(AgcDriver::VulkanDevice& device) {
+    if ((AgcDriver::VulkanDeviceTestAccess::Context(device).limits.framebufferDepthSampleCounts & VK_SAMPLE_COUNT_2_BIT) == 0) return "the device has no two-sample depth targets (framebufferDepthSampleCounts)";
+    constexpr std::size_t bytes = std::size_t{Width} * Height * 16u;
+    AgcDriver::Graphics::DepthTarget depth{reinterpret_cast<std::uintptr_t>(DepthMemory.data()), 0u, {Width, Height}, VK_FORMAT_D32_SFLOAT, 0.0f, 0};
+    depth.samples = 2;
+    std::array<std::uint32_t, 4> written{};
+    std::uint32_t untouched = 0;
+    for (const auto* triangle : {&HalfTriangle, &OtherHalfTriangle}) {
+        Block block(bytes);
+        std::fill(block.data, block.data + bytes, std::uint8_t{0xff});
+        const auto color = DecodeTarget(block, Rgba32FloatInfo);
+        try {
+            Draw(device, color, ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage), Program(0u), *triangle, 2u, &depth);
+        } catch (const std::exception& error) {
+            if (std::string_view(error.what()).find("truncated coverage reduction") == std::string_view::npos) throw;
+            return "the device lacks VK_AMD_mixed_attachment_samples and VK_NV_framebuffer_mixed_samples with truncated coverage reduction";
+        }
+        const auto stored = ReadBack(device, block.Address(), bytes);
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < Width; ++x) {
+                const auto* texel = stored.data() + (static_cast<std::size_t>(y) * Width + x) * 16u;
+                if (std::all_of(texel, texel + 16, [](std::uint8_t byte) { return byte == 0xffu; })) {
+                    ++untouched;
+                    continue;
+                }
+                std::array<float, 4> value{};
+                std::memcpy(value.data(), texel, sizeof(value));
+                const auto mask = static_cast<std::uint32_t>(value[0]);
+                Require(value[0] == static_cast<float>(mask) && mask >= 1u && mask <= 3u && value[1] == 0.0f && value[2] == 0.0f && value[3] == 1.0f, "truncated coverage: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds (" + std::to_string(value[0]) + ", " + std::to_string(value[1]) + ", " + std::to_string(value[2]) + ", " + std::to_string(value[3]) + ")");
+                ++written[mask];
+            }
+        }
+    }
+    Require(written[2] == 0, "truncated coverage: " + std::to_string(written[2]) + " pixels that cover only sample 1 were written into the one-sample target");
+    Require(written[1] != 0 && written[3] != 0 && untouched != 0, "truncated coverage: two half-covering triangles wrote " + std::to_string(written[3]) + " fully covered and " + std::to_string(written[1]) + " sample-0-only pixels and left " + std::to_string(untouched));
+    std::uint32_t perSampleWritten = 0;
+    std::uint32_t perSampleUntouched = 0;
+    for (const auto* triangle : {&HalfTriangle, &OtherHalfTriangle}) {
+        Block block(bytes);
+        std::fill(block.data, block.data + bytes, std::uint8_t{0xff});
+        const auto color = DecodeTarget(block, Rgba32FloatInfo);
+        Draw(device, color, ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::Ancillary), SampleIndexProgram(), *triangle, 2u, &depth, true);
+        const auto stored = ReadBack(device, block.Address(), bytes);
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < Width; ++x) {
+                const auto* texel = stored.data() + (static_cast<std::size_t>(y) * Width + x) * 16u;
+                if (std::all_of(texel, texel + 16, [](std::uint8_t byte) { return byte == 0xffu; })) {
+                    ++perSampleUntouched;
+                    continue;
+                }
+                std::array<float, 4> value{};
+                std::memcpy(value.data(), texel, sizeof(value));
+                Require(value == std::array<float, 4>{0.0f, 0.0f, 0.0f, 1.0f}, "truncated coverage per sample: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds (" + std::to_string(value[0]) + ", " + std::to_string(value[1]) + ", " + std::to_string(value[2]) + ", " + std::to_string(value[3]) + "), not sample 0's output");
+                ++perSampleWritten;
+            }
+        }
+    }
+    Require(perSampleWritten == written[1] + written[3] && perSampleUntouched == untouched, "truncated coverage per sample: the draws wrote " + std::to_string(perSampleWritten) + " pixels where one invocation per pixel wrote " + std::to_string(written[1] + written[3]));
+    return {};
+}
+
+std::string ExpectOneFragment(AgcDriver::VulkanDevice& device) {
+    if ((AgcDriver::VulkanDeviceTestAccess::Context(device).limits.framebufferDepthSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0) return "the device has no four-sample depth targets (framebufferDepthSampleCounts)";
+    constexpr std::size_t bytes = std::size_t{Width} * Height * 16u;
+    AgcDriver::Graphics::DepthTarget depth{reinterpret_cast<std::uintptr_t>(DepthMemory.data()), 0u, {Width, Height}, VK_FORMAT_D32_SFLOAT, 0.0f, 0};
+    depth.samples = 4;
+    std::array<std::uint32_t, 16> written{};
+    std::uint32_t untouched = 0;
+    for (const auto* triangle : {&HalfTriangle, &OtherHalfTriangle}) {
+        Block block(bytes);
+        std::fill(block.data, block.data + bytes, std::uint8_t{0xff});
+        const auto color = DecodeTarget(block, Rgba32FloatInfo, 0x2000u);
+        Require(color.samples == 1u, "a 4-sample color target with one fragment did not decode as one stored sample");
+        try {
+            Draw(device, color, ShaderRecompiler::PixelInputBit(ShaderRecompiler::PixelInput::SampleCoverage), Program(0u), *triangle, 4u, &depth);
+        } catch (const std::exception& error) {
+            if (std::string_view(error.what()).find("truncated coverage reduction") == std::string_view::npos) throw;
+            return "the device lacks VK_AMD_mixed_attachment_samples and VK_NV_framebuffer_mixed_samples with truncated coverage reduction";
+        }
+        const auto stored = ReadBack(device, block.Address(), bytes);
+        for (std::uint32_t y = 0; y < Height; ++y) {
+            for (std::uint32_t x = 0; x < Width; ++x) {
+                const auto* texel = stored.data() + (static_cast<std::size_t>(y) * Width + x) * 16u;
+                if (std::all_of(texel, texel + 16, [](std::uint8_t byte) { return byte == 0xffu; })) {
+                    ++untouched;
+                    continue;
+                }
+                std::array<float, 4> value{};
+                std::memcpy(value.data(), texel, sizeof(value));
+                const auto mask = static_cast<std::uint32_t>(value[0]);
+                Require(value[0] == static_cast<float>(mask) && mask >= 1u && mask <= 15u && value[1] == 0.0f && value[2] == 0.0f && value[3] == 1.0f, "one-fragment coverage: pixel (" + std::to_string(x) + ", " + std::to_string(y) + ") holds (" + std::to_string(value[0]) + ", " + std::to_string(value[1]) + ", " + std::to_string(value[2]) + ", " + std::to_string(value[3]) + ")");
+                ++written[mask];
+            }
+        }
+    }
+    std::uint32_t withoutSampleZero = 0;
+    std::uint32_t partial = 0;
+    for (std::uint32_t mask = 1; mask < 16u; ++mask) {
+        if ((mask & 1u) == 0) withoutSampleZero += written[mask];
+        else if (mask != 15u) partial += written[mask];
+    }
+    Require(withoutSampleZero == 0, "one-fragment coverage: " + std::to_string(withoutSampleZero) + " pixels whose coverage lacks sample 0 were written into the one fragment");
+    Require(written[15] != 0 && partial != 0 && untouched != 0, "one-fragment coverage: two half-covering triangles wrote " + std::to_string(written[15]) + " fully covered and " + std::to_string(partial) + " partly covered pixels and left " + std::to_string(untouched) + " untouched");
+    return {};
+}
+
 }
 
 int main() {
@@ -285,6 +431,8 @@ int main() {
         Expect(*device, PixelInputBit(PixelInput::PerspectiveCenter) | PixelInputBit(PixelInput::SampleCoverage), 2u, "SAMPLE_COVERAGE after the perspective center");
         Expect(*device, PixelInputBit(PixelInput::Ancillary) | PixelInputBit(PixelInput::SampleCoverage), 1u, "SAMPLE_COVERAGE after ANCILLARY");
         if (!ExpectMerged(*device)) std::puts("merged coverage not tested: the device lacks VK_NV_framebuffer_mixed_samples with merged coverage reduction");
+        if (const auto skipped = ExpectTruncated(*device); !skipped.empty()) std::printf("truncated coverage not tested: %s\n", skipped.c_str());
+        if (const auto skipped = ExpectOneFragment(*device); !skipped.empty()) std::printf("one-fragment coverage not tested: %s\n", skipped.c_str());
         std::puts("pixel sample coverage tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp
index 785886aa84..988207259f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PooledBufferRange.cpp
@@ -3,6 +3,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include "../AllocationFailure.hpp"
 #include "../SlabReturn.hpp"
 #include <SDL_loadso.h>
@@ -143,6 +144,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -154,6 +157,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -162,22 +171,11 @@ public:
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
             const auto properties = function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties");
-            const auto* requested = std::getenv("ANYPS5_GPU");
-            const bool named = requested != nullptr && *requested != '\0';
-            context.physical = devices.front();
-            for (const auto candidate : devices) {
-                VkPhysicalDeviceProperties described{};
-                properties(candidate, &described);
-                if (named ? std::strstr(described.deviceName, requested) != nullptr : described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU) {
-                    context.physical = candidate;
-                    break;
-                }
-            }
+            context.physical = SelectFixturePhysicalDevice(devices, properties);
             VkPhysicalDeviceProperties selected{};
             properties(context.physical, &selected);
             context.limits = selected.limits;
             std::printf("device %s vendor=0x%x device=0x%x driver=0x%x\n", selected.deviceName, selected.vendorID, selected.deviceID, selected.driverVersion);
-            Require(requested == nullptr || std::strstr(selected.deviceName, requested) != nullptr, "selected device does not match ANYPS5_GPU");
             VkPhysicalDeviceFeatures supported{};
             function<PFN_vkGetPhysicalDeviceFeatures>("vkGetPhysicalDeviceFeatures")(context.physical, &supported);
             Require(supported.robustBufferAccess == VK_TRUE, "the device lacks robustBufferAccess");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp
index b67059d036..ab06a87e40 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparationScopeSettle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAgc/Shader/include/InterpolantMapping.hpp"
 #include "VulkanTestDevice.hpp"
 #include "SceShaders.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -15,8 +16,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" int APS5_VABI sceAgcCreateInterpolantMapping_0100(ShaderRegister* regs, const Shader* gs, const Shader* ps);
-
 namespace {
 
 void Require(bool condition, const char* message) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp
index beaed11d60..1273ff05c7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedPublication.cpp
@@ -371,6 +371,34 @@ void TransactionLock() {
     Require(excluded, "a transaction ran beside one that had read prepared state");
 }
 
+void CommittedLinks() {
+    ShaderSnapshot front{};
+    auto pixel = std::make_shared<ShaderSnapshot>();
+    ResolvePreparedGraphics(front, pixel, 0, {});
+    Require(front.prepared->fragments.size() == 1 && front.prepared->fragments.front().lock() == pixel, "a resolved link was not published");
+    ShaderSnapshot unrelated{};
+    auto other = std::make_shared<ShaderSnapshot>();
+    std::optional<ShaderPreparationTransaction> open(std::in_place);
+    static_cast<void>(open->Read(unrelated));
+    auto repeated = std::async(std::launch::async, [&] { ResolvePreparedGraphics(front, pixel, 0, {}); });
+    const bool unblocked = repeated.wait_for(std::chrono::seconds(10)) == std::future_status::ready;
+    auto linking = std::async(std::launch::async, [&] { ResolvePreparedGraphics(front, other, 0, {}); });
+    const bool excluded = linking.wait_for(std::chrono::milliseconds(200)) == std::future_status::timeout;
+    open->Commit();
+    open.reset();
+    repeated.get();
+    linking.get();
+    Require(unblocked, "resolving a link the shader already had waited for another thread's transaction");
+    Require(excluded && front.prepared->fragments.size() == 2, "a new link was published beside a transaction that had read prepared state");
+    {
+        ShaderPreparationTransaction transaction;
+        transaction.Edit(front).fragments.clear();
+        ResolvePreparedGraphics(front, pixel, 0, {});
+        transaction.Commit();
+    }
+    Require(front.prepared->fragments.size() == 1 && front.prepared->fragments.front().lock() == pixel, "a link resolved in a transaction that had changed the shader was checked against the published links");
+}
+
 void PreparationPriority(bool beforeSubmit) {
     const auto workers = std::max(2u, std::thread::hardware_concurrency() / 2u);
     std::barrier started(static_cast<std::ptrdiff_t>(workers + 1u));
@@ -415,6 +443,7 @@ int main() {
         RegistryVersions();
         FusedHullHeaderSelection();
         TransactionLock();
+        CommittedLinks();
         PreparationPriority(false);
         PreparationPriority(true);
         auto device = OpenVulkanTestDevice();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp
index 734a7c6825..88ecd918f8 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PreparedShaders.cpp
@@ -437,6 +437,15 @@ void SharedCodeHeaders() {
     AgcDriverRegisterShader_nid_postfix(&mesh.shader);
     AgcDriverResolveShaderAbi_nid_postfix(&vertex.shader, {}, primitive);
     AgcDriverRegisterShader_nid_postfix(&mesh.shader);
+    const auto snapshots = [&] {
+        const auto registry = AgcDriver::DriverDetail::Driver::Get().RegisteredShaders();
+        Require(registry != nullptr, "shared-code headers published no shader registry");
+        auto pair = std::pair{AgcDriver::DriverDetail::RegisteredHeader(*registry, &vertex.shader), AgcDriver::DriverDetail::RegisteredHeader(*registry, &mesh.shader)};
+        Require(pair.first != nullptr && pair.second != nullptr && pair.first != pair.second, "the shared-code headers were not registered apart");
+        return pair;
+    };
+    const auto [vertexSnapshot, meshSnapshot] = snapshots();
+    Require(vertexSnapshot->registeredState != meshSnapshot->registeredState, "a header with other registers shared another header's registered state");
     Shader copy = vertex.shader;
     copy.user_data = nullptr;
     AgcDriverResolveShaderAbi_nid_postfix(&copy, {}, primitive);
@@ -461,6 +470,8 @@ void SharedCodeHeaders() {
     mesh.shader.cx_registers = mesh.context.data();
     mesh.shader.num_cx_registers = mesh.context.size();
     AgcDriverRegisterShader_nid_postfix(&mesh.shader);
+    const auto [sameVertex, sameMesh] = snapshots();
+    Require(sameVertex->registeredState == sameMesh->registeredState && sameMesh->registeredState->context.at(0x2d5) == 0x2000u, "two headers with the same code and registers decoded their registered state twice");
     AgcDriverResolveShaderAbi_nid_postfix(&mesh.shader, {}, primitive);
     AgcDriverResolveShaderAbi_nid_postfix(&vertex.shader, {}, primitive);
     Require(sceAgcDriverSubmitDcb(&packet) == 0, "same-type registered header draw failed");
@@ -958,11 +969,13 @@ void AbiDeferredCompute() {
     caller.shader.specials = &caller.specials;
     caller.specials.dispatch_modifier = 0x8000u;
     AgcDriverRegisterShader_nid_postfix(&caller.shader);
+    const bool lazy = std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr;
     const auto before = ShaderRecompiler::FrontEndBuilds();
     AgcDriverResolveShaderAbi_nid_postfix(&caller.shader, {}, {});
     const auto attempted = ShaderRecompiler::FrontEndBuilds();
     AgcDriverResolveShaderAbi_nid_postfix(&caller.shader, {}, {});
-    Require(attempted > before && ShaderRecompiler::FrontEndBuilds() == attempted, "a compute static ABI deferred to its dispatch was prepared again for the same state");
+    if (lazy) Require(attempted == before && ShaderRecompiler::FrontEndBuilds() == attempted, "a compute static ABI resolved under lazy preparation built its front end before its dispatch");
+    else Require(attempted > before && ShaderRecompiler::FrontEndBuilds() == attempted, "a compute static ABI deferred to its dispatch was prepared again for the same state");
     const auto first = reinterpret_cast<std::uintptr_t>(AddFiveCallee.data());
     const auto second = reinterpret_cast<std::uintptr_t>(AddSixtyFourCallee.data());
     const auto output = reinterpret_cast<std::uintptr_t>(CallerOutput.data());
@@ -981,6 +994,88 @@ void AbiDeferredCompute() {
     AgcDriverShutdown_nid_postfix();
 }
 
+void AbiDeferredConcurrent() {
+    using namespace NarrowConstantStoreFixture;
+    Require(std::getenv("APS5_LAZY_SHADER_PREPARE") != nullptr, "lazy preparation is not enabled");
+    struct Header {
+        Shader shader{};
+        std::array<ShaderRegister, 7> registers{};
+        ShaderSpecialRegs specials{};
+    };
+    static Header header;
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    header.shader.file_header = 0x34333231u;
+    header.shader.version = 0x18;
+    header.shader.header_size = sizeof(header);
+    header.shader.shader_size = sizeof(Code);
+    header.shader.code = Code.data();
+    header.shader.sh_registers = header.registers.data();
+    header.shader.num_sh_registers = header.registers.size();
+    header.shader.specials = &header.specials;
+    header.specials.dispatch_modifier = 0x8000;
+    header.registers = {{{0x20c, static_cast<std::uint32_t>(address >> 8u)}, {0x20d, static_cast<std::uint32_t>(address >> 40u)}, {0x207, Threads}, {0x208, 1}, {0x209, 1}, {0x212, 0}, {0x213, 4}}};
+    AgcDriverRegisterShader_nid_postfix(&header.shader);
+    AgcDriverResolveShaderAbi_nid_postfix(&header.shader, {}, {});
+    constexpr std::size_t Queues = 4;
+    constexpr std::size_t OutputBytes = 65536;
+#ifdef _WIN32
+    auto* allocation = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, Queues * OutputBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+    auto* allocation = static_cast<std::uint8_t*>(std::aligned_alloc(OutputBytes, Queues * OutputBytes));
+#endif
+    Require(allocation != nullptr, "cannot allocate the concurrent first use outputs");
+    const auto release = [](std::uint8_t* block) {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    };
+    const std::unique_ptr<std::uint8_t, decltype(release)> ownedOutputs(allocation, release);
+    GuestAllocations::Mutation().Add(allocation, Queues * OutputBytes, true, true, true);
+    std::fill_n(allocation, Queues * OutputBytes, Fill);
+    std::vector<std::vector<std::uint32_t>> commands(Queues);
+    std::vector<Packet> packets;
+    for (std::size_t queue = 0; queue < Queues; ++queue) {
+        const auto output = reinterpret_cast<std::uintptr_t>(allocation + queue * OutputBytes);
+        for (const auto reg : header.registers) commands[queue].insert(commands[queue].end(), {0xc0017600u, reg.offset, reg.value});
+        commands[queue].insert(commands[queue].end(), {0xc0027600u, 0x240, static_cast<std::uint32_t>(output), static_cast<std::uint32_t>(output >> 32u), 0xc0031500u, 1, 1, 1, 0x8041});
+        packets.push_back({commands[queue].data(), static_cast<std::uint32_t>(commands[queue].size()), 0, {}});
+    }
+    const auto builds = ShaderRecompiler::FrontEndBuilds();
+    const auto uses = AgcDriver::DriverDetail::Driver::DeferredAbiUses();
+    std::barrier start(static_cast<std::ptrdiff_t>(Queues));
+    std::vector<std::thread> threads;
+    for (std::size_t queue = 0; queue < Queues; ++queue) {
+        threads.emplace_back([&, queue] {
+            start.arrive_and_wait();
+            sceAgcDriverSubmitAcb(0x20u + static_cast<std::uint32_t>(queue), &packets[queue]);
+        });
+    }
+    for (auto& thread : threads) thread.join();
+    AgcDriverWaitIdle_nid_postfix();
+    AgcDriverSuspendPoint_nid_postfix();
+    AgcDriverWaitIdle_nid_postfix();
+    for (std::size_t queue = 0; queue < Queues; ++queue) {
+        const auto* output = allocation + queue * OutputBytes;
+        for (std::size_t offset = 0; offset < OutputBytes; ++offset) {
+            const auto expected = offset < Threads * LaneBytes ? ExpectedLane[offset % LaneBytes] : Fill;
+            if (output[offset] != expected) throw std::runtime_error("concurrent first use: queue " + std::to_string(queue) + " byte " + std::to_string(offset) + " is " + std::to_string(output[offset]) + ", expected " + std::to_string(expected));
+        }
+    }
+    const auto after = AgcDriver::DriverDetail::Driver::DeferredAbiUses();
+    const auto built = ShaderRecompiler::FrontEndBuilds() - builds;
+    const auto entries = AgcDriver::DriverDetail::Driver::Get().PreparedEntries(&header.shader);
+    const auto matched = (after.entries - after.unmatchedEntries) - (uses.entries - uses.unmatchedEntries);
+    const auto counts = std::to_string(built) + " front-end builds, " + std::to_string(entries) + " prepared entries, " + std::to_string(after.firstUses - uses.firstUses) + " first uses, " + std::to_string(after.found - uses.found) + " found, " + std::to_string(after.own - uses.own) + " own, " + std::to_string(matched) + " entries used";
+    std::cout << "concurrent first use of a deferred ABI: " << counts << '\n';
+    Require(after.firstUses == uses.firstUses + 1 && after.found == uses.found + 1 && after.own == uses.own, ("four queues making the first use of one deferred ABI at once did not prepare it once (" + counts + ")").c_str());
+    Require(built == after.entries - uses.entries && entries == built, ("four queues making the first use of one deferred ABI at once prepared an artifact besides its preparation (" + counts + ")").c_str());
+    Require(matched == 1, ("four queues making the first use of one deferred ABI at once did not all use the same entry of its preparation (" + counts + ")").c_str());
+    AgcDriverShutdown_nid_postfix();
+}
+
 void AbiDeferredRegistrationFailure() {
     static AbiHeader store;
     DescribeAbi(store, WaterfallStoreCode, 0, {{0x20c, ProgramLow(WaterfallStoreCode.data())}, {0x20d, ProgramHigh(WaterfallStoreCode.data())}, {0x207, 64}, {0x208, 1}, {0x209, 1}, {0x212, 0}, {0x213, 2u << 1u}}, {});
@@ -1198,6 +1293,63 @@ void AbiDeferredRectanglePairs() {
     ExpectFailure([] { AgcDriverShutdown_nid_postfix(); }, "custom per-vertex interpolation is unsupported");
 }
 
+void CommittedAbis() {
+    static AbiHeader front;
+    static AbiHeader pixel;
+    DescribeFront(front);
+    DescribeAbi(pixel, PassthroughPixelCode, 1, {{0x8, ProgramLow(PassthroughPixelCode.data())}, {0x9, ProgramHigh(PassthroughPixelCode.data())}, {0xa, 0}, {0xb, 0}}, {{0x1b6, 1}, {0x1b3, 2}, {0x1b4, 2}, {0x191, 0}, {0x1c5, 4}});
+    for (auto* header : {&front, &pixel}) AgcDriverRegisterShader_nid_postfix(&header->shader);
+    const std::array<const Shader*, 2> stages{&front.shader, &pixel.shader};
+    const std::array<ShaderRegister, 1> primitive{{{0x242, 4}}};
+    const std::array<ShaderRegister, 1> interpolant{{{0x191, 0x20}}};
+    const auto resolve = [&] {
+        AgcDriver::ShaderPreparationScope scope({&front.shader, &pixel.shader});
+        AgcDriverResolveShaderAbi_nid_postfix(&pixel.shader, {}, {});
+        AgcDriverResolveGraphicsStagesAbi_nid_postfix(stages, {}, primitive);
+        AgcDriverResolveGraphicsAbi_nid_postfix(&front.shader, &pixel.shader, 0);
+        scope.Commit();
+    };
+    const auto resolveOther = [&] {
+        AgcDriver::ShaderPreparationScope scope({&pixel.shader});
+        AgcDriverResolveShaderAbi_nid_postfix(&pixel.shader, interpolant, {});
+        scope.Commit();
+    };
+    resolve();
+    const auto registry = AgcDriver::DriverDetail::Driver::Get().RegisteredShaders();
+    Require(registry != nullptr, "committed ABI resolution published no shader registry");
+    const auto pixelSnapshot = AgcDriver::DriverDetail::RegisteredHeader(*registry, &pixel.shader);
+    Require(pixelSnapshot != nullptr, "committed ABI resolution published no pixel snapshot");
+    const auto committedAbis = [&] {
+        std::lock_guard lock(pixelSnapshot->prepared->mutex);
+        return pixelSnapshot->prepared->registeredAbis.size();
+    };
+    AgcDriver::DriverDetail::AwaitRegistrationPreparation();
+    const auto before = ShaderRecompiler::FrontEndBuilds();
+    const auto abisBefore = committedAbis();
+    bool unblocked = false;
+    bool excluded = false;
+    std::uint64_t repeatedBuilds = 0;
+    std::future<void> repeated;
+    std::future<void> other;
+    {
+        AgcDriver::DriverDetail::ShaderSnapshot unrelated{};
+        AgcDriver::DriverDetail::ShaderPreparationTransaction open;
+        static_cast<void>(open.Read(unrelated));
+        repeated = std::async(std::launch::async, resolve);
+        unblocked = repeated.wait_for(std::chrono::seconds(10)) == std::future_status::ready;
+        repeatedBuilds = ShaderRecompiler::FrontEndBuilds() - before;
+        other = std::async(std::launch::async, resolveOther);
+        const auto started = std::chrono::steady_clock::now();
+        while (ShaderRecompiler::FrontEndBuilds() == before + repeatedBuilds && std::chrono::steady_clock::now() - started < std::chrono::seconds(10)) std::this_thread::yield();
+        excluded = other.wait_for(std::chrono::milliseconds(500)) == std::future_status::timeout && committedAbis() == abisBefore;
+        open.Commit();
+    }
+    repeated.get();
+    other.get();
+    Require(unblocked && repeatedBuilds == 0, "resolving ABIs the shaders already had waited for another thread's shader preparation, or prepared them again");
+    Require(excluded, "a new ABI was published beside a shader preparation that had read prepared state");
+}
+
 void RelocatedHeaders() {
     alignas(256) static const std::array<std::uint32_t, 11> code{0x7e0002ffu, 0, 0x7e0202ffu, 0, 0x7e0402ffu, 0, 0x7e0602ffu, 0x3f800000u, 0xf80008cfu, 0x03020100u, 0xbf810000u};
     struct Header {
@@ -1266,11 +1418,12 @@ void RelocatedHeaders() {
 int main(int argc, char** argv) {
     try {
         const std::string_view abiMode = argc == 2 ? argv[1] : "";
-        const bool abiDeferred = abiMode == "--abi-deferred-compute" || abiMode == "--abi-deferred-pixel" || abiMode == "--abi-deferred-stages" || abiMode == "--abi-deferred-rectangle" || abiMode == "--abi-deferred-undecodable-state" || abiMode == "--abi-deferred-registration-failure" || abiMode == "--abi-deferred-vertex-inputs" || abiMode == "--abi-deferred-rectangle-pairs";
+        const bool abiDeferred = abiMode == "--abi-deferred-compute" || abiMode == "--abi-deferred-concurrent" || abiMode == "--abi-deferred-pixel" || abiMode == "--abi-deferred-stages" || abiMode == "--abi-deferred-rectangle" || abiMode == "--abi-deferred-undecodable-state" || abiMode == "--abi-deferred-registration-failure" || abiMode == "--abi-deferred-vertex-inputs" || abiMode == "--abi-deferred-rectangle-pairs";
         Require(argc == 1 || abiDeferred || (argc == 2 && (std::string_view(argv[1]) == "--indirect" || std::string_view(argv[1]) == "--fail-before-registration" || std::string_view(argv[1]) == "--deferred" || std::string_view(argv[1]) == "--deferred-undecodable" || std::string_view(argv[1]) == "--registered-workgroup" || std::string_view(argv[1]) == "--lazy")), "invalid test arguments");
         if (abiDeferred) {
             if (!OpenVulkanTestDevice()) return VulkanTestSkipped;
             if (abiMode == "--abi-deferred-compute") AbiDeferredCompute();
+            else if (abiMode == "--abi-deferred-concurrent") AbiDeferredConcurrent();
             else if (abiMode == "--abi-deferred-pixel") AbiDeferredPixel();
             else if (abiMode == "--abi-deferred-stages") AbiDeferredStages();
             else if (abiMode == "--abi-deferred-undecodable-state") AbiDeferredUndecodableState();
@@ -1318,6 +1471,7 @@ int main(int argc, char** argv) {
         device.reset();
         SharedCodeHeaders();
         RelocatedHeaders();
+        CommittedAbis();
         RegistrationWithoutSpecials();
         Registration(argc == 2);
         std::cout << "prepared shader and transactional registration tests passed\n";
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ProgramWritesMemory.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ProgramWritesMemory.cpp
new file mode 100644
index 0000000000..9efc1296de
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ProgramWritesMemory.cpp
@@ -0,0 +1,48 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/Shaders/ShaderRegistry.hpp"
+#include "prx/libc/include/Shutdown.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <initializer_list>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+constexpr std::uint32_t EndProgram = 0xbf810000u;
+
+bool writes(std::initializer_list<std::uint32_t> words) {
+    AgcDriver::DriverDetail::ShaderSnapshot snapshot{};
+    snapshot.code.assign(words.begin(), words.end());
+    return AgcDriver::DriverDetail::ProgramWritesMemory(snapshot, 0);
+}
+
+void expect(bool condition, const std::string& what) {
+    if (!condition) throw std::runtime_error("program memory writes: " + what);
+}
+
+}
+
+int main() {
+    try {
+        expect(!writes({0xf800000fu, 0x00000000u, EndProgram}), "an export-only program writes memory");
+        expect(!writes({0xe0300000u, 0x80000100u, EndProgram}), "a buffer load writes memory");
+        expect(writes({0xe0700000u, 0x80000100u, EndProgram}), "a buffer store does not write memory");
+        expect(writes({0xf0200f00u, 0x00000000u, EndProgram}), "an image store does not write memory");
+        expect(writes({0xd8360000u, 0x00000000u, EndProgram}), "a GDS write does not write memory");
+        expect(writes({0xbe802000u, EndProgram}), "an indirect jump is treated as reading only");
+        expect(writes({0x7e000280u}), "code that never ends decodes as reading only");
+        AgcDriver::DriverDetail::ShaderSnapshot store{};
+        store.code = {0xe0700000u, 0x80000100u, EndProgram};
+        expect(AgcDriver::DriverDetail::ProgramWritesMemory(store, 0) && AgcDriver::DriverDetail::ProgramWritesMemory(store, 0), "the cached answer differs");
+        expect(!AgcDriver::DriverDetail::ProgramWritesMemory(store, 2), "the program from an offset past the store writes memory");
+        LibcRunShutdown_nid_postfix();
+        std::puts("program memory writes tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try { LibcRunShutdown_nid_postfix(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp
index 00f3ca4d2e..b1b08b90c9 100755
--- a/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/QueueZeroLateInterrupt.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver/Synchronization/SynchronizationStatistics.hpp"
@@ -27,9 +28,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-extern "C" int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-
 namespace {
 
 constexpr std::uint32_t Lanes = 32;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp
new file mode 100644
index 0000000000..66a3c78357
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/RcpHardware.cpp
@@ -0,0 +1,162 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdlib>
+#include <cstdio>
+#include <iostream>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::array<std::array<std::uint32_t, 2>, 256> Measured{{
+    {0x000000u, 0x3f800000u}, {0x002922u, 0x3f7fadd6u}, {0x00a1a9u, 0x3f7ebe44u}, {0x010c47u, 0x3f7debceu},
+    {0x013df5u, 0x3f7d8a32u}, {0x01a87fu, 0x3f7cb9ddu}, {0x024f43u, 0x3f7b766fu}, {0x02d76du, 0x3f7a70beu},
+    {0x031690u, 0x3f79f820u}, {0x033035u, 0x3f79c742u}, {0x03adabu, 0x3f78d946u}, {0x04435bu, 0x3f77bfa4u},
+    {0x04f3a1u, 0x3f76772au}, {0x057a96u, 0x3f757df8u}, {0x05c6afu, 0x3f74f253u}, {0x06342au, 0x3f742a80u},
+    {0x06bf6fu, 0x3f732e24u}, {0x07709au, 0x3f71f00au}, {0x07eb02u, 0x3f711627u}, {0x086273u, 0x3f704304u},
+    {0x09362bu, 0x3f6ed04au}, {0x099950u, 0x3f6e2438u}, {0x09f75cu, 0x3f6d81e2u}, {0x0a097cu, 0x3f6d62b3u},
+    {0x0ab7e3u, 0x3f6c3840u}, {0x0b1a69u, 0x3f6b90f0u}, {0x0b93a5u, 0x3f6ac454u}, {0x0becd7u, 0x3f6a2eadu},
+    {0x0bf0b4u, 0x3f6a2836u}, {0x0c5c7fu, 0x3f697463u}, {0x0c9164u, 0x3f691c8au}, {0x0cb1e2u, 0x3f68e6b5u},
+    {0x0d5f89u, 0x3f67c8a0u}, {0x0dd27au, 0x3f670cc6u}, {0x0e09e4u, 0x3f66b2a2u}, {0x0ead02u, 0x3f65aae2u},
+    {0x0ed904u, 0x3f656421u}, {0x0f17a3u, 0x3f64ffbeu}, {0x0f21ddu, 0x3f64ef61u}, {0x0f2bcdu, 0x3f64df7du},
+    {0x0f4205u, 0x3f64bbfeu}, {0x0f8808u, 0x3f644c6cu}, {0x0faddcu, 0x3f641050u}, {0x0fd630u, 0x3f63d05fu},
+    {0x1012f0u, 0x3f637050u}, {0x108fe7u, 0x3f62abb4u}, {0x10a3d6u, 0x3f628c77u}, {0x1184b9u, 0x3f612e5au},
+    {0x119a72u, 0x3f610cc2u}, {0x11e20bu, 0x3f609e4fu}, {0x123f59u, 0x3f600f00u}, {0x128b2fu, 0x3f5f9b0du},
+    {0x12bd4au, 0x3f5f4eb3u}, {0x12f18du, 0x3f5eff48u}, {0x135d16u, 0x3f5e5c8du}, {0x13deefu, 0x3f5d994bu},
+    {0x140ceeu, 0x3f5d5472u}, {0x14a0f9u, 0x3f5c77fdu}, {0x14f473u, 0x3f5bfc70u}, {0x15051au, 0x3f5be3dau},
+    {0x153e7cu, 0x3f5b8f4fu}, {0x15b949u, 0x3f5adb3au}, {0x1600a3u, 0x3f5a7320u}, {0x1676ebu, 0x3f59c766u},
+    {0x172abbu, 0x3f58c45au}, {0x1738f7u, 0x3f58aff3u}, {0x17a05au, 0x3f581c33u}, {0x17f5e8u, 0x3f57a288u},
+    {0x1818e8u, 0x3f5770e9u}, {0x185f1au, 0x3f570da8u}, {0x18f135u, 0x3f564038u}, {0x194f2fu, 0x3f55bce2u},
+    {0x1a61dbu, 0x3f54409cu}, {0x1a63e2u, 0x3f543dd2u}, {0x1af098u, 0x3f537d12u}, {0x1bd958u, 0x3f52413au},
+    {0x1cb224u, 0x3f511e54u}, {0x1deb7au, 0x3f4f7f68u}, {0x1df9fdu, 0x3f4f6c59u}, {0x1e27a1u, 0x3f4f307du},
+    {0x1e398fu, 0x3f4f1903u}, {0x1ef9d8u, 0x3f4e1e85u}, {0x1fb17cu, 0x3f4d317eu}, {0x1fec12u, 0x3f4ce652u},
+    {0x202036u, 0x3f4ca39au}, {0x20b671u, 0x3f4be450u}, {0x211c70u, 0x3f4b633bu}, {0x21b455u, 0x3f4aa42eu},
+    {0x2217beu, 0x3f4a27e7u}, {0x22c947u, 0x3f494b6eu}, {0x230d97u, 0x3f48f719u}, {0x23a75fu, 0x3f483a41u},
+    {0x244f6fu, 0x3f476d74u}, {0x24ede6u, 0x3f46add8u}, {0x250d33u, 0x3f46882au}, {0x254b0cu, 0x3f463de2u},
+    {0x263ba6u, 0x3f451ef3u}, {0x269e0du, 0x3f44aa89u}, {0x26a2c0u, 0x3f44a4fdu}, {0x26bb7du, 0x3f4487d0u},
+    {0x26e875u, 0x3f4452ddu}, {0x2744e3u, 0x3f43e660u}, {0x281972u, 0x3f42eeaau}, {0x29b882u, 0x3f4111f2u},
+    {0x2a3af4u, 0x3f407e00u}, {0x2a96fbu, 0x3f401628u}, {0x2afa95u, 0x3f3fa642u}, {0x2b0537u, 0x3f3f9a58u},
+    {0x2baf6au, 0x3f3edc66u}, {0x2c7557u, 0x3f3e015au}, {0x2d1c9au, 0x3f3d49c5u}, {0x2d711au, 0x3f3ced8cu},
+    {0x2e0531u, 0x3f3c4cc6u}, {0x2e4415u, 0x3f3c08d1u}, {0x2e8e7du, 0x3f3bb8aau}, {0x2eae05u, 0x3f3b96c8u},
+    {0x2fa54eu, 0x3f3a8eaeu}, {0x301850u, 0x3f3a14d7u}, {0x30d16au, 0x3f39520au}, {0x31f5efu, 0x3f38216cu},
+    {0x32c6ecu, 0x3f374a2du}, {0x33d0ceu, 0x3f363b28u}, {0x34b9b5u, 0x3f355051u}, {0x34c9ebu, 0x3f35400eu},
+    {0x364b9du, 0x3f33c092u}, {0x36f675u, 0x3f3318bau}, {0x376cbfu, 0x3f32a53au}, {0x37dc76u, 0x3f3238afu},
+    {0x387a34u, 0x3f31a04au}, {0x3898d1u, 0x3f3182d5u}, {0x392630u, 0x3f30fb4bu}, {0x398406u, 0x3f30a1c6u},
+    {0x3aa8b5u, 0x3f2f8cd0u}, {0x3b1287u, 0x3f2f2983u}, {0x3b6186u, 0x3f2edfabu}, {0x3bbbe9u, 0x3f2e8b79u},
+    {0x3bfb1eu, 0x3f2e50c8u}, {0x3cf38cu, 0x3f2d6b98u}, {0x3d9c17u, 0x3f2cd172u}, {0x3e7d1bu, 0x3f2c054du},
+    {0x3e875fu, 0x3f2bfc08u}, {0x3f63afu, 0x3f2b360fu}, {0x3f98e2u, 0x3f2b0685u}, {0x3fa7d9u, 0x3f2af92au},
+    {0x407b49u, 0x3f2a3d5au}, {0x4174afu, 0x3f2961e2u}, {0x427df9u, 0x3f287ad8u}, {0x43435cu, 0x3f27d089u},
+    {0x437bcbu, 0x3f27a016u}, {0x44985eu, 0x3f26ad72u}, {0x451abdu, 0x3f263f34u}, {0x457d42u, 0x3f25ec44u},
+    {0x472077u, 0x3f248ef6u}, {0x4724dau, 0x3f248b56u}, {0x47469au, 0x3f246f78u}, {0x482c9cu, 0x3f23b287u},
+    {0x486824u, 0x3f2381e6u}, {0x48db40u, 0x3f232432u}, {0x499523u, 0x3f228dc2u}, {0x49b64au, 0x3f22730au},
+    {0x49dea9u, 0x3f22528du}, {0x4a23d5u, 0x3f221b02u}, {0x4b14f9u, 0x3f215a86u}, {0x4c25fcu, 0x3f2082beu},
+    {0x4cbd87u, 0x3f200befu}, {0x4cdd20u, 0x3f1ff340u}, {0x4dd422u, 0x3f1f334cu}, {0x4ef8aau, 0x3f1e5249u},
+    {0x4f20f3u, 0x3f1e337eu}, {0x4f426du, 0x3f1e19f1u}, {0x5051c1u, 0x3f1d4c05u}, {0x506bf2u, 0x3f1d3841u},
+    {0x507313u, 0x3f1d32e0u}, {0x519088u, 0x3f1c5cc0u}, {0x520935u, 0x3f1c02eau}, {0x52e6b4u, 0x3f1b5f10u},
+    {0x536d35u, 0x3f1afc38u}, {0x54a6d8u, 0x3f1a17a2u}, {0x55c663u, 0x3f19485eu}, {0x56ed5bu, 0x3f187600u},
+    {0x571242u, 0x3f185bd8u}, {0x5790f8u, 0x3f180249u}, {0x57ee05u, 0x3f17c0c8u}, {0x588a7eu, 0x3f175320u},
+    {0x58d556u, 0x3f171ee4u}, {0x59a54au, 0x3f168e80u}, {0x59f999u, 0x3f165444u}, {0x5affb2u, 0x3f15a05bu},
+    {0x5b855cu, 0x3f15453fu}, {0x5bd86du, 0x3f150cd9u}, {0x5c90a9u, 0x3f149059u}, {0x5cd546u, 0x3f146230u},
+    {0x5d9dc9u, 0x3f13dbf0u}, {0x5e14d9u, 0x3f138caau}, {0x5e8766u, 0x3f1340b6u}, {0x5f41cau, 0x3f12c5c6u},
+    {0x5f5572u, 0x3f12b8dcu}, {0x60fd9bu, 0x3f11a440u}, {0x616499u, 0x3f1161b4u}, {0x625d1cu, 0x3f10c218u},
+    {0x62c33au, 0x3f1080e8u}, {0x63c0e3u, 0x3f0fdff7u}, {0x641547u, 0x3f0faabcu}, {0x64b8d7u, 0x3f0f43feu},
+    {0x651327u, 0x3f0f0b83u}, {0x658cdau, 0x3f0ebfadu}, {0x65dc9fu, 0x3f0e8e23u}, {0x662b59u, 0x3f0e5d60u},
+    {0x66d228u, 0x3f0df67eu}, {0x670f27u, 0x3f0dd104u}, {0x67e4c4u, 0x3f0d4e61u}, {0x6916adu, 0x3f0c94eeu},
+    {0x6a50dfu, 0x3f0bd86cu}, {0x6a7a5au, 0x3f0bbfaeu}, {0x6b0a18u, 0x3f0b6a37u}, {0x6b0d54u, 0x3f0b684cu},
+    {0x6b4013u, 0x3f0b4a3au}, {0x6b4cb2u, 0x3f0b42c1u}, {0x6bd361u, 0x3f0af338u}, {0x6bf46cu, 0x3f0adfc3u},
+    {0x6cad4au, 0x3f0a734au}, {0x6cb93du, 0x3f0a6c4cu}, {0x6d76b0u, 0x3f09fdddu}, {0x6dc676u, 0x3f09cf92u},
+    {0x6e36aau, 0x3f098ea8u}, {0x6f0367u, 0x3f0918d3u}, {0x6fa5cau, 0x3f08bbedu}, {0x70c958u, 0x3f08165eu},
+    {0x71e6c2u, 0x3f0775ccu}, {0x721583u, 0x3f075ba3u}, {0x72e6ccu, 0x3f06e703u}, {0x72fdf2u, 0x3f06da29u},
+    {0x73596du, 0x3f06a778u}, {0x7403e4u, 0x3f064966u}, {0x744916u, 0x3f06235cu}, {0x74c9dfu, 0x3f05dccau},
+    {0x74e69au, 0x3f05cd16u}, {0x756dbau, 0x3f05836cu}, {0x7631a9u, 0x3f05192au}, {0x7731afu, 0x3f048f50u},
+    {0x7774a2u, 0x3f046b72u}, {0x791a7cu, 0x3f038b32u}, {0x795e82u, 0x3f036751u}, {0x7aa2c1u, 0x3f02bd52u},
+    {0x7c2684u, 0x3f01f444u}, {0x7c64ebu, 0x3f01d422u}, {0x7d2cafu, 0x3f016db2u}, {0x7d959fu, 0x3f013822u},
+    {0x7e62aau, 0x3f00cffbu}, {0x7ebff2u, 0x3f00a0d0u}, {0x7eecf4u, 0x3f008a1au}, {0x7f1505u, 0x3f0075eau},
+    {0x7f1b10u, 0x3f0072dfu}, {0x7f2614u, 0x3f006d53u}, {0x7ff486u, 0x3f0005beu}, {0x7fffffu, 0x3f000001u},
+}};
+constexpr std::array<std::uint32_t, 6> Exponents{1u, 60u, 127u, 128u, 200u, 252u};
+constexpr std::uint32_t Cases = static_cast<std::uint32_t>(Measured.size() * Exponents.size() * 2u);
+constexpr std::uint32_t Batches = Cases / Threads;
+alignas(256) std::array<std::uint32_t, Threads> Input{};
+alignas(256) std::array<std::uint32_t, Threads> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 9> Code{
+    0x34020082, 0xe0301000, 0x80000201, 0xbf8c3f70, 0x7e065502, 0xe0701000, 0x80010301, 0xbf8c3f70,
+    0xbf810000,
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::uint32_t Sample(std::uint32_t index) {
+    const auto& measured = Measured[index % Measured.size()];
+    const auto exponent = Exponents[(index / Measured.size()) % Exponents.size()];
+    const auto sign = (index / static_cast<std::uint32_t>(Measured.size() * Exponents.size())) << 31u;
+    return sign | exponent << 23u | measured[0];
+}
+
+std::uint32_t Expected(std::uint32_t index) {
+    const auto& measured = Measured[index % Measured.size()];
+    const auto exponent = Exponents[(index / Measured.size()) % Exponents.size()];
+    const auto sign = (index / static_cast<std::uint32_t>(Measured.size() * Exponents.size())) << 31u;
+    return sign | ((measured[1] >> 23u) + 127u - exponent) << 23u | (measured[1] & 0x7fffffu);
+}
+}
+
+int main() {
+    try {
+        if (std::getenv("APS5_EXACT_RCP") == nullptr) return VulkanTestSkipped;
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        std::vector<std::uint32_t> userData(8, 0u);
+        const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+        const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+        std::copy(input.begin(), input.end(), userData.begin());
+        std::copy(output.begin(), output.end(), userData.begin() + 4);
+        const std::span<const std::uint32_t> code(Code);
+        const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+        const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+        ShaderRecompiler::RecompileRequest request{
+            {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+            {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+            device->Target(),
+            {0, 0, 0, 128}
+        };
+        request.useCache = false;
+        request.context.floatMode = ShaderRecompiler::ShaderFloatMode{0xf0u, true, true, false};
+        const auto result = ShaderRecompiler::Recompile(request);
+        for (std::uint32_t batch = 0; batch < Batches; ++batch) {
+            for (std::uint32_t tid = 0; tid < Threads; ++tid) Input[tid] = Sample(batch * Threads + tid);
+            Output.fill(0xdeadbeefu);
+            device->Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+            device->WaitIdle();
+            for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+                const auto wanted = Expected(batch * Threads + tid);
+                Require(Output[tid] == wanted, std::string("v_rcp_f32 of ") + Hex(Input[tid]) + " is " + Hex(Output[tid]) + ", expected the RDNA 2 value " + Hex(wanted));
+            }
+        }
+        std::puts("rcp hardware tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp
index 0657f99bca..eeeb0fd05c 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/RectListCorner.cpp
@@ -2,6 +2,9 @@
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
 #include "Recompiler.hpp"
 #include "SpirvBackend/SpirvModule.hpp"
+#if ANYPS5_ENABLE_SPIRV_TOOLS
+#include "SpirvBackend/SpirvOptimizer.hpp"
+#endif
 #include "VulkanTestDevice.hpp"
 #include <array>
 #include <bit>
@@ -46,8 +49,11 @@ public:
         builder.EmitEntryPoint(spv::ExecutionModelVertex, main, "main", {vertexIndex, position, identity});
         result(spv::OpLabel);
         const auto index = result(spv::OpLoad, intType, vertexIndex);
-        const auto first = result(spv::OpIEqual, boolType, index, constant(intType, 0u));
-        const auto second = result(spv::OpIEqual, boolType, index, constant(intType, 1u));
+        const auto boolVectorType = type(spv::OpTypeVector, boolType, 4u);
+        const auto firstScalar = result(spv::OpIEqual, boolType, index, constant(intType, 0u));
+        const auto secondScalar = result(spv::OpIEqual, boolType, index, constant(intType, 1u));
+        const auto first = result(spv::OpCompositeConstruct, boolVectorType, firstScalar, firstScalar, firstScalar, firstScalar);
+        const auto second = result(spv::OpCompositeConstruct, boolVectorType, secondScalar, secondScalar, secondScalar, secondScalar);
         const auto positionValue = result(spv::OpSelect, vec4Type, first, vector(-1.0f, -1.0f, 0.0f, 1.0f), result(spv::OpSelect, vec4Type, second, vector(1.0f, -1.0f, 0.0f, 1.0f), vector(-1.0f, 1.0f, 0.0f, 1.0f)));
         const auto identityValue = result(spv::OpSelect, vec4Type, first, vector(0.0f, 0.0f, 0.0f, 1.0f), result(spv::OpSelect, vec4Type, second, vector(1.0f, 0.0f, 0.0f, 1.0f), vector(0.0f, 1.0f, 0.0f, 1.0f)));
         emit(spv::OpStore, position, positionValue);
@@ -128,19 +134,24 @@ std::uint32_t VertexOf(std::uint32_t x, std::uint32_t y) {
     return (red >= 128u ? 1u : 0u) + (green >= 128u ? 2u : 0u);
 }
 
-int Run(AgcDriver::VulkanDevice& device) {
+int Run(AgcDriver::VulkanDevice& device, std::uint32_t maximumVersion) {
     std::cout << "device: " << device.DeviceName() << "\n";
     auto target = device.Target();
     if (!target.tessellation.has_value() || !TargetHasCapability(target, spv::CapabilityTessellation)) {
         std::cout << "skipped, device has no tessellation\n";
         return VulkanTestSkipped;
     }
-    if (target.spirvVersion > 0x00010400u) target.spirvVersion = 0x00010400u;
+    if (target.spirvVersion > maximumVersion) target.spirvVersion = maximumVersion;
     Require(target.spirvVersion >= 0x00010300u, "rect-list corner draw needs SPIR-V 1.3");
+    std::cout << "SPIR-V " << (target.spirvVersion >> 16u) << "." << ((target.spirvVersion >> 8u) & 0xffu) << "\n";
     ShaderRecompiler::RecompileResult vertex;
     ShaderRecompiler::RecompileResult fragment;
     vertex.spirv = ShaderRecompiler::SharedSpirv(Emitter(target.spirvVersion).Vertex());
     fragment.spirv = ShaderRecompiler::SharedSpirv(Emitter(target.spirvVersion).Fragment());
+#if ANYPS5_ENABLE_SPIRV_TOOLS
+    static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(vertex.spirv, target.vulkanVersion, target.spirvVersion, target.nonConstantImageOffsets, false));
+    static_cast<void>(ShaderRecompiler::ValidateAndOptimizeSpirv(fragment.spirv, target.vulkanVersion, target.spirvVersion, target.nonConstantImageOffsets, false));
+#endif
     vertex.parameterExports = {0u};
     fragment.fragmentParameters = {{0u, 0u, false, false}};
     const auto rectangle = ShaderRecompiler::BuildRectListShaders(vertex, fragment, target);
@@ -194,8 +205,12 @@ int main() {
     try {
         const auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
-        const auto result = Run(*device);
+        auto result = Run(*device, 0x00010300u);
         if (result != 0) return result;
+        if (device->Target().spirvVersion >= 0x00010400u) {
+            result = Run(*device, 0x00010400u);
+            if (result != 0) return result;
+        }
         std::cout << "rect-list corner tests passed\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp
new file mode 100644
index 0000000000..bf1cc2eae4
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ResidentHeapMirror.cpp
@@ -0,0 +1,393 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ResidentMirror.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint64_t Block = 65536;
+constexpr std::uint64_t HeapBytes = 8u << 20u;
+constexpr std::uint64_t JoinedBytes = 16u << 20u;
+constexpr std::uint64_t ThreadStride = 16384;
+constexpr std::uint64_t StoreBlock = 3 * Block;
+constexpr std::uint32_t LateThread = 5;
+constexpr std::uint64_t ZeroedBlock = 2 * Block;
+
+alignas(256) constexpr std::array<std::uint32_t, 10> Code{
+    0x3404008e, 0xdc388000, 0x04000002, 0x34060082, 0xbf8c3f70, 0xe0701000, 0x80010403, 0xe0701000, 0x80020303, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> CopyCode{0x34060082, 0xe0301000, 0x80000403, 0xbf8c3f70, 0xe0701000, 0x80010403, 0xbf810000};
+
+class OutputBlock {
+public:
+    OutputBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint32_t*>(VirtualAlloc(nullptr, Block, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint32_t*>(std::aligned_alloc(Block, Block));
+#endif
+        Require(block != nullptr, "resident heap mirror: cannot allocate the output block");
+        GuestAllocations::Mutation().Add(block, Block, true, true, true);
+    }
+
+    ~OutputBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    OutputBlock(const OutputBlock&) = delete;
+    OutputBlock& operator=(const OutputBlock&) = delete;
+
+    std::uint32_t* Data() const { return block; }
+
+private:
+    std::uint32_t* block = nullptr;
+};
+
+class GuestHeap {
+public:
+    explicit GuestHeap(bool writable, std::uint64_t ranges = 1, std::uint64_t rangeBytes = HeapBytes, void* at = nullptr) : ranges(ranges), rangeBytes(rangeBytes) {
+        const auto bytes = rangeBytes * ranges;
+#ifdef _WIN32
+        raw = at == nullptr ? GuestArena::GuestArenaAllocate_nid_postfix(bytes, Block)
+                            : GuestArena::GuestArenaAllocateAtOrAbove_nid_postfix(reinterpret_cast<std::uintptr_t>(at), bytes, Block);
+        Require(raw != nullptr && (at == nullptr || raw == at), "resident heap mirror: cannot allocate the guest heap");
+        GuestArena::GuestArenaCommit_nid_postfix(raw, bytes, PAGE_READWRITE, bytes);
+        base = static_cast<std::uint8_t*>(raw);
+#else
+        raw = mmap(at, bytes + Block, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE | (at != nullptr ? MAP_FIXED_NOREPLACE : 0), -1, 0);
+        Require(raw != MAP_FAILED && (at == nullptr || raw == at), "resident heap mirror: cannot map the guest heap");
+        base = reinterpret_cast<std::uint8_t*>((reinterpret_cast<std::uintptr_t>(raw) + Block - 1) / Block * Block);
+#endif
+        GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(base, bytes);
+        GuestAllocations::Mutation mutation;
+        for (std::uint64_t range = 0; range < ranges; ++range) mutation.Add(base + range * rangeBytes, rangeBytes, true, writable, true);
+    }
+
+    ~GuestHeap() {
+        {
+            GuestAllocations::Mutation mutation;
+            for (std::uint64_t range = 0; range < ranges; ++range) mutation.Remove(base + range * rangeBytes);
+        }
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(base, rangeBytes * ranges);
+#ifdef _WIN32
+        GuestArena::GuestArenaReset_nid_postfix(raw, rangeBytes * ranges);
+        GuestArena::GuestArenaRelease_nid_postfix(raw, rangeBytes * ranges);
+#else
+        munmap(raw, rangeBytes * ranges + Block);
+#endif
+    }
+
+    GuestHeap(const GuestHeap&) = delete;
+    GuestHeap& operator=(const GuestHeap&) = delete;
+
+    std::uint8_t* Data() const { return base; }
+    void* Raw() const { return raw; }
+    std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(base); }
+
+    void Store(std::uint64_t offset, std::uint32_t value) const { std::memcpy(base + offset, &value, sizeof(value)); }
+
+    std::uint32_t Load(std::uint64_t offset) const {
+        std::uint32_t value = 0;
+        std::memcpy(&value, base + offset, sizeof(value));
+        return value;
+    }
+
+private:
+    std::uint64_t ranges = 1;
+    std::uint64_t rangeBytes = HeapBytes;
+    void* raw = nullptr;
+    std::uint8_t* base = nullptr;
+};
+
+struct ImportBudget {
+    explicit ImportBudget(std::uint64_t bytes) { AgcDriver::Graphics::SetHostImportBudget(bytes); }
+    ~ImportBudget() { AgcDriver::Graphics::SetHostImportBudget(0); }
+    ImportBudget(const ImportBudget&) = delete;
+    ImportBudget& operator=(const ImportBudget&) = delete;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(std::uint64_t address, std::uint32_t bytes) {
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint64_t value) {
+    char text[24];
+    std::snprintf(text, sizeof(text), "0x%llx", static_cast<unsigned long long>(value));
+    return text;
+}
+
+std::uint32_t Pattern(std::uint32_t thread) {
+    return 0x5a000000u + thread * 0x00010203u + 1u;
+}
+
+void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData) {
+    const std::array<ShaderRecompiler::MemoryRegion, 1> regions{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, regions},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void Dispatch(AgcDriver::VulkanDevice& device, std::uint64_t read, std::uint64_t written, const OutputBlock& output) {
+    std::fill(output.Data(), output.Data() + Threads, 0xdeadbeefu);
+    std::vector<std::uint32_t> userData(12, 0u);
+    userData[0] = static_cast<std::uint32_t>(read);
+    userData[1] = static_cast<std::uint32_t>(read >> 32u);
+    const auto out = BufferDescriptor(reinterpret_cast<std::uintptr_t>(output.Data()), static_cast<std::uint32_t>(Threads * sizeof(std::uint32_t)));
+    const auto store = BufferDescriptor(written + StoreBlock, static_cast<std::uint32_t>(Threads * sizeof(std::uint32_t)));
+    std::copy(out.begin(), out.end(), userData.begin() + 4);
+    std::copy(store.begin(), store.end(), userData.begin() + 8);
+    Run(device, Code, userData);
+}
+
+void Dispatch(AgcDriver::VulkanDevice& device, const GuestHeap& read, const GuestHeap& written, const OutputBlock& output) {
+    Dispatch(device, read.Address(), written.Address(), output);
+}
+
+void Copy(AgcDriver::VulkanDevice& device, std::uint64_t source, const OutputBlock& output) {
+    std::fill(output.Data(), output.Data() + Threads, 0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto in = BufferDescriptor(source, static_cast<std::uint32_t>(Threads * sizeof(std::uint32_t)));
+    const auto out = BufferDescriptor(reinterpret_cast<std::uintptr_t>(output.Data()), static_cast<std::uint32_t>(Threads * sizeof(std::uint32_t)));
+    std::copy(in.begin(), in.end(), userData.begin());
+    std::copy(out.begin(), out.end(), userData.begin() + 4);
+    Run(device, CopyCode, userData);
+}
+
+void CheckReads(const OutputBlock& output, const std::string& step, bool late) {
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+        const auto expected = thread * ThreadStride < Block ? Pattern(thread) : late && thread == LateThread ? Pattern(thread) : 0u;
+        Require(output.Data()[thread] == expected, "resident heap mirror: " + step + ": thread " + std::to_string(thread) + " read " + Hex(output.Data()[thread]) + " at heap offset " + Hex(thread * ThreadStride) + ", expected " + Hex(expected));
+    }
+}
+
+void CheckStores(const GuestHeap& written, const std::string& step) {
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+        const auto value = written.Load(StoreBlock + thread * sizeof(std::uint32_t));
+        Require(value == thread * 4u, "resident heap mirror: " + step + ": the GPU store of thread " + std::to_string(thread) + " into a never-written heap block reached the guest as " + Hex(value) + ", expected " + Hex(thread * 4u));
+    }
+}
+
+void CheckHeld(std::uint64_t before, std::uint64_t written, const std::string& step) {
+    const auto held = AgcDriver::Graphics::MirrorCounters().heapBytes - before;
+    Require(held == written, "resident heap mirror: " + step + ": the heap mirrors of two " + std::to_string(HeapBytes >> 10u) + " KiB heaps hold " + std::to_string(held >> 10u) + " KiB of device memory; the guest and the GPU wrote " + std::to_string(written >> 10u) + " KiB of them");
+}
+
+void ResidentTests(AgcDriver::VulkanDevice& device) {
+    GuestHeap read(false);
+    GuestHeap written(true);
+    const OutputBlock output;
+    for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) read.Store(thread * ThreadStride, Pattern(thread));
+    written.Store(16, 0x77u);
+    const ImportBudget budget(AgcDriver::Graphics::HostImportLiveBytes() + Block);
+    const auto before = AgcDriver::Graphics::MirrorCounters();
+    Dispatch(device, read, written, output);
+    const auto made = AgcDriver::Graphics::MirrorCounters();
+    Require(made.heapMirrors == before.heapMirrors + 2, "resident heap mirror: the two heaps were not heap mirrored (" + std::to_string(made.heapMirrors - before.heapMirrors) + " mirrors made)");
+    CheckHeld(before.heapBytes, 3 * Block, "first dispatch");
+    CheckReads(output, "first dispatch", false);
+    CheckStores(written, "first dispatch");
+    Require(written.Load(16) == 0x77u, "resident heap mirror: the written heap's guest bytes changed");
+    read.Store(LateThread * ThreadStride, Pattern(LateThread));
+    std::memset(read.Data() + ZeroedBlock, 0, Block);
+    Dispatch(device, read, written, output);
+    CheckHeld(before.heapBytes, 4 * Block, "after a guest write into a never-written block and zeros written into another");
+    CheckReads(output, "after a guest write into a never-written block", true);
+    const auto steady = AgcDriver::Graphics::MirrorCounters();
+    Dispatch(device, read, written, output);
+    const auto again = AgcDriver::Graphics::MirrorCounters();
+    Require(again.rebuilds == steady.rebuilds && again.heapBytes == steady.heapBytes, "resident heap mirror: an unchanged dispatch rebuilt or grew the heap mirrors");
+    CheckReads(output, "unchanged dispatch", true);
+    CheckStores(written, "unchanged dispatch");
+}
+
+struct AddressSpaceLimit {
+    explicit AddressSpaceLimit(std::uint64_t bytes) { AgcDriver::Graphics::SetResidentAddressSpaceLimit(bytes); }
+    ~AddressSpaceLimit() { AgcDriver::Graphics::SetResidentAddressSpaceLimit(0); }
+    AddressSpaceLimit(const AddressSpaceLimit&) = delete;
+    AddressSpaceLimit& operator=(const AddressSpaceLimit&) = delete;
+};
+
+void CopiedTests(AgcDriver::VulkanDevice& device) {
+    const AddressSpaceLimit limit(1);
+    GuestHeap read(false);
+    GuestHeap written(true);
+    const OutputBlock output;
+    for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) read.Store(thread * ThreadStride, Pattern(thread));
+    written.Store(16, 0x77u);
+    const ImportBudget budget(AgcDriver::Graphics::HostImportLiveBytes() + Block);
+    const auto before = AgcDriver::Graphics::MirrorCounters();
+    Dispatch(device, read, written, output);
+    const auto made = AgcDriver::Graphics::MirrorCounters();
+    Require(made.heapMirrors == before.heapMirrors + 2, "copied heap mirror: the two heaps were not heap mirrored without sparse address space (" + std::to_string(made.heapMirrors - before.heapMirrors) + " mirrors made)");
+    Require(made.heapBytes - before.heapBytes == 2 * HeapBytes, "copied heap mirror: two " + std::to_string(HeapBytes >> 10u) + " KiB heaps without sparse address space hold " + std::to_string((made.heapBytes - before.heapBytes) >> 10u) + " KiB, expected whole copies");
+    CheckReads(output, "copied, first dispatch", false);
+    CheckStores(written, "copied, first dispatch");
+    Require(written.Load(16) == 0x77u, "copied heap mirror: the written heap's guest bytes changed");
+    read.Store(LateThread * ThreadStride, Pattern(LateThread));
+    Dispatch(device, read, written, output);
+    CheckReads(output, "copied, after a guest write", true);
+    CheckStores(written, "copied, after a guest write");
+}
+
+struct ImportWindow {
+    explicit ImportWindow(std::uint64_t bytes) { AgcDriver::Graphics::SetHostImportRangeWindow(bytes); }
+    ~ImportWindow() { AgcDriver::Graphics::SetHostImportRangeWindow(std::uint64_t{64} << 20u); }
+    ImportWindow(const ImportWindow&) = delete;
+    ImportWindow& operator=(const ImportWindow&) = delete;
+};
+
+void PartialImportTests(AgcDriver::VulkanDevice& device, bool copied, bool readFirst) {
+    const AddressSpaceLimit limit(copied ? 1 : 0);
+    const ImportWindow window(2 * Block);
+    GuestHeap first(!readFirst);
+    GuestHeap second(readFirst);
+    const auto& read = readFirst ? first : second;
+    const auto& written = readFirst ? second : first;
+    const OutputBlock output;
+    const auto tail = HeapBytes - Block;
+    for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) read.Store(thread * ThreadStride, Pattern(thread));
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+        read.Store(tail + thread * sizeof(std::uint32_t), Pattern(thread));
+        written.Store(tail + thread * sizeof(std::uint32_t), Pattern(thread));
+    }
+    const ImportBudget budget(AgcDriver::Graphics::HostImportLiveBytes() + 3 * Block);
+    Dispatch(device, read, written, output);
+    CheckReads(output, "partial heap import", false);
+    const auto& selected = read.Address() < written.Address() ? read : written;
+    const auto* prefix = AgcDriver::Graphics::ExistingHostImportFor(device.graphicsContext(), selected.Address(), 2 * Block);
+    Require(prefix != nullptr && prefix->base == selected.Address() && prefix->bytes == 2 * Block, "partial heap import: the first registered heap has no exact two-block imported prefix");
+    const auto held = AgcDriver::Graphics::HeapMirrorsWithin(selected.Address(), selected.Address() + HeapBytes);
+    const auto expected = copied ? HeapBytes - prefix->bytes : (selected.Address() == read.Address() ? Block : 2 * Block);
+    Require(held.mirrors == 1 && held.bytes == expected, "partial heap import: its mirror holds " + std::to_string(held.bytes) + " bytes, expected " + std::to_string(expected));
+    Copy(device, selected.Address() + tail, output);
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) Require(output.Data()[thread] == Pattern(thread), "partial heap import: GPU read of the mirrored tail lost its contents");
+    selected.Store(tail + 2 * sizeof(std::uint32_t), 0x12345678u);
+    Copy(device, selected.Address() + tail, output);
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) Require(output.Data()[thread] == (thread == 2 ? 0x12345678u : Pattern(thread)), "partial heap import: refresh lost a CPU write or its unchanged neighbors");
+    const auto refreshed = AgcDriver::Graphics::HeapMirrorsWithin(selected.Address(), selected.Address() + HeapBytes);
+    Require(refreshed.mirrors == 1 && refreshed.bytes == expected, "partial heap import: refreshing the selected tail changed its accounted extent");
+}
+
+void ReusedAddressTests(AgcDriver::VulkanDevice& device) {
+    GuestHeap written(true);
+    const OutputBlock output;
+    const ImportBudget budget(AgcDriver::Graphics::HostImportLiveBytes() + Block);
+    void* at = nullptr;
+    std::uint64_t address = 0;
+    {
+        GuestHeap first(false);
+        for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) first.Store(thread * ThreadStride, Pattern(thread));
+        Dispatch(device, first, written, output);
+        CheckReads(output, "the first heap", false);
+        at = first.Raw();
+        address = first.Address();
+    }
+    GuestHeap second(false, 1, HeapBytes, at);
+    Require(second.Address() == address, "resident heap mirror: the second heap did not take the first heap's address");
+    for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) second.Store(thread * ThreadStride, ~Pattern(thread));
+    Dispatch(device, second, written, output);
+    for (std::uint32_t thread = 0; thread < Threads; ++thread) {
+        const auto expected = thread * ThreadStride < Block ? ~Pattern(thread) : 0u;
+        Require(output.Data()[thread] == expected, "resident heap mirror: a heap mapped where a mirrored heap was freed: thread " + std::to_string(thread) + " read " + Hex(output.Data()[thread]) + ", expected " + Hex(expected));
+    }
+    const auto held = AgcDriver::Graphics::HeapMirrorsWithin(address, address + HeapBytes);
+    Require(held.mirrors == 1 && held.bytes == Block, "resident heap mirror: a heap mapped where a mirrored heap was freed holds " + std::to_string(held.mirrors) + " live heap mirrors (" + std::to_string(held.bytes >> 10u) + " KiB), expected 1 (64 KiB)");
+}
+
+void JoinedImportTests(AgcDriver::VulkanDevice& device) {
+    GuestHeap pair(true, 2, JoinedBytes);
+    const OutputBlock output;
+    const auto begin = pair.Address();
+    const auto end = begin + 2 * JoinedBytes;
+    for (std::uint32_t thread = 0; thread * ThreadStride < Block; ++thread) pair.Store(thread * ThreadStride, Pattern(thread));
+    pair.Store(JoinedBytes - sizeof(std::uint32_t), 0x41u);
+    pair.Store(JoinedBytes, 0x42u);
+    const auto before = AgcDriver::Graphics::HeapMirrorsWithin(begin, end);
+    {
+        const ImportBudget budget(AgcDriver::Graphics::HostImportLiveBytes() + Block);
+        Dispatch(device, begin, begin + JoinedBytes, output);
+        CheckReads(output, "two adjacent heaps", false);
+    }
+    const auto mirrored = AgcDriver::Graphics::HeapMirrorsWithin(begin, end);
+    Require(before.mirrors == 0 && mirrored.mirrors == 2 && mirrored.bytes == 4 * Block, "resident heap mirror: two adjacent heaps hold " + std::to_string(before.mirrors) + " heap mirrors before the first dispatch and " + std::to_string(mirrored.mirrors) + " (" + std::to_string(mirrored.bytes >> 10u) + " KiB) after it, expected 0 and 2 (256 KiB); " + std::to_string(AgcDriver::Graphics::HostImportLiveBytes() >> 10u) + " KiB host imports live");
+    const auto live = AgcDriver::Graphics::HostImportLiveBytes();
+    Copy(device, begin + JoinedBytes - Threads * sizeof(std::uint32_t) / 2, output);
+    Require(output.Data()[Threads / 2 - 1] == 0x41u && output.Data()[Threads / 2] == 0x42u, "resident heap mirror: a view across two adjacent heaps read " + Hex(output.Data()[Threads / 2 - 1]) + " " + Hex(output.Data()[Threads / 2]) + ", expected 0x41 0x42");
+    const auto joined = AgcDriver::Graphics::HostImportLiveBytes() - live;
+    Require(joined >= 2 * JoinedBytes, "resident heap mirror: a view across two adjacent heaps made no joined host import (" + std::to_string(joined >> 10u) + " KiB imported)");
+    Dispatch(device, begin, begin + JoinedBytes, output);
+    CheckReads(output, "after the joined import", false);
+    const auto released = AgcDriver::Graphics::HeapMirrorsWithin(begin, end);
+    Require(released.mirrors == 0 && released.bytes == 0, "resident heap mirror: a joined host import over two heap-mirrored heaps left " + std::to_string(released.mirrors) + " of their " + std::to_string(mirrored.mirrors) + " heap mirrors and " + std::to_string(released.bytes >> 10u) + " of " + std::to_string(mirrored.bytes >> 10u) + " KiB held");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+#ifdef _WIN32
+        const bool watched = GuestArena::GuestArenaWriteWatched_nid_postfix();
+#else
+        const bool watched = GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix();
+#endif
+        if (!watched) {
+            std::puts("skipped, no guest write watch: heap mirrors need one");
+            return VulkanTestSkipped;
+        }
+        ResidentTests(*device);
+        ReusedAddressTests(*device);
+        JoinedImportTests(*device);
+        CopiedTests(*device);
+        for (const bool copied : {false, true}) {
+            for (const bool readFirst : {false, true}) PartialImportTests(*device, copied, readFirst);
+        }
+        std::puts("resident heap mirror tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp
index 4d4f77cca1..69392bd173 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampleMultisampleTarget.cpp
@@ -9,6 +9,9 @@
 #include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/State.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/GuestWriteWatch.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "Recompiler.hpp"
 #include "Optimization/ResourceProgram.hpp"
 #include "VulkanTestDevice.hpp"
@@ -17,6 +20,8 @@
 #define NOMINMAX
 #endif
 #include <windows.h>
+#else
+#include <sys/mman.h>
 #endif
 #include <algorithm>
 #include <array>
@@ -57,9 +62,13 @@ constexpr std::uint32_t Float16x4Info = 0x0730u;
 constexpr std::uint32_t MultisampledAttrib = (SampleShift << 12u) | (SampleShift << 15u);
 constexpr std::uint32_t TiledAttrib3 = 0x4dc6c000u;
 constexpr std::uint32_t Float32Export = 9;
+constexpr std::uint32_t Uint16AbgrExport = 7;
 constexpr std::uint32_t Format16161616Float = 71;
 constexpr std::uint32_t Unorm8x4SwappedInfo = 0x8828u;
+constexpr std::uint32_t Uint8x4Info = 0x8428u;
 constexpr std::uint32_t Format8888Unorm = 56;
+constexpr std::uint32_t Format8888Uint = 60;
+constexpr std::uint32_t Format8888Sint = 61;
 constexpr std::uint32_t Type2DMsaa = 14;
 constexpr std::uint32_t TileRenderTarget = 0x1b;
 constexpr std::uint32_t TileZ64KBX = 0x18;
@@ -74,6 +83,7 @@ constexpr std::uint32_t FillOnes = 0x3c003c00u;
 constexpr std::array<float, 4> Ones{1.0f, 1.0f, 1.0f, 1.0f};
 constexpr std::array<float, 4> Written{0.75f, 0.25f, 0.5f, 1.0f};
 constexpr std::uint32_t StoredSample = 1;
+constexpr std::array<std::uint32_t, 4> PointMipSampler{0u, 0xfffu << 12u, 1u << 26u, 0u};
 
 alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
     0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
@@ -86,6 +96,12 @@ constexpr std::array<float, 4> DrawnUnorm8{64.0f / 255.0f, 128.0f / 255.0f, 32.0
 alignas(256) constexpr std::array<std::uint32_t, 11> Unorm8PixelCode{
     0x7e0802ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[0]), 0x7e0a02ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[1]), 0x7e0c02ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[2]), 0x7e0e02ff, std::bit_cast<std::uint32_t>(DrawnUnorm8[3]), 0xf800180f, 0x07060504, 0xbf810000,
 };
+constexpr std::array<std::uint32_t, 4> DrawnUint8{0x12u, 0xbeu, 0x42u, 0x81u};
+alignas(256) constexpr std::array<std::uint32_t, 7> Uint8PixelCode{
+    0x7e0802ff, DrawnUint8[0] | (DrawnUint8[1] << 16u), 0x7e0a02ff, DrawnUint8[2] | (DrawnUint8[3] << 16u), 0xf8001c0f, 0x00000504, 0xbf810000,
+};
+constexpr std::uint32_t FilledSint8 = 0x81beff12u;
+constexpr std::array<std::uint32_t, 4> FilledSint8Texel{0x12u, 0xffffffffu, 0xffffffbeu, 0xffffff81u};
 
 alignas(256) constexpr std::array<std::uint32_t, 26> LoadCode{
     0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
@@ -101,6 +117,15 @@ alignas(256) constexpr std::array<std::uint32_t, 26> ArrayLoadCode{
     0x80001301, 0xbf810000,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 44> PlaneCode{
+    0x34020087, 0xe0301000, 0x80000201, 0xe0301004, 0x80000301, 0xe0301008, 0x80000401, 0xe030100c,
+    0x80000501, 0xe0301010, 0x80000601, 0xbf8c3f70, 0xf0001f08, 0x00011005, 0xf09c0f08, 0x00611402,
+    0xf0900f08, 0x00611802, 0xbf8c3f70, 0xe0701030, 0x80001001, 0xe0701034, 0x80001101, 0xe0701038,
+    0x80001201, 0xe070103c, 0x80001301, 0xe0701040, 0x80001401, 0xe0701044, 0x80001501, 0xe0701048,
+    0x80001601, 0xe070104c, 0x80001701, 0xe0701050, 0x80001801, 0xe0701054, 0x80001901, 0xe0701058,
+    0x80001a01, 0xe070105c, 0x80001b01, 0xbf810000,
+};
+
 alignas(256) constexpr std::array<std::uint32_t, 19> StoreCode{
     0x34020087, 0xe030100c, 0x80000501, 0xe0301010, 0x80000601, 0xe0301014, 0x80000701, 0xe0301018,
     0x80001001, 0xe030101c, 0x80001101, 0xe0301020, 0x80001201, 0xe0301024, 0x80001301, 0xbf8c3f70,
@@ -120,14 +145,31 @@ constexpr std::array<std::array<float, 4>, 3> Triangle{{
 alignas(256) std::array<std::uint32_t, Threads * Words> Buffer{};
 
 struct Block {
-    explicit Block(std::size_t bytes) : bytes(bytes) {
+    explicit Block(std::size_t bytes, bool watched = false) : bytes(bytes), watched(watched) {
 #ifdef _WIN32
-        data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        if (watched) {
+            data = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, BlockBytes));
+            GuestArena::GuestArenaCommit_nid_postfix(data, bytes, PAGE_READWRITE, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, bytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        }
 #else
-        data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        if (watched) {
+            void* raw = mmap(nullptr, bytes + BlockBytes, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+            Require(raw != MAP_FAILED, "cannot map the color target");
+            const auto begin = reinterpret_cast<std::uintptr_t>(raw);
+            const auto aligned = (begin + BlockBytes - 1) & ~(static_cast<std::uintptr_t>(BlockBytes) - 1);
+            if (aligned != begin) munmap(raw, aligned - begin);
+            if (aligned + bytes != begin + bytes + BlockBytes) munmap(reinterpret_cast<void*>(aligned + bytes), begin + BlockBytes - aligned);
+            data = reinterpret_cast<std::uint8_t*>(aligned);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(data, bytes);
+        } else {
+            data = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, bytes));
+        }
 #endif
-        Require(data != nullptr, "cannot allocate the multisampled color target");
+        Require(data != nullptr, "cannot allocate the color target");
         std::memset(data, 0, bytes);
+        Require(!watched || AgcDriver::GuestMemory::Watched(Address(), bytes), "the color target is not write-watched");
         GuestAllocations::Mutation mutation;
         mutation.Add(data, bytes, true, true, true);
     }
@@ -137,15 +179,26 @@ struct Block {
             mutation.Remove(data);
         }
 #ifdef _WIN32
-        VirtualFree(data, 0, MEM_RELEASE);
+        if (watched) {
+            GuestArena::GuestArenaReset_nid_postfix(data, bytes);
+            GuestArena::GuestArenaRelease_nid_postfix(data, bytes);
+        } else {
+            VirtualFree(data, 0, MEM_RELEASE);
+        }
 #else
-        std::free(data);
+        if (watched) {
+            munmap(data, bytes);
+            GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(data, bytes);
+        } else {
+            std::free(data);
+        }
 #endif
     }
     Block(const Block&) = delete;
     Block& operator=(const Block&) = delete;
     std::uint64_t Address() const { return reinterpret_cast<std::uintptr_t>(data); }
     std::size_t bytes;
+    bool watched;
     std::uint8_t* data = nullptr;
 };
 
@@ -177,6 +230,21 @@ AgcDriver::Graphics::ColorTarget DecodeSwappedTarget(const Block& block) {
     return color;
 }
 
+AgcDriver::Graphics::ColorTarget DecodeUintTarget(const Block& block) {
+    AgcDriver::Registers cx;
+    cx[0x318] = static_cast<std::uint32_t>(block.Address() >> 8u);
+    cx[0x31b] = 0;
+    cx[0x31c] = Uint8x4Info;
+    cx[0x31d] = MultisampledAttrib;
+    cx[0x3b0] = ((Side - 1u) << 14u) | (Side - 1u);
+    cx[0x3b8] = TiledAttrib3;
+    cx[0x390] = static_cast<std::uint32_t>(block.Address() >> 40u);
+    auto color = AgcDriver::Graphics::DecodeColorBuffer(cx, 0);
+    Require(color.format == VK_FORMAT_R8G8B8A8_UINT && color.samples == Samples && color.extent.width == Side && color.extent.height == Side, "the 8_8_8_8_UINT target did not decode as a 16x16 RGBA8 UINT surface of 4 samples");
+    color.uintExport = true;
+    return color;
+}
+
 void CheckSwappedSamples(const std::vector<std::array<float, 4>>& loaded) {
     const std::array<float, 4> swapped{DrawnUnorm8[2], DrawnUnorm8[1], DrawnUnorm8[0], DrawnUnorm8[3]};
     const auto codes = [](const std::array<float, 4>& texel) {
@@ -196,6 +264,19 @@ void CheckSwappedSamples(const std::vector<std::array<float, 4>>& loaded) {
     Require(drawn != 0, "no sample of the BGRA8 target holds the drawn color");
 }
 
+void CheckUintSamples(const std::vector<std::array<float, 4>>& loaded) {
+    std::size_t drawn = 0;
+    for (const auto& texel : loaded) {
+        const auto words = std::bit_cast<std::array<std::uint32_t, 4>>(texel);
+        if (words == std::array<std::uint32_t, 4>{}) continue;
+        char text[128];
+        std::snprintf(text, sizeof(text), "a sample of the 8_8_8_8_UINT target reads %08x %08x %08x %08x instead of the drawn color", words[0], words[1], words[2], words[3]);
+        Require(words == DrawnUint8, text);
+        ++drawn;
+    }
+    Require(drawn != 0, "no sample of the 8_8_8_8_UINT target holds the drawn color");
+}
+
 AgcDriver::Graphics::State TargetState(const AgcDriver::Graphics::ColorTarget& color) {
     VkPipelineColorBlendAttachmentState blend{};
     blend.colorWriteMask = 0xf;
@@ -214,7 +295,7 @@ AgcDriver::Graphics::State TargetState(const AgcDriver::Graphics::ColorTarget& c
     state.blends = {blend};
     state.blend = blend;
     state.blendConstants = {};
-    state.samples = Samples;
+    state.samples = color.samples;
     return state;
 }
 
@@ -236,7 +317,7 @@ void Draw(AgcDriver::VulkanDevice& device, const AgcDriver::Graphics::State& sta
     const auto vertexResult = ShaderRecompiler::Recompile(vertex);
     const auto vertexPush = static_cast<std::uint32_t>(vertexResult.pushConstants.size());
     const auto codeAddress = reinterpret_cast<std::uintptr_t>(pixelCode.data());
-    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, Float32Export}};
+    const AgcDriver::Registers context{{0x1b6, 0x8000}, {0x1b3, 0}, {0x1b4, 0}, {0x203, 0}, {0x1c5, state.color.uintExport ? Uint16AbgrExport : Float32Export}};
     const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{codeAddress, std::as_bytes(pixelCode)}}};
     ShaderRecompiler::RecompileRequest fragment{
         {ShaderStage::Fragment, codeAddress, pixelCode, 0, {}},
@@ -274,12 +355,13 @@ std::array<std::uint32_t, 8> TargetDescriptor(const Block& block, std::uint32_t
     };
 }
 
-ShaderRecompiler::RecompileResult CompileProgram(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::array<std::uint32_t, 8>& texture, std::vector<std::uint32_t>& userData) {
+ShaderRecompiler::RecompileResult CompileProgram(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::array<std::uint32_t, 8>& texture, std::vector<std::uint32_t>& userData, const std::array<std::uint32_t, 4>& sampler = {}) {
     const auto address = reinterpret_cast<std::uintptr_t>(Buffer.data());
     const std::array<std::uint32_t, 4> buffer{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), static_cast<std::uint32_t>(Buffer.size() * 4u), 0x31016facu};
     userData.assign(16, 0u);
     std::copy(buffer.begin(), buffer.end(), userData.begin());
     std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    std::copy(sampler.begin(), sampler.end(), userData.begin() + 12);
     const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
     const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
     ShaderRecompiler::RecompileRequest request{
@@ -349,19 +431,19 @@ void RequireStoreRefused(AgcDriver::VulkanDevice& device, const std::array<std::
     Require(refusal.find(expected) != std::string::npos, what + " was not refused: " + refusal);
 }
 
-std::vector<std::array<float, 4>> RunLoad(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, bool arrayed) {
+std::vector<std::array<float, 4>> RunLoad(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, bool arrayed, std::uint32_t fragments) {
     std::vector<std::uint32_t> userData;
     const auto program = CompileLoad(device, texture, userData, arrayed);
-    std::vector<std::array<float, 4>> loaded(Side * Side * Samples);
+    std::vector<std::array<float, 4>> loaded(Side * Side * fragments);
     const auto codeAddress = reinterpret_cast<std::uintptr_t>((arrayed ? ArrayLoadCode : LoadCode).data());
     for (std::uint32_t first = 0; first < loaded.size(); first += Threads) {
         Buffer.fill(0xdeadbeefu);
         for (std::uint32_t tid = 0; tid < Threads; ++tid) {
             const auto index = first + tid;
-            const auto pixel = index / Samples;
+            const auto pixel = index / fragments;
             const std::array<std::uint32_t, 6> words = arrayed
-                ? std::array<std::uint32_t, 6>{0u, 0u, pixel % Side, pixel / Side, 0u, index % Samples}
-                : std::array<std::uint32_t, 6>{0u, 0u, 0u, pixel % Side, pixel / Side, index % Samples};
+                ? std::array<std::uint32_t, 6>{0u, 0u, pixel % Side, pixel / Side, 0u, index % fragments}
+                : std::array<std::uint32_t, 6>{0u, 0u, 0u, pixel % Side, pixel / Side, index % fragments};
             std::copy(words.begin(), words.end(), &Buffer[tid * Words]);
         }
         device.Dispatch(program, 1, 1, 1, {}, codeAddress);
@@ -373,9 +455,9 @@ std::vector<std::array<float, 4>> RunLoad(AgcDriver::VulkanDevice& device, const
     return loaded;
 }
 
-std::vector<std::array<float, 4>> LoadSamples(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture) {
-    auto loaded = RunLoad(device, texture, false);
-    const auto loadedArray = RunLoad(device, texture, true);
+std::vector<std::array<float, 4>> LoadSamples(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, std::uint32_t fragments = Samples) {
+    auto loaded = RunLoad(device, texture, false, fragments);
+    const auto loadedArray = RunLoad(device, texture, true, fragments);
     Require(loadedArray == loaded, "Dim2DMsaaArray image_load disagreed with Dim2DMsaa image_load on the multisampled color target");
     return loaded;
 }
@@ -384,6 +466,37 @@ std::vector<std::array<float, 4>> LoadSamples(AgcDriver::VulkanDevice& device, c
     return LoadSamples(device, TargetDescriptor(block, SampleShift, format, tileMode));
 }
 
+void CheckFirstSampleReads(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& texture, const std::vector<std::array<float, 4>>& samples, bool distinct, const std::string& what) {
+    std::vector<std::uint32_t> userData;
+    const auto program = CompileProgram(device, PlaneCode, texture, userData, PointMipSampler);
+    const auto codeAddress = reinterpret_cast<std::uintptr_t>(PlaneCode.data());
+    const auto bits = [&](std::size_t index) { return std::bit_cast<std::array<std::uint32_t, 4>>(samples[index]); };
+    bool differs = false;
+    for (std::uint32_t first = 0; first < Side * Side; first += Threads) {
+        Buffer.fill(0xdeadbeefu);
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto pixel = first + tid;
+            const std::array<std::uint32_t, 5> words{std::bit_cast<std::uint32_t>((pixel % Side + 0.5f) / Side), std::bit_cast<std::uint32_t>((pixel / Side + 0.5f) / Side), std::bit_cast<std::uint32_t>(1.0f), pixel % Side, pixel / Side};
+            std::copy(words.begin(), words.end(), &Buffer[tid * Words]);
+        }
+        device.Dispatch(program, 1, 1, 1, {}, codeAddress);
+        device.WaitIdle();
+        for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+            const auto pixel = first + tid;
+            const auto sampleZero = bits(pixel * Samples);
+            for (std::uint32_t sample = 1; sample < Samples; ++sample) differs = differs || bits(pixel * Samples + sample) != sampleZero;
+            for (std::uint32_t read = 0; read < 3u; ++read) {
+                std::array<std::uint32_t, 4> texel{};
+                std::copy_n(&Buffer[tid * Words + LoadResult + read * 4u], texel.size(), texel.begin());
+                char where[200];
+                std::snprintf(where, sizeof(where), "%s of pixel (%u, %u) read %08x %08x %08x %08x, sample 0 is %08x %08x %08x %08x", read == 0u ? "a DIM 2D image_load" : read == 1u ? "a DIM 2D image_sample_lz" : "a DIM 2D image_sample_l at LOD 1", pixel % Side, pixel / Side, texel[0], texel[1], texel[2], texel[3], sampleZero[0], sampleZero[1], sampleZero[2], sampleZero[3]);
+                Require(texel == sampleZero, std::string(where) + " " + what);
+            }
+        }
+    }
+    Require(!distinct || differs, "no pixel's sample 0 differs from its other samples " + what);
+}
+
 std::array<std::uint32_t, 8> CompressedDescriptor(const Block& block, std::uint32_t tileMode, std::uint64_t htile) {
     auto texture = TargetDescriptor(block, SampleShift, Format16161616Float, tileMode);
     const auto meta = htile >> 8u;
@@ -643,23 +756,255 @@ int NativeVertexInput(std::unique_ptr<AgcDriver::VulkanDevice>& device) {
     return 0;
 }
 
+alignas(256) constexpr std::array<std::uint32_t, 10> NativeFmaskCode{0x34020084u, 0xe0381000u, 0x80000201u, 0xbf8c3f70u, 0xf0001f08u, 0x00020602u, 0xbf8c3f70u, 0xe0781000u, 0x80010601u, 0xbf810000u};
+alignas(256) std::array<std::uint32_t, Threads * 4u> NativeFmaskInput{};
+alignas(256) std::array<std::uint32_t, Threads * 4u + 4u> NativeFmaskOutput{};
+
+std::array<std::uint32_t, 8> NativeFmaskDescriptor(const Block& fmask, const Block& cmask, std::uint32_t pipeXor) {
+    const auto address = fmask.Address() | pipeXor;
+    const auto metadata = cmask.Address();
+    return {static_cast<std::uint32_t>(address >> 8u), static_cast<std::uint32_t>(address >> 40u) | (166u << 20u) | (((Side - 1u) & 3u) << 30u), ((Side - 1u) >> 2u) | ((Side - 1u) << 14u), 4u | (1u << 3u) | (4u << 6u) | (24u << 20u) | (9u << 28u), 0u, 0u, (1u << 19u) | (1u << 21u) | (static_cast<std::uint32_t>(metadata >> 8u) << 24u), static_cast<std::uint32_t>(metadata >> 16u)};
+}
+
+ShaderRecompiler::RecompileResult CompileNativeFmask(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& image, bool registration) {
+    std::vector<std::uint32_t> userData(16u);
+    const auto buffer = [](const void* data, std::uint32_t bytes) {
+        const auto address = reinterpret_cast<std::uintptr_t>(data);
+        return std::array<std::uint32_t, 4>{static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u) & 0xffffu, bytes, 0x31016facu};
+    };
+    const auto input = buffer(NativeFmaskInput.data(), sizeof(NativeFmaskInput));
+    const auto output = buffer(NativeFmaskOutput.data(), Threads * 16u);
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4u);
+    std::copy(image.begin(), image.end(), userData.begin() + 8u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(NativeFmaskCode.data()), std::as_bytes(std::span(NativeFmaskCode))}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1u, 1u}, 0u, {false, false, false}, false, 1u};
+    auto target = device.Target();
+    target.registrationModules = registration;
+    ShaderRecompiler::RecompileRequest request{{ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(NativeFmaskCode.data()), NativeFmaskCode, 0u, {}}, {32u, 0u, userData, compute, std::nullopt, std::nullopt, memory}, target, {0u, 0u, 0u, 128u}};
+    request.useCache = false;
+    return ShaderRecompiler::Recompile(request);
+}
+
+void DispatchNativeFmask(AgcDriver::VulkanDevice& device, const std::array<std::uint32_t, 8>& image, bool registration) {
+    device.Dispatch(CompileNativeFmask(device, image, registration), 1u, 1u, 1u);
+    device.WaitIdle();
+}
+
+void NativeFmask(std::unique_ptr<AgcDriver::VulkanDevice>& device) {
+    using namespace AgcDriver::Graphics;
+    Block colorMemory(4u * BlockBytes, true);
+    Block dcc(BlockBytes, true);
+    Block cmask(BlockBytes, true);
+    Block fmask(BlockBytes, true);
+    Block unrelated(BlockBytes, true);
+    struct ReleaseDevice {
+        std::unique_ptr<AgcDriver::VulkanDevice>& value;
+        ~ReleaseDevice() { value.reset(); }
+    } releaseDevice{device};
+    constexpr std::uint32_t sentinel = 0xdeadbeefu;
+    for (const auto pipeXor : {0u, 0xf00u}) {
+        std::memset(colorMemory.data, 0, colorMemory.bytes);
+        std::memset(dcc.data, 0, dcc.bytes);
+        std::memset(cmask.data, 0xcc, cmask.bytes);
+        std::memset(fmask.data, 0x11, fmask.bytes);
+        AgcDriver::Registers cx{{0x318, static_cast<std::uint32_t>(colorMemory.Address() >> 8u)}, {0x31b, 0u}, {0x31c, Float16x4Info | 0x10006000u}, {0x31d, (3u << 12u) | (3u << 15u)}, {0x31e, 0u}, {0x31f, static_cast<std::uint32_t>(cmask.Address() >> 8u)}, {0x321, static_cast<std::uint32_t>((fmask.Address() | pipeXor) >> 8u)}, {0x325, static_cast<std::uint32_t>(dcc.Address() >> 8u)}, {0x390, static_cast<std::uint32_t>(colorMemory.Address() >> 40u)}, {0x398, static_cast<std::uint32_t>(cmask.Address() >> 40u)}, {0x3a0, static_cast<std::uint32_t>(fmask.Address() >> 40u)}, {0x3a8, static_cast<std::uint32_t>(dcc.Address() >> 40u)}, {0x3b0, ((Side - 1u) << 14u) | (Side - 1u)}, {0x3b8, TiledAttrib3}};
+        const auto color = DecodeColorBuffer(cx, 0u);
+        Require(color.samples == 8u && color.cmaskAddress == cmask.Address(), "native FMASK fixture lost its decoded target association");
+        std::array<std::array<float, 4>, 8> expected{};
+        for (std::uint32_t sample = 0u; sample < 8u; ++sample) {
+            expected[sample] = {static_cast<float>(sample + 1u) / 8.0f, 0.25f, 0.5f, 1.0f};
+            auto pixel = PixelCode;
+            pixel[1] = std::bit_cast<std::uint32_t>(expected[sample][0]);
+            pixel[3] = std::bit_cast<std::uint32_t>(expected[sample][1]);
+            pixel[5] = std::bit_cast<std::uint32_t>(expected[sample][2]);
+            pixel[7] = std::bit_cast<std::uint32_t>(expected[sample][3]);
+            auto state = TargetState(color);
+            state.quadSampleMask.fill(static_cast<std::uint16_t>(1u << sample));
+            Draw(*device, state, 0u, 2u, pixel);
+        }
+        const auto native = LoadSamples(*device, TargetDescriptor(colorMemory, 3u), 8u);
+        std::vector<std::uint32_t> covered;
+        for (std::uint32_t pixel = 0; pixel < Side * Side; ++pixel) {
+            bool all = true;
+            for (std::size_t sample = 0; sample < 8u; ++sample) all = all && native[pixel * 8u + sample] == expected[sample];
+            if (all) covered.push_back(pixel);
+        }
+        Require(!covered.empty(), "native FMASK fixture did not render eight distinct sample colors");
+        for (std::uint32_t lane = 0; lane < Threads; ++lane) {
+            const auto pixel = covered[lane % covered.size()];
+            NativeFmaskInput[lane * 4u] = pixel % Side;
+            NativeFmaskInput[lane * 4u + 1u] = pixel / Side;
+            NativeFmaskInput[lane * 4u + 2u] = 0u;
+            NativeFmaskInput[lane * 4u + 3u] = 0u;
+        }
+        const auto image = NativeFmaskDescriptor(fmask, cmask, pipeXor);
+        const auto check = [&] {
+            for (std::uint32_t lane = 0; lane < Threads; ++lane) {
+                const std::array<std::uint32_t, 4> mapping{0x76543210u, 1u, 0x76543210u, 0u};
+                for (std::size_t component = 0; component < 4u; ++component) Require(NativeFmaskOutput[lane * 4u + component] == mapping[component], "native FMASK load did not preserve its expanded sample indices and selectors");
+                for (std::uint32_t sample = 0; sample < 8u; ++sample) {
+                    const auto fragment = NativeFmaskOutput[lane * 4u] >> (4u * sample) & 15u;
+                    const auto pixel = NativeFmaskInput[lane * 4u + 1u] * Side + NativeFmaskInput[lane * 4u];
+                    Require(native[pixel * 8u + fragment] == expected[sample], "native FMASK remapped a sampled color to another fragment");
+                }
+            }
+            Require(std::all_of(NativeFmaskOutput.begin() + Threads * 4u, NativeFmaskOutput.end(), [](auto word) { return word == sentinel; }), "native FMASK wrote beyond its output");
+        };
+        for (const auto registration : {false, true}) {
+            for (std::uint32_t repeat = 0; repeat < 2u; ++repeat) {
+                NativeFmaskOutput.fill(sentinel);
+                DispatchNativeFmask(*device, image, registration);
+                check();
+            }
+            const auto program = CompileNativeFmask(*device, image, registration);
+            const auto codeAddress = reinterpret_cast<std::uintptr_t>(NativeFmaskCode.data());
+            std::shared_ptr<const AgcDriver::Recipe> recipe;
+            NativeFmaskOutput.fill(sentinel);
+            device->Dispatch(program, 1u, 1u, 1u, {}, codeAddress, nullptr, &recipe);
+            device->WaitIdle();
+            check();
+            Require(recipe == nullptr, "native FMASK emitted a reusable recipe without an ownership proof");
+            const auto prepared = device->PrepareDispatch(program, {}, Threads, codeAddress);
+            Require(prepared != nullptr, "native FMASK did not prepare a deferred dispatch");
+            NativeFmaskOutput.fill(sentinel);
+            device->Dispatch(program, 1u, 1u, 1u, {}, codeAddress, prepared);
+            device->WaitIdle();
+            check();
+        }
+        Require(LoadSamples(*device, TargetDescriptor(colorMemory, 3u), 8u) == native, "FMASK sampling changed the native samples");
+        Require(std::all_of(fmask.data, fmask.data + fmask.bytes, [](auto byte) { return byte == 0x11u; }) && std::all_of(cmask.data, cmask.data + cmask.bytes, [](auto byte) { return byte == 0xccu; }), "native FMASK sampling published or changed guest metadata");
+        const auto refused = [&](const auto& descriptor, std::string_view reason) {
+            NativeFmaskOutput.fill(sentinel);
+            std::string error;
+            try { DispatchNativeFmask(*device, descriptor, false); } catch (const std::runtime_error& e) { error = e.what(); }
+            Require(error.find(reason) != std::string::npos, "native FMASK missing refusal: " + error);
+            Require(std::all_of(NativeFmaskOutput.begin(), NativeFmaskOutput.end(), [sentinel](auto word) { return word == sentinel; }), "rejected native FMASK wrote output");
+        };
+        refused(NativeFmaskDescriptor(unrelated, cmask, pipeXor), "descriptor does not match");
+        refused(NativeFmaskDescriptor(fmask, unrelated, pipeXor), "descriptor does not match");
+        refused(NativeFmaskDescriptor(fmask, cmask, pipeXor ^ 0x100u), "descriptor does not match");
+        auto resized = image;
+        resized[2] += 1u;
+        refused(resized, "extent or subresource does not match");
+        const auto deferredProgram = CompileNativeFmask(*device, image, false);
+        const auto codeAddress = reinterpret_cast<std::uintptr_t>(NativeFmaskCode.data());
+        const auto preparedBeforeStore = device->PrepareDispatch(deferredProgram, {}, Threads, codeAddress);
+        Require(preparedBeforeStore != nullptr, "native FMASK did not prepare its metadata invalidation probe");
+        std::array<std::byte, 4> same{};
+        same.fill(std::byte{0x11});
+        AgcDriver::GuestMemory::Write(fmask.Address(), same);
+        refused(image, "writes to a resident native FMASK");
+        NativeFmaskOutput.fill(sentinel);
+        std::string deferredError;
+        try {
+            device->Dispatch(deferredProgram, 1u, 1u, 1u, {}, codeAddress, preparedBeforeStore);
+            device->WaitIdle();
+        } catch (const std::runtime_error& error) {
+            deferredError = error.what();
+        }
+        Require(deferredError.find("writes to a resident native FMASK") != std::string::npos, "deferred native FMASK missed its metadata store: " + deferredError);
+        Require(std::all_of(NativeFmaskOutput.begin(), NativeFmaskOutput.end(), [](auto word) { return word == sentinel; }), "rejected deferred native FMASK wrote output");
+        device->SubmitRecorded(true);
+        device->WaitIdle();
+        ClearMultisampleTargets(device->Device());
+        ClearCachedTextures(device->Device());
+        cx[0x31c] &= ~0x2000u;
+        cx[0x31f] = 0u;
+        cx[0x398] = 0u;
+        const auto withoutCmask = DecodeColorBuffer(cx, 0u);
+        Require(withoutCmask.cmaskAddress == 0u, "the no-CMASK control retained metadata");
+        Draw(*device, TargetState(withoutCmask));
+        const auto uncompressed = LoadSamples(*device, TargetDescriptor(colorMemory, 3u), 8u);
+        Require(std::find(uncompressed.begin(), uncompressed.end(), Drawn) != uncompressed.end(), "tracking native FMASK broke ordinary DCC rendering without CMASK");
+        device->SubmitRecorded(true);
+        device->WaitIdle();
+        ClearMultisampleTargets(device->Device());
+        ClearCachedTextures(device->Device());
+        Draw(*device, TargetState(color));
+        auto recreated = color;
+        recreated.pipeBankXor ^= 0x4000u;
+        recreated.fmaskAddress = 0u;
+        recreated.fmaskPipeBankXor = 0u;
+        Draw(*device, TargetState(recreated));
+        std::array<std::byte, 4> formerFmask{};
+        formerFmask.fill(std::byte{0x22});
+        AgcDriver::GuestMemory::Write(fmask.Address(), formerFmask);
+        Draw(*device, TargetState(recreated));
+        auto recreatedDescriptor = TargetDescriptor(colorMemory, 3u);
+        recreatedDescriptor[0] |= recreated.pipeBankXor >> 8u;
+        const auto recreatedSamples = LoadSamples(*device, recreatedDescriptor, 8u);
+        Require(std::find(recreatedSamples.begin(), recreatedSamples.end(), Drawn) != recreatedSamples.end(), "former FMASK metadata affected the recreated native target");
+        device->SubmitRecorded(true);
+        device->WaitIdle();
+        ClearMultisampleTargets(device->Device());
+        ClearCachedTextures(device->Device());
+        std::printf("native FMASK: XOR=0x%x, eight distinct samples, both registration modes, cached reuse, association/extent/write refusals and unchanged guest metadata passed\n", pipeXor);
+    }
+}
+
 }
 
 int main(int argc, char** argv) {
     try {
         auto device = OpenVulkanTestDevice();
         if (!device) return VulkanTestSkipped;
+        if (argc == 2 && std::string_view(argv[1]) == "--native-fmask") {
+            {
+                const auto context = AgcDriver::VulkanDeviceTestAccess::ContextOf(*device);
+                if (!context.storageImageMultisample || (context.limits.framebufferColorSampleCounts & VK_SAMPLE_COUNT_8_BIT) == 0) {
+                    std::puts("native FMASK skipped, the device does not render or store 8-sample color");
+                    return VulkanTestSkipped;
+                }
+            }
+            NativeFmask(device);
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--native-vertex-input") return NativeVertexInput(device);
         Block block(4u * BlockBytes);
         Block other(BlockBytes);
         const auto color = DecodeTarget(block);
         const auto state = TargetState(color);
+        Draw(*device, state);
+        const auto drawn = LoadSamples(*device, block);
+        CheckSamples(state, drawn, {});
+        CheckFirstSampleReads(*device, TargetDescriptor(block, SampleShift), drawn, true, "from the drawn 4x target");
+        Draw(*device, state, 0, 2u, Unorm8PixelCode);
+        const auto redrawn = LoadSamples(*device, block);
+        Require(redrawn != drawn, "drawing the 4x target again with another color left its samples unchanged");
+        CheckFirstSampleReads(*device, TargetDescriptor(block, SampleShift), redrawn, true, "from the 4x target drawn again with another color after a first read");
+        Block zeroed(BlockBytes);
+        CheckFirstSampleReads(*device, TargetDescriptor(zeroed, SampleShift), std::vector<std::array<float, 4>>(Side * Side * Samples), false, "from zeroed color memory no draw rendered to");
+        Block aliased(4u * BlockBytes);
+        Draw(*device, TargetState(DecodeSwappedTarget(aliased)), 0, 2u, Unorm8PixelCode);
+        Draw(*device, TargetState(DecodeTarget(aliased)));
+        const auto aliasedSamples = LoadSamples(*device, aliased);
+        CheckSamples(state, aliasedSamples, {});
+        CheckFirstSampleReads(*device, TargetDescriptor(aliased, SampleShift), aliasedSamples, true, "from a 4x RGBA16F target drawn after a BGRA8 target at the same address");
+        std::puts("DIM 2D image_load, image_sample_lz and image_sample_l reads of a 4x color target return each pixel's sample 0");
+        Block swapped(4u * BlockBytes);
+        Draw(*device, TargetState(DecodeSwappedTarget(swapped)), 0, 2u, Unorm8PixelCode);
+        const auto swappedSamples = LoadSamples(*device, swapped, Format8888Unorm);
+        CheckSwappedSamples(swappedSamples);
+        CheckFirstSampleReads(*device, TargetDescriptor(swapped, SampleShift, Format8888Unorm), swappedSamples, true, "from a 4x BGRA8 target read through an RGBA8 descriptor");
+        std::puts("a 4x BGRA8 color target loaded through an RGBA8 texture descriptor reads its drawn color with red and blue swapped");
+        Block integer(4u * BlockBytes);
+        Block signedFill(BlockBytes);
+        if ((AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).limits.sampledImageIntegerSampleCounts & VK_SAMPLE_COUNT_4_BIT) == 0) {
+            std::puts("DIM 2D reads of 4x 8_8_8_8_UINT and 8_8_8_8_SINT targets not tested: sampledImageIntegerSampleCounts lacks VK_SAMPLE_COUNT_4_BIT");
+        } else {
+            Draw(*device, TargetState(DecodeUintTarget(integer)), 0, 2u, Uint8PixelCode);
+            const auto integerSamples = LoadSamples(*device, integer, Format8888Uint);
+            CheckUintSamples(integerSamples);
+            CheckFirstSampleReads(*device, TargetDescriptor(integer, SampleShift, Format8888Uint), integerSamples, true, "from a drawn 4x 8_8_8_8_UINT target");
+            StoreWords(signedFill, BlockBytes, FilledSint8);
+            CheckFirstSampleReads(*device, TargetDescriptor(signedFill, SampleShift, Format8888Sint), std::vector<std::array<float, 4>>(Side * Side * Samples, std::bit_cast<std::array<float, 4>>(FilledSint8Texel)), false, "from 8_8_8_8_SINT color memory no draw rendered to");
+            std::puts("DIM 2D reads of a drawn 4x 8_8_8_8_UINT target and of 8_8_8_8_SINT color memory no draw rendered to return each pixel's sample 0 bit for bit");
+        }
         if (!AgcDriver::VulkanDeviceTestAccess::ContextOf(*device).storageImageMultisample) {
-            std::puts("multisampled target sampling not tested: storage image multisampling unavailable");
+            std::puts("multisampled target fills, stores and swizzle modes not tested: storage image multisampling unavailable");
             return VulkanTestSkipped;
         }
-        Draw(*device, state);
-        CheckSamples(state, LoadSamples(*device, block), {});
         const auto colorBytes = AgcDriver::Graphics::MultisampledColorBytes(color);
         Require(colorBytes != 0 && colorBytes <= block.bytes, "the 4x target's color memory does not fit its block");
         AgcDriver::Graphics::NoteColorMetadataFill(block.Address(), static_cast<std::size_t>(colorBytes), FillOnes);
@@ -722,10 +1067,6 @@ int main(int argc, char** argv) {
         StoreWords(standard, colorBytes, FillOnes);
         RequireRefused(*device, TargetDescriptor(standard, SampleShift, Format16161616Float, TileS64KBX), "has no modeled multisampled color footprint", "loading an S swizzle multisampled texture no draw rendered to");
         std::puts("every sample of a 4x color target loaded through its multisampled texture descriptor matches the triangle drawn into it, then the fill of its color memory; a surface no draw rendered to loads the value its color memory repeats and keeps it under a later draw");
-        Block swapped(4u * BlockBytes);
-        Draw(*device, TargetState(DecodeSwappedTarget(swapped)), 0, 2u, Unorm8PixelCode);
-        CheckSwappedSamples(LoadSamples(*device, swapped, Format8888Unorm));
-        std::puts("a 4x BGRA8 color target loaded through an RGBA8 texture descriptor reads its drawn color with red and blue swapped");
         Block destination(BlockBytes);
         struct ReleaseIndexDevice {
             std::unique_ptr<AgcDriver::VulkanDevice>& device;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp
index 9e534056ab..ba9346b3e7 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampleOrder.cpp
@@ -1122,6 +1122,22 @@ Samples ReadTarget(const Context& context, VkImageView view, bool color, std::ui
     return ReadValues(values, count);
 }
 
+Samples ReadDepth(const Context& context, const AgcDriver::Graphics::DepthTarget& depth, std::uint32_t samples) {
+    const auto target = AgcDriver::Graphics::DepthSurfaceOrderTarget(context, depth);
+    const VkImageAspectFlags aspects = VK_IMAGE_ASPECT_DEPTH_BIT | (AgcDriver::Graphics::HasStencil(target.format) ? VK_IMAGE_ASPECT_STENCIL_BIT : 0u);
+    Image copy(context, target.format, samples, ReferenceExtent, DepthUsage, 0u);
+    VkImageCopy region{};
+    region.srcSubresource = {VK_IMAGE_ASPECT_DEPTH_BIT, 0u, 0u, 1u};
+    region.dstSubresource = region.srcSubresource;
+    region.extent = {ReferenceExtent.width, ReferenceExtent.height, 1u};
+    Submit(context, [&](VkCommandBuffer commands) {
+        copy.ToGeneral(commands, aspects);
+        FullBarrier(context, commands);
+        context.Function<PFN_vkCmdCopyImage>("vkCmdCopyImage")(commands, target.image, VK_IMAGE_LAYOUT_GENERAL, copy.Handle(), VK_IMAGE_LAYOUT_GENERAL, 1u, &region);
+    });
+    return ReadTarget(context, copy.View(target.format, VK_IMAGE_ASPECT_DEPTH_BIT, VK_IMAGE_USAGE_SAMPLED_BIT), false, samples);
+}
+
 Rendered RenderCheckerboard(AgcDriver::VulkanDevice& device, const Context& context, std::uint32_t samples, std::size_t run, const std::optional<std::array<std::uint8_t, 32>>& locations) {
     AgcDriver::Graphics::ColorTarget color{};
     color.extent = ReferenceExtent;
@@ -1169,7 +1185,7 @@ Rendered RenderCheckerboard(AgcDriver::VulkanDevice& device, const Context& cont
     Settle(device);
     Rendered rendered;
     rendered.color = ReadTarget(context, AgcDriver::Graphics::MultisampleTargetView(context, color), true, samples);
-    rendered.depth = ReadTarget(context, AgcDriver::Graphics::DepthSurfaceOrderTarget(context, depth).view, false, samples);
+    rendered.depth = ReadDepth(context, depth, samples);
     return rendered;
 }
 
@@ -1348,7 +1364,7 @@ void CheckRecipeDepth(AgcDriver::VulkanDevice& device, const Context& context, c
         std::printf("%s: builds no recipe, since a draw that reorders its samples is built in full each time, with its sample swaps\n", what.c_str());
         return;
     }
-    const auto read = [&] { return ReadTarget(context, AgcDriver::Graphics::DepthSurfaceOrderTarget(context, depth).view, false, samples); };
+    const auto read = [&] { return ReadDepth(context, depth, samples); };
     Samples recorded;
     slopes.beforeReplay = [&] {
         Settle(device);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp
index 46e3184ea6..6cfb074620 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SampledCacheBudget.cpp
@@ -1,10 +1,12 @@
 #include "prx/libSceAgcDriver/Execution/include/BdaFeatures.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ShaderResources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureFormat.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureDetiler.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/TextureCache.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/PlaceholderImages.hpp"
@@ -281,38 +283,38 @@ private:
 
 class WatchedSurface {
 public:
-    explicit WatchedSurface(const Context& context) : context(context) {
+    explicit WatchedSurface(const Context& context, std::size_t bytes = SurfaceBytes) : context(context), span(bytes) {
 #ifdef _WIN32
-        memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(SurfaceBytes, 65536));
-        if (memory != nullptr) GuestArena::GuestArenaCommit_nid_postfix(memory, SurfaceBytes, PAGE_READWRITE, SurfaceBytes);
+        memory = static_cast<std::uint8_t*>(GuestArena::GuestArenaAllocate_nid_postfix(bytes, 65536));
+        if (memory != nullptr) GuestArena::GuestArenaCommit_nid_postfix(memory, bytes, PAGE_READWRITE, bytes);
 #else
         constexpr std::uintptr_t alignment = 65536;
-        void* mapped = mmap(nullptr, SurfaceBytes + alignment, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        void* mapped = mmap(nullptr, bytes + alignment, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
         if (mapped != MAP_FAILED) {
             const auto begin = reinterpret_cast<std::uintptr_t>(mapped);
             const auto aligned = (begin + alignment - 1) & ~(alignment - 1);
             if (aligned != begin) munmap(mapped, aligned - begin);
-            if (aligned + SurfaceBytes != begin + SurfaceBytes + alignment) munmap(reinterpret_cast<void*>(aligned + SurfaceBytes), begin + alignment - aligned);
+            if (aligned + bytes != begin + bytes + alignment) munmap(reinterpret_cast<void*>(aligned + bytes), begin + alignment - aligned);
             memory = reinterpret_cast<std::uint8_t*>(aligned);
-            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(memory, SurfaceBytes);
+            GuestWriteWatch::GuestWriteWatchRegister_nid_postfix(memory, bytes);
         }
 #endif
         Require(memory != nullptr, "cannot allocate the watched surface");
-        Require(AgcDriver::GuestMemory::Watched(Address(), SurfaceBytes), "the watched surface is not write-watched");
-        std::memset(memory, 0x5a, SurfaceBytes);
-        GuestAllocations::Mutation().Add(memory, SurfaceBytes, true, true, true);
-        AgcDriver::GuestMemory::CollectWritesUncached(Address(), SurfaceBytes);
+        Require(AgcDriver::GuestMemory::Watched(Address(), bytes), "the watched surface is not write-watched");
+        std::memset(memory, 0x5a, bytes);
+        GuestAllocations::Mutation().Add(memory, bytes, true, true, true);
+        AgcDriver::GuestMemory::CollectWritesUncached(Address(), bytes);
     }
 
     ~WatchedSurface() {
         ClearCachedTextures(context.device);
         GuestAllocations::Mutation().Remove(memory);
 #ifdef _WIN32
-        GuestArena::GuestArenaReset_nid_postfix(memory, SurfaceBytes);
-        GuestArena::GuestArenaRelease_nid_postfix(memory, SurfaceBytes);
+        GuestArena::GuestArenaReset_nid_postfix(memory, span);
+        GuestArena::GuestArenaRelease_nid_postfix(memory, span);
 #else
-        munmap(memory, SurfaceBytes);
-        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(memory, SurfaceBytes);
+        munmap(memory, span);
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(memory, span);
 #endif
     }
 
@@ -323,13 +325,14 @@ public:
 
 private:
     const Context& context;
+    std::size_t span = 0;
     std::uint8_t* memory = nullptr;
 };
 
-std::array<std::uint32_t, 8> Descriptor(std::uint64_t address, std::uint32_t side = Side) {
+std::array<std::uint32_t, 8> Descriptor(std::uint64_t address, std::uint32_t side = Side, std::uint32_t format = Format32UInt) {
     return {
         static_cast<std::uint32_t>(address >> 8u),
-        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (Format32UInt << 20u) | (((side - 1u) & 3u) << 30u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (format << 20u) | (((side - 1u) & 3u) << 30u),
         ((side - 1u) >> 2u) | ((side - 1u) << 14u),
         0xfacu | (TileR64KBX << 20u) | (Type2D << 28u),
         0u,
@@ -339,13 +342,13 @@ std::array<std::uint32_t, 8> Descriptor(std::uint64_t address, std::uint32_t sid
     };
 }
 
-std::shared_ptr<Texture> Sampled(const Context& context, std::uint64_t address, std::uint32_t side = Side) {
-    const auto words = Descriptor(address, side);
+std::shared_ptr<Texture> Sampled(const Context& context, std::uint64_t address, std::uint32_t side = Side, std::uint32_t format = Format32UInt) {
+    const auto words = Descriptor(address, side, format);
     return CachedSampledTexture(context, words);
 }
 
-GuestTextureResource Resource(std::uint64_t address, std::uint32_t side = Side) {
-    const auto words = Descriptor(address, side);
+GuestTextureResource Resource(std::uint64_t address, std::uint32_t side = Side, std::uint32_t format = Format32UInt) {
+    const auto words = Descriptor(address, side, format);
     return DecodeTextureResource(words);
 }
 
@@ -672,6 +675,55 @@ void snapshotTests(const Context& context) {
     Require(TextureCacheUsage().sampledBytes == tiny->AllocationBytes(), "a snapshot whose " + std::to_string(tiny->AllocationBytes()) + "-byte image is smaller than its " + std::to_string(guestBytes) + " guest bytes counted " + std::to_string(TextureCacheUsage().sampledBytes) + " bytes, not its allocation");
 }
 
+void recycleTests(const Context& context) {
+    Block block(context);
+    ClearCachedTextures(context.device);
+    const auto address = block.Surface(0);
+    std::memset(reinterpret_cast<void*>(address), 0xa1, SurfaceBytes);
+    const auto first = Sampled(context, address);
+    Require(Sampled(context, address) == first, "an unchanged surface did not serve its snapshot");
+    std::memset(reinterpret_cast<void*>(address), 0xb2, SurfaceBytes);
+    const auto second = Sampled(context, address);
+    Require(second != first, "a changed surface did not replace its snapshot");
+    std::memset(reinterpret_cast<void*>(address), 0xa1, SurfaceBytes);
+    const auto third = Sampled(context, address);
+    Require(third != second, "the replaced snapshot's size-equal buffer was not reread from guest memory");
+    Require(Sampled(context, address) == third, "an unchanged surface did not serve its remade snapshot");
+    constexpr std::uint32_t BigSide = Side * 2;
+    constexpr std::size_t BigBytes = std::size_t{BigSide} * BigSide * 4u;
+    const WatchedSurface watchedFirst(context, BigBytes);
+    const WatchedSurface watchedSecond(context, BigBytes);
+    const auto bigFirst = Sampled(context, watchedFirst.Address(), BigSide);
+    Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the first big snapshot did not park its dropped " + std::to_string(BigBytes) + "-byte buffer in the spare pool");
+    const auto bigSecond = Sampled(context, watchedSecond.Address(), BigSide);
+    Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the second big snapshot did not take the parked spare of its size");
+}
+
+void spareAgeTests(const Context& context) {
+    Block block(context);
+    ClearCachedTextures(context.device);
+    constexpr std::uint32_t BigSide = Side * 2;
+    constexpr std::size_t BigBytes = std::size_t{BigSide} * BigSide * 4u;
+    {
+        const WatchedSurface watched(context, BigBytes);
+        const auto first = Sampled(context, watched.Address(), BigSide);
+        Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the big snapshot did not park its dropped buffer in the spare pool");
+        for (std::uint64_t present = 0; present <= SpareSnapshotPresents; ++present) Recorder::CountPresent();
+        const auto small = Sampled(context, block.Surface(0));
+        Require(TextureCacheUsage().spareEntries == 0 && TextureCacheUsage().spareBytes == 0, "a spare idle for " + std::to_string(SpareSnapshotPresents + 1u) + " presents was not released");
+    }
+    ClearCachedTextures(context.device);
+    {
+        const WatchedSurface watchedFirst(context, BigBytes);
+        const WatchedSurface watchedSecond(context, BigBytes);
+        const auto second = Sampled(context, watchedFirst.Address(), BigSide);
+        Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "the second big snapshot did not park its dropped buffer in the spare pool");
+        for (std::uint64_t present = 0; present < SpareSnapshotPresents; ++present) Recorder::CountPresent();
+        const auto third = Sampled(context, watchedSecond.Address(), BigSide);
+        Require(TextureCacheUsage().spareEntries == 1 && TextureCacheUsage().spareBytes == BigBytes, "a spare taken within " + std::to_string(SpareSnapshotPresents) + " presents was released instead of reused");
+    }
+}
+
 void heldTests(const Context& context) {
     Block block(context);
     auto held = Sampled(context, block.Surface(0));
@@ -952,7 +1004,7 @@ std::uint64_t ExpectedBudget(const Context& context) {
     VkPhysicalDeviceMemoryBudgetPropertiesEXT reported{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_BUDGET_PROPERTIES_EXT};
     VkPhysicalDeviceMemoryProperties2 properties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_MEMORY_PROPERTIES_2, &reported};
     ReportBudget(context.physical, &properties);
-    return SampledTextureBudget(context.memory, &reported, SampledTextureMemory() + TextureCacheUsage().storageBytes);
+    return SampledTextureBudget(context.memory, &reported, SampledTextureMemory() + TextureCacheUsage().storageBytes, TextureCacheUsage().storageBytes);
 }
 
 std::uint64_t ReadBudget(const Context& context) {
@@ -997,8 +1049,10 @@ void storageMemoryTests(Context context) {
     context.memoryProperties2 = &ReportBudget;
     Block block(context);
     auto held = Sampled(context, block.Surface(0));
-    const auto quarter = std::min<std::uint64_t>(StorageTextureBudget(context.memory, nullptr, 0, 0), ReportedBudget / 4u);
-    Require(ReadStorageBudget(context) == quarter, "52 GiB free of a 64 GiB budget does not leave the storage image cache its quarter");
+    const auto heap = LargestDeviceLocalHeap(context.memory);
+    Require(heap.has_value(), "the device has no device-local heap");
+    const auto half = std::min<std::uint64_t>(context.memory.memoryHeaps[*heap].size / 2u, ReportedBudget / 2u);
+    Require(ReadStorageBudget(context) == half, "52 GiB free of a 64 GiB budget does not leave the storage image cache half of the heap or of the budget");
     context.memoryProperties2 = &ReportPressure;
     const auto pressed = ReadStorageBudget(context);
     const auto expected = GiB + TextureCacheUsage().storageBytes;
@@ -1006,6 +1060,116 @@ void storageMemoryTests(Context context) {
     std::printf("reported heap budget %llu MiB with %llu MiB in use: storage image cache budget %llu MiB\n", static_cast<unsigned long long>(ReportedBudget >> 20u), static_cast<unsigned long long>(PressedUsage >> 20u), static_cast<unsigned long long>(pressed >> 20u));
 }
 
+struct RecoveryProbe {
+    PFN_vkGetDeviceProcAddr deviceProc = nullptr;
+    std::uint64_t released = 0;
+    unsigned requests = 0;
+    unsigned failures = 0;
+    bool pressure = false;
+};
+
+RecoveryProbe recovery;
+
+VkDeviceSize ReclaimForTest(VkDeviceSize bytes, bool newImage) {
+    Require(newImage, "an image allocation did not identify itself to the recovery callback");
+    ++recovery.requests;
+    Require(ReleaseTextureCaches(bytes, false) == 0, "a buffer allocation was allowed to reclaim the cache held by image creation");
+    const auto released = ReleaseTextureCaches(bytes, newImage);
+    recovery.released += released;
+    return released;
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL AllocateForTest(VkDevice device, const VkMemoryAllocateInfo* info, const VkAllocationCallbacks* allocator, VkDeviceMemory* memory) {
+    if (recovery.pressure && recovery.released == 0) {
+        ++recovery.failures;
+        return VK_ERROR_OUT_OF_DEVICE_MEMORY;
+    }
+    return reinterpret_cast<PFN_vkAllocateMemory>(recovery.deviceProc(device, "vkAllocateMemory"))(device, info, allocator, memory);
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL RecoveryProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkAllocateMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(AllocateForTest);
+    return recovery.deviceProc(device, name);
+}
+
+void recoveryTests(Context context, const std::string& mode) {
+    recovery = RecoveryProbe{};
+    recovery.deviceProc = context.deviceProc;
+    context.deviceProc = RecoveryProc;
+    context.cacheReclaim = ReclaimForTest;
+    context.bufferPool.reset();
+    Block block(context);
+    const bool storage = mode == "recover-storage";
+    if (storage) {
+        auto oldest = CachedStorageSurface(context, Resource(block.Surface(0)));
+        const auto allocated = oldest->AllocationBytes();
+        std::weak_ptr<StorageTexture> released = oldest;
+        oldest.reset();
+        auto pending = CachedStorageSurface(context, Resource(block.Surface(1)));
+        pending->MarkDirty();
+        recovery.pressure = true;
+        auto made = CachedStorageSurface(context, Resource(block.Surface(2)));
+        recovery.pressure = false;
+        Require(made != nullptr && released.expired(), "storage allocation recovery did not release its own oldest clean image");
+        Require(pending->Dirty() && StorageImageCached(context, pending.get()), "storage allocation recovery changed an image with pending results");
+        Require(recovery.released == allocated, "storage allocation recovery counted memory still held by its caller");
+        pending->Flush();
+        Require(!pending->Dirty(), "pending storage results could not be stored after memory recovery");
+    } else if (mode == "recover-sampled") {
+        auto oldest = Sampled(context, block.Surface(0));
+        Require(!oldest->ViewsStorageImage(), "the sampled recovery fixture needs a snapshot allocation");
+        const auto allocated = oldest->AllocationBytes();
+        std::weak_ptr<Texture> released = oldest;
+        oldest.reset();
+        auto held = Sampled(context, block.Surface(1));
+        recovery.pressure = true;
+        auto made = Sampled(context, block.Surface(2));
+        recovery.pressure = false;
+        Require(made != nullptr && released.expired(), "sampled allocation recovery did not release its own oldest unused texture");
+        Require(Sampled(context, block.Surface(1)) == held, "sampled allocation recovery removed a texture still held by its caller");
+        Require(recovery.released == allocated, "sampled allocation recovery counted memory still held by its caller");
+    } else {
+        const bool srgb = mode == "recover-srgb";
+        if (srgb) {
+            context.srgbDecodeFormats = SrgbDecodeFormats(context.formatProperties, context.physical);
+            context.srgbCopyFormats = SrgbCopyFormats(context.formatProperties, context.physical, context.srgbDecodeFormats);
+            Require(SrgbExpandsToRgba8(context, 128u), "the device cannot serve the sRGB expansion copy fixture");
+        }
+        auto oldest = Sampled(context, block.Surface(0));
+        Require(!oldest->ViewsStorageImage(), "the sampled recovery fixture needs a snapshot allocation");
+        const auto allocated = oldest->AllocationBytes();
+        std::weak_ptr<Texture> released = oldest;
+        oldest.reset();
+        auto held = Sampled(context, block.Surface(1));
+        const auto side = srgb ? 1024u : 512u;
+        const auto format = srgb ? 128u : 43u;
+        const auto sourceWords = Descriptor(block.Surface(4), side, format);
+        const auto sourceResource = DecodeTextureResource(sourceWords);
+        auto source = CachedStorageSurface(context, sourceResource);
+        source->MarkDirty();
+        if (srgb) {
+            Require(Texture::CanSrgbExpandFrom(context, *source, sourceResource), "the storage surface cannot serve an sRGB expansion copy");
+        } else {
+            Require(Texture::CanRepackCopyFrom(*source, sourceResource), "the storage surface cannot serve a repacked copy");
+        }
+        recovery.pressure = true;
+        auto made = CachedSampledTexture(context, sourceWords);
+        recovery.pressure = false;
+        Require(made != nullptr && made->SharedStorageSource() == source, "sampled copy allocation recovery did not serve the pending storage image");
+        Require(released.expired(), "sampled copy allocation recovery did not release its own oldest unused texture");
+        Require(source->Dirty() && StorageImageCached(context, source.get()), "sampled copy allocation recovery changed or evicted an image with pending results");
+        Require(!held->Released() && held.use_count() == 2, "sampled copy allocation recovery removed a texture still held by its caller");
+        const auto refreshed = Sampled(context, block.Surface(1));
+        Require(refreshed != nullptr && (refreshed == held || refreshed->ViewsStorageImage()), "sampled copy cache refresh did not serve the surface");
+        Require(recovery.released == allocated, "sampled copy allocation recovery counted memory still held by its caller");
+        source->Flush();
+        Require(!source->Dirty(), "pending storage results could not be stored after memory recovery");
+    }
+    Require(recovery.requests == 1 && recovery.failures >= 1 && recovery.failures <= 2, "image allocation recovery was skipped or retried without a bound");
+    const char* label = storage ? "storage" : mode == "recover-srgb" ? "sRGB" : mode == "recover-repack" ? "repacked" : "sampled";
+    std::printf("%s image allocation recovered after %u injected failures: %llu bytes released\n", label, recovery.failures, static_cast<unsigned long long>(recovery.released));
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -1018,11 +1182,12 @@ int main(int argc, char** argv) {
         }
         const bool resources = mode == "resource-admission" || mode == "resource-oversized" || mode == "resource-clear";
         const bool disableStorageImageMultisample = mode == "without-storage-image-multisample";
+        const bool recover = mode == "recover-sampled" || mode == "recover-storage" || mode == "recover-srgb" || mode == "recover-repack";
 #ifdef _WIN32
-        if (!memory) _putenv_s("APS5_TEXTURE_CACHE_MIB", "1");
+        if (!memory) _putenv_s("APS5_TEXTURE_CACHE_MIB", recover ? "16" : "1");
         if (std::getenv("APS5_TEMPLATE_AUDIT_MS") == nullptr) _putenv_s("APS5_TEMPLATE_AUDIT_MS", "250");
 #else
-        if (!memory) setenv("APS5_TEXTURE_CACHE_MIB", "1", 1);
+        if (!memory) setenv("APS5_TEXTURE_CACHE_MIB", recover ? "16" : "1", 1);
         setenv("APS5_TEMPLATE_AUDIT_MS", "250", 0);
 #endif
         std::unique_ptr<Device> device;
@@ -1082,10 +1247,16 @@ int main(int argc, char** argv) {
             std::puts("sampled texture memory budget tests passed");
             return 0;
         }
+        if (recover) {
+            std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+            recoveryTests(context, mode);
+            return 0;
+        }
         {
             std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
             reportedBudgetTests(context);
             snapshotTests(context);
+            recycleTests(context);
             heldTests(context);
             releasedTests(context);
             rescanTests(context);
@@ -1097,6 +1268,7 @@ int main(int argc, char** argv) {
             secondUseTests(context);
             earlyMissTests(context);
             collidingKeyTests(context);
+            spareAgeTests(context);
             ClearCachedTextures(context.device);
         }
         std::puts("sampled texture cache budget tests passed");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp
index c6dd1e4ca1..8d0bdf3153 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SgprPatternFillKeys.cpp
@@ -98,7 +98,7 @@ void MatchTests() {
 
 alignas(8) std::uint32_t Finished = 0;
 std::uint32_t Submitted = 0;
-constexpr std::uint32_t MaxResubmits = 16;
+constexpr std::uint32_t MaxResubmits = 512;
 
 void Submit(const std::vector<std::uint32_t>& data, std::uint32_t groups) {
     std::vector<std::uint32_t> words;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ShutdownThreads.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ShutdownThreads.cpp
index 8f835d52de..82832ba244 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ShutdownThreads.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ShutdownThreads.cpp
@@ -76,6 +76,41 @@ void ClosingJoinsPreparation() {
     Require(ranHere && RegistrationPreparationThreads() == 0, "a closed preparation pool restarted after being joined");
 }
 
+void ClosingDropsQueuedPrebuilds() {
+    using namespace AgcDriver::DriverDetail;
+    std::promise<void> started;
+    auto running = started.get_future();
+    std::promise<void> gate;
+    auto opened = gate.get_future().share();
+    bool queuedRan = false;
+    SubmitLibraryPrebuild([&] { started.set_value(); opened.wait(); });
+    for (int index = 0; index < 3; ++index) SubmitLibraryPrebuild([&] { queuedRan = true; });
+    running.wait();
+    auto entering = std::make_shared<std::promise<void>>();
+    auto entered = entering->get_future();
+    auto awaited = std::make_shared<std::promise<void>>();
+    auto woken = awaited->get_future();
+    std::thread([entering, awaited] {
+        entering->set_value();
+        AwaitLibraryPrebuilds();
+        awaited->set_value();
+    }).detach();
+    entered.wait();
+    const bool waiting = woken.wait_for(std::chrono::milliseconds(20)) == std::future_status::timeout;
+    auto closing = std::async(std::launch::async, [] { CloseRegistrationPreparation(); });
+    const bool waited = closing.wait_for(std::chrono::milliseconds(20)) == std::future_status::timeout;
+    gate.set_value();
+    const bool returned = closing.wait_for(std::chrono::seconds(10)) == std::future_status::ready;
+    const bool wokeUp = woken.wait_for(std::chrono::seconds(10)) == std::future_status::ready;
+    closing.get();
+    Require(waiting, "a waiter for the library prebuilds returned while one was still running");
+    Require(waited, "closing returned while a library prebuild was still running");
+    Require(returned, "closing did not return once the running library prebuild ended");
+    Require(wokeUp, "a waiter for the library prebuilds did not return after closing dropped the queued ones");
+    Require(!queuedRan, "closing ran the queued library prebuilds");
+    Require(RegistrationPreparationThreads() == 0, "closing the library prebuilds left their thread running");
+}
+
 void StoppingJoinsCompareHelpers() {
     using namespace AgcDriver::Graphics;
     const std::vector<std::byte> first(std::size_t{2} << 20u, std::byte{1});
@@ -168,6 +203,7 @@ int main(int argc, char** argv) {
     try {
         const std::string_view mode = argc > 1 ? argv[1] : "";
         if (mode == "--joined") ClosingJoinsPreparation();
+        else if (mode == "--queued-prebuilds") ClosingDropsQueuedPrebuilds();
         else if (mode == "--compare-helpers") StoppingJoinsCompareHelpers();
         else if (mode == "--draw-committer") ShutdownJoinsDrawCommitter();
         else if (mode == "--shader-cache-writer") ShutdownJoinsShaderCacheWriter();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp
index a7a25f9f88..55cae19285 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SparseBufferHoles.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/GuestBufferMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "VulkanTestDevice.hpp"
+#include "FixtureDeviceSelection.hpp"
 #include <SDL_loadso.h>
 #ifdef _WIN32
 #ifndef NOMINMAX
@@ -40,6 +41,8 @@ public:
     Device() {
 #ifdef _WIN32
         library = SDL_LoadObject("vulkan-1.dll");
+#elif defined(__APPLE__)
+        library = SDL_LoadObject("libvulkan.1.dylib");
 #else
         library = SDL_LoadObject("libvulkan.so.1");
 #endif
@@ -51,6 +54,12 @@ public:
             application.apiVersion = VK_API_VERSION_1_1;
             VkInstanceCreateInfo info{VK_STRUCTURE_TYPE_INSTANCE_CREATE_INFO};
             info.pApplicationInfo = &application;
+#ifdef __APPLE__
+            const char* portability = VK_KHR_PORTABILITY_ENUMERATION_EXTENSION_NAME;
+            info.flags = VK_INSTANCE_CREATE_ENUMERATE_PORTABILITY_BIT_KHR;
+            info.enabledExtensionCount = 1;
+            info.ppEnabledExtensionNames = &portability;
+#endif
             Check(function<PFN_vkCreateInstance>("vkCreateInstance")(&info, nullptr, &instance), "vkCreateInstance");
             std::uint32_t count = 0;
             const auto enumerate = function<PFN_vkEnumeratePhysicalDevices>("vkEnumeratePhysicalDevices");
@@ -58,18 +67,7 @@ public:
             Require(count != 0, "no Vulkan device");
             std::vector<VkPhysicalDevice> devices(count);
             Check(enumerate(instance, &count, devices.data()), "vkEnumeratePhysicalDevices");
-            const auto properties = function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties");
-            int rank = -1;
-            for (const auto candidate : devices) {
-                VkPhysicalDeviceProperties described{};
-                properties(candidate, &described);
-                if (described.apiVersion < VK_API_VERSION_1_1) continue;
-                const int candidateRank = described.deviceType == VK_PHYSICAL_DEVICE_TYPE_DISCRETE_GPU ? 2 : described.deviceType == VK_PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU ? 1 : 0;
-                if (candidateRank <= rank) continue;
-                context.physical = candidate;
-                rank = candidateRank;
-            }
-            Require(context.physical != VK_NULL_HANDLE, "no Vulkan 1.1 device");
+            context.physical = SelectFixturePhysicalDevice(devices, function<PFN_vkGetPhysicalDeviceProperties>("vkGetPhysicalDeviceProperties"));
             VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
             VkPhysicalDeviceProperties2 selected{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &subgroup};
             function<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(context.physical, &selected);
@@ -325,7 +323,7 @@ void Run(const Context& context, const CopyPipeline& pipeline, bool writable, co
     std::memset(readback.Bytes().data(), 0xcc, BufferBytes);
     VkBuffer primed = VK_NULL_HANDLE;
     {
-        Buffer earlier(context, BufferBytes, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT);
+        Buffer earlier(context, BufferBytes, VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT);
         primed = earlier.Handle();
         std::memset(earlier.Bytes().data(), 0xa5, BufferBytes);
     }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp
index 809321d1b5..20a4dc48e2 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SparseIndirectIndices.cpp
@@ -168,7 +168,7 @@ void Target(std::vector<std::uint32_t>& words, void* pointer) {
     Append(words, 0x69, {0x390, static_cast<std::uint32_t>(address >> 40u)});
 }
 
-void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap, bool unreadable) {
+void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap, bool unreadable, bool sized = true, std::uint32_t second = DeclaredIndices) {
     indices.Fill(size);
     Reference.fill(Kept);
     Actual.fill(Kept);
@@ -177,7 +177,7 @@ void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap,
     const auto first = unreadable ? 16u / size : afterGap ? indices.AfterGap(size) : 0u;
     Records[8] = 3;
     Records[9] = 1;
-    Records[10] = DeclaredIndices;
+    Records[10] = second;
     Records[16] = 3;
     Records[17] = 1;
     Records[18] = 16u / size;
@@ -192,7 +192,7 @@ void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap,
     Target(words, Actual.data());
     Append(words, 0x2a, {size == 2 ? 0u : 1u});
     Append(words, 0x26, {Low(indices.Base()), High(indices.Base())});
-    Append(words, 0x13, {DeclaredIndices});
+    if (sized) Append(words, 0x13, {DeclaredIndices});
     Append(words, 0x11, {1, Low(Records.data()), High(Records.data())});
     if (multi) Append(words, 0x38, {0, 0, 0, 0x40000280u, 3, Low(Count.data()), High(Count.data()), 32, 0});
     else Append(words, 0x25, {0, 0, 0, 0});
@@ -204,7 +204,7 @@ void Run(SparseIndices& indices, std::uint32_t size, bool multi, bool afterGap,
     const auto covered = std::count_if(Reference.begin(), Reference.end(), [](std::byte value) { return value != Kept; });
     Require(covered != 0, "the reference triangle did not draw");
     Require(Actual == Reference, "the sparse indexed indirect draw differs from the reference triangle");
-    std::cout << "sparse indices " << size << " bytes, " << (multi ? "counted multi" : "single") << ", " << (afterGap ? "after gap" : "before gap") << " passed\n";
+    std::cout << "sparse indices " << size << " bytes, " << (multi ? "counted multi" : "single") << ", " << (afterGap ? "after gap" : "before gap") << (sized ? "" : ", no index size") << " passed\n";
 }
 
 }
@@ -218,10 +218,13 @@ int main(int argc, char** argv) {
         Register(VertexHeader, VertexCode.data(), sizeof(VertexCode), 2);
         Register(PixelHeader, PixelCode.data(), sizeof(PixelCode), 1);
         SparseIndices indices;
-        if (argc == 2 && std::string(argv[1]) == "--unreadable") {
+        const std::string mode = argc == 2 ? argv[1] : "";
+        if (mode == "--unreadable" || mode == "--no-size-unreadable" || mode == "--no-size-unreadable-record") {
             bool refused = false;
             try {
-                Run(indices, 2, false, false, true);
+                if (mode == "--unreadable") Run(indices, 2, false, false, true);
+                else if (mode == "--no-size-unreadable") Run(indices, 2, false, false, true, false);
+                else Run(indices, 2, true, false, false, false);
             } catch (const std::runtime_error& error) {
                 const std::string message = error.what();
                 refused = message.find("guest memory is not readable") != std::string::npos && message.find("+0x6)") != std::string::npos;
@@ -232,10 +235,11 @@ int main(int argc, char** argv) {
             std::cout << "the unreadable indirect index range was refused\n";
             return 0;
         }
+        const bool sized = mode != "--no-size";
         for (const auto size : {2u, 4u}) {
             for (const auto multi : {false, true}) {
-                Run(indices, size, multi, false, false);
-                Run(indices, size, multi, true, false);
+                Run(indices, size, multi, false, false, sized, sized ? DeclaredIndices : 0u);
+                Run(indices, size, multi, true, false, sized, sized ? DeclaredIndices : 0u);
             }
         }
         AgcDriverShutdown_nid_postfix();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp
index a3a273ff50..87090fa580 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StorageCacheBudget.cpp
@@ -162,6 +162,7 @@ int main(int argc, char** argv) {
             Require(first != nullptr, "surface 0 has no cached storage image");
             Require(AgcDriver::Graphics::SharedResourceCache().Size() != 0, "the storage cache workload did not populate the resource cache");
             const auto held = std::max<std::uint64_t>(first->AllocationBytes(), first->GuestBytes());
+            const auto allocated = first->AllocationBytes();
             const auto reused = static_cast<std::uint32_t>(FixedBudget / held) + 1u;
             std::printf("texture cache budget %llu MiB; each 512x512 32_UINT surface holds %llu MiB; cyclic set of %u surfaces (%llu MiB)\n", static_cast<unsigned long long>(budget >> 20u), static_cast<unsigned long long>(held >> 20u), reused, static_cast<unsigned long long>((reused * held) >> 20u));
             Require(budget >= reused * held, "the cyclic set exceeds the test cache budget");
@@ -183,8 +184,8 @@ int main(int argc, char** argv) {
                 Require(cached == (surface >= 2u), "surface " + std::to_string(surface) + (cached ? " is still cached" : " was evicted") + " after " + std::to_string(capacity + 2u) + " surfaces under a budget of " + std::to_string(capacity) + " of them");
                 Require(cached == !images[surface].expired(), "surface " + std::to_string(surface) + (cached ? " is cached but its weak image expired" : " was evicted but its resource cache image is still alive"));
             }
-            const auto released = AgcDriver::Graphics::ReleaseTextureCaches(held);
-            Require(released >= held, "a release of one image's bytes freed " + std::to_string(released >> 20u) + " MiB, less than the " + std::to_string(held >> 20u) + " MiB of the oldest image");
+            const auto released = AgcDriver::Graphics::ReleaseTextureCaches(allocated);
+            Require(released == allocated, "a release of one image's bytes counted " + std::to_string(released) + " bytes, not its " + std::to_string(allocated) + "-byte allocation");
             Require(StorageTexture::FindLive(base + 2u * Stride, SurfaceBytes) == nullptr && images[2].expired(), "the oldest cached storage image survived a release of its bytes");
             Require(StorageTexture::FindLive(base + 3u * Stride, SurfaceBytes) != nullptr && !images[3].expired(), "a release of one image's bytes evicted more than the oldest image");
             Require(StorageTexture::FindLive(base + (capacity + 1u) * Stride, SurfaceBytes) != nullptr, "a release of one image's bytes evicted the newest image");
@@ -194,11 +195,11 @@ int main(int argc, char** argv) {
                 Require(Store(*device, base, 4) != nullptr, "surface 4 is not cached");
                 for (std::uint32_t surface = 5; surface < capacity + 2u; ++surface) Require(Store(*device, base, surface) != nullptr, "surface " + std::to_string(surface) + " is not cached");
             }
-            Require(AgcDriver::Graphics::ReleaseTextureCaches(held) >= held, "a release with a dirty oldest image freed nothing");
+            Require(AgcDriver::Graphics::ReleaseTextureCaches(allocated) == allocated, "a release with a dirty oldest image did not free one clean allocation");
             Require(StorageTexture::FindLive(base + 3u * Stride, SurfaceBytes) != nullptr, "a release took the dirty oldest image before a clean one");
             Require(StorageTexture::FindLive(base + 4u * Stride, SurfaceBytes) == nullptr && images[4].expired(), "a release did not take the oldest clean image");
             const auto rest = AgcDriver::Graphics::ReleaseTextureCaches(~std::uint64_t{0});
-            Require(rest >= held * (capacity - 3u), "a release of everything freed " + std::to_string(rest >> 20u) + " MiB of the " + std::to_string((held * (capacity - 3u)) >> 20u) + " MiB cached");
+            Require(rest == allocated * (capacity - 3u), "a release of everything counted " + std::to_string(rest) + " bytes, not the " + std::to_string(allocated * (capacity - 3u)) + " bytes allocated");
             device->WaitIdle();
             for (std::uint32_t surface = 0; surface < capacity + 2u; ++surface) {
                 if (surface == 3u) continue;
@@ -210,7 +211,7 @@ int main(int argc, char** argv) {
             }
             StorageTexture::FlushPending(base + 3u * Stride, static_cast<std::size_t>(SurfaceBytes), nullptr, "test");
             device->WaitIdle();
-            Require(AgcDriver::Graphics::ReleaseTextureCaches(~std::uint64_t{0}) >= held, "a release did not take the image once its results were stored");
+            Require(AgcDriver::Graphics::ReleaseTextureCaches(~std::uint64_t{0}) == allocated, "a release did not take the image once its results were stored");
             Require(StorageTexture::FindLive(base + 3u * Stride, SurfaceBytes) == nullptr, "surface 3 survived a release after its results were stored");
             Require(AgcDriver::Graphics::ReleaseTextureCaches(held) == 0, "a release from empty caches reported freed bytes");
         } catch (...) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp
index 6fd7ebae81..5b9fbc5ade 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StorageFileWrite.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
@@ -35,27 +38,6 @@
 #endif
 
 class FileStream;
-struct GuestIovec { void* base; std::size_t length; };
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelWritev(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelPwritev(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI _write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest*, std::int32_t, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest*, std::int32_t, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t, std::int32_t*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-}
 
 namespace {
 
@@ -192,7 +174,7 @@ bool CheckWrite(Api api, const char* name, GuestSurface& surface, GuestSurface&
     const auto hold = ProduceHeld(surface, unrelated);
     OutputFile file;
     auto* source = surface.Data() + SourceOffset;
-    const std::array<GuestIovec, 4> vectors{{{source, 111}, {nullptr, 0}, {source + 111, 65537}, {source + 65648, TransferBytes - 65648}}};
+    const std::array<KernelIovec, 4> vectors{{{source, 111}, {nullptr, 0}, {source + 111, 65537}, {source + 65648, TransferBytes - 65648}}};
     const bool positioned = api == Api::Pwrite || api == Api::PosixPwrite || api == Api::Pwritev || api == Api::PosixPwritev || api == Api::Aio || api == Api::AioMultiple;
     if (api == Api::Fwrite) {
         auto* stream = fopen_nid_postfix(file.Name().c_str(), "wb");
@@ -237,7 +219,7 @@ bool CheckWrite(Api api, const char* name, GuestSurface& surface, GuestSurface&
             KernelAioResult result{};
             KernelAioRwRequest request{FileOffset, TransferBytes, source, &result, output};
             std::int32_t id = 0;
-            Require((api == Api::Aio ? sceKernelAioSubmitWriteCommands(&request, 1, 0, &id) : sceKernelAioSubmitWriteCommandsMultiple(&request, 1, 0, &id)) == 0, "file write: AIO submission failed");
+            Require((api == Api::Aio ? sceKernelAioSubmitWriteCommands(&request, 1, 1, &id) : sceKernelAioSubmitWriteCommandsMultiple(&request, 1, 1, &id)) == 0, "file write: AIO submission failed");
             std::int32_t removed = -1;
             Require(sceKernelAioDeleteRequest(id, &removed) == 0 && removed == 0, "file write: AIO deletion failed");
             Require(result.state == 3, "file write: AIO did not complete");
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp
index b2935dd9c9..c9c8e08c3a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StoreIdleResults.cpp
@@ -112,7 +112,7 @@ int main(int argc, char** argv) {
 
         Store(texels);
         if (wake) {
-            const auto pendingDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+            const auto pendingDeadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
             while (!AgcDriver::Graphics::StorageTexture::AnyPending() && std::chrono::steady_clock::now() < pendingDeadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
             Require(AgcDriver::Graphics::StorageTexture::AnyPending(), "idle wake fixture did not observe pending storage results");
             std::this_thread::sleep_for(std::chrono::milliseconds(5));
@@ -127,7 +127,7 @@ int main(int argc, char** argv) {
             cpu = nextTexels;
             Store(nextTexels);
         }
-        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
         while (!stored() && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
         Require(stored(), "the queue-idle store did not bring the result to guest memory without a direct flush or further submission");
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/SubmitProgress.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/SubmitProgress.cpp
new file mode 100644
index 0000000000..1996782ef5
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/SubmitProgress.cpp
@@ -0,0 +1,154 @@
+#include "VulkanTestDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+void Require(bool condition, const char* message) { if (!condition) throw std::runtime_error(message); }
+alignas(256) std::array<std::uint32_t, 15> Code{0xf4080200u, 0xfa000000u, 0xbe840381u, 0x9304ff04u, 0x0019660du, 0x8004ff04u, 0x3c6ef35fu, 0x80828102u, 0xbf078002u, 0xbf85fff9u, 0xbf8cc07fu, 0x7e000204u, 0xe0700000u, 0x80020000u, 0xbf810000u};
+std::uint32_t Low(const void* p) { return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(p)); }
+std::uint32_t High(const void* p) { return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(p) >> 32u); }
+void Set(std::vector<std::uint32_t>& words, std::uint32_t reg, std::uint32_t value) { words.insert(words.end(), {0xc0017600u, reg, value}); }
+void Dispatch(std::vector<std::uint32_t>& words, const void* descriptor, std::uint32_t iterations = 32) {
+    const auto address = reinterpret_cast<std::uintptr_t>(Code.data());
+    Set(words, 0x20c, static_cast<std::uint32_t>(address >> 8u));
+    Set(words, 0x20d, static_cast<std::uint32_t>(address >> 40u));
+    for (auto reg : {0x207u, 0x208u, 0x209u}) Set(words, reg, 1);
+    Set(words, 0x212, 0); Set(words, 0x213, 6); Set(words, 0x240, Low(descriptor)); Set(words, 0x241, High(descriptor)); Set(words, 0x242, iterations);
+    words.insert(words.end(), {0xc0031500u, 1, 1, 1, 0x8041u});
+}
+void Release(std::vector<std::uint32_t>& words, const void* label, std::uint32_t value) {
+    const std::uint32_t interrupt = value % 2 == 0 ? 2 : 0;
+    words.insert(words.end(), {0xc0064900u, 0x514u, (2u << 29u) | (interrupt << 24u), Low(label), High(label), value, 0u, 0u});
+}
+void Await(const std::uint32_t* label, std::uint32_t value) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    while (*static_cast<const volatile std::uint32_t*>(label) != value) {
+        Require(std::chrono::steady_clock::now() < deadline, "submission lost its real GPU completion store");
+        std::this_thread::yield();
+    }
+    AgcDriverWaitIdle_nid_postfix();
+}
+}
+
+int main() {
+    void* block = nullptr;
+    try {
+        auto device = OpenVulkanTestDevice(); if (!device) return VulkanTestSkipped; device.reset();
+#ifdef _WIN32
+        block = VirtualAlloc(nullptr, 65536, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+#else
+        block = std::aligned_alloc(65536, 65536);
+#endif
+        Require(block != nullptr, "cannot allocate submit-progress guest memory");
+        std::memset(block, 0, 65536);
+        GuestAllocations::Mutation().Add(block, 65536, true, true, true);
+        auto* output = static_cast<std::uint32_t*>(block);
+        auto* descriptor = output + 64; auto* label = output + 128; auto* neighbor = output + 192;
+        descriptor[0] = Low(output); descriptor[1] = High(output) & 0xffffu; descriptor[2] = 16; descriptor[3] = 0x31016facu;
+        *neighbor = 0xabcdef12u;
+        const auto submit = [&](std::uint32_t value) {
+            *label = 0; label[1] = 0xfeedbeefu;
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 8);
+            std::vector<std::uint32_t> words; Dispatch(words, descriptor);
+            if (value % 2 != 0) {
+                auto* selfGate = output + 384; selfGate[0] = 0; selfGate[1] = 0;
+                AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(selfGate), 8);
+                Release(words, selfGate, 1);
+                if (value % 3 == 0) words.insert(words.end(), {0xc0079300u, 0x13u, Low(selfGate), High(selfGate), 1, 0, 0xffffffffu, 0xffffffffu, 4});
+                else words.insert(words.end(), {0xc0053c00u, 0x13u, Low(selfGate), High(selfGate), 1, 0xffffffffu, 4});
+            }
+            Release(words, label, value);
+            Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+            AgcDriver::Submit(&packet, 0);
+        };
+        submit(1); Await(label, 1);
+        std::uint32_t ready = 0;
+        for (std::uint32_t value = 2; value < 66; ++value) {
+            submit(value);
+            ready += *static_cast<volatile std::uint32_t*>(label) == value;
+            Await(label, value);
+            Require(*label == value, "submission lost its real GPU completion store");
+            Require(label[1] == 0, "64-bit GPU marker did not replace its genuine CPU-written high word");
+            Require(*neighbor == 0xabcdef12u, "progress wait damaged neighboring guest bytes");
+        }
+        std::cout << ready << "/64 small dependent submissions completed at return\n";
+        std::uint32_t prefixesReady = 0;
+        for (std::uint32_t index = 0; index < 16; ++index) {
+            auto* continued = output + 320;
+            *continued = 0; *label = 0;
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 8);
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(continued), 8);
+            std::vector<std::uint32_t> prefix; Dispatch(prefix, descriptor); Release(prefix, label, 100 + index);
+            prefix.insert(prefix.end(), {0xc0005900u, 0u});
+            const auto control = prefix.size() - 1;
+            Release(prefix, continued, 200 + index);
+            Packet prefixPacket{prefix.data(), static_cast<std::uint32_t>(prefix.size()), 0, {}};
+            AgcDriver::Submit(&prefixPacket, 0);
+            prefixesReady += *static_cast<volatile std::uint32_t*>(label) == 100 + index;
+            Require(*continued == 0, "an unreleased REWIND continuation executed early");
+            std::atomic<bool> logicalDone{false}, waiterFailed{false};
+            std::thread waiter;
+            bool earlyLogicalCompletion = false;
+            if (index == 0) {
+                waiter = std::thread([&] {
+                    try { AgcDriverWaitIdle_nid_postfix(); logicalDone.store(true, std::memory_order_release); }
+                    catch (...) { waiterFailed.store(true, std::memory_order_release); }
+                });
+                std::this_thread::sleep_for(std::chrono::milliseconds(2));
+                earlyLogicalCompletion = logicalDone.load(std::memory_order_acquire);
+            }
+            std::atomic_ref<std::uint32_t>(prefix[control]).store(0x80000000u, std::memory_order_release);
+            AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(&prefix[control]), 4);
+            Await(label, 100 + index); Await(continued, 200 + index);
+            if (waiter.joinable()) waiter.join();
+            Require(!waiterFailed.load() && !earlyLogicalCompletion, "prefix acknowledgement completed the unreleased logical submission");
+        }
+        std::cout << prefixesReady << "/16 finite REWIND prefixes completed at return\n";
+        auto* gate = output + 256; *gate = 0; *label = 0;
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(gate), 4);
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 4);
+        std::vector<std::uint32_t> waiting{0xc0053c00u, 0x13u, Low(gate), High(gate), 1, 0xffffffffu, 0x19u};
+        Release(waiting, label, 77);
+        Packet waitPacket{waiting.data(), static_cast<std::uint32_t>(waiting.size()), 0, {}};
+        AgcDriver::Submit(&waitPacket, 0);
+        Require(*label == 0, "dependent wait fabricated its completion");
+        *gate = 1;
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(gate), 4);
+        Await(label, 77);
+        *label = 0;
+        AgcDriver::GuestMemory::MarkWritten(reinterpret_cast<std::uintptr_t>(label), 4);
+        std::vector<std::uint32_t> slow; Dispatch(slow, descriptor, 1u << 22u); Release(slow, label, 78);
+        Packet slowPacket{slow.data(), static_cast<std::uint32_t>(slow.size()), 0, {}};
+        const auto began = std::chrono::steady_clock::now();
+        AgcDriver::Submit(&slowPacket, 0);
+        Require(std::chrono::steady_clock::now() - began < std::chrono::milliseconds(100), "progress budget became an unbounded GPU drain");
+        Await(label, 78);
+        Require(*neighbor == 0xabcdef12u, "pending progress work damaged neighboring guest bytes");
+        AgcDriverShutdown_nid_postfix();
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try { AgcDriverShutdown_nid_postfix(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp
index 87c935f0d2..7f13530d09 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/Tessellation.cpp
@@ -22,6 +22,7 @@
 #include <span>
 #include <string>
 #include <tuple>
+#include <unordered_set>
 #include <utility>
 #include <vector>
 
@@ -156,6 +157,22 @@ alignas(256) constexpr std::array<std::uint32_t, 29> LocalIndexAsData{
     0x0000030a, 0xd8340010, 0x0000070a, 0xbf8cc07f, 0xbefd2106,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 7> LocalInactiveIndex{
+    0x7e108704, 0x7da80b02, 0x160e06a8, 0x7e060302, 0xd9340020, 0x00000207, 0xbe802006,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 8> LocalRestoredIndex{
+    0x7e108704, 0x160e06a8, 0x7da80b02, 0x7e060302, 0xbefe04c1, 0xd9340020, 0x00000207, 0xbe802006,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> LocalObservedWindow{
+    0xbefc0383, 0x7da80b02, 0x160e06a8, 0x7e108704, 0xd9340020, 0x00000807, 0xbe802006,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 9> LocalNegatedConjunction{
+    0x7d880b02, 0x160e06a8, 0x02100e80, 0x7da20d02, 0x87fe6a7e, 0xbefe087e, 0xd9340020, 0x00000807, 0xbe802006,
+};
+
 alignas(256) constexpr std::array<std::uint32_t, 50> HullDescendingRecords{
     0xd7650000, 0x000100c1, 0xd7660000, 0x000200c1, 0xbf8a0000, 0x7da206f9, 0x81060000, 0xd5480014,
     0x02151101, 0x362402ff, 0x000000ff, 0x160028a0, 0xd5430015, 0x040224ff, 0x00000060, 0xdbfc0000,
@@ -946,6 +963,28 @@ void RequireMergedHullWithoutSubgroups(const ShaderRecompiler::SpirvTarget& targ
     }
 }
 
+void RequireMergedHullConstantIndices(const ShaderRecompiler::SpirvTarget& target) {
+    std::uint32_t cursor = 0;
+    const auto hull = Compile(target, ShaderStage::TessellationControl, MergedHullCode, cursor, MergedTriangles);
+    const auto words = hull.spirv.Words();
+    std::unordered_set<std::uint32_t> constants;
+    std::unordered_set<std::uint32_t> folded;
+    for (std::size_t at = 5; at + 1u < words.size(); at += words[at] >> 16u) {
+        const auto count = words[at] >> 16u;
+        Require(count != 0u && at + count <= words.size(), "the merged hull program compiled to a malformed SPIR-V instruction");
+        const auto opcode = words[at] & 0xffffu;
+        if (opcode == spv::OpConstant && count >= 3u) constants.insert(words[at + 2u]);
+        const bool integer = opcode == spv::OpIAdd || opcode == spv::OpIMul || opcode == spv::OpUDiv || opcode == spv::OpUMod || opcode == spv::OpShiftRightLogical || opcode == spv::OpBitwiseAnd;
+        const auto operand = [&](std::uint32_t id) { return constants.contains(id) || folded.contains(id); };
+        if (integer && count == 5u && operand(words[at + 3u]) && operand(words[at + 4u])) folded.insert(words[at + 2u]);
+        if (opcode == spv::OpAccessChain) {
+            for (std::uint32_t index = 4u; index < count; ++index) {
+                Require(!folded.contains(words[at + index]), "the merged hull program indexes a tessellation attribute with arithmetic on constants instead of a constant, which AMD's Windows driver reads wrongly");
+            }
+        }
+    }
+}
+
 void RequireRegisteredMergedStages() {
     const auto low = [](const auto& code) { return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(code.data()) >> 8u); };
     const auto high = [](const auto& code) { return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(code.data()) >> 40u); };
@@ -982,6 +1021,13 @@ int main() {
         ExpectRefusal(target, ShaderStage::TessellationEvaluation, DomainNeighbourPoint, "neither its patch's control points nor a patch-constant record", RecordPatches);
         ExpectRefusal(target, ShaderStage::TessellationEvaluation, DomainCulledPrimitive, "passthrough primitive");
         ExpectRefusal(target, ShaderStage::Local, LocalIndexAsData, "outside a tessellation ring or LDS address");
+        {
+            std::uint32_t cursor = 0;
+            Require(!Compile(target, ShaderStage::Local, LocalInactiveIndex, cursor).spirv.empty(), "a local program whose relative index survives only on inactive lanes was not compiled");
+        }
+        ExpectRefusal(target, ShaderStage::Local, LocalRestoredIndex, "outside a tessellation ring or LDS address");
+        ExpectRefusal(target, ShaderStage::Local, LocalObservedWindow, "outside a tessellation ring or LDS address");
+        ExpectRefusal(target, ShaderStage::Local, LocalNegatedConjunction, "outside a tessellation ring or LDS address");
         ExpectRefusal(target, ShaderStage::TessellationControl, HullRelativeData, "GE_CNTL.PRIM_GRP_SIZE is 0", RecordPatches);
         ExpectRefusal(target, ShaderStage::TessellationEvaluation, DomainRelativeData, "GE_CNTL.PRIM_GRP_SIZE is 0", RecordPatches);
         ExpectRefusal(target, ShaderStage::TessellationControl, HullCode, "outside its patch's quad factors", {{3u, 3u, 2u, 2u, 2u}, Indices});
@@ -1003,6 +1049,7 @@ int main() {
         ExpectRefusal(target, ShaderStage::TessellationControl, MergedHullOutsidePatch, "reads LDS outside its patch's control point records", MergedTriangles);
         ExpectRefusal(target, ShaderStage::TessellationControl, MergedHullReadLane, "another lane's register", MergedTriangles);
         RequireMergedHullWithoutSubgroups(target);
+        RequireMergedHullConstantIndices(target);
         RequirePatches(*device, target, MergedHullCode, "merged hull program", MergedTriangles, MergedHullCode);
         RequirePatches(*device, target, MergedHullRegisters, "merged hull program storing its local part's registers", MergedTriangles, MergedHullRegisters);
         RequireCounterClockwise(*device, target);
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VCvtPkU8F32RoundMode.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VCvtPkU8F32RoundMode.cpp
new file mode 100644
index 0000000000..777bd3e290
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VCvtPkU8F32RoundMode.cpp
@@ -0,0 +1,141 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 64;
+constexpr std::uint32_t Inputs = 4;
+alignas(256) std::array<std::uint32_t, Threads * Inputs> Input{};
+alignas(256) std::array<std::uint32_t, Threads> Output{};
+
+alignas(256) constexpr std::array<std::uint32_t, 10> Code{
+    0x34020084u, 0x34040082u, 0xe0381000u, 0x80000401u, 0xbf8c3f70u, 0xd55e000au, 0x02010104u, 0xe0701000u,
+    0x80010a02u, 0xbf810000u,
+};
+
+struct PackVector {
+    std::uint32_t value;
+    std::uint32_t denormalsFlushed[4];
+    std::uint32_t denormalsKept[4];
+};
+
+constexpr std::array<PackVector, 38> Vectors{{
+    {0x00000000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x3e000000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x3e800000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x3f000000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x3f400000u, {0x01u, 0x01u, 0x00u, 0x00u}, {0x01u, 0x01u, 0x00u, 0x00u}},
+    {0x3f800000u, {0x01u, 0x01u, 0x01u, 0x01u}, {0x01u, 0x01u, 0x01u, 0x01u}},
+    {0x3fa00000u, {0x01u, 0x02u, 0x01u, 0x01u}, {0x01u, 0x02u, 0x01u, 0x01u}},
+    {0x3fc00000u, {0x02u, 0x02u, 0x01u, 0x01u}, {0x02u, 0x02u, 0x01u, 0x01u}},
+    {0x40200000u, {0x02u, 0x03u, 0x02u, 0x02u}, {0x02u, 0x03u, 0x02u, 0x02u}},
+    {0x40600000u, {0x04u, 0x04u, 0x03u, 0x03u}, {0x04u, 0x04u, 0x03u, 0x03u}},
+    {0x40700000u, {0x04u, 0x04u, 0x03u, 0x03u}, {0x04u, 0x04u, 0x03u, 0x03u}},
+    {0x42ff0000u, {0x80u, 0x80u, 0x7fu, 0x7fu}, {0x80u, 0x80u, 0x7fu, 0x7fu}},
+    {0x43008000u, {0x80u, 0x81u, 0x80u, 0x80u}, {0x80u, 0x81u, 0x80u, 0x80u}},
+    {0x43482000u, {0xc8u, 0xc9u, 0xc8u, 0xc8u}, {0xc8u, 0xc9u, 0xc8u, 0xc8u}},
+    {0x437e8000u, {0xfeu, 0xffu, 0xfeu, 0xfeu}, {0xfeu, 0xffu, 0xfeu, 0xfeu}},
+    {0x437ea000u, {0xffu, 0xffu, 0xfeu, 0xfeu}, {0xffu, 0xffu, 0xfeu, 0xfeu}},
+    {0x437ee000u, {0xffu, 0xffu, 0xfeu, 0xfeu}, {0xffu, 0xffu, 0xfeu, 0xfeu}},
+    {0x437f0000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437f4000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437f7fffu, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437f8000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x437fe000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x43800000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0x501502f9u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0xbe000000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xbf000000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xbeffffffu, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xbf800000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xd01502f9u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x00000001u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x80000001u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x007fffffu, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x00800000u, {0x00u, 0x01u, 0x00u, 0x00u}, {0x00u, 0x01u, 0x00u, 0x00u}},
+    {0x7f800000u, {0xffu, 0xffu, 0xffu, 0xffu}, {0xffu, 0xffu, 0xffu, 0xffu}},
+    {0xff800000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x7fc00000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0xffc00000u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+    {0x7f800001u, {0x00u, 0x00u, 0x00u, 0x00u}, {0x00u, 0x00u, 0x00u, 0x00u}},
+}};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+void Run(AgcDriver::VulkanDevice& device, ShaderRecompiler::ShaderFloatMode floatMode) {
+    Input.fill(0u);
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) Input[lane * Inputs] = Vectors[lane].value;
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(8, 0u);
+    const auto input = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size() * 4u));
+    std::copy(input.begin(), input.end(), userData.begin());
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    const std::span<const std::uint32_t> code(Code);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    request.context.floatMode = floatMode;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+}
+
+void Check(bool kept, std::uint32_t rounding, bool ieee) {
+    for (std::uint32_t lane = 0; lane < Vectors.size(); ++lane) {
+        const auto& vector = Vectors[lane];
+        const auto expected = kept ? vector.denormalsKept[rounding] : vector.denormalsFlushed[rounding];
+        Require(Output[lane] == expected, std::string("v_cvt_pk_u8_f32 round mode ") + std::to_string(rounding) + (kept ? ", f32 denormals kept" : ", f32 denormals flushed") +
+                                              (ieee ? ", IEEE=1" : ", IEEE=0") + " of " + Hex(vector.value) + " is " + Hex(Output[lane]) + ", expected " + Hex(expected));
+    }
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        for (const bool kept : {false, true}) {
+            for (std::uint32_t rounding = 0; rounding < 4u; ++rounding) {
+                for (const bool ieee : {false, true}) {
+                    Run(*device, ShaderRecompiler::ShaderFloatMode{(kept ? 0xf0u : 0xc0u) | rounding, true, ieee, false});
+                    Check(kept, rounding, ieee);
+                }
+            }
+        }
+        std::puts("v_cvt_pk_u8_f32 round mode tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VertexPointSize.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VertexPointSize.cpp
new file mode 100644
index 0000000000..253201b452
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VertexPointSize.cpp
@@ -0,0 +1,165 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstring>
+#include <exception>
+#include <iostream>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Extent = 64u;
+constexpr std::uint32_t MiscVector = 1u << 21u;
+constexpr std::uint32_t VertexPointSize = 1u << 16u;
+alignas(256) std::array<std::byte, Extent * Extent * 4u> pixels{};
+alignas(256) std::array<std::byte, 512> vertices{};
+constexpr std::array<std::uint32_t, 11> positionCode{0xf4080100u, 0xfa000000u, 0x4a0a0a02u, 0x4a0a0b08u, 0x4a0a0a03u, 0xe00c2000u, 0x80010005u, 0xbf8c3f70u, 0xf80008cfu, 0x03020100u, 0xbf810000u};
+constexpr std::array<std::uint32_t, 5> pixelCode{0x7e0002f2u, 0x7e020280u, 0xf800180fu, 0x00010100u, 0xbf810000u};
+
+std::vector<std::uint32_t> SizeExportCode(float size) {
+    std::vector<std::uint32_t> code(positionCode.begin(), positionCode.begin() + 8);
+    code.insert(code.end(), {0x7e0802ffu, std::bit_cast<std::uint32_t>(size), 0xf80000cfu, 0x03020100u, 0xf80008d1u, 0x00000004u, 0xbf810000u});
+    return code;
+}
+
+struct PointSize {
+    float size = 1.0f;
+    float minimum = 0.0f;
+    float maximum = 0.0f;
+    bool fromVertex = false;
+};
+
+struct Square {
+    unsigned pixels = 0;
+    std::uint32_t left = Extent, top = Extent, right = 0, bottom = 0;
+};
+
+std::vector<Square> RunCase(AgcDriver::VulkanDevice& device, const char* name, std::span<const std::uint32_t> vertexCode, const PointSize& points, float offset) {
+    const std::array<std::array<float, 2>, 4> centres{{{16.0f, 16.0f}, {48.0f, 16.0f}, {16.0f, 48.0f}, {48.0f, 48.0f}}};
+    vertices.fill(std::byte{0});
+    constexpr std::uint32_t stride = 16u;
+    for (std::size_t index = 0; index < centres.size(); ++index) {
+        const std::array<float, 4> position{(centres[index][0] + offset) / Extent * 2.0f - 1.0f, (centres[index][1] + offset) / Extent * 2.0f - 1.0f, 0.0f, 1.0f};
+        std::memcpy(vertices.data() + index * stride, position.data(), sizeof(position));
+    }
+    std::array<std::uint32_t, 4> descriptor{};
+    const auto tableAddress = reinterpret_cast<std::uintptr_t>(descriptor.data());
+    std::array<std::uint32_t, 4> userData{static_cast<std::uint32_t>(tableAddress), static_cast<std::uint32_t>(tableAddress >> 32u), 0u, 0u};
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{tableAddress, std::as_bytes(std::span(descriptor))}}};
+    ShaderRecompiler::ShaderVertexStageInfo vertexInfo{};
+    vertexInfo.fetchEmbedded = true;
+    vertexInfo.resourcesNum = 1u;
+    vertexInfo.resourcesDst[0] = {0, 4, 0, 0};
+    vertexInfo.paClVsOutCntl = points.fromVertex ? MiscVector | VertexPointSize : 0u;
+    vertexInfo.pointList = true;
+    vertexInfo.pointSize = points.size;
+    vertexInfo.pointSizeMin = points.minimum;
+    vertexInfo.pointSizeMax = points.maximum;
+    ShaderRecompiler::RecompileRequest request{{ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(vertexCode.data()), vertexCode, 0, {}}, {32u, 0u, userData, std::nullopt, std::nullopt, vertexInfo, memory}, device.Target(), {0u, 0u, 0u, 96u}};
+    const auto address = reinterpret_cast<std::uintptr_t>(vertices.data());
+    descriptor = {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>(address >> 32u) | (stride << 16u), static_cast<std::uint32_t>(centres.size()), 0x01000facu | (77u << 12u)};
+    request.context.vertex->resources[0].fields = descriptor;
+    const auto vertex = ShaderRecompiler::Recompile(request);
+    const auto pushBytes = static_cast<std::uint32_t>(vertex.pushConstants.size());
+    ShaderRecompiler::ShaderPixelStageInfo pixelInfo{};
+    pixelInfo.wave32 = true;
+    pixelInfo.targetOutputMode[0] = 9u;
+    pixelInfo.targetExportMapping.fill(0xe4u);
+    pixelInfo.rasterPrimitive = ShaderRecompiler::RasterPrimitive::Point;
+    ShaderRecompiler::RecompileRequest pixelRequest{{ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}}, {32u, 0u, {}, std::nullopt, pixelInfo, std::nullopt, {}}, device.Target(), PixelPushLayout(pushBytes, device.Target())};
+    const auto pixel = ShaderRecompiler::Recompile(pixelRequest);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> shaders{{{ShaderStage::Vertex, &vertex, 0u}, {ShaderStage::Fragment, &pixel, PixelPushOffset(pushBytes, device.Target())}}};
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, 32u, 32u, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(pixels.data()), {Extent, Extent}, VK_FORMAT_R8G8B8A8_UNORM, pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.renderExtent = {Extent, Extent};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_POINT_LIST;
+    state.paClVsOutCntl = vertexInfo.paClVsOutCntl;
+    state.vertexPoints = true;
+    state.pointSize = points.size;
+    state.pointSizeMin = points.minimum;
+    state.pointSizeMax = points.maximum;
+    state.viewport = {0.0f, static_cast<float>(Extent), static_cast<float>(Extent), -static_cast<float>(Extent), 0.0f, 1.0f};
+    state.scissor = {{0, 0}, {Extent, Extent}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15u;
+    state.blends = {state.blend};
+    AgcDriver::Pm4::DrawParameters draw{0u, static_cast<std::uint32_t>(centres.size()), 0u, 1u, 0u, false};
+    draw.firstInstance = 0u;
+    pixels.fill(std::byte{0});
+    device.Draw(state, draw, shaders);
+    device.WaitIdle();
+    std::vector<Square> squares(centres.size());
+    for (std::uint32_t y = 0; y < Extent; ++y) {
+        for (std::uint32_t x = 0; x < Extent; ++x) {
+            const auto index = (y * Extent + x) * 4u;
+            if (pixels[index] == std::byte{0} && pixels[index + 3u] == std::byte{0}) continue;
+            auto& square = squares[(y >= Extent / 2u ? 2u : 0u) + (x >= Extent / 2u ? 1u : 0u)];
+            ++square.pixels;
+            square.left = std::min(square.left, x);
+            square.top = std::min(square.top, y);
+            square.right = std::max(square.right, x + 1u);
+            square.bottom = std::max(square.bottom, y + 1u);
+        }
+    }
+    std::cout << "case " << name << ":";
+    for (const auto& square : squares) std::cout << " " << square.pixels << " [" << square.left << "," << square.top << ")-(" << square.right << "," << square.bottom << ")";
+    std::cout << "\n";
+    return squares;
+}
+
+void RequireSquares(const std::vector<Square>& squares, std::uint32_t side, const char* name) {
+    for (const auto& square : squares) {
+        Require(square.pixels == side * side && square.right - square.left == side && square.bottom - square.top == side, std::string(name) + ": a point is not a " + std::to_string(side) + "x" + std::to_string(side) + " square");
+    }
+}
+
+void RequireAtMostOnePixel(const std::vector<Square>& squares, const char* name) {
+    for (const auto& square : squares) Require(square.pixels <= 1u, std::string(name) + ": a point with no positive size covers more than one pixel");
+}
+
+void Run(AgcDriver::VulkanDevice& device) {
+    std::cout << "device: " << device.DeviceName() << "\n";
+    RequireSquares(RunCase(device, "register size 1", positionCode, {1.0f, 1.0f, 1.0f, false}, 0.5f), 1u, "register size 1");
+    RequireSquares(RunCase(device, "register size 4", positionCode, {4.0f, 1.0f, 1.0f, false}, 0.0f), 4u, "register size 4");
+    RequireSquares(RunCase(device, "register size 3 ignores the clamp", positionCode, {3.0f, 6.0f, 8.0f, false}, 0.5f), 3u, "register size 3 ignores the clamp");
+    const auto two = SizeExportCode(2.0f);
+    RequireSquares(RunCase(device, "vertex size 2 within [1, 8]", two, {1.0f, 1.0f, 8.0f, true}, 0.0f), 2u, "vertex size 2 within [1, 8]");
+    const auto six = SizeExportCode(6.0f);
+    RequireSquares(RunCase(device, "vertex size 6 clamped to 4", six, {1.0f, 0.5f, 4.0f, true}, 0.0f), 4u, "vertex size 6 clamped to 4");
+    const auto one = SizeExportCode(1.0f);
+    RequireSquares(RunCase(device, "vertex size 1 clamped to 5", one, {1.0f, 5.0f, 8.0f, true}, 0.5f), 5u, "vertex size 1 clamped to 5");
+    RequireSquares(RunCase(device, "vertex size over a register size", six, {1.0f, 1.0f, 8.0f, true}, 0.0f), 6u, "vertex size over a register size");
+    const auto zero = SizeExportCode(0.0f);
+    RequireAtMostOnePixel(RunCase(device, "vertex size 0 within [0, 4]", zero, {0.0f, 0.0f, 4.0f, true}, 0.5f), "vertex size 0 within [0, 4]");
+    const auto negative = SizeExportCode(-3.0f);
+    RequireAtMostOnePixel(RunCase(device, "vertex size -3 within [0, 4]", negative, {1.0f, 0.0f, 4.0f, true}, 0.5f), "vertex size -3 within [0, 4]");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        Run(*device);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/VertexTableReadOrder.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/VertexTableReadOrder.cpp
new file mode 100644
index 0000000000..62786e6108
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/VertexTableReadOrder.cpp
@@ -0,0 +1,205 @@
+#include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawCache.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgc/Shader/include/ShaderConstants.hpp"
+#include "SceShaders.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <functional>
+#include <iostream>
+#include <memory>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::DriverDetail::DrawPipeline;
+
+void check(bool condition, const std::string& what) {
+    if (!condition) throw std::runtime_error("vertex table read order: " + what);
+}
+
+constexpr std::size_t UserDataOffset = 288;
+constexpr std::size_t DirectOffset = 352;
+constexpr std::size_t SemanticOffset = 384;
+
+alignas(64) std::array<std::uint32_t, 8> BufferTable{0x1000u, 0x20000u, 64u, 0x3000u, 0x7000u, 0x20000u, 32u, 0x3000u};
+alignas(64) std::array<std::uint32_t, 1> AttribTable{(0x2cu << 5u) | 1u};
+alignas(64) std::array<std::uint32_t, 4> Elsewhere{};
+std::vector<std::byte> Header(SemanticOffset + sizeof(ShaderSemantic));
+
+void BuildHeader() {
+    std::array<std::uint16_t, ShaderRegs::AGC_DIRECT_RESOURCE_TYPE_COUNT> direct{};
+    direct.fill(ShaderRegs::AGC_ILLEGAL_DIRECT_OFFSET);
+    direct[static_cast<std::size_t>(ShaderRegs::AgcDirectResourceType::PtrVertexBufferTable)] = 0;
+    direct[static_cast<std::size_t>(ShaderRegs::AgcDirectResourceType::PtrVertexAttribDescTable)] = 2;
+    std::memcpy(Header.data() + DirectOffset, direct.data(), sizeof(direct));
+    ShaderSemantic semantic{};
+    semantic.size_in_elements = 1;
+    std::memcpy(Header.data() + SemanticOffset, &semantic, sizeof(semantic));
+    ShaderUserData userData{};
+    userData.direct_resource_offset = reinterpret_cast<std::uint16_t*>(Header.data() + DirectOffset);
+    userData.direct_resource_count = ShaderRegs::AGC_DIRECT_RESOURCE_TYPE_COUNT;
+    std::memcpy(Header.data() + UserDataOffset, &userData, sizeof(userData));
+    Shader shader{};
+    shader.user_data = reinterpret_cast<ShaderUserData*>(Header.data() + UserDataOffset);
+    shader.input_semantics = reinterpret_cast<ShaderSemantic*>(Header.data() + SemanticOffset);
+    shader.num_input_semantics = 1;
+    std::memcpy(Header.data(), &shader, sizeof(shader));
+}
+
+std::uint64_t Address(const void* data) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+}
+
+std::array<std::uint32_t, 4> UserWords() {
+    const auto buffer = Address(BufferTable.data());
+    const auto attrib = Address(AttribTable.data());
+    return {static_cast<std::uint32_t>(buffer), static_cast<std::uint32_t>(buffer >> 32u), static_cast<std::uint32_t>(attrib), static_cast<std::uint32_t>(attrib >> 32u)};
+}
+
+ShaderRecompiler::ShaderVertexStageInfo Decode(std::vector<AgcDriver::Graphics::DecodeRead>& reads) {
+    const auto userWords = UserWords();
+    return AgcDriver::DriverDetail::DecodeOrderedVertexStageInfo(Header, Address(Header.data()), userWords, reads, 0);
+}
+
+struct Gate {
+    std::atomic<bool> release{false};
+};
+
+std::vector<std::shared_ptr<Gate>> Gates;
+
+std::shared_ptr<Gate> Hold(const void* range, std::size_t bytes, std::function<void()> store) {
+    auto gate = Gates.emplace_back(std::make_shared<Gate>());
+    DrawPipeline::Queue0().Enqueue([gate, store = std::move(store)] {
+        while (!gate->release.load(std::memory_order_acquire)) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        store();
+    }, {{Address(range), Address(range) + bytes}});
+    return gate;
+}
+
+void StopQueue() {
+    AgcDriver::GuestMemory::SetReadGuard(nullptr);
+    for (const auto& gate : Gates) gate->release.store(true, std::memory_order_release);
+    DrawPipeline::Active() = false;
+    DrawPipeline::Queue0().Stop();
+}
+
+void WaitEmpty() {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (DrawPipeline::QueuedItems() != 0) {
+        check(std::chrono::steady_clock::now() < deadline, "the pipeline never emptied");
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+}
+
+std::shared_ptr<Gate> completeAtBufferRead;
+const void* completeAtRead = BufferTable.data();
+
+void CompleteQueuedStoreAtBufferRead(std::uint64_t address, std::size_t) {
+    if (address != Address(completeAtRead) || completeAtBufferRead == nullptr) return;
+    std::exchange(completeAtBufferRead, nullptr)->release.store(true, std::memory_order_release);
+    WaitEmpty();
+}
+
+ShaderRecompiler::ShaderVertexStageInfo DecodeBehindQueuedStore(const void* range, std::size_t bytes, std::function<void()> store, std::vector<AgcDriver::Graphics::DecodeRead>& reads) {
+    WaitEmpty();
+    auto gate = Hold(range, bytes, std::move(store));
+    std::thread releaser([gate] {
+        std::this_thread::sleep_for(std::chrono::milliseconds(50));
+        gate->release.store(true, std::memory_order_release);
+    });
+    ShaderRecompiler::ShaderVertexStageInfo info;
+    try {
+        info = Decode(reads);
+    } catch (...) {
+        releaser.join();
+        throw;
+    }
+    releaser.join();
+    return info;
+}
+
+}
+
+int main() {
+    try {
+        BuildHeader();
+        DrawPipeline::Active() = true;
+        std::vector<AgcDriver::Graphics::DecodeRead> reads;
+
+        auto info = Decode(reads);
+        check(info.fetchEmbedded && info.resourcesNum == 1 && info.resources[0].fields[0] == 0x7000u && info.resources[0].fields[2] == 32u, "the tables did not decode to the second vertex buffer");
+
+        info = DecodeBehindQueuedStore(BufferTable.data() + 4, 16, [] {
+            BufferTable[4] = 0x9000u;
+            BufferTable[6] = 128u;
+        }, reads);
+        check(info.resources[0].fields[0] == 0x9000u && info.resources[0].fields[2] == 128u, "the vertex buffer V# was read before the queued store into the vertex buffer table");
+        check(reads.size() == 2 && reads[1].address == Address(BufferTable.data() + 4) && std::memcmp(reads[1].Bytes().data(), BufferTable.data() + 4, 16) == 0, "the recorded V# read is not the stored V#");
+        check(DrawPipeline::QueuedItems() == 0, "the store into the vertex buffer table is still queued");
+
+        info = DecodeBehindQueuedStore(AttribTable.data(), 4, [] { AttribTable[0] = 0x2cu << 5u; }, reads);
+        check(info.resources[0].fields[0] == 0x1000u && info.resources[0].fields[2] == 64u, "the attribute word was read before the queued store into the vertex attribute table");
+        check(reads.size() == 2 && reads[0].address == Address(AttribTable.data()) && reads[1].address == Address(BufferTable.data()), "the decode did not read the stored attribute word and the V# it names");
+
+        WaitEmpty();
+        auto gate = Hold(Elsewhere.data(), sizeof(Elsewhere), [] {});
+        info = Decode(reads);
+        check(info.resources[0].fields[0] == 0x1000u, "the decode next to an unrelated queued store changed");
+        check(DrawPipeline::QueuedItems() == 1, "a decode that overlaps nothing queued drained the pipeline");
+        gate->release.store(true, std::memory_order_release);
+        WaitEmpty();
+
+        completeAtBufferRead = Hold(AttribTable.data(), 4, [] { AttribTable[0] = (0x2cu << 5u) | 1u; });
+        AgcDriver::GuestMemory::SetReadGuard(&CompleteQueuedStoreAtBufferRead);
+        auto drains = DrawPipeline::Queue0().DecodeDrains();
+        info = Decode(reads);
+        AgcDriver::GuestMemory::SetReadGuard(nullptr);
+        check(completeAtBufferRead == nullptr, "the queued attribute store did not complete during the decode");
+        check(info.resources[0].fields[0] == 0x9000u && info.resources[0].fields[2] == 128u, "the decode kept the vertex buffer of an attribute word that a queued store replaced during the decode");
+        check(reads.size() == 2 && reads[1].address == Address(BufferTable.data() + 4), "the recorded reads are not the stored attribute word and the V# it names");
+        check(DrawPipeline::Queue0().DecodeDrains() == drains + 1, "the drain the decode caused was not counted");
+
+        WaitEmpty();
+        auto finished = Hold(BufferTable.data() + 4, 16, [] {
+            BufferTable[4] = 0xb000u;
+            BufferTable[6] = 256u;
+        });
+        finished->release.store(true, std::memory_order_release);
+        WaitEmpty();
+        gate = Hold(Elsewhere.data(), sizeof(Elsewhere), [] {});
+        drains = DrawPipeline::Queue0().DecodeDrains();
+        info = Decode(reads);
+        check(info.resources[0].fields[0] == 0xb000u && info.resources[0].fields[2] == 256u, "the decode did not read the V# a finished item stored");
+        check(DrawPipeline::QueuedItems() == 1 && DrawPipeline::Queue0().DecodeDrains() == drains, "a decode of a table that a finished item wrote drained the pipeline");
+        gate->release.store(true, std::memory_order_release);
+        WaitEmpty();
+
+        completeAtBufferRead = Hold(Elsewhere.data(), sizeof(Elsewhere), [] { Elsewhere[0] = 1u; });
+        completeAtRead = BufferTable.data() + 4;
+        AgcDriver::GuestMemory::SetReadGuard(&CompleteQueuedStoreAtBufferRead);
+        drains = DrawPipeline::Queue0().DecodeDrains();
+        info = Decode(reads);
+        AgcDriver::GuestMemory::SetReadGuard(nullptr);
+        check(completeAtBufferRead == nullptr, "the unrelated queued store did not complete during the decode");
+        check(info.resources[0].fields[0] == 0xb000u && DrawPipeline::Queue0().DecodeDrains() == drains, "a store elsewhere that retired during the decode made the decode drain");
+
+        StopQueue();
+        std::puts("vertex table read order tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try { StopQueue(); } catch (...) {}
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp
index f597fc79ee..a18422c711 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/WindowLaneSpill.cpp
@@ -7,7 +7,13 @@
 #include <iostream>
 #include <span>
 #include <string>
+#include <string_view>
 #include <vector>
+#ifdef _WIN32
+#include <io.h>
+#else
+#include <unistd.h>
+#endif
 
 namespace {
 
@@ -15,7 +21,8 @@ using AgcDriver::Graphics::Require;
 using ShaderRecompiler::ShaderStage;
 
 constexpr std::uint32_t Threads = 32;
-alignas(256) std::array<std::uint32_t, Threads> Output{};
+constexpr std::uint32_t WideThreads = 64;
+alignas(256) std::array<std::uint32_t, WideThreads> Output{};
 
 alignas(256) constexpr std::array<std::uint32_t, 26> Code{
     0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x00010004, 0xd7610003, 0x00010205, 0xd7610003, 0x00010406,
@@ -29,28 +36,111 @@ alignas(256) constexpr std::array<std::uint32_t, 27> IndexedStoreCode{
     0xd7600009, 0x00010303, 0xd760000a, 0x00010503, 0xd760000b, 0x00010703, 0xe0702000, 0x80020001, 0xbf810000,
 };
 
+alignas(256) constexpr std::array<std::uint32_t, 28> ReusedRegisterCode{
+    0x7e060300, 0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x00010004, 0xd7610003, 0x00010205, 0xd7610003,
+    0x00010406, 0xd7610003, 0x00010607, 0x7e048500, 0xbe840380, 0xbe850380, 0xbe860380, 0xbe870380, 0xd7600008,
+    0x00010103, 0xd7600009, 0x00010303, 0xd760000a, 0x00010503, 0xd760000b, 0x00010703, 0xe0702000, 0x80020001,
+    0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 14> OverwrittenSpillCode{
+    0x877c8104, 0x7e040280, 0x7e060280, 0xd7610004, 0x00010008, 0x7e048500, 0x7e0802f2, 0xd7600008, 0x00010104,
+    0xf09c0f08, 0x00400802, 0xe0700000, 0x80030800, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 13> AliasingStoreCode{
+    0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x0001000d, 0x7e040287, 0x7e048500,
+    0xd7600008, 0x00010103, 0x7e040208, 0xe0702000, 0x80010201, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 13> WideAliasingStoreCode{
+    0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x0001500d, 0x7e040287, 0x7e048500,
+    0xd7600008, 0x00015103, 0x7e040208, 0xe0702000, 0x80010201, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 12> StoreAfterReadCode{
+    0x7e020300, 0xbefc030c, 0x7e048500, 0xd7610003, 0x0001000d, 0xd7600008,
+    0x00010103, 0x7e048500, 0x7e040208, 0xe0702000, 0x80010201, 0xbf810000,
+};
+
+constexpr std::uint32_t Spilled = 0x1234u;
+
+class StderrCapture {
+public:
+    StderrCapture() {
+        std::fflush(stderr);
+        file = std::tmpfile();
+        Require(file != nullptr, "cannot open a temporary file for stderr");
+#ifdef _WIN32
+        saved = _dup(_fileno(stderr));
+        _dup2(_fileno(file), _fileno(stderr));
+#else
+        saved = dup(fileno(stderr));
+        dup2(fileno(file), fileno(stderr));
+#endif
+    }
+    std::string Finish() {
+        std::fflush(stderr);
+#ifdef _WIN32
+        _dup2(saved, _fileno(stderr));
+        _close(saved);
+#else
+        dup2(saved, fileno(stderr));
+        close(saved);
+#endif
+        std::rewind(file);
+        std::string text;
+        char buffer[4096];
+        for (std::size_t read = 0; (read = std::fread(buffer, 1, sizeof(buffer), file)) != 0;) text.append(buffer, read);
+        std::fclose(file);
+        std::fwrite(text.data(), 1, text.size(), stderr);
+        return text;
+    }
+
+private:
+    std::FILE* file = nullptr;
+    int saved = -1;
+};
+
 std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t count) {
     const auto address = reinterpret_cast<std::uintptr_t>(data);
     return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (4u << 16u), count, 0x11016facu};
 }
 
-void Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code) {
-    Output.fill(0xdeadbeefu);
-    std::vector<std::uint32_t> userData(16, 0u);
-    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size()));
-    std::copy(output.begin(), output.end(), userData.begin() + 4);
+ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::span<const std::uint32_t> userData, std::uint32_t waveSize = Threads) {
     const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
-    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0, {false, false, false}, false, 1};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{waveSize, 1, 1}, 0, {false, false, false}, false, 1};
     ShaderRecompiler::RecompileRequest request{
         {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
-        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        {waveSize, 0, userData, compute, std::nullopt, std::nullopt, memory},
         device.Target(),
         {0, 0, 0, 128}
     };
     request.useCache = false;
-    const auto result = ShaderRecompiler::Recompile(request);
+    return ShaderRecompiler::Recompile(request);
+}
+
+std::string Run(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, std::uint32_t relativeIndex = 0, std::uint32_t waveSize = Threads) {
+    Output.fill(0xdeadbeefu);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto output = BufferDescriptor(Output.data(), static_cast<std::uint32_t>(Output.size()));
+    std::copy(output.begin(), output.end(), userData.begin() + 4);
+    userData[12] = relativeIndex;
+    userData[13] = Spilled;
+    const auto result = Compile(device, code, userData, waveSize);
+    StderrCapture log;
     device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
     device.WaitIdle();
+    return log.Finish();
+}
+
+constexpr std::string_view Overwritten = "which holds a scalar spilled with v_writelane_b32 that a later v_readlane_b32 was replaced with";
+
+void CheckSpilled(const std::string& log, const std::string& name, std::uint32_t lanes = Threads) {
+    Require(log.find(Overwritten) == std::string::npos, name + ": reported an overwritten spill: " + log);
+    for (std::uint32_t tid = 0; tid < lanes; ++tid) {
+        Require(Output[tid] == Spilled, name + ": lane " + std::to_string(tid) + " stored " + std::to_string(Output[tid]) + ", expected the spilled " + std::to_string(Spilled));
+    }
 }
 
 void Check(const std::string& name) {
@@ -59,6 +149,17 @@ void Check(const std::string& name) {
     }
 }
 
+void CheckRefused(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::string& name) {
+    const std::vector<std::uint32_t> userData(16, 0u);
+    std::string error;
+    try {
+        static_cast<void>(Compile(device, code, userData));
+    } catch (const std::exception& thrown) {
+        error = thrown.what();
+    }
+    Require(error.find("GetSamplerResource dword 0 is not a valid runtime value") != std::string::npos, name + ": " + (error.empty() ? std::string("recompiled") : error));
+}
+
 }
 
 int main() {
@@ -73,6 +174,20 @@ int main() {
         Check("window lane spill");
         Run(*device, IndexedStoreCode);
         Check("window lane spill past an indexed store");
+        CheckRefused(*device, OverwrittenSpillCode, "window lane spill overwritten by an ordinary write before its v_readlane");
+        Run(*device, ReusedRegisterCode);
+        Check("window lane spill into a register with ordinary writes past an indexed store");
+        CheckSpilled(Run(*device, AliasingStoreCode, 0), "window lane spill past an indexed store with m0 = 0");
+        const auto aliased = Run(*device, AliasingStoreCode, 1);
+        Require(aliased.find(Overwritten) != std::string::npos, "window lane spill overwritten by an indexed store with m0 = 1 was not reported: " + aliased);
+        CheckSpilled(Run(*device, StoreAfterReadCode, 1), "window lane spill overwritten by an indexed store with m0 = 1 after its v_readlane");
+        if (device->Target().subgroupSize >= WideThreads) {
+            CheckSpilled(Run(*device, WideAliasingStoreCode, 0, WideThreads), "wave64 window lane spill in lane 40 past an indexed store with m0 = 0", WideThreads);
+            const auto wide = Run(*device, WideAliasingStoreCode, 1, WideThreads);
+            Require(wide.find("stored 40 in lane 40 of vector window slot 1") != std::string::npos, "wave64 window lane spill in lane 40 overwritten by an indexed store with m0 = 1 was not reported: " + wide);
+        } else {
+            std::printf("wave64 cases skipped, subgroup size %u\n", device->Target().subgroupSize);
+        }
         std::puts("window lane spill tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp
index e5804bf70a..0642450135 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ZeroStrideVertexFetch.cpp
@@ -124,6 +124,28 @@ void Draw(AgcDriver::VulkanDevice& device, const Case& value) {
     device.WaitIdle();
 }
 
+void DescriptorDiagnostics(AgcDriver::VulkanDevice& device) {
+    for (std::uint32_t component = 0; component < 4u; ++component) {
+        for (const auto selector : {2u, 3u}) {
+            const auto shift = component * 3u;
+            const Case value{3u, 16u, true, "reserved selector", (0xfacu & ~(7u << shift)) | (selector << shift)};
+            const auto fields = VertexBufferDescriptor(value);
+            char expected[192];
+            std::snprintf(expected, sizeof(expected), "reserved prepared vertex component selector %u at location 0 component %u (V#=[%08x %08x %08x %08x])",
+                selector, component, fields[0], fields[1], fields[2], fields[3]);
+            bool rejected = false;
+            try {
+                Draw(device, value);
+            } catch (const std::runtime_error& error) {
+                const std::string message(error.what());
+                Require(message.find(expected) != std::string::npos, "reserved selector error did not identify the component and descriptor: " + message);
+                rejected = true;
+            }
+            Require(rejected, "a reserved vertex component selector was accepted");
+        }
+    }
+}
+
 void Check(const Case& value) {
     for (std::uint32_t vertex = 0; vertex < Vertices; ++vertex) {
         for (std::uint32_t component = 0; component < 4u; ++component) {
@@ -169,6 +191,7 @@ int main() {
             Draw(*device, value);
             Check(value);
         }
+        DescriptorDiagnostics(*device);
         std::puts("zero-stride vertex fetch tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp
new file mode 100644
index 0000000000..943f962b6e
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp
@@ -0,0 +1,743 @@
+#include "prx/libSceAgcDriver/State/include/Configuration.hpp"
+#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameCapture.hpp"
+#include "prx/libSceAgcDriver/Execution/include/FrameDumpIo.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VideoOutput.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Dcb.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cerrno>
+#include <chrono>
+#include <condition_variable>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <filesystem>
+#include <fstream>
+#include <future>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <utility>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+using AgcDriver::FrameCall;
+using AgcDriver::FrameCallKind;
+using AgcDriver::FrameCaptureReader;
+using AgcDriver::FrameMemoryChunk;
+using AgcDriver::FrameMemoryKind;
+using AgcDriver::FrameRangeAccess;
+using AgcDriver::FrameRangeKind;
+using Clock = std::chrono::steady_clock;
+
+struct Dump {
+    std::uint64_t address = 0;
+    std::uint64_t bytes = 0;
+    std::filesystem::path path;
+};
+
+struct Options {
+    std::filesystem::path directory;
+    std::vector<Dump> dumps;
+    std::filesystem::path frames;
+    bool pace = true;
+    bool strict = false;
+    std::chrono::milliseconds paceTimeout{10000};
+    std::chrono::milliseconds memoryPaceTimeout{10000};
+    std::chrono::milliseconds releaseAfter{3};
+    std::chrono::milliseconds drainTimeout{10000};
+    bool release = true;
+    bool synthesize = true;
+};
+
+class Frames {
+public:
+    void MarkReady() {
+        std::lock_guard lock(mutex);
+        ready.push_back(Clock::now());
+    }
+
+    void Failed(std::exception_ptr error) {
+        std::lock_guard lock(mutex);
+        if (!failure) failure = error;
+    }
+
+    std::vector<Clock::time_point> Times() const {
+        std::lock_guard lock(mutex);
+        return ready;
+    }
+
+    std::exception_ptr Failure() const {
+        std::lock_guard lock(mutex);
+        return failure;
+    }
+
+private:
+    mutable std::mutex mutex;
+    std::vector<Clock::time_point> ready;
+    std::exception_ptr failure;
+};
+
+class ReplayFlip final : public AgcDriver::IFlipRequest {
+public:
+    explicit ReplayFlip(Frames& frames) : frames(frames) {}
+    void GpuReady(const std::shared_ptr<AgcDriver::FrameTiming>&) override { frames.MarkReady(); }
+    void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); }
+
+private:
+    Frames& frames;
+};
+
+class ReplayRenderingWait final : public AgcDriver::IRenderingWait {
+public:
+    void Wait() override {}
+};
+
+class ReplayOutput final : public AgcDriver::IVideoOutput {
+public:
+    explicit ReplayOutput(Frames& frames) : frames(frames) {}
+    std::shared_ptr<AgcDriver::IFlipRequest> Reserve(const AgcDriver::FlipInfo&) override { return std::make_shared<ReplayFlip>(frames); }
+    std::shared_ptr<AgcDriver::IRenderingWait> CaptureRenderingWait(std::uint32_t) override { return std::make_shared<ReplayRenderingWait>(); }
+    void Fail(std::exception_ptr error) noexcept override { frames.Failed(error); }
+
+private:
+    Frames& frames;
+};
+
+std::uint64_t headerNumber(const std::string& header, std::string_view key) {
+    const auto quoted = "\"" + std::string(key) + "\":";
+    const auto at = header.find(quoted);
+    if (at == std::string::npos) throw std::runtime_error("frame replay: the capture header has no " + std::string(key));
+    return std::strtoull(header.c_str() + at + quoted.size(), nullptr, 10);
+}
+
+void restore(const FrameCaptureReader& reader, const FrameMemoryChunk& chunk) {
+    reader.Read(chunk, std::span(reinterpret_cast<std::byte*>(static_cast<std::uintptr_t>(chunk.address)), static_cast<std::size_t>(chunk.bytes)));
+}
+
+bool committedWritable(std::uint64_t address, std::uint64_t bytes) {
+#ifdef _WIN32
+    for (auto at = address; at < address + bytes;) {
+        MEMORY_BASIC_INFORMATION info{};
+        if (VirtualQuery(reinterpret_cast<const void*>(static_cast<std::uintptr_t>(at)), &info, sizeof(info)) == 0 || info.State != MEM_COMMIT) return false;
+        const auto access = info.Protect & 0xffu;
+        if ((info.Protect & PAGE_GUARD) != 0 || (access != PAGE_READWRITE && access != PAGE_EXECUTE_READWRITE)) return false;
+        at = reinterpret_cast<std::uintptr_t>(info.BaseAddress) + info.RegionSize;
+    }
+    return true;
+#else
+    static_cast<void>(address);
+    static_cast<void>(bytes);
+    return false;
+#endif
+}
+
+std::pair<std::uint64_t, std::uint64_t> progress();
+
+struct Skipped {
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> ranges;
+    std::uint64_t bytes = 0;
+
+    void Add(const FrameMemoryChunk& chunk) {
+        ranges.emplace_back(chunk.address, chunk.address + chunk.bytes);
+        bytes += chunk.bytes;
+    }
+
+    bool Overlaps(const FrameMemoryChunk& chunk) const {
+        return std::any_of(ranges.begin(), ranges.end(), [&](const auto& range) { return chunk.address < range.second && range.first < chunk.address + chunk.bytes; });
+    }
+};
+
+void mapHostRanges(const FrameCaptureReader& reader, Skipped& skipped) {
+    std::vector<const FrameMemoryChunk*> host;
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Range && chunk.rangeKind == FrameRangeKind::Host) host.push_back(&chunk);
+    }
+#ifdef _WIN32
+    constexpr std::uint64_t Granularity = 64u * 1024u;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> envelopes;
+    for (const auto* chunk : host) {
+        const auto begin = chunk->address & ~(Granularity - 1);
+        const auto end = (chunk->address + chunk->bytes + Granularity - 1) & ~(Granularity - 1);
+        if (!envelopes.empty() && begin <= envelopes.back().second) envelopes.back().second = std::max(envelopes.back().second, end);
+        else envelopes.emplace_back(begin, end);
+    }
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> refused;
+    for (const auto& [begin, end] : envelopes) {
+        if (VirtualAlloc(reinterpret_cast<void*>(static_cast<std::uintptr_t>(begin)), static_cast<SIZE_T>(end - begin), MEM_RESERVE, PAGE_NOACCESS) == nullptr) refused.emplace_back(begin, end);
+    }
+    for (const auto* chunk : host) {
+        const bool blocked = std::any_of(refused.begin(), refused.end(), [&](const auto& range) { return chunk->address < range.second && range.first < chunk->address + chunk->bytes; });
+        if (!blocked && VirtualAlloc(reinterpret_cast<void*>(static_cast<std::uintptr_t>(chunk->address)), static_cast<SIZE_T>(chunk->bytes), MEM_COMMIT, PAGE_READWRITE) != nullptr) continue;
+        if ((chunk->access & FrameRangeAccess::Gpu) != 0) throw std::runtime_error("frame replay: cannot map the GPU-visible host range at " + std::to_string(chunk->address));
+        skipped.Add(*chunk);
+    }
+#else
+    for (const auto* chunk : host) skipped.Add(*chunk);
+#endif
+}
+
+Skipped restoreMemory(const FrameCaptureReader& reader) {
+    std::uintptr_t base = 0;
+    std::size_t size = 0;
+    GuestArena::GuestArenaRange_nid_postfix(&base, &size);
+    if (!reader.Header().empty() && headerNumber(reader.Header(), "arena_base") != base) throw std::runtime_error("frame replay: the guest arena is at a different address than in the capture");
+    progress();
+    Skipped skipped;
+    mapHostRanges(reader, skipped);
+    {
+        GuestAllocations::Mutation mutation;
+        for (const auto& chunk : reader.Chunks()) {
+            if (chunk.kind != FrameMemoryKind::Range || chunk.rangeKind == FrameRangeKind::Host) continue;
+            const bool gpu = (chunk.access & FrameRangeAccess::Gpu) != 0;
+            if (committedWritable(chunk.address, chunk.bytes)) {
+                if (!gpu) skipped.Add(chunk);
+                else std::memset(reinterpret_cast<void*>(static_cast<std::uintptr_t>(chunk.address)), 0, static_cast<std::size_t>(chunk.bytes));
+                continue;
+            }
+            auto* const pointer = reinterpret_cast<void*>(static_cast<std::uintptr_t>(chunk.address));
+            const auto bytes = static_cast<std::size_t>(chunk.bytes);
+            try {
+                GuestArena::GuestArenaMarkUsed_nid_postfix(pointer, bytes);
+            } catch (const std::exception&) {
+                if (gpu) throw;
+                skipped.Add(chunk);
+                continue;
+            }
+            GuestArena::GuestArenaCommit_nid_postfix(pointer, bytes, 0x04, bytes);
+            mutation.Add(pointer, bytes, (chunk.access & FrameRangeAccess::Readable) != 0, (chunk.access & FrameRangeAccess::Writable) != 0, gpu);
+        }
+    }
+    std::vector<const FrameMemoryChunk*> snapshot;
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Snapshot && !skipped.Overlaps(chunk)) snapshot.push_back(&chunk);
+    }
+    const auto workers = std::max<std::size_t>(1, std::thread::hardware_concurrency());
+    for (std::size_t first = 0; first < snapshot.size(); first += workers) {
+        std::vector<std::future<void>> pending;
+        for (auto index = first; index < std::min(snapshot.size(), first + workers); ++index) {
+            pending.push_back(std::async(std::launch::async, [&reader, chunk = snapshot[index]] { restore(reader, *chunk); }));
+        }
+        for (auto& future : pending) future.get();
+    }
+    return skipped;
+}
+
+std::pair<std::uint64_t, std::uint64_t> progress() {
+    std::uint64_t accepted = 0;
+    std::uint64_t completed = 0;
+    AgcDriverSerialProgress_nid_postfix(&accepted, &completed);
+    return {accepted, completed};
+}
+
+struct Replay {
+    const Options& options;
+    const FrameCaptureReader& reader;
+    Frames frames;
+    std::map<std::uint32_t, std::shared_ptr<ReplayOutput>> outputs;
+    std::mutex memoryMutex;
+    std::map<std::uint64_t, std::vector<const FrameMemoryChunk*>> groups;
+    Skipped skipped;
+    std::atomic<std::uint64_t> paceTimeouts{0};
+    std::atomic<std::uint64_t> staleRegistrations{0};
+    std::atomic<std::uint64_t> failedRegistrations{0};
+    std::atomic<std::uint64_t> submits{0};
+    std::atomic<std::uint64_t> deltaBytes{0};
+    std::atomic<std::int64_t> paceWaitedNs{0};
+    std::atomic<bool> stalled{false};
+    std::atomic<std::uint64_t> stalledAt{0};
+    std::atomic<std::uint64_t> earlyReleases{0};
+    std::atomic<std::uint64_t> lateReleases{0};
+    std::atomic<std::uint64_t> syntheticReleases{0};
+    std::atomic<std::size_t> sequenced{0};
+    std::uint64_t unfinished = 0;
+    std::size_t threads = 0;
+    bool recording = false;
+    Clock::time_point startedAt{};
+    Clock::time_point endedAt{};
+
+    double paceWaitedSeconds() const {
+        return static_cast<double>(paceWaitedNs.load()) / 1e9;
+    }
+
+    void report() const {
+        const auto [accepted, completed] = progress();
+        std::fprintf(stderr, "[frame-replay] %llu submits, %zu frames ready, %.1f s since the first frame, pacing waited %.1f s (%llu timeouts), serials %llu/%llu\n",
+                     static_cast<unsigned long long>(submits.load()), frames.Times().size(), std::chrono::duration<double>(Clock::now() - startedAt).count(), paceWaitedSeconds(),
+                     static_cast<unsigned long long>(paceTimeouts.load()), static_cast<unsigned long long>(completed), static_cast<unsigned long long>(accepted));
+    }
+
+    static bool paced(FrameCallKind kind) {
+        return kind == FrameCallKind::Submit || kind == FrameCallKind::Flip || kind == FrameCallKind::ReserveEopFlip || kind == FrameCallKind::Suspend || kind == FrameCallKind::Memory;
+    }
+
+    void pace(const FrameCall& call) {
+        if (!options.pace || !recording || !paced(call.kind) || call.accepted < call.completed) return;
+        if (stalled.load()) {
+            if (progress().second == stalledAt.load()) return;
+            stalled.store(false);
+        }
+        const auto inFlight = call.accepted - call.completed;
+        const bool memory = call.kind == FrameCallKind::Memory;
+        const auto began = Clock::now();
+        const auto deadline = began + (memory ? options.memoryPaceTimeout : options.paceTimeout);
+        const auto waited = [&] { paceWaitedNs += std::chrono::duration_cast<std::chrono::nanoseconds>(Clock::now() - began).count(); };
+        while (true) {
+            const auto [accepted, completed] = progress();
+            if (accepted - completed <= inFlight) return waited();
+            if (Clock::now() >= deadline) {
+                waited();
+                if (memory) return;
+                stalled.store(true);
+                stalledAt.store(completed);
+                std::fprintf(stderr, "[frame-replay] pacing gave up at call %llu (%s): serials %llu/%llu, the capture had %llu in flight\n", static_cast<unsigned long long>(call.ordinal),
+                             std::string(AgcDriver::FrameCallName(call.kind)).c_str(), static_cast<unsigned long long>(completed), static_cast<unsigned long long>(accepted), static_cast<unsigned long long>(inFlight));
+                ++paceTimeouts;
+                if (options.strict) throw std::runtime_error("frame replay: call " + std::to_string(call.ordinal) + " waited longer than the pacing timeout");
+                return;
+            }
+            std::this_thread::sleep_for(std::chrono::microseconds(50));
+        }
+    }
+
+    void execute(const FrameCall& call) {
+        pace(call);
+        switch (call.kind) {
+        case FrameCallKind::RegisterShader:
+            registration([&] { AgcDriverRegisterShader_nid_postfix(shader(call.address)); });
+            return;
+        case FrameCallKind::ResolveShaderAbi:
+            registration([&] { AgcDriverResolveShaderAbi_nid_postfix(shader(call.address), call.context, call.primitive); });
+            return;
+        case FrameCallKind::ResolveGraphicsAbi:
+            registration([&] { AgcDriverResolveGraphicsAbi_nid_postfix(shader(call.values.at(0)), shader(call.values.at(1)), static_cast<std::uint32_t>(call.values.at(2))); });
+            return;
+        case FrameCallKind::ResolveGraphicsStagesAbi: {
+            std::vector<const Shader*> stages;
+            for (const auto value : call.values) stages.push_back(shader(value));
+            registration([&] { AgcDriverResolveGraphicsStagesAbi_nid_postfix(stages, call.context, call.primitive); });
+            return;
+        }
+        case FrameCallKind::RegisterVideoOutput: {
+            const auto handle = static_cast<std::uint32_t>(call.values.at(0));
+            auto output = std::make_shared<ReplayOutput>(frames);
+            AgcDriverRegisterVideoOutput_nid_postfix(handle, output);
+            outputs.emplace(handle, std::move(output));
+            return;
+        }
+        case FrameCallKind::UnregisterVideoOutput: {
+            const auto handle = static_cast<std::uint32_t>(call.values.at(0));
+            AgcDriverUnregisterVideoOutput_nid_postfix(handle, outputs.at(handle));
+            outputs.erase(handle);
+            return;
+        }
+        case FrameCallKind::SetTessellationFactorRing:
+            sceAgcDriverSetTFRing(reinterpret_cast<const volatile void*>(static_cast<std::uintptr_t>(call.address)), static_cast<std::uint32_t>(call.size));
+            return;
+        case FrameCallKind::Submit: {
+            const Packet packet{reinterpret_cast<std::uint32_t*>(static_cast<std::uintptr_t>(call.address)), static_cast<std::uint32_t>(call.size), static_cast<std::uint8_t>(call.flags), {}};
+            if (call.queue == 0) sceAgcDriverSubmitDcb(&packet);
+            else sceAgcDriverSubmitAcb(call.queue, &packet);
+            if (++submits % 25 == 0) report();
+            return;
+        }
+        case FrameCallKind::Flip:
+            AgcDriverSubmitFlip_nid_postfix(flipInfo(call));
+            return;
+        case FrameCallKind::ReserveEopFlip: {
+            const auto token = static_cast<std::uint32_t>(call.values.at(4));
+            if (AgcDriverReserveEopFlipAt_nid_postfix(flipInfo(call), token) != token) throw std::runtime_error("frame replay: EOP flip token " + std::to_string(token) + " was not reserved");
+            return;
+        }
+        case FrameCallKind::Suspend:
+            AgcDriverSuspendPoint_nid_postfix();
+            return;
+        case FrameCallKind::Memory: {
+            std::lock_guard lock(memoryMutex);
+            const auto found = groups.find(call.values.at(0));
+            if (found == groups.end()) return;
+            for (const auto* chunk : found->second) {
+                if (skipped.Overlaps(*chunk)) continue;
+                restore(reader, *chunk);
+                deltaBytes += chunk->bytes;
+            }
+            return;
+        }
+        case FrameCallKind::FrameStart:
+        case FrameCallKind::End:
+        case FrameCallKind::DisplayBuffer:
+            return;
+        }
+        throw std::runtime_error("frame replay: unknown call kind");
+    }
+
+    static std::uint64_t load(std::uint64_t address, std::size_t bytes) {
+        std::uint64_t value = 0;
+        std::memcpy(&value, reinterpret_cast<const void*>(static_cast<std::uintptr_t>(address)), bytes);
+        return value;
+    }
+
+    static bool satisfies(const AgcDriver::AwaitedWait& wait, std::uint64_t value) {
+        const auto masked = value & wait.mask;
+        const auto reference = wait.reference & wait.mask;
+        switch (wait.function) {
+        case 1: return masked < reference;
+        case 2: return masked <= reference;
+        case 3: return masked == reference;
+        case 4: return masked != reference;
+        case 5: return masked >= reference;
+        case 6: return masked > reference;
+        default: return false;
+        }
+    }
+
+    static std::optional<std::uint64_t> satisfying(const AgcDriver::AwaitedWait& wait, std::uint64_t current) {
+        const auto keep = current & ~wait.mask;
+        const auto reference = wait.reference & wait.mask;
+        switch (wait.function) {
+        case 2:
+        case 3:
+        case 5: return keep | reference;
+        case 1: return reference == 0 ? std::nullopt : std::optional<std::uint64_t>(keep);
+        case 4: return keep | (~reference & wait.mask);
+        case 6: return reference == wait.mask ? std::nullopt : std::optional<std::uint64_t>(keep | ((reference + 1) & wait.mask));
+        default: return std::nullopt;
+        }
+    }
+
+    bool writeRecordedValue(const FrameCall& call, const AgcDriver::AwaitedWait& wait) {
+        if (call.kind != FrameCallKind::Memory) return false;
+        const auto found = groups.find(call.values.at(0));
+        if (found == groups.end()) return false;
+        const auto address = wait.address;
+        for (const auto* chunk : found->second) {
+            if (chunk->address > address || address + 4 > chunk->address + chunk->bytes || skipped.Overlaps(*chunk)) continue;
+            const auto bytes = reader.Read(*chunk);
+            const auto length = static_cast<std::size_t>(std::min<std::uint64_t>(wait.bytes == 8 ? 8 : 4, chunk->address + chunk->bytes - address));
+            const auto* const recorded = bytes.data() + (address - chunk->address);
+            auto* const target = reinterpret_cast<std::byte*>(static_cast<std::uintptr_t>(address));
+            if (std::memcmp(target, recorded, length) == 0) return false;
+            std::uint64_t value = 0;
+            std::memcpy(&value, recorded, length);
+            if (wait.function != 0 && !satisfies(wait, value)) return false;
+            std::memcpy(target, recorded, length);
+            return true;
+        }
+        return false;
+    }
+
+    void releaseAwaited(std::span<const FrameCall> calls, std::size_t from) {
+        std::lock_guard lock(memoryMutex);
+        std::array<AgcDriver::AwaitedWait, 64> awaited{};
+        const auto count = AgcDriverAwaitedWaits_nid_postfix(awaited.data(), awaited.size());
+        for (std::size_t slot = 0; slot < count; ++slot) {
+            const auto& wait = awaited[slot];
+            if (wait.address == 0) continue;
+            const std::size_t bytes = wait.bytes == 8 ? 8 : 4;
+            if (wait.function != 0 && satisfies(wait, load(wait.address, bytes))) continue;
+            bool released = false;
+            for (auto index = from; index < calls.size() && !released; ++index) released = writeRecordedValue(calls[index], wait);
+            for (auto index = std::min(from, calls.size()); index > 0 && !released; --index) {
+                released = writeRecordedValue(calls[index - 1], wait);
+                if (released) ++lateReleases;
+            }
+            if (!released && options.synthesize) {
+                if (const auto value = satisfying(wait, load(wait.address, bytes))) {
+                    std::memcpy(reinterpret_cast<void*>(static_cast<std::uintptr_t>(wait.address)), &*value, bytes);
+                    ++syntheticReleases;
+                    released = true;
+                }
+            }
+            if (released) ++earlyReleases;
+        }
+    }
+
+    void runWindow(std::span<const FrameCall> calls) {
+        std::map<std::uint64_t, std::vector<std::size_t>> byThread;
+        for (std::size_t index = 0; index < calls.size(); ++index) byThread[calls[index].thread].push_back(index);
+        threads = byThread.size();
+        std::mutex mutex;
+        std::condition_variable turn;
+        std::size_t started = 0;
+        std::exception_ptr failure;
+        std::atomic<bool> finished{false};
+        std::thread breaker([&] {
+            if (!options.release) return;
+            auto lastCompleted = progress().second;
+            auto lastProgress = Clock::now();
+            while (!finished.load()) {
+                std::this_thread::sleep_for(std::chrono::milliseconds(1));
+                const auto completed = progress().second;
+                if (completed != lastCompleted) {
+                    lastCompleted = completed;
+                    lastProgress = Clock::now();
+                    continue;
+                }
+                if (Clock::now() - lastProgress < options.releaseAfter) continue;
+                releaseAwaited(calls, sequenced.load());
+                lastProgress = Clock::now();
+            }
+        });
+        std::vector<std::thread> workers;
+        for (const auto& entry : byThread) {
+            workers.emplace_back([&, &indices = entry.second] {
+                for (const auto index : indices) {
+                    std::unique_lock lock(mutex);
+                    turn.wait(lock, [&] { return started == index || failure != nullptr; });
+                    if (failure != nullptr) return;
+                    const auto advance = [&] {
+                        ++started;
+                        sequenced.store(started);
+                        lock.unlock();
+                        turn.notify_all();
+                    };
+                    const auto kind = calls[index].kind;
+                    const bool ordered = kind == FrameCallKind::Memory || kind == FrameCallKind::RegisterVideoOutput || kind == FrameCallKind::UnregisterVideoOutput;
+                    if (!ordered) advance();
+                    try {
+                        execute(calls[index]);
+                        if (ordered) advance();
+                    } catch (...) {
+                        if (!lock.owns_lock()) lock.lock();
+                        if (failure == nullptr) failure = std::current_exception();
+                        turn.notify_all();
+                        return;
+                    }
+                }
+            });
+        }
+        for (auto& worker : workers) worker.join();
+        if (failure == nullptr) drain();
+        finished.store(true);
+        breaker.join();
+        if (failure != nullptr) std::rethrow_exception(failure);
+    }
+
+    void drain() {
+        auto lastCompleted = progress().second;
+        auto lastProgress = Clock::now();
+        while (true) {
+            const auto [accepted, completed] = progress();
+            unfinished = accepted - completed;
+            if (unfinished == 0) return;
+            if (completed != lastCompleted) {
+                lastCompleted = completed;
+                lastProgress = Clock::now();
+            } else if (Clock::now() - lastProgress >= options.drainTimeout) {
+                std::fprintf(stderr, "[frame-replay] %llu submissions did not complete after the last captured call (serials %llu/%llu)\n", static_cast<unsigned long long>(unfinished),
+                             static_cast<unsigned long long>(completed), static_cast<unsigned long long>(accepted));
+                return;
+            }
+            std::this_thread::sleep_for(std::chrono::milliseconds(5));
+        }
+    }
+
+    template <typename TFunction>
+    void registration(TFunction&& function) {
+        try {
+            function();
+        } catch (const std::exception& error) {
+            if (recording && options.strict) throw;
+            ++(recording ? failedRegistrations : staleRegistrations);
+            std::fprintf(stderr, "[frame-replay] %s registration failed: %s\n", recording ? "recorded" : "prologue", error.what());
+        }
+    }
+
+    static const Shader* shader(std::uint64_t address) {
+        return reinterpret_cast<const Shader*>(static_cast<std::uintptr_t>(address));
+    }
+
+    static AgcDriver::FlipInfo flipInfo(const FrameCall& call) {
+        return {static_cast<std::uint32_t>(call.values.at(0)), static_cast<std::int32_t>(call.values.at(1)), static_cast<std::uint32_t>(call.values.at(2)), static_cast<std::int64_t>(call.values.at(3))};
+    }
+};
+
+int usage() {
+    std::fprintf(stderr, "usage: agc_frame_replay <capture directory> [--no-pace] [--no-release] [--release-after-ms <n>] [--strict]\n"
+                         "                        [--dump <address>:<bytes>:<file>]...\n"
+                         "  replays the driver calls and guest memory that APS5_FRAME_CAPTURE=<directory> recorded, through this\n"
+                         "  build's AGC driver with no title running, and prints one JSON line with the frame times\n"
+                         "  --no-pace           issues calls without waiting for the in-flight depth the title had\n"
+                         "  --no-release        never copies recorded CPU stores early to release a GPU wait\n"
+                         "  --release-after-ms  milliseconds without a completion before awaited dwords are released (3)\n"
+                         "  --no-synthesize     releases a wait only with a value the capture recorded, never with its reference value\n"
+                         "  --strict            fails on a pacing timeout or a failed registration inside the captured frames\n"
+                         "  --dump              writes guest memory to a file after the replay (hexadecimal or decimal)\n"
+                         "  --frames <dir>      writes each recorded and replayed display buffer as reference-<n>.bmp and replay-<n>.bmp\n");
+    return 2;
+}
+
+Dump parseDump(std::string_view text) {
+    const auto first = text.find(':');
+    const auto second = first == std::string_view::npos ? std::string_view::npos : text.find(':', first + 1);
+    if (second == std::string_view::npos) throw std::invalid_argument("frame replay: --dump takes <address>:<bytes>:<file>");
+    const auto number = [](std::string_view part) {
+        const std::string value(part);
+        char* end = nullptr;
+        const auto parsed = std::strtoull(value.c_str(), &end, 0);
+        if (value.empty() || end != value.c_str() + value.size()) throw std::invalid_argument("frame replay: '" + value + "' is not a number");
+        return static_cast<std::uint64_t>(parsed);
+    };
+    return {number(text.substr(0, first)), number(text.substr(first + 1, second - first - 1)), std::filesystem::path(std::string(text.substr(second + 1)))};
+}
+
+void writeDump(const Dump& dump) {
+    auto* const pointer = reinterpret_cast<const std::byte*>(static_cast<std::uintptr_t>(dump.address));
+    GuestArena::GuestArenaPrepareHostRead_nid_no_patch(pointer, static_cast<std::size_t>(dump.bytes));
+    std::ofstream file(dump.path, std::ios::binary | std::ios::trunc);
+    file.write(reinterpret_cast<const char*>(pointer), static_cast<std::streamsize>(dump.bytes));
+    if (!file.good()) throw std::runtime_error("frame replay: cannot write " + dump.path.string());
+}
+
+struct FrameCheck {
+    std::size_t compared = 0;
+    double identical = 1.0;
+    int maxDifference = 0;
+};
+
+void writeFrame(const std::filesystem::path& path, const AgcDriver::DisplayBuffer& buffer, std::span<const std::byte> pixels) {
+    std::FILE* file = std::fopen(path.string().c_str(), "wb");
+    const auto failure = file != nullptr ? AgcDriver::WriteBmpAndClose_nid_no_patch(file, buffer.width, buffer.height, pixels) : AgcDriver::FrameDumpIoFailure{"open", errno};
+    if (failure) std::fprintf(stderr, "[frame-replay] cannot write %s (%s failed)\n", path.string().c_str(), failure.operation);
+}
+
+FrameCheck compareFrames(const FrameCaptureReader& reader, const Options& options) {
+    FrameCheck check;
+    if (!options.frames.empty()) std::filesystem::create_directories(options.frames);
+    for (const auto& call : reader.Calls()) {
+        if (call.kind != FrameCallKind::DisplayBuffer || call.values.size() < 9) continue;
+        AgcDriver::DisplayBuffer buffer{};
+        buffer.address = call.address;
+        buffer.pixelFormat = call.values[1];
+        buffer.width = static_cast<std::uint32_t>(call.values[2]);
+        buffer.height = static_cast<std::uint32_t>(call.values[3]);
+        buffer.tilingMode = static_cast<std::uint32_t>(call.values[4]);
+        buffer.pitchInPixel = static_cast<std::uint32_t>(call.values[5]);
+        buffer.dccAddress = call.values[6];
+        buffer.dccClearColor = call.values[7];
+        buffer.alignment = static_cast<std::uint32_t>(call.values[8]);
+        const auto chunk = std::find_if(reader.Chunks().begin(), reader.Chunks().end(), [&](const FrameMemoryChunk& candidate) { return candidate.kind == FrameMemoryKind::Reference && candidate.group == call.values[0]; });
+        if (chunk == reader.Chunks().end()) continue;
+        const auto reference = reader.Read(*chunk);
+        const auto replayed = AgcDriver::ReadDisplayBuffer(buffer);
+        ++check.compared;
+        std::size_t same = 0;
+        const auto pixels = std::min(reference.size(), replayed.size()) / 4;
+        for (std::size_t pixel = 0; pixel < pixels; ++pixel) {
+            bool equal = true;
+            for (std::size_t channel = 0; channel < 4; ++channel) {
+                const auto difference = std::abs(static_cast<int>(reference[pixel * 4 + channel]) - static_cast<int>(replayed[pixel * 4 + channel]));
+                check.maxDifference = std::max(check.maxDifference, difference);
+                equal = equal && difference == 0;
+            }
+            same += equal ? 1 : 0;
+        }
+        const auto total = std::max(reference.size(), replayed.size()) / 4;
+        check.identical = std::min(check.identical, total == 0 ? 1.0 : static_cast<double>(same) / static_cast<double>(total));
+        if (options.frames.empty()) continue;
+        const auto index = std::to_string(call.values[0]);
+        writeFrame(options.frames / ("reference-" + index + ".bmp"), buffer, reference);
+        writeFrame(options.frames / ("replay-" + index + ".bmp"), buffer, replayed);
+    }
+    return check;
+}
+
+int run(const Options& options) {
+    const auto loadStart = Clock::now();
+    const FrameCaptureReader reader(options.directory);
+    if (reader.Truncated()) std::fprintf(stderr, "[frame-replay] the capture is truncated; replaying the complete records\n");
+    auto skipped = restoreMemory(reader);
+    const auto loaded = Clock::now();
+    Replay replay{options, reader};
+    replay.skipped = std::move(skipped);
+    for (const auto& chunk : reader.Chunks()) {
+        if (chunk.kind == FrameMemoryKind::Delta) replay.groups[chunk.group].push_back(&chunk);
+    }
+    const auto& calls = reader.Calls();
+    const auto frameStart = std::find_if(calls.begin(), calls.end(), [](const FrameCall& call) { return call.kind == FrameCallKind::FrameStart; });
+    for (auto call = calls.begin(); call != frameStart; ++call) replay.execute(*call);
+    replay.recording = true;
+    replay.startedAt = Clock::now();
+    if (frameStart != calls.end()) replay.runWindow(std::span(calls).subspan(static_cast<std::size_t>(frameStart - calls.begin()) + 1));
+    if (frameStart == calls.end()) AgcDriverWaitIdle_nid_postfix();
+    replay.endedAt = Clock::now();
+    if (const auto failure = replay.frames.Failure()) std::rethrow_exception(failure);
+    FrameCheck check;
+    if (replay.unfinished == 0) {
+        for (const auto& dump : options.dumps) writeDump(dump);
+        check = compareFrames(reader, options);
+    } else if (!options.dumps.empty()) {
+        std::fprintf(stderr, "[frame-replay] no dumps written: the GPU work did not finish\n");
+    }
+    const auto ready = replay.frames.Times();
+    std::vector<double> frameMs;
+    for (std::size_t index = 1; index < ready.size(); ++index) frameMs.push_back(std::chrono::duration<double, std::milli>(ready[index] - ready[index - 1]).count());
+    std::string frameList;
+    for (const auto value : frameMs) frameList += (frameList.empty() ? "" : ",") + std::to_string(static_cast<long long>(value));
+    std::sort(frameMs.begin(), frameMs.end());
+    const auto percentile = [&](double fraction) { return frameMs.empty() ? 0.0 : frameMs[std::min(frameMs.size() - 1, static_cast<std::size_t>(fraction * static_cast<double>(frameMs.size())))]; };
+    const auto seconds = std::chrono::duration<double>(replay.endedAt - replay.startedAt).count();
+    std::printf("{\"frames\":%zu,\"replay_s\":%.3f,\"fps\":%.3f,\"frame_ms\":{\"p50\":%.3f,\"p90\":%.3f,\"max\":%.3f,\"each\":[%s]},\"submits\":%llu,\"delta_mib\":%.1f,\"pace_timeouts\":%llu,\"pace_wait_s\":%.3f,\"stale_registrations\":%llu,\"failed_registrations\":%llu,\"skipped_mib\":%.1f,\"threads\":%zu,\"released_waits\":%llu,\"of_them_from_earlier_writes\":%llu,\"of_them_synthesized\":%llu,\"unfinished\":%llu,\"frames_compared\":%zu,\"pixels_identical\":%.6f,\"max_channel_diff\":%d,\"load_s\":%.3f}\n",
+                ready.size(), seconds, seconds > 0 ? static_cast<double>(ready.size()) / seconds : 0.0, percentile(0.5), percentile(0.9), frameMs.empty() ? 0.0 : frameMs.back(), frameList.c_str(),
+                static_cast<unsigned long long>(replay.submits.load()), static_cast<double>(replay.deltaBytes.load()) / (1024.0 * 1024.0), static_cast<unsigned long long>(replay.paceTimeouts.load()),
+                replay.paceWaitedSeconds(), static_cast<unsigned long long>(replay.staleRegistrations.load()), static_cast<unsigned long long>(replay.failedRegistrations.load()),
+                static_cast<double>(replay.skipped.bytes) / (1024.0 * 1024.0), replay.threads, static_cast<unsigned long long>(replay.earlyReleases.load()), static_cast<unsigned long long>(replay.lateReleases.load()),
+                static_cast<unsigned long long>(replay.syntheticReleases.load()),
+                static_cast<unsigned long long>(replay.unfinished), check.compared, check.identical, check.maxDifference, std::chrono::duration<double>(loaded - loadStart).count());
+    std::fflush(stdout);
+    return replay.unfinished == 0 ? 0 : 3;
+}
+
+}
+
+int main(int argc, char** argv) {
+    Options options;
+    for (int index = 1; index < argc; ++index) {
+        const std::string_view argument = argv[index];
+        if (argument == "--no-pace") options.pace = false;
+        else if (argument == "--no-release") options.release = false;
+        else if (argument == "--no-synthesize") options.synthesize = false;
+        else if (argument == "--release-after-ms" && index + 1 < argc) options.releaseAfter = std::chrono::milliseconds(std::strtoll(argv[++index], nullptr, 10));
+        else if (argument == "--strict") options.strict = true;
+        else if (argument == "--dump" && index + 1 < argc) options.dumps.push_back(parseDump(argv[++index]));
+        else if (argument == "--frames" && index + 1 < argc) options.frames = argv[++index];
+        else if (!argument.starts_with("-") && options.directory.empty()) options.directory = argument;
+        else return usage();
+    }
+    if (options.directory.empty()) return usage();
+#ifdef _WIN32
+    _putenv_s("APS5_FRAME_CAPTURE", "");
+#else
+    unsetenv("APS5_FRAME_CAPTURE");
+#endif
+    int code = 2;
+    try {
+        code = run(options);
+        if (code == 0) {
+            AgcDriverShutdown_nid_postfix();
+            return 0;
+        }
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "agc_frame_replay: %s\n", error.what());
+    }
+    std::fflush(stdout);
+    std::fflush(stderr);
+    std::_Exit(code);
+}
diff --git a/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp b/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp
index e4eeec9174..7bad5361bb 100644
--- a/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tools/ShaderReplay.cpp
@@ -49,6 +49,7 @@ bool g_graph = false;
 bool g_maintenance8 = false;
 bool g_robust2 = false;
 bool g_waveLdsMemoryBarriers = false;
+bool g_deviceScopeLdsMemoryBarriers = false;
 bool g_code = false;
 
 bool Replay(const char* path) {
@@ -149,6 +150,7 @@ bool Replay(const char* path) {
         if (g_maintenance8) request.request.target.nonConstantImageOffsets = true;
         if (g_robust2) request.request.target.robustBufferAccess2 = true;
         if (g_waveLdsMemoryBarriers) request.request.target.waveLdsMemoryBarriers = true;
+        if (g_deviceScopeLdsMemoryBarriers) request.request.target.deviceScopeLdsMemoryBarriers = true;
         const auto result = ShaderRecompiler::Recompile(request.request);
         std::printf("  recompiled: %zu SPIR-V words\n", result.spirv.size());
         if (g_spirv) {
@@ -186,7 +188,7 @@ bool Replay(const char* path) {
 
 int main(int argc, char** argv) {
     if (argc < 2) {
-        std::fprintf(stderr, "usage: agc_shader_replay [--dis] [--asm] [--cfg] [--mem] [--spv] [--prepare] [--materialize] [--code] [--maintenance8] [--robust2] [--wave-lds-memory-barriers] <shader.req>...\n  the driver writes shader_<address>.req files when APS5_DUMP_SHADERS is set; shader_<address>.prepare.req holds a request whose preparation failed before any resource capture, so replay it with --prepare\n");
+        std::fprintf(stderr, "usage: agc_shader_replay [--dis] [--asm] [--cfg] [--mem] [--spv] [--prepare] [--materialize] [--code] [--maintenance8] [--robust2] [--wave-lds-memory-barriers] [--device-scope-lds-memory-barriers] <shader.req>...\n  the driver writes shader_<address>.req files when APS5_DUMP_SHADERS is set; shader_<address>.prepare.req holds a request whose preparation failed before any resource capture, so replay it with --prepare\n");
         return 2;
     }
     int failures = 0;
@@ -215,6 +217,10 @@ int main(int argc, char** argv) {
             g_waveLdsMemoryBarriers = true;
             continue;
         }
+        if (std::string(argv[i]) == "--device-scope-lds-memory-barriers") {
+            g_deviceScopeLdsMemoryBarriers = true;
+            continue;
+        }
         if (std::string(argv[i]) == "--mem") {
             g_memory = true;
             continue;
diff --git a/core/libs/prx/libSceAgcResourceRegistration/libSceAgcResourceRegistration.hpp b/core/libs/prx/libSceAgcResourceRegistration/libSceAgcResourceRegistration.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAgcResourceRegistration/libSceAgcResourceRegistration.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAgcVsh/Export.cpp b/core/libs/prx/libSceAgcVsh/Export.cpp
index fb34206c21..b648c87cc5 100644
--- a/core/libs/prx/libSceAgcVsh/Export.cpp
+++ b/core/libs/prx/libSceAgcVsh/Export.cpp
@@ -1,3 +1,153 @@
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
+#include "prx/libSceAgcVsh/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,6 +155,904 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceAgcDcbCopyData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1rZSWUv1IRc", sceAgcDcbCopyData_nid_no_patch);
+
+int APS5_VABI sceAgcBranchPatchSetElseTarget_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("QmfvaYpsOcI", sceAgcBranchPatchSetElseTarget_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegistersDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("UZbQjYAwwXM", sceAgcCbSetShRegistersDirect_nid_no_patch);
+
+int APS5_VABI sceAgcCreateShader_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("f3dg2CSgRKY", sceAgcCreateShader_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetNumInstancesGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("6DFuRKT4C9w", sceAgcDcbSetNumInstancesGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("aP1Ki9G3++4", sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("r98I08t+LOg", sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicGdsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1tB0xkLNjcw", sceAgcDcbAtomicGdsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbCopyDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("CbQh3DKMSno", sceAgcAcbCopyDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbWaitUntilSafeForRendering_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GPbUp9jXQa8", sceAgcAcbWaitUntilSafeForRendering_nid_no_patch);
+
+int APS5_VABI sceAgcAsyncCondExecPatchSetEnd_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("k-JpyR2dYAM", sceAgcAsyncCondExecPatchSetEnd_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDmaDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("2ccJz9LQI+w", sceAgcDcbDmaDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetUcRegistersIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hvUfkUIQcOE", sceAgcDcbSetUcRegistersIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaults2_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("2JtWUUiYBXs", sceAgcGetRegisterDefaults2_nid_no_patch);
+
+int APS5_VABI sceAgcCbReleaseMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("wr23dPKyWc0", sceAgcCbReleaseMem_nid_no_patch);
+
+int APS5_VABI sceAgcCondExecPatchSetEnd_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ORWsxIbk4TE", sceAgcCondExecPatchSetEnd_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicGds_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("pH3-dfRpfA0", sceAgcDcbAtomicGds_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GBCh3zCihoU", sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MDLD5Ly94Xk", sceAgcCbSetUcRegisterRangeDirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbEventWrite_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("aJf+j5yntiU", sceAgcDcbEventWrite_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWriteData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("i1jyy49AjXU", sceAgcDcbWriteData_nid_no_patch);
+
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("6lNcCp+fxi4", sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch);
+
+int APS5_VABI sceAgcCbCondWriteGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("FuVbkyKlf+s", sceAgcCbCondWriteGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("zg6u-N6Otxs", sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcGetPacketSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Lkf86B98qPc", sceAgcGetPacketSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAcquireMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("KT-hTp-Ch14", sceAgcAcbAcquireMem_nid_no_patch);
+
+int APS5_VABI sceAgcAcbEventWriteGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Y-5vneiBtzk", sceAgcAcbEventWriteGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexIndirectArgs_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("0o3VDdtA6nM", sceAgcDcbSetIndexIndirectArgs_nid_no_patch);
+
+int APS5_VABI sceAgcAcbDmaData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("-RnpfpxIhec", sceAgcAcbDmaData_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("t1vNu082-jM", sceAgcDcbDrawIndexIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbPrimeUtcl2GetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("KjPeVduz6jU", sceAgcDcbPrimeUtcl2GetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("3ZWa3AoyWZQ", sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAcquireMemGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ewobAQeMo5k", sceAgcAcbAcquireMemGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("AFIh8SQkYlQ", sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("pdEV7bI6COI", sceAgcCreateInterpolantMapping_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirectMulti_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ypVBz4uPKcQ", sceAgcDcbDrawIndexIndirectMulti_nid_no_patch);
+
+int APS5_VABI sceAgcDcbEventWriteGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("C4l9fB17t8w", sceAgcDcbEventWriteGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetUcRegisterDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w4-d0n60hdo", sceAgcDcbSetUcRegisterDirect_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("0fWWK5uG9rQ", sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("pYoKs3lPy88", sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MMlmJAL7N5w", sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetNumInstances_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("tSBxhAPyytQ", sceAgcDcbSetNumInstances_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWaitOnAddressGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("43WJ08sSugE", sceAgcDcbWaitOnAddressGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicGds_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("cduV1f0dcGQ", sceAgcAcbAtomicGds_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("yheJGN-ay+A", sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicMemGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("da1Sm8-QDoU", sceAgcAcbAtomicMemGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("BVFg3CWU6Eo", sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbCondExecGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ou16V5hh5sg", sceAgcDcbCondExecGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexMultiInstanced_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Rlx+bykm0r0", sceAgcDcbDrawIndexMultiInstanced_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegistersIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ZvwO9euwYzc", sceAgcDcbSetCxRegistersIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegistersDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("yUBESvCCJ4I", sceAgcCbSetShRegistersDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCondExecPatchSetCommandAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("YWTKOju587o", sceAgcCondExecPatchSetCommandAddress_nid_no_patch);
+
+int APS5_VABI sceAgcRewindPatchSetRewindState_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ziVA3whp3p4", sceAgcRewindPatchSetRewindState_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("J8YCgfKAMQs", sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch);
+
+int APS5_VABI sceAgcWaitRegMemPatchReference_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("7nOoijNPvEU", sceAgcWaitRegMemPatchReference_nid_no_patch);
+
+int APS5_VABI sceAgcAcbRewind_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("DwICrVxerkY", sceAgcAcbRewind_nid_no_patch);
+
+int APS5_VABI sceAgcAcbCondExecGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ozKzBP4aki4", sceAgcAcbCondExecGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcSuspendPointAndCheckStatus_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("b+fis+WZ3Ig", sceAgcSuspendPointAndCheckStatus_nid_no_patch);
+
+int APS5_VABI sceAgcAcbWaitRegMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("htn36gPnBk4", sceAgcAcbWaitRegMem_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAcquireMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("57labkp+rSQ", sceAgcDcbAcquireMem_nid_no_patch);
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("whb1RL7K4Ss", sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch);
+
+int APS5_VABI sceAgcDcbContextStateOp_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("HabmgqPwPw0", sceAgcDcbContextStateOp_nid_no_patch);
+
+int APS5_VABI sceAgcAcbWriteData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("eZ4+17OQz4Q", sceAgcAcbWriteData_nid_no_patch);
+
+int APS5_VABI sceAgcAcbDmaDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("M0ttm8h7SKA", sceAgcAcbDmaDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("bxGoVxpdSPQ", sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbNop_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("LtTouSCZjHM", sceAgcCbNop_nid_no_patch);
+
+int APS5_VABI sceAgcDcbResetQueue_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("TRO721eVt4g", sceAgcDcbResetQueue_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDmaData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("WmAc2MEj6Io", sceAgcDcbDmaData_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("6ee9Hd3EWXQ", sceAgcDcbDrawIndexGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("IxYiarKlXxM", sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch);
+
+int APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hL7C0IRpWZI", sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetFlip_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("YUeqkyT7mEQ", sceAgcDcbSetFlip_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetMarker_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("QhCbS4X9Rl8", sceAgcDcbSetMarker_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetPredication_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("bbFueFP+J4k", sceAgcDcbSetPredication_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1-gUn1PI4Sw", sceAgcDcbAtomicMem_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaults2Internal_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("wRbq6ZjNop4", sceAgcGetRegisterDefaults2Internal_nid_no_patch);
+
+int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("z2duB-hHQSM", sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch);
+
+int APS5_VABI sceAgcDcbPrimeUtcl2_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("jt3pl7EN17o", sceAgcDcbPrimeUtcl2_nid_no_patch);
+
+int APS5_VABI sceAgcAcbRewindGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("0ZOG0jc9nRg", sceAgcAcbRewindGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("XN+Iuu7XsM8", sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWaitUntilSafeForRendering_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MWiElSNE8j8", sceAgcDcbWaitUntilSafeForRendering_nid_no_patch);
+
+int APS5_VABI sceAgcBranchPatchSetThenTarget_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("xb8VgcXQhvI", sceAgcBranchPatchSetThenTarget_nid_no_patch);
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vcmNN+AAXnY", sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbAtomicMemGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("oz6zQq1JwCE", sceAgcDcbAtomicMemGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcUpdatePrimState_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Y3ymLfZ1384", sceAgcUpdatePrimState_nid_no_patch);
+
+int APS5_VABI sceAgcCbNopGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("t7PlZ9nt5Lc", sceAgcCbNopGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbGetLodStats_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vuSXe69VILM", sceAgcDcbGetLodStats_nid_no_patch);
+
+int APS5_VABI sceAgcWaitRegMemPatchAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("3KDcnM3lrcU", sceAgcWaitRegMemPatchAddress_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MlEw1feXcjg", sceAgcQueueEndOfPipeActionPatchData_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaultsInternal_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("uIwxsqDlHRc", sceAgcGetRegisterDefaultsInternal_nid_no_patch);
+
+int APS5_VABI sceAgcInit_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("kW3GLb7QfPg", sceAgcInit_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDispatchIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w8HVkEeXPv8", sceAgcDcbDispatchIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbCondExec_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("BIPexNBSGog", sceAgcDcbCondExec_nid_no_patch);
+
+int APS5_VABI sceAgcAcbSetMarker_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("xAeBOa0A3kk", sceAgcAcbSetMarker_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("qMlfB1ZhMDc", sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbJump_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("e1DFTg+Sd8U", sceAgcAcbJump_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexCount_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("8N2tmT3jmC8", sceAgcDcbSetIndexCount_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("nNlUtdDDvZ0", sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("+u6dKSLWM2o", sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcSuspendPoint_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("h9z6+0hEydk", sceAgcSuspendPoint_nid_no_patch);
+
+int APS5_VABI sceAgcWaitRegMemPatchMask_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hXAnLgDHCoI", sceAgcWaitRegMemPatchMask_nid_no_patch);
+
+int APS5_VABI sceAgcAcbDispatchIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("PxKWV2fVAps", sceAgcAcbDispatchIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicGdsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("hcIxS8pmXF4", sceAgcAcbAtomicGdsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbCondWrite_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("7toV+elXqNM", sceAgcCbCondWrite_nid_no_patch);
+
+int APS5_VABI sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("P1CugZ99Uzc", sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetPredicationDisableGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vLrBL8DQiz8", sceAgcDcbSetPredicationDisableGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcLinkShaders_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("MqAdbRMdNz4", sceAgcLinkShaders_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWaitRegMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("VmW0Tdpy420", sceAgcDcbWaitRegMem_nid_no_patch);
+
+int APS5_VABI sceAgcGetRegisterDefaults_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Wi82ArQtAwg", sceAgcGetRegisterDefaults_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetShRegisterRangeDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("n2fD4A+pb+g", sceAgcCbSetShRegisterRangeDirect_nid_no_patch);
+
+int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("d-6uF9sZDIU", sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDispatchIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("CtB+A9-VxO0", sceAgcDcbDispatchIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcCbMemSemaphore_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("vHX9guneRBY", sceAgcCbMemSemaphore_nid_no_patch);
+
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("JOWmDrl+j20", sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbDispatch_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("k3GhuSNmBLU", sceAgcCbDispatch_nid_no_patch);
+
+int APS5_VABI sceAgcDcbCopyDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("b5u0Jzm8TF8", sceAgcDcbCopyDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("mR9j7+SfM34", sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("cdDRpqcFGbU", sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch);
+
+int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Qrj4c+61z4A", sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbJump_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("xSAR0LTcRKM", sceAgcDcbJump_nid_no_patch);
+
+int APS5_VABI sceAgcDcbJumpGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("VEGu4dixjUg", sceAgcDcbJumpGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbPrimeUtcl2_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("szG7hz2yEhA", sceAgcAcbPrimeUtcl2_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1DeUNpRIDDA", sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchType_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("T9fjQIINoeE", sceAgcQueueEndOfPipeActionPatchType_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetCxRegisterDirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("LHFXRrlTPD8", sceAgcDcbSetCxRegisterDirect_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndex_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("q88lQ+GP5Yk", sceAgcDcbDrawIndex_nid_no_patch);
+
+int APS5_VABI sceAgcCbDispatchGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("Abendgtz+3o", sceAgcCbDispatchGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbGetLodStatsGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("rUuVjyR+Rd4", sceAgcDcbGetLodStatsGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcGetDataPacketPayloadAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("CQsSq6l6+kA", sceAgcGetDataPacketPayloadAddress_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndirect_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("1q1titRBL6o", sceAgcDcbDrawIndirect_nid_no_patch);
+
+int APS5_VABI sceAgcAcbSetFlip_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ebixW91gpPw", sceAgcAcbSetFlip_nid_no_patch);
+
+int APS5_VABI sceAgcGetFusedShaderSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("nQT5kYLv0cg", sceAgcGetFusedShaderSize_nid_no_patch);
+
+int APS5_VABI sceAgcSetRangePredication_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("n8vgpaQg6dA", sceAgcSetRangePredication_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("QhPDD513V0w", sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbSetIndexSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GIIW2J37e70", sceAgcDcbSetIndexSize_nid_no_patch);
+
+int APS5_VABI sceAgcSetPacketPredication_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w6Dj1VJt5qY", sceAgcSetPacketPredication_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexOffset_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("B+aG9DUnTKA", sceAgcDcbDrawIndexOffset_nid_no_patch);
+
+int APS5_VABI sceAgcAsyncRewindPatchSetRewindState_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("eWaWyFegzgQ", sceAgcAsyncRewindPatchSetRewindState_nid_no_patch);
+
+int APS5_VABI sceAgcJumpPatchSetTarget_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("2BS4EtAaF28", sceAgcJumpPatchSetTarget_nid_no_patch);
+
+int APS5_VABI sceAgcBranchPatchSetCompareAddress_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("GXBlM-ekzrI", sceAgcBranchPatchSetCompareAddress_nid_no_patch);
+
+int APS5_VABI sceAgcAcbJumpGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("b-oySn+G2tE", sceAgcAcbJumpGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcCbBranch_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("w1KFAHVqpaU", sceAgcCbBranch_nid_no_patch);
+
+int APS5_VABI sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("mStuvI0zOtc", sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbCopyData_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("qzMN2XKGA4k", sceAgcAcbCopyData_nid_no_patch);
+
+int APS5_VABI sceAgcDcbWriteDataGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("p9tI+yTvx68", sceAgcDcbWriteDataGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbAtomicMem_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("XKKuA6VkSRc", sceAgcAcbAtomicMem_nid_no_patch);
+
+int APS5_VABI sceAgcAcbPrimeUtcl2GetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("eCjKaqeeQ5s", sceAgcAcbPrimeUtcl2GetSize_nid_no_patch);
+
+int APS5_VABI sceAgcAcbResetQueue_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("JrtiDtKeS38", sceAgcAcbResetQueue_nid_no_patch);
+
+int APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("F8NLhWvFemI", sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch);
+
+int APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("ms1xVoZ-Vwc", sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch);
 
 }
diff --git a/core/libs/prx/libSceAgcVsh/include/Api.hpp b/core/libs/prx/libSceAgcVsh/include/Api.hpp
new file mode 100644
index 0000000000..efe8a800e6
--- /dev/null
+++ b/core/libs/prx/libSceAgcVsh/include/Api.hpp
@@ -0,0 +1,158 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAgcDcbCopyData_nid_no_patch(void);
+int APS5_VABI sceAgcBranchPatchSetElseTarget_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegistersDirect_nid_no_patch(void);
+int APS5_VABI sceAgcCreateShader_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetNumInstancesGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetUcRegisterDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirectMultiGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicGdsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbCopyDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbWaitUntilSafeForRendering_nid_no_patch(void);
+int APS5_VABI sceAgcAsyncCondExecPatchSetEnd_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDmaDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetUcRegistersIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaults2_nid_no_patch(void);
+int APS5_VABI sceAgcCbReleaseMem_nid_no_patch(void);
+int APS5_VABI sceAgcCondExecPatchSetEnd_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicGds_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegistersIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbEventWrite_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWriteData_nid_no_patch(void);
+int APS5_VABI sceAgcSetUcRegIndirectPatchSetAddress_nid_no_patch(void);
+int APS5_VABI sceAgcCbCondWriteGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbQueueEndOfShaderActionGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcGetPacketSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAcquireMem_nid_no_patch(void);
+int APS5_VABI sceAgcAcbEventWriteGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexIndirectArgs_nid_no_patch(void);
+int APS5_VABI sceAgcAcbDmaData_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbPrimeUtcl2GetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAsyncCondExecPatchSetCommandAddress_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAcquireMemGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexIndirectArgsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCreateInterpolantMapping_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirectMulti_nid_no_patch(void);
+int APS5_VABI sceAgcDcbEventWriteGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetUcRegisterDirect_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndirectMultiGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetBaseDrawIndirectArgsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetNumInstances_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWaitOnAddressGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicGds_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetBoolPredicationEnableGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicMemGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCfRegisterRangeDirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbCondExecGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexMultiInstanced_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegistersIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegistersDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCondExecPatchSetCommandAddress_nid_no_patch(void);
+int APS5_VABI sceAgcRewindPatchSetRewindState_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchGcrCntl_nid_no_patch(void);
+int APS5_VABI sceAgcWaitRegMemPatchReference_nid_no_patch(void);
+int APS5_VABI sceAgcAcbRewind_nid_no_patch(void);
+int APS5_VABI sceAgcAcbCondExecGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcSuspendPointAndCheckStatus_nid_no_patch(void);
+int APS5_VABI sceAgcAcbWaitRegMem_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAcquireMem_nid_no_patch(void);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetNumRegisters_nid_no_patch(void);
+int APS5_VABI sceAgcDcbContextStateOp_nid_no_patch(void);
+int APS5_VABI sceAgcAcbWriteData_nid_no_patch(void);
+int APS5_VABI sceAgcAcbDmaDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegisterRangeDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbNop_nid_no_patch(void);
+int APS5_VABI sceAgcDcbResetQueue_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDmaData_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDmaDataPatchSetDstAddressOrOffset_nid_no_patch(void);
+int APS5_VABI sceAgcCbQueueEndOfPipeActionGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetFlip_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetMarker_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetPredication_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicMem_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaults2Internal_nid_no_patch(void);
+int APS5_VABI sceAgcSetShRegIndirectPatchAddRegisters_nid_no_patch(void);
+int APS5_VABI sceAgcDcbPrimeUtcl2_nid_no_patch(void);
+int APS5_VABI sceAgcAcbRewindGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetZPassPredicationEnableGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWaitUntilSafeForRendering_nid_no_patch(void);
+int APS5_VABI sceAgcBranchPatchSetThenTarget_nid_no_patch(void);
+int APS5_VABI sceAgcSetCxRegIndirectPatchSetAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbAtomicMemGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcUpdatePrimState_nid_no_patch(void);
+int APS5_VABI sceAgcCbNopGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbGetLodStats_nid_no_patch(void);
+int APS5_VABI sceAgcWaitRegMemPatchAddress_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchData_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaultsInternal_nid_no_patch(void);
+int APS5_VABI sceAgcInit_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDispatchIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbCondExec_nid_no_patch(void);
+int APS5_VABI sceAgcAcbSetMarker_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexOffsetGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbJump_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexCount_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetShRegistersIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbStallCommandBufferParserGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcSuspendPoint_nid_no_patch(void);
+int APS5_VABI sceAgcWaitRegMemPatchMask_nid_no_patch(void);
+int APS5_VABI sceAgcAcbDispatchIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicGdsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbCondWrite_nid_no_patch(void);
+int APS5_VABI sceAgcDcbEndOcclusionQueryGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetPredicationDisableGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcLinkShaders_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWaitRegMem_nid_no_patch(void);
+int APS5_VABI sceAgcGetRegisterDefaults_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetShRegisterRangeDirect_nid_no_patch(void);
+int APS5_VABI sceAgcSetCxRegIndirectPatchAddRegisters_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDispatchIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcCbMemSemaphore_nid_no_patch(void);
+int APS5_VABI sceAgcCbSetUcRegisterRangeDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbDispatch_nid_no_patch(void);
+int APS5_VABI sceAgcDcbCopyDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexMultiInstancedGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDmaDataPatchSetSrcAddressOrOffsetOrImmediate_nid_no_patch(void);
+int APS5_VABI sceAgcSetShRegIndirectPatchSetAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbJump_nid_no_patch(void);
+int APS5_VABI sceAgcDcbJumpGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbPrimeUtcl2_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegisterDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcQueueEndOfPipeActionPatchType_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetCxRegisterDirect_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndex_nid_no_patch(void);
+int APS5_VABI sceAgcCbDispatchGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbGetLodStatsGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcGetDataPacketPayloadAddress_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndirect_nid_no_patch(void);
+int APS5_VABI sceAgcAcbSetFlip_nid_no_patch(void);
+int APS5_VABI sceAgcGetFusedShaderSize_nid_no_patch(void);
+int APS5_VABI sceAgcSetRangePredication_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetShRegisterDirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbSetIndexSize_nid_no_patch(void);
+int APS5_VABI sceAgcSetPacketPredication_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexOffset_nid_no_patch(void);
+int APS5_VABI sceAgcAsyncRewindPatchSetRewindState_nid_no_patch(void);
+int APS5_VABI sceAgcJumpPatchSetTarget_nid_no_patch(void);
+int APS5_VABI sceAgcBranchPatchSetCompareAddress_nid_no_patch(void);
+int APS5_VABI sceAgcAcbJumpGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcCbBranch_nid_no_patch(void);
+int APS5_VABI sceAgcDcbDrawIndexIndirectGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbCopyData_nid_no_patch(void);
+int APS5_VABI sceAgcDcbWriteDataGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbAtomicMem_nid_no_patch(void);
+int APS5_VABI sceAgcAcbPrimeUtcl2GetSize_nid_no_patch(void);
+int APS5_VABI sceAgcAcbResetQueue_nid_no_patch(void);
+int APS5_VABI sceAgcAcbQueueEndOfShaderActionGetSize_nid_no_patch(void);
+int APS5_VABI sceAgcDcbBeginOcclusionQueryGetSize_nid_no_patch(void);
+
+}
diff --git a/core/libs/prx/libSceAgcVsh/libSceAgcVsh.hpp b/core/libs/prx/libSceAgcVsh/libSceAgcVsh.hpp
new file mode 100644
index 0000000000..9291d1e52e
--- /dev/null
+++ b/core/libs/prx/libSceAgcVsh/libSceAgcVsh.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAgcVsh/include/Api.hpp"
diff --git a/core/libs/prx/libSceAgcVshDebug/libSceAgcVshDebug.hpp b/core/libs/prx/libSceAgcVshDebug/libSceAgcVshDebug.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAgcVshDebug/libSceAgcVshDebug.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAjm.native/CMakeLists.txt b/core/libs/prx/libSceAjm.native/CMakeLists.txt
index c69ccc483c..20f6cf1f20 100644
--- a/core/libs/prx/libSceAjm.native/CMakeLists.txt
+++ b/core/libs/prx/libSceAjm.native/CMakeLists.txt
@@ -62,6 +62,11 @@ if(BUILD_TESTING)
     target_link_libraries(guest_ajm_vibration_tests PRIVATE libSceAjm.native libc)
     configure_windows_unwind(guest_ajm_vibration_tests)
     add_test(NAME guest_ajm_vibration COMMAND guest_ajm_vibration_tests)
+    add_test_executable(guest_ajm_wvorbis_tests ${LIBS_INCLUDE_DIR}/tests/GuestAjmWVorbis.cpp)
+    target_include_directories(guest_ajm_wvorbis_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_ajm_wvorbis_tests PRIVATE libSceAjm.native libc)
+    configure_windows_unwind(guest_ajm_wvorbis_tests)
+    add_test(NAME guest_ajm_wvorbis COMMAND guest_ajm_wvorbis_tests)
     if(UNIX)
         add_test_executable(guest_ajm_teardown_tests ${LIBS_INCLUDE_DIR}/tests/GuestAjmTeardown.cpp)
         target_include_directories(guest_ajm_teardown_tests PRIVATE ${LIBS_INCLUDE_DIR})
@@ -70,7 +75,7 @@ if(BUILD_TESTING)
         add_test(NAME guest_ajm_teardown COMMAND guest_ajm_teardown_tests $<TARGET_FILE:libSceAjm.native>)
     endif()
     if(WIN32)
-        set_tests_properties(guest_ajm guest_ajm_vibration PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_ajm guest_ajm_vibration guest_ajm_wvorbis PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAjm.native>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceAjm.native/Export.cpp b/core/libs/prx/libSceAjm.native/Export.cpp
index 2a7d6a4f1f..c9f1f976a7 100644
--- a/core/libs/prx/libSceAjm.native/Export.cpp
+++ b/core/libs/prx/libSceAjm.native/Export.cpp
@@ -1,9 +1,11 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <atomic>
 #include <cstdio>
+#include <cstring>
 
 // Entry points this library does not implement: reported before the unimplemented-call exception so an
 // APS5_TRACE_AJM run shows which one a title reached.
@@ -12,37 +14,43 @@ static void AjmStub(const char* name) {
     NotImplemented_nid_no_patch(name);
 }
 
-struct WVorbisHeaderPacketParameter {
-    std::size_t size;
-    std::int32_t channels;
-    std::uint32_t sampleRate;
-    std::int32_t bytesPerSecond;
-    std::int32_t shortBlockExponent;
-    std::int32_t longBlockExponent;
-    std::uint32_t reserved;
-    const void* setupPacket;
-    std::size_t setupPacketSize;
-    void* output;
-    std::size_t outputCapacity;
-    std::size_t outputSize;
-};
-
-struct WVorbisSetupPacketParameter {
-    std::size_t size;
-    std::int32_t channels;
-    std::uint32_t reserved;
-    const void* input;
-    std::size_t inputSize;
-    void* output;
-    std::size_t outputCapacity;
-    std::size_t outputSize;
-};
-
 static_assert(sizeof(WVorbisHeaderPacketParameter) == 72);
 static_assert(offsetof(WVorbisHeaderPacketParameter, setupPacket) == 32);
 static_assert(sizeof(WVorbisSetupPacketParameter) == 56);
 static_assert(offsetof(WVorbisSetupPacketParameter, input) == 16);
 
+namespace {
+
+constexpr int AJM_WVORBIS_ERROR_INVALID_PARAMETER = static_cast<int>(0x8A6E0001);
+constexpr int AJM_WVORBIS_ERROR_INVALID_SIZE = static_cast<int>(0x8A6E0002);
+constexpr int AJM_WVORBIS_ERROR_OUTPUT_TOO_SMALL = static_cast<int>(0x8A6E0003);
+constexpr int AJM_WVORBIS_ERROR_INVALID_SETUP = static_cast<int>(0x8A6E0004);
+constexpr std::size_t WVORBIS_LENGTH_TABLE_SIZE = 10;
+constexpr std::size_t VORBIS_IDENTIFICATION_SIZE = 30;
+constexpr std::size_t VORBIS_COMMENT_SIZE = 16;
+constexpr std::size_t WVORBIS_SETUP_MIN_SIZE = 9;
+constexpr std::size_t WVORBIS_SETUP_PART1_LENGTH_OFFSET = 7;
+constexpr std::int32_t VORBIS_BLOCK_SIZE_MIN = 64;
+constexpr std::int32_t VORBIS_BLOCK_SIZE_MAX = 8192;
+constexpr std::uint8_t VORBIS_MAGIC[] {'v', 'o', 'r', 'b', 'i', 's'};
+
+std::int32_t WVorbisBlockSize(std::int32_t log2) {
+    return static_cast<std::int32_t>(1u << (static_cast<std::uint32_t>(log2) & 31u));
+}
+
+std::uint8_t* PutLittle(std::uint8_t* out, std::uint32_t value, std::size_t bytes) {
+    for (std::size_t i = 0; i < bytes; ++i) out[i] = static_cast<std::uint8_t>(value >> (8 * i));
+    return out + bytes;
+}
+
+std::uint8_t* PutVorbisHeaderStart(std::uint8_t* out, std::uint8_t type) {
+    *out++ = type;
+    std::memcpy(out, VORBIS_MAGIC, sizeof(VORBIS_MAGIC));
+    return out + sizeof(VORBIS_MAGIC);
+}
+
+}
+
 extern "C" {
 
 int APS5_VABI sceAjmBatchJobEncode(AjmBatchInfo* info, uint32_t instance, const void* pcm_input, size_t pcm_input_size, void* bitstream_output, size_t bitstream_output_size, void* result) {
@@ -63,8 +71,45 @@ const char* APS5_VABI sceAjmStrError(int error) {
  return nullptr;
 }
 
-int APS5_VABI sceAjmDecWVorbisCreateHeaderPacket(WVorbisHeaderPacketParameter* parameter) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceAjmDecWVorbisCreateHeaderPacket(WVorbisHeaderPacketParameter* param) {
+    if (param == nullptr) return AJM_WVORBIS_ERROR_INVALID_PARAMETER;
+    if (param->size != sizeof(WVorbisHeaderPacketParameter)) return AJM_WVORBIS_ERROR_INVALID_SIZE;
+    if (param->bytesPerSecond < 0) return AJM_WVORBIS_ERROR_INVALID_PARAMETER;
+    if (WVorbisBlockSize(param->shortBlockExponent) < VORBIS_BLOCK_SIZE_MIN) return AJM_WVORBIS_ERROR_INVALID_PARAMETER;
+    if (param->longBlockExponent < param->shortBlockExponent || WVorbisBlockSize(param->longBlockExponent) > VORBIS_BLOCK_SIZE_MAX)
+        return AJM_WVORBIS_ERROR_INVALID_PARAMETER;
+    if (param->setupPacket == nullptr) return AJM_WVORBIS_ERROR_INVALID_PARAMETER;
+    if (param->setupPacketSize < WVORBIS_SETUP_MIN_SIZE) return AJM_WVORBIS_ERROR_INVALID_SETUP;
+    if (param->output == nullptr) return AJM_WVORBIS_ERROR_INVALID_PARAMETER;
+    constexpr std::size_t headers = WVORBIS_LENGTH_TABLE_SIZE + VORBIS_IDENTIFICATION_SIZE + VORBIS_COMMENT_SIZE;
+    if (param->outputCapacity < headers || param->setupPacketSize > param->outputCapacity - headers) return AJM_WVORBIS_ERROR_OUTPUT_TOO_SMALL;
+
+    const auto* setup = static_cast<const std::uint8_t*>(param->setupPacket);
+    const auto part1 = static_cast<std::uint16_t>(setup[WVORBIS_SETUP_PART1_LENGTH_OFFSET] | setup[WVORBIS_SETUP_PART1_LENGTH_OFFSET + 1] << 8);
+    auto* out = static_cast<std::uint8_t*>(param->output);
+    out = PutLittle(out, 0, 2);
+    out = PutLittle(out, VORBIS_IDENTIFICATION_SIZE, 2);
+    out = PutLittle(out, VORBIS_COMMENT_SIZE, 2);
+    out = PutLittle(out, part1, 2);
+    out = PutLittle(out, static_cast<std::uint16_t>(param->setupPacketSize) - part1, 2);
+
+    out = PutVorbisHeaderStart(out, 1);
+    out = PutLittle(out, 0, 4);
+    out = PutLittle(out, static_cast<std::uint32_t>(param->channels), 1);
+    out = PutLittle(out, param->sampleRate, 4);
+    out = PutLittle(out, 0, 4);
+    out = PutLittle(out, static_cast<std::uint32_t>(param->bytesPerSecond) * 8u, 4);
+    out = PutLittle(out, 0, 4);
+    *out++ = static_cast<std::uint8_t>((param->shortBlockExponent & 0xF) | (param->longBlockExponent & 0xF) << 4);
+    *out++ = 1;
+
+    out = PutVorbisHeaderStart(out, 3);
+    out = PutLittle(out, 0, 4);
+    out = PutLittle(out, 0, 4);
+    *out++ = 1;
+
+    std::memcpy(out, setup, param->setupPacketSize);
+    param->outputSize = headers + param->setupPacketSize;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceAjm.native/include/Api.hpp b/core/libs/prx/libSceAjm.native/include/Api.hpp
new file mode 100644
index 0000000000..3c1f8608ed
--- /dev/null
+++ b/core/libs/prx/libSceAjm.native/include/Api.hpp
@@ -0,0 +1,74 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct WVorbisHeaderPacketParameter {
+    std::size_t size;
+    std::int32_t channels;
+    std::uint32_t sampleRate;
+    std::int32_t bytesPerSecond;
+    std::int32_t shortBlockExponent;
+    std::int32_t longBlockExponent;
+    std::uint32_t reserved;
+    const void* setupPacket;
+    std::size_t setupPacketSize;
+    void* output;
+    std::size_t outputCapacity;
+    std::size_t outputSize;
+};
+
+struct WVorbisSetupPacketParameter {
+    std::size_t size;
+    std::int32_t channels;
+    std::uint32_t reserved;
+    const void* input;
+    std::size_t inputSize;
+    void* output;
+    std::size_t outputCapacity;
+    std::size_t outputSize;
+};
+
+extern "C" {
+
+int APS5_VABI sceAjmBatchJobEncode(AjmBatchInfo* info, uint32_t instance, const void* pcmInput, size_t pcmInputSize, void* bitstreamOutput, size_t bitstreamOutputSize, void* result);
+const char* APS5_VABI sceAjmStrError(int error);
+int APS5_VABI sceAjmDecWVorbisCreateHeaderPacket(WVorbisHeaderPacketParameter* param);
+int APS5_VABI sceAjmDecWVorbisCreateSetupPacket(WVorbisSetupPacketParameter* parameter);
+int APS5_VABI sceAjmBatchGetLog();
+int APS5_VABI sceAjmInstanceAvailable();
+uint32_t APS5_VABI sceAjmInstanceCodecType(uint32_t instanceId);
+int APS5_VABI sceAjmInstanceExtend(uint32_t context, uint32_t codec, uint64_t flags, uint32_t instance);
+int APS5_VABI sceAjmInstanceSwitch(uint32_t context, uint32_t codec, uint64_t flags, uint32_t instance);
+int APS5_VABI sceAjmInitialize(int64_t reserved, uint32_t* context);
+int APS5_VABI sceAjmFinalize(uint32_t context);
+int APS5_VABI sceAjmModuleRegister(uint32_t context, uint32_t codec, int64_t reserved);
+int APS5_VABI sceAjmModuleUnregister(uint32_t context, uint32_t codec);
+int APS5_VABI sceAjmMemoryRegister(uint32_t context, void* ptr, size_t pages);
+int APS5_VABI sceAjmMemoryUnregister(uint32_t context, void* ptr);
+int APS5_VABI sceAjmInstanceCreate(uint32_t context, uint32_t codec, uint64_t flags, uint32_t* instance);
+int APS5_VABI sceAjmInstanceDestroy(uint32_t context, uint32_t instance);
+int APS5_VABI sceAjmDecAt9ParseConfigData(const void* configData, AjmDecAt9ConfigDataInfo* configInfo);
+int APS5_VABI sceAjmDecMp3ParseFrame(const uint8_t* stream, uint32_t streamSize, int parseOfl, AjmDecMp3ParseFrame* frame);
+int APS5_VABI sceAjmBatchInitialize(void* buffer, size_t size, AjmBatchInfo* info);
+int APS5_VABI sceAjmBatchJobInitialize(AjmBatchInfo* info, uint32_t instance, const void* codecParameters, size_t codecParametersSize, void* result);
+int APS5_VABI sceAjmBatchJobClearContext(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobSetGaplessDecode(AjmBatchInfo* info, uint32_t instance, const void* gaplessDecode, int reset, void* result);
+int APS5_VABI sceAjmBatchJobControl(AjmBatchInfo* info, uint32_t instance, uint64_t flags, const void* sidebandInput, size_t sidebandInputSize, void* sidebandOutput, size_t sidebandOutputSize);
+int APS5_VABI sceAjmBatchJobRunSplit(AjmBatchInfo* info, uint32_t instance, uint64_t flags, const AjmBuffer* inputBuffers, size_t inputBuffersNum, const AjmBuffer* outputBuffers, size_t outputBuffersNum, void* sidebandOutput, size_t sidebandOutputSize);
+int APS5_VABI sceAjmBatchJobRun(AjmBatchInfo* info, uint32_t instance, uint64_t flags, const void* dataInput, size_t dataInputSize, void* dataOutput, size_t dataOutputSize, void* sidebandOutput, size_t sidebandOutputSize);
+int APS5_VABI sceAjmBatchJobSetResampleParameters(AjmBatchInfo* info, uint32_t instance, float ratio, uint32_t flags, void* result);
+int APS5_VABI sceAjmBatchJobSetResampleParametersEx(AjmBatchInfo* info, uint32_t instance, float ratioStart, float ratioChangePerSample, uint32_t flags, void* result);
+int APS5_VABI sceAjmBatchJobGetResampleInfo(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobDecode(AjmBatchInfo* info, uint32_t instance, const void* bitstreamInput, size_t bitstreamInputSize, void* pcmOutput, size_t pcmOutputSize, void* result);
+int APS5_VABI sceAjmBatchJobDecodeSplit(AjmBatchInfo* info, uint32_t instance, const AjmBuffer* inputBuffers, size_t inputBuffersNum, const AjmBuffer* outputBuffers, size_t outputBuffersNum, void* result);
+int APS5_VABI sceAjmBatchJobDecodeSingle(AjmBatchInfo* info, uint32_t instance, const void* bitstreamInput, size_t bitstreamInputSize, void* pcmOutput, size_t pcmOutputSize, void* result);
+int APS5_VABI sceAjmBatchJobGetGaplessDecode(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobGetInfo(AjmBatchInfo* info, uint32_t instance, void* result);
+int APS5_VABI sceAjmBatchJobGetCodecInfo(AjmBatchInfo* info, uint32_t instance, void* result, size_t resultSize);
+int APS5_VABI sceAjmBatchJobGetStatistics(AjmBatchInfo* info, float interval, void* result);
+int APS5_VABI sceAjmBatchStart(uint32_t context, const AjmBatchInfo* info, int priority, AjmBatchError* error, uint32_t* batch);
+int APS5_VABI sceAjmBatchWait(uint32_t context, uint32_t batch, uint32_t timeout, AjmBatchError* error);
+int APS5_VABI sceAjmBatchCancel(uint32_t context, uint32_t batch);
+int APS5_VABI sceAjmBatchErrorDump(const AjmBatchInfo* info, AjmBatchError* error);
+
+}
diff --git a/core/libs/prx/libSceAjm.native/libSceAjm.native.hpp b/core/libs/prx/libSceAjm.native/libSceAjm.native.hpp
new file mode 100644
index 0000000000..ed8be05e6b
--- /dev/null
+++ b/core/libs/prx/libSceAjm.native/libSceAjm.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAjm.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceAjm.native/src/Ajm.cpp b/core/libs/prx/libSceAjm.native/src/Ajm.cpp
index 69fc72c729..7661f2477d 100644
--- a/core/libs/prx/libSceAjm.native/src/Ajm.cpp
+++ b/core/libs/prx/libSceAjm.native/src/Ajm.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -851,14 +852,15 @@ std::uint32_t ReadBigEndian(const std::uint8_t* data, std::size_t bytes) {
 
 int ParseMp3Header(const std::uint8_t* stream, std::uint32_t streamSize, int parseOfl, AjmDecMp3ParseFrame* frame);
 
-void ParseMp3Ofl(const std::uint8_t* stream, std::uint32_t streamSize, std::uint32_t header, AjmDecMp3ParseFrame* frame) {
+void ParseMp3Ofl(const std::uint8_t* stream, std::uint32_t streamSize, std::uint32_t header, AjmDecMp3ParseFrame* frame, int parseOfl) {
     const std::size_t end = std::min<std::size_t>(streamSize, frame->frame_size);
-    if (end <= 4) return;
-    const std::size_t available = end - 4;
+    const std::size_t sideInfoStart = 4 + (((header >> 16u) & 1u) == 0 ? 2u : 0u);
+    if (end <= sideInfoStart) return;
+    const std::size_t available = end - sideInfoStart;
     std::size_t bit = 0;
     const auto readBits = [&](std::uint32_t count) {
         std::uint32_t value = 0;
-        for (std::uint32_t i = 0; i < count; ++i, ++bit) value = (value << 1u) | (bit / 8 < available ? (stream[4 + bit / 8] >> (7 - bit % 8)) & 1u : 0u);
+        for (std::uint32_t i = 0; i < count; ++i, ++bit) value = (value << 1u) | (bit / 8 < available ? (stream[sideInfoStart + bit / 8] >> (7 - bit % 8)) & 1u : 0u);
         return value;
     };
     const bool mpeg1 = ((header >> 19u) & 3u) == 3u;
@@ -872,11 +874,20 @@ void ParseMp3Ofl(const std::uint8_t* stream, std::uint32_t streamSize, std::uint
         }
     }
     bit += mainDataBits;
-    std::size_t at = 4 + std::min<std::size_t>((bit + 7) / 8, available);
+    std::size_t at = sideInfoStart + std::min<std::size_t>((bit + 7) / 8, available);
 
-    if (at + 8 <= end && (std::memcmp(stream + at, "Xing", 4) == 0 || std::memcmp(stream + at, "Info", 4) == 0)) {
-        const std::uint8_t flags = stream[at + 7];
-        std::size_t field = at + 8;
+    std::size_t tagAt = at;
+    if (tagAt + 8 > end || (std::memcmp(stream + tagAt, "Xing", 4) != 0 && std::memcmp(stream + tagAt, "Info", 4) != 0)) {
+        const std::size_t fixedOffset = mpeg1 ? (mono ? 21u : 36u) : (mono ? 13u : 21u);
+        tagAt = 0;
+        if (fixedOffset + 8 <= end && (std::memcmp(stream + fixedOffset, "Xing", 4) == 0 || std::memcmp(stream + fixedOffset, "Info", 4) == 0)) {
+            tagAt = fixedOffset;
+        }
+    }
+
+    if (tagAt != 0) {
+        const std::uint8_t flags = stream[tagAt + 7];
+        std::size_t field = tagAt + 8;
         std::uint32_t frames = 0;
         if (flags & 0x01u) {
             if (field + 4 > end) return;
@@ -903,30 +914,34 @@ void ParseMp3Ofl(const std::uint8_t* stream, std::uint32_t streamSize, std::uint
             frame->encoder_delay = frame->samples_per_channel + delay + 529;
             frame->ofl_type = MP3_OFL_LAME;
         }
-    } else if (at != 36 && end >= 40 && std::memcmp(stream + 36, "VBRI", 4) == 0) {
-        NotImplemented_nid_no_patch("sceAjmDecMp3ParseFrame (VBRI header outside MPEG-1 stereo)");
-    } else if (at + 26 <= end && std::memcmp(stream + at, "VBRI", 4) == 0) {
-        frame->encoder_delay = ReadBigEndian(stream + at + 6, 2);
+        return;
+    }
+
+    const std::size_t vbriAt = end >= 40 && std::memcmp(stream + 36, "VBRI", 4) == 0 ? 36 : at;
+    if (vbriAt + 26 <= end && std::memcmp(stream + vbriAt, "VBRI", 4) == 0) {
+        frame->encoder_delay = ReadBigEndian(stream + vbriAt + 6, 2);
         frame->ofl_type = MP3_OFL_VBRI;
-        if (frame->frame_size <= streamSize) {
+        if (parseOfl == 1 && frame->frame_size <= streamSize) {
             AjmDecMp3ParseFrame next{};
-            if (ParseMp3Header(stream + frame->frame_size, streamSize - static_cast<std::uint32_t>(frame->frame_size), 1, &next) == 0 && next.ofl_type == MP3_OFL_FGH) {
+            if (ParseMp3Header(stream + frame->frame_size, streamSize - static_cast<std::uint32_t>(frame->frame_size), 2, &next) == 0 && next.ofl_type == MP3_OFL_FGH) {
                 frame->encoder_delay += next.encoder_delay;
                 frame->total_samples = next.total_samples;
                 frame->ofl_type = MP3_OFL_VBRI_AND_FGH;
             }
         }
-    } else if (at + 10 <= end) {
-        while (at + 9 < end && stream[at] != 0xB4u) ++at;
-        if (at + 9 >= end) return;
-        std::uint8_t crc = 0xFF;
-        for (std::size_t i = 0; i < 9; ++i) {
-            for (int shift = 7; shift >= 0; --shift) {
-                const bool same = ((crc >> 7u) & 1u) == ((stream[at + i] >> shift) & 1u);
-                crc = static_cast<std::uint8_t>(same ? (crc << 1u) ^ 0x45u : crc << 1u);
-            }
+        return;
+    }
+
+    while (at + 9 < end && stream[at] != 0xB4u) ++at;
+    if (at + 9 >= end) return;
+    std::uint8_t crc = 0xFF;
+    for (std::size_t i = 0; i < 9; ++i) {
+        for (int shift = 7; shift >= 0; --shift) {
+            const bool same = ((crc >> 7u) & 1u) == ((stream[at + i] >> shift) & 1u);
+            crc = static_cast<std::uint8_t>(same ? (crc << 1u) ^ 0x45u : crc << 1u);
         }
-        if (stream[at + 9] != crc) return;
+    }
+    if (stream[at + 9] == crc) {
         frame->encoder_delay = ReadBigEndian(stream + at + 1, 2);
         frame->total_samples = ReadBigEndian(stream + at + 3, 4);
         frame->ofl_type = MP3_OFL_FGH;
@@ -944,13 +959,13 @@ int ParseMp3Header(const std::uint8_t* stream, std::uint32_t streamSize, int par
     };
     const std::uint32_t header = (std::uint32_t{stream[0]} << 24u) | (std::uint32_t{stream[1]} << 16u) | (std::uint32_t{stream[2]} << 8u) | stream[3];
     const std::uint32_t version = (header >> 19u) & 3u;
+    const std::uint32_t layer = (header >> 17u) & 3u;
     const std::uint32_t sampleRate = sampleRates[version][(header >> 10u) & 3u];
     const std::uint32_t bitrate = kbps[version][(header >> 12u) & 15u] * 1000u;
-    const bool valid = (header >> 21u) == 0x7FFu && sampleRate != 0 && bitrate != 0;
+    const bool valid = (header >> 21u) == 0x7FFu && layer != 0 && sampleRate != 0 && bitrate != 0;
     AJM_TRACE("[ajm] parse mp3 frame %02x %02x %02x %02x (%u bytes, parse ofl %d) -> %s, %u Hz, %u bps\n", stream[0], stream[1], stream[2], stream[3], streamSize, parseOfl, valid ? "ok" : "invalid", sampleRate, bitrate);
     if (!valid) return SCE_AJM_ERROR_INVALID_PARAMETER;
-    if (parseOfl && ((header >> 17u) & 3u) != 1u) NotImplemented_nid_no_patch("sceAjmDecMp3ParseFrame (original file length lookup outside layer III)");
-    if (parseOfl && ((header >> 16u) & 1u) == 0) NotImplemented_nid_no_patch("sceAjmDecMp3ParseFrame (original file length lookup in a CRC-protected frame)");
+    if (parseOfl && layer != 1u) return SCE_AJM_ERROR_INVALID_PARAMETER;
     const bool mpeg1 = version == 3;
     frame->frame_size = (mpeg1 ? 144u : 72u) * bitrate / sampleRate + ((header >> 9u) & 1u);
     frame->num_channels = ((header >> 6u) & 3u) == 3u ? 1u : 2u;
@@ -961,7 +976,7 @@ int ParseMp3Header(const std::uint8_t* stream, std::uint32_t streamSize, int par
     frame->num_frames = 0;
     frame->total_samples = 0;
     frame->ofl_type = MP3_OFL_NONE;
-    if (parseOfl) ParseMp3Ofl(stream, streamSize, header, frame);
+    if (parseOfl) ParseMp3Ofl(stream, streamSize, header, frame, parseOfl);
     return 0;
 }
 
@@ -1122,7 +1137,6 @@ std::size_t OpusPacketSamples(const std::uint8_t* packet, std::size_t size) {
     return frames * frameSamples;
 }
 
-
 std::size_t OpusLength(const std::uint8_t* data, std::size_t size, std::size_t& at) {
     if (at >= size) return SIZE_MAX;
     const std::size_t first = data[at++];
diff --git a/core/libs/prx/libSceAjm/Export.cpp b/core/libs/prx/libSceAjm/Export.cpp
index 508f721ede..be23cfdc39 100644
--- a/core/libs/prx/libSceAjm/Export.cpp
+++ b/core/libs/prx/libSceAjm/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAjm/include/Api.hpp b/core/libs/prx/libSceAjm/include/Api.hpp
new file mode 100644
index 0000000000..1be3b9a23e
--- /dev/null
+++ b/core/libs/prx/libSceAjm/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAjmBatchJobControlBufferRa();
+int APS5_VABI sceAjmBatchJobRunSplitBufferRa();
+int APS5_VABI sceAjmBatchStartBuffer();
+
+}
diff --git a/core/libs/prx/libSceAjm/libSceAjm.hpp b/core/libs/prx/libSceAjm/libSceAjm.hpp
new file mode 100644
index 0000000000..302a86a22a
--- /dev/null
+++ b/core/libs/prx/libSceAjm/libSceAjm.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAjm/include/Api.hpp"
diff --git a/core/libs/prx/libSceAjmi/Export.cpp b/core/libs/prx/libSceAjmi/Export.cpp
index 83e8ac5ffa..3941ee53aa 100644
--- a/core/libs/prx/libSceAjmi/Export.cpp
+++ b/core/libs/prx/libSceAjmi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjmi/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAjmi/include/Api.hpp b/core/libs/prx/libSceAjmi/include/Api.hpp
new file mode 100644
index 0000000000..cf36eb1119
--- /dev/null
+++ b/core/libs/prx/libSceAjmi/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAjmBatchJobInlineBuffer(void);
+int APS5_VABI sceAjmBatchJobRunBufferRa(void);
+
+}
diff --git a/core/libs/prx/libSceAjmi/libSceAjmi.hpp b/core/libs/prx/libSceAjmi/libSceAjmi.hpp
new file mode 100644
index 0000000000..739e63957f
--- /dev/null
+++ b/core/libs/prx/libSceAjmi/libSceAjmi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAjmi/include/Api.hpp"
diff --git a/core/libs/prx/libSceAmpr/Export.cpp b/core/libs/prx/libSceAmpr/Export.cpp
index fe55109c4c..ab976c5ed3 100644
--- a/core/libs/prx/libSceAmpr/Export.cpp
+++ b/core/libs/prx/libSceAmpr/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <ctime>
@@ -226,22 +228,11 @@ static int RecordWriteAddressFromCounterPair(Apr::CommandBufferObject* buffer, v
 
 static std::atomic_flag sharedPtrSpinLock;
 
-struct AmmUsageStatsData {
-    std::uint64_t sizeInBytes;
-    std::uint16_t numPageTablePoolEntries;
-    std::uint16_t allocatedPageTablePoolEntries;
-    std::uint16_t highWatermarkAllocatedEntries;
-    std::uint16_t reserved;
-    std::uint32_t ringIdleFlags;
-};
 static_assert(sizeof(AmmUsageStatsData) == 0x18);
 static constexpr std::uint16_t AmmPageTablePoolEntries = 512;
 static constexpr std::uint32_t AmmRingIdleFlags = 0x7;
 
 extern "C" {
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-int APS5_VABI wcstombs_s_nid_postfix(std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit);
-[[noreturn]] void APS5_VABI __cxa_call_terminate_nid_postfix(void* exception);
 
 int APS5_VABI sceAmprCommandBufferWriteAddressOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t value) {
     if (!ValidWriteAddress(address)) return SCE_KERNEL_ERROR_EINVAL;
@@ -624,11 +615,6 @@ std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueue_04_00(std
     return sizeof(Apr::WriteKernelEventQueueCommand);
 }
 
-struct AmmSubmitResult {
-    std::int32_t result;
-    std::uint32_t errorOffset;
-};
-
 int APS5_VABI sceAmprAmmCommandBufferConstructor(Apr::CommandBufferObject* buffer) {
     (void)buffer;
     return 0;
@@ -845,11 +831,6 @@ int APS5_VABI sceAmprAmmWaitCommandBufferCompletion(std::uint32_t id) {
     return AmmSubmitted_nid_no_patch(id) ? 0 : SCE_KERNEL_ERROR_ESRCH;
 }
 
-int APS5_VABI _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 void APS5_VABI _Unlock_shared_ptr_spin_lock_nid_postfix(void) {
     sharedPtrSpinLock.clear(std::memory_order_release);
 }
@@ -858,21 +839,11 @@ int APS5_VABI _Cnd_init_with_name_nid_postfix(void** handle, const char*) {
     return _Cnd_init_nid_postfix(handle);
 }
 
-int APS5_VABI _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI _ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE3getES3_S3_RSt8ios_baseRNSt5_IosbIiE8_IostateEP2tmPKcSE__nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -882,8 +853,8 @@ void APS5_VABI _Lock_shared_ptr_spin_lock_nid_postfix(void) {
     while (sharedPtrSpinLock.test_and_set(std::memory_order_acquire)) std::this_thread::yield();
 }
 
-
 [[noreturn]] void APS5_VABI __cxa_call_unexpected_nid_postfix(void* unwindException) {
+
     __cxa_call_terminate_nid_postfix(unwindException);
 }
 
diff --git a/core/libs/prx/libSceAmpr/include/Api.hpp b/core/libs/prx/libSceAmpr/include/Api.hpp
new file mode 100644
index 0000000000..8939494652
--- /dev/null
+++ b/core/libs/prx/libSceAmpr/include/Api.hpp
@@ -0,0 +1,159 @@
+#pragma once
+
+#include "prx/libkernel/Apr/include/AprCommandBuffer.hpp"
+#include "prx/libc/include/GuestTime.hpp"
+#include "SceTypes.hpp"
+
+struct AmmSubmitResult {
+    std::int32_t result;
+    std::uint32_t errorOffset;
+};
+
+struct AmmUsageStatsData {
+    std::uint64_t sizeInBytes;
+    std::uint16_t numPageTablePoolEntries;
+    std::uint16_t allocatedPageTablePoolEntries;
+    std::uint16_t highWatermarkAllocatedEntries;
+    std::uint16_t reserved;
+    std::uint32_t ringIdleFlags;
+};
+
+extern "C" {
+
+int APS5_VABI sceAmprCommandBufferWriteAddressOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t value);
+int APS5_VABI sceAmprCommandBufferWriteCounterOnCompletion(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint32_t value);
+int APS5_VABI sceAmprCommandBufferWaitOnAddress(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t reference, std::uint8_t compare, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWaitOnCounter(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint32_t reference, std::uint8_t compare, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWriteKernelEventQueueOnCompletion(Apr::CommandBufferObject* buffer, std::uint64_t equeue, std::int32_t ident, std::uint64_t data);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounterOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPairOnCompletion(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressOnCompletion();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounterOnCompletion();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnAddress();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnCounter();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueueOnCompletion();
+int APS5_VABI sceAmprAprCommandBufferConstructor(Apr::CommandBufferObject* buffer, uint64_t* gatherState, uint64_t* scatterState);
+int APS5_VABI sceAmprAprCommandBufferDestructor(Apr::CommandBufferObject* buffer, uint64_t* gatherState, uint64_t* scatterState);
+int APS5_VABI sceAmprAprCommandBufferMapBegin(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAprCommandBufferMapDirectBegin(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAprCommandBufferMapEnd(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprAprCommandBufferReadFile(Apr::CommandBufferObject* buffer, uint64_t* gatherState, uint64_t* scatterState, uint32_t fileId, void* destination, uint64_t size, uint64_t offset);
+int APS5_VABI sceAmprAprCommandBufferReadFileGather(Apr::CommandBufferObject* buffer, std::uint64_t* mapState, std::uint64_t* scatterGatherState, std::uint64_t size, std::uint64_t offset);
+int APS5_VABI sceAmprAprCommandBufferReadFileGatherScatter(Apr::CommandBufferObject* buffer, std::uint64_t* mapState, std::uint64_t* scatterGatherState, void* destination, std::uint64_t size, std::uint64_t offset);
+int APS5_VABI sceAmprAprCommandBufferReadFileScatter(Apr::CommandBufferObject* buffer, std::uint64_t* mapState, std::uint64_t* scatterGatherState, void* destination, std::uint64_t size);
+int APS5_VABI sceAmprAprCommandBufferResetGatherScatterState(Apr::CommandBufferObject* buffer);
+void* APS5_VABI sceAmprCommandBufferClearBuffer(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferConstructMarker(Apr::CommandBufferObject* buffer, std::uint32_t type, const char* text, const std::uint32_t* color);
+int APS5_VABI sceAmprCommandBufferConstructNop(Apr::CommandBufferObject* buffer, std::int16_t type, const void* payload, std::uint32_t payloadBytes, const std::uint32_t* word);
+int APS5_VABI sceAmprCommandBufferConstructor(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferDestructor(Apr::CommandBufferObject* buffer);
+void* APS5_VABI sceAmprCommandBufferGetBufferBaseAddress(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetCurrentOffset(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetNumCommands(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetSize(const Apr::CommandBufferObject* buffer);
+uint32_t APS5_VABI sceAmprCommandBufferGetType(const Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferNop(Apr::CommandBufferObject* buffer, std::uint32_t dwords);
+int APS5_VABI sceAmprCommandBufferNopWithData(Apr::CommandBufferObject* buffer, std::uint32_t dwords, const std::uint32_t* data);
+int APS5_VABI sceAmprCommandBufferPopMarker(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferPushMarker(Apr::CommandBufferObject* buffer, const char* text);
+int APS5_VABI sceAmprCommandBufferPushMarkerWithColor(Apr::CommandBufferObject* buffer, const char* text, std::uint32_t color);
+int APS5_VABI sceAmprCommandBufferReset(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprCommandBufferSetBuffer(Apr::CommandBufferObject* buffer, void* memory, uint32_t size);
+int APS5_VABI sceAmprCommandBufferSetMarker(Apr::CommandBufferObject* buffer, const char* text);
+int APS5_VABI sceAmprCommandBufferSetMarkerWithColor(Apr::CommandBufferObject* buffer, const char* text, const std::uint32_t* color);
+int APS5_VABI sceAmprCommandBufferWaitOnAddress_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t reference, std::uint8_t compare, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWaitOnCounter_04_00(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint8_t access, std::uint64_t reference, std::uint8_t compare, std::uint8_t maskOperation, std::uint64_t mask, std::uint8_t flush);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPair_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter, std::uint64_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromCounter_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint8_t counter, std::uint64_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounter_04_00(Apr::CommandBufferObject* buffer, volatile std::uint64_t* address, std::uint64_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteAddress_04_00(Apr::CommandBufferObject* buffer, uint64_t* address, uint64_t value, uint32_t flags);
+int APS5_VABI sceAmprCommandBufferWriteCounter_04_00(Apr::CommandBufferObject* buffer, std::uint8_t counter, std::uint8_t access, std::uint64_t value, std::uint8_t operation, std::uint8_t atStart);
+int APS5_VABI sceAmprCommandBufferWriteKernelEventQueue_04_00(Apr::CommandBufferObject* buffer, std::uint64_t equeue, std::int32_t ident, std::uint64_t data, std::uint64_t atStart);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapBegin(std::uint64_t address, std::uint64_t size, std::uint32_t type, std::uint32_t protection);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapDirectBegin(std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::uint32_t type, std::uint32_t protection);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapEnd();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNop(std::uint32_t dwords);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNopWithData(std::uint32_t dwords);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizePopMarker();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarker(const char* text);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarkerWithColor(const char* text, std::uint32_t color);
+uint32_t APS5_VABI sceAmprMeasureCommandSizeReadFile(void);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGather(std::uint64_t size, std::uint64_t offset);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGatherScatter(void* destination, std::uint64_t size, std::uint64_t offset);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileScatter(void* destination, std::uint64_t size);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeResetGatherScatterState();
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarker(const char* text);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarkerWithColor(const char* text, std::uint32_t color);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnAddress_04_00(volatile std::uint64_t* address, std::uint64_t, std::uint8_t compare, std::uint8_t flush);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnCounter_04_00(std::uint8_t, std::uint8_t access, std::uint64_t, std::uint8_t compare, std::uint8_t maskOperation, std::uint64_t, std::uint8_t flush);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounterPair_04_00(volatile std::uint64_t* address, std::uint8_t counter);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounter_04_00(volatile std::uint64_t* address, std::uint8_t counter);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromTimeCounter_04_00(volatile std::uint64_t* address);
+uint32_t APS5_VABI sceAmprMeasureCommandSizeWriteAddress_04_00(void);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounter_04_00(std::uint8_t counter, std::uint8_t access, std::uint64_t, std::uint8_t operation);
+std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteKernelEventQueue_04_00(std::uint64_t, std::int32_t, std::uint64_t);
+int APS5_VABI sceAmprAmmCommandBufferConstructor(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprAmmCommandBufferDestructor(Apr::CommandBufferObject* buffer);
+int APS5_VABI sceAmprAmmCommandBufferMap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferMapWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferMapDirect(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferMapDirectWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferUnmap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMap(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapWithGpuMaskId(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirect(std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirectWithGpuMaskId(std::uint64_t address, std::uint64_t directOffset, std::uint64_t size, std::int32_t type, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeUnmap(std::uint64_t address, std::uint64_t size);
+int APS5_VABI sceAmprAmmCommandBufferRemap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferRemapWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferMultiMap(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferMultiMapWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferModifyProtect(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask);
+int APS5_VABI sceAmprAmmCommandBufferModifyProtectWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtect(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask);
+int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtectWithGpuMaskId(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemap(std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemapWithGpuMaskId(std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMap(std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMapWithGpuMaskId(std::uint64_t address, std::uint64_t alias, std::uint64_t size, std::int32_t protection, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtect(std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtectWithGpuMaskId(std::uint64_t address, std::uint64_t size, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtect(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtectWithGpuMaskId(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection, std::int32_t mask, std::uint8_t gpuMaskId);
+int APS5_VABI sceAmprAmmCommandBufferMapAsPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size);
+int APS5_VABI sceAmprAmmCommandBufferAllocatePaForPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmCommandBufferRemapIntoPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t source, std::uint64_t size, std::int32_t protection, std::uint32_t opcode);
+int APS5_VABI sceAmprAmmCommandBufferUnmapToPrt(Apr::CommandBufferObject* buffer, std::uint64_t address, std::uint64_t size);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapAsPrt(std::uint64_t address, std::uint64_t size);
+std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeAllocatePaForPrt(std::uint64_t address, std::uint64_t size, std::int32_t type, std::int32_t protection);
+int APS5_VABI sceAmprAmmGiveDirectMemory(std::int64_t searchStart, std::int64_t searchEnd, std::size_t size, std::size_t alignment, int usage, std::int64_t* offset);
+int APS5_VABI sceAmprAmmGetVirtualAddressRanges(std::uint64_t* start, std::uint64_t* end, std::uint64_t* multimapStart, std::uint64_t* multimapEnd);
+int APS5_VABI sceAmprAmmSetPageTablePoolOccupancyNotificationThreshold(void);
+int APS5_VABI sceAmprAmmSubmitCommandBuffer(void* base, std::uint32_t offset, std::uint32_t priority);
+int APS5_VABI sceAmprAmmSubmitCommandBuffer2(void* base, std::uint32_t offset, std::uint32_t priority, AmmSubmitResult* result, std::uint32_t* id);
+int APS5_VABI sceAmprAmmSubmitCommandBuffer3(void* base, std::uint32_t offset, std::uint32_t priority, std::uint32_t* id);
+int APS5_VABI sceAmprAmmWaitCommandBufferCompletion(std::uint32_t id);
+void APS5_VABI _Unlock_shared_ptr_spin_lock_nid_postfix(void);
+int APS5_VABI _Cnd_init_with_name_nid_postfix(void** handle, const char*);
+int APS5_VABI _ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE3getES3_S3_RSt8ios_baseRNSt5_IosbIiE8_IostateEP2tmPKcSE__nid_postfix(void);
+int APS5_VABI _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(void);
+void APS5_VABI _Lock_shared_ptr_spin_lock_nid_postfix(void);
+SonyLconv* APS5_VABI sceAmprLocaleconv(void);
+unsigned __int128 APS5_VABI sceAmprUdivti3(unsigned __int128 dividend, unsigned __int128 divisor);
+double APS5_VABI sceAmprSinh(double x, double y);
+char* APS5_VABI sceAmprStrtokS(char* str, const char* delim, char** context);
+int APS5_VABI sceAmprCtimeS(char* buffer, std::size_t size, const std::int64_t* time);
+int APS5_VABI sceAmprWcscpyS(std::uint16_t* dest, std::size_t size, const std::uint16_t* src);
+void* APS5_VABI sceAmprSetConstraintHandlerS(void* handler);
+int APS5_VABI sceAmprFltrounds(void);
+void APS5_VABI sceAmprIgnoreHandlerS(const char* message, void* pointer, int error);
+int APS5_VABI sceAmprWcstombsS(std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit);
+std::size_t APS5_VABI sceAmprMbstowcs(std::uint16_t* dest, const char* src, std::size_t size);
+int APS5_VABI sceAmprAsctimeS(char* buffer, std::size_t size, const GuestTm* time);
+int APS5_VABI sceAmprFpclassifyd(double value);
+int APS5_VABI sceAmprAmmGetUsageStatsData(AmmUsageStatsData* stats);
+
+[[noreturn]] void APS5_VABI __cxa_call_unexpected_nid_postfix(void* unwindException);
+
+}
diff --git a/core/libs/prx/libSceAmpr/libSceAmpr.hpp b/core/libs/prx/libSceAmpr/libSceAmpr.hpp
new file mode 100644
index 0000000000..de5e0e7862
--- /dev/null
+++ b/core/libs/prx/libSceAmpr/libSceAmpr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAmpr/include/Api.hpp"
diff --git a/core/libs/prx/libSceAppChecker/Export.cpp b/core/libs/prx/libSceAppChecker/Export.cpp
index b50753644e..1ed8f0345d 100644
--- a/core/libs/prx/libSceAppChecker/Export.cpp
+++ b/core/libs/prx/libSceAppChecker/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAppChecker/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAppChecker/include/Api.hpp b/core/libs/prx/libSceAppChecker/include/Api.hpp
new file mode 100644
index 0000000000..9c850dbc67
--- /dev/null
+++ b/core/libs/prx/libSceAppChecker/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAppCheckerAbort();
+int APS5_VABI sceAppCheckerExecute();
+int APS5_VABI sceAppCheckerExecuteEx();
+
+}
diff --git a/core/libs/prx/libSceAppChecker/libSceAppChecker.hpp b/core/libs/prx/libSceAppChecker/libSceAppChecker.hpp
new file mode 100644
index 0000000000..471d19be34
--- /dev/null
+++ b/core/libs/prx/libSceAppChecker/libSceAppChecker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAppChecker/include/Api.hpp"
diff --git a/core/libs/prx/libSceAppContent/Export.cpp b/core/libs/prx/libSceAppContent/Export.cpp
index 8bfb24b850..e5c956f2ee 100644
--- a/core/libs/prx/libSceAppContent/Export.cpp
+++ b/core/libs/prx/libSceAppContent/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAppContent/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -26,11 +27,6 @@ static constexpr char TEMPORARY_MOUNT_POINT[] = "/temp0";
 static constexpr char DOWNLOAD_MOUNT_POINT[] = "/download0";
 static constexpr uint32_t TEMPORARY_DATA_OPTION_FORMAT = 1;
 
-struct AppContentAddcontInfo {
-    NpUnifiedEntitlementLabel entitlement_label;
-    uint32_t status;
-};
-
 namespace {
 
 std::atomic_bool initialized{false};
@@ -209,7 +205,6 @@ int APS5_VABI sceAppContentTemporaryDataUnmount(const AppContentMountPoint* moun
     return 0;
 }
 
-
 int APS5_VABI sceAppContentAddcontEnqueueDownload(uint32_t service_label, const NpUnifiedEntitlementLabel* entitlement_label) {
     if (!initialized.load()) return SCE_APP_CONTENT_ERROR_NOT_INITIALIZED;
     (void)service_label;
@@ -313,9 +308,8 @@ int APS5_VABI sceAppContentRequestPatchInstall(void) {
     return 0;
 }
 
-int APS5_VABI sceAppContentTemporaryDataMount(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAppContentTemporaryDataMount(AppContentMountPoint* mountPoint) {
+    return sceAppContentTemporaryDataMount2(TEMPORARY_DATA_OPTION_FORMAT, mountPoint);
 }
 
 }
diff --git a/core/libs/prx/libSceAppContent/include/Api.hpp b/core/libs/prx/libSceAppContent/include/Api.hpp
new file mode 100644
index 0000000000..938424fd88
--- /dev/null
+++ b/core/libs/prx/libSceAppContent/include/Api.hpp
@@ -0,0 +1,45 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct AppContentAddcontInfo {
+    NpUnifiedEntitlementLabel entitlement_label;
+    uint32_t status;
+};
+
+extern "C" {
+
+int APS5_VABI sceAppContentAddcontMount(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentAddcontUnmount(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentGetAddcontInfo(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, AppContentAddcontInfo* info);
+int APS5_VABI sceAppContentGetAddcontInfoList(uint32_t serviceLabel, AppContentAddcontInfo* list, uint32_t listNum, uint32_t* hitNum);
+int APS5_VABI sceAppContentAppParamGetInt(uint32_t paramId, int32_t* value);
+int APS5_VABI sceAppContentDownloadDataFormat(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentDownloadDataGetAvailableSpaceKb(const AppContentMountPoint* mountPoint, size_t* availableSpaceKb);
+int APS5_VABI sceAppContentInitialize(const AppContentInitParam* initParam, AppContentBootParam* bootParam);
+int APS5_VABI sceAppContentTemporaryDataFormat(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentTemporaryDataGetAvailableSpaceKb(const AppContentMountPoint* mountPoint, size_t* availableSpaceKb);
+int APS5_VABI sceAppContentTemporaryDataMount2(uint32_t option, AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentTemporaryDataUnmount(const AppContentMountPoint* mountPoint);
+int APS5_VABI sceAppContentAddcontEnqueueDownload(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel);
+int APS5_VABI sceAppContentAddcontDelete(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel);
+int APS5_VABI sceAppContentGetAddcontDownloadProgress(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, void* progress);
+int APS5_VABI sceAppContentAddcontEnqueueDownloadByEntitlemetId(void);
+int APS5_VABI sceAppContentAddcontEnqueueDownloadSp(void);
+int APS5_VABI sceAppContentAddcontMountByEntitlemetId(void);
+int APS5_VABI sceAppContentAddcontShrink(void);
+int APS5_VABI sceAppContentAppParamGetString(void);
+int APS5_VABI sceAppContentDownload0Expand(void);
+int APS5_VABI sceAppContentDownload0Shrink(void);
+int APS5_VABI sceAppContentDownload1Expand(void);
+int APS5_VABI sceAppContentDownload1Shrink(void);
+int APS5_VABI sceAppContentGetAddcontInfoByEntitlementId(void);
+int APS5_VABI sceAppContentGetAddcontInfoListByIroTag(void);
+int APS5_VABI sceAppContentGetDownloadedStoreCountry(void);
+int APS5_VABI sceAppContentGetEntitlementKey(void);
+int APS5_VABI sceAppContentGetPftFlag(void);
+int APS5_VABI sceAppContentGetRegion(void);
+int APS5_VABI sceAppContentRequestPatchInstall(void);
+int APS5_VABI sceAppContentTemporaryDataMount(AppContentMountPoint* mountPoint);
+
+}
diff --git a/core/libs/prx/libSceAppContent/libSceAppContent.hpp b/core/libs/prx/libSceAppContent/libSceAppContent.hpp
new file mode 100644
index 0000000000..d92b11cf65
--- /dev/null
+++ b/core/libs/prx/libSceAppContent/libSceAppContent.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAppContent/include/Api.hpp"
diff --git a/core/libs/prx/libSceAppDbShellCoreClient/libSceAppDbShellCoreClient.hpp b/core/libs/prx/libSceAppDbShellCoreClient/libSceAppDbShellCoreClient.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAppDbShellCoreClient/libSceAppDbShellCoreClient.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAppDbShellCoreClientForSystemService/libSceAppDbShellCoreClientForSystemService.hpp b/core/libs/prx/libSceAppDbShellCoreClientForSystemService/libSceAppDbShellCoreClientForSystemService.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAppDbShellCoreClientForSystemService/libSceAppDbShellCoreClientForSystemService.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAppInstUtil/Export.cpp b/core/libs/prx/libSceAppInstUtil/Export.cpp
index 5925f41ddd..51721067a8 100644
--- a/core/libs/prx/libSceAppInstUtil/Export.cpp
+++ b/core/libs/prx/libSceAppInstUtil/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceAppInstUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct AppInstallProgressInfo;
-
 extern "C" {
 
 int APS5_VABI sceAppInstUtilInitialize(void) {
@@ -84,4 +83,494 @@ int APS5_VABI sceAppInstUtilGetPrimaryAppSlot(const char* titleId, void* slot) {
     return 0;
 }
 
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatusByAppInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstall2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontListTotalSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontInfoByContentId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddcontInstalledStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUpdateStartTime(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLink(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLinkByUser(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAddcontNum(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelUnInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppDestroyMetadata(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCheckAppSystemVer(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppConvertAppDownloadToDisc(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetMainAppTitleIdForSP(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetSubAppTitleIdForSP(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetMainAppTitleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetSubAppTitleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppDestroyPkg(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilJson(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInsertedDiscRoleType(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRequestInstallDiscGame(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRequestDataDiscCopy(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelDataDiscCopy(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetDataDiscCopyProgress(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilSetPrimaryAppSlot(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAppSlotInfoList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAppEmptySlot(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallGetLinkState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppUnInstallForMultiInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallPs4CloudGame(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppStoreCompilationDiscInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetCompilationDiscInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetStoreCompilationDiscInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleIdList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallRequestCompilationDiscApp(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetNoRelatedAddcontTitleList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetIrremovableAppList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppRequestMoveApps(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppProhibitDownloadInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppAllowDownloadInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAppMoveProgressInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelMoveApps(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetMoveErrorAppList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAllAppSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelGetAllAppSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscMasterDataId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetAppOtherSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppCancelGetAppOtherSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInsertedDiscTotal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppSetRemasterInstallType(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInstallProgressInfoForMultiDisc(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilMountBdEmu(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilUnmountBdEmu(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInstallStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilResumeInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilPauseInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRegisterDownload(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilStartInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstallPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetPatchInstallStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilResumePatchInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilPausePatchInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelInstallPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelInstallAddcont(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelForMultiInstall(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstallByPackage(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilIsRestoreState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetRestoreState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddons(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetInstallOptions(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetContentSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelGetInformation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetWorkspaceStatus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilDeleteWorkspace(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetParentalControlLevel(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCheckLatestPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilCancelCheckPatch(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallPsNowIcon(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddcontInfoList2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAddcontInfoList3(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilClearAddcontInfoCache(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetContentSize2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppInstallContentPush(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetAvailableStorage(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilSwitchInstallLocation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetConfigList(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilSwitchConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilRestoreDataSource(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilGetNeededStorageSize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilAppGetStorageDestType(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAppInstUtilInstallAddons(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceAppInstUtil/include/Api.hpp b/core/libs/prx/libSceAppInstUtil/include/Api.hpp
new file mode 100644
index 0000000000..eeb9b40a31
--- /dev/null
+++ b/core/libs/prx/libSceAppInstUtil/include/Api.hpp
@@ -0,0 +1,128 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct AppInstallProgressInfo;
+
+extern "C" {
+
+int APS5_VABI sceAppInstUtilInitialize(void);
+int APS5_VABI sceAppInstUtilTerminate(void);
+int APS5_VABI sceAppInstUtilAppInstallAll(void* reserved);
+int APS5_VABI sceAppInstUtilAppInstallTitleDir(const char* titleId, const char* titleDir, void* reserved);
+int APS5_VABI sceAppInstUtilAppIsInInstalling(int32_t* installing);
+int APS5_VABI sceAppInstUtilAppIsInUpdating(const char* titleId, bool* updating);
+int APS5_VABI sceAppInstUtilAppExists(const char* titleId, int32_t* exists);
+int APS5_VABI sceAppInstUtilAppGetSize(const char* titleId, std::uint64_t* size);
+int APS5_VABI sceAppInstUtilAppInstallPkg(const char* packagePath, std::uint64_t serviceArgument);
+int APS5_VABI sceAppInstUtilAppPrepareOverwritePkg();
+int APS5_VABI sceAppInstUtilAppRecoverApp();
+int APS5_VABI sceAppInstUtilAppUnInstall(const char* titleId);
+int APS5_VABI sceAppInstUtilAppUnInstallAddcont(const char* titleId, const char* contentLabel);
+int APS5_VABI sceAppInstUtilAppUnInstallPat(const char* titleId);
+int APS5_VABI sceAppInstUtilAppUnInstallTheme();
+int APS5_VABI sceAppInstUtilAppUnInstallTypes(const char* titleId, std::uint32_t types);
+int APS5_VABI sceAppInstUtilGetInstallProgressInfo(const char* titleId, AppInstallProgressInfo* info);
+int APS5_VABI sceAppInstUtilGetInstallProgress(const char* titleId, void* progress);
+int APS5_VABI sceAppInstUtilGetPrimaryAppSlot(const char* titleId, void* slot);
+
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatusByAppInfo(void);
+int APS5_VABI sceAppInstUtilAppUnInstall2(void);
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote(void);
+int APS5_VABI sceAppInstUtilAppUnInstallForRemote2(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontListTotalSize(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontInfo(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontInfoByContentId(void);
+int APS5_VABI sceAppInstUtilGetAddcontInstalledStatus(void);
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleId(void);
+int APS5_VABI sceAppInstUtilAppUpdateStartTime(void);
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLink(void);
+int APS5_VABI sceAppInstUtilAppInstallSharePlayLinkByUser(void);
+int APS5_VABI sceAppInstUtilAppGetAddcontNum(void);
+int APS5_VABI sceAppInstUtilAppCancelUnInstall(void);
+int APS5_VABI sceAppInstUtilAppDestroyMetadata(void);
+int APS5_VABI sceAppInstUtilCheckAppSystemVer(void);
+int APS5_VABI sceAppInstUtilAppConvertAppDownloadToDisc(void);
+int APS5_VABI sceAppInstUtilGetMainAppTitleIdForSP(void);
+int APS5_VABI sceAppInstUtilGetSubAppTitleIdForSP(void);
+int APS5_VABI sceAppInstUtilGetMainAppTitleId(void);
+int APS5_VABI sceAppInstUtilGetSubAppTitleId(void);
+int APS5_VABI sceAppInstUtilAppGetAppInstallStatus(void);
+int APS5_VABI sceAppInstUtilAppDestroyPkg(void);
+int APS5_VABI sceAppInstUtilJson(void);
+int APS5_VABI sceAppInstUtilGetInsertedDiscRoleType(void);
+int APS5_VABI sceAppInstUtilRequestInstallDiscGame(void);
+int APS5_VABI sceAppInstUtilRequestDataDiscCopy(void);
+int APS5_VABI sceAppInstUtilCancelDataDiscCopy(void);
+int APS5_VABI sceAppInstUtilGetDataDiscCopyProgress(void);
+int APS5_VABI sceAppInstUtilSetPrimaryAppSlot(void);
+int APS5_VABI sceAppInstUtilGetAppSlotInfoList(void);
+int APS5_VABI sceAppInstUtilGetAppEmptySlot(void);
+int APS5_VABI sceAppInstUtilAppInstallGetLinkState(void);
+int APS5_VABI sceAppInstUtilAppUnInstallForMultiInstall(void);
+int APS5_VABI sceAppInstUtilAppInstallPs4CloudGame(void);
+int APS5_VABI sceAppInstUtilAppStoreCompilationDiscInfo(void);
+int APS5_VABI sceAppInstUtilAppGetCompilationDiscInfo(void);
+int APS5_VABI sceAppInstUtilAppGetStoreCompilationDiscInfo(void);
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscTitleIdList(void);
+int APS5_VABI sceAppInstUtilAppInstallRequestCompilationDiscApp(void);
+int APS5_VABI sceAppInstUtilAppGetNoRelatedAddcontTitleList(void);
+int APS5_VABI sceAppInstUtilAppGetIrremovableAppList(void);
+int APS5_VABI sceAppInstUtilAppRequestMoveApps(void);
+int APS5_VABI sceAppInstUtilAppProhibitDownloadInstall(void);
+int APS5_VABI sceAppInstUtilAppAllowDownloadInstall(void);
+int APS5_VABI sceAppInstUtilGetAppMoveProgressInfo(void);
+int APS5_VABI sceAppInstUtilAppCancelMoveApps(void);
+int APS5_VABI sceAppInstUtilAppGetMoveErrorAppList(void);
+int APS5_VABI sceAppInstUtilAppGetAllAppSize(void);
+int APS5_VABI sceAppInstUtilAppCancelGetAllAppSize(void);
+int APS5_VABI sceAppInstUtilAppGetInsertedDiscMasterDataId(void);
+int APS5_VABI sceAppInstUtilAppGetAppOtherSize(void);
+int APS5_VABI sceAppInstUtilAppCancelGetAppOtherSize(void);
+int APS5_VABI sceAppInstUtilGetInsertedDiscTotal(void);
+int APS5_VABI sceAppInstUtilAppSetRemasterInstallType(void);
+int APS5_VABI sceAppInstUtilGetInstallProgressInfoForMultiDisc(void);
+int APS5_VABI sceAppInstUtilMountBdEmu(void);
+int APS5_VABI sceAppInstUtilUnmountBdEmu(void);
+int APS5_VABI sceAppInstUtilGetInstallStatus(void);
+int APS5_VABI sceAppInstUtilResumeInstall(void);
+int APS5_VABI sceAppInstUtilPauseInstall(void);
+int APS5_VABI sceAppInstUtilRegisterDownload(void);
+int APS5_VABI sceAppInstUtilInstall(void);
+int APS5_VABI sceAppInstUtilStartInstall(void);
+int APS5_VABI sceAppInstUtilInstallPatch(void);
+int APS5_VABI sceAppInstUtilGetPatchInstallStatus(void);
+int APS5_VABI sceAppInstUtilResumePatchInstall(void);
+int APS5_VABI sceAppInstUtilPausePatchInstall(void);
+int APS5_VABI sceAppInstUtilCancelInstallPatch(void);
+int APS5_VABI sceAppInstUtilCancelInstallAddcont(void);
+int APS5_VABI sceAppInstUtilCancelInstall(void);
+int APS5_VABI sceAppInstUtilCancelForMultiInstall(void);
+int APS5_VABI sceAppInstUtilInstallByPackage(void);
+int APS5_VABI sceAppInstUtilIsRestoreState(void);
+int APS5_VABI sceAppInstUtilGetRestoreState(void);
+int APS5_VABI sceAppInstUtilGetAddons(void);
+int APS5_VABI sceAppInstUtilGetInstallOptions(void);
+int APS5_VABI sceAppInstUtilGetContentSize(void);
+int APS5_VABI sceAppInstUtilCancelGetInformation(void);
+int APS5_VABI sceAppInstUtilGetWorkspaceStatus(void);
+int APS5_VABI sceAppInstUtilDeleteWorkspace(void);
+int APS5_VABI sceAppInstUtilGetParentalControlLevel(void);
+int APS5_VABI sceAppInstUtilCheckLatestPatch(void);
+int APS5_VABI sceAppInstUtilCancelCheckPatch(void);
+int APS5_VABI sceAppInstUtilAppInstallPsNowIcon(void);
+int APS5_VABI sceAppInstUtilGetAddcontInfoList2(void);
+int APS5_VABI sceAppInstUtilGetAddcontInfoList3(void);
+int APS5_VABI sceAppInstUtilClearAddcontInfoCache(void);
+int APS5_VABI sceAppInstUtilGetContentSize2(void);
+int APS5_VABI sceAppInstUtilAppInstallContentPush(void);
+int APS5_VABI sceAppInstUtilGetAvailableStorage(void);
+int APS5_VABI sceAppInstUtilSwitchInstallLocation(void);
+int APS5_VABI sceAppInstUtilGetConfigList(void);
+int APS5_VABI sceAppInstUtilSwitchConfig(void);
+int APS5_VABI sceAppInstUtilRestoreDataSource(void);
+int APS5_VABI sceAppInstUtilGetNeededStorageSize(void);
+int APS5_VABI sceAppInstUtilAppGetStorageDestType(void);
+int APS5_VABI sceAppInstUtilInstallAddons(void);
+
+}
diff --git a/core/libs/prx/libSceAppInstUtil/libSceAppInstUtil.hpp b/core/libs/prx/libSceAppInstUtil/libSceAppInstUtil.hpp
new file mode 100644
index 0000000000..8d20c5a6f2
--- /dev/null
+++ b/core/libs/prx/libSceAppInstUtil/libSceAppInstUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAppInstUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceAsyncStorageInternal/libSceAsyncStorageInternal.hpp b/core/libs/prx/libSceAsyncStorageInternal/libSceAsyncStorageInternal.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAsyncStorageInternal/libSceAsyncStorageInternal.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAt9Enc/Export.cpp b/core/libs/prx/libSceAt9Enc/Export.cpp
index 77fee077ec..09b53ddbc8 100644
--- a/core/libs/prx/libSceAt9Enc/Export.cpp
+++ b/core/libs/prx/libSceAt9Enc/Export.cpp
@@ -1,9 +1,9 @@
+#include "prx/libSceAt9Enc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-
 extern "C" {
 
 int32_t APS5_VABI sceAt9EncClearContext(void *pAt9EncWorkArea, int32_t *pInternalResult) {
diff --git a/core/libs/prx/libSceAt9Enc/include/Api.hpp b/core/libs/prx/libSceAt9Enc/include/Api.hpp
new file mode 100644
index 0000000000..e060d77e4b
--- /dev/null
+++ b/core/libs/prx/libSceAt9Enc/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceAt9EncClearContext(void *pAt9EncWorkArea, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncCreateEncoder(void *pAt9EncWorkArea, void *pAt9EncParam, int32_t memSize, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncEncode(void *pAt9EncWorkArea, const void *pInputBuf, void *pOutputBuf, uint32_t inputBufSize, uint32_t outputBufSize, uint32_t *pOutputDataByte, uint32_t *pUsedBufSize, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncFlush(void *pAt9EncWorkArea, void *pOutputBuf, uint32_t outputBufSize, uint32_t *pOutputDataByte, int32_t *pInternalResult);
+int32_t APS5_VABI sceAt9EncQueryMemSize(void *pAt9EncParam, int32_t *pMemSize, int32_t *pInternalResult);
+
+}
diff --git a/core/libs/prx/libSceAt9Enc/libSceAt9Enc.hpp b/core/libs/prx/libSceAt9Enc/libSceAt9Enc.hpp
new file mode 100644
index 0000000000..c0960da642
--- /dev/null
+++ b/core/libs/prx/libSceAt9Enc/libSceAt9Enc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAt9Enc/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudio/libSceAudio.hpp b/core/libs/prx/libSceAudio/libSceAudio.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudio/libSceAudio.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudio3d/CMakeLists.txt b/core/libs/prx/libSceAudio3d/CMakeLists.txt
index 791d2fac7e..2d4e024734 100644
--- a/core/libs/prx/libSceAudio3d/CMakeLists.txt
+++ b/core/libs/prx/libSceAudio3d/CMakeLists.txt
@@ -22,6 +22,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_audio3d_port PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudio3d>")
     endif()
+    add_test_executable(guest_audio3d_speaker_array_tests ${LIBS_INCLUDE_DIR}/tests/GuestAudio3dSpeakerArray.cpp)
+    target_include_directories(guest_audio3d_speaker_array_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_audio3d_speaker_array_tests PRIVATE libSceAudio3d libSceAudioOut libc)
+    configure_windows_unwind(guest_audio3d_speaker_array_tests)
+    add_test(NAME guest_audio3d_speaker_array COMMAND guest_audio3d_speaker_array_tests)
+    if(WIN32)
+        set_tests_properties(guest_audio3d_speaker_array PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudio3d>")
+    endif()
     add_test_executable(guest_audio3d_mixer_tests ${LIBS_INCLUDE_DIR}/tests/GuestAudio3dMixer.cpp)
     target_include_directories(guest_audio3d_mixer_tests PRIVATE
         ${LIBS_INCLUDE_DIR} ${CMAKE_CURRENT_SOURCE_DIR})
diff --git a/core/libs/prx/libSceAudio3d/Export.cpp b/core/libs/prx/libSceAudio3d/Export.cpp
index 4420537497..0eddd25c80 100644
--- a/core/libs/prx/libSceAudio3d/Export.cpp
+++ b/core/libs/prx/libSceAudio3d/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -14,12 +17,6 @@
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int user_id, int type, int index, std::uint32_t len, std::uint32_t freq, std::uint32_t param);
-int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
-int APS5_VABI sceAudioOutClose(int handle);
-}
-
 namespace {
 
 constexpr int AUDIO3D_ERROR_INVALID_PORT = static_cast<int>(0x80EA0002);
@@ -472,29 +469,29 @@ int APS5_VABI sceAudio3dReportUnregisterHandler(void) {
     return 0;
 }
 
-int APS5_VABI sceAudio3dGetSpeakerArrayMemorySize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+static_assert(sizeof(Audio3dSpeakerArrayParameters) == 0x20);
+
+size_t APS5_VABI sceAudio3dGetSpeakerArrayMemorySize(uint32_t num_speakers, uint8_t is_3d) {
+    return sceAudioOut2GetSpeakerArrayMemorySize(num_speakers, is_3d, 0);
 }
 
-int APS5_VABI sceAudio3dCreateSpeakerArray(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAudio3dCreateSpeakerArray(AudioOut2SpeakerArrayHandle* handle, const Audio3dSpeakerArrayParameters* parameters) {
+    if (!handle || !parameters) return AUDIO3D_ERROR_INVALID_PARAMETER;
+    unsigned char extended[0x28] = {};
+    std::memcpy(extended, parameters, sizeof(*parameters));
+    return sceAudioOut2SpeakerArrayCreate(handle, extended, nullptr);
 }
 
-int APS5_VABI sceAudio3dDeleteSpeakerArray(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAudio3dDeleteSpeakerArray(AudioOut2SpeakerArrayHandle handle) {
+    return sceAudioOut2SpeakerArrayDestroy(handle);
 }
 
-int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t num_coefficients) {
+    return sceAudioOut2GetSpeakerArrayCoefficients(handle, pos, spread, coefficients, num_coefficients, 0, 0.1f);
 }
 
-int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients2(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t num_coefficients, uint8_t height_aware, float downmix_spread_radius) {
+    return sceAudioOut2GetSpeakerArrayCoefficients(handle, pos, spread, coefficients, num_coefficients, height_aware, downmix_spread_radius);
 }
 
 }
diff --git a/core/libs/prx/libSceAudio3d/include/Audio3d.hpp b/core/libs/prx/libSceAudio3d/include/Audio3d.hpp
new file mode 100644
index 0000000000..54c1e127b3
--- /dev/null
+++ b/core/libs/prx/libSceAudio3d/include/Audio3d.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct Audio3dSpeakerArrayParameters {
+    const AudioOut2Position* positions;
+    std::uint32_t numSpeakers;
+    std::uint8_t is3d;
+    void* memory;
+    std::size_t memorySize;
+};
+
+extern "C" {
+
+void APS5_VABI sceAudio3dGetDefaultOpenParameters(Audio3dOpenParameters* p);
+int APS5_VABI sceAudio3dInitialize(int64_t reserved);
+int APS5_VABI sceAudio3dTerminate();
+int APS5_VABI sceAudio3dPortAdvance(uint32_t portId);
+int APS5_VABI sceAudio3dPortClose(uint32_t portId);
+int APS5_VABI sceAudio3dPortGetQueueLevel(uint32_t portId, uint32_t* queueLevel, uint32_t* queueAvailable);
+int APS5_VABI sceAudio3dPortGetAttributesSupported(uint32_t portId, uint32_t* attributes, uint32_t* numAttributes);
+int APS5_VABI sceAudio3dPortOpen(int userId, const Audio3dOpenParameters* parameters, uint32_t* id);
+int APS5_VABI sceAudio3dPortPush(uint32_t portId, uint32_t blocking);
+int APS5_VABI sceAudio3dPortSetAttribute(uint32_t portId, uint32_t attributeId, const void* attribute, size_t attributeSize);
+int APS5_VABI sceAudio3dObjectReserve(uint32_t portId, uint32_t* objectId);
+int APS5_VABI sceAudio3dObjectUnreserve(uint32_t portId, uint32_t objectId);
+int APS5_VABI sceAudio3dObjectSetAttributes(uint32_t portId, uint32_t objectId, uint64_t numAttributes, const Audio3dAttribute* attributeArray);
+int APS5_VABI sceAudio3dPortFlush(uint32_t portId);
+int APS5_VABI sceAudio3dBedWrite2(uint32_t portId, uint32_t numChannels, uint32_t format, const void* buffer, uint32_t numSamples, uint32_t outputRoute, bool);
+int APS5_VABI sceAudio3dBedWrite(uint32_t portId, uint32_t numChannels, uint32_t format, const void* buffer, uint32_t numSamples);
+int APS5_VABI sceAudio3dAudioOutOpen(uint32_t portId, int userId, std::int32_t type, std::int32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int APS5_VABI sceAudio3dAudioOutClose(std::int32_t handle);
+int APS5_VABI sceAudio3dAudioOutOutput(std::int32_t handle, const void* ptr);
+int APS5_VABI sceAudio3dAudioOutOutputs(AudioOutOutputParam* param, uint32_t num);
+int APS5_VABI sceAudio3dStrError(void);
+int APS5_VABI sceAudio3dPortOpenEx(void);
+int APS5_VABI sceAudio3dPortCreate(void);
+int APS5_VABI sceAudio3dPortDestroy(void);
+int APS5_VABI sceAudio3dPortGetStatus(void);
+int APS5_VABI sceAudio3dReportRegisterHandler(void);
+int APS5_VABI sceAudio3dReportUnregisterHandler(void);
+size_t APS5_VABI sceAudio3dGetSpeakerArrayMemorySize(uint32_t numSpeakers, uint8_t is3d);
+int APS5_VABI sceAudio3dCreateSpeakerArray(AudioOut2SpeakerArrayHandle* handle, const Audio3dSpeakerArrayParameters* parameters);
+int APS5_VABI sceAudio3dDeleteSpeakerArray(AudioOut2SpeakerArrayHandle handle);
+int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t numCoefficients);
+int APS5_VABI sceAudio3dGetSpeakerArrayMixCoefficients2(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t numCoefficients, uint8_t heightAware, float downmixSpreadRadius);
+
+}
diff --git a/core/libs/prx/libSceAudio3d/libSceAudio3d.hpp b/core/libs/prx/libSceAudio3d/libSceAudio3d.hpp
new file mode 100644
index 0000000000..dcdc650f61
--- /dev/null
+++ b/core/libs/prx/libSceAudio3d/libSceAudio3d.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
diff --git a/core/libs/prx/libSceAudioIn/Export.cpp b/core/libs/prx/libSceAudioIn/Export.cpp
index 3f4d0837fb..b1d4089ca1 100644
--- a/core/libs/prx/libSceAudioIn/Export.cpp
+++ b/core/libs/prx/libSceAudioIn/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioIn/include/AudioIn.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -191,9 +192,9 @@ int32_t APS5_VABI sceAudioInAsyncOpen(int32_t userId, uint32_t type, uint32_t in
 }
 
 int32_t APS5_VABI sceAudioInIsPadEmbeddedMic(int32_t handle) {
- (void)handle;
- NotImplemented_nid_no_patch(__func__);
- return 0;
+    std::lock_guard lock(g_mutex);
+    if (!find(handle)) return AUDIO_IN_ERROR_INVALID_HANDLE;
+    return 0;
 }
 
 int32_t APS5_VABI sceAudioInGetGain(int32_t handle, float* gain) {
@@ -258,14 +259,14 @@ int APS5_VABI sceAudioInGetHandleStatusInfo(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioInOpenEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAudioInOpenEx(int user_id, uint32_t type, uint32_t index, uint32_t extra, uint32_t len, uint32_t freq, uint32_t param) {
+    (void)extra;
+    return sceAudioInOpen(user_id, type, index, len, freq, param);
 }
 
-int APS5_VABI sceAudioInHqOpenEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceAudioInHqOpenEx(int user_id, uint32_t type, uint32_t index, uint32_t extra, uint32_t len, uint32_t freq, uint32_t param) {
+    (void)extra;
+    return sceAudioInOpen(user_id, type, index, len, freq, param);
 }
 
 int APS5_VABI sceAudioInDeviceOpenEx(void) {
@@ -289,12 +290,10 @@ int APS5_VABI sceAudioInSetSparkSideTone(void) {
 }
 
 int APS5_VABI sceAudioInSetCompressorPreGain(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceAudioInSetNoiseGateThreshold(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceAudioIn/include/AudioIn.hpp b/core/libs/prx/libSceAudioIn/include/AudioIn.hpp
new file mode 100644
index 0000000000..f4d273aab6
--- /dev/null
+++ b/core/libs/prx/libSceAudioIn/include/AudioIn.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioInInit();
+int APS5_VABI sceAudioInGetSilentState(int handle);
+int APS5_VABI sceAudioInInput(int handle, void* dest);
+int APS5_VABI sceAudioInOpen(int userId, uint32_t type, uint32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int32_t APS5_VABI sceAudioInClose(int32_t handle);
+int32_t APS5_VABI sceAudioInHqOpen(int32_t userId, uint32_t type, uint32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int32_t APS5_VABI sceAudioInAsyncOpen(int32_t userId, uint32_t type, uint32_t index, uint32_t len, uint32_t freq, uint32_t param);
+int32_t APS5_VABI sceAudioInIsPadEmbeddedMic(int32_t handle);
+int32_t APS5_VABI sceAudioInGetGain(int32_t handle, float* gain);
+int32_t APS5_VABI sceAudioInGetRerouteCount(int32_t handle);
+int APS5_VABI sceAudioInDeviceIdOpen(void);
+int APS5_VABI sceAudioInDeviceIdAsyncOpen(void);
+int APS5_VABI sceAudioInSetUsbGain(void);
+int APS5_VABI sceAudioInIsSharedDevice(void);
+int APS5_VABI sceAudioInDeviceIdHqOpen(void);
+int APS5_VABI sceAudioInDeviceHqOpen(void);
+int APS5_VABI sceAudioInSetConnections(void);
+int APS5_VABI sceAudioInSetPortConnections(void);
+int APS5_VABI sceAudioInSetPortStatuses(void);
+int APS5_VABI sceAudioInGetHandleStatusInfo(void);
+int APS5_VABI sceAudioInOpenEx(int userId, uint32_t type, uint32_t index, uint32_t extra, uint32_t len, uint32_t freq, uint32_t param);
+int APS5_VABI sceAudioInHqOpenEx(int userId, uint32_t type, uint32_t index, uint32_t extra, uint32_t len, uint32_t freq, uint32_t param);
+int APS5_VABI sceAudioInDeviceOpenEx(void);
+int APS5_VABI sceAudioInChangeAppModuleState(void);
+int APS5_VABI sceAudioInSetSparkParam(void);
+int APS5_VABI sceAudioInSetSparkSideTone(void);
+int APS5_VABI sceAudioInSetCompressorPreGain(void);
+int APS5_VABI sceAudioInSetNoiseGateThreshold(void);
+int APS5_VABI sceAudioInSetMicLevel(void);
+int APS5_VABI sceAudioInSetDeviceMuteStatus(void);
+int APS5_VABI sceAudioInSetDevConnection(void);
+int APS5_VABI sceAudioInCountPorts(void);
+int APS5_VABI sceAudioInSetUserMute(void);
+int APS5_VABI sceAudioInVmicCreate(void);
+int APS5_VABI sceAudioInVmicDestroy(void);
+int APS5_VABI sceAudioInVmicWrite(void);
+int APS5_VABI sceAudioInVmicGetStatus(void);
+int APS5_VABI sceAudioInVmicSetMute(void);
+int APS5_VABI sceAudioInSetMode(void);
+int APS5_VABI sceAudioInSetMode2(void);
+int APS5_VABI sceAudioInExtCtrl(void);
+int APS5_VABI sceAudioInInputs(void);
+
+}
diff --git a/core/libs/prx/libSceAudioIn/libSceAudioIn.hpp b/core/libs/prx/libSceAudioIn/libSceAudioIn.hpp
new file mode 100644
index 0000000000..6da8abb473
--- /dev/null
+++ b/core/libs/prx/libSceAudioIn/libSceAudioIn.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudioIn/include/AudioIn.hpp"
diff --git a/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp b/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp
index 71b2edeba4..566f101c98 100644
--- a/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp
+++ b/core/libs/prx/libSceAudioLatencyEstimation/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioLatencyEstimation/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudioLatencyEstimation/include/Api.hpp b/core/libs/prx/libSceAudioLatencyEstimation/include/Api.hpp
new file mode 100644
index 0000000000..7d8dffbfc4
--- /dev/null
+++ b/core/libs/prx/libSceAudioLatencyEstimation/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioLatencyEstimationAddData();
+int APS5_VABI sceAudioLatencyEstimationGetDelayTime();
+int APS5_VABI sceAudioLatencyEstimationInitialize();
+int APS5_VABI sceAudioLatencyEstimationRelease();
+
+}
diff --git a/core/libs/prx/libSceAudioLatencyEstimation/libSceAudioLatencyEstimation.hpp b/core/libs/prx/libSceAudioLatencyEstimation/libSceAudioLatencyEstimation.hpp
new file mode 100644
index 0000000000..5df8b57860
--- /dev/null
+++ b/core/libs/prx/libSceAudioLatencyEstimation/libSceAudioLatencyEstimation.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudioLatencyEstimation/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudioOut/CMakeLists.txt b/core/libs/prx/libSceAudioOut/CMakeLists.txt
index af79a20cf1..7c97d07a55 100644
--- a/core/libs/prx/libSceAudioOut/CMakeLists.txt
+++ b/core/libs/prx/libSceAudioOut/CMakeLists.txt
@@ -47,6 +47,21 @@ if(BUILD_TESTING)
         endif()
     endforeach()
 
+    add_test_executable(audio_out_buffer_size_tests tests/AudioOutBufferSize.cpp src/AudioOut.cpp src/AudioOut2PadMix.cpp src/AudioOutShutdown.cpp)
+    target_compile_definitions(audio_out_buffer_size_tests PRIVATE SDL_MAIN_HANDLED)
+    target_include_directories(audio_out_buffer_size_tests PRIVATE ${LIBS_INCLUDE_DIR} ${ANYPS5_SDL2_INCLUDE_DIR})
+    target_link_libraries(audio_out_buffer_size_tests PRIVATE libc libkernel libScePad)
+    configure_windows_unwind(audio_out_buffer_size_tests)
+    foreach(bufferSizeMode IN ITEMS pass_through wrap mix threshold)
+        set(bufferSizeTest "audio_out_buffer_size_${bufferSizeMode}")
+        add_test(NAME ${bufferSizeTest} COMMAND audio_out_buffer_size_tests ${bufferSizeMode})
+        set_tests_properties(${bufferSizeTest} PROPERTIES TIMEOUT 5)
+        if(WIN32)
+            set_tests_properties(${bufferSizeTest} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endforeach()
+
     add_test_executable(audio_out_vibration_tests tests/AudioOutVibration.cpp)
     target_include_directories(audio_out_vibration_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(audio_out_vibration_tests PRIVATE libSceAudioOut libScePad libc)
@@ -171,6 +186,16 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudioOut>")
     endif()
 
+    add_test_executable(audio_out_info_tests tests/AudioOutInfo.cpp)
+    target_include_directories(audio_out_info_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(audio_out_info_tests PRIVATE libSceAudioOut libc)
+    configure_windows_unwind(audio_out_info_tests)
+    add_test(NAME audio_out_info COMMAND audio_out_info_tests)
+    if(WIN32)
+        set_tests_properties(audio_out_info PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudioOut>")
+    endif()
+
     add_test_executable(audio_out2_port_layouts_tests tests/AudioOut2PortLayouts.cpp)
     target_include_directories(audio_out2_port_layouts_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(audio_out2_port_layouts_tests PRIVATE libSceAudioOut libc)
@@ -220,4 +245,14 @@ if(BUILD_TESTING)
         set_tests_properties(audio_out2_shutdown audio_out2_waiting_push_shutdown audio_out2_advance_shutdown audio_out_shutdown PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudioOut>")
     endif()
+
+    add_test_executable(audio_out_system_state_tests tests/AudioOutSystemState.cpp)
+    target_include_directories(audio_out_system_state_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(audio_out_system_state_tests PRIVATE libSceAudioOut libc)
+    configure_windows_unwind(audio_out_system_state_tests)
+    add_test(NAME audio_out_system_state COMMAND audio_out_system_state_tests)
+    if(WIN32)
+        set_tests_properties(audio_out_system_state PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceAudioOut>")
+    endif()
 endif()
diff --git a/core/libs/prx/libSceAudioOut/include/AudioOut.hpp b/core/libs/prx/libSceAudioOut/include/AudioOut.hpp
new file mode 100644
index 0000000000..ba5e6b3e93
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/include/AudioOut.hpp
@@ -0,0 +1,80 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioOutInit();
+int APS5_VABI sceAudioOutOpen(int userId, int type, int index, std::uint32_t len, std::uint32_t freq, std::uint32_t param);
+int APS5_VABI sceAudioOutClose(int handle);
+int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
+int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam* param, std::uint32_t num);
+int APS5_VABI sceAudioOutSetVolume(int handle, std::uint32_t flag, int* vol);
+int APS5_VABI sceAudioOutGetLastOutputTime(int handle, std::uint64_t* outputTime);
+int APS5_VABI sceAudioOutGetPortState(int handle, AudioOutPortState* state);
+int APS5_VABI sceAudioOutDeviceIdOpen(std::uint64_t deviceId, std::int32_t type, std::int32_t index, std::uint32_t length, std::int32_t frequency, std::uint32_t parameter);
+int APS5_VABI sceAudioOutSysClose(int handle);
+int APS5_VABI sceAudioOutSysConfigureOutput(int type, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
+int APS5_VABI sceAudioOutSysGetHdmiMonitorInfo(int type, void* info, std::uint32_t size);
+int APS5_VABI sceAudioOutSysOpen(int userId, std::uint32_t mode);
+int APS5_VABI sceAudioOutSetMixLevelPadSpk(int handle, std::uint32_t mixLevel);
+int APS5_VABI sceAudioOutExClose(int handle);
+int APS5_VABI sceAudioOutExConfigureOutput(int control, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
+int APS5_VABI sceAudioOutExGetMonitorInfo(int type, int index, void* info, std::uint32_t size);
+int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
+int APS5_VABI sceAudioOutGetSystemState(AudioOutSystemState* state);
+int APS5_VABI sceAudioOutOpenEx(void);
+int APS5_VABI sceAudioOutSetSystemDebugState(void);
+int APS5_VABI sceAudioOutGetHandleStatusInfo(void);
+int APS5_VABI sceAudioOutGetSimulatedHandleStatusInfo2(void);
+int APS5_VABI sceAudioOutChangeAppModuleState(void);
+int APS5_VABI sceAudioOutGetSimulatedHandleStatusInfo(void);
+int APS5_VABI sceAudioOutGetSimulatedBusUsableStatusByBusType(void);
+int APS5_VABI sceAudioOutAttachToApplicationByPid(void);
+int APS5_VABI sceAudioOutDetachFromApplicationByPid(void);
+int APS5_VABI sceAudioOutPtOpen(void);
+int APS5_VABI sceAudioOutPtClose(void);
+int APS5_VABI sceAudioOutPtGetLastOutputTime(void);
+int APS5_VABI sceAudioOutExPtOpen(void);
+int APS5_VABI sceAudioOutExPtClose(void);
+int APS5_VABI sceAudioOutExPtGetLastOutputTime(void);
+int APS5_VABI sceAudioOutExGetLastOutputTime(void);
+int APS5_VABI sceAudioOutGetInfoOpenNum(void);
+int APS5_VABI sceAudioOutGetInfo(void);
+int APS5_VABI sceAudioOutMasteringInit(uint32_t flags);
+int APS5_VABI sceAudioOutMasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t flags);
+int APS5_VABI sceAudioOutMasteringGetState(AudioOut2MasteringStatesHeader* state);
+int APS5_VABI sceAudioOutMasteringTerm(void);
+int APS5_VABI sceAudioOutSetPadSpkVolume(void);
+int APS5_VABI sceAudioOutSetPadJackVolume(void);
+int APS5_VABI sceAudioOutSetUsbVolume(void);
+int APS5_VABI sceAudioOutSetCaesarVolume(void);
+int APS5_VABI sceAudioOutSetHeadphoneOutMode(void);
+int APS5_VABI sceAudioOutGetFocusEnablePid(void);
+int APS5_VABI sceAudioOutSetMainOutput(void);
+int APS5_VABI sceAudioOutSetVolumeDown(void);
+int APS5_VABI sceAudioOutSetChatBalance(void);
+int APS5_VABI sceAudioOutSetRecMode(void);
+int APS5_VABI sceAudioOutSetAllMute(void);
+int APS5_VABI sceAudioOutSetSparkEQ(void);
+int APS5_VABI sceAudioOutArbitrationInitialize(void);
+int APS5_VABI sceAudioOutEnable3DAudioByArbitration(void);
+int APS5_VABI sceAudioOutAssignHRTF(void);
+int APS5_VABI sceAudioOutEnable3DAudioForUser(void);
+int APS5_VABI sceAudioOutEnableMonoHpOutput(void);
+int APS5_VABI sceAudioOutEnableTVVirtual(void);
+int APS5_VABI sceAudioOutEnableTVCorrection(void);
+int APS5_VABI sceAudioOutEnableVrControllerLowPowerMode(void);
+int APS5_VABI sceAudioOutEnableCinematicVrRotation(void);
+int APS5_VABI sceAudioOutCustomHrtfIsExist(void);
+int APS5_VABI sceAudioOutExConfigureOutputMode(void);
+int APS5_VABI sceAudioOutExSystemInfoIsSupportedAudioOutExMode(void);
+int APS5_VABI sceAudioOutExGetSystemInfo(void);
+int APS5_VABI sceAudioOutExGetOutputInfo(void);
+int APS5_VABI sceAudioOutSysConfigureOutputMode(void);
+int APS5_VABI sceAudioOutSysGetMonitorInfo(void);
+int APS5_VABI sceAudioOutSysHdmiMonitorInfoIsSupportedAudioOutMode(void);
+int APS5_VABI sceAudioOutSysGetSystemInfo(void);
+int APS5_VABI sceAudioOutSysGetOutputInfo(void);
+
+}
diff --git a/core/libs/prx/libSceAudioOut/include/AudioOut2.hpp b/core/libs/prx/libSceAudioOut/include/AudioOut2.hpp
new file mode 100644
index 0000000000..d7212024f9
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/include/AudioOut2.hpp
@@ -0,0 +1,82 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam* params, void* buffer, size_t bufferSize, AudioOut2ContextHandle* ctx);
+int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle ctx, uint32_t* queueLevel, uint32_t* availableQueue);
+int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle ctx, uint32_t blocking);
+int APS5_VABI sceAudioOut2ContextQueryMemory(const AudioOut2ContextParam* params, size_t* memorySize);
+int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam* params);
+int APS5_VABI sceAudioOut2ContextSetAttributes(AudioOut2ContextHandle ctx, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2LoInit(void);
+int APS5_VABI sceAudioOut2LoTerminate(void);
+int APS5_VABI sceAudioOut2LoContextQueryMemory(const AudioOut2ContextParam* params, size_t* memorySize);
+int APS5_VABI sceAudioOut2LoContextCreate(const AudioOut2ContextParam* params, void* buffer, size_t bufferSize, AudioOut2ContextHandle* ctx);
+int APS5_VABI sceAudioOut2LoContextDestroy(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2LoContextSetAttributes(AudioOut2ContextHandle ctx, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2LoContextAdvance(AudioOut2ContextHandle ctx);
+int APS5_VABI sceAudioOut2LoContextPush(AudioOut2ContextHandle ctx, uint32_t blocking);
+int APS5_VABI sceAudioOut2LoContextGetQueueLevel(AudioOut2ContextHandle ctx, uint32_t* queueLevel, uint32_t* availableQueue);
+int APS5_VABI sceAudioOut2LoPortCreate(AudioOut2ContextHandle ctx, const AudioOut2PortParam* params, AudioOut2PortHandle* port);
+int APS5_VABI sceAudioOut2LoPortDestroy(AudioOut2PortHandle port);
+int APS5_VABI sceAudioOut2LoPortSetAttributes(AudioOut2PortHandle port, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2LoPortGetState(AudioOut2PortHandle port, AudioOut2PortState* state);
+int APS5_VABI sceAudioOut2MasteringInit(uint32_t flags);
+int APS5_VABI sceAudioOut2MasteringInitEx(uint32_t flags);
+int APS5_VABI sceAudioOut2MasteringTerm(void);
+int APS5_VABI sceAudioOut2MasteringGetState(AudioOut2MasteringStatesHeader* state, uint32_t output, AudioOut2UserHandle user);
+int APS5_VABI sceAudioOut2MasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t output, uint32_t flags);
+int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle ctx, const AudioOut2PortParam* params, AudioOut2PortHandle* port);
+int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle port);
+int APS5_VABI sceAudioOut2PortGetState(AudioOut2PortHandle port, AudioOut2PortState* state);
+int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle port, const AudioOut2Attribute* attributes, uint32_t num);
+int APS5_VABI sceAudioOut2SpeakerArrayCreate(AudioOut2SpeakerArrayHandle* handle, const void* vbapParams, const void* ambiParams);
+int APS5_VABI sceAudioOut2SpeakerArrayDestroy(AudioOut2SpeakerArrayHandle handle);
+int APS5_VABI sceAudioOut2GetSpeakerArrayAmbisonicsCoefficients(AudioOut2SpeakerArrayHandle handle, uint32_t ambisonicsChannel, float* coefficients, uint32_t numCoefficients);
+int APS5_VABI sceAudioOut2GetSpeakerArrayCoefficients(AudioOut2SpeakerArrayHandle handle, AudioOut2Position pos, float spread, float* coefficients, uint32_t numCoefficients, uint8_t heightAware, float downmixSpreadRadius);
+size_t APS5_VABI sceAudioOut2GetSpeakerArrayMemorySize(uint32_t numSpeakers, uint8_t is3d, uint8_t isAmbisonics);
+int APS5_VABI sceAudioOut2GetSpeakerInfo(AudioOut2SpeakerInfo* info, uint32_t flags);
+int APS5_VABI sceAudioOut2Initialize(void);
+int APS5_VABI sceAudioOut2InitializeEx(std::uint32_t param);
+int APS5_VABI sceAudioOut2Set3DLatency(int userId, std::uint32_t output);
+int APS5_VABI sceAudioOut2GetSystemState(AudioOut2SystemState* state);
+int APS5_VABI sceAudioOut2SetSystemDebugState(const AudioOut2SystemDebugStateParam* param);
+int APS5_VABI sceAudioOut2EnableChat(void);
+int APS5_VABI sceAudioOut2DisableChat(void);
+int APS5_VABI sceAudioOut2UserCreate(uint32_t userId, AudioOut2UserHandle* handle);
+int APS5_VABI sceAudioOut2UserDestroy(AudioOut2UserHandle handle);
+int APS5_VABI sceAudioOut2UserGetSupportedAttributes(AudioOut2UserHandle handle, uint32_t* contextAttributes, uint32_t* portAttributes);
+int APS5_VABI sceAudioOut2UserCreateEx(void);
+int APS5_VABI sceAudioOut2ArbitrationInitialize(void);
+int APS5_VABI sceAudioOut2MbusInit(void);
+int APS5_VABI sceAudioOut2MbusSetPortConnections(void);
+int APS5_VABI sceAudioOut2MbusSetConnections(void);
+int APS5_VABI sceAudioOut2MbusSetPortStatuses(void);
+int APS5_VABI sceAudioOut2MbusSetHeadphoneOutMode(void);
+int APS5_VABI sceAudioOut2MbusUserLoginFor3DAudio(void);
+int APS5_VABI sceAudioOut2MbusSetDeviceConnections(void);
+int APS5_VABI sceAudioOut2MbusSetMorpheusParam(void);
+int APS5_VABI sceAudioOut2MbusSetCaesarParam(void);
+int APS5_VABI sceAudioOut2MbusSetSparkParam(void);
+int APS5_VABI sceAudioOut2AllAudioMainToHeadphoneForDiag(void);
+int APS5_VABI sceAudioOut2LoPortGetStateEx(void);
+int APS5_VABI sceAudioOut2ReportRegisterHandler(void);
+int APS5_VABI sceAudioOut2ReportUnregisterHandler(void);
+int APS5_VABI sceAudioOut2GetTvCorrectionInfo(void);
+int APS5_VABI sceAudioOut2GetIpcHandle(void);
+int APS5_VABI sceAudioOut2GetSystemStateEx(void);
+int APS5_VABI sceAudioOut2SetDebugHeadphoneMode(void);
+int APS5_VABI sceAudioOut2DebugStateCtrl(void);
+int APS5_VABI sceAudioOut2ContextBedWrite(void);
+int APS5_VABI sceAudioOut2PortCreateEx(void);
+int APS5_VABI sceAudioOut2Terminate(void);
+int APS5_VABI sceAudioOut2PortRegister(void);
+int APS5_VABI sceAudioOut2PortUnregister(void);
+int APS5_VABI sceAudioOut2GetAmbisonicsEncodeCoefficients(void);
+int APS5_VABI sceAudioOut2GetHrtfIdForCronos(void);
+
+}
diff --git a/core/libs/prx/libSceAudioOut/libSceAudioOut.hpp b/core/libs/prx/libSceAudioOut/libSceAudioOut.hpp
new file mode 100644
index 0000000000..d092ed95af
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/libSceAudioOut.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
index 9faeaef957..4459dc8152 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -401,12 +402,23 @@ static int allocatePort(int type, std::uint32_t len, std::uint32_t freq, Format
     return -2144993275;
 }
 
+static std::atomic<bool> g_audioOut2Initialized{false};
+
+bool AudioOut2IsInitialized_nid_no_patch() {
+    return g_audioOut2Initialized.load();
+}
+
 extern "C" {
 
-int APS5_VABI sceAudioOutInit() {
+int APS5_VABI sceAudioOut2Initialize(void) {
+    g_audioOut2Initialized.store(true);
     return 0;
 }
 
+int APS5_VABI sceAudioOutInit() {
+    return sceAudioOut2Initialize();
+}
+
 int APS5_VABI sceAudioOutOpen(int userId, int type, int index, std::uint32_t len,
     std::uint32_t freq, std::uint32_t param) {
     (void)userId;
@@ -714,4 +726,13 @@ int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode) {
     return allocatePort(PORT_TYPE_EX, highRate ? 1024 : 256, highRate ? 192000 : 48000, Format::S16Stereo);
 }
 
+int APS5_VABI sceAudioOutGetSystemState(AudioOutSystemState* state) {
+    if (state == nullptr) {
+        return -2144993276;
+    }
+    *state = {};
+    state->loudness = 0.0f;
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp
index e11ee633e5..905eaa42f5 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <algorithm>
 #include <chrono>
 #include <cmath>
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp
index c58bd4c542..42363a9998 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Internal.hpp
@@ -25,6 +25,7 @@
 bool AudioOut2TraceEnabled();
 // Seconds since the first AudioOut2 call, for the trace.
 double AudioOut2TraceSeconds();
+bool AudioOut2IsInitialized_nid_no_patch();
 
 #define AUDIOOUT2_TRACE(...) \
     do { \
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp
index eaba6e102d..e427f40302 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
@@ -5,23 +6,14 @@
 
 extern "C" {
 
-int APS5_VABI sceAudioOut2Initialize(void);
-int APS5_VABI sceAudioOut2ContextQueryMemory(const AudioOut2ContextParam* params, size_t* memory_size);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam* params, void* buffer, size_t buffer_size, AudioOut2ContextHandle* ctx);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle ctx);
-int APS5_VABI sceAudioOut2ContextSetAttributes(AudioOut2ContextHandle ctx, const AudioOut2Attribute* attributes, uint32_t num);
-int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle ctx);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle ctx, uint32_t blocking);
-int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle ctx, uint32_t* queue_level, uint32_t* available_queue);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle ctx, const AudioOut2PortParam* params, AudioOut2PortHandle* port);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle port);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle port, const AudioOut2Attribute* attributes, uint32_t num);
-int APS5_VABI sceAudioOut2PortGetState(AudioOut2PortHandle port, AudioOut2PortState* state);
-
 int APS5_VABI sceAudioOut2LoInit(void) {
     return sceAudioOut2Initialize();
 }
 
+int APS5_VABI sceAudioOut2LoTerminate(void) {
+    return 0;
+}
+
 int APS5_VABI sceAudioOut2LoContextQueryMemory(const AudioOut2ContextParam* params, size_t* memory_size) {
     return sceAudioOut2ContextQueryMemory(params, memory_size);
 }
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp
index e48537db95..88e948e434 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp
@@ -1,5 +1,8 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include <cstddef>
 #include <cstdint>
 #include <cstring>
+#include <atomic>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
@@ -7,29 +10,93 @@ namespace {
 
 constexpr int SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_API_PARAM = static_cast<int>(0x80268201);
 constexpr int SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_STATES_ID = static_cast<int>(0x80268204);
+constexpr int SCE_AUDIO_OUT2_ERROR_MASTERING_NOT_INITIALIZED = static_cast<int>(0x80268203);
+constexpr int SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_FLAG = static_cast<int>(0x80268205);
+constexpr int SCE_AUDIO_OUT2_ERROR_INVALID_POINTER = static_cast<int>(0x8026800C);
+constexpr std::uint32_t AUDIO_OUT2_MASTERING_INIT_EX_MODE = 0x80000000u;
+constexpr std::uint32_t AUDIO_OUT2_MASTERING_SET_PARAM_FLAGS_MAX = 1;
+
+std::atomic<bool> g_masteringInitialized{false};
+
+int InitializeMastering(uint32_t flags, uint32_t accepted) {
+    if (g_masteringInitialized.load()) return 0;
+    if ((flags & ~accepted) != 0) return SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_API_PARAM;
+    g_masteringInitialized.store(true);
+    return 0;
+}
+
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STATES_ID_DEFAULT = 1;
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STATES_ID_V2 = 2;
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STRUCT_ID_COMPRESSOR_DEFAULT = 0x01010001;
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STRUCT_ID_COMPRESSOR_V2 = 0x01020001;
 constexpr std::uint32_t AUDIO_OUT2_MASTERING_STRUCT_ID_LIMITER_DEFAULT = 0x01010003;
 
+constexpr std::uint32_t AUDIO_OUT_MASTERING_PARAMS_ID_DEFAULT = 1;
+constexpr std::uint32_t AUDIO_OUT_MASTERING_STATES_ID_DEFAULT = 1;
+
+constexpr std::size_t AUDIO_OUT_MASTERING_COMPRESSOR_INPUT_RMS_OFFSET = 32;
+constexpr std::size_t AUDIO_OUT_MASTERING_COMPRESSOR_GAIN_OFFSET = 128;
+constexpr std::size_t AUDIO_OUT_MASTERING_LIMITER_INPUT_PEAK_OFFSET = 240;
+constexpr std::size_t AUDIO_OUT_MASTERING_LIMITER_OUTPUT_PEAK_OFFSET = 272;
+constexpr std::size_t AUDIO_OUT_MASTERING_LIMITER_GAIN_PEAK_OFFSET = 304;
+
+static_assert(sizeof(AudioOut2MasteringStates) == 336);
+static_assert(offsetof(AudioOut2MasteringStates, compressor_states) + offsetof(AudioOut2MasteringCompressorStates, input_rms) == AUDIO_OUT_MASTERING_COMPRESSOR_INPUT_RMS_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, compressor_states) + offsetof(AudioOut2MasteringCompressorStates, compression_coeff) == AUDIO_OUT_MASTERING_COMPRESSOR_GAIN_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, limiter_states) + offsetof(AudioOut2MasteringLimiterStates, input_peak) == AUDIO_OUT_MASTERING_LIMITER_INPUT_PEAK_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, limiter_states) + offsetof(AudioOut2MasteringLimiterStates, output_peak) == AUDIO_OUT_MASTERING_LIMITER_OUTPUT_PEAK_OFFSET);
+static_assert(offsetof(AudioOut2MasteringStates, limiter_states) + offsetof(AudioOut2MasteringLimiterStates, gain_peak) == AUDIO_OUT_MASTERING_LIMITER_GAIN_PEAK_OFFSET);
+
 }
 
 extern "C" {
 
-int APS5_VABI sceAudioOut2MasteringInit(uint32_t flags) {
+int APS5_VABI sceAudioOutMasteringInit(uint32_t flags) {
     if (flags != 0) NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
+int APS5_VABI sceAudioOutMasteringTerm(void) {
+    return 0;
+}
+
+int APS5_VABI sceAudioOutMasteringGetState(AudioOut2MasteringStatesHeader* state) {
+    if (state == nullptr) APS5_INVALID_ARG_EX;
+    if (state->states_id != AUDIO_OUT_MASTERING_STATES_ID_DEFAULT) NotImplemented_nid_no_patch(__func__);
+    auto* full = static_cast<AudioOut2MasteringStates*>(static_cast<void*>(state));
+    std::memset(full->compressor_states.input_rms, 0, sizeof(full->compressor_states.input_rms));
+    std::memset(full->compressor_states.compression_coeff, 0, sizeof(full->compressor_states.compression_coeff));
+    std::memset(full->limiter_states.input_peak, 0, sizeof(full->limiter_states.input_peak));
+    std::memset(full->limiter_states.output_peak, 0, sizeof(full->limiter_states.output_peak));
+    std::memset(full->limiter_states.gain_peak, 0, sizeof(full->limiter_states.gain_peak));
+    return 0;
+}
+
+int APS5_VABI sceAudioOutMasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t flags) {
+    if (param == nullptr) APS5_INVALID_ARG_EX;
+    if (flags != 0) NotImplemented_nid_no_patch(__func__);
+    if (param->params_id != AUDIO_OUT_MASTERING_PARAMS_ID_DEFAULT) NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceAudioOut2MasteringInit(uint32_t flags) {
+    return InitializeMastering(flags, 0);
+}
+
+int APS5_VABI sceAudioOut2MasteringInitEx(uint32_t flags) {
+    return InitializeMastering(flags, AUDIO_OUT2_MASTERING_INIT_EX_MODE);
+}
+
 int APS5_VABI sceAudioOut2MasteringTerm(void) {
+    if (!g_masteringInitialized.exchange(false)) return SCE_AUDIO_OUT2_ERROR_MASTERING_NOT_INITIALIZED;
     return 0;
 }
 
 int APS5_VABI sceAudioOut2MasteringGetState(AudioOut2MasteringStatesHeader* state, uint32_t output, AudioOut2UserHandle user) {
     (void)output;
     (void)user;
-    if (state == nullptr) return SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_API_PARAM;
+    if (!g_masteringInitialized.load()) return SCE_AUDIO_OUT2_ERROR_MASTERING_NOT_INITIALIZED;
+    if (state == nullptr) return SCE_AUDIO_OUT2_ERROR_INVALID_POINTER;
     switch (state->states_id) {
         case AUDIO_OUT2_MASTERING_STATES_ID_DEFAULT: {
             auto* full = static_cast<AudioOut2MasteringStates*>(static_cast<void*>(state));
@@ -58,8 +125,9 @@ int APS5_VABI sceAudioOut2MasteringGetState(AudioOut2MasteringStatesHeader* stat
 
 int APS5_VABI sceAudioOut2MasteringSetParam(const AudioOut2MasteringParamsHeader* param, uint32_t output, uint32_t flags) {
     (void)output;
-    (void)flags;
+    if (!g_masteringInitialized.load()) return SCE_AUDIO_OUT2_ERROR_MASTERING_NOT_INITIALIZED;
     if (param == nullptr) return SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_API_PARAM;
+    if (flags > AUDIO_OUT2_MASTERING_SET_PARAM_FLAGS_MAX) return SCE_AUDIO_OUT2_ERROR_MASTERING_INVALID_FLAG;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp
index 14c9bc2c63..e8a547fefc 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstring>
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp
index 26170f4622..36b6746149 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <algorithm>
 #include <cmath>
 #include <cstddef>
@@ -7,6 +8,7 @@
 #include <string>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "AudioOut2Internal.hpp"
 
 namespace {
 
@@ -68,7 +70,7 @@ extern "C" {
 
 int APS5_VABI sceAudioOut2SpeakerArrayCreate(AudioOut2SpeakerArrayHandle* handle, const void* vbap_params, const void* ambi_params) {
     const auto* params = static_cast<const GuestVbapParams*>(vbap_params);
-    if (handle == nullptr || params == nullptr || ambi_params == nullptr || params->positions == nullptr ||
+    if (handle == nullptr || params == nullptr || params->positions == nullptr ||
         params->numSpeakers == 0 || params->numSpeakers > MaxSpeakers || params->memory == nullptr ||
         params->memorySize < sizeof(SpeakerArray) || reinterpret_cast<std::uintptr_t>(params->memory) % alignof(SpeakerArray) != 0) {
         APS5_INVALID_ARG_EX;
@@ -120,8 +122,13 @@ size_t APS5_VABI sceAudioOut2GetSpeakerArrayMemorySize(uint32_t num_speakers, ui
 }
 
 int APS5_VABI sceAudioOut2GetSpeakerInfo(AudioOut2SpeakerInfo* info, uint32_t flags) {
-    (void)flags;
-    if (!info) return static_cast<int>(0x80260502);
+    constexpr int ErrorInvalidParam = static_cast<int>(0x80268001);
+    constexpr int ErrorNotInitialized = static_cast<int>(0x80268006);
+    constexpr int ErrorInvalidPointer = static_cast<int>(0x8026800C);
+    constexpr std::uint32_t MaxFlags = 1;
+    if (!AudioOut2IsInitialized_nid_no_patch()) return ErrorNotInitialized;
+    if (!info) return ErrorInvalidPointer;
+    if (flags > MaxFlags) return ErrorInvalidParam;
     constexpr std::uint8_t SpeakerTypeTelevision = 0;
     constexpr std::uint32_t FrontLeftAndRight = 0x3;
     constexpr AudioOut2SpeakerAngle NoSpeaker = {-360, -360};
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp
index b9d9d152cf..6723eb1371 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp
@@ -1,4 +1,6 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <atomic>
+#include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
@@ -11,8 +13,9 @@ static std::atomic<bool> g_chatEnabled{false};
 
 extern "C" {
 
-int APS5_VABI sceAudioOut2Initialize(void) {
-    return 0;
+int APS5_VABI sceAudioOut2InitializeEx(std::uint32_t param) {
+    (void)param;
+    return sceAudioOut2Initialize();
 }
 
 int APS5_VABI sceAudioOut2Set3DLatency(int userId, std::uint32_t output) {
@@ -28,7 +31,15 @@ int APS5_VABI sceAudioOut2GetSystemState(AudioOut2SystemState* state) {
 }
 
 int APS5_VABI sceAudioOut2SetSystemDebugState(const AudioOut2SystemDebugStateParam* param) {
-    if (param == nullptr) return static_cast<int>(0x80260502);
+    constexpr int ErrorInvalidPointer = static_cast<int>(0x8026800C);
+    constexpr std::uint32_t DebugStateIdLoudness = 1;
+    constexpr std::uint32_t DebugStateIdUnmodelled = 0x20;
+    constexpr std::size_t LoudnessParamSize = 8;
+    constexpr std::size_t UnmodelledParamSize = 4;
+    if (param == nullptr) return ErrorInvalidPointer;
+    if (param->debug_state_id == DebugStateIdUnmodelled && param->param_size == UnmodelledParamSize) NotImplemented_nid_no_patch(__func__);
+    if (param->debug_state_id != DebugStateIdLoudness || param->param_size != LoudnessParamSize) return SCE_AUDIO_OUT2_ERROR_INVALID_PARAM;
+    if (param->param == nullptr) NotImplemented_nid_no_patch(__func__);
     AUDIOOUT2_TRACE("t=%.3f SetSystemDebugState: debug state %u recorded; the host has no system mix to apply it to\n", AudioOut2TraceSeconds(), param->debug_state_id);
     return 0;
 }
diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp
index 1a514be246..5a8bce8592 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut2User.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp b/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
index 02abcf4fd9..1e44d76aa6 100644
--- a/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
+++ b/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -36,8 +38,7 @@ int APS5_VABI sceAudioOutChangeAppModuleState(void) {
 }
 
 int APS5_VABI sceAudioOutGetSimulatedHandleStatusInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return static_cast<int>(0x809B00FF);
 }
 
 int APS5_VABI sceAudioOutGetSimulatedBusUsableStatusByBusType(void) {
@@ -91,32 +92,10 @@ int APS5_VABI sceAudioOutExGetLastOutputTime(void) {
 }
 
 int APS5_VABI sceAudioOutGetInfoOpenNum(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI sceAudioOutGetInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringSetParam(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringGetState(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioOutMasteringTerm(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -365,11 +344,6 @@ int APS5_VABI sceAudioOut2GetSystemStateEx(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioOut2MasteringInitEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioOut2SetDebugHeadphoneMode(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -380,11 +354,6 @@ int APS5_VABI sceAudioOut2DebugStateCtrl(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioOut2LoTerminate(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioOut2ContextBedWrite(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -395,11 +364,6 @@ int APS5_VABI sceAudioOut2PortCreateEx(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioOut2InitializeEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioOut2Terminate(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp
index 404037d497..82e8464648 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2DeviceState.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/libSceAudioOut.hpp"
 #include "SceTypes.hpp"
 
 #include <cstddef>
@@ -8,23 +9,15 @@
 #include <random>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortGetState(AudioOut2PortHandle, AudioOut2PortState*);
-int APS5_VABI sceAudioOut2GetSpeakerInfo(AudioOut2SpeakerInfo*, std::uint32_t);
-int APS5_VABI sceAudioOut2GetSystemState(AudioOut2SystemState*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 namespace {
 
 constexpr int errorInvalidArgument = static_cast<int>(0x80260502);
 constexpr int errorInvalidHandle = static_cast<int>(0x80260503);
+constexpr int errorInvalidParam = static_cast<int>(0x80268001);
+constexpr int errorNotInitialized = static_cast<int>(0x80268006);
+constexpr int errorInvalidPointer = static_cast<int>(0x8026800C);
 constexpr std::uint16_t portTypeMain = 0;
 constexpr std::uint16_t outputMain = 1;
 constexpr std::int16_t volumeMax = 127;
@@ -101,7 +94,38 @@ void SpeakerInfoReportsTheFrontPair() {
     Require(info.speaker_angle[0].azimuth == 30 && info.speaker_angle[0].elevation == 0);
     Require(info.speaker_angle[1].azimuth == -30 && info.speaker_angle[1].elevation == 0);
     for (int index = 2; index < 16; index++) Require(info.speaker_angle[index].azimuth == -360 && info.speaker_angle[index].elevation == -360);
-    Require(sceAudioOut2GetSpeakerInfo(nullptr, 0) == errorInvalidArgument);
+    Require(sceAudioOut2GetSpeakerInfo(nullptr, 0) == errorInvalidPointer);
+}
+
+void SpeakerInfoRequiresInitialization() {
+    AudioOut2SpeakerInfo info;
+    std::memset(&info, 0xAB, sizeof(info));
+    const AudioOut2SpeakerInfo untouched = info;
+    Require(sceAudioOut2GetSpeakerInfo(&info, 0) == errorNotInitialized);
+    Require(sceAudioOut2GetSpeakerInfo(nullptr, 0) == errorNotInitialized);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 2) == errorNotInitialized);
+    Require(std::memcmp(&info, &untouched, sizeof(info)) == 0);
+}
+
+void SpeakerInfoAfterAudioOutInit() {
+    AudioOut2SpeakerInfo info;
+    std::memset(&info, 0xAB, sizeof(info));
+    Require(sceAudioOutInit() == 0);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 0) == 0);
+}
+
+void SpeakerInfoRejectsBadFlags() {
+    AudioOut2SpeakerInfo info;
+    std::memset(&info, 0xAB, sizeof(info));
+    const AudioOut2SpeakerInfo untouched = info;
+    Require(sceAudioOut2GetSpeakerInfo(&info, 2) == errorInvalidParam);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 0x80000000) == errorInvalidParam);
+    Require(sceAudioOut2GetSpeakerInfo(nullptr, 2) == errorInvalidPointer);
+    Require(std::memcmp(&info, &untouched, sizeof(info)) == 0);
+    Require(sceAudioOut2GetSpeakerInfo(&info, 1) == 0);
+    Require(info.type == 0);
+    Require(info.available_bits == 0x3);
+    Require(info.speaker_angle[0].azimuth == 30 && info.speaker_angle[1].azimuth == -30);
 }
 
 void SystemStateIsSilentAndRejectsNull() {
@@ -119,6 +143,9 @@ int main() {
     std::filesystem::remove(path);
     SetEnvironment("SDL_DISKAUDIOFILE", path.string());
 
+    SpeakerInfoRequiresInitialization();
+    SpeakerInfoAfterAudioOutInit();
+
     AudioOut2ContextParam params{};
     Require(sceAudioOut2ContextResetParam(&params) == 0);
     params.num_grains = 256;
@@ -129,6 +156,7 @@ int main() {
     PortStateFollowsTheDataFormat(context);
     PortStateRejectsBadArguments(context);
     SpeakerInfoReportsTheFrontPair();
+    SpeakerInfoRejectsBadFlags();
     SystemStateIsSilentAndRejectsNull();
 
     Require(sceAudioOut2ContextDestroy(context) == 0);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp
index 3ab1cd4a0f..cc08e950f6 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2Latency.cpp
@@ -1,25 +1,15 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <stdexcept>
-
-extern "C" {
-int APS5_VABI sceAudioOut2Initialize();
-int APS5_VABI sceAudioOut2LoInit();
-int APS5_VABI sceAudioOut2LoTerminate();
-int APS5_VABI sceAudioOut2Set3DLatency(int, std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringInit(std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringTerm();
-int APS5_VABI sceAudioOut2MasteringSetParam(const void*, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOut2MasteringGetState(void*, std::uint32_t, std::uint64_t);
-int APS5_VABI sceAudioOut2SetSystemDebugState(const void*);
-int APS5_VABI sceAudioOut2EnableChat();
-int APS5_VABI sceAudioOut2DisableChat();
-}
+#include <utility>
 
 static void Require(bool value, const char* message) {
     if (value) return;
@@ -37,6 +27,16 @@ static bool ThrowsRuntimeError(TFunction function) {
     return false;
 }
 
+template<typename TFunction>
+static bool ThrowsException(TFunction function) {
+    try {
+        function();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
 namespace {
 
 static_assert(sizeof(AudioOut2MasteringCompressorStates) == 208);
@@ -48,9 +48,11 @@ static_assert(sizeof(AudioOut2MasteringStatesV2) == 400);
 constexpr int systemUser = 0xFF;
 constexpr int user = 0x10000000;
 constexpr int errorInvalidParam = static_cast<int>(0x80268001);
-constexpr int errorInvalidArgument = static_cast<int>(0x80260502);
+constexpr int errorInvalidPointer = static_cast<int>(0x8026800C);
 constexpr int errorMasteringInvalidApiParam = static_cast<int>(0x80268201);
 constexpr int errorMasteringInvalidStatesId = static_cast<int>(0x80268204);
+constexpr int errorMasteringNotInitialized = static_cast<int>(0x80268203);
+constexpr int errorMasteringInvalidFlag = static_cast<int>(0x80268205);
 
 void TestSet3DLatency() {
     Require(sceAudioOut2Set3DLatency(systemUser, 0) == errorInvalidParam, "output 0 for selector 255 must be refused");
@@ -66,52 +68,144 @@ void TestSet3DLatency() {
 }
 
 void TestMasteringInit() {
+    const AudioOut2MasteringParamsHeader params{1u};
+    AudioOut2MasteringStates storage{};
+    Require(sceAudioOut2MasteringTerm() == errorMasteringNotInitialized, "termination before initialization is refused");
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 0) == errorMasteringNotInitialized, "parameters before initialization are refused");
+    Require(sceAudioOut2MasteringGetState(nullptr, 0, 0) == errorMasteringNotInitialized, "the initialization check comes before the null check");
+    Require(sceAudioOut2MasteringGetState(&storage.states_header, 0, 0) == errorMasteringNotInitialized, "states before initialization are refused");
+    Require(sceAudioOut2MasteringInit(1) == errorMasteringInvalidApiParam, "flags 1 are refused");
+    Require(sceAudioOut2MasteringInit(0x80000000u) == errorMasteringInvalidApiParam, "sceAudioOut2MasteringInit accepts no flag");
     Require(sceAudioOut2MasteringInit(0) == 0, "flags 0 must be accepted");
-    Require(ThrowsRuntimeError([] { sceAudioOut2MasteringInit(1); }), "flags 1 must throw");
+    Require(sceAudioOut2MasteringInit(1) == 0, "an initialized stage returns 0 before the flags are checked");
+    Require(sceAudioOut2MasteringInit(0) == 0, "a second initialization must be accepted");
 }
 
 void TestMasteringTerm() {
-    Require(sceAudioOut2MasteringInit(0) == 0, "a second initialization must be accepted");
     Require(sceAudioOut2MasteringTerm() == 0, "termination must be accepted");
-    Require(sceAudioOut2MasteringTerm() == 0, "termination must be accepted for each initialization");
+    Require(sceAudioOut2MasteringTerm() == errorMasteringNotInitialized, "initializations are not counted");
+    Require(sceAudioOut2MasteringInitEx(1) == errorMasteringInvalidApiParam, "sceAudioOut2MasteringInitEx refuses the low bits");
+    Require(sceAudioOut2MasteringInitEx(0x80000001u) == errorMasteringInvalidApiParam, "sceAudioOut2MasteringInitEx refuses the low bits with the mode bit");
+    Require(sceAudioOut2MasteringInitEx(0x80000000u) == 0, "sceAudioOut2MasteringInitEx accepts the mode bit");
+    Require(sceAudioOut2MasteringTerm() == 0, "termination after sceAudioOut2MasteringInitEx must be accepted");
+    Require(sceAudioOut2MasteringInitEx(0) == 0, "sceAudioOut2MasteringInitEx accepts flags 0");
 }
 
 void TestMasteringSetParam() {
-    const std::uint32_t params[4] = {1u, 0u, 0u, 0u};
-    Require(sceAudioOut2MasteringSetParam(params, 0, 0) == 0, "mastering parameters must be accepted");
-    Require(sceAudioOut2MasteringSetParam(params, 2, 0) == 0, "mastering parameters for output 2 must be accepted");
+    const AudioOut2MasteringParamsHeader params{1u};
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 0) == 0, "mastering parameters must be accepted");
+    Require(sceAudioOut2MasteringSetParam(&params, 2, 0) == 0, "mastering parameters for output 2 must be accepted");
     Require(sceAudioOut2MasteringSetParam(nullptr, 0, 0) == errorMasteringInvalidApiParam, "null mastering parameters return the invalid API parameter error");
+    Require(sceAudioOut2MasteringSetParam(nullptr, 0, 2) == errorMasteringInvalidApiParam, "the null check comes before the flag check");
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 1) == 0, "flags 1 must be accepted");
+    Require(sceAudioOut2MasteringSetParam(&params, 0, 2) == errorMasteringInvalidFlag, "flags above 1 are refused");
 }
 
 void TestMasteringGetState() {
     alignas(16) std::uint8_t storage[512];
-    Require(sceAudioOut2MasteringGetState(nullptr, 0, 0) == errorMasteringInvalidApiParam, "a null state returns the invalid API parameter error");
-    auto* header = reinterpret_cast<std::uint32_t*>(storage);
+    Require(sceAudioOut2MasteringGetState(nullptr, 0, 0) == errorInvalidPointer, "a null state returns the invalid pointer error");
+    auto* header = reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage);
     auto* words = reinterpret_cast<std::uint32_t*>(storage);
-    *header = 1u;
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == 0, "states id 1 must be accepted");
-    Require(*header == 1u, "states id 1 is kept");
+    header->states_id = 1u;
+    Require(sceAudioOut2MasteringGetState(header, 0, 0) == 0, "states id 1 must be accepted");
+    Require(header->states_id == 1u, "states id 1 is kept");
     Require(words[4] == 0x01010001u && words[5] == 8u + 8u + 3u * 8u * 4u * 2u, "the compressor states descriptor is filled");
     Require(words[56] == 0x01010003u && words[57] == 8u + 8u + 8u * 4u * 3u, "the limiter states descriptor is filled");
     std::fill(storage, storage + sizeof(storage), 0xA5);
-    *header = 2u;
-    Require(sceAudioOut2MasteringGetState(storage, 2, 1) == 0, "states id 2 must be accepted");
-    Require(*header == 2u, "states id 2 is kept");
+    header->states_id = 2u;
+    Require(sceAudioOut2MasteringGetState(header, 2, 1) == 0, "states id 2 must be accepted");
+    Require(header->states_id == 2u, "states id 2 is kept");
     Require(words[4] == 0x01020001u && words[5] == 8u + 8u + 4u * 8u * 4u * 2u, "the V2 compressor states descriptor is filled");
     Require(words[72] == 0x01010003u && words[73] == 8u + 8u + 8u * 4u * 3u, "the V2 limiter states descriptor is filled");
     Require(std::all_of(storage + 8, storage + 16, [](std::uint8_t byte) { return byte == 0; }), "the reserved words are zeroed");
     Require(std::all_of(storage + 24, storage + 288, [](std::uint8_t byte) { return byte == 0; }), "the V2 compressor states are zeroed");
-    *header = 3u;
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == errorMasteringInvalidStatesId, "an unknown states id is refused");
-    *header = 0u;
-    Require(sceAudioOut2MasteringGetState(storage, 0, 0) == errorMasteringInvalidStatesId, "states id 0 is refused");
+    header->states_id = 3u;
+    Require(sceAudioOut2MasteringGetState(header, 0, 0) == errorMasteringInvalidStatesId, "an unknown states id is refused");
+    header->states_id = 0u;
+    Require(sceAudioOut2MasteringGetState(header, 0, 0) == errorMasteringInvalidStatesId, "states id 0 is refused");
+}
+
+void TestLegacyMasteringInit() {
+    Require(sceAudioOutMasteringInit(0) == 0, "legacy flags 0 must be accepted");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(1); }), "legacy flags SwapEqCompressor must throw");
+    Require(sceAudioOutMasteringInit(0) == 0, "a repeated legacy initialization must be accepted");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(2); }), "legacy flags bit 1 must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(3); }), "legacy flags bits 0 and 1 must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(0x80000000u); }), "legacy flags bit 31 must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringInit(0xFFFFFFFFu); }), "legacy flags 0xFFFFFFFF must throw");
+}
+
+void TestLegacyMasteringTerm() {
+    Require(sceAudioOutMasteringTerm() == 0, "legacy termination must be accepted");
+    Require(sceAudioOutMasteringTerm() == 0, "legacy termination must be accepted for each initialization");
+}
+
+void TestLegacyMasteringSetParam() {
+    alignas(16) std::uint32_t params[16];
+    std::fill(params, params + 16, 0xA5A5A5A5u);
+    params[0] = 1u;
+    Require(sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0) == 0, "legacy mastering parameters must be accepted");
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 1); }), "legacy parameters with SwapEqCompressor must throw");
+    Require(params[0] == 1u && params[1] == 0xA5A5A5A5u && params[15] == 0xA5A5A5A5u, "legacy mastering parameters are not modified");
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 2); }), "legacy parameters with flags bit 1 must throw");
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0xFFFFFFFFu); }), "legacy parameters with unknown flags must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringSetParam(nullptr, 0); }), "null legacy parameters must throw");
+    Require(ThrowsException([] { sceAudioOutMasteringSetParam(nullptr, 2); }), "null legacy parameters with unknown flags must throw");
+    params[0] = 0u;
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0); }), "legacy params id 0 must throw");
+    params[0] = 2u;
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0); }), "legacy params id 2 must throw");
+    params[0] = 0x01010001u;
+    Require(ThrowsException([&] { sceAudioOutMasteringSetParam(reinterpret_cast<const AudioOut2MasteringParamsHeader*>(params), 0); }), "an unknown legacy params id must throw");
+}
+
+void TestLegacyMasteringGetState() {
+    constexpr std::size_t size = 512;
+    constexpr std::size_t statesSize = 336;
+    alignas(16) std::uint8_t storage[size];
+    auto* header = reinterpret_cast<std::uint32_t*>(storage);
+    std::fill(storage, storage + size, 0xA5);
+    *header = 1u;
+    Require(sceAudioOutMasteringGetState(reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage)) == 0, "legacy states id 1 must be accepted");
+    Require(*header == 1u, "legacy states id 1 is kept");
+    const std::pair<std::size_t, std::size_t> meters[] = {{32, 128}, {128, 224}, {240, 272}, {272, 304}, {304, 336}};
+    for (const auto& meter : meters) {
+        Require(std::all_of(storage + meter.first, storage + meter.second, [](std::uint8_t byte) { return byte == 0; }), "the legacy mastering meters are zeroed");
+    }
+    Require(std::all_of(storage + 4, storage + 32, [](std::uint8_t byte) { return byte == 0xA5; }), "the bytes before the compressor meters are not modified");
+    Require(std::all_of(storage + 224, storage + 240, [](std::uint8_t byte) { return byte == 0xA5; }), "the limiter descriptor bytes are not modified");
+    Require(std::all_of(storage + statesSize, storage + size, [](std::uint8_t byte) { return byte == 0xA5; }), "the bytes after the states are not modified");
+    Require(sceAudioOutMasteringGetState(reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage)) == 0, "legacy states id 1 must be accepted again");
+
+    for (std::uint32_t id : {0u, 2u, 3u, 0x01010001u, 0xFFFFFFFFu}) {
+        std::fill(storage, storage + size, 0xA5);
+        *header = id;
+        Require(ThrowsException([&] { sceAudioOutMasteringGetState(reinterpret_cast<AudioOut2MasteringStatesHeader*>(storage)); }), "an unknown legacy states id must throw");
+        Require(*header == id && std::all_of(storage + 4, storage + size, [](std::uint8_t byte) { return byte == 0xA5; }), "a refused legacy states id leaves the buffer unmodified");
+    }
+    Require(ThrowsException([] { sceAudioOutMasteringGetState(nullptr); }), "a null legacy state must throw");
 }
 
 void TestSetSystemDebugState() {
-    const std::uint64_t param[4] = {1, 0, 0, 0};
-    Require(sceAudioOut2SetSystemDebugState(reinterpret_cast<const void*>(param)) == 0, "a debug state must be accepted");
-    Require(sceAudioOut2SetSystemDebugState(reinterpret_cast<const void*>(param)) == 0, "a debug state must be accepted again");
-    Require(sceAudioOut2SetSystemDebugState(nullptr) == errorInvalidArgument, "a null debug state is refused");
+    std::uint32_t loudness[2] = {1, 0};
+    const auto set = [&loudness](std::uint32_t id, void* data, std::size_t size) {
+        const AudioOut2SystemDebugStateParam param{id, 0, data, size};
+        return sceAudioOut2SetSystemDebugState(&param);
+    };
+    Require(set(1, loudness, 8) == 0, "the loudness debug state must be accepted");
+    Require(set(1, loudness, 8) == 0, "the loudness debug state must be accepted again");
+    Require(set(1, loudness, 0) == errorInvalidParam, "a loudness debug state of size 0 is refused");
+    Require(set(1, loudness, 4) == errorInvalidParam, "a loudness debug state of size 4 is refused");
+    Require(set(1, loudness, 16) == errorInvalidParam, "a loudness debug state of size 16 is refused");
+    Require(set(0, loudness, 8) == errorInvalidParam, "debug state id 0 is refused");
+    Require(set(2, loudness, 8) == errorInvalidParam, "debug state id 2 is refused");
+    Require(set(0x21, loudness, 8) == errorInvalidParam, "debug state id 0x21 is refused");
+    Require(set(0xFFFFFFFFu, loudness, 8) == errorInvalidParam, "a large debug state id is refused");
+    Require(set(0x20, loudness, 8) == errorInvalidParam, "debug state id 0x20 of size 8 is refused");
+    Require(set(0x20, loudness, 0) == errorInvalidParam, "debug state id 0x20 of size 0 is refused");
+    Require(ThrowsRuntimeError([&] { set(0x20, loudness, 4); }), "debug state id 0x20 of size 4 must throw");
+    Require(ThrowsRuntimeError([&] { set(1, nullptr, 8); }), "a loudness debug state without a param must throw");
+    Require(sceAudioOut2SetSystemDebugState(nullptr) == errorInvalidPointer, "a null debug state is refused");
 }
 
 void TestEnableChat() {
@@ -125,7 +219,9 @@ void TestEnableChat() {
 void TestLowLatencyService() {
     Require(sceAudioOut2LoInit() == 0, "starting the low-latency service must be accepted");
     Require(sceAudioOut2LoInit() == 0, "starting the low-latency service again must be accepted");
-    Require(ThrowsRuntimeError([] { sceAudioOut2LoTerminate(); }), "stopping the low-latency service must throw");
+    Require(sceAudioOut2LoTerminate() == 0, "stopping the low-latency service returns 0");
+    Require(sceAudioOut2LoTerminate() == 0, "stopping a stopped low-latency service returns 0");
+    Require(sceAudioOut2InitializeEx(0) == 0 && sceAudioOut2InitializeEx(1) == 0, "the extended initialization succeeds");
 }
 
 }
@@ -137,6 +233,10 @@ int main() {
     TestMasteringTerm();
     TestMasteringSetParam();
     TestMasteringGetState();
+    TestLegacyMasteringInit();
+    TestLegacyMasteringTerm();
+    TestLegacyMasteringSetParam();
+    TestLegacyMasteringGetState();
     TestSetSystemDebugState();
     TestEnableChat();
     TestLowLatencyService();
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp
index b1d5725eca..fff06c8167 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortBuffers.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 
 #include <algorithm>
@@ -17,18 +18,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp
index 7fcfa50334..dcdcb0268c 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2PortLayouts.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 
 #include <cmath>
@@ -14,19 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2UserCreate(std::uint32_t, AudioOut2UserHandle*);
-int APS5_VABI sceAudioOut2UserDestroy(AudioOut2UserHandle);
-int APS5_VABI sceAudioOut2UserGetSupportedAttributes(AudioOut2UserHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp
index 36074daece..0dfd811378 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOut2Timing.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
 #include "SceTypes.hpp"
 
 #include <chrono>
@@ -14,29 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextQueryMemory(const AudioOut2ContextParam*, std::size_t*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2ContextGetQueueLevel(AudioOut2ContextHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOut2LoContextQueryMemory(const AudioOut2ContextParam*, std::size_t*);
-int APS5_VABI sceAudioOut2LoContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2LoContextDestroy(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2LoContextSetAttributes(AudioOut2ContextHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOut2LoContextAdvance(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2LoContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2LoContextGetQueueLevel(AudioOut2ContextHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceAudioOut2LoPortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2LoPortDestroy(AudioOut2PortHandle);
-int APS5_VABI sceAudioOut2LoPortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOut2LoPortGetState(AudioOut2PortHandle, AudioOut2PortState*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp
new file mode 100644
index 0000000000..6b2eaaef4e
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutBufferSize.cpp
@@ -0,0 +1,95 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "SDL.h"
+#include "prx/libSceAudioOut/include/AudioOutSdl.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <stdexcept>
+#include <string_view>
+#include <vector>
+
+namespace {
+constexpr SDL_AudioDeviceID device = 7;
+int opened = 0;
+int closed = 0;
+int queued = 0;
+std::uint32_t queuedBytes = 0;
+const void* supplied = nullptr;
+std::uint32_t suppliedBytes = 0;
+
+void Require(bool value, const char* message) {
+    if (!value) throw std::runtime_error(message);
+}
+
+void RunPassThrough() {
+    std::vector<float> samples(512u * 8u);
+    for (std::size_t i = 0; i < samples.size(); ++i) samples[i] = static_cast<float>(i % 97u) / 97.0f;
+    const int handle = sceAudioOutOpen(0, 0, 0, 512, 48000, 5);
+    Require(handle > 0 && opened == 1, "a 512-frame F32 8-channel port did not open its device");
+    supplied = samples.data();
+    suppliedBytes = static_cast<std::uint32_t>(samples.size() * sizeof(float));
+    Require(sceAudioOutOutput(handle, samples.data()) == 512, "a 512-frame output did not return 512");
+    Require(queued == 1 && queuedBytes == 16384, "a 512-frame F32 8-channel output did not queue 16384 bytes");
+    Require(sceAudioOutClose(handle) == 0 && closed == 1, "the port did not close its device");
+}
+
+void RunOverflow(std::uint32_t frames, std::uint32_t format, std::uint32_t frameBytes) {
+    std::vector<std::uint8_t> frame(frameBytes);
+    const int handle = sceAudioOutOpen(0, 0, 0, frames, 48000, format);
+    Require(handle > 0 && opened == 1, "a port with an oversized length did not open its device");
+    supplied = frame.data();
+    suppliedBytes = frameBytes;
+    bool threw = false;
+    try {
+        static_cast<void>(sceAudioOutOutput(handle, frame.data()));
+    } catch (const std::runtime_error&) {
+        threw = true;
+    }
+    Require(threw, "an output whose buffer size overflows did not throw");
+    Require(queued == 0, "an output whose buffer size overflows queued audio");
+    Require(sceAudioOutClose(handle) == 0 && closed == 1, "the port did not close after the refused output");
+}
+}
+
+int InitializeSdlAudio_nid_no_patch() { return 0; }
+extern "C" Uint32 SDLCALL SDL_WasInit(Uint32) { return SDL_INIT_AUDIO; }
+extern "C" int SDLCALL SDL_GetNumAudioDevices(int) { return 1; }
+extern "C" const char* SDLCALL SDL_GetAudioDeviceName(int, int) { return "Main speakers"; }
+extern "C" int SDLCALL SDL_GetAudioDeviceSpec(int, int, SDL_AudioSpec* spec) { *spec = {}; spec->channels = 2; return 0; }
+extern "C" const char* SDLCALL SDL_GetCurrentAudioDriver() { return "dummy"; }
+extern "C" const char* SDLCALL SDL_GetError() { return "test error"; }
+extern "C" SDL_AudioDeviceID SDLCALL SDL_OpenAudioDevice(const char* name, int capture, const SDL_AudioSpec* desired, SDL_AudioSpec* obtained, int) {
+    Require(name == nullptr && capture == 0 && desired->callback == nullptr, "the main port did not open the default device");
+    ++opened;
+    *obtained = *desired;
+    return device;
+}
+extern "C" void SDLCALL SDL_PauseAudioDevice(SDL_AudioDeviceID id, int) { Require(id == device, "wrong device paused"); }
+extern "C" Uint32 SDLCALL SDL_GetQueuedAudioSize(SDL_AudioDeviceID id) { Require(id == device, "wrong queue queried"); return 0; }
+extern "C" int SDLCALL SDL_QueueAudio(SDL_AudioDeviceID id, const void* data, Uint32 bytes) {
+    Require(id == device, "wrong queue fed");
+    ++queued;
+    queuedBytes = bytes;
+    if (bytes <= suppliedBytes) Require(std::memcmp(data, supplied, bytes) == 0, "the queued audio is not the supplied samples");
+    return 0;
+}
+extern "C" void SDLCALL SDL_ClearQueuedAudio(SDL_AudioDeviceID id) { Require(id == device, "wrong queue cleared"); }
+extern "C" void SDLCALL SDL_CloseAudioDevice(SDL_AudioDeviceID id) { Require(id == device, "wrong device closed"); ++closed; }
+
+int main(int argc, char** argv) {
+    try {
+        Require(argc == 2, "invalid test arguments");
+        const std::string_view mode = argv[1];
+        if (mode == "pass_through") RunPassThrough();
+        else if (mode == "wrap") RunOverflow(0x80000000u, 5, 8u * sizeof(float));
+        else if (mode == "mix") RunOverflow(0x80000000u, 7, 8u * sizeof(float));
+        else if (mode == "threshold") RunOverflow(0x40000000u, 0, sizeof(std::int16_t));
+        else Require(false, "invalid buffer size mode");
+        std::puts("audio out buffer size tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp
index b96f9dd570..0242fe8839 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutEx.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,13 +6,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
-int APS5_VABI sceAudioOutExConfigureOutput(int control, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
-int APS5_VABI sceAudioOutExClose(int handle);
-int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
-}
-
 static constexpr int SYSTEM_USER = 0xFF;
 static constexpr int ERROR_EX_INVALID_MODE = static_cast<int>(0x80260015u);
 static constexpr int ERROR_EX_INVALID_CONTROL = static_cast<int>(0x80268009u);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp
index 6fcced4ffb..6e6194c862 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutExMonitorInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,10 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceAudioOutExGetMonitorInfo(int, int, void*, std::uint32_t);
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp
new file mode 100644
index 0000000000..f246625a21
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutInfo.cpp
@@ -0,0 +1,18 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <cstdio>
+#include <cstdlib>
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+int main() {
+    Require(sceAudioOutGetSimulatedHandleStatusInfo() == static_cast<int>(0x809B00FF), "simulated handle status info is not supported");
+    Require(sceAudioOutGetInfoOpenNum() == 0, "open port count info returns 0");
+    Require(sceAudioOutGetInfo() == 0, "port info returns 0");
+    std::puts("audio out info calls: PASS");
+}
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp
index e6cdeed0d7..487624514e 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutLastOutputTime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -9,16 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam*, std::uint32_t);
-int APS5_VABI sceAudioOutGetPortState(int, AudioOutPortState*);
-int APS5_VABI sceAudioOutGetLastOutputTime(int, std::uint64_t*);
-std::uint64_t APS5_VABI sceKernelGetProcessTime();
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
@@ -231,6 +223,7 @@ int main() {
     setenv("SDL_AUDIODRIVER", "dummy", 1);
 #endif
     sceKernelGetProcessTime();
+
     TestOutput(portTypeMain);
     TestOutput(portTypeVibration);
     TestPortsAreIndependent();
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp
index ca25acb711..ae686bee18 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutMixLevelPadSpk.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstddef>
@@ -11,14 +12,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutSetVolume(int, std::uint32_t, int*);
-int APS5_VABI sceAudioOutSetMixLevelPadSpk(int, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetEnvironment(const char* name, const std::string& value) {
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp
index 107a2ef2f5..15703d8ba8 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutPortLocks.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -12,12 +13,6 @@
 #include <string_view>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutClose(int);
-}
-
 namespace {
 
 constexpr std::uint32_t Grain = 256;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp
index c56be14970..6b9577e91d 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutResampling.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -7,12 +8,6 @@
 #include <cstdlib>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutClose(int);
-}
-
 namespace {
 
 constexpr std::uint32_t grain = 256;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp
index dd5390753d..fcadcec548 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutShutdown.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
@@ -11,17 +13,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOut2ContextResetParam(AudioOut2ContextParam*);
-int APS5_VABI sceAudioOut2ContextCreate(const AudioOut2ContextParam*, void*, std::size_t, AudioOut2ContextHandle*);
-int APS5_VABI sceAudioOut2ContextAdvance(AudioOut2ContextHandle);
-int APS5_VABI sceAudioOut2ContextPush(AudioOut2ContextHandle, std::uint32_t);
-int APS5_VABI sceAudioOut2PortCreate(AudioOut2ContextHandle, const AudioOut2PortParam*, AudioOut2PortHandle*);
-int APS5_VABI sceAudioOut2PortSetAttributes(AudioOut2PortHandle, const AudioOut2Attribute*, std::uint32_t);
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-}
-
 namespace {
 
 constexpr std::uint32_t grain = 256;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
index eb5878fc18..73ea859c0b 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,14 +6,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutSysOpen(int userId, std::uint32_t mode);
-int APS5_VABI sceAudioOutSysConfigureOutput(int type, std::uint64_t flags, std::uint32_t mode, std::uint32_t target, std::uint64_t option);
-int APS5_VABI sceAudioOutSysClose(int handle);
-int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
-int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
-}
-
 static constexpr int SYSTEM_USER = 0xFF;
 
 static bool failed = false;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp
index 7eb1547ce7..1ea013ca7d 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSysHdmiMonitorInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -8,10 +9,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceAudioOutSysGetHdmiMonitorInfo(int, void*, std::uint32_t);
-}
-
 static void Require(bool value, const char* message) {
     if (value) return;
     std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSystemState.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSystemState.cpp
new file mode 100644
index 0000000000..c925334fbd
--- /dev/null
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSystemState.cpp
@@ -0,0 +1,39 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+namespace {
+
+constexpr int invalidPointer = static_cast<int>(0x80260004);
+
+void TestGetSystemState() {
+    AudioOutSystemState state{};
+    state.loudness = -1.0f;
+    state.reserved8[0] = 0xAA;
+    state.reserved[2] = ~0ull;
+    Require(sceAudioOutGetSystemState(&state) == 0, "sceAudioOutGetSystemState must succeed with valid pointer");
+    Require(state.loudness == 0.0f, "loudness must be reported as 0.0f");
+    Require(state.reserved8[0] == 0 && state.reserved[2] == 0, "reserved fields must be cleared");
+}
+
+void TestInvalidPointer() {
+    Require(sceAudioOutGetSystemState(nullptr) == invalidPointer, "null pointer must return SCE_AUDIO_OUT_ERROR_INVALID_POINTER");
+}
+
+}
+
+int main() {
+    TestGetSystemState();
+    TestInvalidPointer();
+    return 0;
+}
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp
index 4f27e0bf7d..6c01a3a317 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutVibration.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "prx/libScePad/include/PadState.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -7,15 +8,6 @@
 #include <string_view>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutExOpen(int, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam*, std::uint32_t);
-int APS5_VABI sceAudioOutSetVolume(int, std::uint32_t, int*);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
 }
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp
index 6d0a7ca4f1..79681dff96 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutVibrationDevice.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioOut/include/AudioOut.hpp"
 #include "SDL.h"
 #include "prx/libSceAudioOut/include/AudioOutSdl.hpp"
 #include "prx/libScePad/include/PadState.hpp"
@@ -13,15 +14,6 @@
 #include <string_view>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioOutOpen(int, int, int, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioOutClose(int);
-int APS5_VABI sceAudioOutOutput(int, const void*);
-int APS5_VABI sceAudioOutOutputs(AudioOutOutputParam*, std::uint32_t);
-int APS5_VABI sceAudioOutSetVolume(int, std::uint32_t, int*);
-int APS5_VABI sceAudioOutGetLastOutputTime(int, std::uint64_t*);
-}
-
 namespace {
 constexpr std::uint32_t frames = 256;
 bool available = true;
diff --git a/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp b/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp
index 8323b813c9..f00b2ea48a 100644
--- a/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp
+++ b/core/libs/prx/libSceAudioPropagation/AudioPropagation.hpp
@@ -1,6 +1,7 @@
 #ifndef CORE_LIBS_PRX_LIBSCEAUDIOPROPAGATION_AUDIOPROPAGATION_HPP
 #define CORE_LIBS_PRX_LIBSCEAUDIOPROPAGATION_AUDIOPROPAGATION_HPP
 
+#include <array>
 #include <cstddef>
 #include <cstdint>
 
@@ -128,6 +129,14 @@ static_assert(offsetof(ReportInfo, function) == 32);
 static_assert(offsetof(ReportInfo, format) == 40);
 static_assert(offsetof(ReportInfo, arguments) == 48);
 
+inline constexpr std::uint32_t MaxPaths = 36;
+inline constexpr std::uint32_t MaxPathPoints = 4;
+inline constexpr std::uint32_t PathId = 0x010107d3;
+inline constexpr std::uint32_t PathPointId = 0x010107d2;
+inline constexpr std::uint32_t PathInvalid = 1;
+inline constexpr std::uint32_t PathPortal = 2;
+
+
 struct Attribute {
     std::uint32_t id;
     std::uint32_t reserved0;
@@ -209,6 +218,7 @@ std::int32_t APS5_VABI sceAudioPropagationSourceDestroy(AudioPropagationHandle s
 std::int32_t APS5_VABI sceAudioPropagationSourceSetAttributes(AudioPropagationHandle source, const AudioPropagation::Attribute* attributes, std::uint32_t count);
 std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPathCount(AudioPropagationHandle source, std::uint32_t* count);
 std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPath(AudioPropagationHandle source, std::uint32_t index, AudioPropagationHandle* outPath);
+std::int32_t APS5_VABI sceAudioPropagationPathGetNumPoints(AudioPropagationHandle path, std::uint32_t* count);
 std::int32_t APS5_VABI sceAudioPropagationSourceGetRays(AudioPropagationHandle source, void* rays, std::uint32_t* count);
 std::int32_t APS5_VABI sceAudioPropagationSourceCalculateAudioPaths(AudioPropagationHandle source, const void* rays, std::uint32_t rayCount, std::uint32_t reflectionOrder, void* paths, std::uint32_t pathCount);
 std::int32_t APS5_VABI sceAudioPropagationSourceSetAudioPaths(AudioPropagationHandle source, const void* entries, std::uint32_t count);
diff --git a/core/libs/prx/libSceAudioPropagation/CMakeLists.txt b/core/libs/prx/libSceAudioPropagation/CMakeLists.txt
index 29417b8962..0575687fe3 100644
--- a/core/libs/prx/libSceAudioPropagation/CMakeLists.txt
+++ b/core/libs/prx/libSceAudioPropagation/CMakeLists.txt
@@ -5,7 +5,7 @@ configure_windows_unwind(libSceAudioPropagation)
 if(BUILD_TESTING)
     add_test_executable(guest_audio_propagation_tests ${LIBS_INCLUDE_DIR}/tests/GuestAudioPropagation.cpp)
     target_include_directories(guest_audio_propagation_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_audio_propagation_tests PRIVATE libSceAudioPropagation libc)
+    target_link_libraries(guest_audio_propagation_tests PRIVATE libSceAudioPropagation libc ${CMAKE_DL_LIBS})
     configure_windows_unwind(guest_audio_propagation_tests)
     add_test(NAME guest_audio_propagation COMMAND guest_audio_propagation_tests)
     if(WIN32)
diff --git a/core/libs/prx/libSceAudioPropagation/Export.cpp b/core/libs/prx/libSceAudioPropagation/Export.cpp
index fb835aca4d..2c257811bf 100644
--- a/core/libs/prx/libSceAudioPropagation/Export.cpp
+++ b/core/libs/prx/libSceAudioPropagation/Export.cpp
@@ -1,8 +1,10 @@
+#include "prx/libSceAudioPropagation/include/Api.hpp"
+#include "prx/libSceAudioPropagation/AudioPropagation.hpp"
 #include "AudioPropagation.hpp"
 #include "prx/libc/include/General.hpp"
 
-#include <cstdint>
 #include <cmath>
+#include <cstdint>
 #include <cstring>
 #include <mutex>
 #include <stdexcept>
@@ -27,18 +29,25 @@ struct SystemState {
     std::uint32_t maxSources;
 };
 
-enum class Kind { Room, Portal, Source, Material };
+enum class Kind { Room, Portal, Source, Material, Path };
 
 struct Object {
     Kind kind;
     AudioPropagationHandle system;
 };
 
+struct PathState {
+    AudioPath data{};
+    float gain = 0.0f;
+};
+
 struct Registry {
     std::mutex mutex;
     std::unordered_set<AudioPropagationHandle> systems;
     std::unordered_map<AudioPropagationHandle, Object> objects;
     std::unordered_map<AudioPropagationHandle, Object> orphans;
+    std::unordered_map<AudioPropagationHandle, std::array<AudioPropagationHandle, MaxPaths>> sourcePaths;
+    std::unordered_map<AudioPropagationHandle, PathState> paths;
     AudioPropagationHandle next = 1;
 };
 
@@ -101,6 +110,13 @@ void destroyObject(AudioPropagationHandle system, AudioPropagationHandle handle,
         return;
     }
     require(requireObject(state, handle, kind, function).system == system, function);
+    if (kind == Kind::Source) {
+        for (const auto path : state.sourcePaths.at(handle)) {
+            state.paths.erase(path);
+            state.objects.erase(path);
+        }
+        state.sourcePaths.erase(handle);
+    }
     state.objects.erase(handle);
 }
 
@@ -169,9 +185,11 @@ std::int32_t APS5_VABI sceAudioPropagationSystemDestroy(AudioPropagationHandle s
     auto& state = registry();
     std::lock_guard lock(state.mutex);
     requireSystem(state, system, __func__);
+    std::erase_if(state.paths, [&](const auto& entry) { return state.objects.at(entry.first).system == system; });
+    std::erase_if(state.sourcePaths, [&](const auto& entry) { return state.objects.at(entry.first).system == system; });
     std::erase_if(state.objects, [&](const auto& entry) {
         if (entry.second.system != system) return false;
-        state.orphans.insert(entry);
+        if (entry.second.kind != Kind::Path) state.orphans.insert(entry);
         return true;
     });
     reinterpret_cast<SystemState*>(system)->magic = 0;
@@ -257,7 +275,30 @@ std::int32_t APS5_VABI sceAudioPropagationPortalSetAttributes(AudioPropagationHa
 }
 
 std::int32_t APS5_VABI sceAudioPropagationSourceCreate(AudioPropagationHandle system, AudioPropagationHandle* outSource) {
-    createObject(system, Kind::Source, outSource, __func__);
+    require(outSource != nullptr, __func__);
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    AudioPropagationHandle source = 0;
+    createObjectLocked(state, system, Kind::Source, &source, __func__);
+    std::array<AudioPropagationHandle, MaxPaths> handles{};
+    try {
+        for (auto& handle : handles) {
+            createObjectLocked(state, system, Kind::Path, &handle, __func__);
+            PathState path{};
+            path.data.desc = {PathId, sizeof(AudioPath)};
+            path.data.flags = PathInvalid;
+            state.paths.emplace(handle, path);
+        }
+        state.sourcePaths.emplace(source, handles);
+    } catch (...) {
+        for (const auto handle : handles) {
+            state.paths.erase(handle);
+            state.objects.erase(handle);
+        }
+        state.objects.erase(source);
+        throw;
+    }
+    *outSource = source;
     return 0;
 }
 
@@ -279,7 +320,7 @@ std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPathCount(AudioPropagati
     std::lock_guard lock(state.mutex);
     requireObject(state, source, Kind::Source, __func__);
     require(count != nullptr, __func__);
-    *count = 0;
+    *count = MaxPaths;
     return 0;
 }
 
@@ -289,8 +330,18 @@ std::int32_t APS5_VABI sceAudioPropagationSourceGetAudioPath(AudioPropagationHan
     const auto found = state.objects.find(source);
     if (found == state.objects.end() || found->second.kind != Kind::Source || !liveSystem(state, found->second.system)) return ErrorInvalidHandle;
     if (!outPath) return ErrorNullPointer;
-    static_cast<void>(index);
-    return ErrorInvalidArgument;
+    if (index >= MaxPaths) return ErrorInvalidArgument;
+    *outPath = state.sourcePaths.at(source)[index];
+    return 0;
+}
+
+std::int32_t APS5_VABI sceAudioPropagationPathGetNumPoints(AudioPropagationHandle path, std::uint32_t* count) {
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    requireObject(state, path, Kind::Path, __func__);
+    require(count != nullptr, __func__);
+    *count = state.paths.at(path).data.pointCount;
+    return 0;
 }
 
 std::int32_t APS5_VABI sceAudioPropagationSourceGetRays(AudioPropagationHandle source, void* rays, std::uint32_t* count) {
@@ -322,10 +373,19 @@ std::int32_t APS5_VABI sceAudioPropagationSourceSetAudioPaths(AudioPropagationHa
 }
 
 std::int32_t APS5_VABI sceAudioPropagationSourceSetAudioPath(AudioPropagationHandle path, const AudioPath* data, float gain) {
-    static_cast<void>(path);
-    static_cast<void>(data);
-    static_cast<void>(gain);
-    NotImplemented_nid_no_patch(__func__);
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    const auto system = requireObject(state, path, Kind::Path, __func__).system;
+    requireDescriptor(data != nullptr ? &static_cast<const AudioPath*>(data)->desc : nullptr, PathId, sizeof(AudioPath), __func__);
+    const auto replacement = *static_cast<const AudioPath*>(data);
+    require(std::isfinite(gain) && gain >= 0.0f && replacement.pointCount <= MaxPathPoints && (replacement.flags & ~(PathInvalid | PathPortal)) == 0, __func__);
+    for (std::uint32_t index = 0; index < replacement.pointCount; ++index) {
+        const auto& point = replacement.points[index];
+        requireDescriptor(&point.desc, PathPointId, sizeof(PathPoint), __func__);
+        require(std::isfinite(point.gain) && point.gain >= 0.0f && std::isfinite(point.position[0]) && std::isfinite(point.position[1]) && std::isfinite(point.position[2]), __func__);
+        if (point.room != 0) require(requireObject(state, point.room, Kind::Room, __func__).system == system, __func__);
+    }
+    state.paths.at(path) = PathState{replacement, gain};
     return 0;
 }
 
@@ -336,13 +396,28 @@ std::int32_t APS5_VABI sceAudioPropagationSourceRender(AudioPropagationHandle sy
     requireSystem(state, system, __func__);
     const auto& configuration = *reinterpret_cast<const SystemState*>(system);
     require(count <= configuration.maxSources, __func__);
-    const auto requiredBytes = static_cast<std::size_t>(configuration.frameSamples) * 16 * sizeof(float);
     for (std::uint32_t index = 0; index < count; ++index) {
         const auto& info = infos[index];
         requireDescriptor(&info.desc, RenderInfoId, RenderInfoSize, __func__);
         require(requireObject(state, info.source, Kind::Source, __func__).system == system, __func__);
-        require(info.output != nullptr && info.outputSize >= requiredBytes, __func__);
-        if (info.format != RenderFormat) throw std::runtime_error(std::string(__func__) + ": render format " + std::to_string(info.format) + " is unknown");
+        require(info.output != nullptr && info.outputSize != 0, __func__);
+        std::uint32_t channels = 0;
+        switch (info.format) {
+        case 0: channels = 4; break;
+        case 1: channels = 9; break;
+        case 2: channels = 16; break;
+        case 4:
+        case 5: channels = 8; break;
+        default: throw std::runtime_error(std::string(__func__) + ": render format " + std::to_string(info.format) + " is unknown");
+        }
+        const auto requiredBytes = static_cast<std::size_t>(configuration.frameSamples) * channels * sizeof(float);
+        require(info.outputSize >= requiredBytes && info.outputSize % (channels * sizeof(float)) == 0, __func__);
+        for (const auto handle : state.sourcePaths.at(info.source)) {
+            const auto& path = state.paths.at(handle);
+            if (path.gain > 0.0f && path.data.pointCount != 0 && (path.data.flags & PathInvalid) == 0) {
+                throw std::runtime_error(std::string(__func__) + ": nonempty audio path rendering is not implemented");
+            }
+        }
     }
     for (std::uint32_t index = 0; index < count; ++index) {
         infos[index].channelCount = 0;
@@ -350,11 +425,6 @@ std::int32_t APS5_VABI sceAudioPropagationSourceRender(AudioPropagationHandle sy
     return 0;
 }
 
-int APS5_VABI sceAudioPropagationPathGetNumPoints(AudioPropagationHandle path, std::uint32_t* count) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioPropagationReportApi(std::uint32_t category, AudioPropagationHandle handle, std::int32_t result, std::int32_t operation, const char* function, const char* format, ...) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -380,56 +450,6 @@ int APS5_VABI sceAudioPropagationSystemQueryInfo(AudioPropagationHandle system,
     return 0;
 }
 
-int APS5_VABI sceAudioPropagationAudioPathInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationAudioPathPointInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationMaterialInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationPortalSettingsInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationRayInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationSourceRenderInfoInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationSourceSetAudioPathsParamInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationSystem() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationSystemMemoryInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceAudioPropagationSystemOptionInit() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioPropagationReportRegisterHandler(std::uint32_t category, ReportHandler handler, void* userData, ReportRegistration** registration) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAudioPropagation/include/Api.hpp b/core/libs/prx/libSceAudioPropagation/include/Api.hpp
new file mode 100644
index 0000000000..131fe6b5cc
--- /dev/null
+++ b/core/libs/prx/libSceAudioPropagation/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "prx/libSceAudioPropagation/AudioPropagation.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioPropagationReportApi(std::uint32_t category, AudioPropagationHandle handle, std::int32_t result, std::int32_t operation, const char* function, const char* format, ...);
+int APS5_VABI sceAudioPropagationResetAttributes(AudioPropagation::Attribute* attributes, std::uint32_t count);
+int APS5_VABI sceAudioPropagationSourceQueryInfo(AudioPropagationHandle source, AudioPropagation::SourceInfo* info);
+int APS5_VABI sceAudioPropagationSystemLock(AudioPropagationHandle system);
+int APS5_VABI sceAudioPropagationSystemQueryInfo(AudioPropagationHandle system, AudioPropagation::SystemInfo* info, std::size_t size);
+int APS5_VABI sceAudioPropagationReportRegisterHandler(std::uint32_t category, AudioPropagation::ReportHandler handler, void* userData, AudioPropagation::ReportRegistration** registration);
+int APS5_VABI sceAudioPropagationReportUnregisterHandler(AudioPropagation::ReportRegistration* registration);
+int APS5_VABI sceAudioPropagationSystemEnumHandles(AudioPropagationHandle* handles, std::uint32_t capacity);
+int APS5_VABI sceAudioPropagationSystemUnlock(AudioPropagationHandle system);
+
+}
diff --git a/core/libs/prx/libSceAudioPropagation/libSceAudioPropagation.hpp b/core/libs/prx/libSceAudioPropagation/libSceAudioPropagation.hpp
new file mode 100644
index 0000000000..6431f41cde
--- /dev/null
+++ b/core/libs/prx/libSceAudioPropagation/libSceAudioPropagation.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceAudioPropagation/AudioPropagation.hpp"
+#include "prx/libSceAudioPropagation/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudioSystem/Export.cpp b/core/libs/prx/libSceAudioSystem/Export.cpp
index d5c4291d01..de11eb33dd 100644
--- a/core/libs/prx/libSceAudioSystem/Export.cpp
+++ b/core/libs/prx/libSceAudioSystem/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioSystem/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudioSystem/include/Api.hpp b/core/libs/prx/libSceAudioSystem/include/Api.hpp
new file mode 100644
index 0000000000..c15ab7a627
--- /dev/null
+++ b/core/libs/prx/libSceAudioSystem/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudioSystemSystemResume();
+int APS5_VABI sceAudioSystemSystemSuspend();
+
+}
diff --git a/core/libs/prx/libSceAudioSystem/libSceAudioSystem.hpp b/core/libs/prx/libSceAudioSystem/libSceAudioSystem.hpp
new file mode 100644
index 0000000000..092b35b31a
--- /dev/null
+++ b/core/libs/prx/libSceAudioSystem/libSceAudioSystem.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudioSystem/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodReport/libSceAudiodReport.hpp b/core/libs/prx/libSceAudiodReport/libSceAudiodReport.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodReport/libSceAudiodReport.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodec.native/Export.cpp b/core/libs/prx/libSceAudiodec.native/Export.cpp
index 4f00015020..96acf5c292 100644
--- a/core/libs/prx/libSceAudiodec.native/Export.cpp
+++ b/core/libs/prx/libSceAudiodec.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodec.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudiodec.native/include/Api.hpp b/core/libs/prx/libSceAudiodec.native/include/Api.hpp
new file mode 100644
index 0000000000..f5050e0019
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec.native/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudiodecClearContextEx(void);
+int APS5_VABI sceAudiodecCreateDecoderEx(void);
+int APS5_VABI sceAudiodecDecode2(void);
+int APS5_VABI sceAudiodecDecode2Ex(void);
+int APS5_VABI sceAudiodecDecode2WithPriority(void);
+int APS5_VABI sceAudiodecDecode2WithPriorityEx(void);
+int APS5_VABI sceAudiodecDecodeEx(void);
+int APS5_VABI sceAudiodecDecodeWithPriority(void);
+int APS5_VABI sceAudiodecDecodeWithPriorityEx(void);
+int APS5_VABI sceAudiodecDeleteDecoderEx(void);
+int APS5_VABI sceAudiodecGetContext(void);
+int APS5_VABI sceAudiodecInitialize(void);
+int APS5_VABI sceAudiodecRegisterCodec(void);
+int APS5_VABI sceAudiodecTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceAudiodec.native/libSceAudiodec.native.hpp b/core/libs/prx/libSceAudiodec.native/libSceAudiodec.native.hpp
new file mode 100644
index 0000000000..2f7cfa515f
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec.native/libSceAudiodec.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudiodec.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodec/Export.cpp b/core/libs/prx/libSceAudiodec/Export.cpp
index 5e2b911800..4840fde2d0 100644
--- a/core/libs/prx/libSceAudiodec/Export.cpp
+++ b/core/libs/prx/libSceAudiodec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <array>
diff --git a/core/libs/prx/libSceAudiodec/include/Api.hpp b/core/libs/prx/libSceAudiodec/include/Api.hpp
new file mode 100644
index 0000000000..e02050acef
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceAudiodecInitLibrary(uint32_t codecType);
+int32_t APS5_VABI sceAudiodecTermLibrary(uint32_t codecType);
+int32_t APS5_VABI sceAudiodecCreateDecoder(AudiodecCtrl* ctrl, uint32_t codecType);
+int32_t APS5_VABI sceAudiodecDeleteDecoder(int32_t handle);
+int32_t APS5_VABI sceAudiodecClearContext(int32_t handle);
+int32_t APS5_VABI sceAudiodecDecode(int32_t handle, AudiodecCtrl* ctrl);
+
+}
diff --git a/core/libs/prx/libSceAudiodec/libSceAudiodec.hpp b/core/libs/prx/libSceAudiodec/libSceAudiodec.hpp
new file mode 100644
index 0000000000..b8ec4f574f
--- /dev/null
+++ b/core/libs/prx/libSceAudiodec/libSceAudiodec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudiodec/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodecCpu/Export.cpp b/core/libs/prx/libSceAudiodecCpu/Export.cpp
index c0c2f83744..e4ac1ea15b 100644
--- a/core/libs/prx/libSceAudiodecCpu/Export.cpp
+++ b/core/libs/prx/libSceAudiodecCpu/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodecCpu/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAudiodecCpu/include/Api.hpp b/core/libs/prx/libSceAudiodecCpu/include/Api.hpp
new file mode 100644
index 0000000000..336933274e
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpu/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAudiodecCpuClearContext(void);
+int APS5_VABI sceAudiodecCpuDecode(void);
+int APS5_VABI sceAudiodecCpuInitDecoder(void);
+int APS5_VABI sceAudiodecCpuInternalClearContext(void);
+int APS5_VABI sceAudiodecCpuInternalDecode(void);
+int APS5_VABI sceAudiodecCpuInternalInitDecoder(void);
+int APS5_VABI sceAudiodecCpuInternalQueryMemSize(void);
+int APS5_VABI sceAudiodecCpuQueryMemSize(void);
+
+}
diff --git a/core/libs/prx/libSceAudiodecCpu/libSceAudiodecCpu.hpp b/core/libs/prx/libSceAudiodecCpu/libSceAudiodecCpu.hpp
new file mode 100644
index 0000000000..e896a52007
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpu/libSceAudiodecCpu.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAudiodecCpu/include/Api.hpp"
diff --git a/core/libs/prx/libSceAudiodecCpuAlac/libSceAudiodecCpuAlac.hpp b/core/libs/prx/libSceAudiodecCpuAlac/libSceAudiodecCpuAlac.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuAlac/libSceAudiodecCpuAlac.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDdp/libSceAudiodecCpuDdp.hpp b/core/libs/prx/libSceAudiodecCpuDdp/libSceAudiodecCpuDdp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDdp/libSceAudiodecCpuDdp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDts/libSceAudiodecCpuDts.hpp b/core/libs/prx/libSceAudiodecCpuDts/libSceAudiodecCpuDts.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDts/libSceAudiodecCpuDts.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDtsHdLbr/libSceAudiodecCpuDtsHdLbr.hpp b/core/libs/prx/libSceAudiodecCpuDtsHdLbr/libSceAudiodecCpuDtsHdLbr.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDtsHdLbr/libSceAudiodecCpuDtsHdLbr.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuDtsHdMa/libSceAudiodecCpuDtsHdMa.hpp b/core/libs/prx/libSceAudiodecCpuDtsHdMa/libSceAudiodecCpuDtsHdMa.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuDtsHdMa/libSceAudiodecCpuDtsHdMa.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuFlac/libSceAudiodecCpuFlac.hpp b/core/libs/prx/libSceAudiodecCpuFlac/libSceAudiodecCpuFlac.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuFlac/libSceAudiodecCpuFlac.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuLpcm/libSceAudiodecCpuLpcm.hpp b/core/libs/prx/libSceAudiodecCpuLpcm/libSceAudiodecCpuLpcm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuLpcm/libSceAudiodecCpuLpcm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuM4aac/libSceAudiodecCpuM4aac.hpp b/core/libs/prx/libSceAudiodecCpuM4aac/libSceAudiodecCpuM4aac.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuM4aac/libSceAudiodecCpuM4aac.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAudiodecCpuTrhd/libSceAudiodecCpuTrhd.hpp b/core/libs/prx/libSceAudiodecCpuTrhd/libSceAudiodecCpuTrhd.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAudiodecCpuTrhd/libSceAudiodecCpuTrhd.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAutoMounterClient/Export.cpp b/core/libs/prx/libSceAutoMounterClient/Export.cpp
index 77af95c0ff..ab7eed9165 100644
--- a/core/libs/prx/libSceAutoMounterClient/Export.cpp
+++ b/core/libs/prx/libSceAutoMounterClient/Export.cpp
@@ -1,20 +1,9 @@
+#include "prx/libSceAutoMounterClient/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct AutoMounterUsbDeviceInfo {
-    char deviceName[128];
-    std::byte metadata[22];
-    std::byte data0[256];
-    std::byte padding[2];
-    std::uint64_t data0Size;
-    std::byte data1[256];
-    std::uint64_t data1Size;
-    std::byte data2[256];
-    std::uint64_t data2Size;
-};
-
 static_assert(sizeof(AutoMounterUsbDeviceInfo) == 944);
 static_assert(offsetof(AutoMounterUsbDeviceInfo, data0) == 150);
 static_assert(offsetof(AutoMounterUsbDeviceInfo, data0Size) == 408);
diff --git a/core/libs/prx/libSceAutoMounterClient/include/Api.hpp b/core/libs/prx/libSceAutoMounterClient/include/Api.hpp
new file mode 100644
index 0000000000..766f754f18
--- /dev/null
+++ b/core/libs/prx/libSceAutoMounterClient/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct AutoMounterUsbDeviceInfo {
+    char deviceName[128];
+    std::byte metadata[22];
+    std::byte data0[256];
+    std::byte padding[2];
+    std::uint64_t data0Size;
+    std::byte data1[256];
+    std::uint64_t data1Size;
+    std::byte data2[256];
+    std::uint64_t data2Size;
+};
+
+extern "C" {
+
+int APS5_VABI sceAutoMounterClientGetUsbDeviceInfo(const char* deviceName, AutoMounterUsbDeviceInfo* info);
+int APS5_VABI sceAutoMounterClientGetUsbDeviceList(char (*deviceNames)[64], std::int32_t* count);
+int APS5_VABI sceAutoMounterClientInit(PthreadAttr* threadAttr);
+int APS5_VABI sceAutoMounterClientRegisterCallback();
+int APS5_VABI sceAutoMounterClientTerm();
+int APS5_VABI sceAutoMounterClientUnregisterCallback();
+
+}
diff --git a/core/libs/prx/libSceAutoMounterClient/libSceAutoMounterClient.hpp b/core/libs/prx/libSceAutoMounterClient/libSceAutoMounterClient.hpp
new file mode 100644
index 0000000000..dd1e89097a
--- /dev/null
+++ b/core/libs/prx/libSceAutoMounterClient/libSceAutoMounterClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAutoMounterClient/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvPlayer.native/Export.cpp b/core/libs/prx/libSceAvPlayer.native/Export.cpp
index 2584dda091..3834e0cfb5 100644
--- a/core/libs/prx/libSceAvPlayer.native/Export.cpp
+++ b/core/libs/prx/libSceAvPlayer.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayer.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAvPlayer.native/include/Api.hpp b/core/libs/prx/libSceAvPlayer.native/include/Api.hpp
new file mode 100644
index 0000000000..bb1e1f40dc
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer.native/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAvPlayerPrintf(void);
+int APS5_VABI sceAvPlayerVprintf(void);
+
+}
diff --git a/core/libs/prx/libSceAvPlayer.native/libSceAvPlayer.native.hpp b/core/libs/prx/libSceAvPlayer.native/libSceAvPlayer.native.hpp
new file mode 100644
index 0000000000..589a07f273
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer.native/libSceAvPlayer.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvPlayer.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvPlayer/Export.cpp b/core/libs/prx/libSceAvPlayer/Export.cpp
index 93d3d8fb0f..a580ff2899 100644
--- a/core/libs/prx/libSceAvPlayer/Export.cpp
+++ b/core/libs/prx/libSceAvPlayer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayer/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -198,5 +199,28 @@ void SetAvPlayerClockForTest_nid_no_patch(AvPlayerInternal* h, double millisecon
     if (h) ToPlayer(h)->SetClockTimeForTest(milliseconds);
 }
 
+void HoldAvPlayerAudioEofForTest_nid_no_patch(AvPlayerInternal* h, bool hold) {
+    if (h) ToPlayer(h)->SetHoldAudioEofForTest(hold);
+}
+
+bool AvPlayerAudioEofHeldForTest_nid_no_patch(AvPlayerInternal* h) {
+    return h && ToPlayer(h)->AudioEofHeldForTest();
+}
+
+bool AvPlayerAudioEndedForTest_nid_no_patch(AvPlayerInternal* h) {
+    return h && ToPlayer(h)->AudioEndedForTest();
+}
+
+int QueuedAvPlayerAudioForTest_nid_no_patch(AvPlayerInternal* h) {
+    return h ? ToPlayer(h)->QueuedAudioForTest() : 0;
+}
+
+bool NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(AvPlayerInternal* h, std::uint64_t* timestamp) {
+    std::uint64_t value = 0;
+    if (!h || !timestamp || !ToPlayer(h)->NextQueuedAudioTimestampForTest(value)) return false;
+    *timestamp = value;
+    return true;
+}
+
 }
 #pragma GCC visibility pop
diff --git a/core/libs/prx/libSceAvPlayer/include/Api.hpp b/core/libs/prx/libSceAvPlayer/include/Api.hpp
new file mode 100644
index 0000000000..ac8eb6cf31
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer/include/Api.hpp
@@ -0,0 +1,47 @@
+#pragma once
+
+#include "prx/libSceAvPlayer/include/AvPlayer.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <optional>
+#include <string_view>
+#include <vector>
+
+extern "C" {
+
+int APS5_VABI sceAvPlayerAddSource(AvPlayerInternal* h, const char* filename);
+int APS5_VABI sceAvPlayerAddSourceEx(AvPlayerInternal* h, uint32_t uriType, const AvPlayerSourceDetails* sourceDetails);
+int APS5_VABI sceAvPlayerChangeStream(AvPlayerInternal* h, uint32_t oldStreamId, uint32_t newStreamId);
+int APS5_VABI sceAvPlayerClose(AvPlayerInternal* h);
+uint64_t APS5_VABI sceAvPlayerCurrentTime(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerDisableStream(AvPlayerInternal* h, uint32_t streamId);
+int APS5_VABI sceAvPlayerEnableStream(AvPlayerInternal* h, uint32_t streamId);
+Bool APS5_VABI sceAvPlayerGetAudioData(AvPlayerInternal* h, AvPlayerFrameInfo* audioInfo);
+int APS5_VABI sceAvPlayerGetStreamInfo(AvPlayerInternal* h, uint32_t streamId, AvPlayerStreamInfo* info);
+int APS5_VABI sceAvPlayerGetStreamInfoEx(AvPlayerInternal* h, uint32_t streamId, AvPlayerStreamInfoEx* info);
+Bool APS5_VABI sceAvPlayerGetVideoData(AvPlayerInternal* h, AvPlayerFrameInfo* videoInfo);
+Bool APS5_VABI sceAvPlayerGetVideoDataEx(AvPlayerInternal* h, AvPlayerFrameInfoEx* videoInfo);
+AvPlayerInternal* APS5_VABI sceAvPlayerInit(AvPlayerInitData* init);
+int APS5_VABI sceAvPlayerInitEx(const AvPlayerInitDataEx* initEx, AvPlayerInternal** handle);
+Bool APS5_VABI sceAvPlayerIsActive(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerJumpToTime(AvPlayerInternal* h, uint64_t timeMs);
+int APS5_VABI sceAvPlayerPause(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerPostInit(AvPlayerInternal* h, const AvPlayerPostInitData* postInit);
+int APS5_VABI sceAvPlayerResume(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerSetAvSyncMode(AvPlayerInternal* h, uint32_t syncMode);
+int APS5_VABI sceAvPlayerSetAvailableBandwidth(AvPlayerInternal* h, uint32_t startBandwidth, uint32_t minimumBandwidth, uint32_t maximumBandwidth);
+int APS5_VABI sceAvPlayerSetLogCallback(void* callback, void* userData);
+int APS5_VABI sceAvPlayerSetLooping(AvPlayerInternal* h, Bool loop);
+int APS5_VABI sceAvPlayerSetTrickSpeed(AvPlayerInternal* h, int32_t trickSpeed);
+int APS5_VABI sceAvPlayerStart(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerStartEx(AvPlayerInternal* handle, const AvPlayer::StartInfo* startInfo);
+int APS5_VABI sceAvPlayerStop(AvPlayerInternal* h);
+int APS5_VABI sceAvPlayerStreamCount(AvPlayerInternal* h);
+
+}
diff --git a/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp b/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp
index 1c82453073..4e7f7f7759 100644
--- a/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp
+++ b/core/libs/prx/libSceAvPlayer/include/AvPlayer.hpp
@@ -87,6 +87,11 @@ public:
     virtual std::uint64_t CurrentTime() = 0;
     virtual bool Finished() = 0;
     virtual void SetClockTimeForTest(double milliseconds) = 0;
+    virtual void SetHoldAudioEofForTest(bool hold) = 0;
+    virtual bool AudioEofHeldForTest() = 0;
+    virtual bool AudioEndedForTest() = 0;
+    virtual int QueuedAudioForTest() = 0;
+    virtual bool NextQueuedAudioTimestampForTest(std::uint64_t& timestamp) = 0;
 };
 
 std::unique_ptr<ISource> OpenSource(const SourceSettings& settings, const std::string& path, ISourceEvents& events);
@@ -94,6 +99,11 @@ std::unique_ptr<ISource> OpenSource(const SourceSettings& settings, const std::s
 std::uint32_t DetectSourceType(std::string_view path);
 
 void SetAvPlayerClockForTest_nid_no_patch(AvPlayerInternal* h, double milliseconds);
+void HoldAvPlayerAudioEofForTest_nid_no_patch(AvPlayerInternal* h, bool hold);
+bool AvPlayerAudioEofHeldForTest_nid_no_patch(AvPlayerInternal* h);
+bool AvPlayerAudioEndedForTest_nid_no_patch(AvPlayerInternal* h);
+int QueuedAvPlayerAudioForTest_nid_no_patch(AvPlayerInternal* h);
+bool NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(AvPlayerInternal* h, std::uint64_t* timestamp);
 
 class Player final : public AvPlayerInternal, private ISourceEvents {
 public:
@@ -124,6 +134,11 @@ public:
     bool IsActive();
     std::uint64_t CurrentTime();
     void SetClockTimeForTest(double milliseconds);
+    void SetHoldAudioEofForTest(bool hold);
+    bool AudioEofHeldForTest();
+    bool AudioEndedForTest();
+    int QueuedAudioForTest();
+    bool NextQueuedAudioTimestampForTest(std::uint64_t& timestamp);
 
 private:
     enum class State { Initial, Ready, Play, Pause, Stop, EndOfFile, Error };
diff --git a/core/libs/prx/libSceAvPlayer/libSceAvPlayer.hpp b/core/libs/prx/libSceAvPlayer/libSceAvPlayer.hpp
new file mode 100644
index 0000000000..9a78810578
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayer/libSceAvPlayer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvPlayer/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvPlayer/src/Player.cpp b/core/libs/prx/libSceAvPlayer/src/Player.cpp
index 90c3b57dba..f253ee42f4 100644
--- a/core/libs/prx/libSceAvPlayer/src/Player.cpp
+++ b/core/libs/prx/libSceAvPlayer/src/Player.cpp
@@ -391,4 +391,29 @@ void Player::SetClockTimeForTest(double milliseconds) {
     if (source) source->SetClockTimeForTest(milliseconds);
 }
 
+void Player::SetHoldAudioEofForTest(bool hold) {
+    std::lock_guard lock(mutex);
+    if (source) source->SetHoldAudioEofForTest(hold);
+}
+
+bool Player::AudioEofHeldForTest() {
+    std::lock_guard lock(mutex);
+    return source && source->AudioEofHeldForTest();
+}
+
+bool Player::AudioEndedForTest() {
+    std::lock_guard lock(mutex);
+    return source && source->AudioEndedForTest();
+}
+
+int Player::QueuedAudioForTest() {
+    std::lock_guard lock(mutex);
+    return source ? source->QueuedAudioForTest() : 0;
+}
+
+bool Player::NextQueuedAudioTimestampForTest(std::uint64_t& timestamp) {
+    std::lock_guard lock(mutex);
+    return source && source->NextQueuedAudioTimestampForTest(timestamp);
+}
+
 }
diff --git a/core/libs/prx/libSceAvPlayer/src/Source.cpp b/core/libs/prx/libSceAvPlayer/src/Source.cpp
index 4d31c38f1d..452e4a88c8 100644
--- a/core/libs/prx/libSceAvPlayer/src/Source.cpp
+++ b/core/libs/prx/libSceAvPlayer/src/Source.cpp
@@ -151,6 +151,7 @@ public:
         base = milliseconds;
         wall = std::chrono::steady_clock::now();
         running = true;
+        if (overrideTime >= 0.0) overrideTime = milliseconds;
     }
 
     void Reset(double milliseconds) {
@@ -354,6 +355,9 @@ public:
             audioDriving = false;
             presented = false;
             lastPresented = 0;
+            audioHasTimestamp = false;
+            lastAudioTimestamp = 0.0;
+            reconciledAudioClock = false;
             presentationClock.Reset(static_cast<double>(start));
             for (auto* decoder : {&video, &audio}) {
                 decoder->switchTo = -1;
@@ -444,6 +448,34 @@ public:
         presentationClock.SetOverrideForTest(milliseconds);
     }
 
+    void SetHoldAudioEofForTest(bool hold) override {
+        std::lock_guard lock(mutex);
+        holdAudioEof = hold;
+        condition.notify_all();
+    }
+
+    bool AudioEofHeldForTest() override {
+        std::lock_guard lock(mutex);
+        return audioEofHeld;
+    }
+
+    bool AudioEndedForTest() override {
+        std::lock_guard lock(mutex);
+        return audio.stream >= 0 && audio.ended;
+    }
+
+    int QueuedAudioForTest() override {
+        std::lock_guard lock(mutex);
+        return static_cast<int>(audio.frames.size());
+    }
+
+    bool NextQueuedAudioTimestampForTest(std::uint64_t& timestamp) override {
+        std::lock_guard lock(mutex);
+        if (audio.frames.empty()) return false;
+        timestamp = audio.frames.front().info.timestamp;
+        return true;
+    }
+
     bool GetVideoData(AvPlayerFrameInfoEx& info) override {
         bool taken = false;
         {
@@ -475,6 +507,7 @@ public:
 
     std::uint64_t CurrentTime() override {
         std::lock_guard lock(mutex);
+        reconcileExhaustedAudioClock();
         return clockMillis();
     }
 
@@ -510,6 +543,34 @@ private:
         return duration != 0 ? std::min(milliseconds, duration) : milliseconds;
     }
 
+    bool audioExhausted() const {
+        return audioHasTimestamp && demuxEnded && !reposition && audio.ended && audio.packets.empty() && audio.frames.empty();
+    }
+
+    bool audioClockReconciled() const {
+        return reconciledAudioClock && reconciledAudioEpoch == clockEpoch;
+    }
+
+    void markAudioClockReconciled() {
+        reconciledAudioClock = true;
+        reconciledAudioEpoch = clockEpoch;
+    }
+
+    void reconcileExhaustedAudioClock() {
+        if (!audioDriving || !audioExhausted() || audioClockReconciled()) return;
+        presentationClock.Rebase(lastAudioTimestamp);
+        markAudioClockReconciled();
+    }
+
+    void waitBeforeAudioEof() {
+        std::unique_lock lock(mutex);
+        if (!holdAudioEof || stopping) return;
+        audioEofHeld = true;
+        condition.notify_all();
+        condition.wait(lock, [&] { return stopping || !holdAudioEof; });
+        audioEofHeld = false;
+    }
+
     bool takeVideo(AvPlayerFrameInfoEx& info) {
         if (!started || video.stream < 0 || speed < 0) return false;
         if (speed != NormalSpeed) dropLateAudio();
@@ -542,12 +603,23 @@ private:
         if (!started || paused || audio.stream < 0 || speed != NormalSpeed) return false;
         auto& frames = audio.frames;
         while (!frames.empty() && frames.front().epoch < minEpoch) recycleFront(audio);
-        if (frames.empty()) return false;
+        if (frames.empty()) {
+            reconcileExhaustedAudioClock();
+            return false;
+        }
         const auto epoch = frames.front().epoch;
         present(audio, info);
+        const auto currentClock = presentationClock.Now();
+        const auto timestamp = static_cast<double>(info.timestamp);
+        lastAudioTimestamp = timestamp;
+        audioHasTimestamp = true;
+        const bool drifted = currentClock > timestamp + 50.0 || timestamp > currentClock + 50.0;
+        const bool exhausted = audioExhausted() && !audioClockReconciled();
+        const bool shouldRebase = !audioDriving || epoch > clockEpoch || drifted || exhausted;
         audioDriving = true;
         clockEpoch = std::max(clockEpoch, epoch);
-        presentationClock.Rebase(static_cast<double>(info.timestamp));
+        if (shouldRebase) presentationClock.Rebase(timestamp);
+        if (exhausted) markAudioClockReconciled();
         return true;
     }
 
@@ -795,6 +867,7 @@ private:
                     pushAll(PacketKind::Flush, demuxEpoch, requested->target);
                     demuxEnded = false;
                     audioDriving = false;
+                    reconciledAudioClock = false;
                 }
                 condition.notify_all();
                 if (requested->announce) events.OnWarning(SCE_AVPLAYER_ERROR_WAR_JUMP_COMPLETE);
@@ -889,9 +962,11 @@ private:
                     receiveFrames(decoder, frame);
                     avcodec_flush_buffers(decoder.context);
                 }
+                if (item.kind == PacketKind::End && !decoder.video) waitBeforeAudioEof();
                 std::lock_guard lock(mutex);
                 if (item.kind == PacketKind::End) {
                     decoder.ended = true;
+                    if (!decoder.video) reconcileExhaustedAudioClock();
                 } else {
                     decoder.epoch = item.epoch;
                     decoder.skipBefore = 0;
@@ -1098,6 +1173,12 @@ private:
     std::uint64_t clockEpoch = 0;
     std::deque<std::uint64_t> loopEpochs;
     bool audioDriving = false;
+    bool audioHasTimestamp = false;
+    double lastAudioTimestamp = 0.0;
+    bool reconciledAudioClock = false;
+    std::uint64_t reconciledAudioEpoch = 0;
+    bool holdAudioEof = false;
+    bool audioEofHeld = false;
     bool presented = false;
     std::uint64_t lastPresented = 0;
     Clock presentationClock;
diff --git a/core/libs/prx/libSceAvPlayerStreaming/Export.cpp b/core/libs/prx/libSceAvPlayerStreaming/Export.cpp
index b484bc1af2..ba81d51df8 100644
--- a/core/libs/prx/libSceAvPlayerStreaming/Export.cpp
+++ b/core/libs/prx/libSceAvPlayerStreaming/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayerStreaming/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAvPlayerStreaming/include/Api.hpp b/core/libs/prx/libSceAvPlayerStreaming/include/Api.hpp
new file mode 100644
index 0000000000..0fcaf246ad
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayerStreaming/include/Api.hpp
@@ -0,0 +1,41 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI MvpHttpAbort_nid_postfix(void);
+int APS5_VABI MvpHttpDeInit_nid_postfix(void);
+int APS5_VABI MvpHttpGet_nid_postfix(void);
+int APS5_VABI MvpHttpGetLastError_nid_postfix(void);
+int APS5_VABI MvpHttpHead_nid_postfix(void);
+int APS5_VABI MvpHttpHeadCleanup_nid_postfix(void);
+int APS5_VABI MvpHttpInit_nid_postfix(void);
+int APS5_VABI MvpHttpPost_nid_postfix(void);
+int APS5_VABI MvpHttpSetCert_nid_postfix(void);
+int APS5_VABI MvpHttpSetRecvTimeout_nid_postfix(void);
+int APS5_VABI MvpHttpSetRedirectCb_nid_postfix(void);
+int APS5_VABI sceTsCloseFile(void);
+int APS5_VABI sceTsDisableRepresentation(void);
+int APS5_VABI sceTsEnableRepresentation(void);
+int APS5_VABI sceTsEnableStream(void);
+int APS5_VABI sceTsGetAvailableBW(void);
+int APS5_VABI sceTsGetLiveStatus(void);
+int APS5_VABI sceTsGetNextAuInfo(void);
+int APS5_VABI sceTsGetNextUnitData(void);
+int APS5_VABI sceTsGetRepresentationCount(void);
+int APS5_VABI sceTsGetRepresentationInfo(void);
+int APS5_VABI sceTsGetSeekWindow(void);
+int APS5_VABI sceTsGetStreamInfo(void);
+int APS5_VABI sceTsGetUrlEncryptionType(void);
+int APS5_VABI sceTsJumpPTS(void);
+int APS5_VABI sceTsOpenFile(void);
+int APS5_VABI sceTsOpenFileEx(void);
+int APS5_VABI sceTsReleaseBuffer(void);
+int APS5_VABI sceTsRepresentationIsEnabled(void);
+int APS5_VABI sceTsSetAvailableBW(void);
+int APS5_VABI sceTsSetStartingBW(void);
+int APS5_VABI sceTsStartFileStreaming(void);
+int APS5_VABI sceTsStopFileStreaming(void);
+
+}
diff --git a/core/libs/prx/libSceAvPlayerStreaming/libSceAvPlayerStreaming.hpp b/core/libs/prx/libSceAvPlayerStreaming/libSceAvPlayerStreaming.hpp
new file mode 100644
index 0000000000..b6ecf8bfa3
--- /dev/null
+++ b/core/libs/prx/libSceAvPlayerStreaming/libSceAvPlayerStreaming.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvPlayerStreaming/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvSetting/Export.cpp b/core/libs/prx/libSceAvSetting/Export.cpp
index e53788bea3..1861a92646 100644
--- a/core/libs/prx/libSceAvSetting/Export.cpp
+++ b/core/libs/prx/libSceAvSetting/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvSetting/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceAvSetting/include/Api.hpp b/core/libs/prx/libSceAvSetting/include/Api.hpp
new file mode 100644
index 0000000000..6ce470cc12
--- /dev/null
+++ b/core/libs/prx/libSceAvSetting/include/Api.hpp
@@ -0,0 +1,32 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceAvControlGetPuTypeByMonitorInfo(void);
+int APS5_VABI sceAvControlIsVideoOutModeSupportedByMonitorInfoWithOptions(void);
+int APS5_VABI sceAvControlSetDitherModeForDiag(void);
+int APS5_VABI sceAvControlSetLayoutModeForDiag(void);
+int APS5_VABI sceAvControlSetMonitorFakeMode(void);
+int APS5_VABI sceAvControlGetCurrentOutputSysMode(void);
+int APS5_VABI sceAvControlGetNativeHdmiMonitorInfo(void);
+int APS5_VABI sceAvControlGetRawMonitorInfo(void);
+int APS5_VABI sceAvControlGetKsvList(void);
+int APS5_VABI sceAvControlGetRawEdid(void);
+int APS5_VABI sceAvControlRemoveProcessOutputMode(void);
+int APS5_VABI sceAvControlUpdateDriverStatus(void);
+int APS5_VABI sceAvControlNotifyUmdEvent(void);
+int APS5_VABI sceAvControlAddCallbacksForLnc(void);
+int APS5_VABI sceAvControlAddCallbacksForResourceArbitrator(void);
+int APS5_VABI sceAvControlRemoveCallbacks(void);
+int APS5_VABI sceAvControlCheckCallback(void);
+int APS5_VABI sceAvControlWaitCallback(void);
+int APS5_VABI sceAvControlSetColorMode(void);
+int APS5_VABI sceAvControlCheckMonitorInfoCapability(void);
+int APS5_VABI sceAvControlCheckVideoOutMode(void);
+int APS5_VABI sceAvControlSetCheckoutputMode(void);
+int APS5_VABI sceAvControlSetSystemVideoMode(void);
+int APS5_VABI sceAvControlDebugAddCallbacks(void);
+
+}
diff --git a/core/libs/prx/libSceAvSetting/libSceAvSetting.hpp b/core/libs/prx/libSceAvSetting/libSceAvSetting.hpp
new file mode 100644
index 0000000000..76b2b29473
--- /dev/null
+++ b/core/libs/prx/libSceAvSetting/libSceAvSetting.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceAvSetting/include/Api.hpp"
diff --git a/core/libs/prx/libSceAvcap2/libSceAvcap2.hpp b/core/libs/prx/libSceAvcap2/libSceAvcap2.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAvcap2/libSceAvcap2.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceAvcap2mvr/libSceAvcap2mvr.hpp b/core/libs/prx/libSceAvcap2mvr/libSceAvcap2mvr.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceAvcap2mvr/libSceAvcap2mvr.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceBackupRestoreUtil/Export.cpp b/core/libs/prx/libSceBackupRestoreUtil/Export.cpp
index 77695475b9..a737e30ad8 100644
--- a/core/libs/prx/libSceBackupRestoreUtil/Export.cpp
+++ b/core/libs/prx/libSceBackupRestoreUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBackupRestoreUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceBackupRestoreUtil/include/Api.hpp b/core/libs/prx/libSceBackupRestoreUtil/include/Api.hpp
new file mode 100644
index 0000000000..7851d2c315
--- /dev/null
+++ b/core/libs/prx/libSceBackupRestoreUtil/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceBackupRestoreUtilBackupData();
+int APS5_VABI sceBackupRestoreUtilCancelBackupData();
+int APS5_VABI sceBackupRestoreUtilCancelGetRequiredSize();
+int APS5_VABI sceBackupRestoreUtilCancelGetTitles();
+int APS5_VABI sceBackupRestoreUtilCancelRestoreData();
+int APS5_VABI sceBackupRestoreUtilDeleteBackupData();
+int APS5_VABI sceBackupRestoreUtilGetBackupDataInfo();
+int APS5_VABI sceBackupRestoreUtilGetBackupParam();
+int APS5_VABI sceBackupRestoreUtilGetBackupProgress();
+int APS5_VABI sceBackupRestoreUtilGetRequiredSize();
+int APS5_VABI sceBackupRestoreUtilGetRestoreProgress();
+int APS5_VABI sceBackupRestoreUtilGetTitles();
+int APS5_VABI sceBackupRestoreUtilInitialize();
+int APS5_VABI sceBackupRestoreUtilPrepareBackup();
+int APS5_VABI sceBackupRestoreUtilRestoreData();
+int APS5_VABI sceBackupRestoreUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceBackupRestoreUtil/libSceBackupRestoreUtil.hpp b/core/libs/prx/libSceBackupRestoreUtil/libSceBackupRestoreUtil.hpp
new file mode 100644
index 0000000000..357f0a92c0
--- /dev/null
+++ b/core/libs/prx/libSceBackupRestoreUtil/libSceBackupRestoreUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBackupRestoreUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceBeisobmf/Export.cpp b/core/libs/prx/libSceBeisobmf/Export.cpp
index a2eee1a93d..31c0e4b2fe 100644
--- a/core/libs/prx/libSceBeisobmf/Export.cpp
+++ b/core/libs/prx/libSceBeisobmf/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBeisobmf/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceBeisobmf/include/Api.hpp b/core/libs/prx/libSceBeisobmf/include/Api.hpp
new file mode 100644
index 0000000000..60bc60a75e
--- /dev/null
+++ b/core/libs/prx/libSceBeisobmf/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI isobmf_box_getchildbox_nid_postfix(void);
+int APS5_VABI isobmf_box_getdiskoffset_nid_postfix(void);
+int APS5_VABI isobmf_box_getflags32b_nid_postfix(void);
+int APS5_VABI isobmf_box_getmember_length_nid_postfix(void);
+int APS5_VABI isobmf_box_getmember_ptr_nid_postfix(void);
+int APS5_VABI isobmf_box_getmember_type_nid_postfix(void);
+int APS5_VABI isobmf_box_getnextbox_nid_postfix(void);
+int APS5_VABI isobmf_box_getstate_nid_postfix(void);
+int APS5_VABI isobmf_box_gettype_nid_postfix(void);
+int APS5_VABI isobmf_decoder_clear_nid_postfix(void);
+int APS5_VABI isobmf_decoder_create_nid_postfix(void);
+int APS5_VABI isobmf_decoder_decode_nid_postfix(void);
+int APS5_VABI isobmf_decoder_destroy_nid_postfix(void);
+int APS5_VABI isobmf_decoder_get_decoder_tree_nid_postfix(void);
+int APS5_VABI isobmf_decoder_getquerydata_nid_postfix(void);
+int APS5_VABI isobmf_decoder_next_disk_offset_nid_postfix(void);
+int APS5_VABI isobmf_decoder_query_nid_postfix(void);
+int APS5_VABI isobmf_memmanager_set_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceBeisobmf/libSceBeisobmf.hpp b/core/libs/prx/libSceBeisobmf/libSceBeisobmf.hpp
new file mode 100644
index 0000000000..7b7de4f4a4
--- /dev/null
+++ b/core/libs/prx/libSceBeisobmf/libSceBeisobmf.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBeisobmf/include/Api.hpp"
diff --git a/core/libs/prx/libSceBemp2sys/Export.cpp b/core/libs/prx/libSceBemp2sys/Export.cpp
index 3bf12ad835..94f4dd4563 100644
--- a/core/libs/prx/libSceBemp2sys/Export.cpp
+++ b/core/libs/prx/libSceBemp2sys/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBemp2sys/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceBemp2sys/include/Api.hpp b/core/libs/prx/libSceBemp2sys/include/Api.hpp
new file mode 100644
index 0000000000..82e55243e5
--- /dev/null
+++ b/core/libs/prx/libSceBemp2sys/include/Api.hpp
@@ -0,0 +1,39 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI bemp2sys_logprintf_getlevel_nid_postfix(void);
+int APS5_VABI bemp2sys_logprintf_setfunc_nid_postfix(void);
+int APS5_VABI bemp2sys_logprintf_setlevel_nid_postfix(void);
+int APS5_VABI bemp2sys_memmanager_set_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_create_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_init_nid_postfix(void);
+int APS5_VABI bemp2sys_packetizer_release_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_create_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_init_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_parse_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_release_nid_postfix(void);
+int APS5_VABI bemp2sys_pesparser_sendmessage_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_create_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_init_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_readpacket_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_release_nid_postfix(void);
+int APS5_VABI bemp2sys_psdecoder_sendmessage_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_create_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_init_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_readpacket_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_release_nid_postfix(void);
+int APS5_VABI bemp2sys_tsdecoder_sendmessage_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_create_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_destroy_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_init_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_release_nid_postfix(void);
+int APS5_VABI bemp2sys_tsfilter_sendmessage_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceBemp2sys/libSceBemp2sys.hpp b/core/libs/prx/libSceBemp2sys/libSceBemp2sys.hpp
new file mode 100644
index 0000000000..23c390341f
--- /dev/null
+++ b/core/libs/prx/libSceBemp2sys/libSceBemp2sys.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBemp2sys/include/Api.hpp"
diff --git a/core/libs/prx/libSceBgft/Export.cpp b/core/libs/prx/libSceBgft/Export.cpp
index 483969400b..2d5833b1d3 100644
--- a/core/libs/prx/libSceBgft/Export.cpp
+++ b/core/libs/prx/libSceBgft/Export.cpp
@@ -1,33 +1,9 @@
+#include "prx/libSceBgft/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct BgftInitParam {
-    void* heap;
-    uint64_t heapSize;
-};
-
-struct BgftProgress;
-struct BgftStorageTaskParam {
-    std::uint32_t value0;
-    std::uint32_t value4;
-    const char* contentId;
-    const char* text16;
-    std::byte unused24[8];
-    const char* text32;
-    const char* text40;
-    const char* text48;
-    std::uint32_t value56;
-    std::byte padding60[4];
-    const char* text64;
-    const char* text72;
-    const char* text80;
-    const char* text88;
-    std::uint64_t value96;
-    std::uint32_t value104;
-};
-
 static_assert(sizeof(BgftStorageTaskParam) == 112);
 static_assert(offsetof(BgftStorageTaskParam, contentId) == 8);
 static_assert(offsetof(BgftStorageTaskParam, text32) == 32);
@@ -373,4 +349,73 @@ int APS5_VABI sceBgftServiceIntUploadUnregisterTaskAll(void) {
     return 0;
 }
 
+int APS5_VABI sceBgftServiceIntDebugPlayGoClearSetFreeZone() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDebugPlayGoIsSetFreeZone() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadCheckPatchUpdateState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadClearStats() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadGetApplicationDataSize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadGetPatchGoProgress() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadHideTask() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadSetResumeState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntDownloadSetStartState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntPlayGoCheckDiscIniChunksInstall() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntPlayGoStartDataDiscInstall() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntSetTaskVisible() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadGetAvailableTaskCount() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadGetTaskInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadHideTask() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadSetStartState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceBgftServiceIntUploadSetUploadError() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceBgft/include/Api.hpp b/core/libs/prx/libSceBgft/include/Api.hpp
new file mode 100644
index 0000000000..484cf37682
--- /dev/null
+++ b/core/libs/prx/libSceBgft/include/Api.hpp
@@ -0,0 +1,124 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct BgftInitParam {
+    void* heap;
+    uint64_t heapSize;
+};
+
+struct BgftProgress;
+
+struct BgftStorageTaskParam {
+    std::uint32_t value0;
+    std::uint32_t value4;
+    const char* contentId;
+    const char* text16;
+    std::byte unused24[8];
+    const char* text32;
+    const char* text40;
+    const char* text48;
+    std::uint32_t value56;
+    std::byte padding60[4];
+    const char* text64;
+    const char* text72;
+    const char* text80;
+    const char* text88;
+    std::uint64_t value96;
+    std::uint32_t value104;
+};
+
+extern "C" {
+
+int APS5_VABI sceBgftServiceInit(const BgftInitParam* params);
+int APS5_VABI sceBgftServiceTerm(void);
+int APS5_VABI sceBgftServiceDownloadPauseTaskAll();
+int APS5_VABI sceBgftServiceDownloadResumeTaskAll();
+int APS5_VABI sceBgftServiceDownloadStartTaskAll();
+int APS5_VABI sceBgftServiceDownloadStopTaskAll();
+int APS5_VABI sceBgftServiceDownloadFindActivePatchTask(const char* contentId, int32_t* taskId);
+int APS5_VABI sceBgftServiceDownloadFindActivePupTask(int32_t* taskId);
+int APS5_VABI sceBgftServiceDownloadFindTaskByContentId(const char* contentId, int32_t subType, int32_t* taskId);
+int APS5_VABI sceBgftServiceDownloadGetProgress(int32_t taskId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceDownloadPauseTask(int32_t taskId);
+int APS5_VABI sceBgftServiceDownloadResumeTask(int32_t taskId);
+int APS5_VABI sceBgftServiceDownloadStartTask(int32_t taskId);
+int APS5_VABI sceBgftServiceDownloadStopTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadFindActiveGameAndGameAcTask(const char* contentId, int32_t* taskId);
+int APS5_VABI sceBgftServiceIntDownloadFindActiveTask(const char* contentId, int32_t subType, int32_t* taskId);
+int APS5_VABI sceBgftServiceIntDownloadGetGameAndGameAcProgress(const char* contentId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetPatchProgress();
+int APS5_VABI sceBgftServiceIntDownloadGetPlayGoProgress(const char* contentId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetProgress(int32_t taskId, BgftProgress* progress);
+int APS5_VABI sceBgftServiceIntDownloadGetTaskInfo();
+int APS5_VABI sceBgftServiceIntDownloadPauseTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadRegisterTaskByStorageEx(const BgftStorageTaskParam* params, int32_t* taskId);
+int APS5_VABI sceBgftServiceIntDownloadResumeTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadStopTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadStartTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntDownloadUnregisterTask(int32_t taskId);
+int APS5_VABI sceBgftServiceIntInit(const BgftInitParam* params);
+int APS5_VABI sceBgftServiceDownloadQueryTask(void);
+int APS5_VABI sceBgftServiceIntDebugDownloadCorruptPkg(void);
+int APS5_VABI sceBgftServiceIntDebugDownloadRequest(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoGetPlayGoStatusString(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoIsPaused(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoResume(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoRevertToFullState(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoRevertToInitialState(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoRevertToSnapshot(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoSnapshotByTitleId(void);
+int APS5_VABI sceBgftServiceIntDebugPlayGoSuspend(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugDeleteBgftEnvFile(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugDownloadBgftEnvFile(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugGetBgftEnvInfoString(void);
+int APS5_VABI sceBgftServiceIntDownloadDebugGetStat(void);
+int APS5_VABI sceBgftServiceIntDownloadGetExtUsbUserStorageSize(void);
+int APS5_VABI sceBgftServiceIntDownloadGetUserStorageSize(void);
+int APS5_VABI sceBgftServiceIntDownloadPauseTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadQueryTask(void);
+int APS5_VABI sceBgftServiceIntDownloadRegisterTaskByStorage(void);
+int APS5_VABI sceBgftServiceIntDownloadRestartTask(void);
+int APS5_VABI sceBgftServiceIntDownloadResumeTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadStartTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadStopTaskAll(void);
+int APS5_VABI sceBgftServiceIntDownloadUnregisterTaskAll(void);
+int APS5_VABI sceBgftServiceIntExtUsbCheckActiveDownloadTasks(void);
+int APS5_VABI sceBgftServiceIntGetTaskInfoValueInt(void);
+int APS5_VABI sceBgftServiceIntGetTaskInfoValueString(void);
+int APS5_VABI sceBgftServiceIntGetTaskInfoValueStringIndex(void);
+int APS5_VABI sceBgftServiceIntPlayGoFindTaskId(void);
+int APS5_VABI sceBgftServiceIntPlayGoGetDiscIniChunksInstallProgress(void);
+int APS5_VABI sceBgftServiceIntPlayGoIsPaused(void);
+int APS5_VABI sceBgftServiceIntPlayGoResume(void);
+int APS5_VABI sceBgftServiceIntTerm(void);
+int APS5_VABI sceBgftServiceIntUploadGetProgress(void);
+int APS5_VABI sceBgftServiceIntUploadQueryTask(void);
+int APS5_VABI sceBgftServiceIntUploadRegisterTask(void);
+int APS5_VABI sceBgftServiceIntUploadRestartTask(void);
+int APS5_VABI sceBgftServiceIntUploadStartTask(void);
+int APS5_VABI sceBgftServiceIntUploadStartTaskAll(void);
+int APS5_VABI sceBgftServiceIntUploadStopTask(void);
+int APS5_VABI sceBgftServiceIntUploadStopTaskAll(void);
+int APS5_VABI sceBgftServiceIntUploadUnregisterTask(void);
+int APS5_VABI sceBgftServiceIntUploadUnregisterTaskAll(void);
+
+int APS5_VABI sceBgftServiceIntDebugPlayGoClearSetFreeZone();
+int APS5_VABI sceBgftServiceIntDebugPlayGoIsSetFreeZone();
+int APS5_VABI sceBgftServiceIntDownloadCheckPatchUpdateState();
+int APS5_VABI sceBgftServiceIntDownloadClearStats();
+int APS5_VABI sceBgftServiceIntDownloadGetApplicationDataSize();
+int APS5_VABI sceBgftServiceIntDownloadGetPatchGoProgress();
+int APS5_VABI sceBgftServiceIntDownloadHideTask();
+int APS5_VABI sceBgftServiceIntDownloadSetResumeState();
+int APS5_VABI sceBgftServiceIntDownloadSetStartState();
+int APS5_VABI sceBgftServiceIntPlayGoCheckDiscIniChunksInstall();
+int APS5_VABI sceBgftServiceIntPlayGoStartDataDiscInstall();
+int APS5_VABI sceBgftServiceIntSetTaskVisible();
+int APS5_VABI sceBgftServiceIntUploadGetAvailableTaskCount();
+int APS5_VABI sceBgftServiceIntUploadGetTaskInfo();
+int APS5_VABI sceBgftServiceIntUploadHideTask();
+int APS5_VABI sceBgftServiceIntUploadSetStartState();
+int APS5_VABI sceBgftServiceIntUploadSetUploadError();
+
+}
diff --git a/core/libs/prx/libSceBgft/libSceBgft.hpp b/core/libs/prx/libSceBgft/libSceBgft.hpp
new file mode 100644
index 0000000000..27e9095851
--- /dev/null
+++ b/core/libs/prx/libSceBgft/libSceBgft.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBgft/include/Api.hpp"
diff --git a/core/libs/prx/libSceBgsStorage/libSceBgsStorage.hpp b/core/libs/prx/libSceBgsStorage/libSceBgsStorage.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceBgsStorage/libSceBgsStorage.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceBluetoothHid/Export.cpp b/core/libs/prx/libSceBluetoothHid/Export.cpp
index 63c76ddd55..e1e00be946 100644
--- a/core/libs/prx/libSceBluetoothHid/Export.cpp
+++ b/core/libs/prx/libSceBluetoothHid/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBluetoothHid/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -6,36 +7,6 @@
 #include <string>
 #include <mutex>
 
-struct BluetoothHidThreadParam {
-    std::int32_t priority;
-    std::uint32_t padding;
-    std::uint64_t affinityMask;
-    std::uint32_t reserved;
-    std::uint32_t tailPadding;
-};
-
-struct BluetoothHidParam {
-    const BluetoothHidThreadParam* threadParam;
-    std::uint32_t reserved;
-    std::uint32_t padding;
-};
-
-struct BluetoothHidEvent {
-    std::uint64_t deviceHandle;
-    std::uint16_t vendorId;
-    std::uint16_t productId;
-    std::uint8_t type;
-    std::uint8_t status;
-    std::uint16_t reportSize;
-    std::uint8_t reserved[8];
-    std::uint8_t report[78];
-    std::uint8_t padding[2];
-};
-
-struct BluetoothHidDeviceInfo;
-struct BluetoothHidDeviceName;
-using BluetoothHidCallback = void (APS5_VABI *)(const BluetoothHidEvent*, std::int32_t, void*);
-
 static_assert(sizeof(BluetoothHidThreadParam) == 24);
 static_assert(offsetof(BluetoothHidThreadParam, affinityMask) == 8);
 static_assert(offsetof(BluetoothHidThreadParam, reserved) == 16);
diff --git a/core/libs/prx/libSceBluetoothHid/include/Api.hpp b/core/libs/prx/libSceBluetoothHid/include/Api.hpp
new file mode 100644
index 0000000000..ff0741f33f
--- /dev/null
+++ b/core/libs/prx/libSceBluetoothHid/include/Api.hpp
@@ -0,0 +1,61 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <string>
+
+struct BluetoothHidThreadParam {
+    std::int32_t priority;
+    std::uint32_t padding;
+    std::uint64_t affinityMask;
+    std::uint32_t reserved;
+    std::uint32_t tailPadding;
+};
+
+struct BluetoothHidParam {
+    const BluetoothHidThreadParam* threadParam;
+    std::uint32_t reserved;
+    std::uint32_t padding;
+};
+
+struct BluetoothHidEvent {
+    std::uint64_t deviceHandle;
+    std::uint16_t vendorId;
+    std::uint16_t productId;
+    std::uint8_t type;
+    std::uint8_t status;
+    std::uint16_t reportSize;
+    std::uint8_t reserved[8];
+    std::uint8_t report[78];
+    std::uint8_t padding[2];
+};
+
+struct BluetoothHidDeviceInfo;
+
+struct BluetoothHidDeviceName;
+
+using BluetoothHidCallback = void (APS5_VABI *)(const BluetoothHidEvent*, std::int32_t, void*);
+
+extern "C" {
+
+std::int32_t APS5_VABI sceBluetoothHidInit();
+std::int32_t APS5_VABI sceBluetoothHidRegisterCallback(BluetoothHidCallback callback, void* userData, const BluetoothHidParam* param);
+std::int32_t APS5_VABI sceBluetoothHidUnregisterCallback();
+std::int32_t APS5_VABI sceBluetoothHidRegisterDevice(std::uint16_t vendorId, std::uint16_t productId);
+std::int32_t APS5_VABI sceBluetoothHidUnregisterDevice(std::uint16_t vendorId, std::uint16_t productId);
+int APS5_VABI sceBluetoothHidGetDeviceName(std::uint64_t deviceHandle, BluetoothHidDeviceName* name);
+int APS5_VABI sceBluetoothHidGetInputReport(std::uint64_t deviceHandle, std::uint8_t reportId);
+int APS5_VABI sceBluetoothHidSetOutputReport(std::uint64_t deviceHandle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI sceBluetoothHidDebugGetVersion();
+int APS5_VABI sceBluetoothHidDisconnectDevice(std::int32_t deviceId);
+int APS5_VABI sceBluetoothHidGetDeviceInfo(std::int32_t deviceId, BluetoothHidDeviceInfo* info);
+int APS5_VABI sceBluetoothHidGetFeatureReport(std::uint64_t deviceHandle, std::uint8_t reportId);
+int APS5_VABI sceBluetoothHidGetReportDescriptor(std::uint64_t deviceHandle, void* descriptor, std::size_t size);
+int APS5_VABI sceBluetoothHidInterruptOutput(std::uint64_t deviceHandle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI sceBluetoothHidParamInitialize(BluetoothHidParam* param, const BluetoothHidThreadParam* threadParam);
+int APS5_VABI sceBluetoothHidSetFeatureReport(std::uint64_t deviceHandle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI sceBluetoothHidThreadParamInitialize(BluetoothHidThreadParam* param, std::int32_t priority, std::uint64_t affinityMask);
+
+}
diff --git a/core/libs/prx/libSceBluetoothHid/libSceBluetoothHid.hpp b/core/libs/prx/libSceBluetoothHid/libSceBluetoothHid.hpp
new file mode 100644
index 0000000000..ee177d4896
--- /dev/null
+++ b/core/libs/prx/libSceBluetoothHid/libSceBluetoothHid.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceBluetoothHid/include/Api.hpp"
diff --git a/core/libs/prx/libSceCamera/CMakeLists.txt b/core/libs/prx/libSceCamera/CMakeLists.txt
new file mode 100644
index 0000000000..27f982657d
--- /dev/null
+++ b/core/libs/prx/libSceCamera/CMakeLists.txt
@@ -0,0 +1,21 @@
+add_library(libSceCamera SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceCamera PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceCamera)
+
+if(MINGW)
+    foreach(runtimeLinkFlag IN ITEMS -static-libgcc -static-libstdc++ -static)
+        string(REPLACE "${runtimeLinkFlag}" "" CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS}")
+    endforeach()
+endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_camera_tests ${LIBS_INCLUDE_DIR}/tests/GuestCamera.cpp)
+    target_include_directories(guest_camera_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_camera_tests PRIVATE libSceCamera libc)
+    configure_windows_unwind(guest_camera_tests)
+    add_test(NAME guest_camera COMMAND guest_camera_tests)
+    if(WIN32)
+        set_tests_properties(guest_camera PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceCamera>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceCamera/Export.cpp b/core/libs/prx/libSceCamera/Export.cpp
new file mode 100644
index 0000000000..c4fa002d9d
--- /dev/null
+++ b/core/libs/prx/libSceCamera/Export.cpp
@@ -0,0 +1,595 @@
+#include "prx/libSceCamera/include/Api.hpp"
+#include <cstdint>
+#include <cstddef>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+static constexpr int SCE_CAMERA_ERROR_PARAM = static_cast<int>(0x802E0000);
+
+extern "C" {
+
+int APS5_VABI sceCameraIsAttached(int32_t index) {
+    if (index != 0) return SCE_CAMERA_ERROR_PARAM;
+    return 0;
+}
+
+int APS5_VABI sceCameraOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraClose(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraStart(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraStop(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetFrameData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraIsValidFrameData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraStopByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceIDWithoutOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraInitializeRegistryCalibData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Finalize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetConnectedDeviceAndDriverMode(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2IsAttached(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetTrackerMode(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibDataForEve(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibDataFromDevice(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraIsConnectedForSystem(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetRegister(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetVideoSyncInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetConfigInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAttributeInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetMmapConnectedCount(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibDataFromDeviceForEve(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetVrCaptureInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetCalibDataForEve(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetLensCorrection(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetCalibData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetProcessFocusByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Initialize(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAccGetData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetAttribute(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibrationData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Stop(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioClose(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetProductInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetLensCorrection(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraChangeAppModuleState(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetFrameData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetContrast(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetSaturation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraStartByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Open(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Start(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetLensCorrectionInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraOpenByModuleId(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetCalibrationData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioGetData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetCalibData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraWaitForEveReady(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetRegistryInfo(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioGetData2(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAppModuleFocus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetDefectivePixelCancellation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceID(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetForceActivate(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetFieldOfView(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2IsValidFrameData(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetProcessFocus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetConfig(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDeviceConfigWithoutHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraDeviceOpen(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetUacModeInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetRegister(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetGamma(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraRemoveAppModuleFocus(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetDefectivePixelCancellation(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2Close(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetVideoSync(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraWaitForLukeReady(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetDefectivePixelCancellationInternal(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2GetSharpness(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetDebugStop(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCamera2SetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraIsConfigChangeDone(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetVideoSync(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraAudioReset(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAutoExposureGain(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraSetAutoWhiteBalance(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraGetHue(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceCameraCloseByHandle(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+}
diff --git a/core/libs/prx/libSceCamera/include/Api.hpp b/core/libs/prx/libSceCamera/include/Api.hpp
new file mode 100644
index 0000000000..169844eb58
--- /dev/null
+++ b/core/libs/prx/libSceCamera/include/Api.hpp
@@ -0,0 +1,125 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCameraIsAttached(int32_t index);
+int APS5_VABI sceCameraOpen(void);
+int APS5_VABI sceCameraClose(void);
+int APS5_VABI sceCameraStart(void);
+int APS5_VABI sceCameraStop(void);
+int APS5_VABI sceCameraGetConfig(void);
+int APS5_VABI sceCameraSetConfig(void);
+int APS5_VABI sceCameraSetAttribute(void);
+int APS5_VABI sceCameraGetDeviceInfo(void);
+int APS5_VABI sceCameraGetFrameData(void);
+int APS5_VABI sceCameraIsValidFrameData(void);
+int APS5_VABI sceCameraStopByHandle(void);
+int APS5_VABI sceCameraGetDeviceIDWithoutOpen(void);
+int APS5_VABI sceCameraGetAttribute(void);
+int APS5_VABI sceCameraInitializeRegistryCalibData(void);
+int APS5_VABI sceCamera2GetContrast(void);
+int APS5_VABI sceCamera2Finalize(void);
+int APS5_VABI sceCameraGetConnectedDeviceAndDriverMode(void);
+int APS5_VABI sceCamera2IsAttached(void);
+int APS5_VABI sceCamera2SetSharpness(void);
+int APS5_VABI sceCameraSetTrackerMode(void);
+int APS5_VABI sceCameraSetContrast(void);
+int APS5_VABI sceCameraGetCalibDataForEve(void);
+int APS5_VABI sceCameraGetCalibDataFromDevice(void);
+int APS5_VABI sceCamera2SetContrast(void);
+int APS5_VABI sceCameraIsConnectedForSystem(void);
+int APS5_VABI sceCamera2SetExposureGain(void);
+int APS5_VABI sceCameraSetRegister(void);
+int APS5_VABI sceCameraSetVideoSyncInternal(void);
+int APS5_VABI sceCameraSetConfigInternal(void);
+int APS5_VABI sceCameraSetAttributeInternal(void);
+int APS5_VABI sceCamera2SetWhiteBalance(void);
+int APS5_VABI sceCameraGetMmapConnectedCount(void);
+int APS5_VABI sceCamera2GetSaturation(void);
+int APS5_VABI sceCameraGetDeviceConfig(void);
+int APS5_VABI sceCameraAudioOpen(void);
+int APS5_VABI sceCamera2GetAutoExposureGain(void);
+int APS5_VABI sceCameraGetCalibDataFromDeviceForEve(void);
+int APS5_VABI sceCameraGetWhiteBalance(void);
+int APS5_VABI sceCameraGetVrCaptureInfo(void);
+int APS5_VABI sceCameraSetCalibDataForEve(void);
+int APS5_VABI sceCamera2GetAttribute(void);
+int APS5_VABI sceCameraSetLensCorrection(void);
+int APS5_VABI sceCameraSetCalibData(void);
+int APS5_VABI sceCameraSetProcessFocusByHandle(void);
+int APS5_VABI sceCamera2SetConfig(void);
+int APS5_VABI sceCameraGetExposureGain(void);
+int APS5_VABI sceCameraSetSharpness(void);
+int APS5_VABI sceCamera2Initialize(void);
+int APS5_VABI sceCameraSetHue(void);
+int APS5_VABI sceCameraAccGetData(void);
+int APS5_VABI sceCamera2SetAttribute(void);
+int APS5_VABI sceCameraGetCalibrationData(void);
+int APS5_VABI sceCameraGetSaturation(void);
+int APS5_VABI sceCamera2GetHue(void);
+int APS5_VABI sceCamera2Stop(void);
+int APS5_VABI sceCamera2SetSaturation(void);
+int APS5_VABI sceCamera2GetAutoWhiteBalance(void);
+int APS5_VABI sceCameraAudioClose(void);
+int APS5_VABI sceCameraGetProductInfo(void);
+int APS5_VABI sceCameraGetGamma(void);
+int APS5_VABI sceCameraGetLensCorrection(void);
+int APS5_VABI sceCameraChangeAppModuleState(void);
+int APS5_VABI sceCamera2GetFrameData(void);
+int APS5_VABI sceCameraGetContrast(void);
+int APS5_VABI sceCameraSetSaturation(void);
+int APS5_VABI sceCameraGetSharpness(void);
+int APS5_VABI sceCamera2GetExposureGain(void);
+int APS5_VABI sceCameraStartByHandle(void);
+int APS5_VABI sceCamera2Open(void);
+int APS5_VABI sceCamera2Start(void);
+int APS5_VABI sceCameraSetLensCorrectionInternal(void);
+int APS5_VABI sceCameraOpenByModuleId(void);
+int APS5_VABI sceCamera2GetCalibrationData(void);
+int APS5_VABI sceCameraAudioGetData(void);
+int APS5_VABI sceCamera2SetHue(void);
+int APS5_VABI sceCamera2GetGamma(void);
+int APS5_VABI sceCameraGetCalibData(void);
+int APS5_VABI sceCameraWaitForEveReady(void);
+int APS5_VABI sceCameraGetRegistryInfo(void);
+int APS5_VABI sceCameraAudioGetData2(void);
+int APS5_VABI sceCameraSetAppModuleFocus(void);
+int APS5_VABI sceCameraSetDefectivePixelCancellation(void);
+int APS5_VABI sceCameraGetDeviceID(void);
+int APS5_VABI sceCameraSetForceActivate(void);
+int APS5_VABI sceCameraSetWhiteBalance(void);
+int APS5_VABI sceCamera2GetFieldOfView(void);
+int APS5_VABI sceCamera2IsValidFrameData(void);
+int APS5_VABI sceCameraSetProcessFocus(void);
+int APS5_VABI sceCameraSetGamma(void);
+int APS5_VABI sceCamera2GetConfig(void);
+int APS5_VABI sceCamera2GetWhiteBalance(void);
+int APS5_VABI sceCameraGetDeviceConfigWithoutHandle(void);
+int APS5_VABI sceCameraDeviceOpen(void);
+int APS5_VABI sceCameraSetUacModeInternal(void);
+int APS5_VABI sceCameraGetAutoExposureGain(void);
+int APS5_VABI sceCameraGetRegister(void);
+int APS5_VABI sceCamera2SetGamma(void);
+int APS5_VABI sceCameraRemoveAppModuleFocus(void);
+int APS5_VABI sceCameraGetAutoWhiteBalance(void);
+int APS5_VABI sceCameraGetDefectivePixelCancellation(void);
+int APS5_VABI sceCamera2Close(void);
+int APS5_VABI sceCamera2SetVideoSync(void);
+int APS5_VABI sceCameraWaitForLukeReady(void);
+int APS5_VABI sceCameraSetDefectivePixelCancellationInternal(void);
+int APS5_VABI sceCamera2GetSharpness(void);
+int APS5_VABI sceCamera2SetAutoWhiteBalance(void);
+int APS5_VABI sceCameraSetDebugStop(void);
+int APS5_VABI sceCamera2SetAutoExposureGain(void);
+int APS5_VABI sceCameraIsConfigChangeDone(void);
+int APS5_VABI sceCameraSetExposureGain(void);
+int APS5_VABI sceCameraSetVideoSync(void);
+int APS5_VABI sceCameraAudioReset(void);
+int APS5_VABI sceCameraSetAutoExposureGain(void);
+int APS5_VABI sceCameraSetAutoWhiteBalance(void);
+int APS5_VABI sceCameraGetHue(void);
+int APS5_VABI sceCameraCloseByHandle(void);
+
+}
diff --git a/core/libs/prx/libSceCamera/libSceCamera.hpp b/core/libs/prx/libSceCamera/libSceCamera.hpp
new file mode 100644
index 0000000000..f11c2f4973
--- /dev/null
+++ b/core/libs/prx/libSceCamera/libSceCamera.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCamera/include/Api.hpp"
diff --git a/core/libs/prx/libSceCdlgG2P/Export.cpp b/core/libs/prx/libSceCdlgG2P/Export.cpp
index 43abff189e..a6f7113420 100644
--- a/core/libs/prx/libSceCdlgG2P/Export.cpp
+++ b/core/libs/prx/libSceCdlgG2P/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceCdlgG2P/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
@@ -7,8 +9,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceCdlgG2P/include/Api.hpp b/core/libs/prx/libSceCdlgG2P/include/Api.hpp
new file mode 100644
index 0000000000..5233fb9246
--- /dev/null
+++ b/core/libs/prx/libSceCdlgG2P/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceG2PDialogInitialize(void);
+int APS5_VABI sceG2PDialogOpen(const G2PDialogParam* param);
+int APS5_VABI sceG2PDialogUpdateStatus(void);
+int APS5_VABI sceG2PDialogGetStatus(void);
+int APS5_VABI sceG2PDialogGetResult(CommonDialogResultPrefix* result);
+int APS5_VABI sceG2PDialogClose(void);
+int APS5_VABI sceG2PDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceCdlgG2P/libSceCdlgG2P.hpp b/core/libs/prx/libSceCdlgG2P/libSceCdlgG2P.hpp
new file mode 100644
index 0000000000..b01cc903f1
--- /dev/null
+++ b/core/libs/prx/libSceCdlgG2P/libSceCdlgG2P.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCdlgG2P/include/Api.hpp"
diff --git a/core/libs/prx/libSceCdlgPlayerReview/Export.cpp b/core/libs/prx/libSceCdlgPlayerReview/Export.cpp
index 4db4e1760e..75e23b282e 100644
--- a/core/libs/prx/libSceCdlgPlayerReview/Export.cpp
+++ b/core/libs/prx/libSceCdlgPlayerReview/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceCdlgPlayerReview/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
@@ -5,8 +7,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 std::atomic<int> g_status{0};
 
diff --git a/core/libs/prx/libSceCdlgPlayerReview/include/Api.hpp b/core/libs/prx/libSceCdlgPlayerReview/include/Api.hpp
new file mode 100644
index 0000000000..5951bb3d08
--- /dev/null
+++ b/core/libs/prx/libSceCdlgPlayerReview/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayerReviewDialogInitialize(void);
+int APS5_VABI scePlayerReviewDialogTerminate(void);
+int APS5_VABI scePlayerReviewDialogOpen(const PlayerReviewDialogParam* param);
+int APS5_VABI scePlayerReviewDialogClose(void);
+int APS5_VABI scePlayerReviewDialogGetStatus(void);
+int APS5_VABI scePlayerReviewDialogUpdateStatus(void);
+int APS5_VABI scePlayerReviewDialogGetResult(CommonDialogResultPrefix* result);
+
+}
diff --git a/core/libs/prx/libSceCdlgPlayerReview/libSceCdlgPlayerReview.hpp b/core/libs/prx/libSceCdlgPlayerReview/libSceCdlgPlayerReview.hpp
new file mode 100644
index 0000000000..a7037746d2
--- /dev/null
+++ b/core/libs/prx/libSceCdlgPlayerReview/libSceCdlgPlayerReview.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCdlgPlayerReview/include/Api.hpp"
diff --git a/core/libs/prx/libSceCdlgUtilServer/libSceCdlgUtilServer.hpp b/core/libs/prx/libSceCdlgUtilServer/libSceCdlgUtilServer.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCdlgUtilServer/libSceCdlgUtilServer.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceCesCs-module/libSceCesCs-module.hpp b/core/libs/prx/libSceCesCs-module/libSceCesCs-module.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCesCs-module/libSceCesCs-module.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceCesCs/CMakeLists.txt b/core/libs/prx/libSceCesCs/CMakeLists.txt
index c9d9076534..991387c540 100644
--- a/core/libs/prx/libSceCesCs/CMakeLists.txt
+++ b/core/libs/prx/libSceCesCs/CMakeLists.txt
@@ -25,10 +25,21 @@ if(BUILD_TESTING)
 endif()
 
 if(BUILD_TESTING)
-    foreach(variant IN ITEMS unicode unicode_module)
-        add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesUnicode.cpp)
+    foreach(variant IN ITEMS unicode unicode_module japanese japanese_module wide wide_module chinese chinese_module mbc mbc_module)
+        if(variant MATCHES "^mbc")
+            add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesMbc.cpp)
+        elseif(variant MATCHES "^chinese")
+            add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesChinese.cpp)
+        elseif(variant MATCHES "^wide")
+            add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesWide.cpp)
+        elseif(variant MATCHES "^japanese")
+            add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesJapanese.cpp)
+        else()
+            add_test_executable(guest_ces_${variant}_tests ${LIBS_INCLUDE_DIR}/tests/GuestCesUnicode.cpp)
+        endif()
         target_include_directories(guest_ces_${variant}_tests PRIVATE ${LIBS_INCLUDE_DIR})
-        if(variant STREQUAL "unicode_module")
+        configure_windows_unwind(guest_ces_${variant}_tests)
+        if(variant MATCHES "_module$")
             target_link_libraries(guest_ces_${variant}_tests PRIVATE libSceCesCs-module)
         else()
             target_link_libraries(guest_ces_${variant}_tests PRIVATE libSceCesCs)
@@ -36,7 +47,7 @@ if(BUILD_TESTING)
         add_test(NAME guest_ces_${variant} COMMAND guest_ces_${variant}_tests)
     endforeach()
     if(WIN32)
-        set_tests_properties(guest_ces_unicode guest_ces_unicode_module PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_ces_unicode guest_ces_unicode_module guest_ces_japanese guest_ces_japanese_module guest_ces_wide guest_ces_wide_module guest_ces_chinese guest_ces_chinese_module guest_ces_mbc guest_ces_mbc_module PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceCesCs>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceCesCs/Cp936.hpp b/core/libs/prx/libSceCesCs/Cp936.hpp
new file mode 100644
index 0000000000..09e143d1d0
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/Cp936.hpp
@@ -0,0 +1,262 @@
+#pragma once
+
+#include <cstdint>
+
+namespace Cp936 {
+
+inline constexpr uint16_t TO_UCS2[126 * 190] = {
+    0x4E02, 0x4E04, 0x4E05, 0x4E06, 0x4E0F, 0x4E12, 0x4E17, 0x4E1F, 0x4E20, 0x4E21, 0x4E23, 0x4E26, 0x4E29, 0x4E2E, 0x4E2F, 0x4E31, 0x4E33, 0x4E35, 0x4E37, 0x4E3C, 0x4E40, 0x4E41, 0x4E42, 0x4E44, 0x4E46, 0x4E4A, 0x4E51, 0x4E55, 0x4E57, 0x4E5A, 0x4E5B, 0x4E62, 0x4E63, 0x4E64, 0x4E65, 0x4E67, 0x4E68, 0x4E6A, 0x4E6B, 0x4E6C, 0x4E6D, 0x4E6E, 0x4E6F, 0x4E72, 0x4E74, 0x4E75, 0x4E76, 0x4E77, 0x4E78, 0x4E79, 0x4E7A, 0x4E7B, 0x4E7C, 0x4E7D, 0x4E7F, 0x4E80, 0x4E81, 0x4E82, 0x4E83, 0x4E84, 0x4E85, 0x4E87, 0x4E8A, 0x4E90, 0x4E96, 0x4E97, 0x4E99, 0x4E9C, 0x4E9D, 0x4E9E, 0x4EA3, 0x4EAA, 0x4EAF, 0x4EB0, 0x4EB1, 0x4EB4, 0x4EB6, 0x4EB7, 0x4EB8, 0x4EB9, 0x4EBC, 0x4EBD, 0x4EBE, 0x4EC8, 0x4ECC, 0x4ECF, 0x4ED0, 0x4ED2, 0x4EDA, 0x4EDB, 0x4EDC, 0x4EE0, 0x4EE2, 0x4EE6, 0x4EE7,
+    0x4EE9, 0x4EED, 0x4EEE, 0x4EEF, 0x4EF1, 0x4EF4, 0x4EF8, 0x4EF9, 0x4EFA, 0x4EFC, 0x4EFE, 0x4F00, 0x4F02, 0x4F03, 0x4F04, 0x4F05, 0x4F06, 0x4F07, 0x4F08, 0x4F0B, 0x4F0C, 0x4F12, 0x4F13, 0x4F14, 0x4F15, 0x4F16, 0x4F1C, 0x4F1D, 0x4F21, 0x4F23, 0x4F28, 0x4F29, 0x4F2C, 0x4F2D, 0x4F2E, 0x4F31, 0x4F33, 0x4F35, 0x4F37, 0x4F39, 0x4F3B, 0x4F3E, 0x4F3F, 0x4F40, 0x4F41, 0x4F42, 0x4F44, 0x4F45, 0x4F47, 0x4F48, 0x4F49, 0x4F4A, 0x4F4B, 0x4F4C, 0x4F52, 0x4F54, 0x4F56, 0x4F61, 0x4F62, 0x4F66, 0x4F68, 0x4F6A, 0x4F6B, 0x4F6D, 0x4F6E, 0x4F71, 0x4F72, 0x4F75, 0x4F77, 0x4F78, 0x4F79, 0x4F7A, 0x4F7D, 0x4F80, 0x4F81, 0x4F82, 0x4F85, 0x4F86, 0x4F87, 0x4F8A, 0x4F8C, 0x4F8E, 0x4F90, 0x4F92, 0x4F93, 0x4F95, 0x4F96, 0x4F98, 0x4F99, 0x4F9A, 0x4F9C, 0x4F9E, 0x4F9F, 0x4FA1, 0x4FA2,
+    0x4FA4, 0x4FAB, 0x4FAD, 0x4FB0, 0x4FB1, 0x4FB2, 0x4FB3, 0x4FB4, 0x4FB6, 0x4FB7, 0x4FB8, 0x4FB9, 0x4FBA, 0x4FBB, 0x4FBC, 0x4FBD, 0x4FBE, 0x4FC0, 0x4FC1, 0x4FC2, 0x4FC6, 0x4FC7, 0x4FC8, 0x4FC9, 0x4FCB, 0x4FCC, 0x4FCD, 0x4FD2, 0x4FD3, 0x4FD4, 0x4FD5, 0x4FD6, 0x4FD9, 0x4FDB, 0x4FE0, 0x4FE2, 0x4FE4, 0x4FE5, 0x4FE7, 0x4FEB, 0x4FEC, 0x4FF0, 0x4FF2, 0x4FF4, 0x4FF5, 0x4FF6, 0x4FF7, 0x4FF9, 0x4FFB, 0x4FFC, 0x4FFD, 0x4FFF, 0x5000, 0x5001, 0x5002, 0x5003, 0x5004, 0x5005, 0x5006, 0x5007, 0x5008, 0x5009, 0x500A, 0x500B, 0x500E, 0x5010, 0x5011, 0x5013, 0x5015, 0x5016, 0x5017, 0x501B, 0x501D, 0x501E, 0x5020, 0x5022, 0x5023, 0x5024, 0x5027, 0x502B, 0x502F, 0x5030, 0x5031, 0x5032, 0x5033, 0x5034, 0x5035, 0x5036, 0x5037, 0x5038, 0x5039, 0x503B, 0x503D, 0x503F, 0x5040,
+    0x5041, 0x5042, 0x5044, 0x5045, 0x5046, 0x5049, 0x504A, 0x504B, 0x504D, 0x5050, 0x5051, 0x5052, 0x5053, 0x5054, 0x5056, 0x5057, 0x5058, 0x5059, 0x505B, 0x505D, 0x505E, 0x505F, 0x5060, 0x5061, 0x5062, 0x5063, 0x5064, 0x5066, 0x5067, 0x5068, 0x5069, 0x506A, 0x506B, 0x506D, 0x506E, 0x506F, 0x5070, 0x5071, 0x5072, 0x5073, 0x5074, 0x5075, 0x5078, 0x5079, 0x507A, 0x507C, 0x507D, 0x5081, 0x5082, 0x5083, 0x5084, 0x5086, 0x5087, 0x5089, 0x508A, 0x508B, 0x508C, 0x508E, 0x508F, 0x5090, 0x5091, 0x5092, 0x5093, 0x5094, 0x5095, 0x5096, 0x5097, 0x5098, 0x5099, 0x509A, 0x509B, 0x509C, 0x509D, 0x509E, 0x509F, 0x50A0, 0x50A1, 0x50A2, 0x50A4, 0x50A6, 0x50AA, 0x50AB, 0x50AD, 0x50AE, 0x50AF, 0x50B0, 0x50B1, 0x50B3, 0x50B4, 0x50B5, 0x50B6, 0x50B7, 0x50B8, 0x50B9, 0x50BC,
+    0x50BD, 0x50BE, 0x50BF, 0x50C0, 0x50C1, 0x50C2, 0x50C3, 0x50C4, 0x50C5, 0x50C6, 0x50C7, 0x50C8, 0x50C9, 0x50CA, 0x50CB, 0x50CC, 0x50CD, 0x50CE, 0x50D0, 0x50D1, 0x50D2, 0x50D3, 0x50D4, 0x50D5, 0x50D7, 0x50D8, 0x50D9, 0x50DB, 0x50DC, 0x50DD, 0x50DE, 0x50DF, 0x50E0, 0x50E1, 0x50E2, 0x50E3, 0x50E4, 0x50E5, 0x50E8, 0x50E9, 0x50EA, 0x50EB, 0x50EF, 0x50F0, 0x50F1, 0x50F2, 0x50F4, 0x50F6, 0x50F7, 0x50F8, 0x50F9, 0x50FA, 0x50FC, 0x50FD, 0x50FE, 0x50FF, 0x5100, 0x5101, 0x5102, 0x5103, 0x5104, 0x5105, 0x5108, 0x5109, 0x510A, 0x510C, 0x510D, 0x510E, 0x510F, 0x5110, 0x5111, 0x5113, 0x5114, 0x5115, 0x5116, 0x5117, 0x5118, 0x5119, 0x511A, 0x511B, 0x511C, 0x511D, 0x511E, 0x511F, 0x5120, 0x5122, 0x5123, 0x5124, 0x5125, 0x5126, 0x5127, 0x5128, 0x5129, 0x512A, 0x512B,
+    0x512C, 0x512D, 0x512E, 0x512F, 0x5130, 0x5131, 0x5132, 0x5133, 0x5134, 0x5135, 0x5136, 0x5137, 0x5138, 0x5139, 0x513A, 0x513B, 0x513C, 0x513D, 0x513E, 0x5142, 0x5147, 0x514A, 0x514C, 0x514E, 0x514F, 0x5150, 0x5152, 0x5153, 0x5157, 0x5158, 0x5159, 0x515B, 0x515D, 0x515E, 0x515F, 0x5160, 0x5161, 0x5163, 0x5164, 0x5166, 0x5167, 0x5169, 0x516A, 0x516F, 0x5172, 0x517A, 0x517E, 0x517F, 0x5183, 0x5184, 0x5186, 0x5187, 0x518A, 0x518B, 0x518E, 0x518F, 0x5190, 0x5191, 0x5193, 0x5194, 0x5198, 0x519A, 0x519D, 0x519E, 0x519F, 0x51A1, 0x51A3, 0x51A6, 0x51A7, 0x51A8, 0x51A9, 0x51AA, 0x51AD, 0x51AE, 0x51B4, 0x51B8, 0x51B9, 0x51BA, 0x51BE, 0x51BF, 0x51C1, 0x51C2, 0x51C3, 0x51C5, 0x51C8, 0x51CA, 0x51CD, 0x51CE, 0x51D0, 0x51D2, 0x51D3, 0x51D4, 0x51D5, 0x51D6, 0x51D7,
+    0x51D8, 0x51D9, 0x51DA, 0x51DC, 0x51DE, 0x51DF, 0x51E2, 0x51E3, 0x51E5, 0x51E6, 0x51E7, 0x51E8, 0x51E9, 0x51EA, 0x51EC, 0x51EE, 0x51F1, 0x51F2, 0x51F4, 0x51F7, 0x51FE, 0x5204, 0x5205, 0x5209, 0x520B, 0x520C, 0x520F, 0x5210, 0x5213, 0x5214, 0x5215, 0x521C, 0x521E, 0x521F, 0x5221, 0x5222, 0x5223, 0x5225, 0x5226, 0x5227, 0x522A, 0x522C, 0x522F, 0x5231, 0x5232, 0x5234, 0x5235, 0x523C, 0x523E, 0x5244, 0x5245, 0x5246, 0x5247, 0x5248, 0x5249, 0x524B, 0x524E, 0x524F, 0x5252, 0x5253, 0x5255, 0x5257, 0x5258, 0x5259, 0x525A, 0x525B, 0x525D, 0x525F, 0x5260, 0x5262, 0x5263, 0x5264, 0x5266, 0x5268, 0x526B, 0x526C, 0x526D, 0x526E, 0x5270, 0x5271, 0x5273, 0x5274, 0x5275, 0x5276, 0x5277, 0x5278, 0x5279, 0x527A, 0x527B, 0x527C, 0x527E, 0x5280, 0x5283, 0x5284, 0x5285,
+    0x5286, 0x5287, 0x5289, 0x528A, 0x528B, 0x528C, 0x528D, 0x528E, 0x528F, 0x5291, 0x5292, 0x5294, 0x5295, 0x5296, 0x5297, 0x5298, 0x5299, 0x529A, 0x529C, 0x52A4, 0x52A5, 0x52A6, 0x52A7, 0x52AE, 0x52AF, 0x52B0, 0x52B4, 0x52B5, 0x52B6, 0x52B7, 0x52B8, 0x52B9, 0x52BA, 0x52BB, 0x52BC, 0x52BD, 0x52C0, 0x52C1, 0x52C2, 0x52C4, 0x52C5, 0x52C6, 0x52C8, 0x52CA, 0x52CC, 0x52CD, 0x52CE, 0x52CF, 0x52D1, 0x52D3, 0x52D4, 0x52D5, 0x52D7, 0x52D9, 0x52DA, 0x52DB, 0x52DC, 0x52DD, 0x52DE, 0x52E0, 0x52E1, 0x52E2, 0x52E3, 0x52E5, 0x52E6, 0x52E7, 0x52E8, 0x52E9, 0x52EA, 0x52EB, 0x52EC, 0x52ED, 0x52EE, 0x52EF, 0x52F1, 0x52F2, 0x52F3, 0x52F4, 0x52F5, 0x52F6, 0x52F7, 0x52F8, 0x52FB, 0x52FC, 0x52FD, 0x5301, 0x5302, 0x5303, 0x5304, 0x5307, 0x5309, 0x530A, 0x530B, 0x530C, 0x530E,
+    0x5311, 0x5312, 0x5313, 0x5314, 0x5318, 0x531B, 0x531C, 0x531E, 0x531F, 0x5322, 0x5324, 0x5325, 0x5327, 0x5328, 0x5329, 0x532B, 0x532C, 0x532D, 0x532F, 0x5330, 0x5331, 0x5332, 0x5333, 0x5334, 0x5335, 0x5336, 0x5337, 0x5338, 0x533C, 0x533D, 0x5340, 0x5342, 0x5344, 0x5346, 0x534B, 0x534C, 0x534D, 0x5350, 0x5354, 0x5358, 0x5359, 0x535B, 0x535D, 0x5365, 0x5368, 0x536A, 0x536C, 0x536D, 0x5372, 0x5376, 0x5379, 0x537B, 0x537C, 0x537D, 0x537E, 0x5380, 0x5381, 0x5383, 0x5387, 0x5388, 0x538A, 0x538E, 0x538F, 0x5390, 0x5391, 0x5392, 0x5393, 0x5394, 0x5396, 0x5397, 0x5399, 0x539B, 0x539C, 0x539E, 0x53A0, 0x53A1, 0x53A4, 0x53A7, 0x53AA, 0x53AB, 0x53AC, 0x53AD, 0x53AF, 0x53B0, 0x53B1, 0x53B2, 0x53B3, 0x53B4, 0x53B5, 0x53B7, 0x53B8, 0x53B9, 0x53BA, 0x53BC, 0x53BD,
+    0x53BE, 0x53C0, 0x53C3, 0x53C4, 0x53C5, 0x53C6, 0x53C7, 0x53CE, 0x53CF, 0x53D0, 0x53D2, 0x53D3, 0x53D5, 0x53DA, 0x53DC, 0x53DD, 0x53DE, 0x53E1, 0x53E2, 0x53E7, 0x53F4, 0x53FA, 0x53FE, 0x53FF, 0x5400, 0x5402, 0x5405, 0x5407, 0x540B, 0x5414, 0x5418, 0x5419, 0x541A, 0x541C, 0x5422, 0x5424, 0x5425, 0x542A, 0x5430, 0x5433, 0x5436, 0x5437, 0x543A, 0x543D, 0x543F, 0x5441, 0x5442, 0x5444, 0x5445, 0x5447, 0x5449, 0x544C, 0x544D, 0x544E, 0x544F, 0x5451, 0x545A, 0x545D, 0x545E, 0x545F, 0x5460, 0x5461, 0x5463, 0x5465, 0x5467, 0x5469, 0x546A, 0x546B, 0x546C, 0x546D, 0x546E, 0x546F, 0x5470, 0x5474, 0x5479, 0x547A, 0x547E, 0x547F, 0x5481, 0x5483, 0x5485, 0x5487, 0x5488, 0x5489, 0x548A, 0x548D, 0x5491, 0x5493, 0x5497, 0x5498, 0x549C, 0x549E, 0x549F, 0x54A0, 0x54A1,
+    0x54A2, 0x54A5, 0x54AE, 0x54B0, 0x54B2, 0x54B5, 0x54B6, 0x54B7, 0x54B9, 0x54BA, 0x54BC, 0x54BE, 0x54C3, 0x54C5, 0x54CA, 0x54CB, 0x54D6, 0x54D8, 0x54DB, 0x54E0, 0x54E1, 0x54E2, 0x54E3, 0x54E4, 0x54EB, 0x54EC, 0x54EF, 0x54F0, 0x54F1, 0x54F4, 0x54F5, 0x54F6, 0x54F7, 0x54F8, 0x54F9, 0x54FB, 0x54FE, 0x5500, 0x5502, 0x5503, 0x5504, 0x5505, 0x5508, 0x550A, 0x550B, 0x550C, 0x550D, 0x550E, 0x5512, 0x5513, 0x5515, 0x5516, 0x5517, 0x5518, 0x5519, 0x551A, 0x551C, 0x551D, 0x551E, 0x551F, 0x5521, 0x5525, 0x5526, 0x5528, 0x5529, 0x552B, 0x552D, 0x5532, 0x5534, 0x5535, 0x5536, 0x5538, 0x5539, 0x553A, 0x553B, 0x553D, 0x5540, 0x5542, 0x5545, 0x5547, 0x5548, 0x554B, 0x554C, 0x554D, 0x554E, 0x554F, 0x5551, 0x5552, 0x5553, 0x5554, 0x5557, 0x5558, 0x5559, 0x555A, 0x555B,
+    0x555D, 0x555E, 0x555F, 0x5560, 0x5562, 0x5563, 0x5568, 0x5569, 0x556B, 0x556F, 0x5570, 0x5571, 0x5572, 0x5573, 0x5574, 0x5579, 0x557A, 0x557D, 0x557F, 0x5585, 0x5586, 0x558C, 0x558D, 0x558E, 0x5590, 0x5592, 0x5593, 0x5595, 0x5596, 0x5597, 0x559A, 0x559B, 0x559E, 0x55A0, 0x55A1, 0x55A2, 0x55A3, 0x55A4, 0x55A5, 0x55A6, 0x55A8, 0x55A9, 0x55AA, 0x55AB, 0x55AC, 0x55AD, 0x55AE, 0x55AF, 0x55B0, 0x55B2, 0x55B4, 0x55B6, 0x55B8, 0x55BA, 0x55BC, 0x55BF, 0x55C0, 0x55C1, 0x55C2, 0x55C3, 0x55C6, 0x55C7, 0x55C8, 0x55CA, 0x55CB, 0x55CE, 0x55CF, 0x55D0, 0x55D5, 0x55D7, 0x55D8, 0x55D9, 0x55DA, 0x55DB, 0x55DE, 0x55E0, 0x55E2, 0x55E7, 0x55E9, 0x55ED, 0x55EE, 0x55F0, 0x55F1, 0x55F4, 0x55F6, 0x55F8, 0x55F9, 0x55FA, 0x55FB, 0x55FC, 0x55FF, 0x5602, 0x5603, 0x5604, 0x5605,
+    0x5606, 0x5607, 0x560A, 0x560B, 0x560D, 0x5610, 0x5611, 0x5612, 0x5613, 0x5614, 0x5615, 0x5616, 0x5617, 0x5619, 0x561A, 0x561C, 0x561D, 0x5620, 0x5621, 0x5622, 0x5625, 0x5626, 0x5628, 0x5629, 0x562A, 0x562B, 0x562E, 0x562F, 0x5630, 0x5633, 0x5635, 0x5637, 0x5638, 0x563A, 0x563C, 0x563D, 0x563E, 0x5640, 0x5641, 0x5642, 0x5643, 0x5644, 0x5645, 0x5646, 0x5647, 0x5648, 0x5649, 0x564A, 0x564B, 0x564F, 0x5650, 0x5651, 0x5652, 0x5653, 0x5655, 0x5656, 0x565A, 0x565B, 0x565D, 0x565E, 0x565F, 0x5660, 0x5661, 0x5663, 0x5665, 0x5666, 0x5667, 0x566D, 0x566E, 0x566F, 0x5670, 0x5672, 0x5673, 0x5674, 0x5675, 0x5677, 0x5678, 0x5679, 0x567A, 0x567D, 0x567E, 0x567F, 0x5680, 0x5681, 0x5682, 0x5683, 0x5684, 0x5687, 0x5688, 0x5689, 0x568A, 0x568B, 0x568C, 0x568D, 0x5690,
+    0x5691, 0x5692, 0x5694, 0x5695, 0x5696, 0x5697, 0x5698, 0x5699, 0x569A, 0x569B, 0x569C, 0x569D, 0x569E, 0x569F, 0x56A0, 0x56A1, 0x56A2, 0x56A4, 0x56A5, 0x56A6, 0x56A7, 0x56A8, 0x56A9, 0x56AA, 0x56AB, 0x56AC, 0x56AD, 0x56AE, 0x56B0, 0x56B1, 0x56B2, 0x56B3, 0x56B4, 0x56B5, 0x56B6, 0x56B8, 0x56B9, 0x56BA, 0x56BB, 0x56BD, 0x56BE, 0x56BF, 0x56C0, 0x56C1, 0x56C2, 0x56C3, 0x56C4, 0x56C5, 0x56C6, 0x56C7, 0x56C8, 0x56C9, 0x56CB, 0x56CC, 0x56CD, 0x56CE, 0x56CF, 0x56D0, 0x56D1, 0x56D2, 0x56D3, 0x56D5, 0x56D6, 0x56D8, 0x56D9, 0x56DC, 0x56E3, 0x56E5, 0x56E6, 0x56E7, 0x56E8, 0x56E9, 0x56EA, 0x56EC, 0x56EE, 0x56EF, 0x56F2, 0x56F3, 0x56F6, 0x56F7, 0x56F8, 0x56FB, 0x56FC, 0x5700, 0x5701, 0x5702, 0x5705, 0x5707, 0x570B, 0x570C, 0x570D, 0x570E, 0x570F, 0x5710, 0x5711,
+    0x5712, 0x5713, 0x5714, 0x5715, 0x5716, 0x5717, 0x5718, 0x5719, 0x571A, 0x571B, 0x571D, 0x571E, 0x5720, 0x5721, 0x5722, 0x5724, 0x5725, 0x5726, 0x5727, 0x572B, 0x5731, 0x5732, 0x5734, 0x5735, 0x5736, 0x5737, 0x5738, 0x573C, 0x573D, 0x573F, 0x5741, 0x5743, 0x5744, 0x5745, 0x5746, 0x5748, 0x5749, 0x574B, 0x5752, 0x5753, 0x5754, 0x5755, 0x5756, 0x5758, 0x5759, 0x5762, 0x5763, 0x5765, 0x5767, 0x576C, 0x576E, 0x5770, 0x5771, 0x5772, 0x5774, 0x5775, 0x5778, 0x5779, 0x577A, 0x577D, 0x577E, 0x577F, 0x5780, 0x5781, 0x5787, 0x5788, 0x5789, 0x578A, 0x578D, 0x578E, 0x578F, 0x5790, 0x5791, 0x5794, 0x5795, 0x5796, 0x5797, 0x5798, 0x5799, 0x579A, 0x579C, 0x579D, 0x579E, 0x579F, 0x57A5, 0x57A8, 0x57AA, 0x57AC, 0x57AF, 0x57B0, 0x57B1, 0x57B3, 0x57B5, 0x57B6, 0x57B7,
+    0x57B9, 0x57BA, 0x57BB, 0x57BC, 0x57BD, 0x57BE, 0x57BF, 0x57C0, 0x57C1, 0x57C4, 0x57C5, 0x57C6, 0x57C7, 0x57C8, 0x57C9, 0x57CA, 0x57CC, 0x57CD, 0x57D0, 0x57D1, 0x57D3, 0x57D6, 0x57D7, 0x57DB, 0x57DC, 0x57DE, 0x57E1, 0x57E2, 0x57E3, 0x57E5, 0x57E6, 0x57E7, 0x57E8, 0x57E9, 0x57EA, 0x57EB, 0x57EC, 0x57EE, 0x57F0, 0x57F1, 0x57F2, 0x57F3, 0x57F5, 0x57F6, 0x57F7, 0x57FB, 0x57FC, 0x57FE, 0x57FF, 0x5801, 0x5803, 0x5804, 0x5805, 0x5808, 0x5809, 0x580A, 0x580C, 0x580E, 0x580F, 0x5810, 0x5812, 0x5813, 0x5814, 0x5816, 0x5817, 0x5818, 0x581A, 0x581B, 0x581C, 0x581D, 0x581F, 0x5822, 0x5823, 0x5825, 0x5826, 0x5827, 0x5828, 0x5829, 0x582B, 0x582C, 0x582D, 0x582E, 0x582F, 0x5831, 0x5832, 0x5833, 0x5834, 0x5836, 0x5837, 0x5838, 0x5839, 0x583A, 0x583B, 0x583C, 0x583D,
+    0x583E, 0x583F, 0x5840, 0x5841, 0x5842, 0x5843, 0x5845, 0x5846, 0x5847, 0x5848, 0x5849, 0x584A, 0x584B, 0x584E, 0x584F, 0x5850, 0x5852, 0x5853, 0x5855, 0x5856, 0x5857, 0x5859, 0x585A, 0x585B, 0x585C, 0x585D, 0x585F, 0x5860, 0x5861, 0x5862, 0x5863, 0x5864, 0x5866, 0x5867, 0x5868, 0x5869, 0x586A, 0x586D, 0x586E, 0x586F, 0x5870, 0x5871, 0x5872, 0x5873, 0x5874, 0x5875, 0x5876, 0x5877, 0x5878, 0x5879, 0x587A, 0x587B, 0x587C, 0x587D, 0x587F, 0x5882, 0x5884, 0x5886, 0x5887, 0x5888, 0x588A, 0x588B, 0x588C, 0x588D, 0x588E, 0x588F, 0x5890, 0x5891, 0x5894, 0x5895, 0x5896, 0x5897, 0x5898, 0x589B, 0x589C, 0x589D, 0x58A0, 0x58A1, 0x58A2, 0x58A3, 0x58A4, 0x58A5, 0x58A6, 0x58A7, 0x58AA, 0x58AB, 0x58AC, 0x58AD, 0x58AE, 0x58AF, 0x58B0, 0x58B1, 0x58B2, 0x58B3, 0x58B4,
+    0x58B5, 0x58B6, 0x58B7, 0x58B8, 0x58B9, 0x58BA, 0x58BB, 0x58BD, 0x58BE, 0x58BF, 0x58C0, 0x58C2, 0x58C3, 0x58C4, 0x58C6, 0x58C7, 0x58C8, 0x58C9, 0x58CA, 0x58CB, 0x58CC, 0x58CD, 0x58CE, 0x58CF, 0x58D0, 0x58D2, 0x58D3, 0x58D4, 0x58D6, 0x58D7, 0x58D8, 0x58D9, 0x58DA, 0x58DB, 0x58DC, 0x58DD, 0x58DE, 0x58DF, 0x58E0, 0x58E1, 0x58E2, 0x58E3, 0x58E5, 0x58E6, 0x58E7, 0x58E8, 0x58E9, 0x58EA, 0x58ED, 0x58EF, 0x58F1, 0x58F2, 0x58F4, 0x58F5, 0x58F7, 0x58F8, 0x58FA, 0x58FB, 0x58FC, 0x58FD, 0x58FE, 0x58FF, 0x5900, 0x5901, 0x5903, 0x5905, 0x5906, 0x5908, 0x5909, 0x590A, 0x590B, 0x590C, 0x590E, 0x5910, 0x5911, 0x5912, 0x5913, 0x5917, 0x5918, 0x591B, 0x591D, 0x591E, 0x5920, 0x5921, 0x5922, 0x5923, 0x5926, 0x5928, 0x592C, 0x5930, 0x5932, 0x5933, 0x5935, 0x5936, 0x593B,
+    0x593D, 0x593E, 0x593F, 0x5940, 0x5943, 0x5945, 0x5946, 0x594A, 0x594C, 0x594D, 0x5950, 0x5952, 0x5953, 0x5959, 0x595B, 0x595C, 0x595D, 0x595E, 0x595F, 0x5961, 0x5963, 0x5964, 0x5966, 0x5967, 0x5968, 0x5969, 0x596A, 0x596B, 0x596C, 0x596D, 0x596E, 0x596F, 0x5970, 0x5971, 0x5972, 0x5975, 0x5977, 0x597A, 0x597B, 0x597C, 0x597E, 0x597F, 0x5980, 0x5985, 0x5989, 0x598B, 0x598C, 0x598E, 0x598F, 0x5990, 0x5991, 0x5994, 0x5995, 0x5998, 0x599A, 0x599B, 0x599C, 0x599D, 0x599F, 0x59A0, 0x59A1, 0x59A2, 0x59A6, 0x59A7, 0x59AC, 0x59AD, 0x59B0, 0x59B1, 0x59B3, 0x59B4, 0x59B5, 0x59B6, 0x59B7, 0x59B8, 0x59BA, 0x59BC, 0x59BD, 0x59BF, 0x59C0, 0x59C1, 0x59C2, 0x59C3, 0x59C4, 0x59C5, 0x59C7, 0x59C8, 0x59C9, 0x59CC, 0x59CD, 0x59CE, 0x59CF, 0x59D5, 0x59D6, 0x59D9, 0x59DB,
+    0x59DE, 0x59DF, 0x59E0, 0x59E1, 0x59E2, 0x59E4, 0x59E6, 0x59E7, 0x59E9, 0x59EA, 0x59EB, 0x59ED, 0x59EE, 0x59EF, 0x59F0, 0x59F1, 0x59F2, 0x59F3, 0x59F4, 0x59F5, 0x59F6, 0x59F7, 0x59F8, 0x59FA, 0x59FC, 0x59FD, 0x59FE, 0x5A00, 0x5A02, 0x5A0A, 0x5A0B, 0x5A0D, 0x5A0E, 0x5A0F, 0x5A10, 0x5A12, 0x5A14, 0x5A15, 0x5A16, 0x5A17, 0x5A19, 0x5A1A, 0x5A1B, 0x5A1D, 0x5A1E, 0x5A21, 0x5A22, 0x5A24, 0x5A26, 0x5A27, 0x5A28, 0x5A2A, 0x5A2B, 0x5A2C, 0x5A2D, 0x5A2E, 0x5A2F, 0x5A30, 0x5A33, 0x5A35, 0x5A37, 0x5A38, 0x5A39, 0x5A3A, 0x5A3B, 0x5A3D, 0x5A3E, 0x5A3F, 0x5A41, 0x5A42, 0x5A43, 0x5A44, 0x5A45, 0x5A47, 0x5A48, 0x5A4B, 0x5A4C, 0x5A4D, 0x5A4E, 0x5A4F, 0x5A50, 0x5A51, 0x5A52, 0x5A53, 0x5A54, 0x5A56, 0x5A57, 0x5A58, 0x5A59, 0x5A5B, 0x5A5C, 0x5A5D, 0x5A5E, 0x5A5F, 0x5A60,
+    0x5A61, 0x5A63, 0x5A64, 0x5A65, 0x5A66, 0x5A68, 0x5A69, 0x5A6B, 0x5A6C, 0x5A6D, 0x5A6E, 0x5A6F, 0x5A70, 0x5A71, 0x5A72, 0x5A73, 0x5A78, 0x5A79, 0x5A7B, 0x5A7C, 0x5A7D, 0x5A7E, 0x5A80, 0x5A81, 0x5A82, 0x5A83, 0x5A84, 0x5A85, 0x5A86, 0x5A87, 0x5A88, 0x5A89, 0x5A8A, 0x5A8B, 0x5A8C, 0x5A8D, 0x5A8E, 0x5A8F, 0x5A90, 0x5A91, 0x5A93, 0x5A94, 0x5A95, 0x5A96, 0x5A97, 0x5A98, 0x5A99, 0x5A9C, 0x5A9D, 0x5A9E, 0x5A9F, 0x5AA0, 0x5AA1, 0x5AA2, 0x5AA3, 0x5AA4, 0x5AA5, 0x5AA6, 0x5AA7, 0x5AA8, 0x5AA9, 0x5AAB, 0x5AAC, 0x5AAD, 0x5AAE, 0x5AAF, 0x5AB0, 0x5AB1, 0x5AB4, 0x5AB6, 0x5AB7, 0x5AB9, 0x5ABA, 0x5ABB, 0x5ABC, 0x5ABD, 0x5ABF, 0x5AC0, 0x5AC3, 0x5AC4, 0x5AC5, 0x5AC6, 0x5AC7, 0x5AC8, 0x5ACA, 0x5ACB, 0x5ACD, 0x5ACE, 0x5ACF, 0x5AD0, 0x5AD1, 0x5AD3, 0x5AD5, 0x5AD7, 0x5AD9,
+    0x5ADA, 0x5ADB, 0x5ADD, 0x5ADE, 0x5ADF, 0x5AE2, 0x5AE4, 0x5AE5, 0x5AE7, 0x5AE8, 0x5AEA, 0x5AEC, 0x5AED, 0x5AEE, 0x5AEF, 0x5AF0, 0x5AF2, 0x5AF3, 0x5AF4, 0x5AF5, 0x5AF6, 0x5AF7, 0x5AF8, 0x5AF9, 0x5AFA, 0x5AFB, 0x5AFC, 0x5AFD, 0x5AFE, 0x5AFF, 0x5B00, 0x5B01, 0x5B02, 0x5B03, 0x5B04, 0x5B05, 0x5B06, 0x5B07, 0x5B08, 0x5B0A, 0x5B0B, 0x5B0C, 0x5B0D, 0x5B0E, 0x5B0F, 0x5B10, 0x5B11, 0x5B12, 0x5B13, 0x5B14, 0x5B15, 0x5B18, 0x5B19, 0x5B1A, 0x5B1B, 0x5B1C, 0x5B1D, 0x5B1E, 0x5B1F, 0x5B20, 0x5B21, 0x5B22, 0x5B23, 0x5B24, 0x5B25, 0x5B26, 0x5B27, 0x5B28, 0x5B29, 0x5B2A, 0x5B2B, 0x5B2C, 0x5B2D, 0x5B2E, 0x5B2F, 0x5B30, 0x5B31, 0x5B33, 0x5B35, 0x5B36, 0x5B38, 0x5B39, 0x5B3A, 0x5B3B, 0x5B3C, 0x5B3D, 0x5B3E, 0x5B3F, 0x5B41, 0x5B42, 0x5B43, 0x5B44, 0x5B45, 0x5B46, 0x5B47,
+    0x5B48, 0x5B49, 0x5B4A, 0x5B4B, 0x5B4C, 0x5B4D, 0x5B4E, 0x5B4F, 0x5B52, 0x5B56, 0x5B5E, 0x5B60, 0x5B61, 0x5B67, 0x5B68, 0x5B6B, 0x5B6D, 0x5B6E, 0x5B6F, 0x5B72, 0x5B74, 0x5B76, 0x5B77, 0x5B78, 0x5B79, 0x5B7B, 0x5B7C, 0x5B7E, 0x5B7F, 0x5B82, 0x5B86, 0x5B8A, 0x5B8D, 0x5B8E, 0x5B90, 0x5B91, 0x5B92, 0x5B94, 0x5B96, 0x5B9F, 0x5BA7, 0x5BA8, 0x5BA9, 0x5BAC, 0x5BAD, 0x5BAE, 0x5BAF, 0x5BB1, 0x5BB2, 0x5BB7, 0x5BBA, 0x5BBB, 0x5BBC, 0x5BC0, 0x5BC1, 0x5BC3, 0x5BC8, 0x5BC9, 0x5BCA, 0x5BCB, 0x5BCD, 0x5BCE, 0x5BCF, 0x5BD1, 0x5BD4, 0x5BD5, 0x5BD6, 0x5BD7, 0x5BD8, 0x5BD9, 0x5BDA, 0x5BDB, 0x5BDC, 0x5BE0, 0x5BE2, 0x5BE3, 0x5BE6, 0x5BE7, 0x5BE9, 0x5BEA, 0x5BEB, 0x5BEC, 0x5BED, 0x5BEF, 0x5BF1, 0x5BF2, 0x5BF3, 0x5BF4, 0x5BF5, 0x5BF6, 0x5BF7, 0x5BFD, 0x5BFE, 0x5C00, 0x5C02,
+    0x5C03, 0x5C05, 0x5C07, 0x5C08, 0x5C0B, 0x5C0C, 0x5C0D, 0x5C0E, 0x5C10, 0x5C12, 0x5C13, 0x5C17, 0x5C19, 0x5C1B, 0x5C1E, 0x5C1F, 0x5C20, 0x5C21, 0x5C23, 0x5C26, 0x5C28, 0x5C29, 0x5C2A, 0x5C2B, 0x5C2D, 0x5C2E, 0x5C2F, 0x5C30, 0x5C32, 0x5C33, 0x5C35, 0x5C36, 0x5C37, 0x5C43, 0x5C44, 0x5C46, 0x5C47, 0x5C4C, 0x5C4D, 0x5C52, 0x5C53, 0x5C54, 0x5C56, 0x5C57, 0x5C58, 0x5C5A, 0x5C5B, 0x5C5C, 0x5C5D, 0x5C5F, 0x5C62, 0x5C64, 0x5C67, 0x5C68, 0x5C69, 0x5C6A, 0x5C6B, 0x5C6C, 0x5C6D, 0x5C70, 0x5C72, 0x5C73, 0x5C74, 0x5C75, 0x5C76, 0x5C77, 0x5C78, 0x5C7B, 0x5C7C, 0x5C7D, 0x5C7E, 0x5C80, 0x5C83, 0x5C84, 0x5C85, 0x5C86, 0x5C87, 0x5C89, 0x5C8A, 0x5C8B, 0x5C8E, 0x5C8F, 0x5C92, 0x5C93, 0x5C95, 0x5C9D, 0x5C9E, 0x5C9F, 0x5CA0, 0x5CA1, 0x5CA4, 0x5CA5, 0x5CA6, 0x5CA7, 0x5CA8,
+    0x5CAA, 0x5CAE, 0x5CAF, 0x5CB0, 0x5CB2, 0x5CB4, 0x5CB6, 0x5CB9, 0x5CBA, 0x5CBB, 0x5CBC, 0x5CBE, 0x5CC0, 0x5CC2, 0x5CC3, 0x5CC5, 0x5CC6, 0x5CC7, 0x5CC8, 0x5CC9, 0x5CCA, 0x5CCC, 0x5CCD, 0x5CCE, 0x5CCF, 0x5CD0, 0x5CD1, 0x5CD3, 0x5CD4, 0x5CD5, 0x5CD6, 0x5CD7, 0x5CD8, 0x5CDA, 0x5CDB, 0x5CDC, 0x5CDD, 0x5CDE, 0x5CDF, 0x5CE0, 0x5CE2, 0x5CE3, 0x5CE7, 0x5CE9, 0x5CEB, 0x5CEC, 0x5CEE, 0x5CEF, 0x5CF1, 0x5CF2, 0x5CF3, 0x5CF4, 0x5CF5, 0x5CF6, 0x5CF7, 0x5CF8, 0x5CF9, 0x5CFA, 0x5CFC, 0x5CFD, 0x5CFE, 0x5CFF, 0x5D00, 0x5D01, 0x5D04, 0x5D05, 0x5D08, 0x5D09, 0x5D0A, 0x5D0B, 0x5D0C, 0x5D0D, 0x5D0F, 0x5D10, 0x5D11, 0x5D12, 0x5D13, 0x5D15, 0x5D17, 0x5D18, 0x5D19, 0x5D1A, 0x5D1C, 0x5D1D, 0x5D1F, 0x5D20, 0x5D21, 0x5D22, 0x5D23, 0x5D25, 0x5D28, 0x5D2A, 0x5D2B, 0x5D2C, 0x5D2F,
+    0x5D30, 0x5D31, 0x5D32, 0x5D33, 0x5D35, 0x5D36, 0x5D37, 0x5D38, 0x5D39, 0x5D3A, 0x5D3B, 0x5D3C, 0x5D3F, 0x5D40, 0x5D41, 0x5D42, 0x5D43, 0x5D44, 0x5D45, 0x5D46, 0x5D48, 0x5D49, 0x5D4D, 0x5D4E, 0x5D4F, 0x5D50, 0x5D51, 0x5D52, 0x5D53, 0x5D54, 0x5D55, 0x5D56, 0x5D57, 0x5D59, 0x5D5A, 0x5D5C, 0x5D5E, 0x5D5F, 0x5D60, 0x5D61, 0x5D62, 0x5D63, 0x5D64, 0x5D65, 0x5D66, 0x5D67, 0x5D68, 0x5D6A, 0x5D6D, 0x5D6E, 0x5D70, 0x5D71, 0x5D72, 0x5D73, 0x5D75, 0x5D76, 0x5D77, 0x5D78, 0x5D79, 0x5D7A, 0x5D7B, 0x5D7C, 0x5D7D, 0x5D7E, 0x5D7F, 0x5D80, 0x5D81, 0x5D83, 0x5D84, 0x5D85, 0x5D86, 0x5D87, 0x5D88, 0x5D89, 0x5D8A, 0x5D8B, 0x5D8C, 0x5D8D, 0x5D8E, 0x5D8F, 0x5D90, 0x5D91, 0x5D92, 0x5D93, 0x5D94, 0x5D95, 0x5D96, 0x5D97, 0x5D98, 0x5D9A, 0x5D9B, 0x5D9C, 0x5D9E, 0x5D9F, 0x5DA0,
+    0x5DA1, 0x5DA2, 0x5DA3, 0x5DA4, 0x5DA5, 0x5DA6, 0x5DA7, 0x5DA8, 0x5DA9, 0x5DAA, 0x5DAB, 0x5DAC, 0x5DAD, 0x5DAE, 0x5DAF, 0x5DB0, 0x5DB1, 0x5DB2, 0x5DB3, 0x5DB4, 0x5DB5, 0x5DB6, 0x5DB8, 0x5DB9, 0x5DBA, 0x5DBB, 0x5DBC, 0x5DBD, 0x5DBE, 0x5DBF, 0x5DC0, 0x5DC1, 0x5DC2, 0x5DC3, 0x5DC4, 0x5DC6, 0x5DC7, 0x5DC8, 0x5DC9, 0x5DCA, 0x5DCB, 0x5DCC, 0x5DCE, 0x5DCF, 0x5DD0, 0x5DD1, 0x5DD2, 0x5DD3, 0x5DD4, 0x5DD5, 0x5DD6, 0x5DD7, 0x5DD8, 0x5DD9, 0x5DDA, 0x5DDC, 0x5DDF, 0x5DE0, 0x5DE3, 0x5DE4, 0x5DEA, 0x5DEC, 0x5DED, 0x5DF0, 0x5DF5, 0x5DF6, 0x5DF8, 0x5DF9, 0x5DFA, 0x5DFB, 0x5DFC, 0x5DFF, 0x5E00, 0x5E04, 0x5E07, 0x5E09, 0x5E0A, 0x5E0B, 0x5E0D, 0x5E0E, 0x5E12, 0x5E13, 0x5E17, 0x5E1E, 0x5E1F, 0x5E20, 0x5E21, 0x5E22, 0x5E23, 0x5E24, 0x5E25, 0x5E28, 0x5E29, 0x5E2A, 0x5E2B,
+    0x5E2C, 0x5E2F, 0x5E30, 0x5E32, 0x5E33, 0x5E34, 0x5E35, 0x5E36, 0x5E39, 0x5E3A, 0x5E3E, 0x5E3F, 0x5E40, 0x5E41, 0x5E43, 0x5E46, 0x5E47, 0x5E48, 0x5E49, 0x5E4A, 0x5E4B, 0x5E4D, 0x5E4E, 0x5E4F, 0x5E50, 0x5E51, 0x5E52, 0x5E53, 0x5E56, 0x5E57, 0x5E58, 0x5E59, 0x5E5A, 0x5E5C, 0x5E5D, 0x5E5F, 0x5E60, 0x5E63, 0x5E64, 0x5E65, 0x5E66, 0x5E67, 0x5E68, 0x5E69, 0x5E6A, 0x5E6B, 0x5E6C, 0x5E6D, 0x5E6E, 0x5E6F, 0x5E70, 0x5E71, 0x5E75, 0x5E77, 0x5E79, 0x5E7E, 0x5E81, 0x5E82, 0x5E83, 0x5E85, 0x5E88, 0x5E89, 0x5E8C, 0x5E8D, 0x5E8E, 0x5E92, 0x5E98, 0x5E9B, 0x5E9D, 0x5EA1, 0x5EA2, 0x5EA3, 0x5EA4, 0x5EA8, 0x5EA9, 0x5EAA, 0x5EAB, 0x5EAC, 0x5EAE, 0x5EAF, 0x5EB0, 0x5EB1, 0x5EB2, 0x5EB4, 0x5EBA, 0x5EBB, 0x5EBC, 0x5EBD, 0x5EBF, 0x5EC0, 0x5EC1, 0x5EC2, 0x5EC3, 0x5EC4, 0x5EC5,
+    0x5EC6, 0x5EC7, 0x5EC8, 0x5ECB, 0x5ECC, 0x5ECD, 0x5ECE, 0x5ECF, 0x5ED0, 0x5ED4, 0x5ED5, 0x5ED7, 0x5ED8, 0x5ED9, 0x5EDA, 0x5EDC, 0x5EDD, 0x5EDE, 0x5EDF, 0x5EE0, 0x5EE1, 0x5EE2, 0x5EE3, 0x5EE4, 0x5EE5, 0x5EE6, 0x5EE7, 0x5EE9, 0x5EEB, 0x5EEC, 0x5EED, 0x5EEE, 0x5EEF, 0x5EF0, 0x5EF1, 0x5EF2, 0x5EF3, 0x5EF5, 0x5EF8, 0x5EF9, 0x5EFB, 0x5EFC, 0x5EFD, 0x5F05, 0x5F06, 0x5F07, 0x5F09, 0x5F0C, 0x5F0D, 0x5F0E, 0x5F10, 0x5F12, 0x5F14, 0x5F16, 0x5F19, 0x5F1A, 0x5F1C, 0x5F1D, 0x5F1E, 0x5F21, 0x5F22, 0x5F23, 0x5F24, 0x5F28, 0x5F2B, 0x5F2C, 0x5F2E, 0x5F30, 0x5F32, 0x5F33, 0x5F34, 0x5F35, 0x5F36, 0x5F37, 0x5F38, 0x5F3B, 0x5F3D, 0x5F3E, 0x5F3F, 0x5F41, 0x5F42, 0x5F43, 0x5F44, 0x5F45, 0x5F46, 0x5F47, 0x5F48, 0x5F49, 0x5F4A, 0x5F4B, 0x5F4C, 0x5F4D, 0x5F4E, 0x5F4F, 0x5F51,
+    0x5F54, 0x5F59, 0x5F5A, 0x5F5B, 0x5F5C, 0x5F5E, 0x5F5F, 0x5F60, 0x5F63, 0x5F65, 0x5F67, 0x5F68, 0x5F6B, 0x5F6E, 0x5F6F, 0x5F72, 0x5F74, 0x5F75, 0x5F76, 0x5F78, 0x5F7A, 0x5F7D, 0x5F7E, 0x5F7F, 0x5F83, 0x5F86, 0x5F8D, 0x5F8E, 0x5F8F, 0x5F91, 0x5F93, 0x5F94, 0x5F96, 0x5F9A, 0x5F9B, 0x5F9D, 0x5F9E, 0x5F9F, 0x5FA0, 0x5FA2, 0x5FA3, 0x5FA4, 0x5FA5, 0x5FA6, 0x5FA7, 0x5FA9, 0x5FAB, 0x5FAC, 0x5FAF, 0x5FB0, 0x5FB1, 0x5FB2, 0x5FB3, 0x5FB4, 0x5FB6, 0x5FB8, 0x5FB9, 0x5FBA, 0x5FBB, 0x5FBE, 0x5FBF, 0x5FC0, 0x5FC1, 0x5FC2, 0x5FC7, 0x5FC8, 0x5FCA, 0x5FCB, 0x5FCE, 0x5FD3, 0x5FD4, 0x5FD5, 0x5FDA, 0x5FDB, 0x5FDC, 0x5FDE, 0x5FDF, 0x5FE2, 0x5FE3, 0x5FE5, 0x5FE6, 0x5FE8, 0x5FE9, 0x5FEC, 0x5FEF, 0x5FF0, 0x5FF2, 0x5FF3, 0x5FF4, 0x5FF6, 0x5FF7, 0x5FF9, 0x5FFA, 0x5FFC, 0x6007,
+    0x6008, 0x6009, 0x600B, 0x600C, 0x6010, 0x6011, 0x6013, 0x6017, 0x6018, 0x601A, 0x601E, 0x601F, 0x6022, 0x6023, 0x6024, 0x602C, 0x602D, 0x602E, 0x6030, 0x6031, 0x6032, 0x6033, 0x6034, 0x6036, 0x6037, 0x6038, 0x6039, 0x603A, 0x603D, 0x603E, 0x6040, 0x6044, 0x6045, 0x6046, 0x6047, 0x6048, 0x6049, 0x604A, 0x604C, 0x604E, 0x604F, 0x6051, 0x6053, 0x6054, 0x6056, 0x6057, 0x6058, 0x605B, 0x605C, 0x605E, 0x605F, 0x6060, 0x6061, 0x6065, 0x6066, 0x606E, 0x6071, 0x6072, 0x6074, 0x6075, 0x6077, 0x607E, 0x6080, 0x6081, 0x6082, 0x6085, 0x6086, 0x6087, 0x6088, 0x608A, 0x608B, 0x608E, 0x608F, 0x6090, 0x6091, 0x6093, 0x6095, 0x6097, 0x6098, 0x6099, 0x609C, 0x609E, 0x60A1, 0x60A2, 0x60A4, 0x60A5, 0x60A7, 0x60A9, 0x60AA, 0x60AE, 0x60B0, 0x60B3, 0x60B5, 0x60B6, 0x60B7,
+    0x60B9, 0x60BA, 0x60BD, 0x60BE, 0x60BF, 0x60C0, 0x60C1, 0x60C2, 0x60C3, 0x60C4, 0x60C7, 0x60C8, 0x60C9, 0x60CC, 0x60CD, 0x60CE, 0x60CF, 0x60D0, 0x60D2, 0x60D3, 0x60D4, 0x60D6, 0x60D7, 0x60D9, 0x60DB, 0x60DE, 0x60E1, 0x60E2, 0x60E3, 0x60E4, 0x60E5, 0x60EA, 0x60F1, 0x60F2, 0x60F5, 0x60F7, 0x60F8, 0x60FB, 0x60FC, 0x60FD, 0x60FE, 0x60FF, 0x6102, 0x6103, 0x6104, 0x6105, 0x6107, 0x610A, 0x610B, 0x610C, 0x6110, 0x6111, 0x6112, 0x6113, 0x6114, 0x6116, 0x6117, 0x6118, 0x6119, 0x611B, 0x611C, 0x611D, 0x611E, 0x6121, 0x6122, 0x6125, 0x6128, 0x6129, 0x612A, 0x612C, 0x612D, 0x612E, 0x612F, 0x6130, 0x6131, 0x6132, 0x6133, 0x6134, 0x6135, 0x6136, 0x6137, 0x6138, 0x6139, 0x613A, 0x613B, 0x613C, 0x613D, 0x613E, 0x6140, 0x6141, 0x6142, 0x6143, 0x6144, 0x6145, 0x6146,
+    0x6147, 0x6149, 0x614B, 0x614D, 0x614F, 0x6150, 0x6152, 0x6153, 0x6154, 0x6156, 0x6157, 0x6158, 0x6159, 0x615A, 0x615B, 0x615C, 0x615E, 0x615F, 0x6160, 0x6161, 0x6163, 0x6164, 0x6165, 0x6166, 0x6169, 0x616A, 0x616B, 0x616C, 0x616D, 0x616E, 0x616F, 0x6171, 0x6172, 0x6173, 0x6174, 0x6176, 0x6178, 0x6179, 0x617A, 0x617B, 0x617C, 0x617D, 0x617E, 0x617F, 0x6180, 0x6181, 0x6182, 0x6183, 0x6184, 0x6185, 0x6186, 0x6187, 0x6188, 0x6189, 0x618A, 0x618C, 0x618D, 0x618F, 0x6190, 0x6191, 0x6192, 0x6193, 0x6195, 0x6196, 0x6197, 0x6198, 0x6199, 0x619A, 0x619B, 0x619C, 0x619E, 0x619F, 0x61A0, 0x61A1, 0x61A2, 0x61A3, 0x61A4, 0x61A5, 0x61A6, 0x61AA, 0x61AB, 0x61AD, 0x61AE, 0x61AF, 0x61B0, 0x61B1, 0x61B2, 0x61B3, 0x61B4, 0x61B5, 0x61B6, 0x61B8, 0x61B9, 0x61BA, 0x61BB,
+    0x61BC, 0x61BD, 0x61BF, 0x61C0, 0x61C1, 0x61C3, 0x61C4, 0x61C5, 0x61C6, 0x61C7, 0x61C9, 0x61CC, 0x61CD, 0x61CE, 0x61CF, 0x61D0, 0x61D3, 0x61D5, 0x61D6, 0x61D7, 0x61D8, 0x61D9, 0x61DA, 0x61DB, 0x61DC, 0x61DD, 0x61DE, 0x61DF, 0x61E0, 0x61E1, 0x61E2, 0x61E3, 0x61E4, 0x61E5, 0x61E7, 0x61E8, 0x61E9, 0x61EA, 0x61EB, 0x61EC, 0x61ED, 0x61EE, 0x61EF, 0x61F0, 0x61F1, 0x61F2, 0x61F3, 0x61F4, 0x61F6, 0x61F7, 0x61F8, 0x61F9, 0x61FA, 0x61FB, 0x61FC, 0x61FD, 0x61FE, 0x6200, 0x6201, 0x6202, 0x6203, 0x6204, 0x6205, 0x6207, 0x6209, 0x6213, 0x6214, 0x6219, 0x621C, 0x621D, 0x621E, 0x6220, 0x6223, 0x6226, 0x6227, 0x6228, 0x6229, 0x622B, 0x622D, 0x622F, 0x6230, 0x6231, 0x6232, 0x6235, 0x6236, 0x6238, 0x6239, 0x623A, 0x623B, 0x623C, 0x6242, 0x6244, 0x6245, 0x6246, 0x624A,
+    0x624F, 0x6250, 0x6255, 0x6256, 0x6257, 0x6259, 0x625A, 0x625C, 0x625D, 0x625E, 0x625F, 0x6260, 0x6261, 0x6262, 0x6264, 0x6265, 0x6268, 0x6271, 0x6272, 0x6274, 0x6275, 0x6277, 0x6278, 0x627A, 0x627B, 0x627D, 0x6281, 0x6282, 0x6283, 0x6285, 0x6286, 0x6287, 0x6288, 0x628B, 0x628C, 0x628D, 0x628E, 0x628F, 0x6290, 0x6294, 0x6299, 0x629C, 0x629D, 0x629E, 0x62A3, 0x62A6, 0x62A7, 0x62A9, 0x62AA, 0x62AD, 0x62AE, 0x62AF, 0x62B0, 0x62B2, 0x62B3, 0x62B4, 0x62B6, 0x62B7, 0x62B8, 0x62BA, 0x62BE, 0x62C0, 0x62C1, 0x62C3, 0x62CB, 0x62CF, 0x62D1, 0x62D5, 0x62DD, 0x62DE, 0x62E0, 0x62E1, 0x62E4, 0x62EA, 0x62EB, 0x62F0, 0x62F2, 0x62F5, 0x62F8, 0x62F9, 0x62FA, 0x62FB, 0x6300, 0x6303, 0x6304, 0x6305, 0x6306, 0x630A, 0x630B, 0x630C, 0x630D, 0x630F, 0x6310, 0x6312, 0x6313,
+    0x6314, 0x6315, 0x6317, 0x6318, 0x6319, 0x631C, 0x6326, 0x6327, 0x6329, 0x632C, 0x632D, 0x632E, 0x6330, 0x6331, 0x6333, 0x6334, 0x6335, 0x6336, 0x6337, 0x6338, 0x633B, 0x633C, 0x633E, 0x633F, 0x6340, 0x6341, 0x6344, 0x6347, 0x6348, 0x634A, 0x6351, 0x6352, 0x6353, 0x6354, 0x6356, 0x6357, 0x6358, 0x6359, 0x635A, 0x635B, 0x635C, 0x635D, 0x6360, 0x6364, 0x6365, 0x6366, 0x6368, 0x636A, 0x636B, 0x636C, 0x636F, 0x6370, 0x6372, 0x6373, 0x6374, 0x6375, 0x6378, 0x6379, 0x637C, 0x637D, 0x637E, 0x637F, 0x6381, 0x6383, 0x6384, 0x6385, 0x6386, 0x638B, 0x638D, 0x6391, 0x6393, 0x6394, 0x6395, 0x6397, 0x6399, 0x639A, 0x639B, 0x639C, 0x639D, 0x639E, 0x639F, 0x63A1, 0x63A4, 0x63A6, 0x63AB, 0x63AF, 0x63B1, 0x63B2, 0x63B5, 0x63B6, 0x63B9, 0x63BB, 0x63BD, 0x63BF, 0x63C0,
+    0x63C1, 0x63C2, 0x63C3, 0x63C5, 0x63C7, 0x63C8, 0x63CA, 0x63CB, 0x63CC, 0x63D1, 0x63D3, 0x63D4, 0x63D5, 0x63D7, 0x63D8, 0x63D9, 0x63DA, 0x63DB, 0x63DC, 0x63DD, 0x63DF, 0x63E2, 0x63E4, 0x63E5, 0x63E6, 0x63E7, 0x63E8, 0x63EB, 0x63EC, 0x63EE, 0x63EF, 0x63F0, 0x63F1, 0x63F3, 0x63F5, 0x63F7, 0x63F9, 0x63FA, 0x63FB, 0x63FC, 0x63FE, 0x6403, 0x6404, 0x6406, 0x6407, 0x6408, 0x6409, 0x640A, 0x640D, 0x640E, 0x6411, 0x6412, 0x6415, 0x6416, 0x6417, 0x6418, 0x6419, 0x641A, 0x641D, 0x641F, 0x6422, 0x6423, 0x6424, 0x6425, 0x6427, 0x6428, 0x6429, 0x642B, 0x642E, 0x642F, 0x6430, 0x6431, 0x6432, 0x6433, 0x6435, 0x6436, 0x6437, 0x6438, 0x6439, 0x643B, 0x643C, 0x643E, 0x6440, 0x6442, 0x6443, 0x6449, 0x644B, 0x644C, 0x644D, 0x644E, 0x644F, 0x6450, 0x6451, 0x6453, 0x6455,
+    0x6456, 0x6457, 0x6459, 0x645A, 0x645B, 0x645C, 0x645D, 0x645F, 0x6460, 0x6461, 0x6462, 0x6463, 0x6464, 0x6465, 0x6466, 0x6468, 0x646A, 0x646B, 0x646C, 0x646E, 0x646F, 0x6470, 0x6471, 0x6472, 0x6473, 0x6474, 0x6475, 0x6476, 0x6477, 0x647B, 0x647C, 0x647D, 0x647E, 0x647F, 0x6480, 0x6481, 0x6483, 0x6486, 0x6488, 0x6489, 0x648A, 0x648B, 0x648C, 0x648D, 0x648E, 0x648F, 0x6490, 0x6493, 0x6494, 0x6497, 0x6498, 0x649A, 0x649B, 0x649C, 0x649D, 0x649F, 0x64A0, 0x64A1, 0x64A2, 0x64A3, 0x64A5, 0x64A6, 0x64A7, 0x64A8, 0x64AA, 0x64AB, 0x64AF, 0x64B1, 0x64B2, 0x64B3, 0x64B4, 0x64B6, 0x64B9, 0x64BB, 0x64BD, 0x64BE, 0x64BF, 0x64C1, 0x64C3, 0x64C4, 0x64C6, 0x64C7, 0x64C8, 0x64C9, 0x64CA, 0x64CB, 0x64CC, 0x64CF, 0x64D1, 0x64D3, 0x64D4, 0x64D5, 0x64D6, 0x64D9, 0x64DA,
+    0x64DB, 0x64DC, 0x64DD, 0x64DF, 0x64E0, 0x64E1, 0x64E3, 0x64E5, 0x64E7, 0x64E8, 0x64E9, 0x64EA, 0x64EB, 0x64EC, 0x64ED, 0x64EE, 0x64EF, 0x64F0, 0x64F1, 0x64F2, 0x64F3, 0x64F4, 0x64F5, 0x64F6, 0x64F7, 0x64F8, 0x64F9, 0x64FA, 0x64FB, 0x64FC, 0x64FD, 0x64FE, 0x64FF, 0x6501, 0x6502, 0x6503, 0x6504, 0x6505, 0x6506, 0x6507, 0x6508, 0x650A, 0x650B, 0x650C, 0x650D, 0x650E, 0x650F, 0x6510, 0x6511, 0x6513, 0x6514, 0x6515, 0x6516, 0x6517, 0x6519, 0x651A, 0x651B, 0x651C, 0x651D, 0x651E, 0x651F, 0x6520, 0x6521, 0x6522, 0x6523, 0x6524, 0x6526, 0x6527, 0x6528, 0x6529, 0x652A, 0x652C, 0x652D, 0x6530, 0x6531, 0x6532, 0x6533, 0x6537, 0x653A, 0x653C, 0x653D, 0x6540, 0x6541, 0x6542, 0x6543, 0x6544, 0x6546, 0x6547, 0x654A, 0x654B, 0x654D, 0x654E, 0x6550, 0x6552, 0x6553,
+    0x6554, 0x6557, 0x6558, 0x655A, 0x655C, 0x655F, 0x6560, 0x6561, 0x6564, 0x6565, 0x6567, 0x6568, 0x6569, 0x656A, 0x656D, 0x656E, 0x656F, 0x6571, 0x6573, 0x6575, 0x6576, 0x6578, 0x6579, 0x657A, 0x657B, 0x657C, 0x657D, 0x657E, 0x657F, 0x6580, 0x6581, 0x6582, 0x6583, 0x6584, 0x6585, 0x6586, 0x6588, 0x6589, 0x658A, 0x658D, 0x658E, 0x658F, 0x6592, 0x6594, 0x6595, 0x6596, 0x6598, 0x659A, 0x659D, 0x659E, 0x65A0, 0x65A2, 0x65A3, 0x65A6, 0x65A8, 0x65AA, 0x65AC, 0x65AE, 0x65B1, 0x65B2, 0x65B3, 0x65B4, 0x65B5, 0x65B6, 0x65B7, 0x65B8, 0x65BA, 0x65BB, 0x65BE, 0x65BF, 0x65C0, 0x65C2, 0x65C7, 0x65C8, 0x65C9, 0x65CA, 0x65CD, 0x65D0, 0x65D1, 0x65D3, 0x65D4, 0x65D5, 0x65D8, 0x65D9, 0x65DA, 0x65DB, 0x65DC, 0x65DD, 0x65DE, 0x65DF, 0x65E1, 0x65E3, 0x65E4, 0x65EA, 0x65EB,
+    0x65F2, 0x65F3, 0x65F4, 0x65F5, 0x65F8, 0x65F9, 0x65FB, 0x65FC, 0x65FD, 0x65FE, 0x65FF, 0x6601, 0x6604, 0x6605, 0x6607, 0x6608, 0x6609, 0x660B, 0x660D, 0x6610, 0x6611, 0x6612, 0x6616, 0x6617, 0x6618, 0x661A, 0x661B, 0x661C, 0x661E, 0x6621, 0x6622, 0x6623, 0x6624, 0x6626, 0x6629, 0x662A, 0x662B, 0x662C, 0x662E, 0x6630, 0x6632, 0x6633, 0x6637, 0x6638, 0x6639, 0x663A, 0x663B, 0x663D, 0x663F, 0x6640, 0x6642, 0x6644, 0x6645, 0x6646, 0x6647, 0x6648, 0x6649, 0x664A, 0x664D, 0x664E, 0x6650, 0x6651, 0x6658, 0x6659, 0x665B, 0x665C, 0x665D, 0x665E, 0x6660, 0x6662, 0x6663, 0x6665, 0x6667, 0x6669, 0x666A, 0x666B, 0x666C, 0x666D, 0x6671, 0x6672, 0x6673, 0x6675, 0x6678, 0x6679, 0x667B, 0x667C, 0x667D, 0x667F, 0x6680, 0x6681, 0x6683, 0x6685, 0x6686, 0x6688, 0x6689,
+    0x668A, 0x668B, 0x668D, 0x668E, 0x668F, 0x6690, 0x6692, 0x6693, 0x6694, 0x6695, 0x6698, 0x6699, 0x669A, 0x669B, 0x669C, 0x669E, 0x669F, 0x66A0, 0x66A1, 0x66A2, 0x66A3, 0x66A4, 0x66A5, 0x66A6, 0x66A9, 0x66AA, 0x66AB, 0x66AC, 0x66AD, 0x66AF, 0x66B0, 0x66B1, 0x66B2, 0x66B3, 0x66B5, 0x66B6, 0x66B7, 0x66B8, 0x66BA, 0x66BB, 0x66BC, 0x66BD, 0x66BF, 0x66C0, 0x66C1, 0x66C2, 0x66C3, 0x66C4, 0x66C5, 0x66C6, 0x66C7, 0x66C8, 0x66C9, 0x66CA, 0x66CB, 0x66CC, 0x66CD, 0x66CE, 0x66CF, 0x66D0, 0x66D1, 0x66D2, 0x66D3, 0x66D4, 0x66D5, 0x66D6, 0x66D7, 0x66D8, 0x66DA, 0x66DE, 0x66DF, 0x66E0, 0x66E1, 0x66E2, 0x66E3, 0x66E4, 0x66E5, 0x66E7, 0x66E8, 0x66EA, 0x66EB, 0x66EC, 0x66ED, 0x66EE, 0x66EF, 0x66F1, 0x66F5, 0x66F6, 0x66F8, 0x66FA, 0x66FB, 0x66FD, 0x6701, 0x6702, 0x6703,
+    0x6704, 0x6705, 0x6706, 0x6707, 0x670C, 0x670E, 0x670F, 0x6711, 0x6712, 0x6713, 0x6716, 0x6718, 0x6719, 0x671A, 0x671C, 0x671E, 0x6720, 0x6721, 0x6722, 0x6723, 0x6724, 0x6725, 0x6727, 0x6729, 0x672E, 0x6730, 0x6732, 0x6733, 0x6736, 0x6737, 0x6738, 0x6739, 0x673B, 0x673C, 0x673E, 0x673F, 0x6741, 0x6744, 0x6745, 0x6747, 0x674A, 0x674B, 0x674D, 0x6752, 0x6754, 0x6755, 0x6757, 0x6758, 0x6759, 0x675A, 0x675B, 0x675D, 0x6762, 0x6763, 0x6764, 0x6766, 0x6767, 0x676B, 0x676C, 0x676E, 0x6771, 0x6774, 0x6776, 0x6778, 0x6779, 0x677A, 0x677B, 0x677D, 0x6780, 0x6782, 0x6783, 0x6785, 0x6786, 0x6788, 0x678A, 0x678C, 0x678D, 0x678E, 0x678F, 0x6791, 0x6792, 0x6793, 0x6794, 0x6796, 0x6799, 0x679B, 0x679F, 0x67A0, 0x67A1, 0x67A4, 0x67A6, 0x67A9, 0x67AC, 0x67AE, 0x67B1,
+    0x67B2, 0x67B4, 0x67B9, 0x67BA, 0x67BB, 0x67BC, 0x67BD, 0x67BE, 0x67BF, 0x67C0, 0x67C2, 0x67C5, 0x67C6, 0x67C7, 0x67C8, 0x67C9, 0x67CA, 0x67CB, 0x67CC, 0x67CD, 0x67CE, 0x67D5, 0x67D6, 0x67D7, 0x67DB, 0x67DF, 0x67E1, 0x67E3, 0x67E4, 0x67E6, 0x67E7, 0x67E8, 0x67EA, 0x67EB, 0x67ED, 0x67EE, 0x67F2, 0x67F5, 0x67F6, 0x67F7, 0x67F8, 0x67F9, 0x67FA, 0x67FB, 0x67FC, 0x67FE, 0x6801, 0x6802, 0x6803, 0x6804, 0x6806, 0x680D, 0x6810, 0x6812, 0x6814, 0x6815, 0x6818, 0x6819, 0x681A, 0x681B, 0x681C, 0x681E, 0x681F, 0x6820, 0x6822, 0x6823, 0x6824, 0x6825, 0x6826, 0x6827, 0x6828, 0x682B, 0x682C, 0x682D, 0x682E, 0x682F, 0x6830, 0x6831, 0x6834, 0x6835, 0x6836, 0x683A, 0x683B, 0x683F, 0x6847, 0x684B, 0x684D, 0x684F, 0x6852, 0x6856, 0x6857, 0x6858, 0x6859, 0x685A, 0x685B,
+    0x685C, 0x685D, 0x685E, 0x685F, 0x686A, 0x686C, 0x686D, 0x686E, 0x686F, 0x6870, 0x6871, 0x6872, 0x6873, 0x6875, 0x6878, 0x6879, 0x687A, 0x687B, 0x687C, 0x687D, 0x687E, 0x687F, 0x6880, 0x6882, 0x6884, 0x6887, 0x6888, 0x6889, 0x688A, 0x688B, 0x688C, 0x688D, 0x688E, 0x6890, 0x6891, 0x6892, 0x6894, 0x6895, 0x6896, 0x6898, 0x6899, 0x689A, 0x689B, 0x689C, 0x689D, 0x689E, 0x689F, 0x68A0, 0x68A1, 0x68A3, 0x68A4, 0x68A5, 0x68A9, 0x68AA, 0x68AB, 0x68AC, 0x68AE, 0x68B1, 0x68B2, 0x68B4, 0x68B6, 0x68B7, 0x68B8, 0x68B9, 0x68BA, 0x68BB, 0x68BC, 0x68BD, 0x68BE, 0x68BF, 0x68C1, 0x68C3, 0x68C4, 0x68C5, 0x68C6, 0x68C7, 0x68C8, 0x68CA, 0x68CC, 0x68CE, 0x68CF, 0x68D0, 0x68D1, 0x68D3, 0x68D4, 0x68D6, 0x68D7, 0x68D9, 0x68DB, 0x68DC, 0x68DD, 0x68DE, 0x68DF, 0x68E1, 0x68E2,
+    0x68E4, 0x68E5, 0x68E6, 0x68E7, 0x68E8, 0x68E9, 0x68EA, 0x68EB, 0x68EC, 0x68ED, 0x68EF, 0x68F2, 0x68F3, 0x68F4, 0x68F6, 0x68F7, 0x68F8, 0x68FB, 0x68FD, 0x68FE, 0x68FF, 0x6900, 0x6902, 0x6903, 0x6904, 0x6906, 0x6907, 0x6908, 0x6909, 0x690A, 0x690C, 0x690F, 0x6911, 0x6913, 0x6914, 0x6915, 0x6916, 0x6917, 0x6918, 0x6919, 0x691A, 0x691B, 0x691C, 0x691D, 0x691E, 0x6921, 0x6922, 0x6923, 0x6925, 0x6926, 0x6927, 0x6928, 0x6929, 0x692A, 0x692B, 0x692C, 0x692E, 0x692F, 0x6931, 0x6932, 0x6933, 0x6935, 0x6936, 0x6937, 0x6938, 0x693A, 0x693B, 0x693C, 0x693E, 0x6940, 0x6941, 0x6943, 0x6944, 0x6945, 0x6946, 0x6947, 0x6948, 0x6949, 0x694A, 0x694B, 0x694C, 0x694D, 0x694E, 0x694F, 0x6950, 0x6951, 0x6952, 0x6953, 0x6955, 0x6956, 0x6958, 0x6959, 0x695B, 0x695C, 0x695F,
+    0x6961, 0x6962, 0x6964, 0x6965, 0x6967, 0x6968, 0x6969, 0x696A, 0x696C, 0x696D, 0x696F, 0x6970, 0x6972, 0x6973, 0x6974, 0x6975, 0x6976, 0x697A, 0x697B, 0x697D, 0x697E, 0x697F, 0x6981, 0x6983, 0x6985, 0x698A, 0x698B, 0x698C, 0x698E, 0x698F, 0x6990, 0x6991, 0x6992, 0x6993, 0x6996, 0x6997, 0x6999, 0x699A, 0x699D, 0x699E, 0x699F, 0x69A0, 0x69A1, 0x69A2, 0x69A3, 0x69A4, 0x69A5, 0x69A6, 0x69A9, 0x69AA, 0x69AC, 0x69AE, 0x69AF, 0x69B0, 0x69B2, 0x69B3, 0x69B5, 0x69B6, 0x69B8, 0x69B9, 0x69BA, 0x69BC, 0x69BD, 0x69BE, 0x69BF, 0x69C0, 0x69C2, 0x69C3, 0x69C4, 0x69C5, 0x69C6, 0x69C7, 0x69C8, 0x69C9, 0x69CB, 0x69CD, 0x69CF, 0x69D1, 0x69D2, 0x69D3, 0x69D5, 0x69D6, 0x69D7, 0x69D8, 0x69D9, 0x69DA, 0x69DC, 0x69DD, 0x69DE, 0x69E1, 0x69E2, 0x69E3, 0x69E4, 0x69E5, 0x69E6,
+    0x69E7, 0x69E8, 0x69E9, 0x69EA, 0x69EB, 0x69EC, 0x69EE, 0x69EF, 0x69F0, 0x69F1, 0x69F3, 0x69F4, 0x69F5, 0x69F6, 0x69F7, 0x69F8, 0x69F9, 0x69FA, 0x69FB, 0x69FC, 0x69FE, 0x6A00, 0x6A01, 0x6A02, 0x6A03, 0x6A04, 0x6A05, 0x6A06, 0x6A07, 0x6A08, 0x6A09, 0x6A0B, 0x6A0C, 0x6A0D, 0x6A0E, 0x6A0F, 0x6A10, 0x6A11, 0x6A12, 0x6A13, 0x6A14, 0x6A15, 0x6A16, 0x6A19, 0x6A1A, 0x6A1B, 0x6A1C, 0x6A1D, 0x6A1E, 0x6A20, 0x6A22, 0x6A23, 0x6A24, 0x6A25, 0x6A26, 0x6A27, 0x6A29, 0x6A2B, 0x6A2C, 0x6A2D, 0x6A2E, 0x6A30, 0x6A32, 0x6A33, 0x6A34, 0x6A36, 0x6A37, 0x6A38, 0x6A39, 0x6A3A, 0x6A3B, 0x6A3C, 0x6A3F, 0x6A40, 0x6A41, 0x6A42, 0x6A43, 0x6A45, 0x6A46, 0x6A48, 0x6A49, 0x6A4A, 0x6A4B, 0x6A4C, 0x6A4D, 0x6A4E, 0x6A4F, 0x6A51, 0x6A52, 0x6A53, 0x6A54, 0x6A55, 0x6A56, 0x6A57, 0x6A5A,
+    0x6A5C, 0x6A5D, 0x6A5E, 0x6A5F, 0x6A60, 0x6A62, 0x6A63, 0x6A64, 0x6A66, 0x6A67, 0x6A68, 0x6A69, 0x6A6A, 0x6A6B, 0x6A6C, 0x6A6D, 0x6A6E, 0x6A6F, 0x6A70, 0x6A72, 0x6A73, 0x6A74, 0x6A75, 0x6A76, 0x6A77, 0x6A78, 0x6A7A, 0x6A7B, 0x6A7D, 0x6A7E, 0x6A7F, 0x6A81, 0x6A82, 0x6A83, 0x6A85, 0x6A86, 0x6A87, 0x6A88, 0x6A89, 0x6A8A, 0x6A8B, 0x6A8C, 0x6A8D, 0x6A8F, 0x6A92, 0x6A93, 0x6A94, 0x6A95, 0x6A96, 0x6A98, 0x6A99, 0x6A9A, 0x6A9B, 0x6A9C, 0x6A9D, 0x6A9E, 0x6A9F, 0x6AA1, 0x6AA2, 0x6AA3, 0x6AA4, 0x6AA5, 0x6AA6, 0x6AA7, 0x6AA8, 0x6AAA, 0x6AAD, 0x6AAE, 0x6AAF, 0x6AB0, 0x6AB1, 0x6AB2, 0x6AB3, 0x6AB4, 0x6AB5, 0x6AB6, 0x6AB7, 0x6AB8, 0x6AB9, 0x6ABA, 0x6ABB, 0x6ABC, 0x6ABD, 0x6ABE, 0x6ABF, 0x6AC0, 0x6AC1, 0x6AC2, 0x6AC3, 0x6AC4, 0x6AC5, 0x6AC6, 0x6AC7, 0x6AC8, 0x6AC9,
+    0x6ACA, 0x6ACB, 0x6ACC, 0x6ACD, 0x6ACE, 0x6ACF, 0x6AD0, 0x6AD1, 0x6AD2, 0x6AD3, 0x6AD4, 0x6AD5, 0x6AD6, 0x6AD7, 0x6AD8, 0x6AD9, 0x6ADA, 0x6ADB, 0x6ADC, 0x6ADD, 0x6ADE, 0x6ADF, 0x6AE0, 0x6AE1, 0x6AE2, 0x6AE3, 0x6AE4, 0x6AE5, 0x6AE6, 0x6AE7, 0x6AE8, 0x6AE9, 0x6AEA, 0x6AEB, 0x6AEC, 0x6AED, 0x6AEE, 0x6AEF, 0x6AF0, 0x6AF1, 0x6AF2, 0x6AF3, 0x6AF4, 0x6AF5, 0x6AF6, 0x6AF7, 0x6AF8, 0x6AF9, 0x6AFA, 0x6AFB, 0x6AFC, 0x6AFD, 0x6AFE, 0x6AFF, 0x6B00, 0x6B01, 0x6B02, 0x6B03, 0x6B04, 0x6B05, 0x6B06, 0x6B07, 0x6B08, 0x6B09, 0x6B0A, 0x6B0B, 0x6B0C, 0x6B0D, 0x6B0E, 0x6B0F, 0x6B10, 0x6B11, 0x6B12, 0x6B13, 0x6B14, 0x6B15, 0x6B16, 0x6B17, 0x6B18, 0x6B19, 0x6B1A, 0x6B1B, 0x6B1C, 0x6B1D, 0x6B1E, 0x6B1F, 0x6B25, 0x6B26, 0x6B28, 0x6B29, 0x6B2A, 0x6B2B, 0x6B2C, 0x6B2D, 0x6B2E,
+    0x6B2F, 0x6B30, 0x6B31, 0x6B33, 0x6B34, 0x6B35, 0x6B36, 0x6B38, 0x6B3B, 0x6B3C, 0x6B3D, 0x6B3F, 0x6B40, 0x6B41, 0x6B42, 0x6B44, 0x6B45, 0x6B48, 0x6B4A, 0x6B4B, 0x6B4D, 0x6B4E, 0x6B4F, 0x6B50, 0x6B51, 0x6B52, 0x6B53, 0x6B54, 0x6B55, 0x6B56, 0x6B57, 0x6B58, 0x6B5A, 0x6B5B, 0x6B5C, 0x6B5D, 0x6B5E, 0x6B5F, 0x6B60, 0x6B61, 0x6B68, 0x6B69, 0x6B6B, 0x6B6C, 0x6B6D, 0x6B6E, 0x6B6F, 0x6B70, 0x6B71, 0x6B72, 0x6B73, 0x6B74, 0x6B75, 0x6B76, 0x6B77, 0x6B78, 0x6B7A, 0x6B7D, 0x6B7E, 0x6B7F, 0x6B80, 0x6B85, 0x6B88, 0x6B8C, 0x6B8E, 0x6B8F, 0x6B90, 0x6B91, 0x6B94, 0x6B95, 0x6B97, 0x6B98, 0x6B99, 0x6B9C, 0x6B9D, 0x6B9E, 0x6B9F, 0x6BA0, 0x6BA2, 0x6BA3, 0x6BA4, 0x6BA5, 0x6BA6, 0x6BA7, 0x6BA8, 0x6BA9, 0x6BAB, 0x6BAC, 0x6BAD, 0x6BAE, 0x6BAF, 0x6BB0, 0x6BB1, 0x6BB2, 0x6BB6,
+    0x6BB8, 0x6BB9, 0x6BBA, 0x6BBB, 0x6BBC, 0x6BBD, 0x6BBE, 0x6BC0, 0x6BC3, 0x6BC4, 0x6BC6, 0x6BC7, 0x6BC8, 0x6BC9, 0x6BCA, 0x6BCC, 0x6BCE, 0x6BD0, 0x6BD1, 0x6BD8, 0x6BDA, 0x6BDC, 0x6BDD, 0x6BDE, 0x6BDF, 0x6BE0, 0x6BE2, 0x6BE3, 0x6BE4, 0x6BE5, 0x6BE6, 0x6BE7, 0x6BE8, 0x6BE9, 0x6BEC, 0x6BED, 0x6BEE, 0x6BF0, 0x6BF1, 0x6BF2, 0x6BF4, 0x6BF6, 0x6BF7, 0x6BF8, 0x6BFA, 0x6BFB, 0x6BFC, 0x6BFE, 0x6BFF, 0x6C00, 0x6C01, 0x6C02, 0x6C03, 0x6C04, 0x6C08, 0x6C09, 0x6C0A, 0x6C0B, 0x6C0C, 0x6C0E, 0x6C12, 0x6C17, 0x6C1C, 0x6C1D, 0x6C1E, 0x6C20, 0x6C23, 0x6C25, 0x6C2B, 0x6C2C, 0x6C2D, 0x6C31, 0x6C33, 0x6C36, 0x6C37, 0x6C39, 0x6C3A, 0x6C3B, 0x6C3C, 0x6C3E, 0x6C3F, 0x6C43, 0x6C44, 0x6C45, 0x6C48, 0x6C4B, 0x6C4C, 0x6C4D, 0x6C4E, 0x6C4F, 0x6C51, 0x6C52, 0x6C53, 0x6C56, 0x6C58,
+    0x6C59, 0x6C5A, 0x6C62, 0x6C63, 0x6C65, 0x6C66, 0x6C67, 0x6C6B, 0x6C6C, 0x6C6D, 0x6C6E, 0x6C6F, 0x6C71, 0x6C73, 0x6C75, 0x6C77, 0x6C78, 0x6C7A, 0x6C7B, 0x6C7C, 0x6C7F, 0x6C80, 0x6C84, 0x6C87, 0x6C8A, 0x6C8B, 0x6C8D, 0x6C8E, 0x6C91, 0x6C92, 0x6C95, 0x6C96, 0x6C97, 0x6C98, 0x6C9A, 0x6C9C, 0x6C9D, 0x6C9E, 0x6CA0, 0x6CA2, 0x6CA8, 0x6CAC, 0x6CAF, 0x6CB0, 0x6CB4, 0x6CB5, 0x6CB6, 0x6CB7, 0x6CBA, 0x6CC0, 0x6CC1, 0x6CC2, 0x6CC3, 0x6CC6, 0x6CC7, 0x6CC8, 0x6CCB, 0x6CCD, 0x6CCE, 0x6CCF, 0x6CD1, 0x6CD2, 0x6CD8, 0x6CD9, 0x6CDA, 0x6CDC, 0x6CDD, 0x6CDF, 0x6CE4, 0x6CE6, 0x6CE7, 0x6CE9, 0x6CEC, 0x6CED, 0x6CF2, 0x6CF4, 0x6CF9, 0x6CFF, 0x6D00, 0x6D02, 0x6D03, 0x6D05, 0x6D06, 0x6D08, 0x6D09, 0x6D0A, 0x6D0D, 0x6D0F, 0x6D10, 0x6D11, 0x6D13, 0x6D14, 0x6D15, 0x6D16, 0x6D18,
+    0x6D1C, 0x6D1D, 0x6D1F, 0x6D20, 0x6D21, 0x6D22, 0x6D23, 0x6D24, 0x6D26, 0x6D28, 0x6D29, 0x6D2C, 0x6D2D, 0x6D2F, 0x6D30, 0x6D34, 0x6D36, 0x6D37, 0x6D38, 0x6D3A, 0x6D3F, 0x6D40, 0x6D42, 0x6D44, 0x6D49, 0x6D4C, 0x6D50, 0x6D55, 0x6D56, 0x6D57, 0x6D58, 0x6D5B, 0x6D5D, 0x6D5F, 0x6D61, 0x6D62, 0x6D64, 0x6D65, 0x6D67, 0x6D68, 0x6D6B, 0x6D6C, 0x6D6D, 0x6D70, 0x6D71, 0x6D72, 0x6D73, 0x6D75, 0x6D76, 0x6D79, 0x6D7A, 0x6D7B, 0x6D7D, 0x6D7E, 0x6D7F, 0x6D80, 0x6D81, 0x6D83, 0x6D84, 0x6D86, 0x6D87, 0x6D8A, 0x6D8B, 0x6D8D, 0x6D8F, 0x6D90, 0x6D92, 0x6D96, 0x6D97, 0x6D98, 0x6D99, 0x6D9A, 0x6D9C, 0x6DA2, 0x6DA5, 0x6DAC, 0x6DAD, 0x6DB0, 0x6DB1, 0x6DB3, 0x6DB4, 0x6DB6, 0x6DB7, 0x6DB9, 0x6DBA, 0x6DBB, 0x6DBC, 0x6DBD, 0x6DBE, 0x6DC1, 0x6DC2, 0x6DC3, 0x6DC8, 0x6DC9, 0x6DCA,
+    0x6DCD, 0x6DCE, 0x6DCF, 0x6DD0, 0x6DD2, 0x6DD3, 0x6DD4, 0x6DD5, 0x6DD7, 0x6DDA, 0x6DDB, 0x6DDC, 0x6DDF, 0x6DE2, 0x6DE3, 0x6DE5, 0x6DE7, 0x6DE8, 0x6DE9, 0x6DEA, 0x6DED, 0x6DEF, 0x6DF0, 0x6DF2, 0x6DF4, 0x6DF5, 0x6DF6, 0x6DF8, 0x6DFA, 0x6DFD, 0x6DFE, 0x6DFF, 0x6E00, 0x6E01, 0x6E02, 0x6E03, 0x6E04, 0x6E06, 0x6E07, 0x6E08, 0x6E09, 0x6E0B, 0x6E0F, 0x6E12, 0x6E13, 0x6E15, 0x6E18, 0x6E19, 0x6E1B, 0x6E1C, 0x6E1E, 0x6E1F, 0x6E22, 0x6E26, 0x6E27, 0x6E28, 0x6E2A, 0x6E2C, 0x6E2E, 0x6E30, 0x6E31, 0x6E33, 0x6E35, 0x6E36, 0x6E37, 0x6E39, 0x6E3B, 0x6E3C, 0x6E3D, 0x6E3E, 0x6E3F, 0x6E40, 0x6E41, 0x6E42, 0x6E45, 0x6E46, 0x6E47, 0x6E48, 0x6E49, 0x6E4A, 0x6E4B, 0x6E4C, 0x6E4F, 0x6E50, 0x6E51, 0x6E52, 0x6E55, 0x6E57, 0x6E59, 0x6E5A, 0x6E5C, 0x6E5D, 0x6E5E, 0x6E60, 0x6E61,
+    0x6E62, 0x6E63, 0x6E64, 0x6E65, 0x6E66, 0x6E67, 0x6E68, 0x6E69, 0x6E6A, 0x6E6C, 0x6E6D, 0x6E6F, 0x6E70, 0x6E71, 0x6E72, 0x6E73, 0x6E74, 0x6E75, 0x6E76, 0x6E77, 0x6E78, 0x6E79, 0x6E7A, 0x6E7B, 0x6E7C, 0x6E7D, 0x6E80, 0x6E81, 0x6E82, 0x6E84, 0x6E87, 0x6E88, 0x6E8A, 0x6E8B, 0x6E8C, 0x6E8D, 0x6E8E, 0x6E91, 0x6E92, 0x6E93, 0x6E94, 0x6E95, 0x6E96, 0x6E97, 0x6E99, 0x6E9A, 0x6E9B, 0x6E9D, 0x6E9E, 0x6EA0, 0x6EA1, 0x6EA3, 0x6EA4, 0x6EA6, 0x6EA8, 0x6EA9, 0x6EAB, 0x6EAC, 0x6EAD, 0x6EAE, 0x6EB0, 0x6EB3, 0x6EB5, 0x6EB8, 0x6EB9, 0x6EBC, 0x6EBE, 0x6EBF, 0x6EC0, 0x6EC3, 0x6EC4, 0x6EC5, 0x6EC6, 0x6EC8, 0x6EC9, 0x6ECA, 0x6ECC, 0x6ECD, 0x6ECE, 0x6ED0, 0x6ED2, 0x6ED6, 0x6ED8, 0x6ED9, 0x6EDB, 0x6EDC, 0x6EDD, 0x6EE3, 0x6EE7, 0x6EEA, 0x6EEB, 0x6EEC, 0x6EED, 0x6EEE, 0x6EEF,
+    0x6EF0, 0x6EF1, 0x6EF2, 0x6EF3, 0x6EF5, 0x6EF6, 0x6EF7, 0x6EF8, 0x6EFA, 0x6EFB, 0x6EFC, 0x6EFD, 0x6EFE, 0x6EFF, 0x6F00, 0x6F01, 0x6F03, 0x6F04, 0x6F05, 0x6F07, 0x6F08, 0x6F0A, 0x6F0B, 0x6F0C, 0x6F0D, 0x6F0E, 0x6F10, 0x6F11, 0x6F12, 0x6F16, 0x6F17, 0x6F18, 0x6F19, 0x6F1A, 0x6F1B, 0x6F1C, 0x6F1D, 0x6F1E, 0x6F1F, 0x6F21, 0x6F22, 0x6F23, 0x6F25, 0x6F26, 0x6F27, 0x6F28, 0x6F2C, 0x6F2E, 0x6F30, 0x6F32, 0x6F34, 0x6F35, 0x6F37, 0x6F38, 0x6F39, 0x6F3A, 0x6F3B, 0x6F3C, 0x6F3D, 0x6F3F, 0x6F40, 0x6F41, 0x6F42, 0x6F43, 0x6F44, 0x6F45, 0x6F48, 0x6F49, 0x6F4A, 0x6F4C, 0x6F4E, 0x6F4F, 0x6F50, 0x6F51, 0x6F52, 0x6F53, 0x6F54, 0x6F55, 0x6F56, 0x6F57, 0x6F59, 0x6F5A, 0x6F5B, 0x6F5D, 0x6F5F, 0x6F60, 0x6F61, 0x6F63, 0x6F64, 0x6F65, 0x6F67, 0x6F68, 0x6F69, 0x6F6A, 0x6F6B,
+    0x6F6C, 0x6F6F, 0x6F70, 0x6F71, 0x6F73, 0x6F75, 0x6F76, 0x6F77, 0x6F79, 0x6F7B, 0x6F7D, 0x6F7E, 0x6F7F, 0x6F80, 0x6F81, 0x6F82, 0x6F83, 0x6F85, 0x6F86, 0x6F87, 0x6F8A, 0x6F8B, 0x6F8F, 0x6F90, 0x6F91, 0x6F92, 0x6F93, 0x6F94, 0x6F95, 0x6F96, 0x6F97, 0x6F98, 0x6F99, 0x6F9A, 0x6F9B, 0x6F9D, 0x6F9E, 0x6F9F, 0x6FA0, 0x6FA2, 0x6FA3, 0x6FA4, 0x6FA5, 0x6FA6, 0x6FA8, 0x6FA9, 0x6FAA, 0x6FAB, 0x6FAC, 0x6FAD, 0x6FAE, 0x6FAF, 0x6FB0, 0x6FB1, 0x6FB2, 0x6FB4, 0x6FB5, 0x6FB7, 0x6FB8, 0x6FBA, 0x6FBB, 0x6FBC, 0x6FBD, 0x6FBE, 0x6FBF, 0x6FC1, 0x6FC3, 0x6FC4, 0x6FC5, 0x6FC6, 0x6FC7, 0x6FC8, 0x6FCA, 0x6FCB, 0x6FCC, 0x6FCD, 0x6FCE, 0x6FCF, 0x6FD0, 0x6FD3, 0x6FD4, 0x6FD5, 0x6FD6, 0x6FD7, 0x6FD8, 0x6FD9, 0x6FDA, 0x6FDB, 0x6FDC, 0x6FDD, 0x6FDF, 0x6FE2, 0x6FE3, 0x6FE4, 0x6FE5,
+    0x6FE6, 0x6FE7, 0x6FE8, 0x6FE9, 0x6FEA, 0x6FEB, 0x6FEC, 0x6FED, 0x6FF0, 0x6FF1, 0x6FF2, 0x6FF3, 0x6FF4, 0x6FF5, 0x6FF6, 0x6FF7, 0x6FF8, 0x6FF9, 0x6FFA, 0x6FFB, 0x6FFC, 0x6FFD, 0x6FFE, 0x6FFF, 0x7000, 0x7001, 0x7002, 0x7003, 0x7004, 0x7005, 0x7006, 0x7007, 0x7008, 0x7009, 0x700A, 0x700B, 0x700C, 0x700D, 0x700E, 0x700F, 0x7010, 0x7012, 0x7013, 0x7014, 0x7015, 0x7016, 0x7017, 0x7018, 0x7019, 0x701C, 0x701D, 0x701E, 0x701F, 0x7020, 0x7021, 0x7022, 0x7024, 0x7025, 0x7026, 0x7027, 0x7028, 0x7029, 0x702A, 0x702B, 0x702C, 0x702D, 0x702E, 0x702F, 0x7030, 0x7031, 0x7032, 0x7033, 0x7034, 0x7036, 0x7037, 0x7038, 0x703A, 0x703B, 0x703C, 0x703D, 0x703E, 0x703F, 0x7040, 0x7041, 0x7042, 0x7043, 0x7044, 0x7045, 0x7046, 0x7047, 0x7048, 0x7049, 0x704A, 0x704B, 0x704D,
+    0x704E, 0x7050, 0x7051, 0x7052, 0x7053, 0x7054, 0x7055, 0x7056, 0x7057, 0x7058, 0x7059, 0x705A, 0x705B, 0x705C, 0x705D, 0x705F, 0x7060, 0x7061, 0x7062, 0x7063, 0x7064, 0x7065, 0x7066, 0x7067, 0x7068, 0x7069, 0x706A, 0x706E, 0x7071, 0x7072, 0x7073, 0x7074, 0x7077, 0x7079, 0x707A, 0x707B, 0x707D, 0x7081, 0x7082, 0x7083, 0x7084, 0x7086, 0x7087, 0x7088, 0x708B, 0x708C, 0x708D, 0x708F, 0x7090, 0x7091, 0x7093, 0x7097, 0x7098, 0x709A, 0x709B, 0x709E, 0x709F, 0x70A0, 0x70A1, 0x70A2, 0x70A3, 0x70A4, 0x70A5, 0x70A6, 0x70A7, 0x70A8, 0x70A9, 0x70AA, 0x70B0, 0x70B2, 0x70B4, 0x70B5, 0x70B6, 0x70BA, 0x70BE, 0x70BF, 0x70C4, 0x70C5, 0x70C6, 0x70C7, 0x70C9, 0x70CB, 0x70CC, 0x70CD, 0x70CE, 0x70CF, 0x70D0, 0x70D1, 0x70D2, 0x70D3, 0x70D4, 0x70D5, 0x70D6, 0x70D7, 0x70DA,
+    0x70DC, 0x70DD, 0x70DE, 0x70E0, 0x70E1, 0x70E2, 0x70E3, 0x70E5, 0x70EA, 0x70EE, 0x70F0, 0x70F1, 0x70F2, 0x70F3, 0x70F4, 0x70F5, 0x70F6, 0x70F8, 0x70FA, 0x70FB, 0x70FC, 0x70FE, 0x70FF, 0x7100, 0x7101, 0x7102, 0x7103, 0x7104, 0x7105, 0x7106, 0x7107, 0x7108, 0x710B, 0x710C, 0x710D, 0x710E, 0x710F, 0x7111, 0x7112, 0x7114, 0x7117, 0x711B, 0x711C, 0x711D, 0x711E, 0x711F, 0x7120, 0x7121, 0x7122, 0x7123, 0x7124, 0x7125, 0x7127, 0x7128, 0x7129, 0x712A, 0x712B, 0x712C, 0x712D, 0x712E, 0x7132, 0x7133, 0x7134, 0x7135, 0x7137, 0x7138, 0x7139, 0x713A, 0x713B, 0x713C, 0x713D, 0x713E, 0x713F, 0x7140, 0x7141, 0x7142, 0x7143, 0x7144, 0x7146, 0x7147, 0x7148, 0x7149, 0x714B, 0x714D, 0x714F, 0x7150, 0x7151, 0x7152, 0x7153, 0x7154, 0x7155, 0x7156, 0x7157, 0x7158, 0x7159,
+    0x715A, 0x715B, 0x715D, 0x715F, 0x7160, 0x7161, 0x7162, 0x7163, 0x7165, 0x7169, 0x716A, 0x716B, 0x716C, 0x716D, 0x716F, 0x7170, 0x7171, 0x7174, 0x7175, 0x7176, 0x7177, 0x7179, 0x717B, 0x717C, 0x717E, 0x717F, 0x7180, 0x7181, 0x7182, 0x7183, 0x7185, 0x7186, 0x7187, 0x7188, 0x7189, 0x718B, 0x718C, 0x718D, 0x718E, 0x7190, 0x7191, 0x7192, 0x7193, 0x7195, 0x7196, 0x7197, 0x719A, 0x719B, 0x719C, 0x719D, 0x719E, 0x71A1, 0x71A2, 0x71A3, 0x71A4, 0x71A5, 0x71A6, 0x71A7, 0x71A9, 0x71AA, 0x71AB, 0x71AD, 0x71AE, 0x71AF, 0x71B0, 0x71B1, 0x71B2, 0x71B4, 0x71B6, 0x71B7, 0x71B8, 0x71BA, 0x71BB, 0x71BC, 0x71BD, 0x71BE, 0x71BF, 0x71C0, 0x71C1, 0x71C2, 0x71C4, 0x71C5, 0x71C6, 0x71C7, 0x71C8, 0x71C9, 0x71CA, 0x71CB, 0x71CC, 0x71CD, 0x71CF, 0x71D0, 0x71D1, 0x71D2, 0x71D3,
+    0x71D6, 0x71D7, 0x71D8, 0x71D9, 0x71DA, 0x71DB, 0x71DC, 0x71DD, 0x71DE, 0x71DF, 0x71E1, 0x71E2, 0x71E3, 0x71E4, 0x71E6, 0x71E8, 0x71E9, 0x71EA, 0x71EB, 0x71EC, 0x71ED, 0x71EF, 0x71F0, 0x71F1, 0x71F2, 0x71F3, 0x71F4, 0x71F5, 0x71F6, 0x71F7, 0x71F8, 0x71FA, 0x71FB, 0x71FC, 0x71FD, 0x71FE, 0x71FF, 0x7200, 0x7201, 0x7202, 0x7203, 0x7204, 0x7205, 0x7207, 0x7208, 0x7209, 0x720A, 0x720B, 0x720C, 0x720D, 0x720E, 0x720F, 0x7210, 0x7211, 0x7212, 0x7213, 0x7214, 0x7215, 0x7216, 0x7217, 0x7218, 0x7219, 0x721A, 0x721B, 0x721C, 0x721E, 0x721F, 0x7220, 0x7221, 0x7222, 0x7223, 0x7224, 0x7225, 0x7226, 0x7227, 0x7229, 0x722B, 0x722D, 0x722E, 0x722F, 0x7232, 0x7233, 0x7234, 0x723A, 0x723C, 0x723E, 0x7240, 0x7241, 0x7242, 0x7243, 0x7244, 0x7245, 0x7246, 0x7249, 0x724A,
+    0x724B, 0x724E, 0x724F, 0x7250, 0x7251, 0x7253, 0x7254, 0x7255, 0x7257, 0x7258, 0x725A, 0x725C, 0x725E, 0x7260, 0x7263, 0x7264, 0x7265, 0x7268, 0x726A, 0x726B, 0x726C, 0x726D, 0x7270, 0x7271, 0x7273, 0x7274, 0x7276, 0x7277, 0x7278, 0x727B, 0x727C, 0x727D, 0x7282, 0x7283, 0x7285, 0x7286, 0x7287, 0x7288, 0x7289, 0x728C, 0x728E, 0x7290, 0x7291, 0x7293, 0x7294, 0x7295, 0x7296, 0x7297, 0x7298, 0x7299, 0x729A, 0x729B, 0x729C, 0x729D, 0x729E, 0x72A0, 0x72A1, 0x72A2, 0x72A3, 0x72A4, 0x72A5, 0x72A6, 0x72A7, 0x72A8, 0x72A9, 0x72AA, 0x72AB, 0x72AE, 0x72B1, 0x72B2, 0x72B3, 0x72B5, 0x72BA, 0x72BB, 0x72BC, 0x72BD, 0x72BE, 0x72BF, 0x72C0, 0x72C5, 0x72C6, 0x72C7, 0x72C9, 0x72CA, 0x72CB, 0x72CC, 0x72CF, 0x72D1, 0x72D3, 0x72D4, 0x72D5, 0x72D6, 0x72D8, 0x72DA, 0x72DB,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x3000, 0x3001, 0x3002, 0x00B7, 0x02C9, 0x02C7, 0x00A8, 0x3003, 0x3005, 0x2014, 0xFF5E, 0x2016, 0x2026, 0x2018, 0x2019, 0x201C, 0x201D, 0x3014, 0x3015, 0x3008, 0x3009, 0x300A, 0x300B, 0x300C, 0x300D, 0x300E, 0x300F, 0x3016, 0x3017, 0x3010, 0x3011, 0x00B1, 0x00D7, 0x00F7, 0x2236, 0x2227, 0x2228, 0x2211, 0x220F, 0x222A, 0x2229, 0x2208, 0x2237, 0x221A, 0x22A5, 0x2225, 0x2220, 0x2312, 0x2299, 0x222B, 0x222E, 0x2261, 0x224C, 0x2248, 0x223D, 0x221D, 0x2260, 0x226E, 0x226F, 0x2264, 0x2265, 0x221E, 0x2235, 0x2234, 0x2642, 0x2640, 0x00B0, 0x2032, 0x2033, 0x2103, 0xFF04, 0x00A4, 0xFFE0, 0xFFE1, 0x2030, 0x00A7, 0x2116, 0x2606, 0x2605, 0x25CB, 0x25CF, 0x25CE, 0x25C7, 0x25C6, 0x25A1, 0x25A0, 0x25B3, 0x25B2, 0x203B, 0x2192, 0x2190, 0x2191, 0x2193, 0x3013,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x2170, 0x2171, 0x2172, 0x2173, 0x2174, 0x2175, 0x2176, 0x2177, 0x2178, 0x2179, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x2488, 0x2489, 0x248A, 0x248B, 0x248C, 0x248D, 0x248E, 0x248F, 0x2490, 0x2491, 0x2492, 0x2493, 0x2494, 0x2495, 0x2496, 0x2497, 0x2498, 0x2499, 0x249A, 0x249B, 0x2474, 0x2475, 0x2476, 0x2477, 0x2478, 0x2479, 0x247A, 0x247B, 0x247C, 0x247D, 0x247E, 0x247F, 0x2480, 0x2481, 0x2482, 0x2483, 0x2484, 0x2485, 0x2486, 0x2487, 0x2460, 0x2461, 0x2462, 0x2463, 0x2464, 0x2465, 0x2466, 0x2467, 0x2468, 0x2469, 0x0000, 0x0000, 0x3220, 0x3221, 0x3222, 0x3223, 0x3224, 0x3225, 0x3226, 0x3227, 0x3228, 0x3229, 0x0000, 0x0000, 0x2160, 0x2161, 0x2162, 0x2163, 0x2164, 0x2165, 0x2166, 0x2167, 0x2168, 0x2169, 0x216A, 0x216B, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0xFF01, 0xFF02, 0xFF03, 0xFFE5, 0xFF05, 0xFF06, 0xFF07, 0xFF08, 0xFF09, 0xFF0A, 0xFF0B, 0xFF0C, 0xFF0D, 0xFF0E, 0xFF0F, 0xFF10, 0xFF11, 0xFF12, 0xFF13, 0xFF14, 0xFF15, 0xFF16, 0xFF17, 0xFF18, 0xFF19, 0xFF1A, 0xFF1B, 0xFF1C, 0xFF1D, 0xFF1E, 0xFF1F, 0xFF20, 0xFF21, 0xFF22, 0xFF23, 0xFF24, 0xFF25, 0xFF26, 0xFF27, 0xFF28, 0xFF29, 0xFF2A, 0xFF2B, 0xFF2C, 0xFF2D, 0xFF2E, 0xFF2F, 0xFF30, 0xFF31, 0xFF32, 0xFF33, 0xFF34, 0xFF35, 0xFF36, 0xFF37, 0xFF38, 0xFF39, 0xFF3A, 0xFF3B, 0xFF3C, 0xFF3D, 0xFF3E, 0xFF3F, 0xFF40, 0xFF41, 0xFF42, 0xFF43, 0xFF44, 0xFF45, 0xFF46, 0xFF47, 0xFF48, 0xFF49, 0xFF4A, 0xFF4B, 0xFF4C, 0xFF4D, 0xFF4E, 0xFF4F, 0xFF50, 0xFF51, 0xFF52, 0xFF53, 0xFF54, 0xFF55, 0xFF56, 0xFF57, 0xFF58, 0xFF59, 0xFF5A, 0xFF5B, 0xFF5C, 0xFF5D, 0xFFE3,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x3041, 0x3042, 0x3043, 0x3044, 0x3045, 0x3046, 0x3047, 0x3048, 0x3049, 0x304A, 0x304B, 0x304C, 0x304D, 0x304E, 0x304F, 0x3050, 0x3051, 0x3052, 0x3053, 0x3054, 0x3055, 0x3056, 0x3057, 0x3058, 0x3059, 0x305A, 0x305B, 0x305C, 0x305D, 0x305E, 0x305F, 0x3060, 0x3061, 0x3062, 0x3063, 0x3064, 0x3065, 0x3066, 0x3067, 0x3068, 0x3069, 0x306A, 0x306B, 0x306C, 0x306D, 0x306E, 0x306F, 0x3070, 0x3071, 0x3072, 0x3073, 0x3074, 0x3075, 0x3076, 0x3077, 0x3078, 0x3079, 0x307A, 0x307B, 0x307C, 0x307D, 0x307E, 0x307F, 0x3080, 0x3081, 0x3082, 0x3083, 0x3084, 0x3085, 0x3086, 0x3087, 0x3088, 0x3089, 0x308A, 0x308B, 0x308C, 0x308D, 0x308E, 0x308F, 0x3090, 0x3091, 0x3092, 0x3093, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x30A1, 0x30A2, 0x30A3, 0x30A4, 0x30A5, 0x30A6, 0x30A7, 0x30A8, 0x30A9, 0x30AA, 0x30AB, 0x30AC, 0x30AD, 0x30AE, 0x30AF, 0x30B0, 0x30B1, 0x30B2, 0x30B3, 0x30B4, 0x30B5, 0x30B6, 0x30B7, 0x30B8, 0x30B9, 0x30BA, 0x30BB, 0x30BC, 0x30BD, 0x30BE, 0x30BF, 0x30C0, 0x30C1, 0x30C2, 0x30C3, 0x30C4, 0x30C5, 0x30C6, 0x30C7, 0x30C8, 0x30C9, 0x30CA, 0x30CB, 0x30CC, 0x30CD, 0x30CE, 0x30CF, 0x30D0, 0x30D1, 0x30D2, 0x30D3, 0x30D4, 0x30D5, 0x30D6, 0x30D7, 0x30D8, 0x30D9, 0x30DA, 0x30DB, 0x30DC, 0x30DD, 0x30DE, 0x30DF, 0x30E0, 0x30E1, 0x30E2, 0x30E3, 0x30E4, 0x30E5, 0x30E6, 0x30E7, 0x30E8, 0x30E9, 0x30EA, 0x30EB, 0x30EC, 0x30ED, 0x30EE, 0x30EF, 0x30F0, 0x30F1, 0x30F2, 0x30F3, 0x30F4, 0x30F5, 0x30F6, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0391, 0x0392, 0x0393, 0x0394, 0x0395, 0x0396, 0x0397, 0x0398, 0x0399, 0x039A, 0x039B, 0x039C, 0x039D, 0x039E, 0x039F, 0x03A0, 0x03A1, 0x03A3, 0x03A4, 0x03A5, 0x03A6, 0x03A7, 0x03A8, 0x03A9, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x03B1, 0x03B2, 0x03B3, 0x03B4, 0x03B5, 0x03B6, 0x03B7, 0x03B8, 0x03B9, 0x03BA, 0x03BB, 0x03BC, 0x03BD, 0x03BE, 0x03BF, 0x03C0, 0x03C1, 0x03C3, 0x03C4, 0x03C5, 0x03C6, 0x03C7, 0x03C8, 0x03C9, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0xFE35, 0xFE36, 0xFE39, 0xFE3A, 0xFE3F, 0xFE40, 0xFE3D, 0xFE3E, 0xFE41, 0xFE42, 0xFE43, 0xFE44, 0x0000, 0x0000, 0xFE3B, 0xFE3C, 0xFE37, 0xFE38, 0xFE31, 0x0000, 0xFE33, 0xFE34, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0410, 0x0411, 0x0412, 0x0413, 0x0414, 0x0415, 0x0401, 0x0416, 0x0417, 0x0418, 0x0419, 0x041A, 0x041B, 0x041C, 0x041D, 0x041E, 0x041F, 0x0420, 0x0421, 0x0422, 0x0423, 0x0424, 0x0425, 0x0426, 0x0427, 0x0428, 0x0429, 0x042A, 0x042B, 0x042C, 0x042D, 0x042E, 0x042F, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0430, 0x0431, 0x0432, 0x0433, 0x0434, 0x0435, 0x0451, 0x0436, 0x0437, 0x0438, 0x0439, 0x043A, 0x043B, 0x043C, 0x043D, 0x043E, 0x043F, 0x0440, 0x0441, 0x0442, 0x0443, 0x0444, 0x0445, 0x0446, 0x0447, 0x0448, 0x0449, 0x044A, 0x044B, 0x044C, 0x044D, 0x044E, 0x044F, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x02CA, 0x02CB, 0x02D9, 0x2013, 0x2015, 0x2025, 0x2035, 0x2105, 0x2109, 0x2196, 0x2197, 0x2198, 0x2199, 0x2215, 0x221F, 0x2223, 0x2252, 0x2266, 0x2267, 0x22BF, 0x2550, 0x2551, 0x2552, 0x2553, 0x2554, 0x2555, 0x2556, 0x2557, 0x2558, 0x2559, 0x255A, 0x255B, 0x255C, 0x255D, 0x255E, 0x255F, 0x2560, 0x2561, 0x2562, 0x2563, 0x2564, 0x2565, 0x2566, 0x2567, 0x2568, 0x2569, 0x256A, 0x256B, 0x256C, 0x256D, 0x256E, 0x256F, 0x2570, 0x2571, 0x2572, 0x2573, 0x2581, 0x2582, 0x2583, 0x2584, 0x2585, 0x2586, 0x2587, 0x2588, 0x2589, 0x258A, 0x258B, 0x258C, 0x258D, 0x258E, 0x258F, 0x2593, 0x2594, 0x2595, 0x25BC, 0x25BD, 0x25E2, 0x25E3, 0x25E4, 0x25E5, 0x2609, 0x2295, 0x3012, 0x301D, 0x301E, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0101, 0x00E1, 0x01CE, 0x00E0, 0x0113, 0x00E9, 0x011B, 0x00E8, 0x012B, 0x00ED, 0x01D0, 0x00EC, 0x014D, 0x00F3, 0x01D2, 0x00F2, 0x016B, 0x00FA, 0x01D4, 0x00F9, 0x01D6, 0x01D8, 0x01DA, 0x01DC, 0x00FC, 0x00EA, 0x0251, 0x0000, 0x0144, 0x0148, 0x0000, 0x0261, 0x0000, 0x0000, 0x0000, 0x0000, 0x3105, 0x3106, 0x3107, 0x3108, 0x3109, 0x310A, 0x310B, 0x310C, 0x310D, 0x310E, 0x310F, 0x3110, 0x3111, 0x3112, 0x3113, 0x3114, 0x3115, 0x3116, 0x3117, 0x3118, 0x3119, 0x311A, 0x311B, 0x311C, 0x311D, 0x311E, 0x311F, 0x3120, 0x3121, 0x3122, 0x3123, 0x3124, 0x3125, 0x3126, 0x3127, 0x3128, 0x3129, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x3021, 0x3022, 0x3023, 0x3024, 0x3025, 0x3026, 0x3027, 0x3028, 0x3029, 0x32A3, 0x338E, 0x338F, 0x339C, 0x339D, 0x339E, 0x33A1, 0x33C4, 0x33CE, 0x33D1, 0x33D2, 0x33D5, 0xFE30, 0xFFE2, 0xFFE4, 0x0000, 0x2121, 0x3231, 0x0000, 0x2010, 0x0000, 0x0000, 0x0000, 0x30FC, 0x309B, 0x309C, 0x30FD, 0x30FE, 0x3006, 0x309D, 0x309E, 0xFE49, 0xFE4A, 0xFE4B, 0xFE4C, 0xFE4D, 0xFE4E, 0xFE4F, 0xFE50, 0xFE51, 0xFE52, 0xFE54, 0xFE55, 0xFE56, 0xFE57, 0xFE59, 0xFE5A, 0xFE5B, 0xFE5C, 0xFE5D, 0xFE5E, 0xFE5F, 0xFE60, 0xFE61, 0xFE62, 0xFE63, 0xFE64, 0xFE65, 0xFE66, 0xFE68, 0xFE69, 0xFE6A, 0xFE6B, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x3007, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x2500, 0x2501, 0x2502, 0x2503, 0x2504, 0x2505, 0x2506, 0x2507, 0x2508, 0x2509, 0x250A, 0x250B, 0x250C, 0x250D, 0x250E, 0x250F, 0x2510, 0x2511, 0x2512, 0x2513, 0x2514, 0x2515, 0x2516, 0x2517, 0x2518, 0x2519, 0x251A, 0x251B, 0x251C, 0x251D, 0x251E, 0x251F, 0x2520, 0x2521, 0x2522, 0x2523, 0x2524, 0x2525, 0x2526, 0x2527, 0x2528, 0x2529, 0x252A, 0x252B, 0x252C, 0x252D, 0x252E, 0x252F, 0x2530, 0x2531, 0x2532, 0x2533, 0x2534, 0x2535, 0x2536, 0x2537, 0x2538, 0x2539, 0x253A, 0x253B, 0x253C, 0x253D, 0x253E, 0x253F, 0x2540, 0x2541, 0x2542, 0x2543, 0x2544, 0x2545, 0x2546, 0x2547, 0x2548, 0x2549, 0x254A, 0x254B, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x72DC, 0x72DD, 0x72DF, 0x72E2, 0x72E3, 0x72E4, 0x72E5, 0x72E6, 0x72E7, 0x72EA, 0x72EB, 0x72F5, 0x72F6, 0x72F9, 0x72FD, 0x72FE, 0x72FF, 0x7300, 0x7302, 0x7304, 0x7305, 0x7306, 0x7307, 0x7308, 0x7309, 0x730B, 0x730C, 0x730D, 0x730F, 0x7310, 0x7311, 0x7312, 0x7314, 0x7318, 0x7319, 0x731A, 0x731F, 0x7320, 0x7323, 0x7324, 0x7326, 0x7327, 0x7328, 0x732D, 0x732F, 0x7330, 0x7332, 0x7333, 0x7335, 0x7336, 0x733A, 0x733B, 0x733C, 0x733D, 0x7340, 0x7341, 0x7342, 0x7343, 0x7344, 0x7345, 0x7346, 0x7347, 0x7348, 0x7349, 0x734A, 0x734B, 0x734C, 0x734E, 0x734F, 0x7351, 0x7353, 0x7354, 0x7355, 0x7356, 0x7358, 0x7359, 0x735A, 0x735B, 0x735C, 0x735D, 0x735E, 0x735F, 0x7361, 0x7362, 0x7363, 0x7364, 0x7365, 0x7366, 0x7367, 0x7368, 0x7369, 0x736A, 0x736B, 0x736E, 0x7370,
+    0x7371, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x7372, 0x7373, 0x7374, 0x7375, 0x7376, 0x7377, 0x7378, 0x7379, 0x737A, 0x737B, 0x737C, 0x737D, 0x737F, 0x7380, 0x7381, 0x7382, 0x7383, 0x7385, 0x7386, 0x7388, 0x738A, 0x738C, 0x738D, 0x738F, 0x7390, 0x7392, 0x7393, 0x7394, 0x7395, 0x7397, 0x7398, 0x7399, 0x739A, 0x739C, 0x739D, 0x739E, 0x73A0, 0x73A1, 0x73A3, 0x73A4, 0x73A5, 0x73A6, 0x73A7, 0x73A8, 0x73AA, 0x73AC, 0x73AD, 0x73B1, 0x73B4, 0x73B5, 0x73B6, 0x73B8, 0x73B9, 0x73BC, 0x73BD, 0x73BE, 0x73BF, 0x73C1, 0x73C3, 0x73C4, 0x73C5, 0x73C6, 0x73C7, 0x73CB, 0x73CC, 0x73CE, 0x73D2, 0x73D3, 0x73D4, 0x73D5, 0x73D6, 0x73D7, 0x73D8, 0x73DA, 0x73DB, 0x73DC, 0x73DD, 0x73DF, 0x73E1, 0x73E2, 0x73E3, 0x73E4, 0x73E6, 0x73E8, 0x73EA, 0x73EB, 0x73EC, 0x73EE, 0x73EF, 0x73F0, 0x73F1, 0x73F3, 0x73F4, 0x73F5, 0x73F6,
+    0x73F7, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x73F8, 0x73F9, 0x73FA, 0x73FB, 0x73FC, 0x73FD, 0x73FE, 0x73FF, 0x7400, 0x7401, 0x7402, 0x7404, 0x7407, 0x7408, 0x740B, 0x740C, 0x740D, 0x740E, 0x7411, 0x7412, 0x7413, 0x7414, 0x7415, 0x7416, 0x7417, 0x7418, 0x7419, 0x741C, 0x741D, 0x741E, 0x741F, 0x7420, 0x7421, 0x7423, 0x7424, 0x7427, 0x7429, 0x742B, 0x742D, 0x742F, 0x7431, 0x7432, 0x7437, 0x7438, 0x7439, 0x743A, 0x743B, 0x743D, 0x743E, 0x743F, 0x7440, 0x7442, 0x7443, 0x7444, 0x7445, 0x7446, 0x7447, 0x7448, 0x7449, 0x744A, 0x744B, 0x744C, 0x744D, 0x744E, 0x744F, 0x7450, 0x7451, 0x7452, 0x7453, 0x7454, 0x7456, 0x7458, 0x745D, 0x7460, 0x7461, 0x7462, 0x7463, 0x7464, 0x7465, 0x7466, 0x7467, 0x7468, 0x7469, 0x746A, 0x746B, 0x746C, 0x746E, 0x746F, 0x7471, 0x7472, 0x7473, 0x7474, 0x7475, 0x7478, 0x7479,
+    0x747A, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x747B, 0x747C, 0x747D, 0x747F, 0x7482, 0x7484, 0x7485, 0x7486, 0x7488, 0x7489, 0x748A, 0x748C, 0x748D, 0x748F, 0x7491, 0x7492, 0x7493, 0x7494, 0x7495, 0x7496, 0x7497, 0x7498, 0x7499, 0x749A, 0x749B, 0x749D, 0x749F, 0x74A0, 0x74A1, 0x74A2, 0x74A3, 0x74A4, 0x74A5, 0x74A6, 0x74AA, 0x74AB, 0x74AC, 0x74AD, 0x74AE, 0x74AF, 0x74B0, 0x74B1, 0x74B2, 0x74B3, 0x74B4, 0x74B5, 0x74B6, 0x74B7, 0x74B8, 0x74B9, 0x74BB, 0x74BC, 0x74BD, 0x74BE, 0x74BF, 0x74C0, 0x74C1, 0x74C2, 0x74C3, 0x74C4, 0x74C5, 0x74C6, 0x74C7, 0x74C8, 0x74C9, 0x74CA, 0x74CB, 0x74CC, 0x74CD, 0x74CE, 0x74CF, 0x74D0, 0x74D1, 0x74D3, 0x74D4, 0x74D5, 0x74D6, 0x74D7, 0x74D8, 0x74D9, 0x74DA, 0x74DB, 0x74DD, 0x74DF, 0x74E1, 0x74E5, 0x74E7, 0x74E8, 0x74E9, 0x74EA, 0x74EB, 0x74EC, 0x74ED, 0x74F0, 0x74F1,
+    0x74F2, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x74F3, 0x74F5, 0x74F8, 0x74F9, 0x74FA, 0x74FB, 0x74FC, 0x74FD, 0x74FE, 0x7500, 0x7501, 0x7502, 0x7503, 0x7505, 0x7506, 0x7507, 0x7508, 0x7509, 0x750A, 0x750B, 0x750C, 0x750E, 0x7510, 0x7512, 0x7514, 0x7515, 0x7516, 0x7517, 0x751B, 0x751D, 0x751E, 0x7520, 0x7521, 0x7522, 0x7523, 0x7524, 0x7526, 0x7527, 0x752A, 0x752E, 0x7534, 0x7536, 0x7539, 0x753C, 0x753D, 0x753F, 0x7541, 0x7542, 0x7543, 0x7544, 0x7546, 0x7547, 0x7549, 0x754A, 0x754D, 0x7550, 0x7551, 0x7552, 0x7553, 0x7555, 0x7556, 0x7557, 0x7558, 0x755D, 0x755E, 0x755F, 0x7560, 0x7561, 0x7562, 0x7563, 0x7564, 0x7567, 0x7568, 0x7569, 0x756B, 0x756C, 0x756D, 0x756E, 0x756F, 0x7570, 0x7571, 0x7573, 0x7575, 0x7576, 0x7577, 0x757A, 0x757B, 0x757C, 0x757D, 0x757E, 0x7580, 0x7581, 0x7582, 0x7584, 0x7585,
+    0x7587, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x7588, 0x7589, 0x758A, 0x758C, 0x758D, 0x758E, 0x7590, 0x7593, 0x7595, 0x7598, 0x759B, 0x759C, 0x759E, 0x75A2, 0x75A6, 0x75A7, 0x75A8, 0x75A9, 0x75AA, 0x75AD, 0x75B6, 0x75B7, 0x75BA, 0x75BB, 0x75BF, 0x75C0, 0x75C1, 0x75C6, 0x75CB, 0x75CC, 0x75CE, 0x75CF, 0x75D0, 0x75D1, 0x75D3, 0x75D7, 0x75D9, 0x75DA, 0x75DC, 0x75DD, 0x75DF, 0x75E0, 0x75E1, 0x75E5, 0x75E9, 0x75EC, 0x75ED, 0x75EE, 0x75EF, 0x75F2, 0x75F3, 0x75F5, 0x75F6, 0x75F7, 0x75F8, 0x75FA, 0x75FB, 0x75FD, 0x75FE, 0x7602, 0x7604, 0x7606, 0x7607, 0x7608, 0x7609, 0x760B, 0x760D, 0x760E, 0x760F, 0x7611, 0x7612, 0x7613, 0x7614, 0x7616, 0x761A, 0x761C, 0x761D, 0x761E, 0x7621, 0x7623, 0x7627, 0x7628, 0x762C, 0x762E, 0x762F, 0x7631, 0x7632, 0x7636, 0x7637, 0x7639, 0x763A, 0x763B, 0x763D, 0x7641, 0x7642,
+    0x7644, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x7645, 0x7646, 0x7647, 0x7648, 0x7649, 0x764A, 0x764B, 0x764E, 0x764F, 0x7650, 0x7651, 0x7652, 0x7653, 0x7655, 0x7657, 0x7658, 0x7659, 0x765A, 0x765B, 0x765D, 0x765F, 0x7660, 0x7661, 0x7662, 0x7664, 0x7665, 0x7666, 0x7667, 0x7668, 0x7669, 0x766A, 0x766C, 0x766D, 0x766E, 0x7670, 0x7671, 0x7672, 0x7673, 0x7674, 0x7675, 0x7676, 0x7677, 0x7679, 0x767A, 0x767C, 0x767F, 0x7680, 0x7681, 0x7683, 0x7685, 0x7689, 0x768A, 0x768C, 0x768D, 0x768F, 0x7690, 0x7692, 0x7694, 0x7695, 0x7697, 0x7698, 0x769A, 0x769B, 0x769C, 0x769D, 0x769E, 0x769F, 0x76A0, 0x76A1, 0x76A2, 0x76A3, 0x76A5, 0x76A6, 0x76A7, 0x76A8, 0x76A9, 0x76AA, 0x76AB, 0x76AC, 0x76AD, 0x76AF, 0x76B0, 0x76B3, 0x76B5, 0x76B6, 0x76B7, 0x76B8, 0x76B9, 0x76BA, 0x76BB, 0x76BC, 0x76BD, 0x76BE, 0x76C0, 0x76C1,
+    0x76C3, 0x554A, 0x963F, 0x57C3, 0x6328, 0x54CE, 0x5509, 0x54C0, 0x7691, 0x764C, 0x853C, 0x77EE, 0x827E, 0x788D, 0x7231, 0x9698, 0x978D, 0x6C28, 0x5B89, 0x4FFA, 0x6309, 0x6697, 0x5CB8, 0x80FA, 0x6848, 0x80AE, 0x6602, 0x76CE, 0x51F9, 0x6556, 0x71AC, 0x7FF1, 0x8884, 0x50B2, 0x5965, 0x61CA, 0x6FB3, 0x82AD, 0x634C, 0x6252, 0x53ED, 0x5427, 0x7B06, 0x516B, 0x75A4, 0x5DF4, 0x62D4, 0x8DCB, 0x9776, 0x628A, 0x8019, 0x575D, 0x9738, 0x7F62, 0x7238, 0x767D, 0x67CF, 0x767E, 0x6446, 0x4F70, 0x8D25, 0x62DC, 0x7A17, 0x6591, 0x73ED, 0x642C, 0x6273, 0x822C, 0x9881, 0x677F, 0x7248, 0x626E, 0x62CC, 0x4F34, 0x74E3, 0x534A, 0x529E, 0x7ECA, 0x90A6, 0x5E2E, 0x6886, 0x699C, 0x8180, 0x7ED1, 0x68D2, 0x78C5, 0x868C, 0x9551, 0x508D, 0x8C24, 0x82DE, 0x80DE, 0x5305, 0x8912, 0x5265,
+    0x76C4, 0x76C7, 0x76C9, 0x76CB, 0x76CC, 0x76D3, 0x76D5, 0x76D9, 0x76DA, 0x76DC, 0x76DD, 0x76DE, 0x76E0, 0x76E1, 0x76E2, 0x76E3, 0x76E4, 0x76E6, 0x76E7, 0x76E8, 0x76E9, 0x76EA, 0x76EB, 0x76EC, 0x76ED, 0x76F0, 0x76F3, 0x76F5, 0x76F6, 0x76F7, 0x76FA, 0x76FB, 0x76FD, 0x76FF, 0x7700, 0x7702, 0x7703, 0x7705, 0x7706, 0x770A, 0x770C, 0x770E, 0x770F, 0x7710, 0x7711, 0x7712, 0x7713, 0x7714, 0x7715, 0x7716, 0x7717, 0x7718, 0x771B, 0x771C, 0x771D, 0x771E, 0x7721, 0x7723, 0x7724, 0x7725, 0x7727, 0x772A, 0x772B, 0x772C, 0x772E, 0x7730, 0x7731, 0x7732, 0x7733, 0x7734, 0x7739, 0x773B, 0x773D, 0x773E, 0x773F, 0x7742, 0x7744, 0x7745, 0x7746, 0x7748, 0x7749, 0x774A, 0x774B, 0x774C, 0x774D, 0x774E, 0x774F, 0x7752, 0x7753, 0x7754, 0x7755, 0x7756, 0x7757, 0x7758, 0x7759,
+    0x775C, 0x8584, 0x96F9, 0x4FDD, 0x5821, 0x9971, 0x5B9D, 0x62B1, 0x62A5, 0x66B4, 0x8C79, 0x9C8D, 0x7206, 0x676F, 0x7891, 0x60B2, 0x5351, 0x5317, 0x8F88, 0x80CC, 0x8D1D, 0x94A1, 0x500D, 0x72C8, 0x5907, 0x60EB, 0x7119, 0x88AB, 0x5954, 0x82EF, 0x672C, 0x7B28, 0x5D29, 0x7EF7, 0x752D, 0x6CF5, 0x8E66, 0x8FF8, 0x903C, 0x9F3B, 0x6BD4, 0x9119, 0x7B14, 0x5F7C, 0x78A7, 0x84D6, 0x853D, 0x6BD5, 0x6BD9, 0x6BD6, 0x5E01, 0x5E87, 0x75F9, 0x95ED, 0x655D, 0x5F0A, 0x5FC5, 0x8F9F, 0x58C1, 0x81C2, 0x907F, 0x965B, 0x97AD, 0x8FB9, 0x7F16, 0x8D2C, 0x6241, 0x4FBF, 0x53D8, 0x535E, 0x8FA8, 0x8FA9, 0x8FAB, 0x904D, 0x6807, 0x5F6A, 0x8198, 0x8868, 0x9CD6, 0x618B, 0x522B, 0x762A, 0x5F6C, 0x658C, 0x6FD2, 0x6EE8, 0x5BBE, 0x6448, 0x5175, 0x51B0, 0x67C4, 0x4E19, 0x79C9, 0x997C, 0x70B3,
+    0x775D, 0x775E, 0x775F, 0x7760, 0x7764, 0x7767, 0x7769, 0x776A, 0x776D, 0x776E, 0x776F, 0x7770, 0x7771, 0x7772, 0x7773, 0x7774, 0x7775, 0x7776, 0x7777, 0x7778, 0x777A, 0x777B, 0x777C, 0x7781, 0x7782, 0x7783, 0x7786, 0x7787, 0x7788, 0x7789, 0x778A, 0x778B, 0x778F, 0x7790, 0x7793, 0x7794, 0x7795, 0x7796, 0x7797, 0x7798, 0x7799, 0x779A, 0x779B, 0x779C, 0x779D, 0x779E, 0x77A1, 0x77A3, 0x77A4, 0x77A6, 0x77A8, 0x77AB, 0x77AD, 0x77AE, 0x77AF, 0x77B1, 0x77B2, 0x77B4, 0x77B6, 0x77B7, 0x77B8, 0x77B9, 0x77BA, 0x77BC, 0x77BE, 0x77C0, 0x77C1, 0x77C2, 0x77C3, 0x77C4, 0x77C5, 0x77C6, 0x77C7, 0x77C8, 0x77C9, 0x77CA, 0x77CB, 0x77CC, 0x77CE, 0x77CF, 0x77D0, 0x77D1, 0x77D2, 0x77D3, 0x77D4, 0x77D5, 0x77D6, 0x77D8, 0x77D9, 0x77DA, 0x77DD, 0x77DE, 0x77DF, 0x77E0, 0x77E1,
+    0x77E4, 0x75C5, 0x5E76, 0x73BB, 0x83E0, 0x64AD, 0x62E8, 0x94B5, 0x6CE2, 0x535A, 0x52C3, 0x640F, 0x94C2, 0x7B94, 0x4F2F, 0x5E1B, 0x8236, 0x8116, 0x818A, 0x6E24, 0x6CCA, 0x9A73, 0x6355, 0x535C, 0x54FA, 0x8865, 0x57E0, 0x4E0D, 0x5E03, 0x6B65, 0x7C3F, 0x90E8, 0x6016, 0x64E6, 0x731C, 0x88C1, 0x6750, 0x624D, 0x8D22, 0x776C, 0x8E29, 0x91C7, 0x5F69, 0x83DC, 0x8521, 0x9910, 0x53C2, 0x8695, 0x6B8B, 0x60ED, 0x60E8, 0x707F, 0x82CD, 0x8231, 0x4ED3, 0x6CA7, 0x85CF, 0x64CD, 0x7CD9, 0x69FD, 0x66F9, 0x8349, 0x5395, 0x7B56, 0x4FA7, 0x518C, 0x6D4B, 0x5C42, 0x8E6D, 0x63D2, 0x53C9, 0x832C, 0x8336, 0x67E5, 0x78B4, 0x643D, 0x5BDF, 0x5C94, 0x5DEE, 0x8BE7, 0x62C6, 0x67F4, 0x8C7A, 0x6400, 0x63BA, 0x8749, 0x998B, 0x8C17, 0x7F20, 0x94F2, 0x4EA7, 0x9610, 0x98A4, 0x660C, 0x7316,
+    0x77E6, 0x77E8, 0x77EA, 0x77EF, 0x77F0, 0x77F1, 0x77F2, 0x77F4, 0x77F5, 0x77F7, 0x77F9, 0x77FA, 0x77FB, 0x77FC, 0x7803, 0x7804, 0x7805, 0x7806, 0x7807, 0x7808, 0x780A, 0x780B, 0x780E, 0x780F, 0x7810, 0x7813, 0x7815, 0x7819, 0x781B, 0x781E, 0x7820, 0x7821, 0x7822, 0x7824, 0x7828, 0x782A, 0x782B, 0x782E, 0x782F, 0x7831, 0x7832, 0x7833, 0x7835, 0x7836, 0x783D, 0x783F, 0x7841, 0x7842, 0x7843, 0x7844, 0x7846, 0x7848, 0x7849, 0x784A, 0x784B, 0x784D, 0x784F, 0x7851, 0x7853, 0x7854, 0x7858, 0x7859, 0x785A, 0x785B, 0x785C, 0x785E, 0x785F, 0x7860, 0x7861, 0x7862, 0x7863, 0x7864, 0x7865, 0x7866, 0x7867, 0x7868, 0x7869, 0x786F, 0x7870, 0x7871, 0x7872, 0x7873, 0x7874, 0x7875, 0x7876, 0x7878, 0x7879, 0x787A, 0x787B, 0x787D, 0x787E, 0x787F, 0x7880, 0x7881, 0x7882,
+    0x7883, 0x573A, 0x5C1D, 0x5E38, 0x957F, 0x507F, 0x80A0, 0x5382, 0x655E, 0x7545, 0x5531, 0x5021, 0x8D85, 0x6284, 0x949E, 0x671D, 0x5632, 0x6F6E, 0x5DE2, 0x5435, 0x7092, 0x8F66, 0x626F, 0x64A4, 0x63A3, 0x5F7B, 0x6F88, 0x90F4, 0x81E3, 0x8FB0, 0x5C18, 0x6668, 0x5FF1, 0x6C89, 0x9648, 0x8D81, 0x886C, 0x6491, 0x79F0, 0x57CE, 0x6A59, 0x6210, 0x5448, 0x4E58, 0x7A0B, 0x60E9, 0x6F84, 0x8BDA, 0x627F, 0x901E, 0x9A8B, 0x79E4, 0x5403, 0x75F4, 0x6301, 0x5319, 0x6C60, 0x8FDF, 0x5F1B, 0x9A70, 0x803B, 0x9F7F, 0x4F88, 0x5C3A, 0x8D64, 0x7FC5, 0x65A5, 0x70BD, 0x5145, 0x51B2, 0x866B, 0x5D07, 0x5BA0, 0x62BD, 0x916C, 0x7574, 0x8E0C, 0x7A20, 0x6101, 0x7B79, 0x4EC7, 0x7EF8, 0x7785, 0x4E11, 0x81ED, 0x521D, 0x51FA, 0x6A71, 0x53A8, 0x8E87, 0x9504, 0x96CF, 0x6EC1, 0x9664, 0x695A,
+    0x7884, 0x7885, 0x7886, 0x7888, 0x788A, 0x788B, 0x788F, 0x7890, 0x7892, 0x7894, 0x7895, 0x7896, 0x7899, 0x789D, 0x789E, 0x78A0, 0x78A2, 0x78A4, 0x78A6, 0x78A8, 0x78A9, 0x78AA, 0x78AB, 0x78AC, 0x78AD, 0x78AE, 0x78AF, 0x78B5, 0x78B6, 0x78B7, 0x78B8, 0x78BA, 0x78BB, 0x78BC, 0x78BD, 0x78BF, 0x78C0, 0x78C2, 0x78C3, 0x78C4, 0x78C6, 0x78C7, 0x78C8, 0x78CC, 0x78CD, 0x78CE, 0x78CF, 0x78D1, 0x78D2, 0x78D3, 0x78D6, 0x78D7, 0x78D8, 0x78DA, 0x78DB, 0x78DC, 0x78DD, 0x78DE, 0x78DF, 0x78E0, 0x78E1, 0x78E2, 0x78E3, 0x78E4, 0x78E5, 0x78E6, 0x78E7, 0x78E9, 0x78EA, 0x78EB, 0x78ED, 0x78EE, 0x78EF, 0x78F0, 0x78F1, 0x78F3, 0x78F5, 0x78F6, 0x78F8, 0x78F9, 0x78FB, 0x78FC, 0x78FD, 0x78FE, 0x78FF, 0x7900, 0x7902, 0x7903, 0x7904, 0x7906, 0x7907, 0x7908, 0x7909, 0x790A, 0x790B,
+    0x790C, 0x7840, 0x50A8, 0x77D7, 0x6410, 0x89E6, 0x5904, 0x63E3, 0x5DDD, 0x7A7F, 0x693D, 0x4F20, 0x8239, 0x5598, 0x4E32, 0x75AE, 0x7A97, 0x5E62, 0x5E8A, 0x95EF, 0x521B, 0x5439, 0x708A, 0x6376, 0x9524, 0x5782, 0x6625, 0x693F, 0x9187, 0x5507, 0x6DF3, 0x7EAF, 0x8822, 0x6233, 0x7EF0, 0x75B5, 0x8328, 0x78C1, 0x96CC, 0x8F9E, 0x6148, 0x74F7, 0x8BCD, 0x6B64, 0x523A, 0x8D50, 0x6B21, 0x806A, 0x8471, 0x56F1, 0x5306, 0x4ECE, 0x4E1B, 0x51D1, 0x7C97, 0x918B, 0x7C07, 0x4FC3, 0x8E7F, 0x7BE1, 0x7A9C, 0x6467, 0x5D14, 0x50AC, 0x8106, 0x7601, 0x7CB9, 0x6DEC, 0x7FE0, 0x6751, 0x5B58, 0x5BF8, 0x78CB, 0x64AE, 0x6413, 0x63AA, 0x632B, 0x9519, 0x642D, 0x8FBE, 0x7B54, 0x7629, 0x6253, 0x5927, 0x5446, 0x6B79, 0x50A3, 0x6234, 0x5E26, 0x6B86, 0x4EE3, 0x8D37, 0x888B, 0x5F85, 0x902E,
+    0x790D, 0x790E, 0x790F, 0x7910, 0x7911, 0x7912, 0x7914, 0x7915, 0x7916, 0x7917, 0x7918, 0x7919, 0x791A, 0x791B, 0x791C, 0x791D, 0x791F, 0x7920, 0x7921, 0x7922, 0x7923, 0x7925, 0x7926, 0x7927, 0x7928, 0x7929, 0x792A, 0x792B, 0x792C, 0x792D, 0x792E, 0x792F, 0x7930, 0x7931, 0x7932, 0x7933, 0x7935, 0x7936, 0x7937, 0x7938, 0x7939, 0x793D, 0x793F, 0x7942, 0x7943, 0x7944, 0x7945, 0x7947, 0x794A, 0x794B, 0x794C, 0x794D, 0x794E, 0x794F, 0x7950, 0x7951, 0x7952, 0x7954, 0x7955, 0x7958, 0x7959, 0x7961, 0x7963, 0x7964, 0x7966, 0x7969, 0x796A, 0x796B, 0x796C, 0x796E, 0x7970, 0x7971, 0x7972, 0x7973, 0x7974, 0x7975, 0x7976, 0x7979, 0x797B, 0x797C, 0x797D, 0x797E, 0x797F, 0x7982, 0x7983, 0x7986, 0x7987, 0x7988, 0x7989, 0x798B, 0x798C, 0x798D, 0x798E, 0x7990, 0x7991,
+    0x7992, 0x6020, 0x803D, 0x62C5, 0x4E39, 0x5355, 0x90F8, 0x63B8, 0x80C6, 0x65E6, 0x6C2E, 0x4F46, 0x60EE, 0x6DE1, 0x8BDE, 0x5F39, 0x86CB, 0x5F53, 0x6321, 0x515A, 0x8361, 0x6863, 0x5200, 0x6363, 0x8E48, 0x5012, 0x5C9B, 0x7977, 0x5BFC, 0x5230, 0x7A3B, 0x60BC, 0x9053, 0x76D7, 0x5FB7, 0x5F97, 0x7684, 0x8E6C, 0x706F, 0x767B, 0x7B49, 0x77AA, 0x51F3, 0x9093, 0x5824, 0x4F4E, 0x6EF4, 0x8FEA, 0x654C, 0x7B1B, 0x72C4, 0x6DA4, 0x7FDF, 0x5AE1, 0x62B5, 0x5E95, 0x5730, 0x8482, 0x7B2C, 0x5E1D, 0x5F1F, 0x9012, 0x7F14, 0x98A0, 0x6382, 0x6EC7, 0x7898, 0x70B9, 0x5178, 0x975B, 0x57AB, 0x7535, 0x4F43, 0x7538, 0x5E97, 0x60E6, 0x5960, 0x6DC0, 0x6BBF, 0x7889, 0x53FC, 0x96D5, 0x51CB, 0x5201, 0x6389, 0x540A, 0x9493, 0x8C03, 0x8DCC, 0x7239, 0x789F, 0x8776, 0x8FED, 0x8C0D, 0x53E0,
+    0x7993, 0x7994, 0x7995, 0x7996, 0x7997, 0x7998, 0x7999, 0x799B, 0x799C, 0x799D, 0x799E, 0x799F, 0x79A0, 0x79A1, 0x79A2, 0x79A3, 0x79A4, 0x79A5, 0x79A6, 0x79A8, 0x79A9, 0x79AA, 0x79AB, 0x79AC, 0x79AD, 0x79AE, 0x79AF, 0x79B0, 0x79B1, 0x79B2, 0x79B4, 0x79B5, 0x79B6, 0x79B7, 0x79B8, 0x79BC, 0x79BF, 0x79C2, 0x79C4, 0x79C5, 0x79C7, 0x79C8, 0x79CA, 0x79CC, 0x79CE, 0x79CF, 0x79D0, 0x79D3, 0x79D4, 0x79D6, 0x79D7, 0x79D9, 0x79DA, 0x79DB, 0x79DC, 0x79DD, 0x79DE, 0x79E0, 0x79E1, 0x79E2, 0x79E5, 0x79E8, 0x79EA, 0x79EC, 0x79EE, 0x79F1, 0x79F2, 0x79F3, 0x79F4, 0x79F5, 0x79F6, 0x79F7, 0x79F9, 0x79FA, 0x79FC, 0x79FE, 0x79FF, 0x7A01, 0x7A04, 0x7A05, 0x7A07, 0x7A08, 0x7A09, 0x7A0A, 0x7A0C, 0x7A0F, 0x7A10, 0x7A11, 0x7A12, 0x7A13, 0x7A15, 0x7A16, 0x7A18, 0x7A19, 0x7A1B,
+    0x7A1C, 0x4E01, 0x76EF, 0x53EE, 0x9489, 0x9876, 0x9F0E, 0x952D, 0x5B9A, 0x8BA2, 0x4E22, 0x4E1C, 0x51AC, 0x8463, 0x61C2, 0x52A8, 0x680B, 0x4F97, 0x606B, 0x51BB, 0x6D1E, 0x515C, 0x6296, 0x6597, 0x9661, 0x8C46, 0x9017, 0x75D8, 0x90FD, 0x7763, 0x6BD2, 0x728A, 0x72EC, 0x8BFB, 0x5835, 0x7779, 0x8D4C, 0x675C, 0x9540, 0x809A, 0x5EA6, 0x6E21, 0x5992, 0x7AEF, 0x77ED, 0x953B, 0x6BB5, 0x65AD, 0x7F0E, 0x5806, 0x5151, 0x961F, 0x5BF9, 0x58A9, 0x5428, 0x8E72, 0x6566, 0x987F, 0x56E4, 0x949D, 0x76FE, 0x9041, 0x6387, 0x54C6, 0x591A, 0x593A, 0x579B, 0x8EB2, 0x6735, 0x8DFA, 0x8235, 0x5241, 0x60F0, 0x5815, 0x86FE, 0x5CE8, 0x9E45, 0x4FC4, 0x989D, 0x8BB9, 0x5A25, 0x6076, 0x5384, 0x627C, 0x904F, 0x9102, 0x997F, 0x6069, 0x800C, 0x513F, 0x8033, 0x5C14, 0x9975, 0x6D31, 0x4E8C,
+    0x7A1D, 0x7A1F, 0x7A21, 0x7A22, 0x7A24, 0x7A25, 0x7A26, 0x7A27, 0x7A28, 0x7A29, 0x7A2A, 0x7A2B, 0x7A2C, 0x7A2D, 0x7A2E, 0x7A2F, 0x7A30, 0x7A31, 0x7A32, 0x7A34, 0x7A35, 0x7A36, 0x7A38, 0x7A3A, 0x7A3E, 0x7A40, 0x7A41, 0x7A42, 0x7A43, 0x7A44, 0x7A45, 0x7A47, 0x7A48, 0x7A49, 0x7A4A, 0x7A4B, 0x7A4C, 0x7A4D, 0x7A4E, 0x7A4F, 0x7A50, 0x7A52, 0x7A53, 0x7A54, 0x7A55, 0x7A56, 0x7A58, 0x7A59, 0x7A5A, 0x7A5B, 0x7A5C, 0x7A5D, 0x7A5E, 0x7A5F, 0x7A60, 0x7A61, 0x7A62, 0x7A63, 0x7A64, 0x7A65, 0x7A66, 0x7A67, 0x7A68, 0x7A69, 0x7A6A, 0x7A6B, 0x7A6C, 0x7A6D, 0x7A6E, 0x7A6F, 0x7A71, 0x7A72, 0x7A73, 0x7A75, 0x7A7B, 0x7A7C, 0x7A7D, 0x7A7E, 0x7A82, 0x7A85, 0x7A87, 0x7A89, 0x7A8A, 0x7A8B, 0x7A8C, 0x7A8E, 0x7A8F, 0x7A90, 0x7A93, 0x7A94, 0x7A99, 0x7A9A, 0x7A9B, 0x7A9E, 0x7AA1,
+    0x7AA2, 0x8D30, 0x53D1, 0x7F5A, 0x7B4F, 0x4F10, 0x4E4F, 0x9600, 0x6CD5, 0x73D0, 0x85E9, 0x5E06, 0x756A, 0x7FFB, 0x6A0A, 0x77FE, 0x9492, 0x7E41, 0x51E1, 0x70E6, 0x53CD, 0x8FD4, 0x8303, 0x8D29, 0x72AF, 0x996D, 0x6CDB, 0x574A, 0x82B3, 0x65B9, 0x80AA, 0x623F, 0x9632, 0x59A8, 0x4EFF, 0x8BBF, 0x7EBA, 0x653E, 0x83F2, 0x975E, 0x5561, 0x98DE, 0x80A5, 0x532A, 0x8BFD, 0x5420, 0x80BA, 0x5E9F, 0x6CB8, 0x8D39, 0x82AC, 0x915A, 0x5429, 0x6C1B, 0x5206, 0x7EB7, 0x575F, 0x711A, 0x6C7E, 0x7C89, 0x594B, 0x4EFD, 0x5FFF, 0x6124, 0x7CAA, 0x4E30, 0x5C01, 0x67AB, 0x8702, 0x5CF0, 0x950B, 0x98CE, 0x75AF, 0x70FD, 0x9022, 0x51AF, 0x7F1D, 0x8BBD, 0x5949, 0x51E4, 0x4F5B, 0x5426, 0x592B, 0x6577, 0x80A4, 0x5B75, 0x6276, 0x62C2, 0x8F90, 0x5E45, 0x6C1F, 0x7B26, 0x4F0F, 0x4FD8, 0x670D,
+    0x7AA3, 0x7AA4, 0x7AA7, 0x7AA9, 0x7AAA, 0x7AAB, 0x7AAE, 0x7AAF, 0x7AB0, 0x7AB1, 0x7AB2, 0x7AB4, 0x7AB5, 0x7AB6, 0x7AB7, 0x7AB8, 0x7AB9, 0x7ABA, 0x7ABB, 0x7ABC, 0x7ABD, 0x7ABE, 0x7AC0, 0x7AC1, 0x7AC2, 0x7AC3, 0x7AC4, 0x7AC5, 0x7AC6, 0x7AC7, 0x7AC8, 0x7AC9, 0x7ACA, 0x7ACC, 0x7ACD, 0x7ACE, 0x7ACF, 0x7AD0, 0x7AD1, 0x7AD2, 0x7AD3, 0x7AD4, 0x7AD5, 0x7AD7, 0x7AD8, 0x7ADA, 0x7ADB, 0x7ADC, 0x7ADD, 0x7AE1, 0x7AE2, 0x7AE4, 0x7AE7, 0x7AE8, 0x7AE9, 0x7AEA, 0x7AEB, 0x7AEC, 0x7AEE, 0x7AF0, 0x7AF1, 0x7AF2, 0x7AF3, 0x7AF4, 0x7AF5, 0x7AF6, 0x7AF7, 0x7AF8, 0x7AFB, 0x7AFC, 0x7AFE, 0x7B00, 0x7B01, 0x7B02, 0x7B05, 0x7B07, 0x7B09, 0x7B0C, 0x7B0D, 0x7B0E, 0x7B10, 0x7B12, 0x7B13, 0x7B16, 0x7B17, 0x7B18, 0x7B1A, 0x7B1C, 0x7B1D, 0x7B1F, 0x7B21, 0x7B22, 0x7B23, 0x7B27, 0x7B29,
+    0x7B2D, 0x6D6E, 0x6DAA, 0x798F, 0x88B1, 0x5F17, 0x752B, 0x629A, 0x8F85, 0x4FEF, 0x91DC, 0x65A7, 0x812F, 0x8151, 0x5E9C, 0x8150, 0x8D74, 0x526F, 0x8986, 0x8D4B, 0x590D, 0x5085, 0x4ED8, 0x961C, 0x7236, 0x8179, 0x8D1F, 0x5BCC, 0x8BA3, 0x9644, 0x5987, 0x7F1A, 0x5490, 0x5676, 0x560E, 0x8BE5, 0x6539, 0x6982, 0x9499, 0x76D6, 0x6E89, 0x5E72, 0x7518, 0x6746, 0x67D1, 0x7AFF, 0x809D, 0x8D76, 0x611F, 0x79C6, 0x6562, 0x8D63, 0x5188, 0x521A, 0x94A2, 0x7F38, 0x809B, 0x7EB2, 0x5C97, 0x6E2F, 0x6760, 0x7BD9, 0x768B, 0x9AD8, 0x818F, 0x7F94, 0x7CD5, 0x641E, 0x9550, 0x7A3F, 0x544A, 0x54E5, 0x6B4C, 0x6401, 0x6208, 0x9E3D, 0x80F3, 0x7599, 0x5272, 0x9769, 0x845B, 0x683C, 0x86E4, 0x9601, 0x9694, 0x94EC, 0x4E2A, 0x5404, 0x7ED9, 0x6839, 0x8DDF, 0x8015, 0x66F4, 0x5E9A, 0x7FB9,
+    0x7B2F, 0x7B30, 0x7B32, 0x7B34, 0x7B35, 0x7B36, 0x7B37, 0x7B39, 0x7B3B, 0x7B3D, 0x7B3F, 0x7B40, 0x7B41, 0x7B42, 0x7B43, 0x7B44, 0x7B46, 0x7B48, 0x7B4A, 0x7B4D, 0x7B4E, 0x7B53, 0x7B55, 0x7B57, 0x7B59, 0x7B5C, 0x7B5E, 0x7B5F, 0x7B61, 0x7B63, 0x7B64, 0x7B65, 0x7B66, 0x7B67, 0x7B68, 0x7B69, 0x7B6A, 0x7B6B, 0x7B6C, 0x7B6D, 0x7B6F, 0x7B70, 0x7B73, 0x7B74, 0x7B76, 0x7B78, 0x7B7A, 0x7B7C, 0x7B7D, 0x7B7F, 0x7B81, 0x7B82, 0x7B83, 0x7B84, 0x7B86, 0x7B87, 0x7B88, 0x7B89, 0x7B8A, 0x7B8B, 0x7B8C, 0x7B8E, 0x7B8F, 0x7B91, 0x7B92, 0x7B93, 0x7B96, 0x7B98, 0x7B99, 0x7B9A, 0x7B9B, 0x7B9E, 0x7B9F, 0x7BA0, 0x7BA3, 0x7BA4, 0x7BA5, 0x7BAE, 0x7BAF, 0x7BB0, 0x7BB2, 0x7BB3, 0x7BB5, 0x7BB6, 0x7BB7, 0x7BB9, 0x7BBA, 0x7BBB, 0x7BBC, 0x7BBD, 0x7BBE, 0x7BBF, 0x7BC0, 0x7BC2, 0x7BC3,
+    0x7BC4, 0x57C2, 0x803F, 0x6897, 0x5DE5, 0x653B, 0x529F, 0x606D, 0x9F9A, 0x4F9B, 0x8EAC, 0x516C, 0x5BAB, 0x5F13, 0x5DE9, 0x6C5E, 0x62F1, 0x8D21, 0x5171, 0x94A9, 0x52FE, 0x6C9F, 0x82DF, 0x72D7, 0x57A2, 0x6784, 0x8D2D, 0x591F, 0x8F9C, 0x83C7, 0x5495, 0x7B8D, 0x4F30, 0x6CBD, 0x5B64, 0x59D1, 0x9F13, 0x53E4, 0x86CA, 0x9AA8, 0x8C37, 0x80A1, 0x6545, 0x987E, 0x56FA, 0x96C7, 0x522E, 0x74DC, 0x5250, 0x5BE1, 0x6302, 0x8902, 0x4E56, 0x62D0, 0x602A, 0x68FA, 0x5173, 0x5B98, 0x51A0, 0x89C2, 0x7BA1, 0x9986, 0x7F50, 0x60EF, 0x704C, 0x8D2F, 0x5149, 0x5E7F, 0x901B, 0x7470, 0x89C4, 0x572D, 0x7845, 0x5F52, 0x9F9F, 0x95FA, 0x8F68, 0x9B3C, 0x8BE1, 0x7678, 0x6842, 0x67DC, 0x8DEA, 0x8D35, 0x523D, 0x8F8A, 0x6EDA, 0x68CD, 0x9505, 0x90ED, 0x56FD, 0x679C, 0x88F9, 0x8FC7, 0x54C8,
+    0x7BC5, 0x7BC8, 0x7BC9, 0x7BCA, 0x7BCB, 0x7BCD, 0x7BCE, 0x7BCF, 0x7BD0, 0x7BD2, 0x7BD4, 0x7BD5, 0x7BD6, 0x7BD7, 0x7BD8, 0x7BDB, 0x7BDC, 0x7BDE, 0x7BDF, 0x7BE0, 0x7BE2, 0x7BE3, 0x7BE4, 0x7BE7, 0x7BE8, 0x7BE9, 0x7BEB, 0x7BEC, 0x7BED, 0x7BEF, 0x7BF0, 0x7BF2, 0x7BF3, 0x7BF4, 0x7BF5, 0x7BF6, 0x7BF8, 0x7BF9, 0x7BFA, 0x7BFB, 0x7BFD, 0x7BFF, 0x7C00, 0x7C01, 0x7C02, 0x7C03, 0x7C04, 0x7C05, 0x7C06, 0x7C08, 0x7C09, 0x7C0A, 0x7C0D, 0x7C0E, 0x7C10, 0x7C11, 0x7C12, 0x7C13, 0x7C14, 0x7C15, 0x7C17, 0x7C18, 0x7C19, 0x7C1A, 0x7C1B, 0x7C1C, 0x7C1D, 0x7C1E, 0x7C20, 0x7C21, 0x7C22, 0x7C23, 0x7C24, 0x7C25, 0x7C28, 0x7C29, 0x7C2B, 0x7C2C, 0x7C2D, 0x7C2E, 0x7C2F, 0x7C30, 0x7C31, 0x7C32, 0x7C33, 0x7C34, 0x7C35, 0x7C36, 0x7C37, 0x7C39, 0x7C3A, 0x7C3B, 0x7C3C, 0x7C3D, 0x7C3E,
+    0x7C42, 0x9AB8, 0x5B69, 0x6D77, 0x6C26, 0x4EA5, 0x5BB3, 0x9A87, 0x9163, 0x61A8, 0x90AF, 0x97E9, 0x542B, 0x6DB5, 0x5BD2, 0x51FD, 0x558A, 0x7F55, 0x7FF0, 0x64BC, 0x634D, 0x65F1, 0x61BE, 0x608D, 0x710A, 0x6C57, 0x6C49, 0x592F, 0x676D, 0x822A, 0x58D5, 0x568E, 0x8C6A, 0x6BEB, 0x90DD, 0x597D, 0x8017, 0x53F7, 0x6D69, 0x5475, 0x559D, 0x8377, 0x83CF, 0x6838, 0x79BE, 0x548C, 0x4F55, 0x5408, 0x76D2, 0x8C89, 0x9602, 0x6CB3, 0x6DB8, 0x8D6B, 0x8910, 0x9E64, 0x8D3A, 0x563F, 0x9ED1, 0x75D5, 0x5F88, 0x72E0, 0x6068, 0x54FC, 0x4EA8, 0x6A2A, 0x8861, 0x6052, 0x8F70, 0x54C4, 0x70D8, 0x8679, 0x9E3F, 0x6D2A, 0x5B8F, 0x5F18, 0x7EA2, 0x5589, 0x4FAF, 0x7334, 0x543C, 0x539A, 0x5019, 0x540E, 0x547C, 0x4E4E, 0x5FFD, 0x745A, 0x58F6, 0x846B, 0x80E1, 0x8774, 0x72D0, 0x7CCA, 0x6E56,
+    0x7C43, 0x7C44, 0x7C45, 0x7C46, 0x7C47, 0x7C48, 0x7C49, 0x7C4A, 0x7C4B, 0x7C4C, 0x7C4E, 0x7C4F, 0x7C50, 0x7C51, 0x7C52, 0x7C53, 0x7C54, 0x7C55, 0x7C56, 0x7C57, 0x7C58, 0x7C59, 0x7C5A, 0x7C5B, 0x7C5C, 0x7C5D, 0x7C5E, 0x7C5F, 0x7C60, 0x7C61, 0x7C62, 0x7C63, 0x7C64, 0x7C65, 0x7C66, 0x7C67, 0x7C68, 0x7C69, 0x7C6A, 0x7C6B, 0x7C6C, 0x7C6D, 0x7C6E, 0x7C6F, 0x7C70, 0x7C71, 0x7C72, 0x7C75, 0x7C76, 0x7C77, 0x7C78, 0x7C79, 0x7C7A, 0x7C7E, 0x7C7F, 0x7C80, 0x7C81, 0x7C82, 0x7C83, 0x7C84, 0x7C85, 0x7C86, 0x7C87, 0x7C88, 0x7C8A, 0x7C8B, 0x7C8C, 0x7C8D, 0x7C8E, 0x7C8F, 0x7C90, 0x7C93, 0x7C94, 0x7C96, 0x7C99, 0x7C9A, 0x7C9B, 0x7CA0, 0x7CA1, 0x7CA3, 0x7CA6, 0x7CA7, 0x7CA8, 0x7CA9, 0x7CAB, 0x7CAC, 0x7CAD, 0x7CAF, 0x7CB0, 0x7CB4, 0x7CB5, 0x7CB6, 0x7CB7, 0x7CB8, 0x7CBA,
+    0x7CBB, 0x5F27, 0x864E, 0x552C, 0x62A4, 0x4E92, 0x6CAA, 0x6237, 0x82B1, 0x54D7, 0x534E, 0x733E, 0x6ED1, 0x753B, 0x5212, 0x5316, 0x8BDD, 0x69D0, 0x5F8A, 0x6000, 0x6DEE, 0x574F, 0x6B22, 0x73AF, 0x6853, 0x8FD8, 0x7F13, 0x6362, 0x60A3, 0x5524, 0x75EA, 0x8C62, 0x7115, 0x6DA3, 0x5BA6, 0x5E7B, 0x8352, 0x614C, 0x9EC4, 0x78FA, 0x8757, 0x7C27, 0x7687, 0x51F0, 0x60F6, 0x714C, 0x6643, 0x5E4C, 0x604D, 0x8C0E, 0x7070, 0x6325, 0x8F89, 0x5FBD, 0x6062, 0x86D4, 0x56DE, 0x6BC1, 0x6094, 0x6167, 0x5349, 0x60E0, 0x6666, 0x8D3F, 0x79FD, 0x4F1A, 0x70E9, 0x6C47, 0x8BB3, 0x8BF2, 0x7ED8, 0x8364, 0x660F, 0x5A5A, 0x9B42, 0x6D51, 0x6DF7, 0x8C41, 0x6D3B, 0x4F19, 0x706B, 0x83B7, 0x6216, 0x60D1, 0x970D, 0x8D27, 0x7978, 0x51FB, 0x573E, 0x57FA, 0x673A, 0x7578, 0x7A3D, 0x79EF, 0x7B95,
+    0x7CBF, 0x7CC0, 0x7CC2, 0x7CC3, 0x7CC4, 0x7CC6, 0x7CC9, 0x7CCB, 0x7CCE, 0x7CCF, 0x7CD0, 0x7CD1, 0x7CD2, 0x7CD3, 0x7CD4, 0x7CD8, 0x7CDA, 0x7CDB, 0x7CDD, 0x7CDE, 0x7CE1, 0x7CE2, 0x7CE3, 0x7CE4, 0x7CE5, 0x7CE6, 0x7CE7, 0x7CE9, 0x7CEA, 0x7CEB, 0x7CEC, 0x7CED, 0x7CEE, 0x7CF0, 0x7CF1, 0x7CF2, 0x7CF3, 0x7CF4, 0x7CF5, 0x7CF6, 0x7CF7, 0x7CF9, 0x7CFA, 0x7CFC, 0x7CFD, 0x7CFE, 0x7CFF, 0x7D00, 0x7D01, 0x7D02, 0x7D03, 0x7D04, 0x7D05, 0x7D06, 0x7D07, 0x7D08, 0x7D09, 0x7D0B, 0x7D0C, 0x7D0D, 0x7D0E, 0x7D0F, 0x7D10, 0x7D11, 0x7D12, 0x7D13, 0x7D14, 0x7D15, 0x7D16, 0x7D17, 0x7D18, 0x7D19, 0x7D1A, 0x7D1B, 0x7D1C, 0x7D1D, 0x7D1E, 0x7D1F, 0x7D21, 0x7D23, 0x7D24, 0x7D25, 0x7D26, 0x7D28, 0x7D29, 0x7D2A, 0x7D2C, 0x7D2D, 0x7D2E, 0x7D30, 0x7D31, 0x7D32, 0x7D33, 0x7D34, 0x7D35,
+    0x7D36, 0x808C, 0x9965, 0x8FF9, 0x6FC0, 0x8BA5, 0x9E21, 0x59EC, 0x7EE9, 0x7F09, 0x5409, 0x6781, 0x68D8, 0x8F91, 0x7C4D, 0x96C6, 0x53CA, 0x6025, 0x75BE, 0x6C72, 0x5373, 0x5AC9, 0x7EA7, 0x6324, 0x51E0, 0x810A, 0x5DF1, 0x84DF, 0x6280, 0x5180, 0x5B63, 0x4F0E, 0x796D, 0x5242, 0x60B8, 0x6D4E, 0x5BC4, 0x5BC2, 0x8BA1, 0x8BB0, 0x65E2, 0x5FCC, 0x9645, 0x5993, 0x7EE7, 0x7EAA, 0x5609, 0x67B7, 0x5939, 0x4F73, 0x5BB6, 0x52A0, 0x835A, 0x988A, 0x8D3E, 0x7532, 0x94BE, 0x5047, 0x7A3C, 0x4EF7, 0x67B6, 0x9A7E, 0x5AC1, 0x6B7C, 0x76D1, 0x575A, 0x5C16, 0x7B3A, 0x95F4, 0x714E, 0x517C, 0x80A9, 0x8270, 0x5978, 0x7F04, 0x8327, 0x68C0, 0x67EC, 0x78B1, 0x7877, 0x62E3, 0x6361, 0x7B80, 0x4FED, 0x526A, 0x51CF, 0x8350, 0x69DB, 0x9274, 0x8DF5, 0x8D31, 0x89C1, 0x952E, 0x7BAD, 0x4EF6,
+    0x7D37, 0x7D38, 0x7D39, 0x7D3A, 0x7D3B, 0x7D3C, 0x7D3D, 0x7D3E, 0x7D3F, 0x7D40, 0x7D41, 0x7D42, 0x7D43, 0x7D44, 0x7D45, 0x7D46, 0x7D47, 0x7D48, 0x7D49, 0x7D4A, 0x7D4B, 0x7D4C, 0x7D4D, 0x7D4E, 0x7D4F, 0x7D50, 0x7D51, 0x7D52, 0x7D53, 0x7D54, 0x7D55, 0x7D56, 0x7D57, 0x7D58, 0x7D59, 0x7D5A, 0x7D5B, 0x7D5C, 0x7D5D, 0x7D5E, 0x7D5F, 0x7D60, 0x7D61, 0x7D62, 0x7D63, 0x7D64, 0x7D65, 0x7D66, 0x7D67, 0x7D68, 0x7D69, 0x7D6A, 0x7D6B, 0x7D6C, 0x7D6D, 0x7D6F, 0x7D70, 0x7D71, 0x7D72, 0x7D73, 0x7D74, 0x7D75, 0x7D76, 0x7D78, 0x7D79, 0x7D7A, 0x7D7B, 0x7D7C, 0x7D7D, 0x7D7E, 0x7D7F, 0x7D80, 0x7D81, 0x7D82, 0x7D83, 0x7D84, 0x7D85, 0x7D86, 0x7D87, 0x7D88, 0x7D89, 0x7D8A, 0x7D8B, 0x7D8C, 0x7D8D, 0x7D8E, 0x7D8F, 0x7D90, 0x7D91, 0x7D92, 0x7D93, 0x7D94, 0x7D95, 0x7D96, 0x7D97,
+    0x7D98, 0x5065, 0x8230, 0x5251, 0x996F, 0x6E10, 0x6E85, 0x6DA7, 0x5EFA, 0x50F5, 0x59DC, 0x5C06, 0x6D46, 0x6C5F, 0x7586, 0x848B, 0x6868, 0x5956, 0x8BB2, 0x5320, 0x9171, 0x964D, 0x8549, 0x6912, 0x7901, 0x7126, 0x80F6, 0x4EA4, 0x90CA, 0x6D47, 0x9A84, 0x5A07, 0x56BC, 0x6405, 0x94F0, 0x77EB, 0x4FA5, 0x811A, 0x72E1, 0x89D2, 0x997A, 0x7F34, 0x7EDE, 0x527F, 0x6559, 0x9175, 0x8F7F, 0x8F83, 0x53EB, 0x7A96, 0x63ED, 0x63A5, 0x7686, 0x79F8, 0x8857, 0x9636, 0x622A, 0x52AB, 0x8282, 0x6854, 0x6770, 0x6377, 0x776B, 0x7AED, 0x6D01, 0x7ED3, 0x89E3, 0x59D0, 0x6212, 0x85C9, 0x82A5, 0x754C, 0x501F, 0x4ECB, 0x75A5, 0x8BEB, 0x5C4A, 0x5DFE, 0x7B4B, 0x65A4, 0x91D1, 0x4ECA, 0x6D25, 0x895F, 0x7D27, 0x9526, 0x4EC5, 0x8C28, 0x8FDB, 0x9773, 0x664B, 0x7981, 0x8FD1, 0x70EC, 0x6D78,
+    0x7D99, 0x7D9A, 0x7D9B, 0x7D9C, 0x7D9D, 0x7D9E, 0x7D9F, 0x7DA0, 0x7DA1, 0x7DA2, 0x7DA3, 0x7DA4, 0x7DA5, 0x7DA7, 0x7DA8, 0x7DA9, 0x7DAA, 0x7DAB, 0x7DAC, 0x7DAD, 0x7DAF, 0x7DB0, 0x7DB1, 0x7DB2, 0x7DB3, 0x7DB4, 0x7DB5, 0x7DB6, 0x7DB7, 0x7DB8, 0x7DB9, 0x7DBA, 0x7DBB, 0x7DBC, 0x7DBD, 0x7DBE, 0x7DBF, 0x7DC0, 0x7DC1, 0x7DC2, 0x7DC3, 0x7DC4, 0x7DC5, 0x7DC6, 0x7DC7, 0x7DC8, 0x7DC9, 0x7DCA, 0x7DCB, 0x7DCC, 0x7DCD, 0x7DCE, 0x7DCF, 0x7DD0, 0x7DD1, 0x7DD2, 0x7DD3, 0x7DD4, 0x7DD5, 0x7DD6, 0x7DD7, 0x7DD8, 0x7DD9, 0x7DDA, 0x7DDB, 0x7DDC, 0x7DDD, 0x7DDE, 0x7DDF, 0x7DE0, 0x7DE1, 0x7DE2, 0x7DE3, 0x7DE4, 0x7DE5, 0x7DE6, 0x7DE7, 0x7DE8, 0x7DE9, 0x7DEA, 0x7DEB, 0x7DEC, 0x7DED, 0x7DEE, 0x7DEF, 0x7DF0, 0x7DF1, 0x7DF2, 0x7DF3, 0x7DF4, 0x7DF5, 0x7DF6, 0x7DF7, 0x7DF8, 0x7DF9,
+    0x7DFA, 0x5C3D, 0x52B2, 0x8346, 0x5162, 0x830E, 0x775B, 0x6676, 0x9CB8, 0x4EAC, 0x60CA, 0x7CBE, 0x7CB3, 0x7ECF, 0x4E95, 0x8B66, 0x666F, 0x9888, 0x9759, 0x5883, 0x656C, 0x955C, 0x5F84, 0x75C9, 0x9756, 0x7ADF, 0x7ADE, 0x51C0, 0x70AF, 0x7A98, 0x63EA, 0x7A76, 0x7EA0, 0x7396, 0x97ED, 0x4E45, 0x7078, 0x4E5D, 0x9152, 0x53A9, 0x6551, 0x65E7, 0x81FC, 0x8205, 0x548E, 0x5C31, 0x759A, 0x97A0, 0x62D8, 0x72D9, 0x75BD, 0x5C45, 0x9A79, 0x83CA, 0x5C40, 0x5480, 0x77E9, 0x4E3E, 0x6CAE, 0x805A, 0x62D2, 0x636E, 0x5DE8, 0x5177, 0x8DDD, 0x8E1E, 0x952F, 0x4FF1, 0x53E5, 0x60E7, 0x70AC, 0x5267, 0x6350, 0x9E43, 0x5A1F, 0x5026, 0x7737, 0x5377, 0x7EE2, 0x6485, 0x652B, 0x6289, 0x6398, 0x5014, 0x7235, 0x89C9, 0x51B3, 0x8BC0, 0x7EDD, 0x5747, 0x83CC, 0x94A7, 0x519B, 0x541B, 0x5CFB,
+    0x7DFB, 0x7DFC, 0x7DFD, 0x7DFE, 0x7DFF, 0x7E00, 0x7E01, 0x7E02, 0x7E03, 0x7E04, 0x7E05, 0x7E06, 0x7E07, 0x7E08, 0x7E09, 0x7E0A, 0x7E0B, 0x7E0C, 0x7E0D, 0x7E0E, 0x7E0F, 0x7E10, 0x7E11, 0x7E12, 0x7E13, 0x7E14, 0x7E15, 0x7E16, 0x7E17, 0x7E18, 0x7E19, 0x7E1A, 0x7E1B, 0x7E1C, 0x7E1D, 0x7E1E, 0x7E1F, 0x7E20, 0x7E21, 0x7E22, 0x7E23, 0x7E24, 0x7E25, 0x7E26, 0x7E27, 0x7E28, 0x7E29, 0x7E2A, 0x7E2B, 0x7E2C, 0x7E2D, 0x7E2E, 0x7E2F, 0x7E30, 0x7E31, 0x7E32, 0x7E33, 0x7E34, 0x7E35, 0x7E36, 0x7E37, 0x7E38, 0x7E39, 0x7E3A, 0x7E3C, 0x7E3D, 0x7E3E, 0x7E3F, 0x7E40, 0x7E42, 0x7E43, 0x7E44, 0x7E45, 0x7E46, 0x7E48, 0x7E49, 0x7E4A, 0x7E4B, 0x7E4C, 0x7E4D, 0x7E4E, 0x7E4F, 0x7E50, 0x7E51, 0x7E52, 0x7E53, 0x7E54, 0x7E55, 0x7E56, 0x7E57, 0x7E58, 0x7E59, 0x7E5A, 0x7E5B, 0x7E5C,
+    0x7E5D, 0x4FCA, 0x7AE3, 0x6D5A, 0x90E1, 0x9A8F, 0x5580, 0x5496, 0x5361, 0x54AF, 0x5F00, 0x63E9, 0x6977, 0x51EF, 0x6168, 0x520A, 0x582A, 0x52D8, 0x574E, 0x780D, 0x770B, 0x5EB7, 0x6177, 0x7CE0, 0x625B, 0x6297, 0x4EA2, 0x7095, 0x8003, 0x62F7, 0x70E4, 0x9760, 0x5777, 0x82DB, 0x67EF, 0x68F5, 0x78D5, 0x9897, 0x79D1, 0x58F3, 0x54B3, 0x53EF, 0x6E34, 0x514B, 0x523B, 0x5BA2, 0x8BFE, 0x80AF, 0x5543, 0x57A6, 0x6073, 0x5751, 0x542D, 0x7A7A, 0x6050, 0x5B54, 0x63A7, 0x62A0, 0x53E3, 0x6263, 0x5BC7, 0x67AF, 0x54ED, 0x7A9F, 0x82E6, 0x9177, 0x5E93, 0x88E4, 0x5938, 0x57AE, 0x630E, 0x8DE8, 0x80EF, 0x5757, 0x7B77, 0x4FA9, 0x5FEB, 0x5BBD, 0x6B3E, 0x5321, 0x7B50, 0x72C2, 0x6846, 0x77FF, 0x7736, 0x65F7, 0x51B5, 0x4E8F, 0x76D4, 0x5CBF, 0x7AA5, 0x8475, 0x594E, 0x9B41, 0x5080,
+    0x7E5E, 0x7E5F, 0x7E60, 0x7E61, 0x7E62, 0x7E63, 0x7E64, 0x7E65, 0x7E66, 0x7E67, 0x7E68, 0x7E69, 0x7E6A, 0x7E6B, 0x7E6C, 0x7E6D, 0x7E6E, 0x7E6F, 0x7E70, 0x7E71, 0x7E72, 0x7E73, 0x7E74, 0x7E75, 0x7E76, 0x7E77, 0x7E78, 0x7E79, 0x7E7A, 0x7E7B, 0x7E7C, 0x7E7D, 0x7E7E, 0x7E7F, 0x7E80, 0x7E81, 0x7E83, 0x7E84, 0x7E85, 0x7E86, 0x7E87, 0x7E88, 0x7E89, 0x7E8A, 0x7E8B, 0x7E8C, 0x7E8D, 0x7E8E, 0x7E8F, 0x7E90, 0x7E91, 0x7E92, 0x7E93, 0x7E94, 0x7E95, 0x7E96, 0x7E97, 0x7E98, 0x7E99, 0x7E9A, 0x7E9C, 0x7E9D, 0x7E9E, 0x7EAE, 0x7EB4, 0x7EBB, 0x7EBC, 0x7ED6, 0x7EE4, 0x7EEC, 0x7EF9, 0x7F0A, 0x7F10, 0x7F1E, 0x7F37, 0x7F39, 0x7F3B, 0x7F3C, 0x7F3D, 0x7F3E, 0x7F3F, 0x7F40, 0x7F41, 0x7F43, 0x7F46, 0x7F47, 0x7F48, 0x7F49, 0x7F4A, 0x7F4B, 0x7F4C, 0x7F4D, 0x7F4E, 0x7F4F, 0x7F52,
+    0x7F53, 0x9988, 0x6127, 0x6E83, 0x5764, 0x6606, 0x6346, 0x56F0, 0x62EC, 0x6269, 0x5ED3, 0x9614, 0x5783, 0x62C9, 0x5587, 0x8721, 0x814A, 0x8FA3, 0x5566, 0x83B1, 0x6765, 0x8D56, 0x84DD, 0x5A6A, 0x680F, 0x62E6, 0x7BEE, 0x9611, 0x5170, 0x6F9C, 0x8C30, 0x63FD, 0x89C8, 0x61D2, 0x7F06, 0x70C2, 0x6EE5, 0x7405, 0x6994, 0x72FC, 0x5ECA, 0x90CE, 0x6717, 0x6D6A, 0x635E, 0x52B3, 0x7262, 0x8001, 0x4F6C, 0x59E5, 0x916A, 0x70D9, 0x6D9D, 0x52D2, 0x4E50, 0x96F7, 0x956D, 0x857E, 0x78CA, 0x7D2F, 0x5121, 0x5792, 0x64C2, 0x808B, 0x7C7B, 0x6CEA, 0x68F1, 0x695E, 0x51B7, 0x5398, 0x68A8, 0x7281, 0x9ECE, 0x7BF1, 0x72F8, 0x79BB, 0x6F13, 0x7406, 0x674E, 0x91CC, 0x9CA4, 0x793C, 0x8389, 0x8354, 0x540F, 0x6817, 0x4E3D, 0x5389, 0x52B1, 0x783E, 0x5386, 0x5229, 0x5088, 0x4F8B, 0x4FD0,
+    0x7F56, 0x7F59, 0x7F5B, 0x7F5C, 0x7F5D, 0x7F5E, 0x7F60, 0x7F63, 0x7F64, 0x7F65, 0x7F66, 0x7F67, 0x7F6B, 0x7F6C, 0x7F6D, 0x7F6F, 0x7F70, 0x7F73, 0x7F75, 0x7F76, 0x7F77, 0x7F78, 0x7F7A, 0x7F7B, 0x7F7C, 0x7F7D, 0x7F7F, 0x7F80, 0x7F82, 0x7F83, 0x7F84, 0x7F85, 0x7F86, 0x7F87, 0x7F88, 0x7F89, 0x7F8B, 0x7F8D, 0x7F8F, 0x7F90, 0x7F91, 0x7F92, 0x7F93, 0x7F95, 0x7F96, 0x7F97, 0x7F98, 0x7F99, 0x7F9B, 0x7F9C, 0x7FA0, 0x7FA2, 0x7FA3, 0x7FA5, 0x7FA6, 0x7FA8, 0x7FA9, 0x7FAA, 0x7FAB, 0x7FAC, 0x7FAD, 0x7FAE, 0x7FB1, 0x7FB3, 0x7FB4, 0x7FB5, 0x7FB6, 0x7FB7, 0x7FBA, 0x7FBB, 0x7FBE, 0x7FC0, 0x7FC2, 0x7FC3, 0x7FC4, 0x7FC6, 0x7FC7, 0x7FC8, 0x7FC9, 0x7FCB, 0x7FCD, 0x7FCF, 0x7FD0, 0x7FD1, 0x7FD2, 0x7FD3, 0x7FD6, 0x7FD7, 0x7FD9, 0x7FDA, 0x7FDB, 0x7FDC, 0x7FDD, 0x7FDE, 0x7FE2,
+    0x7FE3, 0x75E2, 0x7ACB, 0x7C92, 0x6CA5, 0x96B6, 0x529B, 0x7483, 0x54E9, 0x4FE9, 0x8054, 0x83B2, 0x8FDE, 0x9570, 0x5EC9, 0x601C, 0x6D9F, 0x5E18, 0x655B, 0x8138, 0x94FE, 0x604B, 0x70BC, 0x7EC3, 0x7CAE, 0x51C9, 0x6881, 0x7CB1, 0x826F, 0x4E24, 0x8F86, 0x91CF, 0x667E, 0x4EAE, 0x8C05, 0x64A9, 0x804A, 0x50DA, 0x7597, 0x71CE, 0x5BE5, 0x8FBD, 0x6F66, 0x4E86, 0x6482, 0x9563, 0x5ED6, 0x6599, 0x5217, 0x88C2, 0x70C8, 0x52A3, 0x730E, 0x7433, 0x6797, 0x78F7, 0x9716, 0x4E34, 0x90BB, 0x9CDE, 0x6DCB, 0x51DB, 0x8D41, 0x541D, 0x62CE, 0x73B2, 0x83F1, 0x96F6, 0x9F84, 0x94C3, 0x4F36, 0x7F9A, 0x51CC, 0x7075, 0x9675, 0x5CAD, 0x9886, 0x53E6, 0x4EE4, 0x6E9C, 0x7409, 0x69B4, 0x786B, 0x998F, 0x7559, 0x5218, 0x7624, 0x6D41, 0x67F3, 0x516D, 0x9F99, 0x804B, 0x5499, 0x7B3C, 0x7ABF,
+    0x7FE4, 0x7FE7, 0x7FE8, 0x7FEA, 0x7FEB, 0x7FEC, 0x7FED, 0x7FEF, 0x7FF2, 0x7FF4, 0x7FF5, 0x7FF6, 0x7FF7, 0x7FF8, 0x7FF9, 0x7FFA, 0x7FFD, 0x7FFE, 0x7FFF, 0x8002, 0x8007, 0x8008, 0x8009, 0x800A, 0x800E, 0x800F, 0x8011, 0x8013, 0x801A, 0x801B, 0x801D, 0x801E, 0x801F, 0x8021, 0x8023, 0x8024, 0x802B, 0x802C, 0x802D, 0x802E, 0x802F, 0x8030, 0x8032, 0x8034, 0x8039, 0x803A, 0x803C, 0x803E, 0x8040, 0x8041, 0x8044, 0x8045, 0x8047, 0x8048, 0x8049, 0x804E, 0x804F, 0x8050, 0x8051, 0x8053, 0x8055, 0x8056, 0x8057, 0x8059, 0x805B, 0x805C, 0x805D, 0x805E, 0x805F, 0x8060, 0x8061, 0x8062, 0x8063, 0x8064, 0x8065, 0x8066, 0x8067, 0x8068, 0x806B, 0x806C, 0x806D, 0x806E, 0x806F, 0x8070, 0x8072, 0x8073, 0x8074, 0x8075, 0x8076, 0x8077, 0x8078, 0x8079, 0x807A, 0x807B, 0x807C,
+    0x807D, 0x9686, 0x5784, 0x62E2, 0x9647, 0x697C, 0x5A04, 0x6402, 0x7BD3, 0x6F0F, 0x964B, 0x82A6, 0x5362, 0x9885, 0x5E90, 0x7089, 0x63B3, 0x5364, 0x864F, 0x9C81, 0x9E93, 0x788C, 0x9732, 0x8DEF, 0x8D42, 0x9E7F, 0x6F5E, 0x7984, 0x5F55, 0x9646, 0x622E, 0x9A74, 0x5415, 0x94DD, 0x4FA3, 0x65C5, 0x5C65, 0x5C61, 0x7F15, 0x8651, 0x6C2F, 0x5F8B, 0x7387, 0x6EE4, 0x7EFF, 0x5CE6, 0x631B, 0x5B6A, 0x6EE6, 0x5375, 0x4E71, 0x63A0, 0x7565, 0x62A1, 0x8F6E, 0x4F26, 0x4ED1, 0x6CA6, 0x7EB6, 0x8BBA, 0x841D, 0x87BA, 0x7F57, 0x903B, 0x9523, 0x7BA9, 0x9AA1, 0x88F8, 0x843D, 0x6D1B, 0x9A86, 0x7EDC, 0x5988, 0x9EBB, 0x739B, 0x7801, 0x8682, 0x9A6C, 0x9A82, 0x561B, 0x5417, 0x57CB, 0x4E70, 0x9EA6, 0x5356, 0x8FC8, 0x8109, 0x7792, 0x9992, 0x86EE, 0x6EE1, 0x8513, 0x66FC, 0x6162, 0x6F2B,
+    0x807E, 0x8081, 0x8082, 0x8085, 0x8088, 0x808A, 0x808D, 0x808E, 0x808F, 0x8090, 0x8091, 0x8092, 0x8094, 0x8095, 0x8097, 0x8099, 0x809E, 0x80A3, 0x80A6, 0x80A7, 0x80A8, 0x80AC, 0x80B0, 0x80B3, 0x80B5, 0x80B6, 0x80B8, 0x80B9, 0x80BB, 0x80C5, 0x80C7, 0x80C8, 0x80C9, 0x80CA, 0x80CB, 0x80CF, 0x80D0, 0x80D1, 0x80D2, 0x80D3, 0x80D4, 0x80D5, 0x80D8, 0x80DF, 0x80E0, 0x80E2, 0x80E3, 0x80E6, 0x80EE, 0x80F5, 0x80F7, 0x80F9, 0x80FB, 0x80FE, 0x80FF, 0x8100, 0x8101, 0x8103, 0x8104, 0x8105, 0x8107, 0x8108, 0x810B, 0x810C, 0x8115, 0x8117, 0x8119, 0x811B, 0x811C, 0x811D, 0x811F, 0x8120, 0x8121, 0x8122, 0x8123, 0x8124, 0x8125, 0x8126, 0x8127, 0x8128, 0x8129, 0x812A, 0x812B, 0x812D, 0x812E, 0x8130, 0x8133, 0x8134, 0x8135, 0x8137, 0x8139, 0x813A, 0x813B, 0x813C, 0x813D,
+    0x813F, 0x8C29, 0x8292, 0x832B, 0x76F2, 0x6C13, 0x5FD9, 0x83BD, 0x732B, 0x8305, 0x951A, 0x6BDB, 0x77DB, 0x94C6, 0x536F, 0x8302, 0x5192, 0x5E3D, 0x8C8C, 0x8D38, 0x4E48, 0x73AB, 0x679A, 0x6885, 0x9176, 0x9709, 0x7164, 0x6CA1, 0x7709, 0x5A92, 0x9541, 0x6BCF, 0x7F8E, 0x6627, 0x5BD0, 0x59B9, 0x5A9A, 0x95E8, 0x95F7, 0x4EEC, 0x840C, 0x8499, 0x6AAC, 0x76DF, 0x9530, 0x731B, 0x68A6, 0x5B5F, 0x772F, 0x919A, 0x9761, 0x7CDC, 0x8FF7, 0x8C1C, 0x5F25, 0x7C73, 0x79D8, 0x89C5, 0x6CCC, 0x871C, 0x5BC6, 0x5E42, 0x68C9, 0x7720, 0x7EF5, 0x5195, 0x514D, 0x52C9, 0x5A29, 0x7F05, 0x9762, 0x82D7, 0x63CF, 0x7784, 0x85D0, 0x79D2, 0x6E3A, 0x5E99, 0x5999, 0x8511, 0x706D, 0x6C11, 0x62BF, 0x76BF, 0x654F, 0x60AF, 0x95FD, 0x660E, 0x879F, 0x9E23, 0x94ED, 0x540D, 0x547D, 0x8C2C, 0x6478,
+    0x8140, 0x8141, 0x8142, 0x8143, 0x8144, 0x8145, 0x8147, 0x8149, 0x814D, 0x814E, 0x814F, 0x8152, 0x8156, 0x8157, 0x8158, 0x815B, 0x815C, 0x815D, 0x815E, 0x815F, 0x8161, 0x8162, 0x8163, 0x8164, 0x8166, 0x8168, 0x816A, 0x816B, 0x816C, 0x816F, 0x8172, 0x8173, 0x8175, 0x8176, 0x8177, 0x8178, 0x8181, 0x8183, 0x8184, 0x8185, 0x8186, 0x8187, 0x8189, 0x818B, 0x818C, 0x818D, 0x818E, 0x8190, 0x8192, 0x8193, 0x8194, 0x8195, 0x8196, 0x8197, 0x8199, 0x819A, 0x819E, 0x819F, 0x81A0, 0x81A1, 0x81A2, 0x81A4, 0x81A5, 0x81A7, 0x81A9, 0x81AB, 0x81AC, 0x81AD, 0x81AE, 0x81AF, 0x81B0, 0x81B1, 0x81B2, 0x81B4, 0x81B5, 0x81B6, 0x81B7, 0x81B8, 0x81B9, 0x81BC, 0x81BD, 0x81BE, 0x81BF, 0x81C4, 0x81C5, 0x81C7, 0x81C8, 0x81C9, 0x81CB, 0x81CD, 0x81CE, 0x81CF, 0x81D0, 0x81D1, 0x81D2,
+    0x81D3, 0x6479, 0x8611, 0x6A21, 0x819C, 0x78E8, 0x6469, 0x9B54, 0x62B9, 0x672B, 0x83AB, 0x58A8, 0x9ED8, 0x6CAB, 0x6F20, 0x5BDE, 0x964C, 0x8C0B, 0x725F, 0x67D0, 0x62C7, 0x7261, 0x4EA9, 0x59C6, 0x6BCD, 0x5893, 0x66AE, 0x5E55, 0x52DF, 0x6155, 0x6728, 0x76EE, 0x7766, 0x7267, 0x7A46, 0x62FF, 0x54EA, 0x5450, 0x94A0, 0x90A3, 0x5A1C, 0x7EB3, 0x6C16, 0x4E43, 0x5976, 0x8010, 0x5948, 0x5357, 0x7537, 0x96BE, 0x56CA, 0x6320, 0x8111, 0x607C, 0x95F9, 0x6DD6, 0x5462, 0x9981, 0x5185, 0x5AE9, 0x80FD, 0x59AE, 0x9713, 0x502A, 0x6CE5, 0x5C3C, 0x62DF, 0x4F60, 0x533F, 0x817B, 0x9006, 0x6EBA, 0x852B, 0x62C8, 0x5E74, 0x78BE, 0x64B5, 0x637B, 0x5FF5, 0x5A18, 0x917F, 0x9E1F, 0x5C3F, 0x634F, 0x8042, 0x5B7D, 0x556E, 0x954A, 0x954D, 0x6D85, 0x60A8, 0x67E0, 0x72DE, 0x51DD, 0x5B81,
+    0x81D4, 0x81D5, 0x81D6, 0x81D7, 0x81D8, 0x81D9, 0x81DA, 0x81DB, 0x81DC, 0x81DD, 0x81DE, 0x81DF, 0x81E0, 0x81E1, 0x81E2, 0x81E4, 0x81E5, 0x81E6, 0x81E8, 0x81E9, 0x81EB, 0x81EE, 0x81EF, 0x81F0, 0x81F1, 0x81F2, 0x81F5, 0x81F6, 0x81F7, 0x81F8, 0x81F9, 0x81FA, 0x81FD, 0x81FF, 0x8203, 0x8207, 0x8208, 0x8209, 0x820A, 0x820B, 0x820E, 0x820F, 0x8211, 0x8213, 0x8215, 0x8216, 0x8217, 0x8218, 0x8219, 0x821A, 0x821D, 0x8220, 0x8224, 0x8225, 0x8226, 0x8227, 0x8229, 0x822E, 0x8232, 0x823A, 0x823C, 0x823D, 0x823F, 0x8240, 0x8241, 0x8242, 0x8243, 0x8245, 0x8246, 0x8248, 0x824A, 0x824C, 0x824D, 0x824E, 0x8250, 0x8251, 0x8252, 0x8253, 0x8254, 0x8255, 0x8256, 0x8257, 0x8259, 0x825B, 0x825C, 0x825D, 0x825E, 0x8260, 0x8261, 0x8262, 0x8263, 0x8264, 0x8265, 0x8266, 0x8267,
+    0x8269, 0x62E7, 0x6CDE, 0x725B, 0x626D, 0x94AE, 0x7EBD, 0x8113, 0x6D53, 0x519C, 0x5F04, 0x5974, 0x52AA, 0x6012, 0x5973, 0x6696, 0x8650, 0x759F, 0x632A, 0x61E6, 0x7CEF, 0x8BFA, 0x54E6, 0x6B27, 0x9E25, 0x6BB4, 0x85D5, 0x5455, 0x5076, 0x6CA4, 0x556A, 0x8DB4, 0x722C, 0x5E15, 0x6015, 0x7436, 0x62CD, 0x6392, 0x724C, 0x5F98, 0x6E43, 0x6D3E, 0x6500, 0x6F58, 0x76D8, 0x78D0, 0x76FC, 0x7554, 0x5224, 0x53DB, 0x4E53, 0x5E9E, 0x65C1, 0x802A, 0x80D6, 0x629B, 0x5486, 0x5228, 0x70AE, 0x888D, 0x8DD1, 0x6CE1, 0x5478, 0x80DA, 0x57F9, 0x88F4, 0x8D54, 0x966A, 0x914D, 0x4F69, 0x6C9B, 0x55B7, 0x76C6, 0x7830, 0x62A8, 0x70F9, 0x6F8E, 0x5F6D, 0x84EC, 0x68DA, 0x787C, 0x7BF7, 0x81A8, 0x670B, 0x9E4F, 0x6367, 0x78B0, 0x576F, 0x7812, 0x9739, 0x6279, 0x62AB, 0x5288, 0x7435, 0x6BD7,
+    0x826A, 0x826B, 0x826C, 0x826D, 0x8271, 0x8275, 0x8276, 0x8277, 0x8278, 0x827B, 0x827C, 0x8280, 0x8281, 0x8283, 0x8285, 0x8286, 0x8287, 0x8289, 0x828C, 0x8290, 0x8293, 0x8294, 0x8295, 0x8296, 0x829A, 0x829B, 0x829E, 0x82A0, 0x82A2, 0x82A3, 0x82A7, 0x82B2, 0x82B5, 0x82B6, 0x82BA, 0x82BB, 0x82BC, 0x82BF, 0x82C0, 0x82C2, 0x82C3, 0x82C5, 0x82C6, 0x82C9, 0x82D0, 0x82D6, 0x82D9, 0x82DA, 0x82DD, 0x82E2, 0x82E7, 0x82E8, 0x82E9, 0x82EA, 0x82EC, 0x82ED, 0x82EE, 0x82F0, 0x82F2, 0x82F3, 0x82F5, 0x82F6, 0x82F8, 0x82FA, 0x82FC, 0x82FD, 0x82FE, 0x82FF, 0x8300, 0x830A, 0x830B, 0x830D, 0x8310, 0x8312, 0x8313, 0x8316, 0x8318, 0x8319, 0x831D, 0x831E, 0x831F, 0x8320, 0x8321, 0x8322, 0x8323, 0x8324, 0x8325, 0x8326, 0x8329, 0x832A, 0x832E, 0x8330, 0x8332, 0x8337, 0x833B,
+    0x833D, 0x5564, 0x813E, 0x75B2, 0x76AE, 0x5339, 0x75DE, 0x50FB, 0x5C41, 0x8B6C, 0x7BC7, 0x504F, 0x7247, 0x9A97, 0x98D8, 0x6F02, 0x74E2, 0x7968, 0x6487, 0x77A5, 0x62FC, 0x9891, 0x8D2B, 0x54C1, 0x8058, 0x4E52, 0x576A, 0x82F9, 0x840D, 0x5E73, 0x51ED, 0x74F6, 0x8BC4, 0x5C4F, 0x5761, 0x6CFC, 0x9887, 0x5A46, 0x7834, 0x9B44, 0x8FEB, 0x7C95, 0x5256, 0x6251, 0x94FA, 0x4EC6, 0x8386, 0x8461, 0x83E9, 0x84B2, 0x57D4, 0x6734, 0x5703, 0x666E, 0x6D66, 0x8C31, 0x66DD, 0x7011, 0x671F, 0x6B3A, 0x6816, 0x621A, 0x59BB, 0x4E03, 0x51C4, 0x6F06, 0x67D2, 0x6C8F, 0x5176, 0x68CB, 0x5947, 0x6B67, 0x7566, 0x5D0E, 0x8110, 0x9F50, 0x65D7, 0x7948, 0x7941, 0x9A91, 0x8D77, 0x5C82, 0x4E5E, 0x4F01, 0x542F, 0x5951, 0x780C, 0x5668, 0x6C14, 0x8FC4, 0x5F03, 0x6C7D, 0x6CE3, 0x8BAB, 0x6390,
+    0x833E, 0x833F, 0x8341, 0x8342, 0x8344, 0x8345, 0x8348, 0x834A, 0x834B, 0x834C, 0x834D, 0x834E, 0x8353, 0x8355, 0x8356, 0x8357, 0x8358, 0x8359, 0x835D, 0x8362, 0x8370, 0x8371, 0x8372, 0x8373, 0x8374, 0x8375, 0x8376, 0x8379, 0x837A, 0x837E, 0x837F, 0x8380, 0x8381, 0x8382, 0x8383, 0x8384, 0x8387, 0x8388, 0x838A, 0x838B, 0x838C, 0x838D, 0x838F, 0x8390, 0x8391, 0x8394, 0x8395, 0x8396, 0x8397, 0x8399, 0x839A, 0x839D, 0x839F, 0x83A1, 0x83A2, 0x83A3, 0x83A4, 0x83A5, 0x83A6, 0x83A7, 0x83AC, 0x83AD, 0x83AE, 0x83AF, 0x83B5, 0x83BB, 0x83BE, 0x83BF, 0x83C2, 0x83C3, 0x83C4, 0x83C6, 0x83C8, 0x83C9, 0x83CB, 0x83CD, 0x83CE, 0x83D0, 0x83D1, 0x83D2, 0x83D3, 0x83D5, 0x83D7, 0x83D9, 0x83DA, 0x83DB, 0x83DE, 0x83E2, 0x83E3, 0x83E4, 0x83E6, 0x83E7, 0x83E8, 0x83EB, 0x83EC,
+    0x83ED, 0x6070, 0x6D3D, 0x7275, 0x6266, 0x948E, 0x94C5, 0x5343, 0x8FC1, 0x7B7E, 0x4EDF, 0x8C26, 0x4E7E, 0x9ED4, 0x94B1, 0x94B3, 0x524D, 0x6F5C, 0x9063, 0x6D45, 0x8C34, 0x5811, 0x5D4C, 0x6B20, 0x6B49, 0x67AA, 0x545B, 0x8154, 0x7F8C, 0x5899, 0x8537, 0x5F3A, 0x62A2, 0x6A47, 0x9539, 0x6572, 0x6084, 0x6865, 0x77A7, 0x4E54, 0x4FA8, 0x5DE7, 0x9798, 0x64AC, 0x7FD8, 0x5CED, 0x4FCF, 0x7A8D, 0x5207, 0x8304, 0x4E14, 0x602F, 0x7A83, 0x94A6, 0x4FB5, 0x4EB2, 0x79E6, 0x7434, 0x52E4, 0x82B9, 0x64D2, 0x79BD, 0x5BDD, 0x6C81, 0x9752, 0x8F7B, 0x6C22, 0x503E, 0x537F, 0x6E05, 0x64CE, 0x6674, 0x6C30, 0x60C5, 0x9877, 0x8BF7, 0x5E86, 0x743C, 0x7A77, 0x79CB, 0x4E18, 0x90B1, 0x7403, 0x6C42, 0x56DA, 0x914B, 0x6CC5, 0x8D8B, 0x533A, 0x86C6, 0x66F2, 0x8EAF, 0x5C48, 0x9A71, 0x6E20,
+    0x83EE, 0x83EF, 0x83F3, 0x83F4, 0x83F5, 0x83F6, 0x83F7, 0x83FA, 0x83FB, 0x83FC, 0x83FE, 0x83FF, 0x8400, 0x8402, 0x8405, 0x8407, 0x8408, 0x8409, 0x840A, 0x8410, 0x8412, 0x8413, 0x8414, 0x8415, 0x8416, 0x8417, 0x8419, 0x841A, 0x841B, 0x841E, 0x841F, 0x8420, 0x8421, 0x8422, 0x8423, 0x8429, 0x842A, 0x842B, 0x842C, 0x842D, 0x842E, 0x842F, 0x8430, 0x8432, 0x8433, 0x8434, 0x8435, 0x8436, 0x8437, 0x8439, 0x843A, 0x843B, 0x843E, 0x843F, 0x8440, 0x8441, 0x8442, 0x8443, 0x8444, 0x8445, 0x8447, 0x8448, 0x8449, 0x844A, 0x844B, 0x844C, 0x844D, 0x844E, 0x844F, 0x8450, 0x8452, 0x8453, 0x8454, 0x8455, 0x8456, 0x8458, 0x845D, 0x845E, 0x845F, 0x8460, 0x8462, 0x8464, 0x8465, 0x8466, 0x8467, 0x8468, 0x846A, 0x846E, 0x846F, 0x8470, 0x8472, 0x8474, 0x8477, 0x8479, 0x847B,
+    0x847C, 0x53D6, 0x5A36, 0x9F8B, 0x8DA3, 0x53BB, 0x5708, 0x98A7, 0x6743, 0x919B, 0x6CC9, 0x5168, 0x75CA, 0x62F3, 0x72AC, 0x5238, 0x529D, 0x7F3A, 0x7094, 0x7638, 0x5374, 0x9E4A, 0x69B7, 0x786E, 0x96C0, 0x88D9, 0x7FA4, 0x7136, 0x71C3, 0x5189, 0x67D3, 0x74E4, 0x58E4, 0x6518, 0x56B7, 0x8BA9, 0x9976, 0x6270, 0x7ED5, 0x60F9, 0x70ED, 0x58EC, 0x4EC1, 0x4EBA, 0x5FCD, 0x97E7, 0x4EFB, 0x8BA4, 0x5203, 0x598A, 0x7EAB, 0x6254, 0x4ECD, 0x65E5, 0x620E, 0x8338, 0x84C9, 0x8363, 0x878D, 0x7194, 0x6EB6, 0x5BB9, 0x7ED2, 0x5197, 0x63C9, 0x67D4, 0x8089, 0x8339, 0x8815, 0x5112, 0x5B7A, 0x5982, 0x8FB1, 0x4E73, 0x6C5D, 0x5165, 0x8925, 0x8F6F, 0x962E, 0x854A, 0x745E, 0x9510, 0x95F0, 0x6DA6, 0x82E5, 0x5F31, 0x6492, 0x6D12, 0x8428, 0x816E, 0x9CC3, 0x585E, 0x8D5B, 0x4E09, 0x53C1,
+    0x847D, 0x847E, 0x847F, 0x8480, 0x8481, 0x8483, 0x8484, 0x8485, 0x8486, 0x848A, 0x848D, 0x848F, 0x8490, 0x8491, 0x8492, 0x8493, 0x8494, 0x8495, 0x8496, 0x8498, 0x849A, 0x849B, 0x849D, 0x849E, 0x849F, 0x84A0, 0x84A2, 0x84A3, 0x84A4, 0x84A5, 0x84A6, 0x84A7, 0x84A8, 0x84A9, 0x84AA, 0x84AB, 0x84AC, 0x84AD, 0x84AE, 0x84B0, 0x84B1, 0x84B3, 0x84B5, 0x84B6, 0x84B7, 0x84BB, 0x84BC, 0x84BE, 0x84C0, 0x84C2, 0x84C3, 0x84C5, 0x84C6, 0x84C7, 0x84C8, 0x84CB, 0x84CC, 0x84CE, 0x84CF, 0x84D2, 0x84D4, 0x84D5, 0x84D7, 0x84D8, 0x84D9, 0x84DA, 0x84DB, 0x84DC, 0x84DE, 0x84E1, 0x84E2, 0x84E4, 0x84E7, 0x84E8, 0x84E9, 0x84EA, 0x84EB, 0x84ED, 0x84EE, 0x84EF, 0x84F1, 0x84F2, 0x84F3, 0x84F4, 0x84F5, 0x84F6, 0x84F7, 0x84F8, 0x84F9, 0x84FA, 0x84FB, 0x84FD, 0x84FE, 0x8500, 0x8501,
+    0x8502, 0x4F1E, 0x6563, 0x6851, 0x55D3, 0x4E27, 0x6414, 0x9A9A, 0x626B, 0x5AC2, 0x745F, 0x8272, 0x6DA9, 0x68EE, 0x50E7, 0x838E, 0x7802, 0x6740, 0x5239, 0x6C99, 0x7EB1, 0x50BB, 0x5565, 0x715E, 0x7B5B, 0x6652, 0x73CA, 0x82EB, 0x6749, 0x5C71, 0x5220, 0x717D, 0x886B, 0x95EA, 0x9655, 0x64C5, 0x8D61, 0x81B3, 0x5584, 0x6C55, 0x6247, 0x7F2E, 0x5892, 0x4F24, 0x5546, 0x8D4F, 0x664C, 0x4E0A, 0x5C1A, 0x88F3, 0x68A2, 0x634E, 0x7A0D, 0x70E7, 0x828D, 0x52FA, 0x97F6, 0x5C11, 0x54E8, 0x90B5, 0x7ECD, 0x5962, 0x8D4A, 0x86C7, 0x820C, 0x820D, 0x8D66, 0x6444, 0x5C04, 0x6151, 0x6D89, 0x793E, 0x8BBE, 0x7837, 0x7533, 0x547B, 0x4F38, 0x8EAB, 0x6DF1, 0x5A20, 0x7EC5, 0x795E, 0x6C88, 0x5BA1, 0x5A76, 0x751A, 0x80BE, 0x614E, 0x6E17, 0x58F0, 0x751F, 0x7525, 0x7272, 0x5347, 0x7EF3,
+    0x8503, 0x8504, 0x8505, 0x8506, 0x8507, 0x8508, 0x8509, 0x850A, 0x850B, 0x850D, 0x850E, 0x850F, 0x8510, 0x8512, 0x8514, 0x8515, 0x8516, 0x8518, 0x8519, 0x851B, 0x851C, 0x851D, 0x851E, 0x8520, 0x8522, 0x8523, 0x8524, 0x8525, 0x8526, 0x8527, 0x8528, 0x8529, 0x852A, 0x852D, 0x852E, 0x852F, 0x8530, 0x8531, 0x8532, 0x8533, 0x8534, 0x8535, 0x8536, 0x853E, 0x853F, 0x8540, 0x8541, 0x8542, 0x8544, 0x8545, 0x8546, 0x8547, 0x854B, 0x854C, 0x854D, 0x854E, 0x854F, 0x8550, 0x8551, 0x8552, 0x8553, 0x8554, 0x8555, 0x8557, 0x8558, 0x855A, 0x855B, 0x855C, 0x855D, 0x855F, 0x8560, 0x8561, 0x8562, 0x8563, 0x8565, 0x8566, 0x8567, 0x8569, 0x856A, 0x856B, 0x856C, 0x856D, 0x856E, 0x856F, 0x8570, 0x8571, 0x8573, 0x8575, 0x8576, 0x8577, 0x8578, 0x857C, 0x857D, 0x857F, 0x8580,
+    0x8581, 0x7701, 0x76DB, 0x5269, 0x80DC, 0x5723, 0x5E08, 0x5931, 0x72EE, 0x65BD, 0x6E7F, 0x8BD7, 0x5C38, 0x8671, 0x5341, 0x77F3, 0x62FE, 0x65F6, 0x4EC0, 0x98DF, 0x8680, 0x5B9E, 0x8BC6, 0x53F2, 0x77E2, 0x4F7F, 0x5C4E, 0x9A76, 0x59CB, 0x5F0F, 0x793A, 0x58EB, 0x4E16, 0x67FF, 0x4E8B, 0x62ED, 0x8A93, 0x901D, 0x52BF, 0x662F, 0x55DC, 0x566C, 0x9002, 0x4ED5, 0x4F8D, 0x91CA, 0x9970, 0x6C0F, 0x5E02, 0x6043, 0x5BA4, 0x89C6, 0x8BD5, 0x6536, 0x624B, 0x9996, 0x5B88, 0x5BFF, 0x6388, 0x552E, 0x53D7, 0x7626, 0x517D, 0x852C, 0x67A2, 0x68B3, 0x6B8A, 0x6292, 0x8F93, 0x53D4, 0x8212, 0x6DD1, 0x758F, 0x4E66, 0x8D4E, 0x5B70, 0x719F, 0x85AF, 0x6691, 0x66D9, 0x7F72, 0x8700, 0x9ECD, 0x9F20, 0x5C5E, 0x672F, 0x8FF0, 0x6811, 0x675F, 0x620D, 0x7AD6, 0x5885, 0x5EB6, 0x6570, 0x6F31,
+    0x8582, 0x8583, 0x8586, 0x8588, 0x8589, 0x858A, 0x858B, 0x858C, 0x858D, 0x858E, 0x8590, 0x8591, 0x8592, 0x8593, 0x8594, 0x8595, 0x8596, 0x8597, 0x8598, 0x8599, 0x859A, 0x859D, 0x859E, 0x859F, 0x85A0, 0x85A1, 0x85A2, 0x85A3, 0x85A5, 0x85A6, 0x85A7, 0x85A9, 0x85AB, 0x85AC, 0x85AD, 0x85B1, 0x85B2, 0x85B3, 0x85B4, 0x85B5, 0x85B6, 0x85B8, 0x85BA, 0x85BB, 0x85BC, 0x85BD, 0x85BE, 0x85BF, 0x85C0, 0x85C2, 0x85C3, 0x85C4, 0x85C5, 0x85C6, 0x85C7, 0x85C8, 0x85CA, 0x85CB, 0x85CC, 0x85CD, 0x85CE, 0x85D1, 0x85D2, 0x85D4, 0x85D6, 0x85D7, 0x85D8, 0x85D9, 0x85DA, 0x85DB, 0x85DD, 0x85DE, 0x85DF, 0x85E0, 0x85E1, 0x85E2, 0x85E3, 0x85E5, 0x85E6, 0x85E7, 0x85E8, 0x85EA, 0x85EB, 0x85EC, 0x85ED, 0x85EE, 0x85EF, 0x85F0, 0x85F1, 0x85F2, 0x85F3, 0x85F4, 0x85F5, 0x85F6, 0x85F7,
+    0x85F8, 0x6055, 0x5237, 0x800D, 0x6454, 0x8870, 0x7529, 0x5E05, 0x6813, 0x62F4, 0x971C, 0x53CC, 0x723D, 0x8C01, 0x6C34, 0x7761, 0x7A0E, 0x542E, 0x77AC, 0x987A, 0x821C, 0x8BF4, 0x7855, 0x6714, 0x70C1, 0x65AF, 0x6495, 0x5636, 0x601D, 0x79C1, 0x53F8, 0x4E1D, 0x6B7B, 0x8086, 0x5BFA, 0x55E3, 0x56DB, 0x4F3A, 0x4F3C, 0x9972, 0x5DF3, 0x677E, 0x8038, 0x6002, 0x9882, 0x9001, 0x5B8B, 0x8BBC, 0x8BF5, 0x641C, 0x8258, 0x64DE, 0x55FD, 0x82CF, 0x9165, 0x4FD7, 0x7D20, 0x901F, 0x7C9F, 0x50F3, 0x5851, 0x6EAF, 0x5BBF, 0x8BC9, 0x8083, 0x9178, 0x849C, 0x7B97, 0x867D, 0x968B, 0x968F, 0x7EE5, 0x9AD3, 0x788E, 0x5C81, 0x7A57, 0x9042, 0x96A7, 0x795F, 0x5B59, 0x635F, 0x7B0B, 0x84D1, 0x68AD, 0x5506, 0x7F29, 0x7410, 0x7D22, 0x9501, 0x6240, 0x584C, 0x4ED6, 0x5B83, 0x5979, 0x5854,
+    0x85F9, 0x85FA, 0x85FC, 0x85FD, 0x85FE, 0x8600, 0x8601, 0x8602, 0x8603, 0x8604, 0x8606, 0x8607, 0x8608, 0x8609, 0x860A, 0x860B, 0x860C, 0x860D, 0x860E, 0x860F, 0x8610, 0x8612, 0x8613, 0x8614, 0x8615, 0x8617, 0x8618, 0x8619, 0x861A, 0x861B, 0x861C, 0x861D, 0x861E, 0x861F, 0x8620, 0x8621, 0x8622, 0x8623, 0x8624, 0x8625, 0x8626, 0x8628, 0x862A, 0x862B, 0x862C, 0x862D, 0x862E, 0x862F, 0x8630, 0x8631, 0x8632, 0x8633, 0x8634, 0x8635, 0x8636, 0x8637, 0x8639, 0x863A, 0x863B, 0x863D, 0x863E, 0x863F, 0x8640, 0x8641, 0x8642, 0x8643, 0x8644, 0x8645, 0x8646, 0x8647, 0x8648, 0x8649, 0x864A, 0x864B, 0x864C, 0x8652, 0x8653, 0x8655, 0x8656, 0x8657, 0x8658, 0x8659, 0x865B, 0x865C, 0x865D, 0x865F, 0x8660, 0x8661, 0x8663, 0x8664, 0x8665, 0x8666, 0x8667, 0x8668, 0x8669,
+    0x866A, 0x736D, 0x631E, 0x8E4B, 0x8E0F, 0x80CE, 0x82D4, 0x62AC, 0x53F0, 0x6CF0, 0x915E, 0x592A, 0x6001, 0x6C70, 0x574D, 0x644A, 0x8D2A, 0x762B, 0x6EE9, 0x575B, 0x6A80, 0x75F0, 0x6F6D, 0x8C2D, 0x8C08, 0x5766, 0x6BEF, 0x8892, 0x78B3, 0x63A2, 0x53F9, 0x70AD, 0x6C64, 0x5858, 0x642A, 0x5802, 0x68E0, 0x819B, 0x5510, 0x7CD6, 0x5018, 0x8EBA, 0x6DCC, 0x8D9F, 0x70EB, 0x638F, 0x6D9B, 0x6ED4, 0x7EE6, 0x8404, 0x6843, 0x9003, 0x6DD8, 0x9676, 0x8BA8, 0x5957, 0x7279, 0x85E4, 0x817E, 0x75BC, 0x8A8A, 0x68AF, 0x5254, 0x8E22, 0x9511, 0x63D0, 0x9898, 0x8E44, 0x557C, 0x4F53, 0x66FF, 0x568F, 0x60D5, 0x6D95, 0x5243, 0x5C49, 0x5929, 0x6DFB, 0x586B, 0x7530, 0x751C, 0x606C, 0x8214, 0x8146, 0x6311, 0x6761, 0x8FE2, 0x773A, 0x8DF3, 0x8D34, 0x94C1, 0x5E16, 0x5385, 0x542C, 0x70C3,
+    0x866D, 0x866F, 0x8670, 0x8672, 0x8673, 0x8674, 0x8675, 0x8676, 0x8677, 0x8678, 0x8683, 0x8684, 0x8685, 0x8686, 0x8687, 0x8688, 0x8689, 0x868E, 0x868F, 0x8690, 0x8691, 0x8692, 0x8694, 0x8696, 0x8697, 0x8698, 0x8699, 0x869A, 0x869B, 0x869E, 0x869F, 0x86A0, 0x86A1, 0x86A2, 0x86A5, 0x86A6, 0x86AB, 0x86AD, 0x86AE, 0x86B2, 0x86B3, 0x86B7, 0x86B8, 0x86B9, 0x86BB, 0x86BC, 0x86BD, 0x86BE, 0x86BF, 0x86C1, 0x86C2, 0x86C3, 0x86C5, 0x86C8, 0x86CC, 0x86CD, 0x86D2, 0x86D3, 0x86D5, 0x86D6, 0x86D7, 0x86DA, 0x86DC, 0x86DD, 0x86E0, 0x86E1, 0x86E2, 0x86E3, 0x86E5, 0x86E6, 0x86E7, 0x86E8, 0x86EA, 0x86EB, 0x86EC, 0x86EF, 0x86F5, 0x86F6, 0x86F7, 0x86FA, 0x86FB, 0x86FC, 0x86FD, 0x86FF, 0x8701, 0x8704, 0x8705, 0x8706, 0x870B, 0x870C, 0x870E, 0x870F, 0x8710, 0x8711, 0x8714,
+    0x8716, 0x6C40, 0x5EF7, 0x505C, 0x4EAD, 0x5EAD, 0x633A, 0x8247, 0x901A, 0x6850, 0x916E, 0x77B3, 0x540C, 0x94DC, 0x5F64, 0x7AE5, 0x6876, 0x6345, 0x7B52, 0x7EDF, 0x75DB, 0x5077, 0x6295, 0x5934, 0x900F, 0x51F8, 0x79C3, 0x7A81, 0x56FE, 0x5F92, 0x9014, 0x6D82, 0x5C60, 0x571F, 0x5410, 0x5154, 0x6E4D, 0x56E2, 0x63A8, 0x9893, 0x817F, 0x8715, 0x892A, 0x9000, 0x541E, 0x5C6F, 0x81C0, 0x62D6, 0x6258, 0x8131, 0x9E35, 0x9640, 0x9A6E, 0x9A7C, 0x692D, 0x59A5, 0x62D3, 0x553E, 0x6316, 0x54C7, 0x86D9, 0x6D3C, 0x5A03, 0x74E6, 0x889C, 0x6B6A, 0x5916, 0x8C4C, 0x5F2F, 0x6E7E, 0x73A9, 0x987D, 0x4E38, 0x70F7, 0x5B8C, 0x7897, 0x633D, 0x665A, 0x7696, 0x60CB, 0x5B9B, 0x5A49, 0x4E07, 0x8155, 0x6C6A, 0x738B, 0x4EA1, 0x6789, 0x7F51, 0x5F80, 0x65FA, 0x671B, 0x5FD8, 0x5984, 0x5A01,
+    0x8719, 0x871B, 0x871D, 0x871F, 0x8720, 0x8724, 0x8726, 0x8727, 0x8728, 0x872A, 0x872B, 0x872C, 0x872D, 0x872F, 0x8730, 0x8732, 0x8733, 0x8735, 0x8736, 0x8738, 0x8739, 0x873A, 0x873C, 0x873D, 0x8740, 0x8741, 0x8742, 0x8743, 0x8744, 0x8745, 0x8746, 0x874A, 0x874B, 0x874D, 0x874F, 0x8750, 0x8751, 0x8752, 0x8754, 0x8755, 0x8756, 0x8758, 0x875A, 0x875B, 0x875C, 0x875D, 0x875E, 0x875F, 0x8761, 0x8762, 0x8766, 0x8767, 0x8768, 0x8769, 0x876A, 0x876B, 0x876C, 0x876D, 0x876F, 0x8771, 0x8772, 0x8773, 0x8775, 0x8777, 0x8778, 0x8779, 0x877A, 0x877F, 0x8780, 0x8781, 0x8784, 0x8786, 0x8787, 0x8789, 0x878A, 0x878C, 0x878E, 0x878F, 0x8790, 0x8791, 0x8792, 0x8794, 0x8795, 0x8796, 0x8798, 0x8799, 0x879A, 0x879B, 0x879C, 0x879D, 0x879E, 0x87A0, 0x87A1, 0x87A2, 0x87A3,
+    0x87A4, 0x5DCD, 0x5FAE, 0x5371, 0x97E6, 0x8FDD, 0x6845, 0x56F4, 0x552F, 0x60DF, 0x4E3A, 0x6F4D, 0x7EF4, 0x82C7, 0x840E, 0x59D4, 0x4F1F, 0x4F2A, 0x5C3E, 0x7EAC, 0x672A, 0x851A, 0x5473, 0x754F, 0x80C3, 0x5582, 0x9B4F, 0x4F4D, 0x6E2D, 0x8C13, 0x5C09, 0x6170, 0x536B, 0x761F, 0x6E29, 0x868A, 0x6587, 0x95FB, 0x7EB9, 0x543B, 0x7A33, 0x7D0A, 0x95EE, 0x55E1, 0x7FC1, 0x74EE, 0x631D, 0x8717, 0x6DA1, 0x7A9D, 0x6211, 0x65A1, 0x5367, 0x63E1, 0x6C83, 0x5DEB, 0x545C, 0x94A8, 0x4E4C, 0x6C61, 0x8BEC, 0x5C4B, 0x65E0, 0x829C, 0x68A7, 0x543E, 0x5434, 0x6BCB, 0x6B66, 0x4E94, 0x6342, 0x5348, 0x821E, 0x4F0D, 0x4FAE, 0x575E, 0x620A, 0x96FE, 0x6664, 0x7269, 0x52FF, 0x52A1, 0x609F, 0x8BEF, 0x6614, 0x7199, 0x6790, 0x897F, 0x7852, 0x77FD, 0x6670, 0x563B, 0x5438, 0x9521, 0x727A,
+    0x87A5, 0x87A6, 0x87A7, 0x87A9, 0x87AA, 0x87AE, 0x87B0, 0x87B1, 0x87B2, 0x87B4, 0x87B6, 0x87B7, 0x87B8, 0x87B9, 0x87BB, 0x87BC, 0x87BE, 0x87BF, 0x87C1, 0x87C2, 0x87C3, 0x87C4, 0x87C5, 0x87C7, 0x87C8, 0x87C9, 0x87CC, 0x87CD, 0x87CE, 0x87CF, 0x87D0, 0x87D4, 0x87D5, 0x87D6, 0x87D7, 0x87D8, 0x87D9, 0x87DA, 0x87DC, 0x87DD, 0x87DE, 0x87DF, 0x87E1, 0x87E2, 0x87E3, 0x87E4, 0x87E6, 0x87E7, 0x87E8, 0x87E9, 0x87EB, 0x87EC, 0x87ED, 0x87EF, 0x87F0, 0x87F1, 0x87F2, 0x87F3, 0x87F4, 0x87F5, 0x87F6, 0x87F7, 0x87F8, 0x87FA, 0x87FB, 0x87FC, 0x87FD, 0x87FF, 0x8800, 0x8801, 0x8802, 0x8804, 0x8805, 0x8806, 0x8807, 0x8808, 0x8809, 0x880B, 0x880C, 0x880D, 0x880E, 0x880F, 0x8810, 0x8811, 0x8812, 0x8814, 0x8817, 0x8818, 0x8819, 0x881A, 0x881C, 0x881D, 0x881E, 0x881F, 0x8820,
+    0x8823, 0x7A00, 0x606F, 0x5E0C, 0x6089, 0x819D, 0x5915, 0x60DC, 0x7184, 0x70EF, 0x6EAA, 0x6C50, 0x7280, 0x6A84, 0x88AD, 0x5E2D, 0x4E60, 0x5AB3, 0x559C, 0x94E3, 0x6D17, 0x7CFB, 0x9699, 0x620F, 0x7EC6, 0x778E, 0x867E, 0x5323, 0x971E, 0x8F96, 0x6687, 0x5CE1, 0x4FA0, 0x72ED, 0x4E0B, 0x53A6, 0x590F, 0x5413, 0x6380, 0x9528, 0x5148, 0x4ED9, 0x9C9C, 0x7EA4, 0x54B8, 0x8D24, 0x8854, 0x8237, 0x95F2, 0x6D8E, 0x5F26, 0x5ACC, 0x663E, 0x9669, 0x73B0, 0x732E, 0x53BF, 0x817A, 0x9985, 0x7FA1, 0x5BAA, 0x9677, 0x9650, 0x7EBF, 0x76F8, 0x53A2, 0x9576, 0x9999, 0x7BB1, 0x8944, 0x6E58, 0x4E61, 0x7FD4, 0x7965, 0x8BE6, 0x60F3, 0x54CD, 0x4EAB, 0x9879, 0x5DF7, 0x6A61, 0x50CF, 0x5411, 0x8C61, 0x8427, 0x785D, 0x9704, 0x524A, 0x54EE, 0x56A3, 0x9500, 0x6D88, 0x5BB5, 0x6DC6, 0x6653,
+    0x8824, 0x8825, 0x8826, 0x8827, 0x8828, 0x8829, 0x882A, 0x882B, 0x882C, 0x882D, 0x882E, 0x882F, 0x8830, 0x8831, 0x8833, 0x8834, 0x8835, 0x8836, 0x8837, 0x8838, 0x883A, 0x883B, 0x883D, 0x883E, 0x883F, 0x8841, 0x8842, 0x8843, 0x8846, 0x8847, 0x8848, 0x8849, 0x884A, 0x884B, 0x884E, 0x884F, 0x8850, 0x8851, 0x8852, 0x8853, 0x8855, 0x8856, 0x8858, 0x885A, 0x885B, 0x885C, 0x885D, 0x885E, 0x885F, 0x8860, 0x8866, 0x8867, 0x886A, 0x886D, 0x886F, 0x8871, 0x8873, 0x8874, 0x8875, 0x8876, 0x8878, 0x8879, 0x887A, 0x887B, 0x887C, 0x8880, 0x8883, 0x8886, 0x8887, 0x8889, 0x888A, 0x888C, 0x888E, 0x888F, 0x8890, 0x8891, 0x8893, 0x8894, 0x8895, 0x8897, 0x8898, 0x8899, 0x889A, 0x889B, 0x889D, 0x889E, 0x889F, 0x88A0, 0x88A1, 0x88A3, 0x88A5, 0x88A6, 0x88A7, 0x88A8, 0x88A9,
+    0x88AA, 0x5C0F, 0x5B5D, 0x6821, 0x8096, 0x5578, 0x7B11, 0x6548, 0x6954, 0x4E9B, 0x6B47, 0x874E, 0x978B, 0x534F, 0x631F, 0x643A, 0x90AA, 0x659C, 0x80C1, 0x8C10, 0x5199, 0x68B0, 0x5378, 0x87F9, 0x61C8, 0x6CC4, 0x6CFB, 0x8C22, 0x5C51, 0x85AA, 0x82AF, 0x950C, 0x6B23, 0x8F9B, 0x65B0, 0x5FFB, 0x5FC3, 0x4FE1, 0x8845, 0x661F, 0x8165, 0x7329, 0x60FA, 0x5174, 0x5211, 0x578B, 0x5F62, 0x90A2, 0x884C, 0x9192, 0x5E78, 0x674F, 0x6027, 0x59D3, 0x5144, 0x51F6, 0x80F8, 0x5308, 0x6C79, 0x96C4, 0x718A, 0x4F11, 0x4FEE, 0x7F9E, 0x673D, 0x55C5, 0x9508, 0x79C0, 0x8896, 0x7EE3, 0x589F, 0x620C, 0x9700, 0x865A, 0x5618, 0x987B, 0x5F90, 0x8BB8, 0x84C4, 0x9157, 0x53D9, 0x65ED, 0x5E8F, 0x755C, 0x6064, 0x7D6E, 0x5A7F, 0x7EEA, 0x7EED, 0x8F69, 0x55A7, 0x5BA3, 0x60AC, 0x65CB, 0x7384,
+    0x88AC, 0x88AE, 0x88AF, 0x88B0, 0x88B2, 0x88B3, 0x88B4, 0x88B5, 0x88B6, 0x88B8, 0x88B9, 0x88BA, 0x88BB, 0x88BD, 0x88BE, 0x88BF, 0x88C0, 0x88C3, 0x88C4, 0x88C7, 0x88C8, 0x88CA, 0x88CB, 0x88CC, 0x88CD, 0x88CF, 0x88D0, 0x88D1, 0x88D3, 0x88D6, 0x88D7, 0x88DA, 0x88DB, 0x88DC, 0x88DD, 0x88DE, 0x88E0, 0x88E1, 0x88E6, 0x88E7, 0x88E9, 0x88EA, 0x88EB, 0x88EC, 0x88ED, 0x88EE, 0x88EF, 0x88F2, 0x88F5, 0x88F6, 0x88F7, 0x88FA, 0x88FB, 0x88FD, 0x88FF, 0x8900, 0x8901, 0x8903, 0x8904, 0x8905, 0x8906, 0x8907, 0x8908, 0x8909, 0x890B, 0x890C, 0x890D, 0x890E, 0x890F, 0x8911, 0x8914, 0x8915, 0x8916, 0x8917, 0x8918, 0x891C, 0x891D, 0x891E, 0x891F, 0x8920, 0x8922, 0x8923, 0x8924, 0x8926, 0x8927, 0x8928, 0x8929, 0x892C, 0x892D, 0x892E, 0x892F, 0x8931, 0x8932, 0x8933, 0x8935,
+    0x8937, 0x9009, 0x7663, 0x7729, 0x7EDA, 0x9774, 0x859B, 0x5B66, 0x7A74, 0x96EA, 0x8840, 0x52CB, 0x718F, 0x5FAA, 0x65EC, 0x8BE2, 0x5BFB, 0x9A6F, 0x5DE1, 0x6B89, 0x6C5B, 0x8BAD, 0x8BAF, 0x900A, 0x8FC5, 0x538B, 0x62BC, 0x9E26, 0x9E2D, 0x5440, 0x4E2B, 0x82BD, 0x7259, 0x869C, 0x5D16, 0x8859, 0x6DAF, 0x96C5, 0x54D1, 0x4E9A, 0x8BB6, 0x7109, 0x54BD, 0x9609, 0x70DF, 0x6DF9, 0x76D0, 0x4E25, 0x7814, 0x8712, 0x5CA9, 0x5EF6, 0x8A00, 0x989C, 0x960E, 0x708E, 0x6CBF, 0x5944, 0x63A9, 0x773C, 0x884D, 0x6F14, 0x8273, 0x5830, 0x71D5, 0x538C, 0x781A, 0x96C1, 0x5501, 0x5F66, 0x7130, 0x5BB4, 0x8C1A, 0x9A8C, 0x6B83, 0x592E, 0x9E2F, 0x79E7, 0x6768, 0x626C, 0x4F6F, 0x75A1, 0x7F8A, 0x6D0B, 0x9633, 0x6C27, 0x4EF0, 0x75D2, 0x517B, 0x6837, 0x6F3E, 0x9080, 0x8170, 0x5996, 0x7476,
+    0x8938, 0x8939, 0x893A, 0x893B, 0x893C, 0x893D, 0x893E, 0x893F, 0x8940, 0x8942, 0x8943, 0x8945, 0x8946, 0x8947, 0x8948, 0x8949, 0x894A, 0x894B, 0x894C, 0x894D, 0x894E, 0x894F, 0x8950, 0x8951, 0x8952, 0x8953, 0x8954, 0x8955, 0x8956, 0x8957, 0x8958, 0x8959, 0x895A, 0x895B, 0x895C, 0x895D, 0x8960, 0x8961, 0x8962, 0x8963, 0x8964, 0x8965, 0x8967, 0x8968, 0x8969, 0x896A, 0x896B, 0x896C, 0x896D, 0x896E, 0x896F, 0x8970, 0x8971, 0x8972, 0x8973, 0x8974, 0x8975, 0x8976, 0x8977, 0x8978, 0x8979, 0x897A, 0x897C, 0x897D, 0x897E, 0x8980, 0x8982, 0x8984, 0x8985, 0x8987, 0x8988, 0x8989, 0x898A, 0x898B, 0x898C, 0x898D, 0x898E, 0x898F, 0x8990, 0x8991, 0x8992, 0x8993, 0x8994, 0x8995, 0x8996, 0x8997, 0x8998, 0x8999, 0x899A, 0x899B, 0x899C, 0x899D, 0x899E, 0x899F, 0x89A0,
+    0x89A1, 0x6447, 0x5C27, 0x9065, 0x7A91, 0x8C23, 0x59DA, 0x54AC, 0x8200, 0x836F, 0x8981, 0x8000, 0x6930, 0x564E, 0x8036, 0x7237, 0x91CE, 0x51B6, 0x4E5F, 0x9875, 0x6396, 0x4E1A, 0x53F6, 0x66F3, 0x814B, 0x591C, 0x6DB2, 0x4E00, 0x58F9, 0x533B, 0x63D6, 0x94F1, 0x4F9D, 0x4F0A, 0x8863, 0x9890, 0x5937, 0x9057, 0x79FB, 0x4EEA, 0x80F0, 0x7591, 0x6C82, 0x5B9C, 0x59E8, 0x5F5D, 0x6905, 0x8681, 0x501A, 0x5DF2, 0x4E59, 0x77E3, 0x4EE5, 0x827A, 0x6291, 0x6613, 0x9091, 0x5C79, 0x4EBF, 0x5F79, 0x81C6, 0x9038, 0x8084, 0x75AB, 0x4EA6, 0x88D4, 0x610F, 0x6BC5, 0x5FC6, 0x4E49, 0x76CA, 0x6EA2, 0x8BE3, 0x8BAE, 0x8C0A, 0x8BD1, 0x5F02, 0x7FFC, 0x7FCC, 0x7ECE, 0x8335, 0x836B, 0x56E0, 0x6BB7, 0x97F3, 0x9634, 0x59FB, 0x541F, 0x94F6, 0x6DEB, 0x5BC5, 0x996E, 0x5C39, 0x5F15, 0x9690,
+    0x89A2, 0x89A3, 0x89A4, 0x89A5, 0x89A6, 0x89A7, 0x89A8, 0x89A9, 0x89AA, 0x89AB, 0x89AC, 0x89AD, 0x89AE, 0x89AF, 0x89B0, 0x89B1, 0x89B2, 0x89B3, 0x89B4, 0x89B5, 0x89B6, 0x89B7, 0x89B8, 0x89B9, 0x89BA, 0x89BB, 0x89BC, 0x89BD, 0x89BE, 0x89BF, 0x89C0, 0x89C3, 0x89CD, 0x89D3, 0x89D4, 0x89D5, 0x89D7, 0x89D8, 0x89D9, 0x89DB, 0x89DD, 0x89DF, 0x89E0, 0x89E1, 0x89E2, 0x89E4, 0x89E7, 0x89E8, 0x89E9, 0x89EA, 0x89EC, 0x89ED, 0x89EE, 0x89F0, 0x89F1, 0x89F2, 0x89F4, 0x89F5, 0x89F6, 0x89F7, 0x89F8, 0x89F9, 0x89FA, 0x89FB, 0x89FC, 0x89FD, 0x89FE, 0x89FF, 0x8A01, 0x8A02, 0x8A03, 0x8A04, 0x8A05, 0x8A06, 0x8A08, 0x8A09, 0x8A0A, 0x8A0B, 0x8A0C, 0x8A0D, 0x8A0E, 0x8A0F, 0x8A10, 0x8A11, 0x8A12, 0x8A13, 0x8A14, 0x8A15, 0x8A16, 0x8A17, 0x8A18, 0x8A19, 0x8A1A, 0x8A1B, 0x8A1C,
+    0x8A1D, 0x5370, 0x82F1, 0x6A31, 0x5A74, 0x9E70, 0x5E94, 0x7F28, 0x83B9, 0x8424, 0x8425, 0x8367, 0x8747, 0x8FCE, 0x8D62, 0x76C8, 0x5F71, 0x9896, 0x786C, 0x6620, 0x54DF, 0x62E5, 0x4F63, 0x81C3, 0x75C8, 0x5EB8, 0x96CD, 0x8E0A, 0x86F9, 0x548F, 0x6CF3, 0x6D8C, 0x6C38, 0x607F, 0x52C7, 0x7528, 0x5E7D, 0x4F18, 0x60A0, 0x5FE7, 0x5C24, 0x7531, 0x90AE, 0x94C0, 0x72B9, 0x6CB9, 0x6E38, 0x9149, 0x6709, 0x53CB, 0x53F3, 0x4F51, 0x91C9, 0x8BF1, 0x53C8, 0x5E7C, 0x8FC2, 0x6DE4, 0x4E8E, 0x76C2, 0x6986, 0x865E, 0x611A, 0x8206, 0x4F59, 0x4FDE, 0x903E, 0x9C7C, 0x6109, 0x6E1D, 0x6E14, 0x9685, 0x4E88, 0x5A31, 0x96E8, 0x4E0E, 0x5C7F, 0x79B9, 0x5B87, 0x8BED, 0x7FBD, 0x7389, 0x57DF, 0x828B, 0x90C1, 0x5401, 0x9047, 0x55BB, 0x5CEA, 0x5FA1, 0x6108, 0x6B32, 0x72F1, 0x80B2, 0x8A89,
+    0x8A1E, 0x8A1F, 0x8A20, 0x8A21, 0x8A22, 0x8A23, 0x8A24, 0x8A25, 0x8A26, 0x8A27, 0x8A28, 0x8A29, 0x8A2A, 0x8A2B, 0x8A2C, 0x8A2D, 0x8A2E, 0x8A2F, 0x8A30, 0x8A31, 0x8A32, 0x8A33, 0x8A34, 0x8A35, 0x8A36, 0x8A37, 0x8A38, 0x8A39, 0x8A3A, 0x8A3B, 0x8A3C, 0x8A3D, 0x8A3F, 0x8A40, 0x8A41, 0x8A42, 0x8A43, 0x8A44, 0x8A45, 0x8A46, 0x8A47, 0x8A49, 0x8A4A, 0x8A4B, 0x8A4C, 0x8A4D, 0x8A4E, 0x8A4F, 0x8A50, 0x8A51, 0x8A52, 0x8A53, 0x8A54, 0x8A55, 0x8A56, 0x8A57, 0x8A58, 0x8A59, 0x8A5A, 0x8A5B, 0x8A5C, 0x8A5D, 0x8A5E, 0x8A5F, 0x8A60, 0x8A61, 0x8A62, 0x8A63, 0x8A64, 0x8A65, 0x8A66, 0x8A67, 0x8A68, 0x8A69, 0x8A6A, 0x8A6B, 0x8A6C, 0x8A6D, 0x8A6E, 0x8A6F, 0x8A70, 0x8A71, 0x8A72, 0x8A73, 0x8A74, 0x8A75, 0x8A76, 0x8A77, 0x8A78, 0x8A7A, 0x8A7B, 0x8A7C, 0x8A7D, 0x8A7E, 0x8A7F,
+    0x8A80, 0x6D74, 0x5BD3, 0x88D5, 0x9884, 0x8C6B, 0x9A6D, 0x9E33, 0x6E0A, 0x51A4, 0x5143, 0x57A3, 0x8881, 0x539F, 0x63F4, 0x8F95, 0x56ED, 0x5458, 0x5706, 0x733F, 0x6E90, 0x7F18, 0x8FDC, 0x82D1, 0x613F, 0x6028, 0x9662, 0x66F0, 0x7EA6, 0x8D8A, 0x8DC3, 0x94A5, 0x5CB3, 0x7CA4, 0x6708, 0x60A6, 0x9605, 0x8018, 0x4E91, 0x90E7, 0x5300, 0x9668, 0x5141, 0x8FD0, 0x8574, 0x915D, 0x6655, 0x97F5, 0x5B55, 0x531D, 0x7838, 0x6742, 0x683D, 0x54C9, 0x707E, 0x5BB0, 0x8F7D, 0x518D, 0x5728, 0x54B1, 0x6512, 0x6682, 0x8D5E, 0x8D43, 0x810F, 0x846C, 0x906D, 0x7CDF, 0x51FF, 0x85FB, 0x67A3, 0x65E9, 0x6FA1, 0x86A4, 0x8E81, 0x566A, 0x9020, 0x7682, 0x7076, 0x71E5, 0x8D23, 0x62E9, 0x5219, 0x6CFD, 0x8D3C, 0x600E, 0x589E, 0x618E, 0x66FE, 0x8D60, 0x624E, 0x55B3, 0x6E23, 0x672D, 0x8F67,
+    0x8A81, 0x8A82, 0x8A83, 0x8A84, 0x8A85, 0x8A86, 0x8A87, 0x8A88, 0x8A8B, 0x8A8C, 0x8A8D, 0x8A8E, 0x8A8F, 0x8A90, 0x8A91, 0x8A92, 0x8A94, 0x8A95, 0x8A96, 0x8A97, 0x8A98, 0x8A99, 0x8A9A, 0x8A9B, 0x8A9C, 0x8A9D, 0x8A9E, 0x8A9F, 0x8AA0, 0x8AA1, 0x8AA2, 0x8AA3, 0x8AA4, 0x8AA5, 0x8AA6, 0x8AA7, 0x8AA8, 0x8AA9, 0x8AAA, 0x8AAB, 0x8AAC, 0x8AAD, 0x8AAE, 0x8AAF, 0x8AB0, 0x8AB1, 0x8AB2, 0x8AB3, 0x8AB4, 0x8AB5, 0x8AB6, 0x8AB7, 0x8AB8, 0x8AB9, 0x8ABA, 0x8ABB, 0x8ABC, 0x8ABD, 0x8ABE, 0x8ABF, 0x8AC0, 0x8AC1, 0x8AC2, 0x8AC3, 0x8AC4, 0x8AC5, 0x8AC6, 0x8AC7, 0x8AC8, 0x8AC9, 0x8ACA, 0x8ACB, 0x8ACC, 0x8ACD, 0x8ACE, 0x8ACF, 0x8AD0, 0x8AD1, 0x8AD2, 0x8AD3, 0x8AD4, 0x8AD5, 0x8AD6, 0x8AD7, 0x8AD8, 0x8AD9, 0x8ADA, 0x8ADB, 0x8ADC, 0x8ADD, 0x8ADE, 0x8ADF, 0x8AE0, 0x8AE1, 0x8AE2,
+    0x8AE3, 0x94E1, 0x95F8, 0x7728, 0x6805, 0x69A8, 0x548B, 0x4E4D, 0x70B8, 0x8BC8, 0x6458, 0x658B, 0x5B85, 0x7A84, 0x503A, 0x5BE8, 0x77BB, 0x6BE1, 0x8A79, 0x7C98, 0x6CBE, 0x76CF, 0x65A9, 0x8F97, 0x5D2D, 0x5C55, 0x8638, 0x6808, 0x5360, 0x6218, 0x7AD9, 0x6E5B, 0x7EFD, 0x6A1F, 0x7AE0, 0x5F70, 0x6F33, 0x5F20, 0x638C, 0x6DA8, 0x6756, 0x4E08, 0x5E10, 0x8D26, 0x4ED7, 0x80C0, 0x7634, 0x969C, 0x62DB, 0x662D, 0x627E, 0x6CBC, 0x8D75, 0x7167, 0x7F69, 0x5146, 0x8087, 0x53EC, 0x906E, 0x6298, 0x54F2, 0x86F0, 0x8F99, 0x8005, 0x9517, 0x8517, 0x8FD9, 0x6D59, 0x73CD, 0x659F, 0x771F, 0x7504, 0x7827, 0x81FB, 0x8D1E, 0x9488, 0x4FA6, 0x6795, 0x75B9, 0x8BCA, 0x9707, 0x632F, 0x9547, 0x9635, 0x84B8, 0x6323, 0x7741, 0x5F81, 0x72F0, 0x4E89, 0x6014, 0x6574, 0x62EF, 0x6B63, 0x653F,
+    0x8AE4, 0x8AE5, 0x8AE6, 0x8AE7, 0x8AE8, 0x8AE9, 0x8AEA, 0x8AEB, 0x8AEC, 0x8AED, 0x8AEE, 0x8AEF, 0x8AF0, 0x8AF1, 0x8AF2, 0x8AF3, 0x8AF4, 0x8AF5, 0x8AF6, 0x8AF7, 0x8AF8, 0x8AF9, 0x8AFA, 0x8AFB, 0x8AFC, 0x8AFD, 0x8AFE, 0x8AFF, 0x8B00, 0x8B01, 0x8B02, 0x8B03, 0x8B04, 0x8B05, 0x8B06, 0x8B08, 0x8B09, 0x8B0A, 0x8B0B, 0x8B0C, 0x8B0D, 0x8B0E, 0x8B0F, 0x8B10, 0x8B11, 0x8B12, 0x8B13, 0x8B14, 0x8B15, 0x8B16, 0x8B17, 0x8B18, 0x8B19, 0x8B1A, 0x8B1B, 0x8B1C, 0x8B1D, 0x8B1E, 0x8B1F, 0x8B20, 0x8B21, 0x8B22, 0x8B23, 0x8B24, 0x8B25, 0x8B27, 0x8B28, 0x8B29, 0x8B2A, 0x8B2B, 0x8B2C, 0x8B2D, 0x8B2E, 0x8B2F, 0x8B30, 0x8B31, 0x8B32, 0x8B33, 0x8B34, 0x8B35, 0x8B36, 0x8B37, 0x8B38, 0x8B39, 0x8B3A, 0x8B3B, 0x8B3C, 0x8B3D, 0x8B3E, 0x8B3F, 0x8B40, 0x8B41, 0x8B42, 0x8B43, 0x8B44,
+    0x8B45, 0x5E27, 0x75C7, 0x90D1, 0x8BC1, 0x829D, 0x679D, 0x652F, 0x5431, 0x8718, 0x77E5, 0x80A2, 0x8102, 0x6C41, 0x4E4B, 0x7EC7, 0x804C, 0x76F4, 0x690D, 0x6B96, 0x6267, 0x503C, 0x4F84, 0x5740, 0x6307, 0x6B62, 0x8DBE, 0x53EA, 0x65E8, 0x7EB8, 0x5FD7, 0x631A, 0x63B7, 0x81F3, 0x81F4, 0x7F6E, 0x5E1C, 0x5CD9, 0x5236, 0x667A, 0x79E9, 0x7A1A, 0x8D28, 0x7099, 0x75D4, 0x6EDE, 0x6CBB, 0x7A92, 0x4E2D, 0x76C5, 0x5FE0, 0x949F, 0x8877, 0x7EC8, 0x79CD, 0x80BF, 0x91CD, 0x4EF2, 0x4F17, 0x821F, 0x5468, 0x5DDE, 0x6D32, 0x8BCC, 0x7CA5, 0x8F74, 0x8098, 0x5E1A, 0x5492, 0x76B1, 0x5B99, 0x663C, 0x9AA4, 0x73E0, 0x682A, 0x86DB, 0x6731, 0x732A, 0x8BF8, 0x8BDB, 0x9010, 0x7AF9, 0x70DB, 0x716E, 0x62C4, 0x77A9, 0x5631, 0x4E3B, 0x8457, 0x67F1, 0x52A9, 0x86C0, 0x8D2E, 0x94F8, 0x7B51,
+    0x8B46, 0x8B47, 0x8B48, 0x8B49, 0x8B4A, 0x8B4B, 0x8B4C, 0x8B4D, 0x8B4E, 0x8B4F, 0x8B50, 0x8B51, 0x8B52, 0x8B53, 0x8B54, 0x8B55, 0x8B56, 0x8B57, 0x8B58, 0x8B59, 0x8B5A, 0x8B5B, 0x8B5C, 0x8B5D, 0x8B5E, 0x8B5F, 0x8B60, 0x8B61, 0x8B62, 0x8B63, 0x8B64, 0x8B65, 0x8B67, 0x8B68, 0x8B69, 0x8B6A, 0x8B6B, 0x8B6D, 0x8B6E, 0x8B6F, 0x8B70, 0x8B71, 0x8B72, 0x8B73, 0x8B74, 0x8B75, 0x8B76, 0x8B77, 0x8B78, 0x8B79, 0x8B7A, 0x8B7B, 0x8B7C, 0x8B7D, 0x8B7E, 0x8B7F, 0x8B80, 0x8B81, 0x8B82, 0x8B83, 0x8B84, 0x8B85, 0x8B86, 0x8B87, 0x8B88, 0x8B89, 0x8B8A, 0x8B8B, 0x8B8C, 0x8B8D, 0x8B8E, 0x8B8F, 0x8B90, 0x8B91, 0x8B92, 0x8B93, 0x8B94, 0x8B95, 0x8B96, 0x8B97, 0x8B98, 0x8B99, 0x8B9A, 0x8B9B, 0x8B9C, 0x8B9D, 0x8B9E, 0x8B9F, 0x8BAC, 0x8BB1, 0x8BBB, 0x8BC7, 0x8BD0, 0x8BEA, 0x8C09,
+    0x8C1E, 0x4F4F, 0x6CE8, 0x795D, 0x9A7B, 0x6293, 0x722A, 0x62FD, 0x4E13, 0x7816, 0x8F6C, 0x64B0, 0x8D5A, 0x7BC6, 0x6869, 0x5E84, 0x88C5, 0x5986, 0x649E, 0x58EE, 0x72B6, 0x690E, 0x9525, 0x8FFD, 0x8D58, 0x5760, 0x7F00, 0x8C06, 0x51C6, 0x6349, 0x62D9, 0x5353, 0x684C, 0x7422, 0x8301, 0x914C, 0x5544, 0x7740, 0x707C, 0x6D4A, 0x5179, 0x54A8, 0x8D44, 0x59FF, 0x6ECB, 0x6DC4, 0x5B5C, 0x7D2B, 0x4ED4, 0x7C7D, 0x6ED3, 0x5B50, 0x81EA, 0x6E0D, 0x5B57, 0x9B03, 0x68D5, 0x8E2A, 0x5B97, 0x7EFC, 0x603B, 0x7EB5, 0x90B9, 0x8D70, 0x594F, 0x63CD, 0x79DF, 0x8DB3, 0x5352, 0x65CF, 0x7956, 0x8BC5, 0x963B, 0x7EC4, 0x94BB, 0x7E82, 0x5634, 0x9189, 0x6700, 0x7F6A, 0x5C0A, 0x9075, 0x6628, 0x5DE6, 0x4F50, 0x67DE, 0x505A, 0x4F5C, 0x5750, 0x5EA7, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x8C38, 0x8C39, 0x8C3A, 0x8C3B, 0x8C3C, 0x8C3D, 0x8C3E, 0x8C3F, 0x8C40, 0x8C42, 0x8C43, 0x8C44, 0x8C45, 0x8C48, 0x8C4A, 0x8C4B, 0x8C4D, 0x8C4E, 0x8C4F, 0x8C50, 0x8C51, 0x8C52, 0x8C53, 0x8C54, 0x8C56, 0x8C57, 0x8C58, 0x8C59, 0x8C5B, 0x8C5C, 0x8C5D, 0x8C5E, 0x8C5F, 0x8C60, 0x8C63, 0x8C64, 0x8C65, 0x8C66, 0x8C67, 0x8C68, 0x8C69, 0x8C6C, 0x8C6D, 0x8C6E, 0x8C6F, 0x8C70, 0x8C71, 0x8C72, 0x8C74, 0x8C75, 0x8C76, 0x8C77, 0x8C7B, 0x8C7C, 0x8C7D, 0x8C7E, 0x8C7F, 0x8C80, 0x8C81, 0x8C83, 0x8C84, 0x8C86, 0x8C87, 0x8C88, 0x8C8B, 0x8C8D, 0x8C8E, 0x8C8F, 0x8C90, 0x8C91, 0x8C92, 0x8C93, 0x8C95, 0x8C96, 0x8C97, 0x8C99, 0x8C9A, 0x8C9B, 0x8C9C, 0x8C9D, 0x8C9E, 0x8C9F, 0x8CA0, 0x8CA1, 0x8CA2, 0x8CA3, 0x8CA4, 0x8CA5, 0x8CA6, 0x8CA7, 0x8CA8, 0x8CA9, 0x8CAA, 0x8CAB, 0x8CAC,
+    0x8CAD, 0x4E8D, 0x4E0C, 0x5140, 0x4E10, 0x5EFF, 0x5345, 0x4E15, 0x4E98, 0x4E1E, 0x9B32, 0x5B6C, 0x5669, 0x4E28, 0x79BA, 0x4E3F, 0x5315, 0x4E47, 0x592D, 0x723B, 0x536E, 0x6C10, 0x56DF, 0x80E4, 0x9997, 0x6BD3, 0x777E, 0x9F17, 0x4E36, 0x4E9F, 0x9F10, 0x4E5C, 0x4E69, 0x4E93, 0x8288, 0x5B5B, 0x556C, 0x560F, 0x4EC4, 0x538D, 0x539D, 0x53A3, 0x53A5, 0x53AE, 0x9765, 0x8D5D, 0x531A, 0x53F5, 0x5326, 0x532E, 0x533E, 0x8D5C, 0x5366, 0x5363, 0x5202, 0x5208, 0x520E, 0x522D, 0x5233, 0x523F, 0x5240, 0x524C, 0x525E, 0x5261, 0x525C, 0x84AF, 0x527D, 0x5282, 0x5281, 0x5290, 0x5293, 0x5182, 0x7F54, 0x4EBB, 0x4EC3, 0x4EC9, 0x4EC2, 0x4EE8, 0x4EE1, 0x4EEB, 0x4EDE, 0x4F1B, 0x4EF3, 0x4F22, 0x4F64, 0x4EF5, 0x4F25, 0x4F27, 0x4F09, 0x4F2B, 0x4F5E, 0x4F67, 0x6538, 0x4F5A, 0x4F5D,
+    0x8CAE, 0x8CAF, 0x8CB0, 0x8CB1, 0x8CB2, 0x8CB3, 0x8CB4, 0x8CB5, 0x8CB6, 0x8CB7, 0x8CB8, 0x8CB9, 0x8CBA, 0x8CBB, 0x8CBC, 0x8CBD, 0x8CBE, 0x8CBF, 0x8CC0, 0x8CC1, 0x8CC2, 0x8CC3, 0x8CC4, 0x8CC5, 0x8CC6, 0x8CC7, 0x8CC8, 0x8CC9, 0x8CCA, 0x8CCB, 0x8CCC, 0x8CCD, 0x8CCE, 0x8CCF, 0x8CD0, 0x8CD1, 0x8CD2, 0x8CD3, 0x8CD4, 0x8CD5, 0x8CD6, 0x8CD7, 0x8CD8, 0x8CD9, 0x8CDA, 0x8CDB, 0x8CDC, 0x8CDD, 0x8CDE, 0x8CDF, 0x8CE0, 0x8CE1, 0x8CE2, 0x8CE3, 0x8CE4, 0x8CE5, 0x8CE6, 0x8CE7, 0x8CE8, 0x8CE9, 0x8CEA, 0x8CEB, 0x8CEC, 0x8CED, 0x8CEE, 0x8CEF, 0x8CF0, 0x8CF1, 0x8CF2, 0x8CF3, 0x8CF4, 0x8CF5, 0x8CF6, 0x8CF7, 0x8CF8, 0x8CF9, 0x8CFA, 0x8CFB, 0x8CFC, 0x8CFD, 0x8CFE, 0x8CFF, 0x8D00, 0x8D01, 0x8D02, 0x8D03, 0x8D04, 0x8D05, 0x8D06, 0x8D07, 0x8D08, 0x8D09, 0x8D0A, 0x8D0B, 0x8D0C,
+    0x8D0D, 0x4F5F, 0x4F57, 0x4F32, 0x4F3D, 0x4F76, 0x4F74, 0x4F91, 0x4F89, 0x4F83, 0x4F8F, 0x4F7E, 0x4F7B, 0x4FAA, 0x4F7C, 0x4FAC, 0x4F94, 0x4FE6, 0x4FE8, 0x4FEA, 0x4FC5, 0x4FDA, 0x4FE3, 0x4FDC, 0x4FD1, 0x4FDF, 0x4FF8, 0x5029, 0x504C, 0x4FF3, 0x502C, 0x500F, 0x502E, 0x502D, 0x4FFE, 0x501C, 0x500C, 0x5025, 0x5028, 0x507E, 0x5043, 0x5055, 0x5048, 0x504E, 0x506C, 0x507B, 0x50A5, 0x50A7, 0x50A9, 0x50BA, 0x50D6, 0x5106, 0x50ED, 0x50EC, 0x50E6, 0x50EE, 0x5107, 0x510B, 0x4EDD, 0x6C3D, 0x4F58, 0x4F65, 0x4FCE, 0x9FA0, 0x6C46, 0x7C74, 0x516E, 0x5DFD, 0x9EC9, 0x9998, 0x5181, 0x5914, 0x52F9, 0x530D, 0x8A07, 0x5310, 0x51EB, 0x5919, 0x5155, 0x4EA0, 0x5156, 0x4EB3, 0x886E, 0x88A4, 0x4EB5, 0x8114, 0x88D2, 0x7980, 0x5B34, 0x8803, 0x7FB8, 0x51AB, 0x51B1, 0x51BD, 0x51BC,
+    0x8D0E, 0x8D0F, 0x8D10, 0x8D11, 0x8D12, 0x8D13, 0x8D14, 0x8D15, 0x8D16, 0x8D17, 0x8D18, 0x8D19, 0x8D1A, 0x8D1B, 0x8D1C, 0x8D20, 0x8D51, 0x8D52, 0x8D57, 0x8D5F, 0x8D65, 0x8D68, 0x8D69, 0x8D6A, 0x8D6C, 0x8D6E, 0x8D6F, 0x8D71, 0x8D72, 0x8D78, 0x8D79, 0x8D7A, 0x8D7B, 0x8D7C, 0x8D7D, 0x8D7E, 0x8D7F, 0x8D80, 0x8D82, 0x8D83, 0x8D86, 0x8D87, 0x8D88, 0x8D89, 0x8D8C, 0x8D8D, 0x8D8E, 0x8D8F, 0x8D90, 0x8D92, 0x8D93, 0x8D95, 0x8D96, 0x8D97, 0x8D98, 0x8D99, 0x8D9A, 0x8D9B, 0x8D9C, 0x8D9D, 0x8D9E, 0x8DA0, 0x8DA1, 0x8DA2, 0x8DA4, 0x8DA5, 0x8DA6, 0x8DA7, 0x8DA8, 0x8DA9, 0x8DAA, 0x8DAB, 0x8DAC, 0x8DAD, 0x8DAE, 0x8DAF, 0x8DB0, 0x8DB2, 0x8DB6, 0x8DB7, 0x8DB9, 0x8DBB, 0x8DBD, 0x8DC0, 0x8DC1, 0x8DC2, 0x8DC5, 0x8DC7, 0x8DC8, 0x8DC9, 0x8DCA, 0x8DCD, 0x8DD0, 0x8DD2, 0x8DD3,
+    0x8DD4, 0x51C7, 0x5196, 0x51A2, 0x51A5, 0x8BA0, 0x8BA6, 0x8BA7, 0x8BAA, 0x8BB4, 0x8BB5, 0x8BB7, 0x8BC2, 0x8BC3, 0x8BCB, 0x8BCF, 0x8BCE, 0x8BD2, 0x8BD3, 0x8BD4, 0x8BD6, 0x8BD8, 0x8BD9, 0x8BDC, 0x8BDF, 0x8BE0, 0x8BE4, 0x8BE8, 0x8BE9, 0x8BEE, 0x8BF0, 0x8BF3, 0x8BF6, 0x8BF9, 0x8BFC, 0x8BFF, 0x8C00, 0x8C02, 0x8C04, 0x8C07, 0x8C0C, 0x8C0F, 0x8C11, 0x8C12, 0x8C14, 0x8C15, 0x8C16, 0x8C19, 0x8C1B, 0x8C18, 0x8C1D, 0x8C1F, 0x8C20, 0x8C21, 0x8C25, 0x8C27, 0x8C2A, 0x8C2B, 0x8C2E, 0x8C2F, 0x8C32, 0x8C33, 0x8C35, 0x8C36, 0x5369, 0x537A, 0x961D, 0x9622, 0x9621, 0x9631, 0x962A, 0x963D, 0x963C, 0x9642, 0x9649, 0x9654, 0x965F, 0x9667, 0x966C, 0x9672, 0x9674, 0x9688, 0x968D, 0x9697, 0x96B0, 0x9097, 0x909B, 0x909D, 0x9099, 0x90AC, 0x90A1, 0x90B4, 0x90B3, 0x90B6, 0x90BA,
+    0x8DD5, 0x8DD8, 0x8DD9, 0x8DDC, 0x8DE0, 0x8DE1, 0x8DE2, 0x8DE5, 0x8DE6, 0x8DE7, 0x8DE9, 0x8DED, 0x8DEE, 0x8DF0, 0x8DF1, 0x8DF2, 0x8DF4, 0x8DF6, 0x8DFC, 0x8DFE, 0x8DFF, 0x8E00, 0x8E01, 0x8E02, 0x8E03, 0x8E04, 0x8E06, 0x8E07, 0x8E08, 0x8E0B, 0x8E0D, 0x8E0E, 0x8E10, 0x8E11, 0x8E12, 0x8E13, 0x8E15, 0x8E16, 0x8E17, 0x8E18, 0x8E19, 0x8E1A, 0x8E1B, 0x8E1C, 0x8E20, 0x8E21, 0x8E24, 0x8E25, 0x8E26, 0x8E27, 0x8E28, 0x8E2B, 0x8E2D, 0x8E30, 0x8E32, 0x8E33, 0x8E34, 0x8E36, 0x8E37, 0x8E38, 0x8E3B, 0x8E3C, 0x8E3E, 0x8E3F, 0x8E43, 0x8E45, 0x8E46, 0x8E4C, 0x8E4D, 0x8E4E, 0x8E4F, 0x8E50, 0x8E53, 0x8E54, 0x8E55, 0x8E56, 0x8E57, 0x8E58, 0x8E5A, 0x8E5B, 0x8E5C, 0x8E5D, 0x8E5E, 0x8E5F, 0x8E60, 0x8E61, 0x8E62, 0x8E63, 0x8E64, 0x8E65, 0x8E67, 0x8E68, 0x8E6A, 0x8E6B, 0x8E6E,
+    0x8E71, 0x90B8, 0x90B0, 0x90CF, 0x90C5, 0x90BE, 0x90D0, 0x90C4, 0x90C7, 0x90D3, 0x90E6, 0x90E2, 0x90DC, 0x90D7, 0x90DB, 0x90EB, 0x90EF, 0x90FE, 0x9104, 0x9122, 0x911E, 0x9123, 0x9131, 0x912F, 0x9139, 0x9143, 0x9146, 0x520D, 0x5942, 0x52A2, 0x52AC, 0x52AD, 0x52BE, 0x54FF, 0x52D0, 0x52D6, 0x52F0, 0x53DF, 0x71EE, 0x77CD, 0x5EF4, 0x51F5, 0x51FC, 0x9B2F, 0x53B6, 0x5F01, 0x755A, 0x5DEF, 0x574C, 0x57A9, 0x57A1, 0x587E, 0x58BC, 0x58C5, 0x58D1, 0x5729, 0x572C, 0x572A, 0x5733, 0x5739, 0x572E, 0x572F, 0x575C, 0x573B, 0x5742, 0x5769, 0x5785, 0x576B, 0x5786, 0x577C, 0x577B, 0x5768, 0x576D, 0x5776, 0x5773, 0x57AD, 0x57A4, 0x578C, 0x57B2, 0x57CF, 0x57A7, 0x57B4, 0x5793, 0x57A0, 0x57D5, 0x57D8, 0x57DA, 0x57D9, 0x57D2, 0x57B8, 0x57F4, 0x57EF, 0x57F8, 0x57E4, 0x57DD,
+    0x8E73, 0x8E75, 0x8E77, 0x8E78, 0x8E79, 0x8E7A, 0x8E7B, 0x8E7D, 0x8E7E, 0x8E80, 0x8E82, 0x8E83, 0x8E84, 0x8E86, 0x8E88, 0x8E89, 0x8E8A, 0x8E8B, 0x8E8C, 0x8E8D, 0x8E8E, 0x8E91, 0x8E92, 0x8E93, 0x8E95, 0x8E96, 0x8E97, 0x8E98, 0x8E99, 0x8E9A, 0x8E9B, 0x8E9D, 0x8E9F, 0x8EA0, 0x8EA1, 0x8EA2, 0x8EA3, 0x8EA4, 0x8EA5, 0x8EA6, 0x8EA7, 0x8EA8, 0x8EA9, 0x8EAA, 0x8EAD, 0x8EAE, 0x8EB0, 0x8EB1, 0x8EB3, 0x8EB4, 0x8EB5, 0x8EB6, 0x8EB7, 0x8EB8, 0x8EB9, 0x8EBB, 0x8EBC, 0x8EBD, 0x8EBE, 0x8EBF, 0x8EC0, 0x8EC1, 0x8EC2, 0x8EC3, 0x8EC4, 0x8EC5, 0x8EC6, 0x8EC7, 0x8EC8, 0x8EC9, 0x8ECA, 0x8ECB, 0x8ECC, 0x8ECD, 0x8ECF, 0x8ED0, 0x8ED1, 0x8ED2, 0x8ED3, 0x8ED4, 0x8ED5, 0x8ED6, 0x8ED7, 0x8ED8, 0x8ED9, 0x8EDA, 0x8EDB, 0x8EDC, 0x8EDD, 0x8EDE, 0x8EDF, 0x8EE0, 0x8EE1, 0x8EE2, 0x8EE3,
+    0x8EE4, 0x580B, 0x580D, 0x57FD, 0x57ED, 0x5800, 0x581E, 0x5819, 0x5844, 0x5820, 0x5865, 0x586C, 0x5881, 0x5889, 0x589A, 0x5880, 0x99A8, 0x9F19, 0x61FF, 0x8279, 0x827D, 0x827F, 0x828F, 0x828A, 0x82A8, 0x8284, 0x828E, 0x8291, 0x8297, 0x8299, 0x82AB, 0x82B8, 0x82BE, 0x82B0, 0x82C8, 0x82CA, 0x82E3, 0x8298, 0x82B7, 0x82AE, 0x82CB, 0x82CC, 0x82C1, 0x82A9, 0x82B4, 0x82A1, 0x82AA, 0x829F, 0x82C4, 0x82CE, 0x82A4, 0x82E1, 0x8309, 0x82F7, 0x82E4, 0x830F, 0x8307, 0x82DC, 0x82F4, 0x82D2, 0x82D8, 0x830C, 0x82FB, 0x82D3, 0x8311, 0x831A, 0x8306, 0x8314, 0x8315, 0x82E0, 0x82D5, 0x831C, 0x8351, 0x835B, 0x835C, 0x8308, 0x8392, 0x833C, 0x8334, 0x8331, 0x839B, 0x835E, 0x832F, 0x834F, 0x8347, 0x8343, 0x835F, 0x8340, 0x8317, 0x8360, 0x832D, 0x833A, 0x8333, 0x8366, 0x8365,
+    0x8EE5, 0x8EE6, 0x8EE7, 0x8EE8, 0x8EE9, 0x8EEA, 0x8EEB, 0x8EEC, 0x8EED, 0x8EEE, 0x8EEF, 0x8EF0, 0x8EF1, 0x8EF2, 0x8EF3, 0x8EF4, 0x8EF5, 0x8EF6, 0x8EF7, 0x8EF8, 0x8EF9, 0x8EFA, 0x8EFB, 0x8EFC, 0x8EFD, 0x8EFE, 0x8EFF, 0x8F00, 0x8F01, 0x8F02, 0x8F03, 0x8F04, 0x8F05, 0x8F06, 0x8F07, 0x8F08, 0x8F09, 0x8F0A, 0x8F0B, 0x8F0C, 0x8F0D, 0x8F0E, 0x8F0F, 0x8F10, 0x8F11, 0x8F12, 0x8F13, 0x8F14, 0x8F15, 0x8F16, 0x8F17, 0x8F18, 0x8F19, 0x8F1A, 0x8F1B, 0x8F1C, 0x8F1D, 0x8F1E, 0x8F1F, 0x8F20, 0x8F21, 0x8F22, 0x8F23, 0x8F24, 0x8F25, 0x8F26, 0x8F27, 0x8F28, 0x8F29, 0x8F2A, 0x8F2B, 0x8F2C, 0x8F2D, 0x8F2E, 0x8F2F, 0x8F30, 0x8F31, 0x8F32, 0x8F33, 0x8F34, 0x8F35, 0x8F36, 0x8F37, 0x8F38, 0x8F39, 0x8F3A, 0x8F3B, 0x8F3C, 0x8F3D, 0x8F3E, 0x8F3F, 0x8F40, 0x8F41, 0x8F42, 0x8F43,
+    0x8F44, 0x8368, 0x831B, 0x8369, 0x836C, 0x836A, 0x836D, 0x836E, 0x83B0, 0x8378, 0x83B3, 0x83B4, 0x83A0, 0x83AA, 0x8393, 0x839C, 0x8385, 0x837C, 0x83B6, 0x83A9, 0x837D, 0x83B8, 0x837B, 0x8398, 0x839E, 0x83A8, 0x83BA, 0x83BC, 0x83C1, 0x8401, 0x83E5, 0x83D8, 0x5807, 0x8418, 0x840B, 0x83DD, 0x83FD, 0x83D6, 0x841C, 0x8438, 0x8411, 0x8406, 0x83D4, 0x83DF, 0x840F, 0x8403, 0x83F8, 0x83F9, 0x83EA, 0x83C5, 0x83C0, 0x8426, 0x83F0, 0x83E1, 0x845C, 0x8451, 0x845A, 0x8459, 0x8473, 0x8487, 0x8488, 0x847A, 0x8489, 0x8478, 0x843C, 0x8446, 0x8469, 0x8476, 0x848C, 0x848E, 0x8431, 0x846D, 0x84C1, 0x84CD, 0x84D0, 0x84E6, 0x84BD, 0x84D3, 0x84CA, 0x84BF, 0x84BA, 0x84E0, 0x84A1, 0x84B9, 0x84B4, 0x8497, 0x84E5, 0x84E3, 0x850C, 0x750D, 0x8538, 0x84F0, 0x8539, 0x851F, 0x853A,
+    0x8F45, 0x8F46, 0x8F47, 0x8F48, 0x8F49, 0x8F4A, 0x8F4B, 0x8F4C, 0x8F4D, 0x8F4E, 0x8F4F, 0x8F50, 0x8F51, 0x8F52, 0x8F53, 0x8F54, 0x8F55, 0x8F56, 0x8F57, 0x8F58, 0x8F59, 0x8F5A, 0x8F5B, 0x8F5C, 0x8F5D, 0x8F5E, 0x8F5F, 0x8F60, 0x8F61, 0x8F62, 0x8F63, 0x8F64, 0x8F65, 0x8F6A, 0x8F80, 0x8F8C, 0x8F92, 0x8F9D, 0x8FA0, 0x8FA1, 0x8FA2, 0x8FA4, 0x8FA5, 0x8FA6, 0x8FA7, 0x8FAA, 0x8FAC, 0x8FAD, 0x8FAE, 0x8FAF, 0x8FB2, 0x8FB3, 0x8FB4, 0x8FB5, 0x8FB7, 0x8FB8, 0x8FBA, 0x8FBB, 0x8FBC, 0x8FBF, 0x8FC0, 0x8FC3, 0x8FC6, 0x8FC9, 0x8FCA, 0x8FCB, 0x8FCC, 0x8FCD, 0x8FCF, 0x8FD2, 0x8FD6, 0x8FD7, 0x8FDA, 0x8FE0, 0x8FE1, 0x8FE3, 0x8FE7, 0x8FEC, 0x8FEF, 0x8FF1, 0x8FF2, 0x8FF4, 0x8FF5, 0x8FF6, 0x8FFA, 0x8FFB, 0x8FFC, 0x8FFE, 0x8FFF, 0x9007, 0x9008, 0x900C, 0x900E, 0x9013, 0x9015,
+    0x9018, 0x8556, 0x853B, 0x84FF, 0x84FC, 0x8559, 0x8548, 0x8568, 0x8564, 0x855E, 0x857A, 0x77A2, 0x8543, 0x8572, 0x857B, 0x85A4, 0x85A8, 0x8587, 0x858F, 0x8579, 0x85AE, 0x859C, 0x8585, 0x85B9, 0x85B7, 0x85B0, 0x85D3, 0x85C1, 0x85DC, 0x85FF, 0x8627, 0x8605, 0x8629, 0x8616, 0x863C, 0x5EFE, 0x5F08, 0x593C, 0x5941, 0x8037, 0x5955, 0x595A, 0x5958, 0x530F, 0x5C22, 0x5C25, 0x5C2C, 0x5C34, 0x624C, 0x626A, 0x629F, 0x62BB, 0x62CA, 0x62DA, 0x62D7, 0x62EE, 0x6322, 0x62F6, 0x6339, 0x634B, 0x6343, 0x63AD, 0x63F6, 0x6371, 0x637A, 0x638E, 0x63B4, 0x636D, 0x63AC, 0x638A, 0x6369, 0x63AE, 0x63BC, 0x63F2, 0x63F8, 0x63E0, 0x63FF, 0x63C4, 0x63DE, 0x63CE, 0x6452, 0x63C6, 0x63BE, 0x6445, 0x6441, 0x640B, 0x641B, 0x6420, 0x640C, 0x6426, 0x6421, 0x645E, 0x6484, 0x646D, 0x6496,
+    0x9019, 0x901C, 0x9023, 0x9024, 0x9025, 0x9027, 0x9028, 0x9029, 0x902A, 0x902B, 0x902C, 0x9030, 0x9031, 0x9032, 0x9033, 0x9034, 0x9037, 0x9039, 0x903A, 0x903D, 0x903F, 0x9040, 0x9043, 0x9045, 0x9046, 0x9048, 0x9049, 0x904A, 0x904B, 0x904C, 0x904E, 0x9054, 0x9055, 0x9056, 0x9059, 0x905A, 0x905C, 0x905D, 0x905E, 0x905F, 0x9060, 0x9061, 0x9064, 0x9066, 0x9067, 0x9069, 0x906A, 0x906B, 0x906C, 0x906F, 0x9070, 0x9071, 0x9072, 0x9073, 0x9076, 0x9077, 0x9078, 0x9079, 0x907A, 0x907B, 0x907C, 0x907E, 0x9081, 0x9084, 0x9085, 0x9086, 0x9087, 0x9089, 0x908A, 0x908C, 0x908D, 0x908E, 0x908F, 0x9090, 0x9092, 0x9094, 0x9096, 0x9098, 0x909A, 0x909C, 0x909E, 0x909F, 0x90A0, 0x90A4, 0x90A5, 0x90A7, 0x90A8, 0x90A9, 0x90AB, 0x90AD, 0x90B2, 0x90B7, 0x90BC, 0x90BD, 0x90BF,
+    0x90C0, 0x647A, 0x64B7, 0x64B8, 0x6499, 0x64BA, 0x64C0, 0x64D0, 0x64D7, 0x64E4, 0x64E2, 0x6509, 0x6525, 0x652E, 0x5F0B, 0x5FD2, 0x7519, 0x5F11, 0x535F, 0x53F1, 0x53FD, 0x53E9, 0x53E8, 0x53FB, 0x5412, 0x5416, 0x5406, 0x544B, 0x5452, 0x5453, 0x5454, 0x5456, 0x5443, 0x5421, 0x5457, 0x5459, 0x5423, 0x5432, 0x5482, 0x5494, 0x5477, 0x5471, 0x5464, 0x549A, 0x549B, 0x5484, 0x5476, 0x5466, 0x549D, 0x54D0, 0x54AD, 0x54C2, 0x54B4, 0x54D2, 0x54A7, 0x54A6, 0x54D3, 0x54D4, 0x5472, 0x54A3, 0x54D5, 0x54BB, 0x54BF, 0x54CC, 0x54D9, 0x54DA, 0x54DC, 0x54A9, 0x54AA, 0x54A4, 0x54DD, 0x54CF, 0x54DE, 0x551B, 0x54E7, 0x5520, 0x54FD, 0x5514, 0x54F3, 0x5522, 0x5523, 0x550F, 0x5511, 0x5527, 0x552A, 0x5567, 0x558F, 0x55B5, 0x5549, 0x556D, 0x5541, 0x5555, 0x553F, 0x5550, 0x553C,
+    0x90C2, 0x90C3, 0x90C6, 0x90C8, 0x90C9, 0x90CB, 0x90CC, 0x90CD, 0x90D2, 0x90D4, 0x90D5, 0x90D6, 0x90D8, 0x90D9, 0x90DA, 0x90DE, 0x90DF, 0x90E0, 0x90E3, 0x90E4, 0x90E5, 0x90E9, 0x90EA, 0x90EC, 0x90EE, 0x90F0, 0x90F1, 0x90F2, 0x90F3, 0x90F5, 0x90F6, 0x90F7, 0x90F9, 0x90FA, 0x90FB, 0x90FC, 0x90FF, 0x9100, 0x9101, 0x9103, 0x9105, 0x9106, 0x9107, 0x9108, 0x9109, 0x910A, 0x910B, 0x910C, 0x910D, 0x910E, 0x910F, 0x9110, 0x9111, 0x9112, 0x9113, 0x9114, 0x9115, 0x9116, 0x9117, 0x9118, 0x911A, 0x911B, 0x911C, 0x911D, 0x911F, 0x9120, 0x9121, 0x9124, 0x9125, 0x9126, 0x9127, 0x9128, 0x9129, 0x912A, 0x912B, 0x912C, 0x912D, 0x912E, 0x9130, 0x9132, 0x9133, 0x9134, 0x9135, 0x9136, 0x9137, 0x9138, 0x913A, 0x913B, 0x913C, 0x913D, 0x913E, 0x913F, 0x9140, 0x9141, 0x9142,
+    0x9144, 0x5537, 0x5556, 0x5575, 0x5576, 0x5577, 0x5533, 0x5530, 0x555C, 0x558B, 0x55D2, 0x5583, 0x55B1, 0x55B9, 0x5588, 0x5581, 0x559F, 0x557E, 0x55D6, 0x5591, 0x557B, 0x55DF, 0x55BD, 0x55BE, 0x5594, 0x5599, 0x55EA, 0x55F7, 0x55C9, 0x561F, 0x55D1, 0x55EB, 0x55EC, 0x55D4, 0x55E6, 0x55DD, 0x55C4, 0x55EF, 0x55E5, 0x55F2, 0x55F3, 0x55CC, 0x55CD, 0x55E8, 0x55F5, 0x55E4, 0x8F94, 0x561E, 0x5608, 0x560C, 0x5601, 0x5624, 0x5623, 0x55FE, 0x5600, 0x5627, 0x562D, 0x5658, 0x5639, 0x5657, 0x562C, 0x564D, 0x5662, 0x5659, 0x565C, 0x564C, 0x5654, 0x5686, 0x5664, 0x5671, 0x566B, 0x567B, 0x567C, 0x5685, 0x5693, 0x56AF, 0x56D4, 0x56D7, 0x56DD, 0x56E1, 0x56F5, 0x56EB, 0x56F9, 0x56FF, 0x5704, 0x570A, 0x5709, 0x571C, 0x5E0F, 0x5E19, 0x5E14, 0x5E11, 0x5E31, 0x5E3B, 0x5E3C,
+    0x9145, 0x9147, 0x9148, 0x9151, 0x9153, 0x9154, 0x9155, 0x9156, 0x9158, 0x9159, 0x915B, 0x915C, 0x915F, 0x9160, 0x9166, 0x9167, 0x9168, 0x916B, 0x916D, 0x9173, 0x917A, 0x917B, 0x917C, 0x9180, 0x9181, 0x9182, 0x9183, 0x9184, 0x9186, 0x9188, 0x918A, 0x918E, 0x918F, 0x9193, 0x9194, 0x9195, 0x9196, 0x9197, 0x9198, 0x9199, 0x919C, 0x919D, 0x919E, 0x919F, 0x91A0, 0x91A1, 0x91A4, 0x91A5, 0x91A6, 0x91A7, 0x91A8, 0x91A9, 0x91AB, 0x91AC, 0x91B0, 0x91B1, 0x91B2, 0x91B3, 0x91B6, 0x91B7, 0x91B8, 0x91B9, 0x91BB, 0x91BC, 0x91BD, 0x91BE, 0x91BF, 0x91C0, 0x91C1, 0x91C2, 0x91C3, 0x91C4, 0x91C5, 0x91C6, 0x91C8, 0x91CB, 0x91D0, 0x91D2, 0x91D3, 0x91D4, 0x91D5, 0x91D6, 0x91D7, 0x91D8, 0x91D9, 0x91DA, 0x91DB, 0x91DD, 0x91DE, 0x91DF, 0x91E0, 0x91E1, 0x91E2, 0x91E3, 0x91E4,
+    0x91E5, 0x5E37, 0x5E44, 0x5E54, 0x5E5B, 0x5E5E, 0x5E61, 0x5C8C, 0x5C7A, 0x5C8D, 0x5C90, 0x5C96, 0x5C88, 0x5C98, 0x5C99, 0x5C91, 0x5C9A, 0x5C9C, 0x5CB5, 0x5CA2, 0x5CBD, 0x5CAC, 0x5CAB, 0x5CB1, 0x5CA3, 0x5CC1, 0x5CB7, 0x5CC4, 0x5CD2, 0x5CE4, 0x5CCB, 0x5CE5, 0x5D02, 0x5D03, 0x5D27, 0x5D26, 0x5D2E, 0x5D24, 0x5D1E, 0x5D06, 0x5D1B, 0x5D58, 0x5D3E, 0x5D34, 0x5D3D, 0x5D6C, 0x5D5B, 0x5D6F, 0x5D5D, 0x5D6B, 0x5D4B, 0x5D4A, 0x5D69, 0x5D74, 0x5D82, 0x5D99, 0x5D9D, 0x8C73, 0x5DB7, 0x5DC5, 0x5F73, 0x5F77, 0x5F82, 0x5F87, 0x5F89, 0x5F8C, 0x5F95, 0x5F99, 0x5F9C, 0x5FA8, 0x5FAD, 0x5FB5, 0x5FBC, 0x8862, 0x5F61, 0x72AD, 0x72B0, 0x72B4, 0x72B7, 0x72B8, 0x72C3, 0x72C1, 0x72CE, 0x72CD, 0x72D2, 0x72E8, 0x72EF, 0x72E9, 0x72F2, 0x72F4, 0x72F7, 0x7301, 0x72F3, 0x7303, 0x72FA,
+    0x91E6, 0x91E7, 0x91E8, 0x91E9, 0x91EA, 0x91EB, 0x91EC, 0x91ED, 0x91EE, 0x91EF, 0x91F0, 0x91F1, 0x91F2, 0x91F3, 0x91F4, 0x91F5, 0x91F6, 0x91F7, 0x91F8, 0x91F9, 0x91FA, 0x91FB, 0x91FC, 0x91FD, 0x91FE, 0x91FF, 0x9200, 0x9201, 0x9202, 0x9203, 0x9204, 0x9205, 0x9206, 0x9207, 0x9208, 0x9209, 0x920A, 0x920B, 0x920C, 0x920D, 0x920E, 0x920F, 0x9210, 0x9211, 0x9212, 0x9213, 0x9214, 0x9215, 0x9216, 0x9217, 0x9218, 0x9219, 0x921A, 0x921B, 0x921C, 0x921D, 0x921E, 0x921F, 0x9220, 0x9221, 0x9222, 0x9223, 0x9224, 0x9225, 0x9226, 0x9227, 0x9228, 0x9229, 0x922A, 0x922B, 0x922C, 0x922D, 0x922E, 0x922F, 0x9230, 0x9231, 0x9232, 0x9233, 0x9234, 0x9235, 0x9236, 0x9237, 0x9238, 0x9239, 0x923A, 0x923B, 0x923C, 0x923D, 0x923E, 0x923F, 0x9240, 0x9241, 0x9242, 0x9243, 0x9244,
+    0x9245, 0x72FB, 0x7317, 0x7313, 0x7321, 0x730A, 0x731E, 0x731D, 0x7315, 0x7322, 0x7339, 0x7325, 0x732C, 0x7338, 0x7331, 0x7350, 0x734D, 0x7357, 0x7360, 0x736C, 0x736F, 0x737E, 0x821B, 0x5925, 0x98E7, 0x5924, 0x5902, 0x9963, 0x9967, 0x9968, 0x9969, 0x996A, 0x996B, 0x996C, 0x9974, 0x9977, 0x997D, 0x9980, 0x9984, 0x9987, 0x998A, 0x998D, 0x9990, 0x9991, 0x9993, 0x9994, 0x9995, 0x5E80, 0x5E91, 0x5E8B, 0x5E96, 0x5EA5, 0x5EA0, 0x5EB9, 0x5EB5, 0x5EBE, 0x5EB3, 0x8D53, 0x5ED2, 0x5ED1, 0x5EDB, 0x5EE8, 0x5EEA, 0x81BA, 0x5FC4, 0x5FC9, 0x5FD6, 0x5FCF, 0x6003, 0x5FEE, 0x6004, 0x5FE1, 0x5FE4, 0x5FFE, 0x6005, 0x6006, 0x5FEA, 0x5FED, 0x5FF8, 0x6019, 0x6035, 0x6026, 0x601B, 0x600F, 0x600D, 0x6029, 0x602B, 0x600A, 0x603F, 0x6021, 0x6078, 0x6079, 0x607B, 0x607A, 0x6042,
+    0x9246, 0x9247, 0x9248, 0x9249, 0x924A, 0x924B, 0x924C, 0x924D, 0x924E, 0x924F, 0x9250, 0x9251, 0x9252, 0x9253, 0x9254, 0x9255, 0x9256, 0x9257, 0x9258, 0x9259, 0x925A, 0x925B, 0x925C, 0x925D, 0x925E, 0x925F, 0x9260, 0x9261, 0x9262, 0x9263, 0x9264, 0x9265, 0x9266, 0x9267, 0x9268, 0x9269, 0x926A, 0x926B, 0x926C, 0x926D, 0x926E, 0x926F, 0x9270, 0x9271, 0x9272, 0x9273, 0x9275, 0x9276, 0x9277, 0x9278, 0x9279, 0x927A, 0x927B, 0x927C, 0x927D, 0x927E, 0x927F, 0x9280, 0x9281, 0x9282, 0x9283, 0x9284, 0x9285, 0x9286, 0x9287, 0x9288, 0x9289, 0x928A, 0x928B, 0x928C, 0x928D, 0x928F, 0x9290, 0x9291, 0x9292, 0x9293, 0x9294, 0x9295, 0x9296, 0x9297, 0x9298, 0x9299, 0x929A, 0x929B, 0x929C, 0x929D, 0x929E, 0x929F, 0x92A0, 0x92A1, 0x92A2, 0x92A3, 0x92A4, 0x92A5, 0x92A6,
+    0x92A7, 0x606A, 0x607D, 0x6096, 0x609A, 0x60AD, 0x609D, 0x6083, 0x6092, 0x608C, 0x609B, 0x60EC, 0x60BB, 0x60B1, 0x60DD, 0x60D8, 0x60C6, 0x60DA, 0x60B4, 0x6120, 0x6126, 0x6115, 0x6123, 0x60F4, 0x6100, 0x610E, 0x612B, 0x614A, 0x6175, 0x61AC, 0x6194, 0x61A7, 0x61B7, 0x61D4, 0x61F5, 0x5FDD, 0x96B3, 0x95E9, 0x95EB, 0x95F1, 0x95F3, 0x95F5, 0x95F6, 0x95FC, 0x95FE, 0x9603, 0x9604, 0x9606, 0x9608, 0x960A, 0x960B, 0x960C, 0x960D, 0x960F, 0x9612, 0x9615, 0x9616, 0x9617, 0x9619, 0x961A, 0x4E2C, 0x723F, 0x6215, 0x6C35, 0x6C54, 0x6C5C, 0x6C4A, 0x6CA3, 0x6C85, 0x6C90, 0x6C94, 0x6C8C, 0x6C68, 0x6C69, 0x6C74, 0x6C76, 0x6C86, 0x6CA9, 0x6CD0, 0x6CD4, 0x6CAD, 0x6CF7, 0x6CF8, 0x6CF1, 0x6CD7, 0x6CB2, 0x6CE0, 0x6CD6, 0x6CFA, 0x6CEB, 0x6CEE, 0x6CB1, 0x6CD3, 0x6CEF, 0x6CFE,
+    0x92A8, 0x92A9, 0x92AA, 0x92AB, 0x92AC, 0x92AD, 0x92AF, 0x92B0, 0x92B1, 0x92B2, 0x92B3, 0x92B4, 0x92B5, 0x92B6, 0x92B7, 0x92B8, 0x92B9, 0x92BA, 0x92BB, 0x92BC, 0x92BD, 0x92BE, 0x92BF, 0x92C0, 0x92C1, 0x92C2, 0x92C3, 0x92C4, 0x92C5, 0x92C6, 0x92C7, 0x92C9, 0x92CA, 0x92CB, 0x92CC, 0x92CD, 0x92CE, 0x92CF, 0x92D0, 0x92D1, 0x92D2, 0x92D3, 0x92D4, 0x92D5, 0x92D6, 0x92D7, 0x92D8, 0x92D9, 0x92DA, 0x92DB, 0x92DC, 0x92DD, 0x92DE, 0x92DF, 0x92E0, 0x92E1, 0x92E2, 0x92E3, 0x92E4, 0x92E5, 0x92E6, 0x92E7, 0x92E8, 0x92E9, 0x92EA, 0x92EB, 0x92EC, 0x92ED, 0x92EE, 0x92EF, 0x92F0, 0x92F1, 0x92F2, 0x92F3, 0x92F4, 0x92F5, 0x92F6, 0x92F7, 0x92F8, 0x92F9, 0x92FA, 0x92FB, 0x92FC, 0x92FD, 0x92FE, 0x92FF, 0x9300, 0x9301, 0x9302, 0x9303, 0x9304, 0x9305, 0x9306, 0x9307, 0x9308,
+    0x9309, 0x6D39, 0x6D27, 0x6D0C, 0x6D43, 0x6D48, 0x6D07, 0x6D04, 0x6D19, 0x6D0E, 0x6D2B, 0x6D4D, 0x6D2E, 0x6D35, 0x6D1A, 0x6D4F, 0x6D52, 0x6D54, 0x6D33, 0x6D91, 0x6D6F, 0x6D9E, 0x6DA0, 0x6D5E, 0x6D93, 0x6D94, 0x6D5C, 0x6D60, 0x6D7C, 0x6D63, 0x6E1A, 0x6DC7, 0x6DC5, 0x6DDE, 0x6E0E, 0x6DBF, 0x6DE0, 0x6E11, 0x6DE6, 0x6DDD, 0x6DD9, 0x6E16, 0x6DAB, 0x6E0C, 0x6DAE, 0x6E2B, 0x6E6E, 0x6E4E, 0x6E6B, 0x6EB2, 0x6E5F, 0x6E86, 0x6E53, 0x6E54, 0x6E32, 0x6E25, 0x6E44, 0x6EDF, 0x6EB1, 0x6E98, 0x6EE0, 0x6F2D, 0x6EE2, 0x6EA5, 0x6EA7, 0x6EBD, 0x6EBB, 0x6EB7, 0x6ED7, 0x6EB4, 0x6ECF, 0x6E8F, 0x6EC2, 0x6E9F, 0x6F62, 0x6F46, 0x6F47, 0x6F24, 0x6F15, 0x6EF9, 0x6F2F, 0x6F36, 0x6F4B, 0x6F74, 0x6F2A, 0x6F09, 0x6F29, 0x6F89, 0x6F8D, 0x6F8C, 0x6F78, 0x6F72, 0x6F7C, 0x6F7A, 0x6FD1,
+    0x930A, 0x930B, 0x930C, 0x930D, 0x930E, 0x930F, 0x9310, 0x9311, 0x9312, 0x9313, 0x9314, 0x9315, 0x9316, 0x9317, 0x9318, 0x9319, 0x931A, 0x931B, 0x931C, 0x931D, 0x931E, 0x931F, 0x9320, 0x9321, 0x9322, 0x9323, 0x9324, 0x9325, 0x9326, 0x9327, 0x9328, 0x9329, 0x932A, 0x932B, 0x932C, 0x932D, 0x932E, 0x932F, 0x9330, 0x9331, 0x9332, 0x9333, 0x9334, 0x9335, 0x9336, 0x9337, 0x9338, 0x9339, 0x933A, 0x933B, 0x933C, 0x933D, 0x933F, 0x9340, 0x9341, 0x9342, 0x9343, 0x9344, 0x9345, 0x9346, 0x9347, 0x9348, 0x9349, 0x934A, 0x934B, 0x934C, 0x934D, 0x934E, 0x934F, 0x9350, 0x9351, 0x9352, 0x9353, 0x9354, 0x9355, 0x9356, 0x9357, 0x9358, 0x9359, 0x935A, 0x935B, 0x935C, 0x935D, 0x935E, 0x935F, 0x9360, 0x9361, 0x9362, 0x9363, 0x9364, 0x9365, 0x9366, 0x9367, 0x9368, 0x9369,
+    0x936B, 0x6FC9, 0x6FA7, 0x6FB9, 0x6FB6, 0x6FC2, 0x6FE1, 0x6FEE, 0x6FDE, 0x6FE0, 0x6FEF, 0x701A, 0x7023, 0x701B, 0x7039, 0x7035, 0x704F, 0x705E, 0x5B80, 0x5B84, 0x5B95, 0x5B93, 0x5BA5, 0x5BB8, 0x752F, 0x9A9E, 0x6434, 0x5BE4, 0x5BEE, 0x8930, 0x5BF0, 0x8E47, 0x8B07, 0x8FB6, 0x8FD3, 0x8FD5, 0x8FE5, 0x8FEE, 0x8FE4, 0x8FE9, 0x8FE6, 0x8FF3, 0x8FE8, 0x9005, 0x9004, 0x900B, 0x9026, 0x9011, 0x900D, 0x9016, 0x9021, 0x9035, 0x9036, 0x902D, 0x902F, 0x9044, 0x9051, 0x9052, 0x9050, 0x9068, 0x9058, 0x9062, 0x905B, 0x66B9, 0x9074, 0x907D, 0x9082, 0x9088, 0x9083, 0x908B, 0x5F50, 0x5F57, 0x5F56, 0x5F58, 0x5C3B, 0x54AB, 0x5C50, 0x5C59, 0x5B71, 0x5C63, 0x5C66, 0x7FBC, 0x5F2A, 0x5F29, 0x5F2D, 0x8274, 0x5F3C, 0x9B3B, 0x5C6E, 0x5981, 0x5983, 0x598D, 0x59A9, 0x59AA, 0x59A3,
+    0x936C, 0x936D, 0x936E, 0x936F, 0x9370, 0x9371, 0x9372, 0x9373, 0x9374, 0x9375, 0x9376, 0x9377, 0x9378, 0x9379, 0x937A, 0x937B, 0x937C, 0x937D, 0x937E, 0x937F, 0x9380, 0x9381, 0x9382, 0x9383, 0x9384, 0x9385, 0x9386, 0x9387, 0x9388, 0x9389, 0x938A, 0x938B, 0x938C, 0x938D, 0x938E, 0x9390, 0x9391, 0x9392, 0x9393, 0x9394, 0x9395, 0x9396, 0x9397, 0x9398, 0x9399, 0x939A, 0x939B, 0x939C, 0x939D, 0x939E, 0x939F, 0x93A0, 0x93A1, 0x93A2, 0x93A3, 0x93A4, 0x93A5, 0x93A6, 0x93A7, 0x93A8, 0x93A9, 0x93AA, 0x93AB, 0x93AC, 0x93AD, 0x93AE, 0x93AF, 0x93B0, 0x93B1, 0x93B2, 0x93B3, 0x93B4, 0x93B5, 0x93B6, 0x93B7, 0x93B8, 0x93B9, 0x93BA, 0x93BB, 0x93BC, 0x93BD, 0x93BE, 0x93BF, 0x93C0, 0x93C1, 0x93C2, 0x93C3, 0x93C4, 0x93C5, 0x93C6, 0x93C7, 0x93C8, 0x93C9, 0x93CB, 0x93CC,
+    0x93CD, 0x5997, 0x59CA, 0x59AB, 0x599E, 0x59A4, 0x59D2, 0x59B2, 0x59AF, 0x59D7, 0x59BE, 0x5A05, 0x5A06, 0x59DD, 0x5A08, 0x59E3, 0x59D8, 0x59F9, 0x5A0C, 0x5A09, 0x5A32, 0x5A34, 0x5A11, 0x5A23, 0x5A13, 0x5A40, 0x5A67, 0x5A4A, 0x5A55, 0x5A3C, 0x5A62, 0x5A75, 0x80EC, 0x5AAA, 0x5A9B, 0x5A77, 0x5A7A, 0x5ABE, 0x5AEB, 0x5AB2, 0x5AD2, 0x5AD4, 0x5AB8, 0x5AE0, 0x5AE3, 0x5AF1, 0x5AD6, 0x5AE6, 0x5AD8, 0x5ADC, 0x5B09, 0x5B17, 0x5B16, 0x5B32, 0x5B37, 0x5B40, 0x5C15, 0x5C1C, 0x5B5A, 0x5B65, 0x5B73, 0x5B51, 0x5B53, 0x5B62, 0x9A75, 0x9A77, 0x9A78, 0x9A7A, 0x9A7F, 0x9A7D, 0x9A80, 0x9A81, 0x9A85, 0x9A88, 0x9A8A, 0x9A90, 0x9A92, 0x9A93, 0x9A96, 0x9A98, 0x9A9B, 0x9A9C, 0x9A9D, 0x9A9F, 0x9AA0, 0x9AA2, 0x9AA3, 0x9AA5, 0x9AA7, 0x7E9F, 0x7EA1, 0x7EA3, 0x7EA5, 0x7EA8, 0x7EA9,
+    0x93CE, 0x93CF, 0x93D0, 0x93D1, 0x93D2, 0x93D3, 0x93D4, 0x93D5, 0x93D7, 0x93D8, 0x93D9, 0x93DA, 0x93DB, 0x93DC, 0x93DD, 0x93DE, 0x93DF, 0x93E0, 0x93E1, 0x93E2, 0x93E3, 0x93E4, 0x93E5, 0x93E6, 0x93E7, 0x93E8, 0x93E9, 0x93EA, 0x93EB, 0x93EC, 0x93ED, 0x93EE, 0x93EF, 0x93F0, 0x93F1, 0x93F2, 0x93F3, 0x93F4, 0x93F5, 0x93F6, 0x93F7, 0x93F8, 0x93F9, 0x93FA, 0x93FB, 0x93FC, 0x93FD, 0x93FE, 0x93FF, 0x9400, 0x9401, 0x9402, 0x9403, 0x9404, 0x9405, 0x9406, 0x9407, 0x9408, 0x9409, 0x940A, 0x940B, 0x940C, 0x940D, 0x940E, 0x940F, 0x9410, 0x9411, 0x9412, 0x9413, 0x9414, 0x9415, 0x9416, 0x9417, 0x9418, 0x9419, 0x941A, 0x941B, 0x941C, 0x941D, 0x941E, 0x941F, 0x9420, 0x9421, 0x9422, 0x9423, 0x9424, 0x9425, 0x9426, 0x9427, 0x9428, 0x9429, 0x942A, 0x942B, 0x942C, 0x942D,
+    0x942E, 0x7EAD, 0x7EB0, 0x7EBE, 0x7EC0, 0x7EC1, 0x7EC2, 0x7EC9, 0x7ECB, 0x7ECC, 0x7ED0, 0x7ED4, 0x7ED7, 0x7EDB, 0x7EE0, 0x7EE1, 0x7EE8, 0x7EEB, 0x7EEE, 0x7EEF, 0x7EF1, 0x7EF2, 0x7F0D, 0x7EF6, 0x7EFA, 0x7EFB, 0x7EFE, 0x7F01, 0x7F02, 0x7F03, 0x7F07, 0x7F08, 0x7F0B, 0x7F0C, 0x7F0F, 0x7F11, 0x7F12, 0x7F17, 0x7F19, 0x7F1C, 0x7F1B, 0x7F1F, 0x7F21, 0x7F22, 0x7F23, 0x7F24, 0x7F25, 0x7F26, 0x7F27, 0x7F2A, 0x7F2B, 0x7F2C, 0x7F2D, 0x7F2F, 0x7F30, 0x7F31, 0x7F32, 0x7F33, 0x7F35, 0x5E7A, 0x757F, 0x5DDB, 0x753E, 0x9095, 0x738E, 0x7391, 0x73AE, 0x73A2, 0x739F, 0x73CF, 0x73C2, 0x73D1, 0x73B7, 0x73B3, 0x73C0, 0x73C9, 0x73C8, 0x73E5, 0x73D9, 0x987C, 0x740A, 0x73E9, 0x73E7, 0x73DE, 0x73BA, 0x73F2, 0x740F, 0x742A, 0x745B, 0x7426, 0x7425, 0x7428, 0x7430, 0x742E, 0x742C,
+    0x942F, 0x9430, 0x9431, 0x9432, 0x9433, 0x9434, 0x9435, 0x9436, 0x9437, 0x9438, 0x9439, 0x943A, 0x943B, 0x943C, 0x943D, 0x943F, 0x9440, 0x9441, 0x9442, 0x9443, 0x9444, 0x9445, 0x9446, 0x9447, 0x9448, 0x9449, 0x944A, 0x944B, 0x944C, 0x944D, 0x944E, 0x944F, 0x9450, 0x9451, 0x9452, 0x9453, 0x9454, 0x9455, 0x9456, 0x9457, 0x9458, 0x9459, 0x945A, 0x945B, 0x945C, 0x945D, 0x945E, 0x945F, 0x9460, 0x9461, 0x9462, 0x9463, 0x9464, 0x9465, 0x9466, 0x9467, 0x9468, 0x9469, 0x946A, 0x946C, 0x946D, 0x946E, 0x946F, 0x9470, 0x9471, 0x9472, 0x9473, 0x9474, 0x9475, 0x9476, 0x9477, 0x9478, 0x9479, 0x947A, 0x947B, 0x947C, 0x947D, 0x947E, 0x947F, 0x9480, 0x9481, 0x9482, 0x9483, 0x9484, 0x9491, 0x9496, 0x9498, 0x94C7, 0x94CF, 0x94D3, 0x94D4, 0x94DA, 0x94E6, 0x94FB, 0x951C,
+    0x9520, 0x741B, 0x741A, 0x7441, 0x745C, 0x7457, 0x7455, 0x7459, 0x7477, 0x746D, 0x747E, 0x749C, 0x748E, 0x7480, 0x7481, 0x7487, 0x748B, 0x749E, 0x74A8, 0x74A9, 0x7490, 0x74A7, 0x74D2, 0x74BA, 0x97EA, 0x97EB, 0x97EC, 0x674C, 0x6753, 0x675E, 0x6748, 0x6769, 0x67A5, 0x6787, 0x676A, 0x6773, 0x6798, 0x67A7, 0x6775, 0x67A8, 0x679E, 0x67AD, 0x678B, 0x6777, 0x677C, 0x67F0, 0x6809, 0x67D8, 0x680A, 0x67E9, 0x67B0, 0x680C, 0x67D9, 0x67B5, 0x67DA, 0x67B3, 0x67DD, 0x6800, 0x67C3, 0x67B8, 0x67E2, 0x680E, 0x67C1, 0x67FD, 0x6832, 0x6833, 0x6860, 0x6861, 0x684E, 0x6862, 0x6844, 0x6864, 0x6883, 0x681D, 0x6855, 0x6866, 0x6841, 0x6867, 0x6840, 0x683E, 0x684A, 0x6849, 0x6829, 0x68B5, 0x688F, 0x6874, 0x6877, 0x6893, 0x686B, 0x68C2, 0x696E, 0x68FC, 0x691F, 0x6920, 0x68F9,
+    0x9527, 0x9533, 0x953D, 0x9543, 0x9548, 0x954B, 0x9555, 0x955A, 0x9560, 0x956E, 0x9574, 0x9575, 0x9577, 0x9578, 0x9579, 0x957A, 0x957B, 0x957C, 0x957D, 0x957E, 0x9580, 0x9581, 0x9582, 0x9583, 0x9584, 0x9585, 0x9586, 0x9587, 0x9588, 0x9589, 0x958A, 0x958B, 0x958C, 0x958D, 0x958E, 0x958F, 0x9590, 0x9591, 0x9592, 0x9593, 0x9594, 0x9595, 0x9596, 0x9597, 0x9598, 0x9599, 0x959A, 0x959B, 0x959C, 0x959D, 0x959E, 0x959F, 0x95A0, 0x95A1, 0x95A2, 0x95A3, 0x95A4, 0x95A5, 0x95A6, 0x95A7, 0x95A8, 0x95A9, 0x95AA, 0x95AB, 0x95AC, 0x95AD, 0x95AE, 0x95AF, 0x95B0, 0x95B1, 0x95B2, 0x95B3, 0x95B4, 0x95B5, 0x95B6, 0x95B7, 0x95B8, 0x95B9, 0x95BA, 0x95BB, 0x95BC, 0x95BD, 0x95BE, 0x95BF, 0x95C0, 0x95C1, 0x95C2, 0x95C3, 0x95C4, 0x95C5, 0x95C6, 0x95C7, 0x95C8, 0x95C9, 0x95CA,
+    0x95CB, 0x6924, 0x68F0, 0x690B, 0x6901, 0x6957, 0x68E3, 0x6910, 0x6971, 0x6939, 0x6960, 0x6942, 0x695D, 0x6984, 0x696B, 0x6980, 0x6998, 0x6978, 0x6934, 0x69CC, 0x6987, 0x6988, 0x69CE, 0x6989, 0x6966, 0x6963, 0x6979, 0x699B, 0x69A7, 0x69BB, 0x69AB, 0x69AD, 0x69D4, 0x69B1, 0x69C1, 0x69CA, 0x69DF, 0x6995, 0x69E0, 0x698D, 0x69FF, 0x6A2F, 0x69ED, 0x6A17, 0x6A18, 0x6A65, 0x69F2, 0x6A44, 0x6A3E, 0x6AA0, 0x6A50, 0x6A5B, 0x6A35, 0x6A8E, 0x6A79, 0x6A3D, 0x6A28, 0x6A58, 0x6A7C, 0x6A91, 0x6A90, 0x6AA9, 0x6A97, 0x6AAB, 0x7337, 0x7352, 0x6B81, 0x6B82, 0x6B87, 0x6B84, 0x6B92, 0x6B93, 0x6B8D, 0x6B9A, 0x6B9B, 0x6BA1, 0x6BAA, 0x8F6B, 0x8F6D, 0x8F71, 0x8F72, 0x8F73, 0x8F75, 0x8F76, 0x8F78, 0x8F77, 0x8F79, 0x8F7A, 0x8F7C, 0x8F7E, 0x8F81, 0x8F82, 0x8F84, 0x8F87, 0x8F8B,
+    0x95CC, 0x95CD, 0x95CE, 0x95CF, 0x95D0, 0x95D1, 0x95D2, 0x95D3, 0x95D4, 0x95D5, 0x95D6, 0x95D7, 0x95D8, 0x95D9, 0x95DA, 0x95DB, 0x95DC, 0x95DD, 0x95DE, 0x95DF, 0x95E0, 0x95E1, 0x95E2, 0x95E3, 0x95E4, 0x95E5, 0x95E6, 0x95E7, 0x95EC, 0x95FF, 0x9607, 0x9613, 0x9618, 0x961B, 0x961E, 0x9620, 0x9623, 0x9624, 0x9625, 0x9626, 0x9627, 0x9628, 0x9629, 0x962B, 0x962C, 0x962D, 0x962F, 0x9630, 0x9637, 0x9638, 0x9639, 0x963A, 0x963E, 0x9641, 0x9643, 0x964A, 0x964E, 0x964F, 0x9651, 0x9652, 0x9653, 0x9656, 0x9657, 0x9658, 0x9659, 0x965A, 0x965C, 0x965D, 0x965E, 0x9660, 0x9663, 0x9665, 0x9666, 0x966B, 0x966D, 0x966E, 0x966F, 0x9670, 0x9671, 0x9673, 0x9678, 0x9679, 0x967A, 0x967B, 0x967C, 0x967D, 0x967E, 0x967F, 0x9680, 0x9681, 0x9682, 0x9683, 0x9684, 0x9687, 0x9689,
+    0x968A, 0x8F8D, 0x8F8E, 0x8F8F, 0x8F98, 0x8F9A, 0x8ECE, 0x620B, 0x6217, 0x621B, 0x621F, 0x6222, 0x6221, 0x6225, 0x6224, 0x622C, 0x81E7, 0x74EF, 0x74F4, 0x74FF, 0x750F, 0x7511, 0x7513, 0x6534, 0x65EE, 0x65EF, 0x65F0, 0x660A, 0x6619, 0x6772, 0x6603, 0x6615, 0x6600, 0x7085, 0x66F7, 0x661D, 0x6634, 0x6631, 0x6636, 0x6635, 0x8006, 0x665F, 0x6654, 0x6641, 0x664F, 0x6656, 0x6661, 0x6657, 0x6677, 0x6684, 0x668C, 0x66A7, 0x669D, 0x66BE, 0x66DB, 0x66DC, 0x66E6, 0x66E9, 0x8D32, 0x8D33, 0x8D36, 0x8D3B, 0x8D3D, 0x8D40, 0x8D45, 0x8D46, 0x8D48, 0x8D49, 0x8D47, 0x8D4D, 0x8D55, 0x8D59, 0x89C7, 0x89CA, 0x89CB, 0x89CC, 0x89CE, 0x89CF, 0x89D0, 0x89D1, 0x726E, 0x729F, 0x725D, 0x7266, 0x726F, 0x727E, 0x727F, 0x7284, 0x728B, 0x728D, 0x728F, 0x7292, 0x6308, 0x6332, 0x63B0,
+    0x968C, 0x968E, 0x9691, 0x9692, 0x9693, 0x9695, 0x9696, 0x969A, 0x969B, 0x969D, 0x969E, 0x969F, 0x96A0, 0x96A1, 0x96A2, 0x96A3, 0x96A4, 0x96A5, 0x96A6, 0x96A8, 0x96A9, 0x96AA, 0x96AB, 0x96AC, 0x96AD, 0x96AE, 0x96AF, 0x96B1, 0x96B2, 0x96B4, 0x96B5, 0x96B7, 0x96B8, 0x96BA, 0x96BB, 0x96BF, 0x96C2, 0x96C3, 0x96C8, 0x96CA, 0x96CB, 0x96D0, 0x96D1, 0x96D3, 0x96D4, 0x96D6, 0x96D7, 0x96D8, 0x96D9, 0x96DA, 0x96DB, 0x96DC, 0x96DD, 0x96DE, 0x96DF, 0x96E1, 0x96E2, 0x96E3, 0x96E4, 0x96E5, 0x96E6, 0x96E7, 0x96EB, 0x96EC, 0x96ED, 0x96EE, 0x96F0, 0x96F1, 0x96F2, 0x96F4, 0x96F5, 0x96F8, 0x96FA, 0x96FB, 0x96FC, 0x96FD, 0x96FF, 0x9702, 0x9703, 0x9705, 0x970A, 0x970B, 0x970C, 0x9710, 0x9711, 0x9712, 0x9714, 0x9715, 0x9717, 0x9718, 0x9719, 0x971A, 0x971B, 0x971D, 0x971F,
+    0x9720, 0x643F, 0x64D8, 0x8004, 0x6BEA, 0x6BF3, 0x6BFD, 0x6BF5, 0x6BF9, 0x6C05, 0x6C07, 0x6C06, 0x6C0D, 0x6C15, 0x6C18, 0x6C19, 0x6C1A, 0x6C21, 0x6C29, 0x6C24, 0x6C2A, 0x6C32, 0x6535, 0x6555, 0x656B, 0x724D, 0x7252, 0x7256, 0x7230, 0x8662, 0x5216, 0x809F, 0x809C, 0x8093, 0x80BC, 0x670A, 0x80BD, 0x80B1, 0x80AB, 0x80AD, 0x80B4, 0x80B7, 0x80E7, 0x80E8, 0x80E9, 0x80EA, 0x80DB, 0x80C2, 0x80C4, 0x80D9, 0x80CD, 0x80D7, 0x6710, 0x80DD, 0x80EB, 0x80F1, 0x80F4, 0x80ED, 0x810D, 0x810E, 0x80F2, 0x80FC, 0x6715, 0x8112, 0x8C5A, 0x8136, 0x811E, 0x812C, 0x8118, 0x8132, 0x8148, 0x814C, 0x8153, 0x8174, 0x8159, 0x815A, 0x8171, 0x8160, 0x8169, 0x817C, 0x817D, 0x816D, 0x8167, 0x584D, 0x5AB5, 0x8188, 0x8182, 0x8191, 0x6ED5, 0x81A3, 0x81AA, 0x81CC, 0x6726, 0x81CA, 0x81BB,
+    0x9721, 0x9722, 0x9723, 0x9724, 0x9725, 0x9726, 0x9727, 0x9728, 0x9729, 0x972B, 0x972C, 0x972E, 0x972F, 0x9731, 0x9733, 0x9734, 0x9735, 0x9736, 0x9737, 0x973A, 0x973B, 0x973C, 0x973D, 0x973F, 0x9740, 0x9741, 0x9742, 0x9743, 0x9744, 0x9745, 0x9746, 0x9747, 0x9748, 0x9749, 0x974A, 0x974B, 0x974C, 0x974D, 0x974E, 0x974F, 0x9750, 0x9751, 0x9754, 0x9755, 0x9757, 0x9758, 0x975A, 0x975C, 0x975D, 0x975F, 0x9763, 0x9764, 0x9766, 0x9767, 0x9768, 0x976A, 0x976B, 0x976C, 0x976D, 0x976E, 0x976F, 0x9770, 0x9771, 0x9772, 0x9775, 0x9777, 0x9778, 0x9779, 0x977A, 0x977B, 0x977D, 0x977E, 0x977F, 0x9780, 0x9781, 0x9782, 0x9783, 0x9784, 0x9786, 0x9787, 0x9788, 0x9789, 0x978A, 0x978C, 0x978E, 0x978F, 0x9790, 0x9793, 0x9795, 0x9796, 0x9797, 0x9799, 0x979A, 0x979B, 0x979C,
+    0x979D, 0x81C1, 0x81A6, 0x6B24, 0x6B37, 0x6B39, 0x6B43, 0x6B46, 0x6B59, 0x98D1, 0x98D2, 0x98D3, 0x98D5, 0x98D9, 0x98DA, 0x6BB3, 0x5F40, 0x6BC2, 0x89F3, 0x6590, 0x9F51, 0x6593, 0x65BC, 0x65C6, 0x65C4, 0x65C3, 0x65CC, 0x65CE, 0x65D2, 0x65D6, 0x7080, 0x709C, 0x7096, 0x709D, 0x70BB, 0x70C0, 0x70B7, 0x70AB, 0x70B1, 0x70E8, 0x70CA, 0x7110, 0x7113, 0x7116, 0x712F, 0x7131, 0x7173, 0x715C, 0x7168, 0x7145, 0x7172, 0x714A, 0x7178, 0x717A, 0x7198, 0x71B3, 0x71B5, 0x71A8, 0x71A0, 0x71E0, 0x71D4, 0x71E7, 0x71F9, 0x721D, 0x7228, 0x706C, 0x7118, 0x7166, 0x71B9, 0x623E, 0x623D, 0x6243, 0x6248, 0x6249, 0x793B, 0x7940, 0x7946, 0x7949, 0x795B, 0x795C, 0x7953, 0x795A, 0x7962, 0x7957, 0x7960, 0x796F, 0x7967, 0x797A, 0x7985, 0x798A, 0x799A, 0x79A7, 0x79B3, 0x5FD1, 0x5FD0,
+    0x979E, 0x979F, 0x97A1, 0x97A2, 0x97A4, 0x97A5, 0x97A6, 0x97A7, 0x97A8, 0x97A9, 0x97AA, 0x97AC, 0x97AE, 0x97B0, 0x97B1, 0x97B3, 0x97B5, 0x97B6, 0x97B7, 0x97B8, 0x97B9, 0x97BA, 0x97BB, 0x97BC, 0x97BD, 0x97BE, 0x97BF, 0x97C0, 0x97C1, 0x97C2, 0x97C3, 0x97C4, 0x97C5, 0x97C6, 0x97C7, 0x97C8, 0x97C9, 0x97CA, 0x97CB, 0x97CC, 0x97CD, 0x97CE, 0x97CF, 0x97D0, 0x97D1, 0x97D2, 0x97D3, 0x97D4, 0x97D5, 0x97D6, 0x97D7, 0x97D8, 0x97D9, 0x97DA, 0x97DB, 0x97DC, 0x97DD, 0x97DE, 0x97DF, 0x97E0, 0x97E1, 0x97E2, 0x97E3, 0x97E4, 0x97E5, 0x97E8, 0x97EE, 0x97EF, 0x97F0, 0x97F1, 0x97F2, 0x97F4, 0x97F7, 0x97F8, 0x97F9, 0x97FA, 0x97FB, 0x97FC, 0x97FD, 0x97FE, 0x97FF, 0x9800, 0x9801, 0x9802, 0x9803, 0x9804, 0x9805, 0x9806, 0x9807, 0x9808, 0x9809, 0x980A, 0x980B, 0x980C, 0x980D,
+    0x980E, 0x603C, 0x605D, 0x605A, 0x6067, 0x6041, 0x6059, 0x6063, 0x60AB, 0x6106, 0x610D, 0x615D, 0x61A9, 0x619D, 0x61CB, 0x61D1, 0x6206, 0x8080, 0x807F, 0x6C93, 0x6CF6, 0x6DFC, 0x77F6, 0x77F8, 0x7800, 0x7809, 0x7817, 0x7818, 0x7811, 0x65AB, 0x782D, 0x781C, 0x781D, 0x7839, 0x783A, 0x783B, 0x781F, 0x783C, 0x7825, 0x782C, 0x7823, 0x7829, 0x784E, 0x786D, 0x7856, 0x7857, 0x7826, 0x7850, 0x7847, 0x784C, 0x786A, 0x789B, 0x7893, 0x789A, 0x7887, 0x789C, 0x78A1, 0x78A3, 0x78B2, 0x78B9, 0x78A5, 0x78D4, 0x78D9, 0x78C9, 0x78EC, 0x78F2, 0x7905, 0x78F4, 0x7913, 0x7924, 0x791E, 0x7934, 0x9F9B, 0x9EF9, 0x9EFB, 0x9EFC, 0x76F1, 0x7704, 0x770D, 0x76F9, 0x7707, 0x7708, 0x771A, 0x7722, 0x7719, 0x772D, 0x7726, 0x7735, 0x7738, 0x7750, 0x7751, 0x7747, 0x7743, 0x775A, 0x7768,
+    0x980F, 0x9810, 0x9811, 0x9812, 0x9813, 0x9814, 0x9815, 0x9816, 0x9817, 0x9818, 0x9819, 0x981A, 0x981B, 0x981C, 0x981D, 0x981E, 0x981F, 0x9820, 0x9821, 0x9822, 0x9823, 0x9824, 0x9825, 0x9826, 0x9827, 0x9828, 0x9829, 0x982A, 0x982B, 0x982C, 0x982D, 0x982E, 0x982F, 0x9830, 0x9831, 0x9832, 0x9833, 0x9834, 0x9835, 0x9836, 0x9837, 0x9838, 0x9839, 0x983A, 0x983B, 0x983C, 0x983D, 0x983E, 0x983F, 0x9840, 0x9841, 0x9842, 0x9843, 0x9844, 0x9845, 0x9846, 0x9847, 0x9848, 0x9849, 0x984A, 0x984B, 0x984C, 0x984D, 0x984E, 0x984F, 0x9850, 0x9851, 0x9852, 0x9853, 0x9854, 0x9855, 0x9856, 0x9857, 0x9858, 0x9859, 0x985A, 0x985B, 0x985C, 0x985D, 0x985E, 0x985F, 0x9860, 0x9861, 0x9862, 0x9863, 0x9864, 0x9865, 0x9866, 0x9867, 0x9868, 0x9869, 0x986A, 0x986B, 0x986C, 0x986D,
+    0x986E, 0x7762, 0x7765, 0x777F, 0x778D, 0x777D, 0x7780, 0x778C, 0x7791, 0x779F, 0x77A0, 0x77B0, 0x77B5, 0x77BD, 0x753A, 0x7540, 0x754E, 0x754B, 0x7548, 0x755B, 0x7572, 0x7579, 0x7583, 0x7F58, 0x7F61, 0x7F5F, 0x8A48, 0x7F68, 0x7F74, 0x7F71, 0x7F79, 0x7F81, 0x7F7E, 0x76CD, 0x76E5, 0x8832, 0x9485, 0x9486, 0x9487, 0x948B, 0x948A, 0x948C, 0x948D, 0x948F, 0x9490, 0x9494, 0x9497, 0x9495, 0x949A, 0x949B, 0x949C, 0x94A3, 0x94A4, 0x94AB, 0x94AA, 0x94AD, 0x94AC, 0x94AF, 0x94B0, 0x94B2, 0x94B4, 0x94B6, 0x94B7, 0x94B8, 0x94B9, 0x94BA, 0x94BC, 0x94BD, 0x94BF, 0x94C4, 0x94C8, 0x94C9, 0x94CA, 0x94CB, 0x94CC, 0x94CD, 0x94CE, 0x94D0, 0x94D1, 0x94D2, 0x94D5, 0x94D6, 0x94D7, 0x94D9, 0x94D8, 0x94DB, 0x94DE, 0x94DF, 0x94E0, 0x94E2, 0x94E4, 0x94E5, 0x94E7, 0x94E8, 0x94EA,
+    0x986F, 0x9870, 0x9871, 0x9872, 0x9873, 0x9874, 0x988B, 0x988E, 0x9892, 0x9895, 0x9899, 0x98A3, 0x98A8, 0x98A9, 0x98AA, 0x98AB, 0x98AC, 0x98AD, 0x98AE, 0x98AF, 0x98B0, 0x98B1, 0x98B2, 0x98B3, 0x98B4, 0x98B5, 0x98B6, 0x98B7, 0x98B8, 0x98B9, 0x98BA, 0x98BB, 0x98BC, 0x98BD, 0x98BE, 0x98BF, 0x98C0, 0x98C1, 0x98C2, 0x98C3, 0x98C4, 0x98C5, 0x98C6, 0x98C7, 0x98C8, 0x98C9, 0x98CA, 0x98CB, 0x98CC, 0x98CD, 0x98CF, 0x98D0, 0x98D4, 0x98D6, 0x98D7, 0x98DB, 0x98DC, 0x98DD, 0x98E0, 0x98E1, 0x98E2, 0x98E3, 0x98E4, 0x98E5, 0x98E6, 0x98E9, 0x98EA, 0x98EB, 0x98EC, 0x98ED, 0x98EE, 0x98EF, 0x98F0, 0x98F1, 0x98F2, 0x98F3, 0x98F4, 0x98F5, 0x98F6, 0x98F7, 0x98F8, 0x98F9, 0x98FA, 0x98FB, 0x98FC, 0x98FD, 0x98FE, 0x98FF, 0x9900, 0x9901, 0x9902, 0x9903, 0x9904, 0x9905, 0x9906,
+    0x9907, 0x94E9, 0x94EB, 0x94EE, 0x94EF, 0x94F3, 0x94F4, 0x94F5, 0x94F7, 0x94F9, 0x94FC, 0x94FD, 0x94FF, 0x9503, 0x9502, 0x9506, 0x9507, 0x9509, 0x950A, 0x950D, 0x950E, 0x950F, 0x9512, 0x9513, 0x9514, 0x9515, 0x9516, 0x9518, 0x951B, 0x951D, 0x951E, 0x951F, 0x9522, 0x952A, 0x952B, 0x9529, 0x952C, 0x9531, 0x9532, 0x9534, 0x9536, 0x9537, 0x9538, 0x953C, 0x953E, 0x953F, 0x9542, 0x9535, 0x9544, 0x9545, 0x9546, 0x9549, 0x954C, 0x954E, 0x954F, 0x9552, 0x9553, 0x9554, 0x9556, 0x9557, 0x9558, 0x9559, 0x955B, 0x955E, 0x955F, 0x955D, 0x9561, 0x9562, 0x9564, 0x9565, 0x9566, 0x9567, 0x9568, 0x9569, 0x956A, 0x956B, 0x956C, 0x956F, 0x9571, 0x9572, 0x9573, 0x953A, 0x77E7, 0x77EC, 0x96C9, 0x79D5, 0x79ED, 0x79E3, 0x79EB, 0x7A06, 0x5D47, 0x7A03, 0x7A02, 0x7A1E, 0x7A14,
+    0x9908, 0x9909, 0x990A, 0x990B, 0x990C, 0x990E, 0x990F, 0x9911, 0x9912, 0x9913, 0x9914, 0x9915, 0x9916, 0x9917, 0x9918, 0x9919, 0x991A, 0x991B, 0x991C, 0x991D, 0x991E, 0x991F, 0x9920, 0x9921, 0x9922, 0x9923, 0x9924, 0x9925, 0x9926, 0x9927, 0x9928, 0x9929, 0x992A, 0x992B, 0x992C, 0x992D, 0x992F, 0x9930, 0x9931, 0x9932, 0x9933, 0x9934, 0x9935, 0x9936, 0x9937, 0x9938, 0x9939, 0x993A, 0x993B, 0x993C, 0x993D, 0x993E, 0x993F, 0x9940, 0x9941, 0x9942, 0x9943, 0x9944, 0x9945, 0x9946, 0x9947, 0x9948, 0x9949, 0x994A, 0x994B, 0x994C, 0x994D, 0x994E, 0x994F, 0x9950, 0x9951, 0x9952, 0x9953, 0x9956, 0x9957, 0x9958, 0x9959, 0x995A, 0x995B, 0x995C, 0x995D, 0x995E, 0x995F, 0x9960, 0x9961, 0x9962, 0x9964, 0x9966, 0x9973, 0x9978, 0x9979, 0x997B, 0x997E, 0x9982, 0x9983,
+    0x9989, 0x7A39, 0x7A37, 0x7A51, 0x9ECF, 0x99A5, 0x7A70, 0x7688, 0x768E, 0x7693, 0x7699, 0x76A4, 0x74DE, 0x74E0, 0x752C, 0x9E20, 0x9E22, 0x9E28, 0x9E29, 0x9E2A, 0x9E2B, 0x9E2C, 0x9E32, 0x9E31, 0x9E36, 0x9E38, 0x9E37, 0x9E39, 0x9E3A, 0x9E3E, 0x9E41, 0x9E42, 0x9E44, 0x9E46, 0x9E47, 0x9E48, 0x9E49, 0x9E4B, 0x9E4C, 0x9E4E, 0x9E51, 0x9E55, 0x9E57, 0x9E5A, 0x9E5B, 0x9E5C, 0x9E5E, 0x9E63, 0x9E66, 0x9E67, 0x9E68, 0x9E69, 0x9E6A, 0x9E6B, 0x9E6C, 0x9E71, 0x9E6D, 0x9E73, 0x7592, 0x7594, 0x7596, 0x75A0, 0x759D, 0x75AC, 0x75A3, 0x75B3, 0x75B4, 0x75B8, 0x75C4, 0x75B1, 0x75B0, 0x75C3, 0x75C2, 0x75D6, 0x75CD, 0x75E3, 0x75E8, 0x75E6, 0x75E4, 0x75EB, 0x75E7, 0x7603, 0x75F1, 0x75FC, 0x75FF, 0x7610, 0x7600, 0x7605, 0x760C, 0x7617, 0x760A, 0x7625, 0x7618, 0x7615, 0x7619,
+    0x998C, 0x998E, 0x999A, 0x999B, 0x999C, 0x999D, 0x999E, 0x999F, 0x99A0, 0x99A1, 0x99A2, 0x99A3, 0x99A4, 0x99A6, 0x99A7, 0x99A9, 0x99AA, 0x99AB, 0x99AC, 0x99AD, 0x99AE, 0x99AF, 0x99B0, 0x99B1, 0x99B2, 0x99B3, 0x99B4, 0x99B5, 0x99B6, 0x99B7, 0x99B8, 0x99B9, 0x99BA, 0x99BB, 0x99BC, 0x99BD, 0x99BE, 0x99BF, 0x99C0, 0x99C1, 0x99C2, 0x99C3, 0x99C4, 0x99C5, 0x99C6, 0x99C7, 0x99C8, 0x99C9, 0x99CA, 0x99CB, 0x99CC, 0x99CD, 0x99CE, 0x99CF, 0x99D0, 0x99D1, 0x99D2, 0x99D3, 0x99D4, 0x99D5, 0x99D6, 0x99D7, 0x99D8, 0x99D9, 0x99DA, 0x99DB, 0x99DC, 0x99DD, 0x99DE, 0x99DF, 0x99E0, 0x99E1, 0x99E2, 0x99E3, 0x99E4, 0x99E5, 0x99E6, 0x99E7, 0x99E8, 0x99E9, 0x99EA, 0x99EB, 0x99EC, 0x99ED, 0x99EE, 0x99EF, 0x99F0, 0x99F1, 0x99F2, 0x99F3, 0x99F4, 0x99F5, 0x99F6, 0x99F7, 0x99F8,
+    0x99F9, 0x761B, 0x763C, 0x7622, 0x7620, 0x7640, 0x762D, 0x7630, 0x763F, 0x7635, 0x7643, 0x763E, 0x7633, 0x764D, 0x765E, 0x7654, 0x765C, 0x7656, 0x766B, 0x766F, 0x7FCA, 0x7AE6, 0x7A78, 0x7A79, 0x7A80, 0x7A86, 0x7A88, 0x7A95, 0x7AA6, 0x7AA0, 0x7AAC, 0x7AA8, 0x7AAD, 0x7AB3, 0x8864, 0x8869, 0x8872, 0x887D, 0x887F, 0x8882, 0x88A2, 0x88C6, 0x88B7, 0x88BC, 0x88C9, 0x88E2, 0x88CE, 0x88E3, 0x88E5, 0x88F1, 0x891A, 0x88FC, 0x88E8, 0x88FE, 0x88F0, 0x8921, 0x8919, 0x8913, 0x891B, 0x890A, 0x8934, 0x892B, 0x8936, 0x8941, 0x8966, 0x897B, 0x758B, 0x80E5, 0x76B2, 0x76B4, 0x77DC, 0x8012, 0x8014, 0x8016, 0x801C, 0x8020, 0x8022, 0x8025, 0x8026, 0x8027, 0x8029, 0x8028, 0x8031, 0x800B, 0x8035, 0x8043, 0x8046, 0x804D, 0x8052, 0x8069, 0x8071, 0x8983, 0x9878, 0x9880, 0x9883,
+    0x99FA, 0x99FB, 0x99FC, 0x99FD, 0x99FE, 0x99FF, 0x9A00, 0x9A01, 0x9A02, 0x9A03, 0x9A04, 0x9A05, 0x9A06, 0x9A07, 0x9A08, 0x9A09, 0x9A0A, 0x9A0B, 0x9A0C, 0x9A0D, 0x9A0E, 0x9A0F, 0x9A10, 0x9A11, 0x9A12, 0x9A13, 0x9A14, 0x9A15, 0x9A16, 0x9A17, 0x9A18, 0x9A19, 0x9A1A, 0x9A1B, 0x9A1C, 0x9A1D, 0x9A1E, 0x9A1F, 0x9A20, 0x9A21, 0x9A22, 0x9A23, 0x9A24, 0x9A25, 0x9A26, 0x9A27, 0x9A28, 0x9A29, 0x9A2A, 0x9A2B, 0x9A2C, 0x9A2D, 0x9A2E, 0x9A2F, 0x9A30, 0x9A31, 0x9A32, 0x9A33, 0x9A34, 0x9A35, 0x9A36, 0x9A37, 0x9A38, 0x9A39, 0x9A3A, 0x9A3B, 0x9A3C, 0x9A3D, 0x9A3E, 0x9A3F, 0x9A40, 0x9A41, 0x9A42, 0x9A43, 0x9A44, 0x9A45, 0x9A46, 0x9A47, 0x9A48, 0x9A49, 0x9A4A, 0x9A4B, 0x9A4C, 0x9A4D, 0x9A4E, 0x9A4F, 0x9A50, 0x9A51, 0x9A52, 0x9A53, 0x9A54, 0x9A55, 0x9A56, 0x9A57, 0x9A58,
+    0x9A59, 0x9889, 0x988C, 0x988D, 0x988F, 0x9894, 0x989A, 0x989B, 0x989E, 0x989F, 0x98A1, 0x98A2, 0x98A5, 0x98A6, 0x864D, 0x8654, 0x866C, 0x866E, 0x867F, 0x867A, 0x867C, 0x867B, 0x86A8, 0x868D, 0x868B, 0x86AC, 0x869D, 0x86A7, 0x86A3, 0x86AA, 0x8693, 0x86A9, 0x86B6, 0x86C4, 0x86B5, 0x86CE, 0x86B0, 0x86BA, 0x86B1, 0x86AF, 0x86C9, 0x86CF, 0x86B4, 0x86E9, 0x86F1, 0x86F2, 0x86ED, 0x86F3, 0x86D0, 0x8713, 0x86DE, 0x86F4, 0x86DF, 0x86D8, 0x86D1, 0x8703, 0x8707, 0x86F8, 0x8708, 0x870A, 0x870D, 0x8709, 0x8723, 0x873B, 0x871E, 0x8725, 0x872E, 0x871A, 0x873E, 0x8748, 0x8734, 0x8731, 0x8729, 0x8737, 0x873F, 0x8782, 0x8722, 0x877D, 0x877E, 0x877B, 0x8760, 0x8770, 0x874C, 0x876E, 0x878B, 0x8753, 0x8763, 0x877C, 0x8764, 0x8759, 0x8765, 0x8793, 0x87AF, 0x87A8, 0x87D2,
+    0x9A5A, 0x9A5B, 0x9A5C, 0x9A5D, 0x9A5E, 0x9A5F, 0x9A60, 0x9A61, 0x9A62, 0x9A63, 0x9A64, 0x9A65, 0x9A66, 0x9A67, 0x9A68, 0x9A69, 0x9A6A, 0x9A6B, 0x9A72, 0x9A83, 0x9A89, 0x9A8D, 0x9A8E, 0x9A94, 0x9A95, 0x9A99, 0x9AA6, 0x9AA9, 0x9AAA, 0x9AAB, 0x9AAC, 0x9AAD, 0x9AAE, 0x9AAF, 0x9AB2, 0x9AB3, 0x9AB4, 0x9AB5, 0x9AB9, 0x9ABB, 0x9ABD, 0x9ABE, 0x9ABF, 0x9AC3, 0x9AC4, 0x9AC6, 0x9AC7, 0x9AC8, 0x9AC9, 0x9ACA, 0x9ACD, 0x9ACE, 0x9ACF, 0x9AD0, 0x9AD2, 0x9AD4, 0x9AD5, 0x9AD6, 0x9AD7, 0x9AD9, 0x9ADA, 0x9ADB, 0x9ADC, 0x9ADD, 0x9ADE, 0x9AE0, 0x9AE2, 0x9AE3, 0x9AE4, 0x9AE5, 0x9AE7, 0x9AE8, 0x9AE9, 0x9AEA, 0x9AEC, 0x9AEE, 0x9AF0, 0x9AF1, 0x9AF2, 0x9AF3, 0x9AF4, 0x9AF5, 0x9AF6, 0x9AF7, 0x9AF8, 0x9AFA, 0x9AFC, 0x9AFD, 0x9AFE, 0x9AFF, 0x9B00, 0x9B01, 0x9B02, 0x9B04, 0x9B05,
+    0x9B06, 0x87C6, 0x8788, 0x8785, 0x87AD, 0x8797, 0x8783, 0x87AB, 0x87E5, 0x87AC, 0x87B5, 0x87B3, 0x87CB, 0x87D3, 0x87BD, 0x87D1, 0x87C0, 0x87CA, 0x87DB, 0x87EA, 0x87E0, 0x87EE, 0x8816, 0x8813, 0x87FE, 0x880A, 0x881B, 0x8821, 0x8839, 0x883C, 0x7F36, 0x7F42, 0x7F44, 0x7F45, 0x8210, 0x7AFA, 0x7AFD, 0x7B08, 0x7B03, 0x7B04, 0x7B15, 0x7B0A, 0x7B2B, 0x7B0F, 0x7B47, 0x7B38, 0x7B2A, 0x7B19, 0x7B2E, 0x7B31, 0x7B20, 0x7B25, 0x7B24, 0x7B33, 0x7B3E, 0x7B1E, 0x7B58, 0x7B5A, 0x7B45, 0x7B75, 0x7B4C, 0x7B5D, 0x7B60, 0x7B6E, 0x7B7B, 0x7B62, 0x7B72, 0x7B71, 0x7B90, 0x7BA6, 0x7BA7, 0x7BB8, 0x7BAC, 0x7B9D, 0x7BA8, 0x7B85, 0x7BAA, 0x7B9C, 0x7BA2, 0x7BAB, 0x7BB4, 0x7BD1, 0x7BC1, 0x7BCC, 0x7BDD, 0x7BDA, 0x7BE5, 0x7BE6, 0x7BEA, 0x7C0C, 0x7BFE, 0x7BFC, 0x7C0F, 0x7C16, 0x7C0B,
+    0x9B07, 0x9B09, 0x9B0A, 0x9B0B, 0x9B0C, 0x9B0D, 0x9B0E, 0x9B10, 0x9B11, 0x9B12, 0x9B14, 0x9B15, 0x9B16, 0x9B17, 0x9B18, 0x9B19, 0x9B1A, 0x9B1B, 0x9B1C, 0x9B1D, 0x9B1E, 0x9B20, 0x9B21, 0x9B22, 0x9B24, 0x9B25, 0x9B26, 0x9B27, 0x9B28, 0x9B29, 0x9B2A, 0x9B2B, 0x9B2C, 0x9B2D, 0x9B2E, 0x9B30, 0x9B31, 0x9B33, 0x9B34, 0x9B35, 0x9B36, 0x9B37, 0x9B38, 0x9B39, 0x9B3A, 0x9B3D, 0x9B3E, 0x9B3F, 0x9B40, 0x9B46, 0x9B4A, 0x9B4B, 0x9B4C, 0x9B4E, 0x9B50, 0x9B52, 0x9B53, 0x9B55, 0x9B56, 0x9B57, 0x9B58, 0x9B59, 0x9B5A, 0x9B5B, 0x9B5C, 0x9B5D, 0x9B5E, 0x9B5F, 0x9B60, 0x9B61, 0x9B62, 0x9B63, 0x9B64, 0x9B65, 0x9B66, 0x9B67, 0x9B68, 0x9B69, 0x9B6A, 0x9B6B, 0x9B6C, 0x9B6D, 0x9B6E, 0x9B6F, 0x9B70, 0x9B71, 0x9B72, 0x9B73, 0x9B74, 0x9B75, 0x9B76, 0x9B77, 0x9B78, 0x9B79, 0x9B7A,
+    0x9B7B, 0x7C1F, 0x7C2A, 0x7C26, 0x7C38, 0x7C41, 0x7C40, 0x81FE, 0x8201, 0x8202, 0x8204, 0x81EC, 0x8844, 0x8221, 0x8222, 0x8223, 0x822D, 0x822F, 0x8228, 0x822B, 0x8238, 0x823B, 0x8233, 0x8234, 0x823E, 0x8244, 0x8249, 0x824B, 0x824F, 0x825A, 0x825F, 0x8268, 0x887E, 0x8885, 0x8888, 0x88D8, 0x88DF, 0x895E, 0x7F9D, 0x7F9F, 0x7FA7, 0x7FAF, 0x7FB0, 0x7FB2, 0x7C7C, 0x6549, 0x7C91, 0x7C9D, 0x7C9C, 0x7C9E, 0x7CA2, 0x7CB2, 0x7CBC, 0x7CBD, 0x7CC1, 0x7CC7, 0x7CCC, 0x7CCD, 0x7CC8, 0x7CC5, 0x7CD7, 0x7CE8, 0x826E, 0x66A8, 0x7FBF, 0x7FCE, 0x7FD5, 0x7FE5, 0x7FE1, 0x7FE6, 0x7FE9, 0x7FEE, 0x7FF3, 0x7CF8, 0x7D77, 0x7DA6, 0x7DAE, 0x7E47, 0x7E9B, 0x9EB8, 0x9EB4, 0x8D73, 0x8D84, 0x8D94, 0x8D91, 0x8DB1, 0x8D67, 0x8D6D, 0x8C47, 0x8C49, 0x914A, 0x9150, 0x914E, 0x914F, 0x9164,
+    0x9B7C, 0x9B7D, 0x9B7E, 0x9B7F, 0x9B80, 0x9B81, 0x9B82, 0x9B83, 0x9B84, 0x9B85, 0x9B86, 0x9B87, 0x9B88, 0x9B89, 0x9B8A, 0x9B8B, 0x9B8C, 0x9B8D, 0x9B8E, 0x9B8F, 0x9B90, 0x9B91, 0x9B92, 0x9B93, 0x9B94, 0x9B95, 0x9B96, 0x9B97, 0x9B98, 0x9B99, 0x9B9A, 0x9B9B, 0x9B9C, 0x9B9D, 0x9B9E, 0x9B9F, 0x9BA0, 0x9BA1, 0x9BA2, 0x9BA3, 0x9BA4, 0x9BA5, 0x9BA6, 0x9BA7, 0x9BA8, 0x9BA9, 0x9BAA, 0x9BAB, 0x9BAC, 0x9BAD, 0x9BAE, 0x9BAF, 0x9BB0, 0x9BB1, 0x9BB2, 0x9BB3, 0x9BB4, 0x9BB5, 0x9BB6, 0x9BB7, 0x9BB8, 0x9BB9, 0x9BBA, 0x9BBB, 0x9BBC, 0x9BBD, 0x9BBE, 0x9BBF, 0x9BC0, 0x9BC1, 0x9BC2, 0x9BC3, 0x9BC4, 0x9BC5, 0x9BC6, 0x9BC7, 0x9BC8, 0x9BC9, 0x9BCA, 0x9BCB, 0x9BCC, 0x9BCD, 0x9BCE, 0x9BCF, 0x9BD0, 0x9BD1, 0x9BD2, 0x9BD3, 0x9BD4, 0x9BD5, 0x9BD6, 0x9BD7, 0x9BD8, 0x9BD9, 0x9BDA,
+    0x9BDB, 0x9162, 0x9161, 0x9170, 0x9169, 0x916F, 0x917D, 0x917E, 0x9172, 0x9174, 0x9179, 0x918C, 0x9185, 0x9190, 0x918D, 0x9191, 0x91A2, 0x91A3, 0x91AA, 0x91AD, 0x91AE, 0x91AF, 0x91B5, 0x91B4, 0x91BA, 0x8C55, 0x9E7E, 0x8DB8, 0x8DEB, 0x8E05, 0x8E59, 0x8E69, 0x8DB5, 0x8DBF, 0x8DBC, 0x8DBA, 0x8DC4, 0x8DD6, 0x8DD7, 0x8DDA, 0x8DDE, 0x8DCE, 0x8DCF, 0x8DDB, 0x8DC6, 0x8DEC, 0x8DF7, 0x8DF8, 0x8DE3, 0x8DF9, 0x8DFB, 0x8DE4, 0x8E09, 0x8DFD, 0x8E14, 0x8E1D, 0x8E1F, 0x8E2C, 0x8E2E, 0x8E23, 0x8E2F, 0x8E3A, 0x8E40, 0x8E39, 0x8E35, 0x8E3D, 0x8E31, 0x8E49, 0x8E41, 0x8E42, 0x8E51, 0x8E52, 0x8E4A, 0x8E70, 0x8E76, 0x8E7C, 0x8E6F, 0x8E74, 0x8E85, 0x8E8F, 0x8E94, 0x8E90, 0x8E9C, 0x8E9E, 0x8C78, 0x8C82, 0x8C8A, 0x8C85, 0x8C98, 0x8C94, 0x659B, 0x89D6, 0x89DE, 0x89DA, 0x89DC,
+    0x9BDC, 0x9BDD, 0x9BDE, 0x9BDF, 0x9BE0, 0x9BE1, 0x9BE2, 0x9BE3, 0x9BE4, 0x9BE5, 0x9BE6, 0x9BE7, 0x9BE8, 0x9BE9, 0x9BEA, 0x9BEB, 0x9BEC, 0x9BED, 0x9BEE, 0x9BEF, 0x9BF0, 0x9BF1, 0x9BF2, 0x9BF3, 0x9BF4, 0x9BF5, 0x9BF6, 0x9BF7, 0x9BF8, 0x9BF9, 0x9BFA, 0x9BFB, 0x9BFC, 0x9BFD, 0x9BFE, 0x9BFF, 0x9C00, 0x9C01, 0x9C02, 0x9C03, 0x9C04, 0x9C05, 0x9C06, 0x9C07, 0x9C08, 0x9C09, 0x9C0A, 0x9C0B, 0x9C0C, 0x9C0D, 0x9C0E, 0x9C0F, 0x9C10, 0x9C11, 0x9C12, 0x9C13, 0x9C14, 0x9C15, 0x9C16, 0x9C17, 0x9C18, 0x9C19, 0x9C1A, 0x9C1B, 0x9C1C, 0x9C1D, 0x9C1E, 0x9C1F, 0x9C20, 0x9C21, 0x9C22, 0x9C23, 0x9C24, 0x9C25, 0x9C26, 0x9C27, 0x9C28, 0x9C29, 0x9C2A, 0x9C2B, 0x9C2C, 0x9C2D, 0x9C2E, 0x9C2F, 0x9C30, 0x9C31, 0x9C32, 0x9C33, 0x9C34, 0x9C35, 0x9C36, 0x9C37, 0x9C38, 0x9C39, 0x9C3A,
+    0x9C3B, 0x89E5, 0x89EB, 0x89EF, 0x8A3E, 0x8B26, 0x9753, 0x96E9, 0x96F3, 0x96EF, 0x9706, 0x9701, 0x9708, 0x970F, 0x970E, 0x972A, 0x972D, 0x9730, 0x973E, 0x9F80, 0x9F83, 0x9F85, 0x9F86, 0x9F87, 0x9F88, 0x9F89, 0x9F8A, 0x9F8C, 0x9EFE, 0x9F0B, 0x9F0D, 0x96B9, 0x96BC, 0x96BD, 0x96CE, 0x96D2, 0x77BF, 0x96E0, 0x928E, 0x92AE, 0x92C8, 0x933E, 0x936A, 0x93CA, 0x938F, 0x943E, 0x946B, 0x9C7F, 0x9C82, 0x9C85, 0x9C86, 0x9C87, 0x9C88, 0x7A23, 0x9C8B, 0x9C8E, 0x9C90, 0x9C91, 0x9C92, 0x9C94, 0x9C95, 0x9C9A, 0x9C9B, 0x9C9E, 0x9C9F, 0x9CA0, 0x9CA1, 0x9CA2, 0x9CA3, 0x9CA5, 0x9CA6, 0x9CA7, 0x9CA8, 0x9CA9, 0x9CAB, 0x9CAD, 0x9CAE, 0x9CB0, 0x9CB1, 0x9CB2, 0x9CB3, 0x9CB4, 0x9CB5, 0x9CB6, 0x9CB7, 0x9CBA, 0x9CBB, 0x9CBC, 0x9CBD, 0x9CC4, 0x9CC5, 0x9CC6, 0x9CC7, 0x9CCA, 0x9CCB,
+    0x9C3C, 0x9C3D, 0x9C3E, 0x9C3F, 0x9C40, 0x9C41, 0x9C42, 0x9C43, 0x9C44, 0x9C45, 0x9C46, 0x9C47, 0x9C48, 0x9C49, 0x9C4A, 0x9C4B, 0x9C4C, 0x9C4D, 0x9C4E, 0x9C4F, 0x9C50, 0x9C51, 0x9C52, 0x9C53, 0x9C54, 0x9C55, 0x9C56, 0x9C57, 0x9C58, 0x9C59, 0x9C5A, 0x9C5B, 0x9C5C, 0x9C5D, 0x9C5E, 0x9C5F, 0x9C60, 0x9C61, 0x9C62, 0x9C63, 0x9C64, 0x9C65, 0x9C66, 0x9C67, 0x9C68, 0x9C69, 0x9C6A, 0x9C6B, 0x9C6C, 0x9C6D, 0x9C6E, 0x9C6F, 0x9C70, 0x9C71, 0x9C72, 0x9C73, 0x9C74, 0x9C75, 0x9C76, 0x9C77, 0x9C78, 0x9C79, 0x9C7A, 0x9C7B, 0x9C7D, 0x9C7E, 0x9C80, 0x9C83, 0x9C84, 0x9C89, 0x9C8A, 0x9C8C, 0x9C8F, 0x9C93, 0x9C96, 0x9C97, 0x9C98, 0x9C99, 0x9C9D, 0x9CAA, 0x9CAC, 0x9CAF, 0x9CB9, 0x9CBE, 0x9CBF, 0x9CC0, 0x9CC1, 0x9CC2, 0x9CC8, 0x9CC9, 0x9CD1, 0x9CD2, 0x9CDA, 0x9CDB, 0x9CE0,
+    0x9CE1, 0x9CCC, 0x9CCD, 0x9CCE, 0x9CCF, 0x9CD0, 0x9CD3, 0x9CD4, 0x9CD5, 0x9CD7, 0x9CD8, 0x9CD9, 0x9CDC, 0x9CDD, 0x9CDF, 0x9CE2, 0x977C, 0x9785, 0x9791, 0x9792, 0x9794, 0x97AF, 0x97AB, 0x97A3, 0x97B2, 0x97B4, 0x9AB1, 0x9AB0, 0x9AB7, 0x9E58, 0x9AB6, 0x9ABA, 0x9ABC, 0x9AC1, 0x9AC0, 0x9AC5, 0x9AC2, 0x9ACB, 0x9ACC, 0x9AD1, 0x9B45, 0x9B43, 0x9B47, 0x9B49, 0x9B48, 0x9B4D, 0x9B51, 0x98E8, 0x990D, 0x992E, 0x9955, 0x9954, 0x9ADF, 0x9AE1, 0x9AE6, 0x9AEF, 0x9AEB, 0x9AFB, 0x9AED, 0x9AF9, 0x9B08, 0x9B0F, 0x9B13, 0x9B1F, 0x9B23, 0x9EBD, 0x9EBE, 0x7E3B, 0x9E82, 0x9E87, 0x9E88, 0x9E8B, 0x9E92, 0x93D6, 0x9E9D, 0x9E9F, 0x9EDB, 0x9EDC, 0x9EDD, 0x9EE0, 0x9EDF, 0x9EE2, 0x9EE9, 0x9EE7, 0x9EE5, 0x9EEA, 0x9EEF, 0x9F22, 0x9F2C, 0x9F2F, 0x9F39, 0x9F37, 0x9F3D, 0x9F3E, 0x9F44,
+    0x9CE3, 0x9CE4, 0x9CE5, 0x9CE6, 0x9CE7, 0x9CE8, 0x9CE9, 0x9CEA, 0x9CEB, 0x9CEC, 0x9CED, 0x9CEE, 0x9CEF, 0x9CF0, 0x9CF1, 0x9CF2, 0x9CF3, 0x9CF4, 0x9CF5, 0x9CF6, 0x9CF7, 0x9CF8, 0x9CF9, 0x9CFA, 0x9CFB, 0x9CFC, 0x9CFD, 0x9CFE, 0x9CFF, 0x9D00, 0x9D01, 0x9D02, 0x9D03, 0x9D04, 0x9D05, 0x9D06, 0x9D07, 0x9D08, 0x9D09, 0x9D0A, 0x9D0B, 0x9D0C, 0x9D0D, 0x9D0E, 0x9D0F, 0x9D10, 0x9D11, 0x9D12, 0x9D13, 0x9D14, 0x9D15, 0x9D16, 0x9D17, 0x9D18, 0x9D19, 0x9D1A, 0x9D1B, 0x9D1C, 0x9D1D, 0x9D1E, 0x9D1F, 0x9D20, 0x9D21, 0x9D22, 0x9D23, 0x9D24, 0x9D25, 0x9D26, 0x9D27, 0x9D28, 0x9D29, 0x9D2A, 0x9D2B, 0x9D2C, 0x9D2D, 0x9D2E, 0x9D2F, 0x9D30, 0x9D31, 0x9D32, 0x9D33, 0x9D34, 0x9D35, 0x9D36, 0x9D37, 0x9D38, 0x9D39, 0x9D3A, 0x9D3B, 0x9D3C, 0x9D3D, 0x9D3E, 0x9D3F, 0x9D40, 0x9D41,
+    0x9D42, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x9D43, 0x9D44, 0x9D45, 0x9D46, 0x9D47, 0x9D48, 0x9D49, 0x9D4A, 0x9D4B, 0x9D4C, 0x9D4D, 0x9D4E, 0x9D4F, 0x9D50, 0x9D51, 0x9D52, 0x9D53, 0x9D54, 0x9D55, 0x9D56, 0x9D57, 0x9D58, 0x9D59, 0x9D5A, 0x9D5B, 0x9D5C, 0x9D5D, 0x9D5E, 0x9D5F, 0x9D60, 0x9D61, 0x9D62, 0x9D63, 0x9D64, 0x9D65, 0x9D66, 0x9D67, 0x9D68, 0x9D69, 0x9D6A, 0x9D6B, 0x9D6C, 0x9D6D, 0x9D6E, 0x9D6F, 0x9D70, 0x9D71, 0x9D72, 0x9D73, 0x9D74, 0x9D75, 0x9D76, 0x9D77, 0x9D78, 0x9D79, 0x9D7A, 0x9D7B, 0x9D7C, 0x9D7D, 0x9D7E, 0x9D7F, 0x9D80, 0x9D81, 0x9D82, 0x9D83, 0x9D84, 0x9D85, 0x9D86, 0x9D87, 0x9D88, 0x9D89, 0x9D8A, 0x9D8B, 0x9D8C, 0x9D8D, 0x9D8E, 0x9D8F, 0x9D90, 0x9D91, 0x9D92, 0x9D93, 0x9D94, 0x9D95, 0x9D96, 0x9D97, 0x9D98, 0x9D99, 0x9D9A, 0x9D9B, 0x9D9C, 0x9D9D, 0x9D9E, 0x9D9F, 0x9DA0, 0x9DA1,
+    0x9DA2, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x9DA3, 0x9DA4, 0x9DA5, 0x9DA6, 0x9DA7, 0x9DA8, 0x9DA9, 0x9DAA, 0x9DAB, 0x9DAC, 0x9DAD, 0x9DAE, 0x9DAF, 0x9DB0, 0x9DB1, 0x9DB2, 0x9DB3, 0x9DB4, 0x9DB5, 0x9DB6, 0x9DB7, 0x9DB8, 0x9DB9, 0x9DBA, 0x9DBB, 0x9DBC, 0x9DBD, 0x9DBE, 0x9DBF, 0x9DC0, 0x9DC1, 0x9DC2, 0x9DC3, 0x9DC4, 0x9DC5, 0x9DC6, 0x9DC7, 0x9DC8, 0x9DC9, 0x9DCA, 0x9DCB, 0x9DCC, 0x9DCD, 0x9DCE, 0x9DCF, 0x9DD0, 0x9DD1, 0x9DD2, 0x9DD3, 0x9DD4, 0x9DD5, 0x9DD6, 0x9DD7, 0x9DD8, 0x9DD9, 0x9DDA, 0x9DDB, 0x9DDC, 0x9DDD, 0x9DDE, 0x9DDF, 0x9DE0, 0x9DE1, 0x9DE2, 0x9DE3, 0x9DE4, 0x9DE5, 0x9DE6, 0x9DE7, 0x9DE8, 0x9DE9, 0x9DEA, 0x9DEB, 0x9DEC, 0x9DED, 0x9DEE, 0x9DEF, 0x9DF0, 0x9DF1, 0x9DF2, 0x9DF3, 0x9DF4, 0x9DF5, 0x9DF6, 0x9DF7, 0x9DF8, 0x9DF9, 0x9DFA, 0x9DFB, 0x9DFC, 0x9DFD, 0x9DFE, 0x9DFF, 0x9E00, 0x9E01,
+    0x9E02, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x9E03, 0x9E04, 0x9E05, 0x9E06, 0x9E07, 0x9E08, 0x9E09, 0x9E0A, 0x9E0B, 0x9E0C, 0x9E0D, 0x9E0E, 0x9E0F, 0x9E10, 0x9E11, 0x9E12, 0x9E13, 0x9E14, 0x9E15, 0x9E16, 0x9E17, 0x9E18, 0x9E19, 0x9E1A, 0x9E1B, 0x9E1C, 0x9E1D, 0x9E1E, 0x9E24, 0x9E27, 0x9E2E, 0x9E30, 0x9E34, 0x9E3B, 0x9E3C, 0x9E40, 0x9E4D, 0x9E50, 0x9E52, 0x9E53, 0x9E54, 0x9E56, 0x9E59, 0x9E5D, 0x9E5F, 0x9E60, 0x9E61, 0x9E62, 0x9E65, 0x9E6E, 0x9E6F, 0x9E72, 0x9E74, 0x9E75, 0x9E76, 0x9E77, 0x9E78, 0x9E79, 0x9E7A, 0x9E7B, 0x9E7C, 0x9E7D, 0x9E80, 0x9E81, 0x9E83, 0x9E84, 0x9E85, 0x9E86, 0x9E89, 0x9E8A, 0x9E8C, 0x9E8D, 0x9E8E, 0x9E8F, 0x9E90, 0x9E91, 0x9E94, 0x9E95, 0x9E96, 0x9E97, 0x9E98, 0x9E99, 0x9E9A, 0x9E9B, 0x9E9C, 0x9E9E, 0x9EA0, 0x9EA1, 0x9EA2, 0x9EA3, 0x9EA4, 0x9EA5, 0x9EA7, 0x9EA8, 0x9EA9,
+    0x9EAA, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x9EAB, 0x9EAC, 0x9EAD, 0x9EAE, 0x9EAF, 0x9EB0, 0x9EB1, 0x9EB2, 0x9EB3, 0x9EB5, 0x9EB6, 0x9EB7, 0x9EB9, 0x9EBA, 0x9EBC, 0x9EBF, 0x9EC0, 0x9EC1, 0x9EC2, 0x9EC3, 0x9EC5, 0x9EC6, 0x9EC7, 0x9EC8, 0x9ECA, 0x9ECB, 0x9ECC, 0x9ED0, 0x9ED2, 0x9ED3, 0x9ED5, 0x9ED6, 0x9ED7, 0x9ED9, 0x9EDA, 0x9EDE, 0x9EE1, 0x9EE3, 0x9EE4, 0x9EE6, 0x9EE8, 0x9EEB, 0x9EEC, 0x9EED, 0x9EEE, 0x9EF0, 0x9EF1, 0x9EF2, 0x9EF3, 0x9EF4, 0x9EF5, 0x9EF6, 0x9EF7, 0x9EF8, 0x9EFA, 0x9EFD, 0x9EFF, 0x9F00, 0x9F01, 0x9F02, 0x9F03, 0x9F04, 0x9F05, 0x9F06, 0x9F07, 0x9F08, 0x9F09, 0x9F0A, 0x9F0C, 0x9F0F, 0x9F11, 0x9F12, 0x9F14, 0x9F15, 0x9F16, 0x9F18, 0x9F1A, 0x9F1B, 0x9F1C, 0x9F1D, 0x9F1E, 0x9F1F, 0x9F21, 0x9F23, 0x9F24, 0x9F25, 0x9F26, 0x9F27, 0x9F28, 0x9F29, 0x9F2A, 0x9F2B, 0x9F2D, 0x9F2E, 0x9F30,
+    0x9F31, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x9F32, 0x9F33, 0x9F34, 0x9F35, 0x9F36, 0x9F38, 0x9F3A, 0x9F3C, 0x9F3F, 0x9F40, 0x9F41, 0x9F42, 0x9F43, 0x9F45, 0x9F46, 0x9F47, 0x9F48, 0x9F49, 0x9F4A, 0x9F4B, 0x9F4C, 0x9F4D, 0x9F4E, 0x9F4F, 0x9F52, 0x9F53, 0x9F54, 0x9F55, 0x9F56, 0x9F57, 0x9F58, 0x9F59, 0x9F5A, 0x9F5B, 0x9F5C, 0x9F5D, 0x9F5E, 0x9F5F, 0x9F60, 0x9F61, 0x9F62, 0x9F63, 0x9F64, 0x9F65, 0x9F66, 0x9F67, 0x9F68, 0x9F69, 0x9F6A, 0x9F6B, 0x9F6C, 0x9F6D, 0x9F6E, 0x9F6F, 0x9F70, 0x9F71, 0x9F72, 0x9F73, 0x9F74, 0x9F75, 0x9F76, 0x9F77, 0x9F78, 0x9F79, 0x9F7A, 0x9F7B, 0x9F7C, 0x9F7D, 0x9F7E, 0x9F81, 0x9F82, 0x9F8D, 0x9F8E, 0x9F8F, 0x9F90, 0x9F91, 0x9F92, 0x9F93, 0x9F94, 0x9F95, 0x9F96, 0x9F97, 0x9F98, 0x9F9C, 0x9F9D, 0x9F9E, 0x9FA1, 0x9FA2, 0x9FA3, 0x9FA4, 0x9FA5, 0xF92C, 0xF979, 0xF995, 0xF9E7,
+    0xF9F1, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0xFA0C, 0xFA0D, 0xFA0E, 0xFA0F, 0xFA11, 0xFA13, 0xFA14, 0xFA18, 0xFA1F, 0xFA20, 0xFA21, 0xFA23, 0xFA24, 0xFA27, 0xFA28, 0xFA29, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+};
+
+}
diff --git a/core/libs/prx/libSceCesCs/Export.cpp b/core/libs/prx/libSceCesCs/Export.cpp
index 25dcb94514..92cd419115 100644
--- a/core/libs/prx/libSceCesCs/Export.cpp
+++ b/core/libs/prx/libSceCesCs/Export.cpp
@@ -1,15 +1,23 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <algorithm>
+#include <bit>
 #include <cstring>
+#include <iterator>
+#include <span>
+#include <stdexcept>
 #include <utility>
 #include <vector>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "JisX0208.hpp"
 #include "JisX0212.hpp"
+#include "Cp936.hpp"
+#include "Gb18030.hpp"
 #include "Cp949.hpp"
 #include "Cp950.hpp"
+#include "SingleByte.hpp"
 
 namespace {
 
@@ -21,10 +29,10 @@ constexpr int CES_ERROR_UNASSIGNED_CODE = static_cast<int>(0x805C0020);
 constexpr int CES_ERROR_INVALID_DST_BUFFER = static_cast<int>(0x805C0030);
 constexpr int CES_ERROR_DST_BUFFER_END = static_cast<int>(0x805C0031);
 
-constexpr uint8_t PROFILES[3] = {0, 1, 2};
-constexpr const uint8_t* CP1252_PROFILE = &PROFILES[0];
-constexpr const uint8_t* CP1251_PROFILE = &PROFILES[1];
-constexpr const uint8_t* CP1250_PROFILE = &PROFILES[2];
+constexpr uint8_t PROFILES[3 + SingleByte::Count][8] = {{0}, {1}, {2}};
+constexpr const uint8_t* CP1252_PROFILE = PROFILES[0];
+constexpr const uint8_t* CP1251_PROFILE = PROFILES[1];
+constexpr const uint8_t* CP1250_PROFILE = PROFILES[2];
 
 constexpr uint16_t CP1252_HIGH[32] = {
     0x20AC, 0x0081, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, 0x008D, 0x017D, 0x008F,
@@ -59,21 +67,30 @@ constexpr uint16_t CP932_IBM_HEAD[28] = {
     0xFFE2, 0xFFE4, 0xFF07, 0xFF02, 0x3231, 0x2116, 0x2121, 0x2235,
 };
 
-uint32_t sbcToUnicode(const uint8_t* profile, uint8_t sbc) {
-    if (profile == CP1251_PROFILE || profile == CP1250_PROFILE) {
-        const uint16_t* high = profile == CP1251_PROFILE ? CP1251_HIGH : CP1250_HIGH;
-        return sbc >= 0x80 ? high[sbc - 0x80] : sbc;
+const uint8_t* singleByteProfile(SingleByte::Table table) {
+    return PROFILES[3 + table];
+}
+
+const uint16_t* sbcHighTable(const void* profile) {
+    if (profile == CP1251_PROFILE) return CP1251_HIGH;
+    if (profile == CP1250_PROFILE) return CP1250_HIGH;
+    for (std::size_t table = 0; table < SingleByte::Count; ++table) {
+        if (profile == singleByteProfile(static_cast<SingleByte::Table>(table))) return SingleByte::HIGH[table];
     }
+    return nullptr;
+}
+
+uint32_t sbcToUnicode(const uint8_t* profile, uint8_t sbc) {
+    if (const uint16_t* high = sbcHighTable(profile)) return sbc >= 0x80 ? high[sbc - 0x80] : sbc;
     return sbc >= 0x80 && sbc < 0xA0 ? CP1252_HIGH[sbc - 0x80] : sbc;
 }
 
 bool unicodeToSbc(const uint8_t* profile, uint32_t code, uint8_t& sbc) {
-    if (profile == CP1251_PROFILE || profile == CP1250_PROFILE) {
+    if (const uint16_t* high = sbcHighTable(profile)) {
         if (code < 0x80) {
             sbc = static_cast<uint8_t>(code);
             return true;
         }
-        const uint16_t* high = profile == CP1251_PROFILE ? CP1251_HIGH : CP1250_HIGH;
         for (uint32_t i = 0; i < 128; ++i) {
             if (high[i] == code) {
                 sbc = static_cast<uint8_t>(0x80 + i);
@@ -127,25 +144,314 @@ uint32_t encodeUtf8(uint32_t code, uint8_t* utf8) {
         utf8[1] = static_cast<uint8_t>(0x80 | (code & 0x3F));
         return 2;
     }
-    utf8[0] = static_cast<uint8_t>(0xE0 | code >> 12);
-    utf8[1] = static_cast<uint8_t>(0x80 | (code >> 6 & 0x3F));
-    utf8[2] = static_cast<uint8_t>(0x80 | (code & 0x3F));
-    return 3;
+    if (code < 0x10000) {
+        utf8[0] = static_cast<uint8_t>(0xE0 | code >> 12);
+        utf8[1] = static_cast<uint8_t>(0x80 | (code >> 6 & 0x3F));
+        utf8[2] = static_cast<uint8_t>(0x80 | (code & 0x3F));
+        return 3;
+    }
+    utf8[0] = static_cast<uint8_t>(0xF0 | code >> 18);
+    utf8[1] = static_cast<uint8_t>(0x80 | (code >> 12 & 0x3F));
+    utf8[2] = static_cast<uint8_t>(0x80 | (code >> 6 & 0x3F));
+    utf8[3] = static_cast<uint8_t>(0x80 | (code & 0x3F));
+    return 4;
 }
 
 constexpr uint8_t EUC_JP_TAG[8] = {'E', 'U', 'C', 'J', 'P', '9', '3', '2'};
+constexpr uint8_t EUC_JP_X0208_TAG[8] = {'E', 'U', 'C', 'J', 'X', '2', '0', '8'};
+constexpr uint8_t EUC_JP_X0208_SS2_TAG[8] = {'E', 'U', 'C', 'J', 'X', 'S', 'S', '2'};
+constexpr uint8_t EUC_JP_X0208_SS3_TAG[8] = {'E', 'U', 'C', 'J', 'X', 'S', 'S', '3'};
 constexpr uint8_t SJIS_TAG[8] = {'S', 'J', 'I', 'S', '1', '9', '9', '7'};
+constexpr uint8_t SJIS_X0208_TAG[8] = {'S', 'J', 'I', 'S', 'X', '2', '0', '8'};
+
+bool hasTag(const void* profile, const uint8_t (&tag)[8]) {
+    return profile != nullptr && std::memcmp(profile, tag, sizeof(tag)) == 0;
+}
+
+bool isEucJpX0208(const void* profile) {
+    return hasTag(profile, EUC_JP_X0208_TAG) || hasTag(profile, EUC_JP_X0208_SS2_TAG) || hasTag(profile, EUC_JP_X0208_SS3_TAG);
+}
 
 bool isEucJp(const void* profile) {
-    return profile != nullptr && std::memcmp(profile, EUC_JP_TAG, sizeof(EUC_JP_TAG)) == 0;
+    return hasTag(profile, EUC_JP_TAG) || isEucJpX0208(profile);
+}
+
+bool hasSs2(const void* profile) {
+    return !hasTag(profile, EUC_JP_X0208_TAG);
+}
+
+bool hasSs3(const void* profile) {
+    return hasTag(profile, EUC_JP_TAG) || hasTag(profile, EUC_JP_X0208_SS3_TAG);
+}
+
+bool isSjisX0208(const void* profile) {
+    return hasTag(profile, SJIS_X0208_TAG);
 }
 
 bool isSjis(const void* profile) {
-    return profile != nullptr && std::memcmp(profile, SJIS_TAG, sizeof(SJIS_TAG)) == 0;
+    return hasTag(profile, SJIS_TAG) || isSjisX0208(profile);
+}
+
+struct JisChange {
+    uint16_t jis;
+    uint16_t code;
+};
+
+constexpr JisChange JIS_X0208_CHANGES[6] = {{0x2141, 0x301C}, {0x2142, 0x2016}, {0x215D, 0x2212}, {0x2171, 0x00A2}, {0x2172, 0x00A3}, {0x224C, 0x00AC}};
+constexpr uint16_t JIS_X0208_UNSETTLED_CELL = 0x2140;
+constexpr uint16_t JIS_X0208_UNSETTLED_CODE = 0xFF3C;
+constexpr const char* JIS_X0208_UNSETTLED = "libSceCesCs: the console's mapping of JIS X 0208 cell 0x2140 (U+005C or U+FF3C) is unknown";
+
+constexpr uint32_t jisIndex(uint16_t jis) {
+    return ((jis >> 8) - 0x21) * 94 + (jis & 0xFF) - 0x21;
+}
+
+bool isCp932ExtensionRow(uint32_t row) {
+    return row == 13 || (row >= 89 && row <= 92);
+}
+
+uint16_t strictJisX0208(uint32_t index) {
+    if (isCp932ExtensionRow(index / 94 + 1) || index == jisIndex(JIS_X0208_UNSETTLED_CELL)) return 0;
+    for (const JisChange& change : JIS_X0208_CHANGES) {
+        if (jisIndex(change.jis) == index) return change.code;
+    }
+    return JisX0208::TO_UCS2[index];
+}
+
+uint32_t jisX0208ToUnicode(bool strict, uint32_t index) {
+    if (!strict) return JisX0208::TO_UCS2[index];
+    if (index == jisIndex(JIS_X0208_UNSETTLED_CELL)) throw std::runtime_error(JIS_X0208_UNSETTLED);
+    return strictJisX0208(index);
+}
+
+void requireSettledSjisX0208(uint32_t code) {
+    if (code == 0x5C || code == 0x7E || code == 0xA5 || code == 0x203E) throw std::runtime_error("libSceCesCs: the console's mapping of Shift-JIS bytes 0x5C and 0x7E (ASCII or JIS X 0201 Roman) is unknown");
+}
+
+constexpr uint8_t EUC_CN_TAG[8] = {'E', 'U', 'C', 'C', 'N', '9', '3', '6'};
+constexpr uint8_t GBK_TAG[8] = {'G', 'B', 'K', 'C', 'P', '9', '3', '6'};
+
+bool isEucCn(const void* profile) {
+    return profile != nullptr && std::memcmp(profile, EUC_CN_TAG, sizeof(EUC_CN_TAG)) == 0;
+}
+
+bool isGbk(const void* profile) {
+    return profile != nullptr && std::memcmp(profile, GBK_TAG, sizeof(GBK_TAG)) == 0;
 }
 
 bool isSbc(const void* profile) {
-    return profile == CP1252_PROFILE || profile == CP1251_PROFILE || profile == CP1250_PROFILE;
+    return profile == CP1252_PROFILE || sbcHighTable(profile) != nullptr;
+}
+
+int decodeGb(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
+    const uint8_t lead = mbcs[0];
+    if (lead < 0x80) {
+        length = 1;
+        code = lead;
+        return 0;
+    }
+    const bool gbk = isGbk(profile);
+    if (gbk && lead == 0x80) {
+        length = 1;
+        code = 0x20AC;
+        return 0;
+    }
+    if (lead == 0xFF || (!gbk && lead < 0xA1)) return CES_ERROR_INVALID_ENCODE;
+    if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
+    const uint8_t trail = mbcs[1];
+    if (trail == 0xFF || (gbk ? trail < 0x40 || trail == 0x7F : trail < 0xA1)) return CES_ERROR_INVALID_ENCODE;
+    code = Cp936::TO_UCS2[(lead - 0x81) * 190 + (trail < 0x7F ? trail - 0x40 : trail - 0x41)];
+    if (code == 0) return CES_ERROR_UNASSIGNED_CODE;
+    length = 2;
+    return 0;
+}
+
+const std::vector<std::pair<uint16_t, uint16_t>>& cp936Reverse() {
+    static const auto reverse = [] {
+        std::vector<std::pair<uint16_t, uint16_t>> entries;
+        for (uint32_t cell = 0; cell < 126 * 190; ++cell) {
+            if (Cp936::TO_UCS2[cell] != 0) entries.emplace_back(Cp936::TO_UCS2[cell], static_cast<uint16_t>(cell));
+        }
+        std::sort(entries.begin(), entries.end());
+        return entries;
+    }();
+    return reverse;
+}
+
+int encodeGb(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& length) {
+    if (code < 0x80) {
+        length = 1;
+        mbcs[0] = static_cast<uint8_t>(code);
+        return 0;
+    }
+    const bool gbk = isGbk(profile);
+    if (gbk && code == 0x20AC) {
+        length = 1;
+        mbcs[0] = 0x80;
+        return 0;
+    }
+    if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
+    const auto& reverse = cp936Reverse();
+    for (auto found = std::lower_bound(reverse.begin(), reverse.end(), std::pair<uint16_t, uint16_t>(static_cast<uint16_t>(code), 0));
+         found != reverse.end() && found->first == code; ++found) {
+        const uint8_t lead = static_cast<uint8_t>(0x81 + found->second / 190);
+        const uint32_t cell = found->second % 190;
+        const uint8_t trail = static_cast<uint8_t>(cell < 0x3F ? 0x40 + cell : 0x41 + cell);
+        if (!gbk && (lead < 0xA1 || trail < 0xA1)) continue;
+        mbcs[0] = lead;
+        mbcs[1] = trail;
+        length = 2;
+        return 0;
+    }
+    return CES_ERROR_UNASSIGNED_CODE;
+}
+
+constexpr uint8_t GB18030_2000_TAG[8] = {'G', 'B', '1', '8', '2', '0', '0', '0'};
+constexpr uint8_t GB18030_2005_TAG[8] = {'G', 'B', '1', '8', '2', '0', '0', '5'};
+constexpr uint32_t GB_CELLS = 126 * 190;
+
+struct Gb18030Tables {
+    std::span<const uint32_t[3]> twoByte;
+    std::span<const uint32_t[3]> fourByte;
+    std::span<const uint32_t[2]> fallback;
+};
+
+constexpr Gb18030Tables GB18030_2000{Gb18030::TWO_BYTE_2000, Gb18030::FOUR_BYTE_2000, {}};
+constexpr Gb18030Tables GB18030_2005{Gb18030::TWO_BYTE_2005, Gb18030::FOUR_BYTE_2005, Gb18030::FALLBACK_2005};
+
+const Gb18030Tables* gb18030Tables(const void* profile) {
+    if (profile == nullptr) return nullptr;
+    if (std::memcmp(profile, GB18030_2000_TAG, sizeof(GB18030_2000_TAG)) == 0) return &GB18030_2000;
+    if (std::memcmp(profile, GB18030_2005_TAG, sizeof(GB18030_2005_TAG)) == 0) return &GB18030_2005;
+    return nullptr;
+}
+
+bool isGb18030(const void* profile) {
+    return gb18030Tables(profile) != nullptr;
+}
+
+bool isGb(const void* profile) {
+    return isGbk(profile) || isGb18030(profile);
+}
+
+const uint32_t* findRun(std::span<const uint32_t[3]> runs, uint32_t key) {
+    const auto next = std::upper_bound(runs.begin(), runs.end(), key, [](uint32_t value, const uint32_t (&run)[3]) { return value < run[0]; });
+    if (next == runs.begin()) return nullptr;
+    const uint32_t* run = *std::prev(next);
+    return key - run[0] < run[2] ? run : nullptr;
+}
+
+uint32_t gb18030Cell(const Gb18030Tables& tables, uint32_t cell) {
+    const uint32_t* run = findRun(tables.twoByte, cell);
+    return run ? run[1] + cell - run[0] : Cp936::TO_UCS2[cell];
+}
+
+void putGbCell(uint32_t cell, uint8_t* mbcs) {
+    const uint32_t column = cell % 190;
+    mbcs[0] = static_cast<uint8_t>(0x81 + cell / 190);
+    mbcs[1] = static_cast<uint8_t>(column < 0x3F ? 0x40 + column : 0x41 + column);
+}
+
+int decodeGb18030(const Gb18030Tables& tables, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
+    const uint8_t lead = mbcs[0];
+    if (lead < 0x80) {
+        length = 1;
+        code = lead;
+        return 0;
+    }
+    if (lead == 0x80 || lead == 0xFF) return CES_ERROR_INVALID_ENCODE;
+    if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
+    const uint8_t second = mbcs[1];
+    if (second >= 0x30 && second <= 0x39) {
+        if (mbcsMax < 4) return CES_ERROR_SRC_BUFFER_END;
+        if (mbcs[2] < 0x81 || mbcs[2] == 0xFF || mbcs[3] < 0x30 || mbcs[3] > 0x39) return CES_ERROR_INVALID_ENCODE;
+        const uint32_t linear = (((lead - 0x81) * 10 + (second - 0x30)) * 126 + (mbcs[2] - 0x81)) * 10 + (mbcs[3] - 0x30);
+        const uint32_t* run = findRun(tables.fourByte, linear);
+        if (!run) return CES_ERROR_UNASSIGNED_CODE;
+        length = 4;
+        code = run[1] + linear - run[0];
+        return 0;
+    }
+    if (second < 0x40 || second == 0x7F || second == 0xFF) return CES_ERROR_INVALID_ENCODE;
+    length = 2;
+    code = gb18030Cell(tables, (lead - 0x81) * 190 + (second < 0x7F ? second - 0x40 : second - 0x41));
+    return 0;
+}
+
+const std::vector<std::pair<uint32_t, uint16_t>>& gb18030Reverse(const Gb18030Tables& tables) {
+    const auto build = [](const Gb18030Tables& source) {
+        std::vector<std::pair<uint32_t, uint16_t>> entries;
+        entries.reserve(GB_CELLS);
+        for (uint32_t cell = 0; cell < GB_CELLS; ++cell) entries.emplace_back(gb18030Cell(source, cell), static_cast<uint16_t>(cell));
+        std::sort(entries.begin(), entries.end());
+        return entries;
+    };
+    static const auto reverse2000 = build(GB18030_2000);
+    static const auto reverse2005 = build(GB18030_2005);
+    return &tables == &GB18030_2005 ? reverse2005 : reverse2000;
+}
+
+int encodeGb18030(const Gb18030Tables& tables, uint32_t code, uint8_t* mbcs, uint32_t& length) {
+    if (code < 0x80) {
+        length = 1;
+        mbcs[0] = static_cast<uint8_t>(code);
+        return 0;
+    }
+    const auto& reverse = gb18030Reverse(tables);
+    const auto found = std::lower_bound(reverse.begin(), reverse.end(), std::pair<uint32_t, uint16_t>(code, 0));
+    if (found != reverse.end() && found->first == code) {
+        putGbCell(found->second, mbcs);
+        length = 2;
+        return 0;
+    }
+    for (const auto& run : tables.fourByte) {
+        if (code - run[1] >= run[2]) continue;
+        uint32_t linear = run[0] + code - run[1];
+        mbcs[3] = static_cast<uint8_t>(0x30 + linear % 10);
+        linear /= 10;
+        mbcs[2] = static_cast<uint8_t>(0x81 + linear % 126);
+        linear /= 126;
+        mbcs[1] = static_cast<uint8_t>(0x30 + linear % 10);
+        mbcs[0] = static_cast<uint8_t>(0x81 + linear / 10);
+        length = 4;
+        return 0;
+    }
+    for (const auto& entry : tables.fallback) {
+        if (entry[0] != code) continue;
+        putGbCell(entry[1], mbcs);
+        length = 2;
+        return 0;
+    }
+    return CES_ERROR_UNASSIGNED_CODE;
+}
+
+bool sjisToJis(uint8_t lead, uint8_t trail, int& row, int& cell) {
+    if (!((lead >= 0x81 && lead <= 0x9F) || (lead >= 0xE0 && lead <= 0xFC))) return false;
+    if (trail < 0x40 || trail == 0x7F || trail > 0xFC) return false;
+    row = lead <= 0x9F ? (lead - 0x81) * 2 + 1 : (lead - 0xE0) * 2 + 63;
+    if (trail >= 0x9F) {
+        row += 1;
+        cell = trail - 0x9E;
+    } else {
+        cell = trail > 0x7E ? trail - 0x40 : trail - 0x3F;
+    }
+    return true;
+}
+
+void jisToSjis(int row, int cell, uint8_t& lead, uint8_t& trail) {
+    if (row % 2 != 0) {
+        lead = static_cast<uint8_t>(row < 63 ? 0x81 + (row - 1) / 2 : 0xE0 + (row - 63) / 2);
+        trail = static_cast<uint8_t>(cell <= 63 ? cell + 0x3F : cell + 0x40);
+    } else {
+        lead = static_cast<uint8_t>(row < 63 ? 0x81 + (row - 2) / 2 : 0xE0 + (row - 64) / 2);
+        trail = static_cast<uint8_t>(cell + 0x9E);
+    }
+}
+
+constexpr uint8_t JIS_X0213_PLANE2_ROWS[26] = {1, 8, 3, 4, 5, 12, 13, 14, 15, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94};
+
+bool isSjisSingle(uint8_t byte) {
+    return byte < 0x80 || (byte >= 0xA1 && byte <= 0xDF);
 }
 
 const void* contextProfile(const void* context) {
@@ -172,7 +478,7 @@ bool isBig5(const void* profile) {
 }
 
 bool isMbcs(const void* profile) {
-    return isEucJp(profile) || isSjis(profile) || isSbc(profile) || isEucKr(profile) || isUhc(profile) || isBig5(profile);
+    return isEucJp(profile) || isSjis(profile) || isSbc(profile) || isEucCn(profile) || isGb(profile) || isEucKr(profile) || isUhc(profile) || isBig5(profile);
 }
 
 int decodeCp949(bool unified, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
@@ -267,6 +573,8 @@ int encodeDbcs(const std::vector<DbcsCell>& reverse, bool euc, uint32_t code, ui
 int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t& length, uint32_t& code) {
     if (isEucKr(profile) || isUhc(profile)) return decodeCp949(isUhc(profile), mbcs, mbcsMax, length, code);
     if (isBig5(profile)) return decodeCp950(mbcs, mbcsMax, length, code);
+    if (const Gb18030Tables* tables = gb18030Tables(profile)) return decodeGb18030(*tables, mbcs, mbcsMax, length, code);
+    if (isEucCn(profile) || isGbk(profile)) return decodeGb(profile, mbcs, mbcsMax, length, code);
     const uint8_t lead = mbcs[0];
     if (isSbc(profile)) {
         length = 1;
@@ -274,7 +582,9 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
         return 0;
     }
     if (isSjis(profile)) {
+        const bool strict = isSjisX0208(profile);
         if (lead < 0x80) {
+            if (strict) requireSettledSjisX0208(lead);
             length = 1;
             code = lead;
             return 0;
@@ -288,7 +598,7 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
             if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
             const uint8_t trail = mbcs[1];
             if (trail < 0x40 || trail == 0x7F || trail > 0xFC) return CES_ERROR_INVALID_ENCODE;
-            if (lead >= 0xFA) {
+            if (lead >= 0xFA && !strict) {
                 const uint32_t trailIdx = trail < 0x7F ? trail - 0x40 : trail - 0x41;
                 const uint32_t offset = (lead - 0xFA) * 188 + trailIdx;
                 if (offset <= 387) {
@@ -307,16 +617,11 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
                 }
                 return CES_ERROR_UNASSIGNED_CODE;
             }
-            int row = (lead <= 0x9F) ? (lead - 0x81) * 2 + 1 : (lead - 0xE0) * 2 + 63;
+            int row = 0;
             int cell = 0;
-            if (trail >= 0x9F) {
-                row += 1;
-                cell = trail - 0x9E;
-            } else {
-                cell = (trail > 0x7E) ? trail - 0x40 : trail - 0x3F;
-            }
+            sjisToJis(lead, trail, row, cell);
             if (row < 1 || row > 94 || cell < 1 || cell > 94) return CES_ERROR_UNASSIGNED_CODE;
-            code = JisX0208::TO_UCS2[(row - 1) * 94 + (cell - 1)];
+            code = jisX0208ToUnicode(strict, (row - 1) * 94 + (cell - 1));
             if (code == 0) return CES_ERROR_UNASSIGNED_CODE;
             length = 2;
             return 0;
@@ -328,7 +633,7 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
         code = lead;
         return 0;
     }
-    if (lead == 0x8E) {
+    if (lead == 0x8E && hasSs2(profile)) {
         if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
         if (mbcs[1] < 0xA1 || mbcs[1] > 0xDF) return CES_ERROR_INVALID_ENCODE;
         length = 2;
@@ -339,10 +644,10 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
         if (mbcsMax < 2) return CES_ERROR_SRC_BUFFER_END;
         if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE) return CES_ERROR_INVALID_ENCODE;
         length = 2;
-        code = JisX0208::TO_UCS2[(lead - 0xA1) * 94 + (mbcs[1] - 0xA1)];
+        code = jisX0208ToUnicode(isEucJpX0208(profile), (lead - 0xA1) * 94 + (mbcs[1] - 0xA1));
         return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
     }
-    if (lead == 0x8F) {
+    if (lead == 0x8F && hasSs3(profile)) {
         if (mbcsMax < 3) return CES_ERROR_SRC_BUFFER_END;
         if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE || mbcs[2] < 0xA1 || mbcs[2] > 0xFE) return CES_ERROR_INVALID_ENCODE;
         length = 3;
@@ -358,31 +663,42 @@ struct JisCell {
     bool supplementary;
 };
 
-const std::vector<JisCell>& jisReverse() {
-    static const auto reverse = [] {
-        std::vector<JisCell> entries;
-        entries.reserve(2 * 94 * 94);
-        for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
-            if (JisX0208::TO_UCS2[cell] != 0) entries.push_back({JisX0208::TO_UCS2[cell], static_cast<uint16_t>(cell), false});
-        }
-        for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
-            if (JisX0212::TO_UCS2[cell] != 0) entries.push_back({JisX0212::TO_UCS2[cell], static_cast<uint16_t>(cell), true});
-        }
-        std::stable_sort(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code < right.code; });
-        entries.erase(std::unique(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code == right.code; }), entries.end());
-        return entries;
-    }();
+std::vector<JisCell> buildJisReverse(bool strict) {
+    std::vector<JisCell> entries;
+    entries.reserve(2 * 94 * 94);
+    for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
+        const uint16_t code = strict ? strictJisX0208(cell) : JisX0208::TO_UCS2[cell];
+        if (code != 0) entries.push_back({code, static_cast<uint16_t>(cell), false});
+    }
+    for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
+        if (JisX0212::TO_UCS2[cell] != 0) entries.push_back({JisX0212::TO_UCS2[cell], static_cast<uint16_t>(cell), true});
+    }
+    std::stable_sort(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code < right.code; });
+    entries.erase(std::unique(entries.begin(), entries.end(), [](const JisCell& left, const JisCell& right) { return left.code == right.code; }), entries.end());
+    return entries;
+}
+
+const std::vector<JisCell>& jisReverse(bool strict) {
+    if (strict) {
+        static const auto strictReverse = buildJisReverse(true);
+        return strictReverse;
+    }
+    static const auto reverse = buildJisReverse(false);
     return reverse;
 }
 
 int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& length) {
     if (isEucKr(profile) || isUhc(profile)) return encodeDbcs(cp949Reverse(), isEucKr(profile), code, mbcs, length);
     if (isBig5(profile)) return encodeDbcs(cp950Reverse(), false, code, mbcs, length);
+    if (const Gb18030Tables* tables = gb18030Tables(profile)) return encodeGb18030(*tables, code, mbcs, length);
+    if (isEucCn(profile) || isGbk(profile)) return encodeGb(profile, code, mbcs, length);
     if (isSbc(profile)) {
         length = 1;
         return unicodeToSbc(static_cast<const uint8_t*>(profile), code, mbcs[0]) ? 0 : CES_ERROR_UNASSIGNED_CODE;
     }
     if (isSjis(profile)) {
+        const bool strict = isSjisX0208(profile);
+        if (strict) requireSettledSjisX0208(code);
         if (code < 0x80) {
             length = 1;
             mbcs[0] = static_cast<uint8_t>(code);
@@ -394,18 +710,11 @@ int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& leng
             return 0;
         }
         if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
-        const auto& reverse = jisReverse();
+        if (strict && code == JIS_X0208_UNSETTLED_CODE) throw std::runtime_error(JIS_X0208_UNSETTLED);
+        const auto& reverse = jisReverse(strict);
         const auto found = std::lower_bound(reverse.begin(), reverse.end(), static_cast<uint16_t>(code), [](const JisCell& entry, uint16_t value) { return entry.code < value; });
         if (found == reverse.end() || found->code != code || found->supplementary) return CES_ERROR_UNASSIGNED_CODE;
-        const int row = found->cell / 94 + 1;
-        const int cell = found->cell % 94 + 1;
-        if (row % 2 != 0) {
-            mbcs[0] = static_cast<uint8_t>(row < 63 ? 0x81 + (row - 1) / 2 : 0xE0 + (row - 63) / 2);
-            mbcs[1] = static_cast<uint8_t>(cell <= 63 ? cell + 0x3F : cell + 0x40);
-        } else {
-            mbcs[0] = static_cast<uint8_t>(row < 63 ? 0x81 + (row - 2) / 2 : 0xE0 + (row - 64) / 2);
-            mbcs[1] = static_cast<uint8_t>(cell + 0x9E);
-        }
+        jisToSjis(found->cell / 94 + 1, found->cell % 94 + 1, mbcs[0], mbcs[1]);
         length = 2;
         return 0;
     }
@@ -415,15 +724,18 @@ int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& leng
         return 0;
     }
     if (code >= 0xFF61 && code <= 0xFF9F) {
+        if (!hasSs2(profile)) return CES_ERROR_UNASSIGNED_CODE;
         length = 2;
         mbcs[0] = 0x8E;
         mbcs[1] = static_cast<uint8_t>(0xA1 + (code - 0xFF61));
         return 0;
     }
     if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
-    const auto& reverse = jisReverse();
+    const bool strict = isEucJpX0208(profile);
+    if (strict && code == JIS_X0208_UNSETTLED_CODE) throw std::runtime_error(JIS_X0208_UNSETTLED);
+    const auto& reverse = jisReverse(strict);
     const auto found = std::lower_bound(reverse.begin(), reverse.end(), static_cast<uint16_t>(code), [](const JisCell& entry, uint16_t value) { return entry.code < value; });
-    if (found == reverse.end() || found->code != code) return CES_ERROR_UNASSIGNED_CODE;
+    if (found == reverse.end() || found->code != code || (found->supplementary && !hasSs3(profile))) return CES_ERROR_UNASSIGNED_CODE;
     if (found->supplementary) {
         length = 3;
         mbcs[0] = 0x8F;
@@ -444,10 +756,21 @@ int decodeUcs2(const uint16_t* ucs2, uint32_t, uint32_t& length, uint32_t& code)
 }
 
 uint32_t encodeUcs2(uint32_t code, uint16_t* ucs2) {
+    if (code > 0xFFFF) return 0;
     ucs2[0] = static_cast<uint16_t>(code);
     return 1;
 }
 
+uint32_t encodeUtf16(uint32_t code, uint16_t* utf16) {
+    if (code < 0x10000) {
+        utf16[0] = static_cast<uint16_t>(code);
+        return 1;
+    }
+    utf16[0] = static_cast<uint16_t>(0xD800 | (code - 0x10000) >> 10);
+    utf16[1] = static_cast<uint16_t>(0xDC00 | (code & 0x3FF));
+    return 2;
+}
+
 template<typename Source, typename Decode>
 int toMbcs(const void* context, const Source* source, uint32_t sourceMax, uint32_t* sourceLen, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, Decode decode) {
     if (!context) return CES_ERROR_INVALID_PARAMETER;
@@ -460,7 +783,7 @@ int toMbcs(const void* context, const Source* source, uint32_t sourceMax, uint32
         uint32_t length = 0;
         uint32_t code = 0;
         if (const int result = decode(source + read, sourceMax - read, length, code); result != 0) return result;
-        uint8_t encoded[3];
+        uint8_t encoded[4];
         uint32_t size = 0;
         if (const int result = encodeMbcs(profile, code, encoded, size); result != 0) return result;
         if (mbcs) {
@@ -489,6 +812,7 @@ int fromMbcs(const void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_
         if (const int result = decodeMbcs(profile, mbcs + read, mbcsMax - read, length, code); result != 0) return result;
         Target encoded[4];
         const uint32_t size = encode(code, encoded);
+        if (size == 0) return CES_ERROR_UNASSIGNED_CODE;
         if (target) {
             if (written + size > targetMax) return CES_ERROR_DST_BUFFER_END;
             std::memcpy(target + written, encoded, size * sizeof(Target));
@@ -509,7 +833,7 @@ int mbcsToUtf8(bool accepted, const void* profile, const uint8_t* mbcs, uint32_t
     uint32_t consumed = 0;
     uint32_t code = 0;
     if (const int result = decodeMbcs(profile, mbcs, mbcsMax, consumed, code); result != 0) return result;
-    uint8_t encoded[3];
+    uint8_t encoded[4];
     const uint32_t produced = encodeUtf8(code, encoded);
     if (utf8Max < produced) return CES_ERROR_DST_BUFFER_END;
     std::memcpy(utf8, encoded, produced);
@@ -518,6 +842,202 @@ int mbcsToUtf8(bool accepted, const void* profile, const uint8_t* mbcs, uint32_t
     return 0;
 }
 
+constexpr bool NATIVE_BIG_ENDIAN = std::endian::native == std::endian::big;
+
+template<typename Unit, bool BigEndian>
+uint32_t loadUnit(const Unit* source) {
+    const auto* bytes = reinterpret_cast<const uint8_t*>(source);
+    uint32_t code = 0;
+    for (uint32_t i = 0; i < sizeof(Unit); ++i) code |= uint32_t(bytes[i]) << (8 * (BigEndian ? sizeof(Unit) - 1 - i : i));
+    return code;
+}
+
+template<typename Unit, bool BigEndian>
+void storeUnit(Unit* target, uint32_t code) {
+    auto* bytes = reinterpret_cast<uint8_t*>(target);
+    for (uint32_t i = 0; i < sizeof(Unit); ++i) bytes[i] = static_cast<uint8_t>(code >> (8 * (BigEndian ? sizeof(Unit) - 1 - i : i)));
+}
+
+bool isScalar(uint32_t code) {
+    return code <= 0x10FFFF && (code < 0xD800 || code > 0xDFFF);
+}
+
+template<bool BigEndian>
+int decodeUtf16(const uint16_t* utf16, uint32_t utf16max, uint32_t& length, uint32_t& code) {
+    code = loadUnit<uint16_t, BigEndian>(utf16);
+    length = 1;
+    if (code >= 0xDC00 && code <= 0xDFFF) return CES_ERROR_INVALID_ENCODE;
+    if (code >= 0xD800 && code <= 0xDBFF) {
+        if (utf16max < 2) return CES_ERROR_SRC_BUFFER_END;
+        const uint32_t low = loadUnit<uint16_t, BigEndian>(utf16 + 1);
+        if (low < 0xDC00 || low > 0xDFFF) return CES_ERROR_INVALID_ENCODE;
+        code = 0x10000 + ((code - 0xD800) << 10) + low - 0xDC00;
+        length = 2;
+    }
+    return 0;
+}
+
+int decodeProfiled(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, const void* target, uint32_t& length, uint32_t& code) {
+    if (!matches(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!source) return CES_ERROR_INVALID_SRC_BUFFER;
+    if (sourceMax == 0) return CES_ERROR_SRC_BUFFER_END;
+    if (!target) return CES_ERROR_INVALID_DST_BUFFER;
+    return decodeMbcs(profile, source, sourceMax, length, code);
+}
+
+int profiledToUcs2(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint16_t* ucs2) {
+    uint32_t length = 0;
+    uint32_t code = 0;
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, ucs2, length, code); result != 0) return result;
+    if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
+    *ucs2 = static_cast<uint16_t>(code);
+    if (sourceSize) *sourceSize = length;
+    return 0;
+}
+
+int profiledToUtf8(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len) {
+    uint32_t length = 0;
+    uint32_t code = 0;
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf8, length, code); result != 0) return result;
+    uint8_t encoded[4];
+    const uint32_t produced = encodeUtf8(code, encoded);
+    if (utf8max < produced) return CES_ERROR_DST_BUFFER_END;
+    std::memcpy(utf8, encoded, produced);
+    if (sourceSize) *sourceSize = length;
+    if (utf8Len) *utf8Len = produced;
+    return 0;
+}
+
+template<bool BigEndian>
+int profiledToUtf16(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
+    uint32_t length = 0;
+    uint32_t code = 0;
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf16, length, code); result != 0) return result;
+    const uint32_t units = code < 0x10000 ? 1 : 2;
+    if (utf16max < units) return CES_ERROR_DST_BUFFER_END;
+    if (units == 1) {
+        storeUnit<uint16_t, BigEndian>(utf16, code);
+    } else {
+        storeUnit<uint16_t, BigEndian>(utf16, 0xD800 | (code - 0x10000) >> 10);
+        storeUnit<uint16_t, BigEndian>(utf16 + 1, 0xDC00 | (code & 0x3FF));
+    }
+    if (sourceSize) *sourceSize = length;
+    if (utf16Len) *utf16Len = units;
+    return 0;
+}
+
+template<bool BigEndian>
+int profiledToUtf32(bool (*matches)(const void*), const void* profile, const uint8_t* source, uint32_t sourceMax, uint32_t* sourceSize, uint32_t* utf32) {
+    uint32_t length = 0;
+    uint32_t code = 0;
+    if (const int result = decodeProfiled(matches, profile, source, sourceMax, utf32, length, code); result != 0) return result;
+    storeUnit<uint32_t, BigEndian>(utf32, code);
+    if (sourceSize) *sourceSize = length;
+    return 0;
+}
+
+int encodeProfiled(const void* profile, uint32_t code, uint8_t* target, uint32_t targetMax, uint32_t* targetSize) {
+    uint8_t encoded[4];
+    uint32_t size = 0;
+    if (const int result = encodeMbcs(profile, code, encoded, size); result != 0) return result;
+    if (targetMax < size) return CES_ERROR_DST_BUFFER_END;
+    std::memcpy(target, encoded, size);
+    if (targetSize) *targetSize = size;
+    return 0;
+}
+
+int scalarToProfiled(bool (*matches)(const void*), uint32_t code, const void* profile, uint8_t* target, uint32_t targetMax, uint32_t* targetSize) {
+    if (!matches(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!target) return CES_ERROR_INVALID_DST_BUFFER;
+    if (!isScalar(code)) return CES_ERROR_INVALID_ENCODE;
+    return encodeProfiled(profile, code, target, targetMax, targetSize);
+}
+
+template<bool BigEndian>
+int utf32ToProfiled(bool (*matches)(const void*), const uint32_t* utf32, const void* profile, uint8_t* target, uint32_t targetMax, uint32_t* targetSize) {
+    if (!matches(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!utf32) return CES_ERROR_INVALID_SRC_BUFFER;
+    return scalarToProfiled(matches, loadUnit<uint32_t, BigEndian>(utf32), profile, target, targetMax, targetSize);
+}
+
+template<typename Source, typename Decode>
+int bufferToProfiled(bool (*matches)(const void*), const Source* source, uint32_t sourceMax, uint32_t* sourceLen, const void* profile, uint8_t* target, uint32_t targetMax, uint32_t* targetSize, Decode decode) {
+    if (!matches(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!source) return CES_ERROR_INVALID_SRC_BUFFER;
+    if (sourceMax == 0) return CES_ERROR_SRC_BUFFER_END;
+    if (!target) return CES_ERROR_INVALID_DST_BUFFER;
+    uint32_t length = 0;
+    uint32_t code = 0;
+    if (const int result = decode(source, sourceMax, length, code); result != 0) return result;
+    if (const int result = encodeProfiled(profile, code, target, targetMax, targetSize); result != 0) return result;
+    if (sourceLen) *sourceLen = length;
+    return 0;
+}
+
+int decodeUtf32(const uint32_t* utf32, uint32_t, uint32_t& length, uint32_t& code) {
+    length = 1;
+    code = utf32[0];
+    return isScalar(code) ? 0 : CES_ERROR_INVALID_ENCODE;
+}
+
+uint32_t encodeUtf32(uint32_t code, uint32_t* utf32) {
+    utf32[0] = code;
+    return 1;
+}
+
+int sbcToUnit(const uint8_t* profile, uint8_t sbc, const void* target, uint32_t& code) {
+    if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!target) return CES_ERROR_INVALID_DST_BUFFER;
+    code = sbcToUnicode(profile, sbc);
+    return 0;
+}
+
+template<bool BigEndian>
+int sbcToUtf16(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
+    uint32_t code = 0;
+    if (const int result = sbcToUnit(profile, sbc, utf16, code); result != 0) return result;
+    if (utf16max < 1) return CES_ERROR_DST_BUFFER_END;
+    storeUnit<uint16_t, BigEndian>(utf16, code);
+    if (utf16Len) *utf16Len = 1;
+    return 0;
+}
+
+template<bool BigEndian>
+int sbcToUtf32(const uint8_t* profile, uint8_t sbc, uint32_t* utf32) {
+    uint32_t code = 0;
+    if (const int result = sbcToUnit(profile, sbc, utf32, code); result != 0) return result;
+    storeUnit<uint32_t, BigEndian>(utf32, code);
+    return 0;
+}
+
+int scalarToSbc(uint32_t code, const uint8_t* profile, uint8_t* sbc) {
+    if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!sbc) return CES_ERROR_INVALID_DST_BUFFER;
+    if (!isScalar(code)) return CES_ERROR_INVALID_ENCODE;
+    return unicodeToSbc(profile, code, *sbc) ? 0 : CES_ERROR_UNASSIGNED_CODE;
+}
+
+template<bool BigEndian>
+int utf16ToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc) {
+    if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!utf16) return CES_ERROR_INVALID_SRC_BUFFER;
+    if (utf16max == 0) return CES_ERROR_SRC_BUFFER_END;
+    if (!sbc) return CES_ERROR_INVALID_DST_BUFFER;
+    uint32_t length = 0;
+    uint32_t code = 0;
+    if (const int result = decodeUtf16<BigEndian>(utf16, utf16max, length, code); result != 0) return result;
+    if (!unicodeToSbc(profile, code, *sbc)) return CES_ERROR_UNASSIGNED_CODE;
+    if (utf16Len) *utf16Len = length;
+    return 0;
+}
+
+template<bool BigEndian>
+int utf32ToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc) {
+    if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
+    if (!utf32) return CES_ERROR_INVALID_SRC_BUFFER;
+    return scalarToSbc(loadUnit<uint32_t, BigEndian>(utf32), profile, sbc);
+}
+
 }
 
 extern "C" {
@@ -534,24 +1054,163 @@ const void* APS5_VABI sceCesRefersUcsProfileCp1250(void) {
     return CP1250_PROFILE;
 }
 
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_1(void) {
+    return singleByteProfile(SingleByte::Iso8859_1);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_2(void) {
+    return singleByteProfile(SingleByte::Iso8859_2);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_4(void) {
+    return singleByteProfile(SingleByte::Iso8859_4);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_5(void) {
+    return singleByteProfile(SingleByte::Iso8859_5);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_9(void) {
+    return singleByteProfile(SingleByte::Iso8859_9);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_10(void) {
+    return singleByteProfile(SingleByte::Iso8859_10);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_13(void) {
+    return singleByteProfile(SingleByte::Iso8859_13);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_14(void) {
+    return singleByteProfile(SingleByte::Iso8859_14);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_15(void) {
+    return singleByteProfile(SingleByte::Iso8859_15);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_16(void) {
+    return singleByteProfile(SingleByte::Iso8859_16);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp437(void) {
+    return singleByteProfile(SingleByte::Cp437);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp737(void) {
+    return singleByteProfile(SingleByte::Cp737);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp775(void) {
+    return singleByteProfile(SingleByte::Cp775);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp850(void) {
+    return singleByteProfile(SingleByte::Cp850);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp852(void) {
+    return singleByteProfile(SingleByte::Cp852);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp855(void) {
+    return singleByteProfile(SingleByte::Cp855);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp860(void) {
+    return singleByteProfile(SingleByte::Cp860);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp861(void) {
+    return singleByteProfile(SingleByte::Cp861);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp862(void) {
+    return singleByteProfile(SingleByte::Cp862);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp863(void) {
+    return singleByteProfile(SingleByte::Cp863);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp865(void) {
+    return singleByteProfile(SingleByte::Cp865);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp866(void) {
+    return singleByteProfile(SingleByte::Cp866);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8R(void) {
+    return singleByteProfile(SingleByte::Koi8R);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8U(void) {
+    return singleByteProfile(SingleByte::Koi8U);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1254(void) {
+    return singleByteProfile(SingleByte::Cp1254);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1256(void) {
+    return singleByteProfile(SingleByte::Cp1256);
+}
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1258(void) {
+    return singleByteProfile(SingleByte::Cp1258);
+}
+
 void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void* sheet) {
     if (!sheet) return nullptr;
     std::memcpy(sheet, SJIS_TAG, sizeof(SJIS_TAG));
     return sheet;
 }
 
+void* APS5_VABI sceCesUcsProfileInitSJis1997X0208(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, SJIS_X0208_TAG, sizeof(SJIS_X0208_TAG));
+    return sheet;
+}
+
 int APS5_VABI sceCesMbcsUcsContextInit(void* context, const void* profile) {
     if (!context) return CES_ERROR_INVALID_PARAMETER;
     std::memcpy(context, &profile, sizeof(profile));
     return 0;
 }
 
+int APS5_VABI sceCesMbcsUcsContextInitCopy(void* context, const void* source) {
+    if (!context || !source) return CES_ERROR_INVALID_PARAMETER;
+    const void* profile = contextProfile(source);
+    std::memcpy(context, &profile, sizeof(profile));
+    return 0;
+}
+
 void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void* sheet) {
     if (!sheet) return nullptr;
     std::memcpy(sheet, EUC_JP_TAG, sizeof(EUC_JP_TAG));
     return sheet;
 }
 
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_JP_X0208_TAG, sizeof(EUC_JP_X0208_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_JP_X0208_SS2_TAG, sizeof(EUC_JP_X0208_SS2_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2Ss3(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_JP_X0208_SS3_TAG, sizeof(EUC_JP_X0208_SS3_TAG));
+    return sheet;
+}
+
 void* APS5_VABI sceCesUcsProfileInitEucKr(void* sheet) {
     if (!sheet) return nullptr;
     std::memcpy(sheet, EUC_KR_TAG, sizeof(EUC_KR_TAG));
@@ -623,7 +1282,7 @@ int APS5_VABI sceCesSbcToUtf8(const uint8_t* profile, uint8_t sbc, uint8_t* utf8
     if (!isSbc(profile)) return CES_ERROR_INVALID_PARAMETER;
     if (!utf8) return CES_ERROR_INVALID_DST_BUFFER;
 
-    uint8_t encoded[3];
+    uint8_t encoded[4];
     const uint32_t length = encodeUtf8(sbcToUnicode(profile, sbc), encoded);
     if (utf8max < length) return CES_ERROR_DST_BUFFER_END;
     for (uint32_t i = 0; i < length; ++i) utf8[i] = encoded[i];
@@ -653,7 +1312,7 @@ int APS5_VABI sceCesEucJpToUtf8(const void* profile, const uint8_t* eucBuffer, u
     uint32_t consumed = 0;
     uint32_t code = 0;
     if (const int result = decodeMbcs(profile, eucBuffer, eucMax, consumed, code); result != 0) return result;
-    uint8_t encoded[3];
+    uint8_t encoded[4];
     const uint32_t produced = encodeUtf8(code, encoded);
     if (utf8Max < produced) return CES_ERROR_DST_BUFFER_END;
     std::memcpy(utf8Buffer, encoded, produced);
@@ -662,16 +1321,677 @@ int APS5_VABI sceCesEucJpToUtf8(const void* profile, const uint8_t* eucBuffer, u
     return 0;
 }
 
-int APS5_VABI sceCesEucKrToUtf8(void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+int APS5_VABI sceCesEucKrToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
     return mbcsToUtf8(isEucKr(profile), profile, eucBuffer, eucMax, eucLength, utf8Buffer, utf8Max, utf8Length);
 }
 
-int APS5_VABI sceCesBig5ToUtf8(void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Length, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+int APS5_VABI sceCesBig5ToUtf8(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Length, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
     return mbcsToUtf8(isBig5(profile), profile, big5Buffer, big5Max, big5Length, utf8Buffer, utf8Max, utf8Length);
 }
 
-int APS5_VABI sceCesUhcToUtf8(void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+int APS5_VABI sceCesUhcToUtf8(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
     return mbcsToUtf8(isUhc(profile), profile, uhcBuffer, uhcMax, uhcLength, utf8Buffer, utf8Max, utf8Length);
 }
 
+int APS5_VABI sceCesSJisToUcs2(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* ucs2) {
+    return profiledToUcs2(isSjis, profile, sjisBuffer, sjisMax, sjisSize, ucs2);
+}
+
+int APS5_VABI sceCesSJisToUtf8(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+    return profiledToUtf8(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf8Buffer, utf8Max, utf8Length);
+}
+
+int APS5_VABI sceCesSJisToUtf16(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesSJisToUtf16be(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesSJisToUtf16le(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesSJisToUtf32(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf32);
+}
+
+int APS5_VABI sceCesSJisToUtf32be(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf32);
+}
+
+int APS5_VABI sceCesSJisToUtf32le(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isSjis, profile, sjisBuffer, sjisMax, sjisSize, utf32);
+}
+
+int APS5_VABI sceCesEucJpToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isEucJp, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucJpToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isEucJp, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucJpToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isEucJp, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucJpToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isEucJp, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucJpToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isEucJp, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucJpToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isEucJp, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesUcs2ToSJis(uint16_t ucs2, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return scalarToProfiled(isSjis, ucs2, profile, sjisBuffer, sjisMax, sjisSize);
+}
+
+int APS5_VABI sceCesUtf8ToSJis(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return bufferToProfiled(isSjis, utf8Buffer, utf8Max, utf8Length, profile, sjisBuffer, sjisMax, sjisSize, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return bufferToProfiled(isSjis, utf16Buffer, utf16Max, utf16Length, profile, sjisBuffer, sjisMax, sjisSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return bufferToProfiled(isSjis, utf16Buffer, utf16Max, utf16Length, profile, sjisBuffer, sjisMax, sjisSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return bufferToProfiled(isSjis, utf16Buffer, utf16Max, utf16Length, profile, sjisBuffer, sjisMax, sjisSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToSJis(uint32_t utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return scalarToProfiled(isSjis, utf32, profile, sjisBuffer, sjisMax, sjisSize);
+}
+
+int APS5_VABI sceCesUtf32beToSJis(const uint32_t* utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return utf32ToProfiled<true>(isSjis, utf32, profile, sjisBuffer, sjisMax, sjisSize);
+}
+
+int APS5_VABI sceCesUtf32leToSJis(const uint32_t* utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    return utf32ToProfiled<false>(isSjis, utf32, profile, sjisBuffer, sjisMax, sjisSize);
+}
+
+int APS5_VABI sceCesUcs2ToEucJp(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucJp, ucs2, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf8ToEucJp(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucJp, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucJp, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucJp, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucJp, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToEucJp(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucJp, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32beToEucJp(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<true>(isEucJp, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32leToEucJp(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<false>(isEucJp, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesSJisCodeToJisX0208(uint16_t sjisCode, uint8_t* ku, uint8_t* ten) {
+    if (!ku || !ten) return CES_ERROR_INVALID_DST_BUFFER;
+    int row = 0;
+    int cell = 0;
+    if (!sjisToJis(static_cast<uint8_t>(sjisCode >> 8), static_cast<uint8_t>(sjisCode), row, cell) || row > 94) return CES_ERROR_INVALID_ENCODE;
+    *ku = static_cast<uint8_t>(row);
+    *ten = static_cast<uint8_t>(cell);
+    return 0;
+}
+
+int APS5_VABI sceCesJisX0208ToSJisCode(uint8_t ku, uint8_t ten, uint16_t* sjisCode) {
+    if (!sjisCode) return CES_ERROR_INVALID_DST_BUFFER;
+    if (ku < 1 || ku > 94 || ten < 1 || ten > 94) return CES_ERROR_INVALID_ENCODE;
+    uint8_t lead = 0;
+    uint8_t trail = 0;
+    jisToSjis(ku, ten, lead, trail);
+    *sjisCode = static_cast<uint16_t>(lead << 8 | trail);
+    return 0;
+}
+
+int APS5_VABI sceCesSJisCodeToJisX0213(uint16_t sjisCode, uint8_t* men, uint8_t* ku, uint8_t* ten) {
+    if (!men || !ku || !ten) return CES_ERROR_INVALID_DST_BUFFER;
+    int row = 0;
+    int cell = 0;
+    if (!sjisToJis(static_cast<uint8_t>(sjisCode >> 8), static_cast<uint8_t>(sjisCode), row, cell)) return CES_ERROR_INVALID_ENCODE;
+    *men = row <= 94 ? 1 : 2;
+    *ku = row <= 94 ? static_cast<uint8_t>(row) : JIS_X0213_PLANE2_ROWS[row - 95];
+    *ten = static_cast<uint8_t>(cell);
+    return 0;
+}
+
+int APS5_VABI sceCesJisX0213ToSJisCode(uint8_t men, uint8_t ku, uint8_t ten, uint16_t* sjisCode) {
+    if (!sjisCode) return CES_ERROR_INVALID_DST_BUFFER;
+    if (men < 1 || men > 2 || ku < 1 || ku > 94 || ten < 1 || ten > 94) return CES_ERROR_INVALID_ENCODE;
+    int row = ku;
+    if (men == 2) {
+        const auto* found = std::find(std::begin(JIS_X0213_PLANE2_ROWS), std::end(JIS_X0213_PLANE2_ROWS), ku);
+        if (found == std::end(JIS_X0213_PLANE2_ROWS)) return CES_ERROR_INVALID_ENCODE;
+        row = 95 + static_cast<int>(found - std::begin(JIS_X0213_PLANE2_ROWS));
+    }
+    uint8_t lead = 0;
+    uint8_t trail = 0;
+    jisToSjis(row, ten, lead, trail);
+    *sjisCode = static_cast<uint16_t>(lead << 8 | trail);
+    return 0;
+}
+
+int APS5_VABI sceCesSJisGetCode(const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* sjisCode) {
+    if (!sjisBuffer) return CES_ERROR_INVALID_SRC_BUFFER;
+    if (sjisMax == 0) return CES_ERROR_SRC_BUFFER_END;
+    if (!sjisCode) return CES_ERROR_INVALID_DST_BUFFER;
+    const uint8_t lead = sjisBuffer[0];
+    if (isSjisSingle(lead)) {
+        *sjisCode = lead;
+        if (sjisSize) *sjisSize = 1;
+        return 0;
+    }
+    if (!((lead >= 0x81 && lead <= 0x9F) || (lead >= 0xE0 && lead <= 0xFC))) return CES_ERROR_INVALID_ENCODE;
+    if (sjisMax < 2) return CES_ERROR_SRC_BUFFER_END;
+    int row = 0;
+    int cell = 0;
+    if (!sjisToJis(lead, sjisBuffer[1], row, cell)) return CES_ERROR_INVALID_ENCODE;
+    *sjisCode = static_cast<uint16_t>(lead << 8 | sjisBuffer[1]);
+    if (sjisSize) *sjisSize = 2;
+    return 0;
+}
+
+int APS5_VABI sceCesSJisPutCode(uint16_t sjisCode, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize) {
+    if (!sjisBuffer) return CES_ERROR_INVALID_DST_BUFFER;
+    const uint8_t lead = static_cast<uint8_t>(sjisCode >> 8);
+    const uint8_t trail = static_cast<uint8_t>(sjisCode);
+    int row = 0;
+    int cell = 0;
+    const uint32_t size = lead == 0 ? 1 : 2;
+    if (size == 1 ? !isSjisSingle(trail) : !sjisToJis(lead, trail, row, cell)) return CES_ERROR_INVALID_ENCODE;
+    if (sjisMax < size) return CES_ERROR_DST_BUFFER_END;
+    if (size == 2) sjisBuffer[0] = lead;
+    sjisBuffer[size - 1] = trail;
+    if (sjisSize) *sjisSize = size;
+    return 0;
+}
+
+int APS5_VABI sceCesMbcToUcs2(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* ucs2) {
+    return profiledToUcs2(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, ucs2);
+}
+
+int APS5_VABI sceCesMbcToUtf8(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Len) {
+    return profiledToUtf8(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf8Buffer, utf8Max, utf8Len);
+}
+
+int APS5_VABI sceCesMbcToUtf16(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf16Buffer, utf16Max, utf16Len);
+}
+
+int APS5_VABI sceCesMbcToUtf16be(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len) {
+    return profiledToUtf16<true>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf16Buffer, utf16Max, utf16Len);
+}
+
+int APS5_VABI sceCesMbcToUtf16le(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len) {
+    return profiledToUtf16<false>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf16Buffer, utf16Max, utf16Len);
+}
+
+int APS5_VABI sceCesMbcToUtf32(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf32);
+}
+
+int APS5_VABI sceCesMbcToUtf32be(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32) {
+    return profiledToUtf32<true>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf32);
+}
+
+int APS5_VABI sceCesMbcToUtf32le(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32) {
+    return profiledToUtf32<false>(isMbcs, profile, mbcBuffer, mbcMax, mbcLen, utf32);
+}
+
+int APS5_VABI sceCesSbcToUcs2(const uint8_t* profile, uint8_t sbc, uint16_t* ucs2) {
+    uint32_t code = 0;
+    if (const int result = sbcToUnit(profile, sbc, ucs2, code); result != 0) return result;
+    *ucs2 = static_cast<uint16_t>(code);
+    return 0;
+}
+
+int APS5_VABI sceCesSbcToUtf16(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
+    return sbcToUtf16<NATIVE_BIG_ENDIAN>(profile, sbc, utf16, utf16max, utf16Len);
+}
+
+int APS5_VABI sceCesSbcToUtf16be(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
+    return sbcToUtf16<true>(profile, sbc, utf16, utf16max, utf16Len);
+}
+
+int APS5_VABI sceCesSbcToUtf16le(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
+    return sbcToUtf16<false>(profile, sbc, utf16, utf16max, utf16Len);
+}
+
+int APS5_VABI sceCesSbcToUtf32(const uint8_t* profile, uint8_t sbc, uint32_t* utf32) {
+    return sbcToUtf32<NATIVE_BIG_ENDIAN>(profile, sbc, utf32);
+}
+
+int APS5_VABI sceCesSbcToUtf32be(const uint8_t* profile, uint8_t sbc, uint32_t* utf32) {
+    return sbcToUtf32<true>(profile, sbc, utf32);
+}
+
+int APS5_VABI sceCesSbcToUtf32le(const uint8_t* profile, uint8_t sbc, uint32_t* utf32) {
+    return sbcToUtf32<false>(profile, sbc, utf32);
+}
+
+int APS5_VABI sceCesUcs2ToSbc(uint16_t ucs2, const uint8_t* profile, uint8_t* sbc) {
+    return scalarToSbc(ucs2, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf16ToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc) {
+    return utf16ToSbc<NATIVE_BIG_ENDIAN>(utf16, utf16max, utf16Len, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf16beToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc) {
+    return utf16ToSbc<true>(utf16, utf16max, utf16Len, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf16leToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc) {
+    return utf16ToSbc<false>(utf16, utf16max, utf16Len, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf32ToSbc(uint32_t utf32, const uint8_t* profile, uint8_t* sbc) {
+    return scalarToSbc(utf32, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf32beToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc) {
+    return utf32ToSbc<true>(utf32, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf32leToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc) {
+    return utf32ToSbc<false>(utf32, profile, sbc);
+}
+
+int APS5_VABI sceCesUtf16StrToMbcsStr(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen) {
+    if (!mbcs) return CES_ERROR_INVALID_DST_BUFFER;
+    return toMbcs(context, utf16, utf16max, utf16Len, mbcs, mbcsMax, mbcsLen, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16StrGetMbcsLen(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint32_t* mbcsLen) {
+    return toMbcs(context, utf16, utf16max, utf16Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesMbcsStrToUtf16Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len) {
+    if (!utf16) return CES_ERROR_INVALID_DST_BUFFER;
+    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, utf16, utf16max, utf16Len, encodeUtf16);
+}
+
+int APS5_VABI sceCesMbcsStrGetUtf16Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf16Len) {
+    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, static_cast<uint16_t*>(nullptr), 0, utf16Len, encodeUtf16);
+}
+
+int APS5_VABI sceCesUtf32StrToMbcsStr(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen) {
+    if (!mbcs) return CES_ERROR_INVALID_DST_BUFFER;
+    return toMbcs(context, utf32, utf32max, utf32Len, mbcs, mbcsMax, mbcsLen, decodeUtf32);
+}
+
+int APS5_VABI sceCesUtf32StrGetMbcsLen(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint32_t* mbcsLen) {
+    return toMbcs(context, utf32, utf32max, utf32Len, static_cast<uint8_t*>(nullptr), 0, mbcsLen, decodeUtf32);
+}
+
+int APS5_VABI sceCesMbcsStrToUtf32Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len) {
+    if (!utf32) return CES_ERROR_INVALID_DST_BUFFER;
+    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, utf32, utf32max, utf32Len, encodeUtf32);
+}
+
+int APS5_VABI sceCesMbcsStrGetUtf32Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32Len) {
+    return fromMbcs(context, mbcs, mbcsMax, mbcsLen, static_cast<uint32_t*>(nullptr), 0, utf32Len, encodeUtf32);
+}
+
+void* APS5_VABI sceCesUcsProfileInitEucCnGb2312(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, EUC_CN_TAG, sizeof(EUC_CN_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitGbkCp936(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, GBK_TAG, sizeof(GBK_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitGb18030_2000(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, GB18030_2000_TAG, sizeof(GB18030_2000_TAG));
+    return sheet;
+}
+
+void* APS5_VABI sceCesUcsProfileInitGb18030_2005(void* sheet) {
+    if (!sheet) return nullptr;
+    std::memcpy(sheet, GB18030_2005_TAG, sizeof(GB18030_2005_TAG));
+    return sheet;
+}
+
+int APS5_VABI sceCesEucCnToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2) {
+    return profiledToUcs2(isEucCn, profile, eucBuffer, eucMax, eucSize, ucs2);
+}
+
+int APS5_VABI sceCesEucCnToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+    return profiledToUtf8(isEucCn, profile, eucBuffer, eucMax, eucSize, utf8Buffer, utf8Max, utf8Length);
+}
+
+int APS5_VABI sceCesEucCnToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isEucCn, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucCnToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isEucCn, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucCnToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isEucCn, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucCnToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isEucCn, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucCnToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isEucCn, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucCnToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isEucCn, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesUcs2ToEucCn(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucCn, ucs2, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf8ToEucCn(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucCn, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucCn, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucCn, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucCn, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToEucCn(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucCn, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32beToEucCn(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<true>(isEucCn, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32leToEucCn(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<false>(isEucCn, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesGbToUcs2(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* ucs2) {
+    return profiledToUcs2(isGb, profile, gbBuffer, gbMax, gbSize, ucs2);
+}
+
+int APS5_VABI sceCesGbToUtf8(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length) {
+    return profiledToUtf8(isGb, profile, gbBuffer, gbMax, gbSize, utf8Buffer, utf8Max, utf8Length);
+}
+
+int APS5_VABI sceCesGbToUtf16(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isGb, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesGbToUtf16be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isGb, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesGbToUtf16le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isGb, profile, gbBuffer, gbMax, gbSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesGbToUtf32(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isGb, profile, gbBuffer, gbMax, gbSize, utf32);
+}
+
+int APS5_VABI sceCesGbToUtf32be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isGb, profile, gbBuffer, gbMax, gbSize, utf32);
+}
+
+int APS5_VABI sceCesGbToUtf32le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isGb, profile, gbBuffer, gbMax, gbSize, utf32);
+}
+
+int APS5_VABI sceCesUcs2ToGb(uint16_t ucs2, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return scalarToProfiled(isGb, ucs2, profile, gbBuffer, gbMax, gbSize);
+}
+
+int APS5_VABI sceCesUtf8ToGb(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return bufferToProfiled(isGb, utf8Buffer, utf8Max, utf8Length, profile, gbBuffer, gbMax, gbSize, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return bufferToProfiled(isGb, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return bufferToProfiled(isGb, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return bufferToProfiled(isGb, utf16Buffer, utf16Max, utf16Length, profile, gbBuffer, gbMax, gbSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToGb(uint32_t utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return scalarToProfiled(isGb, utf32, profile, gbBuffer, gbMax, gbSize);
+}
+
+int APS5_VABI sceCesUtf32beToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return utf32ToProfiled<true>(isGb, utf32, profile, gbBuffer, gbMax, gbSize);
+}
+
+int APS5_VABI sceCesUtf32leToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize) {
+    return utf32ToProfiled<false>(isGb, utf32, profile, gbBuffer, gbMax, gbSize);
+}
+
+int APS5_VABI sceCesEucKrToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2) {
+    return profiledToUcs2(isEucKr, profile, eucBuffer, eucMax, eucSize, ucs2);
+}
+
+int APS5_VABI sceCesEucKrToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucKrToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucKrToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesEucKrToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucKrToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesEucKrToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isEucKr, profile, eucBuffer, eucMax, eucSize, utf32);
+}
+
+int APS5_VABI sceCesUhcToUcs2(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* ucs2) {
+    return profiledToUcs2(isUhc, profile, uhcBuffer, uhcMax, uhcSize, ucs2);
+}
+
+int APS5_VABI sceCesUhcToUtf16(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesUhcToUtf16be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesUhcToUtf16le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesUhcToUtf32(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf32);
+}
+
+int APS5_VABI sceCesUhcToUtf32be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32) {
+    return profiledToUtf32<true>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf32);
+}
+
+int APS5_VABI sceCesUhcToUtf32le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32) {
+    return profiledToUtf32<false>(isUhc, profile, uhcBuffer, uhcMax, uhcSize, utf32);
+}
+
+int APS5_VABI sceCesBig5ToUcs2(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* ucs2) {
+    return profiledToUcs2(isBig5, profile, big5Buffer, big5Max, big5Size, ucs2);
+}
+
+int APS5_VABI sceCesBig5ToUtf16(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<NATIVE_BIG_ENDIAN>(isBig5, profile, big5Buffer, big5Max, big5Size, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesBig5ToUtf16be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<true>(isBig5, profile, big5Buffer, big5Max, big5Size, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesBig5ToUtf16le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length) {
+    return profiledToUtf16<false>(isBig5, profile, big5Buffer, big5Max, big5Size, utf16Buffer, utf16Max, utf16Length);
+}
+
+int APS5_VABI sceCesBig5ToUtf32(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32) {
+    return profiledToUtf32<NATIVE_BIG_ENDIAN>(isBig5, profile, big5Buffer, big5Max, big5Size, utf32);
+}
+
+int APS5_VABI sceCesBig5ToUtf32be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32) {
+    return profiledToUtf32<true>(isBig5, profile, big5Buffer, big5Max, big5Size, utf32);
+}
+
+int APS5_VABI sceCesBig5ToUtf32le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32) {
+    return profiledToUtf32<false>(isBig5, profile, big5Buffer, big5Max, big5Size, utf32);
+}
+
+int APS5_VABI sceCesUcs2ToEucKr(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucKr, ucs2, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf8ToEucKr(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf8Buffer, utf8Max, utf8Length, profile, eucBuffer, eucMax, eucSize, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return bufferToProfiled(isEucKr, utf16Buffer, utf16Max, utf16Length, profile, eucBuffer, eucMax, eucSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToEucKr(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return scalarToProfiled(isEucKr, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32beToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<true>(isEucKr, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUtf32leToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize) {
+    return utf32ToProfiled<false>(isEucKr, utf32, profile, eucBuffer, eucMax, eucSize);
+}
+
+int APS5_VABI sceCesUcs2ToUhc(uint16_t ucs2, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return scalarToProfiled(isUhc, ucs2, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUtf8ToUhc(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf8Buffer, utf8Max, utf8Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf16Buffer, utf16Max, utf16Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf16Buffer, utf16Max, utf16Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return bufferToProfiled(isUhc, utf16Buffer, utf16Max, utf16Length, profile, uhcBuffer, uhcMax, uhcSize, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToUhc(uint32_t utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return scalarToProfiled(isUhc, utf32, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUtf32beToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return utf32ToProfiled<true>(isUhc, utf32, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUtf32leToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize) {
+    return utf32ToProfiled<false>(isUhc, utf32, profile, uhcBuffer, uhcMax, uhcSize);
+}
+
+int APS5_VABI sceCesUcs2ToBig5(uint16_t ucs2, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return scalarToProfiled(isBig5, ucs2, profile, big5Buffer, big5Max, big5Size);
+}
+
+int APS5_VABI sceCesUtf8ToBig5(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf8Buffer, utf8Max, utf8Length, profile, big5Buffer, big5Max, big5Size, decodeUtf8);
+}
+
+int APS5_VABI sceCesUtf16ToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf16Buffer, utf16Max, utf16Length, profile, big5Buffer, big5Max, big5Size, decodeUtf16<NATIVE_BIG_ENDIAN>);
+}
+
+int APS5_VABI sceCesUtf16beToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf16Buffer, utf16Max, utf16Length, profile, big5Buffer, big5Max, big5Size, decodeUtf16<true>);
+}
+
+int APS5_VABI sceCesUtf16leToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return bufferToProfiled(isBig5, utf16Buffer, utf16Max, utf16Length, profile, big5Buffer, big5Max, big5Size, decodeUtf16<false>);
+}
+
+int APS5_VABI sceCesUtf32ToBig5(uint32_t utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return scalarToProfiled(isBig5, utf32, profile, big5Buffer, big5Max, big5Size);
+}
+
+int APS5_VABI sceCesUtf32beToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return utf32ToProfiled<true>(isBig5, utf32, profile, big5Buffer, big5Max, big5Size);
+}
+
+int APS5_VABI sceCesUtf32leToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size) {
+    return utf32ToProfiled<false>(isBig5, utf32, profile, big5Buffer, big5Max, big5Size);
+}
+
 }
diff --git a/core/libs/prx/libSceCesCs/Gb18030.hpp b/core/libs/prx/libSceCesCs/Gb18030.hpp
new file mode 100644
index 0000000000..5f13d60813
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/Gb18030.hpp
@@ -0,0 +1,135 @@
+#pragma once
+
+#include <cstdint>
+
+namespace Gb18030 {
+
+inline constexpr uint32_t TWO_BYTE_2000[111][3] = {
+    {0x17C0, 0xE4C6, 0x60}, {0x187E, 0xE526, 0x60}, {0x18E8, 0xE766, 0x6}, {0x1920, 0x20AC, 0x1}, {0x1921, 0xE76D, 0x1}, {0x192C, 0xE76E, 0x2},
+    {0x193A, 0xE770, 0x2}, {0x193C, 0xE586, 0x60}, {0x19FA, 0xE5E6, 0x60}, {0x1AAD, 0xE772, 0xB}, {0x1AB8, 0xE646, 0x60}, {0x1B6E, 0xE77D, 0x8},
+    {0x1B76, 0xE6A6, 0x60}, {0x1BEE, 0xE785, 0x8}, {0x1C0E, 0xE78D, 0x7}, {0x1C21, 0xE794, 0x2}, {0x1C28, 0xE796, 0x1}, {0x1C2B, 0xE797, 0x9},
+    {0x1C34, 0xE706, 0x60}, {0x1CB5, 0xE7A0, 0xF}, {0x1CE5, 0xE7AF, 0xD}, {0x1D47, 0xE7BC, 0xB}, {0x1D6D, 0xE7C7, 0x1}, {0x1D70, 0x1F9, 0x1},
+    {0x1D72, 0xE7C9, 0x4}, {0x1D9B, 0xE7CD, 0x15}, {0x1DC8, 0xE7E2, 0x1}, {0x1DCB, 0xE7E3, 0x1}, {0x1DCD, 0xE7E4, 0x3}, {0x1DF8, 0x303E, 0x1},
+    {0x1DF9, 0x2FF0, 0xC}, {0x1E06, 0xE7F4, 0xD}, {0x1E5F, 0xE801, 0xF}, {0x1ECE, 0xE000, 0x5E}, {0x1F8C, 0xE05E, 0x5E}, {0x204A, 0xE0BC, 0x5E},
+    {0x2108, 0xE11A, 0x5E}, {0x21C6, 0xE178, 0x5E}, {0x2284, 0xE1D6, 0x5E}, {0x408D, 0xE810, 0x5}, {0x58B2, 0xE234, 0x5E}, {0x5970, 0xE292, 0x5E},
+    {0x5A2E, 0xE2F0, 0x5E}, {0x5AEC, 0xE34E, 0x5E}, {0x5BAA, 0xE3AC, 0x5E}, {0x5C68, 0xE40A, 0x5E}, {0x5CD6, 0x2E81, 0x1}, {0x5CD7, 0xE816, 0x3},
+    {0x5CDA, 0x2E84, 0x1}, {0x5CDB, 0x3473, 0x1}, {0x5CDC, 0x3447, 0x1}, {0x5CDD, 0x2E88, 0x1}, {0x5CDE, 0x2E8B, 0x1}, {0x5CDF, 0xE81E, 0x1},
+    {0x5CE0, 0x359E, 0x1}, {0x5CE1, 0x361A, 0x1}, {0x5CE2, 0x360E, 0x1}, {0x5CE3, 0x2E8C, 0x1}, {0x5CE4, 0x2E97, 0x1}, {0x5CE5, 0x396E, 0x1},
+    {0x5CE6, 0x3918, 0x1}, {0x5CE7, 0xE826, 0x1}, {0x5CE8, 0x39CF, 0x1}, {0x5CE9, 0x39DF, 0x1}, {0x5CEA, 0x3A73, 0x1}, {0x5CEB, 0x39D0, 0x1},
+    {0x5CEC, 0xE82B, 0x2}, {0x5CEE, 0x3B4E, 0x1}, {0x5CEF, 0x3C6E, 0x1}, {0x5CF0, 0x3CE0, 0x1}, {0x5CF1, 0x2EA7, 0x1}, {0x5CF2, 0xE831, 0x2},
+    {0x5CF4, 0x2EAA, 0x1}, {0x5CF5, 0x4056, 0x1}, {0x5CF6, 0x415F, 0x1}, {0x5CF7, 0x2EAE, 0x1}, {0x5CF8, 0x4337, 0x1}, {0x5CF9, 0x2EB3, 0x1},
+    {0x5CFA, 0x2EB6, 0x2}, {0x5CFC, 0xE83B, 0x1}, {0x5CFD, 0x43B1, 0x1}, {0x5CFE, 0x43AC, 0x1}, {0x5CFF, 0x2EBB, 0x1}, {0x5D00, 0x43DD, 0x1},
+    {0x5D01, 0x44D6, 0x1}, {0x5D02, 0x4661, 0x1}, {0x5D03, 0x464C, 0x1}, {0x5D04, 0xE843, 0x1}, {0x5D05, 0x4723, 0x1}, {0x5D06, 0x4729, 0x1},
+    {0x5D07, 0x477C, 0x1}, {0x5D08, 0x478D, 0x1}, {0x5D09, 0x2ECA, 0x1}, {0x5D0A, 0x4947, 0x1}, {0x5D0B, 0x497A, 0x1}, {0x5D0C, 0x497D, 0x1},
+    {0x5D0D, 0x4982, 0x2}, {0x5D0F, 0x4985, 0x2}, {0x5D11, 0x499F, 0x1}, {0x5D12, 0x499B, 0x1}, {0x5D13, 0x49B7, 0x1}, {0x5D14, 0x49B6, 0x1},
+    {0x5D15, 0xE854, 0x2}, {0x5D17, 0x4CA3, 0x1}, {0x5D18, 0x4C9F, 0x3}, {0x5D1B, 0x4C77, 0x1}, {0x5D1C, 0x4CA2, 0x1}, {0x5D1D, 0x4D13, 0x7},
+    {0x5D24, 0x4DAE, 0x1}, {0x5D25, 0xE864, 0x1}, {0x5D26, 0xE468, 0x5E},
+};
+
+inline constexpr uint32_t FOUR_BYTE_2000[207][3] = {
+    {0x0, 0x80, 0x24}, {0x24, 0xA5, 0x2}, {0x26, 0xA9, 0x7}, {0x2D, 0xB2, 0x5}, {0x32, 0xB8, 0x1F}, {0x51, 0xD8, 0x8},
+    {0x59, 0xE2, 0x6}, {0x5F, 0xEB, 0x1}, {0x60, 0xEE, 0x4}, {0x64, 0xF4, 0x3}, {0x67, 0xF8, 0x1}, {0x68, 0xFB, 0x1},
+    {0x69, 0xFD, 0x4}, {0x6D, 0x102, 0x11}, {0x7E, 0x114, 0x7}, {0x85, 0x11C, 0xF}, {0x94, 0x12C, 0x18}, {0xAC, 0x145, 0x3},
+    {0xAF, 0x149, 0x4}, {0xB3, 0x14E, 0x1D}, {0xD0, 0x16C, 0x62}, {0x132, 0x1CF, 0x1}, {0x133, 0x1D1, 0x1}, {0x134, 0x1D3, 0x1},
+    {0x135, 0x1D5, 0x1}, {0x136, 0x1D7, 0x1}, {0x137, 0x1D9, 0x1}, {0x138, 0x1DB, 0x1}, {0x139, 0x1DD, 0x1C}, {0x155, 0x1FA, 0x57},
+    {0x1AC, 0x252, 0xF}, {0x1BB, 0x262, 0x65}, {0x220, 0x2C8, 0x1}, {0x221, 0x2CC, 0xD}, {0x22E, 0x2DA, 0xB7}, {0x2E5, 0x3A2, 0x1},
+    {0x2E6, 0x3AA, 0x7}, {0x2ED, 0x3C2, 0x1}, {0x2EE, 0x3CA, 0x37}, {0x325, 0x402, 0xE}, {0x333, 0x450, 0x1}, {0x334, 0x452, 0x1BBE},
+    {0x1EF2, 0x2011, 0x2}, {0x1EF4, 0x2017, 0x1}, {0x1EF5, 0x201A, 0x2}, {0x1EF7, 0x201E, 0x7}, {0x1EFE, 0x2027, 0x9}, {0x1F07, 0x2031, 0x1},
+    {0x1F08, 0x2034, 0x1}, {0x1F09, 0x2036, 0x5}, {0x1F0E, 0x203C, 0x70}, {0x1F7E, 0x20AD, 0x56}, {0x1FD4, 0x2104, 0x1}, {0x1FD5, 0x2106, 0x3},
+    {0x1FD8, 0x210A, 0xC}, {0x1FE4, 0x2117, 0xA}, {0x1FEE, 0x2122, 0x3E}, {0x202C, 0x216C, 0x4}, {0x2030, 0x217A, 0x16}, {0x2046, 0x2194, 0x2},
+    {0x2048, 0x219A, 0x6E}, {0x20B6, 0x2209, 0x6}, {0x20BC, 0x2210, 0x1}, {0x20BD, 0x2212, 0x3}, {0x20C0, 0x2216, 0x4}, {0x20C4, 0x221B, 0x2},
+    {0x20C6, 0x2221, 0x2}, {0x20C8, 0x2224, 0x1}, {0x20C9, 0x2226, 0x1}, {0x20CA, 0x222C, 0x2}, {0x20CC, 0x222F, 0x5}, {0x20D1, 0x2238, 0x5},
+    {0x20D6, 0x223E, 0xA}, {0x20E0, 0x2249, 0x3}, {0x20E3, 0x224D, 0x5}, {0x20E8, 0x2253, 0xD}, {0x20F5, 0x2262, 0x2}, {0x20F7, 0x2268, 0x6},
+    {0x20FD, 0x2270, 0x25}, {0x2122, 0x2296, 0x3}, {0x2125, 0x229A, 0xB}, {0x2130, 0x22A6, 0x19}, {0x2149, 0x22C0, 0x52}, {0x219B, 0x2313, 0x14D},
+    {0x22E8, 0x246A, 0xA}, {0x22F2, 0x249C, 0x64}, {0x2356, 0x254C, 0x4}, {0x235A, 0x2574, 0xD}, {0x2367, 0x2590, 0x3}, {0x236A, 0x2596, 0xA},
+    {0x2374, 0x25A2, 0x10}, {0x2384, 0x25B4, 0x8}, {0x238C, 0x25BE, 0x8}, {0x2394, 0x25C8, 0x3}, {0x2397, 0x25CC, 0x2}, {0x2399, 0x25D0, 0x12},
+    {0x23AB, 0x25E6, 0x1F}, {0x23CA, 0x2607, 0x2}, {0x23CC, 0x260A, 0x36}, {0x2402, 0x2641, 0x1}, {0x2403, 0x2643, 0x83E}, {0x2C41, 0x2E82, 0x2},
+    {0x2C43, 0x2E85, 0x3}, {0x2C46, 0x2E89, 0x2}, {0x2C48, 0x2E8D, 0xA}, {0x2C52, 0x2E98, 0xF}, {0x2C61, 0x2EA8, 0x2}, {0x2C63, 0x2EAB, 0x3},
+    {0x2C66, 0x2EAF, 0x4}, {0x2C6A, 0x2EB4, 0x2}, {0x2C6C, 0x2EB8, 0x3}, {0x2C6F, 0x2EBC, 0xE}, {0x2C7D, 0x2ECB, 0x125}, {0x2DA2, 0x2FFC, 0x4},
+    {0x2DA6, 0x3004, 0x1}, {0x2DA7, 0x3018, 0x5}, {0x2DAC, 0x301F, 0x2}, {0x2DAE, 0x302A, 0x14}, {0x2DC2, 0x303F, 0x2}, {0x2DC4, 0x3094, 0x7},
+    {0x2DCB, 0x309F, 0x2}, {0x2DCD, 0x30F7, 0x5}, {0x2DD2, 0x30FF, 0x6}, {0x2DD8, 0x312A, 0xF6}, {0x2ECE, 0x322A, 0x7}, {0x2ED5, 0x3232, 0x71},
+    {0x2F46, 0x32A4, 0xEA}, {0x3030, 0x3390, 0xC}, {0x303C, 0x339F, 0x2}, {0x303E, 0x33A2, 0x22}, {0x3060, 0x33C5, 0x9}, {0x3069, 0x33CF, 0x2},
+    {0x306B, 0x33D3, 0x2}, {0x306D, 0x33D6, 0x71}, {0x30DE, 0x3448, 0x2B}, {0x3109, 0x3474, 0x12A}, {0x3233, 0x359F, 0x6F}, {0x32A2, 0x360F, 0xB},
+    {0x32AD, 0x361B, 0x2FD}, {0x35AA, 0x3919, 0x55}, {0x35FF, 0x396F, 0x60}, {0x365F, 0x39D1, 0xE}, {0x366D, 0x39E0, 0x93}, {0x3700, 0x3A74, 0xDA},
+    {0x37DA, 0x3B4F, 0x11F}, {0x38F9, 0x3C6F, 0x71}, {0x396A, 0x3CE1, 0x375}, {0x3CDF, 0x4057, 0x108}, {0x3DE7, 0x4160, 0x1D7}, {0x3FBE, 0x4338, 0x74},
+    {0x4032, 0x43AD, 0x4}, {0x4036, 0x43B2, 0x2B}, {0x4061, 0x43DE, 0xF8}, {0x4159, 0x44D7, 0x175}, {0x42CE, 0x464D, 0x14}, {0x42E2, 0x4662, 0xC1},
+    {0x43A3, 0x4724, 0x5}, {0x43A8, 0x472A, 0x52}, {0x43FA, 0x477D, 0x10}, {0x440A, 0x478E, 0x1B9}, {0x45C3, 0x4948, 0x32}, {0x45F5, 0x497B, 0x2},
+    {0x45F7, 0x497E, 0x4}, {0x45FB, 0x4984, 0x1}, {0x45FC, 0x4987, 0x14}, {0x4610, 0x499C, 0x3}, {0x4613, 0x49A0, 0x16}, {0x4629, 0x49B8, 0x2BF},
+    {0x48E8, 0x4C78, 0x27}, {0x490F, 0x4CA4, 0x6F}, {0x497E, 0x4D1A, 0x94}, {0x4A12, 0x4DAF, 0x51}, {0x4A63, 0x9FA6, 0x385A}, {0x82BD, 0xE76C, 0x1},
+    {0x82BE, 0xE7C8, 0x1}, {0x82BF, 0xE7E7, 0xD}, {0x82CC, 0xE815, 0x1}, {0x82CD, 0xE819, 0x5}, {0x82D2, 0xE81F, 0x7}, {0x82D9, 0xE827, 0x4},
+    {0x82DD, 0xE82D, 0x4}, {0x82E1, 0xE833, 0x8}, {0x82E9, 0xE83C, 0x7}, {0x82F0, 0xE844, 0x10}, {0x8300, 0xE856, 0xE}, {0x830E, 0xE865, 0x10C7},
+    {0x93D5, 0xF92D, 0x4C}, {0x9421, 0xF97A, 0x1B}, {0x943C, 0xF996, 0x51}, {0x948D, 0xF9E8, 0x9}, {0x9496, 0xF9F2, 0x1A}, {0x94B0, 0xFA10, 0x1},
+    {0x94B1, 0xFA12, 0x1}, {0x94B2, 0xFA15, 0x3}, {0x94B5, 0xFA19, 0x6}, {0x94BB, 0xFA22, 0x1}, {0x94BC, 0xFA25, 0x2}, {0x94BE, 0xFA2A, 0x406},
+    {0x98C4, 0xFE32, 0x1}, {0x98C5, 0xFE45, 0x4}, {0x98C9, 0xFE53, 0x1}, {0x98CA, 0xFE58, 0x1}, {0x98CB, 0xFE67, 0x1}, {0x98CC, 0xFE6C, 0x95},
+    {0x9961, 0xFF5F, 0x81}, {0x99E2, 0xFFE6, 0x1A}, {0x2E248, 0x10000, 0x100000},
+};
+
+inline constexpr uint32_t TWO_BYTE_2005[118][3] = {
+    {0x17C0, 0xE4C6, 0x60}, {0x187E, 0xE526, 0x60}, {0x18E8, 0xE766, 0x6}, {0x1920, 0x20AC, 0x1}, {0x1921, 0xE76D, 0x1}, {0x192C, 0xE76E, 0x2},
+    {0x193A, 0xE770, 0x2}, {0x193C, 0xE586, 0x60}, {0x19FA, 0xE5E6, 0x60}, {0x1AAD, 0xE772, 0xB}, {0x1AB8, 0xE646, 0x60}, {0x1B6E, 0xE77D, 0x8},
+    {0x1B76, 0xE6A6, 0x60}, {0x1BEE, 0xE785, 0x8}, {0x1C0E, 0xFE10, 0x1}, {0x1C0F, 0xFE12, 0x1}, {0x1C10, 0xFE11, 0x1}, {0x1C11, 0xFE13, 0x4},
+    {0x1C21, 0xFE17, 0x2}, {0x1C28, 0xFE19, 0x1}, {0x1C2B, 0xE797, 0x9}, {0x1C34, 0xE706, 0x60}, {0x1CB5, 0xE7A0, 0xF}, {0x1CE5, 0xE7AF, 0xD},
+    {0x1D47, 0xE7BC, 0xB}, {0x1D6D, 0x1E3F, 0x1}, {0x1D70, 0x1F9, 0x1}, {0x1D72, 0xE7C9, 0x4}, {0x1D9B, 0xE7CD, 0x15}, {0x1DC8, 0xE7E2, 0x1},
+    {0x1DCB, 0xE7E3, 0x1}, {0x1DCD, 0xE7E4, 0x3}, {0x1DF8, 0x303E, 0x1}, {0x1DF9, 0x2FF0, 0xC}, {0x1E06, 0xE7F4, 0xD}, {0x1E5F, 0xE801, 0xF},
+    {0x1ECE, 0xE000, 0x5E}, {0x1F8C, 0xE05E, 0x5E}, {0x204A, 0xE0BC, 0x5E}, {0x2108, 0xE11A, 0x5E}, {0x21C6, 0xE178, 0x5E}, {0x2284, 0xE1D6, 0x5E},
+    {0x408D, 0xE810, 0x5}, {0x58B2, 0xE234, 0x5E}, {0x5970, 0xE292, 0x5E}, {0x5A2E, 0xE2F0, 0x5E}, {0x5AEC, 0xE34E, 0x5E}, {0x5BAA, 0xE3AC, 0x5E},
+    {0x5C68, 0xE40A, 0x5E}, {0x5CD6, 0x2E81, 0x1}, {0x5CD7, 0x20087, 0x1}, {0x5CD8, 0x20089, 0x1}, {0x5CD9, 0x200CC, 0x1}, {0x5CDA, 0x2E84, 0x1},
+    {0x5CDB, 0x3473, 0x1}, {0x5CDC, 0x3447, 0x1}, {0x5CDD, 0x2E88, 0x1}, {0x5CDE, 0x2E8B, 0x1}, {0x5CDF, 0x9FB4, 0x1}, {0x5CE0, 0x359E, 0x1},
+    {0x5CE1, 0x361A, 0x1}, {0x5CE2, 0x360E, 0x1}, {0x5CE3, 0x2E8C, 0x1}, {0x5CE4, 0x2E97, 0x1}, {0x5CE5, 0x396E, 0x1}, {0x5CE6, 0x3918, 0x1},
+    {0x5CE7, 0x9FB5, 0x1}, {0x5CE8, 0x39CF, 0x1}, {0x5CE9, 0x39DF, 0x1}, {0x5CEA, 0x3A73, 0x1}, {0x5CEB, 0x39D0, 0x1}, {0x5CEC, 0x9FB6, 0x2},
+    {0x5CEE, 0x3B4E, 0x1}, {0x5CEF, 0x3C6E, 0x1}, {0x5CF0, 0x3CE0, 0x1}, {0x5CF1, 0x2EA7, 0x1}, {0x5CF2, 0x215D7, 0x1}, {0x5CF3, 0x9FB8, 0x1},
+    {0x5CF4, 0x2EAA, 0x1}, {0x5CF5, 0x4056, 0x1}, {0x5CF6, 0x415F, 0x1}, {0x5CF7, 0x2EAE, 0x1}, {0x5CF8, 0x4337, 0x1}, {0x5CF9, 0x2EB3, 0x1},
+    {0x5CFA, 0x2EB6, 0x2}, {0x5CFC, 0x2298F, 0x1}, {0x5CFD, 0x43B1, 0x1}, {0x5CFE, 0x43AC, 0x1}, {0x5CFF, 0x2EBB, 0x1}, {0x5D00, 0x43DD, 0x1},
+    {0x5D01, 0x44D6, 0x1}, {0x5D02, 0x4661, 0x1}, {0x5D03, 0x464C, 0x1}, {0x5D04, 0x9FB9, 0x1}, {0x5D05, 0x4723, 0x1}, {0x5D06, 0x4729, 0x1},
+    {0x5D07, 0x477C, 0x1}, {0x5D08, 0x478D, 0x1}, {0x5D09, 0x2ECA, 0x1}, {0x5D0A, 0x4947, 0x1}, {0x5D0B, 0x497A, 0x1}, {0x5D0C, 0x497D, 0x1},
+    {0x5D0D, 0x4982, 0x2}, {0x5D0F, 0x4985, 0x2}, {0x5D11, 0x499F, 0x1}, {0x5D12, 0x499B, 0x1}, {0x5D13, 0x49B7, 0x1}, {0x5D14, 0x49B6, 0x1},
+    {0x5D15, 0x9FBA, 0x1}, {0x5D16, 0x241FE, 0x1}, {0x5D17, 0x4CA3, 0x1}, {0x5D18, 0x4C9F, 0x3}, {0x5D1B, 0x4C77, 0x1}, {0x5D1C, 0x4CA2, 0x1},
+    {0x5D1D, 0x4D13, 0x7}, {0x5D24, 0x4DAE, 0x1}, {0x5D25, 0x9FBB, 0x1}, {0x5D26, 0xE468, 0x5E},
+};
+
+inline constexpr uint32_t FOUR_BYTE_2005[209][3] = {
+    {0x0, 0x80, 0x24}, {0x24, 0xA5, 0x2}, {0x26, 0xA9, 0x7}, {0x2D, 0xB2, 0x5}, {0x32, 0xB8, 0x1F}, {0x51, 0xD8, 0x8},
+    {0x59, 0xE2, 0x6}, {0x5F, 0xEB, 0x1}, {0x60, 0xEE, 0x4}, {0x64, 0xF4, 0x3}, {0x67, 0xF8, 0x1}, {0x68, 0xFB, 0x1},
+    {0x69, 0xFD, 0x4}, {0x6D, 0x102, 0x11}, {0x7E, 0x114, 0x7}, {0x85, 0x11C, 0xF}, {0x94, 0x12C, 0x18}, {0xAC, 0x145, 0x3},
+    {0xAF, 0x149, 0x4}, {0xB3, 0x14E, 0x1D}, {0xD0, 0x16C, 0x62}, {0x132, 0x1CF, 0x1}, {0x133, 0x1D1, 0x1}, {0x134, 0x1D3, 0x1},
+    {0x135, 0x1D5, 0x1}, {0x136, 0x1D7, 0x1}, {0x137, 0x1D9, 0x1}, {0x138, 0x1DB, 0x1}, {0x139, 0x1DD, 0x1C}, {0x155, 0x1FA, 0x57},
+    {0x1AC, 0x252, 0xF}, {0x1BB, 0x262, 0x65}, {0x220, 0x2C8, 0x1}, {0x221, 0x2CC, 0xD}, {0x22E, 0x2DA, 0xB7}, {0x2E5, 0x3A2, 0x1},
+    {0x2E6, 0x3AA, 0x7}, {0x2ED, 0x3C2, 0x1}, {0x2EE, 0x3CA, 0x37}, {0x325, 0x402, 0xE}, {0x333, 0x450, 0x1}, {0x334, 0x452, 0x19ED},
+    {0x1D21, 0xE7C7, 0x1}, {0x1D22, 0x1E40, 0x1D0}, {0x1EF2, 0x2011, 0x2}, {0x1EF4, 0x2017, 0x1}, {0x1EF5, 0x201A, 0x2}, {0x1EF7, 0x201E, 0x7},
+    {0x1EFE, 0x2027, 0x9}, {0x1F07, 0x2031, 0x1}, {0x1F08, 0x2034, 0x1}, {0x1F09, 0x2036, 0x5}, {0x1F0E, 0x203C, 0x70}, {0x1F7E, 0x20AD, 0x56},
+    {0x1FD4, 0x2104, 0x1}, {0x1FD5, 0x2106, 0x3}, {0x1FD8, 0x210A, 0xC}, {0x1FE4, 0x2117, 0xA}, {0x1FEE, 0x2122, 0x3E}, {0x202C, 0x216C, 0x4},
+    {0x2030, 0x217A, 0x16}, {0x2046, 0x2194, 0x2}, {0x2048, 0x219A, 0x6E}, {0x20B6, 0x2209, 0x6}, {0x20BC, 0x2210, 0x1}, {0x20BD, 0x2212, 0x3},
+    {0x20C0, 0x2216, 0x4}, {0x20C4, 0x221B, 0x2}, {0x20C6, 0x2221, 0x2}, {0x20C8, 0x2224, 0x1}, {0x20C9, 0x2226, 0x1}, {0x20CA, 0x222C, 0x2},
+    {0x20CC, 0x222F, 0x5}, {0x20D1, 0x2238, 0x5}, {0x20D6, 0x223E, 0xA}, {0x20E0, 0x2249, 0x3}, {0x20E3, 0x224D, 0x5}, {0x20E8, 0x2253, 0xD},
+    {0x20F5, 0x2262, 0x2}, {0x20F7, 0x2268, 0x6}, {0x20FD, 0x2270, 0x25}, {0x2122, 0x2296, 0x3}, {0x2125, 0x229A, 0xB}, {0x2130, 0x22A6, 0x19},
+    {0x2149, 0x22C0, 0x52}, {0x219B, 0x2313, 0x14D}, {0x22E8, 0x246A, 0xA}, {0x22F2, 0x249C, 0x64}, {0x2356, 0x254C, 0x4}, {0x235A, 0x2574, 0xD},
+    {0x2367, 0x2590, 0x3}, {0x236A, 0x2596, 0xA}, {0x2374, 0x25A2, 0x10}, {0x2384, 0x25B4, 0x8}, {0x238C, 0x25BE, 0x8}, {0x2394, 0x25C8, 0x3},
+    {0x2397, 0x25CC, 0x2}, {0x2399, 0x25D0, 0x12}, {0x23AB, 0x25E6, 0x1F}, {0x23CA, 0x2607, 0x2}, {0x23CC, 0x260A, 0x36}, {0x2402, 0x2641, 0x1},
+    {0x2403, 0x2643, 0x83E}, {0x2C41, 0x2E82, 0x2}, {0x2C43, 0x2E85, 0x3}, {0x2C46, 0x2E89, 0x2}, {0x2C48, 0x2E8D, 0xA}, {0x2C52, 0x2E98, 0xF},
+    {0x2C61, 0x2EA8, 0x2}, {0x2C63, 0x2EAB, 0x3}, {0x2C66, 0x2EAF, 0x4}, {0x2C6A, 0x2EB4, 0x2}, {0x2C6C, 0x2EB8, 0x3}, {0x2C6F, 0x2EBC, 0xE},
+    {0x2C7D, 0x2ECB, 0x125}, {0x2DA2, 0x2FFC, 0x4}, {0x2DA6, 0x3004, 0x1}, {0x2DA7, 0x3018, 0x5}, {0x2DAC, 0x301F, 0x2}, {0x2DAE, 0x302A, 0x14},
+    {0x2DC2, 0x303F, 0x2}, {0x2DC4, 0x3094, 0x7}, {0x2DCB, 0x309F, 0x2}, {0x2DCD, 0x30F7, 0x5}, {0x2DD2, 0x30FF, 0x6}, {0x2DD8, 0x312A, 0xF6},
+    {0x2ECE, 0x322A, 0x7}, {0x2ED5, 0x3232, 0x71}, {0x2F46, 0x32A4, 0xEA}, {0x3030, 0x3390, 0xC}, {0x303C, 0x339F, 0x2}, {0x303E, 0x33A2, 0x22},
+    {0x3060, 0x33C5, 0x9}, {0x3069, 0x33CF, 0x2}, {0x306B, 0x33D3, 0x2}, {0x306D, 0x33D6, 0x71}, {0x30DE, 0x3448, 0x2B}, {0x3109, 0x3474, 0x12A},
+    {0x3233, 0x359F, 0x6F}, {0x32A2, 0x360F, 0xB}, {0x32AD, 0x361B, 0x2FD}, {0x35AA, 0x3919, 0x55}, {0x35FF, 0x396F, 0x60}, {0x365F, 0x39D1, 0xE},
+    {0x366D, 0x39E0, 0x93}, {0x3700, 0x3A74, 0xDA}, {0x37DA, 0x3B4F, 0x11F}, {0x38F9, 0x3C6F, 0x71}, {0x396A, 0x3CE1, 0x375}, {0x3CDF, 0x4057, 0x108},
+    {0x3DE7, 0x4160, 0x1D7}, {0x3FBE, 0x4338, 0x74}, {0x4032, 0x43AD, 0x4}, {0x4036, 0x43B2, 0x2B}, {0x4061, 0x43DE, 0xF8}, {0x4159, 0x44D7, 0x175},
+    {0x42CE, 0x464D, 0x14}, {0x42E2, 0x4662, 0xC1}, {0x43A3, 0x4724, 0x5}, {0x43A8, 0x472A, 0x52}, {0x43FA, 0x477D, 0x10}, {0x440A, 0x478E, 0x1B9},
+    {0x45C3, 0x4948, 0x32}, {0x45F5, 0x497B, 0x2}, {0x45F7, 0x497E, 0x4}, {0x45FB, 0x4984, 0x1}, {0x45FC, 0x4987, 0x14}, {0x4610, 0x499C, 0x3},
+    {0x4613, 0x49A0, 0x16}, {0x4629, 0x49B8, 0x2BF}, {0x48E8, 0x4C78, 0x27}, {0x490F, 0x4CA4, 0x6F}, {0x497E, 0x4D1A, 0x94}, {0x4A12, 0x4DAF, 0x51},
+    {0x4A63, 0x9FA6, 0x385A}, {0x82BD, 0xE76C, 0x1}, {0x82BE, 0xE7C8, 0x1}, {0x82BF, 0xE7E7, 0xD}, {0x82CC, 0xE815, 0x1}, {0x82CD, 0xE819, 0x5},
+    {0x82D2, 0xE81F, 0x7}, {0x82D9, 0xE827, 0x4}, {0x82DD, 0xE82D, 0x4}, {0x82E1, 0xE833, 0x8}, {0x82E9, 0xE83C, 0x7}, {0x82F0, 0xE844, 0x10},
+    {0x8300, 0xE856, 0xE}, {0x830E, 0xE865, 0x10C7}, {0x93D5, 0xF92D, 0x4C}, {0x9421, 0xF97A, 0x1B}, {0x943C, 0xF996, 0x51}, {0x948D, 0xF9E8, 0x9},
+    {0x9496, 0xF9F2, 0x1A}, {0x94B0, 0xFA10, 0x1}, {0x94B1, 0xFA12, 0x1}, {0x94B2, 0xFA15, 0x3}, {0x94B5, 0xFA19, 0x6}, {0x94BB, 0xFA22, 0x1},
+    {0x94BC, 0xFA25, 0x2}, {0x94BE, 0xFA2A, 0x406}, {0x98C4, 0xFE32, 0x1}, {0x98C5, 0xFE45, 0x4}, {0x98C9, 0xFE53, 0x1}, {0x98CA, 0xFE58, 0x1},
+    {0x98CB, 0xFE67, 0x1}, {0x98CC, 0xFE6C, 0x95}, {0x9961, 0xFF5F, 0x81}, {0x99E2, 0xFFE6, 0x1A}, {0x2E248, 0x10000, 0x100000},
+};
+
+inline constexpr uint32_t FALLBACK_2005[24][2] = {
+    {0xE78D, 0x1C0E}, {0xE78E, 0x1C0F}, {0xE78F, 0x1C10}, {0xE790, 0x1C11}, {0xE791, 0x1C12}, {0xE792, 0x1C13},
+    {0xE793, 0x1C14}, {0xE794, 0x1C21}, {0xE795, 0x1C22}, {0xE796, 0x1C28}, {0xE816, 0x5CD7}, {0xE817, 0x5CD8},
+    {0xE818, 0x5CD9}, {0xE81E, 0x5CDF}, {0xE826, 0x5CE7}, {0xE82B, 0x5CEC}, {0xE82C, 0x5CED}, {0xE831, 0x5CF2},
+    {0xE832, 0x5CF3}, {0xE83B, 0x5CFC}, {0xE843, 0x5D04}, {0xE854, 0x5D15}, {0xE855, 0x5D16}, {0xE864, 0x5D25},
+};
+
+}
diff --git a/core/libs/prx/libSceCesCs/PendingExports.cpp b/core/libs/prx/libSceCesCs/PendingExports.cpp
index 165fe278e8..849f73b092 100644
--- a/core/libs/prx/libSceCesCs/PendingExports.cpp
+++ b/core/libs/prx/libSceCesCs/PendingExports.cpp
@@ -1,202 +1,23 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-int APS5_VABI sceCesBig5ToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesBig5ToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucCnToUtf8(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesEucCnUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesEucJpToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucJpToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucJpToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucJpToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucJpToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucJpToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesEucJpUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesEucKrToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesEucKrToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesEucKrUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesGbToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesGbToUtf8(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesGbUcsProfileSet4ByteCharRange(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -272,86 +93,11 @@ int APS5_VABI sceCesJisGetLevel(void) {
     return 0;
 }
 
-int APS5_VABI sceCesJisX0208ToSJisCode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesJisX0213ToSJisCode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesJiscsToUcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesMbcToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcToUtf8(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcsStrGetUtf16Len(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcsStrGetUtf32Len(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcsStrToUtf16Str(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcsStrToUtf32Str(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesMbcsUcsContextInitCopy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesMbcsUcsSetMbcsReplacementCharCode(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -382,61 +128,16 @@ int APS5_VABI sceCesRefersUcsProfileCp1253(void) {
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileCp1254(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileCp1255(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileCp1256(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileCp1257(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileCp1258(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp437(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp737(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp775(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp850(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp852(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp855(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileCp857(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -447,41 +148,11 @@ int APS5_VABI sceCesRefersUcsProfileCp858(void) {
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileCp860(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp861(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp862(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp863(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileCp864(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileCp865(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileCp866(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileCp869(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -502,61 +173,16 @@ int APS5_VABI sceCesRefersUcsProfileGbT1988Tilde0x7e(void) {
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileIso8859_1(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileIso8859_10(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileIso8859_11(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileIso8859_13(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileIso8859_14(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileIso8859_15(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileIso8859_16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileIso8859_2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileIso8859_3(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileIso8859_4(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileIso8859_5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileIso8859_6(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -572,11 +198,6 @@ int APS5_VABI sceCesRefersUcsProfileIso8859_8(void) {
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileIso8859_9(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileJisX0201(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -602,16 +223,6 @@ int APS5_VABI sceCesRefersUcsProfileJisX0201Tilde0x7e(void) {
     return 0;
 }
 
-int APS5_VABI sceCesRefersUcsProfileKoi8R(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesRefersUcsProfileKoi8U(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesRefersUcsProfileKsX1003(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -622,106 +233,11 @@ int APS5_VABI sceCesRefersUcsProfileKsX1003Tilde0x7e(void) {
     return 0;
 }
 
-int APS5_VABI sceCesSJisCodeToJisX0208(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisCodeToJisX0213(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisGetCode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisPutCode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSJisToUtf8(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesSJisUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesSbcToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSbcToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSbcToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSbcToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSbcToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSbcToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesSbcToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcs2StrGetIso2022Len(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -732,91 +248,16 @@ int APS5_VABI sceCesUcs2StrToIso2022Str(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUcs2ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcs2ToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUcs2ToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcs2ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitEucCnGb2312(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcsProfileInitEucJis2004(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUcsProfileInitEucJpX0208(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2Ss3(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitGb18030_2000(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitGb18030_2005(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUcsProfileInitGbkCp936(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcsProfileInitIso2022JpCp50221(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -832,11 +273,6 @@ int APS5_VABI sceCesUcsProfileInitIso2022JpRfc1468(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUcsProfileInitSJis1997X0208(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUcsProfileInitSJis2004X0213(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -847,41 +283,6 @@ int APS5_VABI sceCesUcsToJiscs(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUhcToUcs2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf16(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf16be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf16le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf32be(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUhcToUtf32le(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUhcUcsProfileSetSbcs(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -892,311 +293,51 @@ int APS5_VABI sceCesUtf16StrGetIso2022Len(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUtf16StrGetMbcsLen(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf16StrToIso2022Str(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf16StrToMbcsStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf16ToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf16ToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf16beToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf16beToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16beToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf16leToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf16leToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf16leToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf32StrGetIso2022Len(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf32StrGetMbcsLen(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf32StrToIso2022Str(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf32StrToMbcsStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf32ToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf32ToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf32beToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf32beToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32beToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf32leToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf32leToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToSbc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf32leToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf8StrGetIso2022Len(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1207,44 +348,9 @@ int APS5_VABI sceCesUtf8StrToIso2022Str(void) {
     return 0;
 }
 
-int APS5_VABI sceCesUtf8ToBig5(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToEucCn(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToEucJp(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToEucKr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToGb(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceCesUtf8ToMbc(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCesUtf8ToSJis(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCesUtf8ToUhc(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libSceCesCs/SingleByte.hpp b/core/libs/prx/libSceCesCs/SingleByte.hpp
new file mode 100644
index 0000000000..ebe46104cd
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/SingleByte.hpp
@@ -0,0 +1,312 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+
+namespace SingleByte {
+
+enum Table : std::size_t {
+    Iso8859_1,
+    Iso8859_2,
+    Iso8859_4,
+    Iso8859_5,
+    Iso8859_9,
+    Iso8859_10,
+    Iso8859_13,
+    Iso8859_14,
+    Iso8859_15,
+    Iso8859_16,
+    Cp437,
+    Cp737,
+    Cp775,
+    Cp850,
+    Cp852,
+    Cp855,
+    Cp860,
+    Cp861,
+    Cp862,
+    Cp863,
+    Cp865,
+    Cp866,
+    Koi8R,
+    Koi8U,
+    Cp1254,
+    Cp1256,
+    Cp1258,
+    Count,
+};
+
+inline constexpr uint16_t HIGH[Count][128] = {
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x00A1, 0x00A2, 0x00A3, 0x00A4, 0x00A5, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x00AA, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00AF,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x00B9, 0x00BA, 0x00BB, 0x00BC, 0x00BD, 0x00BE, 0x00BF,
+        0x00C0, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x00CC, 0x00CD, 0x00CE, 0x00CF,
+        0x00D0, 0x00D1, 0x00D2, 0x00D3, 0x00D4, 0x00D5, 0x00D6, 0x00D7, 0x00D8, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x00DD, 0x00DE, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x00EC, 0x00ED, 0x00EE, 0x00EF,
+        0x00F0, 0x00F1, 0x00F2, 0x00F3, 0x00F4, 0x00F5, 0x00F6, 0x00F7, 0x00F8, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x00FD, 0x00FE, 0x00FF,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x0104, 0x02D8, 0x0141, 0x00A4, 0x013D, 0x015A, 0x00A7, 0x00A8, 0x0160, 0x015E, 0x0164, 0x0179, 0x00AD, 0x017D, 0x017B,
+        0x00B0, 0x0105, 0x02DB, 0x0142, 0x00B4, 0x013E, 0x015B, 0x02C7, 0x00B8, 0x0161, 0x015F, 0x0165, 0x017A, 0x02DD, 0x017E, 0x017C,
+        0x0154, 0x00C1, 0x00C2, 0x0102, 0x00C4, 0x0139, 0x0106, 0x00C7, 0x010C, 0x00C9, 0x0118, 0x00CB, 0x011A, 0x00CD, 0x00CE, 0x010E,
+        0x0110, 0x0143, 0x0147, 0x00D3, 0x00D4, 0x0150, 0x00D6, 0x00D7, 0x0158, 0x016E, 0x00DA, 0x0170, 0x00DC, 0x00DD, 0x0162, 0x00DF,
+        0x0155, 0x00E1, 0x00E2, 0x0103, 0x00E4, 0x013A, 0x0107, 0x00E7, 0x010D, 0x00E9, 0x0119, 0x00EB, 0x011B, 0x00ED, 0x00EE, 0x010F,
+        0x0111, 0x0144, 0x0148, 0x00F3, 0x00F4, 0x0151, 0x00F6, 0x00F7, 0x0159, 0x016F, 0x00FA, 0x0171, 0x00FC, 0x00FD, 0x0163, 0x02D9,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x0104, 0x0138, 0x0156, 0x00A4, 0x0128, 0x013B, 0x00A7, 0x00A8, 0x0160, 0x0112, 0x0122, 0x0166, 0x00AD, 0x017D, 0x00AF,
+        0x00B0, 0x0105, 0x02DB, 0x0157, 0x00B4, 0x0129, 0x013C, 0x02C7, 0x00B8, 0x0161, 0x0113, 0x0123, 0x0167, 0x014A, 0x017E, 0x014B,
+        0x0100, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x012E, 0x010C, 0x00C9, 0x0118, 0x00CB, 0x0116, 0x00CD, 0x00CE, 0x012A,
+        0x0110, 0x0145, 0x014C, 0x0136, 0x00D4, 0x00D5, 0x00D6, 0x00D7, 0x00D8, 0x0172, 0x00DA, 0x00DB, 0x00DC, 0x0168, 0x016A, 0x00DF,
+        0x0101, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x012F, 0x010D, 0x00E9, 0x0119, 0x00EB, 0x0117, 0x00ED, 0x00EE, 0x012B,
+        0x0111, 0x0146, 0x014D, 0x0137, 0x00F4, 0x00F5, 0x00F6, 0x00F7, 0x00F8, 0x0173, 0x00FA, 0x00FB, 0x00FC, 0x0169, 0x016B, 0x02D9,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0406, 0x0407, 0x0408, 0x0409, 0x040A, 0x040B, 0x040C, 0x00AD, 0x040E, 0x040F,
+        0x0410, 0x0411, 0x0412, 0x0413, 0x0414, 0x0415, 0x0416, 0x0417, 0x0418, 0x0419, 0x041A, 0x041B, 0x041C, 0x041D, 0x041E, 0x041F,
+        0x0420, 0x0421, 0x0422, 0x0423, 0x0424, 0x0425, 0x0426, 0x0427, 0x0428, 0x0429, 0x042A, 0x042B, 0x042C, 0x042D, 0x042E, 0x042F,
+        0x0430, 0x0431, 0x0432, 0x0433, 0x0434, 0x0435, 0x0436, 0x0437, 0x0438, 0x0439, 0x043A, 0x043B, 0x043C, 0x043D, 0x043E, 0x043F,
+        0x0440, 0x0441, 0x0442, 0x0443, 0x0444, 0x0445, 0x0446, 0x0447, 0x0448, 0x0449, 0x044A, 0x044B, 0x044C, 0x044D, 0x044E, 0x044F,
+        0x2116, 0x0451, 0x0452, 0x0453, 0x0454, 0x0455, 0x0456, 0x0457, 0x0458, 0x0459, 0x045A, 0x045B, 0x045C, 0x00A7, 0x045E, 0x045F,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x00A1, 0x00A2, 0x00A3, 0x00A4, 0x00A5, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x00AA, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00AF,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x00B9, 0x00BA, 0x00BB, 0x00BC, 0x00BD, 0x00BE, 0x00BF,
+        0x00C0, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x00CC, 0x00CD, 0x00CE, 0x00CF,
+        0x011E, 0x00D1, 0x00D2, 0x00D3, 0x00D4, 0x00D5, 0x00D6, 0x00D7, 0x00D8, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x0130, 0x015E, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x00EC, 0x00ED, 0x00EE, 0x00EF,
+        0x011F, 0x00F1, 0x00F2, 0x00F3, 0x00F4, 0x00F5, 0x00F6, 0x00F7, 0x00F8, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x0131, 0x015F, 0x00FF,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x0104, 0x0112, 0x0122, 0x012A, 0x0128, 0x0136, 0x00A7, 0x013B, 0x0110, 0x0160, 0x0166, 0x017D, 0x00AD, 0x016A, 0x014A,
+        0x00B0, 0x0105, 0x0113, 0x0123, 0x012B, 0x0129, 0x0137, 0x00B7, 0x013C, 0x0111, 0x0161, 0x0167, 0x017E, 0x2015, 0x016B, 0x014B,
+        0x0100, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x012E, 0x010C, 0x00C9, 0x0118, 0x00CB, 0x0116, 0x00CD, 0x00CE, 0x00CF,
+        0x00D0, 0x0145, 0x014C, 0x00D3, 0x00D4, 0x00D5, 0x00D6, 0x0168, 0x00D8, 0x0172, 0x00DA, 0x00DB, 0x00DC, 0x00DD, 0x00DE, 0x00DF,
+        0x0101, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x012F, 0x010D, 0x00E9, 0x0119, 0x00EB, 0x0117, 0x00ED, 0x00EE, 0x00EF,
+        0x00F0, 0x0146, 0x014D, 0x00F3, 0x00F4, 0x00F5, 0x00F6, 0x0169, 0x00F8, 0x0173, 0x00FA, 0x00FB, 0x00FC, 0x00FD, 0x00FE, 0x0138,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x201D, 0x00A2, 0x00A3, 0x00A4, 0x201E, 0x00A6, 0x00A7, 0x00D8, 0x00A9, 0x0156, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00C6,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x201C, 0x00B5, 0x00B6, 0x00B7, 0x00F8, 0x00B9, 0x0157, 0x00BB, 0x00BC, 0x00BD, 0x00BE, 0x00E6,
+        0x0104, 0x012E, 0x0100, 0x0106, 0x00C4, 0x00C5, 0x0118, 0x0112, 0x010C, 0x00C9, 0x0179, 0x0116, 0x0122, 0x0136, 0x012A, 0x013B,
+        0x0160, 0x0143, 0x0145, 0x00D3, 0x014C, 0x00D5, 0x00D6, 0x00D7, 0x0172, 0x0141, 0x015A, 0x016A, 0x00DC, 0x017B, 0x017D, 0x00DF,
+        0x0105, 0x012F, 0x0101, 0x0107, 0x00E4, 0x00E5, 0x0119, 0x0113, 0x010D, 0x00E9, 0x017A, 0x0117, 0x0123, 0x0137, 0x012B, 0x013C,
+        0x0161, 0x0144, 0x0146, 0x00F3, 0x014D, 0x00F5, 0x00F6, 0x00F7, 0x0173, 0x0142, 0x015B, 0x016B, 0x00FC, 0x017C, 0x017E, 0x2019,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x1E02, 0x1E03, 0x00A3, 0x010A, 0x010B, 0x1E0A, 0x00A7, 0x1E80, 0x00A9, 0x1E82, 0x1E0B, 0x1EF2, 0x00AD, 0x00AE, 0x0178,
+        0x1E1E, 0x1E1F, 0x0120, 0x0121, 0x1E40, 0x1E41, 0x00B6, 0x1E56, 0x1E81, 0x1E57, 0x1E83, 0x1E60, 0x1EF3, 0x1E84, 0x1E85, 0x1E61,
+        0x00C0, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x00CC, 0x00CD, 0x00CE, 0x00CF,
+        0x0174, 0x00D1, 0x00D2, 0x00D3, 0x00D4, 0x00D5, 0x00D6, 0x1E6A, 0x00D8, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x00DD, 0x0176, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x00EC, 0x00ED, 0x00EE, 0x00EF,
+        0x0175, 0x00F1, 0x00F2, 0x00F3, 0x00F4, 0x00F5, 0x00F6, 0x1E6B, 0x00F8, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x00FD, 0x0177, 0x00FF,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x00A1, 0x00A2, 0x00A3, 0x20AC, 0x00A5, 0x0160, 0x00A7, 0x0161, 0x00A9, 0x00AA, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00AF,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x017D, 0x00B5, 0x00B6, 0x00B7, 0x017E, 0x00B9, 0x00BA, 0x00BB, 0x0152, 0x0153, 0x0178, 0x00BF,
+        0x00C0, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x00CC, 0x00CD, 0x00CE, 0x00CF,
+        0x00D0, 0x00D1, 0x00D2, 0x00D3, 0x00D4, 0x00D5, 0x00D6, 0x00D7, 0x00D8, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x00DD, 0x00DE, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x00EC, 0x00ED, 0x00EE, 0x00EF,
+        0x00F0, 0x00F1, 0x00F2, 0x00F3, 0x00F4, 0x00F5, 0x00F6, 0x00F7, 0x00F8, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x00FD, 0x00FE, 0x00FF,
+    },
+    {
+        0x0080, 0x0081, 0x0082, 0x0083, 0x0084, 0x0085, 0x0086, 0x0087, 0x0088, 0x0089, 0x008A, 0x008B, 0x008C, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x0091, 0x0092, 0x0093, 0x0094, 0x0095, 0x0096, 0x0097, 0x0098, 0x0099, 0x009A, 0x009B, 0x009C, 0x009D, 0x009E, 0x009F,
+        0x00A0, 0x0104, 0x0105, 0x0141, 0x20AC, 0x201E, 0x0160, 0x00A7, 0x0161, 0x00A9, 0x0218, 0x00AB, 0x0179, 0x00AD, 0x017A, 0x017B,
+        0x00B0, 0x00B1, 0x010C, 0x0142, 0x017D, 0x201D, 0x00B6, 0x00B7, 0x017E, 0x010D, 0x0219, 0x00BB, 0x0152, 0x0153, 0x0178, 0x017C,
+        0x00C0, 0x00C1, 0x00C2, 0x0102, 0x00C4, 0x0106, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x00CC, 0x00CD, 0x00CE, 0x00CF,
+        0x0110, 0x0143, 0x00D2, 0x00D3, 0x00D4, 0x0150, 0x00D6, 0x015A, 0x0170, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x0118, 0x021A, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x0103, 0x00E4, 0x0107, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x00EC, 0x00ED, 0x00EE, 0x00EF,
+        0x0111, 0x0144, 0x00F2, 0x00F3, 0x00F4, 0x0151, 0x00F6, 0x015B, 0x0171, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x0119, 0x021B, 0x00FF,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x00E5, 0x00E7, 0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x00EC, 0x00C4, 0x00C5,
+        0x00C9, 0x00E6, 0x00C6, 0x00F4, 0x00F6, 0x00F2, 0x00FB, 0x00F9, 0x00FF, 0x00D6, 0x00DC, 0x00A2, 0x00A3, 0x00A5, 0x20A7, 0x0192,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, 0x00BF, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+        0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x0391, 0x0392, 0x0393, 0x0394, 0x0395, 0x0396, 0x0397, 0x0398, 0x0399, 0x039A, 0x039B, 0x039C, 0x039D, 0x039E, 0x039F, 0x03A0,
+        0x03A1, 0x03A3, 0x03A4, 0x03A5, 0x03A6, 0x03A7, 0x03A8, 0x03A9, 0x03B1, 0x03B2, 0x03B3, 0x03B4, 0x03B5, 0x03B6, 0x03B7, 0x03B8,
+        0x03B9, 0x03BA, 0x03BB, 0x03BC, 0x03BD, 0x03BE, 0x03BF, 0x03C0, 0x03C1, 0x03C3, 0x03C2, 0x03C4, 0x03C5, 0x03C6, 0x03C7, 0x03C8,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03C9, 0x03AC, 0x03AD, 0x03AE, 0x03CA, 0x03AF, 0x03CC, 0x03CD, 0x03CB, 0x03CE, 0x0386, 0x0388, 0x0389, 0x038A, 0x038C, 0x038E,
+        0x038F, 0x00B1, 0x2265, 0x2264, 0x03AA, 0x03AB, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x0106, 0x00FC, 0x00E9, 0x0101, 0x00E4, 0x0123, 0x00E5, 0x0107, 0x0142, 0x0113, 0x0156, 0x0157, 0x012B, 0x0179, 0x00C4, 0x00C5,
+        0x00C9, 0x00E6, 0x00C6, 0x014D, 0x00F6, 0x0122, 0x00A2, 0x015A, 0x015B, 0x00D6, 0x00DC, 0x00F8, 0x00A3, 0x00D8, 0x00D7, 0x00A4,
+        0x0100, 0x012A, 0x00F3, 0x017B, 0x017C, 0x017A, 0x201D, 0x00A6, 0x00A9, 0x00AE, 0x00AC, 0x00BD, 0x00BC, 0x0141, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x0104, 0x010C, 0x0118, 0x0116, 0x2563, 0x2551, 0x2557, 0x255D, 0x012E, 0x0160, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x0172, 0x016A, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x017D,
+        0x0105, 0x010D, 0x0119, 0x0117, 0x012F, 0x0161, 0x0173, 0x016B, 0x017E, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x00D3, 0x00DF, 0x014C, 0x0143, 0x00F5, 0x00D5, 0x00B5, 0x0144, 0x0136, 0x0137, 0x013B, 0x013C, 0x0146, 0x0112, 0x0145, 0x2019,
+        0x00AD, 0x00B1, 0x201C, 0x00BE, 0x00B6, 0x00A7, 0x00F7, 0x201E, 0x00B0, 0x2219, 0x00B7, 0x00B9, 0x00B3, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x00E5, 0x00E7, 0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x00EC, 0x00C4, 0x00C5,
+        0x00C9, 0x00E6, 0x00C6, 0x00F4, 0x00F6, 0x00F2, 0x00FB, 0x00F9, 0x00FF, 0x00D6, 0x00DC, 0x00F8, 0x00A3, 0x00D8, 0x00D7, 0x0192,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, 0x00BF, 0x00AE, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x00C1, 0x00C2, 0x00C0, 0x00A9, 0x2563, 0x2551, 0x2557, 0x255D, 0x00A2, 0x00A5, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x00E3, 0x00C3, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x00A4,
+        0x00F0, 0x00D0, 0x00CA, 0x00CB, 0x00C8, 0x0131, 0x00CD, 0x00CE, 0x00CF, 0x2518, 0x250C, 0x2588, 0x2584, 0x00A6, 0x00CC, 0x2580,
+        0x00D3, 0x00DF, 0x00D4, 0x00D2, 0x00F5, 0x00D5, 0x00B5, 0x00FE, 0x00DE, 0x00DA, 0x00DB, 0x00D9, 0x00FD, 0x00DD, 0x00AF, 0x00B4,
+        0x00AD, 0x00B1, 0x2017, 0x00BE, 0x00B6, 0x00A7, 0x00F7, 0x00B8, 0x00B0, 0x00A8, 0x00B7, 0x00B9, 0x00B3, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x016F, 0x0107, 0x00E7, 0x0142, 0x00EB, 0x0150, 0x0151, 0x00EE, 0x0179, 0x00C4, 0x0106,
+        0x00C9, 0x0139, 0x013A, 0x00F4, 0x00F6, 0x013D, 0x013E, 0x015A, 0x015B, 0x00D6, 0x00DC, 0x0164, 0x0165, 0x0141, 0x00D7, 0x010D,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x0104, 0x0105, 0x017D, 0x017E, 0x0118, 0x0119, 0x00AC, 0x017A, 0x010C, 0x015F, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x00C1, 0x00C2, 0x011A, 0x015E, 0x2563, 0x2551, 0x2557, 0x255D, 0x017B, 0x017C, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x0102, 0x0103, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x00A4,
+        0x0111, 0x0110, 0x010E, 0x00CB, 0x010F, 0x0147, 0x00CD, 0x00CE, 0x011B, 0x2518, 0x250C, 0x2588, 0x2584, 0x0162, 0x016E, 0x2580,
+        0x00D3, 0x00DF, 0x00D4, 0x0143, 0x0144, 0x0148, 0x0160, 0x0161, 0x0154, 0x00DA, 0x0155, 0x0170, 0x00FD, 0x00DD, 0x0163, 0x00B4,
+        0x00AD, 0x02DD, 0x02DB, 0x02C7, 0x02D8, 0x00A7, 0x00F7, 0x00B8, 0x00B0, 0x00A8, 0x02D9, 0x0171, 0x0158, 0x0159, 0x25A0, 0x00A0,
+    },
+    {
+        0x0452, 0x0402, 0x0453, 0x0403, 0x0451, 0x0401, 0x0454, 0x0404, 0x0455, 0x0405, 0x0456, 0x0406, 0x0457, 0x0407, 0x0458, 0x0408,
+        0x0459, 0x0409, 0x045A, 0x040A, 0x045B, 0x040B, 0x045C, 0x040C, 0x045E, 0x040E, 0x045F, 0x040F, 0x044E, 0x042E, 0x044A, 0x042A,
+        0x0430, 0x0410, 0x0431, 0x0411, 0x0446, 0x0426, 0x0434, 0x0414, 0x0435, 0x0415, 0x0444, 0x0424, 0x0433, 0x0413, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x0445, 0x0425, 0x0438, 0x0418, 0x2563, 0x2551, 0x2557, 0x255D, 0x0439, 0x0419, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x043A, 0x041A, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x00A4,
+        0x043B, 0x041B, 0x043C, 0x041C, 0x043D, 0x041D, 0x043E, 0x041E, 0x043F, 0x2518, 0x250C, 0x2588, 0x2584, 0x041F, 0x044F, 0x2580,
+        0x042F, 0x0440, 0x0420, 0x0441, 0x0421, 0x0442, 0x0422, 0x0443, 0x0423, 0x0436, 0x0416, 0x0432, 0x0412, 0x044C, 0x042C, 0x2116,
+        0x00AD, 0x044B, 0x042B, 0x0437, 0x0417, 0x0448, 0x0428, 0x044D, 0x042D, 0x0449, 0x0429, 0x0447, 0x0427, 0x00A7, 0x25A0, 0x00A0,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E3, 0x00E0, 0x00C1, 0x00E7, 0x00EA, 0x00CA, 0x00E8, 0x00CD, 0x00D4, 0x00EC, 0x00C3, 0x00C2,
+        0x00C9, 0x00C0, 0x00C8, 0x00F4, 0x00F5, 0x00F2, 0x00DA, 0x00F9, 0x00CC, 0x00D5, 0x00DC, 0x00A2, 0x00A3, 0x00D9, 0x20A7, 0x00D3,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, 0x00BF, 0x00D2, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+        0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x00E5, 0x00E7, 0x00EA, 0x00EB, 0x00E8, 0x00D0, 0x00F0, 0x00DE, 0x00C4, 0x00C5,
+        0x00C9, 0x00E6, 0x00C6, 0x00F4, 0x00F6, 0x00FE, 0x00FB, 0x00DD, 0x00FD, 0x00D6, 0x00DC, 0x00F8, 0x00A3, 0x00D8, 0x20A7, 0x0192,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00C1, 0x00CD, 0x00D3, 0x00DA, 0x00BF, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+        0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x05D0, 0x05D1, 0x05D2, 0x05D3, 0x05D4, 0x05D5, 0x05D6, 0x05D7, 0x05D8, 0x05D9, 0x05DA, 0x05DB, 0x05DC, 0x05DD, 0x05DE, 0x05DF,
+        0x05E0, 0x05E1, 0x05E2, 0x05E3, 0x05E4, 0x05E5, 0x05E6, 0x05E7, 0x05E8, 0x05E9, 0x05EA, 0x00A2, 0x00A3, 0x00A5, 0x20A7, 0x0192,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, 0x00BF, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+        0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00C2, 0x00E0, 0x00B6, 0x00E7, 0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x2017, 0x00C0, 0x00A7,
+        0x00C9, 0x00C8, 0x00CA, 0x00F4, 0x00CB, 0x00CF, 0x00FB, 0x00F9, 0x00A4, 0x00D4, 0x00DC, 0x00A2, 0x00A3, 0x00D9, 0x00DB, 0x0192,
+        0x00A6, 0x00B4, 0x00F3, 0x00FA, 0x00A8, 0x00B8, 0x00B3, 0x00AF, 0x00CE, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00BE, 0x00AB, 0x00BB,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+        0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x00C7, 0x00FC, 0x00E9, 0x00E2, 0x00E4, 0x00E0, 0x00E5, 0x00E7, 0x00EA, 0x00EB, 0x00E8, 0x00EF, 0x00EE, 0x00EC, 0x00C4, 0x00C5,
+        0x00C9, 0x00E6, 0x00C6, 0x00F4, 0x00F6, 0x00F2, 0x00FB, 0x00F9, 0x00FF, 0x00D6, 0x00DC, 0x00F8, 0x00A3, 0x00D8, 0x20A7, 0x0192,
+        0x00E1, 0x00ED, 0x00F3, 0x00FA, 0x00F1, 0x00D1, 0x00AA, 0x00BA, 0x00BF, 0x2310, 0x00AC, 0x00BD, 0x00BC, 0x00A1, 0x00AB, 0x00A4,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x03B1, 0x00DF, 0x0393, 0x03C0, 0x03A3, 0x03C3, 0x00B5, 0x03C4, 0x03A6, 0x0398, 0x03A9, 0x03B4, 0x221E, 0x03C6, 0x03B5, 0x2229,
+        0x2261, 0x00B1, 0x2265, 0x2264, 0x2320, 0x2321, 0x00F7, 0x2248, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x207F, 0x00B2, 0x25A0, 0x00A0,
+    },
+    {
+        0x0410, 0x0411, 0x0412, 0x0413, 0x0414, 0x0415, 0x0416, 0x0417, 0x0418, 0x0419, 0x041A, 0x041B, 0x041C, 0x041D, 0x041E, 0x041F,
+        0x0420, 0x0421, 0x0422, 0x0423, 0x0424, 0x0425, 0x0426, 0x0427, 0x0428, 0x0429, 0x042A, 0x042B, 0x042C, 0x042D, 0x042E, 0x042F,
+        0x0430, 0x0431, 0x0432, 0x0433, 0x0434, 0x0435, 0x0436, 0x0437, 0x0438, 0x0439, 0x043A, 0x043B, 0x043C, 0x043D, 0x043E, 0x043F,
+        0x2591, 0x2592, 0x2593, 0x2502, 0x2524, 0x2561, 0x2562, 0x2556, 0x2555, 0x2563, 0x2551, 0x2557, 0x255D, 0x255C, 0x255B, 0x2510,
+        0x2514, 0x2534, 0x252C, 0x251C, 0x2500, 0x253C, 0x255E, 0x255F, 0x255A, 0x2554, 0x2569, 0x2566, 0x2560, 0x2550, 0x256C, 0x2567,
+        0x2568, 0x2564, 0x2565, 0x2559, 0x2558, 0x2552, 0x2553, 0x256B, 0x256A, 0x2518, 0x250C, 0x2588, 0x2584, 0x258C, 0x2590, 0x2580,
+        0x0440, 0x0441, 0x0442, 0x0443, 0x0444, 0x0445, 0x0446, 0x0447, 0x0448, 0x0449, 0x044A, 0x044B, 0x044C, 0x044D, 0x044E, 0x044F,
+        0x0401, 0x0451, 0x0404, 0x0454, 0x0407, 0x0457, 0x040E, 0x045E, 0x00B0, 0x2219, 0x00B7, 0x221A, 0x2116, 0x00A4, 0x25A0, 0x00A0,
+    },
+    {
+        0x2500, 0x2502, 0x250C, 0x2510, 0x2514, 0x2518, 0x251C, 0x2524, 0x252C, 0x2534, 0x253C, 0x2580, 0x2584, 0x2588, 0x258C, 0x2590,
+        0x2591, 0x2592, 0x2593, 0x2320, 0x25A0, 0x2219, 0x221A, 0x2248, 0x2264, 0x2265, 0x00A0, 0x2321, 0x00B0, 0x00B2, 0x00B7, 0x00F7,
+        0x2550, 0x2551, 0x2552, 0x0451, 0x2553, 0x2554, 0x2555, 0x2556, 0x2557, 0x2558, 0x2559, 0x255A, 0x255B, 0x255C, 0x255D, 0x255E,
+        0x255F, 0x2560, 0x2561, 0x0401, 0x2562, 0x2563, 0x2564, 0x2565, 0x2566, 0x2567, 0x2568, 0x2569, 0x256A, 0x256B, 0x256C, 0x00A9,
+        0x044E, 0x0430, 0x0431, 0x0446, 0x0434, 0x0435, 0x0444, 0x0433, 0x0445, 0x0438, 0x0439, 0x043A, 0x043B, 0x043C, 0x043D, 0x043E,
+        0x043F, 0x044F, 0x0440, 0x0441, 0x0442, 0x0443, 0x0436, 0x0432, 0x044C, 0x044B, 0x0437, 0x0448, 0x044D, 0x0449, 0x0447, 0x044A,
+        0x042E, 0x0410, 0x0411, 0x0426, 0x0414, 0x0415, 0x0424, 0x0413, 0x0425, 0x0418, 0x0419, 0x041A, 0x041B, 0x041C, 0x041D, 0x041E,
+        0x041F, 0x042F, 0x0420, 0x0421, 0x0422, 0x0423, 0x0416, 0x0412, 0x042C, 0x042B, 0x0417, 0x0428, 0x042D, 0x0429, 0x0427, 0x042A,
+    },
+    {
+        0x2500, 0x2502, 0x250C, 0x2510, 0x2514, 0x2518, 0x251C, 0x2524, 0x252C, 0x2534, 0x253C, 0x2580, 0x2584, 0x2588, 0x258C, 0x2590,
+        0x2591, 0x2592, 0x2593, 0x2320, 0x25A0, 0x2219, 0x221A, 0x2248, 0x2264, 0x2265, 0x00A0, 0x2321, 0x00B0, 0x00B2, 0x00B7, 0x00F7,
+        0x2550, 0x2551, 0x2552, 0x0451, 0x0454, 0x2554, 0x0456, 0x0457, 0x2557, 0x2558, 0x2559, 0x255A, 0x255B, 0x0491, 0x255D, 0x255E,
+        0x255F, 0x2560, 0x2561, 0x0401, 0x0404, 0x2563, 0x0406, 0x0407, 0x2566, 0x2567, 0x2568, 0x2569, 0x256A, 0x0490, 0x256C, 0x00A9,
+        0x044E, 0x0430, 0x0431, 0x0446, 0x0434, 0x0435, 0x0444, 0x0433, 0x0445, 0x0438, 0x0439, 0x043A, 0x043B, 0x043C, 0x043D, 0x043E,
+        0x043F, 0x044F, 0x0440, 0x0441, 0x0442, 0x0443, 0x0436, 0x0432, 0x044C, 0x044B, 0x0437, 0x0448, 0x044D, 0x0449, 0x0447, 0x044A,
+        0x042E, 0x0410, 0x0411, 0x0426, 0x0414, 0x0415, 0x0424, 0x0413, 0x0425, 0x0418, 0x0419, 0x041A, 0x041B, 0x041C, 0x041D, 0x041E,
+        0x041F, 0x042F, 0x0420, 0x0421, 0x0422, 0x0423, 0x0416, 0x0412, 0x042C, 0x042B, 0x0417, 0x0428, 0x042D, 0x0429, 0x0427, 0x042A,
+    },
+    {
+        0x20AC, 0x0081, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, 0x009D, 0x009E, 0x0178,
+        0x00A0, 0x00A1, 0x00A2, 0x00A3, 0x00A4, 0x00A5, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x00AA, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00AF,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x00B9, 0x00BA, 0x00BB, 0x00BC, 0x00BD, 0x00BE, 0x00BF,
+        0x00C0, 0x00C1, 0x00C2, 0x00C3, 0x00C4, 0x00C5, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x00CC, 0x00CD, 0x00CE, 0x00CF,
+        0x011E, 0x00D1, 0x00D2, 0x00D3, 0x00D4, 0x00D5, 0x00D6, 0x00D7, 0x00D8, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x0130, 0x015E, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x00E3, 0x00E4, 0x00E5, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x00EC, 0x00ED, 0x00EE, 0x00EF,
+        0x011F, 0x00F1, 0x00F2, 0x00F3, 0x00F4, 0x00F5, 0x00F6, 0x00F7, 0x00F8, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x0131, 0x015F, 0x00FF,
+    },
+    {
+        0x20AC, 0x067E, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x0679, 0x2039, 0x0152, 0x0686, 0x0698, 0x0688,
+        0x06AF, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x06A9, 0x2122, 0x0691, 0x203A, 0x0153, 0x200C, 0x200D, 0x06BA,
+        0x00A0, 0x060C, 0x00A2, 0x00A3, 0x00A4, 0x00A5, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x06BE, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00AF,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x00B9, 0x061B, 0x00BB, 0x00BC, 0x00BD, 0x00BE, 0x061F,
+        0x06C1, 0x0621, 0x0622, 0x0623, 0x0624, 0x0625, 0x0626, 0x0627, 0x0628, 0x0629, 0x062A, 0x062B, 0x062C, 0x062D, 0x062E, 0x062F,
+        0x0630, 0x0631, 0x0632, 0x0633, 0x0634, 0x0635, 0x0636, 0x00D7, 0x0637, 0x0638, 0x0639, 0x063A, 0x0640, 0x0641, 0x0642, 0x0643,
+        0x00E0, 0x0644, 0x00E2, 0x0645, 0x0646, 0x0647, 0x0648, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x0649, 0x064A, 0x00EE, 0x00EF,
+        0x064B, 0x064C, 0x064D, 0x064E, 0x00F4, 0x064F, 0x0650, 0x00F7, 0x0651, 0x00F9, 0x0652, 0x00FB, 0x00FC, 0x200E, 0x200F, 0x06D2,
+    },
+    {
+        0x20AC, 0x0081, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, 0x02C6, 0x2030, 0x008A, 0x2039, 0x0152, 0x008D, 0x008E, 0x008F,
+        0x0090, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, 0x02DC, 0x2122, 0x009A, 0x203A, 0x0153, 0x009D, 0x009E, 0x0178,
+        0x00A0, 0x00A1, 0x00A2, 0x00A3, 0x00A4, 0x00A5, 0x00A6, 0x00A7, 0x00A8, 0x00A9, 0x00AA, 0x00AB, 0x00AC, 0x00AD, 0x00AE, 0x00AF,
+        0x00B0, 0x00B1, 0x00B2, 0x00B3, 0x00B4, 0x00B5, 0x00B6, 0x00B7, 0x00B8, 0x00B9, 0x00BA, 0x00BB, 0x00BC, 0x00BD, 0x00BE, 0x00BF,
+        0x00C0, 0x00C1, 0x00C2, 0x0102, 0x00C4, 0x00C5, 0x00C6, 0x00C7, 0x00C8, 0x00C9, 0x00CA, 0x00CB, 0x0300, 0x00CD, 0x00CE, 0x00CF,
+        0x0110, 0x00D1, 0x0309, 0x00D3, 0x00D4, 0x01A0, 0x00D6, 0x00D7, 0x00D8, 0x00D9, 0x00DA, 0x00DB, 0x00DC, 0x01AF, 0x0303, 0x00DF,
+        0x00E0, 0x00E1, 0x00E2, 0x0103, 0x00E4, 0x00E5, 0x00E6, 0x00E7, 0x00E8, 0x00E9, 0x00EA, 0x00EB, 0x0301, 0x00ED, 0x00EE, 0x00EF,
+        0x0111, 0x00F1, 0x0323, 0x00F3, 0x00F4, 0x01A1, 0x00F6, 0x00F7, 0x00F8, 0x00F9, 0x00FA, 0x00FB, 0x00FC, 0x01B0, 0x20AB, 0x00FF,
+    },
+};
+
+}
diff --git a/core/libs/prx/libSceCesCs/Unicode.cpp b/core/libs/prx/libSceCesCs/Unicode.cpp
index 5a4b10399b..45f36923ee 100644
--- a/core/libs/prx/libSceCesCs/Unicode.cpp
+++ b/core/libs/prx/libSceCesCs/Unicode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include <bit>
 #include <cstdint>
 #include <cstring>
diff --git a/core/libs/prx/libSceCesCs/include/Api.hpp b/core/libs/prx/libSceCesCs/include/Api.hpp
new file mode 100644
index 0000000000..4ad8a366f1
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/include/Api.hpp
@@ -0,0 +1,295 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1251(void);
+const void* APS5_VABI sceCesRefersUcsProfileCp1250(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_1(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_2(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_4(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_5(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_9(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_10(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_13(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_14(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_15(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileIso8859_16(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp437(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp737(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp775(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp850(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp852(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp855(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp860(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp861(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp862(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp863(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp865(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp866(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8R(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileKoi8U(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1254(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1256(void);
+const uint8_t* APS5_VABI sceCesRefersUcsProfileCp1258(void);
+void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitSJis1997X0208(void* sheet);
+int APS5_VABI sceCesMbcsUcsContextInit(void* context, const void* profile);
+int APS5_VABI sceCesMbcsUcsContextInitCopy(void* context, const void* source);
+void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucJpX0208Ss2Ss3(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitEucKr(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitUhc(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitBig5Cp950(void* sheet);
+int APS5_VABI sceCesUtf8StrToMbcsStr(void* context, const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUtf8StrGetMbcsLen(void* context, const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesUcs2StrToMbcsStr(void* context, const uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUcs2StrGetMbcsLen(void* context, const uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesMbcsStrToUtf8Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len);
+int APS5_VABI sceCesMbcsStrGetUtf8Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf8Len);
+int APS5_VABI sceCesMbcsStrToUcs2Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* ucs2, uint32_t ucs2max, uint32_t* ucs2Len);
+int APS5_VABI sceCesMbcsStrGetUcs2Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* ucs2Len);
+int APS5_VABI sceCesEucJpToUcs2(const void* profile, const uint8_t* euc, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2);
+int APS5_VABI sceCesSbcToUtf8(const uint8_t* profile, uint8_t sbc, uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len);
+int APS5_VABI sceCesUtf8ToSbc(const uint8_t* utf8, uint32_t utf8max, uint32_t* utf8Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesEucJpToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesEucKrToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesBig5ToUtf8(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Length, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesUhcToUtf8(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcLength, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesSJisToUcs2(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* ucs2);
+int APS5_VABI sceCesSJisToUtf8(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesSJisToUtf16(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesSJisToUtf16be(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesSJisToUtf16le(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesSJisToUtf32(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32);
+int APS5_VABI sceCesSJisToUtf32be(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32);
+int APS5_VABI sceCesSJisToUtf32le(const void* profile, const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint32_t* utf32);
+int APS5_VABI sceCesEucJpToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucJpToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucJpToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucJpToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucJpToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucJpToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToSJis(uint16_t ucs2, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf8ToSJis(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf16ToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf16beToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf16leToSJis(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf32ToSJis(uint32_t utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf32beToSJis(const uint32_t* utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUtf32leToSJis(const uint32_t* utf32, const void* profile, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesUcs2ToEucJp(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf8ToEucJp(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16ToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16beToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16leToEucJp(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32ToEucJp(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32beToEucJp(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32leToEucJp(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesSJisCodeToJisX0208(uint16_t sjisCode, uint8_t* ku, uint8_t* ten);
+int APS5_VABI sceCesJisX0208ToSJisCode(uint8_t ku, uint8_t ten, uint16_t* sjisCode);
+int APS5_VABI sceCesSJisCodeToJisX0213(uint16_t sjisCode, uint8_t* men, uint8_t* ku, uint8_t* ten);
+int APS5_VABI sceCesJisX0213ToSJisCode(uint8_t men, uint8_t ku, uint8_t ten, uint16_t* sjisCode);
+int APS5_VABI sceCesSJisGetCode(const uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize, uint16_t* sjisCode);
+int APS5_VABI sceCesSJisPutCode(uint16_t sjisCode, uint8_t* sjisBuffer, uint32_t sjisMax, uint32_t* sjisSize);
+int APS5_VABI sceCesMbcToUcs2(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* ucs2);
+int APS5_VABI sceCesMbcToUtf8(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Len);
+int APS5_VABI sceCesMbcToUtf16(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcToUtf16be(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcToUtf16le(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcToUtf32(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32);
+int APS5_VABI sceCesMbcToUtf32be(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32);
+int APS5_VABI sceCesMbcToUtf32le(const void* profile, const uint8_t* mbcBuffer, uint32_t mbcMax, uint32_t* mbcLen, uint32_t* utf32);
+int APS5_VABI sceCesSbcToUcs2(const uint8_t* profile, uint8_t sbc, uint16_t* ucs2);
+int APS5_VABI sceCesSbcToUtf16(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesSbcToUtf16be(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesSbcToUtf16le(const uint8_t* profile, uint8_t sbc, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesSbcToUtf32(const uint8_t* profile, uint8_t sbc, uint32_t* utf32);
+int APS5_VABI sceCesSbcToUtf32be(const uint8_t* profile, uint8_t sbc, uint32_t* utf32);
+int APS5_VABI sceCesSbcToUtf32le(const uint8_t* profile, uint8_t sbc, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToSbc(uint16_t ucs2, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16ToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16beToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16leToSbc(const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf32ToSbc(uint32_t utf32, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf32beToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf32leToSbc(const uint32_t* utf32, const uint8_t* profile, uint8_t* sbc);
+int APS5_VABI sceCesUtf16StrToMbcsStr(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUtf16StrGetMbcsLen(void* context, const uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesMbcsStrToUtf16Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint16_t* utf16, uint32_t utf16max, uint32_t* utf16Len);
+int APS5_VABI sceCesMbcsStrGetUtf16Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf16Len);
+int APS5_VABI sceCesUtf32StrToMbcsStr(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen);
+int APS5_VABI sceCesUtf32StrGetMbcsLen(void* context, const uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len, uint32_t* mbcsLen);
+int APS5_VABI sceCesMbcsStrToUtf32Str(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32, uint32_t utf32max, uint32_t* utf32Len);
+int APS5_VABI sceCesMbcsStrGetUtf32Len(void* context, const uint8_t* mbcs, uint32_t mbcsMax, uint32_t* mbcsLen, uint32_t* utf32Len);
+void* APS5_VABI sceCesUcsProfileInitEucCnGb2312(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitGbkCp936(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitGb18030_2000(void* sheet);
+void* APS5_VABI sceCesUcsProfileInitGb18030_2005(void* sheet);
+int APS5_VABI sceCesEucCnToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2);
+int APS5_VABI sceCesEucCnToUtf8(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesEucCnToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucCnToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucCnToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucCnToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucCnToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucCnToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToEucCn(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf8ToEucCn(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16ToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16beToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16leToEucCn(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32ToEucCn(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32beToEucCn(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32leToEucCn(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesGbToUcs2(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* ucs2);
+int APS5_VABI sceCesGbToUtf8(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length);
+int APS5_VABI sceCesGbToUtf16(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesGbToUtf16be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesGbToUtf16le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesGbToUtf32(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32);
+int APS5_VABI sceCesGbToUtf32be(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32);
+int APS5_VABI sceCesGbToUtf32le(const void* profile, const uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToGb(uint16_t ucs2, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf8ToGb(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf16ToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf16beToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf16leToGb(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf32ToGb(uint32_t utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf32beToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesUtf32leToGb(const uint32_t* utf32, const void* profile, uint8_t* gbBuffer, uint32_t gbMax, uint32_t* gbSize);
+int APS5_VABI sceCesEucKrToUcs2(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* ucs2);
+int APS5_VABI sceCesEucKrToUtf16(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucKrToUtf16be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucKrToUtf16le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesEucKrToUtf32(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucKrToUtf32be(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesEucKrToUtf32le(const void* profile, const uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize, uint32_t* utf32);
+int APS5_VABI sceCesUhcToUcs2(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* ucs2);
+int APS5_VABI sceCesUhcToUtf16(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesUhcToUtf16be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesUhcToUtf16le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesUhcToUtf32(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32);
+int APS5_VABI sceCesUhcToUtf32be(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32);
+int APS5_VABI sceCesUhcToUtf32le(const void* profile, const uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize, uint32_t* utf32);
+int APS5_VABI sceCesBig5ToUcs2(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* ucs2);
+int APS5_VABI sceCesBig5ToUtf16(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesBig5ToUtf16be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesBig5ToUtf16le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length);
+int APS5_VABI sceCesBig5ToUtf32(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32);
+int APS5_VABI sceCesBig5ToUtf32be(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32);
+int APS5_VABI sceCesBig5ToUtf32le(const void* profile, const uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size, uint32_t* utf32);
+int APS5_VABI sceCesUcs2ToEucKr(uint16_t ucs2, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf8ToEucKr(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16ToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16beToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf16leToEucKr(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32ToEucKr(uint32_t utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32beToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUtf32leToEucKr(const uint32_t* utf32, const void* profile, uint8_t* eucBuffer, uint32_t eucMax, uint32_t* eucSize);
+int APS5_VABI sceCesUcs2ToUhc(uint16_t ucs2, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf8ToUhc(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf16ToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf16beToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf16leToUhc(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf32ToUhc(uint32_t utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf32beToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUtf32leToUhc(const uint32_t* utf32, const void* profile, uint8_t* uhcBuffer, uint32_t uhcMax, uint32_t* uhcSize);
+int APS5_VABI sceCesUcs2ToBig5(uint16_t ucs2, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf8ToBig5(const uint8_t* utf8Buffer, uint32_t utf8Max, uint32_t* utf8Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf16ToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf16beToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf16leToBig5(const uint16_t* utf16Buffer, uint32_t utf16Max, uint32_t* utf16Length, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf32ToBig5(uint32_t utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf32beToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesUtf32leToBig5(const uint32_t* utf32, const void* profile, uint8_t* big5Buffer, uint32_t big5Max, uint32_t* big5Size);
+int APS5_VABI sceCesEucCnUcsProfileSetSbcs(void);
+int APS5_VABI sceCesEucJpUcsProfileSetSbcs(void);
+int APS5_VABI sceCesEucKrUcsProfileSetSbcs(void);
+int APS5_VABI sceCesGbUcsProfileSet4ByteCharRange(void);
+int APS5_VABI sceCesGbUcsProfileSetSbcs(void);
+int APS5_VABI sceCesGbUcsProfileSetUdaMapping(void);
+int APS5_VABI sceCesIso2022JpUcsProfileSetSbcs(void);
+int APS5_VABI sceCesIso2022StrGetUcs2Len(void);
+int APS5_VABI sceCesIso2022StrGetUtf16Len(void);
+int APS5_VABI sceCesIso2022StrGetUtf32Len(void);
+int APS5_VABI sceCesIso2022StrGetUtf8Len(void);
+int APS5_VABI sceCesIso2022StrToUcs2Str(void);
+int APS5_VABI sceCesIso2022StrToUtf16Str(void);
+int APS5_VABI sceCesIso2022StrToUtf32Str(void);
+int APS5_VABI sceCesIso2022StrToUtf8Str(void);
+int APS5_VABI sceCesIso2022UcsContextInit(void);
+int APS5_VABI sceCesIso2022UcsContextInitCopy(void);
+int APS5_VABI sceCesJisGetLevel(void);
+int APS5_VABI sceCesJiscsToUcs(void);
+int APS5_VABI sceCesMbcsUcsSetMbcsReplacementCharCode(void);
+int APS5_VABI sceCesMbcsUcsSetMbcsReplacementCharUCode(void);
+int APS5_VABI sceCesRefersUcsProfileAscii(void);
+int APS5_VABI sceCesRefersUcsProfileAsciiWithKatakana(void);
+int APS5_VABI sceCesRefersUcsProfileBs4730(void);
+int APS5_VABI sceCesRefersUcsProfileCp1253(void);
+int APS5_VABI sceCesRefersUcsProfileCp1255(void);
+int APS5_VABI sceCesRefersUcsProfileCp1257(void);
+int APS5_VABI sceCesRefersUcsProfileCp857(void);
+int APS5_VABI sceCesRefersUcsProfileCp858(void);
+int APS5_VABI sceCesRefersUcsProfileCp864(void);
+int APS5_VABI sceCesRefersUcsProfileCp869(void);
+int APS5_VABI sceCesRefersUcsProfileCp874(void);
+int APS5_VABI sceCesRefersUcsProfileGbT1988(void);
+int APS5_VABI sceCesRefersUcsProfileGbT1988Tilde0x7e(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_11(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_3(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_6(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_7(void);
+int APS5_VABI sceCesRefersUcsProfileIso8859_8(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201Katakana(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201Roman(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201RomanTilde0x7e(void);
+int APS5_VABI sceCesRefersUcsProfileJisX0201Tilde0x7e(void);
+int APS5_VABI sceCesRefersUcsProfileKsX1003(void);
+int APS5_VABI sceCesRefersUcsProfileKsX1003Tilde0x7e(void);
+int APS5_VABI sceCesSJisUcsProfileSetSbcs(void);
+int APS5_VABI sceCesUcs2StrGetIso2022Len(void);
+int APS5_VABI sceCesUcs2StrToIso2022Str(void);
+int APS5_VABI sceCesUcs2ToMbc(void);
+int APS5_VABI sceCesUcsProfileInitEucJis2004(void);
+int APS5_VABI sceCesUcsProfileInitIso2022JpCp50221(void);
+int APS5_VABI sceCesUcsProfileInitIso2022JpCp50222(void);
+int APS5_VABI sceCesUcsProfileInitIso2022JpRfc1468(void);
+int APS5_VABI sceCesUcsProfileInitSJis2004X0213(void);
+int APS5_VABI sceCesUcsToJiscs(void);
+int APS5_VABI sceCesUhcUcsProfileSetSbcs(void);
+int APS5_VABI sceCesUtf16StrGetIso2022Len(void);
+int APS5_VABI sceCesUtf16StrToIso2022Str(void);
+int APS5_VABI sceCesUtf16ToMbc(void);
+int APS5_VABI sceCesUtf16beToMbc(void);
+int APS5_VABI sceCesUtf16leToMbc(void);
+int APS5_VABI sceCesUtf32StrGetIso2022Len(void);
+int APS5_VABI sceCesUtf32StrToIso2022Str(void);
+int APS5_VABI sceCesUtf32ToMbc(void);
+int APS5_VABI sceCesUtf32beToMbc(void);
+int APS5_VABI sceCesUtf32leToMbc(void);
+int APS5_VABI sceCesUtf8StrGetIso2022Len(void);
+int APS5_VABI sceCesUtf8StrToIso2022Str(void);
+int APS5_VABI sceCesUtf8ToMbc(void);
+int APS5_VABI sceCesUcs2ToUtf8(uint16_t source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf8ToUcs2(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target);
+int APS5_VABI sceCesUtf8ToUtf32(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint32_t* target);
+int APS5_VABI sceCesUtf8ToUtf32be(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint32_t* target);
+int APS5_VABI sceCesUtf8ToUtf32le(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint32_t* target);
+int APS5_VABI sceCesUtf8ToUtf16(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf8ToUtf16be(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf8ToUtf16le(const uint8_t* source, uint32_t available, uint32_t* sourceLength, uint16_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf16ToUtf8(const uint16_t* source, uint32_t available, uint32_t* sourceLength, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf16beToUtf8(const uint16_t* source, uint32_t available, uint32_t* sourceLength, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf16leToUtf8(const uint16_t* source, uint32_t available, uint32_t* sourceLength, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf32ToUtf8(uint32_t source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf32beToUtf8(const uint32_t* source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+int APS5_VABI sceCesUtf32leToUtf8(const uint32_t* source, uint8_t* target, uint32_t capacity, uint32_t* targetLength);
+
+}
diff --git a/core/libs/prx/libSceCesCs/libSceCesCs.hpp b/core/libs/prx/libSceCesCs/libSceCesCs.hpp
new file mode 100644
index 0000000000..d1bff8e93d
--- /dev/null
+++ b/core/libs/prx/libSceCesCs/libSceCesCs.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCesCs/include/Api.hpp"
diff --git a/core/libs/prx/libSceCommonDialog/CommonDialog.hpp b/core/libs/prx/libSceCommonDialog/CommonDialog.hpp
index f1949f6eeb..260eb371bc 100644
--- a/core/libs/prx/libSceCommonDialog/CommonDialog.hpp
+++ b/core/libs/prx/libSceCommonDialog/CommonDialog.hpp
@@ -248,6 +248,7 @@ inline bool ValidateCommonDialogBaseParam(const CommonDialogBaseParam& param) {
 }
 
 constexpr int COMMON_DIALOG_OK = 0;
+constexpr int COMMON_DIALOG_ERROR_ALREADY_SYSTEM_INITIALIZED = static_cast<int>(0x80B80002);
 constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004);
 
 #endif
diff --git a/core/libs/prx/libSceCommonDialog/Export.cpp b/core/libs/prx/libSceCommonDialog/Export.cpp
index bb18755ae2..8d090d7d35 100644
--- a/core/libs/prx/libSceCommonDialog/Export.cpp
+++ b/core/libs/prx/libSceCommonDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCommonDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -12,7 +13,7 @@ extern "C" {
 int APS5_VABI sceCommonDialogInitialize(void) {
     bool expected = false;
     if (!g_initialized.compare_exchange_strong(expected, true)) {
-        return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
+        return COMMON_DIALOG_ERROR_ALREADY_SYSTEM_INITIALIZED;
     }
     return COMMON_DIALOG_OK;
 }
diff --git a/core/libs/prx/libSceCommonDialog/include/Api.hpp b/core/libs/prx/libSceCommonDialog/include/Api.hpp
new file mode 100644
index 0000000000..50330e8aa4
--- /dev/null
+++ b/core/libs/prx/libSceCommonDialog/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCommonDialogInitialize(void);
+bool APS5_VABI sceCommonDialogIsUsed(void);
+
+}
diff --git a/core/libs/prx/libSceCommonDialog/libSceCommonDialog.hpp b/core/libs/prx/libSceCommonDialog/libSceCommonDialog.hpp
new file mode 100644
index 0000000000..2379b9c83f
--- /dev/null
+++ b/core/libs/prx/libSceCommonDialog/libSceCommonDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceCompanionHttpd/CMakeLists.txt b/core/libs/prx/libSceCompanionHttpd/CMakeLists.txt
new file mode 100644
index 0000000000..cdc8922b8a
--- /dev/null
+++ b/core/libs/prx/libSceCompanionHttpd/CMakeLists.txt
@@ -0,0 +1,21 @@
+add_library(libSceCompanionHttpd SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceCompanionHttpd PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceCompanionHttpd)
+
+if(MINGW)
+    foreach(runtimeLinkFlag IN ITEMS -static-libgcc -static-libstdc++ -static)
+        string(REPLACE "${runtimeLinkFlag}" "" CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS}")
+    endforeach()
+endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_companion_httpd_tests ${LIBS_INCLUDE_DIR}/tests/GuestCompanionHttpd.cpp)
+    target_include_directories(guest_companion_httpd_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_companion_httpd_tests PRIVATE libSceCompanionHttpd libc)
+    configure_windows_unwind(guest_companion_httpd_tests)
+    add_test(NAME guest_companion_httpd COMMAND guest_companion_httpd_tests)
+    if(WIN32)
+        set_tests_properties(guest_companion_httpd PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceCompanionHttpd>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceCompanionHttpd/Export.cpp b/core/libs/prx/libSceCompanionHttpd/Export.cpp
index 48240a3fe1..7941374a21 100644
--- a/core/libs/prx/libSceCompanionHttpd/Export.cpp
+++ b/core/libs/prx/libSceCompanionHttpd/Export.cpp
@@ -1,91 +1,154 @@
+#include "prx/libSceCompanionHttpd/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
+#include <mutex>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int CompanionHttpdErrorInvalidParam = static_cast<int>(0x80E40004u);
+constexpr int CompanionHttpdErrorNotInitialized = static_cast<int>(0x80E40006u);
+constexpr int CompanionHttpdErrorAlreadyInitialized = static_cast<int>(0x80E40007u);
+constexpr int CompanionHttpdErrorNoEvent = static_cast<int>(0x80E40008u);
+constexpr int CompanionHttpdErrorAlreadyStarted = static_cast<int>(0x80E4000Au);
+constexpr int CompanionHttpdErrorNotStarted = static_cast<int>(0x80E4000Bu);
+constexpr int CompanionHttpdErrorAlreadyRegistered = static_cast<int>(0x80E4000Cu);
+
+static_assert(sizeof(CompanionHttpdOptParam) == 0x60);
+
+struct CompanionHttpdState {
+    std::mutex mutex;
+    bool initialized = false;
+    bool started = false;
+    CompanionHttpdRequestCallback callback = nullptr;
+    void* callbackArgument = nullptr;
+};
+
+CompanionHttpdState& State() {
+    static CompanionHttpdState state;
+    return state;
+}
+
+}
+
 extern "C" {
 
-int APS5_VABI sceCompanionHttpdAddHeader() {
+int APS5_VABI sceCompanionHttpdOptParamInitialize(CompanionHttpdOptParam* param) {
+    if (param == nullptr) return CompanionHttpdErrorInvalidParam;
+    std::memset(param, 0, sizeof(*param));
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdInitialize(const CompanionHttpdOptParam* param) {
+    if (param == nullptr) return CompanionHttpdErrorInvalidParam;
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (state.initialized) return CompanionHttpdErrorAlreadyInitialized;
+    state.initialized = true;
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdTerminate(void) {
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (!state.initialized) return CompanionHttpdErrorNotInitialized;
+    if (state.started) NotImplemented_nid_no_patch(__func__);
+    state.initialized = false;
+    state.callback = nullptr;
+    state.callbackArgument = nullptr;
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdRegisterRequestCallback(CompanionHttpdRequestCallback function, void* argument) {
+    if (function == nullptr) return CompanionHttpdErrorInvalidParam;
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (!state.initialized) return CompanionHttpdErrorNotInitialized;
+    if (state.callback != nullptr) return CompanionHttpdErrorAlreadyRegistered;
+    state.callback = function;
+    state.callbackArgument = argument;
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdUnregisterRequestCallback(void) {
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (!state.initialized) return CompanionHttpdErrorNotInitialized;
+    if (state.callback == nullptr) NotImplemented_nid_no_patch(__func__);
+    state.callback = nullptr;
+    state.callbackArgument = nullptr;
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdStart(void) {
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (!state.initialized) return CompanionHttpdErrorNotInitialized;
+    if (state.started) return CompanionHttpdErrorAlreadyStarted;
+    state.started = true;
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdStop(void) {
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (!state.initialized) return CompanionHttpdErrorNotInitialized;
+    if (!state.started) return CompanionHttpdErrorNotStarted;
+    state.started = false;
+    return 0;
+}
+
+int APS5_VABI sceCompanionHttpdGetEvent(void* event) {
+    if (event == nullptr) return CompanionHttpdErrorInvalidParam;
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    if (!state.initialized) return CompanionHttpdErrorNotInitialized;
+    return CompanionHttpdErrorNoEvent;
+}
+
+int APS5_VABI sceCompanionHttpdAddHeader(const char* key, const char* value, void* response) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdGet2ndScreenStatus() {
+int APS5_VABI sceCompanionHttpdSetStatus(int status, void* response) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdGetEvent() {
+int APS5_VABI sceCompanionHttpdSetBody(const char* body, std::uint64_t size, void* response) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdGetUserId() {
+int APS5_VABI sceCompanionHttpdGet2ndScreenStatus(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdInitialize() {
+int APS5_VABI sceCompanionHttpdGetUserId(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdInitialize2() {
+int APS5_VABI sceCompanionHttpdInitialize2(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdOptParamInitialize() {
+int APS5_VABI sceCompanionHttpdRegisterRequestBodyReceptionCallback(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdRegisterRequestBodyReceptionCallback() {
+int APS5_VABI sceCompanionHttpdRegisterRequestCallback2(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceCompanionHttpdRegisterRequestCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdRegisterRequestCallback2() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdSetBody() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdSetStatus() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdStart() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdStop() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdUnregisterRequestBodyReceptionCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceCompanionHttpdUnregisterRequestCallback() {
+int APS5_VABI sceCompanionHttpdUnregisterRequestBodyReceptionCallback(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceCompanionHttpd/include/Api.hpp b/core/libs/prx/libSceCompanionHttpd/include/Api.hpp
new file mode 100644
index 0000000000..6a7e2d194d
--- /dev/null
+++ b/core/libs/prx/libSceCompanionHttpd/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct CompanionHttpdOptParam {
+    std::uint64_t reserved;
+    void* workMemory;
+    std::uint64_t workMemorySize;
+    std::uint8_t settings[0x40];
+    const void* temporaryMountPoint;
+};
+
+using CompanionHttpdRequestCallback = int (*)(int, int, const void*, void*, void*);
+
+extern "C" {
+
+int APS5_VABI sceCompanionHttpdOptParamInitialize(CompanionHttpdOptParam* param);
+int APS5_VABI sceCompanionHttpdInitialize(const CompanionHttpdOptParam* param);
+int APS5_VABI sceCompanionHttpdTerminate(void);
+int APS5_VABI sceCompanionHttpdRegisterRequestCallback(CompanionHttpdRequestCallback function, void* argument);
+int APS5_VABI sceCompanionHttpdUnregisterRequestCallback(void);
+int APS5_VABI sceCompanionHttpdStart(void);
+int APS5_VABI sceCompanionHttpdStop(void);
+int APS5_VABI sceCompanionHttpdGetEvent(void* event);
+int APS5_VABI sceCompanionHttpdAddHeader(const char* key, const char* value, void* response);
+int APS5_VABI sceCompanionHttpdSetStatus(int status, void* response);
+int APS5_VABI sceCompanionHttpdSetBody(const char* body, std::uint64_t size, void* response);
+int APS5_VABI sceCompanionHttpdGet2ndScreenStatus(void);
+int APS5_VABI sceCompanionHttpdGetUserId(void);
+int APS5_VABI sceCompanionHttpdInitialize2(void);
+int APS5_VABI sceCompanionHttpdRegisterRequestBodyReceptionCallback(void);
+int APS5_VABI sceCompanionHttpdRegisterRequestCallback2(void);
+int APS5_VABI sceCompanionHttpdUnregisterRequestBodyReceptionCallback(void);
+
+}
diff --git a/core/libs/prx/libSceCompanionHttpd/libSceCompanionHttpd.hpp b/core/libs/prx/libSceCompanionHttpd/libSceCompanionHttpd.hpp
new file mode 100644
index 0000000000..9626d1bfa7
--- /dev/null
+++ b/core/libs/prx/libSceCompanionHttpd/libSceCompanionHttpd.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCompanionHttpd/include/Api.hpp"
diff --git a/core/libs/prx/libSceCompanionUtil/Export.cpp b/core/libs/prx/libSceCompanionUtil/Export.cpp
index 7a208122da..810abefbdc 100644
--- a/core/libs/prx/libSceCompanionUtil/Export.cpp
+++ b/core/libs/prx/libSceCompanionUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCompanionUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,7 +6,7 @@
 
 extern "C" {
 
-int APS5_VABI sceCompanionUtilGetEvent() {
+int APS5_VABI sceCompanionUtilGetEvent(void* outEvent) {
     return static_cast<int>(0x80AD0008);
 }
 
diff --git a/core/libs/prx/libSceCompanionUtil/include/Api.hpp b/core/libs/prx/libSceCompanionUtil/include/Api.hpp
new file mode 100644
index 0000000000..c71bbbf72b
--- /dev/null
+++ b/core/libs/prx/libSceCompanionUtil/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCompanionUtilGetEvent(void* outEvent);
+int APS5_VABI sceCompanionUtilGetRemoteOskEvent();
+int APS5_VABI sceCompanionUtilInitialize();
+int APS5_VABI sceCompanionUtilOptParamInitialize();
+int APS5_VABI sceCompanionUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceCompanionUtil/libSceCompanionUtil.hpp b/core/libs/prx/libSceCompanionUtil/libSceCompanionUtil.hpp
new file mode 100644
index 0000000000..e49fee6a03
--- /dev/null
+++ b/core/libs/prx/libSceCompanionUtil/libSceCompanionUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCompanionUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceComposite/Export.cpp b/core/libs/prx/libSceComposite/Export.cpp
index ebf58fb725..a2e79ae3ed 100644
--- a/core/libs/prx/libSceComposite/Export.cpp
+++ b/core/libs/prx/libSceComposite/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceComposite/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceComposite/include/Api.hpp b/core/libs/prx/libSceComposite/include/Api.hpp
new file mode 100644
index 0000000000..0df26cb6bc
--- /dev/null
+++ b/core/libs/prx/libSceComposite/include/Api.hpp
@@ -0,0 +1,86 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCompositorAllocateIndex();
+int APS5_VABI sceCompositorCheckCrash();
+int APS5_VABI sceCompositorCommandGpuPerfBegin();
+int APS5_VABI sceCompositorCommandGpuPerfEnd();
+int APS5_VABI sceCompositorCreateIndirectRenderTarget();
+int APS5_VABI sceCompositorDeleteIndirectRenderTarget();
+int APS5_VABI sceCompositorFlush();
+int APS5_VABI sceCompositorFlushWithRepeat();
+int APS5_VABI sceCompositorGetAnotherProcessSystemAddress();
+int APS5_VABI sceCompositorGetAnotherProcessSystemSize();
+int APS5_VABI sceCompositorGetAnotherProcessVideoAddress();
+int APS5_VABI sceCompositorGetAnotherProcessVideoSize();
+int APS5_VABI sceCompositorGetCanvasHandle();
+int APS5_VABI sceCompositorGetClientList();
+int APS5_VABI sceCompositorGetDmemOffset();
+int APS5_VABI sceCompositorGetDummyAddress();
+int APS5_VABI sceCompositorGetDummySize();
+int APS5_VABI sceCompositorGetRemainedCommandNum();
+int APS5_VABI sceCompositorGetRenderTargetResolution();
+int APS5_VABI sceCompositorGetSystemAddress();
+int APS5_VABI sceCompositorGetSystemSize();
+int APS5_VABI sceCompositorGetVideoAddress();
+int APS5_VABI sceCompositorGetVideoSize();
+int APS5_VABI sceCompositorHandleProcessEvents();
+int APS5_VABI sceCompositorInit();
+int APS5_VABI sceCompositorInitWithProcessOrder();
+int APS5_VABI sceCompositorInsertThreadTraceMarker();
+int APS5_VABI sceCompositorIsDebugCaptureEnabled();
+int APS5_VABI sceCompositorIsReady4K();
+int APS5_VABI sceCompositorLockCommandBuffer();
+int APS5_VABI sceCompositorMakeCanvasHandle();
+int APS5_VABI sceCompositorMapAnotherProcess();
+int APS5_VABI sceCompositorMemoryPoolDecommit();
+int APS5_VABI sceCompositorPrivacyMaskPushArea();
+int APS5_VABI sceCompositorQuit();
+int APS5_VABI sceCompositorReleaseCommandBuffer();
+int APS5_VABI sceCompositorReleaseIndex();
+int APS5_VABI sceCompositorReleaseLocalStall();
+int APS5_VABI sceCompositorReserveCommandBuffer();
+int APS5_VABI sceCompositorResetZoomCommand();
+int APS5_VABI sceCompositorSetAgcCompositeCanvasCommand();
+int APS5_VABI sceCompositorSetAgcContextCommand();
+int APS5_VABI sceCompositorSetCompositeCanvasCommandInC();
+int APS5_VABI sceCompositorSetCursorImageAddress();
+int APS5_VABI sceCompositorSetDebugPositionCommand();
+int APS5_VABI sceCompositorSetEndOfFrameCommand();
+int APS5_VABI sceCompositorSetEventCommand();
+int APS5_VABI sceCompositorSetFilterType();
+int APS5_VABI sceCompositorSetFlipCommand2();
+int APS5_VABI sceCompositorSetGameSufaceControlCommand();
+int APS5_VABI sceCompositorSetGnmContextCommand();
+int APS5_VABI sceCompositorSetIndirectCanvasCommand();
+int APS5_VABI sceCompositorSetIndirectCompositionCommand();
+int APS5_VABI sceCompositorSetIndirectRenderTargetConfigCommand();
+int APS5_VABI sceCompositorSetInvisibleCanvasCommand();
+int APS5_VABI sceCompositorSetKeepDisplayBufferCommand();
+int APS5_VABI sceCompositorSetLocalStallCommand();
+int APS5_VABI sceCompositorSetMemoryCommand();
+int APS5_VABI sceCompositorSetPatchCommand();
+int APS5_VABI sceCompositorSetPostEventCommand();
+int APS5_VABI sceCompositorSetRepeatCommand();
+int APS5_VABI sceCompositorSetResolutionCommand();
+int APS5_VABI sceCompositorSetScalingLayoutInfo();
+int APS5_VABI sceCompositorSetSeparateContextCommand();
+int APS5_VABI sceCompositorSetSystemConfigWithMask();
+int APS5_VABI sceCompositorSetVideoOutMode();
+int APS5_VABI sceCompositorSetVirtualCanvasAgcContextCommand();
+int APS5_VABI sceCompositorSetVirtualCanvasCommandFooter();
+int APS5_VABI sceCompositorSetVirtualCanvasPatchCommand();
+int APS5_VABI sceCompositorSetVrMode();
+int APS5_VABI sceCompositorSetZoomCommand();
+int APS5_VABI sceCompositorSystemConfig();
+int APS5_VABI sceCompositorWaitEndOfRendering();
+int APS5_VABI sceCompositorWaitEvent();
+int APS5_VABI sceCompositorWaitPostEvent();
+int APS5_VABI sceCompsoitorGetGpuClock();
+int APS5_VABI sceCompsoitorGetProcessRenderingTime();
+int APS5_VABI sceCompsoitorGetRenderingTime();
+
+}
diff --git a/core/libs/prx/libSceComposite/libSceComposite.hpp b/core/libs/prx/libSceComposite/libSceComposite.hpp
new file mode 100644
index 0000000000..2829781c84
--- /dev/null
+++ b/core/libs/prx/libSceComposite/libSceComposite.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceComposite/include/Api.hpp"
diff --git a/core/libs/prx/libSceCompositeExt/libSceCompositeExt.hpp b/core/libs/prx/libSceCompositeExt/libSceCompositeExt.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCompositeExt/libSceCompositeExt.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceConnectAccountDialog/libSceConnectAccountDialog.hpp b/core/libs/prx/libSceConnectAccountDialog/libSceConnectAccountDialog.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceConnectAccountDialog/libSceConnectAccountDialog.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceContentDelete/Export.cpp b/core/libs/prx/libSceContentDelete/Export.cpp
index 5f886b22a4..ecd7c66372 100644
--- a/core/libs/prx/libSceContentDelete/Export.cpp
+++ b/core/libs/prx/libSceContentDelete/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceContentDelete/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceContentDelete/include/Api.hpp b/core/libs/prx/libSceContentDelete/include/Api.hpp
new file mode 100644
index 0000000000..cabb8b7ac2
--- /dev/null
+++ b/core/libs/prx/libSceContentDelete/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceContentDeleteInitialize(const ContentDeleteInitParam* initParam);
+int APS5_VABI sceContentDeleteByPath(const char* contentPath);
+int APS5_VABI sceContentDeleteById(std::int64_t contentId);
+int APS5_VABI sceContentDeleteByIdListForSf(const std::int64_t* contentIds, std::size_t count);
+int APS5_VABI sceContentDeleteGlobalMstat(void);
+int APS5_VABI sceContentDeleteMemoryInitialize(void);
+int APS5_VABI sceContentDeleteMemoryTerminate(void);
+int APS5_VABI sceContentDeleteTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceContentDelete/libSceContentDelete.hpp b/core/libs/prx/libSceContentDelete/libSceContentDelete.hpp
new file mode 100644
index 0000000000..5fc5f90294
--- /dev/null
+++ b/core/libs/prx/libSceContentDelete/libSceContentDelete.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceContentDelete/include/Api.hpp"
diff --git a/core/libs/prx/libSceContentExport/Export.cpp b/core/libs/prx/libSceContentExport/Export.cpp
index 0c5b205edf..975349f1e5 100644
--- a/core/libs/prx/libSceContentExport/Export.cpp
+++ b/core/libs/prx/libSceContentExport/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceContentExport/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceContentExport/include/Api.hpp b/core/libs/prx/libSceContentExport/include/Api.hpp
new file mode 100644
index 0000000000..97edfa3e73
--- /dev/null
+++ b/core/libs/prx/libSceContentExport/include/Api.hpp
@@ -0,0 +1,30 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceContentExportInit2(const ContentExportInitParam2* initParam);
+int APS5_VABI sceContentExportFinish(std::int32_t expId);
+int APS5_VABI sceContentExportFromData(std::int32_t expId, const ContentExportParam* param, std::size_t contentLength, ContentExportDataCallback callback, void* userData, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFile(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFileWithThumbnail(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportAddToFavorites(std::int64_t contentId);
+int APS5_VABI sceContentExportDataProvideFunction(void);
+int APS5_VABI sceContentExportFree(void);
+int APS5_VABI sceContentExportFrom(void);
+int APS5_VABI sceContentExportFromFileForSf(std::int32_t expId, const ContentExportParam* param, const ContentExportSfParam* sfParam, const char* sourcePath, const char* thumbnailPath, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFileWithContentIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const std::int64_t* contentIds, std::uint32_t contentCount, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportFromFileWithTitleIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const char* titleIdList, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportInit(const ContentExportInitParam* param);
+int APS5_VABI sceContentExportMalloc(void);
+int APS5_VABI sceContentExportRemoveFromFavorites(std::int64_t contentId);
+int APS5_VABI sceContentExportRenameContent(std::int64_t contentId, const char* name);
+int APS5_VABI sceContentExportValidateContents(const std::int64_t* contentIds, std::uint32_t count);
+int APS5_VABI sceContentExportStart(void);
+int APS5_VABI sceContentExportGetProgress(std::int32_t expId);
+int APS5_VABI sceContentExportCancel(std::int32_t expId);
+int APS5_VABI sceContentExportFromDataWithThumbnail(std::int32_t expId, const ContentExportParam* param, const ContentExportCallbackParam* contentCallbackParam, const char* thumbnailType, const ContentExportCallbackParam* thumbnailCallbackParam, char* path, std::size_t pathBufferLength);
+int APS5_VABI sceContentExportTerm(void);
+
+}
diff --git a/core/libs/prx/libSceContentExport/libSceContentExport.hpp b/core/libs/prx/libSceContentExport/libSceContentExport.hpp
new file mode 100644
index 0000000000..a7887a9290
--- /dev/null
+++ b/core/libs/prx/libSceContentExport/libSceContentExport.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceContentExport/include/Api.hpp"
diff --git a/core/libs/prx/libSceContentListController/libSceContentListController.hpp b/core/libs/prx/libSceContentListController/libSceContentListController.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceContentListController/libSceContentListController.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceContentSearch/Export.cpp b/core/libs/prx/libSceContentSearch/Export.cpp
index ac200672de..0fbd052c73 100644
--- a/core/libs/prx/libSceContentSearch/Export.cpp
+++ b/core/libs/prx/libSceContentSearch/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceContentSearch/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceContentSearch/include/Api.hpp b/core/libs/prx/libSceContentSearch/include/Api.hpp
new file mode 100644
index 0000000000..b54e8efb17
--- /dev/null
+++ b/core/libs/prx/libSceContentSearch/include/Api.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceContentSearchInit(const ContentSearchInitParam* initParam);
+int APS5_VABI sceContentSearchCloseMetadata(std::int32_t metadataId);
+int APS5_VABI sceContentSearchGetMetadataFieldInfo(std::int32_t metadataId, const char* field, std::int32_t* metadataType, std::int32_t* size);
+int APS5_VABI sceContentSearchGetMetadataValue(std::int32_t metadataId, const char* field, void* value);
+int APS5_VABI sceContentSearchOpenMetadata(const char* filePath, std::int32_t* metadataId);
+int APS5_VABI sceContentSearchSearchContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, const ContentSearchContentOrderByCondition* orderByConditions, std::uint32_t orderByConditionsLength, std::uint32_t offset, std::uint32_t limit, std::int64_t* numOfContent, void* infos, std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchGetContentLastUpdateId(std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchOpenMetadataByContentId(std::int64_t contentId, std::int32_t* metadataId);
+int APS5_VABI sceContentSearchGetTotalContentSize(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* size, std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchGetNumOfContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* numOfContent, std::int64_t* lastUpdateId);
+int APS5_VABI sceContentSearchTerm(void);
+int APS5_VABI sceContentBinderEnd();
+int APS5_VABI sceContentBinderGetNumOfDifference();
+int APS5_VABI sceContentBinderInitialize();
+int APS5_VABI sceContentBinderIsUpdated();
+int APS5_VABI sceContentBinderReset();
+int APS5_VABI sceContentBinderSearchDifference();
+int APS5_VABI sceContentBinderStart();
+int APS5_VABI sceContentBinderTerminate();
+int APS5_VABI sceContentSearchGetApplicationLastUpdateId();
+int APS5_VABI sceContentSearchGetMyApplicationIndex();
+int APS5_VABI sceContentSearchGetNumOfApplication();
+int APS5_VABI sceContentSearchSearchApplication();
+
+}
diff --git a/core/libs/prx/libSceContentSearch/libSceContentSearch.hpp b/core/libs/prx/libSceContentSearch/libSceContentSearch.hpp
new file mode 100644
index 0000000000..79d8740064
--- /dev/null
+++ b/core/libs/prx/libSceContentSearch/libSceContentSearch.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceContentSearch/include/Api.hpp"
diff --git a/core/libs/prx/libSceConvertKeycode/CMakeLists.txt b/core/libs/prx/libSceConvertKeycode/CMakeLists.txt
index d4f82eb5f7..341ff705b0 100644
--- a/core/libs/prx/libSceConvertKeycode/CMakeLists.txt
+++ b/core/libs/prx/libSceConvertKeycode/CMakeLists.txt
@@ -1,15 +1,41 @@
 add_library(libSceConvertKeycode SHARED EXCLUDE_FROM_ALL Export.cpp)
 target_include_directories(libSceConvertKeycode PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceConvertKeycode PRIVATE libSceUserService)
 configure_windows_unwind(libSceConvertKeycode)
 
 if(BUILD_TESTING)
     add_test_executable(guest_convert_keycode_tests ${LIBS_INCLUDE_DIR}/tests/GuestConvertKeycode.cpp)
     target_include_directories(guest_convert_keycode_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_convert_keycode_tests PRIVATE libSceConvertKeycode libc)
+    target_link_libraries(guest_convert_keycode_tests PRIVATE libSceConvertKeycode libSceUserService libSceSystemService libc)
     configure_windows_unwind(guest_convert_keycode_tests)
     add_test(NAME guest_convert_keycode COMMAND guest_convert_keycode_tests)
     if(WIN32)
         set_tests_properties(guest_convert_keycode PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceConvertKeycode>")
     endif()
+    add_test_executable(guest_convert_keycode_title_tests ${LIBS_INCLUDE_DIR}/tests/GuestConvertKeycodeTitle.cpp)
+    target_include_directories(guest_convert_keycode_title_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_convert_keycode_title_tests PRIVATE libSceConvertKeycode libSceUserService libSceSystemService libc)
+    configure_windows_unwind(guest_convert_keycode_title_tests)
+    string(REPEAT "T" 130 convertKeycodeLongTitle)
+    foreach(titleCase IN ITEMS oversized-id oversized-title cusa ppsa malformed-json missing)
+        set(titleRun ${CMAKE_CURRENT_BINARY_DIR}/convert_keycode_title_${titleCase})
+        file(REMOVE_RECURSE ${titleRun})
+        file(MAKE_DIRECTORY ${titleRun})
+        if(titleCase STREQUAL "oversized-id")
+            file(WRITE ${titleRun}/app0/sce_sys/param.json "{\"titleId\": \"CUSA0123456789012345\", \"localizedParameters\": {\"en-US\": {\"titleName\": \"Fixture\"}}}")
+        elseif(titleCase STREQUAL "oversized-title")
+            file(WRITE ${titleRun}/app0/sce_sys/param.json "{\"titleId\": \"PPSA00000\", \"localizedParameters\": {\"en-US\": {\"titleName\": \"${convertKeycodeLongTitle}\"}}}")
+        elseif(titleCase STREQUAL "cusa" OR titleCase STREQUAL "ppsa")
+            string(TOUPPER ${titleCase} titlePrefix)
+            file(WRITE ${titleRun}/app0/sce_sys/param.json "{\"titleId\": \"${titlePrefix}00000\", \"localizedParameters\": {\"en-US\": {\"titleName\": \"Fixture\"}}}")
+        elseif(titleCase STREQUAL "malformed-json")
+            file(WRITE ${titleRun}/app0/sce_sys/param.json "{")
+        endif()
+        add_test(NAME guest_convert_keycode_title_${titleCase} COMMAND guest_convert_keycode_title_tests WORKING_DIRECTORY ${titleRun})
+        if(WIN32)
+            set_tests_properties(guest_convert_keycode_title_${titleCase} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceConvertKeycode>")
+        endif()
+    endforeach()
 endif()
diff --git a/core/libs/prx/libSceConvertKeycode/Export.cpp b/core/libs/prx/libSceConvertKeycode/Export.cpp
index a38cb0293c..f96e2deca1 100644
--- a/core/libs/prx/libSceConvertKeycode/Export.cpp
+++ b/core/libs/prx/libSceConvertKeycode/Export.cpp
@@ -1,12 +1,19 @@
+#include "prx/libSceConvertKeycode/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <array>
+#include <cstddef>
 #include <cstdint>
+#include <cstring>
 #include <stdexcept>
 #include "SceTypes.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libSceConvertKeycode/ImeKeyboardType.hpp"
+#include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
+#include <string_view>
 
 namespace {
 constexpr int kErrInvalidAddress = static_cast<int>(0x80BC0031u);
-constexpr int kErrInvalidUserId = static_cast<int>(0x80BC0010u);
 constexpr std::array<std::uint16_t, 256> BaseVirtualKeys = {
     255, 255, 255, 255, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76,
     77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 49, 50,
@@ -2295,7 +2302,6 @@ constexpr std::array<char16_t, 27> KoreanFinal = {
     12593, 12594, 12595, 12596, 12597, 12598, 12599, 12601, 12602, 12603, 12604, 12605, 12606, 12607, 12608, 12609, 12610, 12612, 12613, 12614, 12615, 12616, 12618, 12619, 12620, 12621, 12622
 };
 
-
 std::size_t CharacterLayout(std::uint32_t type, std::uint32_t state) {
     constexpr std::array<std::uint8_t, 39> layouts = {18, 7, 0, 1, 14, 8, 29, 17, 9, 25, 24, 23, 10, 11, 16, 26, 27, 12, 1, 19, 28, 3, 3, 1, 1, 1, 1, 1, 1, 1, 14, 32, 14, 34, 35, 36, 37, 1, 1};
     const bool imeMode = (state & 0x4000000u) != 0;
@@ -2393,14 +2399,26 @@ char16_t ConvertCharacter(std::uint16_t keycode, std::uint32_t state, std::uint3
     }
     return character;
 }
+bool Ps4Client() {
+    try {
+        const auto titleId = GetAppTitleId_nid_postfix();
+        return ImeKeyboardType::IsPs4TitleId(std::string_view(titleId.value, strnlen(titleId.value, sizeof(titleId.value))));
+    } catch (const std::runtime_error&) {
+        return false;
+    } catch (const std::length_error&) {
+        return false;
+    }
+}
 }  // namespace
 
 extern "C" {
 
 int APS5_VABI sceConvertKeycodeGetImeKeyboardType(int32_t userId, uint32_t* type) {
- if (type == nullptr) return kErrInvalidAddress;
- if (userId < 0) return kErrInvalidUserId;
- throw std::runtime_error("sceConvertKeycodeGetImeKeyboardType: user keyboard language and variant are unavailable");
+    const bool ps4Client = Ps4Client();
+    const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t sdkVersion;
+    std::memcpy(&sdkVersion, process + 16, sizeof(sdkVersion));
+    return ImeKeyboardType::Resolve(userId, type, sdkVersion, ps4Client, sceUserServiceGetKeyboardType, sceUserServiceGetJapaneseInputType, sceUserServiceGetTraditionalChineseInputType);
 }
 int APS5_VABI sceConvertKeycodeGetVirtualKeycode(std::uint16_t keycode, std::uint32_t keyboardType, std::uint16_t* virtualKeycode) {
     if (virtualKeycode == nullptr) return kErrInvalidAddress;
diff --git a/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp b/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
new file mode 100644
index 0000000000..4ace3c252c
--- /dev/null
+++ b/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
@@ -0,0 +1,71 @@
+#ifndef CORE_LIBS_PRX_LIBSCECONVERTKEYCODE_IMEKEYBOARDTYPE_HPP
+#define CORE_LIBS_PRX_LIBSCECONVERTKEYCODE_IMEKEYBOARDTYPE_HPP
+
+#include <cstdint>
+#include <string_view>
+
+// sceConvertKeycodeGetImeKeyboardType: the UserService keyboard type (plus the Japanese and Traditional Chinese
+// input variants) to IME keyboard type mapping and the SDK compatibility rules, as specified by the repository
+// owner (see docs/dev/debt/libSceConvertKeycode.md). Header-only so the guest test drives every row and error path
+// with fake UserService getters.
+namespace ImeKeyboardType {
+
+constexpr int kErrInvalidAddress = static_cast<int>(0x80BC0031u);
+constexpr int kErrInvalidUserId = static_cast<int>(0x80BC0010u);
+constexpr int kErrGeneric = static_cast<int>(0x80BC00FFu);
+constexpr int kUserServiceUnknownUser = static_cast<int>(0x80960105u);
+
+constexpr std::int32_t kJapaneseKeyboard = 37;
+constexpr std::int32_t kTraditionalChineseKeyboard = 39;
+
+// Index = UserService keyboard type - 16. Types 37 and 39 are resolved through their variants; 0 = no mapping.
+constexpr std::int32_t kFirstMappedType = 16;
+constexpr std::uint32_t kImeTypeByKeyboardType[] = {
+    1, 2, 3, 5, 4, 6, 7, 8, 10, 11, 9, 12, 13, 14, 15, 16, 17, 18, 19, 20,  // 16..35
+    21, 0, 24, 0, 25, 30, 31, 33, 32, 34, 35, 36, 37, 38,                    // 36..49 (37 and 39 are variants)
+};
+constexpr std::int32_t kMappedTypeCount = static_cast<std::int32_t>(sizeof(kImeTypeByKeyboardType) / sizeof(kImeTypeByKeyboardType[0]));
+
+constexpr std::uint32_t LookUp(std::int32_t keyboardType, std::int32_t japaneseVariant, std::int32_t traditionalChineseVariant) {
+    if (keyboardType == kJapaneseKeyboard) {
+        constexpr std::uint32_t japanese[] = {22, 23};
+        return japaneseVariant >= 0 && japaneseVariant < 2 ? japanese[japaneseVariant] : 0;
+    }
+    if (keyboardType == kTraditionalChineseKeyboard) {
+        constexpr std::uint32_t traditionalChinese[] = {26, 27, 28, 29, 39};
+        return traditionalChineseVariant >= 0 && traditionalChineseVariant < 5 ? traditionalChinese[traditionalChineseVariant] : 0;
+    }
+    const std::int32_t index = keyboardType - kFirstMappedType;
+    return index >= 0 && index < kMappedTypeCount ? kImeTypeByKeyboardType[index] : 0;
+}
+
+// Applied after the lookup. 38 -> 4 below PS5 SDK 0x06000000 / PS4 SDK 0x10000000; 39 -> 29 below PS5 SDK 0x08000000
+// and for every PS4 client.
+constexpr std::uint32_t ApplySdkCompatibility(std::uint32_t imeType, std::uint32_t sdkVersion, bool ps4Client) {
+    if (imeType == 38 && sdkVersion < (ps4Client ? 0x10000000u : 0x06000000u)) return 4;
+    if (imeType == 39 && (ps4Client || sdkVersion < 0x08000000u)) return 29;
+    return imeType;
+}
+
+constexpr bool IsPs4TitleId(std::string_view titleId) {
+    return titleId.substr(0, 4) == "CUSA";
+}
+
+template <typename GetKeyboardType, typename GetJapaneseInputType, typename GetTraditionalChineseInputType>
+int Resolve(std::int32_t userId, std::uint32_t* type, std::uint32_t sdkVersion, bool ps4Client, GetKeyboardType getKeyboardType, GetJapaneseInputType getJapaneseInputType, GetTraditionalChineseInputType getTraditionalChineseInputType) {
+    if (type == nullptr) return kErrInvalidAddress;
+    std::int32_t keyboardType = 0;
+    const int result = getKeyboardType(userId, &keyboardType);
+    if (result == kUserServiceUnknownUser) return kErrInvalidUserId;
+    if (result != 0) return kErrGeneric;
+    std::int32_t japaneseVariant = 0;
+    std::int32_t traditionalChineseVariant = 0;
+    if (keyboardType == kJapaneseKeyboard && getJapaneseInputType(userId, &japaneseVariant) != 0) japaneseVariant = 0;
+    if (keyboardType == kTraditionalChineseKeyboard && getTraditionalChineseInputType(userId, &traditionalChineseVariant) != 0) traditionalChineseVariant = 0;
+    *type = ApplySdkCompatibility(LookUp(keyboardType, japaneseVariant, traditionalChineseVariant), sdkVersion, ps4Client);
+    return 0;
+}
+
+}  // namespace ImeKeyboardType
+
+#endif
diff --git a/core/libs/prx/libSceConvertKeycode/include/Api.hpp b/core/libs/prx/libSceConvertKeycode/include/Api.hpp
new file mode 100644
index 0000000000..437b5117c5
--- /dev/null
+++ b/core/libs/prx/libSceConvertKeycode/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceConvertKeycodeGetImeKeyboardType(int32_t userId, uint32_t* type);
+int APS5_VABI sceConvertKeycodeGetVirtualKeycode(std::uint16_t keycode, std::uint32_t keyboardType, std::uint16_t* virtualKeycode);
+int APS5_VABI sceConvertKeycodeGetCharacterFromKeyboardData(const KeyboardData* keyData, std::int32_t index, std::uint32_t state, std::uint32_t keyboardType, char16_t* character);
+int APS5_VABI sceConvertKeycodeGetCharacter(std::uint16_t keycode, std::uint32_t state, std::uint32_t type, char16_t* character);
+
+}
diff --git a/core/libs/prx/libSceConvertKeycode/libSceConvertKeycode.hpp b/core/libs/prx/libSceConvertKeycode/libSceConvertKeycode.hpp
new file mode 100644
index 0000000000..45c6357f44
--- /dev/null
+++ b/core/libs/prx/libSceConvertKeycode/libSceConvertKeycode.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceConvertKeycode/include/Api.hpp"
diff --git a/core/libs/prx/libSceCtrlp/libSceCtrlp.hpp b/core/libs/prx/libSceCtrlp/libSceCtrlp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceCtrlp/libSceCtrlp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp b/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp
index a383508620..04ed029ae6 100644
--- a/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp
+++ b/core/libs/prx/libSceCustomMusicAudioOut/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCustomMusicAudioOut/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceCustomMusicAudioOut/include/Api.hpp b/core/libs/prx/libSceCustomMusicAudioOut/include/Api.hpp
new file mode 100644
index 0000000000..934f42befc
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicAudioOut/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCustomMusicAudioOutFinalize();
+int APS5_VABI sceCustomMusicAudioOutGetAllMusicVolume();
+int APS5_VABI sceCustomMusicAudioOutGetMuted();
+int APS5_VABI sceCustomMusicAudioOutGetVolume();
+int APS5_VABI sceCustomMusicAudioOutSetAllMusicVolume();
+
+}
diff --git a/core/libs/prx/libSceCustomMusicAudioOut/libSceCustomMusicAudioOut.hpp b/core/libs/prx/libSceCustomMusicAudioOut/libSceCustomMusicAudioOut.hpp
new file mode 100644
index 0000000000..387b464246
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicAudioOut/libSceCustomMusicAudioOut.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCustomMusicAudioOut/include/Api.hpp"
diff --git a/core/libs/prx/libSceCustomMusicCore/Export.cpp b/core/libs/prx/libSceCustomMusicCore/Export.cpp
index fa0c494e42..65b3aaccac 100644
--- a/core/libs/prx/libSceCustomMusicCore/Export.cpp
+++ b/core/libs/prx/libSceCustomMusicCore/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCustomMusicCore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceCustomMusicCore/include/Api.hpp b/core/libs/prx/libSceCustomMusicCore/include/Api.hpp
new file mode 100644
index 0000000000..478406741d
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicCore/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCustomMusicCoreBgmClose();
+int APS5_VABI sceCustomMusicCoreBgmOpen();
+int APS5_VABI sceCustomMusicCoreBgmOpen2();
+int APS5_VABI sceCustomMusicCoreBgmOutput();
+int APS5_VABI sceCustomMusicCoreBgmSetAudioVolume();
+int APS5_VABI sceCustomMusicCoreBgmStart();
+int APS5_VABI sceCustomMusicCoreBgmStop();
+int APS5_VABI sceCustomMusicCoreGetBgmAuthorityStatus();
+int APS5_VABI sceCustomMusicCoreGetHdcpStatus();
+int APS5_VABI sceCustomMusicCoreGetSystemAudioVolume();
+int APS5_VABI sceCustomMusicCorePostEvent();
+int APS5_VABI sceCustomMusicCoreSendEvent();
+int APS5_VABI sceCustomMusicCoreSendMulticastEvent();
+int APS5_VABI sceCustomMusicCoreSendSpMessage();
+int APS5_VABI sceCustomMusicCoreSetSystemAudioVolume();
+int APS5_VABI sceCustomMusicCoreStartOperation();
+int APS5_VABI sceCustomMusicCoreStartOperation2();
+int APS5_VABI sceCustomMusicCoreStopOperation();
+
+}
diff --git a/core/libs/prx/libSceCustomMusicCore/libSceCustomMusicCore.hpp b/core/libs/prx/libSceCustomMusicCore/libSceCustomMusicCore.hpp
new file mode 100644
index 0000000000..e7d4cf7206
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicCore/libSceCustomMusicCore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCustomMusicCore/include/Api.hpp"
diff --git a/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp b/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp
index ee9009496a..e64d1e4444 100644
--- a/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp
+++ b/core/libs/prx/libSceCustomMusicSysCallWrapper/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCustomMusicSysCallWrapper/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceCustomMusicSysCallWrapper/include/Api.hpp b/core/libs/prx/libSceCustomMusicSysCallWrapper/include/Api.hpp
new file mode 100644
index 0000000000..63ad57d532
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicSysCallWrapper/include/Api.hpp
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceCustomMusicSelect();
+
+}
diff --git a/core/libs/prx/libSceCustomMusicSysCallWrapper/libSceCustomMusicSysCallWrapper.hpp b/core/libs/prx/libSceCustomMusicSysCallWrapper/libSceCustomMusicSysCallWrapper.hpp
new file mode 100644
index 0000000000..22ad944a67
--- /dev/null
+++ b/core/libs/prx/libSceCustomMusicSysCallWrapper/libSceCustomMusicSysCallWrapper.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceCustomMusicSysCallWrapper/include/Api.hpp"
diff --git a/core/libs/prx/libSceDataTransfer/Export.cpp b/core/libs/prx/libSceDataTransfer/Export.cpp
index 43fb2a1574..5c993b6dfb 100644
--- a/core/libs/prx/libSceDataTransfer/Export.cpp
+++ b/core/libs/prx/libSceDataTransfer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDataTransfer/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDataTransfer/include/Api.hpp b/core/libs/prx/libSceDataTransfer/include/Api.hpp
new file mode 100644
index 0000000000..f04a12fef4
--- /dev/null
+++ b/core/libs/prx/libSceDataTransfer/include/Api.hpp
@@ -0,0 +1,68 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDataTransferAbortFgTransfer();
+int APS5_VABI sceDataTransferAbortRequest();
+int APS5_VABI sceDataTransferAbortSearchPS4();
+int APS5_VABI sceDataTransferCheckBgTransferRunning();
+int APS5_VABI sceDataTransferGetFgTransferProgress();
+int APS5_VABI sceDataTransferGetPrepareFgTransferProgress();
+int APS5_VABI sceDataTransferInitialize();
+int APS5_VABI sceDataTransferRequestGetAppInfoPS4();
+int APS5_VABI sceDataTransferRequestGetSavedataInfoPS4();
+int APS5_VABI sceDataTransferRequestGetUsersPS4();
+int APS5_VABI sceDataTransferRequestLaunchPS4();
+int APS5_VABI sceDataTransferRequestPrepareFgTransfer();
+int APS5_VABI sceDataTransferRequestRebootAuthPS4();
+int APS5_VABI sceDataTransferRequestSearchPS4();
+int APS5_VABI sceDataTransferRequestStartFgTransfer();
+int APS5_VABI sceDataTransferRequestTransferTimePS4();
+int APS5_VABI sceDataTransferTargetAbortBindSavedata();
+int APS5_VABI sceDataTransferTargetAbortDeactivate();
+int APS5_VABI sceDataTransferTargetAbortEth0();
+int APS5_VABI sceDataTransferTargetAbortGetDeviceInfo();
+int APS5_VABI sceDataTransferTargetAbortGetDeviceInfoApplication();
+int APS5_VABI sceDataTransferTargetAbortGetTitles();
+int APS5_VABI sceDataTransferTargetAbortGetUsers();
+int APS5_VABI sceDataTransferTargetAbortLaunch();
+int APS5_VABI sceDataTransferTargetAbortPrepareTransfer();
+int APS5_VABI sceDataTransferTargetAbortPwrReq();
+int APS5_VABI sceDataTransferTargetAbortReboot();
+int APS5_VABI sceDataTransferTargetAbortSendSsoNew2Old();
+int APS5_VABI sceDataTransferTargetAbortSendSsoOld2New();
+int APS5_VABI sceDataTransferTargetAbortTransfer();
+int APS5_VABI sceDataTransferTargetAbortTransferSpeed();
+int APS5_VABI sceDataTransferTargetEventIsAuthReady();
+int APS5_VABI sceDataTransferTargetEventIsIPv6Ready();
+int APS5_VABI sceDataTransferTargetEventIsPwrReqReady();
+int APS5_VABI sceDataTransferTargetGetFailedUsers();
+int APS5_VABI sceDataTransferTargetGetRebootData();
+int APS5_VABI sceDataTransferTargetGetTransferProgress();
+int APS5_VABI sceDataTransferTargetRequestAbortSearch();
+int APS5_VABI sceDataTransferTargetRequestActivate();
+int APS5_VABI sceDataTransferTargetRequestAuth();
+int APS5_VABI sceDataTransferTargetRequestBindSavedata();
+int APS5_VABI sceDataTransferTargetRequestComplete();
+int APS5_VABI sceDataTransferTargetRequestCreateRebootData();
+int APS5_VABI sceDataTransferTargetRequestDeactivate();
+int APS5_VABI sceDataTransferTargetRequestEndTransfer();
+int APS5_VABI sceDataTransferTargetRequestGetDeviceInfo();
+int APS5_VABI sceDataTransferTargetRequestGetDeviceInfoApplication();
+int APS5_VABI sceDataTransferTargetRequestGetTitles();
+int APS5_VABI sceDataTransferTargetRequestGetUsers();
+int APS5_VABI sceDataTransferTargetRequestLaunch();
+int APS5_VABI sceDataTransferTargetRequestPrepareTransfer();
+int APS5_VABI sceDataTransferTargetRequestPrepareTransferProgress();
+int APS5_VABI sceDataTransferTargetRequestPwrReq();
+int APS5_VABI sceDataTransferTargetRequestReboot();
+int APS5_VABI sceDataTransferTargetRequestSearch();
+int APS5_VABI sceDataTransferTargetRequestSendSsoNew2Old();
+int APS5_VABI sceDataTransferTargetRequestSendSsoOld2New();
+int APS5_VABI sceDataTransferTargetRequestStartTransfer();
+int APS5_VABI sceDataTransferTargetRequestTransferSpeed();
+int APS5_VABI sceDataTransferTerminate();
+
+}
diff --git a/core/libs/prx/libSceDataTransfer/libSceDataTransfer.hpp b/core/libs/prx/libSceDataTransfer/libSceDataTransfer.hpp
new file mode 100644
index 0000000000..dfa5f26f82
--- /dev/null
+++ b/core/libs/prx/libSceDataTransfer/libSceDataTransfer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDataTransfer/include/Api.hpp"
diff --git a/core/libs/prx/libSceDbg/libSceDbg.hpp b/core/libs/prx/libSceDbg/libSceDbg.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDbg/libSceDbg.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDbgAssist/libSceDbgAssist.hpp b/core/libs/prx/libSceDbgAssist/libSceDbgAssist.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDbgAssist/libSceDbgAssist.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp b/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp
index f2bbed9a32..dcd840a54c 100644
--- a/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp
+++ b/core/libs/prx/libSceDbgThreadSanitizer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDbgThreadSanitizer/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceDbgThreadSanitizer/include/Api.hpp b/core/libs/prx/libSceDbgThreadSanitizer/include/Api.hpp
new file mode 100644
index 0000000000..0e19a53fdc
--- /dev/null
+++ b/core/libs/prx/libSceDbgThreadSanitizer/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+void APS5_VABI __tsan_acquire(void*);
+void APS5_VABI __tsan_release(void*);
+
+}
diff --git a/core/libs/prx/libSceDbgThreadSanitizer/libSceDbgThreadSanitizer.hpp b/core/libs/prx/libSceDbgThreadSanitizer/libSceDbgThreadSanitizer.hpp
new file mode 100644
index 0000000000..e6ff7c3d4b
--- /dev/null
+++ b/core/libs/prx/libSceDbgThreadSanitizer/libSceDbgThreadSanitizer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDbgThreadSanitizer/include/Api.hpp"
diff --git a/core/libs/prx/libSceDeci5/libSceDeci5.hpp b/core/libs/prx/libSceDeci5/libSceDeci5.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5/libSceDeci5.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Appmp/libSceDeci5Appmp.hpp b/core/libs/prx/libSceDeci5Appmp/libSceDeci5Appmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Appmp/libSceDeci5Appmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5CpComm/libSceDeci5CpComm.hpp b/core/libs/prx/libSceDeci5CpComm/libSceDeci5CpComm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5CpComm/libSceDeci5CpComm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Ctrlp/libSceDeci5Ctrlp.hpp b/core/libs/prx/libSceDeci5Ctrlp/libSceDeci5Ctrlp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Ctrlp/libSceDeci5Ctrlp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Dbgp/libSceDeci5Dbgp.hpp b/core/libs/prx/libSceDeci5Dbgp/libSceDeci5Dbgp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Dbgp/libSceDeci5Dbgp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Drfp/libSceDeci5Drfp.hpp b/core/libs/prx/libSceDeci5Drfp/libSceDeci5Drfp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Drfp/libSceDeci5Drfp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Eventp/libSceDeci5Eventp.hpp b/core/libs/prx/libSceDeci5Eventp/libSceDeci5Eventp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Eventp/libSceDeci5Eventp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Fsmp/libSceDeci5Fsmp.hpp b/core/libs/prx/libSceDeci5Fsmp/libSceDeci5Fsmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Fsmp/libSceDeci5Fsmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Pgcmp/libSceDeci5Pgcmp.hpp b/core/libs/prx/libSceDeci5Pgcmp/libSceDeci5Pgcmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Pgcmp/libSceDeci5Pgcmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Rdrfp/libSceDeci5Rdrfp.hpp b/core/libs/prx/libSceDeci5Rdrfp/libSceDeci5Rdrfp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Rdrfp/libSceDeci5Rdrfp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Tsmp/libSceDeci5Tsmp.hpp b/core/libs/prx/libSceDeci5Tsmp/libSceDeci5Tsmp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Tsmp/libSceDeci5Tsmp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5Ttyp/libSceDeci5Ttyp.hpp b/core/libs/prx/libSceDeci5Ttyp/libSceDeci5Ttyp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5Ttyp/libSceDeci5Ttyp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDeci5UlpCommon/libSceDeci5UlpCommon.hpp b/core/libs/prx/libSceDeci5UlpCommon/libSceDeci5UlpCommon.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDeci5UlpCommon/libSceDeci5UlpCommon.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDepth/Export.cpp b/core/libs/prx/libSceDepth/Export.cpp
index edfa2e580e..58c40c04fd 100644
--- a/core/libs/prx/libSceDepth/Export.cpp
+++ b/core/libs/prx/libSceDepth/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDepth/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDepth/include/Api.hpp b/core/libs/prx/libSceDepth/include/Api.hpp
new file mode 100644
index 0000000000..fae208c300
--- /dev/null
+++ b/core/libs/prx/libSceDepth/include/Api.hpp
@@ -0,0 +1,46 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDepthCalculateRectificationInformation(void);
+int APS5_VABI sceDepthDisableHeteroMode(void);
+int APS5_VABI sceDepthEnableExtendedMode(void);
+int APS5_VABI sceDepthEnableHeteroMode(void);
+int APS5_VABI sceDepthEnableHeteroModeAndGenerateInformation(void);
+int APS5_VABI sceDepthGetCalibrationData(void);
+int APS5_VABI sceDepthGetImage(void);
+int APS5_VABI sceDepthGetRectificationInformation(void);
+int APS5_VABI sceDepthGetSrParameter(void);
+int APS5_VABI sceDepthHandCandidateTrackerGetResult(void);
+int APS5_VABI sceDepthHasCalibrationData(void);
+int APS5_VABI sceDepthHeadCandidateDetectorGetResults(void);
+int APS5_VABI sceDepthHeadCandidateTrackerGetResult(void);
+int APS5_VABI sceDepthHeadCandidateTrackerSetValidationInformation(void);
+int APS5_VABI sceDepthInitialize(void);
+int APS5_VABI sceDepthLoadCalibrationData(void);
+int APS5_VABI sceDepthQueryMemory(void);
+int APS5_VABI sceDepthSaveInternalBuffers(void);
+int APS5_VABI sceDepthSetCalibrationData(void);
+int APS5_VABI sceDepthSetCommands(void);
+int APS5_VABI sceDepthSetPostFilterParameter(void);
+int APS5_VABI sceDepthSetPreFilterParameter(void);
+int APS5_VABI sceDepthSetRectificationInformation(void);
+int APS5_VABI sceDepthSetRoi(void);
+int APS5_VABI sceDepthSetRoiset(void);
+int APS5_VABI sceDepthSetSrParameter(void);
+int APS5_VABI sceDepthSetSrTnrParameter(void);
+int APS5_VABI sceDepthSubmit(void);
+int APS5_VABI sceDepthTerminate(void);
+int APS5_VABI sceDepthUpdate(void);
+int APS5_VABI sceDepthValidateCurrentCalibrationData(void);
+int APS5_VABI sceDepthWaitAndExecutePostProcess(void);
+int APS5_VABI _sceDepthCalcHeteroAdjustParam();
+int APS5_VABI _sceDepthHeadCandidateTrackerGetInformation();
+int APS5_VABI _sceDepthHeadCandidateTrackerSetInformation();
+int APS5_VABI _sceDepthSetCameraFactoryCalibrationData();
+int APS5_VABI _sceDepthSetHeteroAdjustParam();
+int APS5_VABI _sceDepthSetHeteroMode();
+
+}
diff --git a/core/libs/prx/libSceDepth/libSceDepth.hpp b/core/libs/prx/libSceDepth/libSceDepth.hpp
new file mode 100644
index 0000000000..8899705618
--- /dev/null
+++ b/core/libs/prx/libSceDepth/libSceDepth.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDepth/include/Api.hpp"
diff --git a/core/libs/prx/libSceDepth2/Export.cpp b/core/libs/prx/libSceDepth2/Export.cpp
index d043a5728d..18a122f40c 100644
--- a/core/libs/prx/libSceDepth2/Export.cpp
+++ b/core/libs/prx/libSceDepth2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDepth2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDepth2/include/Api.hpp b/core/libs/prx/libSceDepth2/include/Api.hpp
new file mode 100644
index 0000000000..97193eee0c
--- /dev/null
+++ b/core/libs/prx/libSceDepth2/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDepth2GetImage(void);
+int APS5_VABI sceDepth2Initialize(void);
+int APS5_VABI sceDepth2QueryMemory(void);
+int APS5_VABI sceDepth2SaveInternalBuffers(void);
+int APS5_VABI sceDepth2SetCameraFactoryCalibrationData(void);
+int APS5_VABI sceDepth2SetCommand(void);
+int APS5_VABI sceDepth2SetRoi(void);
+int APS5_VABI sceDepth2Submit(void);
+int APS5_VABI sceDepth2Terminate(void);
+int APS5_VABI sceDepth2WaitAndExecutePostProcess(void);
+
+}
diff --git a/core/libs/prx/libSceDepth2/libSceDepth2.hpp b/core/libs/prx/libSceDepth2/libSceDepth2.hpp
new file mode 100644
index 0000000000..30a843bc1b
--- /dev/null
+++ b/core/libs/prx/libSceDepth2/libSceDepth2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDepth2/include/Api.hpp"
diff --git a/core/libs/prx/libSceDipsw/Export.cpp b/core/libs/prx/libSceDipsw/Export.cpp
index 3cddf792b2..a822968f7d 100644
--- a/core/libs/prx/libSceDipsw/Export.cpp
+++ b/core/libs/prx/libSceDipsw/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDipsw/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDipsw/include/Api.hpp b/core/libs/prx/libSceDipsw/include/Api.hpp
new file mode 100644
index 0000000000..655ebbc6de
--- /dev/null
+++ b/core/libs/prx/libSceDipsw/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceKernelCheckDipsw();
+int APS5_VABI sceKernelInitializeDipsw();
+int APS5_VABI sceKernelIsAssistMode();
+int APS5_VABI sceKernelIsDevelopmentMode();
+int APS5_VABI sceKernelIsDisableRazor();
+int APS5_VABI sceKernelReadDipswData();
+int APS5_VABI sceKernelSetDipsw();
+int APS5_VABI sceKernelUnsetDipsw();
+int APS5_VABI sceKernelWriteDipswData();
+
+}
diff --git a/core/libs/prx/libSceDipsw/libSceDipsw.hpp b/core/libs/prx/libSceDipsw/libSceDipsw.hpp
new file mode 100644
index 0000000000..6d1d472e8b
--- /dev/null
+++ b/core/libs/prx/libSceDipsw/libSceDipsw.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDipsw/include/Api.hpp"
diff --git a/core/libs/prx/libSceDiscId/Export.cpp b/core/libs/prx/libSceDiscId/Export.cpp
index ef0373a67b..33a87a4698 100644
--- a/core/libs/prx/libSceDiscId/Export.cpp
+++ b/core/libs/prx/libSceDiscId/Export.cpp
@@ -1,11 +1,9 @@
+#include "prx/libSceDiscId/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct DiscId;
-struct DiscId2;
-
 extern "C" {
 
 int APS5_VABI sceDiscIdGet(DiscId* discId) {
diff --git a/core/libs/prx/libSceDiscId/include/Api.hpp b/core/libs/prx/libSceDiscId/include/Api.hpp
new file mode 100644
index 0000000000..52b6039516
--- /dev/null
+++ b/core/libs/prx/libSceDiscId/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct DiscId;
+
+struct DiscId2;
+
+extern "C" {
+
+int APS5_VABI sceDiscIdGet(DiscId* discId);
+int APS5_VABI sceDiscIdGet2(DiscId2* discId, std::uint32_t flags);
+
+}
diff --git a/core/libs/prx/libSceDiscId/libSceDiscId.hpp b/core/libs/prx/libSceDiscId/libSceDiscId.hpp
new file mode 100644
index 0000000000..26273e4024
--- /dev/null
+++ b/core/libs/prx/libSceDiscId/libSceDiscId.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDiscId/include/Api.hpp"
diff --git a/core/libs/prx/libSceDiscMap/Export.cpp b/core/libs/prx/libSceDiscMap/Export.cpp
index 8fedde6365..7eea1e3999 100644
--- a/core/libs/prx/libSceDiscMap/Export.cpp
+++ b/core/libs/prx/libSceDiscMap/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDiscMap/include/Api.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceDiscMap/include/Api.hpp b/core/libs/prx/libSceDiscMap/include/Api.hpp
new file mode 100644
index 0000000000..392ba50981
--- /dev/null
+++ b/core/libs/prx/libSceDiscMap/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+std::int32_t APS5_VABI sceDiscMapIsRequestOnHDD(const char* path, std::int64_t offset, std::int64_t size, std::int32_t* result);
+std::int32_t APS5_VABI sceDiscMapUnknown_ioKMruft1ek(const char* path, std::int64_t offset, std::int64_t size, std::uint64_t* flags, std::uint64_t* out1, std::uint64_t* out2);
+int APS5_VABI sceDiscMapGetPackageSize(std::int64_t fflags, int* ret1, int* ret2);
+
+}
diff --git a/core/libs/prx/libSceDiscMap/libSceDiscMap.hpp b/core/libs/prx/libSceDiscMap/libSceDiscMap.hpp
new file mode 100644
index 0000000000..e380270d79
--- /dev/null
+++ b/core/libs/prx/libSceDiscMap/libSceDiscMap.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDiscMap/include/Api.hpp"
diff --git a/core/libs/prx/libSceDolbyVision/libSceDolbyVision.hpp b/core/libs/prx/libSceDolbyVision/libSceDolbyVision.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDolbyVision/libSceDolbyVision.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDseehx/Export.cpp b/core/libs/prx/libSceDseehx/Export.cpp
index 43fce06ef6..b54b261746 100644
--- a/core/libs/prx/libSceDseehx/Export.cpp
+++ b/core/libs/prx/libSceDseehx/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDseehx/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDseehx/include/Api.hpp b/core/libs/prx/libSceDseehx/include/Api.hpp
new file mode 100644
index 0000000000..de8de8649b
--- /dev/null
+++ b/core/libs/prx/libSceDseehx/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDseehxConvert();
+int APS5_VABI sceDseehxExtInit();
+int APS5_VABI sceDseehxFlush();
+int APS5_VABI sceDseehxInit();
+
+}
diff --git a/core/libs/prx/libSceDseehx/libSceDseehx.hpp b/core/libs/prx/libSceDseehx/libSceDseehx.hpp
new file mode 100644
index 0000000000..a70d9c176e
--- /dev/null
+++ b/core/libs/prx/libSceDseehx/libSceDseehx.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDseehx/include/Api.hpp"
diff --git a/core/libs/prx/libSceDtcpIp/libSceDtcpIp.hpp b/core/libs/prx/libSceDtcpIp/libSceDtcpIp.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceDtcpIp/libSceDtcpIp.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceDtsEnc/Export.cpp b/core/libs/prx/libSceDtsEnc/Export.cpp
index 06a9bc9f32..058fb9d21b 100644
--- a/core/libs/prx/libSceDtsEnc/Export.cpp
+++ b/core/libs/prx/libSceDtsEnc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceDtsEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceDtsEnc/include/Api.hpp b/core/libs/prx/libSceDtsEnc/include/Api.hpp
new file mode 100644
index 0000000000..c58f777bab
--- /dev/null
+++ b/core/libs/prx/libSceDtsEnc/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDtsEncCreateEncoder();
+int APS5_VABI sceDtsEncDeleteEncoder();
+int APS5_VABI sceDtsEncEncode();
+int APS5_VABI sceDtsEncEncodeAsync();
+int APS5_VABI sceDtsEncFlush();
+int APS5_VABI sceDtsEncIsEncoding();
+int APS5_VABI sceDtsEncWaitEncode();
+
+}
diff --git a/core/libs/prx/libSceDtsEnc/libSceDtsEnc.hpp b/core/libs/prx/libSceDtsEnc/libSceDtsEnc.hpp
new file mode 100644
index 0000000000..c8fe34a7d9
--- /dev/null
+++ b/core/libs/prx/libSceDtsEnc/libSceDtsEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceDtsEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceEditMp4/Export.cpp b/core/libs/prx/libSceEditMp4/Export.cpp
index 9bafeb8142..cc4aed4a43 100644
--- a/core/libs/prx/libSceEditMp4/Export.cpp
+++ b/core/libs/prx/libSceEditMp4/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceEditMp4/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceEditMp4/include/Api.hpp b/core/libs/prx/libSceEditMp4/include/Api.hpp
new file mode 100644
index 0000000000..219759f5bf
--- /dev/null
+++ b/core/libs/prx/libSceEditMp4/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceEditMp4Abort();
+int APS5_VABI sceEditMp4Edit();
+int APS5_VABI sceEditMp4GetStatus();
+int APS5_VABI sceEditMp4Initialize();
+int APS5_VABI sceEditMp4InitializeParam();
+int APS5_VABI sceEditMp4QueryMemSize();
+int APS5_VABI sceEditMp4SetFinishCallback();
+int APS5_VABI sceEditMp4Terminate();
+int APS5_VABI sceEditMp4Unite();
+
+}
diff --git a/core/libs/prx/libSceEditMp4/libSceEditMp4.hpp b/core/libs/prx/libSceEditMp4/libSceEditMp4.hpp
new file mode 100644
index 0000000000..d19448ddb3
--- /dev/null
+++ b/core/libs/prx/libSceEditMp4/libSceEditMp4.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceEditMp4/include/Api.hpp"
diff --git a/core/libs/prx/libSceEmbeddedTts/libSceEmbeddedTts.hpp b/core/libs/prx/libSceEmbeddedTts/libSceEmbeddedTts.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceEmbeddedTts/libSceEmbeddedTts.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceEmbeddedTtsCoreG3/libSceEmbeddedTtsCoreG3.hpp b/core/libs/prx/libSceEmbeddedTtsCoreG3/libSceEmbeddedTtsCoreG3.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceEmbeddedTtsCoreG3/libSceEmbeddedTtsCoreG3.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceErrorDialog/Export.cpp b/core/libs/prx/libSceErrorDialog/Export.cpp
index d3c922f2b1..5d6ed9d85e 100644
--- a/core/libs/prx/libSceErrorDialog/Export.cpp
+++ b/core/libs/prx/libSceErrorDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceErrorDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
diff --git a/core/libs/prx/libSceErrorDialog/include/Api.hpp b/core/libs/prx/libSceErrorDialog/include/Api.hpp
new file mode 100644
index 0000000000..3b12339095
--- /dev/null
+++ b/core/libs/prx/libSceErrorDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceErrorDialogInitialize(void);
+int APS5_VABI sceErrorDialogOpen(const void* param);
+int APS5_VABI sceErrorDialogUpdateStatus(void);
+int APS5_VABI sceErrorDialogGetStatus(void);
+int APS5_VABI sceErrorDialogClose(void);
+int APS5_VABI sceErrorDialogTerminate(void);
+int APS5_VABI sceErrorDialogOpenDetail();
+int APS5_VABI sceErrorDialogOpenWithReport();
+
+}
diff --git a/core/libs/prx/libSceErrorDialog/libSceErrorDialog.hpp b/core/libs/prx/libSceErrorDialog/libSceErrorDialog.hpp
new file mode 100644
index 0000000000..9681a99ea5
--- /dev/null
+++ b/core/libs/prx/libSceErrorDialog/libSceErrorDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceErrorDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceEsvm/Export.cpp b/core/libs/prx/libSceEsvm/Export.cpp
index 54def11467..cbef694c99 100644
--- a/core/libs/prx/libSceEsvm/Export.cpp
+++ b/core/libs/prx/libSceEsvm/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceEsvm/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceEsvm/include/Api.hpp b/core/libs/prx/libSceEsvm/include/Api.hpp
new file mode 100644
index 0000000000..d11b339d0e
--- /dev/null
+++ b/core/libs/prx/libSceEsvm/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceEsvmAppAudioSyncCreateContext();
+int APS5_VABI sceEsvmAppAudioSyncFlush();
+int APS5_VABI sceEsvmSyncVideo();
+
+}
diff --git a/core/libs/prx/libSceEsvm/libSceEsvm.hpp b/core/libs/prx/libSceEsvm/libSceEsvm.hpp
new file mode 100644
index 0000000000..015c133208
--- /dev/null
+++ b/core/libs/prx/libSceEsvm/libSceEsvm.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceEsvm/include/Api.hpp"
diff --git a/core/libs/prx/libSceEsvmEngine/Export.cpp b/core/libs/prx/libSceEsvmEngine/Export.cpp
index 6667c6812b..1ffc3f6398 100644
--- a/core/libs/prx/libSceEsvmEngine/Export.cpp
+++ b/core/libs/prx/libSceEsvmEngine/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceEsvmEngine/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceEsvmEngine/include/Api.hpp b/core/libs/prx/libSceEsvmEngine/include/Api.hpp
new file mode 100644
index 0000000000..a99c298234
--- /dev/null
+++ b/core/libs/prx/libSceEsvmEngine/include/Api.hpp
@@ -0,0 +1,27 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceEsvmEngineDestroyMediaKeySystemAccess();
+int APS5_VABI sceEsvmEngineMediaKeySessionClose();
+int APS5_VABI sceEsvmEngineMediaKeySessionGenerateRequest();
+int APS5_VABI sceEsvmEngineMediaKeySessionGetExpiration();
+int APS5_VABI sceEsvmEngineMediaKeySessionGetKeyStatuses();
+int APS5_VABI sceEsvmEngineMediaKeySessionGetSessionId();
+int APS5_VABI sceEsvmEngineMediaKeySessionLoad();
+int APS5_VABI sceEsvmEngineMediaKeySessionRemove();
+int APS5_VABI sceEsvmEngineMediaKeySessionSetEventHandler();
+int APS5_VABI sceEsvmEngineMediaKeySessionUpdate();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessCreateMediaKeys();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessDestroyMediaKeys();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessGetConfiguration();
+int APS5_VABI sceEsvmEngineMediaKeySystemAccessSetCdmStorageConfig();
+int APS5_VABI sceEsvmEngineMediaKeysCreateSession();
+int APS5_VABI sceEsvmEngineMediaKeysDestroySession();
+int APS5_VABI sceEsvmEngineMediaKeysSetEventHandler();
+int APS5_VABI sceEsvmEngineMediaKeysSetServerCertificate();
+int APS5_VABI sceEsvmEngineRequestMediaKeySystemAccess();
+
+}
diff --git a/core/libs/prx/libSceEsvmEngine/libSceEsvmEngine.hpp b/core/libs/prx/libSceEsvmEngine/libSceEsvmEngine.hpp
new file mode 100644
index 0000000000..c8bc3ef97c
--- /dev/null
+++ b/core/libs/prx/libSceEsvmEngine/libSceEsvmEngine.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceEsvmEngine/include/Api.hpp"
diff --git a/core/libs/prx/libSceFiber/Export.cpp b/core/libs/prx/libSceFiber/Export.cpp
index 54b0930521..4d3e54f5f4 100644
--- a/core/libs/prx/libSceFiber/Export.cpp
+++ b/core/libs/prx/libSceFiber/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFiber/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -36,8 +37,11 @@ static constexpr std::size_t FIBER_MIN_CONTEXT_SIZE = 512;
 static constexpr std::uint64_t FIBER_CONTEXT_FILL = 0xdeadbeefdeadbeefull;
 static constexpr std::size_t FIBER_HOST_STACK_MARGIN = 1u << 20;
 static constexpr std::size_t FIBER_GUEST_STACK_MIN = 64u << 10;
-
-using GuestFiberEntry = FiberEntry;
+static constexpr std::uint32_t FIBER_FLAG_NO_ULOBJMGR = 0x1;
+static constexpr std::uint32_t FIBER_FLAG_CONTEXT_SIZE_CHECK = 0x10;
+static constexpr std::uint32_t FIBER_FLAG_SET_FPU_REGISTERS = 0x100;
+static constexpr std::uint32_t FIBER_DEFAULT_MXCSR = 0x9fc0;
+static constexpr std::uint16_t FIBER_DEFAULT_FPU_CONTROL = 0x037f;
 
 // A fiber that is switching away stays Suspending until its context is saved; whoever runs next
 // on that host thread publishes Suspended. Fibers migrate between threads, so a resumer must never
@@ -60,6 +64,7 @@ struct Fiber {
     void* savedStack;
     char name[FIBER_MAX_NAME_LENGTH + 1];
     bool contextSizeCheck;
+    bool setFpuRegisters;
     std::uint8_t* hostStack;
     std::uint64_t hostStackBytes;
 };
@@ -365,9 +370,13 @@ static void PrepareInitialStack(Fiber* fiber) {
     const auto top = reinterpret_cast<std::uintptr_t>(StackTop(fiber)) & ~static_cast<std::uintptr_t>(15);
     auto* frame = reinterpret_cast<InitialFrame*>(top - 256);
     std::memset(frame, 0, sizeof(*frame));
-    frame->mxcsr = _mm_getcsr();
-    std::uint16_t control = 0;
-    asm volatile("fnstcw %0" : "=m"(control));
+    std::uint16_t control = FIBER_DEFAULT_FPU_CONTROL;
+    if (fiber->setFpuRegisters) {
+        frame->mxcsr = FIBER_DEFAULT_MXCSR;
+    } else {
+        frame->mxcsr = _mm_getcsr();
+        asm volatile("fnstcw %0" : "=m"(control));
+    }
     frame->fpuControl = control;
     frame->r12 = reinterpret_cast<std::uint64_t>(fiber);
     frame->returnAddress = reinterpret_cast<std::uint64_t>(&Aps5FiberTrampoline_nid_no_patch);
@@ -383,12 +392,58 @@ static bool AcquireForResume(Fiber* target) {
         }
         if (state != FiberState::Idle && state != FiberState::Suspended) return false;
         if (target->state.compare_exchange_weak(state, FiberState::Running, std::memory_order_acq_rel)) {
-            if (state == FiberState::Idle) PrepareInitialStack(target);
+            if (state == FiberState::Idle) {
+                if (!target->context) {
+                    target->state.store(FiberState::Idle, std::memory_order_release);
+                    throw std::runtime_error(std::string("sceFiber: fiber '") + target->name + "' has no context; running a fiber on the stack of its caller is not supported");
+                }
+                PrepareInitialStack(target);
+            }
             return true;
         }
     }
 }
 
+static int32_t ValidateContext(const void* addr_context, uint64_t size_context) {
+    if (addr_context == nullptr && size_context != 0) return SCE_FIBER_ERROR_INVALID;
+    if ((reinterpret_cast<std::uintptr_t>(addr_context) & 15) != 0 || (size_context & 15) != 0) return SCE_FIBER_ERROR_ALIGNMENT;
+    if (addr_context != nullptr && size_context < FIBER_MIN_CONTEXT_SIZE) return SCE_FIBER_ERROR_RANGE;
+    return SCE_OK;
+}
+
+static void AttachStack(Fiber* fiber, void* addr_context, uint64_t size_context) {
+    fiber->context = static_cast<std::uint8_t*>(addr_context);
+    fiber->contextSize = size_context;
+    if (size_context < FIBER_GUEST_STACK_MIN) AllocateHostStack(fiber);
+    if (fiber->contextSizeCheck) {
+        auto* words = SizedWindow(fiber);
+        std::fill(words, words + size_context / sizeof(std::uint64_t), FIBER_CONTEXT_FILL);
+    }
+    PinStack(addr_context, size_context);
+}
+
+static void DetachStack(Fiber* fiber) {
+    if (!fiber->context) return;
+    UnpinStack(fiber->context, fiber->contextSize);
+    ReleaseHostStack(fiber);
+}
+
+static int32_t AcquireWithContext(Fiber* target, void* addr_context, uint64_t size_context) {
+    if (addr_context == nullptr && size_context == 0) return AcquireForResume(target) ? SCE_OK : SCE_FIBER_ERROR_STATE;
+    if (addr_context == nullptr) return SCE_FIBER_ERROR_INVALID;
+    if (const auto valid = ValidateContext(addr_context, size_context); valid != SCE_OK) return valid;
+    auto expected = FiberState::Idle;
+    if (!target->state.compare_exchange_strong(expected, FiberState::Running, std::memory_order_acq_rel)) return SCE_FIBER_ERROR_INVALID;
+    if (target->context) {
+        target->state.store(FiberState::Idle, std::memory_order_release);
+        return SCE_FIBER_ERROR_INVALID;
+    }
+    AttachStack(target, addr_context, size_context);
+    if (TraceFibers()) std::fprintf(stderr, "[fiber] attach %s context=%p+0x%llx\n", target->name, addr_context, static_cast<unsigned long long>(size_context));
+    PrepareInitialStack(target);
+    return SCE_OK;
+}
+
 static void Resume(Fiber* target, void** save, std::uint64_t argOnRun) {
     const auto* frame = static_cast<const InitialFrame*>(target->savedStack);
     if (frame->returnAddress == 0) {
@@ -405,58 +460,32 @@ static void Resume(Fiber* target, void** save, std::uint64_t argOnRun) {
     Aps5FiberSwitchStack_nid_no_patch(save, target->savedStack);
 }
 
-extern "C" {
-
-int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, const void* opt_param, uint32_t build_version) {
-    (void)opt_param;
-    (void)build_version;
+static int32_t InitializeFiber(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, uint32_t flags) {
     if (!object || !name || !entry) return SCE_FIBER_ERROR_NULL;
     if ((reinterpret_cast<std::uintptr_t>(object) & 7) != 0) return SCE_FIBER_ERROR_ALIGNMENT;
-    if (addr_context == nullptr && size_context != 0) return SCE_FIBER_ERROR_INVALID;
-    if ((reinterpret_cast<std::uintptr_t>(addr_context) & 15) != 0 || (size_context & 15) != 0) return SCE_FIBER_ERROR_ALIGNMENT;
-    if (addr_context == nullptr) return SCE_FIBER_ERROR_INVALID;
-    if (size_context < FIBER_MIN_CONTEXT_SIZE) return SCE_FIBER_ERROR_RANGE;
+    if (const auto valid = ValidateContext(addr_context, size_context); valid != SCE_OK) return valid;
+    if ((flags & ~(FIBER_FLAG_NO_ULOBJMGR | FIBER_FLAG_CONTEXT_SIZE_CHECK | FIBER_FLAG_SET_FPU_REGISTERS)) != 0) throw std::runtime_error("_sceFiberInitializeWithInternalOptionImpl: unsupported flags " + std::to_string(flags));
     auto* fiber = reinterpret_cast<Fiber*>(object);
-    if (fiber->magic == FIBER_MAGIC) {
-        UnpinStack(fiber->context, fiber->contextSize);
-        ReleaseHostStack(fiber);
-    }
+    if (fiber->magic == FIBER_MAGIC) DetachStack(fiber);
     std::memset(object, 0, FIBER_OBJECT_SIZE);
     fiber->magic = FIBER_MAGIC;
     fiber->state.store(FiberState::Idle, std::memory_order_relaxed);
     fiber->entry = entry;
     fiber->argOnInitialize = arg_on_initialize;
-    fiber->context = static_cast<std::uint8_t*>(addr_context);
-    fiber->contextSize = size_context;
     std::strncpy(fiber->name, name, FIBER_MAX_NAME_LENGTH);
-    if (size_context < FIBER_GUEST_STACK_MIN) AllocateHostStack(fiber);
-    fiber->contextSizeCheck = g_contextSizeCheck.load(std::memory_order_relaxed);
-    if (fiber->contextSizeCheck) {
-        auto* words = SizedWindow(fiber);
-        std::fill(words, words + size_context / sizeof(std::uint64_t), FIBER_CONTEXT_FILL);
-    }
-    PinStack(addr_context, size_context);
-    if (TraceFibers()) std::fprintf(stderr, "[fiber] init %s object=%p context=%p+0x%llx entry=%p\n", fiber->name, static_cast<void*>(object), addr_context, static_cast<unsigned long long>(size_context), reinterpret_cast<void*>(entry));
+    fiber->contextSizeCheck = g_contextSizeCheck.load(std::memory_order_relaxed) || (flags & FIBER_FLAG_CONTEXT_SIZE_CHECK) != 0;
+    fiber->setFpuRegisters = (flags & FIBER_FLAG_SET_FPU_REGISTERS) != 0;
+    if (addr_context) AttachStack(fiber, addr_context, size_context);
+    if (TraceFibers()) std::fprintf(stderr, "[fiber] init %s object=%p context=%p+0x%llx entry=%p flags=0x%x\n", fiber->name, static_cast<void*>(object), addr_context, static_cast<unsigned long long>(size_context), reinterpret_cast<void*>(entry), flags);
     return SCE_OK;
 }
 
-int32_t APS5_VABI sceFiberFinalize(FiberObject* object) {
-    auto* fiber = AsFiber(object);
-    if (!fiber) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
-    const auto state = fiber->state.load(std::memory_order_acquire);
-    if (state == FiberState::Running || state == FiberState::Suspending) return SCE_FIBER_ERROR_STATE;
-    fiber->magic = 0;
-    UnpinStack(fiber->context, fiber->contextSize);
-    ReleaseHostStack(fiber);
-    return SCE_OK;
-}
-
-int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_return) {
+static int32_t RunFiber(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_return, std::uint64_t threadFramePointer) {
     auto* fiber = AsFiber(object);
     if (!fiber) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
     if (ThreadState().current) return SCE_FIBER_ERROR_PERMISSION;
-    if (!AcquireForResume(fiber)) return SCE_FIBER_ERROR_STATE;
-    ThreadState().threadFramePointer = reinterpret_cast<std::uint64_t>(static_cast<void**>(__builtin_frame_address(0))[0]);
+    if (const auto acquired = AcquireWithContext(fiber, addr_context, size_context); acquired != SCE_OK) return acquired;
+    ThreadState().threadFramePointer = threadFramePointer;
     ThreadState().threadBounds = CurrentBounds();
     Resume(fiber, &ThreadState().threadStack, arg_on_run);
     CompletePendingSuspend();
@@ -465,12 +494,13 @@ int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t arg_on_r
     return SCE_OK;
 }
 
-int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
+static int32_t SwitchFiber(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
     auto* target = AsFiber(object);
     if (!target) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
     auto* self = ThreadState().current;
     if (!self) return SCE_FIBER_ERROR_PERMISSION;
-    if (target == self || !AcquireForResume(target)) return SCE_FIBER_ERROR_STATE;
+    if (target == self) return SCE_FIBER_ERROR_STATE;
+    if (const auto acquired = AcquireWithContext(target, addr_context, size_context); acquired != SCE_OK) return acquired;
     if (TraceFibers()) {
         auto** frame = static_cast<void**>(__builtin_frame_address(0));
         void* chain[6] = {};
@@ -489,6 +519,36 @@ int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t arg_on_run, uint6
     return SCE_OK;
 }
 
+static std::uint64_t CallerFramePointer(void* frame) {
+    return reinterpret_cast<std::uint64_t>(static_cast<void**>(frame)[0]);
+}
+
+extern "C" {
+
+int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, const void* opt_param, uint32_t build_version) {
+    (void)opt_param;
+    (void)build_version;
+    return InitializeFiber(object, name, entry, arg_on_initialize, addr_context, size_context, 0);
+}
+
+int32_t APS5_VABI sceFiberFinalize(FiberObject* object) {
+    auto* fiber = AsFiber(object);
+    if (!fiber) return object ? SCE_FIBER_ERROR_INVALID : SCE_FIBER_ERROR_NULL;
+    const auto state = fiber->state.load(std::memory_order_acquire);
+    if (state == FiberState::Running || state == FiberState::Suspending) return SCE_FIBER_ERROR_STATE;
+    fiber->magic = 0;
+    DetachStack(fiber);
+    return SCE_OK;
+}
+
+int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_return) {
+    return RunFiber(object, nullptr, 0, arg_on_run, arg_on_return, CallerFramePointer(__builtin_frame_address(0)));
+}
+
+int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
+    return SwitchFiber(object, nullptr, 0, arg_on_run, arg_on_run_out);
+}
+
 int32_t APS5_VABI sceFiberReturnToThread(uint64_t arg_on_return, uint64_t* arg_on_run) {
     auto* self = ThreadState().current;
     if (!self) return SCE_FIBER_ERROR_PERMISSION;
@@ -565,24 +625,18 @@ int32_t APS5_VABI sceFiberStopContextSizeCheck(void) {
     return g_contextSizeCheck.compare_exchange_strong(expected, false) ? SCE_OK : SCE_FIBER_ERROR_STATE;
 }
 
-int APS5_VABI _sceFiberAttachContextAndRun(FiberObject* fiber, void* addr_context, uint64_t size_context,
-                                          uint64_t arg_on_run, uint64_t* arg_on_return) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int32_t APS5_VABI _sceFiberAttachContextAndRun(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_return) {
+    return RunFiber(object, addr_context, size_context, arg_on_run, arg_on_return, CallerFramePointer(__builtin_frame_address(0)));
 }
 
-int APS5_VABI _sceFiberAttachContextAndSwitch(FiberObject* fiber, void* addr_context, uint64_t size_context,
-                                              uint64_t arg_on_run, uint64_t* arg_on_run_out) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int32_t APS5_VABI _sceFiberAttachContextAndSwitch(FiberObject* object, void* addr_context, uint64_t size_context, uint64_t arg_on_run, uint64_t* arg_on_run_out) {
+    return SwitchFiber(object, addr_context, size_context, arg_on_run, arg_on_run_out);
 }
 
-int APS5_VABI _sceFiberInitializeWithInternalOptionImpl(FiberObject* fiber, const char* name, GuestFiberEntry entry,
-                                                        uint64_t arg_on_initialize, void* addr_context,
-                                                        uint64_t size_context, const FiberOptParam* opt_param,
-                                                        uint32_t flags, uint32_t build_version) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int32_t APS5_VABI _sceFiberInitializeWithInternalOptionImpl(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, const FiberOptParam* opt_param, uint32_t flags, uint32_t build_version) {
+    (void)opt_param;
+    (void)build_version;
+    return InitializeFiber(object, name, entry, arg_on_initialize, addr_context, size_context, flags);
 }
 
 }
diff --git a/core/libs/prx/libSceFiber/include/Api.hpp b/core/libs/prx/libSceFiber/include/Api.hpp
new file mode 100644
index 0000000000..e9cef9744c
--- /dev/null
+++ b/core/libs/prx/libSceFiber/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using GuestFiberEntry = FiberEntry;
+
+extern "C" {
+
+int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t argOnInitialize, void* addrContext, uint64_t sizeContext, const void* optParam, uint32_t buildVersion);
+int32_t APS5_VABI sceFiberFinalize(FiberObject* object);
+int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject* object, uint64_t argOnRun, uint64_t* argOnReturn);
+int32_t APS5_VABI sceFiberSwitch(FiberObject* object, uint64_t argOnRun, uint64_t* argOnRunOut);
+int32_t APS5_VABI sceFiberReturnToThread(uint64_t argOnReturn, uint64_t* argOnRun);
+int32_t APS5_VABI sceFiberGetSelf(FiberObject** fiber);
+int32_t APS5_VABI sceFiberGetInfo(FiberObject* object, FiberInfo* fiberInfo);
+int32_t APS5_VABI sceFiberRename(FiberObject* object, const char* name);
+int32_t APS5_VABI sceFiberOptParamInitialize(FiberOptParam* optParam);
+int32_t APS5_VABI sceFiberGetThreadFramePointerAddress(uint64_t* addrFramePointer);
+int32_t APS5_VABI _sceFiberGetThreadFramePointerAddress(uint64_t* addrFramePointer);
+int32_t APS5_VABI sceFiberStartContextSizeCheck(uint32_t flags);
+int32_t APS5_VABI sceFiberStopContextSizeCheck(void);
+int32_t APS5_VABI _sceFiberAttachContextAndRun(FiberObject* object, void* addrContext, uint64_t sizeContext, uint64_t argOnRun, uint64_t* argOnReturn);
+int32_t APS5_VABI _sceFiberAttachContextAndSwitch(FiberObject* object, void* addrContext, uint64_t sizeContext, uint64_t argOnRun, uint64_t* argOnRunOut);
+int32_t APS5_VABI _sceFiberInitializeWithInternalOptionImpl(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t argOnInitialize, void* addrContext, uint64_t sizeContext, const FiberOptParam* optParam, uint32_t flags, uint32_t buildVersion);
+
+}
diff --git a/core/libs/prx/libSceFiber/libSceFiber.hpp b/core/libs/prx/libSceFiber/libSceFiber.hpp
new file mode 100644
index 0000000000..1a16c725b6
--- /dev/null
+++ b/core/libs/prx/libSceFiber/libSceFiber.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFiber/include/Api.hpp"
diff --git a/core/libs/prx/libSceFios2/Export.cpp b/core/libs/prx/libSceFios2/Export.cpp
index eeedc28190..b97176c204 100644
--- a/core/libs/prx/libSceFios2/Export.cpp
+++ b/core/libs/prx/libSceFios2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFios2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceFios2/include/Api.hpp b/core/libs/prx/libSceFios2/include/Api.hpp
new file mode 100644
index 0000000000..354858a01d
--- /dev/null
+++ b/core/libs/prx/libSceFios2/include/Api.hpp
@@ -0,0 +1,176 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceFiosArchiveGetDecompressorThreadCount();
+int APS5_VABI sceFiosArchiveGetMountBufferSize();
+int APS5_VABI sceFiosArchiveGetMountBufferSizeSync();
+int APS5_VABI sceFiosArchiveMount();
+int APS5_VABI sceFiosArchiveMountSync();
+int APS5_VABI sceFiosArchiveMountWithOrder();
+int APS5_VABI sceFiosArchiveMountWithOrderSync();
+int APS5_VABI sceFiosArchiveSetDecompressorThreadCount();
+int APS5_VABI sceFiosArchiveUnmount();
+int APS5_VABI sceFiosArchiveUnmountSync();
+int APS5_VABI sceFiosCacheContainsFileRangeSync();
+int APS5_VABI sceFiosCacheContainsFileSync();
+int APS5_VABI sceFiosCacheFlushFileRangeSync();
+int APS5_VABI sceFiosCacheFlushFileSync();
+int APS5_VABI sceFiosCacheFlushSync();
+int APS5_VABI sceFiosCachePrefetchFH();
+int APS5_VABI sceFiosCachePrefetchFHRange();
+int APS5_VABI sceFiosCachePrefetchFHRangeSync();
+int APS5_VABI sceFiosCachePrefetchFHSync();
+int APS5_VABI sceFiosCachePrefetchFile();
+int APS5_VABI sceFiosCachePrefetchFileRange();
+int APS5_VABI sceFiosCachePrefetchFileRangeSync();
+int APS5_VABI sceFiosCachePrefetchFileSync();
+int APS5_VABI sceFiosCancelAllOps();
+int APS5_VABI sceFiosClearTimeStamps();
+int APS5_VABI sceFiosCloseAllFiles();
+int APS5_VABI sceFiosDHClose();
+int APS5_VABI sceFiosDHCloseSync();
+int APS5_VABI sceFiosDHGetPath();
+int APS5_VABI sceFiosDHOpen();
+int APS5_VABI sceFiosDHOpenSync();
+int APS5_VABI sceFiosDHRead();
+int APS5_VABI sceFiosDHReadSync();
+int APS5_VABI sceFiosDLLInitialize();
+int APS5_VABI sceFiosDLLTerminate();
+int APS5_VABI sceFiosDateFromComponents();
+int APS5_VABI sceFiosDateGetCurrent();
+int APS5_VABI sceFiosDateToComponents();
+int APS5_VABI sceFiosDeallocatePassthruFH();
+int APS5_VABI sceFiosDebugDumpDH();
+int APS5_VABI sceFiosDebugDumpDate();
+int APS5_VABI sceFiosDebugDumpError();
+int APS5_VABI sceFiosDebugDumpFH();
+int APS5_VABI sceFiosDebugDumpOp();
+int APS5_VABI sceFiosDelete();
+int APS5_VABI sceFiosDeleteSync();
+int APS5_VABI sceFiosDirectoryCreate();
+int APS5_VABI sceFiosDirectoryCreateSync();
+int APS5_VABI sceFiosDirectoryCreateWithMode();
+int APS5_VABI sceFiosDirectoryCreateWithModeSync();
+int APS5_VABI sceFiosDirectoryDelete();
+int APS5_VABI sceFiosDirectoryDeleteSync();
+int APS5_VABI sceFiosDirectoryExists();
+int APS5_VABI sceFiosDirectoryExistsSync();
+int APS5_VABI sceFiosExists();
+int APS5_VABI sceFiosExistsSync();
+int APS5_VABI sceFiosFHClose();
+int APS5_VABI sceFiosFHCloseSync();
+int APS5_VABI sceFiosFHGetOpenParams();
+int APS5_VABI sceFiosFHGetPath();
+int APS5_VABI sceFiosFHGetSize();
+int APS5_VABI sceFiosFHOpen();
+int APS5_VABI sceFiosFHOpenSync();
+int APS5_VABI sceFiosFHOpenWithMode();
+int APS5_VABI sceFiosFHOpenWithModeSync();
+int APS5_VABI sceFiosFHPread();
+int APS5_VABI sceFiosFHPreadSync();
+int APS5_VABI sceFiosFHPreadv();
+int APS5_VABI sceFiosFHPreadvSync();
+int APS5_VABI sceFiosFHPwrite();
+int APS5_VABI sceFiosFHPwriteSync();
+int APS5_VABI sceFiosFHPwritev();
+int APS5_VABI sceFiosFHPwritevSync();
+int APS5_VABI sceFiosFHRead();
+int APS5_VABI sceFiosFHReadSync();
+int APS5_VABI sceFiosFHReadv();
+int APS5_VABI sceFiosFHReadvSync();
+int APS5_VABI sceFiosFHSeek();
+int APS5_VABI sceFiosFHStat();
+int APS5_VABI sceFiosFHStatSync();
+int APS5_VABI sceFiosFHSync();
+int APS5_VABI sceFiosFHSyncSync();
+int APS5_VABI sceFiosFHTell();
+int APS5_VABI sceFiosFHToFileno();
+int APS5_VABI sceFiosFHTruncate();
+int APS5_VABI sceFiosFHTruncateSync();
+int APS5_VABI sceFiosFHWrite();
+int APS5_VABI sceFiosFHWriteSync();
+int APS5_VABI sceFiosFHWritev();
+int APS5_VABI sceFiosFHWritevSync();
+int APS5_VABI sceFiosFileDelete();
+int APS5_VABI sceFiosFileDeleteSync();
+int APS5_VABI sceFiosFileExists();
+int APS5_VABI sceFiosFileExistsSync();
+int APS5_VABI sceFiosFileGetSize();
+int APS5_VABI sceFiosFileGetSizeSync();
+int APS5_VABI sceFiosFileRead();
+int APS5_VABI sceFiosFileReadSync();
+int APS5_VABI sceFiosFileTruncate();
+int APS5_VABI sceFiosFileTruncateSync();
+int APS5_VABI sceFiosFileWrite();
+int APS5_VABI sceFiosFileWriteSync();
+int APS5_VABI sceFiosFilenoToFH();
+int APS5_VABI sceFiosGetAllDHs();
+int APS5_VABI sceFiosGetAllFHs();
+int APS5_VABI sceFiosGetAllOps();
+int APS5_VABI sceFiosGetDefaultOpAttr();
+int APS5_VABI sceFiosGetGlobalDefaultOpAttr();
+int APS5_VABI sceFiosGetSuspendCount();
+int APS5_VABI sceFiosGetThreadDefaultOpAttr();
+int APS5_VABI sceFiosIOFilterAdd();
+int APS5_VABI sceFiosIOFilterCache();
+int APS5_VABI sceFiosIOFilterGetInfo();
+int APS5_VABI sceFiosIOFilterPsarcDearchiver();
+int APS5_VABI sceFiosIOFilterRemove();
+int APS5_VABI sceFiosInitialize();
+int APS5_VABI sceFiosIsIdle();
+int APS5_VABI sceFiosIsInitialized();
+int APS5_VABI sceFiosIsSuspended();
+int APS5_VABI sceFiosIsValidHandle();
+int APS5_VABI sceFiosOpCancel();
+int APS5_VABI sceFiosOpDelete();
+int APS5_VABI sceFiosOpGetActualCount();
+int APS5_VABI sceFiosOpGetAttr();
+int APS5_VABI sceFiosOpGetBuffer();
+int APS5_VABI sceFiosOpGetError();
+int APS5_VABI sceFiosOpGetOffset();
+int APS5_VABI sceFiosOpGetPath();
+int APS5_VABI sceFiosOpGetRequestCount();
+int APS5_VABI sceFiosOpIsCancelled();
+int APS5_VABI sceFiosOpIsDone();
+int APS5_VABI sceFiosOpReschedule();
+int APS5_VABI sceFiosOpRescheduleWithPriority();
+int APS5_VABI sceFiosOpSetBuffer();
+int APS5_VABI sceFiosOpSyncWait();
+int APS5_VABI sceFiosOpSyncWaitForIO();
+int APS5_VABI sceFiosOpWait();
+int APS5_VABI sceFiosOpWaitUntil();
+int APS5_VABI sceFiosOverlayAdd();
+int APS5_VABI sceFiosOverlayGetInfo();
+int APS5_VABI sceFiosOverlayGetList();
+int APS5_VABI sceFiosOverlayModify();
+int APS5_VABI sceFiosOverlayRemove();
+int APS5_VABI sceFiosOverlayResolveSync();
+int APS5_VABI sceFiosPathNormalize();
+int APS5_VABI sceFiosPathcmp();
+int APS5_VABI sceFiosPathncmp();
+int APS5_VABI sceFiosPrintTimeStamps();
+int APS5_VABI sceFiosPrintf();
+int APS5_VABI sceFiosRename();
+int APS5_VABI sceFiosRenameSync();
+int APS5_VABI sceFiosResolve();
+int APS5_VABI sceFiosResolveSync();
+int APS5_VABI sceFiosResume();
+int APS5_VABI sceFiosSaveTimeStamp();
+int APS5_VABI sceFiosSetGlobalDefaultOpAttr();
+int APS5_VABI sceFiosSetThreadDefaultOpAttr();
+int APS5_VABI sceFiosShutdownAndCancelOps();
+int APS5_VABI sceFiosStat();
+int APS5_VABI sceFiosStatSync();
+int APS5_VABI sceFiosSuspend();
+int APS5_VABI sceFiosTerminate();
+int APS5_VABI sceFiosTimeGetCurrent();
+int APS5_VABI sceFiosTimeIntervalFromNanoseconds();
+int APS5_VABI sceFiosTimeIntervalToNanoseconds();
+int APS5_VABI sceFiosTraceTimestamp();
+int APS5_VABI sceFiosUpdateParameters();
+int APS5_VABI sceFiosVprintf();
+
+}
diff --git a/core/libs/prx/libSceFios2/libSceFios2.hpp b/core/libs/prx/libSceFios2/libSceFios2.hpp
new file mode 100644
index 0000000000..5f164953f7
--- /dev/null
+++ b/core/libs/prx/libSceFios2/libSceFios2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFios2/include/Api.hpp"
diff --git a/core/libs/prx/libSceFont-module/libSceFont-module.hpp b/core/libs/prx/libSceFont-module/libSceFont-module.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFont-module/libSceFont-module.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFont.native/libSceFont.native.hpp b/core/libs/prx/libSceFont.native/libSceFont.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFont.native/libSceFont.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFont/include/Api.hpp b/core/libs/prx/libSceFont/include/Api.hpp
new file mode 100644
index 0000000000..bdb0f3f449
--- /dev/null
+++ b/core/libs/prx/libSceFont/include/Api.hpp
@@ -0,0 +1,329 @@
+#pragma once
+
+#include "prx/libSceFont/include/FontTypes.hpp"
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <bit>
+#include <chrono>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <limits>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <new>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <system_error>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+struct FontGraphicsDevice;
+
+struct FontGraphicsDeviceParam;
+
+struct FontGraphicsService;
+
+struct FontGraphicsServiceParam;
+
+struct FontWords;
+
+struct FontGlyphSupport;
+
+struct FontOutlineProfile;
+
+struct FontMetrics;
+
+struct FontStyleInformation;
+
+struct FontGlyphExpandBufferState;
+
+struct FontGraphicsResource;
+
+struct FontGraphicsFrame;
+
+struct FontGraphicsDesignResource;
+
+struct FontGraphicsDesign;
+
+struct FontGraphicsCanvas;
+
+struct FontGraphicsCanvasSequence;
+
+struct FontGraphicsSurface;
+
+struct FontGraphicsSurfaceTexture;
+
+struct FontGraphicsFill;
+
+struct FontGraphicsRegion {
+    float x;
+    float y;
+    float width;
+    float height;
+    std::uint32_t flags;
+    std::uint32_t tag;
+    float outerRadius;
+    float innerRadius;
+};
+
+struct FontGraphicsFillMethod {
+    std::int32_t mode;
+    std::int32_t type;
+    std::uint32_t flags;
+    std::uint32_t tag;
+    std::byte reserved[16];
+};
+
+struct FontGraphicsFillPlot {
+    float mapping[4];
+    const FontGraphicsRegion* region;
+    std::uint16_t tag;
+    std::uint16_t reserved26;
+    std::uint16_t layout;
+    std::uint8_t flags;
+    std::byte reserved[33];
+};
+
+struct FontGraphicsFillRates {
+    float mapping[4];
+    const FontGraphicsFill* fill;
+    std::uint16_t tag;
+    std::uint16_t effect;
+    std::uint16_t layout;
+    std::uint8_t flags;
+    std::byte reserved[33];
+};
+
+struct FontGraphicsPoolUsage {
+    std::uint32_t capacity;
+    std::uint32_t used;
+    std::uint32_t available;
+    std::uint32_t peak;
+    std::int32_t change;
+};
+
+struct FontGraphicsMemoryUsage {
+    FontGraphicsPoolUsage storage;
+    FontGraphicsPoolUsage allocations;
+    void* address;
+};
+
+struct FontGraphicsDeviceUsage {
+    FontGraphicsMemoryUsage first;
+    FontGraphicsMemoryUsage second;
+};
+
+extern "C" {
+
+int APS5_VABI sceFontMemoryInit(FontMemory* memory, void* regionAddress, std::uint32_t regionSize, const FontMemoryInterface* iface, void* mspaceObject, FontMemoryDestroyFunction destroyCallback, void* destroyObject);
+int APS5_VABI sceFontMemoryTerm(FontMemory* memory);
+int APS5_VABI sceFontCreateLibraryWithEdition(const FontMemory* memory, const void* createParams, std::uint64_t edition, FontLibrary* pLibrary);
+int APS5_VABI sceFontCreateLibrary(const FontMemory* memory, const void* createParams, FontLibrary* pLibrary);
+int APS5_VABI sceFontDestroyLibrary(FontLibrary* pLibrary);
+int APS5_VABI sceFontCreateRendererWithEdition(const FontMemory* memory, const void* createParams, std::uint64_t edition, FontRenderer* pRenderer);
+int APS5_VABI sceFontCreateRenderer(const FontMemory* memory, const void* createParams, FontRenderer* pRenderer);
+int APS5_VABI sceFontDestroyRenderer(FontRenderer* pRenderer);
+int APS5_VABI sceFontRendererGetOutlineBufferSize(FontRenderer fontRenderer, std::uint32_t* size);
+int APS5_VABI sceFontRendererResetOutlineBuffer(FontRenderer fontRenderer);
+int APS5_VABI sceFontRendererSetOutlineBufferPolicy(FontRenderer fontRenderer, std::uint64_t bufferPolicy, std::uint32_t basalSize, std::uint32_t limitSize);
+int APS5_VABI sceFontGetPixelResolution(FontLibrary library, std::uint32_t* subPixelCount);
+int APS5_VABI sceFontAttachDeviceCacheBuffer(FontLibrary library, void* buffer, std::uint32_t size);
+int APS5_VABI sceFontClearDeviceCache(FontLibrary library);
+int APS5_VABI sceFontDettachDeviceCacheBuffer(FontLibrary library, void** buffer, std::uint32_t* size);
+int APS5_VABI sceFontSupportExternalFonts(FontLibrary library, std::uint32_t fontMax, std::uint32_t formats);
+int APS5_VABI sceFontSupportSystemFonts(FontLibrary library);
+int APS5_VABI sceFontSetFontsOpenMode(FontLibrary library, std::uint32_t openMode);
+int APS5_VABI sceFontOpenFontMemory(FontLibrary library, const void* fontAddress, std::uint32_t fontSize, const FontOpenDetail* openDetail, FontHandle* pFontHandle);
+int APS5_VABI sceFontOpenFontFile(FontLibrary library, const char* path, std::uint32_t openMode, const FontOpenDetail* openDetail, FontHandle* pFontHandle);
+int APS5_VABI sceFontOpenFontInstance(FontHandle fontHandle, FontHandle setupFont, FontHandle* pFontHandle);
+int APS5_VABI sceFontOpenFontSet(FontLibrary library, std::uint32_t fontSetType, std::uint32_t openMode, const FontOpenDetail* openDetail, FontHandle* pFontHandle);
+int APS5_VABI sceFontCloseFont(FontHandle fontHandle);
+int APS5_VABI sceFontGetLibrary(FontHandle fontHandle, FontLibrary* pLibrary);
+int APS5_VABI sceFontGetFontGlyphsCount(FontHandle fontHandle, std::uint32_t* glyphsCount);
+int APS5_VABI sceFontGetCharGlyphCode(FontHandle fontHandle, std::uint32_t code, std::uint32_t* glyphCode);
+int APS5_VABI sceFontGetFontResolution(FontHandle fontHandle, std::uint32_t* pResolution, float* pScalePixel);
+int APS5_VABI sceFontBindRenderer(FontHandle fontHandle, FontRenderer renderer);
+int APS5_VABI sceFontRebindRenderer(FontHandle fontHandle);
+int APS5_VABI sceFontUnbindRenderer(FontHandle fontHandle);
+int APS5_VABI sceFontGetCharGlyphMetrics(FontHandle fontHandle, std::uint32_t code, FontGlyphMetrics* metrics);
+int APS5_VABI sceFontGetRenderCharGlyphMetrics(FontHandle fontHandle, std::uint32_t code, FontGlyphMetrics* metrics);
+int APS5_VABI sceFontGetHorizontalLayout(FontHandle fontHandle, FontHorizontalLayout* layout);
+int APS5_VABI sceFontGetVerticalLayout(FontHandle fontHandle, FontVerticalLayout* layout);
+int APS5_VABI sceFontGetKerning(FontHandle fontHandle, std::uint32_t preCode, std::uint32_t code, FontKerning* kerning);
+int APS5_VABI sceFontGetRenderScaledKerning(FontHandle fontHandle, std::uint32_t preCode, std::uint32_t code, FontKerning* kerning);
+int APS5_VABI sceFontRenderCharGlyphImage(FontHandle fontHandle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+int APS5_VABI sceFontRenderCharGlyphImageHorizontal(FontHandle fontHandle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+int APS5_VABI sceFontRenderCharGlyphImageVertical(FontHandle fontHandle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
+void APS5_VABI sceFontRenderSurfaceInit(FontRenderSurface* renderSurface, void* buffer, int bufWidthByte, int pixelSizeByte, int widthPixel, int heightPixel);
+void APS5_VABI sceFontRenderSurfaceSetScissor(FontRenderSurface* renderSurface, int x0, int y0, int w, int h);
+int APS5_VABI sceFontRenderSurfaceSetStyleFrame(FontRenderSurface* renderSurface, FontStyleFrame* styleFrame);
+int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code, const FontGenerateGlyphDetail* detail, FontGlyph* pGlyph);
+int APS5_VABI sceFontDeleteGlyph(const FontMemory* memory, FontGlyph* pGlyph);
+int APS5_VABI sceFontGlyphDefineAttribute(FontGlyph glyph, std::int32_t attribute, std::int32_t* previousAttribute);
+int APS5_VABI sceFontGlyphGetAttribute(FontGlyph glyph, int attribute, int* nowAttribute);
+int APS5_VABI sceFontGlyphGetGlyphForm(FontGlyph glyph);
+int APS5_VABI sceFontGlyphGetMetricsForm(FontGlyph glyph);
+int APS5_VABI sceFontGlyphGetScalePixel(FontGlyph glyph, float* w, float* h);
+const FontGlyphMetrics* APS5_VABI sceFontGlyphRefersMetrics(FontGlyph glyph);
+const FontGlyphMetricsHorizontal* APS5_VABI sceFontGlyphRefersMetricsHorizontal(FontGlyph glyph);
+const FontGlyphMetricsHorizontalAdvance* APS5_VABI sceFontGlyphRefersMetricsHorizontalAdvance(FontGlyph glyph);
+const FontGlyphMetricsHorizontalX* APS5_VABI sceFontGlyphRefersMetricsHorizontalX(FontGlyph glyph);
+FontGlyphOutline* APS5_VABI sceFontGlyphRefersOutline(FontGlyph glyph);
+int APS5_VABI sceFontDefineAttribute(FontHandle fontHandle, int attribute, int* oldAttribute);
+int APS5_VABI sceFontGetAttribute(FontHandle fontHandle, int attribute, int* nowAttribute);
+int APS5_VABI sceFontSetScriptLanguage(FontHandle fontHandle, int fontScript, int fontLanguage);
+int APS5_VABI sceFontGetScriptLanguage(FontHandle fontHandle, int fontScript, int* fontLanguage);
+int APS5_VABI sceFontSetTypographicDesign(FontHandle fontHandle, int typographic, int feature);
+int APS5_VABI sceFontGetTypographicDesign(FontHandle fontHandle, int typographic, int* feature);
+int APS5_VABI sceFontSetScalePixel(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetScalePoint(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetResolutionDpi(FontHandle fontHandle, std::uint32_t hDpi, std::uint32_t vDpi);
+int APS5_VABI sceFontSetEffectSlant(FontHandle fontHandle, float slantRatio);
+int APS5_VABI sceFontSetEffectWeight(FontHandle fontHandle, float weightXScale, float weightYScale, std::uint32_t mode);
+int APS5_VABI sceFontGetScalePixel(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetScalePoint(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetResolutionDpi(FontHandle fontHandle, std::uint32_t* hDpi, std::uint32_t* vDpi);
+int APS5_VABI sceFontGetEffectSlant(FontHandle fontHandle, float* slantRatio);
+int APS5_VABI sceFontGetEffectWeight(FontHandle fontHandle, float* weightXScale, float* weightYScale, std::uint32_t* mode);
+int APS5_VABI sceFontSetupRenderScalePixel(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetupRenderScalePoint(FontHandle fontHandle, float w, float h);
+int APS5_VABI sceFontSetupRenderEffectSlant(FontHandle fontHandle, float slantRatio);
+int APS5_VABI sceFontSetupRenderEffectWeight(FontHandle fontHandle, float weightXScale, float weightYScale, std::uint32_t mode);
+int APS5_VABI sceFontGetRenderScalePixel(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetRenderScalePoint(FontHandle fontHandle, float* w, float* h);
+int APS5_VABI sceFontGetRenderEffectSlant(FontHandle fontHandle, float* slantRatio);
+int APS5_VABI sceFontGetRenderEffectWeight(FontHandle fontHandle, float* weightXScale, float* weightYScale, std::uint32_t* mode);
+int APS5_VABI sceFontStyleFrameInit(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameSetScalePixel(FontStyleFrame* styleFrame, float w, float h);
+int APS5_VABI sceFontStyleFrameSetScalePoint(FontStyleFrame* styleFrame, float w, float h);
+int APS5_VABI sceFontStyleFrameSetResolutionDpi(FontStyleFrame* styleFrame, std::uint32_t hDpi, std::uint32_t vDpi);
+int APS5_VABI sceFontStyleFrameSetEffectSlant(FontStyleFrame* styleFrame, float slantRatio);
+int APS5_VABI sceFontStyleFrameSetEffectWeight(FontStyleFrame* styleFrame, float weightXScale, float weightYScale, std::uint32_t mode);
+int APS5_VABI sceFontStyleFrameUnsetScale(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameUnsetEffectSlant(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameUnsetEffectWeight(FontStyleFrame* styleFrame);
+int APS5_VABI sceFontStyleFrameGetScalePixel(const FontStyleFrame* styleFrame, float* w, float* h);
+int APS5_VABI sceFontStyleFrameGetScalePoint(const FontStyleFrame* styleFrame, float* w, float* h);
+int APS5_VABI sceFontStyleFrameGetResolutionDpi(const FontStyleFrame* styleFrame, std::uint32_t* hDpi, std::uint32_t* vDpi);
+int APS5_VABI sceFontStyleFrameGetEffectSlant(const FontStyleFrame* styleFrame, float* slantRatio);
+int APS5_VABI sceFontStyleFrameGetEffectWeight(const FontStyleFrame* styleFrame, float* weightXScale, float* weightYScale, std::uint32_t* mode);
+int APS5_VABI sceFontTextSourceInit(FontTextSource* textSource, const void* textAddress, std::uint32_t textSizeByte, FontTextParseFunction textParser, void* textObject);
+int APS5_VABI sceFontTextSourceRewind(FontTextSource* textSource);
+int APS5_VABI sceFontTextSourceSetDefaultFont(FontTextSource* textSource, FontHandle defaultFont);
+int APS5_VABI sceFontTextSourceSetWritingForm(FontTextSource* textSource, std::int32_t writingForm);
+int APS5_VABI sceFontCreateString(const FontMemory* fontMemory, FontTextSource* textSource, const FontCreateStringDetail* detail, FontString* pFontString);
+int APS5_VABI sceFontDestroyString(FontString* pFontString);
+std::uint32_t APS5_VABI sceFontStringGetTerminateCode(FontString fontString);
+void* APS5_VABI sceFontStringGetTerminateOrder(FontString fontString);
+int APS5_VABI sceFontStringGetWritingForm(FontString fontString);
+FontTextCharacter* APS5_VABI sceFontStringRefersTextCharacters(FontString fontString, std::uint32_t* characterCount);
+const FontTextCharacter* APS5_VABI sceFontStringRefersRenderCharacters(FontString fontString, FontTextCharacter* startCharacter, FontTextCharacter* lastCharacter, std::uint32_t* characterCount);
+int APS5_VABI sceFontCharacterGetBidiLevel(const FontTextCharacter* textCharacter, int* bidiLevel);
+int APS5_VABI sceFontCharacterGetSyllableStringState(const FontTextCharacter* textCharacter, int* syllableStringState);
+int APS5_VABI sceFontCharacterGetTextFontCode(const FontTextCharacter* textCharacter, FontHandle* pFontHandle, std::uint32_t* textCode);
+int APS5_VABI sceFontCharacterGetTextOrder(const FontTextCharacter* textCharacter, void** pTextOrder);
+std::uint32_t APS5_VABI sceFontCharacterLooksFormatCharacters(const FontTextCharacter* textCharacter);
+std::uint32_t APS5_VABI sceFontCharacterLooksWhiteSpace(const FontTextCharacter* textCharacter);
+FontTextCharacter* APS5_VABI sceFontCharacterRefersTextBack(const FontTextCharacter* textCharacter);
+FontTextCharacter* APS5_VABI sceFontCharacterRefersTextNext(const FontTextCharacter* textCharacter);
+FontTextCodes* APS5_VABI sceFontCharactersRefersTextCodes(const FontTextCharacter* textCharacter, const FontTextCharacter* termCharacter, FontTextCodes* textCodes);
+FontTextCodes* APS5_VABI sceFontTextCodesStepNext(FontTextCodes* textCodesStep);
+FontTextCodes* APS5_VABI sceFontTextCodesStepBack(FontTextCodes* textCodesStep);
+int APS5_VABI sceFontWritingInit(FontWriting* fontWriting, FontString fontString, const FontTextCharacter* fontCharacter);
+int APS5_VABI sceFontWritingGetRenderMetrics(FontWriting* fontWriting, FontWritingMetrics* writingMetrics);
+const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting* fontWriting);
+FontTextCharacter* APS5_VABI sceFontWritingRefersRenderStepCharacter(FontWriting* fontWriting, const FontWritingLetterStep** pLetterStep);
+int APS5_VABI sceFontWritingSetMaskInvisible(FontWriting* fontWriting, std::int32_t mask);
+int APS5_VABI sceFontControl(std::int32_t command, void* object, std::uintptr_t argument);
+int APS5_VABI sceFontCreateGraphicsDevice(const FontMemory* memory, const FontGraphicsDeviceParam* param, FontGraphicsDevice** device);
+int APS5_VABI sceFontCreateGraphicsService(const FontMemory* memory, const FontGraphicsServiceParam* param, FontGraphicsService** service);
+int APS5_VABI sceFontCreateGraphicsServiceWithEdition(const FontMemory* memory, const FontGraphicsServiceParam* param, std::uint64_t unusedSlot, FontGraphicsService** service);
+int APS5_VABI sceFontCreateWords(const FontMemory* memory, FontTextSource* source, std::uint64_t unusedSlot, FontWords** words);
+int APS5_VABI sceFontDestroyGraphicsDevice(FontGraphicsDevice** device);
+int APS5_VABI sceFontDestroyGraphicsService(FontGraphicsService** service);
+int APS5_VABI sceFontDestroyWords(FontWords** words);
+int APS5_VABI sceFontGetFontGlyphsOutlineProfile(FontHandle font, FontOutlineProfile* profile);
+int APS5_VABI sceFontGetFontMetrics(FontHandle font, std::uint32_t mode, FontMetrics* metrics);
+int APS5_VABI sceFontGetFontStyleInformation(FontHandle font, FontStyleInformation* information);
+int APS5_VABI sceFontGetGlyphExpandBufferState(FontHandle font, FontGlyphExpandBufferState* state);
+int APS5_VABI sceFontGlyphRenderImage(FontGlyph glyph, const FontStyleFrame* styleFrame, FontRenderer renderer, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* output);
+int APS5_VABI sceFontGlyphRenderImageHorizontal(FontGlyph glyph, const FontStyleFrame* styleFrame, FontRenderer renderer, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* output);
+int APS5_VABI sceFontGlyphRenderImageVertical(FontGlyph glyph, const FontStyleFrame* styleFrame, FontRenderer renderer, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* output);
+int APS5_VABI sceFontGraphicsBeginFrame(FontGraphicsFrame* frame, std::uint64_t flags, FontGraphicsResource** resource);
+int APS5_VABI sceFontGraphicsDrawingCancel(FontGraphicsFrame** frame);
+int APS5_VABI sceFontGraphicsDrawingFinish(FontGraphicsFrame** frame, FontGraphicsDevice* device);
+int APS5_VABI sceFontGraphicsEndFrame(FontGraphicsFrame* frame);
+int APS5_VABI sceFontGraphicsExchangeResource(FontGraphicsResource* resource, FontGraphicsDesignResource* replacement, FontGraphicsDesignResource** previous);
+int APS5_VABI sceFontGraphicsFillMethodInit(FontGraphicsFillMethod* method, std::int32_t mode, std::int32_t type);
+int APS5_VABI sceFontGraphicsFillPlotInit(FontGraphicsFillPlot* plot, const FontGraphicsRegion* region);
+int APS5_VABI sceFontGraphicsFillPlotSetLayout(FontGraphicsFillPlot* plot, std::int32_t first, std::int32_t second);
+int APS5_VABI sceFontGraphicsFillPlotSetMapping(FontGraphicsFillPlot* plot, float first, float second, float third, float fourth);
+int APS5_VABI sceFontGraphicsFillRatesInit(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect);
+int APS5_VABI sceFontGraphicsFillRatesSetFillEffect(FontGraphicsFillRates* rates, const FontGraphicsFill* fill, std::uint32_t effect);
+int APS5_VABI sceFontGraphicsFillRatesSetLayout(FontGraphicsFillRates* rates, std::int32_t first, std::int32_t second);
+int APS5_VABI sceFontGraphicsFillRatesSetMapping(FontGraphicsFillRates* rates, float first, float second, float third, float fourth);
+int APS5_VABI sceFontGraphicsGetDeviceUsage(FontGraphicsDevice* device, FontGraphicsDeviceUsage* usage);
+int APS5_VABI sceFontGraphicsRegionInit(FontGraphicsRegion* region, float x, float y, float width, float height);
+int APS5_VABI sceFontGraphicsRegionInitCircular(FontGraphicsRegion* region, float centerX, float centerY, float outerRadius, float innerRadius);
+int APS5_VABI sceFontGraphicsRegionInitRoundish(FontGraphicsRegion* region, float x, float y, float width, float height, float outerRadius, float innerRadius, std::uint32_t flags);
+int APS5_VABI sceFontGraphicsRelease(void** object);
+int APS5_VABI sceFontGraphicsRenderResource(FontGraphicsFrame* frame, FontGraphicsDesignResource* design, float x, float y, FontGraphicsResource** resource);
+int APS5_VABI sceFontGraphicsSetFramePolicy(FontGraphicsResource* resource, std::int32_t policy, std::uint32_t value);
+int APS5_VABI sceFontGraphicsSetupClipping(FontGraphicsResource* resource, const FontGraphicsRegion* region);
+int APS5_VABI sceFontGraphicsSetupColorRates(FontGraphicsResource* resource, float red, float green, float blue, float alpha);
+int APS5_VABI sceFontGraphicsSetupFillMethod(FontGraphicsResource* resource, const FontGraphicsFillMethod* method);
+int APS5_VABI sceFontGraphicsSetupFillRates(FontGraphicsResource* resource, const FontGraphicsFillRates* rates);
+int APS5_VABI sceFontGraphicsSetupGlyphFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsSetupGlyphFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontGraphicsSetupHandleDefault(FontGraphicsResource* resource, std::uint64_t flags);
+int APS5_VABI sceFontGraphicsSetupLocation(FontGraphicsResource* resource, float x, float y);
+int APS5_VABI sceFontGraphicsSetupPositioning(FontGraphicsResource* resource, std::uint32_t flags, float x, float y);
+int APS5_VABI sceFontGraphicsSetupRotation(FontGraphicsResource* resource, float angle, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsSetupScaling(FontGraphicsResource* resource, float scaleX, float scaleY, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsSetupShapeFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsSetupShapeFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontGraphicsStructureCanvas(FontGraphicsDevice* device, std::uint32_t width, std::uint32_t height, std::int32_t format, FontGraphicsCanvas** canvas);
+int APS5_VABI sceFontGraphicsStructureCanvasSequence(FontGraphicsDevice* device, FontGraphicsCanvas* canvas, const FontGraphicsSurface* surface, std::uint64_t flags, FontGraphicsCanvasSequence** sequence);
+int APS5_VABI sceFontGraphicsStructureDesign(FontGraphicsDevice* device, std::int32_t format, FontGraphicsDesign** design);
+int APS5_VABI sceFontGraphicsStructureDesignResource(FontGraphicsDevice* device, FontGraphicsDesign* design, FontGraphicsDesignResource** resource);
+int APS5_VABI sceFontGraphicsStructureSurfaceTexture(FontGraphicsDevice* device, const FontGraphicsSurface* surface, FontGraphicsSurfaceTexture** texture);
+int APS5_VABI sceFontGraphicsUpdateClipping(FontGraphicsResource* resource, const FontGraphicsRegion* region);
+int APS5_VABI sceFontGraphicsUpdateColorRates(FontGraphicsResource* resource, float red, float green, float blue, float alpha);
+int APS5_VABI sceFontGraphicsUpdateFillMethod(FontGraphicsResource* resource, const FontGraphicsFillMethod* method);
+int APS5_VABI sceFontGraphicsUpdateFillRates(FontGraphicsResource* resource, const FontGraphicsFillRates* rates);
+int APS5_VABI sceFontGraphicsUpdateGlyphFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsUpdateGlyphFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontGraphicsUpdateLocation(FontGraphicsResource* resource, float x, float y);
+int APS5_VABI sceFontGraphicsUpdatePositioning(FontGraphicsResource* resource, std::uint32_t flags, float x, float y);
+int APS5_VABI sceFontGraphicsUpdateRotation(FontGraphicsResource* resource, float angle, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsUpdateScaling(FontGraphicsResource* resource, float scaleX, float scaleY, float pivotX, float pivotY);
+int APS5_VABI sceFontGraphicsUpdateShapeFill(FontGraphicsResource* resource, const FontGraphicsFill* fill);
+int APS5_VABI sceFontGraphicsUpdateShapeFillPlot(FontGraphicsResource* resource, const FontGraphicsFillPlot* plot);
+int APS5_VABI sceFontSupportGlyphs(const FontGlyphSupport* support);
+int APS5_VABI sceFontWordsFindWordCharacters(FontWords* words, FontTextCharacter* firstCharacter, FontTextCharacter* endCharacter, FontTextCharacter** lastCharacter, FontTextCharacter** nextCharacter);
+int APS5_VABI sceFontGraphicsDrawupFillTextureImageObject(FontGraphicsFrame* frame, const void* data, std::uint32_t dataSize, float x, float y, float width, float height, FontGraphicsFill** fill);
+int APS5_VABI sceFontGraphicsDrawupFillTexturePatternObject(FontGraphicsFrame* frame, const void* data, std::uint32_t dataSize, std::uint32_t firstMode, std::uint32_t secondMode, std::int32_t firstCount, std::int32_t firstLayout, std::int32_t secondLayout, std::int32_t secondCount, FontGraphicsFill** fill);
+int APS5_VABI sceFontCreateWritingLine(const FontMemory* memory, std::int32_t writingForm, const void* writingLineDetail, void** pWritingLine);
+int APS5_VABI sceFontDestroyWritingLine(void** pWritingLine);
+int APS5_VABI sceFontWritingLineClear(void* writingLine);
+int APS5_VABI sceFontWritingLineWritesOrder(void* writingLine, std::uint64_t writingAttribute, const FontWritingMetrics* writingMetrics, void* writingOrderer);
+const FontWritingLineStep* APS5_VABI sceFontWritingLineRefersRenderStep(void* writingLine);
+int APS5_VABI sceFontWritingLineGetRenderMetrics(void* writingLine, FontWritingMetrics* writingMetrics);
+int APS5_VABI sceFontWritingLineGetOrderingSpace(void* writingLine, float* advanceSpace, float* headSpace, float* inlineSpace, float* tailSpace);
+
+}
diff --git a/core/libs/prx/libSceFont/include/FontInternal.hpp b/core/libs/prx/libSceFont/include/FontInternal.hpp
index 4e057a93e1..54c173835e 100644
--- a/core/libs/prx/libSceFont/include/FontInternal.hpp
+++ b/core/libs/prx/libSceFont/include/FontInternal.hpp
@@ -34,8 +34,6 @@ struct FontState {
     std::shared_ptr<const std::vector<unsigned char>> faceData;
     FT_Face face = nullptr;
     std::vector<FallbackFace> fallbacks;
-    float scaleW = 16.0f;
-    float scaleH = 16.0f;
     std::map<int, int> scriptLanguages;
     int attribute = 0;
 
@@ -133,7 +131,7 @@ void CachedStyleSetScalar(CachedStyle& style, float value);
 void ClearRenderOutputs(FontGlyphMetrics* metrics, FontRenderOutput* result);
 int ComputeHorizontalLayout(FontHandle handle, const StyleStateBlock* style, std::uint8_t* outWords);
 int ComputeVerticalLayout(FontHandle handle, const StyleStateBlock* style, std::uint8_t* outWords);
-int GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle);
+int GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle, float* usedScaleW = nullptr, float* usedScaleH = nullptr);
 int RenderCharGlyphImageCore(FontHandle handle, std::uint32_t code, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result);
 
 }
diff --git a/core/libs/prx/libSceFont/libSceFont.hpp b/core/libs/prx/libSceFont/libSceFont.hpp
new file mode 100644
index 0000000000..c39c48d023
--- /dev/null
+++ b/core/libs/prx/libSceFont/libSceFont.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFont/include/Api.hpp"
diff --git a/core/libs/prx/libSceFont/src/Layout.cpp b/core/libs/prx/libSceFont/src/Layout.cpp
index a59a3b5f2f..8bce6e00c2 100644
--- a/core/libs/prx/libSceFont/src/Layout.cpp
+++ b/core/libs/prx/libSceFont/src/Layout.cpp
@@ -120,7 +120,8 @@ void FillImageMetrics(FontRenderOutput* result, const FontGlyphMetrics* metrics,
 
 int RenderGlyphIndexToSurface(FontObj& obj, std::uint32_t glyphIndex, FontRenderSurface* surface, float x, float y, FontGlyphMetrics* metrics, FontRenderOutput* result) {
     ClearRenderOutputs(metrics, result);
-    if (!surface->buffer || surface->width <= 0 || surface->height <= 0 || surface->widthByte <= 0 || surface->pixelSizeByte <= 0) return SCE_FONT_ERROR_NO_SUPPORT_SURFACE;
+    const bool emptyExtent = surface->width == 0 || surface->height == 0;
+    if (!surface->buffer || surface->width < 0 || surface->height < 0 || surface->widthByte < 0 || (!emptyExtent && surface->widthByte == 0) || surface->pixelSizeByte <= 0) return SCE_FONT_ERROR_NO_SUPPORT_SURFACE;
     const int bytesPerPixel = surface->pixelSizeByte;
     if (bytesPerPixel != 1 && bytesPerPixel != 4) return SCE_FONT_ERROR_NO_SUPPORT_SURFACE;
     const auto face = static_cast<FT_Face>(obj.ft_face);
@@ -365,7 +366,7 @@ int Font::ComputeVerticalLayout(FontHandle handle, const StyleStateBlock* style,
     return SCE_FONT_OK;
 }
 
-int Font::GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle) {
+int Font::GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMetrics* metrics, bool useCachedStyle, float* usedScaleW, float* usedScaleH) {
     const auto clearMetrics = [&] {
         if (metrics) *metrics = {};
     };
@@ -434,6 +435,8 @@ int Font::GetCharGlyphMetrics(FontHandle handle, std::uint32_t code, FontGlyphMe
     metrics->Vertical.bearingX = static_cast<float>(vertBearingX) / 64.0f * ratioX;
     metrics->Vertical.bearingY = static_cast<float>(vertBearingY) / 64.0f * ratioY;
     metrics->Vertical.advance = static_cast<float>(slot->metrics.vertAdvance) / 64.0f * ratioY;
+    if (usedScaleW) *usedScaleW = scaleW;
+    if (usedScaleH) *usedScaleH = scaleH;
     return finish(SCE_FONT_OK);
 }
 
diff --git a/core/libs/prx/libSceFont/src/Library.cpp b/core/libs/prx/libSceFont/src/Library.cpp
index 4d8adbac7e..54d3f48d0c 100644
--- a/core/libs/prx/libSceFont/src/Library.cpp
+++ b/core/libs/prx/libSceFont/src/Library.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
diff --git a/core/libs/prx/libSceFont/src/Open.cpp b/core/libs/prx/libSceFont/src/Open.cpp
index 36e7e2263d..62d33f609e 100644
--- a/core/libs/prx/libSceFont/src/Open.cpp
+++ b/core/libs/prx/libSceFont/src/Open.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -398,8 +399,6 @@ int APS5_VABI sceFontOpenFontInstance(FontHandle fontHandle, FontHandle setupFon
     ReleaseFontLock(source, sourceLock);
     FontState& targetState = ResetState(target);
     if (FontState* sourceState = TryGetState(fontHandle)) {
-        targetState.scaleW = sourceState->scaleW;
-        targetState.scaleH = sourceState->scaleH;
         if (sourceState->faceData && !sourceState->faceData->empty()) LoadStateFace(targetState, sourceState->faceData, subFontIndex);
         for (const FallbackFace& fallback : sourceState->fallbacks) AddStateFallbackFace(targetState, fallback.data, fallback.subFontIndex);
     }
diff --git a/core/libs/prx/libSceFont/src/Render.cpp b/core/libs/prx/libSceFont/src/Render.cpp
index 7ed1af5165..876b21a590 100644
--- a/core/libs/prx/libSceFont/src/Render.cpp
+++ b/core/libs/prx/libSceFont/src/Render.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -188,7 +189,12 @@ int APS5_VABI sceFontGetKerning(FontHandle fontHandle, std::uint32_t preCode, st
     if (!font || font->magic != HANDLE_MAGIC || !AcquireFontLock(font, fontLock)) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     *kerning = {};
     const FontState* state = TryGetState(fontHandle);
-    if (state) LoadKerning(*state, state->scaleW, state->scaleH, preCode, code, kerning);
+    if (state) {
+        float scaleW = 0.0f;
+        float scaleH = 0.0f;
+        StyleStateGetScalePixel(&font->style, &scaleW, &scaleH);
+        LoadKerning(*state, scaleW, scaleH, preCode, code, kerning);
+    }
     ReleaseFontLock(font, fontLock);
     return SCE_FONT_OK;
 }
@@ -373,8 +379,7 @@ int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code
     *pGlyph = nullptr;
     if (!fontHandle) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     if (code == 0) return SCE_FONT_ERROR_NO_SUPPORT_CODE;
-    const FontState* state = TryGetState(fontHandle);
-    if (!state) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
+    if (!TryGetState(fontHandle)) return SCE_FONT_ERROR_INVALID_FONT_HANDLE;
     const std::uint8_t glyphForm = detail ? detail->glyph_form : 0;
     const std::uint8_t metricsForm = detail ? detail->metrics_form : 0;
     const std::uint16_t formOptions = detail ? detail->form_options : 0;
@@ -385,7 +390,9 @@ int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code
     if ((glyphForm != 0 && metricsForm == 0) || glyphForm > 1 || metricsForm > 4) return SCE_FONT_ERROR_INVALID_PARAMETER;
     if (glyphMemory && glyphMemory->mem_kind != MEMORY_MAGIC) return SCE_FONT_ERROR_INVALID_PARAMETER;
     FontGlyphMetrics metrics{};
-    const int rc = GetCharGlyphMetrics(fontHandle, code, &metrics, false);
+    float scaleW = 0.0f;
+    float scaleH = 0.0f;
+    const int rc = GetCharGlyphMetrics(fontHandle, code, &metrics, false, &scaleW, &scaleH);
     if (rc != SCE_FONT_OK) return rc;
     auto* generated = new (std::nothrow) GeneratedGlyph();
     if (!generated) return SCE_FONT_ERROR_ALLOCATION_FAILED;
@@ -395,13 +402,13 @@ int APS5_VABI sceFontGenerateCharGlyph(FontHandle fontHandle, std::uint32_t code
     generated->glyph.flags = formOptions;
     generated->glyph.glyph_form = glyphForm;
     generated->glyph.metrics_form = metricsForm;
-    generated->glyph.em_size = ClampToU16(state->scaleH);
+    generated->glyph.em_size = ClampToU16(scaleH);
     generated->glyph.baseline = ClampToU16(metrics.Horizontal.bearingY);
     generated->glyph.height_px = ClampToU16(metrics.height);
     generated->glyph.origin_x = 0;
     generated->glyph.origin_y = generated->glyph.baseline;
-    generated->glyph.scale_x = state->scaleW;
-    generated->glyph.base_scale = state->scaleH;
+    generated->glyph.scale_x = scaleW;
+    generated->glyph.base_scale = scaleH;
     generated->glyph.memory = glyphMemory;
     generated->owner = fontHandle;
     generated->outline.outline_flags = generated->glyph.flags;
diff --git a/core/libs/prx/libSceFont/src/Style.cpp b/core/libs/prx/libSceFont/src/Style.cpp
index 01ae245867..fcb40847fe 100644
--- a/core/libs/prx/libSceFont/src/Style.cpp
+++ b/core/libs/prx/libSceFont/src/Style.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -199,14 +200,7 @@ int APS5_VABI sceFontGetTypographicDesign(FontHandle fontHandle, int typographic
 }
 
 int APS5_VABI sceFontSetScalePixel(FontHandle fontHandle, float w, float h) {
-    return UpdateFontStyle(fontHandle, [&](FontHandleNative* font) {
-        const int changed = StyleStateSetScalePixel(&font->style, w, h);
-        if (FontState* state = TryGetState(fontHandle)) {
-            state->scaleW = w;
-            state->scaleH = h;
-        }
-        return changed;
-    });
+    return UpdateFontStyle(fontHandle, [&](FontHandleNative* font) { return StyleStateSetScalePixel(&font->style, w, h); });
 }
 
 int APS5_VABI sceFontSetScalePoint(FontHandle fontHandle, float w, float h) {
diff --git a/core/libs/prx/libSceFont/src/SystemFont.cpp b/core/libs/prx/libSceFont/src/SystemFont.cpp
index 5bcfb0789e..c6e3d87339 100644
--- a/core/libs/prx/libSceFont/src/SystemFont.cpp
+++ b/core/libs/prx/libSceFont/src/SystemFont.cpp
@@ -154,8 +154,12 @@ std::vector<Font::SystemFontFile> Font::SystemFontCandidates(std::uint32_t fontS
 }
 
 std::filesystem::path Font::SystemFontDirectory() {
+#ifdef _WIN32
+    const wchar_t* configured = _wgetenv(L"ANYPS5_SYSTEM_FONTS");
+#else
     const char* configured = std::getenv("ANYPS5_SYSTEM_FONTS");
-    if (!configured || configured[0] == '\0') return ExecutableDirectory() / "anyps5-fonts";
+#endif
+    if (!configured || configured[0] == 0) return ExecutableDirectory() / "anyps5-fonts";
     const std::filesystem::path directory(configured);
     std::error_code error;
     if (!std::filesystem::is_directory(directory, error)) throw std::runtime_error("libSceFont: ANYPS5_SYSTEM_FONTS is not a directory: " + directory.string());
diff --git a/core/libs/prx/libSceFont/src/Text.cpp b/core/libs/prx/libSceFont/src/Text.cpp
index afc8a452f7..115bf3887a 100644
--- a/core/libs/prx/libSceFont/src/Text.cpp
+++ b/core/libs/prx/libSceFont/src/Text.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
diff --git a/core/libs/prx/libSceFont/src/Unimplemented.cpp b/core/libs/prx/libSceFont/src/Unimplemented.cpp
index c98c47a93e..e0dadb8ba9 100644
--- a/core/libs/prx/libSceFont/src/Unimplemented.cpp
+++ b/core/libs/prx/libSceFont/src/Unimplemented.cpp
@@ -1,40 +1,10 @@
+#include "prx/libSceFont/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceFont/include/FontTypes.hpp"
 
-struct FontGraphicsDevice;
-struct FontGraphicsDeviceParam;
-struct FontGraphicsService;
-struct FontGraphicsServiceParam;
-struct FontWords;
-struct FontGlyphSupport;
-struct FontOutlineProfile;
-struct FontMetrics;
-struct FontStyleInformation;
-struct FontGlyphExpandBufferState;
-struct FontGraphicsResource;
-struct FontGraphicsFrame;
-struct FontGraphicsDesignResource;
-struct FontGraphicsDesign;
-struct FontGraphicsCanvas;
-struct FontGraphicsCanvasSequence;
-struct FontGraphicsSurface;
-struct FontGraphicsSurfaceTexture;
-struct FontGraphicsFill;
-
-struct FontGraphicsRegion {
-    float x;
-    float y;
-    float width;
-    float height;
-    std::uint32_t flags;
-    std::uint32_t tag;
-    float outerRadius;
-    float innerRadius;
-};
-
 static_assert(sizeof(FontGraphicsRegion) == 32);
 static_assert(offsetof(FontGraphicsRegion, x) == 0);
 static_assert(offsetof(FontGraphicsRegion, y) == 4);
@@ -45,14 +15,6 @@ static_assert(offsetof(FontGraphicsRegion, tag) == 20);
 static_assert(offsetof(FontGraphicsRegion, outerRadius) == 24);
 static_assert(offsetof(FontGraphicsRegion, innerRadius) == 28);
 
-struct FontGraphicsFillMethod {
-    std::int32_t mode;
-    std::int32_t type;
-    std::uint32_t flags;
-    std::uint32_t tag;
-    std::byte reserved[16];
-};
-
 static_assert(sizeof(FontGraphicsFillMethod) == 32);
 static_assert(offsetof(FontGraphicsFillMethod, mode) == 0);
 static_assert(offsetof(FontGraphicsFillMethod, type) == 4);
@@ -60,16 +22,6 @@ static_assert(offsetof(FontGraphicsFillMethod, flags) == 8);
 static_assert(offsetof(FontGraphicsFillMethod, tag) == 12);
 static_assert(offsetof(FontGraphicsFillMethod, reserved) == 16);
 
-struct FontGraphicsFillPlot {
-    float mapping[4];
-    const FontGraphicsRegion* region;
-    std::uint16_t tag;
-    std::uint16_t reserved26;
-    std::uint16_t layout;
-    std::uint8_t flags;
-    std::byte reserved[33];
-};
-
 static_assert(sizeof(FontGraphicsFillPlot) == 64);
 static_assert(offsetof(FontGraphicsFillPlot, mapping) == 0);
 static_assert(offsetof(FontGraphicsFillPlot, region) == 16);
@@ -79,16 +31,6 @@ static_assert(offsetof(FontGraphicsFillPlot, layout) == 28);
 static_assert(offsetof(FontGraphicsFillPlot, flags) == 30);
 static_assert(offsetof(FontGraphicsFillPlot, reserved) == 31);
 
-struct FontGraphicsFillRates {
-    float mapping[4];
-    const FontGraphicsFill* fill;
-    std::uint16_t tag;
-    std::uint16_t effect;
-    std::uint16_t layout;
-    std::uint8_t flags;
-    std::byte reserved[33];
-};
-
 static_assert(sizeof(FontGraphicsFillRates) == 64);
 static_assert(offsetof(FontGraphicsFillRates, mapping) == 0);
 static_assert(offsetof(FontGraphicsFillRates, fill) == 16);
@@ -98,14 +40,6 @@ static_assert(offsetof(FontGraphicsFillRates, layout) == 28);
 static_assert(offsetof(FontGraphicsFillRates, flags) == 30);
 static_assert(offsetof(FontGraphicsFillRates, reserved) == 31);
 
-struct FontGraphicsPoolUsage {
-    std::uint32_t capacity;
-    std::uint32_t used;
-    std::uint32_t available;
-    std::uint32_t peak;
-    std::int32_t change;
-};
-
 static_assert(sizeof(FontGraphicsPoolUsage) == 20);
 static_assert(offsetof(FontGraphicsPoolUsage, capacity) == 0);
 static_assert(offsetof(FontGraphicsPoolUsage, used) == 4);
@@ -113,27 +47,15 @@ static_assert(offsetof(FontGraphicsPoolUsage, available) == 8);
 static_assert(offsetof(FontGraphicsPoolUsage, peak) == 12);
 static_assert(offsetof(FontGraphicsPoolUsage, change) == 16);
 
-struct FontGraphicsMemoryUsage {
-    FontGraphicsPoolUsage storage;
-    FontGraphicsPoolUsage allocations;
-    void* address;
-};
-
 static_assert(sizeof(FontGraphicsMemoryUsage) == 48);
 static_assert(offsetof(FontGraphicsMemoryUsage, storage) == 0);
 static_assert(offsetof(FontGraphicsMemoryUsage, allocations) == 20);
 static_assert(offsetof(FontGraphicsMemoryUsage, address) == 40);
 
-struct FontGraphicsDeviceUsage {
-    FontGraphicsMemoryUsage first;
-    FontGraphicsMemoryUsage second;
-};
-
 static_assert(sizeof(FontGraphicsDeviceUsage) == 96);
 static_assert(offsetof(FontGraphicsDeviceUsage, first) == 0);
 static_assert(offsetof(FontGraphicsDeviceUsage, second) == 48);
 
-
 #pragma GCC visibility push(default)
 
 extern "C" {
@@ -178,7 +100,6 @@ int APS5_VABI sceFontDestroyWords(FontWords** words) {
     return 0;
 }
 
-
 int APS5_VABI sceFontGetFontGlyphsOutlineProfile(FontHandle font, FontOutlineProfile* profile) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceFont/src/WritingLine.cpp b/core/libs/prx/libSceFont/src/WritingLine.cpp
index 7365c1f418..95771489a0 100644
--- a/core/libs/prx/libSceFont/src/WritingLine.cpp
+++ b/core/libs/prx/libSceFont/src/WritingLine.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 #include <array>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceFontFt-module/libSceFontFt-module.hpp b/core/libs/prx/libSceFontFt-module/libSceFontFt-module.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFontFt-module/libSceFontFt-module.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFontFt/Export.cpp b/core/libs/prx/libSceFontFt/Export.cpp
index b0a213d62f..c376b1c590 100644
--- a/core/libs/prx/libSceFontFt/Export.cpp
+++ b/core/libs/prx/libSceFontFt/Export.cpp
@@ -1,15 +1,12 @@
+#include "prx/libSceFontFt/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-
 #include "prx/libSceFontFt/include/FontFtDriver.hpp"
 #include "prx/libc/include/General.hpp"
 
 #pragma GCC visibility push(default)
 
-struct FontFtAliases;
-struct FontFtGlyphSelection;
-
 extern "C" {
 
 const Font::SysDriver* APS5_VABI sceFontSelectLibraryFt(int value) {
@@ -78,8 +75,7 @@ int APS5_VABI sceFontFtSupportTrueType(FontLibrary library) {
 }
 
 int APS5_VABI sceFontFtSupportTrueTypeGx(FontLibrary library) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return FontFt::SupportFormats(library, {"truetype"});
 }
 
 int APS5_VABI sceFontFtSupportType1(FontLibrary library) {
diff --git a/core/libs/prx/libSceFontFt/include/Api.hpp b/core/libs/prx/libSceFontFt/include/Api.hpp
new file mode 100644
index 0000000000..b31e84ae16
--- /dev/null
+++ b/core/libs/prx/libSceFontFt/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "prx/libSceFont/include/FontTypes.hpp"
+#include "prx/libSceFont/include/FontDriver.hpp"
+#include "SceTypes.hpp"
+
+struct FontFtAliases;
+
+struct FontFtGlyphSelection;
+
+extern "C" {
+
+const Font::SysDriver* APS5_VABI sceFontSelectLibraryFt(int value);
+const Font::RendererSelection* APS5_VABI sceFontSelectRendererFt(int value);
+int APS5_VABI sceFontFtInitAliases(FontFtAliases** aliases);
+int APS5_VABI sceFontFtSetAliasFont(const char* alias, std::uint32_t fontId);
+int APS5_VABI sceFontFtSetAliasPath(const char* alias, const char* path);
+int APS5_VABI sceFontFtSupportBdf(FontLibrary library);
+int APS5_VABI sceFontFtSupportCid(FontLibrary library);
+int APS5_VABI sceFontFtSupportFontFormats(FontLibrary library, std::uint32_t formats);
+int APS5_VABI sceFontFtSupportOpenType(FontLibrary library);
+int APS5_VABI sceFontFtSupportOpenTypeOtf(FontLibrary library);
+int APS5_VABI sceFontFtSupportOpenTypeTtf(FontLibrary library);
+int APS5_VABI sceFontFtSupportPcf(FontLibrary library);
+int APS5_VABI sceFontFtSupportPfr(FontLibrary library);
+int APS5_VABI sceFontFtSupportSystemFonts(FontLibrary library);
+int APS5_VABI sceFontFtSupportTrueType(FontLibrary library);
+int APS5_VABI sceFontFtSupportTrueTypeGx(FontLibrary library);
+int APS5_VABI sceFontFtSupportType1(FontLibrary library);
+int APS5_VABI sceFontFtSupportType42(FontLibrary library);
+int APS5_VABI sceFontFtSupportWinFonts(FontLibrary library);
+int APS5_VABI sceFontFtTermAliases(FontFtAliases** aliases);
+const FontFtGlyphSelection* APS5_VABI sceFontSelectGlyphsFt(std::int32_t selector);
+
+}
diff --git a/core/libs/prx/libSceFontFt/libSceFontFt.hpp b/core/libs/prx/libSceFontFt/libSceFontFt.hpp
new file mode 100644
index 0000000000..a14b5f23e0
--- /dev/null
+++ b/core/libs/prx/libSceFontFt/libSceFontFt.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFontFt/include/Api.hpp"
diff --git a/core/libs/prx/libSceFontFt/src/Driver.cpp b/core/libs/prx/libSceFontFt/src/Driver.cpp
index 6ed7e5203e..3feaa155cf 100644
--- a/core/libs/prx/libSceFontFt/src/Driver.cpp
+++ b/core/libs/prx/libSceFontFt/src/Driver.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFontFt/include/Api.hpp"
 // SPDX-FileCopyrightText: Copyright 2024 shadPS4 Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
@@ -12,7 +13,11 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
 #include <limits>
+#ifdef _WIN32
+#include <windows.h>
+#endif
 
 #include <ft2build.h>
 #include FT_FREETYPE_H
@@ -198,6 +203,41 @@ int APS5_VABI LibrarySupport(FontLibNative* library, std::uint32_t formats) {
     return SCE_FONT_OK;
 }
 
+#ifdef _WIN32
+void CloseMappedFile(FT_Stream stream) {
+    UnmapViewOfFile(stream->base);
+    delete stream;
+}
+
+FT_Error OpenFileFace(FT_Library library, const char* path, FT_Long subFontIndex, FT_Face* face) {
+    const HANDLE file = CreateFileW(std::filesystem::path(reinterpret_cast<const char8_t*>(path)).c_str(), GENERIC_READ, FILE_SHARE_READ, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
+    if (file == INVALID_HANDLE_VALUE) return FT_Err_Cannot_Open_Resource;
+    LARGE_INTEGER size{};
+    if (!GetFileSizeEx(file, &size) || size.QuadPart <= 0 || size.QuadPart > std::numeric_limits<long>::max()) {
+        CloseHandle(file);
+        return FT_Err_Cannot_Open_Stream;
+    }
+    const HANDLE mapping = CreateFileMappingW(file, nullptr, PAGE_READONLY, 0, 0, nullptr);
+    CloseHandle(file);
+    if (!mapping) return FT_Err_Cannot_Open_Stream;
+    void* view = MapViewOfFile(mapping, FILE_MAP_READ, 0, 0, 0);
+    CloseHandle(mapping);
+    if (!view) return FT_Err_Cannot_Open_Stream;
+    auto* stream = new FT_StreamRec{};
+    stream->base = static_cast<unsigned char*>(view);
+    stream->size = static_cast<unsigned long>(size.QuadPart);
+    stream->close = &CloseMappedFile;
+    FT_Open_Args args{};
+    args.flags = FT_OPEN_STREAM;
+    args.stream = stream;
+    return FT_Open_Face(library, &args, subFontIndex, face);
+}
+#else
+FT_Error OpenFileFace(FT_Library library, const char* path, FT_Long subFontIndex, FT_Face* face) {
+    return FT_New_Face(library, path, subFontIndex, face);
+}
+#endif
+
 int APS5_VABI LibraryOpenFont(FontLibNative* library, std::uint32_t mode, const void* fontAddress, std::uint32_t fontSize, std::uint32_t subFontIndex, std::uint32_t uniqueWord, FontObj** inoutFontObj) {
     (void)uniqueWord;
     if (!library || !fontAddress || !inoutFontObj) return SCE_FONT_ERROR_INVALID_PARAMETER;
@@ -222,7 +262,7 @@ int APS5_VABI LibraryOpenFont(FontLibNative* library, std::uint32_t mode, const
     if (fromMemory) {
         error = FT_New_Memory_Face(*ftLibrary, static_cast<const FT_Byte*>(fontAddress), static_cast<FT_Long>(fontSize), static_cast<FT_Long>(subFontIndex), &face);
     } else {
-        error = FT_New_Face(*ftLibrary, static_cast<const char*>(fontAddress), static_cast<FT_Long>(subFontIndex), &face);
+        error = OpenFileFace(*ftLibrary, static_cast<const char*>(fontAddress), static_cast<FT_Long>(subFontIndex), &face);
     }
     if (error != 0 || !face) {
         if (fromMemory || error == FT_Err_Unknown_File_Format) return SCE_FONT_ERROR_NO_SUPPORT_FORMAT;
diff --git a/core/libs/prx/libSceFontGs/libSceFontGs.hpp b/core/libs/prx/libSceFontGs/libSceFontGs.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFontGs/libSceFontGs.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFreeType/CMakeLists.txt b/core/libs/prx/libSceFreeType/CMakeLists.txt
index e0a3b3e116..4fec867345 100644
--- a/core/libs/prx/libSceFreeType/CMakeLists.txt
+++ b/core/libs/prx/libSceFreeType/CMakeLists.txt
@@ -1,29 +1,115 @@
 add_library(libSceFreeType SHARED EXCLUDE_FROM_ALL
         Export.cpp
+        src/Bitmap.cpp
+        src/Outline.cpp
+        src/Charmap.cpp
+        src/FaceInfo.cpp
         src/GuestObjects.cpp
+        src/Names.cpp
+        src/Trigonometry.cpp
 )
 target_include_directories(libSceFreeType PRIVATE ${LIBS_INCLUDE_DIR})
 target_link_libraries(libSceFreeType PRIVATE freetype)
+target_sources(libSceFreeType PRIVATE src/SizeRequest.cpp)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_freetype_request_size_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeRequestSize.cpp)
+    target_include_directories(guest_freetype_request_size_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_request_size_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_request_size_tests)
+    add_test(NAME guest_freetype_request_size COMMAND guest_freetype_request_size_tests)
+    if(WIN32)
+        set_tests_properties(guest_freetype_request_size PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+    endif()
+endif()
+
+target_sources(libSceFreeType PRIVATE src/List.cpp)
 if(MINGW OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
     target_link_options(libSceFreeType PRIVATE LINKER:--exclude-libs,ALL)
 endif()
 configure_windows_unwind(libSceFreeType)
 
 if(BUILD_TESTING)
+    add_test_executable(guest_freetype_bitmap_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeBitmap.cpp)
+    target_include_directories(guest_freetype_bitmap_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_bitmap_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_bitmap_tests)
+    add_test(NAME guest_freetype_bitmap COMMAND guest_freetype_bitmap_tests)
+    if(WIN32)
+        set_tests_properties(guest_freetype_bitmap PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+    endif()
+
+    add_test_executable(guest_freetype_outline_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeOutline.cpp)
+    target_include_directories(guest_freetype_outline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_outline_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_outline_tests)
+    add_test(NAME guest_freetype_outline COMMAND guest_freetype_outline_tests)
+    add_test_executable(guest_freetype_charmap_info_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeCharmapInfo.cpp)
+    target_include_directories(guest_freetype_charmap_info_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_charmap_info_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_charmap_info_tests)
+    add_test(NAME guest_freetype_charmap_info COMMAND guest_freetype_charmap_info_tests)
     add_test_executable(guest_freetype_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeType.cpp)
     target_include_directories(guest_freetype_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_freetype_tests PRIVATE libSceFreeType freetype libc)
     configure_windows_unwind(guest_freetype_tests)
     add_test(NAME guest_freetype COMMAND guest_freetype_tests)
+    add_test_executable(guest_freetype_outline_mutations_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeOutlineMutations.cpp)
+    target_include_directories(guest_freetype_outline_mutations_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_outline_mutations_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_outline_mutations_tests)
+    add_test(NAME guest_freetype_outline_mutations COMMAND guest_freetype_outline_mutations_tests)
+    add_test_executable(guest_freetype_face_info_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeFaceInfo.cpp)
+    target_include_directories(guest_freetype_face_info_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_face_info_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_face_info_tests)
+    add_test(NAME guest_freetype_face_info COMMAND guest_freetype_face_info_tests)
     add_test_executable(guest_freetype_charmap_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeCharmap.cpp)
     target_include_directories(guest_freetype_charmap_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_freetype_charmap_tests PRIVATE libSceFreeType freetype libc)
     configure_windows_unwind(guest_freetype_charmap_tests)
     add_test(NAME guest_freetype_charmap COMMAND guest_freetype_charmap_tests)
+    add_test_executable(guest_freetype_names_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeNames.cpp)
+    target_include_directories(guest_freetype_names_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_names_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_names_tests)
+    add_test(NAME guest_freetype_names COMMAND guest_freetype_names_tests)
+    add_test_executable(guest_freetype_sfnt_names_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeSfntNames.cpp)
+    target_include_directories(guest_freetype_sfnt_names_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_sfnt_names_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_sfnt_names_tests)
+    add_test(NAME guest_freetype_sfnt_names COMMAND guest_freetype_sfnt_names_tests)
     if(WIN32)
+        set_tests_properties(guest_freetype_sfnt_names PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+        set_tests_properties(guest_freetype_names PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
         set_tests_properties(guest_freetype PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
         set_tests_properties(guest_freetype_charmap PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+        set_tests_properties(guest_freetype_outline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+        set_tests_properties(guest_freetype_charmap_info PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+        set_tests_properties(guest_freetype_outline_mutations PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+        set_tests_properties(guest_freetype_face_info PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
+    endif()
+endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_freetype_list_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeList.cpp)
+    target_include_directories(guest_freetype_list_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_list_tests PRIVATE libSceFreeType freetype libc)
+    configure_windows_unwind(guest_freetype_list_tests)
+    add_test(NAME guest_freetype_list COMMAND guest_freetype_list_tests)
+    set_tests_properties(guest_freetype_list PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_freetype_list PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeType>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceFreeType/Export.cpp b/core/libs/prx/libSceFreeType/Export.cpp
index 0c4f8d79b1..0ff5071b79 100644
--- a/core/libs/prx/libSceFreeType/Export.cpp
+++ b/core/libs/prx/libSceFreeType/Export.cpp
@@ -1,7 +1,14 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include FT_OUTLINE_H
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/General.hpp"
 
+#include FT_GASP_H
+#include FT_CID_H
+
+#include <algorithm>
+#include <bit>
 #include <cstdint>
 #include <filesystem>
 #include <fstream>
@@ -13,6 +20,8 @@
 
 using namespace FreeType;
 
+static_assert(sizeof(FT_Bool) == 1 && sizeof(FT_Int) == 4 && sizeof(FT_UInt) == 4);
+
 namespace {
 
 void FinalizeSlot(void* object) {
@@ -149,11 +158,46 @@ int APS5_VABI FT_Set_Pixel_Sizes_nid_postfix(GuestFaceRec* face, std::uint32_t p
     return error;
 }
 
+int APS5_VABI FT_Set_Char_Size_nid_postfix(GuestFaceRec* face, std::int64_t charWidth, std::int64_t charHeight,
+                                        std::uint32_t horizontalResolution, std::uint32_t verticalResolution) {
+    GuestFace* owner = FaceOf(face);
+    if (!owner) return FT_Err_Invalid_Face_Handle;
+    if (!owner->host->size) return FT_Err_Invalid_Size_Handle;
+    if (!charWidth) charWidth = charHeight;
+    else if (!charHeight) charHeight = charWidth;
+    if (charWidth < 64) charWidth = 64;
+    if (charHeight < 64) charHeight = 64;
+    if (!horizontalResolution) horizontalResolution = verticalResolution;
+    else if (!verticalResolution) verticalResolution = horizontalResolution;
+    if (!horizontalResolution) horizontalResolution = verticalResolution = 72;
+    const auto maximum = std::numeric_limits<FT_Long>::max();
+    if (charWidth > (maximum - 36) / horizontalResolution || charHeight > (maximum - 36) / verticalResolution) {
+        throw std::runtime_error("FT_Set_Char_Size: a character size or resolution outside the host arithmetic range is not implemented");
+    }
+    const FT_Error error = FT_Set_Char_Size(owner->host, static_cast<FT_F26Dot6>(charWidth), static_cast<FT_F26Dot6>(charHeight),
+                                          horizontalResolution, verticalResolution);
+    SyncSize(*owner);
+    return error;
+}
+
 std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(GuestFaceRec* face, std::uint64_t charcode) {
     const GuestFace* owner = FaceOf(face);
     return FT_Get_Char_Index(owner ? owner->host : nullptr, static_cast<FT_ULong>(static_cast<std::uint32_t>(charcode)));
 }
 
+int APS5_VABI FT_Get_Kerning_nid_postfix(GuestFaceRec* face, std::uint32_t leftGlyph, std::uint32_t rightGlyph, std::uint32_t kernMode, GuestVector* kerning) {
+    const GuestFace* owner = FaceOf(face);
+    if (!owner || !kerning) return FT_Get_Kerning(owner ? owner->host : nullptr, leftGlyph, rightGlyph, kernMode, nullptr);
+    if (leftGlyph > std::numeric_limits<std::uint16_t>::max() && FT_IS_SFNT(owner->host)) {
+        *kerning = {0, 0};
+        return 0;
+    }
+    FT_Vector result{};
+    const FT_Error error = FT_Get_Kerning(owner->host, leftGlyph, rightGlyph, kernMode, &result);
+    *kerning = {result.x, result.y};
+    return error;
+}
+
 int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec* face, std::uint32_t glyph_index, std::int32_t load_flags) {
     GuestFace* owner = FaceOf(face);
     const FT_Error error = FT_Load_Glyph(owner ? owner->host : nullptr, glyph_index, load_flags);
@@ -161,6 +205,27 @@ int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec* face, std::uint32_t glyph_
     return error;
 }
 
+int APS5_VABI FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(GuestFaceRec* face, const char** registry,
+                                                               const char** ordering, std::int32_t* supplement) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_CID_Registry_Ordering_Supplement(owner ? owner->host : nullptr, registry, ordering, supplement);
+}
+
+int APS5_VABI FT_Get_CID_Is_Internally_CID_Keyed_nid_postfix(GuestFaceRec* face, std::uint8_t* isCid) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_CID_Is_Internally_CID_Keyed(owner ? owner->host : nullptr, isCid);
+}
+
+int APS5_VABI FT_Get_CID_From_Glyph_Index_nid_postfix(GuestFaceRec* face, std::uint32_t glyphIndex, std::uint32_t* cid) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_CID_From_Glyph_Index(owner ? owner->host : nullptr, glyphIndex, cid);
+}
+
+int APS5_VABI FT_Get_Gasp_nid_postfix(GuestFaceRec* face, std::uint32_t ppem) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_Gasp(owner ? owner->host : nullptr, ppem);
+}
+
 int APS5_VABI FT_Load_Char_nid_postfix(GuestFaceRec* face, std::uint64_t charCode, std::int32_t loadFlags) {
     GuestFace* owner = FaceOf(face);
     const FT_Error error = FT_Load_Char(owner ? owner->host : nullptr, static_cast<FT_ULong>(static_cast<std::uint32_t>(charCode)), loadFlags);
@@ -168,6 +233,42 @@ int APS5_VABI FT_Load_Char_nid_postfix(GuestFaceRec* face, std::uint64_t charCod
     return error;
 }
 
+int APS5_VABI FT_Outline_Get_Orientation_nid_postfix(GuestOutline* outline) {
+    if (!outline || outline->n_points == 0) return FT_ORIENTATION_TRUETYPE;
+    const auto initial = outline->points[0];
+    GuestBBox bounds{initial.x, initial.y, initial.x, initial.y};
+    for (unsigned index = 1; index < outline->n_points; ++index) {
+        const auto point = outline->points[index];
+        bounds.xMin = std::min(bounds.xMin, point.x);
+        bounds.yMin = std::min(bounds.yMin, point.y);
+        bounds.xMax = std::max(bounds.xMax, point.x);
+        bounds.yMax = std::max(bounds.yMax, point.y);
+    }
+    if (bounds.xMin == bounds.xMax || bounds.yMin == bounds.yMax ||
+        bounds.xMin < -0x1000000 || bounds.yMin < -0x1000000 ||
+        bounds.xMax > 0x1000000 || bounds.yMax > 0x1000000) return FT_ORIENTATION_NONE;
+    const auto xMagnitude = static_cast<std::uint32_t>((bounds.xMin < 0 ? -bounds.xMin : bounds.xMin) |
+                                                       (bounds.xMax < 0 ? -bounds.xMax : bounds.xMax));
+    const int xShift = std::max(0, static_cast<int>(std::bit_width(xMagnitude)) - 15);
+    const int yShift = std::max(0, static_cast<int>(std::bit_width(static_cast<std::uint32_t>(bounds.yMax - bounds.yMin))) - 15);
+    std::int64_t area = 0;
+    unsigned first = 0;
+    for (unsigned contour = 0; contour < outline->n_contours; ++contour) {
+        const unsigned last = outline->contours[contour];
+        auto previousX = outline->points[last].x >> xShift;
+        auto previousY = outline->points[last].y >> yShift;
+        for (unsigned index = first; index <= last; ++index) {
+            const auto x = outline->points[index].x >> xShift;
+            const auto y = outline->points[index].y >> yShift;
+            area += (y - previousY) * (x + previousX);
+            previousX = x;
+            previousY = y;
+        }
+        first = last + 1;
+    }
+    return area > 0 ? FT_ORIENTATION_POSTSCRIPT : area < 0 ? FT_ORIENTATION_TRUETYPE : FT_ORIENTATION_NONE;
+}
+
 int APS5_VABI FT_Render_Glyph_nid_postfix(GuestGlyphSlotRec* slot, std::int32_t render_mode) {
     GuestFace* owner = FaceOf(slot);
     if (owner) WriteBackOutline(*owner);
@@ -205,4 +306,20 @@ std::uint64_t APS5_VABI FT_Get_Next_Char_nid_postfix(GuestFaceRec* face, std::ui
     return FT_Get_Next_Char(owner ? owner->host : nullptr, static_cast<FT_ULong>(static_cast<std::uint32_t>(charcode)), glyphIndex);
 }
 
+void APS5_VABI FT_Set_Transform_nid_postfix(GuestFaceRec* face, const GuestMatrix* matrix, const GuestVector* delta) {
+    GuestFace* owner = FaceOf(face);
+    if (!owner) return;
+    const auto component = [](std::int64_t value) {
+        if (value < std::numeric_limits<FT_Long>::min() || value > std::numeric_limits<FT_Long>::max()) {
+            throw std::runtime_error("FT_Set_Transform: a component outside the host FT_Long range is not implemented");
+        }
+        return static_cast<FT_Long>(value);
+    };
+    FT_Matrix nativeMatrix{};
+    FT_Vector nativeDelta{};
+    if (matrix) nativeMatrix = {component(matrix->xx), component(matrix->xy), component(matrix->yx), component(matrix->yy)};
+    if (delta) nativeDelta = {component(delta->x), component(delta->y)};
+    FT_Set_Transform(owner->host, matrix ? &nativeMatrix : nullptr, delta ? &nativeDelta : nullptr);
+}
+
 }
diff --git a/core/libs/prx/libSceFreeType/include/Api.hpp b/core/libs/prx/libSceFreeType/include/Api.hpp
new file mode 100644
index 0000000000..7c2f791458
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/include/Api.hpp
@@ -0,0 +1,64 @@
+#pragma once
+
+#include "prx/libSceFreeType/include/GuestList.hpp"
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI FT_Init_FreeType_nid_postfix(FreeType::GuestLibrary** alibrary);
+int APS5_VABI FT_Done_FreeType_nid_postfix(FreeType::GuestLibrary* library);
+int APS5_VABI FT_New_Face_nid_postfix(FreeType::GuestLibrary* library, const char* filepathname, std::int64_t faceIndex, FreeType::GuestFaceRec** aface);
+int APS5_VABI FT_New_Memory_Face_nid_postfix(FreeType::GuestLibrary* library, const unsigned char* fileBase, std::int64_t fileSize, std::int64_t faceIndex, FreeType::GuestFaceRec** aface);
+int APS5_VABI FT_Done_Face_nid_postfix(FreeType::GuestFaceRec* face);
+int APS5_VABI FT_Set_Pixel_Sizes_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t pixelWidth, std::uint32_t pixelHeight);
+int APS5_VABI FT_Set_Char_Size_nid_postfix(FreeType::GuestFaceRec* face, std::int64_t charWidth, std::int64_t charHeight, std::uint32_t horizontalResolution, std::uint32_t verticalResolution);
+std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(FreeType::GuestFaceRec* face, std::uint64_t charcode);
+int APS5_VABI FT_Get_Kerning_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t leftGlyph, std::uint32_t rightGlyph, std::uint32_t kernMode, FreeType::GuestVector* kerning);
+int APS5_VABI FT_Load_Glyph_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t glyphIndex, std::int32_t loadFlags);
+int APS5_VABI FT_Get_Gasp_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t ppem);
+int APS5_VABI FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(FreeType::GuestFaceRec* face, const char** registry, const char** ordering, std::int32_t* supplement);
+int APS5_VABI FT_Get_CID_Is_Internally_CID_Keyed_nid_postfix(FreeType::GuestFaceRec* face, std::uint8_t* isCid);
+int APS5_VABI FT_Get_CID_From_Glyph_Index_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t glyphIndex, std::uint32_t* cid);
+int APS5_VABI FT_Load_Char_nid_postfix(FreeType::GuestFaceRec* face, std::uint64_t charCode, std::int32_t loadFlags);
+int APS5_VABI FT_Outline_Get_Orientation_nid_postfix(FreeType::GuestOutline* outline);
+int APS5_VABI FT_Render_Glyph_nid_postfix(FreeType::GuestGlyphSlotRec* slot, std::int32_t renderMode);
+int APS5_VABI FT_Select_Charmap_nid_postfix(FreeType::GuestFaceRec* face, std::int32_t encoding);
+int APS5_VABI FT_Set_Charmap_nid_postfix(FreeType::GuestFaceRec* face, FreeType::GuestCharMapRec* charmap);
+std::uint64_t APS5_VABI FT_Get_First_Char_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t* glyphIndex);
+std::uint64_t APS5_VABI FT_Get_Next_Char_nid_postfix(FreeType::GuestFaceRec* face, std::uint64_t charcode, std::uint32_t* glyphIndex);
+void APS5_VABI FT_Set_Transform_nid_postfix(FreeType::GuestFaceRec* face, const FreeType::GuestMatrix* matrix, const FreeType::GuestVector* delta);
+int APS5_VABI FT_Get_Charmap_Index_nid_postfix(FreeType::GuestCharMapRec* charmap);
+std::uint64_t APS5_VABI FT_Get_CMap_Language_ID_nid_postfix(FreeType::GuestCharMapRec* charmap);
+std::int64_t APS5_VABI FT_Get_CMap_Format_nid_postfix(FreeType::GuestCharMapRec* charmap);
+const char* APS5_VABI FT_Get_X11_Font_Format_nid_postfix(FreeType::GuestFaceRec* face);
+std::uint16_t APS5_VABI FT_Get_FSType_Flags_nid_postfix(FreeType::GuestFaceRec* face);
+FreeType::GuestListNodeRec* APS5_VABI FT_List_Find_nid_postfix(FreeType::GuestListRec* list, void* data);
+void APS5_VABI FT_List_Add_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+void APS5_VABI FT_List_Insert_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+void APS5_VABI FT_List_Remove_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+void APS5_VABI FT_List_Up_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListNodeRec* node);
+int APS5_VABI FT_List_Iterate_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListIterator iterator, void* user);
+void APS5_VABI FT_List_Finalize_nid_postfix(FreeType::GuestListRec* list, FreeType::GuestListDestructor destroy, FreeType::GuestMemoryRec* memory, void* user);
+int APS5_VABI FT_Get_Glyph_Name_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t glyphIndex, void* buffer, std::uint32_t bufferSize);
+std::uint32_t APS5_VABI FT_Get_Name_Index_nid_postfix(FreeType::GuestFaceRec* face, const char* glyphName);
+const char* APS5_VABI FT_Get_Postscript_Name_nid_postfix(FreeType::GuestFaceRec* face);
+std::uint32_t APS5_VABI FT_Get_Sfnt_Name_Count_nid_postfix(FreeType::GuestFaceRec* face);
+int APS5_VABI FT_Get_Sfnt_Name_nid_postfix(FreeType::GuestFaceRec* face, std::uint32_t index, FreeType::GuestSfntName* name);
+int APS5_VABI FT_Outline_Check_nid_postfix(FreeType::GuestOutline* outline);
+void APS5_VABI FT_Outline_Get_CBox_nid_postfix(const FreeType::GuestOutline* outline, FreeType::GuestBBox* box);
+void APS5_VABI FT_Outline_Translate_nid_postfix(const FreeType::GuestOutline* outline, std::int64_t xOffset, std::int64_t yOffset);
+void APS5_VABI FT_Outline_Reverse_nid_postfix(FreeType::GuestOutline* outline);
+int APS5_VABI FT_Request_Size_nid_postfix(FreeType::GuestFaceRec* face, const FreeType::GuestSizeRequestRec* request);
+
+void APS5_VABI FT_Bitmap_New_nid_postfix(FreeType::GuestBitmap* bitmap);
+int APS5_VABI FT_Bitmap_Copy_nid_postfix(FreeType::GuestLibrary* library, const FreeType::GuestBitmap* source, FreeType::GuestBitmap* target);
+int APS5_VABI FT_Bitmap_Convert_nid_postfix(FreeType::GuestLibrary* library, const FreeType::GuestBitmap* source, FreeType::GuestBitmap* target, std::int32_t alignment);
+int APS5_VABI FT_Bitmap_Done_nid_postfix(FreeType::GuestLibrary* library, FreeType::GuestBitmap* bitmap);
+std::int64_t APS5_VABI FT_Cos_nid_postfix(std::int64_t angle);
+std::int64_t APS5_VABI FT_Sin_nid_postfix(std::int64_t angle);
+std::int64_t APS5_VABI FT_Tan_nid_postfix(std::int64_t angle);
+void APS5_VABI FT_Vector_Unit_nid_postfix(FreeType::GuestVector* vector, std::int64_t angle);
+std::int64_t APS5_VABI FT_Angle_Diff_nid_postfix(std::int64_t first, std::int64_t second);
+
+}
diff --git a/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp b/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp
index 1a2a074378..20553508a0 100644
--- a/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp
+++ b/core/libs/prx/libSceFreeType/include/GuestFreeType.hpp
@@ -8,6 +8,8 @@
 
 namespace FreeType {
 
+struct GuestLibrary;
+
 struct GuestGeneric {
     void* data;
     void (APS5_VABI *finalizer)(void*);
@@ -18,6 +20,13 @@ struct GuestVector {
     std::int64_t y;
 };
 
+struct GuestMatrix {
+    std::int64_t xx;
+    std::int64_t xy;
+    std::int64_t yx;
+    std::int64_t yy;
+};
+
 struct GuestBBox {
     std::int64_t xMin;
     std::int64_t yMin;
@@ -40,6 +49,15 @@ struct GuestCharMapRec {
     std::uint16_t encoding_id;
 };
 
+struct GuestSfntName {
+    std::uint16_t platform_id;
+    std::uint16_t encoding_id;
+    std::uint16_t language_id;
+    std::uint16_t name_id;
+    unsigned char* string;
+    std::uint32_t string_len;
+};
+
 struct GuestSizeMetrics {
     std::uint16_t x_ppem;
     std::uint16_t y_ppem;
@@ -58,6 +76,14 @@ struct GuestSizeRec {
     void* internal;
 };
 
+struct GuestSizeRequestRec {
+    std::uint32_t type;
+    std::int64_t width;
+    std::int64_t height;
+    std::uint32_t horiResolution;
+    std::uint32_t vertResolution;
+};
+
 struct GuestGlyphMetrics {
     std::int64_t width;
     std::int64_t height;
@@ -149,11 +175,15 @@ struct GuestFaceRec {
     void* internal;
 };
 
+static_assert(sizeof(GuestMatrix) == 32 && offsetof(GuestMatrix, xy) == 8 && offsetof(GuestMatrix, yx) == 16 && offsetof(GuestMatrix, yy) == 24);
 static_assert(sizeof(GuestGeneric) == 16 && offsetof(GuestGeneric, finalizer) == 8);
 static_assert(sizeof(GuestBitmapSize) == 32 && offsetof(GuestBitmapSize, size) == 8);
 static_assert(sizeof(GuestCharMapRec) == 16 && offsetof(GuestCharMapRec, platform_id) == 12);
+static_assert(sizeof(GuestSfntName) == 24 && offsetof(GuestSfntName, string) == 8 && offsetof(GuestSfntName, string_len) == 16);
 static_assert(sizeof(GuestSizeMetrics) == 56 && offsetof(GuestSizeMetrics, x_scale) == 8);
 static_assert(sizeof(GuestSizeRec) == 88 && offsetof(GuestSizeRec, metrics) == 24);
+static_assert(sizeof(GuestSizeRequestRec) == 32 && offsetof(GuestSizeRequestRec, width) == 8 && offsetof(GuestSizeRequestRec, height) == 16);
+static_assert(offsetof(GuestSizeRequestRec, horiResolution) == 24 && offsetof(GuestSizeRequestRec, vertResolution) == 28);
 static_assert(sizeof(GuestBitmap) == 40 && offsetof(GuestBitmap, buffer) == 16 && offsetof(GuestBitmap, palette) == 32);
 static_assert(sizeof(GuestOutline) == 40 && offsetof(GuestOutline, points) == 8 && offsetof(GuestOutline, flags) == 32);
 static_assert(offsetof(GuestGlyphSlotRec, glyph_index) == 0x18 && offsetof(GuestGlyphSlotRec, metrics) == 0x30);
diff --git a/core/libs/prx/libSceFreeType/include/GuestList.hpp b/core/libs/prx/libSceFreeType/include/GuestList.hpp
new file mode 100644
index 0000000000..67a8396b87
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/include/GuestList.hpp
@@ -0,0 +1,33 @@
+#ifndef CORE_LIBS_PRX_LIBSCEFREETYPE_INCLUDE_GUESTLIST_HPP
+#define CORE_LIBS_PRX_LIBSCEFREETYPE_INCLUDE_GUESTLIST_HPP
+
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <ft2build.h>
+#include FT_LIST_H
+
+#include <cstddef>
+#include <cstdint>
+
+namespace FreeType {
+
+using GuestListRec = FT_ListRec;
+using GuestListNodeRec = FT_ListNodeRec;
+
+struct GuestMemoryRec {
+    void* user;
+    void* (APS5_VABI *alloc)(GuestMemoryRec*, std::int64_t);
+    void (APS5_VABI *free)(GuestMemoryRec*, void*);
+    void* (APS5_VABI *realloc)(GuestMemoryRec*, std::int64_t, std::int64_t, void*);
+};
+
+using GuestListIterator = int (APS5_VABI *)(GuestListNodeRec*, void*);
+using GuestListDestructor = void (APS5_VABI *)(GuestMemoryRec*, void*, void*);
+
+static_assert(sizeof(GuestListNodeRec) == 24 && offsetof(GuestListNodeRec, prev) == 0 && offsetof(GuestListNodeRec, next) == 8 && offsetof(GuestListNodeRec, data) == 16);
+static_assert(sizeof(GuestListRec) == 16 && offsetof(GuestListRec, head) == 0 && offsetof(GuestListRec, tail) == 8);
+static_assert(sizeof(GuestMemoryRec) == 32 && offsetof(GuestMemoryRec, alloc) == 8 && offsetof(GuestMemoryRec, free) == 16 && offsetof(GuestMemoryRec, realloc) == 24);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceFreeType/include/GuestObjects.hpp b/core/libs/prx/libSceFreeType/include/GuestObjects.hpp
index d237147b89..9ae0c12315 100644
--- a/core/libs/prx/libSceFreeType/include/GuestObjects.hpp
+++ b/core/libs/prx/libSceFreeType/include/GuestObjects.hpp
@@ -19,6 +19,8 @@ struct GuestLibrary {
     std::list<std::unique_ptr<GuestFace>> faces;
 };
 
+void UnregisterBitmap_nid_no_patch(const GuestBitmap* bitmap);
+
 struct GuestFace {
     GuestFaceRec rec{};
     GuestGlyphSlotRec slot{};
@@ -30,8 +32,12 @@ struct GuestFace {
     std::vector<GuestCharMapRec> charmaps;
     std::vector<GuestCharMapRec*> charmapPointers;
     std::vector<GuestVector> outlinePoints;
+
+    ~GuestFace() { UnregisterBitmap_nid_no_patch(&slot.bitmap); }
 };
 
+void RegisterBitmap_nid_no_patch(GuestFace& face);
+
 GuestFace* FaceOf(const GuestFaceRec* face);
 GuestFace* FaceOf(const GuestGlyphSlotRec* slot);
 void SyncFace(GuestFace& face);
diff --git a/core/libs/prx/libSceFreeType/libSceFreeType.hpp b/core/libs/prx/libSceFreeType/libSceFreeType.hpp
new file mode 100644
index 0000000000..e1970ef93b
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/libSceFreeType.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/prx/libSceFreeType/src/Bitmap.cpp b/core/libs/prx/libSceFreeType/src/Bitmap.cpp
new file mode 100644
index 0000000000..2e8a5d750e
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Bitmap.cpp
@@ -0,0 +1,100 @@
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_BITMAP_H
+
+#include <cstdint>
+#include <mutex>
+#include <stdexcept>
+#include <unordered_map>
+
+using namespace FreeType;
+
+namespace {
+
+struct BitmapOwners {
+    std::mutex mutex;
+    std::unordered_map<const GuestBitmap*, FT_Bitmap*> bitmaps;
+};
+
+BitmapOwners& Owners() {
+    static BitmapOwners owners;
+    return owners;
+}
+
+FT_Bitmap NativeBitmap(const GuestBitmap& bitmap) {
+    return {bitmap.rows, bitmap.width, bitmap.pitch, bitmap.buffer, bitmap.num_grays, bitmap.pixel_mode, bitmap.palette_mode, bitmap.palette};
+}
+
+void SyncBitmap(GuestBitmap& guest, const FT_Bitmap& bitmap) {
+    guest = {bitmap.rows, bitmap.width, bitmap.pitch, bitmap.buffer, bitmap.num_grays, bitmap.pixel_mode, bitmap.palette_mode, bitmap.palette};
+    auto& owners = Owners();
+    std::lock_guard lock(owners.mutex);
+    const auto found = owners.bitmaps.find(&guest);
+    if (found != owners.bitmaps.end() && found->second) *found->second = bitmap;
+}
+
+}
+
+namespace FreeType {
+
+void RegisterBitmap_nid_no_patch(GuestFace& face) {
+    auto& owners = Owners();
+    std::lock_guard lock(owners.mutex);
+    owners.bitmaps.insert_or_assign(&face.slot.bitmap, face.host->glyph ? &face.host->glyph->bitmap : nullptr);
+}
+
+void UnregisterBitmap_nid_no_patch(const GuestBitmap* bitmap) {
+    auto& owners = Owners();
+    std::lock_guard lock(owners.mutex);
+    owners.bitmaps.erase(bitmap);
+}
+
+}
+
+extern "C" {
+
+void APS5_VABI FT_Bitmap_New_nid_postfix(GuestBitmap* bitmap) {
+    if (bitmap) SyncBitmap(*bitmap, {});
+}
+
+int APS5_VABI FT_Bitmap_Copy_nid_postfix(GuestLibrary* library, const GuestBitmap* source, GuestBitmap* target) {
+    if (!library) return FT_Err_Invalid_Library_Handle;
+    if (!source || !target) return FT_Err_Invalid_Argument;
+    if (source == target) {
+        SyncBitmap(*target, NativeBitmap(*target));
+        return 0;
+    }
+    if (source->buffer && source->buffer == target->buffer) {
+        throw std::runtime_error("FT_Bitmap_Copy: overlapping source and target buffers are not implemented");
+    }
+    const FT_Bitmap nativeSource = NativeBitmap(*source);
+    FT_Bitmap nativeTarget = NativeBitmap(*target);
+    const FT_Error error = FT_Bitmap_Copy(library->host, &nativeSource, &nativeTarget);
+    SyncBitmap(*target, nativeTarget);
+    return error;
+}
+
+int APS5_VABI FT_Bitmap_Convert_nid_postfix(GuestLibrary* library, const GuestBitmap* source, GuestBitmap* target, std::int32_t alignment) {
+    if (!library) return FT_Err_Invalid_Library_Handle;
+    if (!source || !target) return FT_Err_Invalid_Argument;
+    if (source == target || (source->buffer && source->buffer == target->buffer)) {
+        throw std::runtime_error("FT_Bitmap_Convert: overlapping source and target buffers are not implemented");
+    }
+    const FT_Bitmap nativeSource = NativeBitmap(*source);
+    FT_Bitmap nativeTarget = NativeBitmap(*target);
+    const FT_Error error = FT_Bitmap_Convert(library->host, &nativeSource, &nativeTarget, alignment);
+    SyncBitmap(*target, nativeTarget);
+    return error;
+}
+
+int APS5_VABI FT_Bitmap_Done_nid_postfix(GuestLibrary* library, GuestBitmap* bitmap) {
+    if (!library) return FT_Err_Invalid_Library_Handle;
+    if (!bitmap) return FT_Err_Invalid_Argument;
+    FT_Bitmap native = NativeBitmap(*bitmap);
+    const FT_Error error = FT_Bitmap_Done(library->host, &native);
+    SyncBitmap(*bitmap, native);
+    return error;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/Charmap.cpp b/core/libs/prx/libSceFreeType/src/Charmap.cpp
new file mode 100644
index 0000000000..6f7ee76773
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Charmap.cpp
@@ -0,0 +1,42 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_TRUETYPE_TABLES_H
+
+#include <cstddef>
+#include <cstdint>
+#include <stdexcept>
+
+using namespace FreeType;
+
+namespace {
+
+FT_CharMap HostCharmap(const GuestCharMapRec* charmap) {
+    if (!charmap || !charmap->face) return nullptr;
+    const GuestFace* owner = FaceOf(static_cast<const GuestFaceRec*>(charmap->face));
+    if (owner && owner->host) {
+        for (std::size_t index = 0; index < owner->charmapPointers.size(); ++index) {
+            if (owner->charmapPointers[index] == charmap) return owner->host->charmaps[index];
+        }
+    }
+    throw std::runtime_error("FreeType: a charmap outside the guest face's read-only array is not implemented");
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI FT_Get_Charmap_Index_nid_postfix(GuestCharMapRec* charmap) {
+    return FT_Get_Charmap_Index(HostCharmap(charmap));
+}
+
+std::uint64_t APS5_VABI FT_Get_CMap_Language_ID_nid_postfix(GuestCharMapRec* charmap) {
+    return FT_Get_CMap_Language_ID(HostCharmap(charmap));
+}
+
+std::int64_t APS5_VABI FT_Get_CMap_Format_nid_postfix(GuestCharMapRec* charmap) {
+    return FT_Get_CMap_Format(HostCharmap(charmap));
+}
+
+}
\ No newline at end of file
diff --git a/core/libs/prx/libSceFreeType/src/FaceInfo.cpp b/core/libs/prx/libSceFreeType/src/FaceInfo.cpp
new file mode 100644
index 0000000000..a5969dcbfa
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/FaceInfo.cpp
@@ -0,0 +1,23 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_FONT_FORMATS_H
+
+#include <cstdint>
+
+using namespace FreeType;
+
+extern "C" {
+
+const char* APS5_VABI FT_Get_X11_Font_Format_nid_postfix(GuestFaceRec* face) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_X11_Font_Format(owner ? owner->host : nullptr);
+}
+
+std::uint16_t APS5_VABI FT_Get_FSType_Flags_nid_postfix(GuestFaceRec* face) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_FSType_Flags(owner ? owner->host : nullptr);
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/GuestObjects.cpp b/core/libs/prx/libSceFreeType/src/GuestObjects.cpp
index 79662344d2..17d1888a21 100644
--- a/core/libs/prx/libSceFreeType/src/GuestObjects.cpp
+++ b/core/libs/prx/libSceFreeType/src/GuestObjects.cpp
@@ -13,6 +13,7 @@ GuestFace* FaceOf(const GuestGlyphSlotRec* slot) {
 }
 
 void SyncFace(GuestFace& face) {
+    RegisterBitmap_nid_no_patch(face);
     const FT_Face host = face.host;
     auto& rec = face.rec;
     rec.num_faces = host->num_faces;
diff --git a/core/libs/prx/libSceFreeType/src/List.cpp b/core/libs/prx/libSceFreeType/src/List.cpp
new file mode 100644
index 0000000000..45a1872a31
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/List.cpp
@@ -0,0 +1,102 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestList.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+
+#include <array>
+#include <stdexcept>
+
+using namespace FreeType;
+
+namespace {
+
+class ListWrite {
+public:
+    ListWrite(GuestListRec* list, std::array<GuestListNodeRec*, 4> nodes = {})
+        : writes{GuestArena::HostWrite(list, sizeof(*list)),
+                 GuestArena::HostWrite(nodes[0], nodes[0] ? sizeof(*nodes[0]) : 0),
+                 GuestArena::HostWrite(nodes[1], nodes[1] ? sizeof(*nodes[1]) : 0),
+                 GuestArena::HostWrite(nodes[2], nodes[2] ? sizeof(*nodes[2]) : 0),
+                 GuestArena::HostWrite(nodes[3], nodes[3] ? sizeof(*nodes[3]) : 0)} {
+        for (const auto& write : writes) {
+            if (!write.Open()) throw std::runtime_error("FT_List: a destination is not writable");
+        }
+    }
+
+private:
+    std::array<GuestArena::HostWrite, 5> writes;
+};
+
+struct Iteration {
+    GuestListIterator iterator;
+    void* user;
+};
+
+int Iterate(FT_ListNode node, void* user) {
+    auto& call = *static_cast<Iteration*>(user);
+    return call.iterator(node, call.user);
+}
+
+struct Finalization {
+    GuestMemoryRec* memory;
+    GuestListDestructor destroy;
+    void* user;
+};
+
+void Destroy(FT_Memory memory, void* data, void*) {
+    auto& call = *static_cast<Finalization*>(memory->user);
+    call.destroy(call.memory, data, call.user);
+}
+
+void FreeNode(FT_Memory memory, void* block) {
+    auto& call = *static_cast<Finalization*>(memory->user);
+    call.memory->free(call.memory, block);
+}
+
+}
+
+extern "C" {
+
+GuestListNodeRec* APS5_VABI FT_List_Find_nid_postfix(GuestListRec* list, void* data) {
+    return FT_List_Find(list, data);
+}
+
+void APS5_VABI FT_List_Add_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
+    if (!list || !node) return;
+    const ListWrite write(list, {node, list->tail});
+    FT_List_Add(list, node);
+}
+
+void APS5_VABI FT_List_Insert_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
+    if (!list || !node) return;
+    const ListWrite write(list, {node, list->head});
+    FT_List_Insert(list, node);
+}
+
+void APS5_VABI FT_List_Remove_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
+    if (!list || !node) return;
+    const ListWrite write(list, {node->prev, node->next});
+    FT_List_Remove(list, node);
+}
+
+void APS5_VABI FT_List_Up_nid_postfix(GuestListRec* list, GuestListNodeRec* node) {
+    if (!list || !node || !node->prev) return;
+    const ListWrite write(list, {node, node->prev, node->next, list->head});
+    FT_List_Up(list, node);
+}
+
+int APS5_VABI FT_List_Iterate_nid_postfix(GuestListRec* list, GuestListIterator iterator, void* user) {
+    Iteration call{iterator, user};
+    return FT_List_Iterate(list, iterator ? Iterate : nullptr, &call);
+}
+
+void APS5_VABI FT_List_Finalize_nid_postfix(GuestListRec* list, GuestListDestructor destroy, GuestMemoryRec* memory, void* user) {
+    if (!list || !memory) return;
+    const ListWrite write(list);
+    Finalization call{memory, destroy, user};
+    FT_MemoryRec_ native{};
+    native.user = &call;
+    native.free = FreeNode;
+    FT_List_Finalize(list, destroy ? Destroy : nullptr, &native, user);
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/Names.cpp b/core/libs/prx/libSceFreeType/src/Names.cpp
new file mode 100644
index 0000000000..02e1f9f39c
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Names.cpp
@@ -0,0 +1,56 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_SFNT_NAMES_H
+
+#include <cstdint>
+
+using namespace FreeType;
+
+extern "C" {
+
+int APS5_VABI FT_Get_Glyph_Name_nid_postfix(GuestFaceRec* face, std::uint32_t glyphIndex, void* buffer, std::uint32_t bufferSize) {
+    const GuestFace* owner = FaceOf(face);
+    const FT_Face host = owner ? owner->host : nullptr;
+    if (!host || !buffer || bufferSize == 0) return FT_Get_Glyph_Name(host, glyphIndex, buffer, bufferSize);
+    GuestArena::HostWrite write(buffer, bufferSize);
+    if (static_cast<std::int64_t>(glyphIndex) >= host->num_glyphs) {
+        static_cast<char*>(buffer)[0] = '\0';
+        return FT_Err_Invalid_Glyph_Index;
+    }
+    return FT_Get_Glyph_Name(host, glyphIndex, buffer, bufferSize);
+}
+
+std::uint32_t APS5_VABI FT_Get_Name_Index_nid_postfix(GuestFaceRec* face, const char* glyphName) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_Name_Index(owner ? owner->host : nullptr, glyphName);
+}
+
+const char* APS5_VABI FT_Get_Postscript_Name_nid_postfix(GuestFaceRec* face) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_Postscript_Name(owner ? owner->host : nullptr);
+}
+
+std::uint32_t APS5_VABI FT_Get_Sfnt_Name_Count_nid_postfix(GuestFaceRec* face) {
+    const GuestFace* owner = FaceOf(face);
+    return FT_Get_Sfnt_Name_Count(owner ? owner->host : nullptr);
+}
+
+int APS5_VABI FT_Get_Sfnt_Name_nid_postfix(GuestFaceRec* face, std::uint32_t index, GuestSfntName* name) {
+    const GuestFace* owner = FaceOf(face);
+    FT_SfntName native{};
+    const FT_Error error = FT_Get_Sfnt_Name(owner ? owner->host : nullptr, index, name ? &native : nullptr);
+    if (!error) {
+        name->platform_id = native.platform_id;
+        name->encoding_id = native.encoding_id;
+        name->language_id = native.language_id;
+        name->name_id = native.name_id;
+        name->string = native.string;
+        name->string_len = native.string_len;
+    }
+    return error;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/Outline.cpp b/core/libs/prx/libSceFreeType/src/Outline.cpp
new file mode 100644
index 0000000000..8c9892ad30
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Outline.cpp
@@ -0,0 +1,65 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <ft2build.h>
+#include FT_OUTLINE_H
+
+#include <algorithm>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+
+using namespace FreeType;
+
+extern "C" {
+
+int APS5_VABI FT_Outline_Check_nid_postfix(GuestOutline* outline) {
+    if (!outline) return FT_Outline_Check(nullptr);
+    FT_Outline native{outline->n_contours, outline->n_points, nullptr, nullptr, outline->contours, outline->flags};
+    return FT_Outline_Check(&native);
+}
+
+void APS5_VABI FT_Outline_Get_CBox_nid_postfix(const GuestOutline* outline, GuestBBox* box) {
+    if (!outline || !box) return;
+    GuestBBox bounds{};
+    if (outline->n_points) {
+        const GuestVector& first = outline->points[0];
+        bounds = {first.x, first.y, first.x, first.y};
+        for (std::size_t index = 1; index < outline->n_points; ++index) {
+            const GuestVector& point = outline->points[index];
+            bounds.xMin = std::min(bounds.xMin, point.x);
+            bounds.yMin = std::min(bounds.yMin, point.y);
+            bounds.xMax = std::max(bounds.xMax, point.x);
+            bounds.yMax = std::max(bounds.yMax, point.y);
+        }
+    }
+    *box = bounds;
+}
+
+void APS5_VABI FT_Outline_Translate_nid_postfix(const GuestOutline* outline, std::int64_t xOffset, std::int64_t yOffset) {
+    if (!outline) return;
+    for (std::size_t index = 0; index < outline->n_points; ++index) {
+        GuestVector& point = outline->points[index];
+        point.x = std::bit_cast<std::int64_t>(static_cast<std::uint64_t>(point.x) + static_cast<std::uint64_t>(xOffset));
+        point.y = std::bit_cast<std::int64_t>(static_cast<std::uint64_t>(point.y) + static_cast<std::uint64_t>(yOffset));
+    }
+}
+
+void APS5_VABI FT_Outline_Reverse_nid_postfix(GuestOutline* outline) {
+    if (!outline) return;
+    std::size_t first = 1;
+    for (std::size_t contour = 0; contour < outline->n_contours; ++contour) {
+        const std::size_t last = outline->contours[contour];
+        for (std::size_t left = first, right = last; left < right; ++left, --right) {
+            std::swap(outline->points[left], outline->points[right]);
+        }
+        for (std::size_t left = first, right = last; left < right; ++left, --right) {
+            std::swap(outline->tags[left], outline->tags[right]);
+        }
+        first = last + 2;
+    }
+    outline->flags ^= FT_OUTLINE_REVERSE_FILL;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/SizeRequest.cpp b/core/libs/prx/libSceFreeType/src/SizeRequest.cpp
new file mode 100644
index 0000000000..e70ea25111
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/SizeRequest.cpp
@@ -0,0 +1,25 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/General.hpp"
+
+#include <limits>
+
+using namespace FreeType;
+
+extern "C" {
+
+int APS5_VABI FT_Request_Size_nid_postfix(GuestFaceRec* face, const GuestSizeRequestRec* request) {
+    GuestFace* owner = FaceOf(face);
+    if (!owner || !owner->host->size || !request) return FT_Request_Size(owner ? owner->host : nullptr, nullptr);
+    if (request->width < 0 || request->height < 0 || request->type >= FT_SIZE_REQUEST_TYPE_MAX) return FT_Err_Invalid_Argument;
+    if (request->width > std::numeric_limits<FT_Long>::max() || request->height > std::numeric_limits<FT_Long>::max()) {
+        NotImplemented_nid_no_patch(__func__);
+    }
+    FT_Size_RequestRec hostRequest{static_cast<FT_Size_Request_Type>(request->type), static_cast<FT_Long>(request->width),
+        static_cast<FT_Long>(request->height), request->horiResolution, request->vertResolution};
+    const FT_Error error = FT_Request_Size(owner->host, &hostRequest);
+    SyncSize(*owner);
+    return error;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeType/src/Trigonometry.cpp b/core/libs/prx/libSceFreeType/src/Trigonometry.cpp
new file mode 100644
index 0000000000..a8f85d47fc
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/Trigonometry.cpp
@@ -0,0 +1,81 @@
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+
+#include <ft2build.h>
+#include FT_TRIGONOMETRY_H
+
+#include <array>
+#include <cstdint>
+#include <limits>
+#include <stdexcept>
+
+using namespace FreeType;
+
+namespace {
+
+FT_Angle NormalizeAngle(std::int64_t angle) {
+    return static_cast<FT_Angle>(angle % (360ll << 16));
+}
+
+GuestVector TangentVector(std::int64_t angle) {
+    constexpr std::array<std::int64_t, 22> angles{
+        1740967, 919879, 466945, 234379, 117304, 58666, 29335, 14668, 7334, 3667, 1833,
+        917, 458, 229, 115, 57, 29, 14, 7, 4, 2, 1};
+    std::int64_t remaining = NormalizeAngle(angle);
+    GuestVector vector{1ll << 24, 0};
+    while (remaining < -(45ll << 16)) {
+        vector = {vector.y, -vector.x};
+        remaining += 90ll << 16;
+    }
+    while (remaining > (45ll << 16)) {
+        vector = {-vector.y, vector.x};
+        remaining -= 90ll << 16;
+    }
+    std::int64_t rounding = 1;
+    for (std::size_t iteration = 1; iteration <= angles.size(); ++iteration) {
+        const std::int64_t direction = remaining < 0 ? 1 : -1;
+        const GuestVector step{(vector.y + rounding) >> iteration, (vector.x + rounding) >> iteration};
+        vector.x += direction * step.x;
+        vector.y -= direction * step.y;
+        remaining += direction * angles[iteration - 1];
+        rounding <<= 1;
+    }
+    return vector;
+}
+
+}
+
+extern "C" {
+
+std::int64_t APS5_VABI FT_Cos_nid_postfix(std::int64_t angle) {
+    return FT_Cos(NormalizeAngle(angle));
+}
+
+std::int64_t APS5_VABI FT_Sin_nid_postfix(std::int64_t angle) {
+    return FT_Sin(NormalizeAngle(angle));
+}
+
+std::int64_t APS5_VABI FT_Tan_nid_postfix(std::int64_t angle) {
+    const GuestVector vector = TangentVector(angle);
+    const std::uint64_t x = static_cast<std::uint64_t>(vector.x < 0 ? -vector.x : vector.x);
+    const std::uint64_t y = static_cast<std::uint64_t>(vector.y < 0 ? -vector.y : vector.y);
+    const auto quotient = static_cast<std::int64_t>(x == 0 ? 0x7FFFFFFFull : ((y << 16) + (x >> 1)) / x);
+    return (vector.x < 0) != (vector.y < 0) ? -quotient : quotient;
+}
+
+void APS5_VABI FT_Vector_Unit_nid_postfix(GuestVector* vector, std::int64_t angle) {
+    if (!vector) return;
+    FT_Vector native{};
+    FT_Vector_Unit(&native, NormalizeAngle(angle));
+    vector->x = native.x;
+    vector->y = native.y;
+}
+
+std::int64_t APS5_VABI FT_Angle_Diff_nid_postfix(std::int64_t first, std::int64_t second) {
+    if ((first > 0 && second < std::numeric_limits<std::int64_t>::min() + first) ||
+        (first < 0 && second > std::numeric_limits<std::int64_t>::max() + first)) {
+        throw std::runtime_error("FT_Angle_Diff: overflowing signed angle subtraction is not implemented");
+    }
+    return FT_Angle_Diff(0, NormalizeAngle(second - first));
+}
+
+}
diff --git a/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp b/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFreeTypeOptOl/libSceFreeTypeOptOl.hpp b/core/libs/prx/libSceFreeTypeOptOl/libSceFreeTypeOptOl.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOptOl/libSceFreeTypeOptOl.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp b/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceFsInternalForVsh/Export.cpp b/core/libs/prx/libSceFsInternalForVsh/Export.cpp
index 4a393cfbb7..75159006f0 100644
--- a/core/libs/prx/libSceFsInternalForVsh/Export.cpp
+++ b/core/libs/prx/libSceFsInternalForVsh/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFsInternalForVsh/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceFsInternalForVsh/include/Api.hpp b/core/libs/prx/libSceFsInternalForVsh/include/Api.hpp
new file mode 100644
index 0000000000..15f7c8533c
--- /dev/null
+++ b/core/libs/prx/libSceFsInternalForVsh/include/Api.hpp
@@ -0,0 +1,184 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceBdSchedCancelBackgroundCopyRequest();
+int APS5_VABI sceBdSchedCancelPrioritizedBackgroundCopyRequest();
+int APS5_VABI sceBdSchedConfigure();
+int APS5_VABI sceBdSchedConfigure2();
+int APS5_VABI sceBdSchedDeconfigure();
+int APS5_VABI sceBdSchedGetBackgroundCopyRequest();
+int APS5_VABI sceBdSchedGetExtentMap();
+int APS5_VABI sceBdSchedGetPrioritizedBackgroundCopyRequest();
+int APS5_VABI sceBdSchedGetState();
+int APS5_VABI sceBdSchedSetBackgroundCopyRequest();
+int APS5_VABI sceBdSchedSetDiscIdentity();
+int APS5_VABI sceBdSchedSetPrioritizedBackgroundCopyRequest();
+int APS5_VABI sceBdSchedStartGame();
+int APS5_VABI sceBdSchedStartRipping();
+int APS5_VABI sceBdSchedStopScheduling();
+int APS5_VABI sceFsBfsCheckCleanFlag();
+int APS5_VABI sceFsBindApplication();
+int APS5_VABI sceFsBindPackages();
+int APS5_VABI sceFsCheckFormat();
+int APS5_VABI sceFsCheckSingleUser();
+int APS5_VABI sceFsCreateExfatPartition();
+int APS5_VABI sceFsCreatePfsSaveDataImage();
+int APS5_VABI sceFsCreatePfsTrophyDataImage();
+int APS5_VABI sceFsCreatePprPfsTrophyDataImage();
+int APS5_VABI sceFsDeviceAlignedPread();
+int APS5_VABI sceFsDeviceAlignedPwrite();
+int APS5_VABI sceFsDevpfsA53IocGetBuildMetadataStatus();
+int APS5_VABI sceFsDevpfsCancelWaitEvent();
+int APS5_VABI sceFsDevpfsCreateForVSH();
+int APS5_VABI sceFsDevpfsDeleteForVSH();
+int APS5_VABI sceFsDevpfsDeregisterEvent();
+int APS5_VABI sceFsDevpfsEventComplete();
+int APS5_VABI sceFsDevpfsEventResponseComplete();
+int APS5_VABI sceFsDevpfsFetchMetaEntry();
+int APS5_VABI sceFsDevpfsFsck();
+int APS5_VABI sceFsDevpfsInitFetchMetaEntryCtx();
+int APS5_VABI sceFsDevpfsMountForFSMP();
+int APS5_VABI sceFsDevpfsRegisterEvent();
+int APS5_VABI sceFsDevpfsWaitEvent();
+int APS5_VABI sceFsDrfsRegisterSocket();
+int APS5_VABI sceFsDrfsResumeSocket();
+int APS5_VABI sceFsErriCtl();
+int APS5_VABI sceFsErriGetState();
+int APS5_VABI sceFsExfatMkfsExternalHdd();
+int APS5_VABI sceFsExfatfsMkfs();
+int APS5_VABI sceFsExtUSBSchedDestroy();
+int APS5_VABI sceFsExtUSBSchedInsert();
+int APS5_VABI sceFsExtUSBSchedInsertForHDD();
+int APS5_VABI sceFsExternalStorageDeconfigure();
+int APS5_VABI sceFsExternalStorageGetRawDevice();
+int APS5_VABI sceFsExternalStorageInitialize();
+int APS5_VABI sceFsExternalStorageVerifyMetadata();
+int APS5_VABI sceFsGetAttribute();
+int APS5_VABI sceFsGetClusterStatistics();
+int APS5_VABI sceFsGetDeviceSectorsize();
+int APS5_VABI sceFsGetFsMetadata();
+int APS5_VABI sceFsGetFsMetadataWithProgress();
+int APS5_VABI sceFsGetSmrInfo();
+int APS5_VABI sceFsGschedCtl();
+int APS5_VABI sceFsISSchedConfigCurrentThread();
+int APS5_VABI sceFsISSchedConfigDescriptor();
+int APS5_VABI sceFsISSchedConfigThread();
+int APS5_VABI sceFsISSchedMapStat();
+int APS5_VABI sceFsISSchedResultToPriority();
+int APS5_VABI sceFsISSchedResultToSlot();
+int APS5_VABI sceFsISSchedStatCurrentThread();
+int APS5_VABI sceFsISSchedStatDescriptor();
+int APS5_VABI sceFsISSchedStatThread();
+int APS5_VABI sceFsISSchedUnmapStat();
+int APS5_VABI sceFsInitCreatePfsSaveDataOpt();
+int APS5_VABI sceFsInitCreatePfsTrophyDataOpt();
+int APS5_VABI sceFsInitMountDownloadDataOpt();
+int APS5_VABI sceFsInitMountGamePkgOpt();
+int APS5_VABI sceFsInitMountLwfsCompatOpt();
+int APS5_VABI sceFsInitMountLwfsOpt();
+int APS5_VABI sceFsInitMountPprPkgOpt();
+int APS5_VABI sceFsInitMountSaveDataOpt();
+int APS5_VABI sceFsInitMountTrophyDataOpt();
+int APS5_VABI sceFsInitUmountDownloadDataOpt();
+int APS5_VABI sceFsInitUmountGamePkgOpt();
+int APS5_VABI sceFsInitUmountLwfsCompatOpt();
+int APS5_VABI sceFsInitUmountLwfsOpt();
+int APS5_VABI sceFsInitUmountPprPkgOpt();
+int APS5_VABI sceFsInitUmountSaveDataOpt();
+int APS5_VABI sceFsInitUmountTrophyDataOpt();
+int APS5_VABI sceFsInitWorkspaceFileMetadataParam();
+int APS5_VABI sceFsLvdAttach();
+int APS5_VABI sceFsLvdAttach2();
+int APS5_VABI sceFsLvdAttachPartiallyCryptedDownloadData();
+int APS5_VABI sceFsLvdAttachSingleDefaultImage();
+int APS5_VABI sceFsLvdAttachSingleImage();
+int APS5_VABI sceFsLvdDetach();
+int APS5_VABI sceFsLvdDisableLayer();
+int APS5_VABI sceFsLvdEnableLayer();
+int APS5_VABI sceFsLvdSetDiscIdentity();
+int APS5_VABI sceFsLvdWaitResumed();
+int APS5_VABI sceFsMlfsMount();
+int APS5_VABI sceFsMlfsMountWithFlags();
+int APS5_VABI sceFsMlfsUmount();
+int APS5_VABI sceFsMountDownloadData();
+int APS5_VABI sceFsMountGamePkg();
+int APS5_VABI sceFsMountLwfs();
+int APS5_VABI sceFsMountLwfsCompat();
+int APS5_VABI sceFsMountPartiallyCryptedDownloadData();
+int APS5_VABI sceFsMountPprPkg();
+int APS5_VABI sceFsMountSaveData();
+int APS5_VABI sceFsMountTrophyData();
+int APS5_VABI sceFsNsfsAddOverlayToNamespace();
+int APS5_VABI sceFsNsfsMountWithFlags();
+int APS5_VABI sceFsNsfsSetGlobalExclude();
+int APS5_VABI sceFsNsfsUmount();
+int APS5_VABI sceFsPartitionTrim();
+int APS5_VABI sceFsReserveCluster();
+int APS5_VABI sceFsSetAttribute();
+int APS5_VABI sceFsSetClusterCacheSize();
+int APS5_VABI sceFsSetFileReservedTotal();
+int APS5_VABI sceFsSetSystemReserveSize();
+int APS5_VABI sceFsSetWorkspaceFileHash();
+int APS5_VABI sceFsStatWorkspace();
+int APS5_VABI sceFsSysStorageGetStatus();
+int APS5_VABI sceFsTransactionCancel();
+int APS5_VABI sceFsTransactionSaveDataInitMountOpt();
+int APS5_VABI sceFsTransactionSaveDataMount();
+int APS5_VABI sceFsTransactionStart();
+int APS5_VABI sceFsTrophyImageError();
+int APS5_VABI sceFsUfsAllocateAdditionalContents();
+int APS5_VABI sceFsUfsAllocateAligned();
+int APS5_VABI sceFsUfsAllocateDownloadData();
+int APS5_VABI sceFsUfsAllocateGameImage();
+int APS5_VABI sceFsUfsAllocatePatchImage();
+int APS5_VABI sceFsUfsAllocateSaveData();
+int APS5_VABI sceFsUfsAllocateTrophyData();
+int APS5_VABI sceFsUfsCheckCleanFlag();
+int APS5_VABI sceFsUfsCheckFixedCylinderGroupSize();
+int APS5_VABI sceFsUfsCollectTelemetry();
+int APS5_VABI sceFsUfsCollectTelemetry2();
+int APS5_VABI sceFsUfsDirectWrite();
+int APS5_VABI sceFsUfsEstimateZoneCapacityForUser();
+int APS5_VABI sceFsUfsExtendFile();
+int APS5_VABI sceFsUfsFsck();
+int APS5_VABI sceFsUfsFsckWithMM();
+int APS5_VABI sceFsUfsGetExtentMap();
+int APS5_VABI sceFsUfsGrowLwfs();
+int APS5_VABI sceFsUfsGrowfs();
+int APS5_VABI sceFsUfsHideBlocksFromUser();
+int APS5_VABI sceFsUfsInitalizeSparseFile();
+int APS5_VABI sceFsUfsLargewriteFsck();
+int APS5_VABI sceFsUfsLargewriteFsckWithMM();
+int APS5_VABI sceFsUfsMkLwfs();
+int APS5_VABI sceFsUfsMkfs();
+int APS5_VABI sceFsUfsMkfsForExternalHDD();
+int APS5_VABI sceFsUfsMkfsForSystem();
+int APS5_VABI sceFsUfsMkfsWithFixedCylinderGroupSize();
+int APS5_VABI sceFsUfsReallocateSparseFile();
+int APS5_VABI sceFsUfsRecryptBlocks();
+int APS5_VABI sceFsUfsRecryptGetState();
+int APS5_VABI sceFsUfsRecryptIsUnfinished();
+int APS5_VABI sceFsUfsRecryptSyncMetadata();
+int APS5_VABI sceFsUfsSeekHoleInFile();
+int APS5_VABI sceFsUfsStopOperation();
+int APS5_VABI sceFsUmountDownloadData();
+int APS5_VABI sceFsUmountGamePkg();
+int APS5_VABI sceFsUmountLwfs();
+int APS5_VABI sceFsUmountLwfsCompat();
+int APS5_VABI sceFsUmountSaveData();
+int APS5_VABI sceFsUmountTrophyData();
+int APS5_VABI sceFsUmountWorkspace();
+int APS5_VABI sceFsUnbindApplication();
+int APS5_VABI sceFsUnbindPackages();
+int APS5_VABI sceFsWsCreate();
+int APS5_VABI sceFsWsDelete();
+int APS5_VABI sceFsWsFetchFileMetadata();
+int APS5_VABI sceFsWsFsck();
+int APS5_VABI sceFsWsGetStatus();
+int APS5_VABI sceFsWsMount();
+int APS5_VABI sceFsWsUmount();
+
+}
diff --git a/core/libs/prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp b/core/libs/prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp
new file mode 100644
index 0000000000..bba8925b6e
--- /dev/null
+++ b/core/libs/prx/libSceFsInternalForVsh/libSceFsInternalForVsh.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceFsInternalForVsh/include/Api.hpp"
diff --git a/core/libs/prx/libSceGLSlimVSH/libSceGLSlimVSH.hpp b/core/libs/prx/libSceGLSlimVSH/libSceGLSlimVSH.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGLSlimVSH/libSceGLSlimVSH.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGameCustomDataDialog/CMakeLists.txt b/core/libs/prx/libSceGameCustomDataDialog/CMakeLists.txt
new file mode 100644
index 0000000000..6f19d7891e
--- /dev/null
+++ b/core/libs/prx/libSceGameCustomDataDialog/CMakeLists.txt
@@ -0,0 +1,14 @@
+add_library(libSceGameCustomDataDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceGameCustomDataDialog PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceGameCustomDataDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_game_custom_data_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestGameCustomDataDialog.cpp)
+    target_include_directories(guest_game_custom_data_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_game_custom_data_dialog_tests PRIVATE libSceGameCustomDataDialog)
+    add_test(NAME guest_game_custom_data_dialog COMMAND guest_game_custom_data_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_game_custom_data_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceGameCustomDataDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceGameCustomDataDialog/Export.cpp b/core/libs/prx/libSceGameCustomDataDialog/Export.cpp
index 5b647ad000..48093e841d 100644
--- a/core/libs/prx/libSceGameCustomDataDialog/Export.cpp
+++ b/core/libs/prx/libSceGameCustomDataDialog/Export.cpp
@@ -1,14 +1,75 @@
+#include "prx/libSceGameCustomDataDialog/include/Api.hpp"
+#include <atomic>
+#include <cstdint>
+#include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+std::atomic<int> g_status{COMMON_DIALOG_STATUS_NONE};
+
+}
+
 extern "C" {
 
-int APS5_VABI sceGameCustomDataDialogGetResult() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGameCustomDataDialogInitialize(void) {
+    int expected = COMMON_DIALOG_STATUS_NONE;
+    if (!g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_INITIALIZED)) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
     return 0;
 }
 
-int APS5_VABI sceGameCustomDataDialogInitialize() {
+int APS5_VABI sceGameCustomDataDialogOpenA(const void* param) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
+    return 0;
+}
+
+int APS5_VABI sceGameCustomDataDialogUpdateStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceGameCustomDataDialogGetStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceGameCustomDataDialogGetResultA(void* result) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (status != COMMON_DIALOG_STATUS_FINISHED) return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    const std::int32_t canceled = COMMON_DIALOG_RESULT_USER_CANCELED;
+    std::memcpy(result, &canceled, sizeof(canceled));
+    return 0;
+}
+
+int APS5_VABI sceGameCustomDataDialogClose(void) {
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
+    return 0;
+}
+
+int APS5_VABI sceGameCustomDataDialogTerminate(void) {
+    if (g_status.exchange(COMMON_DIALOG_STATUS_NONE) == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    return 0;
+}
+
+int APS5_VABI sceGameCustomDataDialogGetResult() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -18,14 +79,4 @@ int APS5_VABI sceGameCustomDataDialogOpen() {
     return 0;
 }
 
-int APS5_VABI sceGameCustomDataDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceGameCustomDataDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libSceGameCustomDataDialog/include/Api.hpp b/core/libs/prx/libSceGameCustomDataDialog/include/Api.hpp
new file mode 100644
index 0000000000..20d28826e7
--- /dev/null
+++ b/core/libs/prx/libSceGameCustomDataDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGameCustomDataDialogInitialize(void);
+int APS5_VABI sceGameCustomDataDialogOpenA(const void* param);
+int APS5_VABI sceGameCustomDataDialogUpdateStatus(void);
+int APS5_VABI sceGameCustomDataDialogGetStatus(void);
+int APS5_VABI sceGameCustomDataDialogGetResultA(void* result);
+int APS5_VABI sceGameCustomDataDialogClose(void);
+int APS5_VABI sceGameCustomDataDialogTerminate(void);
+int APS5_VABI sceGameCustomDataDialogGetResult();
+int APS5_VABI sceGameCustomDataDialogOpen();
+
+}
diff --git a/core/libs/prx/libSceGameCustomDataDialog/libSceGameCustomDataDialog.hpp b/core/libs/prx/libSceGameCustomDataDialog/libSceGameCustomDataDialog.hpp
new file mode 100644
index 0000000000..c5267d6b1a
--- /dev/null
+++ b/core/libs/prx/libSceGameCustomDataDialog/libSceGameCustomDataDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGameCustomDataDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceGameLiveStreaming/Export.cpp b/core/libs/prx/libSceGameLiveStreaming/Export.cpp
index d4a4a9bdbd..d9e1f9a227 100644
--- a/core/libs/prx/libSceGameLiveStreaming/Export.cpp
+++ b/core/libs/prx/libSceGameLiveStreaming/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameLiveStreaming/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,25 +6,16 @@
 #include "prx/libSceUserService/UserService.hpp"
 #include <cstring>
 #include <mutex>
+#include <stdexcept>
+#include <string>
 
 static std::mutex g_mutex;
 static bool g_initialized = false;
 static constexpr int ErrorInvalidArgument = static_cast<int>(0x80A00002);
 static constexpr int ErrorAlreadyInitialized = static_cast<int>(0x80A00003);
 static constexpr int ErrorNotInitialized = static_cast<int>(0x80A00004);
+static constexpr std::size_t ProgramInfoSize = 0x134C;
 
-struct GameLiveStreamingProgramInfo;
-
-struct GameLiveStreamingStatus2 {
-    std::int32_t userId;
-    bool isOnAir;
-    std::uint8_t align[3];
-    std::uint32_t spectatorCounts;
-    std::uint32_t textMessageCounts;
-    std::uint32_t commandMessageCounts;
-    std::uint32_t broadcastVideoResolution;
-    std::uint8_t reserved[48];
-};
 static_assert(sizeof(GameLiveStreamingStatus2) == 72);
 
 extern "C" {
@@ -53,7 +45,10 @@ int APS5_VABI sceGameLiveStreamingGetCurrentStatus2(GameLiveStreamingStatus2* st
 }
 
 int APS5_VABI sceGameLiveStreamingGetProgramInfo(GameLiveStreamingProgramInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return ErrorNotInitialized;
+    if (info == nullptr) return ErrorInvalidArgument;
+    std::memset(info, 0, ProgramInfoSize);
     return 0;
 }
 
@@ -102,7 +97,7 @@ int APS5_VABI sceGameLiveStreamingSetMaxBitrate(void) {
     return 0;
 }
 
-int APS5_VABI sceGameLiveStreamingGetCurrentStatus(void) {
+int APS5_VABI sceGameLiveStreamingGetCurrentStatus(GameLiveStreamingStatus* status) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -267,8 +262,10 @@ int APS5_VABI sceGameLiveStreamingStopDebugBroadcast(void) {
     return 0;
 }
 
-int APS5_VABI sceGameLiveStreamingEnableLiveStreaming(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGameLiveStreamingEnableLiveStreaming(bool isEnableLiveStreaming) {
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) throw std::logic_error(std::string(__func__) + ": not initialized");
+    (void)isEnableLiveStreaming;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceGameLiveStreaming/include/Api.hpp b/core/libs/prx/libSceGameLiveStreaming/include/Api.hpp
new file mode 100644
index 0000000000..28b744e492
--- /dev/null
+++ b/core/libs/prx/libSceGameLiveStreaming/include/Api.hpp
@@ -0,0 +1,78 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+
+struct GameLiveStreamingProgramInfo;
+
+struct GameLiveStreamingStatus {
+    std::uint8_t opaque00[12];
+    std::uint8_t reserved[60];
+};
+
+static_assert(offsetof(GameLiveStreamingStatus, reserved) == 0x0C);
+static_assert(sizeof(GameLiveStreamingStatus) == 0x48);
+
+struct GameLiveStreamingStatus2 {
+    std::int32_t userId;
+    bool isOnAir;
+    std::uint8_t align[3];
+    std::uint32_t spectatorCounts;
+    std::uint32_t textMessageCounts;
+    std::uint32_t commandMessageCounts;
+    std::uint32_t broadcastVideoResolution;
+    std::uint8_t reserved[48];
+};
+
+extern "C" {
+
+int APS5_VABI sceGameLiveStreamingInitialize(size_t heapSize);
+int APS5_VABI sceGameLiveStreamingTerminate(void);
+int APS5_VABI sceGameLiveStreamingGetCurrentStatus2(GameLiveStreamingStatus2* status);
+int APS5_VABI sceGameLiveStreamingGetProgramInfo(GameLiveStreamingProgramInfo* info);
+int APS5_VABI sceGameLiveStreamingScreenInitialize(void);
+int APS5_VABI sceGameLiveStreamingScreenInitializeSeparateModeParameter(void);
+int APS5_VABI sceGameLiveStreamingScreenTerminate(void);
+int APS5_VABI sceGameLiveStreamingScreenCloseSeparateMode(void);
+int APS5_VABI sceGameLiveStreamingScreenConfigureSeparateMode(void);
+int APS5_VABI sceGameLiveStreamingScreenOpenSeparateMode(void);
+int APS5_VABI sceGameLiveStreamingScreenSetMode(void);
+int APS5_VABI sceGameLiveStreamingPermitLiveStreaming(void);
+int APS5_VABI sceGameLiveStreamingSetMaxBitrate(void);
+int APS5_VABI sceGameLiveStreamingGetCurrentStatus(GameLiveStreamingStatus* status);
+int APS5_VABI sceGameLiveStreamingEnableSocialFeedback(void);
+int APS5_VABI sceGameLiveStreamingGetSocialFeedbackMessagesCount(void);
+int APS5_VABI sceGameLiveStreamingGetSocialFeedbackMessages(void);
+int APS5_VABI sceGameLiveStreamingPermitServerSideRecording(void);
+int APS5_VABI sceGameLiveStreamingSetMetadata(void);
+int APS5_VABI sceGameLiveStreamingSetSpoilerTag(void);
+int APS5_VABI sceGameLiveStreamingClearSpoilerTag(void);
+int APS5_VABI sceGameLiveStreamingSetPresetSocialFeedbackCommands(void);
+int APS5_VABI sceGameLiveStreamingClearPresetSocialFeedbackCommands(void);
+int APS5_VABI sceGameLiveStreamingSetPresetSocialFeedbackCommandsDescription(void);
+int APS5_VABI sceGameLiveStreamingClearSocialFeedbackMessages(void);
+int APS5_VABI sceGameLiveStreamingPostSocialMessage(void);
+int APS5_VABI sceGameLiveStreamingSetCameraFrameSetting(void);
+int APS5_VABI sceGameLiveStreamingSetServiceProviderPermission(void);
+int APS5_VABI sceGameLiveStreamingSetDefaultServiceProviderPermission(void);
+int APS5_VABI sceGameLiveStreamingSetInvitationSessionId(void);
+int APS5_VABI sceGameLiveStreamingStartGenerateStandbyScreenResource(void);
+int APS5_VABI sceGameLiveStreamingStopGenerateStandbyScreenResource(void);
+int APS5_VABI sceGameLiveStreamingRegisterCallback(void);
+int APS5_VABI sceGameLiveStreamingUnregisterCallback(void);
+int APS5_VABI sceGameLiveStreamingCheckCallback(void);
+int APS5_VABI sceGameLiveStreamingSetStandbyScreenResource(void);
+int APS5_VABI sceGameLiveStreamingGetCurrentBroadcastScreenLayout(void);
+int APS5_VABI sceGameLiveStreamingLaunchLiveViewer(void);
+int APS5_VABI sceGameLiveStreamingLaunchLiveViewerA(void);
+int APS5_VABI sceGameLiveStreamingSetGuardAreas(void);
+int APS5_VABI sceGameLiveStreamingStartSocialFeedbackMessageFiltering(void);
+int APS5_VABI sceGameLiveStreamingStopSocialFeedbackMessageFiltering(void);
+int APS5_VABI sceGameLiveStreamingApplySocialFeedbackMessageFilter(void);
+int APS5_VABI sceGameLiveStreamingSetLinkCommentPreset(void);
+int APS5_VABI sceGameLiveStreamingStartDebugBroadcast(void);
+int APS5_VABI sceGameLiveStreamingStopDebugBroadcast(void);
+int APS5_VABI sceGameLiveStreamingEnableLiveStreaming(bool isEnableLiveStreaming);
+
+}
diff --git a/core/libs/prx/libSceGameLiveStreaming/libSceGameLiveStreaming.hpp b/core/libs/prx/libSceGameLiveStreaming/libSceGameLiveStreaming.hpp
new file mode 100644
index 0000000000..65b14e5bdf
--- /dev/null
+++ b/core/libs/prx/libSceGameLiveStreaming/libSceGameLiveStreaming.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGameLiveStreaming/include/Api.hpp"
diff --git a/core/libs/prx/libSceGameUpdate/Export.cpp b/core/libs/prx/libSceGameUpdate/Export.cpp
index f8527db000..dfcb3d1383 100644
--- a/core/libs/prx/libSceGameUpdate/Export.cpp
+++ b/core/libs/prx/libSceGameUpdate/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameUpdate/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceGameUpdate/include/Api.hpp b/core/libs/prx/libSceGameUpdate/include/Api.hpp
new file mode 100644
index 0000000000..2de12ef941
--- /dev/null
+++ b/core/libs/prx/libSceGameUpdate/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGameUpdateAbortRequest(int requestId);
+int APS5_VABI sceGameUpdateCheck(int requestId, const GameUpdateCheckParam* param, GameUpdateCheckResult* result);
+int APS5_VABI sceGameUpdateCreateRequest(void);
+int APS5_VABI sceGameUpdateDeleteRequest(int requestId);
+int APS5_VABI sceGameUpdateGetAddcontLatestVersion(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, GameUpdateAddcontVersionInfo* info);
+int APS5_VABI sceGameUpdateInitialize(void);
+int APS5_VABI sceGameUpdateTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceGameUpdate/libSceGameUpdate.hpp b/core/libs/prx/libSceGameUpdate/libSceGameUpdate.hpp
new file mode 100644
index 0000000000..9807085ba6
--- /dev/null
+++ b/core/libs/prx/libSceGameUpdate/libSceGameUpdate.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGameUpdate/include/Api.hpp"
diff --git a/core/libs/prx/libSceGic/Export.cpp b/core/libs/prx/libSceGic/Export.cpp
index 6fff8198ce..2c4656fad6 100644
--- a/core/libs/prx/libSceGic/Export.cpp
+++ b/core/libs/prx/libSceGic/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGic/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceGic/include/Api.hpp b/core/libs/prx/libSceGic/include/Api.hpp
new file mode 100644
index 0000000000..889405a588
--- /dev/null
+++ b/core/libs/prx/libSceGic/include/Api.hpp
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGicGetValue();
+
+}
diff --git a/core/libs/prx/libSceGic/libSceGic.hpp b/core/libs/prx/libSceGic/libSceGic.hpp
new file mode 100644
index 0000000000..1f60bb76a8
--- /dev/null
+++ b/core/libs/prx/libSceGic/libSceGic.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGic/include/Api.hpp"
diff --git a/core/libs/prx/libSceGifParser/libSceGifParser.hpp b/core/libs/prx/libSceGifParser/libSceGifParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGifParser/libSceGifParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGnmDriverCompat1/libSceGnmDriverCompat1.hpp b/core/libs/prx/libSceGnmDriverCompat1/libSceGnmDriverCompat1.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverCompat1/libSceGnmDriverCompat1.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp b/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp
index 9b7f2684c4..b09d2a8a87 100644
--- a/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp
@@ -1,35 +1,143 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
 #include <cstdint>
+#include <algorithm>
 #include <cstddef>
+#include <initializer_list>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp"
+#include "prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp"
 
 namespace {
 
+constexpr std::uint32_t InitPacketWords = 0x100;
+
+template <std::size_t Words>
+int WriteHardwareState(std::uint32_t* cmdbuf, std::uint32_t size, const std::array<std::uint32_t, Words>& state) {
+    if (size < InitPacketWords) return 0;
+    auto* at = std::copy(GnmNeo::ClearState.begin(), GnmNeo::ClearState.end(), cmdbuf);
+    at = std::copy(state.begin(), state.end(), at);
+    const auto padding = static_cast<std::uint32_t>(cmdbuf + InitPacketWords - at - 1);
+    at[0] = 0xc0001000u | ((padding - 1) << 16);
+    at[1] = 0;
+    return InitPacketWords;
+}
+
+template <std::size_t Words>
+int WriteContextState(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t packetWords, const std::array<std::uint32_t, Words>& state) {
+    if (size != packetWords) return 0;
+    std::copy(state.begin(), state.end(), cmdbuf);
+    return static_cast<int>(packetWords);
+}
+
+constexpr std::uint32_t OpSetContextReg = 0x69;
+constexpr std::uint32_t OpSetShReg = 0x76;
+
+std::uint32_t* EmitPacket(std::uint32_t* at, std::uint32_t opcode, std::initializer_list<std::uint32_t> body) {
+    *at++ = 0xc0000000u | ((static_cast<std::uint32_t>(body.size()) - 1) << 16) | (opcode << 8);
+    for (const auto word : body) *at++ = word;
+    return at;
+}
+
+std::uint32_t AddressLo(const void* code) {
+    return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(code) >> 8);
+}
+
+std::uint32_t AddressHi(const void* code) {
+    return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(code) >> 40);
+}
+
 constexpr int Failure = static_cast<int>(0x8EEE00FFu);
 constexpr int NoInterface = static_cast<int>(0x80000000u);
 constexpr int ValidationNotEnabled = static_cast<int>(0x80D13FFFu);
 
+constexpr int CommandFailed = -1;
+constexpr std::uint32_t OpNop = 0x10;
+constexpr std::uint32_t NeoDrawFlags = 0xe0000000u;
+constexpr std::uint32_t AutoIndex = 2;
+
+constexpr std::uint32_t Header(std::uint32_t opcode, std::uint32_t bodyWords, bool compute = false, bool predicated = false) {
+    return 0xc0000000u | ((bodyWords - 1) << 16) | (opcode << 8) | (compute ? 2u : 0u) | (predicated ? 1u : 0u);
+}
+
+std::uint32_t* Nop(std::uint32_t* at, std::uint32_t bodyWords) {
+    at[0] = Header(OpNop, bodyWords);
+    at[1] = 0;
+    return at + 1 + bodyWords;
+}
+
+constexpr std::uint32_t ShaderStageCount = 7;
+constexpr std::uint32_t StageVs = 2;
+constexpr std::uint32_t StageEs = 4;
+constexpr std::uint32_t StageLs = 6;
+constexpr std::uint32_t IndirectSgprBase[ShaderStageCount] = {0, 0, 0x4c, 0, 0xcc, 0, 0x14c};
+constexpr std::uint32_t DrawIndirectArgsBytes = 0x10;
+constexpr std::uint32_t DrawIndexedIndirectArgsBytes = 0x14;
+
+std::uint32_t IndirectSgpr(std::uint32_t stage, std::uint32_t offset) {
+    return offset == 0 ? 0 : (offset & 0xffffu) + IndirectSgprBase[stage];
+}
+
+bool ValidIndirect(std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr) {
+    return stage < ShaderStageCount && vertexSgpr < 0x10 && instanceSgpr < 0x10;
+}
+
+bool IndexedIndirectStage(std::uint32_t stage) {
+    return stage == StageVs || stage == StageEs || stage == StageLs;
+}
+
+constexpr std::uint32_t OpSetUconfigReg = 0x79;
+constexpr std::uint32_t IaMultiVgtParam = 0x40000258u;
+
+std::uint32_t* UpdatePsRegisters(std::uint32_t* cmdbuf, const std::uint32_t* regs) {
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {10, regs[2], regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e01c4u, regs[4], regs[5]});
+    at = EmitPacket(at, OpNop, {0xc01e01b3u, regs[6], regs[7]});
+    at = EmitPacket(at, OpNop, {0xc01e01b6u, regs[8]});
+    at = EmitPacket(at, OpNop, {0xc01e01b8u, regs[9]});
+    at = EmitPacket(at, OpNop, {0xc01e0203u, regs[10]});
+    return EmitPacket(at, OpNop, {0xc01e008fu, regs[11]});
+}
+
 } // namespace
 
 extern "C" {
 
-int APS5_VABI sceGnmBeginWorkload(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmBeginWorkload(std::uint32_t stream, std::uint64_t* workload) {
+    if (!workload) return 3;
+    *workload = stream < 0x10 ? 1 : 0;
+    return stream < 0x10 ? 0 : 1;
+}
+
+int APS5_VABI sceGnmComputeWaitOnAddress(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t address, std::uint32_t mask, std::uint32_t compare, std::uint32_t reference) {
+    if (!cmdbuf || size != 14) return CommandFailed;
+    auto* at = Nop(cmdbuf, 3);
+    const bool memory = address > 0xffff;
+    at[0] = Header(0x3c, 6);
+    at[1] = (memory ? 1u << 4 : 0u) | (compare & 7);
+    at[2] = static_cast<std::uint32_t>(address & (memory ? 0xfffffffcu : 0xffffu));
+    at[3] = static_cast<std::uint32_t>(address >> 32);
+    at[4] = reference;
+    at[5] = mask;
+    at[6] = 10;
+    Nop(at + 7, 2);
     return 0;
 }
 
-int APS5_VABI sceGnmComputeWaitOnAddress(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmComputeWaitSemaphore(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t semaphoreAddress, std::uint32_t flags) {
+    if (!cmdbuf || size != 10) return CommandFailed;
+    auto* at = Nop(cmdbuf, 3);
+    at[0] = Header(0x39, 2);
+    at[1] = static_cast<std::uint32_t>(semaphoreAddress);
+    at[2] = (flags == 1 ? 0x100000u : 0u) - 0x20000000u + static_cast<std::uint32_t>(semaphoreAddress >> 32);
+    Nop(at + 3, 2);
     return 0;
 }
 
-int APS5_VABI sceGnmComputeWaitSemaphore(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceGnmCreateWorkloadStream(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmCreateWorkloadStream(std::uint64_t name, std::uint32_t* stream) {
+    if (name == 0 || !stream) return 3;
+    *stream = 1;
     return 0;
 }
 
@@ -51,43 +159,96 @@ int APS5_VABI sceGnmDingDongForWorkload(void) {
     return 0;
 }
 
-int APS5_VABI sceGnmDispatchDirect(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDispatchDirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t threadsX, std::uint32_t threadsY, std::uint32_t threadsZ, std::uint32_t flags) {
+    if (!cmdbuf || size != 9 || static_cast<std::int32_t>(threadsX | threadsY | threadsZ) < 0) return CommandFailed;
+    cmdbuf[0] = Header(0x15, 4, true, flags & 1);
+    cmdbuf[1] = threadsX;
+    cmdbuf[2] = threadsY;
+    cmdbuf[3] = threadsZ;
+    cmdbuf[4] = (flags & 0x18) + 1;
+    Nop(cmdbuf + 5, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDispatchIndirect(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDispatchIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t flags) {
+    if (!cmdbuf || size != 7) return CommandFailed;
+    cmdbuf[0] = Header(0x16, 2, true, flags & 1);
+    cmdbuf[1] = dataOffset;
+    cmdbuf[2] = (flags & 0x18) + 1;
+    Nop(cmdbuf + 3, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDispatchIndirectOnMec(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDispatchIndirectOnMec(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t args, std::uint32_t modifier) {
+    if (!cmdbuf || size != 8 || args == 0 || (args & 3) != 0) return CommandFailed;
+    cmdbuf[0] = Header(0x16, 3, true, modifier & 1);
+    cmdbuf[1] = static_cast<std::uint32_t>(args);
+    cmdbuf[2] = static_cast<std::uint32_t>(args >> 32);
+    cmdbuf[3] = (modifier & 0x18) | 1;
+    cmdbuf[4] = Header(OpNop, 3);
+    cmdbuf[5] = 0;
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndex(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndex(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexCount, std::uint64_t indexAddress, std::uint32_t flags, std::uint32_t) {
+    if (!cmdbuf || size != 10 || indexAddress == 0 || (indexAddress & 1) != 0 || (flags & 0x1ffffffeu) != 0) return CommandFailed;
+    cmdbuf[0] = Header(0x27, 5);
+    cmdbuf[1] = indexCount;
+    cmdbuf[2] = static_cast<std::uint32_t>(indexAddress);
+    cmdbuf[3] = static_cast<std::uint32_t>(indexAddress >> 32);
+    cmdbuf[4] = indexCount;
+    cmdbuf[5] = flags & NeoDrawFlags;
+    Nop(cmdbuf + 6, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndexAuto(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndexAuto(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexCount, std::uint32_t flags) {
+    if (!cmdbuf || size != 7 || (flags & 0x1ffffffeu) != 0) return CommandFailed;
+    cmdbuf[0] = Header(0x2d, 2);
+    cmdbuf[1] = indexCount;
+    cmdbuf[2] = (flags & NeoDrawFlags) | AutoIndex;
+    Nop(cmdbuf + 3, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndexIndirect(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndexIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags) {
+    if (!cmdbuf || size != 9 || !ValidIndirect(stage, vertexSgpr, instanceSgpr)) return CommandFailed;
+    cmdbuf[0] = Header(0x25, 4, false, flags & 1);
+    cmdbuf[1] = dataOffset;
+    cmdbuf[2] = IndirectSgpr(stage, vertexSgpr);
+    cmdbuf[3] = IndirectSgpr(stage, instanceSgpr);
+    cmdbuf[4] = flags & NeoDrawFlags;
+    Nop(cmdbuf + 5, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndexIndirectCountMulti(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndexIndirectCountMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint64_t countAddress, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags) {
+    if (!cmdbuf || size != 0x10 || vertexSgpr >= 0x10 || instanceSgpr >= 0x10 || !IndexedIndirectStage(stage)) return CommandFailed;
+    auto* at = Nop(cmdbuf, 2);
+    at[0] = Header(0x9d, 9, false, flags & 1);
+    at[1] = dataOffset;
+    at[2] = IndirectSgpr(stage, vertexSgpr);
+    at[3] = IndirectSgpr(stage, instanceSgpr);
+    at[4] = countAddress != 0 ? 1u << 30 : 0;
+    at[5] = maxCount;
+    at[6] = static_cast<std::uint32_t>(countAddress);
+    at[7] = static_cast<std::uint32_t>(countAddress >> 32);
+    at[8] = DrawIndexedIndirectArgsBytes;
+    at[9] = flags & NeoDrawFlags;
+    Nop(at + 10, 2);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndexIndirectMulti(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndexIndirectMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags) {
+    if (!cmdbuf || size != 11 || vertexSgpr >= 0x10 || instanceSgpr >= 0x10 || !IndexedIndirectStage(stage)) return CommandFailed;
+    cmdbuf[0] = Header(0x38, 6, false, flags & 1);
+    cmdbuf[1] = dataOffset;
+    cmdbuf[2] = IndirectSgpr(stage, vertexSgpr);
+    cmdbuf[3] = IndirectSgpr(stage, instanceSgpr);
+    cmdbuf[4] = maxCount;
+    cmdbuf[5] = DrawIndexedIndirectArgsBytes;
+    cmdbuf[6] = flags & NeoDrawFlags;
+    Nop(cmdbuf + 7, 3);
     return 0;
 }
 
@@ -96,49 +257,76 @@ int APS5_VABI sceGnmDrawIndexMultiInstanced(void) {
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndexOffset(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndexOffset(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexOffset, std::uint32_t indexCount, std::uint32_t flags) {
+    if (!cmdbuf || size != 9) return CommandFailed;
+    cmdbuf[0] = Header(0x35, 4, false, flags & 1);
+    cmdbuf[1] = indexCount;
+    cmdbuf[2] = indexOffset;
+    cmdbuf[3] = indexCount;
+    cmdbuf[4] = flags & NeoDrawFlags;
+    Nop(cmdbuf + 5, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndirect(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags) {
+    if (!cmdbuf || size != 9 || !ValidIndirect(stage, vertexSgpr, instanceSgpr)) return CommandFailed;
+    cmdbuf[0] = Header(0x24, 4, false, flags & 1);
+    cmdbuf[1] = dataOffset;
+    cmdbuf[2] = IndirectSgpr(stage, vertexSgpr);
+    cmdbuf[3] = IndirectSgpr(stage, instanceSgpr);
+    cmdbuf[4] = (flags & NeoDrawFlags) | AutoIndex;
+    Nop(cmdbuf + 5, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndirectCountMulti(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndirectCountMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint64_t countAddress, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags) {
+    if (!cmdbuf || size != 0x10 || !ValidIndirect(stage, vertexSgpr, instanceSgpr)) return CommandFailed;
+    auto* at = Nop(cmdbuf, 2);
+    at[0] = Header(0x9c, 9, false, flags & 1);
+    at[1] = dataOffset;
+    at[2] = IndirectSgpr(stage, vertexSgpr);
+    at[3] = IndirectSgpr(stage, instanceSgpr);
+    at[4] = countAddress != 0 ? 1u << 30 : 0;
+    at[5] = maxCount;
+    at[6] = static_cast<std::uint32_t>(countAddress);
+    at[7] = static_cast<std::uint32_t>(countAddress >> 32);
+    at[8] = DrawIndirectArgsBytes;
+    at[9] = (flags & NeoDrawFlags) | AutoIndex;
+    Nop(at + 10, 2);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawIndirectMulti(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmDrawIndirectMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags) {
+    if (!cmdbuf || size != 11 || !ValidIndirect(stage, vertexSgpr, instanceSgpr)) return CommandFailed;
+    cmdbuf[0] = Header(0x2c, 6, false, flags & 1);
+    cmdbuf[1] = dataOffset;
+    cmdbuf[2] = IndirectSgpr(stage, vertexSgpr);
+    cmdbuf[3] = IndirectSgpr(stage, instanceSgpr);
+    cmdbuf[4] = maxCount;
+    cmdbuf[5] = DrawIndirectArgsBytes;
+    cmdbuf[6] = (flags & NeoDrawFlags) | AutoIndex;
+    Nop(cmdbuf + 7, 3);
     return 0;
 }
 
-int APS5_VABI sceGnmDrawInitDefaultHardwareState(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmDrawInitDefaultHardwareState(std::uint32_t* cmdbuf, std::uint32_t size) {
+    return WriteHardwareState(cmdbuf, size, GnmNeo::HardwareState);
 }
 
-int APS5_VABI sceGnmDrawInitDefaultHardwareState200(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmDrawInitDefaultHardwareState200(std::uint32_t* cmdbuf, std::uint32_t size) {
+    return WriteHardwareState(cmdbuf, size, GnmNeo::HardwareState200);
 }
 
-int APS5_VABI sceGnmDrawInitDefaultHardwareState350(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmDrawInitDefaultHardwareState350(std::uint32_t* cmdbuf, std::uint32_t size) {
+    return WriteHardwareState(cmdbuf, size, GnmNeo::HardwareState350);
 }
 
-int APS5_VABI sceGnmDrawInitToDefaultContextState(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmDrawInitToDefaultContextState(std::uint32_t* cmdbuf, std::uint32_t size) {
+    return WriteContextState(cmdbuf, size, 0x20, GnmNeo::ContextState);
 }
 
-int APS5_VABI sceGnmDrawInitToDefaultContextState400(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmDrawInitToDefaultContextState400(std::uint32_t* cmdbuf, std::uint32_t size) {
+    return WriteContextState(cmdbuf, size, 0x100, GnmNeo::ContextState400);
 }
 
 int APS5_VABI sceGnmDrawInitToDefaultContextStateInternalCommand(void) {
@@ -185,9 +373,9 @@ int APS5_VABI sceGnmDriverTraceInProgress(void) {
     return 0;
 }
 
-int APS5_VABI sceGnmEndWorkload(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceGnmEndWorkload(std::uint64_t workload) {
+    if (workload == 0) return 2;
+    return ((workload >> 56) & 0xff) > 0xf ? 2 : 0;
 }
 
 int APS5_VABI sceGnmFindResources(void) {
@@ -223,8 +411,7 @@ int APS5_VABI sceGnmGetGpuBlockStatus(void) {
 }
 
 int APS5_VABI sceGnmGetGpuCoreClockFrequency(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 911000000;
 }
 
 int APS5_VABI sceGnmGetGpuInfoStatus(void) {
@@ -243,8 +430,7 @@ int APS5_VABI sceGnmGetNumTcaUnits(void) {
 }
 
 int APS5_VABI sceGnmGetOffChipTessellationBufferSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return 0x800000;
 }
 
 int APS5_VABI sceGnmGetOwnerName(void) {
@@ -304,8 +490,12 @@ int APS5_VABI sceGnmGpuPaDebugLeave(void) {
     return 0;
 }
 
-int APS5_VABI sceGnmInsertDingDongMarker(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmInsertDingDongMarker(std::uint32_t* cmdbuf, std::uint32_t size) {
+    if (!cmdbuf || size != 4) return CommandFailed;
+    cmdbuf[0] = Header(OpNop, 3);
+    cmdbuf[1] = 0;
+    cmdbuf[2] = 0;
+    cmdbuf[3] = 0;
     return 0;
 }
 
@@ -379,8 +569,11 @@ int APS5_VABI sceGnmRequestFlipAndSubmitDoneForWorkload(void) {
     return 0;
 }
 
-int APS5_VABI sceGnmResetVgtControl(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmResetVgtControl(std::uint32_t* cmdbuf, std::uint32_t size) {
+    if (!cmdbuf || size != 3) return CommandFailed;
+    cmdbuf[0] = Header(OpSetUconfigReg, 2);
+    cmdbuf[1] = IaMultiVgtParam;
+    cmdbuf[2] = 0x6d007fu;
     return 0;
 }
 
@@ -416,23 +609,65 @@ int APS5_VABI sceGnmSdmaOpen(void) {
     return Failure;
 }
 
-int APS5_VABI sceGnmSetCsShaderWithModifier(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetCsShaderWithModifier(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier) {
+    if (!cmdbuf || size <= 0x18 || !regs || (modifier & 0xfffffc3fu) != 0 || regs[1] != 0) return CommandFailed;
+    const std::uint32_t rsrc1 = modifier == 0 ? regs[2] : (regs[2] & 0xfffffc3fu) | modifier;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x20c, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x212, rsrc1, regs[3]});
+    at = EmitPacket(at, OpSetShReg, {0x207, regs[4], regs[5], regs[6]});
+    Nop(at, 11);
     return 0;
 }
 
-int APS5_VABI sceGnmSetEmbeddedPsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetEmbeddedPsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t) {
+    if (shaderId > 1) return Failure;
+    const bool black = shaderId == 0;
+    const auto* code = black ? GnmNeo::BlackPs.data() : GnmNeo::DepthOnlyPs.data();
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, AddressLo(code), AddressHi(code)});
+    at = EmitPacket(at, OpSetShReg, {10, black ? 0xc0000u : 0x2000u, black ? 4u : 0u});
+    at = EmitPacket(at, OpSetContextReg, {0x1c4, 0, black ? 4u : 2u});
+    at = EmitPacket(at, OpSetContextReg, {0x1b3, 2, 2});
+    at = EmitPacket(at, OpSetContextReg, {0x1b6, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x1b8, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x203, 0x10});
+    at = EmitPacket(at, OpSetContextReg, {0x8f, black ? 0xfu : 3u});
+    at[0] = 0xc00a1000u;
+    at[1] = 0;
     return 0;
 }
 
-int APS5_VABI sceGnmSetEmbeddedVsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetEmbeddedVsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t) {
+    if (shaderId != 0) return Failure;
+    const auto* code = GnmNeo::FullscreenVs.data();
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x48, AddressLo(code), AddressHi(code)});
+    at = EmitPacket(at, OpSetShReg, {0x4a, 0xc0000, 4});
+    at = EmitPacket(at, OpSetContextReg, {0x207, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x1b1, 0});
+    at = EmitPacket(at, OpSetContextReg, {0x1c3, 4});
+    at[0] = 0xc00a1000u;
+    at[1] = 0;
     return 0;
 }
 
-int APS5_VABI sceGnmSetPsShader350(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetPsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size <= 0x27) return CommandFailed;
+    if (!regs) {
+        auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, 0, 0});
+        at = EmitPacket(at, OpSetContextReg, {0x203, 0});
+        at = EmitPacket(at, OpSetContextReg, {0x8f, 0xf});
+        Nop(at, 0x1d);
+        return 0;
+    }
+    if (regs[1] != 0) return CommandFailed;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {10, regs[2], regs[3]});
+    at = EmitPacket(at, OpSetContextReg, {0x1c4, regs[4], regs[5]});
+    at = EmitPacket(at, OpSetContextReg, {0x1b3, regs[6], regs[7]});
+    at = EmitPacket(at, OpSetContextReg, {0x1b6, regs[8]});
+    at = EmitPacket(at, OpSetContextReg, {0x1b8, regs[9]});
+    at = EmitPacket(at, OpSetContextReg, {0x203, regs[10]});
+    at = EmitPacket(at, OpSetContextReg, {0x8f, regs[11]});
+    Nop(at, 11);
     return 0;
 }
 
@@ -452,8 +687,16 @@ int APS5_VABI sceGnmSetSpiEnableSqCountersForUnitInstance(void) {
     return Failure;
 }
 
-int APS5_VABI sceGnmSetVgtControl(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmSetVgtControl(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t primGroupSizeMinusOne, std::uint32_t partialVsWaveMode, std::uint32_t switchOnlyOnEop) {
+    if (!cmdbuf || size != 3 || primGroupSizeMinusOne >= 0x100 || (switchOnlyOnEop | partialVsWaveMode) >= 2) return CommandFailed;
+    const std::uint32_t switchOnEop = static_cast<std::uint32_t>(switchOnlyOnEop != 0) << 20;
+    const std::uint32_t switchOnEoi = static_cast<std::uint32_t>(switchOnlyOnEop == 0) << 19;
+    const std::uint32_t value = switchOnlyOnEop != 0
+        ? ((partialVsWaveMode & 1) << 16) | primGroupSizeMinusOne | switchOnEop | switchOnEoi | 0x40000u
+        : (primGroupSizeMinusOne & 0x1cffffu) | switchOnEop | switchOnEoi | 0x50000u;
+    cmdbuf[0] = Header(OpSetUconfigReg, 2);
+    cmdbuf[1] = IaMultiVgtParam;
+    cmdbuf[2] = value | 0x600000u;
     return 0;
 }
 
@@ -489,28 +732,64 @@ int APS5_VABI sceGnmUnregisterResource(void) {
     return Failure;
 }
 
-int APS5_VABI sceGnmUpdateGsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdateGsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size < 0x1d || !regs || regs[1] != 0) return CommandFailed;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x88, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x8a, regs[2], regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e02e5u, regs[4]});
+    at = EmitPacket(at, OpNop, {0xc01e029bu, regs[5]});
+    at = EmitPacket(at, OpNop, {0xc01e02e4u, regs[6]});
+    Nop(at, 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdateHsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdateHsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t lsHsConfig) {
+    if (!cmdbuf || size <= 0x1c || !regs || regs[1] != 0) return CommandFailed;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x108, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x10a, regs[2], regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e0286u, regs[5], regs[6]});
+    at = EmitPacket(at, OpNop, {0xc01e02dbu, regs[4]});
+    at = EmitPacket(at, OpNop, {0xc01e02d6u, lsHsConfig});
+    Nop(at, 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdatePsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdatePsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size <= 0x27) return CommandFailed;
+    if (!regs) {
+        auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, 0, 0});
+        at = EmitPacket(at, OpNop, {0xc01e0203u, 0});
+        Nop(at, 0x20);
+        return 0;
+    }
+    if (regs[1] != 0) return CommandFailed;
+    Nop(UpdatePsRegisters(cmdbuf, regs), 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdatePsShader350(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdatePsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs) {
+    if (!cmdbuf || size <= 0x27) return CommandFailed;
+    if (!regs) {
+        auto* at = EmitPacket(cmdbuf, OpSetShReg, {8, 0, 0});
+        at = EmitPacket(at, OpNop, {0xc01e0203u, 0});
+        at = EmitPacket(at, OpSetContextReg, {0x8f, 0xf});
+        Nop(at, 0x1d);
+        return 0;
+    }
+    if (regs[1] != 0) return CommandFailed;
+    Nop(UpdatePsRegisters(cmdbuf, regs), 11);
     return 0;
 }
 
-int APS5_VABI sceGnmUpdateVsShader(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceGnmUpdateVsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier) {
+    if (!cmdbuf || size <= 0x1c || !regs || (modifier & 0xfcfffc3fu) != 0 || regs[1] != 0) return CommandFailed;
+    const std::uint32_t rsrc1 = modifier == 0 ? regs[2] : (regs[2] & 0xfcfffc3fu) | modifier;
+    auto* at = EmitPacket(cmdbuf, OpSetShReg, {0x48, regs[0], 0});
+    at = EmitPacket(at, OpSetShReg, {0x4a, rsrc1, regs[3]});
+    at = EmitPacket(at, OpNop, {0xc01e0207u, regs[6]});
+    at = EmitPacket(at, OpNop, {0xc01e01b1u, regs[4]});
+    at = EmitPacket(at, OpNop, {0xc01e01c3u, regs[5]});
+    Nop(at, 11);
     return 0;
 }
 
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/include/Api.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/include/Api.hpp
new file mode 100644
index 0000000000..f9ecf8db4c
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/include/Api.hpp
@@ -0,0 +1,126 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceGnmBeginWorkload(std::uint32_t stream, std::uint64_t* workload);
+int APS5_VABI sceGnmComputeWaitOnAddress(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t address, std::uint32_t mask, std::uint32_t compare, std::uint32_t reference);
+int APS5_VABI sceGnmComputeWaitSemaphore(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t semaphoreAddress, std::uint32_t flags);
+int APS5_VABI sceGnmCreateWorkloadStream(std::uint64_t name, std::uint32_t* stream);
+int APS5_VABI sceGnmDebugModuleReset(void);
+int APS5_VABI sceGnmDebugReset(void);
+int APS5_VABI sceGnmDestroyWorkloadStream(void);
+int APS5_VABI sceGnmDingDongForWorkload(void);
+int APS5_VABI sceGnmDispatchDirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t threadsX, std::uint32_t threadsY, std::uint32_t threadsZ, std::uint32_t flags);
+int APS5_VABI sceGnmDispatchIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t flags);
+int APS5_VABI sceGnmDispatchIndirectOnMec(std::uint32_t* cmdbuf, std::uint32_t size, std::uint64_t args, std::uint32_t modifier);
+int APS5_VABI sceGnmDrawIndex(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexCount, std::uint64_t indexAddress, std::uint32_t flags, std::uint32_t);
+int APS5_VABI sceGnmDrawIndexAuto(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexCount, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexIndirectCountMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint64_t countAddress, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexIndirectMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndexMultiInstanced(void);
+int APS5_VABI sceGnmDrawIndexOffset(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t indexOffset, std::uint32_t indexCount, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndirect(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndirectCountMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint64_t countAddress, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawIndirectMulti(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t dataOffset, std::uint32_t maxCount, std::uint32_t stage, std::uint32_t vertexSgpr, std::uint32_t instanceSgpr, std::uint32_t flags);
+int APS5_VABI sceGnmDrawInitDefaultHardwareState(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitDefaultHardwareState200(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitDefaultHardwareState350(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitToDefaultContextState(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitToDefaultContextState400(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmDrawInitToDefaultContextStateInternalCommand(void);
+int APS5_VABI sceGnmDrawInitToDefaultContextStateInternalSize(void);
+int APS5_VABI sceGnmDrawOpaqueAuto(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterface(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForGpuDebugger(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForReplay(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForResourceRegistration(void);
+int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForValidation(void);
+int APS5_VABI sceGnmDriverInternalVirtualQuery(void);
+int APS5_VABI sceGnmDriverTraceInProgress(void);
+int APS5_VABI sceGnmEndWorkload(std::uint64_t workload);
+int APS5_VABI sceGnmFindResources(void);
+int APS5_VABI sceGnmFindResourcesPublic(void);
+int APS5_VABI sceGnmGetCoredumpAddress(void);
+int APS5_VABI sceGnmGetCoredumpMode(void);
+int APS5_VABI sceGnmGetCoredumpProtectionFaultTimestamp(void);
+int APS5_VABI sceGnmGetDbgGcHandle(void);
+int APS5_VABI sceGnmGetGpuBlockStatus(void);
+int APS5_VABI sceGnmGetGpuCoreClockFrequency(void);
+int APS5_VABI sceGnmGetGpuInfoStatus(void);
+int APS5_VABI sceGnmGetLastWaitedAddress(void);
+int APS5_VABI sceGnmGetNumTcaUnits(void);
+int APS5_VABI sceGnmGetOffChipTessellationBufferSize(void);
+int APS5_VABI sceGnmGetOwnerName(void);
+int APS5_VABI sceGnmGetPhysicalCounterFromVirtualized(void);
+int APS5_VABI sceGnmGetProtectionFaultTimeStamp(void);
+int APS5_VABI sceGnmGetResourceBaseAddressAndSizeInBytes(void);
+int APS5_VABI sceGnmGetResourceName(void);
+int APS5_VABI sceGnmGetResourceRegistrationBuffers(void);
+int APS5_VABI sceGnmGetResourceShaderGuid(void);
+int APS5_VABI sceGnmGetResourceType(void);
+int APS5_VABI sceGnmGetResourceUserData(void);
+int APS5_VABI sceGnmGetShaderProgramBaseAddress(void);
+int APS5_VABI sceGnmGetShaderStatus(void);
+int APS5_VABI sceGnmGpuPaDebugEnter(void);
+int APS5_VABI sceGnmGpuPaDebugLeave(void);
+int APS5_VABI sceGnmInsertDingDongMarker(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmInsertThreadTraceMarker(void);
+int APS5_VABI sceGnmIsCoredumpValid(void);
+int APS5_VABI sceGnmLogicalTcaUnitToPhysical(void);
+int APS5_VABI sceGnmMapComputeQueueWithPriority(void);
+int APS5_VABI sceGnmPaDisableFlipCallbacks(void);
+int APS5_VABI sceGnmPaEnableFlipCallbacks(void);
+int APS5_VABI sceGnmPaHeartbeat(void);
+int APS5_VABI sceGnmQueryResourceRegistrationUserMemoryRequirements(void);
+int APS5_VABI sceGnmRaiseUserExceptionEvent(void);
+int APS5_VABI sceGnmRegisterGdsResource(void);
+int APS5_VABI sceGnmRegisterGnmLiveCallbackConfig(void);
+int APS5_VABI sceGnmRegisterOwner(void);
+int APS5_VABI sceGnmRegisterOwnerForSystem(void);
+int APS5_VABI sceGnmRegisterResource(void);
+int APS5_VABI sceGnmRequestFlipAndSubmitDoneForWorkload(void);
+int APS5_VABI sceGnmResetVgtControl(std::uint32_t* cmdbuf, std::uint32_t size);
+int APS5_VABI sceGnmSdmaClose(void);
+int APS5_VABI sceGnmSdmaConstFill(void);
+int APS5_VABI sceGnmSdmaCopyLinear(void);
+int APS5_VABI sceGnmSdmaCopyTiled(void);
+int APS5_VABI sceGnmSdmaCopyWindow(void);
+int APS5_VABI sceGnmSdmaFlush(void);
+int APS5_VABI sceGnmSdmaGetMinCmdSize(void);
+int APS5_VABI sceGnmSdmaOpen(void);
+int APS5_VABI sceGnmSetCsShaderWithModifier(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier);
+int APS5_VABI sceGnmSetEmbeddedPsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t);
+int APS5_VABI sceGnmSetEmbeddedVsShader(std::uint32_t* cmdbuf, std::uint32_t, std::uint32_t shaderId, std::uint32_t);
+int APS5_VABI sceGnmSetPsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmSetResourceRegistrationUserMemory(void);
+int APS5_VABI sceGnmSetResourceUserData(void);
+int APS5_VABI sceGnmSetSpiEnableSqCounters(void);
+int APS5_VABI sceGnmSetSpiEnableSqCountersForUnitInstance(void);
+int APS5_VABI sceGnmSetVgtControl(std::uint32_t* cmdbuf, std::uint32_t size, std::uint32_t primGroupSizeMinusOne, std::uint32_t partialVsWaveMode, std::uint32_t switchOnlyOnEop);
+int APS5_VABI sceGnmSetWaveLimitMultiplier(void);
+int APS5_VABI sceGnmSetWaveLimitMultipliers(void);
+int APS5_VABI sceGnmSubmitAndFlipCommandBuffersForWorkload(void);
+int APS5_VABI sceGnmSubmitCommandBuffersForWorkload(void);
+int APS5_VABI sceGnmUnregisterAllResourcesForOwner(void);
+int APS5_VABI sceGnmUnregisterOwnerAndResources(void);
+int APS5_VABI sceGnmUnregisterResource(void);
+int APS5_VABI sceGnmUpdateGsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmUpdateHsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t lsHsConfig);
+int APS5_VABI sceGnmUpdatePsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmUpdatePsShader350(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs);
+int APS5_VABI sceGnmUpdateVsShader(std::uint32_t* cmdbuf, std::uint32_t size, const std::uint32_t* regs, std::uint32_t modifier);
+int APS5_VABI sceGnmValidateDisableDiagnostics(void);
+int APS5_VABI sceGnmValidateDisableDiagnostics2(void);
+int APS5_VABI sceGnmValidateDispatchCommandBuffers(void);
+int APS5_VABI sceGnmValidateDrawCommandBuffers(void);
+int APS5_VABI sceGnmValidateGetDiagnosticInfo(void);
+int APS5_VABI sceGnmValidateGetDiagnostics(void);
+int APS5_VABI sceGnmValidateGetVersion(void);
+int APS5_VABI sceGnmValidateOnSubmitEnabled(void);
+int APS5_VABI sceGnmValidateResetState(void);
+int APS5_VABI sceGnmValidationRegisterMemoryCheckCallback(void);
+
+}
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp
new file mode 100644
index 0000000000..621e98ef3d
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp
@@ -0,0 +1,27 @@
+// SPDX-FileCopyrightText: Copyright 2024-2026 shadPS4 Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#ifndef CORE_LIBS_PRX_LIBSCEGNMDRIVERFORNEOMODE_INCLUDE_EMBEDDEDSHADERS_HPP
+#define CORE_LIBS_PRX_LIBSCEGNMDRIVERFORNEOMODE_INCLUDE_EMBEDDEDSHADERS_HPP
+
+#include <array>
+#include <cstdint>
+
+namespace GnmNeo {
+
+alignas(256) constexpr std::array<std::uint32_t, 15> FullscreenVs{
+    0xbeeb0387u, 0x36020081u, 0x34020281u, 0x360000c2u, 0x4a0202c1u, 0x4a0000c1u, 0x7e020b01u, 0x7e000b00u,
+    0x7e040280u, 0x7e0602f2u, 0xf80008cfu, 0x03020001u, 0xf800020fu, 0x03030303u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 7> BlackPs{
+    0xbeeb0383u, 0x7e000280u, 0x5e000100u, 0xbf800000u, 0xf8001c0fu, 0x00000000u, 0xbf810000u,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 5> DepthOnlyPs{
+    0xbeeb0383u, 0x7e040280u, 0xf8001803u, 0x00000202u, 0xbf810000u,
+};
+
+} // namespace GnmNeo
+
+#endif
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp
new file mode 100644
index 0000000000..5768dd1c92
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp
@@ -0,0 +1,99 @@
+// SPDX-FileCopyrightText: Copyright 2025 shadPS4 Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#ifndef CORE_LIBS_PRX_LIBSCEGNMDRIVERFORNEOMODE_INCLUDE_INITSEQUENCES_HPP
+#define CORE_LIBS_PRX_LIBSCEGNMDRIVERFORNEOMODE_INCLUDE_INITSEQUENCES_HPP
+
+#include <array>
+#include <cstdint>
+
+namespace GnmNeo {
+
+constexpr std::array<std::uint32_t, 12> ClearState{
+    0xc0012800u, 0x80000000u, 0x80000000u, 0xc0001200u, 0x0u, 0xc0055800u, 0x2ec47fc0u, 0xffffffffu,
+    0x0u, 0x0u, 0x0u, 0xau,
+};
+
+constexpr std::array<std::uint32_t, 115> HardwareState{
+    0xc0017600u, 0x216u, 0xffffffffu, 0xc0017600u, 0x217u, 0xffffffffu, 0xc0017600u, 0x215u,
+    0x0u, 0xc0016900u, 0x2f9u, 0x2du, 0xc0016900u, 0x282u, 0x8u, 0xc0016900u,
+    0x280u, 0x80008u, 0xc0016900u, 0x281u, 0xffff0000u, 0xc0016900u, 0x204u, 0x0u,
+    0xc0016900u, 0x206u, 0x43fu, 0xc0016900u, 0x83u, 0xffffu, 0xc0016900u, 0x317u,
+    0x10u, 0xc0016900u, 0x2fau, 0x3f800000u, 0xc0016900u, 0x2fcu, 0x3f800000u, 0xc0016900u,
+    0x2fbu, 0x3f800000u, 0xc0016900u, 0x2fdu, 0x3f800000u, 0xc0016900u, 0x202u, 0xcc0010u,
+    0xc0016900u, 0x30eu, 0xffffffffu, 0xc0016900u, 0x30fu, 0xffffffffu, 0xc0002f00u, 0x1u,
+    0xc0017600u, 0x7u, 0x1ffu, 0xc0017600u, 0x46u, 0x1ffu, 0xc0017600u, 0x87u,
+    0x1ffu, 0xc0017600u, 0xc7u, 0x1ffu, 0xc0017600u, 0x107u, 0x0u, 0xc0017600u,
+    0x147u, 0x1ffu, 0xc0016900u, 0x1b1u, 0x2u, 0xc0016900u, 0x101u, 0x0u,
+    0xc0016900u, 0x100u, 0xffffffffu, 0xc0016900u, 0x103u, 0x0u, 0xc0016900u, 0x284u,
+    0x0u, 0xc0016900u, 0x290u, 0x0u, 0xc0016900u, 0x2aeu, 0x0u, 0xc0016900u,
+    0x292u, 0x0u, 0xc0016900u, 0x293u, 0x6000000u, 0xc0016900u, 0x2f8u, 0x0u,
+    0xc0016900u, 0x2deu, 0x1e9u, 0xc0036900u, 0x295u, 0x100u, 0x100u, 0x4u,
+    0xc0017900u, 0x200u, 0xe0000000u,
+};
+
+constexpr std::array<std::uint32_t, 131> HardwareState200{
+    0xc0017600u, 0x216u, 0xffffffffu, 0xc0017600u, 0x217u, 0xffffffffu, 0xc0017600u, 0x219u,
+    0xffffffffu, 0xc0017600u, 0x21au, 0xffffffffu, 0xc0017600u, 0x215u, 0x0u, 0xc0016900u,
+    0x2f9u, 0x2du, 0xc0016900u, 0x282u, 0x8u, 0xc0016900u, 0x280u, 0x80008u,
+    0xc0016900u, 0x281u, 0xffff0000u, 0xc0016900u, 0x204u, 0x0u, 0xc0016900u, 0x206u,
+    0x43fu, 0xc0016900u, 0x83u, 0xffffu, 0xc0016900u, 0x317u, 0x10u, 0xc0016900u,
+    0x2fau, 0x3f800000u, 0xc0016900u, 0x2fcu, 0x3f800000u, 0xc0016900u, 0x2fbu, 0x3f800000u,
+    0xc0016900u, 0x2fdu, 0x3f800000u, 0xc0016900u, 0x202u, 0xcc0010u, 0xc0016900u, 0x30eu,
+    0xffffffffu, 0xc0016900u, 0x30fu, 0xffffffffu, 0xc0002f00u, 0x1u, 0xc0017600u, 0x7u,
+    0x1701ffu, 0xc0017600u, 0x46u, 0x1701fdu, 0xc0017600u, 0x87u, 0x1701ffu, 0xc0017600u,
+    0xc7u, 0x1701fdu, 0xc0017600u, 0x107u, 0x17u, 0xc0017600u, 0x147u, 0x1701fdu,
+    0xc0017600u, 0x47u, 0x1cu, 0xc0016900u, 0x1b1u, 0x2u, 0xc0016900u, 0x101u,
+    0x0u, 0xc0016900u, 0x100u, 0xffffffffu, 0xc0016900u, 0x103u, 0x0u, 0xc0016900u,
+    0x284u, 0x0u, 0xc0016900u, 0x290u, 0x0u, 0xc0016900u, 0x2aeu, 0x0u,
+    0xc0016900u, 0x292u, 0x0u, 0xc0016900u, 0x293u, 0x6020000u, 0xc0016900u, 0x2f8u,
+    0x0u, 0xc0016900u, 0x2deu, 0x1e9u, 0xc0026900u, 0xebu, 0xff00ff00u, 0xff00u,
+    0xc0036900u, 0x295u, 0x100u, 0x100u, 0x4u, 0xc0017900u, 0x200u, 0xe0000000u,
+    0xc0017900u, 0x40000258u, 0x6d007fu,
+};
+
+constexpr std::array<std::uint32_t, 134> HardwareState350{
+    0xc0017600u, 0x216u, 0xffffffffu, 0xc0017600u, 0x217u, 0xffffffffu, 0xc0017600u, 0x219u,
+    0xffffffffu, 0xc0017600u, 0x21au, 0xffffffffu, 0xc0017600u, 0x215u, 0x0u, 0xc0016900u,
+    0x2f9u, 0x2du, 0xc0016900u, 0x282u, 0x8u, 0xc0016900u, 0x280u, 0x80008u,
+    0xc0016900u, 0x281u, 0xffff0000u, 0xc0016900u, 0x204u, 0x0u, 0xc0016900u, 0x206u,
+    0x43fu, 0xc0016900u, 0x83u, 0xffffu, 0xc0016900u, 0x317u, 0x10u, 0xc0016900u,
+    0x2fau, 0x3f800000u, 0xc0016900u, 0x2fcu, 0x3f800000u, 0xc0016900u, 0x2fbu, 0x3f800000u,
+    0xc0016900u, 0x2fdu, 0x3f800000u, 0xc0016900u, 0x202u, 0xcc0010u, 0xc0016900u, 0x30eu,
+    0xffffffffu, 0xc0016900u, 0x30fu, 0xffffffffu, 0xc0002f00u, 0x1u, 0xc0017600u, 0x7u,
+    0x1701ffu, 0xc0017600u, 0x46u, 0x1701fdu, 0xc0017600u, 0x87u, 0x1701ffu, 0xc0017600u,
+    0xc7u, 0x1701fdu, 0xc0017600u, 0x107u, 0x17u, 0xc0017600u, 0x147u, 0x1701fdu,
+    0xc0017600u, 0x47u, 0x1cu, 0xc0016900u, 0x1b1u, 0x2u, 0xc0016900u, 0x101u,
+    0x0u, 0xc0016900u, 0x100u, 0xffffffffu, 0xc0016900u, 0x103u, 0x0u, 0xc0016900u,
+    0x284u, 0x0u, 0xc0016900u, 0x290u, 0x0u, 0xc0016900u, 0x2aeu, 0x0u,
+    0xc0016900u, 0x102u, 0x0u, 0xc0016900u, 0x292u, 0x0u, 0xc0016900u, 0x293u,
+    0x6020000u, 0xc0016900u, 0x2f8u, 0x0u, 0xc0016900u, 0x2deu, 0x1e9u, 0xc0026900u,
+    0xebu, 0xff00ff00u, 0xff00u, 0xc0036900u, 0x295u, 0x100u, 0x100u, 0x4u,
+    0xc0017900u, 0x200u, 0xe0000000u, 0xc0017900u, 0x40000258u, 0x6d007fu,
+};
+
+constexpr std::array<std::uint32_t, 19> ContextState{
+    0xc0012800u, 0x80000000u, 0x80000000u, 0xc0001200u, 0x0u, 0xc0002f00u, 0x1u, 0xc0016900u,
+    0x102u, 0x0u, 0xc0016900u, 0x202u, 0xcc0010u, 0xc0026900u, 0xebu, 0xff00ff00u,
+    0xff00u, 0xc00d1000u, 0x0u,
+};
+
+constexpr std::array<std::uint32_t, 102> ContextState400{
+    0xc0012800u, 0x80000000u, 0x80000000u, 0xc0001200u, 0x0u, 0xc0016900u, 0x2f9u, 0x2du,
+    0xc0016900u, 0x282u, 0x8u, 0xc0016900u, 0x280u, 0x80008u, 0xc0016900u, 0x281u,
+    0xffff0000u, 0xc0016900u, 0x204u, 0x0u, 0xc0016900u, 0x206u, 0x43fu, 0xc0016900u,
+    0x83u, 0xffffu, 0xc0016900u, 0x317u, 0x10u, 0xc0016900u, 0x2fau, 0x3f800000u,
+    0xc0016900u, 0x2fcu, 0x3f800000u, 0xc0016900u, 0x2fbu, 0x3f800000u, 0xc0016900u, 0x2fdu,
+    0x3f800000u, 0xc0016900u, 0x202u, 0xcc0010u, 0xc0016900u, 0x30eu, 0xffffffffu, 0xc0016900u,
+    0x30fu, 0xffffffffu, 0xc0002f00u, 0x1u, 0xc0016900u, 0x1b1u, 0x2u, 0xc0016900u,
+    0x101u, 0x0u, 0xc0016900u, 0x100u, 0xffffffffu, 0xc0016900u, 0x103u, 0x0u,
+    0xc0016900u, 0x284u, 0x0u, 0xc0016900u, 0x290u, 0x0u, 0xc0016900u, 0x2aeu,
+    0x0u, 0xc0016900u, 0x102u, 0x0u, 0xc0016900u, 0x292u, 0x0u, 0xc0016900u,
+    0x293u, 0x6020000u, 0xc0016900u, 0x2f8u, 0x0u, 0xc0016900u, 0x2deu, 0x1e9u,
+    0xc0026900u, 0xebu, 0xff00ff00u, 0xff00u, 0xc0036900u, 0x295u, 0x100u, 0x100u,
+    0x4u, 0xc0017900u, 0x40000258u, 0x6d007fu, 0xc09a1000u, 0x0u,
+};
+
+} // namespace GnmNeo
+
+#endif
diff --git a/core/libs/prx/libSceGnmDriverForNeoMode/libSceGnmDriverForNeoMode.hpp b/core/libs/prx/libSceGnmDriverForNeoMode/libSceGnmDriverForNeoMode.hpp
new file mode 100644
index 0000000000..ebeb3b8bad
--- /dev/null
+++ b/core/libs/prx/libSceGnmDriverForNeoMode/libSceGnmDriverForNeoMode.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
diff --git a/core/libs/prx/libSceGpuCapture/libSceGpuCapture.hpp b/core/libs/prx/libSceGpuCapture/libSceGpuCapture.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGpuCapture/libSceGpuCapture.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGpuTrace/libSceGpuTrace.hpp b/core/libs/prx/libSceGpuTrace/libSceGpuTrace.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGpuTrace/libSceGpuTrace.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceGvMp4Parser/libSceGvMp4Parser.hpp b/core/libs/prx/libSceGvMp4Parser/libSceGvMp4Parser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceGvMp4Parser/libSceGvMp4Parser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHand/libSceHand.hpp b/core/libs/prx/libSceHand/libSceHand.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHand/libSceHand.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHandTracker/libSceHandTracker.hpp b/core/libs/prx/libSceHandTracker/libSceHandTracker.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHandTracker/libSceHandTracker.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHdrScopes/libSceHdrScopes.hpp b/core/libs/prx/libSceHdrScopes/libSceHdrScopes.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHdrScopes/libSceHdrScopes.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHeadTracker/libSceHeadTracker.hpp b/core/libs/prx/libSceHeadTracker/libSceHeadTracker.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceHeadTracker/libSceHeadTracker.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceHidControl/Export.cpp b/core/libs/prx/libSceHidControl/Export.cpp
index c3bfd0d3ed..bb7329027a 100644
--- a/core/libs/prx/libSceHidControl/Export.cpp
+++ b/core/libs/prx/libSceHidControl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHidControl/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceHidControl/include/Api.hpp b/core/libs/prx/libSceHidControl/include/Api.hpp
new file mode 100644
index 0000000000..ca9e12b806
--- /dev/null
+++ b/core/libs/prx/libSceHidControl/include/Api.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceHidControlEnableMicBeamForming(void);
+int APS5_VABI sceHidControlSetAllVibrationMute(void);
+int APS5_VABI sceHidControlSetVibrationTriggerEffectWeakForce(void);
+int APS5_VABI sceHidControlIsForceUpdateNeeded(void);
+int APS5_VABI sceHidControlSetRemoteMergeProcess(void);
+int APS5_VABI sceHidControlSetCollaboInputSettingOverrideProcess(void);
+int APS5_VABI sceHidControlSetForceAdvancedVibrationMode(void);
+int APS5_VABI sceHidControlPswUpdateIsUpdateNeeded(void);
+int APS5_VABI sceHidControlPswUpdateIsUpdateNeededForMultiDevice(void);
+int APS5_VABI sceHidControlPswUpdateIsReady(void);
+int APS5_VABI sceHidControlPswUpdateStart(void);
+int APS5_VABI sceHidControlPswUpdateGetStatus(void);
+int APS5_VABI sceHidControlPswUpdateSendData(void);
+int APS5_VABI sceHidControlPswUpdateSendAppendixData(void);
+int APS5_VABI sceHidControlPswUpdateGetReconnectStatus(void);
+int APS5_VABI sceHidControlPswUpdateGetDeviceFirmwareUpdateTelemetryData(void);
+int APS5_VABI sceHidControlGetPswState(void);
+int APS5_VABI sceHidControlGetPswBatteryState(void);
+int APS5_VABI sceHidControlSetPswDeviceName(void);
+int APS5_VABI sceHidControlGetPswDeviceName(void);
+int APS5_VABI sceHidControlSetPswConsoleMute(void);
+int APS5_VABI sceHidControlSetPswSpeakerVolume(void);
+int APS5_VABI sceHidControlSetPswSidetoneLevel(void);
+int APS5_VABI sceHidControlGetPswSidetoneLevel(void);
+int APS5_VABI sceHidControlSetPswEqPresetSelection(void);
+int APS5_VABI sceHidControlGetPswEqPresetSelection(void);
+int APS5_VABI sceHidControlSetPswEqPresetName(void);
+int APS5_VABI sceHidControlGetPswEqPresetName(void);
+int APS5_VABI sceHidControlSetPswEqBandValues(void);
+int APS5_VABI sceHidControlGetPswEqBandValues(void);
+int APS5_VABI sceHidControlGetPswAllEqBandValues(void);
+int APS5_VABI sceHidControlSetPswResetSettings(void);
+int APS5_VABI sceHidControlSetPswNetworkLocale(void);
+int APS5_VABI sceHidControlGetPswNetworkLocale(void);
+int APS5_VABI sceHidControlGetPswDeviceNameForNearby(void);
+int APS5_VABI sceHidControlConnectPswDeviceForNearby(void);
+int APS5_VABI sceHidControlGetPswDeviceInfo(void);
+int APS5_VABI sceHidControlSetPswCommand(void);
+int APS5_VABI sceHidControlGetPswCommand(void);
+int APS5_VABI sceHidControlGetPswDeviceIdFromIdxAdd(void);
+
+}
diff --git a/core/libs/prx/libSceHidControl/libSceHidControl.hpp b/core/libs/prx/libSceHidControl/libSceHidControl.hpp
new file mode 100644
index 0000000000..6a943525cb
--- /dev/null
+++ b/core/libs/prx/libSceHidControl/libSceHidControl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHidControl/include/Api.hpp"
diff --git a/core/libs/prx/libSceHmd/CMakeLists.txt b/core/libs/prx/libSceHmd/CMakeLists.txt
index d5a15e9ca8..5bf180e478 100644
--- a/core/libs/prx/libSceHmd/CMakeLists.txt
+++ b/core/libs/prx/libSceHmd/CMakeLists.txt
@@ -1,11 +1,13 @@
 add_library(libSceHmd SHARED EXCLUDE_FROM_ALL Export.cpp)
 target_include_directories(libSceHmd PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceHmd PRIVATE libc)
 configure_windows_unwind(libSceHmd)
 
 if(BUILD_TESTING)
     add_test_executable(guest_hmd_tests ${LIBS_INCLUDE_DIR}/tests/GuestHmd.cpp)
     target_include_directories(guest_hmd_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_hmd_tests PRIVATE libSceHmd)
+    configure_windows_unwind(guest_hmd_tests)
     add_test(NAME guest_hmd COMMAND guest_hmd_tests)
     if(WIN32)
         set_tests_properties(guest_hmd PROPERTIES ENVIRONMENT_MODIFICATION
diff --git a/core/libs/prx/libSceHmd/Export.cpp b/core/libs/prx/libSceHmd/Export.cpp
index 3ede810dfe..c859361ee4 100644
--- a/core/libs/prx/libSceHmd/Export.cpp
+++ b/core/libs/prx/libSceHmd/Export.cpp
@@ -1,58 +1,20 @@
+#include "prx/libSceHmd/include/Api.hpp"
 #include "Hmd.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <atomic>
-
-struct HmdDistortionCommandParameter;
-struct HmdWideNearDistortionCommandParameter;
-struct Hmd2dVrCommandParameter;
-
-struct HmdCommandBuffer {
-    const std::uint32_t* commands;
-    std::uint32_t dwordCount;
-};
+#include <cstddef>
+#include <cstring>
+#include <initializer_list>
+#include <string>
 
 static_assert(sizeof(HmdCommandBuffer) == 16);
 static_assert(offsetof(HmdCommandBuffer, dwordCount) == 8);
 
-struct HmdReprojectionFrameParameter;
-struct HmdReprojectionWideNearParameter;
-struct HmdReprojection2dVrParameter;
-struct HmdReprojectionPose;
-struct HmdReprojectionOverlayParameter;
-struct HmdReprojectionSubmissionParameter;
-struct HmdReprojectionInitializeParameter;
-struct HmdReprojectionMultilayerParameter;
-struct HmdDeviceInformation;
-struct HmdDistortionParameters;
-struct HmdInertialSensorData;
-struct HmdStatusReport;
-
-struct HmdFieldOfView {
-    float angles[4];
-};
-
-struct HmdAssemblyError {
-    float offsets[4];
-};
-
 static_assert(sizeof(HmdFieldOfView) == 16);
 static_assert(sizeof(HmdAssemblyError) == 16);
 
-struct HmdVr2dData;
-struct HmdPuPositionParameter;
-struct HmdOpticalParameter;
-struct HmdCrashDumpInfo;
-struct HmdScreenOutputParameter;
-struct HmdScreenFadeParameter;
-struct HmdScreenStatus;
-struct HmdCaptureInitializeParameter;
-struct HmdCaptureInfo;
-struct HmdLiveCaptureParameter;
-struct HmdReprojectionDebugInfo;
-struct HmdReprojectionMultilayerDebugInfo;
-struct HmdReprojectionCallbackParameter;
-
 namespace {
 
 std::atomic<bool> initialized{false};
@@ -64,62 +26,52 @@ std::int32_t Initialize(const Hmd::InitializeParam* param) {
     return initialized.exchange(true) ? Hmd::AlreadyInitialized : 0;
 }
 
+std::uint32_t CompiledSdkVersion() {
+    static const auto* processParameters = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t version;
+    std::memcpy(&version, processParameters + 0x10, sizeof(version));
+    return version;
 }
 
-struct HmdEyeDistances {
-    std::uint32_t left;
-    std::uint32_t right;
-};
+std::int32_t CommandQueryHandle(std::int32_t handle, const char* query) {
+    if (handle != 0) return Hmd::InvalidHandle;
+    if (initialized.load()) NotImplemented_nid_no_patch((std::string(query) + " with handle 0 after sceHmdInitialize").c_str());
+    if (CompiledSdkVersion() >= Hmd::StartupStateSdkVersion) NotImplemented_nid_no_patch((std::string(query) + " with handle 0 before sceHmdInitialize from SDK 4.50").c_str());
+    return Hmd::NotInitialized;
+}
 
-struct HmdEyeOffset {
-    float x;
-    float y;
-    float z;
-};
+template <typename T>
+T ParameterWord(const Hmd2dVrCommandParameter* parameter, std::size_t offset) {
+    T value;
+    std::memcpy(&value, reinterpret_cast<const unsigned char*>(parameter) + offset, sizeof(value));
+    return value;
+}
 
-struct HmdMirroringAspect {
-    std::uint16_t reserved0;
-    std::int16_t aspect;
-    std::uint16_t reserved1;
-    std::uint16_t reserved2;
-};
+std::int32_t Vr2dCommandArguments(const Hmd2dVrCommandParameter* parameter, const HmdCommandBuffer* commandBuffer) {
+    if (!parameter || !commandBuffer) return Hmd::ParameterNull;
+    for (const std::size_t offset : {0x00u, 0x08u, 0x20u}) {
+        if (ParameterWord<std::uint64_t>(parameter, offset) == 0) return Hmd::ParameterNull;
+    }
+    if (ParameterWord<std::uint32_t>(parameter, 0x34) != 0 || ParameterWord<std::uint64_t>(parameter, 0x38) != 0) return Hmd::ParameterInvalid;
+    return 0;
+}
 
-struct HmdMirroringAspectDebug {
-    std::uint16_t values[5];
-    std::uint8_t mode;
-};
+}
 
 static_assert(sizeof(HmdMirroringAspectDebug) == 12);
 static_assert(offsetof(HmdMirroringAspectDebug, mode) == 10);
 static_assert(sizeof(HmdMirroringAspect) == 8);
 static_assert(offsetof(HmdMirroringAspect, aspect) == 2);
 
-using HmdEventCallback = void (APS5_VABI *)(std::uint32_t events);
-
-struct HmdDfuData {
-    const void* data;
-    std::uint32_t size;
-    std::uint32_t mode;
-};
-
 static_assert(sizeof(HmdDfuData) == 16);
 static_assert(offsetof(HmdDfuData, size) == 8);
 static_assert(offsetof(HmdDfuData, mode) == 12);
 
-struct HmdScreenData {
-    const void* data;
-    std::int32_t size;
-};
-
 static_assert(sizeof(HmdScreenData) == 16);
 static_assert(offsetof(HmdScreenData, size) == 8);
 static_assert(sizeof(HmdEyeDistances) == 8);
 static_assert(sizeof(HmdEyeOffset) == 12);
 
-struct HmdLedData {
-    std::uint8_t values[9];
-};
-
 static_assert(sizeof(HmdLedData) == 9);
 
 extern "C" {
@@ -428,8 +380,7 @@ int APS5_VABI sceHmdReprojectionStopCapture(HmdCaptureInfo* info) {
 }
 
 bool APS5_VABI sceHmdInternalIsCommonDlgMiniAppVr2d(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return false;
 }
 
 int APS5_VABI sceHmdInternalMmapGetSensorCalibrationData(void* buffer, std::uint32_t size) {
@@ -438,8 +389,9 @@ int APS5_VABI sceHmdInternalMmapGetSensorCalibrationData(void* buffer, std::uint
 }
 
 int APS5_VABI sceHmdDistortionGetCorrectionCommand(std::int32_t handle, const HmdDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)parameter;
+    (void)commandBuffer;
+    return CommandQueryHandle(handle, __func__);
 }
 
 int APS5_VABI sceHmdReprojectionQueryOnionBuffAlign(void) {
@@ -452,13 +404,11 @@ int APS5_VABI sceHmdInternalGetDebugMode(std::uint8_t* mode) {
 }
 
 bool APS5_VABI sceHmdInternalIsMiniAppVr2d(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return false;
 }
 
 bool APS5_VABI sceHmdInternalIsCommonDlgVr2d(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return false;
 }
 
 int APS5_VABI sceHmdReprojectionSetOutputMinColor(float red, float green, float blue) {
@@ -572,8 +522,9 @@ int APS5_VABI sceHmdInternalGetHmuSerialNumber(std::uint8_t* serialNumber) {
 }
 
 int APS5_VABI sceHmdDistortionGetWideNearCorrectionCommand(std::int32_t handle, const HmdWideNearDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)parameter;
+    (void)commandBuffer;
+    return CommandQueryHandle(handle, __func__);
 }
 
 int APS5_VABI sceHmdInternalCheckS3dPassModeAvailable(bool* available) {
@@ -597,8 +548,7 @@ int APS5_VABI sceHmdReprojectionStartLiveCapture(const HmdLiveCaptureParameter*
 }
 
 bool APS5_VABI sceHmdInternalIsGameVr2d(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return false;
 }
 
 int APS5_VABI sceHmdGetAssyError(HmdAssemblyError* data) {
@@ -727,8 +677,8 @@ int APS5_VABI sceHmdInternalMmapGetModeId(std::uint32_t* modeId) {
 }
 
 int APS5_VABI sceHmdDistortionGet2dVrCommand(std::int32_t handle, const Hmd2dVrCommandParameter* parameter, HmdCommandBuffer* commandBuffer) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (const auto result = Vr2dCommandArguments(parameter, commandBuffer); result != 0) return result;
+    return CommandQueryHandle(handle, __func__);
 }
 
 int APS5_VABI sceHmdInternalDfuSendSize(std::int32_t size) {
@@ -737,8 +687,9 @@ int APS5_VABI sceHmdInternalDfuSendSize(std::int32_t size) {
 }
 
 int APS5_VABI sceHmdGetWideNearDistortionCorrectionCommand(std::int32_t handle, const HmdWideNearDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)parameter;
+    (void)commandBuffer;
+    return CommandQueryHandle(handle, __func__);
 }
 
 int APS5_VABI sceHmdReprojectionStartMultilayer2(const HmdReprojectionMultilayerParameter* layers, std::uint32_t layerCount, const HmdReprojectionSubmissionParameter* submission, std::uint64_t flipArg, const void* reserved) {
@@ -747,8 +698,9 @@ int APS5_VABI sceHmdReprojectionStartMultilayer2(const HmdReprojectionMultilayer
 }
 
 int APS5_VABI sceHmdGetDistortionCorrectionCommand(std::int32_t handle, const HmdDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)parameter;
+    (void)commandBuffer;
+    return CommandQueryHandle(handle, __func__);
 }
 
 int APS5_VABI sceHmdInternalSetDeviceConnection(std::uint64_t connection) {
@@ -962,8 +914,8 @@ int APS5_VABI sceHmdReprojectionQueryGarlicBuffSize(void) {
 }
 
 int APS5_VABI sceHmdGet2dVrCommand(std::int32_t handle, const Hmd2dVrCommandParameter* parameter, HmdCommandBuffer* commandBuffer) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (const auto result = Vr2dCommandArguments(parameter, commandBuffer); result != 0) return result;
+    return CommandQueryHandle(handle, __func__);
 }
 
 }
diff --git a/core/libs/prx/libSceHmd/Hmd.hpp b/core/libs/prx/libSceHmd/Hmd.hpp
index 31cf038dbb..e535975c5e 100644
--- a/core/libs/prx/libSceHmd/Hmd.hpp
+++ b/core/libs/prx/libSceHmd/Hmd.hpp
@@ -15,6 +15,7 @@ inline constexpr std::int32_t DeviceDisconnected = static_cast<std::int32_t>(0x8
 inline constexpr std::int32_t ParameterNull = static_cast<std::int32_t>(0x81110008);
 inline constexpr std::int32_t ParameterInvalid = static_cast<std::int32_t>(0x81110009);
 inline constexpr std::int32_t UnsupportedFeature = static_cast<std::int32_t>(0x81110016);
+inline constexpr std::uint32_t StartupStateSdkVersion = 0x04500000;
 
 enum class DeviceStatus : std::uint32_t {
     Ready = 0,
@@ -51,10 +52,25 @@ static_assert(offsetof(DeviceInformation, hmuMount) == 24);
 
 }
 
-struct HmdFieldOfView;
-struct HmdEyeOffset;
+struct HmdFieldOfView {
+    float angles[4];
+};
+struct HmdEyeOffset {
+    float x;
+    float y;
+    float z;
+};
 struct HmdInertialSensorData;
-struct HmdAssemblyError;
+struct HmdAssemblyError {
+    float offsets[4];
+};
+struct HmdDistortionCommandParameter;
+struct HmdWideNearDistortionCommandParameter;
+struct Hmd2dVrCommandParameter;
+struct HmdCommandBuffer {
+    const std::uint32_t* commands;
+    std::uint32_t dwordCount;
+};
 
 extern "C" {
 std::int32_t APS5_VABI sceHmdInitialize(const Hmd::InitializeParam* param);
@@ -78,6 +94,16 @@ int APS5_VABI sceHmdGetFieldOfView(std::int32_t handle, HmdFieldOfView* fieldOfV
 int APS5_VABI sceHmdGet2DEyeOffset(std::int32_t handle, HmdEyeOffset* leftOffset, HmdEyeOffset* rightOffset);
 int APS5_VABI sceHmdGetInertialSensorData(std::int32_t handle, HmdInertialSensorData* data, std::uint32_t count);
 int APS5_VABI sceHmdGetAssyError(HmdAssemblyError* data);
+int APS5_VABI sceHmdDistortionGet2dVrCommand(std::int32_t handle, const Hmd2dVrCommandParameter* parameter, HmdCommandBuffer* commandBuffer);
+int APS5_VABI sceHmdDistortionGetCorrectionCommand(std::int32_t handle, const HmdDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer);
+int APS5_VABI sceHmdDistortionGetWideNearCorrectionCommand(std::int32_t handle, const HmdWideNearDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer);
+int APS5_VABI sceHmdGet2dVrCommand(std::int32_t handle, const Hmd2dVrCommandParameter* parameter, HmdCommandBuffer* commandBuffer);
+int APS5_VABI sceHmdGetDistortionCorrectionCommand(std::int32_t handle, const HmdDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer);
+int APS5_VABI sceHmdGetWideNearDistortionCorrectionCommand(std::int32_t handle, const HmdWideNearDistortionCommandParameter* parameter, HmdCommandBuffer* commandBuffer);
+bool APS5_VABI sceHmdInternalIsGameVr2d(void);
+bool APS5_VABI sceHmdInternalIsMiniAppVr2d(void);
+bool APS5_VABI sceHmdInternalIsCommonDlgVr2d(void);
+bool APS5_VABI sceHmdInternalIsCommonDlgMiniAppVr2d(void);
 }
 
 #endif
diff --git a/core/libs/prx/libSceHmd/include/Api.hpp b/core/libs/prx/libSceHmd/include/Api.hpp
new file mode 100644
index 0000000000..3feeb6eb93
--- /dev/null
+++ b/core/libs/prx/libSceHmd/include/Api.hpp
@@ -0,0 +1,232 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "prx/libSceHmd/Hmd.hpp"
+
+struct HmdCaptureInfo;
+
+struct HmdCaptureInitializeParameter;
+
+struct HmdCrashDumpInfo;
+
+struct HmdDeviceInformation;
+
+struct HmdDfuData {
+    const void* data;
+    std::uint32_t size;
+    std::uint32_t mode;
+};
+
+struct HmdDistortionParameters;
+
+using HmdEventCallback = void (APS5_VABI *)(std::uint32_t events);
+
+struct HmdEyeDistances {
+    std::uint32_t left;
+    std::uint32_t right;
+};
+
+
+
+struct HmdLedData {
+    std::uint8_t values[9];
+};
+
+struct HmdLiveCaptureParameter;
+
+struct HmdMirroringAspect {
+    std::uint16_t reserved0;
+    std::int16_t aspect;
+    std::uint16_t reserved1;
+    std::uint16_t reserved2;
+};
+
+struct HmdMirroringAspectDebug {
+    std::uint16_t values[5];
+    std::uint8_t mode;
+};
+
+struct HmdOpticalParameter;
+
+struct HmdPuPositionParameter;
+
+struct HmdReprojection2dVrParameter;
+
+struct HmdReprojectionCallbackParameter;
+
+struct HmdReprojectionDebugInfo;
+
+struct HmdReprojectionFrameParameter;
+
+struct HmdReprojectionInitializeParameter;
+
+struct HmdReprojectionMultilayerDebugInfo;
+
+struct HmdReprojectionMultilayerParameter;
+
+struct HmdReprojectionOverlayParameter;
+
+struct HmdReprojectionPose;
+
+struct HmdReprojectionSubmissionParameter;
+
+struct HmdReprojectionWideNearParameter;
+
+struct HmdScreenData {
+    const void* data;
+    std::int32_t size;
+};
+
+struct HmdScreenFadeParameter;
+
+struct HmdScreenOutputParameter;
+
+struct HmdScreenStatus;
+
+struct HmdStatusReport;
+
+struct HmdVr2dData;
+
+extern "C" {
+
+int APS5_VABI sceHmdInternalGetPUVersion(std::uint32_t* version);
+int APS5_VABI sceHmdInternalEventInitialize(void);
+int APS5_VABI sceHmdInternalSetVirtualDisplaySize(std::uint8_t size);
+int APS5_VABI sceHmdInternalSocialScreenSetOutput(std::uint32_t output, const HmdScreenOutputParameter* parameter);
+int APS5_VABI sceHmdInternalGetVirtualDisplayDepth(std::uint8_t* depth);
+int APS5_VABI sceHmdInternalGetEyeStatus(std::int32_t handle, HmdEyeOffset* left, HmdEyeOffset* right);
+int APS5_VABI sceHmdInternalAnotherScreenOpen(void);
+int APS5_VABI sceHmdReprojectionUnsetCallback(void);
+int APS5_VABI sceHmdInternalSetCrashReportCommand(std::uint8_t command);
+int APS5_VABI sceHmdInternalGetDebugTextMode(std::uint8_t* mode);
+int APS5_VABI sceHmdInternalRegisterEventCallback(HmdEventCallback callback);
+int APS5_VABI sceHmdReprojectionStartWideNear(const HmdReprojectionWideNearParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalGetPUSerialNumber(char* serialNumber);
+int APS5_VABI sceHmdInternalGetDebugSocialScreenMode(std::uint8_t* mode);
+int APS5_VABI sceHmdInternalSetM2LedBrightness(std::int32_t handle, std::uint32_t ledMask, const std::uint8_t* brightness);
+int APS5_VABI sceHmdInternalSetIPD(std::int32_t mode, HmdEyeDistances distances);
+int APS5_VABI sceHmdInternalMirroringModeSetAspect(const HmdMirroringAspect* aspect);
+int APS5_VABI sceHmdInternalDfuGetStatus(std::uint64_t* status);
+int APS5_VABI sceHmdInternalAnotherScreenSendVideo(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalGetRequiredPUPVersion(std::uint32_t* firstVersion, std::uint32_t* secondVersion);
+int APS5_VABI sceHmdReprojectionSetCallback(const HmdReprojectionCallbackParameter* parameter);
+int APS5_VABI sceHmdInternalDfuCheckAfterPvt(std::uint8_t* afterPvt);
+int APS5_VABI sceHmdInternalResetInertialSensor(void);
+int APS5_VABI sceHmdReprojectionSetUserEventStart(std::int64_t eventQueue, std::int32_t eventId);
+int APS5_VABI sceHmdDistortionSetOutputMinColor(float red, float green, float blue);
+int APS5_VABI sceHmdInternalSetVirtualDisplayDepth(std::uint8_t depth);
+int APS5_VABI sceHmdGetDistortionWorkMemoryAlign(void);
+int APS5_VABI sceHmdReprojectionStartMultilayer(const HmdReprojectionMultilayerParameter* layers, std::uint32_t layerCount, const HmdReprojectionSubmissionParameter* submission, const HmdReprojectionPose* pose, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalPushVr2dData(const HmdVr2dData* data);
+int APS5_VABI sceHmdReprojectionClearUserEventEnd(void);
+int APS5_VABI sceHmdInternalGetIPD(HmdEyeDistances* distances);
+int APS5_VABI sceHmdInternalSetVRMode(std::int32_t enabled);
+int APS5_VABI sceHmdInternalCrashReportReadDataSize(std::uint32_t* dataSize);
+int APS5_VABI sceHmdInternalGetVr2dData(HmdVr2dData* data);
+int APS5_VABI sceHmdInternalAnotherScreenSendAudio(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalGetPuPositionParam(HmdPuPositionParameter* parameter);
+int APS5_VABI sceHmdReprojectionInitializeCapture(const HmdCaptureInitializeParameter* parameter);
+int APS5_VABI sceHmdInternalSetDebugSocialScreenMode(std::uint8_t mode);
+int APS5_VABI sceHmdInternalGetHmuPowerStatusForDebug(std::uint8_t* status);
+int APS5_VABI sceHmdGetDistortionWorkMemorySize(void);
+int APS5_VABI sceHmdReprojectionSetDisplayBuffers(std::int32_t videoOutHandle, std::int32_t firstBufferIndex, std::int32_t secondBufferIndex, const void* reserved);
+int APS5_VABI sceHmdInternalAnotherScreenSetFadeAndSwitch(const HmdScreenFadeParameter* parameter);
+int APS5_VABI sceHmdInternalCreateSharedMemory(void);
+int APS5_VABI sceHmdInternalMirroringModeSetAspectDebug(const HmdMirroringAspectDebug* aspect);
+int APS5_VABI sceHmdInternalGetPuBuildNumber(std::uint32_t* buildNumber);
+int APS5_VABI sceHmdDistortionGetCompoundEyeCorrectionCommand(void);
+int APS5_VABI sceHmdInternalSetS3dPassMode(std::uint8_t mode);
+int APS5_VABI sceHmdReprojectionStopCapture(HmdCaptureInfo* info);
+int APS5_VABI sceHmdInternalMmapGetSensorCalibrationData(void* buffer, std::uint32_t size);
+int APS5_VABI sceHmdInternalGetDebugMode(std::uint8_t* mode);
+int APS5_VABI sceHmdReprojectionSetOutputMinColor(float red, float green, float blue);
+int APS5_VABI sceHmdInternalSetPortConnection(std::uint64_t connection);
+int APS5_VABI sceHmdReprojectionDebugGetLastInfo(HmdReprojectionDebugInfo* info);
+int APS5_VABI sceHmdInternalSetM2LedOn(std::int32_t handle, std::uint32_t ledMask, std::uint32_t brightness);
+int APS5_VABI sceHmdReprojectionAddDisplayBuffer(std::int32_t bufferIndex, const void* reserved);
+int APS5_VABI sceHmdInternalSetIpdSettingEnableForSystemService(std::uint8_t enabled);
+int APS5_VABI sceHmdInternalSetLedOn(std::int32_t handle, std::uint32_t ledMask);
+int APS5_VABI sceHmdInternal3dAudioSendData(std::int32_t port, const void* data, std::int32_t size);
+int APS5_VABI sceHmdReprojectionInitialize(const HmdReprojectionInitializeParameter* parameter, std::uint32_t mode, const void* reserved);
+int APS5_VABI sceHmdInternalGetDeviceInformationByHandle(std::int32_t handle, HmdDeviceInformation* information);
+int APS5_VABI sceHmdReprojectionStopLiveCapture(void);
+int APS5_VABI sceHmdInternalAnotherScreenClose(void);
+int APS5_VABI sceHmdInternalCrashReportReadData(void* buffer, std::uint32_t* bytesRead, std::uint32_t bufferSize);
+int APS5_VABI sceHmdInternalGetDeviceInformation(HmdDeviceInformation* information);
+int APS5_VABI sceHmdReprojectionStartCapture(void);
+int APS5_VABI sceHmdInternalGetDefaultLedData(std::int32_t handle, std::uint32_t* mask, HmdLedData* data);
+int APS5_VABI sceHmdInternalDfuClose(void);
+int APS5_VABI sceHmdInternalSetHmuPowerControl(std::uint8_t control);
+int APS5_VABI sceHmdInternalBindDeviceWithUserId(std::int32_t handle, std::int32_t userId);
+int APS5_VABI sceHmdInternalGetHmuSerialNumber(std::uint8_t* serialNumber);
+int APS5_VABI sceHmdInternalCheckS3dPassModeAvailable(bool* available);
+int APS5_VABI sceHmdInternalAnotherScreenGetAudioStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdInternalSeparateModeGetAudioStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdReprojectionStartLiveCapture(const HmdLiveCaptureParameter* parameter);
+int APS5_VABI sceHmdReprojectionFinalize(void);
+int APS5_VABI sceHmdInternalSocialScreenSetFadeAndSwitch(const HmdScreenFadeParameter* parameter);
+int APS5_VABI sceHmdInternalDfuStart(void);
+int APS5_VABI sceHmdInternalSetVirtualDisplayHeight(std::uint8_t height);
+int APS5_VABI sceHmdDistortionInitialize(void* workMemory);
+int APS5_VABI sceHmdInternalDfuSetMode(std::uint32_t mode);
+int APS5_VABI sceHmdInternalSetForcedCrash(std::uint8_t mode);
+int APS5_VABI sceHmdInternalDfuCheckPartialUpdateAvailable(bool* available);
+int APS5_VABI sceHmdInternalSeparateModeClose(void);
+int APS5_VABI sceHmdInternalSetDebugTextMode(std::uint8_t mode);
+int APS5_VABI sceHmdInternalCrashReportClose(void);
+int APS5_VABI sceHmdInternalSetHmuPowerControlForDebug(std::uint8_t control);
+int APS5_VABI sceHmdInternalGetVirtualDisplayHeight(std::uint8_t* height);
+int APS5_VABI sceHmdReprojectionStart(const HmdReprojectionFrameParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalResetLedForVsh(void);
+int APS5_VABI sceHmdInternalDfuOpen(void);
+int APS5_VABI sceHmdInternalSetDebugMode(std::uint8_t mode);
+int APS5_VABI sceHmdInternalCrashReportCancel(void);
+int APS5_VABI sceHmdInternalSeparateModeGetVideoStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdInternalCheckDeviceModelMk3(bool* isMk3);
+int APS5_VABI sceHmdSetVr2dEnable(std::int32_t enabled);
+int APS5_VABI sceHmdInternalSetSidetone(std::uint8_t level);
+int APS5_VABI sceHmdInternalSeparateModeOpen(void);
+int APS5_VABI sceHmdInternalMmapGetModeId(std::uint32_t* modeId);
+int APS5_VABI sceHmdInternalDfuSendSize(std::int32_t size);
+int APS5_VABI sceHmdReprojectionStartMultilayer2(const HmdReprojectionMultilayerParameter* layers, std::uint32_t layerCount, const HmdReprojectionSubmissionParameter* submission, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalSetDeviceConnection(std::uint64_t connection);
+int APS5_VABI sceHmdInternalGetVirtualDisplaySize(std::uint8_t* size);
+int APS5_VABI sceHmdReprojectionUnsetDisplayBuffers(void);
+int APS5_VABI sceHmdInternalGetHmuOpticalParam(HmdOpticalParameter* parameter);
+int APS5_VABI sceHmdInternalSeparateModeSendVideo(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalResetLedForVrTracker(void);
+int APS5_VABI sceHmdReprojectionStartWithOverlay(const HmdReprojectionFrameParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const HmdReprojectionOverlayParameter* overlay, const void* reserved);
+int APS5_VABI sceHmdReprojectionSetUserEventEnd(std::int64_t eventQueue, std::int32_t eventId);
+int APS5_VABI sceHmdInternalCrashReportOpen(void);
+int APS5_VABI sceHmdInternalSetDemoMode(std::uint8_t mode);
+int APS5_VABI sceHmdReprojectionStartWideNearWithOverlay(const HmdReprojectionWideNearParameter* parameter, const HmdReprojectionPose* pose, std::uint64_t flipArg, const HmdReprojectionOverlayParameter* overlay, const void* reserved);
+int APS5_VABI sceHmdGetDistortionParams(HmdDistortionParameters* parameters);
+int APS5_VABI sceHmdInternalDfuSend(const HmdDfuData* data);
+int APS5_VABI sceHmdReprojectionClearUserEventStart(void);
+int APS5_VABI sceHmdInternalSetUserType(std::uint8_t userType);
+int APS5_VABI sceHmdInternalGetDemoMode(std::uint8_t* mode);
+int APS5_VABI sceHmdInternalMapSharedMemory(void);
+int APS5_VABI sceHmdInternalGetCrashDumpInfo(HmdCrashDumpInfo* info);
+int APS5_VABI sceHmdInternalGetTv4kCapability(std::uint8_t* capability);
+int APS5_VABI sceHmdInternalDfuReset(void);
+int APS5_VABI sceHmdReprojectionStart2dVr(const HmdReprojection2dVrParameter* parameter, std::uint64_t flipArg, const void* reserved);
+int APS5_VABI sceHmdInternalMmapGetCount(void);
+int APS5_VABI sceHmdInternalSetDefaultLedData(std::int32_t handle, std::uint32_t mask, const HmdLedData* data);
+int APS5_VABI sceHmdInternal3dAudioClose(std::int32_t port);
+int APS5_VABI sceHmdInternalSetBrightness(std::uint8_t brightness);
+int APS5_VABI sceHmdInternalSocialScreenGetFadeState(std::int32_t* state);
+int APS5_VABI sceHmdInternalSeparateModeSendAudio(const HmdScreenData* data);
+int APS5_VABI sceHmdInternalGetStatusReport(std::int32_t handle, HmdStatusReport* report);
+int APS5_VABI sceHmdInternalGetBrightness(std::uint8_t* brightness);
+int APS5_VABI sceHmdReprojectionFinalizeCapture(void);
+int APS5_VABI sceHmdInternalSetPortStatus(std::uint64_t status);
+int APS5_VABI sceHmdReprojectionStop(void);
+int APS5_VABI sceHmdInternalAnotherScreenGetVideoStatus(HmdScreenStatus* status);
+int APS5_VABI sceHmdInternal3dAudioOpen(std::int32_t port);
+int APS5_VABI sceHmdInternalAnotherScreenGetFadeState(std::int32_t* state);
+int APS5_VABI sceHmdInternalSetDebugGpo(std::uint32_t value);
+int APS5_VABI sceHmdInternalGetIpdSettingEnableForSystemService(std::uint8_t* enabled);
+int APS5_VABI sceHmdReprojectionDebugGetLastInfoMultilayer(HmdReprojectionMultilayerDebugInfo* info);
+int APS5_VABI sceHmdInternalGetPuRevision(std::uint32_t* revision);
+
+}
diff --git a/core/libs/prx/libSceHmd/libSceHmd.hpp b/core/libs/prx/libSceHmd/libSceHmd.hpp
new file mode 100644
index 0000000000..fb3f263602
--- /dev/null
+++ b/core/libs/prx/libSceHmd/libSceHmd.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceHmd/Hmd.hpp"
+#include "prx/libSceHmd/include/Api.hpp"
diff --git a/core/libs/prx/libSceHmd2/CMakeLists.txt b/core/libs/prx/libSceHmd2/CMakeLists.txt
index fc0c32cbf4..6d7565ac4a 100644
--- a/core/libs/prx/libSceHmd2/CMakeLists.txt
+++ b/core/libs/prx/libSceHmd2/CMakeLists.txt
@@ -14,3 +14,15 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceHmd2>")
     endif()
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_hmd2_gaze_tests ${LIBS_INCLUDE_DIR}/tests/GuestHmd2Gaze.cpp)
+    target_include_directories(guest_hmd2_gaze_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_hmd2_gaze_tests PRIVATE libSceHmd2 libc)
+    configure_windows_unwind(guest_hmd2_gaze_tests)
+    add_test(NAME guest_hmd2_gaze COMMAND guest_hmd2_gaze_tests)
+    if(WIN32)
+        set_tests_properties(guest_hmd2_gaze PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceHmd2>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceHmd2/Export.cpp b/core/libs/prx/libSceHmd2/Export.cpp
index a0dd351bdf..a96c767d8b 100644
--- a/core/libs/prx/libSceHmd2/Export.cpp
+++ b/core/libs/prx/libSceHmd2/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceHmd2/include/Api.hpp"
+#include "prx/libSceHmd2/Hmd2.hpp"
 #include "Hmd2.hpp"
 #include "prx/libc/include/general/ExportMacros.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
@@ -13,25 +15,6 @@
 
 namespace Hmd2 {
 
-struct ReprojectionStatus;
-struct ReprojectionOutput {
-    std::uint32_t textureDescriptor[8];
-};
-
-struct ReprojectionInitializeParameter {
-    void* workMemory;
-    void* displayMemory;
-    std::int32_t threadPriority;
-    std::uint32_t threadAffinity;
-    std::uint32_t queueParameter24;
-    std::uint32_t queueParameter28;
-    std::uint32_t renderingMode;
-    std::uint32_t reserved36;
-    void* auxiliaryMemory;
-    std::uint32_t timingInterval;
-    std::uint32_t reserved52[5];
-};
-
 static_assert(sizeof(ReprojectionOutput) == 32);
 static_assert(sizeof(ReprojectionInitializeParameter) == 72);
 static_assert(offsetof(ReprojectionInitializeParameter, threadPriority) == 16);
@@ -39,28 +22,6 @@ static_assert(offsetof(ReprojectionInitializeParameter, threadAffinity) == 20);
 static_assert(offsetof(ReprojectionInitializeParameter, renderingMode) == 32);
 static_assert(offsetof(ReprojectionInitializeParameter, auxiliaryMemory) == 40);
 static_assert(offsetof(ReprojectionInitializeParameter, timingInterval) == 48);
-struct ReprojectionLayer;
-struct ReprojectionBufferedLayer;
-
-struct ReprojectionOption {
-    std::uint32_t size;
-    std::uint32_t flags;
-    std::uint32_t reserved[30];
-};
-
-struct ReprojectionParameter {
-    const ReprojectionLayer* layers;
-    std::int32_t layerCount;
-    std::uint8_t padding[4];
-    const ReprojectionOption* option;
-};
-
-struct ReprojectionBufferedParameter {
-    const ReprojectionBufferedLayer* layers;
-    std::int32_t layerCount;
-    std::uint8_t padding[4];
-    const ReprojectionOption* option;
-};
 
 static_assert(sizeof(ReprojectionOption) == 128);
 static_assert(sizeof(ReprojectionParameter) == 24);
@@ -68,88 +29,12 @@ static_assert(sizeof(ReprojectionBufferedParameter) == 24);
 static_assert(offsetof(ReprojectionParameter, option) == 16);
 static_assert(offsetof(ReprojectionBufferedParameter, option) == 16);
 
-
-struct MirroringParameter {
-    void* workMemory;
-    void* displayMemory;
-};
-
-struct MirroringOption {
-    std::uint32_t mode;
-    std::uint32_t reserved[7];
-};
-
 static_assert(sizeof(MirroringParameter) == 16);
 static_assert(sizeof(MirroringOption) == 32);
 
-struct GazeResultParameter {
-    std::uint32_t size;
-    std::int32_t handle;
-    std::uint8_t reserved[8];
-};
-struct GazeResult;
-struct FoveatedRenderingResult {
-    std::uint32_t size;
-    std::int32_t status;
-    float direction[3];
-    std::uint8_t reserved[4];
-};
-
 static_assert(sizeof(GazeResultParameter) == 16);
 static_assert(sizeof(FoveatedRenderingResult) == 24);
 static_assert(offsetof(FoveatedRenderingResult, direction) == 8);
-struct GazeCalibrationData {
-    void* data;
-    std::int32_t size;
-};
-struct GazeUserCalibrationData {
-    const void* data;
-    std::int32_t size;
-};
-struct GazeUserCalibrationStatus {
-    std::int32_t status;
-    std::int32_t eye;
-    float point[3];
-};
-struct GazeRawData;
-struct GazeObjectSelectionTransform {
-    float values[16];
-};
-
-struct GazeObjectSelectionObject {
-    std::uint64_t id;
-    std::uint32_t enabled;
-    std::uint32_t reserved12;
-    GazeObjectSelectionTransform transform;
-    const GazeObjectSelectionTransform* boundingBoxes;
-    std::uint32_t boundingBoxCount;
-    std::uint32_t reserved92;
-};
-
-struct GazeObjectSelectionParameter {
-    std::uint32_t size;
-    std::uint32_t reserved4;
-    std::uint64_t reserved8;
-    std::uint64_t gazeTimestamp;
-    GazeObjectSelectionTransform transform;
-    std::uint32_t selectionMode;
-    std::uint32_t filterMode;
-    std::uint64_t timestamp;
-    const GazeObjectSelectionObject* objects;
-    std::uint32_t objectCount;
-    std::uint32_t reserved116;
-};
-
-struct GazeObjectSelectionResult {
-    std::uint32_t size;
-    std::uint32_t selected;
-    std::uint64_t objectId;
-    std::uint64_t gazeTimestamp;
-    std::uint32_t gazeValid;
-    float origin[3];
-    float direction[3];
-    float distance;
-};
 
 static_assert(sizeof(GazeObjectSelectionTransform) == 64);
 static_assert(sizeof(GazeObjectSelectionObject) == 96);
@@ -168,28 +53,6 @@ static_assert(offsetof(GazeObjectSelectionResult, gazeTimestamp) == 16);
 static_assert(offsetof(GazeObjectSelectionResult, origin) == 28);
 static_assert(offsetof(GazeObjectSelectionResult, direction) == 40);
 static_assert(offsetof(GazeObjectSelectionResult, distance) == 52);
-struct GazeObjectSelectionInitializeParameter {
-    std::uint32_t size;
-    std::uint32_t maxObjects;
-    void* memory;
-    std::uint32_t memorySize;
-    std::uint32_t reserved;
-};
-struct GazeObjectSelectionMemoryParameter {
-    std::uint32_t size;
-    std::uint32_t maxObjects;
-};
-struct GazeObjectSelectionMemoryInfo {
-    std::uint32_t size;
-    std::uint32_t memorySize;
-    std::uint64_t alignment;
-};
-
-struct CalibrationPoint {
-    float x;
-    float y;
-    float z;
-};
 
 static_assert(sizeof(CalibrationPoint) == 12);
 static_assert(sizeof(GazeCalibrationData) == 16);
@@ -291,14 +154,40 @@ std::int32_t APS5_VABI sceHmd2Close(std::int32_t handle) {
     return 0;
 }
 
-int APS5_VABI sceHmd2GazeGetResult(const Hmd2::GazeResultParameter* parameter, Hmd2::GazeResult* result) {
-    NotImplemented_nid_no_patch(__func__);
+static std::int32_t Hmd2GazeHandle(const Hmd2::GazeResultParameter* param, const void* result, std::uint32_t resultSize, const char* name) {
+    if (!param || !result) return Hmd2::ParameterNull;
+    std::uint32_t size;
+    std::memcpy(&size, result, sizeof(size));
+    if (param->size != sizeof(Hmd2::GazeResultParameter) || size != resultSize) return Hmd2::ParameterInvalid;
+    std::lock_guard lock(stateMutex);
+    if (openHandle == 0 || param->handle != openHandle) return Hmd2::InvalidHandle;
+    NotImplemented_nid_no_patch(name);
     return 0;
 }
 
-int APS5_VABI sceHmd2GazeGetResultForFoveatedRendering(const Hmd2::GazeResultParameter* parameter, Hmd2::FoveatedRenderingResult* result) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+static void Hmd2StoreInvalidGaze(std::byte* result, std::size_t offset) {
+    const std::int32_t invalidIndex = -1;
+    const float invalidPair[2] = {-0.0f, 0.0f};
+    const float invalidScalar = -1.0f;
+    std::memcpy(result + 4, &invalidIndex, sizeof(invalidIndex));
+    std::memcpy(result + offset, invalidPair, sizeof(invalidPair));
+    std::memcpy(result + offset + sizeof(invalidPair), &invalidScalar, sizeof(invalidScalar));
+}
+
+int APS5_VABI sceHmd2GazeGetResult(const Hmd2::GazeResultParameter* param, Hmd2::GazeResult* result) {
+    const std::int32_t status = Hmd2GazeHandle(param, result, 0x38, __func__);
+    if (status != Hmd2::InvalidHandle) return status;
+    auto* bytes = reinterpret_cast<std::byte*>(result);
+    std::memset(bytes + 4, 0, 0x38 - 4);
+    Hmd2StoreInvalidGaze(bytes, 0x14);
+    return status;
+}
+
+int APS5_VABI sceHmd2GazeGetResultForFoveatedRendering(const Hmd2::GazeResultParameter* param, Hmd2::FoveatedRenderingResult* result) {
+    const std::int32_t status = Hmd2GazeHandle(param, result, 0x18, __func__);
+    if (status != Hmd2::InvalidHandle) return status;
+    Hmd2StoreInvalidGaze(reinterpret_cast<std::byte*>(result), 8);
+    return status;
 }
 
 std::int32_t APS5_VABI sceHmd2GetDeviceInformation(Hmd2::DeviceInformation* info) {
@@ -471,7 +360,6 @@ int APS5_VABI sceHmd2RpeorjectionSetParam() {
     return 0;
 }
 
-
 std::int32_t APS5_VABI Hmd2BeforeInitializeZero() {
     return BeforeInitialize(0, __func__);
 }
@@ -963,7 +851,6 @@ std::int32_t APS5_VABI Hmd2CheckSecondThenError1002(const void* a0, const void*
 }
 APS5_EXPORT("W-ZIlUXcrNA", Hmd2CheckSecondThenError1002);
 
-
 std::int32_t APS5_VABI Hmd2WriteStateTwo(void* a0) {
     if (a0 == nullptr) return Hmd2::ParameterNull;
     static constexpr std::uint8_t bytes[] = {0x02, 0x00, 0x00, 0x00, 0x00};
diff --git a/core/libs/prx/libSceHmd2/include/Api.hpp b/core/libs/prx/libSceHmd2/include/Api.hpp
new file mode 100644
index 0000000000..918b5ceac7
--- /dev/null
+++ b/core/libs/prx/libSceHmd2/include/Api.hpp
@@ -0,0 +1,376 @@
+#pragma once
+
+#include "prx/libSceHmd2/Hmd2.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstring>
+#include <mutex>
+#include <stdexcept>
+
+namespace Hmd2 {
+
+struct ReprojectionStatus;
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionOutput {
+    std::uint32_t textureDescriptor[8];
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionInitializeParameter {
+    void* workMemory;
+    void* displayMemory;
+    std::int32_t threadPriority;
+    std::uint32_t threadAffinity;
+    std::uint32_t queueParameter24;
+    std::uint32_t queueParameter28;
+    std::uint32_t renderingMode;
+    std::uint32_t reserved36;
+    void* auxiliaryMemory;
+    std::uint32_t timingInterval;
+    std::uint32_t reserved52[5];
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionLayer;
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionBufferedLayer;
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionOption {
+    std::uint32_t size;
+    std::uint32_t flags;
+    std::uint32_t reserved[30];
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionParameter {
+    const ReprojectionLayer* layers;
+    std::int32_t layerCount;
+    std::uint8_t padding[4];
+    const ReprojectionOption* option;
+};
+
+}
+
+namespace Hmd2 {
+
+struct ReprojectionBufferedParameter {
+    const ReprojectionBufferedLayer* layers;
+    std::int32_t layerCount;
+    std::uint8_t padding[4];
+    const ReprojectionOption* option;
+};
+
+}
+
+namespace Hmd2 {
+
+struct MirroringParameter {
+    void* workMemory;
+    void* displayMemory;
+};
+
+}
+
+namespace Hmd2 {
+
+struct MirroringOption {
+    std::uint32_t mode;
+    std::uint32_t reserved[7];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeResultParameter {
+    std::uint32_t size;
+    std::int32_t handle;
+    std::uint8_t reserved[8];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeResult;
+
+}
+
+namespace Hmd2 {
+
+struct FoveatedRenderingResult {
+    std::uint32_t size;
+    std::int32_t status;
+    float direction[3];
+    std::uint8_t reserved[4];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeCalibrationData {
+    void* data;
+    std::int32_t size;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeUserCalibrationData {
+    const void* data;
+    std::int32_t size;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeUserCalibrationStatus {
+    std::int32_t status;
+    std::int32_t eye;
+    float point[3];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeRawData;
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionTransform {
+    float values[16];
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionObject {
+    std::uint64_t id;
+    std::uint32_t enabled;
+    std::uint32_t reserved12;
+    GazeObjectSelectionTransform transform;
+    const GazeObjectSelectionTransform* boundingBoxes;
+    std::uint32_t boundingBoxCount;
+    std::uint32_t reserved92;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionParameter {
+    std::uint32_t size;
+    std::uint32_t reserved4;
+    std::uint64_t reserved8;
+    std::uint64_t gazeTimestamp;
+    GazeObjectSelectionTransform transform;
+    std::uint32_t selectionMode;
+    std::uint32_t filterMode;
+    std::uint64_t timestamp;
+    const GazeObjectSelectionObject* objects;
+    std::uint32_t objectCount;
+    std::uint32_t reserved116;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionResult {
+    std::uint32_t size;
+    std::uint32_t selected;
+    std::uint64_t objectId;
+    std::uint64_t gazeTimestamp;
+    std::uint32_t gazeValid;
+    float origin[3];
+    float direction[3];
+    float distance;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionInitializeParameter {
+    std::uint32_t size;
+    std::uint32_t maxObjects;
+    void* memory;
+    std::uint32_t memorySize;
+    std::uint32_t reserved;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionMemoryParameter {
+    std::uint32_t size;
+    std::uint32_t maxObjects;
+};
+
+}
+
+namespace Hmd2 {
+
+struct GazeObjectSelectionMemoryInfo {
+    std::uint32_t size;
+    std::uint32_t memorySize;
+    std::uint64_t alignment;
+};
+
+}
+
+namespace Hmd2 {
+
+struct CalibrationPoint {
+    float x;
+    float y;
+    float z;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceHmd2ReprojectionGetStatus(Hmd2::ReprojectionStatus* status);
+int APS5_VABI sceHmd2GazeGetResult(const Hmd2::GazeResultParameter* param, Hmd2::GazeResult* result);
+int APS5_VABI sceHmd2GazeGetResultForFoveatedRendering(const Hmd2::GazeResultParameter* param, Hmd2::FoveatedRenderingResult* result);
+int APS5_VABI sceHmd2ReprojectionBeginFrame(std::uint64_t frameId);
+int APS5_VABI sceHmd2ReprojectionDisableMirroring();
+int APS5_VABI sceHmd2ReprojectionDisableVrMode();
+int APS5_VABI sceHmd2ReprojectionEnableMirroring(const Hmd2::MirroringParameter* parameter);
+int APS5_VABI sceHmd2ReprojectionEnableVrMode(std::uint64_t mode);
+int APS5_VABI sceHmd2ReprojectionGetPredictedDisplayTime(std::uint64_t frameId, std::uint64_t* time);
+int APS5_VABI sceHmd2ReprojectionInitialize(const Hmd2::ReprojectionInitializeParameter* parameter, const void* reserved);
+int APS5_VABI sceHmd2ReprojectionSetAllowPositionalReprojection(std::uint8_t mode);
+int APS5_VABI sceHmd2ReprojectionSetMirroringOption(const Hmd2::MirroringOption* option);
+int APS5_VABI sceHmd2ReprojectionSetParam(std::uint32_t bufferSetId, std::uint64_t frameId, const Hmd2::ReprojectionParameter* parameter, std::uint64_t reserved);
+int APS5_VABI sceHmd2ReprojectionSetParamWithBuffer(std::uint32_t bufferSetId, std::uint64_t frameId, const Hmd2::ReprojectionBufferedParameter* parameter, std::uint64_t reserved);
+int APS5_VABI sceHmd2ReprojectionSetRenderConfig(std::uint64_t flags, std::uint64_t reserved, std::uint64_t reserved2);
+int APS5_VABI sceHmd2ReprojectionSetTiming(std::int32_t timing);
+int APS5_VABI sceHmd2ReprojectionTerminate();
+int APS5_VABI sceHmd2ReprojectionSeeThroughDraw();
+int APS5_VABI sceHmd2ReprojectionSeeThroughIC();
+int APS5_VABI sceHmd2ReprojectionVideoOutEq();
+int APS5_VABI sceHmd2ReprojectionWaitShader();
+int APS5_VABI sceHmd2SeeThroughCallbackGetPoseDataFunc();
+int APS5_VABI sceHmd2ReprojectionClear();
+int APS5_VABI sceHmd2ReprojectionSet();
+int APS5_VABI sceHmd2ReprojectionSetEventGpuEnd(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2ReprojectionSetEventGpuStart(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2RpeorjectionSetParam();
+std::int32_t APS5_VABI Hmd2BeforeInitializeZero();
+int APS5_VABI sceHmd2SetIpdOffset(std::uint8_t enabled, float offset);
+int APS5_VABI sceHmd2GazeActivateGazeTracking(std::int32_t mode);
+std::int32_t APS5_VABI Hmd2BeforeInitializeNotInitialized();
+std::int32_t APS5_VABI Hmd2BeforeInitializeError0004();
+int APS5_VABI sceHmd2GazeStartUserCalibration();
+int APS5_VABI sceHmd2GazeStopUserCalibration();
+int APS5_VABI sceHmd2GazeSetUserCalibrationPoint(Hmd2::CalibrationPoint point);
+int APS5_VABI sceHmd2GazeSetEnabledEye(std::int32_t eye);
+std::int32_t APS5_VABI Hmd2BeforeInitializeParameterNull();
+int APS5_VABI sceHmd2GazeGetCalibrationData(std::int32_t type, Hmd2::GazeCalibrationData* data);
+int APS5_VABI sceHmd2GazeSetUserCalibrationData(const Hmd2::GazeUserCalibrationData* data);
+int APS5_VABI sceHmd2GazeObjectSelectionInitialize(const Hmd2::GazeObjectSelectionInitializeParameter* parameter);
+std::int32_t APS5_VABI Hmd2BeforeInitializeParameterInvalid();
+std::int32_t APS5_VABI Hmd2BeforeInitializeReprojectionNotInitialized();
+int APS5_VABI sceHmd2ReprojectionSetUserEventStart(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2ReprojectionSetUserEventEnd(KernelEqueue queue, std::int32_t eventId);
+int APS5_VABI sceHmd2ReprojectionClearUserEventStart();
+int APS5_VABI sceHmd2ReprojectionClearUserEventEnd();
+int APS5_VABI sceHmd2ReprojectionGetCurrentOutput(Hmd2::ReprojectionOutput* output);
+std::int32_t APS5_VABI Hmd2BeforeInitializeError002C();
+int APS5_VABI sceHmd2GazeObjectSelectionTerminate();
+std::int32_t APS5_VABI Hmd2BeforeInitializeError1002();
+std::int32_t APS5_VABI Hmd2BeforeInitializeError1003();
+std::int32_t APS5_VABI Hmd2BeforeInitializeMinusOne();
+std::int32_t APS5_VABI Hmd2BeforeInitializeValue0400();
+std::int32_t APS5_VABI Hmd2BeforeInitializeValue20000();
+int APS5_VABI sceHmd2InternalSetPortStatus(void);
+int APS5_VABI sceHmd2InternalLedDetectorStartBySlot(void);
+int APS5_VABI sceHmd2InternalImageStartBySlot(void);
+int APS5_VABI sceHmd2InternalSetPortConnection(void);
+int APS5_VABI sceHmd2InternalSetCameraSeeThroughMode(void);
+int APS5_VABI sceHmd2InternalSetFakeLensSeparationDistance(void);
+int APS5_VABI sceHmd2InternalDfuSend(void);
+int APS5_VABI sceHmd2InternalLedDetectorOpenBySlot(void);
+int APS5_VABI sceHmd2InternalImageOpenBySlot(void);
+int APS5_VABI sceHmd2InternalLedDetectorStopBySlot(void);
+int APS5_VABI sceHmd2InternalSetDeviceConnection(void);
+int APS5_VABI sceHmd2InternalLedDetectorCloseBySlot(void);
+int APS5_VABI sceHmd2InternalSetSidetone(void);
+int APS5_VABI sceHmd2InternalGetDeviceId(void);
+int APS5_VABI sceHmd2InternalSetBrightness(void);
+int APS5_VABI sceHmd2InternalImageStopBySlot(void);
+int APS5_VABI sceHmd2InternalSetVibrationMode(void);
+int APS5_VABI sceHmd2InternalGetVr2dData(void);
+int APS5_VABI sceHmd2InternalImageCloseBySlot(void);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError0004(const void* a0);
+int APS5_VABI sceHmd2GazeGetDeviceStatus(std::int32_t* status);
+int APS5_VABI sceHmd2GazeGetUserCalibrationStatus(Hmd2::GazeUserCalibrationStatus* status);
+std::int32_t APS5_VABI Hmd2CheckFirstThenZero(const void* a0);
+int APS5_VABI sceHmd2SetFieldOfView(const Hmd2::FieldOfView* fieldOfView);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError1002(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstThenMinusOne(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstTwoThenParameterInvalid(const void* a0, const void* a1);
+int APS5_VABI sceHmd2GazeObjectSelectionQueryMemory(const Hmd2::GazeObjectSelectionMemoryParameter* parameter, Hmd2::GazeObjectSelectionMemoryInfo* info);
+int APS5_VABI sceHmd2GazeObjectSelectionGetSelectedObject(const Hmd2::GazeObjectSelectionParameter* parameter, Hmd2::GazeObjectSelectionResult* result);
+std::int32_t APS5_VABI Hmd2CheckSecondThenError002C(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2CheckFirstThenParameterInvalid(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckAllSixThenZero(const void* a0, const void* a1, const void* a2, const void* a3, const void* a4, const void* a5);
+std::int32_t APS5_VABI Hmd2CheckSecondThenParameterInvalid(const void* a0, const void* a1);
+int APS5_VABI sceHmd2GazeGetCalibrationDataMaxSize(std::int32_t type, std::uint32_t* size);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError800d0203(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError1003(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstThenError1010(const void* a0);
+std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1002(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1003(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenZero(const void* a0, const void* a1, const void* a2);
+std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenError1003(const void* a0, const void* a1, const void* a2);
+std::int32_t APS5_VABI Hmd2CheckSecondThenInvalidHandle(const void* a0, const void* a1);
+int APS5_VABI sceHmd2GazeInsertRawDataWithHandle(std::int32_t handle, Hmd2::GazeRawData* data);
+std::int32_t APS5_VABI Hmd2CheckSecondThenError1002(const void* a0, const void* a1);
+std::int32_t APS5_VABI Hmd2WriteStateTwo(void* a0);
+std::int32_t APS5_VABI Hmd2WriteSize0x2000Align0x100(std::uint64_t* a0, std::uint64_t* a1);
+std::int32_t APS5_VABI Hmd2WriteFourConstants(void* a0);
+std::int32_t APS5_VABI Hmd2WriteSixHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
+std::int32_t APS5_VABI Hmd2WriteTwelveHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
+std::int32_t APS5_VABI Hmd2SlotUpTo3CheckSecondThirdThenZero(std::uint64_t a0, const void* a1, const void* a2);
+std::int32_t APS5_VABI Hmd2SlotUpTo1ThenError1002(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo1CheckSecondThenError1002(std::uint64_t a0, const void* a1);
+std::int32_t APS5_VABI Hmd2SlotUpTo1ThenMinusOne(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2ThenMinusOne(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1002(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1003(std::uint64_t a0);
+std::int32_t APS5_VABI Hmd2SlotUpTo2CheckSecondThenError002C(std::uint64_t a0, const void* a1);
+std::int32_t APS5_VABI Hmd2IndexZeroCheckSecondThenZero(std::uint64_t a0, const void* a1);
+
+}
diff --git a/core/libs/prx/libSceHmd2/libSceHmd2.hpp b/core/libs/prx/libSceHmd2/libSceHmd2.hpp
new file mode 100644
index 0000000000..0c3f869cc7
--- /dev/null
+++ b/core/libs/prx/libSceHmd2/libSceHmd2.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceHmd2/Hmd2.hpp"
+#include "prx/libSceHmd2/include/Api.hpp"
diff --git a/core/libs/prx/libSceHmdSetupDialog/CMakeLists.txt b/core/libs/prx/libSceHmdSetupDialog/CMakeLists.txt
new file mode 100644
index 0000000000..a294abe2b0
--- /dev/null
+++ b/core/libs/prx/libSceHmdSetupDialog/CMakeLists.txt
@@ -0,0 +1,14 @@
+add_library(libSceHmdSetupDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceHmdSetupDialog PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceHmdSetupDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_hmd_setup_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestHmdSetupDialog.cpp)
+    target_include_directories(guest_hmd_setup_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_hmd_setup_dialog_tests PRIVATE libSceHmdSetupDialog)
+    add_test(NAME guest_hmd_setup_dialog COMMAND guest_hmd_setup_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_hmd_setup_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceHmdSetupDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceHmdSetupDialog/Export.cpp b/core/libs/prx/libSceHmdSetupDialog/Export.cpp
index 6fb905167d..156643bf24 100644
--- a/core/libs/prx/libSceHmdSetupDialog/Export.cpp
+++ b/core/libs/prx/libSceHmdSetupDialog/Export.cpp
@@ -1,42 +1,71 @@
+#include "prx/libSceHmdSetupDialog/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+std::atomic<int> g_status{COMMON_DIALOG_STATUS_NONE};
+
+}
+
 extern "C" {
 
-int APS5_VABI sceHmdSetupDialogClose() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHmdSetupDialogInitialize(void) {
+    int expected = COMMON_DIALOG_STATUS_NONE;
+    if (!g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_INITIALIZED)) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
     return 0;
 }
 
-int APS5_VABI sceHmdSetupDialogGetResult() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHmdSetupDialogOpen(const void* param) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceHmdSetupDialogGetStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHmdSetupDialogUpdateStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceHmdSetupDialogGetStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceHmdSetupDialogGetResult(void* result) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (status != COMMON_DIALOG_STATUS_FINISHED) return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    const std::int32_t canceled = COMMON_DIALOG_RESULT_USER_CANCELED;
+    std::memcpy(result, &canceled, sizeof(canceled));
     return 0;
 }
 
-int APS5_VABI sceHmdSetupDialogInitialize() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHmdSetupDialogClose(void) {
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceHmdSetupDialogOpen() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceHmdSetupDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceHmdSetupDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHmdSetupDialogTerminate(void) {
+    if (g_status.exchange(COMMON_DIALOG_STATUS_NONE) == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceHmdSetupDialog/include/Api.hpp b/core/libs/prx/libSceHmdSetupDialog/include/Api.hpp
new file mode 100644
index 0000000000..abe27b70aa
--- /dev/null
+++ b/core/libs/prx/libSceHmdSetupDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceHmdSetupDialogInitialize(void);
+int APS5_VABI sceHmdSetupDialogOpen(const void* param);
+int APS5_VABI sceHmdSetupDialogUpdateStatus(void);
+int APS5_VABI sceHmdSetupDialogGetStatus(void);
+int APS5_VABI sceHmdSetupDialogGetResult(void* result);
+int APS5_VABI sceHmdSetupDialogClose(void);
+int APS5_VABI sceHmdSetupDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceHmdSetupDialog/libSceHmdSetupDialog.hpp b/core/libs/prx/libSceHmdSetupDialog/libSceHmdSetupDialog.hpp
new file mode 100644
index 0000000000..4b5986bfa2
--- /dev/null
+++ b/core/libs/prx/libSceHmdSetupDialog/libSceHmdSetupDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHmdSetupDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceHttp/Export.cpp b/core/libs/prx/libSceHttp/Export.cpp
index 6599dbf379..ad94bc3ba5 100644
--- a/core/libs/prx/libSceHttp/Export.cpp
+++ b/core/libs/prx/libSceHttp/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include <cstdint>
 #include <cstddef>
 #ifdef _WIN32
@@ -24,52 +25,23 @@
 // No network is emulated: contexts, templates and requests can be created, but any request
 // that would touch the network fails with the library's network error.
 static std::atomic<int> g_nextHandle{1};
-struct HttpConnectionStat;
-struct HttpRequestStat;
 
-using HttpCookieSendCallback = int (APS5_VABI *)(std::int32_t, const char*, const char*, void*);
-using HttpSocketCreationCallback = void (APS5_VABI *)(std::int32_t, std::int32_t, void*);
-using HttpRequestStatusCallback = void (APS5_VABI *)(int, int, void*);
 struct RequestStatusRegistration {
     HttpRequestStatusCallback callback;
     void* argument;
 };
 static std::mutex g_statusMutex;
 static std::map<int, RequestStatusRegistration> g_statusCallbacks;
-struct HttpCookieStats {
-    std::size_t usedBytes;
-    std::uint32_t cookieCount;
-    std::uint32_t reserved;
-    std::size_t peakUsedBytes;
-    std::uint32_t peakCookieCount;
-    std::uint32_t evictedCookieCount;
-};
 
 static_assert(sizeof(HttpCookieStats) == 32);
 static_assert(offsetof(HttpCookieStats, peakUsedBytes) == 16);
 
-struct HttpMemoryPoolStats {
-    std::size_t poolSize;
-    std::size_t peakUsedSize;
-    std::size_t usedSize;
-};
-
-struct HttpRequestHeader {
-    const char* name;
-    const char* value;
-};
-
 static_assert(sizeof(HttpMemoryPoolStats) == 24);
 static_assert(offsetof(HttpMemoryPoolStats, peakUsedSize) == 8);
 static_assert(offsetof(HttpMemoryPoolStats, usedSize) == 16);
 static_assert(sizeof(HttpRequestHeader) == 16);
 static_assert(offsetof(HttpRequestHeader, value) == 8);
 
-struct HttpsCaList {
-    void* certs;
-    int certsNum;
-};
-
 #ifdef _WIN32
 struct HostMutex {
     SRWLOCK native = SRWLOCK_INIT;
@@ -138,6 +110,7 @@ struct HttpEpoll {
 
 static std::mutex g_stateMutex;
 static std::unordered_set<int> g_contexts;
+static std::unordered_map<int, uint64_t> g_contextPoolSizes;
 static std::unordered_map<HttpEpollHandle, std::shared_ptr<HttpEpoll>> g_epolls;
 
 static std::shared_ptr<HttpEpoll> FindEpoll(HttpEpollHandle eh) {
@@ -184,6 +157,16 @@ int APS5_VABI sceHttpCookieFlush(int httpCtxId) {
     return 0;
 }
 
+int APS5_VABI sceHttpGetMemoryPoolStats(int httpCtxId, HttpMemoryPoolStats* currentStat) {
+    if (!currentStat) APS5_INVALID_ARG_EX;
+    std::lock_guard lock(g_stateMutex);
+    if (g_contexts.empty()) return ERROR_BEFORE_INIT;
+    const auto pool = g_contextPoolSizes.find(httpCtxId);
+    if (pool == g_contextPoolSizes.end()) return ERROR_INVALID_ID;
+    *currentStat = {static_cast<std::size_t>(pool->second), 0, 0};
+    return 0;
+}
+
 int APS5_VABI sceHttpCreateConnection(int tmpl_id, const char* server_name, const char* scheme, uint16_t port, int enable_keep_alive) {
     (void)server_name;
     (void)scheme;
@@ -295,9 +278,9 @@ int APS5_VABI sceHttpGetStatusCode(int request_id, int* status_code) {
 int APS5_VABI sceHttpInit_nid_postfix(int memid, int ssl_ctx_id, uint64_t pool_size) {
     (void)memid;
     (void)ssl_ctx_id;
-    (void)pool_size;
     const int id = g_nextHandle.fetch_add(1, std::memory_order_relaxed);
     std::lock_guard lock(g_stateMutex);
+    g_contextPoolSizes[id] = pool_size;
     g_contexts.insert(id);
     AddHttpContext(id);
     return id;
@@ -317,9 +300,8 @@ int APS5_VABI sceHttpSendRequest(int request_id, const void* post_data, size_t s
 }
 
 int APS5_VABI sceHttpSetAuthEnabled(int id, int enable) {
-    (void)id;
-    (void)enable;
-    return 0;
+    if (!HttpInitialised()) return ERROR_BEFORE_INIT;
+    return SetHttpOption(id, &HttpOptions::authEnabled, enable != 0) ? 0 : ERROR_INVALID_ID;
 }
 
 int APS5_VABI sceHttpSetAuthInfoCallback(int id, HttpAuthInfoCallback callback, void* userArg) {
@@ -330,10 +312,9 @@ int APS5_VABI sceHttpSetAuthInfoCallback(int id, HttpAuthInfoCallback callback,
 }
 
 int APS5_VABI sceHttpSetCookieEnabled(int id, int enable) {
-    (void)id;
     if (static_cast<uint32_t>(enable) > 1) return ERROR_INVALID_VALUE;
-    if (enable != 0) NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (!HttpInitialised()) return ERROR_BEFORE_INIT;
+    return SetHttpOption(id, &HttpOptions::cookieEnabled, enable != 0) ? 0 : ERROR_INVALID_ID;
 }
 
 int APS5_VABI sceHttpSetAutoRedirect(int id, int enable) {
@@ -422,6 +403,7 @@ int APS5_VABI sceHttpTerm_nid_postfix(int http_ctx_id) {
     std::vector<std::shared_ptr<HttpEpoll>> epolls;
     {
         std::lock_guard lock(g_stateMutex);
+        g_contextPoolSizes.erase(http_ctx_id);
         if (g_contexts.empty()) return ERROR_BEFORE_INIT;
         if (g_contexts.erase(http_ctx_id) == 0) return ERROR_INVALID_ID;
         RemoveHttpContext(http_ctx_id);
@@ -485,7 +467,6 @@ int APS5_VABI sceHttpSetChunkedTransferEnabled(int id, int enable) {
     return 0;
 }
 
-
 int APS5_VABI sceHttpSetInflateGZIPEnabled(int id, int enable) {
     (void)id;
     if (static_cast<uint32_t>(enable) > 1) return ERROR_INVALID_VALUE;
@@ -691,11 +672,6 @@ int APS5_VABI sceHttpDbgShowStat(void) {
     return 0;
 }
 
-int APS5_VABI sceHttpGetMemoryPoolStats(int contextId, HttpMemoryPoolStats* stats) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceHttpDbgShowConnectionStat(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -727,12 +703,17 @@ int APS5_VABI sceHttpAddRequestHeaderRaw(int id, const char* header, int mode) {
 }
 
 int APS5_VABI sceHttpRemoveRequestHeader(int id, const char* name) {
-    NotImplemented_nid_no_patch(__func__);
+    (void)id;
+    (void)name;
     return 0;
 }
 
-int APS5_VABI sceHttpGetAuthEnabled(int id, int* enabled) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHttpGetAuthEnabled(int id, int* enable) {
+    if (!HttpInitialised()) return ERROR_BEFORE_INIT;
+    if (!enable) return ERROR_INVALID_VALUE;
+    const auto options = FindHttpOptions(id);
+    if (!options) return ERROR_INVALID_ID;
+    *enable = options->authEnabled ? 1 : 0;
     return 0;
 }
 
@@ -751,8 +732,12 @@ int APS5_VABI sceHttpGetCookie(int contextId, const char* url, char* cookie, std
     return 0;
 }
 
-int APS5_VABI sceHttpGetCookieEnabled(int id, int* enabled) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceHttpGetCookieEnabled(int id, int* enable) {
+    if (!HttpInitialised()) return ERROR_BEFORE_INIT;
+    if (!enable) return ERROR_INVALID_VALUE;
+    const auto options = FindHttpOptions(id);
+    if (!options) return ERROR_INVALID_ID;
+    *enable = options->cookieEnabled ? 1 : 0;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceHttp/include/Http.hpp b/core/libs/prx/libSceHttp/include/Http.hpp
new file mode 100644
index 0000000000..505be14652
--- /dev/null
+++ b/core/libs/prx/libSceHttp/include/Http.hpp
@@ -0,0 +1,157 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct HttpConnectionStat;
+struct HttpRequestStat;
+
+struct HttpCookieStats {
+    std::size_t usedBytes;
+    std::uint32_t cookieCount;
+    std::uint32_t reserved;
+    std::size_t peakUsedBytes;
+    std::uint32_t peakCookieCount;
+    std::uint32_t evictedCookieCount;
+};
+
+struct HttpMemoryPoolStats {
+    std::size_t poolSize;
+    std::size_t peakUsedSize;
+    std::size_t usedSize;
+};
+
+struct HttpRequestHeader {
+    const char* name;
+    const char* value;
+};
+
+struct HttpsCaList {
+    void* certs;
+    int certsNum;
+};
+
+using HttpCookieSendCallback = int (APS5_VABI *)(std::int32_t, const char*, const char*, void*);
+
+using HttpSocketCreationCallback = void (APS5_VABI *)(std::int32_t, std::int32_t, void*);
+
+using HttpRequestStatusCallback = void (APS5_VABI *)(int, int, void*);
+
+extern "C" {
+
+int APS5_VABI sceHttpAbortRequest(int requestId);
+int APS5_VABI sceHttpAbortRequestForce(int requestId);
+int APS5_VABI sceHttpAddRequestHeader(int id, const char* name, const char* value, uint32_t mode);
+int APS5_VABI sceHttpAuthCacheFlush(int httpCtxId);
+int APS5_VABI sceHttpCookieFlush(int httpCtxId);
+int APS5_VABI sceHttpCreateConnection(int tmplId, const char* serverName, const char* scheme, uint16_t port, int enableKeepAlive);
+int APS5_VABI sceHttpCreateConnectionWithURL(int tmplId, const char* url, int enableKeepAlive);
+int APS5_VABI sceHttpCreateEpoll(int httpCtxId, HttpEpollHandle* eh);
+int APS5_VABI sceHttpCreateRequest(int connId, int method, const char* path, uint64_t contentLength);
+int APS5_VABI sceHttpCreateRequestWithURL2(int connId, const char* method, const char* url, uint64_t contentLength);
+int APS5_VABI sceHttpCreateTemplate(int httpCtxId, const char* userAgent, int httpVer, int isAutoProxyConf);
+int APS5_VABI sceHttpDeleteConnection(int connId);
+int APS5_VABI sceHttpDeleteRequest(int reqId);
+int APS5_VABI sceHttpDeleteTemplate(int tmplId);
+int APS5_VABI sceHttpDestroyEpoll(int httpCtxId, HttpEpollHandle eh);
+int APS5_VABI sceHttpGetAllResponseHeaders(int requestId, char** header, size_t* headerSize);
+int APS5_VABI sceHttpGetResponseContentLength(int requestId, int* result, uint64_t* contentLength);
+int APS5_VABI sceHttpGetStatusCode(int requestId, int* statusCode);
+int APS5_VABI sceHttpInit_nid_postfix(int memid, int sslCtxId, uint64_t poolSize);
+int APS5_VABI sceHttpsDisableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttpSendRequest(int requestId, const void* postData, size_t size);
+int APS5_VABI sceHttpSetAuthEnabled(int id, int enable);
+int APS5_VABI sceHttpSetAuthInfoCallback(int id, HttpAuthInfoCallback callback, void* userArg);
+int APS5_VABI sceHttpSetCookieEnabled(int id, int enable);
+int APS5_VABI sceHttpSetAutoRedirect(int id, int enable);
+int APS5_VABI sceHttpSetConnectTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpSetEpoll(int id, HttpEpollHandle eh, void* userArg);
+int APS5_VABI sceHttpSetNonblock(int id, int enable);
+int APS5_VABI sceHttpTrySetNonblock(int id, int enable);
+int APS5_VABI sceHttpSetRecvTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpSetRecvBlockSize(int id, uint32_t blockSize);
+int APS5_VABI sceHttpSetResponseHeaderMaxSize(int id, uint64_t headerSize);
+int APS5_VABI sceHttpSetRequestContentLength(int requestId, uint64_t contentLength);
+int APS5_VABI sceHttpSetResolveRetry(int id, int32_t retry);
+int APS5_VABI sceHttpSetResolveTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpSetSendTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttpsSetMinSslVersion(int id, uint32_t sslVersion);
+int APS5_VABI sceHttpsSetSslCallback(int id, HttpsCallback cbfunc, void* userArg);
+int APS5_VABI sceHttpTerm_nid_postfix(int httpCtxId);
+int APS5_VABI sceHttpUnsetEpoll(int id);
+int APS5_VABI sceHttpWaitRequest(HttpEpollHandle eh, HttpNBEvent* nbev, int maxevents, int timeout);
+int APS5_VABI sceHttpCreateRequestWithURL(int connId, int method, const char* url, uint64_t contentLength);
+int APS5_VABI sceHttpReadData(int requestId, void* data, size_t size);
+int APS5_VABI sceHttpRedirectCacheFlush(int httpCtxId);
+int APS5_VABI sceHttpSetChunkedTransferEnabled(int id, int enable);
+int APS5_VABI sceHttpSetInflateGZIPEnabled(int id, int enable);
+int APS5_VABI sceHttpSetRequestStatusCallback(int id, HttpRequestStatusCallback callback, void* argument);
+int APS5_VABI sceHttpParseResponseHeader(const char* header, std::size_t headerLen, const char* fieldStr, const char** fieldValue, std::size_t* valueLen);
+int APS5_VABI sceHttpCreateRequest2(int connId, const char* method, const char* path, uint64_t contentLength);
+int APS5_VABI sceHttpsEnableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttpsLoadCert(int httpCtxId, int num, void* caList, void* cert, void* key);
+int APS5_VABI sceHttpsUnloadCert(int httpCtxId);
+int APS5_VABI sceHttpGetLastErrno(int requestId, int* errnoOut);
+int APS5_VABI sceHttpsGetSslError(int id, int* errNum, uint32_t* detail);
+int APS5_VABI sceHttpSetCookieRecvCallback(int id, HttpCookieRecvCallback cbfunc, void* userArg);
+int APS5_VABI sceHttpsSetSslVersion(int id, int sslVersion);
+int APS5_VABI sceHttpSetRedirectCallback(int id, HttpRedirectCallback cbfunc, void* userArg);
+int APS5_VABI sceHttpAbortWaitRequest(HttpEpollHandle eh);
+int APS5_VABI sceHttpsGetCaList(int httpCtxId, HttpsCaList* caList);
+int APS5_VABI sceHttpsFreeCaList(int httpCtxId, HttpsCaList* caList);
+int APS5_VABI sceHttpAuthCacheImport(int contextId, const void* buffer, std::size_t size);
+int APS5_VABI sceHttpAuthCacheExport(int contextId, void* buffer, std::size_t size, std::size_t* requiredSize);
+int APS5_VABI sceHttpDbgEnableProfile(void);
+int APS5_VABI sceHttpDbgSetPrintf(void);
+int APS5_VABI sceHttpDbgShowStat(void);
+int APS5_VABI sceHttpGetMemoryPoolStats(int contextId, HttpMemoryPoolStats* stats);
+int APS5_VABI sceHttpDbgShowConnectionStat(void);
+int APS5_VABI sceHttpDbgShowRequestStat(void);
+int APS5_VABI sceHttpDbgShowMemoryPoolStat(void);
+int APS5_VABI sceHttpDbgGetConnectionStat(std::int32_t connectionId, HttpConnectionStat* stat);
+int APS5_VABI sceHttpDbgGetRequestStat(std::int32_t requestId, HttpRequestStat* stat);
+int APS5_VABI sceHttpAddRequestHeaderRaw(int id, const char* header, int mode);
+int APS5_VABI sceHttpRemoveRequestHeader(int id, const char* name);
+int APS5_VABI sceHttpGetAuthEnabled(int id, int* enable);
+int APS5_VABI sceHttpSetEpollId(std::int32_t id, std::int32_t epollId, void* userArg);
+int APS5_VABI sceHttpGetEpollId(std::int32_t id, std::int32_t* epollId, void** userArg);
+int APS5_VABI sceHttpGetCookie(int contextId, const char* url, char* cookie, std::size_t* requiredSize, std::size_t size);
+int APS5_VABI sceHttpGetCookieEnabled(int id, int* enable);
+int APS5_VABI sceHttpAddCookie(int contextId, const char* url, const char* cookie, std::size_t size);
+int APS5_VABI sceHttpSetCookieSendCallback(std::int32_t id, HttpCookieSendCallback callback, void* userArg);
+int APS5_VABI sceHttpCookieExport(int contextId, void* buffer, std::size_t size, std::size_t* requiredSize);
+int APS5_VABI sceHttpCookieImport(int contextId, const void* buffer, std::size_t size);
+int APS5_VABI sceHttpSetCookieTotalMaxSize(int contextId, std::uint32_t size);
+int APS5_VABI sceHttpSetCookieMaxSize(int contextId, std::uint32_t size);
+int APS5_VABI sceHttpSetCookieMaxNum(int contextId, std::uint32_t count);
+int APS5_VABI sceHttpSetCookieMaxNumPerDomain(int contextId, std::uint32_t count);
+int APS5_VABI sceHttpGetCookieStats(int id, HttpCookieStats* stats);
+int APS5_VABI sceHttpSetPriorityOption(int id, int priority);
+int APS5_VABI sceHttpSetPolicyOption(int id, int policy);
+int APS5_VABI sceHttpRequestGetAllHeaders(int requestId, HttpRequestHeader* headers, std::uint32_t* headerCount, char* contentLength, std::size_t* contentLengthSize);
+int APS5_VABI sceHttpSetDefaultAcceptEncodingGZIPEnabled(int httpCtxId, int enable);
+int APS5_VABI sceHttpSetProxy(int id, int, int, const char* hostname, std::uint16_t);
+int APS5_VABI sceHttpSetSocketCreationCallback(std::int32_t id, HttpSocketCreationCallback callback, void* userArg);
+int APS5_VABI sceHttpSetHttp09Enabled(int id, int enabled);
+int APS5_VABI sceHttpGetRegisteredCtxIds(int contextId, int* netPoolId, int* sslContextId);
+int APS5_VABI sceHttpGetConnectionStat(std::int32_t connectionId, HttpConnectionStat* stat);
+int APS5_VABI sceHttpAddQuery(int id, const char* query);
+int APS5_VABI sceHttpSetDelayBuildRequestEnabled(int id, int enabled);
+int APS5_VABI sceHttpGetAutoRedirect(int id, int* enable);
+int APS5_VABI sceHttpGetNonblock(int id, int* enable);
+int APS5_VABI sceHttpTryGetNonblock(int id, int* enable);
+int APS5_VABI sceHttpGetAcceptEncodingGZIPEnabled(int id, int* enable);
+int APS5_VABI sceHttpSetAcceptEncodingGZIPEnabled(int id, int enable);
+int APS5_VABI sceHttpGetEpoll(int id, HttpEpollHandle* epoll, void** argument);
+int APS5_VABI sceHttpCacheRedirectedConnectionEnabled(int id, int enable);
+int APS5_VABI sceHttpsEnableOptionPrivate(int id, std::uint32_t sslFlags);
+int APS5_VABI sceHttpsDisableOptionPrivate(int id, std::uint32_t sslFlags);
+int APS5_VABI sceHttpParseStatusLine(const char* statusLine, size_t lineLen, int32_t* httpMajorVer, int32_t* httpMinorVer, int32_t* responseCode, const char** reasonPhrase, size_t* phraseLen);
+int APS5_VABI sceHttpUriBuild(char* out, size_t* requiredSize, size_t capacity, const SceHttpUriElement* element, uint32_t option);
+int APS5_VABI sceHttpUriEscape(char* out, size_t* require, size_t prepare, const char* in);
+int APS5_VABI sceHttpUriUnescape(char* out, size_t* requiredSize, size_t capacity, const char* input);
+int APS5_VABI sceHttpUriMerge(char* mergedUrl, const char* url, const char* relativeUri, size_t* require, size_t prepare, uint32_t option);
+int APS5_VABI sceHttpUriParse(SceHttpUriElement* out, const char* srcUrl, void* pool, size_t* require, size_t prepare);
+int APS5_VABI sceHttpUriCopy(SceHttpUriElement* out, const SceHttpUriElement* src, void* pool, size_t prepare, size_t* require);
+int APS5_VABI sceHttpUriSweepPath(char* dst, const char* src, size_t srcSize);
+
+}
diff --git a/core/libs/prx/libSceHttp/libSceHttp.hpp b/core/libs/prx/libSceHttp/libSceHttp.hpp
new file mode 100644
index 0000000000..69e0774038
--- /dev/null
+++ b/core/libs/prx/libSceHttp/libSceHttp.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHttp/include/Http.hpp"
diff --git a/core/libs/prx/libSceHttp/src/Options.cpp b/core/libs/prx/libSceHttp/src/Options.cpp
index 710b33311a..415c462ee4 100644
--- a/core/libs/prx/libSceHttp/src/Options.cpp
+++ b/core/libs/prx/libSceHttp/src/Options.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "prx/libSceHttp/src/Options.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceHttp/src/HttpErrors.hpp"
diff --git a/core/libs/prx/libSceHttp/src/Options.hpp b/core/libs/prx/libSceHttp/src/Options.hpp
index beca67b395..6c2205ecc9 100644
--- a/core/libs/prx/libSceHttp/src/Options.hpp
+++ b/core/libs/prx/libSceHttp/src/Options.hpp
@@ -6,6 +6,8 @@
 
 struct HttpOptions {
     bool autoRedirect = true;
+    bool authEnabled = false;
+    bool cookieEnabled = false;
     bool nonblock = false;
     bool acceptEncodingGzip = false;
     HttpEpollHandle epoll = nullptr;
diff --git a/core/libs/prx/libSceHttp/src/Parse.cpp b/core/libs/prx/libSceHttp/src/Parse.cpp
index 0732f62407..1662a05f43 100644
--- a/core/libs/prx/libSceHttp/src/Parse.cpp
+++ b/core/libs/prx/libSceHttp/src/Parse.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -11,10 +12,10 @@ bool isAsciiDigit(char c) {
     return c >= '0' && c <= '9';
 }
 
-bool parseVersionNumber(const char* line, size_t lineLen, size_t& index, int32_t* value) {
-    if (index >= lineLen || !isAsciiDigit(line[index])) return false;
+bool parseVersionNumber(const char* line, size_t& index, int32_t* value) {
+    if (!isAsciiDigit(line[index])) return false;
     uint32_t number = 0;
-    while (index < lineLen && isAsciiDigit(line[index])) {
+    while (isAsciiDigit(line[index])) {
         number = number * 10 + static_cast<uint32_t>(line[index] - '0');
         ++index;
     }
@@ -36,11 +37,11 @@ int APS5_VABI sceHttpParseStatusLine(const char* statusLine, size_t lineLen, int
     if (lineLen < 8 || std::memcmp(statusLine, "HTTP/", 5) != 0) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
 
     size_t index = 5;
-    if (!parseVersionNumber(statusLine, lineLen, index, httpMajorVer)) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
-    if (index >= lineLen || statusLine[index] != '.') return ERROR_PARSE_HTTP_INVALID_RESPONSE;
+    if (!parseVersionNumber(statusLine, index, httpMajorVer)) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
+    if (statusLine[index] != '.') return ERROR_PARSE_HTTP_INVALID_RESPONSE;
     ++index;
-    if (!parseVersionNumber(statusLine, lineLen, index, httpMinorVer)) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
-    if (index >= lineLen || statusLine[index] != ' ') return ERROR_PARSE_HTTP_INVALID_RESPONSE;
+    if (!parseVersionNumber(statusLine, index, httpMinorVer)) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
+    if (statusLine[index] != ' ') return ERROR_PARSE_HTTP_INVALID_RESPONSE;
     ++index;
 
     if (lineLen - index < 3) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
@@ -51,10 +52,11 @@ int APS5_VABI sceHttpParseStatusLine(const char* statusLine, size_t lineLen, int
     index += 3;
 
     const char* phrase = statusLine + index;
-    const void* lineFeed = std::memchr(phrase, '\n', lineLen - index);
-    if (!lineFeed) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
+    const size_t searched = lineLen - index + 1;
+    size_t length = 0;
+    while (length != searched && phrase[length] != '\n') ++length;
+    if (length == searched) return ERROR_PARSE_HTTP_INVALID_RESPONSE;
 
-    size_t length = static_cast<size_t>(static_cast<const char*>(lineFeed) - phrase);
     const size_t consumed = index + length + 1;
     if (consumed > static_cast<size_t>(INT32_MAX)) {
         throw std::out_of_range("sceHttpParseStatusLine: consumed byte count exceeds int");
diff --git a/core/libs/prx/libSceHttp/src/Uri.cpp b/core/libs/prx/libSceHttp/src/Uri.cpp
index b1cc8db443..f2c4f83d2d 100644
--- a/core/libs/prx/libSceHttp/src/Uri.cpp
+++ b/core/libs/prx/libSceHttp/src/Uri.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include <algorithm>
 #include <charconv>
 #include <cstdint>
@@ -29,6 +30,7 @@ struct UriParts {
     std::string_view password;
     std::string_view hostname;
     std::string path;
+    size_t pathSpace = 0;
     std::string_view query;
     std::string_view fragment;
     uint16_t port = 0;
@@ -55,8 +57,8 @@ bool equalsIgnoreCase(std::string_view left, std::string_view right) {
 }
 
 uint16_t defaultPort(std::string_view scheme) {
-    if (equalsIgnoreCase(scheme, "http")) return 80;
-    if (equalsIgnoreCase(scheme, "https")) return 443;
+    if (scheme.size() >= 5 && equalsIgnoreCase(scheme.substr(0, 5), "https")) return 443;
+    if (scheme.size() >= 4 && equalsIgnoreCase(scheme.substr(0, 4), "http")) return 80;
     return 0;
 }
 
@@ -64,31 +66,21 @@ bool isHostCharacter(char c) {
     return isAsciiAlpha(c) || isAsciiDigit(c) || c == '-' || c == '.' || c == '_';
 }
 
-std::string removeDotSegments(std::string_view input) {
-    std::string output;
-    while (!input.empty()) {
-        if (input.starts_with("../")) input.remove_prefix(3);
-        else if (input.starts_with("./")) input.remove_prefix(2);
-        else if (input.starts_with("/./")) input.remove_prefix(2);
-        else if (input == "/.") input = "/";
-        else if (input.starts_with("/../") || input == "/..") {
-            input = input.size() == 3 ? std::string_view("/") : input.substr(3);
-            const size_t slash = output.rfind('/');
-            output.erase(slash == std::string::npos ? 0 : slash);
-        } else if (input == "." || input == "..") input = {};
-        else {
-            const size_t end = input.find('/', 1);
-            const size_t length = end == std::string_view::npos ? input.size() : end;
-            output.append(input.substr(0, length));
-            input.remove_prefix(length);
-        }
-    }
-    return output;
+bool isUserinfoCharacter(char c) {
+    return isAsciiAlpha(c) || isAsciiDigit(c) || std::string_view("-._~!$&'()*+,;=%:").find(c) != std::string_view::npos;
+}
+
+std::string sweptPath(std::string_view path) {
+    const std::string source(path);
+    std::string swept(source.size() + 1, '\0');
+    sceHttpUriSweepPath(swept.data(), source.c_str(), source.size() + 1);
+    swept.resize(std::strlen(swept.c_str()));
+    return swept;
 }
 
 size_t schemeLength(std::string_view uri) {
     size_t schemeEnd = 0;
-    if (!uri.empty() && isAsciiAlpha(uri[0])) {
+    if (!uri.empty() && (isAsciiAlpha(uri[0]) || uri[0] == '+' || uri[0] == '-' || uri[0] == '.')) {
         schemeEnd = 1;
         while (schemeEnd < uri.size() && (isAsciiAlpha(uri[schemeEnd]) || isAsciiDigit(uri[schemeEnd]) || uri[schemeEnd] == '+'
             || uri[schemeEnd] == '-' || uri[schemeEnd] == '.')) ++schemeEnd;
@@ -110,49 +102,51 @@ int parseUri(std::string_view uri, UriParts& parts) {
     parts.opaque = !uri.starts_with("//");
     if (!parts.opaque) uri.remove_prefix(2);
 
-    std::string_view authority = uri.substr(0, uri.find_first_of("/?#"));
-    uri.remove_prefix(authority.size());
-
-    const size_t at = authority.rfind('@');
-    if (at != std::string_view::npos) {
-        const std::string_view userinfo = authority.substr(0, at);
+    size_t userinfoEnd = 0;
+    while (userinfoEnd < uri.size() && isUserinfoCharacter(uri[userinfoEnd])) ++userinfoEnd;
+    if (userinfoEnd < uri.size() && uri[userinfoEnd] == '@') {
+        const std::string_view userinfo = uri.substr(0, userinfoEnd);
         const size_t colon = userinfo.find(':');
         parts.username = userinfo.substr(0, colon);
         if (colon != std::string_view::npos) parts.password = userinfo.substr(colon + 1);
-        authority.remove_prefix(at + 1);
+        uri.remove_prefix(userinfoEnd + 1);
     }
 
-    std::string_view port;
-    if (authority.starts_with('[')) {
-        const size_t close = authority.find(']');
+    if (uri.starts_with('[')) {
+        const size_t close = uri.find(']');
         if (close == std::string_view::npos) return ERROR_INVALID_URL;
-        parts.hostname = authority.substr(1, close - 1);
-        authority.remove_prefix(close + 1);
-        if (!authority.empty() && authority[0] != ':') return ERROR_INVALID_URL;
-        if (!authority.empty()) port = authority.substr(1);
+        parts.hostname = uri.substr(1, close - 1);
         for (const char c : parts.hostname) {
             if (!isHostCharacter(c) && c != ':') return ERROR_INVALID_URL;
         }
+        uri.remove_prefix(close + 1);
     } else {
-        const size_t colon = authority.find(':');
-        parts.hostname = authority.substr(0, colon);
-        if (colon != std::string_view::npos) port = authority.substr(colon + 1);
-        for (const char c : parts.hostname) {
-            if (!isHostCharacter(c)) return ERROR_INVALID_URL;
+        size_t hostEnd = 0;
+        if (!uri.starts_with('.')) {
+            while (hostEnd < uri.size() && isHostCharacter(uri[hostEnd])) ++hostEnd;
         }
+        parts.hostname = uri.substr(0, hostEnd);
+        uri.remove_prefix(hostEnd);
     }
 
-    if (port.size() > 5) return ERROR_INVALID_URL;
-    uint32_t portValue = 0;
-    for (const char c : port) {
-        if (!isAsciiDigit(c)) return ERROR_INVALID_URL;
-        portValue = portValue * 10 + static_cast<uint32_t>(c - '0');
+    parts.port = defaultPort(parts.scheme);
+    if (uri.starts_with(':')) {
+        uri.remove_prefix(1);
+        const std::string_view port = uri.substr(0, uri.find('/'));
+        uri.remove_prefix(port.size());
+        if (port.size() > 5) return ERROR_INVALID_URL;
+        uint32_t portValue = 0;
+        for (const char c : port) {
+            if (!isAsciiDigit(c)) return ERROR_INVALID_URL;
+            portValue = portValue * 10 + static_cast<uint32_t>(c - '0');
+        }
+        if (portValue > 0x10000) return ERROR_INVALID_URL;
+        if (!port.empty()) parts.port = static_cast<uint16_t>(portValue);
     }
-    if (portValue > 0xFFFF) return ERROR_INVALID_URL;
-    parts.port = port.empty() ? defaultPort(parts.scheme) : static_cast<uint16_t>(portValue);
 
     const std::string_view path = uri.substr(0, uri.find_first_of("?#"));
-    parts.path = removeDotSegments(path);
+    parts.path = sweptPath(path);
+    parts.pathSpace = path.size();
     uri.remove_prefix(path.size());
 
     if (uri.starts_with('?')) {
@@ -164,8 +158,8 @@ int parseUri(std::string_view uri, UriParts& parts) {
 }
 
 size_t poolSize(const UriParts& parts) {
-    const std::string_view fields[] = {parts.scheme, parts.username, parts.password, parts.hostname, parts.path, parts.query, parts.fragment};
-    size_t size = 0;
+    const std::string_view fields[] = {parts.scheme, parts.username, parts.password, parts.hostname, parts.query, parts.fragment};
+    size_t size = parts.pathSpace + 1;
     for (const std::string_view field : fields) size += field.size() + 1;
     return size;
 }
@@ -345,10 +339,12 @@ int APS5_VABI sceHttpUriParse(SceHttpUriElement* out, const char* src_url, void*
     if (const int result = parseUri(src_url, parts); result != 0) return result;
 
     const std::string_view fields[] = {parts.scheme, parts.username, parts.password, parts.hostname, parts.path, parts.query, parts.fragment};
+    const size_t spaces[] = {parts.scheme.size(), parts.username.size(), parts.password.size(), parts.hostname.size(), parts.pathSpace, parts.query.size(),
+        parts.fragment.size()};
     const size_t size = poolSize(parts);
+    if (write && prepare < size) return ERROR_OUT_OF_MEMORY;
     if (require) *require = size;
     if (!write) return 0;
-    if (prepare < size) return ERROR_OUT_OF_MEMORY;
 
     char* next = static_cast<char*>(pool);
     char* strings[7];
@@ -356,7 +352,7 @@ int APS5_VABI sceHttpUriParse(SceHttpUriElement* out, const char* src_url, void*
         strings[i] = next;
         if (!fields[i].empty()) std::memcpy(next, fields[i].data(), fields[i].size());
         next[fields[i].size()] = '\0';
-        next += fields[i].size() + 1;
+        next += spaces[i] + 1;
     }
     *out = {};
     out->opaque = parts.opaque;
@@ -376,31 +372,38 @@ int APS5_VABI sceHttpUriCopy(SceHttpUriElement* out, const SceHttpUriElement* sr
     const bool write = out && pool;
     if (!write && !require) return ERROR_INVALID_VALUE;
 
+    if (write) {
+        std::memset(out, 0, sizeof(*out));
+        std::memset(pool, 0, prepare);
+    }
     const char* const fields[] = {src->scheme, src->hostname, src->path, src->username, src->password};
-    SceHttpUriElement copy{};
-    char** const slots[] = {&copy.scheme, &copy.hostname, &copy.path, &copy.username, &copy.password};
-    if (write) std::memset(pool, 0, prepare);
+    const uint16_t port = src->port;
+    size_t lengths[5];
     size_t used = 0;
     for (size_t i = 0; i < 5; ++i) {
-        const size_t length = fields[i] ? std::strlen(fields[i]) : 0;
-        const size_t needed = length + 1;
-        if (write) {
-            if (needed > prepare - used) {
-                *out = {};
-                std::memset(pool, 0, prepare);
-                return ERROR_OUT_OF_MEMORY;
-            }
-            char* next = static_cast<char*>(pool) + used;
-            if (length != 0) std::memcpy(next, fields[i], length);
-            next[length] = '\0';
-            *slots[i] = next;
-        }
-        used += needed;
+        lengths[i] = fields[i] ? std::strlen(fields[i]) : 0;
+        used += lengths[i] + 1;
     }
-    if (write) {
-        copy.port = src->port;
-        *out = copy;
+    if (!write) {
+        *require = used;
+        return 0;
     }
+    if (used > prepare) return ERROR_OUT_OF_MEMORY;
+
+    char* next = static_cast<char*>(pool);
+    char* strings[5];
+    for (size_t i = 0; i < 5; ++i) {
+        strings[i] = next;
+        if (lengths[i] != 0) std::memcpy(next, fields[i], lengths[i]);
+        next[lengths[i]] = '\0';
+        next += lengths[i] + 1;
+    }
+    out->scheme = strings[0];
+    out->hostname = strings[1];
+    out->path = strings[2];
+    out->username = strings[3];
+    out->password = strings[4];
+    out->port = port;
     if (require) *require = used;
     return 0;
 }
diff --git a/core/libs/prx/libSceHttp2/Export.cpp b/core/libs/prx/libSceHttp2/Export.cpp
index d97f8d6c6d..7cb14fc27a 100644
--- a/core/libs/prx/libSceHttp2/Export.cpp
+++ b/core/libs/prx/libSceHttp2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp2/include/Http2.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -62,13 +63,6 @@ static bool HandleIsLive(int id) {
     return FindAnyHandle(id) != nullptr;
 }
 
-struct Http2MemoryPoolStats {
-    size_t pool_size;
-    size_t max_inuse_size;
-    size_t current_inuse_size;
-    int32_t reserved;
-};
-
 static std::mutex g_completionsMutex;
 static std::unordered_map<int, std::deque<Http2AsyncResult>> g_completions;
 
@@ -104,11 +98,6 @@ static int CompleteAsync(const char* function, int req_id, const Http2AsyncOptio
     return 0;
 }
 
-using Http2WebSocketTextCallback = void (APS5_VABI*)(std::int32_t requestId, const char* text, std::uint32_t flags, void* userData);
-using Http2WebSocketDataCallback = void (APS5_VABI*)(std::int32_t requestId, const void* data, std::size_t dataSize, std::uint32_t flags, void* userData);
-using Http2WebSocketCloseCallback = void (APS5_VABI*)(std::int32_t requestId, const std::uint16_t* status, const char* reason, std::uint32_t flags, void* userData);
-using Http2WebSocketErrorCallback = void (APS5_VABI*)(std::int32_t requestId, std::int32_t error, void* userData);
-
 extern "C" {
 
 int APS5_VABI sceHttp2AddRequestHeader(int id, const char* name, const char* value, uint32_t mode) {
@@ -385,7 +374,6 @@ int APS5_VABI sceHttp2SetRequestNoContentLength(int id) {
     return 0;
 }
 
-
 int APS5_VABI sceHttp2SetResolveRetry(int id, int32_t retry) {
     (void)id;
     (void)retry;
diff --git a/core/libs/prx/libSceHttp2/include/Http2.hpp b/core/libs/prx/libSceHttp2/include/Http2.hpp
new file mode 100644
index 0000000000..bf7b34e6a7
--- /dev/null
+++ b/core/libs/prx/libSceHttp2/include/Http2.hpp
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct Http2MemoryPoolStats {
+    size_t pool_size;
+    size_t max_inuse_size;
+    size_t current_inuse_size;
+    int32_t reserved;
+};
+
+using Http2WebSocketTextCallback = void (APS5_VABI*)(std::int32_t requestId, const char* text, std::uint32_t flags, void* userData);
+
+using Http2WebSocketDataCallback = void (APS5_VABI*)(std::int32_t requestId, const void* data, std::size_t dataSize, std::uint32_t flags, void* userData);
+
+using Http2WebSocketCloseCallback = void (APS5_VABI*)(std::int32_t requestId, const std::uint16_t* status, const char* reason, std::uint32_t flags, void* userData);
+
+using Http2WebSocketErrorCallback = void (APS5_VABI*)(std::int32_t requestId, std::int32_t error, void* userData);
+
+extern "C" {
+
+int APS5_VABI sceHttp2AddRequestHeader(int id, const char* name, const char* value, uint32_t mode);
+int APS5_VABI sceHttp2CreateRequestWithURL(int tmplId, const char* method, const char* url, uint64_t contentLength);
+int APS5_VABI sceHttp2CreateTemplate(int libHttp2CtxId, const char* userAgent, int httpVer, int isAutoProxyConf);
+int APS5_VABI sceHttp2DeleteRequest(int reqId);
+int APS5_VABI sceHttp2DeleteTemplate(int tmplId);
+int APS5_VABI sceHttp2GetAllResponseHeaders(int reqId, char** header, size_t* headerSize);
+int APS5_VABI sceHttp2GetResponseContentLength(int reqId, int* result, uint64_t* contentLength);
+int APS5_VABI sceHttp2GetStatusCode(int reqId, int* statusCode);
+int APS5_VABI sceHttp2Init(int libnetMemId, int libsslCtxId, size_t poolSize, int maxConcurrentRequest);
+int APS5_VABI sceHttp2ReadData(int reqId, void* data, size_t size);
+int APS5_VABI sceHttp2ReadDataAsync(int reqId, void* data, size_t size, void* kqueueOption, void* option);
+int APS5_VABI sceHttp2SendRequest(int reqId, const void* postData, size_t size);
+int APS5_VABI sceHttp2SendRequestAsync(int reqId, const void* postData, size_t size, Http2AsyncOption* kqueueOption, void* option);
+int APS5_VABI sceHttp2SetAuthEnabled(int id, int isEnable);
+int APS5_VABI sceHttp2SetAutoRedirect(int id, int enable);
+int APS5_VABI sceHttp2SetConnectionWaitTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetConnectTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetInflateGZIPEnabled(int id, int enable);
+int APS5_VABI sceHttp2SetRecvTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetRedirectCallback(int id, void* cbFunc, void* userArg);
+int APS5_VABI sceHttp2SetRequestContentLength(int id, uint64_t contentLength);
+int APS5_VABI sceHttp2SetResolveTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetSendTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SetSslCallback(int id, void* cbFunc, void* userArg);
+int APS5_VABI sceHttp2SetTimeOut(int id, uint32_t usec);
+int APS5_VABI sceHttp2SslDisableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttp2SslEnableOption(int id, uint32_t sslFlags);
+int APS5_VABI sceHttp2SetMinSslVersion(int id, uint32_t sslVersion);
+int APS5_VABI sceHttp2Term(int libHttp2CtxId);
+int APS5_VABI sceHttp2WaitAsync(int reqId, Http2AsyncResult* result, uint32_t* timeout, void* option);
+int APS5_VABI sceHttp2AbortRequest(int reqId);
+int APS5_VABI sceHttp2GetMemoryPoolStats(int libHttp2CtxId, Http2MemoryPoolStats* stats);
+int APS5_VABI sceHttp2CookieFlush(int id);
+int APS5_VABI sceHttp2CreateCookieBox(std::size_t poolSize);
+int APS5_VABI sceHttp2DeleteCookieBox(int cookieBoxId);
+int APS5_VABI sceHttp2SetCookieBox(int id, int cookieBoxId);
+int APS5_VABI sceHttp2SetRequestNoContentLength(int id);
+int APS5_VABI sceHttp2SetResolveRetry(int id, int32_t retry);
+int APS5_VABI sceHttp2WebSocketCreateRequest(std::int32_t templateId, const char* url, Http2WebSocketTextCallback textCallback, Http2WebSocketDataCallback dataCallback, Http2WebSocketCloseCallback closeCallback, Http2WebSocketErrorCallback errorCallback, void* receiveBuffer, std::size_t receiveBufferSize, void* userData, const void* option);
+int APS5_VABI sceHttp2WebSocketCloseAsync(std::int32_t requestId, const std::uint16_t* status, const char* reason, std::uint8_t flags, const Http2AsyncOption* asyncOption, const void* option);
+int APS5_VABI sceHttp2WebSocketSendTextMessageAsync(std::int32_t requestId, const char* text, std::uint8_t flags, const Http2AsyncOption* asyncOption, const void* option);
+int APS5_VABI sceHttp2WebSocketSendDataMessageAsync(std::int32_t requestId, const void* data, std::size_t dataSize, std::uint8_t flags, const Http2AsyncOption* asyncOption, const void* option);
+int APS5_VABI sceHttp2WebSocketSetPingInterval(std::int32_t requestId, std::uint32_t intervalMicroseconds);
+int APS5_VABI sceHttp2WebSocketSetPingTimeout(std::int32_t requestId, std::uint32_t timeoutMicroseconds);
+int APS5_VABI sceHttp2AddCookie(void);
+int APS5_VABI sceHttp2AuthCacheFlush(void);
+int APS5_VABI sceHttp2CookieExport(void);
+int APS5_VABI sceHttp2CookieImport(void);
+int APS5_VABI sceHttp2GetAuthEnabled(void);
+int APS5_VABI sceHttp2GetAutoRedirect(void);
+int APS5_VABI sceHttp2GetCookie(void);
+int APS5_VABI sceHttp2GetCookieBox(void);
+int APS5_VABI sceHttp2GetCookieStats(void);
+int APS5_VABI sceHttp2RedirectCacheFlush(void);
+int APS5_VABI sceHttp2RemoveRequestHeader(void);
+int APS5_VABI sceHttp2SetAuthInfoCallback(void);
+int APS5_VABI sceHttp2SetCookieMaxNum(void);
+int APS5_VABI sceHttp2SetCookieMaxNumPerDomain(void);
+int APS5_VABI sceHttp2SetCookieMaxSize(void);
+int APS5_VABI sceHttp2SetCookieRecvCallback(void);
+int APS5_VABI sceHttp2SetCookieSendCallback(void);
+int APS5_VABI sceHttp2SetPreSendCallback(void);
+
+}
diff --git a/core/libs/prx/libSceHttp2/libSceHttp2.hpp b/core/libs/prx/libSceHttp2/libSceHttp2.hpp
new file mode 100644
index 0000000000..d6ec538a09
--- /dev/null
+++ b/core/libs/prx/libSceHttp2/libSceHttp2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHttp2/include/Http2.hpp"
diff --git a/core/libs/prx/libSceHttpCache/Export.cpp b/core/libs/prx/libSceHttpCache/Export.cpp
index 12a2497b87..d3bdbf753f 100644
--- a/core/libs/prx/libSceHttpCache/Export.cpp
+++ b/core/libs/prx/libSceHttpCache/Export.cpp
@@ -1,46 +1,9 @@
+#include "prx/libSceHttpCache/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct HttpCacheHeader {
-    const char* name;
-    const char* value;
-};
-
-struct HttpCacheRequest {
-    std::uint32_t method;
-    std::uint32_t reserved;
-    const char* url;
-    std::size_t headerCount;
-    const HttpCacheHeader* headers;
-};
-
-struct HttpCacheResponseHeader {
-    std::uint32_t statusCode;
-    std::uint32_t reserved;
-    std::size_t headerCount;
-    const HttpCacheHeader* headers;
-};
-
-struct HttpCacheResponse {
-    std::uint32_t statusCode;
-    std::uint32_t reserved;
-    std::size_t headerCount;
-    const HttpCacheHeader* headers;
-    std::uint64_t contentLength;
-};
-
-struct HttpCacheQuotaEntry {
-    const char* name;
-    std::uint64_t size;
-};
-
-struct HttpCacheQuota {
-    std::size_t count;
-    const HttpCacheQuotaEntry* entries;
-};
-
 static_assert(sizeof(HttpCacheHeader) == 16);
 static_assert(sizeof(HttpCacheRequest) == 32);
 static_assert(offsetof(HttpCacheRequest, url) == 8);
@@ -162,7 +125,6 @@ int APS5_VABI sceHttpCacheTerm(std::int32_t cacheId) {
     return 0;
 }
 
-
 int APS5_VABI sceHttpCacheClearAllUserTags() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceHttpCache/include/Api.hpp b/core/libs/prx/libSceHttpCache/include/Api.hpp
new file mode 100644
index 0000000000..634bf42348
--- /dev/null
+++ b/core/libs/prx/libSceHttpCache/include/Api.hpp
@@ -0,0 +1,75 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+
+struct HttpCacheHeader {
+    const char* name;
+    const char* value;
+};
+
+struct HttpCacheRequest {
+    std::uint32_t method;
+    std::uint32_t reserved;
+    const char* url;
+    std::size_t headerCount;
+    const HttpCacheHeader* headers;
+};
+
+struct HttpCacheResponseHeader {
+    std::uint32_t statusCode;
+    std::uint32_t reserved;
+    std::size_t headerCount;
+    const HttpCacheHeader* headers;
+};
+
+struct HttpCacheResponse {
+    std::uint32_t statusCode;
+    std::uint32_t reserved;
+    std::size_t headerCount;
+    const HttpCacheHeader* headers;
+    std::uint64_t contentLength;
+};
+
+struct HttpCacheQuotaEntry {
+    const char* name;
+    std::uint64_t size;
+};
+
+struct HttpCacheQuota {
+    std::size_t count;
+    const HttpCacheQuotaEntry* entries;
+};
+
+extern "C" {
+
+int APS5_VABI sceHttpCacheClear(std::int32_t cacheId, std::int32_t userId, const char* tag);
+int APS5_VABI sceHttpCacheClearAll(std::int32_t cacheId, std::int32_t userId);
+int APS5_VABI sceHttpCacheCompleteRequest(std::int32_t requestId);
+int APS5_VABI sceHttpCacheCreateRequest(std::int32_t cacheId, std::int32_t userId);
+int APS5_VABI sceHttpCacheCreateRequestWithTag(std::int32_t cacheId, std::int32_t userId, const char* tag);
+int APS5_VABI sceHttpCacheDeleteRequest(std::int32_t requestId);
+int APS5_VABI sceHttpCacheInit(std::size_t poolSize);
+int APS5_VABI sceHttpCacheReadData(std::int32_t requestId, std::size_t size, void* data);
+int APS5_VABI sceHttpCacheRetrieve(std::int32_t requestId, const HttpCacheRequest* request, HttpCacheResponse* response, HttpCacheRequest* nextRequest, std::int32_t* result);
+int APS5_VABI sceHttpCacheRetrieveWithMemoryPool(std::int32_t requestId, const HttpCacheRequest* request, HttpCacheResponse* response, HttpCacheRequest* nextRequest, std::int32_t* result, void* pool, std::size_t* requiredSize, std::size_t poolSize);
+int APS5_VABI sceHttpCacheRevalidate(std::int32_t requestId, const HttpCacheResponseHeader* header, HttpCacheResponse* response, std::int32_t* result);
+int APS5_VABI sceHttpCacheRevalidateWithMemoryPool(std::int32_t requestId, const HttpCacheResponseHeader* header, HttpCacheResponse* response, std::int32_t* result, void* pool, std::size_t* requiredSize, std::size_t poolSize);
+int APS5_VABI sceHttpCacheSetCacheSharing(std::uint8_t enabled);
+int APS5_VABI sceHttpCacheSetData(std::int32_t requestId, const void* data, std::size_t size);
+int APS5_VABI sceHttpCacheSetQuota(std::int32_t cacheId, const HttpCacheQuota* quota);
+int APS5_VABI sceHttpCacheSetResponseHeader(std::int32_t requestId, const HttpCacheResponseHeader* header);
+int APS5_VABI sceHttpCacheSystemClearAll(const char* path);
+int APS5_VABI sceHttpCacheSystemInit(const char* path);
+int APS5_VABI sceHttpCacheSystemSendStatistics();
+int APS5_VABI sceHttpCacheSystemShutdown();
+int APS5_VABI sceHttpCacheSystemTerm();
+int APS5_VABI sceHttpCacheTerm(std::int32_t cacheId);
+int APS5_VABI sceHttpCacheClearAllUserTags();
+int APS5_VABI sceHttpCacheClearCacheInfo();
+int APS5_VABI sceHttpCacheDebugSetUrl();
+int APS5_VABI sceHttpCacheRegisterCacheInfoUrl();
+int APS5_VABI sceHttpCacheRemoveTag();
+
+}
diff --git a/core/libs/prx/libSceHttpCache/libSceHttpCache.hpp b/core/libs/prx/libSceHttpCache/libSceHttpCache.hpp
new file mode 100644
index 0000000000..1a210e0748
--- /dev/null
+++ b/core/libs/prx/libSceHttpCache/libSceHttpCache.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHttpCache/include/Api.hpp"
diff --git a/core/libs/prx/libSceHubAppUtil/Export.cpp b/core/libs/prx/libSceHubAppUtil/Export.cpp
index b4a5ae963d..2ed0d86fca 100644
--- a/core/libs/prx/libSceHubAppUtil/Export.cpp
+++ b/core/libs/prx/libSceHubAppUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHubAppUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceHubAppUtil/include/Api.hpp b/core/libs/prx/libSceHubAppUtil/include/Api.hpp
new file mode 100644
index 0000000000..721784ffcb
--- /dev/null
+++ b/core/libs/prx/libSceHubAppUtil/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceHubAppUtilDeeplinkToLiveDetailView();
+int APS5_VABI sceHubAppUtilDeeplinkToPSSubscriptions();
+int APS5_VABI sceHubAppUtilGetInstallationStatus();
+
+}
diff --git a/core/libs/prx/libSceHubAppUtil/libSceHubAppUtil.hpp b/core/libs/prx/libSceHubAppUtil/libSceHubAppUtil.hpp
new file mode 100644
index 0000000000..6636d9db00
--- /dev/null
+++ b/core/libs/prx/libSceHubAppUtil/libSceHubAppUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceHubAppUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceIcu/libSceIcu.hpp b/core/libs/prx/libSceIcu/libSceIcu.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceIcu/libSceIcu.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceIdu/Export.cpp b/core/libs/prx/libSceIdu/Export.cpp
index def1b88f9a..753cc6aa8b 100644
--- a/core/libs/prx/libSceIdu/Export.cpp
+++ b/core/libs/prx/libSceIdu/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIdu/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceIdu/include/Api.hpp b/core/libs/prx/libSceIdu/include/Api.hpp
new file mode 100644
index 0000000000..4e9d5daaaa
--- /dev/null
+++ b/core/libs/prx/libSceIdu/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceIduGetEnv();
+int APS5_VABI sceIduInit();
+int APS5_VABI sceIduInstallPkg();
+int APS5_VABI sceIduIsAppInstalled();
+int APS5_VABI sceIduIsRifInstalled();
+int APS5_VABI sceIduIsStaffMode();
+int APS5_VABI sceIduReboot();
+int APS5_VABI sceIduTerm();
+
+}
diff --git a/core/libs/prx/libSceIdu/libSceIdu.hpp b/core/libs/prx/libSceIdu/libSceIdu.hpp
new file mode 100644
index 0000000000..b899940205
--- /dev/null
+++ b/core/libs/prx/libSceIdu/libSceIdu.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceIdu/include/Api.hpp"
diff --git a/core/libs/prx/libSceImageUtil/libSceImageUtil.hpp b/core/libs/prx/libSceImageUtil/libSceImageUtil.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceImageUtil/libSceImageUtil.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceIme/Export.cpp b/core/libs/prx/libSceIme/Export.cpp
index 9485063034..a6c3a3d181 100644
--- a/core/libs/prx/libSceIme/Export.cpp
+++ b/core/libs/prx/libSceIme/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include <atomic>
 #include <algorithm>
 #include <cstdint>
@@ -15,25 +16,6 @@
 #include "prx/libSceIme/include/ImeFilterText.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
 
-struct ImeVshContext;
-struct ImeVshParameter;
-struct ImePreeditMetaInfo;
-struct ImeDictionaryWord;
-
-struct ImeVshCaretGeometry {
-    std::int32_t x;
-    std::int32_t y;
-    std::uint32_t height;
-    std::uint32_t index;
-};
-
-struct ImeVshTextGeometry {
-    std::int32_t x;
-    std::int32_t y;
-    std::uint32_t width;
-    std::uint32_t height;
-};
-
 static_assert(sizeof(ImeEditText) == 64);
 static_assert(offsetof(ImeEvent, param) == 8);
 static_assert(sizeof(ImeVshCaretGeometry) == 16);
diff --git a/core/libs/prx/libSceIme/include/Api.hpp b/core/libs/prx/libSceIme/include/Api.hpp
new file mode 100644
index 0000000000..50ed144cfc
--- /dev/null
+++ b/core/libs/prx/libSceIme/include/Api.hpp
@@ -0,0 +1,93 @@
+#pragma once
+
+#include "prx/libSceIme/include/ImeFilterText.hpp"
+#include "SceTypes.hpp"
+
+struct ImeDictionaryWord;
+
+struct ImeVshContext;
+
+struct ImePreeditMetaInfo;
+
+struct ImeVshCaretGeometry {
+    std::int32_t x;
+    std::int32_t y;
+    std::uint32_t height;
+    std::uint32_t index;
+};
+
+struct ImeVshParameter;
+
+struct ImeVshTextGeometry {
+    std::int32_t x;
+    std::int32_t y;
+    std::uint32_t width;
+    std::uint32_t height;
+};
+
+extern "C" {
+
+int APS5_VABI sceImeOpen_nid_postfix(const Param* param, const ExtendedParam* extended);
+int APS5_VABI sceImeClose_nid_postfix(void);
+int APS5_VABI sceImeGetPanelPositionAndForm(PositionAndForm* form);
+int APS5_VABI sceImeGetPanelSize(const Param* param, uint32_t* width, uint32_t* height);
+int APS5_VABI sceImeKeyboardClose(int32_t userId);
+int APS5_VABI sceImeKeyboardGetInfo(uint32_t resourceId, KeyboardInfo* info);
+int APS5_VABI sceImeKeyboardGetResourceId(int32_t userId, KeyboardResourceIdArray* resourceIds);
+int APS5_VABI sceImeKeyboardOpen(int32_t userId, const KeyboardParam* param);
+int APS5_VABI sceImeKeyboardSetMode(int32_t userId, uint32_t mode);
+int APS5_VABI sceImeFilterText(char16_t* dst, int32_t* outLength, uint32_t capacity, const ime_filter::FilterParam* param, const char16_t* src, uint32_t srcLength);
+int APS5_VABI sceImeCheckFilterText(const void* param);
+void APS5_VABI sceImeParamInit(Param* param);
+int APS5_VABI sceImeSetCaret(const Caret* caret);
+int APS5_VABI sceImeSetConsecutiveClauseConversionEnabled(std::uint8_t enabled);
+int APS5_VABI sceImeSetText(const char16_t* text, uint32_t length);
+int APS5_VABI sceImeSetTextGeometry(TextAreaMode mode, const TextGeometry* geometry);
+int APS5_VABI sceImeUpdate(EventHandler handler);
+int APS5_VABI sceImeVshOpen(ImeVshContext** context, const ImeVshParameter* parameter, const char16_t* text);
+int APS5_VABI sceImeKeyboardUpdate(EventHandler handler);
+int APS5_VABI sceImeVshUpdate(ImeVshContext* context);
+int APS5_VABI sceImeVshUpdateContext(ImeVshContext* context, const char16_t* text, std::uint32_t caretIndex);
+int APS5_VABI sceImeVshClearPreedit(ImeVshContext* context);
+int APS5_VABI sceImeVshNotifySetText(ImeVshContext* context, const char16_t* text, std::uint32_t length);
+int APS5_VABI sceImeVshSetCaretGeometry(ImeVshContext* context, const ImeVshCaretGeometry* geometry);
+int APS5_VABI sceImeVshConfirmPreedit(ImeVshContext* context);
+int APS5_VABI sceImeVshSetCaretIndexInPreedit(ImeVshContext* context, std::int32_t index);
+int APS5_VABI sceImeVshSetPreeditGeometry(ImeVshContext* context, const ImeVshTextGeometry* geometry);
+int APS5_VABI sceImeVshSetSelectGeometry(ImeVshContext* context, const ImeVshTextGeometry* geometry);
+int APS5_VABI sceImeVshClose(ImeVshContext* context);
+int APS5_VABI sceImeVshGetPanelPositionAndForm(ImeVshContext* context, PositionAndForm* form);
+int APS5_VABI sceImeSetCandidateIndex(std::int32_t index);
+int APS5_VABI sceImeConfirmCandidate(std::int32_t index);
+int APS5_VABI sceImeDisableController(void);
+int APS5_VABI sceImeSetVoiceDictationEnabled(bool enabled);
+int APS5_VABI sceImeSetEditEventWithRemotePlayEnabled(bool enabled);
+int APS5_VABI sceImeForTestFunction(void);
+int APS5_VABI sceImeVshInformConfirmdString2(ImeVshContext* context, const char16_t* text, std::int32_t firstParameter, std::int32_t secondParameter, std::int32_t thirdParameter);
+int APS5_VABI sceImeVshSetSelectionText(ImeVshContext* context, const char16_t* text, std::uint32_t length);
+int APS5_VABI sceImeCheckUpdateTextInfo(ImeEditText* info, std::uint8_t repair);
+int APS5_VABI sceImeCheckRemoteEventParam(ImeEvent* event, std::uint8_t repair);
+int APS5_VABI sceImeKeyboardOpenInternal(std::int32_t userId, EventHandler handler, const KeyboardParam* param);
+int APS5_VABI sceImeVshSetParam(ImeVshContext* context, const ImeVshParameter* parameter);
+int APS5_VABI sceImeVshUpdateContext2(ImeVshContext* context, const char16_t* text, std::uint32_t caretIndex);
+int APS5_VABI sceImeVshSendTextInfo(ImeVshContext* context, const void* info, std::uint32_t size);
+int APS5_VABI sceImeVshInformConfirmdString(ImeVshContext* context, const char16_t* text, std::int32_t parameter);
+int APS5_VABI sceImeVshNotifyCurrentTextInfo(ImeVshContext* context, const char16_t* text, std::int32_t caretIndex, std::int32_t preeditFirst, std::int32_t preeditSecond, std::int32_t selectionFirst, std::int32_t selectionSecond);
+int APS5_VABI sceImeVshNotifyCurrentTextInfoForReconvertText(ImeVshContext* context, const char16_t* text, std::int32_t caretIndex, std::int32_t preeditFirst, std::int32_t preeditSecond, std::int32_t selectionFirst, std::int32_t selectionSecond, std::int32_t option);
+int APS5_VABI sceImeVshNotifyDeleteText(ImeVshContext* context, const char16_t* text, std::int32_t length, std::int32_t parameter);
+int APS5_VABI sceImeVshNotifyUpdateCaretText(ImeVshContext* context, const char16_t* text, std::int32_t length, std::int32_t parameter);
+int APS5_VABI sceImeVshCheckAutoReConvertingPreeditText(ImeVshContext* context, const char16_t* text);
+int APS5_VABI sceImeVshSetPanelPosition(ImeVshContext* context, float x, float y, std::int32_t horizontalAlignment, std::int32_t verticalAlignment);
+int APS5_VABI sceImeVshNotifyPreeditMetaInfo(ImeVshContext* context, const ImePreeditMetaInfo* info);
+int APS5_VABI sceImeConfigSet(std::uint64_t unusedArgument, std::uint64_t configuration, std::uint32_t key, std::uint32_t value);
+int APS5_VABI sceImeConfigGet(std::uint64_t unusedArgument, std::uint64_t configuration, std::uint32_t key);
+int APS5_VABI sceImeDicGetWords(std::int32_t userId, std::uint64_t dictionary, ImeDictionaryWord* words);
+int APS5_VABI sceImeDicAddWord(std::int32_t userId, std::uint64_t dictionary, const ImeDictionaryWord* word);
+int APS5_VABI sceImeDicDeleteWord(std::int32_t userId, std::uint64_t dictionary, const ImeDictionaryWord* word);
+int APS5_VABI sceImeDicReplaceWord(std::int32_t userId, std::uint64_t dictionary, const ImeDictionaryWord* oldWord, const ImeDictionaryWord* newWord);
+int APS5_VABI sceImeDicDeleteLearnDics(std::int32_t userId);
+int APS5_VABI sceImeDicDeleteUserDics(std::int32_t userId);
+int APS5_VABI FinalizeImeModule_nid_postfix(void);
+int APS5_VABI InitializeImeModule_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceIme/libSceIme.hpp b/core/libs/prx/libSceIme/libSceIme.hpp
new file mode 100644
index 0000000000..01b649be31
--- /dev/null
+++ b/core/libs/prx/libSceIme/libSceIme.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceIme/include/Api.hpp"
diff --git a/core/libs/prx/libSceImeBackend/libSceImeBackend.hpp b/core/libs/prx/libSceImeBackend/libSceImeBackend.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceImeBackend/libSceImeBackend.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceImeDialog/Export.cpp b/core/libs/prx/libSceImeDialog/Export.cpp
index c9b181b025..94cdcf67c7 100644
--- a/core/libs/prx/libSceImeDialog/Export.cpp
+++ b/core/libs/prx/libSceImeDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceImeDialog/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -17,6 +18,7 @@ constexpr std::uint32_t EndStatusUserCanceled = 1;
 constexpr std::uint32_t EndStatusAborted = 2;
 constexpr std::uint32_t MaxTextLength = 2048;
 constexpr int ErrorBusy = static_cast<int>(0x80bc0001u);
+constexpr int ErrorSuspending = static_cast<int>(0x80bc0009u);
 constexpr int ErrorNotOpened = static_cast<int>(0x80bc0002u);
 constexpr int ErrorNotInUse = static_cast<int>(0x80bc0107u);
 constexpr int ErrorInvalidMaxTextLength = static_cast<int>(0x80bc0016u);
@@ -190,21 +192,22 @@ int APS5_VABI sceImeDialogForceClose(void) {
 }
 
 int APS5_VABI sceImeDialogGetCurrentStarState(int64_t state) {
-    NotImplemented_nid_no_patch(__func__);
+    std::lock_guard lock(g_mutex);
+    if (g_dialog.status == StatusNone) return ErrorNotInUse;
+    if (state == 0) return ErrorInvalidAddress;
+    *reinterpret_cast<std::uint32_t*>(state) = 0;
     return 0;
 }
 
-int APS5_VABI sceImeDialogInitInternal(Param* param, ExtendedParam* extended) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceImeDialogInitInternal(const Param* param, const ExtendedParam* extended) {
+    return sceImeDialogInit(param, extended);
 }
 
-int APS5_VABI sceImeDialogSetPanelPosition(int32_t posx, int32_t posy) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceImeDialogSetPanelPosition(int32_t, int32_t) {
+    std::lock_guard lock(g_mutex);
+    return g_dialog.status == StatusNone ? ErrorNotInUse : ErrorSuspending;
 }
 
-
 int APS5_VABI sceImeDialogInitInternalWithSubInfo() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceImeDialog/include/Api.hpp b/core/libs/prx/libSceImeDialog/include/Api.hpp
new file mode 100644
index 0000000000..70f28051e4
--- /dev/null
+++ b/core/libs/prx/libSceImeDialog/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceImeDialogAbort(void);
+int APS5_VABI sceImeDialogGetPanelPositionAndForm(PositionAndForm* form);
+int APS5_VABI sceImeDialogGetPanelSize(const Param* param, uint32_t* width, uint32_t* height);
+int APS5_VABI sceImeDialogGetPanelSizeExtended(const Param* param, const ExtendedParam* extended, uint32_t* width, uint32_t* height);
+int APS5_VABI sceImeDialogGetResult(Result* result);
+int APS5_VABI sceImeDialogGetStatus(void);
+int APS5_VABI sceImeDialogInit(const Param* param, const ExtendedParam* extended);
+int APS5_VABI sceImeDialogTerm(void);
+int APS5_VABI sceImeDialogForTestFunction();
+int APS5_VABI sceImeDialogForceClose(void);
+int APS5_VABI sceImeDialogGetCurrentStarState(int64_t state);
+int APS5_VABI sceImeDialogInitInternal(const Param* param, const ExtendedParam* extended);
+int APS5_VABI sceImeDialogSetPanelPosition(int32_t, int32_t);
+int APS5_VABI sceImeDialogInitInternalWithSubInfo();
+
+}
diff --git a/core/libs/prx/libSceImeDialog/libSceImeDialog.hpp b/core/libs/prx/libSceImeDialog/libSceImeDialog.hpp
new file mode 100644
index 0000000000..b9c6e0c899
--- /dev/null
+++ b/core/libs/prx/libSceImeDialog/libSceImeDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceImeDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceInvitationDialog/Export.cpp b/core/libs/prx/libSceInvitationDialog/Export.cpp
index 8ae801bc26..9053e853ee 100644
--- a/core/libs/prx/libSceInvitationDialog/Export.cpp
+++ b/core/libs/prx/libSceInvitationDialog/Export.cpp
@@ -1,9 +1,10 @@
+#include "prx/libSceInvitationDialog/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-int APS5_VABI sceInvitationDialogGetResult() {
+int APS5_VABI sceInvitationDialogGetResult(InvitationDialogResult* result) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -28,4 +29,9 @@ int APS5_VABI sceInvitationDialogUpdateStatus() {
     return 0;
 }
 
+int APS5_VABI sceInvitationDialogClose(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libSceInvitationDialog/include/Api.hpp b/core/libs/prx/libSceInvitationDialog/include/Api.hpp
new file mode 100644
index 0000000000..884ec82465
--- /dev/null
+++ b/core/libs/prx/libSceInvitationDialog/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+
+struct InvitationDialogRecipients {
+    std::uint32_t count;
+    NpOnlineId onlineIds[16];
+};
+
+struct InvitationDialogResult {
+    std::uint8_t opaque00[8];
+    std::int32_t errorCode;
+    std::uint32_t opaque0C;
+    InvitationDialogRecipients* recipients;
+    std::uint8_t reserved[32];
+};
+
+static_assert(sizeof(NpOnlineId) == 20);
+static_assert(offsetof(InvitationDialogRecipients, onlineIds) == 4);
+static_assert(sizeof(InvitationDialogRecipients) == 324);
+static_assert(offsetof(InvitationDialogResult, errorCode) == 0x08);
+static_assert(offsetof(InvitationDialogResult, opaque0C) == 0x0C);
+static_assert(offsetof(InvitationDialogResult, recipients) == 0x10);
+static_assert(offsetof(InvitationDialogResult, reserved) == 0x18);
+static_assert(sizeof(InvitationDialogResult) == 0x38);
+
+extern "C" {
+
+int APS5_VABI sceInvitationDialogGetResult(InvitationDialogResult* result);
+int APS5_VABI sceInvitationDialogInitialize();
+int APS5_VABI sceInvitationDialogOpen();
+int APS5_VABI sceInvitationDialogTerminate();
+int APS5_VABI sceInvitationDialogUpdateStatus();
+int APS5_VABI sceInvitationDialogClose(void);
+
+}
diff --git a/core/libs/prx/libSceInvitationDialog/libSceInvitationDialog.hpp b/core/libs/prx/libSceInvitationDialog/libSceInvitationDialog.hpp
new file mode 100644
index 0000000000..52cc7b951a
--- /dev/null
+++ b/core/libs/prx/libSceInvitationDialog/libSceInvitationDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceInvitationDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceIpmi/CMakeLists.txt b/core/libs/prx/libSceIpmi/CMakeLists.txt
new file mode 100644
index 0000000000..f549ae49f1
--- /dev/null
+++ b/core/libs/prx/libSceIpmi/CMakeLists.txt
@@ -0,0 +1,3 @@
+add_library(libSceIpmi SHARED EXCLUDE_FROM_ALL Export.cpp PendingExports.cpp)
+target_include_directories(libSceIpmi PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceIpmi)
diff --git a/core/libs/prx/libSceIpmi/Export.cpp b/core/libs/prx/libSceIpmi/Export.cpp
index 238bb67ecf..993a1254b3 100644
--- a/core/libs/prx/libSceIpmi/Export.cpp
+++ b/core/libs/prx/libSceIpmi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIpmi/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceIpmi/PendingExports.cpp b/core/libs/prx/libSceIpmi/PendingExports.cpp
new file mode 100644
index 0000000000..5970f64dd6
--- /dev/null
+++ b/core/libs/prx/libSceIpmi/PendingExports.cpp
@@ -0,0 +1,206 @@
+#include "prx/libSceIpmi/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+extern "C" {
+
+int APS5_VABI _ZN4IPMI4impl11SessionImplC1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfig20estimateMsgQueueSizeEmj(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandler21onAsyncMethodDispatchEPNS_7SessionEjjPvmS4_m(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config26SyncMethodInvocationConfigC1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandler20onSyncMethodDispatchEPNS_7SessionEjPvmmS4_m(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI7SessionD1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl9tryGetMsgEjPvPmm(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandler20onSyncMethodDispatchEPNS_7SessionEjPKNS_8DataInfoEjPNS_10BufferInfoEj(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfigC1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ServerD2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ServerD0Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config24estimateClientMemorySizeEv(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server6createEPPS0_PKNS0_6ConfigEPvS6_(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6ConfigC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandler15onSessionKilledEPNS_7SessionE(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImplD1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl27respondToAsyncMethodRequestEjiPKvm(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config27AsyncMethodInvocationConfigC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandler21onAsyncMethodDispatchEPNS_7SessionEjjPKNS_8DataInfoEj(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ClientD2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl7sendMsgEjPKvmPj(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ClientC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI7SessionD2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZNK4IPMI4impl11SessionImpl16isPeerPrivilegedEv(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI7SessionC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImplD2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ClientD1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD0Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI7Session6Config25estimateSessionMemorySizeEv(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZNK4IPMI6Server6Config29estimateTempWorkingMemorySizeEv(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImplD0Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl7destroyEv(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config27AsyncMethodInvocationConfigC1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl6getMsgEjPvPmmPj(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl27respondToAsyncMethodRequestEjjiPKNS_8DataInfoEj(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ClientD0Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6createEPPS0_PKNS0_6ConfigEPvS6_(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ServerC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImplC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI7SessionD0Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6ServerD1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server6ConfigC1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI4impl11SessionImpl9getServerEv(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6ConfigC1Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config26SyncMethodInvocationConfigC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfigC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI _ZN4IPMI6Server6ConfigC2Ev(void) {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceIpmi/include/Api.hpp b/core/libs/prx/libSceIpmi/include/Api.hpp
new file mode 100644
index 0000000000..200ce258ea
--- /dev/null
+++ b/core/libs/prx/libSceIpmi/include/Api.hpp
@@ -0,0 +1,62 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceIpmiMgrGetIpcBlockerPid(void);
+int APS5_VABI sceIpmiMgrGetIpcBlockerPidByAppId(void);
+int APS5_VABI sceIpmiMgrPauseDump(void);
+int APS5_VABI sceIpmiMgrRaiseExceptionToPid(void);
+int APS5_VABI sceIpmiMgrStartDump(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplC1Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfig20estimateMsgQueueSizeEmj(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler21onAsyncMethodDispatchEPNS_7SessionEjjPvmS4_m(void);
+int APS5_VABI _ZN4IPMI6Client6Config26SyncMethodInvocationConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler20onSyncMethodDispatchEPNS_7SessionEjPvmmS4_m(void);
+int APS5_VABI _ZN4IPMI7SessionD1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl9tryGetMsgEjPvPmm(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler20onSyncMethodDispatchEPNS_7SessionEjPKNS_8DataInfoEjPNS_10BufferInfoEj(void);
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6ServerD2Ev(void);
+int APS5_VABI _ZN4IPMI6ServerD0Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config24estimateClientMemorySizeEv(void);
+int APS5_VABI _ZN4IPMI6Server6createEPPS0_PKNS0_6ConfigEPvS6_(void);
+int APS5_VABI _ZN4IPMI6Client6ConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler15onSessionKilledEPNS_7SessionE(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplD1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl27respondToAsyncMethodRequestEjiPKvm(void);
+int APS5_VABI _ZN4IPMI6Client6Config27AsyncMethodInvocationConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandler21onAsyncMethodDispatchEPNS_7SessionEjjPKNS_8DataInfoEj(void);
+int APS5_VABI _ZN4IPMI6ClientD2Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl7sendMsgEjPKvmPj(void);
+int APS5_VABI _ZN4IPMI6ClientC2Ev(void);
+int APS5_VABI _ZN4IPMI7SessionD2Ev(void);
+int APS5_VABI _ZNK4IPMI4impl11SessionImpl16isPeerPrivilegedEv(void);
+int APS5_VABI _ZN4IPMI7SessionC2Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplD2Ev(void);
+int APS5_VABI _ZN4IPMI6ClientD1Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD0Ev(void);
+int APS5_VABI _ZN4IPMI7Session6Config25estimateSessionMemorySizeEv(void);
+int APS5_VABI _ZNK4IPMI6Server6Config29estimateTempWorkingMemorySizeEv(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplD0Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl7destroyEv(void);
+int APS5_VABI _ZN4IPMI6Client6Config27AsyncMethodInvocationConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl6getMsgEjPvPmmPj(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl27respondToAsyncMethodRequestEjjiPKNS_8DataInfoEj(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD2Ev(void);
+int APS5_VABI _ZN4IPMI6ClientD0Ev(void);
+int APS5_VABI _ZN4IPMI6Client6createEPPS0_PKNS0_6ConfigEPvS6_(void);
+int APS5_VABI _ZN4IPMI6ServerC2Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImplC2Ev(void);
+int APS5_VABI _ZN4IPMI7SessionD0Ev(void);
+int APS5_VABI _ZN4IPMI6ServerD1Ev(void);
+int APS5_VABI _ZN4IPMI6Server6ConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6Server12EventHandlerD1Ev(void);
+int APS5_VABI _ZN4IPMI4impl11SessionImpl9getServerEv(void);
+int APS5_VABI _ZN4IPMI6Client6ConfigC1Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config26SyncMethodInvocationConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Client6Config14MsgQueueConfigC2Ev(void);
+int APS5_VABI _ZN4IPMI6Server6ConfigC2Ev(void);
+
+}
diff --git a/core/libs/prx/libSceIpmi/libSceIpmi.hpp b/core/libs/prx/libSceIpmi/libSceIpmi.hpp
new file mode 100644
index 0000000000..c7fc7c9a22
--- /dev/null
+++ b/core/libs/prx/libSceIpmi/libSceIpmi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceIpmi/include/Api.hpp"
diff --git a/core/libs/prx/libSceJemspace/Export.cpp b/core/libs/prx/libSceJemspace/Export.cpp
index d81f4a5e32..c6a8018fa1 100644
--- a/core/libs/prx/libSceJemspace/Export.cpp
+++ b/core/libs/prx/libSceJemspace/Export.cpp
@@ -1,10 +1,59 @@
-#include <cstddef>
-#include <cstdint>
+#include "prx/libSceJemspace/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceJemspaceCalloc() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceCreate() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceDestroy() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceFree() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceGetStats() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceMalloc() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceMallocUsableSize() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceMemalign() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspacePosixMemalign() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspacePrintStats() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspacePurge() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceRealloc() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+int APS5_VABI sceJemspaceReallocalign() {
+    NotImplemented_nid_no_patch(__func__);
+}
 
 }
diff --git a/core/libs/prx/libSceJemspace/include/Api.hpp b/core/libs/prx/libSceJemspace/include/Api.hpp
new file mode 100644
index 0000000000..5f280f8dcb
--- /dev/null
+++ b/core/libs/prx/libSceJemspace/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceJemspaceCalloc();
+int APS5_VABI sceJemspaceCreate();
+int APS5_VABI sceJemspaceDestroy();
+int APS5_VABI sceJemspaceFree();
+int APS5_VABI sceJemspaceGetStats();
+int APS5_VABI sceJemspaceMalloc();
+int APS5_VABI sceJemspaceMallocUsableSize();
+int APS5_VABI sceJemspaceMemalign();
+int APS5_VABI sceJemspacePosixMemalign();
+int APS5_VABI sceJemspacePrintStats();
+int APS5_VABI sceJemspacePurge();
+int APS5_VABI sceJemspaceRealloc();
+int APS5_VABI sceJemspaceReallocalign();
+
+}
diff --git a/core/libs/prx/libSceJemspace/libSceJemspace.hpp b/core/libs/prx/libSceJemspace/libSceJemspace.hpp
new file mode 100644
index 0000000000..efe1e331fb
--- /dev/null
+++ b/core/libs/prx/libSceJemspace/libSceJemspace.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJemspace/include/Api.hpp"
diff --git a/core/libs/prx/libSceJitBridge/libSceJitBridge.hpp b/core/libs/prx/libSceJitBridge/libSceJitBridge.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJitBridge/libSceJitBridge.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJobManager/CMakeLists.txt b/core/libs/prx/libSceJobManager/CMakeLists.txt
index 8539bbd0c2..4a88c6da6d 100644
--- a/core/libs/prx/libSceJobManager/CMakeLists.txt
+++ b/core/libs/prx/libSceJobManager/CMakeLists.txt
@@ -4,11 +4,32 @@ target_link_libraries(libSceJobManager PRIVATE libSceAgc libSceAgcDriver)
 configure_windows_unwind(libSceJobManager)
 
 if(BUILD_TESTING)
+    add_test_executable(job_manager_compute_progress_tests ${LIBS_INCLUDE_DIR}/tests/JobManagerComputeProgress.cpp)
+    target_include_directories(job_manager_compute_progress_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(job_manager_compute_progress_tests PRIVATE libc)
+    configure_windows_unwind(job_manager_compute_progress_tests)
+    add_test(NAME guest_job_manager_compute_progress COMMAND job_manager_compute_progress_tests)
+    set_tests_properties(guest_job_manager_compute_progress PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_job_manager_compute_progress PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_job_manager_tests ${LIBS_INCLUDE_DIR}/tests/GuestJobManager.cpp)
     target_include_directories(guest_job_manager_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_job_manager_tests PRIVATE libSceJobManager libSceAgc libSceAgcDriver libkernel libc)
     configure_windows_unwind(guest_job_manager_tests)
-    foreach(testCase IN ITEMS memory validation dispatch ordering nested limits priority shutdown)
+    if(WIN32)
+        add_library(job_manager_reference SHARED EXCLUDE_FROM_ALL
+            ${LIBS_INCLUDE_DIR}/tests/GuestJobManager.cpp
+            ${LIBS_INCLUDE_DIR}/tests/JobManagerReference.cpp)
+        target_include_directories(job_manager_reference PRIVATE ${LIBS_INCLUDE_DIR})
+        target_compile_definitions(job_manager_reference PRIVATE ANYPS5_JOB_MANAGER_REFERENCE)
+        target_link_libraries(job_manager_reference PRIVATE libkernel libc)
+        set_target_properties(job_manager_reference PROPERTIES PREFIX "" SUFFIX .prx
+            RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests)
+        configure_windows_unwind(job_manager_reference)
+    endif()
+    foreach(testCase IN ITEMS memory validation dispatch ordering nested limits node_pool priority shutdown worker_policy worker_wake worker_wait worker_count worker_spin)
         add_test(NAME guest_job_manager_${testCase} COMMAND guest_job_manager_tests ${testCase})
         set_tests_properties(guest_job_manager_${testCase} PROPERTIES TIMEOUT 20)
         if(WIN32)
@@ -16,4 +37,13 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJobManager>")
         endif()
     endforeach()
+    set_tests_properties(guest_job_manager_worker_spin PROPERTIES ENVIRONMENT "APS5_TIME_SCALE=1")
+    foreach(scale IN ITEMS 0.1 10)
+        add_test(NAME guest_job_manager_worker_spin_scale_${scale} COMMAND guest_job_manager_tests worker_spin)
+        set_tests_properties(guest_job_manager_worker_spin_scale_${scale} PROPERTIES TIMEOUT 20 ENVIRONMENT "APS5_TIME_SCALE=${scale}")
+        if(WIN32)
+            set_tests_properties(guest_job_manager_worker_spin_scale_${scale} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJobManager>")
+        endif()
+    endforeach()
 endif()
diff --git a/core/libs/prx/libSceJobManager/ComputeProgress.hpp b/core/libs/prx/libSceJobManager/ComputeProgress.hpp
new file mode 100644
index 0000000000..aadd732245
--- /dev/null
+++ b/core/libs/prx/libSceJobManager/ComputeProgress.hpp
@@ -0,0 +1,31 @@
+#ifndef CORE_LIBS_PRX_LIBSCEJOBMANAGER_COMPUTEPROGRESS_HPP
+#define CORE_LIBS_PRX_LIBSCEJOBMANAGER_COMPUTEPROGRESS_HPP
+
+#include <cstdint>
+#include <stdexcept>
+
+namespace JobManager {
+
+class ComputeProgress {
+public:
+    std::uint32_t Publish(std::uint32_t count) {
+        total += count;
+        return total;
+    }
+
+    std::uint32_t Collect(std::uint64_t value) {
+        const auto current = static_cast<std::uint32_t>(value);
+        const std::uint32_t finished = current - seen;
+        if (finished > std::uint32_t{total - seen}) throw std::runtime_error("libSceJobManager: a compute label advanced beyond its published work");
+        seen = current;
+        return finished;
+    }
+
+private:
+    std::uint32_t total = 0;
+    std::uint32_t seen = 0;
+};
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceJobManager/Export.cpp b/core/libs/prx/libSceJobManager/Export.cpp
index 155a95220d..4aa2e117ab 100644
--- a/core/libs/prx/libSceJobManager/Export.cpp
+++ b/core/libs/prx/libSceJobManager/Export.cpp
@@ -1,3 +1,15 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceJobManager/include/Api.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include "prx/libSceAgcDriver/Eq/include/Event.hpp"
+#include "prx/libSceAgc/Cb/include/Sync.hpp"
+#include "prx/libSceAgc/Cb/include/Registers.hpp"
+#include "prx/libSceAgc/Cb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Acb/include/Sync.hpp"
+#include "prx/libSceAgc/Acb/include/Memory.hpp"
+#include "prx/libSceAgc/Acb/include/Dispatch.hpp"
+#include "prx/libSceAgc/Acb/include/Control.hpp"
 #include <algorithm>
 #include <array>
 #include <bit>
@@ -6,42 +18,16 @@
 #include <cstdint>
 #include <cstring>
 #include <deque>
+#include <immintrin.h>
 #include <mutex>
 #include <stdexcept>
 #include <string>
 #include <vector>
 
 #include "SceTypes.hpp"
+#include "ComputeProgress.hpp"
 #include "prx/libc/include/General.hpp"
-
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** result);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
-int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceKernelGetEventFilter(const KernelEvent* ev);
-std::uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
-int APS5_VABI sceAgcDriverAddEqEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceAgcDriverDeleteEqEvent(KernelEqueue eq, int id);
-int APS5_VABI sceAgcDriverSubmitAcb(std::uint32_t queue, const Packet* packet);
-std::uint32_t* APS5_VABI sceAgcAcbAcquireMem(CommandBuffer* buf, std::uint32_t gcrControl, const volatile void* base, std::uint64_t sizeBytes, std::uint32_t pollCycles);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegistersDirect(CommandBuffer* buf, const volatile ShaderRegister* regs, std::uint32_t numRegs);
-std::uint32_t* APS5_VABI sceAgcCbSetShRegisterRangeDirect(CommandBuffer* buf, std::uint32_t offset, const std::uint32_t* values, std::uint32_t numValues);
-std::uint32_t* APS5_VABI sceAgcAcbPushMarker(CommandBuffer* buf, const char* str, std::uint32_t color);
-std::uint32_t* APS5_VABI sceAgcAcbPopMarker(CommandBuffer* buf);
-std::uint32_t* APS5_VABI sceAgcCbDispatch(CommandBuffer* buf, std::uint32_t threadGroupX, std::uint32_t threadGroupY, std::uint32_t threadGroupZ, std::uint32_t modifier);
-std::uint32_t* APS5_VABI sceAgcAcbDispatchIndirect(CommandBuffer* buf, const volatile void* indirectArguments, std::uint32_t modifier);
-std::uint32_t* APS5_VABI sceAgcCbReleaseMem(CommandBuffer* buf, std::uint8_t action, std::uint16_t gcrControl, std::uint8_t dst, std::uint8_t cachePolicy, const volatile Label* address, std::uint8_t dataSelect, std::uint64_t data, std::uint16_t gdsOffset, std::uint16_t gdsSize, std::uint8_t interrupt, std::uint32_t interruptContextId);
-}
+#include "prx/libc/include/GuestArena.hpp"
 
 namespace {
 
@@ -70,35 +56,10 @@ constexpr std::uint64_t ThreadRecordBytes = 0x48;
 constexpr std::uint64_t SequenceBytes = 0x240;
 constexpr std::uint64_t NodeBytes = 72;
 constexpr std::uint64_t ComputeContextBytes = 0x168;
-constexpr std::uint64_t ComputeCommandBytes = 0x3ff * 104 + 0xff * 148 + 0x3f * 32;
 constexpr std::uint32_t FirstComputeQueue = 0x20;
 constexpr std::uint32_t UserDataRegister = 0x240;
 constexpr int UserEventFilter = -11;
 
-struct MemorySizeQueryParams {
-    std::uint32_t version;
-    std::uint32_t workers;
-    std::uint32_t sequences;
-    std::uint32_t invocations;
-    std::uint32_t dispatches;
-    std::uint32_t syncPoints;
-    std::uint32_t waits;
-    std::uint32_t computeSequences;
-    std::uint64_t computeQueueMask;
-};
-
-struct ConfigParams {
-    std::uint32_t version;
-    std::uint32_t threadFlags;
-    std::uint32_t stackSize;
-    std::uint32_t priority;
-    const char* threadName;
-    std::uint32_t spinMicroseconds;
-    std::uint32_t computeAffinity;
-    std::uint32_t computePriority;
-    std::uint32_t reserved;
-};
-
 constexpr ConfigParams DefaultConfig{0, 0x00021fff, 0x00010000, 0x2bc, nullptr, 0, 0x1fff, 0x100, 0};
 
 struct BlockHeader {
@@ -109,12 +70,36 @@ struct BlockHeader {
     std::uint32_t reserved;
 };
 
-using JobEntry = void (APS5_VABI*)(void* argument, std::uint32_t index);
-
 std::uint64_t AlignUp(std::uint64_t value, std::uint64_t alignment) {
     return (value + alignment - 1) & ~(alignment - 1);
 }
 
+std::uint64_t ComputeCommandBudget() {
+    std::array<std::uint32_t, 256> words{};
+    CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
+    const ShaderRegister shaderRegister{};
+    const std::array<std::uint32_t, 2> userData{};
+    bool encoded = sceAgcAcbAcquireMem(&buffer, 0x20380, nullptr, 0, 0x190) != nullptr;
+    encoded = encoded && sceAgcCbSetShRegistersDirect(&buffer, &shaderRegister, 1) != nullptr;
+    encoded = encoded && sceAgcCbSetShRegisterRangeDirect(&buffer, UserDataRegister, userData.data(), 2) != nullptr;
+    encoded = encoded && sceAgcAcbPushMarker(&buffer, "1234567890123456789012345678901", 0) != nullptr;
+    encoded = encoded && sceAgcCbDispatch(&buffer, 1, 1, 1, 0) != nullptr;
+    encoded = encoded && sceAgcAcbPopMarker(&buffer) != nullptr;
+    const auto dispatchBytes = static_cast<std::uint64_t>(buffer.cursor_up - words.data()) * 4;
+    buffer.cursor_up = words.data();
+    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0, 1, 3, nullptr, 1, 0, 0, 0, 0, 0) != nullptr;
+    encoded = encoded && sceAgcAcbWaitRegMem(&buffer, 0, 3, 3, nullptr, 0, ~std::uint64_t{0}, 0x190) != nullptr;
+    encoded = encoded && sceAgcAcbRewind(&buffer, 1) != nullptr;
+    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0x200, 1, 3, nullptr, 1, 0, 0, 0, 0, 0) != nullptr;
+    encoded = encoded && sceAgcAcbWriteData(&buffer, 2, 3, 0, userData.data(), 1, 1, 0) != nullptr;
+    const auto syncBytes = static_cast<std::uint64_t>(buffer.cursor_up - words.data()) * 4;
+    buffer.cursor_up = words.data();
+    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0x200, 1, 3, nullptr, 1, 0, 0, 0, 2, 0) != nullptr;
+    const auto waitBytes = static_cast<std::uint64_t>(buffer.cursor_up - words.data()) * 4;
+    if (!encoded || dispatchBytes > 255 || syncBytes > 255 || waitBytes > 255) throw std::runtime_error("libSceJobManager: compute command size measurement failed");
+    return MaxDispatches * dispatchBytes + MaxSyncPoints * syncBytes + MaxWaits * waitBytes;
+}
+
 struct Manager;
 class Sequence;
 
@@ -143,27 +128,6 @@ struct Counters {
     std::uint32_t waits = 0;
 };
 
-class ISequence {
-public:
-    APS5_VABI virtual int Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) = 0;
-    APS5_VABI virtual int SyncPoint() = 0;
-    APS5_VABI virtual int Wait() = 0;
-    APS5_VABI virtual void CompleteDestructor() {}
-    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence was deleted by its caller"); }
-    APS5_VABI virtual int DispatchCompute(const void* shader, void* userData, std::int32_t x, std::int32_t y, std::int32_t z, const char* name) = 0;
-    APS5_VABI virtual int DispatchComputeIndirect(const void* shader, void* userData, const void* indirectArguments, const char* name) = 0;
-};
-
-class ISequenceFactory {
-public:
-    APS5_VABI virtual int Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
-    APS5_VABI virtual int Destroy(ISequence* sequence) = 0;
-    APS5_VABI virtual void CompleteDestructor() {}
-    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence factory was deleted by its caller"); }
-    APS5_VABI virtual int CreateCompute(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
-    APS5_VABI virtual int DestroyCompute(ISequence* sequence) = 0;
-};
-
 class Sequence final : public ISequence {
 public:
     APS5_VABI int Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) override;
@@ -177,6 +141,7 @@ public:
     void Advance();
     void DispatchCompleted(std::uint32_t invocations);
     void CollectCompute();
+    void SetComputeStorage(std::uint32_t* commands, std::size_t words, Label* completion);
     bool Busy() const { return outstanding != 0; }
 
     Manager* manager = nullptr;
@@ -190,6 +155,7 @@ private:
     int WaitLocked(std::unique_lock<std::mutex>& guard);
     int AppendCompute(Item item);
     void SubmitCompute(const Item& item);
+    void FlushCompute();
 
     Counters limits;
     Counters submitted;
@@ -200,11 +166,13 @@ private:
     std::size_t cursor = 0;
     std::deque<Item> items;
     std::condition_variable passed;
-    Label label{};
-    std::uint64_t labelSeen = 0;
-    std::uint64_t labelTotal = 0;
+    Label* label = nullptr;
+    JobManager::ComputeProgress progress;
+    std::uint32_t pendingCompute = 0;
     bool batchStarted = false;
-    std::deque<std::vector<std::uint32_t>> commands;
+    std::uint32_t* commandBegin = nullptr;
+    std::size_t commandWords = 0;
+    std::size_t commandUsed = 0;
 };
 
 class Factory final : public ISequenceFactory {
@@ -226,6 +194,11 @@ struct Manager {
     std::uint32_t freeNodes = 0;
     std::uint32_t freeSequences = 0;
     std::uint32_t persistentThreads = 0;
+    std::uint32_t workerCount = 0;
+    std::uint32_t sleepingWorkers = 0;
+    std::uint32_t wakeTokens = 0;
+    std::uint64_t pendingInvocations = 0;
+    std::uint64_t spinTicks = 0;
     std::array<std::deque<Item*>, 2> runQueues;
     std::vector<Sequence> sequences;
     std::deque<Sequence> computeSequences;
@@ -238,6 +211,14 @@ struct Manager {
     std::vector<Pthread> workers;
 };
 
+thread_local Manager* currentWorker = nullptr;
+
+void WakeWorkers(Manager& manager, std::uint32_t invocations, bool publisherCanRun = true) {
+    const std::uint32_t available = invocations - (publisherCanRun && currentWorker == &manager ? 1u : 0u);
+    manager.wakeTokens += std::min(available, manager.sleepingWorkers - manager.wakeTokens);
+    if (manager.wakeTokens != 0) manager.work.notify_all();
+}
+
 Manager*& Implementation(void* self) {
     return *static_cast<Manager**>(self);
 }
@@ -267,7 +248,7 @@ bool Sequence::Open(Manager* owner, const Counters& limit, std::uint32_t runQueu
     outstanding = 0;
     cursor = 0;
     items.clear();
-    commands.clear();
+    commandUsed = 0;
     batchStarted = false;
     if (!TakeNode(*owner)) return false;
     open = true;
@@ -285,7 +266,8 @@ void Sequence::Advance() {
             ++outstanding;
             ++cursor;
             manager->runQueues[priority].push_back(&item);
-            manager->work.notify_all();
+            manager->pendingInvocations -= item.count;
+            WakeWorkers(*manager, item.count);
             continue;
         }
         if (item.type == ItemType::Compute || item.type == ItemType::ComputeIndirect) {
@@ -294,6 +276,7 @@ void Sequence::Advance() {
             SubmitCompute(item);
             continue;
         }
+        FlushCompute();
         if (outstanding != 0) return;
         if (item.type == ItemType::SyncPoint) {
             ++completed.syncPoints;
@@ -304,7 +287,7 @@ void Sequence::Advance() {
         const auto retired = static_cast<std::uint32_t>(cursor);
         items.erase(items.begin(), items.begin() + static_cast<std::ptrdiff_t>(retired + 1));
         cursor = 0;
-        commands.clear();
+        commandUsed = 0;
         batchStarted = false;
         if (error == 0) {
             submitted.invocations -= completed.invocations;
@@ -338,6 +321,7 @@ int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, cons
     if (before.invocations + count > limits.invocations || before.dispatches >= limits.dispatches) return Latch(SequenceLimitExceeded);
     if (!TakeNode(*manager)) return Latch(SequenceNoNodes);
     items.push_back({ItemType::Dispatch, this, entry, argument, count, 0, 0, nullptr});
+    manager->pendingInvocations += count;
     Advance();
     return 0;
 }
@@ -353,31 +337,57 @@ void Sequence::SubmitCompute(const Item& item) {
     std::memcpy(&modifier, specials + 0x10, sizeof(modifier));
     const auto userData = reinterpret_cast<std::uint64_t>(item.argument);
     const std::array<std::uint32_t, 2> userDataWords{static_cast<std::uint32_t>(userData), static_cast<std::uint32_t>(userData >> 32)};
-    auto& words = commands.emplace_back(64 + 3 * registerCount + item.name.size() / 4);
-    CommandBuffer buffer{words.data(), words.data() + words.size(), words.data(), words.data() + words.size(), nullptr, nullptr, 0};
-    bool encoded = sceAgcAcbAcquireMem(&buffer, 0x20380u | (batchStarted ? 0u : 1u), nullptr, 0, 0x190) != nullptr;
-    encoded = encoded && sceAgcCbSetShRegistersDirect(&buffer, registers, registerCount) != nullptr;
-    encoded = encoded && sceAgcCbSetShRegisterRangeDirect(&buffer, UserDataRegister, userDataWords.data(), 2) != nullptr;
-    if (item.named) encoded = encoded && sceAgcAcbPushMarker(&buffer, item.name.c_str(), 0) != nullptr;
-    if ((modifier & 1) != 0) {
+    const auto capacity = std::min(commandWords - commandUsed, 64 + 3 * registerCount + item.name.size() / 4);
+    auto* const words = commandBegin + commandUsed;
+    CommandBuffer buffer{words, words + capacity, words, words + capacity, nullptr, nullptr, 0};
+    {
+        const GuestArena::HostWrite destination(words, capacity * 4);
+        bool encoded = sceAgcAcbAcquireMem(&buffer, 0x20380u | (batchStarted ? 0u : 1u), nullptr, 0, 0x190) != nullptr;
+        encoded = encoded && sceAgcCbSetShRegistersDirect(&buffer, registers, registerCount) != nullptr;
+        encoded = encoded && sceAgcCbSetShRegisterRangeDirect(&buffer, UserDataRegister, userDataWords.data(), 2) != nullptr;
+        if (item.named) encoded = encoded && sceAgcAcbPushMarker(&buffer, item.name.c_str(), 0) != nullptr;
         if (item.type == ItemType::Compute) {
             encoded = encoded && sceAgcCbDispatch(&buffer, item.groups[0], item.groups[1], item.groups[2], modifier) != nullptr;
         } else {
             encoded = encoded && sceAgcAcbDispatchIndirect(&buffer, item.indirectArguments, modifier) != nullptr;
         }
+        if (item.named) encoded = encoded && sceAgcAcbPopMarker(&buffer) != nullptr;
+        if (!encoded) throw std::runtime_error("libSceJobManager: a compute dispatch did not fit its command buffer");
     }
-    if (item.named) encoded = encoded && sceAgcAcbPopMarker(&buffer) != nullptr;
-    encoded = encoded && sceAgcCbReleaseMem(&buffer, 0x2f, 0x620, 0, 0, &label, 1, ++labelTotal, 0, 0, 2, 0) != nullptr;
-    if (!encoded) throw std::runtime_error("libSceJobManager: a compute dispatch did not fit its command buffer");
     batchStarted = true;
-    const Packet packet{words.data(), static_cast<std::uint32_t>(buffer.cursor_up - words.data()), 0, {}};
+    ++pendingCompute;
+    const Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
+    commandUsed += packet.dw_num;
     if (sceAgcDriverSubmitAcb(queue, &packet) != 0) throw std::runtime_error("libSceJobManager: sceAgcDriverSubmitAcb failed");
 }
 
+void Sequence::SetComputeStorage(std::uint32_t* commands, std::size_t words, Label* completion) {
+    commandBegin = commands;
+    commandWords = words;
+    label = completion;
+    const GuestArena::HostWrite destination(label, sizeof(*label));
+    label->value = 0;
+}
+
+void Sequence::FlushCompute() {
+    if (pendingCompute == 0) return;
+    if (commandWords - commandUsed < 8) throw std::runtime_error("libSceJobManager: a compute completion did not fit its command buffer");
+    auto* const words = commandBegin + commandUsed;
+    CommandBuffer buffer{words, words + 8, words, words + 8, nullptr, nullptr, 0};
+    {
+        const GuestArena::HostWrite destination(words, 32);
+        if (sceAgcCbReleaseMem(&buffer, 0x2f, 0x200, 1, 3, label, 1, progress.Publish(pendingCompute), 0, 0, 2, 0) == nullptr) {
+            throw std::runtime_error("libSceJobManager: a compute completion could not be encoded");
+        }
+    }
+    pendingCompute = 0;
+    const Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
+    commandUsed += packet.dw_num;
+    if (sceAgcDriverSubmitAcb(queue, &packet) != 0) throw std::runtime_error("libSceJobManager: sceAgcDriverSubmitAcb failed for a completion");
+}
+
 void Sequence::CollectCompute() {
-    const std::uint64_t value = label.value;
-    const auto finished = static_cast<std::uint32_t>(value - labelSeen);
-    labelSeen = value;
+    const auto finished = progress.Collect(label->value);
     if (finished == 0) return;
     completed.dispatches += finished;
     outstanding -= finished;
@@ -440,7 +450,7 @@ int Sequence::WaitAndClose(std::uint32_t index) {
     const auto remaining = static_cast<std::uint32_t>(std::count_if(items.begin(), items.end(), [](const Item& item) { return item.type != ItemType::Wait; }));
     ReturnNodes(*manager, remaining + 1);
     items.clear();
-    commands.clear();
+    commandUsed = 0;
     cursor = 0;
     outstanding = 0;
     open = false;
@@ -460,6 +470,13 @@ int Sequence::WaitLocked(std::unique_lock<std::mutex>& guard) {
     bool done = false;
     items.push_back({ItemType::Wait, this, nullptr, nullptr, 0, 0, 0, &done});
     Advance();
+    if (!done && currentWorker == manager) {
+        std::uint64_t runnable = 0;
+        for (const auto& queue : manager->runQueues) {
+            for (const Item* item : queue) runnable += item->count - item->handedOut;
+        }
+        WakeWorkers(*manager, static_cast<std::uint32_t>(std::min(runnable, std::uint64_t{manager->workerCount})), false);
+    }
     passed.wait(guard, [&done] { return done; });
     --manager->blockedWaiters;
     return result;
@@ -551,26 +568,52 @@ bool RunOne(Manager& manager, std::unique_lock<std::mutex>& guard) {
 
 void* APS5_VABI WorkerEntry(void* argument) {
     Manager& manager = *static_cast<Manager*>(argument);
+    currentWorker = &manager;
+    std::uint64_t lastWork = __rdtsc();
     std::unique_lock guard(manager.lock);
     while (manager.running) {
-        if (RunOne(manager, guard)) continue;
-        manager.work.wait(guard, [&manager] { return !manager.running || !manager.runQueues[0].empty() || !manager.runQueues[1].empty(); });
+        if (RunOne(manager, guard)) {
+            lastWork = __rdtsc();
+            continue;
+        }
+        const bool spinning = manager.pendingInvocations != 0 && __rdtsc() - lastWork < manager.spinTicks;
+        if (spinning || manager.sleepingWorkers >= manager.workerCount - manager.persistentThreads) {
+            guard.unlock();
+            _mm_pause();
+            guard.lock();
+            continue;
+        }
+        ++manager.sleepingWorkers;
+        manager.work.wait(guard, [&manager] { return !manager.running || manager.wakeTokens != 0; });
+        if (manager.wakeTokens != 0) --manager.wakeTokens;
+        --manager.sleepingWorkers;
     }
+    currentWorker = nullptr;
     return nullptr;
 }
 
-std::uint32_t NodeCount(std::uint64_t memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeQueues, bool* fits) {
+struct WorkLayout {
+    std::uint64_t commands = 0;
+    std::uint64_t commandBytes = 0;
+    std::uint64_t labels = 0;
+    std::uint32_t nodes = 0;
+};
+
+WorkLayout LayoutFor(std::uint64_t memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeQueues) {
+    WorkLayout layout;
     const std::uint64_t end = memory + size;
     std::uint64_t address = AlignUp(memory + StateEnd, 8) + workers * ThreadRecordBytes;
     for (const std::uint64_t bytes : {std::uint64_t{0x100}, std::uint64_t{0x80}, std::uint64_t{0x80}, std::uint64_t{0x80}}) address = AlignUp(address, 64) + bytes;
     address = AlignUp(address, 64) + (sequences + computeQueues) * SequenceBytes;
     if (computeQueues != 0) {
-        address = AlignUp(address + ComputeContextBytes, 0x100) + AlignUp(ComputeCommandBytes * computeQueues, 8);
-        address += AlignUp(4 * std::uint64_t{computeQueues}, 8) + 8 * std::uint64_t{computeQueues};
+        layout.commandBytes = ComputeCommandBudget();
+        layout.commands = AlignUp(address + ComputeContextBytes, 0x100);
+        layout.labels = AlignUp(layout.commands + layout.commandBytes * computeQueues + 4 * std::uint64_t{computeQueues}, 8);
+        address = layout.labels + 8 * std::uint64_t{computeQueues};
     }
     address = AlignUp(address, 64);
-    *fits = address <= end;
-    return *fits ? static_cast<std::uint32_t>(((end - address) / NodeBytes) & 0xffff) : 0;
+    if (address <= end) layout.nodes = static_cast<std::uint32_t>(((end - address) / NodeBytes) & 0xffff);
+    return layout;
 }
 
 int ValidateWorkers(const ConfigParams& config, std::uint32_t workers) {
@@ -600,12 +643,13 @@ void StartWorkers(Manager& manager, const ConfigParams& config, std::uint32_t wo
         Pthread thread = nullptr;
         const int created = scePthreadCreate(&thread, &attributes, WorkerEntry, &manager, name.c_str());
         scePthreadAttrDestroy(&attributes);
+
         if (created != 0) throw std::runtime_error("libSceJobManager: scePthreadCreate failed for a worker");
         manager.workers.push_back(thread);
     }
 }
 
-void StartCompute(Manager& manager, std::uint32_t computeSequences, std::uint64_t computeQueueMask, std::uint32_t priority, std::uint32_t affinity) {
+void StartCompute(Manager& manager, const WorkLayout& layout, std::uint32_t computeSequences, std::uint64_t computeQueueMask, std::uint32_t priority, std::uint32_t affinity) {
     if (sceKernelCreateEqueue(&manager.computeEvents, "SceJobManagerComputeEventQueue") != 0) throw std::runtime_error("libSceJobManager: sceKernelCreateEqueue failed");
     for (std::uint64_t mask = computeQueueMask; mask != 0; mask &= mask - 1) {
         const std::uint32_t queue = FirstComputeQueue + static_cast<std::uint32_t>(std::countr_zero(mask));
@@ -616,6 +660,8 @@ void StartCompute(Manager& manager, std::uint32_t computeSequences, std::uint64_
     for (std::uint32_t index = 0; index < computeSequences; ++index) {
         manager.computeSequences[index].compute = true;
         manager.computeSequences[index].queue = manager.computeQueues[index];
+        manager.computeSequences[index].SetComputeStorage(reinterpret_cast<std::uint32_t*>(layout.commands + index * layout.commandBytes),
+            static_cast<std::size_t>(layout.commandBytes / 4), reinterpret_cast<Label*>(layout.labels + index * sizeof(Label)));
     }
     manager.freeComputeSequences = computeSequences == MaxSequences ? ~std::uint32_t{0} : (std::uint32_t{1} << computeSequences) - 1;
     const KernelSchedParam schedule{static_cast<int>(priority)};
@@ -626,6 +672,7 @@ void StartCompute(Manager& manager, std::uint32_t computeSequences, std::uint64_
     }
     const int created = scePthreadCreate(&manager.computeHandler, &attributes, ComputeHandlerEntry, &manager, "SceJobManagerComputeEventHdlr");
     scePthreadAttrDestroy(&attributes);
+
     if (created != 0) throw std::runtime_error("libSceJobManager: scePthreadCreate failed for the compute handler");
 }
 
@@ -642,15 +689,17 @@ int Initialize(void* self, void* memory, std::uint64_t size, std::uint32_t worke
     }
     if (size < StateOffset) return ManagerMemoryTooSmall;
     if (size < StateEnd) throw std::runtime_error("sce::Job::JobManager::initialize: a memory block smaller than 0x2d8 bytes is not supported");
-    std::memset(static_cast<std::uint8_t*>(memory) + StateOffset, 0, StateEnd - StateOffset);
-    const BlockHeader header{0x4d4a, static_cast<std::uint16_t>(StateOffset), 0x05000001, static_cast<std::uint32_t>(size), 0};
-    std::memcpy(memory, &header, sizeof(header));
+    {
+        const GuestArena::HostWrite destination(memory, StateEnd);
+        std::memset(static_cast<std::uint8_t*>(memory) + StateOffset, 0, StateEnd - StateOffset);
+        const BlockHeader header{0x4d4a, static_cast<std::uint16_t>(StateOffset), 0x05000001, static_cast<std::uint32_t>(size), 0};
+        std::memcpy(memory, &header, sizeof(header));
+    }
     if (config != nullptr && config->version > 1) return ManagerInvalidArgument;
     const ConfigParams& settings = config != nullptr ? *config : DefaultConfig;
     const auto computeQueues = computeSequences != 0 ? static_cast<std::uint32_t>(std::popcount(computeQueueMask)) : 0;
-    bool fits = false;
-    const std::uint32_t nodes = NodeCount(base, size, workers, sequences, computeQueues, &fits);
-    if (!fits || nodes == 0) return ManagerMemoryTooSmall;
+    const auto layout = LayoutFor(base, size, workers, sequences, computeQueues);
+    if (layout.nodes == 0) return ManagerMemoryTooSmall;
     if (const int invalid = ValidateWorkers(settings, workers); invalid != 0) return invalid;
     const bool ownHandlerSettings = (settings.version & 1) != 0;
     const std::uint32_t handlerPriority = ownHandlerSettings ? settings.computePriority : 0x100;
@@ -658,7 +707,9 @@ int Initialize(void* self, void* memory, std::uint64_t size, std::uint32_t worke
     if (computeSequences != 0 && (handlerPriority < 0x100 || handlerPriority > 0x2ff || handlerAffinity == 0 || handlerAffinity > 0x1fff)) return ManagerInvalidArgument;
     auto* manager = new Manager;
     manager->running = true;
-    manager->freeNodes = nodes - 1;
+    manager->workerCount = workers;
+    manager->spinTicks = sceKernelGetTscFrequency() / 1000000 * settings.spinMicroseconds;
+    manager->freeNodes = layout.nodes - 1;
     manager->freeSequences = sequences == MaxSequences ? ~std::uint32_t{0} : (std::uint32_t{1} << sequences) - 1;
     manager->sequences = std::vector<Sequence>(sequences);
     for (std::uint32_t priority = 0; priority < 2; ++priority) {
@@ -667,7 +718,7 @@ int Initialize(void* self, void* memory, std::uint64_t size, std::uint32_t worke
         manager->unifiedFactories[priority].manager = manager;
         manager->unifiedFactories[priority].priority = priority;
     }
-    if (computeSequences != 0) StartCompute(*manager, computeSequences, computeQueueMask, handlerPriority, handlerAffinity);
+    if (computeSequences != 0) StartCompute(*manager, layout, computeSequences, computeQueueMask, handlerPriority, handlerAffinity);
     Implementation(self) = manager;
     StartWorkers(*manager, settings, workers);
     return 0;
@@ -693,8 +744,6 @@ void APS5_VABI _ZN3sce3Job10JobManagerC2Ev(void* self) {
     Implementation(self) = nullptr;
 }
 
-int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self);
-
 void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) {
     if (Implementation(self) != nullptr) {
         static_cast<void>(_ZN3sce3Job10JobManager8shutdownEv(self));
@@ -703,6 +752,7 @@ void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) {
 
 void APS5_VABI _ZN3sce3Job10JobManagerD2Ev(void* self) {
     _ZN3sce3Job10JobManagerD1Ev(self);
+
 }
 
 std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* params) {
@@ -724,7 +774,7 @@ std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKN
     if (computeSequences != 0) {
         const auto queues = static_cast<std::uint64_t>(std::popcount(params->computeQueueMask));
         bytes = (bytes + (params->sequences + queues) * SequenceBytes + 0x267) & ~std::uint64_t{0xff};
-        bytes = (bytes + ComputeCommandBytes * queues + 3) & ~std::uint64_t{3};
+        bytes = (bytes + ComputeCommandBudget() * queues + 3) & ~std::uint64_t{3};
         bytes = (bytes + 4 * queues + 7) & ~std::uint64_t{7};
         bytes += 8 * queues;
     } else {
@@ -781,7 +831,7 @@ ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryIn
 int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count) {
     Manager* manager = Implementation(self);
     if (manager == nullptr) return ManagerNotInitialized;
-    if (count > manager->workers.size()) return ManagerInvalidArgument;
+    if (count > manager->workerCount) return ManagerInvalidArgument;
     const std::lock_guard guard(manager->lock);
     manager->persistentThreads = count;
     return 0;
diff --git a/core/libs/prx/libSceJobManager/include/Api.hpp b/core/libs/prx/libSceJobManager/include/Api.hpp
new file mode 100644
index 0000000000..f76c944d21
--- /dev/null
+++ b/core/libs/prx/libSceJobManager/include/Api.hpp
@@ -0,0 +1,78 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <deque>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+struct MemorySizeQueryParams {
+    std::uint32_t version;
+    std::uint32_t workers;
+    std::uint32_t sequences;
+    std::uint32_t invocations;
+    std::uint32_t dispatches;
+    std::uint32_t syncPoints;
+    std::uint32_t waits;
+    std::uint32_t computeSequences;
+    std::uint64_t computeQueueMask;
+};
+
+struct ConfigParams {
+    std::uint32_t version;
+    std::uint32_t threadFlags;
+    std::uint32_t stackSize;
+    std::uint32_t priority;
+    const char* threadName;
+    std::uint32_t spinMicroseconds;
+    std::uint32_t computeAffinity;
+    std::uint32_t computePriority;
+    std::uint32_t reserved;
+};
+
+using JobEntry = void (APS5_VABI*)(void* argument, std::uint32_t index);
+
+class ISequence {
+public:
+    APS5_VABI virtual int Dispatch(JobEntry entry, void* argument, std::uint32_t count, const char* name) = 0;
+    APS5_VABI virtual int SyncPoint() = 0;
+    APS5_VABI virtual int Wait() = 0;
+    APS5_VABI virtual void CompleteDestructor() {}
+    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence was deleted by its caller"); }
+    APS5_VABI virtual int DispatchCompute(const void* shader, void* userData, std::int32_t x, std::int32_t y, std::int32_t z, const char* name) = 0;
+    APS5_VABI virtual int DispatchComputeIndirect(const void* shader, void* userData, const void* indirectArguments, const char* name) = 0;
+};
+
+class ISequenceFactory {
+public:
+    APS5_VABI virtual int Create(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
+    APS5_VABI virtual int Destroy(ISequence* sequence) = 0;
+    APS5_VABI virtual void CompleteDestructor() {}
+    APS5_VABI virtual void DeletingDestructor() { throw std::runtime_error("libSceJobManager: a sequence factory was deleted by its caller"); }
+    APS5_VABI virtual int CreateCompute(ISequence** out, std::uint32_t invocations, std::uint32_t dispatches, std::uint32_t syncPoints, std::uint32_t waits, const char* name) = 0;
+    APS5_VABI virtual int DestroyCompute(ISequence* sequence) = 0;
+};
+
+extern "C" {
+
+void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void* self);
+void APS5_VABI _ZN3sce3Job10JobManagerC2Ev(void* self);
+void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self);
+void APS5_VABI _ZN3sce3Job10JobManagerD2Ev(void* self);
+std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* params);
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t memorySize, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeSequences, std::uint64_t computeQueueMask, const ConfigParams* config);
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t memorySize, std::uint32_t workers, std::uint32_t sequences, const ConfigParams* config);
+int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self);
+ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority);
+ISequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority);
+int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count);
+
+}
diff --git a/core/libs/prx/libSceJobManager/libSceJobManager.hpp b/core/libs/prx/libSceJobManager/libSceJobManager.hpp
new file mode 100644
index 0000000000..740c6ddc49
--- /dev/null
+++ b/core/libs/prx/libSceJobManager/libSceJobManager.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJobManager/include/Api.hpp"
diff --git a/core/libs/prx/libSceJpegDec/Export.cpp b/core/libs/prx/libSceJpegDec/Export.cpp
index aeddcbeb6c..d7d11c7277 100644
--- a/core/libs/prx/libSceJpegDec/Export.cpp
+++ b/core/libs/prx/libSceJpegDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegDec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
diff --git a/core/libs/prx/libSceJpegDec/include/Api.hpp b/core/libs/prx/libSceJpegDec/include/Api.hpp
new file mode 100644
index 0000000000..0f0892be0a
--- /dev/null
+++ b/core/libs/prx/libSceJpegDec/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceJpegDecCreate(const JpegDecCreateParam* param, void* memoryAddress, uint32_t memorySize, void** handle);
+int32_t APS5_VABI sceJpegDecDecode(void* handle, const JpegDecDecodeParam* param, JpegDecImageInfo* imageInfo);
+int32_t APS5_VABI sceJpegDecDelete(void* handle);
+int32_t APS5_VABI sceJpegDecParseHeader(const JpegDecParseParam* param, JpegDecImageInfo* imageInfo);
+int32_t APS5_VABI sceJpegDecQueryMemorySize(const JpegDecCreateParam* param);
+int APS5_VABI sceJpegDecDecodeWithInputControl();
+
+}
diff --git a/core/libs/prx/libSceJpegDec/libSceJpegDec.hpp b/core/libs/prx/libSceJpegDec/libSceJpegDec.hpp
new file mode 100644
index 0000000000..e1581fb344
--- /dev/null
+++ b/core/libs/prx/libSceJpegDec/libSceJpegDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJpegDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceJpegEnc/Export.cpp b/core/libs/prx/libSceJpegEnc/Export.cpp
index 4ebcc09712..6a2407eebe 100644
--- a/core/libs/prx/libSceJpegEnc/Export.cpp
+++ b/core/libs/prx/libSceJpegEnc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegEnc/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -204,7 +205,7 @@ int32_t APS5_VABI sceJpegEncEncode(void* handle, const JpegEncEncodeParam* param
         outputInfo->size = static_cast<std::uint32_t>(jpeg.size());
         outputInfo->height = param->image_height;
     }
-    return 0;
+    return static_cast<std::int32_t>(jpeg.size());
 }
 
 int32_t APS5_VABI sceJpegEncQueryMemorySize(const JpegEncCreateParam* param) {
diff --git a/core/libs/prx/libSceJpegEnc/include/Api.hpp b/core/libs/prx/libSceJpegEnc/include/Api.hpp
new file mode 100644
index 0000000000..25215e5d07
--- /dev/null
+++ b/core/libs/prx/libSceJpegEnc/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceJpegEncCreate(const JpegEncCreateParam* param, void* memory, uint32_t memorySize, void** handle);
+int32_t APS5_VABI sceJpegEncDelete(void* handle);
+int32_t APS5_VABI sceJpegEncEncode(void* handle, const JpegEncEncodeParam* param, JpegEncOutputInfo* outputInfo);
+int32_t APS5_VABI sceJpegEncQueryMemorySize(const JpegEncCreateParam* param);
+
+}
diff --git a/core/libs/prx/libSceJpegEnc/libSceJpegEnc.hpp b/core/libs/prx/libSceJpegEnc/libSceJpegEnc.hpp
new file mode 100644
index 0000000000..a5548622ca
--- /dev/null
+++ b/core/libs/prx/libSceJpegEnc/libSceJpegEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJpegEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceJpegParser/libSceJpegParser.hpp b/core/libs/prx/libSceJpegParser/libSceJpegParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJpegParser/libSceJpegParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJsc/libSceJsc.hpp b/core/libs/prx/libSceJsc/libSceJsc.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJsc/libSceJsc.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJscCompiler/libSceJscCompiler.hpp b/core/libs/prx/libSceJscCompiler/libSceJscCompiler.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJscCompiler/libSceJscCompiler.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJson/libSceJson.hpp b/core/libs/prx/libSceJson/libSceJson.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJson/libSceJson.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceJson2/CMakeLists.txt b/core/libs/prx/libSceJson2/CMakeLists.txt
index f3e7cb682f..cf4780cf80 100644
--- a/core/libs/prx/libSceJson2/CMakeLists.txt
+++ b/core/libs/prx/libSceJson2/CMakeLists.txt
@@ -1,4 +1,4 @@
-add_library(libSceJson2 SHARED EXCLUDE_FROM_ALL Export.cpp)
+add_library(libSceJson2 SHARED EXCLUDE_FROM_ALL Export.cpp InventoryExports.cpp)
 target_include_directories(libSceJson2 PRIVATE ${LIBS_INCLUDE_DIR})
 configure_windows_unwind(libSceJson2)
 
@@ -8,8 +8,19 @@ if(BUILD_TESTING)
     target_link_libraries(guest_json_tests PRIVATE libSceJson2 libc)
     configure_windows_unwind(guest_json_tests)
     add_test(NAME guest_json COMMAND guest_json_tests)
+    add_test(NAME guest_json_numeric_locale COMMAND guest_json_tests --numeric-locale)
+    set_tests_properties(guest_json_numeric_locale PROPERTIES SKIP_RETURN_CODE 77)
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        set(numeric_locale_dir ${CMAKE_CURRENT_BINARY_DIR}/numeric-locale)
+        set(numeric_locale_data ${LIBS_INCLUDE_DIR}/tests/numeric-locale)
+        add_test(NAME guest_json_numeric_locale_setup COMMAND sh -c
+            "rm -rf '${numeric_locale_dir}' && mkdir -p '${numeric_locale_dir}' && I18NPATH='${numeric_locale_dir}' localedef -c -f '${numeric_locale_data}/comma.charmap' -i '${numeric_locale_data}/comma.locale' '${numeric_locale_dir}/xx_COMMA'; test -f '${numeric_locale_dir}/xx_COMMA/LC_NUMERIC'")
+        set_tests_properties(guest_json_numeric_locale_setup PROPERTIES FIXTURES_SETUP json_numeric_locale)
+        set_tests_properties(guest_json_numeric_locale PROPERTIES FIXTURES_REQUIRED json_numeric_locale
+            ENVIRONMENT "LOCPATH=${numeric_locale_dir}")
+    endif()
     if(WIN32)
-        set_tests_properties(guest_json PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_json guest_json_numeric_locale PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJson2>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceJson2/Export.cpp b/core/libs/prx/libSceJson2/Export.cpp
index 5b92c48d68..7e594babab 100644
--- a/core/libs/prx/libSceJson2/Export.cpp
+++ b/core/libs/prx/libSceJson2/Export.cpp
@@ -1,86 +1,34 @@
+#include "prx/libSceJson2/include/Api.hpp"
 #include <algorithm>
 #include <bit>
 #include <cerrno>
+#include <charconv>
 #include <cmath>
 #include <cstdint>
 #include <cstddef>
 #include <cstdio>
 #include <cstring>
 #include <list>
+#include <locale>
 #include <mutex>
 #include <memory>
+#include <sstream>
 #include <stdexcept>
 #include <string>
+#include <string_view>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 namespace {
 
-enum ValueType : std::int32_t {
-    TypeNull = 0,
-    TypeBoolean = 1,
-    TypeInteger = 2,
-    TypeUInteger = 3,
-    TypeReal = 4,
-    TypeString = 5,
-    TypeArray = 6,
-    TypeObject = 7,
-};
+using namespace SceJson2;
 
 constexpr int JsonErrorParse = static_cast<int>(0x80848101);
 
-struct Node;
-struct Value { Node* node; };
-struct String { std::string* text; };
-struct Array { std::list<Value>* items; };
-struct Pair;
-struct Object { std::list<Pair>* items; };
-struct ArrayIteratorState {
-    std::list<Value>::iterator position;
-    std::list<Value>::iterator end;
-};
-struct ArrayIterator { ArrayIteratorState* state; };
-struct ObjectIteratorState {
-    std::list<Pair>* owner = nullptr;
-    std::list<Pair>::iterator position{};
-};
-struct ObjectIterator { ObjectIteratorState* state; };
-struct Pair {
-    String key;
-    std::uint64_t reserved;
-    Value value;
-};
 static_assert(sizeof(Value) == 8 && sizeof(String) == 8 && sizeof(Array) == 8 && sizeof(Object) == 8);
 static_assert(sizeof(ArrayIterator) == 8 && sizeof(ObjectIterator) == 8);
 static_assert(offsetof(Pair, value) == 0x10);
 
-using TypeMismatchHandler = const Value& (APS5_VABI*)(ValueType, const Value*, const Value*, void*);
-using SpecialFloatHandler = Value* (APS5_VABI*)(Value*, std::int32_t, double, const Value*, void*, bool*);
-using ElementAccessFailureHandler = void (APS5_VABI*)(int, const String*, const std::size_t*, const Value*, const Value*, void*);
-
-struct Handlers {
-    TypeMismatchHandler typeMismatch = nullptr;
-    void* typeMismatchContext = nullptr;
-    SpecialFloatHandler specialFloat = nullptr;
-    void* specialFloatContext = nullptr;
-    ElementAccessFailureHandler elementAccessFailure = nullptr;
-    void* elementAccessFailureContext = nullptr;
-};
-
-struct Node {
-    ValueType type = TypeNull;
-    bool boolean = false;
-    std::int64_t integer = 0;
-    std::uint64_t uinteger = 0;
-    double real = 0;
-    String string{};
-    Array array{};
-    Object object{};
-    Handlers handlers{};
-};
-
-using NullAccessCallback = const Value& (APS5_VABI*)(ValueType, const Value*, void*);
-
 struct Globals {
     std::mutex mutex;
     NullAccessCallback callback = nullptr;
@@ -299,8 +247,9 @@ void AppendEscaped(std::string& out, const std::string& text) {
 std::string RealText(double value) {
     if (!std::isfinite(value)) throw std::runtime_error("sce::Json: cannot serialize a non-finite number");
     char buffer[32];
-    std::snprintf(buffer, sizeof(buffer), "%.17g", value);
-    return buffer;
+    const auto result = std::to_chars(buffer, buffer + sizeof(buffer), value, std::chars_format::general, 17);
+    if (result.ec != std::errc{}) throw std::runtime_error("sce::Json: real number formatting failed");
+    return std::string(buffer, result.ptr);
 }
 
 void Serialize(std::string& out, const Node& n) {
@@ -370,8 +319,6 @@ Value& ObjectEntry(Object& object, const std::string& key) {
     }
 }
 
-using ParserReadCallback = int (APS5_VABI*)(char&, void*);
-
 class Parser {
 public:
     Parser(const char* text, std::size_t size, const Handlers& handlers) : text(text), end(text + size), handlers(handlers) {}
@@ -510,8 +457,16 @@ private:
                 }
             }
         }
-        const double real = std::strtod(text.c_str(), nullptr);
-        if (!std::isfinite(real)) throw std::runtime_error("sce::Json::Parser::parse: number " + text + " overflows a double; the console's behaviour is unverified");
+        double real = 0;
+        const auto parsed = std::from_chars(text.data(), text.data() + text.size(), real);
+        bool converted = parsed.ec == std::errc{} && parsed.ptr == text.data() + text.size();
+        if (parsed.ec == std::errc::result_out_of_range) {
+            std::istringstream stream(text);
+            stream.imbue(std::locale::classic());
+            stream >> real;
+            converted = !stream.fail() && stream.eof();
+        }
+        if (!converted || !std::isfinite(real)) throw std::runtime_error("sce::Json::Parser::parse: number " + text + " overflows a double; the console's behaviour is unverified");
         out.type = TypeReal;
         out.real = real;
         return true;
@@ -610,7 +565,6 @@ void* const JsonMemAllocatorVtable[] = {
     reinterpret_cast<void*>(&JsonMemAllocatorPureVirtual), reinterpret_cast<void*>(&JsonMemAllocatorPureVirtual),
 };
 
-
 }
 
 extern "C" {
@@ -713,6 +667,34 @@ String* APS5_VABI _ZNK3sce4Json6String6substrEmm(String* result, const String* s
 }
 std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const String* self, char character, std::size_t position) { return self->text->find(character, position); }
 std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const String* self, char character, std::size_t position) { return self->text->rfind(character, position); }
+char APS5_VABI _ZNK3sce4Json6String2atEm(const String* self, std::size_t position) {
+    if (position >= self->text->size()) throw std::out_of_range("sce::Json::String::at: position past the end");
+    return (*self->text)[position];
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcm(const String* self, const char* text, std::size_t position) {
+    if (text == nullptr) throw std::invalid_argument("sce::Json::String::find: null text");
+    return self->text->find(text, position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcmm(const String* self, const char* text, std::size_t position, std::size_t length) {
+    if (text == nullptr && length > 0) throw std::invalid_argument("sce::Json::String::find: null text");
+    return self->text->find(std::string_view(text == nullptr ? "" : text, length), position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String4findERKS1_m(const String* self, const String* other, std::size_t position) {
+    if (other == nullptr || other->text == nullptr) throw std::invalid_argument("sce::Json::String::find: null other");
+    return self->text->find(*other->text, position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcm(const String* self, const char* text, std::size_t position) {
+    if (text == nullptr) throw std::invalid_argument("sce::Json::String::rfind: null text");
+    return self->text->rfind(text, position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcmm(const String* self, const char* text, std::size_t position, std::size_t length) {
+    if (text == nullptr && length > 0) throw std::invalid_argument("sce::Json::String::rfind: null text");
+    return self->text->rfind(std::string_view(text == nullptr ? "" : text, length), position);
+}
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindERKS1_m(const String* self, const String* other, std::size_t position) {
+    if (other == nullptr || other->text == nullptr) throw std::invalid_argument("sce::Json::String::rfind: null other");
+    return self->text->rfind(*other->text, position);
+}
 int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const String* self, const char* text) {
     if (text == nullptr) throw std::invalid_argument("sce::Json::String::compare: null text");
     return CompareText(self->text->c_str(), text);
@@ -725,6 +707,14 @@ int APS5_VABI _ZNK3sce4Json6String7compareERKS1_(const String* self, const Strin
 void APS5_VABI _ZN3sce4Json5ArrayC1Ev(Array* self) { Construct(*self); }
 void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(Array* self, const Array* other) { CopyArray(*self, *other); }
 void APS5_VABI _ZN3sce4Json5ArrayD1Ev(Array* self) { Destroy(*self); }
+Array* APS5_VABI _ZN3sce4Json5ArrayaSERKS1_(Array* self, const Array* other) {
+    if (self == other) return self;
+    Array copy{};
+    CopyArray(copy, *other);
+    Destroy(*self);
+    *self = copy;
+    return self;
+}
 void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(Array* self, const Value* value) {
     Value copy{};
     CopyInto(copy, *value);
@@ -751,6 +741,11 @@ const Value* APS5_VABI _ZNK3sce4Json5Array4backEv(const Array* self) {
     if (self->items->empty()) throw std::out_of_range("sce::Json::Array::back: empty array");
     return &self->items->back();
 }
+void APS5_VABI _ZN3sce4Json5Array9pop_frontEv(Array* self) {
+    if (self->items->empty()) throw std::out_of_range("sce::Json::Array::pop_front: empty array");
+    Destroy(self->items->front());
+    self->items->pop_front();
+}
 void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(ArrayIterator* self) { delete self->state; self->state = nullptr; }
 ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEv(ArrayIterator* self) {
     if (self->state && self->state->position != self->state->end) ++self->state->position;
@@ -834,6 +829,7 @@ ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iterator7advanceEm(ObjectIterator*
     if (self->state && self->state->owner) {
         while (count) {
             _ZN3sce4Json6Object8iteratorppEv(self);
+
             --count;
         }
     }
@@ -1044,7 +1040,6 @@ int APS5_VABI _ZNK3sce4Json5Value8toStringERNS0_6StringE(const Value* self, Stri
     return 0;
 }
 
-
 int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(Value* out, ParserReadCallback read, void* context) {
     if (read == nullptr) throw std::invalid_argument("sce::Json::Parser::parse: null read callback");
     Parser parser(read, context, NodeOf(*out).handlers);
@@ -1058,26 +1053,12 @@ int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(Value* out, const char*
     return ParseValue(out, parser);
 }
 
-
-struct InitParameterRtti {
-    void* allocParam;
-    void* userData;
-    std::size_t fileBufferSize;
-};
-
 void APS5_VABI _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(InitParameterRtti* self, void* allocParam, void* userData, std::size_t fileBufferSize) {
     self->allocParam = allocParam;
     self->userData = userData;
     self->fileBufferSize = fileBufferSize;
 }
 
-struct InitParameter2 {
-    void* allocator;
-    void* userData;
-    std::size_t fileBufferSize;
-    std::int32_t specialFloatFormatType;
-    std::uint32_t reserved[3];
-};
 static_assert(sizeof(InitParameter2) == 0x28 && offsetof(InitParameter2, specialFloatFormatType) == 0x18);
 
 void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(InitParameter2* self) {
@@ -1087,6 +1068,7 @@ void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(InitParameter2* self) {
 
 void APS5_VABI _ZN3sce4Json14InitParameter2C2Ev(InitParameter2* self) {
     _ZN3sce4Json14InitParameter2C1Ev(self);
+
 }
 
 void APS5_VABI _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(InitParameter2* self, void* allocator, void* userData) {
@@ -1214,6 +1196,7 @@ ObjectIterator* APS5_VABI _ZN3sce4Json6Object6insertERKNS1_4PairE(ObjectIterator
 ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEi(ArrayIterator* result, ArrayIterator* self, int) {
     _ZN3sce4Json5Array8iteratorC1ERKS2_(result, self);
     _ZN3sce4Json5Array8iteratorppEv(self);
+
     return result;
 }
 
@@ -1236,6 +1219,7 @@ void APS5_VABI _ZN3sce4Json5Array8iteratorC1Ev(ArrayIterator* self) {
 ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEi(ObjectIterator* result, ObjectIterator* self, int) {
     auto state = self->state ? std::make_unique<ObjectIteratorState>(*self->state) : nullptr;
     _ZN3sce4Json6Object8iteratorppEv(self);
+
     result->state = state.release();
     return result;
 }
diff --git a/core/libs/prx/libSceJson2/InventoryExports.cpp b/core/libs/prx/libSceJson2/InventoryExports.cpp
new file mode 100644
index 0000000000..c509808eb3
--- /dev/null
+++ b/core/libs/prx/libSceJson2/InventoryExports.cpp
@@ -0,0 +1,404 @@
+#include <cstddef>
+#include <cstdint>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+extern "C" {
+
+int APS5_VABI sceJson2Unknown_001_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json11Initializer24setAllocatorInfoCallBackEPFviNS0_9ValueTypeEPvES3_", sceJson2Unknown_001_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_002_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json11Initializer28setGlobalSpecialFloatHandlerEPFKNS0_5ValueENS0_12FunctionTypeEdPS3_PvPbES6_", sceJson2Unknown_002_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_003_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json11Initializer28setGlobalTypeMismatchHandlerEPFRKNS0_5ValueENS0_9ValueTypeEPS3_S6_PvES7_", sceJson2Unknown_003_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_004_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json11Initializer36setGlobalElementAccessFailureHandlerEPFviPKNS0_6StringEPKmPKNS0_5ValueES9_PvESA_", sceJson2Unknown_004_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_005_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json11InitializerC2Ev", sceJson2Unknown_005_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_006_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json11InitializerD2Ev", sceJson2Unknown_006_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_007_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json12MemAllocatorD0Ev", sceJson2Unknown_007_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_008_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json12MemAllocatorD1Ev", sceJson2Unknown_008_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_009_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json17InitParameterRttiC2EPNS0_14AllocParamRttiEPvm", sceJson2Unknown_009_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_010_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json19InternalInitializer19terminate_staticlibEv", sceJson2Unknown_010_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_011_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json19InternalInitializer20initialize_staticlibEPKNS0_13InitParameterENS1_10InitOptionE", sceJson2Unknown_011_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_012_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json19InternalInitializerC1Ev", sceJson2Unknown_012_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_013_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json19InternalInitializerC2Ev", sceJson2Unknown_013_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_014_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json19InternalInitializerD1Ev", sceJson2Unknown_014_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_015_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json19InternalInitializerD2Ev", sceJson2Unknown_015_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_016_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json4FreeEPv", sceJson2Unknown_016_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_017_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array10push_frontERKNS0_5ValueE", sceJson2Unknown_017_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_018_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array5eraseERKNS1_8iteratorE", sceJson2Unknown_018_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_019_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array6insertERKNS1_8iteratorERKNS0_5ValueE", sceJson2Unknown_019_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_020_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array8iteratorC2ERKS2_", sceJson2Unknown_020_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_021_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array8iteratorC2Ev", sceJson2Unknown_021_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_022_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array8iteratorD2Ev", sceJson2Unknown_022_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_023_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array8pop_backEv", sceJson2Unknown_023_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_024_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Array9pop_frontEv", sceJson2Unknown_024_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_025_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ArrayC2ERKS1_", sceJson2Unknown_025_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_026_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ArrayC2Ev", sceJson2Unknown_026_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_027_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ArrayD2Ev", sceJson2Unknown_027_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_029_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value11referStringEv", sceJson2Unknown_029_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_030_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value12referBooleanEv", sceJson2Unknown_030_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_031_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value12referIntegerEv", sceJson2Unknown_031_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_032_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value13referUIntegerEv", sceJson2Unknown_032_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_033_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value9referRealEv", sceJson2Unknown_033_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_034_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value9serializeEPFiRNS0_6StringEPvES4_", sceJson2Unknown_034_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_035_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5Value9serializeERNS0_6StringEPFiS3_PvES4_", sceJson2Unknown_035_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_036_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2ENS0_9ValueTypeE", sceJson2Unknown_036_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_037_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2EPKc", sceJson2Unknown_037_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_038_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2ERKNS0_5ArrayE", sceJson2Unknown_038_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_039_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2ERKNS0_6ObjectE", sceJson2Unknown_039_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_040_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2ERKNS0_6StringE", sceJson2Unknown_040_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_041_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2ERKS1_", sceJson2Unknown_041_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_042_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2Eb", sceJson2Unknown_042_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_043_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2Ed", sceJson2Unknown_043_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_044_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2El", sceJson2Unknown_044_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_045_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2Em", sceJson2Unknown_045_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_046_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueC2Ev", sceJson2Unknown_046_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_047_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json5ValueD2Ev", sceJson2Unknown_047_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_048_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6MallocEm", sceJson2Unknown_048_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_049_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Object4PairC2ERKNS0_6StringERKNS0_5ValueE", sceJson2Unknown_049_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_050_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Object4PairC2Ev", sceJson2Unknown_050_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_051_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Object4PairD2Ev", sceJson2Unknown_051_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_052_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Object8iteratorC2ERKS2_", sceJson2Unknown_052_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_053_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Object8iteratorC2Ev", sceJson2Unknown_053_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_054_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Object8iteratorD2Ev", sceJson2Unknown_054_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_055_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6ObjectC2ERKS1_", sceJson2Unknown_055_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_056_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6ObjectC2Ev", sceJson2Unknown_056_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_057_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6ObjectD2Ev", sceJson2Unknown_057_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_058_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6Parser5parseERNS0_5ValueEPKc", sceJson2Unknown_058_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_059_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6StringC2EPKc", sceJson2Unknown_059_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_060_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6StringC2ERKS1_", sceJson2Unknown_060_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_061_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6StringC2Ev", sceJson2Unknown_061_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_062_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZN3sce4Json6StringD2Ev", sceJson2Unknown_062_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_063_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZNK3sce4Json14InitParameter211getUserDataEv", sceJson2Unknown_063_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_064_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZNK3sce4Json14InitParameter212getAllocatorEv", sceJson2Unknown_064_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_065_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZNK3sce4Json14InitParameter217getFileBufferSizeEv", sceJson2Unknown_065_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_066_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZNK3sce4Json14InitParameter225getSpecialFloatFormatTypeEv", sceJson2Unknown_066_nid_no_patch);
+
+int APS5_VABI sceJson2Unknown_067_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+APS5_EXPORT("_ZNK3sce4Json5ValueixERKNS0_6StringE", sceJson2Unknown_067_nid_no_patch);
+
+}
diff --git a/core/libs/prx/libSceJson2/include/Api.hpp b/core/libs/prx/libSceJson2/include/Api.hpp
new file mode 100644
index 0000000000..630d23d193
--- /dev/null
+++ b/core/libs/prx/libSceJson2/include/Api.hpp
@@ -0,0 +1,347 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <bit>
+#include <cerrno>
+#include <charconv>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <list>
+#include <locale>
+#include <memory>
+#include <mutex>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+
+namespace SceJson2 {
+
+enum ValueType : std::int32_t {
+    TypeNull = 0,
+    TypeBoolean = 1,
+    TypeInteger = 2,
+    TypeUInteger = 3,
+    TypeReal = 4,
+    TypeString = 5,
+    TypeArray = 6,
+    TypeObject = 7,
+};
+
+}
+
+namespace SceJson2 {
+
+struct Node;
+
+}
+
+namespace SceJson2 {
+
+struct Value { Node* node; };
+
+}
+
+namespace SceJson2 {
+
+struct String { std::string* text; };
+
+}
+
+namespace SceJson2 {
+
+struct Array { std::list<Value>* items; };
+
+}
+
+namespace SceJson2 {
+
+struct Pair;
+
+}
+
+namespace SceJson2 {
+
+struct Object { std::list<Pair>* items; };
+
+}
+
+namespace SceJson2 {
+
+struct ArrayIteratorState {
+    std::list<Value>::iterator position;
+    std::list<Value>::iterator end;
+};
+
+}
+
+namespace SceJson2 {
+
+struct ArrayIterator { ArrayIteratorState* state; };
+
+}
+
+namespace SceJson2 {
+
+struct ObjectIteratorState {
+    std::list<Pair>* owner = nullptr;
+    std::list<Pair>::iterator position{};
+};
+
+}
+
+namespace SceJson2 {
+
+struct ObjectIterator { ObjectIteratorState* state; };
+
+}
+
+namespace SceJson2 {
+
+struct Pair {
+    String key;
+    std::uint64_t reserved;
+    Value value;
+};
+
+}
+
+namespace SceJson2 {
+
+using TypeMismatchHandler = const Value& (APS5_VABI*)(ValueType, const Value*, const Value*, void*);
+
+}
+
+namespace SceJson2 {
+
+using SpecialFloatHandler = Value* (APS5_VABI*)(Value*, std::int32_t, double, const Value*, void*, bool*);
+
+}
+
+namespace SceJson2 {
+
+using ElementAccessFailureHandler = void (APS5_VABI*)(int, const String*, const std::size_t*, const Value*, const Value*, void*);
+
+}
+
+namespace SceJson2 {
+
+struct Handlers {
+    TypeMismatchHandler typeMismatch = nullptr;
+    void* typeMismatchContext = nullptr;
+    SpecialFloatHandler specialFloat = nullptr;
+    void* specialFloatContext = nullptr;
+    ElementAccessFailureHandler elementAccessFailure = nullptr;
+    void* elementAccessFailureContext = nullptr;
+};
+
+}
+
+namespace SceJson2 {
+
+struct Node {
+    ValueType type = TypeNull;
+    bool boolean = false;
+    std::int64_t integer = 0;
+    std::uint64_t uinteger = 0;
+    double real = 0;
+    String string{};
+    Array array{};
+    Object object{};
+    Handlers handlers{};
+};
+
+}
+
+namespace SceJson2 {
+
+using NullAccessCallback = const Value& (APS5_VABI*)(ValueType, const Value*, void*);
+
+}
+
+namespace SceJson2 {
+
+using ParserReadCallback = int (APS5_VABI*)(char&, void*);
+
+}
+
+namespace SceJson2 {
+
+struct InitParameterRtti {
+    void* allocParam;
+    void* userData;
+    std::size_t fileBufferSize;
+};
+
+}
+
+namespace SceJson2 {
+
+struct InitParameter2 {
+    void* allocator;
+    void* userData;
+    std::size_t fileBufferSize;
+    std::int32_t specialFloatFormatType;
+    std::uint32_t reserved[3];
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI _ZN3sce4Json11InitializerC1Ev(void* self);
+int APS5_VABI _ZN3sce4Json11InitializerD1Ev(void* self);
+int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE(void* self, const void* parameter);
+int APS5_VABI _ZN3sce4Json11Initializer9terminateEv(void* self);
+int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallBackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void* self, SceJson2::NullAccessCallback callback, void* context);
+int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallbackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void* self, SceJson2::NullAccessCallback callback, void* context);
+void APS5_VABI _ZN3sce4Json12MemAllocatorC2Ev(void* self);
+void APS5_VABI _ZN3sce4Json12MemAllocatorD2Ev(void* self);
+void APS5_VABI _ZN3sce4Json6StringC1Ev(SceJson2::String* self);
+void APS5_VABI _ZN3sce4Json6StringC1EPKc(SceJson2::String* self, const char* text);
+void APS5_VABI _ZN3sce4Json6StringC1ERKS1_(SceJson2::String* self, const SceJson2::String* other);
+void APS5_VABI _ZN3sce4Json6StringD1Ev(SceJson2::String* self);
+SceJson2::String* APS5_VABI _ZN3sce4Json6StringaSERKS1_(SceJson2::String* self, const SceJson2::String* other);
+const char* APS5_VABI _ZNK3sce4Json6String5c_strEv(const SceJson2::String* self);
+bool APS5_VABI _ZNK3sce4Json6String5emptyEv(const SceJson2::String* self);
+std::size_t APS5_VABI _ZNK3sce4Json6String6lengthEv(const SceJson2::String* self);
+std::size_t APS5_VABI _ZNK3sce4Json6String4sizeEv(const SceJson2::String* self);
+std::size_t APS5_VABI _ZNK3sce4Json6String8capacityEv(const SceJson2::String* self);
+bool APS5_VABI _ZNK3sce4Json6StringeqEPKc(const SceJson2::String* self, const char* text);
+bool APS5_VABI _ZNK3sce4Json6StringeqERKS1_(const SceJson2::String* self, const SceJson2::String* other);
+void APS5_VABI _ZN3sce4Json6String5clearEv(SceJson2::String* self);
+void APS5_VABI _ZN3sce4Json6String6resizeEm(SceJson2::String* self, std::size_t count);
+void APS5_VABI _ZN3sce4Json6String7reserveEm(SceJson2::String* self, std::size_t capacity);
+SceJson2::String* APS5_VABI _ZN3sce4Json6String6appendERKS1_(SceJson2::String* self, const SceJson2::String* other);
+SceJson2::String* APS5_VABI _ZN3sce4Json6String6appendEPKc(SceJson2::String* self, const char* text);
+SceJson2::String* APS5_VABI _ZN3sce4Json6String6appendEPKcm(SceJson2::String* self, const char* text, std::size_t length);
+SceJson2::String* APS5_VABI _ZN3sce4Json6StringpLEPKc(SceJson2::String* self, const char* text);
+SceJson2::String* APS5_VABI _ZN3sce4Json6StringpLEh(SceJson2::String* self, unsigned char ch);
+SceJson2::String* APS5_VABI _ZNK3sce4Json6String6substrEmm(SceJson2::String* result, const SceJson2::String* self, std::size_t position, std::size_t length);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const SceJson2::String* self, char character, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const SceJson2::String* self, char character, std::size_t position);
+char APS5_VABI _ZNK3sce4Json6String2atEm(const SceJson2::String* self, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcm(const SceJson2::String* self, const char* text, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findEPKcmm(const SceJson2::String* self, const char* text, std::size_t position, std::size_t length);
+std::size_t APS5_VABI _ZNK3sce4Json6String4findERKS1_m(const SceJson2::String* self, const SceJson2::String* other, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcm(const SceJson2::String* self, const char* text, std::size_t position);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEPKcmm(const SceJson2::String* self, const char* text, std::size_t position, std::size_t length);
+std::size_t APS5_VABI _ZNK3sce4Json6String5rfindERKS1_m(const SceJson2::String* self, const SceJson2::String* other, std::size_t position);
+int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const SceJson2::String* self, const char* text);
+int APS5_VABI _ZNK3sce4Json6String7compareERKS1_(const SceJson2::String* self, const SceJson2::String* other);
+void APS5_VABI _ZN3sce4Json5ArrayC1Ev(SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(SceJson2::Array* self, const SceJson2::Array* other);
+void APS5_VABI _ZN3sce4Json5ArrayD1Ev(SceJson2::Array* self);
+SceJson2::Array* APS5_VABI _ZN3sce4Json5ArrayaSERKS1_(SceJson2::Array* self, const SceJson2::Array* other);
+void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(SceJson2::Array* self, const SceJson2::Value* value);
+SceJson2::ArrayIterator* APS5_VABI _ZNK3sce4Json5Array5beginEv(SceJson2::ArrayIterator* result, const SceJson2::Array* self);
+SceJson2::ArrayIterator* APS5_VABI _ZNK3sce4Json5Array3endEv(SceJson2::ArrayIterator* result, const SceJson2::Array* self);
+bool APS5_VABI _ZNK3sce4Json5Array5emptyEv(const SceJson2::Array* self);
+std::size_t APS5_VABI _ZNK3sce4Json5Array4sizeEv(const SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5Array5clearEv(SceJson2::Array* self);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array5frontEv(const SceJson2::Array* self);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array4backEv(const SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5Array9pop_frontEv(SceJson2::Array* self);
+void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(SceJson2::ArrayIterator* self);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEv(SceJson2::ArrayIterator* self);
+SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array8iteratordeEv(const SceJson2::ArrayIterator* self);
+SceJson2::Value* APS5_VABI _ZNK3sce4Json5Array8iteratorptEv(const SceJson2::ArrayIterator* self);
+bool APS5_VABI _ZNK3sce4Json5Array8iteratorneERKS2_(const SceJson2::ArrayIterator* self, const SceJson2::ArrayIterator* other);
+void APS5_VABI _ZN3sce4Json5Array8iteratorC1ERKS2_(SceJson2::ArrayIterator* self, const SceJson2::ArrayIterator* other);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iterator7advanceEm(SceJson2::ArrayIterator* self, std::size_t count);
+void APS5_VABI _ZN3sce4Json6ObjectC1Ev(SceJson2::Object* self);
+void APS5_VABI _ZN3sce4Json6ObjectC1ERKS1_(SceJson2::Object* self, const SceJson2::Object* other);
+void APS5_VABI _ZN3sce4Json6ObjectD1Ev(SceJson2::Object* self);
+SceJson2::Object* APS5_VABI _ZN3sce4Json6ObjectaSERKS1_(SceJson2::Object* self, const SceJson2::Object* other);
+void APS5_VABI _ZN3sce4Json6Object5clearEv(SceJson2::Object* self);
+SceJson2::Value* APS5_VABI _ZN3sce4Json6ObjectixERKNS0_6StringE(SceJson2::Object* self, const SceJson2::String* key);
+SceJson2::ObjectIterator* APS5_VABI _ZNK3sce4Json6Object5beginEv(SceJson2::ObjectIterator* result, const SceJson2::Object* self);
+SceJson2::ObjectIterator* APS5_VABI _ZNK3sce4Json6Object3endEv(SceJson2::ObjectIterator* result, const SceJson2::Object* self);
+void APS5_VABI _ZN3sce4Json6Object8iteratorD1Ev(SceJson2::ObjectIterator* self);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEv(SceJson2::ObjectIterator* self);
+SceJson2::Pair* APS5_VABI _ZNK3sce4Json6Object8iteratordeEv(const SceJson2::ObjectIterator* self);
+SceJson2::Pair* APS5_VABI _ZNK3sce4Json6Object8iteratorptEv(const SceJson2::ObjectIterator* self);
+SceJson2::ObjectIterator* APS5_VABI _ZNK3sce4Json6Object4findERKNS0_6StringE(SceJson2::ObjectIterator* result, const SceJson2::Object* self, const SceJson2::String* key);
+bool APS5_VABI _ZNK3sce4Json6Object8iteratoreqERKS2_(const SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+bool APS5_VABI _ZNK3sce4Json6Object8iteratorneERKS2_(const SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+void APS5_VABI _ZN3sce4Json6Object8iteratorC1ERKS2_(SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iterator7advanceEm(SceJson2::ObjectIterator* self, std::size_t count);
+bool APS5_VABI _ZNK3sce4Json6Object5emptyEv(const SceJson2::Object* self);
+std::size_t APS5_VABI _ZNK3sce4Json6Object4sizeEv(const SceJson2::Object* self);
+void APS5_VABI _ZN3sce4Json6Object5eraseERKNS0_6StringE(SceJson2::Object* self, const SceJson2::String* key);
+void APS5_VABI _ZN3sce4Json5ValueC1Ev(SceJson2::Value* self);
+void APS5_VABI _ZN3sce4Json5ValueC1Eb(SceJson2::Value* self, bool value);
+void APS5_VABI _ZN3sce4Json5ValueC1El(SceJson2::Value* self, std::int64_t value);
+void APS5_VABI _ZN3sce4Json5ValueC1Em(SceJson2::Value* self, std::uint64_t value);
+void APS5_VABI _ZN3sce4Json5ValueC1Ed(SceJson2::Value* self, double value);
+void APS5_VABI _ZN3sce4Json5ValueC1EPKc(SceJson2::Value* self, const char* text);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6StringE(SceJson2::Value* self, const SceJson2::String* text);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_5ArrayE(SceJson2::Value* self, const SceJson2::Array* array);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(SceJson2::Value* self, const SceJson2::Object* object);
+void APS5_VABI _ZN3sce4Json5ValueC1ERKS1_(SceJson2::Value* self, const SceJson2::Value* other);
+void APS5_VABI _ZN3sce4Json5ValueD1Ev(SceJson2::Value* self);
+SceJson2::Value* APS5_VABI _ZN3sce4Json5ValueaSERKS1_(SceJson2::Value* self, const SceJson2::Value* other);
+void APS5_VABI _ZN3sce4Json5Value4swapERS1_(SceJson2::Value* self, SceJson2::Value* other);
+int APS5_VABI _ZN3sce4Json5Value3setENS0_9ValueTypeE(SceJson2::Value* self, SceJson2::ValueType type);
+int APS5_VABI _ZN3sce4Json5Value3setEb(SceJson2::Value* self, bool value);
+int APS5_VABI _ZN3sce4Json5Value3setEl(SceJson2::Value* self, std::int64_t value);
+int APS5_VABI _ZN3sce4Json5Value3setEm(SceJson2::Value* self, std::uint64_t value);
+int APS5_VABI _ZN3sce4Json5Value3setEd(SceJson2::Value* self, double value);
+int APS5_VABI _ZN3sce4Json5Value3setEPKc(SceJson2::Value* self, const char* text);
+int APS5_VABI _ZN3sce4Json5Value3setERKNS0_6StringE(SceJson2::Value* self, const SceJson2::String* text);
+int APS5_VABI _ZN3sce4Json5Value3setERKNS0_5ArrayE(SceJson2::Value* self, const SceJson2::Array* array);
+int APS5_VABI _ZN3sce4Json5Value3setERKNS0_6ObjectE(SceJson2::Value* self, const SceJson2::Object* object);
+int APS5_VABI _ZN3sce4Json5Value3setERKS1_(SceJson2::Value* self, const SceJson2::Value* other);
+SceJson2::ValueType APS5_VABI _ZNK3sce4Json5Value7getTypeEv(const SceJson2::Value* self);
+const bool* APS5_VABI _ZNK3sce4Json5Value10getBooleanEv(const SceJson2::Value* self);
+const std::int64_t* APS5_VABI _ZNK3sce4Json5Value10getIntegerEv(const SceJson2::Value* self);
+const std::uint64_t* APS5_VABI _ZNK3sce4Json5Value11getUIntegerEv(const SceJson2::Value* self);
+const double* APS5_VABI _ZNK3sce4Json5Value7getRealEv(const SceJson2::Value* self);
+const SceJson2::String* APS5_VABI _ZNK3sce4Json5Value9getStringEv(const SceJson2::Value* self);
+const SceJson2::Array* APS5_VABI _ZNK3sce4Json5Value8getArrayEv(const SceJson2::Value* self);
+const SceJson2::Object* APS5_VABI _ZNK3sce4Json5Value9getObjectEv(const SceJson2::Value* self);
+std::size_t APS5_VABI _ZNK3sce4Json5Value5countEv(const SceJson2::Value* self);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5ValueixEPKc(const SceJson2::Value* self, const char* key);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5ValueixEm(const SceJson2::Value* self, std::size_t index);
+void APS5_VABI _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(SceJson2::Value* self, SceJson2::ValueType type);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Value8getValueEm(const SceJson2::Value* self, std::size_t index);
+const SceJson2::Value* APS5_VABI _ZNK3sce4Json5Value8getValueERKNS0_6StringE(const SceJson2::Value* self, const SceJson2::String* key);
+SceJson2::Value* APS5_VABI _ZN3sce4Json5Value10referValueEm(SceJson2::Value* self, std::size_t index);
+SceJson2::Value* APS5_VABI _ZN3sce4Json5Value10referValueERKNS0_6StringE(SceJson2::Value* self, const SceJson2::String* key);
+SceJson2::Array* APS5_VABI _ZN3sce4Json5Value10referArrayEv(SceJson2::Value* self);
+SceJson2::Object* APS5_VABI _ZN3sce4Json5Value11referObjectEv(SceJson2::Value* self);
+int APS5_VABI _ZN3sce4Json5Value9serializeERNS0_6StringE(SceJson2::Value* self, SceJson2::String* out);
+int APS5_VABI _ZNK3sce4Json5Value8toStringERNS0_6StringE(const SceJson2::Value* self, SceJson2::String* out);
+int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(SceJson2::Value* out, SceJson2::ParserReadCallback read, void* context);
+int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(SceJson2::Value* out, const char* text, std::size_t size);
+void APS5_VABI _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(SceJson2::InitParameterRtti* self, void* allocParam, void* userData, std::size_t fileBufferSize);
+void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(SceJson2::InitParameter2* self);
+void APS5_VABI _ZN3sce4Json14InitParameter2C2Ev(SceJson2::InitParameter2* self);
+void APS5_VABI _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(SceJson2::InitParameter2* self, void* allocator, void* userData);
+void APS5_VABI _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(SceJson2::InitParameter2* self, void* allocParam, void* userData);
+void APS5_VABI _ZN3sce4Json14InitParameter217setFileBufferSizeEm(SceJson2::InitParameter2* self, std::size_t size);
+void APS5_VABI _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(SceJson2::InitParameter2* self, std::int32_t type);
+int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(void* self, const SceJson2::InitParameter2* parameter);
+void APS5_VABI _ZN3sce4Json5Value5clearEv(SceJson2::Value* self);
+void APS5_VABI _ZN3sce4Json12MemAllocator11notifyErrorEimPv(void* self, int error, std::size_t size, void* userData);
+void APS5_VABI _ZN3sce4Json5Value21setNullAccessCallBackEPFRKS1_NS0_9ValueTypeEPS2_PvES6_(SceJson2::NullAccessCallback callback, void* context);
+int APS5_VABI _ZN3sce4Json5Value30setElementAccessFailureHandlerEPFviPKNS0_6StringEPKmPKS1_S8_PvES9_(SceJson2::Value* self, SceJson2::ElementAccessFailureHandler handler, void* context);
+int APS5_VABI _ZN3sce4Json5Value22setSpecialFloatHandlerEPFKS1_NS0_12FunctionTypeEdPS2_PvPbES5_(SceJson2::Value* self, SceJson2::SpecialFloatHandler handler, void* context);
+int APS5_VABI _ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(SceJson2::Value* self, SceJson2::TypeMismatchHandler handler, void* context);
+bool APS5_VABI _ZNK3sce4Json5ValuecvbEv(const SceJson2::Value* self);
+void APS5_VABI _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(SceJson2::Pair* self, const SceJson2::String* key, const SceJson2::Value* value);
+void APS5_VABI _ZN3sce4Json6Object4PairD1Ev(SceJson2::Pair* self);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object6insertERKNS1_4PairE(SceJson2::ObjectIterator* result, SceJson2::Object* self, const SceJson2::Pair* pair);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEi(SceJson2::ArrayIterator* result, SceJson2::ArrayIterator* self, int);
+SceJson2::ArrayIterator* APS5_VABI _ZN3sce4Json5Array8iteratoraSERKS2_(SceJson2::ArrayIterator* self, const SceJson2::ArrayIterator* other);
+void APS5_VABI _ZN3sce4Json5Array8iteratorC1Ev(SceJson2::ArrayIterator* self);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEi(SceJson2::ObjectIterator* result, SceJson2::ObjectIterator* self, int);
+SceJson2::ObjectIterator* APS5_VABI _ZN3sce4Json6Object8iteratoraSERKS2_(SceJson2::ObjectIterator* self, const SceJson2::ObjectIterator* other);
+void APS5_VABI _ZN3sce4Json6Object8iteratorC1Ev(SceJson2::ObjectIterator* self);
+void APS5_VABI _ZN3sce4Json6Object4PairC1Ev(SceJson2::Pair* self);
+
+}
diff --git a/core/libs/prx/libSceJson2/libSceJson2.hpp b/core/libs/prx/libSceJson2/libSceJson2.hpp
new file mode 100644
index 0000000000..1ff338c252
--- /dev/null
+++ b/core/libs/prx/libSceJson2/libSceJson2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJson2/include/Api.hpp"
diff --git a/core/libs/prx/libSceJxr/CMakeLists.txt b/core/libs/prx/libSceJxr/CMakeLists.txt
new file mode 100644
index 0000000000..251402ba35
--- /dev/null
+++ b/core/libs/prx/libSceJxr/CMakeLists.txt
@@ -0,0 +1,15 @@
+add_library(libSceJxr SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceJxr PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceJxr)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_jxr_tests ${LIBS_INCLUDE_DIR}/tests/GuestJxr.cpp)
+    target_include_directories(guest_jxr_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_jxr_tests PRIVATE libSceJxr libc)
+    configure_windows_unwind(guest_jxr_tests)
+    add_test(NAME guest_jxr COMMAND guest_jxr_tests)
+    if(WIN32)
+        set_tests_properties(guest_jxr PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceJxr>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceJxr/Export.cpp b/core/libs/prx/libSceJxr/Export.cpp
index 608aedc418..bd2404ed30 100644
--- a/core/libs/prx/libSceJxr/Export.cpp
+++ b/core/libs/prx/libSceJxr/Export.cpp
@@ -1,14 +1,24 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceJxr/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+constexpr std::int64_t WmpErrSuccess = 0;
+}
+
 extern "C" {
 
 APS5_DUMMY_FUN
-int APS5_VABI PKFree_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI PKFree_nid_postfix(void** memory) {
+    if (memory != nullptr) {
+        free_nid_postfix(*memory);
+
+        *memory = nullptr;
+    }
+    return WmpErrSuccess;
 }
 
 int APS5_VABI PixelFormatLookup_nid_postfix(void) {
diff --git a/core/libs/prx/libSceJxr/include/Api.hpp b/core/libs/prx/libSceJxr/include/Api.hpp
new file mode 100644
index 0000000000..b29df513d6
--- /dev/null
+++ b/core/libs/prx/libSceJxr/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+std::int64_t APS5_VABI PKFree_nid_postfix(void** memory);
+int APS5_VABI PixelFormatLookup_nid_postfix(void);
+int APS5_VABI readIS_nid_postfix(void);
+int APS5_VABI writeIS_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceJxr/libSceJxr.hpp b/core/libs/prx/libSceJxr/libSceJxr.hpp
new file mode 100644
index 0000000000..e92de5c284
--- /dev/null
+++ b/core/libs/prx/libSceJxr/libSceJxr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceJxr/include/Api.hpp"
diff --git a/core/libs/prx/libSceJxrParser/libSceJxrParser.hpp b/core/libs/prx/libSceJxrParser/libSceJxrParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceJxrParser/libSceJxrParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceKbEmulate/libSceKbEmulate.hpp b/core/libs/prx/libSceKbEmulate/libSceKbEmulate.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceKbEmulate/libSceKbEmulate.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceKeyboard/Export.cpp b/core/libs/prx/libSceKeyboard/Export.cpp
index c7be6fe290..fce1492046 100644
--- a/core/libs/prx/libSceKeyboard/Export.cpp
+++ b/core/libs/prx/libSceKeyboard/Export.cpp
@@ -1,9 +1,7 @@
+#include "prx/libSceKeyboard/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceKeyboard/include/KeyboardState.hpp"
 
-struct KeyboardDeviceInfo;
-struct KeyboardProcessFocus;
-
 extern "C" {
 
 int APS5_VABI sceKeyboardInit(void) {
@@ -27,6 +25,10 @@ int APS5_VABI sceKeyboardReadState(int32_t handle, KeyboardData* data) {
     return Keyboard::ReadState(handle, data);
 }
 
+int APS5_VABI sceKeyboardGetConnection(std::int32_t handle, bool* connected) {
+    return Keyboard::GetConnection(handle, connected);
+}
+
 int APS5_VABI sceKeyboardGetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint8_t led, std::uint8_t modifierKey, std::uint16_t keyCode, KeyboardCharData* charData) {
     return Keyboard::GetKey2Char(handle, arrange, led, modifierKey, keyCode, charData);
 }
@@ -47,8 +49,7 @@ int APS5_VABI sceKeyboardDeviceOpen(std::uint64_t deviceId, std::int32_t index,
 }
 
 int APS5_VABI sceKeyboardDisconnectAll(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return Keyboard::DisconnectAll();
 }
 
 int APS5_VABI sceKeyboardDisconnectDevice(std::int32_t deviceId) {
@@ -61,11 +62,6 @@ int APS5_VABI sceKeyboardDisconnectPort(std::int32_t first, std::int32_t second)
     return 0;
 }
 
-int APS5_VABI sceKeyboardGetConnection(std::int32_t handle, bool* connected) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKeyboardGetDeviceInfo(std::int32_t deviceId, KeyboardDeviceInfo* info) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceKeyboard/include/Api.hpp b/core/libs/prx/libSceKeyboard/include/Api.hpp
new file mode 100644
index 0000000000..a44cb9ca83
--- /dev/null
+++ b/core/libs/prx/libSceKeyboard/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct KeyboardDeviceInfo;
+
+struct KeyboardProcessFocus;
+
+extern "C" {
+
+int APS5_VABI sceKeyboardInit(void);
+int APS5_VABI sceKeyboardOpen(int userId, int32_t type, int32_t index, const void* param);
+int APS5_VABI sceKeyboardClose(int32_t handle);
+int APS5_VABI sceKeyboardRead(int32_t handle, KeyboardData* data, int32_t num);
+int APS5_VABI sceKeyboardReadState(int32_t handle, KeyboardData* data);
+int APS5_VABI sceKeyboardGetConnection(std::int32_t handle, bool* connected);
+int APS5_VABI sceKeyboardGetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint8_t led, std::uint8_t modifierKey, std::uint16_t keyCode, KeyboardCharData* charData);
+int APS5_VABI sceKeyboardConnectPort(std::int32_t first, std::int32_t second);
+int APS5_VABI sceKeyboardDebugGetDeviceId(std::int32_t handle, std::int32_t* deviceId);
+int APS5_VABI sceKeyboardDeviceOpen(std::uint64_t deviceId, std::int32_t index, std::uint32_t options);
+int APS5_VABI sceKeyboardDisconnectAll(void);
+int APS5_VABI sceKeyboardDisconnectDevice(std::int32_t deviceId);
+int APS5_VABI sceKeyboardDisconnectPort(std::int32_t first, std::int32_t second);
+int APS5_VABI sceKeyboardGetDeviceInfo(std::int32_t deviceId, KeyboardDeviceInfo* info);
+int APS5_VABI sceKeyboardGetHandle(std::int32_t userId, std::int32_t type, std::int32_t index);
+int APS5_VABI sceKeyboardMbusInit(void);
+int APS5_VABI sceKeyboardPadEmulateClose(void);
+int APS5_VABI sceKeyboardPadEmulateOpen(void);
+int APS5_VABI sceKeyboardSetProcessFocus(const KeyboardProcessFocus* focus);
+int APS5_VABI sceKeyboardSetProcessPrivilege(std::uint8_t privilege);
+int APS5_VABI sceDbgKeyboardClose();
+int APS5_VABI sceDbgKeyboardGetKey2Char();
+int APS5_VABI sceDbgKeyboardInit();
+int APS5_VABI sceDbgKeyboardOpen();
+int APS5_VABI sceDbgKeyboardRead();
+int APS5_VABI sceDbgKeyboardReadState();
+
+}
diff --git a/core/libs/prx/libSceKeyboard/include/KeyboardState.hpp b/core/libs/prx/libSceKeyboard/include/KeyboardState.hpp
index 11c32a5447..3552af3153 100644
--- a/core/libs/prx/libSceKeyboard/include/KeyboardState.hpp
+++ b/core/libs/prx/libSceKeyboard/include/KeyboardState.hpp
@@ -18,6 +18,8 @@ int Open(int userId, std::int32_t type, std::int32_t index);
 int Close(std::int32_t handle);
 int Read(std::int32_t handle, KeyboardData* data, std::int32_t num);
 int ReadState(std::int32_t handle, KeyboardData* data);
+int GetConnection(std::int32_t handle, bool* connected);
+int DisconnectAll();
 int GetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint32_t led, std::uint32_t modifierKey, std::uint16_t keyCode, KeyboardCharData* charData);
 void Publish(const KeyboardInputEvent& event);
 }
diff --git a/core/libs/prx/libSceKeyboard/libSceKeyboard.hpp b/core/libs/prx/libSceKeyboard/libSceKeyboard.hpp
new file mode 100644
index 0000000000..8ab2bf1b0d
--- /dev/null
+++ b/core/libs/prx/libSceKeyboard/libSceKeyboard.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceKeyboard/include/Api.hpp"
diff --git a/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp b/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
index bd9cf7d8f8..954040b147 100644
--- a/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
+++ b/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
@@ -154,6 +154,23 @@ int ReadState(std::int32_t handle, KeyboardData* data) {
     return KEYBOARD_OK;
 }
 
+int GetConnection(std::int32_t handle, bool* isConnected) {
+    std::lock_guard lock(keyboardMutex);
+    if (!initialized) return KEYBOARD_ERROR_NOT_INITIALIZED;
+    if (handle != KEYBOARD_HANDLE || !opened) return KEYBOARD_ERROR_INVALID_HANDLE;
+    if (isConnected == nullptr) return KEYBOARD_ERROR_INVALID_ARG;
+    *isConnected = connected;
+    return KEYBOARD_OK;
+}
+
+int DisconnectAll() {
+    KeyboardInputEvent event{};
+    event.connectionChange = true;
+    event.connected = false;
+    Publish(event);
+    return KEYBOARD_OK;
+}
+
 int GetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint32_t ledState, std::uint32_t modifierKey, std::uint16_t keyCode, KeyboardCharData* charData) {
     {
         std::lock_guard lock(keyboardMutex);
diff --git a/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp b/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
index 7c97932bff..56b97a8d39 100644
--- a/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
+++ b/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceKeyboard/include/Api.hpp"
 #include "prx/libSceKeyboard/include/keyboard_structs.h"
 #include "prx/libSceKeyboard/include/KeyboardState.hpp"
 #include "prx/libSceVideoOut/include/KeyboardInput.hpp"
@@ -7,17 +8,6 @@
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceKeyboardInit(void);
-int APS5_VABI sceKeyboardOpen(int, std::int32_t, std::int32_t, const void*);
-int APS5_VABI sceKeyboardClose(std::int32_t);
-int APS5_VABI sceKeyboardRead(std::int32_t, KeyboardData*, std::int32_t);
-int APS5_VABI sceKeyboardReadState(std::int32_t, KeyboardData*);
-int APS5_VABI sceKeyboardGetKey2Char(std::int32_t, std::int32_t, std::uint8_t, std::uint8_t, std::uint16_t, KeyboardCharData*);
-int APS5_VABI sceKeyboardConnectPort(void);
-int APS5_VABI sceKeyboardDisconnectAll(void);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static SDL_Event KeyEvent(Uint32 type, SDL_Scancode scancode, Uint16 mod = 0, Uint8 repeat = 0) {
@@ -44,14 +34,20 @@ static std::uint16_t Jis(std::uint32_t modifierKey, std::uint16_t keyCode, std::
 int main() {
     KeyboardData data[16]{};
     KeyboardCharData charData{};
+    bool connected = false;
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_ERROR_NOT_INITIALIZED);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_NOT_INITIALIZED);
     Require(sceKeyboardInit() == KEYBOARD_OK);
     Require(sceKeyboardInit() == KEYBOARD_OK);
     Require(sceKeyboardOpen(1, 0, 1, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardOpen(1, 1, 0, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, KEYBOARD_ARRANGEMENT_101, 0, 0, 0x04, &charData) == KEYBOARD_ERROR_INVALID_HANDLE);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_HANDLE);
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_ERROR_ALREADY_OPENED);
+    Require(sceKeyboardGetConnection(42, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_OK && connected);
     Require(sceKeyboardRead(42, data, 1) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardRead(KEYBOARD_HANDLE, nullptr, 1) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 17) == KEYBOARD_ERROR_INVALID_ARG);
@@ -96,9 +92,11 @@ int main() {
     window.window.event = SDL_WINDOWEVENT_CLOSE;
     input.HandleEvent(window, 7);
     Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 1 && !data[0].connected && data[0].length == 1 && data[0].key_code[0] == 0);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_OK && !connected);
     window.window.event = SDL_WINDOWEVENT_FOCUS_GAINED;
     input.HandleEvent(window, 7);
     Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 1 && data[0].connected);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_OK && connected);
 
     for (std::uint16_t key = 0x04; key < 0x04 + 20; ++key) {
         KeyboardInputEvent press{};
@@ -143,26 +141,39 @@ int main() {
     Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, 2, 0, 0, 0x04, &charData) == KEYBOARD_ERROR_INVALID_ARG);
 
     Require(sceKeyboardClose(KEYBOARD_HANDLE) == KEYBOARD_OK);
+    Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardReadState(KEYBOARD_HANDLE, data) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardClose(KEYBOARD_HANDLE) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_HANDLE);
     Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 1 && data[0].length == 1 && data[0].key_code[0] == 0);
+    Require(data[0].connected);
+    KeyboardInputEvent pressed{};
+    pressed.keyCode = 0x04;
+    pressed.pressed = true;
+    KeyboardPublishInput_nid_postfix(pressed);
+    Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 1 && data[0].key_code[0] == 0x04);
+    Require(sceKeyboardDisconnectAll() == KEYBOARD_OK);
+    Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 1 && !data[0].connected && data[0].length == 1 && data[0].key_code[0] == 0);
+    Require(sceKeyboardReadState(KEYBOARD_HANDLE, data) == KEYBOARD_OK && !data[0].connected && data[0].key_code[0] == 0);
+    Require(sceKeyboardDisconnectAll() == KEYBOARD_OK);
+    Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 0);
+    pressed.keyCode = 0x05;
+    KeyboardPublishInput_nid_postfix(pressed);
+    Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 0);
+    window.window.event = SDL_WINDOWEVENT_FOCUS_LOST;
+    input.HandleEvent(window, 7);
+    window.window.event = SDL_WINDOWEVENT_FOCUS_GAINED;
+    input.HandleEvent(window, 7);
+    Require(sceKeyboardRead(KEYBOARD_HANDLE, data, 1) == 1 && data[0].connected);
     Require(sceKeyboardClose(KEYBOARD_HANDLE) == KEYBOARD_OK);
 
     bool threwConnect = false;
     try {
-        sceKeyboardConnectPort();
+        sceKeyboardConnectPort(0, 0);
+
     } catch (const std::runtime_error&) {
         threwConnect = true;
     }
     Require(threwConnect);
-
-    bool threwDisconnect = false;
-    try {
-        sceKeyboardDisconnectAll();
-    } catch (const std::runtime_error&) {
-        threwDisconnect = true;
-    }
-    Require(threwDisconnect);
 }
diff --git a/core/libs/prx/libSceLibcInternal/CMakeLists.txt b/core/libs/prx/libSceLibcInternal/CMakeLists.txt
index 1297f6abcf..8087b230e5 100644
--- a/core/libs/prx/libSceLibcInternal/CMakeLists.txt
+++ b/core/libs/prx/libSceLibcInternal/CMakeLists.txt
@@ -3,10 +3,24 @@ target_include_directories(libSceLibcInternal PRIVATE ${LIBS_INCLUDE_DIR})
 set_source_files_properties(UserContext.cpp PROPERTIES COMPILE_OPTIONS -fno-omit-frame-pointer)
 target_link_libraries(libSceLibcInternal PRIVATE ${CMAKE_DL_LIBS})
 target_sources(libSceLibcInternal PRIVATE Directory.cpp)
+target_sources(libSceLibcInternal PRIVATE InitOnce.cpp)
+if(BUILD_TESTING)
+    add_test_executable(guest_init_once_tests ${LIBS_INCLUDE_DIR}/tests/GuestInitOnce.cpp)
+    target_include_directories(guest_init_once_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_init_once_tests PRIVATE libSceLibcInternal libkernel libc)
+    configure_windows_unwind(guest_init_once_tests)
+    add_test(NAME guest_init_once COMMAND guest_init_once_tests)
+    set_tests_properties(guest_init_once PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_init_once PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
+    endif()
+endif()
 target_sources(libSceLibcInternal PRIVATE Err.cpp)
 configure_windows_unwind(libSceLibcInternal)
 target_sources(libSceLibcInternal PRIVATE FilesystemStatistics.cpp PathStatistics.cpp)
 target_sources(libSceLibcInternal PRIVATE Inet.cpp)
+target_sources(libSceLibcInternal PRIVATE Filesystem.cpp)
 
 if(BUILD_TESTING)
     add_test_executable(guest_statvfs_tests ${LIBS_INCLUDE_DIR}/tests/GuestStatvfs.cpp)
@@ -149,3 +163,15 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
     endif()
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libc_filesystem_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcFilesystem.cpp)
+    target_include_directories(guest_libc_filesystem_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libc_filesystem_tests PRIVATE libSceLibcInternal libkernel libc)
+    configure_windows_unwind(guest_libc_filesystem_tests)
+    add_test(NAME guest_libc_filesystem COMMAND guest_libc_filesystem_tests)
+    if(WIN32)
+        set_tests_properties(guest_libc_filesystem PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceLibcInternal/Directory.cpp b/core/libs/prx/libSceLibcInternal/Directory.cpp
index 48a1614e85..ffb52e8614 100644
--- a/core/libs/prx/libSceLibcInternal/Directory.cpp
+++ b/core/libs/prx/libSceLibcInternal/Directory.cpp
@@ -1,12 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include <cerrno>
 #include <cstdint>
 
-extern "C" int APS5_VABI close_nid_postfix(int d);
-extern "C" int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 extern "C" void* APS5_VABI fdopendir_nid_postfix(int fd) {
     constexpr int SetDescriptorFlags = 2;
     constexpr int CloseOnExec = 1;
diff --git a/core/libs/prx/libSceLibcInternal/Err.cpp b/core/libs/prx/libSceLibcInternal/Err.cpp
index f16dd24ca1..3e67760ef9 100644
--- a/core/libs/prx/libSceLibcInternal/Err.cpp
+++ b/core/libs/prx/libSceLibcInternal/Err.cpp
@@ -1,18 +1,14 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdarg>
 
-using ErrExit = void (APS5_VABI*)(int);
-
 extern "C" {
 extern const char* __progname_nid_postfix;
-int APS5_VABI vfprintf_nid_postfix(FileStream* stream, const char* format, VaList* args);
-int APS5_VABI fprintf_nid_postfix(FileStream* stream, const char* format, ...);
-int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
-char* APS5_VABI strerror_nid_postfix(int error);
-int* APS5_VABI __error_nid_postfix();
+
 }
 
 namespace {
@@ -32,8 +28,10 @@ const char* ProgramName() {
 void Report(const char* format, VaList* args, const int* code) {
     FileStream* const stream = ErrFile();
     fprintf_nid_postfix(stream, "%s: ", ProgramName());
+
     if (format != nullptr) {
         vfprintf_nid_postfix(stream, format, args);
+
         if (code != nullptr) fputs_nid_postfix(": ", stream);
     }
     if (code != nullptr) fprintf_nid_postfix(stream, "%s\n", strerror_nid_postfix(*code));
@@ -73,6 +71,7 @@ void APS5_VABI vwarnc_nid_postfix(int code, const char* format, VaList* args) {
 
 void APS5_VABI vwarn_nid_postfix(const char* format, VaList* args) {
     vwarnc_nid_postfix(*__error_nid_postfix(), format, args);
+
 }
 
 void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args) {
@@ -86,6 +85,7 @@ void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args) {
 
 [[noreturn]] void APS5_VABI verr_nid_postfix(int status, const char* format, VaList* args) {
     verrc_nid_postfix(status, *__error_nid_postfix(), format, args);
+
 }
 
 [[noreturn]] void APS5_VABI verrx_nid_postfix(int status, const char* format, VaList* args) {
@@ -97,6 +97,7 @@ void APS5_VABI warnc_nid_postfix(int code, const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     vwarnc_nid_postfix(code, format, reinterpret_cast<VaList*>(args));
+
     APS5_ERR_VA_END(args);
 }
 
@@ -105,6 +106,15 @@ void APS5_VABI warn_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     vwarnc_nid_postfix(code, format, reinterpret_cast<VaList*>(args));
+
+    APS5_ERR_VA_END(args);
+}
+
+void APS5_VABI _warn_nid_postfix(const char* format, ...) {
+    APS5_ERR_VA_LIST args;
+    APS5_ERR_VA_START(args, format);
+    vwarn_nid_postfix(format, reinterpret_cast<VaList*>(args));
+
     APS5_ERR_VA_END(args);
 }
 
@@ -112,6 +122,7 @@ void APS5_VABI warnx_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     vwarnx_nid_postfix(format, reinterpret_cast<VaList*>(args));
+
     APS5_ERR_VA_END(args);
 }
 
@@ -119,6 +130,7 @@ void APS5_VABI warnx_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     verrc_nid_postfix(status, code, format, reinterpret_cast<VaList*>(args));
+
 }
 
 [[noreturn]] void APS5_VABI err_nid_postfix(int status, const char* format, ...) {
@@ -126,12 +138,21 @@ void APS5_VABI warnx_nid_postfix(const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     verrc_nid_postfix(status, code, format, reinterpret_cast<VaList*>(args));
+
+}
+
+[[noreturn]] void APS5_VABI _err_nid_postfix(int status, const char* format, ...) {
+    APS5_ERR_VA_LIST args;
+    APS5_ERR_VA_START(args, format);
+    verr_nid_postfix(status, format, reinterpret_cast<VaList*>(args));
+
 }
 
 [[noreturn]] void APS5_VABI errx_nid_postfix(int status, const char* format, ...) {
     APS5_ERR_VA_LIST args;
     APS5_ERR_VA_START(args, format);
     verrx_nid_postfix(status, format, reinterpret_cast<VaList*>(args));
+
 }
 
 }
diff --git a/core/libs/prx/libSceLibcInternal/Export.cpp b/core/libs/prx/libSceLibcInternal/Export.cpp
index 7ca113639e..d018c80566 100644
--- a/core/libs/prx/libSceLibcInternal/Export.cpp
+++ b/core/libs/prx/libSceLibcInternal/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/HeapDiagnostics.hpp"
@@ -13,14 +15,10 @@
 #include <dlfcn.h>
 #endif
 
-extern "C" void APS5_VABI sceKernelSetThreadDtors(thread_dtors_func_t dtors);
-extern "C" int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
 extern "C" const char* __progname_nid_postfix;
 
 namespace {
 
-using ThreadDestructorFunction = void (APS5_VABI*)(void*);
-
 struct ThreadDestructor {
     ThreadDestructorFunction function;
     void* object;
@@ -67,7 +65,7 @@ void APS5_VABI RunThreadDestructors_nid_no_patch() {
 bool FindDsoModule(const void* dsoSymbol, KernelModule& handle) {
     ModuleInfoEx info{};
     info.st_size = sizeof(ModuleInfoEx);
-    if (sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(dsoSymbol), 2, &info) != 0) {
+    if (sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(dsoSymbol), 1, &info) != 0) {
         handle = 0;
         return false;
     }
@@ -95,6 +93,7 @@ bool ForceThreadDestructorPass(KernelModule handle) {
 void RegisterThreadExitHook() {
     [[maybe_unused]] static const bool registered = [] {
         sceKernelSetThreadDtors(RunThreadDestructors_nid_no_patch);
+
         return true;
     }();
 }
@@ -109,6 +108,10 @@ const char* APS5_VABI getprogname_nid_postfix() {
     return __progname_nid_postfix;
 }
 
+const char* APS5_VABI _getprogname_nid_postfix() {
+    return getprogname_nid_postfix();
+}
+
 void APS5_VABI __cxa_finalize_nid_postfix(void* dsoHandle) {
     CxaFinalize_nid_no_patch(dsoHandle);
 }
diff --git a/core/libs/prx/libSceLibcInternal/FileTime.cpp b/core/libs/prx/libSceLibcInternal/FileTime.cpp
index a3bbfe8edc..5b98207e49 100644
--- a/core/libs/prx/libSceLibcInternal/FileTime.cpp
+++ b/core/libs/prx/libSceLibcInternal/FileTime.cpp
@@ -1,16 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 
-struct LibcUtimbuf {
-    std::int64_t actime;
-    std::int64_t modtime;
-};
 static_assert(sizeof(LibcUtimbuf) == 16);
 
-extern "C" int APS5_VABI utimes_nid_postfix(const char*, const KernelTimeval*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 extern "C" int APS5_VABI utime_nid_postfix(const char* path, const LibcUtimbuf* times) {
     int* const error = __error_nid_postfix();
     const int saved = *error;
diff --git a/core/libs/prx/libSceLibcInternal/Filesystem.cpp b/core/libs/prx/libSceLibcInternal/Filesystem.cpp
new file mode 100644
index 0000000000..36341ff483
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/Filesystem.cpp
@@ -0,0 +1,183 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/GuestDirectory.hpp"
+#include "prx/libc/include/General.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+
+namespace {
+
+constexpr std::size_t NameCapacity = 260;
+constexpr std::size_t CurrentCapacity = 256;
+constexpr int NoSuchFile = 2;
+constexpr int Exists = 17;
+constexpr int NotDirectory = 20;
+constexpr int Invalid = 22;
+constexpr int NameTooLong = 63;
+constexpr std::uint16_t DefaultDirectoryMode = 0777;
+constexpr std::uint16_t PermissionBits = 07777;
+
+enum FileType : int {
+    TypeNotFound = -1,
+    TypeNone = 0,
+    TypeRegular = 1,
+    TypeDirectory = 2,
+    TypeSymlink = 3,
+    TypeBlock = 4,
+    TypeCharacter = 5,
+    TypeFifo = 6,
+    TypeSocket = 7,
+    TypeUnknown = 8,
+};
+
+int& GuestErrno() {
+    return *__error_nid_postfix();
+}
+
+int TypeOfMode(std::uint16_t mode) {
+    switch (mode & 0170000) {
+        case 0010000: return TypeFifo;
+        case 0020000: return TypeCharacter;
+        case 0040000: return TypeDirectory;
+        case 0060000: return TypeBlock;
+        case 0100000: return TypeRegular;
+        case 0120000: return TypeSymlink;
+        case 0140000: return TypeSocket;
+        default: return TypeUnknown;
+    }
+}
+
+int StatType(const char* path, int* perms, int* error) {
+    GuestErrno() = 0;
+    FileStat status{};
+    int type;
+    if (stat_nid_postfix(path, &status) == 0) {
+        GuestErrno() = 0;
+        if (perms) *perms = status.st_mode & PermissionBits;
+        type = TypeOfMode(status.st_mode);
+    } else {
+        const int code = GuestErrno();
+        type = code == NoSuchFile || code == NotDirectory || code == Invalid || code == NameTooLong ? TypeNotFound : TypeNone;
+    }
+    if (error) *error = GuestErrno();
+    return type;
+}
+
+void CopyName(char* target, const char* source) {
+    std::size_t length = 0;
+    while (length < NameCapacity - 1 && source[length] != '\0') {
+        target[length] = source[length];
+        ++length;
+    }
+    target[length] = '\0';
+}
+
+bool IsDotEntry(const char* name) {
+    return name[0] == '.' && (name[1] == '\0' || (name[1] == '.' && name[2] == '\0'));
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI _ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error) {
+    return StatType(path, perms, error);
+}
+
+int APS5_VABI _ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error) {
+    return StatType(path, perms, error);
+}
+
+std::uint64_t APS5_VABI _ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(const char* path, int* error) {
+    FileStat status{};
+    if (stat_nid_postfix(path, &status) != 0) {
+        if (error) *error = GuestErrno();
+        return UINT64_MAX;
+    }
+    return static_cast<std::uint64_t>(status.st_size);
+}
+
+int APS5_VABI _ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(const char* path, std::int64_t* seconds, std::int64_t* nanoseconds) {
+    FileStat status{};
+    if (stat_nid_postfix(path, &status) != 0) return GuestErrno();
+    *seconds = status.st_mtim.tv_sec;
+    *nanoseconds = status.st_mtim.tv_nsec;
+    return 0;
+}
+
+int APS5_VABI _ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(const char* path, const char* existing) {
+    GuestErrno() = 0;
+    std::uint16_t mode = DefaultDirectoryMode;
+    if (existing) {
+        FileStat status{};
+        if (stat_nid_postfix(existing, &status) != 0) return -GuestErrno();
+        mode = status.st_mode;
+    }
+    if (mkdir_nid_postfix(path, mode) == 0) return 1;
+    if (GuestErrno() == Exists) return 0;
+    return -GuestErrno();
+}
+
+bool APS5_VABI _ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(const char* path) {
+    return rmdir_nid_postfix(path) == 0;
+}
+
+int APS5_VABI _ZNSt10filesystem7_UnlinkEPKc_nid_postfix(const char* path) {
+    GuestErrno() = 0;
+    return unlink_nid_postfix(path) == 0 ? 0 : GuestErrno();
+}
+
+int APS5_VABI _ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(const char* path, int perms) {
+    return chmod_nid_postfix(path, static_cast<std::uint16_t>(perms));
+}
+
+bool APS5_VABI _ZNSt10filesystem12_Current_getERA260_c_nid_postfix(char* target) {
+    char current[CurrentCapacity];
+    const bool found = getcwd_nid_postfix(current, sizeof(current)) != nullptr;
+    if (found) CopyName(target, current);
+    else target[0] = '\0';
+    return found;
+}
+
+char* APS5_VABI _ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(char* target, void* handle, int* type) {
+    *type = TypeUnknown;
+    GuestDirectoryEntry entry{};
+    GuestDirectoryEntry* result = nullptr;
+    while (readdir_r_nid_postfix(handle, &entry, &result) == 0 && result) {
+        if (IsDotEntry(entry.name)) continue;
+        CopyName(target, entry.name);
+        return target;
+    }
+    target[0] = '\0';
+    return target;
+}
+
+void* APS5_VABI _ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(char* target, const char* path, int* error, int* type) {
+    GuestErrno() = 0;
+    void* handle = opendir_nid_postfix(path);
+    if (!handle) {
+        *error = GuestErrno();
+        return nullptr;
+    }
+    *error = 0;
+    _ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(target, handle, type);
+    if (target[0] != '\0') return handle;
+    closedir_nid_postfix(handle);
+    return nullptr;
+}
+
+int APS5_VABI _ZNSt10filesystem10_Close_dirEPv_nid_postfix(void* handle) {
+    return closedir_nid_postfix(handle);
+}
+
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcSt10error_code_nid_postfix() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcRKNS_4pathESt10error_code_nid_postfix() {
+    NotImplemented_nid_no_patch(__func__);
+}
+
+}
diff --git a/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp b/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp
index 8cb50f1eca..998c338235 100644
--- a/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp
+++ b/core/libs/prx/libSceLibcInternal/FilesystemStatistics.cpp
@@ -1,10 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceLibcInternal/include/Statvfs.hpp"
 #include <cstring>
 
-extern "C" int APS5_VABI _fstatfs_nid_postfix(int, KernelStatfs*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 extern "C" int APS5_VABI fstatvfs_nid_postfix(int descriptor, LibcStatvfs* output) {
     int* const error = __error_nid_postfix();
     const int saved = *error;
diff --git a/core/libs/prx/libSceLibcInternal/Getopt.cpp b/core/libs/prx/libSceLibcInternal/Getopt.cpp
index 80645072b4..43248491d9 100644
--- a/core/libs/prx/libSceLibcInternal/Getopt.cpp
+++ b/core/libs/prx/libSceLibcInternal/Getopt.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -7,12 +9,6 @@
 #include <string>
 #include <string_view>
 
-struct GuestOption {
-    const char* name;
-    int hasArgument;
-    int* flag;
-    int value;
-};
 static_assert(sizeof(GuestOption) == 32);
 static_assert(offsetof(GuestOption, hasArgument) == 8);
 static_assert(offsetof(GuestOption, flag) == 16);
@@ -21,7 +17,6 @@ static_assert(offsetof(GuestOption, value) == 24);
 extern "C" {
 extern const char* __progname_nid_postfix;
 extern FileStream* __stderrp_nid_postfix;
-char* APS5_VABI getenv_nid_postfix(const char* name);
 
 int opterr_nid_postfix = 1;
 int optind_nid_postfix = 1;
diff --git a/core/libs/prx/libSceLibcInternal/Inet.cpp b/core/libs/prx/libSceLibcInternal/Inet.cpp
index 90996aacf6..1dd8ad853d 100644
--- a/core/libs/prx/libSceLibcInternal/Inet.cpp
+++ b/core/libs/prx/libSceLibcInternal/Inet.cpp
@@ -1,12 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-const char* APS5_VABI __inet_ntop_nid_postfix(int family, const void* source, char* destination, std::uint32_t capacity);
-}
-
 namespace {
 
 constexpr int AddressFamilyInet = 2;
@@ -94,12 +92,18 @@ std::uint32_t APS5_VABI inet_addr_nid_postfix(const char* text) {
 
 char* APS5_VABI inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size) {
     __inet_ntop_nid_postfix(AddressFamilyInet, &address, buffer, size);
+
     return buffer;
 }
 
+char* APS5_VABI __inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size) {
+    return inet_ntoa_r_nid_postfix(address, buffer, size);
+}
+
 char* APS5_VABI inet_ntoa_nid_postfix(std::uint32_t address) {
     std::memcpy(g_ntoaBuffer, "[inet_ntoa error]", sizeof(g_ntoaBuffer));
     __inet_ntop_nid_postfix(AddressFamilyInet, &address, g_ntoaBuffer, sizeof(g_ntoaBuffer));
+
     return g_ntoaBuffer;
 }
 
diff --git a/core/libs/prx/libSceLibcInternal/InitOnce.cpp b/core/libs/prx/libSceLibcInternal/InitOnce.cpp
new file mode 100644
index 0000000000..94d59b1ce7
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/InitOnce.cpp
@@ -0,0 +1,56 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <atomic>
+#include <climits>
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+constexpr std::uintptr_t OnceIdle = 0;
+constexpr std::uintptr_t OnceRunning = 1;
+constexpr std::uintptr_t OnceDone = 2;
+constexpr unsigned long InitFailed = 4;
+
+std::atomic<std::uintptr_t>& OnceState(void** once) {
+    return *reinterpret_cast<std::atomic<std::uintptr_t>*>(once);
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI __std_init_once_begin_initialize_clr_nid_postfix(void** once, unsigned long flags, int* pending, void** context) {
+    (void)flags;
+    (void)context;
+    auto& state = OnceState(once);
+    for (;;) {
+        std::uintptr_t current = state.load(std::memory_order_acquire);
+        if (current == OnceIdle) {
+            if (state.compare_exchange_weak(current, OnceRunning, std::memory_order_acq_rel)) {
+                *pending = 1;
+                return 1;
+            }
+            continue;
+        }
+        if (current == OnceDone) {
+            *pending = 0;
+            return 1;
+        }
+        sceKernelSyncOnAddressWait(reinterpret_cast<std::uint32_t*>(once), static_cast<std::uint32_t>(OnceRunning), nullptr, nullptr);
+    }
+}
+
+int APS5_VABI __std_init_once_complete_clr_nid_postfix(void** once, unsigned long flags, void* context) {
+    (void)context;
+    OnceState(once).store(flags == InitFailed ? OnceIdle : OnceDone, std::memory_order_release);
+    sceKernelSyncOnAddressWake(once, INT_MAX);
+    return 1;
+}
+
+[[noreturn]] void APS5_VABI __std_init_once_link_alternate_names_and_abort_nid_postfix() {
+    std::abort();
+}
+
+}
diff --git a/core/libs/prx/libSceLibcInternal/PathStatistics.cpp b/core/libs/prx/libSceLibcInternal/PathStatistics.cpp
index c66f3dcc3b..bca817dd44 100644
--- a/core/libs/prx/libSceLibcInternal/PathStatistics.cpp
+++ b/core/libs/prx/libSceLibcInternal/PathStatistics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include <cerrno>
 #include <cstdint>
@@ -18,7 +19,6 @@
 #endif
 
 struct LibcStatvfs;
-extern "C" int APS5_VABI fstatvfs_nid_postfix(int, LibcStatvfs*);
 
 namespace {
 int Fail(int error) {
diff --git a/core/libs/prx/libSceLibcInternal/SignalList.cpp b/core/libs/prx/libSceLibcInternal/SignalList.cpp
index d27a5531c4..e33acb01fe 100644
--- a/core/libs/prx/libSceLibcInternal/SignalList.cpp
+++ b/core/libs/prx/libSceLibcInternal/SignalList.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -77,16 +79,16 @@ extern const char* const sys_signame_nid_postfix[32] = {
     "USR2",
 };
 
-std::int64_t APS5_VABI _write_nid_postfix(int descriptor, const void* buffer, std::size_t count);
-
 void APS5_VABI psignal_nid_postfix(unsigned int signal, const char* prefix) {
     const char* const message = signal < 32 ? sys_siglist_nid_postfix[signal] : "Unknown signal";
     if (prefix != nullptr && prefix[0] != 0) {
         _write_nid_postfix(2, prefix, std::strlen(prefix));
         _write_nid_postfix(2, ": ", 2);
+
     }
     _write_nid_postfix(2, message, std::strlen(message));
     _write_nid_postfix(2, "\n", 1);
+
 }
 
 }
diff --git a/core/libs/prx/libSceLibcInternal/Spawn.cpp b/core/libs/prx/libSceLibcInternal/Spawn.cpp
index b40cbc9d10..72e1bfcaae 100644
--- a/core/libs/prx/libSceLibcInternal/Spawn.cpp
+++ b/core/libs/prx/libSceLibcInternal/Spawn.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libSceLibcInternal/include/Spawn.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/General.hpp"
@@ -10,8 +12,6 @@
 #include <system_error>
 #include <utility>
 
-extern "C" char* APS5_VABI getenv_nid_postfix(const char* name);
-
 namespace {
 
 constexpr int NoSuchFile = 2;
diff --git a/core/libs/prx/libSceLibcInternal/UserContext.cpp b/core/libs/prx/libSceLibcInternal/UserContext.cpp
index 3f743af8f4..9ef01bd612 100644
--- a/core/libs/prx/libSceLibcInternal/UserContext.cpp
+++ b/core/libs/prx/libSceLibcInternal/UserContext.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/GuestStacks.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -7,8 +9,6 @@
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" int APS5_VABI setcontext_nid_postfix(const UserUcontext* context);
-
 namespace {
 
 using ContextFunction = void (APS5_VABI*)(std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t);
@@ -26,6 +26,7 @@ extern "C" {
 [[noreturn]] void APS5_VABI Aps5MakecontextFinish_nid_no_patch(UserUcontext* context) {
     if (context->link == nullptr) LibcExit_nid_no_patch(0);
     setcontext_nid_postfix(context->link);
+
     std::abort();
 }
 
@@ -62,6 +63,7 @@ Aps5MakecontextStart_nid_no_patch:
     function(arguments[0], arguments[1], arguments[2], arguments[3], arguments[4], arguments[5]);
     if (context->link == nullptr) LibcExit_nid_no_patch(0);
     setcontext_nid_postfix(context->link);
+
     std::abort();
 }
 #endif
diff --git a/core/libs/prx/libSceLibcInternal/include/Api.hpp b/core/libs/prx/libSceLibcInternal/include/Api.hpp
new file mode 100644
index 0000000000..d10e3f958b
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/include/Api.hpp
@@ -0,0 +1,106 @@
+#pragma once
+
+#include "prx/libSceLibcInternal/include/Statvfs.hpp"
+#include "prx/libSceLibcInternal/include/Spawn.hpp"
+#include "prx/libkernel/System/include/UserContext.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "SceTypes.hpp"
+
+using ErrExit = void (APS5_VABI*)(int);
+
+struct GuestOption {
+    const char* name;
+    int hasArgument;
+    int* flag;
+    int value;
+};
+
+struct LibcUtimbuf {
+    std::int64_t actime;
+    std::int64_t modtime;
+};
+
+using ThreadDestructorFunction = void (APS5_VABI*)(void*);
+
+extern "C" {
+
+void* APS5_VABI fdopendir_nid_postfix(int fd);
+void APS5_VABI err_set_file_nid_postfix(FileStream* stream);
+void APS5_VABI err_set_exit_nid_postfix(ErrExit function);
+void APS5_VABI vwarnc_nid_postfix(int code, const char* format, VaList* args);
+void APS5_VABI vwarn_nid_postfix(const char* format, VaList* args);
+void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args);
+void APS5_VABI warnc_nid_postfix(int code, const char* format, ...);
+void APS5_VABI warn_nid_postfix(const char* format, ...);
+void APS5_VABI _warn_nid_postfix(const char* format, ...);
+void APS5_VABI warnx_nid_postfix(const char* format, ...);
+const char* APS5_VABI getprogname_nid_postfix();
+const char* APS5_VABI _getprogname_nid_postfix();
+void APS5_VABI __cxa_finalize_nid_postfix(void* dsoHandle);
+void APS5_VABI sceLibcHeapGetTraceInfo_nid_postfix(Info* info);
+int APS5_VABI _sceLibcInternalThreadAtexit_nid_postfix(ThreadDestructorFunction destructor, void* object, void* dsoSymbol);
+void APS5_VABI _sceLibcInternalThreadDtors_nid_postfix();
+int APS5_VABI _sceLibcInternalForceTlsDestructor_nid_postfix(KernelModule handle);
+unsigned int APS5_VABI alarm_nid_postfix(unsigned int seconds);
+int APS5_VABI fstatvfs_nid_postfix(int descriptor, LibcStatvfs* output);
+int APS5_VABI utime_nid_postfix(const char* path, const LibcUtimbuf* times);
+int APS5_VABI getopt_nid_postfix(int count, char* const* arguments, const char* options);
+int APS5_VABI getopt_long_nid_postfix(int count, char* const* arguments, const char* options, const GuestOption* longOptions, int* index);
+int APS5_VABI getopt_long_only_nid_postfix(int count, char* const* arguments, const char* options, const GuestOption* longOptions, int* index);
+int APS5_VABI inet_aton_nid_postfix(const char* text, std::uint32_t* address);
+std::uint32_t APS5_VABI inet_addr_nid_postfix(const char* text);
+char* APS5_VABI inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size);
+char* APS5_VABI __inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size);
+char* APS5_VABI inet_ntoa_nid_postfix(std::uint32_t address);
+int APS5_VABI statvfs_nid_postfix(const char* path, LibcStatvfs* output);
+void APS5_VABI psignal_nid_postfix(unsigned int signal, const char* prefix);
+int APS5_VABI posix_spawnattr_init_nid_postfix(PosixSpawnAttributes** attributes);
+int APS5_VABI posix_spawnattr_destroy_nid_postfix(PosixSpawnAttributes** attributes);
+int APS5_VABI posix_spawnattr_setflags_nid_postfix(PosixSpawnAttributes** attributes, std::int16_t flags);
+int APS5_VABI posix_spawnattr_setsigdefault_nid_postfix(PosixSpawnAttributes** attributes, const GuestSignalSet* signalDefault);
+int APS5_VABI posix_spawnattr_getflags_nid_postfix(PosixSpawnAttributes* const* attributes, std::int16_t* flags);
+int APS5_VABI posix_spawnattr_getpgroup_nid_postfix(PosixSpawnAttributes* const* attributes, std::int32_t* processGroup);
+int APS5_VABI posix_spawnattr_getschedparam_nid_postfix(PosixSpawnAttributes* const* attributes, std::int32_t* schedulingParameter);
+int APS5_VABI posix_spawnattr_getschedpolicy_nid_postfix(PosixSpawnAttributes* const* attributes, std::int32_t* schedulingPolicy);
+int APS5_VABI posix_spawnattr_getsigdefault_nid_postfix(PosixSpawnAttributes* const* attributes, GuestSignalSet* signalDefault);
+int APS5_VABI posix_spawnattr_getsigmask_nid_postfix(PosixSpawnAttributes* const* attributes, GuestSignalSet* signalMask);
+int APS5_VABI posix_spawnattr_setpgroup_nid_postfix(PosixSpawnAttributes** attributes, std::int32_t processGroup);
+int APS5_VABI posix_spawnattr_setschedparam_nid_postfix(PosixSpawnAttributes** attributes, const std::int32_t* schedulingParameter);
+int APS5_VABI posix_spawnattr_setschedpolicy_nid_postfix(PosixSpawnAttributes** attributes, std::int32_t schedulingPolicy);
+int APS5_VABI posix_spawnattr_setsigmask_nid_postfix(PosixSpawnAttributes** attributes, const GuestSignalSet* signalMask);
+int APS5_VABI posix_spawn_file_actions_init_nid_postfix(PosixSpawnFileActions** actions);
+int APS5_VABI posix_spawn_file_actions_destroy_nid_postfix(PosixSpawnFileActions** actions);
+int APS5_VABI posix_spawn_file_actions_addopen_nid_postfix(PosixSpawnFileActions** actions, int descriptor, const char* path, int openFlags, std::uint16_t mode);
+int APS5_VABI posix_spawn_file_actions_adddup2_nid_postfix(PosixSpawnFileActions** actions, int descriptor, int newDescriptor);
+int APS5_VABI posix_spawn_file_actions_addclose_nid_postfix(PosixSpawnFileActions** actions, int descriptor);
+int APS5_VABI posix_spawn_nid_postfix(std::int32_t* processId, const char* path, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes, char* const* arguments, char* const* environment);
+int APS5_VABI posix_spawnp_nid_postfix(std::int32_t* processId, const char* file, PosixSpawnFileActions* const* actions, PosixSpawnAttributes* const* attributes, char* const* arguments, char* const* environment);
+void APS5_VABI makecontext_nid_postfix(UserUcontext* context, void (APS5_VABI* start)(), int count, ...);
+
+[[noreturn]] void APS5_VABI verrc_nid_postfix(int status, int code, const char* format, VaList* args);
+[[noreturn]] void APS5_VABI verr_nid_postfix(int status, const char* format, VaList* args);
+[[noreturn]] void APS5_VABI verrx_nid_postfix(int status, const char* format, VaList* args);
+[[noreturn]] void APS5_VABI errc_nid_postfix(int status, int code, const char* format, ...);
+[[noreturn]] void APS5_VABI err_nid_postfix(int status, const char* format, ...);
+[[noreturn]] void APS5_VABI _err_nid_postfix(int status, const char* format, ...);
+[[noreturn]] void APS5_VABI errx_nid_postfix(int status, const char* format, ...);
+
+int APS5_VABI _ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error);
+int APS5_VABI _ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(const char* path, int* perms, int* error);
+std::uint64_t APS5_VABI _ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(const char* path, int* error);
+int APS5_VABI _ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(const char* path, std::int64_t* seconds, std::int64_t* nanoseconds);
+int APS5_VABI _ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(const char* path, const char* existing);
+bool APS5_VABI _ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(const char* path);
+int APS5_VABI _ZNSt10filesystem7_UnlinkEPKc_nid_postfix(const char* path);
+int APS5_VABI _ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(const char* path, int perms);
+bool APS5_VABI _ZNSt10filesystem12_Current_getERA260_c_nid_postfix(char* target);
+char* APS5_VABI _ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(char* target, void* handle, int* type);
+void* APS5_VABI _ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(char* target, const char* path, int* error, int* type);
+int APS5_VABI _ZNSt10filesystem10_Close_dirEPv_nid_postfix(void* handle);
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcSt10error_code_nid_postfix();
+void APS5_VABI _ZNSt10filesystem18_Xfilesystem_errorEPKcRKNS_4pathESt10error_code_nid_postfix();
+int APS5_VABI __std_init_once_begin_initialize_clr_nid_postfix(void** once, unsigned long flags, int* pending, void** context);
+int APS5_VABI __std_init_once_complete_clr_nid_postfix(void** once, unsigned long flags, void* context);
+[[noreturn]] void APS5_VABI __std_init_once_link_alternate_names_and_abort_nid_postfix();
+
+}
diff --git a/core/libs/prx/libSceLibcInternal/libSceLibcInternal.hpp b/core/libs/prx/libSceLibcInternal/libSceLibcInternal.hpp
new file mode 100644
index 0000000000..7da0381b01
--- /dev/null
+++ b/core/libs/prx/libSceLibcInternal/libSceLibcInternal.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLibcInternal/include/Api.hpp"
diff --git a/core/libs/prx/libSceLibreSsl/CMakeLists.txt b/core/libs/prx/libSceLibreSsl/CMakeLists.txt
new file mode 100644
index 0000000000..ea084db6e0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/CMakeLists.txt
@@ -0,0 +1,61 @@
+add_library(libSceLibreSsl SHARED EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Digest.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Runtime.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Aes.cpp)
+target_include_directories(libSceLibreSsl PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceLibreSsl PRIVATE mbedcrypto)
+configure_windows_unwind(libSceLibreSsl)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_libressl_x509_errors_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslX509Errors.cpp)
+    target_include_directories(guest_libressl_x509_errors_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_x509_errors_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_x509_errors_tests)
+    add_test(NAME guest_libressl_x509_errors COMMAND guest_libressl_x509_errors_tests)
+    set_tests_properties(guest_libressl_x509_errors PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_x509_errors PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_digest_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslDigest.cpp)
+    target_include_directories(guest_libressl_digest_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_digest_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_digest_tests)
+    add_test(NAME guest_libressl_digest COMMAND guest_libressl_digest_tests)
+    set_tests_properties(guest_libressl_digest PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_digest PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_des_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslDes.cpp)
+    target_include_directories(guest_libressl_des_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_des_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_des_tests)
+    add_test(NAME guest_libressl_des COMMAND guest_libressl_des_tests)
+    set_tests_properties(guest_libressl_des PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_libressl_des PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_runtime_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslRuntime.cpp)
+    target_include_directories(guest_libressl_runtime_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_runtime_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_runtime_tests)
+    add_test(NAME guest_libressl_runtime COMMAND guest_libressl_runtime_tests)
+    set_tests_properties(guest_libressl_runtime PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_runtime PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+
+    add_test_executable(guest_libressl_aes_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslAes.cpp)
+    target_include_directories(guest_libressl_aes_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl_aes_tests PRIVATE libSceLibreSsl libc)
+    configure_windows_unwind(guest_libressl_aes_tests)
+    add_test(NAME guest_libressl_aes COMMAND guest_libressl_aes_tests)
+    set_tests_properties(guest_libressl_aes PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_libressl_aes PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceLibreSsl/Export.cpp b/core/libs/prx/libSceLibreSsl/Export.cpp
index 93b05e0fec..84be6cef36 100644
--- a/core/libs/prx/libSceLibreSsl/Export.cpp
+++ b/core/libs/prx/libSceLibreSsl/Export.cpp
@@ -1,51 +1,24 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <cinttypes>
+#include <cstdio>
 #include <cstddef>
 #include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "mbedtls/des.h"
+
+namespace {
+
+constexpr std::size_t DesScheduleBytes = 128;
+
+}
 
 extern "C" {
 
 APS5_DUMMY_FUN
-int APS5_VABI AES_cbc_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_cfb128_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_ctr128_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_decrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_ecb_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_set_decrypt_key_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI AES_set_encrypt_key_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ASN1_INTEGER_get_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -271,16 +244,6 @@ int APS5_VABI CRYPTO_cleanup_all_ex_data_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI CRYPTO_free_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI CRYPTO_malloc_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI CRYPTO_num_locks_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -296,24 +259,28 @@ int APS5_VABI CRYPTO_set_locking_callback_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI CRYPTO_set_mem_functions_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
+void APS5_VABI DES_ecb_encrypt_nid_postfix(const unsigned char* input, unsigned char* output, const unsigned char* schedule, int enc) {
+    if (input == nullptr || output == nullptr || schedule == nullptr) APS5_INVALID_ARG_EX;
+    mbedtls_des_context context;
+    mbedtls_des_init(&context);
+    unsigned char block[MBEDTLS_DES_KEY_SIZE];
+    std::memcpy(block, input, sizeof(block));
+    int status = enc ? mbedtls_des_setkey_enc(&context, schedule) : mbedtls_des_setkey_dec(&context, schedule);
+    if (status == 0) status = mbedtls_des_crypt_ecb(&context, block, output);
+    mbedtls_des_free(&context);
+    if (status != 0) throw std::runtime_error("DES_ecb_encrypt: mbedtls failed");
+}
+
+int APS5_VABI DES_set_key_nid_postfix(const unsigned char* key, unsigned char* schedule) {
+    if (key == nullptr || schedule == nullptr) APS5_INVALID_ARG_EX;
+    std::memset(schedule, 0, DesScheduleBytes);
+    std::memcpy(schedule, key, MBEDTLS_DES_KEY_SIZE);
     return 0;
 }
 
-int APS5_VABI DES_ecb_encrypt_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI DES_set_key_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI DES_set_odd_parity_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI DES_set_odd_parity_nid_postfix(unsigned char* key) {
+    if (key == nullptr) APS5_INVALID_ARG_EX;
+    mbedtls_des_key_set_parity(key);
 }
 
 int APS5_VABI DTLSv1_client_method_nid_postfix(void) {
@@ -846,36 +813,6 @@ int APS5_VABI HMAC_Update_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI MD4_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI MD4_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI MD4_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI MD5_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI MD5_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI MD5_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI OBJ_cleanup_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1026,31 +963,6 @@ int APS5_VABI PKCS12_parse_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI RAND_add_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_bytes_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_file_name_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_load_file_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI RAND_status_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI RSA_flags_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1116,86 +1028,6 @@ int APS5_VABI RSA_verify_PKCS1_PSS_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI SHA1_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA1_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA1_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA224_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA224_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA224_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA256_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA256_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA256_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA256_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA384_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA384_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA384_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA512_Final_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA512_Init_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI SHA512_Update_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI SSL_CIPHER_get_bits_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1911,9 +1743,69 @@ int APS5_VABI X509_verify_cert_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI X509_verify_cert_error_string_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+const char* APS5_VABI X509_verify_cert_error_string_nid_postfix(std::int64_t error) {
+    static constexpr const char* messages[] {
+        "ok",
+        nullptr,
+        "unable to get issuer certificate",
+        "unable to get certificate CRL",
+        "unable to decrypt certificate's signature",
+        "unable to decrypt CRL's signature",
+        "unable to decode issuer public key",
+        "certificate signature failure",
+        "CRL signature failure",
+        "certificate is not yet valid",
+        "certificate has expired",
+        "CRL is not yet valid",
+        "CRL has expired",
+        "format error in certificate's notBefore field",
+        "format error in certificate's notAfter field",
+        "format error in CRL's lastUpdate field",
+        "format error in CRL's nextUpdate field",
+        "out of memory",
+        "self signed certificate",
+        "self signed certificate in certificate chain",
+        "unable to get local issuer certificate",
+        "unable to verify the first certificate",
+        "certificate chain too long",
+        "certificate revoked",
+        "invalid CA certificate",
+        "path length constraint exceeded",
+        "unsupported certificate purpose",
+        "certificate not trusted",
+        "certificate rejected",
+        "subject issuer mismatch",
+        "authority and subject key identifier mismatch",
+        "authority and issuer serial number mismatch",
+        "key usage does not include certificate signing",
+        "unable to get CRL issuer certificate",
+        "unhandled critical extension",
+        "key usage does not include CRL signing",
+        "unhandled critical CRL extension",
+        "invalid non-CA certificate (has CA markings)",
+        "proxy path length constraint exceeded",
+        "key usage does not include digital signature",
+        "proxy certificates not allowed, please set the appropriate flag",
+        "invalid or inconsistent certificate extension",
+        "invalid or inconsistent certificate policy extension",
+        "no explicit policy",
+        "Different CRL scope",
+        "Unsupported extension feature",
+        "RFC 3779 resource not subset of parent's resources",
+        "permitted subtree violation",
+        "excluded subtree violation",
+        "name constraints minimum and maximum not supported",
+        "application verification failure",
+        "unsupported name constraint type",
+        "unsupported or invalid name constraint syntax",
+        "unsupported or invalid name syntax",
+        "CRL path validation error",
+    };
+    const auto code = static_cast<std::uint32_t>(error);
+    if (code < sizeof(messages) / sizeof(messages[0]) && messages[code]) return messages[code];
+    static char unknown[100];
+    std::snprintf(unknown, sizeof(unknown), "error number %" PRId64, error);
+    return unknown;
 }
 
 int APS5_VABI d2i_OCSP_RESPONSE_nid_postfix(void) {
diff --git a/core/libs/prx/libSceLibreSsl/include/Api.hpp b/core/libs/prx/libSceLibreSsl/include/Api.hpp
new file mode 100644
index 0000000000..cf2b0a75e1
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/include/Api.hpp
@@ -0,0 +1,449 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+inline constexpr int MaxRounds = 14;
+
+struct AesKey {
+    std::uint32_t roundKeys[4 * (MaxRounds + 1)];
+    std::int32_t rounds;
+};
+
+struct Md4Context {
+    std::uint32_t A, B, C, D;
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num;
+};
+
+struct Md5Context {
+    std::uint32_t A, B, C, D;
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num;
+};
+
+struct Sha1Context {
+    std::uint32_t h[5];
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num;
+};
+
+struct Sha256Context {
+    std::uint32_t h[8];
+    std::uint32_t Nl, Nh;
+    std::uint32_t data[16];
+    std::uint32_t num, mdLength;
+};
+
+struct Sha512Context {
+    std::uint64_t h[8];
+    std::uint64_t Nl, Nh;
+    std::uint64_t data[16];
+    std::uint32_t num, mdLength;
+};
+
+extern "C" {
+
+int APS5_VABI ASN1_INTEGER_get_nid_postfix(void);
+int APS5_VABI ASN1_STRING_data_nid_postfix(void);
+int APS5_VABI ASN1_STRING_length_nid_postfix(void);
+int APS5_VABI ASN1_STRING_print_nid_postfix(void);
+int APS5_VABI ASN1_STRING_to_UTF8_nid_postfix(void);
+int APS5_VABI ASN1_STRING_type_nid_postfix(void);
+int APS5_VABI ASN1_TIME_print_nid_postfix(void);
+int APS5_VABI BIO_ctrl_nid_postfix(void);
+int APS5_VABI BIO_f_ssl_nid_postfix(void);
+int APS5_VABI BIO_free_nid_postfix(void);
+int APS5_VABI BIO_new_nid_postfix(void);
+int APS5_VABI BIO_new_fp_nid_postfix(void);
+int APS5_VABI BIO_new_mem_buf_nid_postfix(void);
+int APS5_VABI BIO_new_socket_nid_postfix(void);
+int APS5_VABI BIO_printf_nid_postfix(void);
+int APS5_VABI BIO_puts_nid_postfix(void);
+int APS5_VABI BIO_s_file_nid_postfix(void);
+int APS5_VABI BIO_s_mem_nid_postfix(void);
+int APS5_VABI BIO_write_nid_postfix(void);
+int APS5_VABI BN_CTX_end_nid_postfix(void);
+int APS5_VABI BN_CTX_free_nid_postfix(void);
+int APS5_VABI BN_CTX_new_nid_postfix(void);
+int APS5_VABI BN_CTX_start_nid_postfix(void);
+int APS5_VABI BN_add_word_nid_postfix(void);
+int APS5_VABI BN_bin2bn_nid_postfix(void);
+int APS5_VABI BN_bn2bin_nid_postfix(void);
+int APS5_VABI BN_free_nid_postfix(void);
+int APS5_VABI BN_hex2bn_nid_postfix(void);
+int APS5_VABI BN_mod_inverse_nid_postfix(void);
+int APS5_VABI BN_mul_nid_postfix(void);
+int APS5_VABI BN_new_nid_postfix(void);
+int APS5_VABI BN_num_bits_nid_postfix(void);
+int APS5_VABI BN_print_nid_postfix(void);
+int APS5_VABI BN_set_word_nid_postfix(void);
+int APS5_VABI BN_sub_word_nid_postfix(void);
+int APS5_VABI CMAC_CTX_free_nid_postfix(void);
+int APS5_VABI CMAC_CTX_new_nid_postfix(void);
+int APS5_VABI CMAC_Final_nid_postfix(void);
+int APS5_VABI CMAC_Init_nid_postfix(void);
+int APS5_VABI CMAC_Update_nid_postfix(void);
+int APS5_VABI CONF_modules_free_nid_postfix(void);
+int APS5_VABI CONF_modules_load_file_nid_postfix(void);
+int APS5_VABI CRYPTO_THREADID_set_callback_nid_postfix(void);
+int APS5_VABI CRYPTO_THREADID_set_numeric_nid_postfix(void);
+int APS5_VABI CRYPTO_cleanup_all_ex_data_nid_postfix(void);
+int APS5_VABI CRYPTO_num_locks_nid_postfix(void);
+int APS5_VABI CRYPTO_set_add_lock_callback_nid_postfix(void);
+int APS5_VABI CRYPTO_set_locking_callback_nid_postfix(void);
+void APS5_VABI DES_ecb_encrypt_nid_postfix(const unsigned char* input, unsigned char* output, const unsigned char* schedule, int enc);
+int APS5_VABI DES_set_key_nid_postfix(const unsigned char* key, unsigned char* schedule);
+void APS5_VABI DES_set_odd_parity_nid_postfix(unsigned char* key);
+int APS5_VABI DTLSv1_client_method_nid_postfix(void);
+int APS5_VABI DTLSv1_server_method_nid_postfix(void);
+int APS5_VABI ECDH_compute_key_nid_postfix(void);
+int APS5_VABI ECDSA_sign_nid_postfix(void);
+int APS5_VABI ECDSA_size_nid_postfix(void);
+int APS5_VABI ECDSA_verify_nid_postfix(void);
+int APS5_VABI EC_GROUP_free_nid_postfix(void);
+int APS5_VABI EC_GROUP_get_degree_nid_postfix(void);
+int APS5_VABI EC_GROUP_new_by_curve_name_nid_postfix(void);
+int APS5_VABI EC_KEY_check_key_nid_postfix(void);
+int APS5_VABI EC_KEY_free_nid_postfix(void);
+int APS5_VABI EC_KEY_generate_key_nid_postfix(void);
+int APS5_VABI EC_KEY_get0_group_nid_postfix(void);
+int APS5_VABI EC_KEY_get0_private_key_nid_postfix(void);
+int APS5_VABI EC_KEY_get0_public_key_nid_postfix(void);
+int APS5_VABI EC_KEY_new_nid_postfix(void);
+int APS5_VABI EC_KEY_new_by_curve_name_nid_postfix(void);
+int APS5_VABI EC_KEY_set_group_nid_postfix(void);
+int APS5_VABI EC_KEY_set_private_key_nid_postfix(void);
+int APS5_VABI EC_KEY_set_public_key_nid_postfix(void);
+int APS5_VABI EC_POINT_free_nid_postfix(void);
+int APS5_VABI EC_POINT_mul_nid_postfix(void);
+int APS5_VABI EC_POINT_new_nid_postfix(void);
+int APS5_VABI EC_POINT_oct2point_nid_postfix(void);
+int APS5_VABI EC_POINT_point2oct_nid_postfix(void);
+int APS5_VABI ENGINE_by_id_nid_postfix(void);
+int APS5_VABI ENGINE_cleanup_nid_postfix(void);
+int APS5_VABI ENGINE_ctrl_nid_postfix(void);
+int APS5_VABI ENGINE_ctrl_cmd_nid_postfix(void);
+int APS5_VABI ENGINE_finish_nid_postfix(void);
+int APS5_VABI ENGINE_free_nid_postfix(void);
+int APS5_VABI ENGINE_get_first_nid_postfix(void);
+int APS5_VABI ENGINE_get_id_nid_postfix(void);
+int APS5_VABI ENGINE_get_next_nid_postfix(void);
+int APS5_VABI ENGINE_init_nid_postfix(void);
+int APS5_VABI ENGINE_load_builtin_engines_nid_postfix(void);
+int APS5_VABI ENGINE_load_private_key_nid_postfix(void);
+int APS5_VABI ENGINE_set_default_nid_postfix(void);
+int APS5_VABI ERR_clear_error_nid_postfix(void);
+int APS5_VABI ERR_error_string_nid_postfix(void);
+int APS5_VABI ERR_error_string_n_nid_postfix(void);
+int APS5_VABI ERR_free_strings_nid_postfix(void);
+int APS5_VABI ERR_get_error_nid_postfix(void);
+int APS5_VABI ERR_peek_error_nid_postfix(void);
+int APS5_VABI ERR_remove_thread_state_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_cleanup_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_ctrl_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_free_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_init_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_new_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_set_padding_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_block_size_nid_postfix(void);
+int APS5_VABI EVP_CipherFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_CipherInit_ex_nid_postfix(void);
+int APS5_VABI EVP_CipherUpdate_nid_postfix(void);
+int APS5_VABI EVP_DecryptFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_DecryptInit_ex_nid_postfix(void);
+int APS5_VABI EVP_DecryptUpdate_nid_postfix(void);
+int APS5_VABI EVP_Digest_nid_postfix(void);
+int APS5_VABI EVP_DigestFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_DigestInit_ex_nid_postfix(void);
+int APS5_VABI EVP_DigestUpdate_nid_postfix(void);
+int APS5_VABI EVP_DigestVerifyFinal_nid_postfix(void);
+int APS5_VABI EVP_DigestVerifyInit_nid_postfix(void);
+int APS5_VABI EVP_EncryptFinal_ex_nid_postfix(void);
+int APS5_VABI EVP_EncryptInit_ex_nid_postfix(void);
+int APS5_VABI EVP_EncryptUpdate_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_cleanup_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_create_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_destroy_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_init_nid_postfix(void);
+int APS5_VABI EVP_MD_size_nid_postfix(void);
+int APS5_VABI EVP_PKEY_copy_parameters_nid_postfix(void);
+int APS5_VABI EVP_PKEY_free_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get1_EC_KEY_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get1_RSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_id_nid_postfix(void);
+int APS5_VABI EVP_PKEY_new_nid_postfix(void);
+int APS5_VABI EVP_PKEY_set1_RSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_type_nid_postfix(void);
+int APS5_VABI EVP_aes_128_cbc_nid_postfix(void);
+int APS5_VABI EVP_aes_128_cfb8_nid_postfix(void);
+int APS5_VABI EVP_aes_128_ctr_nid_postfix(void);
+int APS5_VABI EVP_aes_128_gcm_nid_postfix(void);
+int APS5_VABI EVP_aes_192_cbc_nid_postfix(void);
+int APS5_VABI EVP_aes_192_cfb8_nid_postfix(void);
+int APS5_VABI EVP_aes_192_ctr_nid_postfix(void);
+int APS5_VABI EVP_aes_192_gcm_nid_postfix(void);
+int APS5_VABI EVP_aes_256_cbc_nid_postfix(void);
+int APS5_VABI EVP_aes_256_cfb8_nid_postfix(void);
+int APS5_VABI EVP_aes_256_ctr_nid_postfix(void);
+int APS5_VABI EVP_aes_256_gcm_nid_postfix(void);
+int APS5_VABI EVP_cleanup_nid_postfix(void);
+int APS5_VABI EVP_md5_nid_postfix(void);
+int APS5_VABI EVP_sha256_nid_postfix(void);
+int APS5_VABI EVP_sha384_nid_postfix(void);
+int APS5_VABI EVP_sha512_nid_postfix(void);
+int APS5_VABI GENERAL_NAMES_free_nid_postfix(void);
+int APS5_VABI GENERAL_NAME_free_nid_postfix(void);
+int APS5_VABI HMAC_nid_postfix(void);
+int APS5_VABI HMAC_CTX_cleanup_nid_postfix(void);
+int APS5_VABI HMAC_CTX_init_nid_postfix(void);
+int APS5_VABI HMAC_Final_nid_postfix(void);
+int APS5_VABI HMAC_Init_nid_postfix(void);
+int APS5_VABI HMAC_Init_ex_nid_postfix(void);
+int APS5_VABI HMAC_Update_nid_postfix(void);
+int APS5_VABI OBJ_cleanup_nid_postfix(void);
+int APS5_VABI OBJ_create_nid_postfix(void);
+int APS5_VABI OBJ_nid2sn_nid_postfix(void);
+int APS5_VABI OBJ_obj2nid_nid_postfix(void);
+int APS5_VABI OBJ_sn2nid_nid_postfix(void);
+int APS5_VABI OCSP_BASICRESP_free_nid_postfix(void);
+int APS5_VABI OCSP_RESPONSE_free_nid_postfix(void);
+int APS5_VABI OCSP_basic_add1_cert_nid_postfix(void);
+int APS5_VABI OCSP_basic_verify_nid_postfix(void);
+int APS5_VABI OCSP_cert_status_str_nid_postfix(void);
+int APS5_VABI OCSP_check_validity_nid_postfix(void);
+int APS5_VABI OCSP_crl_reason_str_nid_postfix(void);
+int APS5_VABI OCSP_resp_count_nid_postfix(void);
+int APS5_VABI OCSP_resp_get0_nid_postfix(void);
+int APS5_VABI OCSP_response_get1_basic_nid_postfix(void);
+int APS5_VABI OCSP_response_status_nid_postfix(void);
+int APS5_VABI OCSP_response_status_str_nid_postfix(void);
+int APS5_VABI OCSP_single_get0_status_nid_postfix(void);
+int APS5_VABI OPENSSL_add_all_algorithms_noconf_nid_postfix(void);
+int APS5_VABI OPENSSL_load_builtin_modules_nid_postfix(void);
+int APS5_VABI PEM_X509_INFO_read_bio_nid_postfix(void);
+int APS5_VABI PEM_read_RSAPrivateKey_nid_postfix(void);
+int APS5_VABI PEM_read_X509_nid_postfix(void);
+int APS5_VABI PEM_read_bio_PrivateKey_nid_postfix(void);
+int APS5_VABI PEM_read_bio_X509_nid_postfix(void);
+int APS5_VABI PEM_read_bio_X509_AUX_nid_postfix(void);
+int APS5_VABI PEM_write_bio_X509_nid_postfix(void);
+int APS5_VABI PKCS12_PBE_add_nid_postfix(void);
+int APS5_VABI PKCS12_free_nid_postfix(void);
+int APS5_VABI PKCS12_parse_nid_postfix(void);
+int APS5_VABI RSA_flags_nid_postfix(void);
+int APS5_VABI RSA_free_nid_postfix(void);
+int APS5_VABI RSA_generate_key_ex_nid_postfix(void);
+int APS5_VABI RSA_new_nid_postfix(void);
+int APS5_VABI RSA_padding_add_PKCS1_PSS_nid_postfix(void);
+int APS5_VABI RSA_private_decrypt_nid_postfix(void);
+int APS5_VABI RSA_private_encrypt_nid_postfix(void);
+int APS5_VABI RSA_public_decrypt_nid_postfix(void);
+int APS5_VABI RSA_public_encrypt_nid_postfix(void);
+int APS5_VABI RSA_sign_nid_postfix(void);
+int APS5_VABI RSA_size_nid_postfix(void);
+int APS5_VABI RSA_verify_nid_postfix(void);
+int APS5_VABI RSA_verify_PKCS1_PSS_nid_postfix(void);
+int APS5_VABI SSL_CIPHER_get_bits_nid_postfix(void);
+int APS5_VABI SSL_CIPHER_get_name_nid_postfix(void);
+int APS5_VABI SSL_CIPHER_get_version_nid_postfix(void);
+int APS5_VABI SSL_CTX_add_client_CA_nid_postfix(void);
+int APS5_VABI SSL_CTX_callback_ctrl_nid_postfix(void);
+int APS5_VABI SSL_CTX_check_private_key_nid_postfix(void);
+int APS5_VABI SSL_CTX_ctrl_nid_postfix(void);
+int APS5_VABI SSL_CTX_free_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_cert_store_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_ex_data_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_ex_new_index_nid_postfix(void);
+int APS5_VABI SSL_CTX_get_verify_mode_nid_postfix(void);
+int APS5_VABI SSL_CTX_load_verify_locations_nid_postfix(void);
+int APS5_VABI SSL_CTX_load_verify_mem_nid_postfix(void);
+int APS5_VABI SSL_CTX_new_nid_postfix(void);
+int APS5_VABI SSL_CTX_sess_set_new_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set1_groups_list_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_alpn_protos_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_alpn_select_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_cert_store_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_cert_verify_callback_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_cipher_list_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_client_cert_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_default_passwd_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_default_passwd_cb_userdata_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_ex_data_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_info_callback_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_msg_callback_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_next_proto_select_cb_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_quiet_shutdown_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_session_id_context_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_verify_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_PrivateKey_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_PrivateKey_ASN1_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_PrivateKey_file_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_ASN1_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_chain_file_nid_postfix(void);
+int APS5_VABI SSL_CTX_use_certificate_file_nid_postfix(void);
+int APS5_VABI SSL_SESSION_free_nid_postfix(void);
+int APS5_VABI SSL_accept_nid_postfix(void);
+int APS5_VABI SSL_alert_desc_string_long_nid_postfix(void);
+int APS5_VABI SSL_check_private_key_nid_postfix(void);
+int APS5_VABI SSL_connect_nid_postfix(void);
+int APS5_VABI SSL_ctrl_nid_postfix(void);
+int APS5_VABI SSL_free_nid_postfix(void);
+int APS5_VABI SSL_get0_alpn_selected_nid_postfix(void);
+int APS5_VABI SSL_get0_param_nid_postfix(void);
+int APS5_VABI SSL_get1_session_nid_postfix(void);
+int APS5_VABI SSL_get_SSL_CTX_nid_postfix(void);
+int APS5_VABI SSL_get_certificate_nid_postfix(void);
+int APS5_VABI SSL_get_current_cipher_nid_postfix(void);
+int APS5_VABI SSL_get_error_nid_postfix(void);
+int APS5_VABI SSL_get_ex_data_nid_postfix(void);
+int APS5_VABI SSL_get_ex_data_X509_STORE_CTX_idx_nid_postfix(void);
+int APS5_VABI SSL_get_ex_new_index_nid_postfix(void);
+int APS5_VABI SSL_get_fd_nid_postfix(void);
+int APS5_VABI SSL_get_peer_cert_chain_nid_postfix(void);
+int APS5_VABI SSL_get_peer_certificate_nid_postfix(void);
+int APS5_VABI SSL_get_privatekey_nid_postfix(void);
+int APS5_VABI SSL_get_rbio_nid_postfix(void);
+int APS5_VABI SSL_get_servername_nid_postfix(void);
+int APS5_VABI SSL_get_session_nid_postfix(void);
+int APS5_VABI SSL_get_shutdown_nid_postfix(void);
+int APS5_VABI SSL_get_verify_result_nid_postfix(void);
+int APS5_VABI SSL_get_wbio_nid_postfix(void);
+int APS5_VABI SSL_library_init_nid_postfix(void);
+int APS5_VABI SSL_load_error_strings_nid_postfix(void);
+int APS5_VABI SSL_new_nid_postfix(void);
+int APS5_VABI SSL_peek_nid_postfix(void);
+int APS5_VABI SSL_pending_nid_postfix(void);
+int APS5_VABI SSL_read_nid_postfix(void);
+int APS5_VABI SSL_select_next_proto_nid_postfix(void);
+int APS5_VABI SSL_set_SSL_CTX_nid_postfix(void);
+int APS5_VABI SSL_set_bio_nid_postfix(void);
+int APS5_VABI SSL_set_connect_state_nid_postfix(void);
+int APS5_VABI SSL_set_ex_data_nid_postfix(void);
+int APS5_VABI SSL_set_fd_nid_postfix(void);
+int APS5_VABI SSL_set_session_nid_postfix(void);
+int APS5_VABI SSL_set_verify_nid_postfix(void);
+int APS5_VABI SSL_shutdown_nid_postfix(void);
+int APS5_VABI SSL_use_PrivateKey_ASN1_nid_postfix(void);
+int APS5_VABI SSL_use_certificate_ASN1_nid_postfix(void);
+int APS5_VABI SSL_version_nid_postfix(void);
+int APS5_VABI SSL_want_nid_postfix(void);
+int APS5_VABI SSL_write_nid_postfix(void);
+int APS5_VABI SSLeay_nid_postfix(void);
+int APS5_VABI SSLv23_client_method_nid_postfix(void);
+int APS5_VABI SSLv23_server_method_nid_postfix(void);
+int APS5_VABI TLS_client_method_nid_postfix(void);
+int APS5_VABI UI_OpenSSL_nid_postfix(void);
+int APS5_VABI UI_create_method_nid_postfix(void);
+int APS5_VABI UI_destroy_method_nid_postfix(void);
+int APS5_VABI UI_get0_user_data_nid_postfix(void);
+int APS5_VABI UI_get_input_flags_nid_postfix(void);
+int APS5_VABI UI_get_string_type_nid_postfix(void);
+int APS5_VABI UI_method_get_closer_nid_postfix(void);
+int APS5_VABI UI_method_get_opener_nid_postfix(void);
+int APS5_VABI UI_method_get_reader_nid_postfix(void);
+int APS5_VABI UI_method_get_writer_nid_postfix(void);
+int APS5_VABI UI_method_set_closer_nid_postfix(void);
+int APS5_VABI UI_method_set_opener_nid_postfix(void);
+int APS5_VABI UI_method_set_reader_nid_postfix(void);
+int APS5_VABI UI_method_set_writer_nid_postfix(void);
+int APS5_VABI UI_set_result_nid_postfix(void);
+int APS5_VABI X509V3_EXT_print_nid_postfix(void);
+int APS5_VABI X509_EXTENSION_get_critical_nid_postfix(void);
+int APS5_VABI X509_EXTENSION_get_data_nid_postfix(void);
+int APS5_VABI X509_EXTENSION_get_object_nid_postfix(void);
+int APS5_VABI X509_INFO_free_nid_postfix(void);
+int APS5_VABI X509_LOOKUP_file_nid_postfix(void);
+int APS5_VABI X509_NAME_ENTRY_get_data_nid_postfix(void);
+int APS5_VABI X509_NAME_get_entry_nid_postfix(void);
+int APS5_VABI X509_NAME_get_index_by_NID_nid_postfix(void);
+int APS5_VABI X509_NAME_get_text_by_NID_nid_postfix(void);
+int APS5_VABI X509_NAME_oneline_nid_postfix(void);
+int APS5_VABI X509_NAME_print_ex_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get1_chain_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_chain_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_current_cert_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_error_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_error_depth_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_get_ex_data_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_set_error_nid_postfix(void);
+int APS5_VABI X509_STORE_add_cert_nid_postfix(void);
+int APS5_VABI X509_STORE_add_crl_nid_postfix(void);
+int APS5_VABI X509_STORE_add_lookup_nid_postfix(void);
+int APS5_VABI X509_STORE_free_nid_postfix(void);
+int APS5_VABI X509_STORE_new_nid_postfix(void);
+int APS5_VABI X509_STORE_set_flags_nid_postfix(void);
+int APS5_VABI X509_VERIFY_PARAM_set1_host_nid_postfix(void);
+int APS5_VABI X509_VERIFY_PARAM_set1_ip_asc_nid_postfix(void);
+int APS5_VABI X509_VERIFY_PARAM_set_hostflags_nid_postfix(void);
+int APS5_VABI X509_check_issued_nid_postfix(void);
+int APS5_VABI X509_free_nid_postfix(void);
+int APS5_VABI X509_get_ext_d2i_nid_postfix(void);
+int APS5_VABI X509_get_issuer_name_nid_postfix(void);
+int APS5_VABI X509_get_pubkey_nid_postfix(void);
+int APS5_VABI X509_get_serialNumber_nid_postfix(void);
+int APS5_VABI X509_get_subject_name_nid_postfix(void);
+int APS5_VABI X509_load_crl_file_nid_postfix(void);
+int APS5_VABI X509_print_ex_nid_postfix(void);
+int APS5_VABI X509_verify_cert_nid_postfix(void);
+const char* APS5_VABI X509_verify_cert_error_string_nid_postfix(std::int64_t error);
+int APS5_VABI d2i_OCSP_RESPONSE_nid_postfix(void);
+int APS5_VABI d2i_PKCS12_bio_nid_postfix(void);
+int APS5_VABI d2i_PKCS12_fp_nid_postfix(void);
+int APS5_VABI d2i_RSA_PUBKEY_nid_postfix(void);
+int APS5_VABI d2i_X509_nid_postfix(void);
+int APS5_VABI i2a_ASN1_OBJECT_nid_postfix(void);
+int APS5_VABI i2d_X509_PUBKEY_nid_postfix(void);
+int APS5_VABI i2t_ASN1_OBJECT_nid_postfix(void);
+int APS5_VABI sceLibreSslGetMemoryPoolStats(void);
+int APS5_VABI sceLibreSslInit(void);
+int APS5_VABI sceLibreSslInitEx(void);
+int APS5_VABI sceLibreSslInitEx2(void);
+int APS5_VABI sceLibreSslTerm(void);
+int APS5_VABI sk_num_nid_postfix(void);
+int APS5_VABI sk_pop_nid_postfix(void);
+int APS5_VABI sk_pop_free_nid_postfix(void);
+int APS5_VABI sk_value_nid_postfix(void);
+int APS5_VABI AES_set_encrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key);
+int APS5_VABI AES_set_decrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key);
+void APS5_VABI AES_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key);
+void APS5_VABI AES_decrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key);
+void APS5_VABI AES_ecb_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key, int encrypt);
+void APS5_VABI AES_cbc_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int encrypt);
+void APS5_VABI AES_cfb128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int* num, int encrypt);
+void APS5_VABI AES_ctr128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, unsigned char* ecountBuffer, unsigned* num);
+int APS5_VABI MD4_Init_nid_postfix(Md4Context* context);
+int APS5_VABI MD4_Update_nid_postfix(Md4Context* context, const void* data, std::size_t length);
+int APS5_VABI MD4_Final_nid_postfix(unsigned char* digest, Md4Context* context);
+int APS5_VABI MD5_Init_nid_postfix(Md5Context* context);
+int APS5_VABI MD5_Update_nid_postfix(Md5Context* context, const void* data, std::size_t length);
+int APS5_VABI MD5_Final_nid_postfix(unsigned char* digest, Md5Context* context);
+int APS5_VABI SHA1_Init_nid_postfix(Sha1Context* context);
+int APS5_VABI SHA1_Update_nid_postfix(Sha1Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA1_Final_nid_postfix(unsigned char* digest, Sha1Context* context);
+int APS5_VABI SHA224_Init_nid_postfix(Sha256Context* context);
+int APS5_VABI SHA256_Init_nid_postfix(Sha256Context* context);
+int APS5_VABI SHA256_Update_nid_postfix(Sha256Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA224_Update_nid_postfix(Sha256Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA256_Final_nid_postfix(unsigned char* digest, Sha256Context* context);
+int APS5_VABI SHA224_Final_nid_postfix(unsigned char* digest, Sha256Context* context);
+unsigned char* APS5_VABI SHA256_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest);
+int APS5_VABI SHA384_Init_nid_postfix(Sha512Context* context);
+int APS5_VABI SHA512_Init_nid_postfix(Sha512Context* context);
+int APS5_VABI SHA512_Update_nid_postfix(Sha512Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA384_Update_nid_postfix(Sha512Context* context, const void* data, std::size_t length);
+int APS5_VABI SHA512_Final_nid_postfix(unsigned char* digest, Sha512Context* context);
+int APS5_VABI SHA384_Final_nid_postfix(unsigned char* digest, Sha512Context* context);
+void APS5_VABI RAND_add_nid_postfix(const void*, int, double);
+int APS5_VABI RAND_status_nid_postfix(void);
+int APS5_VABI RAND_bytes_nid_postfix(unsigned char* buffer, int count);
+int APS5_VABI RAND_load_file_nid_postfix(const char*, std::int64_t bytes);
+const char* APS5_VABI RAND_file_name_nid_postfix(char* buffer, std::size_t size);
+void* APS5_VABI CRYPTO_malloc_nid_postfix(int count, const char*, int);
+void APS5_VABI CRYPTO_free_nid_postfix(void* pointer);
+int APS5_VABI CRYPTO_set_mem_functions_nid_postfix(void*, void*, void*);
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/libSceLibreSsl.hpp b/core/libs/prx/libSceLibreSsl/libSceLibreSsl.hpp
new file mode 100644
index 0000000000..7b25337c40
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/libSceLibreSsl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLibreSsl/include/Api.hpp"
diff --git a/core/libs/prx/libSceLibreSsl/src/Aes.cpp b/core/libs/prx/libSceLibreSsl/src/Aes.cpp
new file mode 100644
index 0000000000..4c908d646c
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Aes.cpp
@@ -0,0 +1,287 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+constexpr std::size_t BlockSize = 16;
+
+static_assert(sizeof(AesKey) == 244);
+
+constexpr std::uint8_t Multiply(std::uint8_t a, std::uint8_t b) {
+    std::uint8_t product = 0;
+    while (b) {
+        if (b & 1) product ^= a;
+        a = static_cast<std::uint8_t>((a << 1) ^ ((a & 0x80) ? 0x1b : 0));
+        b >>= 1;
+    }
+    return product;
+}
+
+constexpr std::array<std::uint8_t, 256> MakeSubstitution() {
+    std::array<std::uint8_t, 256> box {};
+    for (int value = 0; value < 256; ++value) {
+        std::uint8_t inverse = 0;
+        for (int candidate = 1; candidate < 256 && value; ++candidate)
+            if (Multiply(static_cast<std::uint8_t>(value), static_cast<std::uint8_t>(candidate)) == 1) inverse = static_cast<std::uint8_t>(candidate);
+        std::uint8_t result = 0x63;
+        for (int shift = 0; shift < 5; ++shift)
+            result ^= static_cast<std::uint8_t>((inverse << shift) | (inverse >> ((8 - shift) & 7)));
+        box[value] = result;
+    }
+    return box;
+}
+
+constexpr std::array<std::uint8_t, 256> MakeInverse(const std::array<std::uint8_t, 256>& box) {
+    std::array<std::uint8_t, 256> inverse {};
+    for (int value = 0; value < 256; ++value) inverse[box[value]] = static_cast<std::uint8_t>(value);
+    return inverse;
+}
+
+constexpr auto Substitution = MakeSubstitution();
+constexpr auto InverseSubstitution = MakeInverse(Substitution);
+static_assert(Substitution[0x00] == 0x63 && Substitution[0x53] == 0xed && Substitution[0xff] == 0x16);
+
+std::uint32_t LoadBig32(const unsigned char* p) {
+    return std::uint32_t(p[0]) << 24 | std::uint32_t(p[1]) << 16 | std::uint32_t(p[2]) << 8 | std::uint32_t(p[3]);
+}
+
+void StoreBig32(unsigned char* p, std::uint32_t value) {
+    for (int i = 0; i < 4; ++i) p[i] = static_cast<unsigned char>(value >> (24 - 8 * i));
+}
+
+std::uint32_t SubstituteWord(std::uint32_t word) {
+    return std::uint32_t(Substitution[word >> 24]) << 24 | std::uint32_t(Substitution[(word >> 16) & 0xff]) << 16 |
+        std::uint32_t(Substitution[(word >> 8) & 0xff]) << 8 | Substitution[word & 0xff];
+}
+
+std::uint32_t InverseMixWord(std::uint32_t word) {
+    const std::uint8_t a[4] {std::uint8_t(word >> 24), std::uint8_t(word >> 16), std::uint8_t(word >> 8), std::uint8_t(word)};
+    std::uint32_t result = 0;
+    for (int row = 0; row < 4; ++row) {
+        const std::uint8_t value = Multiply(a[row], 14) ^ Multiply(a[(row + 1) % 4], 11) ^ Multiply(a[(row + 2) % 4], 13) ^ Multiply(a[(row + 3) % 4], 9);
+        result |= std::uint32_t(value) << (24 - 8 * row);
+    }
+    return result;
+}
+
+int RoundsForBits(int bits) {
+    if (bits == 128) return 10;
+    if (bits == 192) return 12;
+    if (bits == 256) return 14;
+    return 0;
+}
+
+void ExpandKey(const unsigned char* userKey, int bits, AesKey& key) {
+    const int words = bits / 32;
+    const int total = 4 * (key.rounds + 1);
+    auto* w = key.roundKeys;
+    for (int i = 0; i < words; ++i) w[i] = LoadBig32(userKey + 4 * i);
+    std::uint8_t roundConstant = 1;
+    for (int i = words; i < total; ++i) {
+        std::uint32_t temp = w[i - 1];
+        if (i % words == 0) {
+            temp = SubstituteWord(temp << 8 | temp >> 24) ^ (std::uint32_t(roundConstant) << 24);
+            roundConstant = Multiply(roundConstant, 2);
+        } else if (words > 6 && i % words == 4) {
+            temp = SubstituteWord(temp);
+        }
+        w[i] = w[i - words] ^ temp;
+    }
+}
+
+const AesKey& RequireKey(const AesKey* key, const char* function) {
+    if (!key) throw std::invalid_argument(std::string(function) + ": null key");
+    if (key->rounds != 10 && key->rounds != 12 && key->rounds != 14)
+        throw std::invalid_argument(std::string(function) + ": key schedule with " + std::to_string(key->rounds) + " rounds");
+    return *key;
+}
+
+void RequireBlocks(const void* in, const void* out, std::size_t length, const char* function) {
+    if (length && (!in || !out)) throw std::invalid_argument(std::string(function) + ": null input or output");
+}
+
+void LoadState(std::uint8_t (&state)[16], const unsigned char* in, const std::uint32_t* roundKey) {
+    for (int column = 0; column < 4; ++column)
+        for (int row = 0; row < 4; ++row)
+            state[4 * column + row] = in[4 * column + row] ^ std::uint8_t(roundKey[column] >> (24 - 8 * row));
+}
+
+void AddRoundKey(std::uint8_t (&state)[16], const std::uint32_t* roundKey) {
+    for (int column = 0; column < 4; ++column)
+        for (int row = 0; row < 4; ++row) state[4 * column + row] ^= std::uint8_t(roundKey[column] >> (24 - 8 * row));
+}
+
+void EncryptBlock(const unsigned char* in, unsigned char* out, const AesKey& key) {
+    std::uint8_t state[16];
+    LoadState(state, in, key.roundKeys);
+    for (int round = 1; round <= key.rounds; ++round) {
+        std::uint8_t shifted[16];
+        for (int column = 0; column < 4; ++column)
+            for (int row = 0; row < 4; ++row) shifted[4 * column + row] = Substitution[state[4 * ((column + row) % 4) + row]];
+        if (round != key.rounds) {
+            for (int column = 0; column < 4; ++column) {
+                const std::uint8_t* a = shifted + 4 * column;
+                const std::uint8_t mixed[4] {
+                    std::uint8_t(Multiply(a[0], 2) ^ Multiply(a[1], 3) ^ a[2] ^ a[3]),
+                    std::uint8_t(a[0] ^ Multiply(a[1], 2) ^ Multiply(a[2], 3) ^ a[3]),
+                    std::uint8_t(a[0] ^ a[1] ^ Multiply(a[2], 2) ^ Multiply(a[3], 3)),
+                    std::uint8_t(Multiply(a[0], 3) ^ a[1] ^ a[2] ^ Multiply(a[3], 2)),
+                };
+                std::memcpy(state + 4 * column, mixed, 4);
+            }
+        } else {
+            std::memcpy(state, shifted, sizeof(state));
+        }
+        AddRoundKey(state, key.roundKeys + 4 * round);
+    }
+    std::memcpy(out, state, sizeof(state));
+}
+
+void DecryptBlock(const unsigned char* in, unsigned char* out, const AesKey& key) {
+    std::uint8_t state[16];
+    LoadState(state, in, key.roundKeys);
+    for (int round = 1; round <= key.rounds; ++round) {
+        std::uint8_t shifted[16];
+        for (int column = 0; column < 4; ++column)
+            for (int row = 0; row < 4; ++row) shifted[4 * column + row] = InverseSubstitution[state[4 * ((column + 4 - row) % 4) + row]];
+        if (round != key.rounds) {
+            for (int column = 0; column < 4; ++column) {
+                const std::uint8_t* a = shifted + 4 * column;
+                const std::uint8_t mixed[4] {
+                    std::uint8_t(Multiply(a[0], 14) ^ Multiply(a[1], 11) ^ Multiply(a[2], 13) ^ Multiply(a[3], 9)),
+                    std::uint8_t(Multiply(a[0], 9) ^ Multiply(a[1], 14) ^ Multiply(a[2], 11) ^ Multiply(a[3], 13)),
+                    std::uint8_t(Multiply(a[0], 13) ^ Multiply(a[1], 9) ^ Multiply(a[2], 14) ^ Multiply(a[3], 11)),
+                    std::uint8_t(Multiply(a[0], 11) ^ Multiply(a[1], 13) ^ Multiply(a[2], 9) ^ Multiply(a[3], 14)),
+                };
+                std::memcpy(state + 4 * column, mixed, 4);
+            }
+        } else {
+            std::memcpy(state, shifted, sizeof(state));
+        }
+        AddRoundKey(state, key.roundKeys + 4 * round);
+    }
+    std::memcpy(out, state, sizeof(state));
+}
+
+unsigned RequirePosition(int position, const char* function) {
+    if (position < 0 || position >= static_cast<int>(BlockSize))
+        throw std::invalid_argument(std::string(function) + ": block position " + std::to_string(position) + " is outside 0-15");
+    return static_cast<unsigned>(position);
+}
+
+void IncrementCounter(unsigned char* counter) {
+    for (int i = 15; i >= 0; --i)
+        if (++counter[i]) return;
+}
+}
+
+extern "C" {
+
+int APS5_VABI AES_set_encrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key) {
+    if (!userKey || !key) return -1;
+    const int rounds = RoundsForBits(bits);
+    if (!rounds) return -2;
+    key->rounds = rounds;
+    ExpandKey(userKey, bits, *key);
+    return 0;
+}
+
+int APS5_VABI AES_set_decrypt_key_nid_postfix(const unsigned char* userKey, int bits, AesKey* key) {
+    const int result = AES_set_encrypt_key_nid_postfix(userKey, bits, key);
+    if (result) return result;
+    auto* w = key->roundKeys;
+    for (int i = 0, j = 4 * key->rounds; i < j; i += 4, j -= 4)
+        for (int k = 0; k < 4; ++k) std::swap(w[i + k], w[j + k]);
+    for (int i = 4; i < 4 * key->rounds; ++i) w[i] = InverseMixWord(w[i]);
+    return 0;
+}
+
+void APS5_VABI AES_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, BlockSize, __func__);
+    EncryptBlock(in, out, k);
+}
+
+void APS5_VABI AES_decrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, BlockSize, __func__);
+    DecryptBlock(in, out, k);
+}
+
+void APS5_VABI AES_ecb_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, const AesKey* key, int encrypt) {
+    if (encrypt == 1) AES_encrypt_nid_postfix(in, out, key);
+    else AES_decrypt_nid_postfix(in, out, key);
+}
+
+void APS5_VABI AES_cbc_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int encrypt) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, length, __func__);
+    if (!ivec) throw std::invalid_argument(std::string(__func__) + ": null iv");
+    std::uint8_t block[BlockSize];
+    if (encrypt) {
+        while (length) {
+            const std::size_t count = length < BlockSize ? length : BlockSize;
+            for (std::size_t n = 0; n < BlockSize; ++n) block[n] = n < count ? in[n] ^ ivec[n] : ivec[n];
+            EncryptBlock(block, out, k);
+            std::memcpy(ivec, out, BlockSize);
+            if (length <= BlockSize) break;
+            length -= BlockSize;
+            in += BlockSize;
+            out += BlockSize;
+        }
+        return;
+    }
+    while (length) {
+        const std::size_t count = length < BlockSize ? length : BlockSize;
+        std::uint8_t cipher[BlockSize];
+        std::memcpy(cipher, in, BlockSize);
+        DecryptBlock(cipher, block, k);
+        for (std::size_t n = 0; n < count; ++n) out[n] = block[n] ^ ivec[n];
+        std::memcpy(ivec, cipher, BlockSize);
+        if (length <= BlockSize) break;
+        length -= BlockSize;
+        in += BlockSize;
+        out += BlockSize;
+    }
+}
+
+void APS5_VABI AES_cfb128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, int* num, int encrypt) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, length, __func__);
+    if (!ivec || !num) throw std::invalid_argument(std::string(__func__) + ": null iv or position");
+    unsigned n = RequirePosition(*num, __func__);
+    for (std::size_t i = 0; i < length; ++i) {
+        if (!n) EncryptBlock(ivec, ivec, k);
+        const auto c = in[i];
+        out[i] = ivec[n] ^ c;
+        ivec[n] = encrypt ? out[i] : c;
+        n = (n + 1) % BlockSize;
+    }
+    *num = static_cast<int>(n);
+}
+
+void APS5_VABI AES_ctr128_encrypt_nid_postfix(const unsigned char* in, unsigned char* out, std::size_t length, const AesKey* key, unsigned char* ivec, unsigned char* ecountBuffer, unsigned* num) {
+    const auto& k = RequireKey(key, __func__);
+    RequireBlocks(in, out, length, __func__);
+    if (!ivec || !ecountBuffer || !num) throw std::invalid_argument(std::string(__func__) + ": null counter, keystream or position");
+    if (*num >= BlockSize) throw std::invalid_argument(std::string(__func__) + ": block position " + std::to_string(*num) + " is outside 0-15");
+    unsigned n = *num;
+    for (std::size_t i = 0; i < length; ++i) {
+        if (!n) {
+            EncryptBlock(ivec, ecountBuffer, k);
+            IncrementCounter(ivec);
+        }
+        out[i] = in[i] ^ ecountBuffer[n];
+        n = (n + 1) % BlockSize;
+    }
+    *num = n;
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Digest.cpp b/core/libs/prx/libSceLibreSsl/src/Digest.cpp
new file mode 100644
index 0000000000..b15e61d7a0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Digest.cpp
@@ -0,0 +1,517 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+static_assert(sizeof(Md4Context) == 92);
+static_assert(sizeof(Md5Context) == 92);
+static_assert(sizeof(Sha1Context) == 96);
+static_assert(sizeof(Sha256Context) == 112);
+static_assert(sizeof(Sha512Context) == 216);
+
+constexpr std::size_t Sha224Length = 28;
+constexpr std::size_t Sha256Length = 32;
+constexpr std::size_t Sha384Length = 48;
+constexpr std::size_t Sha512Length = 64;
+
+std::uint32_t LoadLittle32(const unsigned char* p) {
+    return std::uint32_t(p[0]) | std::uint32_t(p[1]) << 8 | std::uint32_t(p[2]) << 16 | std::uint32_t(p[3]) << 24;
+}
+
+std::uint32_t LoadBig32(const unsigned char* p) {
+    return std::uint32_t(p[0]) << 24 | std::uint32_t(p[1]) << 16 | std::uint32_t(p[2]) << 8 | std::uint32_t(p[3]);
+}
+
+std::uint64_t LoadBig64(const unsigned char* p) {
+    return std::uint64_t(LoadBig32(p)) << 32 | LoadBig32(p + 4);
+}
+
+void StoreLittle32(unsigned char* p, std::uint32_t value) {
+    for (int i = 0; i < 4; ++i) p[i] = static_cast<unsigned char>(value >> (8 * i));
+}
+
+void StoreBig32(unsigned char* p, std::uint32_t value) {
+    for (int i = 0; i < 4; ++i) p[i] = static_cast<unsigned char>(value >> (24 - 8 * i));
+}
+
+void StoreBig64(unsigned char* p, std::uint64_t value) {
+    StoreBig32(p, static_cast<std::uint32_t>(value >> 32));
+    StoreBig32(p + 4, static_cast<std::uint32_t>(value));
+}
+
+void Md4Block(Md4Context& c, const unsigned char* block) {
+    std::uint32_t x[16];
+    for (int i = 0; i < 16; ++i) x[i] = LoadLittle32(block + 4 * i);
+    std::uint32_t a = c.A, b = c.B, cc = c.C, d = c.D;
+    const auto f = [](std::uint32_t x1, std::uint32_t y, std::uint32_t z) { return (x1 & y) | (~x1 & z); };
+    const auto g = [](std::uint32_t x1, std::uint32_t y, std::uint32_t z) { return (x1 & y) | (x1 & z) | (y & z); };
+    const auto h = [](std::uint32_t x1, std::uint32_t y, std::uint32_t z) { return x1 ^ y ^ z; };
+    static constexpr int shifts1[4] {3, 7, 11, 19};
+    static constexpr int shifts2[4] {3, 5, 9, 13};
+    static constexpr int shifts3[4] {3, 9, 11, 15};
+    static constexpr int order2[16] {0, 4, 8, 12, 1, 5, 9, 13, 2, 6, 10, 14, 3, 7, 11, 15};
+    static constexpr int order3[16] {0, 8, 4, 12, 2, 10, 6, 14, 1, 9, 5, 13, 3, 11, 7, 15};
+    for (int i = 0; i < 16; ++i) {
+        const auto t = std::rotl(a + f(b, cc, d) + x[i], shifts1[i % 4]);
+        a = d; d = cc; cc = b; b = t;
+    }
+    for (int i = 0; i < 16; ++i) {
+        const auto t = std::rotl(a + g(b, cc, d) + x[order2[i]] + 0x5a827999u, shifts2[i % 4]);
+        a = d; d = cc; cc = b; b = t;
+    }
+    for (int i = 0; i < 16; ++i) {
+        const auto t = std::rotl(a + h(b, cc, d) + x[order3[i]] + 0x6ed9eba1u, shifts3[i % 4]);
+        a = d; d = cc; cc = b; b = t;
+    }
+    c.A += a; c.B += b; c.C += cc; c.D += d;
+}
+
+void Md5Block(Md5Context& c, const unsigned char* block) {
+    static constexpr std::uint32_t constants[64] {
+        0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
+        0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
+        0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
+        0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
+        0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
+        0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
+        0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
+        0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391,
+    };
+    static constexpr int shifts[16] {7, 12, 17, 22, 5, 9, 14, 20, 4, 11, 16, 23, 6, 10, 15, 21};
+    std::uint32_t x[16];
+    for (int i = 0; i < 16; ++i) x[i] = LoadLittle32(block + 4 * i);
+    std::uint32_t a = c.A, b = c.B, cc = c.C, d = c.D;
+    for (int i = 0; i < 64; ++i) {
+        std::uint32_t mix;
+        int index;
+        switch (i / 16) {
+        case 0: mix = (b & cc) | (~b & d); index = i; break;
+        case 1: mix = (d & b) | (~d & cc); index = (5 * i + 1) % 16; break;
+        case 2: mix = b ^ cc ^ d; index = (3 * i + 5) % 16; break;
+        default: mix = cc ^ (b | ~d); index = (7 * i) % 16; break;
+        }
+        const auto t = d;
+        d = cc;
+        cc = b;
+        b += std::rotl(a + mix + constants[i] + x[index], shifts[(i / 16) * 4 + i % 4]);
+        a = t;
+    }
+    c.A += a; c.B += b; c.C += cc; c.D += d;
+}
+
+void Sha1Block(Sha1Context& c, const unsigned char* block) {
+    std::uint32_t w[80];
+    for (int i = 0; i < 16; ++i) w[i] = LoadBig32(block + 4 * i);
+    for (int i = 16; i < 80; ++i) w[i] = std::rotl(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1);
+    std::uint32_t a = c.h[0], b = c.h[1], cc = c.h[2], d = c.h[3], e = c.h[4];
+    for (int i = 0; i < 80; ++i) {
+        std::uint32_t f, k;
+        if (i < 20) { f = (b & cc) | (~b & d); k = 0x5a827999; }
+        else if (i < 40) { f = b ^ cc ^ d; k = 0x6ed9eba1; }
+        else if (i < 60) { f = (b & cc) | (b & d) | (cc & d); k = 0x8f1bbcdc; }
+        else { f = b ^ cc ^ d; k = 0xca62c1d6; }
+        const auto t = std::rotl(a, 5) + f + e + k + w[i];
+        e = d; d = cc; cc = std::rotl(b, 30); b = a; a = t;
+    }
+    c.h[0] += a; c.h[1] += b; c.h[2] += cc; c.h[3] += d; c.h[4] += e;
+}
+
+void Sha256Block(Sha256Context& c, const unsigned char* block) {
+    static constexpr std::uint32_t constants[64] {
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+    };
+    std::uint32_t w[64];
+    for (int i = 0; i < 16; ++i) w[i] = LoadBig32(block + 4 * i);
+    for (int i = 16; i < 64; ++i) {
+        const auto s0 = std::rotr(w[i - 15], 7) ^ std::rotr(w[i - 15], 18) ^ (w[i - 15] >> 3);
+        const auto s1 = std::rotr(w[i - 2], 17) ^ std::rotr(w[i - 2], 19) ^ (w[i - 2] >> 10);
+        w[i] = w[i - 16] + s0 + w[i - 7] + s1;
+    }
+    std::uint32_t v[8];
+    std::memcpy(v, c.h, sizeof(v));
+    for (int i = 0; i < 64; ++i) {
+        const auto s1 = std::rotr(v[4], 6) ^ std::rotr(v[4], 11) ^ std::rotr(v[4], 25);
+        const auto choice = (v[4] & v[5]) ^ (~v[4] & v[6]);
+        const auto t1 = v[7] + s1 + choice + constants[i] + w[i];
+        const auto s0 = std::rotr(v[0], 2) ^ std::rotr(v[0], 13) ^ std::rotr(v[0], 22);
+        const auto majority = (v[0] & v[1]) ^ (v[0] & v[2]) ^ (v[1] & v[2]);
+        std::memmove(v + 1, v, 7 * sizeof(v[0]));
+        v[4] += t1;
+        v[0] = t1 + s0 + majority;
+    }
+    for (int i = 0; i < 8; ++i) c.h[i] += v[i];
+}
+
+void Sha512Block(Sha512Context& c, const unsigned char* block) {
+    static constexpr std::uint64_t constants[80] {
+        0x428a2f98d728ae22, 0x7137449123ef65cd, 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc, 0x3956c25bf348b538,
+        0x59f111f1b605d019, 0x923f82a4af194f9b, 0xab1c5ed5da6d8118, 0xd807aa98a3030242, 0x12835b0145706fbe,
+        0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2, 0x72be5d74f27b896f, 0x80deb1fe3b1696b1, 0x9bdc06a725c71235,
+        0xc19bf174cf692694, 0xe49b69c19ef14ad2, 0xefbe4786384f25e3, 0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65,
+        0x2de92c6f592b0275, 0x4a7484aa6ea6e483, 0x5cb0a9dcbd41fbd4, 0x76f988da831153b5, 0x983e5152ee66dfab,
+        0xa831c66d2db43210, 0xb00327c898fb213f, 0xbf597fc7beef0ee4, 0xc6e00bf33da88fc2, 0xd5a79147930aa725,
+        0x06ca6351e003826f, 0x142929670a0e6e70, 0x27b70a8546d22ffc, 0x2e1b21385c26c926, 0x4d2c6dfc5ac42aed,
+        0x53380d139d95b3df, 0x650a73548baf63de, 0x766a0abb3c77b2a8, 0x81c2c92e47edaee6, 0x92722c851482353b,
+        0xa2bfe8a14cf10364, 0xa81a664bbc423001, 0xc24b8b70d0f89791, 0xc76c51a30654be30, 0xd192e819d6ef5218,
+        0xd69906245565a910, 0xf40e35855771202a, 0x106aa07032bbd1b8, 0x19a4c116b8d2d0c8, 0x1e376c085141ab53,
+        0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8, 0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb, 0x5b9cca4f7763e373,
+        0x682e6ff3d6b2b8a3, 0x748f82ee5defb2fc, 0x78a5636f43172f60, 0x84c87814a1f0ab72, 0x8cc702081a6439ec,
+        0x90befffa23631e28, 0xa4506cebde82bde9, 0xbef9a3f7b2c67915, 0xc67178f2e372532b, 0xca273eceea26619c,
+        0xd186b8c721c0c207, 0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178, 0x06f067aa72176fba, 0x0a637dc5a2c898a6,
+        0x113f9804bef90dae, 0x1b710b35131c471b, 0x28db77f523047d84, 0x32caab7b40c72493, 0x3c9ebe0a15c9bebc,
+        0x431d67c49c100d4c, 0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, 0x5fcb6fab3ad6faec, 0x6c44198c4a475817,
+    };
+    std::uint64_t w[80];
+    for (int i = 0; i < 16; ++i) w[i] = LoadBig64(block + 8 * i);
+    for (int i = 16; i < 80; ++i) {
+        const auto s0 = std::rotr(w[i - 15], 1) ^ std::rotr(w[i - 15], 8) ^ (w[i - 15] >> 7);
+        const auto s1 = std::rotr(w[i - 2], 19) ^ std::rotr(w[i - 2], 61) ^ (w[i - 2] >> 6);
+        w[i] = w[i - 16] + s0 + w[i - 7] + s1;
+    }
+    std::uint64_t v[8];
+    std::memcpy(v, c.h, sizeof(v));
+    for (int i = 0; i < 80; ++i) {
+        const auto s1 = std::rotr(v[4], 14) ^ std::rotr(v[4], 18) ^ std::rotr(v[4], 41);
+        const auto choice = (v[4] & v[5]) ^ (~v[4] & v[6]);
+        const auto t1 = v[7] + s1 + choice + constants[i] + w[i];
+        const auto s0 = std::rotr(v[0], 28) ^ std::rotr(v[0], 34) ^ std::rotr(v[0], 39);
+        const auto majority = (v[0] & v[1]) ^ (v[0] & v[2]) ^ (v[1] & v[2]);
+        std::memmove(v + 1, v, 7 * sizeof(v[0]));
+        v[4] += t1;
+        v[0] = t1 + s0 + majority;
+    }
+    for (int i = 0; i < 8; ++i) c.h[i] += v[i];
+}
+
+template<class TContext> TContext& RequireContext(TContext* context, const char* function) {
+    if (!context) throw std::invalid_argument(std::string(function) + ": null context");
+    return *context;
+}
+
+void RequireInput(const void* data, std::size_t length, const char* function) {
+    if (!data && length) throw std::invalid_argument(std::string(function) + ": null input");
+}
+
+void RequireDigest(const unsigned char* digest, const char* function) {
+    if (!digest) throw std::invalid_argument(std::string(function) + ": null digest buffer");
+}
+
+void RequireBuffered(std::uint32_t buffered, std::size_t block, const char* function) {
+    if (buffered >= block) throw std::invalid_argument(std::string(function) + ": buffered byte count is not below the block size");
+}
+
+template<class TContext, class TBlock> void Update32(TContext& c, const void* input, std::size_t length, TBlock block) {
+    constexpr std::size_t blockSize = 64;
+    auto* buffer = reinterpret_cast<unsigned char*>(c.data);
+    auto* data = static_cast<const unsigned char*>(input);
+    const std::uint64_t bits = (std::uint64_t(c.Nh) << 32 | c.Nl) + (std::uint64_t(length) << 3);
+    c.Nl = static_cast<std::uint32_t>(bits);
+    c.Nh = static_cast<std::uint32_t>(bits >> 32);
+    if (c.num) {
+        const std::size_t room = blockSize - c.num;
+        if (length < room) {
+            std::memcpy(buffer + c.num, data, length);
+            c.num += static_cast<std::uint32_t>(length);
+            return;
+        }
+        std::memcpy(buffer + c.num, data, room);
+        block(c, buffer);
+        data += room;
+        length -= room;
+        c.num = 0;
+        std::memset(buffer, 0, blockSize);
+    }
+    for (; length >= blockSize; data += blockSize, length -= blockSize) block(c, data);
+    if (length) {
+        std::memcpy(buffer, data, length);
+        c.num = static_cast<std::uint32_t>(length);
+    }
+}
+
+template<class TContext, class TBlock> void Final32(TContext& c, bool bigEndian, TBlock block) {
+    constexpr std::size_t blockSize = 64;
+    auto* buffer = reinterpret_cast<unsigned char*>(c.data);
+    std::size_t n = c.num;
+    buffer[n++] = 0x80;
+    if (n > blockSize - 8) {
+        std::memset(buffer + n, 0, blockSize - n);
+        n = 0;
+        block(c, buffer);
+    }
+    std::memset(buffer + n, 0, blockSize - 8 - n);
+    if (bigEndian) {
+        StoreBig32(buffer + 56, c.Nh);
+        StoreBig32(buffer + 60, c.Nl);
+    } else {
+        StoreLittle32(buffer + 56, c.Nl);
+        StoreLittle32(buffer + 60, c.Nh);
+    }
+    block(c, buffer);
+    c.num = 0;
+    std::memset(buffer, 0, blockSize);
+}
+
+void Sha512Update(Sha512Context& c, const void* input, std::size_t length) {
+    constexpr std::size_t blockSize = 128;
+    auto* buffer = reinterpret_cast<unsigned char*>(c.data);
+    auto* data = static_cast<const unsigned char*>(input);
+    const std::uint64_t low = c.Nl + (std::uint64_t(length) << 3);
+    if (low < c.Nl) ++c.Nh;
+    c.Nh += std::uint64_t(length) >> 61;
+    c.Nl = low;
+    if (c.num) {
+        const std::size_t room = blockSize - c.num;
+        if (length < room) {
+            std::memcpy(buffer + c.num, data, length);
+            c.num += static_cast<std::uint32_t>(length);
+            return;
+        }
+        std::memcpy(buffer + c.num, data, room);
+        Sha512Block(c, buffer);
+        data += room;
+        length -= room;
+        c.num = 0;
+    }
+    for (; length >= blockSize; data += blockSize, length -= blockSize) Sha512Block(c, data);
+    if (length) {
+        std::memcpy(buffer, data, length);
+        c.num = static_cast<std::uint32_t>(length);
+    }
+}
+
+int Sha512Final(unsigned char* digest, Sha512Context& c) {
+    constexpr std::size_t blockSize = 128;
+    auto* buffer = reinterpret_cast<unsigned char*>(c.data);
+    std::size_t n = c.num;
+    buffer[n++] = 0x80;
+    if (n > blockSize - 16) {
+        std::memset(buffer + n, 0, blockSize - n);
+        n = 0;
+        Sha512Block(c, buffer);
+    }
+    std::memset(buffer + n, 0, blockSize - 16 - n);
+    StoreBig64(buffer + 112, c.Nh);
+    StoreBig64(buffer + 120, c.Nl);
+    Sha512Block(c, buffer);
+    if (!digest) return 0;
+    if (c.mdLength == Sha224Length || c.mdLength == Sha256Length)
+        NotImplemented_nid_no_patch("SHA512_Final: SHA-512/224 and SHA-512/256 digest lengths");
+    if (c.mdLength != Sha384Length && c.mdLength != Sha512Length) return 0;
+    for (std::size_t i = 0; i < c.mdLength / 8; ++i) StoreBig64(digest + 8 * i, c.h[i]);
+    return 1;
+}
+
+int Sha256Final(unsigned char* digest, Sha256Context& c, const char* function) {
+    RequireDigest(digest, function);
+    RequireBuffered(c.num, 64, function);
+    Final32(c, true, Sha256Block);
+    if (c.mdLength > Sha256Length) return 0;
+    for (std::size_t i = 0; i < c.mdLength / 4; ++i) StoreBig32(digest + 4 * i, c.h[i]);
+    return 1;
+}
+}
+
+extern "C" {
+
+int APS5_VABI MD4_Init_nid_postfix(Md4Context* context) {
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    c.A = 0x67452301;
+    c.B = 0xefcdab89;
+    c.C = 0x98badcfe;
+    c.D = 0x10325476;
+    return 1;
+}
+
+int APS5_VABI MD4_Update_nid_postfix(Md4Context* context, const void* data, std::size_t length) {
+    auto& c = RequireContext(context, __func__);
+    if (!length) return 1;
+    RequireInput(data, length, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Update32(c, data, length, Md4Block);
+    return 1;
+}
+
+int APS5_VABI MD4_Final_nid_postfix(unsigned char* digest, Md4Context* context) {
+    auto& c = RequireContext(context, __func__);
+    RequireDigest(digest, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Final32(c, false, Md4Block);
+    StoreLittle32(digest, c.A);
+    StoreLittle32(digest + 4, c.B);
+    StoreLittle32(digest + 8, c.C);
+    StoreLittle32(digest + 12, c.D);
+    return 1;
+}
+
+int APS5_VABI MD5_Init_nid_postfix(Md5Context* context) {
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    c.A = 0x67452301;
+    c.B = 0xefcdab89;
+    c.C = 0x98badcfe;
+    c.D = 0x10325476;
+    return 1;
+}
+
+int APS5_VABI MD5_Update_nid_postfix(Md5Context* context, const void* data, std::size_t length) {
+    auto& c = RequireContext(context, __func__);
+    if (!length) return 1;
+    RequireInput(data, length, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Update32(c, data, length, Md5Block);
+    return 1;
+}
+
+int APS5_VABI MD5_Final_nid_postfix(unsigned char* digest, Md5Context* context) {
+    auto& c = RequireContext(context, __func__);
+    RequireDigest(digest, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Final32(c, false, Md5Block);
+    StoreLittle32(digest, c.A);
+    StoreLittle32(digest + 4, c.B);
+    StoreLittle32(digest + 8, c.C);
+    StoreLittle32(digest + 12, c.D);
+    return 1;
+}
+
+int APS5_VABI SHA1_Init_nid_postfix(Sha1Context* context) {
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    c.h[0] = 0x67452301;
+    c.h[1] = 0xefcdab89;
+    c.h[2] = 0x98badcfe;
+    c.h[3] = 0x10325476;
+    c.h[4] = 0xc3d2e1f0;
+    return 1;
+}
+
+int APS5_VABI SHA1_Update_nid_postfix(Sha1Context* context, const void* data, std::size_t length) {
+    auto& c = RequireContext(context, __func__);
+    if (!length) return 1;
+    RequireInput(data, length, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Update32(c, data, length, Sha1Block);
+    return 1;
+}
+
+int APS5_VABI SHA1_Final_nid_postfix(unsigned char* digest, Sha1Context* context) {
+    auto& c = RequireContext(context, __func__);
+    RequireDigest(digest, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Final32(c, true, Sha1Block);
+    for (int i = 0; i < 5; ++i) StoreBig32(digest + 4 * i, c.h[i]);
+    return 1;
+}
+
+int APS5_VABI SHA224_Init_nid_postfix(Sha256Context* context) {
+    static constexpr std::uint32_t initial[8] {0xc1059ed8, 0x367cd507, 0x3070dd17, 0xf70e5939, 0xffc00b31, 0x68581511, 0x64f98fa7, 0xbefa4fa4};
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    std::memcpy(c.h, initial, sizeof(initial));
+    c.mdLength = Sha224Length;
+    return 1;
+}
+
+int APS5_VABI SHA256_Init_nid_postfix(Sha256Context* context) {
+    static constexpr std::uint32_t initial[8] {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    std::memcpy(c.h, initial, sizeof(initial));
+    c.mdLength = Sha256Length;
+    return 1;
+}
+
+int APS5_VABI SHA256_Update_nid_postfix(Sha256Context* context, const void* data, std::size_t length) {
+    auto& c = RequireContext(context, __func__);
+    if (!length) return 1;
+    RequireInput(data, length, __func__);
+    RequireBuffered(c.num, 64, __func__);
+    Update32(c, data, length, Sha256Block);
+    return 1;
+}
+
+int APS5_VABI SHA224_Update_nid_postfix(Sha256Context* context, const void* data, std::size_t length) {
+    return SHA256_Update_nid_postfix(context, data, length);
+}
+
+int APS5_VABI SHA256_Final_nid_postfix(unsigned char* digest, Sha256Context* context) {
+    return Sha256Final(digest, RequireContext(context, __func__), __func__);
+}
+
+int APS5_VABI SHA224_Final_nid_postfix(unsigned char* digest, Sha256Context* context) {
+    return Sha256Final(digest, RequireContext(context, __func__), __func__);
+}
+
+unsigned char* APS5_VABI SHA256_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest) {
+    RequireInput(data, length, __func__);
+    if (!digest) NotImplemented_nid_no_patch("SHA256: null digest buffer");
+    Sha256Context c;
+    SHA256_Init_nid_postfix(&c);
+
+    if (length) Update32(c, data, length, Sha256Block);
+    Sha256Final(digest, c, __func__);
+    return digest;
+}
+
+int APS5_VABI SHA384_Init_nid_postfix(Sha512Context* context) {
+    static constexpr std::uint64_t initial[8] {
+        0xcbbb9d5dc1059ed8, 0x629a292a367cd507, 0x9159015a3070dd17, 0x152fecd8f70e5939,
+        0x67332667ffc00b31, 0x8eb44a8768581511, 0xdb0c2e0d64f98fa7, 0x47b5481dbefa4fa4,
+    };
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    std::memcpy(c.h, initial, sizeof(initial));
+    c.mdLength = Sha384Length;
+    return 1;
+}
+
+int APS5_VABI SHA512_Init_nid_postfix(Sha512Context* context) {
+    static constexpr std::uint64_t initial[8] {
+        0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,
+        0x510e527fade682d1, 0x9b05688c2b3e6c1f, 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179,
+    };
+    auto& c = RequireContext(context, __func__);
+    std::memset(&c, 0, sizeof(c));
+    std::memcpy(c.h, initial, sizeof(initial));
+    c.mdLength = Sha512Length;
+    return 1;
+}
+
+int APS5_VABI SHA512_Update_nid_postfix(Sha512Context* context, const void* data, std::size_t length) {
+    auto& c = RequireContext(context, __func__);
+    if (!length) return 1;
+    RequireInput(data, length, __func__);
+    RequireBuffered(c.num, 128, __func__);
+    Sha512Update(c, data, length);
+    return 1;
+}
+
+int APS5_VABI SHA384_Update_nid_postfix(Sha512Context* context, const void* data, std::size_t length) {
+    return SHA512_Update_nid_postfix(context, data, length);
+}
+
+int APS5_VABI SHA512_Final_nid_postfix(unsigned char* digest, Sha512Context* context) {
+    auto& c = RequireContext(context, __func__);
+    RequireBuffered(c.num, 128, __func__);
+    return Sha512Final(digest, c);
+}
+
+int APS5_VABI SHA384_Final_nid_postfix(unsigned char* digest, Sha512Context* context) {
+    return SHA512_Final_nid_postfix(digest, context);
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl/src/Runtime.cpp b/core/libs/prx/libSceLibreSsl/src/Runtime.cpp
new file mode 100644
index 0000000000..b3ea2389a0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl/src/Runtime.cpp
@@ -0,0 +1,57 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include "prx/libc/include/General.hpp"
+#include "prx/libc/include/HostEntropy.hpp"
+
+extern "C" {
+
+void APS5_VABI RAND_add_nid_postfix(const void*, int, double) {
+}
+
+int APS5_VABI RAND_status_nid_postfix(void) {
+    return 1;
+}
+
+int APS5_VABI RAND_bytes_nid_postfix(unsigned char* buffer, int count) {
+    if (count > 0) {
+        if (!buffer) throw std::invalid_argument(std::string(__func__) + ": null buffer");
+        HostEntropy_nid_no_patch(buffer, static_cast<std::size_t>(count));
+    }
+    return 1;
+}
+
+int APS5_VABI RAND_load_file_nid_postfix(const char*, std::int64_t bytes) {
+    return bytes == -1 ? 123456 : static_cast<int>(bytes);
+}
+
+const char* APS5_VABI RAND_file_name_nid_postfix(char* buffer, std::size_t size) {
+    static constexpr char path[] = "/dev/urandom";
+    if (size) {
+        if (!buffer) throw std::invalid_argument(std::string(__func__) + ": null buffer");
+        const std::size_t copied = size - 1 < sizeof(path) - 1 ? size - 1 : sizeof(path) - 1;
+        std::memcpy(buffer, path, copied);
+        buffer[copied] = '\0';
+    }
+    return sizeof(path) - 1 >= size ? nullptr : buffer;
+}
+
+void* APS5_VABI CRYPTO_malloc_nid_postfix(int count, const char*, int) {
+    if (count <= 0) return nullptr;
+    return malloc_nid_postfix(static_cast<std::size_t>(count));
+}
+
+void APS5_VABI CRYPTO_free_nid_postfix(void* pointer) {
+    free_nid_postfix(pointer);
+
+}
+
+int APS5_VABI CRYPTO_set_mem_functions_nid_postfix(void*, void*, void*) {
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceLibreSsl3/CMakeLists.txt b/core/libs/prx/libSceLibreSsl3/CMakeLists.txt
new file mode 100644
index 0000000000..1a3d213378
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl3/CMakeLists.txt
@@ -0,0 +1,22 @@
+add_library(libSceLibreSsl3 SHARED EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp ${CMAKE_CURRENT_SOURCE_DIR}/src/Digest.cpp)
+target_include_directories(libSceLibreSsl3 PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceLibreSsl3 PRIVATE libSceLibreSsl)
+configure_windows_unwind(libSceLibreSsl3)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_crypto_memcmp_tests ${LIBS_INCLUDE_DIR}/tests/GuestCryptoMemcmp.cpp)
+    target_include_directories(guest_crypto_memcmp_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_crypto_memcmp_tests PRIVATE libSceLibreSsl3)
+    add_test(NAME guest_crypto_memcmp COMMAND guest_crypto_memcmp_tests)
+    set_tests_properties(guest_crypto_memcmp PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_libressl3_digest_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSsl3Digest.cpp)
+    target_include_directories(guest_libressl3_digest_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libressl3_digest_tests PRIVATE libSceLibreSsl3 libc)
+    configure_windows_unwind(guest_libressl3_digest_tests)
+    add_test(NAME guest_libressl3_digest COMMAND guest_libressl3_digest_tests)
+    set_tests_properties(guest_libressl3_digest PROPERTIES TIMEOUT 30)
+    if(WIN32)
+        set_tests_properties(guest_crypto_memcmp guest_libressl3_digest PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibreSsl3>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceLibreSsl3/Export.cpp b/core/libs/prx/libSceLibreSsl3/Export.cpp
index d3289b659b..dfd0b1b483 100644
--- a/core/libs/prx/libSceLibreSsl3/Export.cpp
+++ b/core/libs/prx/libSceLibreSsl3/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
@@ -31,9 +32,13 @@ int APS5_VABI BIO_vfree_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI CRYPTO_memcmp_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI CRYPTO_memcmp_nid_postfix(const void* first, const void* second, std::size_t length) {
+    const auto* firstBytes = static_cast<const volatile unsigned char*>(first);
+    const auto* secondBytes = static_cast<const volatile unsigned char*>(second);
+    unsigned int difference = 0;
+    for (std::size_t index = 0; index < length; ++index)
+        difference |= firstBytes[index] ^ secondBytes[index];
+    return static_cast<int>(difference);
 }
 
 int APS5_VABI DH_get0_key_nid_postfix(void) {
@@ -216,11 +221,6 @@ int APS5_VABI EVP_sha224_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI MD5_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI OBJ_cmp_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -281,11 +281,6 @@ int APS5_VABI RSA_up_ref_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI SHA1_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI SSL_CTX_add0_chain_cert_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceLibreSsl3/include/Api.hpp b/core/libs/prx/libSceLibreSsl3/include/Api.hpp
new file mode 100644
index 0000000000..ff2a535fd7
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl3/include/Api.hpp
@@ -0,0 +1,95 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI ASN1_INTEGER_free_nid_postfix(void);
+int APS5_VABI ASN1_OBJECT_free_nid_postfix(void);
+int APS5_VABI ASN1_STRING_get0_data_nid_postfix(void);
+int APS5_VABI BIO_up_ref_nid_postfix(void);
+int APS5_VABI BIO_vfree_nid_postfix(void);
+int APS5_VABI CRYPTO_memcmp_nid_postfix(const void* first, const void* second, std::size_t length);
+int APS5_VABI DH_get0_key_nid_postfix(void);
+int APS5_VABI DH_get0_pqg_nid_postfix(void);
+int APS5_VABI DSA_get0_key_nid_postfix(void);
+int APS5_VABI DSA_get0_pqg_nid_postfix(void);
+int APS5_VABI EC_KEY_up_ref_nid_postfix(void);
+int APS5_VABI ERR_load_crypto_strings_nid_postfix(void);
+int APS5_VABI ERR_peek_last_error_nid_postfix(void);
+int APS5_VABI ERR_print_errors_cb_nid_postfix(void);
+int APS5_VABI EVP_CIPHER_CTX_set_flags_nid_postfix(void);
+int APS5_VABI EVP_DigestInit_nid_postfix(void);
+int APS5_VABI EVP_DigestSignFinal_nid_postfix(void);
+int APS5_VABI EVP_DigestSignInit_nid_postfix(void);
+int APS5_VABI EVP_EncryptInit_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_free_nid_postfix(void);
+int APS5_VABI EVP_MD_CTX_new_nid_postfix(void);
+int APS5_VABI EVP_PKCS82PKEY_nid_postfix(void);
+int APS5_VABI EVP_PKEY_CTX_ctrl_nid_postfix(void);
+int APS5_VABI EVP_PKEY_CTX_new_nid_postfix(void);
+int APS5_VABI EVP_PKEY_decrypt_nid_postfix(void);
+int APS5_VABI EVP_PKEY_decrypt_init_nid_postfix(void);
+int APS5_VABI EVP_PKEY_encrypt_nid_postfix(void);
+int APS5_VABI EVP_PKEY_encrypt_init_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get0_DH_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get0_DSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_get0_RSA_nid_postfix(void);
+int APS5_VABI EVP_PKEY_new_mac_key_nid_postfix(void);
+int APS5_VABI EVP_PKEY_set1_EC_KEY_nid_postfix(void);
+int APS5_VABI EVP_PKEY_size_nid_postfix(void);
+int APS5_VABI EVP_PKEY_up_ref_nid_postfix(void);
+int APS5_VABI EVP_SignFinal_nid_postfix(void);
+int APS5_VABI EVP_VerifyFinal_nid_postfix(void);
+int APS5_VABI EVP_aes_128_wrap_nid_postfix(void);
+int APS5_VABI EVP_aes_192_wrap_nid_postfix(void);
+int APS5_VABI EVP_aes_256_wrap_nid_postfix(void);
+int APS5_VABI EVP_sha1_nid_postfix(void);
+int APS5_VABI EVP_sha224_nid_postfix(void);
+int APS5_VABI OBJ_cmp_nid_postfix(void);
+int APS5_VABI OBJ_txt2obj_nid_postfix(void);
+int APS5_VABI OCSP_CERTID_free_nid_postfix(void);
+int APS5_VABI OCSP_cert_to_id_nid_postfix(void);
+int APS5_VABI OCSP_resp_find_status_nid_postfix(void);
+int APS5_VABI OpenSSL_version_nid_postfix(void);
+int APS5_VABI PKCS7_free_nid_postfix(void);
+int APS5_VABI PKCS8_PRIV_KEY_INFO_free_nid_postfix(void);
+int APS5_VABI RSA_check_key_nid_postfix(void);
+int APS5_VABI RSA_get0_key_nid_postfix(void);
+int APS5_VABI RSA_padding_add_PKCS1_PSS_mgf1_nid_postfix(void);
+int APS5_VABI RSA_up_ref_nid_postfix(void);
+int APS5_VABI SSL_CTX_add0_chain_cert_nid_postfix(void);
+int APS5_VABI SSL_CTX_clear_chain_certs_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_max_proto_version_nid_postfix(void);
+int APS5_VABI SSL_CTX_set_min_proto_version_nid_postfix(void);
+int APS5_VABI SSL_CTX_up_ref_nid_postfix(void);
+int APS5_VABI SSL_SESSION_up_ref_nid_postfix(void);
+int APS5_VABI SSL_get_client_random_nid_postfix(void);
+int APS5_VABI SSL_up_ref_nid_postfix(void);
+int APS5_VABI X509_PUBKEY_get0_param_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_free_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_init_nid_postfix(void);
+int APS5_VABI X509_STORE_CTX_new_nid_postfix(void);
+int APS5_VABI X509_STORE_up_ref_nid_postfix(void);
+int APS5_VABI X509_get0_extensions_nid_postfix(void);
+int APS5_VABI X509_get0_notAfter_nid_postfix(void);
+int APS5_VABI X509_get0_notBefore_nid_postfix(void);
+int APS5_VABI X509_get0_signature_nid_postfix(void);
+int APS5_VABI X509_get_ext_nid_postfix(void);
+int APS5_VABI X509_get_ext_count_nid_postfix(void);
+int APS5_VABI X509_get_version_nid_postfix(void);
+int APS5_VABI X509_getm_notAfter_nid_postfix(void);
+int APS5_VABI X509_getm_notBefore_nid_postfix(void);
+int APS5_VABI X509_up_ref_nid_postfix(void);
+int APS5_VABI d2i_ASN1_INTEGER_nid_postfix(void);
+int APS5_VABI d2i_ECParameters_nid_postfix(void);
+int APS5_VABI d2i_PKCS7_nid_postfix(void);
+int APS5_VABI d2i_PKCS8_PRIV_KEY_INFO_bio_nid_postfix(void);
+int APS5_VABI d2i_PrivateKey_bio_nid_postfix(void);
+int APS5_VABI d2i_RSAPublicKey_bio_nid_postfix(void);
+int APS5_VABI d2i_X509_bio_nid_postfix(void);
+int APS5_VABI o2i_ECPublicKey_nid_postfix(void);
+unsigned char* APS5_VABI MD5_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest);
+unsigned char* APS5_VABI SHA1_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest);
+
+}
diff --git a/core/libs/prx/libSceLibreSsl3/libSceLibreSsl3.hpp b/core/libs/prx/libSceLibreSsl3/libSceLibreSsl3.hpp
new file mode 100644
index 0000000000..e9b09745c0
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl3/libSceLibreSsl3.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLibreSsl3/include/Api.hpp"
diff --git a/core/libs/prx/libSceLibreSsl3/src/Digest.cpp b/core/libs/prx/libSceLibreSsl3/src/Digest.cpp
new file mode 100644
index 0000000000..ae6a5b5e19
--- /dev/null
+++ b/core/libs/prx/libSceLibreSsl3/src/Digest.cpp
@@ -0,0 +1,28 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include <cstddef>
+#include "prx/libc/include/General.hpp"
+
+extern "C" {
+
+unsigned char* APS5_VABI MD5_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest) {
+    if (!digest) NotImplemented_nid_no_patch("MD5: null digest buffer");
+    Md5Context context;
+    MD5_Init_nid_postfix(&context);
+    MD5_Update_nid_postfix(&context, data, length);
+    MD5_Final_nid_postfix(digest, &context);
+
+    return digest;
+}
+
+unsigned char* APS5_VABI SHA1_nid_postfix(const unsigned char* data, std::size_t length, unsigned char* digest) {
+    if (!digest) NotImplemented_nid_no_patch("SHA1: null digest buffer");
+    Sha1Context context;
+    SHA1_Init_nid_postfix(&context);
+    SHA1_Update_nid_postfix(&context, data, length);
+    SHA1_Final_nid_postfix(digest, &context);
+
+    return digest;
+}
+
+}
diff --git a/core/libs/prx/libSceLoginDialog/Export.cpp b/core/libs/prx/libSceLoginDialog/Export.cpp
index 8fcd0f4daf..1f652d35fb 100644
--- a/core/libs/prx/libSceLoginDialog/Export.cpp
+++ b/core/libs/prx/libSceLoginDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLoginDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceLoginDialog/include/Api.hpp b/core/libs/prx/libSceLoginDialog/include/Api.hpp
new file mode 100644
index 0000000000..51bca2f699
--- /dev/null
+++ b/core/libs/prx/libSceLoginDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceLoginDialogInitialize(void);
+int APS5_VABI sceLoginDialogOpen(const LoginDialogParam* param);
+int APS5_VABI sceLoginDialogUpdateStatus(void);
+int APS5_VABI sceLoginDialogGetStatus(void);
+int APS5_VABI sceLoginDialogGetResult(LoginDialogResult* result);
+int APS5_VABI sceLoginDialogClose(void);
+int APS5_VABI sceLoginDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceLoginDialog/libSceLoginDialog.hpp b/core/libs/prx/libSceLoginDialog/libSceLoginDialog.hpp
new file mode 100644
index 0000000000..eed4b0aa93
--- /dev/null
+++ b/core/libs/prx/libSceLoginDialog/libSceLoginDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLoginDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceLoginMgrServer/Export.cpp b/core/libs/prx/libSceLoginMgrServer/Export.cpp
index c0497cf3de..8c56379312 100644
--- a/core/libs/prx/libSceLoginMgrServer/Export.cpp
+++ b/core/libs/prx/libSceLoginMgrServer/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLoginMgrServer/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceLoginMgrServer/include/Api.hpp b/core/libs/prx/libSceLoginMgrServer/include/Api.hpp
new file mode 100644
index 0000000000..de64daf5d9
--- /dev/null
+++ b/core/libs/prx/libSceLoginMgrServer/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceLoginMgrServerCheckSafetyNoticeShown();
+int APS5_VABI sceLoginMgrServerClearMorpheusRequiredUserId();
+int APS5_VABI sceLoginMgrServerConvertToUserId();
+int APS5_VABI sceLoginMgrServerCreateUser();
+int APS5_VABI sceLoginMgrServerDestroyUser();
+int APS5_VABI sceLoginMgrServerDialogGetAppId();
+int APS5_VABI sceLoginMgrServerDialogGetOpenParam();
+int APS5_VABI sceLoginMgrServerDialogNotifyCloseFinished();
+int APS5_VABI sceLoginMgrServerDialogNotifyOpenFinished();
+int APS5_VABI sceLoginMgrServerDialogSetResult();
+int APS5_VABI sceLoginMgrServerGetLogoutInfo();
+int APS5_VABI sceLoginMgrServerGetMorpheusRequiredUserId();
+int APS5_VABI sceLoginMgrServerGetSharePlayAllowPadOperation();
+int APS5_VABI sceLoginMgrServerInitialize();
+int APS5_VABI sceLoginMgrServerInitializeSharePlayAllowPadOperation();
+int APS5_VABI sceLoginMgrServerIsRequestedCdlgClose();
+int APS5_VABI sceLoginMgrServerLoginServiceGetRequestParam();
+int APS5_VABI sceLoginMgrServerLoginServiceNotifyRequestFinished();
+int APS5_VABI sceLoginMgrServerNotifyEasySignInFinished();
+int APS5_VABI sceLoginMgrServerNotifyEasySignInUserCode();
+int APS5_VABI sceLoginMgrServerNotifyHmdConnectInfo();
+int APS5_VABI sceLoginMgrServerNotifySafetyNoticeShown();
+int APS5_VABI sceLoginMgrServerNotifyShellUIState();
+int APS5_VABI sceLoginMgrServerSetLoginFlag();
+int APS5_VABI sceLoginMgrServerSetMorpheusAssignEnabledFlag();
+int APS5_VABI sceLoginMgrServerSetMorpheusRequiredUserId();
+int APS5_VABI sceLoginMgrServerSetSharePlayMode();
+int APS5_VABI sceLoginMgrServerSetUserStatus();
+int APS5_VABI sceLoginMgrServerTerminate();
+int APS5_VABI sceLoginMgrServerUpdateUserIdRalatedToPadUniqueId();
+
+}
diff --git a/core/libs/prx/libSceLoginMgrServer/libSceLoginMgrServer.hpp b/core/libs/prx/libSceLoginMgrServer/libSceLoginMgrServer.hpp
new file mode 100644
index 0000000000..244b5b6a16
--- /dev/null
+++ b/core/libs/prx/libSceLoginMgrServer/libSceLoginMgrServer.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLoginMgrServer/include/Api.hpp"
diff --git a/core/libs/prx/libSceLoginService/Export.cpp b/core/libs/prx/libSceLoginService/Export.cpp
index 71262ec59b..e3a24fd796 100644
--- a/core/libs/prx/libSceLoginService/Export.cpp
+++ b/core/libs/prx/libSceLoginService/Export.cpp
@@ -1,9 +1,8 @@
+#include "prx/libSceLoginService/include/Api.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct LoginServiceDeviceRequest;
-
 extern "C" {
 
 int APS5_VABI sceLoginServiceInitialize(void) {
diff --git a/core/libs/prx/libSceLoginService/include/Api.hpp b/core/libs/prx/libSceLoginService/include/Api.hpp
new file mode 100644
index 0000000000..853ce09844
--- /dev/null
+++ b/core/libs/prx/libSceLoginService/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct LoginServiceDeviceRequest;
+
+extern "C" {
+
+int APS5_VABI sceLoginServiceInitialize(void);
+int APS5_VABI sceLoginServiceTerminate(void);
+int APS5_VABI sceLoginServiceRequestDevices(const LoginServiceDeviceRequest* param);
+
+}
diff --git a/core/libs/prx/libSceLoginService/libSceLoginService.hpp b/core/libs/prx/libSceLoginService/libSceLoginService.hpp
new file mode 100644
index 0000000000..7de7ce0c1e
--- /dev/null
+++ b/core/libs/prx/libSceLoginService/libSceLoginService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceLoginService/include/Api.hpp"
diff --git a/core/libs/prx/libSceM4aacEnc/Export.cpp b/core/libs/prx/libSceM4aacEnc/Export.cpp
index e71f829cca..64de066d07 100644
--- a/core/libs/prx/libSceM4aacEnc/Export.cpp
+++ b/core/libs/prx/libSceM4aacEnc/Export.cpp
@@ -1,9 +1,9 @@
+#include "prx/libSceM4aacEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-
 extern "C" {
 
 int32_t APS5_VABI sceM4aacEncClearContext(int32_t m4aacEncHandle) {
diff --git a/core/libs/prx/libSceM4aacEnc/include/Api.hpp b/core/libs/prx/libSceM4aacEnc/include/Api.hpp
new file mode 100644
index 0000000000..a981414104
--- /dev/null
+++ b/core/libs/prx/libSceM4aacEnc/include/Api.hpp
@@ -0,0 +1,25 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI sceM4aacEncClearContext(int32_t m4aacEncHandle);
+int APS5_VABI sceM4aacEncClearContextEx();
+int32_t APS5_VABI sceM4aacEncCreateEncoder(int32_t channels, int32_t samplingRate, int32_t bitRate, int32_t inputFormat, int32_t outputFormat, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncCreateEncoderEx();
+int32_t APS5_VABI sceM4aacEncDeleteEncoder(int32_t m4aacEncHandle, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncDeleteEncoderEx();
+int32_t APS5_VABI sceM4aacEncEncode(int32_t m4aacEncHandle, void *pInput, uint32_t inputByte, void *pOutput, uint32_t *pOutputByte, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncEncodeEx();
+int APS5_VABI sceM4aacEncEncodeWithPriority();
+int APS5_VABI sceM4aacEncEncodeWithPriorityEx();
+int32_t APS5_VABI sceM4aacEncFlush(int32_t m4aacEncHandle, void *pOutput, uint32_t *pOutputByte, int32_t *pInternalError);
+int APS5_VABI sceM4aacEncFlushEx();
+int APS5_VABI sceM4aacEncFlushWithPriority();
+int APS5_VABI sceM4aacEncFlushWithPriorityEx();
+int APS5_VABI sceM4aacEncGetContext();
+int APS5_VABI sceM4aacEncInitialize();
+int APS5_VABI sceM4aacEncTerminate();
+
+}
diff --git a/core/libs/prx/libSceM4aacEnc/libSceM4aacEnc.hpp b/core/libs/prx/libSceM4aacEnc/libSceM4aacEnc.hpp
new file mode 100644
index 0000000000..23842cc39b
--- /dev/null
+++ b/core/libs/prx/libSceM4aacEnc/libSceM4aacEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceM4aacEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceMarlin/libSceMarlin.hpp b/core/libs/prx/libSceMarlin/libSceMarlin.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMarlin/libSceMarlin.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMat/libSceMat.hpp b/core/libs/prx/libSceMat/libSceMat.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMat/libSceMat.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMbus/Export.cpp b/core/libs/prx/libSceMbus/Export.cpp
index ca49b545be..5212afd405 100644
--- a/core/libs/prx/libSceMbus/Export.cpp
+++ b/core/libs/prx/libSceMbus/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMbus/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,24 +6,6 @@
 
 #include <string>
 
-struct DeviceServiceThreadParam {
-    std::uint64_t affinityMask;
-    std::int32_t priority;
-    std::uint32_t reserved;
-};
-
-struct DeviceServiceInitParam {
-    std::uint32_t size;
-    std::uint32_t reserved;
-    const DeviceServiceThreadParam* threadParam;
-};
-
-struct DeviceServiceUsageFilter {
-    std::uint16_t usagePage;
-    std::uint16_t minimumUsage;
-    std::uint16_t maximumUsage;
-};
-
 static_assert(sizeof(DeviceServiceThreadParam) == 16);
 static_assert(offsetof(DeviceServiceThreadParam, priority) == 8);
 static_assert(sizeof(DeviceServiceInitParam) == 16);
diff --git a/core/libs/prx/libSceMbus/PendingExports.cpp b/core/libs/prx/libSceMbus/PendingExports.cpp
index 76313b1a67..d5f6a7f050 100644
--- a/core/libs/prx/libSceMbus/PendingExports.cpp
+++ b/core/libs/prx/libSceMbus/PendingExports.cpp
@@ -1,38 +1,13 @@
+#include "prx/libSceMbus/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <cstddef>
 
-struct MbusDeviceFunctionState {
-    std::byte data[180];
-};
-
 static_assert(sizeof(MbusDeviceFunctionState) == 180);
-struct MbusDeviceDescription;
-struct MbusDeviceInfo;
-struct MbusSimulatedHandleStatus;
-struct MbusSparkState;
-struct MbusDriverCallbacks;
-struct MbusUsbPowerEntry;
-struct MbusEvent;
-struct alignas(8) MbusDeviceCondition {
-    std::byte data[256];
-};
 
 static_assert(sizeof(MbusDeviceCondition) == 256);
-struct MbusDeviceServiceInfo;
-struct MbusEventCallbacks {
-    void (APS5_VABI *onOverflow)(std::int32_t eventHandle, void* userData);
-    void (APS5_VABI *onEvent)(std::int32_t eventHandle, void* userData, const MbusEvent* event);
-};
 
 static_assert(sizeof(MbusEventCallbacks) == 16);
-struct MbusProcessInfo;
-struct MbusStartupInfo;
-struct MbusStartupParam;
-struct MbusControlStatus;
-struct MbusDebugDeviceInfo;
-struct MbusInternalInfo;
-struct MbusPriorityInfo;
 
 extern "C" {
 
diff --git a/core/libs/prx/libSceMbus/include/Api.hpp b/core/libs/prx/libSceMbus/include/Api.hpp
new file mode 100644
index 0000000000..d31c99a8aa
--- /dev/null
+++ b/core/libs/prx/libSceMbus/include/Api.hpp
@@ -0,0 +1,192 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+struct DeviceServiceThreadParam {
+    std::uint64_t affinityMask;
+    std::int32_t priority;
+    std::uint32_t reserved;
+};
+
+struct DeviceServiceInitParam {
+    std::uint32_t size;
+    std::uint32_t reserved;
+    const DeviceServiceThreadParam* threadParam;
+};
+
+struct DeviceServiceUsageFilter {
+    std::uint16_t usagePage;
+    std::uint16_t minimumUsage;
+    std::uint16_t maximumUsage;
+};
+
+struct MbusDeviceFunctionState {
+    std::byte data[180];
+};
+
+struct MbusDeviceDescription;
+
+struct MbusDeviceInfo;
+
+struct MbusSimulatedHandleStatus;
+
+struct MbusSparkState;
+
+struct MbusDriverCallbacks;
+
+struct MbusUsbPowerEntry;
+
+struct MbusEvent;
+
+struct alignas(8) MbusDeviceCondition {
+    std::byte data[256];
+};
+
+struct MbusDeviceServiceInfo;
+
+struct MbusEventCallbacks {
+    void (APS5_VABI *onOverflow)(std::int32_t eventHandle, void* userData);
+    void (APS5_VABI *onEvent)(std::int32_t eventHandle, void* userData, const MbusEvent* event);
+};
+
+struct MbusProcessInfo;
+
+struct MbusStartupInfo;
+
+struct MbusStartupParam;
+
+struct MbusControlStatus;
+
+struct MbusDebugDeviceInfo;
+
+struct MbusInternalInfo;
+
+struct MbusPriorityInfo;
+
+extern "C" {
+
+std::int32_t APS5_VABI sceDeviceServiceInitialize(std::int32_t mode, const DeviceServiceInitParam* param);
+std::int32_t APS5_VABI sceDeviceServiceTerminate();
+std::int32_t APS5_VABI sceDeviceServiceGetEventState(std::int32_t clear);
+std::int32_t APS5_VABI sceDeviceServiceQueryDeviceInfo_(std::int32_t deviceClass, const DeviceServiceUsageFilter* filter, std::int32_t arg2, void* infos, std::int32_t maxInfos, std::int32_t* count, std::int32_t* reserved, std::uint32_t infoSize);
+std::int32_t APS5_VABI sceDeviceServiceGetGeneration(void);
+int APS5_VABI sceMbusAcquireControl(std::uint64_t control, std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusAcquireControlList();
+int APS5_VABI sceMbusAcquireControlWithState(std::uint32_t deviceClass, std::int32_t state);
+int APS5_VABI sceMbusAcquireControlWithState2(std::uint32_t deviceClass, std::int32_t moduleId, std::int32_t state);
+int APS5_VABI sceMbusAcquireControlWithStateFlag(std::uint32_t deviceClass, std::uint32_t moduleId, std::uint32_t state, std::uint32_t flags);
+int APS5_VABI sceMbusAddHandle(std::uint32_t deviceClass, std::int32_t handle, std::uint32_t flags);
+int APS5_VABI sceMbusAddHandleByDeviceId(std::uint32_t deviceClass, std::int32_t handle, std::uint64_t deviceId, std::uint32_t first, std::uint32_t second, std::uint32_t third);
+int APS5_VABI sceMbusAddHandleByUserId(std::uint32_t deviceClass, std::int32_t handle, std::int32_t userId, std::int32_t first, std::int32_t second, std::int32_t third);
+int APS5_VABI sceMbusAddHandleByVidPid(std::uint32_t deviceClass, std::int32_t handle, std::int32_t first, std::uint16_t vendorId, std::uint16_t productId, std::int32_t second, std::int32_t third);
+int APS5_VABI sceMbusAddHandleWithModuleId(std::uint32_t deviceClass, std::int32_t handle, std::uint32_t flags, std::uint32_t moduleId);
+int APS5_VABI sceMbusAttachToApplicationByPid(std::int32_t processId, std::int32_t deviceClass, std::int32_t flags);
+int APS5_VABI sceMbusBindDeviceWithUserId(std::uint64_t deviceId, std::int32_t userId);
+int APS5_VABI sceMbusChangeAppModuleState(std::uint32_t deviceClass, std::int32_t moduleId, std::uint32_t state);
+int APS5_VABI sceMbusCheckDriverCallback();
+int APS5_VABI sceMbusConvertToLocalDeviceId(std::uint64_t deviceId, std::uint32_t* localId, std::uint32_t* deviceClass);
+int APS5_VABI sceMbusConvertToLocalDeviceId2(std::uint64_t deviceId, std::uint32_t deviceClass, std::uint64_t* localId);
+int APS5_VABI sceMbusConvertToMbusDeviceId(std::uint64_t localId, std::uint32_t deviceClass, std::uint64_t* deviceId);
+int APS5_VABI sceMbusDebugAcquireControl(std::uint64_t control, std::int32_t first, std::int32_t second, std::int32_t processId);
+int APS5_VABI sceMbusDebugAcquireControlWithState(std::uint32_t deviceClass, std::int32_t state, std::int32_t processId);
+int APS5_VABI sceMbusDebugAcquireControlWithState2(std::uint32_t deviceClass, std::int32_t moduleId, std::int32_t state, std::int32_t processId);
+int APS5_VABI sceMbusDebugAcquireControlWithStateFlag(std::uint32_t deviceClass, std::uint32_t moduleId, std::uint32_t state, std::uint32_t flags, std::int32_t processId);
+int APS5_VABI sceMbusDebugAddProcess(std::int32_t processId, std::int32_t flags, const MbusProcessInfo* info);
+int APS5_VABI sceMbusDebugCheckProcessResume(MbusProcessInfo* info, std::uint32_t flags);
+int APS5_VABI sceMbusDebugDisableBgmForShellUi(std::int32_t processId);
+int APS5_VABI sceMbusDebugGetApplicationStartupInfo(std::uint32_t appId, const MbusProcessInfo* info, MbusStartupInfo* startupInfo);
+int APS5_VABI sceMbusDebugGetControlStatus(std::int32_t deviceClass, std::int32_t processId, MbusControlStatus* status);
+int APS5_VABI sceMbusDebugGetDeviceInfo(std::uint64_t deviceClass, MbusDebugDeviceInfo* info);
+int APS5_VABI sceMbusDebugGetInternalInfo(MbusInternalInfo* info);
+int APS5_VABI sceMbusDebugGetPriorityInfo(std::uint32_t deviceClass, MbusPriorityInfo* info);
+int APS5_VABI sceMbusDebugReenableBgmForShellUi(std::int32_t processId);
+int APS5_VABI sceMbusDebugReleaseControl(std::uint64_t control, std::int32_t processId);
+int APS5_VABI sceMbusDebugRemoveCameraAppModuleFocus(std::int32_t processId);
+int APS5_VABI sceMbusDebugResumeApplication(std::int32_t appId, std::uint8_t firstFlag, std::uint8_t secondFlag, MbusProcessInfo* info);
+int APS5_VABI sceMbusDebugSetApplicationFocusByAppId(std::uint32_t appId);
+int APS5_VABI sceMbusDebugSetCameraAppModuleFocus(std::int32_t processId, std::int32_t moduleId);
+int APS5_VABI sceMbusDebugSetControllerFocusByAppId(std::uint32_t appId);
+int APS5_VABI sceMbusDebugSetOtherProcessExcludedAction(std::uint64_t control, std::uint32_t action, std::int32_t processId);
+int APS5_VABI sceMbusDebugSetPriority(std::uint64_t control, std::uint32_t priority, std::int32_t processId);
+int APS5_VABI sceMbusDebugStartApplication(std::int32_t appId, std::int32_t first, std::int32_t second, std::uint8_t firstFlag, std::uint8_t secondFlag, const MbusStartupParam* param);
+int APS5_VABI sceMbusDebugStartApplication2(std::int32_t appId, std::int32_t first, std::int32_t second, std::uint8_t firstFlag, std::uint8_t secondFlag, const MbusStartupParam* param);
+int APS5_VABI sceMbusDebugStartApplicationNull(std::int32_t appId, std::int32_t first, std::int32_t second, std::uint8_t firstFlag, std::uint8_t secondFlag);
+int APS5_VABI sceMbusDebugSuspendApplication(std::uint32_t appId);
+int APS5_VABI sceMbusDebugTerminateApplication(std::uint32_t appId);
+int APS5_VABI sceMbusDebugTerminateProcess(std::int32_t processId);
+int APS5_VABI sceMbusDetachFromApplicationByPid(std::int32_t processId, std::int32_t deviceClass);
+int APS5_VABI sceMbusDisableBgmForShellUi();
+int APS5_VABI sceMbusDisableChat(std::uint32_t deviceClass);
+int APS5_VABI sceMbusDisconnectDevice(std::uint64_t deviceId);
+int APS5_VABI sceMbusDumpAppInfo();
+int APS5_VABI sceMbusDumpDeviceInfo();
+int APS5_VABI sceMbusDumpHandleStatusInfo(std::uint64_t control, std::int32_t processId);
+int APS5_VABI sceMbusDumpHandleStatusInfoAll(std::uint32_t flags);
+int APS5_VABI sceMbusDumpModuleStateInfo(std::uint64_t control);
+int APS5_VABI sceMbusDumpModuleStateInfoAll();
+int APS5_VABI sceMbusDumpPlayerInfo();
+int APS5_VABI sceMbusDumpPortHandleInfo();
+int APS5_VABI sceMbusDumpProcMediaInfo(std::uint64_t control);
+int APS5_VABI sceMbusDumpProcMediaInfoAll();
+int APS5_VABI sceMbusDumpUserMediaInfo();
+int APS5_VABI sceMbusEnableChat(std::uint32_t deviceClass);
+int APS5_VABI sceMbusEnterAudioOutAutoAttenuation(std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusEventBusStatusChangeSubscribe(std::int32_t eventHandle, std::uint32_t first, std::uint32_t second, std::uint64_t firstValue, std::uint64_t secondValue);
+int APS5_VABI sceMbusEventBusStatusChangeUnsubscribe(std::uint64_t unusedSlot, std::int32_t subscription);
+int APS5_VABI sceMbusEventCallbackFuncsInit_(MbusEventCallbacks* callbacks, std::uint32_t size);
+int APS5_VABI sceMbusEventCreate_(std::uint32_t flags, MbusEvent* buffer, std::uint32_t capacity, const MbusEventCallbacks* callbacks, void* userData);
+int APS5_VABI sceMbusEventDestroy(std::int32_t eventHandle);
+int APS5_VABI sceMbusEventReceive(std::int32_t eventHandle, MbusEvent* events, std::int32_t capacity, std::int32_t wait);
+int APS5_VABI sceMbusGetControlStatus(std::uint64_t control, MbusControlStatus* status);
+int APS5_VABI sceMbusGetDeviceDescription(std::uint64_t deviceId, std::uint32_t selector, MbusDeviceDescription* description);
+int APS5_VABI sceMbusGetDeviceInfoByBusId_(std::int32_t busId, MbusDeviceInfo* info, std::uint32_t size);
+int APS5_VABI sceMbusGetDeviceInfoByConditionForDeviceService(std::int32_t flags, MbusDeviceServiceInfo* infos, std::int32_t capacity, std::int32_t* first, std::int32_t* second, MbusDeviceCondition condition);
+int APS5_VABI sceMbusGetDeviceInfoByCondition_(const MbusDeviceCondition* condition, std::int32_t flags, MbusDeviceInfo* infos, std::int32_t capacity, std::int32_t* first, std::int32_t* second, std::uint32_t infoSize);
+int APS5_VABI sceMbusGetDeviceInfo_(std::uint64_t deviceId, MbusDeviceInfo* info, std::uint32_t size);
+int APS5_VABI sceMbusGetSimulatedBusUsableStatusByBusType(std::uint32_t busType, std::int32_t first, std::uint64_t deviceId, std::uint32_t second, std::uint32_t third);
+int APS5_VABI sceMbusGetSimulatedHandleStatusInfo(std::int32_t deviceClass, std::int32_t first, std::int32_t second, MbusSimulatedHandleStatus* status);
+int APS5_VABI sceMbusGetSimulatedHandleStatusInfo2(std::uint32_t deviceClass, std::uint32_t first, std::uint32_t second, std::uint32_t third, MbusSimulatedHandleStatus* status);
+int APS5_VABI sceMbusGetSparkState(std::uint64_t deviceId, MbusSparkState* state);
+int APS5_VABI sceMbusInit();
+int APS5_VABI sceMbusIsBgmProhibited();
+int APS5_VABI sceMbusIsUsingDevice(std::int32_t deviceClass, std::int32_t handle);
+int APS5_VABI sceMbusLeaveAudioOutAutoAttenuation(std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusNotifyBtDisconnection(std::uint64_t deviceId);
+int APS5_VABI sceMbusNotifyDriverEvent(std::int32_t driverId, std::int32_t eventId, std::uint64_t firstValue, std::int32_t flags, std::uint64_t secondValue);
+int APS5_VABI sceMbusReenableBgmForShellUi();
+int APS5_VABI sceMbusRegisterDriver(std::int32_t driverId, const MbusDriverCallbacks* callbacks, void* userData);
+int APS5_VABI sceMbusReleaseControl(std::uint64_t control);
+int APS5_VABI sceMbusRemoveCameraAppModuleFocus();
+int APS5_VABI sceMbusRemoveHandle(std::int32_t deviceClass, std::int32_t handle);
+int APS5_VABI sceMbusRemoveProxy(std::int32_t processId, std::uint32_t deviceClass, std::uint64_t deviceId);
+int APS5_VABI sceMbusResolveByDeviceId(std::int32_t deviceClass, std::uint64_t deviceId, std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceMbusResolveByHandle(std::int32_t deviceClass, std::int32_t handle, std::int32_t flags);
+int APS5_VABI sceMbusResolveByPlayerId(std::uint32_t deviceClass, std::uint32_t playerId, std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceMbusResolveByUserId(std::uint32_t deviceClass, std::int32_t userId, std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceMbusSetAutoLoginMode(std::uint32_t mode);
+int APS5_VABI sceMbusSetCameraAppModuleFocus(std::int32_t moduleId);
+int APS5_VABI sceMbusSetDeviceFunctionState(std::uint64_t deviceId, MbusDeviceFunctionState state);
+int APS5_VABI sceMbusSetDuckingSetting(std::int32_t setting);
+int APS5_VABI sceMbusSetProxy(std::int32_t processId, std::int32_t first, std::int32_t second, std::int32_t third, std::uint64_t deviceId);
+int APS5_VABI sceMbusSetRoutingMode(std::int32_t mode);
+int APS5_VABI sceMbusSetScratchData(std::uint64_t deviceId, std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusSetScratchDataUpdatedEventMask(std::uint32_t mask);
+int APS5_VABI sceMbusSetSocialScreenAudioMode(std::int32_t first, std::int32_t second);
+int APS5_VABI sceMbusSetTestFlag(std::uint32_t flags);
+int APS5_VABI sceMbusSetThreadParam(std::int32_t priority, std::uint64_t affinityMask, std::uint64_t reserved);
+int APS5_VABI sceMbusSetUsbPowerBlackList(std::int32_t first, std::uint8_t count, const MbusUsbPowerEntry* entries);
+int APS5_VABI sceMbusSetUserMuteStatus(std::int32_t userId, std::int32_t status);
+int APS5_VABI sceMbusSetVolumeDown(std::uint32_t deviceClass, std::uint8_t volume);
+int APS5_VABI sceMbusStartAudioOutAuxBroadcast();
+int APS5_VABI sceMbusStartAudioOutSharePlay(std::int32_t mode);
+int APS5_VABI sceMbusStopAudioOutAuxBroadcast();
+int APS5_VABI sceMbusStopAudioOutSharePlay();
+int APS5_VABI sceMbusTerm();
+int APS5_VABI sceMbusUnregisterDriver(std::int32_t driverId);
+int APS5_VABI sceMbusUserLogin(std::int32_t userId);
+int APS5_VABI sceMbusUserLogout(std::int32_t userId);
+
+}
diff --git a/core/libs/prx/libSceMbus/libSceMbus.hpp b/core/libs/prx/libSceMbus/libSceMbus.hpp
new file mode 100644
index 0000000000..e6b42950e3
--- /dev/null
+++ b/core/libs/prx/libSceMbus/libSceMbus.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMbus/include/Api.hpp"
diff --git a/core/libs/prx/libSceMediaAppSharedStorage/libSceMediaAppSharedStorage.hpp b/core/libs/prx/libSceMediaAppSharedStorage/libSceMediaAppSharedStorage.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMediaAppSharedStorage/libSceMediaAppSharedStorage.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMediaFrameworkInterface/libSceMediaFrameworkInterface.hpp b/core/libs/prx/libSceMediaFrameworkInterface/libSceMediaFrameworkInterface.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMediaFrameworkInterface/libSceMediaFrameworkInterface.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMediaFrameworkUtil/libSceMediaFrameworkUtil.hpp b/core/libs/prx/libSceMediaFrameworkUtil/libSceMediaFrameworkUtil.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMediaFrameworkUtil/libSceMediaFrameworkUtil.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMetadataReaderWriter/libSceMetadataReaderWriter.hpp b/core/libs/prx/libSceMetadataReaderWriter/libSceMetadataReaderWriter.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMetadataReaderWriter/libSceMetadataReaderWriter.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMouse/Export.cpp b/core/libs/prx/libSceMouse/Export.cpp
index 121b9d2e6a..1b1cd0f317 100644
--- a/core/libs/prx/libSceMouse/Export.cpp
+++ b/core/libs/prx/libSceMouse/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMouse/include/Api.hpp"
 #include "prx/libSceMouse/include/MouseState.hpp"
 #include "prx/libc/include/General.hpp"
 
diff --git a/core/libs/prx/libSceMouse/include/Api.hpp b/core/libs/prx/libSceMouse/include/Api.hpp
new file mode 100644
index 0000000000..e37913bd10
--- /dev/null
+++ b/core/libs/prx/libSceMouse/include/Api.hpp
@@ -0,0 +1,23 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMouseInit();
+int APS5_VABI sceMouseOpen(int userId, std::int32_t type, std::int32_t index, const void* param);
+int APS5_VABI sceMouseClose(std::int32_t handle);
+int APS5_VABI sceMouseRead(std::int32_t handle, MouseData* data, std::int32_t num);
+int APS5_VABI sceMouseResetAbsolutePosition(std::int32_t handle, std::uint16_t x, std::uint16_t y);
+int APS5_VABI sceMouseConnectPort();
+int APS5_VABI sceMouseDebugGetDeviceId();
+int APS5_VABI sceMouseDeviceOpen();
+int APS5_VABI sceMouseDisconnectDevice();
+int APS5_VABI sceMouseDisconnectPort();
+int APS5_VABI sceMouseGetDeviceInfo();
+int APS5_VABI sceMouseMbusInit();
+int APS5_VABI sceMouseSetHandType();
+int APS5_VABI sceMouseSetPointerSpeed();
+int APS5_VABI sceMouseSetProcessPrivilege();
+
+}
diff --git a/core/libs/prx/libSceMouse/libSceMouse.hpp b/core/libs/prx/libSceMouse/libSceMouse.hpp
new file mode 100644
index 0000000000..512051b814
--- /dev/null
+++ b/core/libs/prx/libSceMouse/libSceMouse.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMouse/include/Api.hpp"
diff --git a/core/libs/prx/libSceMouse/tests/Mouse.cpp b/core/libs/prx/libSceMouse/tests/Mouse.cpp
index 7e7b1fcf13..27c99cc622 100644
--- a/core/libs/prx/libSceMouse/tests/Mouse.cpp
+++ b/core/libs/prx/libSceMouse/tests/Mouse.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMouse/include/Api.hpp"
 #include "prx/libSceMouse/include/mouse_structs.h"
 #include "prx/libSceMouse/include/MouseState.hpp"
 #include "prx/libSceVideoOut/include/MouseInput.hpp"
@@ -8,11 +9,7 @@
 
 extern "C" {
 bool MouseIsOpen_nid_no_patch();
-int APS5_VABI sceMouseInit();
-int APS5_VABI sceMouseOpen(int, std::int32_t, std::int32_t, const void*);
-int APS5_VABI sceMouseClose(std::int32_t);
-int APS5_VABI sceMouseRead(std::int32_t, MouseData*, std::int32_t);
-int APS5_VABI sceMouseResetAbsolutePosition(std::int32_t, std::uint16_t, std::uint16_t);
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/prx/libSceMove/Export.cpp b/core/libs/prx/libSceMove/Export.cpp
index effeda1e5c..b69438284d 100644
--- a/core/libs/prx/libSceMove/Export.cpp
+++ b/core/libs/prx/libSceMove/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMove/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <mutex>
diff --git a/core/libs/prx/libSceMove/include/Api.hpp b/core/libs/prx/libSceMove/include/Api.hpp
new file mode 100644
index 0000000000..5461d6d775
--- /dev/null
+++ b/core/libs/prx/libSceMove/include/Api.hpp
@@ -0,0 +1,29 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMoveInit(void);
+int APS5_VABI sceMoveTerm(void);
+int APS5_VABI sceMoveOpen(int32_t userId, int32_t type, int32_t index);
+int APS5_VABI sceMoveClose(int32_t handle);
+int APS5_VABI sceMoveGetDeviceInfo(int32_t handle, void* info);
+int APS5_VABI sceMoveGetExtensionPortInfo(int32_t handle, void* data);
+int APS5_VABI sceMoveReadStateLatest(int32_t handle, void* data);
+int APS5_VABI sceMoveReadStateRecent(int32_t handle, int64_t timestamp, void* data, int32_t* outCount);
+int APS5_VABI sceMoveSetVibration(int32_t handle, uint8_t motor);
+int APS5_VABI sceMoveSetLightSphere(int32_t handle, uint8_t red, uint8_t green, uint8_t blue);
+int APS5_VABI sceMoveResetLightSphere(int32_t handle);
+int APS5_VABI sceMoveGetBluetoothAddress(void);
+int APS5_VABI sceMoveGetCalibrationInfo(void);
+int APS5_VABI sceMoveGetDeviceId(void);
+int APS5_VABI sceMoveIsReproductionModel(void);
+int APS5_VABI sceMoveIsValidHandle(void);
+int APS5_VABI sceMoveReadStateRecentForTracker(void);
+int APS5_VABI sceMoveSetCalibrationMode(void);
+int APS5_VABI sceMoveSetExtensionPortOutput(void);
+int APS5_VABI sceMoveSetLightSphereForTracker(void);
+int APS5_VABI sceMoveWriteCalibrationInfo(void);
+
+}
diff --git a/core/libs/prx/libSceMove/libSceMove.hpp b/core/libs/prx/libSceMove/libSceMove.hpp
new file mode 100644
index 0000000000..522d39cc61
--- /dev/null
+++ b/core/libs/prx/libSceMove/libSceMove.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMove/include/Api.hpp"
diff --git a/core/libs/prx/libSceMoveTracker/Export.cpp b/core/libs/prx/libSceMoveTracker/Export.cpp
index ef780c7000..e1c32fd781 100644
--- a/core/libs/prx/libSceMoveTracker/Export.cpp
+++ b/core/libs/prx/libSceMoveTracker/Export.cpp
@@ -1,13 +1,9 @@
+#include "prx/libSceMoveTracker/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct MoveTrackerCameraFrame;
-struct MoveTrackerControllerInput;
-struct MoveTrackerState;
-struct MoveTrackerPlaybackInfo;
-
 extern "C" {
 
 int APS5_VABI sceMoveTrackerCalibrateReset() {
diff --git a/core/libs/prx/libSceMoveTracker/include/Api.hpp b/core/libs/prx/libSceMoveTracker/include/Api.hpp
new file mode 100644
index 0000000000..bfe72f92fd
--- /dev/null
+++ b/core/libs/prx/libSceMoveTracker/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct MoveTrackerCameraFrame;
+
+struct MoveTrackerControllerInput;
+
+struct MoveTrackerPlaybackInfo;
+
+struct MoveTrackerState;
+
+extern "C" {
+
+int APS5_VABI sceMoveTrackerCalibrateReset();
+int APS5_VABI sceMoveTrackerCalibrateYaw(std::int32_t handle, const float* direction);
+int APS5_VABI sceMoveTrackerCameraUpdate(const MoveTrackerCameraFrame* frames);
+int APS5_VABI sceMoveTrackerCaptureInit(void* imageMemory, std::int32_t capacity, std::int32_t interval, const char* path, std::int32_t mode);
+int APS5_VABI sceMoveTrackerCaptureTerm();
+int APS5_VABI sceMoveTrackerControllersUpdate(const MoveTrackerControllerInput* controllers);
+int APS5_VABI sceMoveTrackerGetState(std::int32_t handle, std::uint64_t timestamp, MoveTrackerState* state);
+int APS5_VABI sceMoveTrackerGetVersion();
+int APS5_VABI sceMoveTrackerGetWorkingMemorySize(std::uint32_t* totalSize, std::uint32_t* processingSize);
+int APS5_VABI sceMoveTrackerInit(void* workMemory, std::uint64_t requiredArgument, std::uint32_t pipeId, std::uint32_t queueId);
+int APS5_VABI sceMoveTrackerPlayGetImages(MoveTrackerCameraFrame* frames);
+int APS5_VABI sceMoveTrackerPlayGetStates(MoveTrackerPlaybackInfo* info, MoveTrackerState* states);
+int APS5_VABI sceMoveTrackerPlayStart();
+int APS5_VABI sceMoveTrackerPlayStep();
+int APS5_VABI sceMoveTrackerRecordSave();
+int APS5_VABI sceMoveTrackerRecordStart();
+int APS5_VABI sceMoveTrackerRecordStop();
+int APS5_VABI sceMoveTrackerTerm();
+
+}
diff --git a/core/libs/prx/libSceMoveTracker/libSceMoveTracker.hpp b/core/libs/prx/libSceMoveTracker/libSceMoveTracker.hpp
new file mode 100644
index 0000000000..02c0750675
--- /dev/null
+++ b/core/libs/prx/libSceMoveTracker/libSceMoveTracker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMoveTracker/include/Api.hpp"
diff --git a/core/libs/prx/libSceMsgDialog.native/Export.cpp b/core/libs/prx/libSceMsgDialog.native/Export.cpp
index 339bf0049a..52d1a12279 100644
--- a/core/libs/prx/libSceMsgDialog.native/Export.cpp
+++ b/core/libs/prx/libSceMsgDialog.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp b/core/libs/prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp
new file mode 100644
index 0000000000..ec8e5c89ab
--- /dev/null
+++ b/core/libs/prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp
@@ -0,0 +1,5 @@
+#pragma once
+
+#include "prx/libSceMsgDialog/include/Api.hpp"
+
+extern "C" int APS5_VABI sceMsgDialogGetResult(MsgDialogResult* result);
diff --git a/core/libs/prx/libSceMsgDialog/Export.cpp b/core/libs/prx/libSceMsgDialog/Export.cpp
index 1e02b26eab..a94de137f5 100644
--- a/core/libs/prx/libSceMsgDialog/Export.cpp
+++ b/core/libs/prx/libSceMsgDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMsgDialog/include/Api.hpp"
 // libSceMsgDialog: message dialog state machine (NONE -> INITIALIZED -> RUNNING -> FINISHED) without a visible dialog.
 // The dialog "closes" with the affirmative button after a couple of status polls, so a title waiting for the user
 // never blocks. The message text is logged for the first calls.
@@ -25,7 +26,6 @@ constexpr int kStatusFinished = 3;
 
 constexpr int kErrOk = 0;
 constexpr int kErrNotInitialized = static_cast<int>(0x80B80003u);
-constexpr int kErrNotFinished = static_cast<int>(0x80B80005u);
 constexpr int kErrBusy = static_cast<int>(0x80B80007u);
 constexpr int kErrNotRunning = static_cast<int>(0x80B8000Bu);
 constexpr int kErrArgNull = static_cast<int>(0x80B8000Du);
@@ -42,7 +42,6 @@ constexpr int kButtonTypeYesNoFocusNo = 4;
 
 constexpr int kButtonIdOk = 1;   // OK / YES / BUTTON1
 constexpr int kButtonIdNo = 2;   // NO / BUTTON2
-constexpr int kResultOk = 0;
 
 std::mutex g_lock;
 int g_status = kStatusNone;
@@ -137,15 +136,6 @@ int APS5_VABI sceMsgDialogGetStatus(void) {
 int APS5_VABI sceMsgDialogUpdateStatus(void) {
  return Poll();
 }
-// SceMsgDialogResult: { int32 mode; int32 result; int32 buttonId; uint8 reserved[32] }.
-int APS5_VABI sceMsgDialogGetResult(void* result) {
- if (result == nullptr) return kErrArgNull;
- std::lock_guard g(g_lock);
- if (g_status != kStatusFinished) return kErrNotFinished;
- std::int32_t out[3] = {g_mode, kResultOk, g_buttonId};
- std::memcpy(result, out, sizeof(out));
- return kErrOk;
-}
 int APS5_VABI sceMsgDialogClose(void) {
  std::lock_guard g(g_lock);
  if (g_status != kStatusRunning) return kErrNotRunning;
diff --git a/core/libs/prx/libSceMsgDialog/include/Api.hpp b/core/libs/prx/libSceMsgDialog/include/Api.hpp
new file mode 100644
index 0000000000..44ceec5270
--- /dev/null
+++ b/core/libs/prx/libSceMsgDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMsgDialogInitialize(void);
+int APS5_VABI sceMsgDialogTerminate(void);
+int APS5_VABI sceMsgDialogOpen(const void* param);
+int APS5_VABI sceMsgDialogGetStatus(void);
+int APS5_VABI sceMsgDialogUpdateStatus(void);
+int APS5_VABI sceMsgDialogClose(void);
+int APS5_VABI sceMsgDialogProgressBarInc(int target, std::uint32_t delta);
+int APS5_VABI sceMsgDialogProgressBarSetMsg(int target, const char* msg);
+int APS5_VABI sceMsgDialogProgressBarSetValue(int target, std::uint32_t rate);
+
+}
diff --git a/core/libs/prx/libSceMsgDialog/libSceMsgDialog.hpp b/core/libs/prx/libSceMsgDialog/libSceMsgDialog.hpp
new file mode 100644
index 0000000000..f25195526f
--- /dev/null
+++ b/core/libs/prx/libSceMsgDialog/libSceMsgDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMsgDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceMusicCoreInterface/libSceMusicCoreInterface.hpp b/core/libs/prx/libSceMusicCoreInterface/libSceMusicCoreInterface.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceMusicCoreInterface/libSceMusicCoreInterface.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp b/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp
index dc0e9adc97..9053d6ba40 100644
--- a/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp
+++ b/core/libs/prx/libSceMusicFrameworkInterface/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMusicFrameworkInterface/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceMusicFrameworkInterface/include/Api.hpp b/core/libs/prx/libSceMusicFrameworkInterface/include/Api.hpp
new file mode 100644
index 0000000000..8164b75a7d
--- /dev/null
+++ b/core/libs/prx/libSceMusicFrameworkInterface/include/Api.hpp
@@ -0,0 +1,25 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceMusicFwGetCurrentTime();
+int APS5_VABI sceMusicFwGetLoop();
+int APS5_VABI sceMusicFwGetMuted();
+int APS5_VABI sceMusicFwGetNetworkState();
+int APS5_VABI sceMusicFwGetVolume();
+int APS5_VABI sceMusicFwIsEnded();
+int APS5_VABI sceMusicFwIsPlaying();
+int APS5_VABI sceMusicFwIsStopped();
+int APS5_VABI sceMusicFwRemoveSrc();
+int APS5_VABI sceMusicFwSendMessageAsynchronously();
+int APS5_VABI sceMusicFwSendMessageSynchronously();
+int APS5_VABI sceMusicFwSetCurrentTime();
+int APS5_VABI sceMusicFwSetLoop();
+int APS5_VABI sceMusicFwSetShuffle();
+int APS5_VABI sceMusicFwSetVolume();
+int APS5_VABI sceMusicFwSkipNext();
+int APS5_VABI sceMusicFwSkipPrevious();
+
+}
diff --git a/core/libs/prx/libSceMusicFrameworkInterface/libSceMusicFrameworkInterface.hpp b/core/libs/prx/libSceMusicFrameworkInterface/libSceMusicFrameworkInterface.hpp
new file mode 100644
index 0000000000..83fbfaf531
--- /dev/null
+++ b/core/libs/prx/libSceMusicFrameworkInterface/libSceMusicFrameworkInterface.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceMusicFrameworkInterface/include/Api.hpp"
diff --git a/core/libs/prx/libSceNKWeb/Export.cpp b/core/libs/prx/libSceNKWeb/Export.cpp
index 81401ab485..fdef9184da 100644
--- a/core/libs/prx/libSceNKWeb/Export.cpp
+++ b/core/libs/prx/libSceNKWeb/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNKWeb/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNKWeb/include/Api.hpp b/core/libs/prx/libSceNKWeb/include/Api.hpp
new file mode 100644
index 0000000000..57b480c9e7
--- /dev/null
+++ b/core/libs/prx/libSceNKWeb/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNKWebInitialize();
+int APS5_VABI sceNKWebTerminate();
+
+}
diff --git a/core/libs/prx/libSceNKWeb/libSceNKWeb.hpp b/core/libs/prx/libSceNKWeb/libSceNKWeb.hpp
new file mode 100644
index 0000000000..d65e494889
--- /dev/null
+++ b/core/libs/prx/libSceNKWeb/libSceNKWeb.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNKWeb/include/Api.hpp"
diff --git a/core/libs/prx/libSceNKWebCdlgInjectedBundle/libSceNKWebCdlgInjectedBundle.hpp b/core/libs/prx/libSceNKWebCdlgInjectedBundle/libSceNKWebCdlgInjectedBundle.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNKWebCdlgInjectedBundle/libSceNKWebCdlgInjectedBundle.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNKWebKit/Export.cpp b/core/libs/prx/libSceNKWebKit/Export.cpp
index d81f4a5e32..43ccd2eeb3 100644
--- a/core/libs/prx/libSceNKWebKit/Export.cpp
+++ b/core/libs/prx/libSceNKWebKit/Export.cpp
@@ -1,3 +1,153 @@
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
+#include "prx/libSceNKWebKit/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
@@ -5,6 +155,754 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceNKWebKitUnknown____URPJNZ18_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++-URPJNZ18", sceNKWebKitUnknown____URPJNZ18_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown___67uYkhqBU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++67uYkhqBU", sceNKWebKitUnknown___67uYkhqBU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown___8RYr2gjrw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++8RYr2gjrw", sceNKWebKitUnknown___8RYr2gjrw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown___BntMcao1o_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++BntMcao1o", sceNKWebKitUnknown___BntMcao1o_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown___R8IXi10PI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++R8IXi10PI", sceNKWebKitUnknown___R8IXi10PI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown___j2h_QO22w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++j2h+QO22w", sceNKWebKitUnknown___j2h_QO22w_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown____7XwmYLnI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+-+7XwmYLnI", sceNKWebKitUnknown____7XwmYLnI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown___wmVyLhgm0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+-wmVyLhgm0", sceNKWebKitUnknown___wmVyLhgm0_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__0QEt8ZQWgg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+0QEt8ZQWgg", sceNKWebKitUnknown__0QEt8ZQWgg_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__0YNxcA_duk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+0YNxcA-duk", sceNKWebKitUnknown__0YNxcA_duk_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__0ZZzGYxx_I_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+0ZZzGYxx+I", sceNKWebKitUnknown__0ZZzGYxx_I_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__0rdnkSicqk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+0rdnkSicqk", sceNKWebKitUnknown__0rdnkSicqk_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__1Ex5GCP8Xs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+1Ex5GCP8Xs", sceNKWebKitUnknown__1Ex5GCP8Xs_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__1FfZ_0sxvQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+1FfZ+0sxvQ", sceNKWebKitUnknown__1FfZ_0sxvQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__1ObAtzCrYE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+1ObAtzCrYE", sceNKWebKitUnknown__1ObAtzCrYE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__1n_h4FUu9E_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+1n+h4FUu9E", sceNKWebKitUnknown__1n_h4FUu9E_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__26aZpK535w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+26aZpK535w", sceNKWebKitUnknown__26aZpK535w_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__2XuBaAXb_4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+2XuBaAXb+4", sceNKWebKitUnknown__2XuBaAXb_4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__2rTX2KM7Ms_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+2rTX2KM7Ms", sceNKWebKitUnknown__2rTX2KM7Ms_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__31dbB3S_6Y_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+31dbB3S-6Y", sceNKWebKitUnknown__31dbB3S_6Y_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__3p6wRzzzlQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+3p6wRzzzlQ", sceNKWebKitUnknown__3p6wRzzzlQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__4_GNOUIBt0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+4-GNOUIBt0", sceNKWebKitUnknown__4_GNOUIBt0_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__45BiDnCTxw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+45BiDnCTxw", sceNKWebKitUnknown__45BiDnCTxw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__4lVmXsIwqM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+4lVmXsIwqM", sceNKWebKitUnknown__4lVmXsIwqM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__5E2YZZIstM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+5E2YZZIstM", sceNKWebKitUnknown__5E2YZZIstM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__5V_UOk8zS4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+5V-UOk8zS4", sceNKWebKitUnknown__5V_UOk8zS4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__63IB3UdMOY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+63IB3UdMOY", sceNKWebKitUnknown__63IB3UdMOY_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__6boXsT6XFA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+6boXsT6XFA", sceNKWebKitUnknown__6boXsT6XFA_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__79w68212vg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+79w68212vg", sceNKWebKitUnknown__79w68212vg_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__7HpqmfJz48_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+7HpqmfJz48", sceNKWebKitUnknown__7HpqmfJz48_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__8T1y8Y_lgQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+8T1y8Y-lgQ", sceNKWebKitUnknown__8T1y8Y_lgQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__8VuTEFp13s_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+8VuTEFp13s", sceNKWebKitUnknown__8VuTEFp13s_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__9TKACifR2g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+9TKACifR2g", sceNKWebKitUnknown__9TKACifR2g_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__9ZBRWNf4og_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+9ZBRWNf4og", sceNKWebKitUnknown__9ZBRWNf4og_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__9us0nrDaCU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+9us0nrDaCU", sceNKWebKitUnknown__9us0nrDaCU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__AIEKk6K05M_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+AIEKk6K05M", sceNKWebKitUnknown__AIEKk6K05M_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Abk7CfTivU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Abk7CfTivU", sceNKWebKitUnknown__Abk7CfTivU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__AnsPWo12m8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+AnsPWo12m8", sceNKWebKitUnknown__AnsPWo12m8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__BDqCDede1o_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+BDqCDede1o", sceNKWebKitUnknown__BDqCDede1o_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__BSUP6XSeAw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+BSUP6XSeAw", sceNKWebKitUnknown__BSUP6XSeAw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__BZCJi3OIiQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+BZCJi3OIiQ", sceNKWebKitUnknown__BZCJi3OIiQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ByVxWl1pW8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ByVxWl1pW8", sceNKWebKitUnknown__ByVxWl1pW8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__CgSI_4D534_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+CgSI-4D534", sceNKWebKitUnknown__CgSI_4D534_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__CpPA9_CKUA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+CpPA9+CKUA", sceNKWebKitUnknown__CpPA9_CKUA_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__DcUw5YwkSY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+DcUw5YwkSY", sceNKWebKitUnknown__DcUw5YwkSY_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__DpDBrSZWUc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+DpDBrSZWUc", sceNKWebKitUnknown__DpDBrSZWUc_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__E3D_W4kpl8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+E3D-W4kpl8", sceNKWebKitUnknown__E3D_W4kpl8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__EN6MgNmVv4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+EN6MgNmVv4", sceNKWebKitUnknown__EN6MgNmVv4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ErgockOJwc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ErgockOJwc", sceNKWebKitUnknown__ErgockOJwc_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__FKudG3uS8A_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+FKudG3uS8A", sceNKWebKitUnknown__FKudG3uS8A_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__FWUl_T8yG8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+FWUl-T8yG8", sceNKWebKitUnknown__FWUl_T8yG8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Fca5Eyr4BU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Fca5Eyr4BU", sceNKWebKitUnknown__Fca5Eyr4BU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__FcvpbbdrZM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+FcvpbbdrZM", sceNKWebKitUnknown__FcvpbbdrZM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__FvUhrQaiJQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+FvUhrQaiJQ", sceNKWebKitUnknown__FvUhrQaiJQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__GOwQvxqztE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+GOwQvxqztE", sceNKWebKitUnknown__GOwQvxqztE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Gp0M0sPj9I_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Gp0M0sPj9I", sceNKWebKitUnknown__Gp0M0sPj9I_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__H_bnpXdWtk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+H-bnpXdWtk", sceNKWebKitUnknown__H_bnpXdWtk_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__H5PTMieXNE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+H5PTMieXNE", sceNKWebKitUnknown__H5PTMieXNE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__HuPyGuX_jY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+HuPyGuX+jY", sceNKWebKitUnknown__HuPyGuX_jY_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__IMGO_dXHis_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+IMGO+dXHis", sceNKWebKitUnknown__IMGO_dXHis_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ImJ026_DAw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ImJ026-DAw", sceNKWebKitUnknown__ImJ026_DAw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__IoqHgIw0PM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+IoqHgIw0PM", sceNKWebKitUnknown__IoqHgIw0PM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__JnngM7WyHI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+JnngM7WyHI", sceNKWebKitUnknown__JnngM7WyHI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Kb7j57jDzs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Kb7j57jDzs", sceNKWebKitUnknown__Kb7j57jDzs_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Kx_IV_21hk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Kx-IV+21hk", sceNKWebKitUnknown__Kx_IV_21hk_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__LUabdo811U_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+LUabdo811U", sceNKWebKitUnknown__LUabdo811U_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__LiOmqon2ZI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+LiOmqon2ZI", sceNKWebKitUnknown__LiOmqon2ZI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__LoAenYdWlM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+LoAenYdWlM", sceNKWebKitUnknown__LoAenYdWlM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__LrmM3KN3N8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+LrmM3KN3N8", sceNKWebKitUnknown__LrmM3KN3N8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__MzGFuNN348_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+MzGFuNN348", sceNKWebKitUnknown__MzGFuNN348_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__N_GwpCV4yk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+N-GwpCV4yk", sceNKWebKitUnknown__N_GwpCV4yk_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__N6UhRaLrJE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+N6UhRaLrJE", sceNKWebKitUnknown__N6UhRaLrJE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__NGrXdCa0q8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+NGrXdCa0q8", sceNKWebKitUnknown__NGrXdCa0q8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__NiLTGGKF_E_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+NiLTGGKF+E", sceNKWebKitUnknown__NiLTGGKF_E_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Nqfy8HVG84_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Nqfy8HVG84", sceNKWebKitUnknown__Nqfy8HVG84_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__NuhuZH75ak_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+NuhuZH75ak", sceNKWebKitUnknown__NuhuZH75ak_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__OCxbaKiBUo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+OCxbaKiBUo", sceNKWebKitUnknown__OCxbaKiBUo_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__OOjOkuWL6g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+OOjOkuWL6g", sceNKWebKitUnknown__OOjOkuWL6g_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__OkTn3_PBxM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+OkTn3+PBxM", sceNKWebKitUnknown__OkTn3_PBxM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__PDx3sfB_l4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+PDx3sfB-l4", sceNKWebKitUnknown__PDx3sfB_l4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__POsWAWjXo8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+POsWAWjXo8", sceNKWebKitUnknown__POsWAWjXo8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__PeIrQMgYpw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+PeIrQMgYpw", sceNKWebKitUnknown__PeIrQMgYpw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Q7xLvpc0PA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Q7xLvpc0PA", sceNKWebKitUnknown__Q7xLvpc0PA_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__QL3zQ6ZNy4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+QL3zQ6ZNy4", sceNKWebKitUnknown__QL3zQ6ZNy4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__QqzEnc5c80_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+QqzEnc5c80", sceNKWebKitUnknown__QqzEnc5c80_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__R0GXLrsPM0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+R0GXLrsPM0", sceNKWebKitUnknown__R0GXLrsPM0_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__R2eXISeSvw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+R2eXISeSvw", sceNKWebKitUnknown__R2eXISeSvw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__RkwSDm5kGU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+RkwSDm5kGU", sceNKWebKitUnknown__RkwSDm5kGU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__RtBREW92M0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+RtBREW92M0", sceNKWebKitUnknown__RtBREW92M0_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__S72K_fa2_8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+S72K+fa2-8", sceNKWebKitUnknown__S72K_fa2_8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__S7ftAAWhoQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+S7ftAAWhoQ", sceNKWebKitUnknown__S7ftAAWhoQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__SHzgUiuQDE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+SHzgUiuQDE", sceNKWebKitUnknown__SHzgUiuQDE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Sgy63JgEgQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Sgy63JgEgQ", sceNKWebKitUnknown__Sgy63JgEgQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__Sozphy1Wa8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+Sozphy1Wa8", sceNKWebKitUnknown__Sozphy1Wa8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__TPntL1OK80_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+TPntL1OK80", sceNKWebKitUnknown__TPntL1OK80_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__TT_AplhQWA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+TT+AplhQWA", sceNKWebKitUnknown__TT_AplhQWA_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__TjNmuhxdBQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+TjNmuhxdBQ", sceNKWebKitUnknown__TjNmuhxdBQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__U_nxwdrnDY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+U-nxwdrnDY", sceNKWebKitUnknown__U_nxwdrnDY_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__UKI_MUuiCU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+UKI-MUuiCU", sceNKWebKitUnknown__UKI_MUuiCU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__VvktcfIouQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+VvktcfIouQ", sceNKWebKitUnknown__VvktcfIouQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__WS2yRv5aBI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+WS2yRv5aBI", sceNKWebKitUnknown__WS2yRv5aBI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__XZfnHByVO0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+XZfnHByVO0", sceNKWebKitUnknown__XZfnHByVO0_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__YBfWz5udq4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+YBfWz5udq4", sceNKWebKitUnknown__YBfWz5udq4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__YPwmEWTZwE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+YPwmEWTZwE", sceNKWebKitUnknown__YPwmEWTZwE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__YYEOsi3IMk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+YYEOsi3IMk", sceNKWebKitUnknown__YYEOsi3IMk_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__YyqQTUIQJQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+YyqQTUIQJQ", sceNKWebKitUnknown__YyqQTUIQJQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ZgGbFykhls_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ZgGbFykhls", sceNKWebKitUnknown__ZgGbFykhls_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ZwjLJ74Y38_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ZwjLJ74Y38", sceNKWebKitUnknown__ZwjLJ74Y38_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__b1xwU7aUwU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+b1xwU7aUwU", sceNKWebKitUnknown__b1xwU7aUwU_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__b5TfVQ3_4s_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+b5TfVQ3-4s", sceNKWebKitUnknown__b5TfVQ3_4s_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__bDb7iby5NI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+bDb7iby5NI", sceNKWebKitUnknown__bDb7iby5NI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__baqz7ahOng_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+baqz7ahOng", sceNKWebKitUnknown__baqz7ahOng_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__bvtn3pCtek_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+bvtn3pCtek", sceNKWebKitUnknown__bvtn3pCtek_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__byORTSkWQo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+byORTSkWQo", sceNKWebKitUnknown__byORTSkWQo_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__dAwquupevQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+dAwquupevQ", sceNKWebKitUnknown__dAwquupevQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__dTlroLZao8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+dTlroLZao8", sceNKWebKitUnknown__dTlroLZao8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__eVN0UdRT8c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+eVN0UdRT8c", sceNKWebKitUnknown__eVN0UdRT8c_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__fTKZiGqo8E_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+fTKZiGqo8E", sceNKWebKitUnknown__fTKZiGqo8E_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__feeFP8Y2_c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+feeFP8Y2+c", sceNKWebKitUnknown__feeFP8Y2_c_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__iLBOBrdx5A_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+iLBOBrdx5A", sceNKWebKitUnknown__iLBOBrdx5A_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__iLdIVuhDhY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+iLdIVuhDhY", sceNKWebKitUnknown__iLdIVuhDhY_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__jG4wqqA8yg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+jG4wqqA8yg", sceNKWebKitUnknown__jG4wqqA8yg_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__jLvgfDA97c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+jLvgfDA97c", sceNKWebKitUnknown__jLvgfDA97c_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ji7IBGwnCM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ji7IBGwnCM", sceNKWebKitUnknown__ji7IBGwnCM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__k3JGU_UUXo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+k3JGU-UUXo", sceNKWebKitUnknown__k3JGU_UUXo_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__kX_CdbguB0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+kX-CdbguB0", sceNKWebKitUnknown__kX_CdbguB0_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__keSg8ay8cE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+keSg8ay8cE", sceNKWebKitUnknown__keSg8ay8cE_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__lI9zCCS_HQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+lI9zCCS-HQ", sceNKWebKitUnknown__lI9zCCS_HQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__lwLqZJLo3g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+lwLqZJLo3g", sceNKWebKitUnknown__lwLqZJLo3g_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__mS029ncrbo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+mS029ncrbo", sceNKWebKitUnknown__mS029ncrbo_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__mYy22Ucg7Y_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+mYy22Ucg7Y", sceNKWebKitUnknown__mYy22Ucg7Y_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__nHWcLWOmb4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+nHWcLWOmb4", sceNKWebKitUnknown__nHWcLWOmb4_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__nSg5kHtXkg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+nSg5kHtXkg", sceNKWebKitUnknown__nSg5kHtXkg_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__nc3IouJMEA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+nc3IouJMEA", sceNKWebKitUnknown__nc3IouJMEA_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ndmq8LhAjA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ndmq8LhAjA", sceNKWebKitUnknown__ndmq8LhAjA_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__nrEMsyYHiw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+nrEMsyYHiw", sceNKWebKitUnknown__nrEMsyYHiw_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__oJHrfcyJJM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+oJHrfcyJJM", sceNKWebKitUnknown__oJHrfcyJJM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__ovAafdG0O8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+ovAafdG0O8", sceNKWebKitUnknown__ovAafdG0O8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__pWGccNXto8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+pWGccNXto8", sceNKWebKitUnknown__pWGccNXto8_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__q0GELad_mY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+q0GELad-mY", sceNKWebKitUnknown__q0GELad_mY_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__qXuNlEFSRQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+qXuNlEFSRQ", sceNKWebKitUnknown__qXuNlEFSRQ_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__qsTbJFS86A_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+qsTbJFS86A", sceNKWebKitUnknown__qsTbJFS86A_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__r_TJDA2yIM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+r+TJDA2yIM", sceNKWebKitUnknown__r_TJDA2yIM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__r0UH41I1dI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+r0UH41I1dI", sceNKWebKitUnknown__r0UH41I1dI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__r8OGkuL4dc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+r8OGkuL4dc", sceNKWebKitUnknown__r8OGkuL4dc_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__rFA8ZR_qaI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+rFA8ZR+qaI", sceNKWebKitUnknown__rFA8ZR_qaI_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__rPvFDsPbXM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+rPvFDsPbXM", sceNKWebKitUnknown__rPvFDsPbXM_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__sUvE9LF80k_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+sUvE9LF80k", sceNKWebKitUnknown__sUvE9LF80k_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__suuwfNT5Oc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+suuwfNT5Oc", sceNKWebKitUnknown__suuwfNT5Oc_nid_no_patch);
+
+int APS5_VABI sceNKWebKitUnknown__t_MaTLADe4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+t-MaTLADe4", sceNKWebKitUnknown__t_MaTLADe4_nid_no_patch);
 
 }
diff --git a/core/libs/prx/libSceNKWebKit/include/Api.hpp b/core/libs/prx/libSceNKWebKit/include/Api.hpp
new file mode 100644
index 0000000000..9312101ad1
--- /dev/null
+++ b/core/libs/prx/libSceNKWebKit/include/Api.hpp
@@ -0,0 +1,158 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNKWebKitUnknown____URPJNZ18_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___67uYkhqBU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___8RYr2gjrw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___BntMcao1o_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___R8IXi10PI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___j2h_QO22w_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown____7XwmYLnI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown___wmVyLhgm0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0QEt8ZQWgg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0YNxcA_duk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0ZZzGYxx_I_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__0rdnkSicqk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1Ex5GCP8Xs_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1FfZ_0sxvQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1ObAtzCrYE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__1n_h4FUu9E_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__26aZpK535w_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__2XuBaAXb_4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__2rTX2KM7Ms_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__31dbB3S_6Y_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__3p6wRzzzlQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__4_GNOUIBt0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__45BiDnCTxw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__4lVmXsIwqM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__5E2YZZIstM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__5V_UOk8zS4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__63IB3UdMOY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__6boXsT6XFA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__79w68212vg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__7HpqmfJz48_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__8T1y8Y_lgQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__8VuTEFp13s_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__9TKACifR2g_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__9ZBRWNf4og_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__9us0nrDaCU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__AIEKk6K05M_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Abk7CfTivU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__AnsPWo12m8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__BDqCDede1o_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__BSUP6XSeAw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__BZCJi3OIiQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ByVxWl1pW8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__CgSI_4D534_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__CpPA9_CKUA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__DcUw5YwkSY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__DpDBrSZWUc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__E3D_W4kpl8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__EN6MgNmVv4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ErgockOJwc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FKudG3uS8A_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FWUl_T8yG8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Fca5Eyr4BU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FcvpbbdrZM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__FvUhrQaiJQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__GOwQvxqztE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Gp0M0sPj9I_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__H_bnpXdWtk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__H5PTMieXNE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__HuPyGuX_jY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__IMGO_dXHis_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ImJ026_DAw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__IoqHgIw0PM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__JnngM7WyHI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Kb7j57jDzs_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Kx_IV_21hk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LUabdo811U_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LiOmqon2ZI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LoAenYdWlM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__LrmM3KN3N8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__MzGFuNN348_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__N_GwpCV4yk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__N6UhRaLrJE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__NGrXdCa0q8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__NiLTGGKF_E_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Nqfy8HVG84_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__NuhuZH75ak_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__OCxbaKiBUo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__OOjOkuWL6g_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__OkTn3_PBxM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__PDx3sfB_l4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__POsWAWjXo8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__PeIrQMgYpw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Q7xLvpc0PA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__QL3zQ6ZNy4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__QqzEnc5c80_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__R0GXLrsPM0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__R2eXISeSvw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__RkwSDm5kGU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__RtBREW92M0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__S72K_fa2_8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__S7ftAAWhoQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__SHzgUiuQDE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Sgy63JgEgQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__Sozphy1Wa8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__TPntL1OK80_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__TT_AplhQWA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__TjNmuhxdBQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__U_nxwdrnDY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__UKI_MUuiCU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__VvktcfIouQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__WS2yRv5aBI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__XZfnHByVO0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YBfWz5udq4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YPwmEWTZwE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YYEOsi3IMk_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__YyqQTUIQJQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ZgGbFykhls_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ZwjLJ74Y38_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__b1xwU7aUwU_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__b5TfVQ3_4s_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__bDb7iby5NI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__baqz7ahOng_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__bvtn3pCtek_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__byORTSkWQo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__dAwquupevQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__dTlroLZao8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__eVN0UdRT8c_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__fTKZiGqo8E_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__feeFP8Y2_c_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__iLBOBrdx5A_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__iLdIVuhDhY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__jG4wqqA8yg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__jLvgfDA97c_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ji7IBGwnCM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__k3JGU_UUXo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__kX_CdbguB0_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__keSg8ay8cE_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__lI9zCCS_HQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__lwLqZJLo3g_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__mS029ncrbo_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__mYy22Ucg7Y_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nHWcLWOmb4_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nSg5kHtXkg_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nc3IouJMEA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ndmq8LhAjA_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__nrEMsyYHiw_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__oJHrfcyJJM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__ovAafdG0O8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__pWGccNXto8_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__q0GELad_mY_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__qXuNlEFSRQ_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__qsTbJFS86A_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__r_TJDA2yIM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__r0UH41I1dI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__r8OGkuL4dc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__rFA8ZR_qaI_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__rPvFDsPbXM_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__sUvE9LF80k_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__suuwfNT5Oc_nid_no_patch();
+int APS5_VABI sceNKWebKitUnknown__t_MaTLADe4_nid_no_patch();
+
+}
diff --git a/core/libs/prx/libSceNKWebKit/libSceNKWebKit.hpp b/core/libs/prx/libSceNKWebKit/libSceNKWebKit.hpp
new file mode 100644
index 0000000000..f291edcd57
--- /dev/null
+++ b/core/libs/prx/libSceNKWebKit/libSceNKWebKit.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNKWebKit/include/Api.hpp"
diff --git a/core/libs/prx/libSceNKWebKitRequirements/libSceNKWebKitRequirements.hpp b/core/libs/prx/libSceNKWebKitRequirements/libSceNKWebKitRequirements.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNKWebKitRequirements/libSceNKWebKitRequirements.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNet/CMakeLists.txt b/core/libs/prx/libSceNet/CMakeLists.txt
index da836624e9..dbf0992fae 100644
--- a/core/libs/prx/libSceNet/CMakeLists.txt
+++ b/core/libs/prx/libSceNet/CMakeLists.txt
@@ -8,6 +8,17 @@ if(BUILD_TESTING)
     target_include_directories(net_dontwait_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(net_dontwait_tests PRIVATE libSceNet libkernel libc)
     configure_windows_unwind(net_dontwait_tests)
+    add_test_executable(guest_net_buffer_validation_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetBufferValidation.cpp)
+    target_include_directories(guest_net_buffer_validation_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_buffer_validation_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_buffer_validation_tests)
+    add_test(NAME guest_net_buffer_validation COMMAND guest_net_buffer_validation_tests)
+    set_tests_properties(guest_net_buffer_validation PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        target_link_libraries(guest_net_buffer_validation_tests PRIVATE ws2_32)
+        set_tests_properties(guest_net_buffer_validation PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+    endif()
     foreach(api IN ITEMS send sendto sendmsg recv recvfrom recvmsg duplex blocking)
         add_test(NAME net_dontwait_${api} COMMAND net_dontwait_tests ${api})
         set_tests_properties(net_dontwait_${api} PROPERTIES TIMEOUT 20)
@@ -66,15 +77,34 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
         endforeach()
     endif()
+    if(WIN32)
+        add_test_executable(net_empty_stream_tests ${LIBS_INCLUDE_DIR}/tests/NetEmptyStream.cpp)
+        target_include_directories(net_empty_stream_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(net_empty_stream_tests PRIVATE libSceNet libkernel libc)
+        configure_windows_unwind(net_empty_stream_tests)
+        foreach(api IN ITEMS recv recvfrom recvmsg)
+            foreach(mode IN ITEMS empty dontwait peek nonblocking queued nullbuf errors datagram)
+                add_test(NAME net_empty_stream_${api}_${mode} COMMAND net_empty_stream_tests ${api} ${mode})
+                set_tests_properties(net_empty_stream_${api}_${mode} PROPERTIES TIMEOUT 20
+                    ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
+            endforeach()
+        endforeach()
+    endif()
     add_test_executable(guest_sce_net_tests ${LIBS_INCLUDE_DIR}/tests/GuestSceNet.cpp)
     target_include_directories(guest_sce_net_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_sce_net_tests PRIVATE libSceNet libSceNetCtl libkernel libc)
     configure_windows_unwind(guest_sce_net_tests)
     add_test(NAME guest_sce_net COMMAND guest_sce_net_tests)
+    add_test_executable(guest_net_thread_tests ${LIBS_INCLUDE_DIR}/tests/GuestNetThread.cpp)
+    target_include_directories(guest_net_thread_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_net_thread_tests PRIVATE libSceNet libkernel libc)
+    configure_windows_unwind(guest_net_thread_tests)
+    add_test(NAME guest_net_thread COMMAND guest_net_thread_tests)
+    set_tests_properties(guest_net_thread PROPERTIES TIMEOUT 20)
     set_tests_properties(guest_sce_net PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77)
     if(WIN32)
         target_link_libraries(guest_sce_net_tests PRIVATE ws2_32)
-        set_tests_properties(guest_sce_net PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_sce_net guest_net_thread PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNet>")
     endif()
     add_test_executable(net_epoll_lifetime_tests ${LIBS_INCLUDE_DIR}/tests/NetEpollLifetime.cpp)
diff --git a/core/libs/prx/libSceNet/Export.cpp b/core/libs/prx/libSceNet/Export.cpp
index 4861eac26d..f487e1044d 100644
--- a/core/libs/prx/libSceNet/Export.cpp
+++ b/core/libs/prx/libSceNet/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -10,6 +13,7 @@
 #include <netdb.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
+#include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <poll.h>
 #include <unistd.h>
@@ -43,106 +47,16 @@
 #include "prx/libkernel/Socket/include/SocketPoll.hpp"
 #include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "src/ResolverTestHooks.hpp"
 
 // Guest socket descriptors retain PS5 semantics while their transport is backed by host sockets.
 
-struct NetWlanInformationElement;
-struct NetWlanWakeParameter;
-struct NetWlanScanParameter;
-struct NetWlanScanResult;
-struct NetWlanAdhocScanParameter;
-struct NetWlanInfraScanParameter;
-struct NetWlanJoinResult;
-struct NetDumpFilterParameter;
-
-struct NetWlanAdhocParameter;
-struct NetWlanWakeInfo;
-struct NetWlanPspWakeInfo;
-struct NetWlanPspWakeParameter;
-struct NetWlanApParameter;
-struct NetWlanDeviceInfo;
-struct NetWlanAntennaParameter;
-struct NetWlanRateParameter;
-struct NetWlanDeviceConfiguration;
-struct NetWlanRssiInfo;
-struct NetDhcpInfo;
-struct NetAutoIpInfo;
-struct NetAddress6Info;
-
-struct NetDhcpOptionInfo {
-    std::uint32_t option;
-    std::uint32_t capacity;
-    void* data;
-    std::uint32_t size;
-    std::uint32_t reserved;
-};
-
 static_assert(sizeof(NetDhcpOptionInfo) == 24);
 static_assert(offsetof(NetDhcpOptionInfo, capacity) == 4);
 static_assert(offsetof(NetDhcpOptionInfo, data) == 8);
 static_assert(offsetof(NetDhcpOptionInfo, size) == 16);
 
-struct NetSockInfo6;
-struct NetStatisticsInfo;
-struct NetInterfaceStats;
-struct NetRouteInfo;
-struct NetDebugParameter;
-struct NetArpInfo;
-struct NetAppMemoryInfo;
-struct NetSystemMemoryInfo;
-struct NetBandwidthParameter;
-struct NetDataTraffic;
-struct NetEmulationParameter;
-
-struct NetResolverConnection;
-struct NetThreadParameter;
-struct NetIpv4InterfaceAddress;
-struct NetStatisticsInfoInternal;
-struct NetInitializeParameter;
-struct NetDhcpStartParameter;
-struct NetAddress6StartParameter;
-
-using NetAddressCallback = void (APS5_VABI *)(void* userArg, std::int32_t event, std::int32_t error);
-
-struct NetDhcpdStartParameter {
-    std::uint32_t addresses[5];
-    std::uint32_t maxClients;
-};
-
-struct NetPppoeStartParameter {
-    std::uint32_t dnsAddresses[2];
-    char userName[128];
-    char password[128];
-    std::int32_t mtu;
-    std::uint32_t flags;
-};
-
-struct NetRoutingAddressParameter {
-    std::uint32_t address;
-    std::uint32_t mask;
-};
-
-struct NetRoutingServerParameter {
-    std::int32_t count;
-    std::uint32_t localAddresses[2];
-    std::uint32_t remoteAddresses[2];
-};
-
-struct NetRoutingRule {
-    std::int32_t protocol;
-    std::uint32_t firstAddress;
-    std::uint16_t firstPort;
-    std::uint16_t reserved;
-    std::uint32_t secondAddress;
-    std::uint16_t secondPort;
-    std::uint16_t flags;
-};
-
-struct NetRoutingRuleParameter {
-    std::int32_t count;
-    const NetRoutingRule* rules;
-};
-
 static_assert(sizeof(NetRoutingAddressParameter) == 8);
 static_assert(sizeof(NetRoutingServerParameter) == 20);
 static_assert(offsetof(NetRoutingServerParameter, remoteAddresses) == 12);
@@ -161,66 +75,21 @@ static_assert(offsetof(NetPppoeStartParameter, password) == 136);
 static_assert(offsetof(NetPppoeStartParameter, mtu) == 264);
 static_assert(offsetof(NetPppoeStartParameter, flags) == 268);
 
-struct NetInfoDumpParameter {
-    std::uint32_t flags;
-    std::uint32_t intervalSeconds;
-    char path[64];
-};
-
 static_assert(sizeof(NetInfoDumpParameter) == 72);
 static_assert(offsetof(NetInfoDumpParameter, path) == 8);
 
-struct NetInterfaceInfo;
-struct NetInterfaceStatistics;
-
-struct NetResolverConnectOption {
-    std::int32_t connectionTimeout;
-    std::int32_t resolverTimeout;
-    std::int32_t resolverRetryCount;
-    std::uint32_t reserved;
-};
-
 static_assert(sizeof(NetResolverConnectOption) == 16);
 static_assert(offsetof(NetResolverConnectOption, resolverTimeout) == 4);
 static_assert(offsetof(NetResolverConnectOption, resolverRetryCount) == 8);
 static_assert(offsetof(NetResolverConnectOption, reserved) == 12);
 
-struct NetSyncObject {
-    void* mutex;
-    void* condition;
-    std::uint32_t signals;
-    std::uint32_t reserved;
-};
-
 static_assert(sizeof(NetSyncObject) == 24);
 
-using NetEventCallback = std::uint64_t (APS5_VABI*)(std::uint32_t interfaceId, std::uint64_t events, void* userData, void* waitData);
-
-struct NetIpv6Address {
-    std::uint8_t bytes[16];
-};
-
 static_assert(sizeof(NetIpv6Address) == 16);
 
-struct NetDnsInfo {
-    std::uint32_t primaryAddress;
-    std::uint32_t secondaryAddress;
-};
-
-struct NetDns6Info {
-    NetIpv6Address primaryAddress;
-    NetIpv6Address secondaryAddress;
-};
-
 static_assert(sizeof(NetDnsInfo) == 8);
 static_assert(sizeof(NetDns6Info) == 32);
 
-struct NetIpv6InterfaceAddress {
-    NetIpv6Address address;
-    std::uint8_t prefixLength;
-    std::uint8_t reserved[3];
-};
-
 static_assert(sizeof(NetIpv6InterfaceAddress) == 20);
 
 namespace {
@@ -231,6 +100,7 @@ constexpr int NET_EBADF = 9;
 constexpr int NET_EACCES = 13;
 constexpr int NET_EFAULT = 14;
 constexpr int NET_EINVAL = 22;
+constexpr int NET_ENOTTY = 25;
 constexpr int NET_ENOSPC = 28;
 constexpr int NET_EDOM = 33;
 constexpr int NET_EAGAIN = 35;
@@ -393,6 +263,7 @@ struct Sock {
     std::shared_ptr<NativeSocketHandle> native;
     bool bound = false;
     bool listening = false;
+    bool connectAttempted = false;
     bool aborted = false;
     bool read_shut = false;
     int reported_error = 0;
@@ -460,11 +331,6 @@ std::map<int, EpollRegistrations> g_epoll_socks;
 std::set<int> g_epoll_aborted;
 std::map<int, std::size_t> g_pools;
 
-struct NetMemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-};
 struct Resolver {
     int error = 0;
     int running = 0;
@@ -478,13 +344,13 @@ int g_next_epoll = 0x4000;
 int g_next_pool = 1;
 int g_next_resolver = 0x100;
 bool g_net_inited = false;
+std::atomic<GuestSceNetTest::ResolverLookup> g_resolverLookupForTests{nullptr};
 
 int* errno_slot() {
     static thread_local int e = 0;
     return &e;
 }
 
-extern "C" int* APS5_VABI __error_nid_postfix();
 extern "C" std::size_t NetCtlHostDnsServers_nid_no_patch(std::uint32_t* servers, std::size_t capacity);
 
 void set_errno(int err) {
@@ -497,6 +363,12 @@ int fail(int err) {
     return NET_ERROR_BASE | err;
 }
 
+void* APS5_VABI RunNetThread(void* param) {
+    const auto* thread = static_cast<const NetThreadParameter*>(param);
+    thread->entry(thread->arg);
+    return nullptr;
+}
+
 int set_native_timeout(NativeSocket native, int optname, std::int64_t microseconds) {
     const int native_option = optname == NET_SO_RCVTIMEO ? SO_RCVTIMEO : SO_SNDTIMEO;
 #ifdef _WIN32
@@ -580,20 +452,6 @@ std::uint64_t swap64(std::uint64_t v) {
         ((v >> 8) & 0xFF000000u) | ((v >> 24) & 0xFF0000u) | ((v >> 40) & 0xFF00u) | (v >> 56);
 }
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t name_length;
-    NetIovec* iov;
-    int iov_length;
-    void* control;
-    std::uint32_t control_length;
-    int flags;
-};
 static_assert(sizeof(NetMsghdr) == 48 && offsetof(NetMsghdr, iov) == 16 && offsetof(NetMsghdr, control) == 32 &&
     offsetof(NetMsghdr, flags) == 44);
 
@@ -617,15 +475,6 @@ std::int64_t message_length(const NetMsghdr* message) {
     return static_cast<std::int64_t>(total);
 }
 
-int receive_error(const Sock& socket) {
-#ifdef _WIN32
-    if (WSAGetLastError() == WSAETIMEDOUT && socket.type != NET_SOCK_STREAM && socket.native->receiveTimeout > 0) return NET_EAGAIN;
-#else
-    (void)socket;
-#endif
-    return native_error();
-}
-
 bool message_flags_supported(int flags, int accepted) {
     return (flags & ~accepted) == 0;
 }
@@ -653,7 +502,7 @@ auto native_transfer(const NativeSocketHandle& socket, int flags, bool send, TOp
         if (timeout > 0) {
             const auto remaining = deadline - std::chrono::steady_clock::now();
             if (remaining <= std::chrono::steady_clock::duration::zero()) {
-                WSASetLastError(completeLength > 0 ? WSAEWOULDBLOCK : WSAETIMEDOUT);
+                WSASetLastError(send && completeLength == 0 ? WSAETIMEDOUT : WSAEWOULDBLOCK);
                 return transferred > 0 ? static_cast<Result>(transferred) : static_cast<Result>(-1);
             }
             milliseconds = static_cast<int>(std::min<std::int64_t>(std::chrono::ceil<std::chrono::milliseconds>(remaining).count(), milliseconds));
@@ -692,12 +541,23 @@ int native_message_flags(int flags) {
     return native;
 }
 
-#ifdef _WIN32
+#if defined(_WIN32) || defined(__APPLE__)
+#ifdef __APPLE__
+bool has_local_address(NativeSocket native) {
+    sockaddr_storage local{};
+    NativeLength local_length = sizeof(local);
+    if (::getsockname(native, reinterpret_cast<sockaddr*>(&local), &local_length) != 0) return true;
+    if (local.ss_family == AF_INET) return reinterpret_cast<const sockaddr_in&>(local).sin_port != 0;
+    if (local.ss_family == AF_INET6) return reinterpret_cast<const sockaddr_in6&>(local).sin6_port != 0;
+    return true;
+}
+#else
 bool has_local_address(NativeSocket native) {
     sockaddr_storage local{};
     NativeLength local_length = sizeof(local);
     return ::getsockname(native, reinterpret_cast<sockaddr*>(&local), &local_length) == 0 || WSAGetLastError() != WSAEINVAL;
 }
+#endif
 
 void note_local_address(int s, const Sock& socket) {
     if (socket.type == NET_SOCK_STREAM || socket.bound || !has_local_address(socket.native->value)) return;
@@ -714,14 +574,38 @@ int wait_for_datagram(const Sock& socket, std::chrono::steady_clock::time_point
     const auto now = std::chrono::steady_clock::now();
     if (now >= deadline) return NET_EAGAIN;
     const auto remaining = std::chrono::ceil<std::chrono::milliseconds>(deadline - now).count();
+#ifdef _WIN32
     WSAPOLLFD descriptor{};
     descriptor.fd = socket.native->value;
     descriptor.events = POLLRDNORM;
     return WSAPoll(&descriptor, 1, static_cast<INT>(std::min<long long>(remaining, INT_MAX))) == 0 ? NET_EAGAIN : 0;
+#else
+    pollfd descriptor{};
+    descriptor.fd = socket.native->value;
+    descriptor.events = POLLIN;
+    return ::poll(&descriptor, 1, static_cast<int>(std::min<long long>(remaining, INT_MAX))) == 0 ? NET_EAGAIN : 0;
+#endif
 }
 
 int wait_for_local_address(int s, const Sock& socket, bool empty, int flags) {
-    if (socket.type == NET_SOCK_STREAM || socket.bound) return 0;
+    if (socket.type == NET_SOCK_STREAM) {
+#ifdef _WIN32
+        if (!empty) return 0;
+        sockaddr_storage peer{};
+        NativeLength length = sizeof(peer);
+        if (::getpeername(socket.native->value, reinterpret_cast<sockaddr*>(&peer), &length) != 0) {
+            const int error = native_error();
+            return !socket.connectAttempted && !socket.aborted && !socket.read_shut && error == NET_ENOTCONN ? error : 0;
+        }
+        WSAPOLLFD state{};
+        state.fd = socket.native->value;
+        state.events = POLLRDNORM;
+        return WSAPoll(&state, 1, 0) >= 0 && (state.revents & (POLLERR | POLLHUP | POLLNVAL)) == 0 ? RECEIVE_NOTHING : 0;
+#else
+        return 0;
+#endif
+    }
+    if (socket.bound) return 0;
     const bool named = has_local_address(socket.native->value);
     if (!named && (socket.read_shut || empty)) return RECEIVE_NOTHING;
     if (!named && (socket.native->nonblock || (flags & NET_MSG_DONTWAIT) != 0)) return NET_EAGAIN;
@@ -788,6 +672,10 @@ bool parse_ipv4_parts(const char* text, std::uint32_t& address) {
 
 }  // namespace
 
+void GuestSceNetTest::SetResolverLookupForTests_nid_no_patch(ResolverLookup lookup) noexcept {
+    g_resolverLookupForTests.store(lookup);
+}
+
 extern "C" {
 
 extern const std::uint32_t sce_net_in6addr_any[4] = {};
@@ -862,8 +750,6 @@ int PollSockets(KernelSocketPoll::Entry* entries, int count, int timeoutMillisec
 
 const bool g_socketPollerRegistered = (KernelSetSocketPoller_nid_no_patch(&PollSockets), true);
 
-extern "C" int APS5_VABI sceNetSocketClose(int s);
-
 bool CloseSocketForKernel(int descriptor, int* error) {
     {
         std::lock_guard lk(g_mutex);
@@ -875,8 +761,6 @@ bool CloseSocketForKernel(int descriptor, int* error) {
 
 const bool g_socketCloserRegistered = (KernelSetSocketCloser_nid_no_patch(&CloseSocketForKernel), true);
 
-extern "C" int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval, uint32_t optlen);
-
 bool SetSocketOptionForKernel(int descriptor, int level, int option, const void* value, std::uint32_t length, int* error) {
     {
         std::lock_guard lk(g_mutex);
@@ -1012,8 +896,6 @@ int APS5_VABI sceNetSocket(const char* name, int family, int type, int protocol)
     return fd;
 }
 
-extern "C" int APS5_VABI close_nid_postfix(int d);
-
 int APS5_VABI sceNetSocketClose(int s) {
     std::shared_ptr<NativeSocketHandle> native;
     bool found = false;
@@ -1131,6 +1013,7 @@ int APS5_VABI sceNetAccept(int s, void* addr, uint32_t* addrlen) {
     Sock connection;
     connection.family = listener.family;
     connection.type = NET_SOCK_STREAM;
+    connection.connectAttempted = true;
     connection.native = std::move(handle);
 #ifdef _WIN32
     connection.native->receiveTimeout = listener.native->receiveTimeout.load();
@@ -1213,8 +1096,13 @@ int APS5_VABI sceNetConnect(int s, const void* addr, uint32_t addrlen) {
     if (socket.type == NET_SOCK_STREAM) RefuseClosedLoopbackAtOnce_nid_no_patch(socket.native->value, reinterpret_cast<const sockaddr*>(&native));
 #endif
     if (native.ss_family != (socket.family == NET_AF_INET ? AF_INET : AF_INET6)) return fail(NET_EAFNOSUPPORT);
+    if (socket.type == NET_SOCK_STREAM) {
+        std::lock_guard lock(g_mutex);
+        const auto current = g_socks.find(s);
+        if (current != g_socks.end() && current->second.native == socket.native) current->second.connectAttempted = true;
+    }
     if (::connect(socket.native->value, reinterpret_cast<const sockaddr*>(&native), native_length) == 0) {
-#ifdef _WIN32
+#if defined(_WIN32) || defined(__APPLE__)
         note_local_address(s, socket);
 #endif
         return 0;
@@ -1250,7 +1138,7 @@ int64_t APS5_VABI sceNetRecv(int s, void* buf, size_t len, int flags) {
         if (it == g_socks.end()) return fail(NET_EBADF);
         socket = it->second;
     }
-#ifdef _WIN32
+#if defined(_WIN32) || defined(__APPLE__)
     if (const int wait = wait_for_local_address(s, socket, len == 0, flags)) return wait == RECEIVE_NOTHING ? 0 : fail(wait);
 #endif
     const GuestArena::HostWrite destination(len == 0 ? nullptr : buf, len);
@@ -1262,7 +1150,7 @@ int64_t APS5_VABI sceNetRecv(int s, void* buf, size_t len, int flags) {
 #ifdef _WIN32
     if (result < 0 && socket.type == NET_SOCK_DGRAM && WSAGetLastError() == WSAEMSGSIZE) return static_cast<int64_t>(len);
 #endif
-    return result >= 0 ? result : fail(receive_error(socket));
+    return result >= 0 ? result : fail(native_error());
 }
 
 int64_t APS5_VABI sceNetRecvfrom(int s, void* buf, size_t len, int flags, void* from, uint32_t* fromlen) {
@@ -1279,7 +1167,7 @@ int64_t APS5_VABI sceNetRecvfrom(int s, void* buf, size_t len, int flags, void*
     }
     const GuestArena::HostWrite lengthOutput(from == nullptr ? nullptr : fromlen, from == nullptr ? 0 : sizeof(*fromlen));
     if (!lengthOutput.Open()) return fail(NET_EFAULT);
-#ifdef _WIN32
+#if defined(_WIN32) || defined(__APPLE__)
     if (const int wait = wait_for_local_address(s, socket, len == 0, flags)) {
         if (wait != RECEIVE_NOTHING) return fail(wait);
         if (from) *fromlen = 0;
@@ -1303,7 +1191,7 @@ int64_t APS5_VABI sceNetRecvfrom(int s, void* buf, size_t len, int flags, void*
 #ifdef _WIN32
     if (result < 0 && socket.type == NET_SOCK_DGRAM && WSAGetLastError() == WSAEMSGSIZE) result = static_cast<int>(len);
 #endif
-    if (result < 0) return fail(receive_error(socket));
+    if (result < 0) return fail(native_error());
     if (from && !native_to_guest_address(peer, from, fromlen)) return fail(NET_EAFNOSUPPORT);
     return result;
 }
@@ -1353,7 +1241,7 @@ int64_t APS5_VABI sceNetSendto(int s, const void* buf, size_t len, int flags, co
         }, true, static_cast<int>(len));
     }
     if (result < 0) return fail(native_error());
-#ifdef _WIN32
+#if defined(_WIN32) || defined(__APPLE__)
     note_local_address(s, socket);
 #endif
     return result;
@@ -1397,7 +1285,7 @@ int64_t APS5_VABI sceNetRecvmsg(int s, NetMsghdr* msg, int flags) {
         if (!destinations.emplace_back(entry.base, static_cast<std::size_t>(entry.length)).Open()) return fail(NET_EFAULT);
     }
     const bool datagram = socket.type != NET_SOCK_STREAM;
-#ifdef _WIN32
+#if defined(_WIN32) || defined(__APPLE__)
     if (const int wait = wait_for_local_address(s, socket, total == 0, flags)) {
         if (wait != RECEIVE_NOTHING) return fail(wait);
         msg->flags = 0;
@@ -1421,7 +1309,7 @@ int64_t APS5_VABI sceNetRecvmsg(int s, NetMsghdr* msg, int flags) {
     });
     if (received < 0) {
 #ifdef _WIN32
-        if (!datagram || WSAGetLastError() != WSAEMSGSIZE) return fail(receive_error(socket));
+        if (!datagram || WSAGetLastError() != WSAEMSGSIZE) return fail(native_error());
         received = static_cast<std::int64_t>(buffer.size());
 #else
         return fail(native_error());
@@ -1462,8 +1350,6 @@ int APS5_VABI sceNetShutdown(int s, int how) {
     return error == 0 ? 0 : fail(error);
 }
 
-extern "C" int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length);
-
 int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval, uint32_t optlen) {
     Sock socket;
     bool found = false;
@@ -1509,6 +1395,7 @@ int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval
         if (value < 0) return fail(NET_EINVAL);
         if (set_native_timeout(socket.native->value, optname, value) != 0) return fail(native_error());
     } else if (optname == NET_SO_REUSEADDR || optname == NET_SO_BROADCAST || optname == NET_SO_SNDBUF || optname == NET_SO_RCVBUF) {
+        if ((optname == NET_SO_SNDBUF || optname == NET_SO_RCVBUF) && value < 1) return fail(NET_EINVAL);
         const int native_option = optname == NET_SO_REUSEADDR ? SO_REUSEADDR : optname == NET_SO_BROADCAST ? SO_BROADCAST : optname == NET_SO_SNDBUF ? SO_SNDBUF : SO_RCVBUF;
         if (::setsockopt(socket.native->value, SOL_SOCKET, native_option, reinterpret_cast<const char*>(&value), sizeof(value)) != 0)
             return fail(native_error());
@@ -1638,7 +1525,9 @@ int APS5_VABI sceNetGetpeername(int s, void* addr, uint32_t* addrlen) {
 
 constexpr int NET_SOCKINFO_F_SELF = 0x1;
 constexpr int NET_SOCKINFO_F_NONBLOCK = 0x200000;
+constexpr int NET_SOCKINFO_F_IPV6 = 0x400000;
 constexpr int NET_SOCKINFO_TIME_WAIT = 0x40;
+constexpr int NET_SOCKINFO6_IPV46 = 0x1000;
 
 struct NetSockInfo {
     char name[32];
@@ -1675,6 +1564,11 @@ struct NetSockInfo {
 static_assert(sizeof(NetSockInfo) == 0xA0 && offsetof(NetSockInfo, s) == 0x24 && offsetof(NetSockInfo, local_adr) == 0x34 &&
     offsetof(NetSockInfo, local_port) == 0x3C && offsetof(NetSockInfo, recv_buffer_size) == 0x64);
 
+static_assert(sizeof(NetSockInfo6) == sizeof(NetSockInfo) && offsetof(NetSockInfo6, s) == offsetof(NetSockInfo, s) &&
+    offsetof(NetSockInfo6, local_port) == offsetof(NetSockInfo, local_port) && offsetof(NetSockInfo6, flags) == offsetof(NetSockInfo, flags) &&
+    offsetof(NetSockInfo6, recv_buffer_size) == offsetof(NetSockInfo, recv_buffer_size) && offsetof(NetSockInfo6, local_adr6) == 0x6C &&
+    offsetof(NetSockInfo6, remote_adr6) == 0x7C && offsetof(NetSockInfo6, tx_drops) == offsetof(NetSockInfo, tx_drops));
+
 static int sock_buffer_size(const Sock& socket, bool send, std::int32_t& value) {
     value = send ? socket.snd_buffer : socket.rcv_buffer;
     if (value != 0) return 0;
@@ -1748,6 +1642,86 @@ int APS5_VABI sceNetGetSockInfo(int s, void* info, int n, int flags) {
     return written;
 }
 
+static int fill_sock_info6(int s, NetSockInfo6& record, bool includeIpv4) {
+    Sock socket;
+    {
+        std::lock_guard lk(g_mutex);
+        const auto it = g_socks.find(s);
+        if (it == g_socks.end()) return NET_EBADF;
+        socket = it->second;
+    }
+    const bool ipv6 = socket.family == NET_AF_INET6;
+    if (!ipv6 && !(includeIpv4 && socket.family == NET_AF_INET)) return NET_EAFNOSUPPORT;
+    sockaddr_storage local{};
+    NativeLength length = sizeof(local);
+    if (::getsockname(socket.native->value, reinterpret_cast<sockaddr*>(&local), &length) != 0) {
+#ifdef _WIN32
+        if (WSAGetLastError() != WSAEINVAL) return native_error();
+#else
+        return native_error();
+#endif
+    }
+    sockaddr_storage remote{};
+    length = sizeof(remote);
+    if (::getpeername(socket.native->value, reinterpret_cast<sockaddr*>(&remote), &length) != 0) {
+        const int error = native_error();
+        if (error != NET_ENOTCONN) return error;
+    }
+    record = {};
+    if (const int error = sock_buffer_size(socket, false, record.recv_buffer_size)) return error;
+    if (const int error = sock_buffer_size(socket, true, record.send_buffer_size)) return error;
+    record.s = s;
+    record.socket_type = static_cast<std::int8_t>(socket.type);
+    record.flags = NET_SOCKINFO_F_SELF | (socket.native->nonblock ? NET_SOCKINFO_F_NONBLOCK : 0);
+    if (ipv6) {
+        const auto& local6 = reinterpret_cast<const sockaddr_in6&>(local);
+        const auto& remote6 = reinterpret_cast<const sockaddr_in6&>(remote);
+        std::memcpy(record.local_adr6, &local6.sin6_addr, sizeof(record.local_adr6));
+        std::memcpy(record.remote_adr6, &remote6.sin6_addr, sizeof(record.remote_adr6));
+        record.local_port = local6.sin6_port;
+        record.remote_port = remote6.sin6_port;
+        record.flags |= NET_SOCKINFO_F_IPV6;
+    } else {
+        const auto& local4 = reinterpret_cast<const sockaddr_in&>(local);
+        const auto& remote4 = reinterpret_cast<const sockaddr_in&>(remote);
+        record.local_adr = local4.sin_addr.s_addr;
+        record.remote_adr = remote4.sin_addr.s_addr;
+        record.local_port = local4.sin_port;
+        record.remote_port = remote4.sin_port;
+    }
+    return 0;
+}
+
+int APS5_VABI sceNetGetSockInfo6(std::int32_t s, NetSockInfo6* info, std::uint32_t capacity, std::uint32_t flags) {
+    if ((flags & ~(NET_SOCKINFO_TIME_WAIT | NET_SOCKINFO6_IPV46)) != 0) return fail(NET_EINVAL);
+    const bool includeIpv4 = (flags & NET_SOCKINFO6_IPV46) != 0;
+    std::vector<int> listed;
+    if (s < 0) {
+        std::lock_guard lk(g_mutex);
+        for (const auto& [descriptor, socket] : g_socks) {
+            if (socket.family == NET_AF_INET6 || (includeIpv4 && socket.family == NET_AF_INET)) listed.push_back(descriptor);
+        }
+    }
+    if (!info) return s < 0 ? static_cast<int>(listed.size()) : fail(NET_EINVAL);
+    if (static_cast<std::int32_t>(capacity) < 1) return fail(NET_EINVAL);
+    NetSockInfo6 record;
+    if (s >= 0) {
+        if (const int error = fill_sock_info6(s, record, includeIpv4)) return fail(error);
+        *info = record;
+        return 1;
+    }
+    int written = 0;
+    for (const int descriptor : listed) {
+        if (written == static_cast<std::int32_t>(capacity)) break;
+        const int error = fill_sock_info6(descriptor, record, includeIpv4);
+        if (error == NET_EBADF || error == NET_EAFNOSUPPORT) continue;
+        if (error != 0) return fail(error);
+        info[written] = record;
+        ++written;
+    }
+    return written;
+}
+
 int APS5_VABI sceNetEpollCreate(const char* name, int flags) {
     (void)name;
     (void)flags;
@@ -1944,20 +1918,32 @@ uint32_t APS5_VABI sceNetNtohl_nid_postfix(uint32_t net32) { return swap32(net32
 uint16_t APS5_VABI sceNetNtohs_nid_postfix(uint16_t net16) { return swap16(net16); }
 
 int APS5_VABI sceNetInetPton(int af, const char* src, void* dst) {
-    if (src == nullptr || dst == nullptr) {
+    if (src == nullptr) {
         return fail(NET_EINVAL);
     }
     if (af != NET_AF_INET && af != NET_AF_INET6) {
         return fail(NET_EAFNOSUPPORT);
     }
-    const std::string text = af == NET_AF_INET ? std::string(src, std::strcspn(src, " \t\n\v\f\r")) : std::string(src);
-    std::array<unsigned char, 16> address{};
+    if (dst == nullptr && af == NET_AF_INET6) {
+        return fail(NET_EINVAL);
+    }
+    const auto convert = [](int family, const std::string& text, unsigned char* address) {
 #ifdef _WIN32
-    const int converted = InetPtonA(af == NET_AF_INET ? AF_INET : AF_INET6, text.c_str(), address.data());
+        return InetPtonA(family, text.c_str(), address);
 #else
-    const int converted = ::inet_pton(af == NET_AF_INET ? AF_INET : AF_INET6, text.c_str(), address.data());
+        return ::inet_pton(family, text.c_str(), address);
 #endif
-    if (converted == 1) {
+    };
+    const std::string head(src, std::strcspn(src, " \t\n\v\f\r"));
+    const auto colon = head.rfind(':');
+    const bool dottedTail = af == NET_AF_INET6 && colon != std::string::npos && head.find('.', colon) != std::string::npos;
+    std::array<unsigned char, 16> address{};
+    if (dottedTail && convert(AF_INET, head.substr(colon + 1), address.data()) != 1) {
+        return 0;
+    }
+    const std::string text = af == NET_AF_INET || dottedTail ? head : std::string(src);
+    const int converted = convert(af == NET_AF_INET ? AF_INET : AF_INET6, text, address.data());
+    if (converted == 1 && dst != nullptr) {
         std::memcpy(dst, address.data(), af == NET_AF_INET ? 4 : 16);
     }
     return converted;
@@ -2052,6 +2038,14 @@ int lookup_host(int rid, const char* hostname, const char* func, int family, std
     if (!initialize_sockets()) return fail(5);
     std::uint64_t generation = 0;
     if (const int error = begin_lookup(rid, &Resolver::abort_ntoa, generation)) return error;
+    if (const auto lookup = g_resolverLookupForTests.load()) {
+        if (!lookup(hostname, family, addresses) || addresses.empty()) {
+            set_errno(NET_ENOENT);
+            log_soft(func, "host DNS lookup failed");
+            return end_lookup(rid, generation, NET_ERROR_RESOLVER_ENODNS);
+        }
+        return end_lookup(rid, generation, 0);
+    }
     addrinfo hints{};
     hints.ai_family = family;
     addrinfo* results = nullptr;
@@ -2109,19 +2103,6 @@ int APS5_VABI sceNetResolverStartNtoa6(int rid, const char* hostname, void* addr
     return 0;
 }
 
-struct NetResolverRecord {
-    std::uint32_t address;
-    std::uint8_t address6[12];
-    std::int32_t family;
-    std::int32_t reserved[3];
-};
-
-struct NetResolverInfo {
-    NetResolverRecord records[10];
-    std::int32_t count;
-    std::int32_t count4;
-    std::int32_t reserved[14];
-};
 static_assert(sizeof(NetResolverRecord) == 32 && offsetof(NetResolverRecord, family) == 16);
 static_assert(sizeof(NetResolverInfo) == 384 && offsetof(NetResolverInfo, count) == 320 && offsetof(NetResolverInfo, count4) == 324);
 
@@ -2254,7 +2235,6 @@ int APS5_VABI sceNetShowIfconfigWithMemory(std::int32_t poolId) {
 }
 
 int APS5_VABI sceNetShowPolicy(void) {
-    NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
@@ -2268,7 +2248,8 @@ int APS5_VABI sceNetShowRoute(void) {
 }
 
 int APS5_VABI sceNetShowRouteWithMemory(std::int32_t poolId) {
-    NotImplemented_nid_no_patch(__func__);
+    std::lock_guard lk(g_mutex);
+    if (g_pools.find(poolId) == g_pools.end()) return fail(NET_EBADF);
     return 0;
 }
 
@@ -2292,11 +2273,6 @@ int APS5_VABI sceNetResolverConnectDestroy(NetResolverConnection* connection) {
     return 0;
 }
 
-int APS5_VABI sceNetGetSockInfo6(std::int32_t socket, NetSockInfo6* info, std::uint32_t capacity, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNetSetDns6Info(const NetDns6Info* info, std::uint32_t flags) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2448,13 +2424,16 @@ int APS5_VABI sceNetInetPtonEx(int af, const char* src, void* dst, int) {
     if (af != NET_AF_INET) {
         return sceNetInetPton(af, src, dst);
     }
-    if (src == nullptr || dst == nullptr) {
+    if (src == nullptr) {
         return fail(NET_EINVAL);
     }
     std::uint32_t address = 0;
     if (!parse_ipv4_parts(src, address)) {
         return 0;
     }
+    if (dst == nullptr) {
+        return 1;
+    }
     const std::array<unsigned char, 4> bytes{static_cast<unsigned char>(address >> 24), static_cast<unsigned char>(address >> 16),
                                              static_cast<unsigned char>(address >> 8), static_cast<unsigned char>(address)};
     std::memcpy(dst, bytes.data(), bytes.size());
@@ -2462,18 +2441,42 @@ int APS5_VABI sceNetInetPtonEx(int af, const char* src, void* dst, int) {
 }
 
 int APS5_VABI sceNetIoctl(int socketId, std::uint32_t command, void* argument) {
-    NotImplemented_nid_no_patch(__func__);
+    constexpr std::uint32_t nonblockingRequest = 0x8004667e;
+    constexpr std::uint32_t readableRequest = 0x4004667f;
+    std::shared_ptr<NativeSocketHandle> native;
+    {
+        std::lock_guard lk(g_mutex);
+        const auto it = g_socks.find(socketId);
+        if (it != g_socks.end()) native = it->second.native;
+    }
+    if (!native) {
+        if (!GuestSocketIsOpen_nid_no_patch(socketId)) return fail(NET_EBADF);
+        return ioctl_nid_postfix(socketId, command, argument) == 0 ? 0 : fail(*__error_nid_postfix());
+    }
+    if (command != nonblockingRequest && command != readableRequest) return fail(NET_ENOTTY);
+    if (!argument) return fail(NET_EFAULT);
+    if (command == nonblockingRequest) {
+        const int enabled = *static_cast<const int*>(argument) != 0;
+        return sceNetSetsockopt(socketId, NET_SOL_SOCKET, NET_SO_NBIO, &enabled, sizeof(enabled));
+    }
+#ifdef _WIN32
+    u_long available = 0;
+    if (ioctlsocket(native->value, FIONREAD, &available) != 0) return fail(native_error());
+#else
+    int available = 0;
+    if (::ioctl(native->value, FIONREAD, &available) != 0) return fail(native_error());
+#endif
+    *static_cast<int*>(argument) = static_cast<int>(available);
     return 0;
 }
 
 void* APS5_VABI sceNetMemoryAllocate(std::int32_t size, int flags) {
     constexpr int zeroFill = 2;
+    constexpr std::size_t blockAlignment = 64;
     if (size <= 0) return nullptr;
-    if ((flags & 4) != 0)
-        throw std::runtime_error("sceNetMemoryAllocate: pool reserve allocation is not implemented");
     void* memory = nullptr;
     try {
-        memory = GuestHeap::GuestHeapAllocate_nid_postfix(static_cast<std::size_t>(size));
+        memory = GuestHeap::GuestHeapAlign_nid_postfix(blockAlignment, static_cast<std::size_t>(size));
     } catch (const std::bad_alloc&) {
         return nullptr;
     } catch (const std::length_error&) {
@@ -2533,18 +2536,20 @@ int APS5_VABI sceNetSysctl(const int* name, std::uint32_t nameLength, void* oldV
 }
 
 int APS5_VABI sceNetThreadCreate(Pthread* thread, const NetThreadParameter* parameter, const char* name) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!parameter) return fail(NET_EINVAL);
+    Pthread created = nullptr;
+    const int result = scePthreadCreate(&created, nullptr, RunNetThread, const_cast<NetThreadParameter*>(parameter), name != nullptr ? name : "");
+    if (result != 0) return result;
+    if (thread) *thread = created;
     return 0;
 }
 
-int APS5_VABI sceNetThreadExit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI sceNetThreadExit() {
+    scePthreadExit(nullptr);
 }
 
 int APS5_VABI sceNetThreadJoin(void* thread) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return scePthreadJoin(static_cast<Pthread>(thread), nullptr);
 }
 
 int APS5_VABI sceNetUsleep(int microseconds) {
@@ -2571,7 +2576,7 @@ int APS5_VABI sceNetShowNetstatForBuffer(char* buffer, std::int32_t bufferSize,
 }
 
 int APS5_VABI sceNetShowNetstatEx(std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
+    (void)flags;
     return 0;
 }
 
@@ -3100,14 +3105,12 @@ int APS5_VABI sceNetEmulationDebugSettingsGet(NetEmulationParameter* parameter,
     return 0;
 }
 
-int APS5_VABI sceNetEmulationSet(const NetEmulationParameter* parameter, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNetEmulationSet(const NetEmulationParameter*, std::uint32_t) {
+    return fail(NET_EOPNOTSUPP);
 }
 
-int APS5_VABI sceNetEmulationGet(NetEmulationParameter* parameter, std::uint32_t flags) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNetEmulationGet(NetEmulationParameter*, std::uint32_t) {
+    return fail(NET_EOPNOTSUPP);
 }
 
 }
diff --git a/core/libs/prx/libSceNet/include/Net.hpp b/core/libs/prx/libSceNet/include/Net.hpp
new file mode 100644
index 0000000000..deffa39409
--- /dev/null
+++ b/core/libs/prx/libSceNet/include/Net.hpp
@@ -0,0 +1,438 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NetRoutingRule {
+    std::int32_t protocol;
+    std::uint32_t firstAddress;
+    std::uint16_t firstPort;
+    std::uint16_t reserved;
+    std::uint32_t secondAddress;
+    std::uint16_t secondPort;
+    std::uint16_t flags;
+};
+
+struct NetIovec {
+    void* base;
+    std::uint64_t length;
+};
+
+struct NetResolverRecord {
+    std::uint32_t address;
+    std::uint8_t address6[12];
+    std::int32_t family;
+    std::int32_t reserved[3];
+};
+
+struct NetWlanInformationElement;
+struct NetWlanWakeParameter;
+struct NetWlanScanParameter;
+struct NetWlanScanResult;
+struct NetWlanAdhocScanParameter;
+struct NetWlanInfraScanParameter;
+struct NetWlanJoinResult;
+struct NetDumpFilterParameter;
+struct NetWlanAdhocParameter;
+struct NetWlanWakeInfo;
+struct NetWlanPspWakeInfo;
+struct NetWlanPspWakeParameter;
+struct NetWlanApParameter;
+struct NetWlanDeviceInfo;
+struct NetWlanAntennaParameter;
+struct NetWlanRateParameter;
+struct NetWlanDeviceConfiguration;
+struct NetWlanRssiInfo;
+struct NetDhcpInfo;
+struct NetAutoIpInfo;
+struct NetAddress6Info;
+
+struct NetDhcpOptionInfo {
+    std::uint32_t option;
+    std::uint32_t capacity;
+    void* data;
+    std::uint32_t size;
+    std::uint32_t reserved;
+};
+
+struct NetSockInfo6 {
+    char name[32];
+    std::int32_t pid;
+    std::int32_t s;
+    std::int8_t socket_type;
+    std::int8_t policy;
+    std::int8_t priority;
+    std::int8_t reserved8;
+    std::int32_t recv_queue_length;
+    std::int32_t send_queue_length;
+    std::uint32_t local_adr;
+    std::uint32_t remote_adr;
+    std::uint16_t local_port;
+    std::uint16_t remote_port;
+    std::uint16_t local_vport;
+    std::uint16_t remote_vport;
+    std::int32_t state;
+    std::int32_t flags;
+    std::int32_t tx_bps;
+    std::int32_t rx_bps;
+    std::int32_t max_tx_bps;
+    std::int32_t max_rx_bps;
+    std::int32_t tx_vbps;
+    std::int32_t rx_vbps;
+    std::int32_t recv_buffer_size;
+    std::int32_t send_buffer_size;
+    std::uint8_t local_adr6[16];
+    std::uint8_t remote_adr6[16];
+    std::int32_t tx_drops;
+    std::int32_t rx_drops;
+    std::int32_t tx_wait;
+    std::int32_t reserved[2];
+};
+struct NetStatisticsInfo;
+struct NetInterfaceStats;
+struct NetRouteInfo;
+struct NetDebugParameter;
+struct NetArpInfo;
+struct NetAppMemoryInfo;
+struct NetSystemMemoryInfo;
+struct NetBandwidthParameter;
+struct NetDataTraffic;
+struct NetEmulationParameter;
+struct NetResolverConnection;
+struct NetThreadParameter {
+    void (APS5_VABI *entry)(void*);
+    void* arg;
+    std::uint64_t reserved;
+    std::uint32_t flags;
+};
+struct NetIpv4InterfaceAddress;
+struct NetStatisticsInfoInternal;
+struct NetInitializeParameter;
+struct NetDhcpStartParameter;
+struct NetAddress6StartParameter;
+
+struct NetDhcpdStartParameter {
+    std::uint32_t addresses[5];
+    std::uint32_t maxClients;
+};
+
+struct NetPppoeStartParameter {
+    std::uint32_t dnsAddresses[2];
+    char userName[128];
+    char password[128];
+    std::int32_t mtu;
+    std::uint32_t flags;
+};
+
+struct NetRoutingAddressParameter {
+    std::uint32_t address;
+    std::uint32_t mask;
+};
+
+struct NetRoutingServerParameter {
+    std::int32_t count;
+    std::uint32_t localAddresses[2];
+    std::uint32_t remoteAddresses[2];
+};
+
+struct NetRoutingRuleParameter {
+    std::int32_t count;
+    const NetRoutingRule* rules;
+};
+
+struct NetInfoDumpParameter {
+    std::uint32_t flags;
+    std::uint32_t intervalSeconds;
+    char path[64];
+};
+
+struct NetInterfaceInfo;
+struct NetInterfaceStatistics;
+
+struct NetResolverConnectOption {
+    std::int32_t connectionTimeout;
+    std::int32_t resolverTimeout;
+    std::int32_t resolverRetryCount;
+    std::uint32_t reserved;
+};
+
+struct NetSyncObject {
+    void* mutex;
+    void* condition;
+    std::uint32_t signals;
+    std::uint32_t reserved;
+};
+
+struct NetIpv6Address {
+    std::uint8_t bytes[16];
+};
+
+struct NetDnsInfo {
+    std::uint32_t primaryAddress;
+    std::uint32_t secondaryAddress;
+};
+
+struct NetDns6Info {
+    NetIpv6Address primaryAddress;
+    NetIpv6Address secondaryAddress;
+};
+
+struct NetIpv6InterfaceAddress {
+    NetIpv6Address address;
+    std::uint8_t prefixLength;
+    std::uint8_t reserved[3];
+};
+
+struct NetMemoryPoolStats {
+    std::size_t pool_size;
+    std::size_t max_inuse_size;
+    std::size_t current_inuse_size;
+};
+
+struct NetMsghdr {
+    void* name;
+    std::uint32_t name_length;
+    NetIovec* iov;
+    int iov_length;
+    void* control;
+    std::uint32_t control_length;
+    int flags;
+};
+
+struct NetResolverInfo {
+    NetResolverRecord records[10];
+    std::int32_t count;
+    std::int32_t count4;
+    std::int32_t reserved[14];
+};
+
+using NetAddressCallback = void (APS5_VABI *)(void* userArg, std::int32_t event, std::int32_t error);
+
+using NetEventCallback = std::uint64_t (APS5_VABI*)(std::uint32_t interfaceId, std::uint64_t events, void* userData, void* waitData);
+
+extern "C" {
+
+int* APS5_VABI sceNetErrnoLoc(void);
+int APS5_VABI sceNetShowNetstat(void);
+int APS5_VABI sceNetInit_nid_postfix(void);
+int APS5_VABI sceNetTerm(void);
+int APS5_VABI sceNetPoolCreate(const char* name, int size, int flags);
+int APS5_VABI sceNetPoolDestroy(int memid);
+int APS5_VABI sceNetSocket(const char* name, int family, int type, int protocol);
+int APS5_VABI sceNetSocketClose(int s);
+int APS5_VABI sceNetSocketAbort(int s, int flags);
+int APS5_VABI sceNetBind_nid_postfix(int s, const void* addr, uint32_t addrlen);
+int APS5_VABI sceNetListen(int s, int backlog);
+int APS5_VABI sceNetAccept(int s, void* addr, uint32_t* addrlen);
+int APS5_VABI sceNetConnect(int s, const void* addr, uint32_t addrlen);
+int64_t APS5_VABI sceNetRecv(int s, void* buf, size_t len, int flags);
+int64_t APS5_VABI sceNetRecvfrom(int s, void* buf, size_t len, int flags, void* from, uint32_t* fromlen);
+int64_t APS5_VABI sceNetSend(int s, const void* buf, size_t len, int flags);
+int64_t APS5_VABI sceNetSendto(int s, const void* buf, size_t len, int flags, const void* to, uint32_t tolen);
+int64_t APS5_VABI sceNetSendmsg(int s, const NetMsghdr* msg, int flags);
+int64_t APS5_VABI sceNetRecvmsg(int s, NetMsghdr* msg, int flags);
+int APS5_VABI sceNetShutdown(int s, int how);
+int APS5_VABI sceNetSetsockopt(int s, int level, int optname, const void* optval, uint32_t optlen);
+int APS5_VABI sceNetGetsockopt(int s, int level, int optname, void* optval, uint32_t* optlen);
+int APS5_VABI sceNetGetsockname(int s, void* addr, uint32_t* addrlen);
+int APS5_VABI sceNetGetpeername(int s, void* addr, uint32_t* addrlen);
+int APS5_VABI sceNetGetSockInfo(int s, void* info, int n, int flags);
+int APS5_VABI sceNetEpollCreate(const char* name, int flags);
+int APS5_VABI sceNetShowNetstatWithMemory(int memid);
+int APS5_VABI sceNetGetMemoryPoolStats(int memid, NetMemoryPoolStats* stats);
+int APS5_VABI sceNetEpollDestroy(int eid);
+int APS5_VABI sceNetEpollAbort(int eid, int flags);
+int APS5_VABI sceNetEpollControl(int eid, int op, int id, const NetEpollEvent* event);
+int APS5_VABI sceNetEpollWait(int eid, NetEpollEvent* events, int maxevents, int timeout);
+uint32_t APS5_VABI sceNetHtonl_nid_postfix(uint32_t host32);
+uint16_t APS5_VABI sceNetHtons_nid_postfix(uint16_t host16);
+uint64_t APS5_VABI sceNetHtonll(std::uint64_t host64);
+uint64_t APS5_VABI sceNetNtohll(std::uint64_t net64);
+uint32_t APS5_VABI sceNetNtohl_nid_postfix(uint32_t net32);
+uint16_t APS5_VABI sceNetNtohs_nid_postfix(uint16_t net16);
+int APS5_VABI sceNetInetPton(int af, const char* src, void* dst);
+const char* APS5_VABI sceNetInetNtop(int af, const void* src, char* dst, uint32_t size);
+int APS5_VABI sceNetEtherNtostr(const NetEtherAddr* n, char* str, size_t len);
+int APS5_VABI sceNetEtherStrton(const char* text, NetEtherAddr* address);
+int APS5_VABI sceNetGetMacAddress(NetEtherAddr* addr, int flags);
+int APS5_VABI sceNetResolverCreate(const char* name, int memid, int flags);
+int APS5_VABI sceNetResolverDestroy(int rid);
+int APS5_VABI sceNetResolverStartNtoa(int rid, const char* hostname, void* addr, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartNtoa6(int rid, const char* hostname, void* addr, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartNtoaMultipleRecords(int rid, const char* hostname, NetResolverInfo* info, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartNtoaMultipleRecordsEx(int rid, const char* hostname, NetResolverInfo* info, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartAton(int rid, const void* addr, char* hostname, int len, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverStartAton6(int rid, const void* addr, char* hostname, int len, int timeout, int retry, int flags);
+int APS5_VABI sceNetResolverGetError(int rid, int* status);
+int APS5_VABI sceNetResolverAbort(int rid, int flags);
+int APS5_VABI sceNetShowIfconfig();
+int APS5_VABI sceNetClearDnsCache(int flags);
+int APS5_VABI sceNetGetStatisticsInfo(NetStatisticsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetInterfaceStats(NetInterfaceStats* stats, std::uint32_t flags);
+int APS5_VABI sceNetSetDnsInfo(const NetDnsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetShowIfconfigWithMemory(std::int32_t poolId);
+int APS5_VABI sceNetShowPolicy(void);
+int APS5_VABI sceNetShowPolicyWithMemory(std::int32_t poolId);
+int APS5_VABI sceNetShowRoute(void);
+int APS5_VABI sceNetShowRouteWithMemory(std::int32_t poolId);
+int APS5_VABI sceNetResolverConnectAbort(NetResolverConnection* connection, std::uint32_t flags);
+int APS5_VABI sceNetResolverConnectCreate(const char* name, std::int32_t socketType, NetResolverConnection* connection, std::uint32_t flags);
+int APS5_VABI sceNetResolverConnect(NetResolverConnection* connection, const char* hostname, std::uint16_t port, const NetResolverConnectOption* option);
+int APS5_VABI sceNetResolverConnectDestroy(NetResolverConnection* connection);
+int APS5_VABI sceNetGetSockInfo6(std::int32_t socket, NetSockInfo6* info, std::uint32_t capacity, std::uint32_t flags);
+int APS5_VABI sceNetSetDns6Info(const NetDns6Info* info, std::uint32_t flags);
+int APS5_VABI sceNetShowRoute6(void);
+int APS5_VABI sceNetShowRoute6WithMemory(std::int32_t poolId);
+NetRouteInfo* APS5_VABI sceNetAllocateAllRouteInfo(std::int32_t interfaceId, std::int32_t* count);
+NetRouteInfo* APS5_VABI sceNetAllocateAllRouteInfo6(std::int32_t interfaceId, std::int32_t* count);
+int APS5_VABI sceNetControl(std::uint32_t interfaceId, std::int32_t interfaceIndex, std::uint32_t command, void* data, std::uint32_t dataSize);
+int APS5_VABI sceNetDbgInit(NetDebugParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackCreate(std::uint32_t interfaceId, NetEventCallback callback, void* userData, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackDestroy(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackGetError(std::uint32_t interfaceId, std::int32_t* error, std::uint32_t flags);
+int APS5_VABI sceNetEventCallbackWaitCB(std::int32_t timeout, void* waitData, std::uint32_t flags);
+int APS5_VABI sceNetFreeAllRouteInfo(void* routes);
+int APS5_VABI sceNetGetArpInfo(NetArpInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetAppMemInfo(NetAppMemoryInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetDnsInfo(NetDnsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetGetIfList(std::int32_t interfaceId, NetInterfaceInfo* interfaces, std::uint32_t capacity);
+int APS5_VABI sceNetGetIfListEx(std::int32_t interfaceId, NetInterfaceInfo* interfaces, std::uint32_t capacity, std::uint32_t flags);
+int APS5_VABI sceNetGetIfListOnce(std::int32_t interfaceId, NetInterfaceStatistics* statistics, std::uint32_t count);
+const char* APS5_VABI sceNetGetIfName(std::uint32_t index);
+int APS5_VABI sceNetGetIfnameNumList(std::uint32_t* interfaceIds, std::int32_t capacity, std::uint32_t flags);
+int APS5_VABI sceNetGetNameToIndex(std::uint32_t interfaceId);
+int APS5_VABI sceNetGetRandom(std::uint32_t* output);
+int APS5_VABI sceNetGetRouteInfo(std::int32_t family, NetRouteInfo* routes, std::int32_t capacity, std::uint8_t flags);
+int APS5_VABI sceNetGetsockoptEx(int socketId, int level, int option, void* value, std::uint32_t* valueSize);
+void APS5_VABI sceNetGetSystemTime(std::uint64_t* output);
+int APS5_VABI sceNetGetSystemMemInfo(NetSystemMemoryInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetInitParam(const NetInitializeParameter* parameter);
+int APS5_VABI sceNetInetPtonEx(int af, const char* src, void* dst, int);
+int APS5_VABI sceNetIoctl(int socketId, std::uint32_t command, void* argument);
+void* APS5_VABI sceNetMemoryAllocate(std::int32_t size, int flags);
+void APS5_VABI sceNetMemoryFree(void* memory);
+int APS5_VABI sceNetSetDnsInfoToKernel(const NetDnsInfo* info, std::uint32_t flags);
+int APS5_VABI sceNetSetsockoptEx(int socketId, int level, int option, const void* value, std::uint32_t valueSize);
+int APS5_VABI sceNetSocketInternal(const char* name, int domain, int type, int protocol);
+int APS5_VABI sceNetSyncCreate(NetSyncObject* sync, std::uint32_t signals, const char* name);
+int APS5_VABI sceNetSyncDestroy(NetSyncObject* sync);
+NetSyncObject* APS5_VABI sceNetSyncGet(std::uint32_t index);
+int APS5_VABI sceNetSyncSignal(NetSyncObject* sync, std::uint32_t signals);
+int APS5_VABI sceNetSyncWait(NetSyncObject* sync, std::uint32_t* timeout);
+int APS5_VABI sceNetSysctl(const int* name, std::uint32_t nameLength, void* oldValue, std::size_t* oldSize, const void* newValue, std::size_t newSize);
+int APS5_VABI sceNetThreadCreate(Pthread* thread, const NetThreadParameter* parameter, const char* name);
+void APS5_VABI sceNetThreadExit();
+int APS5_VABI sceNetThreadJoin(void* thread);
+int APS5_VABI sceNetUsleep(int microseconds);
+int APS5_VABI sceNetShowIfconfigForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetShowRouteForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetShowNetstatForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetShowNetstatEx(std::uint32_t flags);
+int APS5_VABI sceNetShowNetstatExForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId, std::uint32_t flags);
+const char* APS5_VABI sceNetInetNtopWithScopeId(std::int32_t family, const void* address, char* text, std::uint32_t size, std::uint32_t scopeId);
+int APS5_VABI sceNetInetPtonWithScopeId(std::int32_t family, const char* text, void* address, std::uint32_t* scopeId);
+int APS5_VABI sceNetGetDns6Info(NetDns6Info* info, std::uint32_t flags);
+int APS5_VABI sceNetSetDns6InfoToKernel(const NetDns6Info* info, std::uint32_t flags);
+int APS5_VABI sceNetShowRoute6ForBuffer(char* buffer, std::int32_t bufferSize, std::int32_t poolId);
+int APS5_VABI sceNetConfigGetIfFlags(std::uint32_t interfaceId, std::uint32_t* flags);
+int APS5_VABI sceNetConfigSetIfFlags(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetConfigUnsetIfFlags(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetConfigDelIfaddr(int interfaceId);
+int APS5_VABI sceNetConfigDownInterface(int interfaceId);
+int APS5_VABI sceNetConfigSetDefaultRoute(const std::uint32_t* gateway);
+int APS5_VABI sceNetConfigSetDefaultRouteDev(const std::uint32_t* gateway);
+int APS5_VABI sceNetConfigSetIfaddr(int interfaceId, const std::uint32_t* address, const std::uint32_t* broadcastAddress, const std::uint32_t* netmask);
+int APS5_VABI sceNetConfigSetIfLinkLocalAddr6(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigUpInterface(int interfaceId);
+int APS5_VABI sceNetConfigUpInterfaceWithFlags(std::uint32_t interfaceId, std::uint32_t flags);
+int APS5_VABI sceNetConfigCleanUpAllInterfaces(void);
+int APS5_VABI sceNetConfigFlushRoute(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigFlushRoute6(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigAddIfaddr(int interfaceId, const std::uint32_t* address, const std::uint32_t* broadcastAddress, const std::uint32_t* netmask);
+int APS5_VABI sceNetConfigGetIfaddr(std::int32_t interfaceId, NetIpv4InterfaceAddress* addresses, std::int32_t capacity);
+int APS5_VABI sceNetConfigSetIfmtu(std::uint32_t interfaceId, int mtu);
+int APS5_VABI sceNetConfigAddArp(const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigAddArpWithInterface(int interfaceId, const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigAddMRoute(const std::uint32_t* address);
+int APS5_VABI sceNetConfigAddRoute(const std::uint32_t* destination, const std::uint32_t* gateway, const std::uint32_t* netmask, int hostRoute);
+int APS5_VABI sceNetConfigAddRouteWithInterface(int interfaceId, const std::uint32_t* destination, const std::uint32_t* gateway, const std::uint32_t* netmask, int hostRoute);
+int APS5_VABI sceNetConfigDelArp(const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigDelArpWithInterface(int interfaceId, const NetEtherAddr* etherAddress, const std::uint32_t* address);
+int APS5_VABI sceNetConfigDelDefaultRoute(void);
+int APS5_VABI sceNetConfigDelDefaultRouteDev(void);
+int APS5_VABI sceNetConfigDelMRoute(const std::uint32_t* address);
+int APS5_VABI sceNetConfigDelRoute(const std::uint32_t* destination, const std::uint32_t* gateway, const std::uint32_t* netmask);
+int APS5_VABI sceNetConfigGetDefaultRoute(std::uint32_t* gateway);
+int APS5_VABI sceNetDhcpGetAutoipInfo(std::int32_t interfaceId, NetAutoIpInfo* parameter);
+int APS5_VABI sceNetDhcpGetInfo(std::int32_t interfaceId, NetDhcpInfo* parameter);
+int APS5_VABI sceNetDhcpGetInfoEx(std::int32_t interfaceId, std::int32_t type, NetDhcpOptionInfo* info, std::uint32_t size);
+int APS5_VABI sceNetDhcpStart(std::uint32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, NetDhcpStartParameter* parameter);
+int APS5_VABI sceNetDhcpStop(int interfaceId);
+int APS5_VABI sceNetConfigAddIfaddr6(int interfaceId, const NetIpv6Address* address, std::uint8_t prefixLength);
+int APS5_VABI sceNetConfigDelIfaddr6(int interfaceId, const NetIpv6Address* address);
+int APS5_VABI sceNetConfigDelDefaultRoute6(void);
+int APS5_VABI sceNetConfigSetIfaddr6(int interfaceId, const NetIpv6Address* address, std::uint8_t prefixLength);
+int APS5_VABI sceNetConfigSetIfaddr6WithFlags(int interfaceId, const NetIpv6Address* address, std::uint8_t prefixLength, std::uint32_t flags);
+int APS5_VABI sceNetConfigSetDefaultRoute6(int interfaceId, const NetIpv6Address* gateway);
+int APS5_VABI sceNetConfigGetIfaddr6(int interfaceId, NetIpv6InterfaceAddress* addresses, std::uint32_t count);
+int APS5_VABI sceNetConfigGetDefaultRoute6(NetIpv6Address* gateway);
+int APS5_VABI sceNetConfigDelRoute6(const NetIpv6Address* destination, std::uint8_t prefixLength);
+int APS5_VABI sceNetConfigAddRoute6(const NetIpv6Address* destination, const NetIpv6Address* gateway, std::uint8_t prefixLength);
+int APS5_VABI sceNetAddrConfig6Start(std::uint32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, const NetAddress6StartParameter* parameter);
+int APS5_VABI sceNetAddrConfig6Stop(int interfaceId);
+int APS5_VABI sceNetAddrConfig6GetInfo(std::int32_t interfaceId, NetAddress6Info* parameter);
+int APS5_VABI sceNetInfoDumpStart(std::int32_t threadParameter1, std::int32_t threadParameter2, const NetInfoDumpParameter* parameter);
+int APS5_VABI sceNetInfoDumpStop(void);
+int APS5_VABI sceNetDhcpdStart(std::uint32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, const NetDhcpdStartParameter* parameter);
+int APS5_VABI sceNetDhcpdStop(int interfaceId);
+int APS5_VABI sceNetDuplicateIpStart(std::int32_t interfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2);
+int APS5_VABI sceNetDuplicateIpStop(int interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocClearWakeOnWlan(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocCreate(std::int32_t interfaceId, NetWlanAdhocParameter* parameter);
+int APS5_VABI sceNetConfigWlanAdhocGetWakeOnWlanInfo(std::int32_t interfaceId, NetWlanWakeInfo* parameter);
+int APS5_VABI sceNetConfigWlanAdhocJoin(std::int32_t interfaceId, NetWlanAdhocParameter* parameter);
+int APS5_VABI sceNetConfigWlanAdhocLeave(int interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocPspEmuClearWakeOnWlan(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigWlanAdhocPspEmuGetWakeOnWlanInfo(std::int32_t interfaceId, NetWlanPspWakeInfo* parameter);
+int APS5_VABI sceNetConfigWlanAdhocPspEmuSetWakeOnWlan(std::int32_t interfaceId, NetWlanPspWakeParameter* parameter);
+int APS5_VABI sceNetConfigWlanAdhocScanJoin(std::int32_t interfaceId, const NetWlanAdhocScanParameter* parameter, void* buffer, std::size_t bufferSize, NetWlanJoinResult** result);
+int APS5_VABI sceNetConfigWlanAdhocSetExtInfoElement(std::int32_t interfaceId, NetWlanInformationElement* parameter, std::int32_t size);
+int APS5_VABI sceNetConfigWlanAdhocSetWakeOnWlan(std::int32_t interfaceId, NetWlanWakeParameter* parameter, std::size_t size);
+int APS5_VABI sceNetConfigWlanApStart(std::int32_t interfaceId, NetWlanApParameter* parameter);
+int APS5_VABI sceNetConfigWlanApStop(int interfaceId);
+int APS5_VABI sceNetConfigWlanBackgroundScanQuery(std::int32_t interfaceId, void* buffer, std::int32_t size, NetWlanScanResult** results, std::size_t* count);
+int APS5_VABI sceNetConfigWlanBackgroundScanStart(std::int32_t interfaceId, NetWlanScanParameter* parameter, std::uint32_t size);
+int APS5_VABI sceNetConfigWlanBackgroundScanStop(int interfaceId);
+int APS5_VABI sceNetConfigWlanDiagGetDeviceInfo(std::int32_t interfaceId, NetWlanDeviceInfo* parameter);
+int APS5_VABI sceNetConfigWlanDiagSetAntenna(std::int32_t interfaceId, NetWlanAntennaParameter* parameter);
+int APS5_VABI sceNetConfigWlanDiagSetTxFixedRate(std::int32_t interfaceId, NetWlanRateParameter* parameter);
+int APS5_VABI sceNetConfigWlanGetDeviceConfig(std::int32_t interfaceId, NetWlanDeviceConfiguration* parameter);
+int APS5_VABI sceNetConfigWlanInfraGetRssiInfo(std::int32_t interfaceId, NetWlanRssiInfo* parameter);
+int APS5_VABI sceNetConfigWlanInfraLeave(int interfaceId);
+int APS5_VABI sceNetConfigWlanInfraScanJoin(std::int32_t interfaceId, const NetWlanInfraScanParameter* parameter, void* buffer, std::size_t bufferSize, NetWlanJoinResult** result);
+int APS5_VABI sceNetConfigWlanScan(std::int32_t interfaceId, const NetWlanScanParameter* parameter, std::size_t parameterSize, void* buffer, std::size_t bufferSize, NetWlanScanResult** results, std::size_t* count);
+int APS5_VABI sceNetConfigWlanSetDeviceConfig(std::int32_t interfaceId, NetWlanDeviceConfiguration* parameter);
+int APS5_VABI sceNetConfigEtherGetLinkMode(std::uint32_t interfaceId, int* mode);
+int APS5_VABI sceNetConfigEtherPostPlugInOutEvent(std::uint32_t interfaceId);
+int APS5_VABI sceNetConfigEtherSetLinkMode(std::uint32_t interfaceId, int mode);
+int APS5_VABI sceNetPppoeStart(std::uint32_t interfaceId, std::int32_t pppoeInterfaceId, NetAddressCallback callback, void* userArg, std::int32_t threadParameter1, std::int32_t threadParameter2, const NetPppoeStartParameter* parameter);
+int APS5_VABI sceNetPppoeStop(void);
+int APS5_VABI sceNetBandwidthControlSetDefaultParam(const NetBandwidthParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetBandwidthControlGetDefaultParam(NetBandwidthParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetBandwidthControlGetDataTraffic(std::int32_t interfaceId, NetDataTraffic* traffic, std::uint32_t flags);
+int APS5_VABI sceNetConfigSetDefaultScope(std::uint32_t interfaceId, const char* interfaceName, std::int32_t scopeId);
+int APS5_VABI sceNetConfigRoutingStart(std::uint32_t firstInterfaceId, std::uint32_t secondInterfaceId, const NetRoutingAddressParameter* addressParameter, NetRoutingServerParameter* serverParameter, const NetRoutingRuleParameter* ruleParameter);
+int APS5_VABI sceNetConfigRoutingStop(void);
+int APS5_VABI sceNetConfigRoutingShowRoutingConfig(void);
+int APS5_VABI sceNetConfigRoutingShowtCtlVar(const char* name);
+int APS5_VABI sceNetGetStatisticsInfoInternal(NetStatisticsInfoInternal* info);
+int APS5_VABI sceNetDumpAbort(std::int32_t dumpId, std::uint32_t flags);
+int APS5_VABI sceNetDumpCreate(const char* name, std::int32_t bufferSize, std::uint32_t flags);
+int APS5_VABI sceNetDumpSetFilterParam(std::int32_t socket, const NetDumpFilterParameter* parameter);
+int APS5_VABI sceNetDumpDestroy(std::int32_t dumpId);
+int APS5_VABI sceNetDumpRead(std::int32_t dumpId, void* buffer, std::int32_t bufferSize, std::uint32_t* flags);
+int APS5_VABI sceNetEmulationDebugSettingsSet(const NetEmulationParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEmulationDebugSettingsGet(NetEmulationParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEmulationSet(const NetEmulationParameter* parameter, std::uint32_t flags);
+int APS5_VABI sceNetEmulationGet(NetEmulationParameter* parameter, std::uint32_t flags);
+
+}
diff --git a/core/libs/prx/libSceNet/libSceNet.hpp b/core/libs/prx/libSceNet/libSceNet.hpp
new file mode 100644
index 0000000000..9f4c162ed2
--- /dev/null
+++ b/core/libs/prx/libSceNet/libSceNet.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNet/include/Net.hpp"
diff --git a/core/libs/prx/libSceNet/src/ResolverTestHooks.hpp b/core/libs/prx/libSceNet/src/ResolverTestHooks.hpp
new file mode 100644
index 0000000000..cde7e83a8a
--- /dev/null
+++ b/core/libs/prx/libSceNet/src/ResolverTestHooks.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include <array>
+#include <cstdint>
+#include <vector>
+
+namespace GuestSceNetTest {
+using ResolverLookup = bool (*)(const char*, int, std::vector<std::array<std::uint8_t, 16>>&);
+void SetResolverLookupForTests_nid_no_patch(ResolverLookup lookup) noexcept;
+}
diff --git a/core/libs/prx/libSceNetCtl/Export.cpp b/core/libs/prx/libSceNetCtl/Export.cpp
index 519bcf4ce1..d3e153e34a 100644
--- a/core/libs/prx/libSceNetCtl/Export.cpp
+++ b/core/libs/prx/libSceNetCtl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -35,16 +36,6 @@
 #include <vector>
 
 // Network-control state reflects host interface addressing, not PSN sign-in status.
-union NetCtlInfoV6;
-struct NetCtlConnectionConfiguration;
-struct NetCtlScanOptions;
-struct NetCtlScanBssidList;
-struct NetCtlScanInfo;
-struct NetCtlNatInfoInternal;
-struct NetCtlBandwidthInfo;
-struct NetCtlNetEvConfiguration;
-struct NetBweInfo;
-struct NetCtlWifiInfo;
 
 static constexpr int SCE_NET_CTL_ERROR_NOT_INITIALIZED = static_cast<int>(0x80412101);
 static constexpr int SCE_NET_CTL_ERROR_ID_NOT_FOUND = static_cast<int>(0x80412104);
@@ -99,6 +90,7 @@ static std::atomic_bool g_initialized{true};
 static std::mutex g_callbackLock;
 static CallbackSlot g_callbacks[MAX_CALLBACKS] = {};
 static CallbackSlot g_callbacksV6[MAX_CALLBACKS] = {};
+static CallbackSlot g_callbacksNpToolkit[MAX_CALLBACKS] = {};
 
 static int RegisterCallback(CallbackSlot (&callbacks)[MAX_CALLBACKS], NetCtlCallback func, void* arg, int* cid) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
@@ -123,15 +115,15 @@ static int UnregisterCallback(CallbackSlot (&callbacks)[MAX_CALLBACKS], int cid)
     return 0;
 }
 
-static bool HasIpv4Callback() {
+static bool HasCallback(const CallbackSlot (&callbacks)[MAX_CALLBACKS]) {
     std::lock_guard lock(g_callbackLock);
-    for (const auto& slot : g_callbacks) {
+    for (const auto& slot : callbacks) {
         if (slot.func) return true;
     }
     return false;
 }
 
-static bool HostHasAddress(int family) {
+static bool QueryHostHasAddress(int family) {
 #ifdef _WIN32
     static const int socket_status = [] {
         WSADATA data{};
@@ -188,6 +180,74 @@ struct HostIpv4Interface {
     std::vector<in_addr> dns;
 };
 
+#ifdef _WIN32
+namespace {
+
+struct HostAddressCache {
+    std::mutex lock;
+    bool registered = false;
+    bool tried = false;
+    std::atomic<std::uint64_t> generation{1};
+    std::uint64_t seen[3]{};
+    bool value[3]{};
+    std::uint64_t interfaceSeen = 0;
+    bool interfaceFound = false;
+    HostIpv4Interface interfaceValue;
+};
+
+HostAddressCache& AddressCache() {
+    static HostAddressCache cache;
+    return cache;
+}
+
+void CALLBACK HostAddressChanged(PVOID, PMIB_UNICASTIPADDRESS_ROW, MIB_NOTIFICATION_TYPE) {
+    AddressCache().generation.fetch_add(1, std::memory_order_acq_rel);
+}
+
+void CALLBACK HostInterfaceChanged(PVOID, PMIB_IPINTERFACE_ROW, MIB_NOTIFICATION_TYPE) {
+    AddressCache().generation.fetch_add(1, std::memory_order_acq_rel);
+}
+
+void CALLBACK HostRouteChanged(PVOID, PMIB_IPFORWARD_ROW2, MIB_NOTIFICATION_TYPE) {
+    AddressCache().generation.fetch_add(1, std::memory_order_acq_rel);
+}
+
+void WatchHostAddresses(HostAddressCache& cache) {
+    if (cache.tried) return;
+    cache.tried = true;
+    HANDLE addresses = nullptr;
+    HANDLE interfaces = nullptr;
+    HANDLE routes = nullptr;
+    cache.registered = NotifyUnicastIpAddressChange(AF_UNSPEC, HostAddressChanged, nullptr, FALSE, &addresses) == NO_ERROR &&
+                       NotifyIpInterfaceChange(AF_UNSPEC, HostInterfaceChanged, nullptr, FALSE, &interfaces) == NO_ERROR &&
+                       NotifyRouteChange2(AF_UNSPEC, HostRouteChanged, nullptr, FALSE, &routes) == NO_ERROR;
+    if (!cache.registered) {
+        if (addresses != nullptr) CancelMibChangeNotify2(addresses);
+        if (interfaces != nullptr) CancelMibChangeNotify2(interfaces);
+        if (routes != nullptr) CancelMibChangeNotify2(routes);
+    }
+}
+
+}
+#endif
+
+static bool HostHasAddress(int family) {
+#ifdef _WIN32
+    auto& cache = AddressCache();
+    const int slot = family == AF_INET ? 0 : family == AF_INET6 ? 1 : 2;
+    std::lock_guard guard(cache.lock);
+    WatchHostAddresses(cache);
+    const auto generation = cache.generation.load(std::memory_order_acquire);
+    if (cache.registered && cache.seen[slot] == generation) return cache.value[slot];
+    const bool value = QueryHostHasAddress(family);
+    cache.value[slot] = value;
+    cache.seen[slot] = generation;
+    return value;
+#else
+    return QueryHostHasAddress(family);
+#endif
+}
+
 static bool UsableIpv4(in_addr address) {
     const auto host = ntohl(address.s_addr);
     return host != 0 && (host >> 24) != 127;
@@ -310,7 +370,7 @@ static std::vector<in_addr> HostDnsServers() {
 }
 #endif
 
-static bool FindHostIpv4Interface(HostIpv4Interface& found) {
+static bool QueryHostIpv4Interface(HostIpv4Interface& found) {
 #ifdef _WIN32
     ULONG size = 0;
     const ULONG flags = GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_INCLUDE_GATEWAYS;
@@ -371,6 +431,25 @@ static bool FindHostIpv4Interface(HostIpv4Interface& found) {
 #endif
 }
 
+static bool FindHostIpv4Interface(HostIpv4Interface& found) {
+#ifdef _WIN32
+    auto& cache = AddressCache();
+    std::lock_guard guard(cache.lock);
+    WatchHostAddresses(cache);
+    const auto generation = cache.generation.load(std::memory_order_acquire);
+    if (!cache.registered || cache.interfaceSeen != generation) {
+        HostIpv4Interface value;
+        cache.interfaceFound = QueryHostIpv4Interface(value);
+        cache.interfaceValue = std::move(value);
+        cache.interfaceSeen = generation;
+    }
+    if (cache.interfaceFound) found = cache.interfaceValue;
+    return cache.interfaceFound;
+#else
+    return QueryHostIpv4Interface(found);
+#endif
+}
+
 extern "C" std::size_t NetCtlHostDnsServers_nid_no_patch(std::uint32_t* servers, std::size_t capacity) {
     HostIpv4Interface host;
     if (!FindHostIpv4Interface(host)) return 0;
@@ -425,17 +504,15 @@ static void HostTraffic(std::uint64_t& sent, std::uint64_t& received) {
 #endif
 }
 
-extern "C" {
-
-int APS5_VABI sceNetCtlCheckCallback(void) {
+static int CheckCallbacks(CallbackSlot (&callbacks)[MAX_CALLBACKS]) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
-    if (!HasIpv4Callback()) return 0;
+    if (!HasCallback(callbacks)) return 0;
     const int event = HostHasAddress(AF_UNSPEC) ? NET_CTL_EVENT_IPOBTAINED : NET_CTL_EVENT_DISCONNECTED;
     CallbackSlot due[MAX_CALLBACKS];
     int count = 0;
     {
         std::lock_guard lock(g_callbackLock);
-        for (auto& slot : g_callbacks) {
+        for (auto& slot : callbacks) {
             if (!slot.func || slot.lastEvent == event) continue;
             slot.lastEvent = event;
             due[count++] = slot;
@@ -445,6 +522,12 @@ int APS5_VABI sceNetCtlCheckCallback(void) {
     return 0;
 }
 
+extern "C" {
+
+int APS5_VABI sceNetCtlCheckCallback(void) {
+    return CheckCallbacks(g_callbacks);
+}
+
 int APS5_VABI sceNetCtlGetIfStat(NetCtlIfStat* stat) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
     if (!stat) return SCE_NET_CTL_ERROR_INVALID_ADDR;
@@ -497,7 +580,11 @@ int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo* info) {
 int APS5_VABI sceNetCtlGetResult(int event, int* result) {
     if (!g_initialized.load()) return SCE_NET_CTL_ERROR_NOT_INITIALIZED;
     if (!result) return SCE_NET_CTL_ERROR_INVALID_ADDR;
-    throw std::logic_error("sceNetCtlGetResult: service event results are not implemented");
+    if (event < NET_CTL_EVENT_DISCONNECTED || event > NET_CTL_EVENT_IPOBTAINED) {
+        throw std::runtime_error("sceNetCtlGetResult: event type " + std::to_string(event) + " is not implemented");
+    }
+    *result = 0;
+    return 0;
 }
 
 int APS5_VABI sceNetCtlGetState(int* state) {
@@ -546,8 +633,7 @@ int APS5_VABI sceNetCtlUnregisterCallbackV6(int cid) {
 }
 
 int APS5_VABI sceNetCtlRegisterCallbackForNpToolkit(NetCtlCallback callback, void* argument, int* callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return RegisterCallback(g_callbacksNpToolkit, callback, argument, callbackId);
 }
 
 int APS5_VABI sceNetCtlRegisterCallbackIpcInt(NetCtlCallback callback, void* argument, int* callbackId) {
@@ -561,8 +647,7 @@ int APS5_VABI sceNetCtlRegisterCallbackForLibIpcInt(NetCtlCallback callback, voi
 }
 
 int APS5_VABI sceNetCtlUnregisterCallbackForNpToolkit(int callbackId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return UnregisterCallback(g_callbacksNpToolkit, callbackId);
 }
 
 int APS5_VABI sceNetCtlUnregisterCallbackIpcInt(int callbackId) {
@@ -576,8 +661,7 @@ int APS5_VABI sceNetCtlUnregisterCallbackForLibIpcInt(int callbackId) {
 }
 
 int APS5_VABI sceNetCtlCheckCallbackForNpToolkit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return CheckCallbacks(g_callbacksNpToolkit);
 }
 
 int APS5_VABI sceNetCtlCheckCallbackForLibIpcInt(void) {
diff --git a/core/libs/prx/libSceNetCtl/include/NetCtl.hpp b/core/libs/prx/libSceNetCtl/include/NetCtl.hpp
new file mode 100644
index 0000000000..f2fa735b00
--- /dev/null
+++ b/core/libs/prx/libSceNetCtl/include/NetCtl.hpp
@@ -0,0 +1,104 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+union NetCtlInfoV6;
+struct NetCtlConnectionConfiguration;
+struct NetCtlScanOptions;
+struct NetCtlScanBssidList;
+struct NetCtlScanInfo;
+struct NetCtlNatInfoInternal;
+struct NetCtlBandwidthInfo;
+struct NetCtlNetEvConfiguration;
+struct NetBweInfo;
+struct NetCtlWifiInfo;
+
+extern "C" {
+
+int APS5_VABI sceNetCtlCheckCallback(void);
+int APS5_VABI sceNetCtlGetIfStat(NetCtlIfStat* stat);
+int APS5_VABI sceNetCtlGetInfo(int code, NetCtlInfo* info);
+int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo* info);
+int APS5_VABI sceNetCtlGetResult(int event, int* result);
+int APS5_VABI sceNetCtlGetState(int* state);
+int APS5_VABI sceNetCtlGetStateV6(int* state);
+int APS5_VABI sceNetCtlInit(void);
+int APS5_VABI sceNetCtlRegisterCallback(NetCtlCallback func, void* arg, int* cid);
+int APS5_VABI sceNetCtlRegisterCallbackV6(NetCtlCallback func, void* arg, int* cid);
+int APS5_VABI sceNetCtlGetInfoV6(std::uint32_t code, NetCtlInfoV6* info);
+void APS5_VABI sceNetCtlTerm(void);
+int APS5_VABI sceNetCtlUnregisterCallback(int cid);
+int APS5_VABI sceNetCtlUnregisterCallbackV6(int cid);
+int APS5_VABI sceNetCtlRegisterCallbackForNpToolkit(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlRegisterCallbackIpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlRegisterCallbackForLibIpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackForNpToolkit(int callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackIpcInt(int callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackForLibIpcInt(int callbackId);
+int APS5_VABI sceNetCtlCheckCallbackForNpToolkit(void);
+int APS5_VABI sceNetCtlCheckCallbackForLibIpcInt(void);
+int APS5_VABI sceNetCtlClearEventIpcInt(int event);
+int APS5_VABI sceNetCtlClearEventForNpToolkit(int event);
+int APS5_VABI sceNetCtlClearEventForLibIpcInt(int event);
+int APS5_VABI sceNetCtlGetResultIpcInt(int event, int* result);
+int APS5_VABI sceNetCtlGetStateIpcInt(int* state);
+int APS5_VABI sceNetCtlGetState2IpcInt(int* state);
+int APS5_VABI sceNetCtlGetInfoIpcInt(std::uint32_t code, NetCtlInfo* info);
+int APS5_VABI sceNetCtlGetEtherLinkMode(int* mode);
+int APS5_VABI sceNetCtlGetWifiType(int* type);
+int APS5_VABI sceNetCtlConnectIpcInt(void);
+int APS5_VABI sceNetCtlConnectWithRetryIpcInt(void);
+int APS5_VABI sceNetCtlConnectConfIpcInt(const NetCtlConnectionConfiguration* configuration);
+int APS5_VABI sceNetCtlDisconnectIpcInt(void);
+int APS5_VABI sceNetCtlScanIpcInt(const char* const* ssids, std::uint32_t count, const NetCtlScanOptions* options);
+int APS5_VABI sceNetCtlGetScanInfoBssidIpcInt(NetCtlScanBssidList* bssids, std::uint32_t capacity);
+int APS5_VABI sceNetCtlGetScanInfoByBssidIpcInt(const std::uint8_t* bssid, NetCtlScanInfo* info, void* buffer, std::size_t* size);
+int APS5_VABI sceNetCtlGetScanInfoForSsidScanIpcInt(NetCtlScanInfo* info, void* buffer, std::size_t* size);
+int APS5_VABI sceNetCtlGetScanInfoBssidForSsidListScanIpcInt(NetCtlScanBssidList* bssids, std::uint32_t capacity);
+int APS5_VABI sceNetCtlGetScanInfoForSsidListScanIpcInt(const std::uint8_t* bssid, NetCtlScanInfo* info, void* buffer, std::size_t* size);
+int APS5_VABI sceNetCtlSetErrorNotificationEnabledIpcInt(int enabled);
+int APS5_VABI sceNetCtlRegisterCallbackV6IpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetCtlUnregisterCallbackV6IpcInt(int callbackId);
+int APS5_VABI sceNetCtlGetResultV6(int eventType, int* errorCode);
+int APS5_VABI sceNetCtlGetResultV6IpcInt(int event, int* result);
+int APS5_VABI sceNetCtlGetStateV6IpcInt(int* state);
+int APS5_VABI sceNetCtlGetInfoV6IpcInt(std::uint32_t code, NetCtlInfoV6* info);
+int APS5_VABI sceNetCtlGetNatInfoIpcInt(NetCtlNatInfoInternal* info);
+int APS5_VABI sceNetCtlSetStunWithPaddingFlagIpcInt(void);
+int APS5_VABI sceNetCtlUnsetStunWithPaddingFlagIpcInt(void);
+int APS5_VABI sceNetCtlIsBandwidthManagementEnabledIpcInt(void);
+int APS5_VABI sceNetCtlDisableBandwidthManagementIpcInt(void);
+int APS5_VABI sceNetCtlEnableBandwidthManagementIpcInt(void);
+int APS5_VABI sceNetCtlGetBandwidthInfoIpcInt(NetCtlBandwidthInfo* info);
+int APS5_VABI sceNetCtlGetNetEvConfigInfoIpcInt(NetCtlNetEvConfiguration* configuration);
+int APS5_VABI sceNetCtlGetConnectionElapsedTimeIpcInt(std::uint64_t* elapsedTime);
+int APS5_VABI sceNetCtlApRpCheckCallback(void);
+int APS5_VABI sceNetCtlApRpClearEvent(void);
+int APS5_VABI sceNetCtlApRpRegisterCallback(void);
+int APS5_VABI sceNetCtlApRpUnregisterCallback(void);
+int APS5_VABI sceNetCtlApRpGetResult(void);
+int APS5_VABI sceNetCtlApRpGetState(void);
+int APS5_VABI sceNetCtlApRpGetInfo(void);
+int APS5_VABI sceNetCtlApRpStart(void);
+int APS5_VABI sceNetCtlApCpStart(void);
+int APS5_VABI sceNetCtlApAppStartWithRetryPid(std::int32_t processId, const char* passcode);
+int APS5_VABI sceNetCtlApAppStartWithRetry(const char* passcode);
+int APS5_VABI sceNetCtlApRpStartWithRetry(void);
+int APS5_VABI sceNetCtlApRpStartConf(void);
+int APS5_VABI sceNetCtlApRpStop(void);
+int APS5_VABI sceNetCtlApCpStop(void);
+int APS5_VABI sceNetCtlApAppInitWpaKey(void);
+int APS5_VABI sceNetCtlApAppInitWpaKeyForQa(std::uint8_t mode);
+int APS5_VABI sceNetCtlApRestart(void);
+int APS5_VABI sceNetBweCheckCallbackIpcInt(void);
+int APS5_VABI sceNetBweClearEventIpcInt(int event);
+int APS5_VABI sceNetBweRegisterCallbackIpcInt(NetCtlCallback callback, void* argument, int* callbackId);
+int APS5_VABI sceNetBweUnregisterCallbackIpcInt(int callbackId);
+int APS5_VABI sceNetBweGetInfoIpcInt(NetBweInfo* info);
+int APS5_VABI sceNetBweStartInternetConnectionTestIpcInt(void);
+int APS5_VABI sceNetBweFinishInternetConnectionTestIpcInt(void);
+int APS5_VABI sceNetBweStartInternetConnectionTestBandwidthTestIpcInt(void);
+int APS5_VABI sceNetBweSetInternetConnectionTestResultIpcInt(std::int32_t firstResult, std::int32_t secondResult);
+int APS5_VABI sceNetCtlGetWifiInfoIpcInt(NetCtlWifiInfo* info);
+
+}
diff --git a/core/libs/prx/libSceNetCtl/libSceNetCtl.hpp b/core/libs/prx/libSceNetCtl/libSceNetCtl.hpp
new file mode 100644
index 0000000000..d60a79d958
--- /dev/null
+++ b/core/libs/prx/libSceNetCtl/libSceNetCtl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
diff --git a/core/libs/prx/libSceNetCtlAp/Export.cpp b/core/libs/prx/libSceNetCtlAp/Export.cpp
index 9da3953097..8eafcd5e4f 100644
--- a/core/libs/prx/libSceNetCtlAp/Export.cpp
+++ b/core/libs/prx/libSceNetCtlAp/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtlAp/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <mutex>
@@ -23,8 +24,6 @@ constexpr std::size_t NET_CTL_AP_INFO_SIZE = 152;
 constexpr std::size_t NET_CTL_AP_CONNECT_INFO_SIZE = 184;
 constexpr int MAX_CALLBACKS = 8;
 
-using NetCtlApCallback = void(APS5_VABI*)(int, void*);
-
 struct CallbackSlot {
     NetCtlApCallback func = nullptr;
     void* arg = nullptr;
@@ -77,6 +76,7 @@ int APS5_VABI sceNetCtlApRegisterCallback(NetCtlApCallback func, void* arg, int*
             return 0;
         }
     }
+    *cid = -1;
     return NET_CTL_AP_ERROR_CALLBACK_MAX;
 }
 
diff --git a/core/libs/prx/libSceNetCtlAp/include/Api.hpp b/core/libs/prx/libSceNetCtlAp/include/Api.hpp
new file mode 100644
index 0000000000..31649a048f
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlAp/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using NetCtlApCallback = void(APS5_VABI*)(int, void*);
+
+extern "C" {
+
+int APS5_VABI sceNetCtlApInit();
+void APS5_VABI sceNetCtlApTerm();
+int APS5_VABI sceNetCtlApCheckCallback();
+int APS5_VABI sceNetCtlApClearEvent(int eventType);
+int APS5_VABI sceNetCtlApRegisterCallback(NetCtlApCallback func, void* arg, int* cid);
+int APS5_VABI sceNetCtlApUnregisterCallback(int cid);
+int APS5_VABI sceNetCtlApGetResult(int eventType, int* errorCode);
+int APS5_VABI sceNetCtlApGetInfo(void* info);
+int APS5_VABI sceNetCtlApGetState(int* state);
+int APS5_VABI sceNetCtlApStop();
+int APS5_VABI sceNetCtlApGetConnectInfo(const char* optStr, void* connectInfo);
+
+}
diff --git a/core/libs/prx/libSceNetCtlAp/libSceNetCtlAp.hpp b/core/libs/prx/libSceNetCtlAp/libSceNetCtlAp.hpp
new file mode 100644
index 0000000000..1f1138e728
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlAp/libSceNetCtlAp.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNetCtlAp/include/Api.hpp"
diff --git a/core/libs/prx/libSceNetCtlApDialog/Export.cpp b/core/libs/prx/libSceNetCtlApDialog/Export.cpp
index 64a0d3086e..d6c67ca827 100644
--- a/core/libs/prx/libSceNetCtlApDialog/Export.cpp
+++ b/core/libs/prx/libSceNetCtlApDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtlApDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceNetCtlApDialog/include/Api.hpp b/core/libs/prx/libSceNetCtlApDialog/include/Api.hpp
new file mode 100644
index 0000000000..ec8df01ad0
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlApDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNetCtlApDialogInitialize(void);
+int APS5_VABI sceNetCtlApDialogTerminate(void);
+int APS5_VABI sceNetCtlApDialogOpen(const NetCtlApDialogParam* param);
+int APS5_VABI sceNetCtlApDialogClose(void);
+int APS5_VABI sceNetCtlApDialogUpdateStatus(void);
+int APS5_VABI sceNetCtlApDialogGetStatus(void);
+int APS5_VABI sceNetCtlApDialogGetResult(NetCtlApDialogResult* result);
+
+}
diff --git a/core/libs/prx/libSceNetCtlApDialog/libSceNetCtlApDialog.hpp b/core/libs/prx/libSceNetCtlApDialog/libSceNetCtlApDialog.hpp
new file mode 100644
index 0000000000..b62243d95c
--- /dev/null
+++ b/core/libs/prx/libSceNetCtlApDialog/libSceNetCtlApDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNetCtlApDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNgs2.native/Export.cpp b/core/libs/prx/libSceNgs2.native/Export.cpp
index 984f3782fe..6f5160436e 100644
--- a/core/libs/prx/libSceNgs2.native/Export.cpp
+++ b/core/libs/prx/libSceNgs2.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNgs2.native/include/Api.hpp b/core/libs/prx/libSceNgs2.native/include/Api.hpp
new file mode 100644
index 0000000000..7bc7c26ad3
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/include/Api.hpp
@@ -0,0 +1,23 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNgs2JobSchedulerResetOption(void);
+int APS5_VABI sceNgs2ModuleArrayEnumItems(void);
+int APS5_VABI sceNgs2ModuleEnumConfigs(void);
+int APS5_VABI sceNgs2ModuleQueueEnumItems(void);
+int APS5_VABI sceNgs2RackQueryInfo(void);
+int APS5_VABI sceNgs2RackRunCommands(void);
+int APS5_VABI sceNgs2StreamCreate(void);
+int APS5_VABI sceNgs2StreamCreateWithAllocator(void);
+int APS5_VABI sceNgs2StreamDestroy(void);
+int APS5_VABI sceNgs2StreamQueryBufferSize(void);
+int APS5_VABI sceNgs2StreamQueryInfo(void);
+int APS5_VABI sceNgs2StreamResetOption(void);
+int APS5_VABI sceNgs2StreamRunCommands(void);
+int APS5_VABI sceNgs2SystemQueryInfo(void);
+int APS5_VABI sceNgs2SystemRunCommands(void);
+
+}
diff --git a/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp b/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp
index a604adba3d..eda5e07ef3 100644
--- a/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp
+++ b/core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp
@@ -9,14 +9,33 @@
 static constexpr int SCE_NGS2_OK = 0;
 static constexpr int SCE_NGS2_ERROR_INVALID_OUT_ADDRESS = static_cast<int>(0x804A8010);
 static constexpr int SCE_NGS2_ERROR_INVALID_OUT_SIZE = static_cast<int>(0x804A8011);
+static constexpr int SCE_NGS2_ERROR_INVALID_BUFFER_INFO = static_cast<int>(0x804A8020);
+static constexpr int SCE_NGS2_ERROR_INVALID_BUFFER_ALLOCATOR = static_cast<int>(0x804A8023);
+static constexpr int SCE_NGS2_ERROR_INVALID_SAMPLE_RATE = static_cast<int>(0x804A8051);
 static constexpr int SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE = static_cast<int>(0x804A8201);
 static constexpr int SCE_NGS2_ERROR_INVALID_RACK_HANDLE = static_cast<int>(0x804A8202);
+static constexpr int SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE = static_cast<int>(0x804A8050);
+static constexpr int SCE_NGS2_ERROR_INVALID_RENDER_BUFFER = static_cast<int>(0x804A8251);
+static constexpr int SCE_NGS2_ERROR_INVALID_NUM_RENDER_BUFFERS = static_cast<int>(0x804A830B);
 static constexpr int SCE_NGS2_ERROR_INVALID_VOICE_INDEX = static_cast<int>(0x804A8305);
+static constexpr int SCE_NGS2_ERROR_INVALID_NUM_GRAIN_SAMPLES = static_cast<int>(0x804A8310);
+static constexpr int SCE_NGS2_ERROR_INVALID_MAX_GRAIN_SAMPLES = static_cast<int>(0x804A8311);
 static constexpr int SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA = static_cast<int>(0x804A8430);
 static constexpr int SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT = static_cast<int>(0x804A8431);
 static constexpr int SCE_NGS2_ERROR_UNKNOWN_WAVEFORM_FORMAT = static_cast<int>(0x804A8432);
+static constexpr int SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE = static_cast<int>(0x804A8450);
+static constexpr int SCE_NGS2_ERROR_INVALID_PAN_SPEAKER = static_cast<int>(0x804A8451);
 static constexpr int SCE_NGS2_ERROR_INVALID_VOICE_HANDLE = static_cast<int>(0x804A8203);
 static constexpr int SCE_NGS2_ERROR_NULL_PARAM_LIST = static_cast<int>(0x804A8360);
+static constexpr int SCE_NGS2_ERROR_INVALID_GEOM_LISTENER_ADDRESS = static_cast<int>(0x804A8461);
+static constexpr int SCE_NGS2_ERROR_INVALID_GEOM_FLAG = static_cast<int>(0x804A8463);
+static constexpr int SCE_NGS2_ERROR_INVALID_OPTION_SIZE = static_cast<int>(0x804A8013);
+static constexpr int SCE_NGS2_ERROR_INVALID_NUM_CHANNELS = static_cast<int>(0x804A8052);
+static constexpr int SCE_NGS2_ERROR_INVALID_PITCH_SHIFT_OPTION = static_cast<int>(0x804A8098);
+static constexpr int SCE_NGS2_ERROR_INVALID_REVERB_OPTION = static_cast<int>(0x804A8099);
+static constexpr int SCE_NGS2_ERROR_INVALID_STATE_SIZE = static_cast<int>(0x804A8302);
+static constexpr int SCE_NGS2_ERROR_INVALID_BUFFER_INDEX = static_cast<int>(0x804A8306);
+static constexpr int SCE_NGS2_ERROR_INVALID_NUM_BUFFERS = static_cast<int>(0x804A830B);
 
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_SAMPLER = 0x1000;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_SUBMIXER = 0x2000;
@@ -24,9 +43,12 @@ static constexpr std::uint32_t SCE_NGS2_RACK_ID_REVERB = 0x2001;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_MASTERING = 0x3000;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_SAMPLER = 0x4001;
 static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER = 0x4002;
+static constexpr std::uint32_t SCE_NGS2_RACK_ID_CUSTOM_MASTERING = 0x4003;
 
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I16L = 0x12;
+static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_I16B = 0x13;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_F32L = 0x18;
+static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_PCM_F32B = 0x19;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_TYPE_ATRAC9 = 0x40;
 
 static constexpr std::uint32_t SCE_NGS2_VOICE_EVENT_PLAY = 1;
@@ -66,15 +88,31 @@ static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_EXIT_LOOP = 0x40010004;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_SAMPLER_VOICE_PARAM_PITCH = 0x40010005;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP = 0x40020000;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP = 0x40030000;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN = 0x40030004;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT = 0x40030005;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_FILTER = 0x40001300;
-static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX = 0x40001d00;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN = 0x40001500;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX = 0x40001900;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_DELAY = 0x40001d00;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX2 = 0x40001f00;
 
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_MAX_MODULES = 24;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_MAX_PORTS = 16;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MAX_BUFFERS = 4;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS = 37;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS = 2;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_REVERB_OPTION_SIZE = 12;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_PITCH_SHIFT_OPTION_SIZE = 8;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_PITCH_SHIFT_STATE_SIZE = 8;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_FILTER = 0x13;
-static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_USER_FX = 0x1d;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_GAIN = 0x15;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_REVERB = 0x1b;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_USER_FX = 0x19;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_DELAY = 0x1d;
 static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_USER_FX2 = 0x1f;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT = 0x20;
+static constexpr std::uint32_t SCE_NGS2_CUSTOM_MODULE_ID_CONVOLUTION = 0x23;
 
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_BLOCKS_FLAG_CONTINUE = 1;
 static constexpr std::uint32_t SCE_NGS2_WAVEFORM_BLOCKS_FLAG_APPEND = 2;
@@ -186,6 +224,15 @@ struct Ngs2CustomModuleOption {
     std::uint32_t size;
 };
 
+struct Ngs2CustomDelayModuleOption {
+    Ngs2CustomModuleOption custom_module_option;
+    std::uint32_t type;
+    std::uint32_t max_taps;
+    float max_length;
+    std::uint32_t reserved;
+};
+static_assert(sizeof(Ngs2CustomDelayModuleOption) == 20);
+
 struct Ngs2UserFx2SetupContext {
     void* common;
     void* param;
@@ -271,6 +318,18 @@ struct Ngs2CustomRackModuleInfo {
 };
 static_assert(sizeof(Ngs2CustomRackModuleInfo) == 40);
 
+struct Ngs2CustomModuleInfo {
+    std::uint32_t module_id;
+    std::uint32_t source_buffer_id;
+    std::uint32_t extra_buffer_id;
+    std::uint32_t dest_buffer_id;
+    std::uint32_t state_offset;
+    std::uint32_t state_size;
+    std::uint32_t reserved;
+    std::uint32_t reserved2;
+};
+static_assert(sizeof(Ngs2CustomModuleInfo) == 32);
+
 struct Ngs2CustomRackPortInfo {
     std::uint32_t source_buffer_id;
     std::uint32_t reserved;
@@ -305,6 +364,8 @@ struct Ngs2CustomSubmixerRackOption {
 };
 static_assert(sizeof(Ngs2CustomSubmixerRackOption) == 1288);
 
+using Ngs2CustomMasteringRackOption = Ngs2CustomSubmixerRackOption;
+
 struct Ngs2RackInfo {
     char name[64];
     Ngs2Handle rack_handle;
@@ -523,6 +584,12 @@ struct Ngs2CustomVoiceUserFx2Param {
 };
 static_assert(sizeof(Ngs2CustomVoiceUserFx2Param) == 24);
 
+struct Ngs2CustomVoiceGainParam {
+    Ngs2VoiceParamHeader header;
+    float gain[SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS];
+};
+static_assert(sizeof(Ngs2CustomVoiceGainParam) == 156);
+
 struct Ngs2CustomVoiceFilterParam {
     Ngs2VoiceParamHeader header;
     std::uint32_t type;
@@ -607,6 +674,12 @@ struct Ngs2VoicePortInfo {
 };
 static_assert(sizeof(Ngs2VoicePortInfo) == 24);
 
+struct Ngs2VoiceMatrixInfo {
+    std::uint32_t num_levels;
+    float levels[64];
+};
+static_assert(sizeof(Ngs2VoiceMatrixInfo) == 260);
+
 struct Ngs2VoiceState {
     std::uint32_t state_flags;
     std::int32_t error_code;
diff --git a/core/libs/prx/libSceNgs2.native/libSceNgs2.native.hpp b/core/libs/prx/libSceNgs2.native/libSceNgs2.native.hpp
new file mode 100644
index 0000000000..1ca6a1c884
--- /dev/null
+++ b/core/libs/prx/libSceNgs2.native/libSceNgs2.native.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceNgs2.native/include/Api.hpp"
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
diff --git a/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp b/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp
index 6c08a090c1..ecebdfed40 100644
--- a/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Atrac9.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -26,6 +27,8 @@ static constexpr std::uint32_t MAX_SAMPLE_RATE = 192000;
 static constexpr std::uint32_t WAVEFORM_TYPE_PCM_FIRST = 0x10;
 static constexpr std::uint32_t WAVEFORM_TYPE_PCM_LAST = 0x1b;
 static constexpr std::uint32_t WAVEFORM_TYPE_VAG = 0x1c;
+static constexpr std::uint32_t VAG_FRAME_SAMPLES = 28;
+static constexpr std::uint32_t ATRAC9_FRAME_SAMPLES[16] = {0, 64, 0, 0, 128, 0, 0, 256, 0, 0, 0, 0, 0, 0, 0, 0};
 static constexpr std::uint32_t PCM_BYTES_PER_SAMPLE[] = {1, 1, 2, 2, 3, 3, 4, 4, 4, 4, 8, 8};
 
 static bool IsPcmType(std::uint32_t type) {
@@ -43,6 +46,37 @@ static Ngs2WaveformBlock PcmBlock(std::uint32_t type, std::uint32_t channels, st
     return block;
 }
 
+static Ngs2WaveformBlock VagBlock(std::uint32_t channels, std::uint32_t pos, std::uint32_t count) {
+    const std::uint32_t frameBytes = 16u * channels;
+    const std::uint32_t first = pos / VAG_FRAME_SAMPLES;
+    const std::uint32_t past = (pos + count + VAG_FRAME_SAMPLES - 1u) / VAG_FRAME_SAMPLES;
+    const auto offset = static_cast<std::uint32_t>(static_cast<std::uint64_t>(first) * frameBytes);
+    Ngs2WaveformBlock block{};
+    block.data_offset = offset;
+    block.data_size = static_cast<std::uint32_t>(past * frameBytes - offset);
+    block.num_samples = (past - first) * VAG_FRAME_SAMPLES;
+    return block;
+}
+
+static Ngs2WaveformBlock Atrac9Block(std::uint32_t config, std::uint32_t pos, std::uint32_t count) {
+    const std::uint32_t rateIndex = (config >> 20) & 0xfu;
+    const std::uint32_t frameSamples = ATRAC9_FRAME_SAMPLES[rateIndex];
+    if (frameSamples == 0) throw std::runtime_error("NGS2: ATRAC9 waveform blocks at sampling rate index " + std::to_string(rateIndex) + " are not implemented");
+    const std::uint32_t superframeShift = (config >> 3) & 3u;
+    const std::uint32_t superframeBytes = (((config >> 5) & 0x7ffu) + 1u) << superframeShift;
+    const std::uint32_t superframeSamples = frameSamples << superframeShift;
+    const std::uint32_t first = pos / superframeSamples;
+    const std::uint32_t lead = frameSamples + pos;
+    const std::uint32_t past = (count + lead + superframeSamples - 1u) / superframeSamples;
+    const std::uint32_t offset = first * superframeBytes;
+    Ngs2WaveformBlock block{};
+    block.data_offset = offset;
+    block.data_size = past * superframeBytes - offset;
+    block.num_skip_samples = lead - first * superframeSamples;
+    block.num_samples = count;
+    return block;
+}
+
 void Ngs2Atrac9DecoderDeleter::operator()(void* handle) const {
     Atrac9ReleaseHandle(handle);
 }
@@ -272,44 +306,31 @@ static int ReadChunks(std::size_t size, TRead&& read, RiffChunks& chunks) {
     return SCE_NGS2_OK;
 }
 
-static bool AddAtrac9Range(Ngs2WaveformInfo& info, std::uint64_t begin, std::uint32_t samples, std::uint32_t repeats) {
-    if (samples == 0) return true;
-    const auto preroll = std::min<std::uint64_t>(begin, info.num_audio_unit_samples);
-    const auto firstFrame = (begin - preroll) / info.num_audio_frame_samples;
-    const auto skip = begin - firstFrame * info.num_audio_frame_samples;
-    const auto frames = (skip + samples + info.num_audio_frame_samples - 1) / info.num_audio_frame_samples;
-    const auto offset = firstFrame * info.audio_frame_size;
-    const auto bytes = frames * info.audio_frame_size;
-    if (offset > info.data_size || bytes > info.data_size - offset) return false;
-    auto& block = info.block[info.num_blocks++];
-    block = {info.data_offset + offset, bytes, repeats, static_cast<std::uint32_t>(skip), samples, 0, 0};
-    return true;
+static void AddAtrac9Block(Ngs2WaveformInfo& info, std::uint32_t begin, std::uint32_t samples, std::uint32_t repeats) {
+    auto block = Atrac9Block(info.format.config_data, begin, samples);
+    if (block.data_offset > info.data_size || block.data_size > info.data_size - block.data_offset)
+        throw std::runtime_error("NGS2: an ATRAC9 loop block reaching past the data chunk is not implemented");
+    block.data_offset += info.data_offset;
+    block.num_repeats = repeats;
+    info.block[info.num_blocks++] = block;
 }
 
 static int ParseAtrac9Loop(const RiffChunks& chunks, Ngs2WaveformInfo& info) {
     if (chunks.sampler == nullptr) return SCE_NGS2_OK;
-    if (chunks.samplerSize < 36) return SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA;
-    const auto count = ReadLe32(chunks.sampler + 28);
-    if (count > (chunks.samplerSize - 36) / 24) return SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA;
-    if (count == 0) return SCE_NGS2_OK;
-    if (count != 1) throw std::runtime_error("NGS2: multiple waveform loops are not implemented");
-    const auto* loop = chunks.sampler + 36;
-    if (ReadLe32(loop + 4) != 0 || ReadLe32(loop + 16) != 0)
-        throw std::runtime_error("NGS2: non-forward or fractional waveform loops are not implemented");
-    const std::uint64_t begin = ReadLe32(loop + 8);
-    const std::uint64_t end = static_cast<std::uint64_t>(ReadLe32(loop + 12)) + 1;
-    const auto skip = info.block[0].num_skip_samples;
-    const std::uint64_t waveformEnd = static_cast<std::uint64_t>(skip) + info.num_samples;
-    if (begin < skip || begin >= end || end > waveformEnd) return SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA;
-    const auto plays = ReadLe32(loop + 20);
-    info.loop_begin_position = static_cast<std::uint32_t>(begin - skip);
-    info.loop_end_position = static_cast<std::uint32_t>(end - skip);
+    if (chunks.samplerSize < 32) throw std::runtime_error("NGS2: a smpl chunk too short for its loop count is not implemented");
+    if (ReadLe32(chunks.sampler + 28) == 0) return SCE_NGS2_OK;
+    if (chunks.samplerSize < 52) throw std::runtime_error("NGS2: a smpl chunk too short for its first loop is not implemented");
+    if (ReadLe32(chunks.sampler + 44) < info.num_delay_samples) throw std::runtime_error("NGS2: an ATRAC9 loop starting inside the decoder delay is not implemented");
+    const std::uint32_t begin = ReadLe32(chunks.sampler + 44) - info.num_delay_samples;
+    const std::uint32_t end = ReadLe32(chunks.sampler + 48) - info.num_delay_samples + 1u;
+    info.loop_begin_position = begin;
+    info.loop_end_position = end;
+    if (end <= begin) return SCE_NGS2_OK;
+    if (end > info.num_samples) throw std::runtime_error("NGS2: a waveform loop ending past the last sample is not implemented");
     info.num_blocks = 0;
-    info.block[0] = {};
-    if (!AddAtrac9Range(info, skip, info.loop_begin_position, 0) ||
-        !AddAtrac9Range(info, begin, static_cast<std::uint32_t>(end - begin), plays == 0 ? UINT32_MAX : plays - 1) ||
-        !AddAtrac9Range(info, end, static_cast<std::uint32_t>(waveformEnd - end), 0))
-        return SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA;
+    if (begin != 0) AddAtrac9Block(info, 0, begin, 0);
+    AddAtrac9Block(info, begin, end - begin, UINT32_MAX);
+    if (end != info.num_samples) AddAtrac9Block(info, end, info.num_samples - end, 0);
     return SCE_NGS2_OK;
 }
 
@@ -333,7 +354,7 @@ static int ParseAtrac9(const RiffChunks& chunks, Ngs2WaveformInfo& info) {
     info.num_audio_unit_per_frame = static_cast<std::uint32_t>(codec.framesInSuperframe);
     info.audio_frame_size = static_cast<std::uint32_t>(codec.superframeSize);
     info.num_audio_frame_samples = static_cast<std::uint32_t>(codec.frameSamples * codec.framesInSuperframe);
-    info.num_delay_samples = ReadLe32(chunks.fact + 4);
+    info.num_delay_samples = static_cast<std::uint32_t>(codec.frameSamples);
     info.num_blocks = 1;
     info.block[0].data_offset = chunks.dataOffset;
     info.block[0].data_size = chunks.dataSize;
@@ -432,21 +453,34 @@ int APS5_VABI sceNgs2CalcWaveformBlock(const Ngs2WaveformFormat* format, uint32_
         *block = PcmBlock(type, format->num_channels, sample_pos, num_samples);
         return SCE_NGS2_OK;
     }
-    if (type == WAVEFORM_TYPE_VAG) throw std::runtime_error("NGS2: waveform blocks of type " + Ngs2Hex(type) + " are not implemented");
+    if (type == WAVEFORM_TYPE_VAG) {
+        *block = VagBlock(format->num_channels, sample_pos, num_samples);
+        return SCE_NGS2_OK;
+    }
     if (type != SCE_NGS2_WAVEFORM_TYPE_ATRAC9) return SCE_NGS2_ERROR_UNKNOWN_WAVEFORM_FORMAT;
-    if (format->num_channels == 0 || format->num_channels > NGS2_MAX_CHANNELS || format->sample_rate == 0 || format->sample_rate > MAX_SAMPLE_RATE) {
+    *block = Atrac9Block(format->config_data, sample_pos, num_samples);
+    return SCE_NGS2_OK;
+}
+
+int APS5_VABI sceNgs2GetWaveformFrameInfo(const Ngs2WaveformFormat* format, uint32_t* out_frame_size, uint32_t* out_num_frame_samples, uint32_t* out_units_per_frame, uint32_t* out_num_delay_samples) {
+    if (out_frame_size == nullptr || out_num_frame_samples == nullptr || out_units_per_frame == nullptr || out_num_delay_samples == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
+    if (format == nullptr || format->num_channels == 0 || format->num_channels > NGS2_MAX_CHANNELS || format->sample_rate == 0 || format->sample_rate > MAX_SAMPLE_RATE) {
         return SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT;
     }
+    if (format->waveform_type == SCE_NGS2_WAVEFORM_TYPE_PCM_I16L) {
+        *out_frame_size = format->num_channels * sizeof(std::int16_t);
+        *out_num_frame_samples = 1;
+        *out_units_per_frame = 1;
+        *out_num_delay_samples = 0;
+        return SCE_NGS2_OK;
+    }
+    if (format->waveform_type != SCE_NGS2_WAVEFORM_TYPE_ATRAC9) throw std::runtime_error("NGS2: the frame info of waveform type " + Ngs2Hex(format->waveform_type) + " is not implemented");
     Atrac9CodecInfo codec{};
     if (!MatchingCodecInfo(*format, codec)) return SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT;
-    const std::uint64_t superframeSamples = static_cast<std::uint64_t>(codec.frameSamples) * codec.framesInSuperframe;
-    const std::uint64_t skip = sample_pos % superframeSamples;
-    block->data_offset = sample_pos / superframeSamples * codec.superframeSize;
-    if (num_samples != 0) {
-        block->data_size = (skip + num_samples + superframeSamples - 1) / superframeSamples * codec.superframeSize;
-        block->num_skip_samples = static_cast<std::uint32_t>(skip);
-    }
-    block->num_samples = num_samples;
+    *out_frame_size = static_cast<std::uint32_t>(codec.superframeSize);
+    *out_num_frame_samples = static_cast<std::uint32_t>(codec.frameSamples * codec.framesInSuperframe);
+    *out_units_per_frame = static_cast<std::uint32_t>(codec.framesInSuperframe);
+    *out_num_delay_samples = static_cast<std::uint32_t>(codec.frameSamples);
     return SCE_NGS2_OK;
 }
 
diff --git a/core/libs/prx/libSceNgs2.native/src/Custom.cpp b/core/libs/prx/libSceNgs2.native/src/Custom.cpp
index d3e586a4d9..5d066d889a 100644
--- a/core/libs/prx/libSceNgs2.native/src/Custom.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Custom.cpp
@@ -12,28 +12,96 @@
 static constexpr std::uint32_t USER_FX2_FLAG_FIRST_PROCESS = 1;
 static constexpr std::uint32_t USER_FX2_FLAG_PARAM_CHANGED = 2;
 
-void Ngs2CheckCustomRack(const Ngs2CustomRackOption& option) {
-    if (option.num_buffers != 1) throw std::runtime_error("NGS2: custom racks with " + std::to_string(option.num_buffers) + " buffers are not implemented");
+static const char* BuiltInModuleName(std::uint32_t moduleId) {
+    switch (moduleId) {
+        case SCE_NGS2_CUSTOM_MODULE_ID_GAIN: return "Gain";
+        case SCE_NGS2_CUSTOM_MODULE_ID_REVERB: return "Reverb";
+        case SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT: return "PitchShift";
+        case SCE_NGS2_CUSTOM_MODULE_ID_CONVOLUTION: return "Convolution";
+        default: return nullptr;
+    }
+}
+
+static std::uint32_t OptionWord(const Ngs2CustomModuleOption& option) {
+    std::uint32_t word = 0;
+    std::memcpy(&word, reinterpret_cast<const std::uint8_t*>(&option) + sizeof(option), sizeof(word));
+    return word;
+}
+
+static int CheckBuiltInModule(const Ngs2CustomRackModuleInfo& info) {
+    const auto stateSizeIs = [&info](std::uint32_t size) { return info.state_size == 0 || info.state_size == size; };
+    if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_GAIN || info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX) {
+        if (!stateSizeIs(0)) return SCE_NGS2_ERROR_INVALID_STATE_SIZE;
+    } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_REVERB) {
+        if (!stateSizeIs(0)) return SCE_NGS2_ERROR_INVALID_STATE_SIZE;
+        if (info.option != nullptr && info.option->size != SCE_NGS2_CUSTOM_REVERB_OPTION_SIZE) return SCE_NGS2_ERROR_INVALID_OPTION_SIZE;
+        if (info.option != nullptr && OptionWord(*info.option) > 1) return SCE_NGS2_ERROR_INVALID_REVERB_OPTION;
+    } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT) {
+        if (!stateSizeIs(SCE_NGS2_CUSTOM_PITCH_SHIFT_STATE_SIZE)) return SCE_NGS2_ERROR_INVALID_STATE_SIZE;
+        if (info.option != nullptr && info.option->size == SCE_NGS2_CUSTOM_PITCH_SHIFT_OPTION_SIZE && OptionWord(*info.option) != 0) {
+            return SCE_NGS2_ERROR_INVALID_PITCH_SHIFT_OPTION;
+        }
+    }
+    return SCE_NGS2_OK;
+}
+
+static void CheckDelayModule(std::uint32_t rackId, const Ngs2CustomRackModuleInfo& info) {
+    if (rackId != SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || info.state_size != 0 || info.state_offset != 0) {
+        throw std::runtime_error("NGS2: this custom Delay rack or module state is not implemented");
+    }
+    if (info.option == nullptr || info.option->size != sizeof(Ngs2CustomDelayModuleOption)) {
+        throw std::runtime_error("NGS2: this custom Delay module option size is not implemented");
+    }
+    Ngs2CustomDelayModuleOption delay{};
+    std::memcpy(&delay, info.option, sizeof(delay));
+    if (delay.type > 1 || delay.max_taps == 0 || delay.max_taps > 8 ||
+        !(delay.max_length >= 1.0f && delay.max_length <= 20000.0f) || delay.reserved != 0) {
+        throw std::runtime_error("NGS2: these custom Delay module option values are not implemented");
+    }
+}
+
+int Ngs2CheckCustomRack(std::uint32_t rackId, const Ngs2CustomRackOption& option, std::uint32_t maxInputs) {
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING && option.num_modules != 0) {
+        throw std::runtime_error("NGS2: custom mastering racks with modules are not implemented");
+    }
+    if (option.num_buffers == 0 || option.num_buffers > SCE_NGS2_CUSTOM_MAX_BUFFERS || option.num_buffers < maxInputs) {
+        return SCE_NGS2_ERROR_INVALID_NUM_BUFFERS;
+    }
     if (option.num_modules > SCE_NGS2_CUSTOM_MAX_MODULES || option.rack_option.max_ports > SCE_NGS2_CUSTOM_MAX_PORTS) APS5_INVALID_ARG_EX;
     for (std::uint32_t m = 0; m < option.num_modules; m++) {
         const auto& info = option.module[m];
         if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX2) {
             if (info.option == nullptr || info.option->size != sizeof(Ngs2CustomUserFx2ModuleOption)) APS5_INVALID_ARG_EX;
-            if (info.source_buffer_id != 0 || info.dest_buffer_id != 0) APS5_INVALID_ARG_EX;
             if (reinterpret_cast<const Ngs2CustomUserFx2ModuleOption*>(info.option)->process_handler == nullptr) APS5_INVALID_ARG_EX;
         } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_FILTER) {
             if (info.option != nullptr || info.state_size != 0 || info.state_offset != 0) APS5_INVALID_ARG_EX;
-            if (info.source_buffer_id != 0 || info.extra_buffer_id != 0 || info.dest_buffer_id != 0) APS5_INVALID_ARG_EX;
         } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX) {
-            if (info.source_buffer_id != 0 || info.dest_buffer_id != 0) APS5_INVALID_ARG_EX;
-            if (info.option != nullptr && info.option->size < sizeof(Ngs2CustomModuleOption)) APS5_INVALID_ARG_EX;
-        } else {
+            if (rackId != SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) throw std::runtime_error("NGS2: the custom UserFx module on a custom sampler rack is not implemented");
+            if (info.option != nullptr) throw std::runtime_error("NGS2: a custom UserFx module option is not implemented");
+        } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_DELAY) {
+            CheckDelayModule(rackId, info);
+        } else if (BuiltInModuleName(info.module_id) == nullptr) {
             throw std::runtime_error("NGS2: custom module id " + Ngs2Hex(info.module_id) + " is not implemented");
         }
+        if (info.source_buffer_id >= option.num_buffers || info.extra_buffer_id >= option.num_buffers || info.dest_buffer_id >= option.num_buffers) {
+            return SCE_NGS2_ERROR_INVALID_BUFFER_INDEX;
+        }
+        const int result = CheckBuiltInModule(info);
+        if (result != SCE_NGS2_OK) return result;
+    }
+    if (option.num_buffers != 1) throw std::runtime_error("NGS2: custom racks with " + std::to_string(option.num_buffers) + " buffers are not implemented");
+    for (std::uint32_t m = 0; m < option.num_modules; m++) {
+        const auto moduleId = option.module[m].module_id;
+        if (moduleId == SCE_NGS2_CUSTOM_MODULE_ID_GAIN && option.module[m].option != nullptr) throw std::runtime_error("NGS2: an option for the custom Gain module is not implemented");
+        if (moduleId == SCE_NGS2_CUSTOM_MODULE_ID_GAIN && rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) continue;
+        if (moduleId == SCE_NGS2_CUSTOM_MODULE_ID_GAIN) throw std::runtime_error("NGS2: the custom Gain module on a custom sampler rack is not implemented");
+        const char* name = BuiltInModuleName(moduleId);
+        if (name != nullptr) throw std::runtime_error(std::string("NGS2: the custom ") + name + " module is not implemented");
     }
     for (std::uint32_t p = 0; p < option.rack_option.max_ports; p++) {
         if (option.port[p].source_buffer_id != 0) APS5_INVALID_ARG_EX;
     }
+    return SCE_NGS2_OK;
 }
 
 static Ngs2UserFx2SetupContext UserFxContext(Ngs2Rack& rack, std::size_t module, std::uint32_t voiceIndex) {
@@ -44,14 +112,18 @@ static Ngs2UserFx2SetupContext UserFxContext(Ngs2Rack& rack, std::size_t module,
 
 void Ngs2SetupUserFx(Ngs2Rack& rack, const Ngs2CustomRackOption& option) {
     rack.customModuleIds.resize(option.num_modules);
+    rack.customModules.resize(option.num_modules);
     rack.userFx.resize(option.num_modules);
     rack.userFxCommon.resize(option.num_modules);
     for (auto& voice : rack.voices) {
         voice.userFx.resize(option.num_modules);
         voice.customUserFx.resize(option.num_modules);
+        voice.customGain.assign(option.num_modules, {});
     }
     for (std::uint32_t m = 0; m < option.num_modules; m++) {
         rack.customModuleIds[m] = option.module[m].module_id;
+        const auto& info = option.module[m];
+        rack.customModules[m] = {info.module_id, info.source_buffer_id, info.extra_buffer_id, info.dest_buffer_id, info.state_offset, info.state_size, 0, 0};
         if (option.module[m].module_id == SCE_NGS2_CUSTOM_MODULE_ID_FILTER) continue;
         if (option.module[m].module_id == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX2) {
             const auto& module = *reinterpret_cast<const Ngs2CustomUserFx2ModuleOption*>(option.module[m].option);
@@ -116,8 +188,31 @@ static void SetCustomUserFxParam(Ngs2Voice& voice, std::uint32_t index, const Ng
     fx.flags = 1;
 }
 
+static void SetGainParam(Ngs2Voice& voice, std::uint32_t index, const Ngs2CustomVoiceGainParam& param) {
+    if (index >= voice.customGain.size() || voice.rack->customModuleIds[index] != SCE_NGS2_CUSTOM_MODULE_ID_GAIN) APS5_INVALID_ARG_EX;
+    for (const float gain : param.gain) {
+        if (!(gain >= -32.0f && gain <= 32.0f)) throw std::runtime_error("NGS2: a custom Gain level outside -32 to 32 is not implemented");
+    }
+    std::copy(std::begin(param.gain), std::end(param.gain), voice.customGain[index].target.begin());
+}
+
+static void ProcessGain(Ngs2Voice& voice, Ngs2VoiceCustomGain& gain, const std::vector<float*>& channels, std::uint32_t grain) {
+    if (voice.hasSamples) {
+        for (std::uint32_t c = 0; c < voice.channels; c++) {
+            const float from = gain.current[c];
+            const float step = (gain.target[c] - from) / static_cast<float>(grain);
+            for (std::uint32_t i = 0; i < grain; i++) channels[c][i] *= from + step * static_cast<float>(i + 1);
+        }
+        voice.hasSamples = std::any_of(voice.samples.begin(), voice.samples.end(), [](float sample) { return sample != 0.0f; });
+    }
+    gain.current = gain.target;
+}
+
 void Ngs2ApplyCustomParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
     const auto rackId = voice.rack->rackId;
+    if ((param.id & ~0xffu) == SCE_NGS2_CUSTOM_VOICE_PARAM_DELAY) {
+        throw std::runtime_error("NGS2: the custom Delay module parameters are not implemented");
+    }
     if (param.id == SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP) {
         if (rackId != SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) throw std::invalid_argument("NGS2: voice param " + Ngs2Hex(param.id) + " belongs to another rack");
         SetupCustomSubmixer(voice, ParamAs<Ngs2CustomSubmixerVoiceSetupParam>(param));
@@ -148,6 +243,11 @@ void Ngs2ApplyCustomParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
         Ngs2SetFilter(voice, filter);
         return;
     }
+    if ((param.id & ~0x1fu) == SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN) {
+        if (rackId != SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) throw std::invalid_argument("NGS2: voice param " + Ngs2Hex(param.id) + " belongs to another rack");
+        SetGainParam(voice, param.id & 0x1f, ParamAs<Ngs2CustomVoiceGainParam>(param));
+        return;
+    }
     if ((param.id & ~0x1fu) == SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX2) {
         if (rackId != SCE_NGS2_RACK_ID_CUSTOM_SAMPLER && rackId != SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) {
             throw std::invalid_argument("NGS2: voice param " + Ngs2Hex(param.id) + " belongs to another rack");
@@ -169,7 +269,10 @@ void Ngs2ProcessUserFx(Ngs2Voice& voice, std::uint32_t grain, std::uint32_t samp
     std::vector<float*> channels(voice.channels);
     for (std::uint32_t c = 0; c < voice.channels; c++) channels[c] = voice.samples.data() + static_cast<std::size_t>(c) * grain;
     for (std::size_t m = 0; m < voice.rack->customModuleIds.size(); m++) {
-        if (voice.rack->customModuleIds[m] == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX2) {
+        if (voice.rack->customModuleIds[m] == SCE_NGS2_CUSTOM_MODULE_ID_DELAY) continue;
+        if (voice.rack->customModuleIds[m] == SCE_NGS2_CUSTOM_MODULE_ID_GAIN) {
+            ProcessGain(voice, voice.customGain[m], channels, grain);
+        } else if (voice.rack->customModuleIds[m] == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX2) {
             if (!voice.hasSamples) continue;
             auto& fx = voice.userFx[m];
             const auto& module = voice.rack->userFx[m];
diff --git a/core/libs/prx/libSceNgs2.native/src/Geom.cpp b/core/libs/prx/libSceNgs2.native/src/Geom.cpp
index 28f5d9f10c..9b68d818ef 100644
--- a/core/libs/prx/libSceNgs2.native/src/Geom.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Geom.cpp
@@ -41,9 +41,9 @@ Vector PerpendicularHint(const Vector& front) {
 }
 
 int Ngs2GeomCalcListener(const Ngs2GeomListenerParam* param, Ngs2GeomListenerWork* outWork, std::uint32_t flags) {
-    if (param == nullptr) APS5_INVALID_ARG_EX;
+    if (param == nullptr) return SCE_NGS2_ERROR_INVALID_GEOM_LISTENER_ADDRESS;
     if (outWork == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    if (flags > 1) throw std::runtime_error("NGS2: unknown listener coordinate flags");
+    if (flags > 1) return SCE_NGS2_ERROR_INVALID_GEOM_FLAG;
     if (!std::isfinite(param->sound_speed) || param->sound_speed <= 0.0f) APS5_INVALID_ARG_EX;
     const Vector position = ReadVector(param->position);
     ReadVector(param->velocity);
diff --git a/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp b/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp
index adc9f3d665..73270afab9 100644
--- a/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp
+++ b/core/libs/prx/libSceNgs2.native/src/Ngs2Internal.hpp
@@ -108,11 +108,17 @@ struct Ngs2VoiceCustomUserFx {
     std::uint32_t flags = 0;
 };
 
+struct Ngs2VoiceCustomGain {
+    std::array<float, SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS> current{};
+    std::array<float, SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS> target{};
+};
+
 struct Ngs2Voice {
     Ngs2Rack* rack = nullptr;
     Ngs2PlayState state = Ngs2PlayState::Empty;
     std::uint32_t stateFlags = 0;
     std::uint32_t channels = 0;
+    std::uint32_t inputChannels = 0;
     std::uint32_t sampleRate = 0;
     std::uint32_t waveformType = 0;
     Ngs2Atrac9 atrac9;
@@ -136,6 +142,7 @@ struct Ngs2Voice {
     float lfeLevel = 1.0f;
     std::vector<Ngs2UserFx2> userFx;
     std::vector<Ngs2VoiceCustomUserFx> customUserFx;
+    std::vector<Ngs2VoiceCustomGain> customGain;
     Ngs2UserFxProcessHandler userFxHandler = nullptr;
     std::array<std::uintptr_t, 3> userFxData{};
     std::uint32_t userFxFlags = 0;
@@ -147,6 +154,7 @@ struct Ngs2Voice {
     void SetEvent(std::uint32_t eventId);
     void ResetSetup();
     const std::uint8_t* WaveformData() const;
+    std::uint32_t InputChannels() const { return inputChannels != 0 ? inputChannels : channels; }
 };
 
 struct Ngs2Rack {
@@ -166,6 +174,7 @@ struct Ngs2Rack {
     std::vector<Ngs2CustomUserFx2ModuleOption> userFx;
     std::vector<std::vector<std::uint8_t>> userFxCommon;
     std::vector<std::uint32_t> customModuleIds;
+    std::vector<Ngs2CustomModuleInfo> customModules;
     std::thread::id lockOwner{};
     std::uint32_t lockDepth = 0;
 };
@@ -229,7 +238,7 @@ std::size_t Ngs2Atrac9BlockBytes(const Ngs2Voice& voice, const Ngs2WaveformBlock
 void Ngs2RestartAtrac9(Ngs2Voice& voice);
 void Ngs2ConsumeAtrac9(Ngs2Voice& voice, std::uint32_t grain, std::uint32_t systemRate);
 bool Ngs2FinishBlock(Ngs2Voice& voice);
-void Ngs2CheckCustomRack(const Ngs2CustomRackOption& option);
+int Ngs2CheckCustomRack(std::uint32_t rackId, const Ngs2CustomRackOption& option, std::uint32_t maxInputs);
 void Ngs2SetupUserFx(Ngs2Rack& rack, const Ngs2CustomRackOption& option);
 void Ngs2CleanupUserFx(Ngs2Rack& rack);
 void Ngs2ApplyCustomParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param);
diff --git a/core/libs/prx/libSceNgs2.native/src/Pan.cpp b/core/libs/prx/libSceNgs2.native/src/Pan.cpp
index af88b23204..e1a4d70548 100644
--- a/core/libs/prx/libSceNgs2.native/src/Pan.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Pan.cpp
@@ -55,10 +55,13 @@ static void AddBetweenSpeakers(const Ngs2PanWork& work, std::uint32_t speaker, f
 }
 
 int Ngs2PanInit(Ngs2PanWork* work, const float* speaker_angles, float unit_angle, uint32_t num_speakers) {
-    if (work == nullptr) APS5_INVALID_ARG_EX;
-    if (speaker_angles != nullptr && !IsUnitAngle(unit_angle)) APS5_INVALID_ARG_EX;
+    if (work == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
+    if (speaker_angles != nullptr && !IsUnitAngle(unit_angle)) return SCE_NGS2_ERROR_INVALID_PAN_UNIT_ANGLE;
     const auto* layout = LayoutFor(num_speakers);
-    if (layout == nullptr) APS5_INVALID_ARG_EX;
+    if (layout == nullptr) {
+        if (speaker_angles == nullptr && num_speakers == 0) APS5_INVALID_ARG_EX;
+        return SCE_NGS2_ERROR_INVALID_PAN_SPEAKER;
+    }
     *work = {};
     work->num_speakers = num_speakers;
     if (speaker_angles == nullptr) {
diff --git a/core/libs/prx/libSceNgs2.native/src/Rack.cpp b/core/libs/prx/libSceNgs2.native/src/Rack.cpp
index 47897d3215..13277128e3 100644
--- a/core/libs/prx/libSceNgs2.native/src/Rack.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Rack.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -19,6 +20,7 @@ union RackOptions {
     Ngs2ReverbRackOption reverb;
     Ngs2CustomSamplerRackOption customSampler;
     Ngs2CustomSubmixerRackOption customSubmixer;
+    Ngs2CustomMasteringRackOption customMastering;
 };
 
 static std::size_t RackOptionSize(std::uint32_t rackId) {
@@ -29,12 +31,13 @@ static std::size_t RackOptionSize(std::uint32_t rackId) {
         case SCE_NGS2_RACK_ID_REVERB: return sizeof(Ngs2ReverbRackOption);
         case SCE_NGS2_RACK_ID_CUSTOM_SAMPLER: return sizeof(Ngs2CustomSamplerRackOption);
         case SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER: return sizeof(Ngs2CustomSubmixerRackOption);
+        case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: return sizeof(Ngs2CustomMasteringRackOption);
         default: throw std::runtime_error("NGS2: rack id " + Ngs2Hex(rackId) + " is not implemented");
     }
 }
 
 static RackOptions DefaultRackOption(std::uint32_t rackId) {
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER || rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) {
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER || rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) {
         throw std::runtime_error("NGS2: default custom rack options are not implemented");
     }
     RackOptions options{};
@@ -83,26 +86,39 @@ static std::uint32_t RackMaxChannels(std::uint32_t rackId, const RackOptions& op
     if (rackId == SCE_NGS2_RACK_ID_SUBMIXER) return options.submixer.max_channels;
     if (rackId == SCE_NGS2_RACK_ID_MASTERING) return options.mastering.max_channels;
     if (rackId == SCE_NGS2_RACK_ID_REVERB) return options.reverb.max_channels;
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) return options.customSubmixer.max_channels;
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) return options.customSubmixer.max_channels;
     return NGS2_MAX_CHANNELS;
 }
 
-static RackOptions CheckedRackOption(std::uint32_t rackId, const Ngs2RackOption* option) {
+static int CheckedRackOption(std::uint32_t rackId, const Ngs2RackOption* option, RackOptions& options) {
     const auto size = RackOptionSize(rackId);
-    if (option == nullptr) return DefaultRackOption(rackId);
+    if (option == nullptr) {
+        options = DefaultRackOption(rackId);
+        return SCE_NGS2_OK;
+    }
     if (option->size != size) throw std::invalid_argument("NGS2: unexpected rack option size " + std::to_string(option->size));
-    RackOptions options{};
+    options = {};
     std::memcpy(&options, option, size);
     const auto maxChannels = RackMaxChannels(rackId, options);
-    if (options.common.max_voices == 0 || maxChannels == 0 || maxChannels > NGS2_MAX_CHANNELS) {
+    if ((rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) && maxChannels > SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS;
+    if ((rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) && (options.customSubmixer.max_inputs == 0 || options.customSubmixer.max_inputs > SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS)) {
+        throw std::runtime_error("NGS2: custom submixer racks with " + std::to_string(options.customSubmixer.max_inputs) + " inputs are not implemented");
+    }
+    if (options.common.max_voices == 0 || maxChannels == 0) throw std::invalid_argument("NGS2: invalid rack voice or channel count");
+    int result = SCE_NGS2_OK;
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) result = Ngs2CheckCustomRack(rackId, options.customSampler.custom_rack_option, 0);
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) result = Ngs2CheckCustomRack(rackId, options.customSubmixer.custom_rack_option, options.customSubmixer.max_inputs);
+    if (result != SCE_NGS2_OK) return result;
+    if (maxChannels > NGS2_MAX_CHANNELS) {
+        if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) {
+            throw std::runtime_error("NGS2: custom submixer racks with " + std::to_string(maxChannels) + " channels are not implemented");
+        }
         throw std::invalid_argument("NGS2: invalid rack voice or channel count");
     }
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) Ngs2CheckCustomRack(options.customSampler.custom_rack_option);
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) Ngs2CheckCustomRack(options.customSubmixer.custom_rack_option);
     if (rackId == SCE_NGS2_RACK_ID_REVERB && options.reverb.reverb_size != 1) {
         throw std::runtime_error("NGS2: reverb rack size " + std::to_string(options.reverb.reverb_size) + " is not implemented");
     }
-    return options;
+    return SCE_NGS2_OK;
 }
 
 static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackOptions& options, const Ngs2ContextBufferInfo& bufferInfo,
@@ -116,7 +132,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO
     rack->maxChannels = RackMaxChannels(rackId, options);
     rack->maxFilters = rackId == SCE_NGS2_RACK_ID_SAMPLER ? options.sampler.max_filters
                       : rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER ? options.customSampler.custom_rack_option.num_modules
-                      : rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER ? options.customSubmixer.custom_rack_option.num_modules : 0;
+                      : (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) ? options.customSubmixer.custom_rack_option.num_modules : 0;
     rack->uid = nextUid++;
     std::memcpy(rack->name, options.common.name, sizeof(rack->name));
     rack->name[sizeof(rack->name) - 1] = '\0';
@@ -124,7 +140,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO
     if (rackId == SCE_NGS2_RACK_ID_SAMPLER) rack->maxChannelWorks = options.sampler.max_channel_works;
     if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) rack->maxChannelWorks = options.customSampler.max_channel_works;
     if (rackId == SCE_NGS2_RACK_ID_SUBMIXER) rack->maxInputs = options.submixer.max_inputs;
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) rack->maxInputs = options.customSubmixer.max_inputs;
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) rack->maxInputs = options.customSubmixer.max_inputs;
     rack->bufferInfo = bufferInfo;
     rack->allocator = allocator;
     rack->voices.resize(options.common.max_voices);
@@ -134,7 +150,7 @@ static int CreateRack(Ngs2Handle systemHandle, std::uint32_t rackId, const RackO
         voice.matrices.resize(options.common.max_matrices);
     }
     if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) Ngs2SetupUserFx(*rack, options.customSampler.custom_rack_option);
-    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER) Ngs2SetupUserFx(*rack, options.customSubmixer.custom_rack_option);
+    if (rackId == SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER || rackId == SCE_NGS2_RACK_ID_CUSTOM_MASTERING) Ngs2SetupUserFx(*rack, options.customSubmixer.custom_rack_option);
     system->racks.push_back(rack);
     *handle = reinterpret_cast<Ngs2Handle>(rack);
     return SCE_NGS2_OK;
@@ -165,7 +181,9 @@ extern "C" {
 
 int APS5_VABI sceNgs2RackQueryBufferSize(uint32_t rack_id, const Ngs2RackOption* option, Ngs2ContextBufferInfo* buffer_info) {
     if (buffer_info == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    CheckedRackOption(rack_id, option);
+    RackOptions options{};
+    const int result = CheckedRackOption(rack_id, option, options);
+    if (result != SCE_NGS2_OK) throw std::invalid_argument("NGS2: invalid rack option, rejected at creation with " + Ngs2Hex(static_cast<std::uint32_t>(result)));
     *buffer_info = {};
     buffer_info->host_buffer_size = sizeof(Ngs2Rack);
     return SCE_NGS2_OK;
@@ -173,16 +191,20 @@ int APS5_VABI sceNgs2RackQueryBufferSize(uint32_t rack_id, const Ngs2RackOption*
 
 int APS5_VABI sceNgs2RackCreate(uintptr_t system_handle, uint32_t rack_id, const Ngs2RackOption* option, const Ngs2ContextBufferInfo* buffer_info, uintptr_t* handle) {
     if (handle == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    const auto options = CheckedRackOption(rack_id, option);
     if (buffer_info == nullptr) APS5_INVALID_ARG_EX;
+    RackOptions options{};
+    const int result = CheckedRackOption(rack_id, option, options);
+    if (result != SCE_NGS2_OK) return result;
     const Ngs2Lock lock;
     return CreateRack(system_handle, rack_id, options, *buffer_info, {}, handle);
 }
 
 int APS5_VABI sceNgs2RackCreateWithAllocator(uintptr_t system_handle, uint32_t rack_id, const Ngs2RackOption* option, const Ngs2BufferAllocator* allocator, uintptr_t* handle) {
     if (handle == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    const auto options = CheckedRackOption(rack_id, option);
     if (allocator == nullptr || allocator->alloc_handler == nullptr || allocator->free_handler == nullptr) APS5_INVALID_ARG_EX;
+    RackOptions options{};
+    const int checked = CheckedRackOption(rack_id, option, options);
+    if (checked != SCE_NGS2_OK) return checked;
     const Ngs2Lock lock;
     if (Ngs2FindSystem(system_handle) == nullptr) return SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE;
     Ngs2ContextBufferInfo bufferInfo{};
@@ -245,6 +267,17 @@ int APS5_VABI sceNgs2RackGetInfo(uintptr_t rack_handle, Ngs2RackInfo* info, size
     return SCE_NGS2_OK;
 }
 
+int APS5_VABI sceNgs2CustomRackGetModuleInfo(uintptr_t rack_handle, uint32_t module_index, Ngs2CustomModuleInfo* info, size_t info_size) {
+    if (info == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
+    const Ngs2Lock lock;
+    const auto* rack = Ngs2FindRack(rack_handle);
+    if (rack == nullptr) return SCE_NGS2_ERROR_INVALID_RACK_HANDLE;
+    if (module_index >= rack->customModules.size() || info_size < sizeof(Ngs2CustomModuleInfo)) APS5_INVALID_ARG_EX;
+    if (info_size != sizeof(Ngs2CustomModuleInfo)) throw std::runtime_error("NGS2: custom module info of " + std::to_string(info_size) + " bytes is not implemented");
+    *info = rack->customModules[module_index];
+    return SCE_NGS2_OK;
+}
+
 int APS5_VABI sceNgs2RackSetUserData(uintptr_t rack_handle, uintptr_t user_data) {
     std::lock_guard lock(Ngs2Mutex());
     auto* rack = Ngs2FindRack(rack_handle);
diff --git a/core/libs/prx/libSceNgs2.native/src/Render.cpp b/core/libs/prx/libSceNgs2.native/src/Render.cpp
index fa764d375a..3fb3689e23 100644
--- a/core/libs/prx/libSceNgs2.native/src/Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Render.cpp
@@ -221,10 +221,11 @@ float Ngs2DefaultLevel(std::uint32_t sourceChannels, std::uint32_t source, std::
 
 static void MixPort(Ngs2Voice& voice, const Ngs2Voice& source, const Ngs2Port& port, std::uint32_t grain) {
     const auto* matrix = port.matrix < 0 || source.matrices[port.matrix].empty() ? nullptr : &source.matrices[port.matrix];
-    const std::size_t outputs = matrix == nullptr ? voice.channels : std::min<std::size_t>(voice.channels, matrix->size() / source.channels);
+    const auto channels = voice.InputChannels();
+    const std::size_t outputs = matrix == nullptr ? channels : std::min<std::size_t>(channels, matrix->size() / source.channels);
     for (std::size_t dst = 0; dst < outputs; dst++) {
         for (std::uint32_t src = 0; src < source.channels; src++) {
-            const float level = port.volume * (matrix == nullptr ? Ngs2DefaultLevel(source.channels, src, voice.channels, static_cast<std::uint32_t>(dst)) : (*matrix)[dst * source.channels + src]);
+            const float level = port.volume * (matrix == nullptr ? Ngs2DefaultLevel(source.channels, src, channels, static_cast<std::uint32_t>(dst)) : (*matrix)[dst * source.channels + src]);
             if (level == 0.0f) continue;
             for (std::uint32_t i = 0; i < grain; i++) voice.samples[dst * grain + i] += source.samples[src * grain + i] * level;
         }
@@ -251,7 +252,7 @@ static void RenderVoice(Ngs2Voice& voice, const std::vector<Ngs2Voice*>& voices,
         bool& active;
         ~RenderingScope() { active = false; }
     } renderingScope{voice.rendering};
-    voice.samples.assign(static_cast<std::size_t>(grain) * voice.channels, 0.0f);
+    voice.samples.assign(static_cast<std::size_t>(grain) * voice.InputChannels(), 0.0f);
     voice.hasSamples = false;
     if (voice.state == Ngs2PlayState::Playing && voice.channels != 0) {
         if (voice.rack->rackId == SCE_NGS2_RACK_ID_SAMPLER || voice.rack->rackId == SCE_NGS2_RACK_ID_CUSTOM_SAMPLER) {
@@ -263,6 +264,7 @@ static void RenderVoice(Ngs2Voice& voice, const std::vector<Ngs2Voice*>& voices,
         Ngs2ProcessLegacyUserFx(voice, grain, systemRate);
         Ngs2ProcessUserFx(voice, grain, systemRate);
     }
+    if (voice.samples.size() != static_cast<std::size_t>(grain) * voice.channels) voice.samples.assign(static_cast<std::size_t>(grain) * voice.channels, 0.0f);
     voice.rendered = true;
 }
 
@@ -336,7 +338,7 @@ void Ngs2RenderSystem(Ngs2System& system, const Ngs2RenderBufferInfo* bufferInfo
     std::vector<std::vector<float>> mixes(numBufferInfo);
     for (auto* voice : voices) {
         RenderVoice(*voice, voices, grain, system.option.sample_rate);
-        if (voice->rack->rackId != SCE_NGS2_RACK_ID_MASTERING || !voice->hasSamples) continue;
+        if ((voice->rack->rackId != SCE_NGS2_RACK_ID_MASTERING && voice->rack->rackId != SCE_NGS2_RACK_ID_CUSTOM_MASTERING) || !voice->hasSamples) continue;
         auto& mix = OutputMix(mixes, bufferInfo, numBufferInfo, *voice, grain);
         const std::uint32_t outputChannels = bufferInfo[voice->outputId].num_channels;
         for (std::uint32_t channel = 0; channel < voice->channels; channel++) {
diff --git a/core/libs/prx/libSceNgs2.native/src/Reverb.cpp b/core/libs/prx/libSceNgs2.native/src/Reverb.cpp
index 131fb321f7..ab3849fbdd 100644
--- a/core/libs/prx/libSceNgs2.native/src/Reverb.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Reverb.cpp
@@ -292,9 +292,23 @@ bool Ngs2ProcessReverb(Ngs2Voice& voice, std::uint32_t grain, std::uint32_t samp
         Reset(reverb);
         reverb.changed = true;
     }
+    const std::uint32_t inputChannels = voice.InputChannels();
     const std::vector<float> input = voice.samples;
     std::vector<float> mono(grain), early(grain), late(grain);
-    MixDown(input.data(), channels, grain, mono.data());
+    MixDown(input.data(), inputChannels, grain, mono.data());
+    std::vector<float> mapped;
+    if (inputChannels != channels) {
+        mapped.assign(static_cast<std::size_t>(grain) * channels, 0.0f);
+        for (std::uint32_t dst = 0; dst < channels; dst++) {
+            for (std::uint32_t src = 0; src < inputChannels; src++) {
+                const float level = Ngs2DefaultLevel(inputChannels, src, channels, dst);
+                if (level == 0.0f) continue;
+                for (std::uint32_t i = 0; i < grain; i++) mapped[static_cast<std::size_t>(dst) * grain + i] += input[static_cast<std::size_t>(src) * grain + i] * level;
+            }
+        }
+        voice.samples.assign(static_cast<std::size_t>(grain) * channels, 0.0f);
+    }
+    const std::vector<float>& direct = inputChannels != channels ? mapped : input;
     if (reverb.changed) {
         std::vector<float> oldEarly(grain), oldLate(grain);
         RunTaps(reverb, reverb.taps, mono.data(), grain, oldEarly.data(), oldLate.data());
@@ -319,7 +333,7 @@ bool Ngs2ProcessReverb(Ngs2Voice& voice, std::uint32_t grain, std::uint32_t samp
     for (std::uint32_t channel = 0; channel < channels; channel++) {
         auto& state = reverb.channels[channel];
         float* out = voice.samples.data() + static_cast<std::size_t>(channel) * grain;
-        const float* in = input.data() + static_cast<std::size_t>(channel) * grain;
+        const float* in = direct.data() + static_cast<std::size_t>(channel) * grain;
         if (channel == LFE_CHANNEL) {
             std::copy(in, in + grain, out);
         } else {
diff --git a/core/libs/prx/libSceNgs2.native/src/System.cpp b/core/libs/prx/libSceNgs2.native/src/System.cpp
index 99eede7a7c..28a7828f36 100644
--- a/core/libs/prx/libSceNgs2.native/src/System.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/System.cpp
@@ -1,9 +1,11 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <condition_variable>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
+#include <iterator>
 #include <map>
 #include <memory>
 #include <mutex>
@@ -17,7 +19,6 @@
 #include "prx/libc/include/General.hpp"
 #include "Ngs2Internal.hpp"
 
-
 static std::vector<Ngs2System*>& Systems() {
     static auto* const systems = new std::vector<Ngs2System*>();
     return *systems;
@@ -197,7 +198,7 @@ int Ngs2ReleaseBuffer(const Ngs2BufferAllocator& allocator, Ngs2ContextBufferInf
 }
 
 static Ngs2ContextBufferInfo Allocate(const Ngs2BufferAllocator* allocator, std::size_t size) {
-    if (allocator == nullptr || allocator->alloc_handler == nullptr || allocator->free_handler == nullptr) APS5_INVALID_ARG_EX;
+    if (allocator->free_handler == nullptr) APS5_INVALID_ARG_EX;
     Ngs2ContextBufferInfo bufferInfo{};
     bufferInfo.host_buffer_size = size;
     bufferInfo.user_data = allocator->user_data;
@@ -212,18 +213,36 @@ static Ngs2SystemOption DefaultSystemOption() {
     option.max_grain_samples = 512;
     option.num_grain_samples = 256;
     option.sample_rate = 48000;
+    option.max_voice_channels = 8;
     return option;
 }
 
-static Ngs2SystemOption CheckedSystemOption(const Ngs2SystemOption* option) {
-    if (option == nullptr) return DefaultSystemOption();
-    if (option->size != sizeof(Ngs2SystemOption)) throw std::invalid_argument("NGS2: unexpected system option size " + std::to_string(option->size));
-    if (option->flags != 0) throw std::runtime_error("NGS2: system option flags are not implemented");
-    if (option->sample_rate == 0 || option->max_grain_samples < MIN_GRAIN_SAMPLES || option->num_grain_samples == 0 ||
-        option->num_grain_samples > option->max_grain_samples) {
-        throw std::invalid_argument("NGS2: invalid system grain or sample rate");
+static constexpr std::uint32_t MAX_GRAIN_SAMPLES = 2048;
+static constexpr std::uint32_t MAX_VOICE_CHANNELS = 37;
+
+static bool ValidGrainSamples(std::uint32_t grainSamples, std::uint32_t maxSamples) {
+    return grainSamples >= MIN_GRAIN_SAMPLES && grainSamples <= maxSamples && grainSamples % MIN_GRAIN_SAMPLES == 0;
+}
+
+static bool ValidSampleRate(std::uint32_t sampleRate) {
+    static constexpr std::uint32_t rates[] = {11025, 12000, 22050, 24000, 44100, 48000, 88200, 96000, 176400, 192000};
+    return std::find(std::begin(rates), std::end(rates), sampleRate) != std::end(rates);
+}
+
+static int CheckSystemOption(const Ngs2SystemOption* option, Ngs2SystemOption& checked) {
+    if (option == nullptr) {
+        checked = DefaultSystemOption();
+        return SCE_NGS2_OK;
     }
-    return *option;
+    if (option->size != sizeof(Ngs2SystemOption)) return SCE_NGS2_ERROR_INVALID_OPTION_SIZE;
+    constexpr std::uint32_t knownFlags = 0x2;
+    if ((option->flags & ~knownFlags) != 0) throw std::runtime_error("NGS2: system option flags " + Ngs2Hex(option->flags) + " are not implemented");
+    if (!ValidGrainSamples(option->max_grain_samples, MAX_GRAIN_SAMPLES)) return SCE_NGS2_ERROR_INVALID_MAX_GRAIN_SAMPLES;
+    if (!ValidGrainSamples(option->num_grain_samples, option->max_grain_samples)) return SCE_NGS2_ERROR_INVALID_NUM_GRAIN_SAMPLES;
+    if (!ValidSampleRate(option->sample_rate)) return SCE_NGS2_ERROR_INVALID_SAMPLE_RATE;
+    if (option->max_voice_channels < 1 || option->max_voice_channels > MAX_VOICE_CHANNELS) return SCE_NGS2_ERROR_INVALID_NUM_CHANNELS;
+    checked = *option;
+    return SCE_NGS2_OK;
 }
 
 static int CreateSystem(const Ngs2SystemOption& option, const Ngs2ContextBufferInfo& bufferInfo, const Ngs2BufferAllocator& allocator, Ngs2Handle* handle) {
@@ -246,23 +265,30 @@ extern "C" {
 
 int APS5_VABI sceNgs2SystemQueryBufferSize(const Ngs2SystemOption* option, Ngs2ContextBufferInfo* buffer_info) {
     if (buffer_info == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    CheckedSystemOption(option);
-    *buffer_info = {};
+    std::memset(buffer_info, 0, offsetof(Ngs2ContextBufferInfo, user_data));
+    Ngs2SystemOption checked{};
+    const int result = CheckSystemOption(option, checked);
+    if (result != SCE_NGS2_OK) return result;
     buffer_info->host_buffer_size = sizeof(Ngs2System);
     return SCE_NGS2_OK;
 }
 
 int APS5_VABI sceNgs2SystemCreate(const Ngs2SystemOption* option, const Ngs2ContextBufferInfo* buffer_info, uintptr_t* handle) {
+    if (buffer_info == nullptr || buffer_info->host_buffer == nullptr) return SCE_NGS2_ERROR_INVALID_BUFFER_INFO;
     if (handle == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    const auto checked = CheckedSystemOption(option);
-    if (buffer_info == nullptr) APS5_INVALID_ARG_EX;
+    Ngs2SystemOption checked{};
+    const int result = CheckSystemOption(option, checked);
+    if (result != SCE_NGS2_OK) return result;
     const Ngs2Lock lock;
     return CreateSystem(checked, *buffer_info, {}, handle);
 }
 
 int APS5_VABI sceNgs2SystemCreateWithAllocator(const Ngs2SystemOption* option, const Ngs2BufferAllocator* allocator, uintptr_t* handle) {
+    if (allocator == nullptr || allocator->alloc_handler == nullptr) return SCE_NGS2_ERROR_INVALID_BUFFER_ALLOCATOR;
     if (handle == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
-    const auto checked = CheckedSystemOption(option);
+    Ngs2SystemOption checked{};
+    const int result = CheckSystemOption(option, checked);
+    if (result != SCE_NGS2_OK) return result;
     const auto bufferInfo = Allocate(allocator, sizeof(Ngs2System));
     const Ngs2Lock lock;
     return CreateSystem(checked, bufferInfo, *allocator, handle);
@@ -319,7 +345,7 @@ int APS5_VABI sceNgs2SystemSetGrainSamples(uintptr_t system_handle, uint32_t num
     const Ngs2Lock lock;
     auto* system = Ngs2FindSystem(system_handle);
     if (system == nullptr) return SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE;
-    if (num_samples == 0 || num_samples > system->option.max_grain_samples) APS5_INVALID_ARG_EX;
+    if (num_samples == 0 || num_samples > system->option.max_grain_samples) return SCE_NGS2_ERROR_INVALID_NUM_GRAIN_SAMPLES;
     system->option.num_grain_samples = num_samples;
     return SCE_NGS2_OK;
 }
@@ -328,7 +354,7 @@ int APS5_VABI sceNgs2SystemSetSampleRate(uintptr_t system_handle, uint32_t sampl
     const Ngs2Lock lock;
     auto* system = Ngs2FindSystem(system_handle);
     if (system == nullptr) return SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE;
-    if (sample_rate == 0) APS5_INVALID_ARG_EX;
+    if (!ValidSampleRate(sample_rate)) return SCE_NGS2_ERROR_INVALID_SAMPLE_RATE;
     for (const auto* rack : system->racks) {
         for (const auto& voice : rack->voices) {
             for (const auto& filter : voice.filters) {
@@ -390,7 +416,16 @@ int APS5_VABI sceNgs2SystemRender(uintptr_t system_handle, const Ngs2RenderBuffe
         system = Ngs2FindSystem(system_handle);
     }
     if (system == nullptr) return SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE;
+    if (num_buffer_info > 31) return SCE_NGS2_ERROR_INVALID_NUM_RENDER_BUFFERS;
     if (buffer_info == nullptr || num_buffer_info == 0) APS5_INVALID_ARG_EX;
+    for (std::uint32_t i = 0; i < num_buffer_info; i++) {
+        const auto waveform_type = buffer_info[i].waveform_type;
+        if (waveform_type != SCE_NGS2_WAVEFORM_TYPE_PCM_I16L && waveform_type != SCE_NGS2_WAVEFORM_TYPE_PCM_I16B &&
+            waveform_type != SCE_NGS2_WAVEFORM_TYPE_PCM_F32L && waveform_type != SCE_NGS2_WAVEFORM_TYPE_PCM_F32B) {
+            return SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE;
+        }
+        if (buffer_info[i].buffer == nullptr) return SCE_NGS2_ERROR_INVALID_RENDER_BUFFER;
+    }
     SystemLockState* state = nullptr;
     {
         const auto self = std::this_thread::get_id();
@@ -422,7 +457,7 @@ int APS5_VABI sceNgs2SystemRender(uintptr_t system_handle, const Ngs2RenderBuffe
 }
 
 int APS5_VABI sceNgs2SystemResetOption(Ngs2SystemOption* option) {
-    if (option == nullptr) APS5_INVALID_ARG_EX;
+    if (option == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
     *option = DefaultSystemOption();
     return SCE_NGS2_OK;
 }
diff --git a/core/libs/prx/libSceNgs2.native/src/Voice.cpp b/core/libs/prx/libSceNgs2.native/src/Voice.cpp
index bc19ab0a0a..2b02256918 100644
--- a/core/libs/prx/libSceNgs2.native/src/Voice.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Voice.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include <algorithm>
 #include <cmath>
 #include <cstddef>
@@ -56,6 +57,7 @@ void Ngs2Voice::ResetSetup() {
     fbwLevel = 1.0f;
     lfeLevel = 1.0f;
     channels = 0;
+    inputChannels = 0;
     sampleRate = 0;
     waveformType = 0;
     atrac9 = {};
@@ -357,9 +359,11 @@ static void ApplyParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
             if (param.id == SCE_NGS2_REVERB_VOICE_PARAM_SETUP) {
                 const auto& setup = ParamAs<Ngs2ReverbVoiceSetupParam>(param);
                 if (setup.flags != 0) throw std::runtime_error("NGS2: reverb setup flags are not implemented");
-                if (setup.num_input_channels != setup.num_output_channels) throw std::runtime_error("NGS2: reverb channel conversion is not implemented");
-                if (setup.num_output_channels != 1 && setup.num_output_channels != 2 && setup.num_output_channels != 6 && setup.num_output_channels != 8) APS5_INVALID_ARG_EX;
+                for (const auto count : {setup.num_input_channels, setup.num_output_channels}) {
+                    if ((count != 1 && count != 2 && count != 6 && count != 8) || count > voice.rack->maxChannels) APS5_INVALID_ARG_EX;
+                }
                 SetupMixer(voice, setup.num_output_channels);
+                voice.inputChannels = setup.num_input_channels;
                 Ngs2SetupReverb(voice);
                 return;
             }
@@ -369,18 +373,19 @@ static void ApplyParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
             }
             break;
         case SCE_NGS2_RACK_ID_MASTERING:
-            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_SETUP) {
+        case SCE_NGS2_RACK_ID_CUSTOM_MASTERING:
+            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_SETUP || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP) {
                 SetupMixer(voice, ParamAs<Ngs2MasteringVoiceSetupParam>(param).num_io_channels);
                 return;
             }
-            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN) {
+            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN) {
                 const auto& gain = ParamAs<Ngs2MasteringVoiceGainParam>(param);
                 if (!std::isfinite(gain.fbw_level) || !std::isfinite(gain.lfe_level)) APS5_INVALID_ARG_EX;
                 voice.fbwLevel = gain.fbw_level;
                 voice.lfeLevel = gain.lfe_level;
                 return;
             }
-            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT) {
+            if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT || param.id == SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT) {
                 voice.outputId = ParamAs<Ngs2MasteringVoiceOutputParam>(param).output_id;
                 return;
             }
@@ -472,6 +477,12 @@ int APS5_VABI sceNgs2VoiceGetState(uintptr_t voice_handle, Ngs2VoiceState* state
             sampler.num_decoded_samples = voice.decodedSamples;
             return SCE_NGS2_OK;
         }
+        case SCE_NGS2_RACK_ID_CUSTOM_MASTERING: {
+            if (state_size != sizeof(Ngs2VoiceState)) return SCE_NGS2_ERROR_INVALID_OUT_SIZE;
+            *state = {};
+            state->state_flags = voice.stateFlags;
+            return SCE_NGS2_OK;
+        }
         default: throw std::runtime_error("NGS2: voice state of rack " + Ngs2Hex(voice.rack->rackId) + " is not implemented");
     }
 }
@@ -526,6 +537,20 @@ int APS5_VABI sceNgs2VoiceGetOwner(uintptr_t voice_handle, uintptr_t* owner_rack
     return SCE_NGS2_OK;
 }
 
+int APS5_VABI sceNgs2VoiceGetMatrixInfo(uintptr_t voice_handle, uint32_t matrix_id, Ngs2VoiceMatrixInfo* info, size_t info_size) {
+    if (info == nullptr) return SCE_NGS2_ERROR_INVALID_OUT_ADDRESS;
+    if (info_size != sizeof(Ngs2VoiceMatrixInfo)) return SCE_NGS2_ERROR_INVALID_OUT_SIZE;
+    const Ngs2Lock lock;
+    const auto* found = Ngs2FindVoice(voice_handle);
+    if (found == nullptr) return SCE_NGS2_ERROR_INVALID_VOICE_HANDLE;
+    if (matrix_id >= found->matrices.size()) APS5_INVALID_ARG_EX;
+    const auto& levels = found->matrices[matrix_id];
+    *info = {};
+    info->num_levels = static_cast<std::uint32_t>(levels.size());
+    std::copy(levels.begin(), levels.end(), info->levels);
+    return SCE_NGS2_OK;
+}
+
 int APS5_VABI sceNgs2PanInit(Ngs2PanWork* work, const float* speaker_angles, float unit_angle, uint32_t num_speakers) {
     return Ngs2PanInit(work, speaker_angles, unit_angle, num_speakers);
 }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp
index eed5eaf1f1..1c72ffa8d4 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Atrac9.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include "libatrac9.h"
@@ -6,8 +7,10 @@
 #include <cstdint>
 #include <cmath>
 #include <cstring>
+#include <iterator>
 #include <random>
 #include <stdexcept>
+#include <tuple>
 #include <utility>
 #include <vector>
 
@@ -174,6 +177,15 @@ static void TestParse() {
     Require(info.num_audio_unit_per_frame == 4 && info.audio_frame_size == SuperframeBytes && info.num_audio_frame_samples == SuperframeSamples);
     Require(info.num_blocks == 1 && info.block[0].data_offset == info.data_offset && info.block[0].data_size == SuperframeBytes);
     Require(info.block[0].num_skip_samples == 256 && info.block[0].num_samples == 900);
+    for (const std::uint32_t factDelay : {0u, 1u, 900u, 0xffffffffu}) {
+        auto other = file;
+        constexpr char factTag[] = {'f', 'a', 'c', 't'};
+        const auto fact = static_cast<std::size_t>(std::search(other.begin(), other.end(), std::begin(factTag), std::end(factTag)) - other.begin());
+        std::memcpy(other.data() + fact + 12, &factDelay, sizeof(factDelay));
+        Ngs2WaveformInfo parsed{};
+        Require(sceNgs2ParseWaveformData(other.data(), other.size(), &parsed) == SCE_NGS2_OK);
+        Require(parsed.num_delay_samples == 256 && parsed.block[0].num_skip_samples == 256 && parsed.num_samples == 900);
+    }
 
     Require(sceNgs2ParseWaveformData(file.data(), 11, &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA);
     Require(sceNgs2ParseWaveformData(Superframe, SuperframeBytes, &info) == SCE_NGS2_ERROR_UNKNOWN_WAVEFORM_FORMAT);
@@ -181,18 +193,73 @@ static void TestParse() {
     Require(sceNgs2ParseWaveformData(wrongRate.data(), wrongRate.size(), &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
 }
 
+static void RequireAtrac9Block(std::uint32_t config, std::uint32_t pos, std::uint32_t count, std::uint64_t offset, std::uint64_t size, std::uint32_t skip) {
+    const Ngs2WaveformFormat format{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 48000, config, 0, 0};
+    Ngs2WaveformBlock block;
+    std::memset(&block, 0xab, sizeof(block));
+    Require(sceNgs2CalcWaveformBlock(&format, pos, count, &block) == SCE_NGS2_OK);
+    Require(block.data_offset == offset && block.data_size == size && block.num_skip_samples == skip && block.num_samples == count);
+    Require(block.num_repeats == 0 && block.reserved == 0 && block.user_data == 0);
+}
+
 static void TestCalcBlock() {
     const Ngs2WaveformFormat format{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 48000, Config, 0, 0};
-    Ngs2WaveformBlock block{};
     Require(sceNgs2CalcWaveformBlock(&format, 1500, 600, nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
-    Require(sceNgs2CalcWaveformBlock(&format, 1500, 600, &block) == SCE_NGS2_OK);
-    Require(block.data_offset == SuperframeBytes && block.data_size == 2 * SuperframeBytes && block.num_skip_samples == 476 && block.num_samples == 600);
-    Require(sceNgs2CalcWaveformBlock(&format, 1500, 0, &block) == SCE_NGS2_OK);
-    Require(block.data_offset == SuperframeBytes && block.data_size == 0 && block.num_skip_samples == 0 && block.num_samples == 0);
-    const Ngs2WaveformFormat stereo{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 2, 48000, Config, 0, 0};
-    Require(sceNgs2CalcWaveformBlock(&stereo, 0, 1, &block) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
-    const Ngs2WaveformFormat silent{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 0, 48000, Config, 0, 0};
-    Require(sceNgs2CalcWaveformBlock(&silent, 0, 1, &block) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
+    RequireAtrac9Block(Config, 0, 768, 0, SuperframeBytes, 256);
+    RequireAtrac9Block(Config, 0, 769, 0, 2 * SuperframeBytes, 256);
+    RequireAtrac9Block(Config, 1500, 600, SuperframeBytes, 2 * SuperframeBytes, 732);
+    RequireAtrac9Block(Config, 1500, 0, SuperframeBytes, SuperframeBytes, 732);
+    RequireAtrac9Block(Config, 4294967195u, 1000, 1073741568u, 3221226240u, 1179);
+    RequireAtrac9Block(0xFE7007E0, 300, 10, 64, 128, 300);
+    RequireAtrac9Block(0xFE4007F0, 600, 100, SuperframeBytes, SuperframeBytes, 216);
+    RequireAtrac9Block(0xFE1007F0, 0, 1, 0, SuperframeBytes, 64);
+    Ngs2WaveformBlock block{};
+    const Ngs2WaveformFormat stereo{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 2, 44100, Config, 0, 0};
+    Require(sceNgs2CalcWaveformBlock(&stereo, 0, 1, &block) == SCE_NGS2_OK && block.data_size == SuperframeBytes && block.num_skip_samples == 256);
+    const Ngs2WaveformFormat silent{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 0, 0, Config, 0, 0};
+    Require(sceNgs2CalcWaveformBlock(&silent, 0, 1, &block) == SCE_NGS2_OK && block.data_size == SuperframeBytes && block.num_skip_samples == 256);
+    for (const std::uint32_t rateIndex : {0u, 2u, 3u, 5u, 6u, 8u, 15u}) {
+        const Ngs2WaveformFormat unknown{SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 48000, (Config & ~0x00F00000u) | rateIndex << 20, 0, 0};
+        bool threw = false;
+        try { sceNgs2CalcWaveformBlock(&unknown, 0, 1, &block); } catch (const std::runtime_error&) { threw = true; }
+        Require(threw);
+    }
+}
+
+static void TestFrameInfo() {
+    const Ngs2WaveformFormat supported[] = {
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 48000, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 48000, Config, 7, 9},
+    };
+    const Ngs2WaveformFormat rejected[] = {
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 2, 48000, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 0, 48000, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 9, 48000, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 44100, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 0, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 192001, Config, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_ATRAC9, 1, 48000, 0, 0, 0},
+    };
+    for (const auto& format : supported) {
+        Ngs2WaveformBlock block{};
+        Require(sceNgs2CalcWaveformBlock(&format, 0, SuperframeSamples, &block) == SCE_NGS2_OK && block.data_size == 2 * SuperframeBytes);
+        std::uint32_t values[4] = {0xa1, 0xa2, 0xa3, 0xa4};
+        Require(sceNgs2GetWaveformFrameInfo(&format, &values[0], &values[1], &values[2], &values[3]) == SCE_NGS2_OK);
+        Require(values[0] == SuperframeBytes && values[1] == SuperframeSamples && values[2] == 4 && values[3] == SuperframeSamples / 4);
+    }
+    for (const auto& format : rejected) {
+        std::uint32_t values[4] = {0xa1, 0xa2, 0xa3, 0xa4};
+        Require(sceNgs2GetWaveformFrameInfo(&format, &values[0], &values[1], &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
+        Require(values[0] == 0xa1 && values[1] == 0xa2 && values[2] == 0xa3 && values[3] == 0xa4);
+    }
+    std::uint32_t values[4] = {0xa1, 0xa2, 0xa3, 0xa4};
+    Require(sceNgs2GetWaveformFrameInfo(nullptr, &values[0], &values[1], &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
+    Require(sceNgs2GetWaveformFrameInfo(&supported[0], nullptr, &values[1], &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(&supported[0], &values[0], nullptr, &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(&supported[0], &values[0], &values[1], nullptr, &values[3]) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(&supported[0], &values[0], &values[1], &values[2], nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(nullptr, nullptr, nullptr, nullptr, nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(values[0] == 0xa1 && values[1] == 0xa2 && values[2] == 0xa3 && values[3] == 0xa4);
 }
 
 static void RequirePcmBlock(std::uint32_t type, std::uint32_t channels, std::uint32_t pos, std::uint32_t count, std::uint64_t offset, std::uint64_t size) {
@@ -229,6 +296,26 @@ static void TestCalcPcmBlock() {
     Require(sceNgs2CalcWaveformBlock(nullptr, 0, 1, &block) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT && block.data_size == 0 && block.num_samples == 0);
 }
 
+static void RequireVagBlock(std::uint32_t channels, std::uint32_t pos, std::uint32_t count, std::uint64_t offset, std::uint64_t size, std::uint32_t samples) {
+    const Ngs2WaveformFormat format{0x1c, channels, 48000, 0, 0, 0};
+    Ngs2WaveformBlock block;
+    std::memset(&block, 0xab, sizeof(block));
+    Require(sceNgs2CalcWaveformBlock(&format, pos, count, &block) == SCE_NGS2_OK);
+    Require(block.data_offset == offset && block.data_size == size && block.num_samples == samples);
+    Require(block.num_repeats == 0 && block.num_skip_samples == 0 && block.reserved == 0 && block.user_data == 0);
+}
+
+static void TestCalcVagBlock() {
+    RequireVagBlock(1, 0, 28, 0, 16, 28);
+    RequireVagBlock(1, 27, 2, 0, 32, 56);
+    RequireVagBlock(1, 28, 28, 16, 16, 28);
+    RequireVagBlock(2, 30, 1, 32, 32, 28);
+    RequireVagBlock(6, 56, 57, 192, 288, 84);
+    RequireVagBlock(1, 0, 0, 0, 0, 0);
+    RequireVagBlock(1, 5, 0, 0, 16, 28);
+    RequireVagBlock(0, 100, 50, 0, 0, 84);
+}
+
 static void Set32(std::vector<std::uint8_t>& bytes, std::size_t offset, std::uint32_t value) {
     for (int i = 0; i < 4; ++i) bytes[offset + i] = static_cast<std::uint8_t>(value >> (i * 8));
 }
@@ -265,7 +352,7 @@ static void TestParseLoops() {
             Require(sceNgs2ParseWaveformData(file.data(), file.size(), &info) == SCE_NGS2_OK);
             Require(info.loop_begin_position == begin && info.loop_end_position == end && info.num_samples == samples);
             Require(info.num_blocks == 1 + (begin != 0) + (end != samples));
-            Require(info.block[begin != 0].num_repeats == 1);
+            Require(info.block[begin != 0].num_repeats == UINT32_MAX);
             const auto system = CreateSystem();
             const auto voice = Voice(CreateRack(system, SCE_NGS2_RACK_ID_SAMPLER));
             Control(voice, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{{}, info.format});
@@ -273,12 +360,12 @@ static void TestParseLoops() {
                 Ngs2SamplerVoiceWaveformBlocksParam{{}, file.data(), 0, info.num_blocks, info.block});
             Patch(voice, Mastering(system, 1));
             Event(voice, SCE_NGS2_VOICE_EVENT_PLAY);
-            const auto rendered = Render(system, samples + end - begin + Grain);
+            const auto loop = end - begin;
+            const auto rendered = Render(system, end + 2 * loop);
             for (std::uint32_t i = 0; i < rendered.size(); ++i) {
-                const auto index = i < end ? i : i - (end - begin);
-                Require(rendered[i] == (i < samples + end - begin ? reference[256 + index] : 0.0f));
+                const auto index = i < end ? i : begin + (i - end) % loop;
+                Require(rendered[i] == reference[256 + index]);
             }
-            Require(Flags(voice) == 0);
             Require(sceNgs2SystemDestroy(system, nullptr) == 0);
         }
     }
@@ -306,28 +393,66 @@ static void TestParseLoops() {
     Require(sceNgs2SystemDestroy(system, nullptr) == 0);
 }
 
+static bool ParseThrows(const std::vector<std::uint8_t>& file) {
+    Ngs2WaveformInfo info{};
+    try {
+        sceNgs2ParseWaveformData(file.data(), file.size(), &info);
+
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
+static std::vector<std::uint8_t> ShortSampler(std::vector<std::uint8_t> file, std::uint32_t size) {
+    file.erase(file.begin() + 100 + size, file.begin() + 160);
+    Set32(file, 96, size);
+    Set32(file, 4, static_cast<std::uint32_t>(file.size() - 8));
+    return file;
+}
+
 static void TestMalformedLoops() {
     const auto original = LoopedFile(100, 700, 0);
-    Ngs2WaveformInfo info{};
-    for (const auto [offset, value] : {std::pair<std::size_t, std::uint32_t>{128, 2}, {144, 0}, {148, 255}, {148, 5000}}) {
+    Ngs2WaveformInfo expected{};
+    Require(sceNgs2ParseWaveformData(original.data(), original.size(), &expected) == SCE_NGS2_OK && expected.num_blocks == 3);
+    for (const auto [offset, value] : {std::pair<std::size_t, std::uint32_t>{128, 2}, {140, 1}, {140, 2}, {152, 0x80000000u}, {156, 5}}) {
         auto file = original;
         Set32(file, offset, value);
-        Require(sceNgs2ParseWaveformData(file.data(), file.size(), &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA);
+        Ngs2WaveformInfo info{};
+        Require(sceNgs2ParseWaveformData(file.data(), file.size(), &info) == SCE_NGS2_OK);
+        Require(info.loop_begin_position == 100 && info.loop_end_position == 700 && info.num_blocks == 3);
+        for (std::uint32_t block = 0; block < 3; ++block) Require(std::memcmp(&info.block[block], &expected.block[block], sizeof(Ngs2WaveformBlock)) == 0);
     }
-    for (const auto offset : {140u, 152u}) {
+    for (const auto [start, last, begin, end] : {std::tuple<std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t>{256, 255, 0, 0}, {356, 255, 100, 0}, {956, 955, 700, 700}, {956, 700, 700, 445}}) {
         auto file = original;
-        Set32(file, offset, 1);
-        bool rejected = false;
-        try { sceNgs2ParseWaveformData(file.data(), file.size(), &info); } catch (const std::runtime_error&) { rejected = true; }
-        Require(rejected);
+        Set32(file, 144, start);
+        Set32(file, 148, last);
+        Ngs2WaveformInfo info{};
+        Require(sceNgs2ParseWaveformData(file.data(), file.size(), &info) == SCE_NGS2_OK);
+        Require(info.loop_begin_position == begin && info.loop_end_position == end && info.num_blocks == 1);
+        Require(info.block[0].num_repeats == 0 && info.block[0].num_samples == info.num_samples);
     }
+    for (const std::uint32_t last : {4096u, 5000u, 0xffffffffu}) {
+        auto file = original;
+        Set32(file, 148, last);
+        Require(ParseThrows(file));
+    }
+    for (const std::uint32_t start : {0u, 255u}) {
+        auto file = original;
+        Set32(file, 144, start);
+        Require(ParseThrows(file));
+    }
+    Ngs2WaveformInfo info{};
+    auto pastData = original;
+    Set32(pastData, 80, 4 * SuperframeSamples - 255);
+    Require(ParseThrows(pastData));
+    Set32(pastData, 80, 4 * SuperframeSamples - 256);
+    Require(sceNgs2ParseWaveformData(pastData.data(), pastData.size(), &info) == SCE_NGS2_OK && info.num_blocks == 3);
     for (std::size_t size = 92; size < 168; ++size)
         Require(sceNgs2ParseWaveformData(original.data(), size, &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA);
-    auto shortSampler = original;
-    shortSampler.erase(shortSampler.begin() + 100 + 35, shortSampler.begin() + 160);
-    Set32(shortSampler, 96, 35);
-    Set32(shortSampler, 4, static_cast<std::uint32_t>(shortSampler.size() - 8));
-    Require(sceNgs2ParseWaveformData(shortSampler.data(), shortSampler.size(), &info) == SCE_NGS2_ERROR_INVALID_WAVEFORM_DATA);
+    for (const std::uint32_t size : {28u, 36u, 50u}) Require(ParseThrows(ShortSampler(original, size)));
+    const auto minimal = ShortSampler(original, 52);
+    Require(sceNgs2ParseWaveformData(minimal.data(), minimal.size(), &info) == SCE_NGS2_OK && info.num_blocks == 3);
 }
 
 static std::uint8_t* SuperframeBeforeGuardPage() {
@@ -538,7 +663,9 @@ int main() {
     TestParseLoops();
     TestMalformedLoops();
     TestCalcBlock();
+    TestFrameInfo();
     TestCalcPcmBlock();
+    TestCalcVagBlock();
     TestCorruptSuperframeAtPageEnd();
     TestStreamPartitions();
     TestRefill(reference);
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp
index 379c277110..47a189ed42 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Custom.cpp
@@ -1,8 +1,11 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <cstdint>
 #include <cstring>
+#include <limits>
 #include <stdexcept>
+#include <string>
 #include <vector>
 
 struct Calls {
@@ -84,6 +87,7 @@ static bool CreateThrows(const Ngs2CustomSubmixerRackOption& option) {
     Ngs2ContextBufferInfo query{};
     try {
         sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &option.custom_rack_option.rack_option, &query);
+
     } catch (const TException&) {
         return true;
     }
@@ -95,17 +99,34 @@ static bool CreateSamplerThrows(const Ngs2CustomSamplerRackOption& option) {
     Ngs2ContextBufferInfo query{};
     try {
         sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &option.custom_rack_option.rack_option, &query);
+
     } catch (const TException&) {
         return true;
     }
     return false;
 }
 
+static Ngs2CustomMasteringRackOption MasteringRackOption(std::uint32_t channels, std::uint32_t inputs) {
+    Ngs2CustomMasteringRackOption option{};
+    auto& common = option.custom_rack_option.rack_option;
+    common.size = sizeof(option);
+    common.max_grain_samples = 512;
+    common.max_voices = 2;
+    common.max_matrices = 1;
+    common.max_ports = 1;
+    option.custom_rack_option.num_buffers = 1;
+    option.custom_rack_option.num_modules = 0;
+    option.max_channels = channels;
+    option.max_inputs = inputs;
+    return option;
+}
+
 template <typename TException, typename TParam>
 static bool ControlThrows(uintptr_t voice, std::uint32_t id, TParam param) {
     param.header = {static_cast<std::uint16_t>(sizeof(TParam)), 0, id};
     try {
         sceNgs2VoiceControl(voice, &param.header);
+
     } catch (const TException&) {
         return true;
     }
@@ -221,6 +242,7 @@ static void TestRackOptions() {
     bool failed = false;
     try {
         sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, nullptr, &query);
+
     } catch (const std::runtime_error&) {
         failed = true;
     }
@@ -355,6 +377,179 @@ static void TestCustomFilter() {
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
+struct ModuleOptionWords {
+    std::uint32_t size;
+    std::uint32_t words[15];
+};
+
+static int allocCalls = 0;
+
+static std::int32_t APS5_VABI CountAlloc(Ngs2ContextBufferInfo*) {
+    allocCalls++;
+    return SCE_NGS2_OK;
+}
+
+static std::int32_t APS5_VABI CountFree(Ngs2ContextBufferInfo*) {
+    return SCE_NGS2_OK;
+}
+
+static Ngs2CustomSubmixerRackOption BuiltInRackOption(const Ngs2CustomUserFx2ModuleOption& userFx2, std::uint32_t moduleId,
+                                                      const ModuleOptionWords* moduleOption, std::uint32_t stateSize) {
+    auto option = RackOption(&userFx2, 1);
+    auto& module = option.custom_rack_option.module[0];
+    module.module_id = moduleId;
+    module.option = reinterpret_cast<const Ngs2CustomModuleOption*>(moduleOption);
+    module.state_size = stateSize;
+    return option;
+}
+
+static void TestCustomRackChecks() {
+    calls = {};
+    const auto system = CreateSystem();
+    const auto userFx2 = Module(Gain);
+    const auto good = RackOption(&userFx2, 1);
+    Ngs2ContextBufferInfo query{};
+    Require(sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &good.custom_rack_option.rack_option, &query) == SCE_NGS2_OK);
+    const auto info = Buffer(query);
+    const auto create = [&](const Ngs2CustomSubmixerRackOption& option) {
+        uintptr_t rack = 0;
+        const int result = sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &option.custom_rack_option.rack_option, &info, &rack);
+        Require(rack == 0);
+        return result;
+    };
+
+    auto option = good;
+    option.custom_rack_option.num_buffers = 0;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_NUM_BUFFERS);
+    Require(CreateThrows<std::invalid_argument>(option));
+    option.custom_rack_option.num_buffers = SCE_NGS2_CUSTOM_MAX_BUFFERS + 1;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_NUM_BUFFERS);
+    option = good;
+    option.max_inputs = 2;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_NUM_BUFFERS);
+    option.custom_rack_option.num_buffers = 2;
+    Require(CreateThrows<std::runtime_error>(option));
+    option.custom_rack_option.num_buffers = SCE_NGS2_CUSTOM_MAX_BUFFERS;
+    option.custom_rack_option.module[0].dest_buffer_id = SCE_NGS2_CUSTOM_MAX_BUFFERS - 1;
+    Require(CreateThrows<std::runtime_error>(option));
+    option.custom_rack_option.module[0].dest_buffer_id = SCE_NGS2_CUSTOM_MAX_BUFFERS;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_BUFFER_INDEX);
+    option = good;
+    option.max_inputs = 0;
+    Require(CreateThrows<std::runtime_error>(option));
+    option.max_inputs = SCE_NGS2_CUSTOM_SUBMIXER_MAX_INPUTS + 1;
+    Require(CreateThrows<std::runtime_error>(option));
+
+    option = good;
+    option.custom_rack_option.module[0].source_buffer_id = 1;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_BUFFER_INDEX);
+    option = good;
+    option.custom_rack_option.module[0].extra_buffer_id = 1;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_BUFFER_INDEX);
+
+    option = good;
+    option.max_channels = SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS + 1;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_NUM_CHANNELS);
+    option.max_channels = 16;
+    Require(CreateThrows<std::runtime_error>(option));
+    option.max_channels = SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS;
+    Require(CreateThrows<std::runtime_error>(option));
+
+    Require(create(BuiltInRackOption(userFx2, 0x19, nullptr, 4)) == SCE_NGS2_ERROR_INVALID_STATE_SIZE);
+    Require(!CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_GAIN, nullptr, 0)));
+    Require(create(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_GAIN, nullptr, 4)) == SCE_NGS2_ERROR_INVALID_STATE_SIZE);
+    const ModuleOptionWords gainOption{sizeof(Ngs2CustomModuleOption), {}};
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_GAIN, &gainOption, 0)));
+
+    const ModuleOptionWords reverb{SCE_NGS2_CUSTOM_REVERB_OPTION_SIZE, {1}};
+    const ModuleOptionWords reverbOff{SCE_NGS2_CUSTOM_REVERB_OPTION_SIZE, {0}};
+    const ModuleOptionWords reverbSize{16, {1}};
+    const ModuleOptionWords reverbWord{SCE_NGS2_CUSTOM_REVERB_OPTION_SIZE, {2}};
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_REVERB, &reverb, 0)));
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_REVERB, &reverbOff, 0)));
+    Require(create(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_REVERB, &reverbSize, 0)) == SCE_NGS2_ERROR_INVALID_OPTION_SIZE);
+    Require(create(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_REVERB, &reverbWord, 0)) == SCE_NGS2_ERROR_INVALID_REVERB_OPTION);
+    Require(create(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_REVERB, &reverb, 4)) == SCE_NGS2_ERROR_INVALID_STATE_SIZE);
+
+    const ModuleOptionWords pitchShift{SCE_NGS2_CUSTOM_PITCH_SHIFT_OPTION_SIZE, {0}};
+    const ModuleOptionWords pitchShiftWord{SCE_NGS2_CUSTOM_PITCH_SHIFT_OPTION_SIZE, {1}};
+    const auto pitchShiftState = SCE_NGS2_CUSTOM_PITCH_SHIFT_STATE_SIZE;
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT, &pitchShift, pitchShiftState)));
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT, &pitchShift, 0)));
+    Require(create(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT, &pitchShift, 4)) == SCE_NGS2_ERROR_INVALID_STATE_SIZE);
+    Require(create(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT, &pitchShiftWord, pitchShiftState)) == SCE_NGS2_ERROR_INVALID_PITCH_SHIFT_OPTION);
+
+    const ModuleOptionWords convolution{64, {}};
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_CONVOLUTION, &convolution, 64)));
+    option = BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_CONVOLUTION, &convolution, 64);
+    option.custom_rack_option.module[0].dest_buffer_id = 1;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_BUFFER_INDEX);
+
+    option = BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_GAIN, nullptr, 0);
+    option.custom_rack_option.num_modules = 2;
+    option.custom_rack_option.module[1] = good.custom_rack_option.module[0];
+    option.custom_rack_option.module[1].dest_buffer_id = 1;
+    Require(create(option) == SCE_NGS2_ERROR_INVALID_BUFFER_INDEX);
+    Require(CreateThrows<std::runtime_error>(BuiltInRackOption(userFx2, 0x1d, nullptr, 0)));
+
+    option = good;
+    option.custom_rack_option.num_buffers = 0;
+    bool rejected = false;
+    uintptr_t rack = 0;
+    try {
+        sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &option.custom_rack_option.rack_option, nullptr, &rack);
+
+    } catch (const std::invalid_argument&) {
+        rejected = true;
+    }
+    Require(rejected);
+    const Ngs2BufferAllocator allocator{CountAlloc, CountFree, 0};
+    Require(sceNgs2RackCreateWithAllocator(system, SCE_NGS2_RACK_ID_CUSTOM_SUBMIXER, &option.custom_rack_option.rack_option, &allocator, &rack) == SCE_NGS2_ERROR_INVALID_NUM_BUFFERS);
+    Require(rack == 0 && allocCalls == 0 && calls.setupVoices.empty());
+
+    Ngs2CustomSamplerRackOption sampler{};
+    sampler.custom_rack_option.rack_option.size = sizeof(sampler);
+    sampler.custom_rack_option.rack_option.max_grain_samples = 512;
+    sampler.custom_rack_option.rack_option.max_voices = 1;
+    sampler.custom_rack_option.num_modules = 1;
+    sampler.custom_rack_option.module[0].module_id = SCE_NGS2_CUSTOM_MODULE_ID_FILTER;
+    sampler.max_channel_works = 1;
+    Require(sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &info, &rack) == SCE_NGS2_ERROR_INVALID_NUM_BUFFERS);
+    sampler.custom_rack_option.num_buffers = 1;
+    sampler.custom_rack_option.module[0].extra_buffer_id = 1;
+    Require(sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &info, &rack) == SCE_NGS2_ERROR_INVALID_BUFFER_INDEX);
+    Require(rack == 0);
+    sampler.custom_rack_option.module[0].extra_buffer_id = 0;
+    Require(sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &info, &rack) == SCE_NGS2_OK);
+    sampler.custom_rack_option.module[0].module_id = SCE_NGS2_CUSTOM_MODULE_ID_GAIN;
+    Require(CreateSamplerThrows<std::runtime_error>(sampler));
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    for (const auto count : {1u, 2u, 24u}) {
+        sampler.custom_rack_option.num_modules = count;
+        for (std::uint32_t index = 0; index < count; ++index) {
+            sampler.custom_rack_option.module[index].module_id = SCE_NGS2_CUSTOM_MODULE_ID_FILTER;
+        }
+        sampler.custom_rack_option.module[count - 1].module_id = 0x19;
+        Require(CreateSamplerThrows<std::runtime_error>(sampler));
+        for (const bool useAllocator : {false, true}) {
+            rack = 0;
+            rejected = false;
+            try {
+                if (useAllocator) {
+                    sceNgs2RackCreateWithAllocator(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &allocator, &rack);
+
+                } else {
+                    sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_SAMPLER, &sampler.custom_rack_option.rack_option, &info, &rack);
+
+                }
+            } catch (const std::runtime_error&) {
+                rejected = true;
+            }
+            Require(rejected && rack == 0 && allocCalls == 0);
+        }
+    }
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
 
 struct LegacyUserFxState {
     std::uint32_t calls = 0;
@@ -365,6 +560,8 @@ struct LegacyUserFxState {
 };
 
 static std::int32_t APS5_VABI ProcessLegacy(Ngs2UserFxProcessContext* context) {
+    Require(context->user_data1 == 123 && context->user_data2 == 456);
+    Require(context->num_channels == 2 && context->num_grain_samples == Grain && context->sample_rate == 48000);
     auto& state = *reinterpret_cast<LegacyUserFxState*>(context->user_data0);
     state.calls++;
     state.flags = context->flags;
@@ -376,7 +573,7 @@ static std::int32_t APS5_VABI ProcessLegacy(Ngs2UserFxProcessContext* context) {
     return SCE_NGS2_OK;
 }
 
-static Ngs2CustomSubmixerRackOption LegacyRackOption(const Ngs2CustomModuleOption* option) {
+static Ngs2CustomSubmixerRackOption LegacyRackOption(const Ngs2CustomModuleOption* option, std::uint32_t moduleIndex) {
     Ngs2CustomSubmixerRackOption rack{};
     auto& common = rack.custom_rack_option.rack_option;
     common.size = sizeof(rack);
@@ -385,27 +582,28 @@ static Ngs2CustomSubmixerRackOption LegacyRackOption(const Ngs2CustomModuleOptio
     common.max_matrices = 1;
     common.max_ports = 1;
     rack.custom_rack_option.num_buffers = 1;
-    rack.custom_rack_option.num_modules = 1;
-    rack.custom_rack_option.module[0].option = option;
-    rack.custom_rack_option.module[0].module_id = SCE_NGS2_CUSTOM_MODULE_ID_USER_FX;
-    rack.custom_rack_option.module[0].state_size = 16;
+    rack.custom_rack_option.num_modules = moduleIndex + 1;
+    for (std::uint32_t index = 0; index <= moduleIndex; ++index) {
+        rack.custom_rack_option.module[index].option = option;
+        rack.custom_rack_option.module[index].module_id = 0x19;
+    }
     rack.max_channels = 2;
     rack.max_inputs = 1;
     return rack;
 }
 
-static void TestCustomLegacyUserFx() {
+static void TestCustomLegacyUserFx(std::uint32_t moduleIndex) {
     const auto system = CreateSystem();
     const auto master = Mastering(system, 2);
     const Ngs2CustomModuleOption header{sizeof(Ngs2CustomModuleOption)};
-    const auto rack = CustomRack(system, LegacyRackOption(&header));
+    const auto rack = CustomRack(system, LegacyRackOption(nullptr, moduleIndex));
     const auto custom = Voice(rack);
     Control(custom, SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP, Ngs2CustomSubmixerVoiceSetupParam{{}, 2, 2, 0, 0});
     Patch(custom, master);
     Event(custom, SCE_NGS2_VOICE_EVENT_PLAY);
 
     LegacyUserFxState state{};
-    Control(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX | 0,
+    Control(custom, 0x40001900 | moduleIndex,
             Ngs2CustomVoiceUserFxParam{{}, ProcessLegacy, reinterpret_cast<std::uintptr_t>(&state), 123, 456});
 
     auto out = Render(system);
@@ -421,20 +619,11 @@ static void TestCustomLegacyUserFx() {
         std::uint8_t dummy[10];
     };
     Require(ControlThrows<std::invalid_argument>(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX | 0, BadSizeParam{}));
-    Require(ControlThrows<std::invalid_argument>(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX | 2, Ngs2CustomVoiceUserFxParam{{}, ProcessLegacy, 0, 0, 0}));
+    Require(ControlThrows<std::invalid_argument>(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX | 31, Ngs2CustomVoiceUserFxParam{{}, ProcessLegacy, 0, 0, 0}));
 
-    Ngs2CustomModuleOption badSize{2};
-    Require(CreateThrows<std::invalid_argument>(LegacyRackOption(&badSize)));
-
-    struct ExtendedOption {
-        std::uint32_t size = 20;
-        std::uint32_t reserved = 0;
-        std::uint32_t channels = 4;
-        float param0 = 1000.0f;
-        float param1 = 0.0f;
-    } extendedOption;
-    const auto rackExtended = CustomRack(system, LegacyRackOption(reinterpret_cast<const Ngs2CustomModuleOption*>(&extendedOption)));
-    Require(sceNgs2RackDestroy(rackExtended, nullptr) == SCE_NGS2_OK);
+    Require(CreateThrows<std::runtime_error>(LegacyRackOption(&header, moduleIndex)));
+    Require(ControlThrows<std::runtime_error>(custom, 0x40001d00,
+                Ngs2CustomVoiceUserFxParam{{}, ProcessLegacy, reinterpret_cast<std::uintptr_t>(&state), 123, 456}));
 
     state.result = -1;
     bool failed = false;
@@ -448,7 +637,7 @@ static void TestCustomLegacyUserFx() {
 
     Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
 
-    const auto rackNullOpt = CustomRack(system, LegacyRackOption(nullptr));
+    const auto rackNullOpt = CustomRack(system, LegacyRackOption(nullptr, moduleIndex));
     const auto voiceNullOpt = Voice(rackNullOpt);
     Control(voiceNullOpt, SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP, Ngs2CustomSubmixerVoiceSetupParam{{}, 2, 2, 0, 0});
     Patch(voiceNullOpt, master);
@@ -457,7 +646,7 @@ static void TestCustomLegacyUserFx() {
     LegacyUserFxState state2{};
     state2.val0 = 0.125f;
     state2.val1 = 0.75f;
-    Control(voiceNullOpt, SCE_NGS2_CUSTOM_VOICE_PARAM_USER_FX | 0,
+    Control(voiceNullOpt, 0x40001900 | moduleIndex,
             Ngs2CustomVoiceUserFxParam{{}, ProcessLegacy, reinterpret_cast<std::uintptr_t>(&state2), 123, 456});
     out = Render(system);
     Require(state2.calls == 1 && state2.flags == 1);
@@ -467,11 +656,259 @@ static void TestCustomLegacyUserFx() {
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
+struct DelayOption {
+    std::uint32_t size = 20;
+    std::uint32_t type = 0;
+    std::uint32_t maxTaps = 4;
+    float maxLength = 1000.0f;
+    std::uint32_t reserved = 0;
+};
+
+static Ngs2CustomSubmixerRackOption DelayRackOption(const DelayOption& delay, std::uint32_t count) {
+    auto option = LegacyRackOption(nullptr, count - 1);
+    option.custom_rack_option.rack_option.max_ports = 8;
+    for (std::uint32_t index = 0; index < count; ++index) {
+        option.custom_rack_option.module[index].module_id = 0x1d;
+        option.custom_rack_option.module[index].option = reinterpret_cast<const Ngs2CustomModuleOption*>(&delay);
+    }
+    return option;
+}
+
+static void TestCustomDelay(std::uint32_t count, const DelayOption& delay) {
+    const auto system = CreateSystem();
+    const auto master = Mastering(system, 2);
+    auto option = DelayRackOption(delay, count);
+    const auto rack = CustomRack(system, option);
+    const auto custom = Voice(rack);
+    Control(custom, SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP, Ngs2CustomSubmixerVoiceSetupParam{{}, 2, 2, 0, 0});
+    Patch(custom, master);
+    Event(custom, SCE_NGS2_VOICE_EVENT_PLAY);
+    for (const float sample : Render(system)) Require(sample == 0.0f);
+
+    std::vector<std::int16_t> pcm(Grain * 2 * 8);
+    for (std::uint32_t i = 0; i < pcm.size() / 2; ++i) {
+        pcm[i * 2] = static_cast<std::int16_t>(1000 + i * 17);
+        pcm[i * 2 + 1] = static_cast<std::int16_t>(-2000 + static_cast<int>(i) * 11);
+    }
+    const auto sampler = Sampler(system, pcm);
+    Patch(sampler, custom);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+    const auto checkGrain = [&](std::uint32_t grain) {
+        const auto out = Render(system);
+        for (std::uint32_t i = 0; i < Grain * 2; ++i) {
+            Require(out[i] == static_cast<float>(pcm[grain * Grain * 2 + i]) / 32768.0f);
+        }
+    };
+    for (std::uint32_t grain = 0; grain < 3; ++grain) checkGrain(grain);
+
+    LegacyUserFxState state{};
+    for (std::uint32_t index = 0; index < 256; ++index) {
+        Ngs2CustomVoiceUserFxParam param{{sizeof(Ngs2CustomVoiceUserFxParam), 0, 0x40001d00 | index},
+                                       ProcessLegacy, reinterpret_cast<std::uintptr_t>(&state), 123, 456};
+        bool rejected = false;
+        try {
+            sceNgs2VoiceControl(custom, &param.header);
+
+        } catch (const std::runtime_error& error) {
+            const std::string message = error.what();
+            rejected = message.find("Delay") != std::string::npos && message.find("not implemented") != std::string::npos;
+        }
+        Require(rejected);
+    }
+    checkGrain(3);
+    Require(state.calls == 0);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_STOP);
+    for (const float sample : Render(system)) Require(sample == 0.0f);
+
+    option.custom_rack_option.module[0].state_size = 4;
+    Require(CreateThrows<std::runtime_error>(option));
+    option.custom_rack_option.module[0].state_size = 0;
+    option.custom_rack_option.module[0].state_offset = 4;
+    Require(CreateThrows<std::runtime_error>(option));
+    option.custom_rack_option.module[0].state_offset = 0;
+    option.custom_rack_option.module[0].option = nullptr;
+    Require(CreateThrows<std::runtime_error>(option));
+    Ngs2CustomSamplerRackOption samplerOption{};
+    samplerOption.custom_rack_option = DelayRackOption(delay, count).custom_rack_option;
+    samplerOption.custom_rack_option.rack_option.size = sizeof(samplerOption);
+    samplerOption.max_channel_works = 1;
+    Require(CreateSamplerThrows<std::runtime_error>(samplerOption));
+    for (const auto invalid : {DelayOption{19}, DelayOption{24}, DelayOption{20, 2}, DelayOption{20, 0, 0},
+                               DelayOption{20, 0, 9}, DelayOption{20, 0, 4, 0.0f}, DelayOption{20, 0, 4, 20001.0f},
+                               DelayOption{20, 0, 4, std::numeric_limits<float>::quiet_NaN()},
+                               DelayOption{20, 0, 4, std::numeric_limits<float>::infinity()}, DelayOption{20, 0, 4, 1000.0f, 1}}) {
+        Require(CreateThrows<std::runtime_error>(DelayRackOption(invalid, count)));
+    }
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestCustomGain() {
+    const auto system = CreateSystem();
+    const auto master = Mastering(system, 2);
+    const auto userFx2 = Module(Gain);
+    const auto rack = CustomRack(system, BuiltInRackOption(userFx2, SCE_NGS2_CUSTOM_MODULE_ID_GAIN, nullptr, 0));
+    const auto custom = Voice(rack);
+    Control(custom, SCE_NGS2_CUSTOM_SUBMIXER_VOICE_PARAM_SETUP, Ngs2CustomSubmixerVoiceSetupParam{{}, 2, 2, 0, 0});
+    Patch(custom, master);
+    Event(custom, SCE_NGS2_VOICE_EVENT_PLAY);
+    std::vector<std::int16_t> pcm(Grain * 2 * 8, 16384);
+    const auto sampler = Sampler(system, pcm);
+    Patch(sampler, custom);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+
+    auto out = Render(system);
+    for (std::uint32_t i = 0; i < Grain; i++) Require(out[i * 2] == 0.0f && out[i * 2 + 1] == 0.0f);
+
+    Ngs2CustomVoiceGainParam gain{};
+    gain.gain[0] = 2.0f;
+    gain.gain[1] = -0.5f;
+    Control(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN | 0, gain);
+    out = Render(system);
+    for (std::uint32_t i = 0; i < Grain; i++) {
+        Require(out[i * 2] == 0.5f * 2.0f * static_cast<float>(i + 1) / Grain);
+        Require(out[i * 2 + 1] == 0.5f * -0.5f * static_cast<float>(i + 1) / Grain);
+    }
+    out = Render(system);
+    for (std::uint32_t i = 0; i < Grain; i++) Require(out[i * 2] == 1.0f && out[i * 2 + 1] == -0.25f);
+
+    gain.gain[0] = 1.0f;
+    Control(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN | 0, gain);
+    out = Render(system);
+    for (std::uint32_t i = 0; i < Grain; i++) Require(out[i * 2] == 0.5f * (2.0f - static_cast<float>(i + 1) / Grain));
+
+    auto outside = gain;
+    outside.gain[2] = 33.0f;
+    Require(ControlThrows<std::runtime_error>(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN | 0, outside));
+    Require(ControlThrows<std::invalid_argument>(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN | 1, gain));
+    Require(ControlThrows<std::invalid_argument>(sampler, SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN | 0, gain));
+    struct ShortGainParam {
+        Ngs2VoiceParamHeader header;
+        float gain[2];
+    };
+    Require(ControlThrows<std::invalid_argument>(custom, SCE_NGS2_CUSTOM_VOICE_PARAM_GAIN | 0, ShortGainParam{}));
+
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+template <typename TException>
+static bool ModuleInfoThrows(uintptr_t rack, std::uint32_t moduleIndex, std::size_t infoSize) {
+    Ngs2CustomModuleInfo info;
+    std::memset(&info, 0xa5, sizeof(info));
+    bool threw = false;
+    try {
+        sceNgs2CustomRackGetModuleInfo(rack, moduleIndex, &info, infoSize);
+
+    } catch (const TException&) {
+        threw = true;
+    }
+    const auto* bytes = reinterpret_cast<const unsigned char*>(&info);
+    for (std::size_t i = 0; i < sizeof(info); i++) Require(bytes[i] == 0xa5);
+    return threw;
+}
+
+static void TestCustomModuleInfo() {
+    const auto system = CreateSystem();
+    const Ngs2CustomUserFx2ModuleOption userFx2{{sizeof(Ngs2CustomUserFx2ModuleOption)}, nullptr, nullptr, nullptr, Gain, sizeof(float), sizeof(float), 8, 0x77};
+    const Ngs2CustomUserFx2ModuleOption modules[2] = {userFx2, userFx2};
+    auto option = RackOption(modules, 2);
+    auto& first = option.custom_rack_option.module[0];
+    first.state_offset = 0x40;
+    first.reserved = 0x11;
+    first.reserved2 = 0x22;
+    auto& filter = option.custom_rack_option.module[1];
+    filter.option = nullptr;
+    filter.module_id = SCE_NGS2_CUSTOM_MODULE_ID_FILTER;
+    filter.state_size = 0;
+    const auto rack = CustomRack(system, option);
+
+    Ngs2CustomModuleInfo info;
+    std::memset(&info, 0xa5, sizeof(info));
+    Require(sceNgs2CustomRackGetModuleInfo(rack, 0, &info, sizeof(info)) == SCE_NGS2_OK);
+    Require(info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_USER_FX2 && info.source_buffer_id == 0 && info.extra_buffer_id == 0 && info.dest_buffer_id == 0);
+    Require(info.state_offset == 0x40 && info.state_size == 16 && info.reserved == 0 && info.reserved2 == 0);
+    std::memset(&info, 0xa5, sizeof(info));
+    Require(sceNgs2CustomRackGetModuleInfo(rack, 1, &info, sizeof(info)) == SCE_NGS2_OK);
+    Require(info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_FILTER && info.state_offset == 0 && info.state_size == 0 && info.reserved == 0 && info.reserved2 == 0);
+
+    Require(sceNgs2CustomRackGetModuleInfo(rack, 0, nullptr, sizeof(info)) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2CustomRackGetModuleInfo(0x1234, 0, nullptr, sizeof(info)) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    std::memset(&info, 0xa5, sizeof(info));
+    Require(sceNgs2CustomRackGetModuleInfo(0x1234, 0, &info, sizeof(info)) == SCE_NGS2_ERROR_INVALID_RACK_HANDLE);
+    Require(sceNgs2CustomRackGetModuleInfo(system, 0, &info, sizeof(info)) == SCE_NGS2_ERROR_INVALID_RACK_HANDLE);
+    const auto* bytes = reinterpret_cast<const unsigned char*>(&info);
+    for (std::size_t i = 0; i < sizeof(info); i++) Require(bytes[i] == 0xa5);
+    Require(ModuleInfoThrows<std::invalid_argument>(rack, 2, sizeof(Ngs2CustomModuleInfo)));
+    Require(ModuleInfoThrows<std::invalid_argument>(rack, 0, sizeof(Ngs2CustomModuleInfo) - 1));
+    Require(ModuleInfoThrows<std::runtime_error>(rack, 0, sizeof(Ngs2CustomModuleInfo) + 8));
+    Require(ModuleInfoThrows<std::invalid_argument>(CreateRack(system, SCE_NGS2_RACK_ID_SUBMIXER), 0, sizeof(Ngs2CustomModuleInfo)));
+
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    Require(sceNgs2CustomRackGetModuleInfo(rack, 0, &info, sizeof(info)) == SCE_NGS2_ERROR_INVALID_RACK_HANDLE);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestCustomMastering() {
+    const auto system = CreateSystem();
+    const auto good = MasteringRackOption(2, 1);
+
+    Ngs2ContextBufferInfo query{};
+    Require(sceNgs2RackQueryBufferSize(SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &good.custom_rack_option.rack_option, &query) == SCE_NGS2_OK);
+    const auto info = Buffer(query);
+    uintptr_t rack = 0;
+    Require(sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &good.custom_rack_option.rack_option, &info, &rack) == SCE_NGS2_OK);
+    const auto voice = Voice(rack);
+
+    Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_SETUP, Ngs2MasteringVoiceSetupParam{{}, 2, 0});
+    Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, 1.0f, 1.0f});
+    Control(voice, SCE_NGS2_CUSTOM_MASTERING_VOICE_PARAM_OUTPUT, Ngs2MasteringVoiceOutputParam{{}, 0, 0});
+    Event(voice, SCE_NGS2_VOICE_EVENT_PLAY);
+
+    Ngs2VoiceState state{};
+    Require(sceNgs2VoiceGetState(voice, &state, sizeof(state)) == SCE_NGS2_OK);
+    Require((state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_INUSE) != 0);
+    Require(sceNgs2VoiceGetState(voice, &state, sizeof(state) - 1) == SCE_NGS2_ERROR_INVALID_OUT_SIZE);
+
+    std::vector<std::int16_t> pcm(Grain * 2 * 8, 16384);
+    const auto sampler = Sampler(system, pcm);
+    Patch(sampler, voice);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+
+    auto out = Render(system);
+    Require(out.size() == Grain * 2);
+    Require(out[0] != 0.0f);
+
+    Require(sceNgs2VoiceGetState(voice, &state, sizeof(state)) == SCE_NGS2_OK);
+    Require((state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_PLAYING) != 0);
+
+    auto createMastering = [&](const Ngs2CustomMasteringRackOption& opt) {
+        uintptr_t r = 0;
+        return sceNgs2RackCreate(system, SCE_NGS2_RACK_ID_CUSTOM_MASTERING, &opt.custom_rack_option.rack_option, &info, &r);
+    };
+
+    auto invalidChannels = good;
+    invalidChannels.max_channels = SCE_NGS2_CUSTOM_SUBMIXER_MAX_CHANNELS + 1;
+    Require(createMastering(invalidChannels) == SCE_NGS2_ERROR_INVALID_NUM_CHANNELS);
+
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
 int main() {
+    for (const auto count : {1u, 2u, 24u}) {
+        for (const auto delay : {DelayOption{}, DelayOption{20, 1, 1, 1.0f, 0}, DelayOption{20, 1, 8, 20000.0f, 0}}) {
+            TestCustomDelay(count, delay);
+        }
+    }
     TestUserFxChain();
     TestRackOptions();
+    TestCustomRackChecks();
     TestCustomSampler();
     TestCustomFilter();
-    TestCustomLegacyUserFx();
+    for (const auto moduleIndex : {0u, 1u, 23u}) TestCustomLegacyUserFx(moduleIndex);
+    TestCustomGain();
+    TestCustomModuleInfo();
+    TestCustomMastering();
     return 0;
 }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp
index cf47e314b2..f6dd4600d1 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Filter.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <cmath>
@@ -151,6 +152,7 @@ static void RequireRejected(uintptr_t voice, const Ngs2SamplerVoiceFilterParam&
     bool rejected = false;
     try {
         sceNgs2VoiceControl(voice, &param.header);
+
     } catch (const TError&) {
         rejected = true;
     }
@@ -181,6 +183,7 @@ static void TestRateChangeUnderFilter() {
     bool rejected = false;
     try {
         sceNgs2SystemSetSampleRate(system, 96000);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp
index 2417e360e0..b456ed0cd0 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Geom.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <cstdint>
@@ -105,6 +106,7 @@ static void RejectListener(const Ngs2GeomListenerParam* param, std::uint32_t fla
     bool rejected = false;
     try {
         sceNgs2GeomCalcListener(param, &work, flags);
+
     } catch (const std::exception&) {
         rejected = true;
     }
@@ -115,9 +117,18 @@ static void RejectListener(const Ngs2GeomListenerParam* param, std::uint32_t fla
 static void TestInvalidListener() {
     auto param = Listener();
     Require(sceNgs2GeomCalcListener(&param, nullptr, 0) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
-    RejectListener(nullptr, 0);
-    RejectListener(&param, 2);
-    RejectListener(&param, 0xffffffffu);
+    Ngs2GeomListenerWork work;
+    std::memset(&work, 0x5a, sizeof(work));
+    unsigned char before[sizeof(work)];
+    std::memcpy(before, &work, sizeof(work));
+    Require(sceNgs2GeomCalcListener(nullptr, &work, 0) == static_cast<int>(0x804A8461));
+    Require(sceNgs2GeomCalcListener(nullptr, &work, 2) == static_cast<int>(0x804A8461));
+    Require(sceNgs2GeomCalcListener(nullptr, nullptr, 0) == static_cast<int>(0x804A8461));
+    Require(sceNgs2GeomCalcListener(&param, &work, 2) == static_cast<int>(0x804A8463));
+    Require(sceNgs2GeomCalcListener(&param, &work, 0x80000000u) == static_cast<int>(0x804A8463));
+    Require(sceNgs2GeomCalcListener(&param, &work, 0xffffffffu) == static_cast<int>(0x804A8463));
+    Require(sceNgs2GeomCalcListener(&param, nullptr, 2) == static_cast<int>(0x804A8010));
+    Require(std::memcmp(before, &work, sizeof(work)) == 0);
     for (const float value : {0.0f, -1.0f, std::numeric_limits<float>::infinity(), std::numeric_limits<float>::quiet_NaN()}) {
         param.sound_speed = value;
         RejectListener(&param, 0);
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2HandleErrors.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2HandleErrors.cpp
index 56246ca178..9682af0e24 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2HandleErrors.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2HandleErrors.cpp
@@ -1,12 +1,284 @@
 #include "Ngs2Test.hpp"
 
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
 #include <iostream>
 #include <stdexcept>
+#include <string>
+#include <vector>
 
 static void Status(int actual, int expected, const char* message) {
     if (actual != expected) throw std::runtime_error(message);
 }
 
+static void CheckResetOption() {
+    Status(sceNgs2SystemResetOption(nullptr), static_cast<int>(0x804A8010u), "null system option did not return the invalid out address error");
+    constexpr std::uint64_t size = 0x90;
+    constexpr std::uint32_t maxGrainSamples = 512;
+    constexpr std::uint32_t numGrainSamples = 256;
+    constexpr std::uint32_t sampleRate = 48000;
+    constexpr std::uint32_t maxVoiceChannels = 8;
+    unsigned char expected[0x90] = {};
+    std::memcpy(expected + 0x00, &size, sizeof(size));
+    std::memcpy(expected + 0x6c, &maxGrainSamples, sizeof(maxGrainSamples));
+    std::memcpy(expected + 0x70, &numGrainSamples, sizeof(numGrainSamples));
+    std::memcpy(expected + 0x74, &sampleRate, sizeof(sampleRate));
+    std::memcpy(expected + 0x78, &maxVoiceChannels, sizeof(maxVoiceChannels));
+    static_assert(sizeof(Ngs2SystemOption) == sizeof(expected));
+    Ngs2SystemOption option;
+    std::memset(&option, 0xAB, sizeof(option));
+    Status(sceNgs2SystemResetOption(&option), SCE_NGS2_OK, "system option reset failed");
+    Require(std::memcmp(&option, expected, sizeof(expected)) == 0);
+    Ngs2ContextBufferInfo query{};
+    Status(sceNgs2SystemQueryBufferSize(&option, &query), SCE_NGS2_OK, "reset system option was rejected");
+}
+
+static int allocations = 0;
+
+static std::int32_t APS5_VABI CountedAllocate(Ngs2ContextBufferInfo* info) {
+    info->host_buffer = std::calloc(1, info->host_buffer_size);
+    allocations++;
+    return SCE_NGS2_OK;
+}
+
+static std::int32_t APS5_VABI CountedRelease(Ngs2ContextBufferInfo* info) {
+    std::free(info->host_buffer);
+    allocations--;
+    return SCE_NGS2_OK;
+}
+
+static std::string Hex(int value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%x", static_cast<unsigned>(value));
+    return text;
+}
+
+static void Returned(int actual, int expected, const char* entry, const std::string& label) {
+    if (actual != expected) throw std::runtime_error(std::string(entry) + " with " + label + " returned " + Hex(actual) + " instead of " + Hex(expected));
+}
+
+static Ngs2SystemOption Option(std::uint32_t maxGrainSamples = 512, std::uint32_t numGrainSamples = 256, std::uint32_t sampleRate = 48000, std::uint32_t maxVoiceChannels = 8) {
+    Ngs2SystemOption option{};
+    option.size = sizeof(option);
+    option.max_grain_samples = maxGrainSamples;
+    option.num_grain_samples = numGrainSamples;
+    option.sample_rate = sampleRate;
+    option.max_voice_channels = maxVoiceChannels;
+    return option;
+}
+
+static void CheckOption(const Ngs2SystemOption& option, int expected, const std::string& label) {
+    constexpr uintptr_t sentinel = 0x5a5a;
+    Ngs2ContextBufferInfo query{};
+    Returned(sceNgs2SystemQueryBufferSize(&option, &query), expected, "sceNgs2SystemQueryBufferSize", label);
+    Require((query.host_buffer_size != 0) == (expected == SCE_NGS2_OK));
+    std::vector<std::uint64_t> storage(query.host_buffer_size / sizeof(std::uint64_t) + 1);
+    Ngs2ContextBufferInfo buffer{};
+    buffer.host_buffer = storage.data();
+    buffer.host_buffer_size = query.host_buffer_size;
+    const Ngs2BufferAllocator allocator{CountedAllocate, CountedRelease, 0};
+    uintptr_t created = sentinel;
+    uintptr_t allocated = sentinel;
+    Returned(sceNgs2SystemCreate(&option, &buffer, &created), expected, "sceNgs2SystemCreate", label);
+    Returned(sceNgs2SystemCreateWithAllocator(&option, &allocator, &allocated), expected, "sceNgs2SystemCreateWithAllocator", label);
+    if (expected != SCE_NGS2_OK) {
+        Require(created == sentinel && allocated == sentinel && allocations == 0);
+        return;
+    }
+    Require(created != sentinel && allocated != sentinel && allocations == 1);
+    for (const auto system : {created, allocated}) {
+        Ngs2SystemInfo info{};
+        Status(sceNgs2SystemGetInfo(system, &info, sizeof(info)), SCE_NGS2_OK, "system info of a valid option failed");
+        Require(info.max_grain_samples == option.max_grain_samples && info.num_grain_samples == option.num_grain_samples && info.sample_rate == option.sample_rate);
+        Status(sceNgs2SystemDestroy(system, nullptr), SCE_NGS2_OK, "system destroy of a valid option failed");
+    }
+    Require(allocations == 0);
+}
+
+static void CheckQueryBuffer(const Ngs2SystemOption* option, int expected, const char* label) {
+    constexpr uintptr_t userData = 0x1234;
+    Ngs2ContextBufferInfo query;
+    std::memset(&query, 0xAB, sizeof(query));
+    query.user_data = userData;
+    Returned(sceNgs2SystemQueryBufferSize(option, &query), expected, "sceNgs2SystemQueryBufferSize", label);
+    Require(query.host_buffer == nullptr && query.user_data == userData);
+    for (const auto value : query.reserved) Require(value == 0);
+    Require((query.host_buffer_size != 0) == (expected == SCE_NGS2_OK));
+}
+
+static void CheckCreateArguments() {
+    constexpr int outputError = static_cast<int>(0x804A8010u);
+    constexpr int bufferError = static_cast<int>(0x804A8020u);
+    constexpr int allocatorError = static_cast<int>(0x804A8023u);
+    constexpr int rateError = static_cast<int>(0x804A8051u);
+    constexpr uintptr_t sentinel = 0x5a5a;
+    const auto valid = Option();
+    const auto badRate = Option(512, 256, 7000);
+    Ngs2ContextBufferInfo query{};
+    Status(sceNgs2SystemQueryBufferSize(&valid, &query), SCE_NGS2_OK, "system buffer query failed");
+    std::vector<std::uint64_t> storage(query.host_buffer_size / sizeof(std::uint64_t) + 1);
+    Ngs2ContextBufferInfo buffer{};
+    buffer.host_buffer = storage.data();
+    buffer.host_buffer_size = query.host_buffer_size;
+    Ngs2ContextBufferInfo noHost = buffer;
+    noHost.host_buffer = nullptr;
+    const Ngs2BufferAllocator allocator{CountedAllocate, CountedRelease, 0};
+    const Ngs2BufferAllocator noAlloc{nullptr, CountedRelease, 0};
+
+    struct CreateCase {
+        const Ngs2SystemOption* option;
+        const Ngs2ContextBufferInfo* buffer;
+        bool handle;
+        int expected;
+        const char* label;
+    };
+    for (const auto& c : {CreateCase{&valid, nullptr, true, bufferError, "a null buffer info"},
+                          CreateCase{&valid, &noHost, true, bufferError, "a null host buffer"},
+                          CreateCase{&badRate, nullptr, false, bufferError, "a null buffer info, handle and bad option"},
+                          CreateCase{&badRate, &noHost, false, bufferError, "a null host buffer, handle and bad option"},
+                          CreateCase{&badRate, &buffer, false, outputError, "a null handle and bad option"},
+                          CreateCase{&badRate, &buffer, true, rateError, "a bad option"}}) {
+        uintptr_t created = sentinel;
+        Returned(sceNgs2SystemCreate(c.option, c.buffer, c.handle ? &created : nullptr), c.expected, "sceNgs2SystemCreate", c.label);
+        Require(created == sentinel);
+    }
+    uintptr_t created = sentinel;
+    Returned(sceNgs2SystemCreate(nullptr, &buffer, &created), SCE_NGS2_OK, "sceNgs2SystemCreate", "a null option");
+    Status(sceNgs2SystemDestroy(created, nullptr), SCE_NGS2_OK, "system destroy failed");
+
+    struct AllocatorCase {
+        const Ngs2SystemOption* option;
+        const Ngs2BufferAllocator* allocator;
+        bool handle;
+        int expected;
+        const char* label;
+    };
+    for (const auto& c : {AllocatorCase{&valid, nullptr, true, allocatorError, "a null allocator"},
+                          AllocatorCase{&valid, &noAlloc, true, allocatorError, "a null alloc handler"},
+                          AllocatorCase{&badRate, nullptr, false, allocatorError, "a null allocator, handle and bad option"},
+                          AllocatorCase{&badRate, &noAlloc, false, allocatorError, "a null alloc handler, handle and bad option"},
+                          AllocatorCase{&badRate, &allocator, false, outputError, "a null handle and bad option"},
+                          AllocatorCase{&badRate, &allocator, true, rateError, "a bad option"}}) {
+        uintptr_t allocated = sentinel;
+        Returned(sceNgs2SystemCreateWithAllocator(c.option, c.allocator, c.handle ? &allocated : nullptr), c.expected, "sceNgs2SystemCreateWithAllocator", c.label);
+        Require(allocated == sentinel && allocations == 0);
+    }
+    uintptr_t allocated = sentinel;
+    Returned(sceNgs2SystemCreateWithAllocator(nullptr, &allocator, &allocated), SCE_NGS2_OK, "sceNgs2SystemCreateWithAllocator", "a null option");
+    Require(allocations == 1);
+    Status(sceNgs2SystemDestroy(allocated, nullptr), SCE_NGS2_OK, "system destroy failed");
+    Require(allocations == 0);
+}
+
+static void CheckSystemOption() {
+    constexpr int outputError = static_cast<int>(0x804A8010u);
+    constexpr int sizeError = static_cast<int>(0x804A8013u);
+    constexpr int rateError = static_cast<int>(0x804A8051u);
+    constexpr int channelsError = static_cast<int>(0x804A8052u);
+    constexpr int grainError = static_cast<int>(0x804A8310u);
+    constexpr int maxGrainError = static_cast<int>(0x804A8311u);
+    constexpr std::uint32_t invalid = 0xffffffffu;
+
+    for (const std::uint32_t size : {0u, 8u, 0x88u, 0x98u, invalid}) {
+        auto option = Option();
+        option.size = size;
+        CheckOption(option, sizeError, "size " + std::to_string(size));
+    }
+    for (const std::uint32_t maxGrain : {0u, 32u, 63u, 65u, 96u, 2047u, 2049u, 2112u, 4096u, invalid}) {
+        CheckOption(Option(maxGrain, 64), maxGrainError, "max grain samples " + std::to_string(maxGrain));
+    }
+    for (const std::uint32_t maxGrain : {64u, 128u, 576u, 2048u}) {
+        CheckOption(Option(maxGrain, 64), SCE_NGS2_OK, "max grain samples " + std::to_string(maxGrain));
+        CheckOption(Option(maxGrain, maxGrain), SCE_NGS2_OK, "grain samples " + std::to_string(maxGrain));
+    }
+    for (const std::uint32_t grain : {0u, 32u, 63u, 65u, 100u, 255u, 257u, 513u, 576u, 2048u, invalid}) {
+        CheckOption(Option(512, grain), grainError, "grain samples " + std::to_string(grain));
+    }
+    for (const std::uint32_t grain : {64u, 192u, 448u, 512u}) {
+        CheckOption(Option(512, grain), SCE_NGS2_OK, "grain samples " + std::to_string(grain));
+    }
+    for (const std::uint32_t rate : {11025u, 12000u, 22050u, 24000u, 44100u, 48000u, 88200u, 96000u, 176400u, 192000u}) {
+        CheckOption(Option(512, 256, rate), SCE_NGS2_OK, "sample rate " + std::to_string(rate));
+    }
+    for (const std::uint32_t rate : {0u, 8000u, 11024u, 11026u, 16000u, 32000u, 47999u, 48001u, 192001u, invalid}) {
+        CheckOption(Option(512, 256, rate), rateError, "sample rate " + std::to_string(rate));
+    }
+    for (const std::uint32_t channels : {1u, 2u, 8u, 36u, 37u}) {
+        CheckOption(Option(512, 256, 48000, channels), SCE_NGS2_OK, "voice channels " + std::to_string(channels));
+    }
+    for (const std::uint32_t channels : {0u, 38u, 39u, invalid}) {
+        CheckOption(Option(512, 256, 48000, channels), channelsError, "voice channels " + std::to_string(channels));
+    }
+
+    auto badSize = Option(100, 100, 7000, 0);
+    badSize.size = 0x88;
+    CheckOption(badSize, sizeError, "a bad size and every other field bad");
+    CheckOption(Option(100, 100, 7000, 0), maxGrainError, "a bad max grain, grain, rate and channels");
+    CheckOption(Option(100, 0, 48000, 8), maxGrainError, "a bad max grain and grain");
+    CheckOption(Option(100, 256, 7000, 8), maxGrainError, "a bad max grain and rate");
+    CheckOption(Option(100, 256, 48000, 0), maxGrainError, "a bad max grain and channels");
+    CheckOption(Option(512, 100, 7000, 0), grainError, "a bad grain, rate and channels");
+    CheckOption(Option(512, 576, 48000, 8), grainError, "a grain above the max grain");
+    CheckOption(Option(512, 100, 48000, 0), grainError, "a bad grain and channels");
+    CheckOption(Option(512, 256, 7000, 0), rateError, "a bad rate and channels");
+
+    auto scheduled = Option();
+    for (auto& character : scheduled.name) character = 'n';
+    for (auto& pointer : scheduled.job_scheduler_options) pointer = 0x1000;
+    CheckOption(scheduled, SCE_NGS2_OK, "a name and job scheduler options");
+
+    const auto invalidRate = Option(512, 256, 7000);
+    Status(sceNgs2SystemQueryBufferSize(&invalidRate, nullptr), outputError, "invalid option took precedence over the null output");
+    Status(sceNgs2SystemQueryBufferSize(nullptr, nullptr), outputError, "null option took precedence over the null output");
+    CheckQueryBuffer(nullptr, SCE_NGS2_OK, "a null option");
+    CheckQueryBuffer(&invalidRate, rateError, "a refused rate");
+    auto invalidSize = Option();
+    invalidSize.size = 0x88;
+    CheckQueryBuffer(&invalidSize, sizeError, "a refused size");
+    const auto valid = Option();
+    CheckQueryBuffer(&valid, SCE_NGS2_OK, "a valid option");
+}
+
+static void CheckSetGrainSamples() {
+    constexpr int systemError = static_cast<int>(0x804A8201u);
+    constexpr int grainError = static_cast<int>(0x804A8310u);
+    const auto system = CreateSystem();
+    Ngs2SystemInfo info{};
+    Status(sceNgs2SystemSetGrainSamples(0x1234, 100), systemError, "an invalid system handle lost to an invalid grain");
+    for (const std::uint32_t grain : {64u, 192u, 512u}) {
+        Status(sceNgs2SystemSetGrainSamples(system, grain), SCE_NGS2_OK, "a valid grain was refused");
+        Status(sceNgs2SystemGetInfo(system, &info, sizeof(info)), SCE_NGS2_OK, "system info failed");
+        Require(info.num_grain_samples == grain);
+    }
+    for (const std::uint32_t grain : {0u, 513u, 576u, 2048u, 0xffffffffu}) {
+        Status(sceNgs2SystemSetGrainSamples(system, grain), grainError, "an invalid grain was accepted");
+        Status(sceNgs2SystemGetInfo(system, &info, sizeof(info)), SCE_NGS2_OK, "system info failed");
+        Require(info.num_grain_samples == 512);
+    }
+    Status(sceNgs2SystemDestroy(system, nullptr), SCE_NGS2_OK, "system destroy failed");
+}
+
+static void CheckSetSampleRate() {
+    constexpr int systemError = static_cast<int>(0x804A8201u);
+    constexpr int rateError = static_cast<int>(0x804A8051u);
+    const auto system = CreateSystem();
+    Ngs2SystemInfo info{};
+    Status(sceNgs2SystemSetSampleRate(0x1234, 7000), systemError, "an invalid system handle lost to an invalid rate");
+    for (const std::uint32_t rate : {11025u, 12000u, 22050u, 24000u, 44100u, 48000u, 88200u, 96000u, 176400u, 192000u}) {
+        Status(sceNgs2SystemSetSampleRate(system, rate), SCE_NGS2_OK, "a valid rate was refused");
+        Status(sceNgs2SystemGetInfo(system, &info, sizeof(info)), SCE_NGS2_OK, "system info failed");
+        Require(info.sample_rate == rate);
+    }
+    for (const std::uint32_t rate : {0u, 7000u, 8000u, 16000u, 32000u, 47999u, 48001u, 192001u, 0xffffffffu}) {
+        Status(sceNgs2SystemSetSampleRate(system, rate), rateError, "an invalid rate was accepted");
+        Status(sceNgs2SystemGetInfo(system, &info, sizeof(info)), SCE_NGS2_OK, "system info failed");
+        Require(info.sample_rate == 192000);
+    }
+    Status(sceNgs2SystemDestroy(system, nullptr), SCE_NGS2_OK, "system destroy failed");
+}
+
 int main() {
     try {
         constexpr int systemError = static_cast<int>(0x804A8201u);
@@ -39,6 +311,11 @@ int main() {
         Status(sceNgs2SystemDestroy(system, nullptr), SCE_NGS2_OK, "valid system destroy failed");
         Status(sceNgs2SystemGetUserData(system, &value), systemError, "retired system returned the wrong error");
         Require(value == sentinel);
+        CheckCreateArguments();
+        CheckResetOption();
+        CheckSystemOption();
+        CheckSetGrainSamples();
+        CheckSetSampleRate();
         std::cout << "NGS2 PS5 handle errors and validation precedence checked\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp
index a2545f52e6..6a0c74f5b3 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Parse.cpp
@@ -113,9 +113,59 @@ static void TestParseFileBank() {
     std::filesystem::remove(path);
 }
 
+static void TestFrameInfoPcm() {
+    for (std::uint32_t channels = 1; channels <= 8; channels++) {
+        for (const std::uint32_t rate : {1u, 22050u, 48000u, 192000u}) {
+            const Ngs2WaveformFormat format{SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, channels, rate, 0, 0, 0};
+            std::uint32_t frameSize = 0xa1, frameSamples = 0xa2, units = 0xa3, delay = 0xa4;
+            Require(sceNgs2GetWaveformFrameInfo(&format, &frameSize, &frameSamples, &units, &delay) == SCE_NGS2_OK);
+            Require(frameSize == channels * 2 && frameSamples == 1 && units == 1 && delay == 0);
+            const auto file = PcmFile(channels, rate, 16, 10);
+            Ngs2WaveformInfo info{};
+            Require(sceNgs2ParseWaveformData(file.data(), file.size(), &info) == SCE_NGS2_OK);
+            Require(info.audio_frame_size == frameSize && info.num_audio_frame_samples == frameSamples);
+            Require(info.num_audio_unit_per_frame == units && info.num_delay_samples == delay);
+        }
+    }
+    const Ngs2WaveformFormat ignored{SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 2, 48000, 0x12345678, 3, 5};
+    std::uint32_t frameSize = 0xa1, frameSamples = 0xa2, units = 0xa3, delay = 0xa4;
+    Require(sceNgs2GetWaveformFrameInfo(&ignored, &frameSize, &frameSamples, &units, &delay) == SCE_NGS2_OK);
+    Require(frameSize == 4 && frameSamples == 1 && units == 1 && delay == 0);
+}
+
+static void TestFrameInfoErrors() {
+    const Ngs2WaveformFormat pcm{SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 2, 48000, 0, 0, 0};
+    std::uint32_t values[4] = {0xa1, 0xa2, 0xa3, 0xa4};
+    const auto untouched = [&] { return values[0] == 0xa1 && values[1] == 0xa2 && values[2] == 0xa3 && values[3] == 0xa4; };
+    Require(sceNgs2GetWaveformFrameInfo(&pcm, nullptr, &values[1], &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(&pcm, &values[0], nullptr, &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(&pcm, &values[0], &values[1], nullptr, &values[3]) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(&pcm, &values[0], &values[1], &values[2], nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(nullptr, nullptr, nullptr, nullptr, nullptr) == SCE_NGS2_ERROR_INVALID_OUT_ADDRESS);
+    Require(sceNgs2GetWaveformFrameInfo(nullptr, &values[0], &values[1], &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
+    Require(untouched());
+    const Ngs2WaveformFormat invalid[] = {
+        {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 0, 48000, 0, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 9, 48000, 0, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 2, 0, 0, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 2, 192001, 0, 0, 0},
+        {0x99, 0, 48000, 0, 0, 0},
+        {SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, 2, 0, 0, 0, 0},
+    };
+    for (const auto& format : invalid) {
+        Require(sceNgs2GetWaveformFrameInfo(&format, &values[0], &values[1], &values[2], &values[3]) == SCE_NGS2_ERROR_INVALID_WAVEFORM_FORMAT);
+        Require(untouched());
+    }
+    for (const std::uint32_t type : {0u, 0x10u, 0x11u, 0x13u, 0x14u, 0x16u, SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, 0x19u, 0x41u, 0xffffffffu}) {
+        Require(FrameInfoThrows({type, 2, 48000, 0, 0, 0}));
+    }
+}
+
 int main() {
     TestParsePcm();
     TestParseFile();
     TestParseFileBank();
+    TestFrameInfoPcm();
+    TestFrameInfoErrors();
     return 0;
 }
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
index 4186d67946..b15456dae6 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
@@ -1,11 +1,14 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <algorithm>
+#include <array>
 #include <atomic>
 #include <chrono>
 #include <cmath>
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <iterator>
 #include <numbers>
 #include <stdexcept>
@@ -262,10 +265,32 @@ static void TestPan() {
     work.speaker_angles[0] = -INFINITY;
     Require(PanThrows(&work, &front, 1, 2));
     Require(sceNgs2PanInit(&work, nullptr, 360.0f, 2) == SCE_NGS2_OK);
-    Require(PanInitThrows(nullptr, nullptr, 360.0f, 2));
-    for (std::uint32_t count : {0u, 1u, 3u, 6u, 8u}) Require(PanInitThrows(&work, nullptr, 360.0f, count));
+    Ngs2PanWork marked;
+    std::memset(&marked, 0x5a, sizeof(marked));
+    Ngs2PanWork expected;
+    std::memcpy(&expected, &marked, sizeof(marked));
+    const auto unchanged = [&] { return std::memcmp(&marked, &expected, sizeof(marked)) == 0; };
     const float pair[] = {-30.0f, 30.0f};
-    Require(PanInitThrows(&work, pair, 180.0f, 2) && !PanInitThrows(&work, pair, 2.0f * pi, 2));
+    Require(sceNgs2PanInit(nullptr, nullptr, 360.0f, 2) == static_cast<int>(0x804A8010));
+    Require(sceNgs2PanInit(nullptr, pair, 180.0f, 3) == static_cast<int>(0x804A8010));
+    Require(sceNgs2PanInit(nullptr, nullptr, 100.0f, 3) == static_cast<int>(0x804A8010));
+    for (std::uint32_t count : {1u, 3u, 6u, 8u, 255u}) {
+        Require(sceNgs2PanInit(&marked, nullptr, 360.0f, count) == static_cast<int>(0x804A8451));
+        Require(unchanged());
+    }
+    Require(PanInitThrows(&marked, nullptr, 360.0f, 0));
+    Require(unchanged());
+    for (std::uint32_t count : {0u, 1u, 3u, 6u, 8u, 255u}) {
+        Require(sceNgs2PanInit(&marked, pair, 360.0f, count) == static_cast<int>(0x804A8451));
+        Require(sceNgs2PanInit(&marked, pair, 2.0f * pi, count) == static_cast<int>(0x804A8451));
+        Require(unchanged());
+    }
+    for (const float unitAngle : {180.0f, 0.0f, 359.0f, 361.0f, 90.0f, pi}) {
+        Require(sceNgs2PanInit(&marked, pair, unitAngle, 2) == static_cast<int>(0x804A8450));
+        Require(sceNgs2PanInit(&marked, pair, unitAngle, 3) == static_cast<int>(0x804A8450));
+        Require(unchanged());
+    }
+    Require(sceNgs2PanInit(&work, pair, 2.0f * pi, 2) == SCE_NGS2_OK);
     const float invalid[] = {0.0f, NAN};
     Require(PanInitThrows(&work, invalid, 360.0f, 2));
     const float onUnit[] = {720.0f, 30.0f};
@@ -663,6 +688,73 @@ static void TestReverb() {
     }
 }
 
+static std::vector<float> RenderReverbChannels(std::uint32_t inputs, std::uint32_t outputs, const Ngs2ReverbI3DL2Param& params, const std::vector<std::int16_t>& pcm, std::uint32_t frames) {
+    const auto firstBuffer = usedBuffers;
+    const auto system = CreateSystem();
+    Require(sceNgs2SystemSetGrainSamples(system, 256) == SCE_NGS2_OK);
+    const auto master = Mastering(system, outputs);
+    const auto reverb = Voice(CreateRack(system, SCE_NGS2_RACK_ID_REVERB));
+    Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, inputs, outputs, 0, 0});
+    Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_I3DL2, Ngs2ReverbVoiceI3DL2Param{{}, params});
+    Patch(reverb, master);
+    Event(reverb, SCE_NGS2_VOICE_EVENT_PLAY);
+    const auto sampler = Voice(CreateRack(system, SCE_NGS2_RACK_ID_SAMPLER));
+    Control(sampler, SCE_NGS2_SAMPLER_VOICE_PARAM_SETUP, Ngs2SamplerVoiceSetupParam{{}, {SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, inputs, 48000, 0, 0, 0}});
+    const Ngs2WaveformBlock block{0, pcm.size() * sizeof(std::int16_t), 0, 0, static_cast<std::uint32_t>(pcm.size() / inputs), 0, 0};
+    Control(sampler, SCE_NGS2_SAMPLER_VOICE_PARAM_ADD_WAVEFORM_BLOCKS, Ngs2SamplerVoiceWaveformBlocksParam{{}, pcm.data(), 0, 1, &block});
+    Patch(sampler, reverb);
+    std::vector<float> identity(inputs * inputs, 0.0f);
+    for (std::uint32_t c = 0; c < inputs; c++) identity[c * inputs + c] = 1.0f;
+    Control(sampler, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, inputs * inputs, identity.data()});
+    Control(sampler, SCE_NGS2_VOICE_PARAM_PORT_MATRIX, Ngs2VoicePortMatrixParam{{}, 0, 0});
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+    std::vector<float> all;
+    std::vector<float> out(256 * outputs);
+    for (std::uint32_t grain = 0; grain * 256 < frames; grain++) {
+        const Ngs2RenderBufferInfo info{out.data(), out.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, outputs};
+        Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
+        all.insert(all.end(), out.begin(), out.end());
+    }
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+    usedBuffers = firstBuffer;
+    return all;
+}
+
+static void TestReverbConversion() {
+    Ngs2ReverbI3DL2Param mixed{1.0f, 1.0f, -1000, 0, 0, 2.91f, 1.3f, -602, 0.015f, -302, 0.022f, 100.0f, 100.0f, 5000.0f, {}};
+    std::vector<std::int16_t> stereo(4096 * 2, 0);
+    std::uint32_t seed = 1;
+    for (std::uint32_t i = 0; i < 3000 * 2; i++) {
+        seed = seed * 1664525u + 1013904223u;
+        stereo[i] = static_cast<std::int16_t>(static_cast<std::int32_t>((seed >> 16) & 0x3fff) - 0x2000);
+    }
+    const auto same = RenderReverbChannels(2, 2, mixed, stereo, 8192);
+    for (std::uint32_t outputs : {6u, 8u}) {
+        const auto surround = RenderReverbChannels(2, outputs, mixed, stereo, 8192);
+        float sides = 0.0f;
+        float lfe = 0.0f;
+        for (std::uint32_t frame = 0; frame < 8192; frame++) {
+            for (std::uint32_t c = 0; c < 2; c++) Require(std::fabs(surround[frame * outputs + c] - same[frame * 2 + c]) <= 1e-7f + std::fabs(same[frame * 2 + c]) * 1e-5f);
+            for (std::uint32_t c = 2; c < outputs; c++) {
+                if (c != 3) sides = std::max(sides, std::fabs(surround[frame * outputs + c]));
+            }
+            lfe = std::max(lfe, std::fabs(surround[frame * outputs + 3]));
+        }
+        Require(sides > 1e-4f && lfe == 0.0f);
+    }
+
+    auto dry = mixed;
+    dry.wet = 0.0f;
+    const std::int16_t levels[6] = {8192, 4096, 2048, 1024, 512, 256};
+    std::vector<std::int16_t> six(4096 * 6);
+    for (std::size_t i = 0; i < six.size(); i++) six[i] = levels[i % 6];
+    const auto down = RenderReverbChannels(6, 2, dry, six, 2048);
+    const float half = std::numbers::sqrt2_v<float> / 2.0f;
+    const float left = (8192.0f + 2048.0f * half + 512.0f * 0.5f) / 32768.0f;
+    const float right = (4096.0f + 2048.0f * half + 256.0f * 0.5f) / 32768.0f;
+    Require(std::fabs(down[1024 * 2] - left) <= left * 1e-5f && std::fabs(down[1024 * 2 + 1] - right) <= right * 1e-5f);
+}
+
 static void TestReverbSetup() {
     const auto system = CreateSystem();
     const auto master = Mastering(system, 2);
@@ -672,12 +764,12 @@ static void TestReverbSetup() {
         try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, channels, channels, 0, 0}); } catch (const std::invalid_argument&) { rejected = true; }
         Require(rejected);
     }
-    bool conversion = false;
-    try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 1, 2, 0, 0}); } catch (const std::runtime_error&) { conversion = true; }
-    Require(conversion);
-    bool flags = false;
-    try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 2, 2, 1, 0}); } catch (const std::runtime_error&) { flags = true; }
-    Require(flags);
+    for (const auto& counts : {std::array<std::uint32_t, 2>{3, 2}, std::array<std::uint32_t, 2>{2, 7}}) {
+        bool rejected = false;
+        try { Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, counts[0], counts[1], 0, 0}); } catch (const std::invalid_argument&) { rejected = true; }
+        Require(rejected);
+    }
+    Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 1, 2, 0, 0});
     Control(reverb, SCE_NGS2_REVERB_VOICE_PARAM_SETUP, Ngs2ReverbVoiceSetupParam{{}, 2, 2, 0, 0});
     Ngs2ReverbI3DL2Param invalid{1.0f, 0.0f, 0, 0, 0, 1.0f, 1.0f, 0, 0.0f, 0, 0.0f, 100.0f, 100.0f, 5000.0f, {}};
     invalid.decay_time = NAN;
@@ -700,10 +792,7 @@ static void TestReverbSetup() {
     Require(loudest > 0.0f && loudest < 1e-8f);
     Ngs2VoiceState state{};
     Require(sceNgs2VoiceGetState(reverb, &state, sizeof(state)) == SCE_NGS2_OK && (state.state_flags & SCE_NGS2_VOICE_STATE_FLAG_INUSE) != 0);
-    Require(sceNgs2SystemSetSampleRate(system, 7000) == SCE_NGS2_OK);
-    bool lowRate = false;
-    try { sceNgs2SystemRender(system, &info, 1); } catch (const std::runtime_error&) { lowRate = true; }
-    Require(lowRate);
+    Require(sceNgs2SystemSetSampleRate(system, 7000) == SCE_NGS2_ERROR_INVALID_SAMPLE_RATE);
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 
     Ngs2ReverbRackOption option{};
@@ -728,13 +817,7 @@ static void TestReverbSetup() {
 static void TestSampleRate() {
     const auto system = CreateSystem();
     Require(sceNgs2SystemSetSampleRate(0x1234, 96000) == SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE);
-    bool threw = false;
-    try {
-        sceNgs2SystemSetSampleRate(system, 0);
-    } catch (const std::invalid_argument&) {
-        threw = true;
-    }
-    Require(threw);
+    Require(sceNgs2SystemSetSampleRate(system, 0) == SCE_NGS2_ERROR_INVALID_SAMPLE_RATE);
     Require(sceNgs2SystemSetSampleRate(system, 96000) == SCE_NGS2_OK);
     Ngs2SystemInfo info{};
     Require(sceNgs2SystemGetInfo(system, &info, sizeof(info)) == SCE_NGS2_OK && info.sample_rate == 96000);
@@ -750,6 +833,42 @@ static void TestSampleRate() {
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
+static bool SystemOptionThrows(const Ngs2SystemOption& option) {
+    Ngs2ContextBufferInfo query{};
+    try {
+        sceNgs2SystemQueryBufferSize(&option, &query);
+
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
+static void TestSystemOptionFlags() {
+    Ngs2SystemOption option{};
+    Require(sceNgs2SystemResetOption(&option) == SCE_NGS2_OK && option.flags == 0);
+    option.flags = 0x2;
+    Ngs2ContextBufferInfo query{};
+    Require(sceNgs2SystemQueryBufferSize(&option, &query) == SCE_NGS2_OK && query.host_buffer_size != 0);
+    const auto info = Buffer(query);
+    uintptr_t system = 0;
+    Require(sceNgs2SystemCreate(&option, &info, &system) == SCE_NGS2_OK && system != 0);
+    Require(sceNgs2SystemSetGrainSamples(system, Grain) == SCE_NGS2_OK);
+    const auto master = Mastering(system, 1);
+    const std::vector<std::int16_t> pcm{1000, 2000, 3000, 4000};
+    const auto sampler = Sampler(system, pcm, 1);
+    Patch(sampler, master);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+    const auto out = RenderI16(system);
+    Require(std::equal(pcm.begin(), pcm.end(), out.begin()));
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+
+    for (const std::uint32_t flags : {0x1u, 0x3u, 0x4u, 0x80000000u, 0x80000002u}) {
+        option.flags = flags;
+        Require(SystemOptionThrows(option));
+    }
+}
+
 static void TestUserData() {
     uintptr_t value = 1;
     Require(sceNgs2SystemSetUserData(0x1234, 5) == SCE_NGS2_ERROR_INVALID_SYSTEM_HANDLE);
@@ -761,6 +880,7 @@ static void TestUserData() {
     bool threw = false;
     try {
         sceNgs2SystemGetUserData(system, nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -784,6 +904,7 @@ static void TestUserData() {
     threw = false;
     try {
         sceNgs2RackGetUserData(rack, nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -931,6 +1052,7 @@ static void TestStereoIntoSurround() {
     bool threw = false;
     try {
         sceNgs2SystemRender(system, info, 3);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -1407,6 +1529,81 @@ static void TestRenderCapacity(std::uint32_t waveformType, std::uint32_t channel
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
+static void TestRenderBufferCount() {
+    const auto system = CreateSystem();
+    std::vector<int16_t> out(Grain);
+    Ngs2RenderBufferInfo infos[32];
+    for (int i = 0; i < 32; i++) {
+        infos[i] = Ngs2RenderBufferInfo{out.data(), out.size() * sizeof(int16_t), SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 1};
+    }
+    Require(sceNgs2SystemRender(system, infos, 31) == SCE_NGS2_OK);
+    Require(sceNgs2SystemRender(system, infos, 32) == SCE_NGS2_ERROR_INVALID_NUM_RENDER_BUFFERS);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestRenderBufferTypeValidation() {
+    const auto system = CreateSystem();
+    std::vector<int16_t> out(Grain);
+    Ngs2RenderBufferInfo info0{out.data(), out.size() * sizeof(int16_t), 0x50, 1};
+    Require(sceNgs2SystemRender(system, &info0, 1) == SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE);
+    Ngs2RenderBufferInfo valid{out.data(), out.size() * sizeof(int16_t), SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 1};
+    Ngs2RenderBufferInfo infos[2];
+    infos[0] = valid;
+    infos[1] = Ngs2RenderBufferInfo{out.data(), out.size() * sizeof(int16_t), 0x50, 1};
+    Require(sceNgs2SystemRender(system, infos, 2) == SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestRenderBufferTypeBeforeNull() {
+    const auto system = CreateSystem();
+    std::vector<int16_t> out(Grain);
+    Ngs2RenderBufferInfo info{nullptr, out.size() * sizeof(int16_t), 0x50, 1};
+    Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestRenderBufferNull() {
+    const auto system = CreateSystem();
+    std::vector<int16_t> out(Grain);
+    Ngs2RenderBufferInfo info{nullptr, out.size() * sizeof(int16_t), SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 1};
+    Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_ERROR_INVALID_RENDER_BUFFER);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestRenderRefusedDoesNotRender() {
+    const auto system = CreateSystem();
+    const auto master = Mastering(system, 1);
+    std::vector<std::int16_t> pcm(Grain, 16384);
+    const auto sampler = Sampler(system, pcm, 0);
+    Patch(sampler, master);
+    Event(sampler, SCE_NGS2_VOICE_EVENT_PLAY);
+    std::vector<int16_t> out(Grain * 2, 123);
+    Ngs2RenderBufferInfo infos[2];
+    infos[0] = Ngs2RenderBufferInfo{out.data(), out.size() * sizeof(int16_t), SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 1};
+    infos[1] = Ngs2RenderBufferInfo{out.data() + Grain, out.size() * sizeof(int16_t), 0x50, 1};
+    Require(sceNgs2SystemRender(system, infos, 2) == SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE);
+    Require(std::all_of(out.begin(), out.end(), [](int16_t value) { return value == 123; }));
+    Ngs2SamplerVoiceState state{};
+    Require(sceNgs2VoiceGetState(sampler, &state.voice_state, sizeof(state)) == SCE_NGS2_OK);
+    Require(state.num_decoded_samples == 0);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
+static void TestRenderBigEndianThrows() {
+    const auto system = CreateSystem();
+    std::vector<int16_t> out(Grain);
+    Ngs2RenderBufferInfo infoI16B{out.data(), out.size() * sizeof(int16_t), SCE_NGS2_WAVEFORM_TYPE_PCM_I16B, 1};
+    bool i16bThrows = false;
+    try { sceNgs2SystemRender(system, &infoI16B, 1); } catch (const std::runtime_error&) { i16bThrows = true; }
+    Require(i16bThrows);
+    std::vector<float> outF(Grain);
+    Ngs2RenderBufferInfo infoF32B{outF.data(), outF.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32B, 1};
+    bool f32bThrows = false;
+    try { sceNgs2SystemRender(system, &infoF32B, 1); } catch (const std::runtime_error&) { f32bThrows = true; }
+    Require(f32bThrows);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
 static void TestSilentRenderValidation() {
     const auto system = CreateSystem();
     std::vector<float> out(Grain, 123.0f);
@@ -1425,12 +1622,12 @@ static void TestSilentRenderValidation() {
     invalid();
     info.num_channels = 1;
     info.waveform_type = UINT32_MAX;
-    bool unsupported = false;
-    try { sceNgs2SystemRender(system, &info, 1); } catch (const std::runtime_error&) { unsupported = true; }
-    Require(unsupported);
+    Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_ERROR_INVALID_WAVEFORM_TYPE);
+    Require(std::all_of(out.begin(), out.end(), [](float value) { return value == 123.0f; }));
+    info.waveform_type = SCE_NGS2_WAVEFORM_TYPE_PCM_F32L;
+    info.buffer = nullptr;
+    Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_ERROR_INVALID_RENDER_BUFFER);
     Require(std::all_of(out.begin(), out.end(), [](float value) { return value == 123.0f; }));
-    info = {};
-    Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
 }
 
@@ -1465,7 +1662,9 @@ int main() {
     TestSubmixerMatrix();
     TestReverb();
     TestReverbSetup();
+    TestReverbConversion();
     TestSampleRate();
+    TestSystemOptionFlags();
     TestUserData();
     TestPcmCallbackReset();
     TestPcmCallbackRefill();
@@ -1488,6 +1687,12 @@ int main() {
     TestRenderCapacity<float>(SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, 2);
     TestRenderCapacity<std::int16_t>(SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 1);
     TestRenderCapacity<std::int16_t>(SCE_NGS2_WAVEFORM_TYPE_PCM_I16L, 2);
+    TestRenderBufferCount();
+    TestRenderBufferTypeValidation();
+    TestRenderBufferTypeBeforeNull();
+    TestRenderBufferNull();
+    TestRenderRefusedDoesNotRender();
+    TestRenderBigEndianThrows();
     TestSilentRenderValidation();
     TestAllocator();
     exitSystem = CreateSystem();
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Test.hpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Test.hpp
index 95252adde2..e1c5907df4 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Test.hpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Test.hpp
@@ -6,12 +6,14 @@
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <exception>
 #include <vector>
 
 extern "C" {
 int APS5_VABI sceNgs2ParseWaveformData(const void*, size_t, Ngs2WaveformInfo*);
 int APS5_VABI sceNgs2ParseWaveformFile(const char*, uint32_t, Ngs2WaveformInfo*);
 int APS5_VABI sceNgs2CalcWaveformBlock(const Ngs2WaveformFormat*, uint32_t, uint32_t, Ngs2WaveformBlock*);
+int APS5_VABI sceNgs2GetWaveformFrameInfo(const Ngs2WaveformFormat*, uint32_t*, uint32_t*, uint32_t*, uint32_t*);
 int APS5_VABI sceNgs2SystemResetOption(Ngs2SystemOption*);
 int APS5_VABI sceNgs2SystemQueryBufferSize(const Ngs2SystemOption*, Ngs2ContextBufferInfo*);
 int APS5_VABI sceNgs2SystemCreate(const Ngs2SystemOption*, const Ngs2ContextBufferInfo*, uintptr_t*);
@@ -42,6 +44,8 @@ int APS5_VABI sceNgs2VoiceRunCommands(uintptr_t, const Ngs2VoiceCommand*, size_t
 int APS5_VABI sceNgs2VoiceGetState(uintptr_t, Ngs2VoiceState*, size_t);
 int APS5_VABI sceNgs2VoiceGetStateFlags(uintptr_t, uint32_t*);
 int APS5_VABI sceNgs2VoiceGetOwner(uintptr_t, uintptr_t*, uint32_t*);
+int APS5_VABI sceNgs2VoiceGetMatrixInfo(uintptr_t, uint32_t, Ngs2VoiceMatrixInfo*, size_t);
+int APS5_VABI sceNgs2CustomRackGetModuleInfo(uintptr_t, uint32_t, Ngs2CustomModuleInfo*, size_t);
 int APS5_VABI sceNgs2VoiceGetPortInfo(uintptr_t, uint32_t, Ngs2VoicePortInfo*, size_t);
 int APS5_VABI sceNgs2VoiceQueryInfo(uintptr_t, uint32_t, void*, size_t);
 int APS5_VABI sceNgs2GeomResetListenerParam(Ngs2GeomListenerParam*);
@@ -60,6 +64,18 @@ inline void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
+inline bool FrameInfoThrows(const Ngs2WaveformFormat& format) {
+    std::uint32_t values[4] = {0xa1, 0xa2, 0xa3, 0xa4};
+    bool threw = false;
+    try {
+        sceNgs2GetWaveformFrameInfo(&format, &values[0], &values[1], &values[2], &values[3]);
+    } catch (const std::exception&) {
+        threw = true;
+    }
+    Require(values[0] == 0xa1 && values[1] == 0xa2 && values[2] == 0xa3 && values[3] == 0xa4);
+    return threw;
+}
+
 inline constexpr std::uint32_t Grain = 8;
 
 inline std::vector<std::vector<std::uint64_t>> buffers;
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp
index c5fed18835..7d525001c1 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2VoiceHandles.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2.native/tests/Ngs2Test.hpp"
 #include "Ngs2Test.hpp"
 
 #include <algorithm>
@@ -35,6 +36,55 @@ static void Invalid(std::string_view api, uintptr_t handle) {
     Require(std::all_of(output.begin(), output.end(), [](auto byte) { return byte == 0xa5; }));
 }
 
+template <typename TException>
+static bool MatrixInfoThrows(uintptr_t voice, std::uint32_t matrixId) {
+    Ngs2VoiceMatrixInfo info;
+    std::memset(&info, 0xa5, sizeof(info));
+    bool threw = false;
+    try {
+        sceNgs2VoiceGetMatrixInfo(voice, matrixId, &info, sizeof(info));
+
+    } catch (const TException&) {
+        threw = true;
+    }
+    const auto* bytes = reinterpret_cast<const unsigned char*>(&info);
+    Require(std::all_of(bytes, bytes + sizeof(info), [](auto byte) { return byte == 0xa5; }));
+    return threw;
+}
+
+static void MatrixInfo() {
+    Ngs2VoiceMatrixInfo info;
+    std::memset(&info, 0xa5, sizeof(info));
+    Status(sceNgs2VoiceGetMatrixInfo(0x1234, 0, &info, sizeof(info)), InvalidVoice, "GetMatrixInfo accepted an invalid voice");
+    const auto* bytes = reinterpret_cast<const unsigned char*>(&info);
+    Require(std::all_of(bytes, bytes + sizeof(info), [](auto byte) { return byte == 0xa5; }));
+    Status(sceNgs2VoiceGetMatrixInfo(0x1234, 0, nullptr, sizeof(info)), SCE_NGS2_ERROR_INVALID_OUT_ADDRESS, "GetMatrixInfo checked the voice before null output");
+    Status(sceNgs2VoiceGetMatrixInfo(0x1234, 0, &info, sizeof(info) - 1), SCE_NGS2_ERROR_INVALID_OUT_SIZE, "GetMatrixInfo checked the voice before the output size");
+    const auto system = CreateSystem();
+    const auto rack = CreateRack(system, SCE_NGS2_RACK_ID_SAMPLER);
+    const auto voice = Voice(rack);
+    Status(sceNgs2VoiceGetMatrixInfo(voice, 0, &info, sizeof(info)), SCE_NGS2_OK, "GetMatrixInfo failed for a matrix without levels");
+    Require(info.num_levels == 0 && std::all_of(std::begin(info.levels), std::end(info.levels), [](float level) { return level == 0.0f; }));
+    const float levels[4] = {1.0f, 0.5f, -5.0f, 6.0f};
+    Control(voice, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, 4, levels});
+    std::memset(&info, 0xa5, sizeof(info));
+    Status(sceNgs2VoiceGetMatrixInfo(voice, 0, &info, sizeof(info)), SCE_NGS2_OK, "GetMatrixInfo failed for a matrix with levels");
+    Require(info.num_levels == 4 && info.levels[0] == 1.0f && info.levels[1] == 0.5f && info.levels[2] == -4.0f && info.levels[3] == 4.0f);
+    Require(std::all_of(std::begin(info.levels) + 4, std::end(info.levels), [](float level) { return level == 0.0f; }));
+    std::array<float, 64> full{};
+    for (std::size_t i = 0; i < full.size(); i++) full[i] = static_cast<float>(i) / 64.0f;
+    Control(voice, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, 64, full.data()});
+    Status(sceNgs2VoiceGetMatrixInfo(voice, 0, &info, sizeof(info)), SCE_NGS2_OK, "GetMatrixInfo failed for 64 levels");
+    Require(info.num_levels == 64 && std::equal(full.begin(), full.end(), info.levels));
+    Status(sceNgs2VoiceGetMatrixInfo(voice, 0, &info, sizeof(info) + 1), SCE_NGS2_ERROR_INVALID_OUT_SIZE, "GetMatrixInfo accepted a larger output");
+    Require(MatrixInfoThrows<std::invalid_argument>(voice, 1));
+    const auto master = Voice(CreateRack(system, SCE_NGS2_RACK_ID_MASTERING));
+    Require(MatrixInfoThrows<std::invalid_argument>(master, 0));
+    Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
+    Status(sceNgs2VoiceGetMatrixInfo(voice, 0, &info, sizeof(info)), InvalidVoice, "GetMatrixInfo accepted a voice of a destroyed rack");
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+}
+
 int main(int argc, char** argv) {
     try {
         if (argc > 2 || (argc == 2 && std::find(Names.begin(), Names.end(), std::string_view(argv[1])) == Names.end())) throw std::runtime_error("unknown voice API test selection");
@@ -80,6 +130,7 @@ int main(int argc, char** argv) {
         Require(sceNgs2RackDestroy(rack, nullptr) == SCE_NGS2_OK);
         for (auto name : Names) if (selected(name)) Invalid(name, voice);
         Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+        if (argc == 1) MatrixInfo();
         std::cout << "NGS2 invalid voice errors, outputs and precedence checked\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/prx/libSceNgs2/PendingExports.cpp b/core/libs/prx/libSceNgs2/PendingExports.cpp
index 79edf98b0c..e1942c4923 100644
--- a/core/libs/prx/libSceNgs2/PendingExports.cpp
+++ b/core/libs/prx/libSceNgs2/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNgs2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,10 +6,6 @@
 
 extern "C" {
 
-int APS5_VABI sceNgs2CustomRackGetModuleInfo(std::uintptr_t rackHandle, std::uint32_t moduleIndex, void* outInfo, std::size_t infoSize) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 int APS5_VABI sceNgs2FftInit() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -21,10 +18,6 @@ int APS5_VABI sceNgs2FftQuerySize() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceNgs2GetWaveformFrameInfo(void* format, std::uint32_t* outFrameSize, std::uint32_t* outNumFrameSamples, std::uint32_t* outUnitsPerFrame, std::uint32_t* outNumDelaySamples) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 int APS5_VABI sceNgs2ParseWaveformUser(std::uintptr_t handler, std::uintptr_t userData, void* outInfo) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -37,9 +30,5 @@ int APS5_VABI sceNgs2SystemEnumRackHandles(std::uintptr_t systemHandle, std::uin
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceNgs2VoiceGetMatrixInfo(std::uintptr_t voiceHandle, std::uint32_t matrixId, void* outInfo, std::size_t infoSize) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 }
diff --git a/core/libs/prx/libSceNgs2/include/Api.hpp b/core/libs/prx/libSceNgs2/include/Api.hpp
new file mode 100644
index 0000000000..3398761ed6
--- /dev/null
+++ b/core/libs/prx/libSceNgs2/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNgs2FftInit();
+int APS5_VABI sceNgs2FftProcess();
+int APS5_VABI sceNgs2FftQuerySize();
+int APS5_VABI sceNgs2ParseWaveformUser(std::uintptr_t handler, std::uintptr_t userData, void* outInfo);
+int APS5_VABI sceNgs2SystemEnumHandles(std::uintptr_t* outHandles, std::uint32_t maxHandles);
+int APS5_VABI sceNgs2SystemEnumRackHandles(std::uintptr_t systemHandle, std::uintptr_t* outHandles, std::uint32_t maxHandles);
+
+}
diff --git a/core/libs/prx/libSceNgs2/libSceNgs2.hpp b/core/libs/prx/libSceNgs2/libSceNgs2.hpp
new file mode 100644
index 0000000000..db4f270ed6
--- /dev/null
+++ b/core/libs/prx/libSceNgs2/libSceNgs2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNgs2/include/Api.hpp"
diff --git a/core/libs/prx/libSceNotification/Export.cpp b/core/libs/prx/libSceNotification/Export.cpp
index 90362f2991..3431c8dbc3 100644
--- a/core/libs/prx/libSceNotification/Export.cpp
+++ b/core/libs/prx/libSceNotification/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNotification/include/Api.hpp"
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceNotification/include/Api.hpp b/core/libs/prx/libSceNotification/include/Api.hpp
new file mode 100644
index 0000000000..24cb956b82
--- /dev/null
+++ b/core/libs/prx/libSceNotification/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNotificationSend(int type, std::uint8_t flag, std::uint8_t* message);
+int APS5_VABI sceNotificationSendById(int type, std::uint8_t flag, std::uint8_t* id, std::uint8_t* jsonData);
+int APS5_VABI sceNotificationShowPsButtonPersistentBanner(std::uint8_t* jsonParam);
+void APS5_VABI sceNotificationHidePsButtonPersistentBanner();
+
+}
diff --git a/core/libs/prx/libSceNotification/libSceNotification.hpp b/core/libs/prx/libSceNotification/libSceNotification.hpp
new file mode 100644
index 0000000000..780084c485
--- /dev/null
+++ b/core/libs/prx/libSceNotification/libSceNotification.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNotification/include/Api.hpp"
diff --git a/core/libs/prx/libSceNotificationClient/libSceNotificationClient.hpp b/core/libs/prx/libSceNotificationClient/libSceNotificationClient.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNotificationClient/libSceNotificationClient.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNpAuth/Export.cpp b/core/libs/prx/libSceNpAuth/Export.cpp
index 265c3fd4df..2d2b89ec9d 100644
--- a/core/libs/prx/libSceNpAuth/Export.cpp
+++ b/core/libs/prx/libSceNpAuth/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpAuth/include/Api.hpp"
 #include <atomic>
 #include <array>
 #include <cstddef>
@@ -84,7 +85,6 @@ int APS5_VABI sceNpAuthGetAuthorizationCodeV3(int req_id, const void* param, voi
  if (it == g_requests.end()) return ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND;
  if (it->second.processed) return ORBIS_NP_AUTH_ERROR_INVALID_ARGUMENT;
  if (it->second.aborted) {
-  it->second.result = ORBIS_NP_AUTH_ERROR_ABORTED;
   return ORBIS_NP_AUTH_ERROR_ABORTED;
  }
  it->second.processed = true;
@@ -102,7 +102,6 @@ int APS5_VABI sceNpAuthGetIdTokenV3(int req_id, const void* param, void* id_toke
  if (it == g_requests.end()) return ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND;
  if (it->second.processed) return ORBIS_NP_AUTH_ERROR_INVALID_ARGUMENT;
  if (it->second.aborted) {
-  it->second.result = ORBIS_NP_AUTH_ERROR_ABORTED;
   return ORBIS_NP_AUTH_ERROR_ABORTED;
  }
  it->second.processed = true;
@@ -125,7 +124,7 @@ int APS5_VABI sceNpAuthPollAsync(int req_id, int* result) {
  std::lock_guard lock(g_requestMutex);
  auto it = g_requests.find(req_id);
  if (it == g_requests.end()) return ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND;
- if (!it->second.isAsync || (!it->second.processed && !it->second.aborted)) return ORBIS_NP_AUTH_ERROR_INVALID_ID;
+ if (!it->second.isAsync || !it->second.processed) return ORBIS_NP_AUTH_ERROR_INVALID_ID;
  if (!it->second.polled) {
   it->second.polled = true;
   return NP_POLL_ASYNC_RUNNING;
@@ -154,7 +153,7 @@ int APS5_VABI sceNpAuthWaitAsync(int req_id, int* result) {
  std::lock_guard lock(g_requestMutex);
  auto it = g_requests.find(req_id);
  if (it == g_requests.end()) return ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND;
- if (!it->second.isAsync || (!it->second.processed && !it->second.aborted)) return ORBIS_NP_AUTH_ERROR_INVALID_ID;
+ if (!it->second.isAsync || !it->second.processed) return ORBIS_NP_AUTH_ERROR_INVALID_ID;
  *result = it->second.result;
  return NP_POLL_ASYNC_FINISHED;
 }
diff --git a/core/libs/prx/libSceNpAuth/include/Api.hpp b/core/libs/prx/libSceNpAuth/include/Api.hpp
new file mode 100644
index 0000000000..cb003d3a93
--- /dev/null
+++ b/core/libs/prx/libSceNpAuth/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpAuthAbortRequest(int reqId);
+int APS5_VABI sceNpAuthCreateAsyncRequest(const void* param);
+int APS5_VABI sceNpAuthCreateRequest(void);
+int APS5_VABI sceNpAuthDeleteRequest(int reqId);
+int APS5_VABI sceNpAuthGetAuthorizedAppCode(std::int32_t requestId, const NpAuthAuthorizedAppCodeParameter* parameter, char* code, std::int32_t* issuerId, bool* authorizationRequired);
+int APS5_VABI sceNpAuthGetAuthorizationCodeV3(int reqId, const void* param, void* authCode, int* issuerId);
+int APS5_VABI sceNpAuthGetIdTokenV3(int reqId, const void* param, void* idToken);
+int APS5_VABI sceNpAuthGetAuthorizationCode(int reqId, const void* param, void* authCode);
+int APS5_VABI sceNpAuthGetIdToken(int reqId, const void* param, void* idToken);
+int APS5_VABI sceNpAuthPollAsync(int reqId, int* result);
+int APS5_VABI sceNpAuthSetTimeout(std::int32_t requestId, std::int32_t resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connectTimeout, std::uint32_t sendTimeout, std::uint32_t receiveTimeout);
+int APS5_VABI sceNpAuthWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpAuthGetAuthorizationCodeA(int reqId, const void* param, void* authCode, int* issuerId);
+int APS5_VABI sceNpAuthGetIdTokenA(int reqId, const void* param, void* token);
+
+}
diff --git a/core/libs/prx/libSceNpAuth/libSceNpAuth.hpp b/core/libs/prx/libSceNpAuth/libSceNpAuth.hpp
new file mode 100644
index 0000000000..1f4aaf4f77
--- /dev/null
+++ b/core/libs/prx/libSceNpAuth/libSceNpAuth.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpAuth/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp
index 9244dedeea..e483fc0a9d 100644
--- a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp
+++ b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -6,8 +8,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp
new file mode 100644
index 0000000000..c2514b916f
--- /dev/null
+++ b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpAuthAuthorizedAppDialogInitialize(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogOpen(const NpAuthAuthorizedAppDialogParam* param);
+int APS5_VABI sceNpAuthAuthorizedAppDialogUpdateStatus(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogGetStatus(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogGetResult(std::int32_t* result);
+int APS5_VABI sceNpAuthAuthorizedAppDialogClose(void);
+int APS5_VABI sceNpAuthAuthorizedAppDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceNpAuthAuthorizedAppDialog/libSceNpAuthAuthorizedAppDialog.hpp b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/libSceNpAuthAuthorizedAppDialog.hpp
new file mode 100644
index 0000000000..c091f6db11
--- /dev/null
+++ b/core/libs/prx/libSceNpAuthAuthorizedAppDialog/libSceNpAuthAuthorizedAppDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpCommerce/Export.cpp b/core/libs/prx/libSceNpCommerce/Export.cpp
index e224383c46..a94c5c9e82 100644
--- a/core/libs/prx/libSceNpCommerce/Export.cpp
+++ b/core/libs/prx/libSceNpCommerce/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpCommerce/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -7,8 +9,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
@@ -170,8 +170,7 @@ int APS5_VABI sceNpCommerceDialogOpen2(const NpCommerceDialogParam2* param) {
 }
 
 int APS5_VABI sceNpCommerceDialogInitializeInternal() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceNpCommerceDialogInitialize();
 }
 
 }
diff --git a/core/libs/prx/libSceNpCommerce/include/Api.hpp b/core/libs/prx/libSceNpCommerce/include/Api.hpp
new file mode 100644
index 0000000000..ddb745fc4a
--- /dev/null
+++ b/core/libs/prx/libSceNpCommerce/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpCommerceDialogInitialize();
+int APS5_VABI sceNpCommerceDialogOpen(const NpCommerceDialogParam* param);
+int APS5_VABI sceNpCommerceDialogUpdateStatus(void);
+int APS5_VABI sceNpCommerceDialogGetStatus(void);
+int APS5_VABI sceNpCommerceDialogGetResult(NpCommerceDialogResult* result);
+int APS5_VABI sceNpCommerceDialogClose(void);
+int APS5_VABI sceNpCommerceDialogTerminate();
+int APS5_VABI sceNpCommerceHidePsStoreIcon(void);
+int APS5_VABI sceNpCommerceShowPsStoreIcon(int pos);
+int APS5_VABI sceNpCommerceSetPsStoreIconLayout(int layout);
+int APS5_VABI sceNpCommerceDialogOpen2(const NpCommerceDialogParam2* param);
+int APS5_VABI sceNpCommerceDialogInitializeInternal();
+
+}
diff --git a/core/libs/prx/libSceNpCommerce/libSceNpCommerce.hpp b/core/libs/prx/libSceNpCommerce/libSceNpCommerce.hpp
new file mode 100644
index 0000000000..240d2d12fe
--- /dev/null
+++ b/core/libs/prx/libSceNpCommerce/libSceNpCommerce.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpCommerce/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpCommon/CMakeLists.txt b/core/libs/prx/libSceNpCommon/CMakeLists.txt
index f85817c30e..bab2481853 100644
--- a/core/libs/prx/libSceNpCommon/CMakeLists.txt
+++ b/core/libs/prx/libSceNpCommon/CMakeLists.txt
@@ -2,5 +2,7 @@ add_library(libSceNpCommon SHARED EXCLUDE_FROM_ALL PendingExports.cpp)
 if(EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp")
     target_sources(libSceNpCommon PRIVATE Export.cpp)
 endif()
+target_sources(libSceNpCommon PRIVATE Runtime.cpp Strings.cpp)
 target_include_directories(libSceNpCommon PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceNpCommon PRIVATE libc libkernel libSceRtc libSceUserService)
 configure_windows_unwind(libSceNpCommon)
diff --git a/core/libs/prx/libSceNpCommon/Export.cpp b/core/libs/prx/libSceNpCommon/Export.cpp
new file mode 100644
index 0000000000..77a7b33fc9
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/Export.cpp
@@ -0,0 +1,175 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include <cctype>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+constexpr int NP_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550003);
+constexpr int NP_ERROR_INVALID_PLATFORM_TYPE = static_cast<int>(0x80550004);
+constexpr int NP_UTIL_ERROR_NOT_MATCH = static_cast<int>(0x80550609);
+constexpr int NP_LW_COND_ERROR_TIMEDOUT = static_cast<int>(0x8055800B);
+constexpr int NP_LW_MUTEX_ERROR_BUSY = static_cast<int>(0x8055800F);
+constexpr int KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
+constexpr int KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
+constexpr std::size_t ONLINE_ID_MAX_LENGTH = 16;
+constexpr int MUTEX_TYPE_RECURSIVE = 2;
+constexpr KernelClockid CLOCK_MONOTONIC_ID = 4;
+
+static_assert(sizeof(NpIdFull) == 36);
+
+static_assert(sizeof(SceKernelSystemSwVersion) == 0x28);
+
+int compareBytes(const std::uint8_t* lhs, const std::uint8_t* rhs, std::size_t count) {
+    for (std::size_t i = 0; i < count; ++i) {
+        if (lhs[i] != rhs[i]) return lhs[i] < rhs[i] ? -1 : 1;
+    }
+    return 0;
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI sceNpCmpOnlineId(const NpOnlineId* onlineId1, const NpOnlineId* onlineId2) {
+    if (!onlineId1 || !onlineId2) return NP_ERROR_INVALID_ARGUMENT;
+    if (std::strncmp(onlineId1->data, onlineId2->data, ONLINE_ID_MAX_LENGTH) != 0) return NP_UTIL_ERROR_NOT_MATCH;
+    return 0;
+}
+
+int APS5_VABI sceNpCmpNpIdInOrder(const NpIdFull* npId1, const NpIdFull* npId2, std::int32_t* order) {
+    if (!npId1 || !npId2 || !order) return NP_ERROR_INVALID_ARGUMENT;
+    int compare = std::strncmp(npId1->handle.data, npId2->handle.data, ONLINE_ID_MAX_LENGTH);
+    if (compare == 0) compare = compareBytes(npId1->opt, npId2->opt, sizeof(npId1->opt));
+    if (compare == 0) compare = compareBytes(npId1->reserved, npId2->reserved, sizeof(npId1->reserved));
+    *order = compare < 0 ? -1 : compare > 0 ? 1 : 0;
+    return 0;
+}
+
+int APS5_VABI sceNpGetPlatformType(const NpIdFull* npId) {
+    constexpr std::uint32_t TAG_PS3 = 0x00337370;
+    constexpr std::uint32_t TAG_VITA = 0x32707370;
+    constexpr std::uint32_t TAG_PS4 = 0x00347370;
+    if (!npId) return NP_ERROR_INVALID_ARGUMENT;
+    if (npId->opt[4] == 0) return 0;
+    std::uint32_t tag = 0;
+    std::memcpy(&tag, npId->opt + 4, sizeof(tag));
+    switch (tag) {
+    case TAG_PS3: return 1;
+    case TAG_VITA: return 2;
+    case TAG_PS4: return 3;
+    default: return NP_ERROR_INVALID_PLATFORM_TYPE;
+    }
+}
+
+int APS5_VABI sceNpIntIsValidOnlineId(const NpOnlineId* onlineId) {
+    if (!onlineId || onlineId->data[ONLINE_ID_MAX_LENGTH] != 0) return 0;
+    const std::size_t length = strnlen(onlineId->data, ONLINE_ID_MAX_LENGTH + 1);
+    if (length < 3 || length > ONLINE_ID_MAX_LENGTH) return 0;
+    if (!std::isalnum(static_cast<unsigned char>(onlineId->data[0]))) return 0;
+    for (std::size_t i = 1; i < length; ++i) {
+        const unsigned char character = static_cast<unsigned char>(onlineId->data[i]);
+        if (!std::isalnum(character) && character != '_' && character != '-') return 0;
+    }
+    return 1;
+}
+
+int APS5_VABI sceNpMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags) {
+    PthreadMutexattr attr = nullptr;
+    int result = scePthreadMutexattrInit(&attr);
+    if (result != 0) return result;
+    if (flags & 1) result = scePthreadMutexattrSettype(&attr, MUTEX_TYPE_RECURSIVE);
+    if (result == 0) result = scePthreadMutexInit(mutex, &attr, name);
+    scePthreadMutexattrDestroy(&attr);
+
+    return result;
+}
+
+int APS5_VABI sceNpMutexDestroy(PthreadMutex* mutex) {
+    return scePthreadMutexDestroy(mutex);
+}
+
+int APS5_VABI sceNpMutexLock(PthreadMutex* mutex) {
+    return scePthreadMutexLock(mutex);
+}
+
+int APS5_VABI sceNpMutexTryLock(PthreadMutex* mutex) {
+    const int result = scePthreadMutexTrylock(mutex);
+    return result == KERNEL_ERROR_EBUSY ? NP_LW_MUTEX_ERROR_BUSY : result;
+}
+
+int APS5_VABI sceNpMutexUnlock(PthreadMutex* mutex) {
+    return scePthreadMutexUnlock(mutex);
+}
+
+int APS5_VABI sceNpLwMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags) {
+    return sceNpMutexInit(mutex, name, flags);
+}
+
+int APS5_VABI sceNpLwMutexDestroy(PthreadMutex* mutex) {
+    return sceNpMutexDestroy(mutex);
+}
+
+int APS5_VABI sceNpLwMutexLock(PthreadMutex* mutex) {
+    return sceNpMutexLock(mutex);
+}
+
+int APS5_VABI sceNpLwMutexTryLock(PthreadMutex* mutex) {
+    return sceNpMutexTryLock(mutex);
+}
+
+int APS5_VABI sceNpLwMutexUnlock(PthreadMutex* mutex) {
+    return sceNpMutexUnlock(mutex);
+}
+
+int APS5_VABI sceNpCondInit(PthreadCond* cond, const char* name, std::uint64_t) {
+    PthreadCondattr attr = nullptr;
+    int result = scePthreadCondattrInit(&attr);
+    if (result != 0) return result;
+    result = scePthreadCondInit(cond, &attr, name);
+    scePthreadCondattrDestroy(&attr);
+
+    return result;
+}
+
+int APS5_VABI sceNpCondDestroy(PthreadCond* cond) {
+    return scePthreadCondDestroy(cond);
+}
+
+int APS5_VABI sceNpCondSignal(PthreadCond* cond) {
+    return scePthreadCondSignal(cond);
+}
+
+int APS5_VABI sceNpCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, std::uint32_t usec) {
+    if (usec == 0) return scePthreadCondWait(cond, mutex);
+    const int result = scePthreadCondTimedwait(cond, mutex, usec);
+    return result == KERNEL_ERROR_ETIMEDOUT ? NP_LW_COND_ERROR_TIMEDOUT : result;
+}
+
+int APS5_VABI sceNpJoinThread(Pthread thread, void** retval) {
+    return scePthreadJoin(thread, retval);
+}
+
+int APS5_VABI sceNpGetSystemClockUsec(std::int64_t* usec) {
+    KernelTimespec now{};
+    const int result = sceKernelClockGettime(CLOCK_MONOTONIC_ID, &now);
+    if (result == 0) *usec = now.tv_sec * 1000000 + now.tv_nsec / 1000;
+    return result;
+}
+
+void APS5_VABI sceNpGetSdkVersion(char* version) {
+    SceKernelSystemSwVersion swVersion{};
+    swVersion.size = sizeof(swVersion);
+    sceKernelGetSystemSwVersion_nid_postfix(&swVersion);
+
+    const std::uint32_t hex = swVersion.version;
+    std::snprintf(version, 8, "%u.%02u", ((hex >> 24) & 0xF) + (hex >> 28) * 10, ((hex >> 16) & 0xF) + ((hex >> 20) & 0xF) * 10);
+}
+
+}
diff --git a/core/libs/prx/libSceNpCommon/PendingExports.cpp b/core/libs/prx/libSceNpCommon/PendingExports.cpp
index d2daed1a92..7c3808ebf3 100644
--- a/core/libs/prx/libSceNpCommon/PendingExports.cpp
+++ b/core/libs/prx/libSceNpCommon/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCommon/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,106 +6,6 @@
 
 extern "C" {
 
-int APS5_VABI sceNpAllocateKernelMemoryNoAlignment(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAllocateKernelMemoryWithAlignment(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpArchInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpArchTerm(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAtomicCas32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAtomicDec32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpAtomicInc32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64Decoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64Encoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64GetDecodeSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64UrlDecoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64UrlEncoder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpBase64UrlGetDecodeSize(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutInitCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutStartOnCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutStartOnCtx64(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutStopOnCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCalloutTermCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCancelEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpClearEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpCloseEventFlag(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -115,236 +16,21 @@ int APS5_VABI sceNpCloseSema(void) {
     return 0;
 }
 
-int APS5_VABI sceNpCmpNpId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCmpNpIdInOrder(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCmpOnlineId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondSignal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondSignalAll(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondSignalTo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondTimedwait(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCondWait(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCreateEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCreateSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpCreateThread(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDbgAssignDebugId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDbgDumpBinary(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDbgDumpText(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDeleteEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpDeleteSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpFreeKernelMemory(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpGetNavSdkVersion(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpGetPlatformType(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetProcessId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetRandom(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetSdkVersion(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetSdkVersionUInt(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGetSystemClockUsec(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocator(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocatorEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocatorExPtr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpGlobalHeapGetAllocatorPtr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapGetAllocator(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapGetStat(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHeapShowStat(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpHexToInt(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpInt32ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpInt64ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpIntGetPlatformType(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpIntIsOnlineIdString(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpIntIsValidOnlineId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpIntSetPlatformType(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpIntToHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpIpc2ClientInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpIpc2ClientTerm(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpJoinThread(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpJsonParse(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -375,146 +61,11 @@ int APS5_VABI sceNpJsonParseInit(void) {
     return 0;
 }
 
-int APS5_VABI sceNpLwCondDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondSignal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondSignalAll(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondSignalTo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwCondWait(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwMutexDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwMutexInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwMutexLock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwMutexTryLock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpLwMutexUnlock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapGetAllocator(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapGetAllocatorEx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMemoryHeapInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMutexDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMutexInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMutexLock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMutexTryLock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpMutexUnlock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpOpenEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpOpenSema(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpPanic(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpPollEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpPollSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpRtcConvertToPosixTime(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpRtcFormatRFC3339(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpRtcParseRFC3339(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpServerErrorJsonGetErrorCode(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -540,91 +91,11 @@ int APS5_VABI sceNpServerErrorJsonParseMultiInit(void) {
     return 0;
 }
 
-int APS5_VABI sceNpSetEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpSetPlatformType(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpSignalSema(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrBuildHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrParseHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToInt32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToInt64(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToUInt32(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrToUInt64(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrcpyToBuf(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrnParseHex(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpStrncpyToBuf(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpThreadGetId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUInt32ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUInt64ToStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUserGetUserIdList(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilBuildTitleId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilCanonicalizeNpIdForPs4(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -635,11 +106,6 @@ int APS5_VABI sceNpUtilCanonicalizeNpIdForPsp2(void) {
     return 0;
 }
 
-int APS5_VABI sceNpUtilCmpAccountId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilGetDateSetAuto(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -675,36 +141,11 @@ int APS5_VABI sceNpUtilGetNpDebug(void) {
     return 0;
 }
 
-int APS5_VABI sceNpUtilGetNpLanguageCode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilGetNpLanguageCode2(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilGetNpLanguageCode2Str(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilGetNpLanguageCodeStr(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilGetNpTestPatch(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpUtilGetNthChar(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilGetShareTitleCheck(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -735,29 +176,9 @@ int APS5_VABI sceNpUtilGetWebTraceSetting(void) {
     return 0;
 }
 
-int APS5_VABI sceNpUtilHttpUrlEncode(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpUtilJidToNpId(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpUtilJsonEscape(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpUtilJsonGetOneChar(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-}
-
-int APS5_VABI sceNpUtilJsonUnescape(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
 }
diff --git a/core/libs/prx/libSceNpCommon/Runtime.cpp b/core/libs/prx/libSceNpCommon/Runtime.cpp
new file mode 100644
index 0000000000..8c8edda9b4
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/Runtime.cpp
@@ -0,0 +1,771 @@
+#include "prx/libSceSaveData/SaveDataCore.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
+#include "prx/libSceRtc/include/Rtc.hpp"
+#include <algorithm>
+#include <atomic>
+#include <iterator>
+#include <mutex>
+#include <random>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include "SceTypes.hpp"
+#include "prx/libc/include/MallocManagedSize.hpp"
+#include "prx/libc/include/General.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+
+static_assert(sizeof(NpCallout) == 0x28);
+
+static_assert(sizeof(NpCalloutContext) == 0x28);
+
+static_assert(sizeof(NpKernelMemory) == 0x18);
+
+static_assert(sizeof(NpMemoryHeap) == 0x20);
+
+namespace {
+
+constexpr int NP_ERROR_NULL_ARGUMENT = static_cast<int>(0x80550003);
+constexpr int NP_ERROR_IPC_ALREADY_INITIALIZED = static_cast<int>(0x80559D00);
+constexpr int NP_ERROR_IPC_NOT_INITIALIZED = static_cast<int>(0x80559D01);
+constexpr int NP_ERROR_ONLINE_ID_MISMATCH = static_cast<int>(0x80550609);
+constexpr int NP_ERROR_INVALID_NP_ID = static_cast<int>(0x80550605);
+constexpr std::size_t NP_ID_OPT_OFFSET = 0x14;
+constexpr std::size_t NP_ID_PLATFORM_OFFSET = 0x18;
+constexpr std::size_t NP_ID_TERMINATOR_FLAG_OFFSET = 0x1C;
+
+std::uint32_t NpIdWord(const std::uint8_t* npId, std::size_t offset) {
+    std::uint32_t value;
+    std::memcpy(&value, npId + offset, sizeof(value));
+    return value;
+}
+constexpr std::size_t NP_ONLINE_ID_MAX = 16;
+constexpr std::size_t NP_ONLINE_ID_MIN = 3;
+constexpr int NP_ERROR_INVALID_ARGUMENT_UTIL = static_cast<int>(0x80550601);
+constexpr std::size_t NP_LANGUAGE_CODE_SIZE = 6;
+constexpr std::size_t NP_LANGUAGE_CODE2_SIZE = 0x24;
+
+struct NpLanguageCodes {
+    const char* code;
+    const char* tag;
+};
+
+constexpr NpLanguageCodes NP_LANGUAGE_CODES[] {
+    {"ja", "ja-JP"}, {"en", "en-US"}, {"fr", "fr-FR"}, {"es", "es-ES"}, {"de", "de-DE"}, {"it", "it-IT"},
+    {"nl", "nl-NL"}, {"pt", "pt-PT"}, {"ru", "ru-RU"}, {"ko", "ko-KR"}, {"zh-TW", "zh-Hant"}, {"zh-CN", "zh-Hans"},
+    {"fi", "fi-FI"}, {"sv", "sv-SE"}, {"da", "da-DK"}, {"no", "no-NO"}, {"pl", "pl-PL"}, {"pt-BR", "pt-BR"},
+    {"en-GB", "en-GB"}, {"tr", "tr-TR"}, {"es-MX", "es-419"}, {"ar", "ar-AE"}, {"fr-CA", "fr-CA"}, {"cs", "cs-CZ"},
+    {"hu", "hu-HU"}, {"el", "el-GR"}, {"ro", "ro-RO"}, {"th", "th-TH"}, {"vi", "vi-VN"}, {"id", "id-ID"},
+    {"uk", "uk-UA"},
+};
+
+const NpLanguageCodes* FindLanguageCodes(int language) {
+    if (language < 0 || static_cast<std::size_t>(language) >= std::size(NP_LANGUAGE_CODES)) return nullptr;
+    return &NP_LANGUAGE_CODES[language];
+}
+
+void CopyText(char* out, const char* text, std::size_t size) {
+    std::strncpy(out, text, size - 1);
+    out[size - 1] = '\0';
+}
+
+std::atomic<std::uint32_t> g_debugIds {0};
+
+constexpr int NP_UTIL_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80550602);
+constexpr int NP_UTIL_ERROR_OUT_OF_RANGE = static_cast<int>(0x8055060A);
+constexpr std::size_t NP_TITLE_ID_SIZE = 13;
+constexpr std::uint8_t NP_TITLE_ID_INDEX_MAX = 99;
+constexpr std::size_t NP_DUMP_LINE_BYTES = 16;
+
+bool IsAsciiLetter(char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z');
+}
+
+bool IsOnlineIdText(const char* text) {
+    const std::size_t length = std::strlen(text);
+    if (length < NP_ONLINE_ID_MIN || length > NP_ONLINE_ID_MAX || !IsAsciiLetter(text[0])) return false;
+    return std::all_of(text + 1, text + length, [](char c) {
+        return IsAsciiLetter(c) || (c >= '0' && c <= '9') || c == '_' || c == '-';
+    });
+}
+
+constexpr int NP_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80558008);
+constexpr std::size_t NP_SDK_VERSION_SIZE = 8;
+constexpr std::size_t NP_RFC3339_BUFFER_MIN = 0x80;
+constexpr std::size_t NP_USER_ID_LIST_SIZE = 20;
+constexpr int USER_ID_INVALID = -1;
+constexpr KernelClockid NP_SYSTEM_CLOCK = 4;
+
+static_assert(sizeof(SceKernelSystemSwVersion) == 0x28);
+
+std::uint32_t SystemVersion() {
+    SceKernelSystemSwVersion version {};
+    version.size = sizeof(version);
+    sceKernelGetSystemSwVersion_nid_postfix(&version);
+
+    return version.version;
+}
+
+int BcdPair(std::uint32_t value, int shift) {
+    return static_cast<int>((value >> (shift + 4)) & 0xF) * 10 + static_cast<int>((value >> shift) & 0xF);
+}
+
+constexpr int NP_ERROR_OUT_OF_MEMORY = static_cast<int>(0x80550005);
+constexpr int NP_ERROR_NULL_OBJECT = static_cast<int>(0x80558005);
+constexpr int NP_ERROR_HEAP_CREATE = static_cast<int>(0x8055800A);
+constexpr std::uint64_t NP_KERNEL_MEMORY_ALIGNMENT = 0x4000;
+constexpr int NP_KERNEL_MEMORY_PROTECTION = 3;
+constexpr std::size_t NP_GLOBAL_HEAP_SIZE = 0x80000;
+constexpr char NP_GLOBAL_HEAP_NAME[] = "NpCommonGlobalHeap";
+constexpr std::size_t NP_IPC_CLIENT_HEAP_SIZE = 0x10000;
+constexpr char NP_IPC_CLIENT_HEAP_NAME[] = "NpCommonIpcClientHeap";
+
+void* APS5_VABI HeapAllocate(std::size_t size, void* context) {
+    auto* heap = static_cast<NpHeap*>(context);
+    return heap->mspace != nullptr ? sceLibcMspaceMalloc_nid_postfix(heap->mspace, size) : nullptr;
+}
+
+void* APS5_VABI HeapReallocate(void* pointer, std::size_t size, void* context) {
+    auto* heap = static_cast<NpHeap*>(context);
+    return heap->mspace != nullptr ? sceLibcMspaceRealloc_nid_postfix(heap->mspace, pointer, size) : nullptr;
+}
+
+void APS5_VABI HeapRelease(void* pointer, void* context) {
+    auto* heap = static_cast<NpHeap*>(context);
+    if (heap->mspace != nullptr && pointer != nullptr) sceLibcMspaceFree_nid_postfix(heap->mspace, pointer);
+}
+
+void* APS5_VABI MemoryHeapAllocate(std::size_t size, void* context) {
+    return HeapAllocate(size, &static_cast<NpMemoryHeap*>(context)->heap);
+}
+
+void* APS5_VABI MemoryHeapReallocate(void* pointer, std::size_t size, void* context) {
+    return HeapReallocate(pointer, size, &static_cast<NpMemoryHeap*>(context)->heap);
+}
+
+void APS5_VABI MemoryHeapRelease(void* pointer, void* context) {
+    HeapRelease(pointer, &static_cast<NpMemoryHeap*>(context)->heap);
+}
+
+std::uint64_t AlignKernelMemory(std::uint64_t size) {
+    const std::uint64_t remainder = size & (NP_KERNEL_MEMORY_ALIGNMENT - 1);
+    return remainder == 0 ? size : size + NP_KERNEL_MEMORY_ALIGNMENT - remainder;
+}
+
+int MapKernelMemory(NpKernelMemory* memory, std::uint64_t size, const char* name) {
+    memory->reserved = 0;
+    memory->size = size;
+    return sceKernelMapNamedFlexibleMemory(&memory->address, size, NP_KERNEL_MEMORY_PROTECTION, 0, name);
+}
+
+void UnmapKernelMemory(NpKernelMemory* memory) {
+    if (memory->address != nullptr) sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory->address), memory->size);
+    memory->address = nullptr;
+}
+
+int InitHeap(NpHeap* heap, void* base, std::size_t size, const char* name) {
+    heap->mspace = sceLibcMspaceCreate_nid_postfix(name, base, size, 0);
+    return heap->mspace != nullptr ? 0 : NP_ERROR_HEAP_CREATE;
+}
+
+void DestroyHeap(NpHeap* heap) {
+    if (heap->mspace == nullptr) return;
+    sceLibcMspaceDestroy_nid_postfix(heap->mspace);
+
+    heap->mspace = nullptr;
+}
+
+int InitMemoryHeap(NpMemoryHeap* heap, std::uint64_t size, const char* name) {
+    if (heap == nullptr) return NP_ERROR_NULL_OBJECT;
+    int result = MapKernelMemory(&heap->memory, AlignKernelMemory(size), name);
+    if (result < 0) return result;
+    result = InitHeap(&heap->heap, heap->memory.address, heap->memory.size, name);
+    if (result >= 0) return result;
+    UnmapKernelMemory(&heap->memory);
+    *heap = {};
+    return result;
+}
+
+void DestroyMemoryHeap(NpMemoryHeap* heap) {
+    DestroyHeap(&heap->heap);
+    UnmapKernelMemory(&heap->memory);
+}
+
+NpAllocator MemoryHeapAllocator(NpMemoryHeap* heap) {
+    return {MemoryHeapAllocate, MemoryHeapReallocate, MemoryHeapRelease, heap};
+}
+
+constexpr int NP_ERROR_NOT_INITIALIZED = static_cast<int>(0x80558001);
+constexpr int NP_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80558002);
+constexpr int NP_ERROR_ALREADY_QUEUED = static_cast<int>(0x80558006);
+constexpr std::uint64_t NP_CALLOUT_MAX_WAIT = 0xFFFFFFFF;
+
+std::mutex g_randomMutex;
+std::mt19937 g_random {std::random_device {}()};
+
+NpMemoryHeap g_globalHeap {};
+NpAllocator g_globalAllocator {};
+NpAllocatorEx g_globalAllocatorEx {};
+int g_archReferences = 0;
+std::mutex g_archMutex;
+std::mutex g_ipcClientMutex;
+bool g_ipcClientInitialized = false;
+NpMemoryHeap g_ipcClientHeap {};
+
+constexpr int KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
+constexpr int KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
+constexpr int NP_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80558009);
+constexpr int NP_ERROR_TIMEOUT = static_cast<int>(0x8055800B);
+constexpr int NP_ERROR_EVENT_FLAG_BUSY = static_cast<int>(0x8055800C);
+constexpr int NP_ERROR_SEMA_BUSY = static_cast<int>(0x8055800D);
+constexpr int NP_ERROR_MUTEX_BUSY = static_cast<int>(0x8055800F);
+constexpr std::uint32_t NP_MUTEX_FLAG_RECURSIVE = 1;
+constexpr int PTHREAD_MUTEX_TYPE_RECURSIVE = 2;
+constexpr std::uint32_t NP_SEMA_FLAG_PRIORITY = 1;
+constexpr std::uint32_t KERNEL_SEMA_ATTR_FIFO = 1;
+constexpr std::uint32_t KERNEL_SEMA_ATTR_PRIORITY_SHIFT = 8;
+constexpr int NP_THREAD_EXPLICIT_SCHED = 0;
+constexpr int NP_THREAD_SCHED_POLICY = 1;
+
+int NpResult(int result) {
+    return result < 0 ? result : 0;
+}
+
+int NpBusyResult(int result, int busy) {
+    return result == KERNEL_ERROR_EBUSY ? busy : NpResult(result);
+}
+
+int InitMutex(PthreadMutex* mutex, const char* name, std::uint32_t flags) {
+    PthreadMutexattr attr {};
+    int result = scePthreadMutexattrInit(&attr);
+    if (result < 0) return result;
+    if ((flags & NP_MUTEX_FLAG_RECURSIVE) != 0) result = scePthreadMutexattrSettype(&attr, PTHREAD_MUTEX_TYPE_RECURSIVE);
+    if (result >= 0) result = scePthreadMutexInit(mutex, &attr, name);
+    scePthreadMutexattrDestroy(&attr);
+
+    return NpResult(result);
+}
+
+int InitCond(PthreadCond* cond, const char* name) {
+    PthreadCondattr attr {};
+    const int result = scePthreadCondattrInit(&attr);
+    if (result < 0) return result;
+    const int created = scePthreadCondInit(cond, &attr, name);
+    scePthreadCondattrDestroy(&attr);
+
+    return created;
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI sceNpAtomicCas32(std::int32_t* value, std::int32_t expected, std::int32_t desired) {
+    std::atomic_ref<std::int32_t>(*value).compare_exchange_strong(expected, desired);
+    return expected;
+}
+
+int APS5_VABI sceNpAtomicInc32(std::int32_t* value) {
+    return std::atomic_ref<std::int32_t>(*value).fetch_add(1);
+}
+
+int APS5_VABI sceNpAtomicDec32(std::int32_t* value) {
+    return std::atomic_ref<std::int32_t>(*value).fetch_sub(1);
+}
+
+int APS5_VABI sceNpCondSignalAll(PthreadCond* cond) {
+    return scePthreadCondBroadcast(cond);
+}
+
+int APS5_VABI sceNpCondSignalTo(PthreadCond* cond, Pthread thread) {
+    return scePthreadCondSignalto(cond, thread);
+}
+
+int APS5_VABI sceNpCondWait(PthreadCond* cond, PthreadMutex* mutex) {
+    return scePthreadCondWait(cond, mutex);
+}
+
+int APS5_VABI sceNpLwCondInit(PthreadCond* cond, const char* name) {
+    return InitCond(cond, name);
+}
+
+int APS5_VABI sceNpLwCondDestroy(PthreadCond* cond) {
+    return scePthreadCondDestroy(cond);
+}
+
+int APS5_VABI sceNpLwCondSignal(PthreadCond* cond) {
+    return scePthreadCondSignal(cond);
+}
+
+int APS5_VABI sceNpLwCondSignalAll(PthreadCond* cond) {
+    return scePthreadCondBroadcast(cond);
+}
+
+int APS5_VABI sceNpLwCondSignalTo(PthreadCond* cond, Pthread thread) {
+    return scePthreadCondSignalto(cond, thread);
+}
+
+int APS5_VABI sceNpLwCondWait(PthreadCond* cond, PthreadMutex* mutex) {
+    return scePthreadCondWait(cond, mutex);
+}
+
+int APS5_VABI sceNpCreateEventFlag(KernelEventFlag* flag, const char* name, std::uint32_t attr, std::uint64_t pattern) {
+    return NpResult(sceKernelCreateEventFlag(flag, name, attr, pattern, nullptr));
+}
+
+int APS5_VABI sceNpDeleteEventFlag(KernelEventFlag flag) {
+    return NpResult(sceKernelDeleteEventFlag(flag));
+}
+
+int APS5_VABI sceNpOpenEventFlag(KernelEventFlag* flag, const char* name) {
+    return NpResult(sceKernelOpenEventFlag(flag, name));
+}
+
+int APS5_VABI sceNpSetEventFlag(KernelEventFlag flag, std::uint64_t pattern) {
+    return NpResult(sceKernelSetEventFlag(flag, pattern));
+}
+
+int APS5_VABI sceNpClearEventFlag(KernelEventFlag flag, std::uint64_t pattern) {
+    return NpResult(sceKernelClearEventFlag(flag, pattern));
+}
+
+int APS5_VABI sceNpPollEventFlag(KernelEventFlag flag, std::uint64_t pattern, std::uint32_t mode, std::uint64_t* result) {
+    return NpBusyResult(sceKernelPollEventFlag(flag, pattern, mode, result), NP_ERROR_EVENT_FLAG_BUSY);
+}
+
+int APS5_VABI sceNpCancelEventFlag(KernelEventFlag flag, std::uint64_t pattern, int* waiting) {
+    return NpResult(sceKernelCancelEventFlag(flag, pattern, waiting));
+}
+
+int APS5_VABI sceNpCreateSema(KernelSema* sema, std::uint32_t flags, int initial, int maximum, const char* name) {
+    const std::uint32_t attr = KERNEL_SEMA_ATTR_FIFO + ((flags & NP_SEMA_FLAG_PRIORITY) << KERNEL_SEMA_ATTR_PRIORITY_SHIFT);
+    return NpResult(sceKernelCreateSema(sema, name, attr, initial, maximum, nullptr));
+}
+
+int APS5_VABI sceNpDeleteSema(KernelSema sema) {
+    return NpResult(sceKernelDeleteSema(sema));
+}
+
+int APS5_VABI sceNpPollSema(KernelSema sema) {
+    return NpBusyResult(sceKernelPollSema(sema, 1), NP_ERROR_SEMA_BUSY);
+}
+
+int APS5_VABI sceNpSignalSema(KernelSema sema) {
+    return NpResult(sceKernelSignalSema(sema, 1));
+}
+
+int APS5_VABI sceNpCreateThread(Pthread* thread, PthreadEntry entry, void* arg, int priority, std::size_t stackSize, KernelCpumask affinity, const char* name) {
+    PthreadAttr attr {};
+    int result = scePthreadAttrInit(&attr);
+    if (result < 0) return result;
+    result = scePthreadAttrSetstacksize(&attr, stackSize);
+    if (result < 0) {
+        scePthreadAttrDestroy(&attr);
+
+        return result;
+    }
+    if (priority != 0) {
+        result = scePthreadAttrSetinheritsched(&attr, NP_THREAD_EXPLICIT_SCHED);
+        if (result >= 0) result = scePthreadAttrSetschedpolicy(&attr, NP_THREAD_SCHED_POLICY);
+        if (result >= 0) {
+            KernelSchedParam param {};
+            param.sched_priority = priority;
+            result = scePthreadAttrSetschedparam(&attr, &param);
+        }
+    }
+    if (result >= 0 && affinity != 0) result = scePthreadAttrSetaffinity(&attr, affinity);
+    if (result >= 0) result = scePthreadCreate(thread, &attr, entry, arg, name);
+    scePthreadAttrDestroy(&attr);
+
+    return result;
+}
+
+int APS5_VABI sceNpThreadGetId(Pthread* thread) {
+    if (thread == nullptr) return NP_ERROR_INVALID_ARGUMENT;
+    *thread = scePthreadSelf();
+    return 0;
+}
+
+int APS5_VABI sceNpGetProcessId(void) {
+    return getpid_nid_postfix();
+}
+
+[[noreturn]] void APS5_VABI sceNpPanic(void) {
+    std::abort();
+}
+
+int APS5_VABI sceNpDbgDumpText(const char* text, int length) {
+    return std::printf("%.*s", length, text);
+}
+
+int APS5_VABI sceNpIpc2ClientInit(void) {
+    std::lock_guard lock(g_ipcClientMutex);
+    if (g_ipcClientInitialized) return NP_ERROR_IPC_ALREADY_INITIALIZED;
+    const int result = InitMemoryHeap(&g_ipcClientHeap, NP_IPC_CLIENT_HEAP_SIZE, NP_IPC_CLIENT_HEAP_NAME);
+    if (result < 0) return result;
+    g_ipcClientInitialized = true;
+    return 0;
+}
+
+int APS5_VABI sceNpIpc2ClientTerm(void) {
+    std::lock_guard lock(g_ipcClientMutex);
+    if (!g_ipcClientInitialized) return NP_ERROR_IPC_NOT_INITIALIZED;
+    DestroyMemoryHeap(&g_ipcClientHeap);
+    g_ipcClientInitialized = false;
+    return 0;
+}
+
+int APS5_VABI sceNpArchInit(void) {
+    std::lock_guard lock(g_archMutex);
+    if (g_archReferences != 0) {
+        ++g_archReferences;
+        return 0;
+    }
+    const int result = InitMemoryHeap(&g_globalHeap, NP_GLOBAL_HEAP_SIZE, NP_GLOBAL_HEAP_NAME);
+    if (result < 0) return result;
+    g_archReferences = 1;
+    return 0;
+}
+
+void APS5_VABI sceNpArchTerm(void) {
+    std::lock_guard lock(g_archMutex);
+    if (g_archReferences == 0) return;
+    if (--g_archReferences == 0) DestroyMemoryHeap(&g_globalHeap);
+}
+
+int APS5_VABI sceNpHeapInit(NpHeap* heap, void* base, std::size_t size, const char* name) {
+    return InitHeap(heap, base, size, name);
+}
+
+void APS5_VABI sceNpHeapDestroy(NpHeap* heap) {
+    DestroyHeap(heap);
+}
+
+void APS5_VABI sceNpHeapGetAllocator(NpHeap* heap, NpAllocator* allocator) {
+    *allocator = {HeapAllocate, HeapReallocate, HeapRelease, heap};
+}
+
+int APS5_VABI sceNpHeapGetStat(const NpHeap* heap, NpHeapStat* stat) {
+    MallocManagedSize stats {};
+    stats.size = sizeof(stats);
+    stats.version = 1;
+    const int result = sceLibcMspaceMallocStats_nid_postfix(heap->mspace, &stats);
+    if (result == 0) *stat = {stats.maxSystemSize, stats.maxInuseSize, stats.currentInuseSize};
+    return result;
+}
+
+void APS5_VABI sceNpHeapShowStat(const NpHeap* heap) {
+    NpHeapStat stat {};
+    if (sceNpHeapGetStat(heap, &stat) != 0) {
+        std::printf("[NpCommon] heap statistics unavailable\n");
+        return;
+    }
+    std::printf("[NpCommon] heap: system %llu bytes, peak in use %llu bytes, in use %llu bytes\n",
+        static_cast<unsigned long long>(stat.maxSystemSize), static_cast<unsigned long long>(stat.maxInuseSize),
+        static_cast<unsigned long long>(stat.currentInuseSize));
+}
+
+int APS5_VABI sceNpMemoryHeapInit(NpMemoryHeap* heap, std::uint64_t size, const char* name) {
+    return InitMemoryHeap(heap, size, name);
+}
+
+void APS5_VABI sceNpMemoryHeapDestroy(NpMemoryHeap* heap) {
+    DestroyMemoryHeap(heap);
+}
+
+void APS5_VABI sceNpMemoryHeapGetAllocator(NpMemoryHeap* heap, NpAllocator* allocator) {
+    *allocator = MemoryHeapAllocator(heap);
+}
+
+void APS5_VABI sceNpMemoryHeapGetAllocatorEx(NpMemoryHeap* heap, int outOfMemoryError, NpAllocatorEx* allocator) {
+    *allocator = {MemoryHeapAllocator(heap), outOfMemoryError};
+}
+
+void APS5_VABI sceNpGlobalHeapGetAllocator(NpAllocator* allocator) {
+    *allocator = MemoryHeapAllocator(&g_globalHeap);
+}
+
+void APS5_VABI sceNpGlobalHeapGetAllocatorEx(NpAllocatorEx* allocator) {
+    *allocator = {MemoryHeapAllocator(&g_globalHeap), NP_ERROR_OUT_OF_MEMORY};
+}
+
+NpAllocator* APS5_VABI sceNpGlobalHeapGetAllocatorPtr(void) {
+    g_globalAllocator = MemoryHeapAllocator(&g_globalHeap);
+    return &g_globalAllocator;
+}
+
+NpAllocatorEx* APS5_VABI sceNpGlobalHeapGetAllocatorExPtr(void) {
+    g_globalAllocatorEx = {MemoryHeapAllocator(&g_globalHeap), NP_ERROR_OUT_OF_MEMORY};
+    return &g_globalAllocatorEx;
+}
+
+int APS5_VABI sceNpAllocateKernelMemoryNoAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory) {
+    if (memory == nullptr) return NP_ERROR_NULL_OBJECT;
+    const int result = MapKernelMemory(memory, size, name);
+    if (result >= 0 && address != nullptr) *address = memory->address;
+    return result;
+}
+
+int APS5_VABI sceNpAllocateKernelMemoryWithAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory) {
+    return sceNpAllocateKernelMemoryNoAlignment(AlignKernelMemory(size), name, address, memory);
+}
+
+int APS5_VABI sceNpFreeKernelMemory(NpKernelMemory* memory) {
+    if (memory == nullptr) return NP_ERROR_NULL_OBJECT;
+    UnmapKernelMemory(memory);
+    return 0;
+}
+
+void APS5_VABI sceNpGetSdkVersionUInt(std::uint32_t* version) {
+    const std::uint32_t value = SystemVersion();
+    if (version != nullptr) *version = value;
+}
+
+int APS5_VABI sceNpRtcConvertToPosixTime(const RtcTick* tick, std::int64_t* seconds) {
+    if (tick->tick == 0) return NP_ERROR_INVALID_ARGUMENT;
+    RtcDateTime time {};
+    const int result = sceRtcSetTick(&time, tick);
+    if (result < 0) return result;
+    return NpResult(sceRtcGetTime_t(&time, seconds));
+}
+
+int APS5_VABI sceNpRtcFormatRFC3339(char* text, std::size_t size, const RtcTick* utc, int timeZoneMinutes) {
+    if (size < NP_RFC3339_BUFFER_MIN) return NP_ERROR_BUFFER_TOO_SMALL;
+    const int result = sceRtcFormatRFC3339(text, utc, timeZoneMinutes);
+    if (result < 0) return result;
+    text[size - 1] = 0;
+    return 0;
+}
+
+int APS5_VABI sceNpUserGetUserIdList(int* users, std::size_t capacity, int* count) {
+    if (capacity < NP_USER_ID_LIST_SIZE) return NP_ERROR_INVALID_ARGUMENT;
+    int registered[NP_USER_ID_LIST_SIZE];
+    std::fill(std::begin(registered), std::end(registered), USER_ID_INVALID);
+    static_assert(sizeof(UserServiceRegisteredUserIdList) <= sizeof(registered));
+    const int result = sceUserServiceGetRegisteredUserIdList(reinterpret_cast<UserServiceRegisteredUserIdList*>(registered));
+    if (result < 0) return result;
+    int found = 0;
+    for (const int user : registered)
+        if (user != USER_ID_INVALID) users[found++] = user;
+    *count = found;
+    return 0;
+}
+
+int APS5_VABI sceNpRtcParseRFC3339(RtcTick* utc, const char* text) {
+    return sceRtcParseRFC3339(utc, text);
+}
+
+static std::uint64_t ClockUsec() {
+    std::int64_t usec = 0;
+    sceNpGetSystemClockUsec(&usec);
+
+    return static_cast<std::uint64_t>(usec);
+}
+
+static void* APS5_VABI CalloutThread(void* arg) {
+    auto* context = static_cast<NpCalloutContext*>(arg);
+    sceNpMutexLock(&context->mutex);
+
+    for (;;) {
+        const std::uint64_t now = ClockUsec();
+        NpCallout* head = context->pending;
+        if (head != nullptr && head->deadline <= now) {
+            context->pending = head->next;
+            sceNpMutexUnlock(&context->mutex);
+
+            head->handler(head->arg);
+            sceNpMutexLock(&context->mutex);
+
+            continue;
+        }
+        if (context->stopping > 0) break;
+        const std::uint64_t wait = head != nullptr ? std::min(head->deadline - now, NP_CALLOUT_MAX_WAIT) : 0;
+        sceNpCondTimedwait(&context->cond, &context->mutex, static_cast<std::uint32_t>(wait));
+
+        if (context->stopping > 0) break;
+    }
+    sceNpMutexUnlock(&context->mutex);
+
+    return nullptr;
+}
+
+int APS5_VABI sceNpCalloutInitCtx(NpCalloutContext* context, const char* name, std::size_t stackSize, int priority,
+    KernelCpumask affinity) {
+    if (context->initialized > 0) return NP_ERROR_ALREADY_INITIALIZED;
+    context->stopping = 0;
+    context->pending = nullptr;
+    int result = sceNpMutexInit(&context->mutex, name, 1);
+    if (result < 0) return result;
+    result = sceNpCondInit(&context->cond, name, 0);
+    if (result >= 0) {
+        result = sceNpCreateThread(&context->thread, CalloutThread, context, priority, stackSize, affinity, name);
+        if (result >= 0) {
+            context->initialized = 1;
+            return 0;
+        }
+        sceNpCondDestroy(&context->cond);
+
+    }
+    sceNpMutexDestroy(&context->mutex);
+
+    return result;
+}
+
+void APS5_VABI sceNpCalloutTermCtx(NpCalloutContext* context) {
+    if (context->initialized == 0) return;
+    sceNpMutexLock(&context->mutex);
+
+    context->stopping = 1;
+    sceNpCondSignal(&context->cond);
+    sceNpMutexUnlock(&context->mutex);
+    sceNpJoinThread(context->thread, nullptr);
+    sceNpCondDestroy(&context->cond);
+    sceNpMutexDestroy(&context->mutex);
+
+    context->initialized = 0;
+}
+
+int APS5_VABI sceNpCalloutStartOnCtx64(NpCalloutContext* context, NpCallout* callout, std::uint64_t usec,
+    void (APS5_VABI *handler)(void* arg), void* arg) {
+    if (context->initialized == 0) return NP_ERROR_NOT_INITIALIZED;
+    const std::uint64_t deadline = ClockUsec() + usec;
+    sceNpMutexLock(&context->mutex);
+
+    for (NpCallout* entry = context->pending; entry != nullptr; entry = entry->next) {
+        if (entry == callout) {
+            sceNpMutexUnlock(&context->mutex);
+
+            return NP_ERROR_ALREADY_QUEUED;
+        }
+    }
+    *callout = {};
+    callout->deadline = deadline;
+    callout->handler = handler;
+    callout->arg = arg;
+    NpCallout** link = &context->pending;
+    while (*link != nullptr && callout->deadline > (*link)->deadline) link = &(*link)->next;
+    callout->next = *link;
+    *link = callout;
+    sceNpCondSignal(&context->cond);
+    sceNpMutexUnlock(&context->mutex);
+
+    return 0;
+}
+
+int APS5_VABI sceNpCalloutStartOnCtx(NpCalloutContext* context, NpCallout* callout, std::uint32_t usec,
+    void (APS5_VABI *handler)(void* arg), void* arg) {
+    return sceNpCalloutStartOnCtx64(context, callout, usec, handler, arg);
+}
+
+int APS5_VABI sceNpCalloutStopOnCtx(NpCalloutContext* context, NpCallout* callout, int* wasPending) {
+    if (context->initialized == 0) return NP_ERROR_NOT_INITIALIZED;
+    sceNpMutexLock(&context->mutex);
+
+    int removed = 0;
+    for (NpCallout** link = &context->pending; *link != nullptr; link = &(*link)->next) {
+        if (*link != callout) continue;
+        *link = callout->next;
+        removed = 1;
+        break;
+    }
+    if (wasPending != nullptr) *wasPending = removed;
+    sceNpMutexUnlock(&context->mutex);
+
+    return 0;
+}
+
+std::uint32_t APS5_VABI sceNpGetRandom(void) {
+    std::lock_guard lock(g_randomMutex);
+    return static_cast<std::uint32_t>(g_random());
+}
+
+int APS5_VABI sceNpUtilCmpAccountId(std::uint64_t left, std::uint64_t right) {
+    return left != right ? 1 : 0;
+}
+
+int APS5_VABI sceNpCmpNpId(const void* npId1, const void* npId2) {
+    if (!npId1 || !npId2) return NP_ERROR_NULL_ARGUMENT;
+    const auto* left = static_cast<const std::uint8_t*>(npId1);
+    const auto* right = static_cast<const std::uint8_t*>(npId2);
+    if (left[NP_ID_TERMINATOR_FLAG_OFFSET] != 1 || right[NP_ID_TERMINATOR_FLAG_OFFSET] != 1) return NP_ERROR_INVALID_NP_ID;
+    if (std::strncmp(static_cast<const char*>(npId1), static_cast<const char*>(npId2), NP_ONLINE_ID_MAX) != 0) return NP_ERROR_ONLINE_ID_MISMATCH;
+    if (NpIdWord(left, NP_ID_OPT_OFFSET) != NpIdWord(right, NP_ID_OPT_OFFSET)) return NP_ERROR_ONLINE_ID_MISMATCH;
+    if (NpIdWord(left, NP_ID_PLATFORM_OFFSET) == NpIdWord(right, NP_ID_PLATFORM_OFFSET)) return 0;
+    if (left[NP_ID_PLATFORM_OFFSET] == 0 || right[NP_ID_PLATFORM_OFFSET] == 0) return 0;
+    return NP_ERROR_ONLINE_ID_MISMATCH;
+}
+
+bool APS5_VABI sceNpIntIsOnlineIdString(const char* text) {
+    return text != nullptr && IsOnlineIdText(text);
+}
+
+int APS5_VABI sceNpUtilGetNpLanguageCode(int language, char* code) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    if (codes == nullptr || code == nullptr) return NP_ERROR_INVALID_ARGUMENT_UTIL;
+    CopyText(code, codes->code, NP_LANGUAGE_CODE_SIZE);
+    return 0;
+}
+
+int APS5_VABI sceNpUtilGetNpLanguageCode2(int language, char* tag) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    if (codes == nullptr || tag == nullptr) return NP_ERROR_INVALID_ARGUMENT_UTIL;
+    CopyText(tag, codes->tag, NP_LANGUAGE_CODE2_SIZE);
+    return 0;
+}
+
+const char* APS5_VABI sceNpUtilGetNpLanguageCodeStr(int language) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    return codes != nullptr ? codes->code : nullptr;
+}
+
+const char* APS5_VABI sceNpUtilGetNpLanguageCode2Str(int language) {
+    const NpLanguageCodes* codes = FindLanguageCodes(language);
+    return codes != nullptr ? codes->tag : nullptr;
+}
+
+std::uint32_t APS5_VABI sceNpDbgAssignDebugId(void) {
+    std::uint32_t id = g_debugIds.fetch_add(1) + 1;
+    if (id == 0) id = g_debugIds.fetch_add(1) + 1;
+    return id;
+}
+
+int APS5_VABI sceNpUtilBuildTitleId(const NpTitleIdParts* parts, char* titleId, std::size_t size) {
+    if (parts == nullptr || titleId == nullptr) return NP_ERROR_INVALID_ARGUMENT_UTIL;
+    if (size < NP_TITLE_ID_SIZE) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (parts->index > NP_TITLE_ID_INDEX_MAX) return NP_UTIL_ERROR_OUT_OF_RANGE;
+    std::memcpy(titleId, parts->id, sizeof(parts->id));
+    titleId[9] = '_';
+    titleId[10] = static_cast<char>('0' + parts->index / 10);
+    titleId[11] = static_cast<char>('0' + parts->index % 10);
+    titleId[12] = '\0';
+    return 0;
+}
+
+void APS5_VABI sceNpDbgDumpBinary(const void* data, std::size_t size) {
+    const auto* bytes = static_cast<const std::uint8_t*>(data);
+    for (std::size_t line = 0; line < size; line += NP_DUMP_LINE_BYTES) {
+        const std::size_t count = std::min(NP_DUMP_LINE_BYTES, size - line);
+        for (std::size_t i = 0; i < NP_DUMP_LINE_BYTES; ++i) {
+            if (i < count) {
+                std::printf("%02x", bytes[line + i]);
+            } else {
+                std::printf("  ");
+            }
+            if ((i & 1) != 0) std::putchar(' ');
+        }
+        std::putchar(' ');
+        for (std::size_t i = 0; i < count; ++i) {
+            const std::uint8_t c = bytes[line + i];
+            std::putchar(c >= 0x20 && c <= 0x7E ? c : '.');
+        }
+        std::putchar('\n');
+    }
+    std::putchar('\n');
+}
+
+}
diff --git a/core/libs/prx/libSceNpCommon/Strings.cpp b/core/libs/prx/libSceNpCommon/Strings.cpp
new file mode 100644
index 0000000000..08125a4c0f
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/Strings.cpp
@@ -0,0 +1,630 @@
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include <cerrno>
+#include <climits>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include "SceTypes.hpp"
+
+namespace {
+
+constexpr int NP_ERROR_INVALID_FORMAT = static_cast<int>(0x80558003);
+constexpr int NP_ERROR_INVALID_CHARACTER = static_cast<int>(0x80558004);
+constexpr int NP_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80558008);
+constexpr int NP_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80558009);
+constexpr int NP_ERROR_OUT_OF_RANGE = static_cast<int>(0x8055800E);
+
+constexpr std::uint32_t NP_FORMAT_UPPERCASE = 1;
+constexpr std::uint32_t NP_FORMAT_PREFIX = 2;
+constexpr std::uint32_t NP_FORMAT_SIGN = 4;
+constexpr std::uint32_t NP_RADIX_MAX = 36;
+
+constexpr char BASE64_ALPHABET[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+constexpr char BASE64URL_ALPHABET[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+constexpr char BASE64_PAD = '=';
+
+int Base64Value(char c, const char* alphabet) {
+    if (c == '\0') return -1;
+    const char* found = std::strchr(alphabet, c);
+    return found != nullptr ? static_cast<int>(found - alphabet) : -1;
+}
+
+struct Base64Block {
+    std::uint32_t bits;
+    int bytes;
+};
+
+int DecodeLastBlock(const char* src, std::size_t length, const char* alphabet, Base64Block* block) {
+    char c[4] = {BASE64_PAD, BASE64_PAD, BASE64_PAD, BASE64_PAD};
+    std::memcpy(c, src, length);
+    const int v0 = Base64Value(c[0], alphabet);
+    const int v1 = Base64Value(c[1], alphabet);
+    if (v0 < 0 || v1 < 0) return NP_ERROR_INVALID_CHARACTER;
+    block->bits = (static_cast<std::uint32_t>(v0) << 18) | (static_cast<std::uint32_t>(v1) << 12);
+    if (c[2] == BASE64_PAD) {
+        if (c[3] != BASE64_PAD) return NP_ERROR_INVALID_CHARACTER;
+        block->bytes = 1;
+        return 0;
+    }
+    const int v2 = Base64Value(c[2], alphabet);
+    if (v2 < 0) return NP_ERROR_INVALID_CHARACTER;
+    block->bits |= static_cast<std::uint32_t>(v2) << 6;
+    if (c[3] == BASE64_PAD) {
+        block->bytes = 2;
+        return 0;
+    }
+    const int v3 = Base64Value(c[3], alphabet);
+    if (v3 < 0) return NP_ERROR_INVALID_CHARACTER;
+    block->bits |= static_cast<std::uint32_t>(v3);
+    block->bytes = 3;
+    return 0;
+}
+
+int Base64Decode(const char* src, std::size_t length, std::uint8_t* dst, std::size_t capacity, const char* alphabet,
+    bool padded) {
+    if (padded && (length & 3) != 0) return NP_ERROR_INVALID_FORMAT;
+    int decoded = 0;
+    while (length > 4) {
+        std::uint32_t bits = 0;
+        for (int i = 0; i < 4; ++i) {
+            const int value = Base64Value(src[i], alphabet);
+            if (value < 0) return NP_ERROR_INVALID_CHARACTER;
+            bits = (bits << 6) | static_cast<std::uint32_t>(value);
+        }
+        if (dst != nullptr) {
+            if (capacity < 3) return NP_ERROR_INVALID_FORMAT;
+            capacity -= 3;
+            *dst++ = static_cast<std::uint8_t>(bits >> 16);
+            *dst++ = static_cast<std::uint8_t>(bits >> 8);
+            *dst++ = static_cast<std::uint8_t>(bits);
+        }
+        decoded += 3;
+        src += 4;
+        length -= 4;
+    }
+    if (padded && length != 4) return NP_ERROR_INVALID_FORMAT;
+    Base64Block block {};
+    const int result = DecodeLastBlock(src, length, alphabet, &block);
+    if (result < 0) return result;
+    if (dst != nullptr) {
+        if (capacity < static_cast<std::size_t>(block.bytes)) return NP_ERROR_INVALID_FORMAT;
+        for (int i = 0; i < block.bytes; ++i) dst[i] = static_cast<std::uint8_t>(block.bits >> (16 - 8 * i));
+    }
+    return decoded + block.bytes;
+}
+
+int Base64Encode(const std::uint8_t* src, char* dst, std::size_t length, const char* alphabet, bool padded) {
+    char* out = dst;
+    for (; length >= 3; length -= 3, src += 3) {
+        const std::uint32_t bits = (src[0] << 16) | (src[1] << 8) | src[2];
+        for (int shift = 18; shift >= 0; shift -= 6) *out++ = alphabet[(bits >> shift) & 0x3F];
+    }
+    if (length != 0) {
+        const std::uint32_t bits = (src[0] << 16) | (length == 2 ? src[1] << 8 : 0);
+        *out++ = alphabet[(bits >> 18) & 0x3F];
+        *out++ = alphabet[(bits >> 12) & 0x3F];
+        if (length == 2) *out++ = alphabet[(bits >> 6) & 0x3F];
+        if (padded) {
+            if (length == 1) *out++ = BASE64_PAD;
+            *out++ = BASE64_PAD;
+        }
+    }
+    return static_cast<int>(out - dst);
+}
+
+int HexValue(char c) {
+    if (c >= '0' && c <= '9') return c - '0';
+    if (c >= 'a' && c <= 'f') return c - 'a' + 10;
+    if (c >= 'A' && c <= 'F') return c - 'A' + 10;
+    return -1;
+}
+
+char HexDigit(std::uint32_t value, bool uppercase) {
+    if (value < 10) return static_cast<char>('0' + value);
+    return static_cast<char>((uppercase ? 'A' : 'a') + value - 10);
+}
+
+int ParseHex(const char* hex, std::size_t length, std::uint8_t* out, std::size_t capacity) {
+    if ((length & 1) != 0) return NP_ERROR_INVALID_ARGUMENT;
+    if (capacity < length / 2) return NP_ERROR_BUFFER_TOO_SMALL;
+    for (std::size_t i = 0; i < length; i += 2) {
+        const int high = HexValue(hex[i]);
+        const int low = HexValue(hex[i + 1]);
+        if (high < 0 || low < 0) return NP_ERROR_INVALID_ARGUMENT;
+        out[i / 2] = static_cast<std::uint8_t>((high << 4) | low);
+    }
+    return 0;
+}
+
+int FormatInteger(char* buf, std::size_t size, std::uint64_t magnitude, char sign, std::uint32_t radix,
+    std::uint32_t flags, std::size_t* length) {
+    if (radix < 1 || radix > NP_RADIX_MAX) return NP_ERROR_INVALID_ARGUMENT;
+    char prefix[3] = {};
+    std::size_t prefixLength = 0;
+    if (sign != '\0') prefix[prefixLength++] = sign;
+    if ((flags & NP_FORMAT_PREFIX) != 0 && (radix == 8 || radix == 16)) {
+        prefix[prefixLength++] = '0';
+        if (radix == 16) prefix[prefixLength++] = (flags & NP_FORMAT_UPPERCASE) != 0 ? 'X' : 'x';
+    }
+    std::size_t digits = 1;
+    if (radix > 1) {
+        for (std::uint64_t rest = magnitude; rest >= radix; rest /= radix) ++digits;
+    }
+    if (buf != nullptr) {
+        if (size < prefixLength + digits + 1) return NP_ERROR_BUFFER_TOO_SMALL;
+        std::memcpy(buf, prefix, prefixLength);
+        char* end = buf + prefixLength + digits;
+        *end = '\0';
+        std::uint64_t rest = magnitude;
+        for (std::size_t i = 0; i < digits; ++i) {
+            *--end = HexDigit(static_cast<std::uint32_t>(rest % radix), (flags & NP_FORMAT_UPPERCASE) != 0);
+            rest /= radix;
+        }
+    }
+    if (length != nullptr) *length = prefixLength + digits;
+    return 0;
+}
+
+std::uint64_t Magnitude(std::int64_t value) {
+    return value < 0 ? 0 - static_cast<std::uint64_t>(value) : static_cast<std::uint64_t>(value);
+}
+
+char PlusSign(bool positive, std::uint32_t flags) {
+    return positive && (flags & NP_FORMAT_SIGN) != 0 ? '+' : '\0';
+}
+
+template <typename Parse>
+int ParseInteger(const char* str, std::size_t* parsedLength, Parse parse, bool* saturated) {
+    char* end = nullptr;
+    errno = 0;
+    parse(str, &end);
+    if (end == str) return NP_ERROR_OUT_OF_RANGE;
+    if (*saturated && errno == ERANGE) return NP_ERROR_OUT_OF_RANGE;
+    if (parsedLength != nullptr) *parsedLength = static_cast<std::size_t>(end - str);
+    return 0;
+}
+
+int CopyToBuffer(char* dst, std::size_t size, const char* src, std::size_t length) {
+    if (size < length + 1) return NP_ERROR_BUFFER_TOO_SMALL;
+    std::strncpy(dst, src, size - 1);
+    dst[size - 1] = '\0';
+    return 0;
+}
+
+constexpr int NP_UTIL_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550601);
+constexpr int NP_UTIL_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80550602);
+constexpr int NP_UTIL_ERROR_INVALID_CHARACTER = static_cast<int>(0x80550608);
+constexpr std::size_t JSON_ESCAPE_MARGIN = 7;
+constexpr std::size_t JSON_UNICODE_ESCAPE_LENGTH = 6;
+constexpr std::size_t JSON_SURROGATE_PAIR_LENGTH = 12;
+constexpr std::uint32_t SURROGATE_MASK = 0xFC00;
+constexpr std::uint32_t HIGH_SURROGATE = 0xD800;
+constexpr std::uint32_t LOW_SURROGATE = 0xDC00;
+constexpr char URL_HEX_DIGITS[] = "0123456789ABCDEF";
+
+const char* JsonShortEscape(unsigned char c) {
+    switch (c) {
+    case '\b': return "\\b";
+    case '\t': return "\\t";
+    case '\n': return "\\n";
+    case '\f': return "\\f";
+    case '\r': return "\\r";
+    case '"': return "\\\"";
+    case '/': return "\\/";
+    case '\\': return "\\\\";
+    default: return nullptr;
+    }
+}
+
+char JsonShortUnescape(char c) {
+    switch (c) {
+    case '"': return '"';
+    case '\\': return '\\';
+    case '/': return '/';
+    case 'b': return '\b';
+    case 'f': return '\f';
+    case 'n': return '\n';
+    case 'r': return '\r';
+    case 't': return '\t';
+    default: return '\0';
+    }
+}
+
+int ParseUtf16Unit(const char* text, std::uint32_t* unit) {
+    *unit = 0;
+    for (int i = 0; i < 4; ++i) {
+        const int value = HexValue(text[i]);
+        if (value < 0) {
+            *unit = 0;
+            return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        }
+        *unit = (*unit << 4) | static_cast<std::uint32_t>(value);
+    }
+    return 0;
+}
+
+std::size_t EncodeUtf8(std::uint32_t codePoint, char* out) {
+    if (codePoint <= 0x7F) {
+        out[0] = static_cast<char>(codePoint);
+        return 1;
+    }
+    if (codePoint <= 0x7FF) {
+        out[0] = static_cast<char>(0xC0 | (codePoint >> 6));
+        out[1] = static_cast<char>(0x80 | (codePoint & 0x3F));
+        return 2;
+    }
+    if (codePoint <= 0xFFFF) {
+        out[0] = static_cast<char>(0xE0 | (codePoint >> 12));
+        out[1] = static_cast<char>(0x80 | ((codePoint >> 6) & 0x3F));
+        out[2] = static_cast<char>(0x80 | (codePoint & 0x3F));
+        return 3;
+    }
+    out[0] = static_cast<char>(0xF0 | (codePoint >> 18));
+    out[1] = static_cast<char>(0x80 | ((codePoint >> 12) & 0x3F));
+    out[2] = static_cast<char>(0x80 | ((codePoint >> 6) & 0x3F));
+    out[3] = static_cast<char>(0x80 | (codePoint & 0x3F));
+    return 4;
+}
+
+std::uint32_t CombineSurrogates(std::uint32_t high, std::uint32_t low) {
+    return 0x10000 + (((high & 0x3FF) << 10) | (low & 0x3FF));
+}
+
+bool IsContinuation(char c) {
+    return (static_cast<unsigned char>(c) & 0xC0) == 0x80;
+}
+
+std::size_t Utf8SequenceLength(unsigned char lead) {
+    if (lead >= 0xC2 && lead <= 0xDF) return 2;
+    if ((lead & 0xF0) == 0xE0) return 3;
+    if ((lead & 0xF8) == 0xF0) return 4;
+    return 0;
+}
+
+bool IsValidSequence(const char* text, std::size_t length) {
+    for (std::size_t i = 1; i < length; ++i) {
+        if (!IsContinuation(text[i])) return false;
+    }
+    return true;
+}
+
+bool IsAllowedTextByte(unsigned char c) {
+    return (c >= 0x20 && c != 0x7F) || c == '\t' || c == '\n' || c == '\r';
+}
+
+bool IsUrlSafe(unsigned char c) {
+    return (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.'
+        || c == '*';
+}
+
+} // namespace
+
+extern "C" {
+
+int APS5_VABI sceNpBase64GetDecodeSize(const char* src, std::size_t length) {
+    return Base64Decode(src, length, nullptr, 0, BASE64_ALPHABET, true);
+}
+
+int APS5_VABI sceNpBase64Decoder(const char* src, std::size_t length, void* dst, std::size_t capacity) {
+    return Base64Decode(src, length, static_cast<std::uint8_t*>(dst), capacity, BASE64_ALPHABET, true);
+}
+
+int APS5_VABI sceNpBase64Encoder(const void* src, char* dst, std::size_t length) {
+    return Base64Encode(static_cast<const std::uint8_t*>(src), dst, length, BASE64_ALPHABET, true);
+}
+
+int APS5_VABI sceNpBase64UrlGetDecodeSize(const char* src, std::size_t length) {
+    return Base64Decode(src, length, nullptr, 0, BASE64URL_ALPHABET, false);
+}
+
+int APS5_VABI sceNpBase64UrlDecoder(const char* src, std::size_t length, void* dst, std::size_t capacity) {
+    return Base64Decode(src, length, static_cast<std::uint8_t*>(dst), capacity, BASE64URL_ALPHABET, false);
+}
+
+int APS5_VABI sceNpBase64UrlEncoder(const void* src, char* dst, std::size_t length) {
+    return Base64Encode(static_cast<const std::uint8_t*>(src), dst, length, BASE64URL_ALPHABET, false);
+}
+
+int APS5_VABI sceNpHexToInt(int c) {
+    return HexValue(static_cast<char>(c));
+}
+
+int APS5_VABI sceNpIntToHex(std::uint32_t value, bool uppercase) {
+    return HexDigit(value, uppercase);
+}
+
+int APS5_VABI sceNpUInt32ToStr(char* buf, std::size_t size, std::uint32_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    return FormatInteger(buf, size, value, PlusSign(value != 0, flags), radix, flags, length);
+}
+
+int APS5_VABI sceNpUInt64ToStr(char* buf, std::size_t size, std::uint64_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    return FormatInteger(buf, size, value, PlusSign(value != 0, flags), radix, flags, length);
+}
+
+int APS5_VABI sceNpInt32ToStr(char* buf, std::size_t size, std::int32_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    const char sign = value < 0 ? '-' : PlusSign(value > 0, flags);
+    return FormatInteger(buf, size, Magnitude(value), sign, radix, flags, length);
+}
+
+int APS5_VABI sceNpInt64ToStr(char* buf, std::size_t size, std::int64_t value, std::uint32_t radix, std::uint32_t flags,
+    std::size_t* length) {
+    const char sign = (flags & NP_FORMAT_SIGN) == 0 ? '\0' : value < 0 ? '-' : PlusSign(value > 0, flags);
+    return FormatInteger(buf, size, Magnitude(value), sign, radix, flags, length);
+}
+
+int APS5_VABI sceNpStrToInt32(const char* str, std::int32_t* value, int base, std::size_t* parsedLength) {
+    long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoll(s, end, base);
+        saturated = parsed == LLONG_MIN || parsed == LLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    if (parsed != static_cast<std::int32_t>(parsed)) return NP_ERROR_OUT_OF_RANGE;
+    *value = static_cast<std::int32_t>(parsed);
+    return 0;
+}
+
+int APS5_VABI sceNpStrToInt64(const char* str, std::int64_t* value, int base, std::size_t* parsedLength) {
+    long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoll(s, end, base);
+        saturated = parsed == LLONG_MIN || parsed == LLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    *value = parsed;
+    return 0;
+}
+
+int APS5_VABI sceNpStrToUInt32(const char* str, std::uint32_t* value, int base, std::size_t* parsedLength) {
+    unsigned long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoull(s, end, base);
+        saturated = parsed == ULLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    if ((parsed >> 32) != 0) return NP_ERROR_OUT_OF_RANGE;
+    *value = static_cast<std::uint32_t>(parsed);
+    return 0;
+}
+
+int APS5_VABI sceNpStrToUInt64(const char* str, std::uint64_t* value, int base, std::size_t* parsedLength) {
+    unsigned long long parsed = 0;
+    bool saturated = false;
+    const int result = ParseInteger(str, parsedLength, [&](const char* s, char** end) {
+        parsed = std::strtoull(s, end, base);
+        saturated = parsed == ULLONG_MAX;
+    }, &saturated);
+    if (result < 0) return result;
+    *value = parsed;
+    return 0;
+}
+
+int APS5_VABI sceNpStrBuildHex(char* dst, std::size_t size, const void* src, std::size_t length, bool uppercase) {
+    if (size <= length * 2) return NP_ERROR_BUFFER_TOO_SMALL;
+    const auto* bytes = static_cast<const std::uint8_t*>(src);
+    for (std::size_t i = 0; i < length; ++i) {
+        dst[i * 2] = HexDigit(bytes[i] >> 4, uppercase);
+        dst[i * 2 + 1] = HexDigit(bytes[i] & 0xF, uppercase);
+    }
+    dst[length * 2] = '\0';
+    return 0;
+}
+
+int APS5_VABI sceNpStrParseHex(const char* hex, void* out, std::size_t capacity) {
+    return ParseHex(hex, std::strlen(hex), static_cast<std::uint8_t*>(out), capacity);
+}
+
+int APS5_VABI sceNpStrnParseHex(const char* hex, std::size_t length, void* out, std::size_t capacity) {
+    return ParseHex(hex, length, static_cast<std::uint8_t*>(out), capacity);
+}
+
+int APS5_VABI sceNpStrcpyToBuf(char* dst, std::size_t size, const char* src) {
+    return CopyToBuffer(dst, size, src, std::strlen(src));
+}
+
+int APS5_VABI sceNpStrncpyToBuf(char* dst, std::size_t size, const char* src, std::size_t maxLength) {
+    return CopyToBuffer(dst, size, src, strnlen(src, maxLength));
+}
+
+int APS5_VABI sceNpUtilJsonEscape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength) {
+    if (dst == nullptr || dstSize == 0 || src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dstSize < JSON_ESCAPE_MARGIN) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    std::size_t written = 0;
+    for (std::size_t i = 0; i < srcLength; ++i) {
+        if (written > dstSize - JSON_ESCAPE_MARGIN) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        const auto c = static_cast<unsigned char>(src[i]);
+        if (c == 0) return 0;
+        char piece[JSON_ESCAPE_MARGIN] = {};
+        if (const char* escape = JsonShortEscape(c)) {
+            std::strcpy(piece, escape);
+        } else if (c >= 0x20 && c != 0x7F) {
+            piece[0] = static_cast<char>(c);
+        } else {
+            std::snprintf(piece, sizeof(piece), "\\u%04x", c);
+        }
+        std::strcat(dst, piece);
+        written += std::strlen(piece);
+    }
+    return 0;
+}
+
+int APS5_VABI sceNpUtilJsonUnescape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength,
+    std::size_t* dstLength) {
+    if (src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dst == nullptr && dstLength == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    const char* end = src + srcLength;
+    std::size_t count = 0;
+    int status = 0;
+    char* out = dst;
+    auto emit = [&](const char* bytes, std::size_t length, std::size_t consumed) {
+        if (out != nullptr) {
+            std::memcpy(out, bytes, length);
+            out += length;
+        }
+        count += length;
+        src += consumed;
+    };
+    while (src < end) {
+        if (dst != nullptr && count + 1 > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        const std::size_t remaining = static_cast<std::size_t>(end - src);
+        if (src[0] != '\\' || remaining < 2) {
+            emit(src, 1, 1);
+            continue;
+        }
+        if (const char simple = JsonShortUnescape(src[1])) {
+            emit(&simple, 1, 2);
+            continue;
+        }
+        if (src[1] != 'u' || remaining < JSON_UNICODE_ESCAPE_LENGTH) {
+            emit(src, 1, 1);
+            continue;
+        }
+        std::uint32_t unit = 0;
+        int result = ParseUtf16Unit(src + 2, &unit);
+        if (result < 0) {
+            status = result;
+            emit(src, 1, 1);
+            continue;
+        }
+        status = 0;
+        char encoded[4] = {};
+        if ((unit & SURROGATE_MASK) != HIGH_SURROGATE) {
+            const std::size_t length = EncodeUtf8(unit, encoded);
+            if (dst != nullptr && count + length > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+            emit(encoded, length, JSON_UNICODE_ESCAPE_LENGTH);
+            continue;
+        }
+        std::uint32_t low = 0;
+        if (remaining < JSON_SURROGATE_PAIR_LENGTH || src[6] != '\\' || src[7] != 'u') {
+            emit(src, 1, 1);
+            continue;
+        }
+        result = ParseUtf16Unit(src + 8, &low);
+        if (result < 0) {
+            status = result;
+            emit(src, 1, 1);
+            continue;
+        }
+        if ((low & SURROGATE_MASK) != LOW_SURROGATE) {
+            emit(src, 1, 1);
+            continue;
+        }
+        const std::size_t length = EncodeUtf8(CombineSurrogates(unit, low), encoded);
+        if (dst != nullptr && count + length > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        emit(encoded, length, JSON_SURROGATE_PAIR_LENGTH);
+    }
+    ++count;
+    if (count > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (dstLength != nullptr) *dstLength = count;
+    if (out != nullptr) *out = '\0';
+    return status;
+}
+
+int APS5_VABI sceNpUtilJsonGetOneChar(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength,
+    std::size_t* dstLength, std::size_t* consumed) {
+    if (src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dst == nullptr && dstLength == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    std::size_t decoded = 1;
+    std::size_t used = 1;
+    int status = 0;
+    char encoded[4] = {};
+    const auto lead = static_cast<unsigned char>(src[0]);
+    if (lead == '\\') {
+        used = 2;
+        if (srcLength < 2) {
+            status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        } else if (const char simple = JsonShortUnescape(src[1])) {
+            encoded[0] = simple;
+        } else if (src[1] != 'u') {
+            used = 1;
+            encoded[0] = '\\';
+        } else {
+            used = JSON_UNICODE_ESCAPE_LENGTH;
+            std::uint32_t unit = 0;
+            if (srcLength < JSON_UNICODE_ESCAPE_LENGTH || ParseUtf16Unit(src + 2, &unit) < 0) {
+                status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+            } else if ((unit & SURROGATE_MASK) != HIGH_SURROGATE) {
+                decoded = EncodeUtf8(unit, encoded);
+            } else {
+                used = JSON_SURROGATE_PAIR_LENGTH;
+                std::uint32_t low = 0;
+                if (srcLength < JSON_SURROGATE_PAIR_LENGTH || ParseUtf16Unit(src + 8, &low) < 0
+                    || (low & SURROGATE_MASK) != LOW_SURROGATE) {
+                    status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+                } else {
+                    decoded = EncodeUtf8(CombineSurrogates(unit, low), encoded);
+                }
+            }
+        }
+    } else if (const std::size_t length = Utf8SequenceLength(lead); length != 0 && srcLength < length) {
+        decoded = 0;
+        used = length;
+        status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    } else if (length != 0 && IsValidSequence(src, length)) {
+        decoded = length;
+        used = length;
+        std::memcpy(encoded, src, length);
+    } else {
+        encoded[0] = src[0];
+    }
+    if (status == 0 && dst != nullptr && dstSize < decoded) status = NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (status == 0 && dst != nullptr) std::memcpy(dst, encoded, decoded);
+    if (dstLength != nullptr) *dstLength = decoded;
+    if (consumed != nullptr) *consumed = used;
+    return status;
+}
+
+int APS5_VABI sceNpUtilGetNthChar(std::size_t index, const char* text, const char** character) {
+    if (text == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    const char* position = text;
+    for (std::size_t i = 0; i < index && *position != '\0'; ++i) {
+        const auto lead = static_cast<unsigned char>(*position);
+        std::size_t length = 1;
+        if (lead < 0x80) {
+            if (!IsAllowedTextByte(lead)) return NP_UTIL_ERROR_INVALID_CHARACTER;
+        } else {
+            length = Utf8SequenceLength(lead);
+            if (length == 0 || !IsValidSequence(position, length)) return NP_UTIL_ERROR_INVALID_CHARACTER;
+        }
+        position += length;
+    }
+    *character = position;
+    return 0;
+}
+
+int APS5_VABI sceNpUtilHttpUrlEncode(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength,
+    std::size_t* dstLength) {
+    if (src == nullptr || srcLength == 0) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    if (dst == nullptr && dstLength == nullptr) return NP_UTIL_ERROR_INVALID_ARGUMENT;
+    std::size_t count = 0;
+    for (std::size_t i = 0; i < srcLength; ++i) {
+        const auto c = static_cast<unsigned char>(src[i]);
+        const bool escaped = c != ' ' && !IsUrlSafe(c);
+        const std::size_t length = escaped ? 3 : 1;
+        if (dst != nullptr && count + length > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+        if (dst != nullptr) {
+            if (escaped) {
+                dst[count] = '%';
+                dst[count + 1] = URL_HEX_DIGITS[c >> 4];
+                dst[count + 2] = URL_HEX_DIGITS[c & 0xF];
+            } else {
+                dst[count] = c == ' ' ? '+' : static_cast<char>(c);
+            }
+        }
+        count += length;
+    }
+    if (dst != nullptr && count + 1 > dstSize) return NP_UTIL_ERROR_BUFFER_TOO_SMALL;
+    if (dst != nullptr) dst[count] = '\0';
+    if (dstLength != nullptr) *dstLength = count + 1;
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceNpCommon/include/Api.hpp b/core/libs/prx/libSceNpCommon/include/Api.hpp
new file mode 100644
index 0000000000..6e1bf26bc7
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/include/Api.hpp
@@ -0,0 +1,222 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpAllocator {
+    void* (APS5_VABI *allocate)(std::size_t size, void* context);
+    void* (APS5_VABI *reallocate)(void* pointer, std::size_t size, void* context);
+    void (APS5_VABI *release)(void* pointer, void* context);
+    void* context;
+};
+
+struct NpAllocatorEx {
+    NpAllocator allocator;
+    int outOfMemoryError;
+};
+
+struct NpCallout {
+    NpCallout* next;
+    void (APS5_VABI *handler)(void* arg);
+    std::uint64_t deadline;
+    void* arg;
+    std::uint64_t reserved;
+};
+
+struct NpCalloutContext {
+    Pthread thread;
+    PthreadMutex mutex;
+    PthreadCond cond;
+    int initialized;
+    int stopping;
+    NpCallout* pending;
+};
+
+struct NpHeap {
+    void* mspace;
+};
+
+struct NpHeapStat {
+    std::uint64_t maxSystemSize;
+    std::uint64_t maxInuseSize;
+    std::uint64_t currentInuseSize;
+};
+
+struct NpIdFull {
+    NpOnlineId handle;
+    std::uint8_t opt[8];
+    std::uint8_t reserved[8];
+};
+
+struct NpKernelMemory {
+    std::uint64_t size;
+    std::uint64_t reserved;
+    void* address;
+};
+
+struct NpMemoryHeap {
+    NpKernelMemory memory;
+    NpHeap heap;
+};
+
+struct NpTitleIdParts {
+    char id[9];
+    char reserved;
+    std::uint8_t index;
+};
+
+extern "C" {
+
+int APS5_VABI sceNpCmpOnlineId(const NpOnlineId* onlineId1, const NpOnlineId* onlineId2);
+int APS5_VABI sceNpCmpNpIdInOrder(const NpIdFull* npId1, const NpIdFull* npId2, std::int32_t* order);
+int APS5_VABI sceNpGetPlatformType(const NpIdFull* npId);
+int APS5_VABI sceNpIntIsValidOnlineId(const NpOnlineId* onlineId);
+int APS5_VABI sceNpMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags);
+int APS5_VABI sceNpMutexDestroy(PthreadMutex* mutex);
+int APS5_VABI sceNpMutexLock(PthreadMutex* mutex);
+int APS5_VABI sceNpMutexTryLock(PthreadMutex* mutex);
+int APS5_VABI sceNpMutexUnlock(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexInit(PthreadMutex* mutex, const char* name, std::uint64_t flags);
+int APS5_VABI sceNpLwMutexDestroy(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexLock(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexTryLock(PthreadMutex* mutex);
+int APS5_VABI sceNpLwMutexUnlock(PthreadMutex* mutex);
+int APS5_VABI sceNpCondInit(PthreadCond* cond, const char* name, std::uint64_t);
+int APS5_VABI sceNpCondDestroy(PthreadCond* cond);
+int APS5_VABI sceNpCondSignal(PthreadCond* cond);
+int APS5_VABI sceNpCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, std::uint32_t usec);
+int APS5_VABI sceNpJoinThread(Pthread thread, void** retval);
+int APS5_VABI sceNpGetSystemClockUsec(std::int64_t* usec);
+void APS5_VABI sceNpGetSdkVersion(char* version);
+int APS5_VABI sceNpCloseEventFlag(void);
+int APS5_VABI sceNpCloseSema(void);
+int APS5_VABI sceNpGetNavSdkVersion(void);
+int APS5_VABI sceNpIntGetPlatformType(void);
+int APS5_VABI sceNpIntSetPlatformType(void);
+int APS5_VABI sceNpJsonParse(void);
+int APS5_VABI sceNpJsonParseBuf(void);
+int APS5_VABI sceNpJsonParseBufInit(void);
+int APS5_VABI sceNpJsonParseEx(void);
+int APS5_VABI sceNpJsonParseExInit(void);
+int APS5_VABI sceNpJsonParseInit(void);
+int APS5_VABI sceNpOpenSema(void);
+int APS5_VABI sceNpServerErrorJsonGetErrorCode(void);
+int APS5_VABI sceNpServerErrorJsonMultiGetErrorCode(void);
+int APS5_VABI sceNpServerErrorJsonParse(void);
+int APS5_VABI sceNpServerErrorJsonParseInit(void);
+int APS5_VABI sceNpServerErrorJsonParseMultiInit(void);
+int APS5_VABI sceNpSetPlatformType(void);
+int APS5_VABI sceNpUtilCanonicalizeNpIdForPs4(void);
+int APS5_VABI sceNpUtilCanonicalizeNpIdForPsp2(void);
+int APS5_VABI sceNpUtilGetDateSetAuto(void);
+int APS5_VABI sceNpUtilGetDbgCommerce(void);
+int APS5_VABI sceNpUtilGetEnv(void);
+int APS5_VABI sceNpUtilGetFakeDisplayNameMode(void);
+int APS5_VABI sceNpUtilGetFakeRateLimit(void);
+int APS5_VABI sceNpUtilGetIgnoreNpTitleId(void);
+int APS5_VABI sceNpUtilGetNpDebug(void);
+int APS5_VABI sceNpUtilGetNpTestPatch(void);
+int APS5_VABI sceNpUtilGetShareTitleCheck(void);
+int APS5_VABI sceNpUtilGetSystemLanguage(void);
+int APS5_VABI sceNpUtilGetTrcNotify(void);
+int APS5_VABI sceNpUtilGetWebApi2FakeRateLimit(void);
+int APS5_VABI sceNpUtilGetWebApi2FakeRateLimitTarget(void);
+int APS5_VABI sceNpUtilGetWebTraceSetting(void);
+int APS5_VABI sceNpUtilJidToNpId(void);
+int APS5_VABI sceNpAtomicCas32(std::int32_t* value, std::int32_t expected, std::int32_t desired);
+int APS5_VABI sceNpAtomicInc32(std::int32_t* value);
+int APS5_VABI sceNpAtomicDec32(std::int32_t* value);
+int APS5_VABI sceNpCondSignalAll(PthreadCond* cond);
+int APS5_VABI sceNpCondSignalTo(PthreadCond* cond, Pthread thread);
+int APS5_VABI sceNpCondWait(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI sceNpLwCondInit(PthreadCond* cond, const char* name);
+int APS5_VABI sceNpLwCondDestroy(PthreadCond* cond);
+int APS5_VABI sceNpLwCondSignal(PthreadCond* cond);
+int APS5_VABI sceNpLwCondSignalAll(PthreadCond* cond);
+int APS5_VABI sceNpLwCondSignalTo(PthreadCond* cond, Pthread thread);
+int APS5_VABI sceNpLwCondWait(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI sceNpCreateEventFlag(KernelEventFlag* flag, const char* name, std::uint32_t attr, std::uint64_t pattern);
+int APS5_VABI sceNpDeleteEventFlag(KernelEventFlag flag);
+int APS5_VABI sceNpOpenEventFlag(KernelEventFlag* flag, const char* name);
+int APS5_VABI sceNpSetEventFlag(KernelEventFlag flag, std::uint64_t pattern);
+int APS5_VABI sceNpClearEventFlag(KernelEventFlag flag, std::uint64_t pattern);
+int APS5_VABI sceNpPollEventFlag(KernelEventFlag flag, std::uint64_t pattern, std::uint32_t mode, std::uint64_t* result);
+int APS5_VABI sceNpCancelEventFlag(KernelEventFlag flag, std::uint64_t pattern, int* waiting);
+int APS5_VABI sceNpCreateSema(KernelSema* sema, std::uint32_t flags, int initial, int maximum, const char* name);
+int APS5_VABI sceNpDeleteSema(KernelSema sema);
+int APS5_VABI sceNpPollSema(KernelSema sema);
+int APS5_VABI sceNpSignalSema(KernelSema sema);
+int APS5_VABI sceNpCreateThread(Pthread* thread, PthreadEntry entry, void* arg, int priority, std::size_t stackSize, KernelCpumask affinity, const char* name);
+int APS5_VABI sceNpThreadGetId(Pthread* thread);
+int APS5_VABI sceNpGetProcessId(void);
+int APS5_VABI sceNpDbgDumpText(const char* text, int length);
+int APS5_VABI sceNpIpc2ClientInit(void);
+int APS5_VABI sceNpIpc2ClientTerm(void);
+int APS5_VABI sceNpArchInit(void);
+void APS5_VABI sceNpArchTerm(void);
+int APS5_VABI sceNpHeapInit(NpHeap* heap, void* base, std::size_t size, const char* name);
+void APS5_VABI sceNpHeapDestroy(NpHeap* heap);
+void APS5_VABI sceNpHeapGetAllocator(NpHeap* heap, NpAllocator* allocator);
+int APS5_VABI sceNpHeapGetStat(const NpHeap* heap, NpHeapStat* stat);
+void APS5_VABI sceNpHeapShowStat(const NpHeap* heap);
+int APS5_VABI sceNpMemoryHeapInit(NpMemoryHeap* heap, std::uint64_t size, const char* name);
+void APS5_VABI sceNpMemoryHeapDestroy(NpMemoryHeap* heap);
+void APS5_VABI sceNpMemoryHeapGetAllocator(NpMemoryHeap* heap, NpAllocator* allocator);
+void APS5_VABI sceNpMemoryHeapGetAllocatorEx(NpMemoryHeap* heap, int outOfMemoryError, NpAllocatorEx* allocator);
+void APS5_VABI sceNpGlobalHeapGetAllocator(NpAllocator* allocator);
+void APS5_VABI sceNpGlobalHeapGetAllocatorEx(NpAllocatorEx* allocator);
+NpAllocator* APS5_VABI sceNpGlobalHeapGetAllocatorPtr(void);
+NpAllocatorEx* APS5_VABI sceNpGlobalHeapGetAllocatorExPtr(void);
+int APS5_VABI sceNpAllocateKernelMemoryNoAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory);
+int APS5_VABI sceNpAllocateKernelMemoryWithAlignment(std::uint64_t size, const char* name, void** address, NpKernelMemory* memory);
+int APS5_VABI sceNpFreeKernelMemory(NpKernelMemory* memory);
+void APS5_VABI sceNpGetSdkVersionUInt(std::uint32_t* version);
+int APS5_VABI sceNpRtcConvertToPosixTime(const RtcTick* tick, std::int64_t* seconds);
+int APS5_VABI sceNpRtcFormatRFC3339(char* text, std::size_t size, const RtcTick* utc, int timeZoneMinutes);
+int APS5_VABI sceNpUserGetUserIdList(int* users, std::size_t capacity, int* count);
+int APS5_VABI sceNpRtcParseRFC3339(RtcTick* utc, const char* text);
+int APS5_VABI sceNpCalloutInitCtx(NpCalloutContext* context, const char* name, std::size_t stackSize, int priority, KernelCpumask affinity);
+void APS5_VABI sceNpCalloutTermCtx(NpCalloutContext* context);
+int APS5_VABI sceNpCalloutStartOnCtx64(NpCalloutContext* context, NpCallout* callout, std::uint64_t usec, void (APS5_VABI *handler)(void* arg), void* arg);
+int APS5_VABI sceNpCalloutStartOnCtx(NpCalloutContext* context, NpCallout* callout, std::uint32_t usec, void (APS5_VABI *handler)(void* arg), void* arg);
+int APS5_VABI sceNpCalloutStopOnCtx(NpCalloutContext* context, NpCallout* callout, int* wasPending);
+std::uint32_t APS5_VABI sceNpGetRandom(void);
+int APS5_VABI sceNpUtilCmpAccountId(std::uint64_t left, std::uint64_t right);
+int APS5_VABI sceNpCmpNpId(const void* npId1, const void* npId2);
+bool APS5_VABI sceNpIntIsOnlineIdString(const char* text);
+int APS5_VABI sceNpUtilGetNpLanguageCode(int language, char* code);
+int APS5_VABI sceNpUtilGetNpLanguageCode2(int language, char* tag);
+const char* APS5_VABI sceNpUtilGetNpLanguageCodeStr(int language);
+const char* APS5_VABI sceNpUtilGetNpLanguageCode2Str(int language);
+std::uint32_t APS5_VABI sceNpDbgAssignDebugId(void);
+int APS5_VABI sceNpUtilBuildTitleId(const NpTitleIdParts* parts, char* titleId, std::size_t size);
+void APS5_VABI sceNpDbgDumpBinary(const void* data, std::size_t size);
+int APS5_VABI sceNpBase64GetDecodeSize(const char* src, std::size_t length);
+int APS5_VABI sceNpBase64Decoder(const char* src, std::size_t length, void* dst, std::size_t capacity);
+int APS5_VABI sceNpBase64Encoder(const void* src, char* dst, std::size_t length);
+int APS5_VABI sceNpBase64UrlGetDecodeSize(const char* src, std::size_t length);
+int APS5_VABI sceNpBase64UrlDecoder(const char* src, std::size_t length, void* dst, std::size_t capacity);
+int APS5_VABI sceNpBase64UrlEncoder(const void* src, char* dst, std::size_t length);
+int APS5_VABI sceNpHexToInt(int c);
+int APS5_VABI sceNpIntToHex(std::uint32_t value, bool uppercase);
+int APS5_VABI sceNpUInt32ToStr(char* buf, std::size_t size, std::uint32_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpUInt64ToStr(char* buf, std::size_t size, std::uint64_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpInt32ToStr(char* buf, std::size_t size, std::int32_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpInt64ToStr(char* buf, std::size_t size, std::int64_t value, std::uint32_t radix, std::uint32_t flags, std::size_t* length);
+int APS5_VABI sceNpStrToInt32(const char* str, std::int32_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrToInt64(const char* str, std::int64_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrToUInt32(const char* str, std::uint32_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrToUInt64(const char* str, std::uint64_t* value, int base, std::size_t* parsedLength);
+int APS5_VABI sceNpStrBuildHex(char* dst, std::size_t size, const void* src, std::size_t length, bool uppercase);
+int APS5_VABI sceNpStrParseHex(const char* hex, void* out, std::size_t capacity);
+int APS5_VABI sceNpStrnParseHex(const char* hex, std::size_t length, void* out, std::size_t capacity);
+int APS5_VABI sceNpStrcpyToBuf(char* dst, std::size_t size, const char* src);
+int APS5_VABI sceNpStrncpyToBuf(char* dst, std::size_t size, const char* src, std::size_t maxLength);
+int APS5_VABI sceNpUtilJsonEscape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength);
+int APS5_VABI sceNpUtilJsonUnescape(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength, std::size_t* dstLength);
+int APS5_VABI sceNpUtilJsonGetOneChar(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength, std::size_t* dstLength, std::size_t* consumed);
+int APS5_VABI sceNpUtilGetNthChar(std::size_t index, const char* text, const char** character);
+int APS5_VABI sceNpUtilHttpUrlEncode(char* dst, std::size_t dstSize, const char* src, std::size_t srcLength, std::size_t* dstLength);
+
+[[noreturn]] void APS5_VABI sceNpPanic(void);
+
+}
diff --git a/core/libs/prx/libSceNpCommon/libSceNpCommon.hpp b/core/libs/prx/libSceNpCommon/libSceNpCommon.hpp
new file mode 100644
index 0000000000..baf8782fd4
--- /dev/null
+++ b/core/libs/prx/libSceNpCommon/libSceNpCommon.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpCommon/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpCppWebApi/Export.cpp b/core/libs/prx/libSceNpCppWebApi/Export.cpp
index 6238d389f8..6ab09331ae 100644
--- a/core/libs/prx/libSceNpCppWebApi/Export.cpp
+++ b/core/libs/prx/libSceNpCppWebApi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -272,11 +273,6 @@ int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12
     return 0;
 }
 
-struct IntrusivePtr {
-    void* object;
-    void (APS5_VABI* deleter)(void*);
-    void* libContext;
-};
 static_assert(sizeof(IntrusivePtr) == 0x18);
 
 static constexpr std::size_t ReferenceCountOffset = 0;
@@ -463,12 +459,6 @@ int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12Intrusive
     return 0;
 }
 
-struct CommonString {
-    std::int32_t referenceCount;
-    char* buffer;
-    std::uint64_t bufferSize;
-    void* libContext;
-};
 static_assert(sizeof(CommonString) == 0x20 && offsetof(CommonString, buffer) == 0x08);
 static_assert(offsetof(CommonString, bufferSize) == 0x10 && offsetof(CommonString, libContext) == 0x18);
 
@@ -896,7 +886,6 @@ static int VectorPushBackString(IntrusivePtr* self, const CommonString* element)
 // libSceNpCppWebApi.prx.
 // --------------------------------------------------------------------------
 
-
 void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
     CopyIntrusivePtr(self, source, 0x00);
 }
@@ -1487,124 +1476,102 @@ int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev(void* self) {
+    (void)self;
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev(void* self) {
+    (void)self;
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev(IntrusivePtr* self) {
+    *self = {};
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
-int APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv(const IntrusivePtr* self) {
+    return self->object;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
 }
 
 bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEneERKS9_(const void* self, const void* other) {
@@ -1759,8 +1726,7 @@ int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToG
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE() {
     return 0;
 }
 
@@ -1775,19 +1741,17 @@ int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToG
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv() {
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerD1Ev(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerD1Ev(void* self) {
+    (void)self;
     return 0;
 }
 
-int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi12getContainerEiRKNS4_23ParameterToGetContainerERNS1_6Common11TransactionINS8_12IntrusivePtrINS8_6VectorINSA_INS3_9ContainerEEEEEEENSA_INS8_18ResponseHeaderBaseEEEEE(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi12getContainerEiRKNS4_23ParameterToGetContainerERNS1_6Common11TransactionINS8_12IntrusivePtrINS8_6VectorINSA_INS3_9ContainerEEEEEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
 }
 
 const char* APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product8getLabelEv(const void* self) {
@@ -1890,4 +1854,1378 @@ std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V15Owner12getAc
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi10getFriendsEiRKNS4_21ParameterToGetFriendsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_18GetFriendsResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends10initializeEPNS1_6Common10LibContextEPKc() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends9terminateEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsD1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi17getBasicPresencesEiRKNS4_28ParameterToGetBasicPresencesERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_25GetBasicPresencesResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences10initializeEPNS1_6Common10LibContextEPKc() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences9terminateEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesD1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V118GetFriendsResponse10getFriendsEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+// --------------------------------------------------------------------------
+// SessionManager2V1 PlayerSessionsApi + InGameCatalog2V5 ContainerApi and Common
+// container helpers imported by titles whose dumps lack libSceNpCppWebApi.prx:
+// request entry points and transactions fail SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN
+// offline; parameter bookkeeping succeeds; response accessors stay unimplemented.
+// --------------------------------------------------------------------------
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBody14setInvitationsERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_30RequestPlayerSessionInvitationEEEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28sendPlayerSessionInvitationsEiRKNS4_39ParameterToSendPlayerSessionInvitationsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_50PostPlayerSessionsSessionIdInvitationsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi17getPlayerSessionsEiRKNS4_28ParameterToGetPlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_29GetPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession14setCustomData2EPKvm() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsers10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_60PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionProperties10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_39PatchPlayerSessionsSessionIdRequestBodyEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeader9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionPropertiesC1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsers9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession14setCustomData1EPKvm() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead16customData2IsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V124GetBlockingUsersResponse9getBlocksEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionPropertiesD1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitations10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_49PostPlayerSessionsSessionIdInvitationsRequestBodyEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V146PatchPlayerSessionsSessionIdRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_39PatchPlayerSessionsSessionIdRequestBodyEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V137RequestPlayerSessionInvitationFactory6createEPNS1_6Common10LibContextENS5_12IntrusivePtrINS3_2ToEEEPNS8_INS3_30RequestPlayerSessionInvitationEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody19setJoinableUserTypeERKNS3_22CustomJoinableUserTypeE() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V127ResponsePlayerSessionPlayer11getPlatformEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V125GetBasicPresencesResponse17getBasicPresencesEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions9setfieldsENS1_6Common12IntrusivePtrINS6_6VectorINS6_6StringEEEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSession9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitationsD1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead14getCustomData1Ev() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi16getBlockingUsersEiRKNS4_27ParameterToGetBlockingUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_24GetBlockingUsersResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers10initializeEPNS1_6Common10LibContextE() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers9terminateEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessions9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead16customData1IsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38addPlayerSessionJoinableSpecifiedUsersEiRKNS4_49ParameterToAddPlayerSessionJoinableSpecifiedUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_61PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead9getLeaderEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitationsC1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessionsD1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead28getExclusiveLeaderPrivilegesEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi26setPlayerSessionPropertiesEiRKNS4_37ParameterToSetPlayerSessionPropertiesERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi25changePlayerSessionLeaderEiRKNS4_36ParameterToChangePlayerSessionLeaderERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V150PutPlayerSessionsSessionIdLeaderRequestBodyFactory6createEPNS1_6Common10LibContextERKNS_4Json5ValueEPNS5_12IntrusivePtrINS3_43PutPlayerSessionsSessionIdLeaderRequestBodyEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V119JoinableUserFactory6createEPNS1_6Common10LibContextERKmPNS5_12IntrusivePtrINS3_12JoinableUserEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeaderD1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V156PostPlayerSessionsSessionIdInvitationsRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_49PostPlayerSessionsSessionIdInvitationsRequestBodyEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitations9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions10initializeEPNS1_6Common10LibContextEPKc() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessionsC1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V133ResponsePlayerSessionMemberPlayer10getPlayersEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody28setExclusiveLeaderPrivilegesERKNS1_6Common6VectorINS5_6StringEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V113PlayerSession9getMemberEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V19ToFactory6createEPNS1_6Common10LibContextERKmPNS5_12IntrusivePtrINS3_2ToEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsersD1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeader10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_43PutPlayerSessionsSessionIdLeaderRequestBodyEEE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V167PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_12JoinableUserEEEEEPNS9_INS3_60PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeaderC1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionProperties9terminateEv() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V118LeaderWithOnlineId12getAccountIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody20setInvitableUserTypeERKNS3_23CustomInvitableUserTypeE() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V129GetPlayerSessionsResponseBody17getPlayerSessionsEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsersC1Ev() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead14getCustomData2Ev() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V127ResponsePlayerSessionPlayer12getAccountIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V112JoinableUserEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersD1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi15filterProfanityEiRKNS4_26ParameterToFilterProfanityERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23FilterProfanityResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity10initializeEPNS1_6Common10LibContextEPKcSA_NS6_12IntrusivePtrINS3_19WebApiFilterRequestEEE() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity9terminateEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityD1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V226WebApiFilterRequestFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_19WebApiFilterRequestEEE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi33getCommunicationRestrictionStatusEiRKNS4_44ParameterToGetCommunicationRestrictionStatusERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_38CommunicationRestrictionStatusResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus10initializeEPNS1_6Common10LibContextEm() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus9terminateEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusD1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, ReferenceCountOffset);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, ReferenceCountOffset, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, ReferenceCountOffset, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, ReferenceCountOffset, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, VectorReferenceCountOffset, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEED2Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEEdeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V118LeaderWithOnlineIdEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorImED2Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element) {
+    return VectorPushBackIntrusivePtr(self, static_cast<const IntrusivePtr*>(element));
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEaSERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+    CopyIntrusivePtr(self, source, 0x00);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V120PlayerSessionForReadEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv() {
+ return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common18ResponseHeaderBase14getHeaderValueEPKcRNS2_12IntrusivePtrINS2_6StringEEE() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE3endEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE5beginEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorImE3endEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorImE5beginEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEppEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorImEppEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence12getAccountIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence12getInContextEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence15getOnlineStatusEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi15ProfanityFilter2V223FilterProfanityResponse10getMessageEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponse13getRestrictedEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_() {
+ return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE4sizeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEE5emptyEv(const IntrusivePtr* self) {
+    const auto* body = static_cast<const VectorBody*>(self->object);
+    if (body == nullptr) return 1;
+    if (body->magic != VectorBodyMagic) {
+        NotImplemented_nid_no_patch(__func__);
+        return 0;
+    }
+    return body->size == 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEaSERKSA_(IntrusivePtr* self, const IntrusivePtr* source) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+    CopyIntrusivePtr(self, source, 0x30);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x00);
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext) {
+    self->object = nullptr;
+    self->deleter = nullptr;
+    self->libContext = libContext;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext) {
+    self->object = nullptr;
+    self->deleter = nullptr;
+    self->libContext = libContext;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorImE4sizeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEdeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEixEm(IntrusivePtr* self, unsigned long index) {
+    auto* body = static_cast<VectorBody*>(self->object);
+    if (body == nullptr || body->magic != VectorBodyMagic || body->elementKind != 1) {
+        NotImplemented_nid_no_patch(__func__);
+        return nullptr;
+    }
+    return static_cast<IntrusivePtr*>(body->elements) + index;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEED2Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEneERKS9_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V133ResponsePlayerSessionMemberPlayerEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V133ResponsePlayerSessionMemberPlayerEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext) {
+    self->object = nullptr;
+    self->deleter = nullptr;
+    self->libContext = libContext;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorImEdeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V118LeaderWithOnlineIdEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorImEneERKS4_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEE4sizeEv(const IntrusivePtr* self) {
+    const auto* body = static_cast<const VectorBody*>(self->object);
+    if (body == nullptr) return 0;
+    if (body->magic != VectorBodyMagic) {
+        NotImplemented_nid_no_patch(__func__);
+        return 0;
+    }
+    return body->size;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V120PlayerSessionForReadEEEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEE5beginEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element) {
+    return VectorPushBackIntrusivePtr(self, static_cast<const IntrusivePtr*>(element));
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE() {
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEE8copyFromERKS9_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x00, __func__);
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku10labelIsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku10priceIsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku8getPriceEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku15getDisplayPriceEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer7setsortENS5_4SortE() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku18originalPriceIsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getDescriptionEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getReleaseDateEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku23getDisplayOriginalPriceEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getDisplayNameEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku16getOriginalPriceEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku25displayOriginalPriceIsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku8getLabelEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9setoffsetEi() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product16releaseDateIsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setcontainerIdsEPKc() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer8setlimitEi() {
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku17displayPriceIsSetEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product5getIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEaSERKSE_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEppEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE5emptyEv(const IntrusivePtr* self) {
+    const auto* body = static_cast<const VectorBody*>(self->object);
+    if (body == nullptr) return 1;
+    if (body->magic != VectorBodyMagic) {
+        NotImplemented_nid_no_patch(__func__);
+        return 0;
+    }
+    return body->size == 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEneERKS9_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE5beginEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEneERKS9_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V53SkuEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEED2Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE3endEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEdeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEdeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1ERKSA_(IntrusivePtr* self, const IntrusivePtr* source) {
+    CopyIntrusivePtr(self, source, 0x30);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEC1ERKSE_(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEED2Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE5beginEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE3endEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEdeEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEppEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE5emptyEv(const IntrusivePtr* self) {
+    const auto* body = static_cast<const VectorBody*>(self->object);
+    if (body == nullptr) return 1;
+    if (body->magic != VectorBodyMagic) {
+        NotImplemented_nid_no_patch(__func__);
+        return 0;
+    }
+    return body->size == 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEaSERKSA_(IntrusivePtr* self, const IntrusivePtr* source) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+    CopyIntrusivePtr(self, source, 0x30);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEppEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEC1Ev(IntrusivePtr* self) {
+    *self = {};
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEED1Ev(IntrusivePtr* self) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_6StringEED2Ev(void* self) {
+    (void)self;
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8copyFromERKS5_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEneERKS5_() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE11hasResponseEv() {
+    return 0;
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEptEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE3endEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringeqEPKc(const CommonString* self, const char* other) {
+    return other != nullptr && std::strcmp(self->buffer != nullptr ? self->buffer : "", other) == 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5getIdEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEaSERS6_(IntrusivePtr* self, const IntrusivePtr* source) {
+    ReleaseIntrusivePtr(self, 0x30, __func__);
+    CopyIntrusivePtr(self, source, 0x30);
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5abortEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE5beginEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5emptyEv(const CommonString* self) {
+    return self->buffer == nullptr || self->buffer[0] == '\0';
+}
+
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEE3getEv(const IntrusivePtr* self) {
+    return self->object;
+}
+
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEdeEv() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 }
diff --git a/core/libs/prx/libSceNpCppWebApi/include/Api.hpp b/core/libs/prx/libSceNpCppWebApi/include/Api.hpp
new file mode 100644
index 0000000000..cdb32647a1
--- /dev/null
+++ b/core/libs/prx/libSceNpCppWebApi/include/Api.hpp
@@ -0,0 +1,684 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct CommonString {
+    std::int32_t referenceCount;
+    char* buffer;
+    std::uint64_t bufferSize;
+    void* libContext;
+};
+
+struct IntrusivePtr {
+    void* object;
+    void (APS5_VABI* deleter)(void*);
+    void* libContext;
+};
+
+extern "C" {
+
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V111UserFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_4UserEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody18setStartSerialRankERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody8setGroupERKNS3_5GroupE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody8setLimitERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody8setUsersERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_4UserEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V121GetRankingRequestBody9setOffsetERKi();
+void* APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122GetRankingResponseBody10getEntriesEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody10setCommentEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody12setSmallDataEPKvm();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody15setNeedsTmpRankERKb();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody19setComparedDateTimeERK10SceRtcTick();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V122RecordScoreRequestBody7setPcIdERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V128GetRankingRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_21GetRankingRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V129RecordScoreRequestBodyFactory6createEPNS1_6Common10LibContextElPNS5_12IntrusivePtrINS3_22RecordScoreRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V14User12setAccountIdERKm();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V14User7setPcIdERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi10getRankingEiRKNS4_21ParameterToGetRankingERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_22GetRankingResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRanking10initializeEPNS1_6Common10LibContextEi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRanking24setgetRankingRequestBodyENS1_6Common12IntrusivePtrINS3_21GetRankingRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRanking9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRankingC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi21ParameterToGetRankingD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi22getLargeDataByObjectIdEiRKNS4_33ParameterToGetLargeDataByObjectIdERNS1_6Common21DownStreamTransactionINS8_12IntrusivePtrINS4_37GetLargeDataByObjectIdResponseHeadersEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectId10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectId9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectIdC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V17ViewApi33ParameterToGetLargeDataByObjectIdD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi18getBoardDefinitionEiRKNS4_29ParameterToGetBoardDefinitionERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_30GetBoardDefinitionResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinition10initializeEPNS1_6Common10LibContextEi();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinition9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinitionC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19BoardsApi29ParameterToGetBoardDefinitionD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi11recordScoreEiRKNS4_22ParameterToRecordScoreERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23RecordScoreResponseBodyEEENSA_INS4_26RecordScoreResponseHeadersEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi15recordLargeDataEiRKNS4_26ParameterToRecordLargeDataERNS1_6Common19UpStreamTransactionINS8_12IntrusivePtrINS3_27RecordLargeDataResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScore10initializeEPNS1_6Common10LibContextEiNS6_12IntrusivePtrINS3_22RecordScoreRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScore22setxPsnAtomicOperationENS5_19XPsnAtomicOperationE();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScore9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScoreC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi22ParameterToRecordScoreD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeData10initializeEPNS1_6Common10LibContextEiNS5_19XPsnAtomicOperationEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeData9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeDataC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi12Leaderboards2V19RecordApi26ParameterToRecordLargeDataD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi12downloadDataEiRKNS4_23ParameterToDownloadDataERNS1_6Common21DownStreamTransactionINS8_12IntrusivePtrINS4_27DownloadDataResponseHeadersEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData10initializeEPNS1_6Common10LibContextEPKci();
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadDataD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10InitParamsC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10InitParamsD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10LibContextC1Ev(uint64_t* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common10initializeERKNS2_10InitParamsERNS2_10LibContextE(const void* params, uint64_t* context);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextEm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE8sendDataEPKvm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common19UpStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V127RecordLargeDataResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEE8readDataEPcm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_12Leaderboards2V17ViewApi37GetLargeDataByObjectIdResponseHeadersEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEE8readDataEPcm();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common21DownStreamTransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V17DataApi27DownloadDataResponseHeadersEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(CommonString* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringD1Ev(CommonString* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V14UserEEEE8pushBackERKS8_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V14UserEEEEC1EPNS2_10LibContextE(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V14UserEEEED1Ev(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEE3endEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEE5beginEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEEppEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common9terminateERNS2_10LibContextE(uint64_t* context);
+const void* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V122GetRankingResponseBody22getLastUpdatedDateTimeEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V123RecordScoreResponseBody10getTmpRankEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V123RecordScoreResponseBody16getTmpSerialRankEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody11getSortModeEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody13getEntryLimitEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody13getUpdateModeEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody13sortModeIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody15entryLimitIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody15updateModeIsSetEv(const void* self);
+std::int64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody16getMaxScoreLimitEv(const void* self);
+std::int64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody16getMinScoreLimitEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody18maxScoreLimitIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody18minScoreLimitIsSetEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody20getLargeDataNumLimitEv(const void* self);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody21getLargeDataSizeLimitEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody22largeDataNumLimitIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V130GetBoardDefinitionResponseBody23largeDataSizeLimitIsSetEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry10getCommentEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry11getObjectIdEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry11getOnlineIdEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry12commentIsSetEv(const void* self);
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry12getAccountIdEv(const void* self);
+const void* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry12getSmallDataEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry13getSerialRankEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry13objectIdIsSetEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry14getHighestRankEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry14smallDataIsSetEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry20getHighestSerialRankEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry7getPcIdEv(const void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry7getRankEv(const void* self);
+std::int64_t APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V15Entry8getScoreEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi12Leaderboards2V19RecordApi26RecordScoreResponseHeaders24getXPsnAtomicOperationIdEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE11getResponseERS8_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V15EntryEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6BinaryEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEEdeEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEENS4_INS6_9RecordApi26RecordScoreResponseHeadersEEEE18getResponseHeadersERSB_();
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6Binary4sizeEv(const void* self);
+const void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common6Binary9getBinaryEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(const CommonString* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEEdeEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_12Leaderboards2V15EntryEEEEneERKS9_(const void* self, const void* other);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession16setMaxSpectatorsERKi();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139RequestPlayerSessionMemberPlayerFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_32RequestCreatePlayerSessionPlayerEEEEEPNS9_INS3_32RequestPlayerSessionMemberPlayerEEE();
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEE3endEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayerD1Ev();
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V110FromMember11getOnlineIdEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitations26setinvitationInvalidFilterEPKc();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V151PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSessionD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V122LocalizedStringFactory6createEPNS1_6Common10LibContextEPKcNS_4Json6ObjectEPNS5_12IntrusivePtrINS3_15LocalizedStringEEE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V151PostPlayerSessionsSessionIdMemberPlayersRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEED2Ev(void* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession20setInvitableUserTypeERKNS3_17InvitableUserTypeE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEE5beginEv(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129PostPlayerSessionsRequestBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEEEdeEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V151PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi25joinPlayerSessionAsPlayerEiRKNS4_36ParameterToJoinPlayerSessionAsPlayerERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_52PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6String6appendEPKc(CommonString* self, const char* text);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15DefaultResponseC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayer9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessions10initializeEPNS1_6Common10LibContextENS6_12IntrusivePtrINS3_29PostPlayerSessionsRequestBodyEEE();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V110FromMemberEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestPlayerSessionMemberPlayerEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSessionC1Ev();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEC1Ev(IntrusivePtr* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead12getSessionIdEv(const void* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead7getFromEv(const void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129PostPlayerSessionsRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V130PostPlayerSessionsResponseBody17getPlayerSessionsEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi18leavePlayerSessionEiRKNS4_29ParameterToLeavePlayerSessionERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessionsD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi27getPlayerSessionInvitationsEiRKNS4_38ParameterToGetPlayerSessionInvitationsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_54GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestPlayerSessionMemberPlayerEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEdeEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V110FromMemberEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitationsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEppEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession19setJoinableUserTypeERKNS3_16JoinableUserTypeE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitationsD1Ev();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestPlayerSessionMemberPlayerEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead14sessionIdIsSetEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead17invitationIdIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessionsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayer10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_51PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEE();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBody16invitationsIsSetEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEEEixEm(void* self, std::uint64_t index);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSession10initializeEPNS1_6Common10LibContextEPKcSA_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V115LocalizedStringEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEdeEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitations9setfieldsENS1_6Common12IntrusivePtrINS6_6VectorINS6_6StringEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15DefaultResponseD1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1EPS6_PFvS8_EPNS2_10LibContextE(IntrusivePtr* self, void* body, void (APS5_VABI* deleter)(void*), void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V133RequestPlayerSessionPlayerFactory6createEPNS1_6Common10LibContextEPKcS9_PNS5_12IntrusivePtrINS3_26RequestPlayerSessionPlayerEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi20createPlayerSessionsEiRKNS4_31ParameterToCreatePlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_30PostPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToJoinPlayerSessionAsPlayerC1Ev();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead9fromIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V126RequestPlayerSessionPlayer15setPushContextsERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_24PlayerSessionPushContextEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V127RequestPlayerSessionFactory6createEPNS1_6Common10LibContextEiNS5_12IntrusivePtrINS3_32RequestPlayerSessionMemberPlayerEEERKNS5_6VectorINS5_6StringEEENS8_INS3_15LocalizedStringEEEPNS8_INS3_20RequestPlayerSessionEEE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V131PlayerSessionPushContextFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_24PlayerSessionPushContextEEE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129PostPlayerSessionsRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(IntrusivePtr* self, const void* element);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEEEneERKS9_(const void* self, const void* other);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38ParameterToGetPlayerSessionInvitations10initializeEPNS1_6Common10LibContextEPKc();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBody14getInvitationsEv(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V132RequestCreatePlayerSessionPlayerEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE6finishEv();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V136UsersPlayerSessionsInvitationForRead22receivedTimestampIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120RequestPlayerSessionEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE11getResponseERS4_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V154GetUsersAccountIdPlayerSessionsInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139RequestCreatePlayerSessionPlayerFactory6createEPNS1_6Common10LibContextEPKcS9_RKNS5_6VectorINS5_12IntrusivePtrINS3_24PlayerSessionPushContextEEEEEPNSB_INS3_32RequestCreatePlayerSessionPlayerEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V124PlayerSessionPushContextEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V136UsersPlayerSessionsInvitationForReadEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEC1Ev(IntrusivePtr* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V113PlayerSession12getSessionIdEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V158PostPlayerSessionsSessionIdMemberPlayersRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_26RequestPlayerSessionPlayerEEEEEPNS9_INS3_51PostPlayerSessionsSessionIdMemberPlayersRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V136PostPlayerSessionsRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_20RequestPlayerSessionEEEEEPNS9_INS3_29PostPlayerSessionsRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession28setExclusiveLeaderPrivilegesERKNS1_6Common6VectorINS5_6StringEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev(IntrusivePtr* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEneERKS9_(const void* self, const void* other);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEdeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEEppEv(void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEEneERKS9_(const void* self, const void* other);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEEdeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEEppEv(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERSB_(const void* self, void* response);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_(const void* self, void* response);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE(void* self, void* context);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE(void* self, void* context);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEixEm(void* self, std::uint64_t index);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE4sizeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE5beginEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE3endEv(void* self);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE4sizeEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEE5beginEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEE3endEv(void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V59Container11getChildrenEv(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerC1Ev(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer10initializeEPNS1_6Common10LibContextE();
+bool APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer13isInitializedEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setserviceLabelEi(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainerD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi12getContainerEiRKNS4_23ParameterToGetContainerERNS1_6Common11TransactionINS8_12IntrusivePtrINS8_6VectorINSA_INS3_9ContainerEEEEEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product8getLabelEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V57Product7getSkusEv(void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product7getTypeEv(const void* self);
+bool APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product9skusIsSetEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi23ParameterToDownloadData11setobjectIdEPKc(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserC1Ev(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser10initializeEPNS1_6Common10LibContextEPKcSA_(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9setfieldsEPKc(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUser9terminateEv(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi37ParameterToGetMultiDataStatusesByUserD1Ev(void);
+int APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V17DataApi26getMultiDataStatusesByUserEiRKNS4_37ParameterToGetMultiDataStatusesByUserERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_32GetMultiDataStatusesResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE(void);
+std::size_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus11getDataSizeEv(const void* self);
+const char* APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus11getObjectIdEv(const void* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus8getOwnerEv(const void* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V110DataStatus9getSlotIdEv(const void* self);
+void* APS5_VABI _ZN3sce2Np9CppWebApi17TitleCloudStorage2V132GetMultiDataStatusesResponseBody17getDataStatusListEv(void* self);
+std::uint32_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V132GetMultiDataStatusesResponseBody23getTotalDataStatusCountEv(const void* self);
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi17TitleCloudStorage2V15Owner12getAccountIdEv(const void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi10getFriendsEiRKNS4_21ParameterToGetFriendsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_18GetFriendsResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi17getBasicPresencesEiRKNS4_28ParameterToGetBasicPresencesERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_25GetBasicPresencesResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V118GetFriendsResponse10getFriendsEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBody14setInvitationsERKNS1_6Common6VectorINS5_12IntrusivePtrINS3_30RequestPlayerSessionInvitationEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28sendPlayerSessionInvitationsEiRKNS4_39ParameterToSendPlayerSessionInvitationsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_50PostPlayerSessionsSessionIdInvitationsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi17getPlayerSessionsEiRKNS4_28ParameterToGetPlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_29GetPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession14setCustomData2EPKvm();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsers10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_60PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionProperties10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_39PatchPlayerSessionsSessionIdRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeader9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionPropertiesC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsers9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120RequestPlayerSession14setCustomData1EPKvm();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead16customData2IsSetEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V124GetBlockingUsersResponse9getBlocksEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionPropertiesD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitations10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_49PostPlayerSessionsSessionIdInvitationsRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V146PatchPlayerSessionsSessionIdRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_39PatchPlayerSessionsSessionIdRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V137RequestPlayerSessionInvitationFactory6createEPNS1_6Common10LibContextENS5_12IntrusivePtrINS3_2ToEEEPNS8_INS3_30RequestPlayerSessionInvitationEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody19setJoinableUserTypeERKNS3_22CustomJoinableUserTypeE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V127ResponsePlayerSessionPlayer11getPlatformEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V125GetBasicPresencesResponse17getBasicPresencesEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions9setfieldsENS1_6Common12IntrusivePtrINS6_6VectorINS6_6StringEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi29ParameterToLeavePlayerSession9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitationsD1Ev();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead14getCustomData1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi16getBlockingUsersEiRKNS4_27ParameterToGetBlockingUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_24GetBlockingUsersResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers10initializeEPNS1_6Common10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi31ParameterToCreatePlayerSessions9terminateEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead16customData1IsSetEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi38addPlayerSessionJoinableSpecifiedUsersEiRKNS4_49ParameterToAddPlayerSessionJoinableSpecifiedUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_61PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead9getLeaderEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitationsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessionsD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead28getExclusiveLeaderPrivilegesEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi26setPlayerSessionPropertiesEiRKNS4_37ParameterToSetPlayerSessionPropertiesERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi25changePlayerSessionLeaderEiRKNS4_36ParameterToChangePlayerSessionLeaderERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V150PutPlayerSessionsSessionIdLeaderRequestBodyFactory6createEPNS1_6Common10LibContextERKNS_4Json5ValueEPNS5_12IntrusivePtrINS3_43PutPlayerSessionsSessionIdLeaderRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V119JoinableUserFactory6createEPNS1_6Common10LibContextERKmPNS5_12IntrusivePtrINS3_12JoinableUserEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeaderD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V156PostPlayerSessionsSessionIdInvitationsRequestBodyFactory6createEPNS1_6Common10LibContextEPNS5_12IntrusivePtrINS3_49PostPlayerSessionsSessionIdInvitationsRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi39ParameterToSendPlayerSessionInvitations9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessions10initializeEPNS1_6Common10LibContextEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi28ParameterToGetPlayerSessionsC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V133ResponsePlayerSessionMemberPlayer10getPlayersEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody28setExclusiveLeaderPrivilegesERKNS1_6Common6VectorINS5_6StringEEE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V113PlayerSession9getMemberEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V19ToFactory6createEPNS1_6Common10LibContextERKmPNS5_12IntrusivePtrINS3_2ToEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsersD1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeader10initializeEPNS1_6Common10LibContextEPKcNS6_12IntrusivePtrINS3_43PutPlayerSessionsSessionIdLeaderRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V167PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyFactory6createEPNS1_6Common10LibContextERKNS5_6VectorINS5_12IntrusivePtrINS3_12JoinableUserEEEEEPNS9_INS3_60PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi36ParameterToChangePlayerSessionLeaderC1Ev();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi37ParameterToSetPlayerSessionProperties9terminateEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V118LeaderWithOnlineId12getAccountIdEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V139PatchPlayerSessionsSessionIdRequestBody20setInvitableUserTypeERKNS3_23CustomInvitableUserTypeE();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V129GetPlayerSessionsResponseBody17getPlayerSessionsEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi49ParameterToAddPlayerSessionJoinableSpecifiedUsersC1Ev();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V120PlayerSessionForRead14getCustomData2Ev();
+int APS5_VABI _ZNK3sce2Np9CppWebApi14SessionManager2V127ResponsePlayerSessionPlayer12getAccountIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V112JoinableUserEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi15filterProfanityEiRKNS4_26ParameterToFilterProfanityERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23FilterProfanityResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity10initializeEPNS1_6Common10LibContextEPKcSA_NS6_12IntrusivePtrINS3_19WebApiFilterRequestEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi15ProfanityFilter2V226WebApiFilterRequestFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_19WebApiFilterRequestEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi33getCommunicationRestrictionStatusEiRKNS4_44ParameterToGetCommunicationRestrictionStatusERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_38CommunicationRestrictionStatusResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus10initializeEPNS1_6Common10LibContextEm();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus9terminateEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusD1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEED2Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEEdeEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V118LeaderWithOnlineIdEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorImED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEaSERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V120PlayerSessionForReadEEEEEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common18ResponseHeaderBase14getHeaderValueEPKcRNS2_12IntrusivePtrINS2_6StringEEE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE3endEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorImE3endEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorImE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEppEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorImEppEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence12getAccountIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence12getInContextEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi11UserProfile2V113BasicPresence15getOnlineStatusEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi15ProfanityFilter2V223FilterProfanityResponse10getMessageEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponse13getRestrictedEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEE3getEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEE3getEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEE4sizeEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEE5emptyEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEaSERKSA_(IntrusivePtr* self, const IntrusivePtr* source);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEEC1ERS7_(IntrusivePtr* self, const IntrusivePtr* source);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEE3getEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEEptEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEEE3getEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V160PostPlayerSessionsSessionIdJoinableSpecifiedUsersRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V12ToEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorImE4sizeEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEdeEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void* APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEEixEm(IntrusivePtr* self, unsigned long index);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V143PutPlayerSessionsSessionIdLeaderRequestBodyEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEEEneERKS9_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEptEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V139PatchPlayerSessionsSessionIdRequestBodyEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEE3getEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V133ResponsePlayerSessionMemberPlayerEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEC1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V133ResponsePlayerSessionMemberPlayerEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V129GetPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11getResponseERS8_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V113PlayerSessionEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEEC1EPNS2_10LibContextE(IntrusivePtr* self, void* libContext);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorImEdeEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V118LeaderWithOnlineIdEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorImEneERKS4_();
+std::uint64_t APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEE4sizeEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V120PlayerSessionForReadEEEEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEEE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEE8pushBackERKS8_(IntrusivePtr* self, const void* element);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V161PostPlayerSessionsSessionIdJoinableSpecifiedUsersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5abortEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V149PostPlayerSessionsSessionIdInvitationsRequestBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V130RequestPlayerSessionInvitationEEEED1Ev(IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V120PlayerSessionForReadEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_14SessionManager2V152PostPlayerSessionsSessionIdMemberPlayersResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE5getIdEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V127ResponsePlayerSessionPlayerEEEE8copyFromERKS9_();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V150PostPlayerSessionsSessionIdInvitationsResponseBodyEED1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_14SessionManager2V113PlayerSessionEEEEEEC1Ev(IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku10labelIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku10priceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku8getPriceEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku15getDisplayPriceEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer7setsortENS5_4SortE();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku18originalPriceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getDescriptionEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getReleaseDateEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku23getDisplayOriginalPriceEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product14getDisplayNameEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku16getOriginalPriceEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku25displayOriginalPriceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku8getLabelEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer9setoffsetEi();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product16releaseDateIsSetEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer15setcontainerIdsEPKc();
+int APS5_VABI _ZN3sce2Np9CppWebApi13InGameCatalog2V512ContainerApi23ParameterToGetContainer8setlimitEi();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V53Sku17displayPriceIsSetEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi13InGameCatalog2V57Product5getIdEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEaSERKSE_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEppEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEE5emptyEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEneERKS9_();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE5beginEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEneERKS9_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEdeEv(const IntrusivePtr* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V53SkuEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE3endEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEEdeEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEdeEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1ERKSA_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS2_6VectorINS4_INS1_13InGameCatalog2V59ContainerEEEEEEENS4_INS2_18ResponseHeaderBaseEEEEC1ERKSE_(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE5beginEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEE3endEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEdeEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V53SkuEEEEppEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEEE5emptyEv(const IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEaSERKSA_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEppEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEC1Ev(IntrusivePtr* self);
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEED1Ev(IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_6StringEED2Ev(void* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8copyFromERKS5_();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEE3getEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEneERKS5_();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common11TransactionINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE11hasResponseEv();
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEptEv(const IntrusivePtr* self);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE3endEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringeqEPKc(const CommonString* self, const char* other);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5getIdEv();
+void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEaSERS6_(IntrusivePtr* self, const IntrusivePtr* source);
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_15DefaultResponseENS2_12IntrusivePtrINS2_18ResponseHeaderBaseEEEE5abortEv();
+int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE5beginEv();
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5emptyEv(const CommonString* self);
+void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEE3getEv(const IntrusivePtr* self);
+int APS5_VABI _ZNK3sce2Np9CppWebApi6Common8IteratorINS2_6StringEEdeEv();
+
+}
diff --git a/core/libs/prx/libSceNpCppWebApi/libSceNpCppWebApi.hpp b/core/libs/prx/libSceNpCppWebApi/libSceNpCppWebApi.hpp
new file mode 100644
index 0000000000..450f928feb
--- /dev/null
+++ b/core/libs/prx/libSceNpCppWebApi/libSceNpCppWebApi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpEntitlementAccess/Export.cpp b/core/libs/prx/libSceNpEntitlementAccess/Export.cpp
index 717d50a1ed..e0593d4afb 100644
--- a/core/libs/prx/libSceNpEntitlementAccess/Export.cpp
+++ b/core/libs/prx/libSceNpEntitlementAccess/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -23,8 +24,14 @@ static constexpr uint32_t SKU_FLAG_FULL = 3;
 
 namespace {
 
+#ifdef _WIN32
+const wchar_t* ConfiguredEntitlements() { return _wgetenv(L"ANYPS5_ENTITLEMENTS"); }
+#else
+const char* ConfiguredEntitlements() { return std::getenv("ANYPS5_ENTITLEMENTS"); }
+#endif
+
 std::filesystem::path EntitlementsPath() {
-    if (const char* configured = std::getenv("ANYPS5_ENTITLEMENTS"); configured != nullptr && configured[0] != '\0') return configured;
+    if (const auto* configured = ConfiguredEntitlements(); configured != nullptr && configured[0] != 0) return configured;
 #ifdef _WIN32
     wchar_t module[MAX_PATH];
     const auto length = GetModuleFileNameW(nullptr, module, MAX_PATH);
@@ -50,7 +57,7 @@ const std::vector<NpEntitlementAccessAddcontEntitlementInfo>& OwnedAddons() {
         const auto path = EntitlementsPath();
         std::ifstream file(path);
         if (!file) {
-            if (std::getenv("ANYPS5_ENTITLEMENTS") != nullptr || std::filesystem::exists(path)) throw std::runtime_error("NpEntitlementAccess: cannot read " + path.string());
+            if (ConfiguredEntitlements() != nullptr || std::filesystem::exists(path)) throw std::runtime_error("NpEntitlementAccess: cannot read " + path.string());
             return addons;
         }
         std::string line;
@@ -139,12 +146,10 @@ int APS5_VABI sceNpEntitlementAccessRequestConsumeUnifiedEntitlement(std::int32_
  return SCE_NP_ERROR_SIGNED_OUT;
 }
 
-
 int APS5_VABI sceNpEntitlementAccessRequestConsumeServiceEntitlement(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, const NpEntitlementAccessTransactionId* transactionId, std::int32_t count, std::int64_t* requestId) {
  return SCE_NP_ERROR_SIGNED_OUT;
 }
 
-
 int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* info) {
     return SCE_NP_ERROR_SIGNED_OUT;
 }
diff --git a/core/libs/prx/libSceNpEntitlementAccess/include/Api.hpp b/core/libs/prx/libSceNpEntitlementAccess/include/Api.hpp
new file mode 100644
index 0000000000..d68d483b87
--- /dev/null
+++ b/core/libs/prx/libSceNpEntitlementAccess/include/Api.hpp
@@ -0,0 +1,33 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfo(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, NpEntitlementAccessAddcontEntitlementInfo* info);
+int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfoList(uint32_t serviceLabel, NpEntitlementAccessAddcontEntitlementInfo* list, uint32_t listNum, uint32_t* hitNum);
+int APS5_VABI sceNpEntitlementAccessGetSkuFlag(uint32_t* skuFlag);
+int APS5_VABI sceNpEntitlementAccessGetEntitlementKey( uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, NpEntitlementAccessEntitlementKey* key);
+int APS5_VABI sceNpEntitlementAccessInitialize(const NpEntitlementAccessInitParam* initParam, NpEntitlementAccessBootParam* bootParam);
+int APS5_VABI sceNpEntitlementAccessAbortRequest(std::int64_t requestId);
+int APS5_VABI sceNpEntitlementAccessDeleteRequest(std::int64_t requestId);
+int APS5_VABI sceNpEntitlementAccessGenerateTransactionId(NpEntitlementAccessTransactionId* transactionId);
+int APS5_VABI sceNpEntitlementAccessPollConsumeEntitlement(std::int64_t requestId, std::int32_t* result, std::int32_t* countResult);
+int APS5_VABI sceNpEntitlementAccessRequestConsumeUnifiedEntitlement(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, const NpEntitlementAccessTransactionId* transactionId, std::int32_t count, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessRequestConsumeServiceEntitlement(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, const NpEntitlementAccessTransactionId* transactionId, std::int32_t count, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* info);
+int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* info);
+int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessGetPftFlag(uint32_t* flag);
+int APS5_VABI sceNpEntitlementAccessGetGameTrialsFlag(uint32_t* flag);
+int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
+int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
+int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
+int APS5_VABI sceNpEntitlementAccessGetAddcontEntitlementInfoIndividual();
+int APS5_VABI sceNpEntitlementAccessPollConsumableEntitlementInfo();
+int APS5_VABI sceNpEntitlementAccessRequestConsumableEntitlementInfo();
+int APS5_VABI sceNpEntitlementAccessRequestConsumeEntitlement();
+
+}
diff --git a/core/libs/prx/libSceNpEntitlementAccess/libSceNpEntitlementAccess.hpp b/core/libs/prx/libSceNpEntitlementAccess/libSceNpEntitlementAccess.hpp
new file mode 100644
index 0000000000..e8590281af
--- /dev/null
+++ b/core/libs/prx/libSceNpEntitlementAccess/libSceNpEntitlementAccess.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpEulaDialog/Export.cpp b/core/libs/prx/libSceNpEulaDialog/Export.cpp
index 1b666cc199..99b4499d54 100644
--- a/core/libs/prx/libSceNpEulaDialog/Export.cpp
+++ b/core/libs/prx/libSceNpEulaDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpEulaDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpEulaDialog/include/Api.hpp b/core/libs/prx/libSceNpEulaDialog/include/Api.hpp
new file mode 100644
index 0000000000..fc29d6fa96
--- /dev/null
+++ b/core/libs/prx/libSceNpEulaDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpEulaDialogCheckVersion();
+int APS5_VABI sceNpEulaDialogCheckVersionAbort();
+int APS5_VABI sceNpEulaDialogClose();
+int APS5_VABI sceNpEulaDialogGetResult();
+int APS5_VABI sceNpEulaDialogGetStatus();
+int APS5_VABI sceNpEulaDialogInitialize();
+int APS5_VABI sceNpEulaDialogOpen();
+int APS5_VABI sceNpEulaDialogTerminate();
+int APS5_VABI sceNpEulaDialogUpdateStatus();
+
+}
diff --git a/core/libs/prx/libSceNpEulaDialog/libSceNpEulaDialog.hpp b/core/libs/prx/libSceNpEulaDialog/libSceNpEulaDialog.hpp
new file mode 100644
index 0000000000..6f2a34108c
--- /dev/null
+++ b/core/libs/prx/libSceNpEulaDialog/libSceNpEulaDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpEulaDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpFriendListDialog/CMakeLists.txt b/core/libs/prx/libSceNpFriendListDialog/CMakeLists.txt
new file mode 100644
index 0000000000..219499b30b
--- /dev/null
+++ b/core/libs/prx/libSceNpFriendListDialog/CMakeLists.txt
@@ -0,0 +1,14 @@
+add_library(libSceNpFriendListDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpFriendListDialog PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpFriendListDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_friend_list_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpFriendListDialog.cpp)
+    target_include_directories(guest_np_friend_list_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_friend_list_dialog_tests PRIVATE libSceNpFriendListDialog)
+    add_test(NAME guest_np_friend_list_dialog COMMAND guest_np_friend_list_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_friend_list_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpFriendListDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpFriendListDialog/Export.cpp b/core/libs/prx/libSceNpFriendListDialog/Export.cpp
index e744f30761..aee6fb1edf 100644
--- a/core/libs/prx/libSceNpFriendListDialog/Export.cpp
+++ b/core/libs/prx/libSceNpFriendListDialog/Export.cpp
@@ -1,12 +1,71 @@
+#include "prx/libSceNpFriendListDialog/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+std::atomic<int> g_status{COMMON_DIALOG_STATUS_NONE};
+
+}
+
 extern "C" {
 
-int APS5_VABI sceNpFriendListDialogClose() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpFriendListDialogInitialize(void) {
+    int expected = COMMON_DIALOG_STATUS_NONE;
+    if (!g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_INITIALIZED)) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
+    return 0;
+}
+
+int APS5_VABI sceNpFriendListDialogOpenA(const void* param) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
+    return 0;
+}
+
+int APS5_VABI sceNpFriendListDialogUpdateStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceNpFriendListDialogGetStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceNpFriendListDialogGetResultA(void* result) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (status != COMMON_DIALOG_STATUS_FINISHED) return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    const std::int32_t canceled = COMMON_DIALOG_RESULT_USER_CANCELED;
+    std::memcpy(result, &canceled, sizeof(canceled));
+    return 0;
+}
+
+int APS5_VABI sceNpFriendListDialogClose(void) {
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
+    return 0;
+}
+
+int APS5_VABI sceNpFriendListDialogTerminate(void) {
+    if (g_status.exchange(COMMON_DIALOG_STATUS_NONE) == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
@@ -15,39 +74,9 @@ int APS5_VABI sceNpFriendListDialogGetResult() {
     return 0;
 }
 
-int APS5_VABI sceNpFriendListDialogGetResultA() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpFriendListDialogGetStatus() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpFriendListDialogInitialize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpFriendListDialogOpen() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceNpFriendListDialogOpenA() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpFriendListDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpFriendListDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libSceNpFriendListDialog/include/Api.hpp b/core/libs/prx/libSceNpFriendListDialog/include/Api.hpp
new file mode 100644
index 0000000000..2bdd0742ab
--- /dev/null
+++ b/core/libs/prx/libSceNpFriendListDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpFriendListDialogInitialize(void);
+int APS5_VABI sceNpFriendListDialogOpenA(const void* param);
+int APS5_VABI sceNpFriendListDialogUpdateStatus(void);
+int APS5_VABI sceNpFriendListDialogGetStatus(void);
+int APS5_VABI sceNpFriendListDialogGetResultA(void* result);
+int APS5_VABI sceNpFriendListDialogClose(void);
+int APS5_VABI sceNpFriendListDialogTerminate(void);
+int APS5_VABI sceNpFriendListDialogGetResult();
+int APS5_VABI sceNpFriendListDialogOpen();
+
+}
diff --git a/core/libs/prx/libSceNpFriendListDialog/libSceNpFriendListDialog.hpp b/core/libs/prx/libSceNpFriendListDialog/libSceNpFriendListDialog.hpp
new file mode 100644
index 0000000000..d1b45137ee
--- /dev/null
+++ b/core/libs/prx/libSceNpFriendListDialog/libSceNpFriendListDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpFriendListDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpGameIntent/Export.cpp b/core/libs/prx/libSceNpGameIntent/Export.cpp
index c8be4b9f09..751b4b1c5b 100644
--- a/core/libs/prx/libSceNpGameIntent/Export.cpp
+++ b/core/libs/prx/libSceNpGameIntent/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpGameIntent/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -12,7 +13,6 @@ constexpr int NpGameIntentErrorIntentNotFound = -2141898746;
 constexpr int NpGameIntentErrorValueNotFound = -2141898745;
 constexpr int NpGameIntentUserIdInvalid = -1;
 
-
 }
 
 extern "C" {
diff --git a/core/libs/prx/libSceNpGameIntent/include/Api.hpp b/core/libs/prx/libSceNpGameIntent/include/Api.hpp
new file mode 100644
index 0000000000..abd369f817
--- /dev/null
+++ b/core/libs/prx/libSceNpGameIntent/include/Api.hpp
@@ -0,0 +1,26 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize);
+int APS5_VABI sceNpGameIntentInitialize(const void* initParam);
+int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo);
+int APS5_VABI sceNpGameIntentTerminate(void);
+int APS5_VABI sceNpGameIntentInitParamInit(NpGameIntentInitParam* param);
+int APS5_VABI sceNpGameIntentInfoInit(NpGameIntentInfo* info);
+int APS5_VABI sceNpGameIntentVshInitialize(void);
+int APS5_VABI sceNpGameIntentVshTerminate(void);
+int APS5_VABI sceNpAppLauncherInitialize(const void* initParam);
+int APS5_VABI sceNpAppLauncherLaunchApp();
+int APS5_VABI sceNpAppLauncherTerminate();
+int APS5_VABI sceNpGameIntentGetUdsNpComId();
+int APS5_VABI sceNpGameIntentLaunchApp();
+int APS5_VABI sceNpGameIntentLaunchApp2();
+int APS5_VABI sceNpGameIntentNotifyAppLaunched();
+int APS5_VABI sceNpSessionServiceGetJoinedPartySession();
+int APS5_VABI sceNpSessionServiceGetRunningGamePlayerSession();
+int APS5_VABI sceNpSessionServiceSendPlayerSessionInvitations();
+
+}
diff --git a/core/libs/prx/libSceNpGameIntent/libSceNpGameIntent.hpp b/core/libs/prx/libSceNpGameIntent/libSceNpGameIntent.hpp
new file mode 100644
index 0000000000..7c0f3b8b2e
--- /dev/null
+++ b/core/libs/prx/libSceNpGameIntent/libSceNpGameIntent.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpGameIntent/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpManager/Export.cpp b/core/libs/prx/libSceNpManager/Export.cpp
index 93a1095e2e..55f1c4c5c8 100644
--- a/core/libs/prx/libSceNpManager/Export.cpp
+++ b/core/libs/prx/libSceNpManager/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpManager/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -20,6 +21,7 @@ static constexpr int SCE_NP_ERROR_CALLBACK_MAX = static_cast<int>(0x8055001D);
 static constexpr uint32_t NP_STATE_SIGNED_OUT = 1;
 static constexpr int NP_POLL_ASYNC_FINISHED = 0;
 static constexpr uint32_t NP_REACHABILITY_STATE_UNAVAILABLE = 0;
+static constexpr uint32_t NP_GAME_PRESENCE_STATUS_OFFLINE = 0;
 
 static std::atomic<int> g_nextRequest{1};
 
@@ -37,8 +39,11 @@ int AddRequest() {
     return reqId;
 }
 
-using NpStateCallbackA = void (APS5_VABI *)(int userId, uint32_t state, void* userdata);
-using NpStateCallback = void (APS5_VABI *)(int userId, uint32_t state, NpId* npId, void* userdata);
+int SignedOutRequest(int reqId) {
+    if (reqId == 0) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(requestMutex);
+    return liveRequests.count(reqId) ? SCE_NP_ERROR_SIGNED_OUT : SCE_NP_ERROR_REQUEST_NOT_FOUND;
+}
 
 constexpr int NP_STATE_CALLBACK_MAX = 8;
 
@@ -253,29 +258,31 @@ int APS5_VABI sceNpAsmTerminate(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceNpCheckNpAvailabilityA(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpCheckNpAvailabilityA(int reqId, int userId) {
+    if (userId == USER_SERVICE_USER_ID_INVALID) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    return SignedOutRequest(reqId);
+}
+int APS5_VABI sceNpGetAccountDateOfBirthA(int userId, void* dateOfBirth) {
+    if (!dateOfBirth || userId == USER_SERVICE_USER_ID_INVALID) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    return SCE_NP_ERROR_SIGNED_OUT;
+}
+int APS5_VABI sceNpGetAccountLanguageA(int reqId, int userId, void* language) {
+    if (!language || userId == USER_SERVICE_USER_ID_INVALID) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    return SignedOutRequest(reqId);
+}
+int APS5_VABI sceNpGetGamePresenceStatus(const NpOnlineId* onlineId, uint32_t* status) {
+    if (!onlineId || !status) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    *status = NP_GAME_PRESENCE_STATUS_OFFLINE;
     return 0;
 }
-int APS5_VABI sceNpGetAccountDateOfBirthA(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpGetGamePresenceStatusA(int userId, uint32_t* status) {
+    if (!status || userId == USER_SERVICE_USER_ID_INVALID) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    *status = NP_GAME_PRESENCE_STATUS_OFFLINE;
     return 0;
 }
-int APS5_VABI sceNpGetAccountLanguageA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpGetGamePresenceStatus(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpGetGamePresenceStatusA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpGetParentalControlInfoA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpGetParentalControlInfoA(int reqId, int userId, int8_t* age, void* info) {
+    if (!age || !info || userId == USER_SERVICE_USER_ID_INVALID) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    return SignedOutRequest(reqId);
 }
 int APS5_VABI sceNpIdMapperAbortRequest(void) {
     NotImplemented_nid_no_patch(__func__);
@@ -664,8 +671,8 @@ int APS5_VABI sceNpManagerIntLoginGetAccessToken(void) {
 }
 
 int APS5_VABI sceNpAbortRequest(int req_id) {
-    (void)req_id;
-    return 0;
+    std::lock_guard lock(requestMutex);
+    return liveRequests.count(req_id) ? 0 : SCE_NP_ERROR_REQUEST_NOT_FOUND;
 }
 
 int APS5_VABI sceNpCheckCallback(void) {
@@ -715,6 +722,7 @@ int APS5_VABI sceNpCreateRequest(void) {
 
 int APS5_VABI sceNpDeleteRequest(int req_id) {
     std::lock_guard lock(requestMutex);
+    if (!liveRequests.count(req_id)) return SCE_NP_ERROR_REQUEST_NOT_FOUND;
     liveRequests.erase(req_id);
     return 0;
 }
@@ -825,8 +833,10 @@ int APS5_VABI sceNpHasSignedUp(int user_id, bool* has_signed_up) {
 }
 
 int APS5_VABI sceNpPollAsync(int req_id, int* result) {
-    (void)req_id;
-    if (result) *result = SCE_NP_ERROR_SIGNED_OUT;
+    if (!result) return SCE_NP_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(requestMutex);
+    if (!liveRequests.count(req_id)) return SCE_NP_ERROR_REQUEST_NOT_FOUND;
+    *result = SCE_NP_ERROR_SIGNED_OUT;
     return NP_POLL_ASYNC_FINISHED;
 }
 
@@ -986,7 +996,6 @@ int APS5_VABI sceNpUnknown_WxLcN76q19o(void) {
     return 0;
 }
 
-
 int APS5_VABI sceNpCheckCallbackForLib() {
     return sceNpCheckCallback();
 }
diff --git a/core/libs/prx/libSceNpManager/include/Api.hpp b/core/libs/prx/libSceNpManager/include/Api.hpp
new file mode 100644
index 0000000000..11a6828eb8
--- /dev/null
+++ b/core/libs/prx/libSceNpManager/include/Api.hpp
@@ -0,0 +1,218 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using NpStateCallback = void (APS5_VABI *)(int userId, uint32_t state, NpId* npId, void* userdata);
+
+using NpStateCallbackA = void (APS5_VABI *)(int userId, uint32_t state, void* userdata);
+
+extern "C" {
+
+int APS5_VABI sceNpAsmAbort(void);
+int APS5_VABI sceNpAsmClientAbortRequest(void);
+int APS5_VABI sceNpAsmClientClearNpTitleToken(void);
+int APS5_VABI sceNpAsmClientClearNpTitleTokenA(void);
+int APS5_VABI sceNpAsmClientCreateRequest2(void);
+int APS5_VABI sceNpAsmClientCreateResourceContext(void);
+int APS5_VABI sceNpAsmClientCreateResourceContext2(void);
+int APS5_VABI sceNpAsmClientDeleteRequest(void);
+int APS5_VABI sceNpAsmClientDeleteResourceContext(void);
+int APS5_VABI sceNpAsmClientDeleteResourceContext2(void);
+int APS5_VABI sceNpAsmClientGetAppId(void);
+int APS5_VABI sceNpAsmClientGetCacheControlMaxAge(void);
+int APS5_VABI sceNpAsmClientGetGameNpTitleInfo(void);
+int APS5_VABI sceNpAsmClientGetGameNpTitleToken(void);
+int APS5_VABI sceNpAsmClientGetGameTitleBanInfo(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo2(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo2A(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo3(void);
+int APS5_VABI sceNpAsmClientGetNpComInfo4(void);
+int APS5_VABI sceNpAsmClientGetNpTitleId(void);
+int APS5_VABI sceNpAsmClientGetNpTitleToken(void);
+int APS5_VABI sceNpAsmClientGetNpTitleToken2(void);
+int APS5_VABI sceNpAsmClientGetNpTitleTokenA(void);
+int APS5_VABI sceNpAsmClientGetRelatedGameNpTitleIds(void);
+int APS5_VABI sceNpAsmClientGetRelatedGameNpTitleIdsA(void);
+int APS5_VABI sceNpAsmClientGetRelatedGameNpTitleIdsResult(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrl(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrlA(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrlWithNpTitleId(void);
+int APS5_VABI sceNpAsmClientGetServiceBaseUrlWithNpTitleIdA(void);
+int APS5_VABI sceNpAsmClientGetServiceIdInfo(void);
+int APS5_VABI sceNpAsmClientGetServiceIdInfoA(void);
+int APS5_VABI sceNpAsmClientInitialize(void);
+int APS5_VABI sceNpAsmClientSetNpTitleId(void);
+int APS5_VABI sceNpAsmClientTerminate(void);
+int APS5_VABI sceNpAsmCreateConnection(void);
+int APS5_VABI sceNpAsmCreateRequest(void);
+int APS5_VABI sceNpAsmDeleteConnection(void);
+int APS5_VABI sceNpAsmDeleteRequest(void);
+int APS5_VABI sceNpAsmGenerateNpTitleToken(void);
+int APS5_VABI sceNpAsmGenerateNpTitleToken2(void);
+int APS5_VABI sceNpAsmGetNpCommInfo(void);
+int APS5_VABI sceNpAsmGetNpCommInfo2(void);
+int APS5_VABI sceNpAsmGetRelatedGameNpTitleIds(void);
+int APS5_VABI sceNpAsmGetServiceBaseUrl(void);
+int APS5_VABI sceNpAsmGetServiceIdInfo(void);
+int APS5_VABI sceNpAsmInitialize(void);
+int APS5_VABI sceNpAsmTerminate(void);
+int APS5_VABI sceNpCheckNpAvailabilityA(int reqId, int userId);
+int APS5_VABI sceNpGetAccountDateOfBirthA(int userId, void* dateOfBirth);
+int APS5_VABI sceNpGetAccountLanguageA(int reqId, int userId, void* language);
+int APS5_VABI sceNpGetGamePresenceStatus(const NpOnlineId* onlineId, uint32_t* status);
+int APS5_VABI sceNpGetGamePresenceStatusA(int userId, uint32_t* status);
+int APS5_VABI sceNpGetParentalControlInfoA(int reqId, int userId, int8_t* age, void* info);
+int APS5_VABI sceNpIdMapperAbortRequest(void);
+int APS5_VABI sceNpIdMapperAccountIdToNpId(void);
+int APS5_VABI sceNpIdMapperAccountIdToOnlineId(void);
+int APS5_VABI sceNpIdMapperCreateRequest(void);
+int APS5_VABI sceNpIdMapperDeleteRequest(void);
+int APS5_VABI sceNpIdMapperNpIdToAccountId(void);
+int APS5_VABI sceNpIdMapperOnlineIdToAccountId(void);
+int APS5_VABI sceNpInGameMessageAbortHandle(void);
+int APS5_VABI sceNpInGameMessageCheckCallback(void);
+int APS5_VABI sceNpInGameMessageGetMemoryPoolStatistics(void);
+int APS5_VABI sceNpInGameMessagePrepareA(void);
+int APS5_VABI sceNpInGameMessageSendDataA(void);
+int APS5_VABI sceNpIntGetAppType(void);
+int APS5_VABI sceNpIntGetGamePresenceStatus(void);
+int APS5_VABI sceNpIntGetNpTitleId(void);
+int APS5_VABI sceNpIntGetNpTitleIdSecret(void);
+int APS5_VABI sceNpIntRegisterCheckCallback(void);
+int APS5_VABI sceNpIntRegisterGamePresenceCallback(void);
+int APS5_VABI sceNpIsPlusMember(int, bool* isMember);
+int APS5_VABI sceNpManagerIntAbortRequest(void);
+int APS5_VABI sceNpManagerIntAddActiveSigninStateCallback(void);
+int APS5_VABI sceNpManagerIntAddOnlineIdChangeCallback(void);
+int APS5_VABI sceNpManagerIntAddPlusMemberTypeCallback(void);
+int APS5_VABI sceNpManagerIntAddSigninStateCallback(void);
+int APS5_VABI sceNpManagerIntAuthGetAuthorizationCode(void);
+int APS5_VABI sceNpManagerIntAuthGetIdToken(void);
+int APS5_VABI sceNpManagerIntCheckNpAvailability(void);
+int APS5_VABI sceNpManagerIntCheckNpAvailabilityByPid(void);
+int APS5_VABI sceNpManagerIntCheckNpState(void);
+int APS5_VABI sceNpManagerIntCheckNpStateA(void);
+int APS5_VABI sceNpManagerIntClearGameAccessToken(void);
+int APS5_VABI sceNpManagerIntClearOnlineIdChangeFlag(void);
+int APS5_VABI sceNpManagerIntClearTicket(void);
+int APS5_VABI sceNpManagerIntClearUsedFlag(void);
+int APS5_VABI sceNpManagerIntClearVshAccessToken(void);
+int APS5_VABI sceNpManagerIntCreateAuthenticationTicket(void);
+int APS5_VABI sceNpManagerIntCreateLoginContext(void);
+int APS5_VABI sceNpManagerIntCreateLoginRequest(void);
+int APS5_VABI sceNpManagerIntCreateRequest(void);
+int APS5_VABI sceNpManagerIntDeleteLoginContext(void);
+int APS5_VABI sceNpManagerIntDeleteRequest(void);
+int APS5_VABI sceNpManagerIntGetAccessTokenViaImplicitFlow(void);
+int APS5_VABI sceNpManagerIntGetAccountAge(void);
+int APS5_VABI sceNpManagerIntGetAccountCountry(void);
+int APS5_VABI sceNpManagerIntGetAccountCountryA(void);
+int APS5_VABI sceNpManagerIntGetAccountCountrySdk(void);
+int APS5_VABI sceNpManagerIntGetAccountDateOfBirthSdk(void);
+int APS5_VABI sceNpManagerIntGetAccountId(void);
+int APS5_VABI sceNpManagerIntGetAccountIdSdk(void);
+int APS5_VABI sceNpManagerIntGetAccountLanguage(void);
+int APS5_VABI sceNpManagerIntGetAccountLanguageA(void);
+int APS5_VABI sceNpManagerIntGetAccountNpEnv(void);
+int APS5_VABI sceNpManagerIntGetAccountType(void);
+int APS5_VABI sceNpManagerIntGetActiveSigninState(void);
+int APS5_VABI sceNpManagerIntGetAuthServerErrorFlag(void);
+int APS5_VABI sceNpManagerIntGetAuthorizationCode(void);
+int APS5_VABI sceNpManagerIntGetAuthorizationCodeWithPsnoUri(void);
+int APS5_VABI sceNpManagerIntGetClientCredentialAccessToken(void);
+int APS5_VABI sceNpManagerIntGetCommunicationRestrictionStatus(void);
+int APS5_VABI sceNpManagerIntGetGameAccessToken(void);
+int APS5_VABI sceNpManagerIntGetIssuerId(void);
+int APS5_VABI sceNpManagerIntGetNpEnv(void);
+int APS5_VABI sceNpManagerIntGetNpId(void);
+int APS5_VABI sceNpManagerIntGetNpIdByOnlineId(void);
+int APS5_VABI sceNpManagerIntGetNpIdSdk(void);
+int APS5_VABI sceNpManagerIntGetOfflineAccountId(void);
+int APS5_VABI sceNpManagerIntGetOnlineId(void);
+int APS5_VABI sceNpManagerIntGetOnlineIdChangeFlag(void);
+int APS5_VABI sceNpManagerIntGetOnlineIdSdk(void);
+int APS5_VABI sceNpManagerIntGetParentalControlFlag(void);
+int APS5_VABI sceNpManagerIntGetParentalControlInfo(void);
+int APS5_VABI sceNpManagerIntGetPlusMemberType(void);
+int APS5_VABI sceNpManagerIntGetPlusMemberTypeNB(void);
+int APS5_VABI sceNpManagerIntGetServerError(void);
+int APS5_VABI sceNpManagerIntGetSigninState(void);
+int APS5_VABI sceNpManagerIntGetSigninTelemetryInfo(void);
+int APS5_VABI sceNpManagerIntGetTicket(void);
+int APS5_VABI sceNpManagerIntGetTicketA(void);
+int APS5_VABI sceNpManagerIntGetTitleToken(void);
+int APS5_VABI sceNpManagerIntGetTitleTokenWithCheck(void);
+int APS5_VABI sceNpManagerIntGetUserIdByAccountId(void);
+int APS5_VABI sceNpManagerIntGetUserIdByNpId(void);
+int APS5_VABI sceNpManagerIntGetUserIdByOnlineId(void);
+int APS5_VABI sceNpManagerIntGetUserIdByOnlineIdSdk(void);
+int APS5_VABI sceNpManagerIntGetUserList(void);
+int APS5_VABI sceNpManagerIntGetUserNum(void);
+int APS5_VABI sceNpManagerIntGetVshAccessToken(void);
+int APS5_VABI sceNpManagerIntGetVshAccessTokenWithCheck(void);
+int APS5_VABI sceNpManagerIntGetVshClientId(void);
+int APS5_VABI sceNpManagerIntIsSubAccount(void);
+int APS5_VABI sceNpManagerIntIsTemporarySignout(void);
+int APS5_VABI sceNpManagerIntIsUnregisteredClientError(void);
+int APS5_VABI sceNpManagerIntLoginAuthenticate(void);
+int APS5_VABI sceNpManagerIntLoginBind(void);
+int APS5_VABI sceNpManagerIntLoginCreateAuthenticationTicket(void);
+int APS5_VABI sceNpManagerIntLoginGetAccessToken(void);
+int APS5_VABI sceNpAbortRequest(int reqId);
+int APS5_VABI sceNpCheckCallback(void);
+int APS5_VABI sceNpCheckNpAvailability(std::int32_t requestId, const NpOnlineId* onlineId, std::uint8_t* available);
+int APS5_VABI sceNpCheckNpReachability(int reqId, int userId);
+int APS5_VABI sceNpCheckPremium(int reqId, const NpCheckPremiumParameter* param, NpCheckPremiumResult* result);
+int APS5_VABI sceNpCreateAsyncRequest(const NpCreateAsyncRequestParameter* param);
+int APS5_VABI sceNpCreateRequest(void);
+int APS5_VABI sceNpDeleteRequest(int reqId);
+int APS5_VABI sceNpGetAccountAge(int reqId, int userId, uint8_t* age);
+int APS5_VABI sceNpGetAccountCountry(const NpOnlineId* onlineId, void* countryCode);
+int APS5_VABI sceNpGetAccountDateOfBirth(const NpOnlineId* onlineId, void* dateOfBirth);
+int APS5_VABI sceNpGetAccountLanguage(int reqId, const NpOnlineId* onlineId, void* language);
+int APS5_VABI sceNpGetParentalControlInfo(int reqId, const NpOnlineId* onlineId, int8_t* age, void* info);
+int APS5_VABI sceNpGetUserIdByOnlineId(const NpOnlineId* onlineId, int* userId);
+int APS5_VABI sceNpCheckPlus(int reqId, const void* param, void* result);
+int APS5_VABI sceNpNotifyPlusFeature(const void* param);
+int APS5_VABI sceNpGetAccountId(const NpOnlineId* onlineId, uint64_t* accountId);
+int APS5_VABI sceNpSetGamePresenceOnline(int reqId, const NpOnlineId* onlineId, uint32_t presence);
+int APS5_VABI sceNpGetAccountCountryA(int userId, void* countryCode);
+int APS5_VABI sceNpGetAccountIdA(int userId, uint64_t* accountId);
+int APS5_VABI sceNpGetNpId(int userId, NpId* npId);
+int APS5_VABI sceNpGetNpReachabilityState(int userId, uint32_t* state);
+int APS5_VABI sceNpGetOnlineId(int userId, NpOnlineId* onlineId);
+int APS5_VABI sceNpGetState(int userId, uint32_t* state);
+int APS5_VABI sceNpHasSignedUp(int userId, bool* hasSignedUp);
+int APS5_VABI sceNpPollAsync(int reqId, int* result);
+void APS5_VABI sceNpRegisterGamePresenceCallback(void* callback, void* userdata);
+int APS5_VABI sceNpRegisterNpReachabilityStateCallback(void* callback, void* userdata);
+int APS5_VABI sceNpUnregisterNpReachabilityStateCallback(void);
+int APS5_VABI sceNpRegisterPlusEventCallback(void* callback, void* userdata);
+int APS5_VABI sceNpRegisterPremiumEventCallback(void* callback, void* userdata);
+int APS5_VABI sceNpRegisterStateCallback(NpStateCallback callback, void* userdata);
+int APS5_VABI sceNpSetContentRestriction(const NpContentRestriction* restriction);
+int APS5_VABI sceNpSetNpTitleId(const NpTitleId* titleId, const NpTitleSecret* titleSecret);
+int APS5_VABI sceNpSetTimeout(int reqId, int32_t resolveRetry, uint32_t resolveTimeout, uint32_t connTimeout, uint32_t sendTimeout, uint32_t recvTimeout);
+int APS5_VABI sceNpUnregisterStateCallback(void);
+int APS5_VABI sceNpGetAccountLanguage2(int reqId, int userId, void* language);
+int APS5_VABI sceNpNotifyPremiumFeature(const void* param);
+int APS5_VABI sceNpRegisterStateCallbackA(NpStateCallbackA callback, void* userdata);
+int APS5_VABI sceNpUnregisterStateCallbackA(int callbackId);
+int APS5_VABI sceNpUnregisterPremiumEventCallback(void);
+int APS5_VABI sceNpUnregisterPlusEventCallback(void);
+int APS5_VABI sceNpGetUserIdByAccountId(uint64_t accountId, int* userId);
+int APS5_VABI sceNpGetSandboxInfo(void* sandboxInfo);
+int APS5_VABI sceNpUnknown_8weiQyIdI3A(int userId, const NpOnlineId* buffer);
+int APS5_VABI sceNpUnknown_WxLcN76q19o(void);
+int APS5_VABI sceNpCheckCallbackForLib();
+int APS5_VABI sceNpInGameMessageCreateHandle();
+int APS5_VABI sceNpInGameMessageDeleteHandle();
+int APS5_VABI sceNpInGameMessageInitialize();
+int APS5_VABI sceNpInGameMessagePrepare();
+int APS5_VABI sceNpInGameMessageSendData();
+int APS5_VABI sceNpInGameMessageTerminate();
+int APS5_VABI sceNpSnsFacebookCreateRequest();
+int APS5_VABI sceNpSnsFacebookDeleteRequest();
+int APS5_VABI sceNpSnsFacebookGetAccessToken();
+
+}
diff --git a/core/libs/prx/libSceNpManager/libSceNpManager.hpp b/core/libs/prx/libSceNpManager/libSceNpManager.hpp
new file mode 100644
index 0000000000..5fa5fa4390
--- /dev/null
+++ b/core/libs/prx/libSceNpManager/libSceNpManager.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpManager/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpMatching2/CMakeLists.txt b/core/libs/prx/libSceNpMatching2/CMakeLists.txt
new file mode 100644
index 0000000000..06978af7ad
--- /dev/null
+++ b/core/libs/prx/libSceNpMatching2/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpMatching2 SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpMatching2 PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpMatching2)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_matching2_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpMatching2Offline.cpp)
+    target_include_directories(guest_np_matching2_offline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_matching2_offline_tests PRIVATE libSceNpMatching2)
+    configure_windows_unwind(guest_np_matching2_offline_tests)
+    add_test(NAME guest_np_matching2_offline COMMAND guest_np_matching2_offline_tests)
+    set_tests_properties(guest_np_matching2_offline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_matching2_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpMatching2>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpMatching2/Export.cpp b/core/libs/prx/libSceNpMatching2/Export.cpp
index 2746971c77..3797bf7136 100644
--- a/core/libs/prx/libSceNpMatching2/Export.cpp
+++ b/core/libs/prx/libSceNpMatching2/Export.cpp
@@ -1,21 +1,69 @@
+#include "prx/libSceNpMatching2/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <unordered_set>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+static constexpr int SCE_NP_MATCHING2_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80550C02);
+static constexpr int SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED = static_cast<int>(0x80550C03);
+static constexpr int SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550C0A);
+static constexpr int SCE_NP_MATCHING2_ERROR_CONTEXT_MAX = static_cast<int>(0x80550C04);
+static constexpr int SCE_NP_MATCHING2_ERROR_CONTEXT_NOT_STARTED = static_cast<int>(0x80550C08);
+static constexpr int SCE_NP_MATCHING2_ERROR_INVALID_CONTEXT_ID = static_cast<int>(0x80550C0B);
+static constexpr int SCE_NET_ERROR_RESOLVER_ETIMEDOUT = static_cast<int>(0x804101E2);
+static constexpr int MAX_CONTEXTS = 10;
+static constexpr std::uint64_t CREATE_CONTEXT_PARAMETER_SIZE = 0x28;
+
+namespace {
+
+static_assert(offsetof(NpMatching2InitializeParameter, size) == 0x20);
+static_assert(sizeof(NpMatching2InitializeParameter) == 0x30);
+
+static_assert(sizeof(NpMatching2CreateContextParameter) == CREATE_CONTEXT_PARAMETER_SIZE);
+
+std::mutex matching2Mutex;
+bool matching2Initialized = false;
+std::unordered_set<std::uint16_t> contexts;
+int nextContextId = 1;
+
+int CheckContext(std::uint16_t ctxId) {
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    return contexts.contains(ctxId) ? 0 : SCE_NP_MATCHING2_ERROR_INVALID_CONTEXT_ID;
+}
+
+}
+
 extern "C" {
 
-int APS5_VABI sceNpMatching2ContextStart() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2ContextStart(std::uint16_t ctxId, std::uint64_t timeout) {
+    (void)ctxId;
+    (void)timeout;
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    return SCE_NET_ERROR_RESOLVER_ETIMEDOUT;
 }
 
-int APS5_VABI sceNpMatching2ContextStop() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2ContextStop(std::uint16_t ctxId) {
+    std::lock_guard lock(matching2Mutex);
+    if (const int error = CheckContext(ctxId)) return error;
+    return SCE_NP_MATCHING2_ERROR_CONTEXT_NOT_STARTED;
 }
 
-int APS5_VABI sceNpMatching2CreateContext() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2CreateContext(const NpMatching2CreateContextParameter* param, std::uint16_t* ctxId) {
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    if (!param || param->size != CREATE_CONTEXT_PARAMETER_SIZE || !ctxId) return SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT;
+    for (int tried = 0; tried < MAX_CONTEXTS; ++tried) {
+        const auto candidate = static_cast<std::uint16_t>((nextContextId - 1 + tried) % MAX_CONTEXTS + 1);
+        if (contexts.contains(candidate)) continue;
+        contexts.insert(candidate);
+        nextContextId = candidate % MAX_CONTEXTS + 1;
+        *ctxId = candidate;
+        return 0;
+    }
+    return SCE_NP_MATCHING2_ERROR_CONTEXT_MAX;
 }
 
 int APS5_VABI sceNpMatching2CreateJoinRoom() {
@@ -23,8 +71,10 @@ int APS5_VABI sceNpMatching2CreateJoinRoom() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2DestroyContext() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpMatching2DestroyContext(std::uint16_t ctxId) {
+    std::lock_guard lock(matching2Mutex);
+    if (const int error = CheckContext(ctxId)) return error;
+    contexts.erase(ctxId);
     return 0;
 }
 
@@ -58,8 +108,11 @@ int APS5_VABI sceNpMatching2GetWorldInfoList() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2Initialize() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpMatching2Initialize(const NpMatching2InitializeParameter* param) {
+    std::lock_guard lock(matching2Mutex);
+    if (matching2Initialized) return SCE_NP_MATCHING2_ERROR_ALREADY_INITIALIZED;
+    if (!param || (param->size != offsetof(NpMatching2InitializeParameter, sslPoolSize) && param->size != sizeof(NpMatching2InitializeParameter))) return SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT;
+    matching2Initialized = true;
     return 0;
 }
 
@@ -78,24 +131,32 @@ int APS5_VABI sceNpMatching2LeaveRoom() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2RegisterContextCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterContextCallback(void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return matching2Initialized ? 0 : SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
 }
 
-int APS5_VABI sceNpMatching2RegisterRoomEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterRoomEventCallback(std::uint16_t ctxId, void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return CheckContext(ctxId);
 }
 
-int APS5_VABI sceNpMatching2RegisterRoomMessageCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterRoomMessageCallback(std::uint16_t ctxId, void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return CheckContext(ctxId);
 }
 
-int APS5_VABI sceNpMatching2RegisterSignalingCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2RegisterSignalingCallback(std::uint16_t ctxId, void* callback, void* userdata) {
+    (void)callback;
+    (void)userdata;
+    std::lock_guard lock(matching2Mutex);
+    return CheckContext(ctxId);
 }
 
 int APS5_VABI sceNpMatching2SearchRoom() {
@@ -113,9 +174,11 @@ int APS5_VABI sceNpMatching2SendRoomMessage() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2SetDefaultRequestOptParam() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpMatching2SetDefaultRequestOptParam(std::uint16_t ctxId, const void* requestOpt) {
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    if (!requestOpt) return SCE_NP_MATCHING2_ERROR_INVALID_ARGUMENT;
+    return CheckContext(ctxId);
 }
 
 int APS5_VABI sceNpMatching2SetRoomDataExternal() {
@@ -143,8 +206,12 @@ int APS5_VABI sceNpMatching2SignalingGetConnectionInfo() {
     return 0;
 }
 
-int APS5_VABI sceNpMatching2Terminate() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpMatching2Terminate(void) {
+    std::lock_guard lock(matching2Mutex);
+    if (!matching2Initialized) return SCE_NP_MATCHING2_ERROR_NOT_INITIALIZED;
+    matching2Initialized = false;
+    contexts.clear();
+    nextContextId = 1;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceNpMatching2/include/Api.hpp b/core/libs/prx/libSceNpMatching2/include/Api.hpp
new file mode 100644
index 0000000000..e7aca1bb5d
--- /dev/null
+++ b/core/libs/prx/libSceNpMatching2/include/Api.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpMatching2InitializeParameter {
+    std::uint64_t poolSize;
+    std::uint64_t cpuAffinityMask;
+    std::int32_t threadPriority;
+    std::uint8_t padding[4];
+    std::uint64_t threadStackSize;
+    std::uint64_t size;
+    std::uint64_t sslPoolSize;
+};
+
+struct NpMatching2CreateContextParameter {
+    const void* npId;
+    const void* npCommunicationId;
+    const void* npPassphrase;
+    std::uint32_t serviceLabel;
+    std::uint64_t size;
+};
+
+extern "C" {
+
+int APS5_VABI sceNpMatching2ContextStart(std::uint16_t ctxId, std::uint64_t timeout);
+int APS5_VABI sceNpMatching2ContextStop(std::uint16_t ctxId);
+int APS5_VABI sceNpMatching2CreateContext(const NpMatching2CreateContextParameter* param, std::uint16_t* ctxId);
+int APS5_VABI sceNpMatching2CreateJoinRoom();
+int APS5_VABI sceNpMatching2DestroyContext(std::uint16_t ctxId);
+int APS5_VABI sceNpMatching2GetRoomDataExternalList();
+int APS5_VABI sceNpMatching2GetRoomDataInternal();
+int APS5_VABI sceNpMatching2GetRoomMemberDataInternal();
+int APS5_VABI sceNpMatching2GetServerId();
+int APS5_VABI sceNpMatching2GetUserInfoList();
+int APS5_VABI sceNpMatching2GetWorldInfoList();
+int APS5_VABI sceNpMatching2Initialize(const NpMatching2InitializeParameter* param);
+int APS5_VABI sceNpMatching2JoinRoom();
+int APS5_VABI sceNpMatching2KickoutRoomMember();
+int APS5_VABI sceNpMatching2LeaveRoom();
+int APS5_VABI sceNpMatching2RegisterContextCallback(void* callback, void* userdata);
+int APS5_VABI sceNpMatching2RegisterRoomEventCallback(std::uint16_t ctxId, void* callback, void* userdata);
+int APS5_VABI sceNpMatching2RegisterRoomMessageCallback(std::uint16_t ctxId, void* callback, void* userdata);
+int APS5_VABI sceNpMatching2RegisterSignalingCallback(std::uint16_t ctxId, void* callback, void* userdata);
+int APS5_VABI sceNpMatching2SearchRoom();
+int APS5_VABI sceNpMatching2SendRoomChatMessage();
+int APS5_VABI sceNpMatching2SendRoomMessage();
+int APS5_VABI sceNpMatching2SetDefaultRequestOptParam(std::uint16_t ctxId, const void* requestOpt);
+int APS5_VABI sceNpMatching2SetRoomDataExternal();
+int APS5_VABI sceNpMatching2SetRoomDataInternal();
+int APS5_VABI sceNpMatching2SetRoomMemberDataInternal();
+int APS5_VABI sceNpMatching2SetUserInfo();
+int APS5_VABI sceNpMatching2SignalingGetConnectionInfo();
+int APS5_VABI sceNpMatching2Terminate(void);
+
+}
diff --git a/core/libs/prx/libSceNpMatching2/libSceNpMatching2.hpp b/core/libs/prx/libSceNpMatching2/libSceNpMatching2.hpp
new file mode 100644
index 0000000000..9819896e2b
--- /dev/null
+++ b/core/libs/prx/libSceNpMatching2/libSceNpMatching2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpMatching2/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpPartner001/Export.cpp b/core/libs/prx/libSceNpPartner001/Export.cpp
index d4dbeeefd9..2a4635c7c8 100644
--- a/core/libs/prx/libSceNpPartner001/Export.cpp
+++ b/core/libs/prx/libSceNpPartner001/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpPartner001/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <atomic>
 #include <stdexcept>
diff --git a/core/libs/prx/libSceNpPartner001/include/Api.hpp b/core/libs/prx/libSceNpPartner001/include/Api.hpp
new file mode 100644
index 0000000000..7254f21010
--- /dev/null
+++ b/core/libs/prx/libSceNpPartner001/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpEAAccessInitialize(void);
+int APS5_VABI sceNpEAAccessTerminate(void);
+int APS5_VABI sceNpHasEAAccessSubscription(int userId, bool* result);
+
+}
diff --git a/core/libs/prx/libSceNpPartner001/libSceNpPartner001.hpp b/core/libs/prx/libSceNpPartner001/libSceNpPartner001.hpp
new file mode 100644
index 0000000000..83c567edd0
--- /dev/null
+++ b/core/libs/prx/libSceNpPartner001/libSceNpPartner001.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpPartner001/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpParty/Export.cpp b/core/libs/prx/libSceNpParty/Export.cpp
index 67fdadc679..4f00ce3699 100644
--- a/core/libs/prx/libSceNpParty/Export.cpp
+++ b/core/libs/prx/libSceNpParty/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpParty/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,9 +7,19 @@
 
 namespace {
 
+constexpr int NP_PARTY_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80552502u);
+constexpr int NP_PARTY_ERROR_NOT_INITIALIZED = static_cast<int>(0x80552503u);
 constexpr int NP_PARTY_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80552504u);
+constexpr int NP_PARTY_ERROR_NOT_IN_PARTY = static_cast<int>(0x80552506u);
 constexpr std::uint16_t NP_PARTY_STATE_NOT_IN_PARTY = 2;
 
+std::atomic<bool> g_initialized{false};
+
+int notInParty(const void* out) {
+    if (!out) return NP_PARTY_ERROR_INVALID_ARGUMENT;
+    return NP_PARTY_ERROR_NOT_IN_PARTY;
+}
+
 }
 
 extern "C" {
@@ -17,8 +29,9 @@ int APS5_VABI sceNpPartyGetState(std::uint16_t* state) {
     *state = NP_PARTY_STATE_NOT_IN_PARTY;
     return 0;
 }
+
 int APS5_VABI sceNpPartyCheckCallback(void) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!g_initialized) return NP_PARTY_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
@@ -32,9 +45,8 @@ int APS5_VABI sceNpPartyCreateA(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyGetId(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetId(void* id) {
+    return notInParty(id);
 }
 
 int APS5_VABI sceNpPartyGetMemberInfo(void) {
@@ -42,19 +54,16 @@ int APS5_VABI sceNpPartyGetMemberInfo(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyGetMemberInfoA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t, void* memberInfo) {
+    return notInParty(memberInfo);
 }
 
-int APS5_VABI sceNpPartyGetMemberSessionInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMemberSessionInfo(std::uint16_t, void* memberGameSessionInfo) {
+    return notInParty(memberGameSessionInfo);
 }
 
-int APS5_VABI sceNpPartyGetMemberVoiceInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t, std::uint16_t, std::uint8_t* memberVoiceState) {
+    return notInParty(memberVoiceState);
 }
 
 int APS5_VABI sceNpPartyGetMembers(void) {
@@ -62,9 +71,8 @@ int APS5_VABI sceNpPartyGetMembers(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyGetMembersA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMembersA(void* memberList) {
+    return notInParty(memberList);
 }
 
 int APS5_VABI sceNpPartyGetStateAsUser(void) {
@@ -72,9 +80,8 @@ int APS5_VABI sceNpPartyGetStateAsUser(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyGetStateAsUserA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetStateAsUserA(std::int32_t, std::uint16_t* state) {
+    return sceNpPartyGetState(state);
 }
 
 int APS5_VABI sceNpPartyGetVoiceChatPriority(void) {
@@ -82,8 +89,10 @@ int APS5_VABI sceNpPartyGetVoiceChatPriority(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyInitialize(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpPartyInitialize(const void* param) {
+    if (!param) return NP_PARTY_ERROR_INVALID_ARGUMENT;
+    bool expected = false;
+    if (!g_initialized.compare_exchange_strong(expected, true)) return NP_PARTY_ERROR_ALREADY_INITIALIZED;
     return 0;
 }
 
@@ -102,8 +111,9 @@ int APS5_VABI sceNpPartyRegisterHandler(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyRegisterHandlerA(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void*) {
+    if (!g_initialized) return NP_PARTY_ERROR_NOT_INITIALIZED;
+    if (!handlers) return NP_PARTY_ERROR_INVALID_ARGUMENT;
     return 0;
 }
 
@@ -112,9 +122,8 @@ int APS5_VABI sceNpPartyRegisterPrivateHandler(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartySendBinaryMessage(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartySendBinaryMessage(const void* sendParams) {
+    return notInParty(sendParams);
 }
 
 int APS5_VABI sceNpPartySetVoiceChatPriority(void) {
@@ -133,7 +142,7 @@ int APS5_VABI sceNpPartyShowInvitationListA(void) {
 }
 
 int APS5_VABI sceNpPartyTerminate(void) {
-    NotImplemented_nid_no_patch(__func__);
+    if (!g_initialized.exchange(false)) return NP_PARTY_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceNpParty/include/Api.hpp b/core/libs/prx/libSceNpParty/include/Api.hpp
new file mode 100644
index 0000000000..6ac3a20bc7
--- /dev/null
+++ b/core/libs/prx/libSceNpParty/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpPartyGetState(std::uint16_t* state);
+int APS5_VABI sceNpPartyCheckCallback(void);
+int APS5_VABI sceNpPartyCreate(void);
+int APS5_VABI sceNpPartyCreateA(void);
+int APS5_VABI sceNpPartyGetId(void* id);
+int APS5_VABI sceNpPartyGetMemberInfo(void);
+int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t, void* memberInfo);
+int APS5_VABI sceNpPartyGetMemberSessionInfo(std::uint16_t, void* memberGameSessionInfo);
+int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t, std::uint16_t, std::uint8_t* memberVoiceState);
+int APS5_VABI sceNpPartyGetMembers(void);
+int APS5_VABI sceNpPartyGetMembersA(void* memberList);
+int APS5_VABI sceNpPartyGetStateAsUser(void);
+int APS5_VABI sceNpPartyGetStateAsUserA(std::int32_t, std::uint16_t* state);
+int APS5_VABI sceNpPartyGetVoiceChatPriority(void);
+int APS5_VABI sceNpPartyInitialize(const void* param);
+int APS5_VABI sceNpPartyJoin(void);
+int APS5_VABI sceNpPartyLeave(void);
+int APS5_VABI sceNpPartyRegisterHandler(void);
+int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void*);
+int APS5_VABI sceNpPartyRegisterPrivateHandler(void);
+int APS5_VABI sceNpPartySendBinaryMessage(const void* sendParams);
+int APS5_VABI sceNpPartySetVoiceChatPriority(void);
+int APS5_VABI sceNpPartyShowInvitationList(void);
+int APS5_VABI sceNpPartyShowInvitationListA(void);
+int APS5_VABI sceNpPartyTerminate(void);
+int APS5_VABI sceNpPartyUnregisterPrivateHandler(void);
+
+}
diff --git a/core/libs/prx/libSceNpParty/libSceNpParty.hpp b/core/libs/prx/libSceNpParty/libSceNpParty.hpp
new file mode 100644
index 0000000000..0b7c65e697
--- /dev/null
+++ b/core/libs/prx/libSceNpParty/libSceNpParty.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpParty/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpProfileDialog/CMakeLists.txt b/core/libs/prx/libSceNpProfileDialog/CMakeLists.txt
new file mode 100644
index 0000000000..6406591808
--- /dev/null
+++ b/core/libs/prx/libSceNpProfileDialog/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpProfileDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpProfileDialog PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceNpProfileDialog PRIVATE libc)
+configure_windows_unwind(libSceNpProfileDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_profile_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpProfileDialog.cpp)
+    target_include_directories(guest_np_profile_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_profile_dialog_tests PRIVATE libSceNpProfileDialog libc)
+    configure_windows_unwind(guest_np_profile_dialog_tests)
+    add_test(NAME guest_np_profile_dialog COMMAND guest_np_profile_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_profile_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpProfileDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpProfileDialog/Export.cpp b/core/libs/prx/libSceNpProfileDialog/Export.cpp
index b0dd450371..3ece49618f 100644
--- a/core/libs/prx/libSceNpProfileDialog/Export.cpp
+++ b/core/libs/prx/libSceNpProfileDialog/Export.cpp
@@ -1,48 +1,145 @@
+#include "prx/libSceNpProfileDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <mutex>
+#include <stdexcept>
+#include <string>
 #include "SceTypes.hpp"
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+constexpr std::uint32_t NP_PROFILE_DIALOG_MODE_NORMAL = 1;
+constexpr std::uint32_t NP_PROFILE_DIALOG_MODE_GRIEF_REPORT = 4;
+
+static_assert(offsetof(SceCommonDialogBaseParam, magic) == 44);
+static_assert(sizeof(SceCommonDialogBaseParam) == 48);
+
+static_assert(offsetof(SceNpProfileDialogParam, size) == 48);
+static_assert(offsetof(SceNpProfileDialogParam, mode) == 56);
+static_assert(offsetof(SceNpProfileDialogParam, userId) == 60);
+static_assert(offsetof(SceNpProfileDialogParam, targetOnlineId) == 64);
+static_assert(offsetof(SceNpProfileDialogParam, userData) == 88);
+static_assert(sizeof(SceNpProfileDialogParam) == 128);
+
+static_assert(offsetof(SceNpProfileDialogParamA, size) == 48);
+static_assert(offsetof(SceNpProfileDialogParamA, mode) == 56);
+static_assert(offsetof(SceNpProfileDialogParamA, userId) == 60);
+static_assert(offsetof(SceNpProfileDialogParamA, targetAccountId) == 64);
+static_assert(offsetof(SceNpProfileDialogParamA, userData) == 80);
+static_assert(sizeof(SceNpProfileDialogParamA) == 120);
+
+static_assert(offsetof(SceNpProfileDialogResult, userAction) == 4);
+static_assert(offsetof(SceNpProfileDialogResult, userData) == 8);
+static_assert(offsetof(SceNpProfileDialogResult, reserved) == 16);
+static_assert(sizeof(SceNpProfileDialogResult) == 48);
+
+struct DialogState {
+    std::mutex mutex;
+    int status = COMMON_DIALOG_STATUS_NONE;
+    void* userData = nullptr;
+};
+
+DialogState& Dialog() {
+    static DialogState state;
+    return state;
+}
+
+[[noreturn]] void Unsettled(const char* function, const std::string& what) {
+    throw std::runtime_error(std::string(function) + ": " + what);
+}
+
+template <typename TParam>
+int OpenDialog(const TParam* param, const char* function) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    if (dialog.status != COMMON_DIALOG_STATUS_INITIALIZED && dialog.status != COMMON_DIALOG_STATUS_FINISHED) {
+        Unsettled(function, "status " + std::to_string(dialog.status) + " is neither INITIALIZED nor FINISHED, and the error for it is unsettled");
+    }
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (param->size != sizeof(TParam)) {
+        Unsettled(function, "param size " + std::to_string(param->size) + " is not the " + std::to_string(sizeof(TParam)) + "-byte layout this library reads");
+    }
+    if (param->mode < NP_PROFILE_DIALOG_MODE_NORMAL || param->mode > NP_PROFILE_DIALOG_MODE_GRIEF_REPORT) {
+        Unsettled(function, "mode " + std::to_string(param->mode) + " is not a known profile dialog mode");
+    }
+    dialog.userData = param->userData;
+    dialog.status = COMMON_DIALOG_STATUS_FINISHED;
+    return COMMON_DIALOG_OK;
+}
+
+}
+
 extern "C" {
 
-int APS5_VABI sceNpProfileDialogClose() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogInitialize(void) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    if (dialog.status != COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
+    dialog.status = COMMON_DIALOG_STATUS_INITIALIZED;
+    dialog.userData = nullptr;
+    return COMMON_DIALOG_OK;
 }
 
-int APS5_VABI sceNpProfileDialogGetResult() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogTerminate(void) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    if (dialog.status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    dialog.status = COMMON_DIALOG_STATUS_NONE;
+    dialog.userData = nullptr;
+    return COMMON_DIALOG_OK;
 }
 
-int APS5_VABI sceNpProfileDialogGetStatus() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogUpdateStatus(void) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    return dialog.status;
 }
 
-int APS5_VABI sceNpProfileDialogInitialize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogGetStatus(void) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    return dialog.status;
 }
 
-int APS5_VABI sceNpProfileDialogOpen() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogOpen(const SceNpProfileDialogParam* param) {
+    return OpenDialog(param, __func__);
 }
 
-int APS5_VABI sceNpProfileDialogOpenA() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogOpenA(const SceNpProfileDialogParamA* param) {
+    return OpenDialog(param, __func__);
 }
 
-int APS5_VABI sceNpProfileDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogClose(void) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    if (dialog.status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    Unsettled(__func__, "status " + std::to_string(dialog.status) + " is not RUNNING, and the error for closing a dialog that is not running is unsettled");
 }
 
-int APS5_VABI sceNpProfileDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpProfileDialogGetResult(SceNpProfileDialogResult* result) {
+    DialogState& dialog = Dialog();
+    std::lock_guard lock(dialog.mutex);
+    if (dialog.status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (dialog.status != COMMON_DIALOG_STATUS_FINISHED) {
+        if (result == nullptr) Unsettled(__func__, "a null result before the dialog finished has an unsettled error");
+        return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    }
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    *result = SceNpProfileDialogResult{};
+    result->result = COMMON_DIALOG_OK;
+    result->userAction = COMMON_DIALOG_RESULT_USER_CANCELED;
+    result->userData = dialog.userData;
+    return COMMON_DIALOG_OK;
 }
 
 }
diff --git a/core/libs/prx/libSceNpProfileDialog/include/Api.hpp b/core/libs/prx/libSceNpProfileDialog/include/Api.hpp
new file mode 100644
index 0000000000..b505733fc0
--- /dev/null
+++ b/core/libs/prx/libSceNpProfileDialog/include/Api.hpp
@@ -0,0 +1,56 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+
+struct SceCommonDialogBaseParam {
+    std::uint64_t size;
+    std::uint8_t reserved[36];
+    std::uint32_t magic;
+};
+
+struct SceNpProfileDialogParam {
+    SceCommonDialogBaseParam baseParam;
+    std::uint64_t size;
+    std::uint32_t mode;
+    std::int32_t userId;
+    NpOnlineId targetOnlineId;
+    std::uint8_t padding[4];
+    void* userData;
+    std::uint8_t reserved[32];
+};
+
+struct SceNpProfileDialogParamA {
+    SceCommonDialogBaseParam baseParam;
+    std::uint64_t size;
+    std::uint32_t mode;
+    std::int32_t userId;
+    std::uint64_t targetAccountId;
+    std::uint8_t padding[8];
+    void* userData;
+    std::uint8_t reserved[32];
+};
+
+struct SceNpProfileDialogResult {
+    std::int32_t result;
+    std::int32_t userAction;
+    void* userData;
+    std::uint8_t reserved[32];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpProfileDialogInitialize(void);
+int APS5_VABI sceNpProfileDialogTerminate(void);
+int APS5_VABI sceNpProfileDialogUpdateStatus(void);
+int APS5_VABI sceNpProfileDialogGetStatus(void);
+int APS5_VABI sceNpProfileDialogOpen(const SceNpProfileDialogParam* param);
+int APS5_VABI sceNpProfileDialogOpenA(const SceNpProfileDialogParamA* param);
+int APS5_VABI sceNpProfileDialogClose(void);
+int APS5_VABI sceNpProfileDialogGetResult(SceNpProfileDialogResult* result);
+
+}
diff --git a/core/libs/prx/libSceNpProfileDialog/libSceNpProfileDialog.hpp b/core/libs/prx/libSceNpProfileDialog/libSceNpProfileDialog.hpp
new file mode 100644
index 0000000000..8cfbbcbcd4
--- /dev/null
+++ b/core/libs/prx/libSceNpProfileDialog/libSceNpProfileDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpProfileDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp b/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp
index 766da74191..a0f12e3e85 100644
--- a/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp
+++ b/core/libs/prx/libSceNpRemotePlaySessionSignaling/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp b/core/libs/prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp
new file mode 100644
index 0000000000..9aeae0ac11
--- /dev/null
+++ b/core/libs/prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpRemotePlaySessionSignalingCreateJoinSession();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetConnectionStatus();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetCustomProperty();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetLocalNetInfo();
+int APS5_VABI sceNpRemotePlaySessionSignalingGetMemoryInfo();
+int APS5_VABI sceNpRemotePlaySessionSignalingInitialize();
+int APS5_VABI sceNpRemotePlaySessionSignalingJoinSession();
+int APS5_VABI sceNpRemotePlaySessionSignalingLeaveSession();
+int APS5_VABI sceNpRemotePlaySessionSignalingSetCustomProperty();
+int APS5_VABI sceNpRemotePlaySessionSignalingTerminate();
+
+}
diff --git a/core/libs/prx/libSceNpRemotePlaySessionSignaling/libSceNpRemotePlaySessionSignaling.hpp b/core/libs/prx/libSceNpRemotePlaySessionSignaling/libSceNpRemotePlaySessionSignaling.hpp
new file mode 100644
index 0000000000..4c78dfe8e5
--- /dev/null
+++ b/core/libs/prx/libSceNpRemotePlaySessionSignaling/libSceNpRemotePlaySessionSignaling.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpRemotePlaySessionSignaling/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt b/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt
new file mode 100644
index 0000000000..d73264a441
--- /dev/null
+++ b/core/libs/prx/libSceNpScoreRanking/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpScoreRanking SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpScoreRanking PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpScoreRanking)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_score_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpScoreOffline.cpp)
+    target_include_directories(guest_np_score_offline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_score_offline_tests PRIVATE libSceNpScoreRanking)
+    configure_windows_unwind(guest_np_score_offline_tests)
+    add_test(NAME guest_np_score_offline COMMAND guest_np_score_offline_tests)
+    set_tests_properties(guest_np_score_offline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_score_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpScoreRanking>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpScoreRanking/Export.cpp b/core/libs/prx/libSceNpScoreRanking/Export.cpp
index 1bb8bc6df6..1edb9c64ca 100644
--- a/core/libs/prx/libSceNpScoreRanking/Export.cpp
+++ b/core/libs/prx/libSceNpScoreRanking/Export.cpp
@@ -1,81 +1,225 @@
+#include "prx/libSceNpScoreRanking/include/Api.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <unordered_map>
+#include <unordered_set>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+static constexpr int SCE_NP_ERROR_SIGNED_OUT = static_cast<int>(0x80550006);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550704);
+static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS = static_cast<int>(0x80550706);
+static constexpr int SCE_NP_COMMUNITY_ERROR_ABORTED = static_cast<int>(0x80550707);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT = static_cast<int>(0x8055070C);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ID = static_cast<int>(0x8055070E);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT = static_cast<int>(0x80550714);
+static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_NPID = static_cast<int>(0x80550719);
+static constexpr std::uint32_t INVALID_SERVICE_LABEL = 0xFFFFFFFF;
+static constexpr std::size_t MAX_OBJECTS = 32;
+static constexpr std::uint64_t MAX_RANGE_PER_REQUEST = 100;
+static constexpr std::uint64_t MAX_NPID_PER_REQUEST = 101;
+static constexpr std::uint64_t GAME_INFO_MAX_SIZE = 189;
+static constexpr std::uint64_t NP_ID_SIZE = 36;
+static constexpr std::uint64_t RANK_DATA_SIZE = 0x80;
+static constexpr std::uint64_t PLAYER_RANK_DATA_SIZE = 0x88;
+static constexpr std::uint64_t COMMENT_SIZE = 64;
+static constexpr std::uint64_t GAME_INFO_SIZE = 200;
+static constexpr std::uint64_t FRIEND_RANKING_OPTION_SIZE = 24;
+static constexpr int POLL_FINISHED = 0;
+static constexpr int POLL_RUNNING = 1;
+
+static_assert(sizeof(NpScoreGameInfo) == GAME_INFO_SIZE);
+
+static_assert(sizeof(NpScoreFriendRankingOption) == FRIEND_RANKING_OPTION_SIZE);
+
+namespace {
+struct Request {
+    int titleCtxId = 0;
+    std::optional<int> result;
+};
+
+std::mutex scoreMutex;
+std::unordered_set<int> titleContexts;
+std::unordered_map<int, Request> requests;
+int nextTitleContext = 1;
+int nextRequest = 1;
+
+int CheckArrays(std::uint64_t arrayNum, const void* commentArray, std::uint64_t commentArraySize, const void* infoArray, std::uint64_t infoArraySize) {
+    if (commentArray && commentArraySize != arrayNum * COMMENT_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    if (infoArray && infoArraySize != arrayNum * GAME_INFO_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    return 0;
+}
+
+int Offline(int reqId) {
+    std::lock_guard lock(scoreMutex);
+    const auto request = requests.find(reqId);
+    if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (request->second.result == SCE_NP_COMMUNITY_ERROR_ABORTED) return SCE_NP_COMMUNITY_ERROR_ABORTED;
+    if (!request->second.result) request->second.result = SCE_NP_ERROR_SIGNED_OUT;
+    return SCE_NP_ERROR_SIGNED_OUT;
+}
+
+int RecordScore(int reqId, const NpScoreGameInfo* gameInfo, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (gameInfo && gameInfo->infoSize > GAME_INFO_MAX_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return Offline(reqId);
+}
+
+int GetRankingByRange(int reqId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (arrayNum > MAX_RANGE_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (startSerialRank == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!rankArray || arrayNum == 0) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (rankArraySize != arrayNum * RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error;
+    return Offline(reqId);
+}
+
+int GetRankingByNpId(int reqId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (arrayNum > MAX_NPID_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_NPID;
+    if (!npIdArray || !rankArray) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (npIdArraySize != arrayNum * NP_ID_SIZE || rankArraySize != arrayNum * PLAYER_RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error;
+    return Offline(reqId);
+}
+
+int GetFriendsRanking(int reqId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, const NpScoreFriendRankingOption* option) {
+    if (!rankArray) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (rankArraySize != arrayNum * RANK_DATA_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ALIGNMENT;
+    std::uint32_t startSerialRank = 1;
+    if (includeSelf == 0) {
+        if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    } else if (option) {
+        if (option->size != FRIEND_RANKING_OPTION_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+        if (option->startSerialRank) startSerialRank = *option->startSerialRank;
+    }
+    if (arrayNum > MAX_RANGE_PER_REQUEST) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (startSerialRank == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (arrayNum == 0) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (const int error = CheckArrays(arrayNum, commentArray, commentArraySize, infoArray, infoArraySize)) return error;
+    return Offline(reqId);
+}
+}
+
 extern "C" {
 
-int APS5_VABI sceNpScoreAbortRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpScoreAbortRequest(int reqId) {
+    std::lock_guard lock(scoreMutex);
+    const auto request = requests.find(reqId);
+    if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.result) request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
     return 0;
 }
 
-int APS5_VABI sceNpScoreCreateNpTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpScoreCreateNpTitleCtx(std::uint32_t serviceLabel, const void* selfNpId) {
+    if (serviceLabel == INVALID_SERVICE_LABEL) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!selfNpId) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    std::lock_guard lock(scoreMutex);
+    if (titleContexts.size() >= MAX_OBJECTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int titleCtxId = nextTitleContext++;
+    titleContexts.insert(titleCtxId);
+    return titleCtxId;
+}
+
+int APS5_VABI sceNpScoreCreateRequest(int titleCtxId) {
+    std::lock_guard lock(scoreMutex);
+    if (!titleContexts.contains(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (requests.size() >= MAX_OBJECTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int reqId = nextRequest++;
+    requests.emplace(reqId, Request{titleCtxId});
+    return reqId;
+}
+
+int APS5_VABI sceNpScoreDeleteNpTitleCtx(int titleCtxId) {
+    std::lock_guard lock(scoreMutex);
+    if (!titleContexts.erase(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    std::erase_if(requests, [titleCtxId](const auto& entry) { return entry.second.titleCtxId == titleCtxId; });
     return 0;
 }
 
-int APS5_VABI sceNpScoreCreateRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreDeleteRequest(int reqId) {
+    std::lock_guard lock(scoreMutex);
+    return requests.erase(reqId) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
 }
 
-int APS5_VABI sceNpScoreDeleteNpTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetBoardInfo(int reqId, std::uint32_t boardId, void* boardInfo, void* option) {
+    (void)boardId;
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!boardInfo) throw std::runtime_error("sceNpScoreGetBoardInfo: the answer for a null board info depends on the title's SDK version");
+    return Offline(reqId);
 }
 
-int APS5_VABI sceNpScoreDeleteRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetFriendsRanking(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetFriendsRanking(reqId, includeSelf, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetBoardInfo() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetFriendsRankingAsync(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetFriendsRanking(reqId, includeSelf, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetFriendsRanking() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByNpId(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByNpId(reqId, npIdArray, npIdArraySize, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetFriendsRankingAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByNpIdAsync(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByNpId(reqId, npIdArray, npIdArraySize, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetRankingByNpId() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByRange(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByRange(reqId, startSerialRank, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetRankingByNpIdAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreGetRankingByRangeAsync(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option) {
+    (void)boardId;
+    (void)lastSortDate;
+    (void)totalRecord;
+    return GetRankingByRange(reqId, startSerialRank, rankArray, rankArraySize, commentArray, commentArraySize, infoArray, infoArraySize, arrayNum, option);
 }
 
-int APS5_VABI sceNpScoreGetRankingByRange() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScorePollAsync(int reqId, int* result) {
+    std::lock_guard lock(scoreMutex);
+    const auto request = requests.find(reqId);
+    if (request == requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.result) return POLL_RUNNING;
+    if (result) *result = *request->second.result;
+    return POLL_FINISHED;
 }
 
-int APS5_VABI sceNpScoreGetRankingByRangeAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreRecordScore(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option) {
+    (void)boardId;
+    (void)score;
+    (void)scoreComment;
+    (void)tmpRank;
+    (void)compareDate;
+    return RecordScore(reqId, gameInfo, option);
 }
 
-int APS5_VABI sceNpScorePollAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpScoreRecordScore() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpScoreRecordScoreAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpScoreRecordScoreAsync(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option) {
+    (void)boardId;
+    (void)score;
+    (void)scoreComment;
+    (void)tmpRank;
+    (void)compareDate;
+    return RecordScore(reqId, gameInfo, option);
 }
 
 }
diff --git a/core/libs/prx/libSceNpScoreRanking/include/Api.hpp b/core/libs/prx/libSceNpScoreRanking/include/Api.hpp
new file mode 100644
index 0000000000..3a665215ec
--- /dev/null
+++ b/core/libs/prx/libSceNpScoreRanking/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpScoreFriendRankingOption {
+    std::uint64_t size;
+    const std::uint32_t* startSerialRank;
+    const std::uint32_t* hits;
+};
+
+struct NpScoreGameInfo {
+    std::uint64_t infoSize;
+    std::uint8_t data[189];
+    std::uint8_t pad[3];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpScoreAbortRequest(int reqId);
+int APS5_VABI sceNpScoreCreateNpTitleCtx(std::uint32_t serviceLabel, const void* selfNpId);
+int APS5_VABI sceNpScoreCreateRequest(int titleCtxId);
+int APS5_VABI sceNpScoreDeleteNpTitleCtx(int titleCtxId);
+int APS5_VABI sceNpScoreDeleteRequest(int reqId);
+int APS5_VABI sceNpScoreGetBoardInfo(int reqId, std::uint32_t boardId, void* boardInfo, void* option);
+int APS5_VABI sceNpScoreGetFriendsRanking(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option);
+int APS5_VABI sceNpScoreGetFriendsRankingAsync(int reqId, std::uint32_t boardId, int includeSelf, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, const NpScoreFriendRankingOption* option);
+int APS5_VABI sceNpScoreGetRankingByNpId(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScoreGetRankingByNpIdAsync(int reqId, std::uint32_t boardId, const void* npIdArray, std::uint64_t npIdArraySize, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScoreGetRankingByRange(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScoreGetRankingByRangeAsync(int reqId, std::uint32_t boardId, std::uint32_t startSerialRank, void* rankArray, std::uint64_t rankArraySize, void* commentArray, std::uint64_t commentArraySize, void* infoArray, std::uint64_t infoArraySize, std::uint64_t arrayNum, void* lastSortDate, void* totalRecord, void* option);
+int APS5_VABI sceNpScorePollAsync(int reqId, int* result);
+int APS5_VABI sceNpScoreRecordScore(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option);
+int APS5_VABI sceNpScoreRecordScoreAsync(int reqId, std::uint32_t boardId, std::int64_t score, const void* scoreComment, const NpScoreGameInfo* gameInfo, std::uint32_t* tmpRank, const void* compareDate, void* option);
+
+}
diff --git a/core/libs/prx/libSceNpScoreRanking/libSceNpScoreRanking.hpp b/core/libs/prx/libSceNpScoreRanking/libSceNpScoreRanking.hpp
new file mode 100644
index 0000000000..312ac2276e
--- /dev/null
+++ b/core/libs/prx/libSceNpScoreRanking/libSceNpScoreRanking.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpScoreRanking/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSessionSignaling/Export.cpp b/core/libs/prx/libSceNpSessionSignaling/Export.cpp
index 79969f86ed..1123e55333 100644
--- a/core/libs/prx/libSceNpSessionSignaling/Export.cpp
+++ b/core/libs/prx/libSceNpSessionSignaling/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSessionSignaling/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -25,79 +26,6 @@ static std::mutex g_mutex;
 static bool g_initialized = false;
 static std::array<SessionSignalingContext, 10> g_contexts{};
 
-struct SessionSignalingInitParam {
-    std::int32_t userId;
-    std::uint64_t poolSize;
-    std::uint64_t affinityMask;
-    std::int32_t threadPriority;
-    std::uint64_t stackSize;
-};
-
-struct SessionSignalingMemoryInfo {
-    std::uint64_t poolSize;
-    std::uint64_t usedSize;
-    std::uint64_t peakUsedSize;
-};
-
-struct SessionSignalingPeerAddress {
-    std::uint64_t accountId;
-    std::uint32_t platform;
-};
-
-struct SessionSignalingSessionParam {
-    std::uint32_t mode;
-    std::uint32_t option;
-};
-
-struct SessionSignalingNetAddress {
-    std::uint32_t address;
-    std::uint16_t port;
-};
-
-union SessionSignalingConnectionInfo {
-    std::uint32_t value;
-    SessionSignalingNetAddress netAddress;
-    SessionSignalingPeerAddress peerAddress;
-};
-
-struct SessionSignalingLocalNetInfo {
-    std::uint32_t localAddress;
-    std::uint32_t mappedAddress;
-    std::uint32_t mappedPort;
-    std::uint32_t mappingStatus;
-};
-
-using SessionSignalingEventCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, const SessionSignalingPeerAddress*, std::int32_t, void*);
-using SessionSignalingConnectionCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
-using SessionSignalingConnectionCallback2 = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
-
-template<typename TConnectionCallback>
-struct SessionSignalingContextParam {
-    std::int32_t userId;
-    std::uint32_t serviceLabel;
-    SessionSignalingEventCallback prepareCallback;
-    void* prepareUserData;
-    SessionSignalingEventCallback sessionCallback;
-    void* sessionUserData;
-    TConnectionCallback connectionCallback;
-    void* connectionUserData;
-};
-
-using SessionSignalingContextParam1 = SessionSignalingContextParam<SessionSignalingConnectionCallback>;
-using SessionSignalingContextParam2 = SessionSignalingContextParam<SessionSignalingConnectionCallback2>;
-
-struct SessionSignalingConnectionStatistics {
-    std::uint32_t peakConnectionCount;
-    std::uint32_t connectionCount;
-    std::uint32_t connectingCount;
-    std::uint32_t connectedCount;
-};
-
-struct SessionSignalingGroupInfo {
-    std::uint32_t connectionIds[64];
-    std::uint64_t connectionCount;
-};
-
 static_assert(sizeof(SessionSignalingMemoryInfo) == 24);
 static_assert(sizeof(SessionSignalingInitParam) == 40);
 static_assert(offsetof(SessionSignalingInitParam, poolSize) == 8);
@@ -273,23 +201,39 @@ int APS5_VABI sceNpSessionSignalingGetConnectionStatistics(SessionSignalingConne
 }
 
 int APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress(std::uint32_t contextId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return SCE_NP_SESSION_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!peerAddress || !connectionId) return SCE_NP_SESSION_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (!FindContext(contextId)) return SCE_NP_SESSION_SIGNALING_ERROR_CONTEXT_NOT_FOUND;
+    return SCE_NP_SESSION_SIGNALING_ERROR_CONN_NOT_FOUND;
 }
 
 int APS5_VABI sceNpSessionSignalingGetGroupFromSessionId(std::uint32_t contextId, const char* sessionId, std::uint32_t* groupId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return SCE_NP_SESSION_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!sessionId || !groupId) return SCE_NP_SESSION_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (!FindContext(contextId)) return SCE_NP_SESSION_SIGNALING_ERROR_CONTEXT_NOT_FOUND;
+    return SCE_NP_SESSION_SIGNALING_ERROR_GROUP_NOT_FOUND;
 }
 
 int APS5_VABI sceNpSessionSignalingGetGroupInfo(std::uint32_t contextId, std::uint32_t groupId, SessionSignalingGroupInfo* groupInfo) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)groupId;
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return SCE_NP_SESSION_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!groupInfo) return SCE_NP_SESSION_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (!FindContext(contextId)) return SCE_NP_SESSION_SIGNALING_ERROR_CONTEXT_NOT_FOUND;
+    return SCE_NP_SESSION_SIGNALING_ERROR_GROUP_NOT_FOUND;
 }
 
-int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress2(std::uint32_t contextId, std::uint32_t groupId, std::uint32_t address, std::uint16_t port, SessionSignalingGroupInfo* groupInfo) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress2(std::uint32_t contextId, std::uint32_t groupId, std::uint32_t address, std::uint16_t port, std::uint32_t* connectionId) {
+    (void)groupId;
+    (void)address;
+    (void)port;
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return SCE_NP_SESSION_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!connectionId) return SCE_NP_SESSION_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (!FindContext(contextId)) return SCE_NP_SESSION_SIGNALING_ERROR_CONTEXT_NOT_FOUND;
+    return SCE_NP_SESSION_SIGNALING_ERROR_GROUP_NOT_FOUND;
 }
 
 int APS5_VABI sceNpSessionSignalingCreateJoinActivate() {
@@ -297,9 +241,14 @@ int APS5_VABI sceNpSessionSignalingCreateJoinActivate() {
     return 0;
 }
 
-int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress(std::uint32_t contextId, std::uint32_t address, std::uint16_t port, std::uint32_t* connectionId) {
+    (void)address;
+    (void)port;
+    std::lock_guard lock(g_mutex);
+    if (!g_initialized) return SCE_NP_SESSION_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!connectionId) return SCE_NP_SESSION_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (!FindContext(contextId)) return SCE_NP_SESSION_SIGNALING_ERROR_CONTEXT_NOT_FOUND;
+    return SCE_NP_SESSION_SIGNALING_ERROR_CONN_NOT_FOUND;
 }
 
 int APS5_VABI sceNpSessionSignalingGetCustomProperty() {
diff --git a/core/libs/prx/libSceNpSessionSignaling/include/Api.hpp b/core/libs/prx/libSceNpSessionSignaling/include/Api.hpp
new file mode 100644
index 0000000000..948b313253
--- /dev/null
+++ b/core/libs/prx/libSceNpSessionSignaling/include/Api.hpp
@@ -0,0 +1,114 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+
+struct SessionSignalingInitParam {
+    std::int32_t userId;
+    std::uint64_t poolSize;
+    std::uint64_t affinityMask;
+    std::int32_t threadPriority;
+    std::uint64_t stackSize;
+};
+
+struct SessionSignalingMemoryInfo {
+    std::uint64_t poolSize;
+    std::uint64_t usedSize;
+    std::uint64_t peakUsedSize;
+};
+
+struct SessionSignalingPeerAddress {
+    std::uint64_t accountId;
+    std::uint32_t platform;
+};
+
+struct SessionSignalingSessionParam {
+    std::uint32_t mode;
+    std::uint32_t option;
+};
+
+struct SessionSignalingNetAddress {
+    std::uint32_t address;
+    std::uint16_t port;
+};
+
+union SessionSignalingConnectionInfo {
+    std::uint32_t value;
+    SessionSignalingNetAddress netAddress;
+    SessionSignalingPeerAddress peerAddress;
+};
+
+struct SessionSignalingLocalNetInfo {
+    std::uint32_t localAddress;
+    std::uint32_t mappedAddress;
+    std::uint32_t mappedPort;
+    std::uint32_t mappingStatus;
+};
+
+using SessionSignalingEventCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, const SessionSignalingPeerAddress*, std::int32_t, void*);
+
+using SessionSignalingConnectionCallback = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
+
+using SessionSignalingConnectionCallback2 = void (APS5_VABI *)(std::uint32_t, std::uint32_t, std::uint32_t, std::int32_t, std::int32_t, void*);
+
+template<typename TConnectionCallback>
+struct SessionSignalingContextParam {
+    std::int32_t userId;
+    std::uint32_t serviceLabel;
+    SessionSignalingEventCallback prepareCallback;
+    void* prepareUserData;
+    SessionSignalingEventCallback sessionCallback;
+    void* sessionUserData;
+    TConnectionCallback connectionCallback;
+    void* connectionUserData;
+};
+
+using SessionSignalingContextParam1 = SessionSignalingContextParam<SessionSignalingConnectionCallback>;
+
+using SessionSignalingContextParam2 = SessionSignalingContextParam<SessionSignalingConnectionCallback2>;
+
+struct SessionSignalingConnectionStatistics {
+    std::uint32_t peakConnectionCount;
+    std::uint32_t connectionCount;
+    std::uint32_t connectingCount;
+    std::uint32_t connectedCount;
+};
+
+struct SessionSignalingGroupInfo {
+    std::uint32_t connectionIds[64];
+    std::uint64_t connectionCount;
+};
+
+extern "C" {
+
+int APS5_VABI sceNpSessionSignalingInitialize(const SessionSignalingInitParam* param);
+int APS5_VABI sceNpSessionSignalingActivateSession(std::uint32_t contextId, const char* sessionId, std::uint32_t sessionType, const SessionSignalingSessionParam* param, std::uint32_t* groupId);
+int APS5_VABI sceNpSessionSignalingCreateContext2(const SessionSignalingContextParam2* param, std::uint32_t* contextId);
+int APS5_VABI sceNpSessionSignalingCreateContext(const SessionSignalingContextParam1* param, std::uint32_t* contextId);
+int APS5_VABI sceNpSessionSignalingDeactivate(std::uint32_t contextId, std::uint32_t connectionId);
+int APS5_VABI sceNpSessionSignalingDestroyContext(std::uint32_t contextId);
+int APS5_VABI sceNpSessionSignalingGetConnectionInfo(std::uint32_t contextId, std::uint32_t connectionId, std::uint32_t code, SessionSignalingConnectionInfo* info);
+int APS5_VABI sceNpSessionSignalingActivateUser(std::uint32_t contextId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress2(std::uint32_t contextId, std::uint32_t groupId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingTerminate(void);
+int32_t APS5_VABI sceNpSessionSignalingGetConnectionStatus(std::uint32_t contextId, std::uint32_t connectionId, std::int32_t* status, std::uint32_t* peerAddress, std::uint16_t* peerPort);
+int32_t APS5_VABI sceNpSessionSignalingGetLocalNetInfo(std::uint32_t contextId, SessionSignalingLocalNetInfo* info);
+int APS5_VABI sceNpSessionSignalingRequestPrepare(uint32_t contextId, uint32_t* requestId);
+int APS5_VABI sceNpSessionSignalingGetMemoryInfo(SessionSignalingMemoryInfo* memoryInfo);
+int APS5_VABI sceNpSessionSignalingGetConnectionStatistics(SessionSignalingConnectionStatistics* statistics);
+int APS5_VABI sceNpSessionSignalingGetConnectionFromPeerAddress(std::uint32_t contextId, const SessionSignalingPeerAddress* peerAddress, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingGetGroupFromSessionId(std::uint32_t contextId, const char* sessionId, std::uint32_t* groupId);
+int APS5_VABI sceNpSessionSignalingGetGroupInfo(std::uint32_t contextId, std::uint32_t groupId, SessionSignalingGroupInfo* groupInfo);
+int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress2(std::uint32_t contextId, std::uint32_t groupId, std::uint32_t address, std::uint16_t port, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingCreateJoinActivate();
+int APS5_VABI sceNpSessionSignalingGetConnectionFromNetAddress(std::uint32_t contextId, std::uint32_t address, std::uint16_t port, std::uint32_t* connectionId);
+int APS5_VABI sceNpSessionSignalingGetCustomProperty();
+int APS5_VABI sceNpSessionSignalingGetGroupFromPeerAddress();
+int APS5_VABI sceNpSessionSignalingInitializeWithPort();
+int APS5_VABI sceNpSessionSignalingJoinActivate();
+int APS5_VABI sceNpSessionSignalingSetCustomProperty();
+
+}
diff --git a/core/libs/prx/libSceNpSessionSignaling/libSceNpSessionSignaling.hpp b/core/libs/prx/libSceNpSessionSignaling/libSceNpSessionSignaling.hpp
new file mode 100644
index 0000000000..8cdf796fb6
--- /dev/null
+++ b/core/libs/prx/libSceNpSessionSignaling/libSceNpSessionSignaling.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSessionSignaling/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSignaling/CMakeLists.txt b/core/libs/prx/libSceNpSignaling/CMakeLists.txt
new file mode 100644
index 0000000000..a5ecdbd944
--- /dev/null
+++ b/core/libs/prx/libSceNpSignaling/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpSignaling SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpSignaling PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpSignaling)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_signaling_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpSignalingOffline.cpp)
+    target_include_directories(guest_np_signaling_offline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_signaling_offline_tests PRIVATE libSceNpSignaling)
+    configure_windows_unwind(guest_np_signaling_offline_tests)
+    add_test(NAME guest_np_signaling_offline COMMAND guest_np_signaling_offline_tests)
+    set_tests_properties(guest_np_signaling_offline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_signaling_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpSignaling>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpSignaling/Export.cpp b/core/libs/prx/libSceNpSignaling/Export.cpp
index 8ab2a25170..1e4d40dcb1 100644
--- a/core/libs/prx/libSceNpSignaling/Export.cpp
+++ b/core/libs/prx/libSceNpSignaling/Export.cpp
@@ -1,44 +1,168 @@
+#include "prx/libSceNpSignaling/include/Api.hpp"
+#include <cstdint>
+#include <cstring>
+#include <mutex>
+#include <unordered_map>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+static constexpr int SCE_NP_ERROR_SIGNED_OUT = static_cast<int>(0x80550006);
+static constexpr int SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED = static_cast<int>(0x80552701);
+static constexpr int SCE_NP_SIGNALING_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80552702);
+static constexpr int SCE_NP_SIGNALING_ERROR_CTXID_NOT_AVAILABLE = static_cast<int>(0x80552704);
+static constexpr int SCE_NP_SIGNALING_ERROR_CTX_NOT_FOUND = static_cast<int>(0x80552705);
+static constexpr int SCE_NP_SIGNALING_ERROR_CONN_NOT_FOUND = static_cast<int>(0x8055270E);
+static constexpr int SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80552715);
+static constexpr int SCE_NP_SIGNALING_ERROR_OWN_NP_ID = static_cast<int>(0x80552716);
+static constexpr int CONTEXT_OPTION_FLAG = 1;
+static constexpr int MAX_CONTEXT_ID = 8;
+static constexpr std::uint32_t CONTEXT_FLAG_BIT = 0x2;
+
+namespace {
+struct SignalingNpId {
+    char handle[16];
+    char term;
+    char dummy[3];
+    std::uint8_t opt[8];
+    std::uint8_t reserved[8];
+};
+static_assert(sizeof(SignalingNpId) == 36);
+
+struct Context {
+    SignalingNpId owner{};
+    std::uint32_t flags = CONTEXT_FLAG_BIT;
+};
+
+std::mutex signalingMutex;
+bool initialized = false;
+std::unordered_map<int, Context> contexts;
+int lastContextId = 0;
+
+bool IsAsciiAlphanumeric(char value) {
+    return (value >= '0' && value <= '9') || (value >= 'A' && value <= 'Z') || (value >= 'a' && value <= 'z');
+}
+
+bool ReadNpId(const void* npId, SignalingNpId& copy) {
+    std::memcpy(&copy, npId, sizeof(copy));
+    if (copy.term != 0) return false;
+    const std::size_t length = strnlen(copy.handle, sizeof(copy.handle));
+    if (length < 3 || !IsAsciiAlphanumeric(copy.handle[0])) return false;
+    for (std::size_t index = 1; index < length; ++index) {
+        const char value = copy.handle[index];
+        if (!IsAsciiAlphanumeric(value) && value != '_' && value != '-') return false;
+    }
+    return true;
+}
+
+int AllocateContextId() {
+    int candidate = lastContextId == MAX_CONTEXT_ID ? 1 : lastContextId + 1;
+    for (int tried = 0; tried < MAX_CONTEXT_ID; ++tried) {
+        if (!contexts.contains(candidate)) {
+            lastContextId = candidate;
+            return candidate;
+        }
+        candidate = candidate == MAX_CONTEXT_ID ? 1 : candidate + 1;
+    }
+    return -1;
+}
+
+Context* FindContext(int ctxId) {
+    const auto context = contexts.find(ctxId);
+    return context == contexts.end() ? nullptr : &context->second;
+}
+}
+
 extern "C" {
 
-int APS5_VABI sceNpSignalingActivateConnection() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSignalingActivateConnection(int ctxId, const void* peerNpId, int* outConnId) {
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!peerNpId || !outConnId) return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    SignalingNpId peer{};
+    if (!ReadNpId(peerNpId, peer)) return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    const Context* context = FindContext(ctxId);
+    if (!context) return SCE_NP_SIGNALING_ERROR_CTX_NOT_FOUND;
+    if (std::memcmp(&context->owner, &peer, sizeof(peer)) == 0) return SCE_NP_SIGNALING_ERROR_OWN_NP_ID;
+    return SCE_NP_ERROR_SIGNED_OUT;
+}
+
+int APS5_VABI sceNpSignalingCreateContext(const void* npId, void* callback, void* callbackArg, int* outContextId) {
+    (void)callback;
+    (void)callbackArg;
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!npId || !outContextId) return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    SignalingNpId owner{};
+    if (!ReadNpId(npId, owner)) return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    const int ctxId = AllocateContextId();
+    if (ctxId < 0) return SCE_NP_SIGNALING_ERROR_CTXID_NOT_AVAILABLE;
+    contexts[ctxId] = Context{owner};
+    *outContextId = ctxId;
     return 0;
 }
 
-int APS5_VABI sceNpSignalingCreateContext() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSignalingDeleteContext(int ctxId) {
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    contexts.erase(ctxId);
     return 0;
 }
 
-int APS5_VABI sceNpSignalingDeleteContext() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSignalingGetConnectionInfo(int ctxId, int connId, int infoCode, void* outInfo) {
+    (void)connId;
+    (void)infoCode;
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!outInfo) return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (!FindContext(ctxId)) return SCE_NP_SIGNALING_ERROR_CTX_NOT_FOUND;
+    return SCE_NP_SIGNALING_ERROR_CONN_NOT_FOUND;
+}
+
+int APS5_VABI sceNpSignalingInitialize(std::int64_t memorySize, int threadPriority, int cpuAffinityMask, std::int64_t threadStackSize) {
+    (void)memorySize;
+    (void)threadPriority;
+    (void)cpuAffinityMask;
+    (void)threadStackSize;
+    std::lock_guard lock(signalingMutex);
+    if (initialized) return SCE_NP_SIGNALING_ERROR_ALREADY_INITIALIZED;
+    initialized = true;
     return 0;
 }
 
-int APS5_VABI sceNpSignalingGetConnectionInfo() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpSignalingInitialize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpSignalingSetContextOption() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSignalingSetContextOption(int ctxId, int optionId, int optionValue) {
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    Context* context = FindContext(ctxId);
+    if (!context) return SCE_NP_SIGNALING_ERROR_CTX_NOT_FOUND;
+    if (optionId != CONTEXT_OPTION_FLAG) return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    if (optionValue == 0) {
+        context->flags &= ~CONTEXT_FLAG_BIT;
+    } else if (optionValue == 1) {
+        context->flags |= CONTEXT_FLAG_BIT;
+    } else {
+        return SCE_NP_SIGNALING_ERROR_INVALID_ARGUMENT;
+    }
     return 0;
 }
 
 int APS5_VABI sceNpSignalingTerminate() {
-    NotImplemented_nid_no_patch(__func__);
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    initialized = false;
+    contexts.clear();
+    lastContextId = 0;
     return 0;
 }
 
-int APS5_VABI sceNpSignalingTerminateConnection() {
+int APS5_VABI sceNpSignalingTerminateConnection(int ctxId, int connId) {
+    (void)connId;
+    std::lock_guard lock(signalingMutex);
+    if (!initialized) return SCE_NP_SIGNALING_ERROR_NOT_INITIALIZED;
+    if (!FindContext(ctxId)) return SCE_NP_SIGNALING_ERROR_CTX_NOT_FOUND;
+    return SCE_NP_SIGNALING_ERROR_CONN_NOT_FOUND;
+}
+
+int APS5_VABI sceNpSignalingDeactivateConnection(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceNpSignaling/include/Api.hpp b/core/libs/prx/libSceNpSignaling/include/Api.hpp
new file mode 100644
index 0000000000..1488e7e3da
--- /dev/null
+++ b/core/libs/prx/libSceNpSignaling/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSignalingActivateConnection(int ctxId, const void* peerNpId, int* outConnId);
+int APS5_VABI sceNpSignalingCreateContext(const void* npId, void* callback, void* callbackArg, int* outContextId);
+int APS5_VABI sceNpSignalingDeleteContext(int ctxId);
+int APS5_VABI sceNpSignalingGetConnectionInfo(int ctxId, int connId, int infoCode, void* outInfo);
+int APS5_VABI sceNpSignalingInitialize(std::int64_t memorySize, int threadPriority, int cpuAffinityMask, std::int64_t threadStackSize);
+int APS5_VABI sceNpSignalingSetContextOption(int ctxId, int optionId, int optionValue);
+int APS5_VABI sceNpSignalingTerminate();
+int APS5_VABI sceNpSignalingTerminateConnection(int ctxId, int connId);
+int APS5_VABI sceNpSignalingDeactivateConnection(void);
+
+}
diff --git a/core/libs/prx/libSceNpSignaling/libSceNpSignaling.hpp b/core/libs/prx/libSceNpSignaling/libSceNpSignaling.hpp
new file mode 100644
index 0000000000..4ab0459137
--- /dev/null
+++ b/core/libs/prx/libSceNpSignaling/libSceNpSignaling.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSignaling/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSns/Export.cpp b/core/libs/prx/libSceNpSns/Export.cpp
index c6647c709c..8fe590490d 100644
--- a/core/libs/prx/libSceNpSns/Export.cpp
+++ b/core/libs/prx/libSceNpSns/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSns/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpSns/include/Api.hpp b/core/libs/prx/libSceNpSns/include/Api.hpp
new file mode 100644
index 0000000000..201afcfef4
--- /dev/null
+++ b/core/libs/prx/libSceNpSns/include/Api.hpp
@@ -0,0 +1,29 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSnsFacebookAbortRequest();
+int APS5_VABI sceNpSnsIntAbortRequest();
+int APS5_VABI sceNpSnsIntCreateRequest();
+int APS5_VABI sceNpSnsIntDeleteRequest();
+int APS5_VABI sceNpSnsIntFbGetGameAccessToken();
+int APS5_VABI sceNpSnsIntFbGetGameAccessTokenAllowed();
+int APS5_VABI sceNpSnsIntFbGetSystemAccessToken();
+int APS5_VABI sceNpSnsIntFbGetTitleInfo();
+int APS5_VABI sceNpSnsIntLinkedStatus();
+int APS5_VABI sceNpSnsIntTwGetSystemAccessToken();
+int APS5_VABI sceNpSnsIntUnlink();
+int APS5_VABI sceNpSnsIntYtGetAccessToken();
+int APS5_VABI sceNpSnsIntYtRefreshMasterToken();
+int APS5_VABI sceNpSnsTwitchAbortRequest();
+int APS5_VABI sceNpSnsTwitchCreateRequest();
+int APS5_VABI sceNpSnsTwitchDeleteRequest();
+int APS5_VABI sceNpSnsTwitchGetAccessToken();
+int APS5_VABI sceNpSnsYouTubeAbortRequest();
+int APS5_VABI sceNpSnsYouTubeCreateRequest();
+int APS5_VABI sceNpSnsYouTubeDeleteRequest();
+int APS5_VABI sceNpSnsYouTubeGetAccessToken();
+
+}
diff --git a/core/libs/prx/libSceNpSns/libSceNpSns.hpp b/core/libs/prx/libSceNpSns/libSceNpSns.hpp
new file mode 100644
index 0000000000..24cb3940ad
--- /dev/null
+++ b/core/libs/prx/libSceNpSns/libSceNpSns.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSns/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/CMakeLists.txt b/core/libs/prx/libSceNpSnsFacebookDialog/CMakeLists.txt
new file mode 100644
index 0000000000..5445d0dddd
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/CMakeLists.txt
@@ -0,0 +1,14 @@
+add_library(libSceNpSnsFacebookDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpSnsFacebookDialog PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpSnsFacebookDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_sns_facebook_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpSnsFacebookDialog.cpp)
+    target_include_directories(guest_np_sns_facebook_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_sns_facebook_dialog_tests PRIVATE libSceNpSnsFacebookDialog)
+    add_test(NAME guest_np_sns_facebook_dialog COMMAND guest_np_sns_facebook_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_np_sns_facebook_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpSnsFacebookDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp b/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp
index 9a4fe0e8cd..ebad76b2f2 100644
--- a/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp
@@ -1,42 +1,71 @@
-#include <cstddef>
+#include "prx/libSceNpSnsFacebookDialog/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
+#include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+std::atomic<int> g_status{COMMON_DIALOG_STATUS_NONE};
+
+}
+
 extern "C" {
 
-int APS5_VABI sceNpSnsFacebookDialogClose(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSnsFacebookDialogInitialize(void) {
+    int expected = COMMON_DIALOG_STATUS_NONE;
+    if (!g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_INITIALIZED)) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
     return 0;
 }
 
+int APS5_VABI sceNpSnsFacebookDialogOpen(const void* param) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
+    return 0;
+}
+
+int APS5_VABI sceNpSnsFacebookDialogUpdateStatus(void) {
+    return g_status.load();
+}
+
 int APS5_VABI sceNpSnsFacebookDialogGetStatus(void) {
-    NotImplemented_nid_no_patch(__func__);
+    return g_status.load();
+}
+
+int APS5_VABI sceNpSnsFacebookDialogGetResult(void* result) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (status != COMMON_DIALOG_STATUS_FINISHED) return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    const std::int32_t canceled = COMMON_DIALOG_RESULT_USER_CANCELED;
+    std::memcpy(result, &canceled, sizeof(canceled));
     return 0;
 }
 
-int APS5_VABI sceNpSnsFacebookDialogGetResult() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSnsFacebookDialogClose(void) {
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceNpSnsFacebookDialogInitialize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpSnsFacebookDialogOpen() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpSnsFacebookDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpSnsFacebookDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpSnsFacebookDialogTerminate(void) {
+    if (g_status.exchange(COMMON_DIALOG_STATUS_NONE) == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/include/Api.hpp b/core/libs/prx/libSceNpSnsFacebookDialog/include/Api.hpp
new file mode 100644
index 0000000000..e201d488c8
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSnsFacebookDialogInitialize(void);
+int APS5_VABI sceNpSnsFacebookDialogOpen(const void* param);
+int APS5_VABI sceNpSnsFacebookDialogUpdateStatus(void);
+int APS5_VABI sceNpSnsFacebookDialogGetStatus(void);
+int APS5_VABI sceNpSnsFacebookDialogGetResult(void* result);
+int APS5_VABI sceNpSnsFacebookDialogClose(void);
+int APS5_VABI sceNpSnsFacebookDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceNpSnsFacebookDialog/libSceNpSnsFacebookDialog.hpp b/core/libs/prx/libSceNpSnsFacebookDialog/libSceNpSnsFacebookDialog.hpp
new file mode 100644
index 0000000000..0401a2b8be
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsFacebookDialog/libSceNpSnsFacebookDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSnsFacebookDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp b/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp
index e1b07d4bfc..8aacd8784b 100644
--- a/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp
+++ b/core/libs/prx/libSceNpSnsYouTubeDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSnsYouTubeDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpSnsYouTubeDialog/include/Api.hpp b/core/libs/prx/libSceNpSnsYouTubeDialog/include/Api.hpp
new file mode 100644
index 0000000000..f2283cb2cf
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsYouTubeDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpSnsYouTubeDialogClose();
+int APS5_VABI sceNpSnsYouTubeDialogGetResult();
+int APS5_VABI sceNpSnsYouTubeDialogGetStatus();
+int APS5_VABI sceNpSnsYouTubeDialogInitialize();
+int APS5_VABI sceNpSnsYouTubeDialogOpen();
+int APS5_VABI sceNpSnsYouTubeDialogTerminate();
+int APS5_VABI sceNpSnsYouTubeDialogUpdateStatus();
+
+}
diff --git a/core/libs/prx/libSceNpSnsYouTubeDialog/libSceNpSnsYouTubeDialog.hpp b/core/libs/prx/libSceNpSnsYouTubeDialog/libSceNpSnsYouTubeDialog.hpp
new file mode 100644
index 0000000000..138afadcec
--- /dev/null
+++ b/core/libs/prx/libSceNpSnsYouTubeDialog/libSceNpSnsYouTubeDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpSnsYouTubeDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpSpeechToText/libSceNpSpeechToText.hpp b/core/libs/prx/libSceNpSpeechToText/libSceNpSpeechToText.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNpSpeechToText/libSceNpSpeechToText.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNpTcs/Export.cpp b/core/libs/prx/libSceNpTcs/Export.cpp
index 483b8fa844..f496f8ffbf 100644
--- a/core/libs/prx/libSceNpTcs/Export.cpp
+++ b/core/libs/prx/libSceNpTcs/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTcs/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpTcs/include/Api.hpp b/core/libs/prx/libSceNpTcs/include/Api.hpp
new file mode 100644
index 0000000000..656b047bae
--- /dev/null
+++ b/core/libs/prx/libSceNpTcs/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpTcsIntDownloadData();
+int APS5_VABI sceNpTcsIntUploadDataToNewSlotAbort();
+int APS5_VABI sceNpTcsIntUploadDataToNewSlotBegin();
+
+}
diff --git a/core/libs/prx/libSceNpTcs/libSceNpTcs.hpp b/core/libs/prx/libSceNpTcs/libSceNpTcs.hpp
new file mode 100644
index 0000000000..cf84369ec2
--- /dev/null
+++ b/core/libs/prx/libSceNpTcs/libSceNpTcs.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTcs/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpTextToSpeech/libSceNpTextToSpeech.hpp b/core/libs/prx/libSceNpTextToSpeech/libSceNpTextToSpeech.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceNpTextToSpeech/libSceNpTextToSpeech.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceNpTrophy/Export.cpp b/core/libs/prx/libSceNpTrophy/Export.cpp
index aad30b5af0..80fa87ee3f 100644
--- a/core/libs/prx/libSceNpTrophy/Export.cpp
+++ b/core/libs/prx/libSceNpTrophy/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy/include/Api.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
@@ -30,14 +31,24 @@ constexpr int NP_TROPHY_ERROR_INVALID_TRP_FILE_FORMAT = static_cast<int>(0x80551
 constexpr int NP_TROPHY_ERROR_TROPHY_NOT_UNLOCKED = static_cast<int>(0x8055161au);
 constexpr int NP_TROPHY_ERROR_TITLE_CONF_NOT_INSTALLED = static_cast<int>(0x80551626u);
 constexpr int NP_TROPHY_INVALID_ID = -1;
-constexpr int NP_TROPHY_NUM_MAX = 128;
+
+constexpr int NP_TROPHY_GRADE_UNKNOWN = 0;
+constexpr int NP_TROPHY_BASE_GAME_GROUP_ID = -1;
 constexpr std::uint32_t TrpMagic = 0xdca24d00u;
 constexpr std::size_t TrpHeaderBytes = 0x60;
 constexpr std::size_t TrpEntryBytes = 0x40;
 
-struct TrophyFlagArray {
-    std::uint32_t bits[NP_TROPHY_NUM_MAX / 32];
-};
+static_assert(sizeof(GameDetails) == 0x4a0);
+
+static_assert(sizeof(GameData) == 0x20);
+
+static_assert(sizeof(GroupDetails) == 0x4a0);
+
+static_assert(sizeof(GroupData) == 0x28);
+
+static_assert(sizeof(TrophyDetails) == 0x498);
+
+static_assert(sizeof(TrophyData) == 0x18);
 
 struct TrpEntry {
     std::uint64_t offset;
@@ -114,6 +125,21 @@ int Lookup(int contextId, int handle, Context*& context) {
     return 0;
 }
 
+int Groups(const Context& context) {
+    int groups = 0;
+    for (int id = 0; id < NP_TROPHY_NUM_MAX; ++id) {
+        char icon[16];
+        std::snprintf(icon, sizeof(icon), "GR%03d.PNG", id);
+        if (!context.entries.contains(icon)) break;
+        groups = id + 1;
+    }
+    return groups;
+}
+
+std::uint32_t Progress(const Context& context) {
+    return context.trophies == 0 ? 0u : static_cast<std::uint32_t>(context.unlocked.size() * 100 / static_cast<std::size_t>(context.trophies));
+}
+
 int CopyIcon(const Context& context, const std::string& name, void* buffer, std::uint64_t* size) {
     const auto entry = context.entries.find(name);
     if (entry == context.entries.end()) return NP_TROPHY_ERROR_ICON_FILE_NOT_FOUND;
@@ -250,18 +276,71 @@ int APS5_VABI sceNpTrophyGetTrophyIcon(int contextId, int handle, int trophyId,
     return CopyIcon(*context, icon, buffer, size);
 }
 
-int APS5_VABI sceNpTrophyGetGameInfo() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpTrophyGetGameInfo(int contextId, int handle, GameDetails* details, GameData* data) {
+    if (!details && !data) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    if ((details && details->size != sizeof(GameDetails)) || (data && data->size != sizeof(GameData))) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(g_mutex);
+    Context* context = nullptr;
+    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
+    if (details) {
+        std::memset(reinterpret_cast<std::uint8_t*>(details) + sizeof(details->size), 0, sizeof(GameDetails) - sizeof(details->size));
+        details->numGroups = static_cast<std::uint32_t>(Groups(*context));
+        details->numTrophies = static_cast<std::uint32_t>(context->trophies);
+    }
+    if (data) {
+        std::memset(reinterpret_cast<std::uint8_t*>(data) + sizeof(data->size), 0, sizeof(GameData) - sizeof(data->size));
+        data->unlockedTrophies = static_cast<std::uint32_t>(context->unlocked.size());
+        data->progressPercentage = Progress(*context);
+    }
     return 0;
 }
 
-int APS5_VABI sceNpTrophyGetGroupInfo() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpTrophyGetGroupInfo(int contextId, int handle, int groupId, GroupDetails* details, GroupData* data) {
+    if (!details && !data) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    if ((details && details->size != sizeof(GroupDetails)) || (data && data->size != sizeof(GroupData))) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(g_mutex);
+    Context* context = nullptr;
+    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
+    if (groupId != NP_TROPHY_BASE_GAME_GROUP_ID) {
+        if (groupId < 0 || groupId >= Groups(*context)) return NP_TROPHY_ERROR_INVALID_GROUP_ID;
+        NotImplemented_nid_no_patch(__func__);
+    }
+    if (details) {
+        std::memset(reinterpret_cast<std::uint8_t*>(details) + sizeof(details->size), 0, sizeof(GroupDetails) - sizeof(details->size));
+        details->groupId = groupId;
+        details->numTrophies = static_cast<std::uint32_t>(context->trophies);
+    }
+    if (data) {
+        std::memset(reinterpret_cast<std::uint8_t*>(data) + sizeof(data->size), 0, sizeof(GroupData) - sizeof(data->size));
+        data->groupId = groupId;
+        data->unlockedTrophies = static_cast<std::uint32_t>(context->unlocked.size());
+        data->progressPercentage = Progress(*context);
+    }
     return 0;
 }
 
-int APS5_VABI sceNpTrophyGetTrophyInfo() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpTrophyGetTrophyInfo(int contextId, int handle, int trophyId, TrophyDetails* details, TrophyData* data) {
+    if (!details && !data) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    if ((details && details->size != sizeof(TrophyDetails)) || (data && data->size != sizeof(TrophyData))) return NP_TROPHY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(g_mutex);
+    Context* context = nullptr;
+    if (const int error = Lookup(contextId, handle, context)) return error;
+    if (!context->registered) return NP_TROPHY_ERROR_NOT_REGISTERED;
+    if (trophyId < 0 || trophyId >= context->trophies) return NP_TROPHY_ERROR_INVALID_TROPHY_ID;
+    if (Groups(*context) != 0) NotImplemented_nid_no_patch(__func__);
+    if (details) {
+        std::memset(reinterpret_cast<std::uint8_t*>(details) + sizeof(details->size), 0, sizeof(TrophyDetails) - sizeof(details->size));
+        details->trophyId = trophyId;
+        details->trophyGrade = NP_TROPHY_GRADE_UNKNOWN;
+        details->groupId = NP_TROPHY_BASE_GAME_GROUP_ID;
+    }
+    if (data) {
+        std::memset(reinterpret_cast<std::uint8_t*>(data) + sizeof(data->size), 0, sizeof(TrophyData) - sizeof(data->size));
+        data->trophyId = trophyId;
+        data->unlocked = context->unlocked.contains(trophyId);
+    }
     return 0;
 }
 
diff --git a/core/libs/prx/libSceNpTrophy/include/Api.hpp b/core/libs/prx/libSceNpTrophy/include/Api.hpp
new file mode 100644
index 0000000000..6360184288
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy/include/Api.hpp
@@ -0,0 +1,92 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+inline constexpr int NP_TROPHY_NUM_MAX = 128;
+
+struct GameData {
+    std::uint64_t size;
+    std::uint32_t unlockedTrophies;
+    std::uint32_t unlockedPlatinum;
+    std::uint32_t unlockedGold;
+    std::uint32_t unlockedSilver;
+    std::uint32_t unlockedBronze;
+    std::uint32_t progressPercentage;
+};
+
+struct GameDetails {
+    std::uint64_t size;
+    std::uint32_t numGroups;
+    std::uint32_t numTrophies;
+    std::uint32_t numPlatinum;
+    std::uint32_t numGold;
+    std::uint32_t numSilver;
+    std::uint32_t numBronze;
+    char title[128];
+    char description[1024];
+};
+
+struct GroupData {
+    std::uint64_t size;
+    std::int32_t groupId;
+    std::uint32_t unlockedTrophies;
+    std::uint32_t unlockedPlatinum;
+    std::uint32_t unlockedGold;
+    std::uint32_t unlockedSilver;
+    std::uint32_t unlockedBronze;
+    std::uint32_t progressPercentage;
+    std::uint8_t reserved[4];
+};
+
+struct GroupDetails {
+    std::uint64_t size;
+    std::int32_t groupId;
+    std::uint32_t numTrophies;
+    std::uint32_t numPlatinum;
+    std::uint32_t numGold;
+    std::uint32_t numSilver;
+    std::uint32_t numBronze;
+    char title[128];
+    char description[1024];
+};
+
+struct TrophyData {
+    std::uint64_t size;
+    std::int32_t trophyId;
+    bool unlocked;
+    std::uint8_t reserved[3];
+    std::uint64_t timestamp;
+};
+
+struct TrophyDetails {
+    std::uint64_t size;
+    std::int32_t trophyId;
+    std::int32_t trophyGrade;
+    std::int32_t groupId;
+    bool hidden;
+    std::uint8_t reserved[3];
+    char name[128];
+    char description[1024];
+};
+
+struct TrophyFlagArray {
+    std::uint32_t bits[NP_TROPHY_NUM_MAX / 32];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpTrophyCreateContext(int* context, int userId, std::uint32_t serviceLabel, std::uint64_t options);
+int APS5_VABI sceNpTrophyDestroyContext(int context);
+int APS5_VABI sceNpTrophyCreateHandle(int* handle);
+int APS5_VABI sceNpTrophyDestroyHandle(int handle);
+int APS5_VABI sceNpTrophyRegisterContext(int contextId, int handle, std::uint64_t options);
+int APS5_VABI sceNpTrophyGetTrophyUnlockState(int contextId, int handle, TrophyFlagArray* flags, std::uint32_t* count);
+int APS5_VABI sceNpTrophyUnlockTrophy(int contextId, int handle, int trophyId, int* platinumId);
+int APS5_VABI sceNpTrophyGetGameIcon(int contextId, int handle, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetGroupIcon(int contextId, int handle, int groupId, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetTrophyIcon(int contextId, int handle, int trophyId, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetGameInfo(int contextId, int handle, GameDetails* details, GameData* data);
+int APS5_VABI sceNpTrophyGetGroupInfo(int contextId, int handle, int groupId, GroupDetails* details, GroupData* data);
+int APS5_VABI sceNpTrophyGetTrophyInfo(int contextId, int handle, int trophyId, TrophyDetails* details, TrophyData* data);
+
+}
diff --git a/core/libs/prx/libSceNpTrophy/libSceNpTrophy.hpp b/core/libs/prx/libSceNpTrophy/libSceNpTrophy.hpp
new file mode 100644
index 0000000000..f808efbd11
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy/libSceNpTrophy.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTrophy/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpTrophy2/Export.cpp b/core/libs/prx/libSceNpTrophy2/Export.cpp
index 9befeb73c9..8a46b8a803 100644
--- a/core/libs/prx/libSceNpTrophy2/Export.cpp
+++ b/core/libs/prx/libSceNpTrophy2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpTrophy2/include/Api.hpp b/core/libs/prx/libSceNpTrophy2/include/Api.hpp
new file mode 100644
index 0000000000..052446ff82
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy2/include/Api.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpTrophy2SystemAbortHandle(void);
+int APS5_VABI sceNpTrophy2SystemBuildGroupIconUri(void);
+int APS5_VABI sceNpTrophy2SystemBuildRewardIconUri(void);
+int APS5_VABI sceNpTrophy2SystemBuildTrophyIconUri(void);
+int APS5_VABI sceNpTrophy2SystemCheckCallback(void);
+int APS5_VABI sceNpTrophy2SystemCheckNetSyncTitles(void);
+int APS5_VABI sceNpTrophy2SystemCreateContext(void);
+int APS5_VABI sceNpTrophy2SystemCreateHandle(void);
+int APS5_VABI sceNpTrophy2SystemDebugLockTrophy(void);
+int APS5_VABI sceNpTrophy2SystemDebugUnlockTrophy(void);
+int APS5_VABI sceNpTrophy2SystemDestroyContext(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyDetails(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyGroupConf(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophySetArray(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyTitleConf(void);
+int APS5_VABI sceNpTrophy2SystemGetTrophyTitleDetails(void);
+int APS5_VABI sceNpTrophy2SystemGetTrpIconByUri(void);
+int APS5_VABI sceNpTrophy2SystemIsServerAvailable(void);
+int APS5_VABI sceNpTrophy2SystemRegisterTitleSyncedCallback(void);
+int APS5_VABI sceNpTrophy2SystemRegisterTitleUpdateCallback(void);
+int APS5_VABI sceNpTrophy2SystemRemoveAll(void);
+int APS5_VABI sceNpTrophy2SystemRemoveTitleData(void);
+int APS5_VABI sceNpTrophy2SystemRemoveUserData(void);
+int APS5_VABI sceNpTrophy2CreateContext(int* context, int userId, uint32_t serviceLabel, uint64_t options);
+int APS5_VABI sceNpTrophy2DestroyContext(int context);
+int APS5_VABI sceNpTrophy2RegisterContext(int context, int handle, uint64_t options);
+int APS5_VABI sceNpTrophy2UnregisterUnlockCallback();
+int APS5_VABI sceNpTrophy2GetRewardIcon(int context, int handle, int rewardId, void* buffer, size_t* size);
+int APS5_VABI sceNpTrophy2ShowTrophyList(int context);
+int APS5_VABI sceNpTrophy2GetGameInfo(int context, int handle, NpTrophy2GameDetails* details, NpTrophy2GameData* data);
+int APS5_VABI sceNpTrophy2GetGameIcon(int context, int handle, void* buffer, size_t* size);
+int APS5_VABI sceNpTrophy2RegisterUnlockCallback(void* callback, void* userdata);
+int APS5_VABI sceNpTrophy2GetGroupInfo(int context, int handle, int groupId, NpTrophy2GroupDetails* details, NpTrophy2GroupData* data);
+int APS5_VABI sceNpTrophy2GetGroupInfoArray(int context, int handle, uint32_t offset, uint32_t limit, NpTrophy2GroupDetails* detailsArray, NpTrophy2GroupData* dataArray, uint32_t* count);
+int APS5_VABI sceNpTrophy2GetGroupIcon(int context, int handle, int groupId, void* buffer, size_t* size);
+int APS5_VABI sceNpTrophy2CreateHandle(int* handle);
+int APS5_VABI sceNpTrophy2DestroyHandle(int handle);
+int APS5_VABI sceNpTrophy2AbortHandle(int handle);
+int APS5_VABI sceNpTrophy2GetTrophyInfo(int context, int handle, int trophyId, NpTrophy2Details* details, NpTrophy2Data* data);
+int APS5_VABI sceNpTrophy2GetTrophyInfoArray(int context, int handle, uint32_t offset, uint32_t limit, NpTrophy2Details* detailsArray, NpTrophy2Data* dataArray, uint32_t* count);
+int APS5_VABI sceNpTrophy2GetTrophyIcon(int context, int handle, int trophyId, void* buffer, size_t* size);
+
+}
diff --git a/core/libs/prx/libSceNpTrophy2/include/NpTrophy2Constants.hpp b/core/libs/prx/libSceNpTrophy2/include/NpTrophy2Constants.hpp
index 6a853b4c28..58ec7f5e33 100644
--- a/core/libs/prx/libSceNpTrophy2/include/NpTrophy2Constants.hpp
+++ b/core/libs/prx/libSceNpTrophy2/include/NpTrophy2Constants.hpp
@@ -4,6 +4,7 @@
 #include <cstdint>
 
 static constexpr int SCE_NP_TROPHY2_OK = 0;
+static constexpr int SCE_NP_TROPHY2_ERROR_INVALID_TROPHY_ID = -2141898486;
 static constexpr int SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND = -2141898479;
 
 static constexpr int NP_TROPHY2_CONTEXT_DEFAULT = 1;
diff --git a/core/libs/prx/libSceNpTrophy2/libSceNpTrophy2.hpp b/core/libs/prx/libSceNpTrophy2/libSceNpTrophy2.hpp
new file mode 100644
index 0000000000..09c653d06d
--- /dev/null
+++ b/core/libs/prx/libSceNpTrophy2/libSceNpTrophy2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTrophy2/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpTrophy2/src/Context.cpp b/core/libs/prx/libSceNpTrophy2/src/Context.cpp
index ef3a23e905..8e623d8c36 100644
--- a/core/libs/prx/libSceNpTrophy2/src/Context.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/Context.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <map>
@@ -77,15 +78,15 @@ int APS5_VABI sceNpTrophy2UnregisterUnlockCallback() {
     return SCE_NP_TROPHY2_OK;
 }
 
-
 int APS5_VABI sceNpTrophy2GetRewardIcon(int context, int handle, int reward_id, void* buffer, size_t* size) {
     (void)context;
     (void)handle;
     (void)reward_id;
     (void)buffer;
-    (void)size;
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (size != nullptr) {
+        *size = NP_TROPHY2_ICON_SIZE_NONE;
+    }
+    return SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND;
 }
 
 int APS5_VABI sceNpTrophy2ShowTrophyList(int context) {
diff --git a/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp b/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp
index dc11f536ef..4e7c771003 100644
--- a/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <cstddef>
 #include <cstring>
 #include <optional>
diff --git a/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp b/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp
index 887423ddc8..d06dc60177 100644
--- a/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/GroupInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceNpTrophy2/src/Handle.cpp b/core/libs/prx/libSceNpTrophy2/src/Handle.cpp
index 3f65f5887e..64013be3d6 100644
--- a/core/libs/prx/libSceNpTrophy2/src/Handle.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/Handle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <stdexcept>
 #include <string>
 
diff --git a/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp b/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp
index ce29da1513..1cabae19e7 100644
--- a/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp
+++ b/core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -82,9 +83,7 @@ int APS5_VABI sceNpTrophy2GetTrophyInfo(int context, int handle, int trophy_id,
         return SCE_NP_TROPHY2_OK;
     }
     const auto trophy = package->trophies.find(trophy_id);
-    if (trophy == package->trophies.end()) {
-        throw std::invalid_argument(std::string(__func__) + ": trophy " + std::to_string(trophy_id) + " is not in " + NpTrophy2::PackagePath(owner->serviceLabel));
-    }
+    if (trophy == package->trophies.end()) return SCE_NP_TROPHY2_ERROR_INVALID_TROPHY_ID;
     if (details != nullptr) fillDetails(trophy->second, details);
     if (data != nullptr) fillData(*owner, trophy->second, data);
     return SCE_NP_TROPHY2_OK;
diff --git a/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp b/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp
index 10352c9edf..5a70852cc0 100644
--- a/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp
+++ b/core/libs/prx/libSceNpTrophy2/tests/TrophyStore.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 #include "prx/libSceNpTrophy2/include/TitleTrophies.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
@@ -23,14 +24,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2DestroyContext(int);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-int APS5_VABI sceNpTrophy2GetTrophyInfoArray(int, int, uint32_t, uint32_t, NpTrophy2Details*, NpTrophy2Data*, uint32_t*);
-}
-
 namespace {
 
 constexpr std::int32_t InitialUser = 0x10000000;
@@ -246,7 +239,6 @@ void testQueries() {
     check(sceNpTrophy2DestroyContext(context) == 0 && sceNpTrophy2DestroyContext(other) == 0, "contexts were not destroyed");
 }
 
-
 void testPostedUnlockRules() {
     std::filesystem::create_directories("app0/sce_sys/trophy2");
     std::filesystem::create_directories("app0/sce_sys/uds");
diff --git a/core/libs/prx/libSceNpTus/Export.cpp b/core/libs/prx/libSceNpTus/Export.cpp
index 21e0e3e7fa..6bf0782927 100644
--- a/core/libs/prx/libSceNpTus/Export.cpp
+++ b/core/libs/prx/libSceNpTus/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTus/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <mutex>
@@ -88,6 +89,16 @@ int Complete(int reqId, int asyncResult) {
     if (const int error = WaitOffline(reqId, &result)) return error;
     return result;
 }
+
+constexpr std::uint32_t INVALID_SERVICE_LABEL = 0xFFFFFFFF;
+
+int CreateTitleContext() {
+    std::lock_guard lock(tusMutex);
+    if (titleContexts.size() >= MAX_TITLE_CONTEXTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int contextId = nextTitleContext++;
+    titleContexts.insert(contextId);
+    return contextId;
+}
 }
 
 extern "C" {
@@ -95,11 +106,7 @@ extern "C" {
 int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId) {
     (void)serviceLabel;
     (void)userId;
-    std::lock_guard lock(tusMutex);
-    if (titleContexts.size() >= MAX_TITLE_CONTEXTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
-    const int contextId = nextTitleContext++;
-    titleContexts.insert(contextId);
-    return contextId;
+    return CreateTitleContext();
 }
 
 int APS5_VABI sceNpTusCreateRequest(int titleCtxId) {
@@ -177,14 +184,14 @@ int APS5_VABI sceNpTusSetThreadParam(void) {
     return 0;
 }
 
-int APS5_VABI sceNpTssCreateNpTitleCtx(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTssCreateNpTitleCtx(std::uint32_t serviceLabel, const NpId* npId) {
+    if (!npId) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (serviceLabel == INVALID_SERVICE_LABEL) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return CreateTitleContext();
 }
 
-int APS5_VABI sceNpTssCreateNpTitleCtxA(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTssCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId) {
+    return sceNpTusCreateNpTitleCtxA(serviceLabel, userId);
 }
 
 int APS5_VABI sceNpTusCreateTitleCtx(void) {
diff --git a/core/libs/prx/libSceNpTus/include/Api.hpp b/core/libs/prx/libSceNpTus/include/Api.hpp
new file mode 100644
index 0000000000..b4e6807d5e
--- /dev/null
+++ b/core/libs/prx/libSceNpTus/include/Api.hpp
@@ -0,0 +1,150 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
+int APS5_VABI sceNpTusCreateRequest(int titleCtxId);
+int APS5_VABI sceNpTusDeleteNpTitleCtx(int titleCtxId);
+int APS5_VABI sceNpTusDeleteRequest(int reqId);
+int APS5_VABI sceNpTusAbortRequest(int reqId);
+int APS5_VABI sceNpTusPollAsync(int reqId, int* result);
+int APS5_VABI sceNpTusGetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusSetThreadParam(void);
+int APS5_VABI sceNpTssCreateNpTitleCtx(std::uint32_t serviceLabel, const NpId* npId);
+int APS5_VABI sceNpTssCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
+int APS5_VABI sceNpTusCreateTitleCtx(void);
+int APS5_VABI sceNpTusSetTimeout(void);
+int APS5_VABI sceNpTusChangeModeForOtherSaveDataOwners(void);
+int APS5_VABI sceNpTusWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpTusGetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataVUser(void);
+int APS5_VABI sceNpTusDeleteMultiSlotDataVUserAsync(void);
+int APS5_VABI sceNpTssGetStorage(void);
+int APS5_VABI sceNpTssGetStorageAsync(void);
+int APS5_VABI sceNpTssGetDataAsync(void);
+int APS5_VABI sceNpTusGetDataForCrossSaveVUser(void);
+int APS5_VABI sceNpTusGetDataForCrossSaveVUserAsync(void);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(void);
+int APS5_VABI sceNpTusGetFriendsVariableA(void);
+int APS5_VABI sceNpTusGetFriendsVariableAAsync(void);
+int APS5_VABI sceNpTusGetFriendsVariableForCrossSave(void);
+int APS5_VABI sceNpTusGetFriendsVariableForCrossSaveAsync(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusA(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusAAsync(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusForCrossSave(void);
+int APS5_VABI sceNpTusGetFriendsDataStatusForCrossSaveAsync(void);
+int APS5_VABI sceNpTssGetSmallStorageAsync(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetFriendsDataStatusAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetFriendsVariableAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTssGetSmallStorage(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
+int APS5_VABI sceNpTusAddAndGetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusAddAndGetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotData(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusDeleteMultiSlotDataA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetFriendsDataStatus(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetFriendsVariable(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatus(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatus(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariable(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiUserVariableVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusTryAndSetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTusTryAndSetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
+int APS5_VABI sceNpTssGetData();
+int APS5_VABI sceNpTusCreateNpTitleCtx();
+int APS5_VABI sceNpTusGetData();
+int APS5_VABI sceNpTusGetDataVUser();
+int APS5_VABI sceNpTusGetMultiSlotVariable();
+int APS5_VABI sceNpTusGetMultiSlotVariableVUser();
+int APS5_VABI sceNpTusSetData();
+int APS5_VABI sceNpTusSetDataVUser();
+int APS5_VABI sceNpTusSetMultiSlotVariable();
+int APS5_VABI sceNpTusSetMultiSlotVariableVUser();
+
+}
diff --git a/core/libs/prx/libSceNpTus/libSceNpTus.hpp b/core/libs/prx/libSceNpTus/libSceNpTus.hpp
new file mode 100644
index 0000000000..5cf1eba7a1
--- /dev/null
+++ b/core/libs/prx/libSceNpTus/libSceNpTus.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpTus/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt b/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt
index d9163d1dc7..62016d6a55 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt
+++ b/core/libs/prx/libSceNpUniversalDataSystem/CMakeLists.txt
@@ -1,4 +1,5 @@
 add_library(libSceNpUniversalDataSystem SHARED EXCLUDE_FROM_ALL
+        ${CMAKE_CURRENT_SOURCE_DIR}/PendingExports.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/System.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/Context.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/Handle.cpp
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp b/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp
index 0231b0cf03..28b17e212b 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp b/core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp
new file mode 100644
index 0000000000..b19e95eb61
--- /dev/null
+++ b/core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp
@@ -0,0 +1,137 @@
+#include <cstdint>
+#include <cstddef>
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDeleteAllRecord() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntGetMemoryStat() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntPostRecordData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBinary() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBool() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetString() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordDataEstimateSize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetArray() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBinary() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBool() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetObject() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetString() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt32() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt64() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/include/Api.hpp b/core/libs/prx/libSceNpUniversalDataSystem/include/Api.hpp
new file mode 100644
index 0000000000..c0d1ad66ea
--- /dev/null
+++ b/core/libs/prx/libSceNpUniversalDataSystem/include/Api.hpp
@@ -0,0 +1,94 @@
+#pragma once
+
+#include "prx/libSceNpUniversalDataSystem/include/UdsEvent.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpUniversalDataSystemIntAbortHandle(void);
+int APS5_VABI sceNpUniversalDataSystemIntCheckNetSyncTitles(void);
+int APS5_VABI sceNpUniversalDataSystemIntCreateContext(void);
+int APS5_VABI sceNpUniversalDataSystemIntCreateHandle(void);
+int APS5_VABI sceNpUniversalDataSystemIntDeleteAllData(void);
+int APS5_VABI sceNpUniversalDataSystemIntDeleteUserDataWithServerData(void);
+int APS5_VABI sceNpUniversalDataSystemIntDestroyContext(void);
+int APS5_VABI sceNpUniversalDataSystemIntDestroyHandle(void);
+int APS5_VABI sceNpUniversalDataSystemIntInitialize(void);
+int APS5_VABI sceNpUniversalDataSystemIntNetSyncTitles(void);
+int APS5_VABI sceNpUniversalDataSystemIntTerminate(void);
+int APS5_VABI sceNpUniversalDataSystemCreateContext(int* context, int userId, uint32_t serviceLabel, uint64_t options);
+int APS5_VABI sceNpUniversalDataSystemDestroyContext(int context);
+int APS5_VABI sceNpUniversalDataSystemRegisterContext(int context, int handle, uint64_t options);
+int APS5_VABI sceNpUniversalDataSystemCreateEvent( const char* eventName, const NpUniversalDataSystemEventPropertyObject* prop, NpUniversalDataSystemEvent** newEvent, NpUniversalDataSystemEventPropertyObject** propPtr);
+int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent* event);
+int APS5_VABI sceNpUniversalDataSystemPostEvent(int context, int handle, const void* event, uint64_t options);
+int APS5_VABI sceNpUniversalDataSystemEventEstimateSize(const NpUniversalDataSystemEvent* event, size_t* size);
+int APS5_VABI sceNpUniversalDataSystemEventToString( const NpUniversalDataSystemEvent* event, char* buf, size_t bufSize, size_t* stringSize);
+int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyArray(NpUniversalDataSystemEventPropertyArray** newArray);
+int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyArray(NpUniversalDataSystemEventPropertyArray* array);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetString( NpUniversalDataSystemEventPropertyArray* array, const char* value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt32( NpUniversalDataSystemEventPropertyArray* array, int32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt32( NpUniversalDataSystemEventPropertyArray* array, uint32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt64( NpUniversalDataSystemEventPropertyArray* array, int64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt64( NpUniversalDataSystemEventPropertyArray* array, uint64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat32( NpUniversalDataSystemEventPropertyArray* array, float value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat64( NpUniversalDataSystemEventPropertyArray* array, double value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBool( NpUniversalDataSystemEventPropertyArray* array, bool value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBinary( NpUniversalDataSystemEventPropertyArray* array, const void* value, size_t valueSize);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetObject( NpUniversalDataSystemEventPropertyArray* array, const NpUniversalDataSystemEventPropertyObject* value, NpUniversalDataSystemEventPropertyObject** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetArray( NpUniversalDataSystemEventPropertyArray* array, const NpUniversalDataSystemEventPropertyArray* value, NpUniversalDataSystemEventPropertyArray** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject** newObject);
+int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject* object);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetString( NpUniversalDataSystemEventPropertyObject* object, const char* key, const char* value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32( NpUniversalDataSystemEventPropertyObject* object, const char* key, int32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt32( NpUniversalDataSystemEventPropertyObject* object, const char* key, uint32_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt64( NpUniversalDataSystemEventPropertyObject* object, const char* key, int64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt64( NpUniversalDataSystemEventPropertyObject* object, const char* key, uint64_t value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat32( NpUniversalDataSystemEventPropertyObject* object, const char* key, float value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat64( NpUniversalDataSystemEventPropertyObject* object, const char* key, double value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBool( NpUniversalDataSystemEventPropertyObject* object, const char* key, bool value);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBinary( NpUniversalDataSystemEventPropertyObject* object, const char* key, const void* value, size_t valueSize);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetObject( NpUniversalDataSystemEventPropertyObject* object, const char* key, const NpUniversalDataSystemEventPropertyObject* value, NpUniversalDataSystemEventPropertyObject** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetArray( NpUniversalDataSystemEventPropertyObject* object, const char* key, const NpUniversalDataSystemEventPropertyArray* value, NpUniversalDataSystemEventPropertyArray** valuePtr);
+int APS5_VABI sceNpUniversalDataSystemCreateHandle(int* handle);
+int APS5_VABI sceNpUniversalDataSystemDestroyHandle(int handle);
+int APS5_VABI sceNpUniversalDataSystemAbortHandle(int handle);
+int APS5_VABI sceNpUniversalDataSystemInitialize(const NpUniversalDataSystemInitParam* param);
+int APS5_VABI sceNpUniversalDataSystemTerminate(void);
+int APS5_VABI sceNpUniversalDataSystemGetMemoryStat(NpUniversalDataSystemMemoryStat* stat);
+int APS5_VABI sceNpUniversalDataSystemGetStorageStat(int context, NpUniversalDataSystemStorageStat* stat);
+
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordArray();
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordData();
+int APS5_VABI sceNpUniversalDataSystemIntCreateRecordObject();
+int APS5_VABI sceNpUniversalDataSystemIntDeleteAllRecord();
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordArray();
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordData();
+int APS5_VABI sceNpUniversalDataSystemIntDestroyRecordObject();
+int APS5_VABI sceNpUniversalDataSystemIntGetMemoryStat();
+int APS5_VABI sceNpUniversalDataSystemIntPostRecordData();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetArray();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBinary();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetBool();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetFloat64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetInt64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetObject();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetString();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordArraySetUInt64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordDataEstimateSize();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetArray();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBinary();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetBool();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetFloat64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetInt64();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetObject();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetString();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt32();
+int APS5_VABI sceNpUniversalDataSystemIntRecordObjectSetUInt64();
+
+}
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/libSceNpUniversalDataSystem.hpp b/core/libs/prx/libSceNpUniversalDataSystem/libSceNpUniversalDataSystem.hpp
new file mode 100644
index 0000000000..e72fd1c696
--- /dev/null
+++ b/core/libs/prx/libSceNpUniversalDataSystem/libSceNpUniversalDataSystem.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp
index f73c4a2cb2..e6f9c0a4c2 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/Context.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstdint>
 #include <map>
 #include <mutex>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp
index be7df0ae46..942a5f9450 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp
index 57e985ba8f..c7552e6a4b 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyArray.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <memory>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp
index d316c1ea30..20fd5f38e1 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/EventPropertyObject.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <memory>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp
index b2aa8ce9fd..331873010e 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/Handle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include "NpUniversalDataSystem.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp b/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp
index 92f91ceedf..6bc49f4f07 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/src/System.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include <cinttypes>
 #include <cstddef>
 #include <cstdint>
diff --git a/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp b/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp
index 73128d5ff0..992af0fe45 100644
--- a/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp
+++ b/core/libs/prx/libSceNpUniversalDataSystem/tests/Events.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
 #include "NpUniversalDataSystem.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -13,40 +14,6 @@
 #include <tuple>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemDestroyContext(int);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetString(NpUniversalDataSystemEventPropertyObject*, const char*, const char*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt32(NpUniversalDataSystemEventPropertyObject*, const char*, uint32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt64(NpUniversalDataSystemEventPropertyObject*, const char*, int64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt64(NpUniversalDataSystemEventPropertyObject*, const char*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat32(NpUniversalDataSystemEventPropertyObject*, const char*, float);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat64(NpUniversalDataSystemEventPropertyObject*, const char*, double);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBool(NpUniversalDataSystemEventPropertyObject*, const char*, bool);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetBinary(NpUniversalDataSystemEventPropertyObject*, const char*, const void*, size_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetObject(NpUniversalDataSystemEventPropertyObject*, const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetArray(NpUniversalDataSystemEventPropertyObject*, const char*, const NpUniversalDataSystemEventPropertyArray*, NpUniversalDataSystemEventPropertyArray**);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyArray(NpUniversalDataSystemEventPropertyArray**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyArray(NpUniversalDataSystemEventPropertyArray*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetString(NpUniversalDataSystemEventPropertyArray*, const char*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt32(NpUniversalDataSystemEventPropertyArray*, int32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt32(NpUniversalDataSystemEventPropertyArray*, uint32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetInt64(NpUniversalDataSystemEventPropertyArray*, int64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetUInt64(NpUniversalDataSystemEventPropertyArray*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat32(NpUniversalDataSystemEventPropertyArray*, float);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetFloat64(NpUniversalDataSystemEventPropertyArray*, double);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBool(NpUniversalDataSystemEventPropertyArray*, bool);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetBinary(NpUniversalDataSystemEventPropertyArray*, const void*, size_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetObject(NpUniversalDataSystemEventPropertyArray*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyArraySetArray(NpUniversalDataSystemEventPropertyArray*, const NpUniversalDataSystemEventPropertyArray*, NpUniversalDataSystemEventPropertyArray**);
-}
-
 namespace {
 
 constexpr int InitialUser = 0x10000000;
@@ -172,6 +139,7 @@ void testEvents() {
     check(throwsInvalidArgument([] {
         NpUniversalDataSystemEvent* unnamed = nullptr;
         sceNpUniversalDataSystemCreateEvent(nullptr, nullptr, &unnamed, nullptr);
+
     }), "an event without a name was created");
 }
 
diff --git a/core/libs/prx/libSceNpUtility/CMakeLists.txt b/core/libs/prx/libSceNpUtility/CMakeLists.txt
new file mode 100644
index 0000000000..982e5ab620
--- /dev/null
+++ b/core/libs/prx/libSceNpUtility/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceNpUtility SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceNpUtility PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceNpUtility)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_np_utility_offline_tests ${LIBS_INCLUDE_DIR}/tests/GuestNpUtilityOffline.cpp)
+    target_include_directories(guest_np_utility_offline_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_np_utility_offline_tests PRIVATE libSceNpUtility)
+    configure_windows_unwind(guest_np_utility_offline_tests)
+    add_test(NAME guest_np_utility_offline COMMAND guest_np_utility_offline_tests)
+    set_tests_properties(guest_np_utility_offline PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_np_utility_offline PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceNpUtility>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceNpUtility/Export.cpp b/core/libs/prx/libSceNpUtility/Export.cpp
index 2247cdf62b..7f5e3bbf94 100644
--- a/core/libs/prx/libSceNpUtility/Export.cpp
+++ b/core/libs/prx/libSceNpUtility/Export.cpp
@@ -1,10 +1,98 @@
+#include "prx/libSceNpUtility/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
+#include <mutex>
+#include <unordered_map>
+#include <unordered_set>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 static constexpr int SCE_NP_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550003);
 static constexpr int SCE_NP_ERROR_SIGNED_OUT = static_cast<int>(0x80550006);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80550704);
+static constexpr int SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS = static_cast<int>(0x80550706);
+static constexpr int SCE_NP_COMMUNITY_ERROR_ABORTED = static_cast<int>(0x80550707);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT = static_cast<int>(0x8055070C);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ID = static_cast<int>(0x8055070E);
+static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_TYPE = static_cast<int>(0x80550711);
+static constexpr int POLL_FINISHED = 0;
+static constexpr int POLL_RUNNING = 1;
+static constexpr std::size_t MAX_TITLE_CONTEXTS = 32;
+static constexpr std::size_t MAX_REQUESTS = 32;
+static constexpr int WORD_FILTER_TITLE_CTX_ID_OFFSET = 0x01000000;
+static constexpr int WORD_FILTER_REQUEST_ID_OFFSET = 0x02000000;
+static constexpr std::size_t WORD_FILTER_COMMENT_MAX_LENGTH = 0x400;
+static constexpr std::uint64_t WORD_FILTER_ASYNC_PARAMETER_SIZE = 0x18;
+
+namespace {
+struct Request {
+    int titleCtxId = 0;
+    bool async = false;
+    bool used = false;
+    bool aborted = false;
+    bool finished = false;
+    int result = 0;
+};
+
+struct Service {
+    Service(int firstTitleContext, int firstRequest) : nextTitleContext(firstTitleContext), nextRequest(firstRequest) {}
+    std::mutex mutex;
+    std::unordered_set<int> titleContexts;
+    std::unordered_map<int, Request> requests;
+    int nextTitleContext;
+    int nextRequest;
+};
+
+Service lookup(1, 1);
+Service wordFilter(WORD_FILTER_TITLE_CTX_ID_OFFSET + 1, WORD_FILTER_REQUEST_ID_OFFSET + 1);
+
+int CreateTitleContext(Service& service, const void* selfNpId) {
+    if (!selfNpId) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    std::lock_guard lock(service.mutex);
+    if (service.titleContexts.size() >= MAX_TITLE_CONTEXTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int titleCtxId = service.nextTitleContext++;
+    service.titleContexts.insert(titleCtxId);
+    return titleCtxId;
+}
+
+int DeleteTitleContext(Service& service, int titleCtxId) {
+    std::lock_guard lock(service.mutex);
+    if (!service.titleContexts.erase(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    std::erase_if(service.requests, [titleCtxId](const auto& entry) { return entry.second.titleCtxId == titleCtxId; });
+    return 0;
+}
+
+int CreateRequest(Service& service, int titleCtxId, bool async) {
+    std::lock_guard lock(service.mutex);
+    if (!service.titleContexts.contains(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (service.requests.size() >= MAX_REQUESTS) return SCE_NP_COMMUNITY_ERROR_TOO_MANY_OBJECTS;
+    const int reqId = service.nextRequest++;
+    service.requests.emplace(reqId, Request{titleCtxId, async});
+    return reqId;
+}
+
+int DeleteRequest(Service& service, int reqId) {
+    std::lock_guard lock(service.mutex);
+    return service.requests.erase(reqId) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+}
+
+int StartOffline(Service& service, int reqId) {
+    std::lock_guard lock(service.mutex);
+    const auto request = service.requests.find(reqId);
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (request->second.aborted) return SCE_NP_COMMUNITY_ERROR_ABORTED;
+    if (request->second.used) return SCE_NP_COMMUNITY_ERROR_INVALID_TYPE;
+    request->second.used = true;
+    request->second.finished = true;
+    request->second.result = SCE_NP_ERROR_SIGNED_OUT;
+    return request->second.async ? 0 : SCE_NP_ERROR_SIGNED_OUT;
+}
+
+int CheckComment(const char* comment) {
+    return strnlen(comment, WORD_FILTER_COMMENT_MAX_LENGTH + 1) > WORD_FILTER_COMMENT_MAX_LENGTH ? SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT : 0;
+}
+}
 
 extern "C" {
 
@@ -37,6 +125,310 @@ int APS5_VABI sceNpBandwidthTestShutdown(int context_id, void* result) {
     return SCE_NP_ERROR_INVALID_ARGUMENT;
 }
 
+int APS5_VABI sceNpAppInfoIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAll() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAllA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAll() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAllA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppInfoIntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdNum() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLink2IntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdNum() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpAppLaunchLinkIntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpBandwidthTestShutdownWithDetailedInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupCreateAsyncRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupCreateTitleCtxA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetCensorComment() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetConvertJidToNpId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetConvertNpIdToJid() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetCreateTitleCtx() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetDeleteRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetDeleteTitleCtx() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetInit() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetInitWithFunctionPointer() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetInitWithMemoryPool() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetIsInit() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetNpId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetSanitizeComment() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetSetTimeout() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupNetTerm() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupPollAsync() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupSetTimeout() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpLookupWaitAsync() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailabilityA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceChecker2IntIsSetServiceType() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntDestroyRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntGetAvailability() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntGetAvailabilityList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpServiceCheckerIntIsCached() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntAbortRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntCreateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntDeleteRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntGetInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpTitleMetadataIntGetNpTitleId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUtilityInit() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpUtilityTerm() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpWordFilterCreateTitleCtxA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpWordFilterSetTimeout() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceNpWordFilterWaitAsync() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 }
 
 extern "C" {
@@ -46,74 +438,83 @@ int APS5_VABI sceNpBandwidthTestInitStart() {
     return 0;
 }
 
-int APS5_VABI sceNpLookupCreateRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpLookupCreateRequest(int titleCtxId) {
+    return CreateRequest(lookup, titleCtxId, false);
+}
+
+int APS5_VABI sceNpLookupCreateTitleCtx(const void* selfNpId) {
+    return CreateTitleContext(lookup, selfNpId);
+}
+
+int APS5_VABI sceNpLookupDeleteRequest(int reqId) {
+    return DeleteRequest(lookup, reqId);
+}
+
+int APS5_VABI sceNpLookupDeleteTitleCtx(int titleCtxId) {
+    return DeleteTitleContext(lookup, titleCtxId);
+}
+
+int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId, void* option) {
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!onlineId || !npId) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    return StartOffline(lookup, reqId);
+}
+
+int APS5_VABI sceNpWordFilterAbortRequest(int reqId) {
+    std::lock_guard lock(wordFilter.mutex);
+    const auto request = wordFilter.requests.find(reqId);
+    if (request == wordFilter.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    request->second.aborted = true;
+    if (!request->second.finished) {
+        request->second.finished = true;
+        request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
+    }
     return 0;
 }
 
-int APS5_VABI sceNpLookupCreateTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void* option) {
+    if (!comment) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (const int error = CheckComment(comment)) return error;
+    return StartOffline(wordFilter, reqId);
 }
 
-int APS5_VABI sceNpLookupDeleteRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterCreateAsyncRequest(int titleCtxId, const std::uint64_t* param) {
+    if (!param || *param != WORD_FILTER_ASYNC_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return CreateRequest(wordFilter, titleCtxId, true);
 }
 
-int APS5_VABI sceNpLookupDeleteTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterCreateRequest(int titleCtxId) {
+    return CreateRequest(wordFilter, titleCtxId, false);
 }
 
-int APS5_VABI sceNpLookupNpId() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterCreateTitleCtx(const void* selfNpId) {
+    return CreateTitleContext(wordFilter, selfNpId);
 }
 
-int APS5_VABI sceNpWordFilterAbortRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterDeleteRequest(int reqId) {
+    return DeleteRequest(wordFilter, reqId);
 }
 
-int APS5_VABI sceNpWordFilterCensorComment() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId) {
+    return DeleteTitleContext(wordFilter, titleCtxId);
 }
 
-int APS5_VABI sceNpWordFilterCreateAsyncRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result) {
+    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(wordFilter.mutex);
+    const auto request = wordFilter.requests.find(reqId);
+    if (request == wordFilter.requests.end() || !request->second.async) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.finished) return POLL_RUNNING;
+    *result = request->second.result;
+    return POLL_FINISHED;
 }
 
-int APS5_VABI sceNpWordFilterCreateRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpWordFilterCreateTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpWordFilterDeleteRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpWordFilterDeleteTitleCtx() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpWordFilterPollAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceNpWordFilterSanitizeComment() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option) {
+    if (!comment || !sanitizedComment) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
+    if (option) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (const int error = CheckComment(comment)) return error;
+    return StartOffline(wordFilter, reqId);
 }
 
 }
diff --git a/core/libs/prx/libSceNpUtility/include/Api.hpp b/core/libs/prx/libSceNpUtility/include/Api.hpp
new file mode 100644
index 0000000000..73d099655b
--- /dev/null
+++ b/core/libs/prx/libSceNpUtility/include/Api.hpp
@@ -0,0 +1,105 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpBandwidthTestAbort(int contextId);
+int APS5_VABI sceNpBandwidthTestGetStatus(int contextId, int* status);
+int APS5_VABI sceNpBandwidthTestInitStartDownload(const void* param);
+int APS5_VABI sceNpBandwidthTestInitStartUpload(const void* param);
+int APS5_VABI sceNpBandwidthTestShutdown(int contextId, void* result);
+int APS5_VABI sceNpBandwidthTestInitStart();
+int APS5_VABI sceNpLookupCreateRequest(int titleCtxId);
+int APS5_VABI sceNpLookupCreateTitleCtx(const void* selfNpId);
+int APS5_VABI sceNpLookupDeleteRequest(int reqId);
+int APS5_VABI sceNpLookupDeleteTitleCtx(int titleCtxId);
+int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId, void* option);
+int APS5_VABI sceNpWordFilterAbortRequest(int reqId);
+int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void* option);
+int APS5_VABI sceNpWordFilterCreateAsyncRequest(int titleCtxId, const std::uint64_t* param);
+int APS5_VABI sceNpWordFilterCreateRequest(int titleCtxId);
+int APS5_VABI sceNpWordFilterCreateTitleCtx(const void* selfNpId);
+int APS5_VABI sceNpWordFilterDeleteRequest(int reqId);
+int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId);
+int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result);
+int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option);
+
+int APS5_VABI sceNpAppInfoIntAbortRequest();
+int APS5_VABI sceNpAppInfoIntCheckAvailability();
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityA();
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAll();
+int APS5_VABI sceNpAppInfoIntCheckAvailabilityAllA();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailability();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityA();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAll();
+int APS5_VABI sceNpAppInfoIntCheckServiceAvailabilityAllA();
+int APS5_VABI sceNpAppInfoIntCreateRequest();
+int APS5_VABI sceNpAppInfoIntDestroyRequest();
+int APS5_VABI sceNpAppInfoIntFinalize();
+int APS5_VABI sceNpAppInfoIntInitialize();
+int APS5_VABI sceNpAppLaunchLink2IntAbortRequest();
+int APS5_VABI sceNpAppLaunchLink2IntCreateRequest();
+int APS5_VABI sceNpAppLaunchLink2IntDestroyRequest();
+int APS5_VABI sceNpAppLaunchLink2IntFinalize();
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdList();
+int APS5_VABI sceNpAppLaunchLink2IntGetCompatibleTitleIdNum();
+int APS5_VABI sceNpAppLaunchLink2IntInitialize();
+int APS5_VABI sceNpAppLaunchLinkIntAbortRequest();
+int APS5_VABI sceNpAppLaunchLinkIntCreateRequest();
+int APS5_VABI sceNpAppLaunchLinkIntDestroyRequest();
+int APS5_VABI sceNpAppLaunchLinkIntFinalize();
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdList();
+int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdNum();
+int APS5_VABI sceNpAppLaunchLinkIntInitialize();
+int APS5_VABI sceNpBandwidthTestShutdownWithDetailedInfo();
+int APS5_VABI sceNpLookupAbortRequest();
+int APS5_VABI sceNpLookupCreateAsyncRequest();
+int APS5_VABI sceNpLookupCreateTitleCtxA();
+int APS5_VABI sceNpLookupNetAbortRequest();
+int APS5_VABI sceNpLookupNetCensorComment();
+int APS5_VABI sceNpLookupNetConvertJidToNpId();
+int APS5_VABI sceNpLookupNetConvertNpIdToJid();
+int APS5_VABI sceNpLookupNetCreateRequest();
+int APS5_VABI sceNpLookupNetCreateTitleCtx();
+int APS5_VABI sceNpLookupNetDeleteRequest();
+int APS5_VABI sceNpLookupNetDeleteTitleCtx();
+int APS5_VABI sceNpLookupNetInit();
+int APS5_VABI sceNpLookupNetInitWithFunctionPointer();
+int APS5_VABI sceNpLookupNetInitWithMemoryPool();
+int APS5_VABI sceNpLookupNetIsInit();
+int APS5_VABI sceNpLookupNetNpId();
+int APS5_VABI sceNpLookupNetSanitizeComment();
+int APS5_VABI sceNpLookupNetSetTimeout();
+int APS5_VABI sceNpLookupNetTerm();
+int APS5_VABI sceNpLookupPollAsync();
+int APS5_VABI sceNpLookupSetTimeout();
+int APS5_VABI sceNpLookupWaitAsync();
+int APS5_VABI sceNpServiceChecker2IntAbortRequest();
+int APS5_VABI sceNpServiceChecker2IntCreateRequest();
+int APS5_VABI sceNpServiceChecker2IntDestroyRequest();
+int APS5_VABI sceNpServiceChecker2IntFinalize();
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailability();
+int APS5_VABI sceNpServiceChecker2IntGetServiceAvailabilityA();
+int APS5_VABI sceNpServiceChecker2IntInitialize();
+int APS5_VABI sceNpServiceChecker2IntIsSetServiceType();
+int APS5_VABI sceNpServiceCheckerIntAbortRequest();
+int APS5_VABI sceNpServiceCheckerIntCreateRequest();
+int APS5_VABI sceNpServiceCheckerIntDestroyRequest();
+int APS5_VABI sceNpServiceCheckerIntFinalize();
+int APS5_VABI sceNpServiceCheckerIntGetAvailability();
+int APS5_VABI sceNpServiceCheckerIntGetAvailabilityList();
+int APS5_VABI sceNpServiceCheckerIntInitialize();
+int APS5_VABI sceNpServiceCheckerIntIsCached();
+int APS5_VABI sceNpTitleMetadataIntAbortRequest();
+int APS5_VABI sceNpTitleMetadataIntCreateRequest();
+int APS5_VABI sceNpTitleMetadataIntDeleteRequest();
+int APS5_VABI sceNpTitleMetadataIntGetInfo();
+int APS5_VABI sceNpTitleMetadataIntGetNpTitleId();
+int APS5_VABI sceNpUtilityInit();
+int APS5_VABI sceNpUtilityTerm();
+int APS5_VABI sceNpWordFilterCreateTitleCtxA();
+int APS5_VABI sceNpWordFilterSetTimeout();
+int APS5_VABI sceNpWordFilterWaitAsync();
+
+}
diff --git a/core/libs/prx/libSceNpUtility/libSceNpUtility.hpp b/core/libs/prx/libSceNpUtility/libSceNpUtility.hpp
new file mode 100644
index 0000000000..01af5539aa
--- /dev/null
+++ b/core/libs/prx/libSceNpUtility/libSceNpUtility.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpUtility/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpWebApi/Export.cpp b/core/libs/prx/libSceNpWebApi/Export.cpp
index 1aece4e185..c78414d680 100644
--- a/core/libs/prx/libSceNpWebApi/Export.cpp
+++ b/core/libs/prx/libSceNpWebApi/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpWebApi/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <cstddef>
diff --git a/core/libs/prx/libSceNpWebApi/include/Api.hpp b/core/libs/prx/libSceNpWebApi/include/Api.hpp
new file mode 100644
index 0000000000..567364a9bf
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi/include/Api.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceNpWebApiAbortRequest();
+int APS5_VABI sceNpWebApiCreateContext();
+int APS5_VABI sceNpWebApiCreateHandle(int libCtxId);
+int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterParam, std::size_t filterParamNum);
+int APS5_VABI sceNpWebApiCreateRequest();
+int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, std::uint32_t npServiceLabel, const void* filterParam, std::size_t filterParamNum);
+int APS5_VABI sceNpWebApiDeleteContext();
+int APS5_VABI sceNpWebApiDeleteHandle(int libCtxId, int handleId);
+int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId);
+int APS5_VABI sceNpWebApiDeleteRequest();
+int APS5_VABI sceNpWebApiDeleteServicePushEventFilter(int libCtxId, int filterId);
+int APS5_VABI sceNpWebApiGetHttpResponseHeaderValue();
+int APS5_VABI sceNpWebApiGetHttpResponseHeaderValueLength();
+int APS5_VABI sceNpWebApiGetHttpStatusCode();
+int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize);
+int APS5_VABI sceNpWebApiReadData();
+int APS5_VABI sceNpWebApiRegisterPushEventCallback();
+int APS5_VABI sceNpWebApiRegisterServicePushEventCallback();
+int APS5_VABI sceNpWebApiSendRequest();
+int APS5_VABI sceNpWebApiTerminate(int libCtxId);
+int APS5_VABI sceNpWebApiUnregisterPushEventCallback();
+int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback();
+int APS5_VABI sceNpWebApiUtilityParseNpId();
+
+}
diff --git a/core/libs/prx/libSceNpWebApi/libSceNpWebApi.hpp b/core/libs/prx/libSceNpWebApi/libSceNpWebApi.hpp
new file mode 100644
index 0000000000..3688862c87
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi/libSceNpWebApi.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpWebApi/include/Api.hpp"
diff --git a/core/libs/prx/libSceNpWebApi2/Export.cpp b/core/libs/prx/libSceNpWebApi2/Export.cpp
index daef37aa53..66a26fe70b 100644
--- a/core/libs/prx/libSceNpWebApi2/Export.cpp
+++ b/core/libs/prx/libSceNpWebApi2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpWebApi2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -15,19 +16,8 @@ static constexpr int SCE_NP_WEBAPI2_ERROR_INVALID_CONTEXT = static_cast<int>(0x8
 static constexpr int SCE_NP_WEBAPI2_ERROR_INVALID_HANDLE = static_cast<int>(0x8055340D);
 static std::atomic<int> g_nextHandle{1};
 
-struct NpWebApi2PushContextId {
-    char value[37];
-};
-
 static_assert(sizeof(NpWebApi2PushContextId) == 37);
 
-struct NpWebApi2MemoryPoolStats {
-    size_t pool_size;
-    size_t max_inuse_size;
-    size_t current_inuse_size;
-    int32_t reserved;
-};
-
 static_assert(sizeof(NpWebApi2MemoryPoolStats) == 32);
 
 static std::mutex g_poolsMutex;
diff --git a/core/libs/prx/libSceNpWebApi2/include/Api.hpp b/core/libs/prx/libSceNpWebApi2/include/Api.hpp
new file mode 100644
index 0000000000..c528b23c20
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi2/include/Api.hpp
@@ -0,0 +1,58 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct NpWebApi2MemoryPoolStats {
+    size_t pool_size;
+    size_t max_inuse_size;
+    size_t current_inuse_size;
+    int32_t reserved;
+};
+
+struct NpWebApi2PushContextId {
+    char value[37];
+};
+
+extern "C" {
+
+int APS5_VABI sceNpWebApi2AbortRequest(int64_t requestId);
+int APS5_VABI sceNpWebApi2AddHttpRequestHeader(int64_t requestId, const char* fieldName, const char* value);
+int APS5_VABI sceNpWebApi2AddWebTraceTag(std::int64_t requestId, const char* value);
+void APS5_VABI sceNpWebApi2CheckTimeout(void);
+int APS5_VABI sceNpWebApi2CreateRequest(int userContextId, const char* apiGroup, const char* path, const char* method, const void* contentParameter, int64_t* requestId);
+int APS5_VABI sceNpWebApi2CreateUserContext(int libCtxId, int userId);
+int APS5_VABI sceNpWebApi2DeleteRequest(int64_t requestId);
+int APS5_VABI sceNpWebApi2DeleteUserContext(int userContextId);
+int APS5_VABI sceNpWebApi2GetHttpResponseHeaderValue(int64_t requestId, const char* fieldName, char* value, size_t valueSize);
+int APS5_VABI sceNpWebApi2GetHttpResponseHeaderValueLength(int64_t requestId, const char* fieldName, size_t* valueLength);
+int APS5_VABI sceNpWebApi2Initialize(int libHttpCtxId, size_t poolSize);
+int APS5_VABI sceNpWebApi2GetMemoryPoolStats(int libraryContextId, NpWebApi2MemoryPoolStats* stats);
+int APS5_VABI sceNpWebApi2PushEventCreateFilter(int libCtxId, int handleId, const char* npServiceName, uint32_t npServiceLabel, const void* filterParam, size_t filterParamNum);
+int APS5_VABI sceNpWebApi2PushEventCreateHandle(int libraryContextId);
+int APS5_VABI sceNpWebApi2PushEventAbortHandle(int libraryContextId, int handleId);
+int APS5_VABI sceNpWebApi2PushEventDeleteHandle(int libraryContextId, int handleId);
+int APS5_VABI sceNpWebApi2PushEventDeletePushContext(int userContextId, const void* pushContextId);
+int APS5_VABI sceNpWebApi2PushEventRegisterCallback(int userContextId, int filterId, void* callback, void* userArg);
+int APS5_VABI sceNpWebApi2ReadData(int64_t requestId, void* data, size_t size);
+int APS5_VABI sceNpWebApi2SendRequest(int64_t requestId, const void* data, size_t dataSize, NpWebApi2ResponseInformationOption* responseInfoOption);
+int APS5_VABI sceNpWebApi2Terminate(int libCtxId);
+int APS5_VABI sceNpWebApi2PushEventCreatePushContext(std::int32_t userContextId, NpWebApi2PushContextId* pushContextId);
+int APS5_VABI sceNpWebApi2PushEventDeleteFilter(std::int32_t libraryContextId, std::int32_t filterId);
+int APS5_VABI sceNpWebApi2PushEventSetHandleTimeout(int libraryContextId, int handleId, std::uint32_t timeout);
+int APS5_VABI sceNpWebApi2PushEventRegisterPushContextCallback();
+int APS5_VABI sceNpWebApi2PushEventStartPushContextCallback(std::int32_t userContextId, const NpWebApi2PushContextId* pushContextId);
+int APS5_VABI sceNpWebApi2PushEventUnregisterCallback(std::int32_t userContextId, std::int32_t callbackId);
+int APS5_VABI sceNpWebApi2PushEventUnregisterPushContextCallback(std::int32_t userContextId, std::int32_t callbackId);
+int APS5_VABI sceNpWebApi2SetRequestTimeout(int64_t requestId, uint32_t timeout);
+int APS5_VABI sceNpWebApi2AddMultipartPart();
+int APS5_VABI sceNpWebApi2CreateMultipartRequest(int userCtxId, const char* apiGroup, const char* path, const char* method, int64_t* requestId);
+int APS5_VABI sceNpWebApi2InitializeForPresence(int libHttpCtxId, uint64_t poolSize);
+int APS5_VABI sceNpWebApi2IntCreateRequest();
+int APS5_VABI sceNpWebApi2IntInitialize(const NpWebApi2IntInitializeArgs* args);
+int APS5_VABI sceNpWebApi2IntInitialize2(const NpWebApi2IntInitialize2Args* args);
+int APS5_VABI sceNpWebApi2IntPushEventCreateCtxIndFilter();
+int APS5_VABI sceNpWebApi2IntPushEventCreateDestPs4CtxIndFilter();
+int APS5_VABI sceNpWebApi2SendMultipartRequest(int64_t requestId, int partIndex, void* data, uint64_t dataSize, void* respInfoOption);
+int APS5_VABI sceNpWebApi2SetMultipartContentType();
+
+}
diff --git a/core/libs/prx/libSceNpWebApi2/libSceNpWebApi2.hpp b/core/libs/prx/libSceNpWebApi2/libSceNpWebApi2.hpp
new file mode 100644
index 0000000000..6c299c3731
--- /dev/null
+++ b/core/libs/prx/libSceNpWebApi2/libSceNpWebApi2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceNpWebApi2/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusCeltDec/CMakeLists.txt b/core/libs/prx/libSceOpusCeltDec/CMakeLists.txt
index 32be01d2dd..38a71d09b5 100644
--- a/core/libs/prx/libSceOpusCeltDec/CMakeLists.txt
+++ b/core/libs/prx/libSceOpusCeltDec/CMakeLists.txt
@@ -1,12 +1,12 @@
 add_library(libSceOpusCeltDec SHARED EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp)
 target_include_directories(libSceOpusCeltDec PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(libSceOpusCeltDec PRIVATE ffmpeg)
+target_link_libraries(libSceOpusCeltDec PRIVATE opus)
 configure_windows_unwind(libSceOpusCeltDec)
 
 if(BUILD_TESTING)
     add_test_executable(guest_opus_celt_dec_tests ${LIBS_INCLUDE_DIR}/tests/GuestOpusCeltDec.cpp)
     target_include_directories(guest_opus_celt_dec_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_opus_celt_dec_tests PRIVATE libSceOpusCeltDec libc)
+    target_link_libraries(guest_opus_celt_dec_tests PRIVATE libSceOpusCeltDec libc opus)
     configure_windows_unwind(guest_opus_celt_dec_tests)
     add_test(NAME guest_opus_celt_dec COMMAND guest_opus_celt_dec_tests)
     if(WIN32)
diff --git a/core/libs/prx/libSceOpusCeltDec/Export.cpp b/core/libs/prx/libSceOpusCeltDec/Export.cpp
index 5f40c01b3c..41ef6ba1a0 100644
--- a/core/libs/prx/libSceOpusCeltDec/Export.cpp
+++ b/core/libs/prx/libSceOpusCeltDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceOpusCeltDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceOpusDec/include/OpusDecoder.hpp"
 #include <cstdint>
diff --git a/core/libs/prx/libSceOpusCeltDec/include/Api.hpp b/core/libs/prx/libSceOpusCeltDec/include/Api.hpp
new file mode 100644
index 0000000000..2cbb6f7599
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltDec/include/Api.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceOpusCeltDecInitialize(std::uint32_t* context);
+int APS5_VABI sceOpusCeltDecTerminate(const std::uint32_t* context);
+int APS5_VABI sceOpusCeltDecGetSize(int channels);
+int APS5_VABI sceOpusCeltDecCreateEx(const std::uint32_t* context, void* state, int sampleRate, int channels);
+int APS5_VABI sceOpusCeltDecDecode(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity);
+int APS5_VABI sceOpusCeltDecDestroy(void* state);
+int APS5_VABI sceOpusCeltDecCreate();
+int APS5_VABI sceOpusCeltDecCtl();
+int APS5_VABI sceOpusCeltDecDecodeFloat();
+int APS5_VABI sceOpusCeltDecDecodeFloatWithPriority();
+int APS5_VABI sceOpusCeltDecDecodeWithPriority();
+
+}
diff --git a/core/libs/prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp b/core/libs/prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp
new file mode 100644
index 0000000000..47b7b5511c
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltDec/libSceOpusCeltDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusCeltDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusCeltEnc/Export.cpp b/core/libs/prx/libSceOpusCeltEnc/Export.cpp
index bcbe6e9029..5f837e73e4 100644
--- a/core/libs/prx/libSceOpusCeltEnc/Export.cpp
+++ b/core/libs/prx/libSceOpusCeltEnc/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceOpusCeltEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct OpusCeltEncoder;
-
 extern "C" {
 
 int APS5_VABI sceOpusCeltEncCreate(OpusCeltEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application) {
diff --git a/core/libs/prx/libSceOpusCeltEnc/include/Api.hpp b/core/libs/prx/libSceOpusCeltEnc/include/Api.hpp
new file mode 100644
index 0000000000..5a38483d1d
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltEnc/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct OpusCeltEncoder;
+
+extern "C" {
+
+int APS5_VABI sceOpusCeltEncCreate(OpusCeltEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusCeltEncCreateEx(const std::uint32_t* contextId, OpusCeltEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusCeltEncCtl(OpusCeltEncoder* encoder, std::int32_t request, ...);
+int APS5_VABI sceOpusCeltEncDestroy(OpusCeltEncoder* encoder);
+int APS5_VABI sceOpusCeltEncEncode(OpusCeltEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusCeltEncEncodeFloat(OpusCeltEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusCeltEncEncodeFloatWithPriority(OpusCeltEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusCeltEncEncodeWithPriority(OpusCeltEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusCeltEncGetSize(std::int32_t channels);
+int APS5_VABI sceOpusCeltEncInitialize(std::uint32_t* contextId);
+int APS5_VABI sceOpusCeltEncTerminate(const std::uint32_t* contextId);
+
+}
diff --git a/core/libs/prx/libSceOpusCeltEnc/libSceOpusCeltEnc.hpp b/core/libs/prx/libSceOpusCeltEnc/libSceOpusCeltEnc.hpp
new file mode 100644
index 0000000000..9a54c5f490
--- /dev/null
+++ b/core/libs/prx/libSceOpusCeltEnc/libSceOpusCeltEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusCeltEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusDec/CMakeLists.txt b/core/libs/prx/libSceOpusDec/CMakeLists.txt
index 4179bce7ff..01bf008dd3 100644
--- a/core/libs/prx/libSceOpusDec/CMakeLists.txt
+++ b/core/libs/prx/libSceOpusDec/CMakeLists.txt
@@ -1,12 +1,12 @@
 add_library(libSceOpusDec SHARED EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp)
 target_include_directories(libSceOpusDec PRIVATE ${LIBS_INCLUDE_DIR})
-target_link_libraries(libSceOpusDec PRIVATE ffmpeg)
+target_link_libraries(libSceOpusDec PRIVATE opus)
 configure_windows_unwind(libSceOpusDec)
 
 if(BUILD_TESTING)
     add_test_executable(guest_opus_dec_tests ${LIBS_INCLUDE_DIR}/tests/GuestOpusDec.cpp)
     target_include_directories(guest_opus_dec_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_opus_dec_tests PRIVATE libSceOpusDec libc)
+    target_link_libraries(guest_opus_dec_tests PRIVATE libSceOpusDec libc opus)
     configure_windows_unwind(guest_opus_dec_tests)
     add_test(NAME guest_opus_dec COMMAND guest_opus_dec_tests)
     if(WIN32)
diff --git a/core/libs/prx/libSceOpusDec/Export.cpp b/core/libs/prx/libSceOpusDec/Export.cpp
index ebf78206f4..f190172797 100644
--- a/core/libs/prx/libSceOpusDec/Export.cpp
+++ b/core/libs/prx/libSceOpusDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceOpusDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceOpusDec/include/OpusDecoder.hpp"
 #include <cstdint>
diff --git a/core/libs/prx/libSceOpusDec/include/Api.hpp b/core/libs/prx/libSceOpusDec/include/Api.hpp
new file mode 100644
index 0000000000..3bf7ca2885
--- /dev/null
+++ b/core/libs/prx/libSceOpusDec/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceOpusDecInitialize(std::uint32_t* context);
+int APS5_VABI sceOpusDecTerminate(const std::uint32_t* context);
+int APS5_VABI sceOpusDecGetSize(int channels);
+int APS5_VABI sceOpusDecCreateEx(const std::uint32_t* context, void* state, int sampleRate, int channels);
+int APS5_VABI sceOpusDecDecode(void* state, const std::uint8_t* data, int bytes, std::int16_t* pcm, int capacity);
+int APS5_VABI sceOpusDecDestroy(void* state);
+int APS5_VABI sceOpusDecCancel();
+int APS5_VABI sceOpusDecCreate();
+int APS5_VABI sceOpusDecCtl();
+int APS5_VABI sceOpusDecDecodeFloat();
+int APS5_VABI sceOpusDecDecodeFloatWithPriority();
+int APS5_VABI sceOpusDecDecodeFloatWithPriorityAndTimeout();
+int APS5_VABI sceOpusDecDecodeWithPriority();
+int APS5_VABI sceOpusDecDecodeWithPriorityAndTimeout();
+
+}
diff --git a/core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp b/core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp
index fee4c48957..fa9cf66b31 100644
--- a/core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp
+++ b/core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp
@@ -1,12 +1,9 @@
 #ifndef CORE_LIBS_PRX_LIBSCEOPUSDEC_INCLUDE_OPUSDECODER_HPP
 #define CORE_LIBS_PRX_LIBSCEOPUSDEC_INCLUDE_OPUSDECODER_HPP
 
-#include <algorithm>
-#include <cmath>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
-#include <limits>
 #include <memory>
 #include <mutex>
 #include <stdexcept>
@@ -15,10 +12,7 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-#include <libavcodec/avcodec.h>
-#include <libswresample/swresample.h>
-}
+#include <opus.h>
 
 namespace {
 
@@ -65,20 +59,10 @@ public:
         decoder->context = *context;
         decoder->channels = channels;
         decoder->sampleRate = sampleRate;
-        const auto* codec = avcodec_find_decoder(AV_CODEC_ID_OPUS);
-        if (!codec) fail("FFmpeg Opus decoder unavailable");
-        decoder->codec = avcodec_alloc_context3(codec);
-        if (!decoder->codec) throw std::bad_alloc();
-        av_channel_layout_default(&decoder->codec->ch_layout, channels);
-        decoder->codec->sample_rate = 48000;
-        if (avcodec_open2(decoder->codec, codec, nullptr) < 0) fail("cannot open FFmpeg decoder");
-        if (sampleRate != 48000) {
-            AVChannelLayout layout{};
-            av_channel_layout_default(&layout, channels);
-            if (swr_alloc_set_opts2(&decoder->resampler, &layout, AV_SAMPLE_FMT_FLT, sampleRate, &layout, AV_SAMPLE_FMT_FLT, 48000, 0, nullptr) < 0 ||
-                swr_init(decoder->resampler) < 0)
-                fail("cannot open FFmpeg resampler");
-        }
+        int error = OPUS_OK;
+        decoder->codec.reset(opus_decoder_create(sampleRate, channels, &error));
+        if (error == OPUS_ALLOC_FAIL) throw std::bad_alloc();
+        if (!decoder->codec || error != OPUS_OK) fail("cannot create libopus decoder");
         decoders.emplace(state, std::move(decoder));
         return 0;
     }
@@ -92,49 +76,18 @@ public:
         std::lock_guard lock(mutex);
         const auto found = decoders.find(state);
         if (found == decoders.end()) return error(1);
-        if (bytes == 0 || bytes > std::numeric_limits<int>::max() - AV_INPUT_BUFFER_PADDING_SIZE) fail("packet loss concealment or oversized packet is not implemented");
+        if (bytes == 0) fail("packet loss concealment is not implemented");
         auto& decoder = *found->second;
         if (celtOnly && (data[0] >> 3) < 16) fail("SILK and hybrid packets are not implemented");
-        const int samples = packetSamples(data, bytes) / (48000 / decoder.sampleRate);
+        const int samples = opus_packet_get_nb_samples(data, bytes, decoder.sampleRate);
+        if (samples <= 0) fail("invalid packet duration");
         const int outputBytes = samples * decoder.channels * 2;
-        if (capacity / 2 * 2 < outputBytes) fail("PCM buffer is too small");
-        std::unique_ptr<AVPacket, void (*)(AVPacket*)> packet(av_packet_alloc(), [](AVPacket* p) { av_packet_free(&p); });
-        std::unique_ptr<AVFrame, void (*)(AVFrame*)> frame(av_frame_alloc(), [](AVFrame* f) { av_frame_free(&f); });
-        if (!packet || !frame || av_new_packet(packet.get(), bytes) < 0) throw std::bad_alloc();
-        std::memcpy(packet->data, data, bytes);
-        if (avcodec_send_packet(decoder.codec, packet.get()) < 0 || avcodec_receive_frame(decoder.codec, frame.get()) < 0)
-            fail("FFmpeg rejected the packet");
-        const auto format = static_cast<AVSampleFormat>(frame->format);
-        if (frame->ch_layout.nb_channels != decoder.channels || frame->sample_rate != 48000 ||
-            (format != AV_SAMPLE_FMT_FLTP && format != AV_SAMPLE_FMT_FLT))
-            fail("unexpected FFmpeg PCM format");
-        std::vector<float> decoded;
-        decoded.reserve(static_cast<std::size_t>(frame->nb_samples) * decoder.channels);
-        for (int sample = 0; sample < frame->nb_samples; ++sample) {
-            for (int channel = 0; channel < decoder.channels; ++channel) {
-                const auto* source = reinterpret_cast<const float*>(frame->extended_data[format == AV_SAMPLE_FMT_FLTP ? channel : 0]);
-                decoded.push_back(source[format == AV_SAMPLE_FMT_FLTP ? sample : sample * decoder.channels + channel]);
-            }
-        }
-        if (decoder.resampler) {
-            const int capacitySamples = swr_get_out_samples(decoder.resampler, frame->nb_samples);
-            if (capacitySamples < 0) fail("FFmpeg resampler rejected the frame");
-            std::vector<float> resampled(static_cast<std::size_t>(capacitySamples) * decoder.channels);
-            auto* output = reinterpret_cast<std::uint8_t*>(resampled.data());
-            const auto* input = reinterpret_cast<const std::uint8_t*>(decoded.data());
-            const int converted = swr_convert(decoder.resampler, &output, capacitySamples, &input, frame->nb_samples);
-            if (converted < 0) fail("FFmpeg resampler rejected the frame");
-            resampled.resize(static_cast<std::size_t>(converted) * decoder.channels);
-            decoded = std::move(resampled);
-        }
-        decoder.pending.insert(decoder.pending.end(), decoded.begin(), decoded.end());
-        const auto count = static_cast<std::size_t>(samples) * decoder.channels;
-        if (decoder.pending.size() < count) decoder.pending.insert(decoder.pending.begin(), count - decoder.pending.size(), 0.0f);
-        for (std::size_t index = 0; index < count; ++index) {
-            const auto converted = static_cast<std::int16_t>(std::lrint(std::clamp(decoder.pending[index] * 32768.0f, -32768.0f, 32767.0f)));
-            std::memcpy(reinterpret_cast<std::uint8_t*>(pcm) + index * 2, &converted, 2);
-        }
-        decoder.pending.erase(decoder.pending.begin(), decoder.pending.begin() + static_cast<std::ptrdiff_t>(count));
+        if (capacity < outputBytes) fail("PCM buffer is too small");
+        std::vector<std::int16_t> decoded(static_cast<std::size_t>(samples) * decoder.channels);
+        const int result = opus_decode(decoder.codec.get(), data, bytes, decoded.data(), samples, 0);
+        if (result < 0) fail("libopus rejected the packet");
+        if (result != samples) fail("unexpected libopus PCM duration");
+        std::memcpy(pcm, decoded.data(), static_cast<std::size_t>(outputBytes));
         return outputBytes;
     }
 
@@ -150,13 +103,7 @@ private:
         std::uint32_t context;
         int channels;
         int sampleRate;
-        AVCodecContext* codec = nullptr;
-        SwrContext* resampler = nullptr;
-        std::vector<float> pending;
-        ~Decoder() {
-            swr_free(&resampler);
-            avcodec_free_context(&codec);
-        }
+        std::unique_ptr<OpusDecoder, void (*)(OpusDecoder*)> codec{nullptr, opus_decoder_destroy};
     };
 
     const char* name;
@@ -173,23 +120,6 @@ private:
     [[noreturn]] void fail(const char* message) const {
         throw std::runtime_error(std::string(name) + ": " + message);
     }
-
-    int packetSamples(const std::uint8_t* packet, int size) const {
-        const unsigned config = packet[0] >> 3;
-        const int frameSamples = config < 12 ? ((config & 3) == 3 ? 2880 : 480 << (config & 3))
-                                : config < 16 ? 480 << (config & 1) : 120 << (config & 3);
-        int frames = 1;
-        switch (packet[0] & 3) {
-        case 1:
-        case 2: frames = 2; break;
-        case 3:
-            if (size < 2) fail("truncated packet frame count");
-            frames = packet[1] & 63;
-            break;
-        }
-        if (frames == 0 || frames * frameSamples > 5760) fail("invalid packet duration");
-        return frames * frameSamples;
-    }
 };
 
 } // namespace
diff --git a/core/libs/prx/libSceOpusDec/libSceOpusDec.hpp b/core/libs/prx/libSceOpusDec/libSceOpusDec.hpp
new file mode 100644
index 0000000000..fd17892819
--- /dev/null
+++ b/core/libs/prx/libSceOpusDec/libSceOpusDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceOpusSilkEnc/Export.cpp b/core/libs/prx/libSceOpusSilkEnc/Export.cpp
index 4e741a3bf9..71bb17fe68 100644
--- a/core/libs/prx/libSceOpusSilkEnc/Export.cpp
+++ b/core/libs/prx/libSceOpusSilkEnc/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceOpusSilkEnc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct OpusSilkEncoder;
-
 extern "C" {
 
 int APS5_VABI sceOpusSilkEncCancel(OpusSilkEncoder* encoder, std::uint32_t batchId) {
diff --git a/core/libs/prx/libSceOpusSilkEnc/include/Api.hpp b/core/libs/prx/libSceOpusSilkEnc/include/Api.hpp
new file mode 100644
index 0000000000..01202c6ad9
--- /dev/null
+++ b/core/libs/prx/libSceOpusSilkEnc/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct OpusSilkEncoder;
+
+extern "C" {
+
+int APS5_VABI sceOpusSilkEncCancel(OpusSilkEncoder* encoder, std::uint32_t batchId);
+int APS5_VABI sceOpusSilkEncCreate(OpusSilkEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusSilkEncCreateEx(const std::uint32_t* contextId, OpusSilkEncoder* encoder, std::int32_t sampleRate, std::int32_t channels, std::int32_t application);
+int APS5_VABI sceOpusSilkEncCtl(OpusSilkEncoder* encoder, std::int32_t request, ...);
+int APS5_VABI sceOpusSilkEncDestroy(OpusSilkEncoder* encoder);
+int APS5_VABI sceOpusSilkEncEncode(OpusSilkEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusSilkEncEncodeFloat(OpusSilkEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes);
+int APS5_VABI sceOpusSilkEncEncodeFloatWithPriority(OpusSilkEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusSilkEncEncodeFloatWithPriorityAndTimeout(OpusSilkEncoder* encoder, const float* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority, std::uint32_t timeout, std::uint32_t* batchId);
+int APS5_VABI sceOpusSilkEncEncodeWithPriority(OpusSilkEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority);
+int APS5_VABI sceOpusSilkEncEncodeWithPriorityAndTimeout(OpusSilkEncoder* encoder, const std::int16_t* samples, std::int32_t frameSize, std::uint8_t* data, std::int32_t maxDataBytes, std::uint32_t priority, std::uint32_t timeout, std::uint32_t* batchId);
+int APS5_VABI sceOpusSilkEncGetSize(std::int32_t channels);
+int APS5_VABI sceOpusSilkEncInitialize(std::uint32_t* contextId);
+int APS5_VABI sceOpusSilkEncTerminate(const std::uint32_t* contextId);
+
+}
diff --git a/core/libs/prx/libSceOpusSilkEnc/libSceOpusSilkEnc.hpp b/core/libs/prx/libSceOpusSilkEnc/libSceOpusSilkEnc.hpp
new file mode 100644
index 0000000000..c11f4f27cd
--- /dev/null
+++ b/core/libs/prx/libSceOpusSilkEnc/libSceOpusSilkEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceOpusSilkEnc/include/Api.hpp"
diff --git a/core/libs/prx/libSceOrbisCompat/libSceOrbisCompat.hpp b/core/libs/prx/libSceOrbisCompat/libSceOrbisCompat.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceOrbisCompat/libSceOrbisCompat.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePad/Export.cpp b/core/libs/prx/libScePad/Export.cpp
index 3a6f40f658..1a8ccb28a8 100644
--- a/core/libs/prx/libScePad/Export.cpp
+++ b/core/libs/prx/libScePad/Export.cpp
@@ -1,5 +1,6 @@
 #include <cstddef>
 #include <cstdint>
+#include <array>
 #include <atomic>
 #include <cstring>
 #include <stdexcept>
@@ -11,40 +12,6 @@
 #include "prx/libScePad/include/Pad.hpp"
 #include "prx/libScePad/include/PadState.hpp"
 
-struct PadStickTuningParameter;
-struct PadTriggerTuningParameter;
-struct PadHuntProfile;
-struct PadLeonardoProfile;
-struct PadProfileInfo;
-struct PadActiveProfileInfo;
-struct PadSavedSettingInfo;
-struct PadUsbDetectionState;
-struct PadVrUsbConnectionStatus;
-struct PadDeviceInfo;
-struct PadLicenseControllerInformation;
-struct PadRemoteSetting;
-struct PadVirtualTriggerSetting;
-struct PadProcessFocusParameter;
-struct PadDataExtended;
-struct PadVrControllerData {
-    std::uint32_t buttons;
-    std::uint8_t stick[2];
-    std::uint8_t unused6[2];
-    std::uint8_t triggers[2];
-    std::uint8_t unused10[2];
-    std::uint32_t touchButtons;
-    std::uint8_t touchValues[4];
-    float acceleration[3];
-    float angularVelocity[3];
-    float orientation[4];
-    std::uint8_t unused60[4];
-    std::uint8_t connected;
-    std::uint8_t connectedCount;
-    std::uint8_t unused66[6];
-    std::uint64_t timestamp;
-    std::uint8_t unused80[24];
-};
-
 static_assert(sizeof(PadVrControllerData) == 104);
 static_assert(offsetof(PadVrControllerData, triggers) == 8);
 static_assert(offsetof(PadVrControllerData, touchButtons) == 12);
@@ -53,51 +20,11 @@ static_assert(offsetof(PadVrControllerData, angularVelocity) == 32);
 static_assert(offsetof(PadVrControllerData, orientation) == 44);
 static_assert(offsetof(PadVrControllerData, connected) == 64);
 static_assert(offsetof(PadVrControllerData, timestamp) == 72);
-struct PadVrControllerDeviceInformation;
-struct PadVrTriggerEffect;
-struct PadVrTriggerEffects;
-struct PadTriggerEffectExtended;
-struct PadExtensionReport;
-struct PadExtensionUnitInfo;
-struct PadTriggerInternalState;
-struct PadTrackerData;
-struct PadBlasterTrackerData;
-struct PadAstonTrackerData;
-struct PadUiData;
-struct PadUiTuningData;
-struct PadLotusButtonData;
-struct PadVersionInfo;
-struct PadTelemetryInfo;
-struct PadPortInfo;
-struct PadVrControllerCombinedState;
-struct PadLeonardoData;
-struct PadLeonardoUniqueData;
-struct PadHistoryData;
-struct PadUpdateParameter;
-struct PadVirtualDeviceParameter;
-struct PadVirtualDeviceId;
-struct PadVirtualDeviceComponentInformation;
-
-struct PadVirtualTriggerInternalState {
-    std::uint32_t states[2];
-    std::uint8_t mode;
-    std::uint8_t flags[2];
-};
 
 static_assert(sizeof(PadVirtualTriggerInternalState) == 12);
 static_assert(offsetof(PadVirtualTriggerInternalState, mode) == 8);
 static_assert(offsetof(PadVirtualTriggerInternalState, flags) == 9);
 
-struct PadLightBarBlinkingParameter {
-    std::uint8_t values[3];
-};
-
-struct PadButtonRemappingInfo {
-    std::uint8_t mapping[14];
-    std::uint8_t reserved;
-    std::uint8_t mode;
-};
-
 static_assert(sizeof(PadLightBarBlinkingParameter) == 3);
 static_assert(sizeof(PadButtonRemappingInfo) == 16);
 static_assert(offsetof(PadButtonRemappingInfo, mode) == 15);
@@ -106,41 +33,89 @@ namespace {
 
 constexpr int PAD_ERROR_DEVICE_NOT_CONNECTED = static_cast<int>(0x80920007);
 constexpr int PAD_ERROR_DEVICE_NO_HANDLE = static_cast<int>(0x80920008);
+constexpr int PAD_ERROR_ALREADY_OPENED = static_cast<int>(0x80920004);
+constexpr int PAD_ERROR_UNKNOWN_USER = static_cast<int>(0x809b0081);
 
-bool g_opened = false;
+std::array<bool, PAD_MAX_CONTROLLERS> g_opened{false};
+std::array<bool, PAD_MAX_CONTROLLERS> g_everOpened{false};
+bool g_remoteOpened = false;
+std::array<int, PAD_SPECIAL_HANDLE_COUNT> g_specialUsers{};
 std::atomic_bool g_initialized{false};
 
+bool SpecialHandle(int handle) {
+    const int slot = handle - PAD_SPECIAL_HANDLE;
+    return slot >= 0 && slot < PAD_SPECIAL_HANDLE_COUNT && g_specialUsers[slot] != 0;
+}
+
+int SpecialHandleOf(int userId) {
+    for (int slot = 0; slot < PAD_SPECIAL_HANDLE_COUNT; ++slot) {
+        if (g_specialUsers[slot] == userId) return PAD_SPECIAL_HANDLE + slot;
+    }
+    return PAD_ERROR_DEVICE_NO_HANDLE;
+}
+
+int PortOf(int handle) {
+    const int port = handle - PAD_HANDLE_BASE;
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS || !g_everOpened[port]) return -1;
+    return port;
+}
+
+bool KnownHandle(int handle) {
+    return PortOf(handle) >= 0 || SpecialHandle(handle);
+}
+
+PadData SpecialData() {
+    PadData data{};
+    data.left_stick_x = data.left_stick_y = data.right_stick_x = data.right_stick_y = 0x80;
+    data.orientation_w = 1.0f;
+    data.acceleration_y = 1.0f;
+    return data;
+}
+
+bool SystemRemote(int userId, int type) {
+    return userId == PAD_USER_ID_SYSTEM && type == PAD_PORT_TYPE_REMOTE;
+}
+
+bool RemoteHandle(int handle) {
+    return g_remoteOpened && handle == PAD_REMOTE_HANDLE;
+}
+
+int PortForUser(int userId, int type, int index) {
+    if (index != 0) return -1;
+    if (type == PAD_PORT_TYPE_STANDARD) {
+        const int port = userId - 0x10000000;
+        if (port >= 0 && port < PAD_MAX_CONTROLLERS) return port;
+    }
+    return -1;
+}
+
 bool ValidPort(int userId, int type, int index) {
-    const bool personalPort = type == PAD_PORT_TYPE_STANDARD || type == PAD_PORT_TYPE_SPECIAL;
-    const bool systemRemote = userId == PAD_USER_ID_SYSTEM && type == PAD_PORT_TYPE_REMOTE;
-    return index == 0 && (personalPort || systemRemote);
+    if (index != 0) return false;
+    if (type == PAD_PORT_TYPE_SPECIAL || SystemRemote(userId, type)) return true;
+    return PortForUser(userId, type, index) >= 0;
 }
 
 }
 
-struct PadUpdateData {
-    std::size_t size;
-    std::uint8_t data[32768];
-};
-
 static_assert(sizeof(PadUpdateData) == 32776);
 static_assert(offsetof(PadUpdateData, data) == 8);
 
-struct PadMotionSensorPosition {
-    float x;
-    float y;
-    float z;
-};
-
 static_assert(sizeof(PadMotionSensorPosition) == 12);
 
 extern "C" {
 
 int APS5_VABI scePadClose_nid_postfix(int handle) {
- if (handle != PAD_HANDLE) {
-  return PAD_ERROR_INVALID_HANDLE;
+ if (RemoteHandle(handle)) {
+  g_remoteOpened = false;
+  return PAD_OK;
  }
- g_opened = false;
+ if (SpecialHandle(handle)) {
+  g_specialUsers[handle - PAD_SPECIAL_HANDLE] = 0;
+  return PAD_OK;
+ }
+ const int port = PortOf(handle);
+ if (port < 0) return PAD_ERROR_INVALID_HANDLE;
+ g_opened[port] = false;
  return PAD_OK;
 }
 
@@ -160,35 +135,37 @@ int APS5_VABI scePadVrControllerReadCombinedState(std::int32_t leftHandle, std::
 }
 
 int APS5_VABI scePadDeviceClassGetExtendedInformation(int handle, PadDeviceClassExtendedInformation* info) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (info == nullptr) return PAD_ERROR_INVALID_ARG;
  std::memset(info, 0, sizeof(*info));
- info->deviceClass = PAD_DEVICE_CLASS_STANDARD;
+ info->deviceClass = SpecialHandle(handle) ? -1 : PAD_DEVICE_CLASS_STANDARD;
  return PAD_OK;
 }
 
 int APS5_VABI scePadDeviceClassParseData(int handle, const PadData* data, PadDeviceClassData* class_data) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (data == nullptr || class_data == nullptr) return PAD_ERROR_INVALID_ARG;
  std::memset(class_data, 0, sizeof(*class_data));
+ if (SpecialHandle(handle)) return PAD_OK;
  class_data->deviceClass = PAD_DEVICE_CLASS_STANDARD;
  class_data->dataValid = data->connected;
  return PAD_OK;
 }
 
 int APS5_VABI scePadGetControllerInformation(int handle, PadControllerInformation* info) {
- if (handle != PAD_HANDLE) {
+ if (!KnownHandle(handle)) {
   return PAD_ERROR_INVALID_HANDLE;
  }
  if (info == nullptr) {
   return PAD_ERROR_INVALID_ARG;
  }
  std::memset(info, 0, sizeof(*info));
+ if (SpecialHandle(handle)) return PAD_OK;
  info->touchPadInfo.pixelDensity = 44.86f;
  info->touchPadInfo.resolution.x = kTouchPadWidth;
  info->touchPadInfo.resolution.y = kTouchPadHeight;
- info->stickInfo.deadZoneLeft = 2;
- info->stickInfo.deadZoneRight = 2;
+ info->stickInfo.deadZoneLeft = 13;
+ info->stickInfo.deadZoneRight = 13;
  info->connectionType = PAD_CONNECTION_TYPE_LOCAL;
  info->connectedCount = 1;
  info->connected = true;
@@ -197,42 +174,65 @@ int APS5_VABI scePadGetControllerInformation(int handle, PadControllerInformatio
 }
 
 int APS5_VABI scePadGetHandle(int user_id, int type, int index) {
- if (!g_opened || !ValidPort(user_id, type, index) || type == PAD_PORT_TYPE_SPECIAL) return PAD_ERROR_DEVICE_NO_HANDLE;
- return PAD_HANDLE;
+ if (!ValidPort(user_id, type, index)) return PAD_ERROR_DEVICE_NO_HANDLE;
+ if (type == PAD_PORT_TYPE_SPECIAL) return SpecialHandleOf(user_id);
+ if (SystemRemote(user_id, type)) return g_remoteOpened ? PAD_REMOTE_HANDLE : PAD_ERROR_DEVICE_NO_HANDLE;
+ const int port = PortForUser(user_id, type, index);
+ if (port < 0 || !g_opened[port]) return PAD_ERROR_DEVICE_NO_HANDLE;
+ return PAD_HANDLE_BASE + port;
 }
 
 int APS5_VABI scePadGetInfo_nid_postfix(PadInfo* info) {
  if (info == nullptr) return PAD_ERROR_INVALID_ARG;
  std::memset(info, 0, sizeof(*info));
- info->maxConnectCount = 4;
- info->connectedCount[0] = 1;
+ info->maxConnectCount = PAD_MAX_CONTROLLERS;
+ std::uint8_t count = 0;
+ for (int port = 0; port < PAD_MAX_CONTROLLERS; ++port) {
+  if (Pad::IsConnected(port)) {
+   PadInfo::PadTypeInfo& slot = info->padTypeInfo[count];
+   slot.connectPort = static_cast<std::uint8_t>(port);
+   slot.status = 1;
+   slot.deviceType = PAD_DEVICE_TYPE_DUAL_SENSE;
+   slot.connectType = PAD_CONNECT_TYPE_BLUETOOTH;
+   std::uint8_t mac[6];
+   std::memcpy(mac, PAD_BD_ADDRESS, sizeof(mac));
+   mac[5] = static_cast<std::uint8_t>(mac[5] + port);
+   std::memcpy(slot.bluetoothMacAddress, mac, sizeof(slot.bluetoothMacAddress));
+   ++count;
+  }
+ }
+ if (count == 0) {
+  PadInfo::PadTypeInfo& slot = info->padTypeInfo[0];
+  slot.connectPort = 0;
+  slot.status = 1;
+  slot.deviceType = PAD_DEVICE_TYPE_DUAL_SENSE;
+  slot.connectType = PAD_CONNECT_TYPE_BLUETOOTH;
+  std::memcpy(slot.bluetoothMacAddress, PAD_BD_ADDRESS, sizeof(slot.bluetoothMacAddress));
+  count = 1;
+ }
+ info->connectedCount[0] = count;
  info->connectedCount[1] = 0;
- PadInfo::PadTypeInfo& slot = info->padTypeInfo[0];
- slot.connectPort = 0;
- slot.status = 1;
- slot.deviceType = PAD_DEVICE_TYPE_DUAL_SENSE;
- slot.connectType = PAD_CONNECT_TYPE_BLUETOOTH;
- std::memcpy(slot.bluetoothMacAddress, PAD_BD_ADDRESS, sizeof(slot.bluetoothMacAddress));
  return PAD_OK;
 }
 
 int APS5_VABI scePadGetTriggerEffectState(int handle, PadTriggerEffectStateInformation* info) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (info == nullptr) return PAD_ERROR_INVALID_ARG;
  std::memset(info, 0, sizeof(*info));
  return PAD_OK;
 }
 
 int APS5_VABI scePadGetExtControllerInformation(int handle, void* info) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (info == nullptr) return PAD_ERROR_INVALID_ARG;
  std::memset(info, 0, 0x2c);
+ if (SpecialHandle(handle)) return PAD_OK;
  PadControllerInformation* base = static_cast<PadControllerInformation*>(info);
  base->touchPadInfo.pixelDensity = 44.86f;
  base->touchPadInfo.resolution.x = kTouchPadWidth;
  base->touchPadInfo.resolution.y = kTouchPadHeight;
- base->stickInfo.deadZoneLeft = 2;
- base->stickInfo.deadZoneRight = 2;
+ base->stickInfo.deadZoneLeft = 13;
+ base->stickInfo.deadZoneRight = 13;
  base->connectionType = PAD_CONNECTION_TYPE_LOCAL;
  base->connectedCount = 1;
  base->connected = true;
@@ -261,9 +261,27 @@ int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void
  if (!ValidPort(userId, type, index)) {
   return PAD_ERROR_INVALID_ARG;
  }
- if (type == PAD_PORT_TYPE_SPECIAL) return PAD_ERROR_DEVICE_NOT_CONNECTED;
- g_opened = true;
- return PAD_HANDLE;
+ if (type == PAD_PORT_TYPE_SPECIAL) {
+  if (SpecialHandleOf(userId) != PAD_ERROR_DEVICE_NO_HANDLE) return PAD_ERROR_ALREADY_OPENED;
+  for (int slot = 0; slot < PAD_SPECIAL_HANDLE_COUNT; ++slot) {
+   if (g_specialUsers[slot] == 0) {
+    g_specialUsers[slot] = userId;
+    return PAD_SPECIAL_HANDLE + slot;
+   }
+  }
+  return PAD_ERROR_UNKNOWN_USER;
+ }
+ if (SystemRemote(userId, type)) {
+  g_remoteOpened = true;
+  return PAD_REMOTE_HANDLE;
+ }
+ const int port = PortForUser(userId, type, index);
+ if (port < 0) {
+  return PAD_ERROR_INVALID_ARG;
+ }
+ g_opened[port] = true;
+ g_everOpened[port] = true;
+ return PAD_HANDLE_BASE + port;
 }
 
 int APS5_VABI scePadOpenExt(int userId, int type, int index, const void* param) {
@@ -283,60 +301,75 @@ int APS5_VABI scePadSetFeatureReport(std::int32_t handle, std::uint8_t reportId,
 int APS5_VABI scePadOutputReport(std::int32_t handle, std::uint8_t reportId, const void* data, std::uint64_t size) { NotImplemented_nid_no_patch(__func__); return 0; }
 
 int APS5_VABI scePadRead_nid_postfix(int handle, PadData* data, int num) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle) && !RemoteHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (data == nullptr || num <= 0) return PAD_ERROR_INVALID_ARG;
- return Pad::Read(data, num);
+ if (RemoteHandle(handle)) {
+  data[0] = PadData{};
+  return 1;
+ }
+ if (SpecialHandle(handle)) {
+  data[0] = SpecialData();
+  return 1;
+ }
+ return Pad::Read(data, num, PortOf(handle));
 }
 
 int APS5_VABI scePadReadState(int handle, PadData* data) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle) && !RemoteHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (data == nullptr) return PAD_ERROR_INVALID_ARG;
 
- *data = Pad::ReadState();
+ *data = RemoteHandle(handle) ? PadData{} : SpecialHandle(handle) ? SpecialData() : Pad::ReadState(PortOf(handle));
 
  return 0;
 }
 
 int APS5_VABI scePadResetLightBar(int handle) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
- Pad::SetLightBar(false, 0, 0, 0);
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetLightBar(PortOf(handle), false, 0, 0, 0);
  return PAD_OK;
 }
 
 int APS5_VABI scePadResetOrientation(int handle) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
- Pad::ResetOrientation();
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::ResetOrientation(PortOf(handle));
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetAngularVelocityDeadbandState(int handle, bool enable) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
- Pad::SetAngularVelocityDeadband(enable);
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetAngularVelocityDeadband(PortOf(handle), enable);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetLightBar(int handle, const PadLightBarParam* param) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (param == nullptr) return PAD_ERROR_INVALID_ARG;
- Pad::SetLightBar(true, param->r, param->g, param->b);
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetLightBar(PortOf(handle), true, param->r, param->g, param->b);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetMotionSensorState(int handle, bool enable) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
- Pad::SetMotionEnabled(enable);
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetMotionEnabled(PortOf(handle), enable);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetTiltCorrectionState(int handle, bool enabled) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
- Pad::SetTiltCorrection(enabled);
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetTiltCorrection(PortOf(handle), enabled);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetTriggerEffect(int handle, const void* param) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (param == nullptr) return PAD_ERROR_INVALID_ARG;
+ if (SpecialHandle(handle)) return PAD_OK;
  const std::uint8_t* bytes = static_cast<const std::uint8_t*>(param);
  const std::uint8_t mask = bytes[0];
  if ((mask & ~0x3u) != 0) {
@@ -347,25 +380,28 @@ int APS5_VABI scePadSetTriggerEffect(int handle, const void* param) {
  if (mode[0] > 6 || mode[1] > 6) {
   return PAD_ERROR_INVALID_ARG;
  }
+ const int port = PortOf(handle);
  for (int trigger = 0; trigger < 2; ++trigger) {
-  if ((mask & (1u << trigger)) != 0) Pad::SetTriggerCommand(trigger, bytes + 8 + 56 * trigger);
+  if ((mask & (1u << trigger)) != 0) Pad::SetTriggerCommand(port, trigger, bytes + 8 + 56 * trigger);
  }
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetVibration(int handle, const PadVibrationParam* param) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (param == nullptr) return PAD_ERROR_INVALID_ARG;
- Pad::SetVibration(param->large_motor, param->small_motor);
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetVibration(PortOf(handle), param->large_motor, param->small_motor);
  return PAD_OK;
 }
 
 int APS5_VABI scePadSetVibrationMode(int handle, int mode) {
  if (!Pad::IsInitialized()) return PAD_ERROR_NOT_INITIALIZED;
  if (mode <= 0) return PAD_ERROR_INVALID_ARG;
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (mode > 3 && mode != 5) return PAD_ERROR_INVALID_ARG;
- Pad::SetVibrationMode(mode);
+ if (SpecialHandle(handle)) return PAD_OK;
+ Pad::SetVibrationMode(PortOf(handle), mode);
  return PAD_OK;
 }
 
@@ -407,15 +443,14 @@ int APS5_VABI scePadVrControllerSetTriggerEffects(std::int32_t leftHandle, std::
 }
 
 int APS5_VABI scePadIsRemoteController(int handle, bool* remote) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (remote == nullptr) return PAD_ERROR_INVALID_ARG;
  *remote = false;
  return 0;
 }
 
-
 int APS5_VABI scePadSetAngularVelocityBiasCorrectionState(int handle, bool enabled) {
- if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+ if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
  if (enabled) NotImplemented_nid_no_patch(__func__);
  return PAD_OK;
 }
@@ -433,7 +468,7 @@ int APS5_VABI scePadVrControllerGetTriggerEffectStates(std::int32_t leftHandle,
 int APS5_VABI scePadGetAccessibilityControllerState(int handle, std::uint32_t* state) {
     if (!Pad::IsInitialized()) return PAD_ERROR_NOT_INITIALIZED;
     if (state == nullptr) return PAD_ERROR_INVALID_ARG;
-    if (handle != PAD_HANDLE) return PAD_ERROR_INVALID_HANDLE;
+    if (!KnownHandle(handle)) return PAD_ERROR_INVALID_HANDLE;
     *state = 0;
     return PAD_OK;
 }
@@ -583,8 +618,11 @@ int APS5_VABI scePadGetVersionInfo(std::int32_t handle, PadVersionInfo* info) {
 }
 
 int APS5_VABI scePadGetControllerType(std::int32_t handle, std::int32_t* type) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (!Pad::IsInitialized()) return PAD_ERROR_NOT_INITIALIZED;
+    if (type == nullptr) return PAD_ERROR_INVALID_ARG;
+    if (PortOf(handle) < 0) return PAD_ERROR_INVALID_HANDLE;
+    *type = PAD_CONTROLLER_TYPE_DUAL_SENSE;
+    return PAD_OK;
 }
 
 int APS5_VABI scePadDisableDataConversion(std::int32_t handle, bool disabled) {
@@ -663,11 +701,13 @@ int APS5_VABI scePadGetLotusIrCodeSetResult(std::int32_t handle, std::int32_t* r
 }
 
 int APS5_VABI scePadSetLotusEnableIrKey(std::int32_t handle) {
+    (void)handle;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
 int APS5_VABI scePadSetLotusDisableIrKey(std::int32_t handle) {
+    (void)handle;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -923,18 +963,18 @@ bool APS5_VABI scePadIsValidHandle(std::int32_t handle, std::int32_t portType) {
 }
 
 bool APS5_VABI scePadIsDS4Connected(std::int32_t handle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)handle;
+    return false;
 }
 
 bool APS5_VABI scePadIsBlasterConnected(std::int32_t handle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)handle;
+    return false;
 }
 
 bool APS5_VABI scePadIsMoveConnected(std::int32_t handle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    (void)handle;
+    return false;
 }
 
 int APS5_VABI scePadGetBluetoothAddress(std::int32_t handle, std::uint64_t* address) {
@@ -1018,6 +1058,8 @@ int APS5_VABI scePadVirtualDeviceInsertTriggerInternalState(std::int32_t deviceI
 }
 
 int APS5_VABI scePadVirtualDeviceGetRemoteSetting(std::int32_t deviceId, PadRemoteSetting* setting) {
+    (void)deviceId;
+    (void)setting;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -1028,6 +1070,7 @@ int APS5_VABI scePadVirtualDeviceSetTriggerEffectSetting(std::int32_t handle, co
 }
 
 int APS5_VABI scePadVirtualDeviceDisableButtonRemapping(bool disabled) {
+    (void)disabled;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libScePad/include/Pad.hpp b/core/libs/prx/libScePad/include/Pad.hpp
index 8a4a7406a5..a80582b500 100644
--- a/core/libs/prx/libScePad/include/Pad.hpp
+++ b/core/libs/prx/libScePad/include/Pad.hpp
@@ -2,6 +2,7 @@
 #define CORE_LIBS_PRX_LIBSCEPAD_PAD_HPP
 
 #include <cstdint>
+#include "SceTypes.hpp"
 
 constexpr int PAD_OK = 0;
 constexpr int PAD_ERROR_INVALID_ARG = -2137915391;
@@ -12,7 +13,12 @@ constexpr int PAD_PORT_TYPE_STANDARD = 0;
 constexpr int PAD_PORT_TYPE_SPECIAL = 2;
 constexpr int PAD_PORT_TYPE_REMOTE = 16;
 constexpr int PAD_USER_ID_SYSTEM = 0xff;
+constexpr int PAD_MAX_CONTROLLERS = 4;
+constexpr int PAD_HANDLE_BASE = 1;
 constexpr int PAD_HANDLE = 1;
+constexpr int PAD_REMOTE_HANDLE = 0x10;
+constexpr int PAD_SPECIAL_HANDLE = 0x20;
+constexpr int PAD_SPECIAL_HANDLE_COUNT = 16;
 
 constexpr int PAD_CONNECTION_TYPE_LOCAL = 0;
 constexpr int PAD_DEVICE_CLASS_STANDARD = 0;
@@ -23,6 +29,8 @@ constexpr int PAD_DEVICE_TYPE_DUAL_SHOCK_4 = 2;
 constexpr int PAD_DEVICE_TYPE_DUAL_SENSE = 3;
 constexpr int PAD_DEVICE_TYPE_DUAL_SENSE_EDGE = 4;
 
+constexpr int PAD_CONTROLLER_TYPE_DUAL_SENSE = 2;
+
 constexpr int PAD_CONNECT_TYPE_UNREGISTERED = 0;
 constexpr int PAD_CONNECT_TYPE_USB = 1;
 constexpr int PAD_CONNECT_TYPE_BLUETOOTH = 2;
@@ -44,4 +52,288 @@ struct PadInfo {
 };
 static_assert(sizeof(PadInfo) == 0x59);
 
+struct PadStickTuningParameter;
+struct PadTriggerTuningParameter;
+struct PadHuntProfile;
+struct PadLeonardoProfile;
+struct PadProfileInfo;
+struct PadActiveProfileInfo;
+struct PadSavedSettingInfo;
+struct PadUsbDetectionState;
+struct PadVrUsbConnectionStatus;
+struct PadDeviceInfo;
+struct PadLicenseControllerInformation;
+struct PadRemoteSetting;
+struct PadVirtualTriggerSetting;
+struct PadProcessFocusParameter;
+struct PadDataExtended;
+
+struct PadVrControllerData {
+    std::uint32_t buttons;
+    std::uint8_t stick[2];
+    std::uint8_t unused6[2];
+    std::uint8_t triggers[2];
+    std::uint8_t unused10[2];
+    std::uint32_t touchButtons;
+    std::uint8_t touchValues[4];
+    float acceleration[3];
+    float angularVelocity[3];
+    float orientation[4];
+    std::uint8_t unused60[4];
+    std::uint8_t connected;
+    std::uint8_t connectedCount;
+    std::uint8_t unused66[6];
+    std::uint64_t timestamp;
+    std::uint8_t unused80[24];
+};
+
+struct PadVrControllerDeviceInformation;
+struct PadVrTriggerEffect;
+struct PadVrTriggerEffects;
+struct PadTriggerEffectExtended;
+struct PadExtensionReport;
+struct PadExtensionUnitInfo;
+struct PadTriggerInternalState;
+struct PadTrackerData;
+struct PadBlasterTrackerData;
+struct PadAstonTrackerData;
+struct PadUiData;
+struct PadUiTuningData;
+struct PadLotusButtonData;
+struct PadVersionInfo;
+struct PadTelemetryInfo;
+struct PadPortInfo;
+struct PadVrControllerCombinedState;
+struct PadLeonardoData;
+struct PadLeonardoUniqueData;
+struct PadHistoryData;
+struct PadUpdateParameter;
+struct PadVirtualDeviceParameter;
+struct PadVirtualDeviceId;
+struct PadVirtualDeviceComponentInformation;
+
+struct PadVirtualTriggerInternalState {
+    std::uint32_t states[2];
+    std::uint8_t mode;
+    std::uint8_t flags[2];
+};
+
+struct PadLightBarBlinkingParameter {
+    std::uint8_t values[3];
+};
+
+struct PadButtonRemappingInfo {
+    std::uint8_t mapping[14];
+    std::uint8_t reserved;
+    std::uint8_t mode;
+};
+
+struct PadUpdateData {
+    std::size_t size;
+    std::uint8_t data[32768];
+};
+
+struct PadMotionSensorPosition {
+    float x;
+    float y;
+    float z;
+};
+
+extern "C" {
+
+int APS5_VABI scePadClose_nid_postfix(int handle);
+int APS5_VABI scePadVrControllerSetVibration(std::int32_t handle, std::uint8_t intensity);
+int APS5_VABI scePadVrControllerSetVibrationMode(std::int32_t handle, std::uint32_t mode);
+int APS5_VABI scePadVrControllerReadCombinedState(std::int32_t leftHandle, std::int32_t rightHandle, PadVrControllerCombinedState* state);
+int APS5_VABI scePadDeviceClassGetExtendedInformation(int handle, PadDeviceClassExtendedInformation* info);
+int APS5_VABI scePadDeviceClassParseData(int handle, const PadData* data, PadDeviceClassData* classData);
+int APS5_VABI scePadGetControllerInformation(int handle, PadControllerInformation* info);
+int APS5_VABI scePadGetHandle(int userId, int type, int index);
+int APS5_VABI scePadGetInfo_nid_postfix(PadInfo* info);
+int APS5_VABI scePadGetTriggerEffectState(int handle, PadTriggerEffectStateInformation* info);
+int APS5_VABI scePadGetExtControllerInformation(int handle, void* info);
+int APS5_VABI scePadSetProcessPrivilege(int privilege);
+int APS5_VABI scePadSetParticularMode(bool mode);
+int APS5_VABI scePadInit_nid_postfix(void);
+int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void* param);
+int APS5_VABI scePadOpenExt(int userId, int type, int index, const void* param);
+int APS5_VABI scePadReadExt(std::int32_t handle, PadDataExtended* data, std::int32_t count);
+int APS5_VABI scePadGetFeatureReport(std::int32_t handle, std::uint8_t reportId, void* data, std::size_t size);
+int APS5_VABI scePadSetFeatureReport(std::int32_t handle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI scePadOutputReport(std::int32_t handle, std::uint8_t reportId, const void* data, std::uint64_t size);
+int APS5_VABI scePadRead_nid_postfix(int handle, PadData* data, int num);
+int APS5_VABI scePadReadState(int handle, PadData* data);
+int APS5_VABI scePadResetLightBar(int handle);
+int APS5_VABI scePadResetOrientation(int handle);
+int APS5_VABI scePadSetAngularVelocityDeadbandState(int handle, bool enable);
+int APS5_VABI scePadSetLightBar(int handle, const PadLightBarParam* param);
+int APS5_VABI scePadSetMotionSensorState(int handle, bool enable);
+int APS5_VABI scePadSetTiltCorrectionState(int handle, bool enabled);
+int APS5_VABI scePadSetTriggerEffect(int handle, const void* param);
+int APS5_VABI scePadSetVibration(int handle, const PadVibrationParam* param);
+int APS5_VABI scePadSetVibrationMode(int handle, int mode);
+int APS5_VABI scePadSetVibrationTriggerEffectWeakWhileEmbeddedMicInUse(bool enabled);
+int APS5_VABI scePadVrControllerGetDeviceInformation(std::int32_t handle, PadVrControllerDeviceInformation* info);
+int APS5_VABI scePadVrControllerRead(std::int32_t handle, PadVrControllerData* data, std::int32_t count);
+int APS5_VABI scePadVrControllerGetTriggerEffectState(std::int32_t leftHandle, std::int32_t rightHandle, PadTriggerEffectStateInformation* states);
+int APS5_VABI scePadVrControllerReadState(int handle, PadVrControllerData* state);
+int APS5_VABI scePadVrControllerSetTriggerEffect(std::int32_t handle, const PadVrTriggerEffect* effect);
+int APS5_VABI scePadVrControllerSetTriggerEffects(std::int32_t leftHandle, std::int32_t rightHandle, const PadVrTriggerEffects* effects);
+int APS5_VABI scePadIsRemoteController(int handle, bool* remote);
+int APS5_VABI scePadSetAngularVelocityBiasCorrectionState(int handle, bool enabled);
+int APS5_VABI scePadUnknown_n3kSX62fgNo();
+int APS5_VABI scePadVrControllerGetTriggerEffectStates(std::int32_t leftHandle, std::int32_t rightHandle, PadTriggerEffectStateInformation* states);
+int APS5_VABI scePadGetAccessibilityControllerState(int handle, std::uint32_t* state);
+int APS5_VABI scePadSetTriggerEffectExt(std::int32_t handle, const PadTriggerEffectExtended* effect);
+int APS5_VABI scePadLastLotusButtonData(std::int32_t handle, std::uint32_t parameter, PadLotusButtonData* data);
+int APS5_VABI scePadReadStateExt(std::int32_t handle, PadDataExtended* data);
+int APS5_VABI scePadSetExtensionReport(std::int32_t handle, const PadExtensionReport* report);
+int APS5_VABI scePadGetExtensionUnitInfo(std::int32_t handle, PadExtensionUnitInfo* info);
+int APS5_VABI scePadEnableExtensionPort(bool enabled);
+int APS5_VABI scePadEnableSpecificDeviceClass(std::int32_t deviceClass);
+int APS5_VABI scePadOpenExt2(std::uint64_t deviceId, std::int32_t type, const void* reserved);
+int APS5_VABI scePadDeviceOpen(std::uint64_t deviceId, std::int32_t type, std::int32_t index);
+int APS5_VABI scePadGetDataInternal(std::uint8_t port, PadData* data);
+int APS5_VABI scePadSetUserColor(std::int32_t handle, std::uint32_t color);
+int APS5_VABI scePadDisableVibration(std::int32_t handle, bool disabled);
+int APS5_VABI scePadSetVibrationStrength(std::int32_t handle, std::uint32_t strength);
+int APS5_VABI scePadSetLightBarBaseBrightness(std::int32_t handle, std::uint32_t brightness);
+int APS5_VABI scePadSetLightBarBlinking(std::int32_t handle, const PadLightBarBlinkingParameter* parameter);
+std::uint64_t APS5_VABI scePadGetIdleCount(std::int32_t userId);
+int APS5_VABI scePadGetControllerIdleCount(std::int32_t handle, std::uint64_t* count);
+int APS5_VABI scePadSetPowerSavingState(std::int32_t handle, std::uint8_t state);
+int APS5_VABI scePadSetAutoPowerOffCount(std::int32_t count);
+int APS5_VABI scePadEnableUsbConnection(bool enabled);
+int APS5_VABI scePadEnableAutoDetect(bool enabled);
+int APS5_VABI scePadEnablePlayPauseEmulation(bool enabled);
+int APS5_VABI scePadDisableTrackingLedBatterySaver(bool disabled);
+int APS5_VABI scePadSetLoginUserNumber(std::int32_t number);
+int APS5_VABI scePadGetCapability(std::int32_t deviceId, std::uint32_t* capability);
+int APS5_VABI scePadShareOutputData(std::int32_t source, std::int32_t destination);
+int APS5_VABI scePadShareOutputDataWithFunctionType(std::int32_t source, std::int32_t destination, std::uint32_t functionType);
+int APS5_VABI scePadSetVibrationForce(std::int32_t handle, const PadVibrationParam* param);
+int APS5_VABI scePadGetVersionInfo(std::int32_t handle, PadVersionInfo* info);
+int APS5_VABI scePadGetControllerType(std::int32_t handle, std::int32_t* type);
+int APS5_VABI scePadDisableDataConversion(std::int32_t handle, bool disabled);
+int APS5_VABI scePadSetButtonRemappingInfo(std::int32_t handle, const PadButtonRemappingInfo* info);
+int APS5_VABI scePadSetProcessPrivilegeOfButtonRemapping(bool enabled);
+int APS5_VABI scePadSetForceIntercepted(bool enabled);
+int APS5_VABI scePadIsLightBarBaseBrightnessControllable(std::int32_t handle);
+int APS5_VABI scePadSwitchConnection(std::int32_t handle, std::uint32_t flags);
+int APS5_VABI scePadDisableTriggerEffect(std::int32_t handle, bool disabled);
+int APS5_VABI scePadSetTriggerEffectStrength(std::int32_t handle, std::uint32_t strength);
+int APS5_VABI scePadGetTriggerEffectInternalState(std::int32_t handle, PadTriggerInternalState* state);
+int APS5_VABI scePadSetUserNumber(std::int32_t handle, std::int32_t number);
+int APS5_VABI scePadDisableTransportButtons(bool disabled);
+int APS5_VABI scePadSetLotusIrCodeSetStart(std::int32_t handle, std::uint8_t codeSet, std::uint16_t code, std::size_t dataSize);
+int APS5_VABI scePadSetLotusIrCodeSetData(std::int32_t handle, std::uint8_t packetIndex, const void* data, std::size_t dataSize);
+int APS5_VABI scePadSetLotusIrCodeSetEnd(std::int32_t handle);
+int APS5_VABI scePadGetLotusIrCodeSetResult(std::int32_t handle, std::int32_t* result, std::uint8_t* deviceResult);
+int APS5_VABI scePadSetLotusEnableIrKey(std::int32_t handle);
+int APS5_VABI scePadSetLotusDisableIrKey(std::int32_t handle);
+int APS5_VABI scePadGetUsbDetectionState(std::int32_t deviceId, PadUsbDetectionState* state);
+int APS5_VABI scePadUiReadState(std::int32_t handle, PadUiData* data);
+int APS5_VABI scePadUiReadStateForTuning(std::int32_t handle, PadUiTuningData* data);
+int APS5_VABI scePadSetStickTriggerTuningMode(std::int32_t handle, std::uint32_t mode);
+int APS5_VABI scePadSetStickTuningParam(std::int32_t handle, std::uint32_t stick, const PadStickTuningParameter* parameter);
+int APS5_VABI scePadSetTriggerTuningParam(std::int32_t handle, const PadTriggerTuningParameter* parameter);
+int APS5_VABI scePadGetProfileHunt(std::int32_t handle, std::int32_t profileId, PadHuntProfile* profile);
+int APS5_VABI scePadSetProfileHunt(std::int32_t handle, std::int32_t profileId, PadHuntProfile* profile, std::uint32_t* result);
+int APS5_VABI scePadResetHunt(std::int32_t handle);
+int APS5_VABI scePadGetProfileInfo(std::int32_t deviceId, std::int32_t profileId, PadProfileInfo* info);
+int APS5_VABI scePadGetActiveProfileInfo(std::int32_t handle, PadActiveProfileInfo* info);
+int APS5_VABI scePadDisableActiveProfileChange(std::int32_t handle, bool disabled);
+int APS5_VABI scePadDisableActiveProfileChangeByDeviceId(std::int32_t deviceId, bool disabled);
+int APS5_VABI scePadSetActiveProfileSlot(std::int32_t deviceId, std::uint32_t slot);
+int APS5_VABI scePadGetSavedSettingInfo(std::int32_t handle, PadSavedSettingInfo* info);
+int APS5_VABI scePadSetSavedSettingInfo(std::int32_t handle, const PadSavedSettingInfo* info);
+int APS5_VABI scePadVrControllerGetPhysicalUsbConnectionStatus(PadVrUsbConnectionStatus* status);
+int APS5_VABI scePadParseUniqueDataLeonardo(std::int32_t handle, const PadLeonardoData* data, PadLeonardoUniqueData* uniqueData);
+int APS5_VABI scePadGetControllerTypeLeonardo(std::int32_t deviceId, std::int32_t* controllerType);
+int APS5_VABI scePadSetControllerTypeLeonardo(std::int32_t deviceId, std::int32_t controllerType);
+int APS5_VABI scePadGetProfileLeonardo(std::int32_t handle, std::int32_t profileId, PadLeonardoProfile* profile);
+int APS5_VABI scePadSetProfileLeonardo(std::int32_t handle, std::int32_t profileId, PadLeonardoProfile* profile, std::uint32_t* result);
+int APS5_VABI scePadResetLeonardo(std::int32_t handle);
+int APS5_VABI scePadSetProfileEditMode(std::int32_t handle, bool enabled, std::uint32_t profile);
+int APS5_VABI scePadGetProfileEditMode(std::int32_t handle, std::int32_t* mode);
+int APS5_VABI scePadGetProfileEditModeLeonardo(std::int32_t handle);
+int APS5_VABI scePadSetSelectButtonCustomizeMode(std::int32_t handle, bool enabled);
+int APS5_VABI scePadGetSelectButtonCustomizeMode(std::int32_t handle);
+int APS5_VABI scePadSetToggleAllReleaseLeonardo(std::int32_t handle);
+int APS5_VABI scePadEnableControllerIndicator(std::int32_t handle);
+int APS5_VABI scePadEnableProfileIndicator(std::int32_t handle);
+int APS5_VABI scePadSetProfileIndicatorAnimation(std::int32_t handle, std::uint8_t animation);
+int APS5_VABI scePadIsCoPilot(std::int32_t handle);
+int APS5_VABI scePadSetIsCoPilot(std::int32_t handle, bool enabled);
+int APS5_VABI scePadRegisterCollaboInputMgrProcess(void);
+int APS5_VABI scePadGetTelemetryInfo(std::int32_t handle, PadTelemetryInfo* info);
+int APS5_VABI scePadGetActiveTime(std::int32_t handle, std::int32_t type, std::uint64_t* activeTime);
+int APS5_VABI scePadGetDeviceId(std::int32_t handle, std::int32_t* deviceId);
+int APS5_VABI scePadGetInfoByPortType(std::int32_t type, PadPortInfo* info);
+int APS5_VABI scePadResetLightBarAll(void);
+int APS5_VABI scePadResetLightBarAllByPortType(std::uint32_t portType);
+int APS5_VABI scePadSetLightBarForTracker(std::int32_t handle, const PadLightBarParam* color);
+int APS5_VABI scePadReadForTracker(std::int32_t handle, PadTrackerData* data, std::int32_t count);
+int APS5_VABI scePadReadBlasterForTracker(std::int32_t handle, PadBlasterTrackerData* data, std::int32_t count);
+int APS5_VABI scePadResetOrientationForTracker(std::int32_t handle);
+int APS5_VABI scePadGetMotionTimerUnit(std::int32_t handle, float* unit);
+int APS5_VABI scePadSetVrTrackingMode(std::uint8_t mode);
+int APS5_VABI scePadGetMotionSensorPosition(std::int32_t handle, PadMotionSensorPosition* position);
+int APS5_VABI scePadGetSphereRadius(std::int32_t handle, float* radius);
+bool APS5_VABI scePadIsValidHandle(std::int32_t handle, std::int32_t portType);
+bool APS5_VABI scePadIsDS4Connected(std::int32_t handle);
+bool APS5_VABI scePadIsBlasterConnected(std::int32_t handle);
+bool APS5_VABI scePadIsMoveConnected(std::int32_t handle);
+int APS5_VABI scePadGetBluetoothAddress(std::int32_t handle, std::uint64_t* address);
+int APS5_VABI scePadIsMoveReproductionModel(std::int32_t handle);
+int APS5_VABI scePadReadAstonForTracker(std::int32_t handle, PadAstonTrackerData* data, std::int32_t count);
+int APS5_VABI scePadGetAstonModel(std::int32_t handle);
+int APS5_VABI scePadMbusInit(void);
+int APS5_VABI scePadMbusTerm(void);
+int APS5_VABI scePadConnectPort(std::int32_t userId, std::int32_t portType);
+int APS5_VABI scePadDisconnectPort(std::int32_t userId, std::int32_t portType);
+int APS5_VABI scePadDisconnectDevice(std::int32_t deviceId);
+int APS5_VABI scePadGetDeviceInfo(std::int32_t deviceId, PadDeviceInfo* info);
+int APS5_VABI scePadSetProcessFocus(const PadProcessFocusParameter* parameter);
+int APS5_VABI scePadVertualDeviceAddDevice(const PadVirtualDeviceParameter* parameter, PadVirtualDeviceId* deviceId);
+int APS5_VABI scePadVirtualDeviceAddDevice(const PadVirtualDeviceParameter* parameter, PadVirtualDeviceId* deviceId);
+int APS5_VABI scePadVirtualDeviceDeleteDevice(std::int32_t deviceId);
+int APS5_VABI scePadVirtualDeviceInsertData(std::int32_t deviceId, const PadData* data);
+int APS5_VABI scePadVirtualDeviceInsertTriggerInternalState(std::int32_t deviceId, const PadVirtualTriggerInternalState* state);
+int APS5_VABI scePadVirtualDeviceGetRemoteSetting(std::int32_t deviceId, PadRemoteSetting* setting);
+int APS5_VABI scePadVirtualDeviceSetTriggerEffectSetting(std::int32_t handle, const PadVirtualTriggerSetting* setting);
+int APS5_VABI scePadVirtualDeviceDisableButtonRemapping(bool disabled);
+int APS5_VABI scePadSetShareButtonMaskForRemotePlay(std::uint8_t mask);
+int APS5_VABI scePadSetPS4BcVibrationMode(std::uint8_t mode);
+int APS5_VABI scePadSetVirtualDeviceComponentInformation(std::int32_t deviceId, const PadVirtualDeviceComponentInformation* info);
+int APS5_VABI scePadEnablePs4CompatibleMode(std::int32_t handle, bool enabled);
+int APS5_VABI scePadGetLicenseControllerInformation(std::int32_t handle, PadLicenseControllerInformation* info);
+int APS5_VABI scePadReadHistory(std::int32_t handle, PadHistoryData* data, std::int32_t count);
+int APS5_VABI scePadStartRecording(void);
+int APS5_VABI scePadStopRecording(void);
+int APS5_VABI scePadRemoteControlInsertData(const std::uint8_t* data);
+int APS5_VABI scePadRemoteControlInsertDataForAston(const std::uint8_t* data);
+int APS5_VABI scePadGetFeatureReport2(std::int32_t handle, std::uint8_t reportId, void* data, std::size_t size);
+int APS5_VABI scePadSetFeatureReport2(std::int32_t handle, std::uint8_t reportId, const void* data, std::size_t size);
+int APS5_VABI scePadSetMuteLed(std::int32_t handle, std::uint32_t mode);
+int APS5_VABI scePadBondUpdateInit(void);
+int APS5_VABI scePadBondUpdateIsReady(std::int32_t deviceId, std::int32_t* ready);
+int APS5_VABI scePadBondUpdateStart(std::int32_t handle, const PadUpdateParameter* parameter);
+int APS5_VABI scePadBondUpdateGetStatus(std::int32_t deviceId, std::int32_t* status);
+int APS5_VABI scePadBondUpdateSendData(std::int32_t deviceId, const PadUpdateData* data);
+int APS5_VABI scePadBondUpdateResetBond(std::int32_t deviceId);
+int APS5_VABI scePadBondUpdateGetReconnectStatus(std::int32_t* status);
+int APS5_VABI scePadBondUpdateTerm(void);
+int APS5_VABI scePadControllerUpdateInit(void);
+int APS5_VABI scePadControllerUpdateIsUpdateNeeded2(std::int32_t deviceId, const std::uint32_t* version, std::uint16_t* status);
+int APS5_VABI scePadControllerUpdateIsReady(std::int32_t deviceId, std::int32_t* ready);
+int APS5_VABI scePadControllerUpdateStart(std::int32_t handle, const PadUpdateParameter* parameter);
+int APS5_VABI scePadControllerUpdateGetStatus(std::int32_t deviceId, std::int32_t* status);
+int APS5_VABI scePadControllerUpdateSendData(std::int32_t deviceId, const PadUpdateData* data);
+int APS5_VABI scePadControllerUpdateResetController(std::int32_t deviceId);
+int APS5_VABI scePadControllerUpdateGetReconnectStatus(std::int32_t* status);
+int APS5_VABI scePadControllerUpdateTerm(void);
+
+}
+
 #endif
diff --git a/core/libs/prx/libScePad/include/PadState.hpp b/core/libs/prx/libScePad/include/PadState.hpp
index fb621171ee..aee2c05569 100644
--- a/core/libs/prx/libScePad/include/PadState.hpp
+++ b/core/libs/prx/libScePad/include/PadState.hpp
@@ -56,23 +56,36 @@ struct PadOutputState {
 namespace Pad {
 void Initialize();
 bool IsInitialized();
-PadData ReadState();
-int Read(PadData* data, int num);
+PadData ReadState(int port = 0);
+int Read(PadData* data, int num, int port = 0);
+void SetVibration(int port, std::uint8_t large, std::uint8_t small);
 void SetVibration(std::uint8_t large, std::uint8_t small);
+void SetVibrationMode(int port, int mode);
 void SetVibrationMode(int mode);
+void SetLightBar(int port, bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b);
 void SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b);
+void SetTriggerCommand(int port, int trigger, const std::uint8_t* command);
 void SetTriggerCommand(int trigger, const std::uint8_t* command);
-void ResetOrientation();
+void ResetOrientation(int port = 0);
+void SetMotionEnabled(int port, bool enabled);
 void SetMotionEnabled(bool enabled);
+void SetTiltCorrection(int port, bool enabled);
 void SetTiltCorrection(bool enabled);
+void SetAngularVelocityDeadband(int port, bool enabled);
 void SetAngularVelocityDeadband(bool enabled);
+void SetConnected(int port, bool connected);
+bool IsConnected(int port);
 }
 
 extern "C" void PadPublishInput_nid_postfix(const PadInputState& input);
+extern "C" void PadPublishInputForPort_nid_postfix(int port, const PadInputState& input);
 extern "C" void PadReportInputFailure_nid_postfix(std::exception_ptr error);
 extern "C" bool PadFetchOutput_nid_postfix(std::uint32_t* seenSequence, PadOutputState* out);
+extern "C" bool PadFetchOutputForPort_nid_postfix(int port, std::uint32_t* seenSequence, PadOutputState* out);
 extern "C" void PadSubmitAudioHaptics_nid_postfix(std::uint8_t large, std::uint8_t small);
 extern "C" void PadQueueLegacyAudioHaptics_nid_postfix(int source, std::uint64_t begin, std::uint64_t end, std::uint8_t large, std::uint8_t small);
 extern "C" void PadClearLegacyAudioHaptics_nid_postfix(int source);
+extern "C" void PadSubmitAudioHapticsForPort_nid_postfix(int port, std::uint8_t large, std::uint8_t small);
+extern "C" void PadSetPortConnected_nid_postfix(int port, bool connected);
 
 #endif
diff --git a/core/libs/prx/libScePad/libScePad.hpp b/core/libs/prx/libScePad/libScePad.hpp
new file mode 100644
index 0000000000..12aecdf76c
--- /dev/null
+++ b/core/libs/prx/libScePad/libScePad.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePad/include/Pad.hpp"
diff --git a/core/libs/prx/libScePad/src/PadState.cpp b/core/libs/prx/libScePad/src/PadState.cpp
index 5a6795f32e..4e1453dbfe 100644
--- a/core/libs/prx/libScePad/src/PadState.cpp
+++ b/core/libs/prx/libScePad/src/PadState.cpp
@@ -13,47 +13,57 @@
 #include <stdexcept>
 
 namespace {
-    std::mutex stateMutex;
-    PadInputState state;
-    std::uint32_t pressedSinceRead = 0;
-    std::uint8_t pressedAnalogL2 = 0;
-    std::uint8_t pressedAnalogR2 = 0;
-    std::uint64_t pressedAt = 0;
+    struct Quat { float w = 1.0f, x = 0.0f, y = 0.0f, z = 0.0f; };
     constexpr std::uint64_t kLatchExpiry = 100000;
-    PadOutputState output;
-    std::chrono::steady_clock::time_point audioHapticEnd;
-    std::array<std::uint8_t, 2> audioHapticRumble{};
-    PadAudioHapticQueue legacyHaptics;
-    std::uint64_t timestamp = 0;
+    std::uint64_t injectedTimestamp = 0;
 
     struct QueuedInput {
         PadInputState input;
         std::uint64_t timestamp = 0;
     };
     constexpr std::size_t kQueueCapacity = 64;
-    std::deque<QueuedInput> queue;
+
+    struct PadSlot {
+        PadInputState state;
+        PadOutputState output;
+        std::deque<QueuedInput> queue;
+        Quat orientation;
+        std::uint64_t lastFuseTime = 0;
+        float biasIntegral[3] = {0.0f, 0.0f, 0.0f};
+        bool tiltCorrection = true;
+        bool angularVelocityDeadband = false;
+        std::uint8_t nextTouchId = 0;
+        bool prevTouchActive[2] = {false, false};
+        std::uint8_t touchIds[2] = {0, 0};
+        std::chrono::steady_clock::time_point audioHapticEnd{};
+        std::array<std::uint8_t, 2> audioHapticRumble{};
+        PadAudioHapticQueue legacyHaptics;
+        std::uint64_t timestamp = 0;
+        std::uint32_t pressedSinceRead = 0;
+        std::uint8_t pressedAnalogL2 = 0;
+        std::uint8_t pressedAnalogR2 = 0;
+        std::uint64_t pressedAt = 0;
+        bool connected = false;
+    };
+
+    std::mutex stateMutex;
+    std::array<PadSlot, PAD_MAX_CONTROLLERS> slots = [] {
+        std::array<PadSlot, PAD_MAX_CONTROLLERS> initialSlots{};
+        initialSlots[0].connected = true;
+        return initialSlots;
+    }();
     std::exception_ptr failure;
     bool initialized = false;
-
-    struct Quat { float w = 1.0f, x = 0.0f, y = 0.0f, z = 0.0f; };
-    Quat orientation;
-    std::uint64_t lastFuseTime = 0;
-    float biasIntegral[3] = {0.0f, 0.0f, 0.0f};
-    bool tiltCorrection = true;
-    bool angularVelocityDeadband = false;
     constexpr float kAngularVelocityDeadband = 0.017453292f;
-    std::uint8_t nextTouchId = 0;
-    bool prevTouchActive[2] = {false, false};
-    std::uint8_t touchIds[2] = {0, 0};
 
-    bool RefreshAudioHaptics() {
-        if (std::chrono::steady_clock::now() >= audioHapticEnd) audioHapticRumble = {};
-        const auto legacy = legacyHaptics.Read(sceKernelGetProcessTime());
-        const auto large = std::max(audioHapticRumble[0], legacy[0]);
-        const auto small = std::max(audioHapticRumble[1], legacy[1]);
-        if (output.audioVibrationLarge == large && output.audioVibrationSmall == small) return false;
-        output.audioVibrationLarge = large;
-        output.audioVibrationSmall = small;
+    bool RefreshAudioHaptics(PadSlot& slot) {
+        if (std::chrono::steady_clock::now() >= slot.audioHapticEnd) slot.audioHapticRumble = {};
+        const auto legacy = slot.legacyHaptics.Read(sceKernelGetProcessTime());
+        const auto large = std::max(slot.audioHapticRumble[0], legacy[0]);
+        const auto small = std::max(slot.audioHapticRumble[1], legacy[1]);
+        if (slot.output.audioVibrationLarge == large && slot.output.audioVibrationSmall == small) return false;
+        slot.output.audioVibrationLarge = large;
+        slot.output.audioVibrationSmall = small;
         return true;
     }
 
@@ -63,33 +73,33 @@ namespace {
         q.w /= n; q.x /= n; q.y /= n; q.z /= n;
     }
 
-    void fuse(float dt, const std::array<float, 3>& accel, const std::array<float, 3>& gyro) {
+    void fuse(PadSlot& slot, float dt, const std::array<float, 3>& accel, const std::array<float, 3>& gyro) {
         float gx = gyro[0], gy = gyro[1], gz = gyro[2];
         const float an = std::sqrt(accel[0] * accel[0] + accel[1] * accel[1] + accel[2] * accel[2]);
-        if (tiltCorrection && an > 1.0f) {
+        if (slot.tiltCorrection && an > 1.0f) {
             const float ax = accel[0] / an, ay = accel[1] / an, az = accel[2] / an;
-            const float vx = 2.0f * (orientation.x * orientation.y + orientation.w * orientation.z);
-            const float vy = orientation.w * orientation.w - orientation.x * orientation.x + orientation.y * orientation.y - orientation.z * orientation.z;
-            const float vz = 2.0f * (orientation.y * orientation.z - orientation.w * orientation.x);
+            const float vx = 2.0f * (slot.orientation.x * slot.orientation.y + slot.orientation.w * slot.orientation.z);
+            const float vy = slot.orientation.w * slot.orientation.w - slot.orientation.x * slot.orientation.x + slot.orientation.y * slot.orientation.y - slot.orientation.z * slot.orientation.z;
+            const float vz = 2.0f * (slot.orientation.y * slot.orientation.z - slot.orientation.w * slot.orientation.x);
             const float ex = ay * vz - az * vy;
             const float ey = az * vx - ax * vz;
             const float ez = ax * vy - ay * vx;
             constexpr float kp = 1.5f;
             constexpr float ki = 0.02f;
-            biasIntegral[0] += ki * ex * dt;
-            biasIntegral[1] += ki * ey * dt;
-            biasIntegral[2] += ki * ez * dt;
-            gx += kp * ex + biasIntegral[0];
-            gy += kp * ey + biasIntegral[1];
-            gz += kp * ez + biasIntegral[2];
+            slot.biasIntegral[0] += ki * ex * dt;
+            slot.biasIntegral[1] += ki * ey * dt;
+            slot.biasIntegral[2] += ki * ez * dt;
+            gx += kp * ex + slot.biasIntegral[0];
+            gy += kp * ey + slot.biasIntegral[1];
+            gz += kp * ez + slot.biasIntegral[2];
         }
         const float hx = 0.5f * gx * dt, hy = 0.5f * gy * dt, hz = 0.5f * gz * dt;
-        const Quat q = orientation;
-        orientation.w = q.w - q.x * hx - q.y * hy - q.z * hz;
-        orientation.x = q.x + q.w * hx + q.y * hz - q.z * hy;
-        orientation.y = q.y + q.w * hy - q.x * hz + q.z * hx;
-        orientation.z = q.z + q.w * hz + q.x * hy - q.y * hx;
-        normalize(orientation);
+        const Quat q = slot.orientation;
+        slot.orientation.w = q.w - q.x * hx - q.y * hy - q.z * hz;
+        slot.orientation.x = q.x + q.w * hx + q.y * hz - q.z * hy;
+        slot.orientation.y = q.y + q.w * hy - q.x * hz + q.z * hx;
+        slot.orientation.z = q.z + q.w * hz + q.x * hy - q.y * hx;
+        normalize(slot.orientation);
     }
 
     void encodeZones(std::uint8_t* dst, std::uint8_t mode, const std::uint8_t* strengths, int count, std::uint8_t frequency) {
@@ -124,10 +134,13 @@ void Pad::Initialize() {
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
     if (!initialized) {
-        timestamp = sceKernelGetProcessTime();
-        lastFuseTime = timestamp;
-        queue.clear();
-        pressedSinceRead = 0;
+        const std::uint64_t now = sceKernelGetProcessTime();
+        for (std::size_t i = 0; i < slots.size(); ++i) {
+            slots[i].timestamp = now;
+            slots[i].lastFuseTime = now;
+            slots[i].queue.clear();
+            slots[i].pressedSinceRead = 0;
+        }
     }
     initialized = true;
 }
@@ -138,7 +151,7 @@ bool Pad::IsInitialized() {
 }
 
 namespace {
-PadData BuildData(const PadInputState& state, std::uint64_t changeTime, std::uint64_t now, const Pad::InputCommandFile::Input& injected) {
+PadData BuildData(PadSlot& slot, const PadInputState& state, std::uint64_t changeTime, std::uint64_t now, const Pad::InputCommandFile::Input& injected, int port) {
     PadData data{};
     data.buttons = state.buttons | injected.buttons;
     const auto& sticks = injected.hasSticks ? injected.sticks : state.sticks;
@@ -152,28 +165,28 @@ PadData BuildData(const PadInputState& state, std::uint64_t changeTime, std::uin
     data.analog_buttons_l2 = trigger(state.analogButtonsL2, 0x100);
     data.analog_buttons_r2 = trigger(state.analogButtonsR2, 0x200);
 
-    const bool live = state.hasMotion && output.motionEnabled;
+    const bool live = state.hasMotion && slot.output.motionEnabled;
     const std::array<float, 3> rest{0.0f, 9.80665f, 0.0f};
     const std::array<float, 3>& accel = live ? state.accel : rest;
     std::array<float, 3> gyro = live ? state.gyro : std::array<float, 3>{0.0f, 0.0f, 0.0f};
-    if (angularVelocityDeadband) {
+    if (slot.angularVelocityDeadband) {
         for (float& axis : gyro) {
             if (axis < kAngularVelocityDeadband && axis > -kAngularVelocityDeadband) axis = 0.0f;
         }
     }
     if (live) {
-        float dt = lastFuseTime != 0 && now > lastFuseTime ? static_cast<float>(now - lastFuseTime) * 1e-6f : 0.0f;
+        float dt = slot.lastFuseTime != 0 && now > slot.lastFuseTime ? static_cast<float>(now - slot.lastFuseTime) * 1e-6f : 0.0f;
         dt = std::min(dt, 0.1f);
-        fuse(dt, accel, gyro);
+        fuse(slot, dt, accel, gyro);
     } else {
-        orientation = Quat{};
-        biasIntegral[0] = biasIntegral[1] = biasIntegral[2] = 0.0f;
+        slot.orientation = Quat{};
+        slot.biasIntegral[0] = slot.biasIntegral[1] = slot.biasIntegral[2] = 0.0f;
     }
-    lastFuseTime = now;
-    data.orientation_x = orientation.x;
-    data.orientation_y = orientation.y;
-    data.orientation_z = orientation.z;
-    data.orientation_w = orientation.w;
+    slot.lastFuseTime = now;
+    data.orientation_x = slot.orientation.x;
+    data.orientation_y = slot.orientation.y;
+    data.orientation_z = slot.orientation.z;
+    data.orientation_w = slot.orientation.w;
     constexpr float kGravity = 9.80665f;
     data.acceleration_x = accel[0] / kGravity;
     data.acceleration_y = accel[1] / kGravity;
@@ -182,20 +195,24 @@ PadData BuildData(const PadInputState& state, std::uint64_t changeTime, std::uin
     data.angular_velocity_y = gyro[1];
     data.angular_velocity_z = gyro[2];
 
-    data.connected = true;
-    data.connected_count = 1;
+    std::uint8_t connectedCount = 0;
+    for (const auto& s : slots) {
+        if (s.connected) ++connectedCount;
+    }
+    data.connected = slot.connected;
+    data.connected_count = connectedCount > 0 ? connectedCount : 1;
     data.timestamp = changeTime;
 
     std::uint8_t touchNum = 0;
     for (int i = 0; i < 2; ++i) {
         const PadTouchPoint& tp = state.touch[i];
-        if (!tp.active) { prevTouchActive[i] = false; continue; }
-        if (!prevTouchActive[i]) touchIds[i] = static_cast<std::uint8_t>(nextTouchId++ & 0x7F);
-        prevTouchActive[i] = true;
+        if (!tp.active) { slot.prevTouchActive[i] = false; continue; }
+        if (!slot.prevTouchActive[i]) slot.touchIds[i] = static_cast<std::uint8_t>(slot.nextTouchId++ & 0x7F);
+        slot.prevTouchActive[i] = true;
         if (touchNum == 0) {
-            data.touch_data_touch0_x = tp.x; data.touch_data_touch0_y = tp.y; data.touch_data_touch0_id = touchIds[i];
+            data.touch_data_touch0_x = tp.x; data.touch_data_touch0_y = tp.y; data.touch_data_touch0_id = slot.touchIds[i];
         } else {
-            data.touch_data_touch1_x = tp.x; data.touch_data_touch1_y = tp.y; data.touch_data_touch1_id = touchIds[i];
+            data.touch_data_touch1_x = tp.x; data.touch_data_touch1_y = tp.y; data.touch_data_touch1_id = slot.touchIds[i];
         }
         ++touchNum;
     }
@@ -223,66 +240,85 @@ Pad::InputCommandFile::Input InjectedInput(std::uint64_t now) {
     const auto injected = commands.Poll(now);
     if (injected != lastInjected) {
         lastInjected = injected;
-        timestamp = now;
+        slots[0].timestamp = now;
+        injectedTimestamp = now;
     }
     return injected;
 }
 }
 
-PadData Pad::ReadState() {
+PadData Pad::ReadState(int port) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) throw std::invalid_argument("Pad: invalid port");
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
     if (!initialized) throw std::runtime_error("Pad: read before initialization");
     const std::uint64_t now = sceKernelGetProcessTime();
-    const auto injected = InjectedInput(now);
-    PadData data = BuildData(state, timestamp, now, injected);
-    if (pressedSinceRead != 0 && now - pressedAt <= kLatchExpiry) {
-        data.buttons |= pressedSinceRead;
-        if (pressedSinceRead & 0x100u) data.analog_buttons_l2 = std::max(data.analog_buttons_l2, pressedAnalogL2);
-        if (pressedSinceRead & 0x200u) data.analog_buttons_r2 = std::max(data.analog_buttons_r2, pressedAnalogR2);
+    const auto injected = port == 0 ? InjectedInput(now) : Pad::InputCommandFile::Input{};
+    auto& slot = slots[port];
+    PadData data = BuildData(slot, slot.state, slot.timestamp, now, injected, port);
+    if (slot.pressedSinceRead != 0 && now - slot.pressedAt <= kLatchExpiry) {
+        data.buttons |= slot.pressedSinceRead;
+        if (slot.pressedSinceRead & 0x100u) data.analog_buttons_l2 = std::max(data.analog_buttons_l2, slot.pressedAnalogL2);
+        if (slot.pressedSinceRead & 0x200u) data.analog_buttons_r2 = std::max(data.analog_buttons_r2, slot.pressedAnalogR2);
     }
-    pressedSinceRead = 0;
+    slot.pressedSinceRead = 0;
     return data;
 }
 
-int Pad::Read(PadData* data, int num) {
+int Pad::Read(PadData* data, int num, int port) {
     if (data == nullptr || num <= 0) throw std::invalid_argument("Pad: invalid read buffer");
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) throw std::invalid_argument("Pad: invalid port");
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
     if (!initialized) throw std::runtime_error("Pad: read before initialization");
-    pressedSinceRead = 0;
+    auto& slot = slots[port];
+    slot.pressedSinceRead = 0;
     const std::uint64_t now = sceKernelGetProcessTime();
-    const auto injected = InjectedInput(now);
-    if (queue.empty()) {
-        data[0] = BuildData(state, timestamp, now, injected);
+    const auto injected = port == 0 ? InjectedInput(now) : Pad::InputCommandFile::Input{};
+    if (slot.queue.empty()) {
+        data[0] = BuildData(slot, slot.state, slot.timestamp, now, injected, port);
         return 1;
     }
     int count = 0;
-    while (count < num && !queue.empty()) {
-        const QueuedInput& entry = queue.front();
-        data[count++] = BuildData(entry.input, entry.timestamp, now, injected);
-        queue.pop_front();
+    while (count < num && !slot.queue.empty()) {
+        const QueuedInput& entry = slot.queue.front();
+        data[count++] = BuildData(slot, entry.input, port == 0 ? std::max(entry.timestamp, injectedTimestamp) : entry.timestamp, now, injected, port);
+        slot.queue.pop_front();
     }
     return count;
 }
 
-void Pad::SetVibration(std::uint8_t large, std::uint8_t small) {
+void Pad::SetVibration(int port, std::uint8_t large, std::uint8_t small) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     if (output.vibrationLarge == large && output.vibrationSmall == small) return;
     output.vibrationLarge = large;
     output.vibrationSmall = small;
     ++output.sequence;
 }
 
-void Pad::SetVibrationMode(int mode) {
+void Pad::SetVibration(std::uint8_t large, std::uint8_t small) {
+    SetVibration(0, large, small);
+}
+
+void Pad::SetVibrationMode(int port, int mode) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     if (output.vibrationMode == mode) return;
     output.vibrationMode = mode;
     ++output.sequence;
 }
 
-void Pad::SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+void Pad::SetVibrationMode(int mode) {
+    SetVibrationMode(0, mode);
+}
+
+void Pad::SetLightBar(int port, bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     output.lightBarValid = valid;
     output.lightBar[0] = r;
     output.lightBar[1] = g;
@@ -290,8 +326,12 @@ void Pad::SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b
     ++output.sequence;
 }
 
-void Pad::SetTriggerCommand(int trigger, const std::uint8_t* command) {
-    if (trigger < 0 || trigger > 1 || command == nullptr) return;
+void Pad::SetLightBar(bool valid, std::uint8_t r, std::uint8_t g, std::uint8_t b) {
+    SetLightBar(0, valid, r, g, b);
+}
+
+void Pad::SetTriggerCommand(int port, int trigger, const std::uint8_t* command) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS || trigger < 0 || trigger > 1 || command == nullptr) return;
     std::uint32_t mode = 0;
     std::memcpy(&mode, command, 4);
     const std::uint8_t* p = command + 8;
@@ -348,55 +388,95 @@ void Pad::SetTriggerCommand(int trigger, const std::uint8_t* command) {
     req.valid = req.effect[0] != 0x05;
     if (!req.valid) req.fallback = 0;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     output.trigger[trigger] = req;
     output.triggerTouched = true;
     ++output.sequence;
 }
 
-void Pad::ResetOrientation() {
+void Pad::SetTriggerCommand(int trigger, const std::uint8_t* command) {
+    SetTriggerCommand(0, trigger, command);
+}
+
+void Pad::ResetOrientation(int port) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
-    orientation = Quat{};
-    biasIntegral[0] = biasIntegral[1] = biasIntegral[2] = 0.0f;
+    slots[port].orientation = Quat{};
+    slots[port].biasIntegral[0] = slots[port].biasIntegral[1] = slots[port].biasIntegral[2] = 0.0f;
+}
+
+void Pad::SetTiltCorrection(int port, bool enabled) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
+    std::lock_guard lock(stateMutex);
+    slots[port].tiltCorrection = enabled;
+    slots[port].biasIntegral[0] = slots[port].biasIntegral[1] = slots[port].biasIntegral[2] = 0.0f;
 }
 
 void Pad::SetTiltCorrection(bool enabled) {
+    SetTiltCorrection(0, enabled);
+}
+
+void Pad::SetAngularVelocityDeadband(int port, bool enabled) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
-    tiltCorrection = enabled;
-    biasIntegral[0] = biasIntegral[1] = biasIntegral[2] = 0.0f;
+    slots[port].angularVelocityDeadband = enabled;
 }
 
 void Pad::SetAngularVelocityDeadband(bool enabled) {
-    std::lock_guard lock(stateMutex);
-    angularVelocityDeadband = enabled;
+    SetAngularVelocityDeadband(0, enabled);
 }
 
-void Pad::SetMotionEnabled(bool enabled) {
+void Pad::SetMotionEnabled(int port, bool enabled) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
+    auto& output = slots[port].output;
     if (output.motionEnabled == enabled) return;
     output.motionEnabled = enabled;
     ++output.sequence;
 }
 
-extern "C" void PadPublishInput_nid_postfix(const PadInputState& input) {
+void Pad::SetMotionEnabled(bool enabled) {
+    SetMotionEnabled(0, enabled);
+}
+
+void Pad::SetConnected(int port, bool connected) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
+    std::lock_guard lock(stateMutex);
+    slots[port].connected = connected;
+}
+
+bool Pad::IsConnected(int port) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return false;
+    std::lock_guard lock(stateMutex);
+    return slots[port].connected;
+}
+
+extern "C" void PadPublishInputForPort_nid_postfix(int port, const PadInputState& input) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
     if (failure) std::rethrow_exception(failure);
-    if (state.buttons == input.buttons && state.sticks == input.sticks &&
-        state.analogButtonsL2 == input.analogButtonsL2 && state.analogButtonsR2 == input.analogButtonsR2 &&
-        state.touchLeft == input.touchLeft && state.touchRight == input.touchRight &&
-        state.hasMotion == input.hasMotion && state.accel == input.accel && state.gyro == input.gyro &&
-        state.touch == input.touch && state.deviceKind == input.deviceKind) return;
-    const std::uint32_t pressed = input.buttons & ~state.buttons;
-    timestamp = sceKernelGetProcessTime();
+    auto& slot = slots[port];
+    if (slot.state.buttons == input.buttons && slot.state.sticks == input.sticks &&
+        slot.state.analogButtonsL2 == input.analogButtonsL2 && slot.state.analogButtonsR2 == input.analogButtonsR2 &&
+        slot.state.touchLeft == input.touchLeft && slot.state.touchRight == input.touchRight &&
+        slot.state.hasMotion == input.hasMotion && slot.state.accel == input.accel && slot.state.gyro == input.gyro &&
+        slot.state.touch == input.touch && slot.state.deviceKind == input.deviceKind) return;
+    const std::uint32_t pressed = input.buttons & ~slot.state.buttons;
+    slot.timestamp = sceKernelGetProcessTime();
     if (pressed != 0) {
-        if (pressedSinceRead != 0 && timestamp - pressedAt > kLatchExpiry) pressedSinceRead = 0;
-        pressedSinceRead |= pressed;
-        pressedAt = timestamp;
-        if (pressed & 0x100u) pressedAnalogL2 = input.analogButtonsL2;
-        if (pressed & 0x200u) pressedAnalogR2 = input.analogButtonsR2;
+        if (slot.pressedSinceRead != 0 && slot.timestamp - slot.pressedAt > kLatchExpiry) slot.pressedSinceRead = 0;
+        slot.pressedSinceRead |= pressed;
+        slot.pressedAt = slot.timestamp;
+        if (pressed & 0x100u) slot.pressedAnalogL2 = input.analogButtonsL2;
+        if (pressed & 0x200u) slot.pressedAnalogR2 = input.analogButtonsR2;
     }
-    state = input;
-    if (queue.size() == kQueueCapacity) queue.pop_front();
-    queue.push_back({input, timestamp});
+    slot.state = input;
+    if (slot.queue.size() == kQueueCapacity) slot.queue.pop_front();
+    slot.queue.push_back({input, slot.timestamp});
+}
+
+extern "C" void PadPublishInput_nid_postfix(const PadInputState& input) {
+    PadPublishInputForPort_nid_postfix(0, input);
 }
 
 extern "C" void PadReportInputFailure_nid_postfix(std::exception_ptr error) {
@@ -405,35 +485,51 @@ extern "C" void PadReportInputFailure_nid_postfix(std::exception_ptr error) {
     if (!failure) failure = error;
 }
 
-extern "C" bool PadFetchOutput_nid_postfix(std::uint32_t* seenSequence, PadOutputState* out) {
+extern "C" bool PadFetchOutputForPort_nid_postfix(int port, std::uint32_t* seenSequence, PadOutputState* out) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return false;
     std::lock_guard lock(stateMutex);
-    if (RefreshAudioHaptics()) ++output.sequence;
-    if (seenSequence == nullptr || out == nullptr || *seenSequence == output.sequence) return false;
-    *seenSequence = output.sequence;
-    *out = output;
+    auto& slot = slots[port];
+    if (RefreshAudioHaptics(slot)) ++slot.output.sequence;
+    if (seenSequence == nullptr || out == nullptr || *seenSequence == slot.output.sequence) return false;
+    *seenSequence = slot.output.sequence;
+    *out = slot.output;
     return true;
 }
 
-extern "C" void PadSubmitAudioHaptics_nid_postfix(std::uint8_t large, std::uint8_t small) {
+extern "C" bool PadFetchOutput_nid_postfix(std::uint32_t* seenSequence, PadOutputState* out) {
+    return PadFetchOutputForPort_nid_postfix(0, seenSequence, out);
+}
+
+extern "C" void PadSubmitAudioHapticsForPort_nid_postfix(int port, std::uint8_t large, std::uint8_t small) {
+    if (port < 0 || port >= PAD_MAX_CONTROLLERS) return;
     std::lock_guard lock(stateMutex);
     if (large == 0 && small == 0) return;
     const auto now = std::chrono::steady_clock::now();
-    if (now >= audioHapticEnd) audioHapticRumble = {};
-    audioHapticRumble[0] = std::max(audioHapticRumble[0], large);
-    audioHapticRumble[1] = std::max(audioHapticRumble[1], small);
-    audioHapticEnd = now + std::chrono::milliseconds(80);
-    static_cast<void>(RefreshAudioHaptics());
-    ++output.sequence;
+    auto& slot = slots[port];
+    if (now >= slot.audioHapticEnd) slot.audioHapticRumble = {};
+    slot.audioHapticRumble[0] = std::max(slot.audioHapticRumble[0], large);
+    slot.audioHapticRumble[1] = std::max(slot.audioHapticRumble[1], small);
+    slot.audioHapticEnd = now + std::chrono::milliseconds(80);
+    static_cast<void>(RefreshAudioHaptics(slot));
+    ++slot.output.sequence;
 }
 
 extern "C" void PadQueueLegacyAudioHaptics_nid_postfix(int source, std::uint64_t begin, std::uint64_t end, std::uint8_t large, std::uint8_t small) {
     std::lock_guard lock(stateMutex);
-    legacyHaptics.Queue(source, begin, end, large, small);
-    if (RefreshAudioHaptics()) ++output.sequence;
+    slots[0].legacyHaptics.Queue(source, begin, end, large, small);
+    if (RefreshAudioHaptics(slots[0])) ++slots[0].output.sequence;
 }
 
 extern "C" void PadClearLegacyAudioHaptics_nid_postfix(int source) {
     std::lock_guard lock(stateMutex);
-    legacyHaptics.Clear(source);
-    if (RefreshAudioHaptics()) ++output.sequence;
+    slots[0].legacyHaptics.Clear(source);
+    if (RefreshAudioHaptics(slots[0])) ++slots[0].output.sequence;
+}
+
+extern "C" void PadSubmitAudioHaptics_nid_postfix(std::uint8_t large, std::uint8_t small) {
+    PadSubmitAudioHapticsForPort_nid_postfix(0, large, small);
+}
+
+extern "C" void PadSetPortConnected_nid_postfix(int port, bool connected) {
+    Pad::SetConnected(port, connected);
 }
diff --git a/core/libs/prx/libScePadTracker/Export.cpp b/core/libs/prx/libScePadTracker/Export.cpp
index e43ebed776..e48d78bdda 100644
--- a/core/libs/prx/libScePadTracker/Export.cpp
+++ b/core/libs/prx/libScePadTracker/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePadTracker/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePadTracker/include/Api.hpp b/core/libs/prx/libScePadTracker/include/Api.hpp
new file mode 100644
index 0000000000..825991c114
--- /dev/null
+++ b/core/libs/prx/libScePadTracker/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePadTrackerCalibrate();
+int APS5_VABI scePadTrackerGetWorkingMemorySize();
+int APS5_VABI scePadTrackerInit();
+int APS5_VABI scePadTrackerReadState();
+int APS5_VABI scePadTrackerTerm();
+int APS5_VABI scePadTrackerUpdate();
+
+}
diff --git a/core/libs/prx/libScePadTracker/libScePadTracker.hpp b/core/libs/prx/libScePadTracker/libScePadTracker.hpp
new file mode 100644
index 0000000000..18b6ca49c9
--- /dev/null
+++ b/core/libs/prx/libScePadTracker/libScePadTracker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePadTracker/include/Api.hpp"
diff --git a/core/libs/prx/libScePatchCheckerClient/Export.cpp b/core/libs/prx/libScePatchCheckerClient/Export.cpp
index 3cce60d2e7..e10db5258f 100644
--- a/core/libs/prx/libScePatchCheckerClient/Export.cpp
+++ b/core/libs/prx/libScePatchCheckerClient/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePatchCheckerClient/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePatchCheckerClient/include/Api.hpp b/core/libs/prx/libScePatchCheckerClient/include/Api.hpp
new file mode 100644
index 0000000000..25f7bdc95a
--- /dev/null
+++ b/core/libs/prx/libScePatchCheckerClient/include/Api.hpp
@@ -0,0 +1,20 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePatchCheckerCancel();
+int APS5_VABI scePatchCheckerCheckPatch();
+int APS5_VABI scePatchCheckerCreateHandler();
+int APS5_VABI scePatchCheckerDestroyHandler();
+int APS5_VABI scePatchCheckerDisableAutoDownload();
+int APS5_VABI scePatchCheckerEnableAutoDownload();
+int APS5_VABI scePatchCheckerGetApplicableTick();
+int APS5_VABI scePatchCheckerGetPackageInfo();
+int APS5_VABI scePatchCheckerInitialize();
+int APS5_VABI scePatchCheckerRequestCheckPatch();
+int APS5_VABI scePatchCheckerRequestCheckPatchByType();
+int APS5_VABI scePatchCheckerTerminate();
+
+}
diff --git a/core/libs/prx/libScePatchCheckerClient/libScePatchCheckerClient.hpp b/core/libs/prx/libScePatchCheckerClient/libScePatchCheckerClient.hpp
new file mode 100644
index 0000000000..dab24e28c7
--- /dev/null
+++ b/core/libs/prx/libScePatchCheckerClient/libScePatchCheckerClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePatchCheckerClient/include/Api.hpp"
diff --git a/core/libs/prx/libScePerf/libScePerf.hpp b/core/libs/prx/libScePerf/libScePerf.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePerf/libScePerf.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePlayGo/Export.cpp b/core/libs/prx/libScePlayGo/Export.cpp
index 9fae1d940e..eb53f29aec 100644
--- a/core/libs/prx/libScePlayGo/Export.cpp
+++ b/core/libs/prx/libScePlayGo/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayGo/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayGo/include/Api.hpp b/core/libs/prx/libScePlayGo/include/Api.hpp
new file mode 100644
index 0000000000..e7f2e0a879
--- /dev/null
+++ b/core/libs/prx/libScePlayGo/include/Api.hpp
@@ -0,0 +1,29 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayGoClose(int handle);
+int APS5_VABI scePlayGoGetChunkId(int handle, uint16_t* outChunkIdList, uint32_t numberOfEntries, uint32_t* outEntries);
+int APS5_VABI scePlayGoGetEta(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, int64_t* outEta);
+int APS5_VABI scePlayGoGetInstallChunkId(int handle, uint16_t* outChunkIdList, uint32_t numberOfEntries, uint32_t* outEntries);
+int APS5_VABI scePlayGoGetInstallSpeed(int handle, int32_t* outSpeed);
+int APS5_VABI scePlayGoGetLanguageMask(int handle, uint64_t* outLanguageMask);
+int APS5_VABI scePlayGoGetLocus(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, int8_t* outLoci);
+int APS5_VABI scePlayGoGetOptionalChunk(int handle, std::uint32_t type, PlayGoOptionalChunk* option);
+int APS5_VABI scePlayGoGetProgress(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, PlayGoProgress* outProgress);
+int APS5_VABI scePlayGoGetSupportedOptionalChunk(int handle, std::uint32_t type, PlayGoOptionalChunk* option);
+int APS5_VABI scePlayGoGetToDoList(int handle, PlayGoToDo* outTodoList, uint32_t numberOfEntries, uint32_t* outEntries);
+int APS5_VABI scePlayGoInitialize(const PlayGoInitParams* init);
+int APS5_VABI scePlayGoOpen(int* outHandle, const void* param);
+int APS5_VABI scePlayGoPrefetch(int handle, const uint16_t* chunkIds, uint32_t numberOfEntries, int8_t minimumLocus);
+int APS5_VABI scePlayGoPrefetchOptionalChunk(int handle, int32_t type, const PlayGoOptionalChunk* option);
+int APS5_VABI scePlayGoSetInstallSpeed(int handle, int32_t speed);
+int APS5_VABI scePlayGoSetToDoList(int handle, const PlayGoToDo* todoList, uint32_t numberOfEntries);
+int APS5_VABI scePlayGoTerminate(void);
+int APS5_VABI scePlayGoRequestNextChunk();
+int APS5_VABI scePlayGoSetLanguageMask(int handle, uint64_t languageMask);
+int APS5_VABI scePlayGoSnapshot();
+
+}
diff --git a/core/libs/prx/libScePlayGo/libScePlayGo.hpp b/core/libs/prx/libScePlayGo/libScePlayGo.hpp
new file mode 100644
index 0000000000..be60245c2e
--- /dev/null
+++ b/core/libs/prx/libScePlayGo/libScePlayGo.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayGo/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayGoDialog/Export.cpp b/core/libs/prx/libScePlayGoDialog/Export.cpp
index e341d17b84..084d94c5b3 100644
--- a/core/libs/prx/libScePlayGoDialog/Export.cpp
+++ b/core/libs/prx/libScePlayGoDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayGoDialog/include/Api.hpp"
 #include <atomic>
 #include <algorithm>
 #include <iterator>
diff --git a/core/libs/prx/libScePlayGoDialog/include/Api.hpp b/core/libs/prx/libScePlayGoDialog/include/Api.hpp
new file mode 100644
index 0000000000..99f0428e67
--- /dev/null
+++ b/core/libs/prx/libScePlayGoDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayGoDialogInitialize(void);
+int APS5_VABI scePlayGoDialogTerminate(void);
+int APS5_VABI scePlayGoDialogOpen(const void* param);
+int APS5_VABI scePlayGoDialogClose(void);
+int APS5_VABI scePlayGoDialogUpdateStatus(void);
+int APS5_VABI scePlayGoDialogGetResult(PlayGoDialogResult* result);
+int APS5_VABI scePlayGoDialogGetStatus(void);
+
+}
diff --git a/core/libs/prx/libScePlayGoDialog/libScePlayGoDialog.hpp b/core/libs/prx/libScePlayGoDialog/libScePlayGoDialog.hpp
new file mode 100644
index 0000000000..3b805577f0
--- /dev/null
+++ b/core/libs/prx/libScePlayGoDialog/libScePlayGoDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayGoDialog/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayReady/Export.cpp b/core/libs/prx/libScePlayReady/Export.cpp
index 59330d9d35..fa7958b257 100644
--- a/core/libs/prx/libScePlayReady/Export.cpp
+++ b/core/libs/prx/libScePlayReady/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayReady/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayReady/include/Api.hpp b/core/libs/prx/libScePlayReady/include/Api.hpp
new file mode 100644
index 0000000000..6fb478bbda
--- /dev/null
+++ b/core/libs/prx/libScePlayReady/include/Api.hpp
@@ -0,0 +1,58 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceBufferAlloc();
+int APS5_VABI sceBufferDup();
+int APS5_VABI sceBufferFree();
+int APS5_VABI sceBufferInit();
+int APS5_VABI sceBufferRealloc();
+int APS5_VABI scePlayReadyApiInitializeInitParams();
+int APS5_VABI scePlayReadyApiIsStarted();
+int APS5_VABI scePlayReadyApiStart();
+int APS5_VABI scePlayReadyApiStop();
+int APS5_VABI scePlayReadyApiVersion();
+int APS5_VABI scePlayReadyApiVersionString();
+int APS5_VABI scePlayReadyBufferFree();
+int APS5_VABI scePlayReadyBufferInit();
+int APS5_VABI scePlayReadyBufferMalloc();
+int APS5_VABI scePlayReadyBufferRealloc();
+int APS5_VABI scePlayReadyContentGetProperty();
+int APS5_VABI scePlayReadyContentSetProperty();
+int APS5_VABI scePlayReadyDomainCertEnumFini();
+int APS5_VABI scePlayReadyDomainCertEnumInit();
+int APS5_VABI scePlayReadyDomainCertEnumNext();
+int APS5_VABI scePlayReadyDomainCertFind();
+int APS5_VABI scePlayReadyDomainJoinGenerateChallenge();
+int APS5_VABI scePlayReadyDomainJoinProcessResponse();
+int APS5_VABI scePlayReadyDomainLeaveGenerateChallenge();
+int APS5_VABI scePlayReadyDomainLeaveProcessResponse();
+int APS5_VABI scePlayReadyEnvelopeClose();
+int APS5_VABI scePlayReadyEnvelopeGetSize();
+int APS5_VABI scePlayReadyEnvelopeInitializeRead();
+int APS5_VABI scePlayReadyEnvelopeOpen();
+int APS5_VABI scePlayReadyEnvelopeRead();
+int APS5_VABI scePlayReadyEnvelopeSeek();
+int APS5_VABI scePlayReadyFinalize();
+int APS5_VABI scePlayReadyFreeDecryptContext();
+int APS5_VABI scePlayReadyInitialize();
+int APS5_VABI scePlayReadyInitializeInitParams();
+int APS5_VABI scePlayReadyLicenseAcqGenerateAck();
+int APS5_VABI scePlayReadyLicenseAcqGenerateChallenge();
+int APS5_VABI scePlayReadyLicenseAcqGetAdditionalResponseData();
+int APS5_VABI scePlayReadyLicenseAcqProcessAckResponse();
+int APS5_VABI scePlayReadyLicenseAcqProcessResponse();
+int APS5_VABI scePlayReadyMemAlloc();
+int APS5_VABI scePlayReadyMemFree();
+int APS5_VABI scePlayReadyMemGetStats();
+int APS5_VABI scePlayReadyMemRealloc();
+int APS5_VABI scePlayReadyNewDecryptContext();
+int APS5_VABI scePlayReadyReaderBind();
+int APS5_VABI scePlayReadyReaderCommit();
+int APS5_VABI scePlayReadyReaderDecrypt();
+int APS5_VABI scePlayReadyReset();
+int APS5_VABI scePlayReadyStoreCleanup();
+
+}
diff --git a/core/libs/prx/libScePlayReady/libScePlayReady.hpp b/core/libs/prx/libScePlayReady/libScePlayReady.hpp
new file mode 100644
index 0000000000..3138b60f6b
--- /dev/null
+++ b/core/libs/prx/libScePlayReady/libScePlayReady.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayReady/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayReady2/Export.cpp b/core/libs/prx/libScePlayReady2/Export.cpp
index 2b08a30037..0ad7e3f73d 100644
--- a/core/libs/prx/libScePlayReady2/Export.cpp
+++ b/core/libs/prx/libScePlayReady2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayReady2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayReady2/include/Api.hpp b/core/libs/prx/libScePlayReady2/include/Api.hpp
new file mode 100644
index 0000000000..3e388e5dc6
--- /dev/null
+++ b/core/libs/prx/libScePlayReady2/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayReadyBufferInitWithData();
+int APS5_VABI scePlayReadyCloneDecryptContext();
+int APS5_VABI scePlayReadyDebugPrintf();
+int APS5_VABI scePlayReadyDebugSetLevel();
+int APS5_VABI scePlayReadyLicenseDelete();
+int APS5_VABI scePlayReadyLicenseDeleteInMemory();
+int APS5_VABI scePlayReadyLicenseGetExpirationTime();
+int APS5_VABI scePlayReadyLicenseGetProperty();
+int APS5_VABI scePlayReadyReaderClose();
+int APS5_VABI scePlayReadyReaderDecryptMultiple();
+int APS5_VABI scePlayReadyReaderDecryptMultipleOpaque();
+int APS5_VABI scePlayReadyReaderDecryptOpaque();
+int APS5_VABI scePlayReadyReaderDecrypt_Legacy();
+int APS5_VABI scePlayReadyReaderFreeOpaqueContent();
+int APS5_VABI scePlayReadyReaderRetrieveOpaqueContent();
+int APS5_VABI scePlayReadyReinitialize();
+
+}
diff --git a/core/libs/prx/libScePlayReady2/libScePlayReady2.hpp b/core/libs/prx/libScePlayReady2/libScePlayReady2.hpp
new file mode 100644
index 0000000000..48fc0e9766
--- /dev/null
+++ b/core/libs/prx/libScePlayReady2/libScePlayReady2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayReady2/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayReady4/Export.cpp b/core/libs/prx/libScePlayReady4/Export.cpp
index 0454139571..9d4bbeea93 100644
--- a/core/libs/prx/libScePlayReady4/Export.cpp
+++ b/core/libs/prx/libScePlayReady4/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayReady4/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayReady4/include/Api.hpp b/core/libs/prx/libScePlayReady4/include/Api.hpp
new file mode 100644
index 0000000000..cef37c1859
--- /dev/null
+++ b/core/libs/prx/libScePlayReady4/include/Api.hpp
@@ -0,0 +1,43 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayReadyApiPlatform();
+int APS5_VABI scePlayReadyCdmiClose();
+int APS5_VABI scePlayReadyCdmiCreateMediaKeySession();
+int APS5_VABI scePlayReadyCdmiCreateMediaKeySystemAccess();
+int APS5_VABI scePlayReadyCdmiCreateMediaKeys();
+int APS5_VABI scePlayReadyCdmiDecryptMultipleOpaque();
+int APS5_VABI scePlayReadyCdmiDecryptOpaque();
+int APS5_VABI scePlayReadyCdmiDecryptOpaque2();
+int APS5_VABI scePlayReadyCdmiDestroyMediaKeySession();
+int APS5_VABI scePlayReadyCdmiDestroyMediaKeySystemAccess();
+int APS5_VABI scePlayReadyCdmiDestroyMediaKeys();
+int APS5_VABI scePlayReadyCdmiFreeOpaqueDecryptedContent();
+int APS5_VABI scePlayReadyCdmiGenerateRequest();
+int APS5_VABI scePlayReadyCdmiGetConfiguration();
+int APS5_VABI scePlayReadyCdmiGetExpiration();
+int APS5_VABI scePlayReadyCdmiGetKeySystem();
+int APS5_VABI scePlayReadyCdmiGetMediaKeyCount();
+int APS5_VABI scePlayReadyCdmiGetMediaKeyStatus();
+int APS5_VABI scePlayReadyCdmiGetSessionAppContext();
+int APS5_VABI scePlayReadyCdmiGetSessionId();
+int APS5_VABI scePlayReadyCdmiIsLicenseAckRequired();
+int APS5_VABI scePlayReadyCdmiLoad();
+int APS5_VABI scePlayReadyCdmiRemove();
+int APS5_VABI scePlayReadyCdmiRetrieveOpaqueDecryptedContent();
+int APS5_VABI scePlayReadyCdmiSetServerCertificate();
+int APS5_VABI scePlayReadyCdmiSetSessionCallbacks();
+int APS5_VABI scePlayReadyCdmiUpdate();
+int APS5_VABI scePlayReadyLicenseCount();
+int APS5_VABI scePlayReadyProfileClear();
+int APS5_VABI scePlayReadyProfileEnter();
+int APS5_VABI scePlayReadyProfileLeave();
+int APS5_VABI scePlayReadyProfilePause();
+int APS5_VABI scePlayReadyProfileResume();
+int APS5_VABI scePlayReadyProfileStart();
+int APS5_VABI scePlayReadyProfileStop();
+
+}
diff --git a/core/libs/prx/libScePlayReady4/libScePlayReady4.hpp b/core/libs/prx/libScePlayReady4/libScePlayReady4.hpp
new file mode 100644
index 0000000000..97c4cdd3e7
--- /dev/null
+++ b/core/libs/prx/libScePlayReady4/libScePlayReady4.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayReady4/include/Api.hpp"
diff --git a/core/libs/prx/libScePlayerInvitationDialog/Export.cpp b/core/libs/prx/libScePlayerInvitationDialog/Export.cpp
index 86095da370..0f78112135 100644
--- a/core/libs/prx/libScePlayerInvitationDialog/Export.cpp
+++ b/core/libs/prx/libScePlayerInvitationDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.h"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.hpp b/core/libs/prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.hpp
new file mode 100644
index 0000000000..be74cdea73
--- /dev/null
+++ b/core/libs/prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayerInvitationDialog/libScePlayerInvitationDialog.h"
diff --git a/core/libs/prx/libScePlayerSelectionDialog/Export.cpp b/core/libs/prx/libScePlayerSelectionDialog/Export.cpp
index 06df01e1c8..52b3363adb 100644
--- a/core/libs/prx/libScePlayerSelectionDialog/Export.cpp
+++ b/core/libs/prx/libScePlayerSelectionDialog/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePlayerSelectionDialog/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -6,8 +8,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libScePlayerSelectionDialog/include/Api.hpp b/core/libs/prx/libScePlayerSelectionDialog/include/Api.hpp
new file mode 100644
index 0000000000..baf1617f53
--- /dev/null
+++ b/core/libs/prx/libScePlayerSelectionDialog/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePlayerSelectionDialogInitialize(void);
+int APS5_VABI scePlayerSelectionDialogOpen(const PlayerSelectionDialogParam* param);
+int APS5_VABI scePlayerSelectionDialogClose(void);
+int APS5_VABI scePlayerSelectionDialogUpdateStatus(void);
+int APS5_VABI scePlayerSelectionDialogGetStatus(void);
+int APS5_VABI scePlayerSelectionDialogGetResult(PlayerSelectionDialogResult* result);
+int APS5_VABI scePlayerSelectionDialogParamInitialize(void* param);
+int APS5_VABI scePlayerSelectionDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libScePlayerSelectionDialog/libScePlayerSelectionDialog.hpp b/core/libs/prx/libScePlayerSelectionDialog/libScePlayerSelectionDialog.hpp
new file mode 100644
index 0000000000..2e72898b93
--- /dev/null
+++ b/core/libs/prx/libScePlayerSelectionDialog/libScePlayerSelectionDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePlayerSelectionDialog/include/Api.hpp"
diff --git a/core/libs/prx/libScePngDec/Export.cpp b/core/libs/prx/libScePngDec/Export.cpp
index 8ff5827de0..3599cef8d3 100644
--- a/core/libs/prx/libScePngDec/Export.cpp
+++ b/core/libs/prx/libScePngDec/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngDec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
diff --git a/core/libs/prx/libScePngDec/include/Api.hpp b/core/libs/prx/libScePngDec/include/Api.hpp
new file mode 100644
index 0000000000..1440fbcf5a
--- /dev/null
+++ b/core/libs/prx/libScePngDec/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int32_t APS5_VABI scePngDecCreate(const PngDecCreateParam* param, void* memoryAddress, uint32_t memorySize, void** handle);
+int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param, PngDecImageInfo* imageInfo);
+int32_t APS5_VABI scePngDecDelete(void* handle);
+int32_t APS5_VABI scePngDecParseHeader(const PngDecParseParam* param, PngDecImageInfo* imageInfo);
+int32_t APS5_VABI scePngDecQueryMemorySize(const PngDecCreateParam* param);
+int APS5_VABI scePngDecDecodeWithInputControl();
+
+}
diff --git a/core/libs/prx/libScePngDec/libScePngDec.hpp b/core/libs/prx/libScePngDec/libScePngDec.hpp
new file mode 100644
index 0000000000..27bf3452a2
--- /dev/null
+++ b/core/libs/prx/libScePngDec/libScePngDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePngDec/include/Api.hpp"
diff --git a/core/libs/prx/libScePngEnc/Export.cpp b/core/libs/prx/libScePngEnc/Export.cpp
index c6e3c9532a..75f4ad13f1 100644
--- a/core/libs/prx/libScePngEnc/Export.cpp
+++ b/core/libs/prx/libScePngEnc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngEnc/include/Api.hpp"
 #include <algorithm>
 #include <bit>
 #include <new>
diff --git a/core/libs/prx/libScePngEnc/include/Api.hpp b/core/libs/prx/libScePngEnc/include/Api.hpp
new file mode 100644
index 0000000000..b279f174e8
--- /dev/null
+++ b/core/libs/prx/libScePngEnc/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePngEncQueryMemorySize(const PngEncCreateParam* param);
+int APS5_VABI scePngEncCreate(const PngEncCreateParam* param, void* memoryAddress, uint32_t memorySize, void** handle);
+int APS5_VABI scePngEncDelete(void* handle);
+int APS5_VABI scePngEncEncode(void* handle, const PngEncEncodeParam* param, PngEncOutputInfo* outputInfo);
+
+}
diff --git a/core/libs/prx/libScePngEnc/libScePngEnc.hpp b/core/libs/prx/libScePngEnc/libScePngEnc.hpp
new file mode 100644
index 0000000000..2355570756
--- /dev/null
+++ b/core/libs/prx/libScePngEnc/libScePngEnc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePngEnc/include/Api.hpp"
diff --git a/core/libs/prx/libScePngParser/libScePngParser.hpp b/core/libs/prx/libScePngParser/libScePngParser.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePngParser/libScePngParser.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePosixForWebKit/Export.cpp b/core/libs/prx/libScePosixForWebKit/Export.cpp
index ca47a2ecf7..6222bbb690 100644
--- a/core/libs/prx/libScePosixForWebKit/Export.cpp
+++ b/core/libs/prx/libScePosixForWebKit/Export.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/HostEntropy.hpp"
 #include "prx/libc/include/General.hpp"
@@ -161,8 +166,8 @@ char* APS5_VABI strcasestr_nid_postfix(const char* text, const char* needle) {
         const char* candidate = text;
         const char* match = needle;
         while (*candidate != '\0' && *match != '\0' &&
-               std::tolower(static_cast<unsigned char>(*candidate)) ==
-               std::tolower(static_cast<unsigned char>(*match))) {
+               FoldCase(static_cast<unsigned char>(*candidate), FnmCasefold) ==
+               FoldCase(static_cast<unsigned char>(*match), FnmCasefold)) {
             ++candidate;
             ++match;
         }
@@ -178,17 +183,16 @@ void APS5_VABI arc4random_buf_nid_postfix(void* buffer, std::size_t size) {
 std::uint32_t APS5_VABI arc4random_nid_postfix() {
     std::uint32_t value;
     arc4random_buf_nid_postfix(&value, sizeof(value));
+
     return value;
 }
 
-int APS5_VABI __wrap_access() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI __wrap_access(const char* path, int mode) {
+    return access_nid_postfix(path, mode);
 }
 
-int APS5_VABI __wrap_clock_gettime() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI __wrap_clock_gettime(int clockId, KernelTimespec* tp) {
+    return clock_gettime_nid_postfix(clockId, tp);
 }
 
 int APS5_VABI __wrap_fchown() {
@@ -196,14 +200,12 @@ int APS5_VABI __wrap_fchown() {
     return 0;
 }
 
-int APS5_VABI __wrap_getcwd() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+char* APS5_VABI __wrap_getcwd(char* buffer, std::size_t size) {
+    return getcwd_nid_postfix(buffer, size);
 }
 
-int APS5_VABI __wrap_getenv() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+char* APS5_VABI __wrap_getenv(const char* name) {
+    return getenv_nid_postfix(name);
 }
 
 int APS5_VABI __wrap_link() {
@@ -211,14 +213,12 @@ int APS5_VABI __wrap_link() {
     return 0;
 }
 
-int APS5_VABI __wrap_lstat() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI __wrap_lstat(const char* path, FileStat* sb) {
+    return lstat_nid_postfix(path, sb);
 }
 
-int APS5_VABI __wrap_mmap() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+void* APS5_VABI __wrap_mmap(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) {
+    return mmap_nid_postfix(address, length, protection, flags, descriptor, offset);
 }
 
 int APS5_VABI __wrap_readlink() {
diff --git a/core/libs/prx/libScePosixForWebKit/Filesystem.cpp b/core/libs/prx/libScePosixForWebKit/Filesystem.cpp
index a7e6f01754..10dfa7eed6 100644
--- a/core/libs/prx/libScePosixForWebKit/Filesystem.cpp
+++ b/core/libs/prx/libScePosixForWebKit/Filesystem.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -14,11 +17,6 @@ extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handle
 #include <unistd.h>
 #endif
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI open_nid_postfix(const char*, int, int);
-}
-
 namespace {
 constexpr char Characters[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 
diff --git a/core/libs/prx/libScePosixForWebKit/Resolver.cpp b/core/libs/prx/libScePosixForWebKit/Resolver.cpp
index f9b8a2acc2..6b0007a4b9 100644
--- a/core/libs/prx/libScePosixForWebKit/Resolver.cpp
+++ b/core/libs/prx/libScePosixForWebKit/Resolver.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -21,8 +23,6 @@
 #include <vector>
 #include "GuestResolver.hpp"
 
-extern "C" int* APS5_VABI sceNetErrnoLoc();
-
 namespace {
 struct HostLookup {
     GuestResolver::HostEntry entry{};
diff --git a/core/libs/prx/libScePosixForWebKit/include/Api.hpp b/core/libs/prx/libScePosixForWebKit/include/Api.hpp
new file mode 100644
index 0000000000..fdd68aa8f7
--- /dev/null
+++ b/core/libs/prx/libScePosixForWebKit/include/Api.hpp
@@ -0,0 +1,40 @@
+#pragma once
+
+#include "prx/libScePosixForWebKit/GuestResolver.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI fnmatch_nid_postfix(const char* pattern, const char* string, int flags);
+char* APS5_VABI strcasestr_nid_postfix(const char* text, const char* needle);
+void APS5_VABI arc4random_buf_nid_postfix(void* buffer, std::size_t size);
+std::uint32_t APS5_VABI arc4random_nid_postfix();
+int APS5_VABI __wrap_access(const char* path, int mode);
+int APS5_VABI __wrap_clock_gettime(int clockId, KernelTimespec* tp);
+int APS5_VABI __wrap_fchown();
+char* APS5_VABI __wrap_getcwd(char* buffer, std::size_t size);
+char* APS5_VABI __wrap_getenv(const char* name);
+int APS5_VABI __wrap_link();
+int APS5_VABI __wrap_lstat(const char* path, FileStat* sb);
+void* APS5_VABI __wrap_mmap(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset);
+int APS5_VABI __wrap_readlink();
+int APS5_VABI __wrap_statvfs();
+int APS5_VABI __wrap_symlink();
+int APS5_VABI clock_gettime_np();
+int APS5_VABI getenv_np();
+int APS5_VABI scePosixForWebKit_gethostbyname_r();
+int APS5_VABI mmap_np();
+int APS5_VABI msetname();
+int APS5_VABI pthread_setschedparam_np();
+int APS5_VABI setenv_np();
+int APS5_VABI scePosixForWebKit_sysinfo();
+int APS5_VABI mkstemp_nid_postfix(char* pattern);
+int APS5_VABI isatty_nid_postfix(int descriptor);
+GuestResolver::HostEntry* APS5_VABI gethostbyname_nid_postfix(const char* name);
+GuestResolver::ServiceEntry* APS5_VABI getservbyname_nid_postfix(const char* name, const char* protocol);
+void APS5_VABI freeaddrinfo_nid_postfix(GuestResolver::AddressInfo* first);
+int APS5_VABI getaddrinfo_nid_postfix(const char* node, const char* service, const GuestResolver::AddressInfo* hints, GuestResolver::AddressInfo** output);
+int APS5_VABI getnameinfo_nid_postfix(const void* address, std::uint32_t length, char* host, std::uint32_t hostLength, char* service, std::uint32_t serviceLength, int flags);
+const char* APS5_VABI gai_strerror_nid_postfix(int error);
+
+}
diff --git a/core/libs/prx/libScePosixForWebKit/libScePosixForWebKit.hpp b/core/libs/prx/libScePosixForWebKit/libScePosixForWebKit.hpp
new file mode 100644
index 0000000000..0f4456a5e2
--- /dev/null
+++ b/core/libs/prx/libScePosixForWebKit/libScePosixForWebKit.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePosixForWebKit/include/Api.hpp"
diff --git a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp
index d1c11f4133..45c16b6916 100644
--- a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp
+++ b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp"
 #include <mutex>
 #include <stdexcept>
 #include <string>
diff --git a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp
new file mode 100644
index 0000000000..991a8ea2d2
--- /dev/null
+++ b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceProprietaryVoiceChatHelperInitialize(void);
+int APS5_VABI sceProprietaryVoiceChatHelperTerminate(void);
+int APS5_VABI sceProprietaryVoiceChatHelperSetVoiceChatState(void);
+int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChatUsageState(void);
+int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChat(void);
+
+}
diff --git a/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/libSceProprietaryVoiceChatHelperPrx.hpp b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/libSceProprietaryVoiceChatHelperPrx.hpp
new file mode 100644
index 0000000000..9302848829
--- /dev/null
+++ b/core/libs/prx/libSceProprietaryVoiceChatHelperPrx/libSceProprietaryVoiceChatHelperPrx.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp"
diff --git a/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp b/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp
index 99db1f489a..a27fb265fc 100644
--- a/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp
+++ b/core/libs/prx/libScePs2EmuMenuDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePs2EmuMenuDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePs2EmuMenuDialog/include/Api.hpp b/core/libs/prx/libScePs2EmuMenuDialog/include/Api.hpp
new file mode 100644
index 0000000000..de66779d90
--- /dev/null
+++ b/core/libs/prx/libScePs2EmuMenuDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePs2EmuMenuDialogClose();
+int APS5_VABI scePs2EmuMenuDialogGetResult();
+int APS5_VABI scePs2EmuMenuDialogGetStatus();
+int APS5_VABI scePs2EmuMenuDialogInitialize();
+int APS5_VABI scePs2EmuMenuDialogOpen();
+int APS5_VABI scePs2EmuMenuDialogTerminate();
+int APS5_VABI scePs2EmuMenuDialogUpdateStatus();
+
+}
diff --git a/core/libs/prx/libScePs2EmuMenuDialog/libScePs2EmuMenuDialog.hpp b/core/libs/prx/libScePs2EmuMenuDialog/libScePs2EmuMenuDialog.hpp
new file mode 100644
index 0000000000..f09948b438
--- /dev/null
+++ b/core/libs/prx/libScePs2EmuMenuDialog/libScePs2EmuMenuDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePs2EmuMenuDialog/include/Api.hpp"
diff --git a/core/libs/prx/libScePsm/libScePsm.hpp b/core/libs/prx/libScePsm/libScePsm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePsm/libScePsm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePsmUtil/Export.cpp b/core/libs/prx/libScePsmUtil/Export.cpp
index 0a7d7939be..422f3863b3 100644
--- a/core/libs/prx/libScePsmUtil/Export.cpp
+++ b/core/libs/prx/libScePsmUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePsmUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libScePsmUtil/include/Api.hpp b/core/libs/prx/libScePsmUtil/include/Api.hpp
new file mode 100644
index 0000000000..15c45087d9
--- /dev/null
+++ b/core/libs/prx/libScePsmUtil/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI scePsmUtilFinalize();
+int APS5_VABI scePsmUtilGetPsmIniFile();
+int APS5_VABI scePsmUtilInitialize();
+int APS5_VABI scePsmUtilRegisterCallbacks();
+
+}
diff --git a/core/libs/prx/libScePsmUtil/libScePsmUtil.hpp b/core/libs/prx/libScePsmUtil/libScePsmUtil.hpp
new file mode 100644
index 0000000000..5c21b12f80
--- /dev/null
+++ b/core/libs/prx/libScePsmUtil/libScePsmUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePsmUtil/include/Api.hpp"
diff --git a/core/libs/prx/libScePsml/libScePsml.hpp b/core/libs/prx/libScePsml/libScePsml.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libScePsml/libScePsml.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libScePsml_debug/Export.cpp b/core/libs/prx/libScePsml_debug/Export.cpp
index 44021762c2..3de9fc4bf6 100644
--- a/core/libs/prx/libScePsml_debug/Export.cpp
+++ b/core/libs/prx/libScePsml_debug/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePsml_debug/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <atomic>
@@ -21,84 +22,12 @@ constexpr std::uint64_t MfsrBlockCount = 4;
 constexpr std::uint32_t MfsrDispatchPacketDwords = 0x600;
 constexpr std::uint64_t MfsrSharedBlockCount = 52;
 
-struct MfsrRequirement {
- std::uint64_t blockBytes;
- std::uint64_t alignment;
- std::uint64_t blockCount;
-};
-
-struct MfsrBlock {
- std::uint64_t address;
- std::uint64_t bytes;
-};
-
-struct MfsrSharedResourcesParam {
- std::uint32_t type;
- std::uint32_t reserved;
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint64_t reserved2;
-};
-
-struct Mfsr2SharedResourcesParam {
- std::uint32_t type;
- std::uint32_t reserved0;
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint16_t width;
- std::uint16_t height;
- std::uint32_t reserved1;
-};
-
 static_assert(sizeof(Mfsr2SharedResourcesParam) == 32);
 static_assert(offsetof(Mfsr2SharedResourcesParam, blocks) == 8);
 static_assert(offsetof(Mfsr2SharedResourcesParam, blockCount) == 16);
 static_assert(offsetof(Mfsr2SharedResourcesParam, width) == 24);
 static_assert(offsetof(Mfsr2SharedResourcesParam, reserved1) == 28);
 
-struct Mfsr2ContextParam {
- std::uint32_t profile;
- std::uint32_t reserved0;
- void* sharedResources;
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint64_t reserved1;
- std::uint16_t outputWidth;
- std::uint16_t outputHeight;
- std::uint32_t inputColorSpace;
-};
-
-struct MfsrCommandBuffer {
- std::uint32_t* cursor;
- std::uint32_t sizeInDwords;
-};
-
-struct MfsrTextureDescriptor {
- std::uint32_t words[8];
-};
-
-struct Mfsr2DispatchParam {
- const MfsrTextureDescriptor* outputColor;
- const MfsrTextureDescriptor* color;
- const MfsrTextureDescriptor* motionVectors;
- const MfsrTextureDescriptor* depth;
- const MfsrTextureDescriptor* exposure;
- std::uint64_t reserved0;
- float preExposure;
- std::uint32_t renderX;
- std::uint32_t renderY;
- std::uint32_t renderWidth;
- std::uint32_t renderHeight;
- float jitter[2];
- float motionVectorScale[2];
- float motionVectorOffset[2];
- float depthRange[2];
- std::uint8_t resetHistory;
- std::uint8_t reserved1[3];
- std::uint32_t optionFlags;
- float sharpness;
-};
-
 static_assert(sizeof(Mfsr2ContextParam) == 48);
 static_assert(offsetof(Mfsr2ContextParam, sharedResources) == 8);
 static_assert(offsetof(Mfsr2ContextParam, blocks) == 16);
@@ -117,19 +46,6 @@ static_assert(offsetof(Mfsr2DispatchParam, resetHistory) == 100);
 static_assert(offsetof(Mfsr2DispatchParam, optionFlags) == 104);
 static_assert(offsetof(Mfsr2DispatchParam, sharpness) == 108);
 
-struct MfsrContextParam {
- std::uint32_t reserved0[2];
- const MfsrBlock* blocks;
- std::uint64_t blockCount;
- std::uint16_t inputWidth;
- std::uint16_t inputHeight;
- std::uint32_t reserved1;
- const void* descriptor0;
- const void* descriptor1;
- std::uint32_t reserved2[2];
- void* sharedResources;
-};
-
 static_assert(sizeof(MfsrRequirement) == 0x18);
 static_assert(sizeof(MfsrSharedResourcesParam) == 0x20);
 static_assert(offsetof(MfsrContextParam, blocks) == 0x08);
diff --git a/core/libs/prx/libScePsml_debug/include/Api.hpp b/core/libs/prx/libScePsml_debug/include/Api.hpp
new file mode 100644
index 0000000000..84c5817117
--- /dev/null
+++ b/core/libs/prx/libScePsml_debug/include/Api.hpp
@@ -0,0 +1,133 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <atomic>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <utility>
+
+struct MfsrRequirement {
+ std::uint64_t blockBytes;
+ std::uint64_t alignment;
+ std::uint64_t blockCount;
+};
+
+struct MfsrBlock {
+ std::uint64_t address;
+ std::uint64_t bytes;
+};
+
+struct MfsrSharedResourcesParam {
+ std::uint32_t type;
+ std::uint32_t reserved;
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint64_t reserved2;
+};
+
+struct Mfsr2SharedResourcesParam {
+ std::uint32_t type;
+ std::uint32_t reserved0;
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint16_t width;
+ std::uint16_t height;
+ std::uint32_t reserved1;
+};
+
+struct Mfsr2ContextParam {
+ std::uint32_t profile;
+ std::uint32_t reserved0;
+ void* sharedResources;
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint64_t reserved1;
+ std::uint16_t outputWidth;
+ std::uint16_t outputHeight;
+ std::uint32_t inputColorSpace;
+};
+
+struct MfsrCommandBuffer {
+ std::uint32_t* cursor;
+ std::uint32_t sizeInDwords;
+};
+
+struct MfsrTextureDescriptor {
+ std::uint32_t words[8];
+};
+
+struct Mfsr2DispatchParam {
+ const MfsrTextureDescriptor* outputColor;
+ const MfsrTextureDescriptor* color;
+ const MfsrTextureDescriptor* motionVectors;
+ const MfsrTextureDescriptor* depth;
+ const MfsrTextureDescriptor* exposure;
+ std::uint64_t reserved0;
+ float preExposure;
+ std::uint32_t renderX;
+ std::uint32_t renderY;
+ std::uint32_t renderWidth;
+ std::uint32_t renderHeight;
+ float jitter[2];
+ float motionVectorScale[2];
+ float motionVectorOffset[2];
+ float depthRange[2];
+ std::uint8_t resetHistory;
+ std::uint8_t reserved1[3];
+ std::uint32_t optionFlags;
+ float sharpness;
+};
+
+struct MfsrContextParam {
+ std::uint32_t reserved0[2];
+ const MfsrBlock* blocks;
+ std::uint64_t blockCount;
+ std::uint16_t inputWidth;
+ std::uint16_t inputHeight;
+ std::uint32_t reserved1;
+ const void* descriptor0;
+ const void* descriptor1;
+ std::uint32_t reserved2[2];
+ void* sharedResources;
+};
+
+extern "C" {
+
+std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement1100(void* requirement, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrCreateContext1100(void** context, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1100(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrInit();
+std::int32_t APS5_VABI scePsmlMfsrGetSharedResourcesInitRequirement(MfsrRequirement* requirement, const MfsrSharedResourcesParam* param);
+std::int32_t APS5_VABI scePsmlMfsrCreateSharedResources(void** sharedResources, const MfsrSharedResourcesParam* param);
+std::int32_t APS5_VABI scePsmlMfsrReleaseSharedResources(void* sharedResources);
+std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement800M3_2(MfsrRequirement* requirement, const MfsrContextParam* param);
+std::int32_t APS5_VABI scePsmlMfsrCreateContext800M3_2(void** context, const MfsrContextParam* param);
+std::int32_t APS5_VABI scePsmlMfsrReleaseContext(void* context);
+std::int32_t APS5_VABI scePsmlMfsrCreateContext1300(void** context, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1300(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacketSizeInDwords(void* context, std::uint32_t* packetSizeInDwords);
+std::int32_t APS5_VABI scePsmlMfsrSelectConfig(void* config);
+std::int32_t APS5_VABI scePsmlMfsrGetMipmapBias(void* context, float* bias, std::uint32_t dimension);
+std::int32_t APS5_VABI scePsmlMfsrRequestCapture(void* context);
+std::int32_t APS5_VABI scePsmlMfsrIsCaptureInProgress(void* context);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1000(void* context, void* commandBuffer, const void* param);
+std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket900(void* context, void* commandBuffer, const void* param);
+int APS5_VABI scePsmlMfsr2ReleaseSharedResources(void* sharedResources);
+int APS5_VABI scePsmlMfsr2GetSharedResourcesInitRequirement(MfsrRequirement* requirement, const Mfsr2SharedResourcesParam* param);
+int APS5_VABI scePsmlMfsr2GetContextInitRequirement(MfsrRequirement* requirement, const Mfsr2ContextParam* param);
+int APS5_VABI scePsmlMfsr2ReleaseContext(void* context);
+int APS5_VABI scePsmlMfsr2GetDispatchPacketsSizeInDwords();
+int APS5_VABI scePsmlMfsr2CreateSharedResources(void** sharedResources, const Mfsr2SharedResourcesParam* param);
+int APS5_VABI scePsmlMfsr2GetDispatchPackets(void* context, const MfsrCommandBuffer* commandBuffer, const Mfsr2DispatchParam* param);
+int APS5_VABI scePsmlMfsr2CreateContext(void** context, const Mfsr2ContextParam* param);
+int APS5_VABI scePsmlMfsr2Init();
+int APS5_VABI scePsmlMfsrEnableSpecularAA();
+int APS5_VABI scePsmlMfsrEnableQuality8K();
+
+}
diff --git a/core/libs/prx/libScePsml_debug/libScePsml_debug.hpp b/core/libs/prx/libScePsml_debug/libScePsml_debug.hpp
new file mode 100644
index 0000000000..fc5eb2ba99
--- /dev/null
+++ b/core/libs/prx/libScePsml_debug/libScePsml_debug.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libScePsml_debug/include/Api.hpp"
diff --git a/core/libs/prx/libSceRandom/Export.cpp b/core/libs/prx/libSceRandom/Export.cpp
index c61ffc4d53..2fcda9cfb5 100644
--- a/core/libs/prx/libSceRandom/Export.cpp
+++ b/core/libs/prx/libSceRandom/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRandom/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceRandom/include/Api.hpp b/core/libs/prx/libSceRandom/include/Api.hpp
new file mode 100644
index 0000000000..ac26ff0d3b
--- /dev/null
+++ b/core/libs/prx/libSceRandom/include/Api.hpp
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRandomGetRandomNumber(void* buf, size_t size);
+
+}
diff --git a/core/libs/prx/libSceRandom/libSceRandom.hpp b/core/libs/prx/libSceRandom/libSceRandom.hpp
new file mode 100644
index 0000000000..1697eb1bee
--- /dev/null
+++ b/core/libs/prx/libSceRandom/libSceRandom.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRandom/include/Api.hpp"
diff --git a/core/libs/prx/libSceRazorCpu/Export.cpp b/core/libs/prx/libSceRazorCpu/Export.cpp
index defd9d798b..5c8e4f8df9 100644
--- a/core/libs/prx/libSceRazorCpu/Export.cpp
+++ b/core/libs/prx/libSceRazorCpu/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRazorCpu/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceRazorCpu/include/Api.hpp b/core/libs/prx/libSceRazorCpu/include/Api.hpp
new file mode 100644
index 0000000000..1e6b94daff
--- /dev/null
+++ b/core/libs/prx/libSceRazorCpu/include/Api.hpp
@@ -0,0 +1,43 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+uint32_t APS5_VABI sceRazorCpuIsCapturing(void);
+int APS5_VABI sceRazorCpuJobManagerDispatch(const char* label, uint16_t firstId, uint16_t secondId, uint16_t firstCount, uint16_t secondCount, uint64_t firstValue, uint64_t secondValue);
+int APS5_VABI sceRazorCpuJobManagerJob(uint16_t firstId, uint16_t secondId, uint16_t thirdId, uint16_t event);
+int APS5_VABI sceRazorCpuJobManagerSequence(const char* label, uint16_t firstId, uint16_t secondId, uint16_t event);
+int APS5_VABI sceRazorCpuPushMarker(const char* label, uint32_t color, uint32_t flags);
+int APS5_VABI sceRazorCpuNamedSync(const char* label);
+int APS5_VABI sceRazorCpuPushMarkerStatic(const char* name, uint32_t color, uint32_t flags);
+int APS5_VABI sceRazorCpuPopMarker(void);
+bool APS5_VABI sceRazorCpuFlushOccurred(uint64_t* timeSpentInFlush);
+int APS5_VABI sceRazorCpuPlotValue(const char* series, float value);
+int APS5_VABI sceRazorCpuWriteBookmark(const char* label, const char* description);
+int APS5_VABI sceRazorCpuSync(void);
+void APS5_VABI sceRazorCpuDisableFiberUserMarkers(void);
+int APS5_VABI sceRazorCpuInitDataTags(void* buffer, size_t size);
+int APS5_VABI sceRazorCpuShutdownDataTags(void);
+size_t APS5_VABI sceRazorCpuGetDataTagStorageSize(uint32_t tagCount);
+int APS5_VABI sceRazorCpuTagArray(const char* label, uint32_t category, void* array, size_t bufferSize, size_t elementSize);
+int APS5_VABI sceRazorCpuTagBuffer(const char* label, uint32_t category, void* buffer, size_t bufferSize);
+int APS5_VABI sceRazorCpuResizeTaggedBuffer(uint32_t category, void* buffer, size_t newBufferSize);
+int APS5_VABI sceRazorCpuUnTagBuffer(uint32_t category, void* buffer);
+int APS5_VABI sceRazorCpuBeginLogicalFileAccess(const char* filename, uint64_t tag, uint64_t size, uint8_t operation);
+int APS5_VABI sceRazorCpuEndLogicalFileAccess(void);
+int APS5_VABI sceRazorCpuFiberLogNameChange(void);
+int APS5_VABI sceRazorCpuFiberSwitch(void);
+int APS5_VABI sceRazorCpuGpuMarkerSync(void);
+int APS5_VABI sceRazorCpuInitializeGpuMarkerContext(void);
+int APS5_VABI sceRazorCpuInitializeInternal(void);
+int APS5_VABI sceRazorCpuSetPopMarkerCallback(void);
+int APS5_VABI sceRazorCpuSetPushMarkerCallback(void);
+int APS5_VABI sceRazorCpuSetPushMarkerStaticCallback(void);
+int APS5_VABI sceRazorCpuStartCaptureInternal(void);
+int APS5_VABI sceRazorCpuStopCaptureInternal(void);
+int APS5_VABI sceRazorCpuWorkloadRunBegin(void);
+int APS5_VABI sceRazorCpuWorkloadRunEnd(void);
+int APS5_VABI sceRazorCpuWorkloadSubmit(void);
+
+}
diff --git a/core/libs/prx/libSceRazorCpu/libSceRazorCpu.hpp b/core/libs/prx/libSceRazorCpu/libSceRazorCpu.hpp
new file mode 100644
index 0000000000..a734b0b85a
--- /dev/null
+++ b/core/libs/prx/libSceRazorCpu/libSceRazorCpu.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRazorCpu/include/Api.hpp"
diff --git a/core/libs/prx/libSceRazorCpu_debug/libSceRazorCpu_debug.hpp b/core/libs/prx/libSceRazorCpu_debug/libSceRazorCpu_debug.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceRazorCpu_debug/libSceRazorCpu_debug.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRegMgr/Export.cpp b/core/libs/prx/libSceRegMgr/Export.cpp
index 9d71463de6..d1efe47018 100644
--- a/core/libs/prx/libSceRegMgr/Export.cpp
+++ b/core/libs/prx/libSceRegMgr/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRegMgr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceRegMgr/include/Api.hpp b/core/libs/prx/libSceRegMgr/include/Api.hpp
new file mode 100644
index 0000000000..91e57f01f1
--- /dev/null
+++ b/core/libs/prx/libSceRegMgr/include/Api.hpp
@@ -0,0 +1,73 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRegMgrGetBin(std::uint32_t optionId, void* data, std::size_t size);
+int APS5_VABI sceRegMgrGetInt(int32_t optionId, int32_t* outInt);
+int APS5_VABI sceRegMgrGetStr(int32_t optionId, char* outString, std::size_t stringLength);
+int APS5_VABI sceRegMgrSetBin(std::uint32_t optionId, const void* data, std::size_t size);
+int APS5_VABI sceRegMgrSetInt(int32_t optionId, int32_t inInt);
+int APS5_VABI sceRegMgrSetStr(int32_t optionId, const char* inStirng, std::size_t stringLength);
+std::int32_t APS5_VABI sceRegMgrNonSysGetInt(std::int64_t key, std::int32_t unk, std::int32_t* data);
+int APS5_VABI sceRegMgrCheckError(void);
+int APS5_VABI sceRegMgrCheckIntVal(void);
+int APS5_VABI sceRegMgrGetBinInitVal(void);
+int APS5_VABI sceRegMgrGetIntInitVal(void);
+int APS5_VABI sceRegMgrGetStrInitVal(void);
+int APS5_VABI sceRegMgrGetVersion(void);
+int APS5_VABI sceRegMgrIsChange(void);
+int APS5_VABI sceRegMgrEvtGetCnt(void);
+int APS5_VABI sceRegMgrEvtGetRegId(void);
+int APS5_VABI sceRegMgrResetVal(void);
+int APS5_VABI sceRegMgrSetInitLevel(void);
+int APS5_VABI sceRegMgrSrvCnvRegionInt(void);
+int APS5_VABI sceRegMgrSrvCnvRegionStr(void);
+int APS5_VABI sceRegMgrSrvGetMachineType(void);
+int APS5_VABI sceRegMgrSrvGetQAFforReg(void);
+int APS5_VABI sceRegMgrSrvGetRealMachineType(void);
+int APS5_VABI sceRegMgrSrvGetRegion(void);
+int APS5_VABI sceRegMgrSrvGetRegionStr(void);
+int APS5_VABI sceRegMgrBackupNeedMem(void);
+int APS5_VABI sceRegMgrBackupPullData(void);
+int APS5_VABI sceRegMgrBackupPushData(void);
+int APS5_VABI sceRegMgrBackupPullDataGkp(void);
+int APS5_VABI sceRegMgrBackupPushDataGkp(void);
+int APS5_VABI sceRegMgrCntlStart(void);
+int APS5_VABI sceRegMgrCntlDeleteReg(void);
+int APS5_VABI sceRegMgrCntlGetFilesCount(void);
+int APS5_VABI sceRegMgrCntlGetFileName(void);
+int APS5_VABI sceRegMgrCntSetInitReinst(void);
+int APS5_VABI sceRegMgrIsInitOK(void);
+int APS5_VABI sceRegMgrGetInitError(void);
+int APS5_VABI sceRegMgrRecoverRegNvs(void);
+int APS5_VABI sceRegMgrNonSysCheckError(void);
+int APS5_VABI sceRegMgrNonSysGetBin(void);
+int APS5_VABI sceRegMgrNonSysGetStr(void);
+int APS5_VABI sceRegMgrNonSysSetBin(void);
+int APS5_VABI sceRegMgrNonSysSetInt(void);
+int APS5_VABI sceRegMgrNonSysSetStr(void);
+int APS5_VABI sceRegMgrGetVersionForPS4(void);
+int APS5_VABI sceRegMgrBackupNeedMemForPS4(void);
+int APS5_VABI sceRegMgrBackupPullDataForPS4(void);
+int APS5_VABI sceRegMgrBackupPushDataForPS4(void);
+int APS5_VABI sceRegMgrEvtGetCntForPS4(void);
+int APS5_VABI sceRegMgrEvtGetRegIdForPS4(void);
+int APS5_VABI sceRegMgrStrncpy(void);
+int APS5_VABI sceRegMgrMemset(void);
+int APS5_VABI sceRegMgrSetbin(void);
+int APS5_VABI sceRegMgrToolGetUpdateCnt(void);
+int APS5_VABI sceRegMgrToolGetEntryCnt(void);
+int APS5_VABI sceRegMgrToolDataCheckGet(void);
+int APS5_VABI sceRegMgrDrvGetUpdateCnt(void);
+int APS5_VABI sceRegMgrDrvGetEntCnt(void);
+int APS5_VABI sceRegMgrDrvDataOpen(void);
+int APS5_VABI sceRegMgrDrvDataCheckGet(void);
+int APS5_VABI sceRegMgrDrvDataClose(void);
+int APS5_VABI sceRegMgrToolGetInfo(void);
+int APS5_VABI sceRegMgrLogPull(void);
+int APS5_VABI sceRegMgrCntlStopHdd(void);
+int APS5_VABI sceRegMgrPrintInfo(void);
+
+}
diff --git a/core/libs/prx/libSceRegMgr/libSceRegMgr.hpp b/core/libs/prx/libSceRegMgr/libSceRegMgr.hpp
new file mode 100644
index 0000000000..28b2427f86
--- /dev/null
+++ b/core/libs/prx/libSceRegMgr/libSceRegMgr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRegMgr/include/Api.hpp"
diff --git a/core/libs/prx/libSceRemotePlayClientIpc/libSceRemotePlayClientIpc.hpp b/core/libs/prx/libSceRemotePlayClientIpc/libSceRemotePlayClientIpc.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceRemotePlayClientIpc/libSceRemotePlayClientIpc.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRemoteplay/Export.cpp b/core/libs/prx/libSceRemoteplay/Export.cpp
index bc653c840f..c398ec2033 100644
--- a/core/libs/prx/libSceRemoteplay/Export.cpp
+++ b/core/libs/prx/libSceRemoteplay/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRemoteplay/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <stdexcept>
diff --git a/core/libs/prx/libSceRemoteplay/include/Api.hpp b/core/libs/prx/libSceRemoteplay/include/Api.hpp
new file mode 100644
index 0000000000..a36c070176
--- /dev/null
+++ b/core/libs/prx/libSceRemoteplay/include/Api.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRemoteplayGetConnectionStatus(int userId, int* status);
+int APS5_VABI sceRemoteplayInitialize(void* heap, size_t heapSize);
+int APS5_VABI sceRemoteplayTerminate(void);
+int APS5_VABI sceRemoteplayApprove(void);
+int APS5_VABI sceRemoteplayClearAllRegistData(void);
+int APS5_VABI sceRemoteplayClearConnectHistory(void);
+int APS5_VABI sceRemoteplayConfirmDeviceRegist(void);
+int APS5_VABI sceRemoteplayDisconnect(void);
+int APS5_VABI sceRemoteplayGeneratePinCode(void);
+int APS5_VABI sceRemoteplayGetApMode(void);
+int APS5_VABI sceRemoteplayGetConnectHistory(void);
+int APS5_VABI sceRemoteplayGetConnectUserId(void);
+int APS5_VABI sceRemoteplayGetMbusDeviceInfo(void);
+int APS5_VABI sceRemoteplayGetOperationStatus(void);
+int APS5_VABI sceRemoteplayGetPrimaryUserId(void);
+int APS5_VABI sceRemoteplayGetRemoteplayStatus(void);
+int APS5_VABI sceRemoteplayGetRpMode(void);
+int APS5_VABI sceRemoteplayImeClose(void);
+int APS5_VABI sceRemoteplayImeFilterResult(void);
+int APS5_VABI sceRemoteplayImeGetEvent(void);
+int APS5_VABI sceRemoteplayImeNotify(void);
+int APS5_VABI sceRemoteplayImeNotifyEventResult(void);
+int APS5_VABI sceRemoteplayImeOpen(void);
+int APS5_VABI sceRemoteplayImeSetCaret(void);
+int APS5_VABI sceRemoteplayImeSetText(void);
+int APS5_VABI sceRemoteplayIsRemoteOskReady(void);
+int APS5_VABI sceRemoteplayIsRemotePlaying(void);
+int APS5_VABI sceRemoteplayNotifyMbusDeviceRegistComplete(void);
+int APS5_VABI sceRemoteplayNotifyNpPushWakeup(void);
+int APS5_VABI sceRemoteplayNotifyPinCodeError(void);
+int APS5_VABI sceRemoteplayNotifySubmitCode(void);
+int APS5_VABI sceRemoteplayNotifyUserDelete(void);
+int APS5_VABI sceRemoteplayPrintAllRegistData(void);
+int APS5_VABI sceRemoteplayProhibit(void);
+int APS5_VABI sceRemoteplayProhibitStreaming(void);
+int APS5_VABI sceRemoteplayServerLock(void);
+int APS5_VABI sceRemoteplayServerUnLock(void);
+int APS5_VABI sceRemoteplaySetApMode(void);
+int APS5_VABI sceRemoteplaySetLogLevel(void);
+int APS5_VABI sceRemoteplaySetProhibition(void);
+int APS5_VABI sceRemoteplaySetProhibitionForVsh(void);
+int APS5_VABI sceRemoteplaySetRpMode(void);
+
+}
diff --git a/core/libs/prx/libSceRemoteplay/libSceRemoteplay.hpp b/core/libs/prx/libSceRemoteplay/libSceRemoteplay.hpp
new file mode 100644
index 0000000000..a04f3f394f
--- /dev/null
+++ b/core/libs/prx/libSceRemoteplay/libSceRemoteplay.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRemoteplay/include/Api.hpp"
diff --git a/core/libs/prx/libSceResourceArbitrator/libSceResourceArbitrator.hpp b/core/libs/prx/libSceResourceArbitrator/libSceResourceArbitrator.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceResourceArbitrator/libSceResourceArbitrator.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRnpsAppMgr/Export.cpp b/core/libs/prx/libSceRnpsAppMgr/Export.cpp
index d81f4a5e32..389f33546a 100644
--- a/core/libs/prx/libSceRnpsAppMgr/Export.cpp
+++ b/core/libs/prx/libSceRnpsAppMgr/Export.cpp
@@ -1,10 +1,144 @@
-#include <cstddef>
+#include "prx/libSceRnpsAppMgr/include/Api.hpp"
 #include <cstdint>
+#include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceRnpsAppMgrBlockAppInstall() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrCreateUpdateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrCreateUrlRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrDestroyBundle() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrDestroyUpdateRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrFinishUrlRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrGetAppInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrGetAppInfoDebugString() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrGetAppInfoList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrGetEventForShellUI() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrGetUpdateProgress() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrHasEventForShellUI() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrPushEventForShellUI() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrRecoverUfsImage() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrRegisterShellUI() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrRemoveApp() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrRemoveAppOnSystemShutdown() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrRemoveUfsImageOnSystemShutdown() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrRequestUpdateCheck() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrSetCrlUrl() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrSetEventFlagForClients() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrSetUpdateUrl() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrStartService() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrTerminate() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrUnblockAppInstall() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceRnpsAppMgrUnregisterShellUI() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 
 }
diff --git a/core/libs/prx/libSceRnpsAppMgr/include/Api.hpp b/core/libs/prx/libSceRnpsAppMgr/include/Api.hpp
new file mode 100644
index 0000000000..95fc2a3856
--- /dev/null
+++ b/core/libs/prx/libSceRnpsAppMgr/include/Api.hpp
@@ -0,0 +1,35 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRnpsAppMgrBlockAppInstall();
+int APS5_VABI sceRnpsAppMgrCreateUpdateRequest();
+int APS5_VABI sceRnpsAppMgrCreateUrlRequest();
+int APS5_VABI sceRnpsAppMgrDestroyBundle();
+int APS5_VABI sceRnpsAppMgrDestroyUpdateRequest();
+int APS5_VABI sceRnpsAppMgrFinishUrlRequest();
+int APS5_VABI sceRnpsAppMgrGetAppInfo();
+int APS5_VABI sceRnpsAppMgrGetAppInfoDebugString();
+int APS5_VABI sceRnpsAppMgrGetAppInfoList();
+int APS5_VABI sceRnpsAppMgrGetEventForShellUI();
+int APS5_VABI sceRnpsAppMgrGetUpdateProgress();
+int APS5_VABI sceRnpsAppMgrHasEventForShellUI();
+int APS5_VABI sceRnpsAppMgrInitialize();
+int APS5_VABI sceRnpsAppMgrPushEventForShellUI();
+int APS5_VABI sceRnpsAppMgrRecoverUfsImage();
+int APS5_VABI sceRnpsAppMgrRegisterShellUI();
+int APS5_VABI sceRnpsAppMgrRemoveApp();
+int APS5_VABI sceRnpsAppMgrRemoveAppOnSystemShutdown();
+int APS5_VABI sceRnpsAppMgrRemoveUfsImageOnSystemShutdown();
+int APS5_VABI sceRnpsAppMgrRequestUpdateCheck();
+int APS5_VABI sceRnpsAppMgrSetCrlUrl();
+int APS5_VABI sceRnpsAppMgrSetEventFlagForClients();
+int APS5_VABI sceRnpsAppMgrSetUpdateUrl();
+int APS5_VABI sceRnpsAppMgrStartService();
+int APS5_VABI sceRnpsAppMgrTerminate();
+int APS5_VABI sceRnpsAppMgrUnblockAppInstall();
+int APS5_VABI sceRnpsAppMgrUnregisterShellUI();
+
+}
diff --git a/core/libs/prx/libSceRnpsAppMgr/libSceRnpsAppMgr.hpp b/core/libs/prx/libSceRnpsAppMgr/libSceRnpsAppMgr.hpp
new file mode 100644
index 0000000000..9fc9484de9
--- /dev/null
+++ b/core/libs/prx/libSceRnpsAppMgr/libSceRnpsAppMgr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRnpsAppMgr/include/Api.hpp"
diff --git a/core/libs/prx/libSceRnpsNKInjectedBundle/libSceRnpsNKInjectedBundle.hpp b/core/libs/prx/libSceRnpsNKInjectedBundle/libSceRnpsNKInjectedBundle.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceRnpsNKInjectedBundle/libSceRnpsNKInjectedBundle.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceRtc/CMakeLists.txt b/core/libs/prx/libSceRtc/CMakeLists.txt
index e0b93b163e..1411d4f936 100644
--- a/core/libs/prx/libSceRtc/CMakeLists.txt
+++ b/core/libs/prx/libSceRtc/CMakeLists.txt
@@ -1,4 +1,5 @@
 add_library(libSceRtc SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_link_libraries(libSceRtc PRIVATE libkernel libc)
 target_include_directories(libSceRtc PRIVATE ${LIBS_INCLUDE_DIR})
 configure_windows_unwind(libSceRtc)
 
@@ -8,8 +9,9 @@ if(BUILD_TESTING)
     target_link_libraries(guest_rtc_tests PRIVATE libSceRtc libc)
     configure_windows_unwind(guest_rtc_tests)
     add_test(NAME guest_rtc COMMAND guest_rtc_tests)
+    add_test(NAME guest_rtc_ps5_title COMMAND guest_rtc_tests ps5-title)
     if(WIN32)
-        set_tests_properties(guest_rtc PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_rtc guest_rtc_ps5_title PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceRtc>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceRtc/Export.cpp b/core/libs/prx/libSceRtc/Export.cpp
index 3cc3b045de..91c6591395 100644
--- a/core/libs/prx/libSceRtc/Export.cpp
+++ b/core/libs/prx/libSceRtc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRtc/include/Rtc.hpp"
 #include <chrono>
 #include <cstdint>
 #include <cstddef>
@@ -6,8 +7,12 @@
 #include <ctime>
 #include <limits>
 #include <mutex>
+#include <stdexcept>
+#include <string_view>
 #include "SceTypes.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 
 namespace {
 
@@ -31,6 +36,7 @@ constexpr std::int64_t WIN32_EPOCH_DAYS = 584388;
 constexpr std::uint64_t UNIX_EPOCH_TICK = UNIX_EPOCH_DAYS * TICKS_PER_DAY;
 constexpr std::uint64_t WIN32_EPOCH_TICK = WIN32_EPOCH_DAYS * TICKS_PER_DAY;
 constexpr std::uint64_t MAX_TICK = 3652059ull * TICKS_PER_DAY - 1;
+constexpr std::uint32_t RANGE_CHECKED_SDK_VERSION = 0x03000000;
 
 struct ClockState {
     std::uint64_t tick = 0;
@@ -100,6 +106,26 @@ RtcDateTime fromTick(std::uint64_t tick) {
         static_cast<std::uint16_t>(timeOfDay % TICKS_PER_MINUTE / TICKS_PER_SECOND), static_cast<std::uint32_t>(timeOfDay % TICKS_PER_SECOND)};
 }
 
+bool ps4Title() {
+    try {
+        const auto titleId = GetAppTitleId_nid_postfix();
+        return std::string_view(titleId.value, strnlen(titleId.value, sizeof(titleId.value))).substr(0, 4) == "CUSA";
+    } catch (const std::runtime_error&) {
+        return false;
+    } catch (const std::length_error&) {
+        return false;
+    }
+}
+
+bool rangeChecked() {
+    static const bool ps4 = ps4Title();
+    if (!ps4) return true;
+    const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t version;
+    std::memcpy(&version, process + 16, sizeof(version));
+    return version >= RANGE_CHECKED_SDK_VERSION;
+}
+
 std::uint64_t currentTick(std::size_t clock = 0) {
     ClockState state;
     {
@@ -370,8 +396,13 @@ int APS5_VABI sceRtcGetDaysInMonth(int year, int month) {
 }
 
 int APS5_VABI sceRtcGetDayOfWeek(int year, int month, int day) {
-    if (year < 1 || year > 9999) return SCE_RTC_ERROR_INVALID_YEAR;
-    if (month < 1 || month > 12) return SCE_RTC_ERROR_INVALID_MONTH;
+    if (rangeChecked()) {
+        if (month < 1 || month > 12) return SCE_RTC_ERROR_INVALID_MONTH;
+        if (year < 1 || year > 9999) return SCE_RTC_ERROR_INVALID_YEAR;
+    } else {
+        if (year < 1) return SCE_RTC_ERROR_INVALID_YEAR;
+        if (month < 1 || month > 12) return SCE_RTC_ERROR_INVALID_MONTH;
+    }
     if (day < 1 || day > daysInMonth(year, month)) return SCE_RTC_ERROR_INVALID_DAY;
     return static_cast<int>((daysFromCivil(year, static_cast<unsigned>(month), static_cast<unsigned>(day)) + 1) % 7);
 }
@@ -389,7 +420,6 @@ int APS5_VABI sceRtcGetTick(const RtcDateTime* time, RtcTick* tick) {
 
 int APS5_VABI sceRtcSetTick(RtcDateTime* time, const RtcTick* tick) {
     if (!time || !tick) return SCE_RTC_ERROR_INVALID_POINTER;
-    if (tick->tick > MAX_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
     *time = fromTick(tick->tick);
     return 0;
 }
@@ -442,15 +472,22 @@ int APS5_VABI sceRtcGetTime_t(const RtcDateTime* time, int64_t* seconds) {
     if (!seconds) return SCE_RTC_ERROR_INVALID_POINTER;
     if (const int result = validate(time); result != 0) return result;
     const std::uint64_t tick = toTick(*time);
-    if (tick < UNIX_EPOCH_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
+    if (tick < UNIX_EPOCH_TICK) {
+        *seconds = 0;
+        return SCE_RTC_ERROR_INVALID_YEAR;
+    }
     *seconds = static_cast<int64_t>((tick - UNIX_EPOCH_TICK) / TICKS_PER_SECOND);
     return 0;
 }
 
 int APS5_VABI sceRtcSetTime_t(RtcDateTime* time, int64_t seconds) {
     if (!time) return SCE_RTC_ERROR_INVALID_POINTER;
-    if (seconds < 0 || static_cast<std::uint64_t>(seconds) > (MAX_TICK - UNIX_EPOCH_TICK) / TICKS_PER_SECOND) return SCE_RTC_ERROR_INVALID_VALUE;
-    *time = fromTick(UNIX_EPOCH_TICK + static_cast<std::uint64_t>(seconds) * TICKS_PER_SECOND);
+    if (rangeChecked()) {
+        if (seconds < 0) return SCE_RTC_ERROR_INVALID_VALUE;
+        *time = fromTick(UNIX_EPOCH_TICK + static_cast<std::uint64_t>(seconds) * TICKS_PER_SECOND);
+        return 0;
+    }
+    *time = fromTick(UNIX_EPOCH_TICK + static_cast<std::uint64_t>(static_cast<std::uint32_t>(seconds)) * TICKS_PER_SECOND);
     return 0;
 }
 
@@ -458,14 +495,16 @@ int APS5_VABI sceRtcGetWin32FileTime(const RtcDateTime* time, uint64_t* win32_ti
     if (!win32_time) return SCE_RTC_ERROR_INVALID_POINTER;
     if (const int result = validate(time); result != 0) return result;
     const std::uint64_t tick = toTick(*time);
-    if (tick < WIN32_EPOCH_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
+    if (tick < WIN32_EPOCH_TICK) {
+        *win32_time = 0;
+        return SCE_RTC_ERROR_INVALID_YEAR;
+    }
     *win32_time = (tick - WIN32_EPOCH_TICK) * 10;
     return 0;
 }
 
 int APS5_VABI sceRtcSetWin32FileTime(RtcDateTime* time, uint64_t win32_time) {
     if (!time) return SCE_RTC_ERROR_INVALID_POINTER;
-    if (win32_time / 10 > MAX_TICK - WIN32_EPOCH_TICK) return SCE_RTC_ERROR_INVALID_VALUE;
     *time = fromTick(WIN32_EPOCH_TICK + win32_time / 10);
     return 0;
 }
@@ -587,8 +626,10 @@ int APS5_VABI sceRtcFormatRFC3339(char* dateTime, const RtcTick* utc, int timeZo
         utc = &now;
     }
     if (timeZoneMinutes < -1439 || timeZoneMinutes > 1439) return SCE_RTC_ERROR_INVALID_VALUE;
-    RtcTick local{};
-    if (const int result = addTicks(&local, utc, timeZoneMinutes, TICKS_PER_MINUTE); result != 0) return result;
+    const auto shift = static_cast<std::int64_t>(timeZoneMinutes) * TICKS_PER_MINUTE;
+    if (rangeChecked() && (shift < 0 ? utc->tick < static_cast<std::uint64_t>(-shift) : utc->tick > std::numeric_limits<std::uint64_t>::max() - static_cast<std::uint64_t>(shift))) return SCE_RTC_ERROR_INVALID_VALUE;
+    const RtcTick local{utc->tick + static_cast<std::uint64_t>(shift)};
+    if (local.tick > MAX_TICK) return SCE_RTC_ERROR_INVALID_YEAR;
     const RtcDateTime time = fromTick(local.tick);
     int written = std::snprintf(dateTime, 23, "%04u-%02u-%02uT%02u:%02u:%02u.%02u", time.year, time.month, time.day, time.hour, time.minute, time.second, time.microsecond / 10000);
     if (timeZoneMinutes == 0) {
@@ -619,8 +660,9 @@ int APS5_VABI sceRtcFormatRFC2822(char* dateTime, const RtcTick* utc, int timeZo
         utc = &now;
     }
     if (timeZoneMinutes < -1439 || timeZoneMinutes > 1439) return SCE_RTC_ERROR_INVALID_VALUE;
-    RtcTick local{};
-    if (const int result = addTicks(&local, utc, timeZoneMinutes, TICKS_PER_MINUTE); result != 0) return result;
+    const RtcTick local{utc->tick + static_cast<std::uint64_t>(static_cast<std::int64_t>(timeZoneMinutes) * TICKS_PER_MINUTE)};
+    if (static_cast<std::int64_t>(local.tick) > static_cast<std::int64_t>(MAX_TICK)) return SCE_RTC_ERROR_INVALID_YEAR;
+    if (static_cast<std::int64_t>(utc->tick) < 0 || static_cast<std::int64_t>(local.tick) < 0) return SCE_RTC_ERROR_INVALID_VALUE;
     const RtcDateTime time = fromTick(local.tick);
     const int offset = timeZoneMinutes < 0 ? -timeZoneMinutes : timeZoneMinutes;
     std::snprintf(dateTime, 32, "%s, %02u %s %04u %02u:%02u:%02u %c%02d%02d", WEEKDAY_NAMES[(local.tick / TICKS_PER_DAY + 1) % 7], time.day,
diff --git a/core/libs/prx/libSceRtc/include/Rtc.hpp b/core/libs/prx/libSceRtc/include/Rtc.hpp
new file mode 100644
index 0000000000..7e84acf6b7
--- /dev/null
+++ b/core/libs/prx/libSceRtc/include/Rtc.hpp
@@ -0,0 +1,69 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceRtcCheckValid(const RtcDateTime* time);
+int APS5_VABI sceRtcIsLeapYear(int year);
+int APS5_VABI sceRtcGetDaysInMonth(int year, int month);
+int APS5_VABI sceRtcGetDayOfWeek(int year, int month, int day);
+int APS5_VABI sceRtcGetTickResolution(void);
+int APS5_VABI sceRtcGetTick(const RtcDateTime* time, RtcTick* tick);
+int APS5_VABI sceRtcSetTick(RtcDateTime* time, const RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentClock(RtcDateTime* time, int timeZoneMinutes);
+int APS5_VABI sceRtcGetCurrentClockLocalTime(RtcDateTime* time);
+int APS5_VABI sceRtcConvertUtcToLocalTime(const RtcTick* utc, RtcTick* localTime);
+int APS5_VABI sceRtcConvertLocalTimeToUtc(const RtcTick* localTime, RtcTick* utc);
+int APS5_VABI sceRtcGetTime_t(const RtcDateTime* time, int64_t* seconds);
+int APS5_VABI sceRtcSetTime_t(RtcDateTime* time, int64_t seconds);
+int APS5_VABI sceRtcGetWin32FileTime(const RtcDateTime* time, uint64_t* win32Time);
+int APS5_VABI sceRtcSetWin32FileTime(RtcDateTime* time, uint64_t win32Time);
+int APS5_VABI sceRtcGetDosTime(const RtcDateTime* time, uint32_t* dosTime);
+int APS5_VABI sceRtcSetDosTime(RtcDateTime* time, uint32_t dosTime);
+int APS5_VABI sceRtcGetYear(const RtcDateTime* time);
+int APS5_VABI sceRtcSetYear(RtcDateTime* time, int year);
+int APS5_VABI sceRtcGetMonth(const RtcDateTime* time);
+int APS5_VABI sceRtcSetMonth(RtcDateTime* time, int month);
+int APS5_VABI sceRtcGetDay(const RtcDateTime* time);
+int APS5_VABI sceRtcSetDay(RtcDateTime* time, int day);
+int APS5_VABI sceRtcGetHour(const RtcDateTime* time);
+int APS5_VABI sceRtcSetHour(RtcDateTime* time, int hour);
+int APS5_VABI sceRtcGetMinute(const RtcDateTime* time);
+int APS5_VABI sceRtcSetMinute(RtcDateTime* time, int minute);
+int APS5_VABI sceRtcGetSecond(const RtcDateTime* time);
+int APS5_VABI sceRtcSetSecond(RtcDateTime* time, int second);
+int APS5_VABI sceRtcGetMicrosecond(const RtcDateTime* time);
+int APS5_VABI sceRtcSetMicrosecond(RtcDateTime* time, int microsecond);
+int APS5_VABI sceRtcFormatRFC3339(char* dateTime, const RtcTick* utc, int timeZoneMinutes);
+int APS5_VABI sceRtcFormatRFC3339LocalTime(char* dateTime, const RtcTick* utc);
+int APS5_VABI sceRtcFormatRFC2822(char* dateTime, const RtcTick* utc, int timeZoneMinutes);
+int APS5_VABI sceRtcFormatRFC2822LocalTime(char* dateTime, const RtcTick* utc);
+int APS5_VABI sceRtcParseRFC3339(RtcTick* utc, const char* dateTime);
+int APS5_VABI sceRtcParseDateTime(RtcTick* utc, const char* dateTime);
+int APS5_VABI sceRtcTickAddTicks(RtcTick* dst, const RtcTick* src, int64_t ticks);
+int APS5_VABI sceRtcTickAddMicroseconds(RtcTick* dst, const RtcTick* src, int64_t usec);
+int APS5_VABI sceRtcTickAddSeconds(RtcTick* dst, const RtcTick* src, int64_t seconds);
+int APS5_VABI sceRtcTickAddMinutes(RtcTick* dst, const RtcTick* src, int64_t minutes);
+int APS5_VABI sceRtcTickAddHours(RtcTick* dst, const RtcTick* src, int32_t hours);
+int APS5_VABI sceRtcTickAddDays(RtcTick* dst, const RtcTick* src, int32_t days);
+int APS5_VABI sceRtcTickAddWeeks(RtcTick* dst, const RtcTick* src, int32_t weeks);
+int APS5_VABI sceRtcTickAddMonths(RtcTick* dst, const RtcTick* src, int32_t months);
+int APS5_VABI sceRtcTickAddYears(RtcTick* dst, const RtcTick* src, int16_t years);
+int APS5_VABI sceRtcInit(void);
+int APS5_VABI sceRtcEnd(void);
+int APS5_VABI sceRtcCompareTick(const RtcTick* first, const RtcTick* second);
+int APS5_VABI sceRtcGetCurrentRawNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentAdNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcGetCurrentDebugNetworkTick(RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentNetworkTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentAdNetworkTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetCurrentDebugNetworkTick(const RtcTick* tick);
+int APS5_VABI sceRtcSetConf(int first, int second, int third, int fourth);
+int APS5_VABI sceRtcFormatRFC3339Precise(char* dateTime, const RtcTick* utc, int timeZoneMinutes, int precision);
+int APS5_VABI sceRtcFormatRFC3339PreciseLocalTime(char* dateTime, const RtcTick* utc, int precision);
+
+}
diff --git a/core/libs/prx/libSceRtc/libSceRtc.hpp b/core/libs/prx/libSceRtc/libSceRtc.hpp
new file mode 100644
index 0000000000..6301e155c4
--- /dev/null
+++ b/core/libs/prx/libSceRtc/libSceRtc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRtc/include/Rtc.hpp"
diff --git a/core/libs/prx/libSceRudp/CMakeLists.txt b/core/libs/prx/libSceRudp/CMakeLists.txt
new file mode 100644
index 0000000000..962bd86e42
--- /dev/null
+++ b/core/libs/prx/libSceRudp/CMakeLists.txt
@@ -0,0 +1,6 @@
+add_library(libSceRudp SHARED EXCLUDE_FROM_ALL
+        ${CMAKE_CURRENT_SOURCE_DIR}/Export.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libkernel/Time/TimedWait.cpp
+)
+target_include_directories(libSceRudp PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceRudp)
diff --git a/core/libs/prx/libSceRudp/Export.cpp b/core/libs/prx/libSceRudp/Export.cpp
index dcfb2c25be..dd4dd2c260 100644
--- a/core/libs/prx/libSceRudp/Export.cpp
+++ b/core/libs/prx/libSceRudp/Export.cpp
@@ -1,6 +1,5 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include <atomic>
-#include <chrono>
-#include <condition_variable>
 #include <cstdint>
 #include <cstdio>
 #include <cstddef>
@@ -11,6 +10,7 @@
 #include <stdexcept>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/Time/include/TimedWait.hpp"
 
 // Offline reliable-UDP: the library initialises and contexts can be created and bound, but no connection can
 // ever be established because there is no network.
@@ -58,8 +58,6 @@ enum RudpOption {
     RUDP_OPTION_KEEP_ALIVE_TIMEOUT = 19,
 };
 
-using GuestRudpEventHandler = RudpEventHandler;
-
 std::mutex g_mutex;
 bool g_inited = false;
 int g_next_ctx = 0;
@@ -93,10 +91,9 @@ struct RudpPoll {
     std::map<int, uint16_t> entries;
 };
 
-
 int g_next_poll = 1;
 std::map<int, RudpPoll> g_polls;
-std::condition_variable g_polls_changed;
+TimedWait::Condition g_polls_changed;
 
 bool valid_ctx(int ctx) {
     return g_ctx.count(ctx) != 0;
@@ -157,7 +154,7 @@ int APS5_VABI sceRudpEnd(void) {
     g_inited = false;
     g_ctx.clear();
     g_polls.clear();
-    g_polls_changed.notify_all();
+    g_polls_changed.NotifyAll();
     return 0;
 }
 
@@ -451,8 +448,8 @@ int APS5_VABI sceRudpPollWait(int pollId, RudpPollEvent* events, std::size_t eve
     }
     const auto closed = [pollId] { return !g_inited || g_polls.count(pollId) == 0; };
     if (timeout > RUDP_POLL_WAIT_MAX_USEC) {
-        g_polls_changed.wait(lk, closed);
-    } else if (!g_polls_changed.wait_for(lk, std::chrono::microseconds(timeout), closed)) {
+        g_polls_changed.Wait(lk, closed);
+    } else if (!g_polls_changed.WaitUntil(lk, TimedWait::DeadlineNanos(timeout), closed)) {
         return 0;
     }
     return g_inited ? RUDP_ERROR_INVALID_POLL_ID : RUDP_ERROR_NOT_INITIALIZED;
@@ -469,7 +466,7 @@ int APS5_VABI sceRudpPollDestroy(int pollId) {
     if (g_polls.erase(pollId) == 0) {
         return RUDP_ERROR_INVALID_POLL_ID;
     }
-    g_polls_changed.notify_all();
+    g_polls_changed.NotifyAll();
     return 0;
 }
 
diff --git a/core/libs/prx/libSceRudp/include/Api.hpp b/core/libs/prx/libSceRudp/include/Api.hpp
new file mode 100644
index 0000000000..44b6881d58
--- /dev/null
+++ b/core/libs/prx/libSceRudp/include/Api.hpp
@@ -0,0 +1,44 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+using GuestRudpEventHandler = RudpEventHandler;
+
+extern "C" {
+
+int APS5_VABI sceRudpInit_nid_postfix(void* memPool, int memPoolSize);
+int APS5_VABI sceRudpActivate(std::int32_t contextId, const void* address, std::uint32_t addressLength);
+int APS5_VABI sceRudpGetStatus(void* status, std::size_t size);
+int APS5_VABI sceRudpEnd(void);
+int APS5_VABI sceRudpTerminate(int ctxId);
+int APS5_VABI sceRudpEnableInternalIOThread(uint32_t stackSize, uint32_t priority);
+int APS5_VABI sceRudpEnableInternalIOThread2(uint32_t stackSize, uint32_t priority, uint64_t affinity);
+int APS5_VABI sceRudpSetEventHandler(GuestRudpEventHandler handler, void* arg);
+int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler handler, void* arg, int* ctxId);
+int APS5_VABI sceRudpBind(int ctxId, uint16_t vport, int transport, uint16_t port);
+int APS5_VABI sceRudpSetOption(int ctxId, int option, const void* value, uint32_t len);
+int APS5_VABI sceRudpGetOption(int ctxId, int option, void* value, uint32_t len);
+int APS5_VABI sceRudpInitiate(int ctxId, const void* to, uint32_t tolen, uint16_t vport);
+int APS5_VABI sceRudpGetContextStatus(int ctxId, void* status, uint32_t size);
+int APS5_VABI sceRudpGetRemoteInfo(int contextId, void* address, std::uint32_t* addressSize, std::uint16_t* virtualPort);
+int APS5_VABI sceRudpGetNumberOfPacketsToRead(int ctxId);
+int APS5_VABI sceRudpGetSizeWritable(int ctxId);
+int APS5_VABI sceRudpGetSizeReadable(int ctxId);
+int APS5_VABI sceRudpWrite(int ctxId, const void* data, uint32_t len, int flags);
+int APS5_VABI sceRudpRead(int ctxId, void* data, uint32_t len, int flags, void* status);
+int APS5_VABI sceRudpNetFlush(void);
+int APS5_VABI sceRudpProcessEvents(std::uint64_t timeout);
+int APS5_VABI sceRudpNetReceived(int socketId, const void* data, std::size_t dataSize, const void* sourceAddress, std::uint32_t sourceAddressSize);
+int APS5_VABI sceRudpGetMaxSegmentSize(uint16_t* size);
+int APS5_VABI sceRudpPollCreate(std::size_t size);
+int APS5_VABI sceRudpPollControl(int pollId, int op, int ctxId, uint16_t events);
+int APS5_VABI sceRudpPollWait(int pollId, RudpPollEvent* events, std::size_t eventLen, uint64_t timeout);
+int APS5_VABI sceRudpPollDestroy(int pollId);
+int APS5_VABI sceRudpAccept();
+int APS5_VABI sceRudpFlush();
+int APS5_VABI sceRudpGetLocalInfo();
+int APS5_VABI sceRudpListen();
+int APS5_VABI sceRudpPollCancel();
+int APS5_VABI sceRudpSetMaxSegmentSize();
+
+}
diff --git a/core/libs/prx/libSceRudp/libSceRudp.hpp b/core/libs/prx/libSceRudp/libSceRudp.hpp
new file mode 100644
index 0000000000..934f85cb3c
--- /dev/null
+++ b/core/libs/prx/libSceRudp/libSceRudp.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceRudp/include/Api.hpp"
diff --git a/core/libs/prx/libSceS3DConversion/libSceS3DConversion.hpp b/core/libs/prx/libSceS3DConversion/libSceS3DConversion.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceS3DConversion/libSceS3DConversion.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceS3da/Export.cpp b/core/libs/prx/libSceS3da/Export.cpp
index 79ca9b7758..fcf0f1f9af 100644
--- a/core/libs/prx/libSceS3da/Export.cpp
+++ b/core/libs/prx/libSceS3da/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceS3da/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct S3daInfo;
-
 extern "C" {
 
 int APS5_VABI sceS3daClose(std::uint32_t port) {
diff --git a/core/libs/prx/libSceS3da/include/Api.hpp b/core/libs/prx/libSceS3da/include/Api.hpp
new file mode 100644
index 0000000000..d89f3a8dbb
--- /dev/null
+++ b/core/libs/prx/libSceS3da/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct S3daInfo;
+
+extern "C" {
+
+int APS5_VABI sceS3daClose(std::uint32_t port);
+int APS5_VABI sceS3daGetInfo(std::uint32_t port, S3daInfo* info);
+int APS5_VABI sceS3daOpen(std::uint32_t port);
+int APS5_VABI sceS3daSendData(std::uint32_t port, const void* data, std::uint32_t size);
+
+}
diff --git a/core/libs/prx/libSceS3da/libSceS3da.hpp b/core/libs/prx/libSceS3da/libSceS3da.hpp
new file mode 100644
index 0000000000..56ae159b9d
--- /dev/null
+++ b/core/libs/prx/libSceS3da/libSceS3da.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceS3da/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveData.native/Export.cpp b/core/libs/prx/libSceSaveData.native/Export.cpp
index e3ccc08dee..916a9dbe26 100644
--- a/core/libs/prx/libSceSaveData.native/Export.cpp
+++ b/core/libs/prx/libSceSaveData.native/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData.native/include/Api.hpp"
+#include "prx/libSceSaveData/include/Api.hpp"
 #include <algorithm>
 #include <atomic>
 #include <cstddef>
@@ -37,6 +39,7 @@ static std::string save_root() {
 static std::mutex g_state_mutex;
 static std::deque<SaveDataEvent> g_events;
 constexpr std::uint32_t SAVE_DATA_EVENT_TYPE_BACKUP = 2;
+constexpr std::uint32_t SAVE_DATA_EVENT_TYPE_CONVERT = 5;
 
 static bool dir_name_match(const char* str, const char* pattern) {
     if (pattern == nullptr || pattern[0] == '\0') {
@@ -280,7 +283,7 @@ extern "C" {
 
 int APS5_VABI sceSaveDataBackup(const SaveDataBackup* backup) {
     if (backup == nullptr || backup->dir_name == nullptr) {
-        throw std::runtime_error("sceSaveDataBackup: null argument");
+        return SAVE_DATA_ERROR_PARAMETER;
     }
     // The system copies the save directory to its backup area asynchronously; the copy itself is
     // not observable by the title, only its completion event.
@@ -477,7 +480,7 @@ int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond* cond, Sa
 int APS5_VABI sceSaveDataGetEventResult(const void* event_param, SaveDataEvent* event) {
     (void)event_param;
     if (event == nullptr) {
-        throw std::runtime_error("sceSaveDataGetEventResult: null event");
+        return SAVE_DATA_ERROR_PARAMETER;
     }
     std::lock_guard lock(g_state_mutex);
     if (g_events.empty()) {
@@ -952,6 +955,13 @@ static int convert(const SaveDataConvert* param) {
         return SAVE_DATA_ERROR_NOT_FOUND;
     }
     g_convertProgress = 1.0f;
+    SaveDataEvent event{};
+    event.type = SAVE_DATA_EVENT_TYPE_CONVERT;
+    event.error_code = SAVE_DATA_OK;
+    event.user_id = param->user_id;
+    event.dir_name = *param->dir_name;
+    std::lock_guard lock(g_state_mutex);
+    g_events.push_back(event);
     return SAVE_DATA_OK;
 }
 
@@ -1034,17 +1044,6 @@ int APS5_VABI sceSaveDataDebugTarget() {
 
 namespace {
 
-struct SaveDataMountPs4 {
-    std::int32_t user_id;
-    std::int32_t pad;
-    const void* title_id;
-    const SceSaveDataDirName* dir_name;
-    const void* fingerprint;
-    std::uint64_t blocks;
-    std::uint32_t mount_mode;
-    std::uint8_t reserved[32];
-};
-
 }
 
 extern "C" {
diff --git a/core/libs/prx/libSceSaveData.native/include/Api.hpp b/core/libs/prx/libSceSaveData.native/include/Api.hpp
new file mode 100644
index 0000000000..00283d8bfd
--- /dev/null
+++ b/core/libs/prx/libSceSaveData.native/include/Api.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct SaveDataMountPs4 {
+    std::int32_t user_id;
+    std::int32_t pad;
+    const void* title_id;
+    const SceSaveDataDirName* dir_name;
+    const void* fingerprint;
+    std::uint64_t blocks;
+    std::uint32_t mount_mode;
+    std::uint8_t reserved[32];
+};
+
+extern "C" {
+
+int APS5_VABI sceSaveDataCommit(const SaveDataCommitParam* param);
+int APS5_VABI sceSaveDataCreateTransactionResource(uint32_t size);
+int APS5_VABI sceSaveDataDelete(const SaveDataDelete* del);
+int APS5_VABI sceSaveDataDeleteTransactionResource(int32_t resource);
+int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result);
+int APS5_VABI sceSaveDataGetMountInfo(const SaveDataMountPoint* mountPoint, SaveDataMountInfo* info);
+int APS5_VABI sceSaveDataGetParam(const SaveDataMountPoint* mountPoint, uint32_t paramType, void* paramBuf, size_t paramBufSize, size_t* gotSize);
+int APS5_VABI sceSaveDataLoadIcon(const SaveDataMountPoint* mountPoint, SaveDataIcon* icon);
+int APS5_VABI sceSaveDataMount3(const SaveDataMount3* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataPrepare(const SaveDataMountPoint* mountPoint, const SaveDataPrepareParam* param);
+int APS5_VABI sceSaveDataSaveIcon(const SaveDataMountPoint* mountPoint, const SaveDataIcon* icon);
+int APS5_VABI sceSaveDataSaveIconByPath(const SaveDataMountPoint* mountPoint, const char* path);
+int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint* mountPoint, uint32_t paramType, const void* paramBuf, size_t paramBufSize);
+int APS5_VABI sceSaveDataUmount2(uint32_t mode, const SaveDataMountPoint* mountPoint);
+int APS5_VABI sceSaveDataTransferringMountPs4(const SaveDataTransferringMount* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataDirNameSearchPs4(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result);
+int APS5_VABI sceSaveDataConvert(const SaveDataConvert* param);
+int APS5_VABI sceSaveDataGetConvertProgress(float* progress);
+int APS5_VABI sceSaveDataCancel(std::uint32_t cancelArgument);
+int APS5_VABI sceSaveDataDirNameSearch2(const SaveDataDirNameSearchCond* cond, SaveDataDirNameSearchResult* result);
+int APS5_VABI sceSaveDataPrepareForTransferring(const SaveDataMountPoint* mountPoint, const SaveDataPrepareParam* param);
+int APS5_VABI sceSaveDataCheckIpmiIfSize();
+int APS5_VABI sceSaveDataDebug();
+int APS5_VABI sceSaveDataDebugCheckBackupData();
+int APS5_VABI sceSaveDataDebugCleanMount();
+int APS5_VABI sceSaveDataDebugCompiledSdkVersion();
+int APS5_VABI sceSaveDataDebugCreateSaveDataRoot();
+int APS5_VABI sceSaveDataDebugProspero();
+int APS5_VABI sceSaveDataDebugRemoveSaveDataRoot();
+int APS5_VABI sceSaveDataDebugTarget();
+int APS5_VABI sceSaveDataInitialize(const void* init);
+int APS5_VABI sceSaveDataMount(const SaveDataMountPs4* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataUmount(const SaveDataMountPoint* mountPoint);
+int APS5_VABI sceSaveDataSetupSaveDataMemory(std::int32_t userId, std::size_t memorySize, const SaveDataParam* param);
+int APS5_VABI sceSaveDataGetSaveDataMemory(std::int32_t userId, void* buf, std::size_t bufSize, std::int64_t offset);
+int APS5_VABI sceSaveDataSetSaveDataMemory(std::int32_t userId, void* buf, std::size_t bufSize, std::int64_t offset);
+
+}
diff --git a/core/libs/prx/libSceSaveData.native/libSceSaveData.native.hpp b/core/libs/prx/libSceSaveData.native/libSceSaveData.native.hpp
new file mode 100644
index 0000000000..6cb55f8ca0
--- /dev/null
+++ b/core/libs/prx/libSceSaveData.native/libSceSaveData.native.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveData/Export.cpp b/core/libs/prx/libSceSaveData/Export.cpp
index f2a68ec989..6fbc7bb184 100644
--- a/core/libs/prx/libSceSaveData/Export.cpp
+++ b/core/libs/prx/libSceSaveData/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
diff --git a/core/libs/prx/libSceSaveData/SaveDataCore.hpp b/core/libs/prx/libSceSaveData/SaveDataCore.hpp
index 58afdfa721..1da806ac51 100644
--- a/core/libs/prx/libSceSaveData/SaveDataCore.hpp
+++ b/core/libs/prx/libSceSaveData/SaveDataCore.hpp
@@ -21,20 +21,13 @@
 #include <vector>
 
 #include "SceTypes.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/RemoveTree.hpp"
 #include "prx/libSceSaveData/SaveDataFile.hpp"
 
 namespace savedata {
 
-extern "C" {
-int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, std::uint32_t attr,
-                                       std::uint64_t init_pattern, const void* param);
-int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef);
-int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern);
-int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, std::uint64_t set_pattern, int* num_wait_threads);
-}
-
 namespace {
 
 constexpr std::uint32_t SD_FACILITY = 0x809F0000u;
diff --git a/core/libs/prx/libSceSaveData/include/Api.hpp b/core/libs/prx/libSceSaveData/include/Api.hpp
new file mode 100644
index 0000000000..88067a68e5
--- /dev/null
+++ b/core/libs/prx/libSceSaveData/include/Api.hpp
@@ -0,0 +1,83 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSaveDataInitialize3(const void* init);
+int APS5_VABI sceSaveDataTerminate(void);
+int APS5_VABI sceSaveDataBackup(const SaveDataBackup* backup);
+int APS5_VABI sceSaveDataGetEventResult(const void* eventParam, SaveDataEvent* event);
+int APS5_VABI sceSaveDataGetSaveDataMemory2(SaveDataMemoryGet2* getParam);
+int APS5_VABI sceSaveDataSetSaveDataMemory2(const SaveDataMemorySet2* setParam);
+int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2* setupParam, SaveDataMemorySetupResult* result);
+int APS5_VABI sceSaveDataSyncSaveDataMemory(const void* syncParam);
+int APS5_VABI sceSaveDataTransferringMount(const SaveDataTransferringMount* mount, SaveDataMountResult* mountResult);
+int APS5_VABI sceSaveDataAbort();
+int APS5_VABI sceSaveDataBindPsnAccount(void);
+int APS5_VABI sceSaveDataBindPsnAccountForSystemBackup(void);
+int APS5_VABI sceSaveDataChangeDatabase(void);
+int APS5_VABI sceSaveDataChangeInternal(void);
+int APS5_VABI sceSaveDataCheckBackupData(void);
+int APS5_VABI sceSaveDataCheckBackupDataForCdlg(void);
+int APS5_VABI sceSaveDataCheckBackupDataInternal(void);
+int APS5_VABI sceSaveDataCheckBackupDataLight(void);
+int APS5_VABI sceSaveDataCheckCloudData(void);
+int APS5_VABI sceSaveDataCheckSaveDataBroken(void);
+int APS5_VABI sceSaveDataCheckSaveDataVersion(void);
+int APS5_VABI sceSaveDataCheckSaveDataVersionLatest(void);
+int APS5_VABI sceSaveDataClearProgress();
+int APS5_VABI sceSaveDataCreateUploadData(void);
+int APS5_VABI sceSaveDataDebugGetThreadId(void);
+int APS5_VABI sceSaveDataDeleteAllUser(void);
+int APS5_VABI sceSaveDataDeleteBackupData(void);
+int APS5_VABI sceSaveDataDeleteCloudData(void);
+int APS5_VABI sceSaveDataDeleteProspero(void);
+int APS5_VABI sceSaveDataDeleteTitle(void);
+int APS5_VABI sceSaveDataDeleteUser(void);
+int APS5_VABI sceSaveDataDirNameSearchInternal(void);
+int APS5_VABI sceSaveDataDownload(void);
+int APS5_VABI sceSaveDataGetAllSize();
+int APS5_VABI sceSaveDataGetAppLaunchedUser(void);
+int APS5_VABI sceSaveDataGetAutoUploadConditions(void);
+int APS5_VABI sceSaveDataGetAutoUploadRequestInfo(void);
+int APS5_VABI sceSaveDataGetAutoUploadSetting(void);
+int APS5_VABI sceSaveDataGetBoundPsnAccountCount(void);
+int APS5_VABI sceSaveDataGetClientThreadPriority(void);
+int APS5_VABI sceSaveDataGetCloudQuotaInfo(void);
+int APS5_VABI sceSaveDataGetEventInfo();
+int APS5_VABI sceSaveDataGetMountedSaveDataCount();
+int APS5_VABI sceSaveDataGetProgress();
+int APS5_VABI sceSaveDataGetSaveDataCount();
+int APS5_VABI sceSaveDataGetSaveDataRootDir(void);
+int APS5_VABI sceSaveDataGetSaveDataRootPath(void);
+int APS5_VABI sceSaveDataGetSaveDataRootUsbPath(void);
+int APS5_VABI sceSaveDataGetSavePoint(void);
+int APS5_VABI sceSaveDataGetUpdatedDataCount(void);
+int APS5_VABI sceSaveDataInitialize2();
+int APS5_VABI sceSaveDataInitializeForCdlg(void);
+int APS5_VABI sceSaveDataIsDeletingUsbDb(void);
+int APS5_VABI sceSaveDataIsMounted();
+int APS5_VABI sceSaveDataManualDelete(void);
+int APS5_VABI sceSaveDataManualDownload(void);
+int APS5_VABI sceSaveDataManualUpload(void);
+int APS5_VABI sceSaveDataMount5();
+int APS5_VABI sceSaveDataMountInternal(void);
+int APS5_VABI sceSaveDataMountSys(void);
+int APS5_VABI sceSaveDataRebuildDatabase(void);
+int APS5_VABI sceSaveDataRegisterEventCallback();
+int APS5_VABI sceSaveDataRestoreBackupData(void);
+int APS5_VABI sceSaveDataRestoreBackupDataForCdlg(void);
+int APS5_VABI sceSaveDataRestoreLoadSaveDataMemory(void);
+int APS5_VABI sceSaveDataSetAutoUploadSetting(void);
+int APS5_VABI sceSaveDataSetEventInfo();
+int APS5_VABI sceSaveDataSetSaveDataLibraryUser(void);
+int APS5_VABI sceSaveDataShutdownStart(void);
+int APS5_VABI sceSaveDataSupportedFakeBrokenStatus(void);
+int APS5_VABI sceSaveDataSyncCloudList(void);
+int APS5_VABI sceSaveDataUmountSys(void);
+int APS5_VABI sceSaveDataUmountWithBackup(void);
+int APS5_VABI sceSaveDataUnregisterEventCallback();
+int APS5_VABI sceSaveDataUpload(void);
+
+}
diff --git a/core/libs/prx/libSceSaveData/libSceSaveData.hpp b/core/libs/prx/libSceSaveData/libSceSaveData.hpp
new file mode 100644
index 0000000000..72713a0e1f
--- /dev/null
+++ b/core/libs/prx/libSceSaveData/libSceSaveData.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSaveData/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveDataDialog.native/Export.cpp b/core/libs/prx/libSceSaveDataDialog.native/Export.cpp
index 54c4fd0926..4e173f20c5 100644
--- a/core/libs/prx/libSceSaveDataDialog.native/Export.cpp
+++ b/core/libs/prx/libSceSaveDataDialog.native/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveDataDialog.native/include/Api.hpp"
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -44,7 +46,7 @@ int APS5_VABI sceSaveDataDialogGetResult(void* result) {
  r->result = SAVE_DATA_DIALOG_RESULT_OK;
  r->button_id = SAVE_DATA_DIALOG_BUTTON_ID_OK;
  r->user_data = g_user_data;
- if (r->dir_name != nullptr && g_dir_name[0] != '\0') {
+ if (r->dir_name != nullptr) {
   std::snprintf(static_cast<SaveDataDirName*>(r->dir_name)->data,
    sizeof(SaveDataDirName::data), "%s", g_dir_name);
  }
diff --git a/core/libs/prx/libSceSaveDataDialog.native/include/Api.hpp b/core/libs/prx/libSceSaveDataDialog.native/include/Api.hpp
new file mode 100644
index 0000000000..838a41d62b
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog.native/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSaveDataDialogGetStatus(void);
+int APS5_VABI sceSaveDataDialogUpdateStatus(void);
+
+}
diff --git a/core/libs/prx/libSceSaveDataDialog.native/libSceSaveDataDialog.native.hpp b/core/libs/prx/libSceSaveDataDialog.native/libSceSaveDataDialog.native.hpp
new file mode 100644
index 0000000000..483cb011af
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog.native/libSceSaveDataDialog.native.hpp
@@ -0,0 +1,4 @@
+#pragma once
+
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
+#include "prx/libSceSaveDataDialog.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceSaveDataDialog/Export.cpp b/core/libs/prx/libSceSaveDataDialog/Export.cpp
index 068c96f145..1ad8a50883 100644
--- a/core/libs/prx/libSceSaveDataDialog/Export.cpp
+++ b/core/libs/prx/libSceSaveDataDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstddef>
@@ -6,7 +7,6 @@
 #include "prx/libSceSaveDataDialog.native/SaveDataDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-
 namespace {
 // Throwing from these reaches std::terminate and aborts the game process.
 int SoftFailNp(const char* func) {
diff --git a/core/libs/prx/libSceSaveDataDialog/include/Api.hpp b/core/libs/prx/libSceSaveDataDialog/include/Api.hpp
new file mode 100644
index 0000000000..40baa8c043
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSaveDataDialogClose(const void* closeParam);
+int APS5_VABI sceSaveDataDialogGetResult(void* result);
+int APS5_VABI sceSaveDataDialogInitialize(void);
+int APS5_VABI sceSaveDataDialogIsReadyToDisplay(void);
+int APS5_VABI sceSaveDataDialogOpen(const void* param);
+int APS5_VABI sceSaveDataDialogProgressBarInc(int target, uint32_t delta);
+int APS5_VABI sceSaveDataDialogProgressBarSetValue(int target, uint32_t rate);
+int APS5_VABI sceSaveDataDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceSaveDataDialog/libSceSaveDataDialog.hpp b/core/libs/prx/libSceSaveDataDialog/libSceSaveDataDialog.hpp
new file mode 100644
index 0000000000..06b3b4f0f0
--- /dev/null
+++ b/core/libs/prx/libSceSaveDataDialog/libSceSaveDataDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceScm/libSceScm.hpp b/core/libs/prx/libSceScm/libSceScm.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceScm/libSceScm.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceScreenShot/CMakeLists.txt b/core/libs/prx/libSceScreenShot/CMakeLists.txt
new file mode 100644
index 0000000000..0300d678fa
--- /dev/null
+++ b/core/libs/prx/libSceScreenShot/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceScreenShot SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceScreenShot PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceScreenShot)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_screenshot_tests ${LIBS_INCLUDE_DIR}/tests/GuestScreenShot.cpp)
+    target_include_directories(guest_screenshot_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_screenshot_tests PRIVATE libSceScreenShot libkernel libc)
+    configure_windows_unwind(guest_screenshot_tests)
+    add_test(NAME guest_screenshot COMMAND guest_screenshot_tests small)
+    add_test(NAME guest_screenshot_large_overlay COMMAND guest_screenshot_tests large)
+    if(WIN32)
+        set_tests_properties(guest_screenshot guest_screenshot_large_overlay PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceScreenShot>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceScreenShot/Export.cpp b/core/libs/prx/libSceScreenShot/Export.cpp
index 3f898a1f74..b9335af525 100644
--- a/core/libs/prx/libSceScreenShot/Export.cpp
+++ b/core/libs/prx/libSceScreenShot/Export.cpp
@@ -1,35 +1,90 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceScreenShot/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+
+namespace {
+
+constexpr int ErrorArgument = static_cast<int>(0x80BE0001);
+constexpr int ErrorOverlayFile = static_cast<int>(0x80BE0003);
+constexpr int ErrorOverlaySize = static_cast<int>(0x80BE000E);
+constexpr std::uint32_t LargeOverlaySdkVersion = 0x3500000;
+constexpr std::size_t MaxOverlayPath = 0x400;
+constexpr std::uint16_t FileTypeMask = 0xF000;
+constexpr std::uint16_t DirectoryType = 0x4000;
+
+std::atomic<bool> disabled{false};
+
+std::uint32_t CompiledSdkVersion() {
+    static const auto* processParameters = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t version;
+    std::memcpy(&version, processParameters + 0x10, sizeof(version));
+    return version;
+}
+
+int SetOverlayImage(const char* path, int offsetX, int offsetY) {
+    const bool large = CompiledSdkVersion() >= LargeOverlaySdkVersion;
+    const int maxX = large ? 3839 : 1919;
+    const int maxY = large ? 2159 : 1079;
+    const std::int64_t maxSize = large ? 8 * 1024 * 1024 : 2 * 1024 * 1024;
+    if (!path || offsetX < 0 || offsetX > maxX || offsetY < 0 || offsetY > maxY) return ErrorArgument;
+    if (strnlen(path, MaxOverlayPath) >= MaxOverlayPath) return ErrorArgument;
+    const int descriptor = sceKernelOpen(path, 0, 0);
+    if (descriptor < 0) return ErrorOverlayFile;
+    FileStat stat{};
+    int result = ErrorOverlayFile;
+    if (sceKernelFstat(descriptor, &stat) == 0 && (stat.st_mode & FileTypeMask) != DirectoryType) {
+        result = stat.st_size > 0 && stat.st_size <= maxSize ? 0 : ErrorOverlaySize;
+    }
+    sceKernelClose(descriptor);
+
+    return result;
+}
+
+}
 
 extern "C" {
 
-int APS5_VABI sceScreenShotSetOverlayImage(const char* path, int x, int y) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceScreenShotSetOverlayImage(const char* path, int offsetX, int offsetY) {
+    return SetOverlayImage(path, offsetX, offsetY);
 }
-int APS5_VABI sceScreenShotSetOverlayImageWithOrigin(const char* path, int x, int y, int origin) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceScreenShotCapture() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+int APS5_VABI sceScreenShotSetOverlayImageWithOrigin(const char* path, int offsetX, int offsetY, int origin) {
+    if (origin < 1 || origin > 9) return ErrorArgument;
+    return SetOverlayImage(path, offsetX, offsetY);
 }
+
 int APS5_VABI sceScreenShotDisable() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceScreenShotDisableNotification() {
-    NotImplemented_nid_no_patch(__func__);
+    disabled = true;
     return 0;
 }
+
 int APS5_VABI sceScreenShotEnable() {
-    NotImplemented_nid_no_patch(__func__);
+    disabled = false;
     return 0;
 }
+
+int APS5_VABI sceScreenShotIsDisabled(int id, int* isDisabled) {
+    if (id == -1 || !isDisabled) return ErrorArgument;
+    *isDisabled = disabled ? 1 : 0;
+    return 0;
+}
+
+int APS5_VABI sceScreenShotDisableNotification() {
+    return 0;
+}
+
 int APS5_VABI sceScreenShotEnableNotification() {
+    return 0;
+}
+
+int APS5_VABI sceScreenShotCapture() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -41,10 +96,6 @@ int APS5_VABI sceScreenShotGetDrcParam() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceScreenShotIsDisabled() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 int APS5_VABI sceScreenShotIsVshScreenCaptureDisabled() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceScreenShot/include/Api.hpp b/core/libs/prx/libSceScreenShot/include/Api.hpp
new file mode 100644
index 0000000000..98d5829a2c
--- /dev/null
+++ b/core/libs/prx/libSceScreenShot/include/Api.hpp
@@ -0,0 +1,21 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceScreenShotSetOverlayImage(const char* path, int offsetX, int offsetY);
+int APS5_VABI sceScreenShotSetOverlayImageWithOrigin(const char* path, int offsetX, int offsetY, int origin);
+int APS5_VABI sceScreenShotDisable();
+int APS5_VABI sceScreenShotEnable();
+int APS5_VABI sceScreenShotIsDisabled(int id, int* isDisabled);
+int APS5_VABI sceScreenShotDisableNotification();
+int APS5_VABI sceScreenShotEnableNotification();
+int APS5_VABI sceScreenShotCapture();
+int APS5_VABI sceScreenShotGetAppInfo();
+int APS5_VABI sceScreenShotGetDrcParam();
+int APS5_VABI sceScreenShotIsVshScreenCaptureDisabled();
+int APS5_VABI sceScreenShotSetDrcParam();
+int APS5_VABI sceScreenShotSetParam();
+
+}
diff --git a/core/libs/prx/libSceScreenShot/libSceScreenShot.hpp b/core/libs/prx/libSceScreenShot/libSceScreenShot.hpp
new file mode 100644
index 0000000000..4deaf512f2
--- /dev/null
+++ b/core/libs/prx/libSceScreenShot/libSceScreenShot.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceScreenShot/include/Api.hpp"
diff --git a/core/libs/prx/libSceSdma/Export.cpp b/core/libs/prx/libSceSdma/Export.cpp
index 97a2ea23cc..1e67f3a5bb 100644
--- a/core/libs/prx/libSceSdma/Export.cpp
+++ b/core/libs/prx/libSceSdma/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSdma/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSdma/include/Api.hpp b/core/libs/prx/libSceSdma/include/Api.hpp
new file mode 100644
index 0000000000..1245319f43
--- /dev/null
+++ b/core/libs/prx/libSceSdma/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdmaBeginQueueMode(void);
+int APS5_VABI sceSdmaCancelQueue(void);
+int APS5_VABI sceSdmaClose(void);
+int APS5_VABI sceSdmaConstantFill(void);
+int APS5_VABI sceSdmaConstantFillNonBlocking(void);
+int APS5_VABI sceSdmaCopyLinear(void);
+int APS5_VABI sceSdmaCopyLinearNonBlocking(void);
+int APS5_VABI sceSdmaCopyTiled(void);
+int APS5_VABI sceSdmaCopyTiledNonBlocking(void);
+int APS5_VABI sceSdmaCopyWindowL2L(void);
+int APS5_VABI sceSdmaCopyWindowL2LNonBlocking(void);
+int APS5_VABI sceSdmaCopyWindowT2T(void);
+int APS5_VABI sceSdmaCopyWindowT2TNonBlocking(void);
+int APS5_VABI sceSdmaCopyWindowTiled(void);
+int APS5_VABI sceSdmaCopyWindowTiledNonBlocking(void);
+int APS5_VABI sceSdmaEndQueueMode(void);
+int APS5_VABI sceSdmaFenceNonBlocking(void);
+int APS5_VABI sceSdmaFinalize(void);
+int APS5_VABI sceSdmaFlushAll(void);
+int APS5_VABI sceSdmaFlushAllWithEvent(void);
+int APS5_VABI sceSdmaInitialize(void);
+int APS5_VABI sceSdmaKickQueue(void);
+int APS5_VABI sceSdmaOpen(void);
+int APS5_VABI sceSdmaQueryWorkingBufferSize(void);
+int APS5_VABI sceSdmaTryFlush(void);
+int APS5_VABI sceSdmaWaitForEvent(void);
+
+}
diff --git a/core/libs/prx/libSceSdma/libSceSdma.hpp b/core/libs/prx/libSceSdma/libSceSdma.hpp
new file mode 100644
index 0000000000..fdaa4a04c9
--- /dev/null
+++ b/core/libs/prx/libSceSdma/libSceSdma.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSdma/include/Api.hpp"
diff --git a/core/libs/prx/libSceShare.native/libSceShare.native.hpp b/core/libs/prx/libSceShare.native/libSceShare.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceShare.native/libSceShare.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceShare/Export.cpp b/core/libs/prx/libSceShare/Export.cpp
index 375682887e..e2f486e7f1 100644
--- a/core/libs/prx/libSceShare/Export.cpp
+++ b/core/libs/prx/libSceShare/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShare/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -6,22 +7,6 @@
 
 // Capture and sharing are not emulated; policy and parameter calls are accepted.
 
-struct ShareScreenshotParamExtended {
-    std::uint64_t size;
-    std::uint32_t source;
-    std::uint32_t mode;
-    const char* text;
-};
-
-struct ShareVideoClipParamExtended {
-    std::uint64_t size;
-    std::uint64_t value8;
-    std::uint64_t value16;
-    std::uint32_t mode;
-    std::uint32_t reserved;
-    const char* text;
-};
-
 static_assert(sizeof(ShareScreenshotParamExtended) == 24);
 static_assert(offsetof(ShareScreenshotParamExtended, text) == 16);
 static_assert(sizeof(ShareVideoClipParamExtended) == 40);
diff --git a/core/libs/prx/libSceShare/include/Api.hpp b/core/libs/prx/libSceShare/include/Api.hpp
new file mode 100644
index 0000000000..bb612024b1
--- /dev/null
+++ b/core/libs/prx/libSceShare/include/Api.hpp
@@ -0,0 +1,41 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct ShareScreenshotParamExtended {
+    std::uint64_t size;
+    std::uint32_t source;
+    std::uint32_t mode;
+    const char* text;
+};
+
+struct ShareVideoClipParamExtended {
+    std::uint64_t size;
+    std::uint64_t value8;
+    std::uint64_t value16;
+    std::uint32_t mode;
+    std::uint32_t reserved;
+    const char* text;
+};
+
+extern "C" {
+
+int APS5_VABI sceShareCaptureScreenshot(const void* param, int32_t* reqId);
+int APS5_VABI sceShareCaptureVideoClip(const void* param, int32_t* reqId);
+int APS5_VABI sceShareFeaturePermit(uint32_t featureFlags);
+int APS5_VABI sceShareFeatureProhibit(uint32_t featureFlags);
+int APS5_VABI sceShareGetCurrentStatus(uint32_t featureFlag, ShareCurrentStatus* status);
+int APS5_VABI sceShareInitialize(size_t heapSize, int threadPriority, uint64_t affinityMask);
+int APS5_VABI sceShareOpenMenuForContent(const void* contentId);
+int APS5_VABI sceShareRegisterContentEventCallback(void* callback, void* userData);
+int APS5_VABI sceShareSetCaptureSource(uint32_t featureFlags, const void* tapPoint);
+int APS5_VABI sceShareSetContentParam(const char* contentParam);
+int APS5_VABI sceShareSetScreenshotOverlayImage(const char* filePath, int32_t marginX, int32_t marginY, int32_t origin);
+int APS5_VABI sceShareTerminate(void);
+int APS5_VABI sceShareUnregisterContentEventCallback(void* callback);
+int APS5_VABI sceShareCaptureScreenshotExtended(const ShareScreenshotParamExtended* param, std::int32_t* requestId);
+int APS5_VABI sceShareCaptureVideoClipExtended(const ShareVideoClipParamExtended* param, std::int32_t* requestId);
+int APS5_VABI sceShareGetRunningStatus(uint32_t* status);
+int APS5_VABI sceShareSetContentParamForApplicationTitle(const char* applicationTitle);
+
+}
diff --git a/core/libs/prx/libSceShare/libSceShare.hpp b/core/libs/prx/libSceShare/libSceShare.hpp
new file mode 100644
index 0000000000..ee79c2f96a
--- /dev/null
+++ b/core/libs/prx/libSceShare/libSceShare.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShare/include/Api.hpp"
diff --git a/core/libs/prx/libSceShareFactoryUtil/Export.cpp b/core/libs/prx/libSceShareFactoryUtil/Export.cpp
index ca9e3680ad..e4b1de17d3 100644
--- a/core/libs/prx/libSceShareFactoryUtil/Export.cpp
+++ b/core/libs/prx/libSceShareFactoryUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShareFactoryUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceShareFactoryUtil/include/Api.hpp b/core/libs/prx/libSceShareFactoryUtil/include/Api.hpp
new file mode 100644
index 0000000000..23f6bad23e
--- /dev/null
+++ b/core/libs/prx/libSceShareFactoryUtil/include/Api.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceShareFactoryUtilBackToGameFromShareFactory();
+int APS5_VABI sceShareFactoryUtilGetLaunchStatus();
+int APS5_VABI sceShareFactoryUtilGetLaunchStatusOfShareFactory();
+int APS5_VABI sceShareFactoryUtilInitialize();
+int APS5_VABI sceShareFactoryUtilLaunchShareFactory();
+int APS5_VABI sceShareFactoryUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceShareFactoryUtil/libSceShareFactoryUtil.hpp b/core/libs/prx/libSceShareFactoryUtil/libSceShareFactoryUtil.hpp
new file mode 100644
index 0000000000..7d666fde94
--- /dev/null
+++ b/core/libs/prx/libSceShareFactoryUtil/libSceShareFactoryUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShareFactoryUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceShareInternal.native/libSceShareInternal.native.hpp b/core/libs/prx/libSceShareInternal.native/libSceShareInternal.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceShareInternal.native/libSceShareInternal.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSharePlay/Export.cpp b/core/libs/prx/libSceSharePlay/Export.cpp
index a1dcf5eadf..05910a7c56 100644
--- a/core/libs/prx/libSceSharePlay/Export.cpp
+++ b/core/libs/prx/libSceSharePlay/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSharePlay/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <mutex>
@@ -41,7 +42,7 @@ int APS5_VABI sceSharePlayGetCurrentConnectionInfoA(SharePlayConnectionInfoA* in
 int APS5_VABI sceSharePlayProhibitController(std::uint8_t prohibited) {
     std::lock_guard lock(g_mutex);
     if (!g_initialized) return SCE_SHARE_PLAY_ERROR_NOT_INITIALIZED;
-    if (prohibited != 0 && prohibited != 1) APS5_INVALID_ARG_EX;
+    if (prohibited != 0 && prohibited != 1) return SCE_SHARE_PLAY_ERROR_INVALID_ARGS;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceSharePlay/include/Api.hpp b/core/libs/prx/libSceSharePlay/include/Api.hpp
new file mode 100644
index 0000000000..6336eae897
--- /dev/null
+++ b/core/libs/prx/libSceSharePlay/include/Api.hpp
@@ -0,0 +1,28 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSharePlayInitialize(void* heap, size_t heapSize);
+int APS5_VABI sceSharePlayTerminate(void);
+int APS5_VABI sceSharePlayGetCurrentConnectionInfoA(SharePlayConnectionInfoA* info);
+int APS5_VABI sceSharePlayProhibitController(std::uint8_t prohibited);
+int APS5_VABI sceSharePlayCrashDaemon(void);
+int APS5_VABI sceSharePlayGetCurrentConnectionInfo(void);
+int APS5_VABI sceSharePlayGetCurrentInfo(void);
+int APS5_VABI sceSharePlayGetEvent(void);
+int APS5_VABI sceSharePlayNotifyDialogOpen(void);
+int APS5_VABI sceSharePlayNotifyForceCloseForCdlg(void);
+int APS5_VABI sceSharePlayResumeScreenForCdlg(void);
+int APS5_VABI sceSharePlayServerLock(void);
+int APS5_VABI sceSharePlayServerUnLock(void);
+int APS5_VABI sceSharePlaySetMode(void);
+int APS5_VABI sceSharePlaySetProhibition(void);
+int APS5_VABI sceSharePlaySetProhibitionModeWithAppId(void);
+int APS5_VABI sceSharePlayStartStandby(void);
+int APS5_VABI sceSharePlayStartStreaming(void);
+int APS5_VABI sceSharePlayStopStandby(void);
+int APS5_VABI sceSharePlayStopStreaming(void);
+
+}
diff --git a/core/libs/prx/libSceSharePlay/libSceSharePlay.hpp b/core/libs/prx/libSceSharePlay/libSceSharePlay.hpp
new file mode 100644
index 0000000000..c68e519720
--- /dev/null
+++ b/core/libs/prx/libSceSharePlay/libSceSharePlay.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSharePlay/include/Api.hpp"
diff --git a/core/libs/prx/libSceShareUtility/Export.cpp b/core/libs/prx/libSceShareUtility/Export.cpp
index fb34206c21..a6cf891afd 100644
--- a/core/libs/prx/libSceShareUtility/Export.cpp
+++ b/core/libs/prx/libSceShareUtility/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShareUtility/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,6 +6,114 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceShareUtilityAdvanceFromFileWithContentIdList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceFromFileWithTitleIdList() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceGetServiceInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceQueryServiceInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceQueryServiceInfoA() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceResetPlayingContent() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceSetPlayingContent() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceSetUploadContentData() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceTerminate() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceValidateContents() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenu() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuBroadcast() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuDefault() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuForShareContent() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityInitializeEx2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityOpenShareMenu() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityOpenShareMenuBroadcast() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityOpenShareMenuDefault() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityOpenShareMenuForShareContent() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceShareUtilityTerminate() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 
 }
diff --git a/core/libs/prx/libSceShareUtility/include/Api.hpp b/core/libs/prx/libSceShareUtility/include/Api.hpp
new file mode 100644
index 0000000000..9ea97606cc
--- /dev/null
+++ b/core/libs/prx/libSceShareUtility/include/Api.hpp
@@ -0,0 +1,30 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceShareUtilityAdvanceFromFileWithContentIdList();
+int APS5_VABI sceShareUtilityAdvanceFromFileWithTitleIdList();
+int APS5_VABI sceShareUtilityAdvanceGetServiceInfo();
+int APS5_VABI sceShareUtilityAdvanceInitialize();
+int APS5_VABI sceShareUtilityAdvanceQueryServiceInfo();
+int APS5_VABI sceShareUtilityAdvanceQueryServiceInfoA();
+int APS5_VABI sceShareUtilityAdvanceResetPlayingContent();
+int APS5_VABI sceShareUtilityAdvanceSetPlayingContent();
+int APS5_VABI sceShareUtilityAdvanceSetUploadContentData();
+int APS5_VABI sceShareUtilityAdvanceTerminate();
+int APS5_VABI sceShareUtilityAdvanceValidateContents();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenu();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuBroadcast();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuDefault();
+int APS5_VABI sceShareUtilityAdvanceWakeUpShareMenuForShareContent();
+int APS5_VABI sceShareUtilityInitialize();
+int APS5_VABI sceShareUtilityInitializeEx2();
+int APS5_VABI sceShareUtilityOpenShareMenu();
+int APS5_VABI sceShareUtilityOpenShareMenuBroadcast();
+int APS5_VABI sceShareUtilityOpenShareMenuDefault();
+int APS5_VABI sceShareUtilityOpenShareMenuForShareContent();
+int APS5_VABI sceShareUtilityTerminate();
+
+}
diff --git a/core/libs/prx/libSceShareUtility/libSceShareUtility.hpp b/core/libs/prx/libSceShareUtility/libSceShareUtility.hpp
new file mode 100644
index 0000000000..90968950c3
--- /dev/null
+++ b/core/libs/prx/libSceShareUtility/libSceShareUtility.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShareUtility/include/Api.hpp"
diff --git a/core/libs/prx/libSceShellUIUtil/Export.cpp b/core/libs/prx/libSceShellUIUtil/Export.cpp
index 2837093a4f..3381c8bd7f 100644
--- a/core/libs/prx/libSceShellUIUtil/Export.cpp
+++ b/core/libs/prx/libSceShellUIUtil/Export.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceShellUIUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct ShellUIUtilLaunchParameter;
-
 extern "C" {
 
 int APS5_VABI sceShellUIUtilCreateTaskToken() {
diff --git a/core/libs/prx/libSceShellUIUtil/include/Api.hpp b/core/libs/prx/libSceShellUIUtil/include/Api.hpp
new file mode 100644
index 0000000000..fe2e641916
--- /dev/null
+++ b/core/libs/prx/libSceShellUIUtil/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct ShellUIUtilLaunchParameter;
+
+extern "C" {
+
+int APS5_VABI sceShellUIUtilCreateTaskToken();
+int APS5_VABI sceShellUIUtilGetAppUrl(const char* application, const char* parameter, char* output, std::uint32_t capacity, std::uint32_t* outputSize);
+int APS5_VABI sceShellUIUtilInitialize();
+int APS5_VABI sceShellUIUtilLaunchByUri(const char* uri, const ShellUIUtilLaunchParameter* parameter);
+int APS5_VABI sceShellUIUtilLaunchTask(std::int32_t taskToken, const char* uri, char* output, std::uint32_t capacity);
+int APS5_VABI sceShellUIUtilTerminate();
+
+}
diff --git a/core/libs/prx/libSceShellUIUtil/libSceShellUIUtil.hpp b/core/libs/prx/libSceShellUIUtil/libSceShellUIUtil.hpp
new file mode 100644
index 0000000000..0b7294088c
--- /dev/null
+++ b/core/libs/prx/libSceShellUIUtil/libSceShellUIUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceShellUIUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceSigninDialog/Export.cpp b/core/libs/prx/libSceSigninDialog/Export.cpp
index 761bf33308..cd55802e70 100644
--- a/core/libs/prx/libSceSigninDialog/Export.cpp
+++ b/core/libs/prx/libSceSigninDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSigninDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceSigninDialog/include/Api.hpp b/core/libs/prx/libSceSigninDialog/include/Api.hpp
new file mode 100644
index 0000000000..5d9a45ed41
--- /dev/null
+++ b/core/libs/prx/libSceSigninDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSigninDialogClose(void);
+int APS5_VABI sceSigninDialogGetResult(void* result);
+int APS5_VABI sceSigninDialogGetStatus(void);
+int APS5_VABI sceSigninDialogInitialize(void);
+int APS5_VABI sceSigninDialogOpen(const void* param);
+int APS5_VABI sceSigninDialogTerminate(void);
+int APS5_VABI sceSigninDialogUpdateStatus(void);
+
+}
diff --git a/core/libs/prx/libSceSigninDialog/libSceSigninDialog.hpp b/core/libs/prx/libSceSigninDialog/libSceSigninDialog.hpp
new file mode 100644
index 0000000000..5791aba9bb
--- /dev/null
+++ b/core/libs/prx/libSceSigninDialog/libSceSigninDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSigninDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceSmart/libSceSmart.hpp b/core/libs/prx/libSceSmart/libSceSmart.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceSmart/libSceSmart.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSocialScreen/Export.cpp b/core/libs/prx/libSceSocialScreen/Export.cpp
index ebaf31823a..31e90003c8 100644
--- a/core/libs/prx/libSceSocialScreen/Export.cpp
+++ b/core/libs/prx/libSceSocialScreen/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSocialScreen/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSocialScreen/include/Api.hpp b/core/libs/prx/libSceSocialScreen/include/Api.hpp
new file mode 100644
index 0000000000..77d98b1b85
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreen/include/Api.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSocialScreenCloseSeparateMode();
+int APS5_VABI sceSocialScreenConfigureSeparateMode();
+int APS5_VABI sceSocialScreenCrashDaemon();
+int APS5_VABI sceSocialScreenGetIgnoreSeparateMode();
+int APS5_VABI sceSocialScreenInitialize();
+int APS5_VABI sceSocialScreenInitializeSeparateModeParameter();
+int APS5_VABI sceSocialScreenOpenSeparateMode();
+int APS5_VABI sceSocialScreenReserveHighFrameRateVideoCaptureRequest();
+int APS5_VABI sceSocialScreenSetIgnoreSeparateMode();
+int APS5_VABI sceSocialScreenSetMode();
+int APS5_VABI sceSocialScreenTerminate();
+
+}
diff --git a/core/libs/prx/libSceSocialScreen/libSceSocialScreen.hpp b/core/libs/prx/libSceSocialScreen/libSceSocialScreen.hpp
new file mode 100644
index 0000000000..c3678800c1
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreen/libSceSocialScreen.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSocialScreen/include/Api.hpp"
diff --git a/core/libs/prx/libSceSocialScreenDialog/CMakeLists.txt b/core/libs/prx/libSceSocialScreenDialog/CMakeLists.txt
new file mode 100644
index 0000000000..83af8dda26
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreenDialog/CMakeLists.txt
@@ -0,0 +1,14 @@
+add_library(libSceSocialScreenDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceSocialScreenDialog PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceSocialScreenDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_social_screen_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestSocialScreenDialog.cpp)
+    target_include_directories(guest_social_screen_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_social_screen_dialog_tests PRIVATE libSceSocialScreenDialog)
+    add_test(NAME guest_social_screen_dialog COMMAND guest_social_screen_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_social_screen_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceSocialScreenDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceSocialScreenDialog/Export.cpp b/core/libs/prx/libSceSocialScreenDialog/Export.cpp
index 17987cec00..b12bb6631e 100644
--- a/core/libs/prx/libSceSocialScreenDialog/Export.cpp
+++ b/core/libs/prx/libSceSocialScreenDialog/Export.cpp
@@ -1,42 +1,71 @@
+#include "prx/libSceSocialScreenDialog/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+std::atomic<int> g_status{COMMON_DIALOG_STATUS_NONE};
+
+}
+
 extern "C" {
 
-int APS5_VABI sceSocialScreenDialogClose() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSocialScreenDialogInitialize(void) {
+    int expected = COMMON_DIALOG_STATUS_NONE;
+    if (!g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_INITIALIZED)) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
     return 0;
 }
 
-int APS5_VABI sceSocialScreenDialogGetResult() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSocialScreenDialogOpen(const void* param) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceSocialScreenDialogGetStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSocialScreenDialogUpdateStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceSocialScreenDialogGetStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceSocialScreenDialogGetResult(void* result) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (status != COMMON_DIALOG_STATUS_FINISHED) return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    const std::int32_t canceled = COMMON_DIALOG_RESULT_USER_CANCELED;
+    std::memcpy(result, &canceled, sizeof(canceled));
     return 0;
 }
 
-int APS5_VABI sceSocialScreenDialogInitialize() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSocialScreenDialogClose(void) {
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceSocialScreenDialogOpen() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceSocialScreenDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceSocialScreenDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceSocialScreenDialogTerminate(void) {
+    if (g_status.exchange(COMMON_DIALOG_STATUS_NONE) == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceSocialScreenDialog/include/Api.hpp b/core/libs/prx/libSceSocialScreenDialog/include/Api.hpp
new file mode 100644
index 0000000000..1c02a641d8
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreenDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSocialScreenDialogInitialize(void);
+int APS5_VABI sceSocialScreenDialogOpen(const void* param);
+int APS5_VABI sceSocialScreenDialogUpdateStatus(void);
+int APS5_VABI sceSocialScreenDialogGetStatus(void);
+int APS5_VABI sceSocialScreenDialogGetResult(void* result);
+int APS5_VABI sceSocialScreenDialogClose(void);
+int APS5_VABI sceSocialScreenDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceSocialScreenDialog/libSceSocialScreenDialog.hpp b/core/libs/prx/libSceSocialScreenDialog/libSceSocialScreenDialog.hpp
new file mode 100644
index 0000000000..91b1893527
--- /dev/null
+++ b/core/libs/prx/libSceSocialScreenDialog/libSceSocialScreenDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSocialScreenDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceSpSysCallWrapper/Export.cpp b/core/libs/prx/libSceSpSysCallWrapper/Export.cpp
index e15c0a9054..485d2fb98f 100644
--- a/core/libs/prx/libSceSpSysCallWrapper/Export.cpp
+++ b/core/libs/prx/libSceSpSysCallWrapper/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSpSysCallWrapper/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSpSysCallWrapper/include/Api.hpp b/core/libs/prx/libSceSpSysCallWrapper/include/Api.hpp
new file mode 100644
index 0000000000..86136aef04
--- /dev/null
+++ b/core/libs/prx/libSceSpSysCallWrapper/include/Api.hpp
@@ -0,0 +1,56 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSpGetPid();
+int APS5_VABI sceSpKernelGettimeofday();
+int APS5_VABI sceSpKernelNanosleep();
+int APS5_VABI sceSpNetConnect();
+int APS5_VABI sceSpNetEpollAbort();
+int APS5_VABI sceSpNetEpollControl();
+int APS5_VABI sceSpNetEpollCreate();
+int APS5_VABI sceSpNetEpollDestroy();
+int APS5_VABI sceSpNetEpollWait();
+int APS5_VABI sceSpNetErrnoLoc();
+int APS5_VABI sceSpNetPoolCreate();
+int APS5_VABI sceSpNetPoolDestroy();
+int APS5_VABI sceSpNetRecv();
+int APS5_VABI sceSpNetResolverAbort();
+int APS5_VABI sceSpNetResolverCreate();
+int APS5_VABI sceSpNetResolverDestroy();
+int APS5_VABI sceSpNetResolverGetError();
+int APS5_VABI sceSpNetResolverStartNtoa();
+int APS5_VABI sceSpNetSend();
+int APS5_VABI sceSpNetSetsockopt();
+int APS5_VABI sceSpNetSocket();
+int APS5_VABI sceSpNetSocketClose();
+int APS5_VABI sceSpPthreadAttrDestroy();
+int APS5_VABI sceSpPthreadAttrInit();
+int APS5_VABI sceSpPthreadAttrSetinheritsched();
+int APS5_VABI sceSpPthreadAttrSetschedparam();
+int APS5_VABI sceSpPthreadAttrSetstacksize();
+int APS5_VABI sceSpPthreadCondDestroy();
+int APS5_VABI sceSpPthreadCondInit();
+int APS5_VABI sceSpPthreadCondSignal();
+int APS5_VABI sceSpPthreadCondWait();
+int APS5_VABI sceSpPthreadCondattrDestroy();
+int APS5_VABI sceSpPthreadCondattrInit();
+int APS5_VABI sceSpPthreadCreate();
+int APS5_VABI sceSpPthreadDetach();
+int APS5_VABI sceSpPthreadExit();
+int APS5_VABI sceSpPthreadJoin();
+int APS5_VABI sceSpPthreadMutexDestroy();
+int APS5_VABI sceSpPthreadMutexInit();
+int APS5_VABI sceSpPthreadMutexLock();
+int APS5_VABI sceSpPthreadMutexUnlock();
+int APS5_VABI sceSpPthreadMutexattrDestroy();
+int APS5_VABI sceSpPthreadMutexattrInit();
+int APS5_VABI sceSpPthreadMutexattrSetprioceiling();
+int APS5_VABI sceSpPthreadMutexattrSetprotocol();
+int APS5_VABI sceSpPthreadMutexattrSettype();
+int APS5_VABI sceSpPthreadSetprio();
+int APS5_VABI sceSpSelect();
+
+}
diff --git a/core/libs/prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp b/core/libs/prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp
new file mode 100644
index 0000000000..452ed7469c
--- /dev/null
+++ b/core/libs/prx/libSceSpSysCallWrapper/libSceSpSysCallWrapper.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSpSysCallWrapper/include/Api.hpp"
diff --git a/core/libs/prx/libSceSrcUtl/Export.cpp b/core/libs/prx/libSceSrcUtl/Export.cpp
index fac2eada51..3494cee76b 100644
--- a/core/libs/prx/libSceSrcUtl/Export.cpp
+++ b/core/libs/prx/libSceSrcUtl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSrcUtl/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSrcUtl/include/Api.hpp b/core/libs/prx/libSceSrcUtl/include/Api.hpp
new file mode 100644
index 0000000000..b4db4c7c48
--- /dev/null
+++ b/core/libs/prx/libSceSrcUtl/include/Api.hpp
@@ -0,0 +1,17 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSrcUtilityFinalize();
+int APS5_VABI sceSrcUtilityFlush();
+int APS5_VABI sceSrcUtilityGetDelaySamples();
+int APS5_VABI sceSrcUtilityGetHandleSize();
+int APS5_VABI sceSrcUtilityGetPriority();
+int APS5_VABI sceSrcUtilityInitialize();
+int APS5_VABI sceSrcUtilityInitializeEx();
+int APS5_VABI sceSrcUtilityResample();
+int APS5_VABI sceSrcUtilitySetPriority();
+
+}
diff --git a/core/libs/prx/libSceSrcUtl/libSceSrcUtl.hpp b/core/libs/prx/libSceSrcUtl/libSceSrcUtl.hpp
new file mode 100644
index 0000000000..cf118c2ada
--- /dev/null
+++ b/core/libs/prx/libSceSrcUtl/libSceSrcUtl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSrcUtl/include/Api.hpp"
diff --git a/core/libs/prx/libSceSsl/Export.cpp b/core/libs/prx/libSceSsl/Export.cpp
index bfc982dcdc..9d3976dd63 100644
--- a/core/libs/prx/libSceSsl/Export.cpp
+++ b/core/libs/prx/libSceSsl/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #ifdef _WIN32
 #include <winsock2.h>
 #else
@@ -466,8 +467,6 @@ struct Session {
     }
 };
 
-using SslVerifyCallback = int (APS5_VABI *)(int, unsigned int, void**, int, void*);
-
 constexpr int SslVersionSsl30 = 2;
 constexpr int SslVersionTls12 = 5;
 
@@ -1337,8 +1336,7 @@ int APS5_VABI sceSslLoadRootCACert() {
 }
 
 int APS5_VABI sceSslRecv(int sslConnectionId, void* buf, std::size_t fulllen) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceSslRead(sslConnectionId, buf, fulllen, 0);
 }
 
 int APS5_VABI sceSslReuseConnection(int sslConnectionId, int sockId) {
@@ -1347,8 +1345,7 @@ int APS5_VABI sceSslReuseConnection(int sslConnectionId, int sockId) {
 }
 
 int APS5_VABI sceSslSend(int sslConnectionId, void* msg, std::size_t fulllen) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceSslWrite(sslConnectionId, msg, fulllen, 0);
 }
 
 int APS5_VABI sceSslSetSslVersion() {
diff --git a/core/libs/prx/libSceSsl/include/Ssl.hpp b/core/libs/prx/libSceSsl/include/Ssl.hpp
new file mode 100644
index 0000000000..38e5e14589
--- /dev/null
+++ b/core/libs/prx/libSceSsl/include/Ssl.hpp
@@ -0,0 +1,65 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include "prx/libSceSsl/SslTypes.hpp"
+
+using SslVerifyCallback = int (APS5_VABI *)(int, unsigned int, void**, int, void*);
+
+extern "C" {
+
+int APS5_VABI sceSslInit_nid_postfix(std::uint64_t poolSize);
+int APS5_VABI sceSslTerm_nid_postfix(int sslCtxId);
+int APS5_VABI sceSslGetMemoryPoolStats(int sslCtxId, SceSsl::MemoryPoolStats* stats);
+int APS5_VABI sceSslLoadCert(int sslCtxId, int caCertNum, SceSsl::Data** caList, SceSsl::Data* cert, SceSsl::Data* privateKey);
+int APS5_VABI sceSslUnloadCert(int sslCtxId);
+int APS5_VABI sceSslGetCaList(int sslCtxId, SceSsl::CaList* output);
+int APS5_VABI sceSslFreeCaList(int sslCtxId, SceSsl::CaList* list);
+int APS5_VABI sceSslGetCaCerts(int sslCtxId, SceSsl::CaCerts* output);
+int APS5_VABI sceSslFreeCaCerts(int sslCtxId, SceSsl::CaCerts* certificates);
+int APS5_VABI sceSslCreateConnection(int sslCtxId, int sockId, const char* host);
+int APS5_VABI sceSslDeleteConnection(int sslConnectionId);
+int APS5_VABI sceSslSetVerifyCallback(int sslConnectionId, SslVerifyCallback cbfunc, void* userArg);
+int APS5_VABI sceSslConnect(int sslConnectionId);
+int APS5_VABI sceSslRead(int sslConnectionId, void* buf, size_t len, int flags);
+int APS5_VABI sceSslWrite(int sslConnectionId, void* buf, size_t len, int flags);
+int APS5_VABI sceSslClose(int sslConnectionId);
+int APS5_VABI sceSslGetSerialNumber(int sslCtxId, void* sslCert, unsigned char* sboData, std::size_t* sboLen);
+int APS5_VABI sceSslFreeSslCertName(int sslCtxId, void* certName);
+int APS5_VABI sceSslEnableVerifyOption(int sslConnectionId, std::uint32_t option);
+int APS5_VABI sceSslDisableVerifyOption(int sslConnectionId, std::uint32_t option);
+const char* APS5_VABI sceSslGetAlpnSelected(int sslConnectionId);
+int APS5_VABI sceSslSetAlpn(int sslConnectionId, const char* proto);
+int APS5_VABI sceSslSetMinSslVersion(int sslConnectionId, int version);
+void* APS5_VABI sceSslGetIssuerName(int sslCtxId, void* sslCert);
+int APS5_VABI sceSslGetNameEntryCount(int sslCtxId, void* certName);
+int APS5_VABI sceSslGetNameEntryInfo(int sslCtxId, void* certName, int entryNum, char* oidname, std::size_t maxOidnameLen, char* value, std::size_t maxValueLen, std::size_t* valueLen);
+int APS5_VABI sceSslGetNotBefore(int sslCtxId, void* sslCert, SceSsl::RtcTick* begin);
+int APS5_VABI sceSslGetNotAfter(int sslCtxId, void* sslCert, SceSsl::RtcTick* limit);
+int APS5_VABI sceSslGetFingerprint(int sslCtxId, void* sslCert, int hashType, unsigned char* fingerprint);
+int APS5_VABI sceSslGetPem(int sslCtxId, void* sslCert, char* buf, std::size_t* bufLen);
+void* APS5_VABI sceSslGetSubjectName(int sslCtxId, void* sslCert);
+int APS5_VABI CA_MGMT_extractKeyBlobEx();
+int APS5_VABI CA_MGMT_extractPublicKeyInfo();
+int APS5_VABI CA_MGMT_freeKeyBlob();
+int APS5_VABI CRYPTO_initAsymmetricKey();
+int APS5_VABI CRYPTO_uninitAsymmetricKey();
+int APS5_VABI RSA_verifySignature();
+int APS5_VABI VLONG_freeVlongQueue();
+int APS5_VABI sceSslCheckRecvPending();
+int APS5_VABI sceSslCreateSslConnection();
+int APS5_VABI sceSslDeleteSslConnection();
+int APS5_VABI sceSslDisableOption();
+int APS5_VABI sceSslDisableOptionInternal();
+int APS5_VABI sceSslDisableOptionInternalInsecure();
+int APS5_VABI sceSslEnableOption();
+int APS5_VABI sceSslEnableOptionInternal();
+int APS5_VABI sceSslGetNanoSSLModuleId();
+int APS5_VABI sceSslGetPeerCert();
+int APS5_VABI sceSslGetSslError();
+int APS5_VABI sceSslLoadRootCACert();
+int APS5_VABI sceSslRecv(int sslConnectionId, void* buf, std::size_t fulllen);
+int APS5_VABI sceSslReuseConnection(int sslConnectionId, int sockId);
+int APS5_VABI sceSslSend(int sslConnectionId, void* msg, std::size_t fulllen);
+int APS5_VABI sceSslSetSslVersion();
+
+}
diff --git a/core/libs/prx/libSceSsl/libSceSsl.hpp b/core/libs/prx/libSceSsl/libSceSsl.hpp
new file mode 100644
index 0000000000..731f181cb2
--- /dev/null
+++ b/core/libs/prx/libSceSsl/libSceSsl.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSsl/include/Ssl.hpp"
diff --git a/core/libs/prx/libSceSulphaDrv/Export.cpp b/core/libs/prx/libSceSulphaDrv/Export.cpp
index b956051655..328b7101a6 100644
--- a/core/libs/prx/libSceSulphaDrv/Export.cpp
+++ b/core/libs/prx/libSceSulphaDrv/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSulphaDrv/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSulphaDrv/include/Api.hpp b/core/libs/prx/libSceSulphaDrv/include/Api.hpp
new file mode 100644
index 0000000000..d04d50e887
--- /dev/null
+++ b/core/libs/prx/libSceSulphaDrv/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSulphaGetClientInfo(void);
+int APS5_VABI sceSulphaGetConnectedClientCount(void);
+int APS5_VABI sceSulphaGetDefaultConfig(void);
+int APS5_VABI sceSulphaGetNeededMemory(void);
+int APS5_VABI sceSulphaInit(void);
+int APS5_VABI sceSulphaMessage(void);
+int APS5_VABI sceSulphaSetBookmark(void);
+int APS5_VABI sceSulphaShutdown(void);
+
+}
diff --git a/core/libs/prx/libSceSulphaDrv/libSceSulphaDrv.hpp b/core/libs/prx/libSceSulphaDrv/libSceSulphaDrv.hpp
new file mode 100644
index 0000000000..1f85062b91
--- /dev/null
+++ b/core/libs/prx/libSceSulphaDrv/libSceSulphaDrv.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSulphaDrv/include/Api.hpp"
diff --git a/core/libs/prx/libSceSysBridge/libSceSysBridge.hpp b/core/libs/prx/libSceSysBridge/libSceSysBridge.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceSysBridge/libSceSysBridge.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSysCore/Export.cpp b/core/libs/prx/libSceSysCore/Export.cpp
index f06a188fd8..7758a11ed7 100644
--- a/core/libs/prx/libSceSysCore/Export.cpp
+++ b/core/libs/prx/libSceSysCore/Export.cpp
@@ -1,12 +1,9 @@
+#include "prx/libSceSysCore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct ApplicationInfo {
-    std::byte data[152];
-};
-
 static_assert(sizeof(ApplicationInfo) == 152);
 
 extern "C" {
@@ -16,4 +13,288 @@ int APS5_VABI sceApplicationGetAppInfoByAppId(std::uint32_t applicationId, Appli
     return 0;
 }
 
+int APS5_VABI _sceApplicationGetAppId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationAddProcess2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationBeginSclkChange() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationBlockingKill2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationBlockingKill3() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationContinue() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationCrashSyscore() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationCrashSystemProcess() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationEndSclkChange() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationExitSpawn() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationExitSpawn2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationFinalize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetAppPackageInfoForCoredump() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCompiledSdkVersionByAppId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCoredumpDirAndFileName() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCoredumpState() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCpuUsage() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetCpuUsage2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetDbgExecutablePath() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetProcs() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetShellCoreAppId() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationGetStateForDebugger() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationInitialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationInitializeForShellCore() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsCrashReportBeingProcessed() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsPrimaryProcess() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsResumable() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationIsSuspendable() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationKickCoredump() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationKickCoredump2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationKill() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessKill() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessKill2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessResume() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationLocalProcessSuspend() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyCoredumpRequestEnd() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyCoredumpRequestProgress() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyVshMainOnStandby() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationNotifyVshReady() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationOnAllResourceReleased() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRaiseException() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRaiseExceptionToLocalPid() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRaiseExceptionToPid() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRequestToChangeRenderingMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationRestore() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationResume() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSave() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendDebugSpawnResult2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerKillRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerResumeRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerSuspendRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSendResultOfDebuggerTitleIdLaunchRequest() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetApplicationFocus() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetControllerFocus() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetControllerFocusPermissionToSubProcess() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSetMemoryPstate() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSignalShellCoreHeartBeat() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSpawn2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSuspend() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSuspendSystemForDebugger() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSwitchToBaseMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSwitchToNeoMode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSwitchToNeoMode2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemReboot() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemShutdown2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemSuspend() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplicationSystemSuspend2() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceApplictionGetStateForDebugger() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceSysCoreGetEventCount() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+int APS5_VABI sceSysCoreReceiveEvent() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 }
diff --git a/core/libs/prx/libSceSysCore/include/Api.hpp b/core/libs/prx/libSceSysCore/include/Api.hpp
new file mode 100644
index 0000000000..8f3529042c
--- /dev/null
+++ b/core/libs/prx/libSceSysCore/include/Api.hpp
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct ApplicationInfo {
+    std::byte data[152];
+};
+
+extern "C" {
+
+int APS5_VABI sceApplicationGetAppInfoByAppId(std::uint32_t applicationId, ApplicationInfo* info);
+
+int APS5_VABI _sceApplicationGetAppId();
+int APS5_VABI sceApplicationAddProcess2();
+int APS5_VABI sceApplicationBeginSclkChange();
+int APS5_VABI sceApplicationBlockingKill2();
+int APS5_VABI sceApplicationBlockingKill3();
+int APS5_VABI sceApplicationContinue();
+int APS5_VABI sceApplicationCrashSyscore();
+int APS5_VABI sceApplicationCrashSystemProcess();
+int APS5_VABI sceApplicationEndSclkChange();
+int APS5_VABI sceApplicationExitSpawn();
+int APS5_VABI sceApplicationExitSpawn2();
+int APS5_VABI sceApplicationFinalize();
+int APS5_VABI sceApplicationGetAppPackageInfoForCoredump();
+int APS5_VABI sceApplicationGetCompiledSdkVersionByAppId();
+int APS5_VABI sceApplicationGetCoredumpDirAndFileName();
+int APS5_VABI sceApplicationGetCoredumpState();
+int APS5_VABI sceApplicationGetCpuUsage();
+int APS5_VABI sceApplicationGetCpuUsage2();
+int APS5_VABI sceApplicationGetDbgExecutablePath();
+int APS5_VABI sceApplicationGetMode();
+int APS5_VABI sceApplicationGetProcs();
+int APS5_VABI sceApplicationGetShellCoreAppId();
+int APS5_VABI sceApplicationGetStateForDebugger();
+int APS5_VABI sceApplicationInitialize();
+int APS5_VABI sceApplicationInitializeForShellCore();
+int APS5_VABI sceApplicationIsCrashReportBeingProcessed();
+int APS5_VABI sceApplicationIsPrimaryProcess();
+int APS5_VABI sceApplicationIsResumable();
+int APS5_VABI sceApplicationIsSuspendable();
+int APS5_VABI sceApplicationKickCoredump();
+int APS5_VABI sceApplicationKickCoredump2();
+int APS5_VABI sceApplicationKill();
+int APS5_VABI sceApplicationLocalProcessKill();
+int APS5_VABI sceApplicationLocalProcessKill2();
+int APS5_VABI sceApplicationLocalProcessResume();
+int APS5_VABI sceApplicationLocalProcessSuspend();
+int APS5_VABI sceApplicationNotifyCoredumpRequestEnd();
+int APS5_VABI sceApplicationNotifyCoredumpRequestProgress();
+int APS5_VABI sceApplicationNotifyVshMainOnStandby();
+int APS5_VABI sceApplicationNotifyVshReady();
+int APS5_VABI sceApplicationOnAllResourceReleased();
+int APS5_VABI sceApplicationRaiseException();
+int APS5_VABI sceApplicationRaiseExceptionToLocalPid();
+int APS5_VABI sceApplicationRaiseExceptionToPid();
+int APS5_VABI sceApplicationRequestToChangeRenderingMode();
+int APS5_VABI sceApplicationRestore();
+int APS5_VABI sceApplicationResume();
+int APS5_VABI sceApplicationSave();
+int APS5_VABI sceApplicationSendDebugSpawnResult2();
+int APS5_VABI sceApplicationSendResultOfDebuggerKillRequest();
+int APS5_VABI sceApplicationSendResultOfDebuggerResumeRequest();
+int APS5_VABI sceApplicationSendResultOfDebuggerSuspendRequest();
+int APS5_VABI sceApplicationSendResultOfDebuggerTitleIdLaunchRequest();
+int APS5_VABI sceApplicationSetApplicationFocus();
+int APS5_VABI sceApplicationSetControllerFocus();
+int APS5_VABI sceApplicationSetControllerFocusPermissionToSubProcess();
+int APS5_VABI sceApplicationSetMemoryPstate();
+int APS5_VABI sceApplicationSignalShellCoreHeartBeat();
+int APS5_VABI sceApplicationSpawn2();
+int APS5_VABI sceApplicationSuspend();
+int APS5_VABI sceApplicationSuspendSystemForDebugger();
+int APS5_VABI sceApplicationSwitchToBaseMode();
+int APS5_VABI sceApplicationSwitchToNeoMode();
+int APS5_VABI sceApplicationSwitchToNeoMode2();
+int APS5_VABI sceApplicationSystemReboot();
+int APS5_VABI sceApplicationSystemShutdown2();
+int APS5_VABI sceApplicationSystemSuspend();
+int APS5_VABI sceApplicationSystemSuspend2();
+int APS5_VABI sceApplictionGetStateForDebugger();
+int APS5_VABI sceSysCoreGetEventCount();
+int APS5_VABI sceSysCoreReceiveEvent();
+
+}
diff --git a/core/libs/prx/libSceSysCore/libSceSysCore.hpp b/core/libs/prx/libSceSysCore/libSceSysCore.hpp
new file mode 100644
index 0000000000..c0d6d0db48
--- /dev/null
+++ b/core/libs/prx/libSceSysCore/libSceSysCore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSysCore/include/Api.hpp"
diff --git a/core/libs/prx/libSceSysUtil/Export.cpp b/core/libs/prx/libSceSysUtil/Export.cpp
index 6ff461210b..a6f707cd6e 100644
--- a/core/libs/prx/libSceSysUtil/Export.cpp
+++ b/core/libs/prx/libSceSysUtil/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSysUtil/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSysUtil/include/Api.hpp b/core/libs/prx/libSceSysUtil/include/Api.hpp
new file mode 100644
index 0000000000..f07cd4a9b9
--- /dev/null
+++ b/core/libs/prx/libSceSysUtil/include/Api.hpp
@@ -0,0 +1,32 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSysUtilSendSystemNotificationWithText(int32_t type, const char* message);
+int APS5_VABI sceSysUtilSendAddressingSystemNotification();
+int APS5_VABI sceSysUtilSendAddressingSystemNotificationWithDeviceId();
+int APS5_VABI sceSysUtilSendAddressingSystemNotificationWithUserId();
+int APS5_VABI sceSysUtilSendAddressingSystemNotificationWithUserName();
+int APS5_VABI sceSysUtilSendNotificationRequest();
+int APS5_VABI sceSysUtilSendNpDebugNotificationRequest();
+int APS5_VABI sceSysUtilSendSystemNotification();
+int APS5_VABI sceSysUtilSendSystemNotification2();
+int APS5_VABI sceSysUtilSendSystemNotificationParamInit();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppId();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppInfo();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppName();
+int APS5_VABI sceSysUtilSendSystemNotificationWithAppNameRelatedToUser();
+int APS5_VABI sceSysUtilSendSystemNotificationWithDeviceId();
+int APS5_VABI sceSysUtilSendSystemNotificationWithDeviceIdRelatedToUser();
+int APS5_VABI sceSysUtilSendSystemNotificationWithErrorCode();
+int APS5_VABI sceSysUtilSendSystemNotificationWithParams();
+int APS5_VABI sceSysUtilSendSystemNotificationWithTextRelatedToUser();
+int APS5_VABI sceSysUtilSendSystemNotificationWithUserId();
+int APS5_VABI sceSysUtilSendSystemNotificationWithUserName();
+int APS5_VABI sceSysUtilSendSystemNotificationWithUserNameInfo();
+int APS5_VABI sceSysUtilSendTrcCheckNotificationRequest();
+int APS5_VABI sceSysUtilSendWebDebugNotificationRequest();
+
+}
diff --git a/core/libs/prx/libSceSysUtil/libSceSysUtil.hpp b/core/libs/prx/libSceSysUtil/libSceSysUtil.hpp
new file mode 100644
index 0000000000..15c98b717c
--- /dev/null
+++ b/core/libs/prx/libSceSysUtil/libSceSysUtil.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSysUtil/include/Api.hpp"
diff --git a/core/libs/prx/libSceSysmodule/Export.cpp b/core/libs/prx/libSceSysmodule/Export.cpp
index 78b4774cfa..272768fe00 100644
--- a/core/libs/prx/libSceSysmodule/Export.cpp
+++ b/core/libs/prx/libSceSysmodule/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSysmodule/include/Api.hpp"
 #include <cstdint>
 #include <cstring>
 #include <map>
@@ -17,8 +19,6 @@
 #include "ModuleTable.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
-
 namespace {
 
 constexpr int SCE_SYSMODULE_ERROR_INVALID_VALUE = static_cast<int>(0x805A1000);
diff --git a/core/libs/prx/libSceSysmodule/include/Api.hpp b/core/libs/prx/libSceSysmodule/include/Api.hpp
new file mode 100644
index 0000000000..db439f37b3
--- /dev/null
+++ b/core/libs/prx/libSceSysmodule/include/Api.hpp
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSysmoduleGetModuleInfoForUnwind(std::uint64_t addr, int flags, ModuleInfoForUnwind* info);
+int APS5_VABI sceSysmoduleGetModuleHandleInternal(std::uint32_t id, std::int32_t* handle);
+int APS5_VABI sceSysmoduleIsLoaded(std::uint16_t id);
+int APS5_VABI sceSysmoduleLoadModule(std::uint16_t id);
+int APS5_VABI sceSysmoduleLoadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
+int APS5_VABI sceSysmoduleUnloadModule(std::uint16_t id);
+int APS5_VABI sceSysmoduleLoadModuleInternal(std::uint32_t id);
+int APS5_VABI sceSysmoduleUnloadModuleInternal(std::uint32_t id);
+int APS5_VABI sceSysmoduleUnloadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
+int APS5_VABI sceSysmoduleIsLoadedInternal(std::uint32_t id);
+int APS5_VABI sceSysmoduleIsCalledFromSysModule();
+int APS5_VABI sceSysmoduleIsCameraPreloaded();
+int APS5_VABI sceSysmoduleLoadModuleByNameInternal(std::uint8_t* fname, std::uint64_t a1, std::uint64_t a2, std::uint64_t a3, std::uint64_t a4, std::uint64_t a5);
+int APS5_VABI sceSysmoduleMapLibcForLibkernel();
+int APS5_VABI sceSysmodulePreloadModuleForLibkernel();
+int APS5_VABI sceSysmoduleUnloadModuleByNameInternal();
+
+}
diff --git a/core/libs/prx/libSceSysmodule/libSceSysmodule.hpp b/core/libs/prx/libSceSysmodule/libSceSysmodule.hpp
new file mode 100644
index 0000000000..235f65eecc
--- /dev/null
+++ b/core/libs/prx/libSceSysmodule/libSceSysmodule.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSysmodule/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemGesture/Export.cpp b/core/libs/prx/libSceSystemGesture/Export.cpp
index 5e1fb249e6..056318a3a4 100644
--- a/core/libs/prx/libSceSystemGesture/Export.cpp
+++ b/core/libs/prx/libSceSystemGesture/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemGesture/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemGesture/include/Api.hpp b/core/libs/prx/libSceSystemGesture/include/Api.hpp
new file mode 100644
index 0000000000..ef1667c91e
--- /dev/null
+++ b/core/libs/prx/libSceSystemGesture/include/Api.hpp
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemGestureAppendTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureClose(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureCreateTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer, int32_t type, const SystemGestureRectangle* rectangle, const void* param);
+int APS5_VABI sceSystemGestureFinalizePrimitiveTouchRecognizer(void);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByIndex(int32_t gestureHandle, uint32_t index, SystemGesturePrimitiveTouchEvent* event);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByPrimitiveID(int32_t gestureHandle, uint16_t primitiveId, SystemGesturePrimitiveTouchEvent* event);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEvents(int32_t gestureHandle, SystemGesturePrimitiveTouchEvent* eventBuffer, uint32_t capacityOfBuffer, uint32_t* numberOfEvent);
+int APS5_VABI sceSystemGestureGetPrimitiveTouchEventsCount(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureGetTouchEventByEventID(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, uint32_t eventId, SystemGestureTouchEvent* event);
+int APS5_VABI sceSystemGestureGetTouchEventByIndex(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, uint32_t index, SystemGestureTouchEvent* event);
+int APS5_VABI sceSystemGestureGetTouchEvents(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, SystemGestureTouchEvent* eventBuffer, uint32_t capacityOfBuffer, uint32_t* numberOfEvent);
+int APS5_VABI sceSystemGestureGetTouchEventsCount(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureGetTouchRecognizerInformation(int32_t gestureHandle, const SystemGestureTouchRecognizer* recognizer, SystemGestureTouchRecognizerInformation* information);
+int APS5_VABI sceSystemGestureInitializePrimitiveTouchRecognizer();
+int32_t APS5_VABI sceSystemGestureOpen(int32_t inputType, const void* param);
+int APS5_VABI sceSystemGestureRemoveTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureResetPrimitiveTouchRecognizer(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureResetTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureUpdateAllTouchRecognizer(int32_t gestureHandle);
+int APS5_VABI sceSystemGestureUpdatePrimitiveTouchRecognizer(int32_t gestureHandle, const SystemGestureTouchPadData* input);
+int APS5_VABI sceSystemGestureUpdateTouchRecognizer(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer);
+int APS5_VABI sceSystemGestureUpdateTouchRecognizerRectangle(int32_t gestureHandle, SystemGestureTouchRecognizer* recognizer, const SystemGestureRectangle* rectangle);
+int APS5_VABI sceSystemGestureDebugGetVersion();
+
+}
diff --git a/core/libs/prx/libSceSystemGesture/libSceSystemGesture.hpp b/core/libs/prx/libSceSystemGesture/libSceSystemGesture.hpp
new file mode 100644
index 0000000000..1e6ac94f6a
--- /dev/null
+++ b/core/libs/prx/libSceSystemGesture/libSceSystemGesture.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemGesture/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger/Export.cpp b/core/libs/prx/libSceSystemLogger/Export.cpp
index 0b82cdf1e0..ebad08c6b3 100644
--- a/core/libs/prx/libSceSystemLogger/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger/include/Api.hpp b/core/libs/prx/libSceSystemLogger/include/Api.hpp
new file mode 100644
index 0000000000..d5e47a68e5
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLoggerInitialize();
+int APS5_VABI sceSystemLoggerSetLogData();
+int APS5_VABI sceSystemLoggerTerminate();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger/libSceSystemLogger.hpp b/core/libs/prx/libSceSystemLogger/libSceSystemLogger.hpp
new file mode 100644
index 0000000000..e47ab854c6
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger/libSceSystemLogger.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2/Export.cpp b/core/libs/prx/libSceSystemLogger2/Export.cpp
index d81f4a5e32..860ef63046 100644
--- a/core/libs/prx/libSceSystemLogger2/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger2/Export.cpp
@@ -1,10 +1,34 @@
-#include <cstddef>
+#include "prx/libSceSystemLogger2/include/Api.hpp"
 #include <cstdint>
+#include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceSystemLogger2GetTimestamp() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceSystemLogger2Initialize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceSystemLogger2SetEventAsync() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceSystemLogger2SetEventAsyncEx() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceSystemLogger2Terminate() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 
 }
diff --git a/core/libs/prx/libSceSystemLogger2/include/Api.hpp b/core/libs/prx/libSceSystemLogger2/include/Api.hpp
new file mode 100644
index 0000000000..4b8e19eaf0
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLogger2GetTimestamp();
+int APS5_VABI sceSystemLogger2Initialize();
+int APS5_VABI sceSystemLogger2SetEventAsync();
+int APS5_VABI sceSystemLogger2SetEventAsyncEx();
+int APS5_VABI sceSystemLogger2Terminate();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger2/libSceSystemLogger2.hpp b/core/libs/prx/libSceSystemLogger2/libSceSystemLogger2.hpp
new file mode 100644
index 0000000000..931a124f24
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2/libSceSystemLogger2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger2/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp b/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp
index a071ef1bed..c01af333e1 100644
--- a/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger2Delivery/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger2Delivery/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2Delivery/include/Api.hpp b/core/libs/prx/libSceSystemLogger2Delivery/include/Api.hpp
new file mode 100644
index 0000000000..c0263701f7
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2Delivery/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLogger2DeliveryGetBatchResult();
+int APS5_VABI sceSystemLogger2DeliveryGetResult();
+int APS5_VABI sceSystemLogger2DeliverySetBatchDeliveryEvent();
+int APS5_VABI sceSystemLogger2DeliveryTerminate();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger2Delivery/libSceSystemLogger2Delivery.hpp b/core/libs/prx/libSceSystemLogger2Delivery/libSceSystemLogger2Delivery.hpp
new file mode 100644
index 0000000000..e91f676c51
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2Delivery/libSceSystemLogger2Delivery.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger2Delivery/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2Game/libSceSystemLogger2Game.hpp b/core/libs/prx/libSceSystemLogger2Game/libSceSystemLogger2Game.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2Game/libSceSystemLogger2Game.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp b/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp
index 1087fa235d..ae54608dbe 100644
--- a/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp
+++ b/core/libs/prx/libSceSystemLogger2NativeQueueClient/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp b/core/libs/prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp
new file mode 100644
index 0000000000..3631a92feb
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemLogger2NativeQueueClientCheckAndMaskData();
+int APS5_VABI sceSystemLogger2NativeQueueClientGetEvent();
+int APS5_VABI sceSystemLogger2NativeQueueClientSetDeliveryEnable();
+int APS5_VABI sceSystemLogger2NativeQueueClientSetDeliveryResult();
+int APS5_VABI sceSystemLogger2NativeQueueClientSetNativeQueueConfig();
+
+}
diff --git a/core/libs/prx/libSceSystemLogger2NativeQueueClient/libSceSystemLogger2NativeQueueClient.hpp b/core/libs/prx/libSceSystemLogger2NativeQueueClient/libSceSystemLogger2NativeQueueClient.hpp
new file mode 100644
index 0000000000..50e859ed9d
--- /dev/null
+++ b/core/libs/prx/libSceSystemLogger2NativeQueueClient/libSceSystemLogger2NativeQueueClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemLogger2NativeQueueClient/include/Api.hpp"
diff --git a/core/libs/prx/libSceSystemService/CMakeLists.txt b/core/libs/prx/libSceSystemService/CMakeLists.txt
index 3542172d1b..02c5161b32 100644
--- a/core/libs/prx/libSceSystemService/CMakeLists.txt
+++ b/core/libs/prx/libSceSystemService/CMakeLists.txt
@@ -22,10 +22,14 @@ if(BUILD_TESTING)
     configure_windows_unwind(guest_loadexec_host)
     find_package(Python3 COMPONENTS Interpreter QUIET)
     if(Python3_FOUND)
+        set(loadexecLibraries $<TARGET_FILE:libSceSystemService> $<TARGET_FILE:libSceAgcDriver> $<TARGET_FILE:libc> $<TARGET_FILE:libkernel>)
+        if(APS5_ENABLE_TRACY)
+            list(APPEND loadexecLibraries $<TARGET_FILE:TracyClient>)
+        endif()
         add_test(NAME loadexec_arguments COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_SOURCE_DIR}/core/relinker/relinker/tests/test_loadexec_arguments.py
             $<TARGET_FILE:relinker> $<TARGET_FILE:guest_loadexec_host>
-            $<TARGET_FILE:libSceSystemService> $<TARGET_FILE:libSceAgcDriver> $<TARGET_FILE:libc> $<TARGET_FILE:libkernel> ${CMAKE_CXX_COMPILER})
+            ${loadexecLibraries} ${CMAKE_CXX_COMPILER})
         set_tests_properties(loadexec_arguments PROPERTIES TIMEOUT 30)
         add_asan_test_options(loadexec_arguments verify_asan_link_order=0)
     endif()
@@ -94,6 +98,29 @@ if(BUILD_TESTING)
         set_tests_properties(guest_system_service_time_zone PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_system_service_app_title_id_tests ${LIBS_INCLUDE_DIR}/tests/GuestSystemServiceAppTitleId.cpp)
+    target_include_directories(guest_system_service_app_title_id_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_system_service_app_title_id_tests PRIVATE libSceSystemService libkernel libc)
+    configure_windows_unwind(guest_system_service_app_title_id_tests)
+    foreach(appTitleIdCase IN ITEMS known:PPSA00000 long:PPSA000000 missing:none)
+        string(REPLACE ":" ";" appTitleIdCase ${appTitleIdCase})
+        list(GET appTitleIdCase 0 appTitleIdName)
+        list(GET appTitleIdCase 1 appTitleIdValue)
+        set(appTitleIdRun ${CMAKE_CURRENT_BINARY_DIR}/guest_system_service_app_title_id_${appTitleIdName})
+        if(appTitleIdName STREQUAL "missing")
+            file(MAKE_DIRECTORY ${appTitleIdRun})
+        else()
+            file(WRITE ${appTitleIdRun}/app0/sce_sys/param.json
+                "{\"titleId\":\"${appTitleIdValue}\",\"localizedParameters\":{\"en-US\":{\"titleName\":\"Example\"}}}")
+        endif()
+        add_test(NAME guest_system_service_app_title_id_${appTitleIdName} COMMAND guest_system_service_app_title_id_tests ${appTitleIdName}
+            WORKING_DIRECTORY ${appTitleIdRun})
+        set_tests_properties(guest_system_service_app_title_id_${appTitleIdName} PROPERTIES TIMEOUT 20)
+        if(WIN32)
+            set_tests_properties(guest_system_service_app_title_id_${appTitleIdName} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endif()
+    endforeach()
     add_test_executable(guest_system_kill_app_tests ${LIBS_INCLUDE_DIR}/tests/GuestSystemKillApp.cpp)
     target_include_directories(guest_system_kill_app_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_system_kill_app_tests PRIVATE libSceSystemService libc)
diff --git a/core/libs/prx/libSceSystemService/Export.cpp b/core/libs/prx/libSceSystemService/Export.cpp
index c2d503d1dc..0b9e30b645 100644
--- a/core/libs/prx/libSceSystemService/Export.cpp
+++ b/core/libs/prx/libSceSystemService/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
+#include <algorithm>
 #include <cerrno>
 #include <chrono>
 #include <cstddef>
@@ -25,11 +27,23 @@
 #include "LoadExec.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include "prx/libSceAgcDriver/Execution/include/HostHdr.hpp"
 
 namespace {
 
+struct MeasuredParameter {
+    int id;
+    int value;
+};
+
+constexpr MeasuredParameter RegistryParameters[] = {
+    {SYSTEM_SERVICE_PARAM_ID_100, 0}, {101, 1}, {102, 2}, {103, 100}, {104, 0x20202}, {105, 0}, {106, 0}, {107, 100}, {108, 0},
+    {109, 100}, {110, 0x20202}, {111, 0}, {200, 0}, {201, 0}, {202, 0}, {203, 0}, {204, 0}, {205, 0}, {206, 0}, {207, 0},
+    {208, 0}, {209, 1}, {210, 71}, {211, 0}, {212, 0}, {213, 0}, {300, 0},
+};
+
 struct ConsoleTimeZone {
     int minutes;
     bool summer;
@@ -231,6 +245,21 @@ HostLaunch PrepareLaunch(const char*, const char* const*) {
 void StartHostExecutable(HostLaunch&) {}
 #endif
 
+constexpr std::size_t TitleIdBufferSize = 10;
+
+std::string RunningTitleId() {
+    const AppTitleId titleId = GetAppTitleId_nid_postfix();
+    return std::string(titleId.value);
+}
+
+void CopyRunningTitleId(const std::string& caller, bool running, char* destination) {
+    if (!running) NotImplemented_nid_no_patch((caller + ": application other than the running title").c_str());
+    if (destination == nullptr) NotImplemented_nid_no_patch((caller + ": null title ID buffer").c_str());
+    const std::string titleId = RunningTitleId();
+    if (titleId.size() >= TitleIdBufferSize) NotImplemented_nid_no_patch((caller + ": title ID that does not fit 10 bytes").c_str());
+    std::memcpy(destination, titleId.c_str(), titleId.size() + 1);
+}
+
 }
 
 extern "C" {
@@ -309,13 +338,11 @@ int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value) {
   case SYSTEM_SERVICE_PARAM_ID_TIME_FORMAT: *value = SYSTEM_SERVICE_PARAM_TIME_FORMAT_24HOUR; break;
   case SYSTEM_SERVICE_PARAM_ID_TIME_ZONE: *value = HostTimeZone().minutes; break;
   case SYSTEM_SERVICE_PARAM_ID_SUMMERTIME: *value = HostTimeZone().summer ? 1 : 0; break;
-  case SYSTEM_SERVICE_PARAM_ID_GAME_PARENTAL_LEVEL: *value = SYSTEM_SERVICE_PARAM_GAME_PARENTAL_OFF; break;
-  case SYSTEM_SERVICE_PARAM_ID_ENTER_BUTTON_ASSIGN: *value = SYSTEM_SERVICE_PARAM_ENTER_BUTTON_CROSS; break;
-  default:
-   if ((paramId >= 100 && paramId <= 111) || (paramId >= 200 && paramId <= 213) || paramId == 300) {
-    NotImplemented_nid_no_patch("sceSystemServiceParamGetInt: registry-backed parameter");
-   }
-   return SYSTEM_SERVICE_ERROR_PARAMETER;
+  default: {
+   const auto measured = std::ranges::find(RegistryParameters, paramId, &MeasuredParameter::id);
+   if (measured == std::ranges::end(RegistryParameters)) return SYSTEM_SERVICE_ERROR_PARAMETER;
+   *value = measured->value;
+  }
  }
  return SYSTEM_SERVICE_OK;
 }
@@ -396,14 +423,6 @@ int APS5_VABI sceSystemServiceOpenChallengeActivity(void) {
  return SYSTEM_SERVICE_OK;
 }
 
-struct SystemServiceTournamentOccurrenceParam {
-    std::uint64_t size;
-    const char* occurrenceId;
-    std::int32_t userId;
-    std::uint32_t padding;
-    const char* context;
-};
-
 static_assert(sizeof(SystemServiceTournamentOccurrenceParam) == 32);
 static_assert(offsetof(SystemServiceTournamentOccurrenceParam, occurrenceId) == 8);
 static_assert(offsetof(SystemServiceTournamentOccurrenceParam, userId) == 16);
@@ -435,6 +454,26 @@ int APS5_VABI sceSystemServiceGetAppIdOfRunningBigApp(void) {
  return SYSTEM_SERVICE_RUNNING_APP_ID;
 }
 
+int APS5_VABI sceSystemServiceGetAppId(const char* titleId) {
+ if (titleId == nullptr) {
+  NotImplemented_nid_no_patch("sceSystemServiceGetAppId: null title ID");
+ }
+ if (RunningTitleId() != titleId) {
+  NotImplemented_nid_no_patch("sceSystemServiceGetAppId: title other than the running title");
+ }
+ return SYSTEM_SERVICE_RUNNING_APP_ID;
+}
+
+int APS5_VABI sceSystemServiceGetAppTitleId(int appId, char* titleId) {
+ CopyRunningTitleId("sceSystemServiceGetAppTitleId", appId == SYSTEM_SERVICE_RUNNING_APP_ID, titleId);
+ return SYSTEM_SERVICE_OK;
+}
+
+int APS5_VABI sceLncUtilGetAppTitleId(std::int32_t appId, char* titleId) {
+ CopyRunningTitleId("sceLncUtilGetAppTitleId", appId == SYSTEM_SERVICE_RUNNING_APP_ID, titleId);
+ return SYSTEM_SERVICE_OK;
+}
+
 int APS5_VABI sceSystemServiceKillApp(int appId, int how, int reason, int coreDump) {
  if (appId != SYSTEM_SERVICE_RUNNING_APP_ID) {
   NotImplemented_nid_no_patch("sceSystemServiceKillApp: application other than the running title");
diff --git a/core/libs/prx/libSceSystemService/PendingExports.cpp b/core/libs/prx/libSceSystemService/PendingExports.cpp
index 9fbb45de38..d2b7fca08e 100644
--- a/core/libs/prx/libSceSystemService/PendingExports.cpp
+++ b/core/libs/prx/libSceSystemService/PendingExports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/General.hpp"
 
 namespace {
@@ -7,72 +8,22 @@ constexpr int SystemServiceRejected = static_cast<int>(0x80A10005);
 
 }
 
-struct ShellCoreErrorDialogParam {
-    const char* message;
-    const char* const* formatArgs;
-    std::uint8_t flag;
-};
-
 static_assert(sizeof(ShellCoreErrorDialogParam) == 24);
 static_assert(offsetof(ShellCoreErrorDialogParam, message) == 0);
 static_assert(offsetof(ShellCoreErrorDialogParam, formatArgs) == 8);
 static_assert(offsetof(ShellCoreErrorDialogParam, flag) == 16);
 
-struct SystemServiceDaemonEvent;
-struct SystemServiceLocalProcessStatus;
 struct SystemServiceEvent;
-struct SystemServicePSButtonEvent;
-struct SystemServicePrivacyDefinitionData;
-struct SystemServicePrivacyDefinitionVersion;
-struct SystemServiceTitleWorkaroundInfo;
-struct SystemServiceStoreParam {
-    std::uint32_t size;
-};
 
 static_assert(sizeof(SystemServiceStoreParam) == 4);
 
-struct SystemServiceCpuPstateParam;
-struct SystemServiceLocalProcessParam;
-struct SystemServiceJvmProcessParam;
-struct SystemServicePs2ProcessParam;
-struct SystemServiceAppInstallStatus;
-struct SystemServiceAppStatus;
-struct ShellCoreLaunchByUriParam {
-    std::uint32_t option;
-    std::int32_t userId;
-};
-
 static_assert(sizeof(ShellCoreLaunchByUriParam) == 8);
 static_assert(offsetof(ShellCoreLaunchByUriParam, option) == 0);
 static_assert(offsetof(ShellCoreLaunchByUriParam, userId) == 4);
-struct ShellCoreTelemetryToken;
-struct ShellCoreUmmStatus {
-    std::int32_t state;
-    std::int32_t inDeviceMuteState;
-};
 
 static_assert(sizeof(ShellCoreUmmStatus) == 8);
 static_assert(offsetof(ShellCoreUmmStatus, state) == 0);
 static_assert(offsetof(ShellCoreUmmStatus, inDeviceMuteState) == 4);
-struct ShellCorePbtcUserInfoList;
-struct ShellCorePrivacyEventData;
-struct ShellCorePsnAccountInfoFirst;
-struct ShellCorePsnAccountInfoSecond;
-struct ShellCorePsnAccountInfoThird;
-struct ShellCorePsnAccountInfoFourth;
-struct ShellCorePsnAccountInfoFifth;
-struct ShellCoreAppLaunchTypeInfo;
-struct LncGpuCrashAppStatus {
-    char titleId[16];
-    std::int32_t appId;
-    std::int32_t appLocalPid;
-    char path[1024];
-    std::int32_t appType;
-    std::int32_t coredumpReason;
-    char corefileName[256];
-    std::uint32_t exceptionCode;
-    std::uint32_t appCategoryType;
-};
 
 static_assert(sizeof(LncGpuCrashAppStatus) == 1320);
 static_assert(offsetof(LncGpuCrashAppStatus, titleId) == 0);
@@ -84,15 +35,6 @@ static_assert(offsetof(LncGpuCrashAppStatus, coredumpReason) == 1052);
 static_assert(offsetof(LncGpuCrashAppStatus, corefileName) == 1056);
 static_assert(offsetof(LncGpuCrashAppStatus, exceptionCode) == 1312);
 static_assert(offsetof(LncGpuCrashAppStatus, appCategoryType) == 1316);
-struct LncLaunchParam {
-    std::uint32_t size;
-    std::int32_t userId;
-    std::int32_t appAttr;
-    std::int32_t enableCrashReport;
-    std::uint64_t checkFlag;
-    std::uint64_t contextId;
-    bool isSpeculativeLaunch;
-};
 
 static_assert(sizeof(LncLaunchParam) == 40);
 static_assert(offsetof(LncLaunchParam, size) == 0);
@@ -102,49 +44,19 @@ static_assert(offsetof(LncLaunchParam, enableCrashReport) == 12);
 static_assert(offsetof(LncLaunchParam, checkFlag) == 16);
 static_assert(offsetof(LncLaunchParam, contextId) == 24);
 static_assert(offsetof(LncLaunchParam, isSpeculativeLaunch) == 32);
-struct LncDaemonEvent;
-struct LncShellUiEvent;
-struct LncLocalProcessStatus {
-    std::int32_t appLocalPid;
-    std::uint8_t reserved[32];
-};
 
 static_assert(sizeof(LncLocalProcessStatus) == 36);
 static_assert(offsetof(LncLocalProcessStatus, appLocalPid) == 0);
 static_assert(offsetof(LncLocalProcessStatus, reserved) == 4);
-struct LncCoredumpState {
-    std::uint32_t progress;
-    std::uint32_t isFinished;
-    std::int32_t result;
-};
 
 static_assert(sizeof(LncCoredumpState) == 12);
 static_assert(offsetof(LncCoredumpState, progress) == 0);
 static_assert(offsetof(LncCoredumpState, isFinished) == 4);
 static_assert(offsetof(LncCoredumpState, result) == 8);
-struct LncVideoFinalizeState {
-    std::uint32_t progress;
-    std::int32_t result;
-};
 
 static_assert(sizeof(LncVideoFinalizeState) == 8);
 static_assert(offsetof(LncVideoFinalizeState, progress) == 0);
 static_assert(offsetof(LncVideoFinalizeState, result) == 4);
-struct LncLocalProcessParam;
-struct LncAppStatus {
-    std::int32_t appId;
-    std::int32_t launchRequestAppId;
-    std::int32_t appType;
-    std::int32_t appAttr;
-    char titleId[16];
-    std::uint32_t appCategoryType;
-    std::int32_t appBootMode;
-    std::int32_t appBootSubMode;
-    char appVer[6];
-    char contentVersion[11];
-    bool isSystemExApp;
-    bool isCdlgInitialized;
-};
 
 static_assert(sizeof(LncAppStatus) == 64);
 static_assert(offsetof(LncAppStatus, appId) == 0);
@@ -159,24 +71,6 @@ static_assert(offsetof(LncAppStatus, appVer) == 44);
 static_assert(offsetof(LncAppStatus, contentVersion) == 50);
 static_assert(offsetof(LncAppStatus, isSystemExApp) == 61);
 static_assert(offsetof(LncAppStatus, isCdlgInitialized) == 62);
-struct LncShellUiAppStatus {
-    std::int32_t appId;
-    std::int32_t appType;
-    std::int32_t appAttr;
-    std::int32_t launchRequestAppId;
-    std::int32_t userId;
-    std::int32_t isActiveCdlg;
-    char path[1024];
-    char sceSysDir[256];
-    std::int32_t isCoredumped;
-    std::int32_t isPrxModuleLoadFailed;
-    std::int32_t appLocalPid;
-    std::int32_t crashReportMode;
-    char category[4];
-    std::uint32_t appCategoryType;
-    std::int32_t appBootMode;
-    std::int32_t appBootSubMode;
-};
 
 static_assert(sizeof(LncShellUiAppStatus) == 1336);
 static_assert(offsetof(LncShellUiAppStatus, appId) == 0);
@@ -195,13 +89,6 @@ static_assert(offsetof(LncShellUiAppStatus, category) == 1320);
 static_assert(offsetof(LncShellUiAppStatus, appCategoryType) == 1324);
 static_assert(offsetof(LncShellUiAppStatus, appBootMode) == 1328);
 static_assert(offsetof(LncShellUiAppStatus, appBootSubMode) == 1332);
-struct AppMessagingMessage {
-    std::int32_t sender;
-    std::uint32_t messageType;
-    std::uint8_t payload[8192];
-    std::uint32_t payloadSize;
-    std::uint64_t timestamp;
-};
 
 static_assert(sizeof(AppMessagingMessage) == 8216);
 static_assert(offsetof(AppMessagingMessage, sender) == 0);
@@ -210,10 +97,6 @@ static_assert(offsetof(AppMessagingMessage, payload) == 8);
 static_assert(offsetof(AppMessagingMessage, payloadSize) == 8200);
 static_assert(offsetof(AppMessagingMessage, timestamp) == 8208);
 
-struct UsbStorageEvent;
-struct UsbStorageDeviceInfo;
-using UsbStorageCallback = void (APS5_VABI *)(const UsbStorageEvent* event, void* userData);
-
 extern "C" {
 
 int APS5_VABI sceAppMessagingClearEventFlag(std::int32_t appId, std::uint64_t flags) {
@@ -386,11 +269,6 @@ int APS5_VABI sceLncUtilGetAppStatusListForShellUIReboot(LncShellUiAppStatus* st
     return 0;
 }
 
-int APS5_VABI sceLncUtilGetAppTitleId(std::int32_t appId, char* titleId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceLncUtilGetAppType(std::int32_t appId, std::uint32_t* type) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1957,11 +1835,6 @@ int APS5_VABI sceSystemServiceGetAppFocusedAppStatus(SystemServiceAppStatus* sta
     return 0;
 }
 
-int APS5_VABI sceSystemServiceGetAppId(const char* titleId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceSystemServiceGetAppIdListOfBigApp(std::int32_t* appIds, std::uint32_t capacity, std::uint32_t* count) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1977,11 +1850,6 @@ int APS5_VABI sceSystemServiceGetAppStatus(SystemServiceAppStatus* status) {
     return 0;
 }
 
-int APS5_VABI sceSystemServiceGetAppTitleId(std::int32_t appId, char* titleId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceSystemServiceGetAppType(std::int32_t appId, std::int32_t* type) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceSystemService/SystemService.hpp b/core/libs/prx/libSceSystemService/SystemService.hpp
index 7b1664cc90..22f85c1123 100644
--- a/core/libs/prx/libSceSystemService/SystemService.hpp
+++ b/core/libs/prx/libSceSystemService/SystemService.hpp
@@ -23,6 +23,7 @@ constexpr int SYSTEM_SERVICE_PARAM_ID_TIME_ZONE = 4;
 constexpr int SYSTEM_SERVICE_PARAM_ID_SUMMERTIME = 5;
 constexpr int SYSTEM_SERVICE_PARAM_ID_SYSTEM_NAME = 6;
 constexpr int SYSTEM_SERVICE_PARAM_ID_GAME_PARENTAL_LEVEL = 7;
+constexpr int SYSTEM_SERVICE_PARAM_ID_100 = 100;
 constexpr int SYSTEM_SERVICE_PARAM_ID_400 = 400;
 constexpr int SYSTEM_SERVICE_PARAM_ID_ENTER_BUTTON_ASSIGN = 1000;
 
@@ -34,8 +35,6 @@ constexpr int SYSTEM_SERVICE_PARAM_LANG_ARABIC = 21;
 constexpr int SYSTEM_SERVICE_PARAM_LANG_UKRAINIAN = 30;
 constexpr int SYSTEM_SERVICE_PARAM_DATE_FORMAT_DDMMYYYY = 1;
 constexpr int SYSTEM_SERVICE_PARAM_TIME_FORMAT_24HOUR = 1;
-constexpr int SYSTEM_SERVICE_PARAM_GAME_PARENTAL_OFF = 0;
-constexpr int SYSTEM_SERVICE_PARAM_ENTER_BUTTON_CROSS = 1;
 
 inline int SystemServiceConsoleLanguage(std::string_view caller) {
     const char* configured = std::getenv("ANYPS5_LANGUAGE");
diff --git a/core/libs/prx/libSceSystemService/include/SystemService.hpp b/core/libs/prx/libSceSystemService/include/SystemService.hpp
new file mode 100644
index 0000000000..6c0120e66b
--- /dev/null
+++ b/core/libs/prx/libSceSystemService/include/SystemService.hpp
@@ -0,0 +1,732 @@
+#pragma once
+
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
+
+#include "SceTypes.hpp"
+
+struct SystemServiceTournamentOccurrenceParam {
+    std::uint64_t size;
+    const char* occurrenceId;
+    std::int32_t userId;
+    std::uint32_t padding;
+    const char* context;
+};
+
+struct ShellCoreErrorDialogParam {
+    const char* message;
+    const char* const* formatArgs;
+    std::uint8_t flag;
+};
+
+struct SystemServiceDaemonEvent;
+struct SystemServiceLocalProcessStatus;
+struct SystemServicePSButtonEvent;
+struct SystemServicePrivacyDefinitionData;
+struct SystemServicePrivacyDefinitionVersion;
+struct SystemServiceTitleWorkaroundInfo;
+
+struct SystemServiceStoreParam {
+    std::uint32_t size;
+};
+
+struct SystemServiceCpuPstateParam;
+struct SystemServiceLocalProcessParam;
+struct SystemServiceJvmProcessParam;
+struct SystemServicePs2ProcessParam;
+struct SystemServiceAppInstallStatus;
+struct SystemServiceAppStatus;
+
+struct ShellCoreLaunchByUriParam {
+    std::uint32_t option;
+    std::int32_t userId;
+};
+
+struct ShellCoreTelemetryToken;
+
+struct ShellCoreUmmStatus {
+    std::int32_t state;
+    std::int32_t inDeviceMuteState;
+};
+
+struct ShellCorePbtcUserInfoList;
+struct ShellCorePrivacyEventData;
+struct ShellCorePsnAccountInfoFirst;
+struct ShellCorePsnAccountInfoSecond;
+struct ShellCorePsnAccountInfoThird;
+struct ShellCorePsnAccountInfoFourth;
+struct ShellCorePsnAccountInfoFifth;
+struct ShellCoreAppLaunchTypeInfo;
+
+struct LncGpuCrashAppStatus {
+    char titleId[16];
+    std::int32_t appId;
+    std::int32_t appLocalPid;
+    char path[1024];
+    std::int32_t appType;
+    std::int32_t coredumpReason;
+    char corefileName[256];
+    std::uint32_t exceptionCode;
+    std::uint32_t appCategoryType;
+};
+
+struct LncLaunchParam {
+    std::uint32_t size;
+    std::int32_t userId;
+    std::int32_t appAttr;
+    std::int32_t enableCrashReport;
+    std::uint64_t checkFlag;
+    std::uint64_t contextId;
+    bool isSpeculativeLaunch;
+};
+
+struct LncDaemonEvent;
+struct LncShellUiEvent;
+
+struct LncLocalProcessStatus {
+    std::int32_t appLocalPid;
+    std::uint8_t reserved[32];
+};
+
+struct LncCoredumpState {
+    std::uint32_t progress;
+    std::uint32_t isFinished;
+    std::int32_t result;
+};
+
+struct LncVideoFinalizeState {
+    std::uint32_t progress;
+    std::int32_t result;
+};
+
+struct LncLocalProcessParam;
+
+struct LncAppStatus {
+    std::int32_t appId;
+    std::int32_t launchRequestAppId;
+    std::int32_t appType;
+    std::int32_t appAttr;
+    char titleId[16];
+    std::uint32_t appCategoryType;
+    std::int32_t appBootMode;
+    std::int32_t appBootSubMode;
+    char appVer[6];
+    char contentVersion[11];
+    bool isSystemExApp;
+    bool isCdlgInitialized;
+};
+
+struct LncShellUiAppStatus {
+    std::int32_t appId;
+    std::int32_t appType;
+    std::int32_t appAttr;
+    std::int32_t launchRequestAppId;
+    std::int32_t userId;
+    std::int32_t isActiveCdlg;
+    char path[1024];
+    char sceSysDir[256];
+    std::int32_t isCoredumped;
+    std::int32_t isPrxModuleLoadFailed;
+    std::int32_t appLocalPid;
+    std::int32_t crashReportMode;
+    char category[4];
+    std::uint32_t appCategoryType;
+    std::int32_t appBootMode;
+    std::int32_t appBootSubMode;
+};
+
+struct AppMessagingMessage {
+    std::int32_t sender;
+    std::uint32_t messageType;
+    std::uint8_t payload[8192];
+    std::uint32_t payloadSize;
+    std::uint64_t timestamp;
+};
+
+extern "C" {
+
+int APS5_VABI sceSystemServiceLoadExec(const char* path, const char* const* arguments);
+int APS5_VABI sceSystemServiceDisableNoticeScreenSkipFlagAutoSet(void);
+int APS5_VABI sceSystemServiceGetDisplaySafeAreaInfo(SystemServiceDisplaySafeAreaInfo* info);
+int APS5_VABI sceSystemServiceShowDisplaySafeAreaSettings(void);
+int APS5_VABI sceSystemServiceGetHdrToneMapLuminance(SystemServiceHdrToneMapLuminance* luminance);
+int APS5_VABI sceSystemServiceGetNoticeScreenSkipFlag(bool* value);
+int APS5_VABI sceSystemServiceGetStatus(SystemServiceStatus* status);
+int APS5_VABI sceSystemServiceHideSplashScreen(void);
+int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value);
+int APS5_VABI sceSystemServiceParamGetString(int paramId, char* buf, size_t bufSize);
+int APS5_VABI sceSystemServicePowerTick(void);
+int APS5_VABI sceSystemServiceReceiveEvent(SystemServiceEvent* event);
+int APS5_VABI sceSystemServiceReportAbnormalTermination(const void* info);
+int APS5_VABI sceSystemServiceSetNoticeScreenSkipFlag(void);
+void APS5_VABI sceSystemServiceInitializePlayerDialogParam(SystemServicePlayerDialogParam* param);
+int APS5_VABI sceSystemServiceDisableMediaPlay();
+int APS5_VABI sceSystemServiceReenableMediaPlay();
+int APS5_VABI sceSystemServiceLaunchPlayerDialog(const void* param);
+int APS5_VABI sceSystemServiceLaunchWebBrowser(const char* uri);
+int APS5_VABI sceSystemServiceLaunchApp(const char* titleId, const char* const* arguments, const void* param);
+int APS5_VABI sceSystemServiceDisableMusicPlayer(void);
+int APS5_VABI sceSystemServiceOpenChallengeActivity(void);
+int APS5_VABI sceSystemServiceOpenTournamentOccurrence(const SystemServiceTournamentOccurrenceParam* param);
+int APS5_VABI sceSystemServiceAddLocalProcessForPsmKit(const char*, const char* const*, const void*);
+int APS5_VABI sceSystemServiceKillLocalProcessForPsmKit(int);
+int APS5_VABI sceSystemServiceReenableMusicPlayer(void);
+int APS5_VABI sceSystemServiceShowControllerSettings(void);
+int APS5_VABI sceSystemServiceGetAppIdOfRunningBigApp(void);
+int APS5_VABI sceSystemServiceKillApp(int appId, int how, int reason, int coreDump);
+int APS5_VABI sceLncUtilKillApp(uint32_t appId);
+int APS5_VABI sceLncUtilKillAppWithReason(uint32_t appId, int reason);
+int APS5_VABI sceSystemServiceLaunchSystemDeeplink(void);
+int APS5_VABI sceShellCoreUtilLaunchByUriParamInit(void);
+int APS5_VABI sceSystemStateMgrTickVideoPlayback(void);
+int APS5_VABI sceSystemServiceTelemetrySetData2WithUserId(void);
+int APS5_VABI sceShellCoreUtilStartUmmDictation(void);
+int APS5_VABI sceSystemServiceGetSpotifyTitleId(void);
+int APS5_VABI sceSystemServiceGetAppStatusListContainsDaemon(void);
+int APS5_VABI sceSystemServiceSwitchToVRApp(void);
+int APS5_VABI sceSystemServiceSwitchToNonVRApp(void);
+int APS5_VABI sceLncUtilGetSpmemAllocatorConfigValue(void);
+int APS5_VABI sceCsbMgrInitialize(void);
+int APS5_VABI sceCsbMgrTerminate(void);
+int APS5_VABI sceCsbMgrCreateLocalSandbox(void);
+int APS5_VABI sceCsbMgrDestroyLocalSandbox(void);
+int APS5_VABI sceCsbMgrSwitchLocalSandbox(void);
+int APS5_VABI sceCsbMgrGetCurrentLocalSandboxId(void);
+int APS5_VABI sceCsbMgrGetLocalSandboxIdList(void);
+int APS5_VABI sceCsbMgrGetLocalSandboxInfo(void);
+int APS5_VABI sceCsbMgrSetLocalSandboxInfo(void);
+int APS5_VABI sceCsbMgrIssueStreamingSandboxInfo(void);
+int APS5_VABI sceReportSequenceHandlerRequestReport(void);
+int APS5_VABI sceReportSequenceHandlerCancelReport(void);
+int APS5_VABI sceReportSequenceHandlerExistsEvent(void);
+int APS5_VABI sceReportSequenceHandlerUpdateEventCache(void);
+int APS5_VABI sceReportSequenceHandlerGetEventCache(void);
+int APS5_VABI sceLncUtilRegisterCallEntries(void);
+int APS5_VABI sceLncUtilGetSpmemConfigJson(void);
+int APS5_VABI sceLncUtilExportSpmemConfigJson(void);
+int APS5_VABI sceLncUtilImportSpmemConfigJson(void);
+int APS5_VABI sceShellCoreUtilExitAppWithValue(void);
+int APS5_VABI sceShellCoreUtilNpDebugSpecialNotification(void);
+int APS5_VABI sceShellCoreUtilIsDddTemperatureDanger(void);
+int APS5_VABI sceShellCoreUtilIsM2StorageTemperatureDanger(void);
+int APS5_VABI sceShellCoreUtilGetAvailableSizeM2(void);
+int APS5_VABI sceShellCoreUtilNotifyConnectAccountStatusChanged(void);
+int APS5_VABI sceShellCoreUtilIsInternalCronosUser(void);
+int APS5_VABI sceShellCoreUtilChangePbtcMode(void);
+int APS5_VABI sceShellCoreUtilTelemetryCacheData(void);
+int APS5_VABI sceShellCoreUtilMicMuteKeyPressed(void);
+int APS5_VABI sceShellCoreUtilSwitchMicMute(void);
+int APS5_VABI sceShellCoreUtilNotifyStartEventToUniversalMicMute(void);
+int APS5_VABI sceShellCoreUtilIsLotusMicActivated(void);
+int APS5_VABI sceShellCoreUtilResetAllNoticeScreenSkipFlag(void);
+int APS5_VABI sceShellCoreUtilResetNoticeScreenSkipFlag(void);
+int APS5_VABI sceShellCoreUtilGetNoticeScreenSkipFlagByAppId(void);
+int APS5_VABI sceShellCoreUtilGetPasscodeInputType(void);
+int APS5_VABI sceShellCoreUtilGetPasscodeDisplayInfo(void);
+int APS5_VABI sceShellCoreUtilNotifySystemResumeTelemetryInfo(void);
+int APS5_VABI sceShellCoreUtilUpdateTelemetryToken(void);
+int APS5_VABI sceShellCoreUtilGetVRBaseMatRectangles(void);
+int APS5_VABI sceShellCoreUtilSetVRBaseMatRectangles(void);
+int APS5_VABI sceShellCoreUtilIsLaunchBlockDialog(void);
+int APS5_VABI sceShellCoreUtilGetConsoleToken(void);
+int APS5_VABI sceShellCoreUtilGetDeviceIdByDeviceUniqueId(void);
+int APS5_VABI sceShellCoreUtilGetDeviceUniqueIdByDeviceId(void);
+int APS5_VABI sceShellCoreUtilGetStreamingClientInfo(void);
+int APS5_VABI sceShellCoreUtilRequestCffUpdate(void);
+int APS5_VABI sceShellCoreUtilGetCffConfig(void);
+int APS5_VABI sceShellCoreUtilRemoveCffConfigFile(void);
+int APS5_VABI sceShellCoreUtilDebugGetNumberOfCffItems(void);
+int APS5_VABI sceShellCoreUtilDebugGetCffInfo(void);
+int APS5_VABI sceShellCoreUtilDebugSetCffStatus(void);
+int APS5_VABI sceShellCoreUtilGetPeripheralConnectionSessionId(void);
+int APS5_VABI sceShellCoreUtilGetCdlgEnabledFreezeRendering(void);
+int APS5_VABI sceShellCoreUtilGetNpTitleId(void);
+int APS5_VABI sceShellCoreUtilIsCronosInGameCommerceEnabled(void);
+int APS5_VABI sceShellCoreUtilLemSettingGet(void);
+int APS5_VABI sceShellCoreUtilLemSettingSet(void);
+int APS5_VABI sceShellCoreUtilLemSettingGetList(void);
+int APS5_VABI sceShellCoreUtilLemSettingReset(void);
+int APS5_VABI sceShellCoreUtilIsEChassisVariant(void);
+int APS5_VABI sceSystemStateMgrGetRebootCause(void);
+int APS5_VABI sceCoredumpSequenceHandlerUpdateEventCache(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetEventCache(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetWorkingEventSummary(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetCoredumpStatus(void);
+int APS5_VABI sceCoredumpSequenceHandlerGetCoredumpStatusByAppId(void);
+int APS5_VABI sceCoredumpSequenceHandlerCancelCoredump(void);
+int APS5_VABI sceSystemServiceIsBgmPlaying(void);
+int APS5_VABI sceShellCoreUtilIsBgmPlaying(void);
+int APS5_VABI sceAppMessagingClearEventFlag(std::int32_t appId, std::uint64_t flags);
+int APS5_VABI sceAppMessagingReceiveMsg(AppMessagingMessage* message);
+int APS5_VABI sceAppMessagingSendMsg(std::uint32_t appId, std::uint32_t messageId, const void* data, std::size_t size, std::uint32_t flags);
+int APS5_VABI sceAppMessagingSendMsgToShellCore(std::uint32_t messageId, const void* data, std::size_t size, std::uint32_t flags);
+int APS5_VABI sceAppMessagingSendMsgToShellUI(std::uint32_t messageId, const void* data, std::size_t size, std::uint32_t flags);
+int APS5_VABI sceAppMessagingSetEventFlag(std::int32_t appId, std::uint64_t flags);
+int APS5_VABI sceAppMessagingTryGetEventFlag(std::uint64_t mask, std::uint64_t* flags, std::uint8_t clear);
+int APS5_VABI sceAppMessagingTryReceiveMsg(AppMessagingMessage* message);
+int APS5_VABI sceLncUtilAcquireCpuBudgetOfExtraAudioDevices();
+int APS5_VABI sceLncUtilAcquireCpuBudgetOfImeForBigApp();
+int APS5_VABI sceLncUtilAcquireCpuBudgetOfInGameStore();
+int APS5_VABI sceLncUtilActivateCdlg();
+int APS5_VABI sceLncUtilAddLocalProcess(std::int32_t appId, const char* path, const char* const* argv, const LncLocalProcessParam* param);
+int APS5_VABI sceLncUtilBlockAppSuspend(const char* reason);
+int APS5_VABI sceLncUtilBlockingGetEventForDaemon(LncDaemonEvent* event, std::uint64_t receiveArgument);
+int APS5_VABI sceLncUtilContinueApp(std::int32_t appId);
+int APS5_VABI sceLncUtilCrashSyscore();
+int APS5_VABI sceLncUtilDeactivateCdlg();
+int APS5_VABI sceLncUtilDeclareReadyForSuspend();
+int APS5_VABI sceLncUtilDisableSuspendNotification();
+int APS5_VABI sceLncUtilEnableSuspendNotification();
+int APS5_VABI sceLncUtilFinishSpecialResume();
+int APS5_VABI sceLncUtilForceKillApp(std::int32_t appId);
+int APS5_VABI sceLncUtilForceKillLocalProcess(std::int32_t appId, std::int32_t processId);
+int APS5_VABI sceLncUtilGetAppCategory(std::int32_t appId, char* category);
+int APS5_VABI sceLncUtilGetAppCategoryType(std::int32_t appId, std::uint32_t* categoryType);
+int APS5_VABI sceLncUtilGetAppFocusedAppStatus(LncAppStatus* status);
+int APS5_VABI sceLncUtilGetAppId(const char* titleId);
+int APS5_VABI sceLncUtilGetAppIdListOfBigApp(std::int32_t* appIds, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetAppIdOfRunningBigApp();
+int APS5_VABI sceLncUtilGetAppLaunchedUser(std::int32_t appId, std::int32_t* userId);
+int APS5_VABI sceLncUtilGetAppStatus(LncAppStatus* status);
+int APS5_VABI sceLncUtilGetAppStatusList(LncAppStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetAppStatusListForShellUIReboot(LncShellUiAppStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetAppTitleId(std::int32_t appId, char* titleId);
+int APS5_VABI sceLncUtilGetAppType(std::int32_t appId, std::uint32_t* type);
+int APS5_VABI sceLncUtilGetCdlgExec(std::int32_t appId, bool* executing);
+int APS5_VABI sceLncUtilGetCdlgType(std::int32_t appId, std::uint32_t* type);
+int APS5_VABI sceLncUtilGetCoredumpState(std::int32_t appId, std::int32_t processId, LncCoredumpState* state);
+int APS5_VABI sceLncUtilGetDbgExecutablePath(char* path, std::uint64_t selector);
+int APS5_VABI sceLncUtilGetEventForDaemon(LncDaemonEvent* event);
+int APS5_VABI sceLncUtilGetEventForShellUI(LncShellUiEvent* event);
+int APS5_VABI sceLncUtilGetGpuCrashFullDumpAppStatus(LncGpuCrashAppStatus* status);
+int APS5_VABI sceLncUtilGetLocalProcessStatusList(LncLocalProcessStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceLncUtilGetParentSocket();
+int APS5_VABI sceLncUtilGetResultKillApp(std::uint32_t requestId);
+int APS5_VABI sceLncUtilGetResultLaunchAppByTitleId(std::uint32_t requestId);
+int APS5_VABI sceLncUtilGetVideoFinalizeState(std::int32_t appId, std::int32_t processId, LncVideoFinalizeState* state);
+int APS5_VABI sceLncUtilInitialize();
+int APS5_VABI sceLncUtilIsActiveCdlg(bool* active);
+int APS5_VABI sceLncUtilIsAppLaunched(const char* titleId, bool* launched);
+int APS5_VABI sceLncUtilIsAppSuspended(std::int32_t appId, bool* suspended);
+int APS5_VABI sceLncUtilIsCdlgActivated(std::uint8_t* activated);
+bool APS5_VABI sceLncUtilIsCpuBudgetOfExtraAudioDevicesAvailable();
+int APS5_VABI sceLncUtilIsHostBoot(std::int32_t appId, bool* hostBoot);
+int APS5_VABI sceLncUtilIsPs2Emu(bool* emulated);
+bool APS5_VABI sceLncUtilIsShellUiFgAndGameBgCpuMode();
+int APS5_VABI sceLncUtilIsSpeculativeLaunch(std::int32_t appId, bool* speculative);
+int APS5_VABI sceLncUtilKickCoredumpOnlyProcMem(std::int32_t appId, std::int32_t processId, const char* first, const char* second);
+int APS5_VABI sceLncUtilKillLocalProcess(std::int32_t appId, std::int32_t processId);
+int APS5_VABI sceLncUtilLaunchApp(const char* titleId, const char* const* argv, const LncLaunchParam* param);
+int APS5_VABI sceLncUtilLoadExec(const char* path, const char* const* argv);
+int APS5_VABI sceLncUtilNotifyCoredumpRequestEnd(std::int32_t appId, std::int32_t processId, std::int32_t result);
+int APS5_VABI sceLncUtilNotifyCoredumpRequestProgress(std::int32_t appId, std::int32_t processId, std::int32_t progress);
+int APS5_VABI sceLncUtilNotifyVshReady(std::uint32_t errorCode);
+int APS5_VABI sceLncUtilRaiseException(std::int32_t appId, std::uint64_t exception);
+int APS5_VABI sceLncUtilRaiseExceptionLocalProcess(std::int32_t appId, std::int32_t processId, std::uint64_t exception);
+int APS5_VABI sceLncUtilRegisterCdlgSharedMemoryName(const char* name);
+int APS5_VABI sceLncUtilRegisterDaemon();
+int APS5_VABI sceLncUtilRegisterShellUI();
+int APS5_VABI sceLncUtilReleaseCpuBudgetOfExtraAudioDevices();
+int APS5_VABI sceLncUtilReleaseCpuBudgetOfImeForBigApp();
+int APS5_VABI sceLncUtilReleaseCpuBudgetOfInGameStore();
+int APS5_VABI sceLncUtilResumeApp(std::int32_t appId, std::uint64_t flags);
+int APS5_VABI sceLncUtilResumeLocalProcess(std::int32_t processId);
+int APS5_VABI sceLncUtilSetAppFocus(std::int32_t appId, std::uint64_t flags, std::uint64_t contextId);
+int APS5_VABI sceLncUtilSetCdlgExec(std::int32_t appId, std::uint8_t executing);
+int APS5_VABI sceLncUtilSetControllerFocus(std::int32_t appId);
+int APS5_VABI sceLncUtilSetControllerFocusPermission(std::uint8_t permission);
+int APS5_VABI sceLncUtilStartKillApp(std::int32_t appId, std::uint32_t* requestId);
+int APS5_VABI sceLncUtilStartLaunchAppByTitleId(const char* titleId, const char* const* argv, const LncLaunchParam* param, std::uint32_t* requestId);
+int APS5_VABI sceLncUtilSuspendApp(std::int32_t appId, std::uint64_t flags, std::int32_t reason);
+int APS5_VABI sceLncUtilSuspendBackgroundApp(std::int32_t first, std::int32_t second);
+int APS5_VABI sceLncUtilSuspendLocalProcess(std::int32_t processId);
+int APS5_VABI sceLncUtilTerminate();
+int APS5_VABI sceLncUtilTryBlockAppSuspend(const char* reason);
+int APS5_VABI sceLncUtilUnblockAppSuspend(const char* reason);
+int APS5_VABI sceLncUtilUnregisterCdlgSharedMemoryName(const char* name);
+int APS5_VABI sceLncUtilUnregisterDaemon();
+int APS5_VABI sceLncUtilUnregisterShellUI();
+int APS5_VABI sceShellCoreUtilAccessibilityZoomLock();
+int APS5_VABI sceShellCoreUtilAccessibilityZoomUnlock();
+int APS5_VABI sceShellCoreUtilAcquireBgmCpuBudget();
+int APS5_VABI sceShellCoreUtilAcquireRemotePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilAcquireSharePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilActivateAbort(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilActivateGetStatus(std::intptr_t handle, std::int32_t* status, std::int32_t* result);
+int APS5_VABI sceShellCoreUtilActivateInit(std::int32_t type, std::intptr_t* handle);
+int APS5_VABI sceShellCoreUtilActivateIsActivated(std::intptr_t handle, bool* activated);
+int APS5_VABI sceShellCoreUtilActivateRecordActivation();
+int APS5_VABI sceShellCoreUtilActivateStart(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilActivateStartAsync(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilActivateTerm(std::intptr_t handle);
+int APS5_VABI sceShellCoreUtilChangeRunLevel(std::int32_t runLevel);
+int APS5_VABI sceShellCoreUtilChangeToStaffModeForIDU();
+int APS5_VABI sceShellCoreUtilCheckerAbort();
+int APS5_VABI sceShellCoreUtilCleanupCrashReport();
+int APS5_VABI sceShellCoreUtilClearAppData();
+int APS5_VABI sceShellCoreUtilClearPs4AppCategoryDefaultsListUpdate();
+int APS5_VABI sceShellCoreUtilClearPsnAccountInfo();
+int APS5_VABI sceShellCoreUtilCrashReportRequestCancel();
+int APS5_VABI sceShellCoreUtilDeclareBeginOfExternalStorageAppMove();
+int APS5_VABI sceShellCoreUtilDeclareEndOfExternalStorageAppMove();
+int APS5_VABI sceShellCoreUtilDeleteDiscInstalledTitleWorkaroundFile();
+int APS5_VABI sceShellCoreUtilDeleteDownloadedHidConfigFile(std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilDeleteDownloadedNetEvConfigFile();
+int APS5_VABI sceShellCoreUtilDeleteDownloadedTitleWorkaroundFile();
+int APS5_VABI sceShellCoreUtilDoFsck(const char* path);
+int APS5_VABI sceShellCoreUtilDownloadHidConfigFileFromServer(std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilDownloadNetEvConfigFileFromServer();
+int APS5_VABI sceShellCoreUtilDownloadTitleWorkaroundFileFromServer();
+int APS5_VABI sceShellCoreUtilEndUmmDictation();
+int APS5_VABI sceShellCoreUtilEnterPowerLockSection();
+int APS5_VABI sceShellCoreUtilExecuteCrashReport();
+int APS5_VABI sceShellCoreUtilExfatFormatExternalHdd(const char* path);
+int APS5_VABI sceShellCoreUtilExitApp();
+int APS5_VABI sceShellCoreUtilExitMiniApp();
+int APS5_VABI sceShellCoreUtilExitMiniAppWithValue(const char* value);
+int APS5_VABI sceShellCoreUtilFormatExternalHdd(const char* path);
+int APS5_VABI sceShellCoreUtilFormatHddForRestore();
+int APS5_VABI sceShellCoreUtilGetAppData(const char* key, void* data, std::int32_t capacity, std::int32_t* size);
+int APS5_VABI sceShellCoreUtilGetAppEnableTTS(std::int32_t appId, bool* enabled);
+int APS5_VABI sceShellCoreUtilGetAppEnterButtonAssign(std::int32_t appId, std::int32_t* assignment);
+int APS5_VABI sceShellCoreUtilGetAppLaunchTypeInfo(std::int32_t appId, ShellCoreAppLaunchTypeInfo* info);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamInt(std::int32_t appId, const char* key, std::int32_t* value);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamIntByBudgetType(std::int32_t budgetType, const char* key, std::int32_t* value);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamString(std::int32_t appId, const char* key, char* value, std::int32_t capacity);
+int APS5_VABI sceShellCoreUtilGetAppLaunchedParamStringByBudgetType(std::int32_t budgetType, const char* key, char* value, std::int32_t capacity);
+int APS5_VABI sceShellCoreUtilGetAutoPowerDownRemainingSeconds();
+int APS5_VABI sceShellCoreUtilGetBasicProductShape();
+int APS5_VABI sceShellCoreUtilGetCheckerString(const char* key, char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetCheckerStringEx(const char* firstKey, const char* secondKey, char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetCloudClientStatus(std::uint32_t* status);
+int APS5_VABI sceShellCoreUtilGetCrashReportCoreFileSetSize();
+int APS5_VABI sceShellCoreUtilGetCrashReportFilterInfoStart();
+int APS5_VABI sceShellCoreUtilGetCrashReportInfoForBoot();
+int APS5_VABI sceShellCoreUtilGetCrashReportInfoForBootStart();
+int APS5_VABI sceShellCoreUtilGetCrashReportInfoStart();
+int APS5_VABI sceShellCoreUtilGetCrashReportResult();
+int APS5_VABI sceShellCoreUtilGetCrashReportStatus();
+int APS5_VABI sceShellCoreUtilGetCrashReportUploadStatus();
+int APS5_VABI sceShellCoreUtilGetDeviceIndexBehavior(std::uint32_t* behavior, std::int32_t* userId, std::uint32_t* scene);
+int APS5_VABI sceShellCoreUtilGetDeviceIndexBehaviorWithTimeout(std::uint32_t* behavior, std::int32_t* userId, std::uint32_t* scene, std::uint8_t timeout);
+int APS5_VABI sceShellCoreUtilGetEffectiveTotalSizeOfUserPartition(std::uint64_t* size);
+std::uint64_t APS5_VABI sceShellCoreUtilGetFreeSizeOfAvContentsTmp();
+int APS5_VABI sceShellCoreUtilGetFreeSizeOfUserPartition(std::uint64_t* freeSize, std::uint64_t* totalSize);
+int APS5_VABI sceShellCoreUtilGetFsckProgress(const char* titleId, std::uint32_t* progress);
+int APS5_VABI sceShellCoreUtilGetGameLiveStreamingStatus(bool* active);
+bool APS5_VABI sceShellCoreUtilGetGnmCompositorOnScreenProfilerFlag();
+int APS5_VABI sceShellCoreUtilGetGpuLoadEmulationMode();
+int APS5_VABI sceShellCoreUtilGetGpuLoadEmulationModeByAppId(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetHidConfigFileInfoString(char* value, std::size_t capacity, std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilGetHidConfigFileString(char* value, std::size_t capacity, std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilGetHidConfigName(char* value, std::size_t capacity, std::int32_t configIndex);
+int APS5_VABI sceShellCoreUtilGetHidConfigNum(std::int32_t* configNum);
+int APS5_VABI sceShellCoreUtilGetIDUMode(std::uint8_t* mode);
+bool APS5_VABI sceShellCoreUtilGetImposeMenuFlagForPs2Emu(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetManifestFileStatus();
+int APS5_VABI sceShellCoreUtilGetNeedSizeOfAppContent(std::uint64_t* size);
+int APS5_VABI sceShellCoreUtilGetNetEvConfigFileInfoString(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetOutOfVrPlayZoneWarning();
+int APS5_VABI sceShellCoreUtilGetPapcGamePcl();
+int APS5_VABI sceShellCoreUtilGetPbtcUserInfoList(ShellCorePbtcUserInfoList* info);
+int APS5_VABI sceShellCoreUtilGetPlatformPrivacyDefinitionEventData(const char* firstKey, const char* secondKey, ShellCorePrivacyEventData* data);
+float APS5_VABI sceShellCoreUtilGetProgressOfFormatExternalHdd();
+float APS5_VABI sceShellCoreUtilGetProgressOfFsck();
+int APS5_VABI sceShellCoreUtilGetPs4AppCategoryDefaultsListId(void* data, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetPs4AppCategoryForTitleId(const char* titleId);
+int APS5_VABI sceShellCoreUtilGetPsStoreIconLayout(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetPsStoreIconState(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetPsnAccountInfo(ShellCorePsnAccountInfoFirst* first, ShellCorePsnAccountInfoSecond* second, ShellCorePsnAccountInfoThird* third, ShellCorePsnAccountInfoFourth* fourth, ShellCorePsnAccountInfoFifth* fifth);
+int APS5_VABI sceShellCoreUtilGetRemotePlayStatus(bool* active);
+int APS5_VABI sceShellCoreUtilGetRunLevel();
+int APS5_VABI sceShellCoreUtilGetSharePlayStatus(bool* active);
+int APS5_VABI sceShellCoreUtilGetSocialScreenStatus(bool* active);
+int APS5_VABI sceShellCoreUtilGetSplashScreenState(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetSupportSiteURL(std::uint32_t first, std::uint32_t second, char* value, std::size_t capacity);
+bool APS5_VABI sceShellCoreUtilGetSuspendConfirmationDialogFlag(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilGetSystemBGState(std::int32_t appId, std::uint32_t* state);
+int APS5_VABI sceShellCoreUtilGetSystemBGWaveColor(std::int32_t appId, std::uint32_t* color);
+int APS5_VABI sceShellCoreUtilGetSystemBGWaveState(std::int32_t appId, std::uint32_t* state);
+int APS5_VABI sceShellCoreUtilGetTelemetryToken(ShellCoreTelemetryToken* token);
+int APS5_VABI sceShellCoreUtilGetTitleWorkaroundFileInfoString(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetTitleWorkaroundFileString(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetUIStatus(std::uint64_t* status);
+int APS5_VABI sceShellCoreUtilGetUmmStatus(std::int32_t userId, ShellCoreUmmStatus* status);
+int APS5_VABI sceShellCoreUtilGetUserFocus(std::int32_t appId, std::int32_t* userId);
+int APS5_VABI sceShellCoreUtilGetUserIdOfMorpheusUser();
+int APS5_VABI sceShellCoreUtilGetVMStatsForTelemetry(char* value, std::size_t capacity);
+int APS5_VABI sceShellCoreUtilGetVersionNumberOfCameraCalibrationData();
+int APS5_VABI sceShellCoreUtilGoBackToKratosCurrentSessionGame();
+int APS5_VABI sceShellCoreUtilHideBlocksFromUser(std::int64_t bytes, std::int32_t flags);
+int APS5_VABI sceShellCoreUtilIncrementVersionNumberOfCameraCalibrationData();
+bool APS5_VABI sceShellCoreUtilIsAccessibilityZoomLocked(std::int32_t appId);
+bool APS5_VABI sceShellCoreUtilIsBgmCpuBudgetAcquired();
+bool APS5_VABI sceShellCoreUtilIsBgmCpuBudgetAvailable();
+bool APS5_VABI sceShellCoreUtilIsExternalStorageAppMoveInProgress();
+int APS5_VABI sceShellCoreUtilIsEyeToEyeDistanceAdjusted(std::uint32_t userId, std::uint8_t* adjusted);
+bool APS5_VABI sceShellCoreUtilIsGameLiveStreamingOnAir();
+int APS5_VABI sceShellCoreUtilIsIDUState();
+bool APS5_VABI sceShellCoreUtilIsImposeScreenOverlaid();
+bool APS5_VABI sceShellCoreUtilIsInSystemSuspendBlackList(std::uint32_t appId);
+int APS5_VABI sceShellCoreUtilIsInternalKratosUser();
+int APS5_VABI sceShellCoreUtilIsKilledOrSuspendedByLogout(std::int32_t first, std::int32_t second, std::uint8_t* result);
+int APS5_VABI sceShellCoreUtilIsNeededCrashReport();
+bool APS5_VABI sceShellCoreUtilIsPowerSaveAlertRequested();
+bool APS5_VABI sceShellCoreUtilIsRemotePlayCpuBudgetAcquired();
+bool APS5_VABI sceShellCoreUtilIsScreenSaverOn();
+bool APS5_VABI sceShellCoreUtilIsSharePlayCpuBudgetAcquired();
+int APS5_VABI sceShellCoreUtilIsShowCrashReport();
+int APS5_VABI sceShellCoreUtilIsTemperatureDanger();
+int APS5_VABI sceShellCoreUtilIsTitleWorkaroundEnabled(std::int32_t selector, const char* key);
+bool APS5_VABI sceShellCoreUtilIsUsbMassStorageMounted(std::uint32_t deviceIndex);
+int APS5_VABI sceShellCoreUtilLaunchByUri(const char* uri, const ShellCoreLaunchByUriParam* param);
+int APS5_VABI sceShellCoreUtilLeavePowerLockSection();
+int APS5_VABI sceShellCoreUtilMakeManifestFile();
+int APS5_VABI sceShellCoreUtilMountAppRight(const char* key);
+int APS5_VABI sceShellCoreUtilMountDownloadDataForShellUI(const char* key);
+int APS5_VABI sceShellCoreUtilMountHddForBackup();
+int APS5_VABI sceShellCoreUtilMountHddForRestore();
+int APS5_VABI sceShellCoreUtilNavigateToAnotherApp(std::uint32_t target);
+int APS5_VABI sceShellCoreUtilNavigateToGoHome(std::uint32_t target);
+int APS5_VABI sceShellCoreUtilNavigateToLaunchedApp(std::uint32_t target);
+int APS5_VABI sceShellCoreUtilNotificationCancelForIDU(std::int64_t notificationId);
+int APS5_VABI sceShellCoreUtilNotificationRequestedForIDU(std::int64_t notificationId, const char* text, std::uint32_t type);
+int APS5_VABI sceShellCoreUtilNotifyBgmCoreTermination();
+int APS5_VABI sceShellCoreUtilNotifyFsReadError(std::int32_t first, std::int32_t second, std::int32_t third, const char* detail);
+int APS5_VABI sceShellCoreUtilNotifyImeStatusChanged(std::int32_t imeStatus, std::uint8_t isCalledFromGame);
+int APS5_VABI sceShellCoreUtilNotifyPsnAccountInfoReceived();
+int APS5_VABI sceShellCoreUtilNotifySystemSuspendTelemetryInfo(std::uint32_t info);
+int APS5_VABI sceShellCoreUtilPfAuthClientConsoleTokenClearCache();
+int APS5_VABI sceShellCoreUtilPostActivityForPsNow(std::int32_t type, const char* activity);
+int APS5_VABI sceShellCoreUtilPostErrorLog(const char* titleId, std::int32_t internalErrorCode, const char* shortError, const char* messageBuffer, std::int32_t suggestionType, const char* logReport);
+int APS5_VABI sceShellCoreUtilPostLaunchConfirmResult(std::uint32_t first, std::uint32_t second);
+int APS5_VABI sceShellCoreUtilPostPsmEventToShellUI(std::int32_t eventId, const char* data);
+int APS5_VABI sceShellCoreUtilPreNotifyOfGameLiveStreaming();
+int APS5_VABI sceShellCoreUtilPreNotifyOfRemotePlay();
+int APS5_VABI sceShellCoreUtilPreNotifyOfSharePlay();
+int APS5_VABI sceShellCoreUtilReleaseBgmCpuBudget();
+int APS5_VABI sceShellCoreUtilReleaseRemotePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilReleaseSharePlayCpuBudget();
+int APS5_VABI sceShellCoreUtilReportSessionErrorToGaikaiController(std::int32_t error, const char* detail);
+int APS5_VABI sceShellCoreUtilReportUnexpectedFatalErrorToSystemTelemetry(std::int32_t error, const char* detail);
+int APS5_VABI sceShellCoreUtilRequestCameraCalibration();
+int APS5_VABI sceShellCoreUtilRequestEjectDevice(const char* path);
+int APS5_VABI sceShellCoreUtilRequestRebootApp(std::int32_t appId);
+int APS5_VABI sceShellCoreUtilRequestShutdown(std::int32_t reason);
+int APS5_VABI sceShellCoreUtilResetAutoPowerDownTimer();
+int APS5_VABI sceShellCoreUtilResetBgdcConfig();
+int APS5_VABI sceShellCoreUtilSetAppData(const char* key, const char* value);
+int APS5_VABI sceShellCoreUtilSetBgmProhibition(std::uint32_t value);
+int APS5_VABI sceShellCoreUtilSetDeviceIndexBehavior(std::uint32_t behavior, std::int32_t userId, std::uint8_t scene);
+int APS5_VABI sceShellCoreUtilSetGameLiveStreamingOnAirFlag(std::int32_t enabled);
+int APS5_VABI sceShellCoreUtilSetGameLiveStreamingStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetGnmCompositorOnScreenProfilerFlag(std::int32_t enabled);
+int APS5_VABI sceShellCoreUtilSetGpuLoadEmulationMode(std::uint32_t mode);
+int APS5_VABI sceShellCoreUtilSetGpuLoadEmulationModeByAppId(std::int32_t appId, std::uint32_t mode);
+int APS5_VABI sceShellCoreUtilSetIDUMode(std::uint8_t mode);
+int APS5_VABI sceShellCoreUtilSetImposeStatusFlag(std::int32_t enabled);
+int APS5_VABI sceShellCoreUtilSetPsStoreIconLayout(std::uint32_t layout);
+int APS5_VABI sceShellCoreUtilSetPsStoreIconState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetRemotePlayStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetSharePlayStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetSkipUpdateCheck(std::uint8_t skip);
+int APS5_VABI sceShellCoreUtilSetSocialScreenStatus(std::int32_t active);
+int APS5_VABI sceShellCoreUtilSetSplashScreenState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetSystemBGState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetSystemBGWaveColor(std::uint32_t color);
+int APS5_VABI sceShellCoreUtilSetSystemBGWaveState(std::uint32_t state);
+int APS5_VABI sceShellCoreUtilSetUIStatus(std::uint64_t status, std::uint64_t mask);
+int APS5_VABI sceShellCoreUtilSetUserFocus(std::int32_t userId);
+int APS5_VABI sceShellCoreUtilShowCriticalErrorDialog(std::uint32_t error, const char* message);
+int APS5_VABI sceShellCoreUtilShowErrorDialog(std::uint32_t error, const char* message);
+int APS5_VABI sceShellCoreUtilShowErrorDialogWithFormatArgs(std::uint32_t error, const char* message, const char* const* formatArgs);
+int APS5_VABI sceShellCoreUtilShowErrorDialogWithParam(std::uint32_t error, const ShellCoreErrorDialogParam* param);
+int APS5_VABI sceShellCoreUtilShowPsUnderLockIndicator();
+int APS5_VABI sceShellCoreUtilSignalUserInput();
+int APS5_VABI sceShellCoreUtilStartPsNowGame(const char* data);
+int APS5_VABI sceShellCoreUtilStopPsNowGame(const char* data);
+int APS5_VABI sceShellCoreUtilTalkKeyEventReceived(std::int64_t deviceId, std::int32_t userId, std::int32_t keyEventType);
+int APS5_VABI sceShellCoreUtilTestBusTransferSpeed(const char* path, std::uint8_t* result);
+int APS5_VABI sceShellCoreUtilTickHeartBeat();
+int APS5_VABI sceShellCoreUtilTriggerPapcUpdate(std::uint32_t value);
+int APS5_VABI sceShellCoreUtilTurnOffScreenSaver();
+int APS5_VABI sceShellCoreUtilUnmountAppRight(const char* key);
+int APS5_VABI sceShellCoreUtilUnmountDownloadDataForShellUI(const char* key);
+int APS5_VABI sceShellCoreUtilUnmountHddForBackup();
+int APS5_VABI sceShellCoreUtilUnmountHddForRestore();
+int APS5_VABI sceShellCoreutilGetCrashReportProcessInformation();
+int APS5_VABI sceSystemModalDialogClose(std::uint32_t dialogId);
+int APS5_VABI sceSystemModalDialogOpen(const char* message);
+int APS5_VABI sceSystemServiceAcquireBgmCpuBudget();
+int APS5_VABI sceSystemServiceAcquireFb0();
+int APS5_VABI sceSystemServiceActivateHevc();
+int APS5_VABI sceSystemServiceActivateHevcAbort(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcGetStatus(std::uintptr_t handle, std::uint32_t* status, std::int32_t* result);
+int APS5_VABI sceSystemServiceActivateHevcInit(std::uintptr_t* handle);
+int APS5_VABI sceSystemServiceActivateHevcIsActivated(std::uint8_t* activated);
+int APS5_VABI sceSystemServiceActivateHevcSoft();
+int APS5_VABI sceSystemServiceActivateHevcSoftAbort(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcSoftGetStatus(std::uintptr_t handle, std::uint32_t* status, std::int32_t* result);
+int APS5_VABI sceSystemServiceActivateHevcSoftInit(std::uintptr_t* handle);
+int APS5_VABI sceSystemServiceActivateHevcSoftIsActivated(std::uint8_t* activated);
+int APS5_VABI sceSystemServiceActivateHevcSoftStart(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcSoftTerm(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcStart(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateHevcTerm(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateMpeg2Abort(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateMpeg2GetStatus(std::uintptr_t handle, std::uint32_t* status, std::int32_t* result);
+int APS5_VABI sceSystemServiceActivateMpeg2Init(std::uintptr_t* handle);
+int APS5_VABI sceSystemServiceActivateMpeg2IsActivated(std::uint8_t* activated);
+int APS5_VABI sceSystemServiceActivateMpeg2Start(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceActivateMpeg2Term(std::uintptr_t handle);
+int APS5_VABI sceSystemServiceAddLocalProcess(std::int32_t appId, const char* path, const char* const* argv, const SystemServiceLocalProcessParam* param);
+int APS5_VABI sceSystemServiceAddLocalProcessForJvm(const char* path, const char* const* argv, const SystemServiceJvmProcessParam* param);
+int APS5_VABI sceSystemServiceAddLocalProcessForPs2Emu(const char* path, const char* const* argv, const SystemServicePs2ProcessParam* param);
+int APS5_VABI sceSystemServiceAppGetAppInstallStatus(const char* titleId, SystemServiceAppInstallStatus* status);
+int APS5_VABI sceSystemServiceChangeAcpClock();
+int APS5_VABI sceSystemServiceChangeClock(const char* clock, std::uint32_t value);
+int APS5_VABI sceSystemServiceChangeCpuClock();
+int APS5_VABI sceSystemServiceChangeCpuPstate(const SystemServiceCpuPstateParam* param);
+int APS5_VABI sceSystemServiceChangeGpuClock();
+int APS5_VABI sceSystemServiceChangeMemPstate(std::uint32_t state);
+int APS5_VABI sceSystemServiceChangeMemoryClock();
+int APS5_VABI sceSystemServiceChangeMemoryClockToBaseMode();
+int APS5_VABI sceSystemServiceChangeMemoryClockToDefault();
+int APS5_VABI sceSystemServiceChangeMemoryClockToMultiMediaMode();
+int APS5_VABI sceSystemServiceChangeNumberOfGpuCu();
+int APS5_VABI sceSystemServiceChangeSamuClock();
+int APS5_VABI sceSystemServiceChangeUvdClock();
+int APS5_VABI sceSystemServiceChangeVceClock();
+int APS5_VABI sceSystemServiceDeclareReadyForSuspend();
+int APS5_VABI sceSystemServiceDisablePartyVoice();
+int APS5_VABI sceSystemServiceDisablePersonalEyeToEyeDistanceSetting();
+int APS5_VABI sceSystemServiceDisableSuspendConfirmationDialog();
+int APS5_VABI sceSystemServiceDisableSuspendNotification();
+int APS5_VABI sceSystemServiceDisableVoiceRecognition();
+int APS5_VABI sceSystemServiceEnablePersonalEyeToEyeDistanceSetting();
+int APS5_VABI sceSystemServiceEnableSuspendConfirmationDialog();
+int APS5_VABI sceSystemServiceEnableSuspendNotification();
+int APS5_VABI sceSystemServiceGetAppCategoryType(std::int32_t appId, std::uint32_t* categoryType);
+int APS5_VABI sceSystemServiceGetAppFocusedAppStatus(SystemServiceAppStatus* status);
+int APS5_VABI sceSystemServiceGetAppId(const char* titleId);
+int APS5_VABI sceSystemServiceGetAppIdListOfBigApp(std::int32_t* appIds, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceSystemServiceGetAppLaunchedUser(std::int32_t appId, std::int32_t* userId);
+int APS5_VABI sceSystemServiceGetAppStatus(SystemServiceAppStatus* status);
+int APS5_VABI sceSystemServiceGetAppTitleId(std::int32_t appId, char* titleId);
+int APS5_VABI sceSystemServiceGetAppType(std::int32_t appId, std::int32_t* type);
+int APS5_VABI sceSystemServiceGetDbgExecutablePath(char* path, std::uint64_t selector);
+int APS5_VABI sceSystemServiceGetEventForDaemon(SystemServiceDaemonEvent* event);
+int APS5_VABI sceSystemServiceGetGpuLoadEmulationMode();
+int APS5_VABI sceSystemServiceGetLocalProcessStatusList(SystemServiceLocalProcessStatus* statuses, std::uint32_t capacity, std::uint32_t* count);
+int APS5_VABI sceSystemServiceGetMainAppTitleId();
+int APS5_VABI sceSystemServiceGetPSButtonEvent(const SystemServiceEvent* event, SystemServicePSButtonEvent* buttonEvent);
+int APS5_VABI sceSystemServiceGetParentSocket();
+int APS5_VABI sceSystemServiceGetParentSocketForJvm();
+int APS5_VABI sceSystemServiceGetParentSocketForPs2Emu();
+int APS5_VABI sceSystemServiceGetParentSocketForPsmKit();
+int APS5_VABI sceSystemServiceGetPlatformPrivacyDefinitionData(const char* key, SystemServicePrivacyDefinitionData* data);
+int APS5_VABI sceSystemServiceGetPlatformPrivacyDefinitionVersion(const char* key, SystemServicePrivacyDefinitionVersion* version);
+int APS5_VABI sceSystemServiceGetPlatformPrivacySetting(std::uint32_t* setting);
+int APS5_VABI sceSystemServiceGetRecentLotusPushedButton(std::uint32_t timeout, std::int32_t* deviceId, std::uint32_t* buttons);
+int APS5_VABI sceSystemServiceGetRemoteplayStatus(bool* active);
+int APS5_VABI sceSystemServiceGetRenderingMode();
+int APS5_VABI sceSystemServiceGetSubAppTitleId();
+int APS5_VABI sceSystemServiceGetSubAppTitleIdForSP();
+int APS5_VABI sceSystemServiceGetTitleWorkaroundInfo(SystemServiceTitleWorkaroundInfo* info);
+int APS5_VABI sceSystemServiceGetUIStatus(std::uint64_t* status);
+int APS5_VABI sceSystemServiceGetVersionNumberOfCameraCalibrationData();
+int APS5_VABI sceSystemServiceInitializeForShellCore();
+int APS5_VABI sceSystemServiceInvokeAppLaunchLink(const char* uri);
+int APS5_VABI sceSystemServiceIsAppSuspended(std::int32_t appId, bool* suspended);
+bool APS5_VABI sceSystemServiceIsBgmCpuBudgetAvailable();
+int APS5_VABI sceSystemServiceIsEyeToEyeDistanceAdjusted(std::uint32_t userId, std::uint8_t* adjusted);
+bool APS5_VABI sceSystemServiceIsGameLiveStreamingOnAir();
+bool APS5_VABI sceSystemServiceIsScreenSaverOn();
+bool APS5_VABI sceSystemServiceIsShellUiFgAndGameBgCpuMode();
+int APS5_VABI sceSystemServiceKillLocalProcess(std::int32_t appId, std::int32_t processId);
+int APS5_VABI sceSystemServiceKillLocalProcessForJvm(std::int32_t processId);
+int APS5_VABI sceSystemServiceKillLocalProcessForPs2Emu(std::int32_t processId);
+int APS5_VABI sceSystemServiceLaunchEventDetails(std::uint64_t unusedSlot, const char* eventId);
+int APS5_VABI sceSystemServiceLaunchStore(const char* uri, const SystemServiceStoreParam* param);
+int APS5_VABI sceSystemServiceLaunchTournamentList();
+int APS5_VABI sceSystemServiceLaunchTournamentsTeamProfile(std::uint64_t unusedSlot, const char* profile, const char* tournament, const char* context);
+int APS5_VABI sceSystemServiceLaunchUdsApp();
+int APS5_VABI sceSystemServiceLaunchWebApp(const char* argument);
+int APS5_VABI sceSystemServiceLoadExecVideoServiceWebApp();
+int APS5_VABI sceSystemServiceNavigateToAnotherApp(std::uint32_t target);
+int APS5_VABI sceSystemServiceNavigateToGoBack();
+int APS5_VABI sceSystemServiceNavigateToGoBackWithValue(const char* value);
+int APS5_VABI sceSystemServiceNavigateToGoHome(std::uint32_t target);
+int APS5_VABI sceSystemServiceNotifyBgmCoreTermination();
+int APS5_VABI sceSystemServiceRaiseExceptionLocalProcess(std::int32_t appId, std::int32_t processId, std::uint64_t exception);
+int APS5_VABI sceSystemServiceReenablePartyVoice();
+int APS5_VABI sceSystemServiceReenableVoiceRecognition();
+int APS5_VABI sceSystemServiceRegisterDaemon();
+int APS5_VABI sceSystemServiceReleaseBgmCpuBudget();
+int APS5_VABI sceSystemServiceReleaseFb0();
+int APS5_VABI sceSystemServiceRequestCameraCalibration();
+int APS5_VABI sceSystemServiceRequestPowerOff();
+int APS5_VABI sceSystemServiceRequestReboot();
+int APS5_VABI sceSystemServiceRequestToChangeRenderingMode();
+int APS5_VABI sceSystemServiceResumeLocalProcess(std::int32_t processId);
+int APS5_VABI sceSystemServiceSaveVideoToken(std::int32_t userId, const char* token);
+int APS5_VABI sceSystemServiceSetControllerFocusPermission(std::uint8_t permission);
+int APS5_VABI sceSystemServiceSetGpuLoadEmulationMode(std::uint32_t mode);
+int APS5_VABI sceSystemServiceSetOutOfVrPlayAreaFlag(std::uint8_t flag);
+int APS5_VABI sceSystemServiceSetOutOfVrPlayZoneWarning();
+int APS5_VABI sceSystemServiceSetPowerSaveLevel(std::uint32_t level);
+int APS5_VABI sceSystemServiceShowClosedCaptionAdvancedSettings();
+int APS5_VABI sceSystemServiceShowClosedCaptionSettings();
+int APS5_VABI sceSystemServiceShowErrorDialog(std::uint32_t error, const char* message);
+int APS5_VABI sceSystemServiceShowEyeToEyeDistanceSetting();
+int APS5_VABI sceSystemServiceShowImposeMenuForPs2Emu(std::uint8_t enabled, std::uint64_t reserved);
+int APS5_VABI sceSystemServiceSuspendBackgroundApp(std::int32_t first, std::int32_t second);
+int APS5_VABI sceSystemServiceSuspendLocalProcess(std::int32_t processId);
+int APS5_VABI sceSystemServiceTelemetrySetData(const char* key, const void* data, std::size_t size);
+int APS5_VABI sceSystemServiceTelemetrySetData2(const char* key, const char* data);
+int APS5_VABI sceSystemServiceTickVideoPlayback();
+int APS5_VABI sceSystemServiceTurnOffScreenSaver();
+int APS5_VABI sceSystemServiceUsbStorageGetDeviceInfo(std::uint32_t device, UsbStorageDeviceInfo* info);
+int APS5_VABI sceSystemServiceUsbStorageGetDeviceList(std::uint32_t* devices, std::int32_t* count);
+int APS5_VABI sceSystemServiceUsbStorageGetdentsClose(std::int32_t fd);
+int APS5_VABI sceSystemServiceUsbStorageGetdentsOpen(std::uint32_t device, std::int32_t* fd, std::uint64_t* bufferSize);
+int APS5_VABI sceSystemServiceUsbStorageGetdentsRead(std::int32_t fd, void* buffer, std::uint64_t bufferSize, std::uint64_t* bytesRead);
+int APS5_VABI sceSystemServiceUsbStorageInit(void* attr);
+bool APS5_VABI sceSystemServiceUsbStorageIsExist(std::uint32_t device, const char* directory, std::uint8_t* exists);
+int APS5_VABI sceSystemServiceUsbStorageRegisterCallback(std::int32_t eventType, UsbStorageCallback callback, void* arg);
+int APS5_VABI sceSystemServiceUsbStorageRegisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+int APS5_VABI sceSystemServiceUsbStorageRegisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+int APS5_VABI sceSystemServiceUsbStorageRequestMap(std::uint32_t device, const char* directory, std::int32_t flags, std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId);
+int APS5_VABI sceSystemServiceUsbStorageRequestMapWSB(std::uint32_t device, const char* directory, std::int32_t flags, std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId);
+int APS5_VABI sceSystemServiceUsbStorageRequestUnmap(std::uint32_t device, const char* directory);
+int APS5_VABI sceSystemServiceUsbStorageTerm();
+int APS5_VABI sceSystemServiceUsbStorageUnregisterCallback(std::int32_t eventType, UsbStorageCallback callback);
+int APS5_VABI sceSystemServiceUsbStorageUnregisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+int APS5_VABI sceSystemServiceUsbStorageUnregisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+int APS5_VABI sceSystemStateMgrCancelShutdownTimer();
+int APS5_VABI sceSystemStateMgrEnterMediaPlaybackMode();
+int APS5_VABI sceSystemStateMgrEnterStandby();
+int APS5_VABI sceSystemStateMgrExtendShutdownTimer();
+int APS5_VABI sceSystemStateMgrExtendShutdownTimerForPostAutoUpdateProcess();
+int APS5_VABI sceSystemStateMgrGetCurrentState();
+int APS5_VABI sceSystemStateMgrGetTriggerCode();
+bool APS5_VABI sceSystemStateMgrIsBdDriveReady();
+int APS5_VABI sceSystemStateMgrIsGpuPerformanceNormal();
+bool APS5_VABI sceSystemStateMgrIsShellUIShutdownInProgress();
+bool APS5_VABI sceSystemStateMgrIsStandbyModeEnabled();
+int APS5_VABI sceSystemStateMgrLeaveMediaPlaybackMode();
+int APS5_VABI sceSystemStateMgrNotifySystemSuspendResumeProgress(const char* progress);
+int APS5_VABI sceSystemStateMgrReboot();
+int APS5_VABI sceSystemStateMgrRequestToKeepMainOnStandby(const char* reason);
+int APS5_VABI sceSystemStateMgrSendCecOneTouchPlayCommand();
+int APS5_VABI sceSystemStateMgrStartRebootTimer(std::int32_t mode);
+int APS5_VABI sceSystemStateMgrStartShutdownTimer();
+int APS5_VABI sceSystemStateMgrStartStadbyTimer();
+int APS5_VABI sceSystemStateMgrStartVshAutoUpdateTimer();
+int APS5_VABI sceSystemStateMgrTickMusicPlayback();
+int APS5_VABI sceSystemStateMgrTickPartyChat();
+int APS5_VABI sceSystemStateMgrTurnOff();
+int APS5_VABI sceSystemStateMgrVshAutoUpdate();
+int APS5_VABI sceSystemStateMgrWaitVshAutoUpdateVerifyDone();
+int APS5_VABI sceSystemStateMgrWakeUp(std::uint16_t trigger);
+
+}
diff --git a/core/libs/prx/libSceSystemService/libSceSystemService.hpp b/core/libs/prx/libSceSystemService/libSceSystemService.hpp
new file mode 100644
index 0000000000..e3ff176277
--- /dev/null
+++ b/core/libs/prx/libSceSystemService/libSceSystemService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemService/include/SystemService.hpp"
diff --git a/core/libs/prx/libSceSystemTts/Export.cpp b/core/libs/prx/libSceSystemTts/Export.cpp
index d895b270e8..dc975b9b4a 100644
--- a/core/libs/prx/libSceSystemTts/Export.cpp
+++ b/core/libs/prx/libSceSystemTts/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemTts/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceSystemTts/include/Api.hpp b/core/libs/prx/libSceSystemTts/include/Api.hpp
new file mode 100644
index 0000000000..d0942cfe30
--- /dev/null
+++ b/core/libs/prx/libSceSystemTts/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSystemTtsCancel();
+int APS5_VABI sceSystemTtsIsAccessibilityAvailable();
+int APS5_VABI sceSystemTtsRegisterCallback();
+int APS5_VABI sceSystemTtsSpeakRequest();
+int APS5_VABI sceSystemTtsUnregisterCallback();
+
+}
diff --git a/core/libs/prx/libSceSystemTts/libSceSystemTts.hpp b/core/libs/prx/libSceSystemTts/libSceSystemTts.hpp
new file mode 100644
index 0000000000..f2c384d4c4
--- /dev/null
+++ b/core/libs/prx/libSceSystemTts/libSceSystemTts.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceSystemTts/include/Api.hpp"
diff --git a/core/libs/prx/libSceTEEClient/Export.cpp b/core/libs/prx/libSceTEEClient/Export.cpp
index 58c703695b..71faf0cb5f 100644
--- a/core/libs/prx/libSceTEEClient/Export.cpp
+++ b/core/libs/prx/libSceTEEClient/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceTEEClient/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceTEEClient/include/Api.hpp b/core/libs/prx/libSceTEEClient/include/Api.hpp
new file mode 100644
index 0000000000..2c38c96684
--- /dev/null
+++ b/core/libs/prx/libSceTEEClient/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI AMDTEE_DLM_FetchDebugStrings_nid_postfix(void);
+int APS5_VABI AMDTEE_DLM_GetDebugToken_nid_postfix(void);
+int APS5_VABI AMDTEE_DLM_StopTADebug_nid_postfix(void);
+int APS5_VABI TEECI_InitASD_nid_postfix(void);
+int APS5_VABI TEECI_SetTimeout_nid_postfix(void);
+int APS5_VABI TEEC_CloseSession_nid_postfix(void);
+int APS5_VABI TEEC_InvokeCommand_nid_postfix(void);
+int APS5_VABI TEEC_OpenSession_nid_postfix(void);
+int APS5_VABI TEEC_ReleaseSharedMemory_nid_postfix(void);
+int APS5_VABI TEEC_RequestCancellation_nid_postfix(void);
+
+}
diff --git a/core/libs/prx/libSceTEEClient/libSceTEEClient.hpp b/core/libs/prx/libSceTEEClient/libSceTEEClient.hpp
new file mode 100644
index 0000000000..7b3b5682b7
--- /dev/null
+++ b/core/libs/prx/libSceTEEClient/libSceTEEClient.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceTEEClient/include/Api.hpp"
diff --git a/core/libs/prx/libSceTextToSpeech/Export.cpp b/core/libs/prx/libSceTextToSpeech/Export.cpp
index 05c84e9df9..cd4a31d3f6 100644
--- a/core/libs/prx/libSceTextToSpeech/Export.cpp
+++ b/core/libs/prx/libSceTextToSpeech/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceTextToSpeech/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceTextToSpeech/include/Api.hpp b/core/libs/prx/libSceTextToSpeech/include/Api.hpp
new file mode 100644
index 0000000000..6f8845b245
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech/include/Api.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceTextToSpeechCancelImpl();
+int APS5_VABI sceTextToSpeechCloseImpl();
+int APS5_VABI sceTextToSpeechGetStatusImpl();
+int APS5_VABI sceTextToSpeechInitImpl();
+int APS5_VABI sceTextToSpeechOpenImpl();
+int APS5_VABI sceTextToSpeechPauseImpl();
+int APS5_VABI sceTextToSpeechResumeImpl();
+int APS5_VABI sceTextToSpeechSpeakContinuousImpl();
+int APS5_VABI sceTextToSpeechSpeakImpl();
+int APS5_VABI sceTextToSpeechTermImpl();
+
+}
diff --git a/core/libs/prx/libSceTextToSpeech/libSceTextToSpeech.hpp b/core/libs/prx/libSceTextToSpeech/libSceTextToSpeech.hpp
new file mode 100644
index 0000000000..0238da246a
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech/libSceTextToSpeech.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceTextToSpeech/include/Api.hpp"
diff --git a/core/libs/prx/libSceTextToSpeech2/Export.cpp b/core/libs/prx/libSceTextToSpeech2/Export.cpp
index 375bf561f4..02aaefeadf 100644
--- a/core/libs/prx/libSceTextToSpeech2/Export.cpp
+++ b/core/libs/prx/libSceTextToSpeech2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceTextToSpeech2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -9,28 +10,6 @@ constexpr std::int32_t SCE_KERNEL_ERROR_EOPNOTSUPP = static_cast<std::int32_t>(0
 
 }
 
-struct TextToSpeechInitParameter {
-    std::uint32_t version;
-    std::int32_t threadPriority;
-    std::uint64_t cpuAffinity;
-    std::uint8_t reserved[48];
-};
-
-struct TextToSpeechOpenParameter {
-    std::uint32_t language;
-    std::uint32_t voiceType;
-    std::uint8_t reserved[56];
-};
-
-struct TextToSpeechSpeakParameter {
-    const char16_t* text;
-    std::uint32_t length;
-    std::uint32_t mode;
-    std::uint32_t volume;
-    std::int32_t speed;
-    std::uint8_t reserved[40];
-};
-
 static_assert(sizeof(TextToSpeechInitParameter) == 64);
 static_assert(sizeof(TextToSpeechOpenParameter) == 64);
 static_assert(sizeof(TextToSpeechSpeakParameter) == 64);
diff --git a/core/libs/prx/libSceTextToSpeech2/include/Api.hpp b/core/libs/prx/libSceTextToSpeech2/include/Api.hpp
new file mode 100644
index 0000000000..23340118f7
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech2/include/Api.hpp
@@ -0,0 +1,38 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct TextToSpeechInitParameter {
+    std::uint32_t version;
+    std::int32_t threadPriority;
+    std::uint64_t cpuAffinity;
+    std::uint8_t reserved[48];
+};
+
+struct TextToSpeechOpenParameter {
+    std::uint32_t language;
+    std::uint32_t voiceType;
+    std::uint8_t reserved[56];
+};
+
+struct TextToSpeechSpeakParameter {
+    const char16_t* text;
+    std::uint32_t length;
+    std::uint32_t mode;
+    std::uint32_t volume;
+    std::int32_t speed;
+    std::uint8_t reserved[40];
+};
+
+extern "C" {
+
+int APS5_VABI sceTextToSpeech2GetSystemStatus(std::int32_t* status);
+std::int32_t APS5_VABI sceTextToSpeech2Initialize(const TextToSpeechInitParameter* param);
+int APS5_VABI sceTextToSpeech2Cancel();
+int APS5_VABI sceTextToSpeech2Close();
+int APS5_VABI sceTextToSpeech2GetSpeechStatus(std::int32_t* status);
+int APS5_VABI sceTextToSpeech2Open(const TextToSpeechOpenParameter* parameter);
+int APS5_VABI sceTextToSpeech2Speak(const TextToSpeechSpeakParameter* parameter);
+int APS5_VABI sceTextToSpeech2Terminate();
+
+}
diff --git a/core/libs/prx/libSceTextToSpeech2/libSceTextToSpeech2.hpp b/core/libs/prx/libSceTextToSpeech2/libSceTextToSpeech2.hpp
new file mode 100644
index 0000000000..998b2dca7a
--- /dev/null
+++ b/core/libs/prx/libSceTextToSpeech2/libSceTextToSpeech2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceTextToSpeech2/include/Api.hpp"
diff --git a/core/libs/prx/libSceTtsCoreG3Bc/libSceTtsCoreG3Bc.hpp b/core/libs/prx/libSceTtsCoreG3Bc/libSceTtsCoreG3Bc.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceTtsCoreG3Bc/libSceTtsCoreG3Bc.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceUlt/Export.cpp b/core/libs/prx/libSceUlt/Export.cpp
index 63344b81f8..88ac5556cc 100644
--- a/core/libs/prx/libSceUlt/Export.cpp
+++ b/core/libs/prx/libSceUlt/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceUlt/include/Api.hpp"
 #include <algorithm>
 #include <atomic>
 #include <bit>
@@ -10,6 +13,7 @@
 #include <memory>
 #include <mutex>
 #include <stdexcept>
+#include <string>
 #include <unordered_map>
 #include <vector>
 
@@ -18,14 +22,8 @@
 #include "SceUltTypes.hpp"
 #include "prx/libSceUlt/src/ReaderWriterLock.hpp"
 
-extern "C" int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" void APS5_VABI scePthreadExit(void* retval);
-extern "C" void APS5_VABI scePthreadYield();
-
 namespace {
 
-
 std::mutex gMutex;
 std::unordered_map<void*, std::shared_ptr<UltMutexState>> gMutexes;
 std::unordered_map<void*, std::shared_ptr<UltConditionState>> gConditions;
@@ -36,7 +34,6 @@ std::unordered_map<void*, std::shared_ptr<UltQueueState>> gQueues;
 std::unordered_map<void*, UltRuntimeState> gRuntimes;
 std::unordered_map<void*, std::shared_ptr<UltUlthreadState>> gUlthreads;
 
-
 int validateCommonOptParam(const void* optParam) {
     if (optParam == nullptr) return ULT_OK;
     if ((reinterpret_cast<std::uintptr_t>(optParam) & 7u) != 0) return ULT_ERROR_ALIGNMENT;
@@ -236,6 +233,15 @@ int APS5_VABI sceUltUlthreadOptParamInitialize(UltOptParam* optParam, std::uint3
     return InitializeOptParam(optParam);
 }
 
+int APS5_VABI sceUltConditionVariableOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion) {
+    (void)buildVersion;
+    return InitializeOptParam(optParam);
+}
+
+int APS5_VABI _sceUltConditionVariableOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion) {
+    return sceUltConditionVariableOptParamInitialize(optParam, buildVersion);
+}
+
 int APS5_VABI sceUltMutexCreate(void* mutex, const char* name, void* waitingQueueResourcePool, const UltMutexOptParam* optParam, std::uint32_t buildVersion) {
     (void)name;
     (void)buildVersion;
@@ -369,7 +375,9 @@ int APS5_VABI sceUltMutexUnlock(void* mutex) {
     return ULT_OK;
 }
 
-int APS5_VABI _sceUltConditionVariableCreate(void* condition, const char*, void* mutex, const void* optParam, std::uint32_t) {
+int APS5_VABI sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion) {
+    (void)name;
+    (void)buildVersion;
     if (condition == nullptr || mutex == nullptr) return ULT_ERROR_NULL;
     if (optParam != nullptr) throw std::runtime_error("ULT condition variable options are not implemented");
     std::lock_guard lock(gMutex);
@@ -385,6 +393,10 @@ int APS5_VABI _sceUltConditionVariableCreate(void* condition, const char*, void*
     return ULT_OK;
 }
 
+int APS5_VABI _sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion) {
+    return sceUltConditionVariableCreate(condition, name, mutex, optParam, buildVersion);
+}
+
 int APS5_VABI sceUltConditionVariableDestroy(void* condition) {
     std::lock_guard lock(gMutex);
     const auto it = gConditions.find(condition);
@@ -803,7 +815,8 @@ int APS5_VABI sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthread
         std::memset(ulthread, 0, 512);
         gUlthreads[ulthread] = state;
     }
-    const int result = scePthreadCreate(&state->_thread, nullptr, ulthreadRunner, state.get(), name != nullptr ? name : "");
+    const std::string threadName = name != nullptr ? std::string(name).substr(0, 31) : std::string();
+    const int result = scePthreadCreate(&state->_thread, nullptr, ulthreadRunner, state.get(), threadName.c_str());
     if (result != 0) {
         std::lock_guard<std::mutex> lock(gMutex);
         gUlthreads.erase(ulthread);
@@ -870,6 +883,7 @@ int APS5_VABI sceUltUlthreadYield() {
         return ULT_ERROR_STATE;
     }
     scePthreadYield();
+
     return ULT_OK;
 }
 
@@ -879,6 +893,7 @@ int APS5_VABI sceUltUlthreadExit(std::int32_t status) {
     }
     gCurrentUlthread->_exited.store(true, std::memory_order_release);
     scePthreadExit(reinterpret_cast<void*>(static_cast<std::intptr_t>(status)));
+
     return ULT_OK;
 }
 
@@ -1081,20 +1096,4 @@ int APS5_VABI sceUltUlthreadFactoryInitialize() {
     return 0;
 }
 
-int APS5_VABI sceUltConditionVariableCreate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceUltConditionVariableOptParamInitialize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-
-int APS5_VABI _sceUltConditionVariableOptParamInitialize() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libSceUlt/include/Api.hpp b/core/libs/prx/libSceUlt/include/Api.hpp
new file mode 100644
index 0000000000..c4c3213f0a
--- /dev/null
+++ b/core/libs/prx/libSceUlt/include/Api.hpp
@@ -0,0 +1,96 @@
+#pragma once
+
+#include "prx/libSceUlt/SceUltTypes.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUltInitialize();
+int APS5_VABI sceUltFinalize();
+int APS5_VABI sceUltMutexOptParamInitialize(UltMutexOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltSemaphoreOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueueOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueueDataResourcePoolOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltWaitingQueueResourcePoolOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltUlthreadOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltConditionVariableOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltConditionVariableOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltMutexCreate(void* mutex, const char* name, void* waitingQueueResourcePool, const UltMutexOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltMutexDestroy(void* mutex);
+int APS5_VABI sceUltMutexLock(void* mutex);
+int APS5_VABI sceUltMutexTryLock(void* mutex);
+int APS5_VABI sceUltMutexUnlock(void* mutex);
+int APS5_VABI sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltConditionVariableCreate(void* condition, const char* name, void* mutex, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltConditionVariableDestroy(void* condition);
+int APS5_VABI sceUltConditionVariableSignal(void* condition);
+int APS5_VABI sceUltConditionVariableWait(void* condition);
+std::uint64_t APS5_VABI sceUltWaitingQueueResourcePoolGetWorkAreaSize(std::uint32_t numThreads, std::uint32_t numSyncObjects);
+int APS5_VABI sceUltWaitingQueueResourcePoolCreate(void* pool, const char* name, std::uint32_t numThreads, std::uint32_t numSyncObjects, void* workArea, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void* pool);
+std::uint64_t APS5_VABI sceUltQueueDataResourcePoolGetWorkAreaSize(std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject);
+int APS5_VABI sceUltQueueDataResourcePoolCreate(void* pool, const char* name, std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject, void* waitingQueueResourcePool, void* workArea, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueueDataResourcePoolDestroy(void* pool);
+int APS5_VABI sceUltQueueCreate(void* queue, const char* name, std::uint64_t dataSize, void* waitingQueueResourcePool, void* queueDataResourcePool, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltQueuePush(void* queue, const void* data);
+int APS5_VABI sceUltQueueTryPush(void* queue, const void* data);
+int APS5_VABI sceUltQueuePop(void* queue, void* data);
+int APS5_VABI sceUltQueueTryPop(void* queue, void* data);
+int APS5_VABI sceUltQueueDestroy(void* queue);
+int APS5_VABI sceUltSemaphoreCreate(void* semaphore, const char* name, std::uint32_t numInitialResource, void* waitingQueueResourcePool, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltSemaphoreAcquire(void* semaphore, std::int32_t numResource);
+int APS5_VABI sceUltSemaphoreTryAcquire(void* semaphore, std::int32_t numResource);
+int APS5_VABI sceUltSemaphoreRelease(void* semaphore, std::int32_t numResource);
+int APS5_VABI sceUltSemaphoreDestroy(void* semaphore);
+int APS5_VABI sceUltUlthreadRuntimeOptParamInitialize(UltUlthreadRuntimeOptParam* optParam, std::uint32_t buildVersion);
+std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread);
+int APS5_VABI sceUltUlthreadRuntimeCreate(void* runtime, const char* name, std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread, void* workArea, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthreadEntry entry, std::uint64_t arg, void* context, std::uint64_t sizeContext, void* runtime, const void* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltUlthreadJoin(void* ulthread, std::int32_t* status);
+int APS5_VABI sceUltUlthreadTryJoin(void* ulthread, std::int32_t* status);
+int APS5_VABI sceUltUlthreadGetSelf(void** ulthread);
+int APS5_VABI sceUltUlthreadYield();
+int APS5_VABI sceUltUlthreadExit(std::int32_t status);
+int APS5_VABI sceUltUlthreadRuntimeDestroy(void* runtime);
+int APS5_VABI _sceUltWaitingQueueResourcePoolCreate(void* pool, const char* name, std::uint32_t numThreads, std::uint32_t numSyncObjects, void* workArea, const void* optParam);
+int APS5_VABI _sceUltSemaphoreCreate(void* semaphore, const char* name, std::uint32_t numInitialResource, void* waitingQueueResourcePool, const void* optParam);
+int APS5_VABI _sceUltMutexOptParamInitialize(UltMutexOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltMutexCreate(void* mutex, const char* name, void* waitingQueueResourcePool, const UltMutexOptParam* optParam);
+int APS5_VABI _sceUltQueueDataResourcePoolCreate(void* pool, const char* name, std::uint32_t numData, std::uint64_t dataSize, std::uint32_t numQueueObject, void* waitingQueueResourcePool, void* workArea, const void* optParam);
+int APS5_VABI _sceUltQueueCreate(void* queue, const char* name, std::uint64_t dataSize, void* waitingQueueResourcePool, void* queueDataResourcePool, const void* optParam);
+int APS5_VABI _sceUltUlthreadRuntimeOptParamInitialize(UltUlthreadRuntimeOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI _sceUltUlthreadRuntimeCreate(void* runtime, const char* name, std::uint32_t maxNumUlthread, std::uint32_t numWorkerThread, void* workArea, const void* optParam);
+int APS5_VABI _sceUltUlthreadCreate(void* ulthread, const char* name, UltUlthreadEntry entry, std::uint64_t arg, void* context, std::uint64_t sizeContext, void* runtime, const void* optParam);
+int APS5_VABI sceUltConditionVariableSignalAll(void* conditionVariable);
+int APS5_VABI sceUltGetConditionVariableInfo(void* object, UltConditionVariableInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetMutexInfo(void* object, UltMutexInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetQueueDataResourcePoolInfo(void* object, UltQueueDataResourcePoolInfo* info);
+int APS5_VABI sceUltGetQueueInfo(void* object, UltQueueInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetReaderWriterLockInfo(void* object, UltReaderWriterLockInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetSemaphoreInfo(void* object, UltSemaphoreInfo* info, UltWaitingThreadInfo* waitingThreads, std::uint32_t capacity);
+int APS5_VABI sceUltGetUlthreadInfo(void* object, UltUlthreadInfo* info);
+int APS5_VABI sceUltGetUlthreadRuntimeInfo(void* runtime, UltUlthreadRuntimeInfo* info, void** ulthreads, std::uint32_t ulthreadCapacity, Pthread* workerThreads, std::uint32_t workerCapacity);
+int APS5_VABI sceUltGetWaitingQueueResourcePoolInfo(void* object, UltWaitingQueueResourcePoolInfo* info);
+int APS5_VABI sceUltAbstractThreadFactoryCreateThread();
+int APS5_VABI sceUltAbstractThreadFactoryGetNumMaxThreads();
+int APS5_VABI sceUltAbstractThreadFactoryJoinThread();
+int APS5_VABI sceUltKernelThreadFactoryFinalize();
+int APS5_VABI sceUltKernelThreadFactoryGetFactoryPointer();
+int APS5_VABI sceUltKernelThreadFactoryInitialize();
+int APS5_VABI sceUltModuleFinalize();
+int APS5_VABI sceUltModuleInitialize();
+int APS5_VABI sceUltUlthreadFactoryFinalize();
+int APS5_VABI sceUltUlthreadFactoryGetFactoryPointer();
+int APS5_VABI sceUltUlthreadFactoryGetWorkAreaSize();
+int APS5_VABI sceUltUlthreadFactoryInitialize();
+int APS5_VABI sceUltReaderWriterLockOptParamInitialize(UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltReaderWriterLockCreate(void* rwlock, const char* name, void* waitingQueueResourcePool, const UltOptParam* optParam, std::uint32_t buildVersion);
+int APS5_VABI sceUltReaderWriterLockDestroy(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockLockRead(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockTryLockRead(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockUnlockRead(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockLockWrite(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockTryLockWrite(void* rwlock);
+int APS5_VABI sceUltReaderWriterLockUnlockWrite(void* rwlock);
+
+}
diff --git a/core/libs/prx/libSceUlt/libSceUlt.hpp b/core/libs/prx/libSceUlt/libSceUlt.hpp
new file mode 100644
index 0000000000..260a68efda
--- /dev/null
+++ b/core/libs/prx/libSceUlt/libSceUlt.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUlt/include/Api.hpp"
diff --git a/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp b/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp
index c947260041..ba86691ca6 100644
--- a/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp
+++ b/core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "prx/libSceUlt/src/ReaderWriterLock.hpp"
 #include "prx/libSceUlt/SceUltTypes.hpp"
 #include <condition_variable>
diff --git a/core/libs/prx/libSceUpdateService/Export.cpp b/core/libs/prx/libSceUpdateService/Export.cpp
index 7fc0488786..d434762726 100644
--- a/core/libs/prx/libSceUpdateService/Export.cpp
+++ b/core/libs/prx/libSceUpdateService/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUpdateService/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceUpdateService/include/Api.hpp b/core/libs/prx/libSceUpdateService/include/Api.hpp
new file mode 100644
index 0000000000..9dce013b86
--- /dev/null
+++ b/core/libs/prx/libSceUpdateService/include/Api.hpp
@@ -0,0 +1,48 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUpsrvGetCompletedTaskId();
+int APS5_VABI sceUpsrvGetRebootFlag();
+int APS5_VABI sceUpsrvGetSystemExUpdateTaskState();
+int APS5_VABI sceUpsrvInitialize();
+int APS5_VABI sceUpsrvPostErrorLog();
+int APS5_VABI sceUpsrvResumePausedTask();
+int APS5_VABI sceUpsrvSetFakeVersion();
+int APS5_VABI sceUpsrvStartUpdateSession();
+int APS5_VABI sceUpsrvSwitchSystemExBank();
+int APS5_VABI sceUpsrvSwitchSystemExBankWithoutVerify();
+int APS5_VABI sceUpsrvTerminate();
+int APS5_VABI sceUpsrvUpdateCancelBDUpdate();
+int APS5_VABI sceUpsrvUpdateCheckCancel();
+int APS5_VABI sceUpsrvUpdateCheckCreateHandler();
+int APS5_VABI sceUpsrvUpdateCheckDestroyHandler();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystem();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystemForDevKit();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystemForSettings();
+int APS5_VABI sceUpsrvUpdateCheckDoCheckSystemWithPupInfo();
+int APS5_VABI sceUpsrvUpdateCreateUpdateTask();
+int APS5_VABI sceUpsrvUpdateDestroyUpdateTask();
+int APS5_VABI sceUpsrvUpdateDoCheckBootUpdate();
+int APS5_VABI sceUpsrvUpdateDoUpdateSystemEx();
+int APS5_VABI sceUpsrvUpdateDoUpdateWithEntitlement();
+int APS5_VABI sceUpsrvUpdateDoUpdateWithPupInfo();
+int APS5_VABI sceUpsrvUpdateDoUpdateWithPupPath2();
+int APS5_VABI sceUpsrvUpdateGetBetaAgreementUrl();
+int APS5_VABI sceUpsrvUpdateGetEulaDisplay();
+int APS5_VABI sceUpsrvUpdateGetEulaStr();
+int APS5_VABI sceUpsrvUpdateGetEulaStrLen();
+int APS5_VABI sceUpsrvUpdateGetFeatureListUrl();
+int APS5_VABI sceUpsrvUpdateGetFeatureListUrlForSystemExUpdate();
+int APS5_VABI sceUpsrvUpdateGetFeatureListUrlForUpdate();
+int APS5_VABI sceUpsrvUpdateGetImageWritingProgress();
+int APS5_VABI sceUpsrvUpdateGetProgress();
+int APS5_VABI sceUpsrvUpdateGetUpdateTaskInfo();
+int APS5_VABI sceUpsrvUpdateGetUpdateTaskMgrInfo();
+int APS5_VABI sceUpsrvUpdateSetEulaAccept();
+int APS5_VABI sceUpsrvUpdateStartUpdateTask();
+int APS5_VABI sceUpsrvVerifySystemExBank();
+
+}
diff --git a/core/libs/prx/libSceUpdateService/libSceUpdateService.hpp b/core/libs/prx/libSceUpdateService/libSceUpdateService.hpp
new file mode 100644
index 0000000000..87a15733f7
--- /dev/null
+++ b/core/libs/prx/libSceUpdateService/libSceUpdateService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUpdateService/include/Api.hpp"
diff --git a/core/libs/prx/libSceUrlConfigResolver/Export.cpp b/core/libs/prx/libSceUrlConfigResolver/Export.cpp
index 60d243d931..85b45cd6ad 100644
--- a/core/libs/prx/libSceUrlConfigResolver/Export.cpp
+++ b/core/libs/prx/libSceUrlConfigResolver/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUrlConfigResolver/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -25,7 +26,6 @@ int APS5_VABI sceUrlConfigResolverGetJscHeapSizeSoftLimit() {
     return 0;
 }
 
-
 int APS5_VABI sceUrlConfigResolverGetReleaseVersion() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceUrlConfigResolver/include/Api.hpp b/core/libs/prx/libSceUrlConfigResolver/include/Api.hpp
new file mode 100644
index 0000000000..e5eb270f75
--- /dev/null
+++ b/core/libs/prx/libSceUrlConfigResolver/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUrlConfigResolverGetAppConfig();
+int APS5_VABI sceUrlConfigResolverGetDefaultQueryParameter();
+int APS5_VABI sceUrlConfigResolverGetDeviceId();
+int APS5_VABI sceUrlConfigResolverGetJscHeapSizeSoftLimit();
+int APS5_VABI sceUrlConfigResolverGetReleaseVersion();
+int APS5_VABI sceUrlConfigResolverGetSysVer();
+int APS5_VABI sceUrlConfigResolverIsUpdated();
+int APS5_VABI sceUrlConfigResolverUpdate();
+
+}
diff --git a/core/libs/prx/libSceUrlConfigResolver/libSceUrlConfigResolver.hpp b/core/libs/prx/libSceUrlConfigResolver/libSceUrlConfigResolver.hpp
new file mode 100644
index 0000000000..cd604928ca
--- /dev/null
+++ b/core/libs/prx/libSceUrlConfigResolver/libSceUrlConfigResolver.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUrlConfigResolver/include/Api.hpp"
diff --git a/core/libs/prx/libSceUsbStorage/CMakeLists.txt b/core/libs/prx/libSceUsbStorage/CMakeLists.txt
new file mode 100644
index 0000000000..a4280361de
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorage/CMakeLists.txt
@@ -0,0 +1,16 @@
+add_library(libSceUsbStorage SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceUsbStorage PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceUsbStorage PRIVATE libc)
+configure_windows_unwind(libSceUsbStorage)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_usb_storage_tests ${LIBS_INCLUDE_DIR}/tests/GuestUsbStorage.cpp)
+    target_include_directories(guest_usb_storage_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_usb_storage_tests PRIVATE libSceUsbStorage libc)
+    configure_windows_unwind(guest_usb_storage_tests)
+    add_test(NAME guest_usb_storage COMMAND guest_usb_storage_tests)
+    if(WIN32)
+        set_tests_properties(guest_usb_storage PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceUsbStorage>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceUsbStorage/Export.cpp b/core/libs/prx/libSceUsbStorage/Export.cpp
index 96c447c943..978a9dc386 100644
--- a/core/libs/prx/libSceUsbStorage/Export.cpp
+++ b/core/libs/prx/libSceUsbStorage/Export.cpp
@@ -1,79 +1,153 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct UsbStorageEvent;
-struct UsbStorageDeviceInfo;
-using UsbStorageCallback = void (APS5_VABI *)(const UsbStorageEvent* event, void* userData);
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
 
 extern "C" {
 
-int APS5_VABI sceUsbStorageInit(void* attr) {
+std::int32_t APS5_VABI sceUsbStorageInit(void* attr) {
+    (void)attr;
+    return 0;
+}
+
+std::int32_t APS5_VABI sceUsbStorageTerm(void) {
+    return 0;
+}
+
+std::int32_t APS5_VABI sceUsbStorageRegisterCallback(std::int32_t eventType, UsbStorageCallback callback, void* arg) {
+    (void)arg;
+    if (callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    if (eventType < UsbStorage::CallbackEventTypeFirst || eventType > UsbStorage::CallbackEventTypeLast) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageTerm(void) {
+
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallback(std::int32_t eventType, UsbStorageCallback callback) {
+    if (callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    if (eventType < UsbStorage::CallbackEventTypeFirst || eventType > UsbStorage::CallbackEventTypeLast) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRegisterCallback(int32_t eventType, UsbStorageCallback callback, void* arg) {
+
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
+    (void)device;
+    (void)arg;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageUnregisterCallback(int32_t eventType, UsbStorageCallback callback) {
+
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback) {
+    (void)device;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRegisterCallbackForMapAvailable(uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
+
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
+    (void)device;
+    (void)arg;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageUnregisterCallbackForMapAvailable(uint32_t device, const char* directory, UsbStorageCallback callback) {
+
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback) {
+    (void)device;
+    if (directory == nullptr || callback == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRegisterCallbackForMapUnavailable(uint32_t device, const char* directory, UsbStorageCallback callback, void* arg) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+std::int32_t APS5_VABI sceUsbStorageGetDeviceInfo(std::uint32_t device, UsbStorageDeviceInfo* info) {
+    (void)device;
+    if (info == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    return UsbStorage::DeviceNotFound;
 }
-int APS5_VABI sceUsbStorageUnregisterCallbackForMapUnavailable(uint32_t device, const char* directory, UsbStorageCallback callback) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetDeviceInfo(uint32_t device, UsbStorageDeviceInfo* info) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetDeviceList(uint32_t* devices, int32_t* count) {
-    NotImplemented_nid_no_patch(__func__);
+
+std::int32_t APS5_VABI sceUsbStorageGetDeviceList(std::uint32_t* devices, std::int32_t* count) {
+    if (devices == nullptr || count == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    *count = 0;
     return 0;
 }
+
 int APS5_VABI sceUsbStorageGetMountPointOfShellCore(uint32_t device, char* mountPoint) {
+    (void)device;
+    (void)mountPoint;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-bool APS5_VABI sceUsbStorageIsExist(uint32_t device, const char* directory, std::uint8_t* exists) {
+
+bool APS5_VABI sceUsbStorageIsExist(std::uint32_t device, const char* directory, std::uint8_t* exists) {
+    (void)device;
+    (void)directory;
+    *exists = 0;
+    return true;
+}
+
+std::int32_t APS5_VABI sceUsbStorageRequestMap(std::uint32_t device, const char* directory, std::int32_t flags,
+                                               std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId) {
+    (void)device;
+    (void)directory;
+    (void)flags;
+    (void)volumeSize;
+    (void)mountPoint;
+    (void)mountId;
+    return UsbStorage::DeviceNotFound;
+}
+
+std::int32_t APS5_VABI sceUsbStorageRequestUnmap(std::uint32_t device, const char* directory) {
+    (void)device;
+    if (directory == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceUsbStorageRequestMap(uint32_t device, const char* directory, int32_t flags, uint64_t volumeSize, char* mountPoint, uint64_t* mountId) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+std::int32_t APS5_VABI sceUsbStorageGetdentsOpen(std::uint32_t device, std::int32_t* fd, std::uint64_t* bufferSize) {
+    (void)device;
+    if (fd == nullptr || bufferSize == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    return UsbStorage::DeviceNotFound;
 }
-int APS5_VABI sceUsbStorageRequestUnmap(uint32_t device, const char* directory) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+std::int32_t APS5_VABI sceUsbStorageGetdentsRead(std::int32_t fd, void* buffer, std::uint64_t bufferSize, std::uint64_t* bytesRead) {
+    (void)fd;
+    (void)bufferSize;
+    if (buffer == nullptr || bytesRead == nullptr) {
+        return UsbStorage::InvalidArgument;
+    }
+    *bytesRead = 0;
+    return UsbStorage::NotSupported;
 }
-int APS5_VABI sceUsbStorageGetdentsOpen(uint32_t device, int32_t* fd, uint64_t* bufferSize) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetdentsRead(int32_t fd, void* buffer, uint64_t bufferSize, uint64_t* bytesRead) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceUsbStorageGetdentsClose(int32_t fd) {
+
+std::int32_t APS5_VABI sceUsbStorageGetdentsClose(std::int32_t fd) {
+    (void)fd;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
@@ -83,10 +157,15 @@ int APS5_VABI sceUsbStorageClearFakeWriteProtection() {
     return 0;
 }
 
-int APS5_VABI sceUsbStorageRequestMapWSB(uint32_t device_id, const char* subpath, int32_t flags,
-                                        int32_t unknown, char* out_mount_path, int32_t* out_status) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int32_t APS5_VABI sceUsbStorageRequestMapWSB(std::uint32_t device, const char* subpath, std::int32_t flags,
+                                                  std::int32_t unknown, char* mountPath, std::int32_t* status) {
+    (void)device;
+    (void)subpath;
+    (void)flags;
+    (void)unknown;
+    (void)mountPath;
+    (void)status;
+    return UsbStorage::DeviceNotFound;
 }
 
 int APS5_VABI sceUsbStorageSetFakeMapLockForDebug() {
diff --git a/core/libs/prx/libSceUsbStorage/UsbStorage.hpp b/core/libs/prx/libSceUsbStorage/UsbStorage.hpp
new file mode 100644
index 0000000000..b3bc2d24ab
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorage/UsbStorage.hpp
@@ -0,0 +1,50 @@
+#ifndef CORE_LIBS_PRX_LIBSCEUSBSTORAGE_USBSTORAGE_HPP
+#define CORE_LIBS_PRX_LIBSCEUSBSTORAGE_USBSTORAGE_HPP
+
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <cstddef>
+#include <cstdint>
+
+namespace UsbStorage {
+
+inline constexpr std::int32_t InvalidArgument = static_cast<std::int32_t>(0x80f40002);
+inline constexpr std::int32_t DeviceNotFound = static_cast<std::int32_t>(0x80f40004);
+inline constexpr std::int32_t NotSupported = static_cast<std::int32_t>(0x80f40005);
+
+inline constexpr std::int32_t CallbackEventTypeFirst = 1;
+inline constexpr std::int32_t CallbackEventTypeLast = 2;
+
+}
+
+struct UsbStorageEvent;
+struct UsbStorageDeviceInfo;
+using UsbStorageCallback = void (APS5_VABI *)(const UsbStorageEvent* event, void* userData);
+
+extern "C" {
+std::int32_t APS5_VABI sceUsbStorageInit(void* attr);
+std::int32_t APS5_VABI sceUsbStorageTerm(void);
+std::int32_t APS5_VABI sceUsbStorageRegisterCallback(std::int32_t eventType, UsbStorageCallback callback, void* arg);
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallback(std::int32_t eventType, UsbStorageCallback callback);
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapAvailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+std::int32_t APS5_VABI sceUsbStorageRegisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback, void* arg);
+std::int32_t APS5_VABI sceUsbStorageUnregisterCallbackForMapUnavailable(std::uint32_t device, const char* directory, UsbStorageCallback callback);
+std::int32_t APS5_VABI sceUsbStorageGetDeviceInfo(std::uint32_t device, UsbStorageDeviceInfo* info);
+std::int32_t APS5_VABI sceUsbStorageGetDeviceList(std::uint32_t* devices, std::int32_t* count);
+std::int32_t APS5_VABI sceUsbStorageGetMountPointOfShellCore(std::uint32_t device, char* mountPoint);
+bool APS5_VABI sceUsbStorageIsExist(std::uint32_t device, const char* directory, std::uint8_t* exists);
+std::int32_t APS5_VABI sceUsbStorageRequestMap(std::uint32_t device, const char* directory, std::int32_t flags,
+                                               std::uint64_t volumeSize, char* mountPoint, std::uint64_t* mountId);
+std::int32_t APS5_VABI sceUsbStorageRequestUnmap(std::uint32_t device, const char* directory);
+std::int32_t APS5_VABI sceUsbStorageGetdentsOpen(std::uint32_t device, std::int32_t* fd, std::uint64_t* bufferSize);
+std::int32_t APS5_VABI sceUsbStorageGetdentsRead(std::int32_t fd, void* buffer, std::uint64_t bufferSize, std::uint64_t* bytesRead);
+std::int32_t APS5_VABI sceUsbStorageGetdentsClose(std::int32_t fd);
+std::int32_t APS5_VABI sceUsbStorageRequestMapWSB(std::uint32_t device, const char* subpath, std::int32_t flags,
+                                                  std::int32_t unknown, char* mountPath, std::int32_t* status);
+std::int32_t APS5_VABI sceUsbStorageClearFakeWriteProtection();
+std::int32_t APS5_VABI sceUsbStorageSetFakeMapLockForDebug();
+std::int32_t APS5_VABI sceUsbStorageSetFakeWriteProtection();
+}
+
+#endif
diff --git a/core/libs/prx/libSceUsbStorage/libSceUsbStorage.hpp b/core/libs/prx/libSceUsbStorage/libSceUsbStorage.hpp
new file mode 100644
index 0000000000..bf34865160
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorage/libSceUsbStorage.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
diff --git a/core/libs/prx/libSceUsbStorageDialog/Export.cpp b/core/libs/prx/libSceUsbStorageDialog/Export.cpp
index 612ac95a57..290ab47eca 100644
--- a/core/libs/prx/libSceUsbStorageDialog/Export.cpp
+++ b/core/libs/prx/libSceUsbStorageDialog/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceUsbStorageDialog/include/Api.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
@@ -7,8 +9,6 @@
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 
-extern "C" int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* users);
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
diff --git a/core/libs/prx/libSceUsbStorageDialog/include/Api.hpp b/core/libs/prx/libSceUsbStorageDialog/include/Api.hpp
new file mode 100644
index 0000000000..636ddf50f5
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorageDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceUsbStorageDialogInitialize(void);
+int APS5_VABI sceUsbStorageDialogOpen(const UsbStorageDialogParam* param);
+int APS5_VABI sceUsbStorageDialogGetStatus(void);
+int APS5_VABI sceUsbStorageDialogUpdateStatus(void);
+int APS5_VABI sceUsbStorageDialogGetResult(UsbStorageDialogResult* result);
+int APS5_VABI sceUsbStorageDialogClose(void);
+int APS5_VABI sceUsbStorageDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceUsbStorageDialog/libSceUsbStorageDialog.hpp b/core/libs/prx/libSceUsbStorageDialog/libSceUsbStorageDialog.hpp
new file mode 100644
index 0000000000..fdc47497d7
--- /dev/null
+++ b/core/libs/prx/libSceUsbStorageDialog/libSceUsbStorageDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUsbStorageDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceUsbd/Export.cpp b/core/libs/prx/libSceUsbd/Export.cpp
index 6d791a3166..46219b9973 100644
--- a/core/libs/prx/libSceUsbd/Export.cpp
+++ b/core/libs/prx/libSceUsbd/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUsbd/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -28,35 +29,8 @@ constexpr std::uint8_t TRANSFER_TYPE_BULK = 2;
 constexpr std::uint8_t TRANSFER_TYPE_INTERRUPT = 3;
 constexpr std::int32_t CONTROL_SETUP_SIZE = 8;
 constexpr std::uint8_t SUPPORTED_TRANSFER_FLAGS = LIBUSB_TRANSFER_SHORT_NOT_OK | LIBUSB_TRANSFER_ADD_ZERO_PACKET;
-
-struct UsbdTimeval {
-    std::int64_t seconds;
-    std::int64_t microseconds;
-};
-
-struct UsbdIsoPacketDescriptor {
-    std::uint32_t length;
-    std::uint32_t actualLength;
-    std::int32_t status;
-};
-
-using UsbdTransferCallback = void (APS5_VABI*)(struct UsbdTransfer*);
-
-struct UsbdTransfer {
-    void* deviceHandle;
-    std::uint8_t flags;
-    std::uint8_t endpoint;
-    std::uint8_t type;
-    std::uint32_t timeout;
-    std::int32_t status;
-    std::int32_t length;
-    std::int32_t actualLength;
-    UsbdTransferCallback callback;
-    void* userData;
-    std::uint8_t* buffer;
-    std::int32_t numIsoPackets;
-    UsbdIsoPacketDescriptor isoPacketDescriptors[1];
-};
+constexpr std::uint16_t STRING_DESCRIPTOR_SIZE = 255;
+constexpr std::uint32_t STRING_DESCRIPTOR_TIMEOUT = 1000;
 
 static_assert(offsetof(UsbdTransfer, timeout) == 12 && offsetof(UsbdTransfer, callback) == 32 && offsetof(UsbdTransfer, numIsoPackets) == 56 && offsetof(UsbdTransfer, isoPacketDescriptors) == 60);
 static_assert(sizeof(libusb_device_descriptor) == 18);
@@ -141,6 +115,13 @@ void LIBUSB_CALL CompleteTransfer(libusb_transfer* host) {
     if (guest->callback != nullptr) guest->callback(guest);
 }
 
+bool RequestStringDescriptor(libusb_device_handle* handle, std::uint8_t descriptorIndex, std::uint16_t languageId, std::uint8_t* descriptor) {
+    std::memset(descriptor, 0, STRING_DESCRIPTOR_SIZE);
+    const auto value = static_cast<std::uint16_t>(LIBUSB_DT_STRING << 8 | descriptorIndex);
+    const int result = libusb_control_transfer(handle, LIBUSB_ENDPOINT_IN, LIBUSB_REQUEST_GET_DESCRIPTOR, value, languageId, descriptor, STRING_DESCRIPTOR_SIZE, STRING_DESCRIPTOR_TIMEOUT);
+    return result >= 0 && descriptor[1] == LIBUSB_DT_STRING;
+}
+
 }
 
 extern "C" {
@@ -550,18 +531,31 @@ std::int32_t APS5_VABI sceUsbdEventHandlerActive() {
 }
 
 std::int32_t APS5_VABI sceUsbdGetConfigDescriptorByValue(void* device, std::uint8_t configurationValue, void** config) {
-    NotImplemented_nid_no_patch(__func__);
+    if (device == nullptr || config == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
+    libusb_config_descriptor* host = nullptr;
+    const int result = libusb_get_config_descriptor_by_value(KnownDevice(device, __func__), configurationValue, &host);
+    *config = nullptr;
+    if (result != 0) return ToGuestError(result);
+    auto& state = State();
+    std::lock_guard lock(state.mutex);
+    state.configs.insert(host);
+    *config = host;
     return 0;
 }
 
 std::int32_t APS5_VABI sceUsbdGetConfiguration(void* deviceHandle, std::int32_t* configuration) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr || configuration == nullptr) return SCE_USBD_ERROR_INVALID_ARG;
+    int host = 0;
+    const int result = libusb_get_configuration(KnownHandle(deviceHandle, __func__), &host);
+    if (result == 0) *configuration = host;
+    return ToGuestError(result);
 }
 
 std::int32_t APS5_VABI sceUsbdGetDescriptor(void* deviceHandle, std::uint8_t descriptorType, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr || data == nullptr || length < 1) return SCE_USBD_ERROR_INVALID_ARG;
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    if (length > 65535) length = 65535;
+    return ToGuestError(libusb_get_descriptor(handle, descriptorType, descriptorIndex, data, length));
 }
 
 void* APS5_VABI sceUsbdGetDevice(void* deviceHandle) {
@@ -585,8 +579,35 @@ std::int32_t APS5_VABI sceUsbdGetMaxPacketSize(void* device, std::uint8_t endpoi
 }
 
 std::int32_t APS5_VABI sceUsbdGetStringDescriptorAscii(void* deviceHandle, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (deviceHandle == nullptr || data == nullptr || length < 1) return SCE_USBD_ERROR_INVALID_ARG;
+    auto* handle = KnownHandle(deviceHandle, __func__);
+    if (length > 65535) length = 65535;
+    data[0] = 0;
+    std::uint8_t descriptor[STRING_DESCRIPTOR_SIZE];
+    if (!RequestStringDescriptor(handle, 0, 0, descriptor)) return SCE_USBD_ERROR_OTHER;
+    const auto languageId = static_cast<std::uint16_t>(descriptor[2] | descriptor[3] << 8);
+    if (!RequestStringDescriptor(handle, descriptorIndex, languageId, descriptor) || descriptor[0] < 2) return SCE_USBD_ERROR_OTHER;
+    std::int32_t units = descriptor[0] / 2 - 1;
+    if (units > length - 1) units = length - 1;
+    std::uint8_t byteOrder = 3;
+    std::int32_t written = 0;
+    for (std::int32_t unit = 0; unit < units; ++unit) {
+        const auto code = static_cast<std::uint16_t>(descriptor[2 * unit + 2] | descriptor[2 * unit + 3] << 8);
+        std::uint8_t character;
+        if ((code & 0xFF00) == 0 && (byteOrder & 1) != 0) {
+            character = static_cast<std::uint8_t>(code);
+            byteOrder = 1;
+        } else if ((code & 0x00FF) == 0 && (byteOrder & 2) != 0) {
+            character = static_cast<std::uint8_t>(code >> 8);
+            byteOrder = 2;
+        } else {
+            continue;
+        }
+        if (character < 0x20 || character > 0x7E || character == '<' || character == '>') continue;
+        data[written++] = character;
+    }
+    data[written] = 0;
+    return written;
 }
 
 std::int32_t APS5_VABI sceUsbdHandleEvents() {
diff --git a/core/libs/prx/libSceUsbd/include/Api.hpp b/core/libs/prx/libSceUsbd/include/Api.hpp
new file mode 100644
index 0000000000..5b5aa49a05
--- /dev/null
+++ b/core/libs/prx/libSceUsbd/include/Api.hpp
@@ -0,0 +1,111 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <chrono>
+#include <climits>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <mutex>
+#include <new>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+
+struct UsbdTimeval {
+    std::int64_t seconds;
+    std::int64_t microseconds;
+};
+
+struct UsbdIsoPacketDescriptor {
+    std::uint32_t length;
+    std::uint32_t actualLength;
+    std::int32_t status;
+};
+
+using UsbdTransferCallback = void (APS5_VABI*)(struct UsbdTransfer*);
+
+struct UsbdTransfer {
+    void* deviceHandle;
+    std::uint8_t flags;
+    std::uint8_t endpoint;
+    std::uint8_t type;
+    std::uint32_t timeout;
+    std::int32_t status;
+    std::int32_t length;
+    std::int32_t actualLength;
+    UsbdTransferCallback callback;
+    void* userData;
+    std::uint8_t* buffer;
+    std::int32_t numIsoPackets;
+    UsbdIsoPacketDescriptor isoPacketDescriptors[1];
+};
+
+extern "C" {
+
+std::int32_t APS5_VABI sceUsbdInit();
+void APS5_VABI sceUsbdExit();
+std::int64_t APS5_VABI sceUsbdGetDeviceList(void*** list);
+void APS5_VABI sceUsbdFreeDeviceList(void** list, std::int32_t unrefDevices);
+std::int32_t APS5_VABI sceUsbdHandleEventsTimeout(const UsbdTimeval* timeout);
+UsbdTransfer* APS5_VABI sceUsbdAllocTransfer(std::int32_t isoPackets);
+void APS5_VABI sceUsbdFreeTransfer(UsbdTransfer* transfer);
+void APS5_VABI sceUsbdFillInterruptTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+void APS5_VABI sceUsbdFillBulkTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+void APS5_VABI sceUsbdFillIsoTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, std::int32_t numIsoPackets, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+void APS5_VABI sceUsbdFillControlSetup(std::uint8_t* buffer, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint16_t length);
+void APS5_VABI sceUsbdFillControlTransfer(UsbdTransfer* transfer, void* deviceHandle, std::uint8_t* buffer, UsbdTransferCallback callback, void* userData, std::uint32_t timeout);
+std::uint8_t* APS5_VABI sceUsbdControlTransferGetData(UsbdTransfer* transfer);
+std::uint8_t* APS5_VABI sceUsbdControlTransferGetSetup(UsbdTransfer* transfer);
+void APS5_VABI sceUsbdSetIsoPacketLengths(UsbdTransfer* transfer, std::uint32_t length);
+std::uint8_t* APS5_VABI sceUsbdGetIsoPacketBuffer(UsbdTransfer* transfer, std::uint32_t packet);
+std::int32_t APS5_VABI sceUsbdBulkTransfer(void* deviceHandle, std::uint8_t endpoint, std::uint8_t* data, std::int32_t length, std::int32_t* transferred, std::uint32_t timeout);
+std::int32_t APS5_VABI sceUsbdInterruptTransfer(void* deviceHandle, std::uint8_t endpoint, std::uint8_t* data, std::int32_t length, std::int32_t* transferred, std::uint32_t timeout);
+std::int32_t APS5_VABI sceUsbdCancelTransfer(UsbdTransfer* transfer);
+std::int32_t APS5_VABI sceUsbdEventHandlingOk();
+void APS5_VABI sceUsbdFreeConfigDescriptor(void* config);
+std::int32_t APS5_VABI sceUsbdAttachKernelDriver(void* deviceHandle, std::int32_t interfaceNumber);
+std::int32_t APS5_VABI sceUsbdCheckConnected(void* deviceHandle);
+std::int32_t APS5_VABI sceUsbdClaimInterface(void* deviceHandle, std::int32_t interfaceNumber);
+void APS5_VABI sceUsbdClose(void* deviceHandle);
+std::int32_t APS5_VABI sceUsbdControlTransfer(void* deviceHandle, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint8_t* data, std::uint16_t length, std::uint32_t timeout);
+std::int32_t APS5_VABI sceUsbdGetActiveConfigDescriptor(void* device, void** config);
+std::uint8_t APS5_VABI sceUsbdGetBusNumber(void* device);
+std::int32_t APS5_VABI sceUsbdGetConfigDescriptor(void* device, std::uint8_t configIndex, void** config);
+std::uint8_t APS5_VABI sceUsbdGetDeviceAddress(void* device);
+std::int32_t APS5_VABI sceUsbdGetDeviceDescriptor(void* device, void* descriptor);
+std::int32_t APS5_VABI sceUsbdGetStringDescriptor(void* deviceHandle, std::uint8_t descriptorIndex, std::uint16_t languageId, std::uint8_t* data, std::int32_t length);
+std::int32_t APS5_VABI sceUsbdKernelDriverActive(void* deviceHandle, std::int32_t interfaceNumber);
+std::int32_t APS5_VABI sceUsbdOpen(void* device, void** deviceHandle);
+void* APS5_VABI sceUsbdRefDevice(void* device);
+std::int32_t APS5_VABI sceUsbdReleaseInterface(void* deviceHandle, std::int32_t interfaceNumber);
+std::int32_t APS5_VABI sceUsbdResetDevice(void* deviceHandle);
+std::int32_t APS5_VABI sceUsbdSetConfiguration(void* deviceHandle, std::int32_t configuration);
+std::int32_t APS5_VABI sceUsbdSubmitTransfer(UsbdTransfer* transfer);
+void APS5_VABI sceUsbdUnrefDevice(void* device);
+std::int32_t APS5_VABI sceUsbdClearHalt(void* deviceHandle, std::uint8_t endpoint);
+std::int32_t APS5_VABI sceUsbdDetachKernelDriver(void* deviceHandle, int interfaceNumber);
+std::int32_t APS5_VABI sceUsbdEventHandlerActive();
+std::int32_t APS5_VABI sceUsbdGetConfigDescriptorByValue(void* device, std::uint8_t configurationValue, void** config);
+std::int32_t APS5_VABI sceUsbdGetConfiguration(void* deviceHandle, std::int32_t* configuration);
+std::int32_t APS5_VABI sceUsbdGetDescriptor(void* deviceHandle, std::uint8_t descriptorType, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length);
+void* APS5_VABI sceUsbdGetDevice(void* deviceHandle);
+int APS5_VABI sceUsbdGetDeviceSpeed(void* device);
+std::int32_t APS5_VABI sceUsbdGetMaxIsoPacketSize(void* device, std::uint8_t endpoint);
+std::int32_t APS5_VABI sceUsbdGetMaxPacketSize(void* device, std::uint8_t endpoint);
+std::int32_t APS5_VABI sceUsbdGetStringDescriptorAscii(void* deviceHandle, std::uint8_t descriptorIndex, std::uint8_t* data, std::int32_t length);
+std::int32_t APS5_VABI sceUsbdHandleEvents();
+std::int32_t APS5_VABI sceUsbdHandleEventsLocked(UsbdTimeval* timeout);
+void APS5_VABI sceUsbdLockEventWaiters();
+void APS5_VABI sceUsbdLockEvents();
+void* APS5_VABI sceUsbdOpenDeviceWithVidPid(std::uint16_t vendorId, std::uint16_t productId);
+std::int32_t APS5_VABI sceUsbdSetInterfaceAltSetting(void* deviceHandle, int interfaceNumber, int alternateSetting);
+std::int32_t APS5_VABI sceUsbdTryLockEvents();
+void APS5_VABI sceUsbdUnlockEventWaiters();
+void APS5_VABI sceUsbdUnlockEvents();
+std::int32_t APS5_VABI sceUsbdWaitForEvent(UsbdTimeval* timeout);
+
+}
diff --git a/core/libs/prx/libSceUsbd/libSceUsbd.hpp b/core/libs/prx/libSceUsbd/libSceUsbd.hpp
new file mode 100644
index 0000000000..6e1c2333f9
--- /dev/null
+++ b/core/libs/prx/libSceUsbd/libSceUsbd.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUsbd/include/Api.hpp"
diff --git a/core/libs/prx/libSceUserService/CMakeLists.txt b/core/libs/prx/libSceUserService/CMakeLists.txt
index 6d606a67e8..282c8e98a3 100644
--- a/core/libs/prx/libSceUserService/CMakeLists.txt
+++ b/core/libs/prx/libSceUserService/CMakeLists.txt
@@ -1,11 +1,12 @@
 add_library(libSceUserService SHARED EXCLUDE_FROM_ALL Export.cpp)
 target_include_directories(libSceUserService PRIVATE ${LIBS_INCLUDE_DIR})
+target_link_libraries(libSceUserService PRIVATE libSceSystemService)
 configure_windows_unwind(libSceUserService)
 
 if(BUILD_TESTING)
     add_test_executable(guest_user_service_tests ${LIBS_INCLUDE_DIR}/tests/GuestUserService.cpp)
     target_include_directories(guest_user_service_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_user_service_tests PRIVATE libSceUserService)
+    target_link_libraries(guest_user_service_tests PRIVATE libSceUserService libSceSystemService libc)
     configure_windows_unwind(guest_user_service_tests)
     add_test(NAME guest_user_service COMMAND guest_user_service_tests)
     if(WIN32)
@@ -17,7 +18,7 @@ endif()
 if(BUILD_TESTING)
     add_test_executable(guest_user_service_user_name_tests ${LIBS_INCLUDE_DIR}/tests/GuestUserServiceUserName.cpp)
     target_include_directories(guest_user_service_user_name_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_user_service_user_name_tests PRIVATE libSceUserService)
+    target_link_libraries(guest_user_service_user_name_tests PRIVATE libSceUserService libSceSystemService)
     add_test(NAME guest_user_service_user_name COMMAND guest_user_service_user_name_tests)
     if(WIN32)
         set_tests_properties(guest_user_service_user_name PROPERTIES ENVIRONMENT_MODIFICATION
@@ -28,7 +29,7 @@ endif()
 if(BUILD_TESTING)
     add_test_executable(guest_user_service_lifecycle_tests ${LIBS_INCLUDE_DIR}/tests/GuestUserServiceLifecycle.cpp)
     target_include_directories(guest_user_service_lifecycle_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_user_service_lifecycle_tests PRIVATE libSceUserService)
+    target_link_libraries(guest_user_service_lifecycle_tests PRIVATE libSceUserService libSceSystemService)
     add_test(NAME guest_user_service_lifecycle COMMAND guest_user_service_lifecycle_tests)
     if(WIN32)
         set_tests_properties(guest_user_service_lifecycle PROPERTIES ENVIRONMENT_MODIFICATION
diff --git a/core/libs/prx/libSceUserService/Export.cpp b/core/libs/prx/libSceUserService/Export.cpp
index a12d5c3263..03a44d4920 100644
--- a/core/libs/prx/libSceUserService/Export.cpp
+++ b/core/libs/prx/libSceUserService/Export.cpp
@@ -1,16 +1,38 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include <cstddef>
 #include <cstdint>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <atomic>
+#include <array>
 #include <cstring>
+#include <deque>
+#include <mutex>
 #include "prx/libSceUserService/UserService.hpp"
 
-static std::atomic<bool> initialized{false};
-static std::atomic<bool> loginReported{false};
+namespace {
 
-static int ReportAccessibilitySetting(int user_id, int32_t* setting, int32_t value) {
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+std::atomic<bool> initialized{false};
+std::mutex userMutex;
+
+struct UserEvent {
+    std::uint32_t eventType;
+    int userId;
+};
+
+std::deque<UserEvent> eventQueue;
+std::array<bool, USER_SERVICE_MAX_USERS> userConnected{true, false, false, false};
+
+int UserIndex(int userId) {
+    if (userId >= USER_SERVICE_INITIAL_USER_ID && userId < USER_SERVICE_INITIAL_USER_ID + USER_SERVICE_MAX_USERS) {
+        return userId - USER_SERVICE_INITIAL_USER_ID;
+    }
+    return -1;
+}
+
+int ReportAccessibilitySetting(int user_id, int32_t* setting, int32_t value) {
+ const int index = UserIndex(user_id);
+ if (index < 0) {
   return USER_SERVICE_ERROR_NOT_LOGGED_IN;
  }
  if (setting == nullptr) {
@@ -20,8 +42,80 @@ static int ReportAccessibilitySetting(int user_id, int32_t* setting, int32_t val
  return USER_SERVICE_OK;
 }
 
+void PopulateInitialLoginEvents() {
+ std::lock_guard lock(userMutex);
+ eventQueue.clear();
+ constexpr std::uint32_t EventTypeLogin = 0;
+ eventQueue.push_back({EventTypeLogin, USER_SERVICE_INITIAL_USER_ID});
+ for (int i = 1; i < USER_SERVICE_MAX_USERS; ++i) {
+  if (userConnected[i]) {
+   eventQueue.push_back({EventTypeLogin, USER_SERVICE_INITIAL_USER_ID + i});
+  }
+ }
+}
+
+
+// Per-user keyboard settings. Nothing in AnyPS5 stores a keyboard type or input variant, so every known user reports
+// the keyboard type of the configured system language and 0 for the input variants (see
+// docs/dev/debt/libSceUserService.md).
+static int32_t KeyboardTypeForSystemLanguage() {
+ constexpr int param_id_lang = 1;
+ constexpr int32_t fallback = 20;
+ constexpr int32_t keyboard_types[] = {37, 20, 26, 21, 17, 28, 29, 33, 34, 38, 39, 40, 23, 35, 16,
+                                       30, 31, 32, 19, 36, 22, 41, 25, 44, 48, 43, 47, 42, 46, 45};
+ int language = -1;
+ if (sceSystemServiceParamGetInt(param_id_lang, &language) != 0 || language < 0 ||
+     language >= static_cast<int>(sizeof(keyboard_types) / sizeof(keyboard_types[0]))) {
+  return fallback;
+ }
+ return keyboard_types[language];
+}
+
+static int32_t NoInputVariant() {
+ return 0;
+}
+
+static int ReportKeyboardSetting(int user_id, int32_t* type, int32_t (*value)()) {
+ if (type == nullptr) {
+  return USER_SERVICE_ERROR_INVALID_ARGUMENT;
+ }
+ if (UserIndex(user_id) < 0) {
+  return USER_SERVICE_ERROR_UNKNOWN_USER;
+ }
+ *type = value();
+ return USER_SERVICE_OK;
+}
+}
+
 extern "C" {
 
+void UserServiceSetUserConnected_nid_postfix(int userIndex, bool connected) {
+    if (userIndex <= 0 || userIndex >= USER_SERVICE_MAX_USERS) return;
+    std::lock_guard lock(userMutex);
+    if (userConnected[userIndex] != connected) {
+        userConnected[userIndex] = connected;
+        if (initialized.load()) {
+            constexpr std::uint32_t EventTypeLogin = 0;
+            constexpr std::uint32_t EventTypeLogout = 1;
+            const std::uint32_t eventType = connected ? EventTypeLogin : EventTypeLogout;
+            const int userId = USER_SERVICE_INITIAL_USER_ID + userIndex;
+            bool collapsed = false;
+            for (auto it = eventQueue.begin(); it != eventQueue.end(); ++it) {
+                if (it->userId == userId) {
+                    if (it->eventType != eventType) {
+                        eventQueue.erase(it);
+                    }
+                    collapsed = true;
+                    break;
+                }
+            }
+            if (!collapsed) {
+                eventQueue.push_back({eventType, userId});
+            }
+        }
+    }
+}
+
 int APS5_VABI sceUserServiceGetAccessibilityChatTranscription(int user_id, int32_t* chat_transcription) {
  return ReportAccessibilitySetting(user_id, chat_transcription, 0);
 }
@@ -57,7 +151,8 @@ int APS5_VABI sceUserServiceGetAccessibilityZoomFollowFocus(int user_id, int32_t
 }
 
 int APS5_VABI sceUserServiceGetAgeLevel(int user_id, uint32_t* age_level) {
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (index < 0) {
   return USER_SERVICE_ERROR_NOT_LOGGED_IN;
  }
  if (age_level == nullptr) {
@@ -76,12 +171,14 @@ int APS5_VABI sceUserServiceGetEvent(SceUserServiceEvent* event) {
  if (event == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- if (loginReported.exchange(true)) {
+ std::lock_guard lock(userMutex);
+ if (eventQueue.empty()) {
   return USER_SERVICE_ERROR_NO_EVENT;
  }
- constexpr std::uint32_t EventTypeLogin = 0;
- event->event_type = EventTypeLogin;
- event->user_id = USER_SERVICE_INITIAL_USER_ID;
+ const auto item = eventQueue.front();
+ eventQueue.pop_front();
+ event->event_type = item.eventType;
+ event->user_id = item.userId;
  return USER_SERVICE_OK;
 }
 
@@ -89,7 +186,8 @@ int APS5_VABI sceUserServiceGetGamePresets(int user_id, UserServiceGamePresets*
  // System-wide game presets (difficulty, view inversion, subtitles, audio language) of the user's
  // profile. A fresh console has none set: every field is 0, "not specified", and the title falls
  // back to its own defaults. this_size is the caller's.
- if (presets == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (presets == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
  presets->difficulty = 0;
@@ -118,10 +216,14 @@ int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* user_
  if (user_id_list == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- user_id_list->user_id[0] = USER_SERVICE_INITIAL_USER_ID;
- user_id_list->user_id[1] = USER_SERVICE_USER_ID_INVALID;
- user_id_list->user_id[2] = USER_SERVICE_USER_ID_INVALID;
- user_id_list->user_id[3] = USER_SERVICE_USER_ID_INVALID;
+ std::lock_guard lock(userMutex);
+ for (int i = 0; i < 4; ++i) {
+  if (i < USER_SERVICE_MAX_USERS && userConnected[i]) {
+   user_id_list->user_id[i] = USER_SERVICE_INITIAL_USER_ID + i;
+  } else {
+   user_id_list->user_id[i] = USER_SERVICE_USER_ID_INVALID;
+  }
+ }
  return USER_SERVICE_OK;
 }
 
@@ -129,22 +231,24 @@ int APS5_VABI sceUserServiceGetUserName(int user_id, char* name, size_t size) {
  if (name == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- if (user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (index < 0) {
   return USER_SERVICE_ERROR_UNKNOWN_USER;
  }
  if (size < USER_SERVICE_MAX_USER_NAME_LENGTH + 1) {
   std::memset(name, 0, size);
   return USER_SERVICE_ERROR_BUFFER_TOO_SHORT;
  }
- std::strncpy(name, USER_SERVICE_INITIAL_USER_NAME, size);
+ std::strncpy(name, USER_SERVICE_USER_NAMES[index], size);
  return USER_SERVICE_OK;
 }
 
 int APS5_VABI sceUserServiceGetUserNumber(int user_id, int32_t* number) {
- if (number == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (number == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- *number = 1;
+ *number = index + 1;
  return USER_SERVICE_OK;
 }
 
@@ -156,7 +260,7 @@ static int MarkInitialized() {
  if (initialized.exchange(true)) {
   return USER_SERVICE_ERROR_ALREADY_INITIALIZED;
  }
- loginReported.store(false);
+ PopulateInitialLoginEvents();
  return USER_SERVICE_OK;
 }
 
@@ -180,6 +284,8 @@ int APS5_VABI sceUserServiceTerminate(void) {
  if (!initialized.exchange(false)) {
   return USER_SERVICE_ERROR_NOT_INITIALIZED;
  }
+ std::lock_guard lock(userMutex);
+ eventQueue.clear();
  return USER_SERVICE_OK;
 }
 
@@ -203,23 +309,41 @@ int APS5_VABI sceUserServiceGetRegisteredUserIdList(UserServiceRegisteredUserIdL
  if (user_id_list == nullptr) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- user_id_list->user_id[0] = USER_SERVICE_INITIAL_USER_ID;
- for (int i = 1; i < 16; ++i) {
-  user_id_list->user_id[i] = USER_SERVICE_USER_ID_INVALID;
+ std::lock_guard lock(userMutex);
+ for (int i = 0; i < 16; ++i) {
+  if (i < USER_SERVICE_MAX_USERS && userConnected[i]) {
+   user_id_list->user_id[i] = USER_SERVICE_INITIAL_USER_ID + i;
+  } else {
+   user_id_list->user_id[i] = USER_SERVICE_USER_ID_INVALID;
+  }
  }
  return USER_SERVICE_OK;
 }
 
 int APS5_VABI sceUserServiceGetUserColor(int user_id, int* color) {
- if (color == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (color == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
- *color = 0;
+ *color = index;
  return USER_SERVICE_OK;
 }
 
+int APS5_VABI sceUserServiceGetKeyboardType(int user_id, int32_t* type) {
+ return ReportKeyboardSetting(user_id, type, KeyboardTypeForSystemLanguage);
+}
+
+int APS5_VABI sceUserServiceGetJapaneseInputType(int user_id, int32_t* type) {
+ return ReportKeyboardSetting(user_id, type, NoInputVariant);
+}
+
+int APS5_VABI sceUserServiceGetTraditionalChineseInputType(int user_id, int32_t* type) {
+ return ReportKeyboardSetting(user_id, type, NoInputVariant);
+}
+
 int APS5_VABI sceUserServiceGetNpAccountId(int user_id, uint64_t* account_id) {
- if (account_id == nullptr || user_id != USER_SERVICE_INITIAL_USER_ID) {
+ const int index = UserIndex(user_id);
+ if (account_id == nullptr || index < 0) {
   return USER_SERVICE_ERROR_INVALID_ARGUMENT;
  }
  *account_id = 0;
diff --git a/core/libs/prx/libSceUserService/UserService.hpp b/core/libs/prx/libSceUserService/UserService.hpp
index eeb192f8aa..3169ed503c 100644
--- a/core/libs/prx/libSceUserService/UserService.hpp
+++ b/core/libs/prx/libSceUserService/UserService.hpp
@@ -3,6 +3,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include "SceTypes.hpp"
 
 struct UserServiceInitParam {
  std::int32_t priority;
@@ -24,5 +25,42 @@ constexpr int USER_SERVICE_ERROR_BUFFER_TOO_SHORT = -2137653238;
 constexpr int USER_SERVICE_ERROR_UNKNOWN_USER = static_cast<int>(0x80960105u);
 constexpr std::size_t USER_SERVICE_MAX_USER_NAME_LENGTH = 16;
 constexpr const char* USER_SERVICE_INITIAL_USER_NAME = "Player";
+constexpr int USER_SERVICE_MAX_USERS = 4;
+constexpr const char* USER_SERVICE_USER_NAMES[USER_SERVICE_MAX_USERS] = {
+    "Player", "Player2", "Player3", "Player4"
+};
+
+extern "C" void UserServiceSetUserConnected_nid_postfix(int userIndex, bool connected);
+
+extern "C" {
+
+int APS5_VABI sceUserServiceGetAccessibilityChatTranscription(int userId, int32_t* chatTranscription);
+int APS5_VABI sceUserServiceGetAccessibilityKeyremapEnable(std::int32_t userId, std::int32_t* enabled);
+int APS5_VABI sceUserServiceGetAccessibilityPressAndHoldDelay(int userId, int32_t* pressAndHoldDelay);
+int APS5_VABI sceUserServiceGetAccessibilityTriggerEffect(int userId, int32_t* triggerEffect);
+int APS5_VABI sceUserServiceGetAccessibilityVibration(int userId, int32_t* vibration);
+int APS5_VABI sceUserServiceGetAccessibilityZoom(std::int32_t userId, std::int32_t* zoom);
+int APS5_VABI sceUserServiceGetAccessibilityZoomEnabled(int userId, int32_t* zoomEnabled);
+int APS5_VABI sceUserServiceGetAccessibilityZoomFollowFocus(int userId, int32_t* zoomFollowFocus);
+int APS5_VABI sceUserServiceGetAgeLevel(int userId, uint32_t* ageLevel);
+int APS5_VABI sceUserServiceGetEvent(SceUserServiceEvent* event);
+int APS5_VABI sceUserServiceGetGamePresets(int userId, UserServiceGamePresets* presets);
+int APS5_VABI sceUserServiceGetInitialUser(int* userId);
+int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* userIdList);
+int APS5_VABI sceUserServiceGetUserName(int userId, char* name, size_t size);
+int APS5_VABI sceUserServiceGetUserNumber(int userId, int32_t* number);
+int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* params);
+int APS5_VABI sceUserServiceInitialize2(std::int32_t priority, KernelCpumask affinityMask);
+int APS5_VABI sceUserServiceTerminate(void);
+int APS5_VABI sceUserServiceGetPlatformPrivacyWs1(int32_t userId, int32_t* value);
+int APS5_VABI sceUserServiceGetForegroundUser(int* userId);
+int APS5_VABI sceUserServiceGetRegisteredUserIdList(UserServiceRegisteredUserIdList* userIdList);
+int APS5_VABI sceUserServiceGetUserColor(int userId, int* color);
+int APS5_VABI sceUserServiceGetKeyboardType(int userId, int32_t* type);
+int APS5_VABI sceUserServiceGetJapaneseInputType(int userId, int32_t* type);
+int APS5_VABI sceUserServiceGetTraditionalChineseInputType(int userId, int32_t* type);
+int APS5_VABI sceUserServiceGetNpAccountId(int userId, uint64_t* accountId);
+
+}
 
 #endif
diff --git a/core/libs/prx/libSceUserService/libSceUserService.hpp b/core/libs/prx/libSceUserService/libSceUserService.hpp
new file mode 100644
index 0000000000..32a9d2d7ae
--- /dev/null
+++ b/core/libs/prx/libSceUserService/libSceUserService.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceUserService/UserService.hpp"
diff --git a/core/libs/prx/libSceVcodec/libSceVcodec.hpp b/core/libs/prx/libSceVcodec/libSceVcodec.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVcodec/libSceVcodec.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecCore.native/Export.cpp b/core/libs/prx/libSceVdecCore.native/Export.cpp
index f619cb820b..3ee8802672 100644
--- a/core/libs/prx/libSceVdecCore.native/Export.cpp
+++ b/core/libs/prx/libSceVdecCore.native/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecCore.native/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecCore.native/include/Api.hpp b/core/libs/prx/libSceVdecCore.native/include/Api.hpp
new file mode 100644
index 0000000000..e7166aa853
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore.native/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVdecCoreCreateDecoderBid();
+int APS5_VABI sceVdecCoreCreateDecoderSvp();
+int APS5_VABI sceVdecCoreMapMemory();
+int APS5_VABI sceVdecCoreSetDecodeInputSvp();
+
+}
diff --git a/core/libs/prx/libSceVdecCore.native/libSceVdecCore.native.hpp b/core/libs/prx/libSceVdecCore.native/libSceVdecCore.native.hpp
new file mode 100644
index 0000000000..ad02da52c4
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore.native/libSceVdecCore.native.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecCore.native/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecCore/Export.cpp b/core/libs/prx/libSceVdecCore/Export.cpp
index fb34206c21..0c25b209ec 100644
--- a/core/libs/prx/libSceVdecCore/Export.cpp
+++ b/core/libs/prx/libSceVdecCore/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecCore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,6 +6,104 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceVdecCoreAnalyzeStream() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreCreateDecoder() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreDeleteDecoder() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreFinalizeComputeResource() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreFlushDecodeOutput() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreGetDecodeOutput() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreInitializeComputeResource() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreMapMemoryBlock() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreQueryComputeResourceInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreQueryFrameBufferInfo() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreQueryInstanceSize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreResetDecoder() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreSetDecodeInput() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreSetDecodeOutputSw() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreSyncDecode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreSyncDecodeOutputSw() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreSyncDecodeWptr() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreTrySyncDecode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreTrySyncDecodeOutputSw() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVdecCoreTrySyncDecodeWptr() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 
 }
diff --git a/core/libs/prx/libSceVdecCore/include/Api.hpp b/core/libs/prx/libSceVdecCore/include/Api.hpp
new file mode 100644
index 0000000000..9b1aaeed6c
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore/include/Api.hpp
@@ -0,0 +1,28 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVdecCoreAnalyzeStream();
+int APS5_VABI sceVdecCoreCreateDecoder();
+int APS5_VABI sceVdecCoreDeleteDecoder();
+int APS5_VABI sceVdecCoreFinalizeComputeResource();
+int APS5_VABI sceVdecCoreFlushDecodeOutput();
+int APS5_VABI sceVdecCoreGetDecodeOutput();
+int APS5_VABI sceVdecCoreInitializeComputeResource();
+int APS5_VABI sceVdecCoreMapMemoryBlock();
+int APS5_VABI sceVdecCoreQueryComputeResourceInfo();
+int APS5_VABI sceVdecCoreQueryFrameBufferInfo();
+int APS5_VABI sceVdecCoreQueryInstanceSize();
+int APS5_VABI sceVdecCoreResetDecoder();
+int APS5_VABI sceVdecCoreSetDecodeInput();
+int APS5_VABI sceVdecCoreSetDecodeOutputSw();
+int APS5_VABI sceVdecCoreSyncDecode();
+int APS5_VABI sceVdecCoreSyncDecodeOutputSw();
+int APS5_VABI sceVdecCoreSyncDecodeWptr();
+int APS5_VABI sceVdecCoreTrySyncDecode();
+int APS5_VABI sceVdecCoreTrySyncDecodeOutputSw();
+int APS5_VABI sceVdecCoreTrySyncDecodeWptr();
+
+}
diff --git a/core/libs/prx/libSceVdecCore/libSceVdecCore.hpp b/core/libs/prx/libSceVdecCore/libSceVdecCore.hpp
new file mode 100644
index 0000000000..347e124988
--- /dev/null
+++ b/core/libs/prx/libSceVdecCore/libSceVdecCore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecCore/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecSavc/Export.cpp b/core/libs/prx/libSceVdecSavc/Export.cpp
index c30e4f9c37..72330582cd 100644
--- a/core/libs/prx/libSceVdecSavc/Export.cpp
+++ b/core/libs/prx/libSceVdecSavc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecSavc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecSavc/include/Api.hpp b/core/libs/prx/libSceVdecSavc/include/Api.hpp
new file mode 100644
index 0000000000..cd352d8c30
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdecCreateSw();
+int APS5_VABI sceSdecDestroySw();
+int APS5_VABI sceSdecGetVersionSw();
+int APS5_VABI sceSdecQueryMemorySw();
+
+}
diff --git a/core/libs/prx/libSceVdecSavc/libSceVdecSavc.hpp b/core/libs/prx/libSceVdecSavc/libSceVdecSavc.hpp
new file mode 100644
index 0000000000..658d88c565
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc/libSceVdecSavc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecSavc/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecSavc2.native/libSceVdecSavc2.native.hpp b/core/libs/prx/libSceVdecSavc2.native/libSceVdecSavc2.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc2.native/libSceVdecSavc2.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecSavc2/Export.cpp b/core/libs/prx/libSceVdecSavc2/Export.cpp
index 6f217fc959..6ca11f6ef7 100644
--- a/core/libs/prx/libSceVdecSavc2/Export.cpp
+++ b/core/libs/prx/libSceVdecSavc2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecSavc2/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecSavc2/include/Api.hpp b/core/libs/prx/libSceVdecSavc2/include/Api.hpp
new file mode 100644
index 0000000000..985cdcd141
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc2/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdecCreateSw2();
+int APS5_VABI sceSdecDestroySw2();
+int APS5_VABI sceSdecGetVersionSw2();
+int APS5_VABI sceSdecQueryMemorySw2();
+
+}
diff --git a/core/libs/prx/libSceVdecSavc2/libSceVdecSavc2.hpp b/core/libs/prx/libSceVdecSavc2/libSceVdecSavc2.hpp
new file mode 100644
index 0000000000..10fff4393c
--- /dev/null
+++ b/core/libs/prx/libSceVdecSavc2/libSceVdecSavc2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecSavc2/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecShevc.native/libSceVdecShevc.native.hpp b/core/libs/prx/libSceVdecShevc.native/libSceVdecShevc.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVdecShevc.native/libSceVdecShevc.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecShevc/Export.cpp b/core/libs/prx/libSceVdecShevc/Export.cpp
index 8f63aa61a9..43e4936066 100644
--- a/core/libs/prx/libSceVdecShevc/Export.cpp
+++ b/core/libs/prx/libSceVdecShevc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecShevc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecShevc/include/Api.hpp b/core/libs/prx/libSceVdecShevc/include/Api.hpp
new file mode 100644
index 0000000000..f6685c6a64
--- /dev/null
+++ b/core/libs/prx/libSceVdecShevc/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceSdecCreateSwHevc();
+int APS5_VABI sceSdecDestroySwHevc();
+int APS5_VABI sceSdecExecuteSwHevc();
+int APS5_VABI sceSdecGetFrameSwHevc();
+int APS5_VABI sceSdecGetVersionSwHevc();
+int APS5_VABI sceSdecQueryMemorySwHevc();
+int APS5_VABI sceSdecResetSwHevc();
+
+}
diff --git a/core/libs/prx/libSceVdecShevc/libSceVdecShevc.hpp b/core/libs/prx/libSceVdecShevc/libSceVdecShevc.hpp
new file mode 100644
index 0000000000..e6f868789a
--- /dev/null
+++ b/core/libs/prx/libSceVdecShevc/libSceVdecShevc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecShevc/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecSvp9.native/libSceVdecSvp9.native.hpp b/core/libs/prx/libSceVdecSvp9.native/libSceVdecSvp9.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVdecSvp9.native/libSceVdecSvp9.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVdecsw/Export.cpp b/core/libs/prx/libSceVdecsw/Export.cpp
index 4c70113346..b39ea9bc46 100644
--- a/core/libs/prx/libSceVdecsw/Export.cpp
+++ b/core/libs/prx/libSceVdecsw/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#include "prx/libSceVdecsw/include/Api.hpp"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
@@ -8,136 +10,28 @@
 #include <mutex>
 #include <stdexcept>
 #include <thread>
+#include <variant>
 #include <vector>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
 namespace {
 
+using namespace SceVdecsw;
+
 constexpr int VdecswErrorOutputPending = static_cast<int>(0x81510115u);
 constexpr int VdecswErrorInputQueueEmpty = static_cast<int>(0x81510116u);
 constexpr int VdecswErrorDecodePending = static_cast<int>(0x81510117u);
 constexpr std::uint32_t CodecVp9 = 2382845;
 constexpr std::size_t MaxQueuedPictures = 4;
+constexpr std::uint32_t CodecAvc = 1;
+constexpr std::uint32_t CodecHevc = 974921;
 
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct InputResult {
-    std::uint64_t thisSize;
-    const void* decodedAu;
-    std::uint32_t outputFrameCount;
-    std::uint32_t reserved;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isLastFrame;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    bool isDiscardedFrame;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInMbsMinus1;
-    std::uint32_t picHeightInMapUnitsMinus1;
-    std::uint8_t frameMbsOnlyFlag;
-    std::uint8_t frameCroppingFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-    std::uint8_t vui[44];
-};
-
-static_assert(sizeof(InputData) == 0x30 && sizeof(InputResult) == 0x18 && sizeof(FrameBuffer) == 0x18);
-static_assert(sizeof(Vp9PictureInfo) == 0x58 && offsetof(Vp9PictureInfo, ptsData) == 0x10 && offsetof(Vp9PictureInfo, profile) == 0x28 && offsetof(Vp9PictureInfo, bitDepth) == 0x38 && offsetof(Vp9PictureInfo, colorSpace) == 0x3c && offsetof(Vp9PictureInfo, renderHeight) == 0x50);
+static_assert(sizeof(SceVideodec2::InputData) == 0x30 && sizeof(InputResult) == 0x18 && sizeof(FrameBuffer) == 0x18);
+static_assert(sizeof(SceVideodec2::Vp9PictureInfo) == 0x58 && offsetof(SceVideodec2::Vp9PictureInfo, ptsData) == 0x10 && offsetof(SceVideodec2::Vp9PictureInfo, profile) == 0x28 && offsetof(SceVideodec2::Vp9PictureInfo, bitDepth) == 0x38 && offsetof(SceVideodec2::Vp9PictureInfo, colorSpace) == 0x3c && offsetof(SceVideodec2::Vp9PictureInfo, renderHeight) == 0x50);
 static_assert(sizeof(OutputInfo) == 0x38 && offsetof(OutputInfo, isLastFrame) == 9 && offsetof(OutputInfo, pictureCount) == 0xb && offsetof(OutputInfo, isDiscardedFrame) == 0x1c);
 static_assert(sizeof(AvcPictureInfo) == 0x78 && offsetof(AvcPictureInfo, picWidthInMbsMinus1) == 0x2c && offsetof(AvcPictureInfo, frameCropBottomOffset) == 0x44);
-
-struct Videodec2FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct Videodec2OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Videodec2AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
+static_assert(sizeof(HevcPictureInfo) == 0xb8 && offsetof(HevcPictureInfo, picWidthInLumaSamples) == 0x28 && offsetof(HevcPictureInfo, sarWidth) == 0x42 && offsetof(HevcPictureInfo, picStruct) == 0x50 && offsetof(HevcPictureInfo, conformanceWindowFlag) == 0x5c && offsetof(HevcPictureInfo, idrPictureFlag) == 0x93 && offsetof(HevcPictureInfo, generalProfileIdc) == 0x97 && offsetof(HevcPictureInfo, generalLevelIdc) == 0x9b && offsetof(HevcPictureInfo, frameCroppingFlag) == 0xa5 && offsetof(HevcPictureInfo, frameCropBottomOffset) == 0xb4);
 
 struct Videodec2Crop {
     std::uint32_t left;
@@ -146,39 +40,29 @@ struct Videodec2Crop {
     std::uint32_t bottom;
 };
 
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
+struct Videodec2PictureHeader {
+    std::uint64_t pts;
+    std::uint64_t dts;
+    std::uint64_t attached;
+    bool keyFrame;
+    bool hevcIdr;
+    std::uint32_t profile;
+    std::uint32_t level;
+    Videodec2Crop crop;
+    std::uint8_t bitDepthMinus8;
 };
 
 }
 
 extern "C" {
-int APS5_VABI sceVideodec2QueryComputeMemoryInfo_nid_postfix(void* info);
-int APS5_VABI sceVideodec2AllocateComputeQueue_nid_postfix(const void* config, const void* memory, std::uint64_t* queue);
-int APS5_VABI sceVideodec2ReleaseComputeQueue_nid_postfix(std::uint64_t queue);
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const void* config, void* memory);
-int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const void* config, const void* memory, std::uint64_t* handle);
-int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t handle);
-int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t handle, const InputData* input, Videodec2FrameBuffer* frame, Videodec2OutputInfo* output);
-int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t handle, Videodec2FrameBuffer* frame, Videodec2OutputInfo* output);
-int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const Videodec2OutputInfo* output, Vp9PictureInfo* info);
-int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t handle);
-int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const Videodec2OutputInfo* output, Videodec2AvcPictureInfo* first, Videodec2AvcPictureInfo* second);
-void Videodec2PictureCrop_nid_no_patch(std::uint64_t handle, const void* frameBuffer, Videodec2Crop* crop);
+
+void Videodec2PictureHeader_nid_no_patch(std::uint64_t handle, const void* frameBuffer, Videodec2PictureHeader* header);
 }
 
 namespace {
 
 struct PendingInput {
-    InputData input;
+    SceVideodec2::InputData input;
     std::vector<std::uint8_t> data;
 };
 
@@ -187,10 +71,12 @@ struct ConsumedInput {
     std::uint32_t frames;
 };
 
+using PictureInfo = std::variant<AvcPictureInfo, HevcPictureInfo>;
+
 struct Picture {
     std::vector<std::uint8_t> pixels;
-    Videodec2OutputInfo output;
-    AvcPictureInfo info;
+    SceVideodec2::OutputInfo output;
+    PictureInfo info;
 };
 
 struct Decoder {
@@ -200,10 +86,10 @@ struct Decoder {
     std::deque<ConsumedInput> consumed;
     std::deque<FrameBuffer> outputs;
     std::deque<Picture> pictures;
-    std::map<const void*, AvcPictureInfo> delivered;
+    std::map<const void*, PictureInfo> delivered;
     bool finalized = false;
     bool drained = false;
-    std::map<const void*, Vp9PictureInfo> deliveredVp9;
+    std::map<const void*, SceVideodec2::Vp9PictureInfo> deliveredVp9;
 };
 
 std::mutex decodersMutex;
@@ -216,27 +102,54 @@ std::shared_ptr<Decoder> findDecoder(std::uint64_t handle) {
     return found->second;
 }
 
-AvcPictureInfo pictureInfo(std::uint64_t handle, const Videodec2OutputInfo& output) {
-    Videodec2AvcPictureInfo source{sizeof(Videodec2AvcPictureInfo)};
-    sceVideodec2GetAvcPictureInfo_nid_postfix(&output, &source, nullptr);
-    if (!source.isValid) throw std::runtime_error("Vdecsw: decoded picture has no picture info");
-    Videodec2Crop crop{};
-    Videodec2PictureCrop_nid_no_patch(handle, output.frameBuffer, &crop);
+PictureInfo pictureInfo(std::uint64_t handle, const SceVideodec2::OutputInfo& output) {
+    Videodec2PictureHeader header{};
+    Videodec2PictureHeader_nid_no_patch(handle, output.frameBuffer, &header);
+    const auto& crop = header.crop;
+    const bool cropped = crop.left != 0 || crop.right != 0 || crop.top != 0 || crop.bottom != 0;
+    if (output.codecType == CodecHevc) {
+        HevcPictureInfo info{};
+        info.thisSize = sizeof(HevcPictureInfo);
+        info.isValid = true;
+        info.ptsData = header.pts;
+        info.dtsData = header.dts;
+        info.attachedData = header.attached;
+        info.picWidthInLumaSamples = output.frameWidth;
+        info.picHeightInLumaSamples = output.frameHeight;
+        info.bitDepthLumaMinus8 = header.bitDepthMinus8;
+        info.bitDepthChromaMinus8 = header.bitDepthMinus8;
+        info.conformanceWindowFlag = cropped;
+        info.confWinLeftOffset = crop.left / 2u;
+        info.confWinRightOffset = crop.right / 2u;
+        info.confWinTopOffset = crop.top / 2u;
+        info.confWinBottomOffset = crop.bottom / 2u;
+        info.idrPictureFlag = header.hevcIdr;
+        info.irapPictureFlag = header.keyFrame;
+        info.generalProfileIdc = static_cast<std::uint8_t>(header.profile);
+        info.generalLevelIdc = static_cast<std::uint8_t>(header.level);
+        info.frameCroppingFlag = cropped;
+        info.frameCropLeftOffset = info.confWinLeftOffset;
+        info.frameCropRightOffset = info.confWinRightOffset;
+        info.frameCropTopOffset = info.confWinTopOffset;
+        info.frameCropBottomOffset = info.confWinBottomOffset;
+        return info;
+    }
+    if (output.codecType != CodecAvc) throw std::runtime_error("Vdecsw: picture info is only implemented for H.264 and HEVC");
     const auto widthInMbs = (output.frameWidth + 15u) / 16u;
     const auto heightInMbs = (output.frameHeight + 15u) / 16u;
     AvcPictureInfo info{};
     info.thisSize = sizeof(AvcPictureInfo);
     info.isValid = true;
-    info.ptsData = source.ptsData;
-    info.dtsData = source.dtsData;
-    info.attachedData = source.attachedData;
-    info.idrPictureFlag = source.idrPictureFlag;
-    info.profileIdc = source.profileIdc;
-    info.levelIdc = source.levelIdc;
+    info.ptsData = header.pts;
+    info.dtsData = header.dts;
+    info.attachedData = header.attached;
+    info.idrPictureFlag = header.keyFrame;
+    info.profileIdc = static_cast<std::uint8_t>(header.profile);
+    info.levelIdc = static_cast<std::uint8_t>(header.level);
     info.picWidthInMbsMinus1 = widthInMbs - 1u;
     info.picHeightInMapUnitsMinus1 = heightInMbs - 1u;
     info.frameMbsOnlyFlag = 1;
-    info.frameCroppingFlag = crop.left != 0 || crop.right != 0 || crop.top != 0 || crop.bottom != 0;
+    info.frameCroppingFlag = cropped;
     info.frameCropLeftOffset = crop.left / 2u;
     info.frameCropRightOffset = crop.right / 2u;
     info.frameCropTopOffset = crop.top / 2u;
@@ -244,33 +157,59 @@ AvcPictureInfo pictureInfo(std::uint64_t handle, const Videodec2OutputInfo& outp
     return info;
 }
 
-Vp9PictureInfo vp9PictureInfo(const Videodec2OutputInfo& output) {
-    Vp9PictureInfo info{sizeof(Vp9PictureInfo)};
+SceVideodec2::Vp9PictureInfo vp9PictureInfo(const SceVideodec2::OutputInfo& output) {
+    SceVideodec2::Vp9PictureInfo info{sizeof(SceVideodec2::Vp9PictureInfo)};
     sceVideodec2GetVp9PictureInfo_nid_postfix(&output, &info);
+
     if (!info.isValid) throw std::runtime_error("Vdecsw: decoded picture has no VP9 picture info");
     return info;
 }
 
+template <typename TInfo>
+int deliveredPictureInfo(const OutputInfo* output, TInfo* info) {
+    if (output == nullptr || info == nullptr || info->thisSize < sizeof(std::uint64_t)) throw std::runtime_error("Vdecsw: invalid argument pointer");
+    if (output->pictureCount > 1) throw std::runtime_error("Vdecsw: second field picture info is not implemented");
+    if (output->pictureCount == 0) return 0;
+    std::vector<std::shared_ptr<Decoder>> all;
+    {
+        std::lock_guard lock(decodersMutex);
+        for (const auto& [handle, decoder] : decoders) all.push_back(decoder);
+    }
+    for (const auto& decoder : all) {
+        std::lock_guard lock(decoder->mutex);
+        const auto found = decoder->delivered.find(output->frameBuffer);
+        if (found == decoder->delivered.end()) continue;
+        const auto* source = std::get_if<TInfo>(&found->second);
+        if (source == nullptr) throw std::runtime_error("Vdecsw: picture info requested for another codec");
+        const auto bytes = std::min<std::uint64_t>(info->thisSize, sizeof(TInfo)) - sizeof(std::uint64_t);
+        std::memcpy(reinterpret_cast<std::uint8_t*>(info) + sizeof(std::uint64_t), reinterpret_cast<const std::uint8_t*>(source) + sizeof(std::uint64_t), bytes);
+        return 0;
+    }
+    throw std::runtime_error("Vdecsw: picture info requested for a frame buffer no decoder returned");
+}
+
 void advance(std::uint64_t handle, Decoder& decoder) {
     while (decoder.pictures.size() < MaxQueuedPictures) {
         std::vector<std::uint8_t> pixels(decoder.frameBytes);
-        Videodec2FrameBuffer frame{sizeof(Videodec2FrameBuffer), pixels.data(), pixels.size(), false};
-        Videodec2OutputInfo output{sizeof(Videodec2OutputInfo)};
+        SceVideodec2::FrameBuffer frame{sizeof(SceVideodec2::FrameBuffer), pixels.data(), pixels.size(), false};
+        SceVideodec2::OutputInfo output{sizeof(SceVideodec2::OutputInfo)};
         if (!decoder.inputs.empty()) {
             const auto* au = static_cast<const void*>(decoder.inputs.front().input.auData);
             auto input = decoder.inputs.front().input;
             input.auData = decoder.inputs.front().data.data();
             sceVideodec2Decode_nid_postfix(handle, &input, &frame, &output);
+
             decoder.inputs.pop_front();
             decoder.consumed.push_back({au, output.isValid ? 1u : 0u});
         } else if (decoder.finalized && !decoder.drained) {
             sceVideodec2Flush_nid_postfix(handle, &frame, &output);
+
             decoder.drained = !output.isValid;
         } else {
             return;
         }
         if (output.isValid) {
-            const auto info = output.codecType == CodecVp9 ? AvcPictureInfo{} : pictureInfo(handle, output);
+            const auto info = output.codecType == CodecVp9 ? PictureInfo{} : pictureInfo(handle, output);
             decoder.pictures.push_back({std::move(pixels), output, info});
         }
     }
@@ -280,11 +219,11 @@ void advance(std::uint64_t handle, Decoder& decoder) {
 
 extern "C" {
 
-int APS5_VABI sceVdecswQueryComputeMemoryInfo(void* info) {
+int APS5_VABI sceVdecswQueryComputeMemoryInfo(SceVideodec2::ComputeMemoryInfo* info) {
     return sceVideodec2QueryComputeMemoryInfo_nid_postfix(info);
 }
 
-int APS5_VABI sceVdecswAllocateComputeQueue(const void* config, const void* memory, std::uint64_t* queue) {
+int APS5_VABI sceVdecswAllocateComputeQueue(const SceVideodec2::ComputeConfigInfo* config, const SceVideodec2::ComputeMemoryInfo* memory, std::uint64_t* queue) {
     return sceVideodec2AllocateComputeQueue_nid_postfix(config, memory, queue);
 }
 
@@ -292,13 +231,13 @@ int APS5_VABI sceVdecswReleaseComputeQueue(std::uint64_t queue) {
     return sceVideodec2ReleaseComputeQueue_nid_postfix(queue);
 }
 
-int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const void* config, void* memory) {
-    return sceVideodec2QueryDecoderMemoryInfo_nid_postfix(config, memory);
+int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const void* config, SceVideodec2::DecoderMemoryInfo* memory) {
+    return sceVideodec2QueryDecoderMemoryInfo_nid_postfix(static_cast<const SceVideodec2::DecoderConfigInfo*>(config), memory);
 }
 
-int APS5_VABI sceVdecswCreateDecoder(const void* config, const DecoderMemoryInfo* memory, std::uint64_t* handle) {
-    if (handle == nullptr || memory == nullptr || memory->thisSize < sizeof(DecoderMemoryInfo) || memory->maxFrameBufferSize == 0) throw std::runtime_error("Vdecsw: invalid decoder creation arguments");
-    const auto result = sceVideodec2CreateDecoder_nid_postfix(config, memory, handle);
+int APS5_VABI sceVdecswCreateDecoder(const void* config, const SceVideodec2::DecoderMemoryInfo* memory, std::uint64_t* handle) {
+    if (handle == nullptr || memory == nullptr || memory->thisSize < sizeof(SceVideodec2::DecoderMemoryInfo) || memory->maxFrameBufferSize == 0) throw std::runtime_error("Vdecsw: invalid decoder creation arguments");
+    const auto result = sceVideodec2CreateDecoder_nid_postfix(static_cast<const SceVideodec2::DecoderConfigInfo*>(config), memory, handle);
     if (result != 0) return result;
     auto decoder = std::make_shared<Decoder>();
     decoder->frameBytes = memory->maxFrameBufferSize;
@@ -315,8 +254,8 @@ int APS5_VABI sceVdecswDeleteDecoder(std::uint64_t handle) {
     return sceVideodec2DeleteDecoder_nid_postfix(handle);
 }
 
-int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t handle, const InputData* input) {
-    if (input == nullptr || input->thisSize < sizeof(InputData)) throw std::runtime_error("Vdecsw: invalid decode input");
+int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t handle, const SceVideodec2::InputData* input) {
+    if (input == nullptr || input->thisSize < sizeof(SceVideodec2::InputData)) throw std::runtime_error("Vdecsw: invalid decode input");
     const auto decoder = findDecoder(handle);
     std::lock_guard lock(decoder->mutex);
     if (decoder->finalized) throw std::runtime_error("Vdecsw: decode input after the sequence was finalized");
@@ -414,34 +353,15 @@ int APS5_VABI sceVdecswGetPictureInfo(const OutputInfo* output, void* first, voi
 }
 
 int APS5_VABI sceVdecswGetAvcPictureInfo(const OutputInfo* output, AvcPictureInfo* first, AvcPictureInfo* second) {
-    if (output == nullptr || first == nullptr || first->thisSize < sizeof(std::uint64_t)) throw std::runtime_error("Vdecsw: invalid argument pointer");
-    if (output->pictureCount > 1) throw std::runtime_error("Vdecsw: second field picture info is not implemented");
-    if (output->pictureCount == 0) return 0;
     static_cast<void>(second);
-    std::vector<std::shared_ptr<Decoder>> all;
-    {
-        std::lock_guard lock(decodersMutex);
-        for (const auto& [handle, decoder] : decoders) all.push_back(decoder);
-    }
-    for (const auto& decoder : all) {
-        std::lock_guard lock(decoder->mutex);
-        const auto found = decoder->delivered.find(output->frameBuffer);
-        if (found == decoder->delivered.end()) continue;
-        const auto bytes = std::min<std::uint64_t>(first->thisSize, sizeof(AvcPictureInfo)) - sizeof(std::uint64_t);
-        std::memcpy(reinterpret_cast<std::uint8_t*>(first) + sizeof(std::uint64_t), reinterpret_cast<const std::uint8_t*>(&found->second) + sizeof(std::uint64_t), bytes);
-        return 0;
-    }
-    throw std::runtime_error("Vdecsw: picture info requested for a frame buffer no decoder returned");
+    return deliveredPictureInfo(output, first);
 }
 
-int APS5_VABI sceVdecswGetHevcPictureInfo(const OutputInfo* output, void* picture) {
-    (void)output;
-    (void)picture;
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVdecswGetHevcPictureInfo(const OutputInfo* output, HevcPictureInfo* picture) {
+    return deliveredPictureInfo(output, picture);
 }
 
-int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo* output, Vp9PictureInfo* picture) {
+int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo* output, SceVideodec2::Vp9PictureInfo* picture) {
     if (output == nullptr || picture == nullptr || picture->thisSize < sizeof(std::uint64_t)) throw std::runtime_error("Vdecsw: invalid argument pointer");
     if (output->pictureCount > 1) throw std::runtime_error("Vdecsw: more than one VP9 picture info is not implemented");
     if (output->pictureCount == 0) return 0;
@@ -454,7 +374,7 @@ int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo* output, Vp9PictureInf
         std::lock_guard lock(decoder->mutex);
         const auto found = decoder->deliveredVp9.find(output->frameBuffer);
         if (found == decoder->deliveredVp9.end()) continue;
-        const auto bytes = std::min<std::uint64_t>(picture->thisSize, sizeof(Vp9PictureInfo)) - sizeof(std::uint64_t);
+        const auto bytes = std::min<std::uint64_t>(picture->thisSize, sizeof(SceVideodec2::Vp9PictureInfo)) - sizeof(std::uint64_t);
         std::memcpy(reinterpret_cast<std::uint8_t*>(picture) + sizeof(std::uint64_t), reinterpret_cast<const std::uint8_t*>(&found->second) + sizeof(std::uint64_t), bytes);
         return 0;
     }
diff --git a/core/libs/prx/libSceVdecsw/include/Api.hpp b/core/libs/prx/libSceVdecsw/include/Api.hpp
new file mode 100644
index 0000000000..7b5fdf595a
--- /dev/null
+++ b/core/libs/prx/libSceVdecsw/include/Api.hpp
@@ -0,0 +1,162 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#pragma once
+
+#include "SceTypes.hpp"
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <deque>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <stdexcept>
+#include <thread>
+#include <variant>
+#include <vector>
+
+namespace SceVdecsw {
+
+struct DecoderConfigInfo {
+    SceVideodec2::DecoderConfigInfo decoder;
+    std::uint64_t computeQueue;
+    std::uint64_t cpuAffinityMask;
+    std::int32_t cpuThreadPriority;
+    bool optimizeProgressiveVideo;
+    std::uint8_t reserved[19];
+};
+
+struct InputResult {
+    std::uint64_t thisSize;
+    const void* decodedAu;
+    std::uint32_t outputFrameCount;
+    std::uint32_t reserved;
+};
+
+}
+
+namespace SceVdecsw {
+
+struct FrameBuffer {
+    std::uint64_t thisSize;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+};
+
+}
+
+namespace SceVdecsw {
+
+struct OutputInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    bool isLastFrame;
+    bool isErrorFrame;
+    std::uint8_t pictureCount;
+    std::uint32_t codecType;
+    std::uint32_t frameWidth;
+    std::uint32_t framePitch;
+    std::uint32_t frameHeight;
+    bool isDiscardedFrame;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+    std::uint32_t frameFormat;
+    std::uint32_t framePitchInBytes;
+};
+
+}
+
+namespace SceVdecsw {
+
+struct AvcPictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint8_t idrPictureFlag;
+    std::uint8_t profileIdc;
+    std::uint8_t levelIdc;
+    std::uint32_t picWidthInMbsMinus1;
+    std::uint32_t picHeightInMapUnitsMinus1;
+    std::uint8_t frameMbsOnlyFlag;
+    std::uint8_t frameCroppingFlag;
+    std::uint32_t frameCropLeftOffset;
+    std::uint32_t frameCropRightOffset;
+    std::uint32_t frameCropTopOffset;
+    std::uint32_t frameCropBottomOffset;
+    std::uint8_t vui[44];
+};
+
+}
+
+namespace SceVdecsw {
+
+struct HevcPictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint32_t picWidthInLumaSamples;
+    std::uint32_t picHeightInLumaSamples;
+    std::uint8_t bitDepthLumaMinus8;
+    std::uint8_t bitDepthChromaMinus8;
+    std::uint8_t timingInfoPresentFlag;
+    std::uint32_t numUnitsInTick;
+    std::uint32_t timeScale;
+    std::uint32_t aspectRatioInfoPresentFlag;
+    std::uint8_t aspectRatioIdc;
+    std::uint16_t sarWidth;
+    std::uint16_t sarHeight;
+    std::uint8_t videoSignal[8];
+    std::uint32_t picStruct;
+    std::uint32_t sourceScanType;
+    std::uint32_t duplicateFlag;
+    std::uint32_t conformanceWindowFlag;
+    std::uint32_t confWinLeftOffset;
+    std::uint32_t confWinRightOffset;
+    std::uint32_t confWinTopOffset;
+    std::uint32_t confWinBottomOffset;
+    std::uint32_t defaultDisplayWindow[5];
+    std::uint8_t chromaLocation[4];
+    std::uint8_t presentFlags[11];
+    std::uint8_t idrPictureFlag;
+    std::uint8_t irapPictureFlag;
+    std::uint8_t generalProfileSpace;
+    std::uint8_t generalTierFlag;
+    std::uint8_t generalProfileIdc;
+    std::uint8_t generalSourceFlags[3];
+    std::uint8_t generalLevelIdc;
+    std::uint8_t subLayer[9];
+    std::uint8_t frameCroppingFlag;
+    std::uint32_t frameCropLeftOffset;
+    std::uint32_t frameCropRightOffset;
+    std::uint32_t frameCropTopOffset;
+    std::uint32_t frameCropBottomOffset;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVdecswQueryComputeMemoryInfo(SceVideodec2::ComputeMemoryInfo* info);
+int APS5_VABI sceVdecswAllocateComputeQueue(const SceVideodec2::ComputeConfigInfo* config, const SceVideodec2::ComputeMemoryInfo* memory, std::uint64_t* queue);
+int APS5_VABI sceVdecswReleaseComputeQueue(std::uint64_t queue);
+int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const void* config, SceVideodec2::DecoderMemoryInfo* memory);
+int APS5_VABI sceVdecswCreateDecoder(const void* config, const SceVideodec2::DecoderMemoryInfo* memory, std::uint64_t* handle);
+int APS5_VABI sceVdecswDeleteDecoder(std::uint64_t handle);
+int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t handle, const SceVideodec2::InputData* input);
+int APS5_VABI sceVdecswTrySyncDecodeInput(std::uint64_t handle, SceVdecsw::InputResult* result);
+int APS5_VABI sceVdecswSyncDecodeInput(std::uint64_t handle, SceVdecsw::InputResult* result);
+int APS5_VABI sceVdecswSetDecodeOutput(std::uint64_t handle, const SceVdecsw::FrameBuffer* frame);
+int APS5_VABI sceVdecswTrySyncDecodeOutput(std::uint64_t handle, SceVdecsw::OutputInfo* output);
+int APS5_VABI sceVdecswSyncDecodeOutput(std::uint64_t handle, SceVdecsw::OutputInfo* output);
+int APS5_VABI sceVdecswGetPictureInfo(const SceVdecsw::OutputInfo* output, void* first, void* second);
+int APS5_VABI sceVdecswGetAvcPictureInfo(const SceVdecsw::OutputInfo* output, SceVdecsw::AvcPictureInfo* first, SceVdecsw::AvcPictureInfo* second);
+int APS5_VABI sceVdecswGetHevcPictureInfo(const SceVdecsw::OutputInfo* output, SceVdecsw::HevcPictureInfo* picture);
+int APS5_VABI sceVdecswGetVp9PictureInfo(const SceVdecsw::OutputInfo* output, SceVideodec2::Vp9PictureInfo* picture);
+int APS5_VABI sceVdecswFinalizeDecodeSequence(std::uint64_t handle);
+int APS5_VABI sceVdecswResetDecoder(std::uint64_t handle);
+
+}
diff --git a/core/libs/prx/libSceVdecsw/libSceVdecsw.hpp b/core/libs/prx/libSceVdecsw/libSceVdecsw.hpp
new file mode 100644
index 0000000000..c080ab901a
--- /dev/null
+++ b/core/libs/prx/libSceVdecsw/libSceVdecsw.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecsw/include/Api.hpp"
diff --git a/core/libs/prx/libSceVdecwrap/Export.cpp b/core/libs/prx/libSceVdecwrap/Export.cpp
index ae14644219..923c85002b 100644
--- a/core/libs/prx/libSceVdecwrap/Export.cpp
+++ b/core/libs/prx/libSceVdecwrap/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecwrap/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVdecwrap/include/Api.hpp b/core/libs/prx/libSceVdecwrap/include/Api.hpp
new file mode 100644
index 0000000000..44f275d760
--- /dev/null
+++ b/core/libs/prx/libSceVdecwrap/include/Api.hpp
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVdecwrapCreateDecoder();
+int APS5_VABI sceVdecwrapDeleteDecoder();
+int APS5_VABI sceVdecwrapFlushDecodeOutput();
+int APS5_VABI sceVdecwrapGetDecodeOutput();
+int APS5_VABI sceVdecwrapMapDirectMemory();
+int APS5_VABI sceVdecwrapMapMemory();
+int APS5_VABI sceVdecwrapQueryDecoderMemoryInfo();
+int APS5_VABI sceVdecwrapQueryFrameBufferInfo();
+int APS5_VABI sceVdecwrapResetDecoder();
+int APS5_VABI sceVdecwrapSetDecodeInput();
+int APS5_VABI sceVdecwrapSyncDecode();
+
+}
diff --git a/core/libs/prx/libSceVdecwrap/libSceVdecwrap.hpp b/core/libs/prx/libSceVdecwrap/libSceVdecwrap.hpp
new file mode 100644
index 0000000000..65c7e47394
--- /dev/null
+++ b/core/libs/prx/libSceVdecwrap/libSceVdecwrap.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVdecwrap/include/Api.hpp"
diff --git a/core/libs/prx/libSceVenc/Export.cpp b/core/libs/prx/libSceVenc/Export.cpp
index fb34206c21..c423ca85fb 100644
--- a/core/libs/prx/libSceVenc/Export.cpp
+++ b/core/libs/prx/libSceVenc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVenc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -5,6 +6,74 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+int APS5_VABI sceVencCreateEncoder() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencDeleteEncoder() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencGetConfig() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencMapMemory() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencQueryHeader() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencQueryMemorySize() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencQueryPreset() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencSetConfig() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencSetDecodedFrame() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencSetPictureConfig() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencSetRateControlConfig() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencSetReferenceFrameInvalidationConfig() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencStartEncode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
+
+int APS5_VABI sceVencStopEncode() {
+    NotImplemented_nid_no_patch(__func__);
+    return 0;
+}
 
 }
diff --git a/core/libs/prx/libSceVenc/include/Api.hpp b/core/libs/prx/libSceVenc/include/Api.hpp
new file mode 100644
index 0000000000..26d25b4a07
--- /dev/null
+++ b/core/libs/prx/libSceVenc/include/Api.hpp
@@ -0,0 +1,22 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVencCreateEncoder();
+int APS5_VABI sceVencDeleteEncoder();
+int APS5_VABI sceVencGetConfig();
+int APS5_VABI sceVencMapMemory();
+int APS5_VABI sceVencQueryHeader();
+int APS5_VABI sceVencQueryMemorySize();
+int APS5_VABI sceVencQueryPreset();
+int APS5_VABI sceVencSetConfig();
+int APS5_VABI sceVencSetDecodedFrame();
+int APS5_VABI sceVencSetPictureConfig();
+int APS5_VABI sceVencSetRateControlConfig();
+int APS5_VABI sceVencSetReferenceFrameInvalidationConfig();
+int APS5_VABI sceVencStartEncode();
+int APS5_VABI sceVencStopEncode();
+
+}
diff --git a/core/libs/prx/libSceVenc/libSceVenc.hpp b/core/libs/prx/libSceVenc/libSceVenc.hpp
new file mode 100644
index 0000000000..cae676b0b2
--- /dev/null
+++ b/core/libs/prx/libSceVenc/libSceVenc.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVenc/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoArbitration/Export.cpp b/core/libs/prx/libSceVideoArbitration/Export.cpp
index 2825147db8..23b1eaa853 100644
--- a/core/libs/prx/libSceVideoArbitration/Export.cpp
+++ b/core/libs/prx/libSceVideoArbitration/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoArbitration/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoArbitration/include/Api.hpp b/core/libs/prx/libSceVideoArbitration/include/Api.hpp
new file mode 100644
index 0000000000..126dfd0696
--- /dev/null
+++ b/core/libs/prx/libSceVideoArbitration/include/Api.hpp
@@ -0,0 +1,11 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoArbitrationAcceptEvent();
+int APS5_VABI sceVideoArbitrationEnable();
+int APS5_VABI sceVideoArbitrationInitialize();
+
+}
diff --git a/core/libs/prx/libSceVideoArbitration/libSceVideoArbitration.hpp b/core/libs/prx/libSceVideoArbitration/libSceVideoArbitration.hpp
new file mode 100644
index 0000000000..46377c3aca
--- /dev/null
+++ b/core/libs/prx/libSceVideoArbitration/libSceVideoArbitration.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoArbitration/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoCoreInterface/Export.cpp b/core/libs/prx/libSceVideoCoreInterface/Export.cpp
index 69f5eb3f02..d81f5a18e0 100644
--- a/core/libs/prx/libSceVideoCoreInterface/Export.cpp
+++ b/core/libs/prx/libSceVideoCoreInterface/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoCoreInterface/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -10,7 +11,6 @@ int APS5_VABI sceVideoCoreIfSetFunctionTableUnlimited() {
     return 0;
 }
 
-
 int APS5_VABI sceVideoCoreIfInitializeInterface() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceVideoCoreInterface/include/Api.hpp b/core/libs/prx/libSceVideoCoreInterface/include/Api.hpp
new file mode 100644
index 0000000000..7b01f1539c
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreInterface/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoCoreIfSetFunctionTableUnlimited();
+int APS5_VABI sceVideoCoreIfInitializeInterface();
+int APS5_VABI sceVideoCoreIfMainLoop();
+int APS5_VABI sceVideoCoreIfSetFunctionTable();
+
+}
diff --git a/core/libs/prx/libSceVideoCoreInterface/libSceVideoCoreInterface.hpp b/core/libs/prx/libSceVideoCoreInterface/libSceVideoCoreInterface.hpp
new file mode 100644
index 0000000000..0a1d280f24
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreInterface/libSceVideoCoreInterface.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoCoreInterface/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp b/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp
index 37c16803eb..0c92606c7e 100644
--- a/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp
+++ b/core/libs/prx/libSceVideoCoreServerInterface/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoCoreServerInterface/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoCoreServerInterface/include/Api.hpp b/core/libs/prx/libSceVideoCoreServerInterface/include/Api.hpp
new file mode 100644
index 0000000000..1b44bc62ac
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreServerInterface/include/Api.hpp
@@ -0,0 +1,55 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoCoreAbortRequest();
+int APS5_VABI sceVideoCoreAcquireDecoderResource();
+int APS5_VABI sceVideoCoreAcquireDecoderResourceForBeWrapper();
+int APS5_VABI sceVideoCoreAddStream();
+int APS5_VABI sceVideoCoreAsyncAddStream();
+int APS5_VABI sceVideoCoreAsyncSendRequest();
+int APS5_VABI sceVideoCoreCancelThumbnail();
+int APS5_VABI sceVideoCoreChangeActiveStatus();
+int APS5_VABI sceVideoCoreChangeAudioStream();
+int APS5_VABI sceVideoCoreChangeDisplaySize();
+int APS5_VABI sceVideoCoreChangeHdcpSetting();
+int APS5_VABI sceVideoCoreChangeSubtitle();
+int APS5_VABI sceVideoCoreDeleteStream();
+int APS5_VABI sceVideoCoreGenerateThumbnail();
+int APS5_VABI sceVideoCoreGenerateThumbnail2();
+int APS5_VABI sceVideoCoreGetCanvasHandle();
+int APS5_VABI sceVideoCoreGetPlayStatus();
+int APS5_VABI sceVideoCoreGetPlayStatus2();
+int APS5_VABI sceVideoCoreGetStreamUid();
+int APS5_VABI sceVideoCoreGetThumbnail();
+int APS5_VABI sceVideoCoreGetThumbnail2();
+int APS5_VABI sceVideoCoreLaunchVideoCore();
+int APS5_VABI sceVideoCoreMediaSourceAbortSourceBuffer();
+int APS5_VABI sceVideoCoreMediaSourceAddSourceBuffer();
+int APS5_VABI sceVideoCoreMediaSourceAppendData();
+int APS5_VABI sceVideoCoreMediaSourceEndOfStream();
+int APS5_VABI sceVideoCoreMediaSourceGetBufferedTimeRanges();
+int APS5_VABI sceVideoCoreMediaSourceGetInputBufferEmptySize();
+int APS5_VABI sceVideoCoreMediaSourceGetPlaybackQuality();
+int APS5_VABI sceVideoCoreMediaSourceGetSourceBufferEvent();
+int APS5_VABI sceVideoCoreMediaSourceRemoveSourceBuffer();
+int APS5_VABI sceVideoCoreMediaSourceSetDuration();
+int APS5_VABI sceVideoCoreMediaSourceSetTimestampOffset();
+int APS5_VABI sceVideoCorePlayControl();
+int APS5_VABI sceVideoCoreRegistEventCallback();
+int APS5_VABI sceVideoCoreReleaseDecoderResource();
+int APS5_VABI sceVideoCoreReleaseDecoderResourceForBeWrapper();
+int APS5_VABI sceVideoCoreSetAudioMute();
+int APS5_VABI sceVideoCoreSetAudioVolume();
+int APS5_VABI sceVideoCoreSetFullScreen();
+int APS5_VABI sceVideoCoreSetInitialInfo();
+int APS5_VABI sceVideoCoreSetInitializeInfo();
+int APS5_VABI sceVideoCoreSetPlaybackRange();
+int APS5_VABI sceVideoCoreSetThumbnailInfo();
+int APS5_VABI sceVideoCoreSyncAddStream();
+int APS5_VABI sceVideoCoreSyncSendRequest();
+int APS5_VABI sceVideoCoreUnregistEventCallback();
+
+}
diff --git a/core/libs/prx/libSceVideoCoreServerInterface/libSceVideoCoreServerInterface.hpp b/core/libs/prx/libSceVideoCoreServerInterface/libSceVideoCoreServerInterface.hpp
new file mode 100644
index 0000000000..5a97dc597f
--- /dev/null
+++ b/core/libs/prx/libSceVideoCoreServerInterface/libSceVideoCoreServerInterface.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoCoreServerInterface/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp b/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp
index 4e2ab88329..3dc080db54 100644
--- a/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp
+++ b/core/libs/prx/libSceVideoDecoderArbitration/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoDecoderArbitration/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoDecoderArbitration/include/Api.hpp b/core/libs/prx/libSceVideoDecoderArbitration/include/Api.hpp
new file mode 100644
index 0000000000..0029460ffa
--- /dev/null
+++ b/core/libs/prx/libSceVideoDecoderArbitration/include/Api.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoDecoderArbitrationAcceptEvent();
+int APS5_VABI sceVideoDecoderArbitrationEnable();
+int APS5_VABI sceVideoDecoderArbitrationEnableSuspendMode();
+int APS5_VABI sceVideoDecoderArbitrationInitialize();
+
+}
diff --git a/core/libs/prx/libSceVideoDecoderArbitration/libSceVideoDecoderArbitration.hpp b/core/libs/prx/libSceVideoDecoderArbitration/libSceVideoDecoderArbitration.hpp
new file mode 100644
index 0000000000..93ab58e19f
--- /dev/null
+++ b/core/libs/prx/libSceVideoDecoderArbitration/libSceVideoDecoderArbitration.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoDecoderArbitration/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp b/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp
index 2c3047328f..83c4dda32a 100644
--- a/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp
+++ b/core/libs/prx/libSceVideoNativeExtEssential/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoNativeExtEssential/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoNativeExtEssential/include/Api.hpp b/core/libs/prx/libSceVideoNativeExtEssential/include/Api.hpp
new file mode 100644
index 0000000000..0801f28d5d
--- /dev/null
+++ b/core/libs/prx/libSceVideoNativeExtEssential/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoNativeExtEssential_CreateDecInstance();
+int APS5_VABI sceVideoNativeExtEssential_DestroyDecInstance();
+int APS5_VABI sceVideoNativeExtEssential_Finalize();
+int APS5_VABI sceVideoNativeExtEssential_Initialize();
+int APS5_VABI sceVideoNativeExtEssential_IsInit();
+
+}
diff --git a/core/libs/prx/libSceVideoNativeExtEssential/libSceVideoNativeExtEssential.hpp b/core/libs/prx/libSceVideoNativeExtEssential/libSceVideoNativeExtEssential.hpp
new file mode 100644
index 0000000000..07fbad2f88
--- /dev/null
+++ b/core/libs/prx/libSceVideoNativeExtEssential/libSceVideoNativeExtEssential.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoNativeExtEssential/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoOut/CMakeLists.txt b/core/libs/prx/libSceVideoOut/CMakeLists.txt
index dee987ce6e..5acccb7a32 100644
--- a/core/libs/prx/libSceVideoOut/CMakeLists.txt
+++ b/core/libs/prx/libSceVideoOut/CMakeLists.txt
@@ -23,7 +23,7 @@ target_include_directories(libSceVideoOut PRIVATE
         ${CMAKE_BINARY_DIR}/core/libs/prx/libSceAgcDriver/generated
 )
 add_dependencies(libSceVideoOut agc_trace_revision)
-target_link_libraries(libSceVideoOut PRIVATE libSceAgcDriver libScePad libSceMouse libSceKeyboard libSceIme libc libkernel decoder_png SDL2-static)
+target_link_libraries(libSceVideoOut PRIVATE libSceAgcDriver libScePad libSceUserService libSceMouse libSceKeyboard libSceIme libc libkernel decoder_png SDL2-static)
 if(WIN32)
     target_link_libraries(libSceVideoOut PRIVATE comctl32 dxgi)
 endif()
@@ -102,7 +102,7 @@ if(BUILD_TESTING)
     endforeach()
 
     set_target_properties(video_out_flip_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
-    foreach(flipMode IN ITEMS lifetime reopen decode controls overlay unopened ps4)
+    foreach(flipMode IN ITEMS lifetime reopen decode controls overlay unopened ps4 resolution resolution_override)
         if(flipMode STREQUAL "lifetime")
             add_test(NAME video_out_flip_${flipMode} COMMAND video_out_flip_tests)
         else()
@@ -145,8 +145,14 @@ endif()
 
 if(BUILD_TESTING)
     add_test_executable(pad_sdl_tests tests/PadSdl.cpp)
-    target_link_libraries(pad_sdl_tests PRIVATE SDL2-static)
+    target_include_directories(pad_sdl_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(pad_sdl_tests PRIVATE libSceVideoOut libScePad libSceUserService libc SDL2-static)
+    configure_windows_unwind(pad_sdl_tests)
     add_test(NAME pad_sdl COMMAND pad_sdl_tests)
+    if(WIN32)
+        set_tests_properties(pad_sdl PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVideoOut>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libScePad>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceUserService>;PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(pad_input_mapping_tests tests/InputMapping.cpp src/InputMapping.cpp)
     target_include_directories(pad_input_mapping_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/3rdparty/SDL2/include)
     target_link_libraries(pad_input_mapping_tests PRIVATE SDL2-static libc)
diff --git a/core/libs/prx/libSceVideoOut/Unimplemented.cpp b/core/libs/prx/libSceVideoOut/Unimplemented.cpp
index 91b75fbb31..35751e05fd 100644
--- a/core/libs/prx/libSceVideoOut/Unimplemented.cpp
+++ b/core/libs/prx/libSceVideoOut/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -62,7 +63,6 @@ int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutC
     return sceVideoOutAdjustColorSpaceConversion(handle, settings);
 }
 
-
 int APS5_VABI sceDbgVideoOutAddOutputModeVr60Privilege() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceVideoOut/include/Buffer.hpp b/core/libs/prx/libSceVideoOut/include/Buffer.hpp
index 5ae8013ae6..112e9cc682 100644
--- a/core/libs/prx/libSceVideoOut/include/Buffer.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Buffer.hpp
@@ -3,23 +3,22 @@
 
 #include <cstdint>
 
-#include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
 extern "C" {
 
-int APS5_VABI sceVideoOutRegisterBuffers(int handle, int buffer_index_start, void* const* addresses, int buffer_num, const VideoOutBufferAttribute* attribute);
-void APS5_VABI sceVideoOutSetBufferAttribute(VideoOutBufferAttribute* attribute, uint32_t pixel_format, uint32_t tiling_mode, uint32_t aspect_ratio, uint32_t width, uint32_t height, uint32_t pitch_in_pixel);
-int APS5_VABI sceVideoOutRegisterBuffers2(int handle, int set_index, int buffer_index_start, const VideoOutBuffers* buffers, int buffer_num, const VideoOutBufferAttribute2* attribute, int category, void* option);
-void APS5_VABI sceVideoOutSetBufferAttribute2(VideoOutBufferAttribute2* attribute, uint64_t pixel_format, uint32_t tiling_mode, uint32_t width, uint32_t height, uint64_t option, uint32_t dcc_control, uint64_t dcc_cb_register_clear_color);
+int APS5_VABI sceVideoOutRegisterBuffers(int handle, int bufferIndexStart, void* const* addresses, int bufferNum, const VideoOutBufferAttribute* attribute);
+void APS5_VABI sceVideoOutSetBufferAttribute(VideoOutBufferAttribute* attribute, uint32_t pixelFormat, uint32_t tilingMode, uint32_t aspectRatio, uint32_t width, uint32_t height, uint32_t pitchInPixel);
+int APS5_VABI sceVideoOutRegisterBuffers2(int handle, int setIndex, int bufferIndexStart, const VideoOutBuffers* buffers, int bufferNum, const VideoOutBufferAttribute2* attribute, int category, void* option);
+void APS5_VABI sceVideoOutSetBufferAttribute2(VideoOutBufferAttribute2* attribute, uint64_t pixelFormat, uint32_t tilingMode, uint32_t width, uint32_t height, uint64_t option, uint32_t dccControl, uint64_t dccCbRegisterClearColor);
 void APS5_VABI sceVideoOutAddBufferAttributeOption(VideoOutBufferAttribute2* attribute, uint64_t option);
 void APS5_VABI sceVideoOutRemoveBufferAttributeOption(VideoOutBufferAttribute2* attribute, uint64_t option);
-int APS5_VABI sceVideoOutSubmitChangeBufferAttribute2(int handle, int set_index, const VideoOutBufferAttribute2* attribute, void* option);
-int APS5_VABI sceVideoOutSubmitEopFlip(int handle, int index, int flip_mode, int64_t flip_arg, std::uint32_t* token);
-int APS5_VABI sceVideoOutSubmitFlip(int handle, int index, int flip_mode, int64_t flip_arg);
-int APS5_VABI sceVideoOutUnregisterBuffers(int handle, int set_index);
+int APS5_VABI sceVideoOutSubmitChangeBufferAttribute2(int handle, int setIndex, const VideoOutBufferAttribute2* attribute, void* option);
+int APS5_VABI sceVideoOutSubmitEopFlip(int handle, int index, int flipMode, int64_t flipArg, std::uint32_t* token);
+int APS5_VABI sceVideoOutSubmitFlip(int handle, int index, int flipMode, int64_t flipArg);
+int APS5_VABI sceVideoOutUnregisterBuffers(int handle, int setIndex);
 int APS5_VABI sceVideoOutGetBufferLabelAddress(int handle, uintptr_t* address);
 
-#endif
-
 }
+
+#endif
diff --git a/core/libs/prx/libSceVideoOut/include/Event.hpp b/core/libs/prx/libSceVideoOut/include/Event.hpp
index ca5e4f09f7..aea9cf2186 100644
--- a/core/libs/prx/libSceVideoOut/include/Event.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Event.hpp
@@ -3,7 +3,6 @@
 
 #include <cstdint>
 
-#include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
 extern "C" {
@@ -24,6 +23,6 @@ int APS5_VABI sceVideoOutGetEventCount(const KernelEvent* ev);
 int APS5_VABI sceVideoOutGetEventData(const KernelEvent* ev, int64_t* data);
 int APS5_VABI sceVideoOutGetEventId(const KernelEvent* ev);
 
-#endif
-
 }
+
+#endif
diff --git a/core/libs/prx/libSceVideoOut/include/Output.hpp b/core/libs/prx/libSceVideoOut/include/Output.hpp
index 569e97ee77..caebc2514a 100644
--- a/core/libs/prx/libSceVideoOut/include/Output.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Output.hpp
@@ -2,17 +2,16 @@
 #define CORE_LIBS_PRX_LIBSCEVIDEOUOUT_INCLUDE_OUTPUT_HPP
 
 #include <cstdint>
-#include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
 int ValidateVideoOutOutputMode_nid_no_patch(uint64_t mode, const VideoOutOutputOptions* options, int displayRefreshRate);
 
 extern "C" {
 
-int APS5_VABI sceVideoOutOpen(int user_id, int bus_type, int index, const void* param);
+int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
 int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutConfigureOutput(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reserved_ptr, uint64_t reserved);
-int APS5_VABI sceVideoOutIsOutputSupported(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reserved_ptr, uint64_t reserved);
+int APS5_VABI sceVideoOutConfigureOutput(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, uint64_t reserved);
+int APS5_VABI sceVideoOutIsOutputSupported(int handle, uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, uint64_t reserved);
 int APS5_VABI sceVideoOutInitializeOutputOptions(VideoOutOutputOptions* options);
 int APS5_VABI sceVideoOutAllowOutputResolutionWqhdDetection(int handle);
 int APS5_VABI sceVideoOutSetFlipRate(int handle, int rate);
@@ -31,9 +30,9 @@ int APS5_VABI sceVideoOutAdjustColor(int handle, const VideoOutColorSettings* se
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings);
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option);
 int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutColorSpaceConversionSettings* settings);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size);
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settingsSize);
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settingsSize);
+int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settingsSize);
 int APS5_VABI sceVideoOutSetGlobalBlendSpace(int handle, uint32_t space, uint32_t option);
 int APS5_VABI sceVideoOutVrrPegToFixedRate(int handle, uint64_t arg1, uint64_t arg2);
 int APS5_VABI sceVideoOutVrrUnpegFromFixedRate(int handle);
diff --git a/core/libs/prx/libSceVideoOut/include/PadInput.hpp b/core/libs/prx/libSceVideoOut/include/PadInput.hpp
index dfa068d16d..2f5eddb56c 100644
--- a/core/libs/prx/libSceVideoOut/include/PadInput.hpp
+++ b/core/libs/prx/libSceVideoOut/include/PadInput.hpp
@@ -5,7 +5,9 @@
 #include "SDL_gamecontroller.h"
 #include "prx/libScePad/include/KeyboardMouse.hpp"
 #include "prx/libScePad/include/PadState.hpp"
+#include "prx/libScePad/include/Pad.hpp"
 #include "prx/libSceVideoOut/include/PadOutputPacing.hpp"
+#include <array>
 #include <chrono>
 #include "prx/libSceVideoOut/include/Telemetry.hpp"
 
@@ -18,28 +20,37 @@ public:
     void HandleEvent(const SDL_Event& event, DisplayWindow& window);
     void Update(const DisplayWindow& window);
     bool MouseModeEnabled() const { return keyboardMouse.MouseMode(); }
+    bool SlotOccupied(int slot) const {
+        return slot >= 0 && slot < PAD_MAX_CONTROLLERS && slots[slot].controller != nullptr;
+    }
 
 private:
+    struct ControllerSlot {
+        SDL_GameController* controller = nullptr;
+        SDL_JoystickID instanceId = -1;
+        PadInputState state{};
+        std::uint32_t outputSequence = 0;
+        PadOutputState outputState{};
+        bool outputPending = false;
+        std::chrono::steady_clock::time_point nextRumbleRefresh{};
+        LightBarPacer lightBar;
+        TriggerEffectCache triggerEffect;
+    };
+
     explicit PadInput(Pad::InputConfiguration configuration);
     void publish(std::uint64_t frame);
+    void publish(std::uint64_t frame, int slot);
     void setMouseMode(bool enabled);
-    void openFirstAvailableController();
+    void openAvailableControllers();
     void openController(int deviceIndex);
-    void closeController();
-    PadInputState sampleController() const;
+    void closeController(int slot);
+    PadInputState sampleController(int slot) const;
     void applyOutput();
-    void enableSensors();
+    void enableSensors(int slot);
 
     Pad::KeyboardMouse keyboardMouse;
-    SDL_GameController* controller = nullptr;
-    PadInputState controllerState{};
-    std::uint32_t outputSequence = 0;
-    PadOutputState outputState{};
-    bool outputPending = false;
+    std::array<ControllerSlot, PAD_MAX_CONTROLLERS> slots{};
     VideoOutTelemetry::PadChangeFilter telemetryFilter;
-    std::chrono::steady_clock::time_point nextRumbleRefresh{};
-    LightBarPacer lightBar;
-    TriggerEffectCache triggerEffect;
 };
 
 #endif
diff --git a/core/libs/prx/libSceVideoOut/include/VideoOut.hpp b/core/libs/prx/libSceVideoOut/include/VideoOut.hpp
new file mode 100644
index 0000000000..8f86fea2b9
--- /dev/null
+++ b/core/libs/prx/libSceVideoOut/include/VideoOut.hpp
@@ -0,0 +1,18 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoOutSetFlipMaster(std::int32_t handle, std::int32_t masterHandle);
+int APS5_VABI sceVideoOutClearFlipMaster(std::int32_t handle);
+int APS5_VABI sceVideoOutCursorEnable(int32_t, int32_t, const void*);
+int APS5_VABI sceVideoOutCursorDisable(int32_t, int32_t);
+int APS5_VABI sceVideoOutCursorSetImageAddress(int32_t, int32_t, const void*);
+int APS5_VABI sceVideoOutCursorSetPosition(int32_t, int32_t, uint32_t, uint32_t);
+int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settingsSize);
+int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settingsSize);
+int APS5_VABI sceDbgVideoOutAddOutputModeVr60Privilege();
+int APS5_VABI sceVideoOutAddVrrStatusFlagsPrivilege();
+
+}
diff --git a/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp b/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp
index 7c868f3ce2..156e03c66d 100644
--- a/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp
+++ b/core/libs/prx/libSceVideoOut/include/VideoOutDriver.hpp
@@ -96,6 +96,9 @@ static constexpr std::uint64_t VIDEO_OUT_OUTPUT_STATUS_FLAG_HDR = 1;
 static constexpr uint64_t VIDEO_OUT_REFRESH_RATE_59_94HZ = 3;
 static constexpr uint64_t VIDEO_OUT_REFRESH_RATE_119_88HZ = 13;
 
+static constexpr std::uint32_t VIDEO_OUT_RESOLUTION_1080P = 1;
+static constexpr std::uint32_t VIDEO_OUT_RESOLUTION_2160P = 2;
+
 struct VideoOutBuffer {
     int groupIndex = -1;
     uint64_t dataAddress = 0;
@@ -226,6 +229,7 @@ public:
     bool HasConfig(int handle);
     bool SupportsHighFrameRate();
     int GetDisplayRefreshRate();
+    std::uint32_t GetDisplayResolution();
 
     // 0, or VIDEO_OUT_ERROR_FLIP_QUEUE_FULL when the title has VIDEO_OUT_FLIP_QUEUE_CAPACITY flips pending.
     int SubmitFlip(int handle, int index, int flipMode, int64_t flipArg);
@@ -252,6 +256,7 @@ private:
     HostHdrProbe hdrProbe;
     std::uint64_t hdrGeneration = 0;
     std::atomic<int> displayRefreshRate{0};
+    std::atomic<std::uint32_t> displayResolution{VIDEO_OUT_RESOLUTION_1080P};
 
     std::jthread presentThread;
     std::jthread vblankThread;
diff --git a/core/libs/prx/libSceVideoOut/libSceVideoOut.hpp b/core/libs/prx/libSceVideoOut/libSceVideoOut.hpp
new file mode 100644
index 0000000000..d3328b1410
--- /dev/null
+++ b/core/libs/prx/libSceVideoOut/libSceVideoOut.hpp
@@ -0,0 +1,6 @@
+#pragma once
+
+#include "prx/libSceVideoOut/include/Buffer.hpp"
+#include "prx/libSceVideoOut/include/Event.hpp"
+#include "prx/libSceVideoOut/include/Output.hpp"
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
diff --git a/core/libs/prx/libSceVideoOut/src/Buffer.cpp b/core/libs/prx/libSceVideoOut/src/Buffer.cpp
index 7197986ca7..75c4e8a067 100644
--- a/core/libs/prx/libSceVideoOut/src/Buffer.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Buffer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Buffer.hpp"
 #include <cstdio>
 #include <cstring>
 #include <mutex>
diff --git a/core/libs/prx/libSceVideoOut/src/Event.cpp b/core/libs/prx/libSceVideoOut/src/Event.cpp
index d13e6494fb..dde7b34821 100644
--- a/core/libs/prx/libSceVideoOut/src/Event.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Event.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Event.hpp"
 #include <algorithm>
 #include <chrono>
 #include <mutex>
diff --git a/core/libs/prx/libSceVideoOut/src/Output.cpp b/core/libs/prx/libSceVideoOut/src/Output.cpp
index 24f9b6f15c..f1d49072fb 100644
--- a/core/libs/prx/libSceVideoOut/src/Output.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Output.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include <algorithm>
 #include <array>
 #include <cstddef>
@@ -19,7 +20,7 @@ static constexpr std::size_t VIDEO_OUT_OUTPUT_OPTIONS_FREE_WORD = 3;
 
 static VideoOutOutputStatus outputStatus(const auto& cfg) {
     VideoOutOutputStatus status{};
-    status.resolution = (cfg.width >= 3840 || cfg.height >= 2160) ? 2u : 1u;
+    status.resolution = VideoOutDriver::Get().GetDisplayResolution();
     const bool hdr = AgcDriver::CurrentHostHdr().available;
     status.dynamicRange = hdr ? VIDEO_OUT_DYNAMIC_RANGE_HDR : VIDEO_OUT_DYNAMIC_RANGE_SDR;
     status.refreshRate = (cfg.outputMode == VIDEO_OUT_OUTPUT_MODE_119_88HZ) ? VIDEO_OUT_REFRESH_RATE_119_88HZ : VIDEO_OUT_REFRESH_RATE_59_94HZ;
diff --git a/core/libs/prx/libSceVideoOut/src/PadInput.cpp b/core/libs/prx/libSceVideoOut/src/PadInput.cpp
index d9abeeb048..5e9ac3fcf7 100644
--- a/core/libs/prx/libSceVideoOut/src/PadInput.cpp
+++ b/core/libs/prx/libSceVideoOut/src/PadInput.cpp
@@ -14,7 +14,9 @@
 #include "prx/libSceAgcDriver/Execution/include/Presentation.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
 #include "prx/libScePad/include/PadState.hpp"
+#include "prx/libScePad/include/Pad.hpp"
 #include "prx/libScePad/include/PadInputTypes.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
 
@@ -22,15 +24,16 @@ PadInput::PadInput() : PadInput(Pad::LoadInputMapping()) {
 }
 
 PadInput::PadInput(Pad::InputConfiguration configuration) : keyboardMouse(std::move(configuration)) {
-    openFirstAvailableController();
+    openAvailableControllers();
 }
 
 PadInput::~PadInput() {
-    closeController();
+    for (int i = 0; i < PAD_MAX_CONTROLLERS; ++i) {
+        closeController(i);
+    }
 }
 
-void PadInput::openFirstAvailableController() {
-    if (controller != nullptr) return;
+void PadInput::openAvailableControllers() {
     SDL_SetHint(SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, "1");
     SDL_SetHint(SDL_HINT_JOYSTICK_HIDAPI_PS5_RUMBLE, "1");
     if ((SDL_WasInit(SDL_INIT_GAMECONTROLLER) & SDL_INIT_GAMECONTROLLER) == 0) {
@@ -42,82 +45,122 @@ void PadInput::openFirstAvailableController() {
     for (int deviceIndex = 0; deviceIndex < SDL_NumJoysticks(); ++deviceIndex) {
         if (!SDL_IsGameController(deviceIndex)) continue;
         openController(deviceIndex);
-        if (controller != nullptr) return;
     }
 }
 
 void PadInput::openController(int deviceIndex) {
-    if (controller != nullptr || !SDL_IsGameController(deviceIndex)) return;
-    controller = SDL_GameControllerOpen(deviceIndex);
-    if (controller == nullptr) {
+    if (!SDL_IsGameController(deviceIndex)) return;
+    const auto instanceId = SDL_JoystickGetDeviceInstanceID(deviceIndex);
+    for (int i = 0; i < PAD_MAX_CONTROLLERS; ++i) {
+        if (slots[i].controller != nullptr && slots[i].instanceId == instanceId) return;
+    }
+    int slot = -1;
+    for (int i = 0; i < PAD_MAX_CONTROLLERS; ++i) {
+        if (slots[i].controller == nullptr) {
+            slot = i;
+            break;
+        }
+    }
+    if (slot == -1) return;
+    SDL_GameController* gc = SDL_GameControllerOpen(deviceIndex);
+    if (gc == nullptr) {
         APS5_LOG_ERR("Pad: could not open game controller %d: %s", deviceIndex, SDL_GetError());
         return;
     }
-    const char* name = SDL_GameControllerName(controller);
-    APS5_LOG_OUT("Pad: connected game controller: %s (type %d, sensors accel=%d gyro=%d, touchpads=%d, led=%d, trigger rumble=%d)",
-        name != nullptr ? name : "unknown", static_cast<int>(SDL_GameControllerGetType(controller)),
-        SDL_GameControllerHasSensor(controller, SDL_SENSOR_ACCEL) == SDL_TRUE, SDL_GameControllerHasSensor(controller, SDL_SENSOR_GYRO) == SDL_TRUE,
-        SDL_GameControllerGetNumTouchpads(controller), SDL_GameControllerHasLED(controller) == SDL_TRUE, SDL_GameControllerHasRumbleTriggers(controller) == SDL_TRUE);
-    enableSensors();
-    outputPending = true;
-    lightBar.Reset();
-    triggerEffect.Reset();
+    slots[slot].controller = gc;
+    slots[slot].instanceId = SDL_JoystickInstanceID(SDL_GameControllerGetJoystick(gc));
+    slots[slot].state = {};
+    slots[slot].outputSequence = 0;
+    slots[slot].outputState = {};
+    slots[slot].outputPending = true;
+    slots[slot].nextRumbleRefresh = {};
+    slots[slot].lightBar.Reset();
+    slots[slot].triggerEffect.Reset();
+    const char* name = SDL_GameControllerName(gc);
+    APS5_LOG_OUT("Pad: connected game controller (slot %d): %s (type %d, sensors accel=%d gyro=%d, touchpads=%d, led=%d, trigger rumble=%d)",
+        slot, name != nullptr ? name : "unknown", static_cast<int>(SDL_GameControllerGetType(gc)),
+        SDL_GameControllerHasSensor(gc, SDL_SENSOR_ACCEL) == SDL_TRUE, SDL_GameControllerHasSensor(gc, SDL_SENSOR_GYRO) == SDL_TRUE,
+        SDL_GameControllerGetNumTouchpads(gc), SDL_GameControllerHasLED(gc) == SDL_TRUE, SDL_GameControllerHasRumbleTriggers(gc) == SDL_TRUE);
+    enableSensors(slot);
+    PadSetPortConnected_nid_postfix(slot, true);
+    UserServiceSetUserConnected_nid_postfix(slot, true);
 }
 
-void PadInput::enableSensors() {
+void PadInput::enableSensors(int slot) {
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return;
+    SDL_GameController* controller = slots[slot].controller;
     if (controller == nullptr) return;
-    const SDL_bool wanted = outputState.motionEnabled ? SDL_TRUE : SDL_FALSE;
+    const SDL_bool wanted = slots[slot].outputState.motionEnabled ? SDL_TRUE : SDL_FALSE;
     if (SDL_GameControllerHasSensor(controller, SDL_SENSOR_ACCEL) == SDL_TRUE) SDL_GameControllerSetSensorEnabled(controller, SDL_SENSOR_ACCEL, wanted);
     if (SDL_GameControllerHasSensor(controller, SDL_SENSOR_GYRO) == SDL_TRUE) SDL_GameControllerSetSensorEnabled(controller, SDL_SENSOR_GYRO, wanted);
 }
 
-void PadInput::closeController() {
-    if (controller == nullptr) return;
-    SDL_GameControllerClose(controller);
-    controller = nullptr;
-    controllerState = {};
+void PadInput::closeController(int slot) {
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return;
+    if (slots[slot].controller == nullptr) return;
+    SDL_GameControllerClose(slots[slot].controller);
+    slots[slot].controller = nullptr;
+    slots[slot].instanceId = -1;
+    slots[slot].state = {};
+    slots[slot].outputState = {};
+    slots[slot].outputPending = false;
+    if (slot > 0) {
+        PadSetPortConnected_nid_postfix(slot, false);
+        UserServiceSetUserConnected_nid_postfix(slot, false);
+    }
 }
 
 void PadInput::applyOutput() {
-    PadOutputState fetched;
-    if (PadFetchOutput_nid_postfix(&outputSequence, &fetched)) {
-        const bool motionChanged = fetched.motionEnabled != outputState.motionEnabled;
-        outputState = fetched;
-        outputPending = true;
-        if (motionChanged) enableSensors();
-    }
-    if (controller == nullptr) return;
-    const auto now = std::chrono::steady_clock::now();
-    const bool isPs5 = SDL_GameControllerGetType(controller) == SDL_CONTROLLER_TYPE_PS5;
-    const auto large = std::max(outputState.vibrationLarge, outputState.audioVibrationLarge);
-    const auto small = std::max(outputState.vibrationSmall, outputState.audioVibrationSmall);
-    const bool rumbling = large != 0 || small != 0;
-    const bool triggerRumble = outputState.trigger[0].fallback != 0 || outputState.trigger[1].fallback != 0;
-    if (SDL_GameControllerHasLED(controller) == SDL_TRUE) {
-        const LightBarPacer::Color color = outputState.lightBarValid
-            ? LightBarPacer::Color{outputState.lightBar[0], outputState.lightBar[1], outputState.lightBar[2]}
-            : LightBarPacer::Color{0, 64, 255};
-        if (lightBar.Due(color, now)) lightBar.Result(color, now, SDL_GameControllerSetLED(controller, color[0], color[1], color[2]) == 0);
-    }
-    if (!outputPending) {
-        if ((rumbling || (triggerRumble && !isPs5)) && now >= nextRumbleRefresh) outputPending = true;
-        else return;
-    }
-    outputPending = false;
-    nextRumbleRefresh = now + std::chrono::milliseconds(700);
-    constexpr Uint32 rumbleMs = 2000;
-    SDL_GameControllerRumble(controller, static_cast<Uint16>(large * 257), static_cast<Uint16>(small * 257), rumbling ? rumbleMs : 0);
-    if (outputState.triggerTouched) {
-        if (isPs5) {
-            TriggerEffectCache::Effect effect{};
-            effect[0] = 0x04 | 0x08;
-            std::memcpy(effect.data() + 10, outputState.trigger[1].effect, 11);
-            std::memcpy(effect.data() + 21, outputState.trigger[0].effect, 11);
-            if (triggerEffect.NeedsSend(effect)) {
-                triggerEffect.Result(effect, SDL_GameControllerSendEffect(controller, effect.data(), static_cast<int>(effect.size())) == 0);
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        PadOutputState fetched;
+        if (PadFetchOutputForPort_nid_postfix(slot, &slots[slot].outputSequence, &fetched)) {
+            const bool motionChanged = fetched.motionEnabled != slots[slot].outputState.motionEnabled;
+            slots[slot].outputState = fetched;
+            slots[slot].outputPending = true;
+            if (motionChanged) enableSensors(slot);
+        }
+        SDL_GameController* controller = slots[slot].controller;
+        if (controller == nullptr) continue;
+        const auto now = std::chrono::steady_clock::now();
+        const bool isPs5 = SDL_GameControllerGetType(controller) == SDL_CONTROLLER_TYPE_PS5;
+        const auto large = std::max(slots[slot].outputState.vibrationLarge, slots[slot].outputState.audioVibrationLarge);
+        const auto small = std::max(slots[slot].outputState.vibrationSmall, slots[slot].outputState.audioVibrationSmall);
+        const bool rumbling = large != 0 || small != 0;
+        const bool triggerRumble = slots[slot].outputState.trigger[0].fallback != 0 || slots[slot].outputState.trigger[1].fallback != 0;
+        if (SDL_GameControllerHasLED(controller) == SDL_TRUE) {
+            struct PlayerLedColor { Uint8 r, g, b; };
+            static constexpr PlayerLedColor defaultColors[4] = {
+                {0, 64, 255},
+                {255, 0, 0},
+                {0, 255, 0},
+                {255, 0, 128}
+            };
+            const auto& def = defaultColors[slot % 4];
+            const LightBarPacer::Color color = slots[slot].outputState.lightBarValid
+                ? LightBarPacer::Color{slots[slot].outputState.lightBar[0], slots[slot].outputState.lightBar[1], slots[slot].outputState.lightBar[2]}
+                : LightBarPacer::Color{def.r, def.g, def.b};
+            if (slots[slot].lightBar.Due(color, now)) slots[slot].lightBar.Result(color, now, SDL_GameControllerSetLED(controller, color[0], color[1], color[2]) == 0);
+        }
+        if (!slots[slot].outputPending) {
+            if ((rumbling || (triggerRumble && !isPs5)) && now >= slots[slot].nextRumbleRefresh) slots[slot].outputPending = true;
+            else continue;
+        }
+        slots[slot].outputPending = false;
+        slots[slot].nextRumbleRefresh = now + std::chrono::milliseconds(700);
+        constexpr Uint32 rumbleMs = 2000;
+        SDL_GameControllerRumble(controller, static_cast<Uint16>(large * 257), static_cast<Uint16>(small * 257), rumbling ? rumbleMs : 0);
+        if (slots[slot].outputState.triggerTouched) {
+            if (isPs5) {
+                TriggerEffectCache::Effect effect{};
+                effect[0] = 0x04 | 0x08;
+                std::memcpy(effect.data() + 10, slots[slot].outputState.trigger[1].effect, 11);
+                std::memcpy(effect.data() + 21, slots[slot].outputState.trigger[0].effect, 11);
+                if (slots[slot].triggerEffect.NeedsSend(effect)) {
+                    slots[slot].triggerEffect.Result(effect, SDL_GameControllerSendEffect(controller, effect.data(), static_cast<int>(effect.size())) == 0);
+                }
+            } else if (SDL_GameControllerHasRumbleTriggers(controller) == SDL_TRUE) {
+                SDL_GameControllerRumbleTriggers(controller, static_cast<Uint16>(slots[slot].outputState.trigger[0].fallback * 257), static_cast<Uint16>(slots[slot].outputState.trigger[1].fallback * 257), triggerRumble ? rumbleMs : 0);
             }
-        } else if (SDL_GameControllerHasRumbleTriggers(controller) == SDL_TRUE) {
-            SDL_GameControllerRumbleTriggers(controller, static_cast<Uint16>(outputState.trigger[0].fallback * 257), static_cast<Uint16>(outputState.trigger[1].fallback * 257), triggerRumble ? rumbleMs : 0);
         }
     }
 }
@@ -129,10 +172,12 @@ void PadInput::setMouseMode(bool enabled) {
     keyboardMouse.SetMouseMode(enabled);
 }
 
-PadInputState PadInput::sampleController() const {
+PadInputState PadInput::sampleController(int slot) const {
     PadInputState result;
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return result;
+    SDL_GameController* controller = slots[slot].controller;
     if (controller == nullptr) return result;
-    const auto readButton = [this](SDL_GameControllerButton button) {
+    const auto readButton = [controller](SDL_GameControllerButton button) {
         return SDL_GameControllerGetButton(controller, button) != 0;
     };
     const auto addButton = [&result, &readButton](SDL_GameControllerButton source, Pad::PadButton button) {
@@ -156,7 +201,7 @@ PadInputState PadInput::sampleController() const {
     addButton(SDL_CONTROLLER_BUTTON_DPAD_LEFT, Pad::PadButton::Left);
     addButton(SDL_CONTROLLER_BUTTON_TOUCHPAD, Pad::PadButton::TouchPad);
 
-    const auto triggerValue = [this](SDL_GameControllerAxis axis) {
+    const auto triggerValue = [controller](SDL_GameControllerAxis axis) {
         const auto value = std::clamp<int>(SDL_GameControllerGetAxis(controller, axis), 0, 32767);
         return static_cast<std::uint8_t>((value * 255 + 16383) / 32767);
     };
@@ -165,7 +210,7 @@ PadInputState PadInput::sampleController() const {
     if (result.analogButtonsL2 != 0) result.buttons |= static_cast<std::uint32_t>(Pad::PadButton::L2);
     if (result.analogButtonsR2 != 0) result.buttons |= static_cast<std::uint32_t>(Pad::PadButton::R2);
 
-    const auto stick = [this](SDL_GameControllerAxis xAxis, SDL_GameControllerAxis yAxis, int deadzonePercent) {
+    const auto stick = [this, controller](SDL_GameControllerAxis xAxis, SDL_GameControllerAxis yAxis, int deadzonePercent) {
         return Pad::StickWithDeadzone(SDL_GameControllerGetAxis(controller, xAxis), SDL_GameControllerGetAxis(controller, yAxis), deadzonePercent);
     };
     const auto left = stick(SDL_CONTROLLER_AXIS_LEFTX, SDL_CONTROLLER_AXIS_LEFTY, keyboardMouse.Configuration().settings.leftStickDeadzonePercent);
@@ -207,23 +252,34 @@ void PadInput::HandleEvent(const SDL_Event& event, DisplayWindow& window) {
         openController(event.cdevice.which);
         return;
     }
-    if (event.type == SDL_CONTROLLERDEVICEREMOVED && controller != nullptr) {
-        const auto instanceId = SDL_JoystickInstanceID(SDL_GameControllerGetJoystick(controller));
-        if (instanceId == event.cdevice.which) {
-            closeController();
-            openFirstAvailableController();
-            publish(window.FrameNumber());
+    if (event.type == SDL_CONTROLLERDEVICEREMOVED) {
+        for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+            if (slots[slot].controller != nullptr && slots[slot].instanceId == event.cdevice.which) {
+                closeController(slot);
+                publish(window.FrameNumber(), slot);
+                break;
+            }
         }
         return;
     }
     if (event.type == SDL_CONTROLLERBUTTONDOWN || event.type == SDL_CONTROLLERBUTTONUP ||
         event.type == SDL_CONTROLLERAXISMOTION || event.type == SDL_CONTROLLERDEVICEREMAPPED) {
-        publish(window.FrameNumber());
+        SDL_JoystickID which = -1;
+        if (event.type == SDL_CONTROLLERBUTTONDOWN || event.type == SDL_CONTROLLERBUTTONUP) which = event.cbutton.which;
+        else if (event.type == SDL_CONTROLLERAXISMOTION) which = event.caxis.which;
+        else if (event.type == SDL_CONTROLLERDEVICEREMAPPED) which = event.cdevice.which;
+        for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+            if (slots[slot].controller != nullptr && slots[slot].instanceId == which) {
+                slots[slot].state = sampleController(slot);
+                publish(window.FrameNumber(), slot);
+                return;
+            }
+        }
         return;
     }
     if (event.type == SDL_WINDOWEVENT) {
         if (keyboardMouse.HandleEvent(event, std::chrono::steady_clock::now()).releaseMouse) setMouseMode(false);
-        publish(window.FrameNumber());
+        publish(window.FrameNumber(), 0);
         return;
     }
     // APS5_NO_PAD_INPUT=1 keeps a measurement run from reacting to keys or mouse buttons that reach
@@ -239,25 +295,54 @@ void PadInput::HandleEvent(const SDL_Event& event, DisplayWindow& window) {
     if (requests.togglePerformanceOverlay && window.Handle() != nullptr && event.key.windowID == SDL_GetWindowID(window.Handle())) AgcDriverTogglePerformanceOverlay_nid_postfix();
     if (requests.screenshot && window.Handle() != nullptr && event.key.windowID == SDL_GetWindowID(window.Handle())) AgcDriverRequestScreenshot_nid_postfix();
     if (requests.toggleMouse) setMouseMode(!keyboardMouse.MouseMode());
-    if (event.type != SDL_MOUSEMOTION) publish(window.FrameNumber());
+    if (event.type != SDL_MOUSEMOTION) publish(window.FrameNumber(), 0);
 }
 
 void PadInput::Update(const DisplayWindow& window) {
-    if (controller != nullptr) SDL_GameControllerUpdate();
+    bool anyController = false;
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        if (slots[slot].controller != nullptr) {
+            anyController = true;
+            break;
+        }
+    }
+    if (anyController) SDL_GameControllerUpdate();
     applyOutput();
-    if (controller != nullptr) controllerState = sampleController();
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        if (slots[slot].controller != nullptr) {
+            slots[slot].state = sampleController(slot);
+        }
+    }
     if (keyboardMouse.MouseMode() && SDL_GetKeyboardFocus() == nullptr) {
         keyboardMouse.Release();
         setMouseMode(false);
-        publish(window.FrameNumber());
+        publish(window.FrameNumber(), 0);
         return;
     }
     const bool changed = keyboardMouse.Advance(std::chrono::steady_clock::now());
-    if (controller != nullptr || keyboardMouse.MouseMode() || changed) publish(window.FrameNumber());
+    if (slots[0].controller != nullptr || keyboardMouse.MouseMode() || changed) {
+        publish(window.FrameNumber(), 0);
+    }
+    for (int slot = 1; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        if (slots[slot].controller != nullptr) {
+            publish(window.FrameNumber(), slot);
+        }
+    }
 }
 
 void PadInput::publish(std::uint64_t frame) {
-    const auto state = keyboardMouse.Compose(controllerState);
-    PadPublishInput_nid_postfix(state);
-    if (auto* telemetry = VideoOutTelemetry::Instance(); telemetry != nullptr) VideoOutTelemetry::EmitPadIfChanged(*telemetry, telemetryFilter, frame, state);
+    for (int slot = 0; slot < PAD_MAX_CONTROLLERS; ++slot) {
+        publish(frame, slot);
+    }
+}
+
+void PadInput::publish(std::uint64_t frame, int slot) {
+    if (slot < 0 || slot >= PAD_MAX_CONTROLLERS) return;
+    if (slot == 0) {
+        const auto state = keyboardMouse.Compose(slots[0].state);
+        PadPublishInput_nid_postfix(state);
+        if (auto* telemetry = VideoOutTelemetry::Instance(); telemetry != nullptr) VideoOutTelemetry::EmitPadIfChanged(*telemetry, telemetryFilter, frame, state);
+    } else {
+        PadPublishInputForPort_nid_postfix(slot, slots[slot].state);
+    }
 }
diff --git a/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp b/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp
index f308f42739..377fb3548b 100644
--- a/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp
+++ b/core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp
@@ -1,4 +1,5 @@
 #include <bit>
+#include <charconv>
 #include <chrono>
 #include <cstdlib>
 #include <cstring>
@@ -6,6 +7,7 @@
 #include <exception>
 #include <thread>
 #include <limits>
+#include <optional>
 #include <stdexcept>
 #include <string>
 
@@ -41,6 +43,26 @@ void require(bool condition, const char* reason) {
     if (!condition) throw std::runtime_error(std::string("VideoOut: ") + reason);
 }
 
+std::uint32_t resolutionIndex(std::uint32_t width, std::uint32_t height) {
+    return (width >= 3840 || height >= 2160) ? VIDEO_OUT_RESOLUTION_2160P : VIDEO_OUT_RESOLUTION_1080P;
+}
+
+std::optional<std::uint32_t> configuredResolution() {
+    const char* value = std::getenv("APS5_OUTPUT_RESOLUTION");
+    if (value == nullptr || *value == '\0') return std::nullopt;
+    const std::string text(value);
+    const char* end = text.data() + text.size();
+    std::uint32_t width = 0;
+    std::uint32_t height = 0;
+    const auto widthResult = std::from_chars(text.data(), end, width);
+    const bool separated = widthResult.ec == std::errc{} && widthResult.ptr != end && (*widthResult.ptr == 'x' || *widthResult.ptr == 'X');
+    const auto heightResult = separated ? std::from_chars(widthResult.ptr + 1, end, height) : std::from_chars_result{end, std::errc::invalid_argument};
+    if (!separated || heightResult.ec != std::errc{} || heightResult.ptr != end || width == 0 || height == 0) {
+        throw std::runtime_error("VideoOut: APS5_OUTPUT_RESOLUTION must be <width>x<height> with positive integers, got \"" + text + "\"");
+    }
+    return resolutionIndex(width, height);
+}
+
 std::vector<const char*> windowExtensions(SDL_Window* window) {
     unsigned extensionCount = 0;
     if (!SDL_Vulkan_GetInstanceExtensions(window, &extensionCount, nullptr)) throw std::runtime_error(std::string("SDL_Vulkan_GetInstanceExtensions failed: ") + SDL_GetError());
@@ -489,12 +511,18 @@ int VideoOutDriver::GetDisplayRefreshRate() {
     return displayRefreshRate.load();
 }
 
+std::uint32_t VideoOutDriver::GetDisplayResolution() {
+    if (const auto configured = configuredResolution()) return *configured;
+    return displayResolution.load();
+}
+
 void VideoOutDriver::updateDisplayRefreshRate() {
     const int display = SDL_GetWindowDisplayIndex(window.Handle());
     if (display < 0) throw std::runtime_error(std::string("SDL_GetWindowDisplayIndex failed: ") + SDL_GetError());
     SDL_DisplayMode mode{};
     if (SDL_GetCurrentDisplayMode(display, &mode) != 0) throw std::runtime_error(std::string("SDL_GetCurrentDisplayMode failed: ") + SDL_GetError());
     displayRefreshRate.store(mode.refresh_rate);
+    displayResolution.store(resolutionIndex(mode.w, mode.h));
 }
 
 void VideoOutDriver::pollHostHdr() {
diff --git a/core/libs/prx/libSceVideoOut/tests/Flip.cpp b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
index 365eddf412..877e19e1fa 100644
--- a/core/libs/prx/libSceVideoOut/tests/Flip.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libSceVideoOut/include/VideoOutDriver.hpp"
 #include "prx/libSceVideoOut/include/Buffer.hpp"
 #include "prx/libSceVideoOut/include/Output.hpp"
@@ -25,11 +26,6 @@
 
 #undef main
 
-extern "C" int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-extern "C" int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-extern "C" int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-extern "C" int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-
 namespace {
 
 void check(bool condition, const char* reason) {
@@ -1022,6 +1018,81 @@ void testOneDevice() {
     check(next.Serial() == 2, "the GPU work and the flip used more than one device");
 }
 
+void testOutputResolution() {
+    const int handle = sceVideoOutOpen(255, 0, 0, nullptr);
+    auto cfg = VideoOutDriver::Get().GetConfig(handle);
+    SDL_DisplayMode mode{};
+    check(SDL_GetCurrentDisplayMode(0, &mode) == 0, "the display mode could not be read");
+    const std::uint32_t expected = (mode.w >= 3840 || mode.h >= 2160) ? 2u : 1u;
+    VideoOutOutputStatus status{};
+    check(sceVideoOutGetOutputStatus(handle, &status) == 0 && status.resolution == expected, "a port without buffers did not report the display's resolution");
+    const std::uint32_t width = expected == 2u ? 1920u : 3840u;
+    const std::uint32_t height = expected == 2u ? 1080u : 2160u;
+    std::vector<std::byte> allocation(static_cast<std::size_t>(width) * height * 4 + 65535);
+    const auto storage = alignedBuffer(allocation);
+    VideoOutBuffers buffer{storage.data(), nullptr, {nullptr, nullptr}};
+    VideoOutBufferAttribute2 attribute{};
+    attribute.width = width;
+    attribute.height = height;
+    attribute.tiling_mode = 1;
+    attribute.pitch_in_pixel = width;
+    attribute.pixel_format = 0x8000000000000000ull;
+    sceVideoOutRegisterBuffers2(handle, 0, 0, &buffer, 1, &attribute, 0, nullptr);
+    check(sceVideoOutSubmitFlip(handle, 0, 1, 1) == 0, "the flip was not accepted");
+    {
+        std::unique_lock lock(cfg->mutex);
+        const bool done = cfg->vblankCond.wait_for(lock, std::chrono::seconds(15), [&] { return cfg->failure || cfg->flipStatus.count == 1; });
+        if (cfg->failure) std::rethrow_exception(cfg->failure);
+        check(done, "the flip did not complete");
+        check(cfg->width == width && cfg->height == height, "the port did not record the buffer size");
+    }
+    check(sceVideoOutGetOutputStatus(handle, &status) == 0 && status.resolution == expected, "the flipped buffer's size changed the reported resolution");
+    sceVideoOutUnregisterBuffers(handle, 0);
+    sceVideoOutClose(handle);
+    LibcRunShutdown_nid_postfix();
+}
+
+void setOutputResolution(const char* value) {
+#ifdef _WIN32
+    check(_putenv_s("APS5_OUTPUT_RESOLUTION", value) == 0, "APS5_OUTPUT_RESOLUTION was not set");
+#else
+    check((*value != '\0' ? setenv("APS5_OUTPUT_RESOLUTION", value, 1) : unsetenv("APS5_OUTPUT_RESOLUTION")) == 0, "APS5_OUTPUT_RESOLUTION was not set");
+#endif
+}
+
+void testOutputResolutionOverride() {
+    const int handle = sceVideoOutOpen(255, 0, 0, nullptr);
+    SDL_DisplayMode mode{};
+    check(SDL_GetCurrentDisplayMode(0, &mode) == 0, "the display mode could not be read");
+    const std::uint32_t following = (mode.w >= 3840 || mode.h >= 2160) ? 2u : 1u;
+    const auto reported = [&] {
+        VideoOutOutputStatus status{};
+        check(sceVideoOutGetOutputStatus(handle, &status) == 0, "the output status was not returned");
+        return status.resolution;
+    };
+    setOutputResolution("");
+    check(reported() == following, "an unset override changed the display's resolution");
+    const std::pair<const char*, std::uint32_t> overrides[] = {{"1920x1080", 1u}, {"1280x720", 1u}, {"3840x2160", 2u}, {"2560x2160", 2u}, {"3840X1", 2u}};
+    for (const auto& [value, expected] : overrides) {
+        setOutputResolution(value);
+        check(reported() == expected, (std::string("the override ") + value + " did not set the reported resolution").c_str());
+        std::array<std::byte, 80> raw{};
+        VideoOutOutputStatus withVrr{};
+        check(sceVideoOutGetOutputStatusWithVrr(handle, raw.data()) == 0, "the VRR status was not returned");
+        std::memcpy(&withVrr, raw.data(), sizeof(withVrr));
+        check(withVrr.resolution == expected,(std::string("the override ") + value + " did not reach the VRR status").c_str());
+    }
+    for (const char* value : {"1920", "1920x", "x1080", "0x1080", "1920x0", "1920x1080x2", " 1920x1080", "1920x1080 ", "-1920x1080", "1920*1080", "4294967296x1080", "high"}) {
+        setOutputResolution(value);
+        const auto message = expectFailure([&] { reported(); });
+        check(message.find("APS5_OUTPUT_RESOLUTION") != std::string::npos && message.find(value) != std::string::npos, (std::string("the malformed value ") + value + " was not rejected by name").c_str());
+    }
+    setOutputResolution("");
+    check(reported() == following, "clearing the override did not restore the display's resolution");
+    sceVideoOutClose(handle);
+    LibcRunShutdown_nid_postfix();
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -1047,6 +1118,8 @@ int main(int argc, char** argv) {
         else if (argc == 2 && std::string(argv[1]) == "unregistered") testUnregisteredBuffer();
         else if (argc == 2 && std::string(argv[1]) == "ps4") testPs4Buffers();
         else if (argc == 2 && std::string(argv[1]) == "cpuflip") testCpuFlipOrder();
+        else if (argc == 2 && std::string(argv[1]) == "resolution") testOutputResolution();
+        else if (argc == 2 && std::string(argv[1]) == "resolution_override") testOutputResolutionOverride();
         else testLifetime(argc == 2 && std::string(argv[1]) == "reopen");
         std::puts("VideoOut flip tests passed");
         return 0;
diff --git a/core/libs/prx/libSceVideoOut/tests/InputMapping.cpp b/core/libs/prx/libSceVideoOut/tests/InputMapping.cpp
index 3497443fcc..6b0c4348ed 100644
--- a/core/libs/prx/libSceVideoOut/tests/InputMapping.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/InputMapping.cpp
@@ -18,6 +18,14 @@ void require(bool condition, const char* message) {
 
 std::filesystem::path root;
 
+void setConfigPath(const std::filesystem::path& path) {
+#ifdef _WIN32
+    require(_wputenv_s(L"ANYPS5_INPUT_CONFIG", path.wstring().c_str()) == 0, "set ANYPS5_INPUT_CONFIG");
+#else
+    require(::setenv("ANYPS5_INPUT_CONFIG", path.string().c_str(), 1) == 0, "set ANYPS5_INPUT_CONFIG");
+#endif
+}
+
 void useConfig(const std::string& text) {
     const auto path = root / "anyps5-input.ini";
     {
@@ -25,11 +33,7 @@ void useConfig(const std::string& text) {
         file << text;
         require(file.good(), "write the input mapping");
     }
-#ifdef _WIN32
-    require(_putenv_s("ANYPS5_INPUT_CONFIG", path.string().c_str()) == 0, "set ANYPS5_INPUT_CONFIG");
-#else
-    require(::setenv("ANYPS5_INPUT_CONFIG", path.string().c_str(), 1) == 0, "set ANYPS5_INPUT_CONFIG");
-#endif
+    setConfigPath(path);
 }
 
 bool rejects(const std::string& text) {
@@ -140,14 +144,6 @@ void mouseLookReject() {
     require(rejects("MouseDecayMs = 20\nmousedecayms = 30\n"), "a mouse setting given twice is rejected");
 }
 
-void setConfigPath(const std::filesystem::path& path) {
-#ifdef _WIN32
-    require(_wputenv_s(L"ANYPS5_INPUT_CONFIG", path.wstring().c_str()) == 0, "set ANYPS5_INPUT_CONFIG");
-#else
-    require(::setenv("ANYPS5_INPUT_CONFIG", path.string().c_str(), 1) == 0, "set ANYPS5_INPUT_CONFIG");
-#endif
-}
-
 void nonAsciiPaths() {
     const std::u8string name = u8"anyps5-input-\u00fc-\u65e5\u672c-" + std::u8string(root.filename().u8string());
     const auto directory = root / std::filesystem::path(name);
diff --git a/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp b/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp
index 759c9708e7..12c9119998 100644
--- a/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/MouseInput.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMouse/include/Api.hpp"
 #include "prx/libSceVideoOut/include/MouseInput.hpp"
 #include "prx/libSceMouse/include/mouse_structs.h"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -9,13 +10,6 @@
 #include <cstdlib>
 #undef main
 
-extern "C" {
-int APS5_VABI sceMouseInit();
-int APS5_VABI sceMouseOpen(int userId, std::int32_t type, std::int32_t index, const void* param);
-int APS5_VABI sceMouseRead(std::int32_t handle, MouseData* data, std::int32_t num);
-int APS5_VABI sceMouseClose(std::int32_t handle);
-}
-
 namespace {
 
 void Require(bool condition, const char* reason) {
diff --git a/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp b/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp
index 5a4a600944..59fafc5235 100644
--- a/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/OutputModePolicy.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceVideoOut/include/Output.hpp"
 #include <cstdio>
 #include <cstdlib>
+#include <initializer_list>
 #include <stdexcept>
 
 static void Require(bool value, const char* reason) {
diff --git a/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp b/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp
index cec6638fbd..3bdec619d1 100644
--- a/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/PadSdl.cpp
@@ -1,13 +1,99 @@
 #include "SDL_config.h"
-
+#include "SDL.h"
+#include "SDL_joystick.h"
+#include "SDL_gamecontroller.h"
+#include "prx/libSceVideoOut/include/PadInput.hpp"
+#include "prx/libSceVideoOut/include/DisplayWindow.hpp"
+#include "prx/libScePad/include/PadState.hpp"
 #include <cstdio>
+#include <cstdlib>
+#undef main
+
+namespace {
+
+static void Require(bool condition) {
+    if (!condition) {
+        std::abort();
+    }
+}
+
+}
 
 int main() {
 #ifdef SDL_JOYSTICK_HIDAPI
     std::puts("pad_sdl: SDL drives controllers through HIDAPI");
-    return 0;
 #else
     std::fputs("pad_sdl: SDL is built without HIDAPI, so a DualSense gets no light bar, touchpad or trigger effects\n", stderr);
     return 1;
 #endif
+
+    Require(SDL_Init(SDL_INIT_GAMECONTROLLER | SDL_INIT_JOYSTICK) == 0);
+
+    SDL_VirtualJoystickDesc desc{};
+    desc.version = SDL_VIRTUAL_JOYSTICK_DESC_VERSION;
+    desc.type = SDL_JOYSTICK_TYPE_GAMECONTROLLER;
+    desc.naxes = 6;
+    desc.nbuttons = 16;
+    desc.name = "Virtual Controller 0";
+    const int dev0 = SDL_JoystickAttachVirtualEx(&desc);
+    Require(dev0 >= 0);
+    Require(SDL_IsGameController(dev0));
+
+    DisplayWindow window;
+    PadInput padInput;
+    Require(padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+
+    SDL_Event add0{};
+    add0.type = SDL_CONTROLLERDEVICEADDED;
+    add0.cdevice.which = dev0;
+    padInput.HandleEvent(add0, window);
+    Require(padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+
+    desc.name = "Virtual Controller 1";
+    const int dev1 = SDL_JoystickAttachVirtualEx(&desc);
+    Require(dev1 >= 0);
+    Require(SDL_IsGameController(dev1));
+
+    SDL_Event add1{};
+    add1.type = SDL_CONTROLLERDEVICEADDED;
+    add1.cdevice.which = dev1;
+    padInput.HandleEvent(add1, window);
+    Require(padInput.SlotOccupied(0));
+    Require(padInput.SlotOccupied(1));
+    Require(!padInput.SlotOccupied(2));
+    Require(Pad::IsConnected(1));
+
+    const SDL_JoystickID id0 = SDL_JoystickGetDeviceInstanceID(dev0);
+    SDL_Event rem0{};
+    rem0.type = SDL_CONTROLLERDEVICEREMOVED;
+    rem0.cdevice.which = id0;
+    padInput.HandleEvent(rem0, window);
+    Require(!padInput.SlotOccupied(0));
+    Require(padInput.SlotOccupied(1));
+    Require(Pad::IsConnected(1));
+
+    padInput.HandleEvent(add0, window);
+    Require(padInput.SlotOccupied(0));
+    Require(padInput.SlotOccupied(1));
+
+    const SDL_JoystickID id1 = SDL_JoystickGetDeviceInstanceID(dev1);
+    SDL_Event rem1{};
+    rem1.type = SDL_CONTROLLERDEVICEREMOVED;
+    rem1.cdevice.which = id1;
+    padInput.HandleEvent(rem1, window);
+    Require(padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+    Require(!Pad::IsConnected(1));
+
+    padInput.HandleEvent(rem0, window);
+    Require(!padInput.SlotOccupied(0));
+    Require(!padInput.SlotOccupied(1));
+
+    Require(SDL_JoystickDetachVirtual(dev1) == 0);
+    Require(SDL_JoystickDetachVirtual(dev0) == 0);
+    SDL_QuitSubSystem(SDL_INIT_GAMECONTROLLER | SDL_INIT_JOYSTICK);
+
+    return 0;
 }
diff --git a/core/libs/prx/libSceVideoOutSecondary/libSceVideoOutSecondary.hpp b/core/libs/prx/libSceVideoOutSecondary/libSceVideoOutSecondary.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoOutSecondary/libSceVideoOutSecondary.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideoRecording.native/libSceVideoRecording.native.hpp b/core/libs/prx/libSceVideoRecording.native/libSceVideoRecording.native.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecording.native/libSceVideoRecording.native.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideoRecording/libSceVideoRecording.hpp b/core/libs/prx/libSceVideoRecording/libSceVideoRecording.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecording/libSceVideoRecording.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideoRecordingP/Export.cpp b/core/libs/prx/libSceVideoRecordingP/Export.cpp
index c3b67583f6..6166139756 100644
--- a/core/libs/prx/libSceVideoRecordingP/Export.cpp
+++ b/core/libs/prx/libSceVideoRecordingP/Export.cpp
@@ -1,51 +1,15 @@
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct VideoRecordingContext;
-
-struct VideoRecordingQueryParam {
-    std::uint64_t size;
-    std::uint32_t reserved8;
-    std::int32_t mode;
-    std::uint8_t reserved16[12];
-    std::uint32_t option;
-    std::uint8_t reserved32[32];
-};
-
 static_assert(sizeof(VideoRecordingQueryParam) == 64);
 static_assert(offsetof(VideoRecordingQueryParam, mode) == 12);
 static_assert(offsetof(VideoRecordingQueryParam, option) == 28);
 
-
-struct VideoRecordingSupportInfo {
-    std::uint8_t data[18];
-};
-
 static_assert(sizeof(VideoRecordingSupportInfo) == 18);
 
-struct VideoRecordingParam {
-    std::uint64_t size;
-    std::int32_t threadPriority;
-    std::uint32_t duration;
-    std::uint32_t mode;
-    std::int32_t outputMode;
-    std::uint32_t option;
-    std::uint32_t format;
-};
-
-struct VideoRecordingParam2 {
-    std::uint64_t size;
-    std::uint64_t affinityMask;
-    std::int32_t threadPriority;
-    std::uint32_t duration;
-    std::uint32_t mode;
-    std::int32_t outputMode;
-    std::uint32_t option;
-    std::uint32_t format;
-};
-
 static_assert(sizeof(VideoRecordingParam) == 32);
 static_assert(offsetof(VideoRecordingParam, duration) == 12);
 static_assert(offsetof(VideoRecordingParam, format) == 28);
diff --git a/core/libs/prx/libSceVideoRecordingP/include/Api.hpp b/core/libs/prx/libSceVideoRecordingP/include/Api.hpp
new file mode 100644
index 0000000000..2f831a0c7e
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecordingP/include/Api.hpp
@@ -0,0 +1,68 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+struct VideoRecordingContext;
+
+struct VideoRecordingParam {
+    std::uint64_t size;
+    std::int32_t threadPriority;
+    std::uint32_t duration;
+    std::uint32_t mode;
+    std::int32_t outputMode;
+    std::uint32_t option;
+    std::uint32_t format;
+};
+
+struct VideoRecordingParam2 {
+    std::uint64_t size;
+    std::uint64_t affinityMask;
+    std::int32_t threadPriority;
+    std::uint32_t duration;
+    std::uint32_t mode;
+    std::int32_t outputMode;
+    std::uint32_t option;
+    std::uint32_t format;
+};
+
+struct VideoRecordingQueryParam {
+    std::uint64_t size;
+    std::uint32_t reserved8;
+    std::int32_t mode;
+    std::uint8_t reserved16[12];
+    std::uint32_t option;
+    std::uint8_t reserved32[32];
+};
+
+struct VideoRecordingSupportInfo {
+    std::uint8_t data[18];
+};
+
+extern "C" {
+
+void APS5_VABI _sceVideoRecordingQueryParam_nid_postfix(VideoRecordingQueryParam* param);
+int APS5_VABI sceVideoRecordingClose(int discard);
+int APS5_VABI sceVideoRecordingCloseByHandle(VideoRecordingContext* handle, int discard);
+int APS5_VABI sceVideoRecordingCopyBGRAtoNV12(void* dst, const void* src, uint32_t width, uint32_t height);
+int APS5_VABI sceVideoRecordingGetInfo(std::int32_t info, void*, std::size_t);
+int APS5_VABI sceVideoRecordingGetInfoByHandle(VideoRecordingContext* handle, int32_t info, void* data, size_t size);
+int APS5_VABI sceVideoRecordingGetStatus(void);
+int APS5_VABI sceVideoRecordingGetSupportInfo(VideoRecordingSupportInfo* info);
+int APS5_VABI sceVideoRecordingGetVideoOutMode(std::uint32_t* mode);
+int APS5_VABI sceVideoRecordingInit(void);
+int APS5_VABI sceVideoRecordingInitialize(void* param);
+int APS5_VABI sceVideoRecordingOpen(const char* path, const VideoRecordingParam* param, void* heap, int heapSize);
+int APS5_VABI sceVideoRecordingOpen2(const char* path, const VideoRecordingParam2* param, void* heap, int heapSize);
+std::int64_t APS5_VABI sceVideoRecordingQueryHddSize2(const VideoRecordingParam2* param);
+int APS5_VABI sceVideoRecordingQueryMemSize(const VideoRecordingParam* param);
+int APS5_VABI sceVideoRecordingQueryMemSize2(const VideoRecordingParam2* param);
+int APS5_VABI sceVideoRecordingRestModeProcessGetStatus(void* status);
+int APS5_VABI sceVideoRecordingRestModeProcessStart(void* param);
+int APS5_VABI sceVideoRecordingSendCommand(int cmd, const void* param);
+int APS5_VABI sceVideoRecordingSetInfo(std::int32_t info, const void* data, std::size_t size);
+int APS5_VABI sceVideoRecordingStart(void);
+int APS5_VABI sceVideoRecordingStop(void);
+int APS5_VABI sceVideoRecordingTerm(void);
+int APS5_VABI videoRecordingUnknown_iQS6DUtLybE(void);
+
+}
diff --git a/core/libs/prx/libSceVideoRecordingP/libSceVideoRecordingP.hpp b/core/libs/prx/libSceVideoRecordingP/libSceVideoRecordingP.hpp
new file mode 100644
index 0000000000..33ebd6f0fc
--- /dev/null
+++ b/core/libs/prx/libSceVideoRecordingP/libSceVideoRecordingP.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoStreamingEngine/Export.cpp b/core/libs/prx/libSceVideoStreamingEngine/Export.cpp
index 1a09e3b9df..f773806a45 100644
--- a/core/libs/prx/libSceVideoStreamingEngine/Export.cpp
+++ b/core/libs/prx/libSceVideoStreamingEngine/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoStreamingEngine/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVideoStreamingEngine/include/Api.hpp b/core/libs/prx/libSceVideoStreamingEngine/include/Api.hpp
new file mode 100644
index 0000000000..2b807d7c25
--- /dev/null
+++ b/core/libs/prx/libSceVideoStreamingEngine/include/Api.hpp
@@ -0,0 +1,20 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVideoStreamingEngineDestroyMediaKeySystemAccess();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGenerateRequest();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGetExpiration();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGetKeyStatuses();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionGetSessionId();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionLoad();
+int APS5_VABI sceVideoStreamingEngineMediaKeySessionSetEventHandler();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessCreateMediaKeys();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessDestroyMediaKeys();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessGetKeySystem();
+int APS5_VABI sceVideoStreamingEngineMediaKeySystemAccessSetCdmStorageConfig();
+int APS5_VABI sceVideoStreamingEngineMediaKeysCreateSession();
+
+}
diff --git a/core/libs/prx/libSceVideoStreamingEngine/libSceVideoStreamingEngine.hpp b/core/libs/prx/libSceVideoStreamingEngine/libSceVideoStreamingEngine.hpp
new file mode 100644
index 0000000000..f0f435d15e
--- /dev/null
+++ b/core/libs/prx/libSceVideoStreamingEngine/libSceVideoStreamingEngine.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideoStreamingEngine/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideoStreamingEngine_sys/libSceVideoStreamingEngine_sys.hpp b/core/libs/prx/libSceVideoStreamingEngine_sys/libSceVideoStreamingEngine_sys.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVideoStreamingEngine_sys/libSceVideoStreamingEngine_sys.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVideodec/Export.cpp b/core/libs/prx/libSceVideodec/Export.cpp
index 56919ce362..efb762dbfe 100644
--- a/core/libs/prx/libSceVideodec/Export.cpp
+++ b/core/libs/prx/libSceVideodec/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#include "prx/libSceVideodec/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -10,6 +12,8 @@
 
 namespace {
 
+using namespace SceVideodec;
+
 constexpr int VideodecErrorApiFail = static_cast<int>(0x80C10000);
 constexpr int VideodecErrorStructSize = static_cast<int>(0x80C10002);
 constexpr int VideodecErrorHandle = static_cast<int>(0x80C10003);
@@ -24,142 +28,6 @@ constexpr int VideodecErrorDecodeAu = static_cast<int>(0x80C10011);
 constexpr std::uint32_t CodecAvc = 1;
 constexpr std::uint32_t PitchAlignment = 64;
 
-struct ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint64_t videodecFlags;
-};
-
-struct ResourceInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct Ctrl {
-    std::uint64_t thisSize;
-    void* handle;
-    std::uint64_t version;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct AvcInfo {
-    std::uint32_t numUnitsInTick;
-    std::uint32_t timeScale;
-    std::uint8_t fixedFrameRateFlag;
-    std::uint8_t aspectRatioIdc;
-    std::uint16_t sarWidth;
-    std::uint16_t sarHeight;
-    std::uint8_t colourPrimaries;
-    std::uint8_t transferCharacteristics;
-    std::uint8_t matrixCoefficients;
-    std::uint8_t videoFullRangeFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-};
-
-union CodecInfo {
-    std::uint8_t reserved[64];
-    AvcInfo avc;
-};
-
-struct PictureInfo {
-    std::uint64_t thisSize;
-    std::uint32_t isValid;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    std::uint32_t isErrorPic;
-    std::uint64_t ptsData;
-    std::uint64_t attachedData;
-    CodecInfo codec;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct Decoder2ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct Decoder2MemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct Decoder2FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct Decoder2OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Decoder2AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
-
 struct Decoder2Crop {
     std::uint32_t left;
     std::uint32_t right;
@@ -168,7 +36,11 @@ struct Decoder2Crop {
 };
 
 static_assert(sizeof(ConfigInfo) == 40 && sizeof(ResourceInfo) == 56 && sizeof(Ctrl) == 24);
-static_assert(sizeof(FrameBuffer) == 24 && sizeof(InputData) == 48 && sizeof(PictureInfo) == 112);
+static_assert(offsetof(ConfigInfo, maxFrameWidth) == 20 && offsetof(ConfigInfo, videodecFlags) == 32);
+static_assert(offsetof(ResourceInfo, cpuGpuMemorySize) == 24 && offsetof(ResourceInfo, maxFrameBufferSize) == 40);
+static_assert(offsetof(ResourceInfo, frameBufferAlignment) == 48);
+static_assert(sizeof(SceVideodec2::DecoderConfigInfo) == 40 && sizeof(SceVideodec2::DecoderMemoryInfo) == 72);
+static_assert(sizeof(FrameBuffer) == 24 && sizeof(SceVideodec2::InputData) == 48 && sizeof(PictureInfo) == 112);
 static_assert(sizeof(CodecInfo) == 64 && offsetof(PictureInfo, codec) == 48);
 
 struct Decoder {
@@ -193,13 +65,7 @@ std::uint32_t AlignUp(std::uint32_t value, std::uint32_t alignment) {
 }
 
 extern "C" {
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const Decoder2ConfigInfo*, Decoder2MemoryInfo*);
-int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const Decoder2ConfigInfo*, const Decoder2MemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t, const InputData*, Decoder2FrameBuffer*, Decoder2OutputInfo*);
-int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t, Decoder2FrameBuffer*, Decoder2OutputInfo*);
-int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const Decoder2OutputInfo*, Decoder2AvcPictureInfo*, Decoder2AvcPictureInfo*);
+
 void Videodec2PictureCrop_nid_no_patch(std::uint64_t, const void*, Decoder2Crop*);
 }
 
@@ -212,7 +78,21 @@ struct Geometry {
     Decoder2Crop crop{};
 };
 
-Geometry Measure(const Decoder2OutputInfo& output, const Decoder2Crop& crop) {
+SceVideodec2::DecoderConfigInfo MapConfig(const ConfigInfo& config) {
+    SceVideodec2::DecoderConfigInfo decoderConfig{};
+    decoderConfig.thisSize = sizeof(SceVideodec2::DecoderConfigInfo);
+    decoderConfig.resourceType = 1;
+    decoderConfig.codecType = CodecAvc;
+    decoderConfig.profile = config.profile;
+    decoderConfig.maxLevel = config.maxLevel;
+    decoderConfig.maxFrameWidth = config.maxFrameWidth;
+    decoderConfig.maxFrameHeight = config.maxFrameHeight;
+    decoderConfig.maxDpbFrameCount = config.maxDpbFrameCount;
+    decoderConfig.decodePipelineDepth = 1;
+    return decoderConfig;
+}
+
+Geometry Measure(const SceVideodec2::OutputInfo& output, const Decoder2Crop& crop) {
     Geometry geometry;
     geometry.width = output.frameWidth;
     geometry.height = output.frameHeight;
@@ -221,7 +101,7 @@ Geometry Measure(const Decoder2OutputInfo& output, const Decoder2Crop& crop) {
     return geometry;
 }
 
-void FillPictureInfo(const Geometry& geometry, const Decoder2OutputInfo& output, PictureInfo* picture) {
+void FillPictureInfo(const Geometry& geometry, const SceVideodec2::OutputInfo& output, PictureInfo* picture) {
     picture->isValid = 0;
     picture->codecType = 0;
     picture->frameWidth = 0;
@@ -243,7 +123,7 @@ void FillPictureInfo(const Geometry& geometry, const Decoder2OutputInfo& output,
     picture->codec.avc.frameCropBottomOffset = geometry.crop.bottom / 2;
 }
 
-int CopyPicture(const Decoder2OutputInfo& output, const Geometry& geometry, const FrameBuffer* frameBuffer) {
+int CopyPicture(const SceVideodec2::OutputInfo& output, const Geometry& geometry, const FrameBuffer* frameBuffer) {
     const auto bytes = static_cast<std::uint64_t>(geometry.pitch) * geometry.height * 3 / 2;
     if (frameBuffer->frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
     if (frameBuffer->frameBufferSize < bytes) return VideodecErrorFrameBufferSize;
@@ -266,18 +146,9 @@ extern "C" {
 int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo* config, const ResourceInfo* resource, Ctrl* ctrl) {
     if (config == nullptr || resource == nullptr || ctrl == nullptr) return VideodecErrorArgumentPointer;
     if (config->thisSize < sizeof(ConfigInfo) || resource->thisSize < sizeof(ResourceInfo)) return VideodecErrorStructSize;
-    Decoder2ConfigInfo decoderConfig{};
-    decoderConfig.thisSize = sizeof(Decoder2ConfigInfo);
-    decoderConfig.resourceType = 1;
-    decoderConfig.codecType = CodecAvc;
-    decoderConfig.profile = config->profile;
-    decoderConfig.maxLevel = config->maxLevel;
-    decoderConfig.maxFrameWidth = config->maxFrameWidth;
-    decoderConfig.maxFrameHeight = config->maxFrameHeight;
-    decoderConfig.maxDpbFrameCount = config->maxDpbFrameCount;
-    decoderConfig.decodePipelineDepth = 1;
-    Decoder2MemoryInfo decoderMemory{};
-    decoderMemory.thisSize = sizeof(Decoder2MemoryInfo);
+    const auto decoderConfig = MapConfig(*config);
+    SceVideodec2::DecoderMemoryInfo decoderMemory{};
+    decoderMemory.thisSize = sizeof(SceVideodec2::DecoderMemoryInfo);
     decoderMemory.cpuMemorySize = resource->cpuMemorySize;
     decoderMemory.cpuMemory = resource->cpuMemory;
     decoderMemory.cpuGpuMemorySize = resource->cpuGpuMemorySize;
@@ -286,6 +157,7 @@ int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo* config, const ResourceI
     decoderMemory.frameBufferAlignment = resource->frameBufferAlignment;
     try {
         sceVideodec2QueryDecoderMemoryInfo_nid_postfix(&decoderConfig, &decoderMemory);
+
     } catch (const std::exception&) {
         return VideodecErrorConfigInfo;
     }
@@ -304,11 +176,11 @@ int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo* config, const ResourceI
     return 0;
 }
 
-int APS5_VABI sceVideodecDecode(Ctrl* ctrl, const InputData* input, FrameBuffer* frameBuffer, PictureInfo* picture) {
+int APS5_VABI sceVideodecDecode(Ctrl* ctrl, const SceVideodec2::InputData* input, FrameBuffer* frameBuffer, PictureInfo* picture) {
     if (ctrl == nullptr || input == nullptr || picture == nullptr) return VideodecErrorArgumentPointer;
     if (frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
     if (ctrl->thisSize < sizeof(Ctrl)) return VideodecErrorStructSize;
-    if (input->thisSize < sizeof(InputData)) return VideodecErrorStructSize;
+    if (input->thisSize < sizeof(SceVideodec2::InputData)) return VideodecErrorStructSize;
     if (picture->thisSize < sizeof(PictureInfo)) return VideodecErrorStructSize;
     if (frameBuffer->thisSize < sizeof(FrameBuffer)) return VideodecErrorStructSize;
     auto* decoder = FindDecoder(ctrl->handle);
@@ -316,20 +188,21 @@ int APS5_VABI sceVideodecDecode(Ctrl* ctrl, const InputData* input, FrameBuffer*
     if (input->auData == nullptr) return VideodecErrorAuPointer;
     if (input->auSize == 0) return VideodecErrorAuSize;
     if (frameBuffer->frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
-    Decoder2FrameBuffer target{};
-    target.thisSize = sizeof(Decoder2FrameBuffer);
+    SceVideodec2::FrameBuffer target{};
+    target.thisSize = sizeof(SceVideodec2::FrameBuffer);
     target.frameBuffer = decoder->picture.data();
     target.frameBufferSize = decoder->picture.size();
-    Decoder2OutputInfo output{sizeof(Decoder2OutputInfo)};
+    SceVideodec2::OutputInfo output{sizeof(SceVideodec2::OutputInfo)};
     try {
         sceVideodec2Decode_nid_postfix(decoder->handle, input, &target, &output);
+
     } catch (const std::exception&) {
         return VideodecErrorDecodeAu;
     }
     Decoder2Crop crop{};
     if (output.isValid) Videodec2PictureCrop_nid_no_patch(decoder->handle, output.frameBuffer, &crop);
     const auto geometry = Measure(output, crop);
-    Decoder2AvcPictureInfo avc{sizeof(Decoder2AvcPictureInfo)};
+    SceVideodec2::AvcPictureInfo avc{sizeof(SceVideodec2::AvcPictureInfo)};
     if (output.isValid) sceVideodec2GetAvcPictureInfo_nid_postfix(&output, &avc, nullptr);
     FillPictureInfo(geometry, output, picture);
     picture->ptsData = avc.ptsData;
@@ -353,6 +226,7 @@ int APS5_VABI sceVideodecDeleteDecoder(Ctrl* ctrl) {
     delete decoder;
     try {
         sceVideodec2DeleteDecoder_nid_postfix(handle);
+
     } catch (const std::exception&) {
         return VideodecErrorApiFail;
     }
@@ -368,20 +242,21 @@ int APS5_VABI sceVideodecFlush(Ctrl* ctrl, FrameBuffer* frameBuffer, PictureInfo
     auto* decoder = FindDecoder(ctrl->handle);
     if (decoder == nullptr) return VideodecErrorHandle;
     if (frameBuffer->frameBuffer == nullptr) return VideodecErrorFrameBufferPointer;
-    Decoder2FrameBuffer target{};
-    target.thisSize = sizeof(Decoder2FrameBuffer);
+    SceVideodec2::FrameBuffer target{};
+    target.thisSize = sizeof(SceVideodec2::FrameBuffer);
     target.frameBuffer = decoder->picture.data();
     target.frameBufferSize = decoder->picture.size();
-    Decoder2OutputInfo output{sizeof(Decoder2OutputInfo)};
+    SceVideodec2::OutputInfo output{sizeof(SceVideodec2::OutputInfo)};
     try {
         sceVideodec2Flush_nid_postfix(decoder->handle, &target, &output);
+
     } catch (const std::exception&) {
         return VideodecErrorDecodeAu;
     }
     Decoder2Crop crop{};
     if (output.isValid) Videodec2PictureCrop_nid_no_patch(decoder->handle, output.frameBuffer, &crop);
     const auto geometry = Measure(output, crop);
-    Decoder2AvcPictureInfo avc{sizeof(Decoder2AvcPictureInfo)};
+    SceVideodec2::AvcPictureInfo avc{sizeof(SceVideodec2::AvcPictureInfo)};
     if (output.isValid) sceVideodec2GetAvcPictureInfo_nid_postfix(&output, &avc, nullptr);
     FillPictureInfo(geometry, output, picture);
     picture->ptsData = avc.ptsData;
@@ -397,6 +272,7 @@ int APS5_VABI sceVideodecReset(Ctrl* ctrl) {
     if (decoder == nullptr) return VideodecErrorHandle;
     try {
         sceVideodec2Reset_nid_postfix(decoder->handle);
+
     } catch (const std::exception&) {
         return VideodecErrorApiFail;
     }
@@ -407,8 +283,22 @@ int APS5_VABI sceVideodecMapMemory(void) {
     return 0;
 }
 
-int APS5_VABI sceVideodecQueryResourceInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVideodecQueryResourceInfo(const ConfigInfo* config, ResourceInfo* resource) {
+    if (config == nullptr || resource == nullptr) return VideodecErrorArgumentPointer;
+    if (config->thisSize < sizeof(ConfigInfo) || resource->thisSize < sizeof(ResourceInfo)) return VideodecErrorStructSize;
+    const auto decoderConfig = MapConfig(*config);
+    SceVideodec2::DecoderMemoryInfo decoderMemory{};
+    decoderMemory.thisSize = sizeof(SceVideodec2::DecoderMemoryInfo);
+    try {
+        sceVideodec2QueryDecoderMemoryInfo_nid_postfix(&decoderConfig, &decoderMemory);
+
+    } catch (const std::exception&) {
+        return VideodecErrorConfigInfo;
+    }
+    resource->cpuMemorySize = decoderMemory.cpuMemorySize;
+    resource->cpuGpuMemorySize = decoderMemory.cpuGpuMemorySize;
+    resource->maxFrameBufferSize = decoderMemory.maxFrameBufferSize;
+    resource->frameBufferAlignment = decoderMemory.frameBufferAlignment;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceVideodec/include/Api.hpp b/core/libs/prx/libSceVideodec/include/Api.hpp
new file mode 100644
index 0000000000..46fd7ef835
--- /dev/null
+++ b/core/libs/prx/libSceVideodec/include/Api.hpp
@@ -0,0 +1,119 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <map>
+#include <mutex>
+#include <stdexcept>
+#include <vector>
+
+namespace SceVideodec {
+
+struct ConfigInfo {
+    std::uint64_t thisSize;
+    std::uint32_t codecType;
+    std::uint32_t profile;
+    std::uint32_t maxLevel;
+    std::int32_t maxFrameWidth;
+    std::int32_t maxFrameHeight;
+    std::int32_t maxDpbFrameCount;
+    std::uint64_t videodecFlags;
+};
+
+}
+
+namespace SceVideodec {
+
+struct ResourceInfo {
+    std::uint64_t thisSize;
+    std::uint64_t cpuMemorySize;
+    void* cpuMemory;
+    std::uint64_t cpuGpuMemorySize;
+    void* cpuGpuMemory;
+    std::uint64_t maxFrameBufferSize;
+    std::uint32_t frameBufferAlignment;
+};
+
+}
+
+namespace SceVideodec {
+
+struct Ctrl {
+    std::uint64_t thisSize;
+    void* handle;
+    std::uint64_t version;
+};
+
+}
+
+namespace SceVideodec {
+
+struct FrameBuffer {
+    std::uint64_t thisSize;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+};
+
+}
+
+namespace SceVideodec {
+
+struct AvcInfo {
+    std::uint32_t numUnitsInTick;
+    std::uint32_t timeScale;
+    std::uint8_t fixedFrameRateFlag;
+    std::uint8_t aspectRatioIdc;
+    std::uint16_t sarWidth;
+    std::uint16_t sarHeight;
+    std::uint8_t colourPrimaries;
+    std::uint8_t transferCharacteristics;
+    std::uint8_t matrixCoefficients;
+    std::uint8_t videoFullRangeFlag;
+    std::uint32_t frameCropLeftOffset;
+    std::uint32_t frameCropRightOffset;
+    std::uint32_t frameCropTopOffset;
+    std::uint32_t frameCropBottomOffset;
+};
+
+}
+
+namespace SceVideodec {
+
+union CodecInfo {
+    std::uint8_t reserved[64];
+    AvcInfo avc;
+};
+
+}
+
+namespace SceVideodec {
+
+struct PictureInfo {
+    std::uint64_t thisSize;
+    std::uint32_t isValid;
+    std::uint32_t codecType;
+    std::uint32_t frameWidth;
+    std::uint32_t framePitch;
+    std::uint32_t frameHeight;
+    std::uint32_t isErrorPic;
+    std::uint64_t ptsData;
+    std::uint64_t attachedData;
+    CodecInfo codec;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVideodecCreateDecoder(const SceVideodec::ConfigInfo* config, const SceVideodec::ResourceInfo* resource, SceVideodec::Ctrl* ctrl);
+int APS5_VABI sceVideodecDecode(SceVideodec::Ctrl* ctrl, const SceVideodec2::InputData* input, SceVideodec::FrameBuffer* frameBuffer, SceVideodec::PictureInfo* picture);
+int APS5_VABI sceVideodecDeleteDecoder(SceVideodec::Ctrl* ctrl);
+int APS5_VABI sceVideodecFlush(SceVideodec::Ctrl* ctrl, SceVideodec::FrameBuffer* frameBuffer, SceVideodec::PictureInfo* picture);
+int APS5_VABI sceVideodecReset(SceVideodec::Ctrl* ctrl);
+int APS5_VABI sceVideodecMapMemory(void);
+int APS5_VABI sceVideodecQueryResourceInfo(const SceVideodec::ConfigInfo* config, SceVideodec::ResourceInfo* resource);
+
+}
diff --git a/core/libs/prx/libSceVideodec/libSceVideodec.hpp b/core/libs/prx/libSceVideodec/libSceVideodec.hpp
new file mode 100644
index 0000000000..8fa57dc2dd
--- /dev/null
+++ b/core/libs/prx/libSceVideodec/libSceVideodec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideodec/include/Api.hpp"
diff --git a/core/libs/prx/libSceVideodec2/Export.cpp b/core/libs/prx/libSceVideodec2/Export.cpp
index 99b68e36c1..de23de7b72 100644
--- a/core/libs/prx/libSceVideodec2/Export.cpp
+++ b/core/libs/prx/libSceVideodec2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include <array>
 #include <span>
 #include <cstdint>
@@ -24,6 +25,8 @@ extern "C" {
 
 namespace {
 
+using namespace SceVideodec2;
+
 constexpr std::uint64_t WorkMemoryBytes = 1u << 20u;
 constexpr std::uint32_t PitchAlignment = 256;
 constexpr std::uint32_t HeightAlignment = 32;
@@ -33,107 +36,6 @@ constexpr std::uint32_t CodecVp9 = 2382845;
 constexpr int Videodec2ErrorAccessUnitSize = static_cast<int>(0x811D010Du);
 constexpr int Videodec2ErrorAccessUnitPointer = static_cast<int>(0x811D010Eu);
 
-struct ComputeMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-};
-
-struct ComputeConfigInfo {
-    std::uint64_t thisSize;
-    std::uint16_t computePipeId;
-    std::uint16_t computeQueueId;
-    bool checkMemoryType;
-};
-
-struct DecoderConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
-
 static_assert(sizeof(Vp9PictureInfo) == 88);
 static_assert(offsetof(Vp9PictureInfo, colorSpace) == 60);
 
@@ -283,6 +185,20 @@ struct Picture {
     bool idr = false;
     Vp9PictureInfo vp9{};
     Crop crop{};
+    bool hevcIdr = false;
+    std::uint8_t bitDepthMinus8 = 0;
+};
+
+struct PictureHeader {
+    std::uint64_t pts;
+    std::uint64_t dts;
+    std::uint64_t attached;
+    bool keyFrame;
+    bool hevcIdr;
+    std::uint32_t profile;
+    std::uint32_t level;
+    Crop crop;
+    std::uint8_t bitDepthMinus8;
 };
 
 struct FrameDeleter {
@@ -437,6 +353,16 @@ bool CarriesAvcSlice(const std::vector<std::uint8_t>& unit) {
     return false;
 }
 
+bool StartsHevcIdr(const std::vector<std::uint8_t>& unit) {
+    for (std::size_t index = 0; index + 3 < unit.size(); ++index) {
+        if (unit[index] != 0 || unit[index + 1] != 0 || unit[index + 2] != 1) continue;
+        const auto type = (unit[index + 3] >> 1u) & 0x3fu;
+        if (type < 32) return type == 19 || type == 20;
+        index += 2;
+    }
+    return false;
+}
+
 void Receive(Decoder& decoder) {
     for (;;) {
         FramePointer frame(av_frame_alloc());
@@ -526,6 +452,7 @@ void EmitDecoded(std::uint64_t handle, Decoder& decoder, FrameBuffer* frame, Out
     if (decoder.context->profile > 0) decoder.profile = static_cast<std::uint32_t>(decoder.context->profile) & 0xffu;
     if (decoder.context->level > 0) decoder.level = static_cast<std::uint32_t>(decoder.context->level);
     if (!WriteNv12(decoder, *picture, static_cast<std::uint8_t*>(frame->frameBuffer), frame->frameBufferSize)) throw std::runtime_error("Videodec2: NV12 conversion failed");
+    timestamps.bitDepthMinus8 = decoder.sampleBytes == 2 ? 2 : 0;
     const auto pitch = PitchBytes(decoder.width, decoder.sampleBytes);
     frame->isAccepted = true;
     output->isValid = true;
@@ -664,7 +591,9 @@ int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t handle, const InputDa
     std::memcpy(packet->data + decoder.parameterSets.size(), unit->data(), unit->size());
     decoder.parameterSets.clear();
     packet->pts = decoder.nextKey;
-    decoder.inputs.emplace(decoder.nextKey++, picture);
+    auto tagged = picture;
+    tagged.hevcIdr = decoder.codec == CodecHevc && StartsHevcIdr(*unit);
+    decoder.inputs.emplace(decoder.nextKey++, tagged);
     Send(decoder, packet);
     EmitDecoded(handle, decoder, frame, output);
     return 0;
@@ -676,7 +605,7 @@ int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t handle, FrameBuffer* f
     if (!found) throw std::runtime_error("Videodec2: invalid decoder handle");
     auto& decoder = *found;
     std::lock_guard guard(decoder.mutex);
-    if (!decoder.flushing) {
+    if (!decoder.flushing && decoder.ready.empty() && !decoder.inputs.empty()) {
         Send(decoder, nullptr);
         decoder.flushing = true;
     }
@@ -776,15 +705,23 @@ int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const OutputInfo* output
     return 0;
 }
 
-void Videodec2PictureCrop_nid_no_patch(std::uint64_t handle, const void* frameBuffer, Crop* crop) {
-    if (!crop) throw std::runtime_error("Videodec2: invalid argument pointer");
+void Videodec2PictureHeader_nid_no_patch(std::uint64_t handle, const void* frameBuffer, PictureHeader* header) {
+    if (!header) throw std::runtime_error("Videodec2: invalid argument pointer");
     const auto found = FindDecoder(handle);
     if (!found) throw std::runtime_error("Videodec2: invalid decoder handle");
     auto& decoder = *found;
     std::lock_guard guard(decoder.mutex);
     const auto picture = decoder.pictures.find(frameBuffer);
     if (picture == decoder.pictures.end()) throw std::runtime_error("Videodec2: unknown frame buffer");
-    *crop = picture->second.crop;
+    const auto& stored = picture->second;
+    *header = {stored.pts, stored.dts, stored.attached, stored.idr, stored.hevcIdr, decoder.profile, decoder.level, stored.crop, stored.bitDepthMinus8};
+}
+
+void Videodec2PictureCrop_nid_no_patch(std::uint64_t handle, const void* frameBuffer, Crop* crop) {
+    if (!crop) throw std::runtime_error("Videodec2: invalid argument pointer");
+    PictureHeader header{};
+    Videodec2PictureHeader_nid_no_patch(handle, frameBuffer, &header);
+    *crop = header.crop;
 }
 
 }
diff --git a/core/libs/prx/libSceVideodec2/Unimplemented.cpp b/core/libs/prx/libSceVideodec2/Unimplemented.cpp
index 1cad37fd28..62a9691332 100644
--- a/core/libs/prx/libSceVideodec2/Unimplemented.cpp
+++ b/core/libs/prx/libSceVideodec2/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
@@ -55,4 +56,7 @@ int APS5_VABI sceVideodec2GetHevcPictureInfo() {
     NotImplemented_nid_no_patch(__func__);
 }
 
+int APS5_VABI sceVideodec2InitLibrary() {
+    NotImplemented_nid_no_patch(__func__);
+}
 }
diff --git a/core/libs/prx/libSceVideodec2/include/Api.hpp b/core/libs/prx/libSceVideodec2/include/Api.hpp
new file mode 100644
index 0000000000..ff71178c8c
--- /dev/null
+++ b/core/libs/prx/libSceVideodec2/include/Api.hpp
@@ -0,0 +1,186 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <array>
+#include <cerrno>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <deque>
+#include <limits>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <span>
+#include <stdexcept>
+#include <vector>
+
+namespace SceVideodec2 {
+
+struct ComputeMemoryInfo {
+    std::uint64_t thisSize;
+    std::uint64_t cpuGpuMemorySize;
+    void* cpuGpuMemory;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct ComputeConfigInfo {
+    std::uint64_t thisSize;
+    std::uint16_t computePipeId;
+    std::uint16_t computeQueueId;
+    bool checkMemoryType;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct DecoderConfigInfo {
+    std::uint64_t thisSize;
+    std::uint32_t resourceType;
+    std::uint32_t codecType;
+    std::uint32_t profile;
+    std::uint32_t maxLevel;
+    std::int32_t maxFrameWidth;
+    std::int32_t maxFrameHeight;
+    std::int32_t maxDpbFrameCount;
+    std::uint32_t decodePipelineDepth;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct DecoderMemoryInfo {
+    std::uint64_t thisSize;
+    std::uint64_t cpuMemorySize;
+    void* cpuMemory;
+    std::uint64_t gpuMemorySize;
+    void* gpuMemory;
+    std::uint64_t cpuGpuMemorySize;
+    void* cpuGpuMemory;
+    std::uint64_t maxFrameBufferSize;
+    std::uint32_t frameBufferAlignment;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct InputData {
+    std::uint64_t thisSize;
+    const std::uint8_t* auData;
+    std::uint64_t auSize;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct FrameBuffer {
+    std::uint64_t thisSize;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+    bool isAccepted;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct OutputInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    bool isErrorFrame;
+    std::uint8_t pictureCount;
+    std::uint32_t codecType;
+    std::uint32_t frameWidth;
+    std::uint32_t framePitch;
+    std::uint32_t frameHeight;
+    void* frameBuffer;
+    std::uint64_t frameBufferSize;
+    std::uint32_t frameFormat;
+    std::uint32_t framePitchInBytes;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct AvcPictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint8_t idrPictureFlag;
+    std::uint8_t profileIdc;
+    std::uint8_t levelIdc;
+    std::uint32_t picWidthInLumaSamples;
+    std::uint32_t picHeightInLumaSamples;
+};
+
+}
+
+namespace SceVideodec2 {
+
+struct Vp9PictureInfo {
+    std::uint64_t thisSize;
+    bool isValid;
+    std::uint64_t ptsData;
+    std::uint64_t dtsData;
+    std::uint64_t attachedData;
+    std::uint32_t profile;
+    std::uint32_t level;
+    std::uint32_t keyFrameFlag;
+    std::uint32_t intraOnly;
+    std::uint8_t bitDepth;
+    std::uint8_t colorRange;
+    std::uint32_t colorSpace;
+    std::uint32_t numFrames;
+    std::uint32_t frameWidth;
+    std::uint32_t frameHeight;
+    std::uint32_t renderWidth;
+    std::uint32_t renderHeight;
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVideodec2QueryComputeMemoryInfo_nid_postfix(SceVideodec2::ComputeMemoryInfo* info);
+int APS5_VABI sceVideodec2AllocateComputeQueue_nid_postfix(const SceVideodec2::ComputeConfigInfo* config, const SceVideodec2::ComputeMemoryInfo* memory, std::uint64_t* queue);
+int APS5_VABI sceVideodec2ReleaseComputeQueue_nid_postfix(std::uint64_t queue);
+int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const SceVideodec2::DecoderConfigInfo* config, SceVideodec2::DecoderMemoryInfo* memory);
+int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const SceVideodec2::DecoderConfigInfo* config, const SceVideodec2::DecoderMemoryInfo* memory, std::uint64_t* handle);
+int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t handle);
+int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t handle, const SceVideodec2::InputData* input, SceVideodec2::FrameBuffer* frame, SceVideodec2::OutputInfo* output);
+int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t handle, SceVideodec2::FrameBuffer* frame, SceVideodec2::OutputInfo* output);
+int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t handle);
+int APS5_VABI sceVideodec2GetPictureInfo_nid_postfix(const SceVideodec2::OutputInfo* output, SceVideodec2::AvcPictureInfo* first, void* second);
+int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const SceVideodec2::OutputInfo* output, SceVideodec2::AvcPictureInfo* first, SceVideodec2::AvcPictureInfo* second);
+int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const SceVideodec2::OutputInfo* output, SceVideodec2::Vp9PictureInfo* info);
+int APS5_VABI sceVideodec2TermLibrary();
+int APS5_VABI sceVideodec2QueryLibraryInfo();
+int APS5_VABI sceVideodec2QueryDecoderInfo();
+int APS5_VABI sceVideodec2MapMemory();
+int APS5_VABI sceVideodec2MapDirectMemory(void*, const void*);
+int APS5_VABI sceVideodec2PresetDecoderConfigInfo();
+int APS5_VABI sceVideodec2PresetDecoderConfigInfoAvc();
+int APS5_VABI sceVideodec2PresetDecoderConfigInfoHevc();
+int APS5_VABI sceVideodec2PresetDecoderConfigInfoVp9();
+int APS5_VABI sceVideodec2CreateDecoderBid();
+int APS5_VABI sceVideodec2CreateHevcDecoder();
+int APS5_VABI sceVideodec2QueryHevcDecoderMemoryInfo();
+int APS5_VABI sceVideodec2GetHevcPictureInfo();
+int APS5_VABI sceVideodec2InitLibrary();
+
+}
diff --git a/core/libs/prx/libSceVideodec2/libSceVideodec2.hpp b/core/libs/prx/libSceVideodec2/libSceVideodec2.hpp
new file mode 100644
index 0000000000..85a17c3882
--- /dev/null
+++ b/core/libs/prx/libSceVideodec2/libSceVideodec2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVideodec2/include/Api.hpp"
diff --git a/core/libs/prx/libSceVisionManager/Export.cpp b/core/libs/prx/libSceVisionManager/Export.cpp
index 91dd5c2463..de5e1986f2 100644
--- a/core/libs/prx/libSceVisionManager/Export.cpp
+++ b/core/libs/prx/libSceVisionManager/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVisionManager/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceVisionManager/include/Api.hpp b/core/libs/prx/libSceVisionManager/include/Api.hpp
new file mode 100644
index 0000000000..95c8fb3a85
--- /dev/null
+++ b/core/libs/prx/libSceVisionManager/include/Api.hpp
@@ -0,0 +1,64 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVisionManagerApplyCalibrateHmdResult();
+int APS5_VABI sceVisionManagerCancelRequest();
+int APS5_VABI sceVisionManagerClose();
+int APS5_VABI sceVisionManagerFinalize();
+int APS5_VABI sceVisionManagerGenerateRegisterUserData();
+int APS5_VABI sceVisionManagerGenerateRegisterUserDataFinalize();
+int APS5_VABI sceVisionManagerGenerateRegisterUserDataInitialize();
+int APS5_VABI sceVisionManagerGetCalibrateTrackingLedInfo();
+int APS5_VABI sceVisionManagerGetCalibrateTrackingLedNecessity();
+int APS5_VABI sceVisionManagerGetHitCountOfRegisterUserData();
+int APS5_VABI sceVisionManagerGetLibraryVersion();
+int APS5_VABI sceVisionManagerGetNumOfRegisterUserDataSlot();
+int APS5_VABI sceVisionManagerGetRegisterUserDataSize();
+int APS5_VABI sceVisionManagerGetRegisterUserDataVersion();
+int APS5_VABI sceVisionManagerGetResultOfCalibrateHmd();
+int APS5_VABI sceVisionManagerGetResultOfCalibrateStereoCamera();
+int APS5_VABI sceVisionManagerGetResultOfCalibrateTrackingLed();
+int APS5_VABI sceVisionManagerGetResultOfFindFace();
+int APS5_VABI sceVisionManagerGetResultOfFindPad();
+int APS5_VABI sceVisionManagerGetResultOfFindPadCorrespondRegion();
+int APS5_VABI sceVisionManagerGetResultOfFindUser();
+int APS5_VABI sceVisionManagerGetResultOfFindUserInRegion();
+int APS5_VABI sceVisionManagerGetResultOfFindUserWithoutIdentify();
+int APS5_VABI sceVisionManagerGetResultOfRegisterUserInRegion();
+int APS5_VABI sceVisionManagerGetStoreCameraImgYPtr();
+int APS5_VABI sceVisionManagerGetWorkingMemorySize();
+int APS5_VABI sceVisionManagerInitialize();
+int APS5_VABI sceVisionManagerLoadSettings();
+int APS5_VABI sceVisionManagerOpen();
+int APS5_VABI sceVisionManagerRegistryClear();
+int APS5_VABI sceVisionManagerRequestCalibrateHmd();
+int APS5_VABI sceVisionManagerRequestCalibrateStereoCamera();
+int APS5_VABI sceVisionManagerRequestCalibrateTrackingLed();
+int APS5_VABI sceVisionManagerRequestClose();
+int APS5_VABI sceVisionManagerRequestFindFace();
+int APS5_VABI sceVisionManagerRequestFindPad();
+int APS5_VABI sceVisionManagerRequestFindPadCorrespondRegion();
+int APS5_VABI sceVisionManagerRequestFindUser();
+int APS5_VABI sceVisionManagerRequestFindUserInRegion();
+int APS5_VABI sceVisionManagerRequestFindUserWithoutIdentify();
+int APS5_VABI sceVisionManagerRequestHeadDetection();
+int APS5_VABI sceVisionManagerRequestInitializeRegisterUserData();
+int APS5_VABI sceVisionManagerRequestOpen();
+int APS5_VABI sceVisionManagerRequestPadTracking();
+int APS5_VABI sceVisionManagerRequestRecogUtility();
+int APS5_VABI sceVisionManagerRequestRegisterUserInRegion();
+int APS5_VABI sceVisionManagerRequestStoreCameraImgY();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCalibrateHmdResult();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCalibrateStereoCameraResult();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCalibrateTrackingLedResult();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCameraFrame();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateCtrlCore();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateRecog();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateRunningStatus();
+int APS5_VABI sceVisionManagerSetCallbackForUpdateStoreFrame();
+int APS5_VABI sceVisionManagerWaitResponse();
+
+}
diff --git a/core/libs/prx/libSceVisionManager/libSceVisionManager.hpp b/core/libs/prx/libSceVisionManager/libSceVisionManager.hpp
new file mode 100644
index 0000000000..e2529647b8
--- /dev/null
+++ b/core/libs/prx/libSceVisionManager/libSceVisionManager.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVisionManager/include/Api.hpp"
diff --git a/core/libs/prx/libSceVnaInternal/libSceVnaInternal.hpp b/core/libs/prx/libSceVnaInternal/libSceVnaInternal.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVnaInternal/libSceVnaInternal.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVnaWebsocket/libSceVnaWebsocket.hpp b/core/libs/prx/libSceVnaWebsocket/libSceVnaWebsocket.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVnaWebsocket/libSceVnaWebsocket.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVoice/Export.cpp b/core/libs/prx/libSceVoice/Export.cpp
index 707d112ea4..a7dfe71792 100644
--- a/core/libs/prx/libSceVoice/Export.cpp
+++ b/core/libs/prx/libSceVoice/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoice/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -26,6 +27,9 @@ constexpr auto NotInitialized = static_cast<std::int32_t>(0x804e0801u);
 constexpr auto InvalidPort = static_cast<std::int32_t>(0x804e0804u);
 constexpr auto InvalidArgument = static_cast<std::int32_t>(0x804e0805u);
 constexpr auto PortNotFound = static_cast<std::int32_t>(0x804e0807u);
+constexpr std::int32_t ThreadPriorityHighest = 256;
+constexpr std::int32_t ThreadPriorityLowest = 767;
+constexpr std::uint64_t ThreadAffinityAll = 0x1fff;
 
 struct Port {
     std::int32_t type;
@@ -42,6 +46,7 @@ struct Voice {
     bool initialized = false;
     bool started = false;
     std::int32_t appType = 0;
+    bool mutedAll = false;
     std::deque<std::uint32_t> freePorts;
     std::map<std::uint32_t, Port> ports;
     std::set<std::pair<std::uint32_t, std::uint32_t>> connections;
@@ -56,6 +61,10 @@ Voice& State() {
     throw std::logic_error(std::string(function) + ": " + why);
 }
 
+bool IsThreadSetting(std::int32_t priority, std::uint64_t affinity) {
+    return priority >= ThreadPriorityHighest && priority <= ThreadPriorityLowest && affinity != 0 && (affinity & ~ThreadAffinityAll) == 0;
+}
+
 Port& RequirePort(Voice& voice, std::uint32_t id, const char* function) {
     if (!voice.initialized) Fail(function, "library not initialized");
     const auto found = voice.ports.find(id);
@@ -65,6 +74,21 @@ Port& RequirePort(Voice& voice, std::uint32_t id, const char* function) {
 
 bool IsInput(std::int32_t type) { return type == PortInDevice || type == PortInPcm || type == PortInVoice; }
 
+bool VoiceFrame(std::int32_t bitrate, std::uint16_t& frameSize, std::uint16_t& frameDuration) {
+    switch (bitrate) {
+    case 3850: frameSize = 20; frameDuration = 40; return true;
+    case 4650: frameSize = 24; frameDuration = 40; return true;
+    case 5700: frameSize = 15; frameDuration = 20; return true;
+    case 7300: frameSize = 19; frameDuration = 20; return true;
+    case 11800: frameSize = 15; frameDuration = 10; return true;
+    case 12200: frameSize = 16; frameDuration = 10; return true;
+    case 14400: frameSize = 27; frameDuration = 15; return true;
+    case 16000: frameSize = 20; frameDuration = 10; return true;
+    case 22533: frameSize = 43; frameDuration = 15; return true;
+    default: return false;
+    }
+}
+
 }
 
 extern "C" {
@@ -90,7 +114,10 @@ int APS5_VABI sceVoiceSetThreadsParams(const VoiceThreadsParams* params) {
     if (voice.started) return static_cast<std::int32_t>(0x804e080bu);
     if (params->mode == 0) return 0;
     if (params->mode != 1) return InvalidArgument;
-    Fail(__func__, "worker priority and affinity are not implemented");
+    if (!IsThreadSetting(params->firstPriority, params->firstAffinity) || !IsThreadSetting(params->secondPriority, params->secondAffinity) || !IsThreadSetting(params->thirdPriority, params->thirdAffinity)) {
+        Fail(__func__, "the result for a priority outside 256-767 or an affinity mask outside 0x1fff is unknown");
+    }
+    return 0;
 }
 
 int APS5_VABI sceVoiceStart(const VoiceStartParam* param) {
@@ -121,6 +148,7 @@ int APS5_VABI sceVoiceEnd_nid_postfix(void) {
     voice.connections.clear();
     voice.started = false;
     voice.appType = 0;
+    voice.mutedAll = false;
     voice.initialized = false;
     return 0;
 }
@@ -138,18 +166,7 @@ int APS5_VABI sceVoiceCreatePort(std::uint32_t* portId, const VoicePortParam* pa
     if (type == PortInPcm || type == PortOutPcm) {
         if (param->pcmaudio.sample_rate != 16000 || param->pcmaudio.data_type != 0) return InvalidArgument;
     } else if (type == PortInVoice || type == PortOutVoice) {
-        switch (param->voice.bitrate) {
-        case 3850: frameSize = 20; frameDuration = 40; break;
-        case 4650: frameSize = 24; frameDuration = 40; break;
-        case 5700: frameSize = 15; frameDuration = 20; break;
-        case 7300: frameSize = 19; frameDuration = 20; break;
-        case 11800: frameSize = 15; frameDuration = 10; break;
-        case 12200: frameSize = 16; frameDuration = 10; break;
-        case 14400: frameSize = 27; frameDuration = 15; break;
-        case 16000: frameSize = 20; frameDuration = 10; break;
-        case 22533: frameSize = 43; frameDuration = 15; break;
-        default: return InvalidArgument;
-        }
+        if (!VoiceFrame(param->voice.bitrate, frameSize, frameDuration)) return InvalidArgument;
     }
     constexpr auto resourceFull = static_cast<std::int32_t>(0x804e0808u);
     if (voice.freePorts.empty()) return resourceFull;
@@ -338,7 +355,7 @@ int APS5_VABI sceVoiceGetMuteFlag(std::uint32_t portId, bool* muted) {
     if (!muted) return InvalidArgument;
     const auto found = voice.ports.find(portId);
     if (found == voice.ports.end()) return PortNotFound;
-    *muted = found->second.muted;
+    *muted = found->second.muted || voice.mutedAll;
     return 0;
 }
 
@@ -411,9 +428,8 @@ int APS5_VABI sceVoiceDisableChat(void) {
     Fail(__func__, "audio chat backend is not implemented");
 }
 
-int APS5_VABI sceVoiceInitHQ(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVoiceInitHQ(const VoiceInitParam* param, std::int32_t version) {
+    return sceVoiceInit(param, version);
 }
 
 int APS5_VABI sceVoiceGetMemorySize(void) {
@@ -441,23 +457,55 @@ int APS5_VABI sceVoiceVADPVTAdjustment(void) {
     return 0;
 }
 
-int APS5_VABI sceVoiceVADSetVersion(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVoiceVADSetVersion(std::int32_t version) {
+    return version == 0 || version == 1 ? 0 : InvalidArgument;
+}
+
+int APS5_VABI sceVoiceSetMuteFlagAll(bool muted) {
+    auto& voice = State();
+    std::lock_guard lock(voice.mutex);
+    if (!voice.initialized) return NotInitialized;
+    voice.mutedAll = muted;
     return 0;
 }
 
-int APS5_VABI sceVoiceSetMuteFlagAll(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVoiceSetBitRate(std::uint32_t portId, std::uint32_t bitrate) {
+    auto& voice = State();
+    std::lock_guard lock(voice.mutex);
+    if (!voice.initialized) return NotInitialized;
+    if (portId > 127) return InvalidPort;
+    const auto found = voice.ports.find(portId);
+    if (found == voice.ports.end()) return PortNotFound;
+    auto& port = found->second;
+    if (port.type != PortInVoice && port.type != PortOutVoice) Fail(__func__, "port does not carry encoded voice");
+    std::uint16_t frameSize = 0;
+    std::uint16_t frameDuration = 0;
+    if (bitrate > INT32_MAX || !VoiceFrame(static_cast<std::int32_t>(bitrate), frameSize, frameDuration)) Fail(__func__, "unsupported bitrate " + std::to_string(bitrate));
+    port.bitrate = bitrate;
+    port.frameSize = frameSize;
     return 0;
 }
 
-int APS5_VABI sceVoiceSetBitRate(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceVoiceUpdatePort(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVoiceUpdatePort(std::uint32_t portId, const VoicePortParam* param) {
+    auto& voice = State();
+    std::lock_guard lock(voice.mutex);
+    if (!voice.initialized) return NotInitialized;
+    if (portId > 127) return InvalidPort;
+    if (!param) Fail(__func__, "null port parameters");
+    const auto found = voice.ports.find(portId);
+    if (found == voice.ports.end()) return PortNotFound;
+    auto& port = found->second;
+    if (param->port_type != port.type) Fail(__func__, "port type " + std::to_string(param->port_type) + " differs from the port's " + std::to_string(port.type));
+    std::uint16_t frameSize = port.frameSize;
+    std::uint16_t frameDuration = 0;
+    const bool voicePort = port.type == PortInVoice || port.type == PortOutVoice;
+    if (voicePort && !VoiceFrame(param->voice.bitrate, frameSize, frameDuration)) Fail(__func__, "unsupported bitrate " + std::to_string(param->voice.bitrate));
+    port.muted = param->mute != 0;
+    port.volume = std::isfinite(param->volume) ? param->volume : 0.0f;
+    if (voicePort) {
+        port.bitrate = static_cast<std::uint32_t>(param->voice.bitrate);
+        port.frameSize = frameSize;
+    }
     return 0;
 }
 
diff --git a/core/libs/prx/libSceVoice/include/Api.hpp b/core/libs/prx/libSceVoice/include/Api.hpp
new file mode 100644
index 0000000000..cdaf1823b6
--- /dev/null
+++ b/core/libs/prx/libSceVoice/include/Api.hpp
@@ -0,0 +1,44 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVoiceInit(const VoiceInitParam* param, std::int32_t version);
+int APS5_VABI sceVoiceSetThreadsParams(const VoiceThreadsParams* params);
+int APS5_VABI sceVoiceStart(const VoiceStartParam* param);
+int APS5_VABI sceVoiceStop(void);
+int APS5_VABI sceVoiceEnd_nid_postfix(void);
+int APS5_VABI sceVoiceCreatePort(std::uint32_t* portId, const VoicePortParam* param);
+int APS5_VABI sceVoiceDeletePort(uint32_t portId);
+int APS5_VABI sceVoiceConnectIPortToOPort(uint32_t inputPortId, uint32_t outputPortId);
+int APS5_VABI sceVoiceDisconnectIPortFromOPort(uint32_t inputPortId, uint32_t outputPortId);
+int APS5_VABI sceVoiceGetBitRate(std::uint32_t portId, std::uint32_t* bitrate);
+int APS5_VABI sceVoiceSetVolume(std::uint32_t portId, float volume);
+int APS5_VABI sceVoiceGetVolume(std::uint32_t portId, float* volume);
+int APS5_VABI sceVoiceGetPortInfo(uint32_t portId, VoicePortInfo* info);
+int APS5_VABI sceVoiceGetPortAttr(std::uint32_t portId, std::int32_t attr, void* value, std::int32_t size);
+int APS5_VABI sceVoiceReadFromOPort(uint32_t outputPortId, void* data, uint32_t* size);
+int APS5_VABI sceVoiceWriteToIPort(uint32_t inputPortId, const void* data, uint32_t* size, int16_t frameGaps);
+int APS5_VABI sceVoiceSetMuteFlag(std::uint32_t portId, std::uint8_t muted);
+int APS5_VABI sceVoiceGetMuteFlag(std::uint32_t portId, bool* muted);
+int APS5_VABI sceVoiceGetResourceInfo(VoiceResourceInfo* info);
+int APS5_VABI sceVoiceEnableChat(void);
+int APS5_VABI sceVoiceResetPort(std::uint32_t portId);
+int APS5_VABI sceVoicePausePort(std::uint32_t portId);
+int APS5_VABI sceVoiceResumePort(std::uint32_t portId);
+int APS5_VABI sceVoiceDisableChat(void);
+int APS5_VABI sceVoiceInitHQ(const VoiceInitParam* param, std::int32_t version);
+int APS5_VABI sceVoiceGetMemorySize(void);
+int APS5_VABI sceVoiceDeviceInCustomerData(void);
+int APS5_VABI sceVoiceQAEnableRecording(void);
+int APS5_VABI sceVoiceVADAdjustment(void);
+int APS5_VABI sceVoiceVADPVTAdjustment(void);
+int APS5_VABI sceVoiceVADSetVersion(std::int32_t version);
+int APS5_VABI sceVoiceSetMuteFlagAll(bool muted);
+int APS5_VABI sceVoiceSetBitRate(std::uint32_t portId, std::uint32_t bitrate);
+int APS5_VABI sceVoiceUpdatePort(std::uint32_t portId, const VoicePortParam* param);
+int APS5_VABI sceVoicePausePortAll(void);
+int APS5_VABI sceVoiceResumePortAll(void);
+
+}
diff --git a/core/libs/prx/libSceVoice/libSceVoice.hpp b/core/libs/prx/libSceVoice/libSceVoice.hpp
new file mode 100644
index 0000000000..5892fc763a
--- /dev/null
+++ b/core/libs/prx/libSceVoice/libSceVoice.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVoice/include/Api.hpp"
diff --git a/core/libs/prx/libSceVoiceChat/Export.cpp b/core/libs/prx/libSceVoiceChat/Export.cpp
index 49e582df5f..b1fde4c767 100644
--- a/core/libs/prx/libSceVoiceChat/Export.cpp
+++ b/core/libs/prx/libSceVoiceChat/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoiceChat/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdio>
diff --git a/core/libs/prx/libSceVoiceChat/include/Api.hpp b/core/libs/prx/libSceVoiceChat/include/Api.hpp
new file mode 100644
index 0000000000..5d5676dff3
--- /dev/null
+++ b/core/libs/prx/libSceVoiceChat/include/Api.hpp
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVoiceChatInitialize(void* param);
+int APS5_VABI sceVoiceChatTerminate(void);
+int APS5_VABI sceVoiceChatRegisterHandlers(void* a);
+int APS5_VABI sceVoiceChatRegisterMicEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatProcessEvent(void);
+int APS5_VABI sceVoiceChatDeleteRequest(int requestId);
+int APS5_VABI sceVoiceChatCreateRequest(void* a, void* b);
+int APS5_VABI NAME(int requestId, void* a, void* b);
+int APS5_VABI sceVoiceChatAbortRequest(int requestId);
+int APS5_VABI sceVoiceChatGetActiveChannel(void* channel);
+int APS5_VABI sceVoiceChatGetChannelMemberActiveChannelMatchingState(void* a, void* b);
+int APS5_VABI sceVoiceChatGetChannelMemberVoiceConnectionState(void* a, void* b);
+int APS5_VABI sceVoiceChatGetChatChannelMemberInfoList(void* a, void* b);
+int APS5_VABI sceVoiceChatGetChatGroupMemberInfoList(void* a, void* b);
+int APS5_VABI sceVoiceChatGetMicState(void* state);
+int APS5_VABI sceVoiceChatGetUserVoiceVolumeGain(void* a, void* gain);
+int APS5_VABI sceVoiceChatSetUserVoiceVolumeGain(void* a, int32_t gain);
+int APS5_VABI sceVoiceChatRegisterChannelEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterDaemonEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterMemberEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterPartyUserStateChangedHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatRegisterVoiceEventHandler(void* a, void* b);
+int APS5_VABI sceVoiceChatStartAccessibilityEvent(void* a);
+int APS5_VABI sceVoiceChatStartChannelEvent(void* a);
+int APS5_VABI sceVoiceChatStartDaemonEvent(void* a);
+int APS5_VABI sceVoiceChatStartMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStartRangedMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStartVoiceEvent(void* a);
+int APS5_VABI sceVoiceChatStopAccessibilityEvent(void* a);
+int APS5_VABI sceVoiceChatStopChannelEvent(void* a);
+int APS5_VABI sceVoiceChatStopDaemonEvent(void* a);
+int APS5_VABI sceVoiceChatStopMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStopRangedMemberEvent(void* a);
+int APS5_VABI sceVoiceChatStopVoiceEvent(void* a);
+int APS5_VABI sceVoiceChatUnregisterAccessibilityEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterChannelEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterDaemonEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterMemberEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterMicEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterPartyUserStateChangedHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterRangedMemberEventHandler(void* a);
+int APS5_VABI sceVoiceChatUnregisterVoiceEventHandler(void* a);
+
+}
diff --git a/core/libs/prx/libSceVoiceChat/libSceVoiceChat.hpp b/core/libs/prx/libSceVoiceChat/libSceVoiceChat.hpp
new file mode 100644
index 0000000000..81d8245cc3
--- /dev/null
+++ b/core/libs/prx/libSceVoiceChat/libSceVoiceChat.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVoiceChat/include/Api.hpp"
diff --git a/core/libs/prx/libSceVoiceCommand/libSceVoiceCommand.hpp b/core/libs/prx/libSceVoiceCommand/libSceVoiceCommand.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceVoiceCommand/libSceVoiceCommand.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceVoiceQoS/Export.cpp b/core/libs/prx/libSceVoiceQoS/Export.cpp
index 6c52605b5e..7781cd7ec8 100644
--- a/core/libs/prx/libSceVoiceQoS/Export.cpp
+++ b/core/libs/prx/libSceVoiceQoS/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoiceQoS/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceVoiceQoS/include/Api.hpp b/core/libs/prx/libSceVoiceQoS/include/Api.hpp
new file mode 100644
index 0000000000..a37b2d9239
--- /dev/null
+++ b/core/libs/prx/libSceVoiceQoS/include/Api.hpp
@@ -0,0 +1,33 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVoiceQoSInit(void* memBlock, uint32_t memSize, int32_t appType);
+int APS5_VABI sceVoiceQoSEnd();
+int APS5_VABI sceVoiceQoSCreateLocalEndpoint(int32_t* localId, int32_t userId, int32_t deviceInId, int32_t deviceOutId);
+int APS5_VABI sceVoiceQoSDeleteLocalEndpoint(int32_t localId);
+int APS5_VABI sceVoiceQoSCreateRemoteEndpoint(int32_t* remoteId);
+int APS5_VABI sceVoiceQoSDeleteRemoteEndpoint(int32_t remoteId);
+int APS5_VABI sceVoiceQoSConnect(int32_t* connectionId, int32_t localId, int32_t remoteId);
+int APS5_VABI sceVoiceQoSDisconnect(int32_t connectionId);
+int APS5_VABI sceVoiceQoSSetConnectionAttribute(std::int32_t connectionId, std::int32_t attributeId, const void* value, std::int32_t size);
+int APS5_VABI sceVoiceQoSSetLocalEndpointAttribute(int32_t localId, int32_t attributeId, const void* value, int32_t size);
+int APS5_VABI sceVoiceQoSSetRemoteEndpointAttribute(int32_t remoteId, int32_t attributeId, const void* value, int32_t size);
+int APS5_VABI sceVoiceQoSReadPacket(int32_t connectionId, void* buffer, uint32_t* size);
+int APS5_VABI sceVoiceQoSWritePacket(int32_t connectionId, const void* buffer, uint32_t* size);
+int APS5_VABI sceVoiceQoSGetLocalEndpointAttribute(int32_t localId, int32_t attributeId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSGetRemoteEndpointAttribute(int32_t remoteId, int32_t attributeId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSGetConnectionAttribute(int32_t connectionId, int32_t attributeId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSGetLocalEndpoint(int32_t connectionId, int32_t* localId);
+int APS5_VABI sceVoiceQoSGetRemoteEndpoint(int32_t connectionId, int32_t* remoteId);
+int APS5_VABI sceVoiceQoSEnableChat();
+int APS5_VABI sceVoiceQoSDisableChat();
+int APS5_VABI sceVoiceQoSGetStatus(int32_t connectionId, int32_t statusId, void* value, int32_t size);
+int APS5_VABI sceVoiceQoSDebugGetStatus(std::int32_t connectionId, std::int32_t statusId, void* value, std::int32_t size);
+int APS5_VABI sceVoiceQoSInitHQ(void* memory, std::uint32_t memorySize, std::int32_t appType);
+int APS5_VABI sceVoiceQoSSetMode();
+int APS5_VABI sceVoiceQoSTerminate();
+
+}
diff --git a/core/libs/prx/libSceVoiceQoS/libSceVoiceQoS.hpp b/core/libs/prx/libSceVoiceQoS/libSceVoiceQoS.hpp
new file mode 100644
index 0000000000..e6e7967b46
--- /dev/null
+++ b/core/libs/prx/libSceVoiceQoS/libSceVoiceQoS.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVoiceQoS/include/Api.hpp"
diff --git a/core/libs/prx/libSceVorbisDec/CMakeLists.txt b/core/libs/prx/libSceVorbisDec/CMakeLists.txt
new file mode 100644
index 0000000000..0da3f0a43e
--- /dev/null
+++ b/core/libs/prx/libSceVorbisDec/CMakeLists.txt
@@ -0,0 +1,77 @@
+enable_language(C)
+
+set(OGG_DIR ${CMAKE_SOURCE_DIR}/3rdparty/ogg)
+set(VORBIS_DIR ${CMAKE_SOURCE_DIR}/3rdparty/vorbis)
+set(OGG_GENERATED_DIR ${CMAKE_CURRENT_BINARY_DIR}/ogg/include)
+
+include(CheckIncludeFiles)
+check_include_files(inttypes.h INCLUDE_INTTYPES_H)
+check_include_files(stdint.h INCLUDE_STDINT_H)
+check_include_files(sys/types.h INCLUDE_SYS_TYPES_H)
+set(SIZE16 int16_t)
+set(USIZE16 uint16_t)
+set(SIZE32 int32_t)
+set(USIZE32 uint32_t)
+set(SIZE64 int64_t)
+set(USIZE64 uint64_t)
+configure_file(${OGG_DIR}/include/ogg/config_types.h.in ${OGG_GENERATED_DIR}/ogg/config_types.h @ONLY)
+
+add_library(ogg STATIC EXCLUDE_FROM_ALL
+        ${OGG_DIR}/src/bitwise.c
+        ${OGG_DIR}/src/framing.c
+)
+target_include_directories(ogg PUBLIC ${OGG_DIR}/include ${OGG_GENERATED_DIR})
+
+add_library(vorbis STATIC EXCLUDE_FROM_ALL
+        ${VORBIS_DIR}/lib/analysis.c
+        ${VORBIS_DIR}/lib/bitrate.c
+        ${VORBIS_DIR}/lib/block.c
+        ${VORBIS_DIR}/lib/codebook.c
+        ${VORBIS_DIR}/lib/envelope.c
+        ${VORBIS_DIR}/lib/floor0.c
+        ${VORBIS_DIR}/lib/floor1.c
+        ${VORBIS_DIR}/lib/info.c
+        ${VORBIS_DIR}/lib/lookup.c
+        ${VORBIS_DIR}/lib/lpc.c
+        ${VORBIS_DIR}/lib/lsp.c
+        ${VORBIS_DIR}/lib/mapping0.c
+        ${VORBIS_DIR}/lib/mdct.c
+        ${VORBIS_DIR}/lib/psy.c
+        ${VORBIS_DIR}/lib/registry.c
+        ${VORBIS_DIR}/lib/res0.c
+        ${VORBIS_DIR}/lib/sharedbook.c
+        ${VORBIS_DIR}/lib/smallft.c
+        ${VORBIS_DIR}/lib/synthesis.c
+        ${VORBIS_DIR}/lib/window.c
+)
+target_include_directories(vorbis PUBLIC ${VORBIS_DIR}/include PRIVATE ${VORBIS_DIR}/lib)
+target_link_libraries(vorbis PUBLIC ogg)
+if(NOT WIN32)
+    target_link_libraries(vorbis PRIVATE m)
+endif()
+
+add_library(vorbisfile STATIC EXCLUDE_FROM_ALL ${VORBIS_DIR}/lib/vorbisfile.c)
+target_include_directories(vorbisfile PRIVATE ${VORBIS_DIR}/lib)
+target_link_libraries(vorbisfile PUBLIC vorbis)
+set_target_properties(ogg vorbis vorbisfile PROPERTIES POSITION_INDEPENDENT_CODE ON C_VISIBILITY_PRESET hidden)
+if(MINGW)
+    foreach(library IN ITEMS ogg vorbis vorbisfile)
+        target_compile_options(${library} PRIVATE -fexceptions)
+    endforeach()
+endif()
+
+add_library(libSceVorbisDec SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceVorbisDec PRIVATE ${LIBS_INCLUDE_DIR})
+target_compile_definitions(libSceVorbisDec PRIVATE OV_EXCLUDE_STATIC_CALLBACKS)
+target_link_libraries(libSceVorbisDec PRIVATE vorbisfile vorbis ogg)
+if(MINGW OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
+    target_link_options(libSceVorbisDec PRIVATE LINKER:--exclude-libs,ALL)
+endif()
+configure_windows_unwind(libSceVorbisDec)
+
+if(BUILD_TESTING)
+    add_library(vorbisenc STATIC EXCLUDE_FROM_ALL ${VORBIS_DIR}/lib/vorbisenc.c)
+    target_include_directories(vorbisenc PRIVATE ${VORBIS_DIR}/lib)
+    target_link_libraries(vorbisenc PUBLIC vorbis)
+    set_target_properties(vorbisenc PROPERTIES POSITION_INDEPENDENT_CODE ON C_VISIBILITY_PRESET hidden)
+endif()
diff --git a/core/libs/prx/libSceVorbisDec/Export.cpp b/core/libs/prx/libSceVorbisDec/Export.cpp
index 44ae4fcc5b..44b39a6c58 100644
--- a/core/libs/prx/libSceVorbisDec/Export.cpp
+++ b/core/libs/prx/libSceVorbisDec/Export.cpp
@@ -1,33 +1,203 @@
+#include "prx/libSceVorbisDec/include/Api.hpp"
+#include "prx/libSceVorbisDec/include/GuestVorbisFile.hpp"
+#include "prx/libc/include/General.hpp"
+
+#include <vorbis/vorbisfile.h>
+
 #include <cstddef>
 #include <cstdint>
-#include "SceTypes.hpp"
-#include "prx/libc/include/General.hpp"
+#include <cstdio>
+#include <limits>
+#include <memory>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+using namespace VorbisDec;
+
+static_assert(sizeof(vorbis_comment) == sizeof(GuestComment));
+static_assert(offsetof(vorbis_comment, user_comments) == offsetof(GuestComment, user_comments));
+static_assert(offsetof(vorbis_comment, comment_lengths) == offsetof(GuestComment, comment_lengths));
+static_assert(offsetof(vorbis_comment, comments) == offsetof(GuestComment, comments));
+static_assert(offsetof(vorbis_comment, vendor) == offsetof(GuestComment, vendor));
+static_assert(SEEK_SET == 0 && SEEK_CUR == 1 && SEEK_END == 2);
+
+namespace {
+
+struct Handle {
+    OggVorbis_File file{};
+    void* datasource = nullptr;
+    GuestCallbacks callbacks{};
+    std::vector<GuestInfo> infos;
+    bool tellOutOfRange = false;
+
+    ~Handle() {
+        file.datasource = nullptr;
+        ov_clear(&file);
+    }
+};
+
+struct Table {
+    std::mutex mutex;
+    std::unordered_map<const void*, std::unique_ptr<Handle>> handles;
+};
+
+Table& Handles() {
+    static auto* table = new Table;
+    return *table;
+}
+
+Handle* Find(const void* vf) {
+    auto& table = Handles();
+    const std::lock_guard lock(table.mutex);
+    const auto found = table.handles.find(vf);
+    return found == table.handles.end() ? nullptr : found->second.get();
+}
+
+std::unique_ptr<Handle> Take(const void* vf) {
+    auto& table = Handles();
+    const std::lock_guard lock(table.mutex);
+    const auto found = table.handles.find(vf);
+    if (found == table.handles.end()) return nullptr;
+    auto handle = std::move(found->second);
+    table.handles.erase(found);
+    return handle;
+}
+
+void Store(const void* vf, std::unique_ptr<Handle> handle) {
+    auto& table = Handles();
+    const std::lock_guard lock(table.mutex);
+    table.handles[vf] = std::move(handle);
+}
+
+void SyncInfos(Handle& handle) {
+    for (std::size_t link = 0; link < handle.infos.size(); ++link) {
+        const vorbis_info& info = handle.file.vi[link];
+        handle.infos[link] = {info.version, info.channels, info.rate, info.bitrate_upper, info.bitrate_nominal, info.bitrate_lower, info.bitrate_window, info.codec_setup};
+    }
+}
+
+void RequireFile(const void* vf, const char* function) {
+    if (!vf) throw std::invalid_argument(std::string(function) + ": a null OggVorbis_File is not implemented");
+}
+
+template <typename TCall>
+auto WithHandle(const void* vf, const char* function, TCall call) {
+    RequireFile(vf, function);
+    if (Handle* handle = Find(vf)) {
+        const auto result = call(*handle);
+        SyncInfos(*handle);
+        return result;
+    }
+    Handle closed;
+    return call(closed);
+}
+
+std::size_t ReadSource(void* buffer, std::size_t size, std::size_t count, void* source) {
+    const auto* handle = static_cast<const Handle*>(source);
+    return handle->callbacks.read_func(buffer, size, count, handle->datasource);
+}
+
+int SeekSource(void* source, ogg_int64_t offset, int whence) {
+    const auto* handle = static_cast<const Handle*>(source);
+    return handle->callbacks.seek_func(handle->datasource, offset, whence);
+}
+
+int CloseSource(void* source) {
+    const auto* handle = static_cast<const Handle*>(source);
+    return handle->callbacks.close_func(handle->datasource);
+}
+
+long TellSource(void* source) {
+    auto* handle = static_cast<Handle*>(source);
+    const std::int64_t position = handle->callbacks.tell_func(handle->datasource);
+    if (position < std::numeric_limits<long>::min() || position > std::numeric_limits<long>::max()) {
+        handle->tellOutOfRange = true;
+        return -1;
+    }
+    return static_cast<long>(position);
+}
+
+struct FilterContext {
+    GuestFilter filter;
+    void* param;
+};
+
+void RunFilter(float** pcm, long channels, long samples, void* context) {
+    const auto* filter = static_cast<const FilterContext*>(context);
+    filter->filter(pcm, channels, samples, filter->param);
+}
+
+}
 
 extern "C" {
 
-int APS5_VABI sceVorbisDecBitrate(void) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVorbisDecOpenCallbacks(void* datasource, void* vf, const char* initial, std::int64_t ibytes, GuestCallbacks callbacks) {
+    RequireFile(vf, __func__);
+    if (initial && (ibytes < std::numeric_limits<long>::min() || ibytes > std::numeric_limits<long>::max())) {
+        throw std::runtime_error(std::string(__func__) + ": an initial byte count outside the host long range is not implemented");
+    }
+    Take(vf).reset();
+    auto handle = std::make_unique<Handle>();
+    handle->datasource = datasource;
+    handle->callbacks = callbacks;
+    const ov_callbacks host{
+        callbacks.read_func ? ReadSource : nullptr,
+        callbacks.seek_func ? SeekSource : nullptr,
+        callbacks.close_func ? CloseSource : nullptr,
+        callbacks.tell_func ? TellSource : nullptr,
+    };
+    const int result = ov_open_callbacks(datasource ? handle.get() : nullptr, &handle->file, initial, initial ? static_cast<long>(ibytes) : 0, host);
+    if (handle->tellOutOfRange) {
+        throw std::runtime_error(std::string(__func__) + ": a stream length outside the host long range is not implemented");
+    }
+    if (result != 0) return result;
+    handle->infos.resize(static_cast<std::size_t>(handle->file.links));
+    SyncInfos(*handle);
+    Store(vf, std::move(handle));
     return 0;
 }
 
-int APS5_VABI sceVorbisDecBitrateInstant(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecClear(void* vf) {
+    const std::unique_ptr<Handle> handle = Take(vf);
+    if (!handle) {
+        Handle closed;
+        return ov_clear(&closed.file);
+    }
+    void* const source = handle->file.datasource;
+    handle->file.datasource = nullptr;
+    const int result = ov_clear(&handle->file);
+    if (source && handle->callbacks.close_func) handle->callbacks.close_func(handle->datasource);
+    return result;
 }
 
-int APS5_VABI sceVorbisDecClear(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecBitrate(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t { return ov_bitrate(&handle.file, link); });
 }
 
-int APS5_VABI sceVorbisDecComment(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecBitrateInstant(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) -> std::int64_t { return ov_bitrate_instant(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecCrossLap(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+GuestComment* APS5_VABI sceVorbisDecComment(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return reinterpret_cast<GuestComment*>(ov_comment(&handle.file, link)); });
+}
+
+int APS5_VABI sceVorbisDecCrossLap(void* first, void* second) {
+    if (first != second) RequireFile(first, __func__);
+    Handle* from = Find(first);
+    if (first != second && from) RequireFile(second, __func__);
+    Handle* to = second == first ? from : Find(second);
+    Handle closedFrom;
+    Handle closedTo;
+    OggVorbis_File* fromFile = from ? &from->file : &closedFrom.file;
+    OggVorbis_File* toFile = second == first ? fromFile : to ? &to->file : &closedTo.file;
+    const int result = ov_crosslap(fromFile, toFile);
+    if (from) SyncInfos(*from);
+    if (to) SyncInfos(*to);
+    return result;
 }
 
 int APS5_VABI sceVorbisDecGetDecodePriority(void) {
@@ -40,99 +210,84 @@ int APS5_VABI sceVorbisDecGetLastDecodeError(void) {
     return 0;
 }
 
-int APS5_VABI sceVorbisDecHalfrate(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecHalfrate(void* vf, int flag) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_halfrate(&handle.file, flag); });
 }
 
-int APS5_VABI sceVorbisDecHalfrateP(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecHalfrateP(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) { return ov_halfrate_p(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+GuestInfo* APS5_VABI sceVorbisDecInfo(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> GuestInfo* {
+        const vorbis_info* info = ov_info(&handle.file, link);
+        return info ? &handle.infos.at(static_cast<std::size_t>(info - handle.file.vi)) : nullptr;
+    });
 }
 
-int APS5_VABI sceVorbisDecOpenCallbacks(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecPcmSeek(void* vf, std::int64_t position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_pcm_seek(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecPcmSeek(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecPcmSeekLap(void* vf, std::int64_t position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_pcm_seek_lap(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecPcmSeekLap(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecPcmSeekPage(void* vf, std::int64_t position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_pcm_seek_page(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecPcmSeekPage(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecPcmSeekPageLap(void* vf, std::int64_t position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_pcm_seek_page_lap(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecPcmSeekPageLap(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecPcmTell(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) -> std::int64_t { return ov_pcm_tell(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecPcmTell(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecPcmTotal(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t { return ov_pcm_total(&handle.file, link); });
 }
 
-int APS5_VABI sceVorbisDecPcmTotal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecRawSeek(void* vf, std::int64_t position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_raw_seek(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecRawSeek(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecRawSeekLap(void* vf, std::int64_t position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_raw_seek_lap(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecRawSeekLap(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecRawTell(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) -> std::int64_t { return ov_raw_tell(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecRawTell(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecRawTotal(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t { return ov_raw_total(&handle.file, link); });
 }
 
-int APS5_VABI sceVorbisDecRawTotal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecRead(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t {
+        return ov_read(&handle.file, buffer, length, bigEndian, word, isSigned, bitstream);
+    });
 }
 
-int APS5_VABI sceVorbisDecRead(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecReadFilter(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream, GuestFilter filter, void* filterParam) {
+    FilterContext context{filter, filterParam};
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t {
+        return ov_read_filter(&handle.file, buffer, length, bigEndian, word, isSigned, bitstream, filter ? RunFilter : nullptr, &context);
+    });
 }
 
-int APS5_VABI sceVorbisDecReadFilter(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecReadFloat(void* vf, float*** pcmChannels, int samples, int* bitstream) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t { return ov_read_float(&handle.file, pcmChannels, samples, bitstream); });
 }
 
-int APS5_VABI sceVorbisDecReadFloat(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecSeekable(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) -> std::int64_t { return ov_seekable(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecSeekable(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceVorbisDecSerialNumber(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecSerialNumber(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) -> std::int64_t { return ov_serialnumber(&handle.file, link); });
 }
 
 int APS5_VABI sceVorbisDecSetDecodePriority(void) {
@@ -140,39 +295,32 @@ int APS5_VABI sceVorbisDecSetDecodePriority(void) {
     return 0;
 }
 
-int APS5_VABI sceVorbisDecStreams(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+std::int64_t APS5_VABI sceVorbisDecStreams(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) -> std::int64_t { return ov_streams(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecTimeSeek(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecTimeSeek(void* vf, double position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_time_seek(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecTimeSeekLap(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecTimeSeekLap(void* vf, double position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_time_seek_lap(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecTimeSeekPage(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecTimeSeekPage(void* vf, double position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_time_seek_page(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecTimeSeekPageLap(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVorbisDecTimeSeekPageLap(void* vf, double position) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_time_seek_page_lap(&handle.file, position); });
 }
 
-int APS5_VABI sceVorbisDecTimeTell(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+double APS5_VABI sceVorbisDecTimeTell(void* vf) {
+    return WithHandle(vf, __func__, [](Handle& handle) { return ov_time_tell(&handle.file); });
 }
 
-int APS5_VABI sceVorbisDecTimeTotal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+double APS5_VABI sceVorbisDecTimeTotal(void* vf, int link) {
+    return WithHandle(vf, __func__, [&](Handle& handle) { return ov_time_total(&handle.file, link); });
 }
 
 }
diff --git a/core/libs/prx/libSceVorbisDec/include/Api.hpp b/core/libs/prx/libSceVorbisDec/include/Api.hpp
new file mode 100644
index 0000000000..7f0e484c62
--- /dev/null
+++ b/core/libs/prx/libSceVorbisDec/include/Api.hpp
@@ -0,0 +1,53 @@
+#pragma once
+
+#include "prx/libSceVorbisDec/include/GuestVorbisFile.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <limits>
+#include <memory>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+extern "C" {
+
+int APS5_VABI sceVorbisDecOpenCallbacks(void* datasource, void* vf, const char* initial, std::int64_t ibytes, VorbisDec::GuestCallbacks callbacks);
+int APS5_VABI sceVorbisDecClear(void* vf);
+std::int64_t APS5_VABI sceVorbisDecBitrate(void* vf, int link);
+std::int64_t APS5_VABI sceVorbisDecBitrateInstant(void* vf);
+VorbisDec::GuestComment* APS5_VABI sceVorbisDecComment(void* vf, int link);
+int APS5_VABI sceVorbisDecCrossLap(void* first, void* second);
+int APS5_VABI sceVorbisDecGetDecodePriority(void);
+int APS5_VABI sceVorbisDecGetLastDecodeError(void);
+int APS5_VABI sceVorbisDecHalfrate(void* vf, int flag);
+int APS5_VABI sceVorbisDecHalfrateP(void* vf);
+VorbisDec::GuestInfo* APS5_VABI sceVorbisDecInfo(void* vf, int link);
+int APS5_VABI sceVorbisDecPcmSeek(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecPcmSeekLap(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecPcmSeekPage(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecPcmSeekPageLap(void* vf, std::int64_t position);
+std::int64_t APS5_VABI sceVorbisDecPcmTell(void* vf);
+std::int64_t APS5_VABI sceVorbisDecPcmTotal(void* vf, int link);
+int APS5_VABI sceVorbisDecRawSeek(void* vf, std::int64_t position);
+int APS5_VABI sceVorbisDecRawSeekLap(void* vf, std::int64_t position);
+std::int64_t APS5_VABI sceVorbisDecRawTell(void* vf);
+std::int64_t APS5_VABI sceVorbisDecRawTotal(void* vf, int link);
+std::int64_t APS5_VABI sceVorbisDecRead(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream);
+std::int64_t APS5_VABI sceVorbisDecReadFilter(void* vf, char* buffer, int length, int bigEndian, int word, int isSigned, int* bitstream, VorbisDec::GuestFilter filter, void* filterParam);
+std::int64_t APS5_VABI sceVorbisDecReadFloat(void* vf, float*** pcmChannels, int samples, int* bitstream);
+std::int64_t APS5_VABI sceVorbisDecSeekable(void* vf);
+std::int64_t APS5_VABI sceVorbisDecSerialNumber(void* vf, int link);
+int APS5_VABI sceVorbisDecSetDecodePriority(void);
+std::int64_t APS5_VABI sceVorbisDecStreams(void* vf);
+int APS5_VABI sceVorbisDecTimeSeek(void* vf, double position);
+int APS5_VABI sceVorbisDecTimeSeekLap(void* vf, double position);
+int APS5_VABI sceVorbisDecTimeSeekPage(void* vf, double position);
+int APS5_VABI sceVorbisDecTimeSeekPageLap(void* vf, double position);
+double APS5_VABI sceVorbisDecTimeTell(void* vf);
+double APS5_VABI sceVorbisDecTimeTotal(void* vf, int link);
+
+}
diff --git a/core/libs/prx/libSceVorbisDec/include/GuestVorbisFile.hpp b/core/libs/prx/libSceVorbisDec/include/GuestVorbisFile.hpp
new file mode 100644
index 0000000000..9da5f3e1d5
--- /dev/null
+++ b/core/libs/prx/libSceVorbisDec/include/GuestVorbisFile.hpp
@@ -0,0 +1,46 @@
+#ifndef CORE_LIBS_PRX_LIBSCEVORBISDEC_INCLUDE_GUESTVORBISFILE_HPP
+#define CORE_LIBS_PRX_LIBSCEVORBISDEC_INCLUDE_GUESTVORBISFILE_HPP
+
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <cstddef>
+#include <cstdint>
+
+namespace VorbisDec {
+
+struct GuestCallbacks {
+    std::size_t (APS5_VABI *read_func)(void*, std::size_t, std::size_t, void*);
+    int (APS5_VABI *seek_func)(void*, std::int64_t, int);
+    int (APS5_VABI *close_func)(void*);
+    std::int64_t (APS5_VABI *tell_func)(void*);
+};
+
+struct GuestInfo {
+    std::int32_t version;
+    std::int32_t channels;
+    std::int64_t rate;
+    std::int64_t bitrate_upper;
+    std::int64_t bitrate_nominal;
+    std::int64_t bitrate_lower;
+    std::int64_t bitrate_window;
+    void* codec_setup;
+};
+
+struct GuestComment {
+    char** user_comments;
+    std::int32_t* comment_lengths;
+    std::int32_t comments;
+    char* vendor;
+};
+
+using GuestFilter = void (APS5_VABI *)(float**, std::int64_t, std::int64_t, void*);
+
+static_assert(sizeof(GuestCallbacks) == 32);
+static_assert(offsetof(GuestInfo, rate) == 8 && offsetof(GuestInfo, bitrate_window) == 40 && offsetof(GuestInfo, codec_setup) == 48);
+static_assert(sizeof(GuestInfo) == 56);
+static_assert(offsetof(GuestComment, comment_lengths) == 8 && offsetof(GuestComment, comments) == 16 && offsetof(GuestComment, vendor) == 24);
+static_assert(sizeof(GuestComment) == 32);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceVorbisDec/libSceVorbisDec.hpp b/core/libs/prx/libSceVorbisDec/libSceVorbisDec.hpp
new file mode 100644
index 0000000000..4e737bab8b
--- /dev/null
+++ b/core/libs/prx/libSceVorbisDec/libSceVorbisDec.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVorbisDec/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrServiceDialog/CMakeLists.txt b/core/libs/prx/libSceVrServiceDialog/CMakeLists.txt
new file mode 100644
index 0000000000..56c0611c39
--- /dev/null
+++ b/core/libs/prx/libSceVrServiceDialog/CMakeLists.txt
@@ -0,0 +1,14 @@
+add_library(libSceVrServiceDialog SHARED EXCLUDE_FROM_ALL Export.cpp)
+target_include_directories(libSceVrServiceDialog PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceVrServiceDialog)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_vr_service_dialog_tests ${LIBS_INCLUDE_DIR}/tests/GuestVrServiceDialog.cpp)
+    target_include_directories(guest_vr_service_dialog_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_vr_service_dialog_tests PRIVATE libSceVrServiceDialog)
+    add_test(NAME guest_vr_service_dialog COMMAND guest_vr_service_dialog_tests)
+    if(WIN32)
+        set_tests_properties(guest_vr_service_dialog PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceVrServiceDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceVrServiceDialog/Export.cpp b/core/libs/prx/libSceVrServiceDialog/Export.cpp
index 355ae01310..961e74e397 100644
--- a/core/libs/prx/libSceVrServiceDialog/Export.cpp
+++ b/core/libs/prx/libSceVrServiceDialog/Export.cpp
@@ -1,42 +1,71 @@
+#include "prx/libSceVrServiceDialog/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int COMMON_DIALOG_STATUS_NONE = 0;
+constexpr int COMMON_DIALOG_STATUS_INITIALIZED = 1;
+constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
+constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
+constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int COMMON_DIALOG_ERROR_ALREADY_INITIALIZED = static_cast<int>(0x80B80004u);
+constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
+constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
+
+std::atomic<int> g_status{COMMON_DIALOG_STATUS_NONE};
+
+}
+
 extern "C" {
 
-int APS5_VABI sceVrServiceDialogClose() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVrServiceDialogInitialize(void) {
+    int expected = COMMON_DIALOG_STATUS_NONE;
+    if (!g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_INITIALIZED)) return COMMON_DIALOG_ERROR_ALREADY_INITIALIZED;
     return 0;
 }
 
-int APS5_VABI sceVrServiceDialogGetResult() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVrServiceDialogOpen(const void* param) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceVrServiceDialogGetStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVrServiceDialogUpdateStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceVrServiceDialogGetStatus(void) {
+    return g_status.load();
+}
+
+int APS5_VABI sceVrServiceDialogGetResult(void* result) {
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (result == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (status != COMMON_DIALOG_STATUS_FINISHED) return COMMON_DIALOG_ERROR_NOT_FINISHED;
+    const std::int32_t canceled = COMMON_DIALOG_RESULT_USER_CANCELED;
+    std::memcpy(result, &canceled, sizeof(canceled));
     return 0;
 }
 
-int APS5_VABI sceVrServiceDialogInitialize() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVrServiceDialogClose(void) {
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    g_status = COMMON_DIALOG_STATUS_FINISHED;
     return 0;
 }
 
-int APS5_VABI sceVrServiceDialogOpen() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceVrServiceDialogTerminate() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceVrServiceDialogUpdateStatus() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVrServiceDialogTerminate(void) {
+    if (g_status.exchange(COMMON_DIALOG_STATUS_NONE) == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceVrServiceDialog/include/Api.hpp b/core/libs/prx/libSceVrServiceDialog/include/Api.hpp
new file mode 100644
index 0000000000..a68e4b7059
--- /dev/null
+++ b/core/libs/prx/libSceVrServiceDialog/include/Api.hpp
@@ -0,0 +1,15 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVrServiceDialogInitialize(void);
+int APS5_VABI sceVrServiceDialogOpen(const void* param);
+int APS5_VABI sceVrServiceDialogUpdateStatus(void);
+int APS5_VABI sceVrServiceDialogGetStatus(void);
+int APS5_VABI sceVrServiceDialogGetResult(void* result);
+int APS5_VABI sceVrServiceDialogClose(void);
+int APS5_VABI sceVrServiceDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceVrServiceDialog/libSceVrServiceDialog.hpp b/core/libs/prx/libSceVrServiceDialog/libSceVrServiceDialog.hpp
new file mode 100644
index 0000000000..b0f8e5c411
--- /dev/null
+++ b/core/libs/prx/libSceVrServiceDialog/libSceVrServiceDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrServiceDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrSetupDialog/Export.cpp b/core/libs/prx/libSceVrSetupDialog/Export.cpp
index 2aa6aad360..f9196d0109 100644
--- a/core/libs/prx/libSceVrSetupDialog/Export.cpp
+++ b/core/libs/prx/libSceVrSetupDialog/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVrSetupDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
diff --git a/core/libs/prx/libSceVrSetupDialog/include/Api.hpp b/core/libs/prx/libSceVrSetupDialog/include/Api.hpp
new file mode 100644
index 0000000000..0ee132a7e1
--- /dev/null
+++ b/core/libs/prx/libSceVrSetupDialog/include/Api.hpp
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceVrSetupDialogInitialize(void);
+int APS5_VABI sceVrSetupDialogOpen(const VrSetupDialogParam* param);
+int APS5_VABI sceVrSetupDialogUpdateStatus(void);
+int APS5_VABI sceVrSetupDialogGetStatus(void);
+int APS5_VABI sceVrSetupDialogGetResult(std::int32_t* result);
+int APS5_VABI sceVrSetupDialogClose(void);
+int APS5_VABI sceVrSetupDialogTerminate(void);
+
+}
diff --git a/core/libs/prx/libSceVrSetupDialog/libSceVrSetupDialog.hpp b/core/libs/prx/libSceVrSetupDialog/libSceVrSetupDialog.hpp
new file mode 100644
index 0000000000..85cdf54080
--- /dev/null
+++ b/core/libs/prx/libSceVrSetupDialog/libSceVrSetupDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrSetupDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrTracker/Export.cpp b/core/libs/prx/libSceVrTracker/Export.cpp
index 14776d3483..7e66fd197e 100644
--- a/core/libs/prx/libSceVrTracker/Export.cpp
+++ b/core/libs/prx/libSceVrTracker/Export.cpp
@@ -1,68 +1,17 @@
+#include "prx/libSceVrTracker/include/Api.hpp"
+#include <atomic>
+#include <mutex>
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct VrTrackerMemoryBlock {
-    void* address;
-    std::uint32_t size;
-    std::uint32_t alignment;
-};
-
-struct VrTrackerInitConfig {
-    std::uint32_t type;
-    std::uint32_t option;
-    std::uint32_t mode;
-    std::uint32_t parameter;
-    std::uint32_t reserved[4];
-};
-
-struct VrTrackerInitParam {
-    std::uint32_t size;
-    std::int32_t mode;
-    std::uint32_t reserved[6];
-    VrTrackerInitConfig config;
-    VrTrackerMemoryBlock memory[3];
-    std::uint32_t option112;
-    std::uint32_t option116;
-    std::uint32_t reservedTail[6];
-};
-
 static_assert(sizeof(VrTrackerMemoryBlock) == 16);
 static_assert(sizeof(VrTrackerInitConfig) == 32);
 static_assert(sizeof(VrTrackerInitParam) == 144);
 static_assert(offsetof(VrTrackerInitParam, config) == 32);
 static_assert(offsetof(VrTrackerInitParam, memory) == 64);
 static_assert(offsetof(VrTrackerInitParam, option112) == 112);
-struct VrTrackerGpuSubmitParam;
-struct VrTrackerResult;
-
-struct VrTrackerCpuProcessParam {
-    std::uint32_t size;
-    std::uint32_t mode;
-    std::uint32_t argument;
-    std::uint32_t reserved[5];
-};
-
-struct VrTrackerGpuWaitParam {
-    std::uint32_t size;
-    std::byte payload[28];
-};
-
-struct VrTrackerGetResultParam {
-    std::uint32_t size;
-    std::int32_t handle;
-    std::uint32_t mode;
-    std::uint32_t extendedResult;
-    std::uint64_t time;
-    std::uint32_t statusMode;
-    std::uint32_t reserved0;
-    std::uint32_t option32;
-    std::byte outputValue[4];
-    std::uint32_t option40;
-    std::uint32_t reserved1[2];
-    std::byte unused[4];
-};
 
 static_assert(sizeof(VrTrackerCpuProcessParam) == 32);
 static_assert(offsetof(VrTrackerCpuProcessParam, mode) == 4);
@@ -74,6 +23,50 @@ static_assert(offsetof(VrTrackerGetResultParam, statusMode) == 24);
 static_assert(offsetof(VrTrackerGetResultParam, outputValue) == 36);
 static_assert(offsetof(VrTrackerGetResultParam, reserved1) == 44);
 
+namespace {
+
+using namespace VrTrackerLegacy;
+
+constexpr int NotInit = static_cast<int>(0x81260801u);
+constexpr int AlreadyInitialized = static_cast<int>(0x81260802u);
+constexpr int DeviceNotRegistered = static_cast<int>(0x81260803u);
+constexpr int DeviceAlreadyRegistered = static_cast<int>(0x81260804u);
+constexpr int ArgumentInvalid = static_cast<int>(0x81260806u);
+constexpr int NotExecuteGpuSubmit = static_cast<int>(0x81260815u);
+
+constexpr std::uint32_t MemoryAlignment = 0x10000;
+constexpr std::uint32_t BaseOnionSize = 0x400000;
+constexpr std::uint32_t GarlicSize = 0x3000000;
+constexpr std::uint32_t WorkSize = 0x1000000;
+constexpr std::uint32_t CalibrationManual = 0;
+constexpr std::uint32_t CalibrationAuto = 1;
+
+static_assert(sizeof(QueryMemoryParam) == 0x40);
+
+bool ValidCalibration(const CalibrationSettings& settings) {
+    return settings.pad_position <= CalibrationAuto && settings.hmd_position <= CalibrationManual &&
+        settings.move_position <= CalibrationAuto && settings.gun_position <= CalibrationAuto;
+}
+
+std::uint32_t OnionSize(const CalibrationSettings& settings) {
+    return settings.move_position == CalibrationAuto ? BaseOnionSize * 2 : BaseOnionSize;
+}
+
+constexpr std::int32_t ComputePipes = 7;
+constexpr std::int32_t QueuesPerPipe = 8;
+
+static_assert(sizeof(InitParam) == 0x80);
+
+std::atomic<bool> g_initialized{false};
+
+constexpr std::uint32_t DeviceHmd = 0;
+constexpr std::uint32_t DeviceGun = 3;
+
+std::mutex g_devicesMutex;
+std::int32_t g_deviceHandles[DeviceGun + 1] = {-1, -1, -1, -1};
+
+} // namespace
+
 extern "C" {
 
 int APS5_VABI sceVrTrackerCpuProcess(const VrTrackerCpuProcessParam* param) {
@@ -97,8 +90,20 @@ int APS5_VABI sceVrTrackerGpuWait(const VrTrackerGpuWaitParam* param) {
     return 0;
 }
 int APS5_VABI sceVrTrackerInit(const VrTrackerInitParam* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (g_initialized.load()) return AlreadyInitialized;
+    if (param && param->size == sizeof(VrTrackerInitParam)) NotImplemented_nid_no_patch(__func__);
+    const auto* init = reinterpret_cast<const InitParam*>(param);
+    if (!init || init->size != sizeof(InitParam) || !init->direct_memory_garlic ||
+        init->direct_memory_garlic_alignment != MemoryAlignment || init->direct_memory_garlic_size != GarlicSize ||
+        !init->direct_memory_onion || init->direct_memory_onion_alignment != MemoryAlignment ||
+        init->direct_memory_onion_size != OnionSize(init->calibration_settings) || !init->work_memory ||
+        init->work_memory_alignment != MemoryAlignment || init->work_memory_size != WorkSize ||
+        init->gpu_pipe_id >= ComputePipes || init->gpu_queue_id >= QueuesPerPipe ||
+        !ValidCalibration(init->calibration_settings)) {
+        return ArgumentInvalid;
+    }
+    bool expected = false;
+    return g_initialized.compare_exchange_strong(expected, true) ? 0 : AlreadyInitialized;
 }
 int APS5_VABI sceVrTrackerCpuPopMarker() {
     NotImplemented_nid_no_patch(__func__);
@@ -117,31 +122,48 @@ int APS5_VABI sceVrTrackerGetPlayAreaWarningInfo(void* info) {
     return 0;
 }
 int APS5_VABI sceVrTrackerGpuWaitAndCpuProcess() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return g_initialized.load() ? NotExecuteGpuSubmit : NotInit;
 }
 int APS5_VABI sceVrTrackerNotifyEndOfCpuProcess(const void* param) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 int APS5_VABI sceVrTrackerQueryMemory(const void* param, void* result) {
-    NotImplemented_nid_no_patch(__func__);
+    const auto* query = static_cast<const QueryMemoryParam*>(param);
+    auto* memory = static_cast<QueryMemoryResult*>(result);
+    if (!query || !memory || query->size != sizeof(QueryMemoryParam) || (query->profile != 0 && query->profile != 100) ||
+        !ValidCalibration(query->calibration_settings)) {
+        return ArgumentInvalid;
+    }
+    memory->direct_memory_onion_size = OnionSize(query->calibration_settings);
+    memory->direct_memory_onion_alignment = MemoryAlignment;
+    memory->direct_memory_garlic_size = GarlicSize;
+    memory->direct_memory_garlic_alignment = MemoryAlignment;
+    memory->work_memory_size = WorkSize;
+    memory->work_memory_alignment = MemoryAlignment;
     return 0;
 }
 int APS5_VABI sceVrTrackerRecalibrate(const void* param) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (!g_initialized.load()) return NotInit;
+    const auto* recalibrate = static_cast<const RecalibrateParam*>(param);
+    if (!recalibrate || recalibrate->size != sizeof(RecalibrateParam) || recalibrate->device_type > DeviceGun) return ArgumentInvalid;
+    if (recalibrate->device_type == DeviceHmd) return DeviceNotRegistered;
+    std::lock_guard lock(g_devicesMutex);
+    return g_deviceHandles[recalibrate->device_type] == -1 ? DeviceNotRegistered : 0;
 }
 int APS5_VABI sceVrTrackerRegisterDevice(int device_type, int handle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceVrTrackerRegisterDeviceInternal(device_type, handle, -1, 0);
 }
 int APS5_VABI sceVrTrackerRegisterDevice2(int device_type, int handle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return sceVrTrackerRegisterDeviceInternal(device_type, handle, -1, 1);
 }
-int APS5_VABI sceVrTrackerRegisterDeviceInternal(int device_type, int handle, int unk0, int unk1) {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceVrTrackerRegisterDeviceInternal(int device_type, int handle, int unk0, int) {
+    if (!g_initialized.load()) return NotInit;
+    const auto type = static_cast<std::uint32_t>(device_type);
+    if (type > DeviceGun || unk0 > 4) return ArgumentInvalid;
+    std::lock_guard lock(g_devicesMutex);
+    if (g_deviceHandles[type] != -1) return DeviceAlreadyRegistered;
+    g_deviceHandles[type] = handle;
     return 0;
 }
 int APS5_VABI sceVrTrackerResetAll() {
@@ -160,9 +182,9 @@ int APS5_VABI sceVrTrackerSetDeviceRejection() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceVrTrackerSetDurationUntilStatusNotTracking(int device_type, std::uint32_t duration_camera_frames) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceVrTrackerSetDurationUntilStatusNotTracking(int device_type, std::uint32_t) {
+    if (!g_initialized.load()) return NotInit;
+    return static_cast<std::uint32_t>(device_type) > DeviceGun ? ArgumentInvalid : 0;
 }
 int APS5_VABI sceVrTrackerSetExtendedMode() {
     NotImplemented_nid_no_patch(__func__);
@@ -185,12 +207,20 @@ int APS5_VABI sceVrTrackerStopLiveCapture() {
     return 0;
 }
 int APS5_VABI sceVrTrackerTerm() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    bool expected = true;
+    return g_initialized.compare_exchange_strong(expected, false) ? 0 : NotInit;
 }
 int APS5_VABI sceVrTrackerUnregisterDevice(int handle) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    if (!g_initialized.load()) return NotInit;
+    if (handle < 0) return ArgumentInvalid;
+    std::lock_guard lock(g_devicesMutex);
+    for (auto& registered : g_deviceHandles) {
+        if (registered == handle) {
+            registered = -1;
+            return 0;
+        }
+    }
+    return ArgumentInvalid;
 }
 int APS5_VABI sceVrTrackerUpdateMotionSensorData(const void* param) {
     NotImplemented_nid_no_patch(__func__);
diff --git a/core/libs/prx/libSceVrTracker/include/Api.hpp b/core/libs/prx/libSceVrTracker/include/Api.hpp
new file mode 100644
index 0000000000..0481e61d60
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker/include/Api.hpp
@@ -0,0 +1,159 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+
+struct VrTrackerMemoryBlock {
+    void* address;
+    std::uint32_t size;
+    std::uint32_t alignment;
+};
+
+struct VrTrackerInitConfig {
+    std::uint32_t type;
+    std::uint32_t option;
+    std::uint32_t mode;
+    std::uint32_t parameter;
+    std::uint32_t reserved[4];
+};
+
+struct VrTrackerInitParam {
+    std::uint32_t size;
+    std::int32_t mode;
+    std::uint32_t reserved[6];
+    VrTrackerInitConfig config;
+    VrTrackerMemoryBlock memory[3];
+    std::uint32_t option112;
+    std::uint32_t option116;
+    std::uint32_t reservedTail[6];
+};
+
+struct VrTrackerGpuSubmitParam;
+
+struct VrTrackerResult;
+
+struct VrTrackerCpuProcessParam {
+    std::uint32_t size;
+    std::uint32_t mode;
+    std::uint32_t argument;
+    std::uint32_t reserved[5];
+};
+
+struct VrTrackerGpuWaitParam {
+    std::uint32_t size;
+    std::byte payload[28];
+};
+
+struct VrTrackerGetResultParam {
+    std::uint32_t size;
+    std::int32_t handle;
+    std::uint32_t mode;
+    std::uint32_t extendedResult;
+    std::uint64_t time;
+    std::uint32_t statusMode;
+    std::uint32_t reserved0;
+    std::uint32_t option32;
+    std::byte outputValue[4];
+    std::uint32_t option40;
+    std::uint32_t reserved1[2];
+    std::byte unused[4];
+};
+
+namespace VrTrackerLegacy {
+
+struct CalibrationSettings {
+    std::uint32_t hmd_position;
+    std::uint32_t pad_position;
+    std::uint32_t move_position;
+    std::uint32_t gun_position;
+    std::uint32_t reserved[4];
+};
+
+struct QueryMemoryParam {
+    std::uint32_t size;
+    std::uint32_t profile;
+    std::uint32_t reserved[6];
+    CalibrationSettings calibration_settings;
+};
+
+struct QueryMemoryResult {
+    std::uint32_t size;
+    std::uint32_t direct_memory_onion_size;
+    std::uint32_t direct_memory_onion_alignment;
+    std::uint32_t direct_memory_garlic_size;
+    std::uint32_t direct_memory_garlic_alignment;
+    std::uint32_t work_memory_size;
+    std::uint32_t work_memory_alignment;
+    std::uint32_t reserved[9];
+};
+
+struct InitParam {
+    std::uint32_t size;
+    std::uint32_t profile;
+    std::uint32_t execution_mode;
+    std::int32_t hmd_thread_priority;
+    std::int32_t pad_thread_priority;
+    std::int32_t move_thread_priority;
+    std::int32_t gun_thread_priority;
+    std::int32_t reserved;
+    std::uint64_t cpu_mask;
+    CalibrationSettings calibration_settings;
+    void* direct_memory_onion;
+    std::uint32_t direct_memory_onion_size;
+    std::uint32_t direct_memory_onion_alignment;
+    void* direct_memory_garlic;
+    std::uint32_t direct_memory_garlic_size;
+    std::uint32_t direct_memory_garlic_alignment;
+    void* work_memory;
+    std::uint32_t work_memory_size;
+    std::uint32_t work_memory_alignment;
+    std::int32_t gpu_pipe_id;
+    std::int32_t gpu_queue_id;
+};
+
+struct RecalibrateParam {
+    std::uint32_t size;
+    std::uint32_t device_type;
+    std::uint32_t calibration_type;
+    std::uint32_t reserved[5];
+};
+
+}
+
+extern "C" {
+
+int APS5_VABI sceVrTrackerCpuProcess(const VrTrackerCpuProcessParam* param);
+int APS5_VABI sceVrTrackerGetResult(const VrTrackerGetResultParam* param, VrTrackerResult* result);
+int APS5_VABI sceVrTrackerGetTime(std::uint64_t* time);
+int APS5_VABI sceVrTrackerGpuSubmit(const VrTrackerGpuSubmitParam* param);
+int APS5_VABI sceVrTrackerGpuWait(const VrTrackerGpuWaitParam* param);
+int APS5_VABI sceVrTrackerInit(const VrTrackerInitParam* param);
+int APS5_VABI sceVrTrackerCpuPopMarker();
+int APS5_VABI sceVrTrackerCpuPushMarker();
+int APS5_VABI sceVrTrackerGetLiveCaptureId();
+int APS5_VABI sceVrTrackerGetPlayAreaWarningInfo(void* info);
+int APS5_VABI sceVrTrackerGpuWaitAndCpuProcess();
+int APS5_VABI sceVrTrackerNotifyEndOfCpuProcess(const void* param);
+int APS5_VABI sceVrTrackerQueryMemory(const void* param, void* result);
+int APS5_VABI sceVrTrackerRecalibrate(const void* param);
+int APS5_VABI sceVrTrackerRegisterDevice(int deviceType, int handle);
+int APS5_VABI sceVrTrackerRegisterDevice2(int deviceType, int handle);
+int APS5_VABI sceVrTrackerRegisterDeviceInternal(int deviceType, int handle, int unk0, int);
+int APS5_VABI sceVrTrackerResetAll();
+int APS5_VABI sceVrTrackerResetOrientationRelative(int deviceType, int handle);
+int APS5_VABI sceVrTrackerSaveInternalBuffers();
+int APS5_VABI sceVrTrackerSetDeviceRejection();
+int APS5_VABI sceVrTrackerSetDurationUntilStatusNotTracking(int deviceType, std::uint32_t);
+int APS5_VABI sceVrTrackerSetExtendedMode();
+int APS5_VABI sceVrTrackerSetLEDBrightness();
+int APS5_VABI sceVrTrackerSetRestingMode();
+int APS5_VABI sceVrTrackerStartLiveCapture();
+int APS5_VABI sceVrTrackerStopLiveCapture();
+int APS5_VABI sceVrTrackerTerm();
+int APS5_VABI sceVrTrackerUnregisterDevice(int handle);
+int APS5_VABI sceVrTrackerUpdateMotionSensorData(const void* param);
+
+}
diff --git a/core/libs/prx/libSceVrTracker/libSceVrTracker.hpp b/core/libs/prx/libSceVrTracker/libSceVrTracker.hpp
new file mode 100644
index 0000000000..81621f7084
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker/libSceVrTracker.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrTracker/include/Api.hpp"
diff --git a/core/libs/prx/libSceVrTracker2/Export.cpp b/core/libs/prx/libSceVrTracker2/Export.cpp
index 2e521f452e..680bd23351 100644
--- a/core/libs/prx/libSceVrTracker2/Export.cpp
+++ b/core/libs/prx/libSceVrTracker2/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVrTracker2/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -6,34 +7,6 @@
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 
-struct VrTracker2InitializeParameter {
-    std::uint32_t size;
-    std::uint32_t mode;
-    std::int32_t threadPriorities[2];
-    std::uint64_t threadAffinityMasks[2];
-    void* workMemory;
-    std::uint32_t workMemorySize;
-    std::uint32_t workMemoryAlignment;
-    std::uint32_t option;
-    std::uint32_t coordinateSystem;
-    std::uint8_t disableOption;
-    std::int8_t optionMode;
-    std::uint8_t reserved[14];
-};
-
-struct VrTracker2MemoryParameter {
-    std::uint32_t size;
-    std::uint32_t mode;
-    std::uint8_t reserved[24];
-};
-
-struct VrTracker2MemoryRequirement {
-    std::uint32_t size;
-    std::uint32_t memorySize;
-    std::uint32_t memoryAlignment;
-    std::uint8_t reserved[20];
-};
-
 static_assert(sizeof(VrTracker2InitializeParameter) == 72);
 static_assert(offsetof(VrTracker2InitializeParameter, threadAffinityMasks) == 16);
 static_assert(offsetof(VrTracker2InitializeParameter, workMemory) == 32);
@@ -41,55 +14,14 @@ static_assert(offsetof(VrTracker2InitializeParameter, coordinateSystem) == 52);
 static_assert(offsetof(VrTracker2InitializeParameter, reserved) == 58);
 static_assert(sizeof(VrTracker2MemoryParameter) == 32);
 static_assert(sizeof(VrTracker2MemoryRequirement) == 32);
-struct VrTracker2LegacyParameter12 {
-    std::uint32_t size;
-    std::uint8_t opaque[8];
-};
-
-struct VrTracker2LegacyParameter20 {
-    std::uint32_t size;
-    std::uint8_t opaque[16];
-};
-
-struct VrTracker2UnsupportedCoordinateParameter;
 
 static_assert(sizeof(VrTracker2LegacyParameter12) == 12);
 static_assert(sizeof(VrTracker2LegacyParameter20) == 20);
 
-struct VrTracker2CalibrationResult;
-struct VrTracker2TelemetryData;
-struct VrTracker2PoseParameter;
-struct VrTracker2PoseResult;
-
-struct VrTracker2MeshRequirement {
-    std::uint32_t vertexCount;
-    std::uint32_t indexCount;
-    std::uint32_t vertexDataSize;
-    std::uint32_t indexDataSize;
-};
-
-struct VrTracker2Pose {
-    float position[3];
-    std::uint8_t padding[4];
-    float orientation[4];
-};
-
 static_assert(sizeof(VrTracker2MeshRequirement) == 16);
 static_assert(sizeof(VrTracker2Pose) == 32);
 static_assert(offsetof(VrTracker2Pose, orientation) == 16);
 
-struct VrTracker2ResultParameter {
-    std::uint32_t size;
-    std::int32_t deviceHandle;
-    std::uint32_t reserved;
-    std::uint8_t padding[4];
-    std::uint64_t timestamp;
-    std::uint32_t reserved2;
-    std::uint8_t padding2[4];
-    std::uint64_t userTag;
-    std::uint32_t reserved3[2];
-};
-
 struct VrTracker2LegacyResultParameter {
     std::uint32_t size;
     std::int32_t deviceHandle;
@@ -105,20 +37,6 @@ static_assert(offsetof(VrTracker2ResultParameter, timestamp) == 16);
 static_assert(offsetof(VrTracker2ResultParameter, userTag) == 32);
 static_assert(sizeof(VrTracker2LegacyResultParameter) == 32);
 static_assert(offsetof(VrTracker2LegacyResultParameter, userTag) == 24);
-struct VrTracker2Result;
-struct VrTracker2CoordinateLocation;
-
-struct VrTracker2BoundaryGeometry {
-    std::uint32_t size;
-    std::uint32_t pointCount;
-    float points[256][3];
-};
-
-struct VrTracker2OrientedBoundingBox {
-    std::uint32_t size;
-    float transform[16];
-    float extents[3];
-};
 
 static_assert(sizeof(VrTracker2BoundaryGeometry) == 3080);
 static_assert(offsetof(VrTracker2BoundaryGeometry, points) == 8);
@@ -140,130 +58,30 @@ std::int32_t ClearThenReportNotInitialized(void* output, std::size_t size) {
 
 }
 
-struct VrTracker2RelativePoseResult {
-    VrTracker2Pose pose;
-    std::uint8_t reserved[32];
-};
-
 static_assert(sizeof(VrTracker2RelativePoseResult) == 64);
 
-struct VrTracker2ScalarResult {
-    std::uint32_t size;
-    float value;
-};
-
-struct VrTracker2TrackingOptions {
-    std::int32_t options[3];
-    std::uint8_t reset;
-    std::uint8_t reserved[3];
-    float vector[3];
-};
-
-struct VrTracker2TrackingOptionsResult {
-    VrTracker2TrackingOptions options;
-    float position[3];
-};
-
-struct VrTracker2DiagnosticResult;
-struct VrTracker2ExtendedResult;
-struct VrTracker2TrackingConfiguration;
-
 static_assert(sizeof(VrTracker2ScalarResult) == 8);
 static_assert(sizeof(VrTracker2TrackingOptions) == 28);
 static_assert(offsetof(VrTracker2TrackingOptions, vector) == 16);
 static_assert(sizeof(VrTracker2TrackingOptionsResult) == 40);
 static_assert(offsetof(VrTracker2TrackingOptionsResult, position) == 28);
 
-struct VrTracker2ModeParameter {
-    std::uint32_t size;
-    std::uint32_t mode;
-    float value;
-};
-
-struct VrTracker2DiagnosticText {
-    char sections[6][512];
-};
-
-struct VrTracker2CompositePoseResult;
-struct VrTracker2CameraImages;
-struct VrTracker2SensorFrame;
-struct VrTracker2TrackingStatus;
-struct VrTracker2BoundaryParameter;
-
 static_assert(sizeof(VrTracker2ModeParameter) == 12);
 static_assert(sizeof(VrTracker2DiagnosticText) == 3072);
 
-struct VrTracker2CameraFrame {
-    std::uint32_t selector;
-    std::uint32_t identifiers[2];
-    std::uint32_t width;
-    std::uint32_t height;
-    std::uint32_t pitch;
-    const void* pixels;
-    std::int32_t bufferIndex;
-};
-
-struct VrTracker2CameraFrameMetadata;
-
 static_assert(offsetof(VrTracker2CameraFrame, pixels) == 24);
 static_assert(offsetof(VrTracker2CameraFrame, bufferIndex) == 32);
 static_assert(sizeof(VrTracker2CameraFrame) == 40);
 
-struct VrTracker2SpatialQueryResult {
-    std::uint32_t size;
-    std::int32_t status;
-    float vectors[2][3];
-    float value;
-};
-
-struct VrTracker2DeviceCalibrationStatus;
-struct VrTracker2DeviceBoundaryParameter;
-struct VrTracker2ResetPoseParameter;
-
 static_assert(sizeof(VrTracker2SpatialQueryResult) == 36);
 static_assert(offsetof(VrTracker2SpatialQueryResult, vectors) == 8);
 static_assert(offsetof(VrTracker2SpatialQueryResult, value) == 32);
 
-struct VrTracker2MapData;
-struct VrTracker2MapStatus;
-
-struct VrTracker2RuntimeStatus;
-struct VrTracker2DiagnosticState;
-struct VrTracker2ExtendedDiagnosticState;
-struct VrTracker2SensorDiagnostics;
-struct VrTracker2DeviceDiagnostics;
-struct VrTracker2TimingDiagnostics;
-struct VrTracker2MapConfiguration;
-struct VrTracker2SensorSummary;
-
-struct VrTracker2CoordinateResultParameter {
-    std::uint32_t coordinateSystem;
-    std::uint32_t reserved;
-    VrTracker2ResultParameter parameter;
-};
-
-struct VrTracker2BoundaryFitResult {
-    std::uint8_t flags[4];
-    float dimensions[4];
-};
-
-struct VrTracker2VectorResult {
-    std::uint32_t size;
-    float value[3];
-};
-
-struct VrTracker2ExtendedTrackingResult;
-
 static_assert(sizeof(VrTracker2CoordinateResultParameter) == 56);
 static_assert(offsetof(VrTracker2CoordinateResultParameter, parameter) == 8);
 static_assert(sizeof(VrTracker2BoundaryFitResult) == 20);
 static_assert(sizeof(VrTracker2VectorResult) == 16);
 
-struct VrTracker2MeshVertex;
-struct VrTracker2TimedPoseResult;
-struct VrTracker2ImagePoseResult;
-struct VrTracker2ImageFrame;
-
 extern "C" {
 
 std::int32_t APS5_VABI sceVrTracker2Finalize() {
diff --git a/core/libs/prx/libSceVrTracker2/include/Api.hpp b/core/libs/prx/libSceVrTracker2/include/Api.hpp
new file mode 100644
index 0000000000..871f89b821
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker2/include/Api.hpp
@@ -0,0 +1,310 @@
+#pragma once
+
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+
+struct VrTracker2InitializeParameter {
+    std::uint32_t size;
+    std::uint32_t mode;
+    std::int32_t threadPriorities[2];
+    std::uint64_t threadAffinityMasks[2];
+    void* workMemory;
+    std::uint32_t workMemorySize;
+    std::uint32_t workMemoryAlignment;
+    std::uint32_t option;
+    std::uint32_t coordinateSystem;
+    std::uint8_t disableOption;
+    std::int8_t optionMode;
+    std::uint8_t reserved[14];
+};
+
+struct VrTracker2MemoryParameter {
+    std::uint32_t size;
+    std::uint32_t mode;
+    std::uint8_t reserved[24];
+};
+
+struct VrTracker2MemoryRequirement {
+    std::uint32_t size;
+    std::uint32_t memorySize;
+    std::uint32_t memoryAlignment;
+    std::uint8_t reserved[20];
+};
+
+struct VrTracker2LegacyParameter12 {
+    std::uint32_t size;
+    std::uint8_t opaque[8];
+};
+
+struct VrTracker2LegacyParameter20 {
+    std::uint32_t size;
+    std::uint8_t opaque[16];
+};
+
+struct VrTracker2UnsupportedCoordinateParameter;
+
+struct VrTracker2CalibrationResult;
+
+struct VrTracker2TelemetryData;
+
+struct VrTracker2PoseParameter;
+
+struct VrTracker2PoseResult;
+
+struct VrTracker2MeshRequirement {
+    std::uint32_t vertexCount;
+    std::uint32_t indexCount;
+    std::uint32_t vertexDataSize;
+    std::uint32_t indexDataSize;
+};
+
+struct VrTracker2Pose {
+    float position[3];
+    std::uint8_t padding[4];
+    float orientation[4];
+};
+
+struct VrTracker2ResultParameter {
+    std::uint32_t size;
+    std::int32_t deviceHandle;
+    std::uint32_t reserved;
+    std::uint8_t padding[4];
+    std::uint64_t timestamp;
+    std::uint32_t reserved2;
+    std::uint8_t padding2[4];
+    std::uint64_t userTag;
+    std::uint32_t reserved3[2];
+};
+
+struct VrTracker2Result;
+
+struct VrTracker2CoordinateLocation;
+
+struct VrTracker2BoundaryGeometry {
+    std::uint32_t size;
+    std::uint32_t pointCount;
+    float points[256][3];
+};
+
+struct VrTracker2OrientedBoundingBox {
+    std::uint32_t size;
+    float transform[16];
+    float extents[3];
+};
+
+struct VrTracker2RelativePoseResult {
+    VrTracker2Pose pose;
+    std::uint8_t reserved[32];
+};
+
+struct VrTracker2ScalarResult {
+    std::uint32_t size;
+    float value;
+};
+
+struct VrTracker2TrackingOptions {
+    std::int32_t options[3];
+    std::uint8_t reset;
+    std::uint8_t reserved[3];
+    float vector[3];
+};
+
+struct VrTracker2TrackingOptionsResult {
+    VrTracker2TrackingOptions options;
+    float position[3];
+};
+
+struct VrTracker2DiagnosticResult;
+
+struct VrTracker2ExtendedResult;
+
+struct VrTracker2TrackingConfiguration;
+
+struct VrTracker2ModeParameter {
+    std::uint32_t size;
+    std::uint32_t mode;
+    float value;
+};
+
+struct VrTracker2DiagnosticText {
+    char sections[6][512];
+};
+
+struct VrTracker2CompositePoseResult;
+
+struct VrTracker2CameraImages;
+
+struct VrTracker2SensorFrame;
+
+struct VrTracker2TrackingStatus;
+
+struct VrTracker2BoundaryParameter;
+
+struct VrTracker2CameraFrame {
+    std::uint32_t selector;
+    std::uint32_t identifiers[2];
+    std::uint32_t width;
+    std::uint32_t height;
+    std::uint32_t pitch;
+    const void* pixels;
+    std::int32_t bufferIndex;
+};
+
+struct VrTracker2CameraFrameMetadata;
+
+struct VrTracker2SpatialQueryResult {
+    std::uint32_t size;
+    std::int32_t status;
+    float vectors[2][3];
+    float value;
+};
+
+struct VrTracker2DeviceCalibrationStatus;
+
+struct VrTracker2DeviceBoundaryParameter;
+
+struct VrTracker2ResetPoseParameter;
+
+struct VrTracker2MapData;
+
+struct VrTracker2MapStatus;
+
+struct VrTracker2RuntimeStatus;
+
+struct VrTracker2DiagnosticState;
+
+struct VrTracker2ExtendedDiagnosticState;
+
+struct VrTracker2SensorDiagnostics;
+
+struct VrTracker2DeviceDiagnostics;
+
+struct VrTracker2TimingDiagnostics;
+
+struct VrTracker2MapConfiguration;
+
+struct VrTracker2SensorSummary;
+
+struct VrTracker2CoordinateResultParameter {
+    std::uint32_t coordinateSystem;
+    std::uint32_t reserved;
+    VrTracker2ResultParameter parameter;
+};
+
+struct VrTracker2BoundaryFitResult {
+    std::uint8_t flags[4];
+    float dimensions[4];
+};
+
+struct VrTracker2VectorResult {
+    std::uint32_t size;
+    float value[3];
+};
+
+struct VrTracker2ExtendedTrackingResult;
+
+struct VrTracker2MeshVertex;
+
+struct VrTracker2TimedPoseResult;
+
+struct VrTracker2ImagePoseResult;
+
+struct VrTracker2ImageFrame;
+
+extern "C" {
+
+std::int32_t APS5_VABI sceVrTracker2Finalize();
+std::int32_t APS5_VABI sceVrTracker2GetCoordinateSystem(std::uint32_t* coordinateSystem);
+std::int32_t APS5_VABI sceVrTracker2GetPlayAreaBoundaryGeometry(VrTracker2BoundaryGeometry* geometry);
+std::int32_t APS5_VABI sceVrTracker2GetPlayAreaOrientedBoundingBox(VrTracker2OrientedBoundingBox* box);
+std::int32_t APS5_VABI sceVrTracker2GetResult(const VrTracker2ResultParameter* parameter, VrTracker2Result* result);
+std::int32_t APS5_VABI sceVrTracker2LocateCoordinateSystem(std::uint32_t coordinateSystem, VrTracker2CoordinateLocation* location);
+std::int32_t APS5_VABI sceVrTracker2RegisterDevice(std::uint32_t deviceType, std::int32_t deviceHandle);
+std::int32_t APS5_VABI sceVrTracker2ResetLocalCoordinate(std::int32_t deviceHandle);
+std::int32_t APS5_VABI sceVrTracker2SetCoordinateSystem(std::uint32_t coordinateSystem);
+std::int32_t APS5_VABI sceVrTracker2UnregisterDevice(std::int32_t deviceHandle);
+std::int32_t APS5_VABI sceVrTracker2QueryMemory(const VrTracker2MemoryParameter* parameter, VrTracker2MemoryRequirement* requirement);
+std::int32_t APS5_VABI sceVrTracker2Initialize(const VrTracker2InitializeParameter* parameter);
+std::int32_t APS5_VABI VrTracker2GetRelativePose(std::uint32_t firstCoordinateSystem, std::uint32_t secondCoordinateSystem, VrTracker2RelativePoseResult* result);
+std::int32_t APS5_VABI VrTracker2GetDiagnosticResult(VrTracker2DiagnosticResult* result);
+std::int32_t APS5_VABI VrTracker2SetTrackingOptions(const VrTracker2TrackingOptions* options);
+std::int32_t APS5_VABI VrTracker2GetTrackingOptions(VrTracker2TrackingOptionsResult* result);
+std::int32_t APS5_VABI VrTracker2GetExtendedResult(VrTracker2ExtendedResult* result);
+std::int32_t APS5_VABI VrTracker2GetCompositePose(const VrTracker2ResultParameter* parameter, VrTracker2CompositePoseResult* result);
+std::int32_t APS5_VABI VrTracker2GetCounter(std::uint64_t* counter, std::uint32_t selector);
+std::int32_t APS5_VABI VrTracker2SetTrackingConfiguration(const VrTracker2TrackingConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2GetTrackingConfiguration(VrTracker2TrackingConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2GetCameraImages(VrTracker2CameraImages* images);
+std::int32_t APS5_VABI VrTracker2GetCameraImage(void* image, std::uint32_t size, std::uint32_t* frameId);
+std::int32_t APS5_VABI VrTracker2GetDiagnosticText(VrTracker2DiagnosticText* text);
+std::int32_t APS5_VABI VrTracker2GetSensorFrame(VrTracker2SensorFrame* frame);
+std::int32_t APS5_VABI VrTracker2GetTrackingStatus(VrTracker2TrackingStatus* status);
+std::int32_t APS5_VABI VrTracker2GetBoundaryParameter(VrTracker2BoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2SetBoundaryParameter(const VrTracker2BoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2SetMode(const VrTracker2ModeParameter* parameter);
+std::int32_t APS5_VABI VrTracker2GetScalarResult(VrTracker2ScalarResult* result);
+std::int32_t APS5_VABI VrTracker2LegacyQuery12(const VrTracker2LegacyParameter12* parameter);
+std::int32_t APS5_VABI VrTracker2LegacyQuery20(const VrTracker2LegacyParameter20* parameter);
+std::int32_t APS5_VABI VrTracker2UnsupportedCoordinateOperation(const VrTracker2UnsupportedCoordinateParameter* parameter);
+std::int32_t APS5_VABI VrTracker2AcquireCameraFrame(std::uint32_t selector, VrTracker2CameraFrame* frame);
+std::int32_t APS5_VABI VrTracker2AcquireCameraFrameWithMetadata(std::uint32_t selector, VrTracker2CameraFrame* frame, VrTracker2CameraFrameMetadata* metadata);
+std::int32_t APS5_VABI VrTracker2ReleaseCameraFrame(const VrTracker2CameraFrame* frame);
+std::int32_t APS5_VABI VrTracker2SetScalarOption(float value);
+std::int32_t APS5_VABI VrTracker2GetScalarOption(float* value);
+std::int32_t APS5_VABI VrTracker2SelectCoordinateSystem(std::uint32_t coordinateSystem);
+std::int32_t APS5_VABI VrTracker2GetSelectedCoordinateSystem(std::uint32_t* coordinateSystem);
+std::int32_t APS5_VABI VrTracker2ResetDevicePose(std::int32_t deviceHandle);
+std::int32_t APS5_VABI VrTracker2ResetPose(const VrTracker2ResetPoseParameter* parameter);
+std::int32_t APS5_VABI VrTracker2QueryPosition(const float* position, VrTracker2SpatialQueryResult* result);
+std::int32_t APS5_VABI VrTracker2QueryDevicePosition(std::int32_t deviceHandle, VrTracker2SpatialQueryResult* result);
+std::int32_t APS5_VABI VrTracker2GetTrackingBounds(VrTracker2OrientedBoundingBox* bounds);
+std::int32_t APS5_VABI VrTracker2GetDeviceState(std::int32_t deviceHandle, std::int32_t* state);
+std::int32_t APS5_VABI VrTracker2GetDeviceCalibrationStatus(std::int32_t deviceHandle, VrTracker2DeviceCalibrationStatus* status);
+std::int32_t APS5_VABI VrTracker2SetDeviceBoundary(std::int32_t deviceHandle, std::int32_t selector, const VrTracker2DeviceBoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2GetDeviceBoundary(std::int32_t deviceHandle, std::int32_t selector, VrTracker2DeviceBoundaryParameter* parameter);
+std::int32_t APS5_VABI VrTracker2ApplyDeviceBoundary(std::int32_t deviceHandle, std::int32_t selector);
+std::int32_t APS5_VABI VrTracker2GetDeviceMapState(std::int32_t deviceHandle, std::int32_t* state);
+std::int32_t APS5_VABI VrTracker2InitializeMap(std::int32_t deviceHandle, const float* parameter);
+std::int32_t APS5_VABI VrTracker2GetCoordinateTrackingResult(const VrTracker2CoordinateResultParameter* parameter, VrTracker2ExtendedTrackingResult* result);
+std::int32_t APS5_VABI VrTracker2GetExtendedTrackingResult(const VrTracker2ResultParameter* parameter, VrTracker2ExtendedTrackingResult* result);
+std::int32_t APS5_VABI VrTracker2FitBoundary(const VrTracker2BoundaryGeometry* boundary, VrTracker2BoundaryFitResult* result);
+std::int32_t APS5_VABI VrTracker2FitBoundaryWithBounds(const VrTracker2BoundaryGeometry* boundary, VrTracker2OrientedBoundingBox* firstBounds, VrTracker2OrientedBoundingBox* secondBounds, VrTracker2BoundaryFitResult* result);
+std::int32_t APS5_VABI VrTracker2GetDeviceCenter(std::int32_t deviceHandle, VrTracker2VectorResult* result);
+std::int32_t APS5_VABI VrTracker2GetRuntimeStatus(VrTracker2RuntimeStatus* status);
+std::int32_t APS5_VABI VrTracker2GetTrackingFlags(bool* active, std::uint8_t* flags);
+std::int32_t APS5_VABI VrTracker2GetDiagnosticState(VrTracker2DiagnosticState* state);
+std::int32_t APS5_VABI VrTracker2GetExtendedDiagnosticState(VrTracker2ExtendedDiagnosticState* state);
+std::int32_t APS5_VABI VrTracker2GetSensorDiagnostics(VrTracker2SensorDiagnostics* diagnostics);
+std::int32_t APS5_VABI VrTracker2GetDeviceDiagnostics(VrTracker2DeviceDiagnostics* diagnostics);
+std::int32_t APS5_VABI VrTracker2GetTimingDiagnostics(VrTracker2TimingDiagnostics* diagnostics);
+std::int32_t APS5_VABI VrTracker2GetMapConfiguration(VrTracker2MapConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2SetMapConfiguration(const VrTracker2MapConfiguration* configuration);
+std::int32_t APS5_VABI VrTracker2GetMapStatus(VrTracker2MapStatus* status);
+std::int32_t APS5_VABI VrTracker2BuildMesh(VrTracker2MeshVertex* vertices, std::uint16_t* indices, std::uint32_t format);
+std::int32_t APS5_VABI VrTracker2GetMapScalar(float* value, const VrTracker2MapData* data);
+std::int32_t APS5_VABI VrTracker2GetTimedPose(VrTracker2TimedPoseResult* result, std::uint64_t timestamp, std::uint64_t userTag);
+std::int32_t APS5_VABI VrTracker2GetMapData(VrTracker2MapData* data, std::uint32_t size);
+std::int32_t APS5_VABI VrTracker2GetPoseScalar(float* value);
+std::int32_t APS5_VABI VrTracker2SubmitImageFrame(const VrTracker2ImageFrame* frame);
+std::int32_t APS5_VABI VrTracker2GetImagePose(VrTracker2ImagePoseResult* result);
+std::int32_t APS5_VABI VrTracker2GetSensorSummary(VrTracker2SensorSummary* summary);
+std::int32_t APS5_VABI VrTracker2NotInitialized();
+std::int32_t APS5_VABI VrTracker2ClearWideResult(void* result);
+std::int32_t APS5_VABI VrTracker2ClearNarrowResult(void* result);
+std::int32_t APS5_VABI VrTracker2CheckSecondThenReportNotInitialized(const void* first, const void* second);
+std::int32_t APS5_VABI VrTracker2Accept();
+std::int32_t APS5_VABI VrTracker2FillDefaults(void* output);
+std::int32_t APS5_VABI VrTracker2ClearWord(void* output);
+std::int32_t APS5_VABI VrTracker2Unknown01(VrTracker2CalibrationResult* result, std::uint32_t capacity);
+std::int32_t APS5_VABI VrTracker2Unknown02(VrTracker2MeshRequirement* requirement, std::uint32_t format);
+std::int32_t APS5_VABI VrTracker2Unknown03(std::uint32_t mode, void* output, std::size_t capacity, std::size_t* writtenSize);
+std::int32_t APS5_VABI VrTracker2Unknown04(const VrTracker2ResultParameter* parameter, VrTracker2Result* result);
+std::int32_t APS5_VABI VrTracker2Unknown05(VrTracker2Pose* pose, std::uint64_t coordinateId);
+std::int32_t APS5_VABI VrTracker2Unknown06(const VrTracker2TelemetryData* data);
+std::int32_t APS5_VABI VrTracker2Unknown07(const VrTracker2PoseParameter* parameter, VrTracker2PoseResult* result);
+
+}
diff --git a/core/libs/prx/libSceVrTracker2/libSceVrTracker2.hpp b/core/libs/prx/libSceVrTracker2/libSceVrTracker2.hpp
new file mode 100644
index 0000000000..667a8cf90f
--- /dev/null
+++ b/core/libs/prx/libSceVrTracker2/libSceVrTracker2.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceVrTracker2/include/Api.hpp"
diff --git a/core/libs/prx/libSceWeb/libSceWeb.hpp b/core/libs/prx/libSceWeb/libSceWeb.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWeb/libSceWeb.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWebBrowserDialog/CMakeLists.txt b/core/libs/prx/libSceWebBrowserDialog/CMakeLists.txt
index 2c498e5df1..641f60463e 100644
--- a/core/libs/prx/libSceWebBrowserDialog/CMakeLists.txt
+++ b/core/libs/prx/libSceWebBrowserDialog/CMakeLists.txt
@@ -12,3 +12,14 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceWebBrowserDialog>")
     endif()
 endif()
+
+if(BUILD_TESTING)
+    add_test_executable(guest_web_browser_dialog_cookies_tests ${LIBS_INCLUDE_DIR}/tests/GuestWebBrowserDialogCookies.cpp)
+    target_include_directories(guest_web_browser_dialog_cookies_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_web_browser_dialog_cookies_tests PRIVATE libSceWebBrowserDialog)
+    add_test(NAME guest_web_browser_dialog_cookies COMMAND guest_web_browser_dialog_cookies_tests)
+    if(WIN32)
+        set_tests_properties(guest_web_browser_dialog_cookies PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceWebBrowserDialog>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceWebBrowserDialog/Export.cpp b/core/libs/prx/libSceWebBrowserDialog/Export.cpp
index 8c720fbab1..d5961d6211 100644
--- a/core/libs/prx/libSceWebBrowserDialog/Export.cpp
+++ b/core/libs/prx/libSceWebBrowserDialog/Export.cpp
@@ -1,22 +1,12 @@
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
 #include "SceTypes.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libc/include/General.hpp"
 
-struct WebBrowserDialogCookieParam {
-    std::uint64_t size;
-    const char* address;
-    const char* cookie;
-    std::uint8_t reserved[256];
-};
-
-struct WebBrowserDialogResetCookieParam {
-    std::uint64_t size;
-    std::uint8_t reserved[256];
-};
-
 static_assert(sizeof(WebBrowserDialogCookieParam) == 280);
 static_assert(offsetof(WebBrowserDialogCookieParam, address) == 8);
 static_assert(offsetof(WebBrowserDialogCookieParam, cookie) == 16);
@@ -24,6 +14,7 @@ static_assert(sizeof(WebBrowserDialogResetCookieParam) == 264);
 
 namespace {
 std::atomic<int> g_status{0};
+std::atomic<bool> g_open{false};
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
 constexpr int COMMON_DIALOG_STATUS_RUNNING = 2;
@@ -31,10 +22,23 @@ constexpr int COMMON_DIALOG_STATUS_FINISHED = 3;
 constexpr int COMMON_DIALOG_RESULT_USER_CANCELED = 1;
 constexpr int COMMON_DIALOG_ERROR_NOT_INITIALIZED = static_cast<int>(0x80B80003u);
 constexpr int COMMON_DIALOG_ERROR_NOT_FINISHED = static_cast<int>(0x80B80005u);
+constexpr int COMMON_DIALOG_ERROR_INVALID_STATE = static_cast<int>(0x80B80006u);
 constexpr int COMMON_DIALOG_ERROR_BUSY = static_cast<int>(0x80B80007u);
 constexpr int COMMON_DIALOG_ERROR_NOT_RUNNING = static_cast<int>(0x80B8000Bu);
 constexpr int COMMON_DIALOG_ERROR_PARAMETER = static_cast<int>(0x80B8000Au);
 constexpr int COMMON_DIALOG_ERROR_ARG_NULL = static_cast<int>(0x80B8000Du);
+
+bool ReservedClear(const std::uint8_t (&reserved)[256]) {
+    for (const auto byte : reserved)
+        if (byte != 0) return false;
+    return true;
+}
+
+bool LengthWithin(const char* text, std::size_t limit) {
+    if (!text) return false;
+    const auto length = strnlen(text, limit);
+    return length != 0 && length < limit;
+}
 }
 
 extern "C" {
@@ -47,14 +51,21 @@ int APS5_VABI sceWebBrowserDialogInitialize(void) {
 
 int APS5_VABI sceWebBrowserDialogTerminate(void) {
     int expected = 1;
-    if (g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_NONE)) return 0;
+    if (g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_NONE)) {
+        g_open = false;
+        return 0;
+    }
     expected = COMMON_DIALOG_STATUS_FINISHED;
-    if (g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_NONE)) return 0;
+    if (g_status.compare_exchange_strong(expected, COMMON_DIALOG_STATUS_NONE)) {
+        g_open = false;
+        return 0;
+    }
     if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     return COMMON_DIALOG_ERROR_BUSY;
 }
 
 int APS5_VABI sceWebBrowserDialogClose(void) {
+    g_open = false;
     const int status = g_status.load();
     if (status == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
     if (status != COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_NOT_RUNNING;
@@ -88,16 +99,23 @@ int APS5_VABI sceWebBrowserDialogOpen(const void* param) {
  if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
  if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
  g_status = COMMON_DIALOG_STATUS_FINISHED;
+ g_open = true;
  return 0;
 }
 
 int APS5_VABI sceWebBrowserDialogUpdateStatus(void) {
-    return g_status.load();
+    const int status = g_status.load();
+    if (status == COMMON_DIALOG_STATUS_FINISHED) g_open = false;
+    return status;
 }
 
-
 int APS5_VABI sceWebBrowserDialogSetCookie(const WebBrowserDialogCookieParam* param) {
-    NotImplemented_nid_no_patch(__func__);
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (g_open.load()) return COMMON_DIALOG_ERROR_INVALID_STATE;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (param->size != sizeof(WebBrowserDialogCookieParam) || !LengthWithin(param->address, 0x800) || !LengthWithin(param->cookie, 0x1000) ||
+        !ReservedClear(param->reserved))
+        return COMMON_DIALOG_ERROR_PARAMETER;
     return 0;
 }
 
@@ -118,11 +136,15 @@ int APS5_VABI sceWebBrowserDialogOpenForPredeterminedContent(const void* param,
     if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
     if (status == COMMON_DIALOG_STATUS_RUNNING) return COMMON_DIALOG_ERROR_BUSY;
     g_status = COMMON_DIALOG_STATUS_FINISHED;
+    g_open = true;
     return 0;
 }
 
 int APS5_VABI sceWebBrowserDialogResetCookie(const WebBrowserDialogResetCookieParam* param) {
-    NotImplemented_nid_no_patch(__func__);
+    if (g_status.load() == COMMON_DIALOG_STATUS_NONE) return COMMON_DIALOG_ERROR_NOT_INITIALIZED;
+    if (param == nullptr) return COMMON_DIALOG_ERROR_ARG_NULL;
+    if (g_open.load()) return COMMON_DIALOG_ERROR_INVALID_STATE;
+    if (param->size != sizeof(WebBrowserDialogResetCookieParam) || !ReservedClear(param->reserved)) return COMMON_DIALOG_ERROR_PARAMETER;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceWebBrowserDialog/include/Api.hpp b/core/libs/prx/libSceWebBrowserDialog/include/Api.hpp
new file mode 100644
index 0000000000..e291592e7f
--- /dev/null
+++ b/core/libs/prx/libSceWebBrowserDialog/include/Api.hpp
@@ -0,0 +1,34 @@
+#pragma once
+
+#include "prx/libSceCommonDialog/CommonDialog.hpp"
+#include "SceTypes.hpp"
+
+struct WebBrowserDialogCookieParam {
+    std::uint64_t size;
+    const char* address;
+    const char* cookie;
+    std::uint8_t reserved[256];
+};
+
+struct WebBrowserDialogResetCookieParam {
+    std::uint64_t size;
+    std::uint8_t reserved[256];
+};
+
+extern "C" {
+
+int APS5_VABI sceWebBrowserDialogInitialize(void);
+int APS5_VABI sceWebBrowserDialogTerminate(void);
+int APS5_VABI sceWebBrowserDialogClose(void);
+int APS5_VABI sceWebBrowserDialogGetResult(WebBrowserDialogResult* result);
+int APS5_VABI sceWebBrowserDialogGetStatus(void);
+int APS5_VABI sceWebBrowserDialogOpen(const void* param);
+int APS5_VABI sceWebBrowserDialogUpdateStatus(void);
+int APS5_VABI sceWebBrowserDialogSetCookie(const WebBrowserDialogCookieParam* param);
+int APS5_VABI sceWebBrowserDialogOpenForPredeterminedContent(const void* param, const WebBrowserDialogAllowList* allowList);
+int APS5_VABI sceWebBrowserDialogResetCookie(const WebBrowserDialogResetCookieParam* param);
+int APS5_VABI sceWebBrowserDialogGetEvent();
+int APS5_VABI sceWebBrowserDialogNavigate();
+int APS5_VABI sceWebBrowserDialogSetZoom();
+
+}
diff --git a/core/libs/prx/libSceWebBrowserDialog/libSceWebBrowserDialog.hpp b/core/libs/prx/libSceWebBrowserDialog/libSceWebBrowserDialog.hpp
new file mode 100644
index 0000000000..d9b740e440
--- /dev/null
+++ b/core/libs/prx/libSceWebBrowserDialog/libSceWebBrowserDialog.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
diff --git a/core/libs/prx/libSceWebKit2/libSceWebKit2.hpp b/core/libs/prx/libSceWebKit2/libSceWebKit2.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWebKit2/libSceWebKit2.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWebKit2Secure/libSceWebKit2Secure.hpp b/core/libs/prx/libSceWebKit2Secure/libSceWebKit2Secure.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWebKit2Secure/libSceWebKit2Secure.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWebmParserMdrw/libSceWebmParserMdrw.hpp b/core/libs/prx/libSceWebmParserMdrw/libSceWebmParserMdrw.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWebmParserMdrw/libSceWebmParserMdrw.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceWkFontConfig/Export.cpp b/core/libs/prx/libSceWkFontConfig/Export.cpp
index 08ae01f5ec..7257bc7ef7 100644
--- a/core/libs/prx/libSceWkFontConfig/Export.cpp
+++ b/core/libs/prx/libSceWkFontConfig/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceWkFontConfig/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libSceWkFontConfig/include/Api.hpp b/core/libs/prx/libSceWkFontConfig/include/Api.hpp
new file mode 100644
index 0000000000..94402813b4
--- /dev/null
+++ b/core/libs/prx/libSceWkFontConfig/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceWkFontConfigGetAttr(void);
+int APS5_VABI sceWkFontConfigGetFont(void);
+int APS5_VABI sceWkFontConfigGetFontFromFontName(void);
+int APS5_VABI sceWkFontConfigGetFontName(void);
+int APS5_VABI sceWkFontConfigGetFontPath(void);
+
+}
diff --git a/core/libs/prx/libSceWkFontConfig/libSceWkFontConfig.hpp b/core/libs/prx/libSceWkFontConfig/libSceWkFontConfig.hpp
new file mode 100644
index 0000000000..0d45867b73
--- /dev/null
+++ b/core/libs/prx/libSceWkFontConfig/libSceWkFontConfig.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceWkFontConfig/include/Api.hpp"
diff --git a/core/libs/prx/libSceWorkspace/libSceWorkspace.hpp b/core/libs/prx/libSceWorkspace/libSceWorkspace.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceWorkspace/libSceWorkspace.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceXml/libSceXml.hpp b/core/libs/prx/libSceXml/libSceXml.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libSceXml/libSceXml.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libSceZlib/Export.cpp b/core/libs/prx/libSceZlib/Export.cpp
index 093a5401d2..f908068b6b 100644
--- a/core/libs/prx/libSceZlib/Export.cpp
+++ b/core/libs/prx/libSceZlib/Export.cpp
@@ -1,33 +1,39 @@
+#include "prx/libSceZlib/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "zlib.h"
+#include <chrono>
+#include <condition_variable>
 #include <cstdint>
+#include <deque>
 #include <limits>
 #include <mutex>
-#include <optional>
 #include <stdexcept>
+#include <unordered_map>
 
 namespace {
 
 static_assert(sizeof(std::uint32_t) == 4 && sizeof(std::uint64_t) == 8 && sizeof(std::int32_t) == 4);
 
+constexpr std::int32_t NOT_FOUND = static_cast<std::int32_t>(0x81120002);
 constexpr std::int32_t NOT_INITIALIZED = static_cast<std::int32_t>(0x81120032);
 constexpr std::int32_t ALREADY_INITIALIZED = static_cast<std::int32_t>(0x81120033);
+constexpr std::int32_t TIMED_OUT = static_cast<std::int32_t>(0x81120027);
 constexpr std::int32_t NO_SPACE = static_cast<std::int32_t>(0x8112001C);
 constexpr std::int32_t INVALID_ARGUMENT = static_cast<std::int32_t>(0x81120016);
-constexpr std::int32_t NOT_FOUND = static_cast<std::int32_t>(0x81120002);
 constexpr std::int32_t FATAL = static_cast<std::int32_t>(0x811200FF);
 
-struct Result {
-    std::uint64_t id;
+struct InflateResult {
     std::uint32_t produced;
     std::int32_t status;
-    bool retrieved = false;
 };
 
 std::mutex serviceMutex;
 bool initialized = false;
 std::uint64_t nextId = 1;
-std::optional<Result> result;
+std::uint64_t session = 0;
+std::unordered_map<std::uint64_t, InflateResult> results;
+std::deque<std::uint64_t> completed;
+std::condition_variable completion;
 
 } // namespace
 
@@ -45,8 +51,11 @@ std::int32_t APS5_VABI sceZlibInitialize(const void* buffer, std::uint64_t lengt
 std::int32_t APS5_VABI sceZlibFinalize() {
     std::lock_guard lock(serviceMutex);
     if (!initialized) return NOT_INITIALIZED;
-    result.reset();
+    results.clear();
+    completed.clear();
     initialized = false;
+    ++session;
+    completion.notify_all();
     return 0;
 }
 
@@ -57,7 +66,6 @@ std::int32_t APS5_VABI sceZlibInflate(const void* source, std::uint32_t sourceLe
         destinationLength > 65536 || destinationLength % 2048 != 0) return INVALID_ARGUMENT;
     if (reinterpret_cast<std::uintptr_t>(destination) % 2048 != 0)
         throw std::runtime_error("sceZlibInflate: unaligned destination driver behavior is not implemented");
-    if (result && !result->retrieved) throw std::runtime_error("sceZlibInflate: multiple outstanding requests unsupported");
     if (nextId == std::numeric_limits<std::uint64_t>::max()) throw std::runtime_error("sceZlibInflate: request IDs exhausted");
     z_stream stream{};
     stream.next_in = const_cast<Bytef*>(static_cast<const Bytef*>(source));
@@ -71,18 +79,25 @@ std::int32_t APS5_VABI sceZlibInflate(const void* source, std::uint32_t sourceLe
         (decoded == Z_BUF_ERROR && stream.avail_out == 0 && stream.avail_in != 0 ? NO_SPACE : FATAL);
     const int ended = inflateEnd(&stream);
     if (ended != Z_OK) throw std::runtime_error("sceZlibInflate: decoder cleanup failed");
-    result = Result{nextId++, produced, status};
-    *requestId = result->id;
+    const std::uint64_t id = nextId++;
+    results[id] = InflateResult{produced, status};
+    completed.push_back(id);
+    completion.notify_one();
+    *requestId = id;
     return 0;
 }
 
 std::int32_t APS5_VABI sceZlibWaitForDone(std::uint64_t* requestId, std::uint32_t* timeout) {
-    std::lock_guard lock(serviceMutex);
+    std::unique_lock lock(serviceMutex);
     if (!initialized) return NOT_INITIALIZED;
     if (!requestId) return INVALID_ARGUMENT;
-    if (timeout) throw std::runtime_error("sceZlibWaitForDone: timeout semantics unknown");
-    if (!result || result->retrieved) throw std::runtime_error("sceZlibWaitForDone: no outstanding request");
-    *requestId = result->id;
+    const std::uint64_t waitSession = session;
+    const auto finished = [waitSession] { return !completed.empty() || session != waitSession; };
+    if (!timeout) completion.wait(lock, finished);
+    else if (!completion.wait_for(lock, std::chrono::microseconds(*timeout), finished)) return TIMED_OUT;
+    if (session != waitSession) throw std::runtime_error("sceZlibWaitForDone: finalization during a wait semantics unknown");
+    *requestId = completed.front();
+    completed.pop_front();
     return 0;
 }
 
@@ -90,11 +105,10 @@ std::int32_t APS5_VABI sceZlibGetResult(std::uint64_t requestId, std::uint32_t*
     std::lock_guard lock(serviceMutex);
     if (!initialized) return NOT_INITIALIZED;
     if (!destinationLength || !status) return INVALID_ARGUMENT;
-    if (!result || result->id != requestId) return NOT_FOUND;
-    if (result->retrieved) throw std::runtime_error("sceZlibGetResult: repeated retrieval semantics unknown");
-    *destinationLength = result->produced;
-    *status = result->status;
-    result->retrieved = true;
+    const auto found = results.find(requestId);
+    if (found == results.end()) return NOT_FOUND;
+    *destinationLength = found->second.produced;
+    *status = found->second.status;
     return 0;
 }
 
diff --git a/core/libs/prx/libSceZlib/include/Api.hpp b/core/libs/prx/libSceZlib/include/Api.hpp
new file mode 100644
index 0000000000..ec57e94915
--- /dev/null
+++ b/core/libs/prx/libSceZlib/include/Api.hpp
@@ -0,0 +1,13 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+std::int32_t APS5_VABI sceZlibInitialize(const void* buffer, std::uint64_t length);
+std::int32_t APS5_VABI sceZlibFinalize();
+std::int32_t APS5_VABI sceZlibInflate(const void* source, std::uint32_t sourceLength, void* destination, std::uint32_t destinationLength, std::uint64_t* requestId);
+std::int32_t APS5_VABI sceZlibWaitForDone(std::uint64_t* requestId, std::uint32_t* timeout);
+std::int32_t APS5_VABI sceZlibGetResult(std::uint64_t requestId, std::uint32_t* destinationLength, std::int32_t* status);
+
+}
diff --git a/core/libs/prx/libSceZlib/libSceZlib.hpp b/core/libs/prx/libSceZlib/libSceZlib.hpp
new file mode 100644
index 0000000000..2740f392a8
--- /dev/null
+++ b/core/libs/prx/libSceZlib/libSceZlib.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libSceZlib/include/Api.hpp"
diff --git a/core/libs/prx/libc/CMakeLists.txt b/core/libs/prx/libc/CMakeLists.txt
index d53c2d0461..0ca57aa2a7 100644
--- a/core/libs/prx/libc/CMakeLists.txt
+++ b/core/libs/prx/libc/CMakeLists.txt
@@ -62,6 +62,7 @@ target_sources(libc PRIVATE
         ${CMAKE_CURRENT_SOURCE_DIR}/src/HostEntropy.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/Backtrace.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/DinkumwareAtomics.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/src/DinkumwareInternals.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/Time.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/TimeExtras.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/src/AtomicBuiltins.cpp
@@ -114,19 +115,56 @@ target_include_directories(libc PRIVATE
 
 target_link_libraries(libc PRIVATE zarchive)
 
+if(BUILD_TESTING)
+    add_test_executable(guest_update_env_tests ${LIBS_INCLUDE_DIR}/tests/GuestUpdateEnv.cpp)
+    target_include_directories(guest_update_env_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_update_env_tests PRIVATE libc ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_update_env_tests)
+    add_test(NAME guest_update_env COMMAND guest_update_env_tests $<TARGET_FILE:libc>)
+    foreach(bit RANGE 0 5)
+        foreach(source RANGE 0 2)
+            add_test(NAME guest_update_env_pending_${bit}_${source} COMMAND guest_update_env_tests $<TARGET_FILE:libc> ${bit} ${source})
+            set_tests_properties(guest_update_env_pending_${bit}_${source} PROPERTIES TIMEOUT 10)
+            if(WIN32)
+                set_tests_properties(guest_update_env_pending_${bit}_${source} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+            endif()
+        endforeach()
+    endforeach()
+    if(WIN32)
+        set_tests_properties(guest_update_env PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 target_sources(libc PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/src/FloatingPoint.cpp)
 
 if(BUILD_TESTING)
     add_test_executable(guest_floating_point_tests ${LIBS_INCLUDE_DIR}/tests/GuestFloatingPoint.cpp)
     target_include_directories(guest_floating_point_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_floating_point_tests PRIVATE libc)
+    target_link_libraries(guest_floating_point_tests PRIVATE libc ${CMAKE_DL_LIBS})
     configure_windows_unwind(guest_floating_point_tests)
-    add_test(NAME guest_floating_point COMMAND guest_floating_point_tests)
+    add_test(NAME guest_floating_point COMMAND guest_floating_point_tests $<TARGET_FILE:libc>)
     set_tests_properties(guest_floating_point PROPERTIES TIMEOUT 10)
     if(WIN32)
         set_tests_properties(guest_floating_point PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    if(MINGW OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        enable_language(ASM)
+        add_test_executable(guest_sce_v2_exceptions_tests
+            ${LIBS_INCLUDE_DIR}/tests/GuestSceV2Exceptions.cpp
+            ${LIBS_INCLUDE_DIR}/tests/GuestSceV2Exceptions.S)
+        target_include_directories(guest_sce_v2_exceptions_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_sce_v2_exceptions_tests PRIVATE libc)
+        configure_windows_unwind(guest_sce_v2_exceptions_tests)
+        add_test(NAME guest_sce_v2_exceptions COMMAND guest_sce_v2_exceptions_tests)
+        set_tests_properties(guest_sce_v2_exceptions PROPERTIES TIMEOUT 10)
+        if(WIN32)
+            set_tests_properties(guest_sce_v2_exceptions PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        endif()
+    endif()
 endif()
 
 if(WIN32)
@@ -299,6 +337,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_atomic_builtins PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_multibyte_locale_tests ${LIBS_INCLUDE_DIR}/tests/GuestMultibyteLocale.cpp)
+    target_include_directories(guest_multibyte_locale_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_multibyte_locale_tests PRIVATE libc)
+    configure_windows_unwind(guest_multibyte_locale_tests)
+    add_test(NAME guest_multibyte_locale COMMAND guest_multibyte_locale_tests)
+    if(WIN32)
+        set_tests_properties(guest_multibyte_locale PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_wide_conversion_tests ${LIBS_INCLUDE_DIR}/tests/GuestWideConversion.cpp)
     target_include_directories(guest_wide_conversion_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_wide_conversion_tests PRIVATE libc)
@@ -354,6 +401,24 @@ if(BUILD_TESTING)
         set_tests_properties(guest_random_state PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_libc_random_seeding_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcRandomSeeding.cpp)
+    target_include_directories(guest_libc_random_seeding_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_libc_random_seeding_tests PRIVATE libc)
+    configure_windows_unwind(guest_libc_random_seeding_tests)
+    add_test(NAME guest_libc-random-seeding COMMAND guest_libc_random_seeding_tests)
+    if(WIN32)
+        set_tests_properties(guest_libc-random-seeding PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+    add_test_executable(guest_random_device_seed_tests ${LIBS_INCLUDE_DIR}/tests/GuestRandomDeviceSeed.cpp src/Random.cpp)
+    target_include_directories(guest_random_device_seed_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_random_device_seed_tests PRIVATE libc)
+    configure_windows_unwind(guest_random_device_seed_tests)
+    add_test(NAME guest_random_device_seed COMMAND guest_random_device_seed_tests)
+    if(WIN32)
+        set_tests_properties(guest_random_device_seed PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_integer_builtins_tests ${LIBS_INCLUDE_DIR}/tests/GuestIntegerBuiltins.cpp)
     target_include_directories(guest_integer_builtins_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_integer_builtins_tests PRIVATE libc)
@@ -441,6 +506,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_libc_threads PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_std_thread_hardware_concurrency_tests ${LIBS_INCLUDE_DIR}/tests/GuestStdThreadHardwareConcurrency.cpp)
+    target_include_directories(guest_std_thread_hardware_concurrency_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_std_thread_hardware_concurrency_tests PRIVATE libc)
+    configure_windows_unwind(guest_std_thread_hardware_concurrency_tests)
+    add_test(NAME guest_std_thread_hardware_concurrency COMMAND guest_std_thread_hardware_concurrency_tests)
+    set_tests_properties(guest_std_thread_hardware_concurrency PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_std_thread_hardware_concurrency PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_libc_static_imports_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibcStaticImports.cpp)
     target_include_directories(guest_libc_static_imports_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_libc_static_imports_tests PRIVATE libc)
@@ -526,6 +601,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_dinkumware_atomics PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_dinkumware_internals_tests ${LIBS_INCLUDE_DIR}/tests/GuestDinkumwareInternals.cpp)
+    target_include_directories(guest_dinkumware_internals_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_dinkumware_internals_tests PRIVATE libc)
+    configure_windows_unwind(guest_dinkumware_internals_tests)
+    add_test(NAME guest_dinkumware_internals COMMAND guest_dinkumware_internals_tests)
+    if(WIN32)
+        set_tests_properties(guest_dinkumware_internals PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_hostname_tests ${LIBS_INCLUDE_DIR}/tests/GuestHostname.cpp)
     target_include_directories(guest_hostname_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_hostname_tests PRIVATE libc)
@@ -642,6 +726,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_standard_streams guest_standard_streams_closed_stdout guest_standard_streams_exclusive_stdout PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_gets_tests ${LIBS_INCLUDE_DIR}/tests/GuestGets.cpp)
+    target_include_directories(guest_gets_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_gets_tests PRIVATE libc ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_gets_tests)
+    add_test(NAME guest_gets COMMAND guest_gets_tests $<TARGET_FILE:libc> guest_gets_error.tmp)
+    set_tests_properties(guest_gets PROPERTIES TIMEOUT 10)
+    if(WIN32)
+        set_tests_properties(guest_gets PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(file_streams_tests ${LIBS_INCLUDE_DIR}/tests/FileStreams.cpp)
     target_include_directories(file_streams_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(file_streams_tests PRIVATE libc)
@@ -652,6 +746,16 @@ if(BUILD_TESTING)
         set_tests_properties(file_streams PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_freopen_host_standard_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreopenHostStandard.cpp)
+    target_include_directories(guest_freopen_host_standard_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freopen_host_standard_tests PRIVATE libc)
+    configure_windows_unwind(guest_freopen_host_standard_tests)
+    add_test(NAME guest_freopen_host_standard COMMAND guest_freopen_host_standard_tests)
+    set_tests_properties(guest_freopen_host_standard PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_freopen_host_standard PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     add_test_executable(guest_error_tests ${LIBS_INCLUDE_DIR}/tests/GuestErrors.cpp)
     target_include_directories(guest_error_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_error_tests PRIVATE libc)
@@ -817,10 +921,6 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     if(UNIX)
-        add_test_executable(exception_runtime_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionRuntime.cpp)
-        target_include_directories(exception_runtime_tests PRIVATE ${LIBS_INCLUDE_DIR})
-        target_link_libraries(exception_runtime_tests PRIVATE libc)
-        add_test(NAME exception_runtime COMMAND exception_runtime_tests)
         add_test_executable(exception_personality_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionPersonality.cpp)
         target_include_directories(exception_personality_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(exception_personality_tests PRIVATE libc)
@@ -835,8 +935,13 @@ if(BUILD_TESTING)
         add_test(NAME guest_path_lifetime COMMAND guest_path_lifetime_tests)
         set_tests_properties(guest_path_lifetime PROPERTIES TIMEOUT 20)
         if(NOT APPLE)
+            add_test_executable(exception_runtime_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionRuntime.cpp)
+            target_include_directories(exception_runtime_tests PRIVATE ${LIBS_INCLUDE_DIR})
+            target_link_libraries(exception_runtime_tests PRIVATE libc)
+            add_test(NAME exception_runtime COMMAND exception_runtime_tests)
             enable_language(C)
             add_test_executable(exception_c_cleanup_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionCCleanup.cpp ${LIBS_INCLUDE_DIR}/tests/ExceptionCCleanup.c)
+            target_include_directories(exception_c_cleanup_tests PRIVATE ${LIBS_INCLUDE_DIR})
             set_source_files_properties(${LIBS_INCLUDE_DIR}/tests/ExceptionCCleanup.c PROPERTIES COMPILE_OPTIONS -fexceptions)
             target_link_libraries(exception_c_cleanup_tests PRIVATE libc)
             add_test(NAME exception_c_cleanup COMMAND exception_c_cleanup_tests)
@@ -1083,6 +1188,7 @@ if(MINGW)
         set_tests_properties(windows_exceptions PROPERTIES ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
         add_test_executable(windows_backtrace_report_tests ${LIBS_INCLUDE_DIR}/tests/WindowsBacktraceReport.cpp)
         target_link_libraries(windows_backtrace_report_tests PRIVATE libc)
+        target_include_directories(windows_backtrace_report_tests PRIVATE ${LIBS_INCLUDE_DIR})
         add_test(NAME windows_backtrace_report COMMAND windows_backtrace_report_tests)
         set_tests_properties(windows_backtrace_report PROPERTIES TIMEOUT 20
             ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>"
diff --git a/core/libs/prx/libc/Export.cpp b/core/libs/prx/libc/Export.cpp
index 6056428c98..cb7055cfd5 100644
--- a/core/libs/prx/libc/Export.cpp
+++ b/core/libs/prx/libc/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -8,8 +9,6 @@ uint32_t Need_sceLibc = 1;
 
 extern "C" {
 
-    int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(int*, int (APS5_VABI *)(void*, void*, void**), void*);
-
     int APS5_VABI std_execute_once_nid_postfix(int* flag, int (APS5_VABI *func)(void*, void*, void**), void* arg) {
         return _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(flag, func, arg);
     }
@@ -25,7 +24,6 @@ int APS5_VABI _ZSt14_Atomic_assertPKcS0__nid_postfix() {
  return 0;
 }
 
-
 APS5_EXPORT("H2e8t5ScQGc", libc___cxa_finalize);
 void APS5_VABI libc___cxa_finalize(void* dsoHandle) {
     CxaFinalize_nid_no_patch(dsoHandle);
diff --git a/core/libs/prx/libc/include/Api.hpp b/core/libs/prx/libc/include/Api.hpp
new file mode 100644
index 0000000000..afdb17d63c
--- /dev/null
+++ b/core/libs/prx/libc/include/Api.hpp
@@ -0,0 +1,1393 @@
+#pragma once
+
+#include "prx/libc/include/specifics/linux/ElfTypes.hpp"
+#include "prx/libc/include/specifics/itanium/UnwindAbi.hpp"
+#include "prx/libc/include/MallocManagedSize.hpp"
+#include "prx/libc/include/GuestTime.hpp"
+#include "prx/libc/include/GuestLocale.hpp"
+#include "prx/libc/include/GuestDirectory.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/exceptions/Unwind.hpp"
+#include "prx/libc/include/exceptions/Runtime.hpp"
+#include "SceTypes.hpp"
+#include <future>
+#include <regex>
+
+#ifdef _LIBCPP_VERSION
+struct GuestExceptionPointer {
+    void* object {};
+    explicit GuestExceptionPointer(void* primary) noexcept : object(primary) {}
+    GuestExceptionPointer(const GuestExceptionPointer&) = delete;
+    ~GuestExceptionPointer() {}
+};
+using GuestExceptionPointerArgument = GuestExceptionPointer&;
+#else
+using GuestExceptionPointer = std::exception_ptr;
+using GuestExceptionPointerArgument = GuestExceptionPointer;
+#endif
+
+using GuestCompare = int (APS5_VABI *)(const void*, const void*);
+
+using GuestContextCompare = int (APS5_VABI*)(const void*, const void*, void*);
+
+using GuestExitCallback = void (APS5_VABI*)();
+
+struct GuestFloatingPointEnvironment {
+    std::uint32_t control;
+    std::uint32_t status;
+    std::uint32_t tag;
+    unsigned char other[16];
+    std::uint32_t mxcsr;
+};
+
+struct GuestInterfaceAddress {
+    GuestInterfaceAddress* next;
+    char* name;
+    std::uint32_t flags;
+    void* address;
+    void* netmask;
+    void* destination;
+    void* data;
+};
+
+struct GuestLocaleFacade {
+    GuestLocale::Implementation* implementation;
+};
+
+using GuestNewHandler = void (APS5_VABI*)();
+
+struct GuestPad {
+    unsigned (APS5_VABI* const* vtable)(GuestPad*);
+    void* condition;
+    void* mutex;
+    bool started;
+};
+
+using Int128 = __int128;
+
+using LibcTerminateHandler = void(*)();
+
+struct MinMaxPointers {
+    const void* minimum;
+    const void* maximum;
+};
+
+struct StreamManipulator {
+    GuestLocale::IosBase* (APS5_VABI* function)(GuestLocale::IosBase*, std::int32_t);
+    std::int32_t argument;
+};
+
+using Uint128 = unsigned __int128;
+
+struct Xtime {
+    std::int64_t sec;
+    std::int64_t nsec;
+};
+
+namespace LibcException {
+
+}
+
+namespace LibcException {
+
+struct CategoryObject { const void* vtable; };
+
+struct ExceptionObject { const void* vtable; const char* message; };
+
+struct ErrorCode { int reserved; int value; const CategoryObject* category; };
+
+struct SystemErrorObject { ExceptionObject base; ErrorCode code; };
+
+}
+
+extern "C" {
+
+int APS5_VABI std_execute_once_nid_postfix(int* flag, int (APS5_VABI *func)(void*, void*, void**), void* arg);
+void APS5_VABI LibcHeapGetTraceInfo_nid_postfix(LibcHeapInfo* info);
+int APS5_VABI _ZSt14_Atomic_assertPKcS0__nid_postfix();
+void APS5_VABI libc___cxa_finalize(void* dsoHandle);
+char* APS5_VABI strndup_nid_postfix(const char* source, std::size_t limit);
+char* APS5_VABI strdup_nid_postfix(const char* source);
+int APS5_VABI asprintf_nid_postfix(char** destination, const char* format, ...);
+void* APS5_VABI scriptingGetMem_nid_postfix(std::size_t alignment, std::size_t bytes);
+void APS5_VABI scriptingFreeMem_nid_postfix(void* pointer);
+void APS5_VABI __atomic_load_nid_postfix(std::size_t, void*, void*, int);
+void APS5_VABI __atomic_store_nid_postfix(std::size_t, void*, void*, int);
+void APS5_VABI __atomic_exchange_nid_postfix(std::size_t, void*, void*, void*, int);
+bool APS5_VABI __atomic_compare_exchange_nid_postfix(std::size_t, void*, void*, void*, int, int);
+bool APS5_VABI __atomic_is_lock_free_nid_postfix(std::size_t size, const void* pointer);
+Uint128 APS5_VABI __sync_fetch_and_add_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_sub_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_and_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_or_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_fetch_and_xor_16_nid_postfix(Uint128* target, Uint128 value);
+Uint128 APS5_VABI __sync_lock_test_and_set_16_nid_postfix(Uint128* target, Uint128 value);
+int APS5_VABI sceLibcBacktraceGetBufferSize_nid_postfix(int limit, int* count, std::size_t* size);
+int APS5_VABI sceLibcBacktraceSelf_nid_postfix(int limit, void* buffer, std::size_t size, int* count);
+double APS5_VABI j0_nid_postfix(double x);
+double APS5_VABI y0_nid_postfix(double x);
+double APS5_VABI j1_nid_postfix(double x);
+double APS5_VABI y1_nid_postfix(double x);
+double APS5_VABI jn_nid_postfix(int order, double x);
+double APS5_VABI yn_nid_postfix(int order, double x);
+int APS5_VABI getw_nid_postfix(FileStream* stream);
+int APS5_VABI putw_nid_postfix(int value, FileStream* stream);
+void APS5_VABI abort_handler_s_nid_postfix(const char* message, void*, int);
+void* APS5_VABI bsearch_s_nid_postfix(const void* key, const void* base, std::size_t count, std::size_t size, GuestContextCompare compare, void* context);
+std::uint16_t* APS5_VABI wcstok_s_nid_postfix(std::uint16_t* str, std::size_t* remaining, const std::uint16_t* delimiters, std::uint16_t** context);
+int APS5_VABI wctomb_s_nid_postfix(int* status, char* destination, std::size_t capacity, std::uint16_t wide);
+int APS5_VABI wcrtomb_s_nid_postfix(std::size_t* result, char* destination, std::size_t capacity, std::uint16_t wide, void* state);
+int APS5_VABI mbstowcs_s_nid_postfix(std::size_t* result, std::uint16_t* destination, std::size_t capacity, const char* source, std::size_t limit);
+int APS5_VABI mbsrtowcs_s_nid_postfix(std::size_t* result, std::uint16_t* destination, std::size_t capacity, const char** source, std::size_t limit, void* state);
+char* APS5_VABI gets_s_nid_postfix(char* buffer, std::size_t size);
+void* APS5_VABI __cxa_demangle_nid_postfix(const char* mangled, char* buf, std::size_t* len, int* status);
+int APS5_VABI __cxa_thread_atexit_impl_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dso);
+int APS5_VABI __cxa_thread_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dso);
+int APS5_VABI LibcInternalExtCxaThreadAtexit_nid_postfix(void (APS5_VABI *destructor)(void*), void* object, void* moduleId);
+int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix( int* flag, int (APS5_VABI *callback)(void*, void*, void**), void* arg );
+void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+void APS5_VABI _Atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+void APS5_VABI _Atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+void APS5_VABI _Atomic_store_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI _Atomic_load_1_nid_postfix(volatile std::uint8_t* target, int);
+std::uint16_t APS5_VABI _Atomic_load_2_nid_postfix(volatile std::uint16_t* target, int);
+std::uint64_t APS5_VABI _Atomic_load_8_nid_postfix(volatile std::uint64_t* target, int order);
+std::uint8_t APS5_VABI _Atomic_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+int APS5_VABI _Atomic_compare_exchange_strong_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t* expected, std::uint32_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+std::uint8_t APS5_VABI _Atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_and_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_and_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_fetch_and_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_and_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_or_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_or_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_fetch_or_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_or_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+std::uint8_t APS5_VABI _Atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI _Atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI _Atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI _Atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);
+int APS5_VABI _Atomic_is_lock_free_1_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_2_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_4_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_8_nid_postfix();
+int APS5_VABI _Atomic_flag_test_and_set_nid_postfix(volatile unsigned char* flag, int);
+void APS5_VABI _Atomic_flag_clear_nid_postfix(volatile unsigned char* flag, int);
+void APS5_VABI _Atomic_thread_fence_nid_postfix(int order);
+void APS5_VABI _Atomic_signal_fence_nid_postfix(int);
+void APS5_VABI _Atomic_copy_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, const volatile void* source, int);
+void APS5_VABI _Atomic_exchange_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, volatile void* value, int);
+int APS5_VABI _Atomic_compare_exchange_strong_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, void* expected, const void* desired, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_nid_postfix(volatile unsigned char* flag, std::size_t size, volatile void* target, void* expected, const void* desired, int, int);
+double APS5_VABI _Stod_nid_postfix(const char* text, char** end, std::int64_t pten);
+long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base);
+double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant);
+float APS5_VABI _FSin_nid_postfix(float x, unsigned int quadrant);
+long double APS5_VABI _LSin_nid_postfix(long double x, unsigned int quadrant);
+double APS5_VABI _Log_nid_postfix(double x, int base);
+float APS5_VABI _FLog_nid_postfix(float x, int base);
+void* APS5_VABI opendir_nid_postfix(const char* path);
+GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void* handle);
+int APS5_VABI readdir_r_nid_postfix(void* handle, GuestDirectoryEntry* entry, GuestDirectoryEntry** result);
+int APS5_VABI closedir_nid_postfix(void* handle);
+void APS5_VABI rewinddir_nid_postfix(void* handle);
+std::int64_t APS5_VABI telldir_nid_postfix(void* handle);
+void APS5_VABI seekdir_nid_postfix(void* handle, std::int64_t location);
+char* APS5_VABI getenv_nid_postfix(const char* name);
+int APS5_VABI setenv_nid_postfix(const char* name, const char* value, int overwrite);
+int APS5_VABI unsetenv_nid_postfix(const char* name);
+int APS5_VABI putenv_nid_postfix(char* text);
+char* APS5_VABI strerror_nid_postfix(int error);
+int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length);
+void APS5_VABI perror_nid_postfix(const char* prefix);
+FileStream* APS5_VABI fdopen_nid_postfix(int descriptor, const char* mode);
+FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, FileStream* stream);
+FileStream* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
+int APS5_VABI fopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode);
+int APS5_VABI fclose_nid_postfix(FileStream* stream);
+FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char* filename, int mode, int protection);
+size_t APS5_VABI fread_nid_postfix(void* buffer, size_t size, size_t count, FileStream* stream);
+size_t APS5_VABI fwrite_nid_postfix(const void* buffer, size_t size, size_t count, FileStream* stream);
+int APS5_VABI fseeko_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
+std::int64_t APS5_VABI ftello_nid_postfix(FileStream* stream);
+int APS5_VABI fseek_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
+std::int64_t APS5_VABI ftell_nid_postfix(FileStream* stream);
+int APS5_VABI fgetpos_nid_postfix(FileStream* stream, std::int64_t* position);
+int APS5_VABI fsetpos_nid_postfix(FileStream* stream, const std::int64_t* position);
+void APS5_VABI rewind_nid_postfix(FileStream* stream);
+int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
+int APS5_VABI fflush_nid_postfix(FileStream* stream);
+int APS5_VABI malloc_stats_fast_nid_postfix(void* stats);
+size_t APS5_VABI malloc_usable_size_nid_postfix(void* pointer);
+void* APS5_VABI malloc_nid_postfix(size_t size);
+void APS5_VABI free_nid_postfix(void* ptr);
+void* APS5_VABI realloc_nid_postfix(void* ptr, size_t newSize);
+void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize);
+void* APS5_VABI memalign_nid_postfix(size_t alignment, size_t size);
+void* APS5_VABI aligned_alloc_nid_postfix(size_t alignment, size_t size);
+void* APS5_VABI reallocalign_nid_postfix(void* ptr, size_t size, size_t alignment);
+void* APS5_VABI calloc_nid_postfix(size_t count, size_t size);
+int APS5_VABI posix_memalign_nid_postfix(void** pointer, size_t alignment, size_t size);
+void* APS5_VABI bsearch_nid_postfix(const void* key, const void* base, size_t count, size_t size, int (APS5_VABI *compare)(const void*, const void*));
+int APS5_VABI mergesort_nid_postfix(void* base, size_t count, size_t size, GuestCompare compare);
+void APS5_VABI qsort_nid_postfix(void* base, size_t count, size_t size, int (APS5_VABI *compare)(const void*, const void*));
+int APS5_VABI qsort_s_nid_postfix(void* base, size_t count, size_t size, GuestContextCompare compare, void* context);
+int APS5_VABI access_nid_postfix(const char* path, int mode);
+int APS5_VABI remove_nid_postfix(const char* path);
+double APS5_VABI __adddf3_nid_postfix(double a, double b);
+float APS5_VABI __addsf3_nid_postfix(float a, float b);
+double APS5_VABI __subdf3_nid_postfix(double a, double b);
+float APS5_VABI __subsf3_nid_postfix(float a, float b);
+double APS5_VABI __muldf3_nid_postfix(double a, double b);
+float APS5_VABI __mulsf3_nid_postfix(float a, float b);
+double APS5_VABI __divdf3_nid_postfix(double a, double b);
+float APS5_VABI __divsf3_nid_postfix(float a, float b);
+double APS5_VABI __negdf2_nid_postfix(double a);
+float APS5_VABI __negsf2_nid_postfix(float a);
+int APS5_VABI __eqdf2_nid_postfix(double a, double b);
+int APS5_VABI __nedf2_nid_postfix(double a, double b);
+int APS5_VABI __ltdf2_nid_postfix(double a, double b);
+int APS5_VABI __ledf2_nid_postfix(double a, double b);
+int APS5_VABI __gtdf2_nid_postfix(double a, double b);
+int APS5_VABI __gedf2_nid_postfix(double a, double b);
+int APS5_VABI __unorddf2_nid_postfix(double a, double b);
+int APS5_VABI __eqsf2_nid_postfix(float a, float b);
+int APS5_VABI __nesf2_nid_postfix(float a, float b);
+int APS5_VABI __ltsf2_nid_postfix(float a, float b);
+int APS5_VABI __lesf2_nid_postfix(float a, float b);
+int APS5_VABI __gtsf2_nid_postfix(float a, float b);
+int APS5_VABI __gesf2_nid_postfix(float a, float b);
+int APS5_VABI __unordsf2_nid_postfix(float a, float b);
+double APS5_VABI __extendsfdf2_nid_postfix(float a);
+float APS5_VABI __truncdfsf2_nid_postfix(double a);
+std::int32_t APS5_VABI __fixsfsi_nid_postfix(float a);
+std::int64_t APS5_VABI __fixsfdi_nid_postfix(float a);
+Int128 APS5_VABI __fixsfti_nid_postfix(float a);
+std::int32_t APS5_VABI __fixdfsi_nid_postfix(double a);
+std::int64_t APS5_VABI __fixdfdi_nid_postfix(double a);
+Int128 APS5_VABI __fixdfti_nid_postfix(double a);
+std::uint32_t APS5_VABI __fixunssfsi_nid_postfix(float a);
+std::uint64_t APS5_VABI __fixunssfdi_nid_postfix(float a);
+Uint128 APS5_VABI __fixunssfti_nid_postfix(float a);
+std::uint32_t APS5_VABI __fixunsdfsi_nid_postfix(double a);
+std::uint64_t APS5_VABI __fixunsdfdi_nid_postfix(double a);
+Uint128 APS5_VABI __fixunsdfti_nid_postfix(double a);
+std::int64_t APS5_VABI __fixxfdi_nid_postfix(long double a);
+Int128 APS5_VABI __fixxfti_nid_postfix(long double a);
+std::uint32_t APS5_VABI __fixunsxfsi_nid_postfix(long double a);
+std::uint64_t APS5_VABI __fixunsxfdi_nid_postfix(long double a);
+Uint128 APS5_VABI __fixunsxfti_nid_postfix(long double a);
+double APS5_VABI __floatsidf_nid_postfix(std::int32_t a);
+double APS5_VABI __floatunsidf_nid_postfix(std::uint32_t a);
+float APS5_VABI __floatsisf_nid_postfix(std::int32_t a);
+float APS5_VABI __floatunsisf_nid_postfix(std::uint32_t a);
+double APS5_VABI __floatdidf_nid_postfix(std::int64_t a);
+float APS5_VABI __floatdisf_nid_postfix(std::int64_t a);
+long double APS5_VABI __floatdixf_nid_postfix(std::int64_t a);
+double APS5_VABI __floatundidf_nid_postfix(std::uint64_t a);
+float APS5_VABI __floatundisf_nid_postfix(std::uint64_t a);
+long double APS5_VABI __floatundixf_nid_postfix(std::uint64_t a);
+double APS5_VABI __floattidf_nid_postfix(Int128 a);
+float APS5_VABI __floattisf_nid_postfix(Int128 a);
+long double APS5_VABI __floattixf_nid_postfix(Int128 a);
+double APS5_VABI __floatuntidf_nid_postfix(Uint128 a);
+float APS5_VABI __floatuntisf_nid_postfix(Uint128 a);
+long double APS5_VABI __floatuntixf_nid_postfix(Uint128 a);
+__complex__ float APS5_VABI __mulsc3_nid_postfix(float a, float b, float c, float d);
+__complex__ double APS5_VABI __muldc3_nid_postfix(double a, double b, double c, double d);
+__complex__ long double APS5_VABI __mulxc3_nid_postfix(long double a, long double b, long double c, long double d);
+__complex__ float APS5_VABI __divsc3_nid_postfix(float a, float b, float c, float d);
+__complex__ double APS5_VABI __divdc3_nid_postfix(double a, double b, double c, double d);
+__complex__ long double APS5_VABI __divxc3_nid_postfix(long double a, long double b, long double c, long double d);
+long double APS5_VABI __powixf2_nid_postfix(long double base, int exponent);
+int APS5_VABI fegetround_nid_postfix();
+int APS5_VABI fesetround_nid_postfix(int rounding);
+int APS5_VABI fetestexcept_nid_postfix(int exceptions);
+int APS5_VABI fegetexceptflag_nid_postfix(std::uint16_t* flags, int exceptions);
+void APS5_VABI _Feraise_nid_postfix(int exceptions);
+int APS5_VABI fesetexceptflag_nid_postfix(const std::uint16_t* flags, int exceptions);
+int APS5_VABI feclearexcept_nid_postfix(int exceptions);
+int APS5_VABI feenableexcept_nid_postfix(int exceptions);
+int APS5_VABI fedisableexcept_nid_postfix(int exceptions);
+int APS5_VABI __feenableexcept_nid_postfix(int exceptions);
+int APS5_VABI __fedisableexcept_nid_postfix(int exceptions);
+int APS5_VABI fegettrapenable_nid_postfix();
+int APS5_VABI fegetexcept_nid_postfix();
+int APS5_VABI fesettrapenable_nid_postfix(int exceptions);
+int APS5_VABI vasprintf_nid_postfix(char** destination, const char* format, VaList* args);
+int APS5_VABI vfprintf_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI fprintf_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI fscanf_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI printf_nid_postfix(const char* format, ...);
+int APS5_VABI libc_printf_nid_postfix(const char* format, ...);
+int APS5_VABI snprintf_nid_postfix(char* buffer, size_t size, const char* format, ...);
+int APS5_VABI sprintf_nid_postfix(char* buffer, const char* format, ...);
+int APS5_VABI vsscanf_nid_postfix(const char* input, const char* format, VaList* args);
+int APS5_VABI sscanf_nid_postfix(const char* input, const char* format, ...);
+int APS5_VABI sscanf_s_nid_postfix(const char* buffer, const char* format, ...);
+int APS5_VABI vprintf_nid_postfix(const char* str, VaList* c);
+int APS5_VABI vsprintf_nid_postfix(char* str, const char* format, VaList* args);
+int APS5_VABI vsnprintf_nid_postfix(char* str, size_t size, const char* format, VaList* c);
+int APS5_VABI vsnprintf_s_nid_postfix(char* buffer, size_t size, const char* format, VaList* args);
+int APS5_VABI vsscanf_s_nid_postfix(const char* buffer, const char* format, VaList* args);
+int APS5_VABI snprintf_s_nid_postfix(char* buffer, size_t size, const char* format, ...);
+int APS5_VABI printf_s_nid_postfix(const char* format, ...);
+int APS5_VABI vsprintf_s_nid_postfix(char* buffer, size_t size, const char* format, VaList* args);
+int APS5_VABI sprintf_s_nid_postfix(char* buffer, size_t size, const char* format, ...);
+int APS5_VABI puts_nid_postfix(const char* s);
+int APS5_VABI vfscanf_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI vscanf_nid_postfix(const char* format, VaList* args);
+int APS5_VABI scanf_nid_postfix(const char* format, ...);
+int APS5_VABI vswprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
+int APS5_VABI swprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
+int APS5_VABI snwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
+int APS5_VABI vswprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
+int APS5_VABI swprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
+int APS5_VABI vsnwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
+int APS5_VABI wprintf_nid_postfix(const char16_t* format, ...);
+int APS5_VABI vfwprintf_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI fwprintf_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI vwprintf_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI fputwc_nid_postfix(char16_t value, FileStream* stream);
+int APS5_VABI fputws_nid_postfix(const char16_t* str, FileStream* stream);
+int APS5_VABI putwc_nid_postfix(char16_t value, FileStream* stream);
+int APS5_VABI putwchar_nid_postfix(char16_t value);
+char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* stream);
+int APS5_VABI chdir_nid_postfix(const char* path);
+char* APS5_VABI getcwd_nid_postfix(char* buffer, std::size_t size);
+void APS5_VABI sceLibcInternalBacktraceForGame_nid_postfix(const char* heapName);
+void APS5_VABI sceLibcInternalHeapErrorReportForGame_nid_postfix(void* heap, void* block, std::uint32_t error);
+int APS5_VABI gethostname_nid_postfix(char* name, std::size_t length);
+std::int64_t APS5_VABI __ashldi3_nid_postfix(std::int64_t value, int shift);
+std::int64_t APS5_VABI __ashrdi3_nid_postfix(std::int64_t value, int shift);
+std::int64_t APS5_VABI __lshrdi3_nid_postfix(std::int64_t value, int shift);
+Int128 APS5_VABI __ashlti3_nid_postfix(Int128 value, int shift);
+Int128 APS5_VABI __ashrti3_nid_postfix(Int128 value, int shift);
+Int128 APS5_VABI __lshrti3_nid_postfix(Int128 value, int shift);
+int APS5_VABI __clzsi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __clzdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __clzti2_nid_postfix(Uint128 value);
+int APS5_VABI __ctzsi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __ctzdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __ctzti2_nid_postfix(Uint128 value);
+int APS5_VABI __ffsdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __ffsti2_nid_postfix(Uint128 value);
+int APS5_VABI __paritysi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __paritydi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __parityti2_nid_postfix(Uint128 value);
+int APS5_VABI __popcountsi2_nid_postfix(std::uint32_t value);
+int APS5_VABI __popcountdi2_nid_postfix(std::uint64_t value);
+int APS5_VABI __popcountti2_nid_postfix(Uint128 value);
+int APS5_VABI __cmpdi2_nid_postfix(std::int64_t a, std::int64_t b);
+int APS5_VABI __cmpti2_nid_postfix(Int128 a, Int128 b);
+int APS5_VABI __ucmpdi2_nid_postfix(std::uint64_t a, std::uint64_t b);
+int APS5_VABI __ucmpti2_nid_postfix(Uint128 a, Uint128 b);
+std::int64_t APS5_VABI __negdi2_nid_postfix(std::int64_t value);
+Int128 APS5_VABI __negti2_nid_postfix(Int128 value);
+std::int64_t APS5_VABI __muldi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __multi3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __divsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __divdi3_nid_postfix(std::int64_t a, std::int64_t b);
+std::int32_t APS5_VABI __modsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __moddi3_nid_postfix(std::int64_t a, std::int64_t b);
+std::uint32_t APS5_VABI __udivsi3_nid_postfix(std::uint32_t a, std::uint32_t b);
+std::uint64_t APS5_VABI __udivdi3_nid_postfix(std::uint64_t a, std::uint64_t b);
+std::uint32_t APS5_VABI __umodsi3_nid_postfix(std::uint32_t a, std::uint32_t b);
+std::uint64_t APS5_VABI __umoddi3_nid_postfix(std::uint64_t a, std::uint64_t b);
+std::int32_t APS5_VABI __divmodsi4_nid_postfix(std::int32_t a, std::int32_t b, std::int32_t* remainder);
+std::int64_t APS5_VABI __divmoddi4_nid_postfix(std::int64_t a, std::int64_t b, std::int64_t* remainder);
+std::uint32_t APS5_VABI __udivmodsi4_nid_postfix(std::uint32_t a, std::uint32_t b, std::uint32_t* remainder);
+std::uint64_t APS5_VABI __udivmoddi4_nid_postfix(std::uint64_t a, std::uint64_t b, std::uint64_t* remainder);
+Uint128 APS5_VABI __udivmodti4_nid_postfix(Uint128 a, Uint128 b, Uint128* remainder);
+std::int32_t APS5_VABI __mulosi4_nid_postfix(std::int32_t a, std::int32_t b, int* overflow);
+std::int64_t APS5_VABI __mulodi4_nid_postfix(std::int64_t a, std::int64_t b, int* overflow);
+Int128 APS5_VABI __muloti4_nid_postfix(Int128 a, Int128 b, int* overflow);
+std::int32_t APS5_VABI __mulvsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __mulvdi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __mulvti3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __addvsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __addvdi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __addvti3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __subvsi3_nid_postfix(std::int32_t a, std::int32_t b);
+std::int64_t APS5_VABI __subvdi3_nid_postfix(std::int64_t a, std::int64_t b);
+Int128 APS5_VABI __subvti3_nid_postfix(Int128 a, Int128 b);
+std::int32_t APS5_VABI __negvsi2_nid_postfix(std::int32_t value);
+std::int64_t APS5_VABI __negvdi2_nid_postfix(std::int64_t value);
+Int128 APS5_VABI __negvti2_nid_postfix(Int128 value);
+std::int32_t APS5_VABI __absvsi2_nid_postfix(std::int32_t value);
+std::int64_t APS5_VABI __absvdi2_nid_postfix(std::int64_t value);
+Int128 APS5_VABI __absvti2_nid_postfix(Int128 value);
+int APS5_VABI getifaddrs_nid_postfix(GuestInterfaceAddress** list);
+void APS5_VABI freeifaddrs_nid_postfix(GuestInterfaceAddress* list);
+int APS5_VABI isupper_nid_postfix(int c);
+int APS5_VABI islower_nid_postfix(int c);
+int APS5_VABI isalpha_nid_postfix(int c);
+int APS5_VABI isdigit_nid_postfix(int c);
+int APS5_VABI isalnum_nid_postfix(int c);
+int APS5_VABI isspace_nid_postfix(int c);
+int APS5_VABI isblank_nid_postfix(int c);
+int APS5_VABI iscntrl_nid_postfix(int c);
+int APS5_VABI isprint_nid_postfix(int c);
+int APS5_VABI isgraph_nid_postfix(int c);
+int APS5_VABI ispunct_nid_postfix(int c);
+int APS5_VABI isxdigit_nid_postfix(int c);
+int APS5_VABI isascii_nid_postfix(int c);
+int APS5_VABI toascii_nid_postfix(int c);
+int APS5_VABI toupper_nid_postfix(int c);
+int APS5_VABI tolower_nid_postfix(int c);
+void APS5_VABI _ZNSt8ios_baseD2Ev_nid_postfix(GuestLocale::IosBase* self);
+GuestLocale::IosBase* APS5_VABI SetStreamWidth(GuestLocale::IosBase* stream, std::int32_t width);
+StreamManipulator APS5_VABI _ZSt4setwi_nid_postfix(std::int32_t width);
+void APS5_VABI _ZNSt8ios_base7_AddstdEPS__nid_postfix(GuestLocale::IosBase* self);
+GuestLocale::Implementation* APS5_VABI _ZNSt6locale5_InitEv_nid_postfix();
+void APS5_VABI _ZNSt6locale5facet9_RegisterEv_nid_postfix(GuestLocale::Facet* self);
+GuestLocale::Implementation* APS5_VABI _ZNSt6locale16_GetgloballocaleEv_nid_postfix();
+GuestLocaleFacade* APS5_VABI _ZNSt6locale7classicEv_nid_postfix();
+std::size_t APS5_VABI _ZNSt7collateIwE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
+std::size_t APS5_VABI _ZNSt7collateIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
+void APS5_VABI _ZNSt8_LocinfoC1EPKc_nid_postfix(GuestLocale::LocinfoStorage* self, const char* localeName);
+void APS5_VABI _ZNSt8_LocinfoD1Ev_nid_postfix(GuestLocale::LocinfoStorage* self);
+int APS5_VABI _Mbtowcx_nid_postfix(std::uint16_t* dst, const char* src, std::size_t count, mbstate_t* st);
+int APS5_VABI _Wctombx_nid_postfix(char* dst, std::uint16_t src, mbstate_t* st);
+const short* APS5_VABI _Getpctype_nid_postfix();
+const short* APS5_VABI _Getptolower_nid_postfix();
+const short* APS5_VABI _Getptoupper_nid_postfix();
+mbstate_t* APS5_VABI _Getpmbstate_nid_postfix();
+mbstate_t* APS5_VABI _Getpwcstate_nid_postfix();
+std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t c, std::uint64_t desc);
+void APS5_VABI _ZNSt6locale7_LocimpC1ERKS0__nid_postfix(GuestLocale::Implementation* self, const GuestLocale::Implementation* source);
+void APS5_VABI _ZNSt6locale7_Locimp7_AddfacEPNS_5facetEm_nid_postfix(GuestLocale::Implementation* self, GuestLocale::Facet* facet, std::size_t id);
+void APS5_VABI _init_env_nid_postfix();
+void APS5_VABI init_env_nid_postfix(const InitEnvParams* params);
+SonyLconv* APS5_VABI localeconv_nid_postfix(void);
+std::lldiv_t APS5_VABI lldiv_nid_postfix(long long numerator, long long denominator);
+std::lldiv_t APS5_VABI ldiv_nid_postfix(std::int64_t numerator, std::int64_t denominator);
+std::lldiv_t APS5_VABI imaxdiv_nid_postfix(std::int64_t numerator, std::int64_t denominator);
+std::int64_t APS5_VABI labs_nid_postfix(std::int64_t x);
+std::int64_t APS5_VABI llabs_nid_postfix(std::int64_t x);
+std::int64_t APS5_VABI imaxabs_nid_postfix(std::int64_t x);
+float APS5_VABI fmodf_nid_postfix(float x, float y);
+float APS5_VABI asinf_nid_postfix(float x);
+float APS5_VABI acosf_nid_postfix(float x);
+float APS5_VABI atan2f_nid_postfix(float y, float x);
+float APS5_VABI hypotf_nid_postfix(float x, float y);
+double APS5_VABI hypot_nid_postfix(double x, double y);
+float APS5_VABI log10f_nid_postfix(float x);
+float APS5_VABI logbf_nid_postfix(float x);
+double APS5_VABI exp2_nid_postfix(double x);
+double APS5_VABI ldexp_nid_postfix(double x, int exponent);
+double APS5_VABI scalbn_nid_postfix(double x, int exponent);
+float APS5_VABI scalbnf_nid_postfix(float x, int exponent);
+long double APS5_VABI scalbnl_nid_postfix(long double x, int exponent);
+float APS5_VABI significandf_nid_postfix(float x);
+double APS5_VABI significand_nid_postfix(double x);
+double APS5_VABI frexp_nid_postfix(double x, int* exponent);
+float APS5_VABI frexpf_nid_postfix(float x, int* exponent);
+std::int64_t APS5_VABI lround_nid_postfix(double x);
+std::int64_t APS5_VABI lroundf_nid_postfix(float x);
+std::int64_t APS5_VABI llround_nid_postfix(double x);
+std::int64_t APS5_VABI llroundf_nid_postfix(float x);
+std::int64_t APS5_VABI llroundl_nid_postfix(long double x);
+int APS5_VABI __isfinitef_nid_postfix(float x);
+int APS5_VABI __isnormal_nid_postfix(double x);
+int APS5_VABI __isnormalf_nid_postfix(float x);
+int APS5_VABI __isinff_nid_postfix(float x);
+float APS5_VABI nearbyintf_nid_postfix(float x);
+long double APS5_VABI nearbyintl_nid_postfix(long double x);
+double APS5_VABI nearbyint_nid_postfix(double x);
+double APS5_VABI cbrt_nid_postfix(double x);
+double APS5_VABI asin_nid_postfix(double x);
+double APS5_VABI acos_nid_postfix(double x);
+double APS5_VABI sqrt_nid_postfix(double x);
+float APS5_VABI sqrtf_nid_postfix(float x);
+double APS5_VABI fabs_nid_postfix(double x);
+float APS5_VABI fabsf_nid_postfix(float x);
+long double APS5_VABI fabsl_nid_postfix(long double x);
+double APS5_VABI copysign_nid_postfix(double x, double y);
+float APS5_VABI copysignf_nid_postfix(float x, float y);
+int APS5_VABI abs_nid_postfix(int x);
+double APS5_VABI trunc_nid_postfix(double x);
+double APS5_VABI ceil_nid_postfix(double x);
+double APS5_VABI floor_nid_postfix(double x);
+float APS5_VABI truncf_nid_postfix(float x);
+float APS5_VABI ceilf_nid_postfix(float x);
+float APS5_VABI floorf_nid_postfix(float x);
+double APS5_VABI fma_nid_postfix(double x, double y, double z);
+float APS5_VABI fmaf_nid_postfix(float x, float y, float z);
+double APS5_VABI fmin_nid_postfix(double x, double y);
+float APS5_VABI fminf_nid_postfix(float x, float y);
+long double APS5_VABI fminl_nid_postfix(long double x, long double y);
+double APS5_VABI fmax_nid_postfix(double x, double y);
+float APS5_VABI fmaxf_nid_postfix(float x, float y);
+long double APS5_VABI fmaxl_nid_postfix(long double x, long double y);
+double APS5_VABI fdim_nid_postfix(double x, double y);
+float APS5_VABI fdimf_nid_postfix(float x, float y);
+long double APS5_VABI acosl_nid_postfix(long double x);
+long double APS5_VABI acoshl_nid_postfix(long double x);
+long double APS5_VABI asinhl_nid_postfix(long double x);
+long double APS5_VABI atanhl_nid_postfix(long double x);
+long double APS5_VABI atan2l_nid_postfix(long double y, long double x);
+long double APS5_VABI cbrtl_nid_postfix(long double x);
+long double APS5_VABI erfl_nid_postfix(long double x);
+long double APS5_VABI erfcl_nid_postfix(long double x);
+long double APS5_VABI expm1l_nid_postfix(long double x);
+long double APS5_VABI log1pl_nid_postfix(long double x);
+long double APS5_VABI log2l_nid_postfix(long double x);
+long double APS5_VABI lgammal_nid_postfix(long double x);
+long double APS5_VABI tgammal_nid_postfix(long double x);
+float APS5_VABI tgammaf_nid_postfix(float x);
+long double APS5_VABI hypotl_nid_postfix(long double x, long double y);
+float APS5_VABI hypot3f_nid_postfix(float x, float y, float z);
+double APS5_VABI hypot3_nid_postfix(double x, double y, double z);
+long double APS5_VABI hypot3l_nid_postfix(long double x, long double y, long double z);
+float APS5_VABI j0f_nid_postfix(float x);
+float APS5_VABI j1f_nid_postfix(float x);
+float APS5_VABI jnf_nid_postfix(int order, float x);
+float APS5_VABI y0f_nid_postfix(float x);
+float APS5_VABI y1f_nid_postfix(float x);
+float APS5_VABI ynf_nid_postfix(int order, float x);
+long double APS5_VABI asinl_nid_postfix(long double x);
+long double APS5_VABI frexpl_nid_postfix(long double x, int* exponent);
+double APS5_VABI exp_nid_postfix(double x);
+double APS5_VABI atan_nid_postfix(double x);
+double APS5_VABI tan_nid_postfix(double x);
+double APS5_VABI log2_nid_postfix(double x);
+double APS5_VABI log_nid_postfix(double x);
+double APS5_VABI log1p_nid_postfix(double x);
+float APS5_VABI log1pf_nid_postfix(float x);
+double APS5_VABI expm1_nid_postfix(double x);
+float APS5_VABI expm1f_nid_postfix(float x);
+float APS5_VABI erff_nid_postfix(float x);
+double APS5_VABI erf_nid_postfix(double x);
+double APS5_VABI erfc_nid_postfix(double x);
+float APS5_VABI erfcf_nid_postfix(float x);
+double APS5_VABI lgamma_nid_postfix(double x);
+float APS5_VABI sinf_nid_postfix(float x);
+float APS5_VABI cosf_nid_postfix(float x);
+float APS5_VABI tanf_nid_postfix(float x);
+void APS5_VABI sincosf_nid_postfix(float x, float* sinp, float* cosp);
+double APS5_VABI sin_nid_postfix(double x);
+double APS5_VABI cos_nid_postfix(double x);
+double APS5_VABI sinh_nid_postfix(double x);
+double APS5_VABI cosh_nid_postfix(double x);
+float APS5_VABI coshf_nid_postfix(float x);
+float APS5_VABI sinhf_nid_postfix(float x);
+double APS5_VABI asinh_nid_postfix(double x);
+float APS5_VABI asinhf_nid_postfix(float x);
+double APS5_VABI acosh_nid_postfix(double x);
+float APS5_VABI acoshf_nid_postfix(float x);
+double APS5_VABI atanh_nid_postfix(double x);
+float APS5_VABI atanhf_nid_postfix(float x);
+void APS5_VABI sincos_nid_postfix(double x, double* sinp, double* cosp);
+float APS5_VABI atanf_nid_postfix(float x);
+double APS5_VABI atan2_nid_postfix(double y, double x);
+float APS5_VABI powf_nid_postfix(float base, float exp);
+double APS5_VABI pow_nid_postfix(double base, double exp);
+float APS5_VABI __powisf2_nid_postfix(float base, int exponent);
+double APS5_VABI __powidf2_nid_postfix(double base, int exponent);
+float APS5_VABI expf_nid_postfix(float x);
+float APS5_VABI exp2f_nid_postfix(float x);
+float APS5_VABI logf_nid_postfix(float x);
+float APS5_VABI log2f_nid_postfix(float x);
+double APS5_VABI log10_nid_postfix(double x);
+float APS5_VABI ldexpf_nid_postfix(float x, int exp);
+double APS5_VABI fmod_nid_postfix(double x, double y);
+float APS5_VABI roundf_nid_postfix(float x);
+double APS5_VABI round_nid_postfix(double x);
+float APS5_VABI cbrtf_nid_postfix(float x);
+float APS5_VABI remainderf_nid_postfix(float x, float y);
+float APS5_VABI nextafterf_nid_postfix(float x, float y);
+double APS5_VABI nextafter_nid_postfix(double x, double y);
+int APS5_VABI __isfinite_nid_postfix(double x);
+int APS5_VABI __isnan_nid_postfix(double x);
+int APS5_VABI __isinf_nid_postfix(double x);
+int APS5_VABI __signbit_nid_postfix(double x);
+float APS5_VABI nanf_nid_postfix(const char* tagp);
+double APS5_VABI nan_nid_postfix(const char* tagp);
+double APS5_VABI modf_nid_postfix(double x, double* integral);
+float APS5_VABI modff_nid_postfix(float x, float* integral);
+double APS5_VABI tanh_nid_postfix(double x);
+float APS5_VABI tanhf_nid_postfix(float x);
+long double APS5_VABI atanl_nid_postfix(long double x);
+long double APS5_VABI sinl_nid_postfix(long double x);
+long double APS5_VABI cosl_nid_postfix(long double x);
+long double APS5_VABI tanl_nid_postfix(long double x);
+long double APS5_VABI sinhl_nid_postfix(long double x);
+long double APS5_VABI coshl_nid_postfix(long double x);
+long double APS5_VABI tanhl_nid_postfix(long double x);
+long double APS5_VABI expl_nid_postfix(long double x);
+long double APS5_VABI exp2l_nid_postfix(long double x);
+long double APS5_VABI logl_nid_postfix(long double x);
+long double APS5_VABI log10l_nid_postfix(long double x);
+long double APS5_VABI powl_nid_postfix(long double base, long double exp);
+long double APS5_VABI ldexpl_nid_postfix(long double x, int exp);
+long double APS5_VABI truncl_nid_postfix(long double x);
+long double APS5_VABI ceill_nid_postfix(long double x);
+long double APS5_VABI floorl_nid_postfix(long double x);
+double APS5_VABI logb_nid_postfix(double x);
+int APS5_VABI ilogb_nid_postfix(double x);
+int APS5_VABI ilogbf_nid_postfix(float x);
+double APS5_VABI remainder_nid_postfix(double x, double y);
+double APS5_VABI remquo_nid_postfix(double x, double y, int* quo);
+float APS5_VABI remquof_nid_postfix(float x, float y, int* quo);
+float APS5_VABI _FSinh_nid_postfix(float x, float y);
+float APS5_VABI _FCosh_nid_postfix(float x, float y);
+short APS5_VABI _FDtest_nid_postfix(const float* value);
+short APS5_VABI _Dtest_nid_postfix(const double* value);
+int APS5_VABI __isnanf_nid_postfix(float x);
+int APS5_VABI isnanf_nid_postfix(float x);
+int APS5_VABI isnan_nid_postfix(double x);
+int APS5_VABI isinf_nid_postfix(double x);
+int APS5_VABI __fpclassifyf_nid_postfix(float x);
+int APS5_VABI __signbitf_nid_postfix(float x);
+int APS5_VABI __signbitl_nid_postfix(long double x);
+int APS5_VABI __isfinitel_nid_postfix(long double x);
+int APS5_VABI rand_nid_postfix();
+int APS5_VABI rand_r_nid_postfix(unsigned int* state);
+void APS5_VABI srand_nid_postfix(unsigned int seed);
+int APS5_VABI __fpclassifyd_nid_postfix(double value);
+double APS5_VABI _Sinh_nid_postfix(double x, double y);
+double APS5_VABI _Cosh_nid_postfix(double x, double y);
+int APS5_VABI _Fltrounds_nid_postfix(void);
+int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment* environment);
+long double APS5_VABI copysignl_nid_postfix(long double x, long double y);
+long double APS5_VABI fdiml_nid_postfix(long double x, long double y);
+long double APS5_VABI fmodl_nid_postfix(long double x, long double y);
+long double APS5_VABI remainderl_nid_postfix(long double x, long double y);
+long double APS5_VABI remquol_nid_postfix(long double x, long double y, int* quotient);
+long double APS5_VABI logbl_nid_postfix(long double x);
+int APS5_VABI ilogbl_nid_postfix(long double x);
+long double APS5_VABI rintl_nid_postfix(long double x);
+long double APS5_VABI roundl_nid_postfix(long double x);
+std::int64_t APS5_VABI lroundl_nid_postfix(long double x);
+std::int64_t APS5_VABI lrintl_nid_postfix(long double x);
+long long APS5_VABI llrintl_nid_postfix(long double x);
+long double APS5_VABI sqrtl_nid_postfix(long double x);
+long double APS5_VABI modfl_nid_postfix(long double x, long double* integral);
+long double APS5_VABI nanl_nid_postfix(const char*);
+long double APS5_VABI scalblnl_nid_postfix(long double x, std::int64_t exponent);
+long double APS5_VABI fmal_nid_postfix(long double x, long double y, long double z);
+double APS5_VABI rint_nid_postfix(double x);
+float APS5_VABI rintf_nid_postfix(float x);
+std::int64_t APS5_VABI lrint_nid_postfix(double x);
+std::int64_t APS5_VABI lrintf_nid_postfix(float x);
+long long APS5_VABI llrint_nid_postfix(double x);
+long long APS5_VABI llrintf_nid_postfix(float x);
+double APS5_VABI drem_nid_postfix(double x, double y);
+float APS5_VABI dremf_nid_postfix(float x, float y);
+double APS5_VABI scalbln_nid_postfix(double x, std::int64_t exponent);
+float APS5_VABI scalblnf_nid_postfix(float x, std::int64_t exponent);
+double APS5_VABI scalb_nid_postfix(double x, double exponent);
+float APS5_VABI scalbf_nid_postfix(float x, float exponent);
+int APS5_VABI finite_nid_postfix(double x);
+int APS5_VABI finitef_nid_postfix(float x);
+int APS5_VABI __fpclassifyl_nid_postfix(long double x);
+int APS5_VABI __isinfl_nid_postfix(long double x);
+int APS5_VABI __isnanl_nid_postfix(long double x);
+int APS5_VABI __isnormall_nid_postfix(long double x);
+short APS5_VABI _LDtest_nid_postfix(const long double* value);
+int APS5_VABI _Dclass_nid_postfix(double x);
+int APS5_VABI _FDclass_nid_postfix(float x);
+int APS5_VABI _LDclass_nid_postfix(long double x);
+short APS5_VABI _LDsign_nid_postfix(long double x);
+void* APS5_VABI sceLibcMspaceCreate_nid_postfix(const char* name, void* base, std::size_t size, unsigned flags);
+int APS5_VABI sceLibcMspaceDestroy_nid_postfix(void* handle);
+void* APS5_VABI sceLibcMspaceMalloc_nid_postfix(void* handle, std::size_t size);
+void APS5_VABI sceLibcMspaceFree_nid_postfix(void* handle, void* pointer);
+void* APS5_VABI sceLibcMspaceCalloc_nid_postfix(void* handle, std::size_t count, std::size_t size);
+void* APS5_VABI sceLibcMspaceRealloc_nid_postfix(void* handle, void* pointer, std::size_t size);
+int APS5_VABI sceLibcMspacePosixMemalign_nid_postfix(void* handle, void** result, std::size_t alignment, std::size_t size);
+void* APS5_VABI sceLibcMspaceMemalign_nid_postfix(void* handle, std::size_t alignment, std::size_t size);
+void* APS5_VABI sceLibcMspaceAlignedAlloc_nid_postfix(void* handle, std::size_t alignment, std::size_t size);
+void* APS5_VABI sceLibcMspaceReallocalign_nid_postfix(void* handle, void* pointer, std::size_t alignment, std::size_t size);
+int APS5_VABI sceLibcMspaceMallocStats_nid_postfix(void* handle, MallocManagedSize* stats);
+int APS5_VABI sceLibcMspaceMallocStatsFast_nid_postfix(void* handle, MallocManagedSize* stats);
+std::size_t APS5_VABI sceLibcMspaceMallocUsableSize_nid_postfix(const void* pointer);
+void* APS5_VABI sceLibcPafMspaceCreate_nid_postfix(const char* name, void* base, std::size_t size, unsigned flags, const void* options);
+int APS5_VABI sceLibcPafMspaceDestroy_nid_postfix(void* handle);
+void* APS5_VABI sceLibcPafMspaceMalloc_nid_postfix(void* handle, std::size_t size, const void* owner);
+void* APS5_VABI sceLibcPafMspaceMemalign_nid_postfix(void* handle, std::size_t alignment, std::size_t size, const void* owner);
+void APS5_VABI sceLibcPafMspaceFree_nid_postfix(void* handle, void* pointer, const void* owner);
+void* APS5_VABI sceLibcPafMspaceCalloc_nid_postfix(void* handle, std::size_t count, std::size_t size, const void* owner);
+void* APS5_VABI sceLibcPafMspaceRealloc_nid_postfix(void* handle, void* pointer, std::size_t size, const void* owner);
+void* APS5_VABI sceLibcPafMspaceReallocalign_nid_postfix(void* handle, void* pointer, std::size_t alignment, std::size_t size, const void* owner);
+int APS5_VABI sceLibcPafMspacePosixMemalign_nid_postfix(void* handle, void** result, std::size_t alignment, std::size_t size, const void* owner);
+int APS5_VABI sceLibcPafMspaceMallocStats_nid_postfix(void* handle, MallocManagedSize* stats);
+int APS5_VABI sceLibcPafMspaceMallocStatsFast_nid_postfix(void* handle, MallocManagedSize* stats);
+int APS5_VABI ___mb_cur_max_nid_postfix();
+int APS5_VABI _Getmbcurmax_nid_postfix();
+int APS5_VABI mbsinit_nid_postfix(const void* state);
+std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
+std::size_t APS5_VABI mbrlen_nid_postfix(const char* source, std::size_t count, void* state);
+int APS5_VABI mbtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count);
+std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void*);
+int APS5_VABI mblen_nid_postfix(const char* source, std::size_t count);
+int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value);
+std::size_t APS5_VABI c32rtomb_nid_postfix(char* destination, std::uint32_t value, void*);
+std::size_t APS5_VABI c16rtomb_nid_postfix(char* destination, std::uint16_t unit, void* state);
+std::size_t APS5_VABI mbrtoc32_nid_postfix(std::uint32_t* destination, const char* source, std::size_t count, void* state);
+std::size_t APS5_VABI mbrtoc16_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
+std::size_t APS5_VABI wcsrtombs_nid_postfix(char* destination, const std::uint16_t** source, std::size_t capacity, void*);
+int APS5_VABI wcsrtombs_s_nid_postfix( std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t** source, std::size_t limit, void* state );
+int APS5_VABI wcstombs_s_nid_postfix( std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit );
+std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t* destination, const char** source, std::size_t capacity, void* state);
+std::size_t APS5_VABI mbstowcs_nid_postfix(std::uint16_t* dest, const char* src, std::size_t size);
+void APS5_VABI exit_nid_postfix(int code);
+int* APS5_VABI libc_error_nid_postfix();
+int* APS5_VABI __error_nid_postfix();
+int APS5_VABI atexit_nid_postfix(GuestExitCallback func);
+int APS5_VABI at_quick_exit_nid_postfix(GuestExitCallback func);
+int APS5_VABI daemon_nid_postfix(int noChdir, int noClose);
+double APS5_VABI erand48_nid_postfix(std::uint16_t* seed);
+std::int64_t APS5_VABI nrand48_nid_postfix(std::uint16_t* seed);
+std::int64_t APS5_VABI jrand48_nid_postfix(std::uint16_t* seed);
+double APS5_VABI drand48_nid_postfix();
+std::int64_t APS5_VABI lrand48_nid_postfix();
+std::int64_t APS5_VABI mrand48_nid_postfix();
+void APS5_VABI srand48_nid_postfix(std::int64_t seedval);
+std::uint16_t* APS5_VABI seed48_nid_postfix(const std::uint16_t* seed);
+void APS5_VABI lcong48_nid_postfix(const std::uint16_t* parameters);
+std::int64_t APS5_VABI random_nid_postfix();
+void APS5_VABI srandom_nid_postfix(std::uint64_t seed);
+char* APS5_VABI initstate_nid_postfix(std::uint64_t seed, char* state, std::int64_t size);
+char* APS5_VABI setstate_nid_postfix(char* state);
+char* APS5_VABI realpath_nid_postfix(const char* path, char* resolved);
+int APS5_VABI rename_nid_postfix(const char* from, const char* to);
+int APS5_VABI iswalnum_nid_postfix(std::uint32_t c);
+int APS5_VABI iswalpha_nid_postfix(std::uint32_t c);
+int APS5_VABI iswblank_nid_postfix(std::uint32_t c);
+int APS5_VABI iswcntrl_nid_postfix(std::uint32_t c);
+int APS5_VABI iswdigit_nid_postfix(std::uint32_t c);
+int APS5_VABI iswgraph_nid_postfix(std::uint32_t c);
+int APS5_VABI iswlower_nid_postfix(std::uint32_t c);
+int APS5_VABI iswprint_nid_postfix(std::uint32_t c);
+int APS5_VABI iswpunct_nid_postfix(std::uint32_t c);
+int APS5_VABI iswspace_nid_postfix(std::uint32_t c);
+int APS5_VABI iswupper_nid_postfix(std::uint32_t c);
+int APS5_VABI iswxdigit_nid_postfix(std::uint32_t c);
+int APS5_VABI iswctype_nid_postfix(std::uint32_t c, std::uint64_t mask);
+int APS5_VABI _Iswctype_nid_postfix(std::uint32_t c, std::uint64_t type);
+std::uint64_t APS5_VABI wctype_nid_postfix(const char* property);
+std::uint32_t APS5_VABI towlower_nid_postfix(std::uint32_t c);
+std::uint32_t APS5_VABI towupper_nid_postfix(std::uint32_t c);
+std::uint32_t APS5_VABI btowc_nid_postfix(int c);
+int APS5_VABI wctob_nid_postfix(std::uint32_t c);
+std::uint64_t APS5_VABI wctrans_nid_postfix(const char* property);
+std::uint32_t APS5_VABI towctrans_nid_postfix(std::uint32_t c, std::uint64_t desc);
+std::uint32_t APS5_VABI _Towlower_nid_postfix(std::uint32_t c, const void*);
+std::uint32_t APS5_VABI _Towupper_nid_postfix(std::uint32_t c, const void*);
+int APS5_VABI _Tolower_nid_postfix(int c, const void*);
+int APS5_VABI _Toupper_nid_postfix(int c, const void*);
+int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
+int APS5_VABI cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
+void APS5_VABI cxa_finalize_nid_postfix(void* dsoHandle);
+void APS5_VABI _Vacopy_nid_postfix(unsigned char* destination, const unsigned char* source);
+unsigned int APS5_VABI _Atomic_fetch_add_4_nid_postfix(volatile unsigned int* target, unsigned int value, int memoryOrder);
+unsigned int APS5_VABI _Atomic_fetch_sub_4_nid_postfix(volatile unsigned int* target, unsigned int value, int memoryOrder);
+int APS5_VABI _Atomic_compare_exchange_weak_4_nid_postfix(volatile unsigned int* target, unsigned int* expected, unsigned int desired, int successOrder, int failureOrder);
+unsigned int APS5_VABI _Atomic_load_4_nid_postfix(volatile unsigned int* target, int memoryOrder);
+std::intmax_t APS5_VABI strtoimax_nid_postfix(const char* str, char** endptr, int base);
+std::uintmax_t APS5_VABI strtoumax_nid_postfix(const char* str, char** endptr, int base);
+unsigned int APS5_VABI _ZSt14_Random_devicev_nid_postfix();
+void APS5_VABI _Lockfilelock_nid_postfix(FileStream* stream);
+void APS5_VABI _Unlockfilelock_nid_postfix(FileStream* stream);
+void APS5_VABI flockfile_nid_postfix(FileStream* stream);
+void APS5_VABI funlockfile_nid_postfix(FileStream* stream);
+int APS5_VABI ftrylockfile_nid_postfix(FileStream* stream);
+std::uint64_t APS5_VABI _Stoul_nid_postfix(const char* str, char** endptr, int base);
+void APS5_VABI _Locksyslock_nid_postfix();
+void APS5_VABI _Unlocksyslock_nid_postfix();
+__int128 APS5_VABI __divti3_nid_postfix(__int128 dividend, __int128 divisor);
+unsigned __int128 APS5_VABI __udivti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
+unsigned __int128 APS5_VABI __umodti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
+__int128 APS5_VABI __modti3_nid_postfix(__int128 dividend, __int128 divisor);
+int APS5_VABI swscanf_nid_postfix(const char16_t* buffer, const char16_t* format, ...);
+int APS5_VABI swscanf_s_nid_postfix(const char16_t* buffer, const char16_t* format, ...);
+int APS5_VABI vswscanf_nid_postfix(const char16_t* buffer, const char16_t* format, VaList* args);
+int APS5_VABI vswscanf_s_nid_postfix(const char16_t* buffer, const char16_t* format, VaList* args);
+int APS5_VABI vfwscanf_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI vfwscanf_s_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI vwscanf_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI vwscanf_s_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI fwscanf_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI fwscanf_s_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI wscanf_nid_postfix(const char16_t* format, ...);
+int APS5_VABI wscanf_s_nid_postfix(const char16_t* format, ...);
+int APS5_VABI fgetc_nid_postfix(FileStream* stream);
+std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream);
+std::int32_t APS5_VABI ungetwc_nid_postfix(std::int32_t value, FileStream* stream);
+int APS5_VABI getc_nid_postfix(FileStream* stream);
+int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI __srget_nid_postfix(FileStream* stream);
+int APS5_VABI getchar_nid_postfix();
+char* APS5_VABI gets_nid_postfix(char* buffer);
+std::int32_t APS5_VABI getwc_nid_postfix(FileStream* stream);
+std::int32_t APS5_VABI getwchar_nid_postfix();
+int APS5_VABI getchar_unlocked_nid_postfix();
+int APS5_VABI fputc_nid_postfix(int value, FileStream* stream);
+int APS5_VABI putc_nid_postfix(int value, FileStream* stream);
+int APS5_VABI putc_unlocked_nid_postfix(int value, FileStream* stream);
+int APS5_VABI __swbuf_nid_postfix(int value, FileStream* stream);
+int APS5_VABI putchar_nid_postfix(int value);
+int APS5_VABI putchar_unlocked_nid_postfix(int value);
+int APS5_VABI ungetc_nid_postfix(int value, FileStream* stream);
+char* APS5_VABI fgets_nid_postfix(char* buffer, int size, FileStream* stream);
+int APS5_VABI feof_nid_postfix(FileStream* stream);
+int APS5_VABI ferror_nid_postfix(FileStream* stream);
+int APS5_VABI feof_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI ferror_unlocked_nid_postfix(FileStream* stream);
+void APS5_VABI clearerr_nid_postfix(FileStream* stream);
+int APS5_VABI fileno_nid_postfix(FileStream* stream);
+void APS5_VABI clearerr_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI fileno_unlocked_nid_postfix(FileStream* stream);
+int APS5_VABI setvbuf_nid_postfix(FileStream* stream, char* buffer, int mode, std::size_t size);
+void APS5_VABI setbuf_nid_postfix(FileStream* stream, char* buffer);
+const char* APS5_VABI setlocale_nid_postfix(int, const char* locale);
+GuestNewHandler APS5_VABI _ZSt15set_new_handlerPFvvE_nid_postfix(GuestNewHandler handler);
+GuestNewHandler APS5_VABI _ZSt15get_new_handlerv_nid_postfix();
+void* APS5_VABI _Znwm_nid_postfix(std::size_t size);
+void* APS5_VABI _Znam_nid_postfix(std::size_t size);
+void* APS5_VABI _ZnwmSt11align_val_t_nid_postfix(std::size_t size, std::size_t alignment);
+void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t size, const void*) noexcept;
+void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t size, const void*) noexcept;
+void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
+void APS5_VABI _ZdlPvRKSt9nothrow_t_nid_postfix(void* pointer, const void*) noexcept;
+void APS5_VABI _ZdaPv_nid_postfix(void* pointer);
+void APS5_VABI _ZdlPvm_nid_postfix(void* pointer, std::size_t);
+void APS5_VABI _ZdaPvm_nid_postfix(void* pointer, std::size_t);
+void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void* pointer, std::size_t alignment);
+void APS5_VABI _ZdlPvmSt11align_val_t_nid_postfix(void* pointer, std::size_t, std::size_t alignment);
+long long APS5_VABI strtonum_nid_postfix(const char* text, long long minimum, long long maximum, const char** error);
+char* APS5_VABI basename_r_nid_postfix(const char* path, char* buffer);
+char* APS5_VABI basename_nid_postfix(const char* path);
+char* APS5_VABI __inet_ntoa_nid_postfix(unsigned int address);
+char* APS5_VABI dirname_nid_postfix(const char* path);
+std::size_t APS5_VABI strnlen_nid_postfix(const char* text, std::size_t limit);
+std::size_t APS5_VABI strnlen_s_nid_postfix(const char* text, std::size_t limit);
+char* APS5_VABI strsep_nid_postfix(char** text, const char* delimiters);
+char* APS5_VABI strncat_nid_postfix(char* destination, const char* source, std::size_t limit);
+char* APS5_VABI strpbrk_nid_postfix(const char* text, const char* accept);
+std::size_t APS5_VABI strcspn_nid_postfix(const char* text, const char* reject);
+std::size_t APS5_VABI strlcat_nid_postfix(char* destination, const char* source, std::size_t capacity);
+char* APS5_VABI stpcpy_nid_postfix(char* destination, const char* source);
+char* APS5_VABI strtok_r_nid_postfix(char* text, const char* delimiters, char** state);
+char* APS5_VABI strtok_nid_postfix(char* text, const char* delimiters);
+int APS5_VABI __inet_aton_nid_postfix(const char* text, void* address);
+std::uint32_t APS5_VABI __inet_addr_nid_postfix(const char* text);
+void* APS5_VABI memset_nid_postfix(void* s, int c, size_t n);
+void APS5_VABI bzero_nid_postfix(void* destination, size_t count);
+void APS5_VABI bcopy_nid_postfix(const void* source, void* destination, size_t count);
+void* APS5_VABI memcpy_nid_postfix(void* dest, const void* src, size_t n);
+void* APS5_VABI memmove_nid_postfix(void* dest, const void* src, size_t n);
+int APS5_VABI memcmp_nid_postfix(const void* s1, const void* s2, size_t n);
+const void* APS5_VABI memchr_nid_postfix(const void* s, int c, size_t n);
+void* APS5_VABI memrchr_nid_postfix(const void* s, int c, size_t n);
+void* APS5_VABI memccpy_nid_postfix(void* dest, const void* src, int c, size_t n);
+void* APS5_VABI memmem_nid_postfix(const void* haystack, size_t haystacklen, const void* needle, size_t needlelen);
+int APS5_VABI strcmp_nid_postfix(const char* s1, const char* s2);
+int APS5_VABI strncmp_nid_postfix(const char* s1, const char* s2, size_t n);
+size_t APS5_VABI strlen_nid_postfix(const char* s);
+char* APS5_VABI strcpy_nid_postfix(char* dest, const char* src);
+char* APS5_VABI strncpy_nid_postfix(char* dest, const char* src, size_t count);
+char* APS5_VABI strcat_nid_postfix(char* dest, const char* src);
+const char* APS5_VABI strchr_nid_postfix(const char* s, int c);
+char* APS5_VABI index_nid_postfix(const char* s, int c);
+char* APS5_VABI strrchr_nid_postfix(const char* s, int c);
+char* APS5_VABI rindex_nid_postfix(const char* s, int c);
+int APS5_VABI flsl_nid_postfix(std::int64_t mask);
+char* APS5_VABI strstr_nid_postfix(const char* haystack, const char* needle);
+size_t APS5_VABI strlcpy_nid_postfix(char* dest, const char* src, size_t size);
+std::int64_t APS5_VABI strtol_nid_postfix(const char* str, char** endptr, int base);
+std::uint64_t APS5_VABI strtoul_nid_postfix(const char* str, char** endptr, int base);
+long long APS5_VABI strtoll_nid_postfix(const char* str, char** endptr, int base);
+unsigned long long APS5_VABI strtoull_nid_postfix(const char* str, char** endptr, int base);
+unsigned long long APS5_VABI strtouq_nid_postfix(const char* str, char** endptr, int base);
+double APS5_VABI strtod_nid_postfix(const char* str, char** endptr);
+double APS5_VABI atof_nid_postfix(const char* str);
+float APS5_VABI strtof_nid_postfix(const char* str, char** endptr);
+long double APS5_VABI strtold_nid_postfix(const char* str, char** endptr);
+int APS5_VABI atoi_nid_postfix(const char* str);
+std::int64_t APS5_VABI atol_nid_postfix(const char* str);
+long long APS5_VABI atoll_nid_postfix(const char* str);
+std::div_t APS5_VABI div_nid_postfix(int numerator, int denominator);
+const char16_t* APS5_VABI wmemchr_nid_postfix(const char16_t* s, char16_t c, size_t n);
+int APS5_VABI wmemcmp_nid_postfix(const char16_t* s1, const char16_t* s2, size_t n);
+char16_t* APS5_VABI wmemcpy_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+char16_t* APS5_VABI wmemmove_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+int APS5_VABI strcasecmp_nid_postfix(const char* s1, const char* s2);
+int APS5_VABI strncasecmp_nid_postfix(const char* s1, const char* s2, size_t n);
+int APS5_VABI bcmp_nid_postfix(const void* s1, const void* s2, size_t n);
+size_t APS5_VABI strspn_nid_postfix(const char* s, const char* accept);
+int APS5_VABI strcoll_nid_postfix(const char* s1, const char* s2);
+int APS5_VABI strncpy_s_nid_postfix(char* dest, size_t destsz, const char* src, size_t count);
+int APS5_VABI strcpy_s_nid_postfix(char* dest, size_t destsz, const char* src);
+int APS5_VABI strncat_s_nid_postfix(char* dest, size_t destsz, const char* src, size_t count);
+int APS5_VABI strcat_s_nid_postfix(char* dest, size_t destsz, const char* src);
+int APS5_VABI memcpy_s_nid_postfix(void* dest, size_t destsz, const void* src, size_t count);
+int APS5_VABI memmove_s_nid_postfix(void* dest, size_t destsz, const void* src, size_t count);
+int APS5_VABI memset_s_nid_postfix(void* dest, size_t destsz, int value, size_t count);
+char* APS5_VABI strnstr_nid_postfix(const char* haystack, const char* needle, size_t length);
+unsigned long long APS5_VABI _Stoull_nid_postfix(const char* str, char** endptr, int base);
+size_t APS5_VABI wcslen_nid_postfix(const char16_t* s);
+size_t APS5_VABI wcsnlen_s_nid_postfix(const char16_t* s, size_t maxlen);
+int APS5_VABI wcscmp_nid_postfix(const char16_t* s1, const char16_t* s2);
+int APS5_VABI wcsncmp_nid_postfix(const char16_t* s1, const char16_t* s2, size_t n);
+char16_t* APS5_VABI wcscpy_nid_postfix(char16_t* dest, const char16_t* src);
+char16_t* APS5_VABI wcscat_nid_postfix(char16_t* dest, const char16_t* src);
+char16_t* APS5_VABI wcsncpy_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+const char16_t* APS5_VABI wcschr_nid_postfix(const char16_t* s, char16_t c);
+const char16_t* APS5_VABI wcsrchr_nid_postfix(const char16_t* s, char16_t c);
+const char16_t* APS5_VABI wcsstr_nid_postfix(const char16_t* haystack, const char16_t* needle);
+const char16_t* APS5_VABI wcspbrk_nid_postfix(const char16_t* s, const char16_t* accept);
+size_t APS5_VABI wcsspn_nid_postfix(const char16_t* s, const char16_t* accept);
+size_t APS5_VABI wcscspn_nid_postfix(const char16_t* s, const char16_t* reject);
+char16_t* APS5_VABI wcstok_nid_postfix(char16_t* text, const char16_t* delimiters, char16_t** last);
+char16_t* APS5_VABI wmemset_nid_postfix(char16_t* s, char16_t c, size_t n);
+double APS5_VABI wcstod_nid_postfix(const char16_t* str, char16_t** endptr);
+float APS5_VABI wcstof_nid_postfix(const char16_t* str, char16_t** endptr);
+long double APS5_VABI wcstold_nid_postfix(const char16_t* str, char16_t** endptr);
+unsigned long long APS5_VABI wcstoul_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+unsigned long long APS5_VABI wcstoull_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+long long APS5_VABI wcstoll_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+long long APS5_VABI wcstol_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+long long APS5_VABI wcstoimax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+unsigned long long APS5_VABI wcstoumax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+std::uint64_t APS5_VABI _WStoul_nid_postfix(const char16_t* str, char16_t** endptr, int base);
+int APS5_VABI wcscoll_nid_postfix(const char16_t* first, const char16_t* second);
+size_t APS5_VABI wcsxfrm_nid_postfix(char16_t* destination, const char16_t* source, size_t count);
+size_t APS5_VABI strxfrm_nid_postfix(char* destination, const char* source, size_t count);
+char* APS5_VABI strtok_s_nid_postfix(char* str, const char* delim, char** context);
+int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+int APS5_VABI wmemmove_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+int APS5_VABI wcsncpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+char16_t* APS5_VABI wcsncat_nid_postfix(char16_t* dest, const char16_t* src, size_t n);
+int APS5_VABI wcsncat_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src, size_t count);
+int APS5_VABI wcscat_s_nid_postfix(char16_t* dest, size_t destsz, const char16_t* src);
+void APS5_VABI openlog_nid_postfix(const char* identity, int options, int facility);
+void APS5_VABI closelog_nid_postfix();
+int APS5_VABI setlogmask_nid_postfix(int mask);
+void APS5_VABI vsyslog_nid_postfix(int priority, const char* format, VaList* args);
+void APS5_VABI syslog_nid_postfix(int priority, const char* format, ...);
+int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
+int APS5_VABI _Mtx_init_with_name_nid_postfix(void** handle, int type, const char*);
+void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
+int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
+int APS5_VABI _Mtx_trylock_nid_postfix(void** handle);
+int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
+int APS5_VABI _Cnd_init_nid_postfix(void** handle);
+int APS5_VABI _Cnd_init_with_default_name_override_nid_postfix(void** handle, const char*);
+void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
+int APS5_VABI _Cnd_wait_nid_postfix(void** conditionHandle, void** mutexHandle);
+int APS5_VABI _Cnd_timedwait_nid_postfix(void** conditionHandle, void** mutexHandle, const Xtime* target);
+int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
+unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix();
+int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*);
+int APS5_VABI _Thrd_yield_nid_postfix();
+int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
+void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad);
+void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(GuestPad* pad);
+void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad);
+void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(GuestPad* pad, void** thread);
+int APS5_VABI _Thrd_join_nid_postfix(void* thread, int* code);
+int APS5_VABI _Thrd_detach_nid_postfix(void* thread);
+int APS5_VABI _Thrd_id_nid_postfix(void);
+void APS5_VABI _Call_once_nid_postfix(std::int32_t* flag, void (APS5_VABI* function)(void));
+int APS5_VABI _Tss_create_nid_postfix(int* key, void (APS5_VABI* destructor)(void*));
+int APS5_VABI _Tss_delete_nid_postfix(int key);
+void* APS5_VABI _Tss_get_nid_postfix(int key);
+int APS5_VABI _Tss_set_nid_postfix(int key, void* value);
+int APS5_VABI _Thrd_equal_nid_postfix(void* first, void* second);
+void* APS5_VABI _Thrd_current_nid_postfix(void);
+int APS5_VABI _Mtx_current_owns_nid_postfix(void**);
+int APS5_VABI _ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(void** mutex, int type, const char* name);
+int APS5_VABI _ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(void** mutex, int type);
+int APS5_VABI _ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(void** mutex);
+int APS5_VABI _ZNSt8__sce_v219_Cnd_init_with_nameEPP12pthread_condPKc_nid_postfix(void** condition, const char* name);
+int APS5_VABI _ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(void** condition, void** mutex);
+int APS5_VABI _ZNSt8__sce_v211_Cnd_signalEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v214_Cnd_broadcastEPP12pthread_cond_nid_postfix(void** condition);
+int APS5_VABI _ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(void* thread);
+int APS5_VABI _ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(void* thread, int* code);
+void APS5_VABI _ZNSt8__sce_v211_Thrd_yieldEv_nid_postfix();
+void* APS5_VABI _ZNSt8__sce_v28_Thrd_idEv_nid_postfix();
+void APS5_VABI tzset_nid_postfix(void);
+int64_t APS5_VABI libc_time_nid_postfix(int64_t* timer);
+int64_t APS5_VABI time_nid_postfix(int64_t* timer);
+int64_t APS5_VABI _Xtime_get_ticks_nid_postfix();
+double APS5_VABI libc_difftime_nid_postfix(int64_t time1, int64_t time0);
+double APS5_VABI difftime_nid_postfix(int64_t time1, int64_t time0);
+GuestTm* APS5_VABI libc_gmtime_nid_postfix(const int64_t* timer);
+GuestTm* APS5_VABI libc_localtime_nid_postfix(const int64_t* timer);
+GuestTm* APS5_VABI localtime_nid_postfix(const int64_t* timer);
+GuestTm* APS5_VABI gmtime_s_nid_postfix(const int64_t* timer, GuestTm* result);
+GuestTm* APS5_VABI gmtime_nid_postfix(const int64_t* timer);
+int64_t APS5_VABI libc_mktime_nid_postfix(GuestTm* timeptr);
+int64_t APS5_VABI mktime_nid_postfix(GuestTm* timeptr);
+size_t APS5_VABI libc_strftime_nid_postfix(char* str, size_t count, const char* format, const GuestTm* timeptr);
+char* APS5_VABI asctime_nid_postfix(const GuestTm* timeptr);
+char* APS5_VABI ctime_nid_postfix(const int64_t* timer);
+size_t APS5_VABI strftime_nid_postfix(char* str, size_t count, const char* format, const GuestTm* timeptr);
+size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const std::uint16_t* format, const GuestTm* timeptr);
+int64_t APS5_VABI clock_nid_postfix();
+int APS5_VABI ctime_s_nid_postfix(char* buffer, std::size_t size, const std::int64_t* time);
+int APS5_VABI asctime_s_nid_postfix(char* buffer, std::size_t size, const GuestTm* time);
+GuestTm* APS5_VABI gmtime_r_nid_postfix(const std::int64_t* timer, GuestTm* result);
+GuestTm* APS5_VABI localtime_r_nid_postfix(const std::int64_t* timer, GuestTm* result);
+std::int64_t APS5_VABI timegm_nid_postfix(GuestTm* time);
+int APS5_VABI xtime_get_nid_postfix(Xtime* time, int base);
+Xtime APS5_VABI _Xtime_to_ts_nid_postfix(const Xtime* time);
+Xtime APS5_VABI _Xtime_diff_to_ts_nid_postfix(const Xtime* target);
+const void* APS5_VABI __std_find_trivial_1_nid_postfix(const void* first, const void* last, std::uint8_t value);
+const void* APS5_VABI __std_find_trivial_2_nid_postfix(const void* first, const void* last, std::uint16_t value);
+const void* APS5_VABI __std_find_trivial_4_nid_postfix(const void* first, const void* last, std::uint32_t value);
+const void* APS5_VABI __std_find_trivial_8_nid_postfix(const void* first, const void* last, std::uint64_t value);
+const void* APS5_VABI __std_find_trivial_unsized_1_nid_postfix(const void* first, std::uint8_t value);
+const void* APS5_VABI __std_find_trivial_unsized_2_nid_postfix(const void* first, std::uint16_t value);
+const void* APS5_VABI __std_find_trivial_unsized_4_nid_postfix(const void* first, std::uint32_t value);
+const void* APS5_VABI __std_find_trivial_unsized_8_nid_postfix(const void* first, std::uint64_t value);
+std::size_t APS5_VABI __std_count_trivial_1_nid_postfix(const void* first, const void* last, std::uint8_t value);
+std::size_t APS5_VABI __std_count_trivial_2_nid_postfix(const void* first, const void* last, std::uint16_t value);
+std::size_t APS5_VABI __std_count_trivial_4_nid_postfix(const void* first, const void* last, std::uint32_t value);
+std::size_t APS5_VABI __std_count_trivial_8_nid_postfix(const void* first, const void* last, std::uint64_t value);
+const void* APS5_VABI __std_min_element_1_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_min_element_2_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_min_element_4_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_min_element_8_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_1_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_2_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_4_nid_postfix(const void* first, const void* last, bool isSigned);
+const void* APS5_VABI __std_max_element_8_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_1_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_2_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_4_nid_postfix(const void* first, const void* last, bool isSigned);
+MinMaxPointers APS5_VABI __std_minmax_element_8_nid_postfix(const void* first, const void* last, bool isSigned);
+void APS5_VABI __std_reverse_trivially_swappable_1_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_trivially_swappable_2_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_trivially_swappable_4_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_trivially_swappable_8_nid_postfix(void* first, void* last);
+void APS5_VABI __std_reverse_copy_trivially_copyable_1_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_reverse_copy_trivially_copyable_2_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_reverse_copy_trivially_copyable_4_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_reverse_copy_trivially_copyable_8_nid_postfix(const void* first, const void* last, void* destination);
+void APS5_VABI __std_swap_ranges_trivially_swappable_noalias_nid_postfix(void* first1, void* last1, void* first2);
+void APS5_VABI ignore_handler_s_nid_postfix(const char* message, void* pointer, int error);
+void* APS5_VABI set_constraint_handler_s_nid_postfix(void* handler);
+std::size_t APS5_VABI wcstombs_nid_postfix(char* destination, const std::uint16_t* source, std::size_t capacity);
+int APS5_VABI wcscpy_s_nid_postfix(std::uint16_t* dest, std::size_t size, const std::uint16_t* src);
+std::size_t APS5_VABI strerrorlen_s_nid_postfix(int error);
+int APS5_VABI strerror_s_nid_postfix(char* buffer, std::size_t capacity, int error);
+void APS5_VABI __cxa_vec_cleanup_nid_postfix(void* array, std::size_t count, std::size_t size, void (APS5_VABI *destroy)(void*));
+void APS5_VABI __cxa_vec_ctor_nid_postfix(void* array, std::size_t count, std::size_t size, void (APS5_VABI *construct)(void*), void (APS5_VABI *destroy)(void*));
+void APS5_VABI __cxa_vec_cctor_nid_postfix(void* destination, void* source, std::size_t count, std::size_t size, void (APS5_VABI *copy)(void*, void*), void (APS5_VABI *destroy)(void*));
+void APS5_VABI __cxa_vec_dtor_nid_postfix(void* array, std::size_t count, std::size_t size, void (APS5_VABI *destroy)(void*));
+void* APS5_VABI __cxa_vec_new_nid_postfix(std::size_t n, std::size_t s, std::size_t p, void (APS5_VABI *ctor)(void*), void (APS5_VABI *dtor)(void*));
+void* APS5_VABI __cxa_vec_new2_nid_postfix(std::size_t n, std::size_t s, std::size_t p, void (APS5_VABI *ctor)(void*), void (APS5_VABI *dtor)(void*), void* (APS5_VABI *alloc)(std::size_t), void (APS5_VABI *dealloc)(void*));
+void* APS5_VABI __cxa_vec_new3_nid_postfix(std::size_t n, std::size_t s, std::size_t p, void (APS5_VABI *ctor)(void*), void (APS5_VABI *dtor)(void*), void* (APS5_VABI *alloc)(std::size_t), void (APS5_VABI *dealloc)(void*, std::size_t));
+void APS5_VABI __cxa_vec_delete_nid_postfix(void* array, std::size_t s, std::size_t p, void (APS5_VABI *dtor)(void*));
+void APS5_VABI __cxa_vec_delete2_nid_postfix(void* array, std::size_t s, std::size_t p, void (APS5_VABI *dtor)(void*), void (APS5_VABI *dealloc)(void*));
+void APS5_VABI __cxa_vec_delete3_nid_postfix(void* array, std::size_t s, std::size_t p, void (APS5_VABI *dtor)(void*), void (APS5_VABI *dealloc)(void*, std::size_t));
+#ifndef _LIBCPP_VERSION
+void APS5_VABI _ZNSt13__future_base12_Result_baseD2Ev_nid_postfix(std::__future_base::_Result_base* self) noexcept;
+#endif
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptr9_M_addrefEv_nid_postfix(GuestExceptionPointer* self) noexcept;
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptr10_M_releaseEv_nid_postfix(GuestExceptionPointer* self) noexcept;
+void* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr6_M_getEv_nid_postfix(const GuestExceptionPointer* self) noexcept;
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC1EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept;
+void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC2EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept;
+const std::type_info* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr20__cxa_exception_typeEv_nid_postfix(const GuestExceptionPointer* self) noexcept;
+GuestExceptionPointer APS5_VABI _ZSt17current_exceptionv_nid_postfix() noexcept;
+int APS5_VABI __cxa_guard_acquire_nid_postfix(std::uint64_t* guardObject);
+void APS5_VABI __cxa_guard_release_nid_postfix(std::uint64_t* guardObject);
+void APS5_VABI __cxa_guard_abort_nid_postfix(std::uint64_t* guardObject);
+LibcException::Header* APS5_VABI __cxa_init_primary_exception_nid_postfix(void* object, std::type_info* type, void (*destructor)(void*));
+void* APS5_VABI __cxa_get_exception_ptr_nid_postfix(void* exception);
+std::type_info* APS5_VABI __cxa_current_exception_type_nid_postfix();
+void* APS5_VABI __cxa_get_globals_nid_postfix();
+void* APS5_VABI __cxa_get_globals_fast_nid_postfix();
+bool APS5_VABI __cxa_uncaught_exception_nid_postfix();
+unsigned APS5_VABI __cxa_uncaught_exceptions_nid_postfix();
+bool APS5_VABI _ZSt18uncaught_exceptionv_nid_postfix();
+int APS5_VABI _ZSt19uncaught_exceptionsv_nid_postfix();
+LibcTerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(LibcTerminateHandler handler);
+LibcTerminateHandler APS5_VABI _ZSt13get_terminatev_nid_postfix();
+void APS5_VABI __cxa_increment_exception_refcount_nid_postfix(void* object);
+void APS5_VABI __cxa_decrement_exception_refcount_nid_postfix(void* object);
+void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
+void* APS5_VABI __cxa_allocate_dependent_exception_nid_postfix();
+void APS5_VABI __cxa_free_dependent_exception_nid_postfix(void* storage);
+void APS5_VABI __cxa_rethrow_primary_exception_nid_postfix(void* object);
+void* APS5_VABI __dynamic_cast_nid_postfix(const void* source, const __cxxabiv1::__class_type_info* sourceType, const __cxxabiv1::__class_type_info* destinationType, std::ptrdiff_t);
+const char* APS5_VABI _ZSt13_Syserror_mapi_nid_postfix(int value);
+const LibcException::CategoryObject* APS5_VABI _ZSt16generic_categoryv_nid_postfix();
+const LibcException::CategoryObject* APS5_VABI _ZSt15system_categoryv_nid_postfix();
+GuestLocale::String* APS5_VABI _ZNKSt23_Generic_error_category7messageEi_nid_postfix( GuestLocale::String* result, const LibcException::CategoryObject* self, int value);
+void APS5_VABI _ZNSt9exceptionD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt9exception4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9exceptionC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt8bad_cast4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8bad_castC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt10bad_typeid4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt10bad_typeidC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt9bad_alloc4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt9bad_allocC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt20bad_array_new_length4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt20bad_array_new_lengthC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt17bad_function_call4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt17bad_function_callC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12bad_weak_ptrD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12bad_weak_ptrD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12bad_weak_ptrD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12bad_weak_ptr4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt19bad_optional_access4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessC1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt19bad_optional_accessC2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt11logic_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11logic_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt11logic_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt11logic_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt11logic_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt11logic_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13runtime_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13runtime_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13runtime_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt13runtime_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13runtime_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13runtime_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13runtime_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13runtime_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt13runtime_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt16invalid_argumentD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt16invalid_argumentD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt16invalid_argumentD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt16invalid_argument4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt16invalid_argumentC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt16invalid_argumentC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt16invalid_argumentC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt16invalid_argumentC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt16invalid_argumentaSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12out_of_rangeD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12out_of_rangeD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12out_of_rangeD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12out_of_range4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12out_of_rangeC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12out_of_rangeC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12out_of_rangeC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12out_of_rangeC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt12out_of_rangeaSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12domain_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12domain_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12domain_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12domain_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12domain_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12domain_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12domain_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12domain_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt12domain_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12length_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12length_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12length_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12length_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12length_errorC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12length_errorC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt12length_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12length_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt12length_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt12system_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12system_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12system_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt12system_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt12system_errorC1ERKS__nid_postfix(LibcException::SystemErrorObject* self, const LibcException::SystemErrorObject* source);
+void APS5_VABI _ZNSt12system_errorC2ERKS__nid_postfix(LibcException::SystemErrorObject* self, const LibcException::SystemErrorObject* source);
+LibcException::SystemErrorObject* APS5_VABI _ZNSt12system_erroraSERKS__nid_postfix(LibcException::SystemErrorObject* self, const LibcException::SystemErrorObject* source);
+void APS5_VABI _ZNSt11regex_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11regex_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11regex_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt11regex_error4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11regex_errorC1ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt11regex_errorC2ERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+LibcException::ExceptionObject* APS5_VABI _ZNSt11regex_erroraSERKS__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt11range_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11range_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt11range_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8ios_base7failureD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8ios_base7failureD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt8ios_base7failureD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt8ios_base7failure4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+_Unwind_Word APS5_VABI _Unwind_GetGR_nid_postfix(_Unwind_Context* context, int index);
+void APS5_VABI _Unwind_SetGR_nid_postfix(_Unwind_Context* context, int index, _Unwind_Word value);
+_Unwind_Ptr APS5_VABI _Unwind_GetIP_nid_postfix(_Unwind_Context* context);
+void APS5_VABI _Unwind_SetIP_nid_postfix(_Unwind_Context* context, _Unwind_Ptr value);
+_Unwind_Ptr APS5_VABI _Unwind_GetIPInfo_nid_postfix(_Unwind_Context* context, int* before);
+_Unwind_Word APS5_VABI _Unwind_GetCFA_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetLanguageSpecificData_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetRegionStart_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetDataRelBase_nid_postfix(_Unwind_Context* context);
+_Unwind_Ptr APS5_VABI _Unwind_GetTextRelBase_nid_postfix(_Unwind_Context* context);
+_Unwind_Reason_Code APS5_VABI _Unwind_ForcedUnwind_nid_postfix(_Unwind_Exception* exception, _Unwind_Stop_Fn stop, void* argument);
+_Unwind_Reason_Code APS5_VABI _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn trace, void* argument);
+int APS5_VABI dl_iterate_phdr_nid_postfix(int (*callback)(dl_phdr_info*, std::size_t, void*), void* data);
+
+[[noreturn]] void APS5_VABI _Exit_nid_postfix(int code);
+[[noreturn]] void APS5_VABI catchReturnFromMain_nid_postfix(int status);
+[[noreturn]] void APS5_VABI quick_exit_nid_postfix(int status);
+[[noreturn]] void APS5_VABI _ZSt14_Throw_C_errori_nid_postfix(int code);
+[[noreturn]] char* APS5_VABI fgetln_nid_postfix(FileStream*, std::size_t*);
+[[noreturn]] void APS5_VABI _Assert_nid_postfix(const char* message, const char* location);
+[[noreturn]] void APS5_VABI _ZSt16_Throw_Cpp_errori_nid_postfix(int code);
+[[noreturn]] void APS5_VABI _Thrd_exit_nid_postfix(int code);
+[[noreturn]] void APS5_VABI _ZSt17rethrow_exceptionNSt15__exception_ptr13exception_ptrE_nid_postfix(GuestExceptionPointerArgument exception);
+[[noreturn]] void APS5_VABI _ZSt9terminatev_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_call_terminate_nid_postfix(void* exception);
+[[noreturn]] void APS5_VABI __cxa_pure_virtual_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_deleted_virtual_nid_postfix();
+[[noreturn]] void APS5_VABI _ZNKSt9exception8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNKSt9exception6_RaiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNKSt11logic_error8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI __cxa_bad_cast_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_bad_typeid_nid_postfix();
+[[noreturn]] void APS5_VABI __cxa_throw_bad_array_new_length_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt11_Xbad_allocv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt14_Xout_of_rangePKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt14_Xlength_errorPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt18_Xinvalid_argumentPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt15_Xruntime_errorPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt13_Xrange_errorPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZSt19_Xbad_function_callv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt19_Throw_bad_weak_ptrv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt26__throw_bad_variant_accessv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt26_Throw_bad_optional_accessv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZSt13_Xregex_errorNSt15regex_constants10error_typeE_nid_postfix(std::regex_constants::error_type code);
+
+[[gnu::returns_twice]] int APS5_VABI setjmp_nid_postfix(std::uint64_t* buffer);
+[[noreturn]] void APS5_VABI longjmp_nid_postfix(std::uint64_t* buffer, int value);
+
+std::uint8_t APS5_VABI __atomic_load_1_nid_postfix(const volatile std::uint8_t* target, int);
+std::uint16_t APS5_VABI __atomic_load_2_nid_postfix(const volatile std::uint16_t* target, int);
+std::uint32_t APS5_VABI __atomic_load_4_nid_postfix(const volatile std::uint32_t* target, int);
+std::uint64_t APS5_VABI __atomic_load_8_nid_postfix(const volatile std::uint64_t* target, int);
+void APS5_VABI __atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+void APS5_VABI __atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+void APS5_VABI __atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+void APS5_VABI __atomic_store_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+int APS5_VABI __atomic_compare_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
+int APS5_VABI __atomic_compare_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
+int APS5_VABI __atomic_compare_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t* expected, std::uint32_t desired, int, int);
+int APS5_VABI __atomic_compare_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+std::uint8_t APS5_VABI __atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_add_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_sub_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_and_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_and_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_and_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_and_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_or_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_or_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_or_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_or_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+std::uint8_t APS5_VABI __atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
+std::uint16_t APS5_VABI __atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
+std::uint32_t APS5_VABI __atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int);
+std::uint64_t APS5_VABI __atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD0Ev_nid_postfix(LibcException::ExceptionObject* self);
+const char* APS5_VABI _ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(const LibcException::ExceptionObject* self);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xout_of_rangeEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v218_Xinvalid_argumentEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v215_Xruntime_errorEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Xoverflow_errorEPKc_nid_postfix(const char* message);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v211_Xbad_allocEv_nid_postfix();
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_19bad_optional_accessE_nid_postfix(const LibcException::ExceptionObject*);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12bad_weak_ptrE_nid_postfix(const LibcException::ExceptionObject*);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_18bad_variant_accessE_nid_postfix(const LibcException::ExceptionObject*);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_11range_errorE_nid_postfix(const LibcException::ExceptionObject* error);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12system_errorE_nid_postfix(const LibcException::SystemErrorObject* error);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v28ios_base6_ThrowERKNS0_7failureE_nid_postfix(const LibcException::SystemErrorObject* failure);
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix(int code);
+std::int64_t APS5_VABI _ZNSt8__sce_v216_Xtime_get_ticksEv_nid_postfix();
+const char* APS5_VABI _ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(int value);
+int APS5_VABI feupdateenv_nid_postfix(const GuestFloatingPointEnvironment* environment);
+int APS5_VABI feholdexcept_nid_postfix(GuestFloatingPointEnvironment* environment);
+void APS5_VABI srandomdev_nid_postfix();
+
+double APS5_VABI _Stodx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error);
+float APS5_VABI _Stofx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error);
+long double APS5_VABI _Stoldx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error);
+float APS5_VABI _Stof_nid_postfix(const char* text, char** end, std::int64_t pten);
+long double APS5_VABI _Stold_nid_postfix(const char* text, char** end, std::int64_t pten);
+long long APS5_VABI _Stollx_nid_postfix(const char* text, char** end, int base, int* error);
+unsigned long long APS5_VABI _Stoullx_nid_postfix(const char* text, char** end, int base, int* error);
+std::uint64_t APS5_VABI _Stoulx_nid_postfix(const char* text, char** end, int base, int* error);
+std::int64_t APS5_VABI _Stolx_nid_postfix(const char* text, char** end, int base, int* error);
+std::size_t APS5_VABI _ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+std::size_t APS5_VABI _ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+std::size_t APS5_VABI _ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+std::size_t APS5_VABI _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*);
+int APS5_VABI siginterrupt_nid_postfix(int guest, int flag);
+
+}
diff --git a/core/libs/prx/libc/include/ApplicationHeap.hpp b/core/libs/prx/libc/include/ApplicationHeap.hpp
index 00033a1d59..bd604dd95a 100644
--- a/core/libs/prx/libc/include/ApplicationHeap.hpp
+++ b/core/libs/prx/libc/include/ApplicationHeap.hpp
@@ -9,6 +9,7 @@ const void* ApplicationProcessParameters_nid_no_patch();
 bool ApplicationGuestHeapApi_nid_no_patch(void** api);
 void ApplicationHeapInitialize_nid_no_patch(const void* processParameters);
 void ApplicationHeapRegister_nid_no_patch(void* const* api);
+bool ApplicationHeapDefault_nid_no_patch();
 void* ApplicationHeapAllocate_nid_no_patch(std::size_t bytes);
 void ApplicationHeapFree_nid_no_patch(void* pointer);
 void* ApplicationHeapReallocate_nid_no_patch(void* pointer, std::size_t bytes);
diff --git a/core/libs/prx/libc/include/FileStream.hpp b/core/libs/prx/libc/include/FileStream.hpp
index 7a81d29f07..73140da0c7 100644
--- a/core/libs/prx/libc/include/FileStream.hpp
+++ b/core/libs/prx/libc/include/FileStream.hpp
@@ -17,6 +17,7 @@
 #include "prx/libc/include/FileLock.hpp"
 extern "C" void* HostStandardHandle_nid_no_patch(int descriptor);
 extern "C" void KeepStandardHandle_nid_no_patch(int descriptor, void* handle);
+extern "C" void PrepareStandardStreams_nid_no_patch();
 struct UcrtStreamState {
     char* pointer;
     char* base;
@@ -73,6 +74,9 @@ class FileStream {
 public:
     explicit FileStream(std::FILE* handle, bool dynamic = false) : _handle(handle), _dynamic(dynamic) {
         if (!_handle) throw std::runtime_error("FileStream: null handle");
+#ifdef _WIN32
+        PrepareStandardStreams_nid_no_patch();
+#endif
         _guest.flags = handle == stdin ? 4 : handle == stdout || handle == stderr ? 8 : 0x10;
 #ifdef _WIN32
         const int descriptor = _fileno(handle);
@@ -212,27 +216,29 @@ public:
         _guest.descriptor = descriptor >= 0 && descriptor <= 32767 ? static_cast<std::int16_t>(descriptor) : -1;
         return true;
     }
+    void PublishStatus(bool endOfFile, bool error) {
+        __atomic_store_n(&_guest.readRemaining, 0, __ATOMIC_RELAXED);
+        __atomic_store_n(&_guest.writeRemaining, 0, __ATOMIC_RELAXED);
+        auto old = __atomic_load_n(&_guest.flags, __ATOMIC_RELAXED);
+        std::int16_t next;
+        do next = static_cast<std::int16_t>((old & ~0x60) | (endOfFile ? 0x20 : 0) | (error ? 0x40 : 0));
+        while (!__atomic_compare_exchange_n(&_guest.flags, &old, next, false, __ATOMIC_RELAXED, __ATOMIC_RELAXED));
+    }
     void SyncStatus() {
         if (!_handle) return;
-        _guest.readRemaining = 0;
-        _guest.writeRemaining = 0;
-        _guest.flags = static_cast<std::int16_t>((_guest.flags & ~0x60) |
-            (std::feof(GetHandle()) ? 0x20 : 0) | (std::ferror(GetHandle()) || guestError ? 0x40 : 0));
+        PublishStatus(std::feof(GetHandle()) != 0, std::ferror(GetHandle()) != 0 || guestError);
     }
 
     void SyncUnlockedStatus() {
         if (!_handle) return;
-        _guest.readRemaining = 0;
-        _guest.writeRemaining = 0;
 #ifdef _WIN32
         const bool endOfFile = std::feof(GetHandle()) != 0;
         const bool error = std::ferror(GetHandle()) != 0;
 #else
-        const bool endOfFile = ::feof_unlocked(GetHandle()) != 0;
-        const bool error = ::ferror_unlocked(GetHandle()) != 0;
+        const bool endOfFile = feof_unlocked(GetHandle()) != 0;
+        const bool error = ferror_unlocked(GetHandle()) != 0;
 #endif
-        _guest.flags = static_cast<std::int16_t>((_guest.flags & ~0x60) |
-            (endOfFile ? 0x20 : 0) | (error || guestError ? 0x40 : 0));
+        PublishStatus(endOfFile, error || guestError);
     }
 
     bool SwitchToReading() {
diff --git a/core/libs/prx/libc/include/General.hpp b/core/libs/prx/libc/include/General.hpp
index f22c2e8556..b45386ab48 100644
--- a/core/libs/prx/libc/include/General.hpp
+++ b/core/libs/prx/libc/include/General.hpp
@@ -16,10 +16,10 @@ extern "C" [[noreturn]] void NotImplemented_nid_no_patch(const char* funcName);
 extern "C" void CxaFinalize_nid_no_patch(void* dsoHandle);
 extern "C" bool StopAtPrefixLetter_nid_no_patch(const char* str, char** endptr, int base);
 extern "C" bool RejectIntegerBase_nid_no_patch(const char* str, char** endptr, int base, bool setError);
-#ifndef _WIN32
 extern "C" int KeepHostStandardError_nid_no_patch();
-extern "C" int HostStandardError_nid_no_patch();
 extern "C" int KeepHostStandardOutput_nid_no_patch();
+#ifndef _WIN32
+extern "C" int HostStandardError_nid_no_patch();
 #else
 extern "C" bool AdoptHostStandardStream_nid_no_patch(int standard, int saved);
 extern "C" std::FILE* HostStandardOutputFile_nid_no_patch();
@@ -70,6 +70,28 @@ struct ThreadForwards_nid_no_patch {
     void (APS5_VABI* exit)(void*);
 };
 extern "C" void RegisterThreadForwards_nid_no_patch(const ThreadForwards_nid_no_patch* forwards);
+struct PthreadSyncForwards_nid_no_patch {
+    int (APS5_VABI* mutexattrInit)(void**);
+    int (APS5_VABI* mutexattrSettype)(void**, int);
+    int (APS5_VABI* mutexattrDestroy)(void**);
+    int (APS5_VABI* mutexInit)(void**, void* const*, const char*);
+    int (APS5_VABI* mutexDestroy)(void**);
+    int (APS5_VABI* mutexLock)(void**);
+    int (APS5_VABI* mutexTrylock)(void**);
+    int (APS5_VABI* mutexUnlock)(void**);
+    int (APS5_VABI* condInit)(void**, void* const*, const char*);
+    int (APS5_VABI* condDestroy)(void**);
+    int (APS5_VABI* condWait)(void**, void**);
+    int (APS5_VABI* condSignal)(void**);
+    int (APS5_VABI* condBroadcast)(void**);
+    int (APS5_VABI* detach)(void*);
+    int (APS5_VABI* join)(void*, void**);
+    void (APS5_VABI* yield)();
+};
+extern "C" void RegisterPthreadSyncForwards_nid_no_patch(const PthreadSyncForwards_nid_no_patch* forwards);
+
+using SigactionFn_nid_no_patch = int (APS5_VABI*)(int, const void*, void*);
+extern "C" void RegisterSigaction_nid_no_patch(SigactionFn_nid_no_patch fn, std::uint32_t* interruptSet);
 
 #define APS5_INVALID_ARG_EX throw std::invalid_argument(std::string(__func__) + ": invalid argument")
 
diff --git a/core/libs/prx/libc/include/GuestAllocations.hpp b/core/libs/prx/libc/include/GuestAllocations.hpp
index 7811725142..c94fd68bd1 100644
--- a/core/libs/prx/libc/include/GuestAllocations.hpp
+++ b/core/libs/prx/libc/include/GuestAllocations.hpp
@@ -40,6 +40,7 @@ public:
     const value_type& front() const { return held().front(); }
     const value_type& back() const { return held().back(); }
     void clear() { ranges.reset(); }
+    const std::shared_ptr<const Ranges>& Snapshot() const { return ranges; }
 
 private:
     const Ranges& held() const {
diff --git a/core/libs/prx/libc/include/GuestArena.hpp b/core/libs/prx/libc/include/GuestArena.hpp
index bf0d756d40..49719e365b 100644
--- a/core/libs/prx/libc/include/GuestArena.hpp
+++ b/core/libs/prx/libc/include/GuestArena.hpp
@@ -55,6 +55,10 @@ void GuestArenaMapFile_nid_postfix(void* pointer, std::size_t bytes, void* secti
 void* GuestArenaMapAlias_nid_postfix(std::uintptr_t address, std::size_t bytes);
 void GuestArenaUnmapAlias_nid_postfix(void* alias);
 bool GuestArenaResidentSpan_nid_postfix(std::uintptr_t address, std::size_t bytes, std::uintptr_t* start, std::uintptr_t* end);
+void GuestArenaCompareWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes);
+void GuestArenaCompareResidentWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes);
+void GuestArenaComparedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count);
+void GuestArenaTakeUnreportedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count);
 void GuestArenaForgetSection_nid_postfix(void* section);
 bool GuestArenaBeginHostImport_nid_no_patch(void* pointer, std::size_t bytes);
 void GuestArenaEndHostImport_nid_no_patch(void* pointer, std::size_t bytes);
diff --git a/core/libs/prx/libc/include/GuestLocale.hpp b/core/libs/prx/libc/include/GuestLocale.hpp
index 45e29df3f1..92ca9f13b8 100644
--- a/core/libs/prx/libc/include/GuestLocale.hpp
+++ b/core/libs/prx/libc/include/GuestLocale.hpp
@@ -58,6 +58,40 @@ struct CollateVtable {
     std::int64_t (APS5_VABI *hash)(const CollateFacet* self, const char* first, const char* last);
 };
 
+struct CodecvtVtable {
+    FacetVtable facet;
+    bool (APS5_VABI *alwaysNoconv)(const Facet* self);
+    int (APS5_VABI *maxLength)(const Facet* self);
+    int (APS5_VABI *encoding)(const Facet* self);
+    int (APS5_VABI *in)(Facet* self, std::uint64_t* state, const char* first1, const char* last1, const char** next1, char* first3, char* last3, char** next3);
+    int (APS5_VABI *out)(Facet* self, std::uint64_t* state, const char* first1, const char* last1, const char** next1, char* first3, char* last3, char** next3);
+    int (APS5_VABI *unshift)(Facet* self, std::uint64_t* state, char* first3, char* last3, char** next3);
+    std::size_t (APS5_VABI *length)(Facet* self, std::uint64_t* state, const char* first1, const char* last1, std::size_t count);
+};
+
+struct NumpunctFacet {
+    Facet base;
+    const char* grouping;
+    char decimalPoint;
+    char thousandsSep;
+    const char* falsename;
+    const char* truename;
+};
+
+struct NumpunctVtable {
+    FacetVtable facet;
+    char (APS5_VABI *decimalPoint)(const NumpunctFacet* self);
+    char (APS5_VABI *thousandsSep)(const NumpunctFacet* self);
+    String* (APS5_VABI *grouping)(String* result, const NumpunctFacet* self);
+    String* (APS5_VABI *falsename)(String* result, const NumpunctFacet* self);
+    String* (APS5_VABI *truename)(String* result, const NumpunctFacet* self);
+};
+
+struct UnsupportedMethodsVtable {
+    FacetVtable facet;
+    void (APS5_VABI *methods[8])();
+};
+
 struct IosBase {
     const void* vtable;
     std::int64_t standardStream;
@@ -89,6 +123,16 @@ static_assert(offsetof(CollateFacet, collation) == 0x10);
 static_assert(sizeof(CollateFacet) == 0x20);
 static_assert(offsetof(CollateVtable, compare) == 0x20);
 static_assert(offsetof(CollateVtable, hash) == 0x30);
+static_assert(offsetof(CodecvtVtable, alwaysNoconv) == 0x20);
+static_assert(offsetof(CodecvtVtable, in) == 0x38);
+static_assert(offsetof(CodecvtVtable, length) == 0x50);
+static_assert(sizeof(NumpunctFacet) == 0x30);
+static_assert(offsetof(NumpunctFacet, grouping) == 0x10);
+static_assert(offsetof(NumpunctFacet, decimalPoint) == 0x18);
+static_assert(offsetof(NumpunctFacet, falsename) == 0x20);
+static_assert(offsetof(NumpunctFacet, truename) == 0x28);
+static_assert(offsetof(NumpunctVtable, decimalPoint) == 0x20);
+static_assert(offsetof(NumpunctVtable, truename) == 0x40);
 static_assert(alignof(LocinfoStorage) == 8);
 
 }
diff --git a/core/libs/prx/libc/include/HostThreadSlot.hpp b/core/libs/prx/libc/include/HostThreadSlot.hpp
new file mode 100644
index 0000000000..39e0e0804d
--- /dev/null
+++ b/core/libs/prx/libc/include/HostThreadSlot.hpp
@@ -0,0 +1,79 @@
+#ifndef CORE_LIBS_PRX_LIBC_INCLUDE_HOSTTHREADSLOT_HPP
+#define CORE_LIBS_PRX_LIBC_INCLUDE_HOSTTHREADSLOT_HPP
+
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <type_traits>
+
+#if defined(_WIN32) && defined(__x86_64__) && defined(__GNUC__)
+#define HOST_THREAD_SLOT_TEB 1
+#include <processthreadsapi.h>
+#endif
+
+template<typename TValue, typename TTag>
+class HostThreadSlot {
+    static_assert(std::is_trivially_copyable_v<TValue> && sizeof(TValue) <= sizeof(std::uintptr_t));
+
+public:
+    static TValue Get() noexcept {
+        const auto bits = load();
+        TValue value;
+        std::memcpy(&value, &bits, sizeof(TValue));
+        return value;
+    }
+
+    static void Set(TValue value) noexcept {
+        std::uintptr_t bits = 0;
+        std::memcpy(&bits, &value, sizeof(TValue));
+        store(bits);
+    }
+
+private:
+#ifdef HOST_THREAD_SLOT_TEB
+    static constexpr unsigned long DirectSlots = 64;
+    static constexpr std::uintptr_t DirectSlotsOffset = 0x1480;
+    static constexpr std::uintptr_t ExpansionSlotsOffset = 0x1780;
+
+    static unsigned long index() noexcept {
+        static const unsigned long allocated = [] {
+            const auto value = TlsAlloc();
+            if (value == 0xffffffffu) std::abort();
+            return value;
+        }();
+        return allocated;
+    }
+
+    static std::uintptr_t readTeb(std::uintptr_t offset) noexcept {
+        std::uintptr_t value;
+        __asm__ __volatile__("movq %%gs:(%1), %0" : "=r"(value) : "r"(offset));
+        return value;
+    }
+
+    static std::uintptr_t load() noexcept {
+        const auto slot = index();
+        if (slot < DirectSlots) return readTeb(DirectSlotsOffset + slot * sizeof(void*));
+        const auto* expansion = reinterpret_cast<const std::uintptr_t*>(readTeb(ExpansionSlotsOffset));
+        return expansion != nullptr ? expansion[slot - DirectSlots] : 0;
+    }
+
+    static void store(std::uintptr_t bits) noexcept {
+        const auto slot = index();
+        if (slot < DirectSlots) {
+            __asm__ __volatile__("movq %0, %%gs:(%1)" : : "r"(bits), "r"(DirectSlotsOffset + slot * sizeof(void*)) : "memory");
+        } else if (!TlsSetValue(slot, reinterpret_cast<void*>(bits))) {
+            std::abort();
+        }
+    }
+#else
+    static std::uintptr_t& bitsOfThread() noexcept {
+        static thread_local std::uintptr_t bits = 0;
+        return bits;
+    }
+
+    static std::uintptr_t load() noexcept { return bitsOfThread(); }
+    static void store(std::uintptr_t bits) noexcept { bitsOfThread() = bits; }
+#endif
+};
+
+#endif
diff --git a/core/libs/prx/libc/include/RenameDot.hpp b/core/libs/prx/libc/include/RenameDot.hpp
index 4364a80d39..a792ac7f32 100644
--- a/core/libs/prx/libc/include/RenameDot.hpp
+++ b/core/libs/prx/libc/include/RenameDot.hpp
@@ -5,6 +5,13 @@
 #include <string>
 #include "FilesystemError.hpp"
 
+inline std::string TrimTrailingSeparators_nid_no_patch(std::string path) {
+    const auto separator = [](char character) { return character == '/' || character == '\\'; };
+    const std::size_t root = std::filesystem::path(path).root_path().native().size();
+    while (path.size() > root && path.size() > 1 && separator(path.back())) path.pop_back();
+    return path;
+}
+
 inline int RenameDotError_nid_no_patch(const char* path) {
     std::size_t length = std::char_traits<char>::length(path);
     const auto separator = [](char character) { return character == '/' || character == '\\'; };
@@ -15,7 +22,7 @@ inline int RenameDotError_nid_no_patch(const char* path) {
     const bool dot = name == 1 && path[start] == '.';
     const bool dotDot = name == 2 && path[start] == '.' && path[start + 1] == '.';
     if (!dot && !dotDot) return 0;
-    const std::string parent = start == 0 ? std::string(".") : std::string(path, start);
+    const std::string parent = start == 0 ? std::string(".") : TrimTrailingSeparators_nid_no_patch(std::string(path, start));
     std::filesystem::path resolved;
     if (const int error = ResolvePathError_nid_no_patch(parent.c_str(), resolved)) return error;
     std::error_code status;
diff --git a/core/libs/prx/libc/include/SonyCrt.hpp b/core/libs/prx/libc/include/SonyCrt.hpp
index cf1879e2c0..db53cd3d54 100644
--- a/core/libs/prx/libc/include/SonyCrt.hpp
+++ b/core/libs/prx/libc/include/SonyCrt.hpp
@@ -138,20 +138,38 @@ inline void* SonySetConstraintHandlerS(void* handler) {
 }
 
 inline int SonyWcscpyS(std::uint16_t* dest, std::size_t size, const std::uint16_t* src) {
-    if (!dest || !src || size == 0) {
-        SonyInvokeConstraintHandler("wcscpy_s", dest, EINVAL);
-        return EINVAL;
+    constexpr int GuestEinval = 22;
+    constexpr int GuestErange = 34;
+    constexpr std::size_t rsizeMax = (SIZE_MAX >> 1) / sizeof(std::uint16_t);
+    if (!dest || size == 0) {
+        SonyInvokeConstraintHandler("wcscpy_s", dest, GuestEinval);
+        return GuestEinval;
     }
-    std::size_t i = 0;
-    while (i + 1 < size && src[i] != 0) {
-        dest[i] = src[i];
-        ++i;
+    if (size > rsizeMax) {
+        SonyInvokeConstraintHandler("wcscpy_s", dest, GuestErange);
+        return GuestErange;
     }
-    dest[i] = 0;
-    if (src[i] != 0) {
-        SonyInvokeConstraintHandler("wcscpy_s", dest, ERANGE);
-        return ERANGE;
+    if (!src) {
+        dest[0] = 0;
+        SonyInvokeConstraintHandler("wcscpy_s", dest, GuestEinval);
+        return GuestEinval;
     }
+    std::size_t length = 0;
+    while (length < size && src[length] != 0) ++length;
+    if (length >= size) {
+        dest[0] = 0;
+        SonyInvokeConstraintHandler("wcscpy_s", dest, GuestErange);
+        return GuestErange;
+    }
+    const auto destination = reinterpret_cast<std::uintptr_t>(dest);
+    const auto source = reinterpret_cast<std::uintptr_t>(src);
+    const auto distance = destination < source ? source - destination : destination - source;
+    if (length != 0 && distance < (length + 1) * sizeof(std::uint16_t)) {
+        dest[0] = 0;
+        SonyInvokeConstraintHandler("wcscpy_s", dest, GuestEinval);
+        return GuestEinval;
+    }
+    std::memcpy(dest, src, (length + 1) * sizeof(std::uint16_t));
     return 0;
 }
 
diff --git a/core/libs/prx/libc/include/WindowsFormatting.hpp b/core/libs/prx/libc/include/WindowsFormatting.hpp
index 0c8dd2861f..f0ee4f771d 100644
--- a/core/libs/prx/libc/include/WindowsFormatting.hpp
+++ b/core/libs/prx/libc/include/WindowsFormatting.hpp
@@ -15,7 +15,6 @@
 #include <vector>
 #include <type_traits>
 
-extern "C" int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length);
 extern "C" std::FILE* GuestStandardOutputFile_nid_no_patch();
 
 namespace LibcDetail {
@@ -161,7 +160,7 @@ inline void AppendUtf8(std::string& utf8, char32_t code) {
     }
 }
 
-inline std::string NanSpec(const std::string& spec) {
+inline std::string PaddedStringSpec(const std::string& spec) {
     std::string result = "%";
     std::size_t index = 1;
     for (; index < spec.size() && std::strchr("-+ #0", spec[index]); ++index)
@@ -170,6 +169,14 @@ inline std::string NanSpec(const std::string& spec) {
     return result + 's';
 }
 
+inline std::string NanText(const std::string& spec, bool negative, bool upper) {
+    std::string sign;
+    if (negative) sign = "-";
+    else if (spec.find('+') != std::string::npos) sign = "+";
+    else if (spec.find(' ') != std::string::npos) sign = " ";
+    return sign + (upper ? "NAN" : "nan");
+}
+
 inline std::string FormatPointer(const std::string& spec, const void* pointer) {
     std::size_t index = 1;
     bool left = false;
@@ -205,7 +212,8 @@ inline std::string FormatPointer(const std::string& spec, const void* pointer) {
     return std::string(padding, ' ') + digits;
 }
 
-constexpr size_t maximumArgumentPosition = 99;
+inline constexpr char KnownConversions[] = "diouxXeEfFgGaAcCsSpn";
+constexpr size_t maximumArgumentPosition = 65535;
 
 inline size_t ArgumentPosition(const char*& format) {
     const char* end = format;
@@ -214,7 +222,8 @@ inline size_t ArgumentPosition(const char*& format) {
     size_t position = 0;
     for (const char* digit = format; digit != end && position <= maximumArgumentPosition; ++digit)
         position = position * 10 + static_cast<size_t>(*digit - '0');
-    if (position == 0 || position > maximumArgumentPosition) throw std::invalid_argument("Format argument position out of range");
+    if (position == 0) return 0;
+    if (position > maximumArgumentPosition) throw std::invalid_argument("Format argument position out of range");
     format = end + 1;
     return position;
 }
@@ -258,7 +267,6 @@ inline std::vector<ArgumentClass> NumberedArgumentClasses(const char* format) {
 
 inline int FormatWindows(char* buffer, size_t size, const char* format, const void* source, std::string* complete = nullptr, bool secure = false) {
     if (!format || !source) throw std::invalid_argument("Null formatting argument");
-    const int savedError = errno;
     const char* const formatStart = format;
     FormatArguments args(source);
     args.Number(NumberedArgumentClasses(format));
@@ -279,16 +287,24 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
         }
         if (const size_t position = ArgumentPosition(format)) args.Seek(position);
         std::string spec = "%";
-        for (; *format && std::strchr("-+ #0'", *format); ++format)
+        bool unmeasuredUnknownFlag = false;
+        bool zeroFlag = false;
+        for (; *format && std::strchr("-+ #0'", *format); ++format) {
             if (*format != '\'') spec += *format;
+            if (std::strchr("+ '", *format)) unmeasuredUnknownFlag = true;
+            if (*format == '0') zeroFlag = true;
+        }
+        bool widthGiven = false;
         if (*format == '*') {
             ++format;
             const int width = star();
             if (width < 0) spec += '-';
             spec += std::to_string(width < 0 ? -static_cast<long long>(width) : width);
+            widthGiven = true;
         } else {
-            while (*format >= '0' && *format <= '9') spec += *format++;
+            for (; *format >= '0' && *format <= '9'; widthGiven = true) spec += *format++;
         }
+        if (zeroFlag && widthGiven) unmeasuredUnknownFlag = true;
         size_t precisionLimit = std::numeric_limits<size_t>::max();
         if (*format == '.') {
             ++format;
@@ -319,6 +335,13 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
         const char conversion = *format;
         if (!conversion) throw std::invalid_argument("Incomplete format conversion");
         ++format;
+        if (!std::strchr(KnownConversions, conversion)) {
+            if (secure || unmeasuredUnknownFlag)
+                throw std::invalid_argument("Unsupported format conversion '" + spec + length + conversion + "' in \"" + std::string(formatStart).substr(0, 160) + "\"");
+            const char text[] = {'%', conversion, '\0'};
+            output.Value(PaddedStringSpec(spec), conversion == '%' ? "%" : text);
+            continue;
+        }
         const bool integerLength = length.empty() || length == "h" || length == "hh" ||
             length == "l" || length == "ll" || length == "j" || length == "z" || length == "t";
         if (conversion == 'd' || conversion == 'i') {
@@ -346,17 +369,16 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
                 spec = spec.substr(0, spec.find('.')) + ".1";
             output.Value(spec + "ll" + conversion, value);
         } else if (std::strchr("aAeEfFgG", conversion)) {
-            const char* nan = conversion >= 'a' ? "nan" : "NAN";
             if (length == "L") {
                 static_assert(sizeof(long double) == 16);
                 static_assert(std::numeric_limits<long double>::digits == 64);
                 const long double value = args.Next<long double>();
-                if (std::isnan(value)) output.Value(NanSpec(spec), nan);
+                if (std::isnan(value)) output.Value(PaddedStringSpec(spec), NanText(spec, std::signbit(value), conversion < 'a').c_str());
                 else output.Value(spec + "L" + conversion, value);
             } else {
                 if (!length.empty() && length != "l") throw std::invalid_argument("Invalid floating length");
                 const double value = args.Next<double>();
-                if (std::isnan(value)) output.Value(NanSpec(spec), nan);
+                if (std::isnan(value)) output.Value(PaddedStringSpec(spec), NanText(spec, std::signbit(value), conversion < 'a').c_str());
                 else output.Value(spec + conversion, value);
             }
         } else if (conversion == 'c' && (length.empty() || length == "h")) {
@@ -377,8 +399,7 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
             if (!value) value = u"(null)";
             std::string utf8;
             while (utf8.size() < precisionLimit && *value) {
-                char32_t code = *value++;
-                if (code >= 0xd800 && code < 0xdc00 && *value >= 0xdc00 && *value < 0xe000) code = 0x10000 + ((code - 0xd800) << 10) + (*value++ - 0xdc00);
+                const char32_t code = *value++;
                 const auto previousSize = utf8.size();
                 AppendUtf8(utf8, code);
                 if (utf8.size() > precisionLimit) {
@@ -390,10 +411,6 @@ inline int FormatWindows(char* buffer, size_t size, const char* format, const vo
         } else if (conversion == 'p' && (length.empty() || length == "l")) {
             const std::string text = FormatPointer(spec, args.Next<void*>());
             output.Append(text.data(), text.size());
-        } else if (conversion == 'm') {
-            char message[128];
-            strerror_r_nid_postfix(savedError, message, sizeof(message));
-            output.Value(spec + 's', static_cast<const char*>(message));
         } else if (conversion == 'n' && secure) {
             throw FormatConstraintViolation("Format count conversion");
         } else if (conversion == 'n' && integerLength && spec == "%") {
diff --git a/core/libs/prx/libc/include/WindowsMappings.hpp b/core/libs/prx/libc/include/WindowsMappings.hpp
index 624685e8a9..9e348301a8 100644
--- a/core/libs/prx/libc/include/WindowsMappings.hpp
+++ b/core/libs/prx/libc/include/WindowsMappings.hpp
@@ -5,6 +5,9 @@
 #include <windows.h>
 #include <algorithm>
 #include <array>
+#ifdef APS5_COUNT_MAPPING_QUERIES
+#include <atomic>
+#endif
 #include <cstdio>
 #include <cstddef>
 #include <cstdint>
@@ -28,18 +31,48 @@ public:
         return *mappings;
     }
 
+#ifdef APS5_COUNT_MAPPING_QUERIES
+    static std::uint64_t MemoryQueries() {
+        return queries.load(std::memory_order_relaxed);
+    }
+#endif
+
     void* Reserve(void* address, std::size_t bytes) {
         return allocate(GetCurrentProcess(), address, bytes, MEM_RESERVE | MEM_RESERVE_PLACEHOLDER, PAGE_NOACCESS, nullptr, 0);
     }
 
     std::vector<std::pair<std::uintptr_t, std::size_t>> Commit(void* address, std::size_t bytes, DWORD protection, std::size_t granule, bool watched) {
+        if (granule == 0) throw std::invalid_argument("guest memory commit granule is zero");
         std::vector<std::pair<std::uintptr_t, std::size_t>> created;
         std::lock_guard lock(mutex);
         collectableRanges.clear();
+        const DWORD flags = MEM_RESERVE | MEM_COMMIT | MEM_REPLACE_PLACEHOLDER | (watched ? MEM_WRITE_WATCH : 0);
+        const auto cut = [](std::uintptr_t at, std::size_t size, const char* operation) {
+            if (!VirtualFree(reinterpret_cast<void*>(at), size, MEM_RELEASE | MEM_PRESERVE_PLACEHOLDER)) fail(operation);
+        };
+        const auto replace = [&](std::uintptr_t at, std::size_t size) {
+            if (!allocate(GetCurrentProcess(), reinterpret_cast<void*>(at), size, flags, protection, nullptr, 0)) fail("replace guest placeholder with private memory");
+            if (!created.empty() && created.back().first + created.back().second == at) created.back().second += size;
+            else created.emplace_back(at, size);
+        };
         const auto end = reinterpret_cast<std::uintptr_t>(address) + bytes;
         for (auto cursor = reinterpret_cast<std::uintptr_t>(address); cursor < end;) {
             const auto memory = query(cursor);
-            const auto stop = std::min(end, reinterpret_cast<std::uintptr_t>(memory.BaseAddress) + memory.RegionSize);
+            const auto regionEnd = reinterpret_cast<std::uintptr_t>(memory.BaseAddress) + memory.RegionSize;
+            const auto stop = std::min(end, regionEnd);
+            if (memory.State == MEM_RESERVE && std::min(end, cursor + granule) <= regionEnd) {
+                forgetClean(cursor, stop);
+                const auto holder = reinterpret_cast<std::uintptr_t>(memory.AllocationBase);
+                if (holder != cursor) cut(holder, cursor - holder, "split guest placeholder prefix");
+                if (stop != regionEnd) cut(cursor, stop - cursor, "split guest placeholder suffix");
+                while (cursor < stop && std::min(end, cursor + granule) <= stop) {
+                    const auto size = std::min(end, cursor + granule) - cursor;
+                    if (cursor + size != stop) cut(cursor, size, "split guest placeholder suffix");
+                    replace(cursor, size);
+                    cursor += size;
+                }
+                continue;
+            }
             if (memory.State == MEM_RESERVE) {
                 const auto limit = std::min(end, cursor + granule);
                 auto placeholderEnd = stop;
@@ -50,10 +83,7 @@ public:
                 }
                 const auto size = std::min(limit, placeholderEnd) - cursor;
                 reset(cursor, size);
-                const DWORD flags = MEM_RESERVE | MEM_COMMIT | MEM_REPLACE_PLACEHOLDER | (watched ? MEM_WRITE_WATCH : 0);
-                if (!allocate(GetCurrentProcess(), reinterpret_cast<void*>(cursor), size, flags, protection, nullptr, 0)) fail("replace guest placeholder with private memory");
-                if (!created.empty() && created.back().first + created.back().second == cursor) created.back().second += size;
-                else created.emplace_back(cursor, size);
+                replace(cursor, size);
                 cursor += size;
             } else {
                 if (memory.State != MEM_COMMIT) throw std::runtime_error("guest memory is not committed");
@@ -96,6 +126,7 @@ public:
             auto shared = slot.page.lock();
             if (!shared) {
                 shared = std::make_shared<SharedPage>();
+                shared->comparedWhenShared = slot.comparedWhenShared;
                 slot.page = shared;
             }
             return shared;
@@ -139,13 +170,15 @@ public:
             const auto aliases = shared->aliases;
             for (const auto alias : aliases) {
                 if (views.at(alias).resident) demote(alias);
+                views.at(alias).aliasDemoted = false;
             }
             const auto viewBytes = std::min(pageBytes, sectionBytes - done);
             split(base, pageBytes);
             mapShared(base, section, offset + done, protection, viewProtection, viewBytes);
             slot->stored = true;
             shared->aliases.push_back(base);
-            views.emplace(base, View{shared, protection, {}, 0, owned, offset + done, 0, 0, false, slot, hostPages(viewBytes)});
+            const auto created = views.emplace(base, View{shared, protection, {}, 0, owned, offset + done, 0, 0, false, slot, hostPages(viewBytes)}).first;
+            if (shared->comparedWhenShared) created->second.unreported = allSubpages;
             remember(freshRanges, base, base + pageBytes);
             invalidate(*shared);
             done += pageBytes;
@@ -186,6 +219,45 @@ public:
         }
     }
 
+    void CompareWhenShared(std::uintptr_t address, std::size_t bytes, bool residentOnly = false) {
+        std::lock_guard lock(mutex);
+        collectableRanges.clear();
+        for (auto it = views.lower_bound(address & ~(pageBytes - 1)); it != views.end() && it->first < address + bytes; ++it) {
+            if (residentOnly && !it->second.resident && !it->second.aliasDemoted) continue;
+            auto& page = *it->second.page;
+            const bool marked = page.comparedWhenShared;
+            page.comparedWhenShared = true;
+            it->second.slot->comparedWhenShared = true;
+            for (const auto alias : page.aliases) {
+                auto& view = views.at(alias);
+                if (view.resident) continue;
+                if (!marked) view.unreported = allSubpages;
+                if (view.armed == 0) continue;
+                protectSubpages(alias, view.armed, view.protection, "stop arming a compared shared page", view.viewBytes);
+                view.armed = 0;
+            }
+        }
+    }
+
+    void ComparedPages(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count, bool unreported) {
+        std::lock_guard lock(mutex);
+        const auto capacity = *count;
+        *count = 0;
+        const auto end = address + bytes;
+        for (auto it = views.lower_bound(address & ~(pageBytes - 1)); it != views.end() && it->first < end; ++it) {
+            auto& view = it->second;
+            if (view.resident || !view.page->comparedWhenShared) continue;
+            const auto listed = static_cast<std::uint8_t>(subpagesOf(it->first, address, end) & (unreported ? view.unreported : allSubpages));
+            for (std::size_t sub = 0; sub < subpages; ++sub) {
+                const auto bit = static_cast<std::uint8_t>(1u << sub);
+                if ((listed & bit) == 0) continue;
+                if (*count == capacity) return;
+                pages[(*count)++] = reinterpret_cast<void*>(it->first + sub * subpageBytes);
+                if (unreported) view.unreported &= static_cast<std::uint8_t>(~bit);
+            }
+        }
+    }
+
     bool HandleWrite(std::uintptr_t address) {
         std::lock_guard lock(mutex);
         const auto base = address & ~(pageBytes - 1);
@@ -286,7 +358,7 @@ public:
         }
         for (std::size_t done = 0; done < bytes; done += pageBytes) {
             const auto found = views.find(address + done);
-            if (found != views.end() && found->second.resident) demote(address + done);
+            if (found != views.end() && found->second.resident) demote(address + done, true);
         }
         auto view = views.find(address);
         if (view == views.end()) throw refuse("the range does not start at a shared view");
@@ -350,6 +422,7 @@ public:
                     if (!watchResident) return false;
                     continue;
                 }
+                if (it->second.page->comparedWhenShared) return false;
                 if (it->second.protection != PAGE_NOACCESS) continue;
                 for (auto at = std::max(address, it->first); at < std::min(end, it->first + pageBytes); at += 4096) {
                     if ((it->second.collected & (1u << ((at - it->first) / 4096))) == 0) return false;
@@ -496,7 +569,7 @@ private:
         for (auto cursor = address; cursor < end;) {
             const auto base = cursor & ~(pageBytes - 1);
             if (const auto found = viewAt(base, position); found != views.end()) {
-                if (found->second.protection == PAGE_NOACCESS || (found->second.resident && !watchResident)) return false;
+                if (found->second.protection == PAGE_NOACCESS || (found->second.resident ? !watchResident : found->second.page->comparedWhenShared)) return false;
                 cursor = std::min(end, base + pageBytes);
                 continue;
             }
@@ -522,6 +595,7 @@ private:
         }();
         std::vector<std::uintptr_t> aliases;
         std::uint32_t pins = 0;
+        bool comparedWhenShared = false;
     };
     struct Section {
         HANDLE handle;
@@ -553,6 +627,7 @@ private:
     struct Physical {
         std::weak_ptr<SharedPage> page;
         bool stored = false;
+        bool comparedWhenShared = false;
         std::shared_ptr<Saved> saved;
         std::size_t savedOffset = 0;
     };
@@ -569,6 +644,8 @@ private:
         std::shared_ptr<Physical> slot;
         std::size_t viewBytes = pageBytes;
         std::uint32_t hostImports = 0;
+        bool aliasDemoted = false;
+        std::uint8_t unreported = 0;
     };
     struct Run {
         std::uintptr_t end;
@@ -716,7 +793,7 @@ private:
         return true;
     }
 
-    void demote(std::uintptr_t address) {
+    void demote(std::uintptr_t address, bool alias = false) {
         const auto run = std::prev(residentRuns.upper_bound(address));
         const auto start = run->first;
         const auto stop = run->second.end;
@@ -734,6 +811,8 @@ private:
             mapShared(page, view.section->handle, view.offset, view.protection);
             view.slot->stored = true;
             view.resident = false;
+            view.aliasDemoted = alias;
+            view.unreported = view.page->comparedWhenShared ? allSubpages : std::uint8_t{0};
             view.seen.fill(0);
             view.armed = 0;
             view.collected = 0;
@@ -890,6 +969,9 @@ private:
 
     static MEMORY_BASIC_INFORMATION query(std::uintptr_t address) {
         MEMORY_BASIC_INFORMATION memory{};
+#ifdef APS5_COUNT_MAPPING_QUERIES
+        queries.fetch_add(1, std::memory_order_relaxed);
+#endif
         if (VirtualQuery(reinterpret_cast<void*>(address), &memory, sizeof(memory)) != sizeof(memory)) fail("query guest memory");
         return memory;
     }
@@ -1023,6 +1105,9 @@ private:
     std::map<std::uintptr_t, std::size_t> splitAliases;
     std::size_t granularity = 0x10000;
     bool watchResident = false;
+#ifdef APS5_COUNT_MAPPING_QUERIES
+    static inline std::atomic<std::uint64_t> queries{0};
+#endif
     std::mutex mutex;
     AllocateFunction allocate = nullptr;
     MapFunction map = nullptr;
diff --git a/core/libs/prx/libc/include/general/ExportMacros.hpp b/core/libs/prx/libc/include/general/ExportMacros.hpp
index 49ab7fbf8c..c175c74f2b 100644
--- a/core/libs/prx/libc/include/general/ExportMacros.hpp
+++ b/core/libs/prx/libc/include/general/ExportMacros.hpp
@@ -1,7 +1,11 @@
 #ifndef CORE_LIBS_PRX_LIBC_INCLUDE_GENERAL_EXPORTMACROS_HPP
 #define CORE_LIBS_PRX_LIBC_INCLUDE_GENERAL_EXPORTMACROS_HPP
 
-#if defined(__GNUC__) || defined(__clang__)
+#if defined(__APPLE__)
+    #define APS5_EXPORT(exportName, funcName) \
+    __asm__(".globl \"_" exportName "_nid_no_patch_cut\"\n\t" \
+    ".set \"_" exportName "_nid_no_patch_cut\", _" #funcName)
+#elif defined(__GNUC__) || defined(__clang__)
     #define APS5_EXPORT(exportName, funcName) \
     __asm__(".globl \"" exportName "_nid_no_patch_cut\"\n\t" \
     ".set \"" exportName "_nid_no_patch_cut\", " #funcName)
diff --git a/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp b/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp
index 89dd7d3bcd..d61f017608 100644
--- a/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp
+++ b/core/libs/prx/libc/include/specifics/linux/ElfTypes.hpp
@@ -1,6 +1,10 @@
 #ifndef PRX_LIBC_INCLUDE_SPECIFICS_LINUX_ELFTYPES_HPP
 #define PRX_LIBC_INCLUDE_SPECIFICS_LINUX_ELFTYPES_HPP
 
+#ifdef __linux__
+#include <link.h>
+#else
+
 #include <cstdint>
 #include <cstddef>
 
@@ -34,3 +38,5 @@ extern "C" int dl_iterate_phdr(int (*callback)(dl_phdr_info*, std::size_t, void*
 #endif
 
 #endif
+
+#endif
diff --git a/core/libs/prx/libc/libc.hpp b/core/libs/prx/libc/libc.hpp
new file mode 100644
index 0000000000..f5bfb1510b
--- /dev/null
+++ b/core/libs/prx/libc/libc.hpp
@@ -0,0 +1,7 @@
+#pragma once
+
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/exceptions/Runtime.hpp"
+#include "prx/libc/include/exceptions/Unwind.hpp"
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/WindowsFormatting.hpp"
diff --git a/core/libs/prx/libc/src/AllocatingStrings.cpp b/core/libs/prx/libc/src/AllocatingStrings.cpp
index 1605fbd125..9f346a90f3 100644
--- a/core/libs/prx/libc/src/AllocatingStrings.cpp
+++ b/core/libs/prx/libc/src/AllocatingStrings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
@@ -8,8 +9,6 @@
 
 extern "C" {
 
-int APS5_VABI vasprintf_nid_postfix(char** destination, const char* format, VaList* args);
-
 char* APS5_VABI strndup_nid_postfix(const char* source, std::size_t limit) {
     if (!source) { errno = 22; return nullptr; }
     std::size_t length = 0;
diff --git a/core/libs/prx/libc/src/ApplicationHeap.cpp b/core/libs/prx/libc/src/ApplicationHeap.cpp
index 84a8f46eb7..af64afc313 100644
--- a/core/libs/prx/libc/src/ApplicationHeap.cpp
+++ b/core/libs/prx/libc/src/ApplicationHeap.cpp
@@ -1,7 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
+#include <atomic>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
@@ -27,6 +29,7 @@ using UsableSize = std::size_t (APS5_VABI *)(void*);
 
 std::mutex heapMutex;
 std::array<void*, 10> heapApi{};
+std::atomic<int> heapKind{0};
 std::once_flag heapInitialization;
 std::exception_ptr heapFailure;
 Initialize heapFinalize = nullptr;
@@ -145,6 +148,18 @@ void ApplicationHeapRegister_nid_no_patch(void* const* api) {
     if (heapFinalized) throw std::runtime_error("application heap: allocator has been finalized");
     if (heapApi[0] != nullptr && heapApi != replacement) throw std::runtime_error("application heap: cannot replace an active allocator");
     heapApi = replacement;
+    heapKind.store(replacement == defaultApi() ? 1 : 2, std::memory_order_release);
+}
+
+bool ApplicationHeapDefault_nid_no_patch() {
+    int kind = heapKind.load(std::memory_order_acquire);
+    if (kind == 0) {
+        std::unique_lock lock(heapMutex);
+        ensureInitialized(lock);
+        if (heapFailure) std::rethrow_exception(heapFailure);
+        kind = heapKind.load(std::memory_order_acquire);
+    }
+    return kind == 1;
 }
 
 void ApplicationHeapInitialize_nid_no_patch(const void* processParameters) {
@@ -192,7 +207,7 @@ void ApplicationHeapFree_nid_no_patch(void* pointer) {
 }
 
 void* ApplicationHeapReallocate_nid_no_patch(void* pointer, std::size_t bytes) {
-    if (bytes == 0 && pointer != nullptr) {
+    if (bytes == 0 && pointer != nullptr && !ApplicationHeapDefault_nid_no_patch()) {
         ApplicationHeapFree_nid_no_patch(pointer);
         return nullptr;
     }
@@ -227,7 +242,7 @@ extern "C" void APS5_VABI scriptingFreeMem_nid_postfix(void* pointer) {
 }
 
 void* ApplicationHeapRealign_nid_no_patch(void* pointer, std::size_t bytes, std::size_t alignment) {
-    if (bytes == 0) {
+    if (bytes == 0 && !ApplicationHeapDefault_nid_no_patch()) {
         ApplicationHeapFree_nid_no_patch(pointer);
         return nullptr;
     }
diff --git a/core/libs/prx/libc/src/AtomicBuiltins.cpp b/core/libs/prx/libc/src/AtomicBuiltins.cpp
index 93df860262..bca7b11a4d 100644
--- a/core/libs/prx/libc/src/AtomicBuiltins.cpp
+++ b/core/libs/prx/libc/src/AtomicBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <stdexcept>
@@ -7,8 +8,6 @@
 
 namespace {
 
-using Uint128 = unsigned __int128;
-
 [[noreturn]] void ConsoleTrap(const char* function) {
     throw std::runtime_error(std::string(function) + ": the console implementation traps (ud2)");
 }
diff --git a/core/libs/prx/libc/src/Backtrace.cpp b/core/libs/prx/libc/src/Backtrace.cpp
index a07a476b4a..ad454b77cc 100644
--- a/core/libs/prx/libc/src/Backtrace.cpp
+++ b/core/libs/prx/libc/src/Backtrace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -14,8 +15,7 @@
 #include <windows.h>
 #include "prx/libc/include/exceptions/Unwind.hpp"
 extern "C" {
-_Unwind_Reason_Code APS5_VABI _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn, void*);
-_Unwind_Ptr APS5_VABI _Unwind_GetIP_nid_postfix(_Unwind_Context*);
+
 std::string BacktraceModulePath_nid_no_patch(HMODULE handle, std::size_t initialCapacity) {
     std::string module;
     std::size_t capacity = initialCapacity == 0 ? 1 : initialCapacity;
@@ -74,6 +74,7 @@ static_assert(sizeof(FrameRecord) == NameOffset);
     };
     TraceState state{addresses, MaxFrames, 0};
     _Unwind_Backtrace_nid_postfix(traceCallback, &state);
+
     const int captured = state.count;
 #endif
     std::vector<Frame> frames;
diff --git a/core/libs/prx/libc/src/Bessel.cpp b/core/libs/prx/libc/src/Bessel.cpp
index 7ba3585ad3..3ef4643d2a 100644
--- a/core/libs/prx/libc/src/Bessel.cpp
+++ b/core/libs/prx/libc/src/Bessel.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cmath>
 #include <cstddef>
diff --git a/core/libs/prx/libc/src/BinaryWordIo.cpp b/core/libs/prx/libc/src/BinaryWordIo.cpp
index 733aadff22..c3e3be0748 100644
--- a/core/libs/prx/libc/src/BinaryWordIo.cpp
+++ b/core/libs/prx/libc/src/BinaryWordIo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
@@ -7,13 +8,6 @@
 
 static_assert(sizeof(int) == 4 && std::endian::native == std::endian::little);
 
-extern "C" {
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI putc_unlocked_nid_postfix(int, FileStream*);
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-}
-
 namespace {
 
 class LockedStream {
diff --git a/core/libs/prx/libc/src/BoundsChecking.cpp b/core/libs/prx/libc/src/BoundsChecking.cpp
index a29df4a74f..634f860c06 100644
--- a/core/libs/prx/libc/src/BoundsChecking.cpp
+++ b/core/libs/prx/libc/src/BoundsChecking.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <climits>
 #include <cstddef>
 #include <cstdint>
@@ -8,13 +9,7 @@
 #include "prx/libc/include/SonyCrt.hpp"
 
 extern "C" {
-std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
-std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void* state);
-int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value);
-int APS5_VABI ___mb_cur_max_nid_postfix();
-int APS5_VABI getchar_nid_postfix();
-int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
-int APS5_VABI fputc_nid_postfix(int value, FileStream* stream);
+
 extern FileStream* __stderrp_nid_postfix;
 [[noreturn]] void abort_nid_postfix(std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t);
 }
@@ -29,8 +24,6 @@ constexpr std::size_t failed = static_cast<std::size_t>(-1);
 constexpr std::size_t rsizeMax = (std::size_t{1} << 61) - 1;
 constexpr std::size_t guestStateSize = 128;
 
-using GuestContextCompare = int (APS5_VABI*)(const void*, const void*, void*);
-
 bool usableSize(std::size_t size) {
     return size != 0 && size <= rsizeMax;
 }
@@ -51,6 +44,7 @@ extern "C" {
 void APS5_VABI abort_handler_s_nid_postfix(const char* message, void*, int) {
     fputs_nid_postfix(message, __stderrp_nid_postfix);
     fputc_nid_postfix('\n', __stderrp_nid_postfix);
+
     abort_nid_postfix(0, 0, 0, 0, 0, 0);
 }
 
@@ -127,7 +121,7 @@ std::uint16_t* APS5_VABI wcstok_s_nid_postfix(std::uint16_t* str, std::size_t* r
 int APS5_VABI wctomb_s_nid_postfix(int* status, char* destination, std::size_t capacity, std::uint16_t wide) {
     if (!status || (!destination && capacity) || (destination && capacity > rsizeMax))
         return violation("wctomb_s: bad argument", guestEinval);
-    if (destination && static_cast<std::size_t>(___mb_cur_max_nid_postfix()) > capacity) {
+    if (destination && static_cast<std::size_t>(_Getmbcurmax_nid_postfix()) > capacity) {
         char bytes[MB_LEN_MAX];
         const int length = wctomb_nid_postfix(bytes, wide);
         if (length > 0 && static_cast<std::size_t>(length) > capacity) return violation("wctomb_s: buffer too small", guestErange);
@@ -154,7 +148,7 @@ int APS5_VABI wcrtomb_s_nid_postfix(std::size_t* result, char* destination, std:
     std::size_t length = 0;
     if (!destination) {
         length = wcrtomb_nid_postfix(bytes, 0, state);
-    } else if (static_cast<std::size_t>(___mb_cur_max_nid_postfix()) > capacity) {
+    } else if (static_cast<std::size_t>(_Getmbcurmax_nid_postfix()) > capacity) {
         length = wcrtomb_nid_postfix(bytes, wide, state);
         if (length != failed && length > capacity) {
             *result = failed;
diff --git a/core/libs/prx/libc/src/CxxAbiSupport.cpp b/core/libs/prx/libc/src/CxxAbiSupport.cpp
index 1cbe9c38cd..c8fa3ef0de 100644
--- a/core/libs/prx/libc/src/CxxAbiSupport.cpp
+++ b/core/libs/prx/libc/src/CxxAbiSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <cstddef>
 #ifndef _UNWIND_H
@@ -74,18 +75,22 @@ int APS5_VABI __cxa_thread_atexit_impl_nid_postfix(void (APS5_VABI *func)(void*)
     auto* context = new (std::nothrow) ThreadAtexitContext{func, arg};
     if (context == nullptr)
         return -1;
-    const int result = __cxxabiv1::__cxa_thread_atexit(
-        [](void* opaque) {
-            auto* context = static_cast<ThreadAtexitContext*>(opaque);
-            const auto destructor = context->destructor;
-            void* object = context->object;
-            delete context;
-            destructor(object);
-        },
-        context, dso);
+    const auto run = [](void* opaque) {
+        auto* context = static_cast<ThreadAtexitContext*>(opaque);
+        const auto destructor = context->destructor;
+        void* object = context->object;
+        delete context;
+        destructor(object);
+    };
+#ifdef __APPLE__
+    __cxxabiv1::__cxa_thread_atexit(run, context, dso);
+    return 0;
+#else
+    const int result = __cxxabiv1::__cxa_thread_atexit(run, context, dso);
     if (result != 0)
         delete context;
     return result;
+#endif
 }
 
 int APS5_VABI __cxa_thread_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dso) {
diff --git a/core/libs/prx/libc/src/DinkumwareAtomics.cpp b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
index f8aecb774e..13af94ddea 100644
--- a/core/libs/prx/libc/src/DinkumwareAtomics.cpp
+++ b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -172,4 +173,61 @@ int APS5_VABI _Atomic_compare_exchange_weak_nid_postfix(volatile unsigned char*
     return LockedCompareExchange(flag, size, target, expected, desired);
 }
 
+
+std::uint8_t APS5_VABI __atomic_load_1_nid_postfix(const volatile std::uint8_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_load_2_nid_postfix(const volatile std::uint16_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_load_4_nid_postfix(const volatile std::uint32_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_load_8_nid_postfix(const volatile std::uint64_t* target, int) { return __atomic_load_n(target, __ATOMIC_SEQ_CST); }
+
+void APS5_VABI __atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { Store(target, value); }
+void APS5_VABI __atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { Store(target, value); }
+void APS5_VABI __atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { Store(target, value); }
+void APS5_VABI __atomic_store_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { Store(target, value); }
+
+std::uint8_t APS5_VABI __atomic_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return Exchange(target, value); }
+std::uint16_t APS5_VABI __atomic_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return Exchange(target, value); }
+std::uint32_t APS5_VABI __atomic_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return Exchange(target, value); }
+std::uint64_t APS5_VABI __atomic_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return Exchange(target, value); }
+
+int APS5_VABI __atomic_compare_exchange_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+int APS5_VABI __atomic_compare_exchange_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+int APS5_VABI __atomic_compare_exchange_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t* expected, std::uint32_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+int APS5_VABI __atomic_compare_exchange_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int) {
+    return CompareExchange(target, expected, desired);
+}
+
+std::uint8_t APS5_VABI __atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_add_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_add(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_sub_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_sub(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_and_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_and_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_and_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_and_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_or_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_or_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_or_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_or_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI __atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI __atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI __atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint64_t APS5_VABI __atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+
 }
diff --git a/core/libs/prx/libc/src/DinkumwareInternals.cpp b/core/libs/prx/libc/src/DinkumwareInternals.cpp
new file mode 100644
index 0000000000..d1f8ac33f4
--- /dev/null
+++ b/core/libs/prx/libc/src/DinkumwareInternals.cpp
@@ -0,0 +1,156 @@
+#include "prx/libc/include/Api.hpp"
+#include <algorithm>
+#include <cctype>
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <string>
+
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+constexpr long long ExponentLimit = 1000000000;
+constexpr int InvalidArgument = 22;
+constexpr int RangeError = 34;
+
+bool Hexadecimal(const char* text) {
+    while (std::isspace(static_cast<unsigned char>(*text))) ++text;
+    if (*text == '+' || *text == '-') ++text;
+    return text[0] == '0' && (text[1] == 'x' || text[1] == 'X');
+}
+
+template<typename TFloat>
+TFloat ScaledFloat(const char* text, char** end, std::int64_t pten, int* error, TFloat (APS5_VABI *parse)(const char*, char**), const char* function) {
+    int& guestErrno = *__error_nid_postfix();
+    const int saved = guestErrno;
+    if (error != nullptr) *error = 0;
+    guestErrno = 0;
+    char* stop = nullptr;
+    TFloat value = parse(text, &stop);
+    if (end != nullptr) *end = stop;
+    const bool overflowed = std::isinf(value) && guestErrno == RangeError;
+    if (pten != 0 && stop != text && (std::isfinite(value) || overflowed)) {
+        if (Hexadecimal(text)) NotImplemented_nid_no_patch(function);
+        std::string number(text, static_cast<const char*>(stop));
+        long long exponent = 0;
+        const auto marker = number.find_first_of("eE");
+        if (marker != std::string::npos) {
+            exponent = std::strtoll(number.c_str() + marker + 1, nullptr, 10);
+            number.resize(marker);
+        }
+        exponent = std::clamp(exponent, -ExponentLimit, ExponentLimit) + std::clamp<std::int64_t>(pten, -ExponentLimit, ExponentLimit);
+        number += 'e';
+        number += std::to_string(exponent);
+        guestErrno = 0;
+        value = parse(number.c_str(), nullptr);
+    }
+    if (guestErrno == RangeError && (value == 0 || std::isinf(value))) {
+        if (error != nullptr) *error = 1;
+    } else if (guestErrno == 0 || guestErrno == RangeError) {
+        guestErrno = saved;
+    }
+    return value;
+}
+
+bool InvalidBase(const char* text, char** end, int base, int* error) {
+    if (base >= 0 && base != 1 && base <= 36) return false;
+    if (end != nullptr) *end = const_cast<char*>(text);
+    if (error != nullptr) *error = InvalidArgument;
+    return true;
+}
+
+template<typename TInteger>
+TInteger ParsedInteger(const char* text, char** end, int base, int* error, TInteger (APS5_VABI *parse)(const char*, char**, int)) {
+    if (error != nullptr) *error = 0;
+    if (InvalidBase(text, end, base, error)) return 0;
+    int& guestErrno = *__error_nid_postfix();
+    const int saved = guestErrno;
+    guestErrno = 0;
+    const TInteger value = parse(text, end, base);
+    if (error != nullptr) *error = guestErrno;
+    if (guestErrno == 0) guestErrno = saved;
+    return value;
+}
+
+}
+
+extern "C" {
+
+double APS5_VABI _Stodx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error) {
+    return ScaledFloat<double>(text, end, pten, error, strtod_nid_postfix, "_Stodx (hexadecimal text with a power-of-ten scale)");
+}
+
+float APS5_VABI _Stofx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error) {
+    return ScaledFloat<float>(text, end, pten, error, strtof_nid_postfix, "_Stofx (hexadecimal text with a power-of-ten scale)");
+}
+
+long double APS5_VABI _Stoldx_nid_postfix(const char* text, char** end, std::int64_t pten, int* error) {
+    return ScaledFloat<long double>(text, end, pten, error, strtold_nid_postfix, "_Stoldx (hexadecimal text with a power-of-ten scale)");
+}
+
+double APS5_VABI _Stod_nid_postfix(const char* text, char** end, std::int64_t pten) {
+    return _Stodx_nid_postfix(text, end, pten, nullptr);
+}
+
+float APS5_VABI _Stof_nid_postfix(const char* text, char** end, std::int64_t pten) {
+    return _Stofx_nid_postfix(text, end, pten, nullptr);
+}
+
+long double APS5_VABI _Stold_nid_postfix(const char* text, char** end, std::int64_t pten) {
+    return _Stoldx_nid_postfix(text, end, pten, nullptr);
+}
+
+long long APS5_VABI _Stollx_nid_postfix(const char* text, char** end, int base, int* error) {
+    return ParsedInteger<long long>(text, end, base, error, strtoll_nid_postfix);
+}
+
+unsigned long long APS5_VABI _Stoullx_nid_postfix(const char* text, char** end, int base, int* error) {
+    return ParsedInteger<unsigned long long>(text, end, base, error, strtoull_nid_postfix);
+}
+
+std::uint64_t APS5_VABI _Stoulx_nid_postfix(const char* text, char** end, int base, int* error) {
+    return _Stoullx_nid_postfix(text, end, base, error);
+}
+
+std::int64_t APS5_VABI _Stolx_nid_postfix(const char* text, char** end, int base, int* error) {
+    if (error != nullptr) *error = 0;
+    if (InvalidBase(text, end, base, error)) return 0;
+    int& guestErrno = *__error_nid_postfix();
+    const int saved = guestErrno;
+    guestErrno = 0;
+    const long long value = strtoll_nid_postfix(text, end, base);
+    if (error != nullptr) *error = guestErrno;
+    guestErrno = 0;
+    static_cast<void>(strtoull_nid_postfix(text, nullptr, base));
+    if (guestErrno == 0) guestErrno = saved;
+    return value;
+}
+
+long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base) {
+    return _Stollx_nid_postfix(text, end, base, nullptr);
+}
+
+double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant) {
+    return quadrant != 0 ? cos_nid_postfix(x) : sin_nid_postfix(x);
+}
+
+float APS5_VABI _FSin_nid_postfix(float x, unsigned int quadrant) {
+    return quadrant != 0 ? cosf_nid_postfix(x) : sinf_nid_postfix(x);
+}
+
+long double APS5_VABI _LSin_nid_postfix(long double x, unsigned int quadrant) {
+    return quadrant != 0 ? cosl_nid_postfix(x) : sinl_nid_postfix(x);
+}
+
+double APS5_VABI _Log_nid_postfix(double x, int base) {
+    if (base > 0) return log10_nid_postfix(x);
+    return base == 0 ? log_nid_postfix(x) : log2_nid_postfix(x);
+}
+
+float APS5_VABI _FLog_nid_postfix(float x, int base) {
+    if (base > 0) return log10f_nid_postfix(x);
+    return base == 0 ? logf_nid_postfix(x) : log2f_nid_postfix(x);
+}
+
+}
diff --git a/core/libs/prx/libc/src/Directory.cpp b/core/libs/prx/libc/src/Directory.cpp
index 425669cdcf..69d3670e80 100644
--- a/core/libs/prx/libc/src/Directory.cpp
+++ b/core/libs/prx/libc/src/Directory.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
diff --git a/core/libs/prx/libc/src/Environment.cpp b/core/libs/prx/libc/src/Environment.cpp
index f77b8727f9..a04c872b46 100644
--- a/core/libs/prx/libc/src/Environment.cpp
+++ b/core/libs/prx/libc/src/Environment.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdlib>
 #include <cerrno>
 #include <cstring>
diff --git a/core/libs/prx/libc/src/Errors.cpp b/core/libs/prx/libc/src/Errors.cpp
index 4e2d3f08bb..04d0187df9 100644
--- a/core/libs/prx/libc/src/Errors.cpp
+++ b/core/libs/prx/libc/src/Errors.cpp
@@ -1,10 +1,10 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstring>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 // Guest FreeBSD errno numbering, not the host CRT's numbering.
 constexpr const char* messages[] = {
@@ -18,7 +18,7 @@ constexpr const char* messages[] = {
     "Is a directory", "Invalid argument", "Too many open files in system",
     "Too many open files", "Inappropriate ioctl for device", "Text file busy",
     "File too large", "No space left on device", "Illegal seek",
-    "Read-only file system", "Too many links", "Broken pipe",
+    "Read-only filesystem", "Too many links", "Broken pipe",
     "Numerical argument out of domain", "Result too large", "Resource temporarily unavailable",
     "Operation now in progress", "Operation already in progress", "Socket operation on non-socket",
     "Destination address required", "Message too long", "Protocol wrong type for socket",
@@ -44,15 +44,15 @@ constexpr const char* messages[] = {
 };
 static_assert(sizeof(messages) / sizeof(messages[0]) == 97);
 bool Known(int error) { return error >= 0 && error < 97; }
+bool NamedByStrerror(int error) { return error > 0 && error < 95; }
 }
 
 extern "C" {
 char* APS5_VABI strerror_nid_postfix(int error) {
     thread_local char buffer[128];
-    const int saved = *__error_nid_postfix();
-    if (Known(error)) std::snprintf(buffer, sizeof(buffer), "%s", messages[error]);
-    else std::snprintf(buffer, sizeof(buffer), "Unknown error: %d", error);
-    *__error_nid_postfix() = Known(error) ? saved : 22;
+    if (error == 0) std::snprintf(buffer, sizeof(buffer), "No error");
+    else if (NamedByStrerror(error)) std::snprintf(buffer, sizeof(buffer), "%s", messages[error]);
+    else std::snprintf(buffer, sizeof(buffer), "error_code=0x%08x", static_cast<unsigned>(error));
     return buffer;
 }
 
@@ -77,6 +77,7 @@ void APS5_VABI perror_nid_postfix(const char* prefix) {
     const int saved = *__error_nid_postfix();
     char message[128];
     strerror_r_nid_postfix(saved, message, sizeof(message));
+
     auto* stream = GetNativeStream(&_Stderr_nid_postfix);
     if (prefix && *prefix) std::fprintf(stream, "%s: %s\n", prefix, message);
     else std::fprintf(stream, "%s\n", message);
diff --git a/core/libs/prx/libc/src/FileAndHeap.cpp b/core/libs/prx/libc/src/FileAndHeap.cpp
index 0b6e86284c..d50cdfad16 100644
--- a/core/libs/prx/libc/src/FileAndHeap.cpp
+++ b/core/libs/prx/libc/src/FileAndHeap.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
+#include <bit>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
@@ -157,9 +159,6 @@ static bool IsPipeStream(std::FILE* native) {
 }
 #endif
 
-using GuestCompare = int (APS5_VABI *)(const void*, const void*);
-using GuestContextCompare = int (APS5_VABI *)(const void*, const void*, void*);
-
 static void SwapElements(unsigned char* left, unsigned char* right, size_t size) {
     for (size_t index = 0; index < size; ++index) std::swap(left[index], right[index]);
 }
@@ -258,13 +257,13 @@ static void SortElements(unsigned char* base, size_t count, size_t size, Compare
 namespace {
 
 template<typename TAllocate>
-void* allocationOrNull(TAllocate allocate) {
+void* allocationOrNull(TAllocate allocate, int error = 12) {
     try {
         return allocate();
     } catch (const std::bad_alloc&) {
     } catch (const std::length_error&) {
     }
-    errno = 12;
+    errno = error;
     return nullptr;
 }
 
@@ -272,12 +271,36 @@ bool validAlignment(std::size_t alignment) {
     return alignment != 0 && (alignment & (alignment - 1)) == 0;
 }
 
+constexpr std::size_t DefaultHeapAlignment = 32;
+constexpr std::size_t DefaultHeapAlignmentLimit = std::size_t{1} << 63;
+constexpr std::size_t DefaultHeapOverhead = 0x1008f;
+constexpr std::size_t DefaultHeapAlignedOverhead = 0x100af;
+
+std::size_t defaultHeapAlignment(std::size_t alignment) {
+    return std::bit_ceil(std::max(alignment, DefaultHeapAlignment));
+}
+
+bool defaultHeapRequestOverflows(std::size_t bytes, std::size_t alignment) {
+    const std::size_t overhead = alignment <= DefaultHeapAlignment ? DefaultHeapOverhead : defaultHeapAlignment(alignment) + DefaultHeapAlignedOverhead;
+    return bytes > std::numeric_limits<std::size_t>::max() - overhead;
+}
+
+template<typename TAllocate>
+void* defaultHeapAllocation(std::size_t bytes, std::size_t alignment, TAllocate allocate) {
+    if (defaultHeapRequestOverflows(bytes, alignment)) return nullptr;
+    return allocationOrNull(allocate, 22);
+}
+
+template<typename TAllocate>
+void* heapAllocation(std::size_t bytes, TAllocate allocate) {
+    if (!ApplicationHeapDefault_nid_no_patch()) return allocationOrNull(allocate);
+    return defaultHeapAllocation(bytes, 0, allocate);
+}
+
 }
 
 extern "C" {
 
-[[noreturn]] void APS5_VABI _ZSt11_Xbad_allocv_nid_postfix();
-
 FileStream* APS5_VABI fdopen_nid_postfix(int descriptor, const char* mode) {
     if (descriptor < 0) { errno = 9; return nullptr; }
     if (!mode) { errno = 22; return nullptr; }
@@ -361,14 +384,12 @@ FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode
     if (!parsed) { errno = 22; return nullptr; }
     try {
         std::filesystem::path path;
-        if (*filename) {
-            if (const int error = ResolvePathError_nid_no_patch(filename, path)) {
-                if (stream->IsHostStandard()) stream->Detach();
-                else stream->Close();
-                if (stream->IsDynamic()) delete stream;
-                errno = error;
-                return nullptr;
-            }
+        if (const int error = *filename ? ResolvePathError_nid_no_patch(filename, path) : 2) {
+            if (stream->IsHostStandard()) stream->Detach();
+            else stream->Close();
+            if (stream->IsDynamic()) delete stream;
+            errno = error;
+            return nullptr;
         }
         if (stream->Reopen(path, parsed->native.c_str(), OpenNative)) {
 #ifdef _WIN32
@@ -455,8 +476,6 @@ int APS5_VABI fclose_nid_postfix(FileStream* stream) {
     return stream->Close();
 }
 
-int APS5_VABI fseek_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
-
 FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char* filename, int mode, int protection) {
     static_cast<void>(protection);
     constexpr int In = 0x01, Out = 0x02, Ate = 0x04, App = 0x08, Trunc = 0x10, Nocreate = 0x20, Noreplace = 0x40,
@@ -477,15 +496,16 @@ FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const
     auto* stream = fopen_nid_postfix(filename, openMode);
     if (!stream || !(mode & Ate) || fseek_nid_postfix(stream, 0, SEEK_END) == 0) return stream;
     fclose_nid_postfix(stream);
+
     return nullptr;
 }
 
 size_t APS5_VABI fread_nid_postfix(void* buffer, size_t size, size_t count, FileStream* stream) {
+    if (size != 0 && count > std::numeric_limits<std::size_t>::max() / size) { errno = EINVAL; return 0; }
     if (stream && !stream->IsOpen()) { errno = 9; return 0; }
     auto* handle = GetStreamHandle(stream);
     if (size == 0 || count == 0) return 0;
     if (!buffer) throw std::runtime_error("fread: null buffer");
-    if (count > std::numeric_limits<std::size_t>::max() / size) throw std::overflow_error("fread: buffer size overflow");
     const auto bytes = size * count;
     if (bytes > std::numeric_limits<std::uintptr_t>::max() - reinterpret_cast<std::uintptr_t>(buffer)) throw std::overflow_error("fread: buffer address overflow");
     const GuestArena::HostWrite destination(buffer, bytes);
@@ -586,6 +606,8 @@ int APS5_VABI fflush_nid_postfix(FileStream* stream) {
     if (stream && (stream->IsRandomDevice() || stream->IsDirectory())) return 0;
 #ifdef __linux__
     if (native && !__fwriting(native)) return 0;
+#elif defined(__APPLE__)
+    if (native && !(native->_flags & __SWR)) return 0;
 #endif
     const int result = std::fflush(native);
     if (stream) stream->SyncStatus();
@@ -601,7 +623,7 @@ size_t APS5_VABI malloc_usable_size_nid_postfix(void* pointer) {
 }
 
 void* APS5_VABI malloc_nid_postfix(size_t size) {
-    return allocationOrNull([size] { return ApplicationHeapAllocate_nid_no_patch(size); });
+    return heapAllocation(size, [size] { return ApplicationHeapAllocate_nid_no_patch(size); });
 }
 
 void APS5_VABI free_nid_postfix(void* ptr) {
@@ -609,49 +631,60 @@ void APS5_VABI free_nid_postfix(void* ptr) {
 }
 
 void* APS5_VABI realloc_nid_postfix(void* ptr, size_t newSize) {
-    return allocationOrNull([ptr, newSize] { return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); });
+    return heapAllocation(newSize, [ptr, newSize] { return ApplicationHeapReallocate_nid_no_patch(ptr, newSize); });
 }
 
 void* APS5_VABI reallocf_nid_postfix(void* ptr, size_t newSize) {
-    try {
-        return ApplicationHeapReallocate_nid_no_patch(ptr, newSize);
-    } catch (const std::bad_alloc&) {
-    } catch (const std::length_error&) {
-    }
-    ApplicationHeapFree_nid_no_patch(ptr);
-    errno = 12;
-    return nullptr;
+    void* result = realloc_nid_postfix(ptr, newSize);
+    if (result == nullptr && ptr != nullptr && newSize != 0) ApplicationHeapFree_nid_no_patch(ptr);
+    return result;
 }
 
 void* APS5_VABI memalign_nid_postfix(size_t alignment, size_t size) {
-    if (!validAlignment(alignment)) {
-        errno = 22;
-        return nullptr;
+    if (!ApplicationHeapDefault_nid_no_patch()) {
+        if (!validAlignment(alignment)) {
+            errno = 22;
+            return nullptr;
+        }
+        return allocationOrNull([alignment, size] { return ApplicationHeapAlign_nid_no_patch(alignment, size); });
     }
-    return allocationOrNull([alignment, size] { return ApplicationHeapAlign_nid_no_patch(alignment, size); });
+    if (alignment >= DefaultHeapAlignmentLimit) return nullptr;
+    const std::size_t rounded = defaultHeapAlignment(alignment);
+    return defaultHeapAllocation(size, alignment, [rounded, size] { return ApplicationHeapAlign_nid_no_patch(rounded, size); });
 }
 
 void* APS5_VABI aligned_alloc_nid_postfix(size_t alignment, size_t size) {
+    if (ApplicationHeapDefault_nid_no_patch() && !validAlignment(alignment)) return nullptr;
     return memalign_nid_postfix(alignment, size);
 }
 
 void* APS5_VABI reallocalign_nid_postfix(void* ptr, size_t size, size_t alignment) {
-    if (size != 0 && !validAlignment(alignment)) {
-        errno = 22;
-        return nullptr;
+    if (!ApplicationHeapDefault_nid_no_patch()) {
+        if (size != 0 && !validAlignment(alignment)) {
+            errno = 22;
+            return nullptr;
+        }
+        return allocationOrNull([ptr, size, alignment] { return ApplicationHeapRealign_nid_no_patch(ptr, size, alignment); });
     }
-    return allocationOrNull([ptr, size, alignment] { return ApplicationHeapRealign_nid_no_patch(ptr, size, alignment); });
+    if (alignment >= DefaultHeapAlignmentLimit) return nullptr;
+    const std::size_t rounded = defaultHeapAlignment(alignment);
+    return defaultHeapAllocation(size, alignment, [ptr, size, rounded] { return ApplicationHeapRealign_nid_no_patch(ptr, size, rounded); });
 }
 
 void* APS5_VABI calloc_nid_postfix(size_t count, size_t size) {
-    return allocationOrNull([count, size] { return ApplicationHeapCalloc_nid_no_patch(count, size); });
+    const auto allocate = [count, size] { return ApplicationHeapCalloc_nid_no_patch(count, size); };
+    if (!ApplicationHeapDefault_nid_no_patch()) return allocationOrNull(allocate);
+    if (size != 0 && count > std::numeric_limits<size_t>::max() / size) return nullptr;
+    return defaultHeapAllocation(count * size, 0, allocate);
 }
 
 int APS5_VABI posix_memalign_nid_postfix(void** pointer, size_t alignment, size_t size) {
     if (!pointer || alignment < sizeof(void*) || (alignment & (alignment - 1)) != 0) return 22;
     const int savedError = errno;
     const int result = ApplicationHeapPosixAlign_nid_no_patch(pointer, alignment, size);
-    errno = savedError;
+    const bool failureSetsError = result != 0 && ApplicationHeapDefault_nid_no_patch() && alignment < DefaultHeapAlignmentLimit &&
+        !defaultHeapRequestOverflows(size, alignment);
+    errno = failureSetsError ? 22 : savedError;
     return result;
 }
 
@@ -706,6 +739,7 @@ int APS5_VABI mergesort_nid_postfix(void* base, size_t count, size_t size, Guest
     }
     if (source != base) std::memcpy(base, source, count * size);
     free_nid_postfix(scratch);
+
     return 0;
 }
 
diff --git a/core/libs/prx/libc/src/Filesystem.cpp b/core/libs/prx/libc/src/Filesystem.cpp
index 510477eb7a..617ebf6e63 100644
--- a/core/libs/prx/libc/src/Filesystem.cpp
+++ b/core/libs/prx/libc/src/Filesystem.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/General.hpp"
 #include <cerrno>
diff --git a/core/libs/prx/libc/src/FloatBuiltins.cpp b/core/libs/prx/libc/src/FloatBuiltins.cpp
index b059652259..235c74f27a 100644
--- a/core/libs/prx/libc/src/FloatBuiltins.cpp
+++ b/core/libs/prx/libc/src/FloatBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cmath>
 #include <cstdint>
@@ -8,9 +9,6 @@
 
 namespace {
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
 constexpr std::uint32_t DefaultMxcsr = 0x1f80;
 
 template<typename TFloat>
diff --git a/core/libs/prx/libc/src/FloatingPoint.cpp b/core/libs/prx/libc/src/FloatingPoint.cpp
index e3717ef61b..ea910f0f3b 100644
--- a/core/libs/prx/libc/src/FloatingPoint.cpp
+++ b/core/libs/prx/libc/src/FloatingPoint.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -61,8 +62,6 @@ int APS5_VABI fegetexceptflag_nid_postfix(std::uint16_t* flags, int exceptions)
     return 0;
 }
 
-int* APS5_VABI __error_nid_postfix();
-
 void APS5_VABI _Feraise_nid_postfix(int exceptions) {
     constexpr unsigned Invalid = 0x01, Ranges = 0x1c, Overflows = 0x18, Inexact = 0x20;
     constexpr int GuestEdom = 33, GuestErange = 34;
@@ -96,7 +95,6 @@ int APS5_VABI feclearexcept_nid_postfix(int exceptions) {
     return 0;
 }
 
-
 int APS5_VABI feenableexcept_nid_postfix(int exceptions) {
     return ChangeTraps(exceptions, true);
 }
@@ -119,6 +117,10 @@ int APS5_VABI fegettrapenable_nid_postfix() {
     return ~control & Exceptions;
 }
 
+int APS5_VABI fegetexcept_nid_postfix() {
+    return fegettrapenable_nid_postfix();
+}
+
 int APS5_VABI fesettrapenable_nid_postfix(int exceptions) {
     const auto mask = static_cast<std::uint16_t>(exceptions);
     if (mask > Exceptions) return 1;
diff --git a/core/libs/prx/libc/src/Formatting.cpp b/core/libs/prx/libc/src/Formatting.cpp
index 1ab1877529..d0066ae761 100644
--- a/core/libs/prx/libc/src/Formatting.cpp
+++ b/core/libs/prx/libc/src/Formatting.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstdio>
@@ -40,13 +41,19 @@ bool RequiresGuestFormatting(const char* format) {
         ++format;
         if (*format == '%') { ++format; continue; }
         while (*format && std::strchr("-+ #0'0123456789.*$", *format)) ++format;
-        if (*format == 'S' || *format == 'C' || *format == 'm' || *format == 'p' ||
+        if (*format == 'S' || *format == 'C' || *format == 'p' ||
             (*format == 'l' && (format[1] == 's' || format[1] == 'c' || format[1] == 'p'))) return true;
+        while (*format && std::strchr("hljztL", *format)) ++format;
+        if (*format && !std::strchr(LibcDetail::KnownConversions, *format)) return true;
         if (*format) ++format;
     }
     return false;
 }
 
+std::size_t HostFormatSize(std::size_t size) {
+    return std::min(size, static_cast<std::size_t>(INT_MAX) + 1);
+}
+
 bool HasGuestWideScan(const char* format) {
     if (format == nullptr) return false;
     while ((format = std::strchr(format, '%')) != nullptr) {
@@ -80,7 +87,6 @@ bool IsWideScan(const std::string& length, char conversion) {
     return conversion == 'S' || conversion == 'C' || (length == "l" && (conversion == 's' || conversion == 'c' || conversion == '['));
 }
 
-
 #endif
 
 std::string HostLength(const std::string& length, char conversion) {
@@ -441,7 +447,7 @@ int APS5_VABI libc_printf_nid_postfix(const char* format, ...) {
 int APS5_VABI snprintf_nid_postfix(char* buffer, size_t size, const char* format, ...) {
     std::va_list args;
     va_start(args, format);
-    const int result = RequiresGuestFormatting(format) ? LibcDetail::FormatWindows(buffer, size, format, args) : std::vsnprintf(buffer, size, format, args);
+    const int result = RequiresGuestFormatting(format) ? LibcDetail::FormatWindows(buffer, size, format, args) : std::vsnprintf(buffer, HostFormatSize(size), format, args);
     va_end(args);
     return result;
 }
@@ -547,7 +553,7 @@ int APS5_VABI vsnprintf_nid_postfix(char* str, size_t size, const char* format,
     if (RequiresGuestFormatting(format)) return LibcDetail::FormatWindows(str, size, format, c);
     std::va_list copy;
     va_copy(copy, *reinterpret_cast<std::va_list*>(c));
-    const int result = std::vsnprintf(str, size, format, copy);
+    const int result = std::vsnprintf(str, HostFormatSize(size), format, copy);
     va_end(copy);
     return result;
 #endif
diff --git a/core/libs/prx/libc/src/FormattingWide.cpp b/core/libs/prx/libc/src/FormattingWide.cpp
index a2b3d0fe7d..66fd9d1142 100644
--- a/core/libs/prx/libc/src/FormattingWide.cpp
+++ b/core/libs/prx/libc/src/FormattingWide.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cerrno>
 #include <climits>
 #include <cstdint>
@@ -218,8 +219,6 @@ std::u16string FormatWide(const char16_t* format, VaList* source, bool secure =
 
 extern "C" {
 extern FileStream* __stdoutp_nid_postfix;
-std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream);
-int APS5_VABI ferror_nid_postfix(FileStream* stream);
 
 int APS5_VABI vswprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args) {
     if (buffer == nullptr || size == 0) { errno = 22; return -1; }
@@ -399,7 +398,8 @@ int APS5_VABI putwchar_nid_postfix(char16_t value) {
 }
 
 char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* stream) {
-    if (buffer == nullptr || stream == nullptr || size <= 0) {
+    if (size < 2) return nullptr;
+    if (buffer == nullptr || stream == nullptr) {
         if (stream != nullptr) stream->SetError();
         errno = 22;
         return nullptr;
@@ -407,14 +407,11 @@ char16_t* APS5_VABI fgetws_nid_postfix(char16_t* buffer, int size, FileStream* s
     int count = 0;
     while (count < size - 1) {
         const std::int32_t character = fgetwc_nid_postfix(stream);
-        if (character == -1) {
-            if (count == 0) return nullptr;
-            break;
-        }
+        if (character == -1) break;
         buffer[count++] = static_cast<char16_t>(character);
         if (character == static_cast<std::int32_t>(u'\n')) break;
     }
-    if (ferror_nid_postfix(stream) != 0) return nullptr;
+    if (count == 0) return nullptr;
     buffer[count] = 0;
     return buffer;
 }
diff --git a/core/libs/prx/libc/src/General.cpp b/core/libs/prx/libc/src/General.cpp
index 26c1935c5a..73c1a10082 100644
--- a/core/libs/prx/libc/src/General.cpp
+++ b/core/libs/prx/libc/src/General.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <atomic>
 #include <cstdio>
 #include <mutex>
@@ -255,13 +256,11 @@ std::optional<std::filesystem::path> ResolveAlias(const std::string& guestPath,
             const auto result = std::filesystem::path(host).make_preferred();
             return module ? PathOrRelinkedModule(result) : result;
         }
-#ifndef _WIN32
         if (guestPath.back() == '/') {
-            auto result = ResolveHostPath(host, SplitNames(std::string_view(relative).substr(prefix.size() + 1)));
+            auto result = ResolveHostPath(host, SplitNames(std::string_view(relative).substr(prefix.size() + 1))).make_preferred();
             result /= "";
             return module ? PathOrRelinkedModule(result) : result;
         }
-#endif
         return ResolveHostPath(host, SplitNames(std::string_view(relative).substr(prefix.size() + 1)), module).make_preferred();
     }
     return std::nullopt;
@@ -318,6 +317,14 @@ void RequireHostDirectory(WorkingDirectory& state, const std::vector<std::string
 #endif
     throw std::filesystem::filesystem_error("Guest path component is not a directory", host, error);
 }
+void RejectNonDirectory(const std::filesystem::path& host) {
+    auto target = host;
+    while (!target.has_filename() && target.has_relative_path()) target = target.parent_path();
+    std::error_code error;
+    const auto status = std::filesystem::status(target, error);
+    if (std::filesystem::exists(status) && !std::filesystem::is_directory(status))
+        throw std::filesystem::filesystem_error("Guest path with a trailing slash is not a directory", host, std::make_error_code(std::errc::not_a_directory));
+}
 std::vector<std::string> WithTrailingSeparator(std::vector<std::string> names, bool trailing) {
     if (trailing && !names.empty()) names.emplace_back();
     return names;
@@ -360,7 +367,10 @@ std::filesystem::path Resolve(WorkingDirectory& state, const char* path, bool mo
         if (!trailing) names.push_back(name);
     }
     if (endsWithDot && !names.empty() && !(archived && AppArchiveHasDirectory_nid_no_patch(HostPath(state, names)))) RequireHostDirectory(state, names);
-    return HostPath(state, WithTrailingSeparator(std::move(names), trailing), module);
+    const bool directory = trailing && !names.empty();
+    auto resolved = HostPath(state, WithTrailingSeparator(std::move(names), trailing), module);
+    if (directory) RejectNonDirectory(resolved);
+    return resolved;
 }
 #ifdef _WIN32
 using WriteMark = FILETIME;
@@ -376,7 +386,11 @@ bool NotBefore(const WriteMark& time, const WriteMark& mark) {
 using WriteMark = timespec;
 WriteMark Now() {
     timespec now;
+#ifdef __APPLE__
+    clock_gettime(CLOCK_REALTIME, &now);
+#else
     clock_gettime(CLOCK_REALTIME_COARSE, &now);
+#endif
     return now;
 }
 bool NotBefore(const WriteMark& time, const WriteMark& mark) {
@@ -415,7 +429,11 @@ void FlushPath(const std::filesystem::path& path) {
 #else
 std::optional<WriteMark> WriteTime(const std::filesystem::path& path) {
     struct stat data;
+#ifdef __APPLE__
+    if (::stat(path.c_str(), &data) == 0) return data.st_mtimespec;
+#else
     if (::stat(path.c_str(), &data) == 0) return data.st_mtim;
+#endif
     if (errno == ENOENT || errno == ENOTDIR) return std::nullopt;
     throw std::system_error(errno, std::generic_category(), "Reading the write time of " + path.string());
 }
@@ -557,6 +575,36 @@ extern "C" std::FILE* HostStandardErrorFile_nid_no_patch() {
     if (std::FILE* kept = g_hostStandardErrorFile.load(std::memory_order_acquire)) return kept;
     return __acrt_iob_func(2);
 }
+
+namespace {
+std::mutex g_hostStandardStreamMutex;
+
+int keepHostStandardStream(int standard) {
+    auto& slot = standard == 1 ? g_hostStandardOutputFile : g_hostStandardErrorFile;
+    if (auto* stream = slot.load(std::memory_order_acquire)) return ::_fileno(stream);
+    const std::unique_ptr<std::FILE, decltype(&::_unlock_file)> unlock(__acrt_iob_func(standard), ::_unlock_file);
+    ::_lock_file(unlock.get());
+    const std::lock_guard lock(g_hostStandardStreamMutex);
+    if (auto* stream = slot.load(std::memory_order_acquire)) return ::_fileno(stream);
+    const int saved = DuplicateHostDescriptor_nid_no_patch(standard);
+    if (saved < 0) return -1;
+    if (!AdoptHostStandardStream_nid_no_patch(standard, saved)) {
+        const int error = errno;
+        ::_close(saved);
+        errno = error;
+        return -1;
+    }
+    return saved;
+}
+}
+
+extern "C" int KeepHostStandardError_nid_no_patch() {
+    return keepHostStandardStream(2);
+}
+
+extern "C" int KeepHostStandardOutput_nid_no_patch() {
+    return keepHostStandardStream(1);
+}
 #endif
 
 extern "C" void AddPathAlias_nid_no_patch(const char* guestPrefix, const char* hostPath) {
diff --git a/core/libs/prx/libc/src/GuestArena.cpp b/core/libs/prx/libc/src/GuestArena.cpp
index 20cdbc1820..65f574aded 100644
--- a/core/libs/prx/libc/src/GuestArena.cpp
+++ b/core/libs/prx/libc/src/GuestArena.cpp
@@ -46,7 +46,12 @@ void noteAccess(const void* pointer, std::size_t bytes) {
 }
 
 constexpr std::uintptr_t GuestArenaOffset = GuestArena::GuestAddressOffset;
-constexpr std::uintptr_t ArenaStart = 0x0000000200000000ull + GuestArenaOffset;
+constexpr std::uintptr_t DefaultAllocationStart = 0x0000000200000000ull + GuestArenaOffset;
+#ifdef __APPLE__
+constexpr std::uintptr_t ArenaStart = DefaultAllocationStart;
+#else
+constexpr std::uintptr_t ArenaStart = GuestArenaOffset == 0 ? 0x10000ull : DefaultAllocationStart;
+#endif
 constexpr std::uintptr_t SystemReservedStart = 0x00000007FFFFC000ull + GuestArenaOffset;
 constexpr std::uintptr_t SystemReservedEnd = 0x0000001000000000ull + GuestArenaOffset;
 constexpr std::uintptr_t ApplicationAreaEnd = 0x000000FC00000000ull + GuestArenaOffset;
@@ -86,7 +91,7 @@ public:
         RequireAllocatable(alignment);
         std::lock_guard lock(_lock);
         auto candidate = hint < _end ? FindAtOrAbove(hint, bytes, alignment) : 0;
-        if (candidate == 0 && hint > _base) candidate = FindAtOrAbove(_base, bytes, alignment);
+        if (candidate == 0 && hint > _base) candidate = FindAtOrAbove(hint < DefaultAllocationStart ? _base : DefaultAllocationStart, bytes, alignment);
         return Claim(candidate, bytes);
     }
 
@@ -273,6 +278,10 @@ private:
             const int failed = ReserveNoReplace(cursor, end - cursor);
             if (failed == 0) continue;
             if (failed != EEXIST) {
+                if (cursor < DefaultAllocationStart && (failed == EACCES || failed == EPERM)) {
+                    occupied.emplace_back(cursor, end);
+                    continue;
+                }
                 char message[128];
                 std::snprintf(message, sizeof(message), "guest arena: cannot reserve 0x%llx+0x%llx",
                     static_cast<unsigned long long>(cursor), static_cast<unsigned long long>(end - cursor));
@@ -309,7 +318,7 @@ private:
     }
 
     std::uintptr_t FindAtOrAbove(std::uintptr_t hint, std::size_t bytes, std::size_t alignment) const {
-        std::uintptr_t candidate = alignUp(std::max(_base, hint), alignment);
+        std::uintptr_t candidate = alignUp(hint == 0 ? DefaultAllocationStart : std::max(_base, hint), alignment);
         auto it = _used.upper_bound(candidate);
         if (it != _used.begin() && std::prev(it)->second > candidate) --it;
         for (; it != _used.end(); ++it) {
@@ -510,6 +519,22 @@ bool GuestArenaResidentSpan_nid_postfix(std::uintptr_t address, std::size_t byte
     return WindowsMappings::Get().ResidentSpan(address, bytes, start, end);
 }
 
+void GuestArenaCompareWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes) {
+    WindowsMappings::Get().CompareWhenShared(address, bytes);
+}
+
+void GuestArenaCompareResidentWhenShared_nid_no_patch(std::uintptr_t address, std::size_t bytes) {
+    WindowsMappings::Get().CompareWhenShared(address, bytes, true);
+}
+
+void GuestArenaComparedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count) {
+    WindowsMappings::Get().ComparedPages(address, bytes, pages, count, false);
+}
+
+void GuestArenaTakeUnreportedPages_nid_no_patch(std::uintptr_t address, std::size_t bytes, void** pages, std::size_t* count) {
+    WindowsMappings::Get().ComparedPages(address, bytes, pages, count, true);
+}
+
 void GuestArenaForgetSection_nid_postfix(void* section) {
     WindowsMappings::Get().ForgetSection(section);
 }
diff --git a/core/libs/prx/libc/src/GuestHeap.cpp b/core/libs/prx/libc/src/GuestHeap.cpp
index 96c95d1063..6277174a21 100644
--- a/core/libs/prx/libc/src/GuestHeap.cpp
+++ b/core/libs/prx/libc/src/GuestHeap.cpp
@@ -280,6 +280,12 @@ void* allocate(GuestAllocations::Mutation& mutation, std::size_t alignment, std:
     return pointer;
 }
 
+void* emptyInPlace(GuestAllocations::Mutation& mutation, void* pointer, bool gpu) {
+    mutation.Remove(pointer);
+    mutation.Add(pointer, 0, true, true, gpu);
+    return pointer;
+}
+
 void free(GuestAllocations::Mutation& mutation, void* pointer) {
     mutation.Remove(pointer);
     const auto blockBytes = reinterpret_cast<std::size_t*>(pointer)[-1];
@@ -307,10 +313,7 @@ void* GuestHeapReallocate_nid_postfix(void* pointer, std::size_t bytes) {
     GuestAllocations::Mutation mutation;
     const auto range = mutation.Find(pointer);
     mutation.RequireUnpinned(pointer, range.bytes);
-    if (bytes == 0) {
-        free(mutation, pointer);
-        return nullptr;
-    }
+    if (bytes == 0) return emptyInPlace(mutation, pointer, range.gpu);
     void* result = allocate(mutation, MinimumAlignment, bytes, range.gpu);
     std::memcpy(result, pointer, std::min(bytes, range.bytes));
     free(mutation, pointer);
@@ -323,8 +326,10 @@ void* GuestHeapRealign_nid_postfix(void* pointer, std::size_t bytes, std::size_t
     const auto range = mutation.Find(pointer);
     mutation.RequireUnpinned(pointer, range.bytes);
     if (bytes == 0) {
-        free(mutation, pointer);
-        return nullptr;
+        if (alignment == 0 || (alignment & (alignment - 1)) != 0) throw std::invalid_argument("invalid guest heap alignment");
+        if (reinterpret_cast<std::uintptr_t>(pointer) % alignment != 0)
+            throw std::invalid_argument("reallocalign to 0 bytes with an alignment the block does not have is not measured on the console");
+        return emptyInPlace(mutation, pointer, range.gpu);
     }
     void* result = allocate(mutation, alignment, bytes, range.gpu);
     std::memcpy(result, pointer, std::min(bytes, range.bytes));
diff --git a/core/libs/prx/libc/src/HeapDiagnostics.cpp b/core/libs/prx/libc/src/HeapDiagnostics.cpp
index 04324b8d39..626f036e4f 100644
--- a/core/libs/prx/libc/src/HeapDiagnostics.cpp
+++ b/core/libs/prx/libc/src/HeapDiagnostics.cpp
@@ -1,11 +1,25 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/HeapDiagnostics.hpp"
 #include <array>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
+#include <cstring>
 #include <stdexcept>
 
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <sys/syscall.h>
+#include <unistd.h>
+#endif
+
+extern "C" std::FILE* GuestStandardOutputFile_nid_no_patch();
+
 namespace {
 
 std::uint64_t mspaceAtomicIdMask = 0;
@@ -19,6 +33,26 @@ static_assert(sizeof(LibcHeapInfo) == 32);
 static_assert(offsetof(LibcHeapInfo, mspace_atomic_id_mask) == 16);
 static_assert(offsetof(LibcHeapInfo, mstate_table) == 24);
 
+constexpr std::size_t MspaceNameOffset = 0x3B0;
+constexpr std::size_t MspaceNumberOffset = 0x3F4;
+constexpr std::uint32_t SegmentOutOfRange = 1;
+
+unsigned long CurrentProcessId() {
+#ifdef _WIN32
+    return GetCurrentProcessId();
+#else
+    return static_cast<unsigned long>(::getpid());
+#endif
+}
+
+unsigned long CurrentThreadId() {
+#ifdef _WIN32
+    return GetCurrentThreadId();
+#else
+    return static_cast<unsigned long>(::syscall(SYS_gettid));
+#endif
+}
+
 }
 
 extern "C" {
@@ -39,6 +73,17 @@ void APS5_VABI sceLibcInternalBacktraceForGame_nid_postfix(const char* heapName)
 }
 
 void APS5_VABI sceLibcInternalHeapErrorReportForGame_nid_postfix(void* heap, void* block, std::uint32_t error) {
+    if (heap == nullptr) throw std::invalid_argument("sceLibcInternalHeapErrorReportForGame: null heap");
+    const auto* state = static_cast<const char*>(heap);
+    std::uint32_t number = 0;
+    std::memcpy(&number, state + MspaceNumberOffset, sizeof(number));
+    std::FILE* output = GuestStandardOutputFile_nid_no_patch();
+    std::fprintf(output, "[SceLibc] A heap error is detected.\n[SceLibc] -- Mspace Name --\n[SceLibc] %s", state + MspaceNameOffset);
+    if (number != 0) std::fprintf(output, " (%2u)", number);
+    std::fputc('\n', output);
+    if (error == SegmentOutOfRange) std::fprintf(output, "[SceLibc] -- Error reason --\n[SceLibc] segment out of range.\n");
+    std::fprintf(output, "[SceLibc] pid:<0x%lx> tid:<0x%lx>\n", CurrentProcessId(), CurrentThreadId());
+    std::fflush(output);
     std::fprintf(stderr, "[libc] heap error 0x%x: heap %p, block %p, reported from guest 0x%llx\n", error, heap, block,
         static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(__builtin_return_address(0))));
 }
diff --git a/core/libs/prx/libc/src/Hostname.cpp b/core/libs/prx/libc/src/Hostname.cpp
index 7b205e3659..a8a74cc4af 100644
--- a/core/libs/prx/libc/src/Hostname.cpp
+++ b/core/libs/prx/libc/src/Hostname.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <cerrno>
diff --git a/core/libs/prx/libc/src/IntegerBuiltins.cpp b/core/libs/prx/libc/src/IntegerBuiltins.cpp
index 2df42c3913..44a6e6df13 100644
--- a/core/libs/prx/libc/src/IntegerBuiltins.cpp
+++ b/core/libs/prx/libc/src/IntegerBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cstdint>
 #include <stdexcept>
@@ -8,9 +9,6 @@
 
 namespace {
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
 constexpr Uint128 Int128SignBit = static_cast<Uint128>(1) << 127;
 constexpr Int128 Int128Max = static_cast<Int128>(~Int128SignBit);
 constexpr Int128 Int128Min = static_cast<Int128>(Int128SignBit);
diff --git a/core/libs/prx/libc/src/Interfaces.cpp b/core/libs/prx/libc/src/Interfaces.cpp
index 8e39cfa29b..9b82031aae 100644
--- a/core/libs/prx/libc/src/Interfaces.cpp
+++ b/core/libs/prx/libc/src/Interfaces.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -5,11 +6,13 @@
 #include <iphlpapi.h>
 #else
 #include <ifaddrs.h>
-#include <linux/if_link.h>
 #include <net/if.h>
-#include <net/if_arp.h>
 #include <netinet/in.h>
+#ifdef __linux__
+#include <linux/if_link.h>
+#include <net/if_arp.h>
 #include <netpacket/packet.h>
+#endif
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <unistd.h>
@@ -29,17 +32,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
-struct GuestInterfaceAddress {
-    GuestInterfaceAddress* next;
-    char* name;
-    std::uint32_t flags;
-    void* address;
-    void* netmask;
-    void* destination;
-    void* data;
-};
 static_assert(sizeof(GuestInterfaceAddress) == 56);
 static_assert(offsetof(GuestInterfaceAddress, flags) == 16);
 static_assert(offsetof(GuestInterfaceAddress, address) == 24);
@@ -160,6 +152,7 @@ int HostEntries(std::vector<Entry>& entries) {
     return 0;
 }
 #else
+#ifdef __linux__
 constexpr std::uint8_t guestLinkFamily = 18;
 constexpr std::size_t guestLinkNameArea = 8 + 16;
 constexpr std::size_t guestLinkMinimum = 54;
@@ -171,6 +164,7 @@ constexpr std::uint8_t guestLinkStateDown = 1;
 constexpr std::uint8_t guestLinkStateUp = 2;
 constexpr std::size_t guestInterfaceDataSize = 152;
 constexpr unsigned int hostLowerUp = 0x10000;
+#endif
 
 struct HostInterface {
     std::string name;
@@ -179,6 +173,7 @@ struct HostInterface {
     std::vector<Entry> addresses;
 };
 
+#ifdef __linux__
 template<typename TValue>
 void Store(std::vector<std::uint8_t>& bytes, std::size_t offset, TValue value) {
     std::memcpy(bytes.data() + offset, &value, sizeof(value));
@@ -253,6 +248,7 @@ std::vector<std::uint8_t> GuestInterfaceData(const std::string& name, unsigned i
     }
     return data;
 }
+#endif
 
 std::uint32_t InterfaceFlags(unsigned int host) {
     constexpr std::pair<unsigned int, std::uint32_t> flags[] = {
@@ -288,6 +284,7 @@ int HostEntries(std::vector<Entry>& entries) {
     try {
         for (auto* item = host; item; item = item->ifa_next) {
             if (!item->ifa_addr) continue;
+#ifdef __linux__
             if (item->ifa_addr->sa_family == AF_PACKET) {
                 const auto& link = *reinterpret_cast<const sockaddr_ll*>(item->ifa_addr);
                 HostInterface& owner = interfaceFor(CheckedName(item->ifa_name));
@@ -302,6 +299,7 @@ int HostEntries(std::vector<Entry>& entries) {
                 owner.linked = true;
                 continue;
             }
+#endif
             if (item->ifa_addr->sa_family != AF_INET && item->ifa_addr->sa_family != AF_INET6) continue;
             if (!item->ifa_netmask) throw std::runtime_error(std::string("getifaddrs: host address without a netmask on ") + item->ifa_name);
             Entry entry{CheckedName(item->ifa_name), InterfaceFlags(item->ifa_flags), GuestAddress(item->ifa_addr), GuestAddress(item->ifa_netmask), {}};
diff --git a/core/libs/prx/libc/src/LocaleSupport.cpp b/core/libs/prx/libc/src/LocaleSupport.cpp
index a4388c8dfe..2546de6389 100644
--- a/core/libs/prx/libc/src/LocaleSupport.cpp
+++ b/core/libs/prx/libc/src/LocaleSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <climits>
 #include <clocale>
 #include <cstddef>
@@ -24,11 +25,6 @@
 #include "prx/libc/include/GuestLocale.hpp"
 #include "SceTypes.hpp"
 
-extern "C" {
-void* APS5_VABI _Znwm_nid_postfix(std::size_t size);
-void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
-}
-
 namespace {
 
 std::mutex g_localeInitMutex;
@@ -110,6 +106,7 @@ void APS5_VABI DestroyCollate(GuestLocale::Facet*) {}
 void APS5_VABI DeleteCollate(GuestLocale::Facet* self) {
     if (self == nullptr) throw std::invalid_argument("collate delete: null facet");
     _ZdlPv_nid_postfix(self);
+
 }
 
 void APS5_VABI RetainFacet(GuestLocale::Facet* self) {
@@ -220,6 +217,83 @@ std::int64_t APS5_VABI WideCollateHash(const GuestLocale::CollateFacet*, const c
 
 const GuestLocale::CollateVtable g_wideCollateVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, WideCollateCompare, WideCollateTransform, WideCollateHash};
 
+bool APS5_VABI CodecvtAlwaysNoconv(const GuestLocale::Facet*) {
+    return true;
+}
+
+int APS5_VABI CodecvtConstantOne(const GuestLocale::Facet*) {
+    return 1;
+}
+
+int APS5_VABI CodecvtNoConversion(GuestLocale::Facet*, std::uint64_t*, const char* first1, const char*, const char** next1, char* first3, char*, char** next3) {
+    *next1 = first1;
+    *next3 = first3;
+    return 3;
+}
+
+int APS5_VABI CodecvtUnshift(GuestLocale::Facet*, std::uint64_t*, char* first3, char*, char** next3) {
+    *next3 = first3;
+    return 0;
+}
+
+std::size_t APS5_VABI CodecvtLength(GuestLocale::Facet*, std::uint64_t*, const char* first1, const char* last1, std::size_t count) {
+    return std::min(static_cast<std::size_t>(last1 - first1), count);
+}
+
+const GuestLocale::CodecvtVtable g_codecvtVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, CodecvtAlwaysNoconv, CodecvtConstantOne, CodecvtConstantOne, CodecvtNoConversion, CodecvtNoConversion, CodecvtUnshift, CodecvtLength};
+
+GuestLocale::String* APS5_VABI AssignCString(GuestLocale::String* result, const char* source) {
+    if (result == nullptr || source == nullptr) throw std::invalid_argument("numpunct string: null argument");
+    const std::size_t length = std::strlen(source);
+    char* data = result->buffer;
+    std::size_t capacity = GuestStringInlineCapacity;
+    if (length > GuestStringInlineCapacity) {
+        capacity = length | GuestStringCapacityMask;
+        data = static_cast<char*>(AllocateStringStorage(capacity + 1));
+    }
+    if (length != 0) std::memcpy(data, source, length);
+    data[length] = 0;
+    if (data != result->buffer) result->pointer = data;
+    result->size = length;
+    result->capacity = capacity;
+    return result;
+}
+
+char APS5_VABI NumpunctDecimalPoint(const GuestLocale::NumpunctFacet* self) {
+    return self->decimalPoint;
+}
+
+char APS5_VABI NumpunctThousandsSep(const GuestLocale::NumpunctFacet* self) {
+    return self->thousandsSep;
+}
+
+GuestLocale::String* APS5_VABI NumpunctGrouping(GuestLocale::String* result, const GuestLocale::NumpunctFacet* self) {
+    return AssignCString(result, self->grouping);
+}
+
+GuestLocale::String* APS5_VABI NumpunctFalsename(GuestLocale::String* result, const GuestLocale::NumpunctFacet* self) {
+    return AssignCString(result, self->falsename);
+}
+
+GuestLocale::String* APS5_VABI NumpunctTruename(GuestLocale::String* result, const GuestLocale::NumpunctFacet* self) {
+    return AssignCString(result, self->truename);
+}
+
+const GuestLocale::NumpunctVtable g_numpunctVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, NumpunctDecimalPoint, NumpunctThousandsSep, NumpunctGrouping, NumpunctFalsename, NumpunctTruename};
+
+void APS5_VABI NumPutMethodUnsupported() {
+    NotImplemented_nid_no_patch("num_put<char>::do_put");
+}
+
+void APS5_VABI TimePutMethodUnsupported() {
+    NotImplemented_nid_no_patch("time_put<char>::do_put");
+}
+
+const GuestLocale::UnsupportedMethodsVtable g_numPutVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, {NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported, NumPutMethodUnsupported}};
+const GuestLocale::UnsupportedMethodsVtable g_timePutVtable{{DestroyCollate, DeleteCollate, RetainFacet, ReleaseFacet}, {TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported, TimePutMethodUnsupported}};
+
+constexpr std::size_t GuestTimePutFacetSize = 0xb8;
+
 constexpr std::array<short, 257> MakeClassificationTable() {
     std::array<short, 257> table{};
     for (unsigned int value = 0; value < 256; ++value) {
@@ -287,6 +361,8 @@ int APS5_VABI isprint_nid_postfix(int c) { return ClassifyCharacter(c, std::ctyp
 int APS5_VABI isgraph_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::graph); }
 int APS5_VABI ispunct_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::punct); }
 int APS5_VABI isxdigit_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::xdigit); }
+int APS5_VABI isascii_nid_postfix(int c) { return (c & ~0x7F) == 0; }
+int APS5_VABI toascii_nid_postfix(int c) { return c & 0x7F; }
 int APS5_VABI toupper_nid_postfix(int c) { return ConvertCharacter(c, true); }
 int APS5_VABI tolower_nid_postfix(int c) { return ConvertCharacter(c, false); }
 
@@ -294,10 +370,19 @@ std::uint64_t _ZNSt5ctypeIcE2idE_nid_postfix = 0;
 std::uint64_t _ZNSt5ctypeIwE2idE_nid_postfix = 0;
 std::uint64_t _ZNSt7collateIwE2idE_nid_postfix = 0;
 std::uint64_t _ZNSt7collateIcE2idE_nid_postfix = 0;
+std::uintptr_t _ZTVSt7collateIcE_nid_postfix[9] {};
 std::uint64_t _ZNSt7codecvtIcc9_MbstatetE2idE_nid_postfix = 0;
 std::uintptr_t _ZTVSt7codecvtIcc9_MbstatetE_nid_postfix[16] {};
+std::uintptr_t _ZTVSt7codecvtIwc9_MbstatetE_nid_postfix[13] {};
 std::uint64_t _ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
 std::uintptr_t _ZTVSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[12] {};
+std::uint64_t _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+std::uintptr_t _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[17] {};
+std::uint64_t _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+std::uint64_t _ZNSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE2idE_nid_postfix = 0;
+std::uintptr_t _ZTVSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[14] {};
+std::uint64_t _ZNSt8numpunctIcE2idE_nid_postfix = 0;
+std::uint64_t _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
 
 std::streamoff _ZSt7_BADOFF_nid_postfix = -1;
 std::fpos_t _ZSt4_Fpz_nid_postfix {};
@@ -323,11 +408,6 @@ GuestLocale::IosBase* APS5_VABI SetStreamWidth(GuestLocale::IosBase* stream, std
     return stream;
 }
 
-struct StreamManipulator {
-    GuestLocale::IosBase* (APS5_VABI* function)(GuestLocale::IosBase*, std::int32_t);
-    std::int32_t argument;
-};
-
 static_assert(sizeof(StreamManipulator) == 0x10);
 
 StreamManipulator APS5_VABI _ZSt4setwi_nid_postfix(std::int32_t width) {
@@ -367,9 +447,7 @@ GuestLocale::Implementation* APS5_VABI _ZNSt6locale16_GetgloballocaleEv_nid_post
 }
 
 namespace {
-struct GuestLocaleFacade {
-    GuestLocale::Implementation* implementation;
-};
+
 GuestLocaleFacade g_classicLocaleFacade{&g_classicLocale};
 }
 
@@ -397,6 +475,43 @@ std::size_t APS5_VABI _ZNSt7collateIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_pos
     return 1;
 }
 
+std::size_t APS5_VABI _ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* object = static_cast<GuestLocale::Facet*>(_Znwm_nid_postfix(sizeof(GuestLocale::Facet)));
+        *object = {&g_codecvtVtable.facet, 0, 0};
+        *facet = object;
+    }
+    return 2;
+}
+
+std::size_t APS5_VABI _ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* punct = static_cast<GuestLocale::NumpunctFacet*>(_Znwm_nid_postfix(sizeof(GuestLocale::NumpunctFacet)));
+        *punct = {{&g_numpunctVtable.facet, 0, 0}, "", '.', ',', "false", "true"};
+        *facet = &punct->base;
+    }
+    return 4;
+}
+
+std::size_t APS5_VABI _ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* object = static_cast<GuestLocale::Facet*>(_Znwm_nid_postfix(sizeof(GuestLocale::Facet)));
+        *object = {&g_numPutVtable.facet, 0, 0};
+        *facet = object;
+    }
+    return 4;
+}
+
+std::size_t APS5_VABI _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const*) {
+    if (facet != nullptr && *facet == nullptr) {
+        auto* object = static_cast<GuestLocale::Facet*>(_Znwm_nid_postfix(GuestTimePutFacetSize));
+        std::memset(object, 0, GuestTimePutFacetSize);
+        object->vtable = &g_timePutVtable.facet;
+        *facet = object;
+    }
+    return 5;
+}
+
 void APS5_VABI _ZNSt8_LocinfoC1EPKc_nid_postfix(GuestLocale::LocinfoStorage* self, const char* localeName) {
     if (self == nullptr || localeName == nullptr || std::strcmp(localeName, "C") != 0) throw std::invalid_argument("_Locinfo: only the C locale is supported");
     new (self) GuestLocale::LocinfoStorage{};
@@ -464,9 +579,11 @@ std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t c, std::uint64_t de
 std::uint64_t _ZNSt7codecvtIwc9_MbstatetE2idE_nid_postfix = 0;
 alignas(16) unsigned char _ZSt4cout_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt4cerr_nid_postfix[0x400] {};
+alignas(16) unsigned char _ZSt4clog_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt3cin_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt5wcout_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt5wcerr_nid_postfix[0x400] {};
+alignas(16) unsigned char _ZSt5wclog_nid_postfix[0x400] {};
 alignas(16) unsigned char _ZSt4wcin_nid_postfix[0x400] {};
 
 // Facet vectors are read by inlined guest code, so they come from the guest application heap.
@@ -511,6 +628,7 @@ void APS5_VABI _init_env_nid_postfix() {
 void APS5_VABI init_env_nid_postfix(const InitEnvParams* params) {
     (void)params;
     _init_env_nid_postfix();
+
 }
 
 SonyLconv* APS5_VABI localeconv_nid_postfix(void) {
diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp
index bfed7a8a4d..d4732e12f3 100644
--- a/core/libs/prx/libc/src/Math.cpp
+++ b/core/libs/prx/libc/src/Math.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include <mutex>
+#include <array>
 #include <bit>
 #include <cstddef>
 #include <cstdint>
@@ -226,7 +228,6 @@ T GuestFmax(T x, T y) {
 }
 
 float GuestBesselSecondKindZero() {
-    std::feraiseexcept(FE_DIVBYZERO);
     return -std::numeric_limits<float>::infinity();
 }
 
@@ -290,7 +291,12 @@ std::int64_t APS5_VABI imaxabs_nid_postfix(std::int64_t x) {
     return labs_nid_postfix(x);
 }
 
-float APS5_VABI fmodf_nid_postfix(float x, float y) { return std::fmod(x, y); }
+float APS5_VABI fmodf_nid_postfix(float x, float y) {
+    const int saved_errno = errno;
+    const float result = std::fmod(x, y);
+    errno = saved_errno;
+    return result;
+}
 float APS5_VABI asinf_nid_postfix(float x) {
     const int saved_errno = errno;
     const float result = std::asin(x);
@@ -321,7 +327,6 @@ double APS5_VABI hypot_nid_postfix(double x, double y) {
     }
     return std::hypot(x, y);
 }
-float APS5_VABI tanf_nid_postfix(float x) { return std::tan(x); }
 float APS5_VABI log10f_nid_postfix(float x) { return std::log10(x); }
 float APS5_VABI logbf_nid_postfix(float x) { return std::logb(x); }
 double APS5_VABI exp2_nid_postfix(double x) {
@@ -458,7 +463,105 @@ double APS5_VABI log2_nid_postfix(double x) { return std::log2(x); }
 double APS5_VABI log_nid_postfix(double x) { return std::log(x); }
 double APS5_VABI log1p_nid_postfix(double x) { return std::log1p(x); }
 float APS5_VABI log1pf_nid_postfix(float x) { return std::log1p(x); }
-double APS5_VABI expm1_nid_postfix(double x) { return std::expm1(x); }
+static double Expm1(double x) {
+    const double tiny = 1.0e-300;
+    const double o_threshold = 7.09782712893383973096e+02;
+    const double ln2_hi = 6.93147180369123816490e-01;
+    const double ln2_lo = 1.90821492927058770002e-10;
+    const double invln2 = 1.44269504088896338700e+00;
+    const double Q1 = -3.33333333333331316428e-02;
+    const double Q2 = 1.58730158725481460165e-03;
+    const double Q3 = -7.93650757867487942473e-05;
+    const double Q4 = 4.00821782732936239552e-06;
+    const double Q5 = -2.01099218183624371326e-07;
+    static volatile double huge = 1.0e+300;
+    const std::uint64_t bits = std::bit_cast<std::uint64_t>(x);
+    std::uint32_t hx = static_cast<std::uint32_t>(bits >> 32);
+    const std::uint32_t xsb = hx & 0x80000000u;
+    hx &= 0x7fffffff;
+    if (hx >= 0x4043687a) {
+        if (hx >= 0x40862e42) {
+            if (hx >= 0x7ff00000) {
+                if (((hx & 0xfffff) | static_cast<std::uint32_t>(bits)) != 0) return x + x;
+                return xsb == 0 ? x : -1.0;
+            }
+            if (x > o_threshold) return huge * huge;
+        }
+        if (xsb != 0 && x + tiny < 0.0) return tiny - 1.0;
+    }
+    double c = 0.0;
+    std::int32_t k;
+    if (hx > 0x3fd62e42) {
+        double hi;
+        double lo;
+        if (hx < 0x3ff0a2b2) {
+            if (xsb == 0) {
+                hi = x - ln2_hi;
+                lo = ln2_lo;
+                k = 1;
+            } else {
+                hi = x + ln2_hi;
+                lo = -ln2_lo;
+                k = -1;
+            }
+        } else {
+            k = static_cast<std::int32_t>(invln2 * x + (xsb == 0 ? 0.5 : -0.5));
+            const double t = k;
+            hi = x - t * ln2_hi;
+            lo = t * ln2_lo;
+        }
+        x = hi - lo;
+        c = (hi - x) - lo;
+    } else if (hx < 0x3c900000) {
+        const double t = huge + x;
+        return x - (t - (huge + x));
+    } else {
+        k = 0;
+    }
+    const double hfx = 0.5 * x;
+    const double hxs = x * hfx;
+    const double r1 = 1.0 + hxs * (Q1 + hxs * (Q2 + hxs * (Q3 + hxs * (Q4 + hxs * Q5))));
+    double t = 3.0 - r1 * hfx;
+    double e = hxs * ((r1 - t) / (6.0 - x * t));
+    if (k == 0) return x - (x * e - hxs);
+    const double twopk = std::bit_cast<double>(static_cast<std::uint64_t>(static_cast<std::uint32_t>(0x3ff + k) << 20) << 32);
+    e = (x * (e - c) - c);
+    e -= hxs;
+    if (k == -1) return 0.5 * (x - e) - 0.5;
+    if (k == 1) {
+        if (x < -0.25) return -2.0 * (e - (x + 0.5));
+        return 1.0 + 2.0 * (x - e);
+    }
+    double y;
+    if (k <= -2 || k > 56) {
+        y = 1.0 - (e - x);
+        if (k == 1024) {
+            y = y * 2.0 * 0x1p1023;
+        } else {
+            y = y * twopk;
+        }
+        return y - 1.0;
+    }
+    if (k < 20) {
+        t = std::bit_cast<double>(static_cast<std::uint64_t>(0x3ff00000u - (0x200000u >> k)) << 32);
+        y = t - (e - x);
+        y = y * twopk;
+    } else {
+        t = std::bit_cast<double>(static_cast<std::uint64_t>(static_cast<std::uint32_t>((0x3ff - k) << 20)) << 32);
+        y = x - (e + t);
+        y += 1.0;
+        y = y * twopk;
+    }
+    return y;
+}
+
+double APS5_VABI expm1_nid_postfix(double x) {
+    const double result = Expm1(x);
+    if (std::isinf(result) && std::isfinite(x)) {
+        errno = ERANGE;
+    }
+    return result;
+}
 float APS5_VABI expm1f_nid_postfix(float x) { return std::expm1(x); }
 float APS5_VABI erff_nid_postfix(float x) { return std::erf(x); }
 double APS5_VABI erf_nid_postfix(double x) { return std::erf(x); }
@@ -475,19 +578,311 @@ double APS5_VABI lgamma_nid_postfix(double x) {
     return std::lgamma(x);
 }
 
-float APS5_VABI sinf_nid_postfix(float x) { return std::sin(x); }
-float APS5_VABI cosf_nid_postfix(float x) { return std::cos(x); }
+static const std::int32_t TrigfIpio2[] = {
+    0xA2F983, 0x6E4E44, 0x1529FC, 0x2757D1, 0xF534DD, 0xC0DB62, 0x95993C, 0x439041, 0xFE5163, 0xABDEBB, 0xC561B7, 0x246E3A,
+    0x424DD2, 0xE00649, 0x2EEA09, 0xD1921C, 0xFE1DEB, 0x1CB129, 0xA73EE8, 0x8235F5, 0x2EBB44, 0x84E99C, 0x7026B4, 0x5F7E41,
+    0x3991D6, 0x398353, 0x39F49C, 0x845F8B, 0xBDF928, 0x3B1FF8, 0x97FFDE, 0x05980F, 0xEF2F11, 0x8B5A0A, 0x6D1F6D, 0x367ECF,
+    0x27CB09, 0xB74F46, 0x3F669E, 0x5FEA2D, 0x7527BA, 0xC7EBE5, 0xF17B3D, 0x0739F7, 0x8A5292, 0xEA6BFB, 0x5FB11F, 0x8D5D08,
+    0x560330, 0x46FC7B, 0x6BABF0, 0xCFBC20, 0x9AF436, 0x1DA9E3, 0x91615E, 0xE61B08, 0x659985, 0x5F14A0, 0x68408D, 0xFFD880,
+    0x4D7327, 0x310606, 0x1556CA, 0x73A8C9, 0x60E27B, 0xC08C6B,
+};
+
+static const double TrigfPio2Parts[] = {
+    1.57079625129699707031e+00, 7.54978941586159635335e-08, 5.39030252995776476554e-15, 3.28200341580791294123e-22,
+    1.27065575308067607349e-29, 1.22933308981111328932e-36, 2.73370053816464559624e-44, 2.16741683877804819444e-51,
+};
+
+static int TrigfKernelRemPio2(const double* x, double* y, int e0) {
+    const double two24 = 1.67772160000000000000e+07, twon24 = 5.96046447753906250000e-08;
+    std::int32_t jz, jv, jp, jk, carry, n, iq[20], i, j, k, m, q0, ih;
+    double z, fw, f[20], fq[20], q[20];
+    const std::int32_t jx = 0;
+    jk = 3;
+    jp = jk;
+    jv = (e0 - 3) / 24;
+    if (jv < 0) jv = 0;
+    q0 = e0 - 24 * (jv + 1);
+    j = jv - jx;
+    m = jx + jk;
+    for (i = 0; i <= m; i++, j++) f[i] = j < 0 ? 0.0 : static_cast<double>(TrigfIpio2[j]);
+    for (i = 0; i <= jk; i++) {
+        for (j = 0, fw = 0.0; j <= jx; j++) fw += x[j] * f[jx + i - j];
+        q[i] = fw;
+    }
+    jz = jk;
+recompute:
+    for (i = 0, j = jz, z = q[jz]; j > 0; i++, j--) {
+        fw = static_cast<double>(static_cast<std::int32_t>(twon24 * z));
+        iq[i] = static_cast<std::int32_t>(z - two24 * fw);
+        z = q[j - 1] + fw;
+    }
+    z = std::scalbn(z, q0);
+    z -= 8.0 * std::floor(z * 0.125);
+    n = static_cast<std::int32_t>(z);
+    z -= static_cast<double>(n);
+    ih = 0;
+    if (q0 > 0) {
+        i = iq[jz - 1] >> (24 - q0);
+        n += i;
+        iq[jz - 1] -= i << (24 - q0);
+        ih = iq[jz - 1] >> (23 - q0);
+    } else if (q0 == 0) {
+        ih = iq[jz - 1] >> 23;
+    } else if (z >= 0.5) {
+        ih = 2;
+    }
+    if (ih > 0) {
+        n += 1;
+        carry = 0;
+        for (i = 0; i < jz; i++) {
+            j = iq[i];
+            if (carry == 0) {
+                if (j != 0) {
+                    carry = 1;
+                    iq[i] = 0x1000000 - j;
+                }
+            } else {
+                iq[i] = 0xffffff - j;
+            }
+        }
+        if (q0 > 0) {
+            switch (q0) {
+                case 1: iq[jz - 1] &= 0x7fffff; break;
+                case 2: iq[jz - 1] &= 0x3fffff; break;
+            }
+        }
+        if (ih == 2) {
+            z = 1.0 - z;
+            if (carry != 0) z -= std::scalbn(1.0, q0);
+        }
+    }
+    if (z == 0.0) {
+        j = 0;
+        for (i = jz - 1; i >= jk; i--) j |= iq[i];
+        if (j == 0) {
+            for (k = 1; iq[jk - k] == 0; k++) {
+            }
+            for (i = jz + 1; i <= jz + k; i++) {
+                f[jx + i] = static_cast<double>(TrigfIpio2[jv + i]);
+                for (j = 0, fw = 0.0; j <= jx; j++) fw += x[j] * f[jx + i - j];
+                q[i] = fw;
+            }
+            jz += k;
+            goto recompute;
+        }
+    }
+    if (z == 0.0) {
+        jz -= 1;
+        q0 -= 24;
+        while (iq[jz] == 0) {
+            jz--;
+            q0 -= 24;
+        }
+    } else {
+        z = std::scalbn(z, -q0);
+        if (z >= two24) {
+            fw = static_cast<double>(static_cast<std::int32_t>(twon24 * z));
+            iq[jz] = static_cast<std::int32_t>(z - two24 * fw);
+            jz += 1;
+            q0 += 24;
+            iq[jz] = static_cast<std::int32_t>(fw);
+        } else {
+            iq[jz] = static_cast<std::int32_t>(z);
+        }
+    }
+    fw = std::scalbn(1.0, q0);
+    for (i = jz; i >= 0; i--) {
+        q[i] = fw * static_cast<double>(iq[i]);
+        fw *= twon24;
+    }
+    for (i = jz; i >= 0; i--) {
+        for (fw = 0.0, k = 0; k <= jp && k <= jz - i; k++) fw += TrigfPio2Parts[k] * q[i + k];
+        fq[jz - i] = fw;
+    }
+    fw = 0.0;
+    for (i = jz; i >= 0; i--) fw += fq[i];
+    y[0] = ih == 0 ? fw : -fw;
+    return n & 7;
+}
+
+static int TrigfRemPio2(float x, double* y) {
+    const double invpio2 = 6.36619772367581382433e-01, pio2_1 = 1.57079631090164184570e+00, pio2_1t = 1.58932547735281966916e-08;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix < 0x4dc90fdb) {
+        volatile double rounded = x * invpio2 + 0x1.8p52;
+        double fn = rounded;
+        fn = fn - 0x1.8p52;
+        const std::int32_t n = static_cast<std::int32_t>(fn);
+        const double r = x - fn * pio2_1;
+        const double w = fn * pio2_1t;
+        *y = r - w;
+        return n;
+    }
+    if (ix >= 0x7f800000) {
+        *y = x - x;
+        return 0;
+    }
+    const std::int32_t e0 = (ix >> 23) - 150;
+    const float z = std::bit_cast<float>(ix - static_cast<std::int32_t>(static_cast<std::uint32_t>(e0) << 23));
+    double tx[1] = {z}, ty[1];
+    const int n = TrigfKernelRemPio2(tx, ty, e0);
+    if (hx < 0) {
+        *y = -ty[0];
+        return -n;
+    }
+    *y = ty[0];
+    return n;
+}
+
+static float TrigfKernelSin(double x) {
+    const double S1 = -0x15555554cbac77.0p-55, S2 = 0x111110896efbb2.0p-59, S3 = -0x1a00f9e2cae774.0p-65, S4 = 0x16cd878c3b46a7.0p-71;
+    const double z = x * x, w = z * z, r = S3 + z * S4, s = z * x;
+    return static_cast<float>((x + s * (S1 + z * S2)) + s * w * r);
+}
+
+static float TrigfKernelCos(double x) {
+    const double C0 = -0x1ffffffd0c5e81.0p-54, C1 = 0x155553e1053a42.0p-57, C2 = -0x16c087e80f1e27.0p-62, C3 = 0x199342e0ee5069.0p-68;
+    const double z = x * x, w = z * z, r = C2 + z * C3;
+    return static_cast<float>(((1.0 + z * C0) + w * C1) + (w * z) * r);
+}
+
+float APS5_VABI sinf_nid_postfix(float x) {
+    const double s1pio2 = std::bit_cast<double>(0x3FF921FB54442D18ull), s2pio2 = std::bit_cast<double>(0x400921FB54442D18ull);
+    const double s3pio2 = std::bit_cast<double>(0x4012D97C7F3321D2ull), s4pio2 = std::bit_cast<double>(0x401921FB54442D18ull);
+    double y;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix <= 0x3f490fda) {
+        if (ix < 0x39800000)
+            if (static_cast<int>(x) == 0) return x;
+        return TrigfKernelSin(x);
+    }
+    if (ix <= 0x407b53d1) {
+        if (ix <= 0x4016cbe3) return hx > 0 ? TrigfKernelCos(x - s1pio2) : -TrigfKernelCos(x + s1pio2);
+        return TrigfKernelSin((hx > 0 ? s2pio2 : -s2pio2) - x);
+    }
+    if (ix <= 0x40e231d5) {
+        if (ix <= 0x40afeddf) return hx > 0 ? -TrigfKernelCos(x - s3pio2) : TrigfKernelCos(x + s3pio2);
+        return TrigfKernelSin(x + (hx > 0 ? -s4pio2 : s4pio2));
+    }
+    if (ix >= 0x7f800000) {
+        if (ix == 0x7f800000) errno = EDOM;
+        return x - x;
+    }
+    const int n = TrigfRemPio2(x, &y);
+    switch (n & 3) {
+        case 0: return TrigfKernelSin(y);
+        case 1: return TrigfKernelCos(y);
+        case 2: return TrigfKernelSin(-y);
+        default: return -TrigfKernelCos(y);
+    }
+}
+
+static const double TrigfPio2[5] = {0.0, std::bit_cast<double>(0x3FF921FB54442D18ull), std::bit_cast<double>(0x400921FB54442D18ull),
+                                std::bit_cast<double>(0x4012D97C7F3321D2ull), std::bit_cast<double>(0x401921FB54442D18ull)};
+
+float APS5_VABI cosf_nid_postfix(float x) {
+    double y;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix <= 0x3f490fda) {
+        if (ix < 0x39800000)
+            if (static_cast<int>(x) == 0) return 1.0f;
+        return TrigfKernelCos(x);
+    }
+    if (ix <= 0x407b53d1) {
+        if (ix > 0x4016cbe3) return -TrigfKernelCos(x + (hx > 0 ? -TrigfPio2[2] : TrigfPio2[2]));
+        return hx > 0 ? TrigfKernelSin(TrigfPio2[1] - x) : TrigfKernelSin(x + TrigfPio2[1]);
+    }
+    if (ix <= 0x40e231d5) {
+        if (ix > 0x40afeddf) return TrigfKernelCos(x + (hx > 0 ? -TrigfPio2[4] : TrigfPio2[4]));
+        return hx > 0 ? TrigfKernelSin(x - TrigfPio2[3]) : TrigfKernelSin(-TrigfPio2[3] - x);
+    }
+    if (ix >= 0x7f800000) {
+        if (ix == 0x7f800000) errno = EDOM;
+        return x - x;
+    }
+    const int n = TrigfRemPio2(x, &y);
+    switch (n & 3) {
+        case 0: return TrigfKernelCos(y);
+        case 1: return TrigfKernelSin(-y);
+        case 2: return -TrigfKernelCos(y);
+        default: return TrigfKernelSin(y);
+    }
+}
+
+static float TrigfKernelTan(double x, int iy) {
+    static const double T[] = {0x15554d3418c99f.0p-54, 0x1112fd38999f72.0p-55, 0x1b54c91d865afe.0p-57,
+                               0x191df3908c33ce.0p-58, 0x185dadfcecf44e.0p-61, 0x1362b9bf971bcd.0p-59};
+    const double z = x * x;
+    double r = T[4] + z * T[5];
+    const double t = T[2] + z * T[3];
+    const double w = z * z;
+    const double s = z * x;
+    const double u = T[0] + z * T[1];
+    r = (x + s * u) + (s * w) * (t + w * r);
+    if (iy == 1) return static_cast<float>(r);
+    return static_cast<float>(-1.0 / r);
+}
+
+float APS5_VABI tanf_nid_postfix(float x) {
+    double y;
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix <= 0x3f490fda) {
+        if (ix < 0x39800000)
+            if (static_cast<int>(x) == 0) return x;
+        return TrigfKernelTan(x, 1);
+    }
+    if (ix <= 0x407b53d1) {
+        if (ix <= 0x4016cbe3) return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[1] : TrigfPio2[1]), -1);
+        return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[2] : TrigfPio2[2]), 1);
+    }
+    if (ix <= 0x40e231d5) {
+        if (ix <= 0x40afeddf) return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[3] : TrigfPio2[3]), -1);
+        return TrigfKernelTan(x + (hx > 0 ? -TrigfPio2[4] : TrigfPio2[4]), 1);
+    }
+    if (ix >= 0x7f800000) {
+        if (ix == 0x7f800000) errno = EDOM;
+        return x - x;
+    }
+    const int n = TrigfRemPio2(x, &y);
+    return TrigfKernelTan(y, 1 - ((n & 1) << 1));
+}
 
 void APS5_VABI sincosf_nid_postfix(float x, float* sinp, float* cosp) {
-    *sinp = std::sin(x);
-    *cosp = std::cos(x);
+    *sinp = sinf_nid_postfix(x);
+    *cosp = cosf_nid_postfix(x);
 }
 
 double APS5_VABI sin_nid_postfix(double x) { return std::sin(x); }
 double APS5_VABI cos_nid_postfix(double x) { return std::cos(x); }
 double APS5_VABI sinh_nid_postfix(double x) { return std::sinh(x); }
 double APS5_VABI cosh_nid_postfix(double x) { return std::cosh(x); }
-float APS5_VABI coshf_nid_postfix(float x) { return std::cosh(x); }
+float APS5_VABI coshf_nid_postfix(float x) {
+    const std::uint32_t magnitude = std::bit_cast<std::uint32_t>(x) & 0x7fffffffu;
+    if (magnitude >= 0x7f800000u) return x * x;
+    const float absolute = std::fabs(x);
+    if (magnitude < 0x3eb17218u) {
+        const float t = SinhfExpm1(absolute);
+        const float w = 1.0f + t;
+        if (magnitude < 0x39800000u) return 1.0f;
+        return 1.0f + (t * t) / (w + w);
+    }
+    if (magnitude < 0x41100000u) {
+        const float t = SinhfExp(absolute);
+        return 0.5f * t + 0.5f / t;
+    }
+    if (magnitude < 0x42b17217u) return 0.5f * SinhfExp(absolute);
+    if (magnitude <= 0x42b2d4fcu) {
+        const float w = SinhfExp(0.5f * absolute);
+        const float t = 0.5f * w;
+        return t * w;
+    }
+    volatile float huge = 1.0e30f;
+    return huge * huge;
+}
 
 float APS5_VABI sinhf_nid_postfix(float x) {
     const std::uint32_t magnitude = std::bit_cast<std::uint32_t>(x) & 0x7fffffffu;
@@ -512,7 +907,21 @@ float APS5_VABI sinhf_nid_postfix(float x) {
 double APS5_VABI asinh_nid_postfix(double x) { return std::asinh(x); }
 float APS5_VABI asinhf_nid_postfix(float x) { return std::asinh(x); }
 double APS5_VABI acosh_nid_postfix(double x) { return std::acosh(x); }
-float APS5_VABI acoshf_nid_postfix(float x) { return std::acosh(x); }
+float APS5_VABI acoshf_nid_postfix(float x) {
+    constexpr float ln2 = 6.9314718246e-01f;
+    const std::uint32_t bits = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t magnitude = bits & 0x7fffffffu;
+    if ((bits & 0x80000000u) != 0 || magnitude < 0x3f800000u) return (x - x) / (x - x);
+    if (magnitude >= 0x7f800000u) return x + x;
+    if (magnitude == 0x3f800000u) return 0.0f;
+    if (magnitude >= 0x4d800000u) return std::log(x) + ln2;
+    if (magnitude > 0x40000000u) {
+        const float square = x * x;
+        return std::log(2.0f * x - 1.0f / (x + std::sqrt(square - 1.0f)));
+    }
+    const float t = x - 1.0f;
+    return AtanhfLog1p(t + std::sqrt(2.0f * t + t * t));
+}
 double APS5_VABI atanh_nid_postfix(double x) { return std::atanh(x); }
 
 float APS5_VABI atanhf_nid_postfix(float x) {
@@ -539,7 +948,50 @@ void APS5_VABI sincos_nid_postfix(double x, double* sinp, double* cosp) {
     *cosp = std::cos(x);
 }
 
-float APS5_VABI atanf_nid_postfix(float x) { return std::atan(x); }
+float APS5_VABI atanf_nid_postfix(float x) {
+    static constexpr float atanhi[] = {static_cast<float>(4.6364760399e-01), static_cast<float>(7.8539812565e-01), static_cast<float>(9.8279368877e-01), static_cast<float>(1.5707962513e+00)};
+    static constexpr float atanlo[] = {static_cast<float>(5.0121582440e-09), static_cast<float>(3.7748947079e-08), static_cast<float>(3.4473217170e-08), static_cast<float>(7.5497894159e-08)};
+    static constexpr float aT[] = {static_cast<float>(3.3333328366e-01), static_cast<float>(-1.9999158382e-01), static_cast<float>(1.4253635705e-01), static_cast<float>(-1.0648017377e-01), static_cast<float>(6.1687607318e-02)};
+    const std::int32_t hx = std::bit_cast<std::int32_t>(x);
+    const std::int32_t ix = hx & 0x7fffffff;
+    if (ix >= 0x4c800000) {
+        if (ix > 0x7f800000) {
+            return x + x;
+        }
+        const volatile float lo = atanlo[3];
+        return hx > 0 ? atanhi[3] + lo : -atanhi[3] - lo;
+    }
+    int id = -1;
+    if (ix < 0x3ee00000) {
+        if (ix < 0x39800000) {
+            return x;
+        }
+    } else {
+        x = std::fabs(x);
+        if (ix < 0x3f300000) {
+            id = 0;
+            x = (2.0f * x - 1.0f) / (2.0f + x);
+        } else if (ix < 0x3f980000) {
+            id = 1;
+            x = (x - 1.0f) / (x + 1.0f);
+        } else if (ix < 0x401c0000) {
+            id = 2;
+            x = (x - 1.5f) / (1.0f + 1.5f * x);
+        } else {
+            id = 3;
+            x = -1.0f / x;
+        }
+    }
+    const float z = x * x;
+    const float w = z * z;
+    const float s1 = z * (aT[0] + w * (aT[2] + w * aT[4]));
+    const float s2 = w * (aT[1] + w * aT[3]);
+    if (id < 0) {
+        return x - x * (s1 + s2);
+    }
+    const float result = atanhi[id] - ((x * (s1 + s2) - atanlo[id]) - x);
+    return hx < 0 ? -result : result;
+}
 double APS5_VABI atan2_nid_postfix(double y, double x) { return std::atan2(y, x); }
 float APS5_VABI powf_nid_postfix(float base, float exp) {
     if (base == 1.0f) return 1.0f;
@@ -572,7 +1024,62 @@ double APS5_VABI __powidf2_nid_postfix(double base, int exponent) {
 }
 float APS5_VABI expf_nid_postfix(float x) { return std::exp(x); }
 float APS5_VABI exp2f_nid_postfix(float x) { return std::exp2(x); }
-float APS5_VABI logf_nid_postfix(float x) { return std::log(x); }
+float APS5_VABI logf_nid_postfix(float x) {
+    const float ln2_hi = static_cast<float>(6.9313812256e-01);
+    const float ln2_lo = static_cast<float>(9.0580006145e-06);
+    const float two25 = static_cast<float>(3.355443200e+07);
+    const float Lg1 = 0xaaaaaa.0p-24f;
+    const float Lg2 = 0xccce13.0p-25f;
+    const float Lg3 = 0x91e9ee.0p-25f;
+    const float Lg4 = 0xf89e26.0p-26f;
+    static volatile float vzero = 0.0f;
+    std::int32_t k = 0;
+    std::int32_t ix = std::bit_cast<std::int32_t>(x);
+    if (ix < 0x00800000) {
+        if ((ix & 0x7fffffff) == 0) {
+            errno = ERANGE;
+            return -two25 / vzero;
+        }
+        if (ix < 0) {
+            errno = EDOM;
+            return (x - x) / 0.0f;
+        }
+        k -= 25;
+        x *= two25;
+        ix = std::bit_cast<std::int32_t>(x);
+    }
+    if (ix >= 0x7f800000) {
+        return x + x;
+    }
+    k += (ix >> 23) - 127;
+    ix &= 0x007fffff;
+    std::int32_t i = (ix + (0x95f64 << 3)) & 0x800000;
+    x = std::bit_cast<float>(ix | (i ^ 0x3f800000));
+    k += i >> 23;
+    const float f = x - 1.0f;
+    const float dk = static_cast<float>(k);
+    if ((0x007fffff & (0x8000 + ix)) < 0xc000) {
+        if (f == 0.0f) {
+            return k == 0 ? 0.0f : dk * ln2_hi + dk * ln2_lo;
+        }
+        const float R = f * f * (0.5f - static_cast<float>(0.33333333333333333) * f);
+        return k == 0 ? f - R : dk * ln2_hi - ((R - dk * ln2_lo) - f);
+    }
+    const float s = f / (2.0f + f);
+    const float z = s * s;
+    i = ix - (0x6147a << 3);
+    const float w = z * z;
+    const std::int32_t j = (0x6b851 << 3) - ix;
+    const float t1 = w * (Lg2 + w * Lg4);
+    const float t2 = z * (Lg1 + w * Lg3);
+    i |= j;
+    const float R = t2 + t1;
+    if (i > 0) {
+        const float hfsq = 0.5f * f * f;
+        return k == 0 ? f - (hfsq - s * (hfsq + R)) : dk * ln2_hi - ((hfsq - (s * (hfsq + R) + dk * ln2_lo)) - f);
+    }
+    return k == 0 ? f - s * (f - R) : dk * ln2_hi - ((s * (f - R) - dk * ln2_lo) - f);
+}
 float APS5_VABI log2f_nid_postfix(float x) { return std::log2(x); }
 double APS5_VABI log10_nid_postfix(double x) { return std::log10(x); }
 float APS5_VABI ldexpf_nid_postfix(float x, int exp) { return std::ldexp(x, exp); }
@@ -584,7 +1091,33 @@ double APS5_VABI fmod_nid_postfix(double x, double y) {
 }
 float APS5_VABI roundf_nid_postfix(float x) { return std::round(x); }
 double APS5_VABI round_nid_postfix(double x) { return std::round(x); }
-float APS5_VABI cbrtf_nid_postfix(float x) { return std::cbrt(x); }
+float APS5_VABI cbrtf_nid_postfix(float x) {
+    const std::uint32_t B1 = 709958130;
+    const std::uint32_t B2 = 642849266;
+    std::uint32_t hx = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t sign = hx & 0x80000000u;
+    hx ^= sign;
+    if (hx >= 0x7f800000u) {
+        return x + x;
+    }
+    float t;
+    if (hx < 0x00800000u) {
+        if (hx == 0) {
+            return x;
+        }
+        t = 0x1p24f * x;
+        const std::uint32_t high = std::bit_cast<std::uint32_t>(t);
+        t = std::bit_cast<float>(sign | ((high & 0x7fffffffu) / 3 + B2));
+    } else {
+        t = std::bit_cast<float>(sign | (hx / 3 + B1));
+    }
+    double T = t;
+    double r = T * T * T;
+    T = T * (static_cast<double>(x) + x + r) / (x + r + r);
+    r = T * T * T;
+    T = T * (static_cast<double>(x) + x + r) / (x + r + r);
+    return static_cast<float>(T);
+}
 float APS5_VABI remainderf_nid_postfix(float x, float y) { return std::remainder(x, y); }
 float APS5_VABI nextafterf_nid_postfix(float x, float y) { return std::nextafter(x, y); }
 double APS5_VABI nextafter_nid_postfix(double x, double y) { return std::nextafter(x, y); }
@@ -750,18 +1283,53 @@ double APS5_VABI _Sinh_nid_postfix(double x, double y) {
     return SonySinh(x, y);
 }
 
+double APS5_VABI _Cosh_nid_postfix(double x, double y) {
+    if (!std::isfinite(x) || !std::isfinite(y)) return y * std::cosh(x);
+    if (y == 0.0) return std::copysign(0.0, y);
+    constexpr double Ln2High = 0x1.62e42fefa0000p-1;
+    constexpr double Ln2Low = 0x1.cf79abc9e3b3ap-40;
+    constexpr double InverseLn2 = 0x1.71547652b82fep+0;
+    const double magnitude = std::abs(x);
+    if (magnitude <= (std::numeric_limits<double>::max_exponent - 1) * (Ln2High + Ln2Low))
+        return y * std::cosh(x);
+    int scaleExponent;
+    const double scale = std::frexp(y, &scaleExponent);
+    constexpr int MaximumExponentSpan = std::numeric_limits<double>::max_exponent -
+        std::numeric_limits<double>::min_exponent + std::numeric_limits<double>::digits + 4;
+    if (magnitude > MaximumExponentSpan * (Ln2High + Ln2Low))
+        return std::scalbn(scale, INT_MAX);
+    const int exponent = static_cast<int>(magnitude * InverseLn2);
+    const double reduced = std::fma(-exponent, Ln2Low, std::fma(-exponent, Ln2High, magnitude));
+    return std::scalbn(scale * (0.5 * std::exp(reduced)), scaleExponent + exponent);
+}
+
 int APS5_VABI _Fltrounds_nid_postfix(void) {
     return SonyFltrounds();
 }
 
-struct GuestFloatingPointEnvironment {
-    std::uint32_t control;
-    std::uint32_t status;
-    std::uint32_t tag;
-    unsigned char other[16];
-    std::uint32_t mxcsr;
-};
-static_assert(sizeof(GuestFloatingPointEnvironment) == 32 && offsetof(GuestFloatingPointEnvironment, mxcsr) == 28);
+static_assert(sizeof(GuestFloatingPointEnvironment) == 32 && alignof(GuestFloatingPointEnvironment) == 4 && offsetof(GuestFloatingPointEnvironment, mxcsr) == 28);
+
+int APS5_VABI feupdateenv_nid_postfix(const GuestFloatingPointEnvironment* environment) {
+    if (environment == nullptr) throw std::invalid_argument("feupdateenv: null environment");
+    const auto saved = *environment;
+    alignas(16) std::array<std::uint32_t, 128> state;
+    asm volatile("fxsave %0" : "=m"(state));
+    const auto supported = state[7] != 0 ? state[7] : 0xffbfu;
+    if ((saved.mxcsr & ~supported) != 0) throw std::invalid_argument("feupdateenv: unsupported MXCSR bits");
+    std::uint16_t status;
+    asm volatile("fnstsw %0" : "=am"(status));
+    const auto pending = (status | _mm_getcsr()) & 0x3f;
+    asm volatile("fldenv %0" : : "m"(saved) : "st", "st(1)", "st(2)", "st(3)", "st(4)", "st(5)", "st(6)", "st(7)");
+    _mm_setcsr(saved.mxcsr);
+    GuestFloatingPointEnvironment raised;
+    asm volatile("fnstenv %0" : "=m"(raised));
+    raised.status |= pending;
+    const auto mxcsr = _mm_getcsr() | pending;
+    asm volatile("fldenv %0" : : "m"(raised) : "st", "st(1)", "st(2)", "st(3)", "st(4)", "st(5)", "st(6)", "st(7)");
+    _mm_setcsr(mxcsr);
+    asm volatile("fwait");
+    return 0;
+}
 
 int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment* environment) {
     if (environment == nullptr) throw std::invalid_argument("fegetenv: null environment");
@@ -770,6 +1338,15 @@ int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment* environment) {
     return 0;
 }
 
+int APS5_VABI feholdexcept_nid_postfix(GuestFloatingPointEnvironment* environment) {
+    if (environment == nullptr) throw std::invalid_argument("feholdexcept: null environment");
+    const auto csr = _mm_getcsr();
+    asm volatile("fnstenv %0\n\tfnclex" : "=m"(*environment));
+    environment->mxcsr = csr;
+    _mm_setcsr((csr & ~0x3fu) | 0x1f80u);
+    return 0;
+}
+
 union SonyDconst {
     unsigned short _Word[8];
     float _Float;
diff --git a/core/libs/prx/libc/src/MathExact.cpp b/core/libs/prx/libc/src/MathExact.cpp
index 1217ca4a4c..bbfe5114ef 100644
--- a/core/libs/prx/libc/src/MathExact.cpp
+++ b/core/libs/prx/libc/src/MathExact.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cerrno>
 #include <climits>
diff --git a/core/libs/prx/libc/src/Mspace.cpp b/core/libs/prx/libc/src/Mspace.cpp
index 8830e5c75c..53e55f6199 100644
--- a/core/libs/prx/libc/src/Mspace.cpp
+++ b/core/libs/prx/libc/src/Mspace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/MallocManagedSize.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -13,8 +14,6 @@
 #include <stdexcept>
 #include <utility>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 constexpr unsigned MspaceThreadUnsafe = 1;
@@ -322,6 +321,7 @@ void* APS5_VABI sceLibcPafMspaceMemalign_nid_postfix(void* handle, std::size_t a
 void APS5_VABI sceLibcPafMspaceFree_nid_postfix(void* handle, void* pointer, const void* owner) {
     (void)owner;
     sceLibcMspaceFree_nid_postfix(handle, pointer);
+
 }
 
 void* APS5_VABI sceLibcPafMspaceCalloc_nid_postfix(void* handle, std::size_t count, std::size_t size, const void* owner) {
diff --git a/core/libs/prx/libc/src/Multibyte.cpp b/core/libs/prx/libc/src/Multibyte.cpp
index e7dc400ac3..330701624b 100644
--- a/core/libs/prx/libc/src/Multibyte.cpp
+++ b/core/libs/prx/libc/src/Multibyte.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/SonyCrt.hpp"
 #include <array>
@@ -53,6 +54,64 @@ bool DecodeUtf8Byte(unsigned char byte, std::uint64_t& value, std::int8_t& pendi
     return true;
 }
 
+constexpr auto Invalid = static_cast<std::size_t>(-1);
+constexpr auto Incomplete = static_cast<std::size_t>(-2);
+constexpr std::size_t StateSize = 16;
+constexpr std::size_t LocaleMaxLength = 3;
+
+std::size_t LocaleToWide(std::uint16_t* destination, const char* source, std::size_t count, unsigned char* state) {
+    if (!source) {
+        std::memset(state, 0, StateSize);
+        return 0;
+    }
+    if (!count) return Incomplete;
+    std::uint64_t value = 0;
+    std::memcpy(&value, state, sizeof(value));
+    auto pending = static_cast<std::int8_t>(state[PendingOffset]);
+    for (std::size_t consumed = 0; consumed < count;) {
+        const auto byte = static_cast<unsigned char>(source[consumed++]);
+        if ((pending == 0 && byte >= 0xf0) || !DecodeUtf8Byte(byte, value, pending)) {
+            errno = 86;
+            return Invalid;
+        }
+        if (pending == 0) {
+            if (destination) *destination = static_cast<std::uint16_t>(value);
+            StorePending(state, 0);
+            return value == 0 ? 0 : consumed;
+        }
+    }
+    std::memcpy(state, &value, sizeof(value));
+    StorePending(state, pending);
+    return Incomplete;
+}
+
+std::size_t LocaleStringToWide(std::uint16_t* destination, const char** source, std::size_t capacity, unsigned char* state) {
+    const char* cursor = *source;
+    std::size_t converted = 0;
+    while (!destination || converted < capacity) {
+        std::uint16_t value = 0;
+        const std::size_t length = LocaleToWide(&value, cursor, LocaleMaxLength, state);
+        if (length == Invalid || length == Incomplete) {
+            if (destination) *source = cursor;
+            errno = 86;
+            return Invalid;
+        }
+        if (destination) destination[converted] = value;
+        if (length == 0) {
+            if (destination) *source = nullptr;
+            return converted;
+        }
+        cursor += length;
+        ++converted;
+    }
+    *source = cursor;
+    return converted;
+}
+
+int ToInt(std::size_t result) {
+    return result == Invalid || result == Incomplete ? -1 : static_cast<int>(result);
+}
+
 }
 
 extern "C" {
@@ -63,51 +122,47 @@ int APS5_VABI ___mb_cur_max_nid_postfix() {
     return 1;
 }
 
-int APS5_VABI _Getmbcurmax_nid_postfix() { return ___mb_cur_max_nid_postfix(); }
+int APS5_VABI _Getmbcurmax_nid_postfix() { return static_cast<int>(LocaleMaxLength); }
 
-int APS5_VABI mbsinit_nid_postfix(const void*) {
-    return 1;
+int APS5_VABI mbsinit_nid_postfix(const void* state) {
+    if (!state) return 1;
+    std::int16_t pending = 0;
+    std::memcpy(&pending, static_cast<const unsigned char*>(state) + PendingOffset, sizeof(pending));
+    return pending == 0;
 }
 
-std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void*) {
-    if (!source) return 0;
-    if (!count) return static_cast<std::size_t>(-2);
-    const auto value = static_cast<unsigned char>(*source);
-    if (destination) *destination = value;
-    return value != 0;
+std::size_t APS5_VABI mbrtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state) {
+    thread_local unsigned char internal[StateSize]{};
+    if (!source) {
+        destination = nullptr;
+        source = "";
+    }
+    return LocaleToWide(destination, source, count, state ? static_cast<unsigned char*>(state) : internal);
 }
 
 std::size_t APS5_VABI mbrlen_nid_postfix(const char* source, std::size_t count, void* state) {
-    return mbrtowc_nid_postfix(nullptr, source, count, state);
+    thread_local unsigned char internal[StateSize]{};
+    return LocaleToWide(nullptr, source, count, state ? static_cast<unsigned char*>(state) : internal);
 }
 
 int APS5_VABI mbtowc_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count) {
-    const auto result = mbrtowc_nid_postfix(destination, source, count, nullptr);
-    if (result == static_cast<std::size_t>(-2)) {
-        errno = 86;
-        return -1;
-    }
-    return static_cast<int>(result);
+    thread_local unsigned char internal[StateSize]{};
+    return ToInt(LocaleToWide(destination, source, count < LocaleMaxLength ? count : LocaleMaxLength, internal));
 }
 
 std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void*) {
     if (!destination) return 1;
-    if (value > 255) {
-        errno = 86;
-        return static_cast<std::size_t>(-1);
-    }
-    *destination = static_cast<char>(value);
-    return 1;
+    return EncodeUtf8(destination, value);
 }
 
 int APS5_VABI mblen_nid_postfix(const char* source, std::size_t count) {
-    return mbtowc_nid_postfix(nullptr, source, count);
+    unsigned char state[StateSize]{};
+    return ToInt(LocaleToWide(nullptr, source, count, state));
 }
 
 int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value) {
     if (!destination) return 0;
-    const auto result = wcrtomb_nid_postfix(destination, value, nullptr);
-    return result == static_cast<std::size_t>(-1) ? -1 : static_cast<int>(result);
+    return static_cast<int>(EncodeUtf8(destination, value));
 }
 
 std::size_t APS5_VABI c32rtomb_nid_postfix(char* destination, std::uint32_t value, void*) {
@@ -212,29 +267,30 @@ std::size_t APS5_VABI mbrtoc16_nid_postfix(std::uint16_t* destination, const cha
     return static_cast<std::size_t>(-2);
 }
 
-std::size_t APS5_VABI wcsrtombs_nid_postfix(char* destination, const std::uint16_t** source, std::size_t capacity, void* state) {
+std::size_t APS5_VABI wcsrtombs_nid_postfix(char* destination, const std::uint16_t** source, std::size_t capacity, void*) {
     const auto* wide = *source;
-    std::size_t converted = 0;
-    while (!destination || converted < capacity) {
-        char byte;
-        if (wcrtomb_nid_postfix(&byte, wide[converted], state) == static_cast<std::size_t>(-1)) {
-            if (destination) *source = wide + converted;
-            return static_cast<std::size_t>(-1);
+    std::size_t written = 0;
+    for (;; ++wide) {
+        char bytes[LocaleMaxLength];
+        const std::size_t length = EncodeUtf8(bytes, *wide);
+        if (destination) {
+            if (length > capacity - written) {
+                *source = wide;
+                return written;
+            }
+            std::memcpy(destination + written, bytes, length);
         }
-        if (destination) destination[converted] = byte;
-        if (byte == '\0') {
+        if (*wide == 0) {
             if (destination) *source = nullptr;
-            return converted;
+            return written;
         }
-        ++converted;
+        written += length;
     }
-    *source = wide + converted;
-    return converted;
 }
 
-int APS5_VABI wcsrtombs_s_nid_postfix(
+static int WideToLocaleChecked(
     std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t** source, std::size_t limit,
-    void* state
+    void* state, bool stopAtLimit
 ) {
     constexpr int GuestEinval = 22;
     constexpr int GuestErange = 34;
@@ -275,6 +331,7 @@ int APS5_VABI wcsrtombs_s_nid_postfix(
             *result = Failed;
             return GuestEilseq;
         }
+        if (length > limit && stopAtLimit) break;
         if (length > limit || length > capacity) {
             *source = wide;
             destination[0] = '\0';
@@ -304,31 +361,30 @@ int APS5_VABI wcsrtombs_s_nid_postfix(
     return 0;
 }
 
+int APS5_VABI wcsrtombs_s_nid_postfix(
+    std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t** source, std::size_t limit,
+    void* state
+) {
+    return WideToLocaleChecked(result, destination, capacity, source, limit, state, false);
+}
+
 int APS5_VABI wcstombs_s_nid_postfix(
     std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit
 ) {
     std::array<std::uint64_t, 16> state{};
-    return wcsrtombs_s_nid_postfix(result, destination, capacity, &source, limit, state.data());
+    return WideToLocaleChecked(result, destination, capacity, &source, limit, state.data(), limit < capacity);
 }
 
-std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t* destination, const char** source, std::size_t capacity, void*) {
-    if (!destination) return std::strlen(*source);
-    std::size_t converted = 0;
-    while (converted < capacity) {
-        const auto value = static_cast<unsigned char>((*source)[converted]);
-        destination[converted] = value;
-        if (value == 0) {
-            *source = nullptr;
-            return converted;
-        }
-        ++converted;
-    }
-    *source += converted;
-    return converted;
+std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t* destination, const char** source, std::size_t capacity, void* state) {
+    thread_local unsigned char internal[StateSize]{};
+    if (destination) *destination = 0;
+    return LocaleStringToWide(destination, source, capacity, state ? static_cast<unsigned char*>(state) : internal);
 }
 
 std::size_t APS5_VABI mbstowcs_nid_postfix(std::uint16_t* dest, const char* src, std::size_t size) {
-    return SonyMbstowcs(dest, src, size);
+    if (!src) return 0;
+    unsigned char state[StateSize]{};
+    return LocaleStringToWide(dest, &src, size, state);
 }
 
 }
diff --git a/core/libs/prx/libc/src/Process.cpp b/core/libs/prx/libc/src/Process.cpp
index 9d2f6909b0..17f1889ed0 100644
--- a/core/libs/prx/libc/src/Process.cpp
+++ b/core/libs/prx/libc/src/Process.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include <csignal>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -20,8 +22,6 @@
 #include "prx/libc/include/General.hpp"
 #include "SceTypes.hpp"
 
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
-
 namespace {
 
 std::mutex shutdownMutex;
@@ -34,7 +34,7 @@ std::exception_ptr shutdownFailure;
 std::stop_source shutdownSource;
 std::atomic<bool> exitRequested{false};
 std::atomic<bool> exitStarted{false};
-using GuestExitCallback = void (APS5_VABI*)();
+
 thread_local bool runningExit = false;
 
 void APS5_VABI RunGuestExitCallback(void* callback) {
@@ -271,6 +271,7 @@ int APS5_VABI at_quick_exit_nid_postfix(GuestExitCallback func) {
     }
     for (auto it = callbacks.rbegin(); it != callbacks.rend(); ++it) (*it)();
     _Exit_nid_postfix(status);
+
 }
 
 int APS5_VABI daemon_nid_postfix(int noChdir, int noClose) {
@@ -281,3 +282,42 @@ int APS5_VABI daemon_nid_postfix(int noChdir, int noClose) {
 }
 
 }
+
+namespace {
+constexpr int SaRestart = 0x2;
+std::atomic<SigactionFn_nid_no_patch> registeredSigaction{nullptr};
+std::atomic<std::uint32_t*> registeredInterruptSet{nullptr};
+
+struct InterruptSigaction {
+    std::uintptr_t handler;
+    int flags;
+    std::uint32_t mask[4];
+};
+static_assert(sizeof(InterruptSigaction) == 32 && offsetof(InterruptSigaction, flags) == 8 && offsetof(InterruptSigaction, mask) == 12);
+}
+
+extern "C" {
+
+void RegisterSigaction_nid_no_patch(SigactionFn_nid_no_patch fn, std::uint32_t* interruptSet) {
+    registeredInterruptSet.store(interruptSet, std::memory_order_release);
+    registeredSigaction.store(fn, std::memory_order_release);
+}
+
+int APS5_VABI siginterrupt_nid_postfix(int guest, int flag) {
+    const auto sigaction = registeredSigaction.load(std::memory_order_acquire);
+    auto* const interruptSet = registeredInterruptSet.load(std::memory_order_acquire);
+    if (sigaction == nullptr || interruptSet == nullptr) throw std::runtime_error("siginterrupt: libkernel has not registered sigaction");
+    InterruptSigaction action{};
+    if (sigaction(guest, nullptr, &action) != 0) return -1;
+    const auto index = static_cast<std::uint32_t>(guest - 1);
+    if (flag) {
+        interruptSet[index >> 5] |= 1u << (index & 31);
+        action.flags &= ~SaRestart;
+    } else {
+        interruptSet[index >> 5] &= ~(1u << (index & 31));
+        action.flags |= SaRestart;
+    }
+    return sigaction(guest, &action, nullptr);
+}
+
+}
diff --git a/core/libs/prx/libc/src/Random.cpp b/core/libs/prx/libc/src/Random.cpp
index 06cf1d789d..03aba20b2e 100644
--- a/core/libs/prx/libc/src/Random.cpp
+++ b/core/libs/prx/libc/src/Random.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libc/include/HostEntropy.hpp"
 #include <array>
 #include <cmath>
 #include <cstddef>
@@ -17,15 +19,7 @@ constexpr std::array<std::int64_t, MaxTypes> MinimumStateBytes {8, 32, 64, 128,
 constexpr std::array<int, MaxTypes> Degrees {0, 7, 15, 31, 63};
 constexpr std::array<int, MaxTypes> Separations {0, 3, 1, 3, 1};
 
-std::uint32_t g_defaultTable[] {
-    3,
-    0x2cf41758, 0x27bb3711, 0x4916d4d1, 0x7b02f59f, 0x9b8e28eb, 0xc0e80269,
-    0x696f5c16, 0x878f1ff5, 0x52d9c07f, 0x916a06cd, 0xb50b3a20, 0x2776970a,
-    0xee4eb2a6, 0xe94640ec, 0xb1d65612, 0x9d1ed968, 0x1043f6b7, 0xa3432a76,
-    0x17eacbb9, 0x3c09e2eb, 0x04f8c2b3, 0x708a1f57, 0xee341814, 0x95d0e4d2,
-    0xb06f216c, 0x8bd2e72e, 0x8f7c38d7, 0xcfc6a8fc, 0x02a59495, 0xa20d2a69,
-    0xe29d12d1
-};
+std::uint32_t g_defaultTable[32]{};
 
 struct AdditiveFeedbackState {
     char* table;
@@ -50,12 +44,13 @@ void StoreWord(char* table, int index, std::uint32_t value) {
 }
 
 std::uint32_t GoodRand(std::uint32_t context) {
-    std::int32_t x = static_cast<std::int32_t>(context % 0x7ffffffeu) + 1;
-    const std::int32_t high = x / 127773;
-    const std::int32_t low = x % 127773;
+    std::int64_t x = static_cast<std::int32_t>(context);
+    if (x == 0) x = 123459876;
+    const std::int64_t high = x / 127773;
+    const std::int64_t low = x % 127773;
     x = 16807 * low - 2836 * high;
     if (x < 0) x += 0x7fffffff;
-    return static_cast<std::uint32_t>(x - 1);
+    return static_cast<std::uint32_t>(x);
 }
 
 std::uint32_t NextLocked() {
@@ -95,6 +90,14 @@ void SaveTypeWordLocked() {
     StoreWord(state.table, 0, static_cast<std::uint32_t>(word));
 }
 
+bool SeedDefaultState() {
+    SeedLocked(1);
+    SaveTypeWordLocked();
+    return true;
+}
+
+[[maybe_unused]] const bool g_defaultStateSeeded = SeedDefaultState();
+
 std::uint16_t g_rand48Seed[3]{0x330e, 0xabcd, 0x1234};
 constexpr std::uint64_t DefaultRand48Multiplier = 0x5deece66dull;
 constexpr std::uint16_t DefaultRand48Addend = 0xb;
@@ -180,6 +183,16 @@ void APS5_VABI srandom_nid_postfix(std::uint64_t seed) {
     SeedLocked(static_cast<std::uint32_t>(seed));
 }
 
+void APS5_VABI srandomdev_nid_postfix() {
+    std::lock_guard lock(g_randomLock);
+    const auto words = g_random.type == LinearCongruentialType ? 1 : g_random.degree;
+    HostEntropy_nid_no_patch(g_random.table + sizeof(std::uint32_t), static_cast<std::size_t>(words) * sizeof(std::uint32_t));
+    if (g_random.type != LinearCongruentialType) {
+        g_random.front = g_random.separation;
+        g_random.rear = 0;
+    }
+}
+
 char* APS5_VABI initstate_nid_postfix(std::uint64_t seed, char* state, std::int64_t size) {
     if (size < MinimumStateBytes[0]) return nullptr;
     if (state == nullptr) throw std::invalid_argument("initstate: null state");
diff --git a/core/libs/prx/libc/src/RealPath.cpp b/core/libs/prx/libc/src/RealPath.cpp
index 10a0193b94..92c58204d9 100644
--- a/core/libs/prx/libc/src/RealPath.cpp
+++ b/core/libs/prx/libc/src/RealPath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -10,8 +11,6 @@
 #include <string_view>
 #include <system_error>
 
-extern "C" char* APS5_VABI getcwd_nid_postfix(char* buffer, std::size_t size);
-
 namespace {
 constexpr std::size_t PathMax = 1024;
 constexpr std::string_view Separators = "/\\";
diff --git a/core/libs/prx/libc/src/Rename.cpp b/core/libs/prx/libc/src/Rename.cpp
index 973c142ff6..36454860ae 100644
--- a/core/libs/prx/libc/src/Rename.cpp
+++ b/core/libs/prx/libc/src/Rename.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
 #include "prx/libc/include/RenameDot.hpp"
 #include "prx/libc/include/General.hpp"
@@ -71,6 +72,9 @@ static int RenamePath_nid_no_patch(const std::filesystem::path& source, const st
         error.clear();
         sameFile = fs::equivalent(source, destination, error);
         if (error == std::errc::no_such_file_or_directory) error.clear();
+#ifdef __APPLE__
+        if (error == std::errc::not_supported) error.clear();
+#endif
         if (error) return FilesystemError(error);
         if (!sameFile && sourceIsDirectory && !destinationIsDirectory) return GuestEnotdir;
         if (!sameFile && !sourceIsDirectory && destinationIsDirectory) return GuestEisdir;
diff --git a/core/libs/prx/libc/src/RuneLocale.cpp b/core/libs/prx/libc/src/RuneLocale.cpp
index fa25f0412c..18e5aceb1d 100644
--- a/core/libs/prx/libc/src/RuneLocale.cpp
+++ b/core/libs/prx/libc/src/RuneLocale.cpp
@@ -1,4 +1,6 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -147,17 +149,18 @@ std::uint32_t APS5_VABI towupper_nid_postfix(std::uint32_t c) {
 }
 
 std::uint32_t APS5_VABI btowc_nid_postfix(int c) {
-    return c == -1 ? GuestRune::Weof : static_cast<unsigned char>(c);
+    const auto byte = static_cast<unsigned char>(c);
+    if (c == -1) return GuestRune::Weof;
+    if (byte < 0x80) return byte;
+    if (byte < 0xc0 || byte >= 0xf0) errno = 86;
+    return GuestRune::Weof;
 }
 
 int APS5_VABI wctob_nid_postfix(std::uint32_t c) {
-    return c < 256 ? static_cast<int>(c) : -1;
+    const auto unit = static_cast<std::uint16_t>(c);
+    return unit < 0x80 ? static_cast<int>(unit) : -1;
 }
 
-std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t c, std::uint64_t desc);
-const short* APS5_VABI _Getptolower_nid_postfix();
-const short* APS5_VABI _Getptoupper_nid_postfix();
-
 std::uint64_t APS5_VABI wctrans_nid_postfix(const char* property) {
     if (std::strcmp(property, "tolower") == 0) return 1;
     if (std::strcmp(property, "toupper") == 0) return 2;
diff --git a/core/libs/prx/libc/src/RuntimeSupport.cpp b/core/libs/prx/libc/src/RuntimeSupport.cpp
index f7204ea7f1..dbaf710627 100644
--- a/core/libs/prx/libc/src/RuntimeSupport.cpp
+++ b/core/libs/prx/libc/src/RuntimeSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cstdio>
 #include <cstdint>
@@ -95,6 +96,15 @@ void APS5_VABI cxa_finalize_nid_postfix(void* dsoHandle) {
     CxaFinalize_nid_no_patch(dsoHandle);
 }
 
+void APS5_VABI _Vacopy_nid_postfix(unsigned char* destination, const unsigned char* source) {
+    std::uint64_t overflowArea;
+    std::memcpy(&overflowArea, source + 16, sizeof(overflowArea));
+    std::memcpy(destination + 16, &overflowArea, sizeof(overflowArea));
+    unsigned char offsets[16];
+    std::memcpy(offsets, source, sizeof(offsets));
+    std::memcpy(destination, offsets, sizeof(offsets));
+}
+
 unsigned int APS5_VABI _Atomic_fetch_add_4_nid_postfix(volatile unsigned int* target, unsigned int value, int memoryOrder) {
     (void)memoryOrder;
     return GccAtomicFetchAdd(target, value);
@@ -156,10 +166,12 @@ void APS5_VABI _Unlockfilelock_nid_postfix(FileStream* stream) {
 
 void APS5_VABI flockfile_nid_postfix(FileStream* stream) {
     _Lockfilelock_nid_postfix(stream);
+
 }
 
 void APS5_VABI funlockfile_nid_postfix(FileStream* stream) {
     _Unlockfilelock_nid_postfix(stream);
+
 }
 
 int APS5_VABI ftrylockfile_nid_postfix(FileStream* stream) {
diff --git a/core/libs/prx/libc/src/ScanningWide.cpp b/core/libs/prx/libc/src/ScanningWide.cpp
index 0b95de6e78..0390ecd6cb 100644
--- a/core/libs/prx/libc/src/ScanningWide.cpp
+++ b/core/libs/prx/libc/src/ScanningWide.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdarg>
 #include <cstddef>
 #include <cstdint>
@@ -22,13 +23,6 @@
 #define APS5_VA_END() va_end(args)
 #endif
 
-extern "C" int APS5_VABI iswspace_nid_postfix(std::uint32_t c);
-extern "C" std::size_t APS5_VABI wcrtomb_nid_postfix(char* destination, std::uint16_t value, void* state);
-extern "C" std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream);
-extern "C" int APS5_VABI ungetc_nid_postfix(int value, FileStream* stream);
-extern "C" void APS5_VABI flockfile_nid_postfix(FileStream* stream);
-extern "C" void APS5_VABI funlockfile_nid_postfix(FileStream* stream);
-
 namespace {
 
 enum class Fit { Invalid, Prefix, Valid };
@@ -127,8 +121,9 @@ Fit FloatFit(std::string_view text) {
     if (digits == 0) return Fit::Invalid;
     if (Lower(text[index]) != (hex ? 'p' : 'e')) return Fit::Invalid;
     ++index;
-    if (index < text.size() && (text[index] == '+' || text[index] == '-')) ++index;
-    if (index == text.size()) return Fit::Prefix;
+    if (index == text.size()) return Fit::Valid;
+    if (text[index] == '+' || text[index] == '-') ++index;
+    if (index == text.size()) return Fit::Valid;
     for (; index < text.size(); ++index) {
         if (!IsDecimal(text[index])) return Fit::Invalid;
     }
@@ -256,7 +251,7 @@ private:
     }
 
     Outcome Literal(char16_t expected) {
-        if (input.Peek() < 0) return Outcome::Input;
+        if (input.Peek() < 0) return Outcome::Matching;
         if (input.Peek() != expected) return Outcome::Matching;
         input.Advance();
         return Outcome::Done;
@@ -303,6 +298,7 @@ private:
         if (*format == u'%') {
             ++format;
             SkipSpace();
+            if (input.Peek() < 0) return Outcome::Input;
             return Literal(u'%');
         }
         const Directive directive = Parse();
@@ -319,6 +315,8 @@ private:
         case u's':
         case u'c':
         case u'[': return Text(directive);
+        case u'S':
+        case u'C': return Outcome::Matching;
         case u'n': return Count(directive);
         default: Fail("unsupported conversion " + std::to_string(directive.conversion));
         }
diff --git a/core/libs/prx/libc/src/StandardStreams.cpp b/core/libs/prx/libc/src/StandardStreams.cpp
index 2cd656f01f..958616a565 100644
--- a/core/libs/prx/libc/src/StandardStreams.cpp
+++ b/core/libs/prx/libc/src/StandardStreams.cpp
@@ -1,18 +1,71 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cstddef>
 #include <cstdint>
 #include <stdexcept>
 #ifdef _WIN32
+#include <fcntl.h>
 #include <io.h>
+#include <stdlib.h>
 #else
 #include <fcntl.h>
 #include <unistd.h>
 #endif
 
+#ifdef _WIN32
+extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
+#endif
+
 namespace {
-#ifndef _WIN32
+#ifdef _WIN32
+constexpr std::intptr_t NoStreamHandle = -2;
+
+std::intptr_t StandardHandle(int descriptor) {
+    const auto previous = _set_thread_local_invalid_parameter_handler([](const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {});
+    const std::intptr_t handle = ::_get_osfhandle(descriptor);
+    _set_thread_local_invalid_parameter_handler(previous);
+    return handle;
+}
+
+}
+
+extern "C" void PrepareStandardStreams_nid_no_patch() {
+    static const bool ready = [] {
+        for (int descriptor = 0; descriptor <= 2; ++descriptor) {
+            const std::intptr_t handle = StandardHandle(descriptor);
+            if (handle != -1 && handle != NoStreamHandle) continue;
+            auto* const stream = __acrt_iob_func(descriptor);
+            const int existing = ::_fileno(stream);
+            if (existing >= 0) {
+                const std::intptr_t existingHandle = StandardHandle(existing);
+                if (existingHandle != -1 && existingHandle != NoStreamHandle) {
+                    if (::_dup2(existing, descriptor) != 0)
+                        throw std::runtime_error("cannot restore a standard descriptor from its stream");
+                    continue;
+                }
+            }
+            const int opened = ::_open("NUL", (descriptor == 0 ? _O_RDONLY : _O_WRONLY) | _O_BINARY);
+            if (opened < 0) throw std::runtime_error("cannot open NUL for a missing standard descriptor");
+            if (opened > descriptor) {
+                const int moved = ::_dup2(opened, descriptor);
+                ::_close(opened);
+                if (moved != 0) throw std::runtime_error("cannot restore a missing standard descriptor");
+            }
+            if (::_fileno(stream) != descriptor && ::_close(descriptor) != 0)
+                throw std::runtime_error("cannot release a restored standard descriptor");
+            if (::_wfreopen(L"NUL", descriptor == 0 ? L"rb" : L"wb", stream) != stream || ::_fileno(stream) != descriptor)
+                throw std::runtime_error("cannot attach a standard stream to its NUL descriptor");
+        }
+        return true;
+    }();
+    static_cast<void>(ready);
+}
+
+namespace {
+#else
 const bool standardDescriptorsOpen = [] {
     for (int descriptor = 0; descriptor <= 2; ++descriptor) {
         if (::fcntl(descriptor, F_GETFD) != -1 || errno != EBADF) continue;
@@ -28,6 +81,7 @@ const bool standardDescriptorsOpen = [] {
 FileStream input{stdin};
 }
 extern "C" {
+
 FileStream* __stdinp_nid_postfix = &input;
 FileStream* __stdoutp_nid_postfix = &_Stdout_nid_postfix;
 FileStream* __stderrp_nid_postfix = &_Stderr_nid_postfix;
@@ -70,7 +124,6 @@ std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream* stream) {
     return static_cast<std::int32_t>(code);
 }
 
-
 std::int32_t APS5_VABI ungetwc_nid_postfix(std::int32_t value, FileStream* stream) {
     if (value == -1) return -1;
     if (value < 0 || value > 255) {
@@ -92,7 +145,7 @@ int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream) {
 #ifdef _WIN32
     const int result = _fgetc_nolock(native);
 #else
-    const int result = ::getc_unlocked(native);
+    const int result = getc_unlocked(native);
 #endif
     stream->SyncUnlockedStatus();
     stream->KeepDirectoryReadError(result == -1);
@@ -100,6 +153,31 @@ int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream) {
 }
 int APS5_VABI __srget_nid_postfix(FileStream* stream) { return fgetc_nid_postfix(stream); }
 int APS5_VABI getchar_nid_postfix() { return fgetc_nid_postfix(__stdinp_nid_postfix); }
+char* APS5_VABI gets_nid_postfix(char* buffer) {
+    if (buffer == nullptr) throw std::invalid_argument("gets: null buffer");
+    auto* stream = __stdinp_nid_postfix;
+    if (stream && !stream->IsOpen()) { errno = 9; return nullptr; }
+    flockfile_nid_postfix(stream);
+
+    struct Unlock {
+        FileStream* stream;
+        ~Unlock() { funlockfile_nid_postfix(stream); }
+    } unlock{stream};
+    char* cursor = buffer;
+    for (;;) {
+        const int value = fgetc_nid_postfix(stream);
+        if (value == EOF) {
+            if (cursor == buffer) return nullptr;
+            *cursor = 0;
+            return buffer;
+        }
+        if (value == '\n') {
+            *cursor = 0;
+            return buffer;
+        }
+        *cursor++ = static_cast<char>(value);
+    }
+}
 std::int32_t APS5_VABI getwc_nid_postfix(FileStream* stream) { return fgetwc_nid_postfix(stream); }
 std::int32_t APS5_VABI getwchar_nid_postfix() { return fgetwc_nid_postfix(__stdinp_nid_postfix); }
 int APS5_VABI getchar_unlocked_nid_postfix() { return getc_unlocked_nid_postfix(__stdinp_nid_postfix); }
@@ -115,7 +193,7 @@ int APS5_VABI putc_unlocked_nid_postfix(int value, FileStream* stream) {
 #ifdef _WIN32
     const int result = _fputc_nolock(value, GetNativeStream(stream));
 #else
-    const int result = ::putc_unlocked(value, GetNativeStream(stream));
+    const int result = putc_unlocked(value, GetNativeStream(stream));
 #endif
     stream->SyncUnlockedStatus();
     return result;
@@ -194,9 +272,15 @@ int APS5_VABI setvbuf_nid_postfix(FileStream* stream, char* buffer, int mode, st
         buffer = nullptr;
         size = BUFSIZ;
     }
-    return std::setvbuf(GetStreamHandle(stream), buffer, native, size);
+    auto* handle = GetStreamHandle(stream);
+#ifdef _WIN32
+    if (handle == __acrt_iob_func(1) && KeepHostStandardOutput_nid_no_patch() < 0) return -1;
+    if (handle == __acrt_iob_func(2) && KeepHostStandardError_nid_no_patch() < 0) return -1;
+#endif
+    return std::setvbuf(handle, buffer, native, size);
 }
 void APS5_VABI setbuf_nid_postfix(FileStream* stream, char* buffer) {
     setvbuf_nid_postfix(stream, buffer, buffer ? 0 : 2, buffer ? 1024 : 0);
+
 }
 }
diff --git a/core/libs/prx/libc/src/StdioExtras.cpp b/core/libs/prx/libc/src/StdioExtras.cpp
index 28b5f7b33b..f6ebcc9784 100644
--- a/core/libs/prx/libc/src/StdioExtras.cpp
+++ b/core/libs/prx/libc/src/StdioExtras.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
@@ -18,8 +19,6 @@
 
 namespace {
 
-using GuestNewHandler = void (APS5_VABI*)();
-
 std::atomic<GuestNewHandler> g_newHandler{nullptr};
 
 void* Allocate(std::size_t size) {
@@ -83,9 +82,8 @@ int APS5_VABI sprintf_s_nid_postfix(char* buffer, size_t size, const char* forma
 }
 
 // Only the "C" locale exists.
-const char* APS5_VABI setlocale_nid_postfix(int category, const char* locale) {
-    if (category < 0 || category > 6) return nullptr;
-    if (locale == nullptr || locale[0] == 0 || std::strcmp(locale, "C") == 0 || std::strcmp(locale, "POSIX") == 0) return "C";
+const char* APS5_VABI setlocale_nid_postfix(int, const char* locale) {
+    if (locale == nullptr || locale[0] == 0 || std::strcmp(locale, "C") == 0) return "C";
     return nullptr;
 }
 
@@ -131,6 +129,11 @@ void APS5_VABI _ZdlPv_nid_postfix(void* pointer) {
     if (pointer != nullptr) ApplicationHeapFree_nid_no_patch(pointer);
 }
 
+void APS5_VABI _ZdlPvRKSt9nothrow_t_nid_postfix(void* pointer, const void*) noexcept {
+    _ZdlPv_nid_postfix(pointer);
+
+}
+
 void APS5_VABI _ZdaPv_nid_postfix(void* pointer) {
     if (pointer != nullptr) ApplicationHeapFree_nid_no_patch(pointer);
 }
diff --git a/core/libs/prx/libc/src/StringExtensions.cpp b/core/libs/prx/libc/src/StringExtensions.cpp
index 18b9cb6f18..35eed9a5f4 100644
--- a/core/libs/prx/libc/src/StringExtensions.cpp
+++ b/core/libs/prx/libc/src/StringExtensions.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -169,7 +170,6 @@ char* APS5_VABI strtok_nid_postfix(char* text, const char* delimiters) {
     return strtok_r_nid_postfix(text, delimiters, &state);
 }
 
-
 int APS5_VABI __inet_aton_nid_postfix(const char* text, void* address) {
     std::uint8_t parts[3];
     std::size_t count = 0;
diff --git a/core/libs/prx/libc/src/Strings.cpp b/core/libs/prx/libc/src/Strings.cpp
index 55ee19e5b1..224d291524 100644
--- a/core/libs/prx/libc/src/Strings.cpp
+++ b/core/libs/prx/libc/src/Strings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <bit>
 #include <cstddef>
 #include <cstdint>
@@ -153,7 +154,7 @@ TFloat NanValue(const NanSubject& subject, const char*& end) {
         return std::bit_cast<double>((subject.negative ? 0x8000000000000000ull : 0) | 0x7ff8000000000000ull | payload);
     } else if constexpr (std::is_same_v<TFloat, float>) {
         end = NanSequenceEnd(subject.tail);
-        return std::bit_cast<float>(0x7fc00000u);
+        return std::bit_cast<float>((subject.negative ? 0x80000000u : 0) | 0x7fc00000u);
     } else {
         end = NanSequenceEnd(subject.tail);
         TFloat value{};
@@ -187,7 +188,36 @@ TFloat ParseFloat(const char* text, char** end, TFloat (*parse)(const char*, cha
     const TFloat value = parse(text, &parsedEnd);
     if (errno == ERANGE && value != 0 && (value < 0 ? -value : value) < std::numeric_limits<TFloat>::min()) errno = saved;
     if (end != nullptr) *end = parsedEnd;
-    return parsedEnd == text ? TFloat{0} : value;
+    const char* subject = text;
+    while (std::isspace(static_cast<unsigned char>(*subject))) ++subject;
+    if (parsedEnd == text) {
+        if (subject[0] != '-') return TFloat{0};
+        if constexpr (std::is_same_v<TFloat, float>) return subject[1] == '\0' ? TFloat{0} : -TFloat{0};
+        const bool special = std::strchr("iInN", subject[1]) != nullptr && subject[1] != '\0';
+        return std::is_same_v<TFloat, long double> && !special ? -TFloat{0} : TFloat{0};
+    }
+    if (*subject == '+' || *subject == '-') ++subject;
+    const bool hexadecimal = subject[0] == '0' && (subject[1] == 'x' || subject[1] == 'X') && parsedEnd > subject + 2;
+    if constexpr (std::is_same_v<TFloat, float>) {
+        const float magnitude = value < 0 ? -value : value;
+        if (value != 0 && magnitude < std::numeric_limits<float>::min()) {
+            const long double exact = std::strtold(text, nullptr);
+            const bool roundedUp = magnitude == std::numeric_limits<float>::denorm_min() && (exact < 0 ? -exact : exact) < magnitude;
+            errno = hexadecimal ? (roundedUp ? ERANGE : saved) : (static_cast<long double>(value) != exact ? ERANGE : saved);
+        }
+        return value;
+    }
+    if (!hexadecimal) return value;
+    if constexpr (std::is_same_v<TFloat, double>) {
+        constexpr double smallest = std::numeric_limits<double>::denorm_min();
+        if ((value < 0 ? -value : value) == smallest) {
+            const long double exact = std::strtold(text, nullptr);
+            if ((exact < 0 ? -exact : exact) < smallest) errno = ERANGE;
+        }
+    } else if (errno == ERANGE) {
+        errno = saved;
+    }
+    return value;
 }
 
 }
@@ -418,22 +448,21 @@ char16_t* APS5_VABI wmemmove_nid_postfix(char16_t* dest, const char16_t* src, si
 
 }
 
-
 extern "C" {
 
 int APS5_VABI strcasecmp_nid_postfix(const char* s1, const char* s2) {
     for (;; ++s1, ++s2) {
-        const int a = std::tolower(static_cast<unsigned char>(*s1));
-        const int b = std::tolower(static_cast<unsigned char>(*s2));
-        if (a != b || *s1 == 0) return a - b;
+        const int a = tolower_nid_postfix(static_cast<unsigned char>(*s1));
+        const int b = tolower_nid_postfix(static_cast<unsigned char>(*s2));
+        if (a != b || *s1 == 0) return (a > b) - (a < b);
     }
 }
 
 int APS5_VABI strncasecmp_nid_postfix(const char* s1, const char* s2, size_t n) {
     for (; n != 0; ++s1, ++s2, --n) {
-        const int a = std::tolower(static_cast<unsigned char>(*s1));
-        const int b = std::tolower(static_cast<unsigned char>(*s2));
-        if (a != b) return a - b;
+        const int a = tolower_nid_postfix(static_cast<unsigned char>(*s1));
+        const int b = tolower_nid_postfix(static_cast<unsigned char>(*s2));
+        if (a != b) return a < b ? -1 : 1;
         if (*s1 == 0) break;
     }
     return 0;
@@ -467,6 +496,12 @@ int APS5_VABI strncpy_s_nid_postfix(char* dest, size_t destsz, const char* src,
         dest[0] = '\0';
         return GuestErange;
     }
+    const auto destination = reinterpret_cast<std::uintptr_t>(dest);
+    const auto source = reinterpret_cast<std::uintptr_t>(src);
+    if (destination < source + (length + 1) && source < destination + length + 1) {
+        dest[0] = '\0';
+        return GuestEinval;
+    }
     std::memcpy(dest, src, length);
     dest[length] = '\0';
     return 0;
@@ -494,6 +529,12 @@ int APS5_VABI strncat_s_nid_postfix(char* dest, size_t destsz, const char* src,
         dest[0] = '\0';
         return GuestErange;
     }
+    const auto destination = reinterpret_cast<std::uintptr_t>(dest);
+    const auto source = reinterpret_cast<std::uintptr_t>(src);
+    if (destination < source + (length + 1) && source < destination + used + length + 1) {
+        dest[0] = '\0';
+        return GuestEinval;
+    }
     std::memcpy(dest + used, src, length);
     dest[used + length] = '\0';
     return 0;
@@ -768,6 +809,7 @@ int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_
     if (destsz > RsizeMax) return GuestErange;
     if (!src || count > destsz) {
         wmemset_nid_postfix(dest, 0, destsz);
+
         return src ? GuestErange : GuestEinval;
     }
     const auto destination = reinterpret_cast<std::uintptr_t>(dest);
@@ -775,6 +817,7 @@ int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, size_t destsz, const char16_
     const auto distance = destination < source ? source - destination : destination - source;
     if (count != 0 && distance < count * sizeof(char16_t)) {
         wmemset_nid_postfix(dest, 0, destsz);
+
         return GuestEinval;
     }
     if (count != 0) std::memcpy(dest, src, count * sizeof(char16_t));
@@ -789,6 +832,7 @@ int APS5_VABI wmemmove_s_nid_postfix(char16_t* dest, size_t destsz, const char16
     if (destsz > RsizeMax) return GuestErange;
     if (!src || count > destsz) {
         wmemset_nid_postfix(dest, 0, destsz);
+
         return src ? GuestErange : GuestEinval;
     }
     if (count != 0) std::memmove(dest, src, count * sizeof(char16_t));
@@ -851,8 +895,8 @@ int APS5_VABI wcsncat_s_nid_postfix(char16_t* dest, size_t destsz, const char16_
     }
     const auto destination = reinterpret_cast<std::uintptr_t>(dest + used);
     const auto source = reinterpret_cast<std::uintptr_t>(src);
-    const auto distance = destination < source ? source - destination : destination - source;
-    if (length != 0 && distance < (length + 1) * sizeof(char16_t)) {
+    const auto bytes = length * sizeof(char16_t);
+    if (destination < source + bytes && source < destination + bytes) {
         dest[0] = 0;
         return GuestEinval;
     }
diff --git a/core/libs/prx/libc/src/Syslog.cpp b/core/libs/prx/libc/src/Syslog.cpp
index a94f34e141..137566b52f 100644
--- a/core/libs/prx/libc/src/Syslog.cpp
+++ b/core/libs/prx/libc/src/Syslog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdarg>
@@ -13,12 +14,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length);
-int APS5_VABI vsnprintf_nid_postfix(char* buffer, std::size_t size, const char* format, VaList* args);
-}
-
 namespace {
 constexpr int priorityMask = 0x07;
 constexpr int facilityMask = 0x3f8;
@@ -57,6 +52,7 @@ std::string ExpandErrorText(const char* format, int error) {
         if (cursor[0] == '%' && cursor[1] == 'm') {
             char text[128];
             strerror_r_nid_postfix(error, text, sizeof(text));
+
             for (const char* character = text; *character; ++character) {
                 expanded += *character;
                 if (*character == '%') expanded += '%';
@@ -82,6 +78,7 @@ std::string Format(const char* format, VaList* args) {
     if (size <= 0) return {};
     std::string buffer(static_cast<std::size_t>(size) + 1, '\0');
     vsnprintf_nid_postfix(buffer.data(), buffer.size(), format, args);
+
     buffer.resize(static_cast<std::size_t>(size));
     return buffer;
 #endif
@@ -135,6 +132,7 @@ void APS5_VABI syslog_nid_postfix(int priority, const char* format, ...) {
     va_start(args, format);
 #endif
     vsyslog_nid_postfix(priority, format, reinterpret_cast<VaList*>(args));
+
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
diff --git a/core/libs/prx/libc/src/Threads.cpp b/core/libs/prx/libc/src/Threads.cpp
index a00ba39463..8f13974d7a 100644
--- a/core/libs/prx/libc/src/Threads.cpp
+++ b/core/libs/prx/libc/src/Threads.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
 #ifdef _WIN32
@@ -26,11 +27,6 @@
 
 namespace {
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
 constexpr std::int64_t nanosPerSecond = 1000000000;
 constexpr std::int64_t longestSleepSeconds = 86400;
 
@@ -350,6 +346,10 @@ int SignalCondition_nid_no_patch(void** handle) {
     return threadSuccess;
 }
 
+unsigned APS5_VABI _ZNSt6thread20hardware_concurrencyEv_nid_postfix() {
+    return std::thread::hardware_concurrency();
+}
+
 int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*) {
     if (!target)
         APS5_INVALID_ARG_EX;
@@ -379,18 +379,15 @@ int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime*) {
     }
 }
 
+int APS5_VABI _Thrd_yield_nid_postfix() {
+    std::this_thread::yield();
+    return threadSuccess;
+}
 
 int APS5_VABI _Cnd_signal_nid_postfix(void** handle) {
     return SignalCondition_nid_no_patch(handle);
 }
 
-struct GuestPad {
-    unsigned (APS5_VABI* const* vtable)(GuestPad*);
-    void* condition;
-    void* mutex;
-    bool started;
-};
-
 static_assert(offsetof(GuestPad, condition) == 0x8 && offsetof(GuestPad, mutex) == 0x10 && offsetof(GuestPad, started) == 0x18 && sizeof(GuestPad) == 0x20);
 
 [[noreturn]] void ThrowCppError_nid_no_patch(int code);
@@ -438,6 +435,7 @@ void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad) {
     const int created = _Mtx_init_nid_postfix(&pad->mutex, 1);
     if (created != threadSuccess) {
         _Cnd_destroy_nid_postfix(&pad->condition);
+
         RequireThrd(created, "_Pad::_Pad: _Mtx_init");
     }
     pad->started = false;
@@ -445,6 +443,7 @@ void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad) {
     if (locked != threadSuccess) {
         _Mtx_destroy_nid_postfix(&pad->mutex);
         _Cnd_destroy_nid_postfix(&pad->condition);
+
         RequireThrd(locked, "_Pad::_Pad: _Mtx_lock");
     }
 }
@@ -454,6 +453,7 @@ void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(GuestPad* pad) {
     RequireThrd(_Mtx_unlock_nid_postfix(&pad->mutex), "_Pad::~_Pad: _Mtx_unlock");
     _Mtx_destroy_nid_postfix(&pad->mutex);
     _Cnd_destroy_nid_postfix(&pad->condition);
+
 }
 
 void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad) {
@@ -546,5 +546,122 @@ int APS5_VABI _Mtx_current_owns_nid_postfix(void**) {
     return 1;
 }
 
+static std::atomic<const PthreadSyncForwards_nid_no_patch*> registeredPthreadSyncForwards{nullptr};
+
+void RegisterPthreadSyncForwards_nid_no_patch(const PthreadSyncForwards_nid_no_patch* forwards) {
+    registeredPthreadSyncForwards.store(forwards, std::memory_order_release);
 }
 
+static const PthreadSyncForwards_nid_no_patch& PthreadSync(const char* function) {
+    const auto* forwards = registeredPthreadSyncForwards.load(std::memory_order_acquire);
+    if (!forwards) throw std::runtime_error(std::string(function) + ": libkernel synchronization is not registered");
+    return *forwards;
+}
+
+constexpr int KernelDeadlock = static_cast<int>(0x8002000b);
+constexpr int KernelNoMemory = static_cast<int>(0x8002000c);
+constexpr int KernelBusy = static_cast<int>(0x80020010);
+constexpr int RecursiveMutexType = 0x100;
+constexpr int KernelRecursiveMutex = 2;
+
+static int CreateResult(int result) {
+    if (result == 0) return threadSuccess;
+    return result == KernelNoMemory ? threadNomem : threadError;
+}
+
+static const char* SyncObjectName(const char* name) {
+    return name != nullptr && name[0] != '\0' ? name : nullptr;
+}
+
+int APS5_VABI _ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(void** mutex, int type, const char* name) {
+    const auto& sync = PthreadSync(__func__);
+    *mutex = nullptr;
+    void* attr = nullptr;
+    const int created = sync.mutexattrInit(&attr);
+    if (created != 0) return CreateResult(created);
+    if ((type & RecursiveMutexType) != 0 && sync.mutexattrSettype(&attr, KernelRecursiveMutex) != 0) {
+        sync.mutexattrDestroy(&attr);
+        return threadError;
+    }
+    const int initialized = sync.mutexInit(mutex, &attr, SyncObjectName(name));
+    const int released = sync.mutexattrDestroy(&attr);
+    if (initialized != 0) return CreateResult(initialized);
+    if (released != 0) {
+        sync.mutexDestroy(mutex);
+        return threadError;
+    }
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(void** mutex, int type) {
+    return _ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(mutex, type, "SceLibcI_Mtx");
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(void** mutex) {
+    return PthreadSync(__func__).mutexDestroy(mutex);
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(void** mutex) {
+    const int result = PthreadSync(__func__).mutexLock(mutex);
+    if (result == 0) return threadSuccess;
+    return result == KernelDeadlock ? threadBusy : threadError;
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(void** mutex) {
+    const int result = PthreadSync(__func__).mutexTrylock(mutex);
+    if (result == 0) return threadSuccess;
+    return result == KernelBusy ? threadBusy : threadError;
+}
+
+int APS5_VABI _ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(void** mutex) {
+    PthreadSync(__func__).mutexUnlock(mutex);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v219_Cnd_init_with_nameEPP12pthread_condPKc_nid_postfix(void** condition, const char* name) {
+    return CreateResult(PthreadSync(__func__).condInit(condition, nullptr, SyncObjectName(name)));
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(void** condition) {
+    return CreateResult(PthreadSync(__func__).condInit(condition, nullptr, "SceLibcI_Cnd"));
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(void** condition) {
+    return PthreadSync(__func__).condDestroy(condition);
+}
+
+int APS5_VABI _ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(void** condition, void** mutex) {
+    PthreadSync(__func__).condWait(condition, mutex);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v211_Cnd_signalEPP12pthread_cond_nid_postfix(void** condition) {
+    PthreadSync(__func__).condSignal(condition);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v214_Cnd_broadcastEPP12pthread_cond_nid_postfix(void** condition) {
+    PthreadSync(__func__).condBroadcast(condition);
+    return threadSuccess;
+}
+
+int APS5_VABI _ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(void* thread) {
+    return PthreadSync(__func__).detach(thread) == 0 ? threadSuccess : threadError;
+}
+
+int APS5_VABI _ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(void* thread, int* code) {
+    void* result = nullptr;
+    if (PthreadSync(__func__).join(thread, &result) != 0) return threadError;
+    if (code) *code = static_cast<int>(reinterpret_cast<std::intptr_t>(result));
+    return threadSuccess;
+}
+
+void APS5_VABI _ZNSt8__sce_v211_Thrd_yieldEv_nid_postfix() {
+    PthreadSync(__func__).yield();
+}
+
+void* APS5_VABI _ZNSt8__sce_v28_Thrd_idEv_nid_postfix() {
+    return _Thrd_current_nid_postfix();
+}
+
+}
diff --git a/core/libs/prx/libc/src/Time.cpp b/core/libs/prx/libc/src/Time.cpp
index c3499f8047..ebc13dfe50 100644
--- a/core/libs/prx/libc/src/Time.cpp
+++ b/core/libs/prx/libc/src/Time.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cerrno>
@@ -101,7 +102,11 @@ std::tm toHostTm(const GuestTm& guest) {
     host.tm_isdst = guest.tm_isdst;
 #ifndef _WIN32
     host.tm_gmtoff = static_cast<long>(guest.tm_gmtoff);
+#ifdef __APPLE__
+    host.tm_zone = const_cast<char*>(guest.tm_zone);
+#else
     host.tm_zone = guest.tm_zone;
+#endif
 #endif
     return host;
 }
@@ -157,8 +162,6 @@ const bool timeZoneFixed = [] {
 }  // namespace
 #endif
 
-extern "C" int64_t APS5_VABI libc_mktime_nid_postfix(GuestTm* timeptr);
-
 namespace {
 
 bool setHostZone(const char* zone) {
@@ -183,6 +186,7 @@ std::recursive_mutex& zoneMutex() {
 }
 
 char** HostZoneNames();
+char* GuestZoneName(int index);
 
 void applyGuestZone() {
     static bool initialized = false;
@@ -205,9 +209,8 @@ void applyGuestZone() {
 #else
     ::tzset();
 #endif
-    char** names = HostZoneNames();
-    tzname_nid_postfix[0] = names[0];
-    tzname_nid_postfix[1] = names[1];
+    tzname_nid_postfix[0] = GuestZoneName(0);
+    tzname_nid_postfix[1] = GuestZoneName(1);
 }
 
 int& zoneDepth() {
@@ -515,32 +518,35 @@ char** HostZoneNames() {
     return ::tzname;
 #endif
 }
+
+char* GuestZoneName(int index) {
+    static char unnamed[] = "   ";
+    char** names = HostZoneNames();
+#ifdef _WIN32
+    const bool daylightSaving = _daylight != 0;
+#else
+    const bool daylightSaving = ::daylight != 0;
+#endif
+    return index == 1 && !daylightSaving ? unnamed : names[index];
+}
 }
 
 extern "C" {
 
-char* tzname_nid_postfix[2] = {HostZoneNames()[0], HostZoneNames()[1]};
+char* tzname_nid_postfix[2] = {GuestZoneName(0), GuestZoneName(1)};
 int64_t timezone_nid_postfix = 0;
 int daylight_nid_postfix = 0;
 
-GuestTm* APS5_VABI localtime_s_nid_postfix(const int64_t* timer, GuestTm* result);
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const int64_t* timer, GuestTm* result);
-int64_t APS5_VABI libc_time_nid_postfix(int64_t* timer);
-double APS5_VABI libc_difftime_nid_postfix(int64_t time1, int64_t time0);
-std::size_t APS5_VABI wcsrtombs_nid_postfix(char* destination, const std::uint16_t** source, std::size_t capacity, void* state);
-std::size_t APS5_VABI mbsrtowcs_nid_postfix(std::uint16_t* destination, const char** source, std::size_t capacity, void* state);
-int APS5_VABI ___mb_cur_max_nid_postfix();
-
 void APS5_VABI tzset_nid_postfix(void) {
     const ZoneScope zone;
-    char** names = HostZoneNames();
-    tzname_nid_postfix[0] = names[0];
-    tzname_nid_postfix[1] = names[1];
+    tzname_nid_postfix[0] = GuestZoneName(0);
+    tzname_nid_postfix[1] = GuestZoneName(1);
     const int64_t now = libc_time_nid_postfix(nullptr);
     GuestTm universal{};
     GuestTm local{};
     gmtime_s_nid_postfix(&now, &universal);
     localtime_s_nid_postfix(&now, &local);
+
     daylight_nid_postfix = local.tm_isdst >= 0 ? 1 : 0;
     timezone_nid_postfix = static_cast<int64_t>(libc_difftime_nid_postfix(libc_mktime_nid_postfix(&universal), libc_mktime_nid_postfix(&local)));
 }
@@ -688,6 +694,7 @@ int64_t APS5_VABI mktime_nid_postfix(GuestTm* timeptr) {
 size_t APS5_VABI libc_strftime_nid_postfix(char* str, size_t count, const char* format, const GuestTm* timeptr) {
     const ZoneScope zone;
     tzset_nid_postfix();
+
     return formatGuestTime(str, count, format, *timeptr);
 }
 
@@ -725,6 +732,7 @@ size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const st
     constexpr auto Failed = static_cast<std::size_t>(-1);
     if (format == nullptr) throw std::invalid_argument("wcsftime: null format");
     if (timeptr == nullptr) throw std::invalid_argument("wcsftime: null time");
+    if (str == nullptr) return 0;
     const std::uint16_t* formatCursor = format;
     const std::size_t formatLength = wcsrtombs_nid_postfix(nullptr, &formatCursor, 0, nullptr);
     if (formatLength == Failed) return 0;
@@ -734,7 +742,8 @@ size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const st
         return 0;
     }
     wcsrtombs_nid_postfix(narrowFormat.get(), &formatCursor, formatLength + 1, nullptr);
-    const auto maxCharacterBytes = static_cast<std::size_t>(___mb_cur_max_nid_postfix());
+
+    const auto maxCharacterBytes = static_cast<std::size_t>(_Getmbcurmax_nid_postfix());
     if (std::numeric_limits<std::size_t>::max() / maxCharacterBytes <= count) {
         errno = GuestEinval;
         return 0;
@@ -745,13 +754,15 @@ size_t APS5_VABI wcsftime_nid_postfix(std::uint16_t* str, size_t count, const st
         return 0;
     }
     const int callerError = errno;
-    if (strftime_nid_postfix(narrow.get(), count, narrowFormat.get(), timeptr) == 0) {
+    if (strftime_nid_postfix(narrow.get(), count * maxCharacterBytes, narrowFormat.get(), timeptr) == 0) {
         errno = callerError;
         return 0;
     }
     const char* narrowCursor = narrow.get();
-    const std::size_t length = mbsrtowcs_nid_postfix(str, &narrowCursor, count, nullptr);
-    if (length == static_cast<std::size_t>(-2) || length == Failed || narrowCursor != nullptr) return 0;
+    const std::size_t length = mbsrtowcs_nid_postfix(nullptr, &narrowCursor, 0, nullptr);
+    if (length == Failed || length >= count) return 0;
+    mbsrtowcs_nid_postfix(str, &narrowCursor, count, nullptr);
+
     return length;
 }
 
diff --git a/core/libs/prx/libc/src/TimeExtras.cpp b/core/libs/prx/libc/src/TimeExtras.cpp
index ee2a225b25..8b4baa0823 100644
--- a/core/libs/prx/libc/src/TimeExtras.cpp
+++ b/core/libs/prx/libc/src/TimeExtras.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 
 #include "prx/libc/include/General.hpp"
@@ -5,11 +7,6 @@
 
 namespace {
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
 constexpr int timeUtc = 1;
 constexpr std::int64_t nanosPerSecond = 1000000000;
 constexpr std::int64_t secondsPerDay = 86400;
@@ -35,10 +32,6 @@ std::int64_t wrappingAdd(std::int64_t left, std::int64_t right) {
 
 extern "C" {
 
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const std::int64_t* timer, GuestTm* result);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t* timer, GuestTm* result);
-std::int64_t APS5_VABI _Xtime_get_ticks_nid_postfix();
-
 GuestTm* APS5_VABI gmtime_r_nid_postfix(const std::int64_t* timer, GuestTm* result) {
     return gmtime_s_nid_postfix(timer, result);
 }
@@ -74,6 +67,7 @@ Xtime APS5_VABI _Xtime_to_ts_nid_postfix(const Xtime* time) {
 Xtime APS5_VABI _Xtime_diff_to_ts_nid_postfix(const Xtime* target) {
     Xtime now{};
     xtime_get_nid_postfix(&now, timeUtc);
+
     std::int64_t seconds = wrappingAdd(target->sec, target->nsec / nanosPerSecond);
     std::int64_t nanos = target->nsec % nanosPerSecond;
     if (nanos < 0) {
diff --git a/core/libs/prx/libc/src/VectorAlgorithms.cpp b/core/libs/prx/libc/src/VectorAlgorithms.cpp
index 169c0a23d8..80b1a8f99c 100644
--- a/core/libs/prx/libc/src/VectorAlgorithms.cpp
+++ b/core/libs/prx/libc/src/VectorAlgorithms.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -7,11 +8,6 @@
 
 namespace {
 
-struct MinMaxPointers {
-    const void* minimum;
-    const void* maximum;
-};
-
 template<typename TValue>
 TValue Read(const unsigned char* address) {
     TValue value;
diff --git a/core/libs/prx/libc/src/WideConversion.cpp b/core/libs/prx/libc/src/WideConversion.cpp
index 09fb1fd1c9..109dae7f16 100644
--- a/core/libs/prx/libc/src/WideConversion.cpp
+++ b/core/libs/prx/libc/src/WideConversion.cpp
@@ -1,6 +1,9 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/SonyCrt.hpp"
 #include <cerrno>
+#include <climits>
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
@@ -19,25 +22,22 @@ extern "C" void* APS5_VABI set_constraint_handler_s_nid_postfix(void* handler) {
 
 extern "C" std::size_t APS5_VABI wcstombs_nid_postfix(char* destination, const std::uint16_t* source, std::size_t capacity) {
     std::size_t count = 0;
-    while (!destination || count < capacity) {
-        const auto value = source[count];
-        if (value > 255) {
-            errno = 86;
-            return static_cast<std::size_t>(-1);
+    for (;; ++source) {
+        char bytes[MB_LEN_MAX];
+        const std::size_t length = wcrtomb_nid_postfix(bytes, *source, nullptr);
+        for (std::size_t index = 0; index < length; ++index) {
+            if (destination && count == capacity) return count;
+            if (destination) destination[count] = bytes[index];
+            if (bytes[index] == '\0') return count;
+            ++count;
         }
-        if (destination) destination[count] = static_cast<char>(value);
-        if (value == 0) break;
-        ++count;
     }
-    return count;
 }
 
 extern "C" int APS5_VABI wcscpy_s_nid_postfix(std::uint16_t* dest, std::size_t size, const std::uint16_t* src) {
     return SonyWcscpyS(dest, size, src);
 }
 
-extern "C" int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t capacity);
-
 namespace {
 
 std::size_t ReadErrorMessage(int error, char (&message)[128]) {
diff --git a/core/libs/prx/libc/src/exception/ArraySupport.cpp b/core/libs/prx/libc/src/exception/ArraySupport.cpp
index 6b5302ac9e..961f834282 100644
--- a/core/libs/prx/libc/src/exception/ArraySupport.cpp
+++ b/core/libs/prx/libc/src/exception/ArraySupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <limits>
 
@@ -15,6 +16,7 @@ void APS5_VABI __cxa_vec_ctor_nid_postfix(void* array, std::size_t count, std::s
         for (; complete < count; ++complete) construct(static_cast<unsigned char*>(array) + complete * size);
     } catch (...) {
         __cxa_vec_cleanup_nid_postfix(array, complete, size, destroy);
+
         throw;
     }
 }
@@ -26,6 +28,7 @@ void APS5_VABI __cxa_vec_cctor_nid_postfix(void* destination, void* source, std:
             copy(static_cast<unsigned char*>(destination) + complete * size, static_cast<unsigned char*>(source) + complete * size);
     } catch (...) {
         __cxa_vec_cleanup_nid_postfix(destination, complete, size, destroy);
+
         throw;
     }
 }
@@ -37,6 +40,7 @@ void APS5_VABI __cxa_vec_dtor_nid_postfix(void* array, std::size_t count, std::s
     } catch (...) {
         if (unwinding) LibcException::Terminate();
         __cxa_vec_cleanup_nid_postfix(array, count, size, destroy);
+
         throw;
     }
 }
diff --git a/core/libs/prx/libc/src/exception/ExceptionPointer.cpp b/core/libs/prx/libc/src/exception/ExceptionPointer.cpp
index 447d85ac45..6b808a870c 100644
--- a/core/libs/prx/libc/src/exception/ExceptionPointer.cpp
+++ b/core/libs/prx/libc/src/exception/ExceptionPointer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <exception>
 
 #ifndef _LIBCPP_VERSION
@@ -62,6 +63,7 @@ exception_ptr current_exception() noexcept {
 
 void rethrow_exception(exception_ptr exception) {
     __cxa_rethrow_primary_exception_nid_postfix(exception._M_exception_object);
+
     LibcException::Terminate();
 }
 
@@ -73,10 +75,12 @@ exception_ptr::exception_ptr(void* exception) noexcept : _M_exception_object(exc
 
 void exception_ptr::_M_addref() noexcept {
     __cxa_increment_exception_refcount_nid_postfix(_M_exception_object);
+
 }
 
 void exception_ptr::_M_release() noexcept {
     __cxa_decrement_exception_refcount_nid_postfix(_M_exception_object);
+
     _M_exception_object = nullptr;
 }
 
@@ -94,22 +98,15 @@ const type_info* exception_ptr::__cxa_exception_type() const noexcept {
 
 #else
 
-namespace {
-struct GuestExceptionPointer {
-    void* object {};
-    explicit GuestExceptionPointer(void* primary) noexcept : object(primary) {}
-    GuestExceptionPointer(const GuestExceptionPointer&) = delete;
-    ~GuestExceptionPointer() {}
-};
-}
-
 extern "C" {
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptr9_M_addrefEv_nid_postfix(GuestExceptionPointer* self) noexcept {
     __cxa_increment_exception_refcount_nid_postfix(self->object);
+
 }
 
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptr10_M_releaseEv_nid_postfix(GuestExceptionPointer* self) noexcept {
     __cxa_decrement_exception_refcount_nid_postfix(self->object);
+
     self->object = nullptr;
 }
 
@@ -120,10 +117,12 @@ void* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr6_M_getEv_nid_postfix(cons
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC1EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept {
     self->object = exception;
     __cxa_increment_exception_refcount_nid_postfix(exception);
+
 }
 
 void APS5_VABI _ZNSt15__exception_ptr13exception_ptrC2EPv_nid_postfix(GuestExceptionPointer* self, void* exception) noexcept {
     _ZNSt15__exception_ptr13exception_ptrC1EPv_nid_postfix(self, exception);
+
 }
 
 const std::type_info* APS5_VABI _ZNKSt15__exception_ptr13exception_ptr20__cxa_exception_typeEv_nid_postfix(const GuestExceptionPointer* self) noexcept {
@@ -136,6 +135,7 @@ GuestExceptionPointer APS5_VABI _ZSt17current_exceptionv_nid_postfix() noexcept
 
 [[noreturn]] void APS5_VABI _ZSt17rethrow_exceptionNSt15__exception_ptr13exception_ptrE_nid_postfix(GuestExceptionPointer& exception) {
     __cxa_rethrow_primary_exception_nid_postfix(exception.object);
+
     LibcException::Terminate();
 }
 }
diff --git a/core/libs/prx/libc/src/exception/GuardSupport.cpp b/core/libs/prx/libc/src/exception/GuardSupport.cpp
index 7eaab8684f..09f9cbf02d 100644
--- a/core/libs/prx/libc/src/exception/GuardSupport.cpp
+++ b/core/libs/prx/libc/src/exception/GuardSupport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <thread>
 
diff --git a/core/libs/prx/libc/src/exception/Personality.cpp b/core/libs/prx/libc/src/exception/Personality.cpp
index 87826a2dc8..d4ed0a681f 100644
--- a/core/libs/prx/libc/src/exception/Personality.cpp
+++ b/core/libs/prx/libc/src/exception/Personality.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/exceptions/Unwind.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 
 extern "C" _Unwind_Reason_Code APS5_VABI __gxx_personality_v0_nid_postfix(
diff --git a/core/libs/prx/libc/src/exception/Runtime.cpp b/core/libs/prx/libc/src/exception/Runtime.cpp
index e790d1a2db..33a0c5485d 100644
--- a/core/libs/prx/libc/src/exception/Runtime.cpp
+++ b/core/libs/prx/libc/src/exception/Runtime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/exceptions/Unwind.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <algorithm>
 #include <cstdarg>
@@ -117,7 +119,7 @@ void Release(void* object) {
     }
 }
 
-void APS5_VABI Cleanup(_Unwind_Reason_Code reason, _Unwind_Exception* exception) {
+static void APS5_VABI Cleanup(_Unwind_Reason_Code reason, _Unwind_Exception* exception) {
     if (reason != _URC_FOREIGN_EXCEPTION_CAUGHT) Terminate();
     auto* header = FromUnwind(exception);
     if (exception->exception_class == DependentClass) {
@@ -285,8 +287,10 @@ void APS5_VABI __cxa_free_exception_nid_postfix(void* object) {
     header->unwind.exception_cleanup = Cleanup;
     ++globals.uncaught;
     _Unwind_RaiseException_nid_postfix(&header->unwind);
+
     RawLog("[libc] unhandled exception '%s' thrown from %p\n", type ? type->name() : "?", throwSite);
     __cxa_begin_catch_nid_postfix(&header->unwind);
+
     InvokeTerminate(header->terminate);
 }
 
@@ -343,6 +347,7 @@ void APS5_VABI __cxa_end_catch_nid_postfix() {
         globals.caught = header->next;
         bool foreign = !Native(header->unwind.exception_class);
         _Unwind_DeleteException_nid_postfix(UnwindOf(header));
+
         if (foreign) DeleteForeignHeader(header);
     }
 }
@@ -355,6 +360,7 @@ void APS5_VABI __cxa_end_catch_nid_postfix() {
     if (Native(header->unwind.exception_class)) ++globals.uncaught;
     _Unwind_RaiseException_nid_postfix(UnwindOf(header));
     __cxa_begin_catch_nid_postfix(UnwindOf(header));
+
     InvokeTerminate(header->terminate ? header->terminate : terminateHandler.load());
 }
 
@@ -373,7 +379,7 @@ unsigned APS5_VABI __cxa_uncaught_exceptions_nid_postfix() { return LibcExceptio
 bool APS5_VABI _ZSt18uncaught_exceptionv_nid_postfix() { return __cxa_uncaught_exception_nid_postfix(); }
 int APS5_VABI _ZSt19uncaught_exceptionsv_nid_postfix() { return static_cast<int>(__cxa_uncaught_exceptions_nid_postfix()); }
 [[noreturn]] void APS5_VABI _ZSt9terminatev_nid_postfix() { LibcException::Terminate(); }
-using LibcTerminateHandler = void(*)();
+
 LibcTerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(LibcTerminateHandler handler) {
     return LibcException::terminateHandler.exchange(handler ? handler : std::abort);
 }
@@ -388,6 +394,7 @@ void* APS5_VABI __cxa_current_primary_exception_nid_postfix() {
     if (!globals.caught || !Native(globals.caught->unwind.exception_class)) return nullptr;
     void* object = Primary(globals.caught) + 1;
     __cxa_increment_exception_refcount_nid_postfix(object);
+
     return object;
 }
 void* APS5_VABI __cxa_allocate_dependent_exception_nid_postfix() {
@@ -410,9 +417,11 @@ void APS5_VABI __cxa_rethrow_primary_exception_nid_postfix(void* object) {
     header->unwind.exception_class = DependentClass;
     header->unwind.exception_cleanup = Cleanup;
     __cxa_increment_exception_refcount_nid_postfix(object);
+
     ++globals.uncaught;
     _Unwind_RaiseException_nid_postfix(&header->unwind);
     __cxa_begin_catch_nid_postfix(&header->unwind);
+
     InvokeTerminate(header->terminate);
 }
 
@@ -450,6 +459,7 @@ void* APS5_VABI __dynamic_cast_nid_postfix(const void* source, const __cxxabiv1:
 
 [[noreturn]] void APS5_VABI __cxa_call_terminate_nid_postfix(void* exception) {
     __cxa_begin_catch_nid_postfix(exception);
+
     LibcException::Terminate();
 }
 [[noreturn]] void APS5_VABI __cxa_pure_virtual_nid_postfix() { LibcException::Terminate(); }
diff --git a/core/libs/prx/libc/src/exception/StandardExceptions.cpp b/core/libs/prx/libc/src/exception/StandardExceptions.cpp
index 31feeb3d8e..2cfb9918fb 100644
--- a/core/libs/prx/libc/src/exception/StandardExceptions.cpp
+++ b/core/libs/prx/libc/src/exception/StandardExceptions.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include <cstdio>
@@ -7,11 +8,9 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" void* APS5_VABI _Znwm_nid_postfix(std::size_t size);
-
 namespace LibcException {
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct ExceptionObject { const void* vtable; const char* message; };
+
 struct ExceptionVtable {
     std::ptrdiff_t offset;
     const TypeRecord* type;
@@ -128,10 +127,8 @@ ExceptionObject* Assign(ExceptionObject* object, const ExceptionObject* source)
     __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)), [](void* p) { DestroyPlain(static_cast<ExceptionObject*>(p)); });
 }
 
-struct CategoryObject { const void* vtable; };
-struct ErrorCode { int value; const CategoryObject* category; };
-struct SystemErrorObject { ExceptionObject base; ErrorCode code; };
-static_assert(sizeof(ErrorCode) == 16 && sizeof(SystemErrorObject) == 32 && offsetof(SystemErrorObject, code) == 16);
+static_assert(sizeof(ErrorCode) == 16 && offsetof(ErrorCode, value) == 4 && offsetof(ErrorCode, category) == 8);
+static_assert(sizeof(SystemErrorObject) == 32 && offsetof(SystemErrorObject, code) == 16);
 struct CppError { int value; const char* message; };
 
 static const char* GenericErrorMessage(int value) {
@@ -216,13 +213,15 @@ static const char* GenericErrorMessage(int value) {
 
 const TypeRecord ErrorCategoryType {ClassTypeVtable + 2, "St14error_category", nullptr};
 const TypeRecord GenericCategoryType {SingleTypeVtable + 2, "St23_Generic_error_category", &ErrorCategoryType};
-static void APS5_VABI GenericCategoryDestroy_nid_no_patch(CategoryObject*) {}
-static void APS5_VABI GenericCategoryDelete_nid_no_patch(CategoryObject*) {
-    throw std::invalid_argument("std::_Generic_error_category: the generic category object is not heap allocated");
+const TypeRecord SystemCategoryType {SingleTypeVtable + 2, "St22_System_error_category", &ErrorCategoryType};
+static void APS5_VABI CategoryDestroy_nid_no_patch(CategoryObject*) {}
+static void APS5_VABI CategoryDelete_nid_no_patch(CategoryObject*) {
+    throw std::invalid_argument("std::error_category: the generic and system category objects are not heap allocated");
 }
 static const char* APS5_VABI GenericCategoryName_nid_no_patch(const CategoryObject*) { return "generic"; }
-static GuestLocale::String* APS5_VABI GenericCategoryMessage_nid_no_patch(GuestLocale::String* result, const CategoryObject*, int value) {
-    if (!result) throw std::invalid_argument("std::_Generic_error_category::message: null result");
+static const char* APS5_VABI SystemCategoryName_nid_no_patch(const CategoryObject*) { return "system"; }
+static GuestLocale::String* APS5_VABI CategoryMessage_nid_no_patch(GuestLocale::String* result, const CategoryObject*, int value) {
+    if (!result) throw std::invalid_argument("std::error_category::message: null result");
     const char* message = GenericErrorMessage(value);
     if (!message) message = "unknown error";
     const auto length = std::strlen(message);
@@ -235,22 +234,57 @@ static GuestLocale::String* APS5_VABI GenericCategoryMessage_nid_no_patch(GuestL
     result->capacity = capacity;
     return result;
 }
-static ErrorCode APS5_VABI GenericCategoryCondition_nid_no_patch(const CategoryObject* self, int value) { return {value, self}; }
-static bool APS5_VABI GenericCategoryEquivalentCondition_nid_no_patch(const CategoryObject* self, int value, const ErrorCode* condition) {
-    return condition->category == self && condition->value == value;
+static ErrorCode APS5_VABI CategoryCondition_nid_no_patch(const CategoryObject* self, int value) { return {0, value, self}; }
+static bool APS5_VABI CategoryEquivalentCondition_nid_no_patch(const CategoryObject* self, int value, const ErrorCode* condition) {
+    using Condition = ErrorCode (APS5_VABI *)(const CategoryObject*, int);
+    const auto mapped = reinterpret_cast<Condition>(static_cast<const void* const*>(self->vtable)[4])(self, value);
+    return condition->category == mapped.category && condition->value == mapped.value;
 }
-static bool APS5_VABI GenericCategoryEquivalentCode_nid_no_patch(const CategoryObject* self, const ErrorCode* code, int value) {
+static bool APS5_VABI CategoryEquivalentCode_nid_no_patch(const CategoryObject* self, const ErrorCode* code, int value) {
     return code->category == self && code->value == value;
 }
 const void* const GenericCategoryVtable[] {
     nullptr, &GenericCategoryType,
-    reinterpret_cast<const void*>(GenericCategoryDestroy_nid_no_patch), reinterpret_cast<const void*>(GenericCategoryDelete_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryName_nid_no_patch), reinterpret_cast<const void*>(GenericCategoryMessage_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryCondition_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryEquivalentCondition_nid_no_patch),
-    reinterpret_cast<const void*>(GenericCategoryEquivalentCode_nid_no_patch)
+    reinterpret_cast<const void*>(CategoryDestroy_nid_no_patch), reinterpret_cast<const void*>(CategoryDelete_nid_no_patch),
+    reinterpret_cast<const void*>(GenericCategoryName_nid_no_patch), reinterpret_cast<const void*>(CategoryMessage_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCode_nid_no_patch)
 };
 const CategoryObject GenericCategory {GenericCategoryVtable + 2};
+static ErrorCode APS5_VABI SystemCategoryCondition_nid_no_patch(const CategoryObject* self, int value) {
+    return {0, value, GenericErrorMessage(value) ? &GenericCategory : self};
+}
+const void* const SystemCategoryVtable[] {
+    nullptr, &SystemCategoryType,
+    reinterpret_cast<const void*>(CategoryDestroy_nid_no_patch), reinterpret_cast<const void*>(CategoryDelete_nid_no_patch),
+    reinterpret_cast<const void*>(SystemCategoryName_nid_no_patch), reinterpret_cast<const void*>(CategoryMessage_nid_no_patch),
+    reinterpret_cast<const void*>(SystemCategoryCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCondition_nid_no_patch),
+    reinterpret_cast<const void*>(CategoryEquivalentCode_nid_no_patch)
+};
+const CategoryObject SystemCategory {SystemCategoryVtable + 2};
+[[noreturn]] void ThrowCppError(int code, const ExceptionVtable& table) {
+    static constexpr CppError errors[] {
+        {16, "device or resource busy"},
+        {22, "invalid argument"},
+        {3, "no such process"},
+        {12, "not enough memory"},
+        {1, "operation not permitted"},
+        {11, "resource deadlock would occur"},
+        {35, "resource unavailable try again"}
+    };
+    if (code < 0 || code >= static_cast<int>(std::size(errors)))
+        throw std::out_of_range("_Throw_Cpp_error: " + std::to_string(code) + " is not a _Cpp_error code");
+    const auto& error = errors[code];
+    char message[128];
+    std::snprintf(message, sizeof(message), "%s: %s", error.message, GenericErrorMessage(error.value));
+    auto* object = static_cast<SystemErrorObject*>(__cxa_allocate_exception_nid_postfix(sizeof(SystemErrorObject)));
+    Construct(&object->base, table, message);
+    object->code = {0, error.value, &GenericCategory};
+    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)),
+        reinterpret_cast<decltype(Header::destructor)>(DestroyGuestMessage_nid_no_patch));
+}
 }
 
 extern "C" {
@@ -260,9 +294,12 @@ const char* APS5_VABI _ZSt13_Syserror_mapi_nid_postfix(int value) {
 const LibcException::CategoryObject* APS5_VABI _ZSt16generic_categoryv_nid_postfix() {
     return &LibcException::GenericCategory;
 }
+const LibcException::CategoryObject* APS5_VABI _ZSt15system_categoryv_nid_postfix() {
+    return &LibcException::SystemCategory;
+}
 GuestLocale::String* APS5_VABI _ZNKSt23_Generic_error_category7messageEi_nid_postfix(
     GuestLocale::String* result, const LibcException::CategoryObject* self, int value) {
-    return LibcException::GenericCategoryMessage_nid_no_patch(result, self, value);
+    return LibcException::CategoryMessage_nid_no_patch(result, self, value);
 }
 LibcException::TypeRecord _ZTISt8ios_base_nid_postfix {LibcException::ClassTypeVtable + 2, "St8ios_base", nullptr};
 LibcException::TypeRecord _ZTISt9exception_nid_postfix {LibcException::ClassTypeVtable + 2, "St9exception", nullptr};
@@ -291,6 +328,10 @@ void APS5_VABI _ZNSt8bad_castD0Ev_nid_postfix(LibcException::ExceptionObject* se
 const char* APS5_VABI _ZNKSt8bad_cast4whatEv_nid_postfix(const LibcException::ExceptionObject* self) { return LibcException::PlainWhat(self); }
 void APS5_VABI _ZNSt8bad_castC1Ev_nid_postfix(LibcException::ExceptionObject* self) { self->vtable = &_ZTVSt8bad_cast_nid_postfix.destroy; }
 void APS5_VABI _ZNSt8bad_castC2Ev_nid_postfix(LibcException::ExceptionObject* self) { self->vtable = &_ZTVSt8bad_cast_nid_postfix.destroy; }
+[[noreturn]] void APS5_VABI _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(const LibcException::ExceptionObject* self) {
+    if (!self) throw std::invalid_argument("exception object is null");
+    LibcException::ThrowPlain(_ZTVSt8bad_cast_nid_postfix);
+}
 
 LibcException::TypeRecord _ZTISt10bad_typeid_nid_postfix {LibcException::SingleTypeVtable + 2, "St10bad_typeid", &_ZTISt9exception_nid_postfix};
 LibcException::ExceptionVtable _ZTVSt10bad_typeid_nid_postfix {0, &_ZTISt10bad_typeid_nid_postfix, LibcException::GuestDestroyPlain_nid_no_patch, LibcException::GuestDeletePlain_nid_no_patch, LibcException::GuestPlainWhat_nid_no_patch};
@@ -480,7 +521,6 @@ const char* APS5_VABI _ZNKSt8ios_base7failure4whatEv_nid_postfix(const LibcExcep
 [[noreturn]] void APS5_VABI _ZSt15_Xruntime_errorPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(_ZTVSt13runtime_error_nid_postfix, message); }
 [[noreturn]] void APS5_VABI _ZSt13_Xrange_errorPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(_ZTVSt11range_error_nid_postfix, message); }
 [[noreturn]] void APS5_VABI _ZSt19_Xbad_function_callv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt17bad_function_call_nid_postfix); }
-[[noreturn]] void APS5_VABI _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt17bad_function_call_nid_postfix); }
 [[noreturn]] void APS5_VABI _ZSt19_Throw_bad_weak_ptrv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt12bad_weak_ptr_nid_postfix); }
 [[noreturn]] void APS5_VABI _ZSt26__throw_bad_variant_accessv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt18bad_variant_access_nid_postfix); }
 [[noreturn]] void APS5_VABI _ZSt26_Throw_bad_optional_accessv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt19bad_optional_access_nid_postfix); }
@@ -493,24 +533,100 @@ const char* APS5_VABI _ZNKSt8ios_base7failure4whatEv_nid_postfix(const LibcExcep
         reinterpret_cast<decltype(LibcException::Header::destructor)>(LibcException::DestroyGuestMessage_nid_no_patch));
 }
 [[noreturn]] void ThrowCppError_nid_no_patch(int code) {
-    static constexpr LibcException::CppError errors[] {
-        {16, "device or resource busy"},
-        {22, "invalid argument"},
-        {3, "no such process"},
-        {12, "not enough memory"},
-        {1, "operation not permitted"},
-        {11, "resource deadlock would occur"},
-        {35, "resource unavailable try again"}
-    };
-    if (code < 0 || code >= static_cast<int>(std::size(errors)))
-        throw std::out_of_range("_Throw_Cpp_error: " + std::to_string(code) + " is not a _Cpp_error code");
-    const auto& error = errors[code];
-    char message[128];
-    std::snprintf(message, sizeof(message), "%s: %s", error.message, LibcException::GenericErrorMessage(error.value));
-    auto* object = static_cast<LibcException::SystemErrorObject*>(__cxa_allocate_exception_nid_postfix(sizeof(LibcException::SystemErrorObject)));
-    LibcException::Construct(&object->base, _ZTVSt12system_error_nid_postfix, message);
-    object->code = {error.value, &LibcException::GenericCategory};
-    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(&_ZTISt12system_error_nid_postfix),
-        reinterpret_cast<decltype(LibcException::Header::destructor)>(LibcException::DestroyGuestMessage_nid_no_patch));
+    LibcException::ThrowCppError(code, _ZTVSt12system_error_nid_postfix);
+}
+}
+
+namespace LibcException::SceV2 {
+static const char* APS5_VABI BadOptionalAccessWhat_nid_no_patch(const ExceptionObject*) { return "Bad optional access"; }
+static const char* APS5_VABI BadWeakPtrWhat_nid_no_patch(const ExceptionObject*) { return "bad_weak_ptr"; }
+static const char* APS5_VABI BadVariantAccessWhat_nid_no_patch(const ExceptionObject*) { return "bad variant access"; }
+static const char* APS5_VABI BadFunctionCallWhat_nid_no_patch(const ExceptionObject*) { return "bad function call"; }
+}
+
+extern "C" {
+LibcException::TypeRecord _ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix {LibcException::SingleTypeVtable + 2, "NSt13__sce_cxxvers16_Error_exceptionE", &_ZTISt9exception_nid_postfix};
+}
+
+namespace LibcException::SceV2 {
+constexpr ExceptionVtable MessageTable(const TypeRecord& type) {
+    return {0, &type, GuestDestroyMessage_nid_no_patch, GuestDeleteMessage_nid_no_patch, GuestMessageWhat_nid_no_patch};
+}
+constexpr ExceptionVtable PlainTable(const TypeRecord& type, const char* (APS5_VABI *what)(const ExceptionObject*)) {
+    return {0, &type, GuestDestroyPlain_nid_no_patch, GuestDeletePlain_nid_no_patch, what};
+}
+const ExceptionVtable ErrorException = MessageTable(_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix);
+const TypeRecord LogicErrorType {SingleTypeVtable + 2, "NSt8__sce_v211logic_errorE", &_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix};
+const TypeRecord LengthErrorType {SingleTypeVtable + 2, "NSt8__sce_v212length_errorE", &LogicErrorType};
+const TypeRecord OutOfRangeType {SingleTypeVtable + 2, "NSt8__sce_v212out_of_rangeE", &LogicErrorType};
+const TypeRecord InvalidArgumentType {SingleTypeVtable + 2, "NSt8__sce_v216invalid_argumentE", &LogicErrorType};
+const TypeRecord RuntimeErrorType {SingleTypeVtable + 2, "NSt8__sce_v213runtime_errorE", &_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix};
+const TypeRecord OverflowErrorType {SingleTypeVtable + 2, "NSt8__sce_v214overflow_errorE", &RuntimeErrorType};
+const TypeRecord RangeErrorType {SingleTypeVtable + 2, "NSt8__sce_v211range_errorE", &RuntimeErrorType};
+const TypeRecord SystemErrorBaseType {SingleTypeVtable + 2, "NSt8__sce_v213_System_errorE", &RuntimeErrorType};
+const TypeRecord SystemErrorType {SingleTypeVtable + 2, "NSt8__sce_v212system_errorE", &SystemErrorBaseType};
+const TypeRecord IosFailureType {SingleTypeVtable + 2, "NSt8__sce_v28ios_base7failureE", &SystemErrorType};
+const TypeRecord BadOptionalAccessType {SingleTypeVtable + 2, "NSt8__sce_v219bad_optional_accessE", &_ZTISt9exception_nid_postfix};
+const TypeRecord BadWeakPtrType {SingleTypeVtable + 2, "NSt8__sce_v212bad_weak_ptrE", &_ZTISt9exception_nid_postfix};
+const TypeRecord BadVariantAccessType {SingleTypeVtable + 2, "NSt8__sce_v218bad_variant_accessE", &_ZTISt9exception_nid_postfix};
+const TypeRecord BadFunctionCallType {SingleTypeVtable + 2, "NSt8__sce_v217bad_function_callE", &_ZTISt9exception_nid_postfix};
+const ExceptionVtable LengthError = MessageTable(LengthErrorType);
+const ExceptionVtable OutOfRange = MessageTable(OutOfRangeType);
+const ExceptionVtable InvalidArgument = MessageTable(InvalidArgumentType);
+const ExceptionVtable RuntimeError = MessageTable(RuntimeErrorType);
+const ExceptionVtable OverflowError = MessageTable(OverflowErrorType);
+const ExceptionVtable RangeError = MessageTable(RangeErrorType);
+const ExceptionVtable SystemError = MessageTable(SystemErrorType);
+const ExceptionVtable IosFailure = MessageTable(IosFailureType);
+const ExceptionVtable BadOptionalAccess = PlainTable(BadOptionalAccessType, BadOptionalAccessWhat_nid_no_patch);
+const ExceptionVtable BadWeakPtr = PlainTable(BadWeakPtrType, BadWeakPtrWhat_nid_no_patch);
+const ExceptionVtable BadVariantAccess = PlainTable(BadVariantAccessType, BadVariantAccessWhat_nid_no_patch);
+const ExceptionVtable BadFunctionCall = PlainTable(BadFunctionCallType, BadFunctionCallWhat_nid_no_patch);
+
+[[noreturn]] void ThrowCopy(const ExceptionObject* source, const ExceptionVtable& table) {
+    auto* object = static_cast<ExceptionObject*>(__cxa_allocate_exception_nid_postfix(sizeof(ExceptionObject)));
+    Copy(object, source, table);
+    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)),
+        reinterpret_cast<decltype(Header::destructor)>(DestroyGuestMessage_nid_no_patch));
+}
+[[noreturn]] void ThrowSystemCopy(const SystemErrorObject* source, const ExceptionVtable& table) {
+    auto* object = static_cast<SystemErrorObject*>(__cxa_allocate_exception_nid_postfix(sizeof(SystemErrorObject)));
+    Copy(&object->base, &source->base, table);
+    object->code = source->code;
+    __cxa_throw_nid_postfix(object, reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(table.type)),
+        reinterpret_cast<decltype(Header::destructor)>(DestroyGuestMessage_nid_no_patch));
+}
+}
+
+extern "C" {
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message) { LibcException::Construct(self, LibcException::SceV2::ErrorException, message); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(LibcException::ExceptionObject* self, const char* message) { LibcException::Construct(self, LibcException::SceV2::ErrorException, message); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC1ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source) { LibcException::Copy(self, source, LibcException::SceV2::ErrorException); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionC2ERKS0__nid_postfix(LibcException::ExceptionObject* self, const LibcException::ExceptionObject* source) { LibcException::Copy(self, source, LibcException::SceV2::ErrorException); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
+void APS5_VABI _ZNSt13__sce_cxxvers16_Error_exceptionD0Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DeleteMessage(self); }
+const char* APS5_VABI _ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(const LibcException::ExceptionObject* self) { return LibcException::MessageWhat(self); }
+
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::LengthError, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v214_Xout_of_rangeEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::OutOfRange, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v218_Xinvalid_argumentEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::InvalidArgument, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v215_Xruntime_errorEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::RuntimeError, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Xoverflow_errorEPKc_nid_postfix(const char* message) { LibcException::ThrowMessage(LibcException::SceV2::OverflowError, message); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v211_Xbad_allocEv_nid_postfix() { LibcException::ThrowPlain(_ZTVSt9bad_alloc_nid_postfix); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix() { LibcException::ThrowPlain(LibcException::SceV2::BadFunctionCall); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_19bad_optional_accessE_nid_postfix(const LibcException::ExceptionObject*) { LibcException::ThrowPlain(LibcException::SceV2::BadOptionalAccess); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12bad_weak_ptrE_nid_postfix(const LibcException::ExceptionObject*) { LibcException::ThrowPlain(LibcException::SceV2::BadWeakPtr); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_18bad_variant_accessE_nid_postfix(const LibcException::ExceptionObject*) { LibcException::ThrowPlain(LibcException::SceV2::BadVariantAccess); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_11range_errorE_nid_postfix(const LibcException::ExceptionObject* error) { LibcException::SceV2::ThrowCopy(error, LibcException::SceV2::RangeError); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v26_ThrowERKNS_12system_errorE_nid_postfix(const LibcException::SystemErrorObject* error) { LibcException::SceV2::ThrowSystemCopy(error, LibcException::SceV2::SystemError); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v28ios_base6_ThrowERKNS0_7failureE_nid_postfix(const LibcException::SystemErrorObject* failure) { LibcException::SceV2::ThrowSystemCopy(failure, LibcException::SceV2::IosFailure); }
+[[noreturn]] void APS5_VABI _ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix(int code) { LibcException::ThrowCppError(code, LibcException::SceV2::SystemError); }
+
+std::int64_t APS5_VABI _ZNSt8__sce_v216_Xtime_get_ticksEv_nid_postfix() { return _Xtime_get_ticks_nid_postfix(); }
+const char* APS5_VABI _ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(int value) {
+    if (value == 0) return "success";
+    const char* message = LibcException::GenericErrorMessage(value);
+    return message ? message : "unknown error";
 }
 }
diff --git a/core/libs/prx/libc/src/exception/TypeInfo.cpp b/core/libs/prx/libc/src/exception/TypeInfo.cpp
index 49ba0e47ee..a1d58f019b 100644
--- a/core/libs/prx/libc/src/exception/TypeInfo.cpp
+++ b/core/libs/prx/libc/src/exception/TypeInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <stdexcept>
 
diff --git a/core/libs/prx/libc/src/exception/Unwind.cpp b/core/libs/prx/libc/src/exception/Unwind.cpp
index 94226226e0..a690410bee 100644
--- a/core/libs/prx/libc/src/exception/Unwind.cpp
+++ b/core/libs/prx/libc/src/exception/Unwind.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Unwind.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include "prx/libc/include/specifics/linux/ElfTypes.hpp"
diff --git a/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp b/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp
index bae022e001..a18ff70dc9 100644
--- a/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp
+++ b/core/libs/prx/libc/src/specifics/gcc/StackGuard.cpp
@@ -1,4 +1,8 @@
 #include <cstdint>
 #include <cstdlib>
 
+#ifdef __APPLE__
+extern "C" std::uintptr_t __stack_chk_guard_nid_postfix = 0xDEADBEEFCAFEBABEull;
+#else
 std::uintptr_t __stack_chk_guard = 0xDEADBEEFCAFEBABEull;
+#endif
diff --git a/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp b/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp
index cc2ff7b9e3..516a53933a 100644
--- a/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp
+++ b/core/libs/prx/libc/src/specifics/linux/DlIteratePhdr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstddef>
 #include <stdexcept>
 
diff --git a/core/libs/prx/libkernel/Aio/src/Aio.cpp b/core/libs/prx/libkernel/Aio/src/Aio.cpp
index 9926ac1dd6..54fb54921f 100644
--- a/core/libs/prx/libkernel/Aio/src/Aio.cpp
+++ b/core/libs/prx/libkernel/Aio/src/Aio.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <array>
 #include <cerrno>
 #include <chrono>
@@ -5,7 +6,6 @@
 #include <cstdint>
 #include <mutex>
 #include <stdexcept>
-#include <string>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
@@ -25,6 +25,7 @@ namespace {
 constexpr std::int32_t AioProcessing = 2;
 constexpr std::int32_t AioCompleted = 3;
 constexpr std::int32_t AioAborted = 4;
+constexpr std::int32_t AioReported = 0x10000;
 constexpr std::int32_t AioMaxQueues = 512;
 constexpr std::int32_t AioRequestNumMax = 128;
 constexpr std::int32_t AioIdNumMax = 128;
@@ -34,6 +35,11 @@ constexpr std::int32_t AioSchedulingWindowMax = 128;
 constexpr std::int32_t AioDelayedCountMax = 128;
 constexpr std::uint32_t AioSplitSizeMax = 0x1000000;
 constexpr std::uint32_t AioSplitChunkSizeMax = 0x1000000;
+constexpr std::int32_t AioPriorityLow = 1;
+constexpr std::int32_t AioPriorityHigh = 3;
+constexpr std::int32_t AioDefaultSchedulingWindow = 32;
+constexpr std::int32_t AioDefaultDelayedCountLimit = 32;
+constexpr std::uint32_t AioDefaultSplitSize = 0x100000;
 
 std::mutex g_mutex;
 std::array<std::int32_t, AioMaxQueues> g_states{};
@@ -57,6 +63,30 @@ void SetState(std::int32_t id, std::int32_t state) {
     g_states[id] = state;
 }
 
+std::int32_t StateLocked(std::int32_t id) {
+    return ValidId(id) && g_states[id] != 0 ? g_states[id] : SCE_KERNEL_ERROR_ESRCH;
+}
+
+std::int32_t ReportLocked(std::int32_t id) {
+    const std::int32_t state = StateLocked(id);
+    if (state != SCE_KERNEL_ERROR_ESRCH && state != AioProcessing) g_states[id] |= AioReported;
+    return state;
+}
+
+std::int32_t CancelLocked(std::int32_t id) {
+    const std::int32_t state = StateLocked(id);
+    if (state == SCE_KERNEL_ERROR_ESRCH) return state;
+    if (state != AioProcessing) return state & ~AioReported;
+    g_states[id] = AioAborted;
+    return AioAborted;
+}
+
+std::int32_t DeleteLocked(std::int32_t id) {
+    if (StateLocked(id) == SCE_KERNEL_ERROR_ESRCH) return SCE_KERNEL_ERROR_ESRCH;
+    g_states[id] = 0;
+    return 0;
+}
+
 std::int64_t NativePread(std::int32_t fd, void* buf, std::size_t nbyte, std::int64_t offset) {
     const GuestArena::HostWrite destination(buf, nbyte);
     if (!destination.Open()) {
@@ -93,7 +123,7 @@ std::int64_t NativePwrite(std::int32_t fd, const void* buf, std::size_t nbyte, s
 #endif
 }
 
-bool RunRequest(KernelAioRwRequest& req, bool write) {
+void RunRequest(KernelAioRwRequest& req, bool write) {
     const std::int64_t done = write
         ? NativePwrite(req.fd, req.buf, req.nbyte, req.offset)
         : NativePread(req.fd, req.buf, req.nbyte, req.offset);
@@ -103,55 +133,47 @@ bool RunRequest(KernelAioRwRequest& req, bool write) {
         if (error == EBADF) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EBADF);
         if (error == EFAULT) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EFAULT);
         if (error == EINVAL) req.result->return_value = static_cast<std::int64_t>(SCE_KERNEL_ERROR_EINVAL);
-        req.result->state = AioAborted;
-        return false;
+        req.result->state = AioCompleted;
+        return;
     }
     req.result->return_value = done;
     req.result->state = AioCompleted;
-    return true;
 }
 
-int ValidateRequests(KernelAioRwRequest* req, std::int32_t size, const void* id) {
+int ValidateRequests(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, const void* id) {
     if (req == nullptr || id == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (size <= 0) return SCE_KERNEL_ERROR_EINVAL;
+    if (size <= 0 || size > AioRequestNumMax || prio < AioPriorityLow || prio > AioPriorityHigh) return SCE_KERNEL_ERROR_EINVAL;
     for (std::int32_t i = 0; i < size; ++i) {
         if (req[i].result == nullptr) return SCE_KERNEL_ERROR_EFAULT;
     }
     return 0;
 }
 
-int SubmitCommands(KernelAioRwRequest* req, std::int32_t size, bool write, std::int32_t* id) {
-    const int error = ValidateRequests(req, size, id);
+int SubmitCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, bool write, std::int32_t* id) {
+    const int error = ValidateRequests(req, size, prio, id);
     if (error != 0) return error;
     const std::int32_t queue = AllocateId();
-    bool aborted = false;
-    for (std::int32_t i = 0; i < size; ++i) {
-        if (!RunRequest(req[i], write)) aborted = true;
-    }
-    SetState(queue, aborted ? AioAborted : AioCompleted);
+    for (std::int32_t i = 0; i < size; ++i) RunRequest(req[i], write);
+    SetState(queue, AioCompleted);
     *id = queue;
     return 0;
 }
 
-int SubmitCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, bool write, std::int32_t* id, const char* name) {
-    if (req != nullptr && id != nullptr && size > AioRequestNumMax) throw std::runtime_error(std::string(name) + ": more than 128 requests per batch is not modelled");
-    const int error = ValidateRequests(req, size, id);
+int SubmitCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, bool write, std::int32_t* id) {
+    const int error = ValidateRequests(req, size, prio, id);
     if (error != 0) return error;
     for (std::int32_t i = 0; i < size; ++i) {
         const std::int32_t queue = AllocateId();
-        SetState(queue, RunRequest(req[i], write) ? AioCompleted : AioAborted);
+        RunRequest(req[i], write);
+        SetState(queue, AioCompleted);
         id[i] = queue;
     }
     return 0;
 }
 
-int ValidateIds(const std::int32_t* id, std::int32_t num, const void* out, const char* name) {
+int ValidateIds(const std::int32_t* id, std::int32_t num, const void* out) {
     if (id == nullptr || out == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (num < 0) return SCE_KERNEL_ERROR_EINVAL;
-    if (num > AioIdNumMax) throw std::runtime_error(std::string(name) + ": more than 128 ids per batch is not modelled");
-    for (std::int32_t i = 0; i < num; ++i) {
-        if (!ValidId(id[i])) return SCE_KERNEL_ERROR_EINVAL;
-    }
+    if (num <= 0 || num > AioIdNumMax) return SCE_KERNEL_ERROR_EINVAL;
     return 0;
 }
 
@@ -161,49 +183,31 @@ extern "C" {
 
 int APS5_VABI sceKernelAioDeleteRequest(int32_t id, int32_t* ret) {
     if (ret == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
-    SetState(id, AioAborted);
-    *ret = 0;
+    std::lock_guard<std::mutex> lock(g_mutex);
+    *ret = DeleteLocked(id);
     return 0;
 }
 
 int APS5_VABI sceKernelAioDeleteRequests(int32_t* id, int32_t num, int32_t* ret) {
-    const int error = ValidateIds(id, num, ret, "sceKernelAioDeleteRequests");
+    const int error = ValidateIds(id, num, ret);
     if (error != 0) return error;
-    for (int32_t i = 0; i < num; ++i) {
-        SetState(id[i], AioAborted);
-        ret[i] = 0;
-    }
+    std::lock_guard<std::mutex> lock(g_mutex);
+    for (int32_t i = 0; i < num; ++i) ret[i] = DeleteLocked(id[i]);
     return 0;
 }
 
 int APS5_VABI sceKernelAioCancelRequest(int32_t id, int32_t* state) {
     if (state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (id == 0) {
-        *state = AioProcessing;
-        return 0;
-    }
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
-    SetState(id, AioAborted);
-    *state = AioAborted;
+    std::lock_guard<std::mutex> lock(g_mutex);
+    *state = CancelLocked(id);
     return 0;
 }
 
 int APS5_VABI sceKernelAioCancelRequests(int32_t* id, int32_t num, int32_t* state) {
-    if (id == nullptr || state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (num < 0) return SCE_KERNEL_ERROR_EINVAL;
-    if (num > AioIdNumMax) throw std::runtime_error("sceKernelAioCancelRequests: more than 128 ids per batch is not modelled");
-    for (int32_t i = 0; i < num; ++i) {
-        if (id[i] != 0 && !ValidId(id[i])) return SCE_KERNEL_ERROR_EINVAL;
-    }
-    for (int32_t i = 0; i < num; ++i) {
-        if (id[i] == 0) {
-            state[i] = AioProcessing;
-            continue;
-        }
-        SetState(id[i], AioAborted);
-        state[i] = AioAborted;
-    }
+    const int error = ValidateIds(id, num, state);
+    if (error != 0) return error;
+    std::lock_guard<std::mutex> lock(g_mutex);
+    for (int32_t i = 0; i < num; ++i) state[i] = CancelLocked(id[i]);
     return 0;
 }
 
@@ -215,14 +219,18 @@ int APS5_VABI sceKernelAioInitializeImpl(void* param, int32_t size) {
 
 void APS5_VABI sceKernelAioInitializeParam(void* param) {
     if (param == nullptr) throw std::invalid_argument("sceKernelAioInitializeParam: param is null");
+    auto* scheduling = static_cast<KernelAioSchedulingParam*>(param);
+    for (int index = 0; index < 3; ++index) {
+        const bool split = index < 2;
+        scheduling[index] = {AioDefaultSchedulingWindow, AioDefaultDelayedCountLimit, split ? 1u : 0u, split ? AioDefaultSplitSize : 0u, split ? AioDefaultSplitSize : 0u};
+    }
 }
 
 int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, int32_t schedulingWindowSize, int32_t delayedCountLimit, uint32_t enableSplit, uint32_t splitSize, uint32_t splitChunkSize) {
     if (param == nullptr) throw std::invalid_argument("sceKernelAioSetParam: param is null");
-    if (schedulingWindowSize < 0 || schedulingWindowSize > AioSchedulingWindowMax) throw std::runtime_error("sceKernelAioSetParam: a scheduling window outside 0..128 is not modelled");
-    if (delayedCountLimit < 0 || delayedCountLimit > AioDelayedCountMax) throw std::runtime_error("sceKernelAioSetParam: a delayed count limit outside 0..128 is not modelled");
-    if (enableSplit > 1) throw std::runtime_error("sceKernelAioSetParam: a split flag other than 0 or 1 is not modelled");
-    if (splitSize > AioSplitSizeMax || splitChunkSize > AioSplitChunkSizeMax) throw std::runtime_error("sceKernelAioSetParam: a split size above 0x1000000 is not modelled");
+    if (schedulingWindowSize < 0 || schedulingWindowSize > AioSchedulingWindowMax || delayedCountLimit < 0 || delayedCountLimit > AioDelayedCountMax || enableSplit > 1)
+        return SCE_KERNEL_ERROR_EINVAL;
+    if (enableSplit == 1 && (splitSize == 0 || splitSize > AioSplitSizeMax || splitChunkSize == 0 || splitChunkSize > AioSplitChunkSizeMax)) return SCE_KERNEL_ERROR_EINVAL;
     param->schedulingWindowSize = schedulingWindowSize;
     param->delayedCountLimit = delayedCountLimit;
     param->enableSplit = enableSplit;
@@ -232,37 +240,32 @@ int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, int32_t sche
 }
 
 int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommands(req, size, false, id);
+    return SubmitCommands(req, size, prio, false, id);
 }
 
 int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommands(req, size, true, id);
+    return SubmitCommands(req, size, prio, true, id);
 }
 
 int APS5_VABI sceKernelAioSubmitReadCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommandsMultiple(req, size, false, id, "sceKernelAioSubmitReadCommandsMultiple");
+    return SubmitCommandsMultiple(req, size, prio, false, id);
 }
 
 int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id) {
-    (void)prio;
-    return SubmitCommandsMultiple(req, size, true, id, "sceKernelAioSubmitWriteCommandsMultiple");
+    return SubmitCommandsMultiple(req, size, prio, true, id);
 }
 
 int APS5_VABI sceKernelAioPollRequest(int32_t id, int32_t* state) {
     if (state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
     std::lock_guard<std::mutex> lock(g_mutex);
-    *state = g_states[id];
+    *state = ReportLocked(id);
     return 0;
 }
 
 int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state, uint32_t mode, uint32_t* usec) {
-    const int error = ValidateIds(id, num, state, "sceKernelAioWaitRequests");
+    const int error = ValidateIds(id, num, state);
     if (error != 0) return error;
-    if (mode != AioWaitAnd && mode != AioWaitOr) throw std::runtime_error("sceKernelAioWaitRequests: unsupported wait mode");
+    if (mode != AioWaitAnd && mode != AioWaitOr) return SCE_KERNEL_ERROR_EINVAL;
     const auto start = std::chrono::steady_clock::now();
     for (;;) {
         bool allDone = true;
@@ -270,15 +273,22 @@ int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state,
         {
             std::lock_guard<std::mutex> lock(g_mutex);
             for (int32_t i = 0; i < num; ++i) {
-                state[i] = g_states[id[i]];
-                if (state[i] == AioProcessing) allDone = false;
-                if (state[i] == AioCompleted) anyCompleted = true;
+                const std::int32_t current = StateLocked(id[i]);
+                if (current == AioProcessing) allDone = false;
+                if ((current & ~AioReported) == AioCompleted) anyCompleted = true;
+            }
+            if (allDone || (mode == AioWaitOr && anyCompleted)) {
+                for (int32_t i = 0; i < num; ++i) state[i] = ReportLocked(id[i]);
+                return 0;
             }
         }
-        if (allDone || (mode == AioWaitOr && anyCompleted)) return 0;
         if (usec != nullptr && *usec != 0) {
             const auto elapsed = std::chrono::duration_cast<std::chrono::microseconds>(std::chrono::steady_clock::now() - start).count();
-            if (elapsed > static_cast<std::int64_t>(*usec)) return SCE_KERNEL_ERROR_ETIMEDOUT;
+            if (elapsed > static_cast<std::int64_t>(*usec)) {
+                std::lock_guard<std::mutex> lock(g_mutex);
+                for (int32_t i = 0; i < num; ++i) state[i] = ReportLocked(id[i]);
+                return SCE_KERNEL_ERROR_ETIMEDOUT;
+            }
         }
         PreciseSleepUs(10);
     }
@@ -286,13 +296,12 @@ int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state,
 
 int APS5_VABI sceKernelAioWaitRequest(int32_t id, int32_t* state, uint32_t* usec) {
     if (state == nullptr) return SCE_KERNEL_ERROR_EFAULT;
-    if (!ValidId(id)) return SCE_KERNEL_ERROR_EINVAL;
     const auto start = std::chrono::steady_clock::now();
     for (;;) {
         std::int32_t current;
         {
             std::lock_guard<std::mutex> lock(g_mutex);
-            current = g_states[id];
+            current = ReportLocked(id);
         }
         if (current != AioProcessing) {
             *state = current;
@@ -310,10 +319,10 @@ int APS5_VABI sceKernelAioWaitRequest(int32_t id, int32_t* state, uint32_t* usec
 }
 
 int APS5_VABI sceKernelAioPollRequests(int32_t* id, int32_t num, int32_t* state) {
-    const int error = ValidateIds(id, num, state, "sceKernelAioPollRequests");
+    const int error = ValidateIds(id, num, state);
     if (error != 0) return error;
     std::lock_guard<std::mutex> lock(g_mutex);
-    for (int32_t i = 0; i < num; ++i) state[i] = g_states[id[i]];
+    for (int32_t i = 0; i < num; ++i) state[i] = ReportLocked(id[i]);
     return 0;
 }
 
diff --git a/core/libs/prx/libkernel/Apr/src/Apr.cpp b/core/libs/prx/libkernel/Apr/src/Apr.cpp
index 42e4274d9e..49676567f6 100644
--- a/core/libs/prx/libkernel/Apr/src/Apr.cpp
+++ b/core/libs/prx/libkernel/Apr/src/Apr.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <optional>
 #include <deque>
@@ -35,8 +37,6 @@
 #include <windows.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 constexpr int GUEST_ENOENT = 2;
@@ -674,6 +674,7 @@ std::optional<Deferred> _execute(const Apr::CommandBufferObject& buffer, std::ui
         case Apr::Opcode::WriteKernelEventQueue: {
             const auto command = _read<Apr::WriteKernelEventQueueCommand>(buffer, cursor);
             EqueueTriggerEvent_nid_postfix(static_cast<KernelEqueue>(command.equeue), static_cast<uintptr_t>(command.ident), EVFILT_AMPR, reinterpret_cast<void*>(command.data));
+
             break;
         }
         case Apr::Opcode::WriteAddressFromTimeCounter: {
@@ -701,8 +702,6 @@ std::optional<Deferred> _execute(const Apr::CommandBufferObject& buffer, std::ui
 
 extern "C" {
 
-int APS5_VABI sceKernelAllocateDirectMemory(int64_t searchStart, int64_t searchEnd, size_t length, size_t alignment, int memoryType, int64_t* offset);
-
 int AmmGiveDirectMemory_nid_no_patch(std::int64_t searchStart, std::int64_t searchEnd, std::size_t size, std::size_t alignment, int usage, std::int64_t* offset) {
     if (!offset || (usage != 0 && usage != 1)) return SCE_KERNEL_ERROR_EINVAL;
     const int result = sceKernelAllocateDirectMemory(searchStart, searchEnd, size, alignment, 0, offset);
@@ -826,7 +825,6 @@ bool AmmSubmitted_nid_no_patch(std::uint32_t id) {
     return true;
 }
 
-
 int APS5_VABI sceKernelAprResolveFilepathsToIds(const char** paths, uint32_t count, uint32_t* ids, uint32_t* error_index) {
     if (!paths || !ids) return _fail(GUEST_EINVAL);
     for (uint32_t index = 0; index < count; ++index) {
diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt
index 0d5ba7dce4..f1bccb7a91 100644
--- a/core/libs/prx/libkernel/CMakeLists.txt
+++ b/core/libs/prx/libkernel/CMakeLists.txt
@@ -46,6 +46,7 @@ add_library(libkernel SHARED EXCLUDE_FROM_ALL
         ${CMAKE_CURRENT_SOURCE_DIR}/Pthread/Posix/Tsd.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Pthread/Posix/Sem.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Pthread/Posix/Spinlock.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/Pselect.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/Socket.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/Udp.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Socket/src/SocketOptions.cpp
@@ -74,6 +75,7 @@ add_library(libkernel SHARED EXCLUDE_FROM_ALL
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/SignalSets.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/Notification.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/System/src/UserContext.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Time/Ktimer.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Time/SleepWake.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Time/Time.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Time/TimedWait.cpp
@@ -186,6 +188,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_posix_sem_init guest_posix_sem_post PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_posix_named_sem_tests ${LIBS_INCLUDE_DIR}/tests/GuestPosixNamedSem.cpp)
+    target_include_directories(guest_posix_named_sem_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_posix_named_sem_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_posix_named_sem_tests)
+    add_test(NAME guest_posix_named_sem COMMAND guest_posix_named_sem_tests)
+    set_tests_properties(guest_posix_named_sem PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_posix_named_sem PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_process_time_tests ${LIBS_INCLUDE_DIR}/tests/GuestProcessTime.cpp)
     target_include_directories(guest_process_time_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_process_time_tests PRIVATE libkernel libc)
@@ -212,6 +224,17 @@ if(BUILD_TESTING)
         set_tests_properties(guest_process_arguments PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    find_package(Python3 QUIET COMPONENTS Interpreter)
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND Python3_Interpreter_FOUND)
+        add_test_executable(guest_runtime_lifecycle_tests ${LIBS_INCLUDE_DIR}/tests/GuestRuntimeLifecycle.cpp)
+        target_include_directories(guest_runtime_lifecycle_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_runtime_lifecycle_tests PRIVATE libkernel libc ${CMAKE_DL_LIBS})
+        set_target_properties(guest_runtime_lifecycle_tests PROPERTIES ENABLE_EXPORTS ON)
+        add_dependencies(guest_runtime_lifecycle_tests relinker)
+        add_test(NAME guest_runtime_lifecycle COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_SOURCE_DIR}/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py
+            $<TARGET_FILE:relinker> $<TARGET_FILE:guest_runtime_lifecycle_tests> $<TARGET_FILE_DIR:libkernel>)
+    endif()
     add_library(guest_module_fixture SHARED ${LIBS_INCLUDE_DIR}/tests/GuestModuleFixture.cpp)
     target_include_directories(guest_module_fixture PRIVATE ${LIBS_INCLUDE_DIR})
     add_custom_command(TARGET guest_module_fixture POST_BUILD
@@ -220,11 +243,12 @@ if(BUILD_TESTING)
     add_dependencies(guest_module_fixture nid_patcher)
     configure_windows_unwind(guest_module_fixture)
     set_target_properties(guest_module_fixture PROPERTIES BUILD_WITH_INSTALL_RPATH ON INSTALL_RPATH "$ORIGIN")
-    find_package(Python3 QUIET COMPONENTS Interpreter)
-    if(Python3_Interpreter_FOUND AND NOT WIN32)
-        target_link_options(guest_module_fixture PRIVATE -Wl,--no-as-needed)
-        add_test(NAME nid_patcher_dynamic_strings COMMAND ${Python3_EXECUTABLE}
-            ${LIBS_INCLUDE_DIR}/nid/tests/test_dynamic_strings.py $<TARGET_FILE:guest_module_fixture>)
+    if(Python3_Interpreter_FOUND)
+        if(NOT WIN32)
+            target_link_options(guest_module_fixture PRIVATE -Wl,--no-as-needed)
+            add_test(NAME nid_patcher_dynamic_strings COMMAND ${Python3_EXECUTABLE}
+                ${LIBS_INCLUDE_DIR}/nid/tests/test_dynamic_strings.py $<TARGET_FILE:guest_module_fixture>)
+        endif()
         add_test(NAME nid_patcher_symbol_versions COMMAND ${Python3_EXECUTABLE}
             ${LIBS_INCLUDE_DIR}/nid/tests/test_symbol_versions.py $<TARGET_FILE:nid_patcher>)
     endif()
@@ -239,7 +263,7 @@ if(BUILD_TESTING)
         target_sources(guest_dynamic_loader_tests PRIVATE "${CMAKE_CURRENT_BINARY_DIR}/GuestDynamicLoader.def")
     endif()
     add_test(NAME guest_dynamic_loader COMMAND guest_dynamic_loader_tests $<TARGET_FILE_NAME:guest_module_fixture>)
-    set_tests_properties(guest_dynamic_loader PROPERTIES
+    set_tests_properties(guest_dynamic_loader PROPERTIES TIMEOUT 30
         WORKING_DIRECTORY "$<TARGET_FILE_DIR:guest_module_fixture>" RESOURCE_LOCK guest_dynamic_loader_files)
     if(WIN32)
         set_tests_properties(guest_dynamic_loader PROPERTIES ENVIRONMENT_MODIFICATION
@@ -357,8 +381,27 @@ if(BUILD_TESTING)
         target_link_libraries(guest_host_standard_error_windows_tests PRIVATE libkernel libc)
         configure_windows_unwind(guest_host_standard_error_windows_tests)
         add_test(NAME guest_host_standard_error_windows COMMAND guest_host_standard_error_windows_tests)
-        set_tests_properties(guest_host_standard_error_windows PROPERTIES TIMEOUT 10 ENVIRONMENT_MODIFICATION
+        add_test(NAME guest_host_standard_buffering_windows COMMAND guest_host_standard_error_windows_tests --buffering)
+        set_tests_properties(guest_host_standard_error_windows guest_host_standard_buffering_windows PROPERTIES TIMEOUT 10 ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test_executable(guest_closed_standard_descriptors_windows_tests ${LIBS_INCLUDE_DIR}/tests/GuestClosedStandardDescriptorsWindows.cpp)
+        target_include_directories(guest_closed_standard_descriptors_windows_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_closed_standard_descriptors_windows_tests PRIVATE libkernel libc)
+        configure_windows_unwind(guest_closed_standard_descriptors_windows_tests)
+        add_test(NAME guest_closed_standard_descriptors_windows COMMAND guest_closed_standard_descriptors_windows_tests)
+        set_tests_properties(guest_closed_standard_descriptors_windows PROPERTIES TIMEOUT 30 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test_executable(guest_closed_standard_streams_load_windows_tests ${LIBS_INCLUDE_DIR}/tests/GuestClosedStandardStreamsLoadWindows.cpp)
+        target_include_directories(guest_closed_standard_streams_load_windows_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_closed_standard_streams_load_windows_tests PRIVATE shell32)
+        if(MINGW)
+            target_compile_options(guest_closed_standard_streams_load_windows_tests PRIVATE -fasynchronous-unwind-tables)
+        endif()
+        add_dependencies(guest_closed_standard_streams_load_windows_tests libc)
+        configure_windows_unwind(guest_closed_standard_streams_load_windows_tests)
+        add_test(NAME guest_closed_standard_streams_load_windows COMMAND guest_closed_standard_streams_load_windows_tests "$<TARGET_FILE:libc>")
+        set_tests_properties(guest_closed_standard_streams_load_windows PROPERTIES TIMEOUT 10
+            ENVIRONMENT_MODIFICATION "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     add_test_executable(guest_truncate_tests ${LIBS_INCLUDE_DIR}/tests/GuestTruncate.cpp)
     target_include_directories(guest_truncate_tests PRIVATE ${LIBS_INCLUDE_DIR})
@@ -1033,7 +1076,7 @@ if(BUILD_TESTING)
     target_link_libraries(guest_raise_exception_tests PRIVATE libkernel libc)
     configure_windows_unwind(guest_raise_exception_tests)
     add_test(NAME guest_raise_exception COMMAND guest_raise_exception_tests)
-    set_tests_properties(guest_raise_exception PROPERTIES TIMEOUT 30)
+    set_tests_properties(guest_raise_exception PROPERTIES TIMEOUT 60)
     add_asan_test_options(guest_raise_exception detect_stack_use_after_return=0)
     if(WIN32)
         set_tests_properties(guest_raise_exception PROPERTIES ENVIRONMENT_MODIFICATION
@@ -1159,7 +1202,7 @@ if(BUILD_TESTING)
     endif()
     add_test_executable(guest_sched_priority_tests ${LIBS_INCLUDE_DIR}/tests/GuestSchedPriority.cpp)
     target_include_directories(guest_sched_priority_tests PRIVATE ${LIBS_INCLUDE_DIR})
-    target_link_libraries(guest_sched_priority_tests PRIVATE libkernel libc)
+    target_link_libraries(guest_sched_priority_tests PRIVATE libkernel libkernel_sys libc)
     configure_windows_unwind(guest_sched_priority_tests)
     add_test(NAME guest_sched_priority COMMAND guest_sched_priority_tests)
     set_tests_properties(guest_sched_priority PROPERTIES TIMEOUT 20)
@@ -1167,6 +1210,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_sched_priority PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_rtprio_thread_tests ${LIBS_INCLUDE_DIR}/tests/GuestRtprioThread.cpp)
+    target_include_directories(guest_rtprio_thread_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_rtprio_thread_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_rtprio_thread_tests)
+    add_test(NAME guest_rtprio_thread COMMAND guest_rtprio_thread_tests)
+    set_tests_properties(guest_rtprio_thread PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_rtprio_thread PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_operation_mode_tests ${LIBS_INCLUDE_DIR}/tests/GuestOperationMode.cpp)
     target_include_directories(guest_operation_mode_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_operation_mode_tests PRIVATE libkernel libc)
@@ -1293,6 +1346,19 @@ if(BUILD_TESTING)
         set_tests_properties(guest_named_shm_concurrency PROPERTIES TIMEOUT 20)
     endif()
     if(WIN32)
+        add_test_executable(guest_named_shm_windows_tests ${LIBS_INCLUDE_DIR}/tests/GuestNamedShmWindows.cpp)
+        target_include_directories(guest_named_shm_windows_tests PRIVATE ${LIBS_INCLUDE_DIR} ${LIBS_INCLUDE_DIR}/nid/include)
+        target_link_libraries(guest_named_shm_windows_tests PRIVATE libkernel libc advapi32)
+        configure_windows_unwind(guest_named_shm_windows_tests)
+        add_test(NAME guest_named_shm_windows COMMAND guest_named_shm_windows_tests)
+        set_tests_properties(guest_named_shm_windows PROPERTIES TIMEOUT 20 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test(NAME guest_named_shm_windows_short_temp COMMAND guest_named_shm_windows_tests --short-temp)
+        set_tests_properties(guest_named_shm_windows_short_temp PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        add_test(NAME guest_named_shm_windows_long_short_temp COMMAND guest_named_shm_windows_tests --long-short-temp)
+        set_tests_properties(guest_named_shm_windows_long_short_temp PROPERTIES TIMEOUT 20 SKIP_RETURN_CODE 77 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
         set_tests_properties(guest_shm_open PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
@@ -1359,9 +1425,10 @@ if(BUILD_TESTING)
     target_link_libraries(guest_socket_options_tests PRIVATE libkernel libc)
     configure_windows_unwind(guest_socket_options_tests)
     add_test(NAME guest_socket_options COMMAND guest_socket_options_tests)
-    set_tests_properties(guest_socket_options PROPERTIES TIMEOUT 30)
+    add_test(NAME guest_socket_options_multicast COMMAND guest_socket_options_tests multicast)
+    set_tests_properties(guest_socket_options guest_socket_options_multicast PROPERTIES TIMEOUT 30)
     if(WIN32)
-        set_tests_properties(guest_socket_options PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(guest_socket_options guest_socket_options_multicast PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
     add_test_executable(guest_socket_stream_options_tests ${LIBS_INCLUDE_DIR}/tests/GuestSocketStreamOptions.cpp)
@@ -1559,6 +1626,16 @@ if(BUILD_TESTING)
         set_tests_properties(guest_socket_connect_listening PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    add_test_executable(guest_underscore_entry_tests ${LIBS_INCLUDE_DIR}/tests/GuestUnderscoreEntries.cpp)
+    target_include_directories(guest_underscore_entry_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_underscore_entry_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_underscore_entry_tests)
+    add_test(NAME guest_underscore_entries COMMAND guest_underscore_entry_tests)
+    set_tests_properties(guest_underscore_entries PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_underscore_entries PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     add_test_executable(guest_elf_phdr_match_tests ${LIBS_INCLUDE_DIR}/tests/GuestElfPhdrMatch.cpp)
     target_include_directories(guest_elf_phdr_match_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_elf_phdr_match_tests PRIVATE libkernel libc)
@@ -1610,6 +1687,18 @@ if(BUILD_TESTING)
         set_tests_properties(guest_memory guest_mmap_fixed_anonymous PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    if(NOT ANYPS5_ENABLE_ASAN AND (WIN32 OR CMAKE_SYSTEM_NAME STREQUAL "Linux"))
+        add_test_executable(guest_low_address_memory_tests ${LIBS_INCLUDE_DIR}/tests/GuestLowAddressMemory.cpp)
+        target_include_directories(guest_low_address_memory_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_low_address_memory_tests PRIVATE libkernel libc)
+        configure_windows_unwind(guest_low_address_memory_tests)
+        add_test(NAME guest_low_address_memory COMMAND guest_low_address_memory_tests)
+        set_tests_properties(guest_low_address_memory PROPERTIES TIMEOUT 20)
+        if(WIN32)
+            set_tests_properties(guest_low_address_memory PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endif()
+    endif()
     add_test_executable(guest_mprotect_unmapped_tests ${LIBS_INCLUDE_DIR}/tests/GuestMprotectUnmapped.cpp)
     target_include_directories(guest_mprotect_unmapped_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_mprotect_unmapped_tests PRIVATE libkernel libc)
@@ -1635,6 +1724,7 @@ if(BUILD_TESTING)
     target_link_libraries(guest_flexible_memory_budget_tests PRIVATE libkernel libc)
     configure_windows_unwind(guest_flexible_memory_budget_tests)
     add_library(guest_flexible_memory_module SHARED ${LIBS_INCLUDE_DIR}/tests/GuestFlexibleMemoryModule.cpp)
+    target_include_directories(guest_flexible_memory_module PRIVATE ${LIBS_INCLUDE_DIR})
     set_target_properties(guest_flexible_memory_module PROPERTIES PREFIX "" SUFFIX ".guest.prx")
     add_dependencies(guest_flexible_memory_budget_tests guest_flexible_memory_module)
     target_compile_definitions(guest_flexible_memory_budget_tests PRIVATE GUEST_FLEXIBLE_MEMORY_MODULE="$<TARGET_FILE:guest_flexible_memory_module>")
@@ -1713,6 +1803,13 @@ if(BUILD_TESTING)
         set_tests_properties(guest_directory_rewind PROPERTIES TIMEOUT 15 ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
+        add_test_executable(guest_directory_link_type_tests ${LIBS_INCLUDE_DIR}/tests/GuestDirectoryLinkTypes.cpp)
+        target_include_directories(guest_directory_link_type_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_directory_link_type_tests PRIVATE libkernel libc)
+        add_test(NAME guest_directory_link_types COMMAND guest_directory_link_type_tests)
+        set_tests_properties(guest_directory_link_types PROPERTIES TIMEOUT 15)
+    endif()
     add_test_executable(guest_directory_entry_tests ${LIBS_INCLUDE_DIR}/tests/GuestDirectoryEntries.cpp)
     target_include_directories(guest_directory_entry_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_directory_entry_tests PRIVATE libkernel libc)
@@ -1843,7 +1940,7 @@ if(BUILD_TESTING)
         target_include_directories(guest_file_lock_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(guest_file_lock_tests PRIVATE libkernel libc)
         configure_windows_unwind(guest_file_lock_tests)
-        foreach(fileLockCase IN ITEMS duplicate lifetime conversion threads streams process)
+        foreach(fileLockCase IN ITEMS duplicate lifetime conversion threads streams process directory)
             add_test(NAME guest_file_lock_${fileLockCase} COMMAND guest_file_lock_tests ${fileLockCase})
             set_tests_properties(guest_file_lock_${fileLockCase} PROPERTIES TIMEOUT 20 ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
@@ -1920,6 +2017,21 @@ if(BUILD_TESTING)
 endif()
 
 if(BUILD_TESTING)
+    add_test_executable(guest_timed_join_tests ${LIBS_INCLUDE_DIR}/tests/GuestTimedJoin.cpp)
+    target_include_directories(guest_timed_join_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_timed_join_tests PRIVATE libkernel libc ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_timed_join_tests)
+    foreach(joinMode IN ITEMS normal coarse)
+        add_test(NAME guest_timed_join_${joinMode} COMMAND guest_timed_join_tests $<TARGET_FILE:libkernel>)
+        set_tests_properties(guest_timed_join_${joinMode} PROPERTIES TIMEOUT 15)
+        if(joinMode STREQUAL coarse)
+            set_tests_properties(guest_timed_join_${joinMode} PROPERTIES ENVIRONMENT "APS5_COARSE_TIMED_WAITS=1")
+        endif()
+        if(WIN32)
+            set_tests_properties(guest_timed_join_${joinMode} PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endif()
+    endforeach()
     add_test_executable(guest_sleep_cancel_tests ${LIBS_INCLUDE_DIR}/tests/GuestSleepCancel.cpp)
     target_include_directories(guest_sleep_cancel_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_sleep_cancel_tests PRIVATE libkernel libc)
diff --git a/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp b/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp
index 82e570403e..4247868360 100644
--- a/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp
@@ -1216,6 +1216,9 @@ int DoMapShared(void** addr, size_t len, int prot, HostSharedMemory object) {
     try {
 #ifdef _WIN32
         GuestArena::GuestArenaMap_nid_postfix(mapped, len, object, 0, WinProtFromPosix(nativeProtection));
+#elif defined(__APPLE__)
+        if (::mmap(mapped, len, nativeProtection & ~PROT_EXEC, MAP_SHARED | MAP_FIXED, object, 0) == MAP_FAILED) throw std::system_error(errno, std::generic_category(), "map shared memory");
+        if ((nativeProtection & PROT_EXEC) != 0 && ::mprotect(mapped, len, nativeProtection) != 0) throw std::system_error(errno, std::generic_category(), "make shared memory executable");
 #else
         if (::mmap(mapped, len, nativeProtection, MAP_SHARED | MAP_FIXED, object, 0) == MAP_FAILED) throw std::system_error(errno, std::generic_category(), "map shared memory");
 #endif
diff --git a/core/libs/prx/libkernel/DirectMemory/Export.cpp b/core/libs/prx/libkernel/DirectMemory/Export.cpp
index bd93f135d1..93101cb207 100644
--- a/core/libs/prx/libkernel/DirectMemory/Export.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/Export.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -32,8 +34,6 @@
 #include <mutex>
 
 extern "C" std::uint64_t GuestImageSegmentBytes_nid_no_patch();
-extern "C" void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-extern "C" int* APS5_VABI __error_nid_postfix();
 
 namespace {
 
@@ -218,13 +218,12 @@ int APS5_VABI sceKernelAllocateMainDirectMemory(size_t len, size_t alignment, in
 }
 
 int APS5_VABI sceKernelAvailableDirectMemorySize(int64_t search_start, int64_t search_end, size_t alignment, int64_t* phys_addr_out, size_t* size_out) {
- if (!phys_addr_out || !size_out) return SCE_KERNEL_ERROR_EINVAL;
  int64_t start = 0;
  size_t size = 0;
  const int result = DirectMemoryLargestFree(search_start, search_end, alignment, &start, &size);
- if (result != 0) { *phys_addr_out = 0; *size_out = 0; return result; }
- *phys_addr_out = start;
- *size_out = size;
+ if (result != 0) return result;
+ if (phys_addr_out) *phys_addr_out = start;
+ if (size_out) *size_out = size;
  return 0;
 }
 
@@ -277,8 +276,6 @@ int APS5_VABI sceKernelMapFlexibleMemory(void** addr_in_out, size_t len, int pro
  return _mapFlexible(addr_in_out, len, prot, flags & ~IgnoredHeapFlag);
 }
 
-int APS5_VABI sceKernelSetVirtualRangeName(const void* addr, uint64_t len, const char* name);
-
 int APS5_VABI sceKernelMapNamedDirectMemory(void** addr, size_t len, int prot, int flags, int64_t direct_memory_start, size_t alignment, const char* name) {
  const int result = DoMapDirect(addr, len, prot, flags, direct_memory_start, alignment);
  if (result == 0) _releaseFlexible(reinterpret_cast<uintptr_t>(*addr), len);
@@ -320,7 +317,11 @@ int APS5_VABI sceKernelMmap(void* addr, size_t len, int prot, int flags, int fd,
 }
 
 int APS5_VABI sceKernelReleaseFlexibleMemory(void* addr, size_t len) {
- return sceKernelMunmap(reinterpret_cast<uint64_t>(addr), len);
+ const auto start = reinterpret_cast<uintptr_t>(addr);
+ if (start == 0 || (start & (PS5_PAGE_SIZE - 1)) != 0 || (len & (PS5_PAGE_SIZE - 1)) != 0 || len > std::numeric_limits<uintptr_t>::max() - start)
+  return SCE_KERNEL_ERROR_EINVAL;
+ if (len != 0) _releaseFlexible(start, len);
+ return 0;
 }
 
 int APS5_VABI sceKernelReleaseDirectMemory(int64_t start, size_t len) {
@@ -501,6 +502,12 @@ int APS5_VABI sceKernelGetPageTableStats(int* cpu_total, int* cpu_available, int
  return 0;
 }
 
+int APS5_VABI sceKernelGetTraceMemoryStats(std::uint64_t* first, std::uint64_t* second) {
+ if (first) *first = 0;
+ if (second) *second = 0;
+ return 0;
+}
+
 int APS5_VABI sceKernelGetPrtAperture(int index, void** addr, size_t* len) {
  if (index < 0 || index >= PRT_APERTURE_COUNT || !addr || !len) return SCE_KERNEL_ERROR_EINVAL;
  std::lock_guard lock(g_prtLock);
@@ -516,8 +523,6 @@ int APS5_VABI sceKernelSetPrtAperture(int index, void* addr, size_t len) {
  return 0;
 }
 
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry* entries, int num_entries, int* num_entries_out, int flags);
-
 int APS5_VABI sceKernelBatchMap(KernelBatchMapEntry* entries, int num_entries, int* num_entries_out) {
  constexpr int MapFixed = 0x10;
  return sceKernelBatchMap2(entries, num_entries, num_entries_out, MapFixed);
diff --git a/core/libs/prx/libkernel/DirectMemory/Jit.cpp b/core/libs/prx/libkernel/DirectMemory/Jit.cpp
index fb3ad0405c..60e266a543 100644
--- a/core/libs/prx/libkernel/DirectMemory/Jit.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/Jit.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
@@ -26,6 +27,9 @@
 #include <fcntl.h>
 #include <sys/mman.h>
 #include <unistd.h>
+#ifdef __APPLE__
+#include <filesystem>
+#endif
 #endif
 
 namespace {
@@ -140,8 +144,19 @@ int DuplicateDescriptor(int descriptor) {
 }
 #else
 int CreateBacking(std::size_t bytes, int* descriptor, std::shared_ptr<JitObject>* object) {
+#ifdef __APPLE__
+    auto path = (std::filesystem::temp_directory_path() / "anyps5-jit-XXXXXX").string();
+    const int file = mkstemp(path.data());
+    if (file < 0) return HostFailure("create JIT shared memory", errno);
+    if (unlink(path.c_str()) != 0 || fcntl(file, F_SETFD, FD_CLOEXEC) != 0) {
+        const int error = errno;
+        ::close(file);
+        return HostFailure("create JIT shared memory", error);
+    }
+#else
     const int file = memfd_create("anyps5 jit shared memory", MFD_CLOEXEC);
     if (file < 0) return HostFailure("create JIT shared memory", errno);
+#endif
     const bool representable = bytes <= static_cast<std::uint64_t>(std::numeric_limits<off_t>::max());
     if (!representable || ftruncate(file, static_cast<off_t>(bytes)) != 0) {
         const int error = !representable || errno == EFBIG ? ENOMEM : errno;
diff --git a/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp b/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp
index 54cdbaf12d..44a02c7f12 100644
--- a/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp
@@ -154,14 +154,10 @@ struct PhysicalMemoryPool {
     }
 
     int LargestFree(int64_t searchStart, int64_t searchEnd, size_t alignment, int64_t* startOut, size_t* sizeOut) {
-        if (!startOut || !sizeOut) return SCE_KERNEL_ERROR_EINVAL;
-        if (searchStart < 0 || searchEnd <= searchStart) return SCE_KERNEL_ERROR_EAGAIN;
-        uint64_t align;
-        if (!NormalizeAlignment(alignment, align)) return SCE_KERNEL_ERROR_EAGAIN;
-
-        uint64_t cur;
-        if (!RoundUp(static_cast<uint64_t>(searchStart), kPage, cur)) return SCE_KERNEL_ERROR_EAGAIN;
-        const uint64_t limit = std::min<uint64_t>(static_cast<uint64_t>(searchEnd), kPoolBytes) & ~(kPage - 1);
+        if ((alignment & (alignment - 1)) != 0) return SCE_KERNEL_ERROR_EINVAL;
+        const uint64_t alignMask = std::max<uint64_t>(alignment, kPage) - 1;
+        uint64_t cur = searchStart > 0 ? std::min<uint64_t>(static_cast<uint64_t>(searchStart) & ~(kPage - 1), kPoolBytes) : 0;
+        const uint64_t limit = searchEnd > 0 ? std::min<uint64_t>((static_cast<uint64_t>(searchEnd) + kPage - 1) & ~(kPage - 1), kPoolBytes) : 0;
 
         std::lock_guard<std::mutex> lock(_mutex);
         uint64_t bestStart = 0;
@@ -175,11 +171,13 @@ struct PhysicalMemoryPool {
             uint64_t runEnd = cur;
             while (runEnd < limit && !_used[runEnd / kPage]) runEnd += kPage;
 
-            uint64_t alignedStart;
-            if (!RoundUp(cur, align, alignedStart)) break;
-            if (alignedStart < runEnd && runEnd - alignedStart > bestSize) {
-                bestStart = alignedStart;
-                bestSize = runEnd - alignedStart;
+            const int64_t low = std::max(static_cast<int64_t>(cur), searchStart);
+            const int64_t high = std::min(static_cast<int64_t>(runEnd), searchEnd);
+            const int64_t alignedStart = static_cast<int64_t>((static_cast<uint64_t>(low) + alignMask) & ~alignMask);
+            const uint64_t size = static_cast<uint64_t>(high) - static_cast<uint64_t>(alignedStart);
+            if (low < high && alignedStart < high && size > bestSize) {
+                bestStart = static_cast<uint64_t>(alignedStart);
+                bestSize = size;
             }
             cur = runEnd;
         }
@@ -267,7 +265,15 @@ private:
         bool splitHi = false;
         try {
             splitHi = _splitAt(hi);
-            ForgetDirectMemory(static_cast<int64_t>(lo), static_cast<size_t>(hi - lo));
+            for (size_t page = first; page < first + count;) {
+                if (!_used[page]) {
+                    ++page;
+                    continue;
+                }
+                const size_t runStart = page;
+                while (page < first + count && _used[page]) ++page;
+                ForgetDirectMemory(static_cast<int64_t>(runStart * kPage), static_cast<size_t>((page - runStart) * kPage));
+            }
         } catch (...) {
             if (splitHi) _unsplitAt(hi);
             if (splitLo) _unsplitAt(lo);
diff --git a/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp b/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp
index 7f15f884a1..d20fb3c364 100644
--- a/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/MemoryPoolExport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <exception>
diff --git a/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp b/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp
index c540f34c99..24ad4c0331 100644
--- a/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp
+++ b/core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "DirectMemory.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -21,16 +23,6 @@
 #include "prx/libkernel/File/include/RandomDevice.hpp"
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI sceKernelMunmap(std::uint64_t address, std::size_t length);
-extern "C" int APS5_VABI sceKernelMlock_nid_postfix(void* address, std::uint64_t length);
-extern "C" int APS5_VABI sceKernelMunlock_nid_postfix(void* address, std::uint64_t length);
-extern "C" int APS5_VABI sceKernelMunlockall_nid_postfix();
-extern "C" int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, uint64_t info_size);
-extern "C" std::int64_t APS5_VABI sceKernelPread(int descriptor, void* buffer, std::size_t length, std::int64_t offset);
-extern "C" int APS5_VABI munmap_nid_postfix(void* address, std::size_t length) noexcept;
-extern "C" int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
-
 namespace {
 // FreeBSD/PS5 ABI values, independent of the host's errno and mmap constants.
 constexpr int GuestInvalid = 22;
@@ -38,6 +30,7 @@ constexpr int GuestNoMemory = 12;
 constexpr int GuestBadDescriptor = 9;
 constexpr int GuestAccess = 13;
 constexpr int GuestFault = 14;
+constexpr int GuestBusy = 16;
 constexpr int GuestIoError = 5;
 constexpr int GuestNotSupported = 45;
 constexpr int GuestShared = 0x1;
@@ -130,6 +123,7 @@ void* MapPrivateFileCopy(void* address, std::size_t rounded, int protection, int
         const auto read = sceKernelPread(descriptor, static_cast<unsigned char*>(mapped) + done, static_cast<std::size_t>(copied - done), static_cast<std::int64_t>(start + done));
         if (read <= 0) {
             munmap_nid_postfix(mapped, rounded);
+
             return failed(read < 0 ? static_cast<int>(read & 0xffff) : GuestIoError);
         }
         done += static_cast<std::uint64_t>(read);
@@ -137,6 +131,7 @@ void* MapPrivateFileCopy(void* address, std::size_t rounded, int protection, int
     if (protection != 3 && mprotect_nid_postfix(mapped, rounded, protection) != 0) {
         const int error = *__error_nid_postfix();
         munmap_nid_postfix(mapped, rounded);
+
         return failed(error);
     }
     return mapped;
@@ -171,7 +166,7 @@ void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protecti
 #endif
         const bool exclusive = fixedAnonymous && (mappingFlags & GuestMapExclusive) != 0;
         const int placement = fixedAnonymous ? GuestMapFixed | (exclusive ? GuestMapNoOverwrite : 0) : 0;
-        void* mapped = fixedAnonymous ? address : nullptr;
+        void* mapped = address;
         const auto alignment = !fixedAnonymous && (flags & GuestAlignedSuper) != 0 ? SuperpageSize : PS5_PAGE_SIZE;
         try {
             const auto result = DoMapAnon(&mapped, rounded, protection, placement, alignment, exclusive, fixedAnonymous);
@@ -337,7 +332,7 @@ int APS5_VABI msync_nid_postfix(void* address, std::size_t length, int flags) {
     if (end < start) return failed(GuestInvalid);
     if ((flags & (GuestSyncAsync | GuestSyncInvalidate)) == (GuestSyncAsync | GuestSyncInvalidate)) return failed(GuestInvalid);
     if (start == end ? !Mapped(start) : !GuestRangeMapped(start, end)) return failed(GuestNoMemory);
-    if ((flags & GuestSyncInvalidate) != 0) throw std::runtime_error("msync: MS_INVALIDATE is not implemented");
+    if ((flags & GuestSyncInvalidate) != 0) return failed(GuestBusy);
     return 0;
 }
 
@@ -368,6 +363,7 @@ int APS5_VABI mincore_nid_postfix(const void* address, std::size_t length, char*
     for (auto cursor = first; cursor < end;) {
         VirtualQueryInfo info{};
         sceKernelVirtualQuery(reinterpret_cast<const void*>(cursor), 0, &info, sizeof(info));
+
         const auto extentEnd = std::min<std::uintptr_t>(info.end, end);
         std::fill_n(vec + (cursor - first) / PS5_PAGE_SIZE, (extentEnd - cursor) / PS5_PAGE_SIZE, static_cast<char>(info.is_committed != 0 ? 1 : 0));
         cursor = extentEnd;
diff --git a/core/libs/prx/libkernel/Equeue/Equeue.cpp b/core/libs/prx/libkernel/Equeue/Equeue.cpp
index 1256cc9391..f4ad697406 100644
--- a/core/libs/prx/libkernel/Equeue/Equeue.cpp
+++ b/core/libs/prx/libkernel/Equeue/Equeue.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
 #include "Equeue.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libc/include/General.hpp"
@@ -12,6 +14,62 @@
 #include <stdexcept>
 #include <unordered_map>
 
+static constexpr std::uint64_t FileRepollNs = 1000000;
+
+struct UnreadFile {
+    bool measured = false;
+    std::int64_t bytes = 0;
+};
+
+static UnreadFile UnreadFileBytes(int file) {
+    FileStat status{};
+    if (sceKernelFstat(file, &status) != 0) {
+        return {};
+    }
+    const std::int64_t offset = sceKernelLseek(file, 0, 1);
+    if (offset < 0) {
+        return {};
+    }
+    return {true, status.st_size - offset};
+}
+
+static bool RegularFile(int descriptor) {
+    if (File::IsHostStream(descriptor)) {
+        return false;
+    }
+    FileStat status{};
+    return sceKernelFstat(descriptor, &status) == 0 && (status.st_mode & 0170000) == 0100000;
+}
+
+static KernelEqueueEvent FileEvent(int descriptor, int16_t filter, uint16_t flags, void* udata) {
+    KernelEqueueEvent event{};
+    event.event.ident = static_cast<uintptr_t>(descriptor);
+    event.event.filter = filter;
+    event.event.flags = flags;
+    event.event.udata = udata;
+    event.filter.repoll = true;
+    if (filter == EVFILT_WRITE) {
+        event.filter.pollFunc = [](KernelEqueueEvent* e) {
+            e->event.data = 0;
+            return true;
+        };
+    } else {
+        event.filter.owner = std::make_shared<UnreadFile>();
+        event.filter.pollFunc = [](KernelEqueueEvent* e) {
+            const auto* unread = static_cast<const UnreadFile*>(e->filter.owner.get());
+            if (!unread->measured || unread->bytes == 0) {
+                return false;
+            }
+            e->event.data = static_cast<intptr_t>(unread->bytes);
+            return true;
+        };
+    }
+    event.filter.resetFunc = [](KernelEqueueEvent* e) {
+        e->triggered = false;
+    };
+    return event;
+}
+
 static std::unordered_map<KernelEqueue, KernelEqueueRef> g_equeues;
 static std::mutex g_equeueMutex;
 static uint64_t g_nextEqueue = 1;
@@ -21,6 +79,7 @@ struct KernelEqueuePrivate::WaitSet {
     std::vector<std::shared_ptr<void>> held;
     std::vector<std::shared_ptr<KernelEqueuePrivate>> queues;
     uint64_t nearestTimerNs = std::numeric_limits<uint64_t>::max();
+    bool repoll = false;
 };
 
 extern "C" {
@@ -98,6 +157,28 @@ bool KernelEqueuePrivate::PollEvents() {
     return polled;
 }
 
+void KernelEqueuePrivate::MeasureFiles(std::unique_lock<std::mutex>& lock) {
+    std::vector<std::pair<int, std::shared_ptr<void>>> files;
+    for (const auto& e : m_events) {
+        if (e.enabled && e.filter.repoll && e.event.filter == EVFILT_READ) {
+            files.emplace_back(static_cast<int>(e.event.ident), e.filter.owner);
+        }
+    }
+    if (files.empty()) {
+        return;
+    }
+    lock.unlock();
+    std::vector<UnreadFile> measured;
+    measured.reserve(files.size());
+    for (const auto& [file, owner] : files) {
+        measured.push_back(UnreadFileBytes(file));
+    }
+    lock.lock();
+    for (std::size_t i = 0; i < files.size(); ++i) {
+        *static_cast<UnreadFile*>(files[i].second.get()) = measured[i];
+    }
+}
+
 void KernelEqueuePrivate::WakePollers() {
     for (const auto waker : m_pollers) {
         GuestSockets::Wake(waker);
@@ -117,6 +198,8 @@ void KernelEqueuePrivate::GatherInterests(WaitSet& wait, std::uintptr_t waker, b
         }
         if (e.filter.watched) {
             GatherWatched(wait, e.filter.watched, waker);
+        } else if (e.filter.repoll) {
+            wait.repoll = true;
         } else if (e.filter.waitDescriptor >= 0) {
             wait.interests.push_back({e.filter.waitDescriptor, false});
             wait.held.push_back(e.filter.owner);
@@ -151,6 +234,12 @@ void KernelEqueuePrivate::WaitForDescriptors(std::unique_lock<std::mutex>& lock,
     const auto waker = GuestSockets::CurrentWaker();
     WaitSet wait;
     GatherInterests(wait, waker, false);
+    if (wait.repoll) {
+        const std::uint64_t soon = TimedWait::NowNanos() + FileRepollNs;
+        if (deadlineNanos == 0 || deadlineNanos > soon) {
+            deadlineNanos = soon;
+        }
+    }
     m_pollers.push_back(waker);
     if (!wait.queues.empty()) {
         PollEvents();
@@ -187,9 +276,10 @@ int KernelEqueuePrivate::CollectTriggered(KernelEvent* ev, int num) {
         return CollectOncePerWait(ev, num);
     }
     int ret = 0;
+    std::list<KernelEqueueEvent> requeued;
     for (auto it = m_events.begin(); it != m_events.end() && ret < num;) {
         auto& e = *it;
-        if (!e.enabled) {
+        if (!e.triggered || !e.enabled) {
             ++it;
             continue;
         }
@@ -221,8 +311,15 @@ int KernelEqueuePrivate::CollectTriggered(KernelEvent* ev, int num) {
             e.pendingEvents.pop_front();
             e.triggered = true;
         }
-        it = erase ? m_events.erase(it) : std::next(it);
+        const auto next = std::next(it);
+        if (erase) {
+            m_events.erase(it);
+        } else {
+            requeued.splice(requeued.end(), m_events, it);
+        }
+        it = next;
     }
+    m_events.splice(m_events.end(), requeued);
     return ret;
 }
 
@@ -271,6 +368,10 @@ int KernelEqueuePrivate::GetTriggeredEvents(KernelEvent* ev, int num) {
     if (m_closed) {
         return SCE_KERNEL_ERROR_EBADF;
     }
+    MeasureFiles(lock);
+    if (m_closed) {
+        return SCE_KERNEL_ERROR_EBADF;
+    }
     TriggerExpiredTimers(MonotonicNs());
     PollEvents();
     return CollectTriggered(ev, num);
@@ -285,6 +386,10 @@ std::size_t KernelEqueuePrivate::CountTriggeredEvents() {
     if (m_closed) {
         return 0;
     }
+    MeasureFiles(lock);
+    if (m_closed) {
+        return 0;
+    }
     TriggerExpiredTimers(MonotonicNs());
     PollEvents();
     return static_cast<std::size_t>(std::count_if(m_events.begin(), m_events.end(), [](const KernelEqueueEvent& event) { return event.enabled && event.triggered; }));
@@ -311,6 +416,10 @@ int KernelEqueuePrivate::WaitForEventsUntil(KernelEvent* ev, int num, std::uint6
         return SCE_KERNEL_ERROR_EBADF;
     }
     for (;;) {
+        MeasureFiles(lock);
+        if (m_closed) {
+            return SCE_KERNEL_ERROR_EBADF;
+        }
         TriggerExpiredTimers(MonotonicNs());
         const bool polling = PollEvents();
         const int ret = CollectTriggered(ev, num);
@@ -414,6 +523,9 @@ int KernelEqueuePrivate::EditEvent(uintptr_t ident, int16_t filter, const std::f
     if (m_closed) {
         return SCE_KERNEL_ERROR_EBADF;
     }
+    if (filter == EVFILT_TIMER) {
+        TriggerExpiredTimers(MonotonicNs());
+    }
     auto it = std::find_if(m_events.begin(), m_events.end(),
         [ident, filter](const auto& e) {
             return e.event.ident == ident && e.event.filter == filter;
@@ -503,7 +615,6 @@ int APS5_VABI EqueueDeleteEvent_nid_postfix(KernelEqueue eq, uintptr_t ident, in
     return owner->DeleteEvent(ident, filter);
 }
 
-
 int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name) {
     if (eq == nullptr || name == nullptr) {
         return SCE_KERNEL_ERROR_EINVAL;
@@ -685,6 +796,7 @@ int APS5_VABI sceKernelAddAmprEvent(KernelEqueue eq, int id, void* udata) {
         }
     };
     EqueueAddEvent_nid_postfix(eq, event);
+
     return EQUEUE_OK;
 }
 
@@ -697,6 +809,7 @@ int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue eq, int id) {
         return EQUEUE_OK;
     }
     EqueueDeleteEvent_nid_postfix(eq, static_cast<uintptr_t>(id), EVFILT_AMPR);
+
     return EQUEUE_OK;
 }
 
@@ -709,15 +822,19 @@ static int AddDescriptorEvent(KernelEqueue eq, int fd, std::size_t size, void* u
     std::int64_t available = 0;
     bool eof = false;
     const bool isPipe = !isSocket && filter == EVFILT_READ && !File::IsHostStream(fd) && GuestSockets::PipeReadState(fd, &available, &eof);
-    if (!isSocket && !isPipe && DescriptorIsOpen_nid_no_patch(fd)) {
-        NotImplemented_nid_no_patch(filter == EVFILT_READ ? "sceKernelAddReadEvent: descriptor that is neither a socket nor the read end of a pipe" : "sceKernelAddWriteEvent: non-socket descriptor");
+    const bool isFile = !isSocket && !isPipe && RegularFile(fd);
+    if (!isSocket && !isPipe && !isFile && DescriptorIsOpen_nid_no_patch(fd)) {
+        NotImplemented_nid_no_patch(filter == EVFILT_READ ? "sceKernelAddReadEvent: descriptor that is neither a socket, the read end of a pipe nor a regular file" : "sceKernelAddWriteEvent: descriptor that is neither a socket nor a regular file");
     }
     if (size > 1 && !isPipe) {
         NotImplemented_nid_no_patch(filter == EVFILT_READ ? "sceKernelAddReadEvent: low watermark" : "sceKernelAddWriteEvent: low watermark");
     }
-    if (!isSocket && !isPipe) {
+    if (!isSocket && !isPipe && !isFile) {
         return SCE_KERNEL_ERROR_EBADF;
     }
+    if (isFile) {
+        return EqueueAddEvent_nid_postfix(eq, FileEvent(fd, filter, EV_ADD, udata));
+    }
     return EqueueAddEvent_nid_postfix(eq, EqueueDescriptorEvent(fd, filter, EV_ADD, udata));
 }
 
diff --git a/core/libs/prx/libkernel/Equeue/Equeue.hpp b/core/libs/prx/libkernel/Equeue/Equeue.hpp
index ef217632d6..6b9194be56 100644
--- a/core/libs/prx/libkernel/Equeue/Equeue.hpp
+++ b/core/libs/prx/libkernel/Equeue/Equeue.hpp
@@ -57,6 +57,7 @@ struct KernelFilter {
     EqueueDeleteFunc deleteEventFunc = nullptr;
     EqueuePollFunc pollFunc = nullptr;
     int waitDescriptor = -1;
+    bool repoll = false;
     std::shared_ptr<KernelEqueuePrivate> watched;
 };
 
@@ -104,6 +105,7 @@ private:
     int CollectTriggered(KernelEvent* ev, int num);
     int CollectOncePerWait(KernelEvent* ev, int num);
     bool PollEvents();
+    void MeasureFiles(std::unique_lock<std::mutex>& lock);
     void WakePollers();
     void WaitForDescriptors(std::unique_lock<std::mutex>& lock, std::uint64_t deadlineNanos);
     void GatherInterests(WaitSet& wait, std::uintptr_t waker, bool nested);
diff --git a/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp b/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp
index e72bfe3900..9065ffd156 100644
--- a/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp
+++ b/core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <stdexcept>
@@ -21,7 +22,13 @@ intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent* ev) {
 
 int APS5_VABI sceKernelGetEventError(const KernelEvent* ev) {
     const KernelEvent& event = requireEvent(ev, __func__);
-    return (event.flags & EV_ERROR) != 0 ? static_cast<int>(event.data) : 0;
+    if (event.fflags == 0) {
+        return 0;
+    }
+    if (event.fflags > 0xFFFFu) {
+        throw std::runtime_error(std::string(__func__) + ": fflags " + std::to_string(event.fflags) + " above 0xFFFF");
+    }
+    return static_cast<int>(0x80020000u | event.fflags);
 }
 
 intptr_t APS5_VABI sceKernelGetEventFflags(const KernelEvent* ev) {
diff --git a/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp b/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
index 04fe98539f..084de00999 100644
--- a/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
+++ b/core/libs/prx/libkernel/Equeue/src/FileEvent.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/File.hpp"
@@ -165,6 +166,16 @@ struct Snapshot {
 };
 
 bool TakeSnapshot(HANDLE handle, Snapshot& snapshot) {
+    std::wstring path(MAX_PATH, L'\0');
+    auto length = ::GetFinalPathNameByHandleW(handle, path.data(), static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED);
+    if (length >= path.size()) {
+        path.resize(length);
+        length = ::GetFinalPathNameByHandleW(handle, path.data(), length, FILE_NAME_NORMALIZED);
+    }
+    if (length != 0 && length < path.size()) {
+        path.resize(length);
+        snapshot.path = std::move(path);
+    }
     FILE_BASIC_INFO basic{};
     FILE_STANDARD_INFO standard{};
     if (!::GetFileInformationByHandleEx(handle, FileBasicInfo, &basic, sizeof(basic)) ||
@@ -178,16 +189,6 @@ bool TakeSnapshot(HANDLE handle, Snapshot& snapshot) {
     snapshot.creation = basic.CreationTime.QuadPart;
     snapshot.lastWrite = basic.LastWriteTime.QuadPart;
     snapshot.change = basic.ChangeTime.QuadPart;
-    std::wstring path(MAX_PATH, L'\0');
-    auto length = ::GetFinalPathNameByHandleW(handle, path.data(), static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED);
-    if (length >= path.size()) {
-        path.resize(length);
-        length = ::GetFinalPathNameByHandleW(handle, path.data(), length, FILE_NAME_NORMALIZED);
-    }
-    if (length != 0 && length < path.size()) {
-        path.resize(length);
-        snapshot.path = std::move(path);
-    }
     return true;
 }
 
diff --git a/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp b/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp
index 917bc4a8f8..66a863d6c7 100644
--- a/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp
+++ b/core/libs/prx/libkernel/Equeue/src/Kqueue.cpp
@@ -1,8 +1,14 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libkernel/Equeue/include/EdgeWatch.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/File/include/ArchivedFile.hpp"
+#include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/HostStreams.hpp"
+#include "prx/libkernel/File/include/RandomDevice.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
 #include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 
@@ -19,17 +25,18 @@
 #include <vector>
 
 #ifdef _WIN32
+#include "prx/libc/include/WindowsDescriptor.hpp"
 #include <fcntl.h>
 #include <io.h>
 #else
 #include <fcntl.h>
+#include <sys/stat.h>
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
+constexpr int GUEST_EPERM = 1;
 constexpr int GUEST_ENOENT = 2;
 constexpr int GUEST_EBADF = 9;
 constexpr int GUEST_EFAULT = 14;
@@ -39,6 +46,10 @@ constexpr int GUEST_EMFILE = 24;
 constexpr int GUEST_EPIPE = 32;
 
 constexpr int KQ_NEVENTS = 8;
+constexpr std::int16_t EVFILT_AIO = -3;
+constexpr std::int16_t EVFILT_PROCDESC = -8;
+constexpr std::int16_t EVFILT_LIO = -10;
+constexpr std::int16_t EVFILT_SENDFILE = -12;
 constexpr std::uint32_t NOTE_FFCTRLMASK = 0xc0000000;
 constexpr std::uint32_t NOTE_FFLAGSMASK = 0x00ffffff;
 constexpr std::uint32_t NOTE_FFAND = 0x40000000;
@@ -128,6 +139,27 @@ int DescriptorFilterError(int kqueueDescriptor, std::uintptr_t ident) {
     return descriptor == kqueueDescriptor ? GUEST_EINVAL : 0;
 }
 
+bool MeasuredProcdescDescriptor(int descriptor) {
+    std::shared_ptr<void> owner;
+    std::uintptr_t native = 0;
+    if (GuestSockets::IsOpen(descriptor) || KernelLookupSocketNative_nid_no_patch(descriptor, &owner, &native) || FindKqueue(descriptor)) {
+        return true;
+    }
+    if (descriptor < 3 || File::IsRandomDevice(descriptor)) {
+        return false;
+    }
+    if (File::IsArchivedFile(descriptor) || File::DirectoryDescriptorPath(descriptor)) {
+        return true;
+    }
+#ifdef _WIN32
+    const DWORD type = ::GetFileType(WindowsDescriptorHandle_nid_no_patch(descriptor));
+    return type == FILE_TYPE_DISK || type == FILE_TYPE_PIPE;
+#else
+    struct stat status{};
+    return ::fstat(descriptor, &status) == 0 && (S_ISREG(status.st_mode) || S_ISDIR(status.st_mode) || S_ISFIFO(status.st_mode) || S_ISSOCK(status.st_mode));
+#endif
+}
+
 std::int64_t DescriptorLowWater(const KernelEvent& change) {
     if ((change.fflags & NOTE_LOWAT) == 0 || !GuestSockets::IsOpen(static_cast<int>(change.ident))) {
         return 0;
@@ -327,6 +359,47 @@ void TouchUserKnote(KernelEqueueEvent& event, KernelEvent& change) {
     }
 }
 
+int ModifyTimerKnote(const KernelEqueueRef& queue, KernelEvent& change) {
+    if ((change.flags & ~(EV_ADD | EV_ONESHOT)) != 0) {
+        NotImplemented_nid_no_patch("kevent: re-adding an EVFILT_TIMER with flags other than EV_ONESHOT");
+    }
+    if (change.data <= 0 || change.fflags != 0) {
+        NotImplemented_nid_no_patch("kevent: re-adding an EVFILT_TIMER with nonzero fflags or a period of 0 or less");
+    }
+    const auto periodNs = TimerPeriodNanos(change.data, change.fflags);
+    bool oneShot = false;
+    bool disabled = false;
+    bool overflow = false;
+    const int error = GuestErrno(queue->EditEvent(change.ident, change.filter, [&change, &oneShot, &disabled, &overflow, periodNs](KernelEqueueEvent& event) {
+        if (event.intervalNs == 0) {
+            oneShot = true;
+            return;
+        }
+        if (!event.enabled) {
+            disabled = true;
+            return;
+        }
+        if (*periodNs > std::numeric_limits<std::uint64_t>::max() - event.deadlineNs) {
+            overflow = true;
+            return;
+        }
+        event.intervalNs = *periodNs;
+        event.event.udata = change.udata;
+    }));
+    if (oneShot) {
+        NotImplemented_nid_no_patch("kevent: re-adding a one-shot EVFILT_TIMER");
+    }
+    if (disabled) {
+        NotImplemented_nid_no_patch("kevent: re-adding a disabled EVFILT_TIMER");
+    }
+    if (overflow) {
+        NotImplemented_nid_no_patch("kevent: re-adding an EVFILT_TIMER with a period that overflows the armed expiry");
+    }
+    change.fflags = 0;
+    change.data = 0;
+    return error;
+}
+
 int ModifyKnote(const KernelEqueueRef& queue, KernelEvent& change) {
     if (change.filter == EVFILT_TIMER) {
         NotImplemented_nid_no_patch("kevent: changing an existing EVFILT_TIMER");
@@ -369,6 +442,28 @@ int Register(const KernelEqueueRef& queue, int kqueueDescriptor, KernelEvent& ch
     if (change.filter > 0) {
         return GUEST_EINVAL;
     }
+    if (change.filter == EVFILT_AIO || change.filter == EVFILT_LIO || change.filter == EVFILT_SENDFILE) {
+        if ((change.flags & EV_ADD) == 0) {
+            return GUEST_ENOENT;
+        }
+        change.fflags = 0;
+        change.data = 0;
+        return GUEST_EPERM;
+    }
+    if (change.filter == EVFILT_PROCDESC) {
+        if (const int error = DescriptorFilterError(kqueueDescriptor, change.ident)) {
+            return error;
+        }
+        if ((change.flags & EV_ADD) == 0) {
+            return GUEST_ENOENT;
+        }
+        if (!MeasuredProcdescDescriptor(static_cast<int>(change.ident))) {
+            NotImplemented_nid_no_patch("kevent: EVFILT_PROCDESC on a kind of descriptor that was not measured");
+        }
+        change.fflags = 0;
+        change.data = 0;
+        return GUEST_EINVAL;
+    }
     if (change.filter != EVFILT_READ && change.filter != EVFILT_WRITE && change.filter != EVFILT_VNODE && change.filter != EVFILT_TIMER && change.filter != EVFILT_USER) {
         NotImplemented_nid_no_patch(("kevent: filter " + std::to_string(change.filter)).c_str());
     }
@@ -403,6 +498,9 @@ int Register(const KernelEqueueRef& queue, int kqueueDescriptor, KernelEvent& ch
     if ((change.flags & EV_DELETE) != 0) {
         return GuestErrno(queue->DeleteEvent(change.ident, change.filter));
     }
+    if (change.filter == EVFILT_TIMER && (change.flags & EV_ADD) != 0) {
+        return ModifyTimerKnote(queue, change);
+    }
     return ModifyKnote(queue, change);
 }
 
diff --git a/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp b/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp
index a6403ce990..29f13e6df2 100644
--- a/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp
+++ b/core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/SaveDataCore.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <atomic>
@@ -14,21 +16,27 @@
 #include <thread>
 #include <unordered_map>
 #include <cstdio>
+#include <cstring>
 #include <cstdlib>
 
 static constexpr int SCE_OK = 0;
 static constexpr int SCE_KERNEL_ERROR_EPERM = 0x80020001;
-static constexpr int SCE_KERNEL_ERROR_ENOENT = 0x80020002;
 static constexpr int SCE_KERNEL_ERROR_ESRCH = 0x80020003;
 static constexpr int SCE_KERNEL_ERROR_ENOMEM = 0x8002000C;
 static constexpr int SCE_KERNEL_ERROR_EACCES = 0x8002000D;
 static constexpr int SCE_KERNEL_ERROR_EBUSY = 0x80020010;
 static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
 static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = 0x8002003C;
+static constexpr int SCE_KERNEL_ERROR_EFAULT = 0x8002000E;
+static constexpr int SCE_KERNEL_ERROR_ENAMETOOLONG = 0x8002003F;
 static constexpr int SCE_KERNEL_ERROR_ECANCELED = 0x80020055;
 
+static constexpr uint32_t EVF_ATTR_TH_FIFO = 0x01;
+static constexpr uint32_t EVF_ATTR_TH_PRIO = 0x02;
 static constexpr uint32_t EVF_ATTR_SINGLE = 0x10;
 static constexpr uint32_t EVF_ATTR_MULTI = 0x20;
+static constexpr uint32_t EVF_ATTR_SHARED = 0x100;
+static constexpr size_t EVF_NAME_CAPACITY = 32;
 static constexpr uint32_t EVF_WAITMODE_AND = 0x01;
 static constexpr uint32_t EVF_WAITMODE_OR = 0x02;
 static constexpr uint32_t EVF_WAITMODE_CLEAR_ALL = 0x10;
@@ -49,6 +57,7 @@ struct KernelEventFlagPrivate {
     std::string _name;
     uint64_t _pattern = 0;
     bool _multipleWaiters = false;
+    bool _shared = false;
     bool _deleted = false;
     int _waiters = 0;
     uint64_t _cancelGeneration = 0;
@@ -84,20 +93,33 @@ struct KernelEventFlagPrivate {
 
 namespace {
 
-std::shared_mutex eventFlagRegistryMutex;
-std::unordered_map<KernelEventFlag, std::shared_ptr<KernelEventFlagPrivate>> eventFlagRegistry;
+struct EventFlagHandle {
+    std::shared_ptr<KernelEventFlagPrivate> flag;
+    bool opened = false;
+};
 
-std::shared_ptr<KernelEventFlagPrivate> ResolveEventFlag(KernelEventFlag handle) {
+std::shared_mutex eventFlagRegistryMutex;
+std::unordered_map<KernelEventFlag, std::shared_ptr<EventFlagHandle>> eventFlagRegistry;
+
+std::shared_ptr<EventFlagHandle> ResolveEventFlag(KernelEventFlag handle) {
     if (!handle) return {};
     std::shared_lock lock(eventFlagRegistryMutex);
     const auto it = eventFlagRegistry.find(handle);
-    return it == eventFlagRegistry.end() ? std::shared_ptr<KernelEventFlagPrivate>{} : it->second;
+    return it == eventFlagRegistry.end() ? std::shared_ptr<EventFlagHandle>{} : it->second;
 }
 
-void RetireEventFlag(KernelEventFlag handle, const std::shared_ptr<KernelEventFlagPrivate>& owner) {
+KernelEventFlag RegisterEventFlag(const std::shared_ptr<EventFlagHandle>& entry) {
+    const auto handle = reinterpret_cast<KernelEventFlag>(entry.get());
+    eventFlagRegistry.emplace(handle, entry);
+    return handle;
+}
+
+bool RetireEventFlag(KernelEventFlag handle, const std::shared_ptr<EventFlagHandle>& owner) {
     std::unique_lock lock(eventFlagRegistryMutex);
     const auto it = eventFlagRegistry.find(handle);
-    if (it != eventFlagRegistry.end() && it->second == owner) eventFlagRegistry.erase(it);
+    if (it == eventFlagRegistry.end() || it->second != owner) return false;
+    eventFlagRegistry.erase(it);
+    return true;
 }
 
 }
@@ -110,7 +132,6 @@ static bool TraceSync() {
 static bool IsValidWaitMode(uint32_t waitMode) {
     const uint32_t match = waitMode & (EVF_WAITMODE_AND | EVF_WAITMODE_OR);
     const uint32_t clear = waitMode & (EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT);
-    if ((waitMode & ~(EVF_WAITMODE_AND | EVF_WAITMODE_OR | EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT)) != 0) return false;
     return (match == EVF_WAITMODE_AND || match == EVF_WAITMODE_OR) && clear != (EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT);
 }
 
@@ -130,130 +151,178 @@ int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, ui
     (void)param;
     if (!ef || !name) return SCE_KERNEL_ERROR_EINVAL;
     if ((attr & EVF_ATTR_SINGLE) && (attr & EVF_ATTR_MULTI)) return SCE_KERNEL_ERROR_EINVAL;
-    if ((attr & ~0x33u) != 0) return SCE_KERNEL_ERROR_EINVAL;
+    if ((attr & EVF_ATTR_TH_FIFO) && (attr & EVF_ATTR_TH_PRIO)) return SCE_KERNEL_ERROR_EINVAL;
+    if ((attr & ~(EVF_ATTR_TH_FIFO | EVF_ATTR_TH_PRIO | EVF_ATTR_SINGLE | EVF_ATTR_MULTI | EVF_ATTR_SHARED)) != 0) return SCE_KERNEL_ERROR_EINVAL;
+    if (std::strlen(name) >= EVF_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG;
+    KernelEventFlag handle = nullptr;
     std::shared_ptr<KernelEventFlagPrivate> flag;
     try {
         flag = std::make_shared<KernelEventFlagPrivate>();
         flag->_name = name;
         flag->_pattern = init_pattern;
         flag->_multipleWaiters = (attr & EVF_ATTR_MULTI) != 0;
+        flag->_shared = (attr & EVF_ATTR_SHARED) != 0;
+        auto entry = std::make_shared<EventFlagHandle>(EventFlagHandle{flag, false});
         std::unique_lock lock(eventFlagRegistryMutex);
-        eventFlagRegistry.emplace(flag.get(), flag);
+        if (flag->_shared) {
+            for (const auto& [other, otherEntry] : eventFlagRegistry) {
+                if (otherEntry->opened || !otherEntry->flag->_shared) continue;
+                std::lock_guard flagLock(otherEntry->flag->_mutex);
+                if (!otherEntry->flag->_deleted && otherEntry->flag->_name == flag->_name) return SCE_KERNEL_ERROR_EPERM;
+            }
+        }
+        handle = RegisterEventFlag(entry);
     } catch (const std::bad_alloc&) {
         return SCE_KERNEL_ERROR_ENOMEM;
     }
-    *ef = flag.get();
-    if (TraceSync()) std::fprintf(stderr, "[evf] create %p '%s' attr=0x%x init=0x%llx\n", static_cast<void*>(flag.get()), name, attr, static_cast<unsigned long long>(init_pattern));
+    *ef = handle;
+    if (TraceSync()) std::fprintf(stderr, "[evf] create %p '%s' attr=0x%x init=0x%llx\n", static_cast<void*>(handle), name, attr, static_cast<unsigned long long>(init_pattern));
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelOpenEventFlag(KernelEventFlag* ef, const char* name) {
-    if (!ef || !name) return SCE_KERNEL_ERROR_EINVAL;
-    std::shared_lock lock(eventFlagRegistryMutex);
-    for (const auto& [handle, flag] : eventFlagRegistry) {
-        std::lock_guard flagLock(flag->_mutex);
-        if (flag->_deleted || flag->_name != name) continue;
-        *ef = handle;
-        return SCE_OK;
+    if (!name) return SCE_KERNEL_ERROR_EFAULT;
+    if (std::strlen(name) >= EVF_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG;
+    try {
+        std::unique_lock lock(eventFlagRegistryMutex);
+        std::shared_ptr<KernelEventFlagPrivate> target;
+        for (const auto& [handle, entry] : eventFlagRegistry) {
+            if (entry->opened || !entry->flag->_shared) continue;
+            std::lock_guard flagLock(entry->flag->_mutex);
+            if (entry->flag->_deleted || entry->flag->_name != name) continue;
+            target = entry->flag;
+            break;
+        }
+        if (!target) return SCE_KERNEL_ERROR_ESRCH;
+        if (!ef) return SCE_KERNEL_ERROR_EFAULT;
+        *ef = RegisterEventFlag(std::make_shared<EventFlagHandle>(EventFlagHandle{std::move(target), true}));
+    } catch (const std::bad_alloc&) {
+        return SCE_KERNEL_ERROR_ENOMEM;
     }
-    return SCE_KERNEL_ERROR_ENOENT;
+    return SCE_OK;
+}
+
+int APS5_VABI sceKernelCloseEventFlag(KernelEventFlag ef) {
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    if (!entry->opened) return SCE_KERNEL_ERROR_EPERM;
+    return RetireEventFlag(ef, entry) ? SCE_OK : SCE_KERNEL_ERROR_ESRCH;
 }
 
 int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::unique_lock lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    ef->_deleted = true;
-    ef->_changed.NotifyAll();
-    ef->_changed.Wait(lock, [&] { return ef->_waiters == 0; });
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    if (entry->opened) return SCE_KERNEL_ERROR_EPERM;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::unique_lock lock(flag->_mutex);
+    if (flag->_deleted) return SCE_KERNEL_ERROR_ESRCH;
+    flag->_deleted = true;
+    flag->_changed.NotifyAll();
+    flag->_changed.Wait(lock, [&] { return flag->_waiters == 0; });
     lock.unlock();
-    RetireEventFlag(ef, keepAlive);
+    RetireEventFlag(ef, entry);
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, uint64_t bit_pattern) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    ef->_pattern |= bit_pattern;
-    if (TraceSync()) std::fprintf(stderr, "[evf] set %p '%s' |=0x%llx -> 0x%llx\n", static_cast<void*>(ef), ef->_name.c_str(), static_cast<unsigned long long>(bit_pattern), static_cast<unsigned long long>(ef->_pattern));
-    for (auto* waiter = ef->_waiterHead; waiter != nullptr; waiter = waiter->next) {
-        if (!waiter->satisfied && IsSatisfied(ef->_pattern, waiter->bitPattern, waiter->waitMode)) {
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) return entry->opened ? SCE_OK : SCE_KERNEL_ERROR_ESRCH;
+    flag->_pattern |= bit_pattern;
+    if (TraceSync()) std::fprintf(stderr, "[evf] set %p '%s' |=0x%llx -> 0x%llx\n", static_cast<void*>(ef), flag->_name.c_str(), static_cast<unsigned long long>(bit_pattern), static_cast<unsigned long long>(flag->_pattern));
+    for (auto* waiter = flag->_waiterHead; waiter != nullptr; waiter = waiter->next) {
+        if (!waiter->satisfied && IsSatisfied(flag->_pattern, waiter->bitPattern, waiter->waitMode)) {
             waiter->satisfied = true;
-            waiter->resultPattern = ef->_pattern;
+            waiter->resultPattern = flag->_pattern;
             if (waiter->waitMode & EVF_WAITMODE_CLEAR_ALL) {
-                ef->_pattern = 0;
+                flag->_pattern = 0;
             } else if (waiter->waitMode & EVF_WAITMODE_CLEAR_PAT) {
-                ef->_pattern &= ~waiter->bitPattern;
+                flag->_pattern &= ~waiter->bitPattern;
             }
         }
     }
-    ef->_changed.NotifyAll();
+    flag->_changed.NotifyAll();
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelClearEventFlag(KernelEventFlag ef, uint64_t bit_pattern) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    ef->_pattern &= bit_pattern;
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) return entry->opened ? SCE_OK : SCE_KERNEL_ERROR_ESRCH;
+    flag->_pattern &= bit_pattern;
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, uint64_t set_pattern, int* num_wait_threads) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    if (num_wait_threads) *num_wait_threads = ef->_waiters;
-    ef->_pattern = set_pattern;
-    ++ef->_cancelGeneration;
-    ef->_changed.NotifyAll();
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) {
+        if (!entry->opened) return SCE_KERNEL_ERROR_ESRCH;
+        if (num_wait_threads) *num_wait_threads = 0;
+        return SCE_OK;
+    }
+    if (num_wait_threads) *num_wait_threads = flag->_waiters;
+    flag->_pattern = set_pattern;
+    ++flag->_cancelGeneration;
+    flag->_changed.NotifyAll();
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelPollEventFlag(KernelEventFlag ef, uint64_t bit_pattern, uint32_t wait_mode, uint64_t* result_pat) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
     if (bit_pattern == 0 || !IsValidWaitMode(wait_mode)) return SCE_KERNEL_ERROR_EINVAL;
-    std::lock_guard lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    if (!ef->_multipleWaiters && ef->_waiters != 0) return SCE_KERNEL_ERROR_EPERM;
-    if (!IsSatisfied(ef->_pattern, bit_pattern, wait_mode)) {
-        if (result_pat) *result_pat = ef->_pattern;
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::lock_guard lock(flag->_mutex);
+    if (flag->_deleted) {
+        if (!entry->opened) return SCE_KERNEL_ERROR_ESRCH;
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EACCES;
+    }
+    if (!flag->_multipleWaiters && flag->_waiters != 0) {
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EPERM;
+    }
+    if (!IsSatisfied(flag->_pattern, bit_pattern, wait_mode)) {
+        if (result_pat) *result_pat = flag->_pattern;
         return SCE_KERNEL_ERROR_EBUSY;
     }
-    Consume(ef, bit_pattern, wait_mode, result_pat);
+    Consume(flag, bit_pattern, wait_mode, result_pat);
     return SCE_OK;
 }
 
 int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bit_pattern, uint32_t wait_mode, uint64_t* result_pat, KernelUseconds* timeout) {
-    if (!ef) return SCE_KERNEL_ERROR_ESRCH;
-    const auto keepAlive = ResolveEventFlag(ef);
-    if (!keepAlive) return SCE_KERNEL_ERROR_ESRCH;
+    const auto entry = ResolveEventFlag(ef);
+    if (!entry) return SCE_KERNEL_ERROR_ESRCH;
     if (bit_pattern == 0 || !IsValidWaitMode(wait_mode)) return SCE_KERNEL_ERROR_EINVAL;
-    std::unique_lock lock(ef->_mutex);
-    if (ef->_deleted) return SCE_KERNEL_ERROR_ESRCH;
-    if (!ef->_multipleWaiters && ef->_waiters != 0) return SCE_KERNEL_ERROR_EPERM;
-    if (IsSatisfied(ef->_pattern, bit_pattern, wait_mode)) {
-        Consume(ef, bit_pattern, wait_mode, result_pat);
+    KernelEventFlagPrivate* flag = entry->flag.get();
+    std::unique_lock lock(flag->_mutex);
+    if (flag->_deleted) {
+        if (!entry->opened) return SCE_KERNEL_ERROR_ESRCH;
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EACCES;
+    }
+    if (!flag->_multipleWaiters && flag->_waiters != 0) {
+        if (result_pat) *result_pat = 0;
+        return SCE_KERNEL_ERROR_EPERM;
+    }
+    if (IsSatisfied(flag->_pattern, bit_pattern, wait_mode)) {
+        Consume(flag, bit_pattern, wait_mode, result_pat);
         return SCE_OK;
     }
-    const uint64_t generation = ef->_cancelGeneration;
-    if (TraceSync()) std::fprintf(stderr, "[evf] wait %p '%s' want=0x%llx mode=0x%x have=0x%llx timeout=%d caller=%p outer=%p\n", static_cast<void*>(ef), ef->_name.c_str(), static_cast<unsigned long long>(bit_pattern), wait_mode, static_cast<unsigned long long>(ef->_pattern), timeout ? static_cast<int>(*timeout) : -1, __builtin_return_address(0), static_cast<void**>(static_cast<void**>(__builtin_frame_address(0))[0])[1]);
-    ++ef->_waiters;
+    const uint64_t generation = flag->_cancelGeneration;
+    if (TraceSync()) std::fprintf(stderr, "[evf] wait %p '%s' want=0x%llx mode=0x%x have=0x%llx timeout=%d caller=%p outer=%p\n", static_cast<void*>(ef), flag->_name.c_str(), static_cast<unsigned long long>(bit_pattern), wait_mode, static_cast<unsigned long long>(flag->_pattern), timeout ? static_cast<int>(*timeout) : -1, __builtin_return_address(0), static_cast<void**>(static_cast<void**>(__builtin_frame_address(0))[0])[1]);
+    ++flag->_waiters;
     WaiterNode waiter;
     waiter.bitPattern = bit_pattern;
     waiter.waitMode = wait_mode;
-    ef->pushWaiter(&waiter);
+    flag->pushWaiter(&waiter);
     struct WaiterGuard {
         KernelEventFlagPrivate* flag;
         WaiterNode* node;
@@ -262,27 +331,28 @@ int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bit_pattern, u
             --flag->_waiters;
             flag->_changed.NotifyAll();
         }
-    } waiterGuard{ef, &waiter};
-    const auto released = [&] { return ef->_deleted || ef->_cancelGeneration != generation || waiter.satisfied; };
+    } waiterGuard{flag, &waiter};
+    const auto released = [&] { return flag->_deleted || flag->_cancelGeneration != generation || waiter.satisfied; };
     bool timedOut = false;
     const auto waitStart = std::chrono::steady_clock::now();
     if (timeout) {
         const std::uint64_t deadline = TimedWait::DeadlineNanos(*timeout);
-        timedOut = !ef->_changed.WaitUntil(lock, deadline, released);
+        timedOut = !flag->_changed.WaitUntil(lock, deadline, released);
         *timeout = static_cast<KernelUseconds>(TimedWait::RemainingMicros(deadline));
     } else {
-        ef->_changed.Wait(lock, released);
+        flag->_changed.Wait(lock, released);
     }
     KernelTraceWait_nid_postfix("evf", __builtin_return_address(0), static_cast<std::uint64_t>(std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now() - waitStart).count()), timedOut);
-    if (ef->_deleted) {
+    if (flag->_deleted) {
+        if (result_pat) *result_pat = 0;
         return SCE_KERNEL_ERROR_EACCES;
     }
-    if (ef->_cancelGeneration != generation) {
-        if (result_pat) *result_pat = ef->_pattern;
+    if (flag->_cancelGeneration != generation) {
+        if (result_pat) *result_pat = 0;
         return SCE_KERNEL_ERROR_ECANCELED;
     }
     if (timedOut && !waiter.satisfied) {
-        if (result_pat) *result_pat = ef->_pattern;
+        if (result_pat) *result_pat = flag->_pattern;
         return SCE_KERNEL_ERROR_ETIMEDOUT;
     }
     if (result_pat) *result_pat = waiter.resultPattern;
@@ -292,8 +362,8 @@ int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bit_pattern, u
 }
 
 extern "C" int APS5_Test_GetEventFlagWaiterCount(KernelEventFlag handle) {
-    const auto keepAlive = ResolveEventFlag(handle);
-    if (!keepAlive) return -1;
-    std::lock_guard lock(keepAlive->_mutex);
-    return keepAlive->_waiters;
+    const auto entry = ResolveEventFlag(handle);
+    if (!entry) return -1;
+    std::lock_guard lock(entry->flag->_mutex);
+    return entry->flag->_waiters;
 }
diff --git a/core/libs/prx/libkernel/File/include/DescriptorControl.hpp b/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
index 341324638c..e927284888 100644
--- a/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
+++ b/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
@@ -13,11 +13,15 @@ bool IoctlRequestMalformed(std::uint64_t request);
 int Ioctl(int fd, std::uint64_t request, void* argument);
 int DuplicateFrom(int fd, int start);
 void RememberDescriptor(int fd, int openFlags);
+void RememberPipe(int fd);
 void ShareDescriptor(int from, int to);
 void ForgetDescriptor(int fd);
 bool Appends(int fd);
 bool IsVnode(int fd);
+bool IsCharacterDevice(int fd);
 
 }
 
+extern "C" bool DescriptorHasNoVnode_nid_no_patch(int fd);
+
 #endif
diff --git a/core/libs/prx/libkernel/File/include/SharedMemory.hpp b/core/libs/prx/libkernel/File/include/SharedMemory.hpp
index 5c9ffc9f47..7d9be97385 100644
--- a/core/libs/prx/libkernel/File/include/SharedMemory.hpp
+++ b/core/libs/prx/libkernel/File/include/SharedMemory.hpp
@@ -14,6 +14,15 @@ std::int64_t WriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
 std::int64_t PwriteSharedMemory_nid_no_patch(int descriptor, const void* buffer, std::size_t size, std::int64_t offset);
 std::int64_t SeekSharedMemory_nid_no_patch(int descriptor, std::int64_t offset, int whence);
 int TruncateSharedMemory_nid_no_patch(int descriptor, std::int64_t length);
+#ifdef _WIN32
+int SetSharedMemoryMode_nid_no_patch(int descriptor, int mode);
+int SharedMemoryDescriptorWritable_nid_no_patch(int descriptor);
+void TrackSharedMemoryDescriptor_nid_no_patch(int descriptor, bool writable);
+void ForgetSharedMemoryDescriptor_nid_no_patch(int descriptor);
+void DuplicateSharedMemoryDescriptor_nid_no_patch(int source, int destination);
+int CloseSharedMemoryDescriptor_nid_no_patch(int descriptor);
+int ReplaceSharedMemoryDescriptor_nid_no_patch(int source, int destination);
+#endif
 #ifndef _WIN32
 std::int64_t WritevSharedMemory_nid_no_patch(int descriptor, const struct iovec* vectors, int count);
 std::int64_t PwritevSharedMemory_nid_no_patch(int descriptor, const struct iovec* vectors, int count, std::int64_t offset);
diff --git a/core/libs/prx/libkernel/File/include/WindowsSymbolicLink.hpp b/core/libs/prx/libkernel/File/include/WindowsSymbolicLink.hpp
index 5d3e3bb584..e8f2a2f06b 100644
--- a/core/libs/prx/libkernel/File/include/WindowsSymbolicLink.hpp
+++ b/core/libs/prx/libkernel/File/include/WindowsSymbolicLink.hpp
@@ -122,6 +122,14 @@ public:
     }
 };
 
+inline bool WindowsSymbolicLinkLoop(const std::filesystem::path& path) {
+    const auto handle = CreateFileW(path.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) return GetLastError() == ERROR_CANT_RESOLVE_FILENAME;
+    CloseHandle(handle);
+    return false;
+}
+
 }
 
 #endif
diff --git a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
index a83f899801..34b7fe576a 100644
--- a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
+++ b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
@@ -1,8 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/File/include/DescriptorControl.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/RandomDevice.hpp"
 #include "prx/libkernel/File/include/ArchivedFile.hpp"
+#include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/FileLock.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -21,8 +24,10 @@
 #include <string>
 
 #ifdef _WIN32
+#include <fcntl.h>
 #include <io.h>
 #include <windows.h>
+#include "prx/libc/include/General.hpp"
 #include "prx/libc/include/WindowsDescriptor.hpp"
 #else
 #include <fcntl.h>
@@ -31,9 +36,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI dup2_nid_postfix(int from, int to);
-
 namespace {
 
 constexpr int GuestEintr = 4;
@@ -114,6 +116,7 @@ enum class Kind { File, Directory, Pipe, Socket, Device, RandomDevice, ArchivedF
 struct Entry {
     bool closeOnExec = false;
     std::shared_ptr<int> status;
+    bool pipe = false;
 };
 
 std::mutex g_mutex;
@@ -178,8 +181,33 @@ Entry InitialEntry(int fd) {
     return {false, std::make_shared<int>(status)};
 }
 
+void SetHostAppend(int fd, bool append, const char* function) {
+    const int translation = ::_setmode(fd, _O_BINARY);
+    if (translation == -1 || ::_setmode(fd, translation) == -1)
+        throw std::runtime_error(std::string(function) + ": cannot read the translation mode of descriptor " + std::to_string(fd) + ", errno=" + std::to_string(errno));
+    HANDLE copy = nullptr;
+    if (!::DuplicateHandle(::GetCurrentProcess(), WindowsDescriptorHandle_nid_no_patch(fd), ::GetCurrentProcess(), &copy, 0, TRUE, DUPLICATE_SAME_ACCESS))
+        throw std::runtime_error(std::string(function) + ": cannot duplicate the handle of descriptor " + std::to_string(fd) + ", error=" + std::to_string(::GetLastError()));
+    const int replacement = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(copy), (append ? _O_APPEND : 0) | translation);
+    if (replacement < 0) {
+        ::CloseHandle(copy);
+        throw std::runtime_error(std::string(function) + ": cannot open a replacement for descriptor " + std::to_string(fd) + ", errno=" + std::to_string(errno));
+    }
+    auto* const standard = HostStandardHandle_nid_no_patch(fd);
+    const int moved = ::_dup2(replacement, fd);
+    const int error = errno;
+    ::_close(replacement);
+    KeepStandardHandle_nid_no_patch(fd, standard);
+    if (moved != 0)
+        throw std::runtime_error(std::string(function) + ": cannot replace descriptor " + std::to_string(fd) + ", errno=" + std::to_string(error));
+}
+
 void ApplyHostStatus(int fd, Kind kind, int changed, int next, const char* function) {
-    if ((changed & Append) && kind == Kind::File) Unsupported(function, "changing O_APPEND", kind, fd);
+    if ((changed & Append) && kind == Kind::File) {
+        const auto status = g_entries.at(fd).status;
+        for (const auto& [descriptor, entry] : g_entries)
+            if (entry.status == status && DescriptorIsOpen_nid_no_patch(descriptor)) SetHostAppend(descriptor, (next & Append) != 0, function);
+    }
     if ((changed & Nonblocking) && kind == Kind::Device) Unsupported(function, "changing O_NONBLOCK", kind, fd);
     if ((changed & Nonblocking) && kind == Kind::Pipe) SetPipeNonblocking(fd, (next & Nonblocking) != 0, function);
 }
@@ -361,6 +389,12 @@ int CurrentStatus(int fd) {
     return *Materialize(fd).status;
 }
 
+bool CreatedByPipe(int fd) {
+    std::lock_guard lock(g_mutex);
+    const auto found = g_entries.find(fd);
+    return found != g_entries.end() && found->second.pipe;
+}
+
 void SetCloseOnExec(int fd, bool value) {
     std::lock_guard lock(g_mutex);
     Materialize(fd).closeOnExec = value;
@@ -481,7 +515,7 @@ int Fcntl(int fd, int command, std::intptr_t argument) {
             return 0;
         case GetStatusFlags: {
             if (!Classify(fd, "fcntl")) return Fail(GuestEbadf);
-            const int access = AccessMode(fd, "fcntl");
+            const int access = CreatedByPipe(fd) ? ReadWrite : AccessMode(fd, "fcntl");
             return access | CurrentStatus(fd);
         }
         case SetStatusFlags: {
@@ -560,11 +594,17 @@ void RememberDescriptor(int fd, int openFlags) {
 #endif
 }
 
+void RememberPipe(int fd) {
+    RememberDescriptor(fd, 0);
+    std::lock_guard lock(g_mutex);
+    g_entries[fd].pipe = true;
+}
+
 void ShareDescriptor(int from, int to) {
     File::ShareArchivedFile(from, to);
     std::lock_guard lock(g_mutex);
-    auto status = Materialize(from).status;
-    g_entries[to] = Entry{false, std::move(status)};
+    const auto& source = Materialize(from);
+    g_entries[to] = Entry{false, source.status, source.pipe};
 #ifdef _WIN32
     File::SharePositionedTransfer(from, to);
     GuestFileLockShare_nid_no_patch(from, to);
@@ -583,6 +623,16 @@ bool Appends(int fd) {
     return found != g_entries.end() && found->second.status && (*found->second.status & Append) != 0;
 }
 
+bool IsCharacterDevice(int fd) {
+    if (fd < 0) return false;
+#ifdef _WIN32
+    return DescriptorIsOpen_nid_no_patch(fd) && !GuestSockets::IsOpen(fd) && !File::DirectoryDescriptorPath(fd) && ::GetFileType(WindowsDescriptorHandle_nid_no_patch(fd)) == FILE_TYPE_CHAR;
+#else
+    struct stat status{};
+    return ::fstat(fd, &status) == 0 && S_ISCHR(status.st_mode);
+#endif
+}
+
 bool IsVnode(int fd) {
     if (fd < 0 || File::IsRandomDevice(fd)) return false;
     if (File::IsArchivedFile(fd)) return true;
@@ -596,3 +646,7 @@ bool IsVnode(int fd) {
 }
 
 }
+
+extern "C" bool DescriptorHasNoVnode_nid_no_patch(int fd) {
+    return !File::IsVnode(fd) && !File::IsCharacterDevice(fd) && !File::IsRandomDevice(fd);
+}
diff --git a/core/libs/prx/libkernel/File/src/Open.cpp b/core/libs/prx/libkernel/File/src/Open.cpp
index 0cd332ef01..49bf78e813 100644
--- a/core/libs/prx/libkernel/File/src/Open.cpp
+++ b/core/libs/prx/libkernel/File/src/Open.cpp
@@ -1,7 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/File/include/NativeStat.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
+#include "prx/libc/include/RenameDot.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
 #include "prx/libkernel/File/include/File.hpp"
@@ -86,6 +89,8 @@ static int NativeWrite(int fd, const void* buf, std::size_t n) {
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 static void IgnoreInvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {}
 static int NativeClose(int fd) {
+    const int shared = File::CloseSharedMemoryDescriptor_nid_no_patch(fd);
+    if (shared != -2) return shared;
     const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreInvalidParameter);
     const int result = ::_close(fd);
     _set_thread_local_invalid_parameter_handler(previous);
@@ -114,11 +119,7 @@ static std::filesystem::path NativeMetadataPath(const std::filesystem::path& pat
                                             : std::filesystem::path(L"\\\\?\\" + native);
 }
 static bool NativeSymbolicLinkLoop(const std::filesystem::path& path) {
-    const auto handle = CreateFileW(path.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
-        nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
-    if (handle == INVALID_HANDLE_VALUE) return GetLastError() == ERROR_CANT_RESOLVE_FILENAME;
-    CloseHandle(handle);
-    return false;
+    return File::WindowsSymbolicLinkLoop(path);
 }
 static int MapFlags(int sceFlags) {
     int f = 0;
@@ -172,9 +173,6 @@ static int MapFlags(int sceFlags) {
 }
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-
 static int SceErrorFromErrno(int error) {
     const int guest = error > 0 && error <= 34 ? error : FilesystemError(std::error_code(error, std::generic_category()));
     return static_cast<int>(0x80020000u | static_cast<unsigned>(guest));
@@ -297,12 +295,12 @@ int OpenInDirectory_nid_no_patch(int directory, const char* path, int flags, std
 }
 
 int APS5_VABI sceKernelClose(int d) {
-    if (File::IsHostStream(d)) return SCE_KERNEL_ERROR_EBADF;
+    if (File::IsHostStream(d)) return SCE_KERNEL_ERROR_EPERM;
     if (GuestSockets::IsOpen(d)) return GuestSockets::Close(d) == 0 ? 0 : SceKernelError(*__error_nid_postfix());
+    EqueueDescriptorClosed(d);
 #ifdef _WIN32
     const auto positioned = File::LockPositionedTransfer(d);
 #endif
-    EqueueDescriptorClosed(d);
     File::ForgetRandomDevice(d);
     File::ForgetDescriptor(d);
     ForgetJitSharedMemory(d);
@@ -352,6 +350,18 @@ std::int64_t APS5_VABI sceKernelWrite(int d, const void* buf, std::size_t nbytes
     return static_cast<std::int64_t>(n);
 }
 
+static bool SeekOverflows(int d, std::int64_t offset, int whence) {
+    const std::int64_t current = NativeLseek(d, 0, 1);
+    if (current < 0) return false;
+    std::int64_t base = current;
+    if (whence == 2) {
+        base = NativeLseek(d, 0, 2);
+        NativeLseek(d, current, 0);
+        if (base < 0) return false;
+    }
+    return base > std::numeric_limits<std::int64_t>::max() - offset;
+}
+
 std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence) {
     if (GuestSockets::IsOpen(d)) return SCE_KERNEL_ERROR_ESPIPE;
     if (whence < 0 || whence > 2) {
@@ -365,7 +375,11 @@ std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence) {
     }
 #endif
     std::int64_t result = NativeLseek(d, offset, whence);
-    if (result < 0) return SceIoErrorFromErrno(errno);
+    if (result < 0) {
+        const int error = errno;
+        if (error == EINVAL && offset > 0 && (whence == 1 || whence == 2) && SeekOverflows(d, offset, whence)) return SceIoErrorFromErrno(EOVERFLOW);
+        return SceIoErrorFromErrno(error);
+    }
     return result;
 }
 
@@ -423,12 +437,16 @@ int StatInDirectory_nid_no_patch(int directory, const char* path, FileStat* sb,
 int APS5_VABI sceKernelUnlink(const char* path) {
     if (path == nullptr) return SceErrorFromErrno(GuestEfault);
     if (*path == '\0') return SceErrorFromErrno(2);
+    if (const int dot = RenameDotError_nid_no_patch(path)) return SceKernelError(dot);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
     constexpr int GuestEperm = 1;
     std::error_code error;
     if (std::filesystem::is_directory(std::filesystem::symlink_status(native, error))) return SceErrorFromErrno(GuestEperm);
     if (NativeUnlink(native) != 0) {
+#ifdef _WIN32
+        if (NativeSymbolicLinkLoop(native.parent_path())) return SCE_KERNEL_ERROR_ELOOP;
+#endif
         return SceErrorFromErrno(errno == ENOENT ? NotFoundError_nid_no_patch(native) : errno);
     }
     RecordWrittenPath_nid_no_patch(native);
diff --git a/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp b/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp
index a5af2341a3..40ed2effdb 100644
--- a/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp
+++ b/core/libs/prx/libkernel/File/src/SandboxCertificates.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <array>
@@ -21,8 +22,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-
 namespace {
 constexpr char CertificateBegin[] = "-----BEGIN CERTIFICATE-----";
 constexpr char CertificateEnd[] = "-----END CERTIFICATE-----";
diff --git a/core/libs/prx/libkernel/File/src/SharedMemory.cpp b/core/libs/prx/libkernel/File/src/SharedMemory.cpp
index c5b133d941..67315a6478 100644
--- a/core/libs/prx/libkernel/File/src/SharedMemory.cpp
+++ b/core/libs/prx/libkernel/File/src/SharedMemory.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/File/include/SharedMemory.hpp"
@@ -14,6 +16,8 @@
 #include <limits>
 #include <optional>
 #include <atomic>
+#include <mutex>
+#include <unordered_map>
 
 #ifdef _WIN32
 #include <fcntl.h>
@@ -22,6 +26,11 @@
 #include <sys/stat.h>
 #include <filesystem>
 #include <random>
+#include <windows.h>
+#include <aclapi.h>
+#include <sddl.h>
+#include "nid/Sha1.hpp"
+extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 #else
 #include "nid/Sha1.hpp"
 #include <fcntl.h>
@@ -33,10 +42,34 @@
 #include <cstdio>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
+#ifdef _WIN32
+std::mutex sharedDescriptorAccessMutex;
+std::unordered_map<int, bool> sharedDescriptorAccess;
+
+const std::wstring& WindowsNamedRoot() {
+    static const std::wstring root = [] {
+        const auto directory = std::filesystem::temp_directory_path();
+        std::vector<wchar_t> pathBuffer(32768);
+        const HANDLE handle = ::CreateFileW(directory.c_str(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+            nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (handle == INVALID_HANDLE_VALUE)
+            throw std::system_error(static_cast<int>(::GetLastError()), std::system_category(), "opening the named shared-memory temporary root");
+        const DWORD length = ::GetFinalPathNameByHandleW(handle, pathBuffer.data(), static_cast<DWORD>(pathBuffer.size()),
+            FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+        const DWORD error = length == 0 ? ::GetLastError() : length >= pathBuffer.size() ? ERROR_FILENAME_EXCED_RANGE : ERROR_SUCCESS;
+        ::CloseHandle(handle);
+        if (error != ERROR_SUCCESS)
+            throw std::system_error(static_cast<int>(error), std::system_category(), "resolving the named shared-memory temporary root");
+        return (std::filesystem::path(std::wstring(pathBuffer.data(), length)) / L"AnyPS5" / L"shm").wstring();
+    }();
+    return root;
+}
+
+void IgnoreDescriptorParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {}
+#endif
+
 bool IsHostSharedMemoryDescriptor(int descriptor) {
 #ifdef __linux__
     char descriptorPath[64];
@@ -47,6 +80,44 @@ bool IsHostSharedMemoryDescriptor(int descriptor) {
     objectPath[length] = '\0';
     return std::string_view(objectPath).starts_with("/dev/shm/anyps5-shm-") ||
         std::string_view(objectPath).starts_with("/memfd:anyps5 shm_open");
+#elif defined(_WIN32)
+    {
+        std::lock_guard lock(sharedDescriptorAccessMutex);
+        if (!sharedDescriptorAccess.contains(descriptor)) return false;
+    }
+    const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreDescriptorParameter);
+    const auto handleValue = ::_get_osfhandle(descriptor);
+    _set_thread_local_invalid_parameter_handler(previous);
+    if (handleValue == -1) return false;
+    const auto handle = reinterpret_cast<HANDLE>(handleValue);
+    std::vector<wchar_t> pathBuffer(32768);
+    const DWORD length = ::GetFinalPathNameByHandleW(handle, pathBuffer.data(), static_cast<DWORD>(pathBuffer.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    if (length == 0 || length >= pathBuffer.size()) return false;
+    std::wstring objectPath(pathBuffer.data(), length);
+    std::wstring_view root;
+    try {
+        root = WindowsNamedRoot();
+    } catch (...) {
+        return false;
+    }
+    if (objectPath.size() <= root.size() || objectPath[root.size()] != L'\\') return false;
+    if (::CompareStringOrdinal(objectPath.data(), static_cast<int>(root.size()), root.data(), static_cast<int>(root.size()), TRUE) != CSTR_EQUAL) return false;
+    const std::wstring_view relative(objectPath.data() + root.size() + 1, objectPath.size() - root.size() - 1);
+    if (relative.find_first_of(L"\\/") != std::wstring_view::npos) return false;
+    const auto validHex = [](wchar_t character) {
+        return (character >= L'0' && character <= L'9') || (character >= L'a' && character <= L'f');
+    };
+    if (relative.size() < 44 || !std::all_of(relative.begin(), relative.begin() + 40, validHex)) return false;
+    if (relative.substr(40) == L".dat") return true;
+    constexpr std::wstring_view marker = L"-unlinked-";
+    if (!relative.substr(40).starts_with(marker) || !relative.ends_with(L".dat")) return false;
+    const auto suffix = relative.substr(40 + marker.size(), relative.size() - 40 - marker.size() - 4);
+    const auto separator = suffix.find(L'-');
+    if (separator == std::wstring_view::npos || separator == 0 || separator + 1 == suffix.size()) return false;
+    const auto decimal = [](std::wstring_view value) {
+        return std::all_of(value.begin(), value.end(), [](wchar_t character) { return character >= L'0' && character <= L'9'; });
+    };
+    return decimal(suffix.substr(0, separator)) && decimal(suffix.substr(separator + 1));
 #else
     (void)descriptor;
     return false;
@@ -107,7 +178,6 @@ int GuestError(int error) {
     }
 }
 
-#ifndef _WIN32
 int NamedGuestError(int error) {
     switch (error) {
     case ENOENT:
@@ -133,14 +203,17 @@ int NamedGuestError(int error) {
     }
 }
 
-std::string NamedHostPath(const char* path, int& error) {
+std::string NamedHostName(const char* path, int& error) {
     if (path == nullptr) { error = EFAULT; return {}; }
     std::size_t length = 0;
     while (length < 1024 && path[length] != '\0') ++length;
     if (length == 1024) { error = ENAMETOOLONG; return {}; }
     if (length == 0 || path[0] != '/') { error = EINVAL; return {}; }
     const auto digest = Nid::Sha1(std::vector<std::uint8_t>(path, path + length));
-    std::string hostName = "/anyps5-shm-";
+    std::string hostName;
+#ifndef _WIN32
+    hostName = "/anyps5-shm-";
+#endif
     for (const auto byte : digest) {
         hostName += "0123456789abcdef"[byte >> 4];
         hostName += "0123456789abcdef"[byte & 15];
@@ -149,9 +222,384 @@ std::string NamedHostPath(const char* path, int& error) {
     return hostName;
 }
 
+#ifdef _WIN32
+int WindowsNamedError(DWORD error) {
+    switch (error) {
+    case ERROR_FILE_NOT_FOUND:
+    case ERROR_PATH_NOT_FOUND: return ENOENT;
+    case ERROR_ACCESS_DENIED:
+    case ERROR_SHARING_VIOLATION: return EACCES;
+    case ERROR_FILE_EXISTS:
+    case ERROR_ALREADY_EXISTS: return EEXIST;
+    case ERROR_INVALID_NAME: return EINVAL;
+    case ERROR_TOO_MANY_OPEN_FILES: return EMFILE;
+    case ERROR_DISK_FULL: return ENOSPC;
+    case ERROR_NOT_ENOUGH_MEMORY:
+    case ERROR_OUTOFMEMORY: return ENOMEM;
+    default: return 0;
+    }
+}
+
+std::filesystem::path WindowsNamedPath(const std::string& name) {
+    return std::filesystem::path(WindowsNamedRoot()) / std::filesystem::path(name + ".dat");
+}
+
+void EnsurePrivateWindowsDirectory(const std::filesystem::path& path, bool objectDirectory = false) {
+    const std::wstring ownerRights = objectDirectory ? L"0x001701ff" : L"FA";
+    const std::wstring policy = L"D:P(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;" + ownerRights + L";;;OW)";
+    PSECURITY_DESCRIPTOR descriptor = nullptr;
+    if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(
+            policy.c_str(), SDDL_REVISION_1, &descriptor, nullptr))
+        throw std::system_error(static_cast<int>(::GetLastError()), std::system_category(), "creating the named shared-memory access policy");
+    PACL dacl = nullptr;
+    BOOL present = FALSE;
+    BOOL defaulted = FALSE;
+    if (!::GetSecurityDescriptorDacl(descriptor, &present, &dacl, &defaulted) || !present || dacl == nullptr) {
+        const DWORD error = ::GetLastError();
+        ::LocalFree(descriptor);
+        throw std::system_error(static_cast<int>(error == ERROR_SUCCESS ? ERROR_INVALID_SECURITY_DESCR : error),
+                                std::system_category(), "reading the named shared-memory access policy");
+    }
+
+    SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), descriptor, FALSE};
+    if (!::CreateDirectoryW(path.c_str(), &security) && ::GetLastError() != ERROR_ALREADY_EXISTS) {
+        const DWORD error = ::GetLastError();
+        ::LocalFree(descriptor);
+        throw std::system_error(static_cast<int>(error), std::system_category(), "creating the named shared-memory directory");
+    }
+    const DWORD attributes = ::GetFileAttributesW(path.c_str());
+    if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_DIRECTORY) == 0 ||
+        (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+        const DWORD error = attributes == INVALID_FILE_ATTRIBUTES ? ::GetLastError() : ERROR_ACCESS_DENIED;
+        ::LocalFree(descriptor);
+        throw std::system_error(static_cast<int>(error), std::system_category(), "validating the named shared-memory directory");
+    }
+    const DWORD result = ::SetNamedSecurityInfoW(const_cast<LPWSTR>(path.c_str()), SE_FILE_OBJECT,
+                                                  DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
+                                                  nullptr, nullptr, dacl, nullptr);
+    ::LocalFree(descriptor);
+    if (result != ERROR_SUCCESS) throw std::system_error(static_cast<int>(result), std::system_category(), "securing the named shared-memory directory");
+}
+
+DWORD SetWindowsNamedPermissions(HANDLE handle, int mode) {
+    std::wstring policy = L"D:P(A;OICI;FA;;;SY)(A;;WD;;;OW)";
+    if ((mode & 0400) != 0) policy += L"(A;;GRWD;;;OW)";
+    if ((mode & 0200) != 0) policy += L"(A;;GWSDWD;;;OW)";
+    PSECURITY_DESCRIPTOR descriptor = nullptr;
+    if (!::ConvertStringSecurityDescriptorToSecurityDescriptorW(policy.c_str(), SDDL_REVISION_1, &descriptor, nullptr))
+        return ::GetLastError();
+    PACL dacl = nullptr;
+    BOOL present = FALSE;
+    BOOL defaulted = FALSE;
+    if (!::GetSecurityDescriptorDacl(descriptor, &present, &dacl, &defaulted) || !present || dacl == nullptr) {
+        const DWORD error = ::GetLastError();
+        ::LocalFree(descriptor);
+        return error == ERROR_SUCCESS ? ERROR_INVALID_SECURITY_DESCR : error;
+    }
+    const DWORD result = ::SetSecurityInfo(handle, SE_FILE_OBJECT,
+        DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION, nullptr, nullptr, dacl, nullptr);
+    ::LocalFree(descriptor);
+    return result;
+}
+
+void CleanupUnlinkedWindowsObjects(const std::filesystem::path& objectPath, const std::string& name) {
+    const auto pattern = objectPath.parent_path() / (std::wstring(name.begin(), name.end()) + L"-unlinked-*.dat");
+    WIN32_FIND_DATAW data{};
+    const HANDLE search = ::FindFirstFileW(pattern.c_str(), &data);
+    if (search == INVALID_HANDLE_VALUE) return;
+    do {
+        if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
+            const auto orphanPath = objectPath.parent_path() / data.cFileName;
+            HANDLE orphan = ::CreateFileW(orphanPath.c_str(), DELETE, 0, nullptr, OPEN_EXISTING,
+                FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+            if (orphan != INVALID_HANDLE_VALUE) {
+                FILE_DISPOSITION_INFO deletion{TRUE};
+                ::SetFileInformationByHandle(orphan, FileDispositionInfo, &deletion, sizeof(deletion));
+                ::CloseHandle(orphan);
+            }
+        }
+    } while (::FindNextFileW(search, &data));
+    ::FindClose(search);
+}
+
+void ReapUnlinkedWindowsObject(const std::filesystem::path& orphanPath) {
+    HANDLE orphan = ::CreateFileW(orphanPath.c_str(), DELETE, 0, nullptr, OPEN_EXISTING,
+        FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+    if (orphan == INVALID_HANDLE_VALUE) return;
+    FILE_DISPOSITION_INFO deletion{TRUE};
+    ::SetFileInformationByHandle(orphan, FileDispositionInfo, &deletion, sizeof(deletion));
+    ::CloseHandle(orphan);
+}
+
+class WindowsNamedLock {
+public:
+    explicit WindowsNamedLock(const std::string& name) {
+        Initialize(WindowsNamedPath(name).wstring());
+    }
+
+    explicit WindowsNamedLock(HANDLE object) {
+        BY_HANDLE_FILE_INFORMATION status{};
+        if (!::GetFileInformationByHandle(object, &status)) { error = ::GetLastError(); return; }
+        Initialize(L"object-" + std::to_wstring(status.dwVolumeSerialNumber) + L"-" +
+                   std::to_wstring(status.nFileIndexHigh) + L"-" + std::to_wstring(status.nFileIndexLow));
+    }
+
+    ~WindowsNamedLock() {
+        if (locked) ::ReleaseMutex(handle);
+        if (handle != nullptr) ::CloseHandle(handle);
+    }
+
+    DWORD Error() const { return error; }
+
+private:
+    void Initialize(const std::wstring& identity) {
+        const auto bytes = std::vector<std::uint8_t>(reinterpret_cast<const std::uint8_t*>(identity.data()),
+                                                     reinterpret_cast<const std::uint8_t*>(identity.data() + identity.size()));
+        const auto digest = Nid::Sha1(bytes);
+        std::wstring lockName = L"Global\\AnyPS5NamedShm-";
+        for (const auto byte : digest) {
+            lockName += L"0123456789abcdef"[byte >> 4];
+            lockName += L"0123456789abcdef"[byte & 15];
+        }
+        handle = ::CreateMutexW(nullptr, FALSE, lockName.c_str());
+        if (handle == nullptr) { error = ::GetLastError(); return; }
+        const DWORD result = ::WaitForSingleObject(handle, INFINITE);
+        if (result == WAIT_OBJECT_0 || result == WAIT_ABANDONED) locked = true;
+        else error = result == WAIT_FAILED ? ::GetLastError() : ERROR_GEN_FAILURE;
+    }
+    HANDLE handle = nullptr;
+    DWORD error = ERROR_SUCCESS;
+    bool locked = false;
+};
+
+int OpenNamedFile(const char* path, int flags, int mode) {
+    const int savedError = errno;
+    int validationError = 0;
+    const auto hostName = NamedHostName(path, validationError);
+    if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
+
+    WindowsNamedLock namespaceLock(hostName);
+    if (namespaceLock.Error() != ERROR_SUCCESS) {
+        if (const int guest = WindowsNamedError(namespaceLock.Error())) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: locking the host named-object namespace failed, error=" + std::to_string(namespaceLock.Error()));
+    }
+
+    std::filesystem::path objectPath;
+    try {
+        objectPath = WindowsNamedPath(hostName);
+        EnsurePrivateWindowsDirectory(objectPath.parent_path().parent_path());
+        EnsurePrivateWindowsDirectory(objectPath.parent_path(), true);
+        CleanupUnlinkedWindowsObjects(objectPath, hostName);
+    } catch (const std::system_error& error) {
+        const auto nativeError = static_cast<DWORD>(error.code().value());
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: preparing the host named-object namespace failed: " + std::string(error.what()));
+    }
+
+    const bool readWrite = (flags & SCE_KERNEL_O_ACCMODE) == SCE_KERNEL_O_RDWR;
+    const DWORD access = GENERIC_READ | (readWrite ? GENERIC_WRITE : 0) | WRITE_DAC;
+    const bool create = (flags & SCE_KERNEL_O_CREAT) != 0;
+    const DWORD creationAccess = access | (create ? WRITE_DAC | DELETE : 0);
+    ::SetLastError(ERROR_SUCCESS);
+    HANDLE handle = ::CreateFileW(objectPath.c_str(), creationAccess, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                                  nullptr, create ? CREATE_NEW : OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+    DWORD createResult = ::GetLastError();
+    bool created = handle != INVALID_HANDLE_VALUE && create;
+    if (handle == INVALID_HANDLE_VALUE && create && createResult == ERROR_FILE_EXISTS && !(flags & SCE_KERNEL_O_EXCL)) {
+        handle = ::CreateFileW(objectPath.c_str(), access, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                               nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+        createResult = ::GetLastError();
+    }
+    if (handle == INVALID_HANDLE_VALUE) {
+        const DWORD nativeError = createResult;
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: opening the host named object failed, error=" + std::to_string(nativeError));
+    }
+
+    BY_HANDLE_FILE_INFORMATION status{};
+    if (!::GetFileInformationByHandle(handle, &status) || (status.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0) {
+        const DWORD lastError = ::GetLastError();
+        const DWORD nativeError = lastError == ERROR_SUCCESS ? ERROR_INVALID_NAME : lastError;
+        if (created) {
+            FILE_DISPOSITION_INFO deletion{TRUE};
+            ::SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion));
+        }
+        ::CloseHandle(handle);
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_open: refusing a reparse-point named object, error=" + std::to_string(nativeError));
+    }
+
+    if (created) {
+        const int permissions = (mode & 0777) & ~File::GetCreationMask_nid_no_patch();
+        const DWORD nativeError = SetWindowsNamedPermissions(handle, permissions);
+        if (nativeError != ERROR_SUCCESS) {
+            FILE_DISPOSITION_INFO deletion{TRUE};
+            ::SetFileInformationByHandle(handle, FileDispositionInfo, &deletion, sizeof(deletion));
+            ::CloseHandle(handle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_open: setting guest creation permissions failed, error=" + std::to_string(nativeError));
+        }
+    }
+
+    if ((flags & SCE_KERNEL_O_TRUNC) && readWrite) {
+        WindowsNamedLock objectLock(handle);
+        if (objectLock.Error() != ERROR_SUCCESS) {
+            const DWORD nativeError = objectLock.Error();
+            ::CloseHandle(handle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_open: locking the host named object for truncation failed, error=" + std::to_string(nativeError));
+        }
+        LARGE_INTEGER zero{};
+        if (!::SetFilePointerEx(handle, zero, nullptr, FILE_BEGIN) || !::SetEndOfFile(handle)) {
+            const DWORD nativeError = ::GetLastError();
+            ::CloseHandle(handle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_open: truncating the host named object failed, error=" + std::to_string(nativeError));
+        }
+    }
+
+    const int nativeFlags = _O_BINARY | (readWrite ? _O_RDWR : _O_RDONLY);
+    const int descriptor = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), nativeFlags);
+    if (descriptor >= 0) {
+        File::TrackSharedMemoryDescriptor_nid_no_patch(descriptor, readWrite);
+        errno = savedError;
+        return descriptor;
+    }
+    const int nativeError = errno;
+    ::CloseHandle(handle);
+    if (const int guest = GuestError(nativeError)) return Fail(guest);
+    throw std::runtime_error("shm_open: converting the host named object to a descriptor failed, errno=" + std::to_string(nativeError));
+}
+
+int UnlinkNamedFile(const char* path) {
+    const int savedError = errno;
+    int validationError = 0;
+    const auto hostName = NamedHostName(path, validationError);
+    if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
+    WindowsNamedLock namespaceLock(hostName);
+    if (namespaceLock.Error() != ERROR_SUCCESS) {
+        if (const int guest = WindowsNamedError(namespaceLock.Error())) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: locking the host named-object namespace failed, error=" + std::to_string(namespaceLock.Error()));
+    }
+
+    std::filesystem::path objectPath;
+    try {
+        objectPath = WindowsNamedPath(hostName);
+    } catch (const std::filesystem::filesystem_error& error) {
+        const auto nativeError = static_cast<DWORD>(error.code().value());
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: locating the host named object failed: " + std::string(error.what()));
+    }
+
+    HANDLE objectHandle = ::CreateFileW(objectPath.c_str(), FILE_READ_ATTRIBUTES | GENERIC_WRITE,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+        FILE_FLAG_OPEN_REPARSE_POINT, nullptr);
+    if (objectHandle == INVALID_HANDLE_VALUE) {
+        const DWORD nativeError = ::GetLastError();
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: opening the host named object failed, error=" + std::to_string(nativeError));
+    }
+    BY_HANDLE_FILE_INFORMATION status{};
+    if (!::GetFileInformationByHandle(objectHandle, &status) ||
+        (status.dwFileAttributes & (FILE_ATTRIBUTE_DIRECTORY | FILE_ATTRIBUTE_REPARSE_POINT)) != 0) {
+        const DWORD lastError = ::GetLastError();
+        const DWORD nativeError = lastError == ERROR_SUCCESS ? ERROR_INVALID_NAME : lastError;
+        ::CloseHandle(objectHandle);
+        if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+        throw std::runtime_error("shm_unlink: refusing an invalid host named object, error=" + std::to_string(nativeError));
+    }
+
+    static std::atomic<unsigned> sequence{0};
+    for (unsigned attempt = 0; attempt < 64; ++attempt) {
+        const auto orphanPath = objectPath.parent_path() /
+            (objectPath.stem().wstring() + L"-unlinked-" + std::to_wstring(::GetCurrentProcessId()) +
+             L"-" + std::to_wstring(sequence.fetch_add(1, std::memory_order_relaxed)) + objectPath.extension().wstring());
+        if (!::MoveFileExW(objectPath.c_str(), orphanPath.c_str(), MOVEFILE_WRITE_THROUGH)) {
+            const DWORD nativeError = ::GetLastError();
+            if (nativeError == ERROR_ALREADY_EXISTS || nativeError == ERROR_FILE_EXISTS) continue;
+            ::CloseHandle(objectHandle);
+            if (const int guest = WindowsNamedError(nativeError)) return Fail(NamedGuestError(guest));
+            throw std::runtime_error("shm_unlink: detaching the host named object failed, error=" + std::to_string(nativeError));
+        }
+        ::CloseHandle(objectHandle);
+        ReapUnlinkedWindowsObject(orphanPath);
+        errno = savedError;
+        return 0;
+    }
+    ::CloseHandle(objectHandle);
+    return Fail(NamedGuestError(EEXIST));
+}
+
+int SetSharedMemoryModeInternal(int descriptor, int mode) {
+    if (!IsHostSharedMemoryDescriptor(descriptor)) return -2;
+    const auto rawHandle = ::_get_osfhandle(descriptor);
+    if (rawHandle == -1) { errno = EBADF; return -1; }
+    const auto handle = reinterpret_cast<HANDLE>(rawHandle);
+    WindowsNamedLock objectLock(handle);
+    if (objectLock.Error() != ERROR_SUCCESS) {
+        const int error = WindowsNamedError(objectLock.Error());
+        errno = error ? error : EIO;
+        return -1;
+    }
+    const DWORD nativeError = SetWindowsNamedPermissions(handle, mode & 0777);
+    if (nativeError == ERROR_SUCCESS) return 0;
+    const int error = WindowsNamedError(nativeError);
+    errno = error ? error : EACCES;
+    return -1;
+}
+
+std::filesystem::path SharedMemoryDescriptorPath(int descriptor) {
+    const auto rawHandle = ::_get_osfhandle(descriptor);
+    std::filesystem::path finalPath;
+    if (rawHandle != -1) {
+        std::vector<wchar_t> path(32768);
+        const DWORD length = ::GetFinalPathNameByHandleW(reinterpret_cast<HANDLE>(rawHandle), path.data(),
+            static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+        if (length > 4 && length < path.size()) {
+            std::wstring value(path.data(), length);
+            finalPath = std::filesystem::path(std::move(value));
+        }
+    }
+    return finalPath;
+}
+
+void ReapSharedMemoryDescriptorPath(const std::filesystem::path& path) {
+    if (!path.empty() && path.filename().wstring().find(L"-unlinked-") != std::wstring::npos)
+        ReapUnlinkedWindowsObject(path);
+}
+
+int CloseSharedMemoryDescriptorInternal(int descriptor) {
+    if (!IsHostSharedMemoryDescriptor(descriptor)) return -2;
+    const int savedError = errno;
+    const auto finalPath = SharedMemoryDescriptorPath(descriptor);
+    int result;
+    {
+        std::lock_guard lock(sharedDescriptorAccessMutex);
+        result = ::_close(descriptor);
+        if (result == 0) sharedDescriptorAccess.erase(descriptor);
+    }
+    if (result == 0) ReapSharedMemoryDescriptorPath(finalPath);
+    if (result == 0) errno = savedError;
+    return result;
+}
+
+int ReplaceSharedMemoryDescriptorInternal(int source, int destination) {
+    if (!IsHostSharedMemoryDescriptor(destination)) return -2;
+    const int savedError = errno;
+    const auto finalPath = SharedMemoryDescriptorPath(destination);
+    const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreDescriptorParameter);
+    const int result = ::_dup2(source, destination);
+    _set_thread_local_invalid_parameter_handler(previous);
+    if (result == 0) {
+        ReapSharedMemoryDescriptorPath(finalPath);
+        errno = savedError;
+    }
+    return result;
+}
+#else
 int OpenNamedFile(const char* path, int flags, int mode) {
     int validationError = 0;
-    const auto hostName = NamedHostPath(path, validationError);
+    const auto hostName = NamedHostName(path, validationError);
     if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
     HostShmLock namespaceLock;
     if (namespaceLock.Error() != 0) {
@@ -222,6 +670,44 @@ bool IsSharedMemoryDescriptor_nid_no_patch(int descriptor) {
     return IsHostSharedMemoryDescriptor(descriptor);
 }
 
+#ifdef _WIN32
+int SetSharedMemoryMode_nid_no_patch(int descriptor, int mode) {
+    return SetSharedMemoryModeInternal(descriptor, mode);
+}
+
+int CloseSharedMemoryDescriptor_nid_no_patch(int descriptor) {
+    return CloseSharedMemoryDescriptorInternal(descriptor);
+}
+
+int ReplaceSharedMemoryDescriptor_nid_no_patch(int source, int destination) {
+    return ReplaceSharedMemoryDescriptorInternal(source, destination);
+}
+
+int SharedMemoryDescriptorWritable_nid_no_patch(int descriptor) {
+    if (!IsHostSharedMemoryDescriptor(descriptor)) return -2;
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    const auto found = sharedDescriptorAccess.find(descriptor);
+    return found != sharedDescriptorAccess.end() && found->second ? 1 : 0;
+}
+
+void TrackSharedMemoryDescriptor_nid_no_patch(int descriptor, bool writable) {
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    sharedDescriptorAccess[descriptor] = writable;
+}
+
+void ForgetSharedMemoryDescriptor_nid_no_patch(int descriptor) {
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    sharedDescriptorAccess.erase(descriptor);
+}
+
+void DuplicateSharedMemoryDescriptor_nid_no_patch(int source, int destination) {
+    std::lock_guard lock(sharedDescriptorAccessMutex);
+    sharedDescriptorAccess.erase(destination);
+    const auto found = sharedDescriptorAccess.find(source);
+    if (found != sharedDescriptorAccess.end()) sharedDescriptorAccess[destination] = found->second;
+}
+#endif
+
 namespace {
 
 class SharedMemoryLock {
@@ -230,6 +716,18 @@ public:
 #ifdef __linux__
         struct stat originalStatus{};
         if (::fstat(value, &originalStatus) != 0) { shared = true; error = errno; return; }
+#elif defined(_WIN32)
+        if (!IsHostSharedMemoryDescriptor(value)) return;
+        const auto originalValue = ::_get_osfhandle(value);
+        if (originalValue == -1) return;
+        BY_HANDLE_FILE_INFORMATION originalStatus{};
+        if (!::GetFileInformationByHandle(reinterpret_cast<HANDLE>(originalValue), &originalStatus)) {
+            shared = true;
+            error = EBADF;
+            return;
+        }
+        windowsObjectLock = std::make_unique<WindowsNamedLock>(reinterpret_cast<HANDLE>(originalValue));
+        if (windowsObjectLock->Error() != ERROR_SUCCESS) { shared = true; error = WindowsNamedError(windowsObjectLock->Error()); if (!error) error = EIO; return; }
 #endif
         if (!IsHostSharedMemoryDescriptor(value)) {
 #ifdef __linux__
@@ -247,10 +745,20 @@ public:
         if (hostLock->Error() != 0) { error = hostLock->Error(); return; }
         descriptor = Duplicate(value);
         if (descriptor < 0) { error = errno; return; }
+#ifdef _WIN32
+        DuplicateSharedMemoryDescriptor_nid_no_patch(value, descriptor);
+#endif
         if (!IsHostSharedMemoryDescriptor(descriptor)) { error = EBADF; return; }
         if (!Refresh()) { error = errno; return; }
 #ifdef __linux__
         if (status.st_dev != originalStatus.st_dev || status.st_ino != originalStatus.st_ino) error = EBADF;
+#elif defined(_WIN32)
+        BY_HANDLE_FILE_INFORMATION duplicatedStatus{};
+        const auto duplicatedValue = ::_get_osfhandle(descriptor);
+        if (duplicatedValue == -1 || !::GetFileInformationByHandle(reinterpret_cast<HANDLE>(duplicatedValue), &duplicatedStatus) ||
+            duplicatedStatus.dwVolumeSerialNumber != originalStatus.dwVolumeSerialNumber ||
+            duplicatedStatus.nFileIndexHigh != originalStatus.nFileIndexHigh ||
+            duplicatedStatus.nFileIndexLow != originalStatus.nFileIndexLow) error = EBADF;
 #endif
     }
 
@@ -258,7 +766,7 @@ public:
         if (descriptor >= 0) {
             const int savedError = errno;
 #ifdef _WIN32
-            ::_close(descriptor);
+            CloseSharedMemoryDescriptor_nid_no_patch(descriptor);
 #else
             ::close(descriptor);
 #endif
@@ -292,6 +800,9 @@ private:
 
     int descriptor = -1;
     std::optional<HostShmLock> hostLock;
+#ifdef _WIN32
+    std::unique_ptr<WindowsNamedLock> windowsObjectLock;
+#endif
     bool shared = false;
     int error = 0;
 };
@@ -303,7 +814,9 @@ std::int64_t WriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
     if (guard.Error() != 0) { errno = guard.Error(); return -1; }
     if (!guard.Refresh()) return -1;
     const auto fd = guard.Descriptor();
-#ifndef _WIN32
+#ifdef _WIN32
+    if (SharedMemoryDescriptorWritable_nid_no_patch(fd) == 0) { errno = EBADF; return -1; }
+#else
     const int access = ::fcntl(fd, F_GETFL);
     if (access < 0) return -1;
     if ((access & O_ACCMODE) == O_RDONLY) { errno = EBADF; return -1; }
@@ -331,7 +844,9 @@ std::int64_t PwriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
     if (guard.Error() != 0) { errno = guard.Error(); return -1; }
     if (!guard.Refresh()) return -1;
     const auto fd = guard.Descriptor();
-#ifndef _WIN32
+#ifdef _WIN32
+    if (SharedMemoryDescriptorWritable_nid_no_patch(fd) == 0) { errno = EBADF; return -1; }
+#else
     const int access = ::fcntl(fd, F_GETFL);
     if (access < 0) return -1;
     if ((access & O_ACCMODE) == O_RDONLY) { errno = EBADF; return -1; }
@@ -341,7 +856,19 @@ std::int64_t PwriteSharedMemory_nid_no_patch(int descriptor, const void* buffer,
     if (offset >= status.st_size) return 0;
     const auto count = std::min<std::uint64_t>(size, static_cast<std::uint64_t>(status.st_size - offset));
 #ifdef _WIN32
-    const auto result = NativePositioned_nid_no_patch(fd, const_cast<void*>(buffer), static_cast<std::size_t>(count), offset, true);
+    const auto handle = reinterpret_cast<HANDLE>(::_get_osfhandle(fd));
+    if (handle == INVALID_HANDLE_VALUE || ::GetFileType(handle) != FILE_TYPE_DISK) { errno = EBADF; return -1; }
+    LARGE_INTEGER previous{};
+    if (!::SetFilePointerEx(handle, LARGE_INTEGER{}, &previous, FILE_CURRENT)) { errno = EIO; return -1; }
+    OVERLAPPED overlapped{};
+    overlapped.Offset = static_cast<DWORD>(offset);
+    overlapped.OffsetHigh = static_cast<DWORD>(static_cast<std::uint64_t>(offset) >> 32u);
+    DWORD written = 0;
+    const BOOL succeeded = ::WriteFile(handle, buffer, static_cast<DWORD>(std::min<std::uint64_t>(count, std::numeric_limits<DWORD>::max())), &written, &overlapped);
+    const DWORD writeError = succeeded ? ERROR_SUCCESS : ::GetLastError();
+    if (!::SetFilePointerEx(handle, previous, nullptr, FILE_BEGIN)) throw std::runtime_error("pwrite: restoring the host file position failed");
+    if (!succeeded) { errno = writeError == ERROR_ACCESS_DENIED ? EBADF : EIO; return -1; }
+    const auto result = written;
 #else
     const auto result = ::pwrite(fd, buffer, static_cast<std::size_t>(count), static_cast<off_t>(offset));
 #endif
@@ -436,9 +963,19 @@ std::int64_t PwritevSharedMemory_nid_no_patch(int descriptor, const struct iovec
 #endif
 
 int TruncateSharedMemory_nid_no_patch(int descriptor, std::int64_t length) {
+#ifdef _WIN32
+    const auto positioned = LockPositionedTransfer(descriptor);
+#endif
     SharedMemoryLock guard(descriptor);
     if (!guard.IsShared()) return -2;
-    if (guard.Error() != 0) { errno = guard.Error(); return -1; }
+    if (guard.Error() != 0) {
+        errno = guard.Error();
+#ifdef _WIN32
+        return errno;
+#else
+        return -1;
+#endif
+    }
     const auto fd = guard.Descriptor();
 #ifdef _WIN32
     const int result = static_cast<int>(::_chsize_s(fd, length));
@@ -456,7 +993,7 @@ extern "C" int APS5_VABI shm_open_nid_postfix(const char* path, int flags, int m
     if ((flags & ~AcceptedFlags) != 0) return Fail(GuestInvalid);
     if (path != anonymousObject) {
 #ifdef _WIN32
-        NotImplemented_nid_no_patch("shm_open of a named object");
+        return OpenNamedFile(path, flags, mode);
 #else
         return OpenNamedFile(path, flags, mode);
 #endif
@@ -471,12 +1008,10 @@ extern "C" int APS5_VABI shm_open_nid_postfix(const char* path, int flags, int m
 
 extern "C" int APS5_VABI shm_unlink_nid_postfix(const char* path) {
 #ifdef _WIN32
-    (void)path;
-    NotImplemented_nid_no_patch("shm_unlink of a named object");
-    return 0;
+    return UnlinkNamedFile(path);
 #else
     int validationError = 0;
-    const auto hostName = NamedHostPath(path, validationError);
+    const auto hostName = NamedHostName(path, validationError);
     if (validationError != 0) return Fail(NamedGuestError(validationError) ? NamedGuestError(validationError) : GuestInvalid);
     HostShmLock namespaceLock;
     if (namespaceLock.Error() != 0) {
diff --git a/core/libs/prx/libkernel/File/src/Stdio.cpp b/core/libs/prx/libkernel/File/src/Stdio.cpp
index 2aece3834c..338dc6c3a8 100644
--- a/core/libs/prx/libkernel/File/src/Stdio.cpp
+++ b/core/libs/prx/libkernel/File/src/Stdio.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cstdint>
 #include <cstddef>
@@ -43,10 +45,6 @@
 #include <mach/mach_vm.h>
 #endif
 
-struct KernelIovec {
-    void* base;
-    std::size_t length;
-};
 static_assert(sizeof(KernelIovec) == sizeof(GuestSockets::Iovec));
 static_assert(sizeof(KernelIovec) == sizeof(AppArchiveBuffer) && offsetof(KernelIovec, length) == offsetof(AppArchiveBuffer, Length));
 
@@ -59,6 +57,7 @@ static constexpr std::uint64_t KERNEL_MNT_NOSUID = 0x8;
 
 #ifdef _WIN32
 #include <windows.h>
+#include "prx/libkernel/File/include/WindowsSymbolicLink.hpp"
 #include <io.h>
 #include <cstdio>
 #include <fcntl.h>
@@ -172,10 +171,13 @@ static int SetTimes(HANDLE handle, const KernelTimeval* times) {
         errno = EINVAL;
         return -1;
     }
-    return SetFileTime(handle, nullptr, &access, &modified) ? 0 : File::WindowsFileTime::Failure(GetLastError());
+    FILETIME creation{};
+    if (!GetFileTime(handle, &creation, nullptr, nullptr)) return File::WindowsFileTime::Failure(GetLastError());
+    const auto birth = CompareFileTime(&modified, &creation) < 0 ? &modified : nullptr;
+    return SetFileTime(handle, birth, &access, &modified) ? 0 : File::WindowsFileTime::Failure(GetLastError());
 }
 static int NativeUtimes(const std::filesystem::path& path, const KernelTimeval* times, bool followLink = true) {
-    const auto handle = CreateFileW(path.c_str(), FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+    const auto handle = CreateFileW(path.c_str(), FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
         nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | (followLink ? 0 : FILE_FLAG_OPEN_REPARSE_POINT), nullptr);
     if (handle == INVALID_HANDLE_VALUE) return File::WindowsFileTime::Failure(GetLastError());
     const int result = SetTimes(handle, times);
@@ -188,7 +190,7 @@ static int NativeFutimes(int descriptor, const KernelTimeval* times) {
     const auto original = reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor));
     if (original == INVALID_HANDLE_VALUE) { errno = EBADF; return -1; }
     if (GetFileType(original) != FILE_TYPE_DISK) { errno = EINVAL; return -1; }
-    const auto handle = ReOpenFile(original, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0);
+    const auto handle = ReOpenFile(original, FILE_READ_ATTRIBUTES | FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, 0);
     if (handle == INVALID_HANDLE_VALUE) return File::WindowsFileTime::Failure(GetLastError());
     const int result = SetTimes(handle, times);
     CloseHandle(handle);
@@ -263,9 +265,10 @@ static std::int64_t NativePositionedTransfer(int descriptor, void* buf, std::siz
         errno = ESPIPE;
         return -1;
     }
+    const auto at = write && File::Appends(descriptor) ? ~std::uint64_t{} : static_cast<std::uint64_t>(offset);
     OVERLAPPED overlapped{};
-    overlapped.Offset = static_cast<DWORD>(offset);
-    overlapped.OffsetHigh = static_cast<DWORD>(static_cast<std::uint64_t>(offset) >> 32u);
+    overlapped.Offset = static_cast<DWORD>(at);
+    overlapped.OffsetHigh = static_cast<DWORD>(at >> 32u);
     DWORD done = 0;
     const BOOL ok = write ? ::WriteFile(handle, buf, static_cast<DWORD>(nbytes), &done, &overlapped)
                           : ::ReadFile(handle, buf, static_cast<DWORD>(nbytes), &done, &overlapped);
@@ -479,8 +482,6 @@ static int PathLookupFailure(const std::error_code& error) {
     return lookup ? SceErrorFromErrno(error.default_error_condition().value()) : 0;
 }
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static int PosixFailure(int error) {
     *__error_nid_postfix() = error;
     return -1;
@@ -498,6 +499,14 @@ static std::int64_t PosixResult(std::int64_t result) {
     return result < 0 ? PosixFailure(static_cast<int>(result) & 0xffff) : result;
 }
 
+static int DeviceFilesystem(KernelStatfs* fs) {
+    fs->f_bsize = 512;
+    fs->f_iosize = 512;
+    fs->f_blocks = 2;
+    fs->f_namemax = 255;
+    return 0;
+}
+
 #ifdef _WIN32
 static int NativeFstatfs(int descriptor, KernelStatfs* fs) {
     if (!File::IsDirectoryDescriptor(descriptor)) {
@@ -505,6 +514,7 @@ static int NativeFstatfs(int descriptor, KernelStatfs* fs) {
         if (handle == INVALID_HANDLE_VALUE) return GUEST_EBADF;
         const DWORD type = ::GetFileType(handle);
         if (type == FILE_TYPE_PIPE) return GUEST_EINVAL;
+        if (type == FILE_TYPE_CHAR) return DeviceFilesystem(fs);
         if (type != FILE_TYPE_DISK)
             throw std::runtime_error("_fstatfs: descriptor " + std::to_string(descriptor) + " is not a file on a Windows volume");
     }
@@ -552,6 +562,7 @@ static int NativeFstatfs(int descriptor, KernelStatfs* fs) {
     if (::fstat(descriptor, &file) != 0) return SceErrorFromErrno(errno) & 0xffff;
     if (S_ISSOCK(file.st_mode) && (::fcntl(descriptor, F_GETFL) & O_PATH) == 0) return GUEST_EINVAL;
     if (NativeIsPipe(descriptor)) return GUEST_EINVAL;
+    if (S_ISCHR(file.st_mode)) return DeviceFilesystem(fs);
     struct statvfs host{};
     if (::fstatvfs(descriptor, &host) != 0) return SceErrorFromErrno(errno) & 0xffff;
     if (host.f_flag & ST_RDONLY) fs->f_flags |= KERNEL_MNT_RDONLY;
@@ -580,8 +591,8 @@ extern "C" int APS5_VABI pipe_nid_postfix(int* descriptors) {
     const int result = ::pipe(native);
 #endif
     if (result != 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
-    File::RememberDescriptor(native[0], 0);
-    File::RememberDescriptor(native[1], 0);
+    File::RememberPipe(native[0]);
+    File::RememberPipe(native[1]);
     std::memcpy(descriptors, native, sizeof(native));
     return 0;
 }
@@ -614,9 +625,6 @@ static bool HasNonDirectoryPrefix(const std::filesystem::path& native) {
     return false;
 }
 
-extern "C" int APS5_VABI dup_nid_postfix(int d);
-extern "C" int APS5_VABI close_nid_postfix(int d);
-
 int File::DuplicateFrom(int fd, int start) {
 #ifdef _WIN32
     std::vector<int> below;
@@ -691,7 +699,7 @@ int APS5_VABI chflags_nid_postfix(const char* path, std::uint64_t flags) {
 }
 
 int APS5_VABI fchflags_nid_postfix(int d, std::uint64_t flags) {
-    if (GuestSockets::IsOpen(d) || File::IsSharedMemoryDescriptor_nid_no_patch(d)) return PosixFailure(GUEST_EINVAL);
+    if (GuestSockets::IsOpen(d) || IsKqueueDescriptor(d) || File::IsSharedMemoryDescriptor_nid_no_patch(d)) return PosixFailure(GUEST_EINVAL);
     File::RefuseArchivedFile(d, "fchflags");
     if (!File::IsVnode(d)) {
         if (!DescriptorIsOpen_nid_no_patch(d)) return PosixFailure(GUEST_EBADF);
@@ -711,7 +719,7 @@ int APS5_VABI nmount_nid_postfix(const KernelIovec* iov, unsigned int niov, int
 }
 
 int APS5_VABI close_nid_postfix(int d) {
-    if (File::IsHostStream(d)) return PosixFailure(GUEST_EBADF);
+    if (File::IsHostStream(d)) return PosixFailure(GUEST_EPERM);
     int socketError = 0;
     if (KernelCloseSocket_nid_no_patch(d, &socketError)) {
         if (socketError == 0) return 0;
@@ -719,16 +727,18 @@ int APS5_VABI close_nid_postfix(int d) {
         return -1;
     }
     if (GuestSockets::IsOpen(d)) return GuestSockets::Close(d);
+    EqueueDescriptorClosed(d);
 #ifdef _WIN32
     const auto positioned = File::LockPositionedTransfer(d);
 #endif
-    EqueueDescriptorClosed(d);
     File::ForgetRandomDevice(d);
     File::ForgetDescriptor(d);
     ForgetJitSharedMemory(d);
 #ifdef _WIN32
     File::ForgetDirectoryDescriptor(d);
     File::ForgetFileLock(d);
+    const int shared = File::CloseSharedMemoryDescriptor_nid_no_patch(d);
+    if (shared != -2) return shared;
     return WithoutParameterHandler([d] { return ::_close(d); });
 #else
     return ::close(d);
@@ -747,26 +757,9 @@ std::atomic<int> g_hostStandardOutput{-1};
 
 void PreserveHostStream(int standard, std::atomic<int>& slot) {
     if (slot.load() >= 0) return;
-#ifdef _WIN32
-    const int saved = WithoutParameterHandler([standard] { return ::_dup(standard); });
-#else
     const int saved = standard == 1 ? KeepHostStandardOutput_nid_no_patch() : KeepHostStandardError_nid_no_patch();
-#endif
     if (saved < 0) throw std::runtime_error(standard == 1 ? "dup2: cannot keep the host standard output" : "dup2: cannot keep the host standard error");
-    int expected = -1;
-    if (!slot.compare_exchange_strong(expected, saved)) {
-#ifdef _WIN32
-        _close(saved);
-#endif
-        return;
-    }
-#ifdef _WIN32
-    if (!AdoptHostStandardStream_nid_no_patch(standard, saved)) {
-        slot.store(-1);
-        _close(saved);
-        throw std::runtime_error(standard == 1 ? "dup2: cannot keep the host standard output" : "dup2: cannot keep the host standard error");
-    }
-#endif
+    slot.store(saved);
 }
 
 void PreserveHostStandardError() { PreserveHostStream(2, g_hostStandardError); }
@@ -786,6 +779,7 @@ int APS5_VABI dup_nid_postfix(int d) {
 #ifdef _WIN32
     const int duplicate = WithoutParameterHandler([d] { return ::_dup(d); });
     if (duplicate >= 0) File::DuplicateDirectoryDescriptor(d, duplicate);
+    if (duplicate >= 0) File::DuplicateSharedMemoryDescriptor_nid_no_patch(d, duplicate);
 #else
     const int duplicate = ::dup(d);
 #endif
@@ -818,8 +812,10 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
     if (from == to) return to;
     if (to == 1) PreserveHostStandardOutput();
     if (to == 2) PreserveHostStandardError();
+    auto positioned = File::LockPositionedTransfer(to);
     auto* const standard = HostStandardHandle_nid_no_patch(to);
-    const int duplicated = WithoutParameterHandler([from, to] { return ::_dup2(from, to); });
+    int duplicated = File::ReplaceSharedMemoryDescriptor_nid_no_patch(from, to);
+    if (duplicated == -2) duplicated = WithoutParameterHandler([from, to] { return ::_dup2(from, to); });
     KeepStandardHandle_nid_no_patch(to, standard);
     if (duplicated != 0) return PosixFailure(SceErrorFromErrno(errno) & 0xffff);
     EqueueDescriptorClosed(to);
@@ -828,7 +824,10 @@ int APS5_VABI dup2_nid_postfix(int from, int to) {
     File::DuplicateDirectoryDescriptor(from, to);
     File::ForgetFileLock(to);
     File::ForgetRandomDevice(to);
+    File::ForgetSharedMemoryDescriptor_nid_no_patch(to);
+    File::DuplicateSharedMemoryDescriptor_nid_no_patch(from, to);
     if (sourceIsRandom) File::RememberRandomDevice(to);
+    positioned.unlock();
     File::ShareDescriptor(from, to);
     DuplicateJitSharedMemory(from, to);
     return to;
@@ -865,6 +864,9 @@ int APS5_VABI flock_nid_postfix(int d, int operation) {
 #endif
     const int type = operation & 8 ? 8 : operation & 2 ? 2 : operation & 1 ? 1 : 0;
     if (type == 0) return PosixFailure(GUEST_EBADF);
+#ifdef _WIN32
+    if (File::IsDirectoryDescriptor(d)) return 0;
+#endif
     if (NativeFlock(d, type | (operation & 4)) != 0) {
 #ifdef _WIN32
         const auto error = ::GetLastError();
@@ -880,7 +882,7 @@ int APS5_VABI flock_nid_postfix(int d, int operation) {
 }
 
 int APS5_VABI _fstatfs_nid_postfix(int d, KernelStatfs* buf) {
-    if (GuestSockets::IsOpen(d)) return PosixFailure(GUEST_EINVAL);
+    if (GuestSockets::IsOpen(d) || IsKqueueDescriptor(d)) return PosixFailure(GUEST_EINVAL);
     if (d < 0) return PosixFailure(GUEST_EBADF);
     File::RefuseArchivedFile(d, "fstatfs");
     KernelStatfs result{};
@@ -946,6 +948,9 @@ int APS5_VABI mkdir_nid_postfix(const char* path, uint16_t mode) {
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return PosixFailure(error);
     if (NativeMkdir(native, mode) != 0) {
         const int nativeError = errno;
+#ifdef _WIN32
+        if (File::WindowsSymbolicLinkLoop(WithoutTrailingSeparator(native).parent_path())) return PosixFailure(GUEST_ELOOP);
+#endif
         const bool blockedByFile = (nativeError == ENOENT || nativeError == EINVAL) && HasNonDirectoryPrefix(native);
         return PosixResult(SceErrorFromErrno(blockedByFile ? GUEST_ENOTDIR : nativeError));
     }
@@ -1135,6 +1140,35 @@ int APS5_VABI sceKernelGetdents(int fd, char* buf, int nbytes) {
 
 #else
 
+static bool InsideApp0(int fd) {
+    const int savedErrno = errno;
+    const bool inside = [fd] {
+        const auto directory = File::DirectoryDescriptorPath(fd);
+        if (!directory) return false;
+        std::error_code error;
+        const auto app0 = std::filesystem::weakly_canonical(ResolveDiskPath_nid_no_patch("/app0"), error);
+        if (error || app0.empty()) return false;
+        const auto relative = directory->lexically_relative(app0);
+        return !relative.empty() && *relative.begin() != "..";
+    }();
+    errno = savedErrno;
+    return inside;
+}
+
+static unsigned char GuestEntryType(int fd, const struct dirent64& entry, bool followLinks) {
+    if (entry.d_type != DT_LNK && entry.d_type != DT_UNKNOWN) return entry.d_type;
+    if (entry.d_type == DT_LNK && !followLinks) return DT_LNK;
+    const int savedErrno = errno;
+    struct stat target{};
+    const bool found = ::fstatat(fd, entry.d_name, &target, followLinks ? 0 : AT_SYMLINK_NOFOLLOW) == 0;
+    errno = savedErrno;
+    if (!found) return entry.d_type;
+    if (S_ISDIR(target.st_mode)) return DT_DIR;
+    if (S_ISREG(target.st_mode)) return DT_REG;
+    if (S_ISLNK(target.st_mode)) return DT_LNK;
+    return entry.d_type;
+}
+
 int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* basep) {
     if (GuestSockets::IsOpen(fd)) return SceErrorFromErrno(GUEST_EINVAL);
     File::RefuseArchivedFile(fd, "getdirentries");
@@ -1156,6 +1190,7 @@ int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* bas
     if (read < 0) return SceErrorFromErrno(errno);
     std::size_t written = 0;
     off_t resume = base;
+    const bool followLinks = InsideApp0(fd);
     for (long offset = 0; offset < read;) {
         const auto* entry = reinterpret_cast<const struct dirent64*>(host.data() + offset);
         const auto nameLength = std::strlen(entry->d_name);
@@ -1172,7 +1207,7 @@ int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* bas
         const auto nameBytes = static_cast<std::uint8_t>(nameLength);
         std::memcpy(out, &fileNumber, sizeof(fileNumber));
         std::memcpy(out + 4, &recordLength, sizeof(recordLength));
-        out[6] = static_cast<char>(entry->d_type);
+        out[6] = static_cast<char>(GuestEntryType(fd, *entry, followLinks));
         out[7] = static_cast<char>(nameBytes);
         std::memcpy(out + GuestHeaderBytes, entry->d_name, nameLength);
         written += record;
@@ -1193,6 +1228,10 @@ int APS5_VABI getdirentries_nid_postfix(int fd, char* buf, int nbytes, int64_t*
     return PosixResult(sceKernelGetdirentries(fd, buf, nbytes, basep));
 }
 
+int APS5_VABI _getdirentries_nid_postfix(int fd, char* buf, int nbytes, int64_t* basep) {
+    return getdirentries_nid_postfix(fd, buf, nbytes, basep);
+}
+
 int APS5_VABI getdents_nid_postfix(int fd, char* buf, int nbytes) {
     return PosixResult(sceKernelGetdents(fd, buf, nbytes));
 }
@@ -1208,6 +1247,9 @@ int APS5_VABI sceKernelMkdir(const char* path, uint16_t mode) {
     if (std::filesystem::exists(native, error)) return SceErrorFromErrno(GUEST_EEXIST);
     if (const int failure = PathLookupFailure(error)) return failure;
     if (!std::filesystem::is_directory(WithoutTrailingSeparator(native).parent_path(), error)) {
+#ifdef _WIN32
+        if (File::WindowsSymbolicLinkLoop(WithoutTrailingSeparator(native).parent_path())) return SceKernelError(GUEST_ELOOP);
+#endif
         return SceErrorFromErrno(HasNonDirectoryPrefix(native) ? GUEST_ENOTDIR : GUEST_ENOENT);
     }
     if (!std::filesystem::create_directory(native, error)) return SceErrorFromErrno(error.value() ? error.value() : GUEST_EIO);
@@ -1319,14 +1361,15 @@ static std::int64_t TransferIovecs(int d, const KernelIovec* guestIov, int iovcn
         return result < 0 ? SceErrorFromErrno(errno) : 0;
     }
     if (!write && offset == nullptr && File::IsDirectoryDescriptor(d)) return SceErrorFromErrno(GUEST_EISDIR);
-    if (write && offset == nullptr && iovcnt > 1 && total <= static_cast<std::size_t>(std::numeric_limits<int>::max()) && File::Appends(d)) {
+    if (write && iovcnt > 1 && total <= static_cast<std::size_t>(std::numeric_limits<int>::max()) && File::Appends(d)) {
         std::vector<char> gathered;
         gathered.reserve(total);
         for (int i = 0; i < iovcnt; ++i) {
             const auto* base = static_cast<const char*>(iov[i].base);
             gathered.insert(gathered.end(), base, base + iov[i].length);
         }
-        const auto result = NativeTransferBuffer(d, gathered.data(), gathered.size(), true);
+        const auto result = offset != nullptr ? NativePositionedTransfer(d, gathered.data(), gathered.size(), *offset, true)
+                                              : NativeTransferBuffer(d, gathered.data(), gathered.size(), true);
         return result < 0 ? SceErrorFromErrno(errno) : result;
     }
     const bool whole = write || offset != nullptr || NativeIsDisk(d);
@@ -1463,16 +1506,19 @@ int APS5_VABI sceKernelRename(const char* from, const char* to) {
 int APS5_VABI sceKernelRmdir(const char* path) {
     if (!path) return SceErrorFromErrno(GUEST_EFAULT);
     if (*path == '\0') return SceErrorFromErrno(GUEST_ENOENT);
+    if (const int dot = RenameDotError_nid_no_patch(path)) return SceKernelError(dot);
     std::filesystem::path native;
     if (const int error = ResolvePathError_nid_no_patch(path, native)) return SceKernelError(error);
     std::error_code error;
     if (std::filesystem::is_symlink(native, error)) return SceErrorFromErrno(GUEST_ENOTDIR);
     if (const int failure = PathLookupFailure(error)) return failure;
     if (!std::filesystem::is_directory(native, error)) {
+#ifdef _WIN32
+        if (File::WindowsSymbolicLinkLoop(WithoutTrailingSeparator(native).parent_path())) return SceKernelError(GUEST_ELOOP);
+#endif
         const bool blockedByFile = HasNonDirectoryPrefix(native) || std::filesystem::exists(WithoutTrailingSeparator(native), error);
         return SceErrorFromErrno(blockedByFile ? GUEST_ENOTDIR : GUEST_ENOENT);
     }
-    if (FinalPathComponentIsDot_nid_no_patch(path)) return SceErrorFromErrno(GUEST_EINVAL);
     if (!std::filesystem::is_empty(native, error)) return SceErrorFromErrno(GUEST_ENOTEMPTY);
     if (!RemoveEmptyDirectory(native)) return SceErrorFromErrno(GUEST_EIO);
     RecordWrittenPath_nid_no_patch(native);
@@ -1500,6 +1546,10 @@ int APS5_VABI sceKernelChmod_nid_postfix(const char* path, std::uint16_t mode) {
 int APS5_VABI sceKernelFchmod(int d, std::uint16_t mode) {
     if (GuestSockets::IsOpen(d)) return SceErrorFromErrno(GUEST_EINVAL);
     File::RefuseArchivedFile(d, "fchmod");
+#ifdef _WIN32
+    const int sharedMemoryResult = File::SetSharedMemoryMode_nid_no_patch(d, mode);
+    if (sharedMemoryResult != -2) return sharedMemoryResult == 0 ? 0 : SceErrorFromErrno(errno);
+#endif
     if (NativeFchmod(d, mode & 07777) != 0) return SceErrorFromErrno(errno);
     return 0;
 }
@@ -1523,7 +1573,12 @@ int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t lengt
     if (const int failure = PathLookupFailure(error)) return failure;
     if (!std::filesystem::exists(status)) return SceErrorFromErrno(NotFoundError_nid_no_patch(native));
     if (std::filesystem::is_directory(status)) return SceErrorFromErrno(GUEST_EISDIR);
-    if (const int failure = NativeTruncate(native, length)) return SceErrorFromErrno(failure);
+    if (const int failure = NativeTruncate(native, length)) {
+#ifdef _WIN32
+        if (File::WindowsSymbolicLinkLoop(native)) return SceKernelError(GUEST_ELOOP);
+#endif
+        return SceErrorFromErrno(failure);
+    }
     RecordWrittenPath_nid_no_patch(native);
     return 0;
 }
diff --git a/core/libs/prx/libkernel/File/src/Terminal.cpp b/core/libs/prx/libkernel/File/src/Terminal.cpp
index 25f8a85526..d8220e00bb 100644
--- a/core/libs/prx/libkernel/File/src/Terminal.cpp
+++ b/core/libs/prx/libkernel/File/src/Terminal.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Socket/include/SocketRuntime.hpp"
 #include <cstddef>
@@ -13,7 +15,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
 #ifdef _WIN32
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 #endif
diff --git a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp
index fdead458de..b9feacb7d1 100644
--- a/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp
+++ b/core/libs/prx/libkernel/Module/src/DynamicLoader.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libkernel/Module/ModuleArgs.hpp"
@@ -11,6 +12,7 @@
 #include <memory>
 #include <limits>
 #include <mutex>
+#include <set>
 #include <string>
 #include <stdexcept>
 #include <system_error>
@@ -23,6 +25,9 @@
 #else
 #include <dlfcn.h>
 #include <link.h>
+#ifdef __linux__
+#include <unistd.h>
+#endif
 #endif
 
 #ifdef _WIN32
@@ -36,6 +41,29 @@ void Error(const char* message) {
     std::snprintf(loaderError.data(), loaderError.size(), "%s", message);
     pendingError = true;
 }
+void LoadFailure(const std::filesystem::path& source, const std::filesystem::path& resolved, const std::string& reason) {
+    std::error_code status;
+    const auto message = resolved == source && std::filesystem::is_regular_file(source, status)
+        ? "dlopen: " + source.string() + " was not relinked: no " + source.filename().string() + ".guest.prx was found (" + reason +
+            "); relink its directory with the relinker's --module-dir <dir> option"
+        : "dlopen: cannot load " + resolved.string() + " (" + reason + ")";
+    Error(message.c_str());
+    static std::mutex reportedLock;
+    static std::set<std::filesystem::path> reported;
+    std::lock_guard lock(reportedLock);
+    if (reported.insert(resolved).second) std::fprintf(stderr, "[module] %s\n", message.c_str());
+}
+#ifdef _WIN32
+HMODULE LoadWithoutErrorDialog(const std::filesystem::path& path) {
+    const auto mode = GetThreadErrorMode();
+    SetThreadErrorMode(mode | SEM_FAILCRITICALERRORS, nullptr);
+    const auto loaded = LoadLibraryExW(path.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
+    const auto error = GetLastError();
+    SetThreadErrorMode(mode, nullptr);
+    SetLastError(error);
+    return loaded;
+}
+#endif
 struct Module {
     void* native = nullptr;
     bool owned = true;
@@ -113,6 +141,56 @@ char* APS5_VABI dlerror_nid_postfix() {
     pendingError = false;
     return loaderError.data();
 }
+#ifdef __linux__
+static void InitializeLinuxGuestModule(void* native) {
+    auto* table = static_cast<std::uint64_t*>(::dlsym(native, "__aps5_guest_lifecycle_nid_no_patch"));
+    if (!table) return;
+    link_map* requested = nullptr;
+    link_map* owner = nullptr;
+    Dl_info info{};
+    if (::dlinfo(native, RTLD_DI_LINKMAP, &requested) != 0 || requested == nullptr ||
+        !::dladdr1(table, &info, reinterpret_cast<void**>(&owner), RTLD_DL_LINKMAP) || owner == nullptr)
+        throw std::runtime_error("dlopen: cannot identify guest lifecycle metadata owner");
+    if (owner != requested) return;
+    if (table[0] != 0x415053354c494658ull) throw std::runtime_error("dlopen: unsupported guest lifecycle metadata");
+    using Entry = int (APS5_VABI *)(std::size_t, const void*, void*);
+    using Initializer = void (APS5_VABI *)(int, char**, char**);
+    static std::mutex initializedLock;
+    static std::condition_variable initializedChanged;
+    const auto thread = static_cast<std::uint64_t>(::gettid());
+    std::unique_lock lock(initializedLock);
+    while (table[6] == 1) {
+        if (table[7] == thread) return;
+        initializedChanged.wait(lock);
+    }
+    if (table[6] == 2) return;
+    if (table[6] != 0) throw std::runtime_error("dlopen: deferred guest initialization failed or finalized");
+    table[6] = 1;
+    table[7] = thread;
+    lock.unlock();
+    try {
+        const auto pending = *static_cast<const PendingModuleArgs*>(__aps5_get_pending_module_args_nid_no_patch());
+        const int result = table[2] == 0 ? 0 : reinterpret_cast<Entry>(table[2])(pending.args, pending.argp, nullptr);
+        for (std::uint64_t index = 0; index < table[4]; ++index) {
+            const auto initializer = *reinterpret_cast<Initializer*>(table[8 + index]);
+            if (initializer) initializer(0, nullptr, nullptr);
+        }
+        __aps5_set_module_init_result_nid_no_patch(result);
+        lock.lock();
+        table[6] = 2;
+        table[7] = 0;
+        lock.unlock();
+        initializedChanged.notify_all();
+    } catch (...) {
+        lock.lock();
+        table[6] = 3;
+        table[7] = 0;
+        lock.unlock();
+        initializedChanged.notify_all();
+        throw;
+    }
+}
+#endif
 #ifdef _WIN32
 static void InitializeDeferredModule(HMODULE native) {
     using Entry = int (APS5_VABI *)(std::size_t, const void*, void*);
@@ -179,9 +257,15 @@ void* APS5_VABI dlopen_nid_postfix(const char* path, int flags) {
             module->owned = false;
         } else {
             if (!*path) { Error("dlopen: empty module path"); return nullptr; }
-            const auto resolved = RelinkedModulePath_nid_no_patch(ResolvePath_nid_no_patch(path));
-            module->native = LoadLibraryExW(resolved.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
-            if (module->native) InitializeDeferredModule(static_cast<HMODULE>(module->native));
+            const auto source = ResolvePath_nid_no_patch(path);
+            const auto resolved = RelinkedModulePath_nid_no_patch(source);
+            module->native = LoadWithoutErrorDialog(resolved);
+            if (!module->native) {
+                const auto error = GetLastError();
+                LoadFailure(source, resolved, "Windows loader error " + std::to_string(error));
+                return nullptr;
+            }
+            InitializeDeferredModule(static_cast<HMODULE>(module->native));
         }
         if (!module->native) {
             char message[128];
@@ -189,11 +273,18 @@ void* APS5_VABI dlopen_nid_postfix(const char* path, int flags) {
             Error(message); return nullptr;
         }
 #else
-        const auto resolved = path ? RelinkedModulePath_nid_no_patch(ResolvePath_nid_no_patch(path)).string() : std::string{};
+        const auto source = path ? ResolvePath_nid_no_patch(path) : std::filesystem::path{};
+        const auto resolved = path ? RelinkedModulePath_nid_no_patch(source) : std::filesystem::path{};
         const int nativeFlags = ((flags & 3) == 1 ? RTLD_LAZY : RTLD_NOW) |
             ((flags & 0x100) ? RTLD_GLOBAL : RTLD_LOCAL);
         module->native = ::dlopen(path ? resolved.c_str() : nullptr, nativeFlags);
-        if (!module->native) { Error(::dlerror()); return nullptr; }
+        if (!module->native) {
+            if (path) LoadFailure(source, resolved, ::dlerror()); else Error(::dlerror());
+            return nullptr;
+        }
+#ifdef __linux__
+        if (path) InitializeLinuxGuestModule(module->native);
+#endif
 #endif
         std::lock_guard lock(modulesMutex);
         const auto handle = nextHandle++;
diff --git a/core/libs/prx/libkernel/Module/src/Module.cpp b/core/libs/prx/libkernel/Module/src/Module.cpp
index 9e71a3183c..9a9b712fcc 100644
--- a/core/libs/prx/libkernel/Module/src/Module.cpp
+++ b/core/libs/prx/libkernel/Module/src/Module.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -111,7 +112,6 @@ extern "C" void ForgetUnloadedUnwindImages_nid_no_patch() {
   for (const auto base : unloaded) UnwindImages().erase(base);
 }
 #elif !defined(__APPLE__)
-extern "C" int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
 
 namespace {
 struct ImageSearch {
@@ -142,7 +142,7 @@ bool IsRelinkedImage(std::uint64_t address) {
 void FillGuestUnwindInfo(std::uint64_t address, ModuleInfoForUnwind* info) {
   ModuleInfoEx module{};
   module.st_size = sizeof(ModuleInfoEx);
-  if (sceKernelGetModuleInfoFromAddr(address, 2, &module) != 0)
+  if (sceKernelGetModuleInfoFromAddr(address, 1, &module) != 0)
     throw std::runtime_error("sceKernelGetModuleInfoForUnwind: failed to query guest module information");
   info->eh_frame_hdr_addr = module.eh_frame_hdr_addr;
   info->eh_frame_addr = module.eh_frame_addr;
@@ -151,13 +151,6 @@ void FillGuestUnwindInfo(std::uint64_t address, ModuleInfoForUnwind* info) {
 }
 #endif
 
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
-void* APS5_VABI dlsym_nid_postfix(void* handle, const char* name);
-int APS5_VABI dlclose_nid_postfix(void* handle);
-const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-}
-
 namespace {
 constexpr int kRtldNow = 2;
 
diff --git a/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp b/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
index 63451dbcad..2df8293175 100644
--- a/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
+++ b/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -356,20 +357,22 @@ bool SystemImage(const GuestImage& image) {
 }
 #endif
 
-int FillModuleInfo(KernelModule handle, ModuleInfo* info, bool titleOnly) {
+template<typename TInfo>
+int FillModuleInfo(KernelModule handle, TInfo* info, bool titleOnly) {
     if (!info) return SCE_KERNEL_ERROR_EFAULT;
-    if (info->st_size != sizeof(ModuleInfo)) return SCE_KERNEL_ERROR_EINVAL;
+    if (info->st_size != sizeof(TInfo)) return SCE_KERNEL_ERROR_EINVAL;
     for (const auto& image : GuestImages()) {
         if (ModuleIdForImage_nid_no_patch(image.native) != handle) continue;
         if (titleOnly && SystemImage(image)) return SCE_KERNEL_ERROR_EPERM;
-        ModuleInfo result{};
-        result.st_size = sizeof(ModuleInfo);
+        TInfo result{};
+        result.st_size = sizeof(TInfo);
 #ifdef _WIN32
         if (!Fill(image.address, result)) return SCE_KERNEL_ERROR_ESRCH;
 #else
-        ImageSearch<ModuleInfo> search{image.address, &result, false};
-        dl_iterate_phdr(FindImage<ModuleInfo>, &search);
+        ImageSearch<TInfo> search{image.address, &result, false};
+        dl_iterate_phdr(FindImage<TInfo>, &search);
         if (!search.found) return SCE_KERNEL_ERROR_ESRCH;
+        if constexpr (std::is_same_v<TInfo, ModuleInfoEx>) result.id = handle;
 #endif
         *info = result;
         return 0;
@@ -392,22 +395,32 @@ int FillModuleList(KernelModule* handles, std::size_t count, std::size_t* actual
 extern "C" {
 
 int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info) {
+    if (flags != 1 && flags != 2) {
+        if (!info) throw std::invalid_argument("sceKernelGetModuleInfoFromAddr: null info with flags " + std::to_string(flags));
+        *info = {};
+        return SCE_KERNEL_ERROR_EINVAL;
+    }
     if (!info) return SCE_KERNEL_ERROR_EFAULT;
-    if (flags != 2) throw std::invalid_argument("sceKernelGetModuleInfoFromAddr: unsupported flags " + std::to_string(flags));
     ModuleInfoEx result{};
-    result.st_size = sizeof(ModuleInfoEx);
 #ifdef _WIN32
-    if (!Fill(static_cast<std::uintptr_t>(address), result)) return SCE_KERNEL_ERROR_ESRCH;
+    MEMORY_BASIC_INFORMATION memory{};
+    const bool found = Fill(static_cast<std::uintptr_t>(address), result) &&
+        VirtualQuery(reinterpret_cast<LPCVOID>(address), &memory, sizeof(memory)) == sizeof(memory);
+    const GuestImage image{nullptr, found ? reinterpret_cast<std::uintptr_t>(memory.AllocationBase) : 0};
 #else
     Dl_info symbol{};
     link_map* native = nullptr;
-    if (!dladdr1(reinterpret_cast<const void*>(address), &symbol, reinterpret_cast<void**>(&native), RTLD_DL_LINKMAP) || !native)
-        return SCE_KERNEL_ERROR_ESRCH;
     ImageSearch<ModuleInfoEx> search{static_cast<std::uintptr_t>(address), &result, false};
-    dl_iterate_phdr(FindImage<ModuleInfoEx>, &search);
-    if (!search.found) return SCE_KERNEL_ERROR_ESRCH;
-    result.id = ModuleIdForImage_nid_no_patch(native);
+    if (dladdr1(reinterpret_cast<const void*>(address), &symbol, reinterpret_cast<void**>(&native), RTLD_DL_LINKMAP) && native)
+        dl_iterate_phdr(FindImage<ModuleInfoEx>, &search);
+    const bool found = search.found;
+    if (found) result.id = ModuleIdForImage_nid_no_patch(native);
+    const GuestImage image{native, 0};
 #endif
+    if (!found || (flags == 2 && SystemImage(image))) {
+        *info = {};
+        return SCE_KERNEL_ERROR_ESRCH;
+    }
     *info = result;
     return 0;
 }
@@ -428,6 +441,10 @@ int APS5_VABI sceKernelGetModuleInfo2(KernelModule handle, ModuleInfo* info) {
     return FillModuleInfo(handle, info, true);
 }
 
+int GetModuleInfoExByHandle_nid_no_patch(KernelModule handle, ModuleInfoEx* info) {
+    return FillModuleInfo(handle, info, false);
+}
+
 std::int32_t APS5_VABI sceKernelGetLibkernelTextLocation_nid_postfix(void** address, std::size_t* size) {
     if (!address || !size) throw std::invalid_argument("sceKernelGetLibkernelTextLocation: null argument");
     const auto images = GuestImages();
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp b/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp
index 2becc20064..1f49be53c4 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Atfork.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
 #include "../include/Atfork.hpp"
 #include <mutex>
 #include <new>
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp b/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp
index 86fd01c134..a71ae71597 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Attr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <stdexcept>
@@ -7,16 +8,6 @@
 #include "../include/Pthread.hpp"
 #include "Common.hpp"
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stacksize);
-int APS5_VABI scePthreadAttrSetstack(PthreadAttr* attr, void* addr, std::size_t size);
-int APS5_VABI scePthreadAttrSetsolosched(PthreadAttr* attr, int solosched);
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-int APS5_VABI sched_get_priority_min_nid_postfix(int policy);
-}
-
 static constexpr int GuestSchedFifo = 1;
 static constexpr int GuestSchedRr = 3;
 
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp b/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp
index 4f4c7884db..9d98ca6274 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Barrier.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <climits>
 #include <condition_variable>
@@ -7,25 +8,12 @@
 #include <stdexcept>
 #include <string>
 
-struct PthreadBarrierPrivate {
-    std::mutex mutex;
-    std::condition_variable changed;
-    unsigned count;
-    unsigned arrived = 0;
-    unsigned active = 0;
-    std::uint64_t generation = 0;
-};
-
 namespace {
 
 constexpr int PROCESS_PRIVATE = 0;
 
 }
 
-struct PthreadBarrierattrPrivate {
-    int pshared = PROCESS_PRIVATE;
-};
-
 extern "C" {
 
 int APS5_VABI pthread_barrierattr_init_nid_postfix(PthreadBarrierattrPrivate** attr) {
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Common.hpp b/core/libs/prx/libkernel/Pthread/Posix/Common.hpp
index b89859ae7e..e16aa453c6 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Common.hpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Common.hpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Time/include/Time.hpp"
 #ifndef CORE_LIBS_PRX_LIBKERNEL_PTHREAD_POSIX_COMMON_HPP
 #define CORE_LIBS_PRX_LIBKERNEL_PTHREAD_POSIX_COMMON_HPP
 
@@ -6,8 +7,6 @@
 #include <limits>
 #include "SceTypes.hpp"
 
-extern "C" int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-
 namespace PosixThread {
 
 constexpr int GUEST_ESRCH = 3;
@@ -20,11 +19,16 @@ inline int ToErrno(int sceResult) {
     return sceResult == 0 ? 0 : static_cast<int>(static_cast<std::uint32_t>(sceResult) & 0xFFFFu);
 }
 
+inline int ToSce(int error) {
+    return error == 0 ? 0 : static_cast<int>(0x80020000u | static_cast<std::uint32_t>(error));
+}
+
 // Converts an absolute deadline on the guest clock into a relative wait, clamped to what the sce layer accepts.
 inline bool RelativeMicroseconds(int clockId, const KernelTimespec* abstime, KernelUseconds* usec) {
     if (!abstime || abstime->tv_nsec < 0 || abstime->tv_nsec >= 1000000000) return false;
     KernelTimespec now{};
     clock_gettime_nid_postfix(clockId, &now);
+
     constexpr auto maximum = std::numeric_limits<KernelUseconds>::max();
     if (abstime->tv_sec < now.tv_sec - 1) {
         *usec = 0;
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp b/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp
index f357cac53a..43f18c44ce 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Cond.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "Common.hpp"
@@ -80,4 +81,16 @@ int APS5_VABI pthread_condattr_getpshared_nid_postfix(const PthreadCondattr* att
     return 0;
 }
 
+int APS5_VABI pthread_cond_signalto_np_nid_postfix(PthreadCond* cond, Pthread thread) {
+    return toPosix(scePthreadCondSignalto(cond, thread));
+}
+
+int APS5_VABI scePthreadCondattrSetpshared(PthreadCondattr* attr, int pshared) {
+    return PosixThread::ToSce(pthread_condattr_setpshared_nid_postfix(attr, pshared));
+}
+
+int APS5_VABI scePthreadCondattrGetpshared(const PthreadCondattr* attr, int* pshared) {
+    return PosixThread::ToSce(pthread_condattr_getpshared_nid_postfix(attr, pshared));
+}
+
 }
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp b/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp
index 346b447bb8..6f41a86fde 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -38,8 +40,6 @@ void _initializeStatic(PthreadMutex* mutex, const char* funcName) {
 
 extern "C" {
 
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-
 int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex) {
     if (!mutex) throw std::runtime_error("pthread_mutex_destroy: null mutex");
     if (_isStaticInitializer(*mutex)) {
@@ -169,4 +169,51 @@ int APS5_VABI pthread_mutexattr_gettype_nid_postfix(const PthreadMutexattr* attr
     return 0;
 }
 
+int APS5_VABI pthread_mutexattr_setkind_np_nid_postfix(PthreadMutexattr* attr, int kind) {
+    if (!attr || !*attr) {
+        *__error_nid_postfix() = POSIX_EINVAL;
+        return -1;
+    }
+    if (kind < static_cast<int>(MutexType::ErrorCheck) || kind > static_cast<int>(MutexType::Adaptive))
+        throw std::runtime_error("pthread_mutexattr_setkind_np: kind " + std::to_string(kind) + " is not a mutex type, and pthread_mutex_init does not reject it with EINVAL");
+    (*attr)->type = static_cast<MutexType>(kind);
+    return 0;
+}
+
+int APS5_VABI pthread_mutexattr_getkind_np_nid_postfix(PthreadMutexattr attr) {
+    if (!attr) {
+        *__error_nid_postfix() = POSIX_EINVAL;
+        return -1;
+    }
+    return static_cast<int>(attr->type);
+}
+
+int APS5_VABI scePthreadMutexattrGettype(const PthreadMutexattr* attr, int* type) {
+    return PosixThread::ToSce(pthread_mutexattr_gettype_nid_postfix(attr, type));
+}
+
+int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol) {
+    return PosixThread::ToSce(pthread_mutexattr_setprotocol_nid_postfix(attr, protocol));
+}
+
+int APS5_VABI scePthreadMutexattrGetprotocol(const PthreadMutexattr* attr, int* protocol) {
+    return PosixThread::ToSce(pthread_mutexattr_getprotocol_nid_postfix(attr, protocol));
+}
+
+int APS5_VABI scePthreadMutexattrSetprioceiling(PthreadMutexattr* attr, int prioceiling) {
+    return PosixThread::ToSce(pthread_mutexattr_setprioceiling_nid_postfix(attr, prioceiling));
+}
+
+int APS5_VABI scePthreadMutexattrGetprioceiling(const PthreadMutexattr* attr, int* prioceiling) {
+    return PosixThread::ToSce(pthread_mutexattr_getprioceiling_nid_postfix(attr, prioceiling));
+}
+
+int APS5_VABI scePthreadMutexattrSetpshared(PthreadMutexattr* attr, int pshared) {
+    return PosixThread::ToSce(pthread_mutexattr_setpshared_nid_postfix(attr, pshared));
+}
+
+int APS5_VABI scePthreadMutexattrGetpshared(const PthreadMutexattr* attr, int* pshared) {
+    return PosixThread::ToSce(pthread_mutexattr_getpshared_nid_postfix(attr, pshared));
+}
+
 }
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Once.cpp b/core/libs/prx/libkernel/Pthread/Posix/Once.cpp
index 6919e008be..220e54a0a1 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Once.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Once.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Pthread/include/Cancel.hpp"
@@ -8,10 +9,7 @@
 
 namespace {
 // FreeBSD guest ABI: PTHREAD_ONCE_INIT is {0, nullptr}; completed state is 1.
-struct GuestOnce {
-    std::int32_t state;
-    void* mutex;
-};
+
 static_assert(offsetof(GuestOnce, mutex) == 8 && sizeof(GuestOnce) == 16);
 std::mutex onceMutex;
 std::condition_variable onceChanged;
@@ -39,6 +37,7 @@ extern "C" int APS5_VABI pthread_once_nid_postfix(
     CleanupHandler reset{};
     void* const mark = ThreadCancel::CleanupMark();
     __pthread_cleanup_push_imp_nid_postfix(ResetOnce, control, &reset);
+
     try {
         initialize();
     } catch (...) {
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp b/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp
index c07eadf645..c82db18c88 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -37,8 +38,6 @@ void initializeStatic(PthreadRwlock* rwlock, const char* funcName) {
 
 extern "C" {
 
-int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
-
 int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock) {
     if (!rwlock) throw std::runtime_error("pthread_rwlock_destroy: null rwlock");
     if (*rwlock == nullptr) return 0;
@@ -70,6 +69,25 @@ int APS5_VABI pthread_rwlockattr_setpshared_nid_postfix(PthreadRwlockattr* attr,
     return 0;
 }
 
+int APS5_VABI pthread_rwlockattr_gettype_np_nid_postfix(const PthreadRwlockattr* attr, int* type) {
+    if (!attr || !*attr) throw std::runtime_error("pthread_rwlockattr_gettype_np: null attr");
+    if (!type) throw std::runtime_error("pthread_rwlockattr_gettype_np: null type");
+    *type = (*attr)->type;
+    return 0;
+}
+
+int APS5_VABI scePthreadRwlockattrGettype(const PthreadRwlockattr* attr, int* type) {
+    return PosixThread::ToSce(pthread_rwlockattr_gettype_np_nid_postfix(attr, type));
+}
+
+int APS5_VABI scePthreadRwlockattrSetpshared(PthreadRwlockattr* attr, int pshared) {
+    return PosixThread::ToSce(pthread_rwlockattr_setpshared_nid_postfix(attr, pshared));
+}
+
+int APS5_VABI scePthreadRwlockattrGetpshared(const PthreadRwlockattr* attr, int* pshared) {
+    return PosixThread::ToSce(pthread_rwlockattr_getpshared_nid_postfix(attr, pshared));
+}
+
 int APS5_VABI pthread_rwlock_rdlock_nid_postfix(PthreadRwlock* rwlock) {
     initializeStatic(rwlock, __func__);
     return toPosix(scePthreadRwlockRdlock(rwlock));
@@ -93,6 +111,16 @@ int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, cons
     return toPosix(scePthreadRwlockTimedwrlock(rwlock, usec));
 }
 
+int APS5_VABI pthread_rwlock_reltimedrdlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec) {
+    initializeStatic(rwlock, __func__);
+    return toPosix(scePthreadRwlockTimedrdlock(rwlock, usec));
+}
+
+int APS5_VABI pthread_rwlock_reltimedwrlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec) {
+    initializeStatic(rwlock, __func__);
+    return toPosix(scePthreadRwlockTimedwrlock(rwlock, usec));
+}
+
 int APS5_VABI pthread_rwlock_tryrdlock_nid_postfix(PthreadRwlock* rwlock) {
     initializeStatic(rwlock, __func__);
     return toPosix(scePthreadRwlockTryrdlock(rwlock));
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp b/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp
index e780d7f59f..d755e0cf46 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Sem.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -7,8 +8,14 @@
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 #include <cerrno>
 #include <chrono>
+#include <cstdarg>
 #include <cstring>
+#include <map>
+#include <memory>
 #include <mutex>
+#include <stdexcept>
+#include <string>
+#include <string_view>
 
 // The guest sem_t is at least 8 bytes; its first word holds a pointer to the host semaphore.
 struct PosixSemaphore {
@@ -17,10 +24,19 @@ struct PosixSemaphore {
     unsigned int count;
 };
 
+static constexpr int GUEST_ENOENT = 2;
+static constexpr int GUEST_EEXIST = 17;
 static constexpr int GUEST_EAGAIN = 35;
+static constexpr int GUEST_ENAMETOOLONG = 63;
 static constexpr int GUEST_EOVERFLOW = 84;
 static constexpr unsigned int GUEST_SEM_VALUE_MAX = 0x7fffffffu;
 static constexpr int GUEST_REALTIME_CLOCK = 0;
+static constexpr int GUEST_O_CREAT = 0x200;
+static constexpr int GUEST_O_EXCL = 0x800;
+static constexpr std::size_t GUEST_PATH_MAX = 1024;
+static constexpr std::size_t GUEST_NAME_MAX = 255;
+static constexpr std::string_view NAMED_SEMAPHORE_PREFIX = "/tmp/SEMD";
+static constexpr std::string_view NAMED_SEMAPHORE_FILE_PREFIX = "SEMD";
 
 static int Fail(int error) {
     errno = error;
@@ -34,6 +50,49 @@ static PosixSemaphore* Get(void* sem) {
     return semaphore;
 }
 
+struct NamedSemaphoreMapping {
+    PosixSemaphore* semaphore;
+    std::uint64_t reserved;
+};
+
+struct NamedSemaphore {
+    std::unique_ptr<PosixSemaphore> semaphore;
+    std::unique_ptr<NamedSemaphoreMapping> mapping;
+    int openCount = 0;
+};
+
+struct NamedSemaphores {
+    std::mutex lock;
+    std::map<std::string, std::shared_ptr<NamedSemaphore>> linked;
+    std::map<const void*, std::shared_ptr<NamedSemaphore>> open;
+};
+
+static NamedSemaphores& Named() {
+    static NamedSemaphores named;
+    return named;
+}
+
+static bool IsNamed(const void* sem) {
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    return named.open.count(sem) != 0;
+}
+
+static int NamedPathError(const char* function, const char* name, int notAbsolute) {
+    if (!name) throw std::invalid_argument(std::string(function) + ": null name");
+    if (name[0] != '/') return notAbsolute;
+    if (NAMED_SEMAPHORE_PREFIX.size() + std::strlen(name + 1) >= GUEST_PATH_MAX) return GUEST_ENAMETOOLONG;
+    return 0;
+}
+
+static int NamedFileError(const char* function, const char* name) {
+    const std::string_view file(name + 1);
+    if (file.find('/') != std::string_view::npos)
+        throw std::runtime_error(std::string(function) + ": the name " + name + " would resolve below /tmp, which is not modelled");
+    if (NAMED_SEMAPHORE_FILE_PREFIX.size() + file.size() > GUEST_NAME_MAX) return GUEST_ENAMETOOLONG;
+    return 0;
+}
+
 static int WaitFor(PosixSemaphore* semaphore, const KernelUseconds* usec) {
     ThreadCancel::Check();
     std::unique_lock lock(semaphore->lock);
@@ -60,7 +119,7 @@ int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value) {
 
 int APS5_VABI sem_destroy_nid_postfix(void* sem) {
     auto* semaphore = Get(sem);
-    if (!semaphore) return Fail(PosixThread::GUEST_EINVAL);
+    if (!semaphore || IsNamed(sem)) return Fail(PosixThread::GUEST_EINVAL);
     delete semaphore;
     std::memset(sem, 0, sizeof(semaphore));
     return 0;
@@ -125,4 +184,86 @@ int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value) {
     return 0;
 }
 
+void* APS5_VABI sem_open_nid_postfix(const char* name, int flags, ...) {
+    if (const int error = NamedPathError("sem_open", name, PosixThread::GUEST_EINVAL)) {
+        Fail(error);
+        return nullptr;
+    }
+    if ((flags & ~(GUEST_O_CREAT | GUEST_O_EXCL)) != 0) {
+        Fail(PosixThread::GUEST_EINVAL);
+        return nullptr;
+    }
+    unsigned int value = 0;
+    if ((flags & GUEST_O_CREAT) != 0) {
+#ifdef _WIN32
+        __builtin_sysv_va_list arguments;
+        __builtin_sysv_va_start(arguments, flags);
+        static_cast<void>(__builtin_va_arg(arguments, int));
+        value = static_cast<unsigned int>(__builtin_va_arg(arguments, int));
+        __builtin_sysv_va_end(arguments);
+#else
+        std::va_list arguments;
+        va_start(arguments, flags);
+        static_cast<void>(va_arg(arguments, int));
+        value = static_cast<unsigned int>(va_arg(arguments, int));
+        va_end(arguments);
+#endif
+    }
+    if (const int error = NamedFileError("sem_open", name)) {
+        Fail(error);
+        return nullptr;
+    }
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    const std::string file(name + 1);
+    std::shared_ptr<NamedSemaphore> object;
+    if (const auto found = named.linked.find(file); found != named.linked.end()) {
+        if ((flags & (GUEST_O_CREAT | GUEST_O_EXCL)) == (GUEST_O_CREAT | GUEST_O_EXCL)) {
+            Fail(GUEST_EEXIST);
+            return nullptr;
+        }
+        object = found->second;
+    } else {
+        if ((flags & GUEST_O_CREAT) == 0) {
+            Fail(GUEST_ENOENT);
+            return nullptr;
+        }
+        if (value > GUEST_SEM_VALUE_MAX)
+            throw std::runtime_error("sem_open: initial value " + std::to_string(value) + " is above SEM_VALUE_MAX, which FreeBSD stores unchecked");
+        object = std::make_shared<NamedSemaphore>();
+        object->semaphore = std::make_unique<PosixSemaphore>();
+        object->semaphore->count = value;
+        named.linked.emplace(file, object);
+    }
+    if (!object->mapping) {
+        object->mapping = std::make_unique<NamedSemaphoreMapping>(NamedSemaphoreMapping{object->semaphore.get(), 0});
+        named.open.emplace(object->mapping.get(), object);
+    }
+    ++object->openCount;
+    return object->mapping.get();
+}
+
+int APS5_VABI sem_close_nid_postfix(void* sem) {
+    if (!sem) throw std::invalid_argument("sem_close: null semaphore");
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    const auto found = named.open.find(sem);
+    if (found == named.open.end()) return Fail(PosixThread::GUEST_EINVAL);
+    const auto object = found->second;
+    if (--object->openCount == 0) {
+        named.open.erase(found);
+        object->mapping.reset();
+    }
+    return 0;
+}
+
+int APS5_VABI sem_unlink_nid_postfix(const char* name) {
+    if (const int error = NamedPathError("sem_unlink", name, GUEST_ENOENT)) return Fail(error);
+    if (const int error = NamedFileError("sem_unlink", name)) return Fail(error);
+    auto& named = Named();
+    std::lock_guard lock(named.lock);
+    if (named.linked.erase(std::string(name + 1)) == 0) return Fail(GUEST_ENOENT);
+    return 0;
+}
+
 }
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp b/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp
index 9101c62da8..92c36969eb 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "Common.hpp"
 #include <atomic>
@@ -5,10 +6,6 @@
 #include <stdexcept>
 #include <thread>
 
-struct PthreadSpinlockPrivate {
-    std::atomic<std::thread::id> owner{};
-};
-
 namespace {
 
 constexpr int GUEST_EPERM = 1;
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp b/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp
index 06705a3130..160ce82945 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Thread.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -14,26 +19,9 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadDetach(Pthread thread);
-void APS5_VABI scePthreadExit(void* retval);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadRename(Pthread thread, const char* name);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadEqual(Pthread thread1, Pthread thread2);
-int APS5_VABI scePthreadOnce(int32_t* once, void (APS5_VABI* init)(void));
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* old_state);
-int APS5_VABI scePthreadSetcanceltype(int type, int* old_type);
-void APS5_VABI scePthreadTestcancel();
-int APS5_VABI scePthreadSetprio(Pthread thread, int prio);
-int APS5_VABI scePthreadGetprio(Pthread thread, int* prio);
-void APS5_VABI scePthreadYield();
+
+int APS5_VABI JoinThread_nid_no_patch(Pthread thread, void** retval, const KernelTimespec* abstime);
+
 }
 
 static constexpr int GUEST_SCHED_FIFO = 1;
@@ -51,11 +39,6 @@ static constexpr std::size_t GUEST_CPUSET_BYTES = 32;
 static constexpr int GUEST_ERANGE = 34;
 
 extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI scePthreadGetaffinity(Pthread thread, KernelCpumask* mask);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
-int APS5_VABI getpid_nid_postfix(void);
 
 int APS5_VABI cpuset_getaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, void* mask) {
     constexpr int LevelWhich = 3, WhichThread = 1, WhichProcess = 2;
@@ -124,33 +107,30 @@ int APS5_VABI cpuset_setaffinity_nid_postfix(int level, int which, std::int64_t
     return 0;
 }
 
-struct GuestRtPrio {
-    std::uint16_t type;
-    std::uint16_t prio;
-};
-
 int APS5_VABI rtprio_thread_nid_postfix(int function, int lwpid, GuestRtPrio* priority) {
     constexpr int Lookup = 0, Set = 1;
-    constexpr int GuestEsrch = 3, GuestEfault = 14, GuestEinval = 22;
-    constexpr std::uint16_t Normal = 3;
+    constexpr int GuestEsrch = 3, GuestEfault = 14;
+    constexpr int GuestSchedFifo = 1, GuestSchedRr = 3;
+    constexpr std::uint16_t Realtime = 2, Normal = 3, Fifo = 10;
     const auto fail = [](int error) {
         *__error_nid_postfix() = error;
         return -1;
     };
-    if (function != Lookup && function != Set) return fail(GuestEinval);
+    if (function != Lookup && function != Set) return fail(GuestEsrch);
     if (priority == nullptr) return fail(GuestEfault);
     auto* self = scePthreadSelf();
-    if (lwpid != 0 && static_cast<std::int64_t>(lwpid) != static_cast<std::int64_t>(self->tid)) {
-        if (!LiveGuestThreadExists(lwpid)) return fail(GuestEsrch);
-        NotImplemented_nid_no_patch("rtprio_thread: a thread other than the calling one");
-    }
-    const int policy = self->schedPolicy.load(std::memory_order_relaxed);
-    if (policy == 1 || policy == 3) NotImplemented_nid_no_patch("rtprio_thread: a guest thread's real-time class");
+    int policy = self->schedPolicy.load(std::memory_order_relaxed);
+    int schedPriority = self->priority.load(std::memory_order_relaxed);
+    const bool other = lwpid != 0 && static_cast<std::int64_t>(lwpid) != static_cast<std::int64_t>(self->tid);
+    if (other && !GetLiveGuestThreadSched_nid_no_patch(lwpid, policy, schedPriority)) return fail(GuestEsrch);
+    const bool realTime = policy == GuestSchedFifo || policy == GuestSchedRr;
     if (function == Lookup) {
-        priority->type = Normal;
-        priority->prio = 0;
+        priority->type = realTime ? (policy == GuestSchedFifo ? Fifo : Realtime) : Normal;
+        priority->prio = realTime ? static_cast<std::uint16_t>(schedPriority) : 0;
         return 0;
     }
+    if (other) NotImplemented_nid_no_patch("rtprio_thread: a thread other than the calling one");
+    if (realTime) NotImplemented_nid_no_patch("rtprio_thread: a guest thread's real-time class");
     if (priority->type == Normal && priority->prio == 0) return 0;
     NotImplemented_nid_no_patch("rtprio_thread: a real-time priority change");
 }
@@ -180,6 +160,7 @@ int APS5_VABI pthread_detach_nid_postfix(Pthread thread) {
 
 void APS5_VABI pthread_exit_nid_postfix(void* value) {
     scePthreadExit(value);
+
 }
 
 int APS5_VABI scePthreadGetschedparam(Pthread thread, int* policy, KernelSchedParam* param) {
@@ -241,6 +222,12 @@ int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** value) {
     return PosixThread::ToErrno(scePthreadJoin(thread, value));
 }
 
+int APS5_VABI pthread_timedjoin_np_nid_postfix(Pthread thread, void** value, const KernelTimespec* abstime) {
+    if (abstime == nullptr || abstime->tv_sec < 0 || abstime->tv_nsec < 0 || abstime->tv_nsec >= 1000000000)
+        return PosixThread::GUEST_EINVAL;
+    return PosixThread::ToErrno(JoinThread_nid_no_patch(thread, value, abstime));
+}
+
 namespace {
 struct RegisterPthreadOnLoad {
     RegisterPthreadOnLoad() {
@@ -258,6 +245,25 @@ struct RegisterPthreadOnLoad {
             scePthreadExit,
         };
         RegisterThreadForwards_nid_no_patch(&forwards);
+        static const PthreadSyncForwards_nid_no_patch sync{
+            reinterpret_cast<decltype(sync.mutexattrInit)>(scePthreadMutexattrInit),
+            reinterpret_cast<decltype(sync.mutexattrSettype)>(scePthreadMutexattrSettype),
+            reinterpret_cast<decltype(sync.mutexattrDestroy)>(scePthreadMutexattrDestroy),
+            reinterpret_cast<decltype(sync.mutexInit)>(scePthreadMutexInit),
+            reinterpret_cast<decltype(sync.mutexDestroy)>(scePthreadMutexDestroy),
+            reinterpret_cast<decltype(sync.mutexLock)>(scePthreadMutexLock),
+            reinterpret_cast<decltype(sync.mutexTrylock)>(scePthreadMutexTrylock),
+            reinterpret_cast<decltype(sync.mutexUnlock)>(scePthreadMutexUnlock),
+            reinterpret_cast<decltype(sync.condInit)>(scePthreadCondInit),
+            reinterpret_cast<decltype(sync.condDestroy)>(scePthreadCondDestroy),
+            reinterpret_cast<decltype(sync.condWait)>(scePthreadCondWait),
+            reinterpret_cast<decltype(sync.condSignal)>(scePthreadCondSignal),
+            reinterpret_cast<decltype(sync.condBroadcast)>(scePthreadCondBroadcast),
+            reinterpret_cast<decltype(sync.detach)>(scePthreadDetach),
+            reinterpret_cast<decltype(sync.join)>(scePthreadJoin),
+            scePthreadYield,
+        };
+        RegisterPthreadSyncForwards_nid_no_patch(&sync);
     }
 };
 const RegisterPthreadOnLoad gRegisterPthread;
@@ -279,14 +285,13 @@ int APS5_VABI pthread_getname_np_nid_postfix(Pthread thread, char* name) {
 
 void APS5_VABI pthread_set_name_np_nid_postfix(Pthread thread, const char* name) {
     scePthreadRename(thread, name != nullptr ? name : "");
+
 }
 
 Pthread APS5_VABI pthread_self_nid_postfix(void) {
     return scePthreadSelf();
 }
 
-int APS5_VABI scePthreadGetthreadid(void);
-
 int APS5_VABI pthread_getthreadid_np_nid_postfix(void) {
     return scePthreadGetthreadid();
 }
@@ -305,6 +310,7 @@ int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId) {
 
 int APS5_VABI sched_yield_nid_postfix(void) {
     scePthreadYield();
+
     return 0;
 }
 
@@ -331,10 +337,12 @@ int APS5_VABI pthread_setschedparam_nid_postfix(Pthread thread, int policy, cons
 
 void APS5_VABI pthread_testcancel_nid_postfix(void) {
     scePthreadTestcancel();
+
 }
 
 void APS5_VABI pthread_yield_nid_postfix(void) {
     scePthreadYield();
+
 }
 
 unsigned int APS5_VABI sleep_nid_postfix(unsigned int seconds) {
diff --git a/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp b/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp
index d46ac1d42d..f715d153be 100644
--- a/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp
+++ b/core/libs/prx/libkernel/Pthread/Posix/Tsd.cpp
@@ -1,16 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "Common.hpp"
 
-extern "C" {
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-}
-
 extern "C" {
 
 void* APS5_VABI pthread_getspecific_nid_postfix(PthreadKey key) {
diff --git a/core/libs/prx/libkernel/Pthread/include/Pthread.hpp b/core/libs/prx/libkernel/Pthread/include/Pthread.hpp
index c4442bd188..0e83376197 100644
--- a/core/libs/prx/libkernel/Pthread/include/Pthread.hpp
+++ b/core/libs/prx/libkernel/Pthread/include/Pthread.hpp
@@ -181,6 +181,7 @@ bool GuestThreadIsLive(const PthreadPrivate* thread);
 std::unique_lock<std::mutex> LockLiveGuestThread(const PthreadPrivate* thread);
 bool LiveGuestThreadExists(std::int64_t tid);
 bool GetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask& mask);
+bool GetLiveGuestThreadSched_nid_no_patch(std::int64_t tid, int& policy, int& priority);
 bool SetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask mask);
 extern "C" std::size_t GetDefaultStackSize_nid_no_patch();
 extern "C" bool SetDefaultStackSize_nid_no_patch(std::size_t size);
diff --git a/core/libs/prx/libkernel/Pthread/src/Attr.cpp b/core/libs/prx/libkernel/Pthread/src/Attr.cpp
index 0b3b82078c..0c26eb6762 100644
--- a/core/libs/prx/libkernel/Pthread/src/Attr.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Attr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
diff --git a/core/libs/prx/libkernel/Pthread/src/Mutex.cpp b/core/libs/prx/libkernel/Pthread/src/Mutex.cpp
index d7bc4013f8..f57ea97b25 100644
--- a/core/libs/prx/libkernel/Pthread/src/Mutex.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Mutex.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/Mutex.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -149,16 +150,6 @@ int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type) {
     return 0;
 }
 
-int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol) {
-    if (!attr || !*attr)
-        return SCE_KERNEL_ERROR_EINVAL;
-    constexpr int PrioNone = 0;
-    constexpr int PrioProtect = 2;
-    if (protocol < PrioNone || protocol > PrioProtect)
-        return SCE_KERNEL_ERROR_EINVAL;
-    return 0;
-}
-
 int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char*) {
     if (!mutex)
         throw std::invalid_argument("Mutex pointer is null");
@@ -201,10 +192,12 @@ int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex) {
 }
 
 int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex) {
-    auto* current = resolveMutex(mutex, false);
-    if (!current)
+    if (!mutex)
+        throw std::invalid_argument("Mutex pointer is null");
+    auto* current = std::atomic_ref<PthreadMutex>(*mutex).load(std::memory_order_acquire);
+    if (current == destroyedMutex())
         return SCE_KERNEL_ERROR_EINVAL;
-    if (current->_owner.load(std::memory_order_acquire) != std::this_thread::get_id())
+    if (!isInitializedMutex(current) || current->_owner.load(std::memory_order_acquire) != std::this_thread::get_id())
         return sceNotPermitted;
     bool released = true;
     if (current->_type == MutexType::Recursive) {
diff --git a/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp b/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp
index 35a043a8e9..f502a5951e 100644
--- a/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Rwlock.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/Rwlock.hpp"
 #include "prx/libc/include/General.hpp"
@@ -14,6 +15,8 @@ static constexpr int SCE_KERNEL_ERROR_EDEADLK = 0x8002000B;
 static constexpr int SCE_KERNEL_ERROR_EBUSY = 0x80020010;
 static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = 0x8002003C;
 static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
+static constexpr int FIRST_STORED_RWLOCK_TYPE = 1;
+static constexpr int LAST_STORED_RWLOCK_TYPE = 2;
 
 static PthreadRwlockPrivate* const DestroyedRwlock = reinterpret_cast<PthreadRwlockPrivate*>(std::uintptr_t{1});
 
@@ -174,7 +177,7 @@ int APS5_VABI scePthreadRwlockattrInit(PthreadRwlockattr* attr) {
 }
 
 int APS5_VABI scePthreadRwlockattrSettype(PthreadRwlockattr* attr, int type) {
-    if (!attr || !*attr) throw std::runtime_error("scePthreadRwlockattrSettype: null attr");
+    if (!attr || !*attr || type < FIRST_STORED_RWLOCK_TYPE || type > LAST_STORED_RWLOCK_TYPE) return SCE_KERNEL_ERROR_EINVAL;
     (*attr)->type = type;
     return SCE_OK;
 }
diff --git a/core/libs/prx/libkernel/Pthread/src/Sem.cpp b/core/libs/prx/libkernel/Pthread/src/Sem.cpp
index ea9006380e..5d6c44715d 100644
--- a/core/libs/prx/libkernel/Pthread/src/Sem.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Sem.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/Cancel.hpp"
 #include "prx/libc/include/General.hpp"
diff --git a/core/libs/prx/libkernel/Pthread/src/Thread.cpp b/core/libs/prx/libkernel/Pthread/src/Thread.cpp
index 31451006c2..2191cce204 100644
--- a/core/libs/prx/libkernel/Pthread/src/Thread.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Thread.cpp
@@ -1,7 +1,11 @@
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/ThreadLifecycle.hpp"
 #include "../include/WindowsThreadLocal.hpp"
 #include "../include/Cancel.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -34,6 +38,7 @@
 #endif
 
 static constexpr int SCE_OK = 0;
+static constexpr std::size_t GUEST_THREAD_NAME_CAPACITY = 32;
 
 static constexpr std::size_t HOST_STACK_MARGIN = 1u << 20;
 static constexpr int DETACH_DETACHED = 1;
@@ -74,9 +79,9 @@ static GuestThreadState& CurrentGuestState() {
     return state;
 #endif
 }
-static std::mutex stackLock;
-static std::map<PthreadPrivate*, std::pair<std::uintptr_t, std::uintptr_t>> liveStacks;
-static std::map<std::uintptr_t, std::size_t> protectedStackPages;
+static std::mutex& stackLock = *new std::mutex();
+static auto& liveStacks = *new std::map<PthreadPrivate*, std::pair<std::uintptr_t, std::uintptr_t>>();
+static auto& protectedStackPages = *new std::map<std::uintptr_t, std::size_t>();
 #if defined(__linux__)
 struct GuestStackMapping {
     std::uintptr_t mappingEnd;
@@ -84,7 +89,7 @@ struct GuestStackMapping {
     std::uintptr_t stackEnd;
 };
 static std::mutex guestStackMappingsLock;
-static std::map<std::uintptr_t, GuestStackMapping> guestStackMappings;
+static auto& guestStackMappings = *new std::map<std::uintptr_t, GuestStackMapping>();
 
 static void RegisterGuestStackMapping(PthreadPrivate* thread) {
     const auto mappingStart = reinterpret_cast<std::uintptr_t>(thread->guestStack);
@@ -108,14 +113,103 @@ struct RetiredStack {
     int hostTid;
 };
 
+struct FinishedStack {
+    void* address;
+    std::size_t bytes;
+};
+
 static std::mutex retiredStacksLock;
 static std::vector<RetiredStack> retiredStacks;
+static std::vector<FinishedStack> spareStacks;
+static std::size_t spareStackBytes = 0;
+
+static std::size_t SpareStackLimit() {
+    static const auto limit = [] {
+        const auto pages = sysconf(_SC_PHYS_PAGES);
+        const auto pageSize = sysconf(_SC_PAGESIZE);
+        if (pages <= 0 || pageSize <= 0) return std::size_t{4u << 20};
+        const auto total = static_cast<std::uint64_t>(pages) * static_cast<std::uint64_t>(pageSize);
+        return std::clamp<std::size_t>(static_cast<std::size_t>(total / 1024), 4u << 20, 64u << 20);
+    }();
+    return limit;
+}
+
+static void ReleaseFinishedStack(const FinishedStack& stack) {
+    UnregisterGuestStackMapping(stack.address);
+    DoMunmap(stack.address, stack.bytes);
+}
+
+static bool DiscardFinishedStackPages(const FinishedStack& stack) {
+    auto* usable = static_cast<std::byte*>(stack.address) + GUEST_STACK_GUARD;
+    const auto bytes = stack.bytes - GUEST_STACK_GUARD;
+    return madvise(usable, bytes, MADV_DONTNEED) == 0;
+}
+
+static void CollectFinishedStack(void* address, std::size_t bytes) {
+    UnregisterGuestStackMapping(address);
+    const FinishedStack finished{address, bytes};
+    if (!DiscardFinishedStackPages(finished)) {
+        ReleaseFinishedStack(finished);
+        return;
+    }
+    std::vector<FinishedStack> release;
+    {
+        std::lock_guard lock(retiredStacksLock);
+        spareStacks.push_back({address, bytes});
+        spareStackBytes += bytes;
+        const auto limit = SpareStackLimit();
+        while (spareStackBytes > limit && !spareStacks.empty()) {
+            spareStackBytes -= spareStacks.front().bytes;
+            release.push_back(spareStacks.front());
+            spareStacks.erase(spareStacks.begin());
+        }
+    }
+    if (!release.empty()) {
+        static std::atomic_flag logged = ATOMIC_FLAG_INIT;
+        if (!logged.test_and_set(std::memory_order_relaxed))
+            std::fprintf(stderr, "scePthread: spare stack cache reached its host-memory limit; releasing cached mappings\n");
+        for (const auto& stack : release) ReleaseFinishedStack(stack);
+    }
+}
+
+static bool TakeSpareStack(std::size_t bytes, FinishedStack* stack) {
+    std::lock_guard lock(retiredStacksLock);
+    const auto found = std::find_if(spareStacks.begin(), spareStacks.end(), [bytes](const FinishedStack& candidate) { return candidate.bytes == bytes; });
+    if (found == spareStacks.end()) return false;
+    *stack = *found;
+    spareStackBytes -= found->bytes;
+    spareStacks.erase(found);
+    return true;
+}
+
+static void ReleaseSpareStacks() {
+    std::vector<FinishedStack> release;
+    {
+        std::lock_guard lock(retiredStacksLock);
+        release.swap(spareStacks);
+        spareStackBytes = 0;
+    }
+    for (const auto& stack : release) ReleaseFinishedStack(stack);
+}
 
 static void AllocateGuestStack(PthreadPrivate* thread, std::size_t usableBytes) {
     const std::size_t bytes = (usableBytes + PS5_PAGE_SIZE - 1) / PS5_PAGE_SIZE * PS5_PAGE_SIZE + GUEST_STACK_GUARD;
+    FinishedStack spare{};
+    if (TakeSpareStack(bytes, &spare)) {
+        if (DoMprotect(spare.address, spare.bytes, 3) == 0 && DoMprotect(spare.address, GUEST_STACK_GUARD, 0) == 0) {
+            thread->guestStack = spare.address;
+            thread->guestStackBytes = spare.bytes;
+            return;
+        }
+        UnregisterGuestStackMapping(spare.address);
+        DoMunmap(spare.address, spare.bytes);
+    }
     void* stack = nullptr;
-    if (DoMapAnon(&stack, bytes, 3, 0) != 0)
-        throw std::runtime_error("scePthreadCreate: cannot map the guest thread stack");
+    if (DoMapAnon(&stack, bytes, 3, 0) != 0) {
+        ReleaseSpareStacks();
+        if (DoMapAnon(&stack, bytes, 3, 0) != 0)
+            throw std::runtime_error("scePthreadCreate: cannot map the guest thread stack");
+    }
     if (DoMprotect(stack, GUEST_STACK_GUARD, 0) != 0) {
         DoMunmap(stack, bytes);
         throw std::runtime_error("scePthreadCreate: cannot protect the guest thread stack guard");
@@ -126,9 +220,7 @@ static void AllocateGuestStack(PthreadPrivate* thread, std::size_t usableBytes)
 
 static void FreeGuestStack(PthreadPrivate* thread) {
     if (thread->guestStack == nullptr) return;
-    void* const mapping = thread->guestStack;
-    UnregisterGuestStackMapping(mapping);
-    DoMunmap(thread->guestStack, thread->guestStackBytes);
+    CollectFinishedStack(thread->guestStack, thread->guestStackBytes);
     thread->guestStack = nullptr;
     thread->guestStackBytes = 0;
 }
@@ -153,10 +245,7 @@ static void ReapRetiredStacks() {
             }
         }
     }
-    for (const auto& stack : ready) {
-        UnregisterGuestStackMapping(stack.address);
-        DoMunmap(stack.address, stack.bytes);
-    }
+    for (const auto& stack : ready) CollectFinishedStack(stack.address, stack.bytes);
 }
 
 static void RetireGuestStack(PthreadPrivate* thread) {
@@ -463,6 +552,18 @@ bool GetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask& ma
     return false;
 }
 
+bool GetLiveGuestThreadSched_nid_no_patch(std::int64_t tid, int& policy, int& priority) {
+    auto& registry = CpuClocks();
+    std::lock_guard lock(registry.lock);
+    for (const auto& [id, thread] : registry.threads) {
+        if (thread->tid != tid || thread->_finished.load(std::memory_order_acquire)) continue;
+        policy = thread->schedPolicy.load(std::memory_order_relaxed);
+        priority = thread->priority.load(std::memory_order_relaxed);
+        return true;
+    }
+    return false;
+}
+
 bool SetLiveGuestThreadAffinity_nid_no_patch(std::int64_t tid, KernelCpumask mask) {
     auto& registry = CpuClocks();
     std::lock_guard lock(registry.lock);
@@ -819,6 +920,7 @@ extern "C" {
 
 int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name) {
     if (!thread || !entry) throw std::runtime_error("scePthreadCreate: null arg");
+    if (name && std::strlen(name) >= GUEST_THREAD_NAME_CAPACITY) return SCE_KERNEL_ERROR_ENAMETOOLONG;
     if (attr && !*attr) attr = nullptr;
     auto p = std::make_unique<PthreadPrivate>(attr ? *attr : nullptr);
     bool detached = false;
@@ -926,7 +1028,7 @@ int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, Pthread
     return SCE_OK;
 }
 
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval) {
+int APS5_VABI JoinThread_nid_no_patch(Pthread thread, void** retval, const KernelTimespec* abstime) {
     if (!thread) return SCE_KERNEL_ERROR_EINVAL;
     if (thread == CurrentGuestState().current) return SCE_KERNEL_ERROR_EDEADLK;
     if (thread->_detached) return SCE_KERNEL_ERROR_EINVAL;
@@ -938,7 +1040,22 @@ int APS5_VABI scePthreadJoin(Pthread thread, void** retval) {
         if (thread->_joining) return SCE_KERNEL_ERROR_EOPNOTSUPP;
         thread->_joining = true;
         while (!thread->_finished.load()) {
-            ThreadCancel::Wait(thread->_join_cv, lock, std::nullopt);
+            std::optional<std::uint64_t> deadline;
+            if (abstime != nullptr) {
+                KernelTimespec now{};
+                if (clock_gettime_nid_postfix(0, &now) != 0) {
+                    thread->_joining = false;
+                    throw std::runtime_error("Joining guest thread: realtime clock unavailable");
+                }
+                if (abstime->tv_sec < now.tv_sec || (abstime->tv_sec == now.tv_sec && abstime->tv_nsec <= now.tv_nsec)) {
+                    thread->_joining = false;
+                    return SCE_KERNEL_ERROR_ETIMEDOUT;
+                }
+                const auto seconds = static_cast<std::uint64_t>(abstime->tv_sec) - static_cast<std::uint64_t>(now.tv_sec);
+                const auto nanos = seconds > 1 ? std::int64_t{1000000000} : static_cast<std::int64_t>(seconds) * 1000000000 + abstime->tv_nsec - now.tv_nsec;
+                deadline = TimedWait::DeadlineNanos(static_cast<std::uint64_t>((nanos + 999) / 1000));
+            }
+            ThreadCancel::Wait(thread->_join_cv, lock, deadline);
             if (ThreadCancel::Requested()) {
                 thread->_joining = false;
                 lock.unlock();
@@ -964,11 +1081,16 @@ int APS5_VABI scePthreadJoin(Pthread thread, void** retval) {
     return SCE_OK;
 }
 
+int APS5_VABI scePthreadJoin(Pthread thread, void** retval) {
+    return JoinThread_nid_no_patch(thread, retval, nullptr);
+}
+
 int APS5_VABI scePthreadDetach(Pthread thread) {
     if (!thread) return SCE_KERNEL_ERROR_EINVAL;
     {
         std::lock_guard lock(thread->_join_mtx);
-        if (thread->_detached || thread->_joining || thread->_joined.load(std::memory_order_acquire)) return SCE_KERNEL_ERROR_EINVAL;
+        if (thread->_joined.load(std::memory_order_acquire)) return SCE_KERNEL_ERROR_ESRCH;
+        if (thread->_detached || thread->_joining) return SCE_KERNEL_ERROR_EINVAL;
         thread->_detached = true;
     }
 #ifdef _WIN32
@@ -1066,6 +1188,7 @@ int APS5_VABI scePthreadCancel(Pthread thread) {
             thread->cancelWait->NotifyAll();
         }
         scePthreadYield();
+
     }
 }
 
@@ -1093,6 +1216,7 @@ void APS5_VABI pthread_cleanup_push_nid_postfix(void (APS5_VABI* routine)(void*)
 
 void APS5_VABI pthread_cleanup_pop_nid_postfix(int execute) {
     __pthread_cleanup_pop_imp_nid_postfix(execute);
+
 }
 
 int APS5_VABI scePthreadEqual(Pthread thread1, Pthread thread2) {
@@ -1192,6 +1316,7 @@ int APS5_VABI scePthreadOnce(int32_t* once, void (APS5_VABI* init)(void)) {
     CleanupHandler reset{};
     void* const mark = ThreadCancel::CleanupMark();
     __pthread_cleanup_push_imp_nid_postfix(ResetOnce, once, &reset);
+
     try {
         init();
     } catch (...) {
diff --git a/core/libs/prx/libkernel/Pthread/src/Tsd.cpp b/core/libs/prx/libkernel/Pthread/src/Tsd.cpp
index 03c706c202..2cf90e324a 100644
--- a/core/libs/prx/libkernel/Pthread/src/Tsd.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Tsd.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "../include/Pthread.hpp"
 #include "../include/ThreadLifecycle.hpp"
 #include "../include/WindowsThreadLocal.hpp"
diff --git a/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp b/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp
index 725f297e67..a1b4e1bd60 100644
--- a/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp
+++ b/core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp
@@ -21,9 +21,12 @@ extern "C" {
 
 int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt) {
  (void)opt;
- if (sem == nullptr || name == nullptr || attr > 2 || init < 0 || max <= 0 || init > max) {
+ if (sem == nullptr || attr > 2 || max < 0) {
   APS5_INVALID_ARG_EX;
  }
+ if (name == nullptr || init < 0 || max == 0 || init > max) {
+  return SCE_KERNEL_ERROR_EINVAL;
+ }
 
  *sem = new KernelSemaPrivate(init, max, std::string(name), attr == 1);
  if (TraceSync()) std::fprintf(stderr, "[sema] create %p '%s' attr=0x%x init=%d max=%d\n", static_cast<void*>(*sem), name, attr, init, max);
@@ -31,8 +34,11 @@ int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t at
 }
 
 int APS5_VABI sceKernelPollSema(KernelSema sem, int need) {
- if (sem == nullptr || need <= 0) {
-  APS5_INVALID_ARG_EX;
+ if (sem == nullptr) {
+  return SCE_KERNEL_ERROR_ESRCH;
+ }
+ if (need <= 0 || need > sem->maxCount) {
+  return SCE_KERNEL_ERROR_EINVAL;
  }
 
  std::lock_guard<std::mutex> lock(sem->mutex);
@@ -44,9 +50,15 @@ int APS5_VABI sceKernelPollSema(KernelSema sem, int need) {
 }
 
 int APS5_VABI sceKernelSignalSema(KernelSema sem, int count) {
- if (sem == nullptr || count < 0) {
+ if (sem == nullptr) {
+  return SCE_KERNEL_ERROR_ESRCH;
+ }
+ if (count < 0) {
   APS5_INVALID_ARG_EX;
  }
+ if (count == 0) {
+  return SCE_KERNEL_ERROR_EINVAL;
+ }
 
  std::lock_guard<std::mutex> lock(sem->mutex);
  if (count > sem->maxCount - sem->tokenCount) {
@@ -60,7 +72,10 @@ int APS5_VABI sceKernelSignalSema(KernelSema sem, int count) {
 }
 
 int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time) {
- if (sem == nullptr || need <= 0) {
+ if (sem == nullptr) {
+  return SCE_KERNEL_ERROR_ESRCH;
+ }
+ if (need <= 0) {
   APS5_INVALID_ARG_EX;
  }
 
@@ -129,7 +144,7 @@ int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time)
 
 int APS5_VABI sceKernelCancelSema(KernelSema sem, int count, int* threads) {
  if (sem == nullptr) {
-  APS5_INVALID_ARG_EX;
+  return SCE_KERNEL_ERROR_ESRCH;
  }
 
  std::lock_guard<std::mutex> lock(sem->mutex);
@@ -148,7 +163,7 @@ int APS5_VABI sceKernelCancelSema(KernelSema sem, int count, int* threads) {
 
 int APS5_VABI sceKernelDeleteSema(KernelSema sem) {
  if (sem == nullptr) {
-  APS5_INVALID_ARG_EX;
+  return SCE_KERNEL_ERROR_ESRCH;
  }
 
  std::unique_lock<std::mutex> lock(sem->mutex);
diff --git a/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp b/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp
index 56bbe00efe..18a966c5da 100644
--- a/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp
+++ b/core/libs/prx/libkernel/Socket/include/SocketOptions.hpp
@@ -1,5 +1,6 @@
 #pragma once
 #include <cstdint>
+#include <vector>
 
 namespace GuestSockets {
 
@@ -9,13 +10,30 @@ struct SocketOptionState {
     bool noSignal = false;
     std::int64_t sendTimeout = 0;
     std::int64_t receiveTimeout = 0;
+    int sendBuffer = 0;
+    int receiveBuffer = 0;
+    int sendLowWater = 0;
+    int receiveLowWater = 0;
+    int ipTimeToLive = 64;
+    int ipTypeOfService = 0;
+    int multicastTimeToLive = 1;
+    bool multicastLoop = true;
+    int tcpMaximumSegment = 536;
+    unsigned int tcpKeepIdle = 0;
+    unsigned int tcpKeepInterval = 0;
+    unsigned int tcpKeepCount = 0;
+    int keptFlags = 0;
+    std::uint32_t multicastInterface = 0;
+    std::vector<std::uint64_t> memberships;
 };
 
 bool NativeListening(std::uintptr_t native, bool& listening);
-int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int option, const void* value, std::uint32_t length);
-int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int type, int option, void* value, std::uint32_t* length);
-int SetTcpLevelOption(std::uintptr_t native, bool tcp, int option, const void* value, std::uint32_t length);
-int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value, std::uint32_t* length);
+int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, const void* value, std::uint32_t length);
+int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, void* value, std::uint32_t* length);
+int SetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, const void* value, std::uint32_t length);
+int GetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, void* value, std::uint32_t* length);
+int SetIpLevelOption(std::uintptr_t native, SocketOptionState& state, bool ipv4, bool datagram, int option, const void* value, std::uint32_t length);
+int GetIpLevelOption(SocketOptionState& state, bool ipv4, bool datagram, int option, void* value, std::uint32_t* length);
 int SetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, const void* value, std::uint32_t length);
 int GetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, void* value, std::uint32_t* length);
 
diff --git a/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp b/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp
index bbcb17e637..5ffab9d013 100644
--- a/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp
+++ b/core/libs/prx/libkernel/Socket/src/AddressConversion.cpp
@@ -1,11 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 constexpr int kGuestInet = 2;
 constexpr int kGuestInet6 = 28;
diff --git a/core/libs/prx/libkernel/Socket/src/Pselect.cpp b/core/libs/prx/libkernel/Socket/src/Pselect.cpp
new file mode 100644
index 0000000000..8ae40d8549
--- /dev/null
+++ b/core/libs/prx/libkernel/Socket/src/Pselect.cpp
@@ -0,0 +1,32 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+
+extern "C" {
+
+int APS5_VABI pselect_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout, const void* sigmask) {
+    constexpr int SetMask = 3;
+    struct Timeval {
+        std::int64_t seconds;
+        std::int64_t microseconds;
+    } limit{};
+    const Timeval* wait = nullptr;
+    if (timeout != nullptr) {
+        const auto* spec = static_cast<const std::int64_t*>(timeout);
+        limit = {spec[0], spec[1] / 1000};
+        wait = &limit;
+    }
+    std::uint32_t previous[4]{};
+    if (sigmask != nullptr && sigprocmask_nid_postfix(SetMask, sigmask, previous) != 0) return -1;
+    const int result = select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
+    if (sigmask != nullptr) {
+        const int error = *__error_nid_postfix();
+        sigprocmask_nid_postfix(SetMask, previous, nullptr);
+
+        *__error_nid_postfix() = error;
+    }
+    return result;
+}
+
+}
diff --git a/core/libs/prx/libkernel/Socket/src/Socket.cpp b/core/libs/prx/libkernel/Socket/src/Socket.cpp
index 6cc428f617..e27ce66b87 100644
--- a/core/libs/prx/libkernel/Socket/src/Socket.cpp
+++ b/core/libs/prx/libkernel/Socket/src/Socket.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -131,9 +133,6 @@ int HostPoll(KernelSocketPoll::Entry* descriptors, int count, int timeoutMillise
 
 extern "C" {
 
-const char* APS5_VABI __inet_ntop_nid_postfix(int family, const void* source, char* destination, std::uint32_t capacity);
-int APS5_VABI __inet_pton_nid_postfix(int family, const char* text, void* destination);
-
 const char* APS5_VABI inet_ntop_nid_postfix(int af, const void* src, char* dst, uint32_t size) {
     return __inet_ntop_nid_postfix(af, src, dst, size);
 }
@@ -142,8 +141,6 @@ int APS5_VABI inet_pton_nid_postfix(int af, const char* src, void* dst) {
     return __inet_pton_nid_postfix(af, src, dst);
 }
 
-int* APS5_VABI __error_nid_postfix();
-
 void KernelSetSocketPoller_nid_no_patch(KernelSocketPoll::Poller poller) {
     g_socketPoller.store(poller);
 }
diff --git a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
index 37fce2af2e..fd7ea3cfd8 100644
--- a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
+++ b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
@@ -16,6 +16,7 @@
 #include "prx/libkernel/Socket/include/SocketOptions.hpp"
 #include <algorithm>
 #include <cstring>
+#include <stdexcept>
 
 namespace GuestSockets {
 namespace {
@@ -30,18 +31,48 @@ constexpr int GuestOobInline = 0x100;
 constexpr int GuestNoSigpipe = 0x800;
 constexpr int GuestSendBuffer = 0x1001;
 constexpr int GuestReceiveBuffer = 0x1002;
+constexpr int GuestSendLowWater = 0x1003;
+constexpr int GuestReceiveLowWater = 0x1004;
 constexpr int GuestSendTimeout = 0x1005;
 constexpr int GuestReceiveTimeout = 0x1006;
 constexpr int GuestError = 0x1007;
 constexpr int GuestType = 0x1008;
 constexpr int GuestNonBlocking = 0x1200;
+constexpr int GuestNonBlockingState = 0x100;
+constexpr int GuestUnix = 1;
 constexpr int GuestTcpNoDelay = 1;
+constexpr int GuestReusePort = 0x200;
+constexpr int KeptFlags = 0x1 | GuestReuseAddress | 0x40 | GuestReusePort | 0x400 | 0x2000 | 0x10000;
+constexpr int WriteOnlyFlags = 0x4000 | 0x8000;
 constexpr int GuestTcpNoDelayFlag = 4;
+constexpr int GuestTcpMaximumSegment = 2;
+constexpr int GuestTcpKeepIdle = 0x100;
+constexpr int GuestTcpKeepInterval = 0x200;
+constexpr int GuestTcpKeepCount = 0x400;
+constexpr int MinimumSegment = 216;
+constexpr unsigned int TicksPerSecond = 1000;
+constexpr unsigned int DefaultKeepIdle = 7200;
+constexpr unsigned int DefaultKeepInterval = 75;
+constexpr unsigned int DefaultKeepCount = 8;
 constexpr int GuestIpv6Only = 27;
+constexpr int GuestIpTypeOfService = 3;
+constexpr int GuestIpTimeToLive = 4;
+constexpr int GuestIpMulticastTimeToLive = 10;
+constexpr int GuestIpMulticastLoop = 11;
+constexpr int GuestIpMulticastInterface = 9;
+constexpr int GuestIpAddMembership = 12;
+constexpr int GuestIpDropMembership = 13;
+constexpr std::uint32_t MulticastRequestWithIndex = 12;
+constexpr int ErrorNotSupported = 45;
+constexpr int ErrorAddressInUse = 48;
+constexpr int ErrorAddressNotAvailable = 49;
 
 constexpr int ErrorInvalid = 22;
 constexpr int ErrorDomain = 33;
 constexpr int ErrorNoProtocolOption = 42;
+constexpr int ErrorNoBuffers = 55;
+constexpr int MaximumReservation = 5592405;
+constexpr int MaximumBuffer = 524288;
 constexpr int MaximumLinger = 65535;
 constexpr std::int64_t LongestTimeout = 0x7fffffffffffffffLL;
 
@@ -78,7 +109,6 @@ int HostError() { return GuestErrorFromHost(errno); }
 
 int NativeBoolean(int option) {
     switch (option) {
-        case GuestReuseAddress: return SO_REUSEADDR;
         case GuestKeepAlive: return SO_KEEPALIVE;
         case GuestDontRoute: return SO_DONTROUTE;
         case GuestBroadcast: return SO_BROADCAST;
@@ -87,9 +117,21 @@ int NativeBoolean(int option) {
     }
 }
 
+void EnsureBuffers(SocketOptionState& state, int family, int type) {
+    if (state.sendBuffer != 0) return;
+    if (family == GuestUnix) {
+        state.sendBuffer = type == 2 ? 2048 : 8192;
+        state.receiveBuffer = type == 2 ? 4096 : 8192;
+    } else {
+        state.sendBuffer = type == 1 ? 32768 : 9216;
+        state.receiveBuffer = type == 1 ? 65536 : 42080;
+    }
+    state.sendLowWater = std::min(2048, state.sendBuffer);
+    state.receiveLowWater = 1;
+}
+
 int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t size) {
-    const std::uint32_t count = std::min(*length, size);
-    if (count != 0 && !output) return ErrorInvalid;
+    const std::uint32_t count = output ? std::min(*length, size) : 0;
     if (count != 0) std::memcpy(output, value, count);
     *length = count;
     return 0;
@@ -97,11 +139,10 @@ int Copy(void* output, std::uint32_t* length, const void* value, std::uint32_t s
 
 }
 
-int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int option, const void* value, std::uint32_t length) {
+int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, const void* value, std::uint32_t length) {
     const auto handle = static_cast<NativeHandle>(native);
     if (option == GuestLinger) {
         if (length < sizeof(GuestLingerValue)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         GuestLingerValue guest;
         std::memcpy(&guest, value, sizeof(guest));
         if (guest.seconds < 0 || guest.seconds > MaximumLinger) return ErrorDomain;
@@ -119,7 +160,6 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op
     }
     if (option == GuestSendTimeout || option == GuestReceiveTimeout) {
         if (length < sizeof(GuestTimeval)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         GuestTimeval time;
         std::memcpy(&time, value, sizeof(time));
         if (time.seconds < 0 || time.microseconds < 0 || time.microseconds >= 1000000) return ErrorDomain;
@@ -128,7 +168,6 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op
     }
     if (option == GuestNoSigpipe || option == GuestNonBlocking) {
         if (length < sizeof(int)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         int number;
         std::memcpy(&number, value, sizeof(number));
         if (option == GuestNoSigpipe) {
@@ -146,21 +185,52 @@ int SetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int op
         return 0;
     }
     const bool native_boolean = NativeBoolean(option) != -1;
-    if (native_boolean || option == GuestSendBuffer || option == GuestReceiveBuffer) {
+    const bool buffer = option == GuestSendBuffer || option == GuestReceiveBuffer;
+    const bool lowWater = option == GuestSendLowWater || option == GuestReceiveLowWater;
+    if (native_boolean || buffer || lowWater) {
         if (length < sizeof(int)) return ErrorInvalid;
-        if (!value) return ErrorInvalid;
         int number;
         std::memcpy(&number, value, sizeof(number));
-        if (option == GuestSendBuffer || option == GuestReceiveBuffer) {
+        if (buffer || lowWater) {
             if (number < 1) return ErrorInvalid;
-            const int nativeOption = option == GuestSendBuffer ? SO_SNDBUF : SO_RCVBUF;
+            EnsureBuffers(state, family, type);
+            const bool send = option == GuestSendBuffer || option == GuestSendLowWater;
+            int& size = send ? state.sendBuffer : state.receiveBuffer;
+            int& mark = send ? state.sendLowWater : state.receiveLowWater;
+            if (lowWater) {
+                mark = std::min(number, size);
+                return 0;
+            }
+            if (number > MaximumReservation) return ErrorNoBuffers;
+            const int nativeOption = send ? SO_SNDBUF : SO_RCVBUF;
             if (::setsockopt(handle, SOL_SOCKET, nativeOption, reinterpret_cast<NativeOptionValue>(&number), sizeof(number))) return HostError();
+            size = std::min(number, MaximumBuffer);
+            mark = std::min(mark, size);
             return 0;
         }
         const int enabled = number != 0 ? 1 : 0;
         if (::setsockopt(handle, SOL_SOCKET, NativeBoolean(option), reinterpret_cast<NativeOptionValue>(&enabled), sizeof(enabled))) return HostError();
         return 0;
     }
+    if ((option & (KeptFlags | WriteOnlyFlags)) != 0 && (option & (option - 1)) == 0) {
+        if (length < sizeof(int)) return ErrorInvalid;
+        int number;
+        std::memcpy(&number, value, sizeof(number));
+        if ((option & KeptFlags) == 0) return 0;
+        const int flags = number != 0 ? state.keptFlags | option : state.keptFlags & ~option;
+        if (option == GuestReuseAddress || option == GuestReusePort) {
+#ifdef _WIN32
+            const int reuseAddress = (flags & (GuestReuseAddress | GuestReusePort)) != 0 ? 1 : 0;
+#else
+            const int reuseAddress = (flags & GuestReuseAddress) != 0 ? 1 : 0;
+            const int reusePort = (flags & GuestReusePort) != 0 ? 1 : 0;
+            if (::setsockopt(handle, SOL_SOCKET, SO_REUSEPORT, reinterpret_cast<NativeOptionValue>(&reusePort), sizeof(reusePort))) return HostError();
+#endif
+            if (::setsockopt(handle, SOL_SOCKET, SO_REUSEADDR, reinterpret_cast<NativeOptionValue>(&reuseAddress), sizeof(reuseAddress))) return HostError();
+        }
+        state.keptFlags = flags;
+        return 0;
+    }
     return ErrorNoProtocolOption;
 }
 
@@ -178,7 +248,7 @@ bool NativeListening(std::uintptr_t native, bool& listening) {
     return true;
 }
 
-int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int type, int option, void* value, std::uint32_t* length) {
+int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int family, int type, int option, void* value, std::uint32_t* length) {
     const auto handle = static_cast<NativeHandle>(native);
     if (option == GuestLinger) {
         linger current{};
@@ -203,10 +273,12 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int ty
         number = listening ? GuestAcceptConnection : 0;
     } else if (option == GuestType) {
         number = type;
+    } else if ((option & KeptFlags) != 0 && (option & (option - 1)) == 0) {
+        number = state.keptFlags & option;
     } else if (option == GuestNoSigpipe) {
         number = state.noSignal ? GuestNoSigpipe : 0;
     } else if (option == GuestNonBlocking) {
-        number = state.nonblocking ? 1 : 0;
+        number = state.nonblocking ? GuestNonBlockingState : 0;
     } else if (option == GuestError) {
         int pending = 0;
         socklen_t size = sizeof(pending);
@@ -216,29 +288,53 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int ty
         else if (pending != 0) state.reportedError = pending;
 #endif
         number = pending == 0 ? 0 : GuestErrorFromHost(pending);
-    } else if (option == GuestSendBuffer || option == GuestReceiveBuffer) {
-        socklen_t size = sizeof(number);
-        if (::getsockopt(handle, SOL_SOCKET, option == GuestSendBuffer ? SO_SNDBUF : SO_RCVBUF, reinterpret_cast<NativeOptionOutput>(&number), &size)) return HostError();
+    } else if (option == GuestSendBuffer || option == GuestReceiveBuffer || option == GuestSendLowWater || option == GuestReceiveLowWater) {
+        EnsureBuffers(state, family, type);
+        number = option == GuestSendBuffer ? state.sendBuffer : option == GuestReceiveBuffer ? state.receiveBuffer
+            : option == GuestSendLowWater ? state.sendLowWater : state.receiveLowWater;
     } else {
         return ErrorNoProtocolOption;
     }
     return Copy(value, length, &number, sizeof(number));
 }
 
-int SetTcpLevelOption(std::uintptr_t native, bool tcp, int option, const void* value, std::uint32_t length) {
+int SetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, const void* value, std::uint32_t length) {
     if (!tcp) return ErrorInvalid;
-    if (option != GuestTcpNoDelay) return ErrorNoProtocolOption;
+    if (option != GuestTcpNoDelay && option != GuestTcpMaximumSegment && option != GuestTcpKeepIdle && option != GuestTcpKeepInterval &&
+        option != GuestTcpKeepCount)
+        return ErrorNoProtocolOption;
     if (length < sizeof(int)) return ErrorInvalid;
-    if (!value) return ErrorInvalid;
     int number;
     std::memcpy(&number, value, sizeof(number));
+    const auto unsignedNumber = static_cast<unsigned int>(number);
+    if (option == GuestTcpMaximumSegment) {
+        if (number <= 0 || number > state.tcpMaximumSegment || number + 40 < MinimumSegment) return ErrorInvalid;
+        state.tcpMaximumSegment = number;
+        return 0;
+    }
+    if (option == GuestTcpKeepCount) {
+        state.tcpKeepCount = unsignedNumber;
+        return 0;
+    }
+    if (option == GuestTcpKeepIdle || option == GuestTcpKeepInterval) {
+        if (unsignedNumber > UINT32_MAX / TicksPerSecond) return ErrorInvalid;
+        (option == GuestTcpKeepIdle ? state.tcpKeepIdle : state.tcpKeepInterval) = unsignedNumber;
+        return 0;
+    }
     const int enabled = number != 0 ? 1 : 0;
     if (::setsockopt(static_cast<NativeHandle>(native), IPPROTO_TCP, TCP_NODELAY, reinterpret_cast<NativeOptionValue>(&enabled), sizeof(enabled))) return HostError();
     return 0;
 }
 
-int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value, std::uint32_t* length) {
+int GetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, void* value, std::uint32_t* length) {
     if (!tcp) return ErrorInvalid;
+    if (option == GuestTcpMaximumSegment || option == GuestTcpKeepIdle || option == GuestTcpKeepInterval || option == GuestTcpKeepCount) {
+        const unsigned int number = option == GuestTcpMaximumSegment ? static_cast<unsigned int>(state.tcpMaximumSegment)
+            : option == GuestTcpKeepIdle ? (state.tcpKeepIdle != 0 ? state.tcpKeepIdle : DefaultKeepIdle)
+            : option == GuestTcpKeepInterval ? (state.tcpKeepInterval != 0 ? state.tcpKeepInterval : DefaultKeepInterval)
+            : (state.tcpKeepCount != 0 ? state.tcpKeepCount : DefaultKeepCount);
+        return Copy(value, length, &number, sizeof(number));
+    }
     if (option != GuestTcpNoDelay) return ErrorNoProtocolOption;
     int enabled = 0;
     socklen_t size = sizeof(enabled);
@@ -247,11 +343,117 @@ int GetTcpLevelOption(std::uintptr_t native, bool tcp, int option, void* value,
     return Copy(value, length, &number, sizeof(number));
 }
 
+bool MulticastOption(int option) {
+    return option == GuestIpMulticastInterface || option == GuestIpMulticastTimeToLive || option == GuestIpMulticastLoop ||
+        option == GuestIpAddMembership || option == GuestIpDropMembership;
+}
+
+int SetIpLevelOption(std::uintptr_t native, SocketOptionState& state, bool ipv4, bool datagram, int option, const void* value, std::uint32_t length) {
+    if (!ipv4) return ErrorInvalid;
+    if (MulticastOption(option) && !datagram) return ErrorNotSupported;
+    const auto handle = static_cast<NativeHandle>(native);
+    if (option == GuestIpAddMembership || option == GuestIpDropMembership) {
+        if (length < sizeof(ip_mreq)) return ErrorInvalid;
+        ip_mreq request{};
+        std::memcpy(&request, value, sizeof(request));
+        const auto* group = reinterpret_cast<const unsigned char*>(&request.imr_multiaddr);
+        if ((group[0] & 0xf0) != 0xe0) return ErrorInvalid;
+        std::uint32_t groupBits;
+        std::uint32_t interfaceBits;
+        std::memcpy(&groupBits, &request.imr_multiaddr, sizeof(groupBits));
+        std::memcpy(&interfaceBits, &request.imr_interface, sizeof(interfaceBits));
+        const std::uint64_t key = (std::uint64_t{groupBits} << 32) | interfaceBits;
+        const bool join = option == GuestIpAddMembership;
+        const auto found = join || interfaceBits != 0
+            ? std::find(state.memberships.begin(), state.memberships.end(), key)
+            : std::find_if(state.memberships.begin(), state.memberships.end(), [groupBits](std::uint64_t joined) { return joined >> 32 == groupBits; });
+        if (join && found != state.memberships.end()) return ErrorAddressInUse;
+        if (!join && found == state.memberships.end()) return ErrorAddressNotAvailable;
+        if (!join) {
+            const auto joinedInterface = static_cast<std::uint32_t>(*found);
+            std::memcpy(&request.imr_interface, &joinedInterface, sizeof(joinedInterface));
+        }
+        if (::setsockopt(handle, IPPROTO_IP, join ? IP_ADD_MEMBERSHIP : IP_DROP_MEMBERSHIP, reinterpret_cast<NativeOptionValue>(&request), sizeof(request)))
+            return HostError();
+        if (join) state.memberships.push_back(key);
+        else state.memberships.erase(found);
+        return 0;
+    }
+    if (option == GuestIpMulticastInterface) {
+        if (length < sizeof(in_addr)) return ErrorInvalid;
+        in_addr address{};
+        if (length == MulticastRequestWithIndex) {
+            std::int32_t index;
+            std::memcpy(&index, static_cast<const unsigned char*>(value) + 8, sizeof(index));
+            if (index != 0) throw std::runtime_error("IP_MULTICAST_IF: an interface index is not supported");
+            const auto* addresses = static_cast<const unsigned char*>(value);
+            if (std::any_of(addresses, addresses + 8, [](unsigned char byte) { return byte != 0; }))
+                throw std::runtime_error("IP_MULTICAST_IF: an ip_mreqn with a non-zero address is not supported");
+        } else {
+            std::memcpy(&address, value, sizeof(address));
+        }
+        if (::setsockopt(handle, IPPROTO_IP, IP_MULTICAST_IF, reinterpret_cast<NativeOptionValue>(&address), sizeof(address))) return HostError();
+        std::memcpy(&state.multicastInterface, &address, sizeof(address));
+        return 0;
+    }
+    if (option == GuestIpTimeToLive || option == GuestIpTypeOfService) {
+        if (length < sizeof(int)) return ErrorInvalid;
+        int number;
+        std::memcpy(&number, value, sizeof(number));
+        const int stored = number & 0xff;
+        if (option == GuestIpTypeOfService) {
+            state.ipTypeOfService = stored;
+            return 0;
+        }
+        if (stored != 0 && ::setsockopt(handle, IPPROTO_IP, IP_TTL, reinterpret_cast<NativeOptionValue>(&stored), sizeof(stored))) return HostError();
+        state.ipTimeToLive = stored;
+        return 0;
+    }
+    if (option == GuestIpMulticastTimeToLive || option == GuestIpMulticastLoop) {
+        unsigned int number;
+        if (length == 1) {
+            unsigned char byte;
+            std::memcpy(&byte, value, 1);
+            number = byte;
+        } else {
+            if (length < sizeof(number)) return ErrorInvalid;
+            std::memcpy(&number, value, sizeof(number));
+            if (option == GuestIpMulticastTimeToLive && number > 255) return ErrorInvalid;
+        }
+        const int host = option == GuestIpMulticastLoop ? ((number & 0xff) != 0 ? 1 : 0) : static_cast<int>(number);
+        const int nativeOption = option == GuestIpMulticastLoop ? IP_MULTICAST_LOOP : IP_MULTICAST_TTL;
+        if (::setsockopt(handle, IPPROTO_IP, nativeOption, reinterpret_cast<NativeOptionValue>(&host), sizeof(host))) return HostError();
+        if (option == GuestIpMulticastLoop) state.multicastLoop = host != 0;
+        else state.multicastTimeToLive = host;
+        return 0;
+    }
+    return ErrorNoProtocolOption;
+}
+
+int GetIpLevelOption(SocketOptionState& state, bool ipv4, bool datagram, int option, void* value, std::uint32_t* length) {
+    if (!ipv4) return ErrorInvalid;
+    if (MulticastOption(option) && option != GuestIpAddMembership && option != GuestIpDropMembership && !datagram) return ErrorNotSupported;
+    if (option == GuestIpMulticastInterface) {
+        if (*length == MulticastRequestWithIndex) throw std::runtime_error("IP_MULTICAST_IF: reading an ip_mreqn is not supported");
+        return Copy(value, length, &state.multicastInterface, sizeof(state.multicastInterface));
+    }
+    int number;
+    if (option == GuestIpTimeToLive) number = state.ipTimeToLive;
+    else if (option == GuestIpTypeOfService) number = state.ipTypeOfService;
+    else if (option == GuestIpMulticastTimeToLive) number = state.multicastTimeToLive;
+    else if (option == GuestIpMulticastLoop) number = state.multicastLoop ? 1 : 0;
+    else return ErrorNoProtocolOption;
+    if ((option == GuestIpMulticastTimeToLive || option == GuestIpMulticastLoop) && *length == 1) {
+        const auto byte = static_cast<unsigned char>(number);
+        return Copy(value, length, &byte, 1);
+    }
+    return Copy(value, length, &number, sizeof(number));
+}
+
 int SetIpv6LevelOption(std::uintptr_t native, bool ipv6, int option, const void* value, std::uint32_t length) {
     if (!ipv6) return ErrorInvalid;
     if (option != GuestIpv6Only) return ErrorNoProtocolOption;
     if (length != sizeof(int)) return ErrorInvalid;
-    if (!value) return ErrorInvalid;
     int number;
     std::memcpy(&number, value, sizeof(number));
     const int enabled = number != 0 ? 1 : 0;
diff --git a/core/libs/prx/libkernel/Socket/src/Udp.cpp b/core/libs/prx/libkernel/Socket/src/Udp.cpp
index 3b412c4a5a..d9c657d417 100644
--- a/core/libs/prx/libkernel/Socket/src/Udp.cpp
+++ b/core/libs/prx/libkernel/Socket/src/Udp.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -57,8 +59,6 @@
 #include <string>
 #include <vector>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI dup2_nid_postfix(int from, int to);
 namespace {
 #ifdef _WIN32
 using NativeSocket = SOCKET;
@@ -106,7 +106,9 @@ int ConnectError() {
 }
 int SendError(int type) {
 #ifdef _WIN32
-    if (type == 2 && WSAGetLastError() == WSAENOTCONN) return 39;
+    const int error = WSAGetLastError();
+    if (type == 2 && error == WSAENOTCONN) return 39;
+    if (type == 1 && (error == WSAECONNABORTED || error == WSAECONNRESET)) return 32;
 #else
     static_cast<void>(type);
 #endif
@@ -295,6 +297,15 @@ bool Address(const void* input, std::uint32_t length, sockaddr_storage& native,
     Fail(47);
     return false;
 }
+int LongAddressError(const Socket& socket, const void* address, std::uint32_t length) {
+    if ((socket.family != 2 && socket.family != 28) || length <= (socket.family == 2 ? 16u : 28u)) return 0;
+    constexpr unsigned char mapped[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
+    if (socket.family != 28 || socket.type != 2 || std::memcmp(static_cast<const unsigned char*>(address) + 8, mapped, sizeof(mapped)) != 0) return 22;
+    int ipv6Only = 0;
+    socklen_t size = sizeof(ipv6Only);
+    if (::getsockopt(socket.value, IPPROTO_IPV6, IPV6_V6ONLY, reinterpret_cast<char*>(&ipv6Only), &size)) return NativeError();
+    return ipv6Only ? 22 : 0;
+}
 std::uint16_t& PortOf(sockaddr_storage& address) {
     return address.ss_family == AF_INET ? reinterpret_cast<sockaddr_in&>(address).sin_port : reinterpret_cast<sockaddr_in6&>(address).sin6_port;
 }
@@ -302,15 +313,20 @@ bool Listening(const Socket& socket) {
     bool listening = false;
     return GuestSockets::NativeListening(static_cast<std::uintptr_t>(socket.value), listening) && listening;
 }
-bool ZeroPortConnect(const Socket& socket, const void* address, std::uint32_t length) {
-    if (!address || (socket.type != 1 && socket.type != 2) || (socket.family != 2 && socket.family != 28)) return false;
-    const auto* bytes = static_cast<const unsigned char*>(address);
-    if (length < (socket.family == 2 ? 16u : 28u) || bytes[1] != socket.family || (bytes[2] | bytes[3]) != 0) return false;
+constexpr std::int64_t NotAnswered = -2;
+std::int64_t ZeroPortSend(const Socket& socket, const sockaddr_storage& destination, std::uint64_t length) {
+    if (socket.type != 2 || socket.family != 2 || destination.ss_family != AF_INET) return NotAnswered;
+    const auto& remote = reinterpret_cast<const sockaddr_in&>(destination);
+    if (remote.sin_port != 0) return NotAnswered;
     sockaddr_storage peer{};
     socklen_t peerSize = sizeof(peer);
-    if (::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &peerSize) == 0) return false;
-    Fail(49);
-    return true;
+    if (::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &peerSize) == 0) return NotAnswered;
+    sockaddr_in local{};
+    socklen_t localSize = sizeof(local);
+    const bool bound = ::getsockname(socket.value, reinterpret_cast<sockaddr*>(&local), &localSize) == 0
+        && local.sin_port != 0 && local.sin_addr.s_addr != htonl(INADDR_ANY);
+    if (bound && remote.sin_addr.s_addr != htonl(INADDR_ANY) && remote.sin_addr.s_addr != htonl(INADDR_BROADCAST)) return static_cast<std::int64_t>(length);
+    return Fail(49);
 }
 int Disconnect(const Socket& socket) {
     sockaddr_storage peer{};
@@ -338,6 +354,20 @@ int Disconnect(const Socket& socket) {
     if (::bind(socket.value, reinterpret_cast<sockaddr*>(&wildcard), localSize) != 0) return Fail(NativeError());
     return 0;
 }
+bool ZeroPortConnect(const Socket& socket, const void* address, std::uint32_t length) {
+    if (!address || (socket.type != 1 && socket.type != 2) || (socket.family != 2 && socket.family != 28)) return false;
+    const auto* bytes = static_cast<const unsigned char*>(address);
+    if (length < (socket.family == 2 ? 16u : 28u) || bytes[1] != socket.family || (bytes[2] | bytes[3]) != 0) return false;
+    if (socket.type == 2) {
+        if (Disconnect(socket) != 0) return true;
+    } else {
+        sockaddr_storage peer{};
+        socklen_t peerSize = sizeof(peer);
+        if (::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &peerSize) == 0) return false;
+    }
+    Fail(49);
+    return true;
+}
 void GuestAddress(const sockaddr_storage& native, void* output, std::uint32_t* length) {
     unsigned char bytes[28]{};
     bytes[0] = native.ss_family == AF_INET ? 16 : 28;
@@ -506,11 +536,7 @@ using NativePollDescriptor = WSAPOLLFD;
 #else
 using NativePollDescriptor = pollfd;
 #endif
-struct GuestPollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
+
 struct PollFlag {
     short guest;
     short native;
@@ -538,6 +564,16 @@ constexpr short GuestPollWritable = 0x4;
 constexpr short GuestPollVnodeReady = GuestPollReadable | GuestPollWritable;
 constexpr short GuestPollHangUp = 0x10;
 constexpr short GuestPollError = 0x8;
+#ifdef _WIN32
+short ClosedStreamEvents(int descriptor, short revents, short requested) {
+    if ((revents & (POLLHUP | POLLERR)) != POLLHUP) return revents;
+    const auto socket = Find(descriptor);
+    if (!socket || socket->type != 1) return revents;
+    revents = static_cast<short>(revents | (requested & POLLRDNORM));
+    std::lock_guard lock(socket->modeMutex);
+    return socket->sendShut ? revents : static_cast<short>(revents & ~POLLHUP);
+}
+#endif
 [[noreturn]] void ThrowReadEndWritable(int descriptor) {
     throw std::runtime_error("poll: POLLOUT on the read end of pipe descriptor " + std::to_string(descriptor) + " is not supported");
 }
@@ -676,6 +712,17 @@ int SetNonBlocking(Socket& socket) {
     socket.options.nonblocking = true;
     return 0;
 }
+bool ReadableNow(const Socket& socket) {
+    NativePollDescriptor entry{};
+    entry.fd = socket.value;
+#ifdef _WIN32
+    entry.events = POLLRDNORM;
+    return WSAPoll(&entry, 1, 0) > 0;
+#else
+    entry.events = POLLIN;
+    return ::poll(&entry, 1, 0) > 0;
+#endif
+}
 int ReceiveAnsweredHere(Socket& socket, std::uint64_t length) {
 #ifdef _WIN32
     {
@@ -683,7 +730,8 @@ int ReceiveAnsweredHere(Socket& socket, std::uint64_t length) {
         if (socket.receiveShut) return 0;
     }
 #endif
-    if (length != 0 || socket.type != 1) return -1;
+    if (length != 0) return -1;
+    if (socket.type != 1) return ReadableNow(socket) ? -1 : 0;
     sockaddr_storage peer{};
     socklen_t size = sizeof(peer);
     return ::getpeername(socket.value, reinterpret_cast<sockaddr*>(&peer), &size) == 0 ? 0 : NativeError();
@@ -1086,31 +1134,35 @@ int APS5_VABI _fcntl_nid_postfix(int descriptor, int command, ...) {
 }
 int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option,
                                     const void* value, std::uint32_t length) {
+    if (!value && length != 0) return Fail(14);
     int netError = 0;
     if (!GuestSockets::IsOpen(descriptor) && KernelSetSocketOption_nid_no_patch(descriptor, level, option, value, length, &netError)) {
         return netError == 0 ? 0 : Fail(netError);
     }
     const auto socket = Lookup(descriptor);
     if (!socket) return -1;
-    if (level != 0xffff && level != 6 && level != 41) return Fail(42);
+    if (level != 0xffff && level != 0 && level != 6 && level != 41) return Fail(22);
     std::lock_guard lock(socket->modeMutex);
     const auto native = static_cast<std::uintptr_t>(socket->value);
-    const int error = level == 6    ? GuestSockets::SetTcpLevelOption(native, socket->family != GuestUnix && socket->type == 1, option, value, length)
+    const int error = level == 0    ? GuestSockets::SetIpLevelOption(native, socket->options, socket->family == 2, socket->type == 2, option, value, length)
+                      : level == 6  ? GuestSockets::SetTcpLevelOption(native, socket->options, socket->family != GuestUnix && socket->type == 1, option, value, length)
                       : level == 41 ? GuestSockets::SetIpv6LevelOption(native, socket->family == 28, option, value, length)
-                                    : GuestSockets::SetSocketLevelOption(native, socket->options, option, value, length);
+                                    : GuestSockets::SetSocketLevelOption(native, socket->options, socket->family, socket->type, option, value, length);
     return error == 0 ? 0 : Fail(error);
 }
 int APS5_VABI getsockopt_nid_postfix(int descriptor, int level, int option,
                                     void* value, std::uint32_t* length) {
     const auto socket = Lookup(descriptor);
     if (!socket) return -1;
-    if (level != 0xffff && level != 6 && level != 41) return Fail(42);
+    if (level != 0xffff && level != 0 && level != 6 && level != 41) return Fail(22);
     if (!length) return Fail(22);
+    if (!value) *length = 0;
     std::lock_guard lock(socket->modeMutex);
     const auto native = static_cast<std::uintptr_t>(socket->value);
-    const int error = level == 6    ? GuestSockets::GetTcpLevelOption(native, socket->family != GuestUnix && socket->type == 1, option, value, length)
+    const int error = level == 0    ? GuestSockets::GetIpLevelOption(socket->options, socket->family == 2, socket->type == 2, option, value, length)
+                      : level == 6  ? GuestSockets::GetTcpLevelOption(native, socket->options, socket->family != GuestUnix && socket->type == 1, option, value, length)
                       : level == 41 ? GuestSockets::GetIpv6LevelOption(native, socket->family == 28, option, value, length)
-                                    : GuestSockets::GetSocketLevelOption(native, socket->options, socket->type, option, value, length);
+                                    : GuestSockets::GetSocketLevelOption(native, socket->options, socket->family, socket->type, option, value, length);
     return error == 0 ? 0 : Fail(error);
 }
 int APS5_VABI socket_nid_postfix(int family, int type, int protocol) {
@@ -1208,6 +1260,7 @@ int APS5_VABI connect_nid_postfix(int descriptor, const void* address, std::uint
     if (socket->type == 1) RefuseClosedLoopbackAtOnce_nid_no_patch(socket->value, reinterpret_cast<const sockaddr*>(&native));
 #endif
     if (socket->type == 1 && Listening(*socket)) return Fail(45);
+    if (const int error = LongAddressError(*socket, address, length)) return Fail(error);
     if (ZeroPortConnect(*socket, address, length)) return -1;
     if (native.ss_family != (socket->family == 2 ? AF_INET : AF_INET6)) return Fail(47);
     {
@@ -1242,8 +1295,18 @@ int APS5_VABI accept_nid_postfix(int descriptor, void* address, std::uint32_t* l
             std::lock_guard modeLock(listener->modeMutex);
             inheritNonblocking = listener->options.nonblocking;
             accepted->options.noSignal = listener->options.noSignal;
+            accepted->options.keptFlags = listener->options.keptFlags;
             accepted->options.sendTimeout = listener->options.sendTimeout;
             accepted->options.receiveTimeout = listener->options.receiveTimeout;
+            accepted->options.sendBuffer = listener->options.sendBuffer;
+            accepted->options.receiveBuffer = listener->options.receiveBuffer;
+            accepted->options.sendLowWater = listener->options.sendLowWater;
+            accepted->options.receiveLowWater = listener->options.receiveLowWater;
+            accepted->options.ipTimeToLive = listener->options.ipTimeToLive;
+            accepted->options.ipTypeOfService = listener->options.ipTypeOfService;
+            accepted->options.tcpKeepIdle = listener->options.tcpKeepIdle;
+            accepted->options.tcpKeepInterval = listener->options.tcpKeepInterval;
+            accepted->options.tcpKeepCount = listener->options.tcpKeepCount;
         }
         if (inheritNonblocking && SetNonBlocking(*accepted)) return -1;
         const int acceptedDescriptor = Install(std::move(accepted));
@@ -1288,6 +1351,7 @@ int APS5_VABI bind_nid_postfix(int descriptor, const void* address, std::uint32_
     sockaddr_storage native{};
     socklen_t size;
     if (!Address(address, length, native, size)) return -1;
+    if (const int error = LongAddressError(*socket, address, length)) return Fail(error);
     return ::bind(socket->value, reinterpret_cast<sockaddr*>(&native), size) ? Fail(NativeError()) : 0;
 }
 int APS5_VABI shutdown_nid_postfix(int descriptor, int how) {
@@ -1374,7 +1438,9 @@ std::int64_t APS5_VABI sendto_nid_postfix(int descriptor, const void* buffer, st
         sockaddr_storage native{};
         socklen_t size;
         if (!Address(address, addressLength, native, size)) return -1;
+        if (socket->family == 28 && socket->type == 2 && addressLength > 28) return Fail(22);
         if (native.ss_family != (socket->family == 2 ? AF_INET : AF_INET6)) return Fail(47);
+        if (const auto answered = ZeroPortSend(*socket, native, length); answered != NotAnswered) return answered;
         result = static_cast<int>(::sendto(socket->value, static_cast<const char*>(buffer), static_cast<int>(length), SocketSendFlags(*socket, flags),
             reinterpret_cast<sockaddr*>(&native), size));
     }
@@ -1413,19 +1479,7 @@ std::int64_t APS5_VABI recvfrom_nid_postfix(int descriptor, void* buffer, std::u
     }
     return result;
 }
-struct GuestIovec {
-    void* base;
-    std::uint64_t length;
-};
-struct GuestMsghdr {
-    void* name;
-    std::uint32_t nameLength;
-    GuestIovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
+
 static_assert(sizeof(GuestMsghdr) == 48 && offsetof(GuestMsghdr, iov) == 16 && offsetof(GuestMsghdr, control) == 32 && offsetof(GuestMsghdr, flags) == 44);
 static std::int64_t MessageLength(const GuestMsghdr* message) {
     if (!message) return Fail(14);
@@ -1527,8 +1581,8 @@ std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message,
     GuestMsghdr header{};
     if (!message || !ReadGuest(&header, message, sizeof(header))) return Fail(14);
     if (header.iovLength < 0 || header.iovLength > 1024) return Fail(40);
-    std::vector<GuestIovec> vectors(static_cast<std::size_t>(header.iovLength));
-    if (!ReadGuest(vectors.data(), header.iov, vectors.size() * sizeof(GuestIovec))) return Fail(14);
+    std::vector<KernelIovec> vectors(static_cast<std::size_t>(header.iovLength));
+    if (!ReadGuest(vectors.data(), header.iov, vectors.size() * sizeof(KernelIovec))) return Fail(14);
     header.iov = vectors.data();
     const auto total = MessageLength(&header);
     if (total < 0) return -1;
@@ -1543,22 +1597,26 @@ std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message,
         return Fail(55);
     }
     sockaddr_storage native{};
-    socklen_t size = sizeof(native);
-    if (const int waited = WaitForTransfer(*socket, false, flags)) return Fail(waited);
-    std::int64_t received = ::recvfrom(socket->value, buffer.data(), static_cast<int>(buffer.size()),
-        NativeReceiveFlags(flags, socket->type), reinterpret_cast<sockaddr*>(&native), &size);
-    if (received < 0) {
+    socklen_t size = 0;
+    std::int64_t received = 0;
+    if (total != 0 || socket->type == 1 || ReadableNow(*socket)) {
+        size = sizeof(native);
+        if (const int waited = WaitForTransfer(*socket, false, flags)) return Fail(waited);
+        received = ::recvfrom(socket->value, buffer.data(), static_cast<int>(buffer.size()),
+            NativeReceiveFlags(flags, socket->type), reinterpret_cast<sockaddr*>(&native), &size);
+        if (received < 0) {
 #ifdef _WIN32
-        if (!records || WSAGetLastError() != WSAEMSGSIZE) return Fail(NativeError());
-        received = static_cast<std::int64_t>(buffer.size());
+            if (!records || WSAGetLastError() != WSAEMSGSIZE) return Fail(NativeError());
+            received = static_cast<std::int64_t>(buffer.size());
 #else
-        return Fail(NativeError());
+            return Fail(NativeError());
 #endif
+        }
     }
-    header.flags = 0;
+    header.flags = flags;
     if (received > total) {
         received = total;
-        header.flags = 0x10;
+        header.flags |= 0x10;
     }
     std::size_t offset = 0;
     for (const auto& vector : vectors) {
@@ -1584,15 +1642,10 @@ std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message,
     if (!WriteGuest(reinterpret_cast<char*>(message) + results, reinterpret_cast<const char*>(&header) + results, sizeof(header) - results)) return Fail(14);
     return received;
 }
-struct GuestSendfileHeaders {
-    GuestIovec* headers;
-    int headerCount;
-    GuestIovec* trailers;
-    int trailerCount;
-};
+
 static_assert(sizeof(GuestSendfileHeaders) == 32 && offsetof(GuestSendfileHeaders, trailers) == 16);
-std::int64_t APS5_VABI sceKernelPread(int descriptor, void* buffer, std::size_t length, std::int64_t offset);
-static bool SendfileIovecs(const GuestIovec* iov, int count) {
+
+static bool SendfileIovecs(const KernelIovec* iov, int count) {
     if (!iov) return true;
     if (count < 0 || count > 1024) return false;
     std::uint64_t total = 0;
@@ -1614,7 +1667,7 @@ static int SendAll(const Socket& socket, const void* data, std::uint64_t length,
     }
     return 0;
 }
-static int SendIovecs(const Socket& socket, const GuestIovec* iov, int count, std::int64_t& sent) {
+static int SendIovecs(const Socket& socket, const KernelIovec* iov, int count, std::int64_t& sent) {
     for (int i = 0; iov && i < count; ++i)
         if (const int error = SendAll(socket, iov[i].base, iov[i].length, sent)) return error;
     return 0;
@@ -1645,7 +1698,7 @@ int APS5_VABI sendfile_nid_postfix(int file, int descriptor, std::int64_t offset
     };
     if (received < 0) return finish(received == -21 || received == -29 ? 22 : static_cast<int>(-received));
     const auto socket = Lookup(descriptor);
-    if (!socket) return finish(9);
+    if (!socket) return finish(*__error_nid_postfix());
     if (socket->type != 1) return finish(22);
     sockaddr_storage peer{};
     socklen_t size = sizeof(peer);
@@ -1671,6 +1724,7 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
     std::vector<NativePollDescriptor> native;
     std::vector<std::uint32_t> owners;
     std::vector<std::uint32_t> pipes;
+    std::vector<std::uint32_t> kqueues;
     int ready = 0;
     for (std::uint32_t i = 0; i < count; ++i) {
         auto& entry = descriptors[i];
@@ -1689,6 +1743,10 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
                 ++ready;
                 continue;
             }
+            if (IsKqueueDescriptor(entry.descriptor)) {
+                kqueues.push_back(i);
+                continue;
+            }
             if (File::IsRandomDevice(entry.descriptor)) {
                 const short readable = static_cast<short>(entry.events & GuestPollReadable);
                 entry.revents = readable != 0 ? readable : entry.events;
@@ -1711,7 +1769,7 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
 #else
             if (!IsPipe(entry.descriptor, entry.events))
 #endif
-                throw std::runtime_error("poll: descriptor " + std::to_string(entry.descriptor) + " is neither a socket, a pipe, a file nor a directory");
+                throw std::runtime_error("poll: descriptor " + std::to_string(entry.descriptor) + " is neither a socket, a pipe, a file, a directory nor a kqueue");
             pipes.push_back(i);
             continue;
         }
@@ -1734,7 +1792,7 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         owners.push_back(index);
     }
 #endif
-    if (native.empty() && pipes.empty()) {
+    if (native.empty() && pipes.empty() && kqueues.empty()) {
         if (ready || timeout == 0) return ready;
         if (timeout < 0) throw std::runtime_error("poll: an infinite wait without sockets or pipes never returns");
         PreciseSleepUs(static_cast<unsigned long long>(timeout) * 1000);
@@ -1742,6 +1800,9 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
     }
     const auto collect = [&](std::size_t i, bool pipe) {
         auto& entry = descriptors[owners[i]];
+#ifdef _WIN32
+        if (!pipe) native[i].revents = ClosedStreamEvents(entry.descriptor, native[i].revents, native[i].events);
+#endif
         for (const auto& flag : RequestFlags)
             if ((entry.events & flag.guest) && (native[i].revents & flag.native))
                 entry.revents = static_cast<short>(entry.revents | flag.guest);
@@ -1752,18 +1813,35 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
             entry.revents = static_cast<short>((entry.revents & ~GuestPollWritable) | (entry.events & GuestPollReadable));
         if (entry.revents) ++ready;
     };
-#ifdef _WIN32
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(timeout < 0 ? 0 : timeout);
+#ifdef _WIN32
+    const bool sliced = !pipes.empty() || !kqueues.empty();
+#else
+    const bool sliced = !kqueues.empty();
+#endif
     for (;;) {
-        int pipeReady = 0;
+        int checkedReady = 0;
+#ifdef _WIN32
         for (const auto index : pipes) {
             auto& entry = descriptors[index];
             PipeReadiness(entry.descriptor, entry.events, entry.revents);
-            if (entry.revents) ++pipeReady;
+            if (entry.revents) ++checkedReady;
+        }
+#endif
+        for (const auto index : kqueues) {
+            auto& entry = descriptors[index];
+            const auto readable = KqueueReadable(entry.descriptor);
+            if (!readable && DescriptorIsOpen_nid_no_patch(entry.descriptor)) {
+                if (timeout < 0) return poll_nid_postfix(descriptors, count, -1);
+                const auto left = std::chrono::duration_cast<std::chrono::microseconds>(deadline - std::chrono::steady_clock::now()).count();
+                return poll_nid_postfix(descriptors, count, static_cast<int>(std::max<long long>(0, (left + 999) / 1000)));
+            }
+            entry.revents = !readable ? GuestPollInvalid : *readable ? static_cast<short>(entry.events & GuestPollReadable) : short{0};
+            if (entry.revents) ++checkedReady;
         }
         int slice = 0;
-        if (!ready && !pipeReady) {
-            if (pipes.empty()) slice = timeout;
+        if (!ready && !checkedReady) {
+            if (!sliced) slice = timeout;
             else if (timeout < 0) slice = 1;
             else {
                 const auto left = std::chrono::duration_cast<std::chrono::milliseconds>(deadline - std::chrono::steady_clock::now()).count();
@@ -1772,8 +1850,12 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         }
         if (!native.empty()) {
             for (auto& request : native) request.revents = 0;
+#ifdef _WIN32
             if (WSAPoll(native.data(), static_cast<ULONG>(native.size()), slice) < 0) return Fail(NativeError());
-        } else if (!ready && !pipeReady) {
+#else
+            if (::poll(native.data(), static_cast<nfds_t>(native.size()), slice) < 0) return Fail(NativeError());
+#endif
+        } else if (!ready && !checkedReady) {
             const auto wake = std::chrono::steady_clock::now() + std::chrono::milliseconds(1);
             PreciseSleepUntil(timeout < 0 ? wake : std::min(deadline, wake));
         }
@@ -1781,19 +1863,16 @@ int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t c
         for (const auto& request : native)
             if (request.revents) ++socketReady;
         const bool expired = timeout >= 0 && std::chrono::steady_clock::now() >= deadline;
-        if (ready || pipeReady || socketReady || expired || pipes.empty()) {
-            ready += pipeReady;
+        if (ready || checkedReady || socketReady || expired || !sliced) {
+            ready += checkedReady;
+#ifdef _WIN32
             for (std::size_t i = 0; i < native.size(); ++i) collect(i, false);
+#else
+            for (std::size_t i = 0; i < native.size(); ++i) collect(i, i >= socketCount);
+#endif
             return ready;
         }
     }
-#else
-    const int wait = ready ? 0 : timeout;
-    const int result = ::poll(native.data(), static_cast<nfds_t>(native.size()), wait);
-    if (result < 0) return Fail(NativeError());
-    for (std::size_t i = 0; i < native.size(); ++i) collect(i, i >= socketCount);
-    return ready;
-#endif
 }
 }
 
@@ -1852,3 +1931,44 @@ std::int64_t GuestSockets::Writev(int descriptor, const Iovec* iov, int iovcnt)
     }
     return Write(descriptor, buffer.data(), total);
 }
+
+extern "C" {
+int APS5_VABI _setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length) {
+    return setsockopt_nid_postfix(descriptor, level, option, value, length);
+}
+int APS5_VABI _getsockopt_nid_postfix(int descriptor, int level, int option, void* value, std::uint32_t* length) {
+    return getsockopt_nid_postfix(descriptor, level, option, value, length);
+}
+int APS5_VABI _connect_nid_postfix(int descriptor, const void* address, std::uint32_t length) {
+    return connect_nid_postfix(descriptor, address, length);
+}
+int APS5_VABI _listen_nid_postfix(int descriptor, int backlog) {
+    return listen_nid_postfix(descriptor, backlog);
+}
+int APS5_VABI _accept_nid_postfix(int descriptor, void* address, std::uint32_t* length) {
+    return accept_nid_postfix(descriptor, address, length);
+}
+int APS5_VABI _bind_nid_postfix(int descriptor, const void* address, std::uint32_t length) {
+    return bind_nid_postfix(descriptor, address, length);
+}
+int APS5_VABI _getsockname_nid_postfix(int descriptor, void* address, std::uint32_t* length) {
+    return getsockname_nid_postfix(descriptor, address, length);
+}
+int APS5_VABI _getpeername_nid_postfix(int descriptor, void* address, std::uint32_t* length) {
+    return getpeername_nid_postfix(descriptor, address, length);
+}
+std::int64_t APS5_VABI _sendto_nid_postfix(int descriptor, const void* buffer, std::uint64_t length,
+    int flags, const void* address, std::uint32_t addressLength) {
+    return sendto_nid_postfix(descriptor, buffer, length, flags, address, addressLength);
+}
+std::int64_t APS5_VABI _recvfrom_nid_postfix(int descriptor, void* buffer, std::uint64_t length,
+    int flags, void* address, std::uint32_t* addressLength) {
+    return recvfrom_nid_postfix(descriptor, buffer, length, flags, address, addressLength);
+}
+std::int64_t APS5_VABI _sendmsg_nid_postfix(int descriptor, const GuestMsghdr* message, int flags) {
+    return sendmsg_nid_postfix(descriptor, message, flags);
+}
+std::int64_t APS5_VABI _recvmsg_nid_postfix(int descriptor, GuestMsghdr* message, int flags) {
+    return recvmsg_nid_postfix(descriptor, message, flags);
+}
+}
diff --git a/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp b/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp
index 98da8ea9e9..a83f3e3c2d 100644
--- a/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp
+++ b/core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <array>
 #include <atomic>
 #include <chrono>
@@ -16,8 +18,6 @@
 #include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 constexpr int SYNC_ON_ADDRESS_OK = 0;
@@ -56,7 +56,7 @@ struct UserSemaphore {
 };
 
 struct AddressWaiter {
-    TimedWait::Condition condition;
+    TimedWait::SingleWaiterCondition condition;
     bool woken = false;
 };
 
@@ -81,15 +81,11 @@ bool IsAlignedAddress(std::uintptr_t address) {
 
 template <class TFunction>
 void DeferringDelivery(TFunction function) {
-#ifdef _WIN32
     {
         TimedWait::DeliveryDeferral deferral;
         function();
     }
     TimedWait::DeliverDeferred();
-#else
-    function();
-#endif
 }
 
 template <class TReady>
@@ -205,6 +201,7 @@ int UmtxDeadline(const void* sizeArgument, const void* timeArgument, std::option
     } else {
         KernelTimespec now{};
         clock_gettime_nid_postfix(static_cast<int>(time.clockId), &now);
+
         remaining = SaturatingNanos(time.timeout.tv_sec - now.tv_sec, time.timeout.tv_nsec - now.tv_nsec);
     }
     if (remaining < UNBOUNDED_WAIT_NANOS) {
diff --git a/core/libs/prx/libkernel/System/src/Coredump.cpp b/core/libs/prx/libkernel/System/src/Coredump.cpp
index f618d1e2ea..7f041e1b61 100644
--- a/core/libs/prx/libkernel/System/src/Coredump.cpp
+++ b/core/libs/prx/libkernel/System/src/Coredump.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <atomic>
@@ -48,7 +49,6 @@ int APS5_VABI sceKernelDebugWriteCppExceptionInfo(const void* exception, uint64_
     return 0;
 }
 
-
 int APS5_VABI sceCoredumpAttachUserFile(std::uint32_t userValue, const char* path) {
     if (!path || !validUserFileFlags(userValue)) return SCE_COREDUMP_ERROR_INVALID_ARGUMENT;
     if (static_cast<std::int32_t>(std::strlen(path)) < 0) return 0;
@@ -68,7 +68,7 @@ int APS5_VABI sceCoredumpAttachMemoryRegionAsUserFile(std::uint32_t userValue, c
 }
 
 int APS5_VABI sceCoredumpSetUserDataType(std::int32_t type) {
-    NotImplemented_nid_no_patch("Uxqkdta7wEg");
+    (void)type;
     return 0;
 }
 
diff --git a/core/libs/prx/libkernel/System/src/Error.cpp b/core/libs/prx/libkernel/System/src/Error.cpp
index a0eb19f9b6..5b3452fd77 100644
--- a/core/libs/prx/libkernel/System/src/Error.cpp
+++ b/core/libs/prx/libkernel/System/src/Error.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cstdint>
diff --git a/core/libs/prx/libkernel/System/src/Exception.cpp b/core/libs/prx/libkernel/System/src/Exception.cpp
index e3a768008f..8882083584 100644
--- a/core/libs/prx/libkernel/System/src/Exception.cpp
+++ b/core/libs/prx/libkernel/System/src/Exception.cpp
@@ -1,9 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
+#include "prx/libkernel/Time/include/TimedWait.hpp"
 #include <vector>
 #include <algorithm>
 #include <array>
@@ -26,7 +28,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" Pthread APS5_VABI scePthreadSelf();
 #ifdef _WIN32
 extern "C" void Aps5RedirectedEntryStub();
 extern "C" [[noreturn]] void Aps5RedirectedExit(CONTEXT* context, const void* vectors, void (*restore)(CONTEXT*, EXCEPTION_RECORD*));
@@ -193,6 +194,7 @@ constexpr std::size_t RedZone = 128;
 constexpr std::size_t HomeArea = 32;
 constexpr auto RetryLimit = std::chrono::seconds(1);
 constexpr auto HostCodeLimit = std::chrono::milliseconds(50);
+constexpr auto HostCodeResample = std::chrono::microseconds(20);
 constexpr std::size_t VectorBytes = 16 * 32;
 
 struct Delivery {
@@ -449,7 +451,12 @@ bool RaiseOn(Pthread thread, GuestExceptionHandler handler, int signum) {
             continue;
         }
         if (restoring && std::chrono::steady_clock::now() >= retryDeadline) throw std::runtime_error("sceKernelRaiseException: the target thread stayed inside NtContinue or winpthreads for 1 s");
-        SwitchToThread();
+        if (running == CodeKind::Host) {
+            const auto resample = std::chrono::steady_clock::now() + HostCodeResample;
+            while (std::chrono::steady_clock::now() < resample) YieldProcessor();
+        } else {
+            SwitchToThread();
+        }
     }
     const DWORD64 slot = (delivery.context.Rsp - RedZone - sizeof(Delivery)) & ~static_cast<DWORD64>(15);
     if (!StackWritable(slot - HomeArea - 8, delivery.context.Rsp - RedZone)) {
@@ -521,7 +528,8 @@ void ToHost(const GuestMcontext& m, mcontext_t& host) {
     if (host.fpregs != nullptr) std::memcpy(host.fpregs, m.fpstate, FxsaveRegisterBytes);
 }
 
-void Deliver(int, siginfo_t*, void* context) {
+void Deliver(int signum, siginfo_t*, void* context) {
+    if (TimedWait::DeferDelivery(signum)) return;
     const auto handler = Handler(RaisedSignal);
     if (handler == nullptr) {
         static constexpr char message[] = "sceKernelRaiseException: the handler was removed before the signal was delivered\n";
diff --git a/core/libs/prx/libkernel/System/src/Login.cpp b/core/libs/prx/libkernel/System/src/Login.cpp
index 80f9eaabc9..e188559977 100644
--- a/core/libs/prx/libkernel/System/src/Login.cpp
+++ b/core/libs/prx/libkernel/System/src/Login.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cerrno>
diff --git a/core/libs/prx/libkernel/System/src/Notification.cpp b/core/libs/prx/libkernel/System/src/Notification.cpp
index 9d94d2b291..df976eac7f 100644
--- a/core/libs/prx/libkernel/System/src/Notification.cpp
+++ b/core/libs/prx/libkernel/System/src/Notification.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include <string>
diff --git a/core/libs/prx/libkernel/System/src/Process.cpp b/core/libs/prx/libkernel/System/src/Process.cpp
index 348464a177..6532933db3 100644
--- a/core/libs/prx/libkernel/System/src/Process.cpp
+++ b/core/libs/prx/libkernel/System/src/Process.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #ifndef NOMINMAX
 #define NOMINMAX
@@ -8,6 +10,12 @@
 #else
 #include <sched.h>
 #include <unistd.h>
+#ifdef __linux__
+#include <sys/uio.h>
+#elif defined(__APPLE__)
+#include <mach/mach.h>
+#include <mach/mach_vm.h>
+#endif
 #endif
 #if defined(__linux__) && defined(__x86_64__)
 #include <asm/prctl.h>
@@ -18,6 +26,7 @@
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/HostEntropy.hpp"
+#include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libkernel/AppMetadata/include/AppMetadata.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
@@ -44,12 +53,10 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
-
 namespace {
 
 constexpr int sceInvalidArgument = static_cast<int>(0x80020016u);
+constexpr int errnoOperationNotPermitted = 1;
 constexpr int errnoNoSuchProcess = 3;
 constexpr int errnoNoChild = 10;
 constexpr int errnoBadAddress = 14;
@@ -59,6 +66,86 @@ std::mutex supplementaryGroupsMutex;
 std::vector<std::uint32_t> supplementaryGroups{0};
 constexpr unsigned freebsdWaitOptions = 0x8000003Fu;
 
+bool StoreGuestId(std::uint32_t* output) {
+    if (output == nullptr) return true;
+    const auto address = reinterpret_cast<std::uintptr_t>(output);
+    if (address > std::numeric_limits<std::uintptr_t>::max() - sizeof(*output)) return false;
+    const auto end = address + sizeof(*output);
+    for (auto cursor = address; cursor < end;) {
+        VirtualQueryInfo info{};
+        if (sceKernelVirtualQuery(reinterpret_cast<const void*>(cursor), 0, &info, sizeof(info)) != 0 ||
+            info.end <= cursor || (info.protection & 2) == 0)
+            return false;
+        cursor = std::min(end, info.end);
+    }
+    const GuestArena::HostWrite guard(output, sizeof(*output));
+    if (!guard.Open()) return false;
+    constexpr std::uint32_t zero = 0;
+#ifdef _WIN32
+    SIZE_T written = 0;
+    return WriteProcessMemory(GetCurrentProcess(), output, &zero, sizeof(zero), &written) != 0 && written == sizeof(zero);
+#elif defined(__linux__)
+    iovec local{const_cast<std::uint32_t*>(&zero), sizeof(zero)};
+    iovec remote{output, sizeof(zero)};
+    return ::process_vm_writev(::getpid(), &local, 1, &remote, 1, 0) == static_cast<ssize_t>(sizeof(zero));
+#elif defined(__APPLE__)
+    return ::mach_vm_write(::mach_task_self(), reinterpret_cast<mach_vm_address_t>(output),
+        reinterpret_cast<vm_offset_t>(const_cast<std::uint32_t*>(&zero)), sizeof(zero)) == KERN_SUCCESS;
+#else
+    *output = zero;
+    return true;
+#endif
+}
+
+bool GuestRange(const void* pointer, std::size_t bytes) {
+    const auto start = reinterpret_cast<std::uintptr_t>(pointer);
+    return start != 0 && bytes <= std::numeric_limits<std::uintptr_t>::max() - start;
+}
+
+bool ReadGuest(void* destination, const void* source, std::size_t bytes) {
+    if (bytes == 0) return true;
+    if (!GuestRange(source, bytes)) return false;
+    GuestArena::GuestArenaPrepareHostRead_nid_no_patch(source, bytes);
+#ifdef _WIN32
+    SIZE_T copied = 0;
+    return ReadProcessMemory(GetCurrentProcess(), source, destination, bytes, &copied) != 0 && copied == bytes;
+#elif defined(__linux__)
+    iovec local{destination, bytes};
+    iovec remote{const_cast<void*>(source), bytes};
+    const auto copied = ::process_vm_readv(::getpid(), &local, 1, &remote, 1, 0);
+    if (copied < 0 && errno != EFAULT) throw std::runtime_error("credentials: process_vm_readv failed with errno " + std::to_string(errno));
+    return copied >= 0 && static_cast<std::size_t>(copied) == bytes;
+#elif defined(__APPLE__)
+    mach_vm_size_t copied = 0;
+    return ::mach_vm_read_overwrite(::mach_task_self(), reinterpret_cast<mach_vm_address_t>(source), bytes,
+        reinterpret_cast<mach_vm_address_t>(destination), &copied) == KERN_SUCCESS && copied == bytes;
+#else
+    throw std::runtime_error("credentials: checked guest reads are not implemented on this host");
+#endif
+}
+
+bool WriteGuest(void* destination, const void* source, std::size_t bytes) {
+    if (bytes == 0) return true;
+    if (!GuestRange(destination, bytes)) return false;
+    const GuestArena::HostWrite guard(destination, bytes);
+    if (!guard.Open()) return false;
+#ifdef _WIN32
+    SIZE_T copied = 0;
+    return WriteProcessMemory(GetCurrentProcess(), destination, source, bytes, &copied) != 0 && copied == bytes;
+#elif defined(__linux__)
+    iovec local{const_cast<void*>(source), bytes};
+    iovec remote{destination, bytes};
+    const auto copied = ::process_vm_writev(::getpid(), &local, 1, &remote, 1, 0);
+    if (copied < 0 && errno != EFAULT) throw std::runtime_error("credentials: process_vm_writev failed with errno " + std::to_string(errno));
+    return copied >= 0 && static_cast<std::size_t>(copied) == bytes;
+#elif defined(__APPLE__)
+    return ::mach_vm_write(::mach_task_self(), reinterpret_cast<mach_vm_address_t>(destination),
+        reinterpret_cast<vm_offset_t>(source), static_cast<mach_msg_type_number_t>(bytes)) == KERN_SUCCESS;
+#else
+    throw std::runtime_error("credentials: checked guest writes are not implemented on this host");
+#endif
+}
+
 std::atomic<std::uint32_t> gpoBits{0};
 constexpr std::array<std::uint8_t, 16> openPsId{'A', 'n', 'y', 'P', 'S', '5', 'O', 'p', 'e', 'n', 'P', 's', 'I', 'd', 0, 1};
 
@@ -158,6 +245,7 @@ constexpr int guestRlimitCount = 15;
 constexpr std::int64_t guestRlimitInfinity = std::numeric_limits<std::int64_t>::max();
 constexpr std::int64_t guestStackLimit = 0x200000;
 constexpr std::int64_t guestProcessLimit = 1604;
+constexpr std::int64_t guestProcessLimitPerUser = 1443;
 
 #ifdef _WIN32
 std::int64_t hostMemoryLimit() {
@@ -183,39 +271,13 @@ std::int64_t toGuestLimit(rlim_t value) {
 
 }
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
-struct GuestResourceLimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-
 namespace {
 std::mutex openFileLimitMutex;
 std::optional<GuestResourceLimit> guestOpenFileLimit;
+std::mutex processLimitMutex;
+GuestResourceLimit guestProcessResourceLimit{guestProcessLimit, guestProcessLimit};
 }
 
-struct GuestResourceUsage {
-    KernelTimeval ru_utime;
-    KernelTimeval ru_stime;
-    std::int64_t ru_maxrss;
-    std::int64_t ru_ixrss;
-    std::int64_t ru_idrss;
-    std::int64_t ru_isrss;
-    std::int64_t ru_minflt;
-    std::int64_t ru_majflt;
-    std::int64_t ru_nswap;
-    std::int64_t ru_inblock;
-    std::int64_t ru_oublock;
-    std::int64_t ru_msgsnd;
-    std::int64_t ru_msgrcv;
-    std::int64_t ru_nsignals;
-    std::int64_t ru_nvcsw;
-    std::int64_t ru_nivcsw;
-};
-
-extern "C" Pthread APS5_VABI scePthreadSelf();
-
 extern "C" {
 
 // unknown data
@@ -253,6 +315,24 @@ int APS5_VABI getsid_nid_postfix(int pid) {
     return -1;
 }
 
+int APS5_VABI setpgid_nid_postfix(int pid, int pgid) {
+    if (pgid < 0) {
+        *__error_nid_postfix() = errnoInvalidArgument;
+        return -1;
+    }
+    const int self = getpid_nid_postfix();
+    if (pid != 0 && pid != self) {
+        *__error_nid_postfix() = errnoNoSuchProcess;
+        return -1;
+    }
+    *__error_nid_postfix() = errnoOperationNotPermitted;
+    return -1;
+}
+
+int APS5_VABI setpgrp_nid_postfix(int pid, int pgrp) {
+    return setpgid_nid_postfix(pid, pgrp);
+}
+
 int APS5_VABI getppid_nid_postfix(void) {
 #ifdef _WIN32
     const DWORD self = GetCurrentProcessId();
@@ -314,6 +394,22 @@ int APS5_VABI issetugid_nid_postfix(void) {
     return 0;
 }
 
+int APS5_VABI getresuid_nid_postfix(std::uint32_t* ruid, std::uint32_t* euid, std::uint32_t* suid) {
+    if (!StoreGuestId(ruid) || !StoreGuestId(euid) || !StoreGuestId(suid)) {
+        *__error_nid_postfix() = errnoBadAddress;
+        return -1;
+    }
+    return 0;
+}
+
+int APS5_VABI getresgid_nid_postfix(std::uint32_t* rgid, std::uint32_t* egid, std::uint32_t* sgid) {
+    if (!StoreGuestId(rgid) || !StoreGuestId(egid) || !StoreGuestId(sgid)) {
+        *__error_nid_postfix() = errnoBadAddress;
+        return -1;
+    }
+    return 0;
+}
+
 void APS5_VABI exit_nid_postfix(int code) {
     LibcExit_nid_no_patch(code);
 }
@@ -334,8 +430,6 @@ int APS5_VABI waitpid_nid_postfix(int pid, int* status, int options) {
     return -1;
 }
 
-int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit);
-
 int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limit) {
     if (limit == nullptr) {
         *__error_nid_postfix() = guestFault;
@@ -356,6 +450,7 @@ int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limi
 
     GuestResourceLimit current{};
     getrlimit_nid_postfix(resource, &current);
+
     if (resource == guestRlimitNofile) {
         if (requested.rlim_max <= current.rlim_max && requested.rlim_cur <= requested.rlim_max) {
             std::lock_guard lock(openFileLimitMutex);
@@ -363,8 +458,13 @@ int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limi
             return 0;
         }
     }
-    if (resource == guestRlimitNproc)
-        throw std::runtime_error("setrlimit: RLIMIT_NPROC is not stored");
+    if (resource == guestRlimitNproc) {
+        requested.rlim_cur = std::clamp(requested.rlim_cur, std::int64_t{1}, guestProcessLimitPerUser);
+        requested.rlim_max = std::clamp(requested.rlim_max, std::int64_t{1}, guestProcessLimitPerUser);
+        std::lock_guard lock(processLimitMutex);
+        guestProcessResourceLimit = requested;
+        return 0;
+    }
     if (requested.rlim_cur != current.rlim_cur || requested.rlim_max != current.rlim_max)
         throw std::runtime_error("setrlimit: changing the limit of resource " + std::to_string(resource) + " is not supported");
     return 0;
@@ -469,6 +569,7 @@ void APS5_VABI sceKernelSync(void) {
 
 void APS5_VABI sync_nid_postfix(void) {
     sceKernelSync();
+
 }
 
 int APS5_VABI sched_get_priority_max_nid_postfix(int policy) {
@@ -617,20 +718,21 @@ int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit) {
         *__error_nid_postfix() = guestFault;
         return -1;
     }
+    GuestResourceLimit result{};
     switch (resource) {
     case guestRlimitData: {
 #ifdef _WIN32
         const std::int64_t memory = hostMemoryLimit();
-        limit->rlim_cur = memory;
-        limit->rlim_max = memory;
+        result.rlim_cur = memory;
+        result.rlim_max = memory;
 #else
         rlimit native{};
         if (::getrlimit(RLIMIT_DATA, &native) != 0)
             throw std::system_error(errno, std::generic_category(), "getrlimit: getrlimit failed");
-        limit->rlim_cur = toGuestLimit(native.rlim_cur);
-        limit->rlim_max = toGuestLimit(native.rlim_max);
+        result.rlim_cur = toGuestLimit(native.rlim_cur);
+        result.rlim_max = toGuestLimit(native.rlim_max);
 #endif
-        return 0;
+        break;
     }
     case guestRlimitNofile: {
         std::lock_guard lock(openFileLimitMutex);
@@ -645,17 +747,18 @@ int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit) {
             guestOpenFileLimit = GuestResourceLimit{toGuestLimit(native.rlim_cur), toGuestLimit(native.rlim_max)};
 #endif
         }
-        *limit = *guestOpenFileLimit;
-        return 0;
+        result = *guestOpenFileLimit;
+        break;
     }
     case guestRlimitStack:
-        limit->rlim_cur = guestStackLimit;
-        limit->rlim_max = guestStackLimit;
-        return 0;
-    case guestRlimitNproc:
-        limit->rlim_cur = guestProcessLimit;
-        limit->rlim_max = guestProcessLimit;
-        return 0;
+        result.rlim_cur = guestStackLimit;
+        result.rlim_max = guestStackLimit;
+        break;
+    case guestRlimitNproc: {
+        std::lock_guard lock(processLimitMutex);
+        result = guestProcessResourceLimit;
+        break;
+    }
     case guestRlimitCpu:
     case guestRlimitFsize:
     case guestRlimitCore:
@@ -667,12 +770,17 @@ int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit) {
     case guestRlimitSwap:
     case guestRlimitKqueues:
     case guestRlimitUmtxp:
-        limit->rlim_cur = guestRlimitInfinity;
-        limit->rlim_max = guestRlimitInfinity;
-        return 0;
+        result.rlim_cur = guestRlimitInfinity;
+        result.rlim_max = guestRlimitInfinity;
+        break;
     default:
         throw std::runtime_error("getrlimit: unsupported resource " + std::to_string(resource));
     }
+    if (!WriteGuest(limit, &result, sizeof(result))) {
+        *__error_nid_postfix() = guestFault;
+        return -1;
+    }
+    return 0;
 }
 
 int APS5_VABI getpriority_nid_postfix(int which, int who) {
@@ -708,6 +816,7 @@ int APS5_VABI setpriority_nid_postfix(int which, int who, int niceval) {
 int APS5_VABI getdtablesize_nid_postfix(void) {
     GuestResourceLimit limit{};
     getrlimit_nid_postfix(guestRlimitNofile, &limit);
+
     std::int64_t tableSize = limit.rlim_cur;
 #ifndef _WIN32
     tableSize = std::min(tableSize, static_cast<std::int64_t>(::getdtablesize()));
@@ -770,6 +879,28 @@ int APS5_VABI setregid_nid_postfix(std::uint32_t rgid, std::uint32_t egid) {
     return 0;
 }
 
+int APS5_VABI setresuid_nid_postfix(std::uint32_t ruid, std::uint32_t euid, std::uint32_t suid) {
+    constexpr std::uint32_t unchanged = 0xffffffffu;
+    if (ruid != 0 && ruid != unchanged)
+        throw std::runtime_error("setresuid: unsupported real user id " + std::to_string(ruid));
+    if (euid != 0 && euid != unchanged)
+        throw std::runtime_error("setresuid: unsupported effective user id " + std::to_string(euid));
+    if (suid != 0 && suid != unchanged)
+        throw std::runtime_error("setresuid: unsupported saved user id " + std::to_string(suid));
+    return 0;
+}
+
+int APS5_VABI setresgid_nid_postfix(std::uint32_t rgid, std::uint32_t egid, std::uint32_t sgid) {
+    constexpr std::uint32_t unchanged = 0xffffffffu;
+    if (rgid != 0 && rgid != unchanged)
+        throw std::runtime_error("setresgid: unsupported real group id " + std::to_string(rgid));
+    if (egid != 0 && egid != unchanged)
+        throw std::runtime_error("setresgid: unsupported effective group id " + std::to_string(egid));
+    if (sgid != 0 && sgid != unchanged)
+        throw std::runtime_error("setresgid: unsupported saved group id " + std::to_string(sgid));
+    return 0;
+}
+
 int APS5_VABI setgroups_nid_postfix(int count, const std::uint32_t* groups) {
     if (count < 0 || count > freebsdGroupsMax) {
         *__error_nid_postfix() = errnoInvalidArgument;
@@ -779,14 +910,22 @@ int APS5_VABI setgroups_nid_postfix(int count, const std::uint32_t* groups) {
         *__error_nid_postfix() = errnoBadAddress;
         return -1;
     }
-    if (count > 0 && groups[0] != 0)
-        throw std::runtime_error("setgroups: unsupported effective group id " + std::to_string(groups[0]));
+    std::vector<std::uint32_t> requested;
+    if (count > 0) {
+        requested.resize(static_cast<std::size_t>(count));
+        if (!ReadGuest(requested.data(), groups, requested.size() * sizeof(requested[0]))) {
+            *__error_nid_postfix() = errnoBadAddress;
+            return -1;
+        }
+    }
+    if (count > 0 && requested[0] != 0)
+        throw std::runtime_error("setgroups: unsupported effective group id " + std::to_string(requested[0]));
     std::lock_guard lock(supplementaryGroupsMutex);
     if (count == 0) {
         supplementaryGroups.resize(1);
         return 0;
     }
-    supplementaryGroups.assign(groups, groups + count);
+    supplementaryGroups.swap(requested);
     return 0;
 }
 
@@ -802,7 +941,10 @@ int APS5_VABI getgroups_nid_postfix(int capacity, std::uint32_t* groups) {
         *__error_nid_postfix() = errnoBadAddress;
         return -1;
     }
-    std::copy(supplementaryGroups.begin(), supplementaryGroups.end(), groups);
+    if (!WriteGuest(groups, supplementaryGroups.data(), supplementaryGroups.size() * sizeof(supplementaryGroups[0]))) {
+        *__error_nid_postfix() = errnoBadAddress;
+        return -1;
+    }
     return count;
 }
 
diff --git a/core/libs/prx/libkernel/System/src/Rtld.cpp b/core/libs/prx/libkernel/System/src/Rtld.cpp
index 90472da544..5d424ba846 100644
--- a/core/libs/prx/libkernel/System/src/Rtld.cpp
+++ b/core/libs/prx/libkernel/System/src/Rtld.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include <array>
diff --git a/core/libs/prx/libkernel/System/src/Sandbox.cpp b/core/libs/prx/libkernel/System/src/Sandbox.cpp
index dd3918c68a..e904dc5942 100644
--- a/core/libs/prx/libkernel/System/src/Sandbox.cpp
+++ b/core/libs/prx/libkernel/System/src/Sandbox.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 extern "C" const char* APS5_VABI sceKernelGetFsSandboxRandomWord() {
diff --git a/core/libs/prx/libkernel/System/src/Sanitizer.cpp b/core/libs/prx/libkernel/System/src/Sanitizer.cpp
index 0586eef7d7..15ff3e040f 100644
--- a/core/libs/prx/libkernel/System/src/Sanitizer.cpp
+++ b/core/libs/prx/libkernel/System/src/Sanitizer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 
 extern "C" {
diff --git a/core/libs/prx/libkernel/System/src/SignalSets.cpp b/core/libs/prx/libkernel/System/src/SignalSets.cpp
index 688ad49ce8..8444422f5d 100644
--- a/core/libs/prx/libkernel/System/src/SignalSets.cpp
+++ b/core/libs/prx/libkernel/System/src/SignalSets.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -5,11 +7,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
 static_assert(sizeof(GuestSignalSet) == 16);
 
 namespace {
diff --git a/core/libs/prx/libkernel/System/src/Signals.cpp b/core/libs/prx/libkernel/System/src/Signals.cpp
index 773a688b23..cc99d90231 100644
--- a/core/libs/prx/libkernel/System/src/Signals.cpp
+++ b/core/libs/prx/libkernel/System/src/Signals.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/Pthread/Posix/Common.hpp"
@@ -17,23 +19,12 @@
 #include <string>
 #include <thread>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getpid_nid_postfix(void);
-extern "C" Pthread APS5_VABI scePthreadSelf(void);
-
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-
-struct GuestSigaction {
-    std::uintptr_t handler;
-    int flags;
-    GuestSignalSet mask;
-};
 static_assert(sizeof(GuestSigaction) == 32 && offsetof(GuestSigaction, flags) == 8 && offsetof(GuestSigaction, mask) == 12);
 
+extern "C" GuestSignalSet _sigintr_nid_postfix{};
+
 namespace {
-using GuestHandler = void (APS5_VABI *)(int);
+
 constexpr int MaxSignal = 128;
 constexpr int GuestSigkill = 9;
 constexpr int GuestSigstop = 17;
@@ -73,11 +64,8 @@ struct GuestSiginfo {
 static_assert(sizeof(GuestSiginfo) == 80 && offsetof(GuestSiginfo, code) == 8 && offsetof(GuestSiginfo, pid) == 12 &&
     offsetof(GuestSiginfo, uid) == 16 && offsetof(GuestSiginfo, address) == 24 && offsetof(GuestSiginfo, value) == 32 &&
     offsetof(GuestSiginfo, band) == 40);
-struct GuestTimespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
-static_assert(sizeof(GuestTimespec) == 16 && offsetof(GuestTimespec, nanoseconds) == 8);
+
+static_assert(sizeof(KernelTimespec) == 16 && offsetof(KernelTimespec, tv_nsec) == 8);
 bool IgnoredByDefault(int guest) {
     return guest == 16 || guest == GuestSigcont || guest == 20 || guest == 23 || guest == 28 || guest == 29;
 }
@@ -122,6 +110,10 @@ bool TakePending(int guest) {
     return (word.fetch_and(~bit, std::memory_order_relaxed) & bit) != 0;
 }
 
+void DiscardPendingIfIgnored(int guest, const GuestSigaction& action) {
+    if (action.handler == 1 || (action.handler == 0 && IgnoredByDefault(guest))) TakePending(guest);
+}
+
 bool PendingInSet(const GuestSignalSet& set, int* guest) {
     for (int candidate = 1; candidate <= MaxSignal; ++candidate) {
         if (!SignalInSet(set, candidate) || !TakePending(candidate)) continue;
@@ -234,7 +226,7 @@ bool DeliverPendingSignal(int guest) {
     return false;
 }
 
-int WaitForPendingInSet(const GuestSignalSet& set, bool waitForever, const GuestTimespec* timeout, int* guest) {
+int WaitForPendingInSet(const GuestSignalSet& set, bool waitForever, const KernelTimespec* timeout, int* guest) {
     auto& pending = Pending();
     std::unique_lock lock(pending.lock);
     std::optional<std::chrono::steady_clock::time_point> deadline;
@@ -244,8 +236,8 @@ int WaitForPendingInSet(const GuestSignalSet& set, bool waitForever, const Guest
             pending.changed.wait(lock);
             continue;
         }
-        if (!deadline) deadline = std::chrono::steady_clock::now() + std::chrono::seconds(timeout->seconds) +
-            std::chrono::nanoseconds(timeout->nanoseconds);
+        if (!deadline) deadline = std::chrono::steady_clock::now() + std::chrono::seconds(timeout->tv_sec) +
+            std::chrono::nanoseconds(timeout->tv_nsec);
         if (pending.changed.wait_until(lock, *deadline) == std::cv_status::no_timeout) continue;
         return PendingInSet(set, guest) ? 0 : GuestEagain;
     }
@@ -273,8 +265,6 @@ void WaitForDeliverableSignal() {
     }
 }
 
-extern "C" int APS5_VABI _sigprocmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet);
-
 }
 
 namespace {
@@ -371,10 +361,6 @@ extern "C" unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int seconds)
     return remaining;
 }
 
-struct GuestItimerval {
-    KernelTimeval interval;
-    KernelTimeval value;
-};
 static_assert(sizeof(GuestItimerval) == 32 && offsetof(GuestItimerval, value) == 16);
 
 extern "C" int APS5_VABI getitimer_nid_postfix(int which, GuestItimerval* output) {
@@ -466,11 +452,6 @@ extern "C" int APS5_VABI setitimer_nid_postfix(int which, const GuestItimerval*
     return 0;
 }
 
-struct GuestStack {
-    void* sp;
-    std::size_t size;
-    int flags;
-};
 static_assert(sizeof(GuestStack) == 24 && offsetof(GuestStack, flags) == 16);
 namespace {
 constexpr int SsDisable = 4;
@@ -483,10 +464,11 @@ GuestHandler APS5_VABI signal_nid_postfix(int guest, GuestHandler handler) {
     const auto invalid = reinterpret_cast<GuestHandler>(static_cast<std::uintptr_t>(-1));
     if (guest < 1 || guest > MaxSignal || ((guest == GuestSigkill || guest == GuestSigstop) && handler != nullptr)) { *__error_nid_postfix() = 22; return invalid; }
     std::lock_guard lock(registration);
-    const GuestSigaction action{reinterpret_cast<std::uintptr_t>(handler), SaRestart, {}};
+    const GuestSigaction action{reinterpret_cast<std::uintptr_t>(handler), SignalInSet(_sigintr_nid_postfix, guest) ? 0 : SaRestart, {}};
     if (!Install(guest, action)) { *__error_nid_postfix() = 22; return invalid; }
     const auto previous = reinterpret_cast<GuestHandler>(dispositions[guest].handler);
     dispositions[guest] = action;
+    DiscardPendingIfIgnored(guest, action);
     return previous;
 }
 int APS5_VABI sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous) {
@@ -498,10 +480,14 @@ int APS5_VABI sigaction_nid_postfix(int guest, const GuestSigaction* action, Gue
     if (action) {
         if (!Install(guest, *action)) { *__error_nid_postfix() = 22; return -1; }
         dispositions[guest] = *action;
+        DiscardPendingIfIgnored(guest, *action);
     }
     if (previous) *previous = old;
     return 0;
 }
+int APS5_VABI _sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous) {
+    return sigaction_nid_postfix(guest, action, previous);
+}
 int APS5_VABI raise_nid_postfix(int guest) {
     if (guest == 0) return 0;
     if (guest < 1 || guest > MaxSignal) { *__error_nid_postfix() = 22; return -1; }
@@ -597,9 +583,9 @@ int APS5_VABI pthread_sigmask_nid_postfix(int how, const GuestSignalSet* set, Gu
     return _sigprocmask_nid_postfix(how, set, previousSet);
 }
 
-int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet* set, void* info, const GuestTimespec* timeout) {
+int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet* set, void* info, const KernelTimespec* timeout) {
     if (set == nullptr || !SetHasSignal(*set)) { *__error_nid_postfix() = 22; return -1; }
-    if (timeout != nullptr && (timeout->nanoseconds < 0 || timeout->nanoseconds >= 1000000000) && !PendingInSetPresent(*set)) {
+    if (timeout != nullptr && (timeout->tv_nsec < 0 || timeout->tv_nsec >= 1000000000) && !PendingInSetPresent(*set)) {
         *__error_nid_postfix() = 22;
         return -1;
     }
@@ -643,10 +629,15 @@ int APS5_VABI sigsuspend_nid_postfix(const GuestSignalSet* set) {
     }
     WaitForDeliverableSignal();
     _sigprocmask_nid_postfix(GuestSigsetmask, &previous, nullptr);
+
     *__error_nid_postfix() = GuestEintr;
     return -1;
 }
 
+int APS5_VABI _sigsuspend_nid_postfix(const GuestSignalSet* set) {
+    return sigsuspend_nid_postfix(set);
+}
+
 int APS5_VABI sigpending_nid_postfix(GuestSignalSet* set) {
     if (set == nullptr) { *__error_nid_postfix() = 14; return -1; }
     auto& pending = Pending();
@@ -666,3 +657,12 @@ int APS5_VABI _is_signal_return_nid_postfix(std::uint64_t programCounter) {
 }
 
 }
+
+namespace {
+struct RegisterSignalsOnLoad {
+    RegisterSignalsOnLoad() {
+        RegisterSigaction_nid_no_patch(reinterpret_cast<SigactionFn_nid_no_patch>(sigaction_nid_postfix), _sigintr_nid_postfix.bits);
+    }
+};
+const RegisterSignalsOnLoad gRegisterSignals;
+}
diff --git a/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp b/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp
index 6f834ce2ff..9c6bf6029c 100644
--- a/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp
+++ b/core/libs/prx/libkernel/System/src/SoftwareVersion.cpp
@@ -1,15 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
 
-struct SceKernelProsperoSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, size) == 0x00);
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, versionString) == 0x08);
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, version) == 0x24);
diff --git a/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp b/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
index da87fe7bb2..7abef3192e 100644
--- a/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
+++ b/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
@@ -1,8 +1,12 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libkernel/System/include/HostCpu.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -20,22 +24,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getpid_nid_postfix();
-extern "C" std::uint64_t APS5_VABI sceKernelGetTscFrequency(void);
-struct GuestRlimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-extern "C" int APS5_VABI getrlimit_nid_postfix(int resource, GuestRlimit* limit);
-
-struct SceKernelSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-extern "C" int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, uint64_t info_size);
-
 namespace {
 
 int CopyOut(const void* value, std::size_t size, void* oldValue, std::size_t* oldLength) {
@@ -92,7 +80,18 @@ const SystemInteger* FindSystemInteger(const int* name) {
 }
 
 bool IsLeafMib(const int* name) {
-    return FindSystemInteger(name) != nullptr || (name[0] == 6 && (name[1] == 2 || name[1] == 3 || name[1] == 5 || name[1] == 7)) || (name[0] == 1 && (name[1] == 37 || name[1] == 50));
+    return FindSystemInteger(name) != nullptr || (name[0] == 6 && (name[1] == 2 || name[1] == 3 || name[1] == 5 || name[1] == 7)) || (name[0] == 1 && (name[1] == 21 || name[1] == 37 || name[1] == 50));
+}
+
+KernelTimeval BootTime() {
+    static const KernelTimeval bootTime = [] {
+        KernelTimespec now{};
+        KernelTimespec uptime{};
+        if (clock_gettime_nid_postfix(0, &now) != 0 || clock_gettime_nid_postfix(5, &uptime) != 0) throw std::runtime_error("kern.boottime: reading CLOCK_REALTIME or CLOCK_UPTIME failed");
+        const std::int64_t nanos = (now.tv_sec - uptime.tv_sec) * 1000000000LL + now.tv_nsec - uptime.tv_nsec;
+        return KernelTimeval{nanos / 1000000000LL, nanos % 1000000000LL / 1000LL};
+    }();
+    return bootTime;
 }
 
 bool IsMeasuredAbsentMib(const int* name, std::uint32_t nameLength) {
@@ -192,7 +191,7 @@ std::int64_t APS5_VABI sysconf_nid_postfix(int name) {
             result = 128;
             break;
         case 5: { // _SC_OPEN_MAX
-            GuestRlimit limit{};
+            GuestResourceLimit limit{};
             if (getrlimit_nid_postfix(8, &limit) == 0) {
                 result = limit.rlim_cur;
             }
@@ -323,6 +322,21 @@ int APS5_VABI sysctl_nid_postfix(const int* name, std::uint32_t nameLength, void
         static constexpr char path[] = "/app0/eboot.bin";
         return CopyOut(path, sizeof(path), oldValue, oldLength);
     }
+    if (nameLength >= 3 && name[0] == 1 && name[1] == 14 && name[2] == 35) {
+        if (newValue != nullptr) {
+            *__error_nid_postfix() = 1;
+            return -1;
+        }
+        if (nameLength != 4) {
+            *__error_nid_postfix() = 22;
+            return -1;
+        }
+        if (name[3] != getpid_nid_postfix()) {
+            *__error_nid_postfix() = 3;
+            return -1;
+        }
+        return CopyOut(nullptr, 0, oldValue, oldLength);
+    }
     if (nameLength >= 3 && name[0] == 1 && name[1] == 14 && name[2] == 32) {
         if (newValue != nullptr) {
             *__error_nid_postfix() = 1;
@@ -339,6 +353,14 @@ int APS5_VABI sysctl_nid_postfix(const int* name, std::uint32_t nameLength, void
         const auto entries = GuestVmEntries();
         return CopyOut(entries.data(), entries.size() * sizeof(GuestVmEntry), oldValue, oldLength);
     }
+    if (nameLength == 2 && name[0] == 1 && name[1] == 21) {
+        if (newValue != nullptr) {
+            *__error_nid_postfix() = 1;
+            return -1;
+        }
+        const KernelTimeval bootTime = BootTime();
+        return CopyOut(&bootTime, sizeof(bootTime), oldValue, oldLength);
+    }
     if (nameLength == 2 && name[0] == 1 && name[1] == 37) {
         if (newValue != nullptr) {
             *__error_nid_postfix() = 1;
@@ -396,6 +418,10 @@ int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::si
         static constexpr int mib[] = {1, 14, 12};
         return sysctl_nid_postfix(mib, 3, oldValue, oldLength, newValue, newLength);
     }
+    if (std::strcmp(name, "kern.boottime") == 0) {
+        static constexpr int mib[] = {1, 21};
+        return sysctl_nid_postfix(mib, 2, oldValue, oldLength, newValue, newLength);
+    }
     if (std::strcmp(name, "kern.arandom") == 0) {
         static constexpr int mib[] = {1, 37};
         return sysctl_nid_postfix(mib, 2, oldValue, oldLength, newValue, newLength);
@@ -452,7 +478,8 @@ int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::si
         static constexpr int mib[] = {6, 12};
         return sysctl_nid_postfix(mib, 2, oldValue, oldLength, newValue, newLength);
     }
-    throw std::runtime_error(std::string(__func__) + ": unsupported name " + name);
+    *__error_nid_postfix() = 2;
+    return -1;
 }
 
 int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion* version) {
@@ -465,6 +492,31 @@ int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion*
     return 0;
 }
 
+int APS5_VABI sceKernelGetSystemExVersion(char* first, char* second) {
+    if (first == nullptr || second == nullptr) {
+        return 22;
+    }
+    *first = '\0';
+    *second = '\0';
+    return 0;
+}
+
+int APS5_VABI sysKernelGetLowerLimitSysexVersion_nid_postfix(char* version) {
+    if (version == nullptr) {
+        return SCE_KERNEL_ERROR_EINVAL;
+    }
+    *version = '\0';
+    return 0;
+}
+
+int APS5_VABI sysKernelGetLowerLimitUpdVersion_nid_postfix(std::uint32_t* version) {
+    if (version == nullptr) {
+        return SCE_KERNEL_ERROR_EINVAL;
+    }
+    *version = 0;
+    return 0;
+}
+
 int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_t* size) {
     struct KnownName {
         const char* name;
@@ -480,6 +532,7 @@ int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_
         {"hw.physmem", {6, 5}, 2},
         {"hw.realmem", {6, 12}, 2},
         {"kern.arandom", {1, 37}, 2},
+        {"kern.boottime", {1, 21}, 2},
         {"kern.clockrate", {1, 12}, 2},
         {"kern.maxfiles", {1, 7}, 2},
         {"kern.maxfilesperproc", {1, 27}, 2},
@@ -514,6 +567,7 @@ int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_
     for (const auto& entry : SystemIntegers) {
         if (std::strcmp(name, entry.name) == 0) return copyMib(entry.mib, 2);
     }
-    throw std::runtime_error(std::string(__func__) + ": unsupported name " + name);
+    *__error_nid_postfix() = 2;
+    return -1;
 }
 }
diff --git a/core/libs/prx/libkernel/System/src/ThermalSensors.cpp b/core/libs/prx/libkernel/System/src/ThermalSensors.cpp
index bd83c4282c..fcff781e17 100644
--- a/core/libs/prx/libkernel/System/src/ThermalSensors.cpp
+++ b/core/libs/prx/libkernel/System/src/ThermalSensors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/System/include/ThermalSensors.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
diff --git a/core/libs/prx/libkernel/System/src/UserContext.cpp b/core/libs/prx/libkernel/System/src/UserContext.cpp
index 92eaa7a389..0ebbc448f2 100644
--- a/core/libs/prx/libkernel/System/src/UserContext.cpp
+++ b/core/libs/prx/libkernel/System/src/UserContext.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestStacks.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -7,9 +9,6 @@
 #include <cstring>
 #include <immintrin.h>
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
-
 namespace {
 
 struct RegisterFrame {
@@ -157,6 +156,7 @@ int APS5_VABI Aps5GetcontextFinish_nid_no_patch(UserUcontext* context, const Reg
     if (context == nullptr) return Fail(GuestEinval);
     UserUcontext captured{};
     sigprocmask_nid_postfix(GuestSigBlock, nullptr, captured.sigmask);
+
     auto& machine = captured.mcontext;
     machine.rdi = frame->rdi;
     machine.rsi = frame->rsi;
@@ -213,6 +213,7 @@ int APS5_VABI setcontext_nid_postfix(const UserUcontext* context) {
     mxcsr &= HostMxcsrMask();
     std::memcpy(frame.fxsave + FxsaveMxcsr, &mxcsr, sizeof(mxcsr));
     sigprocmask_nid_postfix(GuestSigSetmask, context->sigmask, nullptr);
+
     Aps5ContextRestore_nid_no_patch(&frame);
 }
 
diff --git a/core/libs/prx/libkernel/Time/Ktimer.cpp b/core/libs/prx/libkernel/Time/Ktimer.cpp
new file mode 100644
index 0000000000..933a20bc60
--- /dev/null
+++ b/core/libs/prx/libkernel/Time/Ktimer.cpp
@@ -0,0 +1,151 @@
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+#include <cstdint>
+#include <mutex>
+
+namespace {
+
+constexpr int GuestEfault = 14;
+constexpr int GuestEinval = 22;
+constexpr int GuestEagain = 35;
+
+std::int64_t Fail(int error) {
+    *__error_nid_postfix() = error;
+    return -1;
+}
+
+constexpr int ClockRealtime = 0;
+constexpr int ClockMonotonic = 4;
+constexpr int SigevNone = 0;
+constexpr int SigevSignal = 1;
+constexpr int SigevThreadId = 4;
+constexpr int SignalMax = 128;
+constexpr int TimerAbstime = 1;
+constexpr int FirstTimer = 3;
+constexpr int TimerMax = 32;
+constexpr long long NanosecondsPerSecond = 1000000000;
+constexpr long long TickNanoseconds = 1000000;
+
+using Nanoseconds = __int128;
+
+struct Ktimer {
+    bool live = false;
+    int clock = ClockRealtime;
+    Nanoseconds value = 0;
+    Nanoseconds interval = 0;
+};
+
+std::mutex g_ktimerLock;
+Ktimer g_ktimers[TimerMax];
+
+Nanoseconds ToNanoseconds(const KernelTimespec& time) {
+    return static_cast<Nanoseconds>(time.tv_sec) * NanosecondsPerSecond + time.tv_nsec;
+}
+
+KernelTimespec ToTimespec(Nanoseconds time) {
+    return {static_cast<std::int64_t>(time / NanosecondsPerSecond),
+            static_cast<std::int64_t>(time % NanosecondsPerSecond)};
+}
+
+Nanoseconds ClockNow(int clock) {
+    KernelTimespec now{};
+    clock_gettime_nid_postfix(clock, &now);
+
+    return ToNanoseconds(now);
+}
+
+bool FixTimespec(KernelTimespec& time) {
+    if (time.tv_sec < 0 || time.tv_nsec < 0 || time.tv_nsec >= NanosecondsPerSecond) return false;
+    if (time.tv_sec == 0 && time.tv_nsec != 0 && time.tv_nsec < TickNanoseconds) time.tv_nsec = TickNanoseconds;
+    return true;
+}
+
+Ktimer* FindTimer(int id) {
+    if (id < FirstTimer || id >= TimerMax || !g_ktimers[id].live) return nullptr;
+    return &g_ktimers[id];
+}
+
+void Expire(Ktimer& timer, Nanoseconds now) {
+    if (timer.value == 0 || now < timer.value) return;
+    if (timer.interval == 0) {
+        timer.value = 0;
+        return;
+    }
+    timer.value += ((now - timer.value) / timer.interval + 1) * timer.interval;
+}
+
+GuestItimerspec Remaining(Ktimer& timer) {
+    const Nanoseconds now = ClockNow(timer.clock);
+    Expire(timer, now);
+    GuestItimerspec result{ToTimespec(timer.interval), {}};
+    if (timer.value != 0) result.it_value = timer.value > now ? ToTimespec(timer.value - now) : KernelTimespec{0, 1};
+    return result;
+}
+
+}
+
+extern "C" {
+
+int APS5_VABI ktimer_create_nid_postfix(int clock, const GuestSigevent* event, int* timerid) {
+    if (clock != ClockRealtime && clock != ClockMonotonic) return static_cast<int>(Fail(GuestEinval));
+    if (event != nullptr) {
+        if (event->notify != SigevNone && event->notify != SigevSignal && event->notify != SigevThreadId)
+            return static_cast<int>(Fail(GuestEinval));
+        if (event->notify != SigevNone && (event->signo <= 0 || event->signo > SignalMax))
+            return static_cast<int>(Fail(GuestEinval));
+    }
+    std::lock_guard lock(g_ktimerLock);
+    int id = FirstTimer;
+    while (id < TimerMax && g_ktimers[id].live) ++id;
+    if (id == TimerMax) return static_cast<int>(Fail(GuestEagain));
+    if (timerid == nullptr) return static_cast<int>(Fail(GuestEfault));
+    if (event == nullptr || event->notify != SigevNone) NotImplemented_nid_no_patch("ktimer_create delivering a signal");
+    g_ktimers[id] = {true, clock, 0, 0};
+    *timerid = id;
+    return 0;
+}
+
+int APS5_VABI ktimer_delete_nid_postfix(int id) {
+    std::lock_guard lock(g_ktimerLock);
+    Ktimer* timer = FindTimer(id);
+    if (timer == nullptr) return static_cast<int>(Fail(GuestEinval));
+    *timer = {};
+    return 0;
+}
+
+int APS5_VABI ktimer_settime_nid_postfix(int id, int flags, const GuestItimerspec* value, GuestItimerspec* oldValue) {
+    if (value == nullptr) return static_cast<int>(Fail(GuestEfault));
+    std::lock_guard lock(g_ktimerLock);
+    Ktimer* timer = FindTimer(id);
+    if (timer == nullptr) return static_cast<int>(Fail(GuestEinval));
+    GuestItimerspec next = *value;
+    if (!FixTimespec(next.it_value)) return static_cast<int>(Fail(GuestEinval));
+    const bool armed = next.it_value.tv_sec != 0 || next.it_value.tv_nsec != 0;
+    if (armed && !FixTimespec(next.it_interval)) return static_cast<int>(Fail(GuestEinval));
+    if (!armed) next.it_interval = {};
+    if (oldValue != nullptr) *oldValue = Remaining(*timer);
+    timer->interval = ToNanoseconds(next.it_interval);
+    timer->value = ToNanoseconds(next.it_value);
+    if (armed && (flags & TimerAbstime) == 0) timer->value += ClockNow(timer->clock);
+    return 0;
+}
+
+int APS5_VABI ktimer_gettime_nid_postfix(int id, GuestItimerspec* value) {
+    std::lock_guard lock(g_ktimerLock);
+    Ktimer* timer = FindTimer(id);
+    if (timer == nullptr) return static_cast<int>(Fail(GuestEinval));
+    if (value == nullptr) return static_cast<int>(Fail(GuestEfault));
+    *value = Remaining(*timer);
+    return 0;
+}
+
+int APS5_VABI ktimer_getoverrun_nid_postfix(int id) {
+    std::lock_guard lock(g_ktimerLock);
+    if (FindTimer(id) == nullptr) return static_cast<int>(Fail(GuestEinval));
+    return 0;
+}
+
+}
diff --git a/core/libs/prx/libkernel/Time/Time.cpp b/core/libs/prx/libkernel/Time/Time.cpp
index 411f92751d..4e3d97ebca 100644
--- a/core/libs/prx/libkernel/Time/Time.cpp
+++ b/core/libs/prx/libkernel/Time/Time.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
 #include "prx/libkernel/Time/include/TimedWait.hpp"
 #include "prx/libkernel/Time/include/SleepWake.hpp"
@@ -36,8 +40,6 @@
 #endif // __linux__
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_CLOCK_REALTIME = 0;
@@ -119,16 +121,6 @@ static const bool g_timerResolutionRaised = [] {
     return raised;
 }();
 
-extern "C" {
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-}
-
 static void ReportTimedWait(const char* name, const std::function<void()>& body) {
     std::vector<double> samples(200);
     for (auto& sample : samples) {
@@ -152,11 +144,13 @@ static const bool g_timerSelfTest = [] {
     scePthreadCondInit(&cond, nullptr, nullptr);
     scePthreadMutexInit(&guestMutex, nullptr, nullptr);
     scePthreadMutexLock(&guestMutex);
+
     ReportTimedWait("scePthreadCondTimedwait(1000 us)", [&] { scePthreadCondTimedwait(&cond, &guestMutex, 1000); });
     ReportTimedWait("scePthreadCondTimedwait(13000 us)", [&] { scePthreadCondTimedwait(&cond, &guestMutex, 13000); });
     scePthreadMutexUnlock(&guestMutex);
     scePthreadMutexDestroy(&guestMutex);
     scePthreadCondDestroy(&cond);
+
     ReportTimedWait("sceKernelUsleep(1000)", [&] { sceKernelUsleep_nid_postfix(1000); });
     ReportTimedWait("Sleep(1)", [&] { Sleep(1); });
     HANDLE event = CreateEventW(nullptr, TRUE, FALSE, nullptr);
diff --git a/core/libs/prx/libkernel/Time/TimedWait.cpp b/core/libs/prx/libkernel/Time/TimedWait.cpp
index 7c171db399..bb5ba2cdca 100644
--- a/core/libs/prx/libkernel/Time/TimedWait.cpp
+++ b/core/libs/prx/libkernel/Time/TimedWait.cpp
@@ -11,6 +11,9 @@
 #include <windows.h>
 #else
 #include <cerrno>
+#include <csignal>
+#include <pthread.h>
+#include <system_error>
 #include <time.h>
 #endif
 
@@ -389,6 +392,91 @@ void Condition::NotifyAll() {
     coarse.notify_all();
 }
 
+namespace {
+
+constinit thread_local std::atomic<int> deferralDepth{0};
+constinit thread_local std::atomic<int> deferredSignal{0};
+
+class DeliveryAllowance {
+public:
+    DeliveryAllowance() : depth(deferralDepth.exchange(0)) { DeliverDeferred(); }
+    ~DeliveryAllowance() { deferralDepth.store(depth); }
+    DeliveryAllowance(const DeliveryAllowance&) = delete;
+    DeliveryAllowance& operator=(const DeliveryAllowance&) = delete;
+
+private:
+    int depth;
+};
+
+}
+
+DeliveryDeferral::DeliveryDeferral() {
+    deferralDepth.fetch_add(1);
+}
+
+DeliveryDeferral::~DeliveryDeferral() {
+    deferralDepth.fetch_sub(1);
+}
+
+void DeliverDeferred() {
+    if (deferralDepth.load() != 0) return;
+    const int signum = deferredSignal.exchange(0);
+    if (signum != 0) pthread_kill(pthread_self(), signum);
+}
+
+bool DeferDelivery(int signum) {
+    if (deferralDepth.load() == 0) return false;
+    deferredSignal.store(signum);
+    return true;
+}
+
+#ifdef __APPLE__
+SingleWaiterCondition::SingleWaiterCondition() : semaphore(dispatch_semaphore_create(0)) {
+    if (semaphore == nullptr) throw std::runtime_error("TimedWait: cannot create a wait semaphore");
+}
+
+SingleWaiterCondition::~SingleWaiterCondition() {
+    dispatch_release(semaphore);
+}
+
+void SingleWaiterCondition::NotifyOne() {
+    dispatch_semaphore_signal(semaphore);
+}
+
+bool SingleWaiterCondition::waitSignal(const std::uint64_t* deadlineNanos) {
+    DeliveryAllowance allowance;
+    if (deadlineNanos == nullptr) return dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER) == 0;
+    const std::uint64_t now = NowNanos();
+    const std::uint64_t remaining = *deadlineNanos > now ? *deadlineNanos - now : 0;
+    const dispatch_time_t deadline = remaining >= static_cast<std::uint64_t>(std::numeric_limits<std::int64_t>::max()) ? DISPATCH_TIME_FOREVER : dispatch_time(DISPATCH_TIME_NOW, static_cast<std::int64_t>(remaining));
+    return dispatch_semaphore_wait(semaphore, deadline) == 0;
+}
+#else
+SingleWaiterCondition::SingleWaiterCondition() {
+    if (sem_init(&semaphore, 0, 0) != 0) throw std::system_error(errno, std::generic_category(), "TimedWait: cannot create a wait semaphore");
+}
+
+SingleWaiterCondition::~SingleWaiterCondition() {
+    sem_destroy(&semaphore);
+}
+
+void SingleWaiterCondition::NotifyOne() {
+    sem_post(&semaphore);
+}
+
+bool SingleWaiterCondition::waitSignal(const std::uint64_t* deadlineNanos) {
+    DeliveryAllowance allowance;
+    timespec deadline{};
+    if (deadlineNanos != nullptr) deadline = {static_cast<time_t>(*deadlineNanos / 1000000000ULL), static_cast<long>(*deadlineNanos % 1000000000ULL)};
+    for (;;) {
+        const int result = deadlineNanos == nullptr ? sem_wait(&semaphore) : sem_clockwait(&semaphore, CLOCK_MONOTONIC, &deadline);
+        if (result == 0) return true;
+        if (errno == ETIMEDOUT) return false;
+        if (errno != EINTR) throw std::system_error(errno, std::generic_category(), "TimedWait: cannot wait for a wait semaphore");
+    }
+}
+#endif
+
 #endif
 
 void BindThreadWaitState(std::atomic<int>* state) {
diff --git a/core/libs/prx/libkernel/Time/include/TimedWait.hpp b/core/libs/prx/libkernel/Time/include/TimedWait.hpp
index 2f1725819d..9ad4e09f03 100644
--- a/core/libs/prx/libkernel/Time/include/TimedWait.hpp
+++ b/core/libs/prx/libkernel/Time/include/TimedWait.hpp
@@ -7,6 +7,12 @@
 #include <cstdint>
 #include <mutex>
 
+#ifdef __APPLE__
+#include <dispatch/dispatch.h>
+#elif !defined(_WIN32)
+#include <semaphore.h>
+#endif
+
 namespace TimedWait {
 
 bool Coarse();
@@ -21,9 +27,6 @@ void WakeChangeSleepers();
 
 struct Waiter;
 
-#ifdef _WIN32
-constexpr unsigned PARK_SPINS = 1000;
-
 class DeliveryDeferral {
 public:
     DeliveryDeferral();
@@ -33,6 +36,10 @@ public:
 };
 
 void DeliverDeferred();
+
+#ifdef _WIN32
+constexpr unsigned PARK_SPINS = 1000;
+
 void SpinPause();
 Waiter* BeginPark(const void* key);
 bool FinishPark(const void* key, Waiter* waiter, const std::uint64_t* deadlineNanos);
@@ -132,6 +139,51 @@ private:
     std::condition_variable_any coarse;
 };
 
+#ifdef _WIN32
+using SingleWaiterCondition = Condition;
+#else
+bool DeferDelivery(int signum);
+
+class SingleWaiterCondition {
+public:
+    SingleWaiterCondition();
+    ~SingleWaiterCondition();
+    SingleWaiterCondition(const SingleWaiterCondition&) = delete;
+    SingleWaiterCondition& operator=(const SingleWaiterCondition&) = delete;
+
+    void NotifyOne();
+
+    template <class TLock, class TPredicate>
+    void Wait(TLock& lock, TPredicate predicate) {
+        while (!predicate()) {
+            lock.unlock();
+            waitSignal(nullptr);
+            lock.lock();
+        }
+    }
+
+    template <class TLock, class TPredicate>
+    bool WaitUntil(TLock& lock, std::uint64_t deadlineNanos, TPredicate predicate) {
+        while (!predicate()) {
+            lock.unlock();
+            const bool signaled = waitSignal(&deadlineNanos);
+            lock.lock();
+            if (!signaled) return predicate();
+        }
+        return true;
+    }
+
+private:
+    bool waitSignal(const std::uint64_t* deadlineNanos);
+
+#ifdef __APPLE__
+    dispatch_semaphore_t semaphore;
+#else
+    sem_t semaphore;
+#endif
+};
+#endif
+
 }  // namespace TimedWait
 
 #endif
diff --git a/core/libs/prx/libkernel/Unimplemented.cpp b/core/libs/prx/libkernel/Unimplemented.cpp
index 617dc506f1..87c6cb3406 100644
--- a/core/libs/prx/libkernel/Unimplemented.cpp
+++ b/core/libs/prx/libkernel/Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
@@ -141,9 +142,4 @@ int APS5_VABI __Ux86_64_setcontext() {
     return 0;
 }
 
-int APS5_VABI sigreturn() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 }
diff --git a/core/libs/prx/libkernel/include/Api.hpp b/core/libs/prx/libkernel/include/Api.hpp
new file mode 100644
index 0000000000..bbaac3dc55
--- /dev/null
+++ b/core/libs/prx/libkernel/include/Api.hpp
@@ -0,0 +1,799 @@
+#pragma once
+
+#include "prx/libSceLibcInternal/include/Spawn.hpp"
+#include "prx/libkernel/System/include/UserContext.hpp"
+#include "prx/libkernel/File/include/KernelStatfs.hpp"
+#include "prx/libkernel/Apr/include/AprCommandBuffer.hpp"
+#include "prx/libc/include/specifics/linux/ElfTypes.hpp"
+#include "SceTypes.hpp"
+#include <mutex>
+#include <condition_variable>
+#include <atomic>
+#include <thread>
+
+struct KernelIovec {
+    void* base;
+    std::size_t length;
+};
+
+using GuestHandler = void (APS5_VABI *)(int);
+
+struct GuestItimerspec {
+    KernelTimespec it_interval;
+    KernelTimespec it_value;
+};
+
+struct GuestItimerval {
+    KernelTimeval interval;
+    KernelTimeval value;
+};
+
+struct GuestMsghdr {
+    void* name;
+    std::uint32_t nameLength;
+    KernelIovec* iov;
+    int iovLength;
+    void* control;
+    std::uint32_t controlLength;
+    int flags;
+};
+
+struct GuestOnce {
+    std::int32_t state;
+    void* mutex;
+};
+
+struct GuestPollDescriptor {
+    int descriptor;
+    short events;
+    short revents;
+};
+
+struct GuestResourceLimit {
+    std::int64_t rlim_cur;
+    std::int64_t rlim_max;
+};
+
+struct GuestResourceUsage {
+    KernelTimeval ru_utime;
+    KernelTimeval ru_stime;
+    std::int64_t ru_maxrss;
+    std::int64_t ru_ixrss;
+    std::int64_t ru_idrss;
+    std::int64_t ru_isrss;
+    std::int64_t ru_minflt;
+    std::int64_t ru_majflt;
+    std::int64_t ru_nswap;
+    std::int64_t ru_inblock;
+    std::int64_t ru_oublock;
+    std::int64_t ru_msgsnd;
+    std::int64_t ru_msgrcv;
+    std::int64_t ru_nsignals;
+    std::int64_t ru_nvcsw;
+    std::int64_t ru_nivcsw;
+};
+
+struct GuestRtPrio {
+    std::uint16_t type;
+    std::uint16_t prio;
+};
+
+struct GuestSendfileHeaders {
+    KernelIovec* headers;
+    int headerCount;
+    KernelIovec* trailers;
+    int trailerCount;
+};
+
+struct GuestSigaction {
+    std::uintptr_t handler;
+    int flags;
+    GuestSignalSet mask;
+};
+
+struct GuestSigevent {
+    int notify;
+    int signo;
+    std::int64_t value;
+    std::int64_t extra[8];
+};
+
+struct GuestStack {
+    void* sp;
+    std::size_t size;
+    int flags;
+};
+
+struct PthreadBarrierPrivate {
+    std::mutex mutex;
+    std::condition_variable changed;
+    unsigned count;
+    unsigned arrived = 0;
+    unsigned active = 0;
+    std::uint64_t generation = 0;
+};
+
+struct PthreadBarrierattrPrivate {
+    int pshared = 0;
+};
+
+struct PthreadSpinlockPrivate {
+    std::atomic<std::thread::id> owner{};
+};
+
+struct SceKernelProsperoSystemSwVersion {
+    std::uint64_t size;
+    char versionString[0x1C];
+    std::uint32_t version;
+};
+
+struct SceKernelSystemSwVersion {
+    std::uint64_t size;
+    char versionString[0x1C];
+    std::uint32_t version;
+};
+
+extern "C" {
+int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, std::uint32_t attr, std::uint64_t initPattern, const void* param);
+int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef);
+int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, std::uint64_t bitPattern);
+int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, std::uint64_t setPattern, int* numWaitThreads);
+
+}
+
+extern "C" {
+
+int APS5_VABI __tls_get_addr_nid_postfix(void);
+int APS5_VABI physhm_open_nid_postfix(void);
+int APS5_VABI physhm_unlink_nid_postfix(void);
+int APS5_VABI sceKernelUnknown03(void);
+int APS5_VABI sceKernelUnknown04(void);
+int APS5_VABI sceKernelUnknown05(void);
+int APS5_VABI sceKernelUnknown06(void);
+int APS5_VABI sceKernelUnknown07(void);
+int APS5_VABI sceKernelUnknown08(void);
+int APS5_VABI sceKernelUnknown09(void);
+int APS5_VABI sceKernelUnknown10(void);
+int APS5_VABI sceKernelUnknown11(void);
+int APS5_VABI sceKernelUnknown12(void);
+int APS5_VABI sceKernelUnknown13(void);
+int APS5_VABI sceKernelUnknown14(void);
+int APS5_VABI sceKernelUnknown15(void);
+int APS5_VABI sceKernelUnknown16(void);
+int APS5_VABI sceKernelUnknown17(void);
+int APS5_VABI sceKernelUnknown18(void);
+int APS5_VABI sceKernelUnknown19(void);
+int APS5_VABI sceKernelPrintBacktraceWithModuleInfo(void);
+int APS5_VABI sceKernelGetProcessAbiType();
+int APS5_VABI __Ux86_64_setcontext();
+int APS5_VABI sceKernelAioDeleteRequest(int32_t id, int32_t* ret);
+int APS5_VABI sceKernelAioDeleteRequests(int32_t* id, int32_t num, int32_t* ret);
+int APS5_VABI sceKernelAioCancelRequest(int32_t id, int32_t* state);
+int APS5_VABI sceKernelAioCancelRequests(int32_t* id, int32_t num, int32_t* state);
+int APS5_VABI sceKernelAioInitializeImpl(void* param, int32_t size);
+void APS5_VABI sceKernelAioInitializeParam(void* param);
+int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, int32_t schedulingWindowSize, int32_t delayedCountLimit, uint32_t enableSplit, uint32_t splitSize, uint32_t splitChunkSize);
+int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioSubmitReadCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest* req, int32_t size, int32_t prio, int32_t* id);
+int APS5_VABI sceKernelAioPollRequest(int32_t id, int32_t* state);
+int APS5_VABI sceKernelAioWaitRequests(int32_t* id, int32_t num, int32_t* state, uint32_t mode, uint32_t* usec);
+int APS5_VABI sceKernelAioWaitRequest(int32_t id, int32_t* state, uint32_t* usec);
+int APS5_VABI sceKernelAioPollRequests(int32_t* id, int32_t num, int32_t* state);
+int APS5_VABI sceKernelAprResolveFilepathsToIds(const char** paths, uint32_t count, uint32_t* ids, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizes(const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIdsAndFileSizes(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIds(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, uint32_t* errorIndex);
+int APS5_VABI sceKernelAprGetFileSize(uint32_t id, uint64_t* size);
+int APS5_VABI sceKernelAprGetFileStat(uint32_t id, FileStat* stat);
+int APS5_VABI sceKernelAprSubmitCommandBuffer(const Apr::CommandBufferObject* buffer, uint32_t priority);
+int APS5_VABI sceKernelAprSubmitCommandBufferAndGetId(const Apr::CommandBufferObject* buffer, uint32_t priority, uint32_t* id);
+int APS5_VABI sceKernelAprSubmitCommandBufferAndGetResult(const Apr::CommandBufferObject* buffer, uint32_t priority, uint32_t* result, uint32_t* id);
+int APS5_VABI sceKernelAprWaitCommandBuffer(uint32_t id);
+int APS5_VABI sceKernelAprResolveFilepathsToIdsForEach(const char** paths, uint32_t count, uint32_t* ids, int* results);
+int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizesForEach(const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, int* results);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIdsForEach(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, int* results);
+int APS5_VABI sceKernelAprResolveFilepathsWithPrefixToIdsAndFileSizesForEach(const char* prefix, const char** paths, uint32_t count, uint32_t* ids, uint64_t* sizes, int* results);
+int APS5_VABI sceKernelWriteModifyMtypeProtectCommand(void* dst, std::uint64_t address, std::uint64_t size, std::uint64_t type, std::uint64_t protection, std::uint64_t mask, std::uint64_t* outSize);
+int APS5_VABI sceKernelWriteRemapIntoPrtCommand(std::uint32_t* dst, std::uint64_t address, std::uint64_t source, std::uint64_t size, int protection, int opcode, std::uint64_t* outSize);
+int APS5_VABI sceKernelAllocateDirectMemory(int64_t searchStart, int64_t searchEnd, size_t len, size_t alignment, int memoryType, int64_t* physAddrOut);
+int APS5_VABI sceKernelAllocateMainDirectMemory(size_t len, size_t alignment, int memoryType, int64_t* physAddrOut);
+int APS5_VABI sceKernelAvailableDirectMemorySize(int64_t searchStart, int64_t searchEnd, size_t alignment, int64_t* physAddrOut, size_t* sizeOut);
+int APS5_VABI sceKernelDirectMemoryQuery(int64_t offset, int flags, void* info, size_t infoSize);
+int APS5_VABI sceKernelGetDirectMemoryType(int64_t offset, int* memoryType, int64_t* start, int64_t* end);
+size_t APS5_VABI sceKernelGetDirectMemorySize(void);
+int APS5_VABI sceKernelEnableDmemAliasing(void);
+int APS5_VABI sceKernelMapDirectMemory(void** addr, size_t len, int prot, int flags, int64_t directMemoryStart, size_t alignment);
+int APS5_VABI sceKernelMapDirectMemory2(void** addr, size_t len, int type, int prot, int flags, int64_t directMemoryStart, size_t alignment);
+int APS5_VABI sceKernelMapFlexibleMemory(void** addrInOut, size_t len, int prot, int flags);
+int APS5_VABI sceKernelMapNamedDirectMemory(void** addr, size_t len, int prot, int flags, int64_t directMemoryStart, size_t alignment, const char* name);
+int32_t APS5_VABI sceKernelMapNamedFlexibleMemory(void** addrInOut, size_t len, int prot, int flags, const char* name);
+int32_t APS5_VABI sceKernelMapNamedFlexibleMemoryInternal(void** addrInOut, size_t len, int prot, int flags, const char* name);
+int APS5_VABI sceKernelMprotect(const void* addr, size_t len, int prot);
+int APS5_VABI sceKernelMunmap(uint64_t vaddr, size_t len);
+int APS5_VABI sceKernelMmap(void* addr, size_t len, int prot, int flags, int fd, int64_t offset, void** res);
+int APS5_VABI sceKernelReleaseFlexibleMemory(void* addr, size_t len);
+int APS5_VABI sceKernelReleaseDirectMemory(int64_t start, size_t len);
+int APS5_VABI sceKernelReserveVirtualRange(void** addr, size_t len, int flags, size_t alignment);
+int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, uint64_t infoSize);
+int APS5_VABI sceKernelCheckedReleaseDirectMemory(int64_t start, size_t len);
+int APS5_VABI sceKernelMtypeprotect(const void* addr, size_t len, int type, int prot);
+int APS5_VABI sceKernelQueryMemoryProtection(void* addr, void** start, void** end, int* prot);
+int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
+int APS5_VABI sceKernelAvailableFlexibleMemorySize(size_t* size);
+int APS5_VABI sceKernelConfiguredFlexibleMemorySize(size_t* size);
+int APS5_VABI sceKernelInternalMemoryGetAvailableSize(std::size_t* size);
+int APS5_VABI sceKernelSetVirtualRangeName(const void* addr, uint64_t len, const char* name);
+int APS5_VABI sceKernelClearVirtualRangeName(const void* addr, uint64_t len);
+int APS5_VABI sceKernelGetPageTableStats(int* cpuTotal, int* cpuAvailable, int* gpuTotal, int* gpuAvailable);
+int APS5_VABI sceKernelGetPrtAperture(int index, void** addr, size_t* len);
+int APS5_VABI sceKernelSetPrtAperture(int index, void* addr, size_t len);
+int APS5_VABI sceKernelBatchMap(KernelBatchMapEntry* entries, int numEntries, int* numEntriesOut);
+int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry* entries, int numEntries, int* numEntriesOut, int flags);
+int APS5_VABI sceKernelMlock_nid_postfix(void* address, std::uint64_t length);
+int APS5_VABI sceKernelMunlock_nid_postfix(void* address, std::uint64_t length);
+int APS5_VABI sceKernelMunlockall_nid_postfix();
+int APS5_VABI sceKernelJitCreateSharedMemory(const char* name, std::size_t len, int maxProt, int* fdOut);
+int APS5_VABI sceKernelJitCreateAliasOfSharedMemory(int fd, int maxProt, int* fdOut);
+int APS5_VABI sceKernelJitMapSharedMemory(int fd, int prot, void** startOut);
+int APS5_VABI sceKernelMemoryPoolBatch(const KernelMemoryPoolBatchEntry* entries, int numEntries, int* numEntriesOut, int flags);
+int APS5_VABI sceKernelMemoryPoolCommit(void* addr, size_t len, int type, int prot, int flags);
+int APS5_VABI sceKernelMemoryPoolDecommit(void* addr, size_t len, int flags);
+int APS5_VABI sceKernelMemoryPoolExpand(int64_t searchStart, int64_t searchEnd, size_t len, size_t alignment, int64_t* physAddrOut);
+int APS5_VABI sceKernelMemoryPoolGetBlockStats(KernelMemoryPoolBlockStats* output, size_t outputSize);
+int APS5_VABI sceKernelMemoryPoolReserve(void* addrIn, size_t len, size_t alignment, int flags, void** addrOut);
+void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
+int APS5_VABI munmap_nid_postfix(void* address, std::size_t length) noexcept;
+int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
+int APS5_VABI mlock_nid_postfix(const void* address, std::size_t length);
+int APS5_VABI munlock_nid_postfix(const void* address, std::size_t length);
+int APS5_VABI mlockall_nid_postfix(int flags);
+int APS5_VABI munlockall_nid_postfix();
+int APS5_VABI msync_nid_postfix(void* address, std::size_t length, int flags);
+int APS5_VABI madvise_nid_postfix(void* address, std::size_t length, int advice);
+int APS5_VABI mincore_nid_postfix(const void* address, std::size_t length, char* vec);
+int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
+int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
+int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
+int APS5_VABI sceKernelAddUserEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
+int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue eq, int id, void* udata);
+int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddHRTimerEvent(KernelEqueue eq, int id, const KernelTimespec* ts, void* udata);
+int APS5_VABI sceKernelDeleteHRTimerEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddTimerEvent(KernelEqueue eq, int id, KernelUseconds usec, void* udata);
+int APS5_VABI sceKernelDeleteTimerEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddAmprEvent(KernelEqueue eq, int id, void* udata);
+int APS5_VABI sceKernelAddAmprSystemEvent(KernelEqueue eq, int id, void* udata);
+int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelDeleteAmprSystemEvent(KernelEqueue eq, int id);
+int APS5_VABI sceKernelAddReadEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
+int APS5_VABI sceKernelDeleteReadEvent(KernelEqueue eq, int fd);
+int APS5_VABI sceKernelAddWriteEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
+int APS5_VABI sceKernelDeleteWriteEvent(KernelEqueue eq, int fd);
+intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent* ev);
+int APS5_VABI sceKernelGetEventError(const KernelEvent* ev);
+intptr_t APS5_VABI sceKernelGetEventFflags(const KernelEvent* ev);
+int APS5_VABI sceKernelGetEventFilter(const KernelEvent* ev);
+uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
+void* APS5_VABI sceKernelGetEventUserData(const KernelEvent* ev);
+int APS5_VABI sceKernelAddFileEvent(KernelEqueue eq, int fd, int watch, void* udata);
+int APS5_VABI sceKernelDeleteFileEvent(KernelEqueue eq, int fd);
+int APS5_VABI kqueue_nid_postfix();
+int APS5_VABI kevent_nid_postfix(int descriptor, const KernelEvent* changelist, int nchanges, KernelEvent* eventlist, int nevents, const KernelTimespec* timeout);
+int APS5_VABI sceKernelOpenEventFlag(KernelEventFlag* ef, const char* name);
+int APS5_VABI sceKernelCloseEventFlag(KernelEventFlag ef);
+int APS5_VABI sceKernelClearEventFlag(KernelEventFlag ef, uint64_t bitPattern);
+int APS5_VABI sceKernelPollEventFlag(KernelEventFlag ef, uint64_t bitPattern, uint32_t waitMode, uint64_t* resultPat);
+int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, uint64_t bitPattern, uint32_t waitMode, uint64_t* resultPat, KernelUseconds* timeout);
+int APS5_VABI shm_open_nid_postfix(const char* path, int flags, int mode);
+int APS5_VABI shm_unlink_nid_postfix(const char* path);
+int APS5_VABI pipe_nid_postfix(int* descriptors);
+int APS5_VABI chmod_nid_postfix(const char* path, int mode);
+int APS5_VABI chflags_nid_postfix(const char* path, std::uint64_t flags);
+int APS5_VABI fchflags_nid_postfix(int d, std::uint64_t flags);
+int APS5_VABI nmount_nid_postfix(const KernelIovec* iov, unsigned int niov, int flags);
+int APS5_VABI close_nid_postfix(int d);
+int APS5_VABI _close_nid_postfix(int descriptor);
+int APS5_VABI dup_nid_postfix(int d);
+int APS5_VABI dup2_nid_postfix(int from, int to);
+int APS5_VABI flock_nid_postfix(int d, int operation);
+int APS5_VABI _fstatfs_nid_postfix(int d, KernelStatfs* buf);
+int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int d, FileStat* sb);
+int64_t APS5_VABI _fstat_nid_postfix(int d, FileStat* sb);
+int APS5_VABI ftruncate_nid_postfix(int d, int64_t length);
+int APS5_VABI sceKernelFtruncate(int d, int64_t length);
+int64_t APS5_VABI lseek_nid_postfix(int d, int64_t offset, int whence);
+int APS5_VABI mkdir_nid_postfix(const char* path, uint16_t mode);
+int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
+int APS5_VABI creat_nid_postfix(const char* path, int mode);
+int APS5_VABI _open_nid_postfix(const char* path, int flags, ...);
+int64_t APS5_VABI pread_nid_postfix(int d, void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int d, const void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI read_nid_postfix(int d, void* buf, uint64_t nbytes);
+std::int64_t APS5_VABI _read_nid_postfix(int descriptor, void* buffer, std::size_t count);
+int64_t APS5_VABI write_nid_postfix(int d, const char* str, int64_t size);
+std::int64_t APS5_VABI _write_nid_postfix(int descriptor, const void* buffer, std::size_t count);
+int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
+int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb);
+int APS5_VABI unlink_nid_postfix(const char* path);
+int APS5_VABI sceKernelCheckReachability(const char* path);
+int APS5_VABI sceKernelFstat(int d, FileStat* sb);
+int APS5_VABI sceKernelFsync(int fd);
+int APS5_VABI sceKernelFdatasync(int fd);
+int APS5_VABI sceKernelWriteThrottlingStatus(std::uint64_t* status);
+int APS5_VABI sceKernelGetdirentries(int fd, char* buf, int nbytes, int64_t* basep);
+int APS5_VABI sceKernelGetdents(int fd, char* buf, int nbytes);
+int APS5_VABI getdirentries_nid_postfix(int fd, char* buf, int nbytes, int64_t* basep);
+int APS5_VABI _getdirentries_nid_postfix(int fd, char* buf, int nbytes, int64_t* basep);
+int APS5_VABI getdents_nid_postfix(int fd, char* buf, int nbytes);
+int APS5_VABI sceKernelMkdir(const char* path, uint16_t mode);
+int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t offset);
+int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int64_t APS5_VABI sceKernelPwritev(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int64_t APS5_VABI preadv_nid_postfix(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int64_t APS5_VABI pwritev_nid_postfix(int d, const KernelIovec* iov, int iovcnt, int64_t offset);
+int APS5_VABI sceKernelRename(const char* from, const char* to);
+int APS5_VABI sceKernelRmdir(const char* path);
+int APS5_VABI rmdir_nid_postfix(const char* path);
+int APS5_VABI sceKernelChmod_nid_postfix(const char* path, std::uint16_t mode);
+int APS5_VABI sceKernelFchmod(int d, std::uint16_t mode);
+int APS5_VABI fchmod_nid_postfix(int d, int mode);
+int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t length);
+int APS5_VABI truncate_nid_postfix(const char* path, std::int64_t length);
+int APS5_VABI sceKernelUtimes_nid_postfix(const char* path, const KernelTimeval* times);
+int APS5_VABI utimes_nid_postfix(const char* path, const KernelTimeval* times);
+int APS5_VABI lutimes_nid_postfix(const char* path, const KernelTimeval* times);
+int APS5_VABI sceKernelFutimes(int d, const KernelTimeval* times);
+int APS5_VABI futimes_nid_postfix(int d, const KernelTimeval* times);
+int APS5_VABI fsync_nid_postfix(int fd);
+int APS5_VABI fdatasync_nid_postfix(int fd);
+int64_t APS5_VABI readv_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI writev_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI _readv_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int64_t APS5_VABI _writev_nid_postfix(int d, const KernelIovec* iov, int iovcnt);
+int APS5_VABI cfsetspeed_nid_postfix(void* attributes, std::uint32_t speed);
+int APS5_VABI tcgetattr_nid_postfix(int descriptor, void* attributes);
+int APS5_VABI tcsetattr_nid_postfix(int descriptor, int action, const void* attributes);
+int APS5_VABI tcsendbreak_nid_postfix(int descriptor, int duration);
+int APS5_VABI tcdrain_nid_postfix(int descriptor);
+int APS5_VABI tcflush_nid_postfix(int descriptor, int queue);
+int APS5_VABI tcflow_nid_postfix(int descriptor, int action);
+int APS5_VABI tcgetpgrp_nid_postfix(int descriptor);
+int APS5_VABI tcsetpgrp_nid_postfix(int descriptor, int group);
+char* APS5_VABI dlerror_nid_postfix();
+void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
+void* APS5_VABI dlsym_nid_postfix(void* handle, const char* name);
+int APS5_VABI dlclose_nid_postfix(void* handle);
+int APS5_VABI sceKernelDlsym(KernelModule handle, const char* symbol, void** addr);
+int APS5_VABI sceKernelGetModuleInfoForUnwind(uint64_t addr, int flags, ModuleInfoForUnwind* info);
+KernelModule APS5_VABI sceKernelLoadStartModule(const char* moduleFileName, size_t args, const void* argp, uint32_t flags, const KernelLoadModuleOpt* opt, int* res);
+int APS5_VABI sceKernelStopUnloadModule(KernelModule handle, size_t args, const void* argp, uint32_t flags, const KernelUnloadModuleOpt* opt, int* res);
+int APS5_VABI __elf_phdr_match_addr_nid_postfix(dl_phdr_info* phdrInfo, void* addr);
+int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
+int APS5_VABI sceKernelGetModuleList(KernelModule* handles, std::size_t count, std::size_t* actual);
+int APS5_VABI sceKernelGetModuleList2(KernelModule* handles, std::size_t count, std::size_t* actual);
+int APS5_VABI sceKernelGetModuleInfo(KernelModule handle, ModuleInfo* info);
+int APS5_VABI sceKernelGetModuleInfo2(KernelModule handle, ModuleInfo* info);
+std::int32_t APS5_VABI sceKernelGetLibkernelTextLocation_nid_postfix(void** address, std::size_t* size);
+std::int32_t APS5_VABI sceKernelInternalMemoryGetModuleSegmentInfo_nid_postfix(InternalSegmentInfo* result);
+int APS5_VABI pthread_attr_destroy_nid_postfix(PthreadAttr* attr);
+int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr);
+int APS5_VABI pthread_attr_getdetachstate_nid_postfix(const PthreadAttr* attr, int* state);
+int APS5_VABI pthread_attr_getguardsize_nid_postfix(const PthreadAttr* attr, size_t* guardSize);
+int APS5_VABI pthread_attr_getinheritsched_nid_postfix(const PthreadAttr* attr, int* inheritSched);
+int APS5_VABI pthread_attr_getschedparam_nid_postfix(const PthreadAttr* attr, KernelSchedParam* param);
+int APS5_VABI pthread_attr_getschedpolicy_nid_postfix(const PthreadAttr* attr, int* policy);
+int APS5_VABI pthread_attr_getscope_nid_postfix(const PthreadAttr* attr, int* scope);
+int APS5_VABI pthread_attr_getstack_nid_postfix(const PthreadAttr* __restrict attr, void** __restrict stackAddr, size_t* __restrict stackSize);
+int APS5_VABI pthread_attr_getstackaddr_nid_postfix(const PthreadAttr* __restrict attr, void** __restrict stackAddr);
+int APS5_VABI pthread_attr_getstacksize_nid_postfix(const PthreadAttr* attr, size_t* stackSize);
+int APS5_VABI pthread_attr_init_nid_postfix(PthreadAttr* attr);
+int APS5_VABI pthread_attr_setdetachstate_nid_postfix(PthreadAttr* attr, int state);
+int APS5_VABI pthread_attr_setguardsize_nid_postfix(PthreadAttr* attr, size_t guardSize);
+int APS5_VABI pthread_attr_setinheritsched_nid_postfix(PthreadAttr* attr, int inheritSched);
+int APS5_VABI pthread_attr_setschedparam_nid_postfix(PthreadAttr* attr, const KernelSchedParam* param);
+int APS5_VABI pthread_attr_setschedpolicy_nid_postfix(PthreadAttr* attr, int policy);
+int APS5_VABI pthread_attr_setscope_nid_postfix(PthreadAttr* attr, int scope);
+int APS5_VABI pthread_attr_setstacksize_nid_postfix(PthreadAttr* attr, size_t stackSize);
+int APS5_VABI pthread_attr_setstack_nid_postfix(PthreadAttr* attr, void* stackAddr, size_t stackSize);
+int APS5_VABI pthread_attr_setsolosched_np_nid_postfix(PthreadAttr* attr, int solosched);
+int APS5_VABI pthread_barrierattr_init_nid_postfix(PthreadBarrierattrPrivate** attr);
+int APS5_VABI pthread_barrierattr_destroy_nid_postfix(PthreadBarrierattrPrivate** attr);
+int APS5_VABI pthread_barrierattr_getpshared_nid_postfix(PthreadBarrierattrPrivate* const* attr, int* pshared);
+int APS5_VABI pthread_barrierattr_setpshared_nid_postfix(PthreadBarrierattrPrivate** attr, int pshared);
+int APS5_VABI pthread_barrier_init_nid_postfix(PthreadBarrierPrivate** barrier, PthreadBarrierattrPrivate* const* attr, unsigned count);
+int APS5_VABI pthread_barrier_wait_nid_postfix(PthreadBarrierPrivate** barrier);
+int APS5_VABI pthread_barrier_destroy_nid_postfix(PthreadBarrierPrivate** barrier);
+int APS5_VABI pthread_cond_destroy_nid_postfix(PthreadCond* cond);
+int APS5_VABI pthread_cond_broadcast_nid_postfix(PthreadCond* cond);
+int APS5_VABI pthread_cond_init_nid_postfix(PthreadCond* cond, const PthreadCondattr* attr);
+int APS5_VABI pthread_cond_signal_nid_postfix(PthreadCond* cond);
+int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
+int APS5_VABI pthread_cond_reltimedwait_np_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, KernelUseconds usec);
+int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
+int APS5_VABI pthread_condattr_destroy_nid_postfix(PthreadCondattr* attr);
+int APS5_VABI pthread_condattr_init_nid_postfix(PthreadCondattr* attr);
+int APS5_VABI pthread_condattr_setclock_nid_postfix(PthreadCondattr* attr, KernelClockid clockId);
+int APS5_VABI pthread_condattr_setpshared_nid_postfix(PthreadCondattr* attr, int pshared);
+int APS5_VABI pthread_condattr_getpshared_nid_postfix(const PthreadCondattr* attr, int* pshared);
+int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
+int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_timedlock_nid_postfix(PthreadMutex* mutex, const KernelTimespec* abstime);
+int APS5_VABI pthread_mutex_trylock_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_reltimedlock_np_nid_postfix(PthreadMutex* mutex, KernelUseconds usec);
+int APS5_VABI pthread_mutex_isowned_np_nid_postfix(PthreadMutex* mutex);
+int APS5_VABI pthread_mutex_getspinloops_np_nid_postfix(PthreadMutex* mutex, int* count);
+int APS5_VABI pthread_mutex_setspinloops_np_nid_postfix(PthreadMutex* mutex, int count);
+int APS5_VABI pthread_mutex_getyieldloops_np_nid_postfix(PthreadMutex* mutex, int* count);
+int APS5_VABI pthread_mutex_setyieldloops_np_nid_postfix(PthreadMutex* mutex, int count);
+int APS5_VABI pthread_mutexattr_destroy_nid_postfix(PthreadMutexattr* attr);
+int APS5_VABI pthread_mutexattr_init_nid_postfix(PthreadMutexattr* attr);
+int APS5_VABI pthread_mutexattr_getpshared_nid_postfix(const PthreadMutexattr* attr, int* pshared);
+int APS5_VABI pthread_mutexattr_setpshared_nid_postfix(PthreadMutexattr* attr, int pshared);
+int APS5_VABI pthread_mutexattr_setprotocol_nid_postfix(PthreadMutexattr* attr, int protocol);
+int APS5_VABI pthread_mutexattr_getprotocol_nid_postfix(const PthreadMutexattr* attr, int* protocol);
+int APS5_VABI pthread_mutexattr_setprioceiling_nid_postfix(PthreadMutexattr* attr, int prioceiling);
+int APS5_VABI pthread_mutexattr_getprioceiling_nid_postfix(const PthreadMutexattr* attr, int* prioceiling);
+int APS5_VABI pthread_mutexattr_settype_nid_postfix(PthreadMutexattr* attr, int type);
+int APS5_VABI pthread_mutexattr_gettype_nid_postfix(const PthreadMutexattr* attr, int* type);
+int APS5_VABI pthread_once_nid_postfix( GuestOnce* control, void (APS5_VABI *initialize)());
+int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_init_nid_postfix(PthreadRwlock* rwlock, const PthreadRwlockattr* attr);
+int APS5_VABI pthread_rwlockattr_destroy_nid_postfix(PthreadRwlockattr* attr);
+int APS5_VABI pthread_rwlockattr_init_nid_postfix(PthreadRwlockattr* attr);
+int APS5_VABI pthread_rwlockattr_getpshared_nid_postfix(const PthreadRwlockattr* attr, int* pshared);
+int APS5_VABI pthread_rwlockattr_setpshared_nid_postfix(PthreadRwlockattr* attr, int pshared);
+int APS5_VABI pthread_rwlock_rdlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_timedrdlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
+int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
+int APS5_VABI pthread_rwlock_reltimedrdlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec);
+int APS5_VABI pthread_rwlock_reltimedwrlock_np_nid_postfix(PthreadRwlock* rwlock, KernelUseconds usec);
+int APS5_VABI pthread_rwlock_tryrdlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_trywrlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_unlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
+int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value);
+int APS5_VABI sem_destroy_nid_postfix(void* sem);
+int APS5_VABI sem_wait_nid_postfix(void* sem);
+int APS5_VABI sem_trywait_nid_postfix(void* sem);
+int APS5_VABI sem_timedwait_nid_postfix(void* sem, const KernelTimespec* abstime);
+int APS5_VABI sem_reltimedwait_np_nid_postfix(void* sem, uint32_t usec);
+int APS5_VABI sem_post_nid_postfix(void* sem);
+int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value);
+void* APS5_VABI sem_open_nid_postfix(const char* name, int flags, ...);
+int APS5_VABI sem_close_nid_postfix(void* sem);
+int APS5_VABI sem_unlink_nid_postfix(const char* name);
+int APS5_VABI pthread_spin_init_nid_postfix(PthreadSpinlockPrivate** lock, int pshared);
+int APS5_VABI pthread_spin_destroy_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI pthread_spin_trylock_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI pthread_spin_lock_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI pthread_spin_unlock_nid_postfix(PthreadSpinlockPrivate** lock);
+int APS5_VABI cpuset_getaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, void* mask);
+int APS5_VABI cpuset_setaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, const void* mask);
+int APS5_VABI rtprio_thread_nid_postfix(int function, int lwpid, GuestRtPrio* priority);
+int APS5_VABI pthread_setconcurrency_nid_postfix(int newLevel);
+int APS5_VABI pthread_getconcurrency_nid_postfix();
+int APS5_VABI pthread_create_nid_postfix(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg);
+int APS5_VABI pthread_create_name_np_nid_postfix(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
+int APS5_VABI pthread_detach_nid_postfix(Pthread thread);
+void APS5_VABI pthread_exit_nid_postfix(void* value);
+int APS5_VABI scePthreadGetschedparam(Pthread thread, int* policy, KernelSchedParam* param);
+int APS5_VABI scePthreadSetschedparam(Pthread thread, int policy, const KernelSchedParam* param);
+int APS5_VABI pthread_getschedparam_nid_postfix(Pthread thread, int* policy, KernelSchedParam* param);
+int APS5_VABI pthread_getprio_nid_postfix(Pthread thread);
+int APS5_VABI pthread_getaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, void* cpuset);
+int APS5_VABI pthread_setaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, const void* cpuset);
+int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** value);
+int APS5_VABI pthread_timedjoin_np_nid_postfix(Pthread thread, void** value, const KernelTimespec* abstime);
+int APS5_VABI pthread_rename_np_nid_postfix(Pthread thread, const char* name);
+int APS5_VABI pthread_getname_np_nid_postfix(Pthread thread, char* name);
+void APS5_VABI pthread_set_name_np_nid_postfix(Pthread thread, const char* name);
+Pthread APS5_VABI pthread_self_nid_postfix(void);
+int APS5_VABI pthread_getthreadid_np_nid_postfix(void);
+int APS5_VABI pthread_equal_nid_postfix(Pthread first, Pthread second);
+int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId);
+int APS5_VABI sched_yield_nid_postfix(void);
+int APS5_VABI pthread_cancel_nid_postfix(Pthread thread);
+int APS5_VABI pthread_setcancelstate_nid_postfix(int state, int* oldState);
+int APS5_VABI pthread_setcanceltype_nid_postfix(int type, int* oldType);
+int APS5_VABI pthread_setprio_nid_postfix(Pthread thread, int prio);
+int APS5_VABI pthread_setschedparam_nid_postfix(Pthread thread, int policy, const KernelSchedParam* param);
+void APS5_VABI pthread_testcancel_nid_postfix(void);
+void APS5_VABI pthread_yield_nid_postfix(void);
+unsigned int APS5_VABI sleep_nid_postfix(unsigned int seconds);
+void* APS5_VABI pthread_getspecific_nid_postfix(PthreadKey key);
+int APS5_VABI pthread_setspecific_nid_postfix(PthreadKey key, void* value);
+int APS5_VABI pthread_key_create_nid_postfix(PthreadKey* key, pthread_key_destructor_func_t destructor);
+int APS5_VABI pthread_key_delete_nid_postfix(PthreadKey key);
+int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
+int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
+int APS5_VABI scePthreadAttrSetdetachstate(PthreadAttr* attr, int detachstate);
+int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
+int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stacksize);
+int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** stackaddr, std::size_t* stacksize);
+int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
+int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
+int APS5_VABI scePthreadAttrGetdetachstate(const PthreadAttr* attr, int* state);
+int APS5_VABI scePthreadAttrGetguardsize(const PthreadAttr* attr, size_t* guardSize);
+int APS5_VABI scePthreadAttrGetinheritsched(const PthreadAttr* attr, int* inheritSched);
+int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
+int APS5_VABI scePthreadAttrGetschedpolicy(const PthreadAttr* attr, int* policy);
+int APS5_VABI scePthreadAttrGetsolosched(const PthreadAttr* attr, int* solosched);
+int APS5_VABI scePthreadAttrGetstackaddr(const PthreadAttr* attr, void** stackAddr);
+int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, size_t* stackSize);
+int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
+int APS5_VABI scePthreadAttrSetguardsize(PthreadAttr* attr, size_t guardSize);
+int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
+int APS5_VABI scePthreadAttrSetschedpolicy(PthreadAttr* attr, int policy);
+int APS5_VABI scePthreadAttrSetsolosched(PthreadAttr* attr, int solosched);
+int APS5_VABI scePthreadAttrSetstack(PthreadAttr* attr, void* addr, size_t size);
+int APS5_VABI scePthreadAttrSetstackaddr(PthreadAttr* attr, void* addr);
+int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
+int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
+int APS5_VABI scePthreadSemPost(PthreadSem* sem);
+int APS5_VABI scePthreadSemWait(PthreadSem* sem);
+int APS5_VABI scePthreadSemTrywait(PthreadSem* sem);
+int APS5_VABI scePthreadSemTimedwait(PthreadSem* sem, KernelUseconds usec);
+int APS5_VABI scePthreadSemGetvalue(PthreadSem* sem, int* value);
+int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
+int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
+int APS5_VABI scePthreadDetach(Pthread thread);
+Pthread APS5_VABI scePthreadSelf();
+void APS5_VABI scePthreadYield();
+int APS5_VABI scePthreadCancel(Pthread thread);
+int APS5_VABI scePthreadEqual(Pthread thread1, Pthread thread2);
+KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
+int APS5_VABI scePthreadGetaffinity(Pthread thread, KernelCpumask* mask);
+int APS5_VABI scePthreadGetname(Pthread thread, char* name);
+int APS5_VABI scePthreadGetprio(Pthread thread, int* prio);
+int APS5_VABI scePthreadGetthreadid(void);
+int APS5_VABI scePthreadRename(Pthread thread, const char* name);
+int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
+int APS5_VABI scePthreadSetcancelstate(int state, int* oldState);
+int APS5_VABI scePthreadSetcanceltype(int type, int* oldType);
+void APS5_VABI scePthreadTestcancel();
+int APS5_VABI scePthreadSetprio(Pthread thread, int prio);
+int APS5_VABI scePthreadOnce(int32_t* once, void (APS5_VABI* init)(void));
+void APS5_VABI __pthread_cxa_finalize_nid_postfix(void* argument);
+int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
+int APS5_VABI scePthreadKeyDelete(PthreadKey key);
+void* APS5_VABI scePthreadGetspecific(PthreadKey key);
+int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
+int APS5_VABI __inet_pton_nid_postfix(int family, const char* text, void* destination);
+const char* APS5_VABI __inet_ntop_nid_postfix(int family, const void* source, char* destination, std::uint32_t capacity);
+std::uint32_t APS5_VABI htonl_nid_postfix(std::uint32_t value);
+std::uint32_t APS5_VABI ntohl_nid_postfix(std::uint32_t value);
+std::uint16_t APS5_VABI htons_nid_postfix(std::uint16_t value);
+std::uint16_t APS5_VABI ntohs_nid_postfix(std::uint16_t value);
+int APS5_VABI pselect_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout, const void* sigmask);
+const char* APS5_VABI inet_ntop_nid_postfix(int af, const void* src, char* dst, uint32_t size);
+int APS5_VABI inet_pton_nid_postfix(int af, const char* src, void* dst);
+int APS5_VABI select_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout);
+int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
+int APS5_VABI _fcntl_nid_postfix(int descriptor, int command, ...);
+int APS5_VABI setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length);
+int APS5_VABI getsockopt_nid_postfix(int descriptor, int level, int option, void* value, std::uint32_t* length);
+int APS5_VABI socket_nid_postfix(int family, int type, int protocol);
+int APS5_VABI __sys_socketex_nid_postfix(const char* name, int family, int type, int protocol);
+int APS5_VABI socketpair_nid_postfix(int family, int type, int protocol, int* descriptors);
+int APS5_VABI connect_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI listen_nid_postfix(int descriptor, int backlog);
+int APS5_VABI accept_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+std::int64_t APS5_VABI send_nid_postfix(int descriptor, const void* buffer, std::uint64_t length, int flags);
+std::int64_t APS5_VABI recv_nid_postfix(int descriptor, void* buffer, std::uint64_t length, int flags);
+int APS5_VABI bind_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI shutdown_nid_postfix(int descriptor, int how);
+int APS5_VABI getsockname_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI getpeername_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI ioctl_nid_postfix(int descriptor, std::uint64_t request, void* argument);
+int APS5_VABI _ioctl_nid_postfix(int descriptor, std::uint64_t request, void* argument);
+std::int64_t APS5_VABI sendto_nid_postfix(int descriptor, const void* buffer, std::uint64_t length, int flags, const void* address, std::uint32_t addressLength);
+std::int64_t APS5_VABI recvfrom_nid_postfix(int descriptor, void* buffer, std::uint64_t length, int flags, void* address, std::uint32_t* addressLength);
+std::int64_t APS5_VABI sendmsg_nid_postfix(int descriptor, const GuestMsghdr* message, int flags);
+std::int64_t APS5_VABI recvmsg_nid_postfix(int descriptor, GuestMsghdr* message, int flags);
+int APS5_VABI sendfile_nid_postfix(int file, int descriptor, std::int64_t offset, std::uint64_t length, const GuestSendfileHeaders* headers, std::int64_t* sbytes, int flags);
+int APS5_VABI poll_nid_postfix(GuestPollDescriptor* descriptors, std::uint32_t count, int timeout);
+int APS5_VABI _setsockopt_nid_postfix(int descriptor, int level, int option, const void* value, std::uint32_t length);
+int APS5_VABI _getsockopt_nid_postfix(int descriptor, int level, int option, void* value, std::uint32_t* length);
+int APS5_VABI _connect_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI _listen_nid_postfix(int descriptor, int backlog);
+int APS5_VABI _accept_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI _bind_nid_postfix(int descriptor, const void* address, std::uint32_t length);
+int APS5_VABI _getsockname_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+int APS5_VABI _getpeername_nid_postfix(int descriptor, void* address, std::uint32_t* length);
+std::int64_t APS5_VABI _sendto_nid_postfix(int descriptor, const void* buffer, std::uint64_t length, int flags, const void* address, std::uint32_t addressLength);
+std::int64_t APS5_VABI _recvfrom_nid_postfix(int descriptor, void* buffer, std::uint64_t length, int flags, void* address, std::uint32_t* addressLength);
+std::int64_t APS5_VABI _sendmsg_nid_postfix(int descriptor, const GuestMsghdr* message, int flags);
+std::int64_t APS5_VABI _recvmsg_nid_postfix(int descriptor, GuestMsghdr* message, int flags);
+int APS5_VABI sceKernelSyncOnAddressWait(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait8(std::uint8_t* address, std::uint8_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait16(std::uint16_t* address, std::uint16_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait32(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWait64(std::uint64_t* address, std::uint64_t expected, const KernelUseconds* timeout, const char* name);
+int APS5_VABI sceKernelSyncOnAddressWake(void* address, std::int32_t count);
+int APS5_VABI _umtx_op_nid_postfix(void* object, int operation, std::uint64_t value, void* sizeArgument, void* timeArgument);
+int APS5_VABI sceCoredumpRegisterCoredumpHandler(uint64_t handler, size_t stackSize, uint64_t context);
+int APS5_VABI sceCoredumpUnregisterCoredumpHandler(void);
+int APS5_VABI sceKernelDebugWriteCppExceptionInfo(const void* exception, uint64_t unknown, const char* typeName, const char* what);
+int APS5_VABI sceCoredumpAttachUserFile(std::uint32_t userValue, const char* path);
+int APS5_VABI sceCoredumpGetStopInfoGpu_Agc(void* info, size_t size);
+int APS5_VABI sceCoredumpAttachMemoryRegionAsUserFile(std::uint32_t userValue, const void* mem, std::int32_t size, const char* name);
+int APS5_VABI sceCoredumpSetUserDataType(std::int32_t type);
+void APS5_VABI sceCoredumpDebugTextOut(const char* str, int len);
+int64_t APS5_VABI sceCoredumpWriteUserData(const void* data, size_t size);
+int APS5_VABI sceCoredumpGetStopInfoCpu(void* info, size_t size);
+int APS5_VABI sceCoredumpGetThreadContextInfo(void* threadContextInfo, size_t threadContextInfoSize);
+int APS5_VABI sceCoredumpWriteUserString(uint32_t first, const char* text, int third);
+int APS5_VABI sceCoredumpConfigDumpMode(int mode);
+int APS5_VABI sceCoredumpAttachUserMemoryFile(std::uint32_t userValue, const void* mem, std::int32_t size);
+int APS5_VABI sceCoredumpAttachMemoryRegion(std::uint32_t userValue, const void* mem, std::int32_t size);
+std::int32_t APS5_VABI sceKernelError(std::int32_t posixError);
+int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
+int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
+int APS5_VABI sceKernelRaiseException(Pthread thread, int signum);
+void APS5_VABI sceKernelDebugRaiseException(int c1, int c2);
+void APS5_VABI sceKernelDebugRaiseExceptionOnReleaseMode(int c1, int c2);
+int APS5_VABI getlogin_r_nid_postfix(char* output, int size);
+int APS5_VABI sceKernelDebugOutText(int channel, const char* text);
+int APS5_VABI sceKernelSendNotificationRequest(int device, const void* request, std::size_t size, int flags);
+int APS5_VABI getargc_nid_postfix(void);
+const char** APS5_VABI getargv_nid_postfix(void);
+int APS5_VABI getpagesize_nid_postfix(void);
+int APS5_VABI getpid_nid_postfix(void);
+int APS5_VABI getsid_nid_postfix(int pid);
+int APS5_VABI getppid_nid_postfix(void);
+int APS5_VABI sceKernelGetAppInfo(int pid, void* info);
+int APS5_VABI getuid_nid_postfix(void);
+int APS5_VABI geteuid_nid_postfix(void);
+int APS5_VABI getgid_nid_postfix(void);
+int APS5_VABI getegid_nid_postfix(void);
+int APS5_VABI issetugid_nid_postfix(void);
+int APS5_VABI getresuid_nid_postfix(std::uint32_t* ruid, std::uint32_t* euid, std::uint32_t* suid);
+int APS5_VABI getresgid_nid_postfix(std::uint32_t* rgid, std::uint32_t* egid, std::uint32_t* sgid);
+int APS5_VABI system_nid_postfix(const char* command);
+int APS5_VABI waitpid_nid_postfix(int pid, int* status, int options);
+int APS5_VABI setrlimit_nid_postfix(int resource, const GuestResourceLimit* limit);
+int APS5_VABI wait_nid_postfix(int* status);
+int APS5_VABI execvp_nid_postfix(const char* file, char* const* arguments);
+int APS5_VABI execv_nid_postfix(const char* path, char* const* arguments);
+int APS5_VABI execve_nid_postfix(const char* path, char* const* arguments, char* const* environment);
+int APS5_VABI sceKernelGetCurrentCpu(void);
+int APS5_VABI sceKernelGetMainSocId(void);
+int APS5_VABI sceKernelGetCpumode(void);
+std::uint64_t APS5_VABI sceKernelGetGPI(void);
+void APS5_VABI sceKernelSetGPO(std::uint32_t bits);
+int APS5_VABI sceKernelGetOpenPsId(void* openPsIdOutput);
+void* APS5_VABI sceKernelGetProcParam(void);
+int APS5_VABI sceKernelUuidCreate(std::uint32_t* uuid);
+int APS5_VABI sceKernelCreateUuidV4(std::uint8_t* uuid);
+void APS5_VABI sceKernelSync(void);
+void APS5_VABI sync_nid_postfix(void);
+int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
+int APS5_VABI sched_get_priority_min_nid_postfix(int policy);
+int APS5_VABI sysarch(int operation, void* parameters);
+int APS5_VABI getrusage_nid_postfix(int who, GuestResourceUsage* usage);
+int APS5_VABI getrlimit_nid_postfix(int resource, GuestResourceLimit* limit);
+int APS5_VABI getpriority_nid_postfix(int which, int who);
+int APS5_VABI setpriority_nid_postfix(int which, int who, int niceval);
+int APS5_VABI getdtablesize_nid_postfix(void);
+int APS5_VABI sceKernelIsTrinityMode(void);
+void APS5_VABI sceKernelGetOperationMode(int* mode, int* submode);
+int APS5_VABI seteuid_nid_postfix(std::uint32_t euid);
+int APS5_VABI setegid_nid_postfix(std::uint32_t egid);
+int APS5_VABI setuid_nid_postfix(std::uint32_t uid);
+int APS5_VABI setgid_nid_postfix(std::uint32_t gid);
+int APS5_VABI setreuid_nid_postfix(std::uint32_t ruid, std::uint32_t euid);
+int APS5_VABI setregid_nid_postfix(std::uint32_t rgid, std::uint32_t egid);
+int APS5_VABI setresuid_nid_postfix(std::uint32_t ruid, std::uint32_t euid, std::uint32_t suid);
+int APS5_VABI setresgid_nid_postfix(std::uint32_t rgid, std::uint32_t egid, std::uint32_t sgid);
+int APS5_VABI setgroups_nid_postfix(int count, const std::uint32_t* groups);
+int APS5_VABI getgroups_nid_postfix(int capacity, std::uint32_t* groups);
+void APS5_VABI sceKernelRtldSetApplicationHeapAPI(void* api[]);
+int APS5_VABI sceKernelRtldThreadAtexitDecrement(const void* dsoSymbol);
+int APS5_VABI sceKernelRtldThreadAtexitIncrement(const void* dsoSymbol);
+void APS5_VABI sceKernelSetThreadAtexitCount(get_thread_atexit_count_func_t func);
+void APS5_VABI sceKernelSetThreadAtexitReport(thread_atexit_report_func_t func);
+void APS5_VABI sceKernelSetThreadDtors(thread_dtors_func_t dtors);
+void APS5_VABI _sceKernelRtldSetApplicationHeapAPI_nid_postfix(void* api[]);
+int APS5_VABI _sceKernelRtldThreadAtexitDecrement_nid_postfix(const void* dsoSymbol);
+int APS5_VABI _sceKernelRtldThreadAtexitIncrement_nid_postfix(const void* dsoSymbol);
+void APS5_VABI _sceKernelSetThreadAtexitCount_nid_postfix(get_thread_atexit_count_func_t callback);
+void APS5_VABI _sceKernelSetThreadAtexitReport_nid_postfix(thread_atexit_report_func_t callback);
+void APS5_VABI _sceKernelSetThreadDtors_nid_postfix(thread_dtors_func_t callback);
+const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
+int APS5_VABI sceKernelIsAddressSanitizerEnabled(void);
+int APS5_VABI sceKernelIsThreadSanitizerEnabled(void);
+MallocReplace* APS5_VABI sceKernelGetSanitizerMallocReplaceExternal(void);
+NewReplace* APS5_VABI sceKernelGetSanitizerNewReplaceExternal(void);
+int APS5_VABI getitimer_nid_postfix(int which, GuestItimerval* output);
+int APS5_VABI setitimer_nid_postfix(int which, const GuestItimerval* value, GuestItimerval* previous);
+GuestHandler APS5_VABI signal_nid_postfix(int guest, GuestHandler handler);
+int APS5_VABI sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous);
+int APS5_VABI _sigaction_nid_postfix(int guest, const GuestSigaction* action, GuestSigaction* previous);
+int APS5_VABI raise_nid_postfix(int guest);
+int APS5_VABI kill_nid_postfix(int pid, int guest);
+int APS5_VABI killpg_nid_postfix(int pgrp, int guest);
+int APS5_VABI pthread_kill_nid_postfix(Pthread thread, int guest);
+int APS5_VABI sigaltstack_nid_postfix(const GuestStack* stack, GuestStack* previous);
+int APS5_VABI _sigprocmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet);
+int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
+int APS5_VABI pthread_sigmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet);
+int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet* set, void* info, const KernelTimespec* timeout);
+int APS5_VABI sigwaitinfo_nid_postfix(const GuestSignalSet* set, void* info);
+int APS5_VABI sigwait_nid_postfix(const GuestSignalSet* set, int* received);
+int APS5_VABI pause_nid_postfix(void);
+int APS5_VABI sigsuspend_nid_postfix(const GuestSignalSet* set);
+int APS5_VABI _sigsuspend_nid_postfix(const GuestSignalSet* set);
+int APS5_VABI sigpending_nid_postfix(GuestSignalSet* set);
+int APS5_VABI _is_signal_return_nid_postfix(std::uint64_t programCounter);
+int APS5_VABI sigemptyset_nid_postfix(GuestSignalSet* set);
+int APS5_VABI sigfillset_nid_postfix(GuestSignalSet* set);
+int APS5_VABI sigaddset_nid_postfix(GuestSignalSet* set, int signal);
+int APS5_VABI sigdelset_nid_postfix(GuestSignalSet* set, int signal);
+int APS5_VABI sigismember_nid_postfix(const GuestSignalSet* set, int signal);
+int APS5_VABI sceKernelGetProsperoSystemSwVersion_nid_postfix(SceKernelProsperoSystemSwVersion* version);
+int APS5_VABI sceKernelGetAllowedSdkVersionOnSystem_nid_postfix(std::uint32_t* version);
+std::int64_t APS5_VABI sysconf_nid_postfix(int name);
+int APS5_VABI sysctl_nid_postfix(const int* name, std::uint32_t nameLength, void* oldValue, std::size_t* oldLength, const void* newValue, std::size_t newLength);
+int APS5_VABI sysctlbyname_nid_postfix(const char* name, void* oldValue, std::size_t* oldLength, const void* newValue, std::size_t newLength);
+int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion* version);
+int APS5_VABI sysctlnametomib_nid_postfix(const char* name, int* mib, std::size_t* size);
+int APS5_VABI sceKernelGetCpuTemperature(int* outCelsius);
+int APS5_VABI sceKernelGetSocSensorTemperature(int sensorId, int* outCelsius);
+int APS5_VABI sceKernelGetSocPowerConsumption(void* consumption);
+int APS5_VABI setcontext_nid_postfix(const UserUcontext* context);
+int APS5_VABI ktimer_create_nid_postfix(int clock, const GuestSigevent* event, int* timerid);
+int APS5_VABI ktimer_delete_nid_postfix(int id);
+int APS5_VABI ktimer_settime_nid_postfix(int id, int flags, const GuestItimerspec* value, GuestItimerspec* oldValue);
+int APS5_VABI ktimer_gettime_nid_postfix(int id, GuestItimerspec* value);
+int APS5_VABI ktimer_getoverrun_nid_postfix(int id);
+int APS5_VABI _nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
+int APS5_VABI usleep_nid_postfix(KernelUseconds microseconds);
+int APS5_VABI clock_settime_nid_postfix(int clockId, const KernelTimespec* tp);
+int APS5_VABI sceKernelClockGetres(KernelClockid clockId, KernelTimespec* tp);
+int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
+int APS5_VABI sceKernelConvertLocaltimeToUtc(int64_t localTime, int64_t reserved, int64_t* utcTime, KernelTimesec* timezone, int32_t* dstSeconds);
+int APS5_VABI sceKernelConvertUtcToLocaltime(int64_t utcTime, int64_t* localTime, KernelTimesec* st, int32_t* dstSec);
+int APS5_VABI sceKernelGettimeofday(KernelTimeval* tp);
+int APS5_VABI sceKernelGettimezone(KernelTimezone* tz);
+uint64_t APS5_VABI sceKernelReadTsc(void);
+std::int64_t APS5_VABI sceKernelGetCpuFrequency(void);
+unsigned int APS5_VABI sceKernelSleep(unsigned int seconds);
+
+[[noreturn]] void APS5_VABI _exit_nid_postfix(int status);
+
+[[gnu::returns_twice]] int APS5_VABI getcontext_nid_postfix(UserUcontext* context);
+
+[[gnu::returns_twice]] int APS5_VABI sigsetjmp_nid_postfix(std::uint64_t* buffer, int saveMask);
+[[noreturn]] void APS5_VABI siglongjmp_nid_postfix(std::uint64_t* buffer, int value);
+
+int APS5_VABI sceKernelGetTraceMemoryStats(std::uint64_t* first, std::uint64_t* second);
+int APS5_VABI pthread_cond_signalto_np_nid_postfix(PthreadCond* cond, Pthread thread);
+int APS5_VABI scePthreadCondattrSetpshared(PthreadCondattr* attr, int pshared);
+int APS5_VABI scePthreadCondattrGetpshared(const PthreadCondattr* attr, int* pshared);
+int APS5_VABI pthread_mutexattr_setkind_np_nid_postfix(PthreadMutexattr* attr, int kind);
+int APS5_VABI pthread_mutexattr_getkind_np_nid_postfix(PthreadMutexattr attr);
+int APS5_VABI scePthreadMutexattrGettype(const PthreadMutexattr* attr, int* type);
+int APS5_VABI scePthreadMutexattrGetprotocol(const PthreadMutexattr* attr, int* protocol);
+int APS5_VABI scePthreadMutexattrSetprioceiling(PthreadMutexattr* attr, int prioceiling);
+int APS5_VABI scePthreadMutexattrGetprioceiling(const PthreadMutexattr* attr, int* prioceiling);
+int APS5_VABI scePthreadMutexattrSetpshared(PthreadMutexattr* attr, int pshared);
+int APS5_VABI scePthreadMutexattrGetpshared(const PthreadMutexattr* attr, int* pshared);
+int APS5_VABI pthread_rwlockattr_gettype_np_nid_postfix(const PthreadRwlockattr* attr, int* type);
+int APS5_VABI scePthreadRwlockattrGettype(const PthreadRwlockattr* attr, int* type);
+int APS5_VABI scePthreadRwlockattrSetpshared(PthreadRwlockattr* attr, int pshared);
+int APS5_VABI scePthreadRwlockattrGetpshared(const PthreadRwlockattr* attr, int* pshared);
+int APS5_VABI setpgid_nid_postfix(int pid, int pgid);
+int APS5_VABI setpgrp_nid_postfix(int pid, int pgrp);
+int APS5_VABI sceKernelGetSystemExVersion(char* first, char* second);
+int APS5_VABI sysKernelGetLowerLimitSysexVersion_nid_postfix(char* version);
+int APS5_VABI sysKernelGetLowerLimitUpdVersion_nid_postfix(std::uint32_t* version);
+
+}
diff --git a/core/libs/prx/libkernel/libkernel.hpp b/core/libs/prx/libkernel/libkernel.hpp
new file mode 100644
index 0000000000..3a32592846
--- /dev/null
+++ b/core/libs/prx/libkernel/libkernel.hpp
@@ -0,0 +1,14 @@
+#pragma once
+
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
diff --git a/core/libs/prx/libkernel_sys/Aio.cpp b/core/libs/prx/libkernel_sys/Aio.cpp
new file mode 100644
index 0000000000..f81b5842de
--- /dev/null
+++ b/core/libs/prx/libkernel_sys/Aio.cpp
@@ -0,0 +1,314 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include <algorithm>
+#include <chrono>
+#include <condition_variable>
+#include <cstddef>
+#include <cstdint>
+#include <deque>
+#include <limits>
+#include <list>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <thread>
+
+#include "SceTypes.hpp"
+#include "prx/libc/include/General.hpp"
+
+namespace {
+
+constexpr int GuestEbadf = 9;
+constexpr int GuestEfault = 14;
+constexpr int GuestEinval = 22;
+constexpr int GuestEagain = 35;
+constexpr int GuestEinprogress = 36;
+constexpr int GuestEopnotsupp = 45;
+constexpr int GuestEcanceled = 85;
+constexpr int LioWrite = 1;
+constexpr int LioRead = 2;
+constexpr int LioSync = 3;
+constexpr int AioCanceled = 1;
+constexpr int AioNotCanceled = 2;
+constexpr int AioAllDone = 3;
+constexpr int SigevNone = 0;
+constexpr int SigevSignal = 1;
+constexpr int SigevKevent = 3;
+constexpr int SigevThreadId = 4;
+constexpr int SignalMax = 128;
+constexpr int GuestOSync = 0x80;
+constexpr int GetFlags = 3;
+constexpr int AccessMode = 3;
+constexpr int WriteOnly = 1;
+constexpr int ReadWrite = 2;
+constexpr std::uint16_t TypeMask = 0170000;
+constexpr std::uint16_t TypeFifo = 0010000;
+constexpr std::uint16_t TypeDirectory = 0040000;
+constexpr std::uint16_t TypeRegular = 0100000;
+constexpr std::uint16_t TypeSocket = 0140000;
+constexpr std::size_t QueuePerProcess = 256;
+constexpr std::uint64_t IoSizeMax = std::numeric_limits<int>::max();
+constexpr std::int64_t NanosecondsPerSecond = 1000000000;
+constexpr std::int64_t TickNanoseconds = 1000000;
+
+static_assert(offsetof(GuestAiocb, lioOpcode) == 48 && offsetof(GuestAiocb, status) == 56 && offsetof(GuestAiocb, sigevent) == 80);
+static_assert(sizeof(GuestAiocb) == 160);
+
+enum class State { Queued, Running, Done };
+
+struct Job {
+    GuestAiocb* user;
+    int descriptor;
+    int opcode;
+    std::int64_t offset;
+    void* buffer;
+    std::uint64_t bytes;
+    State state = State::Queued;
+    std::int64_t status = -1;
+    int error = 0;
+};
+
+struct Aio {
+    std::mutex lock;
+    std::condition_variable changed;
+    bool used = false;
+    bool held = false;
+    bool started = false;
+    std::intptr_t nextId = 0;
+    std::deque<std::shared_ptr<Job>> queued;
+    std::list<std::shared_ptr<Job>> all;
+    std::list<std::shared_ptr<Job>> done;
+};
+
+Aio& Instance() {
+    static auto* aio = new Aio;
+    return *aio;
+}
+
+int Fail(int error) {
+    *__error_nid_postfix() = error;
+    return -1;
+}
+
+void Run(Job& job) {
+    std::int64_t result = 0;
+    if (job.opcode == LioRead) result = job.bytes == 0 ? 0 : pread_nid_postfix(job.descriptor, job.buffer, job.bytes, job.offset);
+    else if (job.opcode == LioWrite) result = pwrite_nid_disambig1_nid_postfix(job.descriptor, job.buffer, job.bytes, job.offset);
+    else result = fsync_nid_postfix(job.descriptor);
+    job.status = result < 0 ? -1 : result;
+    job.error = result < 0 ? *__error_nid_postfix() : 0;
+}
+
+void Worker() {
+    auto& aio = Instance();
+    std::unique_lock lock(aio.lock);
+    for (;;) {
+        aio.changed.wait(lock, [&] { return !aio.held && !aio.queued.empty(); });
+        auto job = aio.queued.front();
+        aio.queued.pop_front();
+        job->state = State::Running;
+        lock.unlock();
+        Run(*job);
+        lock.lock();
+        job->state = State::Done;
+        aio.done.push_back(job);
+        aio.changed.notify_all();
+    }
+}
+
+void Complete(Aio& aio, const std::shared_ptr<Job>& job, std::int64_t status, int error) {
+    job->status = status;
+    job->error = error;
+    job->state = State::Done;
+    aio.done.push_back(job);
+    aio.changed.notify_all();
+}
+
+std::optional<int> ReadyError(const std::shared_ptr<Job>& job) {
+    if (job->state != State::Done) return std::nullopt;
+    return job->error;
+}
+
+std::int64_t Consume(Aio& aio, std::list<std::shared_ptr<Job>>::iterator found) {
+    const auto job = *found;
+    aio.done.erase(found);
+    aio.all.remove(job);
+    job->user->error = job->error;
+    job->user->status = job->status;
+    return job->error != 0 ? Fail(job->error) : job->status;
+}
+
+std::optional<std::chrono::nanoseconds> WaitTime(const KernelTimespec& time) {
+    if (time.tv_sec < 0 || time.tv_nsec < 0 || time.tv_nsec >= NanosecondsPerSecond) return std::nullopt;
+    const auto microseconds = time.tv_nsec / 1000;
+    const std::int64_t whole = microseconds * 1000;
+    const std::int64_t rounded = time.tv_sec == 0 && whole < TickNanoseconds ? TickNanoseconds : whole;
+    const auto seconds = std::min<std::int64_t>(time.tv_sec, std::chrono::duration_cast<std::chrono::seconds>(std::chrono::hours(24 * 365)).count());
+    return std::chrono::seconds(seconds) + std::chrono::nanoseconds(rounded);
+}
+
+int Queue(GuestAiocb* user, int opcode) {
+    if (user == nullptr) return Fail(GuestEfault);
+    auto& aio = Instance();
+    std::unique_lock lock(aio.lock);
+    aio.used = true;
+    user->status = -1;
+    user->error = 0;
+    user->kernelinfo = reinterpret_cast<void*>(std::intptr_t{-1});
+    const auto fail = [&](int error) {
+        user->error = error;
+        return Fail(error);
+    };
+    if (aio.all.size() >= QueuePerProcess) return fail(GuestEagain);
+    const GuestAiocb request = *user;
+    if (request.nbytes > IoSizeMax) return Fail(GuestEinval);
+    const int notify = request.sigevent.notify;
+    if (notify != SigevKevent && notify != SigevSignal && notify != SigevThreadId && notify != SigevNone) return fail(GuestEinval);
+    if ((notify == SigevSignal || notify == SigevThreadId) && (request.sigevent.signo <= 0 || request.sigevent.signo > SignalMax))
+        return Fail(GuestEinval);
+    const int flags = fcntl_nid_postfix(request.fildes, GetFlags);
+    if (flags < 0) return fail(GuestEbadf);
+    const int access = flags & AccessMode;
+    if (opcode == LioRead && access != 0 && access != ReadWrite) return fail(GuestEbadf);
+    if (opcode == LioWrite && access != WriteOnly && access != ReadWrite) return fail(GuestEbadf);
+    FileStat status{};
+    if (_fstat_nid_postfix(request.fildes, &status) != 0) return fail(GuestEbadf);
+    const auto type = static_cast<std::uint16_t>(status.st_mode & TypeMask);
+    if (type == TypeSocket) NotImplemented_nid_no_patch("aio on a socket");
+    const bool vnode = type != 0 && type != TypeFifo;
+    if (opcode == LioSync && !vnode) return fail(GuestEinval);
+    if (opcode != LioSync && request.offset < 0) return fail(GuestEinval);
+    user->kernelinfo = reinterpret_cast<void*>(aio.nextId++);
+    if (notify != SigevNone) NotImplemented_nid_no_patch("aio completion delivering a signal or a kevent");
+    user->error = GuestEinprogress;
+    if (type != TypeRegular && type != TypeDirectory) return fail(GuestEopnotsupp);
+    auto job = std::make_shared<Job>(Job{user, request.fildes, opcode, request.offset, request.buf, request.nbytes});
+    aio.all.push_back(job);
+    aio.queued.push_back(job);
+    if (!aio.started) {
+        aio.started = true;
+        std::thread(Worker).detach();
+    }
+    aio.changed.notify_all();
+    return 0;
+}
+
+}
+
+extern "C" {
+
+void AioHoldWorkerForTest_nid_no_patch(bool hold) {
+    auto& aio = Instance();
+    std::lock_guard lock(aio.lock);
+    aio.held = hold;
+    aio.changed.notify_all();
+}
+
+int APS5_VABI aio_read_nid_postfix(GuestAiocb* aiocb) {
+    return Queue(aiocb, LioRead);
+}
+
+int APS5_VABI aio_write_nid_postfix(GuestAiocb* aiocb) {
+    return Queue(aiocb, LioWrite);
+}
+
+int APS5_VABI aio_fsync_nid_postfix(int operation, GuestAiocb* aiocb) {
+    if (operation != GuestOSync) return Fail(GuestEinval);
+    return Queue(aiocb, LioSync);
+}
+
+int APS5_VABI aio_error_nid_postfix(const GuestAiocb* aiocb) {
+    auto& aio = Instance();
+    std::lock_guard lock(aio.lock);
+    if (!aio.used || aiocb == nullptr) return GuestEinval;
+    for (const auto& job : aio.all) {
+        if (job->user == aiocb) return ReadyError(job).value_or(GuestEinprogress);
+    }
+    if (aiocb->status == -1) return static_cast<int>(aiocb->error);
+    return GuestEinval;
+}
+
+std::int64_t APS5_VABI aio_return_nid_postfix(GuestAiocb* aiocb) {
+    auto& aio = Instance();
+    std::lock_guard lock(aio.lock);
+    if (!aio.used) return Fail(GuestEinval);
+    for (auto job = aio.done.begin(); job != aio.done.end(); ++job) {
+        if ((*job)->user == aiocb) return Consume(aio, job);
+    }
+    return Fail(GuestEinval);
+}
+
+int APS5_VABI aio_suspend_nid_postfix(const GuestAiocb* const* list, int count, const KernelTimespec* timeout) {
+    if (count < 0 || count > static_cast<int>(QueuePerProcess)) return Fail(GuestEinval);
+    std::optional<std::chrono::nanoseconds> wait;
+    if (timeout != nullptr) {
+        wait = WaitTime(*timeout);
+        if (!wait) return Fail(GuestEinval);
+    }
+    auto& aio = Instance();
+    std::unique_lock lock(aio.lock);
+    if (!aio.used) return Fail(GuestEagain);
+    if (count == 0) return 0;
+    for (;;) {
+        bool listed = false;
+        for (const auto& job : aio.all) {
+            for (int index = 0; index < count; ++index) {
+                if (job->user != list[index]) continue;
+                listed = true;
+                if (job->state == State::Done) return 0;
+            }
+        }
+        if (!listed) return 0;
+        if (!wait) aio.changed.wait(lock);
+        else if (aio.changed.wait_for(lock, *wait) == std::cv_status::timeout) return Fail(GuestEagain);
+    }
+}
+
+std::int64_t APS5_VABI aio_waitcomplete_nid_postfix(GuestAiocb** result, const KernelTimespec* timeout) {
+    if (result != nullptr) *result = nullptr;
+    std::optional<std::chrono::nanoseconds> wait;
+    bool poll = false;
+    if (timeout != nullptr) {
+        poll = timeout->tv_sec == 0 && timeout->tv_nsec == 0;
+        if (!poll) {
+            wait = WaitTime(*timeout);
+            if (!wait) return Fail(GuestEinval);
+        }
+    }
+    auto& aio = Instance();
+    std::unique_lock lock(aio.lock);
+    aio.used = true;
+    while (aio.done.empty()) {
+        if (poll) return Fail(GuestEagain);
+        if (!wait) aio.changed.wait(lock);
+        else if (aio.changed.wait_for(lock, *wait) == std::cv_status::timeout && aio.done.empty()) return Fail(GuestEagain);
+    }
+    if (result != nullptr) *result = aio.done.front()->user;
+    return Consume(aio, aio.done.begin());
+}
+
+int APS5_VABI aio_cancel_nid_postfix(int descriptor, GuestAiocb* aiocb) {
+    if (fcntl_nid_postfix(descriptor, GetFlags) < 0) return Fail(GuestEbadf);
+    auto& aio = Instance();
+    std::lock_guard lock(aio.lock);
+    int cancelled = 0;
+    int notCancelled = 0;
+    for (const auto& job : std::list<std::shared_ptr<Job>>(aio.all)) {
+        if (job->state == State::Done || job->descriptor != descriptor || (aiocb != nullptr && job->user != aiocb)) continue;
+        if (job->state == State::Queued) {
+            std::erase(aio.queued, job);
+            Complete(aio, job, -1, GuestEcanceled);
+            ++cancelled;
+        } else {
+            ++notCancelled;
+        }
+        if (aiocb != nullptr) break;
+    }
+    if (aiocb != nullptr && cancelled != 0) return AioCanceled;
+    if (notCancelled != 0) return AioNotCanceled;
+    if (cancelled != 0) return AioCanceled;
+    return AioAllDone;
+}
+
+}
diff --git a/core/libs/prx/libkernel_sys/CMakeLists.txt b/core/libs/prx/libkernel_sys/CMakeLists.txt
index 6938d0c456..8aead464a0 100644
--- a/core/libs/prx/libkernel_sys/CMakeLists.txt
+++ b/core/libs/prx/libkernel_sys/CMakeLists.txt
@@ -1,3 +1,3 @@
-add_library(${LIB_NAME} SHARED EXCLUDE_FROM_ALL Export.cpp Export.Discovery.cpp)
+add_library(${LIB_NAME} SHARED EXCLUDE_FROM_ALL Export.cpp Export.Discovery.cpp Aio.cpp)
 target_include_directories(${LIB_NAME} PRIVATE ${LIBS_INCLUDE_DIR})
 configure_windows_unwind(${LIB_NAME})
diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index 702eff446b..8fb821d7c1 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -1,48 +1,22 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/KernelErrors.hpp"
+#include <cstddef>
+
+namespace {
+
+int SceResult(int error) {
+    return error == 0 ? 0 : SceKernelError(error);
+}
+
+}
 
 extern "C" {
 
-int APS5_VABI aio_cancel_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_error_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_fsync_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_read_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_return_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_suspend_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_waitcomplete_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI aio_write_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI amd64_set_fsbase_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -68,11 +42,6 @@ int APS5_VABI blockpool_unmap_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI chown_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI cpuset_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -93,16 +62,6 @@ int APS5_VABI dynlib_get_obj_member_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI fchownat_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI fstat_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI futimesat_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -278,31 +237,6 @@ int APS5_VABI ksem_wait_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI ktimer_create_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ktimer_delete_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ktimer_getoverrun_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ktimer_gettime_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI ktimer_settime_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ktrace_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -313,21 +247,6 @@ int APS5_VABI lchflags_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI lchmod_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI lchown_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI linkat_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI mdbg_call_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -353,11 +272,6 @@ int APS5_VABI profil_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pselect_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI pthread_attr_getaffinity_np_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -463,16 +377,6 @@ int APS5_VABI pthread_resume_user_context_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_rwlock_reltimedrdlock_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI pthread_rwlock_reltimedwrlock_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI pthread_rwlock_setname_np_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -518,11 +422,6 @@ int APS5_VABI pthread_switch_delete_np_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI pthread_timedjoin_np_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI ptrace_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -683,11 +582,6 @@ int APS5_VABI sceKernelCloseEport(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelCloseEventFlag(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelCloseSema(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -933,11 +827,6 @@ int APS5_VABI sceKernelGetChildApp(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetCompiledSdkVersion(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetCompiledSdkVersionByPath(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1103,16 +992,6 @@ int APS5_VABI sceKernelGetMemoryPstate(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetModuleInfoInternal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sceKernelGetModuleListInternal(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetOpenPsIdForSystem(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1143,11 +1022,6 @@ int APS5_VABI sceKernelGetProcessName(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetProcessType(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetProcessTypeOfBudget(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1263,11 +1137,6 @@ int APS5_VABI sceKernelGetSubsysSubId(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetSystemExVersion(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetSystemLevelDebuggerModeForRcmgr(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1283,11 +1152,6 @@ int APS5_VABI sceKernelGetThreadName(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetTraceMemoryStats(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetUniversalMode(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -1733,9 +1597,8 @@ int APS5_VABI sceKernelMlockall(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelMsync(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceKernelMsync(void* address, std::size_t length, int flags) {
+    return msync_nid_postfix(address, length, flags) == 0 ? 0 : SceKernelError(*__error_nid_postfix());
 }
 
 int APS5_VABI sceKernelNormalizePath(void) {
@@ -2143,11 +2006,6 @@ int APS5_VABI sceKernelTerminateSysCore(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelTitleWorkaroundIsEnabled(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelTitleWorkdaroundIsEnabled(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2283,14 +2141,12 @@ int APS5_VABI sceLibcMspaceCreateForMonoMutex(void) {
     return 0;
 }
 
-int APS5_VABI scePthreadAtfork(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadAtfork(void (APS5_VABI* prepare)(), void (APS5_VABI* parent)(), void (APS5_VABI* child)()) {
+    return SceResult(pthread_atfork_nid_postfix(prepare, parent, child));
 }
 
-int APS5_VABI scePthreadAttrGetscope(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadAttrGetscope(const PthreadAttr* attr, int* scope) {
+    return SceResult(pthread_attr_getscope_nid_postfix(attr, scope));
 }
 
 int APS5_VABI scePthreadAttrSetcreatesuspend(void) {
@@ -2298,59 +2154,46 @@ int APS5_VABI scePthreadAttrSetcreatesuspend(void) {
     return 0;
 }
 
-int APS5_VABI scePthreadAttrSetscope(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadAttrSetscope(PthreadAttr* attr, int scope) {
+    return SceResult(pthread_attr_setscope_nid_postfix(attr, scope));
 }
 
-int APS5_VABI scePthreadBarrierDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierDestroy(PthreadBarrierPrivate** barrier) {
+    return SceResult(pthread_barrier_destroy_nid_postfix(barrier));
 }
 
-int APS5_VABI scePthreadBarrierInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierInit(PthreadBarrierPrivate** barrier, PthreadBarrierattrPrivate* const* attr, unsigned count, const char* name) {
+    (void)name;
+    return SceResult(pthread_barrier_init_nid_postfix(barrier, attr, count));
 }
 
-int APS5_VABI scePthreadBarrierWait(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierWait(PthreadBarrierPrivate** barrier) {
+    const int result = pthread_barrier_wait_nid_postfix(barrier);
+    return result > 0 ? SceKernelError(result) : result;
 }
 
-int APS5_VABI scePthreadBarrierattrDestroy(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierattrDestroy(PthreadBarrierattrPrivate** attr) {
+    return SceResult(pthread_barrierattr_destroy_nid_postfix(attr));
 }
 
-int APS5_VABI scePthreadBarrierattrGetpshared(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierattrGetpshared(PthreadBarrierattrPrivate* const* attr, int* pshared) {
+    return SceResult(pthread_barrierattr_getpshared_nid_postfix(attr, pshared));
 }
 
-int APS5_VABI scePthreadBarrierattrInit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierattrInit(PthreadBarrierattrPrivate** attr) {
+    return SceResult(pthread_barrierattr_init_nid_postfix(attr));
 }
 
-int APS5_VABI scePthreadBarrierattrSetpshared(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI scePthreadCondattrGetclock(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadBarrierattrSetpshared(PthreadBarrierattrPrivate** attr, int pshared) {
+    return SceResult(pthread_barrierattr_setpshared_nid_postfix(attr, pshared));
 }
 
 int APS5_VABI scePthreadGetconcurrency(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    return pthread_getconcurrency_nid_postfix();
 }
 
-int APS5_VABI scePthreadGetcpuclockid(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadGetcpuclockid(Pthread thread, int* clockId) {
+    return SceResult(pthread_getcpuclockid_nid_postfix(thread, clockId));
 }
 
 int APS5_VABI scePthreadMain(void) {
@@ -2423,9 +2266,8 @@ int APS5_VABI scePthreadSetBesteffort(void) {
     return 0;
 }
 
-int APS5_VABI scePthreadSetconcurrency(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI scePthreadSetconcurrency(int level) {
+    return SceResult(pthread_setconcurrency_nid_postfix(level));
 }
 
 int APS5_VABI scePthreadSingle(void) {
@@ -2458,11 +2300,6 @@ int APS5_VABI sched_getscheduler_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI sched_rr_get_interval_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sched_setparam_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2473,26 +2310,11 @@ int APS5_VABI sched_setscheduler_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI sem_close_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sem_open_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sem_setname_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sem_unlink_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI set_phys_fmem_limit_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -2548,16 +2370,6 @@ int APS5_VABI sysKernelGetIntdevModeForRcmgr_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI sysKernelGetLowerLimitSysexVersion_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
-int APS5_VABI sysKernelGetLowerLimitUpdVersion_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sysKernelGetManufacturingMode_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index a3beeb2fe6..3c47113b4f 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cstdarg>
 #include <cstdint>
@@ -11,6 +14,7 @@
 #include <string_view>
 #include <system_error>
 #include <sys/stat.h>
+#include <ctime>
 #ifndef _WIN32
 #include <cerrno>
 #include <fcntl.h>
@@ -19,11 +23,16 @@
 #endif
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libkernel/KernelErrors.hpp"
 #include "prx/libc/include/FilesystemError.hpp"
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
+#include "prx/libkernel/File/include/DescriptorControl.hpp"
 #include "prx/libc/include/CreationMask.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
-#include "prx/libkernel/KernelErrors.hpp"
+
 #ifdef _WIN32
 #ifndef NOMINMAX
 #define NOMINMAX
@@ -37,17 +46,16 @@
 #endif
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 #ifdef _WIN32
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 static void IgnoreInvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {}
-static int GuestFstat(int fd) {
+static int GuestFstat(int fd, bool* withoutVnode = nullptr) {
     const auto previous = _set_thread_local_invalid_parameter_handler(IgnoreInvalidParameter);
     struct _stat64 status{};
     const int result = ::_fstat64(fd, &status);
     _set_thread_local_invalid_parameter_handler(previous);
+    if (result == 0 && withoutVnode != nullptr) *withoutVnode = (status.st_mode & _S_IFMT) == _S_IFIFO;
     return result;
 }
 #endif
@@ -91,6 +99,7 @@ constexpr int PcRecXferAlign = 17;
 constexpr int PcSymlinkMax = 18;
 constexpr int PcMinHoleSize = 21;
 constexpr int PcAsyncIo = 53;
+constexpr std::int64_t PosixAsynchronousIo = 200112;
 constexpr int PcPrioIo = 54;
 constexpr int PcSyncIo = 55;
 constexpr int PcAclExtended = 59;
@@ -98,6 +107,7 @@ constexpr int PcAclPathMax = 60;
 constexpr int PcMacPresent = 63;
 constexpr int PcAclNfs4 = 64;
 constexpr int GuestAtSymlinkNofollow = 0x0200;
+constexpr int GuestAtSymlinkFollow = 0x0400;
 
 int GuestFileError(int error) {
     switch (error) {
@@ -121,6 +131,37 @@ std::int64_t Fail(int error) {
     return -1;
 }
 
+std::int64_t PathConfigurationValue(int name, const char* function) {
+    switch (name) {
+    case PcLinkMax: return 32767;
+    case PcNameMax: return static_cast<std::int64_t>(GuestNameMax);
+    case PcPathMax: return static_cast<std::int64_t>(GuestPathMax);
+    case PcPipeBuf: return 512;
+    case PcChownRestricted: return 1;
+    case PcNoTrunc: return 1;
+    case PcFileSizeBits: return 64;
+    case PcRecMaxXferSize: return -1;
+    case PcSymlinkMax: return static_cast<std::int64_t>(GuestPathMax);
+    case PcPrioIo: return 0;
+    case PcSyncIo: return 0;
+    case PcMaxCanon:
+    case PcMaxInput:
+    case PcVdisable:
+    case PcAllocSizeMin:
+    case PcRecIncrXferSize:
+    case PcRecMinXferSize:
+    case PcRecXferAlign:
+    case PcMinHoleSize:
+    case PcAsyncIo:
+    case PcAclExtended:
+    case PcAclPathMax:
+    case PcMacPresent:
+    case PcAclNfs4:
+        throw std::runtime_error(std::string(function) + ": name " + std::to_string(name) + " depends on the console filesystem or kernel configuration");
+    default: return Fail(GuestEinval);
+    }
+}
+
 int GuestError(const std::error_code& error) {
     const auto condition = error.default_error_condition();
     if (condition == std::errc::resource_unavailable_try_again) return GuestEagain;
@@ -149,6 +190,22 @@ bool HasNonDirectoryPrefix(const std::filesystem::path& native) {
     return false;
 }
 
+void RequireGuestOwner(const char* call, std::uint32_t uid, std::uint32_t gid) {
+    constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
+    if (uid != 0 && uid != Unchanged) NotImplemented_nid_no_patch((std::string(call) + ": an owner other than the guest user").c_str());
+    if (gid != 0 && gid != Unchanged) NotImplemented_nid_no_patch((std::string(call) + ": a group other than the guest group").c_str());
+}
+
+bool IsSymbolicLink(const std::filesystem::path& native) {
+#ifdef _WIN32
+    const DWORD attributes = GetFileAttributesW(native.wstring().c_str());
+    return attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0;
+#else
+    std::error_code error;
+    return std::filesystem::is_symlink(std::filesystem::symlink_status(native, error));
+#endif
+}
+
 std::int64_t ReadNativeLink(const std::filesystem::path& native, char* buffer, std::size_t size) {
 #ifdef _WIN32
     const DWORD attributes = GetFileAttributesW(native.wstring().c_str());
@@ -254,6 +311,13 @@ int RenamePath(const std::filesystem::path& source, const std::filesystem::path&
 
 extern "C" {
 
+int APS5_VABI sceKernelGetCompiledSdkVersion(std::int32_t* version) {
+    if (version == nullptr) return SCE_KERNEL_ERROR_EINVAL;
+    static const auto* parameters = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::memcpy(version, parameters + 0x10, sizeof(*version));
+    return 0;
+}
+
 int APS5_VABI fork_nid_postfix(void) {
     NotImplemented_nid_no_patch("fork: child processes");
     return -1;
@@ -267,12 +331,24 @@ std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask) {
     return File::ExchangeCreationMask_nid_no_patch(mask);
 }
 
-int APS5_VABI _fstatfs_nid_postfix(int d, void* buf);
-
-int APS5_VABI fstatfs_nid_postfix(int d, void* buf) {
+int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf) {
     return _fstatfs_nid_postfix(d, buf);
 }
 
+int GetModuleInfoExByHandle_nid_no_patch(KernelModule handle, ModuleInfoEx* info);
+
+int APS5_VABI sceKernelGetModuleInfoInternal(KernelModule handle, ModuleInfoEx* info) {
+    return GetModuleInfoExByHandle_nid_no_patch(handle, info);
+}
+
+int APS5_VABI sceKernelGetModuleListInternal(KernelModule* handles, std::size_t count, std::size_t* actual) {
+    return sceKernelGetModuleList(handles, count, actual);
+}
+
+int APS5_VABI fstat_nid_postfix(int d, FileStat* sb) {
+    return static_cast<int>(_fstat_nid_postfix(d, sb));
+}
+
 std::int64_t APS5_VABI readlink_nid_postfix(const char* path, char* buffer, std::size_t size) {
     if (size > static_cast<std::size_t>(std::numeric_limits<std::int64_t>::max())) return Fail(GuestEinval);
     if (path == nullptr) return Fail(GuestEfault);
@@ -304,36 +380,57 @@ std::int64_t APS5_VABI pathconf_nid_postfix(const char* path, int name) {
     const auto status = std::filesystem::status(native, error);
     if (error) return Fail(error == std::errc::no_such_file_or_directory && HasNonDirectoryPrefix(native) ? GuestEnotdir : GuestError(error));
     if (!std::filesystem::exists(status)) return Fail(HasNonDirectoryPrefix(native) ? GuestEnotdir : GuestEnoent);
-    switch (name) {
-    case PcLinkMax: return 32767;
-    case PcNameMax: return static_cast<std::int64_t>(GuestNameMax);
-    case PcPathMax: return static_cast<std::int64_t>(GuestPathMax);
-    case PcPipeBuf: return 512;
-    case PcChownRestricted: return 1;
-    case PcNoTrunc: return 1;
-    case PcFileSizeBits: return 64;
-    case PcRecMaxXferSize: return -1;
-    case PcSymlinkMax: return static_cast<std::int64_t>(GuestPathMax);
-    case PcPrioIo: return 0;
-    case PcSyncIo: return 0;
-    case PcMaxCanon:
-    case PcMaxInput:
-    case PcVdisable:
-    case PcAllocSizeMin:
-    case PcRecIncrXferSize:
-    case PcRecMinXferSize:
-    case PcRecXferAlign:
-    case PcMinHoleSize:
-    case PcAsyncIo:
-    case PcAclExtended:
-    case PcAclPathMax:
-    case PcMacPresent:
-    case PcAclNfs4:
-        throw std::runtime_error("pathconf: name " + std::to_string(name) + " depends on the console filesystem or kernel configuration");
-    default: return Fail(GuestEinval);
-    }
+    return PathConfigurationValue(name, "pathconf");
 }
 
+std::int64_t APS5_VABI _fpathconf_nid_postfix(int fd, int name) {
+    if (fd < 0) return Fail(GuestEbadf);
+    bool withoutVnode = false;
+#ifdef _WIN32
+    if (GuestFstat(fd, &withoutVnode) != 0) return Fail(GuestEbadf);
+#else
+    struct stat status{};
+    if (::fstat(fd, &status) != 0) return Fail(GuestEbadf);
+    withoutVnode = S_ISFIFO(status.st_mode) || S_ISSOCK(status.st_mode);
+#endif
+    if (name == PcAsyncIo) return PosixAsynchronousIo;
+    if (withoutVnode) return name == PcPipeBuf ? 512 : Fail(GuestEinval);
+    return PathConfigurationValue(name, "fpathconf");
+}
+
+std::int64_t APS5_VABI fpathconf_nid_postfix(int fd, int name) {
+    return _fpathconf_nid_postfix(fd, name);
+}
+
+#ifdef _WIN32
+static int FollowLinkPath(const std::filesystem::path& source, std::filesystem::path& target) {
+    target = source;
+    const DWORD attributes = GetFileAttributesW(source.c_str());
+    if (attributes == INVALID_FILE_ATTRIBUTES || (attributes & FILE_ATTRIBUTE_REPARSE_POINT) == 0) return 0;
+    const HANDLE handle = CreateFileW(source.c_str(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr,
+        OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) {
+        const DWORD code = GetLastError();
+        if (code == ERROR_FILE_NOT_FOUND || code == ERROR_PATH_NOT_FOUND) return GuestEnoent;
+        if (code == ERROR_CANT_RESOLVE_FILENAME) return GuestEloop;
+        throw std::system_error(static_cast<int>(code), std::system_category(), "link: CreateFileW");
+    }
+    std::wstring name(MAX_PATH, L'\0');
+    DWORD length = GetFinalPathNameByHandleW(handle, name.data(), static_cast<DWORD>(name.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    if (length >= name.size()) {
+        name.resize(length);
+        length = GetFinalPathNameByHandleW(handle, name.data(), static_cast<DWORD>(name.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    }
+    const DWORD code = GetLastError();
+    CloseHandle(handle);
+    if (length == 0 || length >= name.size())
+        throw std::system_error(static_cast<int>(code), std::system_category(), "link: GetFinalPathNameByHandleW");
+    name.resize(length);
+    target = std::filesystem::path(name);
+    return 0;
+}
+#endif
+
 int APS5_VABI link_nid_postfix(const char* existing, const char* created) {
     if (existing == nullptr || created == nullptr) return static_cast<int>(Fail(GuestEfault));
     if (*existing == '\0' || *created == '\0') return static_cast<int>(Fail(GuestEnoent));
@@ -342,11 +439,23 @@ int APS5_VABI link_nid_postfix(const char* existing, const char* created) {
     if (const int error = ResolvePathError_nid_no_patch(created, destination)) return static_cast<int>(Fail(error));
     std::error_code error;
     const auto status = std::filesystem::status(source, error);
-    if (!std::filesystem::exists(status)) return static_cast<int>(Fail(HasNonDirectoryPrefix(source) ? GuestEnotdir : GuestEnoent));
+    if (!std::filesystem::exists(status)) {
+#ifdef _WIN32
+        std::filesystem::path target;
+        if (const int followError = FollowLinkPath(source, target)) return static_cast<int>(Fail(followError));
+#endif
+        return static_cast<int>(Fail(HasNonDirectoryPrefix(source) ? GuestEnotdir : GuestEnoent));
+    }
     if (std::filesystem::is_directory(status)) return static_cast<int>(Fail(GuestEperm));
     if (std::filesystem::exists(std::filesystem::symlink_status(destination, error))) return static_cast<int>(Fail(GuestEexist));
     if (!std::filesystem::is_directory(destination.parent_path(), error)) return static_cast<int>(Fail(HasNonDirectoryPrefix(destination) ? GuestEnotdir : GuestEnoent));
+#ifdef _WIN32
+    std::filesystem::path target;
+    if (const int followError = FollowLinkPath(source, target)) return static_cast<int>(Fail(followError));
+    if (std::filesystem::is_directory(target, error)) return static_cast<int>(Fail(GuestEperm));
+#else
     const auto target = std::filesystem::is_symlink(source, error) ? std::filesystem::canonical(source, error) : source;
+#endif
     if (!error) std::filesystem::create_hard_link(target, destination, error);
     if (error == std::errc::cross_device_link) return static_cast<int>(Fail(GuestExdev));
     if (error) throw std::system_error(error, "link");
@@ -354,9 +463,21 @@ int APS5_VABI link_nid_postfix(const char* existing, const char* created) {
     return 0;
 }
 
+int APS5_VABI linkat_nid_postfix(int fd1, const char* path1, int fd2, const char* path2, int flag) {
+    if (flag & ~GuestAtSymlinkFollow) return static_cast<int>(Fail(GuestEinval));
+    if (path1 == nullptr || path2 == nullptr) return static_cast<int>(Fail(GuestEfault));
+    if ((fd1 != GuestAtFdcwd && *path1 != '/') || (fd2 != GuestAtFdcwd && *path2 != '/'))
+        NotImplemented_nid_no_patch("linkat: a relative path with a directory descriptor");
+    std::filesystem::path source;
+    if (flag == 0 && *path1 != '\0' && ResolvePathError_nid_no_patch(path1, source) == 0 && IsSymbolicLink(source))
+        NotImplemented_nid_no_patch("linkat: a hard link to a symbolic link itself");
+    return link_nid_postfix(path1, path2);
+}
+
 int APS5_VABI fchdir_nid_postfix(int fd) {
     int error = 0;
     const char* path = GetDirectoryDescriptorPath_nid_no_patch(fd, &error);
+    if (path == nullptr && error == GuestEnotdir && DescriptorHasNoVnode_nid_no_patch(fd)) return static_cast<int>(Fail(GuestEinval));
     if (path == nullptr) return static_cast<int>(Fail(error));
 #ifndef _WIN32
     if (::faccessat(fd, ".", X_OK, AT_EACCESS) != 0) return static_cast<int>(Fail(errno));
@@ -385,6 +506,7 @@ int APS5_VABI chroot_nid_postfix(const char* path) {
 
 int APS5_VABI symlink_nid_postfix(const char* target, const char* created) {
     if (target == nullptr || created == nullptr) return static_cast<int>(Fail(GuestEfault));
+    if (std::strlen(target) >= GuestPathMax) return static_cast<int>(Fail(GuestEnametoolong));
     if (*target == '\0' || *created == '\0') return static_cast<int>(Fail(GuestEnoent));
     const std::filesystem::path contents(target);
     if (contents.has_root_name() || contents.has_root_directory()) {
@@ -428,8 +550,6 @@ int APS5_VABI symlink_nid_postfix(const char* target, const char* created) {
     return 0;
 }
 
-int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
-
 int APS5_VABI openat_nid_postfix(int fd, const char* path, int flags, ...) {
     int mode = 0;
     if (flags & SCE_KERNEL_O_CREAT) {
@@ -454,7 +574,24 @@ int APS5_VABI openat_nid_postfix(int fd, const char* path, int flags, ...) {
     return result;
 }
 
-int APS5_VABI mkdir_nid_postfix(const char* path, std::uint16_t mode);
+int APS5_VABI _openat_nid_postfix(int fd, const char* path, int flags, ...) {
+    int mode = 0;
+    if (flags & SCE_KERNEL_O_CREAT) {
+#ifdef _WIN32
+        __builtin_sysv_va_list arguments;
+        __builtin_sysv_va_start(arguments, flags);
+        mode = __builtin_va_arg(arguments, int);
+        __builtin_sysv_va_end(arguments);
+#else
+        std::va_list arguments;
+        va_start(arguments, flags);
+        mode = va_arg(arguments, int);
+        va_end(arguments);
+#endif
+    }
+    return openat_nid_postfix(fd, path, flags, mode);
+}
+
 
 int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode) {
     if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
@@ -473,6 +610,7 @@ int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode)
         if (code == ERROR_ALREADY_EXISTS || code == ERROR_FILE_EXISTS) return static_cast<int>(Fail(GuestEexist));
         if (code == ERROR_ACCESS_DENIED) return static_cast<int>(Fail(GuestEperm));
         if (code == ERROR_FILENAME_EXCED_RANGE) return static_cast<int>(Fail(GuestEnametoolong));
+        if (code == ERROR_CANT_RESOLVE_FILENAME) return static_cast<int>(Fail(GuestEloop));
         if (code == ERROR_PATH_NOT_FOUND) {
             if (HasNonDirectoryPrefix(native)) return static_cast<int>(Fail(GuestEnotdir));
             return static_cast<int>(Fail(GuestEnoent));
@@ -531,6 +669,23 @@ int APS5_VABI fchmodat_nid_postfix(int fd, const char* path, int mode, int flag)
     return 0;
 }
 
+int APS5_VABI lchmod_nid_postfix(const char* path, std::uint16_t mode) {
+#ifndef __APPLE__
+    std::filesystem::path native;
+    if (path != nullptr && *path != '\0' && ResolvePathError_nid_no_patch(path, native) == 0) {
+#ifdef _WIN32
+        const DWORD attributes = GetFileAttributesW(native.wstring().c_str());
+        const bool symbolic = attributes != INVALID_FILE_ATTRIBUTES && (attributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0;
+#else
+        std::error_code status;
+        const bool symbolic = std::filesystem::is_symlink(std::filesystem::symlink_status(native, status));
+#endif
+        if (symbolic) NotImplemented_nid_no_patch("lchmod: the mode of a symbolic link on a host that cannot change it");
+    }
+#endif
+    return fchmodat_nid_postfix(GuestAtFdcwd, path, mode, GuestAtSymlinkNofollow);
+}
+
 int APS5_VABI fchown_nid_postfix(int fd, std::uint32_t uid, std::uint32_t gid) {
     constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
     if (uid != 0 && uid != Unchanged) NotImplemented_nid_no_patch("fchown: an owner other than the guest user");
@@ -544,8 +699,37 @@ int APS5_VABI fchown_nid_postfix(int fd, std::uint32_t uid, std::uint32_t gid) {
     return 0;
 }
 
-int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
-int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb);
+int APS5_VABI sched_rr_get_interval_nid_postfix(int pid, KernelTimespec* interval) {
+    constexpr int GuestEsrch = 3;
+    const int self = getpid_nid_postfix();
+    if (pid != 0 && pid != self) return static_cast<int>(Fail(GuestEsrch));
+    if (interval == nullptr) return static_cast<int>(Fail(GuestEfault));
+    interval->tv_sec = 0;
+    interval->tv_nsec = 94000000;
+    return 0;
+}
+
+int APS5_VABI chown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid) {
+    FileStat status{};
+    if (stat_nid_postfix(path, &status) != 0) return -1;
+    RequireGuestOwner("chown", uid, gid);
+    return 0;
+}
+
+int APS5_VABI lchown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid) {
+    FileStat status{};
+    if (lstat_nid_postfix(path, &status) != 0) return -1;
+    RequireGuestOwner("lchown", uid, gid);
+    return 0;
+}
+
+int APS5_VABI fchownat_nid_postfix(int fd, const char* path, std::uint32_t uid, std::uint32_t gid, int flag) {
+    if (flag & ~GuestAtSymlinkNofollow) return static_cast<int>(Fail(GuestEinval));
+    FileStat status{};
+    if (fstatat_nid_postfix(fd, path, &status, flag) != 0) return -1;
+    RequireGuestOwner("fchownat", uid, gid);
+    return 0;
+}
 
 int APS5_VABI fstatat_nid_postfix(int fd, const char* path, FileStat* sb, int flag) {
     if (flag & ~GuestAtSymlinkNofollow) return static_cast<int>(Fail(GuestEinval));
@@ -557,9 +741,6 @@ int APS5_VABI fstatat_nid_postfix(int fd, const char* path, FileStat* sb, int fl
     return 0;
 }
 
-int APS5_VABI unlink_nid_postfix(const char* path);
-int APS5_VABI rmdir_nid_postfix(const char* path);
-
 int APS5_VABI unlinkat_nid_postfix(int fd, const char* path, int flag) {
     if (flag & ~GuestAtRemovedir) return static_cast<int>(Fail(GuestEinval));
     if (path == nullptr) return static_cast<int>(Fail(GuestEfault));
@@ -575,8 +756,8 @@ int APS5_VABI unlinkat_nid_postfix(int fd, const char* path, int flag) {
     while (!native.has_filename() && native.has_relative_path()) native = native.parent_path();
     std::error_code statusError;
     const auto symlinkStatus = std::filesystem::symlink_status(native, statusError);
+    if (IsDotOrDotDot(path)) return static_cast<int>(Fail(GuestEinval));
     if (flag & GuestAtRemovedir) {
-        if (IsDotOrDotDot(path)) return static_cast<int>(Fail(GuestEinval));
         if (std::filesystem::is_symlink(symlinkStatus)) return static_cast<int>(Fail(GuestEnotdir));
         if (!std::filesystem::is_directory(symlinkStatus)) {
             if (HasNonDirectoryPrefix(native) || std::filesystem::exists(symlinkStatus))
@@ -631,6 +812,13 @@ int APS5_VABI unlinkat_nid_postfix(int fd, const char* path, int flag) {
     return 0;
 }
 
+int APS5_VABI scePthreadCondattrGetclock(const PthreadCondattr* attr, KernelClockid* clockId) {
+    if (!attr || !*attr) return SCE_KERNEL_ERROR_EINVAL;
+    if (!clockId) throw std::runtime_error("scePthreadCondattrGetclock: null clock id");
+    *clockId = (*attr)->_clockid;
+    return 0;
+}
+
 int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const char* to) {
     if (from == nullptr || to == nullptr) return static_cast<int>(Fail(GuestEfault));
     if (*from == '\0' || *to == '\0') return static_cast<int>(Fail(GuestEnoent));
@@ -689,9 +877,7 @@ int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const
     return 0;
 }
 
-
 bool SetDefaultStackSize_nid_no_patch(std::size_t size);
-void APS5_VABI pthread_set_name_np_nid_postfix(void* thread, const char* name);
 
 int APS5_VABI pthread_set_defaultstacksize_np_nid_postfix(std::size_t size) {
     return SetDefaultStackSize_nid_no_patch(size) ? 0 : GuestEinval;
@@ -701,8 +887,21 @@ int APS5_VABI scePthreadSetDefaultstacksize(std::size_t size) {
     return SetDefaultStackSize_nid_no_patch(size) ? 0 : SceKernelError(GuestEinval);
 }
 
-void APS5_VABI scePthreadSetName(void* thread, const char* name) {
+void APS5_VABI scePthreadSetName(Pthread thread, const char* name) {
     pthread_set_name_np_nid_postfix(thread, name);
+
+}
+
+int APS5_VABI sceKernelTitleWorkaroundIsEnabled(const KernelTitleWorkaround* workaround, std::int32_t bit, std::int32_t* enabled) {
+    if (!workaround || !enabled) return static_cast<int>(0x8002000E);
+    if (static_cast<std::uint32_t>(bit) >= 0x3A) return static_cast<int>(0x80020016);
+    *enabled = static_cast<std::int32_t>((workaround->ids[bit >> 6] >> (bit & 0x3F)) & 1);
+    return 0;
+}
+
+int APS5_VABI sceKernelGetProcessType(int pid) {
+    if (pid != getpid_nid_postfix() && pid != -1 && pid != 0) return static_cast<int>(0x80020003);
+    return 0;
 }
 
 }
diff --git a/core/libs/prx/libkernel_sys/include/Api.hpp b/core/libs/prx/libkernel_sys/include/Api.hpp
new file mode 100644
index 0000000000..938bc8178b
--- /dev/null
+++ b/core/libs/prx/libkernel_sys/include/Api.hpp
@@ -0,0 +1,562 @@
+#pragma once
+
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+
+struct GuestAiocb {
+    int fildes;
+    std::int64_t offset;
+    void* buf;
+    std::uint64_t nbytes;
+    int spare[2];
+    void* spare2;
+    int lioOpcode;
+    int reqprio;
+    std::int64_t status;
+    std::int64_t error;
+    void* kernelinfo;
+    GuestSigevent sigevent;
+};
+
+struct KernelTitleWorkaround {
+    std::int32_t version;
+    std::int32_t align;
+    std::uint64_t ids[2];
+};
+
+extern "C" {
+
+int APS5_VABI aio_read_nid_postfix(GuestAiocb* aiocb);
+int APS5_VABI aio_write_nid_postfix(GuestAiocb* aiocb);
+int APS5_VABI aio_fsync_nid_postfix(int operation, GuestAiocb* aiocb);
+int APS5_VABI aio_error_nid_postfix(const GuestAiocb* aiocb);
+std::int64_t APS5_VABI aio_return_nid_postfix(GuestAiocb* aiocb);
+int APS5_VABI aio_suspend_nid_postfix(const GuestAiocb* const* list, int count, const KernelTimespec* timeout);
+std::int64_t APS5_VABI aio_waitcomplete_nid_postfix(GuestAiocb** result, const KernelTimespec* timeout);
+int APS5_VABI aio_cancel_nid_postfix(int descriptor, GuestAiocb* aiocb);
+int APS5_VABI sceKernelGetCompiledSdkVersion(std::int32_t* version);
+int APS5_VABI fork_nid_postfix(void);
+int APS5_VABI setsid_nid_postfix(void);
+std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask);
+int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf);
+int APS5_VABI sceKernelGetModuleInfoInternal(KernelModule handle, ModuleInfoEx* info);
+int APS5_VABI sceKernelGetModuleListInternal(KernelModule* handles, std::size_t count, std::size_t* actual);
+int APS5_VABI fstat_nid_postfix(int d, FileStat* sb);
+std::int64_t APS5_VABI readlink_nid_postfix(const char* path, char* buffer, std::size_t size);
+std::int64_t APS5_VABI readlinkat_nid_postfix(int fd, const char* path, char* buffer, std::size_t size);
+std::int64_t APS5_VABI pathconf_nid_postfix(const char* path, int name);
+std::int64_t APS5_VABI _fpathconf_nid_postfix(int fd, int name);
+std::int64_t APS5_VABI fpathconf_nid_postfix(int fd, int name);
+int APS5_VABI link_nid_postfix(const char* existing, const char* created);
+int APS5_VABI linkat_nid_postfix(int fd1, const char* path1, int fd2, const char* path2, int flag);
+int APS5_VABI fchdir_nid_postfix(int fd);
+int APS5_VABI chroot_nid_postfix(const char* path);
+int APS5_VABI symlink_nid_postfix(const char* target, const char* created);
+int APS5_VABI openat_nid_postfix(int fd, const char* path, int flags, ...);
+int APS5_VABI mkdirat_nid_postfix(int fd, const char* path, std::uint16_t mode);
+int APS5_VABI fchmodat_nid_postfix(int fd, const char* path, int mode, int flag);
+int APS5_VABI lchmod_nid_postfix(const char* path, std::uint16_t mode);
+int APS5_VABI fchown_nid_postfix(int fd, std::uint32_t uid, std::uint32_t gid);
+int APS5_VABI sched_rr_get_interval_nid_postfix(int pid, KernelTimespec* interval);
+int APS5_VABI chown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid);
+int APS5_VABI lchown_nid_postfix(const char* path, std::uint32_t uid, std::uint32_t gid);
+int APS5_VABI fchownat_nid_postfix(int fd, const char* path, std::uint32_t uid, std::uint32_t gid, int flag);
+int APS5_VABI fstatat_nid_postfix(int fd, const char* path, FileStat* sb, int flag);
+int APS5_VABI unlinkat_nid_postfix(int fd, const char* path, int flag);
+int APS5_VABI scePthreadCondattrGetclock(const PthreadCondattr* attr, KernelClockid* clockId);
+int APS5_VABI renameat_nid_postfix(int oldfd, const char* from, int newfd, const char* to);
+int APS5_VABI pthread_set_defaultstacksize_np_nid_postfix(std::size_t size);
+int APS5_VABI scePthreadSetDefaultstacksize(std::size_t size);
+void APS5_VABI scePthreadSetName(Pthread thread, const char* name);
+int APS5_VABI sceKernelTitleWorkaroundIsEnabled(const KernelTitleWorkaround* workaround, std::int32_t bit, std::int32_t* enabled);
+int APS5_VABI sceKernelGetProcessType(int pid);
+int APS5_VABI amd64_set_fsbase_nid_postfix(void);
+int APS5_VABI blockpool_batch_nid_postfix(void);
+int APS5_VABI blockpool_map_nid_postfix(void);
+int APS5_VABI blockpool_open_nid_postfix(void);
+int APS5_VABI blockpool_unmap_nid_postfix(void);
+int APS5_VABI cpuset_nid_postfix(void);
+int APS5_VABI cpuset_getid_nid_postfix(void);
+int APS5_VABI cpuset_setid_nid_postfix(void);
+int APS5_VABI dynlib_get_obj_member_nid_postfix(void);
+int APS5_VABI futimesat_nid_postfix(void);
+int APS5_VABI get_authinfo_nid_postfix(void);
+int APS5_VABI get_module_info_list_nid_postfix(void);
+int APS5_VABI get_page_table_stats_nid_postfix(void);
+int APS5_VABI get_sdk_compiled_version_nid_postfix(void);
+int APS5_VABI get_self_auth_info_nid_postfix(void);
+int APS5_VABI get_vm_map_timestamp_nid_postfix(void);
+int APS5_VABI getfsstat_nid_postfix(void);
+int APS5_VABI getlogin_nid_postfix(void);
+int APS5_VABI ipmimgr_call_nid_postfix(void);
+int APS5_VABI is_in_sandbox_nid_postfix(void);
+int APS5_VABI kenv_nid_postfix(void);
+int APS5_VABI kldfind_nid_postfix(void);
+int APS5_VABI kldfirstmod_nid_postfix(void);
+int APS5_VABI kldload_nid_postfix(void);
+int APS5_VABI kldnext_nid_postfix(void);
+int APS5_VABI kldstat_nid_postfix(void);
+int APS5_VABI kldsym_nid_postfix(void);
+int APS5_VABI kldunload_nid_postfix(void);
+int APS5_VABI kmq_notify_nid_postfix(void);
+int APS5_VABI kmq_open_nid_postfix(void);
+int APS5_VABI kmq_setattr_nid_postfix(void);
+int APS5_VABI kmq_timedreceive_nid_postfix(void);
+int APS5_VABI kmq_timedsend_nid_postfix(void);
+int APS5_VABI kmq_unlink_nid_postfix(void);
+int APS5_VABI ksem_close_nid_postfix(void);
+int APS5_VABI ksem_destroy_nid_postfix(void);
+int APS5_VABI ksem_getvalue_nid_postfix(void);
+int APS5_VABI ksem_init_nid_postfix(void);
+int APS5_VABI ksem_open_nid_postfix(void);
+int APS5_VABI ksem_post_nid_postfix(void);
+int APS5_VABI ksem_timedwait_nid_postfix(void);
+int APS5_VABI ksem_trywait_nid_postfix(void);
+int APS5_VABI ksem_unlink_nid_postfix(void);
+int APS5_VABI ksem_wait_nid_postfix(void);
+int APS5_VABI ktrace_nid_postfix(void);
+int APS5_VABI lchflags_nid_postfix(void);
+int APS5_VABI mdbg_call_nid_postfix(void);
+int APS5_VABI mdbg_service_nid_postfix(void);
+int APS5_VABI mount_nid_postfix(void);
+int APS5_VABI openintr_nid_postfix(void);
+int APS5_VABI profil_nid_postfix(void);
+int APS5_VABI pthread_attr_getaffinity_np_nid_postfix(void);
+int APS5_VABI pthread_attr_getsolosched_np_nid_postfix(void);
+int APS5_VABI pthread_attr_setaffinity_np_nid_postfix(void);
+int APS5_VABI pthread_attr_setcreatesuspend_np_nid_postfix(void);
+int APS5_VABI pthread_attr_setstackaddr_nid_postfix(void);
+int APS5_VABI pthread_barrier_setname_np_nid_postfix(void);
+int APS5_VABI pthread_cond_setname_np_nid_postfix(void);
+int APS5_VABI pthread_get_specificarray_np_nid_postfix(void);
+int APS5_VABI pthread_get_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_getstack_np_nid_postfix(void);
+int APS5_VABI pthread_main_np_nid_postfix(void);
+int APS5_VABI pthread_multi_np_nid_postfix(void);
+int APS5_VABI pthread_mutex_getprioceiling_nid_postfix(void);
+int APS5_VABI pthread_mutex_init_for_mono_nid_postfix(void);
+int APS5_VABI pthread_mutex_setname_np_nid_postfix(void);
+int APS5_VABI pthread_mutex_setprioceiling_nid_postfix(void);
+int APS5_VABI pthread_mutexattr_getgen_np_nid_postfix(void);
+int APS5_VABI pthread_mutexattr_setgen_np_nid_postfix(void);
+int APS5_VABI pthread_resume_all_np_nid_postfix(void);
+int APS5_VABI pthread_resume_np_nid_postfix(void);
+int APS5_VABI pthread_resume_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_rwlock_setname_np_nid_postfix(void);
+int APS5_VABI pthread_rwlockattr_settype_np_nid_postfix(void);
+int APS5_VABI pthread_set_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_single_np_nid_postfix(void);
+int APS5_VABI pthread_suspend_all_np_nid_postfix(void);
+int APS5_VABI pthread_suspend_np_nid_postfix(void);
+int APS5_VABI pthread_suspend_user_context_np_nid_postfix(void);
+int APS5_VABI pthread_switch_add_np_nid_postfix(void);
+int APS5_VABI pthread_switch_delete_np_nid_postfix(void);
+int APS5_VABI ptrace_nid_postfix(void);
+int APS5_VABI pwrite_nid_postfix(void);
+int APS5_VABI reboot_nid_postfix(void);
+int APS5_VABI revoke_nid_postfix(void);
+int APS5_VABI rfork_thread_nid_postfix(void);
+int APS5_VABI rtld_printf_nid_postfix(void);
+int APS5_VABI sceCoredumpDebugForceCoredumpOnAppClose(void);
+int APS5_VABI sceCoredumpDebugTriggerCoredump(void);
+int APS5_VABI sceCoredumpGetStopInfoGpu(void);
+int APS5_VABI sceCoredumpInternalGetThreadContextInfo(void);
+int APS5_VABI sceKernelAddACInfo(void);
+int APS5_VABI sceKernelAddCpumodeEvent(void);
+int APS5_VABI sceKernelAddGpuExceptionEvent(void);
+int APS5_VABI sceKernelAddProcessToCanvasMap(void);
+int APS5_VABI sceKernelAddResource(void);
+int APS5_VABI sceKernelAllocateDirectMemory2(void);
+int APS5_VABI sceKernelAllocateDirectMemoryForApp(void);
+int APS5_VABI sceKernelAllocateDirectMemoryForMiniApp(void);
+int APS5_VABI sceKernelAllocateToolMemory(void);
+int APS5_VABI sceKernelAllocateTraceDirectMemory(void);
+int APS5_VABI sceKernelAprCtrl(void);
+int APS5_VABI sceKernelAprSubmitCommandBufferAndGetResult_TEST(void);
+int APS5_VABI sceKernelAprSubmitCommandBuffer_TEST(void);
+int APS5_VABI sceKernelAvailableToolMemorySize(void);
+int APS5_VABI sceKernelBacktraceSelf(void);
+int APS5_VABI sceKernelBeginAppMount(void);
+int APS5_VABI sceKernelBeginAppMount2(void);
+int APS5_VABI sceKernelCallIndirectBuffer(void);
+int APS5_VABI sceKernelCallIndirectBuffer2(void);
+int APS5_VABI sceKernelClearBootReqNotifyCount(void);
+int APS5_VABI sceKernelClearGameDirectMemory(void);
+int APS5_VABI sceKernelCloseEport(void);
+int APS5_VABI sceKernelCloseSema(void);
+int APS5_VABI sceKernelCreateBudget(void);
+int APS5_VABI sceKernelCreateEport(void);
+int APS5_VABI sceKernelDebugAcquireAndUpdateDebugRegister(void);
+int APS5_VABI sceKernelDebugGetAppStatus(void);
+int APS5_VABI sceKernelDebugGetPauseCount(void);
+int APS5_VABI sceKernelDebugGetPrivateLogText(void);
+int APS5_VABI sceKernelDebugGetSchedLockMode(void);
+int APS5_VABI sceKernelDebugGetSdkLogText(void);
+int APS5_VABI sceKernelDebugGpuPaDebugIsInProgress(void);
+int APS5_VABI sceKernelDebugInjectProcessEvent(void);
+int APS5_VABI sceKernelDebugPackageCorrupted(void);
+int APS5_VABI sceKernelDebugRaiseExceptionWithContext(void);
+int APS5_VABI sceKernelDebugRaiseExceptionWithInfo(void);
+int APS5_VABI sceKernelDebugReleaseDebugContext(void);
+int APS5_VABI sceKernelDeleteACInfo(void);
+int APS5_VABI sceKernelDeleteBudget(void);
+int APS5_VABI sceKernelDeleteCpumodeEvent(void);
+int APS5_VABI sceKernelDeleteEport(void);
+int APS5_VABI sceKernelDeleteGpuExceptionEvent(void);
+int APS5_VABI sceKernelDeleteProcessFromCanvasMap(void);
+int APS5_VABI sceKernelDeleteSavedApp(void);
+int APS5_VABI sceKernelDirectMemoryQueryForId(void);
+int APS5_VABI sceKernelEnableDmemAliasing2(void);
+int APS5_VABI sceKernelEnablePthreadObjectCheck(void);
+int APS5_VABI sceKernelEndAppMount(void);
+int APS5_VABI sceKernelEndAppMount2(void);
+int APS5_VABI sceKernelEventLogInit(void);
+int APS5_VABI sceKernelEventLogPread(void);
+int APS5_VABI sceKernelEventLogRead(void);
+int APS5_VABI sceKernelEventLogWrite(void);
+int APS5_VABI sceKernelExpectedHddFormat(void);
+int APS5_VABI sceKernelFlock(void);
+int APS5_VABI sceKernelGetACInfoAllForCoredump(void);
+int APS5_VABI sceKernelGetAppCategoryType(void);
+int APS5_VABI sceKernelGetAppInfoByAppId(void);
+int APS5_VABI sceKernelGetAppState(void);
+int APS5_VABI sceKernelGetAslrStatus(void);
+int APS5_VABI sceKernelGetAutoUpdateVersion(void);
+int APS5_VABI sceKernelGetBackupRestoreMode(void);
+int APS5_VABI sceKernelGetBackupRestoreModeOfNextBoot(void);
+int APS5_VABI sceKernelGetBasicProductShape(void);
+int APS5_VABI sceKernelGetBetaUpdateTestForRcmgr(void);
+int APS5_VABI sceKernelGetBioUsageAll(void);
+int APS5_VABI sceKernelGetBootReqNotifyCount(void);
+int APS5_VABI sceKernelGetBudget(void);
+int APS5_VABI sceKernelGetBuildNumber(void);
+int APS5_VABI sceKernelGetCallRecord(void);
+int APS5_VABI sceKernelGetChildApp(void);
+int APS5_VABI sceKernelGetCompiledSdkVersionByPath(void);
+int APS5_VABI sceKernelGetCompiledSdkVersionByPid(void);
+int APS5_VABI sceKernelGetCoredumpAppInfo(void);
+int APS5_VABI sceKernelGetCpuUsage(void);
+int APS5_VABI sceKernelGetCpuUsageAll(void);
+int APS5_VABI sceKernelGetCpuUsageProc(void);
+int APS5_VABI sceKernelGetCpuUsageProc2(void);
+int APS5_VABI sceKernelGetCpuUsageThread(void);
+int APS5_VABI sceKernelGetCpumodeGame(void);
+int APS5_VABI sceKernelGetCurrentFanDuty(void);
+int APS5_VABI sceKernelGetDataTransferMode(void);
+int APS5_VABI sceKernelGetDebugMenuMiniModeForRcmgr(void);
+int APS5_VABI sceKernelGetDebugMenuModeForPsmForRcmgr(void);
+int APS5_VABI sceKernelGetDebugMenuModeForRcmgr(void);
+int APS5_VABI sceKernelGetDefaultToolMemorySize(void);
+int APS5_VABI sceKernelGetEmergencyErrorLog(void);
+int APS5_VABI sceKernelGetExecutableModuleHandle(void);
+int APS5_VABI sceKernelGetExtLibcHandle(void);
+int APS5_VABI sceKernelGetFakeFinalizeMenuForRcmgr(void);
+int APS5_VABI sceKernelGetFirstImageAddr(void);
+int APS5_VABI sceKernelGetFlagedUpdaterForRcmgr(void);
+int APS5_VABI sceKernelGetForceUpdateModeForRcmgr(void);
+int APS5_VABI sceKernelGetGPO(void);
+int APS5_VABI sceKernelGetHwFeatureInfoForDecid(void);
+int APS5_VABI sceKernelGetHwModelName(void);
+int APS5_VABI sceKernelGetHwSerialNumber(void);
+int APS5_VABI sceKernelGetIdPs(void);
+int APS5_VABI sceKernelGetIdTableCurrentCount(void);
+int APS5_VABI sceKernelGetIoreq(void);
+int APS5_VABI sceKernelGetIpcPath(void);
+int APS5_VABI sceKernelGetKnobs(void);
+int APS5_VABI sceKernelGetKqueueFromEqueue(void);
+int APS5_VABI sceKernelGetMemoryPstate(void);
+int APS5_VABI sceKernelGetOpenPsIdForSystem(void);
+int APS5_VABI sceKernelGetPagingStatsOfAllObjects(void);
+int APS5_VABI sceKernelGetPagingStatsOfAllThreads(void);
+int APS5_VABI sceKernelGetParentApp(void);
+int APS5_VABI sceKernelGetPhysPageSize(void);
+int APS5_VABI sceKernelGetProcessName(void);
+int APS5_VABI sceKernelGetProcessTypeOfBudget(void);
+int APS5_VABI sceKernelGetProductCode(void);
+int APS5_VABI sceKernelGetProductStr(void);
+int APS5_VABI sceKernelGetPs4SystemSwVersion(void);
+int APS5_VABI sceKernelGetPsmIntdevModeForRcmgr(void);
+int APS5_VABI sceKernelGetPsnAccessTraceLogForRcmgr(void);
+int APS5_VABI sceKernelGetQafExpirationTimeNotafterForRcmgr(void);
+int APS5_VABI sceKernelGetQafExpirationTimeNotbeforeForRcmgr(void);
+int APS5_VABI sceKernelGetQafGenerationForRcmgr(void);
+int APS5_VABI sceKernelGetQafNameForRcmgr(void);
+int APS5_VABI sceKernelGetRenderingMode(void);
+int APS5_VABI sceKernelGetResidentCount(void);
+int APS5_VABI sceKernelGetResidentFmemCount(void);
+int APS5_VABI sceKernelGetResource(void);
+int APS5_VABI sceKernelGetResourceLimit(void);
+int APS5_VABI sceKernelGetResourceOne(void);
+int APS5_VABI sceKernelGetSafemode(void);
+int APS5_VABI sceKernelGetSanitizerMallocReplace(void);
+int APS5_VABI sceKernelGetSanitizerNewReplace(void);
+int APS5_VABI sceKernelGetSocClock(void);
+int APS5_VABI sceKernelGetSpecialIForRcmgr(void);
+int APS5_VABI sceKernelGetSubsysId(void);
+int APS5_VABI sceKernelGetSubsysSubId(void);
+int APS5_VABI sceKernelGetSystemLevelDebuggerModeForRcmgr(void);
+int APS5_VABI sceKernelGetSystemSwBeta(void);
+int APS5_VABI sceKernelGetThreadName(void);
+int APS5_VABI sceKernelGetUniversalMode(void);
+int APS5_VABI sceKernelGetUpdVersion(void);
+int APS5_VABI sceKernelGetUtokenDataExecutionForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenExpirationTimeNotafterForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenExpirationTimeNotbeforeForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenFakeSharefactoryForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenFlagedUpdaterForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenNpEnvSwitchingForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenSaveDataRepairForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenStoreModeForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenUseSoftwagnerForAcmgr(void);
+int APS5_VABI sceKernelGetUtokenUseSoftwagnerForRcmgr(void);
+int APS5_VABI sceKernelGetUtokenWeakenedPortRestrictionForRcmgr(void);
+int APS5_VABI sceKernelGetVrCaptureSize(void);
+int APS5_VABI sceKernelGiveDirectMemoryToMapper(void);
+int APS5_VABI sceKernelHasNeoMode(void);
+int APS5_VABI sceKernelHwGetBdDriveInfo(void);
+int APS5_VABI sceKernelHwHasOpticalOut(void);
+int APS5_VABI sceKernelHwHasWlanBt(void);
+int APS5_VABI sceKernelIccControlBDPowerState(void);
+int APS5_VABI sceKernelIccControlUSBPowerState(void);
+int APS5_VABI sceKernelIccGetBDPowerState(void);
+int APS5_VABI sceKernelIccGetBootTimestamp(void);
+int APS5_VABI sceKernelIccGetCPMode(void);
+int APS5_VABI sceKernelIccGetCountTime(void);
+int APS5_VABI sceKernelIccGetCpuInfoBit(void);
+int APS5_VABI sceKernelIccGetErrLog(void);
+int APS5_VABI sceKernelIccGetHwInfo(void);
+int APS5_VABI sceKernelIccGetPowerNumberOfBootShutdown(void);
+int APS5_VABI sceKernelIccGetPowerOperatingTime(void);
+int APS5_VABI sceKernelIccGetPowerUpCause(void);
+int APS5_VABI sceKernelIccGetSysEventLog(void);
+int APS5_VABI sceKernelIccGetUSBPowerState(void);
+int APS5_VABI sceKernelIccIndicatorBootDone(void);
+int APS5_VABI sceKernelIccIndicatorShutdown(void);
+int APS5_VABI sceKernelIccIndicatorStandby(void);
+int APS5_VABI sceKernelIccIndicatorStandbyBoot(void);
+int APS5_VABI sceKernelIccIndicatorStandbyShutdown(void);
+int APS5_VABI sceKernelIccNotifyBootStatus(void);
+int APS5_VABI sceKernelIccNvsFlush(void);
+int APS5_VABI sceKernelIccReadPowerBootMessage(void);
+int APS5_VABI sceKernelIccSetBuzzer(void);
+int APS5_VABI sceKernelIccSetCPMode(void);
+int APS5_VABI sceKernelIccSetCpuInfoBit(void);
+int APS5_VABI sceKernelIccSetDownloadMode(void);
+int APS5_VABI sceKernelInternalGetKmemStatistics(void);
+int APS5_VABI sceKernelInternalGetMapStatistics(void);
+int APS5_VABI sceKernelInternalHeapPrintBacktraceWithModuleInfo(void);
+int APS5_VABI sceKernelInternalMapDirectMemory(void);
+int APS5_VABI sceKernelInternalMapNamedDirectMemory(void);
+int APS5_VABI sceKernelInternalResumeDirectMemoryRelease(void);
+int APS5_VABI sceKernelInternalSuspendDirectMemoryRelease(void);
+int APS5_VABI sceKernelIsAllowedToSelectDvdRegion(void);
+int APS5_VABI sceKernelIsAuthenticNeo(void);
+int APS5_VABI sceKernelIsCEX(void);
+int APS5_VABI sceKernelIsDebuggerAttached(void);
+int APS5_VABI sceKernelIsDevKit(void);
+int APS5_VABI sceKernelIsExperimentalBeta(void);
+int APS5_VABI sceKernelIsGenuineCEX(void);
+int APS5_VABI sceKernelIsGenuineDevKit(void);
+int APS5_VABI sceKernelIsGenuineKratosCex(void);
+int APS5_VABI sceKernelIsGenuineN(void);
+int APS5_VABI sceKernelIsGenuineTestKit(void);
+int APS5_VABI sceKernelIsInSandbox(void);
+int APS5_VABI sceKernelIsKratos(void);
+int APS5_VABI sceKernelIsM2DeviceAttached(void);
+int APS5_VABI sceKernelIsMainOnStanbyMode(void);
+int APS5_VABI sceKernelIsMainOnStandbyMode(void);
+int APS5_VABI sceKernelIsModuleLoaded(void);
+int APS5_VABI sceKernelIsNeoMode(void);
+int APS5_VABI sceKernelIsProspero(void);
+int APS5_VABI sceKernelIsPs4Process(void);
+int APS5_VABI sceKernelIsTestKit(void);
+int APS5_VABI sceKernelJitGetSharedMemoryInfo(void);
+int APS5_VABI sceKernelKernelHeapUsage(void);
+int APS5_VABI sceKernelLoadStartModuleForSysmodule(void);
+int APS5_VABI sceKernelLoadStartModuleInternalForMono(void);
+int APS5_VABI sceKernelLwfsAllocateBlock(void);
+int APS5_VABI sceKernelLwfsLseek(void);
+int APS5_VABI sceKernelLwfsSetAttribute(void);
+int APS5_VABI sceKernelLwfsTrimBlock(void);
+int APS5_VABI sceKernelLwfsWrite(void);
+int APS5_VABI sceKernelMapNamedSystemFlexibleMemory(void);
+int APS5_VABI sceKernelMapSanitizerShadowMemory(void);
+int APS5_VABI sceKernelMapToolMemory(void);
+int APS5_VABI sceKernelMapTraceMemory(void);
+int APS5_VABI sceKernelMapperGetParam(void);
+int APS5_VABI sceKernelMemoryPoolMove(void);
+int APS5_VABI sceKernelMlockall(void);
+int APS5_VABI sceKernelMsync(void* address, std::size_t length, int flags);
+int APS5_VABI sceKernelNormalizePath(void);
+int APS5_VABI sceKernelNotifyAppEvent(void);
+int APS5_VABI sceKernelNotifyAppStateChanged(void);
+int APS5_VABI sceKernelNotifySystemSuspendResumeProgress(void);
+int APS5_VABI sceKernelNotifySystemSuspendStart(void);
+int APS5_VABI sceKernelOpenEport(void);
+int APS5_VABI sceKernelOpenInternal(void);
+int APS5_VABI sceKernelOpenSema(void);
+int APS5_VABI sceKernelPrepareDirectMemorySwap(void);
+int APS5_VABI sceKernelPrepareToResumeProcess(void);
+int APS5_VABI sceKernelPrepareToSuspendProcess(void);
+int APS5_VABI sceKernelProtectDirectMemory(void);
+int APS5_VABI sceKernelProtectDirectMemoryForPID(void);
+int APS5_VABI sceKernelQueryToolMemory(void);
+int APS5_VABI sceKernelQueryTraceMemory(void);
+int APS5_VABI sceKernelRandomizedPath(void);
+int APS5_VABI sceKernelRdup(void);
+int APS5_VABI sceKernelReboot(void);
+int APS5_VABI sceKernelReleaseToolMemory(void);
+int APS5_VABI sceKernelReleaseTraceDirectMemory(void);
+int APS5_VABI sceKernelReportUnpatchedFunctionCall(void);
+int APS5_VABI sceKernelReserve2mbPage(void);
+int APS5_VABI sceKernelReserveSystemDirectMemory(void);
+int APS5_VABI sceKernelRestoreApp(void);
+int APS5_VABI sceKernelResumeDirectMemoryRelease(void);
+int APS5_VABI sceKernelResumeProcess(void);
+int APS5_VABI sceKernelRtldControl(void);
+int APS5_VABI sceKernelSandboxPath(void);
+int APS5_VABI sceKernelSaveApp(void);
+int APS5_VABI sceKernelSetAppInfo(void);
+int APS5_VABI sceKernelSetAppState(void);
+int APS5_VABI sceKernelSetBackupRestoreMode(void);
+int APS5_VABI sceKernelSetBaseModeClock(void);
+int APS5_VABI sceKernelSetBesteffort(void);
+int APS5_VABI sceKernelSetBootReqNotify(void);
+int APS5_VABI sceKernelSetBudget(void);
+int APS5_VABI sceKernelSetCallRecord(void);
+int APS5_VABI sceKernelSetCompressionAttribute(void);
+int APS5_VABI sceKernelSetCoredumpAppInfo(void);
+int APS5_VABI sceKernelSetCpumodeGame(void);
+int APS5_VABI sceKernelSetDataTransferMode(void);
+int APS5_VABI sceKernelSetEmergencyErrorLog(void);
+int APS5_VABI sceKernelSetFsstParam(void);
+int APS5_VABI sceKernelSetGPI(void);
+int APS5_VABI sceKernelSetGameDirectMemoryLimit(void);
+int APS5_VABI sceKernelSetGpuCu(void);
+int APS5_VABI sceKernelSetIoreq(void);
+int APS5_VABI sceKernelSetKnobs(void);
+int APS5_VABI sceKernelSetMemoryPstate(void);
+int APS5_VABI sceKernelSetNeoModeClock(void);
+int APS5_VABI sceKernelSetPackageInfo(void);
+int APS5_VABI sceKernelSetPhysFmemLimit(void);
+int APS5_VABI sceKernelSetProcessName(void);
+int APS5_VABI sceKernelSetProcessProperty(void);
+int APS5_VABI sceKernelSetProcessPropertyString(void);
+int APS5_VABI sceKernelSetSafemode(void);
+int APS5_VABI sceKernelSetSafemodeDirect(void);
+int APS5_VABI sceKernelSetSuspendState(void);
+int APS5_VABI sceKernelSetTimezoneInfo(void);
+int APS5_VABI sceKernelSetUpdatemode(void);
+int APS5_VABI sceKernelSetVmContainer(void);
+int APS5_VABI sceKernelSettimeofday(void);
+int APS5_VABI sceKernelSflashGetWritePrio(void);
+int APS5_VABI sceKernelSflashSetWritePrio(void);
+int APS5_VABI sceKernelSlvNotifyError(void);
+int APS5_VABI sceKernelSpawn(void);
+int APS5_VABI sceKernelStreamWriteActivate(void);
+int APS5_VABI sceKernelStreamWriteCreate(void);
+int APS5_VABI sceKernelStreamWriteDeactivate(void);
+int APS5_VABI sceKernelStreamWriteDelete(void);
+int APS5_VABI sceKernelStreamWriteRead(void);
+int APS5_VABI sceKernelStreamWriteStat(void);
+int APS5_VABI sceKernelStreamWriteWrite(void);
+int APS5_VABI sceKernelSuspendDirectMemoryRelease(void);
+int APS5_VABI sceKernelSuspendProcess(void);
+int APS5_VABI sceKernelSuspendSystem(void);
+int APS5_VABI sceKernelSwitchToBaseMode(void);
+int APS5_VABI sceKernelSwitchToNativeMode(void);
+int APS5_VABI sceKernelSwitchToNeoMode(void);
+int APS5_VABI sceKernelTerminateProcess(void);
+int APS5_VABI sceKernelTerminateSysCore(void);
+int APS5_VABI sceKernelTitleWorkdaroundIsEnabled(void);
+int APS5_VABI sceKernelTraceMemoryTypeProtect(void);
+int APS5_VABI sceKernelTriggerEport(void);
+int APS5_VABI sceKernelVirtualQueryAll(void);
+int APS5_VABI sceKernelWaitCommandBufferCompletion(void);
+int APS5_VABI sceKernelWriteEventQueueOnCompletionCommand(void);
+int APS5_VABI sceKernelWriteMapCommand(void);
+int APS5_VABI sceKernelWriteMapCommand2(void);
+int APS5_VABI sceKernelWriteMapDirectCommand(void);
+int APS5_VABI sceKernelWriteMapDirectWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteMapWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteModifyMtypeProtectWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteModifyProtectCommand(void);
+int APS5_VABI sceKernelWriteModifyProtectWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteMultiMapCommand(void);
+int APS5_VABI sceKernelWriteMultiMapWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteRemapCommand(void);
+int APS5_VABI sceKernelWriteRemapWithGpuMaskIdCommand(void);
+int APS5_VABI sceKernelWriteSdkEventLog(void);
+int APS5_VABI sceKernelWriteSdkEventLogV(void);
+int APS5_VABI sceKernelWriteUnmapCommand(void);
+int APS5_VABI sceKernelWriteWaitOnAddressCommand(void);
+int APS5_VABI sceKernelWriteWaitOnCounterCommand(void);
+int APS5_VABI sceKernelWriteWriteAddressCommand(void);
+int APS5_VABI sceKernelWriteWriteCounterCommand(void);
+int APS5_VABI sceKernelYieldCpumode(void);
+int APS5_VABI sceLibcMspaceCreateForMonoMutex(void);
+int APS5_VABI scePthreadAtfork(void (APS5_VABI* prepare)(), void (APS5_VABI* parent)(), void (APS5_VABI* child)());
+int APS5_VABI scePthreadAttrGetscope(const PthreadAttr* attr, int* scope);
+int APS5_VABI scePthreadAttrSetcreatesuspend(void);
+int APS5_VABI scePthreadAttrSetscope(PthreadAttr* attr, int scope);
+int APS5_VABI scePthreadBarrierDestroy(PthreadBarrierPrivate** barrier);
+int APS5_VABI scePthreadBarrierInit(PthreadBarrierPrivate** barrier, PthreadBarrierattrPrivate* const* attr, unsigned count, const char* name);
+int APS5_VABI scePthreadBarrierWait(PthreadBarrierPrivate** barrier);
+int APS5_VABI scePthreadBarrierattrDestroy(PthreadBarrierattrPrivate** attr);
+int APS5_VABI scePthreadBarrierattrGetpshared(PthreadBarrierattrPrivate* const* attr, int* pshared);
+int APS5_VABI scePthreadBarrierattrInit(PthreadBarrierattrPrivate** attr);
+int APS5_VABI scePthreadBarrierattrSetpshared(PthreadBarrierattrPrivate** attr, int pshared);
+int APS5_VABI scePthreadGetconcurrency(void);
+int APS5_VABI scePthreadGetcpuclockid(Pthread thread, int* clockId);
+int APS5_VABI scePthreadMain(void);
+int APS5_VABI scePthreadMulti(void);
+int APS5_VABI scePthreadMutexGetprioceiling(void);
+int APS5_VABI scePthreadMutexInitForInternalLibc(void);
+int APS5_VABI scePthreadMutexIsowned(void);
+int APS5_VABI scePthreadMutexSetprioceiling(void);
+int APS5_VABI scePthreadMutexattrGetgen(void);
+int APS5_VABI scePthreadMutexattrGetkind(void);
+int APS5_VABI scePthreadMutexattrInitForInternalLibc(void);
+int APS5_VABI scePthreadMutexattrSetgen(void);
+int APS5_VABI scePthreadMutexattrSetkind(void);
+int APS5_VABI scePthreadResume(void);
+int APS5_VABI scePthreadResumeAll(void);
+int APS5_VABI scePthreadSetBesteffort(void);
+int APS5_VABI scePthreadSetconcurrency(int level);
+int APS5_VABI scePthreadSingle(void);
+int APS5_VABI scePthreadSuspend(void);
+int APS5_VABI scePthreadSuspendAll(void);
+int APS5_VABI scePthreadTimedjoin(void);
+int APS5_VABI sched_getparam_nid_postfix(void);
+int APS5_VABI sched_getscheduler_nid_postfix(void);
+int APS5_VABI sched_setparam_nid_postfix(void);
+int APS5_VABI sched_setscheduler_nid_postfix(void);
+int APS5_VABI sem_setname_nid_postfix(void);
+int APS5_VABI set_phys_fmem_limit_nid_postfix(void);
+int APS5_VABI setlogin_nid_postfix(void);
+int APS5_VABI settimeofday_nid_postfix(void);
+int APS5_VABI sigqueue_nid_postfix(void);
+int APS5_VABI sigreturn_nid_postfix(void);
+int APS5_VABI statfs_nid_postfix(void);
+int APS5_VABI swapcontext_nid_postfix(void);
+int APS5_VABI swapon_nid_postfix(void);
+int APS5_VABI symlinkat_nid_postfix(void);
+int APS5_VABI sysKernelGetIntdevModeForInternalLibc_nid_postfix(void);
+int APS5_VABI sysKernelGetIntdevModeForRcmgr_nid_postfix(void);
+int APS5_VABI sysKernelGetManufacturingMode_nid_postfix(void);
+int APS5_VABI sysKernelGetUpdVersion_nid_postfix(void);
+int APS5_VABI sysc_e00_nid_postfix(void);
+int APS5_VABI sysc_m00_nid_postfix(void);
+int APS5_VABI sysc_s00_nid_postfix(void);
+int APS5_VABI tcgetsid_nid_postfix(void);
+int APS5_VABI tcsetsid_nid_postfix(void);
+int APS5_VABI unmount_nid_postfix(void);
+int APS5_VABI utrace_nid_postfix(void);
+int APS5_VABI uuidgen_nid_postfix(void);
+int APS5_VABI vfork_nid_postfix(void);
+int APS5_VABI wait3_nid_postfix(void);
+int APS5_VABI wait4_nid_postfix(void);
+
+int APS5_VABI _openat_nid_postfix(int fd, const char* path, int flags, ...);
+
+}
diff --git a/core/libs/prx/libkernel_sys/libkernel_sys.hpp b/core/libs/prx/libkernel_sys/libkernel_sys.hpp
new file mode 100644
index 0000000000..d1700db775
--- /dev/null
+++ b/core/libs/prx/libkernel_sys/libkernel_sys.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libkernel_sys/include/Api.hpp"
diff --git a/core/libs/prx/libkernel_web/libkernel_web.hpp b/core/libs/prx/libkernel_web/libkernel_web.hpp
new file mode 100644
index 0000000000..6f70f09bee
--- /dev/null
+++ b/core/libs/prx/libkernel_web/libkernel_web.hpp
@@ -0,0 +1 @@
+#pragma once
diff --git a/core/libs/prx/libmdbg_syscore/Export.cpp b/core/libs/prx/libmdbg_syscore/Export.cpp
index 195bb3c119..77409149dd 100644
--- a/core/libs/prx/libmdbg_syscore/Export.cpp
+++ b/core/libs/prx/libmdbg_syscore/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/libmdbg_syscore/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/libmdbg_syscore/include/Api.hpp b/core/libs/prx/libmdbg_syscore/include/Api.hpp
new file mode 100644
index 0000000000..9008d00bb7
--- /dev/null
+++ b/core/libs/prx/libmdbg_syscore/include/Api.hpp
@@ -0,0 +1,151 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI sceDebugAcquireAndUpdateDebugRegister();
+int APS5_VABI sceDebugAttachProcess();
+int APS5_VABI sceDebugCancelCoredump();
+int APS5_VABI sceDebugClearStepThread();
+int APS5_VABI sceDebugCreatePerfScratchDataArea();
+int APS5_VABI sceDebugCreatePerfScratchExecutableArea();
+int APS5_VABI sceDebugCreateScratchDataArea();
+int APS5_VABI sceDebugCreateScratchDataAreaForPrx();
+int APS5_VABI sceDebugCreateScratchExecutableArea();
+int APS5_VABI sceDebugCreateScratchExecutableAreaForPrx();
+int APS5_VABI sceDebugDestroyPerfScratchDataArea();
+int APS5_VABI sceDebugDestroyPerfScratchExecutableArea();
+int APS5_VABI sceDebugDestroyScratchDataArea();
+int APS5_VABI sceDebugDestroyScratchExecutableArea();
+int APS5_VABI sceDebugDetachProcess();
+int APS5_VABI sceDebugGetApplicationIdByTitleId();
+int APS5_VABI sceDebugGetApplicationInfo();
+int APS5_VABI sceDebugGetApplicationList();
+int APS5_VABI sceDebugGetCrashInfoDetailForCoredump();
+int APS5_VABI sceDebugGetCrashInfoForCoredump();
+int APS5_VABI sceDebugGetDLLoadFlag();
+int APS5_VABI sceDebugGetDataListOfUltQueue();
+int APS5_VABI sceDebugGetDebugRegisterStatusMap();
+int APS5_VABI sceDebugGetEventList();
+int APS5_VABI sceDebugGetEventListForEQueueFd();
+int APS5_VABI sceDebugGetEventSubscriptionList();
+int APS5_VABI sceDebugGetEventSubscriptionListForEQueueFd();
+int APS5_VABI sceDebugGetFiberInfo();
+int APS5_VABI sceDebugGetFileInfo();
+int APS5_VABI sceDebugGetFileInfoForCoredump();
+int APS5_VABI sceDebugGetFileList();
+int APS5_VABI sceDebugGetFileListForCoredump();
+int APS5_VABI sceDebugGetGpuInfoArea();
+int APS5_VABI sceDebugGetJobManagerInfo();
+int APS5_VABI sceDebugGetJobManagerSequenceInfo();
+int APS5_VABI sceDebugGetJobManagerSequenceList();
+int APS5_VABI sceDebugGetModuleInfo();
+int APS5_VABI sceDebugGetModuleList();
+int APS5_VABI sceDebugGetModuleMetaData();
+int APS5_VABI sceDebugGetMonoVMInfo();
+int APS5_VABI sceDebugGetMonoVMList();
+int APS5_VABI sceDebugGetProcessCoredumpHandlerEventBlob();
+int APS5_VABI sceDebugGetProcessCoredumpHandlerEventInfo();
+int APS5_VABI sceDebugGetProcessCoredumpHandlerResult();
+int APS5_VABI sceDebugGetProcessEventCntlFlag();
+int APS5_VABI sceDebugGetProcessInfo();
+int APS5_VABI sceDebugGetProcessList();
+int APS5_VABI sceDebugGetProcessPropertyForCoredump();
+int APS5_VABI sceDebugGetProcessResourceStatCount();
+int APS5_VABI sceDebugGetProcessResourceStatData();
+int APS5_VABI sceDebugGetProcessTime();
+int APS5_VABI sceDebugGetProcessTimeCounter();
+int APS5_VABI sceDebugGetSyncExclusiveWaiterList();
+int APS5_VABI sceDebugGetSyncObjectData();
+int APS5_VABI sceDebugGetSyncObjectList();
+int APS5_VABI sceDebugGetSyncWaiterList();
+int APS5_VABI sceDebugGetSyncWaiterListForEQueueFd();
+int APS5_VABI sceDebugGetSystemStatusBlob();
+int APS5_VABI sceDebugGetSystemStatusCount();
+int APS5_VABI sceDebugGetThreadInfo();
+int APS5_VABI sceDebugGetThreadInfoByIdent();
+int APS5_VABI sceDebugGetThreadList();
+int APS5_VABI sceDebugGetThreadListAsIdent();
+int APS5_VABI sceDebugGetUlObjectList();
+int APS5_VABI sceDebugGetUltCondvarInfo();
+int APS5_VABI sceDebugGetUltInfo();
+int APS5_VABI sceDebugGetUltListOfUltRuntime();
+int APS5_VABI sceDebugGetUltMutexInfo();
+int APS5_VABI sceDebugGetUltQueueDataResourcePoolInfo();
+int APS5_VABI sceDebugGetUltQueueInfo();
+int APS5_VABI sceDebugGetUltRuntimeInfo();
+int APS5_VABI sceDebugGetUltRwlockInfo();
+int APS5_VABI sceDebugGetUltSemaphoreInfo();
+int APS5_VABI sceDebugGetUltWaitingQueueResourcePoolInfo();
+int APS5_VABI sceDebugGetVirtualMemoryDetailInfoForCoredump();
+int APS5_VABI sceDebugGetVirtualMemoryInfo();
+int APS5_VABI sceDebugGetVirtualMemoryInfoForCoredump();
+int APS5_VABI sceDebugGetWaitingListOfUltCondvar();
+int APS5_VABI sceDebugGetWaitingListOfUltMutex();
+int APS5_VABI sceDebugGetWaitingListOfUltQueue();
+int APS5_VABI sceDebugGetWaitingListOfUltRwlock();
+int APS5_VABI sceDebugGetWaitingListOfUltSemaphore();
+int APS5_VABI sceDebugGetWorkerThreadListOfUltRuntime();
+int APS5_VABI sceDebugInit();
+int APS5_VABI sceDebugInitForCoredump();
+int APS5_VABI sceDebugInitForTest();
+int APS5_VABI sceDebugIpmiGetBlockTimeInfoList();
+int APS5_VABI sceDebugIpmiGetBlockedIpcInfo();
+int APS5_VABI sceDebugIpmiGetChannelInfo();
+int APS5_VABI sceDebugIpmiGetChannelKidList();
+int APS5_VABI sceDebugIpmiGetChannelWaitingThreadList();
+int APS5_VABI sceDebugIpmiGetClientInfo();
+int APS5_VABI sceDebugIpmiGetClientKidList();
+int APS5_VABI sceDebugIpmiGetClientKidListByDump();
+int APS5_VABI sceDebugIpmiGetClientKidListByServerKid();
+int APS5_VABI sceDebugIpmiGetConnectRequestInfoList();
+int APS5_VABI sceDebugIpmiGetConnectionInfoList();
+int APS5_VABI sceDebugIpmiGetConnectionWaitingThreadListByClientKid();
+int APS5_VABI sceDebugIpmiGetConnectionWaitingThreadListBySessionKid();
+int APS5_VABI sceDebugIpmiGetDump();
+int APS5_VABI sceDebugIpmiGetEncryptedInfoAllForCoredump();
+int APS5_VABI sceDebugIpmiGetKidInfoListForCoredump();
+int APS5_VABI sceDebugIpmiGetServerDispatchInfo();
+int APS5_VABI sceDebugIpmiGetServerInfo();
+int APS5_VABI sceDebugIpmiGetServerKidList();
+int APS5_VABI sceDebugIpmiGetServerKidListByDump();
+int APS5_VABI sceDebugIpmiGetServerWaitingThreadList();
+int APS5_VABI sceDebugIpmiGetSessionInfo();
+int APS5_VABI sceDebugIpmiGetSessionKidList();
+int APS5_VABI sceDebugIpmiGetSessionKidListByServerKid();
+int APS5_VABI sceDebugIpmiGetTidListByDump();
+int APS5_VABI sceDebugKillApplication();
+int APS5_VABI sceDebugKillProcess();
+int APS5_VABI sceDebugNoStopChildProcesses();
+int APS5_VABI sceDebugNoStopOnDLLoad();
+int APS5_VABI sceDebugProcessSpawn();
+int APS5_VABI sceDebugReadEvent();
+int APS5_VABI sceDebugReadEventForTest();
+int APS5_VABI sceDebugReadProcessMemory();
+int APS5_VABI sceDebugReadProcessMemoryForSDBGP();
+int APS5_VABI sceDebugReadProcessRegister();
+int APS5_VABI sceDebugReadProcessRegisterForSDBGP();
+int APS5_VABI sceDebugReadProcessResourceStatData();
+int APS5_VABI sceDebugReadThreadRegister();
+int APS5_VABI sceDebugReadThreadRegisterForSDBGP();
+int APS5_VABI sceDebugReleaseDebugRegister();
+int APS5_VABI sceDebugResumeApplication();
+int APS5_VABI sceDebugResumeProcess();
+int APS5_VABI sceDebugResumeThread();
+int APS5_VABI sceDebugSetProcessEventCntlFlag();
+int APS5_VABI sceDebugSetStepThread();
+int APS5_VABI sceDebugSpawnApplication();
+int APS5_VABI sceDebugStopChildProcesses();
+int APS5_VABI sceDebugStopOnDLLoad();
+int APS5_VABI sceDebugSuspendApplication();
+int APS5_VABI sceDebugSuspendProcess();
+int APS5_VABI sceDebugSuspendThread();
+int APS5_VABI sceDebugTriggerCoredump();
+int APS5_VABI sceDebugTriggerCoredumpForSystem();
+int APS5_VABI sceDebugTriggerVrCaptureDump();
+int APS5_VABI sceDebugWriteProcessMemory();
+int APS5_VABI sceDebugWriteProcessRegister();
+int APS5_VABI sceDebugWriteThreadRegister();
+
+}
diff --git a/core/libs/prx/libmdbg_syscore/libmdbg_syscore.hpp b/core/libs/prx/libmdbg_syscore/libmdbg_syscore.hpp
new file mode 100644
index 0000000000..8a0fe08e5f
--- /dev/null
+++ b/core/libs/prx/libmdbg_syscore/libmdbg_syscore.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/libmdbg_syscore/include/Api.hpp"
diff --git a/core/libs/prx/ulobjmgr/Export.cpp b/core/libs/prx/ulobjmgr/Export.cpp
index 25b7f547b2..93b5fa3ddb 100644
--- a/core/libs/prx/ulobjmgr/Export.cpp
+++ b/core/libs/prx/ulobjmgr/Export.cpp
@@ -1,3 +1,4 @@
+#include "prx/ulobjmgr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
 #include "SceTypes.hpp"
diff --git a/core/libs/prx/ulobjmgr/include/Api.hpp b/core/libs/prx/ulobjmgr/include/Api.hpp
new file mode 100644
index 0000000000..2f2e574e66
--- /dev/null
+++ b/core/libs/prx/ulobjmgr/include/Api.hpp
@@ -0,0 +1,10 @@
+#pragma once
+
+#include "SceTypes.hpp"
+
+extern "C" {
+
+int APS5_VABI _sceUlobjmgrRegisterObject(std::uint64_t object, std::int32_t kind, std::uint32_t* id);
+int APS5_VABI _sceUlobjmgrUnregisterObject(std::uint32_t id);
+
+}
diff --git a/core/libs/prx/ulobjmgr/ulobjmgr.hpp b/core/libs/prx/ulobjmgr/ulobjmgr.hpp
new file mode 100644
index 0000000000..3a6f8594df
--- /dev/null
+++ b/core/libs/prx/ulobjmgr/ulobjmgr.hpp
@@ -0,0 +1,3 @@
+#pragma once
+
+#include "prx/ulobjmgr/include/Api.hpp"
diff --git a/core/libs/tests/AppArchiveFixture.hpp b/core/libs/tests/AppArchiveFixture.hpp
index b6c5e4529c..234c647e3c 100644
--- a/core/libs/tests/AppArchiveFixture.hpp
+++ b/core/libs/tests/AppArchiveFixture.hpp
@@ -20,8 +20,11 @@ inline std::vector<char> Pattern(std::size_t size) {
 }
 
 inline std::filesystem::path EnterFreshRoot(const char* name) {
-    const auto root = std::filesystem::temp_directory_path() /
-        (std::string(name) + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    std::filesystem::path root;
+    do {
+        root = std::filesystem::temp_directory_path() /
+            (std::string(name) + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    } while (!std::filesystem::create_directory(root));
     std::filesystem::create_directories(root / "app0" / "sce_sys");
     std::filesystem::current_path(root);
     return std::filesystem::canonical(root);
diff --git a/core/libs/tests/ApplicationHeap.cpp b/core/libs/tests/ApplicationHeap.cpp
index be99345d50..8c02b16146 100644
--- a/core/libs/tests/ApplicationHeap.cpp
+++ b/core/libs/tests/ApplicationHeap.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -22,24 +23,9 @@
 #endif
 
 extern "C" {
-void APS5_VABI _init_env_nid_postfix();
-int APS5_VABI posix_memalign_nid_postfix(void**, std::size_t, std::size_t);
-void* APS5_VABI reallocf_nid_postfix(void*, std::size_t);
-void* APS5_VABI _Znwm_nid_postfix(std::size_t);
-void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void APS5_VABI _ZdlPv_nid_postfix(void*);
-void APS5_VABI _ZdaPv_nid_postfix(void*);
-void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void*, std::size_t);
-void APS5_VABI _ZdlPvmSt11align_val_t_nid_postfix(void*, std::size_t, std::size_t);
+
 void* ApplicationHeapRealign_nid_no_patch(void*, std::size_t, std::size_t);
-char* APS5_VABI strdup_nid_postfix(const char*);
-char* APS5_VABI strndup_nid_postfix(const char*, std::size_t);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI atexit_nid_postfix(void (APS5_VABI*)());
-void* APS5_VABI scriptingGetMem_nid_postfix(std::size_t, std::size_t);
-void APS5_VABI scriptingFreeMem_nid_postfix(void*);
+
 }
 
 namespace {
@@ -256,8 +242,10 @@ int main(int argc, char** argv) {
         require(initializes == 0);
         require(_Znwm_nid_postfix(40) == storage.data() && lastSize == 40 && initializes == 1);
         _ZdlPv_nid_postfix(storage.data());
+
         require(frees == 1);
         _init_env_nid_postfix();
+
         require(initializes == 1);
         return 0;
     }
@@ -275,11 +263,14 @@ int main(int argc, char** argv) {
         require(first[blockBytes - 1] == std::byte{0x5a} && second[0] == std::byte{0xa5});
         scriptingFreeMem_nid_postfix(first);
         scriptingFreeMem_nid_postfix(second);
+
         require(initializes == 0 && frees == 0);
         _init_env_nid_postfix();
+
         require(initializes == 1);
         require(_Znwm_nid_postfix(40) == storage.data() && lastSize == 40);
         _ZdlPv_nid_postfix(storage.data());
+
         require(frees == 1);
         return 0;
     }
@@ -303,7 +294,8 @@ int main(int argc, char** argv) {
         for (unsigned i = 0; i < 63; ++i) require(pointer[i] == 0x5a);
         pointer = static_cast<unsigned char*>(ApplicationHeapReallocate_nid_no_patch(pointer, 11));
         for (unsigned i = 0; i < 11; ++i) require(pointer[i] == 0x5a);
-        require(ApplicationHeapReallocate_nid_no_patch(pointer, 0) == nullptr);
+        require(ApplicationHeapReallocate_nid_no_patch(pointer, 0) == pointer && ApplicationHeapUsableSize_nid_no_patch(pointer) == 0);
+        ApplicationHeapFree_nid_no_patch(pointer);
         pointer = static_cast<unsigned char*>(ApplicationHeapReallocate_nid_no_patch(nullptr, 32));
         require(pointer != nullptr);
         ApplicationHeapFree_nid_no_patch(pointer);
@@ -317,14 +309,20 @@ int main(int argc, char** argv) {
         require(pointer != nullptr && ApplicationHeapUsableSize_nid_no_patch(pointer) == 9);
         for (unsigned i = 0; i < 9; ++i) require(pointer[i] == 0x3c);
         *__error_nid_postfix() = 0;
-        require(reallocf_nid_postfix(pointer, 0) == nullptr && *__error_nid_postfix() == 0);
+        require(reallocf_nid_postfix(pointer, 0) == pointer && *__error_nid_postfix() == 0 && ApplicationHeapUsableSize_nid_no_patch(pointer) == 0);
+        ApplicationHeapFree_nid_no_patch(pointer);
         reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); });
         pointer = static_cast<unsigned char*>(reallocf_nid_postfix(nullptr, 40));
         require(pointer != nullptr);
-        require(reallocf_nid_postfix(pointer, SIZE_MAX - 4096) == nullptr && *__error_nid_postfix() == 12);
+        *__error_nid_postfix() = 77;
+        require(reallocf_nid_postfix(pointer, SIZE_MAX - 4096) == nullptr && *__error_nid_postfix() == 77);
         reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); });
-        *__error_nid_postfix() = 0;
-        require(reallocf_nid_postfix(nullptr, SIZE_MAX) == nullptr && *__error_nid_postfix() == 12);
+        pointer = static_cast<unsigned char*>(reallocf_nid_postfix(nullptr, 40));
+        require(pointer != nullptr);
+        require(reallocf_nid_postfix(pointer, SIZE_MAX - 0x1008f) == nullptr && *__error_nid_postfix() == 22);
+        reject([pointer] { ApplicationHeapUsableSize_nid_no_patch(pointer); });
+        *__error_nid_postfix() = 77;
+        require(reallocf_nid_postfix(nullptr, SIZE_MAX) == nullptr && *__error_nid_postfix() == 77);
         void* empty = ApplicationHeapAllocate_nid_no_patch(0);
         require(empty != nullptr);
         ApplicationHeapFree_nid_no_patch(empty);
@@ -335,6 +333,7 @@ int main(int argc, char** argv) {
             auto* aligned = ApplicationHeapAlign_nid_no_patch(alignment, 37);
             require(reinterpret_cast<std::uintptr_t>(aligned) % alignment == 0);
             _ZdlPvSt11align_val_t_nid_postfix(aligned, alignment);
+
         }
         void* aligned = nullptr;
         require(ApplicationHeapPosixAlign_nid_no_patch(&aligned, 256, 99) == 0);
@@ -378,21 +377,27 @@ int main(int argc, char** argv) {
     require(_Znwm_nid_postfix(0) == storage.data() && lastSize == 1);
     _ZdlPv_nid_postfix(storage.data());
     _ZdlPv_nid_postfix(nullptr);
+
     require(frees == 3);
     require(_ZnamRKSt9nothrow_t_nid_postfix(24, nullptr) == storage.data() && lastSize == 24);
     _ZdaPv_nid_postfix(storage.data());
+
     require(frees == 4);
     require(ApplicationHeapRealign_nid_no_patch(storage.data(), 48, 32) == storage.data() && lastSize == 48 && lastAlignment == 32);
     reject([] { ApplicationHeapRealign_nid_no_patch(storage.data(), 16, 4096); });
     pointer = ApplicationHeapAlign_nid_no_patch(64, 37);
     _ZdlPvSt11align_val_t_nid_postfix(pointer, 64);
+
     require(frees == 5);
     _ZdlPvSt11align_val_t_nid_postfix(nullptr, 64);
+
     require(frees == 5);
     pointer = ApplicationHeapAlign_nid_no_patch(64, 37);
     _ZdlPvmSt11align_val_t_nid_postfix(pointer, 37, 64);
+
     require(frees == 6);
     _ZdlPvmSt11align_val_t_nid_postfix(nullptr, 37, 64);
+
     require(frees == 6);
     require(reallocf_nid_postfix(storage.data(), 80) == storage.data() && lastSize == 80 && frees == 6);
     require(reallocf_nid_postfix(storage.data(), 16) == storage.data() && lastSize == 16 && frees == 6);
@@ -473,6 +478,7 @@ int main(int argc, char** argv) {
     const auto beforeScripting = frees;
     const auto sizeBeforeScripting = lastSize;
     scriptingFreeMem_nid_postfix(nullptr);
+
     auto* small = static_cast<std::byte*>(scriptingGetMem_nid_postfix(0, 31));
     auto* aligned = static_cast<std::byte*>(scriptingGetMem_nid_postfix(64, 37));
     require(small != nullptr && small != storage.data() && reinterpret_cast<std::uintptr_t>(small) % 16 == 0);
@@ -482,12 +488,14 @@ int main(int argc, char** argv) {
     require(small + 31 <= aligned || aligned + 37 <= small);
     scriptingFreeMem_nid_postfix(small);
     scriptingFreeMem_nid_postfix(aligned);
+
     require(scriptingGetMem_nid_postfix(24, 80) == nullptr);
     require(scriptingGetMem_nid_postfix(16, std::numeric_limits<std::size_t>::max()) == nullptr);
     fail = true;
     auto* unaffected = scriptingGetMem_nid_postfix(16, 64);
     require(unaffected != nullptr);
     scriptingFreeMem_nid_postfix(unaffected);
+
     fail = false;
     require(frees == beforeScripting && lastSize == sizeBeforeScripting);
 }
diff --git a/core/libs/tests/ApplicationHeapStats.cpp b/core/libs/tests/ApplicationHeapStats.cpp
index 1345d218d1..8844a5c835 100644
--- a/core/libs/tests/ApplicationHeapStats.cpp
+++ b/core/libs/tests/ApplicationHeapStats.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -6,11 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI malloc_stats_fast_nid_postfix(void*);
-std::size_t APS5_VABI malloc_usable_size_nid_postfix(void*);
-}
-
 namespace {
 
 alignas(64) std::array<std::byte, 256> storage{};
diff --git a/core/libs/tests/ExceptionCCleanup.cpp b/core/libs/tests/ExceptionCCleanup.cpp
index cca7677edb..9612a8aaa3 100644
--- a/core/libs/tests/ExceptionCCleanup.cpp
+++ b/core/libs/tests/ExceptionCCleanup.cpp
@@ -1,10 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdio>
 #include <sys/wait.h>
 #include <unistd.h>
 
 extern "C" void CallWithCleanup(void (*function)(), int* count);
 extern "C" void CallAroundCleanup(void (*before)(), void (*within)(), int* count);
-extern "C" void (*_ZSt13set_terminatePFvvE_nid_postfix(void (*)()))();
 
 int cleanups;
 
diff --git a/core/libs/tests/ExceptionRuntime.cpp b/core/libs/tests/ExceptionRuntime.cpp
index 54111f196c..8eb7fde24e 100644
--- a/core/libs/tests/ExceptionRuntime.cpp
+++ b/core/libs/tests/ExceptionRuntime.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #undef NDEBUG
 #include <cassert>
 #include <cstdio>
@@ -19,28 +20,6 @@
 #ifdef __linux__
 #include <sys/prctl.h>
 #endif
-#include <unwind.h>
-
-extern "C" unsigned __cxa_uncaught_exceptions_nid_postfix();
-extern "C" void* __cxa_current_primary_exception_nid_postfix();
-extern "C" void __cxa_decrement_exception_refcount_nid_postfix(void*);
-extern "C" void __cxa_rethrow_primary_exception_nid_postfix(void*);
-
-extern "C" [[noreturn]] void _ZSt14_Xout_of_rangePKc_nid_postfix(const char*);
-extern "C" [[noreturn]] void _ZSt13_Xrange_errorPKc_nid_postfix(const char*);
-extern "C" [[noreturn]] void _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix();
-extern "C" [[noreturn]] void __cxa_bad_cast_nid_postfix();
-extern "C" [[noreturn]] void _ZSt19_Throw_bad_weak_ptrv_nid_postfix();
-extern "C" [[noreturn]] void _ZSt26__throw_bad_variant_accessv_nid_postfix();
-extern "C" [[noreturn]] void _ZSt26_Throw_bad_optional_accessv_nid_postfix();
-extern "C" [[noreturn]] void _ZNKSt9exception6_RaiseEv_nid_postfix(const void*);
-extern "C" void* __cxa_vec_new3_nid_postfix(std::size_t, std::size_t, std::size_t, void(*)(void*), void(*)(void*), void*(*)(std::size_t), void(*)(void*, std::size_t));
-extern "C" void __cxa_vec_delete3_nid_postfix(void*, std::size_t, std::size_t, void(*)(void*), void(*)(void*, std::size_t));
-extern "C" _Unwind_Reason_Code _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn, void*);
-extern "C" _Unwind_Reason_Code _Unwind_ForcedUnwind_nid_postfix(_Unwind_Exception*, _Unwind_Stop_Fn, void*);
-extern "C" std::uintptr_t _Unwind_GetIP_nid_postfix(_Unwind_Context*);
-extern "C" std::uintptr_t _Unwind_GetGR_nid_postfix(_Unwind_Context*, int);
-extern "C" void (*_ZSt13set_terminatePFvvE_nid_postfix(void(*)()))();
 
 thread_local int destroyed = 0;
 struct Guard {
@@ -99,7 +78,7 @@ void CheckForeign() {
         assert(reason == _URC_FOREIGN_EXCEPTION_CAUGHT); ++foreignDeleted; delete p;
     };
     try {
-        try { _Unwind_RaiseException(exception); assert(false); }
+        try { _Unwind_RaiseException_nid_postfix(exception); assert(false); }
         catch (...) { assert(__cxa_current_primary_exception_nid_postfix() == nullptr); throw; }
     } catch (...) {}
     assert(foreignDeleted == 1);
@@ -134,6 +113,7 @@ void CheckArrays() {
     failArray = true;
     try {
         __cxa_vec_new3_nid_postfix(4, sizeof(int), sizeof(std::size_t), ArrayConstruct, ArrayDestroy, std::malloc, ArrayFree);
+
         assert(false);
     } catch (int value) { assert(value == 73); }
     assert(arrayConstructed == 2 && arrayDestroyed == 2 && arrayFreed == 1);
@@ -141,6 +121,7 @@ void CheckArrays() {
     failArray = false;
     void* array = __cxa_vec_new3_nid_postfix(4, sizeof(int), sizeof(std::size_t), ArrayConstruct, ArrayDestroy, std::malloc, ArrayFree);
     __cxa_vec_delete3_nid_postfix(array, sizeof(int), sizeof(std::size_t), ArrayDestroy, ArrayFree);
+
     assert(arrayConstructed == 4 && arrayDestroyed == 4 && arrayFreed == 1);
 }
 void* ThreadTest(void*) {
@@ -226,6 +207,7 @@ int main() {
     try { __cxa_rethrow_primary_exception_nid_postfix(retained); assert(false); }
     catch (int value) { assert(value == 27); }
     __cxa_decrement_exception_refcount_nid_postfix(retained);
+
     {
         auto made = std::make_exception_ptr(Counted());
         try { std::rethrow_exception(made); assert(false); } catch (const Counted&) {}
@@ -248,8 +230,17 @@ int main() {
     catch (const std::range_error&) {}
     bool badFunctionCall = false;
     try { _ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix(); }
-    catch (const std::bad_function_call&) { badFunctionCall = true; }
+    catch (const std::bad_function_call&) { std::abort(); }
+    catch (const std::exception& value) {
+        if (std::strcmp(typeid(value).name(), "NSt8__sce_v217bad_function_callE") != 0) std::abort();
+        if (std::strcmp(value.what(), "bad function call") != 0) std::abort();
+        badFunctionCall = true;
+    }
     if (!badFunctionCall) std::abort();
+    bool plainBadFunctionCall = false;
+    try { _ZSt19_Xbad_function_callv_nid_postfix(); }
+    catch (const std::bad_function_call&) { plainBadFunctionCall = true; }
+    if (!plainBadFunctionCall) std::abort();
     try { __cxa_bad_cast_nid_postfix(); }
     catch (const std::exception& value) { assert(value.what() != nullptr); }
     try { _ZSt19_Throw_bad_weak_ptrv_nid_postfix(); std::abort(); }
@@ -260,8 +251,17 @@ int main() {
     catch (const std::bad_optional_access& value) { if (std::strcmp(value.what(), "bad_optional_access") != 0) std::abort(); }
     try { _ZNKSt9exception6_RaiseEv_nid_postfix(nullptr); assert(false); }
     catch (const std::invalid_argument&) {}
-    try { _ZNKSt9exception6_RaiseEv_nid_postfix(&object); assert(false); }
+    LibcException::ExceptionObject exceptionObject {};
+    _ZNSt9exceptionC1Ev_nid_postfix(&exceptionObject);
+    try { _ZNKSt9exception6_RaiseEv_nid_postfix(&exceptionObject); assert(false); }
     catch (const std::exception& value) { assert(std::strcmp(value.what(), "std::exception") == 0); }
+    _ZNSt9exceptionD1Ev_nid_postfix(&exceptionObject);
+    try { _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(nullptr); assert(false); }
+    catch (const std::invalid_argument&) {}
+    _ZNSt8bad_castC1Ev_nid_postfix(&exceptionObject);
+    try { _ZNKSt8bad_cast8_DoraiseEv_nid_postfix(&exceptionObject); assert(false); }
+    catch (const std::bad_cast&) {}
+    _ZNSt8bad_castD1Ev_nid_postfix(&exceptionObject);
     CheckRtti();
     CheckForeign();
     CheckStaticInitialization();
diff --git a/core/libs/tests/Fiber.cpp b/core/libs/tests/Fiber.cpp
index 2267ee2497..9f77bd063e 100644
--- a/core/libs/tests/Fiber.cpp
+++ b/core/libs/tests/Fiber.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFiber/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -12,20 +13,6 @@
 
 using Entry = void (APS5_VABI*)(std::uint64_t, std::uint64_t);
 
-extern "C" {
-std::int32_t APS5_VABI _sceFiberInitializeImpl_nid_postfix(FiberObject*, const char*, Entry, std::uint64_t, void*, std::uint64_t, const void*, std::uint32_t);
-std::int32_t APS5_VABI sceFiberFinalize(FiberObject*);
-std::int32_t APS5_VABI sceFiberRun_nid_postfix(FiberObject*, std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberSwitch(FiberObject*, std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberReturnToThread(std::uint64_t, std::uint64_t*);
-std::int32_t APS5_VABI sceFiberGetSelf(FiberObject**);
-std::int32_t APS5_VABI sceFiberGetInfo(FiberObject*, FiberInfo*);
-std::int32_t APS5_VABI sceFiberGetThreadFramePointerAddress(std::uint64_t*);
-std::int32_t APS5_VABI _sceFiberGetThreadFramePointerAddress(std::uint64_t*);
-std::int32_t APS5_VABI sceFiberStartContextSizeCheck(std::uint32_t);
-std::int32_t APS5_VABI sceFiberStopContextSizeCheck(void);
-}
-
 static void Require(bool value, const char* what) {
     if (!value) { std::fprintf(stderr, "Fiber check failed: %s\n", what); std::abort(); }
 }
@@ -33,6 +20,8 @@ static void Require(bool value, const char* what) {
 namespace {
 
 constexpr std::int32_t FiberErrorNull = static_cast<std::int32_t>(0x80590001);
+constexpr std::int32_t FiberErrorAlignment = static_cast<std::int32_t>(0x80590002);
+constexpr std::int32_t FiberErrorRange = static_cast<std::int32_t>(0x80590003);
 constexpr std::int32_t FiberErrorInvalid = static_cast<std::int32_t>(0x80590004);
 constexpr std::int32_t FiberErrorPermission = static_cast<std::int32_t>(0x80590005);
 constexpr std::int32_t FiberErrorState = static_cast<std::int32_t>(0x80590006);
@@ -225,6 +214,7 @@ void APS5_VABI LargeContextEntry(std::uint64_t, std::uint64_t) {
     const auto* address = const_cast<const unsigned char*>(&local);
     g_largeOnContext = address >= g_largeContext.data() && address < g_largeContext.data() + g_largeContext.size();
     sceFiberReturnToThread(0, nullptr);
+
 }
 
 void RunOnLargeContext() {
@@ -235,6 +225,91 @@ void RunOnLargeContext() {
     Require(sceFiberFinalize(fiber) == 0, "finalize large fiber");
 }
 
+alignas(16) std::array<unsigned char, 64 * 1024> g_attachedContext;
+alignas(16) std::array<unsigned char, 4 * 1024> g_attachedSmallContext;
+FiberStorage g_attachedStorage;
+FiberStorage g_attachedTargetStorage;
+auto* const g_attached = reinterpret_cast<FiberObject*>(&g_attachedStorage);
+auto* const g_attachedTarget = reinterpret_cast<FiberObject*>(&g_attachedTargetStorage);
+
+void APS5_VABI AttachedTargetEntry(std::uint64_t argOnInitialize, std::uint64_t argOnRun) {
+    Require(argOnInitialize == 44 && argOnRun == 500, "attached switch target arguments");
+    CheckActiveContext(g_attachedTarget, g_attachedSmallContext.size());
+    std::uint64_t received = 0;
+    Require(sceFiberSwitch(g_attached, 600, &received) == 0, "switch back from the attached target");
+    Require(false, "attached switch target resumed after its last switch");
+}
+
+void APS5_VABI AttachedEntry(std::uint64_t argOnInitialize, std::uint64_t argOnRun) {
+    Require(argOnInitialize == 33 && argOnRun == 400, "attached fiber arguments");
+    FiberObject* self = nullptr;
+    Require(sceFiberGetSelf(&self) == 0 && self == g_attached, "attached fiber self");
+    CheckActiveContext(g_attached, g_attachedContext.size());
+    Require(_sceFiberAttachContextAndRun(g_attachedTarget, g_attachedSmallContext.data(), g_attachedSmallContext.size(), 0, nullptr) == FiberErrorPermission, "attach and run inside a fiber");
+    std::uint64_t received = 0;
+    Require(_sceFiberAttachContextAndSwitch(g_attached, g_attachedContext.data(), g_attachedContext.size(), 0, nullptr) == FiberErrorState, "attach and switch to self");
+    Require(_sceFiberAttachContextAndSwitch(g_attachedTarget, g_attachedSmallContext.data() + 8, g_attachedSmallContext.size() - 16, 500, nullptr) == FiberErrorAlignment, "attach and switch with a misaligned context");
+    Require(_sceFiberAttachContextAndSwitch(g_attachedTarget, g_attachedSmallContext.data(), g_attachedSmallContext.size(), 500, &received) == 0 && received == 600, "attach and switch");
+    Require(sceFiberReturnToThread(700, &received) == 0 && received == 800, "attached fiber resumed");
+    for (;;) sceFiberReturnToThread(received + 1, &received);
+}
+
+void APS5_VABI DefaultFpuEntry(std::uint64_t, std::uint64_t) {
+    std::uint16_t control = 0;
+    asm volatile("fnstcw %0" : "=m"(control));
+    std::uint64_t received = 0;
+    for (;;) sceFiberReturnToThread((static_cast<std::uint64_t>(control) << 32) | _mm_getcsr(), &received);
+}
+
+void RunAttachedContext() {
+    Require(_sceFiberInitializeImpl_nid_postfix(g_attached, "attached", AttachedEntry, 33, nullptr, 0, nullptr, 0) == 0, "initialize without a context");
+    Require(_sceFiberInitializeImpl_nid_postfix(g_attachedTarget, "attached target", AttachedTargetEntry, 44, nullptr, 0, nullptr, 0) == 0, "initialize switch target without a context");
+    FiberInfo info{};
+    info.size = sizeof(info);
+    Require(sceFiberGetInfo(g_attached, &info) == 0 && info.addr_context == nullptr && info.size_context == 0, "fiber without a context reports none");
+    Require(_sceFiberAttachContextAndRun(nullptr, g_attachedContext.data(), g_attachedContext.size(), 0, nullptr) == FiberErrorNull, "attach and run a null fiber");
+    Require(_sceFiberAttachContextAndRun(g_attached, nullptr, g_attachedContext.size(), 0, nullptr) == FiberErrorInvalid, "attach a null context with a size");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), 0, 0, nullptr) == FiberErrorRange, "attach a context without a size");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), 256, 0, nullptr) == FiberErrorRange, "attach a context below the minimum size");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), 1000, 0, nullptr) == FiberErrorAlignment, "attach a context of an unaligned size");
+    Require(_sceFiberAttachContextAndSwitch(g_attached, g_attachedContext.data(), g_attachedContext.size(), 0, nullptr) == FiberErrorPermission, "attach and switch outside a fiber");
+    std::uint64_t returned = 0;
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), g_attachedContext.size(), 400, &returned) == 0 && returned == 700, "attach and run");
+    Require(_sceFiberAttachContextAndRun(g_attached, g_attachedContext.data(), g_attachedContext.size(), 800, &returned) == FiberErrorInvalid, "attach to a fiber that has a context");
+    Require(_sceFiberAttachContextAndRun(g_attached, nullptr, 0, 800, &returned) == 0 && returned == 801, "run an attached fiber without a new context");
+    Require(sceFiberRun_nid_postfix(g_attached, 802, &returned) == 0 && returned == 803, "run an attached fiber");
+    Require(sceFiberFinalize(g_attachedTarget) == 0, "finalize a suspended attached target");
+    Require(sceFiberFinalize(g_attached) == 0, "finalize attached fiber");
+    Require(_sceFiberInitializeImpl_nid_postfix(g_attachedTarget, "attached target", AttachedTargetEntry, 44, nullptr, 0, nullptr, 0) == 0, "reinitialize attached target");
+    Require(sceFiberFinalize(g_attachedTarget) == 0, "finalize fiber without a context");
+}
+
+void RunInternalOptions() {
+    auto* fiber = reinterpret_cast<FiberObject*>(&g_checkedStorage);
+    Require(_sceFiberInitializeWithInternalOptionImpl(nullptr, "options", CheckedEntry, 0, g_checkedContext.data(), g_checkedContext.size(), nullptr, 0, 0) == FiberErrorNull, "internal option null fiber");
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "options", CheckedEntry, 0, g_checkedContext.data(), 256, nullptr, 0, 0) == FiberErrorRange, "internal option small context");
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "options", CheckedEntry, 0, g_checkedContext.data(), g_checkedContext.size(), nullptr, 0x1, 0) == 0, "internal option without object registration");
+    FiberInfo info{};
+    info.size = sizeof(info);
+    Require(sceFiberGetInfo(fiber, &info) == 0 && info.size_context_margin == ~0ull, "no margin without the size check flag");
+    Require(sceFiberFinalize(fiber) == 0, "finalize internal option fiber");
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "options", CheckedEntry, 0, g_checkedContext.data(), g_checkedContext.size(), nullptr, 0x10, 0) == 0, "internal option size check");
+    Require(sceFiberGetInfo(fiber, &info) == 0 && info.size_context_margin == g_checkedContext.size(), "size check flag fills the context");
+    Require(sceFiberRun_nid_postfix(fiber, 0, nullptr) == 0, "run size checked fiber");
+    Require(sceFiberGetInfo(fiber, &info) == 0 && info.size_context_margin < g_checkedContext.size() - 4096, "size check flag measures the margin");
+    Require(sceFiberFinalize(fiber) == 0, "finalize size checked fiber");
+
+    Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "fpu", DefaultFpuEntry, 0, nullptr, 0, nullptr, 0x100, 0) == 0, "internal option fpu defaults without a context");
+    const auto threadCsr = _mm_getcsr();
+    _mm_setcsr((threadCsr & ~0x8040u) | 0x6000u);
+    std::uint64_t returned = 0;
+    Require(_sceFiberAttachContextAndRun(fiber, g_checkedContext.data(), g_checkedContext.size(), 0, &returned) == 0, "run fpu defaults fiber");
+    _mm_setcsr(threadCsr);
+    Require((returned & 0xffffffffu) == 0x9fc0u, "fpu defaults flag starts with the default MXCSR");
+    Require((returned >> 32) == 0x037fu, "fpu defaults flag starts with the default x87 control word");
+    Require(sceFiberFinalize(fiber) == 0, "finalize fpu defaults fiber");
+}
+
 [[gnu::noinline]] std::int32_t RunFirst(std::uint64_t* returned) {
     g_threadFramePointer = reinterpret_cast<std::uint64_t>(__builtin_frame_address(0));
     const std::int32_t result = sceFiberRun_nid_postfix(g_first, 100, returned);
@@ -285,4 +360,6 @@ int main() {
     RunHostCallOnSmallContext();
     RunFrameChain();
     RunOnLargeContext();
+    RunAttachedContext();
+    RunInternalOptions();
 }
diff --git a/core/libs/tests/FilePosition.cpp b/core/libs/tests/FilePosition.cpp
index 0337c58932..9bd695cc15 100644
--- a/core/libs/tests/FilePosition.cpp
+++ b/core/libs/tests/FilePosition.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
@@ -12,12 +13,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI fgetpos_nid_postfix(FileStream*, std::int64_t*);
-int APS5_VABI fsetpos_nid_postfix(FileStream*, const std::int64_t*);
-std::int64_t APS5_VABI ftello_nid_postfix(FileStream*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "File position check failed at line %d\n", line);
diff --git a/core/libs/tests/FileStreams.cpp b/core/libs/tests/FileStreams.cpp
index 55445e2707..853a5b5484 100644
--- a/core/libs/tests/FileStreams.cpp
+++ b/core/libs/tests/FileStreams.cpp
@@ -1,8 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <barrier>
 #include <cerrno>
+#include <cstddef>
 #include <cstdint>
 #include <cstring>
 #include <filesystem>
@@ -21,29 +23,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-FileStream* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
-FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char*, int, int);
-FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, FileStream* stream);
-int APS5_VABI fclose_nid_postfix(FileStream* stream);
-std::size_t APS5_VABI fread_nid_postfix(void* buffer, std::size_t size, std::size_t count, FileStream* stream);
-std::size_t APS5_VABI fwrite_nid_postfix(const void* buffer, std::size_t size, std::size_t count, FileStream* stream);
-int APS5_VABI fseek_nid_postfix(FileStream* stream, std::int64_t offset, int origin);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream* stream);
-int APS5_VABI fputs_nid_postfix(const char* str, FileStream* stream);
-int APS5_VABI fflush_nid_postfix(FileStream* stream);
-int APS5_VABI remove_nid_postfix(const char* path);
-int APS5_VABI rename_nid_postfix(const char* from, const char* to);
-int APS5_VABI ferror_nid_postfix(FileStream* stream);
-int APS5_VABI feof_nid_postfix(FileStream* stream);
-void APS5_VABI clearerr_nid_postfix(FileStream* stream);
-int APS5_VABI fgetc_nid_postfix(FileStream* stream);
-int APS5_VABI getc_unlocked_nid_postfix(FileStream* stream);
-char* APS5_VABI fgets_nid_postfix(char* buffer, int size, FileStream* stream);
-int APS5_VABI ungetc_nid_postfix(int value, FileStream* stream);
-int APS5_VABI fscanf_nid_postfix(FileStream* stream, const char* format, ...);
-}
-
 static void Require(bool condition, const char* message = "File stream check failed") {
     if (!condition) throw std::runtime_error(message);
 }
@@ -222,6 +201,11 @@ int main(int argc, char** argv) {
     ExpectException([&] { fputs_nid_postfix(nullptr, stream); });
     ExpectException([&] { fwrite_nid_postfix(nullptr, 1, sizeof(payload), stream); });
     errno = 0;
+    Require(fread_nid_postfix(buffer.data(), 2, SIZE_MAX / 2 + 1, stream) == 0 && errno == EINVAL && ferror_nid_postfix(stream) == 0);
+    errno = 0;
+    Require(fread_nid_postfix(buffer.data(), 2, SIZE_MAX / 2 + 1, nullptr) == 0 && errno == EINVAL);
+    ExpectException([&] { fwrite_nid_postfix(buffer.data(), SIZE_MAX / 2 + 1, 2, stream); });
+    errno = 0;
     Require(fseek_nid_postfix(stream, 0, -1) == -1);
     Require(errno == EINVAL);
     Require(fclose_nid_postfix(stream) == 0);
diff --git a/core/libs/tests/FontFixture.hpp b/core/libs/tests/FontFixture.hpp
index 601512cd98..e6e7c11e2b 100644
--- a/core/libs/tests/FontFixture.hpp
+++ b/core/libs/tests/FontFixture.hpp
@@ -5,6 +5,7 @@
 #include <initializer_list>
 #include <map>
 #include <string>
+#include <string_view>
 #include <vector>
 
 namespace FontFixture {
@@ -20,6 +21,31 @@ inline std::vector<unsigned char> Words(std::initializer_list<int> values) {
     return out;
 }
 
+inline std::vector<unsigned char> BitmapFont() {
+    const std::string_view font =
+        "STARTFONT 2.1\n"
+        "FONT -anyps5-fixture-medium-r-normal--1-10-75-75-c-10-iso10646-1\n"
+        "SIZE 1 75 75\n"
+        "FONTBOUNDINGBOX 1 1 0 0\n"
+        "STARTPROPERTIES 4\n"
+        "FONT_ASCENT 1\n"
+        "FONT_DESCENT 0\n"
+        "CHARSET_REGISTRY \"ISO10646\"\n"
+        "CHARSET_ENCODING \"1\"\n"
+        "ENDPROPERTIES\n"
+        "CHARS 1\n"
+        "STARTCHAR A\n"
+        "ENCODING 65\n"
+        "SWIDTH 1000 0\n"
+        "DWIDTH 1 0\n"
+        "BBX 1 1 0 0\n"
+        "BITMAP\n"
+        "80\n"
+        "ENDCHAR\n"
+        "ENDFONT\n";
+    return {font.begin(), font.end()};
+}
+
 inline std::vector<unsigned char> BuildFont(int glyphCount, std::map<std::string, std::vector<unsigned char>> tables) {
     tables["glyf"] = Words({0, 0});
     tables["head"] = Words({1, 0, 1, 0, 0, 0, 0x5F0F, 0x3CF5, 0, 1000, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 2, 0, 0});
diff --git a/core/libs/tests/Formatting.cpp b/core/libs/tests/Formatting.cpp
index f22d7880dd..a7de87f988 100644
--- a/core/libs/tests/Formatting.cpp
+++ b/core/libs/tests/Formatting.cpp
@@ -1,8 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
 #include <algorithm>
 #include <array>
+#include <climits>
 #include <cmath>
 #include <cstdlib>
 #include <cstring>
@@ -10,23 +12,13 @@
 #include <stdexcept>
 #include <cstdint>
 #include <cstdio>
+#include <cstdarg>
 
-extern "C" {
-int APS5_VABI snprintf_nid_postfix(char*, size_t, const char*, ...);
-int APS5_VABI sprintf_nid_postfix(char*, const char*, ...);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI libc_printf_nid_postfix(const char*, ...);
-int APS5_VABI sscanf_nid_postfix(const char*, const char*, ...);
-int APS5_VABI vsnprintf_nid_postfix(char*, size_t, const char*, VaList*);
-int APS5_VABI vsnprintf_s_nid_postfix(char*, size_t, const char*, VaList*);
-int APS5_VABI snprintf_s_nid_postfix(char*, size_t, const char*, ...);
-int APS5_VABI vsscanf_s_nid_postfix(const char*, const char*, VaList*);
-int APS5_VABI vsscanf_nid_postfix(const char*, const char*, VaList*);
-int APS5_VABI vprintf_nid_postfix(const char*, VaList*);
-int APS5_VABI asprintf_nid_postfix(char**, const char*, ...);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
+#if defined(__clang__) && !defined(_WIN32)
+#define __builtin_sysv_va_list va_list
+#define __builtin_sysv_va_start va_start
+#define __builtin_sysv_va_end va_end
+#endif
 
 static void Require(bool condition) {
     if (!condition) throw std::runtime_error("Formatting check failed");
@@ -84,11 +76,39 @@ static int APS5_VABI PrintList(const char* format, ...) {
     return result;
 }
 
+static void CheckSizeLimits() {
+    using Formatter = int (APS5_VABI*)(char*, size_t, const char*, ...);
+    for (const Formatter format : {&snprintf_nid_postfix, &FormatList}) {
+        char output[8];
+        for (const std::size_t oversized : {static_cast<std::size_t>(INT_MAX) + 2, static_cast<std::size_t>(SIZE_MAX)}) {
+            for (const bool wide : {false, true}) {
+                std::memset(output, 'Z', sizeof(output));
+                int consumed = -1;
+                *__error_nid_postfix() = 0;
+                const int result = wide ? format(output, oversized, "%ls%n", u"x", &consumed)
+                                        : format(output, oversized, "x%n", &consumed);
+                Require(result == 1 && *__error_nid_postfix() == 0 && std::strcmp(output, "x") == 0 && consumed == 1);
+                Require(std::all_of(output + 2, output + sizeof(output), [](char value) { return value == 'Z'; }));
+            }
+        }
+        for (const std::size_t capacity : {std::size_t{0}, std::size_t{1}, static_cast<std::size_t>(INT_MAX), static_cast<std::size_t>(INT_MAX) + 1}) {
+            std::memset(output, 'Z', sizeof(output));
+            *__error_nid_postfix() = 35;
+            Require(format(output, capacity, "x") == 1 && *__error_nid_postfix() == 35);
+            Require(output[0] == (capacity == 0 ? 'Z' : capacity == 1 ? '\0' : 'x'));
+            const std::size_t written = capacity < 2 ? capacity : 2;
+            if (capacity > 1) Require(output[1] == 0);
+            Require(std::all_of(output + written, output + sizeof(output), [](char value) { return value == 'Z'; }));
+        }
+        Require(format(nullptr, 0, "x") == 1);
+    }
+}
+
 static bool CheckWidePrecision() {
     const char16_t input[] = u"A\u00e9\u20ac\U0001f600Z";
     const char* expected[] = {"", "A", "A", "A\xc3\xa9", "A\xc3\xa9", "A\xc3\xa9", "A\xc3\xa9\xe2\x82\xac",
-        "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac",
-        "A\xc3\xa9\xe2\x82\xac\xf0\x9f\x98\x80", "A\xc3\xa9\xe2\x82\xac\xf0\x9f\x98\x80Z"};
+        "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac", "A\xc3\xa9\xe2\x82\xac\xed\xa0\xbd",
+        "A\xc3\xa9\xe2\x82\xac\xed\xa0\xbd", "A\xc3\xa9\xe2\x82\xac\xed\xa0\xbd"};
     bool correct = true;
     for (int precision = 0; precision < 12; ++precision) {
         char output[32];
@@ -103,7 +123,8 @@ static bool CheckWidePrecision() {
     char output[32];
     Require(snprintf_nid_postfix(output, sizeof(output), "[%5.1ls]", u"\u00e9") == 7 && std::strcmp(output, "[     ]") == 0);
     Require(snprintf_nid_postfix(output, sizeof(output), "[%-5.2ls]", u"\u00e9") == 7 && std::strcmp(output, "[\xc3\xa9   ]") == 0);
-    Require(FormatList(output, sizeof(output), "%.3ls", u"\U0001f600") == 0 && output[0] == 0);
+    Require(FormatList(output, sizeof(output), "%.3ls", u"\U0001f600") == 3 && std::strcmp(output, "\xed\xa0\xbd") == 0);
+    Require(FormatList(output, sizeof(output), "%ls", u"\U0001f600") == 6 && std::strcmp(output, "\xed\xa0\xbd\xed\xb8\x80") == 0);
     Require(FormatList(output, sizeof(output), "%ls[% u][% 4u][%+ lu][%- 3hhu][% x][%+o]", u"", 5u, 5u, 5ULL, 5u, 255u, 8u) == 25
         && std::strcmp(output, "[5][   5][5][5  ][ff][10]") == 0);
     Require(FormatList(output, sizeof(output), "%.*ls:%d", -1, u"\u00e9", 7) == 4 && std::strcmp(output, "\xc3\xa9:7") == 0);
@@ -116,10 +137,11 @@ static bool CheckWidePrecision() {
     Require(snprintf_nid_postfix(output, sizeof(output), "[%ls]", static_cast<const char16_t*>(nullptr)) == 8 && std::strcmp(output, "[(null)]") == 0);
     Require(snprintf_nid_postfix(output, sizeof(output), "a%lcb%C", 0, 0) == 4 && std::memcmp(output, "a\0b\0", 5) == 0);
     Require(FormatList(output, sizeof(output), "%%ls:%2$d:%1$d", 3, 7) == 7 && std::strcmp(output, "%ls:7:3") == 0);
-    Require(FormatList(output, sizeof(output), "%ls[%f][%+f][% F][%5.1e]", u"", -NAN, -NAN, NAN, -NAN) == 22
-        && std::strcmp(output, "[nan][nan][NAN][  nan]") == 0);
-    Require(FormatList(output, sizeof(output), "%ls[%-6g][%06a][%LG][%+f]", u"", NAN, -NAN, -static_cast<long double>(NAN), -INFINITY) == 27
-        && std::strcmp(output, "[nan   ][   nan][NAN][-inf]") == 0);
+    Require(FormatList(output, sizeof(output), "%ls[%f][%+f][% F][%5.1e]", u"", -NAN, -NAN, NAN, -NAN) == 25
+        && std::strcmp(output, "[-nan][-nan][ NAN][ -nan]") == 0);
+    Require(FormatList(output, sizeof(output), "%ls[%-6g][%06a][%LG][%+f]", u"", NAN, -NAN, -static_cast<long double>(NAN), -INFINITY) == 28
+        && std::strcmp(output, "[nan   ][  -nan][-NAN][-inf]") == 0);
+    Require(FormatList(output, sizeof(output), "%ls[%+f][%8.3f|]", u"", NAN, -NAN) == 17 && std::strcmp(output, "[+nan][    -nan|]") == 0);
     for (std::size_t capacity = 0; capacity <= 6; ++capacity) {
         std::memset(output, '!', sizeof(output));
         int count = -1;
@@ -171,19 +193,24 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(std::strcmp(buffer, "Mount requested: 0") == 0);
     for (int index = 0; index < 10000; ++index) {
         snprintf_nid_postfix(buffer, sizeof(buffer), "%d %d %d %d %d %d %d %d", 1, 2, 3, 4, 5, 6, 7, 8);
+
         Require(std::strcmp(buffer, "1 2 3 4 5 6 7 8") == 0);
         FormatList(buffer, sizeof(buffer), "%.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %d", 1., 2., 3., 4., 5., 6., 7., 8., 9., 10., 11);
         Require(std::strcmp(buffer, "1.0 2.0 3.0 4.0 5.0 6.0 7.0 8.0 9.0 10.0 11") == 0);
         snprintf_nid_postfix(buffer, sizeof(buffer), "%ld %lu %lld %zu %td %jd", -4294967297LL, 4294967297ULL, -5LL, 7ULL, -8LL, 9LL);
+
         Require(std::strcmp(buffer, "-4294967297 4294967297 -5 7 -8 9") == 0);
         snprintf_nid_postfix(buffer, sizeof(buffer), "%s:%*.*f:%d", "test", -8, 2, 1.25, 7);
+
         Require(std::strcmp(buffer, "test:1.25    :7") == 0);
         FormatList(buffer, sizeof(buffer), "%d %d %d %d %d %d %d %.3Lf %.1f", 1, 2, 3, 4, 5, 6, 7, 1.125L, 2.5);
         Require(std::strcmp(buffer, "1 2 3 4 5 6 7 1.125 2.5") == 0);
     }
     snprintf_nid_postfix(buffer, sizeof(buffer), "%.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f %.1f", 1., 2., 3., 4., 5., 6., 7., 8., 9., 10.);
+
     Require(std::strcmp(buffer, "1.0 2.0 3.0 4.0 5.0 6.0 7.0 8.0 9.0 10.0") == 0);
     snprintf_nid_postfix(buffer, sizeof(buffer), "%.3Lf %d %.1f", 1.125L, 7, 2.5);
+
     Require(std::strcmp(buffer, "1.125 7 2.5") == 0);
     Require(snprintf_nid_postfix(buffer, sizeof(buffer), "%'d|%'u|%'.2f|%'-8ld|%'+05d|%'g", 1234567, 4000000000u, 1234567.891, 1234567LL, 42, 1e6) == 50);
     Require(std::strcmp(buffer, "1234567|4000000000|1234567.89|1234567 |+0042|1e+06") == 0);
@@ -202,20 +229,12 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(FormatList(buffer, sizeof(buffer), "%2$ls|%1$C|%3$d", 0x41, u"\u00e9", 7) == 6 && std::strcmp(buffer, "\xc3\xa9|A|7") == 0);
     Require(FormatList(buffer, sizeof(buffer), "%2$d %d %ls|%*5$d|%1$d", 1, 2, 3, u"x", 4) == 12 && std::strcmp(buffer, "2 3 x|   4|1") == 0);
     Require(FormatList(buffer, sizeof(buffer), "[%*3$d]%ls", 5, u"", 3) == 5 && std::strcmp(buffer, "[  5]") == 0);
-    const char* const invalidPositions[] = {"%0$d%ls", "%100$d%ls", "%*0$d%ls"};
-    for (const char* format : invalidPositions) {
-        bool threw = false;
-        try {
-            FormatList(buffer, sizeof(buffer), format, 1, u"");
-        } catch (const std::invalid_argument&) {
-            threw = true;
-        }
-        Require(threw);
-    }
+    Require(FormatList(buffer, sizeof(buffer), "%100$d %2$d%1$ls", u"", 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100) == 4 && std::strcmp(buffer, "99 1") == 0);
     char expected[1024];
     std::snprintf(expected, sizeof(expected), "%#08x %.3e %a %g %llx", 42u, 1.25, 1.25, 1.25,
         static_cast<unsigned long long>(reinterpret_cast<std::uintptr_t>(buffer)));
     snprintf_nid_postfix(buffer, sizeof(buffer), "%#08x %.3e %a %g %p", 42u, 1.25, 1.25, 1.25, static_cast<void*>(buffer));
+
     Require(std::strcmp(buffer, expected) == 0);
     char pointers[128];
     const auto address = [](std::uintptr_t value) { return reinterpret_cast<void*>(value); };
@@ -236,6 +255,7 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(snprintf_nid_postfix(pointers, sizeof(pointers), "%p", address(0xffffffffffffffffull)) == 16 &&
         std::strcmp(pointers, "ffffffffffffffff") == 0);
     snprintf_nid_postfix(buffer, sizeof(buffer), "%.*s", -1, "unlimited");
+
     Require(std::strcmp(buffer, "unlimited") == 0);
     buffer[5] = '!';
     Require(snprintf_nid_postfix(buffer, 5, "%s", "abcdef") == 6);
@@ -328,6 +348,21 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     }
     char narrow[8] = {};
     Require(sscanf_nid_postfix("ab%", "%7[^%ls]", narrow) == 1 && std::strcmp(narrow, "ab") == 0);
+#endif
+#ifdef _WIN32
+    char freebsd[64];
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "%qd|%qu|%qx|%qo") == 15 &&
+        std::strcmp(freebsd, "%qd|%qu|%qx|%qo") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "%qd|%d", 7) == 5 && std::strcmp(freebsd, "%qd|7") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "%D|%hD|%O|%U|%jD") == 14 &&
+        std::strcmp(freebsd, "%D|%D|%O|%U|%D") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "[%5%][%-5%][%y][%5y][%-3y][%hhz]") == 34 &&
+        std::strcmp(freebsd, "[    %][%    ][%y][   %y][%y ][%z]") == 0);
+    Require(snprintf_nid_postfix(freebsd, sizeof(freebsd), "[%#y][%.2y][%-#4.1y]") == 14 &&
+        std::strcmp(freebsd, "[%y][%y][%y  ]") == 0);
+    bool incomplete = false;
+    try { snprintf_nid_postfix(freebsd, sizeof(freebsd), "100%"); } catch (const std::invalid_argument&) { incomplete = true; }
+    Require(incomplete);
 #endif
     long long count = -1;
     int smallCount = -1;
@@ -336,11 +371,12 @@ __attribute__((noinline)) static void APS5_VABI RunChecks() {
     Require(snprintf_nid_postfix(buffer, sizeof(buffer), "a%cb", 0) == 3);
     Require(buffer[0] == 'a' && buffer[1] == 0 && buffer[2] == 'b' && buffer[3] == 0);
     *__error_nid_postfix() = 35;
-    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%m][%.8m][%-10.5m][%d]", 7) == 59);
-    Require(std::strcmp(buffer, "[Resource temporarily unavailable][Resource][Resou     ][7]") == 0);
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%m][%.8m][%-10.5m][%d]", 7) == 23);
+    Require(std::strcmp(buffer, "[%m][%m][%m        ][7]") == 0);
     Require(*__error_nid_postfix() == 35);
-    *__error_nid_postfix() = 63;
-    Require(FormatList(buffer, sizeof(buffer), "%s: %m", "open") == 24 && std::strcmp(buffer, "open: File name too long") == 0);
+    Require(FormatList(buffer, sizeof(buffer), "%s: %m", "open") == 8 && std::strcmp(buffer, "open: %m") == 0);
+    Require(snprintf_nid_postfix(buffer, sizeof(buffer), "[%5k][%-3y][%lk][%#.2k][%y%d][%0$d]", 42) == 31);
+    Require(std::strcmp(buffer, "[   %k][%y ][%k][%k][%y42][%$d]") == 0);
     Require(printf_nid_postfix("printf: %d %.1f\n", 7, 2.5) == 14);
     Require(libc_printf_nid_postfix("libc_printf: %s\n", "OK") == 16);
     Require(libc_printf_nid_postfix("%d %d %d %d %d %d %d\n", 1, 22, 333, 4444, 55555, 666666, 7777777) == 35);
@@ -366,6 +402,7 @@ static void CheckAllocatingFormat() {
     char* allocated = nullptr;
     Require(asprintf_nid_postfix(&allocated, "%ls:%S:%lc:%d", u"\u00e9", u"ab", 0x20ac, 7) == 11 && std::strcmp(allocated, "\xc3\xa9:ab:\xe2\x82\xac:7") == 0);
     free_nid_postfix(allocated);
+
 }
 
-int main() { RunChecks(); CheckAllocatingFormat(); return CheckWidePrecision() ? 0 : 1; }
+int main() { CheckSizeLimits(); RunChecks(); CheckAllocatingFormat(); return CheckWidePrecision() ? 0 : 1; }
diff --git a/core/libs/tests/FreeTypeFontFixture.hpp b/core/libs/tests/FreeTypeFontFixture.hpp
index 9458d09a81..b876a19139 100644
--- a/core/libs/tests/FreeTypeFontFixture.hpp
+++ b/core/libs/tests/FreeTypeFontFixture.hpp
@@ -20,7 +20,8 @@ static void PutAll16(std::vector<unsigned char>& out, std::initializer_list<int>
     for (const int value : values) Put16(out, static_cast<std::uint32_t>(static_cast<std::uint16_t>(value)));
 }
 
-static std::vector<unsigned char> SquareGlyphFont(std::uint32_t codepoint, int width, bool symbolMap = false) {
+static std::vector<unsigned char> SquareGlyphFont(std::uint32_t codepoint, int width, bool symbolMap = false,
+                                                 const std::vector<unsigned char>* gasp = nullptr) {
     std::vector<unsigned char> head;
     Put32(head, 0x00010000u);
     Put32(head, 0x00010000u);
@@ -53,11 +54,19 @@ static std::vector<unsigned char> SquareGlyphFont(std::uint32_t codepoint, int w
         const int symbol = static_cast<int>(codepoint + 0xF000);
         PutAll16(cmap, {4, 32, 0, 4, 4, 1, 0, symbol, 0xFFFF, 0, symbol, 0xFFFF, 1 - symbol, 1, 0, 0});
     }
-    const std::vector<std::pair<const char*, const std::vector<unsigned char>*>> tables = {
+    std::vector<std::pair<const char*, const std::vector<unsigned char>*>> tables = {
         {"cmap", &cmap}, {"glyf", &glyf}, {"head", &head}, {"hhea", &hhea}, {"hmtx", &hmtx}, {"loca", &loca}, {"maxp", &maxp}};
+    if (gasp) tables.insert(tables.begin() + 1, {"gasp", gasp});
+    unsigned power = 1;
+    unsigned selector = 0;
+    while (power <= tables.size() / 2) {
+        power *= 2;
+        ++selector;
+    }
     std::vector<unsigned char> font;
     Put32(font, 0x00010000u);
-    PutAll16(font, {static_cast<int>(tables.size()), 64, 2, static_cast<int>(tables.size()) * 16 - 64});
+    PutAll16(font, {static_cast<int>(tables.size()), static_cast<int>(power * 16), static_cast<int>(selector),
+                    static_cast<int>(tables.size() * 16 - power * 16)});
     std::uint32_t offset = 12 + static_cast<std::uint32_t>(tables.size()) * 16;
     for (const auto& [tag, data] : tables) {
         font.insert(font.end(), tag, tag + 4);
diff --git a/core/libs/tests/GuestAccess.cpp b/core/libs/tests/GuestAccess.cpp
index f4fa4fb8e8..f7cd52dcae 100644
--- a/core/libs/tests/GuestAccess.cpp
+++ b/core/libs/tests/GuestAccess.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <chrono>
 #include <cstdlib>
@@ -10,12 +11,6 @@
 #include <aclapi.h>
 #endif
 
-extern "C" {
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI chdir_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestAcm.cpp b/core/libs/tests/GuestAcm.cpp
index 9ba39f03ee..80d918bda6 100644
--- a/core/libs/tests/GuestAcm.cpp
+++ b/core/libs/tests/GuestAcm.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAcm/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -6,17 +7,6 @@
 #include <initializer_list>
 #include "SceTypes.hpp"
 
-extern "C" {
-int APS5_VABI sceAcmContextCreate(std::uint32_t*);
-int APS5_VABI sceAcmContextDestroy(std::uint32_t);
-int APS5_VABI sceAcmBatchStartBuffer(std::uint32_t, const void*, std::size_t, void*, std::uint32_t*);
-int APS5_VABI sceAcmBatchStartBuffers(std::uint32_t, std::uint32_t, const void* const[], void*, std::uint32_t*);
-int APS5_VABI sceAcmBatchWait(std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAcm_ConvReverb_SharedInput(AcmBatchInfo*, std::uint32_t, AcmReverbInput*, std::uint32_t, const AcmReverbFilter* const*, const float*, const AcmReverbOutput* const*);
-int APS5_VABI sceAcm_FFT(AcmBatchInfo*, std::int32_t, std::uint32_t, std::int32_t, const void* const*, std::int32_t, void* const*, std::int32_t);
-int APS5_VABI sceAcm_Panner(AcmBatchInfo*, std::uint32_t, const void* const*, std::uint32_t, std::uint32_t, std::uint32_t, const void* const*, const void* const*, const void* const*, void* const*);
-}
-
 static void Require(bool value) {
     if (!value) std::abort();
 }
diff --git a/core/libs/tests/GuestAddressConversion.cpp b/core/libs/tests/GuestAddressConversion.cpp
index 4d44b0a41b..4b6b4f252a 100644
--- a/core/libs/tests/GuestAddressConversion.cpp
+++ b/core/libs/tests/GuestAddressConversion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -5,17 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI __inet_pton_nid_postfix(int, const char*, void*);
-const char* APS5_VABI __inet_ntop_nid_postfix(int, const void*, char*, std::uint32_t);
-int APS5_VABI inet_pton_nid_postfix(int, const char*, void*);
-const char* APS5_VABI inet_ntop_nid_postfix(int, const void*, char*, std::uint32_t);
-int* APS5_VABI __error_nid_postfix();
-std::uint32_t APS5_VABI htonl_nid_postfix(std::uint32_t);
-std::uint32_t APS5_VABI ntohl_nid_postfix(std::uint32_t);
-std::uint16_t APS5_VABI htons_nid_postfix(std::uint16_t);
-std::uint16_t APS5_VABI ntohs_nid_postfix(std::uint16_t);
-}
 static void Require(bool value) { if (!value) std::abort(); }
 
 using Ntop = const char* (APS5_VABI *)(int, const void*, char*, std::uint32_t);
@@ -470,6 +461,7 @@ static void CheckConsolePton() {
         *__error_nid_postfix() = 0;
         const int result = sample.plain ? inet_pton_nid_postfix(sample.family, sample.text, destination)
                                         : __inet_pton_nid_postfix(sample.family, sample.text, destination);
+
         Require(result == sample.result);
         Require(*__error_nid_postfix() == sample.error);
         Require(SameBytes(destination, sample.bytes));
@@ -484,6 +476,7 @@ static void CheckConsoleNtop() {
         *__error_nid_postfix() = 0;
         const char* result = sample.plain ? inet_ntop_nid_postfix(sample.family, source, Wide, sample.size)
                                           : __inet_ntop_nid_postfix(sample.family, source, Wide, sample.size);
+
         Require(result == (sample.succeeds ? Wide : nullptr));
         Require(*__error_nid_postfix() == sample.error);
         Require(SameBytes(Wide, sample.bytes));
diff --git a/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp b/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp
index 72b97bd56f..8e807d6996 100644
--- a/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp
+++ b/core/libs/tests/GuestAgcDriverDebugUnavailable.cpp
@@ -1,38 +1,9 @@
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceAgcDriverGetShaderDebuggingStatus();
-int APS5_VABI sceAgcDriverSetValidationErrorOutputFrequency(std::uint32_t);
-int APS5_VABI sceAgcDriverSetSubmitValidationMode(std::uint32_t);
-int APS5_VABI sceAgcDriverGetSubmitValidationMode(std::uint32_t*);
-int APS5_VABI sceAgcDriverSetSubmitValidationConfig(const void*);
-int APS5_VABI sceAgcDriverGetSubmitValidationConfig(void*);
-int APS5_VABI sceAgcDriverSetValidationDisabled();
-int APS5_VABI sceAgcDriverGetCaptureConfig();
-int APS5_VABI sceAgcDriverSetCaptureConfig();
-int APS5_VABI sceAgcDriverGetGpuPrintfWorkArea();
-int APS5_VABI sceAgcDriverSetGpuPrintfEnabled();
-int APS5_VABI sceAgcDriverDbgReadRegister();
-int APS5_VABI sceAgcDriverDbgWriteRegister();
-int APS5_VABI sceAgcDriverGetGpuRefClks();
-int APS5_VABI sceAgcDriverIsSuspendPointInFlight();
-int APS5_VABI sceAgcDriverIsPaDebug();
-int APS5_VABI sceAgcDriverGetExceptionStatus();
-int APS5_VABI sceAgcDriverGetTraceInitiator();
-int APS5_VABI sceAgcDriverRegisterGpuResetCallbacks();
-int APS5_VABI sceAgcDriverUnregisterGpuResetCallbacks();
-int APS5_VABI sceAgdResetGpu();
-int APS5_VABI sceAgcDriverSysSubmitFlipHandleProxy();
-int APS5_VABI sceAgcDriverUserDataImmediateWrite();
-int APS5_VABI sceAgcDriverUserDataImmediateWritePacket();
-int APS5_VABI sceAgcDriverGetCoredumpMode(std::uint32_t*);
-int APS5_VABI sceAgcDriverAllocateToolMemoryForGpuReset(std::uint64_t, std::uint64_t, std::uint64_t, void*);
-int APS5_VABI sceAgcDriverGetAllocatedToolMemoryForGpuReset(std::uint64_t, void*);
-}
-
 static constexpr int DebugUnavailable = static_cast<int>(0x8A6C1000);
 static constexpr int FeatureUnavailable = static_cast<int>(0x8A6D0001);
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestAgcDriverResources.cpp b/core/libs/tests/GuestAgcDriverResources.cpp
index fc55b15a8a..eafe67b86e 100644
--- a/core/libs/tests/GuestAgcDriverResources.cpp
+++ b/core/libs/tests/GuestAgcDriverResources.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceAgcDriver/State/include/Status.hpp"
+#include "prx/libSceAgcDriver/Resource/include/Registration.hpp"
+#include "prx/libSceAgcDriver/include/AgcDriver.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstddef>
@@ -6,33 +9,6 @@
 #include <cstring>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceAgcDriverRegisterDefaultOwner(std::uint32_t);
-int APS5_VABI sceAgcDriverRegisterOwner(std::uint32_t*, const char*);
-int APS5_VABI sceAgcDriverRegisterResource(std::uint32_t*, std::uint32_t, const void*, std::size_t, const char*, std::uint32_t, std::uint64_t);
-int APS5_VABI sceAgcDriverRegisterMultipleResources(std::uint32_t*, std::uint32_t, const void*, std::uint32_t);
-int APS5_VABI sceAgcDriverRegisterGdsResource(std::uint32_t*, std::uint32_t, std::uint32_t, std::uint32_t, const char*, std::uint32_t, std::uint64_t);
-int APS5_VABI sceAgcDriverUnregisterAllResourcesForOwner(std::uint32_t);
-int APS5_VABI sceAgcDriverRegisterWorkloadStream(std::uint32_t, const void*);
-int APS5_VABI sceAgcDriverUnregisterWorkloadStream(std::uint32_t);
-int APS5_VABI sceAgcDriverGetDefaultOwner(std::uint32_t*);
-int APS5_VABI sceAgcDriverGetResourceRegistrationMaxNameLength(std::uint32_t*);
-int APS5_VABI sceAgcDriverGetOwnerName(std::uint32_t, const char**);
-int APS5_VABI sceAgcDriverGetResourceName(std::uint32_t, const char**);
-int APS5_VABI sceAgcDriverGetResourceType(std::uint32_t, std::uint32_t*);
-int APS5_VABI sceAgcDriverGetResourceUserData(std::uint32_t, std::uint64_t*);
-int APS5_VABI sceAgcDriverSetResourceUserData(std::uint32_t, std::uint64_t);
-int APS5_VABI sceAgcDriverGetResourceBaseAddressAndSizeInBytes(std::uint32_t, void**, std::size_t*);
-int APS5_VABI sceAgcDriverGetResourceShaderGuid(std::uint32_t, void*);
-int APS5_VABI sceAgcDriverFindResourcesPublic(const void*, void*);
-bool APS5_VABI sceAgcDriverIsCaptureInProgress(void);
-bool APS5_VABI sceAgcDriverIsTraceInProgress(void);
-bool APS5_VABI sceAgcDriverIsSubmitValidationEnabled(void);
-int APS5_VABI sceAgcDriverRegisterOwnerForSystem();
-int APS5_VABI sceAgcDriverInitResourceRegistrationInterface();
-int APS5_VABI sceAgcDriverSetResourceRegistrationInfo();
-}
-
 static constexpr int Unavailable = static_cast<int>(0x8A6C9018);
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -92,8 +68,25 @@ int main() {
     Require(sceAgcDriverFindResourcesPublic(nullptr, nullptr) == Unavailable);
     Require(sceAgcDriverUnregisterAllResourcesForOwner(owner) == Unavailable);
     Require(std::string_view(name) == "unchanged");
+    constexpr int InvalidStream = static_cast<int>(0x8A6C0033);
+    constexpr int NullStream = static_cast<int>(0x8A6C0035);
+    constexpr int StreamNotRegistered = static_cast<int>(0x8A6C003A);
+    for (const std::uint32_t id : {0u, 32u, 0x101u, 0xffffffffu}) {
+        Require(sceAgcDriverRegisterWorkloadStream(id, memory) == InvalidStream);
+        Require(sceAgcDriverRegisterWorkloadStream(id, nullptr) == InvalidStream);
+        Require(sceAgcDriverUnregisterWorkloadStream(id) == InvalidStream);
+    }
+    Require(sceAgcDriverRegisterWorkloadStream(2u, nullptr) == NullStream);
+    Require(sceAgcDriverUnregisterWorkloadStream(2u) == StreamNotRegistered);
+    Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == 0);
+    Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == InvalidStream);
+    Require(sceAgcDriverRegisterWorkloadStream(1u, nullptr) == InvalidStream);
+    Require(sceAgcDriverRegisterWorkloadStream(31u, reinterpret_cast<const char*>(memory) + 1) == 0);
+    Require(sceAgcDriverUnregisterWorkloadStream(1u) == 0);
+    Require(sceAgcDriverUnregisterWorkloadStream(1u) == StreamNotRegistered);
     Require(sceAgcDriverRegisterWorkloadStream(1u, memory) == 0);
     Require(sceAgcDriverUnregisterWorkloadStream(1u) == 0);
+    Require(sceAgcDriverUnregisterWorkloadStream(31u) == 0);
     Require(!sceAgcDriverIsCaptureInProgress());
     Require(!sceAgcDriverIsTraceInProgress());
     Require(!sceAgcDriverIsSubmitValidationEnabled());
diff --git a/core/libs/tests/GuestAio.cpp b/core/libs/tests/GuestAio.cpp
index cad5b3c0b7..79dfd69a61 100644
--- a/core/libs/tests/GuestAio.cpp
+++ b/core/libs/tests/GuestAio.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -19,28 +21,7 @@
 #include <io.h>
 extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
 #endif
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t id, std::int32_t* ret);
-int APS5_VABI sceKernelAioInitializeImpl(void* param, std::int32_t size);
-void APS5_VABI sceKernelAioInitializeParam(void* param);
-int APS5_VABI sceKernelAioSetParam(KernelAioSchedulingParam* param, std::int32_t schedulingWindowSize, std::int32_t delayedCountLimit, std::uint32_t enableSplit, std::uint32_t splitSize, std::uint32_t splitChunkSize);
-int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioSubmitWriteCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioPollRequest(std::int32_t id, std::int32_t* state);
-int APS5_VABI sceKernelAioWaitRequest(std::int32_t id, std::int32_t* state, std::uint32_t* usec);
-int APS5_VABI sceKernelAioSubmitReadCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioSubmitWriteCommandsMultiple(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioWaitRequests(std::int32_t* id, std::int32_t num, std::int32_t* state, std::uint32_t mode, std::uint32_t* usec);
-int APS5_VABI sceKernelAioPollRequests(std::int32_t* id, std::int32_t num, std::int32_t* state);
-int APS5_VABI sceKernelAioCancelRequest(std::int32_t id, std::int32_t* state);
-int APS5_VABI sceKernelAioCancelRequests(std::int32_t* id, std::int32_t num, std::int32_t* state);
-int APS5_VABI sceKernelAioDeleteRequests(std::int32_t* id, std::int32_t num, std::int32_t* ret);
-}
+
 static void Require(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Aio check failed at line %d\n", line);
@@ -69,9 +50,9 @@ static void CheckBadPositionedDescriptors() {
                 KernelAioResult result{-1, 0};
                 KernelAioRwRequest request{0, count, &buffer, &result, descriptor};
                 std::int32_t id = 0;
-                Check((write ? sceKernelAioSubmitWriteCommands(&request, 1, 0, &id)
-                             : sceKernelAioSubmitReadCommands(&request, 1, 0, &id)) == 0);
-                Check(result.state == 4 && result.return_value == SCE_KERNEL_ERROR_EBADF);
+                Check((write ? sceKernelAioSubmitWriteCommands(&request, 1, 1, &id)
+                             : sceKernelAioSubmitReadCommands(&request, 1, 1, &id)) == 0);
+                Check(result.state == 3 && result.return_value == SCE_KERNEL_ERROR_EBADF);
                 std::int32_t removed = -1;
                 Check(sceKernelAioDeleteRequest(id, &removed) == 0);
             }
@@ -109,26 +90,42 @@ int main(int argc, char** argv) {
     Check(sceKernelAioSetParam(&schedulingParams[2], 128, 128, 0, 0x1000000, 0x1000000) == 0);
     Check(schedulingParams[2].schedulingWindowSize == 128 && schedulingParams[2].delayedCountLimit == 128);
     Check(schedulingParams[2].enableSplit == 0 && schedulingParams[2].splitSize == 0x1000000 && schedulingParams[2].splitChunkSize == 0x1000000);
-    const auto setParamThrows = [&](std::int32_t window, std::int32_t delayed, std::uint32_t split, std::uint32_t size, std::uint32_t chunk) {
+    const auto setParamRefuses = [&](std::int32_t window, std::int32_t delayed, std::uint32_t split, std::uint32_t size, std::uint32_t chunk) {
         KernelAioSchedulingParam untouchedParam{7, 7, 7, 7, 7};
-        bool thrown = false;
-        try { sceKernelAioSetParam(&untouchedParam, window, delayed, split, size, chunk); } catch (const std::exception&) { thrown = true; }
-        return thrown && untouchedParam.schedulingWindowSize == 7 && untouchedParam.delayedCountLimit == 7 &&
+        return sceKernelAioSetParam(&untouchedParam, window, delayed, split, size, chunk) == SCE_KERNEL_ERROR_EINVAL &&
+            untouchedParam.schedulingWindowSize == 7 && untouchedParam.delayedCountLimit == 7 &&
             untouchedParam.enableSplit == 7 && untouchedParam.splitSize == 7 && untouchedParam.splitChunkSize == 7;
     };
-    Check(setParamThrows(129, 32, 1, 0x100000, 0x100000));
-    Check(setParamThrows(-1, 32, 1, 0x100000, 0x100000));
-    Check(setParamThrows(32, 129, 1, 0x100000, 0x100000));
-    Check(setParamThrows(32, -1, 1, 0x100000, 0x100000));
-    Check(setParamThrows(32, 32, 2, 0x100000, 0x100000));
-    Check(setParamThrows(32, 32, 1, 0x1000001, 0x100000));
-    Check(setParamThrows(32, 32, 1, 0x100000, 0x1000001));
+    Check(setParamRefuses(129, 32, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(0x7fffffff, 32, 0, 0, 0));
+    Check(setParamRefuses(-1, 32, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 129, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(32, -1, 1, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 32, 2, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 32, 0xffffffffu, 0x100000, 0x100000));
+    Check(setParamRefuses(32, 32, 1, 0x1000001, 0x100000));
+    Check(setParamRefuses(32, 32, 1, 0x100000, 0x1000001));
+    Check(setParamRefuses(32, 32, 1, 0, 0x100000));
+    Check(setParamRefuses(32, 32, 1, 0x100000, 0));
+    KernelAioSchedulingParam accepted{7, 7, 7, 7, 7};
+    Check(sceKernelAioSetParam(&accepted, 0, 0, 0, 0, 0) == 0 && accepted.schedulingWindowSize == 0 && accepted.splitSize == 0);
+    Check(sceKernelAioSetParam(&accepted, 1, 1, 0, 0xffffffffu, 0x1000001) == 0 && accepted.splitSize == 0xffffffffu && accepted.splitChunkSize == 0x1000001);
+    Check(sceKernelAioSetParam(&accepted, 1, 1, 1, 1, 0x20000) == 0 && accepted.splitSize == 1 && accepted.splitChunkSize == 0x20000);
+    Check(sceKernelAioSetParam(&accepted, 1, 1, 1, 0x10001, 0x1000000) == 0 && accepted.splitSize == 0x10001);
     bool nullThrew = false;
     try { sceKernelAioSetParam(nullptr, 32, 32, 1, 0x100000, 0x100000); } catch (const std::invalid_argument&) { nullThrew = true; }
     Check(nullThrew);
     Check(sceKernelAioInitializeImpl(schedulingParams.data(), static_cast<std::int32_t>(sizeof(schedulingParams))) == 0);
-    int initParam = 0;
-    sceKernelAioInitializeParam(&initParam);
+    std::array<KernelAioSchedulingParam, 4> initParam{};
+    initParam.fill({7, 7, 7, 7, 7});
+    sceKernelAioInitializeParam(initParam.data());
+    for (int index = 0; index < 2; ++index) {
+        Check(initParam[index].schedulingWindowSize == 32 && initParam[index].delayedCountLimit == 32 && initParam[index].enableSplit == 1 &&
+            initParam[index].splitSize == 0x100000 && initParam[index].splitChunkSize == 0x100000);
+    }
+    Check(initParam[2].schedulingWindowSize == 32 && initParam[2].delayedCountLimit == 32 && initParam[2].enableSplit == 0 &&
+        initParam[2].splitSize == 0 && initParam[2].splitChunkSize == 0);
+    Check(initParam[3].schedulingWindowSize == 7 && initParam[3].splitChunkSize == 7);
     const int fd = sceKernelOpen(file.string().c_str(), SCE_KERNEL_O_RDONLY, 0);
     Check(fd >= 0);
     std::array<char, 16> first{};
@@ -140,7 +137,7 @@ int main(int argc, char** argv) {
         {32, second.size(), second.data(), &secondResult, fd},
     };
     std::int32_t id = 0;
-    Check(sceKernelAioSubmitReadCommands(requests, 2, 0, &id) == 0);
+    Check(sceKernelAioSubmitReadCommands(requests, 2, 1, &id) == 0);
     Check(id > 0);
     std::int32_t state = 0;
     Check(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
@@ -152,11 +149,11 @@ int main(int argc, char** argv) {
     KernelAioResult invalidReadResult{-1, 0};
     KernelAioRwRequest invalidReadRequest{-1, first.size(), first.data(), &invalidReadResult, fd};
     std::int32_t invalidReadId = 0;
-    Check(sceKernelAioSubmitReadCommands(&invalidReadRequest, 1, 0, &invalidReadId) == 0);
+    Check(sceKernelAioSubmitReadCommands(&invalidReadRequest, 1, 1, &invalidReadId) == 0);
     std::int32_t invalidReadState = 0;
     Check(sceKernelAioWaitRequest(invalidReadId, &invalidReadState, nullptr) == 0);
-    Check(invalidReadState == 4);
-    Check(invalidReadResult.state == 4 && invalidReadResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(invalidReadState == 3);
+    Check(invalidReadResult.state == 3 && invalidReadResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::array<char, 4> aggregateReadBuffer{};
     KernelAioResult aggregateReadSuccessResult{-1, 0};
     KernelAioResult aggregateReadErrorResult{-1, 0};
@@ -165,16 +162,26 @@ int main(int argc, char** argv) {
         {-1, aggregateReadBuffer.size(), aggregateReadBuffer.data(), &aggregateReadErrorResult, fd},
     };
     std::int32_t aggregateReadId = 0;
-    Check(sceKernelAioSubmitReadCommands(aggregateReads, 2, 0, &aggregateReadId) == 0);
+    Check(sceKernelAioSubmitReadCommands(aggregateReads, 2, 1, &aggregateReadId) == 0);
     std::int32_t aggregateReadState = 0;
     Check(sceKernelAioWaitRequest(aggregateReadId, &aggregateReadState, nullptr) == 0);
-    Check(aggregateReadState == 4);
+    Check(aggregateReadState == 3);
     Check(aggregateReadSuccessResult.state == 3 && aggregateReadSuccessResult.return_value == 4);
-    Check(aggregateReadErrorResult.state == 4 && aggregateReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(aggregateReadErrorResult.state == 3 && aggregateReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     Check(std::memcmp(aggregateReadBuffer.data(), seed.data() + 4, aggregateReadBuffer.size()) == 0);
+    std::int32_t pollFirstId = 0;
+    Check(sceKernelAioSubmitReadCommands(requests, 1, 1, &pollFirstId) == 0);
+    std::int32_t pollFirst = 0;
+    std::int32_t cancelFirst = 0;
+    Check(sceKernelAioCancelRequest(pollFirstId, &cancelFirst) == 0 && cancelFirst == 3);
+    Check(sceKernelAioPollRequest(pollFirstId, &pollFirst) == 0 && pollFirst == 3);
+    Check(sceKernelAioPollRequest(pollFirstId, &pollFirst) == 0 && pollFirst == 0x10003);
+    Check(sceKernelAioCancelRequest(pollFirstId, &cancelFirst) == 0 && cancelFirst == 3);
+    Check(sceKernelAioDeleteRequest(pollFirstId, &cancelFirst) == 0 && cancelFirst == 0);
     std::int32_t polled = 0;
     Check(sceKernelAioPollRequest(id, &polled) == 0);
-    Check(polled == 3);
+    Check(polled == 0x10003);
+    Check(sceKernelAioWaitRequest(id, &state, nullptr) == 0 && state == 0x10003);
     std::int32_t deleted = -1;
     Check(sceKernelAioDeleteRequest(id, &deleted) == 0);
     Check(deleted == 0);
@@ -185,18 +192,18 @@ int main(int argc, char** argv) {
     KernelAioResult writeResult{-1, 0};
     KernelAioRwRequest writeRequest{0, written.size(), written.data(), &writeResult, writeFd};
     std::int32_t writeId = 0;
-    Check(sceKernelAioSubmitWriteCommands(&writeRequest, 1, 0, &writeId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(&writeRequest, 1, 1, &writeId) == 0);
     std::int32_t writeState = 0;
     Check(sceKernelAioWaitRequest(writeId, &writeState, nullptr) == 0);
     Check(writeState == 3 && writeResult.state == 3 && writeResult.return_value == 5);
     KernelAioResult invalidWriteResult{-1, 0};
     KernelAioRwRequest invalidWriteRequest{-1, written.size(), written.data(), &invalidWriteResult, writeFd};
     std::int32_t invalidWriteId = 0;
-    Check(sceKernelAioSubmitWriteCommands(&invalidWriteRequest, 1, 0, &invalidWriteId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(&invalidWriteRequest, 1, 1, &invalidWriteId) == 0);
     std::int32_t invalidWriteState = 0;
     Check(sceKernelAioWaitRequest(invalidWriteId, &invalidWriteState, nullptr) == 0);
-    Check(invalidWriteState == 4);
-    Check(invalidWriteResult.state == 4 && invalidWriteResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(invalidWriteState == 3);
+    Check(invalidWriteResult.state == 3 && invalidWriteResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::array<char, 4> aggregateWriteBuffer = {'G', 'O', 'O', 'D'};
     KernelAioResult aggregateWriteSuccessResult{-1, 0};
     KernelAioResult aggregateWriteErrorResult{-1, 0};
@@ -205,12 +212,12 @@ int main(int argc, char** argv) {
         {-1, aggregateWriteBuffer.size(), aggregateWriteBuffer.data(), &aggregateWriteErrorResult, writeFd},
     };
     std::int32_t aggregateWriteId = 0;
-    Check(sceKernelAioSubmitWriteCommands(aggregateWrites, 2, 0, &aggregateWriteId) == 0);
+    Check(sceKernelAioSubmitWriteCommands(aggregateWrites, 2, 1, &aggregateWriteId) == 0);
     std::int32_t aggregateWriteState = 0;
     Check(sceKernelAioWaitRequest(aggregateWriteId, &aggregateWriteState, nullptr) == 0);
-    Check(aggregateWriteState == 4);
+    Check(aggregateWriteState == 3);
     Check(aggregateWriteSuccessResult.state == 3 && aggregateWriteSuccessResult.return_value == 4);
-    Check(aggregateWriteErrorResult.state == 4 && aggregateWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(aggregateWriteErrorResult.state == 3 && aggregateWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     Check(sceKernelClose(writeFd) == 0);
     { std::ifstream stream(file, std::ios::binary); std::string contents; std::getline(stream, contents);
       Check(contents.rfind("HELLO", 0) == 0); }
@@ -220,13 +227,17 @@ int main(int argc, char** argv) {
       Check(contents.size() == seed.size());
       Check(contents.substr(8, aggregateWriteBuffer.size()) == "GOOD");
       Check(contents.substr(12, 4) == seed.substr(12, 4)); }
-    Check(sceKernelAioSubmitReadCommands(nullptr, 1, 0, &id) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitReadCommands(requests, 0, 0, &id) == SCE_KERNEL_ERROR_EINVAL);
-    Check(sceKernelAioSubmitReadCommands(requests, 1, 0, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioWaitRequest(9999, &state, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioSubmitReadCommands(nullptr, 1, 1, &id) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitReadCommands(requests, 0, 1, &id) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioSubmitReadCommands(requests, 1, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
+    state = 7;
+    Check(sceKernelAioWaitRequest(9999, &state, nullptr) == 0 && state == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioWaitRequest(id, nullptr, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioPollRequest(id, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioPollRequest(0, &polled) == SCE_KERNEL_ERROR_EINVAL);
+    for (const std::int32_t unknown : {0, -1, 511, 512, 100000}) {
+        polled = 7;
+        Check(sceKernelAioPollRequest(unknown, &polled) == 0 && polled == SCE_KERNEL_ERROR_ESRCH);
+    }
     Check(sceKernelAioDeleteRequest(id, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     const int batchFd = sceKernelOpen(file.string().c_str(), SCE_KERNEL_O_RDWR, 0);
     Check(batchFd >= 0);
@@ -239,13 +250,13 @@ int main(int argc, char** argv) {
         {-1, batchReadBuffer.size(), batchReadBuffer.data(), &batchReadErrorResult, batchFd},
     };
     std::int32_t batchReadIds[2] = {0, 0};
-    Check(sceKernelAioSubmitReadCommandsMultiple(batchReads, 2, 0, batchReadIds) == 0);
+    Check(sceKernelAioSubmitReadCommandsMultiple(batchReads, 2, 1, batchReadIds) == 0);
     Check(batchReadIds[0] > 0 && batchReadIds[1] > 0 && batchReadIds[0] != batchReadIds[1]);
     Check(batchReadSuccessResult.state == 3 && batchReadSuccessResult.return_value == 4);
-    Check(batchReadErrorResult.state == 4 && batchReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(batchReadErrorResult.state == 3 && batchReadErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::int32_t batchReadStates[2] = {0, 0};
     Check(sceKernelAioWaitRequests(batchReadIds, 2, batchReadStates, 1, nullptr) == 0);
-    Check(batchReadStates[0] == 3 && batchReadStates[1] == 4);
+    Check(batchReadStates[0] == 3 && batchReadStates[1] == 3);
     std::array<char, 4> batchWriteData = {'A', 'B', 'C', 'D'};
     KernelAioResult batchWriteSuccessResult{-1, 0};
     KernelAioResult batchWriteErrorResult{-1, 0};
@@ -254,13 +265,13 @@ int main(int argc, char** argv) {
         {-1, batchWriteData.size(), batchWriteData.data(), &batchWriteErrorResult, batchFd},
     };
     std::int32_t batchWriteIds[2] = {0, 0};
-    Check(sceKernelAioSubmitWriteCommandsMultiple(batchWrites, 2, 0, batchWriteIds) == 0);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(batchWrites, 2, 1, batchWriteIds) == 0);
     Check(batchWriteIds[0] > 0 && batchWriteIds[1] > 0 && batchWriteIds[0] != batchWriteIds[1]);
     Check(batchWriteSuccessResult.state == 3 && batchWriteSuccessResult.return_value == 4);
-    Check(batchWriteErrorResult.state == 4 && batchWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
+    Check(batchWriteErrorResult.state == 3 && batchWriteErrorResult.return_value == SCE_KERNEL_ERROR_EINVAL);
     std::int32_t batchWriteStates[2] = {0, 0};
     Check(sceKernelAioWaitRequests(batchWriteIds, 2, batchWriteStates, 1, nullptr) == 0);
-    Check(batchWriteStates[0] == 3 && batchWriteStates[1] == 4);
+    Check(batchWriteStates[0] == 3 && batchWriteStates[1] == 3);
     std::array<char, 4> patch = {'W', 'X', 'Y', 'Z'};
     KernelAioResult patchResult{-1, 0};
     KernelAioResult badResult{-1, 0};
@@ -269,17 +280,17 @@ int main(int argc, char** argv) {
         {0, patch.size(), patch.data(), &badResult, -1},
     };
     std::int32_t writeIds[2] = {0, 0};
-    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 2, 0, writeIds) == 0);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 2, 1, writeIds) == 0);
     Check(sceKernelLseek(batchFd, 0, 1) == 2);
     Check(writeIds[0] > 0 && writeIds[1] > 0 && writeIds[0] != writeIds[1]);
     Check(patchResult.state == 3 && patchResult.return_value == 4);
-    Check(badResult.state == 4 && badResult.return_value == SCE_KERNEL_ERROR_EBADF);
+    Check(badResult.state == 3 && badResult.return_value == SCE_KERNEL_ERROR_EBADF);
     std::int32_t writeStates[2] = {0, 0};
     Check(sceKernelAioWaitRequests(writeIds, 2, writeStates, 1, nullptr) == 0);
-    Check(writeStates[0] == 3 && writeStates[1] == 4);
+    Check(writeStates[0] == 3 && writeStates[1] == 3);
     std::int32_t polledStates[2] = {0, 0};
     Check(sceKernelAioPollRequests(writeIds, 2, polledStates) == 0);
-    Check(polledStates[0] == 3 && polledStates[1] == 4);
+    Check(polledStates[0] == 0x10003 && polledStates[1] == 0x10003);
     std::array<char, 4> readBack{};
     std::array<char, 4> tail{};
     KernelAioResult readBackResult{-1, 0};
@@ -289,7 +300,7 @@ int main(int argc, char** argv) {
         {60, tail.size(), tail.data(), &tailResult, batchFd},
     };
     std::int32_t readIds[2] = {0, 0};
-    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 2, 0, readIds) == 0);
+    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 2, 1, readIds) == 0);
     Check(readIds[0] > 0 && readIds[1] > 0 && readIds[0] != readIds[1]);
     Check(readBackResult.state == 3 && readBackResult.return_value == 4);
     Check(std::memcmp(readBack.data(), "WXYZ", 4) == 0);
@@ -301,74 +312,87 @@ int main(int argc, char** argv) {
     Check(readStates[0] == 3 && readStates[1] == 3);
     std::int32_t cancelled = 0;
     Check(sceKernelAioCancelRequest(readIds[0], &cancelled) == 0);
-    Check(cancelled == 4);
+    Check(cancelled == 3);
     Check(sceKernelAioPollRequest(readIds[0], &polled) == 0);
-    Check(polled == 4);
+    Check(polled == 0x10003);
     Check(sceKernelAioCancelRequest(0, &cancelled) == 0);
-    Check(cancelled == 2);
+    Check(cancelled == SCE_KERNEL_ERROR_ESRCH);
     std::int32_t cancelIds[2] = {0, readIds[1]};
     std::int32_t cancelStates[2] = {0, 0};
     Check(sceKernelAioCancelRequests(cancelIds, 2, cancelStates) == 0);
-    Check(cancelStates[0] == 2 && cancelStates[1] == 4);
+    Check(cancelStates[0] == SCE_KERNEL_ERROR_ESRCH && cancelStates[1] == 3);
     Check(sceKernelAioPollRequest(readIds[1], &polled) == 0);
-    Check(polled == 4);
+    Check(polled == 0x10003);
+    Check(sceKernelAioCancelRequest(readIds[1], &cancelled) == 0 && cancelled == 3);
     Check(sceKernelAioPollRequests(readIds, 2, polledStates) == 0);
-    Check(polledStates[0] == 4 && polledStates[1] == 4);
+    Check(polledStates[0] == 0x10003 && polledStates[1] == 0x10003);
     std::int32_t deletedRets[2] = {-1, -1};
     Check(sceKernelAioDeleteRequests(writeIds, 2, deletedRets) == 0);
     Check(deletedRets[0] == 0 && deletedRets[1] == 0);
     Check(sceKernelAioPollRequest(writeIds[0], &polled) == 0);
-    Check(polled == 4);
-    Check(sceKernelAioDeleteRequests(writeIds, 0, deletedRets) == 0);
+    Check(polled == SCE_KERNEL_ERROR_ESRCH);
+    Check(sceKernelAioDeleteRequests(writeIds, 2, deletedRets) == 0);
+    Check(deletedRets[0] == SCE_KERNEL_ERROR_ESRCH && deletedRets[1] == SCE_KERNEL_ERROR_ESRCH);
+    std::int32_t deletedRet = 7;
+    Check(sceKernelAioDeleteRequest(writeIds[0], &deletedRet) == 0 && deletedRet == SCE_KERNEL_ERROR_ESRCH);
+    std::uint32_t unknownTimeout = 1000;
+    Check(sceKernelAioWaitRequests(writeIds, 2, polledStates, 1, &unknownTimeout) == 0);
+    Check(polledStates[0] == SCE_KERNEL_ERROR_ESRCH && polledStates[1] == SCE_KERNEL_ERROR_ESRCH);
+    Check(sceKernelAioDeleteRequests(writeIds, 0, deletedRets) == SCE_KERNEL_ERROR_EINVAL);
     Check(sceKernelClose(batchFd) == 0);
     std::int32_t badIds[2] = {readIds[0], 9999};
     std::int32_t untouched[2] = {7, 7};
-    Check(sceKernelAioSubmitReadCommandsMultiple(nullptr, 1, 0, readIds) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 1, 0, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 0, 0, writeIds) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioSubmitReadCommandsMultiple(nullptr, 1, 1, readIds) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitReadCommandsMultiple(readBatch, 1, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(writeBatch, 0, 1, writeIds) == SCE_KERNEL_ERROR_EINVAL);
     KernelAioRwRequest noResult{0, 1, readBack.data(), nullptr, batchFd};
-    Check(sceKernelAioSubmitWriteCommandsMultiple(&noResult, 1, 0, writeIds) == SCE_KERNEL_ERROR_EFAULT);
+    Check(sceKernelAioSubmitWriteCommandsMultiple(&noResult, 1, 1, writeIds) == SCE_KERNEL_ERROR_EFAULT);
     std::array<KernelAioRwRequest, 129> unread{};
     std::array<std::int32_t, 129> unreadIds{};
-    for (const auto submit : {sceKernelAioSubmitReadCommandsMultiple, sceKernelAioSubmitWriteCommandsMultiple}) {
-        bool limited = false;
-        try { submit(unread.data(), 129, 0, unreadIds.data()); } catch (const std::runtime_error&) { limited = true; }
-        Check(limited);
+    unreadIds.fill(7);
+    for (const auto submit : {sceKernelAioSubmitReadCommandsMultiple, sceKernelAioSubmitWriteCommandsMultiple, sceKernelAioSubmitReadCommands, sceKernelAioSubmitWriteCommands}) {
+        Check(submit(unread.data(), 129, 1, unreadIds.data()) == SCE_KERNEL_ERROR_EINVAL);
+        for (const std::int32_t priority : {0, 4, -1}) Check(submit(unread.data(), 1, priority, unreadIds.data()) == SCE_KERNEL_ERROR_EINVAL);
+        Check(unreadIds[0] == 7);
     }
-    std::int32_t unreadId = 0;
-    Check(sceKernelAioSubmitReadCommands(unread.data(), 129, 0, &unreadId) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioSubmitWriteCommands(unread.data(), 129, 0, &unreadId) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioWaitRequests(readIds, 2, nullptr, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioWaitRequests(nullptr, 2, readStates, 1, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioWaitRequests(readIds, -1, readStates, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
-    Check(sceKernelAioWaitRequests(badIds, 2, untouched, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
-    Check(untouched[0] == 7 && untouched[1] == 7);
+    Check(sceKernelAioWaitRequests(badIds, 2, untouched, 1, nullptr) == 0);
+    Check(untouched[0] == 0x10003 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
+    untouched[0] = untouched[1] = 7;
     Check(sceKernelAioPollRequests(readIds, 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioPollRequests(nullptr, 2, readStates) == SCE_KERNEL_ERROR_EFAULT);
     Check(sceKernelAioPollRequests(readIds, -1, readStates) == SCE_KERNEL_ERROR_EINVAL);
-    Check(sceKernelAioPollRequests(badIds, 2, untouched) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioPollRequests(badIds, 2, untouched) == 0);
+    Check(untouched[0] == 0x10003 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
+    untouched[0] = untouched[1] = 7;
+    Check(sceKernelAioPollRequests(readIds, 0, untouched) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioWaitRequests(readIds, 0, untouched, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioCancelRequests(readIds, 0, untouched) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioDeleteRequests(readIds, 0, untouched) == SCE_KERNEL_ERROR_EINVAL);
     Check(untouched[0] == 7 && untouched[1] == 7);
-    Check(sceKernelAioPollRequests(readIds, 0, untouched) == 0);
-    Check(untouched[0] == 7 && untouched[1] == 7);
-    bool threw = false;
-    try { sceKernelAioWaitRequests(readIds, 2, readStates, 3, nullptr); } catch (const std::runtime_error&) { threw = true; }
-    Check(threw);
-    threw = false;
+    for (const std::uint32_t mode : {0u, 3u, 4u, 0x100u, 0xffffffffu}) {
+        Check(sceKernelAioWaitRequests(readIds, 2, untouched, mode, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+        Check(untouched[0] == 7 && untouched[1] == 7);
+    }
     std::array<std::int32_t, 129> manyIds{};
     std::array<std::int32_t, 129> manyStates{};
     manyIds.fill(readIds[0]);
-    try { sceKernelAioDeleteRequests(manyIds.data(), 129, manyStates.data()); } catch (const std::runtime_error&) { threw = true; }
-    Check(threw);
-    threw = false;
-    try { sceKernelAioPollRequests(manyIds.data(), 129, manyStates.data()); } catch (const std::runtime_error&) { threw = true; }
-    Check(threw);
-    Check(sceKernelAioCancelRequest(9999, &cancelled) == SCE_KERNEL_ERROR_EINVAL);
+    manyStates.fill(7);
+    Check(sceKernelAioDeleteRequests(manyIds.data(), 129, manyStates.data()) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioPollRequests(manyIds.data(), 129, manyStates.data()) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioWaitRequests(manyIds.data(), 129, manyStates.data(), 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Check(sceKernelAioCancelRequests(manyIds.data(), 129, manyStates.data()) == SCE_KERNEL_ERROR_EINVAL);
+    Check(manyStates[0] == 7);
+    Check(sceKernelAioPollRequests(manyIds.data(), 128, manyStates.data()) == 0 && manyStates[127] == manyStates[0]);
+    Check(sceKernelAioCancelRequest(9999, &cancelled) == 0 && cancelled == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioCancelRequest(readIds[0], nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioCancelRequests(badIds, 2, untouched) == SCE_KERNEL_ERROR_EINVAL);
-    Check(untouched[0] == 7 && untouched[1] == 7);
+    Check(sceKernelAioCancelRequests(badIds, 2, untouched) == 0);
+    Check(untouched[0] == 3 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioCancelRequests(cancelIds, 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
-    Check(sceKernelAioDeleteRequests(badIds, 2, untouched) == SCE_KERNEL_ERROR_EINVAL);
-    Check(untouched[0] == 7 && untouched[1] == 7);
+    Check(sceKernelAioDeleteRequests(badIds, 2, untouched) == 0);
+    Check(untouched[0] == 0 && untouched[1] == SCE_KERNEL_ERROR_ESRCH);
     Check(sceKernelAioDeleteRequests(writeIds, 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     const auto shared = root / "shared.bin";
     std::string sharedContents;
@@ -385,7 +409,7 @@ int main(int argc, char** argv) {
                 KernelAioResult result{-1, 0};
                 KernelAioRwRequest request{offset, bytes.size(), bytes.data(), &result, sharedFd};
                 std::int32_t requestId = 0;
-                if (sceKernelAioSubmitReadCommands(&request, 1, 0, &requestId) != 0 || result.state != 3 ||
+                if (sceKernelAioSubmitReadCommands(&request, 1, 1, &requestId) != 0 || result.state != 3 ||
                     result.return_value != 16 || std::memcmp(bytes.data(), sharedContents.data() + offset, 16) != 0) {
                     misread = true;
                 }
@@ -395,5 +419,21 @@ int main(int argc, char** argv) {
     for (auto& reader : readers) reader.join();
     Check(!misread);
     Check(sceKernelClose(sharedFd) == 0);
+    const auto appendFile = root / "append.bin";
+    { std::ofstream stream(appendFile, std::ios::binary); stream << seed; }
+    const int appendFd = sceKernelOpen(appendFile.string().c_str(), SCE_KERNEL_O_RDWR | SCE_KERNEL_O_APPEND, 0);
+    Check(appendFd >= 0);
+    std::array<char, 4> appendBuffer = {'T', 'A', 'I', 'L'};
+    KernelAioResult appendResult{-1, 0};
+    KernelAioRwRequest appendRequest{0, appendBuffer.size(), appendBuffer.data(), &appendResult, appendFd};
+    std::int32_t appendId = 0;
+    Check(sceKernelAioSubmitWriteCommands(&appendRequest, 1, 1, &appendId) == 0);
+    std::int32_t appendState = 0;
+    Check(sceKernelAioWaitRequest(appendId, &appendState, nullptr) == 0);
+    Check(appendState == 3 && appendResult.state == 3 && appendResult.return_value == 4);
+    Check(sceKernelClose(appendFd) == 0);
+    { std::ifstream stream(appendFile, std::ios::binary);
+      std::string contents{std::istreambuf_iterator<char>(stream), std::istreambuf_iterator<char>()};
+      Check(contents == seed + "TAIL"); }
     Check(std::filesystem::remove_all(root) > 0);
 }
diff --git a/core/libs/tests/GuestAjm.cpp b/core/libs/tests/GuestAjm.cpp
index 017b6304a8..c7780f5f65 100644
--- a/core/libs/tests/GuestAjm.cpp
+++ b/core/libs/tests/GuestAjm.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -16,34 +17,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceAjmInitialize(std::int64_t, std::uint32_t*);
-int APS5_VABI sceAjmFinalize(std::uint32_t);
-int APS5_VABI sceAjmDecAt9ParseConfigData(const void*, AjmDecAt9ConfigDataInfo*);
-int APS5_VABI sceAjmDecMp3ParseFrame(const std::uint8_t*, std::uint32_t, int, AjmDecMp3ParseFrame*);
-int APS5_VABI sceAjmInstanceCreate(std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t*);
-int APS5_VABI sceAjmInstanceDestroy(std::uint32_t, std::uint32_t);
-int APS5_VABI sceAjmBatchInitialize(void*, std::size_t, AjmBatchInfo*);
-int APS5_VABI sceAjmBatchJobInitialize(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobDecode(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobDecodeSingle(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobRun(AjmBatchInfo*, std::uint32_t, std::uint64_t, const void*, std::size_t, void*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobRunSplit(AjmBatchInfo*, std::uint32_t, std::uint64_t, const AjmBuffer*, std::size_t, const AjmBuffer*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobSetGaplessDecode(AjmBatchInfo*, std::uint32_t, const void*, int, void*);
-int APS5_VABI sceAjmBatchJobControl(AjmBatchInfo*, std::uint32_t, std::uint64_t, const void*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobGetGaplessDecode(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobGetCodecInfo(AjmBatchInfo*, std::uint32_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchJobGetInfo(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchStart(std::uint32_t, const AjmBatchInfo*, int, AjmBatchError*, std::uint32_t*);
-int APS5_VABI sceAjmBatchWait(std::uint32_t, std::uint32_t, std::uint32_t, AjmBatchError*);
-int APS5_VABI sceAjmBatchCancel(std::uint32_t, std::uint32_t);
-int APS5_VABI sceAjmBatchJobClearContext(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobSetResampleParameters(AjmBatchInfo*, std::uint32_t, float, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobGetResampleInfo(AjmBatchInfo*, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobSetResampleParametersEx(AjmBatchInfo*, std::uint32_t, float, float, std::uint32_t, void*);
-int APS5_VABI sceAjmBatchJobDecodeSplit(AjmBatchInfo*, std::uint32_t, const AjmBuffer*, std::size_t, const AjmBuffer*, std::size_t, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 namespace {
@@ -391,6 +364,21 @@ void TestMp3ParseFrame() {
     Require(sceAjmDecMp3ParseFrame(reservedSampleRate, 4, 0, &frame) == invalidParameter);
     const std::uint8_t mpeg25Above64Kbps[4] = {0xFF, 0xE3, 0x98, 0xC0};
     Require(sceAjmDecMp3ParseFrame(mpeg25Above64Kbps, 4, 0, &frame) == invalidParameter);
+    for (const std::uint8_t layer : {0u, 2u, 3u}) {
+        const std::uint8_t header[4] = {0xFF, static_cast<std::uint8_t>(0xF9u | (layer << 1u)), 0x90, 0x04};
+        if (layer == 0) {
+            std::memset(&frame, 0xA5, sizeof(frame));
+            const auto previous = frame;
+            Require(sceAjmDecMp3ParseFrame(header, sizeof(header), 0, &frame) == invalidParameter);
+            Require(std::memcmp(&frame, &previous, sizeof(frame)) == 0);
+        } else {
+            Require(ParsesTo(header, sizeof(header), 417, 2, 1152, 128000, 44100));
+        }
+        std::memset(&frame, 0xA5, sizeof(frame));
+        const auto previous = frame;
+        Require(sceAjmDecMp3ParseFrame(header, sizeof(header), 1, &frame) == invalidParameter);
+        Require(std::memcmp(&frame, &previous, sizeof(frame)) == 0);
+    }
 }
 
 const std::uint8_t LAME_MPEG1_STEREO_VBR[] = {
@@ -457,14 +445,17 @@ bool OflParsesTo(const std::vector<std::uint8_t>& stream, std::uint32_t streamSi
     return frame.num_frames == frames && frame.encoder_delay == delay && frame.total_samples == total && frame.ofl_type == type;
 }
 
-bool OflThrows(const std::vector<std::uint8_t>& stream) {
-    AjmDecMp3ParseFrame frame{};
-    try {
-        sceAjmDecMp3ParseFrame(stream.data(), static_cast<std::uint32_t>(stream.size()), 1, &frame);
-    } catch (const std::runtime_error&) {
-        return true;
+std::vector<std::uint8_t> ProtectedMp3Frame(std::vector<std::uint8_t> frame, bool tagAfterCrc) {
+    frame[1] &= 0xFE;
+    if (tagAfterCrc) {
+        const auto size = frame.size();
+        frame.insert(frame.begin() + 4, {0xA5, 0x5A});
+        frame.resize(size);
+    } else {
+        frame[4] = 0xA5;
+        frame[5] = 0x5A;
     }
-    return false;
+    return frame;
 }
 
 void TestMp3ParseOfl() {
@@ -481,21 +472,75 @@ void TestMp3ParseOfl() {
     const auto fgh = Mp3Frame(FGH_FRAME, sizeof(FGH_FRAME), 417);
     Require(OflParsesTo(fgh, 417, 0, 1105, 441000, 3));
     Require(OflParsesTo(Mp3Frame(FGH_BAD_CRC_FRAME, sizeof(FGH_BAD_CRC_FRAME), 417), 417, 0, 0, 0, 0));
+    const auto marker = std::find(fgh.begin() + 36, fgh.end(), 0xB4u);
+    Require(marker != fgh.end() && static_cast<std::size_t>(fgh.end() - marker) >= 10);
+    std::vector<std::uint8_t> misleadingFgh(417, 0);
+    std::copy_n(fgh.begin(), 4, misleadingFgh.begin());
+    const auto markerOffset = static_cast<std::size_t>(marker - fgh.begin());
+    std::copy_n(fgh.begin() + static_cast<std::ptrdiff_t>(markerOffset), 10, misleadingFgh.begin() + 36);
+    misleadingFgh[45] ^= 0x01u;
+    std::copy_n(fgh.begin() + static_cast<std::ptrdiff_t>(markerOffset), 10, misleadingFgh.begin() + 48);
+    Require(OflParsesTo(misleadingFgh, 417, 0, 0, 0, 0));
     auto vbri = Mp3Frame(VBRI_FRAME, sizeof(VBRI_FRAME), 417);
     Require(OflParsesTo(vbri, 417, 0, 576, 0, 2));
     vbri.insert(vbri.end(), fgh.begin(), fgh.end());
     Require(OflParsesTo(vbri, 834, 0, 576 + 1105, 441000, 4));
     Require(OflParsesTo(vbri, 480, 0, 576, 0, 2));
 
-    auto protectedFrame = stereo;
-    protectedFrame[1] = 0xFA;
-    Require(OflThrows(protectedFrame));
-    auto layer2 = stereo;
-    layer2[1] = 0xFD;
-    Require(OflThrows(layer2));
+    for (const bool tagAfterCrc : {false, true}) {
+        const auto protectedStereo = ProtectedMp3Frame(stereo, tagAfterCrc);
+        Require(OflParsesTo(protectedStereo, 417, 10, 1152 + 576 + 529, 10000, 1));
+        const auto protectedMono = ProtectedMp3Frame(mono, tagAfterCrc);
+        Require(OflParsesTo(protectedMono, 576, 10, 1152 + 576 + 529, 10000, 1));
+        const auto protectedMpeg2 = ProtectedMp3Frame(mpeg2, tagAfterCrc);
+        Require(OflParsesTo(protectedMpeg2, 208, 20, 576 + 576 + 529, 10000, 1));
+    }
+    auto protectedNonzeroSideInfo = ProtectedMp3Frame(stereo, true);
+    protectedNonzeroSideInfo[8] = 0x00;
+    protectedNonzeroSideInfo[9] = 0x10;
+    std::move_backward(protectedNonzeroSideInfo.begin() + 38, protectedNonzeroSideInfo.end() - 2, protectedNonzeroSideInfo.end());
+    protectedNonzeroSideInfo[38] = 0;
+    protectedNonzeroSideInfo[39] = 0;
+    Require(OflParsesTo(protectedNonzeroSideInfo, 417, 10, 1152 + 576 + 529, 10000, 1));
+    const auto protectedFgh = ProtectedMp3Frame(fgh, true);
+    Require(OflParsesTo(protectedFgh, 417, 0, 1105, 441000, 3));
     auto monoVbri = Mp3Frame(VBRI_FRAME, sizeof(VBRI_FRAME), 417);
     monoVbri[3] = 0xC4;
-    Require(OflThrows(monoVbri));
+    Require(OflParsesTo(monoVbri, 417, 0, 576, 0, 2));
+    for (const std::uint8_t version : {0xF3u, 0xE3u}) {
+        for (const std::uint8_t mode : {0x04u, 0xC4u}) {
+            auto otherVbri = Mp3Frame(VBRI_FRAME, sizeof(VBRI_FRAME), version == 0xF3 ? 208 : 417);
+            otherVbri[1] = version;
+            otherVbri[2] = 0x80;
+            otherVbri[3] = mode;
+            Require(OflParsesTo(otherVbri, static_cast<std::uint32_t>(otherVbri.size()), 0, 576, 0, 2));
+        }
+    }
+    const auto protectedVbri = ProtectedMp3Frame(monoVbri, false);
+    Require(OflParsesTo(protectedVbri, 417, 0, 576, 0, 2));
+    auto monoVbriAndFgh = monoVbri;
+    monoVbriAndFgh.insert(monoVbriAndFgh.end(), protectedFgh.begin(), protectedFgh.end());
+    Require(OflParsesTo(monoVbriAndFgh, 834, 0, 576 + 1105, 441000, 4));
+}
+
+void TestMp3MetadataBounds() {
+    const auto stereo = Mp3Frame(LAME_MPEG1_STEREO_VBR, sizeof(LAME_MPEG1_STEREO_VBR), 417);
+    const auto protectedStereo = ProtectedMp3Frame(stereo, true);
+    const auto protectedLame = ProtectedMp3Frame(stereo, false);
+    auto vbri = Mp3Frame(VBRI_FRAME, sizeof(VBRI_FRAME), 417);
+    vbri[3] = 0xC4;
+    for (const auto& complete : {stereo, protectedStereo, protectedLame, vbri}) {
+        for (std::size_t length = 0; length <= complete.size(); ++length) {
+            const std::vector<std::uint8_t> prefix(complete.begin(), complete.begin() + length);
+            AjmDecMp3ParseFrame frame{};
+            const int result = sceAjmDecMp3ParseFrame(prefix.data(), static_cast<std::uint32_t>(prefix.size()), 1, &frame);
+            Require(result == (length < 4 ? static_cast<int>(0x80930005) : 0));
+            if (length >= 4) Require(frame.frame_size == 417);
+        }
+    }
+    std::vector<std::uint8_t> chain;
+    for (std::size_t i = 0; i < 4096; ++i) chain.insert(chain.end(), vbri.begin(), vbri.end());
+    Require(OflParsesTo(chain, static_cast<std::uint32_t>(chain.size()), 0, 576, 0, 2));
 }
 
 struct GaplessDecode {
@@ -1927,12 +1972,14 @@ int main() {
     bool nullBuffersThrow = false;
     try {
         sceAjmBatchJobRunSplit(&batchInfo, 0, 0, nullptr, 1, nullptr, 0, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         nullBuffersThrow = true;
     }
     Require(nullBuffersThrow && batchInfo.offset == 0);
     TestMp3ParseFrame();
     TestMp3ParseOfl();
+    TestMp3MetadataBounds();
     TestMp3(context);
     TestOpus(context);
     TestOpus(context, 1);
diff --git a/core/libs/tests/GuestAjmVibration.cpp b/core/libs/tests/GuestAjmVibration.cpp
index 11351dcb6f..b130f5fbd2 100644
--- a/core/libs/tests/GuestAjmVibration.cpp
+++ b/core/libs/tests/GuestAjmVibration.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -8,19 +9,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAjmInitialize(std::int64_t, std::uint32_t*);
-int APS5_VABI sceAjmFinalize(std::uint32_t);
-int APS5_VABI sceAjmDecAt9ParseConfigData(const void*, AjmDecAt9ConfigDataInfo*);
-int APS5_VABI sceAjmInstanceCreate(std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t*);
-int APS5_VABI sceAjmInstanceDestroy(std::uint32_t, std::uint32_t);
-int APS5_VABI sceAjmBatchInitialize(void*, std::size_t, AjmBatchInfo*);
-int APS5_VABI sceAjmBatchJobInitialize(AjmBatchInfo*, std::uint32_t, const void*, std::size_t, void*);
-int APS5_VABI sceAjmBatchJobRun(AjmBatchInfo*, std::uint32_t, std::uint64_t, const void*, std::size_t, void*, std::size_t, void*, std::size_t);
-int APS5_VABI sceAjmBatchStart(std::uint32_t, const AjmBatchInfo*, int, AjmBatchError*, std::uint32_t*);
-int APS5_VABI sceAjmBatchWait(std::uint32_t, std::uint32_t, std::uint32_t, AjmBatchError*);
-}
-
 namespace {
 void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
diff --git a/core/libs/tests/GuestAjmWVorbis.cpp b/core/libs/tests/GuestAjmWVorbis.cpp
new file mode 100644
index 0000000000..b017065e10
--- /dev/null
+++ b/core/libs/tests/GuestAjmWVorbis.cpp
@@ -0,0 +1,92 @@
+#include "prx/libSceAjm.native/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+static_assert(sizeof(WVorbisHeaderPacketParameter) == 0x48);
+
+namespace {
+
+constexpr int InvalidParameter = static_cast<int>(0x8A6E0001);
+constexpr int InvalidSize = static_cast<int>(0x8A6E0002);
+constexpr int OutputTooSmall = static_cast<int>(0x8A6E0003);
+constexpr int InvalidSetup = static_cast<int>(0x8A6E0004);
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+constexpr std::array<std::uint8_t, 12> Setup {5, 'v', 'o', 'r', 'b', 'i', 's', 9, 0, 0xAA, 0xBB, 0xCC};
+
+WVorbisHeaderPacketParameter Valid(std::uint8_t* output, std::size_t outputSize) {
+    return {sizeof(WVorbisHeaderPacketParameter), 2, 48000, 16000, 8, 11, 0, Setup.data(), Setup.size(), output, outputSize, 0};
+}
+
+int Create(WVorbisHeaderPacketParameter param) { return sceAjmDecWVorbisCreateHeaderPacket(&param); }
+
+void TestValidation() {
+    std::array<std::uint8_t, 128> output {};
+    Require(sceAjmDecWVorbisCreateHeaderPacket(nullptr) == InvalidParameter, "a null parameter is refused");
+    auto param = Valid(output.data(), output.size());
+    param.size = 0x40;
+    Require(Create(param) == InvalidSize, "a wrong structure size is refused");
+    param = Valid(output.data(), output.size());
+    param.bytesPerSecond = -1;
+    Require(Create(param) == InvalidParameter, "a negative byte rate is refused");
+    param = Valid(output.data(), output.size());
+    param.shortBlockExponent = 5;
+    Require(Create(param) == InvalidParameter, "a block size below 64 is refused");
+    param.shortBlockExponent = 38;
+    param.longBlockExponent = 38;
+    Require(Create(param) == 0, "block size exponents are taken modulo 32 as the console's shift does");
+    param = Valid(output.data(), output.size());
+    param.longBlockExponent = 7;
+    Require(Create(param) == InvalidParameter, "block size 1 below block size 0 is refused");
+    param.longBlockExponent = 14;
+    Require(Create(param) == InvalidParameter, "a block size above 8192 is refused");
+    param = Valid(output.data(), output.size());
+    param.setupPacket = nullptr;
+    param.setupPacketSize = 0;
+    Require(Create(param) == InvalidParameter, "a null setup packet is refused before its size");
+    param = Valid(output.data(), output.size());
+    param.setupPacketSize = 8;
+    Require(Create(param) == InvalidSetup, "a setup packet below 9 bytes is refused");
+    param = Valid(nullptr, 0);
+    Require(Create(param) == InvalidParameter, "a null output is refused before its size");
+    param = Valid(output.data(), 9);
+    Require(Create(param) == OutputTooSmall, "an output below 10 bytes is refused");
+    param = Valid(output.data(), 56 + Setup.size() - 1);
+    Require(Create(param) == OutputTooSmall, "an output that cannot hold the setup packet is refused");
+}
+
+void TestPacket() {
+    std::array<std::uint8_t, 128> output {};
+    output.fill(0xEE);
+    auto param = Valid(output.data(), output.size());
+    Require(sceAjmDecWVorbisCreateHeaderPacket(&param) == 0, "a valid header packet is built");
+    Require(param.outputSize == 56 + Setup.size(), "the written size covers the table, both headers and the setup packet");
+    constexpr std::uint8_t Expected[] {
+        0, 0, 30, 0, 16, 0, 9, 0, 3, 0,
+        1, 'v', 'o', 'r', 'b', 'i', 's', 0, 0, 0, 0, 2, 0x80, 0xBB, 0, 0, 0, 0, 0, 0, 0x00, 0xF4, 0x01, 0x00, 0, 0, 0, 0, 0xB8, 1,
+        3, 'v', 'o', 'r', 'b', 'i', 's', 0, 0, 0, 0, 0, 0, 0, 0, 1,
+    };
+    static_assert(sizeof(Expected) == 56);
+    Require(std::memcmp(output.data(), Expected, sizeof(Expected)) == 0, "the table, identification and comment headers match");
+    Require(std::memcmp(output.data() + 56, Setup.data(), Setup.size()) == 0, "the setup packet follows unchanged");
+    Require(output[56 + Setup.size()] == 0xEE, "nothing is written past the packet");
+}
+
+}
+
+int main() {
+    TestValidation();
+    TestPacket();
+    std::puts("guest ajm wvorbis header packet: PASS");
+}
diff --git a/core/libs/tests/GuestAllocatingStrings.cpp b/core/libs/tests/GuestAllocatingStrings.cpp
index 8bf053914b..9bcaf27685 100644
--- a/core/libs/tests/GuestAllocatingStrings.cpp
+++ b/core/libs/tests/GuestAllocatingStrings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
@@ -8,15 +9,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-char* APS5_VABI strndup_nid_postfix(const char*, std::size_t);
-char* APS5_VABI strdup_nid_postfix(const char*);
-int APS5_VABI asprintf_nid_postfix(char**, const char*, ...);
-int APS5_VABI vasprintf_nid_postfix(char**, const char*, VaList*);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value) {
diff --git a/core/libs/tests/GuestAllocatorFailures.cpp b/core/libs/tests/GuestAllocatorFailures.cpp
index 5312249a50..f38e1a1e2d 100644
--- a/core/libs/tests/GuestAllocatorFailures.cpp
+++ b/core/libs/tests/GuestAllocatorFailures.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -12,23 +13,14 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" {
-void* APS5_VABI malloc_nid_postfix(std::size_t);
-void* APS5_VABI calloc_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI realloc_nid_postfix(void*, std::size_t);
-void* APS5_VABI memalign_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI aligned_alloc_nid_postfix(std::size_t, std::size_t);
-int APS5_VABI posix_memalign_nid_postfix(void**, std::size_t, std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int NoMemory = 12;
 constexpr int InvalidArgument = 22;
+constexpr int Untouched = 77;
 constexpr std::size_t Max = std::numeric_limits<std::size_t>::max();
 constexpr std::size_t HalfPlusOne = static_cast<std::size_t>(std::numeric_limits<std::ptrdiff_t>::max()) + 1;
+constexpr std::size_t LastPlainFailure = Max - 0x1008f;
 
 int failures = 0;
 
@@ -50,7 +42,7 @@ void report(const char* what, const char* detail) {
 
 template<typename TCall>
 void expectNull(const char* what, int expectedError, TCall call) {
-    *__error_nid_postfix() = 0;
+    *__error_nid_postfix() = Untouched;
     void* result = nullptr;
     try {
         result = call();
@@ -65,6 +57,7 @@ void expectNull(const char* what, int expectedError, TCall call) {
     if (result != nullptr) {
         report(what, "returned a block");
         free_nid_postfix(result);
+
         return;
     }
     if (*__error_nid_postfix() != expectedError) {
@@ -95,27 +88,59 @@ int main() {
     void* api[10]{};
     ApplicationHeapRegister_nid_no_patch(api);
 
-    expectNull("malloc(SIZE_MAX)", NoMemory, [] { return malloc_nid_postfix(Max); });
-    expectNull("malloc(PTRDIFF_MAX + 1)", NoMemory, [] { return malloc_nid_postfix(HalfPlusOne); });
-    expectNull("calloc(SIZE_MAX, 2)", NoMemory, [] { return calloc_nid_postfix(Max, 2); });
-    expectNull("calloc(2^33, 2^33)", NoMemory, [] { return calloc_nid_postfix(std::size_t{1} << 33, std::size_t{1} << 33); });
-    expectNull("calloc(PTRDIFF_MAX + 1, 1)", NoMemory, [] { return calloc_nid_postfix(HalfPlusOne, 1); });
-    expectNull("realloc(NULL, SIZE_MAX)", NoMemory, [] { return realloc_nid_postfix(nullptr, Max); });
-    expectNull("aligned_alloc(64, SIZE_MAX)", NoMemory, [] { return aligned_alloc_nid_postfix(64, Max); });
-    expectNull("memalign(64, PTRDIFF_MAX + 1)", NoMemory, [] { return memalign_nid_postfix(64, HalfPlusOne); });
-    expectNull("aligned_alloc(24, 64)", InvalidArgument, [] { return aligned_alloc_nid_postfix(24, 64); });
-    expectNull("aligned_alloc(0, 64)", InvalidArgument, [] { return aligned_alloc_nid_postfix(0, 64); });
-    expectNull("memalign(24, 64)", InvalidArgument, [] { return memalign_nid_postfix(24, 64); });
+    expectNull("malloc(SIZE_MAX)", Untouched, [] { return malloc_nid_postfix(Max); });
+    expectNull("malloc(SIZE_MAX - 0x1008e)", Untouched, [] { return malloc_nid_postfix(LastPlainFailure + 1); });
+    expectNull("malloc(SIZE_MAX - 0x1008f)", InvalidArgument, [] { return malloc_nid_postfix(LastPlainFailure); });
+    expectNull("malloc(PTRDIFF_MAX + 1)", InvalidArgument, [] { return malloc_nid_postfix(HalfPlusOne); });
+    expectNull("calloc(SIZE_MAX, 2)", Untouched, [] { return calloc_nid_postfix(Max, 2); });
+    expectNull("calloc(2^33, 2^33)", Untouched, [] { return calloc_nid_postfix(std::size_t{1} << 33, std::size_t{1} << 33); });
+    expectNull("calloc(1, SIZE_MAX - 0x1008e)", Untouched, [] { return calloc_nid_postfix(1, LastPlainFailure + 1); });
+    expectNull("calloc(PTRDIFF_MAX + 1, 1)", InvalidArgument, [] { return calloc_nid_postfix(HalfPlusOne, 1); });
+    expectNull("realloc(NULL, SIZE_MAX)", Untouched, [] { return realloc_nid_postfix(nullptr, Max); });
+    expectNull("realloc(NULL, PTRDIFF_MAX + 1)", InvalidArgument, [] { return realloc_nid_postfix(nullptr, HalfPlusOne); });
+    expectNull("aligned_alloc(64, SIZE_MAX)", Untouched, [] { return aligned_alloc_nid_postfix(64, Max); });
+    expectNull("aligned_alloc(16, PTRDIFF_MAX + 1)", InvalidArgument, [] { return aligned_alloc_nid_postfix(16, HalfPlusOne); });
+    expectNull("memalign(64, PTRDIFF_MAX + 1)", InvalidArgument, [] { return memalign_nid_postfix(64, HalfPlusOne); });
+    expectNull("memalign(4096, SIZE_MAX - 0x110af)", InvalidArgument, [] { return memalign_nid_postfix(4096, Max - 0x110af); });
+    expectNull("memalign(4096, SIZE_MAX - 0x110ae)", Untouched, [] { return memalign_nid_postfix(4096, Max - 0x110ae); });
+    expectNull("memalign(100, SIZE_MAX - 0x1012f)", InvalidArgument, [] { return memalign_nid_postfix(100, Max - 0x1012f); });
+    expectNull("memalign(100, SIZE_MAX - 0x1012e)", Untouched, [] { return memalign_nid_postfix(100, Max - 0x1012e); });
+    expectNull("memalign(3, SIZE_MAX - 0x1008f)", InvalidArgument, [] { return memalign_nid_postfix(3, LastPlainFailure); });
+    expectNull("memalign(3, SIZE_MAX - 0x1008e)", Untouched, [] { return memalign_nid_postfix(3, LastPlainFailure + 1); });
+    expectNull("memalign(2^63, 16)", Untouched, [] { return memalign_nid_postfix(HalfPlusOne, 16); });
+    expectNull("memalign(SIZE_MAX, 16)", Untouched, [] { return memalign_nid_postfix(Max, 16); });
+    expectNull("memalign(2^62 + 1, 16)", InvalidArgument, [] { return memalign_nid_postfix((std::size_t{1} << 62) + 1, 16); });
+    expectNull("aligned_alloc(24, 64)", Untouched, [] { return aligned_alloc_nid_postfix(24, 64); });
+    expectNull("aligned_alloc(0, 64)", Untouched, [] { return aligned_alloc_nid_postfix(0, 64); });
+    expectNull("aligned_alloc(2^63, 16)", Untouched, [] { return aligned_alloc_nid_postfix(HalfPlusOne, 16); });
+
+    struct RoundedAlignment {
+        std::size_t requested;
+        std::size_t guaranteed;
+    };
+    for (const RoundedAlignment& alignment : {RoundedAlignment{0, 32}, RoundedAlignment{3, 32}, RoundedAlignment{24, 32}, RoundedAlignment{48, 64},
+             RoundedAlignment{100, 128}, RoundedAlignment{3000, 4096}}) {
+        void* aligned = expectBlock("memalign with an alignment that is not a power of two", [&alignment] { return memalign_nid_postfix(alignment.requested, 40); });
+        if (aligned != nullptr && reinterpret_cast<std::uintptr_t>(aligned) % alignment.guaranteed != 0) report("memalign", "did not round the alignment up to a power of two");
+        free_nid_postfix(aligned);
+
+    }
 
     auto* block = static_cast<unsigned char*>(expectBlock("malloc(40)", [] { return malloc_nid_postfix(40); }));
     if (block != nullptr) {
         std::memset(block, 0x6b, 40);
-        expectNull("realloc(block, SIZE_MAX)", NoMemory, [block] { return realloc_nid_postfix(block, Max); });
-        expectNull("realloc(block, PTRDIFF_MAX + 1)", NoMemory, [block] { return realloc_nid_postfix(block, HalfPlusOne); });
+        expectNull("realloc(block, SIZE_MAX)", Untouched, [block] { return realloc_nid_postfix(block, Max); });
+        expectNull("realloc(block, PTRDIFF_MAX + 1)", InvalidArgument, [block] { return realloc_nid_postfix(block, HalfPlusOne); });
         for (unsigned index = 0; index < 40; ++index) {
             if (block[index] != 0x6b) report("realloc failure", "damaged the original block");
         }
-        free_nid_postfix(block);
+        void* emptied = expectBlock("realloc(block, 0)", [block] { return realloc_nid_postfix(block, 0); });
+        if (emptied != block) report("realloc(block, 0)", "did not return the same block");
+        if (emptied != nullptr && malloc_usable_size_nid_postfix(emptied) != 0) report("realloc(block, 0)", "left usable bytes in the block");
+        void* regrown = expectBlock("realloc(emptied, 64)", [emptied] { return realloc_nid_postfix(emptied, 64); });
+        if (regrown != nullptr && malloc_usable_size_nid_postfix(regrown) != 64) report("realloc(emptied, 64)", "did not hold 64 bytes");
+        free_nid_postfix(regrown);
+
     }
 
 #ifdef ANYPS5_ENABLE_ASAN
@@ -153,9 +178,10 @@ int main() {
             }
             if (huge != nullptr) {
                 free_nid_postfix(huge);
+
                 committed = true;
-            } else if (*__error_nid_postfix() != NoMemory) {
-                report("malloc(300 GiB)", "returned NULL without ENOMEM");
+            } else if (*__error_nid_postfix() != InvalidArgument) {
+                report("malloc(300 GiB)", "returned NULL without EINVAL");
             } else {
                 ++failedCommits;
             }
@@ -177,7 +203,7 @@ int main() {
             std::fputs("skipped: the host can commit 300 GiB, so the failed commit and arena release checks did not run\n", stderr);
 #endif
         } else {
-            if (failedCommits != 10) report("failed heap commits", "did not return ENOMEM for all ten attempts");
+            if (failedCommits != 10) report("failed heap commits", "did not return EINVAL for all ten attempts");
             void* after = nullptr;
             try {
                 after = GuestArena::GuestArenaAllocate_nid_postfix(probeBytes, 0x4000);
@@ -192,18 +218,35 @@ int main() {
         void* small = malloc_nid_postfix(100);
         if (small == nullptr) report("malloc(100) after a failed huge malloc", "returned NULL");
         free_nid_postfix(small);
+
         void* large = malloc_nid_postfix(std::size_t{1} << 20);
         if (large == nullptr) report("malloc(1 MiB) after a failed huge malloc", "returned NULL");
         free_nid_postfix(large);
+
     }
 #endif
 
-    void* untouched = &failures;
-    *__error_nid_postfix() = 77;
-    if (posix_memalign_nid_postfix(&untouched, HalfPlusOne, 8) != NoMemory) report("posix_memalign(PTRDIFF_MAX + 1)", "did not return ENOMEM");
-    if (posix_memalign_nid_postfix(&untouched, 64, HalfPlusOne) != NoMemory) report("posix_memalign(64, PTRDIFF_MAX + 1)", "did not return ENOMEM");
-    if (posix_memalign_nid_postfix(&untouched, 64, Max) != NoMemory) report("posix_memalign(64, SIZE_MAX)", "did not return ENOMEM");
-    if (untouched != &failures || *__error_nid_postfix() != 77) report("posix_memalign failure", "touched the output or errno");
+    struct PosixCase {
+        const char* what;
+        std::size_t alignment;
+        std::size_t size;
+        int result;
+        int error;
+    };
+    for (const PosixCase& check : {PosixCase{"posix_memalign(PTRDIFF_MAX + 1, 8)", HalfPlusOne, 8, NoMemory, Untouched},
+             PosixCase{"posix_memalign(64, PTRDIFF_MAX + 1)", 64, HalfPlusOne, NoMemory, InvalidArgument},
+             PosixCase{"posix_memalign(64, SIZE_MAX)", 64, Max, NoMemory, Untouched},
+             PosixCase{"posix_memalign(64, SIZE_MAX - 0x100ef)", 64, Max - 0x100ef, NoMemory, InvalidArgument},
+             PosixCase{"posix_memalign(64, SIZE_MAX - 0x100ee)", 64, Max - 0x100ee, NoMemory, Untouched},
+             PosixCase{"posix_memalign(4, 8)", 4, 8, InvalidArgument, Untouched}, PosixCase{"posix_memalign(24, 8)", 24, 8, InvalidArgument, Untouched},
+             PosixCase{"posix_memalign(PTRDIFF_MAX + 2, 8)", HalfPlusOne + 1, 8, InvalidArgument, Untouched}}) {
+        void* untouched = &failures;
+        *__error_nid_postfix() = Untouched;
+        const int result = posix_memalign_nid_postfix(&untouched, check.alignment, check.size);
+        if (result != check.result) report(check.what, "returned the wrong error number");
+        if (*__error_nid_postfix() != check.error) report(check.what, "left the wrong errno");
+        if (untouched != &failures) report(check.what, "touched the output");
+    }
 
     free_nid_postfix(expectBlock("calloc(3, 5)", [] { return calloc_nid_postfix(3, 5); }));
     free_nid_postfix(expectBlock("calloc(0, 5)", [] { return calloc_nid_postfix(0, 5); }));
diff --git a/core/libs/tests/GuestAmmPlacement.cpp b/core/libs/tests/GuestAmmPlacement.cpp
index db65b897bf..9c05f42929 100644
--- a/core/libs/tests/GuestAmmPlacement.cpp
+++ b/core/libs/tests/GuestAmmPlacement.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include <cstdint>
@@ -5,10 +6,6 @@
 #include <exception>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceAmprAmmGetVirtualAddressRanges(std::uint64_t*, std::uint64_t*, std::uint64_t*, std::uint64_t*);
-}
-
 static void Require(bool condition, const char* message) {
     if (!condition) throw std::runtime_error(message);
 }
diff --git a/core/libs/tests/GuestAmpr.cpp b/core/libs/tests/GuestAmpr.cpp
index f6017f152f..7b5bc20439 100644
--- a/core/libs/tests/GuestAmpr.cpp
+++ b/core/libs/tests/GuestAmpr.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestArena.hpp"
@@ -20,132 +23,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceAmprCommandBufferConstructor(Apr::CommandBufferObject*);
-int APS5_VABI sceAmprAprCommandBufferConstructor(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*);
-int APS5_VABI sceAmprCommandBufferSetBuffer(Apr::CommandBufferObject*, void*, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferReset(Apr::CommandBufferObject*);
-void* APS5_VABI sceAmprCommandBufferClearBuffer(Apr::CommandBufferObject*);
-std::uint32_t APS5_VABI sceAmprCommandBufferGetCurrentOffset(const Apr::CommandBufferObject*);
-std::uint32_t APS5_VABI sceAmprCommandBufferGetNumCommands(const Apr::CommandBufferObject*);
-int APS5_VABI sceAmprCommandBufferWriteAddressOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferPushMarker(Apr::CommandBufferObject*, const char*);
-int APS5_VABI sceAmprCommandBufferPushMarkerWithColor(Apr::CommandBufferObject*, const char*, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferPopMarker(Apr::CommandBufferObject*);
-int APS5_VABI sceAmprCommandBufferSetMarker(Apr::CommandBufferObject*, const char*);
-int APS5_VABI sceAmprCommandBufferSetMarkerWithColor(Apr::CommandBufferObject*, const char*, const std::uint32_t*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarker(const char*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizePushMarkerWithColor(const char*, std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizePopMarker();
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarker(const char*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeSetMarkerWithColor(const char*, std::uint32_t);
-int APS5_VABI sceKernelAprSubmitCommandBuffer(const Apr::CommandBufferObject*, std::uint32_t);
-int APS5_VABI sceKernelAprSubmitCommandBufferAndGetId(const Apr::CommandBufferObject*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceKernelAprWaitCommandBuffer(std::uint32_t);
-int APS5_VABI sceAmprCommandBufferWaitOnAddress(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWaitOnCounter(Apr::CommandBufferObject*, std::uint8_t, std::uint32_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteCounterOnCompletion(Apr::CommandBufferObject*, std::uint8_t, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounterOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPairOnCompletion(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteKernelEventQueueOnCompletion(Apr::CommandBufferObject*, std::uint64_t, std::int32_t, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferNop(Apr::CommandBufferObject*, std::uint32_t);
-int APS5_VABI sceAmprCommandBufferNopWithData(Apr::CommandBufferObject*, std::uint32_t, const std::uint32_t*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNop(std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeNopWithData(std::uint32_t);
-int APS5_VABI sceAmprCommandBufferWaitOnAddress_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t, std::uint8_t, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnAddress_04_00(volatile std::uint64_t*, std::uint64_t, std::uint8_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromTimeCounter_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounter_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferWriteAddressFromCounterPair_04_00(Apr::CommandBufferObject*, volatile std::uint64_t*, std::uint8_t, std::uint64_t);
-int APS5_VABI sceAmprCommandBufferWriteKernelEventQueue_04_00(Apr::CommandBufferObject*, std::uint64_t, std::int32_t, std::uint64_t, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromTimeCounter_04_00(volatile std::uint64_t*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounter_04_00(volatile std::uint64_t*, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteAddressFromCounterPair_04_00(volatile std::uint64_t*, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWaitOnCounter_04_00(Apr::CommandBufferObject*, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferWriteCounter_04_00(Apr::CommandBufferObject*, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWaitOnCounter_04_00(std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeWriteCounter_04_00(std::uint8_t, std::uint8_t, std::uint64_t, std::uint8_t);
-int APS5_VABI sceAmprCommandBufferConstructNop(Apr::CommandBufferObject*, std::int16_t, const void*, std::uint32_t, const std::uint32_t*);
-int APS5_VABI sceAmprCommandBufferConstructMarker(Apr::CommandBufferObject*, std::uint32_t, const char*, const std::uint32_t*);
-int APS5_VABI sceKernelAprResolveFilepathsToIds(const char**, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizes(const char**, std::uint32_t, std::uint32_t*, std::uint64_t*, std::uint32_t*);
-int APS5_VABI sceKernelAprResolveFilepathsToIdsAndFileSizesForEach(const char**, std::uint32_t, std::uint32_t*, std::uint64_t*, int*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceAmprAprCommandBufferReadFile(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, std::uint32_t, void*, std::uint64_t, std::uint64_t);
-std::uint32_t APS5_VABI sceAmprMeasureCommandSizeReadFile();
-int APS5_VABI sceAmprAprCommandBufferReadFileGather(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAprCommandBufferReadFileScatter(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, void*, std::uint64_t);
-int APS5_VABI sceAmprAprCommandBufferReadFileGatherScatter(Apr::CommandBufferObject*, std::uint64_t*, std::uint64_t*, void*, std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAprCommandBufferResetGatherScatterState(Apr::CommandBufferObject*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGather(std::uint64_t, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileScatter(void*, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeReadFileGatherScatter(void*, std::uint64_t, std::uint64_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeResetGatherScatterState();
-std::size_t APS5_VABI sceKernelGetDirectMemorySize();
-int APS5_VABI sceAmprAmmGetUsageStatsData(void*);
-int APS5_VABI sceAmprAmmCommandBufferConstructor(Apr::CommandBufferObject*);
-int APS5_VABI sceAmprAmmCommandBufferMap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferMapWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferMapDirect(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferMapDirectWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferUnmap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMap(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapWithGpuMaskId(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirect(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapDirectWithGpuMaskId(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeUnmap(std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAmmGiveDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceAmprAmmGetVirtualAddressRanges(std::uint64_t*, std::uint64_t*, std::uint64_t*, std::uint64_t*);
-int APS5_VABI sceAmprAmmSubmitCommandBuffer(void*, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAmprAmmSubmitCommandBuffer2(void*, std::uint32_t, std::uint32_t, std::uint64_t*, std::uint32_t*);
-int APS5_VABI sceAmprAmmSubmitCommandBuffer3(void*, std::uint32_t, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceAmprAmmWaitCommandBufferCompletion(std::uint32_t);
-int APS5_VABI sceAmprAprCommandBufferMapBegin(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAprCommandBufferMapDirectBegin(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAprCommandBufferMapEnd(Apr::CommandBufferObject*);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapBegin(std::uint64_t, std::uint64_t, std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapDirectBegin(std::uint64_t, std::uint64_t, std::uint64_t, std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI sceAmprMeasureCommandSizeMapEnd();
-int APS5_VABI sceKernelQueryMemoryProtection(void*, void**, void**, int*);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceAmprAmmCommandBufferMapAsPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t);
-int APS5_VABI sceAmprAmmCommandBufferAllocatePaForPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferRemapIntoPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint32_t);
-int APS5_VABI sceKernelWriteModifyMtypeProtectCommand(void*, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t*);
-int APS5_VABI sceKernelWriteRemapIntoPrtCommand(std::uint32_t*, std::uint64_t, std::uint64_t, std::uint64_t, int, int, std::uint64_t*);
-int APS5_VABI sceAmprAmmCommandBufferUnmapToPrt(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMapAsPrt(std::uint64_t, std::uint64_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeAllocatePaForPrt(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferRemap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferRemapWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferMultiMap(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferMultiMapWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyProtect(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyProtectWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtect(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t);
-int APS5_VABI sceAmprAmmCommandBufferModifyMtypeProtectWithGpuMaskId(Apr::CommandBufferObject*, std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemap(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeRemapWithGpuMaskId(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMap(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeMultiMapWithGpuMaskId(std::uint64_t, std::uint64_t, std::uint64_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtect(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyProtectWithGpuMaskId(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::uint8_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtect(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t);
-std::int64_t APS5_VABI sceAmprAmmMeasureAmmCommandSizeModifyMtypeProtectWithGpuMaskId(std::uint64_t, std::uint64_t, std::int32_t, std::int32_t, std::int32_t, std::uint8_t);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue*, const char*);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue, KernelEvent*, int, int*, const KernelUseconds*);
-int APS5_VABI sceKernelAddAmprEvent(KernelEqueue, int, void*);
-int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue, int);
-int APS5_VABI sceKernelGetEventFilter(const KernelEvent*);
-std::uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent*);
-std::intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent*);
-void* APS5_VABI sceKernelGetEventUserData(const KernelEvent*);
-}
-
 static void RequireAt(bool value, int line) {
     if (value) return;
     std::fprintf(stderr, "GuestAmpr.cpp:%d: requirement failed\n", line);
@@ -582,6 +459,10 @@ void TestVersionedCounters() {
 
 void TestClearBuffer() {
     Recorder recorder;
+    Require(sceAmprMeasureCommandSizeWriteAddressOnCompletion() == sizeof(Apr::WriteAddressCommand));
+    Require(sceAmprMeasureCommandSizeWriteCounterOnCompletion() == sizeof(Apr::WriteCounterCommand));
+    Require(sceAmprMeasureCommandSizeWriteKernelEventQueueOnCompletion() == sizeof(Apr::WriteKernelEventQueueCommand));
+    Require(sceAmprCommandBufferGetBufferBaseAddress(&recorder.buffer) == recorder.buffer.base);
     Require(sceAmprCommandBufferNop(&recorder.buffer, 1) == 0);
     Require(recorder.Offset() != 0 && recorder.Commands() == 1);
     Require(sceAmprCommandBufferClearBuffer(&recorder.buffer) == recorder.memory.data());
@@ -741,6 +622,7 @@ void TestReadAtUnseekableOffsetThrows() {
     bool rejected = false;
     try {
         sceKernelAprSubmitCommandBuffer(&buffer, 0);
+
     } catch (const std::runtime_error& error) {
         rejected = std::string(error.what()).find("returned 0 of 4 bytes") != std::string::npos;
     }
@@ -778,6 +660,7 @@ void TestMalformedCommandSizes() {
         bool rejected = false;
         try {
             sceKernelAprSubmitCommandBuffer(&buffer, 0);
+
         } catch (const std::runtime_error& error) {
             rejected = std::string(error.what()).starts_with(expected);
         }
@@ -797,6 +680,7 @@ void TestMalformedCommandSizes() {
     bool rejected = false;
     try {
         sceKernelAprSubmitCommandBuffer(&buffer, 0);
+
     } catch (const std::runtime_error& error) {
         rejected = std::string(error.what()).starts_with("APR: malformed command");
     }
@@ -924,7 +808,7 @@ void TestAmmRangesAboveHintedMaps() {
     constexpr std::uint64_t step = 0x400000;
     void* span = nullptr;
     Require(sceKernelReserveVirtualRange(&span, 4 * step, 0, 0) == 0);
-    Require(sceKernelMunmap(span, 4 * step) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(span), 4 * step) == 0);
     const auto heap = reinterpret_cast<std::uint64_t>(span);
     void* placed = span;
     Require(sceKernelMapFlexibleMemory(&placed, page, 3, 0) == 0 && placed == span);
@@ -944,26 +828,26 @@ void TestAmmRangesAboveHintedMaps() {
         Require(sceKernelMapFlexibleMemory(&mapped, page, 3, 0) == 0);
         Require(reinterpret_cast<std::uint64_t>(mapped) == hint);
         Require(hint + page <= start || hint >= multimapEnd);
-        Require(sceKernelMunmap(mapped, page) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     }
-    Require(sceKernelMunmap(span, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(span), page) == 0);
 }
 
 void TestAmmUsageStats() {
     std::array<std::uint64_t, 4> stats{};
     Require(sceAmprAmmGetUsageStatsData(nullptr) == static_cast<int>(0x80020016));
     stats[0] = 0x19;
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == static_cast<int>(0x80020016));
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == static_cast<int>(0x80020016));
     stats = {0x18, 0xdeadbeef, 0xdeadbeef, 0xdeadbeef};
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == 0);
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == 0);
     Require(stats[0] == 0x18);
     Require((stats[1] & 0xffffu) == 512u && (stats[1] >> 16u) == 0u);
     Require((stats[2] & 0xffffffffu) == 7u && (stats[2] >> 32u) == 0u);
     stats = {0x8, 0xdeadbeef, 0xdeadbeef, 0xdeadbeef};
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == 0);
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == 0);
     Require(stats[0] == 0x8 && stats[1] == 0xdeadbeef && stats[2] == 0xdeadbeef);
     stats = {0x0, 0xdeadbeef, 0xdeadbeef, 0xdeadbeef};
-    Require(sceAmprAmmGetUsageStatsData(stats.data()) == 0);
+    Require(sceAmprAmmGetUsageStatsData(reinterpret_cast<AmmUsageStatsData*>(stats.data())) == 0);
     Require(stats[0] == 0 && stats[1] == 0xdeadbeef);
 }
 
@@ -1021,7 +905,7 @@ void TestAmm() {
     RequireAppended(remaps, offset, commands, Apr::Opcode::AmmUnmap, sceAmprAmmMeasureAmmCommandSizeUnmap(automatic, 2 * page));
     Require(sceAmprAmmCommandBufferMapWithGpuMaskId(&remaps.buffer, reused, 6 * page, 0, cpuReadWrite, 1) == 0);
     std::uint64_t result = ~0ull;
-    Require(sceAmprAmmSubmitCommandBuffer2(remaps.memory.data(), remaps.Offset(), 0, &result, &id) == 0 && result == 0);
+    Require(sceAmprAmmSubmitCommandBuffer2(remaps.memory.data(), remaps.Offset(), 0, reinterpret_cast<AmmSubmitResult*>(&result), &id) == 0 && result == 0);
     Require(sceAmprAmmWaitCommandBufferCompletion(id) == 0);
     At(reused + 6 * page - 8) = 0x5555;
     Require(At(reused + 6 * page - 8) == 0x5555);
diff --git a/core/libs/tests/GuestAmprCppError.cpp b/core/libs/tests/GuestAmprCppError.cpp
index 8e2407c199..62d9843363 100644
--- a/core/libs/tests/GuestAmprCppError.cpp
+++ b/core/libs/tests/GuestAmprCppError.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
@@ -11,18 +12,16 @@
 #include <string>
 
 struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
-struct Category { const void* const* vtable; };
-struct ErrorCode { int value; const Category* category; };
-struct SystemError { const void* const* vtable; const char* message; ErrorCode code; };
-static_assert(sizeof(SystemError) == 32 && offsetof(SystemError, code) == 16);
 
-using GuestWhat = const char* (APS5_VABI *)(const SystemError*);
-using CategoryDelete = void (APS5_VABI *)(const Category*);
-using CategoryName = const char* (APS5_VABI *)(const Category*);
-using CategoryMessage = void* (APS5_VABI *)(void*, const Category*, int);
-using CategoryCondition = ErrorCode (APS5_VABI *)(const Category*, int);
-using CategoryEquivalentCondition = bool (APS5_VABI *)(const Category*, int, const ErrorCode*);
-using CategoryEquivalentCode = bool (APS5_VABI *)(const Category*, const ErrorCode*, int);
+static_assert(sizeof(LibcException::SystemErrorObject) == 32 && offsetof(LibcException::SystemErrorObject, code) == 16);
+
+using GuestWhat = const char* (APS5_VABI *)(const LibcException::SystemErrorObject*);
+using CategoryDelete = void (APS5_VABI *)(const LibcException::CategoryObject*);
+using CategoryName = const char* (APS5_VABI *)(const LibcException::CategoryObject*);
+using CategoryMessage = void* (APS5_VABI *)(void*, const LibcException::CategoryObject*, int);
+using CategoryCondition = LibcException::ErrorCode (APS5_VABI *)(const LibcException::CategoryObject*, int);
+using CategoryEquivalentCondition = bool (APS5_VABI *)(const LibcException::CategoryObject*, int, const LibcException::ErrorCode*);
+using CategoryEquivalentCode = bool (APS5_VABI *)(const LibcException::CategoryObject*, const LibcException::ErrorCode*, int);
 
 struct Expected { int value; const char* what; };
 static constexpr Expected Errors[] {
@@ -40,11 +39,7 @@ extern const unsigned char _ZTISt9exception_nid_postfix[];
 extern const unsigned char _ZTISt11logic_error_nid_postfix[];
 extern const unsigned char _ZTISt13runtime_error_nid_postfix[];
 extern const unsigned char _ZTISt12system_error_nid_postfix[];
-[[noreturn]] void APS5_VABI _ZSt16_Throw_Cpp_errori_nid_postfix(int code);
-void APS5_VABI _ZNSt12system_errorC1ERKS__nid_postfix(SystemError* self, const SystemError* source);
-SystemError* APS5_VABI _ZNSt12system_erroraSERKS__nid_postfix(SystemError* self, const SystemError* source);
-void APS5_VABI _ZNSt12system_errorD1Ev_nid_postfix(SystemError* self);
-void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
+
 void APS5_VABI GuestCatch(int code);
 
 const void* FixtureCatchType = nullptr;
@@ -71,58 +66,61 @@ static const TypeRecord* TypeOf(const void* const* vtable, int destroySlot) {
     return static_cast<const TypeRecord*>(vtable[destroySlot - 1]);
 }
 
-static void CheckCategory(const SystemError& error) {
-    const Category* category = error.code.category;
+static void CheckCategory(const LibcException::SystemErrorObject& error) {
+    const LibcException::CategoryObject* category = error.code.category;
     Require(category != nullptr, 20);
-    const TypeRecord* type = TypeOf(category->vtable, 0);
+    const TypeRecord* type = TypeOf(static_cast<const void* const*>(category->vtable), 0);
     Require(std::strcmp(type->name, "St23_Generic_error_category") == 0, 21);
     Require(type->base && std::strcmp(type->base->name, "St14error_category") == 0, 22);
-    Require(std::strcmp(Slot<CategoryName>(category->vtable, 2)(category), "generic") == 0, 23);
-    const ErrorCode condition = Slot<CategoryCondition>(category->vtable, 4)(category, error.code.value);
+    Require(std::strcmp(Slot<CategoryName>(reinterpret_cast<const void* const*>(category->vtable), 2)(category), "generic") == 0, 23);
+    const LibcException::ErrorCode condition = Slot<CategoryCondition>(reinterpret_cast<const void* const*>(category->vtable), 4)(category, error.code.value);
     Require(condition.value == error.code.value && condition.category == category, 24);
-    const ErrorCode other {error.code.value + 1, category};
-    const ErrorCode foreign {error.code.value, nullptr};
-    auto equivalentCondition = Slot<CategoryEquivalentCondition>(category->vtable, 5);
+    const LibcException::ErrorCode other {0, error.code.value + 1, category};
+    const LibcException::ErrorCode foreign {0, error.code.value, nullptr};
+    auto equivalentCondition = Slot<CategoryEquivalentCondition>(reinterpret_cast<const void* const*>(category->vtable), 5);
     Require(equivalentCondition(category, error.code.value, &condition), 25);
     Require(!equivalentCondition(category, error.code.value, &other), 26);
     Require(!equivalentCondition(category, error.code.value, &foreign), 27);
-    auto equivalentCode = Slot<CategoryEquivalentCode>(category->vtable, 6);
+    auto equivalentCode = Slot<CategoryEquivalentCode>(reinterpret_cast<const void* const*>(category->vtable), 6);
     Require(equivalentCode(category, &error.code, error.code.value), 28);
     Require(!equivalentCode(category, &error.code, error.code.value + 1), 29);
     Require(!equivalentCode(category, &foreign, error.code.value), 30);
     GuestLocale::String result {};
-    Require(Slot<CategoryMessage>(category->vtable, 3)(&result, category, error.code.value) == &result, 33);
+    Require(Slot<CategoryMessage>(reinterpret_cast<const void* const*>(category->vtable), 3)(&result, category, error.code.value) == &result, 33);
     const char* data = result.capacity <= 15 ? result.buffer : result.pointer;
     Require(std::strcmp(data, std::strstr(FixtureExpected->what, ": ") + 2) == 0, 34);
     if (result.capacity > 15) _ZdlPv_nid_postfix(result.pointer);
     bool deleteThrew = false;
     try {
-        Slot<CategoryDelete>(category->vtable, 1)(category);
+        Slot<CategoryDelete>(reinterpret_cast<const void* const*>(category->vtable), 1)(category);
     } catch (const std::invalid_argument&) {
         deleteThrew = true;
     }
     Require(deleteThrew, 32);
 }
 
-static void CheckCopies(const SystemError& error) {
-    SystemError copy {};
+static void CheckCopies(const LibcException::SystemErrorObject& error) {
+    LibcException::SystemErrorObject copy {};
     _ZNSt12system_errorC1ERKS__nid_postfix(&copy, &error);
-    Require(copy.vtable == error.vtable && copy.message == error.message, 40);
+
+    Require(copy.base.vtable == error.base.vtable && copy.base.message == error.base.message, 40);
     Require(copy.code.value == error.code.value && copy.code.category == error.code.category, 41);
-    SystemError assigned {};
+    LibcException::SystemErrorObject assigned {};
     _ZNSt12system_errorC1ERKS__nid_postfix(&assigned, &error);
-    assigned.code = {0, nullptr};
+
+    assigned.code = {0, 0, nullptr};
     Require(_ZNSt12system_erroraSERKS__nid_postfix(&assigned, &error) == &assigned, 42);
     Require(assigned.code.value == error.code.value && assigned.code.category == error.code.category, 43);
-    _ZNSt12system_errorD1Ev_nid_postfix(&assigned);
-    _ZNSt12system_errorD1Ev_nid_postfix(&copy);
-    Require(copy.message == nullptr && assigned.message == nullptr, 44);
+    _ZNSt12system_errorD1Ev_nid_postfix(&assigned.base);
+    _ZNSt12system_errorD1Ev_nid_postfix(&copy.base);
+
+    Require(copy.base.message == nullptr && assigned.base.message == nullptr, 44);
 }
 
 extern "C" void APS5_VABI FixtureInspect(void* object) {
-    const auto& error = *static_cast<const SystemError*>(object);
-    Require(std::strcmp(TypeOf(error.vtable, 0)->name, "St12system_error") == 0, 10);
-    const char* what = Slot<GuestWhat>(error.vtable, 2)(&error);
+    const auto& error = *static_cast<const LibcException::SystemErrorObject*>(object);
+    Require(std::strcmp(TypeOf(static_cast<const void* const*>(error.base.vtable), 0)->name, "St12system_error") == 0, 10);
+    const char* what = Slot<GuestWhat>(reinterpret_cast<const void* const*>(error.base.vtable), 2)(&error);
     Require(what && std::strcmp(what, FixtureExpected->what) == 0, 11);
     Require(error.code.value == FixtureExpected->value, 12);
     CheckCategory(error);
@@ -142,6 +140,7 @@ static void CheckOutOfRange(int code) {
     bool threw = false;
     try {
         _ZSt16_Throw_Cpp_errori_nid_postfix(code);
+
     } catch (const std::out_of_range& error) {
         threw = std::string(error.what()).find(std::to_string(code)) != std::string::npos;
     }
diff --git a/core/libs/tests/GuestAmprThreads.cpp b/core/libs/tests/GuestAmprThreads.cpp
index 403c445304..653c2cb941 100644
--- a/core/libs/tests/GuestAmprThreads.cpp
+++ b/core/libs/tests/GuestAmprThreads.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -17,11 +21,6 @@
 #include <unistd.h>
 #endif
 
-struct GuestXtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
 struct PadTarget {
     std::atomic<int>* order;
     std::atomic<bool>* destroyed;
@@ -38,48 +37,19 @@ struct GuestTypeInfo {
 struct GuestSystemError {
     const void* vtable;
     const char* message;
+    int reserved;
     int code;
     const void* category;
 };
 
-using GuestTerminate = void (APS5_VABI*)();
-
-struct TestPad {
-    unsigned (APS5_VABI* const* vtable)(TestPad*);
-    void* condition;
-    void* mutex;
-    bool started;
+struct TestPad : GuestPad {
     PadTarget target;
 };
 
+using GuestTerminate = void (APS5_VABI*)();
+
 extern "C" {
-void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(TestPad* pad);
-void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(TestPad* pad);
-void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(TestPad* pad, Pthread* thread);
-void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(TestPad* pad);
-int APS5_VABI _Thrd_join_nid_postfix(Pthread thread, int* code);
-int APS5_VABI _Thrd_sleep_nid_postfix(const GuestXtime* target, GuestXtime* remaining);
-void APS5_VABI _Lock_shared_ptr_spin_lock_nid_postfix(void);
-void APS5_VABI _Unlock_shared_ptr_spin_lock_nid_postfix(void);
-int APS5_VABI sceAmprWcstombsS(std::size_t* result, char* destination, std::size_t capacity, const std::uint16_t* source, std::size_t limit);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI pthread_detach_nid_postfix(Pthread thread);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
-int APS5_VABI _Cnd_init_with_name_nid_postfix(void** handle, const char* name);
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_wait_nid_postfix(void** condition, void** mutex);
-int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-GuestTerminate APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(GuestTerminate handler);
-const GuestTypeInfo* APS5_VABI __cxa_current_exception_type_nid_postfix();
-void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
-LibcException::Header* APS5_VABI __cxa_init_primary_exception_nid_postfix(void* object, std::type_info* type, void (*destructor)(void*));
-[[noreturn]] void APS5_VABI __cxa_call_unexpected_nid_postfix(void* unwindException);
+
 extern const unsigned char _ZTVN10__cxxabiv117__class_type_infoE_nid_postfix[];
 }
 
@@ -106,7 +76,7 @@ static std::int64_t RealtimeNanos() {
     return now.tv_sec * NanosPerSecond + now.tv_nsec;
 }
 
-static GuestXtime XtimeAfter(std::int64_t nanos) {
+static Xtime XtimeAfter(std::int64_t nanos) {
     const auto target = RealtimeNanos() + nanos;
     return {target / NanosPerSecond, target % NanosPerSecond};
 }
@@ -134,10 +104,12 @@ static void* APS5_VABI SpinWorker(void* arg) {
     auto& context = *static_cast<SpinContext*>(arg);
     for (int iteration = 0; iteration < SpinIterations; ++iteration) {
         _Lock_shared_ptr_spin_lock_nid_postfix();
+
         if (context.inside.fetch_add(1) != 0) context.overlapped = true;
         ++context.counter;
         context.inside.fetch_sub(1);
         _Unlock_shared_ptr_spin_lock_nid_postfix();
+
     }
     return nullptr;
 }
@@ -180,12 +152,12 @@ static void TestThreadSleep() {
     Require(RealtimeNanos() - before < NanosPerSecond / 2);
 
     const auto carried = XtimeAfter(30000000);
-    const GuestXtime unnormalized{carried.sec - 2, carried.nsec + 2 * NanosPerSecond};
+    const Xtime unnormalized{carried.sec - 2, carried.nsec + 2 * NanosPerSecond};
     Require(_Thrd_sleep_nid_postfix(&unnormalized, nullptr) == 0);
     Require(RealtimeNanos() >= carried.sec * NanosPerSecond + carried.nsec);
 
     const auto borrowed = XtimeAfter(20000000);
-    const GuestXtime negative{borrowed.sec + 1, borrowed.nsec - NanosPerSecond};
+    const Xtime negative{borrowed.sec + 1, borrowed.nsec - NanosPerSecond};
     Require(_Thrd_sleep_nid_postfix(&negative, nullptr) == 0);
     Require(RealtimeNanos() >= borrowed.sec * NanosPerSecond + borrowed.nsec);
 
@@ -209,6 +181,7 @@ static void TestThreadSleep() {
     bool rejected = false;
     try {
         _Thrd_sleep_nid_postfix(nullptr, nullptr);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -224,6 +197,7 @@ static void TestSpinLock() {
     Require(context.counter == SpinThreads * SpinIterations);
     _Lock_shared_ptr_spin_lock_nid_postfix();
     _Unlock_shared_ptr_spin_lock_nid_postfix();
+
 }
 
 static void TestWcstombs() {
@@ -265,11 +239,11 @@ static void TestWcstombs() {
     Require(result == Failed && buffer[0] == 'x');
 
     std::memset(buffer, 'x', sizeof(buffer));
-    Require(sceAmprWcstombsS(&result, buffer, sizeof(buffer), wide, sizeof(buffer)) == GuestEilseq);
-    Require(result == Failed && buffer[0] == 'a' && buffer[1] == '\0');
+    Require(sceAmprWcstombsS(&result, buffer, sizeof(buffer), wide, sizeof(buffer)) == 0);
+    Require(result == 3 && std::memcmp(buffer, "a\xc4\x80\0x", 5) == 0);
 
-    Require(sceAmprWcstombsS(&result, nullptr, 0, wide, 0) == GuestEilseq);
-    Require(result == Failed);
+    Require(sceAmprWcstombsS(&result, nullptr, 0, wide, 0) == 0);
+    Require(result == 3);
 }
 
 template<typename TException, typename TCall>
@@ -366,6 +340,7 @@ static void TestConditionSignal() {
     RequireThrows<std::invalid_argument>([&] { _Cnd_signal_nid_postfix(&context.mutex); });
     RequireThrows<std::invalid_argument>([] { _Cnd_init_with_name_nid_postfix(nullptr, "AmprSignal"); });
     _Cnd_destroy_nid_postfix(&context.condition);
+
     Require(context.condition == nullptr);
     RequireThrows<std::invalid_argument>([&] { _Cnd_signal_nid_postfix(&context.condition); });
 
@@ -373,24 +348,28 @@ static void TestConditionSignal() {
     Require(_Cnd_init_with_name_nid_postfix(&unnamed, nullptr) == ThrdSuccess && unnamed != nullptr);
     Require(_Cnd_signal_nid_postfix(&unnamed) == ThrdSuccess);
     _Cnd_destroy_nid_postfix(&unnamed);
+
     void* plain = nullptr;
     Require(_Cnd_init_nid_postfix(&plain) == ThrdSuccess);
     Require(_Cnd_signal_nid_postfix(&plain) == ThrdSuccess);
     _Cnd_destroy_nid_postfix(&plain);
     _Mtx_destroy_nid_postfix(&context.mutex);
+
 }
 
-static unsigned APS5_VABI PadGo(TestPad* pad) {
+static unsigned APS5_VABI PadGo(GuestPad* base) {
+    auto* pad = static_cast<TestPad*>(base);
     const auto local = pad->target;
     std::this_thread::sleep_for(std::chrono::milliseconds(20));
     local.order->store(local.beforeRelease);
     _ZNSt4_Pad8_ReleaseEv_nid_postfix(pad);
+
     while (!local.destroyed->load()) std::this_thread::yield();
     local.order->store(local.afterRelease);
     return local.exitCode;
 }
 
-static constexpr std::array<unsigned (APS5_VABI*)(TestPad*), 1> PadVtable{PadGo};
+static constexpr std::array<unsigned (APS5_VABI*)(GuestPad*), 1> PadVtable{PadGo};
 
 template <typename TException, typename TCall>
 static bool Throws(TCall call) {
@@ -406,6 +385,7 @@ static void ConstructPad(TestPad& pad, std::atomic<int>& order, std::atomic<bool
     std::memset(&pad, 0xCD, sizeof(pad));
     pad.vtable = PadVtable.data();
     _ZNSt4_PadC2Ev_nid_postfix(&pad);
+
     Require(pad.vtable == PadVtable.data());
     Require(pad.condition && pad.mutex && !pad.started);
     pad.target = {&order, &destroyed, 2 * index + 1, 2 * index + 2, exitCode};
@@ -417,11 +397,13 @@ static void TestPadLaunch() {
     TestPad pad;
     ConstructPad(pad, order, destroyed, 0, 0);
     Pthread thread = nullptr;
-    _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, &thread);
+    _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, reinterpret_cast<void**>(&thread));
+
     Require(thread != nullptr);
     Require(pad.started);
     Require(order.load() == 1);
     _ZNSt4_PadD2Ev_nid_postfix(&pad);
+
     Require(!pad.condition && !pad.mutex);
     Require(order.load() == 1);
     destroyed = true;
@@ -439,9 +421,11 @@ static void TestPadLaunchMany() {
     std::array<Pthread, Count> threads{};
     for (int index = 0; index < Count; ++index) {
         ConstructPad(pads[index], orders[index], destroyed, index, 100u + index);
-        _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pads[index], &threads[index]);
+        _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pads[index], reinterpret_cast<void**>(&threads[index]));
+
         Require(orders[index].load() == 2 * index + 1);
         _ZNSt4_PadD2Ev_nid_postfix(&pads[index]);
+
     }
     destroyed = true;
     for (int index = 0; index < Count; ++index) {
@@ -452,10 +436,12 @@ static void TestPadLaunchMany() {
     }
 }
 
-static unsigned APS5_VABI PadGoImmediate(TestPad* pad) {
+static unsigned APS5_VABI PadGoImmediate(GuestPad* base) {
+    auto* pad = static_cast<TestPad*>(base);
     const auto local = pad->target;
     local.order->store(local.beforeRelease);
     _ZNSt4_Pad8_ReleaseEv_nid_postfix(pad);
+
     while (!local.destroyed->load()) std::this_thread::yield();
     local.order->store(local.afterRelease);
     return local.exitCode;
@@ -463,7 +449,7 @@ static unsigned APS5_VABI PadGoImmediate(TestPad* pad) {
 
 static void TestPadConcurrentLaunch() {
     constexpr int Count = 4;
-    constexpr std::array<unsigned (APS5_VABI*)(TestPad*), 1> immediateVtable{PadGoImmediate};
+    constexpr std::array<unsigned (APS5_VABI*)(GuestPad*), 1> immediateVtable{PadGoImmediate};
     std::atomic<int> ready{0};
     std::array<std::thread, Count> parents;
     for (int index = 0; index < Count; ++index) {
@@ -476,9 +462,11 @@ static void TestPadConcurrentLaunch() {
             ready.fetch_add(1);
             while (ready.load() != Count) std::this_thread::yield();
             Pthread thread = nullptr;
-            _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, &thread);
+            _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(&pad, reinterpret_cast<void**>(&thread));
+
             Require(thread != nullptr && pad.started && order.load() == 2 * index + 1);
             _ZNSt4_PadD2Ev_nid_postfix(&pad);
+
             std::memset(&pad, 0xcd, sizeof(pad));
             destroyed = true;
             int code = 0;
@@ -505,7 +493,7 @@ static void* APS5_VABI DestroyPad(void* arg) {
 static void APS5_VABI ExitWithSystemErrorCode() {
     const auto* type = __cxa_current_exception_type_nid_postfix();
     const auto* error = static_cast<const GuestSystemError*>(__cxa_current_primary_exception_nid_postfix());
-    _exit(type && error && std::strcmp(type->name, "St12system_error") == 0 ? error->code : 1);
+    _exit(type && error && std::strcmp(type->name(), "St12system_error") == 0 ? error->code : 1);
 }
 
 template <typename TCall>
@@ -514,6 +502,7 @@ static int TerminateExitCode(GuestTerminate handler, TCall call) {
     Require(child >= 0);
     if (child == 0) {
         _ZSt13set_terminatePFvvE_nid_postfix(handler);
+
         call();
         _exit(2);
     }
@@ -526,7 +515,7 @@ static const GuestTypeInfo UnexpectedType{_ZTVN10__cxxabiv117__class_type_infoE_
 
 static void APS5_VABI ExitWithCaughtType() {
     const auto* type = __cxa_current_exception_type_nid_postfix();
-    _exit(type == &UnexpectedType ? 42 : type == nullptr ? 43 : 1);
+    _exit(type == reinterpret_cast<const std::type_info*>(&UnexpectedType) ? 42 : type == nullptr ? 43 : 1);
 }
 
 static void TestCallUnexpected() {
@@ -535,6 +524,7 @@ static void TestCallUnexpected() {
         auto* type = reinterpret_cast<std::type_info*>(const_cast<GuestTypeInfo*>(&UnexpectedType));
         LibcException::Header* header = __cxa_init_primary_exception_nid_postfix(object, type, nullptr);
         __cxa_call_unexpected_nid_postfix(&header->unwind);
+
     }) == 42);
     Require(TerminateExitCode(ExitWithCaughtType, [] { __cxa_call_unexpected_nid_postfix(nullptr); }) == 43);
 }
@@ -545,7 +535,7 @@ static void TestPadErrors() {
     Require(Throws<std::invalid_argument>([] { _ZNSt4_PadD2Ev_nid_postfix(nullptr); }));
     Require(Throws<std::invalid_argument>([] { _ZNSt4_Pad8_ReleaseEv_nid_postfix(nullptr); }));
     Pthread thread = nullptr;
-    Require(Throws<std::invalid_argument>([&] { _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(nullptr, &thread); }));
+    Require(Throws<std::invalid_argument>([&] { _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(nullptr, reinterpret_cast<void**>(&thread)); }));
 
     std::atomic<int> order{0};
     std::atomic<bool> destroyed{true};
@@ -563,6 +553,7 @@ static void TestPadErrors() {
     Require(context.rejected);
     Require(pad.condition && pad.mutex);
     _ZNSt4_PadD2Ev_nid_postfix(&pad);
+
     Require(!pad.condition && !pad.mutex);
     Require(Throws<std::invalid_argument>([&] { _ZNSt4_PadD2Ev_nid_postfix(&pad); }));
 }
diff --git a/core/libs/tests/GuestAppContent.cpp b/core/libs/tests/GuestAppContent.cpp
index 468467e521..876515f966 100644
--- a/core/libs/tests/GuestAppContent.cpp
+++ b/core/libs/tests/GuestAppContent.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAppContent/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include <chrono>
@@ -8,26 +10,6 @@
 #include <array>
 #include "ProcessParametersFixture.hpp"
 
-extern "C" {
-int APS5_VABI sceAppContentInitialize(const AppContentInitParam*, AppContentBootParam*);
-int APS5_VABI sceAppContentAddcontMount(uint32_t, const NpUnifiedEntitlementLabel*, AppContentMountPoint*);
-int APS5_VABI sceAppContentAddcontUnmount(const AppContentMountPoint*);
-int APS5_VABI sceAppContentAddcontEnqueueDownload(uint32_t, const NpUnifiedEntitlementLabel*);
-int APS5_VABI sceAppContentAddcontDelete(uint32_t, const NpUnifiedEntitlementLabel*);
-int APS5_VABI sceAppContentGetAddcontDownloadProgress(uint32_t, const NpUnifiedEntitlementLabel*, void*);
-int APS5_VABI sceAppContentTemporaryDataMount2(uint32_t, AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataUnmount(const AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataFormat(const AppContentMountPoint*);
-int APS5_VABI sceAppContentTemporaryDataGetAvailableSpaceKb(const AppContentMountPoint*, size_t*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceAppContentGetAddcontInfo(uint32_t, const NpUnifiedEntitlementLabel*, void*);
-int APS5_VABI sceAppContentGetAddcontInfoList(uint32_t, void*, uint32_t, uint32_t*);
-int APS5_VABI sceAppContentDownloadDataGetAvailableSpaceKb(const AppContentMountPoint*, size_t*);
-int APS5_VABI sceAppContentDownloadDataFormat(const AppContentMountPoint*);
-int APS5_VABI sceAppContentAppParamGetInt(uint32_t, int32_t*);
-}
-
 static constexpr int ErrorParameter = static_cast<int>(0x80D90002);
 static constexpr int ErrorNotFound = static_cast<int>(0x80D90005);
 static constexpr int ErrorDrmNoEntitlement = static_cast<int>(0x80D90007);
@@ -191,13 +173,24 @@ int main() {
     Require(sceAppContentTemporaryDataMount2(1, &mountPoint) == 0);
     Require(std::filesystem::is_empty(backing));
     Require(sceAppContentTemporaryDataUnmount(&mountPoint) == 0);
+    Require(sceAppContentTemporaryDataMount(nullptr) == ErrorParameter);
+    { std::ofstream file(backing / "remove.txt"); file << "format"; }
+    std::memset(&mountPoint, 0x5a, sizeof(mountPoint));
+    Require(sceAppContentTemporaryDataMount(&mountPoint) == 0);
+    Require(std::strcmp(mountPoint.data, "/temp0") == 0);
+    Require(std::filesystem::is_empty(backing));
+    Require(sceAppContentTemporaryDataMount(&second) == ErrorBusy);
+    Require(sceAppContentTemporaryDataMount2(0, &second) == ErrorBusy);
+    Require(sceAppContentTemporaryDataUnmount(&mountPoint) == 0);
+    Require(sceAppContentTemporaryDataMount(&mountPoint) == 0);
+    Require(sceAppContentTemporaryDataUnmount(&mountPoint) == 0);
     unsigned char info[24];
     std::memset(info, 0x5a, sizeof(info));
     unsigned char untouchedInfo[24];
     std::memcpy(untouchedInfo, info, sizeof(info));
-    Require(sceAppContentGetAddcontInfo(0, &label, info) == ErrorDrmNoEntitlement);
+    Require(sceAppContentGetAddcontInfo(0, &label, reinterpret_cast<AppContentAddcontInfo*>(info)) == ErrorDrmNoEntitlement);
     Require(std::memcmp(info, untouchedInfo, sizeof(info)) == 0);
-    Require(sceAppContentGetAddcontInfo(0, nullptr, info) == ErrorParameter);
+    Require(sceAppContentGetAddcontInfo(0, nullptr, reinterpret_cast<AppContentAddcontInfo*>(info)) == ErrorParameter);
     Require(sceAppContentGetAddcontInfo(0, &label, nullptr) == ErrorParameter);
 
     for (const std::uint32_t version : {0x014fffffu, 0x01500000u, 0x034fffffu, 0x03500000u}) {
@@ -208,7 +201,7 @@ int main() {
             const int infoError = version >= 0x01500000 ? ErrorParameter : ErrorDrmNoEntitlement;
             const int lateError = version >= 0x03500000 ? ErrorParameter : ErrorNotFound;
             Require(sceAppContentAddcontMount(0, &label, &mountPoint) == earlyError);
-            Require(sceAppContentGetAddcontInfo(0, &label, info) == infoError);
+            Require(sceAppContentGetAddcontInfo(0, &label, reinterpret_cast<AppContentAddcontInfo*>(info)) == infoError);
             Require(sceAppContentAddcontEnqueueDownload(0, &label) == earlyError);
             Require(sceAppContentAddcontDelete(0, &label) == lateError);
             Require(sceAppContentGetAddcontDownloadProgress(0, &label, progress) == lateError);
@@ -222,18 +215,18 @@ int main() {
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, &hitNum) == 0);
     Require(hitNum == 0);
     hitNum = 0x5a5a5a5a;
-    Require(sceAppContentGetAddcontInfoList(0, info, 0, &hitNum) == 0);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 0, &hitNum) == 0);
     Require(hitNum == 0);
     hitNum = 0x5a5a5a5a;
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 1, &hitNum) == 0);
     Require(hitNum == 0);
     hitNum = 0x5a5a5a5a;
-    Require(sceAppContentGetAddcontInfoList(0, info, 1, &hitNum) == 0);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 1, &hitNum) == 0);
     Require(hitNum == 0);
     Require(std::memcmp(info, untouchedInfo, sizeof(info)) == 0);
-    Require(sceAppContentGetAddcontInfoList(0, info, 1, nullptr) == ErrorParameter);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 1, nullptr) == ErrorParameter);
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, nullptr) == ErrorParameter);
-    Require(sceAppContentGetAddcontInfoList(0, info, 0, nullptr) == ErrorParameter);
+    Require(sceAppContentGetAddcontInfoList(0, reinterpret_cast<AppContentAddcontInfo*>(info), 0, nullptr) == ErrorParameter);
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 1, nullptr) == ErrorParameter);
     std::filesystem::current_path(original);
     std::filesystem::remove_all(directory);
diff --git a/core/libs/tests/GuestAppInfo.cpp b/core/libs/tests/GuestAppInfo.cpp
index 860ff13718..e1220222b5 100644
--- a/core/libs/tests/GuestAppInfo.cpp
+++ b/core/libs/tests/GuestAppInfo.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -8,16 +10,6 @@
 #include <string>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceKernelGetAppInfo(int pid, void* info);
-int APS5_VABI getpid_nid_postfix(void);
-int APS5_VABI sceKernelUuidCreate(std::uint32_t* uuid);
-int APS5_VABI sceKernelCreateUuidV4(std::uint8_t* uuid);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct AppInfo {
diff --git a/core/libs/tests/GuestAppendStreams.cpp b/core/libs/tests/GuestAppendStreams.cpp
index 2fb3939330..ee44d84e7f 100644
--- a/core/libs/tests/GuestAppendStreams.cpp
+++ b/core/libs/tests/GuestAppendStreams.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -13,21 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI flock_nid_postfix(int, int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "append stream check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestAppendWrites.cpp b/core/libs/tests/GuestAppendWrites.cpp
index 0780e303eb..806611cae1 100644
--- a/core/libs/tests/GuestAppendWrites.cpp
+++ b/core/libs/tests/GuestAppendWrites.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -12,21 +14,6 @@
 #include <utility>
 #include <vector>
 
-struct GuestIovec {
-    const void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-int APS5_VABI dup_nid_postfix(int);
-}
-
 static void Check(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "append check failed at line %d\n", line);
@@ -40,7 +27,7 @@ static constexpr int CreateWriteAppend = 0x0209;
 static constexpr int Truncate = 0x0400;
 static constexpr int FromStart = 0;
 static constexpr int FromCurrent = 1;
-static constexpr int Writers = 4;
+static constexpr int Writers = 5;
 static constexpr int LinesPerWriter = 1500;
 static constexpr std::size_t LineLength = 32;
 
@@ -52,15 +39,18 @@ static std::string Line(int writer, int index) {
 
 static void WriteLines(int fd, int writer) {
     for (int index = 0; index < LinesPerWriter; ++index) {
-        const std::string line = Line(writer, index);
+        std::string line = Line(writer, index);
         std::int64_t written = -1;
         if (writer == 0 || writer == 2) {
             written = sceKernelWrite(fd, line.data(), line.size());
         } else if (writer == 1) {
             written = write_nid_postfix(fd, line.data(), static_cast<std::int64_t>(line.size()));
-        } else {
-            const GuestIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
+        } else if (writer == 3) {
+            const KernelIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
             written = writev_nid_postfix(fd, parts, 2);
+        } else {
+            const KernelIovec parts[2]{{line.data(), 7}, {line.data() + 7, line.size() - 7}};
+            written = pwritev_nid_postfix(fd, parts, 2, 0);
         }
         Require(written == static_cast<std::int64_t>(LineLength));
     }
@@ -77,9 +67,10 @@ int main() {
     const int second = sceKernelOpen(Path, CreateWriteAppend, 0644);
     const int duplicate = dup_nid_postfix(first);
     const int vectored = sceKernelOpen(Path, CreateWriteAppend, 0644);
-    Require(second >= 0 && duplicate >= 0 && vectored >= 0);
+    const int positionedVector = sceKernelOpen(Path, CreateWriteAppend, 0644);
+    Require(second >= 0 && duplicate >= 0 && vectored >= 0 && positionedVector >= 0);
 
-    const int descriptors[Writers]{first, second, duplicate, vectored};
+    const int descriptors[Writers]{first, second, duplicate, vectored, positionedVector};
     std::vector<std::thread> threads;
     for (int writer = 0; writer < Writers; ++writer) threads.emplace_back(WriteLines, descriptors[writer], writer);
     for (auto& thread : threads) thread.join();
@@ -88,7 +79,7 @@ int main() {
     Require(contents.size() == static_cast<std::size_t>(Writers) * LinesPerWriter * LineLength);
     std::set<std::pair<int, int>> seen;
     for (std::size_t offset = 0; offset < contents.size(); offset += LineLength) {
-        const std::string line = contents.substr(offset, LineLength);
+        std::string line = contents.substr(offset, LineLength);
         int writer = -1;
         int index = -1;
         Require(std::sscanf(line.c_str(), "w%d %d ", &writer, &index) == 2);
@@ -105,6 +96,20 @@ int main() {
     Require(sceKernelLseek(first, 0, FromCurrent) == size + static_cast<std::int64_t>(LineLength));
     Require(Contents().substr(static_cast<std::size_t>(size)) == tail);
 
+    const std::string head = Contents().substr(0, LineLength);
+    const std::string positioned = Line(9, 1);
+    Require(sceKernelLseek(first, 0, FromStart) == 0);
+    Require(sceKernelPwrite(first, positioned.data(), positioned.size(), 0) == static_cast<std::int64_t>(LineLength));
+    Require(sceKernelLseek(first, 0, FromCurrent) == 0);
+    std::string gathered = Line(9, 2);
+    const KernelIovec pieces[2]{{gathered.data(), 7}, {gathered.data() + 7, gathered.size() - 7}};
+    Require(pwritev_nid_postfix(first, pieces, 2, static_cast<std::int64_t>(LineLength)) == static_cast<std::int64_t>(LineLength));
+    Require(sceKernelLseek(first, 0, FromCurrent) == 0);
+    const std::string appended = Contents();
+    Require(appended.size() == static_cast<std::size_t>(size) + 3 * LineLength);
+    Require(appended.substr(0, LineLength) == head);
+    Require(appended.substr(static_cast<std::size_t>(size) + LineLength) == positioned + gathered);
+
     for (const int fd : descriptors) Require(sceKernelClose(fd) == 0);
     std::remove(Path);
 }
diff --git a/core/libs/tests/GuestAprRead.cpp b/core/libs/tests/GuestAprRead.cpp
index a8ba636dc3..004346dbcd 100644
--- a/core/libs/tests/GuestAprRead.cpp
+++ b/core/libs/tests/GuestAprRead.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Apr/include/AprCommandBuffer.hpp"
 #include <algorithm>
@@ -14,18 +16,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelAprResolveFilepathsToIds(const char**, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceKernelAprSubmitCommandBuffer(const Apr::CommandBufferObject*, std::uint32_t);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(void*);
-}
-
 namespace {
 
 constexpr std::size_t FileBytes = (16u << 20u) + 257u;
@@ -81,13 +71,15 @@ public:
         Require(sceKernelAllocateDirectMemory(0, 13824ll << 20, MappingBytes, 0x4000, 0, &physical) == 0, "cannot allocate direct memory");
         if (sceKernelMapDirectMemory(&pointer, MappingBytes, 0x33, 0, physical, 0x4000) != 0) {
             sceKernelReleaseDirectMemory(physical, MappingBytes);
+
             throw std::runtime_error("cannot map direct memory");
         }
     }
 
     ~DirectBuffer() {
-        sceKernelMunmap(pointer, MappingBytes);
+        sceKernelMunmap(reinterpret_cast<std::uint64_t>(pointer), MappingBytes);
         sceKernelReleaseDirectMemory(physical, MappingBytes);
+
     }
 
     std::uint8_t* Data() const { return static_cast<std::uint8_t*>(pointer); }
@@ -161,9 +153,9 @@ void TestErrors(const Fixture& fixture) {
 
 void TestStreams(const Fixture& fixture) {
     constexpr int StreamCount = 600;
-    std::vector<void*> streams;
+    std::vector<FileStream*> streams;
     for (int index = 0; index < StreamCount; ++index) {
-        void* stream = fopen_nid_postfix(("apr_stream_" + std::to_string(index) + ".tmp").c_str(), "w");
+        FileStream* stream = fopen_nid_postfix(("apr_stream_" + std::to_string(index) + ".tmp").c_str(), "w");
         if (stream == nullptr) break;
         streams.push_back(stream);
     }
@@ -175,7 +167,7 @@ void TestStreams(const Fixture& fixture) {
     } catch (const std::runtime_error& failure) {
         error = failure.what();
     }
-    for (void* stream : streams) fclose_nid_postfix(stream);
+    for (FileStream* stream : streams) fclose_nid_postfix(stream);
     for (int index = 0; index < StreamCount; ++index) std::filesystem::remove("apr_stream_" + std::to_string(index) + ".tmp");
     Require(error.empty(), ("APR read failed while " + std::to_string(streams.size()) + " guest streams were open: " + error).c_str());
     Require(held, "cannot hold 600 guest fopen streams");
diff --git a/core/libs/tests/GuestArrayCallbacks.cpp b/core/libs/tests/GuestArrayCallbacks.cpp
index 92bfdfdef7..cdb9079455 100644
--- a/core/libs/tests/GuestArrayCallbacks.cpp
+++ b/core/libs/tests/GuestArrayCallbacks.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -11,19 +12,6 @@ using AllocateCallback = void* (APS5_VABI *)(std::size_t);
 using FreeCallback = void (APS5_VABI *)(void*);
 using SizedFreeCallback = void (APS5_VABI *)(void*, std::size_t);
 
-extern "C" {
-void APS5_VABI __cxa_vec_ctor_nid_postfix(void*, std::size_t, std::size_t, ElementCallback, ElementCallback);
-void APS5_VABI __cxa_vec_cctor_nid_postfix(void*, void*, std::size_t, std::size_t, CopyCallback, ElementCallback);
-void APS5_VABI __cxa_vec_dtor_nid_postfix(void*, std::size_t, std::size_t, ElementCallback);
-void APS5_VABI __cxa_vec_cleanup_nid_postfix(void*, std::size_t, std::size_t, ElementCallback);
-void* APS5_VABI __cxa_vec_new_nid_postfix(std::size_t, std::size_t, std::size_t, ElementCallback, ElementCallback);
-void* APS5_VABI __cxa_vec_new2_nid_postfix(std::size_t, std::size_t, std::size_t, ElementCallback, ElementCallback, AllocateCallback, FreeCallback);
-void* APS5_VABI __cxa_vec_new3_nid_postfix(std::size_t, std::size_t, std::size_t, ElementCallback, ElementCallback, AllocateCallback, SizedFreeCallback);
-void APS5_VABI __cxa_vec_delete_nid_postfix(void*, std::size_t, std::size_t, ElementCallback);
-void APS5_VABI __cxa_vec_delete2_nid_postfix(void*, std::size_t, std::size_t, ElementCallback, FreeCallback);
-void APS5_VABI __cxa_vec_delete3_nid_postfix(void*, std::size_t, std::size_t, ElementCallback, SizedFreeCallback);
-}
-
 namespace {
 
 constexpr std::size_t Count = 4;
@@ -104,18 +92,23 @@ void checkCookie(const void* array) {
 void checkElements() {
     reset(source.data());
     __cxa_vec_ctor_nid_postfix(source.data(), Count, ElementBytes, construct, destroy);
+
     require(constructed == Count, "constructor count is wrong");
     __cxa_vec_dtor_nid_postfix(source.data(), Count, ElementBytes, destroy);
+
     require(destroyed == Count, "destructor count is wrong");
     reset(storage.data());
     __cxa_vec_cctor_nid_postfix(storage.data(), source.data(), Count, ElementBytes, copy, destroy);
+
     require(copied == Count && std::memcmp(storage.data(), source.data(), source.size()) == 0, "copy construction failed");
     __cxa_vec_cleanup_nid_postfix(storage.data(), Count, ElementBytes, destroy);
+
     require(destroyed == Count, "cleanup count is wrong");
     __cxa_vec_ctor_nid_postfix(nullptr, Count, ElementBytes, nullptr, nullptr);
     __cxa_vec_cctor_nid_postfix(nullptr, nullptr, Count, ElementBytes, nullptr, nullptr);
     __cxa_vec_dtor_nid_postfix(nullptr, Count, ElementBytes, nullptr);
     __cxa_vec_cleanup_nid_postfix(nullptr, Count, ElementBytes, nullptr);
+
 }
 
 void checkAllocation(bool sized) {
@@ -123,6 +116,7 @@ void checkAllocation(bool sized) {
     void* array = sized
         ? __cxa_vec_new3_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, releaseSized)
         : __cxa_vec_new2_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, release);
+
     require(array == destination && constructed == Count && allocated == 1, "array allocation failed");
     checkCookie(array);
     if (sized) __cxa_vec_delete3_nid_postfix(array, ElementBytes, Padding, destroy, releaseSized);
@@ -133,6 +127,7 @@ void checkAllocation(bool sized) {
     array = sized
         ? __cxa_vec_new3_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, releaseSized)
         : __cxa_vec_new2_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, release);
+
     require(array == nullptr && allocated == 1 && constructed == 0 && freed == 0, "failed allocation invoked element callbacks");
     if (sized) __cxa_vec_delete3_nid_postfix(nullptr, ElementBytes, Padding, destroy, releaseSized);
     else __cxa_vec_delete2_nid_postfix(nullptr, ElementBytes, Padding, destroy, release);
@@ -146,8 +141,10 @@ void checkDefaultAllocation() {
     reset(static_cast<std::byte*>(array));
     __cxa_vec_ctor_nid_postfix(array, Count, ElementBytes, construct, destroy);
     __cxa_vec_delete_nid_postfix(array, ElementBytes, Padding, destroy);
+
     require(constructed == Count && destroyed == Count, "default array deletion failed");
     __cxa_vec_delete_nid_postfix(nullptr, ElementBytes, Padding, destroy);
+
 }
 
 template<typename TAction>
@@ -170,6 +167,7 @@ void checkRollback(bool sized) {
     void* array = sized
         ? __cxa_vec_new3_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, releaseSized)
         : __cxa_vec_new2_nid_postfix(Count, ElementBytes, Padding, construct, destroy, allocate, release);
+
     failDestroy = true;
     expectException([&] {
         if (sized) __cxa_vec_delete3_nid_postfix(array, ElementBytes, Padding, destroy, releaseSized);
@@ -183,6 +181,7 @@ void checkCopyRollback() {
     failCopy = true;
     expectException([] {
         __cxa_vec_cctor_nid_postfix(storage.data(), source.data(), Count, ElementBytes, copy, destroy);
+
     });
     require(copied == 2 && destroyed == 2, "copy constructor rollback failed");
 }
diff --git a/core/libs/tests/GuestAt9Enc.cpp b/core/libs/tests/GuestAt9Enc.cpp
index 2da60d41b3..470baa0b57 100644
--- a/core/libs/tests/GuestAt9Enc.cpp
+++ b/core/libs/tests/GuestAt9Enc.cpp
@@ -1,16 +1,9 @@
+#include "prx/libSceAt9Enc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int32_t APS5_VABI sceAt9EncClearContext(void* pAt9EncWorkArea, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncCreateEncoder(void* pAt9EncWorkArea, void* pAt9EncParam, int32_t memSize, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncEncode(void* pAt9EncWorkArea, const void* pInputBuf, void* pOutputBuf, uint32_t inputBufSize, uint32_t outputBufSize, uint32_t* pOutputDataByte, uint32_t* pUsedBufSize, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncFlush(void* pAt9EncWorkArea, void* pOutputBuf, uint32_t outputBufSize, uint32_t* pOutputDataByte, int32_t* pInternalResult);
-int32_t APS5_VABI sceAt9EncQueryMemSize(void* pAt9EncParam, int32_t* pMemSize, int32_t* pInternalResult);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestAtoi.cpp b/core/libs/tests/GuestAtoi.cpp
index 31d63e6ccd..0d7be20f60 100644
--- a/core/libs/tests/GuestAtoi.cpp
+++ b/core/libs/tests/GuestAtoi.cpp
@@ -1,12 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 
-extern "C" {
-int APS5_VABI atoi_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 int main() {
     struct Case {
         const char* text;
diff --git a/core/libs/tests/GuestAtomicBuiltins.cpp b/core/libs/tests/GuestAtomicBuiltins.cpp
index 43d9a0f010..7ac75e5ea4 100644
--- a/core/libs/tests/GuestAtomicBuiltins.cpp
+++ b/core/libs/tests/GuestAtomicBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,22 +6,6 @@
 #include <stdexcept>
 #include <thread>
 
-using Uint128 = unsigned __int128;
-
-extern "C" {
-void APS5_VABI __atomic_load_nid_postfix(std::size_t, void*, void*, int);
-void APS5_VABI __atomic_store_nid_postfix(std::size_t, void*, void*, int);
-void APS5_VABI __atomic_exchange_nid_postfix(std::size_t, void*, void*, void*, int);
-bool APS5_VABI __atomic_compare_exchange_nid_postfix(std::size_t, void*, void*, void*, int, int);
-bool APS5_VABI __atomic_is_lock_free_nid_postfix(std::size_t, const void*);
-Uint128 APS5_VABI __sync_fetch_and_add_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_sub_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_and_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_or_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_fetch_and_xor_16_nid_postfix(Uint128*, Uint128);
-Uint128 APS5_VABI __sync_lock_test_and_set_16_nid_postfix(Uint128*, Uint128);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestAudio3dParameters.cpp b/core/libs/tests/GuestAudio3dParameters.cpp
index 4335f1ff0f..8382df155a 100644
--- a/core/libs/tests/GuestAudio3dParameters.cpp
+++ b/core/libs/tests/GuestAudio3dParameters.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
@@ -5,8 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" void APS5_VABI sceAudio3dGetDefaultOpenParameters(Audio3dOpenParameters* parameters);
-
 static_assert(sizeof(Audio3dOpenParameters) == 0x28);
 static_assert(offsetof(Audio3dOpenParameters, num_beds) == 0x20);
 
@@ -74,4 +73,5 @@ int main() {
     CheckInvalidDestination();
     CheckShortBuffer();
     CheckExtendedBuffer();
+    Require(sceAudio3dInitialize(-1) == static_cast<int>(0x80EA0004), "non-zero reserved parameter rejected in sceAudio3dInitialize");
 }
diff --git a/core/libs/tests/GuestAudio3dPort.cpp b/core/libs/tests/GuestAudio3dPort.cpp
index 7adbb92ede..5833c4a051 100644
--- a/core/libs/tests/GuestAudio3dPort.cpp
+++ b/core/libs/tests/GuestAudio3dPort.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <chrono>
@@ -9,29 +10,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-void APS5_VABI sceAudio3dGetDefaultOpenParameters(Audio3dOpenParameters* parameters);
-int APS5_VABI sceAudio3dInitialize(std::int64_t reserved);
-int APS5_VABI sceAudio3dTerminate();
-int APS5_VABI sceAudio3dPortOpen(int user_id, const Audio3dOpenParameters* parameters, std::uint32_t* id);
-int APS5_VABI sceAudio3dPortClose(std::uint32_t port_id);
-int APS5_VABI sceAudio3dPortSetAttribute(std::uint32_t port_id, std::uint32_t attribute_id, const void* attribute, std::size_t attribute_size);
-int APS5_VABI sceAudio3dPortGetAttributesSupported(std::uint32_t port_id, std::uint32_t* attributes, std::uint32_t* num_attributes);
-int APS5_VABI sceAudio3dPortGetQueueLevel(std::uint32_t port_id, std::uint32_t* queue_level, std::uint32_t* queue_available);
-int APS5_VABI sceAudio3dPortAdvance(std::uint32_t port_id);
-int APS5_VABI sceAudio3dPortPush(std::uint32_t port_id, std::uint32_t blocking);
-int APS5_VABI sceAudio3dPortFlush(std::uint32_t port_id);
-int APS5_VABI sceAudio3dObjectReserve(std::uint32_t port_id, std::uint32_t* object_id);
-int APS5_VABI sceAudio3dObjectUnreserve(std::uint32_t port_id, std::uint32_t object_id);
-int APS5_VABI sceAudio3dObjectSetAttributes(std::uint32_t port_id, std::uint32_t object_id, std::uint64_t num_attributes, const Audio3dAttribute* attribute_array);
-int APS5_VABI sceAudio3dBedWrite(std::uint32_t port_id, std::uint32_t num_channels, std::uint32_t format, const void* buffer, std::uint32_t num_samples);
-int APS5_VABI sceAudio3dBedWrite2(std::uint32_t port_id, std::uint32_t num_channels, std::uint32_t format, const void* buffer, std::uint32_t num_samples, std::uint32_t output_route, bool restricted);
-int APS5_VABI sceAudio3dAudioOutOpen(std::uint32_t port_id, int user_id, std::int32_t type, std::int32_t index, std::uint32_t len, std::uint32_t freq, std::uint32_t param);
-int APS5_VABI sceAudio3dAudioOutClose(std::int32_t handle);
-int APS5_VABI sceAudio3dAudioOutOutput(std::int32_t handle, const void* ptr);
-int APS5_VABI sceAudio3dAudioOutOutputs(AudioOutOutputParam* param, std::uint32_t num);
-}
-
 namespace {
 
 constexpr int INVALID_PORT = static_cast<int>(0x80EA0002);
diff --git a/core/libs/tests/GuestAudio3dSpeakerArray.cpp b/core/libs/tests/GuestAudio3dSpeakerArray.cpp
new file mode 100644
index 0000000000..4a70481074
--- /dev/null
+++ b/core/libs/tests/GuestAudio3dSpeakerArray.cpp
@@ -0,0 +1,62 @@
+#include "prx/libSceAudioOut/include/AudioOut2.hpp"
+#include "prx/libSceAudio3d/include/Audio3d.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <exception>
+
+namespace {
+
+constexpr int INVALID_PARAMETER = static_cast<int>(0x80EA0004);
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+template <typename F>
+void RequireThrows(F f, const char* message) {
+    bool threw = false;
+    try {
+        f();
+    } catch (const std::exception&) {
+        threw = true;
+    }
+    Require(threw, message);
+}
+
+}
+
+int main() {
+    Require(sceAudio3dGetSpeakerArrayMemorySize(4, 1) == sceAudioOut2GetSpeakerArrayMemorySize(4, 1, 0), "memory size forwards to AudioOut2 without ambisonics");
+    RequireThrows([] { sceAudio3dGetSpeakerArrayMemorySize(0, 0); }, "zero speakers throws invalid_argument");
+
+    const AudioOut2Position positions[4] = {{1, 1, 0}, {1, -1, 0}, {-1, 1, 0}, {-1, -1, 0}};
+    alignas(16) unsigned char memory[1024] = {};
+    const std::size_t size = sceAudio3dGetSpeakerArrayMemorySize(4, 0);
+    Require(size <= sizeof(memory), "speaker array fits the test buffer");
+    const Audio3dSpeakerArrayParameters parameters{positions, 4, 0, memory, size};
+
+    AudioOut2SpeakerArrayHandle handle = nullptr;
+    Require(sceAudio3dCreateSpeakerArray(nullptr, &parameters) == INVALID_PARAMETER, "null handle is an invalid parameter");
+    Require(sceAudio3dCreateSpeakerArray(&handle, nullptr) == INVALID_PARAMETER, "null parameters are an invalid parameter");
+    Require(handle == nullptr, "a rejected create leaves the handle");
+    Require(sceAudio3dCreateSpeakerArray(&handle, &parameters) == 0, "create succeeds without ambisonics parameters");
+    Require(handle != nullptr, "create stores the handle");
+
+    float coefficients[4] = {-1, -1, -1, -1};
+    Require(sceAudio3dGetSpeakerArrayMixCoefficients(handle, AudioOut2Position{1, 0, 0}, 0.0f, coefficients, 4) == 0, "mix coefficients succeed");
+    Require(coefficients[2] == 0.0f && coefficients[3] == 0.0f, "mix coefficients are written");
+    float coefficients2[4] = {-1, -1, -1, -1};
+    Require(sceAudio3dGetSpeakerArrayMixCoefficients2(handle, AudioOut2Position{1, 0, 0}, 0.0f, coefficients2, 4, 1, 0.5f) == 0, "mix coefficients 2 succeed");
+    Require(coefficients2[3] == 0.0f, "mix coefficients 2 are written");
+    RequireThrows([&] { sceAudio3dGetSpeakerArrayMixCoefficients(handle, AudioOut2Position{1, 0, 0}, 0.0f, coefficients, 3); }, "a coefficient count that differs from the array is rejected");
+    RequireThrows([&] { sceAudio3dGetSpeakerArrayMixCoefficients(handle, AudioOut2Position{1, 0, 0}, 0.0f, nullptr, 4); }, "null coefficients pointer throws invalid_argument");
+
+    Require(sceAudio3dDeleteSpeakerArray(handle) == 0, "delete succeeds");
+    RequireThrows([&] { sceAudio3dDeleteSpeakerArray(handle); }, "a deleted array is no longer valid");
+    return 0;
+}
diff --git a/core/libs/tests/GuestAudioIn.cpp b/core/libs/tests/GuestAudioIn.cpp
index 05b2eac559..f968624ea3 100644
--- a/core/libs/tests/GuestAudioIn.cpp
+++ b/core/libs/tests/GuestAudioIn.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioIn/include/AudioIn.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <chrono>
@@ -11,19 +12,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceAudioInInit();
-int APS5_VABI sceAudioInOpen(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInHqOpen(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAudioInAsyncOpen(int, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t);
-int32_t APS5_VABI sceAudioInIsPadEmbeddedMic(int32_t);
-int32_t APS5_VABI sceAudioInGetGain(int32_t, float*);
-int32_t APS5_VABI sceAudioInGetRerouteCount(int32_t);
-int APS5_VABI sceAudioInInput(int, void*);
-int APS5_VABI sceAudioInGetSilentState(int);
-int APS5_VABI sceAudioInClose(int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
@@ -48,6 +36,21 @@ namespace {
 
 constexpr int user = 0x10000000;
 
+void TestOpenEx() {
+    constexpr int invalidSize = static_cast<int>(0x80260102);
+    constexpr int invalidFreq = static_cast<int>(0x80260103);
+    constexpr int invalidType = static_cast<int>(0x80260104);
+    Require(sceAudioInOpenEx(user, 2, 0, 7, 256, 48000, 2) == invalidType);
+    Require(sceAudioInOpenEx(user, 0, 0, 7, 512, 48000, 2) == invalidSize);
+    Require(sceAudioInOpenEx(user, 0, 0, 7, 256, 44100, 2) == invalidFreq);
+    Require(sceAudioInHqOpenEx(user, 0, 0, 7, 128, 44100, 2) == invalidFreq);
+    int port = sceAudioInOpenEx(user, 0, 0, 7, 256, 48000, 2);
+    Require(port > 0 && sceAudioInClose(port) == 0);
+    port = sceAudioInHqOpenEx(user, 0, 0, 7, 256, 16000, 2);
+    Require(port > 0 && sceAudioInClose(port) == 0);
+    Require(sceAudioInSetCompressorPreGain() == 0 && sceAudioInSetNoiseGateThreshold() == 0);
+}
+
 void TestValidation() {
     constexpr int invalidHandle = static_cast<int>(0x80260101);
     constexpr int invalidSize = static_cast<int>(0x80260102);
@@ -99,7 +102,10 @@ void TestValidation() {
     port = sceAudioInAsyncOpen(user, 0, 0, 128, 48000, 0x10);
     gain = 0.5f;
     Require(port > 0 && sceAudioInGetGain(port, &gain) == 0 && gain == 1.0f && sceAudioInGetRerouteCount(port) == 0 && sceAudioInClose(port) == 0);
-    Require(ReportsNotImplemented("sceAudioInIsPadEmbeddedMic", [] { sceAudioInIsPadEmbeddedMic(1); }));
+    Require(sceAudioInIsPadEmbeddedMic(1) == static_cast<int32_t>(0x80260101));
+    const int mic = sceAudioInOpen(user, 0, 0, 256, 48000, 0x10);
+    Require(mic > 0 && sceAudioInIsPadEmbeddedMic(mic) == 0 && sceAudioInClose(mic) == 0);
+    Require(sceAudioInIsPadEmbeddedMic(mic) == static_cast<int32_t>(0x80260101));
 }
 
 void InputSound(int handle, std::vector<std::int16_t>& block, int samples = 256) {
@@ -119,6 +125,7 @@ void TestCapture() {
     SetEnvironment("SDL_DISKAUDIOFILEIN", path.string());
 
     TestValidation();
+    TestOpenEx();
     const int handle = sceAudioInOpen(user, 0, 0, 256, 48000, 2);
     Require(handle > 0 && sceAudioInGetSilentState(handle) == 0);
     std::vector<std::int16_t> block(256 * 2 + 1, 0x5555);
@@ -147,6 +154,7 @@ void TestNoDevice() {
     SetEnvironment("SDL_AUDIODRIVER", "none");
 
     TestValidation();
+    TestOpenEx();
     const int handle = sceAudioInOpen(user, 0, 0, 256, 16000, 0x12);
     Require(handle > 0 && sceAudioInGetSilentState(handle) == 1);
     Require(sceAudioInGetSilentState(handle + 1) == invalidHandle);
diff --git a/core/libs/tests/GuestAudioPropagation.cpp b/core/libs/tests/GuestAudioPropagation.cpp
index 0f060fd0a5..b1435209ae 100644
--- a/core/libs/tests/GuestAudioPropagation.cpp
+++ b/core/libs/tests/GuestAudioPropagation.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudioPropagation/include/Api.hpp"
 #include "prx/libSceAudioPropagation/AudioPropagation.hpp"
 
 #include <cstdint>
@@ -5,13 +6,14 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <limits>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceAudioPropagationPathGetNumPoints();
-int APS5_VABI sceAudioPropagationSystemLock();
-int APS5_VABI sceAudioPropagationMaterialInit();
-}
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
 
 namespace {
 
@@ -34,6 +36,16 @@ void RequireThrows(TCall call, const char* message) {
     Require(false, message);
 }
 
+void* Resolve(const char* name) {
+#ifdef _WIN32
+    const HMODULE module = GetModuleHandleA("libSceAudioPropagation.prx");
+    Require(module != nullptr, "library module");
+    return reinterpret_cast<void*>(GetProcAddress(module, name));
+#else
+    return dlsym(RTLD_DEFAULT, name);
+#endif
+}
+
 AudioPropagationSystemMemory Memory() {
     AudioPropagationSystemMemory memory{};
     memory.desc = {AudioPropagation::SystemMemoryId, AudioPropagation::SystemMemorySize};
@@ -152,13 +164,54 @@ int main() {
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceCreate(system, nullptr); }, "source without output");
     Require(sceAudioPropagationSourceSetAttributes(source, portalAttributes, 3) == 0, "source attributes failed");
     std::uint32_t count = 7;
-    Require(sceAudioPropagationSourceGetAudioPathCount(source, &count) == 0 && count == 0, "source reports audio paths");
+    Require(sceAudioPropagationSourceGetAudioPathCount(source, &count) == 0 && count == AudioPropagation::MaxPaths, "source path pool size");
     AudioPropagationHandle path = 0;
-    path = 0x1234;
-    Require(sceAudioPropagationSourceGetAudioPath(source, 0, &path) == AudioPropagation::ErrorInvalidArgument && path == 0x1234, "audio path without paths");
-    Require(sceAudioPropagationSourceGetAudioPath(source, UINT32_MAX, &path) == AudioPropagation::ErrorInvalidArgument && path == 0x1234, "audio path index range");
-    Require(sceAudioPropagationSourceGetAudioPath(source, 0, nullptr) == AudioPropagation::ErrorNullPointer, "audio path null output");
-    Require(sceAudioPropagationSourceGetAudioPath(0, 0, nullptr) == AudioPropagation::ErrorInvalidHandle, "audio path handle precedence");
+    Require(sceAudioPropagationSourceGetAudioPath(source, 0, &path) == 0 && path != 0, "path lookup immediately after source creation");
+    AudioPropagationHandle repeated = 0;
+    Require(sceAudioPropagationSourceGetAudioPath(source, 0, &repeated) == 0 && repeated == path, "path handle is unstable");
+    AudioPropagationHandle lastPath = 0;
+    Require(sceAudioPropagationSourceGetAudioPath(source, AudioPropagation::MaxPaths - 1, &lastPath) == 0 && lastPath != path, "last path slot");
+    Require(sceAudioPropagationSourceGetAudioPath(source, AudioPropagation::MaxPaths, &repeated) == AudioPropagation::ErrorInvalidArgument, "out of range path slot");
+    Require(repeated == path, "rejected path lookup changed the output");
+    Require(sceAudioPropagationSourceGetAudioPath(source, 0, nullptr) == AudioPropagation::ErrorNullPointer, "null path output");
+    Require(sceAudioPropagationSourceGetAudioPath(0, 0, nullptr) == AudioPropagation::ErrorInvalidHandle, "path lookup handle precedence");
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 0, "initial path has points");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(source, &count); }, "source used as a path");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(path, nullptr); }, "null point-count output");
+    AudioPropagation::AudioPath configured{};
+    configured.desc = {AudioPropagation::PathId, sizeof(configured)};
+    configured.pointCount = 2;
+    configured.flags = AudioPropagation::PathInvalid;
+    for (auto& point : configured.points) {
+        point.desc = {AudioPropagation::PathPointId, sizeof(point)};
+        point.gain = 1.0f;
+    }
+    configured.points[0].room = rooms[0];
+    configured.points[0].opaque[0] = std::byte{0x7f};
+    configured.opaque[0] = std::byte{0x55};
+    configured.points[0].position[0] = 3.0f;
+    Require(sceAudioPropagationSourceSetAudioPath(path, &configured, 1.0f) == 0, "path configuration");
+    configured.pointCount = 0;
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 2, "path configuration aliases caller memory");
+    configured.pointCount = 2;
+    auto badPath = configured;
+    badPath.desc.size--;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "wrong path size");
+    badPath = configured;
+    badPath.pointCount = AudioPropagation::MaxPathPoints + 1;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "too many path points");
+    badPath = configured;
+    AudioPropagationHandle pathMaterial = 0;
+    Require(sceAudioPropagationSystemRegisterMaterial(system, material, &pathMaterial) == 0, "path material creation");
+    badPath.points[0].room = pathMaterial;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "material used as a path room");
+    Require(sceAudioPropagationSystemUnregisterMaterial(pathMaterial) == 0, "path material cleanup");
+    badPath = configured;
+    badPath.points[0].position[0] = std::numeric_limits<float>::infinity();
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "nonfinite point position");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &configured, std::numeric_limits<float>::quiet_NaN()); }, "nonfinite path gain");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, nullptr, 1.0f); }, "null path data");
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 2, "rejected update changed path state");
 
     std::uint8_t rays[AudioPropagation::RaySize * 2]{};
     count = 7;
@@ -186,6 +239,13 @@ int main() {
     Require(sceAudioPropagationSystemCreate(&options, &otherMemory, &otherSystem) == 0, "second system create failed");
     AudioPropagationHandle otherSource = 0;
     Require(sceAudioPropagationSourceCreate(otherSystem, &otherSource) == 0, "second system source create failed");
+    AudioPropagationHandle foreignRoom = 0;
+    Require(sceAudioPropagationRoomCreate(otherSystem, &foreignRoom) == 0, "foreign room create failed");
+    badPath = configured;
+    badPath.points[0].room = foreignRoom;
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(path, &badPath, 1.0f); }, "room from another system");
+    Require(sceAudioPropagationRoomDestroy(otherSystem, foreignRoom) == 0, "foreign room cleanup");
+    Require(sceAudioPropagationPathGetNumPoints(path, &count) == 0 && count == 2, "cross-system rejection changed path state");
     AudioPropagationHandle secondSource = 0;
     Require(sceAudioPropagationSourceCreate(system, &secondSource) == 0, "second source create failed");
 
@@ -260,10 +320,36 @@ int main() {
     reset();
     infos[0].outputSize = 0;
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceRender(system, infos, 1); }, "render with an empty output");
+    for (const std::uint32_t format : {0u, 1u, 2u, 4u, 5u}) {
+        reset();
+        infos[0].format = format;
+        const std::size_t channels = format == 0 ? 4 : format == 1 ? 9 : format == 2 ? 16 : 8;
+        infos[0].outputSize = sizeof(float) * options.frameSamples * channels;
+        Require(sceAudioPropagationSourceRender(system, infos, 1) == 0, "render in a known format failed");
+        Require(untouched(), "empty source modified a mix in a known format");
+        infos[0].outputSize -= sizeof(float) * channels;
+        RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceRender(system, infos, 1); }, "known format accepted an undersized frame");
+        Require(untouched(), "undersized known-format output modified a mix");
+    }
     reset();
-    infos[1].format = 1;
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSourceRender(system, infos, 2); }, "render with an unknown format");
-    Require(untouched(), "render with an unknown format wrote an output");
+    infos[0].format = 1;
+    infos[0].outputSize = sizeof(float) * (options.frameSamples * 9 + 1);
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceRender(system, infos, 1); }, "render of a partial nine-channel frame");
+    Require(untouched(), "render of a partial frame wrote an output");
+    for (const std::uint32_t format : {3u, 6u}) {
+        reset();
+        infos[1].format = format;
+        RequireThrows<std::runtime_error>([&] { sceAudioPropagationSourceRender(system, infos, 2); }, "render with an unknown format");
+        Require(untouched(), "render with an unknown format wrote an output");
+    }
+
+    reset();
+    configured.flags = 0;
+    Require(sceAudioPropagationSourceSetAudioPath(path, &configured, 1.0f) == 0, "active path configuration");
+    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSourceRender(system, infos, 2); }, "active path silently rendered");
+    Require(untouched(), "unsupported active-path render modified output");
+    configured.flags = AudioPropagation::PathInvalid;
+    Require(sceAudioPropagationSourceSetAudioPath(path, &configured, 1.0f) == 0, "invalidating path");
 
     Require(sceAudioPropagationSourceDestroy(system, secondSource) == 0, "second source destroy failed");
     reset();
@@ -274,13 +360,18 @@ int main() {
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceDestroy(system + 16, source); }, "source destroy with another system");
     Require(sceAudioPropagationPortalDestroy(system, portal) == 0, "portal destroy failed");
     Require(sceAudioPropagationSourceDestroy(system, source) == 0, "source destroy failed");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(path, &count); }, "path survived source destruction");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAudioPath(lastPath, &configured, 1.0f); }, "path update after source destruction");
     Require(sceAudioPropagationRoomDestroy(system, rooms[0]) == 0, "room destroy failed");
 
     AudioPropagationHandle lateSource = 0;
     AudioPropagationHandle lateMaterial = 0;
     Require(sceAudioPropagationSourceCreate(system, &lateSource) == 0, "late source create failed");
+    AudioPropagationHandle latePath = 0;
+    Require(sceAudioPropagationSourceGetAudioPath(lateSource, 0, &latePath) == 0 && latePath != path, "path handle reuse");
     Require(sceAudioPropagationSystemRegisterMaterial(system, material, &lateMaterial) == 0, "late material register failed");
     Require(sceAudioPropagationSystemDestroy(system) == 0, "system destroy failed");
+    RequireThrows<std::invalid_argument>([&] { sceAudioPropagationPathGetNumPoints(latePath, &count); }, "path survived system destruction");
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceSetAttributes(lateSource, &attribute, 1); }, "source used after its system");
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationRoomDestroy(system, lateSource); }, "orphan destroyed as the wrong kind");
     RequireThrows<std::invalid_argument>([&] { sceAudioPropagationSourceDestroy(system + 16, lateSource); }, "orphan destroyed with another system");
@@ -292,9 +383,12 @@ int main() {
     Require(sceAudioPropagationSystemCreate(&options, &memory, &system) == 0, "memory reuse after destroy failed");
     Require(sceAudioPropagationSystemDestroy(system) == 0, "second destroy failed");
 
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationPathGetNumPoints(); }, "path get num points throw");
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSystemLock(); }, "system lock throw");
-    RequireThrows<std::runtime_error>([&] { sceAudioPropagationMaterialInit(); }, "material init throw");
+    RequireThrows<std::runtime_error>([&] { sceAudioPropagationSystemLock(0); }, "system lock throw");
+
+    Require(Resolve("sceAudioPropagationSystemCreate") != nullptr && Resolve("sceAudioPropagationSourceSetAudioPath") != nullptr, "export lookup");
+    for (const char* name : {"sceAudioPropagationAudioPathInit", "sceAudioPropagationAudioPathPointInit", "sceAudioPropagationMaterialInit", "sceAudioPropagationPortalSettingsInit", "sceAudioPropagationRayInit", "sceAudioPropagationSourceRenderInfoInit", "sceAudioPropagationSourceSetAudioPathsParamInit", "sceAudioPropagationSystemMemoryInit", "sceAudioPropagationSystemOptionInit", "sceAudioPropagationSystem"}) {
+        Require(Resolve(name) == nullptr, name);
+    }
 
     std::puts("AudioPropagation tests passed");
     return 0;
diff --git a/core/libs/tests/GuestAudiodec.cpp b/core/libs/tests/GuestAudiodec.cpp
index 3eb7a370db..ed04f8ee5d 100644
--- a/core/libs/tests/GuestAudiodec.cpp
+++ b/core/libs/tests/GuestAudiodec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAudiodec/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cmath>
@@ -8,15 +9,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI sceAudiodecInitLibrary(std::uint32_t);
-std::int32_t APS5_VABI sceAudiodecTermLibrary(std::uint32_t);
-std::int32_t APS5_VABI sceAudiodecCreateDecoder(AudiodecCtrl*, std::uint32_t);
-std::int32_t APS5_VABI sceAudiodecDeleteDecoder(std::int32_t);
-std::int32_t APS5_VABI sceAudiodecDecode(std::int32_t, AudiodecCtrl*);
-std::int32_t APS5_VABI sceAudiodecClearContext(std::int32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 namespace {
diff --git a/core/libs/tests/GuestAvPlayer.cpp b/core/libs/tests/GuestAvPlayer.cpp
index 54220d0b27..a784e37263 100644
--- a/core/libs/tests/GuestAvPlayer.cpp
+++ b/core/libs/tests/GuestAvPlayer.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceAvPlayer/include/Api.hpp"
 #include <algorithm>
 #include <array>
 #include <chrono>
@@ -25,35 +26,6 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceAvPlayer/include/AvPlayer.hpp"
 
-extern "C" {
-AvPlayerInternal* APS5_VABI sceAvPlayerInit(AvPlayerInitData*);
-int APS5_VABI sceAvPlayerInitEx(const AvPlayerInitDataEx*, AvPlayerInternal**);
-int APS5_VABI sceAvPlayerPostInit(AvPlayerInternal*, const AvPlayerPostInitData*);
-int APS5_VABI sceAvPlayerSetLogCallback(void*, void*);
-int APS5_VABI sceAvPlayerAddSource(AvPlayerInternal*, const char*);
-int APS5_VABI sceAvPlayerStreamCount(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerGetStreamInfo(AvPlayerInternal*, std::uint32_t, AvPlayerStreamInfo*);
-int APS5_VABI sceAvPlayerGetStreamInfoEx(AvPlayerInternal*, std::uint32_t, AvPlayerStreamInfoEx*);
-int APS5_VABI sceAvPlayerEnableStream(AvPlayerInternal*, std::uint32_t);
-int APS5_VABI sceAvPlayerChangeStream(AvPlayerInternal*, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAvPlayerSetAvailableBandwidth(AvPlayerInternal*, std::uint32_t, std::uint32_t, std::uint32_t);
-int APS5_VABI sceAvPlayerStart(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerStartEx(AvPlayerInternal*, const AvPlayer::StartInfo*);
-int APS5_VABI sceAvPlayerStop(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerPause(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerResume(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerJumpToTime(AvPlayerInternal*, std::uint64_t);
-int APS5_VABI sceAvPlayerSetLooping(AvPlayerInternal*, Bool);
-int APS5_VABI sceAvPlayerSetAvSyncMode(AvPlayerInternal*, std::uint32_t);
-int APS5_VABI sceAvPlayerSetTrickSpeed(AvPlayerInternal*, std::int32_t);
-Bool APS5_VABI sceAvPlayerGetVideoDataEx(AvPlayerInternal*, AvPlayerFrameInfoEx*);
-Bool APS5_VABI sceAvPlayerGetVideoData(AvPlayerInternal*, AvPlayerFrameInfo*);
-Bool APS5_VABI sceAvPlayerGetAudioData(AvPlayerInternal*, AvPlayerFrameInfo*);
-Bool APS5_VABI sceAvPlayerIsActive(AvPlayerInternal*);
-std::uint64_t APS5_VABI sceAvPlayerCurrentTime(AvPlayerInternal*);
-int APS5_VABI sceAvPlayerClose(AvPlayerInternal*);
-}
-
 namespace {
 
 constexpr int Width = 100;
@@ -1090,6 +1062,8 @@ void TestExtendedExports() {
     Check(WaitFor([&] { return sceAvPlayerGetVideoDataEx(player, &frame) != 0; }), "no frame after extended restart");
     Check(frame.timestamp <= 67, "zero-position start did not restart playback");
     Check(sceAvPlayerClose(player) == 0, "close failed");
+    Check(sceAvPlayerAddSourceEx(nullptr, 0, nullptr) == InvalidParams, "null player add source rejected");
+    Check(sceAvPlayerDisableStream(nullptr, 0) == InvalidParams, "null player disable stream rejected");
 }
 
 void TestWithoutAllocators() {
@@ -1617,6 +1591,437 @@ void TestVideoSyncTolerance() {
     Check(allocations.blocks.empty(), "sync tolerance allocations leaked");
 }
 
+void TestAudioClockDriftGating() {
+    const auto open = [](Events& events) {
+        AvPlayerInitData init = InitData(&events);
+        auto* player = sceAvPlayerInit(&init);
+        Check(player != nullptr, "audio drift gating init failed");
+        Check(sceAvPlayerAddSource(player, "/app0/avplayer.mp4") == 0, "audio drift gating source failed");
+        Check(WaitFor([&] { return events.Seen(EventReady); }), "audio drift gating ready missing");
+        Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "audio drift gating audio failed");
+        Check(sceAvPlayerStart(player) == 0, "audio drift gating start failed");
+        Check(WaitFor([&] { return events.Seen(EventPlay); }), "audio drift gating play missing");
+        return player;
+    };
+    const auto close = [](AvPlayerInternal* player) {
+        Check(sceAvPlayerClose(player) == 0, "audio drift gating close failed");
+        std::lock_guard lock(allocations.mutex);
+        Check(allocations.blocks.empty(), "audio drift gating allocations leaked");
+    };
+    const auto take = [](AvPlayerInternal* player, AvPlayerFrameInfo& sound, const char* missing) {
+        Check(WaitFor([&] { return sceAvPlayerGetAudioData(player, &sound) != 0; }), missing);
+    };
+
+    std::uint64_t secondTs = 0;
+    std::uint64_t beyondTs = 0;
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "probe first audio frame missing");
+        Check(sound.timestamp == 0, "first audio frame timestamp unexpected");
+        take(player, sound, "probe second audio frame missing");
+        Check(sound.timestamp > 0 && sound.timestamp <= 30, "second audio frame timestamp unexpected");
+        secondTs = sound.timestamp;
+        Check(WaitFor([&] {
+            while (sceAvPlayerGetAudioData(player, &sound)) {
+                if (sound.timestamp > 50) {
+                    beyondTs = sound.timestamp;
+                    return true;
+                }
+            }
+            return false;
+        }), "probe audio beyond 50ms missing");
+        close(player);
+    }
+    Check(beyondTs > 50, "probe timestamps unsuitable for drift gating");
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "within-threshold first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, 0.0);
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        take(player, sound, "within-threshold second audio missing");
+        Check(sound.timestamp == secondTs, "within-threshold second timestamp changed");
+        Check(sceAvPlayerCurrentTime(player) == 0, "clock rebased despite audio being within drift threshold");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "clock-lead boundary first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(secondTs + 50));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        take(player, sound, "clock-lead boundary second audio missing");
+        Check(sound.timestamp == secondTs, "clock-lead boundary second timestamp changed");
+        Check(sceAvPlayerCurrentTime(player) == secondTs + 50, "exact 50ms clock-lead boundary rebased");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "audio-lead boundary first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(beyondTs - 50));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        Check(WaitFor([&] {
+            while (sceAvPlayerGetAudioData(player, &sound)) {
+                if (sound.timestamp >= beyondTs) return true;
+            }
+            return false;
+        }), "audio-lead boundary frame missing");
+        Check(sound.timestamp == beyondTs, "audio-lead boundary timestamp unexpected");
+        Check(sceAvPlayerCurrentTime(player) == beyondTs - 50, "exact 50ms audio-lead boundary rebased");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "clock-lead rebase first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(secondTs + 51));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        take(player, sound, "clock-lead rebase second audio missing");
+        Check(sound.timestamp == secondTs, "clock-lead rebase second timestamp changed");
+        Check(sceAvPlayerCurrentTime(player) == secondTs, "clock-lead beyond 50ms did not rebase");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events);
+        AvPlayerFrameInfo sound{};
+        take(player, sound, "audio-lead rebase first audio missing");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, 0.0);
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        Check(WaitFor([&] {
+            while (sceAvPlayerGetAudioData(player, &sound)) {
+                if (sound.timestamp > 50) return true;
+            }
+            return false;
+        }), "audio-lead rebase frame missing");
+        Check(sound.timestamp == beyondTs, "audio-lead rebase timestamp unexpected");
+        Check(sceAvPlayerCurrentTime(player) == beyondTs, "audio-lead beyond 50ms did not rebase");
+        close(player);
+    }
+}
+
+constexpr std::array<std::uint8_t, 2687> ShortAudioMovie{
+    0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6f, 0x6d, 0x00, 0x00, 0x02, 0x00,
+    0x69, 0x73, 0x6f, 0x6d, 0x69, 0x73, 0x6f, 0x32, 0x61, 0x76, 0x63, 0x31, 0x6d, 0x70, 0x34, 0x31,
+    0x00, 0x00, 0x06, 0x77, 0x6d, 0x6f, 0x6f, 0x76, 0x00, 0x00, 0x00, 0x6c, 0x6d, 0x76, 0x68, 0x64,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xe8,
+    0x00, 0x00, 0x03, 0xe8, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x02, 0xe8, 0x74, 0x72, 0x61, 0x6b, 0x00, 0x00, 0x00, 0x5c,
+    0x74, 0x6b, 0x68, 0x64, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xe8, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
+    0x00, 0x40, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x65, 0x64, 0x74, 0x73,
+    0x00, 0x00, 0x00, 0x1c, 0x65, 0x6c, 0x73, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x03, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, 0x60,
+    0x6d, 0x64, 0x69, 0x61, 0x00, 0x00, 0x00, 0x20, 0x6d, 0x64, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3c, 0x00, 0x00, 0x00, 0x3c, 0x00,
+    0x55, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x68, 0x64, 0x6c, 0x72, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x76, 0x69, 0x64, 0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x56, 0x69, 0x64, 0x65, 0x6f, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72,
+    0x00, 0x00, 0x00, 0x02, 0x0b, 0x6d, 0x69, 0x6e, 0x66, 0x00, 0x00, 0x00, 0x14, 0x76, 0x6d, 0x68,
+    0x64, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x24, 0x64, 0x69, 0x6e, 0x66, 0x00, 0x00, 0x00, 0x1c, 0x64, 0x72, 0x65, 0x66, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x75, 0x72, 0x6c, 0x20, 0x00, 0x00, 0x00,
+    0x01, 0x00, 0x00, 0x01, 0xcb, 0x73, 0x74, 0x62, 0x6c, 0x00, 0x00, 0x00, 0xb7, 0x73, 0x74, 0x73,
+    0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa7, 0x61, 0x76, 0x63,
+    0x31, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x40, 0x00, 0x48, 0x00,
+    0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0xff, 0xff, 0x00,
+    0x00, 0x00, 0x2d, 0x61, 0x76, 0x63, 0x43, 0x01, 0x42, 0xc0, 0x0a, 0xff, 0xe1, 0x00, 0x16, 0x67,
+    0x42, 0xc0, 0x0a, 0xda, 0x10, 0x9b, 0x01, 0x10, 0x00, 0x00, 0x03, 0x00, 0x10, 0x00, 0x00, 0x03,
+    0x03, 0xc0, 0xf1, 0x22, 0x6a, 0x01, 0x00, 0x04, 0x68, 0xce, 0x0f, 0xc8, 0x00, 0x00, 0x00, 0x10,
+    0x70, 0x61, 0x73, 0x70, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x14,
+    0x62, 0x74, 0x72, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1c, 0x20,
+    0x00, 0x00, 0x00, 0x18, 0x73, 0x74, 0x74, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x14, 0x73, 0x74, 0x73, 0x73,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x28,
+    0x73, 0x74, 0x73, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x18,
+    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x8c, 0x73, 0x74, 0x73, 0x7a, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1e, 0x00, 0x00, 0x02, 0x62, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x00, 0x00, 0x0a,
+    0x00, 0x00, 0x00, 0x2c, 0x73, 0x74, 0x63, 0x6f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07,
+    0x00, 0x00, 0x06, 0xbf, 0x00, 0x00, 0x09, 0x2d, 0x00, 0x00, 0x09, 0x43, 0x00, 0x00, 0x09, 0x53,
+    0x00, 0x00, 0x09, 0x69, 0x00, 0x00, 0x09, 0x79, 0x00, 0x00, 0x09, 0x8f, 0x00, 0x00, 0x02, 0xb9,
+    0x74, 0x72, 0x61, 0x6b, 0x00, 0x00, 0x00, 0x5c, 0x74, 0x6b, 0x68, 0x64, 0x00, 0x00, 0x00, 0x03,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+    0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x24, 0x65, 0x64, 0x74, 0x73, 0x00, 0x00, 0x00, 0x1c, 0x65, 0x6c, 0x73, 0x74,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc8, 0x00, 0x00, 0x04, 0x00,
+    0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x02, 0x31, 0x6d, 0x64, 0x69, 0x61, 0x00, 0x00, 0x00, 0x20,
+    0x6d, 0x64, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0xbb, 0x80, 0x00, 0x00, 0x25, 0x80, 0x55, 0xc4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d,
+    0x68, 0x64, 0x6c, 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x73, 0x6f, 0x75, 0x6e,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x53, 0x6f, 0x75, 0x6e,
+    0x64, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x00, 0x00, 0x00, 0x01, 0xdc, 0x6d, 0x69, 0x6e,
+    0x66, 0x00, 0x00, 0x00, 0x10, 0x73, 0x6d, 0x68, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x24, 0x64, 0x69, 0x6e, 0x66, 0x00, 0x00, 0x00, 0x1c, 0x64, 0x72, 0x65,
+    0x66, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0c, 0x75, 0x72, 0x6c,
+    0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0xa0, 0x73, 0x74, 0x62, 0x6c, 0x00, 0x00, 0x00,
+    0x7e, 0x73, 0x74, 0x73, 0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x6e, 0x6d, 0x70, 0x34, 0x61, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0xbb, 0x80, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x36, 0x65, 0x73, 0x64, 0x73, 0x00, 0x00, 0x00, 0x00, 0x03, 0x80, 0x80,
+    0x80, 0x25, 0x00, 0x02, 0x00, 0x04, 0x80, 0x80, 0x80, 0x17, 0x40, 0x15, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x7d, 0x00, 0x00, 0x00, 0x0b, 0xdc, 0x05, 0x80, 0x80, 0x80, 0x05, 0x11, 0x90, 0x56, 0xe5,
+    0x00, 0x06, 0x80, 0x80, 0x80, 0x01, 0x02, 0x00, 0x00, 0x00, 0x14, 0x62, 0x74, 0x72, 0x74, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x7d, 0x00, 0x00, 0x00, 0x0b, 0xdc, 0x00, 0x00, 0x00, 0x20, 0x73,
+    0x74, 0x74, 0x73, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0a, 0x00,
+    0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x01, 0x80, 0x00, 0x00, 0x00, 0x58, 0x73,
+    0x74, 0x73, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x01, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00,
+    0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x02, 0x00,
+    0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x73, 0x74, 0x73, 0x7a, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x06, 0x00,
+    0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x2c, 0x73, 0x74, 0x63, 0x6f, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x07, 0x00, 0x00, 0x06, 0xa7, 0x00, 0x00, 0x09, 0x21, 0x00, 0x00, 0x09, 0x37, 0x00,
+    0x00, 0x09, 0x4d, 0x00, 0x00, 0x09, 0x5d, 0x00, 0x00, 0x09, 0x73, 0x00, 0x00, 0x09, 0x83, 0x00,
+    0x00, 0x00, 0x1a, 0x73, 0x67, 0x70, 0x64, 0x01, 0x00, 0x00, 0x00, 0x72, 0x6f, 0x6c, 0x6c, 0x00,
+    0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0xff, 0xff, 0x00, 0x00, 0x00, 0x1c, 0x73, 0x62, 0x67,
+    0x70, 0x00, 0x00, 0x00, 0x00, 0x72, 0x6f, 0x6c, 0x6c, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+    0x0b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x62, 0x75, 0x64, 0x74, 0x61, 0x00, 0x00, 0x00,
+    0x5a, 0x6d, 0x65, 0x74, 0x61, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x21, 0x68, 0x64, 0x6c,
+    0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6d, 0x64, 0x69, 0x72, 0x61, 0x70, 0x70,
+    0x6c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x69, 0x6c,
+    0x73, 0x74, 0x00, 0x00, 0x00, 0x25, 0xa9, 0x74, 0x6f, 0x6f, 0x00, 0x00, 0x00, 0x1d, 0x64, 0x61,
+    0x74, 0x61, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x4c, 0x61, 0x76, 0x66, 0x35, 0x38,
+    0x2e, 0x37, 0x36, 0x2e, 0x31, 0x30, 0x30, 0x00, 0x00, 0x00, 0x08, 0x66, 0x72, 0x65, 0x65, 0x00,
+    0x00, 0x03, 0xe0, 0x6d, 0x64, 0x61, 0x74, 0xde, 0x04, 0x00, 0x4c, 0x61, 0x76, 0x63, 0x35, 0x38,
+    0x2e, 0x31, 0x33, 0x34, 0x2e, 0x31, 0x30, 0x30, 0x00, 0x42, 0x20, 0x08, 0xc1, 0x18, 0x38, 0x00,
+    0x00, 0x02, 0x44, 0x06, 0x05, 0xff, 0xff, 0x40, 0xdc, 0x45, 0xe9, 0xbd, 0xe6, 0xd9, 0x48, 0xb7,
+    0x96, 0x2c, 0xd8, 0x20, 0xd9, 0x23, 0xee, 0xef, 0x78, 0x32, 0x36, 0x34, 0x20, 0x2d, 0x20, 0x63,
+    0x6f, 0x72, 0x65, 0x20, 0x31, 0x36, 0x34, 0x20, 0x2d, 0x20, 0x48, 0x2e, 0x32, 0x36, 0x34, 0x2f,
+    0x4d, 0x50, 0x45, 0x47, 0x2d, 0x34, 0x20, 0x41, 0x56, 0x43, 0x20, 0x63, 0x6f, 0x64, 0x65, 0x63,
+    0x20, 0x2d, 0x20, 0x43, 0x6f, 0x70, 0x79, 0x6c, 0x65, 0x66, 0x74, 0x20, 0x32, 0x30, 0x30, 0x33,
+    0x2d, 0x32, 0x30, 0x32, 0x31, 0x20, 0x2d, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77,
+    0x77, 0x77, 0x2e, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x6c, 0x61, 0x6e, 0x2e, 0x6f, 0x72, 0x67, 0x2f,
+    0x78, 0x32, 0x36, 0x34, 0x2e, 0x68, 0x74, 0x6d, 0x6c, 0x20, 0x2d, 0x20, 0x6f, 0x70, 0x74, 0x69,
+    0x6f, 0x6e, 0x73, 0x3a, 0x20, 0x63, 0x61, 0x62, 0x61, 0x63, 0x3d, 0x30, 0x20, 0x72, 0x65, 0x66,
+    0x3d, 0x31, 0x20, 0x64, 0x65, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x3d, 0x30, 0x3a, 0x30, 0x3a, 0x30,
+    0x20, 0x61, 0x6e, 0x61, 0x6c, 0x79, 0x73, 0x65, 0x3d, 0x30, 0x3a, 0x30, 0x20, 0x6d, 0x65, 0x3d,
+    0x64, 0x69, 0x61, 0x20, 0x73, 0x75, 0x62, 0x6d, 0x65, 0x3d, 0x30, 0x20, 0x70, 0x73, 0x79, 0x3d,
+    0x31, 0x20, 0x70, 0x73, 0x79, 0x5f, 0x72, 0x64, 0x3d, 0x31, 0x2e, 0x30, 0x30, 0x3a, 0x30, 0x2e,
+    0x30, 0x30, 0x20, 0x6d, 0x69, 0x78, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x66, 0x3d, 0x30, 0x20, 0x6d,
+    0x65, 0x5f, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x3d, 0x31, 0x36, 0x20, 0x63, 0x68, 0x72, 0x6f, 0x6d,
+    0x61, 0x5f, 0x6d, 0x65, 0x3d, 0x31, 0x20, 0x74, 0x72, 0x65, 0x6c, 0x6c, 0x69, 0x73, 0x3d, 0x30,
+    0x20, 0x38, 0x78, 0x38, 0x64, 0x63, 0x74, 0x3d, 0x30, 0x20, 0x63, 0x71, 0x6d, 0x3d, 0x30, 0x20,
+    0x64, 0x65, 0x61, 0x64, 0x7a, 0x6f, 0x6e, 0x65, 0x3d, 0x32, 0x31, 0x2c, 0x31, 0x31, 0x20, 0x66,
+    0x61, 0x73, 0x74, 0x5f, 0x70, 0x73, 0x6b, 0x69, 0x70, 0x3d, 0x31, 0x20, 0x63, 0x68, 0x72, 0x6f,
+    0x6d, 0x61, 0x5f, 0x71, 0x70, 0x5f, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x3d, 0x30, 0x20, 0x74,
+    0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x3d, 0x32, 0x20, 0x6c, 0x6f, 0x6f, 0x6b, 0x61, 0x68, 0x65,
+    0x61, 0x64, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x3d, 0x31, 0x20, 0x73, 0x6c, 0x69,
+    0x63, 0x65, 0x64, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x3d, 0x30, 0x20, 0x6e, 0x72,
+    0x3d, 0x30, 0x20, 0x64, 0x65, 0x63, 0x69, 0x6d, 0x61, 0x74, 0x65, 0x3d, 0x31, 0x20, 0x69, 0x6e,
+    0x74, 0x65, 0x72, 0x6c, 0x61, 0x63, 0x65, 0x64, 0x3d, 0x30, 0x20, 0x62, 0x6c, 0x75, 0x72, 0x61,
+    0x79, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x74, 0x3d, 0x30, 0x20, 0x63, 0x6f, 0x6e, 0x73, 0x74,
+    0x72, 0x61, 0x69, 0x6e, 0x65, 0x64, 0x5f, 0x69, 0x6e, 0x74, 0x72, 0x61, 0x3d, 0x30, 0x20, 0x62,
+    0x66, 0x72, 0x61, 0x6d, 0x65, 0x73, 0x3d, 0x30, 0x20, 0x77, 0x65, 0x69, 0x67, 0x68, 0x74, 0x70,
+    0x3d, 0x30, 0x20, 0x6b, 0x65, 0x79, 0x69, 0x6e, 0x74, 0x3d, 0x33, 0x30, 0x20, 0x6b, 0x65, 0x79,
+    0x69, 0x6e, 0x74, 0x5f, 0x6d, 0x69, 0x6e, 0x3d, 0x33, 0x20, 0x73, 0x63, 0x65, 0x6e, 0x65, 0x63,
+    0x75, 0x74, 0x3d, 0x30, 0x20, 0x69, 0x6e, 0x74, 0x72, 0x61, 0x5f, 0x72, 0x65, 0x66, 0x72, 0x65,
+    0x73, 0x68, 0x3d, 0x30, 0x20, 0x72, 0x63, 0x3d, 0x63, 0x72, 0x66, 0x20, 0x6d, 0x62, 0x74, 0x72,
+    0x65, 0x65, 0x3d, 0x30, 0x20, 0x63, 0x72, 0x66, 0x3d, 0x32, 0x33, 0x2e, 0x30, 0x20, 0x71, 0x63,
+    0x6f, 0x6d, 0x70, 0x3d, 0x30, 0x2e, 0x36, 0x30, 0x20, 0x71, 0x70, 0x6d, 0x69, 0x6e, 0x3d, 0x30,
+    0x20, 0x71, 0x70, 0x6d, 0x61, 0x78, 0x3d, 0x36, 0x39, 0x20, 0x71, 0x70, 0x73, 0x74, 0x65, 0x70,
+    0x3d, 0x34, 0x20, 0x69, 0x70, 0x5f, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x3d, 0x31, 0x2e, 0x34, 0x30,
+    0x20, 0x61, 0x71, 0x3d, 0x30, 0x00, 0x80, 0x00, 0x00, 0x00, 0x16, 0x65, 0x88, 0x84, 0x3a, 0x26,
+    0x28, 0x00, 0x09, 0x02, 0xc9, 0xc9, 0xc9, 0xd7, 0x5d, 0x75, 0xd7, 0x5d, 0x75, 0xd7, 0x5d, 0x75,
+    0xe0, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9a, 0x20, 0x36, 0x82, 0x30, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04,
+    0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x40, 0x3a, 0x82, 0x30, 0x21, 0x10, 0x04,
+    0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x60, 0x3a, 0x82, 0x30, 0x21, 0x10, 0x04,
+    0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x80,
+    0x3a, 0x82, 0x30, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xa0,
+    0x3a, 0x82, 0x30, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x21, 0x10, 0x04, 0x60, 0x8c, 0x1c, 0x00,
+    0x00, 0x00, 0x06, 0x41, 0x9a, 0xc0, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xe0,
+    0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x00, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9b, 0x20, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x40, 0x3e, 0x82,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x60, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41,
+    0x9b, 0x80, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0xa0, 0x3e, 0x82, 0x30, 0x00,
+    0x00, 0x00, 0x06, 0x41, 0x9b, 0xc0, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0xe0,
+    0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x00, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9a, 0x20, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x40, 0x3e, 0x82,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0x60, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41,
+    0x9a, 0x80, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xa0, 0x3e, 0x82, 0x30, 0x00,
+    0x00, 0x00, 0x06, 0x41, 0x9a, 0xc0, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9a, 0xe0,
+    0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x00, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00,
+    0x06, 0x41, 0x9b, 0x20, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x40, 0x3e, 0x82,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0x60, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41,
+    0x9b, 0x80, 0x3e, 0x82, 0x30, 0x00, 0x00, 0x00, 0x06, 0x41, 0x9b, 0xa0, 0x3e, 0x82, 0x30
+};
+
+void WriteShortAudioMovie() {
+    std::filesystem::create_directories("app0");
+    std::ofstream file("app0/short-audio.mp4", std::ios::binary | std::ios::trunc);
+    file.write(reinterpret_cast<const char*>(ShortAudioMovie.data()), static_cast<std::streamsize>(ShortAudioMovie.size()));
+    Check(static_cast<bool>(file), "cannot write the short audio movie");
+}
+
+void TestAudioEofClockRebase() {
+    const auto open = [](Events& events, bool hold) {
+        AvPlayerInitData init = InitData(&events);
+        auto* player = sceAvPlayerInit(&init);
+        Check(player != nullptr, "audio eof clock init failed");
+        Check(sceAvPlayerAddSource(player, "/app0/avplayer.mp4") == 0, "audio eof clock source failed");
+        Check(WaitFor([&] { return events.Seen(EventReady); }), "audio eof clock ready missing");
+        Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "audio eof clock audio failed");
+        if (hold) AvPlayer::HoldAvPlayerAudioEofForTest_nid_no_patch(player, true);
+        Check(sceAvPlayerStart(player) == 0, "audio eof clock start failed");
+        Check(WaitFor([&] { return events.Seen(EventPlay); }), "audio eof clock play missing");
+        return player;
+    };
+    const auto close = [](AvPlayerInternal* player) {
+        AvPlayer::HoldAvPlayerAudioEofForTest_nid_no_patch(player, false);
+        Check(sceAvPlayerClose(player) == 0, "audio eof clock close failed");
+        std::lock_guard lock(allocations.mutex);
+        Check(allocations.blocks.empty(), "audio eof clock allocations leaked");
+    };
+    const auto pullQueued = [](AvPlayerInternal* player) {
+        std::uint64_t timestamp = 0;
+        Check(AvPlayer::NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(player, &timestamp), "audio eof clock queue empty");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(timestamp));
+        AvPlayerFrameInfo sound{};
+        Check(sceAvPlayerGetAudioData(player, &sound) != 0, "audio eof clock drain failed");
+        Check(sound.timestamp == timestamp, "audio eof clock drained an unexpected frame");
+    };
+    const auto leaveFinalFrame = [&](AvPlayerInternal* player, bool afterEof) {
+        Check(WaitFor([&] {
+            const auto queued = AvPlayer::QueuedAvPlayerAudioForTest_nid_no_patch(player);
+            const auto ready = afterEof ? AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player) : AvPlayer::AvPlayerAudioEofHeldForTest_nid_no_patch(player);
+            if (ready && queued >= 1) return true;
+            if (queued > 1) pullQueued(player);
+            return false;
+        }), afterEof ? "audio eof before the final pull missing" : "audio eof hold missing");
+        while (AvPlayer::QueuedAvPlayerAudioForTest_nid_no_patch(player) > 1) pullQueued(player);
+    };
+    const auto pullFinal = [](AvPlayerInternal* player, AvPlayerFrameInfo& sound) {
+        std::uint64_t last = 0;
+        Check(AvPlayer::NextQueuedAvPlayerAudioTimestampForTest_nid_no_patch(player, &last), "final audio frame was not queued");
+        Check(last > 50, "final audio timestamp is inside the drift gate");
+        AvPlayer::SetAvPlayerClockForTest_nid_no_patch(player, static_cast<double>(last - 42));
+        std::this_thread::sleep_for(std::chrono::milliseconds(40));
+        Check(sceAvPlayerGetAudioData(player, &sound) != 0, "final audio frame missing");
+        Check(sound.timestamp == last, "final audio timestamp changed");
+        return last;
+    };
+
+    {
+        Events events;
+        auto* player = open(events, true);
+        leaveFinalFrame(player, false);
+        AvPlayerFrameInfo sound{};
+        const auto last = pullFinal(player, sound);
+        Check(sceAvPlayerCurrentTime(player) == last - 42, "clock rebased before audio eof was marked");
+        AvPlayer::HoldAvPlayerAudioEofForTest_nid_no_patch(player, false);
+        Check(WaitFor([&] { return AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player); }), "audio eof was not marked");
+        Check(sceAvPlayerCurrentTime(player) == last, "clock was not reconciled after audio eof");
+        close(player);
+    }
+
+    {
+        Events events;
+        auto* player = open(events, false);
+        leaveFinalFrame(player, true);
+        AvPlayerFrameInfo sound{};
+        const auto last = pullFinal(player, sound);
+        Check(sceAvPlayerCurrentTime(player) == last, "clock was not reconciled when the final frame followed eof");
+        close(player);
+    }
+}
+
+void TestAudioClockAdvancesAfterEof() {
+    WriteShortAudioMovie();
+    Events events;
+    AvPlayerInitData init = InitData(&events);
+    auto* player = sceAvPlayerInit(&init);
+    Check(player != nullptr, "audio eof advance init failed");
+    Check(sceAvPlayerAddSource(player, "/app0/short-audio.mp4") == 0, "audio eof advance source failed");
+    Check(WaitFor([&] { return events.Seen(EventReady); }), "audio eof advance ready missing");
+    Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "audio eof advance audio failed");
+    Check(sceAvPlayerStart(player) == 0, "audio eof advance start failed");
+    Check(WaitFor([&] { return events.Seen(EventPlay); }), "audio eof advance play missing");
+    AvPlayerFrameInfo sound{};
+    std::uint64_t last = 0;
+    Check(WaitFor([&] {
+        while (sceAvPlayerGetAudioData(player, &sound)) last = sound.timestamp;
+        return AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player);
+    }), "short audio did not end");
+    Check(last > 0 && last < 500, "short audio timestamp unexpected");
+    const auto before = sceAvPlayerCurrentTime(player);
+    std::this_thread::sleep_for(std::chrono::milliseconds(80));
+    for (int poll = 0; poll < 5; ++poll) sceAvPlayerGetAudioData(player, &sound);
+    const auto after = sceAvPlayerCurrentTime(player);
+    Check(after >= before + 40, "clock stopped after audio eof: " + std::to_string(before) + " to " + std::to_string(after));
+    Check(sceAvPlayerClose(player) == 0, "audio eof advance close failed");
+    std::lock_guard lock(allocations.mutex);
+    Check(allocations.blocks.empty(), "audio eof advance allocations leaked");
+}
+
+void TestTrailingVideoAfterShortAudio() {
+    WriteShortAudioMovie();
+    Events events;
+    AvPlayerInitData init = InitData(&events);
+    auto* player = sceAvPlayerInit(&init);
+    Check(player != nullptr, "trailing video init failed");
+    Check(sceAvPlayerAddSource(player, "/app0/short-audio.mp4") == 0, "trailing video source failed");
+    Check(WaitFor([&] { return events.Seen(EventReady); }), "trailing video ready missing");
+    Check(sceAvPlayerEnableStream(player, VideoStream) == 0, "trailing video stream failed");
+    Check(sceAvPlayerEnableStream(player, EnglishAudioStream) == 0, "trailing video audio failed");
+    Check(sceAvPlayerStart(player) == 0, "trailing video start failed");
+    Check(WaitFor([&] { return events.Seen(EventPlay); }), "trailing video play missing");
+    AvPlayerFrameInfo sound{};
+    std::uint64_t last = 0;
+    Check(WaitFor([&] {
+        while (sceAvPlayerGetAudioData(player, &sound)) last = sound.timestamp;
+        return AvPlayer::AvPlayerAudioEndedForTest_nid_no_patch(player);
+    }), "trailing video audio did not end");
+    Check(last > 0 && last < 500, "trailing video audio timestamp unexpected");
+    std::uint64_t latest = 0;
+    Check(WaitFor([&] {
+        sceAvPlayerGetAudioData(player, &sound);
+        sceAvPlayerCurrentTime(player);
+        AvPlayerFrameInfoEx frame{};
+        if (sceAvPlayerGetVideoDataEx(player, &frame)) latest = std::max(latest, frame.timestamp);
+        return latest > last + 100;
+    }, 3000), "trailing video was not delivered after audio eof");
+    Check(sceAvPlayerClose(player) == 0, "trailing video close failed");
+    std::lock_guard lock(allocations.mutex);
+    Check(allocations.blocks.empty(), "trailing video allocations leaked");
+}
+
 }
 
 int main(int argc, char** argv) {
@@ -1656,6 +2061,10 @@ int main(int argc, char** argv) {
         TestLoopWarningWaitsForPlayback();
         TestEofStopLatency();
         TestVideoSyncTolerance();
+        TestAudioClockDriftGating();
+        TestAudioEofClockRebase();
+        TestAudioClockAdvancesAfterEof();
+        TestTrailingVideoAfterShortAudio();
         std::puts("AvPlayer tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/tests/GuestAvailableCpumask.cpp b/core/libs/tests/GuestAvailableCpumask.cpp
index 31775180e5..1450a36bce 100644
--- a/core/libs/tests/GuestAvailableCpumask.cpp
+++ b/core/libs/tests/GuestAvailableCpumask.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstddef>
@@ -9,28 +11,6 @@
 #include <thread>
 #include <utility>
 
-extern "C" {
-KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetaffinity(Pthread thread, KernelCpumask* mask);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI cpuset_getaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, void* mask);
-int APS5_VABI cpuset_setaffinity_nid_postfix(int level, int which, std::int64_t id, std::size_t size, const void* mask);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-Pthread APS5_VABI pthread_self_nid_postfix(void);
-int APS5_VABI pthread_getaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, void* cpuset);
-int APS5_VABI pthread_setaffinity_np_nid_postfix(Pthread thread, std::size_t cpusetSize, const void* cpuset);
-int APS5_VABI scePthreadGetthreadid(void);
-int APS5_VABI sceKernelGetCurrentCpu(void);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int PS5_LOGICAL_CPUS = 16;
 
@@ -120,6 +100,7 @@ static void* APS5_VABI SetCpuset(void* arg) {
     std::uint64_t set[4] = {cpu | (1ull << 40), 0, 0, 0};
     result->results[0] = cpuset_setaffinity_nid_postfix(3, 1, -1, 8, set);
     scePthreadGetaffinity(scePthreadSelf(), &result->affinity[0]);
+
     set[1] = 1;
     result->results[1] = cpuset_setaffinity_nid_postfix(3, 1, -1, 16, set) == -1 && *__error_nid_postfix() == 22;
     set[1] = 0;
@@ -130,9 +111,11 @@ static void* APS5_VABI SetCpuset(void* arg) {
     const std::uint64_t unavailable[1] = {1ull << 40};
     result->results[6] = cpuset_setaffinity_nid_postfix(3, 1, -1, 8, unavailable) == -1 && *__error_nid_postfix() == 11;
     scePthreadGetaffinity(scePthreadSelf(), &result->affinity[1]);
+
     const std::uint64_t process[1] = {cpu};
     result->results[7] = cpuset_setaffinity_nid_postfix(3, 2, getpid_nid_postfix(), 8, process);
     scePthreadGetaffinity(scePthreadSelf(), &result->affinity[2]);
+
     return nullptr;
 }
 
diff --git a/core/libs/tests/GuestBacktrace.cpp b/core/libs/tests/GuestBacktrace.cpp
index 7ae55383e3..8d3f597480 100644
--- a/core/libs/tests/GuestBacktrace.cpp
+++ b/core/libs/tests/GuestBacktrace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -13,8 +14,7 @@
 #include <vector>
 
 extern "C" {
-int APS5_VABI sceLibcBacktraceGetBufferSize_nid_postfix(int, int*, std::size_t*);
-int APS5_VABI sceLibcBacktraceSelf_nid_postfix(int, void*, std::size_t, int*);
+
 #if defined(_WIN32)
 std::string BacktraceModulePath_nid_no_patch(HMODULE, std::size_t);
 #endif
diff --git a/core/libs/tests/GuestBadOptionalAccess.cpp b/core/libs/tests/GuestBadOptionalAccess.cpp
index a4280e3ef5..0b9d8edfe9 100644
--- a/core/libs/tests/GuestBadOptionalAccess.cpp
+++ b/core/libs/tests/GuestBadOptionalAccess.cpp
@@ -1,19 +1,18 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
-struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const char* (APS5_VABI *what)(const Object*); };
+
+struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const char* (APS5_VABI *what)(const LibcException::ExceptionObject*); };
 
 extern "C" {
 extern const TypeRecord _ZTISt9exception_nid_postfix;
 extern const TypeRecord _ZTISt19bad_optional_access_nid_postfix;
 extern const Vtable _ZTVSt19bad_optional_access_nid_postfix;
-void APS5_VABI _ZNSt19bad_optional_accessC1Ev_nid_postfix(Object*);
-void APS5_VABI _ZNSt19bad_optional_accessD1Ev_nid_postfix(Object*);
-[[noreturn]] void APS5_VABI _ZSt26_Throw_bad_optional_accessv_nid_postfix();
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -24,14 +23,17 @@ int main() {
     Require(type.base == &_ZTISt9exception_nid_postfix);
     const auto& table = _ZTVSt19bad_optional_access_nid_postfix;
     Require(table.offset == 0 && table.type == &type && table.what != nullptr);
-    Object object{};
+    LibcException::ExceptionObject object{};
     _ZNSt19bad_optional_accessC1Ev_nid_postfix(&object);
+
     Require(object.vtable == &table.destroy);
     Require(std::strcmp(table.what(&object), "bad_optional_access") == 0);
     _ZNSt19bad_optional_accessD1Ev_nid_postfix(&object);
+
     bool thrown = false;
     try {
         _ZSt26_Throw_bad_optional_accessv_nid_postfix();
+
     } catch (...) {
         thrown = true;
     }
diff --git a/core/libs/tests/GuestBessel.cpp b/core/libs/tests/GuestBessel.cpp
index 75c94ec4ac..4ff093ad18 100644
--- a/core/libs/tests/GuestBessel.cpp
+++ b/core/libs/tests/GuestBessel.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cerrno>
@@ -10,16 +11,6 @@
 #include <iterator>
 #include <limits>
 
-extern "C" {
-double APS5_VABI j0_nid_postfix(double);
-double APS5_VABI j1_nid_postfix(double);
-double APS5_VABI jn_nid_postfix(int, double);
-double APS5_VABI y0_nid_postfix(double);
-double APS5_VABI y1_nid_postfix(double);
-double APS5_VABI yn_nid_postfix(int, double);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static double Value(std::uint64_t bits) { return std::bit_cast<double>(bits); }
@@ -96,10 +87,35 @@ static void CheckSecondKind() {
         y0_nid_postfix(input);
         y1_nid_postfix(input);
         yn_nid_postfix(3, input);
+
         Require(std::fetestexcept(FE_DIVBYZERO | FE_INVALID) == 0);
     }
 }
 
+static void CheckFloatSecondKindZero() {
+    const char* names[] = {"y0f", "y1f", "ynf"};
+    for (int function = 0; function < 3; ++function) {
+        for (const int order : {INT_MIN, -3, -2, -1, 0, 1, 2, 3, INT_MAX}) {
+            for (const float input : {0.0f, -0.0f}) {
+                for (const int flags : {0, FE_INEXACT, FE_DIVBYZERO}) {
+                    std::feclearexcept(FE_ALL_EXCEPT);
+                    std::feraiseexcept(flags);
+                    const int expectedFlags = std::fetestexcept(FE_ALL_EXCEPT);
+                    *__error_nid_postfix() = 12345;
+                    const float result = function == 0 ? y0f_nid_postfix(input) : function == 1 ? y1f_nid_postfix(input) : ynf_nid_postfix(order, input);
+                    const int actualFlags = std::fetestexcept(FE_ALL_EXCEPT);
+                    if (std::bit_cast<std::uint32_t>(result) != 0xff800000u || actualFlags != expectedFlags || *__error_nid_postfix() != 12345) {
+                        std::fprintf(stderr, "Guest %s(%d, %08x): result %08x, flags %x, expected %x, errno %d\n", names[function], order,
+                                     std::bit_cast<std::uint32_t>(input), std::bit_cast<std::uint32_t>(result), actualFlags, expectedFlags, *__error_nid_postfix());
+                        std::abort();
+                    }
+                }
+            }
+        }
+    }
+    std::feclearexcept(FE_ALL_EXCEPT);
+}
+
 static void CheckIntegerOrders() {
     const OrderCase first[] = {
         {2, 0x3ddb7cdfd9d7bdbbull, 0x3b979ca10c924224ull}, {5, 0xbddb7cdfd9d7bdbbull, 0xb4cfed4f3ec0c466ull}, {33, 0x3e00000000000000ull, 0x0000000000000000ull},
@@ -181,6 +197,7 @@ static void CheckValues() {
 int main() {
     CheckFirstKind();
     CheckSecondKind();
+    CheckFloatSecondKindZero();
     CheckIntegerOrders();
     CheckValues();
     return 0;
diff --git a/core/libs/tests/GuestBinaryWord.cpp b/core/libs/tests/GuestBinaryWord.cpp
index 2720a1f894..cfb2f004f0 100644
--- a/core/libs/tests/GuestBinaryWord.cpp
+++ b/core/libs/tests/GuestBinaryWord.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -10,22 +11,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI getw_nid_postfix(FileStream*);
-int APS5_VABI putw_nid_postfix(int, FileStream*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-int APS5_VABI ungetc_nid_postfix(int, FileStream*);
-int APS5_VABI fgetc_nid_postfix(FileStream*);
-void APS5_VABI clearerr_nid_postfix(FileStream*);
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
@@ -75,6 +60,7 @@ void CheckShortReads(const char* path) {
         Require((stream->GuestState().flags & 0x60) == 0x20, "short-read EOF flag");
         Require(ftell_nid_postfix(stream) == static_cast<std::int64_t>(length), "consume incomplete word bytes");
         clearerr_nid_postfix(stream);
+
         Require((stream->GuestState().flags & 0x60) == 0, "clear short-read status");
         Require(fclose_nid_postfix(stream) == 0, "close incomplete word");
     }
@@ -107,8 +93,10 @@ void CheckConcurrentWrites(const char* path) {
     auto* stream = fopen_nid_postfix(path, "w+b");
     Require(stream != nullptr, "open shared stream");
     flockfile_nid_postfix(stream);
+
     Require(putw_nid_postfix(0, stream) == 0, "putw accepts a lock held by its caller");
     funlockfile_nid_postfix(stream);
+
     const auto writer = [stream](int value) {
         for (int count = 0; count < 256; ++count)
             Require(putw_nid_postfix(value, stream) == 0, "concurrent word write");
diff --git a/core/libs/tests/GuestBluetoothHid.cpp b/core/libs/tests/GuestBluetoothHid.cpp
index fb37aa3c23..fbc4db06e2 100644
--- a/core/libs/tests/GuestBluetoothHid.cpp
+++ b/core/libs/tests/GuestBluetoothHid.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceBluetoothHid/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -6,36 +7,6 @@
 #include <cstdlib>
 #include <stdexcept>
 
-struct BluetoothHidEvent;
-struct BluetoothHidDeviceInfo;
-struct BluetoothHidThreadParam {
-    std::int32_t priority;
-    std::uint32_t padding;
-    std::uint64_t affinityMask;
-    std::uint32_t reserved;
-    std::uint32_t tailPadding;
-};
-struct BluetoothHidParam {
-    const BluetoothHidThreadParam* threadParam;
-    std::uint32_t reserved;
-    std::uint32_t padding;
-};
-using BluetoothHidCallback = void (APS5_VABI *)(const BluetoothHidEvent*, std::int32_t, void*);
-
-extern "C" {
-std::int32_t APS5_VABI sceBluetoothHidInit();
-std::int32_t APS5_VABI sceBluetoothHidRegisterCallback(BluetoothHidCallback callback, void* userData, const BluetoothHidParam* param);
-std::int32_t APS5_VABI sceBluetoothHidUnregisterCallback();
-std::int32_t APS5_VABI sceBluetoothHidRegisterDevice(std::uint16_t vendorId, std::uint16_t productId);
-std::int32_t APS5_VABI sceBluetoothHidUnregisterDevice(std::uint16_t vendorId, std::uint16_t productId);
-int APS5_VABI sceBluetoothHidGetInputReport(std::uint64_t, std::uint8_t);
-int APS5_VABI sceBluetoothHidDebugGetVersion();
-int APS5_VABI sceBluetoothHidGetDeviceInfo(std::int32_t, BluetoothHidDeviceInfo*);
-int APS5_VABI sceBluetoothHidDisconnectDevice(std::int32_t);
-int APS5_VABI sceBluetoothHidGetFeatureReport(std::uint64_t, std::uint8_t);
-int APS5_VABI sceBluetoothHidSetFeatureReport(std::uint64_t, std::uint8_t, const void*, std::size_t);
-}
-
 namespace {
 
 int callbackCalls = 0;
@@ -82,6 +53,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidGetInputReport(0, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -90,6 +62,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidGetDeviceInfo(0, nullptr);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -97,6 +70,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidDisconnectDevice(0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -104,6 +78,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidGetFeatureReport(0, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -111,6 +86,7 @@ int main() {
     threw = false;
     try {
         sceBluetoothHidSetFeatureReport(0, 0, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestBoundsChecking.cpp b/core/libs/tests/GuestBoundsChecking.cpp
index 4021e99e48..fb7977eaa8 100644
--- a/core/libs/tests/GuestBoundsChecking.cpp
+++ b/core/libs/tests/GuestBoundsChecking.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -8,19 +9,8 @@
 #include <fstream>
 #include <string>
 
-using GuestContextCompare = int (APS5_VABI*)(const void*, const void*, void*);
-
 extern "C" {
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void*);
-void* APS5_VABI bsearch_s_nid_postfix(const void*, const void*, std::size_t, std::size_t, GuestContextCompare, void*);
-std::uint16_t* APS5_VABI wcstok_s_nid_postfix(std::uint16_t*, std::size_t*, const std::uint16_t*, std::uint16_t**);
-int APS5_VABI wctomb_s_nid_postfix(int*, char*, std::size_t, std::uint16_t);
-int APS5_VABI wcrtomb_s_nid_postfix(std::size_t*, char*, std::size_t, std::uint16_t, void*);
-int APS5_VABI mbstowcs_s_nid_postfix(std::size_t*, std::uint16_t*, std::size_t, const char*, std::size_t);
-int APS5_VABI mbsrtowcs_s_nid_postfix(std::size_t*, std::uint16_t*, std::size_t, const char**, std::size_t, void*);
-char* APS5_VABI gets_s_nid_postfix(char*, std::size_t);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
+
 extern FileStream* __stdinp_nid_postfix;
 }
 
@@ -130,7 +120,14 @@ void CheckWideToMultibyte() {
     int status = 7;
     char bytes[4] = {'x', 'x', 'x', 'x'};
     Require(wctomb_s_nid_postfix(&status, bytes, sizeof(bytes), 'A') == 0 && status == 1 && bytes[0] == 'A', "wctomb_s did not convert");
-    Require(wctomb_s_nid_postfix(&status, bytes, sizeof(bytes), 0x263a) == 86 && status == -1, "wctomb_s converted an unrepresentable character");
+    Require(wctomb_s_nid_postfix(&status, bytes, sizeof(bytes), 0x263a) == 0 && status == 3 && std::memcmp(bytes, "\xE2\x98\xBA", 3) == 0,
+        "wctomb_s did not convert U+263A to UTF-8");
+    std::memset(bytes, 'x', sizeof(bytes));
+    status = 7;
+    int smallBefore = constraintCalls;
+    Require(wctomb_s_nid_postfix(&status, bytes, 2, 0x263a) == 34 && status == 7 && std::memcmp(bytes, "xxxx", 4) == 0,
+        "wctomb_s wrote past a two-byte buffer");
+    RequireViolation(smallBefore, "wctomb_s: buffer too small", 34);
     Require(wctomb_s_nid_postfix(&status, nullptr, 0, 'A') == 0 && status == 0, "wctomb_s reported state dependence");
     status = 7;
     int before = constraintCalls;
@@ -144,7 +141,13 @@ void CheckWideToMultibyte() {
     std::size_t result = 7;
     Require(wcrtomb_s_nid_postfix(&result, bytes, sizeof(bytes), 'B', state) == 0 && result == 1 && bytes[0] == 'B', "wcrtomb_s did not convert");
     Require(wcrtomb_s_nid_postfix(&result, nullptr, 0, 'B', state) == 0 && result == 1, "wcrtomb_s did not measure the reset sequence");
-    Require(wcrtomb_s_nid_postfix(&result, bytes, sizeof(bytes), 0x263a, state) == 86 && result == failed, "wcrtomb_s converted an unrepresentable character");
+    Require(wcrtomb_s_nid_postfix(&result, bytes, sizeof(bytes), 0x263a, state) == 0 && result == 3 && std::memcmp(bytes, "\xE2\x98\xBA", 3) == 0,
+        "wcrtomb_s did not convert U+263A to UTF-8");
+    std::memset(bytes, 'x', sizeof(bytes));
+    before = constraintCalls;
+    Require(wcrtomb_s_nid_postfix(&result, bytes, 2, 0x263a, state) == 34 && result == failed && bytes[0] == 0 && std::memcmp(bytes + 1, "xxx", 3) == 0,
+        "wcrtomb_s wrote past a two-byte buffer");
+    RequireViolation(before, "wcrtomb_s: buffer too small", 34);
     before = constraintCalls;
     bytes[0] = 'x';
     Require(wcrtomb_s_nid_postfix(&result, bytes, sizeof(bytes), 'B', nullptr) == 22 && result == failed && bytes[0] == 0, "wcrtomb_s accepted a null state");
@@ -225,6 +228,7 @@ void CheckGets(const char* path) {
     RequireViolation(before, "gets_s: bad argument", 22);
     __stdinp_nid_postfix = saved;
     fclose_nid_postfix(stream);
+
     std::remove(path);
 }
 
@@ -233,6 +237,7 @@ void CheckGets(const char* path) {
 int main(int argc, char** argv) {
     Require(argc > 1, "usage: guest_bounds_checking_tests <scratch file>");
     set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(RecordConstraint));
+
     CheckBsearch();
     CheckWcstok();
     CheckWideToMultibyte();
diff --git a/core/libs/tests/GuestCamera.cpp b/core/libs/tests/GuestCamera.cpp
new file mode 100644
index 0000000000..c074795e23
--- /dev/null
+++ b/core/libs/tests/GuestCamera.cpp
@@ -0,0 +1,48 @@
+#include "prx/libSceCamera/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+constexpr int ErrorParam = static_cast<int>(0x802E0000u);
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "Camera: %s\n", message);
+        std::abort();
+    }
+}
+
+template <typename TCall>
+void RequireNotImplemented(TCall call, const std::string& name) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        Require(std::string(error.what()) == name + " not implemented", "a declared camera function threw another error");
+        return;
+    }
+    Require(false, "a declared camera function returned");
+}
+
+}
+
+int main() {
+    Require(sceCameraIsAttached(0) == 0, "camera 0 must be reported as not attached");
+    Require(sceCameraIsAttached(1) == ErrorParam, "camera index 1 must be rejected");
+    Require(sceCameraIsAttached(-1) == ErrorParam, "a negative camera index must be rejected");
+    RequireNotImplemented([] { sceCameraOpen(); }, "sceCameraOpen");
+    RequireNotImplemented([] { sceCameraClose(); }, "sceCameraClose");
+    RequireNotImplemented([] { sceCameraStart(); }, "sceCameraStart");
+    RequireNotImplemented([] { sceCameraStop(); }, "sceCameraStop");
+    RequireNotImplemented([] { sceCameraGetConfig(); }, "sceCameraGetConfig");
+    RequireNotImplemented([] { sceCameraSetConfig(); }, "sceCameraSetConfig");
+    RequireNotImplemented([] { sceCameraSetAttribute(); }, "sceCameraSetAttribute");
+    RequireNotImplemented([] { sceCameraGetDeviceInfo(); }, "sceCameraGetDeviceInfo");
+    RequireNotImplemented([] { sceCameraGetFrameData(); }, "sceCameraGetFrameData");
+    RequireNotImplemented([] { sceCameraIsValidFrameData(); }, "sceCameraIsValidFrameData");
+    return 0;
+}
diff --git a/core/libs/tests/GuestCes.cpp b/core/libs/tests/GuestCes.cpp
index 7e5238dce7..a9ffd3653d 100644
--- a/core/libs/tests/GuestCes.cpp
+++ b/core/libs/tests/GuestCes.cpp
@@ -1,28 +1,11 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
 #include <cstdint>
+#include <initializer_list>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1252(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1251(void);
-const std::uint8_t* APS5_VABI sceCesRefersUcsProfileCp1250(void);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesUtf8StrToMbcsStr(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8StrGetMbcsLen(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf8Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrGetUtf8Len(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesUcs2StrToMbcsStr(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2StrGetMbcsLen(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUcs2Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrGetUcs2Len(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceCesEucJpToUcs2(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
-int APS5_VABI sceCesSbcToUtf8(const std::uint8_t*, std::uint8_t, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUtf8ToSbc(const std::uint8_t*, std::uint32_t, std::uint32_t*, const std::uint8_t*, std::uint8_t*);
-void* APS5_VABI sceCesUcsProfileInitSJis1997Cp932(void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void RequireSbcToUtf8(const std::uint8_t* profile, std::uint8_t sbc, const char* expected) {
@@ -46,6 +29,175 @@ static int Utf8ToSbc(const std::uint8_t* profile, const char* utf8, std::uint32_
     return sceCesUtf8ToSbc(reinterpret_cast<const std::uint8_t*>(utf8), utf8max, &length, profile, &sbc);
 }
 
+static void RequireSbcCode(const std::uint8_t* profile, std::uint8_t sbc, std::uint32_t code) {
+    char expected[4] = {};
+    if (code < 0x80) {
+        expected[0] = static_cast<char>(code);
+    } else if (code < 0x800) {
+        expected[0] = static_cast<char>(0xC0 | (code >> 6));
+        expected[1] = static_cast<char>(0x80 | (code & 0x3F));
+    } else {
+        expected[0] = static_cast<char>(0xE0 | (code >> 12));
+        expected[1] = static_cast<char>(0x80 | ((code >> 6) & 0x3F));
+        expected[2] = static_cast<char>(0x80 | (code & 0x3F));
+    }
+    RequireSbcToUtf8(profile, sbc, expected);
+}
+
+static void CheckSingleByteProfiles() {
+    constexpr int unassignedCode = static_cast<int>(0x805C0020);
+    const auto getters = {sceCesRefersUcsProfileIso8859_1, sceCesRefersUcsProfileIso8859_2, sceCesRefersUcsProfileIso8859_4, sceCesRefersUcsProfileIso8859_5, sceCesRefersUcsProfileIso8859_9, sceCesRefersUcsProfileIso8859_10, sceCesRefersUcsProfileIso8859_13, sceCesRefersUcsProfileIso8859_14, sceCesRefersUcsProfileIso8859_15, sceCesRefersUcsProfileIso8859_16, sceCesRefersUcsProfileCp437, sceCesRefersUcsProfileCp737, sceCesRefersUcsProfileCp775, sceCesRefersUcsProfileCp850, sceCesRefersUcsProfileCp852, sceCesRefersUcsProfileCp855, sceCesRefersUcsProfileCp860, sceCesRefersUcsProfileCp861, sceCesRefersUcsProfileCp862, sceCesRefersUcsProfileCp863, sceCesRefersUcsProfileCp865, sceCesRefersUcsProfileCp866, sceCesRefersUcsProfileKoi8R, sceCesRefersUcsProfileKoi8U, sceCesRefersUcsProfileCp1254, sceCesRefersUcsProfileCp1256, sceCesRefersUcsProfileCp1258};
+    const void* existing[] = {sceCesRefersUcsProfileCp1252(), sceCesRefersUcsProfileCp1251(), sceCesRefersUcsProfileCp1250()};
+    std::size_t index = 0;
+    for (const auto getter : getters) {
+        const std::uint8_t* profile = getter();
+        Require(profile != nullptr && profile == getter());
+        for (const void* other : existing) Require(profile != other);
+        std::size_t inner = 0;
+        for (const auto earlier : getters) {
+            if (inner++ == index) break;
+            Require(profile != earlier());
+        }
+        ++index;
+        for (int sbc = 1; sbc < 256; ++sbc) {
+            std::uint8_t cp[4] = {};
+            std::uint32_t cpLength = 0;
+            std::uint8_t back = 0;
+            Require(sceCesSbcToUtf8(profile, static_cast<std::uint8_t>(sbc), cp, sizeof(cp), &cpLength) == 0);
+            if (sbc < 0x80) Require(cpLength == 1 && cp[0] == sbc);
+            Require(sceCesUtf8ToSbc(cp, cpLength, &cpLength, profile, &back) == 0 && back == sbc);
+        }
+        Require(Utf8ToSbc(profile, "\xE3\x81\x82", 3) == unassignedCode);
+    }
+    struct Check {
+        decltype(&sceCesRefersUcsProfileIso8859_1) profile;
+        std::uint8_t sbc;
+        std::uint32_t code;
+    };
+    const Check checks[] = {
+        {sceCesRefersUcsProfileIso8859_1, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_1, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileIso8859_1, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_1, 0xFF, 0x00FF},
+        {sceCesRefersUcsProfileIso8859_2, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_2, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileIso8859_2, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_2, 0xFF, 0x02D9},
+        {sceCesRefersUcsProfileIso8859_4, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_4, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileIso8859_4, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_4, 0xFF, 0x02D9},
+        {sceCesRefersUcsProfileIso8859_5, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_5, 0xA4, 0x0404},
+        {sceCesRefersUcsProfileIso8859_5, 0xC1, 0x0421},
+        {sceCesRefersUcsProfileIso8859_5, 0xFF, 0x045F},
+        {sceCesRefersUcsProfileIso8859_9, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_9, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileIso8859_9, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_9, 0xFF, 0x00FF},
+        {sceCesRefersUcsProfileIso8859_10, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_10, 0xA4, 0x012A},
+        {sceCesRefersUcsProfileIso8859_10, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_10, 0xFF, 0x0138},
+        {sceCesRefersUcsProfileIso8859_13, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_13, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileIso8859_13, 0xC1, 0x012E},
+        {sceCesRefersUcsProfileIso8859_13, 0xFF, 0x2019},
+        {sceCesRefersUcsProfileIso8859_14, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_14, 0xA4, 0x010A},
+        {sceCesRefersUcsProfileIso8859_14, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_14, 0xFF, 0x00FF},
+        {sceCesRefersUcsProfileIso8859_15, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_15, 0xA4, 0x20AC},
+        {sceCesRefersUcsProfileIso8859_15, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_15, 0xFF, 0x00FF},
+        {sceCesRefersUcsProfileIso8859_16, 0x80, 0x0080},
+        {sceCesRefersUcsProfileIso8859_16, 0xA4, 0x20AC},
+        {sceCesRefersUcsProfileIso8859_16, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileIso8859_16, 0xFF, 0x00FF},
+        {sceCesRefersUcsProfileCp437, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp437, 0xA4, 0x00F1},
+        {sceCesRefersUcsProfileCp437, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp437, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp737, 0x80, 0x0391},
+        {sceCesRefersUcsProfileCp737, 0xA4, 0x03BD},
+        {sceCesRefersUcsProfileCp737, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp737, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp775, 0x80, 0x0106},
+        {sceCesRefersUcsProfileCp775, 0xA4, 0x017C},
+        {sceCesRefersUcsProfileCp775, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp775, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp850, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp850, 0xA4, 0x00F1},
+        {sceCesRefersUcsProfileCp850, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp850, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp852, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp852, 0xA4, 0x0104},
+        {sceCesRefersUcsProfileCp852, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp852, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp855, 0x80, 0x0452},
+        {sceCesRefersUcsProfileCp855, 0xA4, 0x0446},
+        {sceCesRefersUcsProfileCp855, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp855, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp860, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp860, 0xA4, 0x00F1},
+        {sceCesRefersUcsProfileCp860, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp860, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp861, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp861, 0xA4, 0x00C1},
+        {sceCesRefersUcsProfileCp861, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp861, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp862, 0x80, 0x05D0},
+        {sceCesRefersUcsProfileCp862, 0xA4, 0x00F1},
+        {sceCesRefersUcsProfileCp862, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp862, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp863, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp863, 0xA4, 0x00A8},
+        {sceCesRefersUcsProfileCp863, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp863, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp865, 0x80, 0x00C7},
+        {sceCesRefersUcsProfileCp865, 0xA4, 0x00F1},
+        {sceCesRefersUcsProfileCp865, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp865, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileCp866, 0x80, 0x0410},
+        {sceCesRefersUcsProfileCp866, 0xA4, 0x0434},
+        {sceCesRefersUcsProfileCp866, 0xC1, 0x2534},
+        {sceCesRefersUcsProfileCp866, 0xFF, 0x00A0},
+        {sceCesRefersUcsProfileKoi8R, 0x80, 0x2500},
+        {sceCesRefersUcsProfileKoi8R, 0xA4, 0x2553},
+        {sceCesRefersUcsProfileKoi8R, 0xC1, 0x0430},
+        {sceCesRefersUcsProfileKoi8R, 0xFF, 0x042A},
+        {sceCesRefersUcsProfileKoi8U, 0x80, 0x2500},
+        {sceCesRefersUcsProfileKoi8U, 0xA4, 0x0454},
+        {sceCesRefersUcsProfileKoi8U, 0xC1, 0x0430},
+        {sceCesRefersUcsProfileKoi8U, 0xFF, 0x042A},
+        {sceCesRefersUcsProfileCp1254, 0x80, 0x20AC},
+        {sceCesRefersUcsProfileCp1254, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileCp1254, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileCp1254, 0xFF, 0x00FF},
+        {sceCesRefersUcsProfileCp1256, 0x80, 0x20AC},
+        {sceCesRefersUcsProfileCp1256, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileCp1256, 0xC1, 0x0621},
+        {sceCesRefersUcsProfileCp1256, 0xFF, 0x06D2},
+        {sceCesRefersUcsProfileCp1258, 0x80, 0x20AC},
+        {sceCesRefersUcsProfileCp1258, 0xA4, 0x00A4},
+        {sceCesRefersUcsProfileCp1258, 0xC1, 0x00C1},
+        {sceCesRefersUcsProfileCp1258, 0xFF, 0x00FF},
+    };
+    for (const Check& check : checks) RequireSbcCode(check.profile(), check.sbc, check.code);
+
+    char context[256] = {};
+    Require(sceCesMbcsUcsContextInit(context, sceCesRefersUcsProfileKoi8R()) == 0);
+    std::uint8_t koi8[16] = {};
+    std::uint32_t used = 0;
+    std::uint32_t produced = 0;
+    Require(sceCesUtf8StrToMbcsStr(context, reinterpret_cast<const std::uint8_t*>("\xD0\x9F\xD1\x80\xD0\xB8\xD0\xB2\xD0\xB5\xD1\x82"), 12, &used, koi8, sizeof(koi8), &produced) == 0);
+    Require(used == 12 && produced == 6 && std::memcmp(koi8, "\xF0\xD2\xC9\xD7\xC5\xD4", 6) == 0);
+    std::uint8_t utf8[32] = {};
+    Require(sceCesMbcsStrToUtf8Str(context, koi8, 6, &used, utf8, sizeof(utf8), &produced) == 0);
+    Require(used == 6 && produced == 12 && std::memcmp(utf8, "\xD0\x9F\xD1\x80\xD0\xB8\xD0\xB2\xD0\xB5\xD1\x82", 12) == 0);
+}
+
 int main() {
     constexpr int invalidParameter = static_cast<int>(0x805C0001);
     constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
@@ -57,6 +209,7 @@ int main() {
 
     const std::uint8_t* profile = sceCesRefersUcsProfileCp1252();
     Require(profile != nullptr && profile == sceCesRefersUcsProfileCp1252());
+    CheckSingleByteProfiles();
 
     RequireSbcToUtf8(profile, 'A', "A");
     RequireSbcToUtf8(profile, 0x80, "\xE2\x82\xAC");
@@ -115,28 +268,28 @@ int main() {
     Require(Utf8ToSbc(cyrillic, "\xC3\xA9", 2) == unassignedCode);
     Require(Utf8ToSbc(profile, "\xD0\x90", 2) == unassignedCode);
 
-    const std::uint8_t* latin2 = sceCesRefersUcsProfileCp1250();
+    const void* latin2 = sceCesRefersUcsProfileCp1250();
     Require(latin2 != nullptr && latin2 == sceCesRefersUcsProfileCp1250() && latin2 != profile && latin2 != cyrillic);
-    RequireSbcToUtf8(latin2, 'A', "A");
-    RequireSbcToUtf8(latin2, 0x80, "\xE2\x82\xAC");
-    RequireSbcToUtf8(latin2, 0x81, "\xC2\x81");
-    RequireSbcToUtf8(latin2, 0x8A, "\xC5\xA0");
-    RequireSbcToUtf8(latin2, 0xA3, "\xC5\x81");
-    RequireSbcToUtf8(latin2, 0xA5, "\xC4\x84");
-    RequireSbcToUtf8(latin2, 0xAF, "\xC5\xBB");
-    RequireSbcToUtf8(latin2, 0xE9, "\xC3\xA9");
-    RequireSbcToUtf8(latin2, 0xFF, "\xCB\x99");
-    RequireUtf8ToSbc(latin2, "\xC5\xA0", 0x8A);
-    RequireUtf8ToSbc(latin2, "\xC5\x81", 0xA3);
-    RequireUtf8ToSbc(latin2, "\xC3\xA9", 0xE9);
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 'A', "A");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0x80, "\xE2\x82\xAC");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0x81, "\xC2\x81");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0x8A, "\xC5\xA0");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0xA3, "\xC5\x81");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0xA5, "\xC4\x84");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0xAF, "\xC5\xBB");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0xE9, "\xC3\xA9");
+    RequireSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), 0xFF, "\xCB\x99");
+    RequireUtf8ToSbc(reinterpret_cast<const uint8_t*>(latin2), "\xC5\xA0", 0x8A);
+    RequireUtf8ToSbc(reinterpret_cast<const uint8_t*>(latin2), "\xC5\x81", 0xA3);
+    RequireUtf8ToSbc(reinterpret_cast<const uint8_t*>(latin2), "\xC3\xA9", 0xE9);
     for (int sbc = 1; sbc < 256; ++sbc) {
         std::uint8_t cp[4] = {};
         std::uint32_t cpLength = 0;
         std::uint8_t back = 0;
-        Require(sceCesSbcToUtf8(latin2, static_cast<std::uint8_t>(sbc), cp, sizeof(cp), &cpLength) == 0);
-        Require(sceCesUtf8ToSbc(cp, cpLength, &cpLength, latin2, &back) == 0 && back == sbc);
+        Require(sceCesSbcToUtf8(reinterpret_cast<const uint8_t*>(latin2), static_cast<std::uint8_t>(sbc), cp, sizeof(cp), &cpLength) == 0);
+        Require(sceCesUtf8ToSbc(cp, cpLength, &cpLength, reinterpret_cast<const uint8_t*>(latin2), &back) == 0 && back == sbc);
     }
-    Require(Utf8ToSbc(latin2, "\xD0\x90", 2) == unassignedCode);
+    Require(Utf8ToSbc(reinterpret_cast<const uint8_t*>(latin2), "\xD0\x90", 2) == unassignedCode);
     char latin2Context[256] = {};
     Require(sceCesMbcsUcsContextInit(latin2Context, latin2) == 0);
     std::uint8_t latin2Back[16] = {};
diff --git a/core/libs/tests/GuestCesChinese.cpp b/core/libs/tests/GuestCesChinese.cpp
new file mode 100644
index 0000000000..409b46af74
--- /dev/null
+++ b/core/libs/tests/GuestCesChinese.cpp
@@ -0,0 +1,347 @@
+#include "prx/libSceCesCs/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
+
+static constexpr int invalidParameter = static_cast<int>(0x805C0001);
+static constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+static constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+static constexpr int invalidEncode = static_cast<int>(0x805C0014);
+static constexpr int unassignedCode = static_cast<int>(0x805C0020);
+static constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+static constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+
+struct Gb18030Sequence {
+    std::uint32_t bytes;
+    std::uint32_t code2000;
+    std::uint32_t code2005;
+};
+
+struct Gb18030Difference {
+    std::uint32_t bytes;
+    std::uint32_t code2000;
+    std::uint32_t code2005;
+    bool fallback;
+};
+
+static constexpr Gb18030Sequence GB18030_BOUNDARIES[88] = {
+    {0x81308130, 0x80, 0x80}, {0x8130D239, 0x450, 0x450}, {0x8130D330, 0x452, 0x452}, {0x8135F436, 0x1E3E, 0x1E3E},
+    {0x8135F437, 0x1E3F, 0xE7C7}, {0x8135F438, 0x1E40, 0x1E40}, {0x8136A531, 0x200F, 0x200F}, {0x8136A532, 0x2011, 0x2011},
+    {0x8137A838, 0x2641, 0x2641}, {0x8137A839, 0x2643, 0x2643}, {0x8138FD38, 0x2E80, 0x2E80}, {0x8138FD39, 0x2E82, 0x2E82},
+    {0x8230A632, 0x3619, 0x3619}, {0x8230A633, 0x361B, 0x361B}, {0x8230F237, 0x3917, 0x3917}, {0x8230F238, 0x3919, 0x3919},
+    {0x8231D437, 0x3CDF, 0x3CDF}, {0x8231D438, 0x3CE1, 0x3CE1}, {0x8232AF32, 0x4055, 0x4055}, {0x8232AF33, 0x4057, 0x4057},
+    {0x8232C936, 0x415E, 0x415E}, {0x8232C937, 0x4160, 0x4160}, {0x8232F837, 0x4336, 0x4336}, {0x8232F838, 0x4338, 0x4338},
+    {0x8233A338, 0x44D5, 0x44D5}, {0x8233A339, 0x44D7, 0x44D7}, {0x8233C931, 0x464B, 0x464B}, {0x8233C932, 0x464D, 0x464D},
+    {0x8233E837, 0x478C, 0x478C}, {0x8233E838, 0x478E, 0x478E}, {0x82349638, 0x4946, 0x4946}, {0x82349639, 0x4948, 0x4948},
+    {0x8234A130, 0x49B5, 0x49B5}, {0x8234A131, 0x49B8, 0x49B8}, {0x8234E733, 0x4C76, 0x4C76}, {0x8234E734, 0x4C78, 0x4C78},
+    {0x82358F32, 0x4DFF, 0x4DFF}, {0x82358F33, 0x9FA6, 0x9FA6}, {0x8336C738, 0xD7FF, 0xD7FF}, {0x8336C739, 0xE76C, 0xE76C},
+    {0x8336CF39, 0xE863, 0xE863}, {0x8336D030, 0xE865, 0xE865}, {0x84308534, 0xF92B, 0xF92B}, {0x84308535, 0xF92D, 0xF92D},
+    {0x84309C37, 0xFA26, 0xFA26}, {0x84309C38, 0xFA2A, 0xFA2A}, {0x84318537, 0xFE2F, 0xFE2F}, {0x84318538, 0xFE32, 0xFE32},
+    {0x8431A233, 0xFFDF, 0xFFDF}, {0x8431A234, 0xFFE6, 0xFFE6}, {0x8431A439, 0xFFFF, 0xFFFF}, {0x8431A530, 0x0, 0x0},
+    {0x8F39FE39, 0x0, 0x0}, {0x90308130, 0x10000, 0x10000}, {0x95328235, 0x1FFFF, 0x1FFFF}, {0x95328236, 0x20000, 0x20000},
+    {0x9A348431, 0x2FFFF, 0x2FFFF}, {0x9A348432, 0x30000, 0x30000}, {0x9F368537, 0x3FFFF, 0x3FFFF}, {0x9F368538, 0x40000, 0x40000},
+    {0xA4388733, 0x4FFFF, 0x4FFFF}, {0xA4388734, 0x50000, 0x50000}, {0xAA308839, 0x5FFFF, 0x5FFFF}, {0xAA308930, 0x60000, 0x60000},
+    {0xAF328A35, 0x6FFFF, 0x6FFFF}, {0xAF328A36, 0x70000, 0x70000}, {0xB4348C31, 0x7FFFF, 0x7FFFF}, {0xB4348C32, 0x80000, 0x80000},
+    {0xB9368D37, 0x8FFFF, 0x8FFFF}, {0xB9368D38, 0x90000, 0x90000}, {0xBE388F33, 0x9FFFF, 0x9FFFF}, {0xBE388F34, 0xA0000, 0xA0000},
+    {0xC4309039, 0xAFFFF, 0xAFFFF}, {0xC4309130, 0xB0000, 0xB0000}, {0xC9329235, 0xBFFFF, 0xBFFFF}, {0xC9329236, 0xC0000, 0xC0000},
+    {0xCE349431, 0xCFFFF, 0xCFFFF}, {0xCE349432, 0xD0000, 0xD0000}, {0xD3369537, 0xDFFFF, 0xDFFFF}, {0xD3369538, 0xE0000, 0xE0000},
+    {0xD8389733, 0xEFFFF, 0xEFFFF}, {0xD8389734, 0xF0000, 0xF0000}, {0xDE309839, 0xFFFFF, 0xFFFFF}, {0xDE309930, 0x100000, 0x100000},
+    {0xE3329A35, 0x10FFFF, 0x10FFFF}, {0xE3329A36, 0x0, 0x0}, {0xFD308130, 0x0, 0x0}, {0xFE39FE39, 0x0, 0x0},
+};
+static constexpr Gb18030Difference GB18030_DIFFERENCES[26] = {
+    {0xA6D9, 0xE78D, 0xFE10, true}, {0xA6DA, 0xE78E, 0xFE12, true}, {0xA6DB, 0xE78F, 0xFE11, true}, {0xA6DC, 0xE790, 0xFE13, true},
+    {0xA6DD, 0xE791, 0xFE14, true}, {0xA6DE, 0xE792, 0xFE15, true}, {0xA6DF, 0xE793, 0xFE16, true}, {0xA6EC, 0xE794, 0xFE17, true},
+    {0xA6ED, 0xE795, 0xFE18, true}, {0xA6F3, 0xE796, 0xFE19, true}, {0xA8BC, 0xE7C7, 0x1E3F, false}, {0xFE51, 0xE816, 0x20087, true},
+    {0xFE52, 0xE817, 0x20089, true}, {0xFE53, 0xE818, 0x200CC, true}, {0xFE59, 0xE81E, 0x9FB4, true}, {0xFE61, 0xE826, 0x9FB5, true},
+    {0xFE66, 0xE82B, 0x9FB6, true}, {0xFE67, 0xE82C, 0x9FB7, true}, {0xFE6C, 0xE831, 0x215D7, true}, {0xFE6D, 0xE832, 0x9FB8, true},
+    {0xFE76, 0xE83B, 0x2298F, true}, {0xFE7E, 0xE843, 0x9FB9, true}, {0xFE90, 0xE854, 0x9FBA, true}, {0xFE91, 0xE855, 0x241FE, true},
+    {0xFEA0, 0xE864, 0x9FBB, true}, {0x8135F437, 0x1E3F, 0xE7C7, false},
+};
+static std::uint32_t Gb18030Bytes(std::uint32_t linear) {
+    return (0x81 + linear / 12600) << 24 | (0x30 + linear / 1260 % 10) << 16 | (0x81 + linear / 10 % 126) << 8 | (0x30 + linear % 10);
+}
+
+static void Fnv(std::uint32_t& hash, std::uint32_t value) {
+    for (int i = 0; i < 4; ++i) {
+        hash ^= (value >> (8 * i)) & 0xFF;
+        hash *= 0x01000193;
+    }
+}
+
+static std::uint32_t Gb18030Decode(const void* gb, std::uint32_t packed) {
+    std::uint8_t bytes[4] = {};
+    const std::uint32_t size = packed > 0xFFFF ? 4 : 2;
+    for (std::uint32_t i = 0; i < size; ++i) bytes[i] = static_cast<std::uint8_t>(packed >> (8 * (size - 1 - i)));
+    std::uint32_t consumed = 0x55;
+    std::uint32_t code = 0xDEADBEEF;
+    const int result = sceCesGbToUtf32(gb, bytes, size, &consumed, &code);
+    if (result != 0) {
+        Require(result == unassignedCode && consumed == 0x55 && code == 0xDEADBEEF);
+        return 0;
+    }
+    Require(consumed == size);
+    return code;
+}
+
+static std::uint32_t Gb18030Encode(const void* gb, std::uint32_t code) {
+    std::uint8_t bytes[4] = {};
+    std::uint32_t size = 0;
+    Require(sceCesUtf32ToGb(code, gb, bytes, sizeof(bytes), &size) == 0 && (size == 2 || size == 4));
+    std::uint32_t packed = 0;
+    for (std::uint32_t i = 0; i < size; ++i) packed = packed << 8 | bytes[i];
+    return packed;
+}
+
+static void RequireGb18030Error(const void* gb, const char* bytes, std::uint32_t size, int error) {
+    std::uint32_t consumed = 0x55;
+    std::uint32_t utf32 = 0xDEADBEEF;
+    Require(sceCesGbToUtf32(gb, Bytes(bytes), size, &consumed, &utf32) == error && consumed == 0x55 && utf32 == 0xDEADBEEF);
+    std::uint16_t ucs2 = 0xBEEF;
+    Require(sceCesMbcToUcs2(gb, Bytes(bytes), size, &consumed, &ucs2) == error && consumed == 0x55 && ucs2 == 0xBEEF);
+}
+
+static void CheckGb18030(const void* gb, bool revision2005, std::uint32_t twoByteHash, std::uint32_t fourByteHash, std::uint32_t encodeHash, int fourByteOneWay, int codeOneWay) {
+    std::uint32_t hash = 0x811C9DC5;
+    for (std::uint32_t cell = 0; cell < 126 * 190; ++cell) {
+        const std::uint32_t column = cell % 190;
+        const std::uint32_t bytes = (0x81 + cell / 190) << 8 | (column < 0x3F ? 0x40 + column : 0x41 + column);
+        const std::uint32_t code = Gb18030Decode(gb, bytes);
+        Require(code != 0 && Gb18030Encode(gb, code) == bytes);
+        Fnv(hash, code);
+    }
+    Require(hash == twoByteHash);
+
+    hash = 0x811C9DC5;
+    int oneWay = 0;
+    for (std::uint32_t linear = 0; linear < 39420; ++linear) {
+        const std::uint32_t bytes = Gb18030Bytes(linear);
+        const std::uint32_t code = Gb18030Decode(gb, bytes);
+        Require(code >= 0x80 && code <= 0xFFFF);
+        const std::uint32_t back = Gb18030Encode(gb, code);
+        if (back != bytes) {
+            Require(back <= 0xFFFF && Gb18030Decode(gb, back) == code);
+            ++oneWay;
+        }
+        Fnv(hash, code);
+    }
+    Require(hash == fourByteHash && oneWay == fourByteOneWay);
+
+    hash = 0x811C9DC5;
+    oneWay = 0;
+    for (std::uint32_t code = 0x80; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        const std::uint32_t bytes = Gb18030Encode(gb, code);
+        if (Gb18030Decode(gb, bytes) != code) ++oneWay;
+        Fnv(hash, bytes);
+    }
+    Require(hash == encodeHash && oneWay == codeOneWay);
+
+    hash = 0x811C9DC5;
+    int samples = 0;
+    for (std::uint32_t linear = 189000; linear <= 189000 + 0xFFFFF; linear += 997) {
+        Fnv(hash, Gb18030Decode(gb, Gb18030Bytes(linear)));
+        ++samples;
+    }
+    Require(hash == 0x9E77B552 && samples == 1052);
+    hash = 0x811C9DC5;
+    for (std::uint32_t code = 0x10000; code < 0x110000; code += 997) Fnv(hash, Gb18030Encode(gb, code));
+    Require(hash == 0x3D088D7E);
+
+    for (const Gb18030Sequence& entry : GB18030_BOUNDARIES) {
+        const std::uint32_t code = revision2005 ? entry.code2005 : entry.code2000;
+        Require(Gb18030Decode(gb, entry.bytes) == code);
+        if (code != 0) Require(Gb18030Encode(gb, code) == entry.bytes);
+    }
+    for (const Gb18030Difference& entry : GB18030_DIFFERENCES) {
+        const std::uint32_t code = revision2005 ? entry.code2005 : entry.code2000;
+        Require(Gb18030Decode(gb, entry.bytes) == code && Gb18030Encode(gb, code) == entry.bytes);
+        if (revision2005 && entry.fallback) Require(Gb18030Encode(gb, entry.code2000) == entry.bytes);
+    }
+
+    RequireGb18030Error(gb, "\x80", 1, invalidEncode);
+    RequireGb18030Error(gb, "\xFF", 1, invalidEncode);
+    RequireGb18030Error(gb, "\x81", 1, srcBufferEnd);
+    RequireGb18030Error(gb, "\x81\x30", 2, srcBufferEnd);
+    RequireGb18030Error(gb, "\x81\x30\x81", 3, srcBufferEnd);
+    RequireGb18030Error(gb, "\x81\x00", 2, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x2F", 2, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x3A", 2, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x7F", 2, invalidEncode);
+    RequireGb18030Error(gb, "\x81\xFF", 2, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x30\x80\x30", 4, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x30\xFF\x30", 4, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x30\x30\x30", 4, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x30\x81\x2F", 4, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x30\x81\x3A", 4, invalidEncode);
+    RequireGb18030Error(gb, "\x81\x30\x81\x81", 4, invalidEncode);
+    RequireGb18030Error(gb, "\x84\x31\xA5\x30", 4, unassignedCode);
+    RequireGb18030Error(gb, "\xE3\x32\x9A\x36", 4, unassignedCode);
+    RequireGb18030Error(gb, "\xFE\x39\xFE\x39", 4, unassignedCode);
+
+    std::uint32_t consumed = 0x55;
+    std::uint32_t produced = 0x55;
+    std::uint16_t ucs2 = 0xBEEF;
+    Require(sceCesGbToUcs2(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, &ucs2) == unassignedCode && consumed == 0x55 && ucs2 == 0xBEEF);
+    std::uint8_t utf8[4] = {1, 2, 3, 4};
+    Require(sceCesGbToUtf8(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, utf8, 3, &produced) == dstBufferEnd && consumed == 0x55 && produced == 0x55);
+    Require(std::memcmp(utf8, "\x01\x02\x03\x04", 4) == 0);
+    Require(sceCesGbToUtf8(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, utf8, 4, &produced) == 0 && consumed == 4 && produced == 4);
+    Require(std::memcmp(utf8, "\xF0\x90\x80\x80", 4) == 0);
+    std::uint16_t utf16[2] = {0xBEEF, 0xBEEF};
+    produced = 0x55;
+    Require(sceCesGbToUtf16(gb, Bytes("\xE3\x32\x9A\x35"), 4, &consumed, utf16, 1, &produced) == dstBufferEnd && produced == 0x55 && utf16[0] == 0xBEEF);
+    Require(sceCesGbToUtf16(gb, Bytes("\xE3\x32\x9A\x35"), 4, &consumed, utf16, 2, &produced) == 0 && produced == 2 && utf16[0] == 0xDBFF && utf16[1] == 0xDFFF);
+    Require(sceCesGbToUtf16be(gb, Bytes("\x90\x30\x81\x30"), 4, &consumed, utf16, 2, &produced) == 0 && std::memcmp(utf16, "\xD8\x00\xDC\x00", 4) == 0);
+    Require(sceCesMbcToUtf16le(gb, Bytes("\x94\x39\xFC\x36"), 4, &consumed, utf16, 2, &produced) == 0 && consumed == 4 && std::memcmp(utf16, "\x3D\xD8\x00\xDE", 4) == 0);
+    Require(sceCesGbToUcs2(gb, Bytes("\xA2\xE3"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x20AC);
+
+    std::uint8_t mbcs[4] = {1, 2, 3, 4};
+    produced = 0x55;
+    Require(sceCesUtf32ToGb(0x10000, gb, mbcs, 3, &produced) == dstBufferEnd && produced == 0x55 && std::memcmp(mbcs, "\x01\x02\x03\x04", 4) == 0);
+    Require(sceCesUtf32ToGb(0xD800, gb, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUtf32ToGb(0x110000, gb, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUcs2ToGb(0x80, gb, mbcs, sizeof(mbcs), &produced) == 0 && produced == 4 && std::memcmp(mbcs, "\x81\x30\x81\x30", 4) == 0);
+    Require(sceCesUcs2ToGb(0x20AC, gb, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\xA2\xE3", 2) == 0);
+    Require(sceCesUtf8ToGb(Bytes("\xF0\x9F\x98\x80"), 4, &consumed, gb, mbcs, sizeof(mbcs), &produced) == 0 && consumed == 4 && produced == 4);
+    Require(std::memcmp(mbcs, "\x94\x39\xFC\x36", 4) == 0);
+    const std::uint16_t pair[2] = {0xD83D, 0xDE00};
+    Require(sceCesUtf16ToGb(pair, 2, &consumed, gb, mbcs, sizeof(mbcs), &produced) == 0 && consumed == 2 && produced == 4 && std::memcmp(mbcs, "\x94\x39\xFC\x36", 4) == 0);
+    Require(sceCesUtf16ToGb(pair, 1, &consumed, gb, mbcs, sizeof(mbcs), &produced) == srcBufferEnd);
+
+    alignas(8) std::uint8_t context[64] = {};
+    Require(sceCesMbcsUcsContextInit(context, gb) == 0);
+    const char* utf8Text = "A\xE4\xB8\xAD\xC2\x80\xF0\x9F\x98\x80\xEF\xB8\x90";
+    const char* gbText = revision2005 ? "A\xD6\xD0\x81\x30\x81\x30\x94\x39\xFC\x36\xA6\xD9" : "A\xD6\xD0\x81\x30\x81\x30\x94\x39\xFC\x36\x84\x31\x82\x36";
+    const std::uint32_t gbSize = revision2005 ? 13 : 15;
+    std::uint8_t text[16] = {};
+    Require(sceCesUtf8StrToMbcsStr(context, Bytes(utf8Text), 13, &consumed, text, sizeof(text), &produced) == 0 && consumed == 13 && produced == gbSize);
+    Require(std::memcmp(text, gbText, gbSize) == 0);
+    std::uint8_t backUtf8[16] = {};
+    Require(sceCesMbcsStrToUtf8Str(context, text, gbSize, &consumed, backUtf8, sizeof(backUtf8), &produced) == 0 && consumed == gbSize && produced == 13);
+    Require(std::memcmp(backUtf8, utf8Text, 13) == 0);
+    std::uint16_t backUtf16[8] = {};
+    Require(sceCesMbcsStrToUtf16Str(context, text, gbSize, &consumed, backUtf16, 8, &produced) == 0 && consumed == gbSize && produced == 6);
+    Require(backUtf16[0] == 'A' && backUtf16[1] == 0x4E2D && backUtf16[2] == 0x80 && backUtf16[3] == 0xD83D && backUtf16[4] == 0xDE00 && backUtf16[5] == 0xFE10);
+    Require(sceCesMbcsStrToUtf16Str(context, text, gbSize, &consumed, backUtf16, 4, &produced) == dstBufferEnd);
+    Require(sceCesMbcsStrGetUtf16Len(context, text, gbSize, &consumed, &produced) == 0 && consumed == gbSize && produced == 6);
+    std::uint8_t again[16] = {};
+    Require(sceCesUtf16StrToMbcsStr(context, backUtf16, 6, &consumed, again, sizeof(again), &produced) == 0 && consumed == 6 && produced == gbSize);
+    Require(std::memcmp(again, gbText, gbSize) == 0);
+    std::uint16_t ucs2Text[8] = {};
+    Require(sceCesMbcsStrToUcs2Str(context, text, gbSize, &consumed, ucs2Text, 8, &produced) == unassignedCode);
+    Require(sceCesUtf8StrToMbcsStr(context, Bytes("\xC2\x80"), 2, &consumed, text, 3, &produced) == dstBufferEnd);
+}
+
+int main() {
+    alignas(8) std::uint8_t eucSheet[64] = {};
+    alignas(8) std::uint8_t gbkSheet[64] = {};
+    alignas(8) std::uint8_t sjisSheet[64] = {};
+    const void* euc = sceCesUcsProfileInitEucCnGb2312(eucSheet);
+    const void* gbk = sceCesUcsProfileInitGbkCp936(gbkSheet);
+    const void* sjis = sceCesUcsProfileInitSJis1997Cp932(sjisSheet);
+    Require(euc == eucSheet && gbk == gbkSheet);
+    Require(sceCesUcsProfileInitEucCnGb2312(nullptr) == nullptr && sceCesUcsProfileInitGbkCp936(nullptr) == nullptr);
+
+    std::uint32_t consumed = 0;
+    std::uint32_t produced = 0;
+    std::uint16_t ucs2 = 0;
+    Require(sceCesEucCnToUcs2(euc, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x4E2D);
+    Require(sceCesEucCnToUcs2(euc, Bytes("A"), 1, &consumed, &ucs2) == 0 && consumed == 1 && ucs2 == 'A');
+    Require(sceCesEucCnToUcs2(euc, Bytes("\xA1\xA4"), 2, &consumed, &ucs2) == 0 && ucs2 == 0x00B7);
+    Require(sceCesEucCnToUcs2(euc, Bytes("\x80"), 1, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesEucCnToUcs2(euc, Bytes("\x81\x40"), 2, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesEucCnToUcs2(euc, Bytes("\xD6\x40"), 2, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesEucCnToUcs2(euc, Bytes("\xD6\xD0"), 1, &consumed, &ucs2) == srcBufferEnd);
+    Require(sceCesEucCnToUcs2(euc, Bytes("\xAA\xA1"), 2, &consumed, &ucs2) == unassignedCode);
+    Require(sceCesEucCnToUcs2(gbk, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesEucCnToUcs2(euc, nullptr, 2, &consumed, &ucs2) == invalidSrcBuffer);
+    Require(sceCesEucCnToUcs2(euc, Bytes("\xD6\xD0"), 2, &consumed, nullptr) == invalidDstBuffer);
+
+    std::uint8_t utf8[4] = {};
+    Require(sceCesEucCnToUtf8(euc, Bytes("\xCE\xC4"), 2, &consumed, utf8, sizeof(utf8), &produced) == 0);
+    Require(produced == 3 && std::memcmp(utf8, "\xE6\x96\x87", 3) == 0);
+    std::uint16_t utf16 = 0;
+    Require(sceCesEucCnToUtf16be(euc, Bytes("\xD6\xD0"), 2, &consumed, &utf16, 1, &produced) == 0 && std::memcmp(&utf16, "\x4E\x2D", 2) == 0);
+    std::uint32_t utf32 = 0;
+    Require(sceCesEucCnToUtf32(euc, Bytes("\xD6\xD0"), 2, &consumed, &utf32) == 0 && utf32 == 0x4E2D);
+
+    Require(sceCesGbToUcs2(gbk, Bytes("\x80"), 1, &consumed, &ucs2) == 0 && consumed == 1 && ucs2 == 0x20AC);
+    Require(sceCesGbToUcs2(gbk, Bytes("\x81\x40"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x4E02);
+    Require(sceCesGbToUcs2(gbk, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == 0 && ucs2 == 0x4E2D);
+    Require(sceCesGbToUcs2(gbk, Bytes("\xFF"), 1, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesGbToUcs2(gbk, Bytes("\x81\x7F"), 2, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesGbToUcs2(gbk, Bytes("\x81\x3F"), 2, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesGbToUcs2(euc, Bytes("\x81\x40"), 2, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesGbToUcs2(sjis, Bytes("A"), 1, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesGbToUtf8(gbk, Bytes("\x80"), 1, &consumed, utf8, sizeof(utf8), &produced) == 0);
+    Require(produced == 3 && std::memcmp(utf8, "\xE2\x82\xAC", 3) == 0);
+    Require(sceCesGbToUtf8(gbk, Bytes("\x80"), 1, &consumed, utf8, 2, &produced) == dstBufferEnd);
+    Require(sceCesGbToUtf16(gbk, Bytes("\x81\x40"), 2, &consumed, &utf16, 1, &produced) == 0 && utf16 == 0x4E02 && produced == 1);
+    Require(sceCesGbToUtf32le(gbk, Bytes("\x81\x40"), 2, &consumed, &utf32) == 0 && std::memcmp(&utf32, "\x02\x4E\x00\x00", 4) == 0);
+
+    std::uint8_t mbcs[4] = {};
+    Require(sceCesUcs2ToEucCn(0x4E2D, euc, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\xD6\xD0", 2) == 0);
+    Require(sceCesUcs2ToEucCn(0x4E02, euc, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(sceCesUcs2ToEucCn(0x20AC, euc, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(sceCesUcs2ToEucCn(0x4E2D, euc, mbcs, 1, &produced) == dstBufferEnd);
+    Require(sceCesUcs2ToEucCn(0xDC00, euc, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUcs2ToGb(0x4E02, gbk, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\x81\x40", 2) == 0);
+    Require(sceCesUcs2ToGb(0x20AC, gbk, mbcs, sizeof(mbcs), &produced) == 0 && produced == 1 && mbcs[0] == 0x80);
+    Require(sceCesUcs2ToGb(0x3042, euc, mbcs, sizeof(mbcs), &produced) == invalidParameter);
+    Require(sceCesUcs2ToGb(0x3042, gbk, nullptr, sizeof(mbcs), &produced) == invalidDstBuffer);
+    Require(sceCesUtf8ToEucCn(Bytes("\xE6\x96\x87"), 3, &consumed, euc, mbcs, sizeof(mbcs), &produced) == 0);
+    Require(consumed == 3 && std::memcmp(mbcs, "\xCE\xC4", 2) == 0);
+    Require(sceCesUtf8ToGb(Bytes("\xF0\x9F\x98\x80"), 4, &consumed, gbk, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    std::uint16_t zhongLe = 0;
+    std::memcpy(&zhongLe, "\x2D\x4E", 2);
+    Require(sceCesUtf16leToGb(&zhongLe, 1, &consumed, gbk, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\xD6\xD0", 2) == 0);
+    Require(sceCesUtf32ToEucCn(0x110000, euc, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    std::uint32_t zhongBe = 0;
+    std::memcpy(&zhongBe, "\x00\x00\x4E\x2D", 4);
+    Require(sceCesUtf32beToGb(&zhongBe, gbk, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\xD6\xD0", 2) == 0);
+
+    int gbkCount = 0;
+    int eucCount = 0;
+    for (int code = 1; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        std::uint8_t encoded[4] = {};
+        std::uint32_t size = 0;
+        std::uint16_t back = 0;
+        if (sceCesUcs2ToGb(static_cast<std::uint16_t>(code), gbk, encoded, sizeof(encoded), &size) == 0) {
+            Require(sceCesGbToUcs2(gbk, encoded, size, &consumed, &back) == 0 && consumed == size && back == code);
+            ++gbkCount;
+        }
+        if (sceCesUcs2ToEucCn(static_cast<std::uint16_t>(code), euc, encoded, sizeof(encoded), &size) == 0) {
+            Require(size == 1 || (encoded[0] >= 0xA1 && encoded[1] >= 0xA1));
+            Require(sceCesEucCnToUcs2(euc, encoded, size, &consumed, &back) == 0 && consumed == size && back == code);
+            ++eucCount;
+        }
+    }
+    Require(gbkCount == 127 + 1 + 21791 && eucCount > 127 + 7000 && eucCount < gbkCount);
+
+    alignas(8) std::uint8_t context[64] = {};
+    Require(sceCesMbcsUcsContextInit(context, gbk) == 0);
+    std::uint8_t text[16] = {};
+    Require(sceCesUtf8StrToMbcsStr(context, Bytes("A\xE4\xB8\xAD\xE2\x82\xAC"), 16, &consumed, text, sizeof(text), &produced) == 0);
+    Require(consumed == 7 && produced == 4 && std::memcmp(text, "A\xD6\xD0\x80", 4) == 0);
+    std::uint8_t back[16] = {};
+    Require(sceCesMbcsStrToUtf8Str(context, text, produced, &consumed, back, sizeof(back), &produced) == 0);
+    Require(consumed == 4 && produced == 7 && std::memcmp(back, "A\xE4\xB8\xAD\xE2\x82\xAC", 7) == 0);
+
+    alignas(8) std::uint8_t gb2000Sheet[64] = {};
+    alignas(8) std::uint8_t gb2005Sheet[64] = {};
+    const void* gb2000 = sceCesUcsProfileInitGb18030_2000(gb2000Sheet);
+    const void* gb2005 = sceCesUcsProfileInitGb18030_2005(gb2005Sheet);
+    Require(gb2000 == gb2000Sheet && gb2005 == gb2005Sheet);
+    Require(sceCesUcsProfileInitGb18030_2000(nullptr) == nullptr && sceCesUcsProfileInitGb18030_2005(nullptr) == nullptr);
+    Require(sceCesEucCnToUcs2(gb2000, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesGbToUcs2(gb2005, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x4E2D);
+    CheckGb18030(gb2000, false, 0xE61D3BD3, 0x83476043, 0x469CFCE5, 0, 0);
+    CheckGb18030(gb2005, true, 0x83EDDA69, 0x8D188DFC, 0x31CD0B55, 18, 24);
+    return 0;
+}
diff --git a/core/libs/tests/GuestCesDbcs.cpp b/core/libs/tests/GuestCesDbcs.cpp
index 552f5193e9..044d48e641 100644
--- a/core/libs/tests/GuestCesDbcs.cpp
+++ b/core/libs/tests/GuestCesDbcs.cpp
@@ -1,24 +1,40 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void* APS5_VABI sceCesUcsProfileInitEucKr(void*);
-void* APS5_VABI sceCesUcsProfileInitUhc(void*);
-void* APS5_VABI sceCesUcsProfileInitBig5Cp950(void*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesEucKrToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUhcToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesBig5ToUtf8(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsUcsContextInit(void*, const void*);
-int APS5_VABI sceCesUtf8StrToMbcsStr(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUtf8Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesUcs2StrToMbcsStr(void*, const std::uint16_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceCesMbcsStrToUcs2Str(void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
-}
-
 using ToUtf8 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using ToUcs2 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*);
+using ToUtf16 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint16_t*, std::uint32_t, std::uint32_t*);
+using ToUtf32 = int (APS5_VABI*)(const void*, const std::uint8_t*, std::uint32_t, std::uint32_t*, std::uint32_t*);
+using FromUcs2 = int (APS5_VABI*)(std::uint16_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf8 = int (APS5_VABI*)(const std::uint8_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf16 = int (APS5_VABI*)(const std::uint16_t*, std::uint32_t, std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf32 = int (APS5_VABI*)(std::uint32_t, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+using FromUtf32Unit = int (APS5_VABI*)(const std::uint32_t*, const void*, std::uint8_t*, std::uint32_t, std::uint32_t*);
+
+struct Decoders {
+    ToUtf8 utf8;
+    ToUcs2 ucs2;
+    ToUtf16 utf16[3];
+    ToUtf32 utf32[3];
+};
+
+struct Encoders {
+    FromUcs2 ucs2;
+    FromUtf8 utf8;
+    FromUtf16 utf16[3];
+    FromUtf32 utf32;
+    FromUtf32Unit utf32Unit[3];
+};
+
+constexpr Decoders eucKrDecoders = {sceCesEucKrToUtf8, sceCesEucKrToUcs2, {sceCesEucKrToUtf16, sceCesEucKrToUtf16be, sceCesEucKrToUtf16le}, {sceCesEucKrToUtf32, sceCesEucKrToUtf32be, sceCesEucKrToUtf32le}};
+constexpr Decoders uhcDecoders = {sceCesUhcToUtf8, sceCesUhcToUcs2, {sceCesUhcToUtf16, sceCesUhcToUtf16be, sceCesUhcToUtf16le}, {sceCesUhcToUtf32, sceCesUhcToUtf32be, sceCesUhcToUtf32le}};
+constexpr Decoders big5Decoders = {sceCesBig5ToUtf8, sceCesBig5ToUcs2, {sceCesBig5ToUtf16, sceCesBig5ToUtf16be, sceCesBig5ToUtf16le}, {sceCesBig5ToUtf32, sceCesBig5ToUtf32be, sceCesBig5ToUtf32le}};
+constexpr Encoders eucKrEncoders = {sceCesUcs2ToEucKr, sceCesUtf8ToEucKr, {sceCesUtf16ToEucKr, sceCesUtf16beToEucKr, sceCesUtf16leToEucKr}, sceCesUtf32ToEucKr, {nullptr, sceCesUtf32beToEucKr, sceCesUtf32leToEucKr}};
+constexpr Encoders uhcEncoders = {sceCesUcs2ToUhc, sceCesUtf8ToUhc, {sceCesUtf16ToUhc, sceCesUtf16beToUhc, sceCesUtf16leToUhc}, sceCesUtf32ToUhc, {nullptr, sceCesUtf32beToUhc, sceCesUtf32leToUhc}};
+constexpr Encoders big5Encoders = {sceCesUcs2ToBig5, sceCesUtf8ToBig5, {sceCesUtf16ToBig5, sceCesUtf16beToBig5, sceCesUtf16leToBig5}, sceCesUtf32ToBig5, {nullptr, sceCesUtf32beToBig5, sceCesUtf32leToBig5}};
 
 constexpr int invalidParameter = static_cast<int>(0x805C0001);
 constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
@@ -110,6 +126,137 @@ static std::uint32_t RoundTripMismatches(void* context) {
     return mismatches;
 }
 
+static std::uint32_t Load(const void* data, std::uint32_t size, int order) {
+    if (order == 0) {
+        std::uint16_t unit = 0;
+        std::uint32_t wide = 0;
+        if (size == 2) std::memcpy(&unit, data, 2);
+        else std::memcpy(&wide, data, 4);
+        return size == 2 ? unit : wide;
+    }
+    const auto* bytes = static_cast<const std::uint8_t*>(data);
+    std::uint32_t value = 0;
+    for (std::uint32_t i = 0; i < size; ++i) value |= static_cast<std::uint32_t>(bytes[i]) << (8 * (order == 1 ? size - 1 - i : i));
+    return value;
+}
+
+static void Store(void* data, std::uint32_t size, int order, std::uint32_t value) {
+    if (order == 0) {
+        const auto unit = static_cast<std::uint16_t>(value);
+        if (size == 2) std::memcpy(data, &unit, 2);
+        else std::memcpy(data, &value, 4);
+        return;
+    }
+    auto* bytes = static_cast<std::uint8_t*>(data);
+    for (std::uint32_t i = 0; i < size; ++i) bytes[i] = static_cast<std::uint8_t>(value >> (8 * (order == 1 ? size - 1 - i : i)));
+}
+
+static std::uint32_t Utf8Code(const std::uint8_t* utf8, std::uint32_t length) {
+    if (length == 1) return utf8[0];
+    if (length == 2) return (utf8[0] & 0x1Fu) << 6 | (utf8[1] & 0x3Fu);
+    return (utf8[0] & 0x0Fu) << 12 | (utf8[1] & 0x3Fu) << 6 | (utf8[2] & 0x3Fu);
+}
+
+static std::uint32_t Utf8Bytes(std::uint32_t code, std::uint8_t* utf8) {
+    if (code < 0x80) {
+        utf8[0] = static_cast<std::uint8_t>(code);
+        return 1;
+    }
+    const std::uint32_t length = code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+    for (std::uint32_t i = length - 1; i > 0; --i) {
+        utf8[i] = static_cast<std::uint8_t>(0x80 | (code & 0x3F));
+        code >>= 6;
+    }
+    utf8[0] = static_cast<std::uint8_t>((length == 2 ? 0xC0 : length == 3 ? 0xE0 : 0xF0) | code);
+    return length;
+}
+
+static void RequireDecoders(const Decoders& decoders, const void* profile) {
+    for (std::uint32_t lead = 0; lead < 256; ++lead) {
+        for (std::uint32_t trail = 0; trail < 256; ++trail) {
+            const std::uint8_t source[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
+            std::uint8_t utf8[4] = {};
+            std::uint32_t consumed = 0;
+            std::uint32_t produced = 0;
+            const int expected = decoders.utf8(profile, source, sizeof(source), &consumed, utf8, sizeof(utf8), &produced);
+            const std::uint32_t code = expected == 0 ? Utf8Code(utf8, produced) : 0;
+            std::uint16_t ucs2 = 0x5555;
+            std::uint32_t read = 77;
+            Require(decoders.ucs2(profile, source, sizeof(source), &read, &ucs2) == expected);
+            Require(expected == 0 ? read == consumed && ucs2 == code : read == 77 && ucs2 == 0x5555);
+            for (int order = 0; order < 3; ++order) {
+                std::uint16_t utf16 = 0x5555;
+                std::uint32_t units = 77;
+                read = 77;
+                Require(decoders.utf16[order](profile, source, sizeof(source), &read, &utf16, 1, &units) == expected);
+                Require(expected == 0 ? read == consumed && units == 1 && Load(&utf16, 2, order) == code : read == 77 && units == 77 && utf16 == 0x5555);
+                std::uint32_t utf32 = 0x55555555;
+                read = 77;
+                Require(decoders.utf32[order](profile, source, sizeof(source), &read, &utf32) == expected);
+                Require(expected == 0 ? read == consumed && Load(&utf32, 4, order) == code : read == 77 && utf32 == 0x55555555);
+            }
+        }
+    }
+}
+
+struct Encoded {
+    std::uint8_t bytes[2] = {0x55, 0x55};
+    std::uint32_t size = 77;
+    std::uint32_t read = 77;
+};
+
+static int Encode(const Encoders& encoders, int form, std::uint32_t code, const void* profile, Encoded& out) {
+    std::uint8_t utf8[4] = {};
+    std::uint16_t utf16[2] = {};
+    std::uint32_t utf32 = 0;
+    if (form == 0) return encoders.ucs2(static_cast<std::uint16_t>(code), profile, out.bytes, sizeof(out.bytes), &out.size);
+    if (form == 1) return encoders.utf8(utf8, Utf8Bytes(code, utf8), &out.read, profile, out.bytes, sizeof(out.bytes), &out.size);
+    if (form <= 4) {
+        const int order = form - 2;
+        if (code < 0x10000) Store(utf16, 2, order, code);
+        else {
+            Store(utf16, 2, order, 0xD800 | (code - 0x10000) >> 10);
+            Store(utf16 + 1, 2, order, 0xDC00 | (code & 0x3FF));
+        }
+        return encoders.utf16[order](utf16, code < 0x10000 ? 1 : 2, &out.read, profile, out.bytes, sizeof(out.bytes), &out.size);
+    }
+    if (form == 5) return encoders.utf32(code, profile, out.bytes, sizeof(out.bytes), &out.size);
+    Store(&utf32, 4, form - 5, code);
+    return encoders.utf32Unit[form - 5](&utf32, profile, out.bytes, sizeof(out.bytes), &out.size);
+}
+
+static std::uint32_t SourceUnits(int form, std::uint32_t code) {
+    if (form == 1) return code < 0x80 ? 1 : code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+    if (form >= 2 && form <= 4) return code < 0x10000 ? 1 : 2;
+    return 77;
+}
+
+static void RequireEncode(const Encoders& encoders, const void* profile, std::uint32_t code, int expected, const std::uint8_t* bytes, std::uint32_t size) {
+    for (int form = 0; form < 8; ++form) {
+        if (form == 0 && code > 0xFFFF) continue;
+        Encoded out;
+        Require(Encode(encoders, form, code, profile, out) == expected);
+        if (expected == 0) Require(out.read == SourceUnits(form, code) && out.size == size && std::memcmp(out.bytes, bytes, size) == 0);
+        else Require(out.read == 77 && out.size == 77 && out.bytes[0] == 0x55 && out.bytes[1] == 0x55);
+    }
+}
+
+static void RequireEncoders(const Encoders& encoders, const void* profile, void* context) {
+    Require(sceCesMbcsUcsContextInit(context, profile) == 0);
+    for (std::uint32_t code = 1; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        const auto ucs2 = static_cast<std::uint16_t>(code);
+        std::uint8_t bytes[2] = {};
+        std::uint32_t read = 0;
+        std::uint32_t written = 0;
+        const int expected = sceCesUcs2StrToMbcsStr(context, &ucs2, 1, &read, bytes, sizeof(bytes), &written);
+        RequireEncode(encoders, profile, code, expected, bytes, written);
+    }
+    RequireEncode(encoders, profile, 0, 0, Bytes("\0"), 1);
+    RequireEncode(encoders, profile, 0x20000, unassignedCode, nullptr, 0);
+    RequireEncode(encoders, profile, 0x10FFFF, unassignedCode, nullptr, 0);
+}
+
 int main() {
     alignas(8) std::uint8_t eucKrSheet[64] = {};
     alignas(8) std::uint8_t uhcSheet[64] = {};
@@ -175,5 +322,87 @@ int main() {
     RequireString(context, "\xF9\xE9\xF9\xEB\xF9\xEA\xA2\xA1\xA2\xA3\xA2\xA2", "\xE2\x95\x9E\xE2\x95\xA1\xE2\x95\xAA\xE2\x95\xAE\xE2\x95\xAF\xE2\x95\xB0");
     Require(Utf8ToMbcs(context, "\xEA\xB0\x80") == unassignedCode);
     Require(RoundTripMismatches(context) == 10);
+
+    RequireDecoders(eucKrDecoders, eucKr);
+    RequireDecoders(uhcDecoders, uhc);
+    RequireDecoders(big5Decoders, big5);
+    RequireEncoders(eucKrEncoders, eucKr, context);
+    RequireEncoders(uhcEncoders, uhc, context);
+    RequireEncoders(big5Encoders, big5, context);
+
+    const std::uint8_t* ga = Bytes("\xB0\xA1");
+    std::uint16_t unit = 0;
+    std::uint32_t wide = 0;
+    std::uint32_t read = 0;
+    std::uint32_t units = 0;
+    Require(sceCesEucKrToUtf16be(eucKr, ga, 2, &read, &unit, 1, &units) == 0 && read == 2 && units == 1 && std::memcmp(&unit, "\xAC\x00", 2) == 0);
+    Require(sceCesEucKrToUtf16le(eucKr, ga, 2, &read, &unit, 1, &units) == 0 && std::memcmp(&unit, "\x00\xAC", 2) == 0);
+    Require(sceCesEucKrToUtf16(eucKr, ga, 2, nullptr, &unit, 1, nullptr) == 0 && unit == 0xAC00);
+    Require(sceCesEucKrToUtf32be(eucKr, ga, 2, &read, &wide) == 0 && read == 2 && std::memcmp(&wide, "\x00\x00\xAC\x00", 4) == 0);
+    Require(sceCesEucKrToUtf32le(eucKr, ga, 2, &read, &wide) == 0 && std::memcmp(&wide, "\x00\xAC\x00\x00", 4) == 0);
+    Require(sceCesEucKrToUtf32(eucKr, ga, 2, nullptr, &wide) == 0 && wide == 0xAC00);
+    Require(sceCesEucKrToUcs2(eucKr, Bytes("\0"), 1, &read, &unit) == 0 && read == 1 && unit == 0);
+    Require(sceCesUhcToUcs2(uhc, Bytes("\x8C\x63"), 2, nullptr, &unit) == 0 && unit == 0xB620);
+    Require(sceCesBig5ToUtf32le(big5, Bytes("\xA4\xA4"), 2, &read, &wide) == 0 && std::memcmp(&wide, "\x2D\x4E\x00\x00", 4) == 0);
+
+    Require(sceCesEucKrToUtf16(uhc, nullptr, 0, nullptr, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesEucKrToUtf16(eucKr, nullptr, 0, nullptr, nullptr, 0, nullptr) == invalidSrcBuffer);
+    Require(sceCesEucKrToUtf16(eucKr, ga, 0, nullptr, nullptr, 0, nullptr) == srcBufferEnd);
+    Require(sceCesEucKrToUtf16(eucKr, ga, 2, nullptr, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesEucKrToUtf16(eucKr, Bytes("\x8C\x63"), 2, nullptr, &unit, 0, nullptr) == invalidEncode);
+    unit = 0x5555;
+    read = 77;
+    units = 77;
+    Require(sceCesEucKrToUtf16(eucKr, ga, 2, &read, &unit, 0, &units) == dstBufferEnd && unit == 0x5555 && read == 77 && units == 77);
+    Require(sceCesUhcToUcs2(uhc, ga, 2, nullptr, nullptr) == invalidDstBuffer);
+    Require(sceCesBig5ToUtf32(big5, Bytes("\xA4\xA4"), 1, nullptr, &wide) == srcBufferEnd);
+    Require(sceCesBig5ToUtf32be(eucJp, Bytes("\xA4\xA4"), 2, nullptr, &wide) == invalidParameter);
+    Require(sceCesBig5ToUtf32le(big5, Bytes("\xA4\xA4"), 2, nullptr, nullptr) == invalidDstBuffer);
+
+    RequireEncode(eucKrEncoders, eucKr, 0x20AC, 0, Bytes("\xA2\xE6"), 2);
+    RequireEncode(eucKrEncoders, eucKr, 0xB620, unassignedCode, nullptr, 0);
+    RequireEncode(uhcEncoders, uhc, 0xB620, 0, Bytes("\x8C\x63"), 2);
+    RequireEncode(big5Encoders, big5, 0x2550, 0, Bytes("\xF9\xF9"), 2);
+    RequireEncode(big5Encoders, big5, 0x5341, 0, Bytes("\xA4\x51"), 2);
+    RequireEncode(big5Encoders, big5, 0xAC00, unassignedCode, nullptr, 0);
+    RequireEncode(eucKrEncoders, uhc, 0xAC00, invalidParameter, nullptr, 0);
+    RequireEncode(uhcEncoders, nullptr, 0xAC00, invalidParameter, nullptr, 0);
+    RequireEncode(big5Encoders, eucJp, 0x4E2D, invalidParameter, nullptr, 0);
+
+    std::uint8_t out[2] = {0x55, 0x55};
+    std::uint32_t size = 77;
+    read = 77;
+    const std::uint32_t big = 0x0000AC00;
+    Require(sceCesUcs2ToEucKr(0xAC00, uhc, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesUcs2ToEucKr(0xD800, eucKr, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesUcs2ToEucKr(0xD800, eucKr, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf32ToUhc(0x110000, uhc, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf32ToUhc(0xDFFF, uhc, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf32beToBig5(nullptr, eucKr, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesUtf32beToBig5(nullptr, big5, nullptr, 0, nullptr) == invalidSrcBuffer);
+    Require(sceCesUtf32leToBig5(&big, big5, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesUtf8ToEucKr(nullptr, 0, nullptr, uhc, nullptr, 0, nullptr) == invalidParameter);
+    Require(sceCesUtf8ToEucKr(nullptr, 0, nullptr, eucKr, nullptr, 0, nullptr) == invalidSrcBuffer);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 0, nullptr, eucKr, nullptr, 0, nullptr) == srcBufferEnd);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 3, nullptr, eucKr, nullptr, 0, nullptr) == invalidDstBuffer);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 2, &read, eucKr, out, 2, &size) == srcBufferEnd);
+    Require(sceCesUtf8ToEucKr(Bytes("\xC0\x80"), 2, &read, eucKr, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf8ToEucKr(Bytes("\xEA\xB0\x80"), 3, &read, eucKr, out, 1, &size) == dstBufferEnd);
+    const std::uint16_t lowSurrogate[1] = {0xDC00};
+    const std::uint16_t highSurrogate[2] = {0xD800, 0x0041};
+    Require(sceCesUtf16ToUhc(lowSurrogate, 1, &read, uhc, out, 2, &size) == invalidEncode);
+    Require(sceCesUtf16ToUhc(highSurrogate, 1, &read, uhc, out, 2, &size) == srcBufferEnd);
+    Require(sceCesUtf16ToUhc(highSurrogate, 2, &read, uhc, out, 2, &size) == invalidEncode);
+    Require(out[0] == 0x55 && out[1] == 0x55 && size == 77 && read == 77);
+
+    std::memcpy(&unit, "\xAC\x00", 2);
+    Require(sceCesUtf16beToEucKr(&unit, 1, &read, eucKr, out, 2, &size) == 0 && read == 1 && size == 2 && std::memcmp(out, "\xB0\xA1", 2) == 0);
+    std::memcpy(&unit, "\x00\xAC", 2);
+    Require(sceCesUtf16leToUhc(&unit, 1, nullptr, uhc, out, 2, nullptr) == 0 && std::memcmp(out, "\xB0\xA1", 2) == 0);
+    std::memcpy(&wide, "\x00\x00\x4E\x2D", 4);
+    Require(sceCesUtf32beToBig5(&wide, big5, out, 2, &size) == 0 && size == 2 && std::memcmp(out, "\xA4\xA4", 2) == 0);
+    std::memcpy(&wide, "\x2D\x4E\x00\x00", 4);
+    Require(sceCesUtf32leToBig5(&wide, big5, out, 2, nullptr) == 0 && std::memcmp(out, "\xA4\xA4", 2) == 0);
+    Require(sceCesUcs2ToEucKr(0, eucKr, out, 1, &size) == 0 && size == 1 && out[0] == 0);
     return 0;
 }
diff --git a/core/libs/tests/GuestCesJapanese.cpp b/core/libs/tests/GuestCesJapanese.cpp
new file mode 100644
index 0000000000..a63a45411d
--- /dev/null
+++ b/core/libs/tests/GuestCesJapanese.cpp
@@ -0,0 +1,373 @@
+#include "prx/libSceCesCs/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
+
+constexpr int invalidParameter = static_cast<int>(0x805C0001);
+constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+constexpr int invalidEncode = static_cast<int>(0x805C0014);
+constexpr int unassignedCode = static_cast<int>(0x805C0020);
+constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+constexpr std::uint32_t jisX0208Cells = 6878;
+constexpr std::uint32_t jisX0208Digest = 0xA614D6F6;
+constexpr std::uint32_t jisX0212Cells = 6067;
+constexpr std::uint32_t jisX0212Digest = 0x7C193A73;
+const std::string unsettledCell = "libSceCesCs: the console's mapping of JIS X 0208 cell 0x2140 (U+005C or U+FF3C) is unknown";
+const std::string unsettledByte = "libSceCesCs: the console's mapping of Shift-JIS bytes 0x5C and 0x7E (ASCII or JIS X 0201 Roman) is unknown";
+
+template <typename TCall>
+static bool Reports(const std::string& message, TCall call) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        return error.what() == message;
+    }
+    return false;
+}
+
+static std::uint32_t Digest(std::uint32_t hash, std::uint16_t value) {
+    hash = (hash ^ (value & 0xFF)) * 0x01000193u;
+    return (hash ^ (value >> 8)) * 0x01000193u;
+}
+
+static int EucToUcs2(const void* profile, const char* bytes, std::uint32_t size, std::uint16_t& ucs2) {
+    std::uint32_t used = 0;
+    return sceCesEucJpToUcs2(profile, Bytes(bytes), size, &used, &ucs2);
+}
+
+static int SJisToUcs2(const void* profile, const char* bytes, std::uint32_t size, std::uint16_t& ucs2) {
+    std::uint32_t used = 0;
+    return sceCesSJisToUcs2(profile, Bytes(bytes), size, &used, &ucs2);
+}
+
+static bool EucEncodes(const void* profile, std::uint16_t ucs2, const char* expected) {
+    std::uint8_t mbcs[4] = {};
+    std::uint32_t size = 0;
+    return sceCesUcs2ToEucJp(ucs2, profile, mbcs, sizeof(mbcs), &size) == 0 && size == std::strlen(expected) && std::memcmp(mbcs, expected, size) == 0;
+}
+
+static bool SJisEncodes(const void* profile, std::uint16_t ucs2, const char* expected) {
+    std::uint8_t mbcs[4] = {};
+    std::uint32_t size = 0;
+    return sceCesUcs2ToSJis(ucs2, profile, mbcs, sizeof(mbcs), &size) == 0 && size == std::strlen(expected) && std::memcmp(mbcs, expected, size) == 0;
+}
+
+static bool EncodeLeavesOutputs(int expected, const void* profile, std::uint16_t ucs2, bool sjis) {
+    std::uint8_t mbcs[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+    std::uint32_t size = 77;
+    const int result = sjis ? sceCesUcs2ToSJis(ucs2, profile, mbcs, sizeof(mbcs), &size) : sceCesUcs2ToEucJp(ucs2, profile, mbcs, sizeof(mbcs), &size);
+    return result == expected && size == 77 && mbcs[0] == 0xEE && mbcs[1] == 0xEE && mbcs[2] == 0xEE;
+}
+
+static bool DecodeLeavesOutputs(int expected, const void* profile, const char* bytes, std::uint32_t size, bool sjis) {
+    std::uint32_t used = 77;
+    std::uint16_t ucs2 = 0xEEEE;
+    const int result = sjis ? sceCesSJisToUcs2(profile, Bytes(bytes), size, &used, &ucs2) : sceCesEucJpToUcs2(profile, Bytes(bytes), size, &used, &ucs2);
+    return result == expected && used == 77 && ucs2 == 0xEEEE;
+}
+
+static void SweepEucJisX0208(const void* profile) {
+    std::uint32_t assigned = 0;
+    std::uint32_t hash = 0x811C9DC5u;
+    for (std::uint32_t lead = 0xA1; lead <= 0xFE; ++lead) {
+        for (std::uint32_t trail = 0xA1; trail <= 0xFE; ++trail) {
+            const std::uint8_t cell[2] = {static_cast<std::uint8_t>(lead), static_cast<std::uint8_t>(trail)};
+            std::uint32_t used = 77;
+            std::uint16_t ucs2 = 0xEEEE;
+            std::uint16_t value = 0;
+            if (lead == 0xA1 && trail == 0xC0) {
+                Require(Reports(unsettledCell, [&] { sceCesEucJpToUcs2(profile, cell, 2, &used, &ucs2); }));
+            } else if (const int result = sceCesEucJpToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
+                Require(used == 2);
+                value = ucs2;
+                ++assigned;
+                std::uint8_t again[4] = {};
+                std::uint32_t size = 0;
+                Require(sceCesUcs2ToEucJp(ucs2, profile, again, sizeof(again), &size) == 0 && size == 2 && again[0] == lead && again[1] == trail);
+            } else {
+                Require(result == unassignedCode && used == 77 && ucs2 == 0xEEEE);
+            }
+            hash = Digest(hash, value);
+        }
+    }
+    Require(assigned == jisX0208Cells && hash == jisX0208Digest);
+}
+
+static void SweepSJisJisX0208(const void* profile) {
+    std::uint32_t assigned = 0;
+    std::uint32_t hash = 0x811C9DC5u;
+    for (int row = 1; row <= 94; ++row) {
+        for (int column = 1; column <= 94; ++column) {
+            std::uint16_t code = 0;
+            Require(sceCesJisX0208ToSJisCode(static_cast<std::uint8_t>(row), static_cast<std::uint8_t>(column), &code) == 0);
+            const std::uint8_t cell[2] = {static_cast<std::uint8_t>(code >> 8), static_cast<std::uint8_t>(code)};
+            std::uint32_t used = 77;
+            std::uint16_t ucs2 = 0xEEEE;
+            std::uint16_t value = 0;
+            if (row == 1 && column == 32) {
+                Require(Reports(unsettledCell, [&] { sceCesSJisToUcs2(profile, cell, 2, &used, &ucs2); }));
+            } else if (const int result = sceCesSJisToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
+                Require(used == 2);
+                value = ucs2;
+                ++assigned;
+                std::uint8_t again[4] = {};
+                std::uint32_t size = 0;
+                Require(sceCesUcs2ToSJis(ucs2, profile, again, sizeof(again), &size) == 0 && size == 2 && again[0] == cell[0] && again[1] == cell[1]);
+            } else {
+                Require(result == unassignedCode && used == 77 && ucs2 == 0xEEEE);
+            }
+            hash = Digest(hash, value);
+        }
+    }
+    Require(assigned == jisX0208Cells && hash == jisX0208Digest);
+}
+
+static void TestJisX0208Profiles(const void* cp932, const void* cp51932) {
+    alignas(8) std::uint8_t sheets[4][256] = {};
+    Require(sceCesUcsProfileInitEucJpX0208(nullptr) == nullptr && sceCesUcsProfileInitEucJpX0208Ss2(nullptr) == nullptr);
+    Require(sceCesUcsProfileInitEucJpX0208Ss2Ss3(nullptr) == nullptr && sceCesUcsProfileInitSJis1997X0208(nullptr) == nullptr);
+    const void* euc = sceCesUcsProfileInitEucJpX0208(sheets[0]);
+    const void* ss2 = sceCesUcsProfileInitEucJpX0208Ss2(sheets[1]);
+    const void* ss3 = sceCesUcsProfileInitEucJpX0208Ss2Ss3(sheets[2]);
+    const void* sjis = sceCesUcsProfileInitSJis1997X0208(sheets[3]);
+    Require(euc == sheets[0] && ss2 == sheets[1] && ss3 == sheets[2] && sjis == sheets[3]);
+    const void* strictEuc[3] = {euc, ss2, ss3};
+
+    std::uint16_t ucs2 = 0;
+    Require(EucToUcs2(sjis, "\xA4\xA2", 2, ucs2) == invalidParameter);
+    Require(SJisToUcs2(euc, "\x82\xA0", 2, ucs2) == invalidParameter);
+    Require(EncodeLeavesOutputs(invalidParameter, sjis, 0x3042, false) && EncodeLeavesOutputs(invalidParameter, ss3, 0x3042, true));
+
+    for (const void* profile : strictEuc) {
+        SweepEucJisX0208(profile);
+        Require(EucToUcs2(profile, "\\~", 2, ucs2) == 0 && ucs2 == 0x5C && EucEncodes(profile, 0x5C, "\\") && EucEncodes(profile, 0x7E, "~"));
+        Require(EucToUcs2(profile, "\xA1\xC1", 2, ucs2) == 0 && ucs2 == 0x301C && EucEncodes(profile, 0x301C, "\xA1\xC1"));
+        Require(EucToUcs2(profile, "\xA1\xC2", 2, ucs2) == 0 && ucs2 == 0x2016);
+        Require(EucToUcs2(profile, "\xA1\xDD", 2, ucs2) == 0 && ucs2 == 0x2212);
+        Require(EucToUcs2(profile, "\xA1\xF1", 2, ucs2) == 0 && ucs2 == 0x00A2);
+        Require(EucToUcs2(profile, "\xA1\xF2", 2, ucs2) == 0 && ucs2 == 0x00A3);
+        Require(EucToUcs2(profile, "\xA2\xCC", 2, ucs2) == 0 && ucs2 == 0x00AC);
+        for (const std::uint16_t cp932Form : {0xFF5E, 0x2225, 0xFF0D, 0xFFE0, 0xFFE1, 0xFFE2, 0x2460, 0x2170}) Require(EncodeLeavesOutputs(unassignedCode, profile, cp932Form, false));
+        Require(Reports(unsettledCell, [&] { EucEncodes(profile, 0xFF3C, ""); }));
+        Require(DecodeLeavesOutputs(unassignedCode, profile, "\xAD\xA1", 2, false) && DecodeLeavesOutputs(unassignedCode, profile, "\xF9\xA1", 2, false));
+        Require(DecodeLeavesOutputs(unassignedCode, profile, "\xA9\xA1", 2, false) && DecodeLeavesOutputs(unassignedCode, profile, "\xFE\xFE", 2, false));
+        Require(DecodeLeavesOutputs(invalidEncode, profile, "\xA4\x41", 2, false) && DecodeLeavesOutputs(invalidEncode, profile, "\xA4\xFF", 2, false));
+        Require(DecodeLeavesOutputs(invalidEncode, profile, "\x80", 1, false) && DecodeLeavesOutputs(invalidEncode, profile, "\xFF", 1, false));
+        Require(DecodeLeavesOutputs(srcBufferEnd, profile, "\xA4\xA2", 1, false));
+        std::uint8_t mbcs[4] = {0xEE, 0xEE, 0xEE, 0xEE};
+        std::uint32_t size = 77;
+        Require(sceCesUcs2ToEucJp(0x3042, profile, mbcs, 1, &size) == dstBufferEnd && size == 77 && mbcs[0] == 0xEE);
+    }
+    Require(EucToUcs2(cp51932, "\xA1\xC0", 2, ucs2) == 0 && ucs2 == 0xFF3C && EucEncodes(cp51932, 0xFF3C, "\xA1\xC0"));
+    Require(EucToUcs2(cp51932, "\xA1\xC1", 2, ucs2) == 0 && ucs2 == 0xFF5E && EucToUcs2(cp51932, "\xAD\xA1", 2, ucs2) == 0 && ucs2 == 0x2460);
+    Require(EucEncodes(cp51932, 0x7E8A, "\xF9\xA1") && EucEncodes(ss3, 0x7E8A, "\x8F\xD4\xE3"));
+    Require(EncodeLeavesOutputs(unassignedCode, euc, 0x7E8A, false) && EncodeLeavesOutputs(unassignedCode, ss2, 0x7E8A, false));
+
+    Require(DecodeLeavesOutputs(invalidEncode, euc, "\x8E\xB1", 2, false) && DecodeLeavesOutputs(invalidEncode, euc, "\x8E", 1, false));
+    Require(DecodeLeavesOutputs(invalidEncode, euc, "\x8F\xB0\xA1", 3, false) && DecodeLeavesOutputs(invalidEncode, ss2, "\x8F\xB0\xA1", 3, false));
+    Require(EncodeLeavesOutputs(unassignedCode, euc, 0xFF71, false));
+    Require(EncodeLeavesOutputs(unassignedCode, euc, 0x4E02, false) && EncodeLeavesOutputs(unassignedCode, ss2, 0x4E02, false));
+    for (const void* profile : {ss2, ss3}) {
+        for (std::uint32_t kana = 0xA1; kana <= 0xDF; ++kana) {
+            const char bytes[3] = {'\x8E', static_cast<char>(kana), 0};
+            Require(EucToUcs2(profile, bytes, 2, ucs2) == 0 && ucs2 == 0xFF61 + kana - 0xA1 && EucEncodes(profile, ucs2, bytes));
+        }
+        Require(DecodeLeavesOutputs(invalidEncode, profile, "\x8E\xE0", 2, false) && DecodeLeavesOutputs(invalidEncode, profile, "\x8E\xA0", 2, false));
+        Require(DecodeLeavesOutputs(srcBufferEnd, profile, "\x8E\xB1", 1, false));
+    }
+    std::uint32_t supplementary = 0;
+    std::uint32_t hash = 0x811C9DC5u;
+    for (std::uint32_t lead = 0xA1; lead <= 0xFE; ++lead) {
+        for (std::uint32_t trail = 0xA1; trail <= 0xFE; ++trail) {
+            const char bytes[4] = {'\x8F', static_cast<char>(lead), static_cast<char>(trail), 0};
+            std::uint16_t value = 0;
+            if (const int result = EucToUcs2(ss3, bytes, 3, ucs2); result == 0) {
+                value = ucs2;
+                ++supplementary;
+                Require(EucEncodes(ss3, ucs2, ucs2 == 0x7E ? "~" : bytes));
+            } else {
+                Require(result == unassignedCode);
+            }
+            hash = Digest(hash, value);
+        }
+    }
+    Require(supplementary == jisX0212Cells && hash == jisX0212Digest);
+    Require(DecodeLeavesOutputs(srcBufferEnd, ss3, "\x8F\xB0", 2, false) && DecodeLeavesOutputs(invalidEncode, ss3, "\x8F\xB0\x41", 3, false));
+    Require(EucEncodes(ss3, 0x4E02, "\x8F\xB0\xA1") && EucEncodes(ss2, 0xFF71, "\x8E\xB1"));
+
+    std::uint8_t utf8[4] = {};
+    std::uint32_t used = 0;
+    std::uint32_t produced = 0;
+    Require(sceCesEucJpToUtf8(euc, Bytes("\xA1\xC1"), 2, &used, utf8, sizeof(utf8), &produced) == 0 && used == 2 && produced == 3 && std::memcmp(utf8, "\xE3\x80\x9C", 3) == 0);
+    alignas(8) std::uint8_t context[256] = {};
+    std::uint16_t wide[8] = {};
+    Require(sceCesMbcsUcsContextInit(context, ss2) == 0);
+    Require(sceCesMbcsStrToUcs2Str(context, Bytes("A\xA4\xA2\x8E\xB1"), 5, &used, wide, 8, &produced) == 0 && used == 5 && produced == 3 && wide[1] == 0x3042 && wide[2] == 0xFF71);
+    Require(sceCesMbcsUcsContextInit(context, euc) == 0);
+    Require(sceCesMbcsStrToUcs2Str(context, Bytes("A\xA4\xA2\x8E\xB1"), 5, &used, wide, 8, &produced) == invalidEncode);
+
+    SweepSJisJisX0208(sjis);
+    Require(SJisToUcs2(sjis, "\x81\x60", 2, ucs2) == 0 && ucs2 == 0x301C && SJisEncodes(sjis, 0x301C, "\x81\x60"));
+    Require(SJisToUcs2(sjis, "\x81\x91", 2, ucs2) == 0 && ucs2 == 0x00A2 && SJisEncodes(sjis, 0x00AC, "\x81\xCA"));
+    for (const std::uint16_t cp932Form : {0xFF5E, 0x2225, 0xFF0D, 0xFFE0, 0xFFE1, 0xFFE2, 0x2460, 0x2170, 0x7E8A, 0x4E02}) Require(EncodeLeavesOutputs(unassignedCode, sjis, cp932Form, true));
+    for (const char* removed : {"\x87\x40", "\xED\x40", "\xEE\xFC", "\xFA\x40", "\xFC\x4B", "\xF0\x40", "\xEF\xFC"}) Require(DecodeLeavesOutputs(unassignedCode, sjis, removed, 2, true));
+    Require(SJisToUcs2(cp932, "\x87\x40", 2, ucs2) == 0 && ucs2 == 0x2460 && SJisToUcs2(cp932, "\xFA\x40", 2, ucs2) == 0 && ucs2 == 0x2170);
+    Require(SJisToUcs2(cp932, "\x81\x5F", 2, ucs2) == 0 && ucs2 == 0xFF3C && SJisToUcs2(cp932, "\\", 1, ucs2) == 0 && ucs2 == 0x5C);
+    Require(DecodeLeavesOutputs(invalidEncode, sjis, "\x82\x7F", 2, true) && DecodeLeavesOutputs(invalidEncode, sjis, "\x82\xFD", 2, true));
+    Require(DecodeLeavesOutputs(srcBufferEnd, sjis, "\x82\xA0", 1, true));
+    for (std::uint32_t byte = 0; byte <= 0xFF; ++byte) {
+        const char bytes[2] = {static_cast<char>(byte), 0};
+        if (byte == 0x5C || byte == 0x7E) {
+            Require(Reports(unsettledByte, [&] { SJisToUcs2(sjis, bytes, 1, ucs2); }));
+        } else if (byte < 0x80) {
+            Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == byte && (byte == 0 || SJisEncodes(sjis, ucs2, bytes)));
+        } else if (byte >= 0xA1 && byte <= 0xDF) {
+            Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == 0xFF61 + byte - 0xA1 && SJisEncodes(sjis, ucs2, bytes));
+        } else {
+            Require(DecodeLeavesOutputs(byte == 0x80 || byte == 0xA0 || byte >= 0xFD ? invalidEncode : srcBufferEnd, sjis, bytes, 1, true));
+        }
+    }
+    for (const std::uint16_t unsettled : {0x5C, 0x7E, 0xA5, 0x203E}) Require(Reports(unsettledByte, [&] { SJisEncodes(sjis, unsettled, ""); }));
+    Require(Reports(unsettledCell, [&] { SJisEncodes(sjis, 0xFF3C, ""); }));
+    Require(sceCesMbcsUcsContextInit(context, sjis) == 0);
+    const std::uint16_t text[] = {0x3042, 0x301C, 0xFF71, 0};
+    std::uint8_t mbcs[8] = {};
+    Require(sceCesUcs2StrToMbcsStr(context, text, 4, &used, mbcs, sizeof(mbcs), &produced) == 0 && used == 3 && produced == 5 && std::memcmp(mbcs, "\x82\xA0\x81\x60\xB1", 5) == 0);
+    Require(Reports(unsettledByte, [&] { sceCesMbcsStrToUcs2Str(context, Bytes("A\\"), 2, &used, wide, 8, &produced); }));
+}
+
+int main() {
+    constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+    constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+
+    alignas(8) std::uint8_t sjisSheet[64] = {};
+    alignas(8) std::uint8_t eucSheet[64] = {};
+    const void* sjis = sceCesUcsProfileInitSJis1997Cp932(sjisSheet);
+    const void* euc = sceCesUcsProfileInitEucJpCp51932(eucSheet);
+    Require(sjis != nullptr && euc != nullptr);
+
+    std::uint32_t consumed = 0;
+    std::uint32_t produced = 0;
+    std::uint16_t ucs2 = 0;
+    Require(sceCesSJisToUcs2(sjis, Bytes("\x82\xA0"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x3042);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\xB1"), 1, &consumed, &ucs2) == 0 && consumed == 1 && ucs2 == 0xFF71);
+    Require(sceCesSJisToUcs2(sjis, Bytes("A"), 1, &consumed, &ucs2) == 0 && consumed == 1 && ucs2 == 'A');
+    Require(sceCesSJisToUcs2(sjis, Bytes("\x81\x60"), 2, &consumed, &ucs2) == 0 && ucs2 == 0xFF5E);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\xFA\x40"), 2, &consumed, &ucs2) == 0 && ucs2 == 0x2170);
+    Require(sceCesSJisToUcs2(euc, Bytes("\x82\xA0"), 2, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesSJisToUcs2(sjis, nullptr, 2, &consumed, &ucs2) == invalidSrcBuffer);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\x82\xA0"), 0, &consumed, &ucs2) == srcBufferEnd);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\x82\xA0"), 1, &consumed, &ucs2) == srcBufferEnd);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\x82\xA0"), 2, &consumed, nullptr) == invalidDstBuffer);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\x82\x7F"), 2, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesSJisToUcs2(sjis, Bytes("\xF0\x40"), 2, &consumed, &ucs2) == unassignedCode);
+
+    std::uint8_t utf8[4] = {};
+    Require(sceCesSJisToUtf8(sjis, Bytes("\x93\xFA"), 2, &consumed, utf8, sizeof(utf8), &produced) == 0);
+    Require(consumed == 2 && produced == 3 && std::memcmp(utf8, "\xE6\x97\xA5", 3) == 0);
+    Require(sceCesSJisToUtf8(sjis, Bytes("\x93\xFA"), 2, &consumed, utf8, 2, &produced) == dstBufferEnd);
+
+    std::uint16_t utf16 = 0;
+    Require(sceCesSJisToUtf16(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf16, 1, &produced) == 0 && utf16 == 0x3042 && produced == 1);
+    Require(sceCesSJisToUtf16(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf16, 0, &produced) == dstBufferEnd);
+    Require(sceCesSJisToUtf16be(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf16, 1, &produced) == 0);
+    Require(std::memcmp(&utf16, "\x30\x42", 2) == 0);
+    Require(sceCesSJisToUtf16le(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf16, 1, &produced) == 0);
+    Require(std::memcmp(&utf16, "\x42\x30", 2) == 0);
+
+    std::uint32_t utf32 = 0;
+    Require(sceCesSJisToUtf32(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf32) == 0 && utf32 == 0x3042);
+    Require(sceCesSJisToUtf32be(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf32) == 0);
+    Require(std::memcmp(&utf32, "\x00\x00\x30\x42", 4) == 0);
+    Require(sceCesSJisToUtf32le(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf32) == 0);
+    Require(std::memcmp(&utf32, "\x42\x30\x00\x00", 4) == 0);
+
+    Require(sceCesEucJpToUtf16(euc, Bytes("\xA4\xA2"), 2, &consumed, &utf16, 1, &produced) == 0 && consumed == 2 && utf16 == 0x3042);
+    Require(sceCesEucJpToUtf16be(euc, Bytes("\x8E\xB1"), 2, &consumed, &utf16, 1, &produced) == 0);
+    Require(std::memcmp(&utf16, "\xFF\x71", 2) == 0);
+    Require(sceCesEucJpToUtf32(euc, Bytes("\x8F\xB0\xA1"), 3, &consumed, &utf32) == 0 && consumed == 3 && utf32 == 0x4E02);
+    Require(sceCesEucJpToUtf32le(euc, Bytes("\xA4\xA2"), 2, &consumed, &utf32) == 0);
+    Require(std::memcmp(&utf32, "\x42\x30\x00\x00", 4) == 0);
+    Require(sceCesEucJpToUtf32(sjis, Bytes("\xA4\xA2"), 2, &consumed, &utf32) == invalidParameter);
+
+    std::uint8_t mbcs[4] = {};
+    Require(sceCesUcs2ToSJis(0x3042, sjis, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\x82\xA0", 2) == 0);
+    Require(sceCesUcs2ToSJis(0xFF71, sjis, mbcs, sizeof(mbcs), &produced) == 0 && produced == 1 && mbcs[0] == 0xB1);
+    Require(sceCesUcs2ToSJis(0x3042, sjis, mbcs, 1, &produced) == dstBufferEnd);
+    Require(sceCesUcs2ToSJis(0xD800, sjis, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    Require(sceCesUcs2ToSJis(0x4E02, sjis, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(sceCesUcs2ToSJis(0x3042, euc, mbcs, sizeof(mbcs), &produced) == invalidParameter);
+    Require(sceCesUcs2ToSJis(0x3042, sceCesRefersUcsProfileCp1252(), mbcs, sizeof(mbcs), &produced) == invalidParameter);
+    Require(sceCesUcs2ToSJis(0x3042, sjis, nullptr, sizeof(mbcs), &produced) == invalidDstBuffer);
+    Require(sceCesUcs2ToEucJp(0x4E02, euc, mbcs, sizeof(mbcs), &produced) == 0 && produced == 3 && std::memcmp(mbcs, "\x8F\xB0\xA1", 3) == 0);
+    Require(sceCesUcs2ToEucJp(0xFF71, euc, mbcs, sizeof(mbcs), &produced) == 0 && produced == 2 && std::memcmp(mbcs, "\x8E\xB1", 2) == 0);
+
+    Require(sceCesUtf8ToSJis(Bytes("\xE6\x97\xA5"), 3, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == 0);
+    Require(consumed == 3 && produced == 2 && std::memcmp(mbcs, "\x93\xFA", 2) == 0);
+    Require(sceCesUtf8ToSJis(Bytes("\xE6\x97\xA5"), 2, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == srcBufferEnd);
+    Require(sceCesUtf8ToSJis(Bytes("\xF0\x9F\x98\x80"), 4, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(sceCesUtf8ToSJis(nullptr, 3, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == invalidSrcBuffer);
+    Require(sceCesUtf8ToEucJp(Bytes("\xE6\x97\xA5"), 3, &consumed, euc, mbcs, sizeof(mbcs), &produced) == 0);
+    Require(produced == 2 && std::memcmp(mbcs, "\xC6\xFC", 2) == 0);
+
+    const std::uint16_t hiragana[] = {0x3042};
+    const std::uint16_t pair[] = {0xD83D, 0xDE00};
+    const std::uint16_t lone[] = {0xDC00};
+    Require(sceCesUtf16ToSJis(hiragana, 1, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == 0 && consumed == 1 && std::memcmp(mbcs, "\x82\xA0", 2) == 0);
+    Require(sceCesUtf16ToSJis(pair, 2, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == unassignedCode);
+    Require(sceCesUtf16ToSJis(pair, 1, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == srcBufferEnd);
+    Require(sceCesUtf16ToSJis(lone, 1, &consumed, sjis, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    std::uint16_t hiraganaBe = 0;
+    std::memcpy(&hiraganaBe, "\x30\x42", 2);
+    Require(sceCesUtf16beToEucJp(&hiraganaBe, 1, &consumed, euc, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\xA4\xA2", 2) == 0);
+
+    Require(sceCesUtf32ToSJis(0x65E5, sjis, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\x93\xFA", 2) == 0);
+    Require(sceCesUtf32ToSJis(0x110000, sjis, mbcs, sizeof(mbcs), &produced) == invalidEncode);
+    std::uint32_t utf32Be = 0;
+    std::memcpy(&utf32Be, "\x00\x00\x65\xE5", 4);
+    Require(sceCesUtf32beToSJis(&utf32Be, sjis, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\x93\xFA", 2) == 0);
+    Require(sceCesUtf32beToSJis(nullptr, sjis, mbcs, sizeof(mbcs), &produced) == invalidSrcBuffer);
+    std::uint32_t utf32Le = 0;
+    std::memcpy(&utf32Le, "\xE5\x65\x00\x00", 4);
+    Require(sceCesUtf32leToEucJp(&utf32Le, euc, mbcs, sizeof(mbcs), &produced) == 0 && std::memcmp(mbcs, "\xC6\xFC", 2) == 0);
+
+    for (int code = 1; code < 0x10000; ++code) {
+        if (code >= 0xD800 && code <= 0xDFFF) continue;
+        std::uint8_t encoded[4] = {};
+        std::uint32_t size = 0;
+        if (sceCesUcs2ToSJis(static_cast<std::uint16_t>(code), sjis, encoded, sizeof(encoded), &size) == 0) {
+            std::uint16_t back = 0;
+            Require(sceCesSJisToUcs2(sjis, encoded, size, &consumed, &back) == 0 && consumed == size && back == code);
+        }
+    }
+
+    std::uint8_t ku = 0;
+    std::uint8_t ten = 0;
+    std::uint16_t sjisCode = 0;
+    Require(sceCesSJisCodeToJisX0208(0x82A0, &ku, &ten) == 0 && ku == 4 && ten == 2);
+    Require(sceCesSJisCodeToJisX0208(0x93FA, &ku, &ten) == 0 && ku == 38 && ten == 92);
+    Require(sceCesSJisCodeToJisX0208(0xEFFC, &ku, &ten) == 0 && ku == 94 && ten == 94);
+    Require(sceCesSJisCodeToJisX0208(0xF040, &ku, &ten) == invalidEncode);
+    Require(sceCesSJisCodeToJisX0208(0x0041, &ku, &ten) == invalidEncode);
+    Require(sceCesSJisCodeToJisX0208(0x827F, &ku, &ten) == invalidEncode);
+    Require(sceCesSJisCodeToJisX0208(0x82A0, nullptr, &ten) == invalidDstBuffer);
+    Require(sceCesJisX0208ToSJisCode(4, 2, &sjisCode) == 0 && sjisCode == 0x82A0);
+    Require(sceCesJisX0208ToSJisCode(0, 2, &sjisCode) == invalidEncode);
+    Require(sceCesJisX0208ToSJisCode(4, 95, &sjisCode) == invalidEncode);
+    Require(sceCesJisX0208ToSJisCode(4, 2, nullptr) == invalidDstBuffer);
+    for (int row = 1; row <= 94; ++row) {
+        for (int cell = 1; cell <= 94; ++cell) {
+            Require(sceCesJisX0208ToSJisCode(static_cast<std::uint8_t>(row), static_cast<std::uint8_t>(cell), &sjisCode) == 0);
+            Require(sceCesSJisCodeToJisX0208(sjisCode, &ku, &ten) == 0 && ku == row && ten == cell);
+        }
+    }
+    TestJisX0208Profiles(sjis, euc);
+    return 0;
+}
diff --git a/core/libs/tests/GuestCesMbc.cpp b/core/libs/tests/GuestCesMbc.cpp
new file mode 100644
index 0000000000..4bab69f25e
--- /dev/null
+++ b/core/libs/tests/GuestCesMbc.cpp
@@ -0,0 +1,135 @@
+#include "prx/libSceCesCs/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
+
+static void RequireX0213(std::uint16_t sjis, std::uint8_t men, std::uint8_t ku, std::uint8_t ten) {
+    std::uint8_t m = 0;
+    std::uint8_t k = 0;
+    std::uint8_t t = 0;
+    Require(sceCesSJisCodeToJisX0213(sjis, &m, &k, &t) == 0 && m == men && k == ku && t == ten);
+    std::uint16_t back = 0;
+    Require(sceCesJisX0213ToSJisCode(men, ku, ten, &back) == 0 && back == sjis);
+}
+
+int main() {
+    constexpr int invalidParameter = static_cast<int>(0x805C0001);
+    constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+    constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+    constexpr int invalidEncode = static_cast<int>(0x805C0014);
+    constexpr int unassignedCode = static_cast<int>(0x805C0020);
+    constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+
+    alignas(8) std::uint8_t sjisSheet[64] = {};
+    alignas(8) std::uint8_t eucSheet[64] = {};
+    alignas(8) std::uint8_t gbkSheet[64] = {};
+    alignas(8) std::uint8_t blankSheet[64] = {};
+    const void* sjis = sceCesUcsProfileInitSJis1997Cp932(sjisSheet);
+    const void* euc = sceCesUcsProfileInitEucJpCp51932(eucSheet);
+    const void* gbk = sceCesUcsProfileInitGbkCp936(gbkSheet);
+    const void* cp1252 = sceCesRefersUcsProfileCp1252();
+
+    std::uint32_t consumed = 0;
+    std::uint32_t produced = 0;
+    std::uint16_t ucs2 = 0;
+    Require(sceCesMbcToUcs2(sjis, Bytes("\x82\xA0"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x3042);
+    Require(sceCesMbcToUcs2(sjis, Bytes("\xB1"), 1, &consumed, &ucs2) == 0 && consumed == 1 && ucs2 == 0xFF71);
+    Require(sceCesMbcToUcs2(euc, Bytes("\xA4\xA2"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x3042);
+    Require(sceCesMbcToUcs2(gbk, Bytes("\xD6\xD0"), 2, &consumed, &ucs2) == 0 && consumed == 2 && ucs2 == 0x4E2D);
+    Require(sceCesMbcToUcs2(cp1252, Bytes("\x80"), 1, &consumed, &ucs2) == 0 && consumed == 1 && ucs2 == 0x20AC);
+    Require(sceCesMbcToUcs2(nullptr, Bytes("A"), 1, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesMbcToUcs2(blankSheet, Bytes("A"), 1, &consumed, &ucs2) == invalidParameter);
+    Require(sceCesMbcToUcs2(sjis, nullptr, 1, &consumed, &ucs2) == invalidSrcBuffer);
+    Require(sceCesMbcToUcs2(sjis, Bytes("A"), 0, &consumed, &ucs2) == srcBufferEnd);
+    Require(sceCesMbcToUcs2(sjis, Bytes("A"), 1, &consumed, nullptr) == invalidDstBuffer);
+    Require(sceCesMbcToUcs2(sjis, Bytes("\x82"), 1, &consumed, &ucs2) == srcBufferEnd);
+    Require(sceCesMbcToUcs2(sjis, Bytes("\x80"), 1, &consumed, &ucs2) == invalidEncode);
+    Require(sceCesMbcToUcs2(sjis, Bytes("\xF0\x40"), 2, &consumed, &ucs2) == unassignedCode);
+
+    std::uint8_t utf8[4] = {};
+    Require(sceCesMbcToUtf8(gbk, Bytes("\xD6\xD0"), 2, &consumed, utf8, sizeof(utf8), &produced) == 0 && consumed == 2 && produced == 3);
+    Require(std::memcmp(utf8, "\xE4\xB8\xAD", 3) == 0);
+    Require(sceCesMbcToUtf8(gbk, Bytes("\xD6\xD0"), 2, &consumed, utf8, 2, &produced) == dstBufferEnd);
+
+    std::uint16_t utf16 = 0;
+    Require(sceCesMbcToUtf16(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf16, 1, &produced) == 0 && produced == 1 && utf16 == 0x3042);
+    Require(sceCesMbcToUtf16le(euc, Bytes("\xA4\xA2"), 2, &consumed, &utf16, 1, &produced) == 0 && std::memcmp(&utf16, "\x42\x30", 2) == 0);
+    Require(sceCesMbcToUtf16be(euc, Bytes("\xA4\xA2"), 2, &consumed, &utf16, 1, &produced) == 0 && std::memcmp(&utf16, "\x30\x42", 2) == 0);
+    Require(sceCesMbcToUtf16(sjis, Bytes("\x82\xA0"), 2, &consumed, &utf16, 0, &produced) == dstBufferEnd);
+
+    std::uint32_t utf32 = 0;
+    Require(sceCesMbcToUtf32(gbk, Bytes("A"), 1, &consumed, &utf32) == 0 && consumed == 1 && utf32 == 'A');
+    Require(sceCesMbcToUtf32le(gbk, Bytes("\xD6\xD0"), 2, &consumed, &utf32) == 0 && std::memcmp(&utf32, "\x2D\x4E\x00\x00", 4) == 0);
+    Require(sceCesMbcToUtf32be(gbk, Bytes("\xD6\xD0"), 2, &consumed, &utf32) == 0 && std::memcmp(&utf32, "\x00\x00\x4E\x2D", 4) == 0);
+
+    std::uint16_t code = 0;
+    std::uint32_t size = 0;
+    Require(sceCesSJisGetCode(Bytes("\x82\xA0"), 2, &size, &code) == 0 && size == 2 && code == 0x82A0);
+    Require(sceCesSJisGetCode(Bytes("A\x82"), 2, &size, &code) == 0 && size == 1 && code == 'A');
+    Require(sceCesSJisGetCode(Bytes("\xDF"), 1, &size, &code) == 0 && size == 1 && code == 0xDF);
+    Require(sceCesSJisGetCode(Bytes("\xFC\xFC"), 2, nullptr, &code) == 0 && code == 0xFCFC);
+    Require(sceCesSJisGetCode(Bytes("\x82"), 1, &size, &code) == srcBufferEnd);
+    Require(sceCesSJisGetCode(Bytes("\x80"), 1, &size, &code) == invalidEncode);
+    Require(sceCesSJisGetCode(Bytes("\xA0"), 1, &size, &code) == invalidEncode);
+    Require(sceCesSJisGetCode(Bytes("\xFD\x40"), 2, &size, &code) == invalidEncode);
+    Require(sceCesSJisGetCode(Bytes("\x82\x7F"), 2, &size, &code) == invalidEncode);
+    Require(sceCesSJisGetCode(nullptr, 2, &size, &code) == invalidSrcBuffer);
+    Require(sceCesSJisGetCode(Bytes("A"), 0, &size, &code) == srcBufferEnd);
+    Require(sceCesSJisGetCode(Bytes("A"), 1, &size, nullptr) == invalidDstBuffer);
+
+    std::uint8_t sjisOut[2] = {};
+    Require(sceCesSJisPutCode(0x82A0, sjisOut, 2, &size) == 0 && size == 2 && sjisOut[0] == 0x82 && sjisOut[1] == 0xA0);
+    Require(sceCesSJisPutCode('A', sjisOut, 1, &size) == 0 && size == 1 && sjisOut[0] == 'A');
+    Require(sceCesSJisPutCode(0xB1, sjisOut, 1, nullptr) == 0 && sjisOut[0] == 0xB1);
+    Require(sceCesSJisPutCode(0x82A0, sjisOut, 1, &size) == dstBufferEnd);
+    Require(sceCesSJisPutCode('A', sjisOut, 0, &size) == dstBufferEnd);
+    Require(sceCesSJisPutCode(0x80, sjisOut, 2, &size) == invalidEncode);
+    Require(sceCesSJisPutCode(0x0141, sjisOut, 2, &size) == invalidEncode);
+    Require(sceCesSJisPutCode(0x827F, sjisOut, 2, &size) == invalidEncode);
+    Require(sceCesSJisPutCode(0x82A0, nullptr, 2, &size) == invalidDstBuffer);
+
+    RequireX0213(0x8140, 1, 1, 1);
+    RequireX0213(0x889F, 1, 16, 1);
+    RequireX0213(0xEFFC, 1, 94, 94);
+    RequireX0213(0xF040, 2, 1, 1);
+    RequireX0213(0xF09F, 2, 8, 1);
+    RequireX0213(0xF140, 2, 3, 1);
+    RequireX0213(0xF19F, 2, 4, 1);
+    RequireX0213(0xF240, 2, 5, 1);
+    RequireX0213(0xF29F, 2, 12, 1);
+    RequireX0213(0xF340, 2, 13, 1);
+    RequireX0213(0xF39F, 2, 14, 1);
+    RequireX0213(0xF440, 2, 15, 1);
+    RequireX0213(0xF49F, 2, 78, 1);
+    RequireX0213(0xF540, 2, 79, 1);
+    RequireX0213(0xFCFC, 2, 94, 94);
+    std::uint8_t men = 0;
+    std::uint8_t ku = 0;
+    std::uint8_t ten = 0;
+    Require(sceCesSJisCodeToJisX0213(0x8040, &men, &ku, &ten) == invalidEncode);
+    Require(sceCesSJisCodeToJisX0213(0xFD40, &men, &ku, &ten) == invalidEncode);
+    Require(sceCesSJisCodeToJisX0213(0x827F, &men, &ku, &ten) == invalidEncode);
+    Require(sceCesSJisCodeToJisX0213(0x82A0, nullptr, &ku, &ten) == invalidDstBuffer);
+    Require(sceCesJisX0213ToSJisCode(2, 2, 1, &code) == invalidEncode);
+    Require(sceCesJisX0213ToSJisCode(2, 77, 1, &code) == invalidEncode);
+    Require(sceCesJisX0213ToSJisCode(3, 1, 1, &code) == invalidEncode);
+    Require(sceCesJisX0213ToSJisCode(0, 1, 1, &code) == invalidEncode);
+    Require(sceCesJisX0213ToSJisCode(1, 95, 1, &code) == invalidEncode);
+    Require(sceCesJisX0213ToSJisCode(1, 1, 0, &code) == invalidEncode);
+    Require(sceCesJisX0213ToSJisCode(1, 1, 1, nullptr) == invalidDstBuffer);
+
+    alignas(8) std::uint8_t context[64] = {};
+    alignas(8) std::uint8_t copy[64] = {};
+    Require(sceCesMbcsUcsContextInit(context, gbk) == 0);
+    Require(sceCesMbcsUcsContextInitCopy(copy, context) == 0);
+    Require(sceCesMbcsStrToUtf8Str(copy, Bytes("\xD6\xD0"), 2, &consumed, utf8, sizeof(utf8), &produced) == 0 && consumed == 2 && produced == 3);
+    Require(std::memcmp(utf8, "\xE4\xB8\xAD", 3) == 0);
+    Require(sceCesMbcsUcsContextInitCopy(nullptr, context) == invalidParameter);
+    Require(sceCesMbcsUcsContextInitCopy(copy, nullptr) == invalidParameter);
+}
diff --git a/core/libs/tests/GuestCesUnicode.cpp b/core/libs/tests/GuestCesUnicode.cpp
index 1603f09810..75a78e85bc 100644
--- a/core/libs/tests/GuestCesUnicode.cpp
+++ b/core/libs/tests/GuestCesUnicode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceCesCs/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceCesCs/JisX0208.hpp"
 #include "prx/libSceCesCs/JisX0212.hpp"
@@ -7,25 +8,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceCesUcs2ToUtf8(uint16_t, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUcs2(const uint8_t*, uint32_t, uint32_t*, uint16_t*);
-int APS5_VABI sceCesUtf32ToUtf8(uint32_t, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf32beToUtf8(const uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf32leToUtf8(const uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf32(const uint8_t*, uint32_t, uint32_t*, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf32be(const uint8_t*, uint32_t, uint32_t*, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf32le(const uint8_t*, uint32_t, uint32_t*, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf16(const uint8_t*, uint32_t, uint32_t*, uint16_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf16be(const uint8_t*, uint32_t, uint32_t*, uint16_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf8ToUtf16le(const uint8_t*, uint32_t, uint32_t*, uint16_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf16ToUtf8(const uint16_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf16beToUtf8(const uint16_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-int APS5_VABI sceCesUtf16leToUtf8(const uint16_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-void* APS5_VABI sceCesUcsProfileInitEucJpCp51932(void*);
-int APS5_VABI sceCesEucJpToUtf8(const void*, const uint8_t*, uint32_t, uint32_t*, uint8_t*, uint32_t, uint32_t*);
-}
-
 namespace {
 
 constexpr int INVALID_PARAMETER = static_cast<int>(0x805C0001);
diff --git a/core/libs/tests/GuestCesWide.cpp b/core/libs/tests/GuestCesWide.cpp
new file mode 100644
index 0000000000..bf4f34bd30
--- /dev/null
+++ b/core/libs/tests/GuestCesWide.cpp
@@ -0,0 +1,111 @@
+#include "prx/libSceCesCs/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static const std::uint8_t* Bytes(const char* text) { return reinterpret_cast<const std::uint8_t*>(text); }
+
+int main() {
+    constexpr int invalidParameter = static_cast<int>(0x805C0001);
+    constexpr int invalidSrcBuffer = static_cast<int>(0x805C0010);
+    constexpr int srcBufferEnd = static_cast<int>(0x805C0011);
+    constexpr int invalidEncode = static_cast<int>(0x805C0014);
+    constexpr int unassignedCode = static_cast<int>(0x805C0020);
+    constexpr int invalidDstBuffer = static_cast<int>(0x805C0030);
+    constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
+
+    const std::uint8_t* cp1252 = sceCesRefersUcsProfileCp1252();
+    const std::uint8_t* cp1251 = sceCesRefersUcsProfileCp1251();
+    alignas(8) std::uint8_t sjisSheet[64] = {};
+    const void* sjis = sceCesUcsProfileInitSJis1997Cp932(sjisSheet);
+
+    std::uint16_t ucs2 = 0;
+    std::uint16_t utf16 = 0;
+    std::uint32_t utf32 = 0;
+    std::uint32_t length = 0;
+    Require(sceCesSbcToUcs2(cp1252, 0x80, &ucs2) == 0 && ucs2 == 0x20AC);
+    Require(sceCesSbcToUcs2(cp1251, 0xC0, &ucs2) == 0 && ucs2 == 0x0410);
+    Require(sceCesSbcToUcs2(static_cast<const std::uint8_t*>(sjis), 0x41, &ucs2) == invalidParameter);
+    Require(sceCesSbcToUcs2(cp1252, 0x41, nullptr) == invalidDstBuffer);
+    Require(sceCesSbcToUtf16(cp1252, 0x80, &utf16, 1, &length) == 0 && utf16 == 0x20AC && length == 1);
+    Require(sceCesSbcToUtf16(cp1252, 0x80, &utf16, 0, &length) == dstBufferEnd);
+    Require(sceCesSbcToUtf16be(cp1252, 0x80, &utf16, 1, &length) == 0 && std::memcmp(&utf16, "\x20\xAC", 2) == 0);
+    Require(sceCesSbcToUtf16le(cp1252, 0x80, &utf16, 1, &length) == 0 && std::memcmp(&utf16, "\xAC\x20", 2) == 0);
+    Require(sceCesSbcToUtf32(cp1252, 0x9F, &utf32) == 0 && utf32 == 0x0178);
+    Require(sceCesSbcToUtf32be(cp1252, 0x9F, &utf32) == 0 && std::memcmp(&utf32, "\x00\x00\x01\x78", 4) == 0);
+    Require(sceCesSbcToUtf32le(cp1252, 0x9F, &utf32) == 0 && std::memcmp(&utf32, "\x78\x01\x00\x00", 4) == 0);
+
+    std::uint8_t sbc = 0;
+    Require(sceCesUcs2ToSbc(0x20AC, cp1252, &sbc) == 0 && sbc == 0x80);
+    Require(sceCesUcs2ToSbc(0x0410, cp1251, &sbc) == 0 && sbc == 0xC0);
+    Require(sceCesUcs2ToSbc(0x3042, cp1252, &sbc) == unassignedCode);
+    Require(sceCesUcs2ToSbc(0xD800, cp1252, &sbc) == invalidEncode);
+    Require(sceCesUcs2ToSbc(0x41, cp1252, nullptr) == invalidDstBuffer);
+    Require(sceCesUcs2ToSbc(0x41, static_cast<const std::uint8_t*>(sjis), &sbc) == invalidParameter);
+    const std::uint16_t euro[] = {0x20AC};
+    const std::uint16_t pair[] = {0xD83D, 0xDE00};
+    Require(sceCesUtf16ToSbc(euro, 1, &length, cp1252, &sbc) == 0 && sbc == 0x80 && length == 1);
+    Require(sceCesUtf16ToSbc(pair, 2, &length, cp1252, &sbc) == unassignedCode);
+    Require(sceCesUtf16ToSbc(pair, 1, &length, cp1252, &sbc) == srcBufferEnd);
+    Require(sceCesUtf16ToSbc(euro, 0, &length, cp1252, &sbc) == srcBufferEnd);
+    Require(sceCesUtf16ToSbc(nullptr, 1, &length, cp1252, &sbc) == invalidSrcBuffer);
+    std::uint16_t euroBe = 0;
+    std::memcpy(&euroBe, "\x20\xAC", 2);
+    Require(sceCesUtf16beToSbc(&euroBe, 1, &length, cp1252, &sbc) == 0 && sbc == 0x80);
+    std::uint16_t euroLe = 0;
+    std::memcpy(&euroLe, "\xAC\x20", 2);
+    Require(sceCesUtf16leToSbc(&euroLe, 1, &length, cp1252, &sbc) == 0 && sbc == 0x80);
+    Require(sceCesUtf32ToSbc(0x0178, cp1252, &sbc) == 0 && sbc == 0x9F);
+    Require(sceCesUtf32ToSbc(0x110000, cp1252, &sbc) == invalidEncode);
+    std::uint32_t yBe = 0;
+    std::memcpy(&yBe, "\x00\x00\x01\x78", 4);
+    Require(sceCesUtf32beToSbc(&yBe, cp1252, &sbc) == 0 && sbc == 0x9F);
+    std::uint32_t yLe = 0;
+    std::memcpy(&yLe, "\x78\x01\x00\x00", 4);
+    Require(sceCesUtf32leToSbc(&yLe, cp1252, &sbc) == 0 && sbc == 0x9F);
+    Require(sceCesUtf32leToSbc(nullptr, cp1252, &sbc) == invalidSrcBuffer);
+    for (int value = 0; value < 256; ++value) {
+        Require(sceCesSbcToUtf32(cp1251, static_cast<std::uint8_t>(value), &utf32) == 0);
+        Require(sceCesUtf32ToSbc(utf32, cp1251, &sbc) == 0 && sbc == value);
+    }
+
+    alignas(8) std::uint8_t context[64] = {};
+    Require(sceCesMbcsUcsContextInit(context, sjis) == 0);
+    const std::uint16_t wide[] = {0x3042, 'A', 0xFF71, 0};
+    std::uint8_t mbcs[8] = {};
+    std::uint32_t mbcsLength = 0;
+    Require(sceCesUtf16StrToMbcsStr(context, wide, 4, &length, mbcs, sizeof(mbcs), &mbcsLength) == 0);
+    Require(length == 3 && mbcsLength == 4 && std::memcmp(mbcs, "\x82\xA0" "A\xB1", 4) == 0);
+    Require(sceCesUtf16StrGetMbcsLen(context, wide, 4, &length, &mbcsLength) == 0 && length == 3 && mbcsLength == 4);
+    Require(sceCesUtf16StrToMbcsStr(context, wide, 4, &length, mbcs, 3, &mbcsLength) == dstBufferEnd);
+    Require(sceCesUtf16StrToMbcsStr(context, wide, 4, &length, nullptr, 3, &mbcsLength) == invalidDstBuffer);
+    Require(sceCesUtf16StrToMbcsStr(context, pair, 2, &length, mbcs, sizeof(mbcs), &mbcsLength) == unassignedCode);
+    const std::uint32_t wide32[] = {0x65E5, 'B', 0};
+    Require(sceCesUtf32StrToMbcsStr(context, wide32, 3, &length, mbcs, sizeof(mbcs), &mbcsLength) == 0);
+    Require(length == 2 && mbcsLength == 3 && std::memcmp(mbcs, "\x93\xFA" "B", 3) == 0);
+    Require(sceCesUtf32StrGetMbcsLen(context, wide32, 1, &length, &mbcsLength) == 0 && length == 1 && mbcsLength == 2);
+    const std::uint32_t bad32[] = {0xDC00};
+    Require(sceCesUtf32StrGetMbcsLen(context, bad32, 1, &length, &mbcsLength) == invalidEncode);
+
+    std::uint16_t utf16Out[4] = {};
+    std::uint32_t outLength = 0;
+    Require(sceCesMbcsStrToUtf16Str(context, Bytes("\x82\xA0" "A\xB1"), 8, &length, utf16Out, 4, &outLength) == 0);
+    Require(length == 4 && outLength == 3 && utf16Out[0] == 0x3042 && utf16Out[1] == 'A' && utf16Out[2] == 0xFF71);
+    Require(sceCesMbcsStrGetUtf16Len(context, Bytes("\x82\xA0" "A"), 3, &length, &outLength) == 0 && length == 3 && outLength == 2);
+    Require(sceCesMbcsStrToUtf16Str(context, Bytes("\x82\xA0" "A"), 3, &length, utf16Out, 1, &outLength) == dstBufferEnd);
+    Require(sceCesMbcsStrToUtf16Str(context, Bytes("\x82"), 1, &length, utf16Out, 4, &outLength) == srcBufferEnd);
+    std::uint32_t utf32Out[4] = {};
+    Require(sceCesMbcsStrToUtf32Str(context, Bytes("\x93\xFA" "B"), 3, &length, utf32Out, 4, &outLength) == 0);
+    Require(length == 3 && outLength == 2 && utf32Out[0] == 0x65E5 && utf32Out[1] == 'B');
+    Require(sceCesMbcsStrToUtf32Str(context, Bytes("A"), 1, &length, nullptr, 4, &outLength) == invalidDstBuffer);
+    Require(sceCesMbcsStrGetUtf32Len(context, Bytes("AB"), 2, &length, &outLength) == 0 && outLength == 2);
+    Require(sceCesMbcsStrGetUtf32Len(nullptr, Bytes("AB"), 2, &length, &outLength) == invalidParameter);
+
+    Require(sceCesMbcsUcsContextInit(context, cp1252) == 0);
+    Require(sceCesMbcsStrToUtf16Str(context, Bytes("\x80\xE9"), 2, &length, utf16Out, 4, &outLength) == 0);
+    Require(outLength == 2 && utf16Out[0] == 0x20AC && utf16Out[1] == 0x00E9);
+    return 0;
+}
diff --git a/core/libs/tests/GuestCharacter.cpp b/core/libs/tests/GuestCharacter.cpp
index 7601716b77..c6fc299ba0 100644
--- a/core/libs/tests/GuestCharacter.cpp
+++ b/core/libs/tests/GuestCharacter.cpp
@@ -1,44 +1,32 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
 #include <cctype>
 #include <clocale>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-extern "C" {
-int APS5_VABI isupper_nid_postfix(int);
-int APS5_VABI islower_nid_postfix(int);
-int APS5_VABI isalpha_nid_postfix(int);
-int APS5_VABI isdigit_nid_postfix(int);
-int APS5_VABI isalnum_nid_postfix(int);
-int APS5_VABI isspace_nid_postfix(int);
-int APS5_VABI isblank_nid_postfix(int);
-int APS5_VABI iscntrl_nid_postfix(int);
-int APS5_VABI isprint_nid_postfix(int);
-int APS5_VABI isgraph_nid_postfix(int);
-int APS5_VABI ispunct_nid_postfix(int);
-int APS5_VABI isxdigit_nid_postfix(int);
-int APS5_VABI toupper_nid_postfix(int);
-int APS5_VABI tolower_nid_postfix(int);
-const short* APS5_VABI _Getptolower_nid_postfix();
-const short* APS5_VABI _Getptoupper_nid_postfix();
-const char* APS5_VABI setlocale_nid_postfix(int, const char*);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     Require(std::setlocale(LC_CTYPE, "C") != nullptr);
     for (int category = 0; category <= 6; ++category) {
         const char* result = setlocale_nid_postfix(category, "C");
         Require(result != nullptr && std::strcmp(result, "C") == 0);
-        result = setlocale_nid_postfix(category, "POSIX");
-        Require(result != nullptr && std::strcmp(result, "C") == 0);
+        Require(setlocale_nid_postfix(category, "POSIX") == nullptr);
         result = setlocale_nid_postfix(category, nullptr);
         Require(result != nullptr && std::strcmp(result, "C") == 0);
         result = setlocale_nid_postfix(category, "");
         Require(result != nullptr && std::strcmp(result, "C") == 0);
         Require(setlocale_nid_postfix(category, "en_US.UTF-8") == nullptr);
     }
-    Require(setlocale_nid_postfix(-1, "C") == nullptr);
-    Require(setlocale_nid_postfix(7, "C") == nullptr);
+    for (const int category : std::array<int, 4>{-1, 7, 100, 1 << 30}) {
+        const char* result = setlocale_nid_postfix(category, "C");
+        Require(result != nullptr && std::strcmp(result, "C") == 0);
+        result = setlocale_nid_postfix(category, nullptr);
+        Require(result != nullptr && std::strcmp(result, "C") == 0);
+        Require(setlocale_nid_postfix(category, "POSIX") == nullptr && setlocale_nid_postfix(category, "x") == nullptr);
+    }
     for (int c = EOF; c <= 255; ++c) {
         Require(bool(isupper_nid_postfix(c)) == bool(std::isupper(c)));
         Require(bool(islower_nid_postfix(c)) == bool(std::islower(c)));
@@ -52,9 +40,16 @@ int main() {
         Require(bool(isgraph_nid_postfix(c)) == bool(std::isgraph(c)));
         Require(bool(ispunct_nid_postfix(c)) == bool(std::ispunct(c)));
         Require(bool(isxdigit_nid_postfix(c)) == bool(std::isxdigit(c)));
+        Require(bool(isascii_nid_postfix(c)) == (c >= 0 && c <= 127));
+        Require(toascii_nid_postfix(c) == (c & 0x7F));
         Require(toupper_nid_postfix(c) == std::toupper(c));
         Require(tolower_nid_postfix(c) == std::tolower(c));
         Require(toupper_nid_postfix(c) == _Getptoupper_nid_postfix()[c]);
         Require(tolower_nid_postfix(c) == _Getptolower_nid_postfix()[c]);
     }
+    Require(!isascii_nid_postfix(-100));
+    Require(!isascii_nid_postfix(128));
+    Require(!isascii_nid_postfix(256));
+    Require(toascii_nid_postfix(258) == 2);
+    Require(toascii_nid_postfix(-1) == 0x7F);
 }
diff --git a/core/libs/tests/GuestClosedStandardDescriptors.cpp b/core/libs/tests/GuestClosedStandardDescriptors.cpp
index 4cb0deece1..de4c2500e5 100644
--- a/core/libs/tests/GuestClosedStandardDescriptors.cpp
+++ b/core/libs/tests/GuestClosedStandardDescriptors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstring>
@@ -6,10 +7,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-}
-
 namespace {
 
 constexpr int GuestGetFlags = 3;
diff --git a/core/libs/tests/GuestClosedStandardDescriptorsWindows.cpp b/core/libs/tests/GuestClosedStandardDescriptorsWindows.cpp
new file mode 100644
index 0000000000..b5633d602a
--- /dev/null
+++ b/core/libs/tests/GuestClosedStandardDescriptorsWindows.cpp
@@ -0,0 +1,93 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <windows.h>
+#include <io.h>
+
+extern "C" {
+
+extern FileStream* __stdinp_nid_postfix;
+extern FileStream* __stdoutp_nid_postfix;
+extern FileStream* __stderrp_nid_postfix;
+
+}
+
+namespace {
+
+constexpr int GuestGetDescriptorFlags = 1;
+constexpr int GuestGetFlags = 3;
+constexpr int GuestAccessMode = 3;
+constexpr int GuestReadOnly = 0;
+constexpr int GuestWriteOnly = 1;
+
+int Child(const char* closed) {
+    for (int descriptor = 0; descriptor <= 2; ++descriptor) {
+        if (closed[descriptor] != '1') continue;
+        const auto handle = reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor));
+        if (handle == INVALID_HANDLE_VALUE || handle == reinterpret_cast<HANDLE>(-2)) return 70 + descriptor;
+        if (::GetFileType(handle) != FILE_TYPE_CHAR) return 73 + descriptor;
+        if (fcntl_nid_postfix(descriptor, GuestGetDescriptorFlags) != 0) return 76 + descriptor;
+        const int expected = descriptor == 0 ? GuestReadOnly : GuestWriteOnly;
+        if ((fcntl_nid_postfix(descriptor, GuestGetFlags) & GuestAccessMode) != expected) return 79 + descriptor;
+        std::FILE* const host = descriptor == 0 ? stdin : descriptor == 1 ? stdout : stderr;
+        FileStream* const guest = descriptor == 0 ? __stdinp_nid_postfix : descriptor == 1 ? __stdoutp_nid_postfix : __stderrp_nid_postfix;
+        if (::_fileno(host) != descriptor) return 82 + descriptor;
+        if (guest->GuestState().descriptor != descriptor) return 96 + descriptor;
+        if (fileno_nid_postfix(guest) != descriptor) return 85 + descriptor;
+        if (descriptor == 0) {
+            if (std::fgetc(host) != EOF || std::feof(host) == 0 || std::ferror(host) != 0) return 88;
+            std::clearerr(host);
+            if (fgetc_nid_postfix(guest) != EOF || feof_nid_postfix(guest) == 0 || ferror_nid_postfix(guest) != 0) return 89;
+            clearerr_nid_postfix(guest);
+        } else {
+            if (std::fputc('x', host) == EOF || std::fflush(host) != 0 || std::ferror(host) != 0) return 90 + descriptor;
+            if (fputc_nid_postfix('x', guest) == EOF || fflush_nid_postfix(guest) != 0 || ferror_nid_postfix(guest) != 0) return 93 + descriptor;
+        }
+    }
+    return 0;
+}
+
+DWORD RunWithout(const wchar_t* self, bool input, bool output, bool error) {
+    std::wstring command = std::wstring(L"\"") + self + L"\" --closed-child " + (input ? L"1" : L"0") + (output ? L"1" : L"0") + (error ? L"1" : L"0");
+    STARTUPINFOW startup{};
+    startup.cb = sizeof(startup);
+    startup.dwFlags = STARTF_USESTDHANDLES;
+    startup.hStdInput = input ? nullptr : GetStdHandle(STD_INPUT_HANDLE);
+    startup.hStdOutput = output ? nullptr : GetStdHandle(STD_OUTPUT_HANDLE);
+    startup.hStdError = error ? nullptr : GetStdHandle(STD_ERROR_HANDLE);
+    PROCESS_INFORMATION process{};
+    if (!CreateProcessW(self, command.data(), nullptr, nullptr, TRUE, DETACHED_PROCESS, nullptr, nullptr, &startup, &process)) return 0xffffffffu;
+    DWORD code = 0xfffffffeu;
+    if (WaitForSingleObject(process.hProcess, 10000) == WAIT_OBJECT_0) GetExitCodeProcess(process.hProcess, &code);
+    else TerminateProcess(process.hProcess, code);
+    CloseHandle(process.hThread);
+    CloseHandle(process.hProcess);
+    return code;
+}
+
+}
+
+int main(int argc, char** argv) {
+    if (argc > 2 && std::strcmp(argv[1], "--closed-child") == 0 && std::strlen(argv[2]) == 3) return Child(argv[2]);
+    wchar_t self[MAX_PATH];
+    if (GetModuleFileNameW(nullptr, self, MAX_PATH) == 0) return 2;
+    const struct { bool input, output, error; const char* name; } cases[] = {
+        {true, false, false, "stdin"},
+        {false, true, false, "stdout"},
+        {false, false, true, "stderr"},
+        {true, true, true, "all three"},
+    };
+    for (const auto& test : cases) {
+        const DWORD result = RunWithout(self, test.input, test.output, test.error);
+        if (result != 0) {
+            std::fprintf(stderr, "missing standard handles, %s: child exited with %lu\n", test.name, result);
+            return 1;
+        }
+    }
+    std::puts("missing standard handles are opened on NUL");
+    return 0;
+}
diff --git a/core/libs/tests/GuestClosedStandardStreamsLoadWindows.cpp b/core/libs/tests/GuestClosedStandardStreamsLoadWindows.cpp
new file mode 100644
index 0000000000..da5ce1a579
--- /dev/null
+++ b/core/libs/tests/GuestClosedStandardStreamsLoadWindows.cpp
@@ -0,0 +1,104 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstdint>
+#include <cwchar>
+#include <string>
+#include <windows.h>
+#include <shellapi.h>
+#include <io.h>
+
+extern "C" {
+_invalid_parameter_handler _set_thread_local_invalid_parameter_handler(_invalid_parameter_handler);
+
+}
+
+namespace {
+int invalidCalls = 0;
+
+void InvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned int, std::uintptr_t) {
+    ++invalidCalls;
+}
+
+DWORD RunPrebound(const std::wstring& library, HANDLE report) {
+    wchar_t self[MAX_PATH];
+    const DWORD length = GetModuleFileNameW(nullptr, self, MAX_PATH);
+    if (length == 0 || length >= MAX_PATH) return 0xffffffffu;
+    HANDLE inherited = nullptr;
+    if (!DuplicateHandle(GetCurrentProcess(), report, GetCurrentProcess(), &inherited, 0, TRUE, DUPLICATE_SAME_ACCESS)) return 0xfffffffeu;
+    std::wstring command = L"\"" + std::wstring(self) + L"\" \"" + library + L"\" --prebound";
+    STARTUPINFOW startup{};
+    startup.cb = sizeof(startup);
+    startup.dwFlags = STARTF_USESTDHANDLES;
+    startup.hStdError = inherited;
+    PROCESS_INFORMATION process{};
+    const bool created = CreateProcessW(self, command.data(), nullptr, nullptr, TRUE, DETACHED_PROCESS, nullptr, nullptr, &startup, &process) != 0;
+    CloseHandle(inherited);
+    if (!created) return 0xfffffffdu;
+    DWORD code = 0xfffffffcu;
+    if (WaitForSingleObject(process.hProcess, 5000) == WAIT_OBJECT_0) GetExitCodeProcess(process.hProcess, &code);
+    else TerminateProcess(process.hProcess, code);
+    CloseHandle(process.hThread);
+    CloseHandle(process.hProcess);
+    return code;
+}
+}
+
+int main() {
+    HANDLE report = nullptr;
+    if (!DuplicateHandle(GetCurrentProcess(), GetStdHandle(STD_ERROR_HANDLE), GetCurrentProcess(), &report, 0, FALSE, DUPLICATE_SAME_ACCESS)) return 1;
+    const auto finish = [&](int code, const std::string& message) {
+        DWORD written = 0;
+        WriteFile(report, message.data(), static_cast<DWORD>(message.size()), &written, nullptr);
+        CloseHandle(report);
+        return code;
+    };
+    int count = 0;
+    auto** const arguments = CommandLineToArgvW(GetCommandLineW(), &count);
+    if (!arguments || (count != 2 && count != 3) || (count == 3 && std::wcscmp(arguments[2], L"--prebound") != 0)) {
+        if (arguments) LocalFree(arguments);
+        return finish(2, "expected one libc path argument\n");
+    }
+    const std::wstring library(arguments[1]);
+    const bool prebound = count == 3;
+    LocalFree(arguments);
+    int outputDescriptor = 1;
+    if (prebound) {
+        if (::_fileno(stdout) != -2 || ::_wfreopen(L"NUL", L"wb", stdout) != stdout)
+            return finish(11, "cannot prepare an already rebound stdout\n");
+        outputDescriptor = ::_fileno(stdout);
+        if (outputDescriptor < 3 || ::_get_osfhandle(1) != -2)
+            return finish(11, "stdout did not retain its separate descriptor\n");
+    } else {
+        const DWORD child = RunPrebound(library, report);
+        if (child != 0) return finish(12, "prebound stdout child exited with " + std::to_string(child) + "\n");
+        for (int descriptor : {1, 2}) {
+            if (::_fileno(__acrt_iob_func(descriptor)) != descriptor || ::_close(descriptor) != 0)
+                return finish(4, "cannot close an inherited standard descriptor\n");
+        }
+    }
+    const auto previous = _set_thread_local_invalid_parameter_handler(InvalidParameter);
+    const auto module = LoadLibraryW(library.c_str());
+    const DWORD loadError = module == nullptr ? GetLastError() : ERROR_SUCCESS;
+    _set_thread_local_invalid_parameter_handler(previous);
+    if (module == nullptr) return finish(5, "cannot load libc: " + std::to_string(loadError) + "\n");
+    if (invalidCalls != 0) return finish(6, "restoring bound standard streams invoked the invalid parameter handler " + std::to_string(invalidCalls) + " times\n");
+    const auto put = reinterpret_cast<decltype(&fputc_nid_postfix)>(GetProcAddress(module, "fputc_nid_postfix"));
+    const auto flush = reinterpret_cast<decltype(&fflush_nid_postfix)>(GetProcAddress(module, "fflush_nid_postfix"));
+    if (!put || !flush) return finish(7, "cannot find guest stream operations\n");
+    if (::_write(1, "x", 1) != 1) return finish(13, "the restored stdout descriptor cannot write\n");
+    for (int descriptor : {1, 2}) {
+        const auto pointer = GetProcAddress(module, descriptor == 1 ? "__stdoutp_nid_postfix" : "__stderrp_nid_postfix");
+        if (!pointer) return finish(8, "cannot find a guest standard stream\n");
+        auto* const guest = *reinterpret_cast<FileStream**>(pointer);
+        auto* const host = __acrt_iob_func(descriptor);
+        const int expected = descriptor == 1 ? outputDescriptor : descriptor;
+        if (!guest || guest->GuestState().descriptor != expected || ::_fileno(host) != expected)
+            return finish(9, "a restored stream has the wrong descriptor\n");
+        if (std::fputc('x', host) != 'x' || std::fflush(host) != 0 || put('x', guest) != 'x' || flush(guest) != 0)
+            return finish(10, "a restored stream cannot write to NUL\n");
+    }
+    return finish(0, "bound standard streams are restored without invalid parameter callbacks\n");
+}
diff --git a/core/libs/tests/GuestCollate.cpp b/core/libs/tests/GuestCollate.cpp
index 7dec7aabab..f886933573 100644
--- a/core/libs/tests/GuestCollate.cpp
+++ b/core/libs/tests/GuestCollate.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include <array>
@@ -10,8 +11,7 @@
 
 extern "C" {
 extern GuestLocale::Implementation* _ZSt21_sceLibcClassicLocale_nid_postfix;
-std::size_t APS5_VABI _ZNSt7collateIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
-std::size_t APS5_VABI _ZNSt7collateIwE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(GuestLocale::Facet** facet, const GuestLocale::Implementation* const* locale);
+
 }
 
 namespace {
diff --git a/core/libs/tests/GuestCommonDialog.cpp b/core/libs/tests/GuestCommonDialog.cpp
index 1638caf9ec..b0d74a3b47 100644
--- a/core/libs/tests/GuestCommonDialog.cpp
+++ b/core/libs/tests/GuestCommonDialog.cpp
@@ -1,24 +1,23 @@
+#include "prx/libSceCommonDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceCommonDialogInitialize(void);
-bool APS5_VABI sceCommonDialogIsUsed(void);
-}
-
 namespace {
 
 void Require(bool value) {
     if (!value) std::abort();
 }
 
+constexpr int kErrAlreadySystemInitialized = static_cast<int>(0x80B80002);
+
 }
 
 int main() {
     Require(!sceCommonDialogIsUsed());
     Require(sceCommonDialogInitialize() == COMMON_DIALOG_OK);
     Require(!sceCommonDialogIsUsed());
-    Require(sceCommonDialogInitialize() == COMMON_DIALOG_ERROR_ALREADY_INITIALIZED);
+    Require(sceCommonDialogInitialize() == kErrAlreadySystemInitialized);
+    Require(sceCommonDialogInitialize() == kErrAlreadySystemInitialized);
     Require(!sceCommonDialogIsUsed());
 }
diff --git a/core/libs/tests/GuestCompanionHttpd.cpp b/core/libs/tests/GuestCompanionHttpd.cpp
new file mode 100644
index 0000000000..afe5b08822
--- /dev/null
+++ b/core/libs/tests/GuestCompanionHttpd.cpp
@@ -0,0 +1,110 @@
+#include "prx/libSceCompanionHttpd/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+constexpr int InvalidParam = static_cast<int>(0x80E40004u);
+constexpr int NotInitialized = static_cast<int>(0x80E40006u);
+constexpr int AlreadyInitialized = static_cast<int>(0x80E40007u);
+constexpr int NoEvent = static_cast<int>(0x80E40008u);
+constexpr int AlreadyStarted = static_cast<int>(0x80E4000Au);
+constexpr int NotStarted = static_cast<int>(0x80E4000Bu);
+constexpr int AlreadyRegistered = static_cast<int>(0x80E4000Cu);
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "CompanionHttpd: %s\n", message);
+        std::abort();
+    }
+}
+
+template <typename TCall>
+void RequireNotImplemented(TCall call, const std::string& name) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        Require(std::string(error.what()) == name + " not implemented", "a companion function threw another error");
+        return;
+    }
+    Require(false, "a companion function that should throw returned");
+}
+
+int APS5_VABI RequestCallback(int, int, const void*, void*, void*) {
+    std::fprintf(stderr, "CompanionHttpd: the request callback was called\n");
+    std::abort();
+}
+
+void CheckOptionBlock() {
+    unsigned char block[0x70];
+    std::memset(block, 0x5a, sizeof(block));
+    Require(sceCompanionHttpdOptParamInitialize(nullptr) == InvalidParam, "a null option block must be rejected");
+    Require(sceCompanionHttpdOptParamInitialize(reinterpret_cast<CompanionHttpdOptParam*>(block)) == 0, "sceCompanionHttpdOptParamInitialize failed");
+    for (std::size_t index = 0; index < sizeof(block); ++index) {
+        Require(block[index] == (index < 0x60 ? 0u : 0x5au), "the option block must be zeroed over its 0x60 bytes and nothing past them");
+    }
+}
+
+void CheckStates() {
+    unsigned char param[0x60]{};
+    unsigned char event[0x104];
+    std::memset(event, 0x5a, sizeof(event));
+    unsigned char untouched[0x104];
+    std::memset(untouched, 0x5a, sizeof(untouched));
+    auto* callback = reinterpret_cast<void*>(&RequestCallback);
+    Require(sceCompanionHttpdGetEvent(event) == NotInitialized, "an event before initialization");
+    Require(sceCompanionHttpdStart() == NotInitialized, "a start before initialization");
+    Require(sceCompanionHttpdStop() == NotInitialized, "a stop before initialization");
+    Require(sceCompanionHttpdTerminate() == NotInitialized, "a termination before initialization");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), nullptr) == NotInitialized, "a callback before initialization");
+    Require(sceCompanionHttpdUnregisterRequestCallback() == NotInitialized, "an unregistration before initialization");
+    Require(sceCompanionHttpdInitialize(nullptr) == InvalidParam, "a null parameter must be rejected");
+    Require(sceCompanionHttpdInitialize(reinterpret_cast<const CompanionHttpdOptParam*>(param)) == 0, "sceCompanionHttpdInitialize failed");
+    Require(sceCompanionHttpdInitialize(reinterpret_cast<const CompanionHttpdOptParam*>(param)) == AlreadyInitialized, "a second initialization");
+    Require(sceCompanionHttpdRegisterRequestCallback(nullptr, nullptr) == InvalidParam, "a null callback must be rejected");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), param) == 0, "registering the request callback failed");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), param) == AlreadyRegistered, "a second callback");
+    Require(sceCompanionHttpdGetEvent(nullptr) == InvalidParam, "a null event must be rejected");
+    Require(sceCompanionHttpdGetEvent(event) == NoEvent, "no companion device connects before the start");
+    Require(sceCompanionHttpdStop() == NotStarted, "a stop before the start");
+    Require(sceCompanionHttpdStart() == 0, "sceCompanionHttpdStart failed");
+    Require(sceCompanionHttpdStart() == AlreadyStarted, "a second start");
+    Require(sceCompanionHttpdGetEvent(event) == NoEvent, "no companion device connects after the start");
+    Require(std::memcmp(event, untouched, sizeof(event)) == 0, "sceCompanionHttpdGetEvent wrote the event");
+    RequireNotImplemented([] { sceCompanionHttpdTerminate(); }, "sceCompanionHttpdTerminate");
+    Require(sceCompanionHttpdStop() == 0, "sceCompanionHttpdStop failed");
+    Require(sceCompanionHttpdUnregisterRequestCallback() == 0, "unregistering the request callback failed");
+    RequireNotImplemented([] { sceCompanionHttpdUnregisterRequestCallback(); }, "sceCompanionHttpdUnregisterRequestCallback");
+    Require(sceCompanionHttpdTerminate() == 0, "sceCompanionHttpdTerminate failed");
+    Require(sceCompanionHttpdTerminate() == NotInitialized, "a second termination");
+    Require(sceCompanionHttpdInitialize(reinterpret_cast<const CompanionHttpdOptParam*>(param)) == 0, "initializing again after the termination failed");
+    Require(sceCompanionHttpdRegisterRequestCallback(reinterpret_cast<CompanionHttpdRequestCallback>(callback), nullptr) == 0, "the termination kept the callback");
+    Require(sceCompanionHttpdTerminate() == 0, "the last termination failed");
+}
+
+void CheckResponseBuilders() {
+    unsigned char response[0x20]{};
+    RequireNotImplemented([&] { sceCompanionHttpdAddHeader("key", "value", response); }, "sceCompanionHttpdAddHeader");
+    RequireNotImplemented([&] { sceCompanionHttpdSetStatus(200, response); }, "sceCompanionHttpdSetStatus");
+    RequireNotImplemented([&] { sceCompanionHttpdSetBody("body", 4, response); }, "sceCompanionHttpdSetBody");
+    RequireNotImplemented([] { sceCompanionHttpdGet2ndScreenStatus(); }, "sceCompanionHttpdGet2ndScreenStatus");
+    RequireNotImplemented([] { sceCompanionHttpdGetUserId(); }, "sceCompanionHttpdGetUserId");
+    RequireNotImplemented([] { sceCompanionHttpdInitialize2(); }, "sceCompanionHttpdInitialize2");
+    RequireNotImplemented([] { sceCompanionHttpdRegisterRequestBodyReceptionCallback(); }, "sceCompanionHttpdRegisterRequestBodyReceptionCallback");
+    RequireNotImplemented([] { sceCompanionHttpdRegisterRequestCallback2(); }, "sceCompanionHttpdRegisterRequestCallback2");
+    RequireNotImplemented([] { sceCompanionHttpdUnregisterRequestBodyReceptionCallback(); }, "sceCompanionHttpdUnregisterRequestBodyReceptionCallback");
+}
+
+}
+
+int main() {
+    CheckOptionBlock();
+    CheckStates();
+    CheckResponseBuilders();
+    return 0;
+}
diff --git a/core/libs/tests/GuestCondRecursiveMutex.cpp b/core/libs/tests/GuestCondRecursiveMutex.cpp
index 92f7166071..e21300d818 100644
--- a/core/libs/tests/GuestCondRecursiveMutex.cpp
+++ b/core/libs/tests/GuestCondRecursiveMutex.cpp
@@ -1,29 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 static constexpr int POSIX_ETIMEDOUT = 60;
 static constexpr int MUTEX_TYPE_RECURSIVE = 2;
 
diff --git a/core/libs/tests/GuestCondTimedwait.cpp b/core/libs/tests/GuestCondTimedwait.cpp
index 434d257d2d..70db4b4e2b 100644
--- a/core/libs/tests/GuestCondTimedwait.cpp
+++ b/core/libs/tests/GuestCondTimedwait.cpp
@@ -1,36 +1,18 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI pthread_cond_init_nid_postfix(PthreadCond* cond, const PthreadCondattr* attr);
-int APS5_VABI pthread_cond_destroy_nid_postfix(PthreadCond* cond);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI pthread_cond_reltimedwait_np_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *)(void*), void*, void*);
-void APS5_VABI __pthread_cxa_finalize_nid_postfix(void*);
-unsigned int APS5_VABI sceKernelSleep(unsigned int seconds);
-}
-
 static int cleanupAt = -1;
 static void APS5_VABI Cleanup(void*) { cleanupAt = 0; }
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
 static constexpr int POSIX_EPERM = 1;
 static constexpr int POSIX_EINVAL = 22;
 static constexpr int POSIX_ETIMEDOUT = 60;
@@ -55,6 +37,7 @@ struct Signalled {
     PthreadCond cond = nullptr;
     bool ready = false;
     int trylock = SCE_OK;
+    Pthread target = nullptr;
 };
 
 static void* APS5_VABI Trylocker(void* arg) {
@@ -72,6 +55,15 @@ static void* APS5_VABI Signaller(void* arg) {
     return nullptr;
 }
 
+static void* APS5_VABI SignallerTo(void* arg) {
+    auto& signalled = *static_cast<Signalled*>(arg);
+    Require(scePthreadMutexLock(&signalled.mutex) == SCE_OK);
+    signalled.ready = true;
+    Require(pthread_cond_signalto_np_nid_postfix(&signalled.cond, signalled.target) == 0);
+    Require(scePthreadMutexUnlock(&signalled.mutex) == SCE_OK);
+    return nullptr;
+}
+
 static void RequireHeldByCaller(Signalled& signalled) {
     Pthread thread = nullptr;
     Require(scePthreadCreate(&thread, nullptr, Trylocker, &signalled, nullptr) == SCE_OK);
@@ -108,8 +100,29 @@ static void RelativeWait() {
     Require(scePthreadMutexDestroy(&signalled.mutex) == SCE_OK);
 }
 
+static void SignalTo() {
+    Signalled signalled;
+    signalled.target = scePthreadSelf();
+    Require(scePthreadMutexInit(&signalled.mutex, nullptr, nullptr) == SCE_OK);
+    Require(scePthreadCondInit(&signalled.cond, nullptr, nullptr) == SCE_OK);
+    Require(pthread_cond_signalto_np_nid_postfix(&signalled.cond, signalled.target) == 0);
+    Require(scePthreadMutexLock(&signalled.mutex) == SCE_OK);
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, SignallerTo, &signalled, nullptr) == SCE_OK);
+    const auto waitStart = std::chrono::steady_clock::now();
+    while (!signalled.ready)
+        Require(pthread_cond_reltimedwait_np_nid_postfix(&signalled.cond, &signalled.mutex, 10000000) == 0);
+    Require(std::chrono::steady_clock::now() - waitStart < std::chrono::seconds(5));
+    Require(scePthreadMutexUnlock(&signalled.mutex) == SCE_OK);
+    Require(scePthreadJoin(thread, nullptr) == SCE_OK);
+    Require(scePthreadCondDestroy(&signalled.cond) == SCE_OK);
+    Require(pthread_cond_signalto_np_nid_postfix(&signalled.cond, signalled.target) == 22);
+    Require(scePthreadMutexDestroy(&signalled.mutex) == SCE_OK);
+}
+
 int main() {
     RelativeWait();
+    SignalTo();
 
     Context context;
     PthreadCond cond = nullptr;
@@ -148,5 +161,6 @@ int main() {
     void* finalizeHandle = reinterpret_cast<void*>(7);
     Require(__cxa_atexit_nid_postfix(Cleanup, nullptr, finalizeHandle) == SCE_OK);
     __pthread_cxa_finalize_nid_postfix(finalizeHandle);
+
     Require(cleanupAt == 0);
 }
diff --git a/core/libs/tests/GuestCondUnownedMutex.cpp b/core/libs/tests/GuestCondUnownedMutex.cpp
index f68fe17391..124b772719 100644
--- a/core/libs/tests/GuestCondUnownedMutex.cpp
+++ b/core/libs/tests/GuestCondUnownedMutex.cpp
@@ -1,28 +1,15 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, unsigned int usec);
-int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int POSIX_EPERM = 1;
 static constexpr int POSIX_EINVAL = 22;
 static constexpr std::uintptr_t ADAPTIVE_INITIALIZER = 1;
diff --git a/core/libs/tests/GuestContentDelete.cpp b/core/libs/tests/GuestContentDelete.cpp
index 06cebf5b38..caafe4a5bd 100644
--- a/core/libs/tests/GuestContentDelete.cpp
+++ b/core/libs/tests/GuestContentDelete.cpp
@@ -1,14 +1,10 @@
+#include "prx/libSceContentDelete/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI sceContentDeleteInitialize(const ContentDeleteInitParam* initParam);
-extern "C" int APS5_VABI sceContentDeleteTerminate(void);
-extern "C" int APS5_VABI sceContentDeleteById(std::int64_t contentId);
-extern "C" int APS5_VABI sceContentDeleteByPath(const char* contentPath);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestContentExport.cpp b/core/libs/tests/GuestContentExport.cpp
index 4f72b3a7c7..07fa418b6d 100644
--- a/core/libs/tests/GuestContentExport.cpp
+++ b/core/libs/tests/GuestContentExport.cpp
@@ -1,30 +1,10 @@
+#include "prx/libSceContentExport/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <set>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceContentExportAddToFavorites(std::int64_t contentId);
-extern "C" int APS5_VABI sceContentExportDataProvideFunction(void);
-extern "C" int APS5_VABI sceContentExportFree(void);
-extern "C" int APS5_VABI sceContentExportFrom(void);
-extern "C" int APS5_VABI sceContentExportFromFileForSf(std::int32_t expId, const ContentExportParam* param, const ContentExportSfParam* sfParam, const char* sourcePath, const char* thumbnailPath, char* path, std::size_t pathBufferLength);
-extern "C" int APS5_VABI sceContentExportFromFileWithContentIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const std::int64_t* contentIds, std::uint32_t contentCount, char* path, std::size_t pathBufferLength);
-extern "C" int APS5_VABI sceContentExportFromFileWithTitleIdList(std::int32_t expId, const ContentExportParam* param, const char* sourcePath, const char* thumbnailPath, const char* titleIdList, char* path, std::size_t pathBufferLength);
-extern "C" int APS5_VABI sceContentExportInit(const ContentExportInitParam* param);
-extern "C" int APS5_VABI sceContentExportMalloc(void);
-extern "C" int APS5_VABI sceContentExportRemoveFromFavorites(std::int64_t contentId);
-extern "C" int APS5_VABI sceContentExportRenameContent(std::int64_t contentId, const char* name);
-extern "C" int APS5_VABI sceContentExportValidateContents(const std::int64_t* contentIds, std::uint32_t count);
-
-extern "C" int APS5_VABI sceContentExportInit2(const ContentExportInitParam2* init_param);
-extern "C" int APS5_VABI sceContentExportTerm(void);
-extern "C" int APS5_VABI sceContentExportStart(void);
-extern "C" int APS5_VABI sceContentExportFinish(std::int32_t expId);
-extern "C" int APS5_VABI sceContentExportGetProgress(std::int32_t expId);
-extern "C" int APS5_VABI sceContentExportCancel(std::int32_t expId);
-extern "C" int APS5_VABI sceContentExportFromDataWithThumbnail(std::int32_t expId, const ContentExportParam* param, const ContentExportCallbackParam* contentCallbackParam, const char* thumbnailType, const ContentExportCallbackParam* thumbnailCallbackParam, char* path, std::size_t pathBufferLength);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -47,6 +27,7 @@ void Export(std::int32_t expId) {
     ContentExportCallbackParam content{};
     ContentExportCallbackParam thumbnail{};
     sceContentExportFromDataWithThumbnail(expId, &param, &content, "image/png", &thumbnail, path, sizeof(path));
+
 }
 
 }
diff --git a/core/libs/tests/GuestContentSearch.cpp b/core/libs/tests/GuestContentSearch.cpp
index e9facbccc1..c262e8a9df 100644
--- a/core/libs/tests/GuestContentSearch.cpp
+++ b/core/libs/tests/GuestContentSearch.cpp
@@ -1,26 +1,23 @@
+#include "prx/libSceContentSearch/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceContentSearchInit(const ContentSearchInitParam* init_param);
-int APS5_VABI sceContentSearchTerm(void);
-int APS5_VABI sceContentSearchGetContentLastUpdateId(std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchGetNumOfContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* numOfContent, std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchGetTotalContentSize(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, std::int64_t* size, std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchSearchContent(const ContentSearchContentColumnSet* columnSet, std::uint32_t columnSetLength, const ContentSearchContentOrderByCondition* orderByConditions, std::uint32_t orderByConditionsLength, std::uint32_t offset, std::uint32_t limit, std::int64_t* numOfContent, void* infos, std::int64_t* lastUpdateId);
-int APS5_VABI sceContentSearchOpenMetadata(const char* filePath, std::int32_t* metadataId);
-int APS5_VABI sceContentSearchOpenMetadataByContentId(std::int64_t contentId, std::int32_t* metadataId);
-int APS5_VABI sceContentSearchCloseMetadata(std::int32_t metadataId);
-int APS5_VABI sceContentSearchGetMetadataFieldInfo(std::int32_t metadataId, const char* field, std::int32_t* metadataType, std::int32_t* size);
-int APS5_VABI sceContentSearchGetMetadataValue(std::int32_t metadataId, const char* field, void* value);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
 
+template <typename TAction>
+bool ThrowsRuntimeError(TAction action) {
+    try {
+        action();
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
 template <typename TAction>
 bool Throws(TAction action) {
     try {
@@ -136,4 +133,18 @@ int main() {
     Require(sceContentSearchTerm() == 0);
     Require(sceContentSearchGetContentLastUpdateId(&updateId) == ErrorNotInitialized);
     Require(updateId == -1);
+    constexpr int binderResult = static_cast<int>(0x809D000F);
+    Require(sceContentBinderInitialize() == binderResult);
+    Require(sceContentBinderStart() == binderResult);
+    Require(sceContentBinderReset() == binderResult);
+    Require(sceContentBinderIsUpdated() == binderResult);
+    Require(sceContentBinderGetNumOfDifference() == binderResult);
+    Require(sceContentBinderSearchDifference() == binderResult);
+    Require(sceContentBinderEnd() == binderResult);
+    Require(sceContentBinderTerminate() == binderResult);
+
+    Require(ThrowsRuntimeError([] { sceContentSearchGetApplicationLastUpdateId(); }));
+    Require(ThrowsRuntimeError([] { sceContentSearchGetMyApplicationIndex(); }));
+    Require(ThrowsRuntimeError([] { sceContentSearchGetNumOfApplication(); }));
+    Require(ThrowsRuntimeError([] { sceContentSearchSearchApplication(); }));
 }
diff --git a/core/libs/tests/GuestConvertKeycode.cpp b/core/libs/tests/GuestConvertKeycode.cpp
index cce08ee498..8bf7b815b0 100644
--- a/core/libs/tests/GuestConvertKeycode.cpp
+++ b/core/libs/tests/GuestConvertKeycode.cpp
@@ -1,19 +1,125 @@
+#include "prx/libSceConvertKeycode/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "ProcessParametersFixture.hpp"
+#include "prx/libSceConvertKeycode/ImeKeyboardType.hpp"
+#include <array>
+#include <cstddef>
+#include <cstring>
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
-
-extern "C" {
-int APS5_VABI sceConvertKeycodeGetVirtualKeycode(std::uint16_t, std::uint32_t, std::uint16_t*);
-int APS5_VABI sceConvertKeycodeGetImeKeyboardType(std::int32_t, std::uint32_t*);
-int APS5_VABI sceConvertKeycodeGetCharacter(std::uint16_t, std::uint32_t, std::uint32_t, char16_t*);
-}
+#include <string>
+#include <utility>
 
 static void Require(bool value) { if (!value) std::abort(); }
 
+static void SetLanguage(const char* value) {
+#ifdef _WIN32
+    Require(_putenv_s("ANYPS5_LANGUAGE", value != nullptr ? value : "") == 0);
+#else
+    Require((value != nullptr ? ::setenv("ANYPS5_LANGUAGE", value, 1) : ::unsetenv("ANYPS5_LANGUAGE")) == 0);
+#endif
+}
+
+namespace {
+
+struct FakeUser {
+    int keyboardResult = 0;
+    std::int32_t keyboardType = 0;
+    int japaneseResult = 0;
+    std::int32_t japaneseVariant = 0;
+    int chineseResult = 0;
+    std::int32_t chineseVariant = 0;
+    int calls = 0;
+};
+
+int Resolve(const FakeUser& user, std::uint32_t* type, std::uint32_t sdkVersion = 0xFFFFFFFFu, bool ps4Client = false) {
+    return ImeKeyboardType::Resolve(
+        7, type, sdkVersion, ps4Client,
+        [&](std::int32_t id, std::int32_t* value) { Require(id == 7); *value = user.keyboardType; return user.keyboardResult; },
+        [&](std::int32_t id, std::int32_t* value) { Require(id == 7); *value = user.japaneseVariant; return user.japaneseResult; },
+        [&](std::int32_t id, std::int32_t* value) { Require(id == 7); *value = user.chineseVariant; return user.chineseResult; });
+}
+
+std::uint32_t Map(std::int32_t keyboardType, std::int32_t japanese = 0, std::int32_t chinese = 0, std::uint32_t sdkVersion = 0xFFFFFFFFu, bool ps4Client = false) {
+    FakeUser user;
+    user.keyboardType = keyboardType;
+    user.japaneseVariant = japanese;
+    user.chineseVariant = chinese;
+    std::uint32_t type = 0xFFFFFFFFu;
+    Require(Resolve(user, &type, sdkVersion, ps4Client) == 0);
+    return type;
+}
+
+void RequireImeKeyboardTypeMapping() {
+    // The owner's table: UserService keyboard type -> IME keyboard type.
+    constexpr std::pair<int, int> table[] = {
+        {16, 1}, {17, 2}, {18, 3}, {19, 5}, {20, 4}, {21, 6}, {22, 7}, {23, 8}, {24, 10}, {25, 11}, {26, 9}, {27, 12},
+        {28, 13}, {29, 14}, {30, 15}, {31, 16}, {32, 17}, {33, 18}, {34, 19}, {35, 20}, {36, 21}, {38, 24}, {40, 25},
+        {41, 30}, {42, 31}, {43, 33}, {44, 32}, {45, 34}, {46, 35}, {47, 36}, {48, 37}, {49, 38}};
+    for (const auto& [keyboard, ime] : table) {
+        // 49 -> 38 is compatibility-sensitive; the table row is checked on a new SDK, the rule separately below.
+        Require(Map(keyboard) == static_cast<std::uint32_t>(ime));
+    }
+    // Unmatched keyboard types succeed with IME type 0 (including 0, the gaps, and out-of-range values).
+    for (int keyboard : {-1, 0, 1, 15, 50, 51, 1000, 0x7FFFFFFF, static_cast<int>(0x80000000u)}) Require(Map(keyboard) == 0);
+
+    // Type 37: Japanese input variant; anything else is unmatched.
+    Require(Map(37, 0) == 22 && Map(37, 1) == 23);
+    Require(Map(37, 2) == 0 && Map(37, -1) == 0);
+    Require(Map(37, 0, 4) == 22);  // the Traditional Chinese variant is ignored for 37
+    // Type 39: Traditional Chinese input variant.
+    Require(Map(39, 0, 0) == 26 && Map(39, 0, 1) == 27 && Map(39, 0, 2) == 28 && Map(39, 0, 3) == 29 && Map(39, 0, 4) == 39);
+    Require(Map(39, 0, 5) == 0 && Map(39, 0, -1) == 0);
+    Require(Map(39, 1, 0) == 26);  // the Japanese variant is ignored for 39
+
+    // Variant query failure falls back to variant 0 and still succeeds; other types never query the variants.
+    FakeUser user;
+    std::uint32_t type = 0xFFFFFFFFu;
+    user.keyboardType = 37; user.japaneseResult = static_cast<int>(0x80960001u); user.japaneseVariant = 1;
+    Require(Resolve(user, &type) == 0 && type == 22);
+    user = {};
+    type = 0xFFFFFFFFu;
+    user.keyboardType = 39; user.chineseResult = static_cast<int>(0x80960001u); user.chineseVariant = 4;
+    Require(Resolve(user, &type) == 0 && type == 26);
+    user = {};
+    type = 0xFFFFFFFFu;
+    user.keyboardType = 20; user.japaneseResult = 1; user.chineseResult = 1;
+    Require(Resolve(user, &type) == 0 && type == 4);
+
+    // SDK compatibility, applied after the lookup. IME 38 (from 49): PS5 SDK < 0x06000000, PS4 SDK < 0x10000000 -> 4.
+    Require(Map(49, 0, 0, 0x05FFFFFFu, false) == 4);
+    Require(Map(49, 0, 0, 0x06000000u, false) == 38);
+    Require(Map(49, 0, 0, 0x0FFFFFFFu, true) == 4);
+    Require(Map(49, 0, 0, 0x10000000u, true) == 38);
+    // IME 39 (from 39 variant 4): PS5 SDK < 0x08000000 and every PS4 client -> 29.
+    Require(Map(39, 0, 4, 0x07FFFFFFu, false) == 29);
+    Require(Map(39, 0, 4, 0x08000000u, false) == 39);
+    Require(Map(39, 0, 4, 0xFFFFFFFFu, true) == 29);
+    // Other IME types are never rewritten.
+    Require(Map(20, 0, 0, 0, false) == 4 && Map(36, 0, 0, 0, true) == 21 && Map(39, 0, 3, 0, true) == 29);
+
+    // Errors leave the output untouched.
+    type = 0x1234u;
+    user = {};
+    Require(ImeKeyboardType::Resolve(7, nullptr, 0, false, [](std::int32_t, std::int32_t*) { Require(false); return 0; }, [](std::int32_t, std::int32_t*) { return 0; }, [](std::int32_t, std::int32_t*) { return 0; }) == static_cast<int>(0x80BC0031u));
+    user.keyboardResult = static_cast<int>(0x80960105u);
+    Require(Resolve(user, &type) == static_cast<int>(0x80BC0010u) && type == 0x1234u);
+    for (int other : {1, -1, static_cast<int>(0x80960002u), static_cast<int>(0x80960005u), static_cast<int>(0x80BC0010u)}) {
+        user.keyboardResult = other;
+        Require(Resolve(user, &type) == static_cast<int>(0x80BC00FFu) && type == 0x1234u);
+    }
+}
+
+}  // namespace
+
 int main() {
+    static std::array<std::byte, 64> process{};
+    Require(ProcessParametersFixture::Install(process.data(), process.size()));
+    constexpr std::uint32_t sdkVersion = 0x09000000u;
+    std::memcpy(process.data() + 16, &sdkVersion, sizeof(sdkVersion));
     constexpr int invalidAddress = static_cast<int>(0x80BC0031u);
     constexpr int invalidUserId = static_cast<int>(0x80BC0010u);
 
@@ -35,24 +141,40 @@ int main() {
         bool rejected = false;
         try {
             sceConvertKeycodeGetVirtualKeycode(28, layout, &virtualKey);
+
         } catch (const std::runtime_error&) {
             rejected = true;
         }
         Require(rejected && virtualKey == 0xABCD);
     }
 
+    // The exported function with the real UserService: unknown users fail, the initial user reports the US-English default (keyboard type 20 -> IME 4).
     std::uint32_t type = 0xFFFFFFFFu;
     Require(sceConvertKeycodeGetImeKeyboardType(-1, &type) == invalidUserId);
+    Require(sceConvertKeycodeGetImeKeyboardType(0, &type) == invalidUserId);
     Require(type == 0xFFFFFFFFu);
-
-    bool rejected = false;
-    try {
-        sceConvertKeycodeGetImeKeyboardType(0, &type);
-    } catch (const std::runtime_error&) {
-        rejected = true;
+    SetLanguage(nullptr);
+    Require(sceConvertKeycodeGetImeKeyboardType(0x10000000, &type) == 0 && type == 4);
+    constexpr std::uint32_t imeTypeByLanguage[] = {22, 4, 9, 6, 2, 13, 14, 18, 19, 24, 26, 25, 8, 20, 1, 15, 16, 17, 5, 21, 7, 30, 11, 32, 37, 33, 36, 31, 35, 34};
+    for (int language = 0; language < 30; ++language) {
+        SetLanguage(std::to_string(language).c_str());
+        type = 0xFFFFFFFFu;
+        Require(sceConvertKeycodeGetImeKeyboardType(0x10000000, &type) == 0 && type == imeTypeByLanguage[language]);
     }
-    Require(rejected && type == 0xFFFFFFFFu);
+    SetLanguage("30");
+    Require(sceConvertKeycodeGetImeKeyboardType(0x10000000, &type) == 0 && type == 4);
+    SetLanguage(nullptr);
 
+    Require(ImeKeyboardType::IsPs4TitleId("CUSA00000"));
+    Require(ImeKeyboardType::IsPs4TitleId("CUSA"));
+    Require(!ImeKeyboardType::IsPs4TitleId("PPSA00000"));
+    Require(!ImeKeyboardType::IsPs4TitleId(""));
+    Require(!ImeKeyboardType::IsPs4TitleId("CUS"));
+    Require(!ImeKeyboardType::IsPs4TitleId("cusa00000"));
+    Require(!ImeKeyboardType::IsPs4TitleId("XCUSA0000"));
+    Require(!ImeKeyboardType::IsPs4TitleId("HOMEBREW1"));
+
+    RequireImeKeyboardTypeMapping();
     Require(sceConvertKeycodeGetCharacter(4, 0, 0, nullptr) == invalidAddress);
     char16_t character = u'?';
     Require(sceConvertKeycodeGetCharacter(4, 0, 0, &character) == static_cast<int>(0x80BC001Du));
diff --git a/core/libs/tests/GuestConvertKeycodeTitle.cpp b/core/libs/tests/GuestConvertKeycodeTitle.cpp
new file mode 100644
index 0000000000..c398ae1ba0
--- /dev/null
+++ b/core/libs/tests/GuestConvertKeycodeTitle.cpp
@@ -0,0 +1,22 @@
+#include "prx/libSceConvertKeycode/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "ProcessParametersFixture.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+int main() {
+#ifdef _WIN32
+    if (_putenv_s("ANYPS5_LANGUAGE", "") != 0) return 2;
+#else
+    if (::unsetenv("ANYPS5_LANGUAGE") != 0) return 2;
+#endif
+    static std::array<std::byte, 64> process{};
+    constexpr std::uint32_t sdkVersion = 0x09000000u;
+    std::memcpy(process.data() + 16, &sdkVersion, sizeof(sdkVersion));
+    if (!ProcessParametersFixture::Install(process.data(), process.size())) return 2;
+    std::uint32_t type = 0xFFFFFFFFu;
+    return sceConvertKeycodeGetImeKeyboardType(0x10000000, &type) == 0 && type == 4 ? 0 : 1;
+}
diff --git a/core/libs/tests/GuestCoredumpAttach.cpp b/core/libs/tests/GuestCoredumpAttach.cpp
index 5d3b7ebb5e..e1948026e4 100644
--- a/core/libs/tests/GuestCoredumpAttach.cpp
+++ b/core/libs/tests/GuestCoredumpAttach.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,18 +9,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceCoredumpRegisterCoredumpHandler(uint64_t handler, size_t stackSize, uint64_t context);
-int APS5_VABI sceCoredumpUnregisterCoredumpHandler(void);
-int APS5_VABI sceCoredumpAttachMemoryRegion(uint32_t userValue, const void* mem, std::int32_t size);
-int APS5_VABI sceCoredumpAttachUserMemoryFile(uint32_t userValue, const void* mem, std::int32_t size);
-int APS5_VABI sceCoredumpGetStopInfoCpu(void* info, size_t size);
-int APS5_VABI sceCoredumpGetThreadContextInfo(void* threadContextInfo, size_t threadContextInfoSize);
-int APS5_VABI sceCoredumpGetStopInfoGpu_Agc(void* info, size_t size);
-int APS5_VABI sceCoredumpWriteUserString(uint32_t first, const char* text, int third);
-int APS5_VABI sceCoredumpConfigDumpMode(int mode);
-}
-
 namespace {
 alignas(16) std::array<std::byte, 0x40> process{};
 constexpr int InvalidArgument = static_cast<int>(0x81180000u);
diff --git a/core/libs/tests/GuestCoredumpUserData.cpp b/core/libs/tests/GuestCoredumpUserData.cpp
index 3b7c6c3817..694d076666 100644
--- a/core/libs/tests/GuestCoredumpUserData.cpp
+++ b/core/libs/tests/GuestCoredumpUserData.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,15 +9,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceCoredumpRegisterCoredumpHandler(uint64_t handler, size_t stackSize, uint64_t context);
-int APS5_VABI sceCoredumpUnregisterCoredumpHandler(void);
-int64_t APS5_VABI sceCoredumpWriteUserData(const void* data, size_t size);
-void APS5_VABI sceCoredumpDebugTextOut(const char* str, int len);
-int APS5_VABI sceCoredumpAttachUserFile(uint32_t userValue, const char* path);
-int APS5_VABI sceCoredumpAttachMemoryRegionAsUserFile(uint32_t userValue, const void* mem, std::int32_t size, const char* name);
-}
-
 namespace {
 alignas(16) std::array<std::byte, 0x40> process{};
 constexpr int64_t InvalidArgument = static_cast<int32_t>(0x81180000u);
@@ -77,6 +69,7 @@ int main() {
     Require(sceCoredumpAttachUserFile(0x40000000u, "") == NotInCoredumpHandler);
 
     Require(NotInCoredumpHandler < 0);
+    Require(sceCoredumpSetUserDataType(0) == 0);
     RequireWritesRefused(region);
     RequireAttachesRefused(region);
     sceCoredumpDebugTextOut(text, static_cast<int>(sizeof(text) - 1));
@@ -91,6 +84,7 @@ int main() {
     RequireWritesRefused(region);
     RequireAttachesRefused(region);
     sceCoredumpDebugTextOut(text, static_cast<int>(sizeof(text) - 1));
+
     Require(!handlerRan);
 
     Require(sceCoredumpWriteUserData(nullptr, region.size()) == InvalidArgument);
diff --git a/core/libs/tests/GuestCpuTimeClocks.cpp b/core/libs/tests/GuestCpuTimeClocks.cpp
index cb7405736e..18ae60bb87 100644
--- a/core/libs/tests/GuestCpuTimeClocks.cpp
+++ b/core/libs/tests/GuestCpuTimeClocks.cpp
@@ -1,19 +1,17 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdlib>
 
 extern "C" {
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI clock_getres_nid_postfix(int clockId, KernelTimespec* res);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int APS5_VABI sceKernelClockGetres(KernelClockid clockId, KernelTimespec* tp);
+
 #ifdef _WIN32
 int APS5_VABI ClockTimeWin32ErrorToGuestErrno_nid_no_patch(std::uint32_t error);
 #endif
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
+
 }
 
 #ifdef _WIN32
@@ -23,7 +21,6 @@ static constexpr std::uint32_t WINDOWS_ERROR_INVALID_HANDLE = 6;
 #endif
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
 
 static constexpr int GUEST_CLOCK_MONOTONIC = 4;
 static constexpr int GUEST_CLOCK_THREAD_CPUTIME_ID = 14;
diff --git a/core/libs/tests/GuestCredentials.cpp b/core/libs/tests/GuestCredentials.cpp
index 887f69c727..c2bc00310d 100644
--- a/core/libs/tests/GuestCredentials.cpp
+++ b/core/libs/tests/GuestCredentials.cpp
@@ -1,26 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI seteuid_nid_postfix(std::uint32_t);
-int APS5_VABI setegid_nid_postfix(std::uint32_t);
-int APS5_VABI setuid_nid_postfix(std::uint32_t);
-int APS5_VABI setgid_nid_postfix(std::uint32_t);
-int APS5_VABI setreuid_nid_postfix(std::uint32_t, std::uint32_t);
-int APS5_VABI setregid_nid_postfix(std::uint32_t, std::uint32_t);
-int APS5_VABI setgroups_nid_postfix(int, const std::uint32_t*);
-int APS5_VABI getgroups_nid_postfix(int, std::uint32_t*);
-int APS5_VABI getuid_nid_postfix(void);
-int APS5_VABI geteuid_nid_postfix(void);
-int APS5_VABI getgid_nid_postfix(void);
-int APS5_VABI getegid_nid_postfix(void);
-int APS5_VABI issetugid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 using SetId = int (APS5_VABI *)(std::uint32_t);
 using SetReId = int (APS5_VABI *)(std::uint32_t, std::uint32_t);
@@ -43,6 +28,17 @@ static bool ThrowsRe(SetReId function, std::uint32_t r, std::uint32_t e) {
     return false;
 }
 
+using SetResId = int (APS5_VABI *)(std::uint32_t, std::uint32_t, std::uint32_t);
+
+static bool ThrowsRes(SetResId function, std::uint32_t r, std::uint32_t e, std::uint32_t s) {
+    try {
+        function(r, e, s);
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
 constexpr int GuestEfault = 14;
 constexpr int GuestEinval = 22;
 constexpr std::uint32_t Unchanged = 0xffffffffu;
@@ -68,6 +64,32 @@ int main() {
     Require(Throws(setgid_nid_postfix, Unchanged));
     Require(getuid_nid_postfix() == 0 && geteuid_nid_postfix() == 0);
     Require(getgid_nid_postfix() == 0 && getegid_nid_postfix() == 0 && issetugid_nid_postfix() == 0);
+
+    std::uint32_t ruid = 99, euid = 99, suid = 99;
+    *__error_nid_postfix() = 13;
+    Require(getresuid_nid_postfix(&ruid, &euid, &suid) == 0);
+    Require(ruid == 0 && euid == 0 && suid == 0);
+    Require(*__error_nid_postfix() == 13);
+    ruid = 99;
+    euid = 99;
+    suid = 99;
+    Require(getresuid_nid_postfix(&ruid, nullptr, nullptr) == 0 && ruid == 0);
+    Require(getresuid_nid_postfix(nullptr, &euid, nullptr) == 0 && euid == 0);
+    Require(getresuid_nid_postfix(nullptr, nullptr, &suid) == 0 && suid == 0);
+    Require(getresuid_nid_postfix(nullptr, nullptr, nullptr) == 0);
+
+    std::uint32_t rgid = 99, egid = 99, sgid = 99;
+    *__error_nid_postfix() = 13;
+    Require(getresgid_nid_postfix(&rgid, &egid, &sgid) == 0);
+    Require(rgid == 0 && egid == 0 && sgid == 0);
+    Require(*__error_nid_postfix() == 13);
+    rgid = 99;
+    egid = 99;
+    sgid = 99;
+    Require(getresgid_nid_postfix(&rgid, nullptr, nullptr) == 0 && rgid == 0);
+    Require(getresgid_nid_postfix(nullptr, &egid, nullptr) == 0 && egid == 0);
+    Require(getresgid_nid_postfix(nullptr, nullptr, &sgid) == 0 && sgid == 0);
+    Require(getresgid_nid_postfix(nullptr, nullptr, nullptr) == 0);
     Require(setreuid_nid_postfix(Unchanged, Unchanged) == 0);
     Require(setreuid_nid_postfix(0, Unchanged) == 0);
     Require(setreuid_nid_postfix(Unchanged, 0) == 0);
@@ -82,10 +104,44 @@ int main() {
     Require(ThrowsRe(setregid_nid_postfix, 1000, 0));
     Require(ThrowsRe(setregid_nid_postfix, 0, 1000));
 
+    Require(setresuid_nid_postfix(Unchanged, Unchanged, Unchanged) == 0);
+    Require(setresuid_nid_postfix(0, Unchanged, Unchanged) == 0);
+    Require(setresuid_nid_postfix(Unchanged, 0, Unchanged) == 0);
+    Require(setresuid_nid_postfix(Unchanged, Unchanged, 0) == 0);
+    Require(setresuid_nid_postfix(0, 0, 0) == 0);
+    Require(ThrowsRes(setresuid_nid_postfix, 1000, 0, 0));
+    Require(ThrowsRes(setresuid_nid_postfix, 0, 1000, 0));
+    Require(ThrowsRes(setresuid_nid_postfix, 0, 0, 1000));
+    Require(ThrowsRes(setresuid_nid_postfix, 1000, Unchanged, Unchanged));
+    Require(ThrowsRes(setresuid_nid_postfix, Unchanged, 1000, Unchanged));
+    Require(ThrowsRes(setresuid_nid_postfix, Unchanged, Unchanged, 1000));
+
+    Require(setresgid_nid_postfix(Unchanged, Unchanged, Unchanged) == 0);
+    Require(setresgid_nid_postfix(0, Unchanged, Unchanged) == 0);
+    Require(setresgid_nid_postfix(Unchanged, 0, Unchanged) == 0);
+    Require(setresgid_nid_postfix(Unchanged, Unchanged, 0) == 0);
+    Require(setresgid_nid_postfix(0, 0, 0) == 0);
+    Require(ThrowsRes(setresgid_nid_postfix, 1000, 0, 0));
+    Require(ThrowsRes(setresgid_nid_postfix, 0, 1000, 0));
+    Require(ThrowsRes(setresgid_nid_postfix, 0, 0, 1000));
+    Require(ThrowsRes(setresgid_nid_postfix, 1000, Unchanged, Unchanged));
+    Require(ThrowsRes(setresgid_nid_postfix, Unchanged, 1000, Unchanged));
+    Require(ThrowsRes(setresgid_nid_postfix, Unchanged, Unchanged, 1000));
+
     std::array<std::uint32_t, 4> groups{};
     Require(getgroups_nid_postfix(0, nullptr) == 1);
     Require(getgroups_nid_postfix(static_cast<int>(groups.size()), groups.data()) == 1 && groups[0] == 0);
     Require(groups[0] == static_cast<std::uint32_t>(getegid_nid_postfix()));
+    *__error_nid_postfix() = 13;
+    RequireFailure(setgroups_nid_postfix(1, reinterpret_cast<const std::uint32_t*>(1)), GuestEfault);
+    *__error_nid_postfix() = 13;
+    RequireFailure(getgroups_nid_postfix(1, reinterpret_cast<std::uint32_t*>(1)), GuestEfault);
+    Require(getgroups_nid_postfix(0, nullptr) == 1);
+
+    *__error_nid_postfix() = 13;
+    RequireFailure(getresuid_nid_postfix(reinterpret_cast<std::uint32_t*>(1), nullptr, nullptr), GuestEfault);
+    *__error_nid_postfix() = 13;
+    RequireFailure(getresgid_nid_postfix(nullptr, reinterpret_cast<std::uint32_t*>(1), nullptr), GuestEfault);
 
     const std::array<std::uint32_t, 3> wanted{0, 5, 7};
     Require(setgroups_nid_postfix(static_cast<int>(wanted.size()), wanted.data()) == 0);
diff --git a/core/libs/tests/GuestCrt.cpp b/core/libs/tests/GuestCrt.cpp
index d2fe45d744..fc18d84627 100644
--- a/core/libs/tests/GuestCrt.cpp
+++ b/core/libs/tests/GuestCrt.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceAmpr/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/SonyCrt.hpp"
@@ -14,31 +16,6 @@
 #include <exception>
 #include <limits>
 
-extern "C" {
-SonyLconv* APS5_VABI sceAmprLocaleconv(void);
-double APS5_VABI sceAmprSinh(double x, double y);
-char* APS5_VABI sceAmprStrtokS(char* str, const char* delim, char** context);
-int APS5_VABI sceAmprCtimeS(char* buffer, std::size_t size, const std::int64_t* time);
-int APS5_VABI sceAmprWcscpyS(std::uint16_t* dest, std::size_t size, const std::uint16_t* src);
-void* APS5_VABI sceAmprSetConstraintHandlerS(void* handler);
-int APS5_VABI sceAmprFltrounds(void);
-void APS5_VABI sceAmprIgnoreHandlerS(const char* message, void* pointer, int error);
-std::size_t APS5_VABI sceAmprMbstowcs(std::uint16_t* dest, const char* src, std::size_t size);
-int APS5_VABI sceAmprAsctimeS(char* buffer, std::size_t size, const GuestTm* time);
-int APS5_VABI ctime_s_nid_postfix(char* buffer, std::size_t size, const std::int64_t* time);
-int APS5_VABI asctime_s_nid_postfix(char* buffer, std::size_t size, const GuestTm* time);
-std::size_t APS5_VABI mbstowcs_nid_postfix(std::uint16_t* dest, const char* src, std::size_t size);
-char* APS5_VABI strtok_s_nid_postfix(char* str, const char* delim, char** context);
-int APS5_VABI __fpclassifyd_nid_postfix(double value);
-unsigned __int128 APS5_VABI __udivti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
-__int128 APS5_VABI __divti3_nid_postfix(__int128 dividend, __int128 divisor);
-unsigned __int128 APS5_VABI __umodti3_nid_postfix(unsigned __int128 dividend, unsigned __int128 divisor);
-__int128 APS5_VABI __modti3_nid_postfix(__int128 dividend, __int128 divisor);
-SonyLconv* APS5_VABI localeconv_nid_postfix(void);
-int APS5_VABI sceAmprFpclassifyd(double value);
-unsigned int APS5_VABI _ZSt14_Random_devicev_nid_postfix();
-}
-
 #define Require(condition) do { if (!(condition)) { std::fprintf(stderr, "guest_crt: line %d: %s\n", __LINE__, #condition); std::abort(); } } while (0)
 
 static int g_handlerCalls = 0;
@@ -154,6 +131,7 @@ int main() {
     trapped = false;
     try {
         __umodti3_nid_postfix(((unsigned __int128)0x1234 << 64) | 0x5678, 0);
+
     } catch (const std::runtime_error& error) {
         trapped = std::strcmp(error.what(), "__umodti3: integer divide by zero (0x00000000000012340000000000005678 % 0)") == 0;
     }
diff --git a/core/libs/tests/GuestCryptoMemcmp.cpp b/core/libs/tests/GuestCryptoMemcmp.cpp
new file mode 100644
index 0000000000..e23991ed1f
--- /dev/null
+++ b/core/libs/tests/GuestCryptoMemcmp.cpp
@@ -0,0 +1,124 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#else
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+namespace {
+
+void Require(bool value) {
+    if (!value) {
+        std::fprintf(stderr, "CRYPTO_memcmp check failed\n");
+        std::abort();
+    }
+}
+
+class GuardedPage {
+public:
+    explicit GuardedPage(bool different) {
+#ifdef _WIN32
+        SYSTEM_INFO info{};
+        GetSystemInfo(&info);
+        pageSize = info.dwPageSize;
+        memory = static_cast<unsigned char*>(VirtualAlloc(nullptr, pageSize * 2, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+        Require(memory != nullptr);
+        DWORD previous;
+        Require(VirtualProtect(memory + pageSize, pageSize, PAGE_NOACCESS, &previous) != 0);
+#else
+        const long nativePageSize = sysconf(_SC_PAGESIZE);
+        Require(nativePageSize > 0);
+        pageSize = static_cast<std::size_t>(nativePageSize);
+        void* allocation = mmap(nullptr, pageSize * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(allocation != MAP_FAILED);
+        memory = static_cast<unsigned char*>(allocation);
+        Require(mprotect(memory + pageSize, pageSize, PROT_NONE) == 0);
+#endif
+        std::memset(memory, 0xA5, pageSize);
+        if (different) memory[pageSize - 1] ^= 0xFF;
+#ifdef _WIN32
+        Require(VirtualProtect(memory, pageSize, PAGE_READONLY, &previous) != 0);
+#else
+        Require(mprotect(memory, pageSize, PROT_READ) == 0);
+#endif
+    }
+
+    GuardedPage(const GuardedPage&) = delete;
+    GuardedPage& operator=(const GuardedPage&) = delete;
+
+    ~GuardedPage() {
+#ifdef _WIN32
+        VirtualFree(memory, 0, MEM_RELEASE);
+#else
+        munmap(memory, pageSize * 2);
+#endif
+    }
+
+    const unsigned char* Tail(std::size_t length) const {
+        Require(length <= pageSize);
+        return memory + pageSize - length;
+    }
+
+private:
+    unsigned char* memory = nullptr;
+    std::size_t pageSize = 0;
+};
+
+}
+
+int main() {
+    Require(CRYPTO_memcmp_nid_postfix(nullptr, nullptr, 0) == 0);
+    unsigned char byte = 0xA5;
+    Require(CRYPTO_memcmp_nid_postfix(nullptr, &byte, 0) == 0);
+    Require(CRYPTO_memcmp_nid_postfix(&byte, nullptr, 0) == 0);
+    for (unsigned int left = 0; left < 256; ++left) {
+        for (unsigned int right = 0; right < 256; ++right) {
+            const unsigned char a = static_cast<unsigned char>(left);
+            const unsigned char b = static_cast<unsigned char>(right);
+            Require((CRYPTO_memcmp_nid_postfix(&a, &b, 1) == 0) == (left == right));
+        }
+    }
+    std::array<unsigned char, 67> first;
+    for (std::size_t index = 0; index < first.size(); ++index) first[index] = static_cast<unsigned char>(index * 37);
+    auto second = first;
+    const auto original = first;
+    Require(CRYPTO_memcmp_nid_postfix(first.data(), first.data(), first.size()) == 0);
+    Require(CRYPTO_memcmp_nid_postfix(first.data() + 1, second.data() + 1, 65) == 0);
+    for (std::size_t index = 1; index <= 65; ++index) {
+        second[index] ^= 0x80;
+        const auto changed = second;
+        Require(CRYPTO_memcmp_nid_postfix(first.data() + 1, second.data() + 1, 65) != 0);
+        Require(CRYPTO_memcmp_nid_postfix(second.data() + 1, first.data() + 1, 65) != 0);
+        Require(first == original && second == changed);
+        second[index] ^= 0x80;
+    }
+    second[32] ^= 0x80;
+    Require(CRYPTO_memcmp_nid_postfix(first.data(), second.data(), 32) == 0);
+    Require(CRYPTO_memcmp_nid_postfix(first.data(), second.data(), 33) != 0);
+    second = first;
+    second[1] ^= 0x80;
+    second[65] ^= 0x80;
+    Require(CRYPTO_memcmp_nid_postfix(first.data(), second.data(), first.size()) != 0);
+    first.fill(0xCC);
+    Require(CRYPTO_memcmp_nid_postfix(first.data(), first.data() + 1, first.size() - 1) == 0);
+    first[32] = 0xCD;
+    const auto overlap = first;
+    Require(CRYPTO_memcmp_nid_postfix(first.data(), first.data() + 1, first.size() - 1) != 0);
+    Require(first == overlap);
+    const GuardedPage equal(false);
+    const GuardedPage other(false);
+    const GuardedPage different(true);
+    for (const std::size_t length : {0, 1, 2, 7, 15, 16, 17, 31, 32, 33, 63, 64, 65, 127, 128, 129}) {
+        Require(CRYPTO_memcmp_nid_postfix(equal.Tail(length), other.Tail(length), length) == 0);
+        Require((CRYPTO_memcmp_nid_postfix(equal.Tail(length), different.Tail(length), length) == 0) == (length == 0));
+    }
+}
diff --git a/core/libs/tests/GuestCurrentCpu.cpp b/core/libs/tests/GuestCurrentCpu.cpp
index 389ad302ff..17cda444cb 100644
--- a/core/libs/tests/GuestCurrentCpu.cpp
+++ b/core/libs/tests/GuestCurrentCpu.cpp
@@ -1,22 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <array>
 #include <bit>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceKernelGetCurrentCpu(void);
-int APS5_VABI sceKernelGetMainSocId(void);
-int APS5_VABI sceKernelGetCpumode(void);
-std::int64_t APS5_VABI sceKernelGetCpuFrequency(void);
-std::uint64_t APS5_VABI sceKernelGetTscFrequency(void);
-KernelCpumask APS5_VABI sceKernelGetAvailableCpumask(void);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr unsigned MAX_HOST_CPUS = 256;
 static constexpr int CALLS_PER_THREAD = 64;
diff --git a/core/libs/tests/GuestDaemon.cpp b/core/libs/tests/GuestDaemon.cpp
index 0e87384eb6..bec3a6613a 100644
--- a/core/libs/tests/GuestDaemon.cpp
+++ b/core/libs/tests/GuestDaemon.cpp
@@ -1,12 +1,14 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
-extern "C" int APS5_VABI daemon_nid_postfix(int, int);
+
 static void Require(bool value) { if (!value) std::abort(); }
 static bool ReportsNotImplemented(int noChdir, int noClose) {
     try {
         daemon_nid_postfix(noChdir, noClose);
+
     } catch (const std::runtime_error& error) {
         return std::string(error.what()) == "daemon: forking into the background not implemented";
     }
diff --git a/core/libs/tests/GuestDatagramReceive.cpp b/core/libs/tests/GuestDatagramReceive.cpp
index 2c7bc9e0c5..d11fe04de6 100644
--- a/core/libs/tests/GuestDatagramReceive.cpp
+++ b/core/libs/tests/GuestDatagramReceive.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -8,30 +11,6 @@
 #include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-int APS5_VABI sceNetSocketClose(int);
-int* APS5_VABI sceNetErrnoLoc();
-}
-
 static void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "%s\n", message);
@@ -56,6 +35,7 @@ static void Check(bool net, bool from, int family) {
     const auto bind = [&](int descriptor) {
         return net ? sceNetBind_nid_postfix(descriptor, destination.data(), addressSize) :
             bind_nid_postfix(descriptor, destination.data(), addressSize);
+
     };
     const int bound = bind(receiver);
     if (bound < 0 && family == 28 && *error == 49) {
@@ -80,6 +60,7 @@ static void Check(bool net, bool from, int family) {
             sceNetRecv(receiver, buffer, length, flags);
         return from ? recvfrom_nid_postfix(receiver, buffer, length, flags, address, addressLength) :
             recv_nid_postfix(receiver, buffer, length, flags);
+
     };
     const auto send = [&](const char* data, std::size_t length) {
         Require((net ? sceNetSendto(sender, data, length, 0, destination.data(), addressSize) :
@@ -140,6 +121,21 @@ static void Check(bool net, bool from, int family) {
         std::this_thread::sleep_for(std::chrono::milliseconds(1));
     } while (std::chrono::steady_clock::now() < deadline);
     Require(result == 0 && byte == '!', "empty datagram");
+    if (!net) {
+        send("hello", 5);
+        const auto ready = std::chrono::steady_clock::now() + std::chrono::seconds(1);
+        do {
+            result = receive(&byte, 1, 2, nullptr, nullptr);
+            if (result >= 0 || *error != 35) break;
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        } while (std::chrono::steady_clock::now() < ready);
+        Require(result == 1, "wait for the datagram");
+        Require(receive(&byte, 0, 2, nullptr, nullptr) == 0 && receive(&byte, 1, 2, nullptr, nullptr) == 1, "a zero-length peek keeps the datagram");
+        Require(receive(&byte, 0, 0, nullptr, nullptr) == 0, "a zero-length receive returns 0");
+        Require(receive(&byte, 1, 0, nullptr, nullptr) < 0 && *error == 35, "a zero-length receive discards the datagram");
+        Require(fcntl_nid_postfix(receiver, 4, 2) == 0, "make receiver blocking");
+        Require(receive(&byte, 0, 0, nullptr, nullptr) == 0, "a zero-length receive on an empty queue returns 0 without waiting");
+    }
     Require(closeSocket(receiver) == 0, "close receiver");
     Require(closeSocket(sender) == 0, "close sender");
 }
diff --git a/core/libs/tests/GuestDeferredModule.cpp b/core/libs/tests/GuestDeferredModule.cpp
index 719a68829f..f9e3089049 100644
--- a/core/libs/tests/GuestDeferredModule.cpp
+++ b/core/libs/tests/GuestDeferredModule.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #define WIN32_LEAN_AND_MEAN
 #include "GuestDeferredModule.hpp"
 #include <chrono>
@@ -6,15 +7,6 @@
 #include <filesystem>
 #include <future>
 
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-char* APS5_VABI dlerror_nid_postfix();
-int APS5_VABI sceKernelLoadStartModule(const char*, std::size_t, const void*, unsigned, const void*, int*);
-int APS5_VABI sceKernelStopUnloadModule(int, std::size_t, const void*, unsigned, const void*, int*);
-}
-
 static void Require(bool value, const char* what) {
     if (!value) {
         std::fprintf(stderr, "%s\n", what);
diff --git a/core/libs/tests/GuestDemangle.cpp b/core/libs/tests/GuestDemangle.cpp
index ea2f1100cf..b3bc34a66d 100644
--- a/core/libs/tests/GuestDemangle.cpp
+++ b/core/libs/tests/GuestDemangle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -9,12 +10,6 @@
 #include <new>
 #include <stdexcept>
 
-extern "C" {
-char* APS5_VABI __cxa_demangle_nid_postfix(const char*, char*, std::size_t*, int*);
-void* APS5_VABI malloc_nid_postfix(std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-}
-
 namespace {
 
 constexpr char MangledName[] = "_ZN3foo3barEi";
@@ -159,12 +154,13 @@ void RegisterAllocator() {
 void ReleaseIfReturned(void* result, void* original = nullptr) {
     ForgetIfMoved(original, result);
     free_nid_postfix(result != nullptr ? result : original);
+
 }
 
 void TestNullOutputBuffer() {
     std::size_t length = 0;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status));
     Check(result != nullptr, "null output buffer did not demangle");
     Check(status == 0, "null output buffer returned the wrong status");
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "null output buffer returned the wrong string");
@@ -174,7 +170,7 @@ void TestNullOutputBuffer() {
 }
 
 void TestOptionalStatus() {
-    char* result = __cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr));
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "optional status output failed");
     Check(result != nullptr && Owns(result), "optional status output was not guest-owned");
     ReleaseIfReturned(result);
@@ -185,7 +181,7 @@ void TestLargeBufferReuse() {
     const std::size_t originalLength = 128;
     std::size_t length = originalLength;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, &status));
     Check(result == buffer, "sufficient guest buffer was not reused");
     Check(status == 0, "sufficient guest buffer returned the wrong status");
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "sufficient guest buffer returned the wrong string");
@@ -198,7 +194,7 @@ void TestSmallBufferGrowth() {
     std::size_t length = 1;
     const std::size_t reallocationsBefore = reallocationCalls;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, &status));
     Check(result != nullptr, "too-small guest buffer did not grow");
     Check(status == 0, "grown guest buffer returned the wrong status");
     Check(result != nullptr && std::strcmp(result, DemangledName) == 0, "grown guest buffer returned the wrong string");
@@ -210,18 +206,19 @@ void TestSmallBufferGrowth() {
 
 void TestInvalidInputs() {
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix("not_a_mangled_name", nullptr, nullptr, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix("not_a_mangled_name", nullptr, nullptr, &status));
     Check(result == nullptr && status == -2, "invalid mangled name did not return status -2");
     status = 99;
-    result = __cxa_demangle_nid_postfix(nullptr, nullptr, nullptr, &status);
+    result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(nullptr, nullptr, nullptr, &status));
     Check(result == nullptr && status == -3, "null mangled name did not return status -3");
 
     auto* buffer = static_cast<char*>(malloc_nid_postfix(32));
     std::memcpy(buffer, "unchanged", sizeof("unchanged"));
-    result = __cxa_demangle_nid_postfix(MangledName, buffer, nullptr, &status);
+    result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), nullptr, &status));
     Check(result == nullptr && status == -3, "missing length for a supplied buffer did not return status -3");
     Check(std::strcmp(buffer, "unchanged") == 0, "invalid supplied-buffer arguments modified the buffer");
     free_nid_postfix(buffer);
+
 }
 
 void TestAllocationFailure() {
@@ -229,7 +226,7 @@ void TestAllocationFailure() {
     failNextAllocation = true;
     std::size_t length = 0;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, &length, &status));
     Check(result == nullptr, "guest allocation failure returned a buffer");
     Check(status == -1, "guest allocation failure did not return status -1");
     Check(allocationFailures == failuresBefore + 1, "demangler bypassed failed guest allocation");
@@ -243,7 +240,7 @@ void TestReallocationFailure() {
     const std::size_t failuresBefore = reallocationFailures;
     failNextReallocation = true;
     int status = 99;
-    char* result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, &status);
+    char* result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, &status));
     Check(result == nullptr, "guest reallocation failure returned a buffer");
     Check(status == -1, "guest reallocation failure did not return status -1");
     Check(reallocationFailures == failuresBefore + 1, "demangler bypassed failed guest reallocation");
@@ -257,7 +254,7 @@ void TestAllocatorDiagnostics() {
     bool allocationDiagnostic = false;
     char* result = nullptr;
     try {
-        result = __cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr);
+        result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, nullptr, nullptr, nullptr));
     } catch (const std::runtime_error& error) {
         allocationDiagnostic = std::strcmp(error.what(), "guest allocator callback failure") == 0;
     }
@@ -271,7 +268,7 @@ void TestAllocatorDiagnostics() {
     bool reallocationDiagnostic = false;
     result = nullptr;
     try {
-        result = __cxa_demangle_nid_postfix(MangledName, buffer, &length, nullptr);
+        result = reinterpret_cast<char*>(__cxa_demangle_nid_postfix(MangledName, static_cast<char*>(buffer), &length, nullptr));
     } catch (const std::runtime_error& error) {
         reallocationDiagnostic = std::strcmp(error.what(), "guest reallocator callback failure") == 0;
     }
diff --git a/core/libs/tests/GuestDinkumwareAtomics.cpp b/core/libs/tests/GuestDinkumwareAtomics.cpp
index 8e45d76902..47765a29c8 100644
--- a/core/libs/tests/GuestDinkumwareAtomics.cpp
+++ b/core/libs/tests/GuestDinkumwareAtomics.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,32 +6,6 @@
 #include <cstring>
 #include <thread>
 
-extern "C" {
-void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
-void APS5_VABI _Atomic_store_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-std::uint16_t APS5_VABI _Atomic_load_2_nid_postfix(volatile std::uint16_t*, int);
-std::uint64_t APS5_VABI _Atomic_load_8_nid_postfix(volatile std::uint64_t*, int);
-std::uint32_t APS5_VABI _Atomic_exchange_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
-std::uint64_t APS5_VABI _Atomic_exchange_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-int APS5_VABI _Atomic_compare_exchange_strong_2_nid_postfix(volatile std::uint16_t*, std::uint16_t*, std::uint16_t, int, int);
-int APS5_VABI _Atomic_compare_exchange_weak_8_nid_postfix(volatile std::uint64_t*, std::uint64_t*, std::uint64_t, int, int);
-std::uint8_t APS5_VABI _Atomic_fetch_add_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
-std::uint64_t APS5_VABI _Atomic_fetch_add_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-std::uint16_t APS5_VABI _Atomic_fetch_sub_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
-std::uint32_t APS5_VABI _Atomic_fetch_and_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
-std::uint8_t APS5_VABI _Atomic_fetch_or_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
-std::uint64_t APS5_VABI _Atomic_fetch_xor_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
-int APS5_VABI _Atomic_is_lock_free_4_nid_postfix();
-int APS5_VABI _Atomic_flag_test_and_set_nid_postfix(volatile unsigned char*, int);
-void APS5_VABI _Atomic_flag_clear_nid_postfix(volatile unsigned char*, int);
-void APS5_VABI _Atomic_thread_fence_nid_postfix(int);
-void APS5_VABI _Atomic_signal_fence_nid_postfix(int);
-void APS5_VABI _Atomic_copy_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, const volatile void*, int);
-void APS5_VABI _Atomic_exchange_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, volatile void*, int);
-int APS5_VABI _Atomic_compare_exchange_strong_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, void*, const void*, int, int);
-int APS5_VABI _Atomic_compare_exchange_weak_nid_postfix(volatile unsigned char*, std::size_t, volatile void*, void*, const void*, int, int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int Relaxed = 0, Acquire = 2, Release = 3, AcqRel = 4, SeqCst = 5;
@@ -38,6 +13,7 @@ constexpr int Relaxed = 0, Acquire = 2, Release = 3, AcqRel = 4, SeqCst = 5;
 static void CheckTyped() {
     std::uint8_t byte = 0;
     _Atomic_store_1_nid_postfix(&byte, 7, SeqCst);
+
     Require(byte == 7 && _Atomic_fetch_add_1_nid_postfix(&byte, 250, Relaxed) == 7 && byte == 1);
     Require(_Atomic_fetch_or_1_nid_postfix(&byte, 0x80, AcqRel) == 1 && byte == 0x81);
     std::uint16_t half = 5;
@@ -50,6 +26,7 @@ static void CheckTyped() {
     Require(_Atomic_exchange_4_nid_postfix(&word, 9, 6) == 0xf00f && word == 9);
     std::uint64_t wide = 0;
     _Atomic_store_8_nid_postfix(&wide, 0x123456789ull, Release);
+
     Require(_Atomic_load_8_nid_postfix(&wide, Acquire) == 0x123456789ull);
     Require(_Atomic_load_8_nid_postfix(&wide, Release) == 0 && _Atomic_load_8_nid_postfix(&wide, AcqRel) == 0);
     Require(_Atomic_fetch_add_8_nid_postfix(&wide, 1, SeqCst) == 0x123456789ull && wide == 0x12345678aull);
@@ -66,9 +43,11 @@ static void CheckFlagsAndFences() {
     Require(_Atomic_flag_test_and_set_nid_postfix(&flag, SeqCst) == 0 && flag == 1);
     Require(_Atomic_flag_test_and_set_nid_postfix(&flag, Relaxed) == 1);
     _Atomic_flag_clear_nid_postfix(&flag, Release);
+
     Require(flag == 0);
     _Atomic_thread_fence_nid_postfix(SeqCst);
     _Atomic_signal_fence_nid_postfix(SeqCst);
+
 }
 
 struct Wide {
@@ -79,9 +58,11 @@ static void CheckGeneric() {
     unsigned char lock = 0;
     Wide target{{1, 2, 3}}, source{{4, 5, 6}}, expected{{1, 2, 3}};
     _Atomic_copy_nid_postfix(&lock, sizeof(Wide), &target, &source, SeqCst);
+
     Require(std::memcmp(&target, &source, sizeof(Wide)) == 0 && lock == 0);
     Wide other{{7, 8, 9}};
     _Atomic_exchange_nid_postfix(&lock, sizeof(Wide), &target, &other, SeqCst);
+
     Require(target.parts[0] == 7 && other.parts[0] == 4 && lock == 0);
     const Wide desired{{10, 11, 12}};
     Require(_Atomic_compare_exchange_strong_nid_postfix(&lock, sizeof(Wide), &target, &expected, &desired, SeqCst, SeqCst) == 0);
@@ -98,6 +79,7 @@ static void CheckConcurrentGeneric() {
         for (int i = 0; i < Iterations; ++i) {
             Wide expected;
             _Atomic_copy_nid_postfix(&lock, sizeof(Wide), &expected, &counter, SeqCst);
+
             Wide next;
             do {
                 next = Wide{{expected.parts[0] + 1, expected.parts[1] + 2, expected.parts[2] + 3}};
@@ -111,8 +93,45 @@ static void CheckConcurrentGeneric() {
     Require(counter.parts[0] == 2 * Iterations && counter.parts[1] == 4 * Iterations && counter.parts[2] == 6 * Iterations);
 }
 
+static void CheckSized() {
+    std::uint8_t byte = 0xa5;
+    Require(__atomic_load_1_nid_postfix(&byte, Acquire) == 0xa5);
+    std::uint16_t half = 0;
+    __atomic_store_2_nid_postfix(&half, 0x1234, Release);
+    Require(half == 0x1234);
+    Require(__atomic_fetch_add_2_nid_postfix(&half, 0xffff, Relaxed) == 0x1234 && half == 0x1233);
+    Require(__atomic_fetch_or_2_nid_postfix(&half, 0x8000, SeqCst) == 0x1233 && half == 0x9233);
+    std::uint32_t word = 5;
+    Require(__atomic_exchange_4_nid_postfix(&word, 9, AcqRel) == 5 && word == 9);
+    Require(__atomic_fetch_sub_4_nid_postfix(&word, 10, SeqCst) == 9 && word == 0xffffffffu);
+    Require(__atomic_fetch_and_1_nid_postfix(&byte, 0x0f, SeqCst) == 0xa5 && byte == 0x05);
+    std::uint8_t expectedByte = 4;
+    Require(__atomic_compare_exchange_1_nid_postfix(&byte, &expectedByte, 7, SeqCst, Relaxed) == 0 && expectedByte == 5 && byte == 5);
+    Require(__atomic_compare_exchange_1_nid_postfix(&byte, &expectedByte, 7, SeqCst, Relaxed) == 1 && expectedByte == 5 && byte == 7);
+    std::uint64_t wide = 0;
+    __atomic_store_8_nid_postfix(&wide, 0x0123456789abcdefull, SeqCst);
+    Require(__atomic_load_8_nid_postfix(&wide, SeqCst) == 0x0123456789abcdefull);
+    Require(__atomic_fetch_xor_8_nid_postfix(&wide, 0xffffffff00000000ull, SeqCst) == 0x0123456789abcdefull && wide == 0xfedcba9889abcdefull);
+    std::uint64_t expectedWide = 0xfedcba9889abcdefull;
+    Require(__atomic_compare_exchange_8_nid_postfix(&wide, &expectedWide, 1, SeqCst, SeqCst) == 1 && wide == 1);
+    Require(__atomic_exchange_8_nid_postfix(&wide, 2, 6) == 1 && wide == 2);
+    Require(__atomic_load_8_nid_postfix(&wide, Release) == 2 && __atomic_load_8_nid_postfix(&wide, AcqRel) == 2 && __atomic_load_8_nid_postfix(&wide, -1) == 2);
+    Require(__atomic_fetch_add_8_nid_postfix(&wide, 1, 7) == 2 && wide == 3);
+
+    std::uint64_t counter = 0;
+    std::thread threads[4];
+    for (auto& thread : threads) {
+        thread = std::thread([&counter] {
+            for (int i = 0; i < 100000; ++i) __atomic_fetch_add_8_nid_postfix(&counter, 1, Relaxed);
+        });
+    }
+    for (auto& thread : threads) thread.join();
+    Require(counter == 400000);
+}
+
 int main() {
     CheckTyped();
+    CheckSized();
     CheckFlagsAndFences();
     CheckGeneric();
     CheckConcurrentGeneric();
diff --git a/core/libs/tests/GuestDinkumwareInternals.cpp b/core/libs/tests/GuestDinkumwareInternals.cpp
new file mode 100644
index 0000000000..6e1ffdf7e4
--- /dev/null
+++ b/core/libs/tests/GuestDinkumwareInternals.cpp
@@ -0,0 +1,177 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+
+namespace {
+
+constexpr int RangeError = 34;
+constexpr int InvalidArgument = 22;
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "Dinkumware internals: %s\n", message);
+        std::exit(1);
+    }
+}
+
+void CheckStod(const char* text, std::int64_t pten, double expected, long consumed, int error, const char* message) {
+    *__error_nid_postfix() = 0;
+    char* end = nullptr;
+    const double value = _Stod_nid_postfix(text, &end, pten);
+    const bool same = std::isnan(expected) ? std::isnan(value) : value == expected && std::signbit(value) == std::signbit(expected);
+    Require(same && end - text == consumed && *__error_nid_postfix() == error, message);
+}
+
+void TestStod() {
+    CheckStod("1.5", 0, 1.5, 3, 0, "unscaled decimal");
+    CheckStod("1.5", 1, 15.0, 3, 0, "decimal scaled up");
+    CheckStod("12", -2, 0.12, 2, 0, "decimal scaled down");
+    CheckStod("  -2.25e3xyz", 300, -0x1.a3f7f806a8135p+1007, 9, 0, "the scale is applied before rounding");
+    CheckStod("1e-400", 300, 1e-100, 6, 0, "an underflowing text scaled back into range");
+    CheckStod("1e-400", 0, 0.0, 6, RangeError, "an unscaled underflow");
+    CheckStod("1e300", 100, HUGE_VAL, 5, RangeError, "a scale that overflows");
+    CheckStod("1e300", 8, 1e308, 5, 0, "a scale up to the largest decades");
+    CheckStod("5e-324", -1, 0.0, 6, RangeError, "a scale that underflows to zero");
+    CheckStod("1", 2147483647, HUGE_VAL, 1, RangeError, "the largest scale");
+    CheckStod("5", std::int64_t{1} << 40, HUGE_VAL, 1, RangeError, "a scale above 32 bits");
+    CheckStod("1e400", -100, 1e300, 5, 0, "an overflowing text scaled back into range");
+    CheckStod("0.01e41", -2, 1e37, 7, 0, "a negative scale from leading fraction zeros");
+    CheckStod("1e-2147483648", -1, 0.0, 13, RangeError, "the smallest exponent and scale");
+    CheckStod("-0", 5, -0.0, 2, 0, "negative zero keeps its sign");
+    CheckStod("infinity", 3, HUGE_VAL, 8, 0, "infinity is not scaled");
+    CheckStod("nan", 3, NAN, 3, 0, "NaN is not scaled");
+    CheckStod("1e", 2, 100.0, 1, 0, "an exponent marker without digits");
+    CheckStod(".5", 2, 50.0, 2, 0, "a fraction without integer digits");
+    CheckStod("0.3", -1, 0.03, 3, 0, "0.3 scaled down rounds as 0.03");
+    CheckStod("123456789012345678901234567890", -20, 1234567890.1234567, 30, 0, "a long digit string");
+    CheckStod("abc", 4, 0.0, 0, 0, "no number");
+    CheckStod("0x1.8p0", 0, 1.5, 7, 0, "unscaled hexadecimal");
+}
+
+void TestStoll() {
+    char* end = nullptr;
+    *__error_nid_postfix() = 0;
+    Require(_Stoll_nid_postfix("-0x1F", &end, 0) == -31 && std::strcmp(end, "") == 0, "_Stoll base detection");
+    Require(_Stoll_nid_postfix("+42abc", &end, 10) == 42 && std::strcmp(end, "abc") == 0, "_Stoll stops at the first non-digit");
+    Require(_Stoll_nid_postfix("  z", &end, 36) == 35, "_Stoll base 36");
+    Require(*__error_nid_postfix() == 0, "_Stoll set errno without an overflow");
+    Require(_Stoll_nid_postfix("9223372036854775808", &end, 10) == 9223372036854775807ll && *__error_nid_postfix() == RangeError, "_Stoll saturates");
+}
+
+void TestFloatErrors() {
+    char* end = nullptr;
+    int error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("1.5", &end, 2, &error) == 150.0 && error == 0 && *__error_nid_postfix() == 0, "_Stodx in range");
+    error = 99;
+    Require(std::isinf(_Stodx_nid_postfix("1e400", &end, 0, &error)) && error == 1 && *__error_nid_postfix() == RangeError, "_Stodx overflow");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("1e-400", &end, 2, &error) == 0.0 && error == 1 && *__error_nid_postfix() == RangeError, "_Stodx underflow");
+    error = 99;
+    *__error_nid_postfix() = 7;
+    Require(_Stodx_nid_postfix("1e-400", &end, 300, &error) == 1e-100 && error == 0 && *__error_nid_postfix() == 7, "_Stodx rescued by its scale");
+    error = 99;
+    *__error_nid_postfix() = RangeError;
+    Require(_Stodx_nid_postfix("2.5", &end, 1, &error) == 25.0 && error == 0 && *__error_nid_postfix() == RangeError, "_Stodx kept a preset errno");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(std::isinf(_Stofx_nid_postfix("1e39", &end, 0, &error)) && error == 1 && *__error_nid_postfix() == RangeError, "_Stofx overflow");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("2.5e-1", &end, 3, &error) == 250.0f && error == 0 && *__error_nid_postfix() == 0, "_Stofx scaled");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1e39", &end, -1, &error) == 1e38f && error == 0 && *__error_nid_postfix() == 0, "_Stofx overflow scaled back into range");
+    error = 99;
+    Require(_Stodx_nid_postfix("1e400", &end, -100, &error) == 1e300 && error == 0 && *__error_nid_postfix() == 0, "_Stodx overflow scaled back into range");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stoldx_nid_postfix("1e400", &end, 0, &error) == 1e400L && error == 0 && *__error_nid_postfix() == 0, "_Stoldx uses the extended range");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("1e-310", &end, 0, &error) == 1e-310 && error == 0 && *__error_nid_postfix() == 0 && end[0] == '\0', "_Stodx subnormal");
+    error = 99;
+    Require(_Stodx_nid_postfix("1e-300", &end, -10, &error) == 1e-310 && error == 0 && *__error_nid_postfix() == 0, "_Stodx scaled into the subnormal range");
+    error = 99;
+    *__error_nid_postfix() = 7;
+    Require(_Stodx_nid_postfix("1e-310", &end, 0, &error) == 1e-310 && error == 0 && *__error_nid_postfix() == 7, "_Stodx subnormal kept a preset errno");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stodx_nid_postfix("2e-324", &end, 0, &error) == 0.0 && error == 1 && *__error_nid_postfix() == RangeError, "_Stodx below the smallest subnormal");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1e-45", &end, 0, &error) == 0x1p-149f && error == 0 && *__error_nid_postfix() == 0 && end[0] == '\0', "_Stofx inexact subnormal");
+    error = 99;
+    Require(_Stofx_nid_postfix("1e-35", &end, -10, &error) == 0x1p-149f && error == 0 && *__error_nid_postfix() == 0, "_Stofx scaled into the subnormal range");
+    error = 99;
+    *__error_nid_postfix() = 7;
+    const float subnormal = _Stofx_nid_postfix("1e-40", &end, 0, &error);
+    Require(subnormal > 0x1p-134f && subnormal < 0x1p-132f && error == 0 && *__error_nid_postfix() == 7, "_Stofx subnormal kept a preset errno");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1e-46", &end, 0, &error) == 0.0f && error == 1 && *__error_nid_postfix() == RangeError, "_Stofx underflow");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stofx_nid_postfix("1.17549435e-38", &end, 0, &error) == 0x1p-126f && error == 0 && *__error_nid_postfix() == 0, "_Stofx smallest normal");
+    error = 99;
+    Require(_Stoldx_nid_postfix("1e-4940", &end, 0, &error) == 1e-4940L && error == 0 && *__error_nid_postfix() == 0, "_Stoldx subnormal");
+    error = 99;
+    Require(_Stoldx_nid_postfix("1e-4930", &end, -10, &error) == 1e-4940L && error == 0 && *__error_nid_postfix() == 0, "_Stoldx scaled into the subnormal range");
+    error = 99;
+    Require(_Stoldx_nid_postfix("1e-5000", &end, 0, &error) == 0.0L && error == 1 && *__error_nid_postfix() == RangeError, "_Stoldx underflow");
+    Require(_Stof_nid_postfix("1.5", &end, 1) == 15.0f, "_Stof");
+    Require(_Stold_nid_postfix("1.5", &end, -1) == 0.15L, "_Stold");
+    error = 99;
+    Require(std::isnan(_Stodx_nid_postfix("nan", &end, 2, &error)) && error == 0 && end[0] == '\0', "_Stodx NaN");
+}
+
+void TestIntegerErrors() {
+    char* end = nullptr;
+    int error = 99;
+    *__error_nid_postfix() = 5;
+    Require(_Stollx_nid_postfix("123", &end, 0, &error) == 123 && error == 0 && *__error_nid_postfix() == 5, "_Stollx in range");
+    Require(_Stollx_nid_postfix("9223372036854775808", &end, 10, &error) == 9223372036854775807ll && error == RangeError && *__error_nid_postfix() == RangeError, "_Stollx overflow");
+    *__error_nid_postfix() = 5;
+    const char* text = " 12";
+    for (int base : {1, -1, 37}) {
+        error = 99;
+        Require(_Stollx_nid_postfix(text, &end, base, &error) == 0 && error == InvalidArgument && end == text && *__error_nid_postfix() == 5, "_Stollx invalid base");
+        error = 99;
+        Require(_Stolx_nid_postfix(text, &end, base, &error) == 0 && error == InvalidArgument && end == text && *__error_nid_postfix() == 5, "_Stolx invalid base");
+    }
+    Require(_Stoll_nid_postfix(text, &end, 1) == 0 && end == text && *__error_nid_postfix() == 5, "_Stoll invalid base");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stolx_nid_postfix("9223372036854775808", &end, 0, &error) == 9223372036854775807ll && error == RangeError && *__error_nid_postfix() == 0, "_Stolx overflow inside the unsigned range");
+    Require(_Stolx_nid_postfix("-18446744073709551615", &end, 10, &error) == (-9223372036854775807ll - 1) && error == RangeError && *__error_nid_postfix() == 0, "_Stolx negative overflow inside the unsigned range");
+    Require(_Stolx_nid_postfix("18446744073709551616", &end, 10, &error) == 9223372036854775807ll && error == RangeError && *__error_nid_postfix() == RangeError, "_Stolx overflow past the unsigned range");
+    error = 99;
+    *__error_nid_postfix() = 0;
+    Require(_Stoulx_nid_postfix("-1", &end, 0, &error) == 18446744073709551615ull && error == 0, "_Stoulx wraps a negative value");
+    Require(_Stoullx_nid_postfix("-18446744073709551615", &end, 10, &error) == 1 && error == 0 && *__error_nid_postfix() == 0, "_Stoullx wraps a negated maximum");
+    Require(_Stoullx_nid_postfix("18446744073709551616", &end, 10, &error) == 18446744073709551615ull && error == RangeError && *__error_nid_postfix() == RangeError, "_Stoullx overflow");
+}
+
+void TestDispatch() {
+    Require(_Sin_nid_postfix(0.5, 0) == std::sin(0.5) && _Sin_nid_postfix(0.5, 1) == std::cos(0.5) && _Sin_nid_postfix(0.5, 7) == std::cos(0.5), "_Sin");
+    Require(_FSin_nid_postfix(0.5f, 0) == std::sin(0.5f) && _FSin_nid_postfix(0.5f, 2) == std::cos(0.5f), "_FSin");
+    Require(_LSin_nid_postfix(0.5L, 0) == std::sin(0.5L) && _LSin_nid_postfix(0.5L, 3) == std::cos(0.5L), "_LSin");
+    Require(_Log_nid_postfix(8.0, 0) == std::log(8.0) && _Log_nid_postfix(1000.0, 1) == 3.0 && _Log_nid_postfix(1000.0, 5) == 3.0 && _Log_nid_postfix(8.0, -1) == 3.0, "_Log");
+    Require(_FLog_nid_postfix(8.0f, 0) == std::log(8.0f) && _FLog_nid_postfix(100.0f, 1) == 2.0f && _FLog_nid_postfix(8.0f, -3) == 3.0f, "_FLog");
+}
+
+}
+
+int main() {
+    TestStod();
+    TestStoll();
+    TestFloatErrors();
+    TestIntegerErrors();
+    TestDispatch();
+}
diff --git a/core/libs/tests/GuestDirectory.cpp b/core/libs/tests/GuestDirectory.cpp
index 4df4394622..f5646097dc 100644
--- a/core/libs/tests/GuestDirectory.cpp
+++ b/core/libs/tests/GuestDirectory.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
@@ -15,21 +17,12 @@
 #ifdef _WIN32
 #include <windows.h>
 #endif
-extern "C" {
-void* APS5_VABI opendir_nid_postfix(const char*);
-GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void*);
-int APS5_VABI readdir_r_nid_postfix(void*, GuestDirectoryEntry*, GuestDirectoryEntry**);
-int APS5_VABI closedir_nid_postfix(void*);
-void APS5_VABI rewinddir_nid_postfix(void*);
-std::int64_t APS5_VABI telldir_nid_postfix(void*);
-void APS5_VABI seekdir_nid_postfix(void*, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static std::map<std::string, std::uint32_t> ReadFileNumbers(void* directory) {
     std::map<std::string, std::uint32_t> numbers;
     rewinddir_nid_postfix(directory);
+
     while (auto* entry = readdir_nid_postfix(directory)) {
         Require(entry->fileNumber != 0);
         numbers[entry->name] = entry->fileNumber;
@@ -105,10 +98,12 @@ int main() {
     Require(entries.at("subdirectory") == 4);
     Require(entries.at(".") == 4 && entries.at("..") == 4);
     rewinddir_nid_postfix(directory);
+
     std::size_t count = 0;
     while (readdir_nid_postfix(directory)) ++count;
     Require(count == entries.size());
     rewinddir_nid_postfix(directory);
+
     std::map<std::string, int> copies;
     GuestDirectoryEntry buffer;
     GuestDirectoryEntry* result = nullptr;
@@ -129,6 +124,7 @@ int main() {
     result = &buffer;
     Require(readdir_r_nid_postfix(directory, &buffer, &result) == 0 && result == nullptr);
     rewinddir_nid_postfix(directory);
+
     *__error_nid_postfix() = 13;
     auto* first = readdir_nid_postfix(directory);
     Require(first != nullptr);
@@ -141,6 +137,7 @@ int main() {
     bool nullEntryThrows = false;
     try {
         readdir_r_nid_postfix(directory, nullptr, &result);
+
     } catch (const std::invalid_argument&) {
         nullEntryThrows = true;
     }
@@ -148,11 +145,13 @@ int main() {
     bool nullResultThrows = false;
     try {
         readdir_r_nid_postfix(directory, &buffer, nullptr);
+
     } catch (const std::invalid_argument&) {
         nullResultThrows = true;
     }
     Require(nullResultThrows);
     rewinddir_nid_postfix(directory);
+
     Require(readdir_nid_postfix(directory) != nullptr);
     const std::int64_t second = telldir_nid_postfix(directory);
     Require(second != -1);
@@ -161,6 +160,7 @@ int main() {
     const std::string secondName = entryAfterTell->name;
     while (readdir_nid_postfix(directory)) {}
     seekdir_nid_postfix(directory, second);
+
     auto* entryAfterSeek = readdir_nid_postfix(directory);
     Require(entryAfterSeek != nullptr && secondName == entryAfterSeek->name);
     Require(entryAfterSeek->fileNumber == fileNumbers.at(secondName));
@@ -168,6 +168,7 @@ int main() {
     Require(telldir_nid_postfix(nullptr) == -1 && *__error_nid_postfix() == 9);
     *__error_nid_postfix() = 0;
     seekdir_nid_postfix(nullptr, second);
+
     Require(*__error_nid_postfix() == 9);
     Require(closedir_nid_postfix(directory) == 0);
     Require(opendir_nid_postfix((root / "missing").string().c_str()) == nullptr);
diff --git a/core/libs/tests/GuestDirectoryBuffer.cpp b/core/libs/tests/GuestDirectoryBuffer.cpp
index e5d0c6c122..02e2ff0246 100644
--- a/core/libs/tests/GuestDirectoryBuffer.cpp
+++ b/core/libs/tests/GuestDirectoryBuffer.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -13,18 +15,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI sceKernelGetdirentries(int, char*, int, std::int64_t*);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMprotect(void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory buffer check failed at line %d\n", line);
@@ -88,6 +78,7 @@ static void CheckOversizedName() {
     bool threw = false;
     try {
         sceKernelGetdents(directory, buffer.data(), static_cast<int>(buffer.size()));
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -121,7 +112,7 @@ static void CheckReadOnlyDestination() {
         static_cast<std::int64_t*>(mapping)) == SCE_KERNEL_ERROR_EFAULT);
     Require(sceKernelMprotect(mapping, page, 3) == 0);
     Require(sceKernelGetdirentries(directory, buffer.data(), static_cast<int>(buffer.size()), &base) > 0);
-    Require(sceKernelMunmap(mapping, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), page) == 0);
     Require(sceKernelReleaseDirectMemory(physical, page) == 0);
     Require(sceKernelClose(directory) == 0);
     std::filesystem::remove_all(root);
diff --git a/core/libs/tests/GuestDirectoryClose.cpp b/core/libs/tests/GuestDirectoryClose.cpp
index 68d3d60176..5a59797a0e 100644
--- a/core/libs/tests/GuestDirectoryClose.cpp
+++ b/core/libs/tests/GuestDirectoryClose.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
@@ -10,13 +12,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI _close_nid_postfix(int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory close check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestDirectoryEntries.cpp b/core/libs/tests/GuestDirectoryEntries.cpp
index 35bf2413c9..91b41aea16 100644
--- a/core/libs/tests/GuestDirectoryEntries.cpp
+++ b/core/libs/tests/GuestDirectoryEntries.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -11,20 +14,6 @@
 #include <map>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-int APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI sceKernelGetdirentries(int, char*, int, std::int64_t*);
-int APS5_VABI getdents_nid_postfix(int, char*, int);
-int APS5_VABI getdirentries_nid_postfix(int, char*, int, std::int64_t*);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory entry check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestDirectoryLinkTypes.cpp b/core/libs/tests/GuestDirectoryLinkTypes.cpp
new file mode 100644
index 0000000000..fb9b0f0845
--- /dev/null
+++ b/core/libs/tests/GuestDirectoryLinkTypes.cpp
@@ -0,0 +1,76 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/FileFlags.hpp"
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <map>
+#include <string>
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Directory link type check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static constexpr std::uint8_t TypeDirectory = 4;
+static constexpr std::uint8_t TypeRegular = 8;
+static constexpr std::uint8_t TypeLink = 10;
+
+static std::map<std::string, std::uint8_t> Types(const char* path) {
+    const int directory = sceKernelOpen(path, SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(directory >= 0);
+    std::array<char, 4096> buffer{};
+    std::map<std::string, std::uint8_t> types;
+    for (;;) {
+        const int read = sceKernelGetdents(directory, buffer.data(), static_cast<int>(buffer.size()));
+        Require(read >= 0);
+        if (read == 0) break;
+        for (int offset = 0; offset < read;) {
+            std::uint16_t recordLength = 0;
+            std::memcpy(&recordLength, buffer.data() + offset + 4, sizeof(recordLength));
+            Require(recordLength != 0 && offset + recordLength <= read);
+            types[std::string(buffer.data() + offset + 8)] = static_cast<std::uint8_t>(buffer[offset + 6]);
+            offset += recordLength;
+        }
+    }
+    Require(sceKernelClose(directory) == 0);
+    return types;
+}
+
+int main() {
+    const auto root = std::filesystem::temp_directory_path() /
+        ("anyps5-directory-link-types-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directories(root / "app0" / "real"));
+    Require(std::filesystem::create_directories(root / "dump" / "packed"));
+    Require(std::filesystem::create_directories(root / "data"));
+    { std::ofstream stream(root / "dump" / "eboot.bin", std::ios::binary); stream << "x"; }
+    std::filesystem::create_directory_symlink(root / "dump" / "packed", root / "app0" / "packed");
+    std::filesystem::create_symlink(root / "dump" / "eboot.bin", root / "app0" / "eboot.bin");
+    std::filesystem::create_symlink(root / "dump" / "missing", root / "app0" / "dangling");
+    std::filesystem::create_directory_symlink(root / "dump" / "packed", root / "data" / "saved");
+    std::filesystem::current_path(root);
+
+    auto app0 = Types("/app0");
+    Require(app0.contains("real") && app0["real"] == TypeDirectory);
+    Require(app0.contains("packed") && app0["packed"] == TypeDirectory);
+    Require(app0.contains("eboot.bin") && app0["eboot.bin"] == TypeRegular);
+    Require(app0.contains("dangling") && app0["dangling"] == TypeLink);
+
+    auto data = Types("/data");
+    Require(data.contains("saved") && data["saved"] == TypeLink);
+
+    std::error_code error;
+    std::filesystem::current_path(std::filesystem::temp_directory_path(), error);
+    std::filesystem::remove_all(root, error);
+    std::puts("directory link type tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestDirectoryRewind.cpp b/core/libs/tests/GuestDirectoryRewind.cpp
index 00217b646e..424c5bda23 100644
--- a/core/libs/tests/GuestDirectoryRewind.cpp
+++ b/core/libs/tests/GuestDirectoryRewind.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/DirectoryDescriptor.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -14,15 +16,6 @@
 #include <set>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory rewind check failed at line %d\n", line);
@@ -31,7 +24,6 @@ static void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
-
 static std::set<std::string> ReadAll(int directory) {
     std::set<std::string> names;
     std::array<char, 4096> buffer{};
diff --git a/core/libs/tests/GuestDiscMap.cpp b/core/libs/tests/GuestDiscMap.cpp
index 498dc7c443..7c3811f9a5 100644
--- a/core/libs/tests/GuestDiscMap.cpp
+++ b/core/libs/tests/GuestDiscMap.cpp
@@ -1,14 +1,10 @@
+#include "prx/libSceDiscMap/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-std::int32_t APS5_VABI sceDiscMapIsRequestOnHDD(const char* path, std::int64_t offset, std::int64_t size, std::int32_t* result);
-std::int32_t APS5_VABI sceDiscMapUnknown_ioKMruft1ek(const char* path, std::int64_t offset, std::int64_t size, std::uint64_t* flags, std::uint64_t* out1, std::uint64_t* out2);
-}
-
 namespace {
 
 constexpr std::int32_t noBitmapInfo = static_cast<std::int32_t>(0x81100004);
diff --git a/core/libs/tests/GuestDup.cpp b/core/libs/tests/GuestDup.cpp
index 4e0451ae85..cb2ce4f36e 100644
--- a/core/libs/tests/GuestDup.cpp
+++ b/core/libs/tests/GuestDup.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <initializer_list>
@@ -5,21 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int GuestEbadf = 9;
@@ -104,6 +91,8 @@ static void BadDescriptors() {
 #ifdef _WIN32
     const auto previous = _set_invalid_parameter_handler(RecordInvalidParameter);
 #endif
+    Require(dup2_nid_postfix(pipe[0], closed) == closed);
+    Require(close_nid_postfix(closed) == 0);
     RequireFailure(close_nid_postfix(closed), GuestEbadf);
     RequireFailure(close_nid_postfix(-1), GuestEbadf);
 #ifdef _WIN32
@@ -190,6 +179,7 @@ static void DuplicatesShareStatusFlags() {
     constexpr int SetDescriptorFlags = 2;
     constexpr int GetFlags = 3;
     constexpr int SetFlags = 4;
+    constexpr int ReadWrite = 2;
     constexpr int NonBlocking = 4;
     constexpr int GuestEagain = 35;
     int pipe[2];
@@ -201,14 +191,14 @@ static void DuplicatesShareStatusFlags() {
     Require(duplicate >= 0);
     Require(fcntl_nid_postfix(duplicate, GetDescriptorFlags) == 0);
     Require(fcntl_nid_postfix(duplicate, SetFlags, NonBlocking) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == NonBlocking);
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadWrite | NonBlocking));
     Require(dup2_nid_postfix(pipe[0], other[0]) == other[0]);
     Require(fcntl_nid_postfix(other[0], GetDescriptorFlags) == 0);
-    Require(fcntl_nid_postfix(other[0], GetFlags) == NonBlocking);
+    Require(fcntl_nid_postfix(other[0], GetFlags) == (ReadWrite | NonBlocking));
     char buffer[4] = {};
     RequireFailure(static_cast<int>(read_nid_postfix(other[0], buffer, sizeof(buffer))), GuestEagain);
     Require(fcntl_nid_postfix(pipe[0], SetFlags, 0) == 0);
-    Require(fcntl_nid_postfix(duplicate, GetFlags) == 0);
+    Require(fcntl_nid_postfix(duplicate, GetFlags) == ReadWrite);
     Require(fcntl_nid_postfix(pipe[0], GetDescriptorFlags) == 1);
     for (const int descriptor : {pipe[0], pipe[1], other[0], other[1], duplicate}) Require(close_nid_postfix(descriptor) == 0);
 }
diff --git a/core/libs/tests/GuestDynamicCast.cpp b/core/libs/tests/GuestDynamicCast.cpp
index c7892a5e96..5a4212d578 100644
--- a/core/libs/tests/GuestDynamicCast.cpp
+++ b/core/libs/tests/GuestDynamicCast.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -11,8 +12,7 @@ struct Object { const void* vtable; };
 extern "C" {
 extern const unsigned char _ZTVN10__cxxabiv117__class_type_infoE_nid_postfix[];
 extern const unsigned char _ZTVN10__cxxabiv120__si_class_type_infoE_nid_postfix[];
-void* APS5_VABI __dynamic_cast_nid_postfix(const void*, const void*, const void*, std::ptrdiff_t);
-LibcException::Header* APS5_VABI __cxa_init_primary_exception_nid_postfix(void*, std::type_info*, void (*)(void*));
+
 }
 
 namespace {
@@ -32,14 +32,15 @@ const Vtable DerivedVtable{0, &DerivedType, nullptr};
 int main() {
     const Object derived{&DerivedVtable.first};
     const Object base{&BaseVtable.first};
-    Require(__dynamic_cast_nid_postfix(&derived, &BaseType, &DerivedType, 0) == &derived);
-    Require(__dynamic_cast_nid_postfix(&derived, &BaseType, &OtherType, 0) == nullptr);
-    Require(__dynamic_cast_nid_postfix(&base, &BaseType, &DerivedType, 0) == nullptr);
-    Require(__dynamic_cast_nid_postfix(nullptr, &BaseType, &DerivedType, 0) == nullptr);
+    Require(__dynamic_cast_nid_postfix(&derived, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&DerivedType), 0) == &derived);
+    Require(__dynamic_cast_nid_postfix(&derived, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&OtherType), 0) == nullptr);
+    Require(__dynamic_cast_nid_postfix(&base, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&DerivedType), 0) == nullptr);
+    Require(__dynamic_cast_nid_postfix(nullptr, reinterpret_cast<const __cxxabiv1::__class_type_info*>(&BaseType), reinterpret_cast<const __cxxabiv1::__class_type_info*>(&DerivedType), 0) == nullptr);
     void* object = __cxa_allocate_exception_nid_postfix(16);
     auto* type = reinterpret_cast<std::type_info*>(const_cast<TypeRecord*>(&DerivedType));
     LibcException::Header* header = __cxa_init_primary_exception_nid_postfix(object, type, Destroy);
     Require(header == LibcException::FromObject(object));
     Require(header->type == type && header->destructor == Destroy && header->adjusted == object);
     __cxa_free_exception_nid_postfix(object);
+
 }
diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index 8ea9fe7c93..b3e9d0b4e9 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -1,27 +1,24 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdlib>
 #include <cstdint>
 #include <cstdio>
+#include <cstring>
 #include <filesystem>
 #include <fstream>
-#ifndef _WIN32
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
 #include <dlfcn.h>
 #endif
 #include <stdexcept>
 #include <source_location>
 #include <thread>
-extern "C" {
-int APS5_VABI sceKernelDlsym(std::int32_t, const char*, void**);
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-char* APS5_VABI dlerror_nid_postfix();
-int APS5_VABI _sceKernelRtldThreadAtexitIncrement_nid_postfix(const void*);
-int APS5_VABI _sceKernelRtldThreadAtexitDecrement_nid_postfix(const void*);
-int APS5_VABI sceKernelLoadStartModule(const char*, std::size_t, const void*, unsigned, const void*, int*);
-int APS5_VABI sceKernelStopUnloadModule(int, std::size_t, const void*, unsigned, const void*, int*);
-}
+
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "guest_dynamic_loader: failed at %s:%u\n", location.file_name(), location.line());
@@ -37,6 +34,28 @@ static bool ThrowsRuntimeError(TFunction function) {
     }
     return false;
 }
+static bool FailsAsUnrelinked(const std::filesystem::path& module) {
+    void* handle = dlopen_nid_postfix(module.string().c_str(), 2);
+    const char* error = dlerror_nid_postfix();
+    return handle == nullptr && error != nullptr && std::strstr(error, module.filename().string().c_str()) != nullptr &&
+        std::strstr(error, "--module-dir") != nullptr;
+}
+static void CheckUnrelinkedModule(const std::filesystem::path& module) {
+#ifdef _WIN32
+    const UINT processMode = SetErrorMode(0);
+    DWORD threadMode = 0;
+    const bool threadModeSet = SetThreadErrorMode(SEM_NOGPFAULTERRORBOX, &threadMode) != 0;
+#endif
+    const bool first = FailsAsUnrelinked(module);
+    const bool again = FailsAsUnrelinked(module);
+#ifdef _WIN32
+    const DWORD threadModeAfter = GetThreadErrorMode();
+    SetThreadErrorMode(threadMode, nullptr);
+    SetErrorMode(processMode);
+    Require(threadModeSet && threadModeAfter == SEM_NOGPFAULTERRORBOX);
+#endif
+    Require(first && again);
+}
 #ifdef _WIN32
 static void CheckGlobalLookupOrder(const char* path) {
     const std::filesystem::path other = "anyps5-global-order-for-test.guest.prx";
@@ -87,6 +106,7 @@ static bool CheckGlobalVisibility(const char* path, bool globalFirst) {
             std::fprintf(stderr, "RTLD_GLOBAL lost after closing its handle: global_first=%d scope=%s; surviving handle returns %d\n",
                 globalFirst, scope == nullptr ? "NULL" : "-2", add(20, 22));
             dlerror_nid_postfix();
+
             visible = false;
         }
     }
@@ -108,7 +128,8 @@ int main(int argc, char** argv) {
     Require(dlerror_nid_postfix() != nullptr);
     Require(dlerror_nid_postfix() == nullptr);
     Require(dlopen_nid_postfix("anyps5-missing-module-for-test.prx", 2) == nullptr);
-    Require(dlerror_nid_postfix() != nullptr);
+    const char* missing = dlerror_nid_postfix();
+    Require(missing != nullptr && std::strstr(missing, "--module-dir") == nullptr);
     void* mainSymbol = nullptr;
     const int mainResult = sceKernelDlsym(0, "GuestDefaultScopeOnly", &mainSymbol);
     std::fprintf(stderr, "sceKernelDlsym(0, GuestDefaultScopeOnly): result=0x%08x, symbol=%p\n", static_cast<unsigned>(mainResult), mainSymbol);
@@ -117,6 +138,7 @@ int main(int argc, char** argv) {
     Require(reinterpret_cast<MainFunction>(mainSymbol)(6, 7) == 42);
     Require(sceKernelDlsym(0, "anyps5_missing_main_symbol", &mainSymbol) == static_cast<int>(0x80020003u));
     dlerror_nid_postfix();
+
     void* executable = dlopen_nid_postfix(nullptr, 2);
     Require(executable != nullptr && dlclose_nid_postfix(executable) == 0);
 #ifdef _WIN32
@@ -155,10 +177,12 @@ int main(int argc, char** argv) {
     const std::filesystem::path guest = "anyps5-relinked-module-for-test.prx";
     auto relinked = guest;
     relinked += ".guest.prx";
+    std::filesystem::remove(relinked);
     {
         std::ofstream elf(guest, std::ios::binary);
         elf.write("\x7f" "ELF", 4);
     }
+    CheckUnrelinkedModule(guest);
     std::filesystem::copy_file(argv[1], relinked, std::filesystem::copy_options::overwrite_existing);
     void* redirected = dlopen_nid_postfix(guest.string().c_str(), 2);
     Require(redirected != nullptr);
diff --git a/core/libs/tests/GuestDynamicLoaderVariants.cpp b/core/libs/tests/GuestDynamicLoaderVariants.cpp
index 5dd0f764b8..adeb771494 100644
--- a/core/libs/tests/GuestDynamicLoaderVariants.cpp
+++ b/core/libs/tests/GuestDynamicLoaderVariants.cpp
@@ -1,12 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <source_location>
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-}
+
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "guest_dynamic_loader_variants: failed at %s:%u\n", location.file_name(), location.line());
diff --git a/core/libs/tests/GuestElfPhdrMatch.cpp b/core/libs/tests/GuestElfPhdrMatch.cpp
index 3e8d585a70..4d0797a548 100644
--- a/core/libs/tests/GuestElfPhdrMatch.cpp
+++ b/core/libs/tests/GuestElfPhdrMatch.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/specifics/linux/ElfTypes.hpp"
 #include "SceTypes.hpp"
@@ -5,10 +6,6 @@
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI __elf_phdr_match_addr_nid_postfix(dl_phdr_info*, void*);
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
diff --git a/core/libs/tests/GuestEntitlements.cpp b/core/libs/tests/GuestEntitlements.cpp
new file mode 100644
index 0000000000..6960f9b349
--- /dev/null
+++ b/core/libs/tests/GuestEntitlements.cpp
@@ -0,0 +1,74 @@
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
+#include "SceTypes.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <random>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static void SetEntitlements(const std::filesystem::path& file) {
+#ifdef _WIN32
+    Require(_wputenv_s(L"ANYPS5_ENTITLEMENTS", file.wstring().c_str()) == 0);
+#else
+    Require(::setenv("ANYPS5_ENTITLEMENTS", file.c_str(), 1) == 0);
+#endif
+}
+
+int main(int argc, char** argv) {
+    const auto root = std::filesystem::temp_directory_path() / ("anyps5_guest_entitlements-" + std::to_string(std::random_device{}()));
+    const auto directory = root / std::filesystem::path(u8"dlc-a\u00e7\u00e3o-\u65e5\u672c");
+    const auto file = directory / "anyps5-entitlements.ini";
+    if (argc == 2 && std::string_view(argv[1]) == "missing") {
+        std::uint32_t skuFlag = 0;
+    Require(sceNpEntitlementAccessGetSkuFlag(nullptr) == static_cast<int>(0x80558003));
+    Require(sceNpEntitlementAccessGetSkuFlag(&skuFlag) == 0 && skuFlag == 3);
+    std::uint32_t pftFlag = 1;
+    Require(sceNpEntitlementAccessGetPftFlag(nullptr) == static_cast<int>(0x817D0002));
+    Require(sceNpEntitlementAccessGetPftFlag(&pftFlag) == 0 && pftFlag == 0);
+    std::uint32_t trialFlag = 1;
+    Require(sceNpEntitlementAccessGetGameTrialsFlag(nullptr) == static_cast<int>(0x817D0002));
+    Require(sceNpEntitlementAccessGetGameTrialsFlag(&trialFlag) == 0 && trialFlag == 0);
+    Require(sceNpEntitlementAccessGenerateTransactionId(nullptr) == static_cast<int>(0x80558003));
+    SetEntitlements(file);
+        std::uint32_t hits = 0;
+        bool rejected = false;
+        try {
+            sceNpEntitlementAccessGetAddcontEntitlementInfoList(0, nullptr, 0, &hits);
+
+        } catch (const std::runtime_error& error) {
+            rejected = std::string_view(error.what()).starts_with("NpEntitlementAccess: cannot read ");
+        }
+        Require(rejected);
+        std::puts("Guest entitlements rejected a missing configured file");
+        return 0;
+    }
+    std::filesystem::create_directories(directory);
+    {
+        std::ofstream ini(file, std::ios::binary);
+        ini << "# owned add-ons\nFIRSTADDON0000\n  SECONDADDON ; second\n";
+        Require(static_cast<bool>(ini));
+    }
+    SetEntitlements(file);
+    NpEntitlementAccessAddcontEntitlementInfo list[3]{};
+    std::uint32_t hits = 0;
+    Require(sceNpEntitlementAccessGetAddcontEntitlementInfoList(0, list, 3, &hits) == 0);
+    Require(hits == 2);
+    Require(std::strcmp(list[0].entitlement_label.data, "FIRSTADDON0000") == 0);
+    Require(std::strcmp(list[1].entitlement_label.data, "SECONDADDON") == 0);
+    NpUnifiedEntitlementLabel label{};
+    std::memcpy(label.data, "SECONDADDON", 11);
+    NpEntitlementAccessAddcontEntitlementInfo info{};
+    Require(sceNpEntitlementAccessGetAddcontEntitlementInfo(0, &label, &info) == 0);
+    Require(std::strcmp(info.entitlement_label.data, "SECONDADDON") == 0 && info.package_type == 3 && info.download_status == 4);
+    std::filesystem::remove_all(root);
+    std::puts("Guest entitlements passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestEnvironment.cpp b/core/libs/tests/GuestEnvironment.cpp
index 46e2b2b11b..aab45e4742 100644
--- a/core/libs/tests/GuestEnvironment.cpp
+++ b/core/libs/tests/GuestEnvironment.cpp
@@ -1,14 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <cstring>
 #include <string>
-extern "C" {
-char* APS5_VABI getenv_nid_postfix(const char*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI unsetenv_nid_postfix(const char*);
-int APS5_VABI putenv_nid_postfix(char*);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     const char* key = "ANYPS5_GUEST_ENV_TEST_4C27";
diff --git a/core/libs/tests/GuestEqueueEvents.cpp b/core/libs/tests/GuestEqueueEvents.cpp
index 8e97329913..1a990f8c23 100644
--- a/core/libs/tests/GuestEqueueEvents.cpp
+++ b/core/libs/tests/GuestEqueueEvents.cpp
@@ -1,41 +1,15 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Equeue/Equeue.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
+#include <initializer_list>
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddUserEvent(KernelEqueue eq, int id);
-int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
-int APS5_VABI sceKernelTriggerUserEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
-int APS5_VABI sceKernelAddAmprEvent(KernelEqueue eq, int id, void* udata);
-int APS5_VABI sceKernelDeleteAmprEvent(KernelEqueue eq, int id);
-int APS5_VABI EqueueTriggerEvent_nid_postfix(KernelEqueue eq, uintptr_t ident, int16_t filter, void* triggerData);
-int APS5_VABI sceKernelAddHRTimerEvent(KernelEqueue eq, int id, const KernelTimespec* ts, void* udata);
-int APS5_VABI sceKernelAddTimerEvent(KernelEqueue eq, int id, KernelUseconds usec, void* udata);
-int APS5_VABI sceKernelDeleteTimerEvent(KernelEqueue eq, int id);
-intptr_t APS5_VABI sceKernelGetEventData(const KernelEvent* ev);
-int APS5_VABI sceKernelGetEventError(const KernelEvent* ev);
-intptr_t APS5_VABI sceKernelGetEventFflags(const KernelEvent* ev);
-int APS5_VABI sceKernelGetEventFilter(const KernelEvent* ev);
-uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
-void* APS5_VABI sceKernelGetEventUserData(const KernelEvent* ev);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
-static constexpr int SCE_KERNEL_ERROR_EBADF = static_cast<int>(0x80020009);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003c);
-static constexpr int EVFILT_TIMER = -7;
-static constexpr int EVFILT_USER = -11;
-static constexpr int EVFILT_HRTIMER = -15;
-static constexpr int EVFILT_AMPR = -25;
-static constexpr std::uint16_t EV_ERROR = 0x4000;
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -49,6 +23,16 @@ static bool RejectsNull(TResult (APS5_VABI *accessor)(const KernelEvent*)) {
     return false;
 }
 
+static bool RejectsWideFflags(const KernelEvent* ev) {
+    try {
+        sceKernelGetEventError(ev);
+
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
 static void SleepAtLeast(std::chrono::steady_clock::duration duration) {
     const auto start = std::chrono::steady_clock::now();
     while (std::chrono::steady_clock::now() - start < duration) {
@@ -246,12 +230,64 @@ static void VerifyRepeatedAmprCompletionsAreNotLost() {
     Require(sceKernelDeleteEqueue(eq) == SCE_OK);
 }
 
+static void RequireReported(KernelEqueue eq, int num, std::initializer_list<uintptr_t> expected) {
+    KernelEvent events[4]{};
+    int count = 0;
+    const KernelUseconds poll = 0;
+    Require(sceKernelWaitEqueue(eq, events, num, &count, &poll) == SCE_OK);
+    Require(count == static_cast<int>(expected.size()));
+    int index = 0;
+    for (const uintptr_t id : expected) {
+        Require(sceKernelGetEventId(&events[index++]) == id);
+    }
+}
+
+static void VerifyReportedEventsMoveBehindWaitingOnes() {
+    KernelEqueue eq = 0;
+    KernelEvent events[4]{};
+    int count = 0;
+    const KernelUseconds poll = 0;
+    int payload = 0;
+    Require(sceKernelCreateEqueue(&eq, "rotate") == SCE_OK);
+    for (const int id : {1, 2}) {
+        Require(sceKernelAddUserEvent(eq, id) == SCE_OK);
+        Require(sceKernelTriggerUserEvent(eq, id, &payload) == SCE_OK);
+    }
+    RequireReported(eq, 1, {1});
+    RequireReported(eq, 1, {2});
+    RequireReported(eq, 1, {1});
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+
+    Require(sceKernelCreateEqueue(&eq, "rotate three") == SCE_OK);
+    for (const int id : {1, 2, 3}) {
+        Require(sceKernelAddUserEvent(eq, id) == SCE_OK);
+        Require(sceKernelTriggerUserEvent(eq, id, &payload) == SCE_OK);
+    }
+    RequireReported(eq, 2, {1, 2});
+    RequireReported(eq, 2, {3, 1});
+    RequireReported(eq, 2, {2, 3});
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+
+    Require(sceKernelCreateEqueue(&eq, "rotate edge") == SCE_OK);
+    for (const int id : {7, 8}) {
+        Require(sceKernelAddUserEventEdge(eq, id) == SCE_OK);
+        Require(sceKernelTriggerUserEvent(eq, id, &payload) == SCE_OK);
+    }
+    RequireReported(eq, 1, {7});
+    Require(sceKernelTriggerUserEvent(eq, 7, &payload) == SCE_OK);
+    RequireReported(eq, 1, {8});
+    RequireReported(eq, 1, {7});
+    Require(sceKernelWaitEqueue(eq, events, 4, &count, &poll) == SCE_KERNEL_ERROR_ETIMEDOUT);
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+}
+
 int main() {
     VerifyPeriodicTimer();
     VerifyUserEventReportedOncePerWait();
     VerifyBlockingWaitReportsLevelEventOnce();
     VerifyEdgeUserEventReportedOnce();
     VerifyRepeatedAmprCompletionsAreNotLost();
+    VerifyReportedEventsMoveBehindWaitingOnes();
 
     KernelEqueue eq = 0;
     Require(sceKernelCreateEqueue(&eq, "events") == SCE_OK);
@@ -291,12 +327,30 @@ int main() {
     Require(sceKernelGetEventFflags(&rawEvent) == static_cast<intptr_t>(0x80000001LL));
     Require(sceKernelGetEventData(&rawEvent) == -5);
     Require(sceKernelGetEventUserData(&rawEvent) == nullptr);
-    Require(sceKernelGetEventError(&rawEvent) == 0);
-    rawEvent.flags = static_cast<std::uint16_t>(~EV_ERROR);
-    Require(sceKernelGetEventError(&rawEvent) == 0);
+    Require(RejectsWideFflags(&rawEvent));
+    rawEvent.fflags = 0;
     rawEvent.flags = EV_ERROR;
     rawEvent.data = 22;
-    Require(sceKernelGetEventError(&rawEvent) == 22);
+    Require(sceKernelGetEventError(&rawEvent) == 0);
+    rawEvent.data = -1;
+    Require(sceKernelGetEventError(&rawEvent) == 0);
+    rawEvent.data = 0x80020016;
+    Require(sceKernelGetEventError(&rawEvent) == 0);
+    rawEvent.fflags = 5;
+    rawEvent.data = 0;
+    Require(sceKernelGetEventError(&rawEvent) == static_cast<int>(0x80020005));
+    rawEvent.data = 22;
+    Require(sceKernelGetEventError(&rawEvent) == static_cast<int>(0x80020005));
+    rawEvent.flags = 0;
+    rawEvent.fflags = 7;
+    Require(sceKernelGetEventError(&rawEvent) == static_cast<int>(0x80020007));
+    rawEvent.flags = EV_EOF;
+    rawEvent.fflags = 3;
+    rawEvent.data = 9;
+    Require(sceKernelGetEventError(&rawEvent) == static_cast<int>(0x80020003));
+    rawEvent.flags = static_cast<std::uint16_t>(~EV_ERROR);
+    rawEvent.fflags = 0xFFFF;
+    Require(sceKernelGetEventError(&rawEvent) == static_cast<int>(0x8002FFFF));
 
     Require(RejectsNull(sceKernelGetEventData));
     Require(RejectsNull(sceKernelGetEventError));
diff --git a/core/libs/tests/GuestErr.cpp b/core/libs/tests/GuestErr.cpp
index cf7f656594..570a1c1d85 100644
--- a/core/libs/tests/GuestErr.cpp
+++ b/core/libs/tests/GuestErr.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
@@ -11,27 +13,10 @@
 #include <unistd.h>
 #endif
 
-using ErrExit = void (APS5_VABI*)(int);
-
 extern "C" {
-void APS5_VABI err_set_file_nid_postfix(FileStream* stream);
-void APS5_VABI err_set_exit_nid_postfix(ErrExit function);
-void APS5_VABI warn_nid_postfix(const char* format, ...);
-void APS5_VABI warnc_nid_postfix(int code, const char* format, ...);
-void APS5_VABI warnx_nid_postfix(const char* format, ...);
-[[noreturn]] void APS5_VABI err_nid_postfix(int status, const char* format, ...);
-[[noreturn]] void APS5_VABI errc_nid_postfix(int status, int code, const char* format, ...);
-[[noreturn]] void APS5_VABI errx_nid_postfix(int status, const char* format, ...);
-void APS5_VABI vwarn_nid_postfix(const char* format, VaList* args);
-void APS5_VABI vwarnc_nid_postfix(int code, const char* format, VaList* args);
-void APS5_VABI vwarnx_nid_postfix(const char* format, VaList* args);
-[[noreturn]] void APS5_VABI verr_nid_postfix(int status, const char* format, VaList* args);
-[[noreturn]] void APS5_VABI verrc_nid_postfix(int status, int code, const char* format, VaList* args);
-[[noreturn]] void APS5_VABI verrx_nid_postfix(int status, const char* format, VaList* args);
-char* APS5_VABI strerror_nid_postfix(int error);
-int* APS5_VABI __error_nid_postfix();
+
 extern const char* __progname_nid_postfix;
-void APS5_VABI psignal_nid_postfix(unsigned int signal, const char* prefix);
+
 extern const char* const sys_signame_nid_postfix[32];
 extern const char* const sys_siglist_nid_postfix[32];
 }
@@ -63,6 +48,7 @@ public:
     Capture() : stream(std::tmpfile()) { err_set_file_nid_postfix(&stream); }
     ~Capture() {
         err_set_file_nid_postfix(nullptr);
+
         stream.Close();
     }
     std::string Take() {
@@ -144,15 +130,24 @@ int main() {
         Capture capture;
         *__error_nid_postfix() = 2;
         warn_nid_postfix("open %s", "a.txt");
+
         Require(capture.Take() == "prog: open a.txt: " + noEntry + "\n", "warn");
         *__error_nid_postfix() = 2;
         warn_nid_postfix(nullptr);
+
         Require(capture.Take() == "prog: " + noEntry + "\n", "warn without format");
+        *__error_nid_postfix() = 13;
+        _warn_nid_postfix("open %s", "b.txt");
+
+        Require(capture.Take() == "prog: open b.txt: " + denied + "\n", "_warn");
         warnc_nid_postfix(13, "%d-%s", 7, "x");
+
         Require(capture.Take() == "prog: 7-x: " + denied + "\n", "warnc");
         warnx_nid_postfix("plain %c", 'q');
+
         Require(capture.Take() == "prog: plain q\n", "warnx");
         warnx_nid_postfix(nullptr);
+
         Require(capture.Take() == "prog: \n", "warnx without format");
 
         err_set_exit_nid_postfix(Hook);
@@ -163,6 +158,12 @@ int main() {
         *__error_nid_postfix() = 2;
         Require(ExitStatus([] { err_nid_postfix(5, "e"); }) == 5, "err status");
         Require(capture.Take() == "prog: e: " + noEntry + "\n", "err text");
+        *__error_nid_postfix() = 13;
+        Require(ExitStatus([] { _err_nid_postfix(7, "%s %d", "f", 8); }) == 7 && g_hookStatus == 7, "_err status");
+        Require(capture.Take() == "prog: f 8: " + denied + "\n", "_err text");
+        *__error_nid_postfix() = 2;
+        Require(ExitStatus([] { _warn_nid_postfix(nullptr); }) == -1 && g_hookStatus == 7, "_warn does not exit");
+        Require(capture.Take() == "prog: " + noEntry + "\n", "_warn without format");
 
         *__error_nid_postfix() = 2;
         CallVariant(Variant::Warn, 0, 0, "open %s", "a.txt");
@@ -185,6 +186,7 @@ int main() {
         Require(ExitStatus([] { CallVariant(Variant::Errx, 0, 0, nullptr); }) == 0, "verrx status 0");
         Require(capture.Take() == "prog: \n", "verrx without format");
         err_set_exit_nid_postfix(nullptr);
+
     }
     __progname_nid_postfix = savedName;
 
diff --git a/core/libs/tests/GuestErrorDialog.cpp b/core/libs/tests/GuestErrorDialog.cpp
index 106819b6a8..034eb4e5e0 100644
--- a/core/libs/tests/GuestErrorDialog.cpp
+++ b/core/libs/tests/GuestErrorDialog.cpp
@@ -1,16 +1,8 @@
+#include "prx/libSceErrorDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceErrorDialogInitialize(void);
-int APS5_VABI sceErrorDialogOpen(const void* param);
-int APS5_VABI sceErrorDialogUpdateStatus(void);
-int APS5_VABI sceErrorDialogGetStatus(void);
-int APS5_VABI sceErrorDialogClose(void);
-int APS5_VABI sceErrorDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -20,6 +12,7 @@ constexpr int kStatusFinished = 3;
 constexpr int kErrNotInitialized = static_cast<int>(0x80ED0001);
 constexpr int kErrAlreadyInitialized = static_cast<int>(0x80ED0002);
 constexpr int kErrParam = static_cast<int>(0x80ED0003);
+constexpr int kErrUnexpectedFatal = static_cast<int>(0x80ED0004);
 constexpr int kErrInvalidState = static_cast<int>(0x80ED0005);
 
 struct ErrorDialogParam {
@@ -68,4 +61,6 @@ int main() {
     Require(sceErrorDialogGetStatus() == 0);
     Require(sceErrorDialogUpdateStatus() == 0);
     Require(sceErrorDialogClose() == kErrInvalidState);
+    Require(sceErrorDialogOpenDetail() == kErrUnexpectedFatal);
+    Require(sceErrorDialogOpenWithReport() == kErrUnexpectedFatal);
 }
diff --git a/core/libs/tests/GuestErrors.cpp b/core/libs/tests/GuestErrors.cpp
index b66b25b00d..1946147d26 100644
--- a/core/libs/tests/GuestErrors.cpp
+++ b/core/libs/tests/GuestErrors.cpp
@@ -1,14 +1,12 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <climits>
+#include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <thread>
 
-extern "C" {
-char* APS5_VABI strerror_nid_postfix(int);
-int APS5_VABI strerror_r_nid_postfix(int, char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
 static void Require(bool value) { if (!value) std::abort(); }
 static const char* const freebsd[97] = {
     "No error: 0", "Operation not permitted", "No such file or directory",
@@ -21,7 +19,7 @@ static const char* const freebsd[97] = {
     "Is a directory", "Invalid argument", "Too many open files in system",
     "Too many open files", "Inappropriate ioctl for device", "Text file busy",
     "File too large", "No space left on device", "Illegal seek",
-    "Read-only file system", "Too many links", "Broken pipe",
+    "Read-only filesystem", "Too many links", "Broken pipe",
     "Numerical argument out of domain", "Result too large", "Resource temporarily unavailable",
     "Operation now in progress", "Operation already in progress", "Socket operation on non-socket",
     "Destination address required", "Message too long", "Protocol wrong type for socket",
@@ -62,7 +60,11 @@ int main() {
     for (int error = 0; error <= 96; ++error) {
         Require(strerror_r_nid_postfix(error, buffer, sizeof(buffer)) == 0);
         Require(std::strcmp(buffer, freebsd[error]) == 0);
-        Require(std::strcmp(strerror_nid_postfix(error), freebsd[error]) == 0);
+        char coded[32];
+        std::snprintf(coded, sizeof(coded), "error_code=0x%08x", static_cast<unsigned>(error));
+        const char* expected = error == 0 ? "No error" : error < 95 ? freebsd[error] : coded;
+        Require(std::strcmp(strerror_nid_postfix(error), expected) == 0);
+        Require(*__error_nid_postfix() == 13);
     }
     Require(strerror_r_nid_postfix(-1, buffer, sizeof(buffer)) == 22);
     Require(std::strcmp(buffer, "Unknown error: -1") == 0);
@@ -70,15 +72,18 @@ int main() {
     struct UnknownError {
         int error;
         const char* text;
+        const char* coded;
     };
-    for (const UnknownError& unknown : {UnknownError{97, "Unknown error: 97"}, UnknownError{INT_MAX, "Unknown error: 2147483647"},
-                                        UnknownError{INT_MIN, "Unknown error: -2147483648"}}) {
+    for (const UnknownError& unknown : {UnknownError{97, "Unknown error: 97", "error_code=0x00000061"},
+                                        UnknownError{9999, "Unknown error: 9999", "error_code=0x0000270f"},
+                                        UnknownError{INT_MAX, "Unknown error: 2147483647", "error_code=0x7fffffff"},
+                                        UnknownError{-1, "Unknown error: -1", "error_code=0xffffffff"},
+                                        UnknownError{INT_MIN, "Unknown error: -2147483648", "error_code=0x80000000"}}) {
         Require(strerror_r_nid_postfix(unknown.error, buffer, sizeof(buffer)) == 22);
         Require(std::strcmp(buffer, unknown.text) == 0);
         Require(*__error_nid_postfix() == 13);
-        Require(std::strcmp(strerror_nid_postfix(unknown.error), unknown.text) == 0);
-        Require(*__error_nid_postfix() == 22);
-        *__error_nid_postfix() = 13;
+        Require(std::strcmp(strerror_nid_postfix(unknown.error), unknown.coded) == 0);
+        Require(*__error_nid_postfix() == 13);
     }
     char sentinel[] = "xyz";
     Require(strerror_r_nid_postfix(22, sentinel, 1) == 34);
diff --git a/core/libs/tests/GuestExceptionHandler.cpp b/core/libs/tests/GuestExceptionHandler.cpp
index fbb5dfd8f7..2ad28a7af4 100644
--- a/core/libs/tests/GuestExceptionHandler.cpp
+++ b/core/libs/tests/GuestExceptionHandler.cpp
@@ -1,15 +1,9 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
-int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_EAGAIN = static_cast<int>(0x80020023);
-
 static void APS5_VABI Handler(int, void*) {}
 static void APS5_VABI Other(int, void*) {}
 
diff --git a/core/libs/tests/GuestExecuteOnce.cpp b/core/libs/tests/GuestExecuteOnce.cpp
index 327fbe8c32..e58792b37d 100644
--- a/core/libs/tests/GuestExecuteOnce.cpp
+++ b/core/libs/tests/GuestExecuteOnce.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -5,7 +6,7 @@
 #include <thread>
 
 using Callback = int (APS5_VABI *)(void*, void*, void**);
-extern "C" int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(int*, Callback, void*);
+
 static int ExecuteOnce(int* flag, Callback callback, void* arg) {
     return _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(flag, callback, arg);
 }
diff --git a/core/libs/tests/GuestExecuteOnceConcurrency.cpp b/core/libs/tests/GuestExecuteOnceConcurrency.cpp
index e5fc8f802e..1537ea5887 100644
--- a/core/libs/tests/GuestExecuteOnceConcurrency.cpp
+++ b/core/libs/tests/GuestExecuteOnceConcurrency.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -10,10 +11,6 @@
 
 using Callback = int (APS5_VABI *)(void*, void*, void**);
 using ExecuteFunction = int (APS5_VABI *)(int*, Callback, void*);
-extern "C" {
-int APS5_VABI _ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1__nid_postfix(int*, Callback, void*);
-int APS5_VABI std_execute_once_nid_postfix(int*, Callback, void*);
-}
 
 static void Check(bool value, int line) {
     if (!value) {
diff --git a/core/libs/tests/GuestExecvp.cpp b/core/libs/tests/GuestExecvp.cpp
index 24044df2f7..22e67f4d98 100644
--- a/core/libs/tests/GuestExecvp.cpp
+++ b/core/libs/tests/GuestExecvp.cpp
@@ -1,12 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
-extern "C" {
-int APS5_VABI execvp_nid_postfix(const char*, char* const*);
-int APS5_VABI execv_nid_postfix(const char*, char* const*);
-int APS5_VABI execve_nid_postfix(const char*, char* const*, char* const*);
-}
+
 template <typename TCall> static bool Throws(TCall call, const std::string& message) {
     try {
         call();
diff --git a/core/libs/tests/GuestExitOrder.cpp b/core/libs/tests/GuestExitOrder.cpp
index 889e6f0f26..af813531ef 100644
--- a/core/libs/tests/GuestExitOrder.cpp
+++ b/core/libs/tests/GuestExitOrder.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
@@ -5,9 +6,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
-extern "C" int APS5_VABI atexit_nid_postfix(void (APS5_VABI *func)());
-
 namespace {
 
 int events[2];
diff --git a/core/libs/tests/GuestFdopendir.cpp b/core/libs/tests/GuestFdopendir.cpp
index 551ad063f0..7dfad311ad 100644
--- a/core/libs/tests/GuestFdopendir.cpp
+++ b/core/libs/tests/GuestFdopendir.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/GuestDirectory.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/File.hpp"
@@ -9,16 +12,7 @@
 #include <fstream>
 #include <map>
 #include <string>
-extern "C" {
-void* APS5_VABI fdopendir_nid_postfix(int);
-GuestDirectoryEntry* APS5_VABI readdir_nid_postfix(void*);
-int APS5_VABI closedir_nid_postfix(void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     const auto root = std::filesystem::path("anyps5-fdopendir-test-" +
diff --git a/core/libs/tests/GuestFileLock.cpp b/core/libs/tests/GuestFileLock.cpp
index 3fb7ac7b71..26dd7afae8 100644
--- a/core/libs/tests/GuestFileLock.cpp
+++ b/core/libs/tests/GuestFileLock.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <barrier>
 #include <chrono>
@@ -12,25 +15,6 @@
 
 class FileStream;
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI flock_nid_postfix(int, int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-FileStream* APS5_VABI fdopen_nid_postfix(int, const char*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
@@ -53,7 +37,8 @@ static bool Acquires(int descriptor, int mode) {
 
 struct Fixture {
     static inline unsigned serial = 0;
-    std::string path = (std::filesystem::temp_directory_path() / ("anyps5-flock-" + std::to_string(::GetCurrentProcessId()) + "-" + std::to_string(serial++) + ".bin")).string();
+    std::filesystem::path native = std::filesystem::temp_directory_path() / ("anyps5-flock-" + std::to_string(::GetCurrentProcessId()) + "-" + std::to_string(serial++) + ".bin");
+    std::string path = native.string();
     std::set<int> descriptors;
     int source = Open(true);
     int other = Open(false);
@@ -76,7 +61,7 @@ struct Fixture {
     }
     ~Fixture() {
         for (const int descriptor : descriptors) Require(close_nid_postfix(descriptor) == 0);
-        Require(std::remove(path.c_str()) == 0);
+        Require(std::filesystem::remove(native));
     }
 };
 
@@ -262,7 +247,7 @@ static int ChildTry(const Fixture (&fixtures)[6], int mode) {
     wchar_t executable[32768];
     Require(::GetModuleFileNameW(nullptr, executable, 32768) != 0);
     std::wstring command = L"\"" + std::wstring(executable) + L"\" child " + std::to_wstring(mode | 4);
-    for (const Fixture& fixture : fixtures) command += L" \"" + std::filesystem::path(fixture.path).wstring() + L"\"";
+    for (const Fixture& fixture : fixtures) command += L" \"" + fixture.native.filename().wstring() + L"\"";
     STARTUPINFOW startup{};
     startup.cb = sizeof(startup);
     PROCESS_INFORMATION process{};
@@ -296,11 +281,29 @@ static void Processes() {
     Require(ChildTry(fixtures, 2) == 0);
 }
 
+static void Directories() {
+    const std::filesystem::path directory = std::filesystem::temp_directory_path() / ("anyps5-flock-dir-" + std::to_string(::GetCurrentProcessId()));
+    std::filesystem::create_directories(directory);
+    const std::string path = directory.string();
+    const int descriptor = open_nid_postfix(path.c_str(), 0x20000, 0);
+    Require(descriptor >= 0);
+    Require(flock_nid_postfix(descriptor, 1 | 4) == 0);
+    Require(flock_nid_postfix(descriptor, 2 | 4) == 0);
+    Require(flock_nid_postfix(descriptor, 2) == 0);
+    Require(flock_nid_postfix(descriptor, 8) == 0);
+    Require(flock_nid_postfix(descriptor, 0) == -1 && *__error_nid_postfix() == 9);
+    Require(flock_nid_postfix(descriptor, 4) == -1 && *__error_nid_postfix() == 9);
+    Require(close_nid_postfix(descriptor) == 0);
+    std::error_code ignored;
+    std::filesystem::remove_all(directory, ignored);
+}
+
 int main(int argc, char** argv) {
     if (argc >= 4 && std::string(argv[1]) == "child") {
         int busy = 0;
         for (int index = 3; index < argc; ++index) {
-            const int descriptor = open_nid_postfix(argv[index], 2, 0);
+            const std::string path = (std::filesystem::temp_directory_path() / argv[index]).string();
+            const int descriptor = open_nid_postfix(path.c_str(), 2, 0);
             Require(descriptor >= 0);
             if (flock_nid_postfix(descriptor, std::atoi(argv[2])) == 0) {
                 Require(flock_nid_postfix(descriptor, 8) == 0);
@@ -320,5 +323,6 @@ int main(int argc, char** argv) {
     else if (mode == "threads") Threads();
     else if (mode == "streams") Streams();
     else if (mode == "process") Processes();
+    else if (mode == "directory") Directories();
     else std::abort();
 }
diff --git a/core/libs/tests/GuestFileTimestamps.cpp b/core/libs/tests/GuestFileTimestamps.cpp
index 62750ec5f3..983915404c 100644
--- a/core/libs/tests/GuestFileTimestamps.cpp
+++ b/core/libs/tests/GuestFileTimestamps.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstdio>
@@ -10,22 +12,6 @@
 #include <io.h>
 #endif
 
-extern "C" {
-int APS5_VABI utimes_nid_postfix(const char*, const KernelTimeval*);
-int APS5_VABI lutimes_nid_postfix(const char*, const KernelTimeval*);
-int APS5_VABI futimes_nid_postfix(int, const KernelTimeval*);
-int APS5_VABI sceKernelUtimes_nid_postfix(const char*, const KernelTimeval*);
-int APS5_VABI stat_nid_postfix(const char*, FileStat*);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-std::int64_t APS5_VABI _fstat_nid_postfix(int, FileStat*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s (guest errno %d)\n", message, *__error_nid_postfix());
@@ -60,6 +46,70 @@ static void CheckTimes(const std::string& path, int fd, const KernelTimeval* exp
 #endif
 }
 
+#ifdef _WIN32
+static std::uint64_t Ticks(const FILETIME& time) {
+    return (static_cast<std::uint64_t>(time.dwHighDateTime) << 32) | time.dwLowDateTime;
+}
+
+static void CheckBirthtime(const std::string& path, int fd, std::uint64_t expected) {
+    FILETIME creation{};
+    Require(GetFileTime(reinterpret_cast<HANDLE>(_get_osfhandle(fd)), &creation, nullptr, nullptr), "native creation time");
+    Require(Ticks(creation) == expected, "native birth time follows an earlier mtime and never advances");
+    FileStat byPath{}, byFd{};
+    Require(stat_nid_postfix(path.c_str(), &byPath) == 0, "stat birth time");
+    Require(sceKernelFstat(fd, &byFd) == 0, "fstat birth time");
+    for (const auto* status : {&byPath, &byFd}) {
+        Require(status->st_birthtim.tv_sec == static_cast<std::int64_t>(expected / 10000000) - 11644473600LL &&
+            status->st_birthtim.tv_nsec == static_cast<std::int64_t>(expected % 10000000) * 100, "guest birth time matches native metadata");
+    }
+}
+
+template<typename TUpdate>
+static void CheckBirthtimeUpdates(const std::string& path, int fd, TUpdate update) {
+    const auto handle = CreateFileW(std::filesystem::path(path).c_str(), FILE_WRITE_ATTRIBUTES | FILE_READ_ATTRIBUTES,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    Require(handle != INVALID_HANDLE_VALUE, "open birth time fixture");
+    constexpr std::uint64_t initial = 116444736000000000ULL + 2000000000ULL * 10000000 + 1234567;
+    const FILETIME creation{static_cast<DWORD>(initial), static_cast<DWORD>(initial >> 32)};
+    Require(SetFileTime(handle, &creation, nullptr, nullptr), "seed native birth time");
+    const KernelTimeval later[2]{{1900000000, 654321}, {2100000000, 123456}};
+    Require(update(later) == 0, "update later modification time");
+    CheckTimes(path, fd, later);
+    CheckBirthtime(path, fd, initial);
+    const KernelTimeval earlier[2]{{1800000000, 1}, {2000000000, 123456}};
+    Require(update(earlier) == 0, "update modification time less than a microsecond before birth");
+    CheckTimes(path, fd, earlier);
+    constexpr std::uint64_t lowered = initial - 7;
+    CheckBirthtime(path, fd, lowered);
+    const KernelTimeval equal[2]{{1700000000, 999999}, earlier[1]};
+    Require(update(equal) == 0, "update equal modification time");
+    CheckTimes(path, fd, equal);
+    CheckBirthtime(path, fd, lowered);
+    const KernelTimeval invalid[2]{{1600000000, 0}, {std::numeric_limits<std::int64_t>::max(), 0}};
+    Require(update(invalid) != 0, "reject invalid modification time before changing birth");
+    CheckTimes(path, fd, equal);
+    CheckBirthtime(path, fd, lowered);
+    FILETIME future{};
+    GetSystemTimePreciseAsFileTime(&future);
+    const auto futureTicks = Ticks(future) + 600ULL * 10000000;
+    future = {static_cast<DWORD>(futureTicks), static_cast<DWORD>(futureTicks >> 32)};
+    Require(SetFileTime(handle, &future, nullptr, nullptr), "seed future birth time");
+    Require(CloseHandle(handle), "close birth time fixture");
+    const auto before = std::chrono::system_clock::now();
+    Require(update(nullptr) == 0, "current time lowers a future birth time");
+    const auto after = std::chrono::system_clock::now();
+    FILETIME nativeCreation{}, access{}, modified{};
+    Require(GetFileTime(reinterpret_cast<HANDLE>(_get_osfhandle(fd)), &nativeCreation, &access, &modified), "read current native times");
+    Require(Ticks(nativeCreation) == Ticks(access) && Ticks(access) == Ticks(modified), "current times share one snapshot including lowered birth");
+    CheckBirthtime(path, fd, Ticks(modified));
+    FileStat status{};
+    Require(sceKernelFstat(fd, &status) == 0, "fstat current birth time");
+    const auto recorded = std::chrono::seconds(status.st_birthtim.tv_sec) + std::chrono::nanoseconds(status.st_birthtim.tv_nsec);
+    Require(recorded >= before.time_since_epoch() - std::chrono::seconds(1) &&
+        recorded <= after.time_since_epoch() + std::chrono::seconds(1), "current birth time uses host clock");
+}
+#endif
+
 int main() {
     const auto root = std::filesystem::path("anyps5-file-times-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
     Require(std::filesystem::create_directory(root), "create fixture directory");
@@ -68,6 +118,15 @@ int main() {
     const int fd = open_nid_postfix(path.c_str(), 0, 0);
     Require(fd >= 0, "open read-only descriptor");
 
+#ifdef _WIN32
+    for (const auto update : {utimes_nid_postfix, lutimes_nid_postfix, sceKernelUtimes_nid_postfix}) {
+        CheckBirthtimeUpdates(path, fd, [&](const KernelTimeval* times) { return update(path.c_str(), times); });
+    }
+    for (const auto update : {futimes_nid_postfix, sceKernelFutimes}) {
+        CheckBirthtimeUpdates(path, fd, [&](const KernelTimeval* times) { return update(fd, times); });
+    }
+#endif
+
     const KernelTimeval first[2]{{1000000000, 123456}, {1000000001, 500000}};
     Require(utimes_nid_postfix(path.c_str(), first) == 0, "utimes fractional timestamp");
     CheckTimes(path, fd, first);
@@ -145,6 +204,14 @@ int main() {
     Require(std::filesystem::create_directory(directory), "create timestamp directory");
     const int directoryFd = open_nid_postfix(directory.c_str(), 0, 0);
     Require(directoryFd >= 0, "open directory descriptor");
+#ifdef _WIN32
+    for (const auto update : {utimes_nid_postfix, lutimes_nid_postfix, sceKernelUtimes_nid_postfix}) {
+        CheckBirthtimeUpdates(directory, directoryFd, [&](const KernelTimeval* times) { return update(directory.c_str(), times); });
+    }
+    for (const auto update : {futimes_nid_postfix, sceKernelFutimes}) {
+        CheckBirthtimeUpdates(directory, directoryFd, [&](const KernelTimeval* times) { return update(directoryFd, times); });
+    }
+#endif
     Require(utimes_nid_postfix(directory.c_str(), first) == 0, "directory utimes");
     FileStat directoryStatus{};
     Require(stat_nid_postfix(directory.c_str(), &directoryStatus) == 0 && Same(directoryStatus.st_mtim, first[1]), "directory stat precision");
diff --git a/core/libs/tests/GuestFileVector.cpp b/core/libs/tests/GuestFileVector.cpp
index e9e7b46880..72e398204c 100644
--- a/core/libs/tests/GuestFileVector.cpp
+++ b/core/libs/tests/GuestFileVector.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -26,37 +29,6 @@ static int MakePipe(int* ends) { return ::pipe(ends); }
 static int ClosePipe(int end) { return ::close(end); }
 #endif
 
-struct GuestIovec {
-    void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI dup_nid_postfix(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelReadv(int, const GuestIovec*, int);
-std::int64_t APS5_VABI readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _writev_nid_postfix(int, const GuestIovec*, int);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI sceKernelWritev(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelPreadv(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwritev(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI preadv_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelFtruncate(int, std::int64_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "File vector check failed at line %d\n", line);
@@ -94,13 +66,14 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
     for (std::size_t worker = 0; worker < Workers; ++worker) {
         writers[worker] = std::thread([&, worker] {
             std::uint16_t label = 0;
-            std::array<GuestIovec, Parts> pieces;
+            std::array<KernelIovec, Parts> pieces;
             pieces.fill({&label, sizeof(label)});
             start.arrive_and_wait();
             for (std::size_t record = 0; record < Records; ++record) {
                 label = static_cast<std::uint16_t>(worker * Records + record);
                 const auto written = worker % 2 == 0 ? sceKernelWritev(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()))
                                                      : writev_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()));
+
                 Require(written == RecordBytes);
             }
         });
@@ -126,12 +99,13 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
     for (std::size_t worker = 0; worker < Workers; ++worker) {
         readers[worker] = std::thread([&, worker] {
             std::array<std::uint16_t, Parts> record{};
-            std::array<GuestIovec, Parts> pieces;
+            std::array<KernelIovec, Parts> pieces;
             for (std::size_t part = 0; part < Parts; ++part) pieces[part] = {&record[part], sizeof(record[part])};
             start.arrive_and_wait();
             for (;;) {
                 const auto read = worker % 2 == 0 ? sceKernelReadv(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()))
                                                  : readv_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()));
+
                 if (read == 0) break;
                 Require(read == RecordBytes);
                 for (const auto label : record) Require(label == record[0]);
@@ -152,7 +126,7 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
     for (std::size_t worker = 0; worker < Workers; ++worker) {
         positioned[worker] = std::thread([&, worker] {
             std::array<std::uint16_t, Parts> record{};
-            std::array<GuestIovec, Parts> pieces;
+            std::array<KernelIovec, Parts> pieces;
             for (std::size_t part = 0; part < Parts; ++part) pieces[part] = {&record[part], sizeof(record[part])};
             start.arrive_and_wait();
             for (std::size_t iteration = 0; iteration < Records; ++iteration) {
@@ -161,9 +135,11 @@ static void ConcurrentRecords(const std::filesystem::path& path) {
                     record.fill(static_cast<std::uint16_t>(0x8000 + worker * Records + iteration));
                     transferred = worker == 0 ? sceKernelPwritev(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0)
                                               : pwritev_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0);
+
                 } else {
                     transferred = worker == 1 ? sceKernelPreadv(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0)
                                               : preadv_nid_postfix(descriptors[worker], pieces.data(), static_cast<int>(pieces.size()), 0);
+
                     for (const auto label : record) Require(label == record[0]);
                 }
                 Require(transferred == RecordBytes);
@@ -189,7 +165,7 @@ int main() {
 
     char first[3] = {};
     char second[4] = {};
-    GuestIovec reads[2] = {{first, sizeof(first)}, {second, sizeof(second)}};
+    KernelIovec reads[2] = {{first, sizeof(first)}, {second, sizeof(second)}};
     Require(sceKernelReadv(file, reads, 2) == 7);
     Require(std::memcmp(first, "012", 3) == 0 && std::memcmp(second, "3456", 4) == 0);
     Require(sceKernelLseek(file, 0, 1) == 7);
@@ -215,7 +191,7 @@ int main() {
 
     char ab[] = "AB";
     char cde[] = "CDE";
-    GuestIovec writes[2] = {{ab, 2}, {cde, 3}};
+    KernelIovec writes[2] = {{ab, 2}, {cde, 3}};
     Require(sceKernelPwritev(file, writes, 2, 2) == 5);
     Require(sceKernelLseek(file, 0, 1) == 10);
     Require(Contents(path) == "01ABCDE789");
@@ -223,7 +199,7 @@ int main() {
     Require(sceKernelWritev(file, writes, 2) == 5);
     Require(sceKernelLseek(file, 0, 1) == 13);
     Require(Contents(path) == "01ABCDE7ABCDE");
-    GuestIovec swapped[2] = {{cde, 3}, {ab, 2}};
+    KernelIovec swapped[2] = {{cde, 3}, {ab, 2}};
     Require(sceKernelLseek(file, 8, 0) == 8 && writev_nid_postfix(file, swapped, 2) == 5);
     Require(sceKernelLseek(file, 0, 1) == 13 && Contents(path) == "01ABCDE7CDEAB");
     Require(sceKernelLseek(file, 8, 0) == 8 && writev_nid_postfix(file, writes, 2) == 5);
@@ -232,7 +208,7 @@ int main() {
     Require(sceKernelLseek(file, 0, 1) == 13 && Contents(path) == "01ABCDE7CDEAB");
     Require(sceKernelLseek(file, 8, 0) == 8 && writev_nid_postfix(file, writes, 2) == 5);
 
-    GuestIovec gapped[3] = {{first, 2}, {nullptr, 0}, {second, 3}};
+    KernelIovec gapped[3] = {{first, 2}, {nullptr, 0}, {second, 3}};
     Require(sceKernelPreadv(file, gapped, 3, 0) == 5);
     Require(std::memcmp(first, "01", 2) == 0 && std::memcmp(second, "ABC", 3) == 0);
     Require(sceKernelLseek(file, 2, 0) == 2);
@@ -240,7 +216,7 @@ int main() {
     Require(std::memcmp(first, "AB", 2) == 0 && std::memcmp(second, "CDE", 3) == 0);
     Require(sceKernelLseek(file, 0, 1) == 7);
 
-    GuestIovec empty[1] = {{nullptr, 0}};
+    KernelIovec empty[1] = {{nullptr, 0}};
     Require(sceKernelReadv(file, empty, 1) == 0);
     Require(sceKernelReadv(file, reads, 0) == 0);
     Require(sceKernelWritev(file, nullptr, 0) == 0);
@@ -272,12 +248,12 @@ int main() {
     Require(Contents(path) == "01ABCDE7ABCDE");
     char x[] = "X";
     char y[] = "Y";
-    GuestIovec marks[2] = {{x, 1}, {y, 1}};
+    KernelIovec marks[2] = {{x, 1}, {y, 1}};
     Require(pwritev_nid_postfix(file, marks, 2, 0) == 2);
     Require(Contents(path) == "XYABCDE7ABCDE");
     char zero[] = "0";
     char one[] = "1";
-    GuestIovec restore[2] = {{zero, 1}, {one, 1}};
+    KernelIovec restore[2] = {{zero, 1}, {one, 1}};
     Require(pwritev_nid_postfix(file, restore, 2, 0) == 2);
     Require(sceKernelLseek(file, 0, 1) == 4);
     Require(pwritev_nid_postfix(file, writes, 2, -1) == -1 && *__error_nid_postfix() == 22);
@@ -326,12 +302,12 @@ int main() {
     int ends[2] = {};
     Require(MakePipe(ends) == 0);
     char xyz[] = "xyz";
-    GuestIovec message[1] = {{xyz, 3}};
+    KernelIovec message[1] = {{xyz, 3}};
     Require(sceKernelWritev(ends[1], message, 1) == 3);
     Require(sceKernelReadv(ends[0], reads, 2) == 3);
     Require(std::memcmp(first, "xyz", 3) == 0);
     char stuvw[] = "stuvw";
-    GuestIovec longer[1] = {{stuvw, 5}};
+    KernelIovec longer[1] = {{stuvw, 5}};
     Require(sceKernelWritev(ends[1], longer, 1) == 5);
     Require(sceKernelReadv(ends[0], reads, 2) == 5);
     Require(std::memcmp(first, "stu", 3) == 0 && std::memcmp(second, "vw", 2) == 0);
@@ -351,7 +327,7 @@ int main() {
     const int random = sceKernelOpen("/dev/urandom", 0, 0);
     Require(random >= 0);
     unsigned char noise[48]{};
-    GuestIovec pieces[2] = {{noise, 16}, {noise + 16, 16}};
+    KernelIovec pieces[2] = {{noise, 16}, {noise + 16, 16}};
     Require(sceKernelReadv(random, pieces, 2) == 32);
     Require(sceKernelPreadv(random, pieces, 1, 1000) == 16);
     Require(sceKernelPread(random, noise + 32, 16, 1000) == 16);
diff --git a/core/libs/tests/GuestFileVectorMemory.cpp b/core/libs/tests/GuestFileVectorMemory.cpp
index 58285bbdd7..8bac8775f0 100644
--- a/core/libs/tests/GuestFileVectorMemory.cpp
+++ b/core/libs/tests/GuestFileVectorMemory.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestArena.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -19,28 +22,6 @@
 #include <unistd.h>
 #endif
 
-struct GuestIovec {
-    void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelReadv(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelWritev(int, const GuestIovec*, int);
-std::int64_t APS5_VABI sceKernelPreadv(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwritev(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _readv_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI _writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI preadv_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "File vector memory check failed at line %d\n", line);
@@ -54,7 +35,7 @@ struct Transfer {
     bool posix;
     bool positioned;
     bool write;
-    std::function<std::int64_t(int, const GuestIovec*, int)> call;
+    std::function<std::int64_t(int, const KernelIovec*, int)> call;
 };
 
 static std::uintptr_t observedTable = 0;
@@ -77,14 +58,14 @@ int main(int argc, char** argv) {
     const std::array<Transfer, 10> transfers{{
         {"readv", true, false, false, readv_nid_postfix},
         {"writev", true, false, true, writev_nid_postfix},
-        {"preadv", true, true, false, [](int fd, const GuestIovec* iov, int count) { return preadv_nid_postfix(fd, iov, count, 1); }},
-        {"pwritev", true, true, true, [](int fd, const GuestIovec* iov, int count) { return pwritev_nid_postfix(fd, iov, count, 1); }},
+        {"preadv", true, true, false, [](int fd, const KernelIovec* iov, int count) { return preadv_nid_postfix(fd, iov, count, 1); }},
+        {"pwritev", true, true, true, [](int fd, const KernelIovec* iov, int count) { return pwritev_nid_postfix(fd, iov, count, 1); }},
         {"_readv", true, false, false, _readv_nid_postfix},
         {"_writev", true, false, true, _writev_nid_postfix},
         {"sceKernelReadv", false, false, false, sceKernelReadv},
         {"sceKernelWritev", false, false, true, sceKernelWritev},
-        {"sceKernelPreadv", false, true, false, [](int fd, const GuestIovec* iov, int count) { return sceKernelPreadv(fd, iov, count, 1); }},
-        {"sceKernelPwritev", false, true, true, [](int fd, const GuestIovec* iov, int count) { return sceKernelPwritev(fd, iov, count, 1); }},
+        {"sceKernelPreadv", false, true, false, [](int fd, const KernelIovec* iov, int count) { return sceKernelPreadv(fd, iov, count, 1); }},
+        {"sceKernelPwritev", false, true, true, [](int fd, const KernelIovec* iov, int count) { return sceKernelPwritev(fd, iov, count, 1); }},
     }};
 #ifdef _WIN32
     SYSTEM_INFO system{};
@@ -98,9 +79,9 @@ int main(int argc, char** argv) {
     Require(memory != MAP_FAILED);
 #endif
     std::array<char, 2> bytes{'A', 'B'};
-    const std::array<GuestIovec, 2> vectors{{{bytes.data(), 1}, {bytes.data() + 1, 1}}};
+    const std::array<KernelIovec, 2> vectors{{{bytes.data(), 1}, {bytes.data() + 1, 1}}};
     std::memcpy(memory, vectors.data(), sizeof(vectors));
-    std::memcpy(memory + page - sizeof(GuestIovec), vectors.data(), sizeof(GuestIovec));
+    std::memcpy(memory + page - sizeof(KernelIovec), vectors.data(), sizeof(KernelIovec));
     Protect(memory, page, true);
     Protect(memory + page, page, false);
     const auto path = std::filesystem::temp_directory_path() /
@@ -113,13 +94,13 @@ int main(int argc, char** argv) {
         { std::ofstream file(path, std::ios::binary); file << "ABCD"; Require(static_cast<bool>(file)); }
         const int fd = sceKernelOpen(guestPath.c_str(), SCE_KERNEL_O_RDWR, 0);
         Require(fd >= 0);
-        const std::array<const GuestIovec*, 6> invalid{{
+        const std::array<const KernelIovec*, 6> invalid{{
             nullptr,
-            reinterpret_cast<const GuestIovec*>(std::uintptr_t{1}),
-            reinterpret_cast<const GuestIovec*>(memory + page),
-            reinterpret_cast<const GuestIovec*>(memory + page - sizeof(GuestIovec)),
-            reinterpret_cast<const GuestIovec*>(memory + page - sizeof(GuestIovec) / 2),
-            reinterpret_cast<const GuestIovec*>(UINTPTR_MAX - sizeof(GuestIovec) + 1),
+            reinterpret_cast<const KernelIovec*>(std::uintptr_t{1}),
+            reinterpret_cast<const KernelIovec*>(memory + page),
+            reinterpret_cast<const KernelIovec*>(memory + page - sizeof(KernelIovec)),
+            reinterpret_cast<const KernelIovec*>(memory + page - sizeof(KernelIovec) / 2),
+            reinterpret_cast<const KernelIovec*>(UINTPTR_MAX - sizeof(KernelIovec) + 1),
         }};
         for (const auto* table : invalid) {
             *__error_nid_postfix() = 0;
@@ -142,7 +123,7 @@ int main(int argc, char** argv) {
         observedTable = reinterpret_cast<std::uintptr_t>(memory);
         observedBytes = 0;
         GuestArena::GuestArenaSetHostReadHook_nid_no_patch(ObserveRead);
-        Require(transfer.call(fd, reinterpret_cast<const GuestIovec*>(memory), 2) == 2);
+        Require(transfer.call(fd, reinterpret_cast<const KernelIovec*>(memory), 2) == 2);
         GuestArena::GuestArenaSetHostReadHook_nid_no_patch(nullptr);
         Require(observedBytes == sizeof(vectors));
         Require(sceKernelLseek(fd, 0, SEEK_CUR) == (transfer.positioned ? 0 : 2));
@@ -156,10 +137,10 @@ int main(int argc, char** argv) {
             Require((bytes == (transfer.positioned ? std::array<char, 2>{'B', 'C'} : std::array<char, 2>{'A', 'B'})));
         }
         Require(sceKernelLseek(fd, 0, SEEK_SET) == 0);
-        Require(transfer.call(fd, reinterpret_cast<const GuestIovec*>(memory + page - sizeof(GuestIovec)), 1) == 1);
+        Require(transfer.call(fd, reinterpret_cast<const KernelIovec*>(memory + page - sizeof(KernelIovec)), 1) == 1);
         Require(sceKernelLseek(fd, 0, SEEK_CUR) == (transfer.positioned ? 0 : 1));
         Require(sceKernelLseek(fd, 0, SEEK_SET) == 0);
-        std::array<GuestIovec, 1024> maximum{};
+        std::array<KernelIovec, 1024> maximum{};
         maximum.back() = {bytes.data(), 1};
         Require(transfer.call(fd, maximum.data(), static_cast<int>(maximum.size())) == 1);
         Require(sceKernelLseek(fd, 0, SEEK_CUR) == (transfer.positioned ? 0 : 1));
diff --git a/core/libs/tests/GuestFilesystem.cpp b/core/libs/tests/GuestFilesystem.cpp
index 1557080c12..b2bf77d497 100644
--- a/core/libs/tests/GuestFilesystem.cpp
+++ b/core/libs/tests/GuestFilesystem.cpp
@@ -1,7 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/RenameDot.hpp"
 #include "prx/libkernel/File/include/File.hpp"
 #include "prx/libkernel/File/include/NativeStat.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
@@ -29,88 +32,7 @@
 #ifdef __linux__
 #include <sys/inotify.h>
 #endif
-extern "C" {
-int APS5_VABI remove_nid_postfix(const char*);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI sceKernelChmod_nid_postfix(const char*, unsigned short);
-int APS5_VABI sceKernelFchmod(int, unsigned short);
-int APS5_VABI fchmod_nid_postfix(int, int);
-int APS5_VABI chmod_nid_postfix(const char*, int);
-int APS5_VABI chflags_nid_postfix(const char*, std::uint64_t);
-int APS5_VABI fchflags_nid_postfix(int, std::uint64_t);
-int APS5_VABI futimes_nid_postfix(int, const KernelTimeval*);
-int APS5_VABI sceKernelFutimes(int, const KernelTimeval*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI sceKernelFsync(int);
-int APS5_VABI fdatasync_nid_postfix(int);
-int APS5_VABI fsync_nid_postfix(int);
-int APS5_VABI sceKernelFdatasync(int);
-int APS5_VABI sceKernelWriteThrottlingStatus(std::uint64_t*);
-int APS5_VABI sceKernelFtruncate(int, long long);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char*, long long);
-int APS5_VABI truncate_nid_postfix(const char*, long long);
-int APS5_VABI sceKernelUtimes_nid_postfix(const char*, const void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI creat_nid_postfix(const char*, int);
-int APS5_VABI _open_nid_postfix(const char*, int, ...);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI flock_nid_postfix(int, int);
-int APS5_VABI stat_nid_postfix(const char*, FileStat*);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI sceKernelOpen(const char*, int, unsigned short);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI getdents_nid_postfix(int, char*, int);
-int APS5_VABI getdirentries_nid_postfix(int, char*, int, int64_t*);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelReadv(int, const void*, int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPreadv(int, const void*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-int APS5_VABI sceKernelCheckReachability(const char*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelUnlink(const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelRmdir(const char*);
-int APS5_VABI sceKernelMkdir(const char*, unsigned short);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelCheckReachability(const char*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI chdir_nid_postfix(const char*);
-void* APS5_VABI opendir_nid_postfix(const char*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fgetc_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-char* APS5_VABI fgets_nid_postfix(char*, int, FileStream*);
-int APS5_VABI fscanf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI fputc_nid_postfix(int, FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-void APS5_VABI clearerr_nid_postfix(FileStream*);
-int APS5_VABI feof_nid_postfix(FileStream*);
-int APS5_VABI ferror_nid_postfix(FileStream*);
-int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-int APS5_VABI ftrylockfile_nid_postfix(FileStream*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI dup2_nid_postfix(int, int);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-int APS5_VABI sceKernelDebugOutText(int, const char*);
-}
+
 #ifdef _WIN32
 static bool g_invalidParameter = false;
 static void RecordInvalidParameter(const wchar_t*, const wchar_t*, const wchar_t*, unsigned, std::uintptr_t) { g_invalidParameter = true; }
@@ -138,6 +60,7 @@ static void Check(bool value, int line) {
 static bool ChflagsThrows(const std::filesystem::path& path, std::uint64_t flags, const char* names) {
     try {
         chflags_nid_postfix(path.string().c_str(), flags);
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), names) != nullptr;
     }
@@ -147,6 +70,7 @@ static bool ChflagsThrows(const std::filesystem::path& path, std::uint64_t flags
 static bool FchflagsThrows(int descriptor, std::uint64_t flags, const char* names) {
     try {
         fchflags_nid_postfix(descriptor, flags);
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), names) != nullptr;
     }
@@ -259,19 +183,50 @@ static void TestParentTraversal() {
     Require(stat_nid_postfix("/parent-test-mount/missing/.", &status) == -1 && *__error_nid_postfix() == 2);
     Require(stat_nid_postfix("/parent-test-mount/existing/.", &status) == 0 && (status.st_mode & 0170000) == 0040000);
     Require(access_nid_postfix("/parent-test-mount/existing/./", 0) == 0);
-#ifndef _WIN32
+    Require(TrimTrailingSeparators_nid_no_patch("/") == "/");
+    Require(TrimTrailingSeparators_nid_no_patch("/mount/dir//") == "/mount/dir");
+    Require(TrimTrailingSeparators_nid_no_patch("dir/") == "dir");
+#ifdef _WIN32
+    Require(TrimTrailingSeparators_nid_no_patch("C:\\") == "C:\\");
+    Require(TrimTrailingSeparators_nid_no_patch("C:/") == "C:/");
+    Require(TrimTrailingSeparators_nid_no_patch("C:\\dir\\") == "C:\\dir");
+    Require(TrimTrailingSeparators_nid_no_patch("C:\\\\") == "C:\\");
+    Require(TrimTrailingSeparators_nid_no_patch("C:\\folder\\\\") == "C:\\folder");
+#endif
+    std::filesystem::create_directory(root / "dot-victim");
+    for (const char* name : {"/parent-test-mount/dot-victim/.", "/parent-test-mount/dot-victim/..", "/parent-test-mount/dot-victim/./", "/parent-test-mount/dot-victim/../"}) {
+        Require(unlink_nid_postfix(name) == -1 && *__error_nid_postfix() == 22);
+        Require(rmdir_nid_postfix(name) == -1 && *__error_nid_postfix() == 22);
+        Require(sceKernelUnlink(name) == static_cast<int>(0x80020016u));
+        Require(sceKernelRmdir(name) == static_cast<int>(0x80020016u));
+    }
+    Require(unlink_nid_postfix("/parent-test-mount/present.txt/.") == -1 && *__error_nid_postfix() == 20);
+    Require(rename_nid_postfix("/parent-test-mount/present.txt/.", "/parent-test-mount/dot-renamed") == -1 && *__error_nid_postfix() == 20);
+    Require(rename_nid_postfix("/parent-test-mount/present.txt/..", "/parent-test-mount/dot-renamed") == -1 && *__error_nid_postfix() == 20);
+    Require(rmdir_nid_postfix("/parent-test-mount/missing/..") == -1 && *__error_nid_postfix() == 2);
+    Require(std::filesystem::is_directory(root / "dot-victim") && std::filesystem::is_regular_file(root / "present.txt"));
+    std::filesystem::remove(root / "dot-victim");
     for (const char* name : {"slash-unlink", "slash-remove", "slash-rename", "slash-open", "slash-kernel"}) std::ofstream(root / name) << "kept";
     Require(unlink_nid_postfix("/parent-test-mount/slash-unlink/") == -1 && *__error_nid_postfix() == 20);
     Require(remove_nid_postfix("/parent-test-mount/slash-remove/") == -1 && *__error_nid_postfix() == 20);
     Require(rename_nid_postfix("/parent-test-mount/slash-rename/", "/parent-test-mount/slash-renamed") == -1 && *__error_nid_postfix() == 20);
     Require(open_nid_postfix("/parent-test-mount/slash-open/", 0, 0) == -1 && *__error_nid_postfix() == 20);
     Require(sceKernelUnlink("/parent-test-mount/slash-kernel/") == static_cast<int>(0x80020014u));
+    Require(rename_nid_postfix("/parent-test-mount/slash-remove", "/parent-test-mount/slash-open/") == -1 && *__error_nid_postfix() == 20);
+    Require(stat_nid_postfix("/parent-test-mount/slash-open/", &status) == -1 && *__error_nid_postfix() == 20);
+    Require(access_nid_postfix("/parent-test-mount/slash-open/", 0) == -1 && *__error_nid_postfix() == 20);
+    Require(chmod_nid_postfix("/parent-test-mount/slash-open/", 0644) == -1 && *__error_nid_postfix() == 20);
+    Require(mkdir_nid_postfix("/parent-test-mount/slash-open/", 0755) == -1 && *__error_nid_postfix() == 20);
+    Require(rmdir_nid_postfix("/parent-test-mount/slash-open/") == -1 && *__error_nid_postfix() == 20);
+    Require(sceKernelOpen("/parent-test-mount/slash-open/", 0x601, 0600) == static_cast<int>(0x80020014u));
+    Require(unlink_nid_postfix((root.generic_string() + "/slash-kernel/").c_str()) == -1 && *__error_nid_postfix() == 20);
     for (const char* name : {"slash-unlink", "slash-remove", "slash-rename", "slash-open", "slash-kernel"}) Require(std::filesystem::is_regular_file(root / name));
     Require(!std::filesystem::exists(root / "slash-renamed"));
     Require(sceKernelStat("/parent-test-mount/Existing/", &status) == 0 && (status.st_mode & 0170000) == 0040000);
+    const int listed = sceKernelOpen("/parent-test-mount/Existing/", 0x20000, 0);
+    Require(listed >= 0 && sceKernelClose(listed) == 0);
     Require(mkdir_nid_postfix("/parent-test-mount/slash-directory/", 0755) == 0 && std::filesystem::is_directory(root / "slash-directory"));
     Require(rmdir_nid_postfix("/parent-test-mount/slash-directory/") == 0 && !std::filesystem::exists(root / "slash-directory"));
-#endif
     RemovePathAlias_nid_no_patch("parent-test-mount");
     std::error_code linkError;
     std::filesystem::create_directory_symlink("Existing", root / "directory-link", linkError);
@@ -456,6 +411,7 @@ static void TestMissingPathListsDirectoryOnce() {
     bool ambiguous = false;
     try {
         sceKernelStat((root / "PLUGIN.prx").generic_string().c_str(), &status);
+
     } catch (const std::runtime_error&) {
         ambiguous = true;
     }
@@ -631,16 +587,20 @@ int main() {
             Require(fread_nid_postfix(unread, 1, sizeof(unread), directoryStream) == 0 && *__error_nid_postfix() == 21);
             Require(ferror_nid_postfix(directoryStream) != 0 && feof_nid_postfix(directoryStream) == 0);
             clearerr_nid_postfix(directoryStream);
+
             Require(ferror_nid_postfix(directoryStream) == 0);
             *__error_nid_postfix() = 0;
             Require(fgetc_nid_postfix(directoryStream) == -1 && *__error_nid_postfix() == 21 && ferror_nid_postfix(directoryStream) != 0);
             clearerr_nid_postfix(directoryStream);
+
             *__error_nid_postfix() = 0;
             Require(fgets_nid_postfix(unread, sizeof(unread), directoryStream) == nullptr && *__error_nid_postfix() == 21 && ferror_nid_postfix(directoryStream) != 0);
             clearerr_nid_postfix(directoryStream);
+
             *__error_nid_postfix() = 0;
             Require(fscanf_nid_postfix(directoryStream, "%d", &scanned) == -1 && *__error_nid_postfix() == 21 && ferror_nid_postfix(directoryStream) != 0);
             clearerr_nid_postfix(directoryStream);
+
             Require(fseek_nid_postfix(directoryStream, 0, 0) == 0 && ftell_nid_postfix(directoryStream) == 0);
             *__error_nid_postfix() = 0;
             Require(fputc_nid_postfix('x', directoryStream) == -1 && *__error_nid_postfix() == 9 && ferror_nid_postfix(directoryStream) != 0);
@@ -684,6 +644,10 @@ int main() {
     Require(fchflags_nid_postfix(flagged, 0) == -1 && *__error_nid_postfix() == 9);
     Require(fchflags_nid_postfix(flagged, ~0ULL) == -1 && *__error_nid_postfix() == 9);
     Require(fchflags_nid_postfix(-1, 0) == -1 && *__error_nid_postfix() == 9);
+    const int flaggedKqueue = kqueue_nid_postfix();
+    Require(flaggedKqueue >= 0);
+    Require(fchflags_nid_postfix(flaggedKqueue, 0) == -1 && *__error_nid_postfix() == 22);
+    Require(close_nid_postfix(flaggedKqueue) == 0);
     const int flaggedRoot = sceKernelOpen(root.string().c_str(), 0x20000, 0);
     Require(flaggedRoot >= 0 && fchflags_nid_postfix(flaggedRoot, 0) == 0 && sceKernelClose(flaggedRoot) == 0);
     int flaggedPipe[2];
@@ -812,6 +776,7 @@ int main() {
             Require(held != INVALID_HANDLE_VALUE);
             const int result = kernel ? sceKernelRename(name(lockedSource).c_str(), name(preservedTarget).c_str()) :
                 rename_nid_postfix(name(lockedSource).c_str(), name(preservedTarget).c_str());
+
             Require(CloseHandle(held) != 0);
             Require(result != 0 && std::filesystem::is_regular_file(marker));
             if (!std::filesystem::is_directory(preservedTarget))
@@ -1062,6 +1027,16 @@ int main() {
         Require(checkRelativeLink(fileLink, 11));
         Require(checkRelativeLink(directoryLink, 16));
         Require(checkRelativeLink(danglingLink, 11));
+        const auto belowStatLoop = statLoop.string() + "\\inside";
+        Require(sceKernelUnlink(belowStatLoop.c_str()) == static_cast<int>(0x8002003eu));
+        Require(unlink_nid_postfix(belowStatLoop.c_str()) == -1 && *__error_nid_postfix() == 62);
+        Require(sceKernelMkdir(belowStatLoop.c_str(), 0700) == static_cast<int>(0x8002003eu));
+        Require(mkdir_nid_postfix(belowStatLoop.c_str(), 0700) == -1 && *__error_nid_postfix() == 62);
+        Require(sceKernelRmdir(belowStatLoop.c_str()) == static_cast<int>(0x8002003eu));
+        Require(rmdir_nid_postfix(belowStatLoop.c_str()) == -1 && *__error_nid_postfix() == 62);
+        Require(sceKernelRmdir(statLoop.string().c_str()) == static_cast<int>(0x80020014u));
+        Require(sceKernelTruncate_nid_postfix(statLoop.string().c_str(), 0) == static_cast<int>(0x8002003eu));
+        Require(truncate_nid_postfix(statLoop.string().c_str(), 0) == -1 && *__error_nid_postfix() == 62);
         FileStat followed{};
         Require(lstat_nid_postfix(fileLink.string().c_str(), &linkStatus) == 0);
         Require(stat_nid_postfix(fileLink.string().c_str(), &followed) == 0 && (followed.st_mode & 0170000) == 0100000);
@@ -1193,6 +1168,14 @@ int main() {
         Require(pread_nid_postfix(locked, nullptr, 1, 0) == -1 && *__error_nid_postfix() == 14);
         Require(close_nid_postfix(transferPipe[0]) == 0 && close_nid_postfix(transferPipe[1]) == 0);
     }
+    Require(lseek_nid_postfix(locked, 4, 0) == 4);
+    Require(lseek_nid_postfix(locked, INT64_MAX, 1) == -1 && *__error_nid_postfix() == 84);
+    Require(lseek_nid_postfix(locked, 0, 1) == 4);
+    Require(lseek_nid_postfix(locked, -1, 0) == -1 && *__error_nid_postfix() == 22);
+    const std::int64_t lockedSize = lseek_nid_postfix(locked, 0, 2);
+    Require(lockedSize >= 0);
+    Require(lseek_nid_postfix(locked, INT64_MAX - lockedSize + 1, 2) == -1 && *__error_nid_postfix() == 84);
+    Require(lseek_nid_postfix(locked, 0, 1) == lockedSize);
     Require(flock_nid_postfix(-1, 2 | 4) == -1 && *__error_nid_postfix() == 9);
     Require(flock_nid_postfix(0x7fffffff, 1) == -1 && *__error_nid_postfix() == 9);
     int flockPipe[2] = {-1, -1};
@@ -1248,7 +1231,7 @@ int main() {
     const int directoryDescriptor = open_nid_postfix(rootName.c_str(), 0, 0);
     Require(directoryDescriptor >= 0);
     char directoryBytes[8]{};
-    struct { void* base; std::size_t length; } directoryVector[2] = {{directoryBytes, 3}, {directoryBytes + 3, 5}};
+    KernelIovec directoryVector[2] = {{directoryBytes, 3}, {directoryBytes + 3, 5}};
     Require(read_nid_postfix(directoryDescriptor, directoryBytes, sizeof(directoryBytes)) == -1 && *__error_nid_postfix() == 21);
     Require(sceKernelRead(directoryDescriptor, directoryBytes, sizeof(directoryBytes)) == static_cast<int>(0x80020015u));
     Require(sceKernelReadv(directoryDescriptor, directoryVector, 2) == static_cast<int>(0x80020015u));
@@ -1474,14 +1457,18 @@ int main() {
         Require(std::memcmp(first, second, sizeof(first)) != 0);
         Require(feof_nid_postfix(stream) == 0 && ferror_nid_postfix(stream) == 0);
         flockfile_nid_postfix(stream);
+
         Require(fread_nid_postfix(first, 1, 4, stream) == 4);
         funlockfile_nid_postfix(stream);
+
         Require(ftrylockfile_nid_postfix(stream) == 0);
         funlockfile_nid_postfix(stream);
+
         Require(fflush_nid_postfix(stream) == 0);
         bool unsupported = false;
         try {
             fgetc_nid_postfix(stream);
+
         } catch (const std::runtime_error&) {
             unsupported = true;
         }
@@ -1491,6 +1478,7 @@ int main() {
             bool rejected = false;
             try {
                 fopen_nid_postfix(device, mode);
+
             } catch (const std::runtime_error&) {
                 rejected = true;
             }
diff --git a/core/libs/tests/GuestFiopen.cpp b/core/libs/tests/GuestFiopen.cpp
index 276459ec07..b5d8e930bd 100644
--- a/core/libs/tests/GuestFiopen.cpp
+++ b/core/libs/tests/GuestFiopen.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -7,14 +8,6 @@
 #include <filesystem>
 #include <string>
 
-extern "C" {
-FileStream* APS5_VABI _ZSt7_FiopenPKcNSt5_IosbIiE9_OpenmodeEi_nid_postfix(const char*, int, int);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fopen_s_nid_postfix(FileStream**, const char*, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-std::int64_t APS5_VABI ftello_nid_postfix(FileStream*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Fiopen check failed at line %d\n", line);
@@ -38,6 +31,7 @@ static std::string Contents(const char* name) {
     std::string text;
     for (int c; (c = std::fgetc(stream->GetHandle())) != EOF;) text += static_cast<char>(c);
     fclose_nid_postfix(stream);
+
     return text;
 }
 
@@ -45,6 +39,7 @@ static void Write(FileStream* stream, const char* text) {
     Require(stream != nullptr);
     Require(std::fputs(text, stream->GetHandle()) >= 0);
     fclose_nid_postfix(stream);
+
 }
 
 static bool Exists(const char* name) {
@@ -87,10 +82,12 @@ int main() {
     auto* stream = Open(file, In);
     Require(stream != nullptr && std::fgetc(stream->GetHandle()) == 'a');
     fclose_nid_postfix(stream);
+
     stream = Open(file, In);
     Require(stream != nullptr);
     std::fputc('x', stream->GetHandle());
     fclose_nid_postfix(stream);
+
     Require(Contents(file) == "abc");
 
     Write(Open(file, App), "d");
@@ -101,6 +98,7 @@ int main() {
     stream = Open(file, In | Ate);
     Require(stream != nullptr && ftello_nid_postfix(stream) == 5);
     fclose_nid_postfix(stream);
+
     stream = Open(file, In | Binary);
     Require(stream != nullptr && ftello_nid_postfix(stream) == 0);
     fclose_nid_postfix(stream);
@@ -112,6 +110,7 @@ int main() {
     stream = Open(file, In | Noreplace);
     Require(stream != nullptr);
     fclose_nid_postfix(stream);
+
     stream = Open(file, In | Binary | Noreplace);
     Require(stream != nullptr);
     fclose_nid_postfix(stream);
@@ -128,6 +127,7 @@ int main() {
     stream = Open(file, In | Out);
     Require(stream != nullptr && std::fgetc(stream->GetHandle()) == 'X');
     fclose_nid_postfix(stream);
+
     Require(Contents(file) == "Xbcdef");
 
     Write(Open(file, In | Out | App), "g");
@@ -152,7 +152,7 @@ int main() {
     Require(stream != nullptr && std::fgetc(stream->GetHandle()) == 'k');
     fclose_nid_postfix(stream);
 
-#ifndef _WIN32
+#ifdef __linux__
     auto* full = std::fopen("/dev/full", "wb");
     Require(full != nullptr);
     auto* fullStream = new FileStream(full, true);
diff --git a/core/libs/tests/GuestFlexibleMemoryBudget.cpp b/core/libs/tests/GuestFlexibleMemoryBudget.cpp
index cba381e734..2b3b74f051 100644
--- a/core/libs/tests/GuestFlexibleMemoryBudget.cpp
+++ b/core/libs/tests/GuestFlexibleMemoryBudget.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/DirectMemory/DirectMemory.hpp"
@@ -12,24 +13,9 @@
 #include <string_view>
 
 extern "C" {
-int APS5_VABI sceKernelConfiguredFlexibleMemorySize(std::size_t*);
-int APS5_VABI sceKernelAvailableFlexibleMemorySize(std::size_t*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelReleaseFlexibleMemory(void*, std::size_t);
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
+
 std::uint64_t GuestImageSegmentBytes_nid_no_patch();
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-char* APS5_VABI dlerror_nid_postfix();
-int APS5_VABI dlclose_nid_postfix(void*);
-std::size_t APS5_VABI sceKernelGetDirectMemorySize();
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMapDirectMemory2(void**, std::size_t, int, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMapNamedDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t, const char*);
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry*, int, int*, int);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
+
 }
 
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
diff --git a/core/libs/tests/GuestFlexibleMemoryModule.cpp b/core/libs/tests/GuestFlexibleMemoryModule.cpp
index 1bf220a810..10f33287fc 100644
--- a/core/libs/tests/GuestFlexibleMemoryModule.cpp
+++ b/core/libs/tests/GuestFlexibleMemoryModule.cpp
@@ -1,3 +1,37 @@
+#ifdef __APPLE__
+#include "prx/libc/include/specifics/linux/ElfTypes.hpp"
+#include <dlfcn.h>
+#include <cstring>
+#endif
+
 extern "C" {
 unsigned char guestFlexibleMemoryModuleData[512u * 1024u * 1024u] = {};
 }
+
+#ifdef __APPLE__
+namespace {
+
+[[gnu::section("__APS5DATA,__meta"), gnu::used]] alignas(8) std::byte metadata[0x60 + sizeof(Elf64_Phdr)]{};
+
+[[maybe_unused]] const bool described = [] {
+    Dl_info image{};
+    if (dladdr(guestFlexibleMemoryModuleData, &image) == 0) return false;
+    const std::uint64_t loadBias = reinterpret_cast<std::uintptr_t>(image.dli_fbase);
+    Elf64_Phdr header{};
+    header.p_type = PT_LOAD;
+    header.p_flags = PF_R | PF_W;
+    header.p_offset = reinterpret_cast<std::uintptr_t>(guestFlexibleMemoryModuleData) - loadBias;
+    header.p_vaddr = header.p_offset;
+    header.p_paddr = header.p_offset;
+    header.p_memsz = sizeof(guestFlexibleMemoryModuleData);
+    const std::uint64_t version = 2;
+    const std::uint64_t count = 1;
+    std::memcpy(metadata + 0x08, &loadBias, sizeof(loadBias));
+    std::memcpy(metadata + 0x58, &count, sizeof(count));
+    std::memcpy(metadata + 0x60, &header, sizeof(header));
+    std::memcpy(metadata, &version, sizeof(version));
+    return true;
+}();
+
+}
+#endif
diff --git a/core/libs/tests/GuestFloatBuiltins.cpp b/core/libs/tests/GuestFloatBuiltins.cpp
index a64f17eb85..e8051b96c0 100644
--- a/core/libs/tests/GuestFloatBuiltins.cpp
+++ b/core/libs/tests/GuestFloatBuiltins.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cmath>
@@ -6,75 +7,6 @@
 #include <cstring>
 #include <xmmintrin.h>
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
-extern "C" {
-double APS5_VABI __adddf3_nid_postfix(double, double);
-float APS5_VABI __addsf3_nid_postfix(float, float);
-double APS5_VABI __subdf3_nid_postfix(double, double);
-float APS5_VABI __subsf3_nid_postfix(float, float);
-double APS5_VABI __muldf3_nid_postfix(double, double);
-float APS5_VABI __mulsf3_nid_postfix(float, float);
-double APS5_VABI __divdf3_nid_postfix(double, double);
-float APS5_VABI __divsf3_nid_postfix(float, float);
-double APS5_VABI __negdf2_nid_postfix(double);
-float APS5_VABI __negsf2_nid_postfix(float);
-int APS5_VABI __eqdf2_nid_postfix(double, double);
-int APS5_VABI __nedf2_nid_postfix(double, double);
-int APS5_VABI __ltdf2_nid_postfix(double, double);
-int APS5_VABI __ledf2_nid_postfix(double, double);
-int APS5_VABI __gtdf2_nid_postfix(double, double);
-int APS5_VABI __gedf2_nid_postfix(double, double);
-int APS5_VABI __unorddf2_nid_postfix(double, double);
-int APS5_VABI __eqsf2_nid_postfix(float, float);
-int APS5_VABI __ltsf2_nid_postfix(float, float);
-int APS5_VABI __gesf2_nid_postfix(float, float);
-int APS5_VABI __unordsf2_nid_postfix(float, float);
-double APS5_VABI __extendsfdf2_nid_postfix(float);
-float APS5_VABI __truncdfsf2_nid_postfix(double);
-std::int32_t APS5_VABI __fixsfsi_nid_postfix(float);
-std::int64_t APS5_VABI __fixsfdi_nid_postfix(float);
-Int128 APS5_VABI __fixsfti_nid_postfix(float);
-std::int32_t APS5_VABI __fixdfsi_nid_postfix(double);
-std::int64_t APS5_VABI __fixdfdi_nid_postfix(double);
-Int128 APS5_VABI __fixdfti_nid_postfix(double);
-std::uint32_t APS5_VABI __fixunssfsi_nid_postfix(float);
-std::uint64_t APS5_VABI __fixunssfdi_nid_postfix(float);
-Uint128 APS5_VABI __fixunssfti_nid_postfix(float);
-std::uint32_t APS5_VABI __fixunsdfsi_nid_postfix(double);
-std::uint64_t APS5_VABI __fixunsdfdi_nid_postfix(double);
-Uint128 APS5_VABI __fixunsdfti_nid_postfix(double);
-std::int64_t APS5_VABI __fixxfdi_nid_postfix(long double);
-Int128 APS5_VABI __fixxfti_nid_postfix(long double);
-std::uint32_t APS5_VABI __fixunsxfsi_nid_postfix(long double);
-std::uint64_t APS5_VABI __fixunsxfdi_nid_postfix(long double);
-Uint128 APS5_VABI __fixunsxfti_nid_postfix(long double);
-double APS5_VABI __floatsidf_nid_postfix(std::int32_t);
-double APS5_VABI __floatunsidf_nid_postfix(std::uint32_t);
-float APS5_VABI __floatsisf_nid_postfix(std::int32_t);
-float APS5_VABI __floatunsisf_nid_postfix(std::uint32_t);
-double APS5_VABI __floatdidf_nid_postfix(std::int64_t);
-float APS5_VABI __floatdisf_nid_postfix(std::int64_t);
-long double APS5_VABI __floatdixf_nid_postfix(std::int64_t);
-double APS5_VABI __floatundidf_nid_postfix(std::uint64_t);
-float APS5_VABI __floatundisf_nid_postfix(std::uint64_t);
-long double APS5_VABI __floatundixf_nid_postfix(std::uint64_t);
-double APS5_VABI __floattidf_nid_postfix(Int128);
-float APS5_VABI __floattisf_nid_postfix(Int128);
-long double APS5_VABI __floattixf_nid_postfix(Int128);
-double APS5_VABI __floatuntidf_nid_postfix(Uint128);
-float APS5_VABI __floatuntisf_nid_postfix(Uint128);
-long double APS5_VABI __floatuntixf_nid_postfix(Uint128);
-__complex__ float APS5_VABI __mulsc3_nid_postfix(float, float, float, float);
-__complex__ double APS5_VABI __muldc3_nid_postfix(double, double, double, double);
-__complex__ long double APS5_VABI __mulxc3_nid_postfix(long double, long double, long double, long double);
-__complex__ float APS5_VABI __divsc3_nid_postfix(float, float, float, float);
-__complex__ double APS5_VABI __divdc3_nid_postfix(double, double, double, double);
-__complex__ long double APS5_VABI __divxc3_nid_postfix(long double, long double, long double, long double);
-long double APS5_VABI __powixf2_nid_postfix(long double, int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::uint64_t Bits(double value) { return std::bit_cast<std::uint64_t>(value); }
diff --git a/core/libs/tests/GuestFloatingPoint.cpp b/core/libs/tests/GuestFloatingPoint.cpp
index 3ea9884bb0..eb01ae2bc7 100644
--- a/core/libs/tests/GuestFloatingPoint.cpp
+++ b/core/libs/tests/GuestFloatingPoint.cpp
@@ -1,29 +1,22 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <barrier>
 #include <cstdint>
+#include <cstddef>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <thread>
 #include <xmmintrin.h>
-
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-void APS5_VABI _Feraise_nid_postfix(int);
-int APS5_VABI fegetround_nid_postfix();
-int APS5_VABI fesetround_nid_postfix(int);
-int APS5_VABI fetestexcept_nid_postfix(int);
-int APS5_VABI feclearexcept_nid_postfix(int);
-int APS5_VABI fegetexceptflag_nid_postfix(std::uint16_t*, int);
-int APS5_VABI fesetexceptflag_nid_postfix(const std::uint16_t*, int);
-int APS5_VABI feenableexcept_nid_postfix(int);
-int APS5_VABI fedisableexcept_nid_postfix(int);
-int APS5_VABI __feenableexcept_nid_postfix(int);
-int APS5_VABI __fedisableexcept_nid_postfix(int);
-int APS5_VABI fegettrapenable_nid_postfix();
-int APS5_VABI fesettrapenable_nid_postfix(int);
-}
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
 
 namespace {
 
@@ -60,6 +53,28 @@ Environment SeedFlags(unsigned x87, unsigned sse) {
     return ReadEnvironment();
 }
 
+void CheckEnabledExceptions() {
+    const auto seeded = SeedFlags(0, 0);
+    for (unsigned x87 = 0; x87 <= 0x3f; ++x87) {
+        for (unsigned sse = 0; sse <= 0x3f; ++sse) {
+            auto state = seeded;
+            state.x87[0] = (state.x87[0] & ~0xc3fu) | 0x800 | x87;
+            state.x87[1] = (state.x87[1] & ~0x3fu) | (x87 & 0x15u);
+            state.sse = (state.sse & ~0x7fbfu) | 0x2000 | (sse << 7) | (sse & 0x2au);
+            WriteEnvironment(state);
+            *__error_nid_postfix() = 123;
+            const int enabled = fegetexcept_nid_postfix();
+            const int error = *__error_nid_postfix();
+            const auto after = ReadEnvironment();
+            WriteEnvironment(seeded);
+            Require(enabled == static_cast<int>(0x3f ^ x87), "enabled exceptions use the x87 masks independently of SSE");
+            Require(after.x87[0] == state.x87[0] && after.x87[1] == state.x87[1] && after.sse == state.sse,
+                    "enabled exception query preserves control modes and flags");
+            Require(error == 123, "enabled exception query preserves errno");
+        }
+    }
+}
+
 void CheckRounding() {
     const auto seeded = SeedFlags(0x02, 0x10);
     constexpr int modes[] = {0, 0x400, 0x800, 0xc00};
@@ -103,6 +118,7 @@ void CheckFeraise() {
         const auto seeded = SeedFlags(0, 0);
         *__error_nid_postfix() = 0;
         _Feraise_nid_postfix(static_cast<int>(requested));
+
         const unsigned raised = (requested & 0x18) != 0 ? requested | 0x20 : requested;
         const auto state = ReadEnvironment();
         Require((state.x87[1] & 0x3f) == raised && (state.sse & 0x3f) == raised, "_Feraise raises the flags on both units");
@@ -142,6 +158,7 @@ void CheckFlags() {
     traps.x87[0] &= ~0x08u;
     traps.sse &= ~(0x08u << 7);
     WriteEnvironment(traps);
+    traps = ReadEnvironment();
     const std::uint16_t none = 0;
     Require(fesetexceptflag_nid_postfix(&none, 0x01) == 0, "restore with an unmasked exception");
     Require(feclearexcept_nid_postfix(0x02) == 0, "clear with an unmasked exception");
@@ -187,35 +204,156 @@ unsigned SseMasks() {
     return (ReadEnvironment().sse >> 7) & 0x3fu;
 }
 
+bool HostKeepsSseTraps() {
+    const unsigned saved = _mm_getcsr();
+    _mm_setcsr(saved & ~(0x01u << 7));
+    const bool kept = (_mm_getcsr() & (0x01u << 7)) == 0;
+    _mm_setcsr(saved);
+    return kept;
+}
+
 void CheckTraps() {
     const auto seeded = SeedFlags(0, 0);
+    const bool sseKept = HostKeepsSseTraps();
+    const auto sse = [&](unsigned masks) { return sseKept ? masks : 0x3fu; };
+    const auto both = [&](unsigned traps) { return static_cast<int>(0xffffffc0u | (sseKept ? traps : 0u)); };
     Require(feenableexcept_nid_postfix(0x49) == static_cast<int>(0xffffffc0u), "enable reports no previous trap as the console does");
     Require(X87Masks() == 0x36 && fegettrapenable_nid_postfix() == 0x09, "enable unmasks the x87 exceptions");
-    Require(SseMasks() == 0x36, "enable unmasks the SSE exceptions");
-    Require(fedisableexcept_nid_postfix(0x41) == static_cast<int>(0xffffffc9u), "disable returns the traps enabled on both units");
+    Require(SseMasks() == sse(0x36), "enable unmasks the SSE exceptions");
+    Require(fedisableexcept_nid_postfix(0x41) == both(0x09), "disable returns the traps enabled on both units");
     Require(X87Masks() == 0x37 && fegettrapenable_nid_postfix() == 0x08, "disable masks the x87 exception");
-    Require(SseMasks() == 0x37, "disable masks the SSE exception");
-    Require(__feenableexcept_nid_postfix(0x02) == static_cast<int>(0xffffffc8u) && X87Masks() == 0x35, "the internal enable differs");
-    Require(__fedisableexcept_nid_postfix(0x3f) == static_cast<int>(0xffffffcau) && X87Masks() == 0x3f && fegettrapenable_nid_postfix() == 0, "the internal disable differs");
+    Require(SseMasks() == sse(0x37), "disable masks the SSE exception");
+    Require(__feenableexcept_nid_postfix(0x02) == both(0x08) && X87Masks() == 0x35, "the internal enable differs");
+    Require(__fedisableexcept_nid_postfix(0x3f) == both(0x0a) && X87Masks() == 0x3f && fegettrapenable_nid_postfix() == 0, "the internal disable differs");
     Require(fesettrapenable_nid_postfix(0x40) == 1 && X87Masks() == 0x3f, "an out-of-range trap set was accepted");
-    Require(fesettrapenable_nid_postfix(0x10004) == 0 && fegettrapenable_nid_postfix() == 0x04 && SseMasks() == 0x3b, "a trap set did not use the low 16 bits");
-    Require(fesettrapenable_nid_postfix(0x01) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == 0x3a, "a trap set masked enabled traps");
-    Require(fesettrapenable_nid_postfix(0) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == 0x3a, "an empty trap set masked enabled traps");
+    Require(fesettrapenable_nid_postfix(0x10004) == 0 && fegettrapenable_nid_postfix() == 0x04 && SseMasks() == sse(0x3b), "a trap set did not use the low 16 bits");
+    Require(fesettrapenable_nid_postfix(0x01) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == sse(0x3a), "a trap set masked enabled traps");
+    Require(fesettrapenable_nid_postfix(0) == 0 && fegettrapenable_nid_postfix() == 0x05 && SseMasks() == sse(0x3a), "an empty trap set masked enabled traps");
     auto mixed = ReadEnvironment();
     mixed.x87[0] = (mixed.x87[0] & ~0x3fu) | 0x36;
     mixed.sse = (mixed.sse & ~(0x3fu << 7)) | (0x3au << 7);
     WriteEnvironment(mixed);
-    Require(feenableexcept_nid_postfix(0) == static_cast<int>(0xffffffc1u), "enable reports only the traps enabled on both units");
+    Require(feenableexcept_nid_postfix(0) == both(0x01), "enable reports only the traps enabled on both units");
     Require(fegettrapenable_nid_postfix() == 0x09, "the trap query reads only the x87 control word");
     WriteEnvironment(seeded);
 }
 
-int main() {
+using HoldExcept = int (APS5_VABI*)(Environment*);
+
+void CheckHold(HoldExcept hold, Environment* saved) {
+    const auto before = ReadEnvironment();
+    *__error_nid_postfix() = 123;
+    Require(hold(saved) == 0, "feholdexcept succeeds");
+    const auto after = ReadEnvironment();
+    Require(std::memcmp(saved, &before, sizeof(before)) == 0, "feholdexcept saves the full original environment");
+    Require((after.x87[0] & 0x3f) == 0x3f && (after.sse & 0x1f80) == 0x1f80, "feholdexcept masks both units");
+    Require((after.x87[1] & 0x80ff) == 0 && (after.sse & 0x3f) == 0, "feholdexcept clears pending exceptions");
+    Require((after.x87[1] & ~0x80ffu) == (before.x87[1] & ~0x80ffu), "feholdexcept preserves other x87 status bits");
+    Require((after.x87[0] & ~0x3fu) == (before.x87[0] & ~0x3fu), "feholdexcept preserves x87 control settings");
+    Require((after.sse & ~0x1fbfu) == (before.sse & ~0x1fbfu), "feholdexcept preserves SSE control settings");
+    Require(after.x87[2] == before.x87[2] && std::memcmp(after.x87.data() + 3, before.x87.data() + 3, 16) == 0, "feholdexcept preserves x87 tags and instruction/data state");
+    Require(*__error_nid_postfix() == 123, "feholdexcept preserves errno");
+}
+
+void CheckHoldExcept(HoldExcept hold) {
+    Require(hold != nullptr, "feholdexcept export is missing");
+    static_assert(sizeof(Environment) == 32 && alignof(Environment) == 4 && offsetof(Environment, sse) == 28);
+    const auto original = ReadEnvironment();
+    struct {
+        std::array<unsigned char, 8> before;
+        Environment value;
+        std::array<unsigned char, 8> after;
+    } output;
+    for (unsigned rounding = 0; rounding < 4; ++rounding) {
+        for (unsigned modes = 0; modes < 4; ++modes) {
+            for (unsigned mask = 0; mask < 64; ++mask) {
+                auto state = original;
+                const unsigned sseMask = (mask * 13 + 7) & 0x3f;
+                state.x87[0] = (state.x87[0] & ~0xc3fu) | (rounding << 10) | mask;
+                state.x87[1] = (state.x87[1] & ~0x80ffu) | (mask & 0x25);
+                state.sse = (state.sse & ~0xffffu) | (sseMask << 7) | (sseMask & 0x1a) | (((rounding + 1) & 3) << 13) | ((modes & 1) << 6) | ((modes & 2) << 14);
+                WriteEnvironment(state);
+                std::memset(&output, 0xa5, sizeof(output));
+                CheckHold(hold, &output.value);
+                for (const auto byte : output.before) Require(byte == 0xa5, "feholdexcept underwrites output");
+                for (const auto byte : output.after) Require(byte == 0xa5, "feholdexcept overwrites output");
+            }
+        }
+    }
+    WriteEnvironment(original);
+    bool threw = false;
+    try { hold(nullptr); } catch (const std::invalid_argument&) { threw = true; }
+    Require(threw, "feholdexcept rejects null storage");
+    const auto afterNull = ReadEnvironment();
+    Require(std::memcmp(&original, &afterNull, sizeof(original)) == 0, "null feholdexcept preserves the environment");
+#ifdef _WIN32
+    SYSTEM_INFO info{};
+    GetSystemInfo(&info);
+    const std::size_t page = info.dwPageSize;
+    auto* memory = static_cast<unsigned char*>(VirtualAlloc(nullptr, page * 2, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+    Require(memory != nullptr, "allocate feholdexcept guard pages");
+    DWORD oldProtection;
+    Require(VirtualProtect(memory + page, page, PAGE_NOACCESS, &oldProtection) != 0, "protect feholdexcept trailing page");
+#else
+    const auto page = static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+    auto* memory = static_cast<unsigned char*>(mmap(nullptr, page * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    Require(memory != MAP_FAILED, "allocate feholdexcept guard pages");
+    Require(mprotect(memory + page, page, PROT_NONE) == 0, "protect feholdexcept trailing page");
+#endif
+    CheckHold(hold, reinterpret_cast<Environment*>(memory + page - sizeof(Environment)));
+#ifdef _WIN32
+    Require(VirtualFree(memory, 0, MEM_RELEASE) != 0, "release feholdexcept guard pages");
+#else
+    Require(munmap(memory, page * 2) == 0, "release feholdexcept guard pages");
+#endif
+    WriteEnvironment(original);
+    std::barrier ready(2);
+    const auto worker = [&](unsigned mode) {
+        const auto saved = ReadEnvironment();
+        auto state = saved;
+        state.x87[0] = (state.x87[0] & ~0xc00u) | (mode << 10) | 0x3f;
+        state.x87[1] &= ~0x80ffu;
+        state.sse |= 0x1f80;
+        state.sse &= ~0x3fu;
+        WriteEnvironment(state);
+        ready.arrive_and_wait();
+        Environment output;
+        CheckHold(hold, &output);
+        ready.arrive_and_wait();
+        Require(fegetround_nid_postfix() == static_cast<int>(mode << 10), "feholdexcept keeps thread-local rounding");
+        WriteEnvironment(saved);
+    };
+    std::thread first(worker, 1);
+    std::thread second(worker, 2);
+    first.join();
+    second.join();
+    const auto afterThreads = ReadEnvironment();
+    Require(std::memcmp(&original, &afterThreads, sizeof(original)) == 0, "feholdexcept workers preserve the main environment");
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 2, "expected libc path");
+#ifdef _WIN32
+    const auto library = LoadLibraryA(argv[1]);
+    Require(library != nullptr, "load libc for feholdexcept");
+    const auto hold = reinterpret_cast<HoldExcept>(GetProcAddress(library, "feholdexcept_nid_postfix"));
+#else
+    const auto library = dlopen(argv[1], RTLD_NOW);
+    Require(library != nullptr, "load libc for feholdexcept");
+    const auto hold = reinterpret_cast<HoldExcept>(dlsym(library, "feholdexcept_nid_postfix"));
+#endif
     const auto original = ReadEnvironment();
     CheckRounding();
+    CheckEnabledExceptions();
     CheckFlags();
     CheckTraps();
     CheckThreads();
+    CheckHoldExcept(hold);
     WriteEnvironment(original);
+#ifdef _WIN32
+    FreeLibrary(library);
+#else
+    dlclose(library);
+#endif
     std::puts("floating-point environment checks passed");
 }
diff --git a/core/libs/tests/GuestFminf.cpp b/core/libs/tests/GuestFminf.cpp
index fcf48171a6..a414e26444 100644
--- a/core/libs/tests/GuestFminf.cpp
+++ b/core/libs/tests/GuestFminf.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cfenv>
 #include <cmath>
@@ -5,15 +6,6 @@
 #include <cstdlib>
 #include <limits>
 
-extern "C" {
-double APS5_VABI fmin_nid_postfix(double, double);
-float APS5_VABI fminf_nid_postfix(float, float);
-long double APS5_VABI fminl_nid_postfix(long double, long double);
-double APS5_VABI fmax_nid_postfix(double, double);
-float APS5_VABI fmaxf_nid_postfix(float, float);
-long double APS5_VABI fmaxl_nid_postfix(long double, long double);
-}
-
 static void Check(bool condition, const char* name, int line) {
     if (!condition) {
         std::fprintf(stderr, "%s check failed at line %d\n", name, line);
diff --git a/core/libs/tests/GuestFnmatch.cpp b/core/libs/tests/GuestFnmatch.cpp
index 32b4e5b16e..8ed07dc566 100644
--- a/core/libs/tests/GuestFnmatch.cpp
+++ b/core/libs/tests/GuestFnmatch.cpp
@@ -1,15 +1,86 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <stdexcept>
-extern "C" int APS5_VABI fnmatch_nid_postfix(const char*, const char*, int);
+#include <clocale>
+#include <cctype>
+#include <string>
+
 struct Case {
     const char* pattern;
     const char* string;
     int flags;
     int result;
 };
+static void Require(bool value) {
+    if (!value) {
+        std::fputs("Guest byte case check failed\n", stderr);
+        std::abort();
+    }
+}
+
+static int FoldCByte(int byte) {
+    return byte >= 'A' && byte <= 'Z' ? byte + 'a' - 'A' : byte;
+}
+
+static void CheckCaseInsensitiveBytePairs() {
+    for (int a = 0; a < 256; ++a) {
+        for (int b = 0; b < 256; ++b) {
+            char left[] = {static_cast<char>(a), 0};
+            char right[] = {static_cast<char>(b), 0};
+            const int expected = FoldCByte(a) - FoldCByte(b);
+            const int sign = (expected > 0) - (expected < 0);
+            Require(strcasecmp_nid_postfix(left, right) == sign);
+            Require(strncasecmp_nid_postfix(left, right, 0) == 0);
+            Require(strncasecmp_nid_postfix(left, right, 1) == sign);
+            Require(strncasecmp_nid_postfix(left, right, 2) == sign);
+            const char* match = b == 0 || expected == 0 ? left : nullptr;
+            Require(strcasestr_nid_postfix(left, right) == match);
+            const char pattern[] = {'\\', static_cast<char>(a), 0};
+            Require(fnmatch_nid_postfix(a == 0 ? pattern + 1 : pattern, right, 0x10) == (expected == 0 ? 0 : 1));
+            Require(static_cast<unsigned char>(left[0]) == a && left[1] == 0);
+            Require(static_cast<unsigned char>(right[0]) == b && right[1] == 0);
+        }
+    }
+    const char left = 'A', right = 'a';
+    Require(strncasecmp_nid_postfix(&left, &right, 0) == 0);
+    Require(strncasecmp_nid_postfix(&left, &right, 1) == 0);
+    const char repeated[] = "AaAaBAaAaC";
+    Require(strcasestr_nid_postfix(repeated, "aaac") == repeated + 6);
+    Require(strcasestr_nid_postfix(repeated, "aAa") == repeated);
+    Require(strcasestr_nid_postfix(repeated, "aaad") == nullptr);
+    Require(strcasecmp_nid_postfix("AbC", "aBcD") == -1);
+    Require(strncasecmp_nid_postfix("AbC", "aBcD", 3) == 0);
+    Require(strncasecmp_nid_postfix("AbC", "aBcD", 4) == -1);
+}
+
+static void CheckCaseInsensitiveHostLocale() {
+    const char* original = std::setlocale(LC_CTYPE, nullptr);
+    Require(original != nullptr);
+    struct RestoreLocale {
+        std::string name;
+        ~RestoreLocale() { Require(std::setlocale(LC_CTYPE, name.c_str()) != nullptr); }
+    } restore{original};
+    Require(std::setlocale(LC_CTYPE, "C") != nullptr);
+    CheckCaseInsensitiveBytePairs();
+    bool exercised = false;
+    for (const char* name : {".1252", "English_United States.1252", "en_US.ISO8859-1", "de_DE.ISO8859-1",
+                             "en_US.iso88591", "tr_TR.ISO8859-9", "Turkish_Turkey.1254", "tr_TR.UTF-8"}) {
+        if (!std::setlocale(LC_CTYPE, name)) continue;
+        bool changed = false;
+        for (int byte = 0; byte < 256; ++byte) changed |= std::tolower(byte) != FoldCByte(byte);
+        if (!changed) continue;
+        std::fprintf(stderr, "Checking guest byte comparisons with host LC_CTYPE=%s\n", name);
+        CheckCaseInsensitiveBytePairs();
+        exercised = true;
+    }
+    if (!exercised) std::fputs("No installed locale changes host byte case folding; host-locale regression skipped\n", stderr);
+}
+
 int main() {
+    CheckCaseInsensitiveHostLocale();
     static const Case cases[] = {
         {"*.txt", "notes.txt", 0x00, 0},
         {"*.txt", "notes.TXT", 0x00, 1},
@@ -71,6 +142,7 @@ int main() {
     bool threw = false;
     try {
         fnmatch_nid_postfix(nullptr, "x", 0);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestFont.cpp b/core/libs/tests/GuestFont.cpp
index 1ca28f3228..6f46ad3ee6 100644
--- a/core/libs/tests/GuestFont.cpp
+++ b/core/libs/tests/GuestFont.cpp
@@ -1,12 +1,17 @@
+#include "prx/libSceFontFt/include/Api.hpp"
+#include "prx/libSceFont/include/Api.hpp"
 #include "prx/libSceFont/include/FontDriver.hpp"
+#include "prx/libc/include/General.hpp"
 #include "tests/FontFixture.hpp"
 #include <array>
 #include <cstddef>
+#include <cmath>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <filesystem>
+#include <fstream>
 #include <initializer_list>
 #include <map>
 #include <random>
@@ -14,71 +19,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceFontMemoryInit(FontMemory*, void*, std::uint32_t, const FontMemoryInterface*, void*, FontMemoryDestroyFunction, void*);
-int APS5_VABI sceFontMemoryTerm(FontMemory*);
-int APS5_VABI sceFontCreateLibrary(const FontMemory*, const void*, FontLibrary*);
-int APS5_VABI sceFontDestroyLibrary(FontLibrary*);
-int APS5_VABI sceFontCreateRenderer(const FontMemory*, const void*, FontRenderer*);
-int APS5_VABI sceFontDestroyRenderer(FontRenderer*);
-int APS5_VABI sceFontGetPixelResolution(FontLibrary, std::uint32_t*);
-int APS5_VABI sceFontAttachDeviceCacheBuffer(FontLibrary, void*, std::uint32_t);
-int APS5_VABI sceFontClearDeviceCache(FontLibrary);
-int APS5_VABI sceFontDettachDeviceCacheBuffer(FontLibrary, void**, std::uint32_t*);
-int APS5_VABI sceFontSupportSystemFonts(FontLibrary);
-int APS5_VABI sceFontSupportExternalFonts(FontLibrary, std::uint32_t, std::uint32_t);
-int APS5_VABI sceFontOpenFontSet(FontLibrary, std::uint32_t, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontMemory(FontLibrary, const void*, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontFile(FontLibrary, const char*, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontCloseFont(FontHandle);
-int APS5_VABI sceFontSetScriptLanguage(FontHandle, int, int);
-int APS5_VABI sceFontGetScriptLanguage(FontHandle, int, int*);
-int APS5_VABI sceFontSetTypographicDesign(FontHandle, int, int);
-int APS5_VABI sceFontGetTypographicDesign(FontHandle, int, int*);
-int APS5_VABI sceFontDefineAttribute(FontHandle, int, int*);
-int APS5_VABI sceFontGetAttribute(FontHandle, int, int*);
-int APS5_VABI sceFontSetResolutionDpi(FontHandle, std::uint32_t, std::uint32_t);
-int APS5_VABI sceFontGetResolutionDpi(FontHandle, std::uint32_t*, std::uint32_t*);
-int APS5_VABI sceFontSetScalePixel(FontHandle, float, float);
-int APS5_VABI sceFontBindRenderer(FontHandle, FontRenderer);
-int APS5_VABI sceFontUnbindRenderer(FontHandle);
-int APS5_VABI sceFontSetupRenderScalePixel(FontHandle, float, float);
-int APS5_VABI sceFontSetupRenderScalePoint(FontHandle, float, float);
-int APS5_VABI sceFontGetKerning(FontHandle, std::uint32_t, std::uint32_t, FontKerning*);
-int APS5_VABI sceFontGetFontGlyphsCount(FontHandle, std::uint32_t*);
-int APS5_VABI sceFontGetCharGlyphCode(FontHandle, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceFontGetFontResolution(FontHandle, std::uint32_t*, float*);
-int APS5_VABI sceFontGetRenderScaledKerning(FontHandle, std::uint32_t, std::uint32_t, FontKerning*);
-int APS5_VABI sceFontGenerateCharGlyph(FontHandle, std::uint32_t, const FontGenerateGlyphDetail*, FontGlyph*);
-int APS5_VABI sceFontGlyphDefineAttribute(FontGlyph, std::int32_t, std::int32_t*);
-int APS5_VABI sceFontGlyphGetAttribute(FontGlyph, int, int*);
-int APS5_VABI sceFontDeleteGlyph(const FontMemory*, FontGlyph*);
-int APS5_VABI sceFontTextSourceInit(FontTextSource*, const void*, std::uint32_t, FontTextParseFunction, void*);
-int APS5_VABI sceFontCreateString(const FontMemory*, FontTextSource*, const FontCreateStringDetail*, FontString*);
-int APS5_VABI sceFontDestroyString(FontString*);
-FontTextCharacter* APS5_VABI sceFontStringRefersTextCharacters(FontString, std::uint32_t*);
-int APS5_VABI sceFontWritingInit(FontWriting*, FontString, const FontTextCharacter*);
-const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting*);
-FontTextCharacter* APS5_VABI sceFontWritingRefersRenderStepCharacter(FontWriting*, const FontWritingLetterStep**);
-const void* APS5_VABI sceFontSelectLibraryFt(int);
-const void* APS5_VABI sceFontSelectRendererFt(int);
-int APS5_VABI sceFontFtSupportBdf(FontLibrary library);
-int APS5_VABI sceFontFtSupportCid(FontLibrary library);
-int APS5_VABI sceFontFtSupportOpenType(FontLibrary library);
-int APS5_VABI sceFontFtSupportOpenTypeOtf(FontLibrary library);
-int APS5_VABI sceFontFtSupportOpenTypeTtf(FontLibrary library);
-int APS5_VABI sceFontFtSupportPcf(FontLibrary library);
-int APS5_VABI sceFontFtSupportPfr(FontLibrary library);
-int APS5_VABI sceFontFtSupportTrueType(FontLibrary library);
-int APS5_VABI sceFontFtSupportType1(FontLibrary library);
-int APS5_VABI sceFontFtSupportType42(FontLibrary library);
-int APS5_VABI sceFontFtSupportWinFonts(FontLibrary library);
-int APS5_VABI sceFontCharacterGetSyllableStringState(const FontTextCharacter*, int*);
-FontTextCodes* APS5_VABI sceFontCharactersRefersTextCodes(const FontTextCharacter*, const FontTextCharacter*, FontTextCodes*);
-FontTextCodes* APS5_VABI sceFontTextCodesStepNext(FontTextCodes*);
-FontTextCodes* APS5_VABI sceFontTextCodesStepBack(FontTextCodes*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Font check failed at line %d\n", line);
@@ -89,9 +29,9 @@ static void Check(bool value, int line) {
 
 static void SetFontDirectory(const std::filesystem::path& directory) {
 #ifdef _WIN32
-    Require(_putenv_s("ANYPS5_SYSTEM_FONTS", directory.string().c_str()) == 0);
+    Require(_wputenv_s(L"ANYPS5_SYSTEM_FONTS", directory.wstring().c_str()) == 0);
 #else
-    Require(::setenv("ANYPS5_SYSTEM_FONTS", directory.string().c_str(), 1) == 0);
+    Require(::setenv("ANYPS5_SYSTEM_FONTS", directory.c_str(), 1) == 0);
 #endif
 }
 
@@ -194,6 +134,7 @@ static void CheckTextCodes(const FontMemory* memory, FontHandle font) {
     bool threw = false;
     try {
         sceFontCharactersRefersTextCodes(nullptr, nullptr, &codes);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -205,6 +146,68 @@ static bool KerningIs(const FontKerning& kerning, float offsetX) {
     return kerning.offsetX == offsetX && kerning.offsetY == 0.0f && kerning.positionX == 0.0f && kerning.positionY == 0.0f;
 }
 
+static void CheckGlyphScale(FontHandle font, const FontMemory* memory, float expectedW, float expectedH) {
+    float width = 0.0f;
+    float height = 0.0f;
+    Require(sceFontGetScalePixel(font, &width, &height) == SCE_FONT_OK);
+    Require(width == expectedW && height == expectedH);
+    FontGlyph glyph = nullptr;
+    Require(sceFontGenerateCharGlyph(font, 'A', nullptr, &glyph) == SCE_FONT_OK && glyph != nullptr);
+    Require(sceFontGlyphGetScalePixel(glyph, &width, &height) == SCE_FONT_OK);
+    if (width != expectedW || height != expectedH) {
+        std::fprintf(stderr, "Generated glyph scale %.3f x %.3f differs from font scale %.3f x %.3f\n", width, height, expectedW, expectedH);
+    }
+    Require(width == expectedW && height == expectedH);
+    Require(glyph->em_size == static_cast<std::uint16_t>(std::lround(expectedH)));
+    Require(sceFontDeleteGlyph(memory, &glyph) == SCE_FONT_OK && glyph == nullptr);
+}
+
+static void CheckPointAndDpiScale(FontHandle font, FontLibrary library, const FontMemory* memory, FontRenderer renderer) {
+    FontKerning kerning{};
+    Require(sceFontSetScalePoint(font, 20.0f, 30.0f) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 40.0f, 60.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    Require(sceFontSetResolutionDpi(font, 216, 288) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 60.0f, 120.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -12.0f));
+    Require(sceFontSetScalePoint(font, 50.0f, 40.0f) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 150.0f, 160.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -30.0f));
+    Require(sceFontSetResolutionDpi(font, 0, 0) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 50.0f, 40.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -10.0f));
+    Require(sceFontSetScalePixel(font, 100.0f, 75.0f) == SCE_FONT_OK);
+    Require(sceFontSetResolutionDpi(font, 144, 216) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 100.0f, 75.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -20.0f));
+    Require(sceFontSetScalePoint(font, 20.0f, 30.0f) == SCE_FONT_OK);
+    CheckGlyphScale(font, memory, 40.0f, 90.0f);
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    FontHandle instance = nullptr;
+    Require(sceFontOpenFontInstance(font, nullptr, &instance) == SCE_FONT_OK && instance != nullptr);
+    CheckGlyphScale(instance, memory, 40.0f, 90.0f);
+    Require(sceFontGetKerning(instance, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    Require(sceFontSetScalePoint(instance, 30.0f, 40.0f) == SCE_FONT_OK);
+    CheckGlyphScale(instance, memory, 60.0f, 120.0f);
+    CheckGlyphScale(font, memory, 40.0f, 90.0f);
+    Require(sceFontCloseFont(instance) == SCE_FONT_OK);
+    Require(sceFontBindRenderer(font, renderer) == SCE_FONT_OK);
+    Require(sceFontSetupRenderScalePixel(font, 100.0f, 100.0f) == SCE_FONT_OK);
+    Require(sceFontGetRenderScaledKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -20.0f));
+    Require(sceFontGetKerning(font, 'A', 'V', &kerning) == SCE_FONT_OK && KerningIs(kerning, -8.0f));
+    Require(sceFontUnbindRenderer(font) == SCE_FONT_OK);
+    const std::vector<unsigned char> data = KerningFont();
+    FontHandle fresh = nullptr;
+    Require(sceFontOpenFontMemory(library, data.data(), static_cast<std::uint32_t>(data.size()), nullptr, &fresh) == SCE_FONT_OK);
+    float width = 0.0f;
+    float height = 0.0f;
+    Require(sceFontGetScalePixel(fresh, &width, &height) == SCE_FONT_OK);
+    CheckGlyphScale(fresh, memory, width, height);
+    Require(sceFontCloseFont(fresh) == SCE_FONT_OK);
+    Require(sceFontSetResolutionDpi(font, 144, 144) == SCE_FONT_OK);
+    Require(sceFontSetScalePixel(font, 100.0f, 100.0f) == SCE_FONT_OK);
+}
+
 int main() {
     constexpr std::uint32_t SystemFontSet = 0x18070043u;
     const std::filesystem::path fontRoot = std::filesystem::temp_directory_path() / ("anyps5_guest_font-" + std::to_string(std::random_device{}()));
@@ -220,10 +223,10 @@ int main() {
     FontLibrary library = nullptr;
     Require(sceFontCreateLibrary(&memory, nullptr, &library) == SCE_FONT_ERROR_INVALID_PARAMETER && library == nullptr);
     Require(sceFontCreateLibrary(&memory, sceFontSelectLibraryFt(0), &library) == SCE_FONT_OK && library != nullptr);
-    Require(sceFontFtSupportBdf(library) == 0 && sceFontFtSupportCid(library) == 0 && sceFontFtSupportOpenType(library) == 0 && sceFontFtSupportOpenTypeOtf(library) == 0 && sceFontFtSupportOpenTypeTtf(library) == 0 && sceFontFtSupportPcf(library) == 0 && sceFontFtSupportPfr(library) == 0 && sceFontFtSupportTrueType(library) == 0 && sceFontFtSupportType1(library) == 0 && sceFontFtSupportType42(library) == 0 && sceFontFtSupportWinFonts(library) == 0);
+    Require(sceFontFtSupportBdf(library) == 0 && sceFontFtSupportCid(library) == 0 && sceFontFtSupportOpenType(library) == 0 && sceFontFtSupportOpenTypeOtf(library) == 0 && sceFontFtSupportOpenTypeTtf(library) == 0 && sceFontFtSupportPcf(library) == 0 && sceFontFtSupportPfr(library) == 0 && sceFontFtSupportTrueType(library) == 0 && sceFontFtSupportTrueTypeGx(library) == 0 && sceFontFtSupportType1(library) == 0 && sceFontFtSupportType42(library) == 0 && sceFontFtSupportWinFonts(library) == 0);
     const auto* nativeLibrary = static_cast<const Font::FontLibNative*>(library);
     const auto savedLock = nativeLibrary->lock_word;
-    for (auto support : {sceFontFtSupportBdf, sceFontFtSupportCid, sceFontFtSupportOpenType, sceFontFtSupportOpenTypeOtf, sceFontFtSupportOpenTypeTtf, sceFontFtSupportPcf, sceFontFtSupportPfr, sceFontFtSupportTrueType, sceFontFtSupportType1, sceFontFtSupportType42, sceFontFtSupportWinFonts}) {
+    for (auto support : {sceFontFtSupportBdf, sceFontFtSupportCid, sceFontFtSupportOpenType, sceFontFtSupportOpenTypeOtf, sceFontFtSupportOpenTypeTtf, sceFontFtSupportPcf, sceFontFtSupportPfr, sceFontFtSupportTrueType, sceFontFtSupportTrueTypeGx, sceFontFtSupportType1, sceFontFtSupportType42, sceFontFtSupportWinFonts}) {
         Font::FontLibNative invalidLibrary{};
         Require(support(nullptr) == SCE_FONT_ERROR_INVALID_LIBRARY);
         Require(support(&invalidLibrary) == SCE_FONT_ERROR_INVALID_LIBRARY);
@@ -311,6 +314,20 @@ int main() {
     Require(sceFontOpenFontMemory(library, notAFont, sizeof(notAFont), nullptr, &font) == SCE_FONT_ERROR_NO_SUPPORT_FORMAT && font == nullptr);
 
     const std::vector<unsigned char> fontData = EmptyGlyphFont();
+    const auto fileFont = fontRoot / std::filesystem::path(u8"external-a\u00e7\u00e3o-\u65e5\u672c") / "font.ttf";
+    std::filesystem::create_directories(fileFont.parent_path());
+    {
+        std::ofstream file(fileFont, std::ios::binary);
+        file.write(reinterpret_cast<const char*>(fontData.data()), static_cast<std::streamsize>(fontData.size()));
+        Require(static_cast<bool>(file));
+    }
+    const std::u8string fontRootText = fontRoot.u8string();
+    AddPathAlias_nid_no_patch("/font-test", reinterpret_cast<const char*>(fontRootText.c_str()));
+    const std::u8string fileFontText = u8"/font-test/external-a\u00e7\u00e3o-\u65e5\u672c/font.ttf";
+    FontHandle fileHandle = nullptr;
+    Require(sceFontOpenFontFile(library, reinterpret_cast<const char*>(fileFontText.c_str()), 1, nullptr, &fileHandle) == SCE_FONT_OK && fileHandle != nullptr);
+    Require(sceFontCloseFont(fileHandle) == SCE_FONT_OK);
+    RemovePathAlias_nid_no_patch("/font-test");
     Require(sceFontOpenFontMemory(library, fontData.data(), static_cast<std::uint32_t>(fontData.size()), nullptr, &font) == SCE_FONT_OK && font != nullptr);
     int setting = -1;
     Require(sceFontGetScriptLanguage(font, 3, &setting) == SCE_FONT_ERROR_INVALID_PARAMETER && setting == 0);
@@ -326,11 +343,13 @@ int main() {
         bool getThrew = false;
         try {
             sceFontSetScriptLanguage(font, script, script);
+
         } catch (const std::logic_error&) {
             setThrew = true;
         }
         try {
             sceFontGetScriptLanguage(font, script, &setting);
+
         } catch (const std::logic_error&) {
             getThrew = true;
         }
@@ -352,6 +371,7 @@ int main() {
         bool getThrew = false;
         try {
             sceFontGetTypographicDesign(font, selector, &setting);
+
         } catch (const std::logic_error&) {
             getThrew = true;
         }
@@ -361,6 +381,7 @@ int main() {
             bool setThrew = false;
             try {
                 sceFontSetTypographicDesign(font, selector, feature);
+
             } catch (const std::logic_error&) {
                 setThrew = true;
             }
@@ -385,6 +406,7 @@ int main() {
     bool typographyQueryThrew = false;
     try {
         sceFontGetTypographicDesign(font, 65537, &setting);
+
     } catch (const std::logic_error&) {
         typographyQueryThrew = true;
     }
@@ -541,6 +563,8 @@ int main() {
     Require(sceFontUnbindRenderer(font) == SCE_FONT_OK);
     Require(sceFontGetRenderScaledKerning(font, 'A', 'V', &kerning) == SCE_FONT_ERROR_NOT_BOUND_RENDERER);
 
+    CheckPointAndDpiScale(font, library, &memory, renderer);
+
     ParsedText parsed{"AV", 0, font};
     FontTextSource source{};
     Require(sceFontTextSourceInit(&source, parsed.text, 2, ParseText, &parsed) == SCE_FONT_OK);
diff --git a/core/libs/tests/GuestFontWritingLine.cpp b/core/libs/tests/GuestFontWritingLine.cpp
index 5c311aede3..0f41bb2066 100644
--- a/core/libs/tests/GuestFontWritingLine.cpp
+++ b/core/libs/tests/GuestFontWritingLine.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFont/include/Api.hpp"
 #include "prx/libSceFont/include/FontTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,16 +6,6 @@
 #include <exception>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceFontCreateWritingLine(const FontMemory*, std::int32_t, const void*, void**);
-int APS5_VABI sceFontDestroyWritingLine(void**);
-int APS5_VABI sceFontWritingLineClear(void*);
-int APS5_VABI sceFontWritingLineWritesOrder(void*, std::uint64_t, const FontWritingMetrics*, void*);
-const FontWritingLineStep* APS5_VABI sceFontWritingLineRefersRenderStep(void*);
-int APS5_VABI sceFontWritingLineGetRenderMetrics(void*, FontWritingMetrics*);
-int APS5_VABI sceFontWritingLineGetOrderingSpace(void*, float*, float*, float*, float*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Font writing line check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestFopenErrors.cpp b/core/libs/tests/GuestFopenErrors.cpp
index 5c72df7df0..7cfd9c96b6 100644
--- a/core/libs/tests/GuestFopenErrors.cpp
+++ b/core/libs/tests/GuestFopenErrors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <chrono>
@@ -8,14 +9,6 @@
 #include <string>
 #include <unistd.h>
 
-extern "C" {
-void* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
-int APS5_VABI fclose_nid_postfix(void* stream);
-void* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, void* stream);
-int APS5_VABI fopen_s_nid_postfix(void** result, const char* filename, const char* mode);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, int line) {
@@ -60,12 +53,12 @@ void Open() {
     Check(OpenFails((LongName + "/inside").c_str(), "a", GuestEnametoolong));
     Check(OpenFails("missing.txt", "r", GuestEnoent));
     Check(OpenFails("folder", "w", GuestEisdir));
-    void* plain = fopen_nid_postfix("plain.txt", "r");
+    FileStream* plain = fopen_nid_postfix("plain.txt", "r");
     Check(plain != nullptr && fclose_nid_postfix(plain) == 0);
 }
 
 bool ReopenFails(const char* name, const char* mode, int error) {
-    void* stream = fopen_nid_postfix("plain.txt", "r");
+    FileStream* stream = fopen_nid_postfix("plain.txt", "r");
     Check(stream != nullptr);
     *__error_nid_postfix() = 0;
     const bool failed = freopen_nid_postfix(name, mode, stream) == nullptr && *__error_nid_postfix() == error;
@@ -79,14 +72,14 @@ void Reopen() {
     Check(ReopenFails(LongName.c_str(), "r", GuestEnametoolong));
     Check(ReopenFails(LongName.c_str(), "w", GuestEnametoolong));
     Check(ReopenFails("missing.txt", "r", GuestEnoent));
-    void* stream = fopen_nid_postfix("plain.txt", "r");
+    FileStream* stream = fopen_nid_postfix("plain.txt", "r");
     Check(stream != nullptr);
-    void* reopened = freopen_nid_postfix("plain.txt", "r", stream);
+    FileStream* reopened = freopen_nid_postfix("plain.txt", "r", stream);
     Check(reopened != nullptr && fclose_nid_postfix(reopened) == 0);
 }
 
 void CheckedOpen() {
-    void* stream = reinterpret_cast<void*>(1);
+    FileStream* stream = reinterpret_cast<FileStream*>(1);
     Check(fopen_s_nid_postfix(&stream, "loop", "r") == GuestEloop && stream == nullptr);
     Check(fopen_s_nid_postfix(&stream, LongName.c_str(), "w") == GuestEnametoolong && stream == nullptr);
     Check(fopen_s_nid_postfix(&stream, "folder", "w") == GuestEisdir && stream == nullptr);
diff --git a/core/libs/tests/GuestFopenLongHostPath.cpp b/core/libs/tests/GuestFopenLongHostPath.cpp
index 9ebe1738ce..9a15819f63 100644
--- a/core/libs/tests/GuestFopenLongHostPath.cpp
+++ b/core/libs/tests/GuestFopenLongHostPath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -10,14 +11,6 @@
 #define NOMINMAX
 #include <windows.h>
 
-extern "C" {
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(void*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, void*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, const char* message) {
@@ -29,7 +22,7 @@ std::filesystem::path Extended(const std::filesystem::path& path) {
     return native.starts_with(L"\\\\") ? L"\\\\?\\UNC\\" + native.substr(2) : L"\\\\?\\" + native;
 }
 
-using Stream = std::unique_ptr<void, decltype(&fclose_nid_postfix)>;
+using Stream = std::unique_ptr<FileStream, decltype(&fclose_nid_postfix)>;
 
 Stream Open(const char* path, const char* mode) {
     Stream stream(fopen_nid_postfix(path, mode), fclose_nid_postfix);
diff --git a/core/libs/tests/GuestForceTlsDestructor.cpp b/core/libs/tests/GuestForceTlsDestructor.cpp
index 6f900b9396..aba2bcafaa 100644
--- a/core/libs/tests/GuestForceTlsDestructor.cpp
+++ b/core/libs/tests/GuestForceTlsDestructor.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -10,15 +12,6 @@
 #include <dlfcn.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info);
-int APS5_VABI _sceLibcInternalThreadAtexit_nid_postfix(void (APS5_VABI* destructor)(void*), void* object, void* dsoSymbol);
-void APS5_VABI _sceLibcInternalThreadDtors_nid_postfix();
-int APS5_VABI _sceLibcInternalForceTlsDestructor_nid_postfix(KernelModule handle);
-}
-
 namespace {
 
 using Destructor = void (APS5_VABI*)(void*);
@@ -57,13 +50,14 @@ void* APS5_VABI Worker(void*) {
 KernelModule ModuleOf(const void* address) {
     ModuleInfoEx info{};
     info.st_size = sizeof(ModuleInfoEx);
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 2, &info) == 0);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 1, &info) == 0);
     return info.id;
 }
 
 bool ForceThrows(KernelModule handle) {
     try {
         _sceLibcInternalForceTlsDestructor_nid_postfix(handle);
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -101,6 +95,7 @@ int main() {
     Require(_sceLibcInternalForceTlsDestructor_nid_postfix(0) == 0);
     Require(calls.size() == 2);
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls == std::vector<std::intptr_t>{3, 1, 2});
 
     calls.clear();
@@ -108,6 +103,7 @@ int main() {
     Require(_sceLibcInternalForceTlsDestructor_nid_postfix(other) == 0);
     Require(calls.empty());
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls.empty());
 
     Require(Register(RecordAndRegister, 10) == 0);
diff --git a/core/libs/tests/GuestFreeType.cpp b/core/libs/tests/GuestFreeType.cpp
index 8e5c7e7d0f..c14954f91c 100644
--- a/core/libs/tests/GuestFreeType.cpp
+++ b/core/libs/tests/GuestFreeType.cpp
@@ -1,11 +1,16 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FreeTypeFontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestFreeType.hpp"
 #include "prx/libc/include/General.hpp"
 
 #include <ft2build.h>
 #include FT_FREETYPE_H
+#include FT_GASP_H
 #include FT_OUTLINE_H
+#include FT_TRIGONOMETRY_H
+#include FT_CID_H
 
+#include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstdio>
@@ -14,6 +19,7 @@
 #include <filesystem>
 #include <fstream>
 #include <initializer_list>
+#include <limits>
 #include <random>
 #include <stdexcept>
 #include <string>
@@ -22,19 +28,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Init_FreeType_nid_postfix(void**);
-int APS5_VABI FT_Done_FreeType_nid_postfix(void*);
-int APS5_VABI FT_New_Face_nid_postfix(void*, const char*, std::int64_t, GuestFaceRec**);
-int APS5_VABI FT_New_Memory_Face_nid_postfix(void*, const unsigned char*, std::int64_t, std::int64_t, GuestFaceRec**);
-int APS5_VABI FT_Done_Face_nid_postfix(GuestFaceRec*);
-int APS5_VABI FT_Set_Pixel_Sizes_nid_postfix(GuestFaceRec*, std::uint32_t, std::uint32_t);
-std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(GuestFaceRec*, std::uint64_t);
-int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec*, std::uint32_t, std::int32_t);
-int APS5_VABI FT_Load_Char_nid_postfix(GuestFaceRec*, std::uint64_t, std::int32_t);
-int APS5_VABI FT_Render_Glyph_nid_postfix(GuestGlyphSlotRec*, std::int32_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType check failed at line %d\n", line);
@@ -43,6 +36,77 @@ static void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
+static void CheckGaspTable(const std::vector<unsigned char>* table, const std::vector<std::pair<unsigned, int>>& ranges,
+                           bool versionZero, bool render) {
+    const auto font = SquareGlyphFont('A', 700, false, table);
+    FreeType::GuestLibrary* library = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Library nativeLibrary = nullptr;
+    FT_Face native = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(nativeLibrary, font.data(), static_cast<FT_Long>(font.size()), 0, &native) == 0);
+    auto* slot = face->glyph;
+    const auto glyphIndex = slot->glyph_index;
+    const auto bitmap = slot->bitmap.buffer;
+    const auto points = slot->outline.points;
+    for (std::uint32_t ppem = 0; ppem <= 65536; ++ppem) {
+        int expected = FT_GASP_NO_TABLE;
+        for (const auto& [maximum, flags] : ranges) {
+            if (ppem > maximum) continue;
+            expected = versionZero ? flags & 3 : flags;
+            break;
+        }
+        Require(FT_Get_Gasp_nid_postfix(face, ppem) == expected);
+        Require(FT_Get_Gasp(native, ppem) == expected);
+    }
+    Require(FT_Get_Gasp_nid_postfix(face, UINT32_MAX) == FT_GASP_NO_TABLE);
+    Require(face->glyph == slot && slot->glyph_index == glyphIndex && slot->bitmap.buffer == bitmap && slot->outline.points == points);
+    if (render) {
+        for (const unsigned ppem : {7u, 8u, 15u, 16u, 31u, 32u, 64u}) {
+            const int flags = FT_Get_Gasp_nid_postfix(face, ppem);
+            const int load = flags & FT_GASP_DO_GRIDFIT ? FT_LOAD_DEFAULT : FT_LOAD_NO_HINTING;
+            const auto mode = flags & FT_GASP_DO_GRAY ? FT_RENDER_MODE_NORMAL : FT_RENDER_MODE_MONO;
+            Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, ppem) == 0 && FT_Set_Pixel_Sizes(native, 0, ppem) == 0);
+            Require(FT_Load_Char_nid_postfix(face, 'A', load) == 0 && FT_Load_Char(native, 'A', load) == 0);
+            Require(FT_Render_Glyph_nid_postfix(face->glyph, mode) == 0 && FT_Render_Glyph(native->glyph, mode) == 0);
+            const auto& actual = face->glyph->bitmap;
+            const auto& expected = native->glyph->bitmap;
+            Require(actual.width > 0 && actual.rows > 0);
+            Require(actual.width == expected.width && actual.rows == expected.rows && actual.pitch == expected.pitch);
+            Require(actual.pixel_mode == expected.pixel_mode && actual.num_grays == expected.num_grays);
+            Require(face->glyph->bitmap_left == native->glyph->bitmap_left && face->glyph->bitmap_top == native->glyph->bitmap_top);
+            Require(std::memcmp(actual.buffer, expected.buffer, static_cast<std::size_t>(actual.rows) * std::abs(actual.pitch)) == 0);
+        }
+    }
+    Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+}
+
+static void CheckGasp() {
+    Require(FT_Get_Gasp_nid_postfix(nullptr, 0) == FT_GASP_NO_TABLE);
+    Require(FT_Get_Gasp_nid_postfix(nullptr, UINT32_MAX) == FT_GASP_NO_TABLE);
+    CheckGaspTable(nullptr, {}, false, false);
+    const std::vector<std::pair<unsigned, int>> ranges{{0, 0x8003}, {7, 2}, {15, 1}, {31, 0}, {65535, 0xFFFF}};
+    for (const unsigned version : {0u, 1u}) {
+        std::vector<unsigned char> table;
+        Put16(table, version);
+        Put16(table, ranges.size());
+        for (const auto& [maximum, flags] : ranges) {
+            Put16(table, maximum);
+            Put16(table, flags);
+        }
+        CheckGaspTable(&table, ranges, version == 0, true);
+    }
+    std::vector<unsigned char> shortRange;
+    PutAll16(shortRange, {1, 1, 48, FT_GASP_DO_GRAY});
+    CheckGaspTable(&shortRange, {{48, FT_GASP_DO_GRAY}}, false, false);
+    for (const std::vector<unsigned char>& table : {std::vector<unsigned char>{}, {0, 1}, {0, 1, 0, 0}, {0, 2, 0, 1, 0, 10, 0, 3}}) {
+        CheckGaspTable(&table, {}, false, false);
+    }
+    std::puts("FreeType gasp: 8 fonts, 524304 queries, null faces and 14 rendered glyphs passed");
+}
+
 template <typename TCall> static bool ThrowsWith(TCall call, const std::string& prefix) {
     try {
         call();
@@ -52,7 +116,7 @@ template <typename TCall> static bool ThrowsWith(TCall call, const std::string&
     return false;
 }
 
-static void FaceMatches(const GuestFaceRec* face, FT_Face host, const void* library) {
+static void FaceMatches(const GuestFaceRec* face, FT_Face host, const FreeType::GuestLibrary* library) {
     Require(face->num_faces == host->num_faces && face->face_index == host->face_index && face->face_flags == host->face_flags);
     Require(face->style_flags == host->style_flags && face->num_glyphs == host->num_glyphs && face->num_glyphs == 2);
     Require((face->family_name == nullptr) == (host->family_name == nullptr) && (face->style_name == nullptr) == (host->style_name == nullptr));
@@ -67,6 +131,121 @@ static void FaceMatches(const GuestFaceRec* face, FT_Face host, const void* libr
     Require(face->glyph != nullptr && face->glyph->face == face && face->glyph->library == library && face->size != nullptr && face->size->face == face);
 }
 
+static unsigned orientationCases = 0;
+
+static void CheckOrientationCase(std::vector<GuestVector> points, std::vector<std::uint16_t> contours,
+                                 int expected, bool compareNative = true) {
+    ++orientationCases;
+    const auto originalPoints = points;
+    const auto originalContours = contours;
+    std::vector<unsigned char> tags(points.size(), FT_CURVE_TAG_ON);
+    GuestOutline outline{static_cast<std::uint16_t>(contours.size()), static_cast<std::uint16_t>(points.size()),
+                         points.data(), tags.data(), contours.data(), FT_OUTLINE_EVEN_ODD_FILL | FT_OUTLINE_REVERSE_FILL};
+    const auto original = outline;
+    Require(FT_Outline_Get_Orientation_nid_postfix(&outline) == expected);
+    Require(outline.n_points == original.n_points && outline.n_contours == original.n_contours && outline.flags == original.flags);
+    Require(outline.points == original.points && outline.tags == original.tags && outline.contours == original.contours);
+    for (std::size_t index = 0; index < points.size(); ++index) {
+        Require(points[index].x == originalPoints[index].x && points[index].y == originalPoints[index].y);
+        Require(tags[index] == FT_CURVE_TAG_ON);
+    }
+    Require(contours == originalContours);
+    if (compareNative) {
+        std::vector<FT_Vector> nativePoints;
+        for (const auto& point : points) nativePoints.push_back({static_cast<FT_Pos>(point.x), static_cast<FT_Pos>(point.y)});
+        FT_Outline native{outline.n_contours, outline.n_points, nativePoints.data(), tags.data(), contours.data(), outline.flags};
+        Require(FT_Outline_Get_Orientation(&native) == expected);
+    }
+}
+
+static void CheckOutlineOrientation() {
+    Require(FT_Outline_Get_Orientation_nid_postfix(nullptr) == FT_ORIENTATION_TRUETYPE);
+    CheckOrientationCase({}, {}, FT_ORIENTATION_TRUETYPE);
+    CheckOrientationCase({{0, 0}}, {0}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, 0}, {1, 1}}, {1}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, 0}, {1, 1}, {2, 2}}, {2}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, 0}, {40, 0}, {40, 40}, {0, 40}}, {3}, FT_ORIENTATION_POSTSCRIPT);
+    CheckOrientationCase({{0, 0}, {0, 40}, {40, 40}, {40, 0}}, {3}, FT_ORIENTATION_TRUETYPE);
+    CheckOrientationCase({{0, 0}, {40, 0}, {40, 40}, {0, 40}, {10, 10}, {10, 30}, {30, 30}, {30, 10}},
+                          {3, 7}, FT_ORIENTATION_POSTSCRIPT);
+    CheckOrientationCase({{0, 0}, {40, 0}, {40, 40}, {0, 40}, {0, 0}, {0, 40}, {40, 40}, {40, 0}},
+                          {3, 7}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, 0}, {40, 0}, {40, 40}, {0, 40}}, {}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{1048577, 0}, {1048578, 1}, {1048577, 2}}, {2}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{-0x1000000, -0x1000000}, {0x1000000, -0x1000000},
+                           {0x1000000, 0x1000000}, {-0x1000000, 0x1000000}}, {3}, FT_ORIENTATION_POSTSCRIPT);
+    CheckOrientationCase({{-0x1000001, 0}, {0, 100}, {100, 0}}, {2}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, -0x1000001}, {100, 0}, {0, 100}}, {2}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, 0}, {0x1000001, 100}, {100, 0}}, {2}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{0, 0}, {100, 0x1000001}, {0, 100}}, {2}, FT_ORIENTATION_NONE);
+    CheckOrientationCase({{INT64_MIN, INT64_MIN}, {INT64_MAX, INT64_MAX}, {0, 1}}, {2}, FT_ORIENTATION_NONE, false);
+    std::vector<GuestVector> repeated{{0, 0}, {32767, 0}, {32767, 32767}, {0, 32767},
+                                      {0, 0}, {32767, 0}, {32767, 32767}, {0, 32767}};
+    CheckOrientationCase(repeated, {3, 7}, FT_ORIENTATION_POSTSCRIPT, sizeof(FT_Pos) == 8);
+    if constexpr (sizeof(FT_Pos) == 4) {
+        FT_Vector nativePoints[]{{0, 0}, {32767, 0}, {32767, 32767}, {0, 32767},
+                                  {0, 0}, {32767, 0}, {32767, 32767}, {0, 32767}};
+        unsigned short contours[]{3, 7};
+        FT_Outline native{2, 8, nativePoints, nullptr, contours, 0};
+        Require(FT_Outline_Get_Orientation(&native) == FT_ORIENTATION_TRUETYPE);
+    }
+    std::vector<GuestVector> maximum(65535);
+    const GuestVector square[]{{0, 0}, {32767, 0}, {32767, 32767}, {0, 32767}};
+    for (std::size_t index = 0; index < maximum.size(); ++index) maximum[index] = square[index % 4];
+    CheckOrientationCase(maximum, {65534}, FT_ORIENTATION_POSTSCRIPT, sizeof(FT_Pos) == 8);
+    std::vector<std::uint16_t> singletons(65535);
+    for (std::size_t index = 0; index < singletons.size(); ++index) singletons[index] = static_cast<std::uint16_t>(index);
+    CheckOrientationCase(maximum, singletons, FT_ORIENTATION_NONE);
+    std::mt19937 random(0xF7013);
+    for (unsigned test = 0; test < 512; ++test) {
+        std::vector<GuestVector> points(random() % 10 + 3);
+        for (auto& point : points) point = {static_cast<int>(random() % 1024) - 512, static_cast<int>(random() % 1024) - 512};
+        std::int64_t twiceArea = 0;
+        auto previous = points.back();
+        for (const auto& current : points) {
+            twiceArea += previous.x * current.y - current.x * previous.y;
+            previous = current;
+        }
+        const int expected = twiceArea > 0 ? FT_ORIENTATION_POSTSCRIPT : twiceArea < 0 ? FT_ORIENTATION_TRUETYPE : FT_ORIENTATION_NONE;
+        const std::vector<std::uint16_t> contours{static_cast<std::uint16_t>(points.size() - 1)};
+        CheckOrientationCase(points, contours, expected);
+        for (auto& point : points) { point.x += 1000; point.y -= 2000; }
+        CheckOrientationCase(points, contours, expected);
+        std::reverse(points.begin(), points.end());
+        CheckOrientationCase(points, contours, twiceArea == 0 ? FT_ORIENTATION_NONE : expected == FT_ORIENTATION_POSTSCRIPT ? FT_ORIENTATION_TRUETYPE : FT_ORIENTATION_POSTSCRIPT);
+    }
+    const auto font = SquareGlyphFont('A', 700);
+    FreeType::GuestLibrary* library = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Library nativeLibrary = nullptr;
+    FT_Face native = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(nativeLibrary, font.data(), static_cast<FT_Long>(font.size()), 0, &native) == 0);
+    Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 32) == 0 && FT_Set_Pixel_Sizes(native, 0, 32) == 0);
+    for (const bool reflect : {false, true}) {
+        Require(FT_Load_Char_nid_postfix(face, 'A', FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        Require(FT_Load_Char(native, 'A', FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        if (reflect) {
+            for (unsigned index = 0; index < face->glyph->outline.n_points; ++index) {
+                face->glyph->outline.points[index].x = -face->glyph->outline.points[index].x;
+                native->glyph->outline.points[index].x = -native->glyph->outline.points[index].x;
+            }
+        }
+        Require(FT_Outline_Get_Orientation_nid_postfix(&face->glyph->outline) == (reflect ? FT_ORIENTATION_POSTSCRIPT : FT_ORIENTATION_TRUETYPE));
+        Require(FT_Outline_Get_Orientation(&native->glyph->outline) == (reflect ? FT_ORIENTATION_POSTSCRIPT : FT_ORIENTATION_TRUETYPE));
+        Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == 0 && FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL) == 0);
+        const auto& actual = face->glyph->bitmap;
+        const auto& expected = native->glyph->bitmap;
+        Require(actual.width > 0 && actual.rows > 0 && actual.width == expected.width && actual.rows == expected.rows && actual.pitch == expected.pitch);
+        Require(actual.pixel_mode == expected.pixel_mode && face->glyph->bitmap_left == native->glyph->bitmap_left && face->glyph->bitmap_top == native->glyph->bitmap_top);
+        Require(std::memcmp(actual.buffer, expected.buffer, static_cast<std::size_t>(actual.rows) * std::abs(actual.pitch)) == 0);
+    }
+    Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+    std::printf("FreeType outline orientation: %u polygon cases and 2 rendered glyphs passed\n", orientationCases);
+}
+
 static void SlotMatches(const GuestGlyphSlotRec* slot, FT_GlyphSlot host) {
     Require(slot->glyph_index == host->glyph_index && slot->format == static_cast<std::uint32_t>(host->format) && slot->next == nullptr);
     const auto& metrics = host->metrics;
@@ -89,10 +268,362 @@ static void SlotMatches(const GuestGlyphSlotRec* slot, FT_GlyphSlot host) {
     Require(slot->lsb_delta == host->lsb_delta && slot->rsb_delta == host->rsb_delta && slot->control_len == host->control_len);
 }
 
+static void SizeMatches(const GuestFaceRec* face, FT_Face host) {
+    const auto& actual = face->size->metrics;
+    const auto& expected = host->size->metrics;
+    Require(actual.x_ppem == expected.x_ppem && actual.y_ppem == expected.y_ppem);
+    Require(actual.x_scale == expected.x_scale && actual.y_scale == expected.y_scale);
+    Require(actual.ascender == expected.ascender && actual.descender == expected.descender);
+    Require(actual.height == expected.height && actual.max_advance == expected.max_advance);
+}
+
+static void Trigonometry() {
+    constexpr std::int64_t circle = 360ll << 16;
+    const std::array<std::pair<std::int64_t, std::int64_t>, 68> poleTangents{{
+        {-17694728ll, 33692373208ll},
+        {-17694727ll, 45725363639ll},
+        {-17694726ll, 45725363639ll},
+        {-17694725ll, 64015509094ll},
+        {-17694724ll, 64015509094ll},
+        {-17694723ll, 128031018189ll},
+        {-17694722ll, 128031018189ll},
+        {-17694721ll, 640155090944ll},
+        {-17694720ll, -640155090944ll},
+        {-17694719ll, -128031018189ll},
+        {-17694718ll, -128031018189ll},
+        {-17694717ll, -64015509094ll},
+        {-17694716ll, -64015509094ll},
+        {-17694715ll, -45725363639ll},
+        {-17694714ll, -45725363639ll},
+        {-17694713ll, -33692373208ll},
+        {-17694712ll, -33692373208ll},
+        {-5898248ll, 33692373208ll},
+        {-5898247ll, 45725363639ll},
+        {-5898246ll, 45725363639ll},
+        {-5898245ll, 64015509094ll},
+        {-5898244ll, 64015509094ll},
+        {-5898243ll, 128031018189ll},
+        {-5898242ll, 128031018189ll},
+        {-5898241ll, 640155090944ll},
+        {-5898240ll, -640155090944ll},
+        {-5898239ll, -128031018189ll},
+        {-5898238ll, -128031018189ll},
+        {-5898237ll, -64015509094ll},
+        {-5898236ll, -64015509094ll},
+        {-5898235ll, -45725363639ll},
+        {-5898234ll, -45725363639ll},
+        {-5898233ll, -33692373208ll},
+        {-5898232ll, -33692373208ll},
+        {5898232ll, 33692373208ll},
+        {5898233ll, 45725363639ll},
+        {5898234ll, 45725363639ll},
+        {5898235ll, 64015509094ll},
+        {5898236ll, 64015509094ll},
+        {5898237ll, 128031018189ll},
+        {5898238ll, 128031018189ll},
+        {5898239ll, 640155090944ll},
+        {5898240ll, -640155090944ll},
+        {5898241ll, -128031018189ll},
+        {5898242ll, -128031018189ll},
+        {5898243ll, -64015509094ll},
+        {5898244ll, -64015509094ll},
+        {5898245ll, -45725363639ll},
+        {5898246ll, -45725363639ll},
+        {5898247ll, -33692373208ll},
+        {5898248ll, -33692373208ll},
+        {17694712ll, 33692373208ll},
+        {17694713ll, 45725363639ll},
+        {17694714ll, 45725363639ll},
+        {17694715ll, 64015509094ll},
+        {17694716ll, 64015509094ll},
+        {17694717ll, 128031018189ll},
+        {17694718ll, 128031018189ll},
+        {17694719ll, 640155090944ll},
+        {17694720ll, -640155090944ll},
+        {17694721ll, -128031018189ll},
+        {17694722ll, -128031018189ll},
+        {17694723ll, -64015509094ll},
+        {17694724ll, -64015509094ll},
+        {17694725ll, -45725363639ll},
+        {17694726ll, -45725363639ll},
+        {17694727ll, -33692373208ll},
+        {17694728ll, -33692373208ll}}};
+    int scalarCases = 0;
+    int vectorCases = 0;
+    int differenceCases = 0;
+    for (const auto& [angle, tangent] : poleTangents) {
+        Require(FT_Tan_nid_postfix(angle) == tangent);
+        if (sizeof(FT_Fixed) == 4) {
+            Require(static_cast<std::int64_t>(FT_Tan(static_cast<FT_Angle>(angle))) != tangent);
+        } else {
+            Require(static_cast<std::int64_t>(FT_Tan(static_cast<FT_Angle>(angle))) == tangent);
+        }
+    }
+    auto compare = [&](std::int64_t angle, FT_Angle nativeAngle, std::int64_t expectedTangent) {
+        Require(FT_Cos_nid_postfix(angle) == FT_Cos(nativeAngle));
+        Require(FT_Sin_nid_postfix(angle) == FT_Sin(nativeAngle));
+        Require(FT_Tan_nid_postfix(angle) == expectedTangent);
+        FT_Vector expected{};
+        FT_Vector_Unit(&expected, nativeAngle);
+        struct GuardedVector {
+            std::uint64_t before;
+            GuestVector vector;
+            std::uint64_t after;
+        } actual{0xA55A0FF0FF00AA55ull, {INT64_MAX, INT64_MIN}, 0x55AA00FFF00F5AA5ull};
+        FT_Vector_Unit_nid_postfix(&actual.vector, angle);
+        Require(actual.vector.x == expected.x && actual.vector.y == expected.y);
+        Require(actual.vector.x == FT_Cos_nid_postfix(angle) && actual.vector.y == FT_Sin_nid_postfix(angle));
+        Require(actual.before == 0xA55A0FF0FF00AA55ull && actual.after == 0x55AA00FFF00F5AA5ull);
+        ++scalarCases;
+        ++vectorCases;
+    };
+    std::mt19937 random(0x17A693Bu);
+    std::uniform_int_distribution<std::int32_t> angles(INT32_MIN, INT32_MAX);
+    for (unsigned sample = 0; sample < 4096; ++sample) {
+        const std::int32_t angle = angles(random);
+        Require(FT_Cos_nid_postfix(angle) == FT_Cos(angle));
+        Require(FT_Sin_nid_postfix(angle) == FT_Sin(angle));
+        Require(static_cast<std::int32_t>(FT_Tan_nid_postfix(angle)) == FT_Tan(angle));
+        FT_Vector expected{};
+        GuestVector actual{};
+        FT_Vector_Unit(&expected, angle);
+        FT_Vector_Unit_nid_postfix(&actual, angle);
+        Require(actual.x == expected.x && actual.y == expected.y);
+        ++scalarCases;
+        ++vectorCases;
+    }
+    const std::array<std::int64_t, 14> bases{-circle + 1, -(180ll << 16), -(90ll << 16) - 1, -(45ll << 16),
+        -1, 0, 1, 25783, 45ll << 16, (90ll << 16) - 1, 90ll << 16, (90ll << 16) + 1, 180ll << 16, circle - 1};
+    for (const std::int64_t turns : {0ll, 1ll, -1ll, 97ll, -97ll, 100000000000ll, -100000000000ll, 390000000000ll, -390000000000ll}) {
+        for (const std::int64_t base : bases) {
+            const std::int64_t tangent = FT_Tan_nid_postfix(base);
+            compare(base + circle * turns, static_cast<FT_Angle>(base), tangent);
+            for (const std::int64_t other : bases) {
+                Require(FT_Angle_Diff_nid_postfix(base + circle * turns, other + circle * turns) ==
+                        FT_Angle_Diff(static_cast<FT_Angle>(base), static_cast<FT_Angle>(other)));
+                ++differenceCases;
+            }
+        }
+    }
+    for (const auto boundary : std::array<std::pair<std::int64_t, std::int64_t>, 4>{
+             std::pair{INT64_MIN, -16252928ll}, std::pair{INT64_MAX, 16252927ll},
+             std::pair{INT64_MIN + 1, -16252927ll}, std::pair{INT64_MAX - 1, 16252926ll}}) {
+        Require(FT_Cos_nid_postfix(boundary.first) == FT_Cos(static_cast<FT_Angle>(boundary.second)));
+        Require(FT_Sin_nid_postfix(boundary.first) == FT_Sin(static_cast<FT_Angle>(boundary.second)));
+        Require(FT_Tan_nid_postfix(boundary.first) == FT_Tan_nid_postfix(boundary.second));
+        FT_Vector expected{};
+        GuestVector actual{};
+        FT_Vector_Unit(&expected, static_cast<FT_Angle>(boundary.second));
+        FT_Vector_Unit_nid_postfix(&actual, boundary.first);
+        Require(actual.x == expected.x && actual.y == expected.y);
+        ++scalarCases;
+        ++vectorCases;
+    }
+    FT_Vector_Unit_nid_postfix(nullptr, INT64_MIN);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MIN, INT64_MIN + 1) == 1);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MAX, INT64_MAX - 1) == -1);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MIN, INT64_MIN) == 0);
+    Require(FT_Angle_Diff_nid_postfix(INT64_MAX, INT64_MAX) == 0);
+    for (const auto pair : std::array<std::pair<std::int64_t, std::int64_t>, 4>{
+             std::pair{INT64_MIN, INT64_MAX}, std::pair{INT64_MAX, INT64_MIN}, std::pair{INT64_MIN, 0ll}, std::pair{0ll, INT64_MIN}}) {
+        if (pair.first == 0) {
+            Require(FT_Angle_Diff_nid_postfix(pair.first, pair.second) == FT_Angle_Diff_nid_postfix(0, -16252928));
+        } else {
+            Require(ThrowsWith([&] { FT_Angle_Diff_nid_postfix(pair.first, pair.second); }, "FT_Angle_Diff: overflowing signed angle subtraction"));
+        }
+    }
+    const auto font = SquareGlyphFont('A', 700);
+    GuestLibrary* library = nullptr;
+    FT_Library oracle = nullptr;
+    GuestFaceRec* face = nullptr;
+    FT_Face native = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&oracle) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face(oracle, font.data(), static_cast<FT_Long>(font.size()), 0, &native) == 0);
+    int rendered = 0;
+    for (const unsigned pixels : {32u, 64u}) {
+        Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, pixels) == FT_Set_Pixel_Sizes(native, 0, pixels));
+        for (const FT_Angle angle : {0L, 30L << 16, 45L << 16, 90L << 16, 135L << 16}) {
+            Require(FT_Load_Char_nid_postfix(face, 'A', FT_LOAD_DEFAULT) == FT_Load_Char(native, 'A', FT_LOAD_DEFAULT));
+            GuestVector unit{};
+            FT_Vector_Unit_nid_postfix(&unit, angle + circle * 100000000000ll);
+            for (unsigned point = 0; point < face->glyph->outline.n_points; ++point) {
+                auto& value = face->glyph->outline.points[point];
+                const auto x = static_cast<FT_Long>(value.x);
+                const auto y = static_cast<FT_Long>(value.y);
+                value = {FT_MulFix(x, static_cast<FT_Long>(unit.x)) - FT_MulFix(y, static_cast<FT_Long>(unit.y)),
+                         FT_MulFix(x, static_cast<FT_Long>(unit.y)) + FT_MulFix(y, static_cast<FT_Long>(unit.x))};
+            }
+            FT_Matrix matrix{FT_Cos(angle), -FT_Sin(angle), FT_Sin(angle), FT_Cos(angle)};
+            FT_Outline_Transform(&native->glyph->outline, &matrix);
+            Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL));
+            SlotMatches(face->glyph, native->glyph);
+            ++rendered;
+        }
+    }
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(oracle) == 0);
+    std::printf("FreeType trigonometry: %d scalar cases, %d vectors, %d angle differences, 68 LP64 tangent goldens, %d rendered glyphs\n",
+                scalarCases, vectorCases, differenceCases, rendered);
+}
+
 struct Finalizers {
     std::vector<int> calls;
 };
 
+static std::vector<unsigned char> CidMetadataFont(bool keyed, const std::string& registry, const std::string& ordering,
+                                                int supplement, unsigned cid) {
+    const auto index = [](const std::vector<std::vector<unsigned char>>& objects) {
+        std::vector<unsigned char> result;
+        Put16(result, objects.size());
+        if (objects.empty()) return result;
+        result.insert(result.end(), {1, 1});
+        unsigned offset = 1;
+        for (const auto& object : objects) {
+            offset += object.size();
+            Require(offset < 256);
+            result.push_back(static_cast<unsigned char>(offset));
+        }
+        for (const auto& object : objects) result.insert(result.end(), object.begin(), object.end());
+        return result;
+    };
+    const auto integer = [](std::vector<unsigned char>& dict, int value) {
+        dict.push_back(29);
+        Put32(dict, static_cast<std::uint32_t>(value));
+    };
+    const auto bytes = [](const std::string& text) { return std::vector<unsigned char>(text.begin(), text.end()); };
+    std::array<int, 5> offsets{};
+    std::vector<unsigned char> font;
+    for (unsigned pass = 0; pass < 2; ++pass) {
+        std::vector<unsigned char> top;
+        for (const int value : {0, 0, 700, 800}) integer(top, value);
+        top.push_back(5);
+        if (keyed) {
+            for (const int value : {391, 392, supplement}) integer(top, value);
+            top.insert(top.end(), {12, 30});
+            integer(top, cid + 1);
+            top.insert(top.end(), {12, 34});
+        }
+        integer(top, offsets[0]); top.push_back(15);
+        integer(top, offsets[1]); top.push_back(17);
+        if (keyed) {
+            integer(top, offsets[3]); top.insert(top.end(), {12, 36});
+            integer(top, offsets[2]); top.insert(top.end(), {12, 37});
+        }
+        font = {1, 0, 4, 4};
+        const auto append = [&](const std::vector<std::vector<unsigned char>>& objects) {
+            const auto data = index(objects);
+            font.insert(font.end(), data.begin(), data.end());
+        };
+        append({bytes(keyed ? "TestCID" : "TestNamed")});
+        append({top});
+        append({bytes(registry), bytes(ordering)});
+        append({});
+        offsets[0] = static_cast<int>(font.size());
+        font.push_back(0); Put16(font, cid);
+        offsets[2] = static_cast<int>(font.size());
+        font.insert(font.end(), {0, 0, 0});
+        offsets[1] = static_cast<int>(font.size());
+        append({{248, 236, 14}, {248, 236, 239, 139, 21, 248, 136, 139, 139, 249, 80, 252, 136, 139, 139, 253, 80, 5, 14}});
+        offsets[3] = static_cast<int>(font.size());
+        std::vector<unsigned char> privateDict;
+        integer(privateDict, 0); integer(privateDict, offsets[4]); privateDict.push_back(18);
+        append({privateDict});
+        offsets[4] = static_cast<int>(font.size());
+    }
+    return font;
+}
+
+static bool SameCidString(const char* a, const char* b) { return a && b ? std::strcmp(a, b) == 0 : a == b; }
+
+static unsigned cidQueries = 0;
+
+static void CheckCidQueries(GuestFaceRec* face, FT_Face native, int kind, unsigned cid, int supplement,
+                            const char* registry, const char* ordering) {
+    for (unsigned mask = 0; mask < 8; ++mask) {
+        struct Result {
+            std::uint64_t before = 0x123456789ABCDEF0;
+            const char* registry = "registry sentinel";
+            const char* ordering = "ordering sentinel";
+            std::int32_t supplement = 0x12345678;
+            std::uint32_t after = 0xFEDCBA98;
+        } actual, expected;
+        const int error = FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, mask & 1 ? &actual.registry : nullptr,
+                            mask & 2 ? &actual.ordering : nullptr, mask & 4 ? &actual.supplement : nullptr);
+        Require(error == FT_Get_CID_Registry_Ordering_Supplement(native, mask & 1 ? &expected.registry : nullptr,
+                            mask & 2 ? &expected.ordering : nullptr, mask & 4 ? &expected.supplement : nullptr));
+        Require(error == (kind > 0 ? 0 : FT_Err_Invalid_Argument));
+        Require(SameCidString(actual.registry, expected.registry) && SameCidString(actual.ordering, expected.ordering));
+        Require(actual.supplement == expected.supplement && actual.before == 0x123456789ABCDEF0 && actual.after == 0xFEDCBA98);
+        if (mask & 1) Require(SameCidString(actual.registry, kind > 0 ? registry : nullptr));
+        if (mask & 2) Require(SameCidString(actual.ordering, kind > 0 ? ordering : nullptr));
+        if (mask & 4) Require(actual.supplement == (kind > 0 ? supplement : 0));
+        ++cidQueries;
+    }
+    const char* alias = "sentinel";
+    const char* nativeAlias = "sentinel";
+    Require(FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, &alias, &alias, nullptr) ==
+            FT_Get_CID_Registry_Ordering_Supplement(native, &nativeAlias, &nativeAlias, nullptr));
+    Require(SameCidString(alias, nativeAlias) && SameCidString(alias, kind > 0 ? ordering : nullptr));
+    ++cidQueries;
+    for (const bool output : {false, true}) {
+        struct Result { std::uint8_t before = 0x12; std::uint8_t value = 0xA5; std::array<std::uint8_t, 3> after{0x34, 0x56, 0x78}; } actual, expected;
+        const int error = FT_Get_CID_Is_Internally_CID_Keyed_nid_postfix(face, output ? &actual.value : nullptr);
+        Require(error == FT_Get_CID_Is_Internally_CID_Keyed(native, output ? &expected.value : nullptr));
+        Require(error == (kind >= 0 ? 0 : FT_Err_Invalid_Argument));
+        Require(actual.value == expected.value && (!output || actual.value == (kind > 0 ? 1 : 0)));
+        Require(actual.before == 0x12 && actual.after == expected.after);
+        ++cidQueries;
+        for (const unsigned glyph : {0u, 1u, 2u, 41u, 65535u, UINT32_MAX}) {
+            struct Mapping { std::uint32_t before = 0x12345678; std::uint32_t value = 0xDEADBEEF; std::uint32_t after = 0x87654321; } actualCid, nativeCid;
+            const int mappingError = FT_Get_CID_From_Glyph_Index_nid_postfix(face, glyph, output ? &actualCid.value : nullptr);
+            Require(mappingError == FT_Get_CID_From_Glyph_Index(native, glyph, output ? &nativeCid.value : nullptr));
+            Require(mappingError == (kind > 0 && glyph < 2 ? 0 : FT_Err_Invalid_Argument));
+            Require(actualCid.value == nativeCid.value && (!output || actualCid.value == (mappingError == 0 && glyph == 1 ? cid : 0)));
+            Require(actualCid.before == 0x12345678 && actualCid.after == 0x87654321);
+            ++cidQueries;
+        }
+    }
+}
+
+static void CheckCidMetadata() {
+    CheckCidQueries(nullptr, nullptr, -2, 0, 0, nullptr, nullptr);
+    struct Fixture { std::vector<unsigned char> bytes; int kind; unsigned cid; int supplement; const char* registry; const char* ordering; unsigned renderGlyph; };
+    const std::array<Fixture, 4> fixtures{{
+        {CidMetadataFont(true, "Adobe", "Identity", 7, 41), 1, 41, 7, "Adobe", "Identity", 41},
+        {CidMetadataFont(true, "TestRegistry", "TestOrdering", 9, 65535), 1, 65535, 9, "TestRegistry", "TestOrdering", 65535},
+        {CidMetadataFont(false, "Adobe", "Identity", 0, 41), 0, 0, 0, nullptr, nullptr, 1},
+        {SquareGlyphFont('A', 700), -1, 0, 0, nullptr, nullptr, 1}}};
+    for (const auto& fixture : fixtures) {
+        FreeType::GuestLibrary* library = nullptr;
+        GuestFaceRec* face = nullptr;
+        FT_Library nativeLibrary = nullptr;
+        FT_Face native = nullptr;
+        Require(FT_Init_FreeType_nid_postfix(&library) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+        Require(FT_New_Memory_Face_nid_postfix(library, fixture.bytes.data(), fixture.bytes.size(), 0, &face) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, fixture.bytes.data(), static_cast<FT_Long>(fixture.bytes.size()), 0, &native) == 0);
+        CheckCidQueries(face, native, fixture.kind, fixture.cid, fixture.supplement, fixture.registry, fixture.ordering);
+        const char* registry = nullptr;
+        const char* ordering = nullptr;
+        if (fixture.kind > 0) Require(FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, &registry, &ordering, nullptr) == 0);
+        Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 32) == 0 && FT_Set_Pixel_Sizes(native, 0, 32) == 0);
+        Require(FT_Load_Glyph_nid_postfix(face, fixture.renderGlyph, FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        Require(FT_Load_Glyph(native, fixture.renderGlyph, FT_LOAD_NO_HINTING | FT_LOAD_NO_BITMAP) == 0);
+        Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == 0 && FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL) == 0);
+        SlotMatches(face->glyph, native->glyph);
+        Require(face->glyph->bitmap.width > 0 && face->glyph->bitmap.rows > 0);
+        if (fixture.kind > 0) {
+            const char* againRegistry = nullptr;
+            const char* againOrdering = nullptr;
+            Require(FT_Get_CID_Registry_Ordering_Supplement_nid_postfix(face, &againRegistry, &againOrdering, nullptr) == 0);
+            Require(registry == againRegistry && ordering == againOrdering);
+            Require(SameCidString(registry, fixture.registry) && SameCidString(ordering, fixture.ordering));
+        }
+        Require(FT_Done_Face_nid_postfix(face) == 0 && FT_Done_Face(native) == 0);
+        Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+    }
+    std::printf("FreeType CID metadata: %u query scenarios, 4 fonts and 4 rendered glyphs passed\n", cidQueries);
+}
+
 static void NativeSlotFinalizer(void* object) {
     auto* slot = static_cast<FT_GlyphSlot>(object);
     Require(slot->face->glyph == nullptr);
@@ -141,16 +672,109 @@ static void SetFinalizers(GuestFaceRec* face, Finalizers& events) {
     face->size->generic = {&events, GuestSizeFinalizer};
 }
 
+static void CheckTransforms(const std::vector<unsigned char>& font) {
+    FT_Library native = nullptr;
+    FT_Face host = nullptr;
+    FT_Face nativeOther = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
+    GuestFaceRec* face = nullptr;
+    GuestFaceRec* other = nullptr;
+    Require(FT_Init_FreeType(&native) == 0 && FT_Init_FreeType_nid_postfix(&library) == 0);
+    Require(FT_New_Memory_Face(native, font.data(), static_cast<FT_Long>(font.size()), 0, &host) == 0);
+    Require(FT_New_Memory_Face(native, font.data(), static_cast<FT_Long>(font.size()), 0, &nativeOther) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &face) == 0);
+    Require(FT_New_Memory_Face_nid_postfix(library, font.data(), font.size(), 0, &other) == 0);
+    Require(FT_Set_Pixel_Sizes(host, 0, 100) == 0 && FT_Set_Pixel_Sizes_nid_postfix(face, 0, 100) == 0);
+    Require(FT_Set_Pixel_Sizes(nativeOther, 0, 100) == 0 && FT_Set_Pixel_Sizes_nid_postfix(other, 0, 100) == 0);
+    const std::array matrices{
+        GuestMatrix{65536, 0, 0, 65536}, GuestMatrix{0, -65536, 65536, 0}, GuestMatrix{0, 65536, -65536, 0},
+        GuestMatrix{-65536, 0, 0, 65536}, GuestMatrix{131072, 0, 0, 32768}, GuestMatrix{65536, 16384, -8192, 65536},
+        GuestMatrix{0, 0, 0, 0}
+    };
+    const std::array deltas{GuestVector{0, 0}, GuestVector{64, -128}, GuestVector{31, -63}, GuestVector{-96, 192}};
+    std::size_t comparisons = 0;
+    for (std::size_t m = 0; m <= matrices.size(); ++m) {
+        for (std::size_t d = 0; d <= deltas.size(); ++d) {
+            GuestMatrix input = m < matrices.size() ? matrices[m] : matrices[0];
+            GuestVector delta = d < deltas.size() ? deltas[d] : deltas[0];
+            FT_Matrix matrix{static_cast<FT_Fixed>(input.xx), static_cast<FT_Fixed>(input.xy), static_cast<FT_Fixed>(input.yx), static_cast<FT_Fixed>(input.yy)};
+            FT_Vector translation{static_cast<FT_Pos>(delta.x), static_cast<FT_Pos>(delta.y)};
+            std::array<unsigned char, sizeof(GuestGlyphSlotRec)> savedSlot{};
+            std::array<unsigned char, sizeof(GuestSizeRec)> savedSize{};
+            std::memcpy(savedSlot.data(), face->glyph, savedSlot.size());
+            std::memcpy(savedSize.data(), face->size, savedSize.size());
+            FT_Set_Transform_nid_postfix(face, m < matrices.size() ? &input : nullptr, d < deltas.size() ? &delta : nullptr);
+
+            FT_Set_Transform(host, m < matrices.size() ? &matrix : nullptr, d < deltas.size() ? &translation : nullptr);
+            Require(std::memcmp(savedSlot.data(), face->glyph, savedSlot.size()) == 0);
+            Require(std::memcmp(savedSize.data(), face->size, savedSize.size()) == 0);
+            Require(input.xx == matrix.xx && input.xy == matrix.xy && input.yx == matrix.yx && input.yy == matrix.yy);
+            Require(delta.x == translation.x && delta.y == translation.y);
+            input = matrices[0];
+            delta = deltas[0];
+            for (const auto flags : std::array<std::int32_t, 3>{FT_LOAD_DEFAULT, FT_LOAD_IGNORE_TRANSFORM, FT_LOAD_RENDER}) {
+                for (const std::uint32_t glyph : {0u, 1u}) {
+                    Require(FT_Load_Glyph_nid_postfix(face, glyph, flags) == FT_Load_Glyph(host, glyph, flags));
+                    SlotMatches(face->glyph, host->glyph);
+                    if (face->glyph->format == FT_GLYPH_FORMAT_OUTLINE) {
+                        Require(FT_Render_Glyph_nid_postfix(face->glyph, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(host->glyph, FT_RENDER_MODE_NORMAL));
+                        SlotMatches(face->glyph, host->glyph);
+                    }
+                    ++comparisons;
+                }
+            }
+            Require(FT_Load_Glyph_nid_postfix(other, 1, FT_LOAD_DEFAULT) == FT_Load_Glyph(nativeOther, 1, FT_LOAD_DEFAULT));
+            SlotMatches(other->glyph, nativeOther->glyph);
+        }
+    }
+    GuestMatrix rejected{65536, 0, 0, 65536};
+    GuestVector rejectedDelta{};
+    const auto loadUnchanged = [&] {
+        Require(FT_Load_Glyph_nid_postfix(face, 1, FT_LOAD_DEFAULT) == FT_Load_Glyph(host, 1, FT_LOAD_DEFAULT));
+        SlotMatches(face->glyph, host->glyph);
+    };
+    if constexpr (sizeof(FT_Long) < sizeof(std::int64_t)) {
+        for (const auto value : std::array<std::int64_t, 5>{-0x80000001ll, 0x80000000ll, 0x100000000ll,
+                                                          std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max()}) {
+            for (auto member : {&GuestMatrix::xx, &GuestMatrix::xy, &GuestMatrix::yx, &GuestMatrix::yy}) {
+                rejected = matrices[0];
+                rejected.*member = value;
+                Require(ThrowsWith([&] { FT_Set_Transform_nid_postfix(face, &rejected, nullptr); },
+                                   "FT_Set_Transform: a component outside the host FT_Long range is not implemented"));
+                loadUnchanged();
+            }
+            for (auto member : {&GuestVector::x, &GuestVector::y}) {
+                rejectedDelta = {};
+                rejectedDelta.*member = value;
+                Require(ThrowsWith([&] { FT_Set_Transform_nid_postfix(face, &matrices[1], &rejectedDelta); },
+                                   "FT_Set_Transform: a component outside the host FT_Long range is not implemented"));
+                loadUnchanged();
+            }
+        }
+    }
+    rejected.xx = std::numeric_limits<std::int64_t>::max();
+    rejectedDelta.x = std::numeric_limits<std::int64_t>::min();
+    FT_Set_Transform_nid_postfix(nullptr, &rejected, &rejectedDelta);
+    FT_Set_Transform_nid_postfix(nullptr, nullptr, nullptr);
+
+    Require(FT_Done_FreeType_nid_postfix(library) == 0 && FT_Done_FreeType(native) == 0);
+    std::printf("FT_Set_Transform: %zu native glyph and bitmap comparisons\n", comparisons);
+}
+
 int main() {
     const auto root = std::filesystem::temp_directory_path() / ("anyps5_guest_freetype-" + std::to_string(std::random_device{}()));
     std::filesystem::create_directories(root / "app0");
+    CheckGasp();
+    Trigonometry();
     const std::vector<unsigned char> font = SquareGlyphFont('A', 700);
     {
         std::ofstream file(root / "app0" / "font.ttf", std::ios::binary);
         file.write(reinterpret_cast<const char*>(font.data()), static_cast<std::streamsize>(font.size()));
     }
     const auto previous = std::filesystem::current_path();
+    CheckCidMetadata();
     std::filesystem::current_path(root);
+    CheckOutlineOrientation();
 
     FT_Library hostLibrary = nullptr;
     Require(FT_Init_FreeType(&hostLibrary) == 0);
@@ -161,7 +785,7 @@ int main() {
     Require(secondFace != 0);
 
     Require(FT_Init_FreeType_nid_postfix(nullptr) == FT_Err_Invalid_Argument);
-    void* library = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
     Require(FT_Init_FreeType_nid_postfix(&library) == 0 && library != nullptr);
     Require(FT_Done_FreeType_nid_postfix(nullptr) == FT_Err_Invalid_Library_Handle);
     Require(FT_Done_Face_nid_postfix(nullptr) == FT_Err_Invalid_Face_Handle);
@@ -191,6 +815,8 @@ int main() {
     Require(FT_New_Memory_Face_nid_postfix(library, font.data(), fontSize, -1, &probe) == 0 && probe != nullptr);
     Require(probe->num_faces == nativeProbe->num_faces && probe->face_index == nativeProbe->face_index);
     Require((probe->glyph == nullptr) == (nativeProbe->glyph == nullptr) && (probe->size == nullptr) == (nativeProbe->size == nullptr));
+    Require(FT_Set_Char_Size_nid_postfix(probe, std::numeric_limits<std::int64_t>::max(), 0, 0, 0) ==
+            FT_Set_Char_Size(nativeProbe, 64, 64, 72, 72));
     Finalizers nativeProbeEvents;
     Finalizers guestProbeEvents;
     nativeProbe->generic = {&nativeProbeEvents, NativeFaceFinalizer};
@@ -234,6 +860,75 @@ int main() {
     Require(guestMetrics.x_ppem == 100 && guestMetrics.y_ppem == 100 && guestMetrics.x_scale == metrics.x_scale && guestMetrics.y_scale == metrics.y_scale);
     Require(guestMetrics.ascender == metrics.ascender && guestMetrics.descender == metrics.descender && guestMetrics.height == metrics.height && guestMetrics.max_advance == metrics.max_advance);
 
+    GuestVector kerning{123, 456};
+    Require(FT_Get_Kerning_nid_postfix(nullptr, 1, 1, FT_KERNING_DEFAULT, &kerning) == FT_Err_Invalid_Face_Handle);
+    Require(kerning.x == 123 && kerning.y == 456);
+    Require(FT_Get_Kerning_nid_postfix(nullptr, 1, 1, FT_KERNING_DEFAULT, nullptr) == FT_Err_Invalid_Face_Handle);
+    Require(FT_Get_Kerning_nid_postfix(face, 1, 1, FT_KERNING_DEFAULT, nullptr) == FT_Err_Invalid_Argument);
+    Require(FT_Get_Kerning_nid_postfix(face, 1, 1, FT_KERNING_DEFAULT, &kerning) == 0);
+    Require(kerning.x == 0 && kerning.y == 0);
+
+    auto kernFont = font;
+    const std::uint32_t kernOffset = static_cast<std::uint32_t>(kernFont.size()) + 16;
+    kernFont[5] = 8;
+    kernFont[7] = 128;
+    kernFont[9] = 3;
+    kernFont[11] = 0;
+    for (std::size_t entry = 12; entry < 12 + 7 * 16; entry += 16) {
+        const std::uint32_t offset = (static_cast<std::uint32_t>(kernFont[entry + 8]) << 24) |
+            (static_cast<std::uint32_t>(kernFont[entry + 9]) << 16) |
+            (static_cast<std::uint32_t>(kernFont[entry + 10]) << 8) | kernFont[entry + 11];
+        std::vector<unsigned char> adjusted;
+        Put32(adjusted, offset + 16);
+        std::memcpy(kernFont.data() + entry + 8, adjusted.data(), 4);
+    }
+    std::vector<unsigned char> kernEntry{'k', 'e', 'r', 'n'};
+    Put32(kernEntry, 0);
+    Put32(kernEntry, kernOffset);
+    Put32(kernEntry, 24);
+    kernFont.insert(kernFont.begin() + 12 + 5 * 16, kernEntry.begin(), kernEntry.end());
+    PutAll16(kernFont, {0, 1, 0, 20, 1, 1, 6, 0, 0, 1, 1, -73});
+    {
+        std::ofstream file(root / "app0" / "kern.ttf", std::ios::binary);
+        file.write(reinterpret_cast<const char*>(kernFont.data()), static_cast<std::streamsize>(kernFont.size()));
+    }
+    FT_Face kernHost = nullptr;
+    GuestFaceRec* kernFace = nullptr;
+    Require(FT_New_Memory_Face(hostLibrary, kernFont.data(), static_cast<FT_Long>(kernFont.size()), 0, &kernHost) == 0);
+    Require(FT_New_Face_nid_postfix(library, "/app0/kern.ttf", 0, &kernFace) == 0);
+    Require(FT_HAS_KERNING(kernHost));
+    const unsigned modes[] = {FT_KERNING_DEFAULT, FT_KERNING_UNFITTED, FT_KERNING_UNSCALED, 99};
+    for (const unsigned size : {100u, 12u}) {
+        Require(FT_Set_Pixel_Sizes_nid_postfix(kernFace, 0, size) == 0 && FT_Set_Pixel_Sizes(kernHost, 0, size) == 0);
+        for (const unsigned mode : modes) {
+            FT_Vector expected{};
+            Require(FT_Get_Kerning(kernHost, 1, 1, mode, &expected) == 0);
+            kerning = {123, 456};
+            Require(FT_Get_Kerning_nid_postfix(kernFace, 1, 1, mode, &kerning) == 0);
+            Require(kerning.x == expected.x && kerning.y == expected.y && kerning.y == 0);
+            if (mode == FT_KERNING_UNSCALED) Require(kerning.x == -73);
+            if (size == 100 && mode == FT_KERNING_DEFAULT) Require(kerning.x == -448);
+            if (size == 100 && mode == FT_KERNING_UNFITTED) Require(kerning.x == -467);
+            for (const unsigned leftGlyph : {0x10001u, 0x7FFF0001u}) {
+                kerning = {123, 456};
+                Require(FT_Get_Kerning_nid_postfix(kernFace, leftGlyph, 1, mode, &kerning) == 0);
+                Require(kerning.x == 0 && kerning.y == 0);
+            }
+            kerning = {123, 456};
+            Require(FT_Get_Kerning_nid_postfix(kernFace, 1, 0x10001u, mode, &kerning) == 0);
+            Require(kerning.x == expected.x && kerning.y == expected.y);
+        }
+    }
+    for (const unsigned glyph : {0u, 2u, 0xFFFFFFFFu}) {
+        kerning = {123, 456};
+        Require(FT_Get_Kerning_nid_postfix(kernFace, glyph, 1, FT_KERNING_UNSCALED, &kerning) == 0);
+        Require(kerning.x == 0 && kerning.y == 0);
+        kerning = {123, 456};
+        Require(FT_Get_Kerning_nid_postfix(kernFace, 1, glyph, FT_KERNING_UNSCALED, &kerning) == 0);
+        Require(kerning.x == 0 && kerning.y == 0);
+    }
+    FT_Done_Face(kernHost);
+
     Require(FT_Get_Char_Index_nid_postfix(face, 'A') == 1 && FT_Get_Char_Index_nid_postfix(face, 'B') == 0);
     Require(FT_Get_Char_Index_nid_postfix(face, 0x100000041ull) == 1);
     Require(FT_Get_Char_Index_nid_postfix(nullptr, 'A') == 0);
@@ -302,6 +997,64 @@ int main() {
     slot->outline.points = original;
     Require(FT_Render_Glyph_nid_postfix(slot, FT_RENDER_MODE_NORMAL) == 0 && slot->bitmap_left == 10);
 
+    {
+        struct Request {
+            std::int64_t width;
+            std::int64_t height;
+            std::uint32_t horizontal;
+            std::uint32_t vertical;
+        };
+        const std::array requests{
+            Request{0, 0, 0, 0}, Request{0, 12 * 64, 0, 0}, Request{12 * 64, 0, 0, 0},
+            Request{12 * 64, 18 * 64, 96, 144}, Request{12 * 64 + 32, 12 * 64 + 32, 72, 72},
+            Request{1, 63, 72, 72}, Request{-1, -100, 0, 0}, Request{0, -100, 96, 0},
+            Request{12 * 64, 18 * 64, 0, 144}, Request{12 * 64, 18 * 64, 96, 0},
+            Request{65535ll * 64, 64, 72, 72}, Request{65536ll * 64, 64, 72, 72},
+            Request{64, 65536ll * 64, 72, 72},
+            Request{18 * 64, 12 * 64, 72, 72}
+        };
+        std::size_t successes = 0;
+        std::size_t failures = 0;
+        for (const auto& request : requests) {
+            std::array<unsigned char, sizeof(GuestGlyphSlotRec)> previousSlot{};
+            std::memcpy(previousSlot.data(), face->glyph, previousSlot.size());
+            const auto expected = FT_Set_Char_Size(host, static_cast<FT_F26Dot6>(request.width), static_cast<FT_F26Dot6>(request.height),
+                                                   request.horizontal, request.vertical);
+            Require(FT_Set_Char_Size_nid_postfix(face, request.width, request.height, request.horizontal, request.vertical) == expected);
+            Require(std::memcmp(previousSlot.data(), face->glyph, previousSlot.size()) == 0);
+            expected == 0 ? ++successes : ++failures;
+            SizeMatches(face, host);
+            Require(FT_Load_Char_nid_postfix(face, 'A', FT_LOAD_DEFAULT) == FT_Load_Char(host, 'A', FT_LOAD_DEFAULT));
+            SlotMatches(face->glyph, host->glyph);
+        }
+        Require(successes != 0 && failures != 0);
+        for (const auto value : std::array<std::int64_t, 2>{std::numeric_limits<std::int64_t>::min(), -0x80000001ll}) {
+            Require(FT_Set_Char_Size_nid_postfix(face, value, 0, 0, 0) == FT_Set_Char_Size(host, 64, 64, 0, 0));
+            SizeMatches(face, host);
+            Require(FT_Set_Char_Size_nid_postfix(face, 0, value, 0, 0) == 0);
+            SizeMatches(face, host);
+        }
+        for (const auto value : {std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max()}) {
+            Require(FT_Set_Char_Size_nid_postfix(nullptr, value, value, 0, 0) == FT_Err_Invalid_Face_Handle);
+        }
+        if constexpr (sizeof(FT_F26Dot6) < sizeof(std::int64_t)) {
+            for (const auto value : std::array<std::int64_t, 4>{0x7FFFFFFFll, 0x80000000ll, 0x100000040ll, std::numeric_limits<std::int64_t>::max()}) {
+                for (const bool width : {false, true}) {
+                    Require(ThrowsWith([&] { FT_Set_Char_Size_nid_postfix(face, width ? value : 64, width ? 64 : value, 72, 72); },
+                                       "FT_Set_Char_Size: a character size or resolution outside the host arithmetic range is not implemented"));
+                    SizeMatches(face, host);
+                }
+            }
+            Require(ThrowsWith([&] { FT_Set_Char_Size_nid_postfix(face, 64, 64, std::numeric_limits<std::uint32_t>::max(), 72); },
+                               "FT_Set_Char_Size: a character size or resolution outside the host arithmetic range is not implemented"));
+            SizeMatches(face, host);
+        }
+        Require(FT_Set_Char_Size_nid_postfix(memoryFace, 0, 48 * 64, 0, 144) == 0);
+        Require(memoryFace->size->metrics.y_ppem == 96 && face->size->metrics.y_ppem == 1);
+        Require(FT_Set_Pixel_Sizes_nid_postfix(face, 0, 100) == 0 && FT_Set_Pixel_Sizes(host, 0, 100) == 0);
+        std::printf("FT_Set_Char_Size: %zu native request comparisons, %zu successes, %zu errors\n", requests.size(), successes, failures);
+    }
+
     Finalizers nativeDone;
     Finalizers guestDone;
     SetFinalizers(host, nativeDone);
@@ -325,7 +1078,7 @@ int main() {
     SetFinalizers(memoryFace, guestSecondEvents);
     Require(FT_Done_FreeType(hostLibrary) == 0);
 
-    void* independent = nullptr;
+    FreeType::GuestLibrary* independent = nullptr;
     GuestFaceRec* independentFace = nullptr;
     Require(FT_Init_FreeType_nid_postfix(&independent) == 0);
     Require(FT_New_Memory_Face_nid_postfix(independent, font.data(), fontSize, 0, &independentFace) == 0);
@@ -337,8 +1090,9 @@ int main() {
     Require(FT_Get_Char_Index_nid_postfix(independentFace, 'A') == 1);
     Require(FT_Done_FreeType_nid_postfix(independent) == 0 && independentEvents.calls == nativeDone.calls);
 
-    void* empty = nullptr;
+    FreeType::GuestLibrary* empty = nullptr;
     Require(FT_Init_FreeType_nid_postfix(&empty) == 0 && FT_Done_FreeType_nid_postfix(empty) == 0);
+    CheckTransforms(font);
     std::filesystem::current_path(previous);
     std::error_code ignored;
     std::filesystem::remove_all(root, ignored);
diff --git a/core/libs/tests/GuestFreeTypeBitmap.cpp b/core/libs/tests/GuestFreeTypeBitmap.cpp
new file mode 100644
index 0000000000..6a05b55c58
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeBitmap.cpp
@@ -0,0 +1,290 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_BITMAP_H
+#include FT_MODULE_H
+
+#include <cstdint>
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <new>
+#include <stdexcept>
+#include <unordered_set>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType bitmap check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static GuestBitmap Guest(const FT_Bitmap& bitmap) {
+    return {bitmap.rows, bitmap.width, bitmap.pitch, bitmap.buffer, bitmap.num_grays, bitmap.pixel_mode, bitmap.palette_mode, bitmap.palette};
+}
+
+static void Matches(const GuestBitmap& guest, const FT_Bitmap& native, bool comparePadding) {
+    Require(guest.rows == native.rows && guest.width == native.width && guest.pitch == native.pitch);
+    Require(guest.num_grays == native.num_grays && guest.pixel_mode == native.pixel_mode && guest.palette_mode == native.palette_mode);
+    Require(guest.palette == native.palette && (guest.buffer == nullptr) == (native.buffer == nullptr));
+    if (!guest.buffer) return;
+    const auto pitch = static_cast<std::size_t>(native.pitch < 0 ? -native.pitch : native.pitch);
+    const std::size_t width = comparePadding ? pitch : native.width;
+    for (std::uint32_t row = 0; row < native.rows; ++row) {
+        Require(std::memcmp(guest.buffer + row * pitch, native.buffer + row * pitch, width) == 0);
+    }
+}
+
+static void TestFormat(GuestLibrary* library, FT_Library oracle, unsigned char mode, int bits) {
+    constexpr std::uint32_t width = 10;
+    constexpr std::uint32_t rows = 3;
+    const int stride = static_cast<int>((width * bits + 7) / 8) + 2;
+    std::vector<unsigned char> data(rows * static_cast<std::size_t>(stride));
+    for (std::size_t index = 0; index < data.size(); ++index) data[index] = static_cast<unsigned char>(index * 37 + 11);
+    if (mode == FT_PIXEL_MODE_BGRA) {
+        for (std::uint32_t row = 0; row < rows; ++row) {
+            for (std::uint32_t col = 0; col < width; ++col) {
+                unsigned char* pixel = data.data() + row * stride + col * 4;
+                pixel[0] = static_cast<unsigned char>(col * 7);
+                pixel[1] = static_cast<unsigned char>(row * 23);
+                pixel[2] = static_cast<unsigned char>(col * 11);
+                pixel[3] = col == 0 ? 0 : static_cast<unsigned char>(128 + row * 63);
+                if (col == 0) pixel[0] = pixel[1] = pixel[2] = 0;
+            }
+        }
+    }
+    const auto original = data;
+    int palette = 17;
+    for (const int sign : {-1, 1}) {
+        const FT_Bitmap source{rows, width, sign * stride, data.data(), static_cast<unsigned short>(bits < 8 ? 1 << bits : 256), mode, 7, &palette};
+        GuestBitmap guestSource = Guest(source);
+        for (const int flow : {-1, 0, 1}) {
+            FT_Bitmap native{};
+            native.pitch = flow;
+            GuestBitmap target{};
+            target.pitch = flow;
+            Require(FT_Bitmap_Copy_nid_postfix(library, &guestSource, &target) == FT_Bitmap_Copy(oracle, &source, &native));
+            Require(target.buffer != source.buffer && native.buffer != source.buffer && target.buffer != native.buffer);
+            Matches(target, native, true);
+            const GuestBitmap before = target;
+            Require(FT_Bitmap_Copy_nid_postfix(library, &target, &target) == 0);
+            Require(target.buffer == before.buffer && target.pitch == before.pitch);
+            Matches(target, native, true);
+            data[0] ^= 0xFF;
+            Require(target.buffer[flow != 0 && flow != sign ? (rows - 1) * stride : 0] == original[0]);
+            data[0] ^= 0xFF;
+            for (const int alignment : {0, 1, 2, 4, -4}) {
+                Require(FT_Bitmap_Convert_nid_postfix(library, &guestSource, &target, alignment) == FT_Bitmap_Convert(oracle, &source, &native, alignment));
+                Matches(target, native, false);
+                Require(target.pixel_mode == FT_PIXEL_MODE_GRAY && target.rows == rows && target.width == width);
+                Require(target.pitch == (flow < 0 || (flow == 0 && sign < 0) ? -1 : 1) * (alignment == 4 || alignment == -4 ? 12 : 10));
+                Require(data == original);
+            }
+            Require(FT_Bitmap_Done_nid_postfix(library, &target) == FT_Bitmap_Done(oracle, &native));
+            Matches(target, native, true);
+            Require(target.rows == 0 && target.pitch == 0 && target.buffer == nullptr && target.palette == nullptr);
+            Require(FT_Bitmap_Done_nid_postfix(library, &target) == 0);
+        }
+    }
+}
+
+struct Allocations {
+    bool fail = false;
+    std::unordered_set<void*> blocks;
+
+    static void* Allocate(FT_Memory memory, long size) {
+        auto& state = *static_cast<Allocations*>(memory->user);
+        if (state.fail) return nullptr;
+        void* block = std::malloc(static_cast<std::size_t>(size));
+        if (block) Require(state.blocks.insert(block).second);
+        return block;
+    }
+
+    static void Free(FT_Memory memory, void* block) {
+        auto& state = *static_cast<Allocations*>(memory->user);
+        Require(state.blocks.erase(block) == 1);
+        std::free(block);
+    }
+
+    static void* Reallocate(FT_Memory, long, long, void*) {
+        return nullptr;
+    }
+};
+
+static void TestAllocationFailure() {
+    Allocations guestAllocations;
+    Allocations nativeAllocations;
+    FT_MemoryRec_ guestMemory{&guestAllocations, Allocations::Allocate, Allocations::Free, Allocations::Reallocate};
+    FT_MemoryRec_ nativeMemory{&nativeAllocations, Allocations::Allocate, Allocations::Free, Allocations::Reallocate};
+    GuestLibrary library{};
+    FT_Library oracle = nullptr;
+    Require(FT_New_Library(&guestMemory, &library.host) == 0);
+    Require(FT_New_Library(&nativeMemory, &oracle) == 0);
+    const auto guestBase = guestAllocations.blocks.size();
+    const auto nativeBase = nativeAllocations.blocks.size();
+    unsigned char pixels[]{1, 2, 3, 4, 5, 6, 7, 8, 9, 10};
+    const FT_Bitmap source{2, 5, 5, pixels, 256, FT_PIXEL_MODE_GRAY, 0, nullptr};
+    const GuestBitmap guestSource = Guest(source);
+    GuestBitmap target{};
+    FT_Bitmap native{};
+    for (const bool convert : {false, true}) {
+        Require(FT_Bitmap_Copy_nid_postfix(&library, &guestSource, &target) == 0);
+        Require(FT_Bitmap_Copy(oracle, &source, &native) == 0);
+        Require(guestAllocations.blocks.size() == guestBase + 1 && nativeAllocations.blocks.size() == nativeBase + 1);
+        guestAllocations.fail = nativeAllocations.fail = true;
+        const FT_Error expected = convert ? FT_Bitmap_Convert(oracle, &source, &native, 4) : FT_Bitmap_Copy(oracle, &source, &native);
+        const int error = convert ? FT_Bitmap_Convert_nid_postfix(&library, &guestSource, &target, 4) : FT_Bitmap_Copy_nid_postfix(&library, &guestSource, &target);
+        Require(expected == FT_Err_Out_Of_Memory && error == expected);
+        Matches(target, native, false);
+        Require(target.buffer == nullptr && guestAllocations.blocks.size() == guestBase && nativeAllocations.blocks.size() == nativeBase);
+        guestAllocations.fail = nativeAllocations.fail = false;
+    }
+    Require(FT_Bitmap_Convert_nid_postfix(&library, &guestSource, &target, 4) == 0);
+    Require(FT_Bitmap_Convert(oracle, &source, &native, 4) == 0);
+    Matches(target, native, false);
+    Require(FT_Bitmap_Done_nid_postfix(&library, &target) == 0 && FT_Bitmap_Done(oracle, &native) == 0);
+    Require(guestAllocations.blocks.size() == guestBase && nativeAllocations.blocks.size() == nativeBase);
+    Require(FT_Done_Library(library.host) == 0 && FT_Done_Library(oracle) == 0);
+    Require(guestAllocations.blocks.empty() && nativeAllocations.blocks.empty());
+}
+
+struct SlotFinalizer {
+    GuestFace* face;
+    GuestLibrary* library;
+    bool called = false;
+
+    static void Run(void* object) {
+        auto* slot = static_cast<FT_GlyphSlot>(object);
+        auto& state = *static_cast<SlotFinalizer*>(slot->generic.data);
+        Require(slot->face->glyph == nullptr);
+        Require(FT_Load_Glyph_nid_postfix(&state.face->rec, 0, FT_LOAD_DEFAULT) == FT_Err_Invalid_Face_Handle);
+        Require(FT_Bitmap_Done_nid_postfix(state.library, &state.face->slot.bitmap) == 0);
+        Require(slot->bitmap.buffer == nullptr && slot->bitmap.width == 0);
+        state.called = true;
+    }
+};
+
+static void TestGlyphSlot(GuestLibrary* library, FT_Library oracle) {
+    const auto bytes = FontFixture::BuildFont(1, {});
+    GuestFace face;
+    face.library = library;
+    Require(FT_New_Memory_Face(library->host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &face.host) == 0);
+    FT_Face nativeFace = nullptr;
+    Require(FT_New_Memory_Face(oracle, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &nativeFace) == 0);
+    SyncFace(face);
+    unsigned char pixels[]{7, 31, 65, 127, 255, 17, 61, 101, 189, 239};
+    const FT_Bitmap source{2, 5, 5, pixels, 256, FT_PIXEL_MODE_GRAY, 0, nullptr};
+    const GuestBitmap guestSource = Guest(source);
+    auto& target = face.slot.bitmap;
+    auto& native = nativeFace->glyph->bitmap;
+    Require(FT_Bitmap_Copy_nid_postfix(library, &guestSource, &target) == FT_Bitmap_Copy(oracle, &source, &native));
+    Matches(target, native, true);
+    Require(face.host->glyph->bitmap.buffer == target.buffer && face.host->glyph->bitmap.width == 5);
+    GuestBitmap retained{};
+    Require(FT_Bitmap_Copy_nid_postfix(library, &target, &retained) == 0);
+    Require(retained.buffer != target.buffer && std::memcmp(retained.buffer, target.buffer, 10) == 0);
+    Require(FT_Bitmap_Done_nid_postfix(library, &target) == FT_Bitmap_Done(oracle, &native));
+    Require(face.host->glyph->bitmap.buffer == nullptr && face.host->glyph->bitmap.width == 0);
+    Require(FT_Bitmap_Convert_nid_postfix(library, &guestSource, &target, 4) == FT_Bitmap_Convert(oracle, &source, &native, 4));
+    Matches(target, native, false);
+    Require(face.host->glyph->bitmap.buffer == target.buffer && face.host->glyph->bitmap.pitch == 8);
+    Require(FT_Bitmap_Done_nid_postfix(library, &target) == 0 && FT_Bitmap_Done(oracle, &native) == 0);
+    target.rows = 9;
+    target.width = 17;
+    face.host->glyph->bitmap.rows = 9;
+    face.host->glyph->bitmap.width = 17;
+    FT_Bitmap_New_nid_postfix(&target);
+    Require(target.rows == 0 && face.host->glyph->bitmap.rows == 0 && face.host->glyph->bitmap.width == 0);
+    Require(FT_Bitmap_Done_nid_postfix(library, &retained) == 0);
+    Require(FT_Bitmap_Copy_nid_postfix(library, &guestSource, &target) == 0);
+    SlotFinalizer finalizer{&face, library};
+    face.host->glyph->generic = {&finalizer, SlotFinalizer::Run};
+    Require(FT_Done_Face(face.host) == 0 && FT_Done_Face(nativeFace) == 0);
+    Require(finalizer.called);
+}
+
+static void TestReusedStorage(GuestLibrary* library) {
+    const auto bytes = FontFixture::BuildFont(1, {});
+    alignas(GuestFace) std::byte storage[sizeof(GuestFace)]{};
+    auto* face = new (storage) GuestFace;
+    face->library = library;
+    Require(FT_New_Memory_Face(library->host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &face->host) == 0);
+    FT_Face native = face->host;
+    SyncFace(*face);
+    void* address = &face->slot.bitmap;
+    face->~GuestFace();
+    auto* bitmap = new (address) GuestBitmap{};
+    native->glyph->bitmap.width = 73;
+    FT_Bitmap_New_nid_postfix(bitmap);
+    Require(bitmap->width == 0 && native->glyph->bitmap.width == 73);
+    Require(FT_Done_Face(native) == 0);
+}
+
+int main() {
+    GuestLibrary* library = nullptr;
+    FT_Library oracle = nullptr;
+    Require(FT_Init_FreeType_nid_postfix(&library) == 0 && library != nullptr);
+    Require(FT_Init_FreeType(&oracle) == 0);
+
+    GuestBitmap empty{1, 2, 3, nullptr, 4, 5, 6, nullptr};
+    FT_Bitmap_New_nid_postfix(&empty);
+    FT_Bitmap nativeEmpty{};
+    Matches(empty, nativeEmpty, true);
+    Require(empty.rows == 0 && empty.width == 0 && empty.pitch == 0);
+    FT_Bitmap_New_nid_postfix(nullptr);
+    Require(FT_Bitmap_Copy_nid_postfix(nullptr, nullptr, nullptr) == FT_Err_Invalid_Library_Handle);
+    Require(FT_Bitmap_Convert_nid_postfix(nullptr, nullptr, nullptr, 1) == FT_Err_Invalid_Library_Handle);
+    Require(FT_Bitmap_Done_nid_postfix(nullptr, nullptr) == FT_Err_Invalid_Library_Handle);
+    Require(FT_Bitmap_Copy_nid_postfix(library, nullptr, &empty) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Copy_nid_postfix(library, &empty, nullptr) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Convert_nid_postfix(library, nullptr, &empty, 1) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Convert_nid_postfix(library, &empty, nullptr, 1) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Done_nid_postfix(library, nullptr) == FT_Err_Invalid_Argument);
+    Require(FT_Bitmap_Copy_nid_postfix(library, &empty, &empty) == 0);
+
+    for (const auto [mode, bits] : {std::pair{FT_PIXEL_MODE_MONO, 1}, {FT_PIXEL_MODE_GRAY2, 2}, {FT_PIXEL_MODE_GRAY4, 4},
+                                  {FT_PIXEL_MODE_GRAY, 8}, {FT_PIXEL_MODE_LCD, 8}, {FT_PIXEL_MODE_LCD_V, 8}, {FT_PIXEL_MODE_BGRA, 32}}) {
+        TestFormat(library, oracle, static_cast<unsigned char>(mode), bits);
+    }
+    GuestBitmap target{};
+    const GuestBitmap unsupported{0, 0, 0, nullptr, 0, FT_PIXEL_MODE_NONE, 0, nullptr};
+    Require(FT_Bitmap_Copy_nid_postfix(library, &unsupported, &target) == 0);
+    Require(target.buffer == nullptr);
+    Require(FT_Bitmap_Convert_nid_postfix(library, &unsupported, &target, 1) == FT_Err_Invalid_Argument);
+    Require(target.buffer == nullptr && target.width == 0);
+    bool overlapThrew = false;
+    try {
+        FT_Bitmap_Convert_nid_postfix(library, &target, &target, 1);
+    } catch (const std::runtime_error&) {
+        overlapThrew = true;
+    }
+    Require(overlapThrew);
+    unsigned char sharedPixel = 17;
+    GuestBitmap shared{1, 1, 1, &sharedPixel, 256, FT_PIXEL_MODE_GRAY, 0, nullptr};
+    GuestBitmap alias = shared;
+    for (const bool convert : {false, true}) {
+        overlapThrew = false;
+        try {
+            if (convert) FT_Bitmap_Convert_nid_postfix(library, &shared, &alias, 1);
+            else FT_Bitmap_Copy_nid_postfix(library, &shared, &alias);
+        } catch (const std::runtime_error&) {
+            overlapThrew = true;
+        }
+        Require(overlapThrew && sharedPixel == 17 && alias.buffer == &sharedPixel);
+    }
+    Require(FT_Bitmap_Done_nid_postfix(library, &target) == 0);
+    TestAllocationFailure();
+    TestGlyphSlot(library, oracle);
+    TestReusedStorage(library);
+    Require(FT_Done_FreeType(library->host) == 0);
+    delete library;
+    Require(FT_Done_FreeType(oracle) == 0);
+}
diff --git a/core/libs/tests/GuestFreeTypeCharmap.cpp b/core/libs/tests/GuestFreeTypeCharmap.cpp
index 27372b1526..cfa8f479b9 100644
--- a/core/libs/tests/GuestFreeTypeCharmap.cpp
+++ b/core/libs/tests/GuestFreeTypeCharmap.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceFreeType/include/Api.hpp"
 #include "FreeTypeFontFixture.hpp"
 #include "prx/libSceFreeType/include/GuestFreeType.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -19,17 +20,6 @@
 
 using namespace FreeType;
 
-extern "C" {
-int APS5_VABI FT_Init_FreeType_nid_postfix(void**);
-int APS5_VABI FT_New_Face_nid_postfix(void*, const char*, std::int64_t, GuestFaceRec**);
-std::uint32_t APS5_VABI FT_Get_Char_Index_nid_postfix(GuestFaceRec*, std::uint64_t);
-int APS5_VABI FT_Load_Glyph_nid_postfix(GuestFaceRec*, std::uint32_t, std::int32_t);
-int APS5_VABI FT_Select_Charmap_nid_postfix(GuestFaceRec*, std::int32_t);
-int APS5_VABI FT_Set_Charmap_nid_postfix(GuestFaceRec*, GuestCharMapRec*);
-std::uint64_t APS5_VABI FT_Get_First_Char_nid_postfix(GuestFaceRec*, std::uint32_t*);
-std::uint64_t APS5_VABI FT_Get_Next_Char_nid_postfix(GuestFaceRec*, std::uint64_t, std::uint32_t*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "FreeType charmap check failed at line %d\n", line);
@@ -76,7 +66,7 @@ int main() {
     Require(FT_New_Memory_Face(native, font.data(), static_cast<FT_Long>(font.size()), 0, &host) == 0);
     Require(FT_New_Memory_Face(native, font.data(), static_cast<FT_Long>(font.size()), 0, &foreignHost) == 0);
     Require(FT_New_Memory_Face(native, zeroFont.data(), static_cast<FT_Long>(zeroFont.size()), 0, &zeroHost) == 0);
-    void* library = nullptr;
+    FreeType::GuestLibrary* library = nullptr;
     GuestFaceRec* face = nullptr;
     GuestFaceRec* foreign = nullptr;
     GuestFaceRec* zero = nullptr;
diff --git a/core/libs/tests/GuestFreeTypeCharmapInfo.cpp b/core/libs/tests/GuestFreeTypeCharmapInfo.cpp
new file mode 100644
index 0000000000..33c47e7d1c
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeCharmapInfo.cpp
@@ -0,0 +1,119 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_TRUETYPE_TABLES_H
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <stdexcept>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType charmap info check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static std::vector<unsigned char> Font(std::uint16_t language4, std::uint32_t language12) {
+    auto cmap = FontFixture::Words({0, 2, 3, 1, 0, 20, 3, 10, 0, 52});
+    const auto format4 = FontFixture::Words({4, 32, language4, 4, 4, 1, 0, 'A', 0xFFFF, 0, 'A', 0xFFFF, 1 - 'A', 1, 0, 0});
+    const auto format12 = FontFixture::Words({12, 0, 0, 28, static_cast<int>(language12 >> 16), static_cast<int>(language12 & 0xFFFF),
+                                             0, 1, 1, 0xF600, 1, 0xF600, 0, 2});
+    cmap.insert(cmap.end(), format4.begin(), format4.end());
+    cmap.insert(cmap.end(), format12.begin(), format12.end());
+    return FontFixture::BuildFont(3, {{"cmap", cmap}});
+}
+
+struct FacePair {
+    std::vector<unsigned char> bytes;
+    GuestFace guest;
+    FT_Face oracle = nullptr;
+
+    FacePair(GuestLibrary& library, FT_Library nativeLibrary, std::vector<unsigned char> font) : bytes(std::move(font)) {
+        guest.library = &library;
+        Require(FT_New_Memory_Face(library.host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &guest.host) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &oracle) == 0);
+        SyncFace(guest);
+    }
+
+    ~FacePair() {
+        Require(FT_Done_Face(guest.host) == 0);
+        Require(FT_Done_Face(oracle) == 0);
+    }
+};
+
+static void Compare(FacePair& face, std::uint16_t language4, std::uint32_t language12) {
+    Require(face.guest.rec.num_charmaps == 2 && face.oracle->num_charmaps == 2);
+    const auto selected = face.guest.rec.charmap;
+    const auto nativeSelected = face.oracle->charmap;
+    for (int index = 0; index < face.guest.rec.num_charmaps; ++index) {
+        GuestCharMapRec* guest = face.guest.rec.charmaps[index];
+        FT_CharMap native = face.oracle->charmaps[index];
+        Require(FT_Get_Charmap_Index_nid_postfix(guest) == index);
+        Require(FT_Get_Charmap_Index_nid_postfix(guest) == FT_Get_Charmap_Index(native));
+        const auto format = FT_Get_CMap_Format_nid_postfix(guest);
+        Require(format == FT_Get_CMap_Format(native) && (format == 4 || format == 12));
+        const auto language = FT_Get_CMap_Language_ID_nid_postfix(guest);
+        Require(language == FT_Get_CMap_Language_ID(native));
+        Require(language == (format == 4 ? language4 : language12));
+    }
+    Require(face.guest.rec.charmap == selected && face.oracle->charmap == nativeSelected);
+}
+
+template <typename TCall> static bool Unsupported(TCall call) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        return std::string_view(error.what()).starts_with("FreeType: a charmap outside");
+    }
+    return false;
+}
+
+int main() {
+    GuestLibrary library{};
+    FT_Library nativeLibrary = nullptr;
+    Require(FT_Init_FreeType(&library.host) == 0);
+    Require(FT_Init_FreeType(&nativeLibrary) == 0);
+    {
+        FacePair first(library, nativeLibrary, Font(0x0411, 0x80000001u));
+        FacePair second(library, nativeLibrary, Font(0x0412, 0xFFFFFFFFu));
+        Compare(first, 0x0411, 0x80000001u);
+        Compare(second, 0x0412, 0xFFFFFFFFu);
+        for (int index = 0; index < first.guest.rec.num_charmaps; ++index) {
+            Require(FT_Set_Charmap_nid_postfix(&first.guest.rec, first.guest.rec.charmaps[index]) == 0);
+            Require(FT_Set_Charmap(first.oracle, first.oracle->charmaps[index]) == 0);
+            Compare(first, 0x0411, 0x80000001u);
+            Compare(second, 0x0412, 0xFFFFFFFFu);
+        }
+        GuestCharMapRec copied = *first.guest.rec.charmaps[0];
+        Require(Unsupported([&] { FT_Get_Charmap_Index_nid_postfix(&copied); }));
+        Require(Unsupported([&] { FT_Get_CMap_Language_ID_nid_postfix(&copied); }));
+        Require(Unsupported([&] { FT_Get_CMap_Format_nid_postfix(&copied); }));
+        FacePair bitmap(library, nativeLibrary, FontFixture::BitmapFont());
+        Require(!FT_IS_SFNT(bitmap.oracle) && bitmap.guest.rec.num_charmaps == 1);
+        GuestCharMapRec* bitmapMap = bitmap.guest.rec.charmaps[0];
+        Require(FT_Get_Charmap_Index_nid_postfix(bitmapMap) == FT_Get_Charmap_Index(bitmap.oracle->charmaps[0]));
+        Require(FT_Get_CMap_Language_ID_nid_postfix(bitmapMap) == FT_Get_CMap_Language_ID(bitmap.oracle->charmaps[0]));
+        Require(FT_Get_CMap_Language_ID_nid_postfix(bitmapMap) == 0);
+        Require(FT_Get_CMap_Format_nid_postfix(bitmapMap) == FT_Get_CMap_Format(bitmap.oracle->charmaps[0]));
+        Require(FT_Get_CMap_Format_nid_postfix(bitmapMap) == -1);
+        GuestCharMapRec empty{};
+        FT_CharMapRec nativeEmpty{};
+        for (GuestCharMapRec* guest : {static_cast<GuestCharMapRec*>(nullptr), &empty}) {
+            Require(FT_Get_Charmap_Index_nid_postfix(guest) == FT_Get_Charmap_Index(guest ? &nativeEmpty : nullptr));
+            Require(FT_Get_CMap_Language_ID_nid_postfix(guest) == FT_Get_CMap_Language_ID(guest ? &nativeEmpty : nullptr));
+            Require(FT_Get_CMap_Format_nid_postfix(guest) == FT_Get_CMap_Format(guest ? &nativeEmpty : nullptr));
+        }
+    }
+    Require(FT_Done_FreeType(library.host) == 0);
+    Require(FT_Done_FreeType(nativeLibrary) == 0);
+}
\ No newline at end of file
diff --git a/core/libs/tests/GuestFreeTypeFaceInfo.cpp b/core/libs/tests/GuestFreeTypeFaceInfo.cpp
new file mode 100644
index 0000000000..65ca766d9b
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeFaceInfo.cpp
@@ -0,0 +1,85 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_FONT_FORMATS_H
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType face info check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static std::vector<unsigned char> Font(std::uint16_t flags) {
+    std::vector<unsigned char> os2(78, 0);
+    os2[8] = static_cast<unsigned char>(flags >> 8);
+    os2[9] = static_cast<unsigned char>(flags);
+    return FontFixture::BuildFont(3, {{"OS/2", os2}});
+}
+
+struct FacePair {
+    std::vector<unsigned char> bytes;
+    GuestFace guest;
+    FT_Face oracle = nullptr;
+
+    FacePair(GuestLibrary& library, FT_Library nativeLibrary, std::vector<unsigned char> font) : bytes(std::move(font)) {
+        guest.library = &library;
+        Require(FT_New_Memory_Face(library.host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &guest.host) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &oracle) == 0);
+        SyncFace(guest);
+    }
+
+    ~FacePair() {
+        Require(FT_Done_Face(guest.host) == 0);
+        Require(FT_Done_Face(oracle) == 0);
+    }
+};
+
+static const char* Query(FacePair& face, const char* format, std::uint16_t flags) {
+    const char* actual = FT_Get_X11_Font_Format_nid_postfix(&face.guest.rec);
+    const char* expected = FT_Get_X11_Font_Format(face.oracle);
+    Require(actual && expected && std::strcmp(actual, expected) == 0 && std::strcmp(actual, format) == 0);
+    Require(actual == FT_Get_X11_Font_Format(face.guest.host));
+    Require(FT_Get_FSType_Flags_nid_postfix(&face.guest.rec) == FT_Get_FSType_Flags(face.oracle));
+    Require(FT_Get_FSType_Flags_nid_postfix(&face.guest.rec) == flags);
+    return actual;
+}
+
+int main() {
+    GuestLibrary library{};
+    FT_Library nativeLibrary = nullptr;
+    Require(FT_Init_FreeType(&library.host) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+    std::vector<const char*> retained;
+    const char* bitmapFormat = nullptr;
+    {
+        FacePair bitmap(library, nativeLibrary, FontFixture::BitmapFont());
+        bitmapFormat = Query(bitmap, "BDF", 0);
+        for (const std::uint16_t flags : {0, 2, 4, 8, 0x0100, 0x0200, 0x0308, 0x8000, 0xFFFF}) {
+            FacePair face(library, nativeLibrary, Font(flags));
+            retained.push_back(Query(face, "TrueType", flags));
+            Require(Query(bitmap, "BDF", 0) == bitmapFormat);
+        }
+        FacePair missing(library, nativeLibrary, FontFixture::BuildFont(3, {}));
+        Query(missing, "TrueType", 0);
+        GuestFaceRec empty{};
+        for (GuestFaceRec* face : {static_cast<GuestFaceRec*>(nullptr), &empty}) {
+            Require(FT_Get_X11_Font_Format_nid_postfix(face) == FT_Get_X11_Font_Format(nullptr));
+            Require(FT_Get_FSType_Flags_nid_postfix(face) == FT_Get_FSType_Flags(nullptr));
+        }
+    }
+    Require(FT_Done_FreeType(library.host) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+    for (const char* format : retained) Require(std::strcmp(format, "TrueType") == 0);
+    Require(std::strcmp(bitmapFormat, "BDF") == 0);
+}
diff --git a/core/libs/tests/GuestFreeTypeList.cpp b/core/libs/tests/GuestFreeTypeList.cpp
new file mode 100644
index 0000000000..0e93a0d850
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeList.cpp
@@ -0,0 +1,261 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestList.hpp"
+
+#include <array>
+#include <cstdio>
+#include <cstdlib>
+#include <map>
+#include <random>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType list check failed at line %d\n", line);
+        std::abort();
+    }
+}
+
+#define Require(value) Check((value), __LINE__)
+
+constexpr std::size_t Count = 16;
+using Nodes = std::array<FT_ListNodeRec, Count>;
+
+static int Index(FT_ListNode node, const Nodes& nodes) {
+    if (!node) return -1;
+    for (std::size_t i = 0; i < nodes.size(); ++i) if (node == &nodes[i]) return static_cast<int>(i);
+    Require(false);
+    return -2;
+}
+
+struct Lists {
+    FT_ListRec guest{};
+    FT_ListRec native{};
+    Nodes actual{};
+    Nodes expected{};
+    std::array<int, 4> values{11, 22, 33, 44};
+
+    Lists() {
+        for (std::size_t i = 0; i < Count; ++i) actual[i].data = expected[i].data = i % 5 == 0 ? nullptr : &values[i % values.size()];
+    }
+
+    void Match() const {
+        Require(Index(guest.head, actual) == Index(native.head, expected));
+        Require(Index(guest.tail, actual) == Index(native.tail, expected));
+        for (std::size_t i = 0; i < Count; ++i) {
+            Require(Index(actual[i].prev, actual) == Index(expected[i].prev, expected));
+            Require(Index(actual[i].next, actual) == Index(expected[i].next, expected));
+            Require(actual[i].data == expected[i].data);
+        }
+    }
+
+    void Fill() {
+        for (std::size_t i = 0; i < Count; ++i) {
+            FT_List_Add_nid_postfix(&guest, &actual[i]);
+
+            FT_List_Add(&native, &expected[i]);
+        }
+        Match();
+    }
+};
+
+static void Mutations() {
+    Lists lists;
+    std::array<bool, Count> active{};
+    std::array<unsigned, 4> operations{};
+    std::mt19937 random(0x7157);
+    for (unsigned step = 0; step < 2048; ++step) {
+        const auto i = random() % Count;
+        const bool choice = (random() & 1u) != 0;
+        if (active[i]) {
+            if (choice) {
+                FT_List_Up_nid_postfix(&lists.guest, &lists.actual[i]);
+
+                FT_List_Up(&lists.native, &lists.expected[i]);
+                ++operations[3];
+            } else {
+                FT_List_Remove_nid_postfix(&lists.guest, &lists.actual[i]);
+
+                FT_List_Remove(&lists.native, &lists.expected[i]);
+                active[i] = false;
+                ++operations[2];
+            }
+        } else {
+            if (choice) {
+                FT_List_Insert_nid_postfix(&lists.guest, &lists.actual[i]);
+
+                FT_List_Insert(&lists.native, &lists.expected[i]);
+                ++operations[1];
+            } else {
+                FT_List_Add_nid_postfix(&lists.guest, &lists.actual[i]);
+
+                FT_List_Add(&lists.native, &lists.expected[i]);
+                ++operations[0];
+            }
+            active[i] = true;
+        }
+        lists.Match();
+        for (auto& value : lists.values) {
+            Require(Index(FT_List_Find_nid_postfix(&lists.guest, &value), lists.actual) == Index(FT_List_Find(&lists.native, &value), lists.expected));
+        }
+        Require(Index(FT_List_Find_nid_postfix(&lists.guest, nullptr), lists.actual) == Index(FT_List_Find(&lists.native, nullptr), lists.expected));
+        int absent = 123;
+        Require(FT_List_Find_nid_postfix(&lists.guest, &absent) == nullptr);
+    }
+    for (const auto count : operations) Require(count != 0);
+    for (auto operation : {FT_List_Add_nid_postfix, FT_List_Insert_nid_postfix, FT_List_Remove_nid_postfix, FT_List_Up_nid_postfix}) {
+        operation(nullptr, &lists.actual[0]);
+        operation(&lists.guest, nullptr);
+        operation(nullptr, nullptr);
+        lists.Match();
+    }
+    Require(FT_List_Find_nid_postfix(nullptr, nullptr) == nullptr);
+    std::printf("list mutations: 2048 states compared with native FreeType\n");
+}
+
+struct Walk {
+    FT_List list;
+    Nodes* nodes;
+    bool guest;
+    bool remove;
+    std::size_t stop;
+    int error;
+    std::vector<int> visits;
+};
+
+static int Visit(FT_ListNode node, void* user, bool guest) {
+    auto& state = *static_cast<Walk*>(user);
+    Require(state.guest == guest);
+    state.visits.push_back(Index(node, *state.nodes));
+    if (state.remove) {
+        if (guest) FT_List_Remove_nid_postfix(state.list, node);
+        else FT_List_Remove(state.list, node);
+        node->prev = nullptr;
+        node->next = nullptr;
+    }
+    return state.visits.size() == state.stop ? state.error : 0;
+}
+
+static int NativeIterator(FT_ListNode node, void* user) { return Visit(node, user, false); }
+static int APS5_VABI GuestIterator(GuestListNodeRec* node, void* user) { return Visit(node, user, true); }
+
+static void IterationCases() {
+    for (const bool remove : {false, true}) {
+        for (const std::size_t stop : {0u, 1u, 3u, 16u}) {
+            Lists lists;
+            lists.Fill();
+            const int error = stop == 3 ? -29 : 73;
+            Walk guest{&lists.guest, &lists.actual, true, remove, stop, error, {}};
+            Walk native{&lists.native, &lists.expected, false, remove, stop, error, {}};
+            const int result = FT_List_Iterate_nid_postfix(&lists.guest, GuestIterator, &guest);
+            Require(result == FT_List_Iterate(&lists.native, NativeIterator, &native));
+            Require(result == (stop == 0 ? 0 : error));
+            Require(guest.visits == native.visits && guest.visits.size() == (stop == 0 ? Count : stop));
+            lists.Match();
+        }
+    }
+    Lists empty;
+    Walk guest{&empty.guest, &empty.actual, true, false, 0, 0, {}};
+    Walk native{&empty.native, &empty.expected, false, false, 0, 0, {}};
+    Require(FT_List_Iterate_nid_postfix(&empty.guest, GuestIterator, &guest) == 0 && guest.visits.empty());
+    Require(FT_List_Iterate_nid_postfix(nullptr, GuestIterator, &guest) == FT_List_Iterate(nullptr, NativeIterator, &native));
+    Require(FT_List_Iterate_nid_postfix(&empty.guest, nullptr, &guest) == FT_List_Iterate(&empty.native, nullptr, &native));
+    Require(FT_List_Iterate_nid_postfix(nullptr, nullptr, nullptr) == FT_List_Iterate(nullptr, nullptr, nullptr));
+    std::printf("list iteration: 8 callback/order/error/removal cases compared\n");
+}
+
+struct Event {
+    int kind;
+    int id;
+    bool cleared;
+    bool operator==(const Event&) const = default;
+};
+
+struct Disposal {
+    FT_List list;
+    FT_Memory native;
+    GuestMemoryRec* guest;
+    void* user;
+    std::map<void*, int> live;
+    std::vector<Event> events;
+};
+
+static void Release(Disposal& state, void* block) {
+    const auto found = state.live.find(block);
+    Require(found != state.live.end());
+    state.events.push_back({2, found->second, state.list->head == nullptr || state.list->tail == nullptr});
+    state.live.erase(found);
+    delete static_cast<FT_ListNode>(block);
+}
+
+static void NativeFree(FT_Memory memory, void* block) {
+    auto& state = *static_cast<Disposal*>(memory->user);
+    Require(state.native == memory);
+    Release(state, block);
+}
+
+static void APS5_VABI GuestFree(GuestMemoryRec* memory, void* block) {
+    auto& state = *static_cast<Disposal*>(memory->user);
+    Require(state.guest == memory);
+    Release(state, block);
+}
+
+static void NativeDestroy(FT_Memory memory, void* data, void* user) {
+    auto& state = *static_cast<Disposal*>(memory->user);
+    Require(state.native == memory && state.user == user);
+    state.events.push_back({1, data ? *static_cast<int*>(data) : -1, state.list->head == nullptr || state.list->tail == nullptr});
+}
+
+static void APS5_VABI GuestDestroy(GuestMemoryRec* memory, void* data, void* user) {
+    auto& state = *static_cast<Disposal*>(memory->user);
+    Require(state.guest == memory && state.user == user);
+    state.events.push_back({1, data ? *static_cast<int*>(data) : -1, state.list->head == nullptr || state.list->tail == nullptr});
+}
+
+static void FinalizationCases() {
+    for (const bool destroy : {false, true}) {
+        for (const unsigned count : {0u, 1u, 8u}) {
+            FT_ListRec guestList{}, nativeList{};
+            std::array<int, 8> ids{0, 1, 2, 3, 4, 5, 6, 7};
+            int token = 9;
+            Disposal guest{&guestList, nullptr, nullptr, &token, {}, {}};
+            Disposal native{&nativeList, nullptr, nullptr, &token, {}, {}};
+            GuestMemoryRec guestMemory{&guest, nullptr, GuestFree, nullptr};
+            FT_MemoryRec_ nativeMemory{&native, nullptr, NativeFree, nullptr};
+            guest.guest = &guestMemory;
+            native.native = &nativeMemory;
+            for (unsigned i = 0; i < count; ++i) {
+                auto* a = new FT_ListNodeRec{};
+                auto* b = new FT_ListNodeRec{};
+                a->data = b->data = i == 0 ? nullptr : &ids[i];
+                guest.live.emplace(a, i);
+                native.live.emplace(b, i);
+                FT_List_Add_nid_postfix(&guestList, a);
+
+                FT_List_Add(&nativeList, b);
+            }
+            const auto savedHead = guestList.head;
+            FT_List_Finalize_nid_postfix(&guestList, GuestDestroy, nullptr, &token);
+
+            Require(guestList.head == savedHead && guest.events.empty());
+            FT_List_Finalize_nid_postfix(nullptr, GuestDestroy, &guestMemory, &token);
+
+            Require(guest.events.empty());
+            FT_List_Finalize_nid_postfix(&guestList, destroy ? GuestDestroy : nullptr, &guestMemory, &token);
+
+            FT_List_Finalize(&nativeList, destroy ? NativeDestroy : nullptr, &nativeMemory, &token);
+            Require(guestList.head == nullptr && guestList.tail == nullptr && nativeList.head == nullptr && nativeList.tail == nullptr);
+            Require(guest.live.empty() && native.live.empty());
+            Require(guest.events == native.events && guest.events.size() == count * (destroy ? 2u : 1u));
+            for (const auto& event : guest.events) Require(!event.cleared);
+        }
+    }
+    std::printf("list finalization: 6 allocator/destructor/order cases compared\n");
+}
+
+int main() {
+    Mutations();
+    IterationCases();
+    FinalizationCases();
+}
diff --git a/core/libs/tests/GuestFreeTypeNames.cpp b/core/libs/tests/GuestFreeTypeNames.cpp
new file mode 100644
index 0000000000..7ae21fde1a
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeNames.cpp
@@ -0,0 +1,123 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <string>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType names check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static std::vector<unsigned char> NamedFont(const std::string& postscript, const std::string& first, const std::string& second) {
+    std::vector<unsigned char> post(32, 0);
+    post[1] = 2;
+    for (const int value : {3, 0, 258, 259}) FontFixture::Put16(post, value);
+    for (const auto* name : {&first, &second}) {
+        post.push_back(static_cast<unsigned char>(name->size()));
+        post.insert(post.end(), name->begin(), name->end());
+    }
+    auto names = FontFixture::Words({0, 1, 18, 3, 1, 0x0409, 6, static_cast<int>(postscript.size() * 2), 0});
+    for (const unsigned char ch : postscript) FontFixture::Put16(names, ch);
+    return FontFixture::BuildFont(3, {{"post", post}, {"name", names}});
+}
+
+struct FacePair {
+    std::vector<unsigned char> bytes;
+    GuestFace guest;
+    FT_Face oracle = nullptr;
+
+    FacePair(GuestLibrary& library, FT_Library nativeLibrary, std::vector<unsigned char> font) : bytes(std::move(font)) {
+        guest.library = &library;
+        Require(FT_New_Memory_Face(library.host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &guest.host) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &oracle) == 0);
+        SyncFace(guest);
+    }
+
+    ~FacePair() {
+        Require(FT_Done_Face(guest.host) == 0);
+        Require(FT_Done_Face(oracle) == 0);
+    }
+};
+
+static void CompareGlyph(GuestFaceRec* guest, FT_Face native, std::uint32_t index, std::uint32_t size) {
+    std::array<char, 32> expected;
+    expected.fill('?');
+    auto actual = expected;
+    const FT_Error error = FT_Get_Glyph_Name(native, index, expected.data() + 3, size);
+    Require(FT_Get_Glyph_Name_nid_postfix(guest, index, actual.data() + 3, size) == error);
+    Require(actual == expected);
+}
+
+static void CheckFace(FacePair& face, bool names) {
+    Require((FT_HAS_GLYPH_NAMES(face.oracle) != 0) == names);
+    for (const std::uint32_t index : {0u, 1u, 2u, 3u, 0x7FFFFFFFu}) {
+        for (const std::uint32_t size : {0u, 1u, 2u, 5u, 24u}) CompareGlyph(&face.guest.rec, face.oracle, index, size);
+        Require(FT_Get_Glyph_Name_nid_postfix(&face.guest.rec, index, nullptr, 24) == FT_Get_Glyph_Name(face.oracle, index, nullptr, 24));
+    }
+    for (const std::uint32_t index : {0x80000000u, 0xFFFFFFFFu}) {
+        for (const std::uint32_t size : {0u, 1u, 24u}) {
+            std::array<char, 32> expected;
+            expected.fill('?');
+            auto actual = expected;
+            if (size) expected[3] = '\0';
+            Require(FT_Get_Glyph_Name_nid_postfix(&face.guest.rec, index, actual.data() + 3, size) ==
+                    (size ? FT_Err_Invalid_Glyph_Index : FT_Err_Invalid_Argument));
+            Require(actual == expected);
+        }
+    }
+    for (const char* name : {".notdef", "alpha.custom", "beta", "gamma.custom", "delta", "ALPHA.CUSTOM", "missing", ""}) {
+        Require(FT_Get_Name_Index_nid_postfix(&face.guest.rec, name) == FT_Get_Name_Index(face.oracle, name));
+    }
+    Require(FT_Get_Name_Index_nid_postfix(&face.guest.rec, nullptr) == 0);
+    const char* actual = FT_Get_Postscript_Name_nid_postfix(&face.guest.rec);
+    const char* expected = FT_Get_Postscript_Name(face.oracle);
+    Require((actual == nullptr) == (expected == nullptr));
+    Require(!actual || std::strcmp(actual, expected) == 0);
+    Require(actual == FT_Get_Postscript_Name(face.guest.host));
+}
+
+int main() {
+    GuestLibrary library{};
+    FT_Library nativeLibrary = nullptr;
+    Require(FT_Init_FreeType(&library.host) == 0);
+    Require(FT_Init_FreeType(&nativeLibrary) == 0);
+    {
+        FacePair first(library, nativeLibrary, NamedFont("NameFixture-A", "alpha.custom", "beta"));
+        FacePair second(library, nativeLibrary, NamedFont("NameFixture-B", "gamma.custom", "delta"));
+        std::vector<unsigned char> post(32, 0);
+        post[1] = 3;
+        FacePair unnamed(library, nativeLibrary, FontFixture::BuildFont(3, {{"post", post}}));
+        CheckFace(first, true);
+        Require(FT_Get_Name_Index_nid_postfix(&first.guest.rec, "alpha.custom") == 1);
+        Require(FT_Get_Name_Index_nid_postfix(&first.guest.rec, "beta") == 2);
+        const char* retained = FT_Get_Postscript_Name_nid_postfix(&first.guest.rec);
+        Require(retained && std::strcmp(retained, "NameFixture-A") == 0);
+        CheckFace(second, true);
+        Require(FT_Get_Name_Index_nid_postfix(&second.guest.rec, "gamma.custom") == 1);
+        Require(FT_Get_Name_Index_nid_postfix(&second.guest.rec, "delta") == 2);
+        CheckFace(unnamed, false);
+        Require(FT_Get_Postscript_Name_nid_postfix(&unnamed.guest.rec) == nullptr);
+        Require(FT_Get_Postscript_Name_nid_postfix(&first.guest.rec) == retained && std::strcmp(retained, "NameFixture-A") == 0);
+        for (const std::uint32_t size : {0u, 1u, 24u}) CompareGlyph(nullptr, nullptr, 0, size);
+        Require(FT_Get_Glyph_Name_nid_postfix(nullptr, 0, nullptr, 0) == FT_Err_Invalid_Face_Handle);
+        Require(FT_Get_Name_Index_nid_postfix(nullptr, "alpha.custom") == 0);
+        Require(FT_Get_Name_Index_nid_postfix(nullptr, nullptr) == 0);
+        Require(FT_Get_Postscript_Name_nid_postfix(nullptr) == nullptr);
+    }
+    Require(FT_Done_FreeType(library.host) == 0);
+    Require(FT_Done_FreeType(nativeLibrary) == 0);
+}
diff --git a/core/libs/tests/GuestFreeTypeOutline.cpp b/core/libs/tests/GuestFreeTypeOutline.cpp
new file mode 100644
index 0000000000..39013980a0
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeOutline.cpp
@@ -0,0 +1,106 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <ft2build.h>
+#include FT_OUTLINE_H
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <limits>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType outline check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static void CompareCheck(std::uint16_t pointCount, std::vector<std::uint16_t>& contours) {
+    GuestOutline guest{static_cast<std::uint16_t>(contours.size()), pointCount, nullptr, nullptr, contours.data(), 0x71};
+    FT_Outline native{guest.n_contours, pointCount, nullptr, nullptr, contours.data(), guest.flags};
+    const auto before = contours;
+    Require(FT_Outline_Check_nid_postfix(&guest) == FT_Outline_Check(&native));
+    Require(contours == before && guest.flags == 0x71 && guest.points == nullptr && guest.tags == nullptr);
+}
+
+static void EnumerateContours(std::uint16_t pointCount, std::vector<std::uint16_t>& contours, std::size_t index) {
+    if (index == contours.size()) {
+        CompareCheck(pointCount, contours);
+        return;
+    }
+    for (const std::uint16_t end : {0, 1, 2, 3, 4, 5, 6, 65535}) {
+        contours[index] = end;
+        EnumerateContours(pointCount, contours, index + 1);
+    }
+}
+
+static bool Equal(const GuestBBox& actual, const GuestBBox& expected) {
+    return actual.xMin == expected.xMin && actual.yMin == expected.yMin && actual.xMax == expected.xMax && actual.yMax == expected.yMax;
+}
+
+static void CompareBounds(std::vector<GuestVector> points) {
+    std::vector<FT_Vector> nativePoints;
+    for (const auto& point : points) nativePoints.push_back({static_cast<FT_Pos>(point.x), static_cast<FT_Pos>(point.y)});
+    GuestOutline guest{65535, static_cast<std::uint16_t>(points.size()), points.data(), nullptr, nullptr, 0x71};
+    FT_Outline native{guest.n_contours, guest.n_points, nativePoints.data(), nullptr, nullptr, guest.flags};
+    struct GuardedBox {
+        std::uint64_t before;
+        GuestBBox value;
+        std::uint64_t after;
+    } actual{0x1122334455667788, {91, 92, 93, 94}, 0x8877665544332211};
+    FT_BBox expected{91, 92, 93, 94};
+    FT_Outline_Get_CBox(&native, &expected);
+    FT_Outline_Get_CBox_nid_postfix(&guest, &actual.value);
+
+    Require(Equal(actual.value, {expected.xMin, expected.yMin, expected.xMax, expected.yMax}));
+    Require(actual.before == 0x1122334455667788 && actual.after == 0x8877665544332211);
+    FT_Outline_Get_CBox_nid_postfix(&guest, nullptr);
+
+    Require(guest.n_contours == 65535 && guest.flags == 0x71 && guest.tags == nullptr && guest.contours == nullptr);
+}
+
+int main() {
+    Require(FT_Outline_Check_nid_postfix(nullptr) == FT_Outline_Check(nullptr));
+    for (std::uint16_t pointCount = 0; pointCount <= 6; ++pointCount) {
+        for (std::size_t contourCount = 0; contourCount <= 3; ++contourCount) {
+            std::vector<std::uint16_t> contours(contourCount);
+            EnumerateContours(pointCount, contours, 0);
+        }
+    }
+    std::vector<std::uint16_t> maximum = {65534};
+    CompareCheck(65535, maximum);
+    GuestOutline high{1, 65535, nullptr, nullptr, maximum.data(), 0};
+    Require(FT_Outline_Check_nid_postfix(&high) == 0);
+    std::vector<std::uint16_t> maximumContours(65535);
+    for (std::size_t index = 0; index < maximumContours.size(); ++index) maximumContours[index] = static_cast<std::uint16_t>(index);
+    CompareCheck(65535, maximumContours);
+    CompareBounds({});
+    CompareBounds({{17, -29}});
+    CompareBounds({{-10, 20}, {5000, -7000}, {30, 40}, {-200, 9000}});
+    CompareBounds({{std::numeric_limits<std::int32_t>::min(), 0}, {0, std::numeric_limits<std::int32_t>::max()}});
+    std::vector<GuestVector> maximumPoints(65535, {3, 7});
+    maximumPoints.back() = {-12345, 54321};
+    CompareBounds(maximumPoints);
+    std::array<GuestVector, 3> wide = {{{std::numeric_limits<std::int64_t>::min(), 1},
+                                        {std::int64_t{1} << 40, std::numeric_limits<std::int64_t>::max()},
+                                        {std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::min()}}};
+    GuestOutline outline{0, static_cast<std::uint16_t>(wide.size()), wide.data(), nullptr, nullptr, 0};
+    GuestBBox box{1, 2, 3, 4};
+    FT_Outline_Get_CBox_nid_postfix(&outline, &box);
+
+    Require(Equal(box, {std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::min(),
+                        std::numeric_limits<std::int64_t>::max(), std::numeric_limits<std::int64_t>::max()}));
+    const GuestBBox retained = box;
+    FT_Outline_Get_CBox_nid_postfix(nullptr, &box);
+
+    Require(Equal(box, retained));
+    FT_Outline_Get_CBox_nid_postfix(nullptr, nullptr);
+
+}
diff --git a/core/libs/tests/GuestFreeTypeOutlineMutations.cpp b/core/libs/tests/GuestFreeTypeOutlineMutations.cpp
new file mode 100644
index 0000000000..b7e437d03e
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeOutlineMutations.cpp
@@ -0,0 +1,173 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FreeTypeFontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_OUTLINE_H
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType outline mutation check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+static bool Equal(const GuestVector& left, const GuestVector& right) {
+    return left.x == right.x && left.y == right.y;
+}
+
+static void ReverseOracle(std::size_t count, std::vector<std::uint16_t> contours, std::int32_t flags) {
+    std::vector<GuestVector> storage(count + 2);
+    storage.front() = {991, 992};
+    storage.back() = {-993, -994};
+    std::vector<unsigned char> tags(count + 2, 0xA5);
+    std::vector<FT_Vector> nativePoints;
+    std::vector<unsigned char> nativeTags;
+    for (std::size_t index = 0; index < count; ++index) {
+        storage[index + 1] = {(std::int64_t{1} << 40) + static_cast<std::int64_t>(index) * 3,
+                              -(std::int64_t{1} << 41) + static_cast<std::int64_t>(index) * 7};
+        tags[index + 1] = static_cast<unsigned char>(index * 73);
+        nativePoints.push_back({static_cast<FT_Pos>(index), -static_cast<FT_Pos>(index)});
+        nativeTags.push_back(tags[index + 1]);
+    }
+    const auto original = storage;
+    const auto originalTags = tags;
+    const auto originalContours = contours;
+    GuestOutline guest{static_cast<std::uint16_t>(contours.size()), static_cast<std::uint16_t>(count), storage.data() + 1,
+                       tags.data() + 1, contours.data(), flags};
+    FT_Outline native{guest.n_contours, guest.n_points, nativePoints.data(), nativeTags.data(), contours.data(), flags};
+    FT_Outline_Reverse(&native);
+    FT_Outline_Reverse_nid_postfix(&guest);
+
+    Require(guest.flags == native.flags && guest.flags == (flags ^ FT_OUTLINE_REVERSE_FILL));
+    Require(guest.n_points == count && guest.n_contours == contours.size() && contours == originalContours);
+    for (std::size_t index = 0; index < count; ++index) {
+        const auto source = static_cast<std::size_t>(nativePoints[index].x);
+        Require(source < count && Equal(storage[index + 1], original[source + 1]));
+        Require(tags[index + 1] == nativeTags[index]);
+    }
+    Require(Equal(storage.front(), original.front()) && Equal(storage.back(), original.back()));
+    Require(tags.front() == 0xA5 && tags.back() == 0xA5);
+    FT_Outline_Reverse_nid_postfix(&guest);
+
+    Require(guest.flags == flags && tags == originalTags);
+    for (std::size_t index = 0; index < storage.size(); ++index) Require(Equal(storage[index], original[index]));
+}
+
+static void TranslateOracle(std::size_t count, FT_Pos xOffset, FT_Pos yOffset) {
+    std::vector<GuestVector> storage(count + 2, {991, -992});
+    std::vector<FT_Vector> nativePoints;
+    for (std::size_t index = 0; index < count; ++index) {
+        const auto value = static_cast<FT_Pos>(index % 101);
+        storage[index + 1] = {value - 50, 25 - value};
+        nativePoints.push_back({value - 50, 25 - value});
+    }
+    GuestOutline guest{65535, static_cast<std::uint16_t>(count), storage.data() + 1, nullptr, nullptr, 0x71};
+    FT_Outline native{guest.n_contours, guest.n_points, nativePoints.data(), nullptr, nullptr, guest.flags};
+    FT_Outline_Translate(&native, xOffset, yOffset);
+    FT_Outline_Translate_nid_postfix(&guest, xOffset, yOffset);
+
+    for (std::size_t index = 0; index < count; ++index) {
+        Require(storage[index + 1].x == nativePoints[index].x && storage[index + 1].y == nativePoints[index].y);
+    }
+    Require(Equal(storage.front(), {991, -992}) && Equal(storage.back(), {991, -992}));
+    Require(guest.n_contours == 65535 && guest.n_points == count && guest.flags == 0x71);
+    Require(guest.tags == nullptr && guest.contours == nullptr);
+}
+
+static void WideTranslation() {
+    const auto low = std::numeric_limits<std::int64_t>::min();
+    const auto high = std::numeric_limits<std::int64_t>::max();
+    const auto wide = std::int64_t{1} << 40;
+    std::array<GuestVector, 6> points = {{{high, low}, {low, high}, {-1, 0}, {1, -1}, {wide, -wide}, {high - 5, low + 5}}};
+    const auto original = points;
+    const std::array<GuestVector, 6> expected = {{{low, high}, {low + 1, high - 1}, {0, -1}, {2, -2}, {wide + 1, -wide - 1}, {high - 4, low + 4}}};
+    GuestOutline guest{0, static_cast<std::uint16_t>(points.size()), points.data(), nullptr, nullptr, 0};
+    FT_Outline_Translate_nid_postfix(&guest, 1, -1);
+
+    for (std::size_t index = 0; index < points.size(); ++index) Require(Equal(points[index], expected[index]));
+    FT_Outline_Translate_nid_postfix(&guest, -1, 1);
+
+    for (std::size_t index = 0; index < points.size(); ++index) Require(Equal(points[index], original[index]));
+    GuestVector point{7, -9};
+    guest.n_points = 1;
+    guest.points = &point;
+    FT_Outline_Translate_nid_postfix(&guest, wide, -wide);
+
+    Require(Equal(point, {wide + 7, -wide - 9}));
+    point = {low, 1};
+    FT_Outline_Translate_nid_postfix(&guest, low, high);
+
+    Require(Equal(point, {0, low}));
+}
+
+static void RenderModifiedOutline() {
+    const auto bytes = SquareGlyphFont('A', 700);
+    GuestLibrary library{};
+    FT_Library nativeLibrary = nullptr;
+    Require(FT_Init_FreeType(&library.host) == 0 && FT_Init_FreeType(&nativeLibrary) == 0);
+    {
+        GuestFace guest;
+        guest.library = &library;
+        FT_Face native = nullptr;
+        Require(FT_New_Memory_Face(library.host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &guest.host) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &native) == 0);
+        Require(FT_Set_Pixel_Sizes(guest.host, 18, 18) == 0 && FT_Set_Pixel_Sizes(native, 18, 18) == 0);
+        Require(FT_Load_Glyph(guest.host, 1, FT_LOAD_DEFAULT) == 0 && FT_Load_Glyph(native, 1, FT_LOAD_DEFAULT) == 0);
+        SyncFace(guest);
+        FT_Outline_Reverse_nid_postfix(&guest.slot.outline);
+        FT_Outline_Translate_nid_postfix(&guest.slot.outline, 77, -129);
+
+        FT_Outline_Reverse(&native->glyph->outline);
+        FT_Outline_Translate(&native->glyph->outline, 77, -129);
+        Require(FT_Render_Glyph_nid_postfix(&guest.slot, FT_RENDER_MODE_NORMAL) == FT_Render_Glyph(native->glyph, FT_RENDER_MODE_NORMAL));
+        const auto& actual = guest.slot.bitmap;
+        const auto& expected = native->glyph->bitmap;
+        Require(actual.width > 0 && actual.rows > 0 && actual.width == expected.width && actual.rows == expected.rows);
+        Require(actual.pitch == expected.pitch && actual.pixel_mode == expected.pixel_mode && actual.num_grays == expected.num_grays);
+        Require(guest.slot.bitmap_left == native->glyph->bitmap_left && guest.slot.bitmap_top == native->glyph->bitmap_top);
+        const auto pitch = static_cast<std::size_t>(expected.pitch < 0 ? -expected.pitch : expected.pitch);
+        Require(std::memcmp(actual.buffer, expected.buffer, pitch * expected.rows) == 0);
+        Require(FT_Done_Face(guest.host) == 0 && FT_Done_Face(native) == 0);
+    }
+    Require(FT_Done_FreeType(library.host) == 0 && FT_Done_FreeType(nativeLibrary) == 0);
+}
+
+int main() {
+    FT_Outline_Reverse_nid_postfix(nullptr);
+    FT_Outline_Translate_nid_postfix(nullptr, std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max());
+
+    ReverseOracle(0, {}, FT_OUTLINE_REVERSE_FILL);
+    for (std::size_t count = 1; count <= 8; ++count) {
+        for (unsigned mask = 0; mask < (1u << (count - 1)); ++mask) {
+            std::vector<std::uint16_t> contours;
+            for (std::size_t index = 0; index < count; ++index) {
+                if (index + 1 == count || (mask & (1u << index))) contours.push_back(static_cast<std::uint16_t>(index));
+            }
+            ReverseOracle(count, contours, static_cast<std::int32_t>(mask) | 0x31);
+        }
+    }
+    ReverseOracle(65535, {65534}, 0);
+    std::vector<std::uint16_t> maximumContours(65535);
+    for (std::size_t index = 0; index < maximumContours.size(); ++index) maximumContours[index] = static_cast<std::uint16_t>(index);
+    ReverseOracle(65535, maximumContours, FT_OUTLINE_REVERSE_FILL);
+    for (std::size_t count = 0; count <= 6; ++count) {
+        for (const FT_Pos xOffset : {-65, 0, 64, 127}) {
+            for (const FT_Pos yOffset : {-99, 0, 101}) TranslateOracle(count, xOffset, yOffset);
+        }
+    }
+    TranslateOracle(65535, 99, -17);
+    WideTranslation();
+    RenderModifiedOutline();
+}
diff --git a/core/libs/tests/GuestFreeTypeRequestSize.cpp b/core/libs/tests/GuestFreeTypeRequestSize.cpp
new file mode 100644
index 0000000000..a1e8356b3d
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeRequestSize.cpp
@@ -0,0 +1,182 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FreeTypeFontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+
+#include <ft2build.h>
+#include FT_FREETYPE_H
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType size request check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+struct Fixture {
+    std::vector<unsigned char> bytes;
+    FT_Library library = nullptr;
+    FT_Face native = nullptr;
+    FreeType::GuestLibrary* guestLibrary = nullptr;
+    GuestFaceRec* guest = nullptr;
+
+    explicit Fixture(std::vector<unsigned char> font, int faceIndex = 0) : bytes(std::move(font)) {
+        Require(FT_Init_FreeType(&library) == 0);
+        Require(FT_New_Memory_Face(library, bytes.data(), static_cast<FT_Long>(bytes.size()), faceIndex, &native) == 0);
+        Require(FT_Init_FreeType_nid_postfix(&guestLibrary) == 0);
+        Require(FT_New_Memory_Face_nid_postfix(guestLibrary, bytes.data(), static_cast<std::int64_t>(bytes.size()), faceIndex, &guest) == 0);
+    }
+
+    ~Fixture() {
+        Require(FT_Done_FreeType_nid_postfix(guestLibrary) == 0);
+        Require(FT_Done_FreeType(library) == 0);
+    }
+
+    void CheckMetrics() const {
+        const auto& actual = guest->size->metrics;
+        const auto& expected = native->size->metrics;
+        Require(actual.x_ppem == expected.x_ppem && actual.y_ppem == expected.y_ppem);
+        Require(actual.x_scale == expected.x_scale && actual.y_scale == expected.y_scale);
+        Require(actual.ascender == expected.ascender && actual.descender == expected.descender);
+        Require(actual.height == expected.height && actual.max_advance == expected.max_advance);
+    }
+
+    int Request(GuestSizeRequestRec request) {
+        FT_Size_RequestRec hostRequest{static_cast<FT_Size_Request_Type>(request.type), static_cast<FT_Long>(request.width),
+            static_cast<FT_Long>(request.height), request.horiResolution, request.vertResolution};
+        const auto before = request;
+        const auto* size = guest->size;
+        const auto generic = size->generic;
+        const int error = FT_Request_Size(native, &hostRequest);
+        Require(FT_Request_Size_nid_postfix(guest, &request) == error);
+        Require(request.type == before.type && request.width == before.width && request.height == before.height);
+        Require(request.horiResolution == before.horiResolution && request.vertResolution == before.vertResolution);
+        Require(guest->size == size && size->face == guest && size->generic.data == generic.data && size->generic.finalizer == generic.finalizer);
+        CheckMetrics();
+        return error;
+    }
+
+    void Load() const {
+        Require(FT_Load_Glyph(native, 1, FT_LOAD_DEFAULT) == 0);
+        Require(FT_Load_Glyph_nid_postfix(guest, 1, FT_LOAD_DEFAULT) == 0);
+        const auto& actual = guest->glyph->metrics;
+        const auto& expected = native->glyph->metrics;
+        Require(actual.width == expected.width && actual.height == expected.height);
+        Require(actual.horiBearingX == expected.horiBearingX && actual.horiBearingY == expected.horiBearingY);
+        Require(actual.horiAdvance == expected.horiAdvance && actual.vertAdvance == expected.vertAdvance);
+        Require(guest->glyph->advance.x == native->glyph->advance.x && guest->glyph->advance.y == native->glyph->advance.y);
+    }
+};
+
+static void CheckScalable() {
+    Fixture fixture(SquareGlyphFont('A', 913));
+    fixture.guest->size->generic.data = &fixture;
+    for (std::uint32_t type = FT_SIZE_REQUEST_TYPE_NOMINAL; type < FT_SIZE_REQUEST_TYPE_MAX; ++type) {
+        Require(fixture.Request({type, 0, 0, 0, 0}) == FT_Err_Invalid_PPem);
+        for (const auto& dimensions : std::array<std::array<std::int64_t, 2>, 4>{{{0, 23 * 64 + 17},
+                 {31 * 64 + 49, 0}, {17 * 64 + 31, 29 * 64 + 33}, {48 * 64, 12 * 64}}}) {
+            for (const auto& dpi : std::array<std::array<std::uint32_t, 2>, 4>{{{0, 0}, {72, 144}, {96, 0}, {0, 120}}}) {
+                const auto factor = type == FT_SIZE_REQUEST_TYPE_SCALES ? 64 : 1;
+                Require(fixture.Request({type, dimensions[0] * factor, dimensions[1] * factor, dpi[0], dpi[1]}) == 0);
+                fixture.Load();
+            }
+        }
+    }
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_SCALES, 0x18000, 0x28000, 0, 0}) == 0);
+    const auto scales = fixture.guest->size->metrics;
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_SCALES, 0x18000, 0x28000,
+        std::numeric_limits<std::uint32_t>::max(), std::numeric_limits<std::uint32_t>::max()}) == 0);
+    Require(fixture.guest->size->metrics.x_scale == scales.x_scale && fixture.guest->size->metrics.y_scale == scales.y_scale);
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, 65536LL * 64, 17 * 64, 0, 0}) == FT_Err_Invalid_Pixel_Size);
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, 19 * 64, 27 * 64, 0, 0}) == 0);
+    fixture.Load();
+    auto* slot = fixture.guest->glyph;
+    Require(slot->outline.n_points > 0);
+    slot->outline.points[0].x += 137;
+    slot->outline.flags ^= 2;
+    const auto point = slot->outline.points[0];
+    const auto savedSlot = *slot;
+    for (const auto width : {21LL * 64, 65536LL * 64}) {
+        fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, width, 15 * 64, 0, 0});
+        Require(std::memcmp(slot, &savedSlot, sizeof(savedSlot)) == 0);
+        Require(slot->outline.points[0].x == point.x && slot->outline.points[0].y == point.y);
+    }
+}
+
+static void CheckInvalid() {
+    Fixture fixture(SquareGlyphFont('A', 913));
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, 17 * 64, 23 * 64, 0, 0}) == 0);
+    for (const auto& request : std::array<GuestSizeRequestRec, 6>{{
+             {FT_SIZE_REQUEST_TYPE_NOMINAL, -1, 1024, 0, 0},
+             {FT_SIZE_REQUEST_TYPE_NOMINAL, 1024, std::numeric_limits<std::int64_t>::min(), 0, 0},
+             {FT_SIZE_REQUEST_TYPE_MAX, 1024, 1024, 0, 0},
+             {std::numeric_limits<std::uint32_t>::max(), 1024, 1024, 0, 0},
+             {FT_SIZE_REQUEST_TYPE_MAX, std::numeric_limits<std::int64_t>::max(), 1024, 0, 0},
+             {FT_SIZE_REQUEST_TYPE_NOMINAL, std::numeric_limits<std::int64_t>::max(), -1, 0, 0}}}) {
+        Require(FT_Request_Size_nid_postfix(fixture.guest, &request) == FT_Err_Invalid_Argument);
+        Require(FT_Request_Size_nid_postfix(nullptr, &request) == FT_Err_Invalid_Face_Handle);
+        fixture.CheckMetrics();
+    }
+    Require(FT_Request_Size_nid_postfix(nullptr, nullptr) == FT_Err_Invalid_Face_Handle);
+    Require(FT_Request_Size_nid_postfix(fixture.guest, nullptr) == FT_Request_Size(fixture.native, nullptr));
+    fixture.CheckMetrics();
+
+    Fixture probe(SquareGlyphFont('A', 913), -1);
+    Require(probe.guest->size == nullptr && probe.native->size == nullptr);
+    GuestSizeRequestRec request{FT_SIZE_REQUEST_TYPE_NOMINAL, -1, -1, 0, 0};
+    Require(FT_Request_Size_nid_postfix(probe.guest, &request) == FT_Err_Invalid_Size_Handle);
+    Require(FT_Request_Size_nid_postfix(probe.guest, nullptr) == FT_Err_Invalid_Size_Handle);
+
+    for (const auto& dimensions : std::array<std::array<std::int64_t, 2>, 2>{{{0x100000000LL + 1024, 1024}, {1024, 0x100000000LL + 1024}}}) {
+        request = {FT_SIZE_REQUEST_TYPE_NOMINAL, dimensions[0], dimensions[1], 0, 0};
+        if constexpr (sizeof(FT_Long) == sizeof(std::int64_t)) {
+            Require(fixture.Request(request) == FT_Err_Invalid_Pixel_Size);
+        } else {
+            bool threw = false;
+            try {
+                FT_Request_Size_nid_postfix(fixture.guest, &request);
+
+            } catch (const std::runtime_error&) {
+                threw = true;
+            }
+            Require(threw);
+            fixture.CheckMetrics();
+        }
+    }
+}
+
+static void CheckBitmap() {
+    const std::string bdf = "STARTFONT 2.1\nFONT -AnyPS5-Fixed-Medium-R-Normal--8-80-72-72-C-80-ISO10646-1\n"
+        "SIZE 8 72 72\nFONTBOUNDINGBOX 8 8 0 0\nSTARTPROPERTIES 4\nFONT_ASCENT 8\nFONT_DESCENT 0\n"
+        "CHARSET_REGISTRY \"ISO10646\"\nCHARSET_ENCODING \"1\"\nENDPROPERTIES\nCHARS 1\nSTARTCHAR A\nENCODING 65\n"
+        "SWIDTH 1000 0\nDWIDTH 8 0\nBBX 8 8 0 0\nBITMAP\n18\n24\n42\n7E\n42\n42\n42\n00\nENDCHAR\nENDFONT\n";
+    Fixture fixture({bdf.begin(), bdf.end()});
+    Require(!FT_IS_SCALABLE(fixture.native) && fixture.guest->num_fixed_sizes == 1);
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, 8 * 64, 8 * 64, 0, 0}) == 0);
+    fixture.Load();
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, 0, 8 * 64, 72, 72}) == 0);
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_REAL_DIM, 8 * 64, 8 * 64, 0, 0}) == 0);
+    Require(fixture.Request({FT_SIZE_REQUEST_TYPE_NOMINAL, 0, 17 * 64, 0, 0}) == FT_Err_Invalid_Pixel_Size);
+    for (const auto type : {FT_SIZE_REQUEST_TYPE_BBOX, FT_SIZE_REQUEST_TYPE_CELL, FT_SIZE_REQUEST_TYPE_SCALES}) {
+        Require(fixture.Request({static_cast<std::uint32_t>(type), 8 * 64, 8 * 64, 0, 0}) == FT_Err_Unimplemented_Feature);
+    }
+}
+
+int main() {
+    CheckScalable();
+    CheckInvalid();
+    CheckBitmap();
+}
diff --git a/core/libs/tests/GuestFreeTypeSfntNames.cpp b/core/libs/tests/GuestFreeTypeSfntNames.cpp
new file mode 100644
index 0000000000..4cd1e8f14c
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeSfntNames.cpp
@@ -0,0 +1,140 @@
+#include "prx/libSceFreeType/include/Api.hpp"
+#include "FontFixture.hpp"
+#include "prx/libSceFreeType/include/GuestObjects.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include FT_SFNT_NAMES_H
+
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <utility>
+#include <vector>
+
+using namespace FreeType;
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "FreeType SFNT names check failed at line %d\n", line);
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+struct NameRecord {
+    std::uint16_t platform;
+    std::uint16_t encoding;
+    std::uint16_t language;
+    std::uint16_t name;
+    std::vector<unsigned char> bytes;
+};
+
+static std::vector<unsigned char> NamedFont(const std::vector<NameRecord>& records) {
+    auto table = FontFixture::Words({0, static_cast<int>(records.size()), 6 + 12 * static_cast<int>(records.size())});
+    int offset = 0;
+    for (const auto& record : records) {
+        for (const int value : {static_cast<int>(record.platform), static_cast<int>(record.encoding), static_cast<int>(record.language),
+                               static_cast<int>(record.name), static_cast<int>(record.bytes.size()), offset}) FontFixture::Put16(table, value);
+        offset += static_cast<int>(record.bytes.size());
+    }
+    for (const auto& record : records) table.insert(table.end(), record.bytes.begin(), record.bytes.end());
+    return FontFixture::BuildFont(3, {{"name", table}});
+}
+
+struct FacePair {
+    std::vector<unsigned char> bytes;
+    GuestFace guest;
+    FT_Face oracle = nullptr;
+
+    FacePair(GuestLibrary& library, FT_Library nativeLibrary, std::vector<unsigned char> font) : bytes(std::move(font)) {
+        guest.library = &library;
+        Require(FT_New_Memory_Face(library.host, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &guest.host) == 0);
+        Require(FT_New_Memory_Face(nativeLibrary, bytes.data(), static_cast<FT_Long>(bytes.size()), 0, &oracle) == 0);
+        SyncFace(guest);
+    }
+
+    ~FacePair() {
+        Require(FT_Done_Face(guest.host) == 0);
+        Require(FT_Done_Face(oracle) == 0);
+    }
+};
+
+static GuestSfntName Query(FacePair& face, std::uint32_t index, const NameRecord& record) {
+    struct GuardedName {
+        std::array<unsigned char, 8> before;
+        GuestSfntName value;
+        std::array<unsigned char, 8> after;
+    } actual;
+    std::memset(&actual, 0xA5, sizeof(actual));
+    FT_SfntName expected{};
+    Require(FT_Get_Sfnt_Name(face.oracle, index, &expected) == 0);
+    Require(FT_Get_Sfnt_Name_nid_postfix(&face.guest.rec, index, &actual.value) == 0);
+    for (const auto byte : actual.before) Require(byte == 0xA5);
+    for (const auto byte : actual.after) Require(byte == 0xA5);
+    const auto& name = actual.value;
+    Require(name.platform_id == expected.platform_id && name.platform_id == record.platform);
+    Require(name.encoding_id == expected.encoding_id && name.encoding_id == record.encoding);
+    Require(name.language_id == expected.language_id && name.language_id == record.language);
+    Require(name.name_id == expected.name_id && name.name_id == record.name);
+    Require(name.string_len == expected.string_len && name.string_len == record.bytes.size());
+    Require(std::memcmp(name.string, expected.string, name.string_len) == 0);
+    Require(std::memcmp(name.string, record.bytes.data(), name.string_len) == 0);
+    FT_SfntName native{};
+    Require(FT_Get_Sfnt_Name(face.guest.host, index, &native) == 0 && name.string == native.string);
+    return name;
+}
+
+static void InvalidQuery(GuestFaceRec* guest, FT_Face native, std::uint32_t index) {
+    GuestSfntName actual;
+    std::memset(&actual, 0xA5, sizeof(actual));
+    std::array<unsigned char, sizeof(actual)> before;
+    std::memcpy(before.data(), &actual, sizeof(actual));
+    FT_SfntName expected{};
+    const FT_Error error = FT_Get_Sfnt_Name(native, index, &expected);
+    Require(error != 0);
+    Require(FT_Get_Sfnt_Name_nid_postfix(guest, index, &actual) == error);
+    Require(std::memcmp(&actual, before.data(), sizeof(actual)) == 0);
+    Require(FT_Get_Sfnt_Name_nid_postfix(guest, index, nullptr) == FT_Get_Sfnt_Name(native, index, nullptr));
+}
+
+int main() {
+    GuestLibrary library{};
+    FT_Library nativeLibrary = nullptr;
+    Require(FT_Init_FreeType(&library.host) == 0);
+    Require(FT_Init_FreeType(&nativeLibrary) == 0);
+    {
+        const std::vector<NameRecord> records = {
+            {1, 0, 0, 1, {'F', 'a', 'm', 'i', 'l', 'y'}},
+            {3, 1, 0x0409, 6, {0, 'S', 0, 'f', 0, 'n', 0, 't'}},
+            {3, 10, 0x0411, 256, {0, 'A', 0, 0, 0, 'B'}}
+        };
+        FacePair first(library, nativeLibrary, NamedFont(records));
+        FacePair empty(library, nativeLibrary, FontFixture::BuildFont(3, {}));
+        Require(FT_Get_Sfnt_Name_Count_nid_postfix(&first.guest.rec) == records.size());
+        Require(FT_Get_Sfnt_Name_Count_nid_postfix(&first.guest.rec) == FT_Get_Sfnt_Name_Count(first.oracle));
+        std::vector<GuestSfntName> retained;
+        for (std::uint32_t index = 0; index < records.size(); ++index) retained.push_back(Query(first, index, records[index]));
+        {
+            const std::vector<NameRecord> other = {{3, 1, 0x0409, 6, {0, 'O', 0, 't', 0, 'h', 0, 'e', 0, 'r'}}};
+            FacePair second(library, nativeLibrary, NamedFont(other));
+            Require(FT_Get_Sfnt_Name_Count_nid_postfix(&second.guest.rec) == other.size());
+            Query(second, 0, other[0]);
+        }
+        for (std::uint32_t index = 0; index < records.size(); ++index) {
+            Require(Query(first, index, records[index]).string == retained[index].string);
+            Require(std::memcmp(retained[index].string, records[index].bytes.data(), retained[index].string_len) == 0);
+            Require(FT_Get_Sfnt_Name_nid_postfix(&first.guest.rec, index, nullptr) == FT_Get_Sfnt_Name(first.oracle, index, nullptr));
+        }
+        Require(FT_Get_Sfnt_Name_Count_nid_postfix(&empty.guest.rec) == 0);
+        Require(FT_Get_Sfnt_Name_Count_nid_postfix(nullptr) == 0);
+        for (const std::uint32_t index : {0u, 3u, 0x80000000u, 0xFFFFFFFFu}) {
+            if (index >= records.size()) InvalidQuery(&first.guest.rec, first.oracle, index);
+            InvalidQuery(&empty.guest.rec, empty.oracle, index);
+            InvalidQuery(nullptr, nullptr, index);
+        }
+    }
+    Require(FT_Done_FreeType(library.host) == 0);
+    Require(FT_Done_FreeType(nativeLibrary) == 0);
+}
diff --git a/core/libs/tests/GuestFreebsdClocks.cpp b/core/libs/tests/GuestFreebsdClocks.cpp
index 40972ab464..1ae0f71258 100644
--- a/core/libs/tests/GuestFreebsdClocks.cpp
+++ b/core/libs/tests/GuestFreebsdClocks.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <climits>
@@ -8,20 +11,6 @@
 #include <ctime>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI clock_getres_nid_postfix(int clockId, KernelTimespec* res);
-int APS5_VABI clock_settime_nid_postfix(int clockId, const KernelTimespec* tp);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int APS5_VABI sceKernelClockGetres(KernelClockid clockId, KernelTimespec* tp);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-int APS5_VABI gettimeofday_nid_postfix(KernelTimeval* tv, KernelTimezone* tz);
-std::int64_t APS5_VABI _Xtime_get_ticks_nid_postfix();
-int APS5_VABI sceKernelConvertLocaltimeToUtc(std::int64_t, std::int64_t, std::int64_t*, KernelTimesec*, std::int32_t*);
-int APS5_VABI sceKernelConvertUtcToLocaltime(std::int64_t, std::int64_t*, KernelTimesec*, std::int32_t*);
-}
-
 static constexpr int SCE_OK = 0;
 
 static constexpr int GUEST_CLOCK_REALTIME = 0;
@@ -70,6 +59,7 @@ static void UnsupportedResolutionStillThrows() {
     bool rejected = false;
     try {
         clock_getres_nid_postfix(3, &resolution);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -88,6 +78,7 @@ static void OmittedTimeIsFaultAfterClockValidation() {
     bool rejected = false;
     try {
         clock_gettime_nid_postfix(3, nullptr);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -244,6 +235,7 @@ static void RequireSettimeError(int clockId, const KernelTimespec* time, int err
 static bool SettimeThrows(const KernelTimespec& time, const char* requested) {
     try {
         clock_settime_nid_postfix(GUEST_CLOCK_REALTIME, &time);
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), requested) != nullptr;
     }
diff --git a/core/libs/tests/GuestFreopenHostStandard.cpp b/core/libs/tests/GuestFreopenHostStandard.cpp
new file mode 100644
index 0000000000..cf8e85e536
--- /dev/null
+++ b/core/libs/tests/GuestFreopenHostStandard.cpp
@@ -0,0 +1,77 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <string>
+#include <fcntl.h>
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <io.h>
+#else
+#include <unistd.h>
+#endif
+
+extern "C" {
+
+extern FileStream* __stdoutp_nid_postfix;
+}
+
+static void Require(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "freopen host standard check failed at line %d, errno %d\n", line, errno);
+        std::abort();
+    }
+}
+#define Check(value) Require((value), __LINE__)
+
+#ifdef _WIN32
+static int HostDup(int descriptor) { return ::_dup(descriptor); }
+static int HostDup2(int from, int to) { return ::_dup2(from, to); }
+static int HostClose(int descriptor) { return ::_close(descriptor); }
+static int HostWrite(int descriptor, const char* text, unsigned size) { return ::_write(descriptor, text, size); }
+static int HostFileno(std::FILE* stream) { return ::_fileno(stream); }
+#else
+static int HostDup(int descriptor) { return ::dup(descriptor); }
+static int HostDup2(int from, int to) { return ::dup2(from, to) == to ? 0 : -1; }
+static int HostClose(int descriptor) { return ::close(descriptor); }
+static int HostWrite(int descriptor, const char* text, unsigned size) { return static_cast<int>(::write(descriptor, text, size)); }
+static int HostFileno(std::FILE* stream) { return ::fileno(stream); }
+#endif
+
+static std::string Contents(const std::string& name) {
+    std::ifstream stream(name, std::ios::binary);
+    return std::string(std::istreambuf_iterator<char>(stream), std::istreambuf_iterator<char>());
+}
+
+int main() {
+    const auto sinkName = "anyps5-freopen-host-standard-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".txt";
+    std::FILE* sink = std::fopen(sinkName.c_str(), "wb");
+    Check(sink != nullptr);
+    const int original = HostDup(1);
+    Check(original >= 0 && HostDup2(HostFileno(sink), 1) == 0);
+
+    errno = 0;
+    FileStream* const reopened = freopen_nid_postfix("", "w", __stdoutp_nid_postfix);
+    const int error = errno;
+
+    const int written = HostWrite(1, "host", 4);
+    const bool restored = HostDup2(original, 1) == 0 && HostClose(original) == 0;
+    Check(std::fclose(sink) == 0);
+    Check(restored);
+    Check(reopened == nullptr);
+    Check(error == ENOENT);
+    Check(written == 4);
+    Check(Contents(sinkName) == "host");
+
+    errno = 0;
+    Check(fputs_nid_postfix("text", __stdoutp_nid_postfix) == -1 && errno == EBADF);
+    Check(std::filesystem::remove(sinkName));
+    return 0;
+}
diff --git a/core/libs/tests/GuestFstatFault.cpp b/core/libs/tests/GuestFstatFault.cpp
index 4f0aa66bb9..08ff17cd37 100644
--- a/core/libs/tests/GuestFstatFault.cpp
+++ b/core/libs/tests/GuestFstatFault.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -10,15 +13,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "fstat check failed at line %d\n", line);
@@ -60,10 +54,8 @@ int main() {
     Require(close_nid_postfix(sockets[0]) == 0);
     Require(close_nid_postfix(sockets[1]) == 0);
     Require(close_nid_postfix(file) == 0);
-#ifndef _WIN32
     RequireFailure(file, GuestEbadf);
     RequireFailure(-1, GuestEbadf);
-#endif
 
     std::filesystem::remove_all(root);
 }
diff --git a/core/libs/tests/GuestFstatfs.cpp b/core/libs/tests/GuestFstatfs.cpp
index 0c86546ccb..9950e6b9dc 100644
--- a/core/libs/tests/GuestFstatfs.cpp
+++ b/core/libs/tests/GuestFstatfs.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
@@ -36,15 +39,6 @@ struct GuestStatfs {
 };
 static_assert(sizeof(GuestStatfs) == 472);
 
-extern "C" {
-int APS5_VABI _fstatfs_nid_postfix(int, GuestStatfs*);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "fstatfs check failed at line %d\n", line);
@@ -63,7 +57,7 @@ static void RequireFailure(int descriptor, int error) {
     GuestStatfs fs;
     std::memset(&fs, 0x5a, sizeof(fs));
     *__error_nid_postfix() = 0;
-    Require(_fstatfs_nid_postfix(descriptor, &fs) == -1);
+    Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(&fs)) == -1);
     Require(*__error_nid_postfix() == error);
     for (std::size_t i = 0; i < sizeof(fs); ++i) Require(reinterpret_cast<const unsigned char*>(&fs)[i] == 0x5a);
 }
@@ -71,7 +65,7 @@ static void RequireFailure(int descriptor, int error) {
 static void RequireVolume(int descriptor, const std::filesystem::path& path) {
     GuestStatfs fs;
     std::memset(&fs, 0x5a, sizeof(fs));
-    Require(_fstatfs_nid_postfix(descriptor, &fs) == 0);
+    Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(&fs)) == 0);
     const auto space = std::filesystem::space(path);
     Require(fs.f_version == StatfsVersion);
     Require(fs.f_bsize > 0 && fs.f_iosize > 0);
@@ -83,6 +77,19 @@ static void RequireVolume(int descriptor, const std::filesystem::path& path) {
     Require(fs.f_fstypename[0] == '\0' && fs.f_mntfromname[0] == '\0' && fs.f_mntonname[0] == '\0');
 }
 
+static void RequireDeviceFilesystem(int descriptor) {
+    GuestStatfs fs;
+    std::memset(&fs, 0x5a, sizeof(fs));
+    Require(_fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(&fs)) == 0);
+    GuestStatfs expected{};
+    expected.f_version = StatfsVersion;
+    expected.f_bsize = 512;
+    expected.f_iosize = 512;
+    expected.f_blocks = 2;
+    expected.f_namemax = 255;
+    Require(std::memcmp(&fs, &expected, sizeof(fs)) == 0);
+}
+
 int main() {
     const auto root = std::filesystem::temp_directory_path() /
         ("anyps5-fstatfs-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
@@ -122,11 +129,19 @@ int main() {
     Require(close_nid_postfix(sockets[1]) == 0);
     RequireFailure(sockets[0], GuestEbadf);
 
+    const int random = sceKernelOpen("/dev/urandom", SCE_KERNEL_O_RDONLY, 0);
+    Require(random >= 0);
+    RequireDeviceFilesystem(random);
+    Require(close_nid_postfix(random) == 0);
+
+    const int kqueue = kqueue_nid_postfix();
+    Require(kqueue >= 0);
+    RequireFailure(kqueue, GuestEinval);
+    Require(close_nid_postfix(kqueue) == 0);
+
     RequireFailure(-1, GuestEbadf);
     Require(close_nid_postfix(file) == 0);
-#ifndef _WIN32
     RequireFailure(file, GuestEbadf);
-#endif
 
     std::filesystem::remove_all(root);
 }
diff --git a/core/libs/tests/GuestFstatvfs.cpp b/core/libs/tests/GuestFstatvfs.cpp
index 487e8bacc7..9137793fbb 100644
--- a/core/libs/tests/GuestFstatvfs.cpp
+++ b/core/libs/tests/GuestFstatvfs.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <array>
@@ -11,16 +15,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-int APS5_VABI fstatvfs_nid_postfix(int, void*);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "fstatvfs check failed at line %d\n", line);
@@ -34,7 +28,7 @@ static void RequireFailure(int descriptor, int error) {
     output.fill(0x5A5A5A5A5A5A5A5Aull);
     const auto saved = output;
     *__error_nid_postfix() = 0;
-    Require(fstatvfs_nid_postfix(descriptor, output.data()) == -1);
+    Require(fstatvfs_nid_postfix(descriptor, reinterpret_cast<LibcStatvfs*>(output.data())) == -1);
     Require(*__error_nid_postfix() == error);
     Require(output == saved);
 }
@@ -43,7 +37,7 @@ static void RequireVolume(int descriptor, const std::filesystem::path& path) {
     std::array<std::uint64_t, 13> guarded;
     guarded.fill(0xA5A5A5A5A5A5A5A5ull);
     *__error_nid_postfix() = 12345;
-    Require(fstatvfs_nid_postfix(descriptor, guarded.data() + 1) == 0);
+    Require(fstatvfs_nid_postfix(descriptor, reinterpret_cast<LibcStatvfs*>(guarded.data() + 1)) == 0);
     Require(*__error_nid_postfix() == 12345);
     Require(guarded.front() == 0xA5A5A5A5A5A5A5A5ull && guarded.back() == guarded.front());
     const auto* fields = guarded.data() + 1;
diff --git a/core/libs/tests/GuestFstatvfsConversion.cpp b/core/libs/tests/GuestFstatvfsConversion.cpp
index f93e221e6b..d8533937ad 100644
--- a/core/libs/tests/GuestFstatvfsConversion.cpp
+++ b/core/libs/tests/GuestFstatvfsConversion.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/KernelStatfs.hpp"
 #include <array>
@@ -7,8 +8,6 @@
 #include <cstring>
 #include <limits>
 
-extern "C" int APS5_VABI fstatvfs_nid_postfix(int, void*);
-
 namespace {
 KernelStatfs backend;
 int backendError;
@@ -55,7 +54,7 @@ int main() {
         };
         const int before = calls;
         guestError = 12345;
-        Require(fstatvfs_nid_postfix(42, output.data() + 1) == 0);
+        Require(fstatvfs_nid_postfix(42, reinterpret_cast<LibcStatvfs*>(output.data() + 1)) == 0);
         Require(calls == before + 1 && guestError == 12345);
         Require(output.front() == 0xA5A5A5A5A5A5A5A5ull && output.back() == output.front());
         Require(std::memcmp(output.data() + 1, expected.data(), sizeof(expected)) == 0);
@@ -63,7 +62,7 @@ int main() {
     backend.f_bavail = -1;
     backend.f_ffree = -2;
     std::array<std::uint64_t, 11> output{};
-    Require(fstatvfs_nid_postfix(42, output.data()) == 0);
+    Require(fstatvfs_nid_postfix(42, reinterpret_cast<LibcStatvfs*>(output.data())) == 0);
     Require(output[0] == std::numeric_limits<std::uint64_t>::max());
     Require(output[3] == std::numeric_limits<std::uint64_t>::max() - 1 && output[4] == output[3]);
     Require(fstatvfs_nid_postfix(42, nullptr) == -1 && guestError == 14);
@@ -71,7 +70,7 @@ int main() {
         backendError = failure;
         output.fill(0x5A5A5A5A5A5A5A5Aull);
         const auto saved = output;
-        Require(fstatvfs_nid_postfix(42, output.data()) == -1 && guestError == failure);
+        Require(fstatvfs_nid_postfix(42, reinterpret_cast<LibcStatvfs*>(output.data())) == -1 && guestError == failure);
         Require(output == saved);
         Require(fstatvfs_nid_postfix(42, nullptr) == -1 && guestError == failure);
     }
diff --git a/core/libs/tests/GuestG2PDialog.cpp b/core/libs/tests/GuestG2PDialog.cpp
index a318e77f68..afb2800b64 100644
--- a/core/libs/tests/GuestG2PDialog.cpp
+++ b/core/libs/tests/GuestG2PDialog.cpp
@@ -1,21 +1,10 @@
+#include "prx/libSceCdlgG2P/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include "prx/libSceUserService/UserService.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceG2PDialogInitialize(void);
-int APS5_VABI sceG2PDialogOpen(const void* param);
-int APS5_VABI sceG2PDialogUpdateStatus(void);
-int APS5_VABI sceG2PDialogGetStatus(void);
-int APS5_VABI sceG2PDialogGetResult(void* result);
-int APS5_VABI sceG2PDialogClose(void);
-int APS5_VABI sceG2PDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -43,7 +32,7 @@ int main() {
     Require(sceG2PDialogTerminate() == kErrNotInitialized);
     Require(sceG2PDialogOpen(&param) == kErrNotInitialized);
     Require(sceG2PDialogClose() == kErrNotInitialized);
-    Require(sceG2PDialogGetResult(result) == kErrNotInitialized);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == kErrNotInitialized);
     Require(sceG2PDialogOpen(nullptr) == static_cast<int>(0x80B8000Du));
     Require(sceG2PDialogGetResult(nullptr) == static_cast<int>(0x80B8000Du));
     Require(sceG2PDialogGetStatus() == kStatusNone);
@@ -55,7 +44,7 @@ int main() {
     Require(sceG2PDialogUpdateStatus() == kStatusInitialized);
 
     Require(sceG2PDialogOpen(nullptr) == kErrArgNull);
-    Require(sceG2PDialogGetResult(result) == kErrNotFinished);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == kErrNotFinished);
 
     param.base.size = 0;
     Require(sceG2PDialogOpen(&param) == static_cast<int>(0x80B8000Au));
@@ -82,7 +71,7 @@ int main() {
     Require(sceG2PDialogUpdateStatus() == kStatusFinished);
 
     Require(sceG2PDialogGetResult(nullptr) == kErrArgNull);
-    Require(sceG2PDialogGetResult(result) == 0);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == 0);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == kResultUserCanceled);
     Require(result[1] == -1);
@@ -97,7 +86,7 @@ int main() {
     Require(sceG2PDialogClose() == static_cast<int>(0x80B8000Bu));
     Require(sceG2PDialogGetStatus() == kStatusInitialized);
     result[2] = -1;
-    Require(sceG2PDialogGetResult(result) == kErrNotFinished);
+    Require(sceG2PDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == kErrNotFinished);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == -1);
     Require(sceG2PDialogTerminate() == 0);
diff --git a/core/libs/tests/GuestGameCustomDataDialog.cpp b/core/libs/tests/GuestGameCustomDataDialog.cpp
new file mode 100644
index 0000000000..5d5d686a9b
--- /dev/null
+++ b/core/libs/tests/GuestGameCustomDataDialog.cpp
@@ -0,0 +1,63 @@
+#include "prx/libSceGameCustomDataDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000D);
+constexpr int kResultUserCanceled = 1;
+
+}
+
+int main() {
+    std::int64_t param = 0;
+    std::int32_t result[2] = {-1, -1};
+
+    Require(sceGameCustomDataDialogTerminate() == kErrNotInitialized);
+    Require(sceGameCustomDataDialogOpenA(&param) == kErrNotInitialized);
+    Require(sceGameCustomDataDialogClose() == kErrNotInitialized);
+    Require(sceGameCustomDataDialogGetResultA(result) == kErrNotInitialized);
+    Require(sceGameCustomDataDialogGetStatus() == kStatusNone);
+    Require(sceGameCustomDataDialogUpdateStatus() == kStatusNone);
+
+    Require(sceGameCustomDataDialogInitialize() == 0);
+    Require(sceGameCustomDataDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceGameCustomDataDialogGetStatus() == kStatusInitialized);
+    Require(sceGameCustomDataDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceGameCustomDataDialogOpenA(nullptr) == kErrArgNull);
+    Require(sceGameCustomDataDialogGetResultA(result) == kErrNotFinished);
+
+    Require(sceGameCustomDataDialogOpenA(&param) == 0);
+    Require(sceGameCustomDataDialogGetStatus() == kStatusFinished);
+    Require(sceGameCustomDataDialogUpdateStatus() == kStatusFinished);
+
+    Require(sceGameCustomDataDialogGetResultA(nullptr) == kErrArgNull);
+    Require(sceGameCustomDataDialogGetResultA(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(result[1] == -1);
+
+    Require(sceGameCustomDataDialogClose() == 0);
+    Require(sceGameCustomDataDialogTerminate() == 0);
+    Require(sceGameCustomDataDialogTerminate() == kErrNotInitialized);
+    Require(sceGameCustomDataDialogGetStatus() == kStatusNone);
+    Require(sceGameCustomDataDialogUpdateStatus() == kStatusNone);
+
+    Require(sceGameCustomDataDialogInitialize() == 0);
+    Require(sceGameCustomDataDialogUpdateStatus() == kStatusInitialized);
+    Require(sceGameCustomDataDialogClose() == 0);
+    Require(sceGameCustomDataDialogUpdateStatus() == kStatusFinished);
+    result[0] = -1;
+    Require(sceGameCustomDataDialogGetResultA(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(sceGameCustomDataDialogTerminate() == 0);
+}
diff --git a/core/libs/tests/GuestGameLiveStreaming.cpp b/core/libs/tests/GuestGameLiveStreaming.cpp
index 8f6f879c8a..7d641c4e23 100644
--- a/core/libs/tests/GuestGameLiveStreaming.cpp
+++ b/core/libs/tests/GuestGameLiveStreaming.cpp
@@ -1,4 +1,6 @@
+#include "prx/libSceGameLiveStreaming/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
@@ -6,32 +8,24 @@
 #include <stdexcept>
 #include <span>
 
-struct GameLiveStreamingStatus2 {
-    std::int32_t userId;
-    bool isOnAir;
-    std::uint8_t align[3];
-    std::uint32_t spectatorCounts;
-    std::uint32_t textMessageCounts;
-    std::uint32_t commandMessageCounts;
-    std::uint32_t broadcastVideoResolution;
-    std::uint8_t reserved[48];
-};
 static_assert(sizeof(GameLiveStreamingStatus2) == 72);
 
-extern "C" {
-int APS5_VABI sceGameLiveStreamingInitialize(std::size_t heap_size);
-int APS5_VABI sceGameLiveStreamingTerminate(void);
-int APS5_VABI sceGameLiveStreamingGetCurrentStatus2(GameLiveStreamingStatus2* status);
-struct GameLiveStreamingProgramInfo;
-int APS5_VABI sceGameLiveStreamingGetProgramInfo(GameLiveStreamingProgramInfo*);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
 
 constexpr std::int32_t kInvalidUserId = -1;
 
+bool EnableThrowsNotInitialized(bool isEnableLiveStreaming) {
+    try {
+        sceGameLiveStreamingEnableLiveStreaming(isEnableLiveStreaming);
+
+    } catch (const std::logic_error&) {
+        return true;
+    }
+    return false;
+}
+
 }
 
 int main() {
@@ -40,8 +34,10 @@ int main() {
     constexpr int notInitialized = static_cast<int>(0x80A00004);
     Require(sceGameLiveStreamingTerminate() == notInitialized);
     Require(sceGameLiveStreamingGetCurrentStatus2(nullptr) == notInitialized);
+    Require(EnableThrowsNotInitialized(true));
     for (const std::size_t size : {0u, 1u, 0x3fffu, 0x4001u, 0x100000u}) Require(sceGameLiveStreamingInitialize(size) == invalidArgument);
     Require(sceGameLiveStreamingInitialize(0x4000) == 0);
+    Require(sceGameLiveStreamingEnableLiveStreaming(true) == 0);
     Require(sceGameLiveStreamingInitialize(0) == invalidArgument);
     Require(sceGameLiveStreamingInitialize(0x4000) == alreadyInitialized);
     Require(sceGameLiveStreamingGetCurrentStatus2(nullptr) == invalidArgument);
@@ -62,17 +58,22 @@ int main() {
         Require(byte == 0);
     }
 
-    bool threwProgramInfo = false;
-    try {
-        sceGameLiveStreamingGetProgramInfo(nullptr);
-    } catch (const std::runtime_error&) {
-        threwProgramInfo = true;
+    Require(sceGameLiveStreamingGetProgramInfo(nullptr) == static_cast<int>(0x80A00002));
+    std::array<std::uint8_t, 0x134C + 16> programInfo{};
+    programInfo.fill(0x7f);
+    Require(sceGameLiveStreamingGetProgramInfo(reinterpret_cast<GameLiveStreamingProgramInfo*>(programInfo.data())) == 0);
+    for (std::size_t i = 0; i < programInfo.size(); ++i) {
+        Require(programInfo[i] == (i < 0x134C ? 0 : 0x7f));
     }
-    Require(threwProgramInfo);
 
+    Require(sceGameLiveStreamingEnableLiveStreaming(false) == 0);
     Require(sceGameLiveStreamingTerminate() == 0);
+    Require(EnableThrowsNotInitialized(false));
     std::memset(&status, 0x7f, sizeof(status));
     Require(sceGameLiveStreamingGetCurrentStatus2(&status) == notInitialized);
     for (const auto value : std::as_bytes(std::span(&status, 1))) Require(value == std::byte{0x7f});
+    programInfo.fill(0x7f);
+    Require(sceGameLiveStreamingGetProgramInfo(reinterpret_cast<GameLiveStreamingProgramInfo*>(programInfo.data())) == notInitialized);
+    for (const std::uint8_t byte : programInfo) Require(byte == 0x7f);
     Require(sceGameLiveStreamingTerminate() == notInitialized);
 }
diff --git a/core/libs/tests/GuestGameUpdate.cpp b/core/libs/tests/GuestGameUpdate.cpp
index c46d451c83..b3df072055 100644
--- a/core/libs/tests/GuestGameUpdate.cpp
+++ b/core/libs/tests/GuestGameUpdate.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceGameUpdate/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -6,16 +7,6 @@
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceGameUpdateInitialize(void);
-int APS5_VABI sceGameUpdateTerminate(void);
-int APS5_VABI sceGameUpdateGetAddcontLatestVersion(std::uint32_t, const NpUnifiedEntitlementLabel*, GameUpdateAddcontVersionInfo*);
-int APS5_VABI sceGameUpdateCreateRequest(void);
-int APS5_VABI sceGameUpdateCheck(int, const GameUpdateCheckParam*, GameUpdateCheckResult*);
-int APS5_VABI sceGameUpdateAbortRequest(int);
-int APS5_VABI sceGameUpdateDeleteRequest(int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TFunction>
diff --git a/core/libs/tests/GuestGenericCategory.cpp b/core/libs/tests/GuestGenericCategory.cpp
index b4f3f98687..36026d3f0b 100644
--- a/core/libs/tests/GuestGenericCategory.cpp
+++ b/core/libs/tests/GuestGenericCategory.cpp
@@ -1,6 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include <array>
+#include <bit>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -8,20 +10,13 @@
 #include <limits>
 #include <stdexcept>
 
-struct Category { void* const* vtable; };
-struct ErrorCode { int value; const Category* category; };
-using Message = GuestLocale::String* (APS5_VABI *)(GuestLocale::String*, const Category*, int);
-using Name = const char* (APS5_VABI *)(const Category*);
-using Condition = ErrorCode (APS5_VABI *)(const Category*, int);
-
-extern "C" {
-const char* APS5_VABI _ZSt13_Syserror_mapi_nid_postfix(int value);
-const Category* APS5_VABI _ZSt16generic_categoryv_nid_postfix();
-GuestLocale::String* APS5_VABI _ZNKSt23_Generic_error_category7messageEi_nid_postfix(
-    GuestLocale::String* result, const Category* self, int value);
-int* APS5_VABI __error_nid_postfix();
-void APS5_VABI _ZdlPv_nid_postfix(void* pointer);
-}
+using Message = GuestLocale::String* (APS5_VABI *)(GuestLocale::String*, const LibcException::CategoryObject*, int);
+using Name = const char* (APS5_VABI *)(const LibcException::CategoryObject*);
+using Condition = LibcException::ErrorCode (APS5_VABI *)(const LibcException::CategoryObject*, int);
+using EquivalentCondition = bool (APS5_VABI *)(const LibcException::CategoryObject*, int, const LibcException::ErrorCode*);
+using EquivalentCode = bool (APS5_VABI *)(const LibcException::CategoryObject*, const LibcException::ErrorCode*, int);
+using Delete = void (APS5_VABI *)(const LibcException::CategoryObject*);
+struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
 
 static void Require(bool value, int line) {
     if (value) return;
@@ -30,7 +25,7 @@ static void Require(bool value, int line) {
 }
 #define REQUIRE(value) Require((value), __LINE__)
 
-static void CheckMessage(Message message, const Category* category, int value, const char* expected) {
+static void CheckMessage(Message message, const LibcException::CategoryObject* category, int value, const char* expected) {
     constexpr std::uint64_t marker = 0xA55AA55AA55AA55Aull;
     struct Guarded { std::uint64_t before; GuestLocale::String result; std::uint64_t after; };
     Guarded guarded {marker, {}, marker};
@@ -48,15 +43,48 @@ static void CheckMessage(Message message, const Category* category, int value, c
     if (length > 15) _ZdlPv_nid_postfix(guarded.result.pointer);
 }
 
+static void CheckSystemCategory(const LibcException::CategoryObject* generic) {
+    const LibcException::CategoryObject* system = _ZSt15system_categoryv_nid_postfix();
+    REQUIRE(system && system != generic && system == _ZSt15system_categoryv_nid_postfix());
+    const auto* type = static_cast<const TypeRecord*>(static_cast<const void* const*>(system->vtable)[-1]);
+    REQUIRE(std::strcmp(type->name, "St22_System_error_category") == 0);
+    REQUIRE(type->base && std::strcmp(type->base->name, "St14error_category") == 0);
+    REQUIRE(std::strcmp(std::bit_cast<Name>(static_cast<const void* const*>(system->vtable)[2])(system), "system") == 0);
+    const auto condition = std::bit_cast<Condition>(static_cast<const void* const*>(system->vtable)[4]);
+    const LibcException::ErrorCode known = condition(system, 2);
+    std::uint64_t head = 0;
+    std::memcpy(&head, &known, sizeof(head));
+    REQUIRE(head == std::uint64_t{2} << 32 && known.value == 2 && known.category == generic);
+    const LibcException::ErrorCode unknown = condition(system, 44);
+    REQUIRE(unknown.reserved == 0 && unknown.value == 44 && unknown.category == system);
+    const auto equivalentCondition = std::bit_cast<EquivalentCondition>(static_cast<const void* const*>(system->vtable)[5]);
+    REQUIRE(equivalentCondition(system, 2, &known));
+    const LibcException::ErrorCode sameCategory {0, 2, system};
+    REQUIRE(!equivalentCondition(system, 2, &sameCategory));
+    REQUIRE(equivalentCondition(system, 44, &unknown));
+    const auto equivalentCode = std::bit_cast<EquivalentCode>(static_cast<const void* const*>(system->vtable)[6]);
+    REQUIRE(equivalentCode(system, &sameCategory, 2) && !equivalentCode(system, &known, 2));
+    const auto message = std::bit_cast<Message>(static_cast<const void* const*>(system->vtable)[3]);
+    CheckMessage(message, system, 2, "no such file or directory");
+    CheckMessage(message, system, 44, "unknown error");
+    bool rejected = false;
+    try { std::bit_cast<Delete>(static_cast<const void* const*>(system->vtable)[1])(system); }
+    catch (const std::invalid_argument&) { rejected = true; }
+    REQUIRE(rejected);
+}
+
 int main() {
     const std::array<void*, 10> api {};
     ApplicationHeapRegister_nid_no_patch(api.data());
-    const Category* category = _ZSt16generic_categoryv_nid_postfix();
+    const LibcException::CategoryObject* category = _ZSt16generic_categoryv_nid_postfix();
     REQUIRE(category && category == _ZSt16generic_categoryv_nid_postfix());
-    REQUIRE(std::strcmp(reinterpret_cast<Name>(category->vtable[2])(category), "generic") == 0);
-    const auto message = reinterpret_cast<Message>(category->vtable[3]);
-    const auto condition = reinterpret_cast<Condition>(category->vtable[4])(category, 35);
-    REQUIRE(condition.value == 35 && condition.category == category);
+    REQUIRE(std::strcmp(std::bit_cast<Name>(static_cast<const void* const*>(category->vtable)[2])(category), "generic") == 0);
+    const auto message = std::bit_cast<Message>(static_cast<const void* const*>(category->vtable)[3]);
+    const auto condition = std::bit_cast<Condition>(static_cast<const void* const*>(category->vtable)[4])(category, 35);
+    REQUIRE(condition.reserved == 0 && condition.value == 35 && condition.category == category);
+    const auto equivalent = std::bit_cast<EquivalentCondition>(static_cast<const void* const*>(category->vtable)[5]);
+    REQUIRE(equivalent(category, 35, &condition));
+    CheckSystemCategory(category);
 
     struct Expected { int value; const char* text; };
     const Expected expected[] {
@@ -89,11 +117,13 @@ int main() {
     REQUIRE(message(&first, category, 25) == &first && message(&second, category, 11) == &second);
     REQUIRE(first.pointer != second.pointer);
     _ZdlPv_nid_postfix(second.pointer);
+
     REQUIRE(std::strcmp(first.pointer, "inappropriate io control operation") == 0);
     _ZdlPv_nid_postfix(first.pointer);
+
     bool rejected = false;
     try { message(nullptr, category, 22); }
     catch (const std::invalid_argument&) { rejected = true; }
     REQUIRE(rejected);
-    std::puts("guest generic category, FreeBSD error map and message ownership: PASS");
+    std::puts("guest generic and system categories, FreeBSD error map and message ownership: PASS");
 }
diff --git a/core/libs/tests/GuestGetitimer.cpp b/core/libs/tests/GuestGetitimer.cpp
index 1fa5f82516..ae97af4f05 100644
--- a/core/libs/tests/GuestGetitimer.cpp
+++ b/core/libs/tests/GuestGetitimer.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -10,19 +12,14 @@
 #include <limits>
 #include <thread>
 
-struct GuestItimerval {
-    KernelTimeval interval;
-    KernelTimeval value;
-};
-
 static_assert(sizeof(GuestItimerval) == 32 && offsetof(GuestItimerval, value) == 16);
 
 extern "C" {
-int APS5_VABI getitimer_nid_postfix(int, GuestItimerval*);
+
 unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int);
-int* APS5_VABI __error_nid_postfix();
+
 using Handler = void (APS5_VABI *)(int);
-Handler APS5_VABI signal_nid_postfix(int, Handler);
+
 }
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestGetlogin.cpp b/core/libs/tests/GuestGetlogin.cpp
index b006a283fc..385c37ce1a 100644
--- a/core/libs/tests/GuestGetlogin.cpp
+++ b/core/libs/tests/GuestGetlogin.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cerrno>
@@ -16,9 +18,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI getlogin_r_nid_postfix(char*, int);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Check(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "getlogin_r check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestGetloginNoSession.cpp b/core/libs/tests/GuestGetloginNoSession.cpp
index c9f29f5513..fc31313d74 100644
--- a/core/libs/tests/GuestGetloginNoSession.cpp
+++ b/core/libs/tests/GuestGetloginNoSession.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cerrno>
@@ -8,8 +9,6 @@
 #include <string>
 #include <unistd.h>
 
-extern "C" int APS5_VABI getlogin_r_nid_postfix(char*, int);
-
 static int loginError = ENXIO;
 
 extern "C" int getlogin_r(char* output, std::size_t size) {
diff --git a/core/libs/tests/GuestGetopt.cpp b/core/libs/tests/GuestGetopt.cpp
index 26e0ca0803..13db14bc90 100644
--- a/core/libs/tests/GuestGetopt.cpp
+++ b/core/libs/tests/GuestGetopt.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
@@ -7,19 +9,8 @@
 #include <string>
 #include <vector>
 
-struct GuestOption {
-    const char* name;
-    int hasArgument;
-    int* flag;
-    int value;
-};
-
 extern "C" {
-int APS5_VABI getopt_nid_postfix(int, char* const*, const char*);
-int APS5_VABI getopt_long_nid_postfix(int, char* const*, const char*, const GuestOption*, int*);
-int APS5_VABI getopt_long_only_nid_postfix(int, char* const*, const char*, const GuestOption*, int*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI unsetenv_nid_postfix(const char*);
+
 extern int opterr_nid_postfix;
 extern int optind_nid_postfix;
 extern int optopt_nid_postfix;
diff --git a/core/libs/tests/GuestGetrlimit.cpp b/core/libs/tests/GuestGetrlimit.cpp
index 5d6d5d2999..9f2a39f589 100644
--- a/core/libs/tests/GuestGetrlimit.cpp
+++ b/core/libs/tests/GuestGetrlimit.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <cstdint>
@@ -18,20 +20,6 @@
 #include <sys/sysctl.h>
 #endif
 
-struct ResourceLimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-
-extern "C" int APS5_VABI getrlimit_nid_postfix(int resource, ResourceLimit* limit);
-extern "C" int* APS5_VABI __error_nid_postfix();
-extern "C" int APS5_VABI getdtablesize_nid_postfix(void);
-extern "C" int APS5_VABI setrlimit_nid_postfix(int resource, const ResourceLimit* limit);
-extern "C" int APS5_VABI pipe_nid_postfix(int* descriptors);
-extern "C" int APS5_VABI close_nid_postfix(int descriptor);
-extern "C" void* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
-extern "C" int APS5_VABI fclose_nid_postfix(void* stream);
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_RLIMIT_CPU = 0;
@@ -54,15 +42,15 @@ static constexpr std::int64_t GUEST_RLIM_INFINITY = std::numeric_limits<std::int
 
 static void Require(bool value) { if (!value) std::abort(); }
 
-static ResourceLimit GuestLimit(int resource) {
-    ResourceLimit limit{-1, -1};
+static GuestResourceLimit GuestLimit(int resource) {
+    GuestResourceLimit limit{-1, -1};
     Require(getrlimit_nid_postfix(resource, &limit) == 0);
     Require(limit.rlim_cur >= 0 && limit.rlim_cur <= limit.rlim_max);
     return limit;
 }
 
 #if defined(_WIN32) || defined(__APPLE__)
-static void RequireDescriptorsEndAt(const ResourceLimit& limit) {
+static void RequireDescriptorsEndAt(const GuestResourceLimit& limit) {
     constexpr int GUEST_EMFILE = 24;
     std::vector<int> descriptors;
     int pair[2]{-1, -1};
@@ -82,19 +70,19 @@ static void RequireDescriptorsEndAt(const ResourceLimit& limit) {
 #ifdef _WIN32
 static void RequireStreamsOpen() {
     const auto path = (std::filesystem::temp_directory_path() / ("aps5-open-streams-" + std::to_string(GetCurrentProcessId()))).string();
-    std::vector<void*> streams;
+    std::vector<FileStream*> streams;
     for (int index = 0; index < 1024; ++index) {
-        void* stream = fopen_nid_postfix(path.c_str(), "ab");
+        FileStream* stream = fopen_nid_postfix(path.c_str(), "ab");
         Require(stream != nullptr);
         streams.push_back(stream);
     }
-    for (void* stream : streams) Require(fclose_nid_postfix(stream) == 0);
+    for (FileStream* stream : streams) Require(fclose_nid_postfix(stream) == 0);
     std::filesystem::remove(path);
 }
 #endif
 
 static void CheckOpenFileLimit() {
-    const ResourceLimit limit = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit limit = GuestLimit(GUEST_RLIMIT_NOFILE);
     Require(limit.rlim_cur == limit.rlim_max);
 #ifdef _WIN32
     Require(limit.rlim_cur == 8192);
@@ -114,20 +102,21 @@ static void CheckOpenFileLimit() {
     RequireDescriptorsEndAt(limit);
 #endif
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &limit) == 0);
-    const ResourceLimit lowered{limit.rlim_max > 1 ? limit.rlim_max - 1 : 1, limit.rlim_max};
+    const GuestResourceLimit lowered{limit.rlim_max > 1 ? limit.rlim_max - 1 : 1, limit.rlim_max};
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &lowered) == 0);
-    const ResourceLimit updated = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit updated = GuestLimit(GUEST_RLIMIT_NOFILE);
     Require(updated.rlim_cur == lowered.rlim_cur);
     Require(updated.rlim_max == lowered.rlim_max);
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &limit) == 0);
-    const ResourceLimit restored = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit restored = GuestLimit(GUEST_RLIMIT_NOFILE);
     Require(restored.rlim_cur == limit.rlim_cur);
     Require(restored.rlim_max == limit.rlim_max);
     if (limit.rlim_max != GUEST_RLIM_INFINITY) {
-        const ResourceLimit raised{limit.rlim_cur, limit.rlim_max + 1};
+        const GuestResourceLimit raised{limit.rlim_cur, limit.rlim_max + 1};
         bool raisedRejected = false;
         try {
             setrlimit_nid_postfix(GUEST_RLIMIT_NOFILE, &raised);
+
         } catch (const std::runtime_error&) {
             raisedRejected = true;
         }
@@ -135,12 +124,17 @@ static void CheckOpenFileLimit() {
     }
 }
 
-static void RequireError(int resource, ResourceLimit* limit, int error) {
+static void RequireError(int resource, GuestResourceLimit* limit, int error) {
     *__error_nid_postfix() = 0;
     Require(getrlimit_nid_postfix(resource, limit) == -1);
     Require(*__error_nid_postfix() == error);
 }
 
+static void RequireInvalidOutputPointer(int resource) {
+    auto* const invalid = reinterpret_cast<GuestResourceLimit*>(static_cast<std::uintptr_t>(1));
+    RequireError(resource, invalid, GUEST_EFAULT);
+}
+
 #ifndef _WIN32
 static std::int64_t Guest(rlim_t value) {
     return value == RLIM_INFINITY ? GUEST_RLIM_INFINITY : static_cast<std::int64_t>(value);
@@ -149,7 +143,7 @@ static std::int64_t Guest(rlim_t value) {
 static void RequireHostLimit(int resource, int hostResource) {
     rlimit host{};
     Require(getrlimit(hostResource, &host) == 0);
-    const ResourceLimit guest = GuestLimit(resource);
+    const GuestResourceLimit guest = GuestLimit(resource);
     Require(guest.rlim_cur == Guest(host.rlim_cur));
     Require(guest.rlim_max == Guest(host.rlim_max));
 }
@@ -185,24 +179,26 @@ int main() {
              GUEST_RLIMIT_KQUEUES,
              GUEST_RLIMIT_UMTXP,
          }) {
-        const ResourceLimit guest = GuestLimit(resource);
+        const GuestResourceLimit guest = GuestLimit(resource);
         Require(guest.rlim_cur == GUEST_RLIM_INFINITY);
         Require(guest.rlim_max == GUEST_RLIM_INFINITY);
         RequireError(resource, nullptr, GUEST_EFAULT);
     }
-    ResourceLimit limit{};
+    GuestResourceLimit limit{};
     RequireError(GUEST_RLIM_NLIMITS, &limit, GUEST_EINVAL);
     RequireError(-1, &limit, GUEST_EINVAL);
     RequireError(GUEST_RLIM_NLIMITS, nullptr, GUEST_EINVAL);
     RequireError(-1, nullptr, GUEST_EINVAL);
     RequireError(GUEST_RLIMIT_DATA, nullptr, GUEST_EFAULT);
-    const ResourceLimit stack = GuestLimit(GUEST_RLIMIT_STACK);
+    RequireInvalidOutputPointer(GUEST_RLIMIT_DATA);
+    RequireInvalidOutputPointer(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit stack = GuestLimit(GUEST_RLIMIT_STACK);
     Require(stack.rlim_cur == 0x200000 && stack.rlim_max == 0x200000);
     RequireError(GUEST_RLIMIT_STACK, nullptr, GUEST_EFAULT);
-    const ResourceLimit processes = GuestLimit(GUEST_RLIMIT_NPROC);
+    const GuestResourceLimit processes = GuestLimit(GUEST_RLIMIT_NPROC);
     Require(processes.rlim_cur == 1604 && processes.rlim_max == 1604);
     RequireError(GUEST_RLIMIT_NPROC, nullptr, GUEST_EFAULT);
-    const ResourceLimit nofile = GuestLimit(GUEST_RLIMIT_NOFILE);
+    const GuestResourceLimit nofile = GuestLimit(GUEST_RLIMIT_NOFILE);
     const int tableSize = getdtablesize_nid_postfix();
     std::int64_t expectedTableSize = nofile.rlim_cur;
 #ifndef _WIN32
diff --git a/core/libs/tests/GuestGetrusage.cpp b/core/libs/tests/GuestGetrusage.cpp
index 7fefbdca94..1cfd2b9fe8 100644
--- a/core/libs/tests/GuestGetrusage.cpp
+++ b/core/libs/tests/GuestGetrusage.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -8,16 +10,10 @@ struct Timeval {
     std::int64_t tv_sec;
     std::int64_t tv_usec;
 };
-struct ResourceUsage {
-    Timeval ru_utime;
-    Timeval ru_stime;
-    std::int64_t rest[14];
-};
-extern "C" int APS5_VABI getrusage_nid_postfix(int who, ResourceUsage* usage);
-extern "C" int* APS5_VABI __error_nid_postfix();
+
 static void Require(bool value) { if (!value) std::abort(); }
 static std::int64_t CpuMicros(int who) {
-    ResourceUsage usage{};
+    GuestResourceUsage usage{};
     Require(getrusage_nid_postfix(who, &usage) == 0);
     return (usage.ru_utime.tv_sec + usage.ru_stime.tv_sec) * 1000000 + usage.ru_utime.tv_usec + usage.ru_stime.tv_usec;
 }
@@ -29,15 +25,15 @@ static void SpinUntil(int who, std::int64_t micros) {
         Require(std::chrono::steady_clock::now() < deadline);
     }
 }
-static void RequireFailure(int who, ResourceUsage* usage, int error) {
+static void RequireFailure(int who, GuestResourceUsage* usage, int error) {
     *__error_nid_postfix() = 0;
     Require(getrusage_nid_postfix(who, usage) == -1);
     Require(*__error_nid_postfix() == error);
 }
 int main() {
-    ResourceUsage untouched;
+    GuestResourceUsage untouched;
     std::memset(&untouched, 0x5a, sizeof(untouched));
-    const ResourceUsage pattern = untouched;
+    const GuestResourceUsage pattern = untouched;
     RequireFailure(2, &untouched, 22);
     RequireFailure(-2, &untouched, 22);
     Require(std::memcmp(&untouched, &pattern, sizeof(untouched)) == 0);
@@ -45,10 +41,10 @@ int main() {
     RequireFailure(0, nullptr, 14);
     RequireFailure(1, nullptr, 14);
     RequireFailure(-1, nullptr, 14);
-    ResourceUsage children;
+    GuestResourceUsage children;
     std::memset(&children, 0xff, sizeof(children));
     Require(getrusage_nid_postfix(-1, &children) == 0);
-    const ResourceUsage empty{};
+    const GuestResourceUsage empty{};
     Require(std::memcmp(&children, &empty, sizeof(children)) == 0);
     SpinUntil(0, 400000);
     const std::int64_t mainThread = CpuMicros(1);
diff --git a/core/libs/tests/GuestGets.cpp b/core/libs/tests/GuestGets.cpp
new file mode 100644
index 0000000000..4862729c19
--- /dev/null
+++ b/core/libs/tests/GuestGets.cpp
@@ -0,0 +1,156 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/FileStream.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <atomic>
+#include <cerrno>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+extern "C" {
+extern FileStream* __stdinp_nid_postfix;
+
+}
+
+namespace {
+
+using Gets = char* (APS5_VABI*)(char*);
+Gets readLine;
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "gets: %s\n", message);
+    std::abort();
+}
+
+class Input {
+    FileStream* previous = __stdinp_nid_postfix;
+    FileStream stream;
+
+public:
+    explicit Input(std::FILE* handle) : stream(handle) { __stdinp_nid_postfix = &stream; }
+    Input(const void* bytes, std::size_t size) : stream(std::tmpfile()) {
+        Require(std::fwrite(bytes, 1, size, stream.GetHandle()) == size, "seed input");
+        std::rewind(stream.GetHandle());
+        __stdinp_nid_postfix = &stream;
+    }
+    ~Input() {
+        __stdinp_nid_postfix = previous;
+        if (stream.IsOpen()) stream.Close();
+    }
+    FileStream& Stream() { return stream; }
+};
+
+void CheckBytes() {
+    std::array<unsigned char, 257> bytes;
+    std::size_t size = 0;
+    for (unsigned value = 0; value < 256; ++value)
+        if (value != '\n') bytes[size++] = static_cast<unsigned char>(value);
+    bytes[size++] = '\n';
+    Input input(bytes.data(), size);
+    std::array<unsigned char, 264> output;
+    output.fill(0xa5);
+    *__error_nid_postfix() = 123;
+    Require(readLine(reinterpret_cast<char*>(output.data() + 4)) == reinterpret_cast<char*>(output.data() + 4), "byte read pointer");
+    const int error = *__error_nid_postfix();
+    Require(std::memcmp(output.data() + 4, bytes.data(), 255) == 0 && output[259] == 0, "all byte values and terminator");
+    Require(error == 123, "successful read preserves errno");
+    for (std::size_t index = 0; index < 4; ++index) Require(output[index] == 0xa5, "prefix guard");
+    for (std::size_t index = 260; index < output.size(); ++index) Require(output[index] == 0xa5, "suffix guard");
+    output.fill(0xa5);
+    Require(readLine(reinterpret_cast<char*>(output.data() + 4)) == nullptr, "EOF return");
+    for (const auto value : output) Require(value == 0xa5, "initial EOF leaves buffer unchanged");
+    Require((input.Stream().GuestState().flags & 0x20) != 0, "guest EOF flag");
+}
+
+void CheckLines() {
+    const char text[] = "\nfirst\r\nlast";
+    Input input(text, sizeof(text) - 1);
+    char output[16];
+    Require(readLine(output) == output && output[0] == 0, "empty line");
+    Require(readLine(output) == output && std::strcmp(output, "first\r") == 0, "newline removed without dropping carriage return");
+    Require(readLine(output) == output && std::strcmp(output, "last") == 0, "partial last line at EOF");
+    output[0] = 'x';
+    Require(readLine(output) == nullptr && output[0] == 'x', "repeated EOF preserves destination");
+}
+
+void CheckErrors() {
+    Input input("", 0);
+    input.Stream().Close();
+    char output[8] = "keep";
+    Require(readLine(output) == nullptr && std::strcmp(output, "keep") == 0 && *__error_nid_postfix() == 9, "closed input");
+    bool threw = false;
+    try { readLine(nullptr); } catch (const std::invalid_argument&) { threw = true; }
+    Require(threw, "null buffer is explicit unsupported input");
+}
+
+void CheckReadError(const char* path) {
+    {
+        Input input(std::fopen(path, "wb"));
+        std::array<char, 8> output;
+        output.fill('x');
+        Require(readLine(output.data()) == nullptr, "write-only input read error");
+        for (const auto value : output) Require(value == 'x', "initial read error leaves destination unchanged");
+        Require((input.Stream().GuestState().flags & 0x40) != 0, "guest error flag");
+    }
+    Require(std::remove(path) == 0, "remove error fixture");
+}
+
+void CheckThreads() {
+    constexpr unsigned lines = 2048;
+    std::array<char, lines * 9> text;
+    for (unsigned index = 0; index < lines; ++index)
+        std::snprintf(text.data() + index * 8, 9, "%07u\n", index);
+    Input input(text.data(), lines * 8);
+    std::array<std::atomic<unsigned>, lines> seen{};
+    std::atomic<bool> invalid{false};
+    std::vector<std::thread> workers;
+    for (unsigned thread = 0; thread < 8; ++thread) workers.emplace_back([&] {
+        char output[lines * 8 + 1];
+        while (readLine(output)) {
+            if (std::strlen(output) != 7) { invalid = true; continue; }
+            unsigned index = 0;
+            bool digits = true;
+            for (unsigned digit = 0; digit < 7; ++digit) {
+                if (output[digit] < '0' || output[digit] > '9') { digits = false; break; }
+                index = index * 10 + static_cast<unsigned>(output[digit] - '0');
+            }
+            if (!digits || index >= lines) invalid = true;
+            else ++seen[index];
+        }
+    });
+    for (auto& worker : workers) worker.join();
+    Require(!invalid, "concurrent line contents");
+    for (auto& count : seen) Require(count == 1, "each line read exactly once");
+}
+
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 3, "expected libc path and scratch file");
+#ifdef _WIN32
+    const auto library = LoadLibraryA(argv[1]);
+    Require(library != nullptr, "load libc");
+    readLine = reinterpret_cast<Gets>(GetProcAddress(library, "gets_nid_postfix"));
+#else
+    const auto library = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    Require(library != nullptr, "load libc");
+    readLine = reinterpret_cast<Gets>(dlsym(library, "gets_nid_postfix"));
+#endif
+    Require(readLine != nullptr, "missing gets export");
+    CheckBytes();
+    CheckLines();
+    CheckErrors();
+    CheckReadError(argv[2]);
+    CheckThreads();
+    std::puts("gets checks passed");
+}
diff --git a/core/libs/tests/GuestGnmNeoDefaultState.cpp b/core/libs/tests/GuestGnmNeoDefaultState.cpp
new file mode 100644
index 0000000000..c4731f75ea
--- /dev/null
+++ b/core/libs/tests/GuestGnmNeoDefaultState.cpp
@@ -0,0 +1,69 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <initializer_list>
+
+namespace {
+
+using StateWriter = int (APS5_VABI *)(std::uint32_t*, std::uint32_t);
+
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr std::uint32_t BufferWords = 0x110;
+
+std::uint32_t g_words[BufferWords];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+std::uint32_t* Fresh() {
+    for (auto& word : g_words) word = Untouched;
+    return g_words;
+}
+
+void RequireAt(std::uint32_t at, std::initializer_list<std::uint32_t> expected) {
+    for (const auto word : expected) Require(g_words[at++] == word);
+}
+
+void RequireUntouchedFrom(std::uint32_t at) {
+    for (; at < BufferWords; ++at) Require(g_words[at] == Untouched);
+}
+
+void CheckHardwareState(StateWriter writer, std::uint32_t stateWords, std::initializer_list<std::uint32_t> tail) {
+    Require(writer(Fresh(), 0xff) == 0);
+    RequireUntouchedFrom(0);
+
+    Require(writer(Fresh(), 0x100) == 0x100);
+    RequireAt(0, {0xc0012800u, 0x80000000u, 0x80000000u, 0xc0001200u, 0, 0xc0055800u, 0x2ec47fc0u, 0xffffffffu, 0, 0, 0, 10});
+    RequireAt(12, {0xc0017600u, 0x216, 0xffffffffu, 0xc0017600u, 0x217, 0xffffffffu});
+    const std::uint32_t end = 12 + stateWords;
+    RequireAt(end - static_cast<std::uint32_t>(tail.size()), tail);
+    const std::uint32_t padding = 0x100 - end - 1;
+    RequireAt(end, {0xc0001000u | ((padding - 1) << 16), 0});
+    for (std::uint32_t at = end + 2; at < 0x100; ++at) Require(g_words[at] == Untouched);
+    RequireUntouchedFrom(0x100);
+
+    Require(writer(Fresh(), 0x10f) == 0x100);
+    RequireUntouchedFrom(0x100);
+}
+
+void CheckContextState(StateWriter writer, std::uint32_t packetWords, std::uint32_t stateWords, std::initializer_list<std::uint32_t> tail) {
+    Require(writer(Fresh(), packetWords - 1) == 0);
+    RequireUntouchedFrom(0);
+    Require(writer(Fresh(), packetWords + 1) == 0);
+    RequireUntouchedFrom(0);
+
+    Require(writer(Fresh(), packetWords) == static_cast<int>(packetWords));
+    RequireAt(0, {0xc0012800u, 0x80000000u, 0x80000000u, 0xc0001200u, 0});
+    RequireAt(stateWords - static_cast<std::uint32_t>(tail.size()), tail);
+    RequireUntouchedFrom(stateWords);
+}
+
+} // namespace
+
+int main() {
+    CheckHardwareState(sceGnmDrawInitDefaultHardwareState, 115, {0x100, 4, 0xc0017900u, 0x200, 0xe0000000u});
+    CheckHardwareState(sceGnmDrawInitDefaultHardwareState200, 131, {0x200, 0xe0000000u, 0xc0017900u, 0x40000258u, 0x6d007fu});
+    CheckHardwareState(sceGnmDrawInitDefaultHardwareState350, 134, {0x200, 0xe0000000u, 0xc0017900u, 0x40000258u, 0x6d007fu});
+    CheckContextState(sceGnmDrawInitToDefaultContextState, 0x20, 19, {0xff00ff00u, 0xff00, 0xc00d1000u, 0});
+    CheckContextState(sceGnmDrawInitToDefaultContextState400, 0x100, 102, {0x40000258u, 0x6d007fu, 0xc09a1000u, 0});
+}
diff --git a/core/libs/tests/GuestGnmNeoEmbedded.cpp b/core/libs/tests/GuestGnmNeoEmbedded.cpp
new file mode 100644
index 0000000000..fb8f7caa80
--- /dev/null
+++ b/core/libs/tests/GuestGnmNeoEmbedded.cpp
@@ -0,0 +1,73 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <initializer_list>
+
+namespace {
+
+constexpr int Failure = static_cast<int>(0x8EEE00FFu);
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr std::uint32_t BufferWords = 48;
+
+std::uint32_t g_words[BufferWords];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+std::uint32_t* Fresh() {
+    for (auto& word : g_words) word = Untouched;
+    return g_words;
+}
+
+void RequireAt(std::uint32_t at, std::initializer_list<std::uint32_t> expected) {
+    for (const auto word : expected) Require(g_words[at++] == word);
+}
+
+void RequireUntouchedFrom(std::uint32_t at) {
+    for (; at < BufferWords; ++at) Require(g_words[at] == Untouched);
+}
+
+const std::uint32_t* ShaderCode() {
+    const auto address = (static_cast<std::uintptr_t>(g_words[3]) << 40) | (static_cast<std::uintptr_t>(g_words[2]) << 8);
+    return reinterpret_cast<const std::uint32_t*>(address);
+}
+
+void CheckVs() {
+    Require(sceGnmSetEmbeddedVsShader(Fresh(), 0x1d, 0, 0) == 0);
+    RequireAt(0, {0xc0027600u, 0x48});
+    RequireAt(4, {0xc0027600u, 0x4a, 0xc0000, 4, 0xc0016900u, 0x207, 0, 0xc0016900u, 0x1b1, 0, 0xc0016900u, 0x1c3, 4,
+        0xc00a1000u, 0});
+    RequireUntouchedFrom(19);
+    const auto* code = ShaderCode();
+    Require(code[0] == 0xbeeb0387u && code[10] == 0xf80008cfu && code[11] == 0x03020001u && code[14] == 0xbf810000u);
+
+    Require(sceGnmSetEmbeddedVsShader(Fresh(), 0x1d, 1, 0) == Failure);
+    RequireUntouchedFrom(0);
+}
+
+void CheckPs() {
+    Require(sceGnmSetEmbeddedPsShader(Fresh(), 0x28, 0, 0) == 0);
+    RequireAt(0, {0xc0027600u, 8});
+    RequireAt(4, {0xc0027600u, 10, 0xc0000, 4, 0xc0026900u, 0x1c4, 0, 4, 0xc0026900u, 0x1b3, 2, 2, 0xc0016900u, 0x1b6, 0,
+        0xc0016900u, 0x1b8, 0, 0xc0016900u, 0x203, 0x10, 0xc0016900u, 0x8f, 0xf, 0xc00a1000u, 0});
+    RequireUntouchedFrom(30);
+    const auto* black = ShaderCode();
+    Require(black[0] == 0xbeeb0383u && black[2] == 0x5e000100u && black[4] == 0xf8001c0fu && black[6] == 0xbf810000u);
+
+    Require(sceGnmSetEmbeddedPsShader(Fresh(), 0x28, 1, 0) == 0);
+    RequireAt(4, {0xc0027600u, 10, 0x2000, 0, 0xc0026900u, 0x1c4, 0, 2, 0xc0026900u, 0x1b3, 2, 2, 0xc0016900u, 0x1b6, 0,
+        0xc0016900u, 0x1b8, 0, 0xc0016900u, 0x203, 0x10, 0xc0016900u, 0x8f, 3, 0xc00a1000u, 0});
+    RequireUntouchedFrom(30);
+    const auto* depthOnly = ShaderCode();
+    Require(depthOnly != black && depthOnly[1] == 0x7e040280u && depthOnly[2] == 0xf8001803u && depthOnly[4] == 0xbf810000u);
+
+    Require(sceGnmSetEmbeddedPsShader(Fresh(), 0x28, 2, 0) == Failure);
+    RequireUntouchedFrom(0);
+}
+
+} // namespace
+
+int main() {
+    CheckVs();
+    CheckPs();
+}
diff --git a/core/libs/tests/GuestGnmNeoPackets.cpp b/core/libs/tests/GuestGnmNeoPackets.cpp
new file mode 100644
index 0000000000..b31a5d0897
--- /dev/null
+++ b/core/libs/tests/GuestGnmNeoPackets.cpp
@@ -0,0 +1,136 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <initializer_list>
+
+namespace {
+
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr std::uint32_t U = Untouched;
+
+std::uint32_t g_words[16];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+std::uint32_t* Fresh() {
+    for (auto& word : g_words) word = Untouched;
+    return g_words;
+}
+
+void RequireWords(std::initializer_list<std::uint32_t> expected) {
+    std::size_t at = 0;
+    for (const auto word : expected) Require(g_words[at++] == word);
+    for (; at < 16; ++at) Require(g_words[at] == Untouched);
+}
+
+void RequireRefused(int result) {
+    Require(result == -1);
+    RequireWords({});
+}
+
+void CheckDirectDraws() {
+    Require(sceGnmInsertDingDongMarker(Fresh(), 4) == 0);
+    RequireWords({0xc0021000u, 0, 0, 0});
+    RequireRefused(sceGnmInsertDingDongMarker(Fresh(), 3));
+    Require(sceGnmInsertDingDongMarker(nullptr, 4) == -1);
+
+    Require(sceGnmDrawIndexAuto(Fresh(), 7, 36, 0xe0000001u) == 0);
+    RequireWords({0xc0012d00u, 36, 0xe0000002u, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndexAuto(Fresh(), 7, 36, 2));
+    RequireRefused(sceGnmDrawIndexAuto(Fresh(), 6, 36, 0));
+
+    Require(sceGnmDrawIndex(Fresh(), 10, 99, 0x123456789abcull, 0x20000000u, 0) == 0);
+    RequireWords({0xc0042700u, 99, 0x56789abcu, 0x1234, 99, 0x20000000u, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndex(Fresh(), 10, 99, 0x1001, 0, 0));
+    RequireRefused(sceGnmDrawIndex(Fresh(), 10, 99, 0, 0, 0));
+    RequireRefused(sceGnmDrawIndex(Fresh(), 10, 99, 0x1000, 0x10, 0));
+
+    Require(sceGnmDrawIndexOffset(Fresh(), 9, 4, 12, 0x40000001u) == 0);
+    RequireWords({0xc0033501u, 12, 4, 12, 0x40000000u, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndexOffset(Fresh(), 10, 4, 12, 0));
+}
+
+void CheckDispatches() {
+    Require(sceGnmDispatchDirect(Fresh(), 9, 8, 4, 2, 0x19) == 0);
+    RequireWords({0xc0031503u, 8, 4, 2, 0x19, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDispatchDirect(Fresh(), 9, 0x80000000u, 1, 1, 0));
+    RequireRefused(sceGnmDispatchDirect(Fresh(), 8, 1, 1, 1, 0));
+
+    Require(sceGnmDispatchIndirect(Fresh(), 7, 0x40, 0x8) == 0);
+    RequireWords({0xc0011602u, 0x40, 9, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDispatchIndirect(Fresh(), 9, 0x40, 0));
+
+    Require(sceGnmDispatchIndirectOnMec(Fresh(), 8, 0x700001000ull, 0x19) == 0);
+    RequireWords({0xc0021603u, 0x1000, 7, 0x19, 0xc0021000u, 0});
+    RequireRefused(sceGnmDispatchIndirectOnMec(Fresh(), 8, 0x700001002ull, 0));
+    RequireRefused(sceGnmDispatchIndirectOnMec(Fresh(), 8, 0, 0));
+}
+
+void CheckIndirectDraws() {
+    Require(sceGnmDrawIndirect(Fresh(), 9, 0x20, 2, 3, 5, 0x20000001u) == 0);
+    RequireWords({0xc0032401u, 0x20, 0x4f, 0x51, 0x20000002u, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndirect(Fresh(), 9, 0x20, 7, 0, 0, 0));
+    RequireRefused(sceGnmDrawIndirect(Fresh(), 9, 0x20, 2, 0x10, 0, 0));
+
+    Require(sceGnmDrawIndexIndirect(Fresh(), 9, 0x60, 4, 1, 0, 0x1) == 0);
+    RequireWords({0xc0032501u, 0x60, 0xcd, 0, 0, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndexIndirect(Fresh(), 9, 0x60, 4, 0, 0x10, 0));
+
+    Require(sceGnmDrawIndirectMulti(Fresh(), 11, 0x30, 6, 6, 2, 0, 0x80000000u) == 0);
+    RequireWords({0xc0052c00u, 0x30, 0x14e, 0, 6, 0x10, 0x80000002u, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndirectMulti(Fresh(), 9, 0x30, 6, 6, 2, 0, 0));
+
+    Require(sceGnmDrawIndexIndirectMulti(Fresh(), 11, 0x30, 6, 2, 0, 1, 0x60000000u) == 0);
+    RequireWords({0xc0053800u, 0x30, 0, 0x4d, 6, 0x14, 0x60000000u, 0xc0021000u, 0, U, U});
+    RequireRefused(sceGnmDrawIndexIndirectMulti(Fresh(), 11, 0x30, 6, 0, 0, 0, 0));
+    RequireRefused(sceGnmDrawIndexIndirectMulti(Fresh(), 11, 0x30, 6, 3, 0, 0, 0));
+
+    Require(sceGnmDrawIndirectCountMulti(Fresh(), 16, 0, 5, 0x200000040ull, 2, 1, 1, 1) == 0);
+    RequireWords({0xc0011000u, 0, U, 0xc0089c01u, 0, 0x4d, 0x4d, 0x40000000u, 5, 0x40, 2, 0x10, 2, 0xc0011000u, 0, U});
+    RequireRefused(sceGnmDrawIndirectCountMulti(Fresh(), 15, 0, 5, 0, 2, 1, 1, 0));
+
+    Require(sceGnmDrawIndexIndirectCountMulti(Fresh(), 16, 0x14, 3, 0, 6, 0, 0, 0xe0000000u) == 0);
+    RequireWords({0xc0011000u, 0, U, 0xc0089d00u, 0x14, 0, 0, 0, 3, 0, 0, 0x14, 0xe0000000u, 0xc0011000u, 0, U});
+    RequireRefused(sceGnmDrawIndexIndirectCountMulti(Fresh(), 16, 0, 3, 0, 5, 0, 0, 0));
+}
+
+void CheckComputeWaits() {
+    Require(sceGnmComputeWaitSemaphore(Fresh(), 10, 0x123456780ull, 1) == 0);
+    RequireWords({0xc0021000u, 0, U, U, 0xc0013900u, 0x23456780u, 0xe0100001u, 0xc0011000u, 0, U});
+    Require(sceGnmComputeWaitSemaphore(Fresh(), 10, 0x123456780ull, 0) == 0);
+    Require(g_words[6] == 0xe0000001u);
+    RequireRefused(sceGnmComputeWaitSemaphore(Fresh(), 9, 0, 0));
+
+    Require(sceGnmComputeWaitOnAddress(Fresh(), 14, 0x500001003ull, 0xff, 0xb, 7) == 0);
+    RequireWords({0xc0021000u, 0, U, U, 0xc0053c00u, 0x13, 0x1000, 5, 7, 0xff, 10, 0xc0011000u, 0, U});
+    Require(sceGnmComputeWaitOnAddress(Fresh(), 14, 0x1234, 1, 3, 0) == 0);
+    RequireWords({0xc0021000u, 0, U, U, 0xc0053c00u, 3, 0x1234, 0, 0, 1, 10, 0xc0011000u, 0, U});
+    RequireRefused(sceGnmComputeWaitOnAddress(Fresh(), 13, 0x1234, 1, 3, 0));
+}
+
+void CheckVgtControl() {
+    Require(sceGnmSetVgtControl(Fresh(), 3, 0x7f, 1, 1) == 0);
+    RequireWords({0xc0017900u, 0x40000258u, 0x75007fu});
+    Require(sceGnmSetVgtControl(Fresh(), 3, 0x10, 1, 0) == 0);
+    RequireWords({0xc0017900u, 0x40000258u, 0x6d0010u});
+    RequireRefused(sceGnmSetVgtControl(Fresh(), 3, 0x100, 0, 0));
+    RequireRefused(sceGnmSetVgtControl(Fresh(), 3, 0, 2, 0));
+    RequireRefused(sceGnmSetVgtControl(Fresh(), 3, 0, 0, 2));
+    RequireRefused(sceGnmSetVgtControl(Fresh(), 4, 0, 0, 0));
+
+    Require(sceGnmResetVgtControl(Fresh(), 3) == 0);
+    RequireWords({0xc0017900u, 0x40000258u, 0x6d007fu});
+    RequireRefused(sceGnmResetVgtControl(Fresh(), 2));
+    Require(sceGnmResetVgtControl(nullptr, 3) == -1);
+}
+
+} // namespace
+
+int main() {
+    CheckDirectDraws();
+    CheckDispatches();
+    CheckIndirectDraws();
+    CheckComputeWaits();
+    CheckVgtControl();
+}
diff --git a/core/libs/tests/GuestGnmNeoRetail.cpp b/core/libs/tests/GuestGnmNeoRetail.cpp
index 29148976fa..3101ebb9b0 100644
--- a/core/libs/tests/GuestGnmNeoRetail.cpp
+++ b/core/libs/tests/GuestGnmNeoRetail.cpp
@@ -1,58 +1,8 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceGnmDebugModuleReset(void);
-int APS5_VABI sceGnmDebugReset(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterface(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForGpuDebugger(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForReplay(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForResourceRegistration(void);
-int APS5_VABI sceGnmDriverInternalRetrieveGnmInterfaceForValidation(void);
-int APS5_VABI sceGnmDriverTraceInProgress(void);
-int APS5_VABI sceGnmFindResources(void);
-int APS5_VABI sceGnmFindResourcesPublic(void);
-int APS5_VABI sceGnmGetDbgGcHandle(void);
-int APS5_VABI sceGnmGetOwnerName(void);
-int APS5_VABI sceGnmGetPhysicalCounterFromVirtualized(void);
-int APS5_VABI sceGnmGetResourceBaseAddressAndSizeInBytes(void);
-int APS5_VABI sceGnmGetResourceName(void);
-int APS5_VABI sceGnmGetResourceRegistrationBuffers(void);
-int APS5_VABI sceGnmGetResourceShaderGuid(void);
-int APS5_VABI sceGnmGetResourceType(void);
-int APS5_VABI sceGnmGetResourceUserData(void);
-int APS5_VABI sceGnmQueryResourceRegistrationUserMemoryRequirements(void);
-int APS5_VABI sceGnmRegisterGdsResource(void);
-int APS5_VABI sceGnmRegisterOwner(void);
-int APS5_VABI sceGnmRegisterOwnerForSystem(void);
-int APS5_VABI sceGnmRegisterResource(void);
-int APS5_VABI sceGnmSdmaClose(void);
-int APS5_VABI sceGnmSdmaConstFill(void);
-int APS5_VABI sceGnmSdmaCopyLinear(void);
-int APS5_VABI sceGnmSdmaCopyTiled(void);
-int APS5_VABI sceGnmSdmaCopyWindow(void);
-int APS5_VABI sceGnmSdmaFlush(void);
-int APS5_VABI sceGnmSdmaGetMinCmdSize(void);
-int APS5_VABI sceGnmSdmaOpen(void);
-int APS5_VABI sceGnmSetResourceRegistrationUserMemory(void);
-int APS5_VABI sceGnmSetResourceUserData(void);
-int APS5_VABI sceGnmSetSpiEnableSqCounters(void);
-int APS5_VABI sceGnmSetSpiEnableSqCountersForUnitInstance(void);
-int APS5_VABI sceGnmUnregisterAllResourcesForOwner(void);
-int APS5_VABI sceGnmUnregisterOwnerAndResources(void);
-int APS5_VABI sceGnmUnregisterResource(void);
-int APS5_VABI sceGnmValidateDisableDiagnostics(void);
-int APS5_VABI sceGnmValidateDisableDiagnostics2(void);
-int APS5_VABI sceGnmValidateDispatchCommandBuffers(void);
-int APS5_VABI sceGnmValidateDrawCommandBuffers(void);
-int APS5_VABI sceGnmValidateGetDiagnosticInfo(void);
-int APS5_VABI sceGnmValidateGetDiagnostics(void);
-int APS5_VABI sceGnmValidateOnSubmitEnabled(void);
-int APS5_VABI sceGnmValidateResetState(void);
-int APS5_VABI sceGnmValidationRegisterMemoryCheckCallback(void);
-}
-
 namespace {
 
 constexpr int Failure = static_cast<int>(0x8EEE00FFu);
diff --git a/core/libs/tests/GuestGnmNeoShaders.cpp b/core/libs/tests/GuestGnmNeoShaders.cpp
new file mode 100644
index 0000000000..75760c5b1e
--- /dev/null
+++ b/core/libs/tests/GuestGnmNeoShaders.cpp
@@ -0,0 +1,128 @@
+#include "prx/libSceGnmDriverForNeoMode/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <initializer_list>
+
+namespace {
+
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr std::size_t BufferWords = 48;
+constexpr std::uint32_t Regs[12] = {0x1000, 0, 0x2000, 0x3000, 0x4000, 0x5000, 0x6000, 0x7000, 0x8000, 0x9000, 0xa000, 0xb000};
+constexpr std::uint32_t BadRegs[12] = {0x1000, 1};
+constexpr std::uint32_t MaskedRegs[12] = {0x1000, 0, 0x030003c0u, 0x3000, 0x4000, 0x5000, 0x6000};
+
+std::uint32_t g_words[BufferWords];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+std::uint32_t* Fresh() {
+    for (auto& word : g_words) word = Untouched;
+    return g_words;
+}
+
+void RequireWords(std::initializer_list<std::uint32_t> expected) {
+    std::size_t at = 0;
+    for (const auto word : expected) Require(g_words[at++] == word);
+    for (; at < BufferWords; ++at) Require(g_words[at] == Untouched);
+}
+
+void RequireRefused(int result) {
+    Require(result == -1);
+    RequireWords({});
+}
+
+void CheckVs() {
+    Require(sceGnmUpdateVsShader(Fresh(), 0x1d, Regs, 0) == 0);
+    RequireWords({0xc0027600u, 0x48, 0x1000, 0, 0xc0027600u, 0x4a, 0x2000, 0x3000, 0xc0011000u, 0xc01e0207u, 0x6000,
+        0xc0011000u, 0xc01e01b1u, 0x4000, 0xc0011000u, 0xc01e01c3u, 0x5000, 0xc00a1000u, 0});
+    Require(sceGnmUpdateVsShader(Fresh(), 0x1d, MaskedRegs, 0x40) == 0);
+    Require(g_words[6] == 0x40);
+    Require(sceGnmUpdateVsShader(Fresh(), 0x1d, MaskedRegs, 0) == 0);
+    Require(g_words[6] == 0x030003c0u);
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1d, Regs, 0x80000000u));
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1c, Regs, 0));
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1d, BadRegs, 0));
+    RequireRefused(sceGnmUpdateVsShader(Fresh(), 0x1d, nullptr, 0));
+}
+
+void CheckPs() {
+    Require(sceGnmUpdatePsShader(Fresh(), 0x28, Regs) == 0);
+    RequireWords({0xc0027600u, 8, 0x1000, 0, 0xc0027600u, 10, 0x2000, 0x3000, 0xc0021000u, 0xc01e01c4u, 0x4000, 0x5000,
+        0xc0021000u, 0xc01e01b3u, 0x6000, 0x7000, 0xc0011000u, 0xc01e01b6u, 0x8000, 0xc0011000u, 0xc01e01b8u, 0x9000,
+        0xc0011000u, 0xc01e0203u, 0xa000, 0xc0011000u, 0xc01e008fu, 0xb000, 0xc00a1000u, 0});
+    Require(sceGnmUpdatePsShader(Fresh(), 0x28, nullptr) == 0);
+    RequireWords({0xc0027600u, 8, 0, 0, 0xc0011000u, 0xc01e0203u, 0, 0xc01f1000u, 0});
+    RequireRefused(sceGnmUpdatePsShader(Fresh(), 0x27, Regs));
+    RequireRefused(sceGnmUpdatePsShader(Fresh(), 0x28, BadRegs));
+
+    Require(sceGnmUpdatePsShader350(Fresh(), 0x28, Regs) == 0);
+    Require(g_words[26] == 0xc01e008fu && g_words[28] == 0xc00a1000u);
+    Require(sceGnmUpdatePsShader350(Fresh(), 0x28, nullptr) == 0);
+    RequireWords({0xc0027600u, 8, 0, 0, 0xc0011000u, 0xc01e0203u, 0, 0xc0016900u, 0x8f, 0xf, 0xc01c1000u, 0});
+    RequireRefused(sceGnmUpdatePsShader350(Fresh(), 0x27, nullptr));
+    RequireRefused(sceGnmUpdatePsShader350(Fresh(), 0x28, BadRegs));
+
+    Require(sceGnmSetPsShader350(Fresh(), 0x28, Regs) == 0);
+    RequireWords({0xc0027600u, 8, 0x1000, 0, 0xc0027600u, 10, 0x2000, 0x3000, 0xc0026900u, 0x1c4, 0x4000, 0x5000,
+        0xc0026900u, 0x1b3, 0x6000, 0x7000, 0xc0016900u, 0x1b6, 0x8000, 0xc0016900u, 0x1b8, 0x9000,
+        0xc0016900u, 0x203, 0xa000, 0xc0016900u, 0x8f, 0xb000, 0xc00a1000u, 0});
+    Require(sceGnmSetPsShader350(Fresh(), 0x28, nullptr) == 0);
+    RequireWords({0xc0027600u, 8, 0, 0, 0xc0016900u, 0x203, 0, 0xc0016900u, 0x8f, 0xf, 0xc01c1000u, 0});
+    RequireRefused(sceGnmSetPsShader350(Fresh(), 0x27, Regs));
+    RequireRefused(sceGnmSetPsShader350(Fresh(), 0x28, BadRegs));
+}
+
+void CheckGsHsCs() {
+    Require(sceGnmUpdateGsShader(Fresh(), 0x1d, Regs) == 0);
+    RequireWords({0xc0027600u, 0x88, 0x1000, 0, 0xc0027600u, 0x8a, 0x2000, 0x3000, 0xc0011000u, 0xc01e02e5u, 0x4000,
+        0xc0011000u, 0xc01e029bu, 0x5000, 0xc0011000u, 0xc01e02e4u, 0x6000, 0xc00a1000u, 0});
+    RequireRefused(sceGnmUpdateGsShader(Fresh(), 0x1c, Regs));
+    RequireRefused(sceGnmUpdateGsShader(Fresh(), 0x1d, nullptr));
+    RequireRefused(sceGnmUpdateGsShader(Fresh(), 0x1d, BadRegs));
+
+    Require(sceGnmUpdateHsShader(Fresh(), 0x1d, Regs, 0x77) == 0);
+    RequireWords({0xc0027600u, 0x108, 0x1000, 0, 0xc0027600u, 0x10a, 0x2000, 0x3000, 0xc0021000u, 0xc01e0286u, 0x5000, 0x6000,
+        0xc0011000u, 0xc01e02dbu, 0x4000, 0xc0011000u, 0xc01e02d6u, 0x77, 0xc00a1000u, 0});
+    RequireRefused(sceGnmUpdateHsShader(Fresh(), 0x1c, Regs, 0));
+    RequireRefused(sceGnmUpdateHsShader(Fresh(), 0x1d, BadRegs, 0));
+
+    Require(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, Regs, 0x3c0) == 0);
+    RequireWords({0xc0027600u, 0x20c, 0x1000, 0, 0xc0027600u, 0x212, 0x23c0, 0x3000, 0xc0037600u, 0x207, 0x4000, 0x5000, 0x6000,
+        0xc00a1000u, 0});
+    Require(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, MaskedRegs, 0x40) == 0);
+    Require(g_words[6] == 0x03000040u);
+    Require(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, MaskedRegs, 0) == 0);
+    Require(g_words[6] == 0x030003c0u);
+    RequireRefused(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, Regs, 0x400));
+    RequireRefused(sceGnmSetCsShaderWithModifier(Fresh(), 0x18, Regs, 0));
+    RequireRefused(sceGnmSetCsShaderWithModifier(Fresh(), 0x19, BadRegs, 0));
+}
+
+void CheckWorkloads() {
+    std::uint32_t stream = Untouched;
+    Require(sceGnmCreateWorkloadStream(0, &stream) == 3 && stream == Untouched);
+    Require(sceGnmCreateWorkloadStream(5, nullptr) == 3);
+    Require(sceGnmCreateWorkloadStream(5, &stream) == 0 && stream == 1);
+
+    std::uint64_t workload = Untouched;
+    Require(sceGnmBeginWorkload(3, &workload) == 0 && workload == 1);
+    Require(sceGnmBeginWorkload(0x10, &workload) == 1 && workload == 0);
+    Require(sceGnmBeginWorkload(0, nullptr) == 3);
+
+    Require(sceGnmEndWorkload(0) == 2);
+    Require(sceGnmEndWorkload(1) == 0);
+    Require(sceGnmEndWorkload(0x0full << 56) == 0);
+    Require(sceGnmEndWorkload(0x10ull << 56) == 2);
+}
+
+} // namespace
+
+int main() {
+    CheckVs();
+    CheckPs();
+    CheckGsHsCs();
+    CheckWorkloads();
+    Require(sceGnmGetGpuCoreClockFrequency() == 911000000);
+    Require(sceGnmGetOffChipTessellationBufferSize() == 0x800000);
+}
diff --git a/core/libs/tests/GuestHeapReportForGame.cpp b/core/libs/tests/GuestHeapReportForGame.cpp
index 9238d7bdb1..db56fe1a2c 100644
--- a/core/libs/tests/GuestHeapReportForGame.cpp
+++ b/core/libs/tests/GuestHeapReportForGame.cpp
@@ -1,15 +1,26 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#ifdef _WIN32
+#include <process.h>
+#else
+#include <unistd.h>
+#endif
 #include <filesystem>
 #include <fstream>
 #include <sstream>
 #include <string>
 
-extern "C" {
-void APS5_VABI sceLibcInternalBacktraceForGame_nid_postfix(const char* heapName);
-void APS5_VABI sceLibcInternalHeapErrorReportForGame_nid_postfix(void* heap, void* block, std::uint32_t error);
+
+static std::string ReadAll(const std::filesystem::path& path) {
+    std::ifstream file(path);
+    std::stringstream text;
+    text << file.rdbuf();
+    return text.str();
 }
 
 static void Require(bool value, const char* message) {
@@ -20,25 +31,58 @@ static void Require(bool value, const char* message) {
 
 int main() {
     const auto path = std::filesystem::temp_directory_path() / ("anyps5-heap-report-" + std::to_string(std::rand()) + ".txt");
-    Require(std::freopen(path.string().c_str(), "w", stderr) != nullptr, "stderr redirection failed");
+    const auto outputPath = std::filesystem::temp_directory_path() / ("anyps5-heap-report-out-" + std::to_string(std::rand()) + ".txt");
+#ifdef _WIN32
+    Require(_wfreopen(path.wstring().c_str(), L"w", stderr) != nullptr, "stderr redirection failed");
+    Require(_wfreopen(outputPath.wstring().c_str(), L"w", stdout) != nullptr, "stdout redirection failed");
+#else
+    Require(std::freopen(path.c_str(), "w", stderr) != nullptr, "stderr redirection failed");
+    Require(std::freopen(outputPath.c_str(), "w", stdout) != nullptr, "stdout redirection failed");
+#endif
 
     char heapName[] = "SceLibcHeap";
     sceLibcInternalBacktraceForGame_nid_postfix(heapName);
     sceLibcInternalBacktraceForGame_nid_postfix(nullptr);
-    int heap = 0;
+    alignas(16) char heap[0x400] = {};
+    std::strcpy(heap + 0x3B0, "SceLibcHeap");
+    const std::uint32_t number = 3;
+    std::memcpy(heap + 0x3F4, &number, sizeof(number));
     int block = 0;
-    sceLibcInternalHeapErrorReportForGame_nid_postfix(&heap, &block, 0x1234u);
+    sceLibcInternalHeapErrorReportForGame_nid_postfix(heap, &block, 1);
+    std::memset(heap + 0x3F4, 0, sizeof(number));
+    sceLibcInternalHeapErrorReportForGame_nid_postfix(heap, &block, 2);
+    bool threw = false;
+    try {
+        sceLibcInternalHeapErrorReportForGame_nid_postfix(nullptr, &block, 1);
+    } catch (const std::invalid_argument&) {
+        threw = true;
+    }
+    Require(threw, "null heap accepted");
     std::fflush(stderr);
     std::fclose(stderr);
+    std::fflush(stdout);
+    std::fclose(stdout);
 
-    std::ifstream file(path);
-    std::stringstream text;
-    text << file.rdbuf();
-    file.close();
+    const std::string report = ReadAll(path);
+    const std::string output = ReadAll(outputPath);
     std::filesystem::remove(path);
-    const std::string report = text.str();
+    std::filesystem::remove(outputPath);
+    const std::string first = "[SceLibc] A heap error is detected.\n[SceLibc] -- Mspace Name --\n[SceLibc] SceLibcHeap ( 3)\n"
+        "[SceLibc] -- Error reason --\n[SceLibc] segment out of range.\n[SceLibc] pid:<0x";
+    const std::string second = "[SceLibc] A heap error is detected.\n[SceLibc] -- Mspace Name --\n[SceLibc] SceLibcHeap\n[SceLibc] pid:<0x";
+    Require(output.rfind(first, 0) == 0, "segment error report differs");
+    Require(output.find(second, first.size()) != std::string::npos, "unnamed reason report differs");
+    Require(output.find("reason", output.find(second)) == std::string::npos, "reason printed for error 2");
     Require(report.find("[SceLibcHeap] backtrace requested from guest 0x") != std::string::npos, "heap name not reported");
     Require(report.find("[] backtrace requested from guest 0x") != std::string::npos, "null heap name not reported");
-    Require(report.find("[libc] heap error 0x1234: heap ") != std::string::npos, "heap error not reported");
+    Require(report.find("[libc] heap error 0x1: heap ") != std::string::npos, "host diagnostic missing");
+#ifdef _WIN32
+    const unsigned long pid = static_cast<unsigned long>(_getpid());
+#else
+    const unsigned long pid = static_cast<unsigned long>(getpid());
+#endif
+    char pidText[32];
+    std::snprintf(pidText, sizeof(pidText), "pid:<0x%lx> tid:<0x", pid);
+    Require(output.find(pidText) != std::string::npos, "pid differs");
     Require(std::string(heapName) == "SceLibcHeap", "heap name modified");
 }
diff --git a/core/libs/tests/GuestHeapRounding.cpp b/core/libs/tests/GuestHeapRounding.cpp
index d888f7311f..e71d91abab 100644
--- a/core/libs/tests/GuestHeapRounding.cpp
+++ b/core/libs/tests/GuestHeapRounding.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #ifndef NOMINMAX
 #define NOMINMAX
 #endif
@@ -16,13 +17,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-void* APS5_VABI malloc_nid_postfix(std::size_t);
-void APS5_VABI free_nid_postfix(void*);
-void* APS5_VABI realloc_nid_postfix(void*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr std::size_t HeaderBytes = 2 * sizeof(void*);
@@ -40,6 +34,7 @@ bool checkThreshold(std::size_t bytes, unsigned char value) {
     pointer[bytes - 1] = static_cast<unsigned char>(value + 1);
     const bool preserved = pointer[0] == value && pointer[bytes - 1] == static_cast<unsigned char>(value + 1);
     free_nid_postfix(pointer);
+
     return preserved;
 }
 
@@ -77,14 +72,15 @@ DWORD runChild(const wchar_t* mode) {
 
 int runMallocOverflow() {
     registerDefaultHeap();
-    *__error_nid_postfix() = 0;
+    *__error_nid_postfix() = 77;
     try {
         auto* pointer = malloc_nid_postfix(std::numeric_limits<std::size_t>::max() - HeaderBytes);
         if (pointer != nullptr) {
             free_nid_postfix(pointer);
+
             return 1;
         }
-        return *__error_nid_postfix() == 12 ? 0 : 4;
+        return *__error_nid_postfix() == 77 ? 0 : 4;
     } catch (const std::exception& error) {
         std::fprintf(stderr, "malloc failed with an unexpected exception: %s\n", error.what());
         return 2;
@@ -100,14 +96,15 @@ int runReallocOverflow() {
     auto* original = static_cast<unsigned char*>(malloc_nid_postfix(bytes));
     std::memset(original, 0x5a, bytes);
     bool rejectedWithExpectedError = false;
-    *__error_nid_postfix() = 0;
+    *__error_nid_postfix() = 77;
     try {
         auto* result = realloc_nid_postfix(original, std::numeric_limits<std::size_t>::max() - HeaderBytes);
         if (result != nullptr) {
             free_nid_postfix(result);
+
             return 4;
         }
-        rejectedWithExpectedError = *__error_nid_postfix() == 12;
+        rejectedWithExpectedError = *__error_nid_postfix() == 77;
     } catch (const std::exception& error) {
         std::fprintf(stderr, "realloc failed with an unexpected exception: %s\n", error.what());
     } catch (...) {
@@ -141,6 +138,7 @@ int runReallocOverflow() {
     if (result == 0) {
         free_nid_postfix(replacement);
         free_nid_postfix(original);
+
     }
     return static_cast<int>(result);
 }
diff --git a/core/libs/tests/GuestHmd.cpp b/core/libs/tests/GuestHmd.cpp
index 230395afb9..257e9f381c 100644
--- a/core/libs/tests/GuestHmd.cpp
+++ b/core/libs/tests/GuestHmd.cpp
@@ -1,12 +1,22 @@
+#include "ProcessParametersFixture.hpp"
 #include "prx/libSceHmd/Hmd.hpp"
 
+#include <array>
+#include <cstddef>
+#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 #include <initializer_list>
+#include <stdexcept>
 
 namespace {
 
+constexpr std::uint32_t LastSdkBeforeStartupState = 0x044fffff;
+constexpr std::uint32_t FirstSdkWithStartupState = 0x04500000;
+
+alignas(16) std::array<std::byte, 0x40> process{};
+
 void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "HMD: %s\n", message);
@@ -14,12 +24,28 @@ void Require(bool condition, const char* message) {
     }
 }
 
+void InstallProcessParameters() {
+    const std::uint64_t size = process.size();
+    const std::uint32_t magic = 0x4942524f;
+    std::memcpy(process.data(), &size, sizeof(size));
+    std::memcpy(process.data() + 8, &magic, sizeof(magic));
+    Require(ProcessParametersFixture::Install(process.data(), process.size()), "process parameters were not installed");
+}
+
+void SetCompiledSdkVersion(std::uint32_t version) {
+    std::memcpy(process.data() + 0x10, &version, sizeof(version));
+}
+
 void CheckDisconnected() {
     Hmd::DeviceStatus status = Hmd::DeviceStatus::Ready;
     Require(sceHmdInternalGetDeviceStatus(&status) == 0, "status query failed");
     Require(status == Hmd::DeviceStatus::NotDetected, "headset reported connected");
     Require(sceHmdInternalGetDeviceStatus(nullptr) == Hmd::ParameterNull, "null status");
     Require(sceHmdInternalMmapIsConnect() == 0, "connection reported present");
+    Require(!sceHmdInternalIsGameVr2d(), "game reported in VR2D without a headset");
+    Require(!sceHmdInternalIsMiniAppVr2d(), "mini app reported in VR2D without a headset");
+    Require(!sceHmdInternalIsCommonDlgVr2d(), "common dialog reported in VR2D without a headset");
+    Require(!sceHmdInternalIsCommonDlgMiniAppVr2d(), "common dialog mini app reported in VR2D without a headset");
 }
 
 void CheckBufferQueries() {
@@ -53,6 +79,77 @@ void CheckHandleQueries(std::int32_t expected) {
     for (const auto byte : sensor) Require(byte == 0x5a, "a refused sensor query wrote its output");
 }
 
+template <typename Call>
+bool Unimplemented(Call call) {
+    try {
+        static_cast<void>(call());
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
+void CheckCommandQueries(bool handleZeroMeasured) {
+    unsigned char zeroed[64] = {};
+    unsigned char vr2dBytes[64] = {};
+    unsigned char commands[16];
+    std::memset(commands, 0x5a, sizeof(commands));
+    for (const std::size_t offset : {0x00u, 0x08u, 0x20u}) std::memset(vr2dBytes + offset, 0x11, 8);
+    const auto* distortion = reinterpret_cast<const HmdDistortionCommandParameter*>(zeroed);
+    const auto* wideNear = reinterpret_cast<const HmdWideNearDistortionCommandParameter*>(zeroed);
+    const auto* zeroedVr2d = reinterpret_cast<const Hmd2dVrCommandParameter*>(zeroed);
+    const auto* vr2d = reinterpret_cast<const Hmd2dVrCommandParameter*>(vr2dBytes);
+    auto* commandBuffer = reinterpret_cast<HmdCommandBuffer*>(commands);
+    const auto vr2dWith = [&](std::size_t offset, unsigned char value, std::size_t bytes, auto check) {
+        unsigned char changed[64];
+        std::memcpy(changed, vr2dBytes, sizeof(changed));
+        std::memset(changed + offset, value, bytes);
+        check(reinterpret_cast<const Hmd2dVrCommandParameter*>(changed));
+    };
+    for (const auto handle : {-1, 1, 0x0f000000}) {
+        Require(sceHmdGetDistortionCorrectionCommand(handle, distortion, commandBuffer) == Hmd::InvalidHandle, "distortion command accepted a handle sceHmdOpen never issued");
+        Require(sceHmdDistortionGetCorrectionCommand(handle, distortion, commandBuffer) == Hmd::InvalidHandle, "aliased distortion command accepted a handle sceHmdOpen never issued");
+        Require(sceHmdGetWideNearDistortionCorrectionCommand(handle, wideNear, commandBuffer) == Hmd::InvalidHandle, "wide-near distortion command accepted a handle sceHmdOpen never issued");
+        Require(sceHmdDistortionGetWideNearCorrectionCommand(handle, wideNear, commandBuffer) == Hmd::InvalidHandle, "aliased wide-near distortion command accepted a handle sceHmdOpen never issued");
+        Require(sceHmdGet2dVrCommand(handle, vr2d, commandBuffer) == Hmd::InvalidHandle, "2D VR command accepted a handle sceHmdOpen never issued");
+        Require(sceHmdDistortionGet2dVrCommand(handle, vr2d, commandBuffer) == Hmd::InvalidHandle, "aliased 2D VR command accepted a handle sceHmdOpen never issued");
+    }
+    for (const auto handle : {0, -1, 1, 0x0f000000}) {
+        for (const auto query : {sceHmdGet2dVrCommand, sceHmdDistortionGet2dVrCommand}) {
+            Require(query(handle, zeroedVr2d, commandBuffer) == Hmd::ParameterNull, "2D VR command took a parameter with null pointers");
+            Require(query(handle, nullptr, commandBuffer) == Hmd::ParameterNull, "2D VR command took a null parameter");
+            Require(query(handle, vr2d, nullptr) == Hmd::ParameterNull, "2D VR command took a null command buffer");
+            for (const std::size_t offset : {0x00u, 0x08u, 0x20u}) {
+                vr2dWith(offset, 0, 8, [&](const Hmd2dVrCommandParameter* changed) {
+                    Require(query(handle, changed, commandBuffer) == Hmd::ParameterNull, "2D VR command took a null pointer in its parameter");
+                });
+            }
+            vr2dWith(0x34, 0x01, 4, [&](const Hmd2dVrCommandParameter* changed) {
+                Require(query(handle, changed, commandBuffer) == Hmd::ParameterInvalid, "2D VR command took a non-zero field at 0x34");
+            });
+            vr2dWith(0x38, 0x01, 8, [&](const Hmd2dVrCommandParameter* changed) {
+                Require(query(handle, changed, commandBuffer) == Hmd::ParameterInvalid, "2D VR command took a non-zero field at 0x38");
+            });
+        }
+    }
+    if (!handleZeroMeasured) {
+        Require(Unimplemented([&] { return sceHmdGetDistortionCorrectionCommand(0, distortion, commandBuffer); }), "distortion command answered handle 0 where its answer is not measured");
+        Require(Unimplemented([&] { return sceHmdDistortionGetCorrectionCommand(0, distortion, commandBuffer); }), "aliased distortion command answered handle 0 where its answer is not measured");
+        Require(Unimplemented([&] { return sceHmdGetWideNearDistortionCorrectionCommand(0, wideNear, commandBuffer); }), "wide-near distortion command answered handle 0 where its answer is not measured");
+        Require(Unimplemented([&] { return sceHmdDistortionGetWideNearCorrectionCommand(0, wideNear, commandBuffer); }), "aliased wide-near distortion command answered handle 0 where its answer is not measured");
+        Require(Unimplemented([&] { return sceHmdGet2dVrCommand(0, vr2d, commandBuffer); }), "2D VR command answered handle 0 where its answer is not measured");
+        Require(Unimplemented([&] { return sceHmdDistortionGet2dVrCommand(0, vr2d, commandBuffer); }), "aliased 2D VR command answered handle 0 where its answer is not measured");
+    } else {
+        Require(sceHmdGetDistortionCorrectionCommand(0, distortion, commandBuffer) == Hmd::NotInitialized, "distortion command before initialize");
+        Require(sceHmdDistortionGetCorrectionCommand(0, distortion, commandBuffer) == Hmd::NotInitialized, "aliased distortion command before initialize");
+        Require(sceHmdGetWideNearDistortionCorrectionCommand(0, wideNear, commandBuffer) == Hmd::NotInitialized, "wide-near distortion command before initialize");
+        Require(sceHmdDistortionGetWideNearCorrectionCommand(0, wideNear, commandBuffer) == Hmd::NotInitialized, "aliased wide-near distortion command before initialize");
+        Require(sceHmdGet2dVrCommand(0, vr2d, commandBuffer) == Hmd::NotInitialized, "2D VR command before initialize");
+        Require(sceHmdDistortionGet2dVrCommand(0, vr2d, commandBuffer) == Hmd::NotInitialized, "aliased 2D VR command before initialize");
+    }
+    for (const auto byte : commands) Require(byte == 0x5a, "a refused command query wrote its output");
+}
+
 void CheckAssyError(std::int32_t expected) {
     unsigned char data[32];
     std::memset(data, 0x5a, sizeof(data));
@@ -69,6 +166,7 @@ int main() {
     std::memset(&info, 0xa5, sizeof(info));
     const auto untouched = info;
 
+    InstallProcessParameters();
     CheckDisconnected();
     CheckBufferQueries();
     Require(sceHmdTerminate() == Hmd::NotInitialized, "terminate before initialize");
@@ -78,6 +176,10 @@ int main() {
     Require(sceHmdGetDeviceInformation(&info) == Hmd::NotInitialized, "query before initialize");
     Require(std::memcmp(&info, &untouched, sizeof(info)) == 0, "failed query modified output");
     CheckHandleQueries(Hmd::NotInitialized);
+    SetCompiledSdkVersion(LastSdkBeforeStartupState);
+    CheckCommandQueries(true);
+    SetCompiledSdkVersion(FirstSdkWithStartupState);
+    CheckCommandQueries(false);
     CheckAssyError(Hmd::NotInitialized);
     Require(sceHmdGetDeviceInformationByHandle(0, &info) == Hmd::NotInitialized,
             "handle query before initialize");
@@ -116,6 +218,7 @@ int main() {
             Require(std::memcmp(&info, &expected, sizeof(info)) == 0, "invalid handle modified output");
         }
         CheckHandleQueries(Hmd::InvalidHandle);
+        CheckCommandQueries(false);
         CheckAssyError(Hmd::DeviceDisconnected);
         Require(sceHmdGetDeviceInformationByHandle(0, nullptr) == Hmd::InvalidHandle,
                 "null query accepted invalid handle");
diff --git a/core/libs/tests/GuestHmd2.cpp b/core/libs/tests/GuestHmd2.cpp
index e1bd7b8c52..6303182c1e 100644
--- a/core/libs/tests/GuestHmd2.cpp
+++ b/core/libs/tests/GuestHmd2.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHmd2/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libSceHmd/Hmd.hpp"
 #include "prx/libSceHmd2/Hmd2.hpp"
@@ -11,57 +12,7 @@
 #include <stdexcept>
 
 namespace Hmd2 {
-struct ReprojectionOutput;
-}
 
-extern "C" {
-std::int32_t APS5_VABI Hmd2WriteStateTwo(void* a0);
-std::int32_t APS5_VABI Hmd2WriteSize0x2000Align0x100(std::uint64_t* a0, std::uint64_t* a1);
-std::int32_t APS5_VABI Hmd2WriteFourConstants(void* a0);
-std::int32_t APS5_VABI Hmd2WriteSixHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
-std::int32_t APS5_VABI Hmd2WriteTwelveHalvesThenInvalidHandle(std::uint64_t a0, void* a1);
-std::int32_t APS5_VABI Hmd2SlotUpTo3CheckSecondThirdThenZero(std::uint64_t a0, const void* a1, const void* a2);
-std::int32_t APS5_VABI Hmd2SlotUpTo1ThenError1002(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo1CheckSecondThenError1002(std::uint64_t a0, const void* a1);
-std::int32_t APS5_VABI Hmd2SlotUpTo1ThenMinusOne(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2ThenMinusOne(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1002(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2ThenError1003(std::uint64_t a0);
-std::int32_t APS5_VABI Hmd2SlotUpTo2CheckSecondThenError002C(std::uint64_t a0, const void* a1);
-std::int32_t APS5_VABI Hmd2IndexZeroCheckSecondThenZero(std::uint64_t a0, const void* a1);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError0004(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenZero(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError1002(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenMinusOne(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstTwoThenParameterInvalid(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenError002C(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenParameterInvalid(const void*);
-std::int32_t APS5_VABI Hmd2CheckAllSixThenZero(const void*, const void*, const void*, const void*, const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenParameterInvalid(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError800d0203(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError1003(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstThenError1010(const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1002(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstTwoThenError1003(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenZero(const void*, const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckFirstAndThirdThenError1003(const void*, const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenInvalidHandle(const void*, const void*);
-std::int32_t APS5_VABI Hmd2CheckSecondThenError1002(const void*, const void*);
-std::int32_t APS5_VABI Hmd2BeforeInitializeZero();
-std::int32_t APS5_VABI Hmd2BeforeInitializeNotInitialized();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError0004();
-std::int32_t APS5_VABI Hmd2BeforeInitializeParameterNull();
-std::int32_t APS5_VABI Hmd2BeforeInitializeParameterInvalid();
-std::int32_t APS5_VABI Hmd2BeforeInitializeReprojectionNotInitialized();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError002C();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError1002();
-std::int32_t APS5_VABI Hmd2BeforeInitializeError1003();
-std::int32_t APS5_VABI Hmd2BeforeInitializeMinusOne();
-std::int32_t APS5_VABI Hmd2BeforeInitializeValue0400();
-std::int32_t APS5_VABI Hmd2BeforeInitializeValue20000();
-int APS5_VABI sceHmd2GazeActivateGazeTracking(std::int32_t mode);
-int APS5_VABI sceHmd2ReprojectionGetCurrentOutput(Hmd2::ReprojectionOutput* output);
-int APS5_VABI sceHmd2SetFieldOfView(const Hmd2::FieldOfView* fieldOfView);
 }
 
 namespace {
diff --git a/core/libs/tests/GuestHmd2Gaze.cpp b/core/libs/tests/GuestHmd2Gaze.cpp
new file mode 100644
index 0000000000..7a9a674c36
--- /dev/null
+++ b/core/libs/tests/GuestHmd2Gaze.cpp
@@ -0,0 +1,96 @@
+#include "prx/libSceHmd2/include/Api.hpp"
+#include "prx/libSceHmd2/Hmd2.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cmath>
+#include <cstring>
+#include <initializer_list>
+
+namespace {
+
+constexpr std::int32_t InvalidHandle = static_cast<std::int32_t>(0x8a720003);
+constexpr std::int32_t ParameterNull = static_cast<std::int32_t>(0x8a720008);
+constexpr std::int32_t ParameterInvalid = static_cast<std::int32_t>(0x8a720009);
+
+void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "FAIL: %s\n", what);
+    std::abort();
+}
+
+template<class T>
+T Read(const unsigned char* bytes, std::size_t offset) {
+    T value;
+    std::memcpy(&value, bytes + offset, sizeof(value));
+    return value;
+}
+
+bool NegativeZero(float value) {
+    return value == 0.0f && std::signbit(value);
+}
+
+void CheckGazeResult() {
+    Hmd2::GazeResultParameter param {sizeof(Hmd2::GazeResultParameter), 0x0e010000, 0};
+    unsigned char result[0x38];
+    std::memset(result, 0x5a, sizeof(result));
+    const std::uint32_t size = 0x38;
+    std::memcpy(result, &size, sizeof(size));
+
+    Require(sceHmd2GazeGetResult(nullptr, reinterpret_cast<Hmd2::GazeResult*>(result)) == ParameterNull, "null param");
+    Require(sceHmd2GazeGetResult(&param, nullptr) == ParameterNull, "null result");
+    Hmd2::GazeResultParameter wrongParam = param;
+    wrongParam.size = 0x18;
+    Require(sceHmd2GazeGetResult(&wrongParam, reinterpret_cast<Hmd2::GazeResult*>(result)) == ParameterInvalid, "param size");
+    const std::uint32_t wrongSize = 0x18;
+    std::memcpy(result, &wrongSize, sizeof(wrongSize));
+    Require(sceHmd2GazeGetResult(&param, reinterpret_cast<Hmd2::GazeResult*>(result)) == ParameterInvalid, "result size");
+    Require(Read<std::uint32_t>(result, 4) == 0x5a5a5a5a, "result untouched after a size error");
+
+    std::memcpy(result, &size, sizeof(size));
+    Require(sceHmd2GazeGetResult(&param, reinterpret_cast<Hmd2::GazeResult*>(result)) == InvalidHandle, "unopened handle");
+    Require(Read<std::uint32_t>(result, 0) == 0x38, "size kept");
+    Require(Read<std::int32_t>(result, 4) == -1, "+4 is -1");
+    for (const std::size_t offset : {0x8u, 0xcu, 0x10u, 0x20u, 0x24u, 0x28u, 0x2cu, 0x30u, 0x34u})
+        Require(Read<std::uint32_t>(result, offset) == 0, "cleared word");
+    Require(NegativeZero(Read<float>(result, 0x14)), "+0x14 is -0.0");
+    Require(Read<std::uint32_t>(result, 0x18) == 0, "+0x18 is 0.0");
+    Require(Read<float>(result, 0x1c) == -1.0f, "+0x1c is -1.0");
+
+    Hmd2::GazeResultParameter zero {sizeof(Hmd2::GazeResultParameter), 0, 0};
+    Require(sceHmd2GazeGetResult(&zero, reinterpret_cast<Hmd2::GazeResult*>(result)) == InvalidHandle, "handle 0");
+}
+
+void CheckFoveatedResult() {
+    Hmd2::GazeResultParameter param {sizeof(Hmd2::GazeResultParameter), 0x0e010000, 0};
+    unsigned char result[0x18];
+    std::memset(result, 0x5a, sizeof(result));
+    const std::uint32_t size = 0x18;
+    std::memcpy(result, &size, sizeof(size));
+
+    Require(sceHmd2GazeGetResultForFoveatedRendering(nullptr, reinterpret_cast<Hmd2::FoveatedRenderingResult*>(result)) == ParameterNull, "foveated null param");
+    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, nullptr) == ParameterNull, "foveated null result");
+    unsigned char large[0x38] = {};
+    const std::uint32_t largeSize = 0x38;
+    std::memcpy(large, &largeSize, sizeof(largeSize));
+    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, reinterpret_cast<Hmd2::FoveatedRenderingResult*>(large)) == ParameterInvalid, "foveated result size");
+
+    Require(sceHmd2GazeGetResultForFoveatedRendering(&param, reinterpret_cast<Hmd2::FoveatedRenderingResult*>(result)) == InvalidHandle, "foveated unopened handle");
+    Require(Read<std::uint32_t>(result, 0) == 0x18, "foveated size kept");
+    Require(Read<std::int32_t>(result, 4) == -1, "foveated +4 is -1");
+    Require(NegativeZero(Read<float>(result, 8)), "foveated +8 is -0.0");
+    Require(Read<std::uint32_t>(result, 0xc) == 0, "foveated +0xc is 0.0");
+    Require(Read<float>(result, 0x10) == -1.0f, "foveated +0x10 is -1.0");
+    Require(Read<std::uint32_t>(result, 0x14) == 0x5a5a5a5a, "foveated +0x14 untouched");
+}
+
+}
+
+int main() {
+    Require(sceHmd2Initialize(nullptr) != 0, "initialize reports no headset");
+    CheckGazeResult();
+    CheckFoveatedResult();
+    std::puts("guest Hmd2 gaze results without a headset: PASS");
+    return 0;
+}
diff --git a/core/libs/tests/GuestHmdSetupDialog.cpp b/core/libs/tests/GuestHmdSetupDialog.cpp
new file mode 100644
index 0000000000..1b4f731d93
--- /dev/null
+++ b/core/libs/tests/GuestHmdSetupDialog.cpp
@@ -0,0 +1,63 @@
+#include "prx/libSceHmdSetupDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000D);
+constexpr int kResultUserCanceled = 1;
+
+}
+
+int main() {
+    std::int64_t param = 0;
+    std::int32_t result[2] = {-1, -1};
+
+    Require(sceHmdSetupDialogTerminate() == kErrNotInitialized);
+    Require(sceHmdSetupDialogOpen(&param) == kErrNotInitialized);
+    Require(sceHmdSetupDialogClose() == kErrNotInitialized);
+    Require(sceHmdSetupDialogGetResult(result) == kErrNotInitialized);
+    Require(sceHmdSetupDialogGetStatus() == kStatusNone);
+    Require(sceHmdSetupDialogUpdateStatus() == kStatusNone);
+
+    Require(sceHmdSetupDialogInitialize() == 0);
+    Require(sceHmdSetupDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceHmdSetupDialogGetStatus() == kStatusInitialized);
+    Require(sceHmdSetupDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceHmdSetupDialogOpen(nullptr) == kErrArgNull);
+    Require(sceHmdSetupDialogGetResult(result) == kErrNotFinished);
+
+    Require(sceHmdSetupDialogOpen(&param) == 0);
+    Require(sceHmdSetupDialogGetStatus() == kStatusFinished);
+    Require(sceHmdSetupDialogUpdateStatus() == kStatusFinished);
+
+    Require(sceHmdSetupDialogGetResult(nullptr) == kErrArgNull);
+    Require(sceHmdSetupDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(result[1] == -1);
+
+    Require(sceHmdSetupDialogClose() == 0);
+    Require(sceHmdSetupDialogTerminate() == 0);
+    Require(sceHmdSetupDialogTerminate() == kErrNotInitialized);
+    Require(sceHmdSetupDialogGetStatus() == kStatusNone);
+    Require(sceHmdSetupDialogUpdateStatus() == kStatusNone);
+
+    Require(sceHmdSetupDialogInitialize() == 0);
+    Require(sceHmdSetupDialogUpdateStatus() == kStatusInitialized);
+    Require(sceHmdSetupDialogClose() == 0);
+    Require(sceHmdSetupDialogUpdateStatus() == kStatusFinished);
+    result[0] = -1;
+    Require(sceHmdSetupDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(sceHmdSetupDialogTerminate() == 0);
+}
diff --git a/core/libs/tests/GuestHostStandardError.cpp b/core/libs/tests/GuestHostStandardError.cpp
index 4c3fdc2309..131df792f6 100644
--- a/core/libs/tests/GuestHostStandardError.cpp
+++ b/core/libs/tests/GuestHostStandardError.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <csignal>
@@ -16,18 +18,7 @@
 #endif
 
 extern "C" {
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI dup2_nid_postfix(int, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI puts_nid_postfix(const char*);
-int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...);
-void APS5_VABI perror_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
+
 extern FileStream* __stderrp_nid_postfix;
 extern FileStream* __stdoutp_nid_postfix;
 }
diff --git a/core/libs/tests/GuestHostStandardErrorWindows.cpp b/core/libs/tests/GuestHostStandardErrorWindows.cpp
index f91c92d09e..0248298110 100644
--- a/core/libs/tests/GuestHostStandardErrorWindows.cpp
+++ b/core/libs/tests/GuestHostStandardErrorWindows.cpp
@@ -1,9 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/HostStandardStreams.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <string>
 #ifdef _WIN32
 #include <windows.h>
@@ -12,15 +15,7 @@
 #endif
 
 extern "C" {
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI dup2_nid_postfix(int, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI puts_nid_postfix(const char*);
-int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-void APS5_VABI perror_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
+
 extern FileStream _Stdout_nid_postfix;
 extern FileStream _Stderr_nid_postfix;
 }
@@ -84,6 +79,7 @@ static void GuestText(int standard, const std::string& text) {
         Require(fprintf_nid_postfix(&_Stderr_nid_postfix, "guest-fprintf\n") >= 0);
         *__error_nid_postfix() = 2;
         perror_nid_postfix("guest-perror");
+
         Require(fflush_nid_postfix(&_Stderr_nid_postfix) == 0);
     }
     std::string got(text.size(), '\0');
@@ -96,7 +92,55 @@ static void GuestText(int standard, const std::string& text) {
     ::_close(guest[1]);
 }
 
-int main() {
+static void Buffering(int standard) {
+    int capture[2]{-1, -1};
+    Require(::_pipe(capture, 65536, _O_BINARY) == 0);
+    const int original = ::_dup(standard);
+    Require(original >= 0 && ::_dup2(capture[1], standard) == 0);
+    auto* guestStream = standard == 1 ? &_Stdout_nid_postfix : &_Stderr_nid_postfix;
+    char buffer[4096]{};
+    flockfile_nid_postfix(guestStream);
+
+    if (standard == 1) setbuf_nid_postfix(guestStream, buffer);
+    else Require(setvbuf_nid_postfix(guestStream, buffer, 0, sizeof(buffer)) == 0);
+    funlockfile_nid_postfix(guestStream);
+
+    Require(fprintf_nid_postfix(guestStream, "guest-buffered") == 14);
+    Require(std::fputs("host-immediate", standard == 1 ? stdout : stderr) >= 0);
+    char bytes[64]{};
+    DWORD read = 0;
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 14);
+    Require(read == 14 && std::string(bytes, read) == "host-immediate");
+    Require(::_read(capture[0], bytes, 14) == 14);
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 0);
+    Require(fflush_nid_postfix(guestStream) == 0);
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 14);
+    Require(read == 14 && std::string(bytes, read) == "guest-buffered");
+    Require(::_read(capture[0], bytes, 14) == 14);
+
+    int guest[2]{-1, -1};
+    Require(pipe_nid_postfix(guest) == 0 && dup2_nid_postfix(guest[1], standard) == standard);
+    Require(fprintf_nid_postfix(guestStream, "guest-redirected") == 16 && fflush_nid_postfix(guestStream) == 0);
+    Require(std::fputs("host-original", standard == 1 ? stdout : stderr) >= 0);
+    Require(Available(capture[0], bytes, sizeof(bytes), read) == 13);
+    Require(read == 13 && std::string(bytes, read) == "host-original");
+    Require(Available(guest[0], bytes, sizeof(bytes), read) == 16);
+    Require(read == 16 && std::string(bytes, read) == "guest-redirected");
+    Require(setvbuf_nid_postfix(guestStream, nullptr, 2, 0) == 0);
+    Require(::_dup2(original, standard) == 0);
+    ::_close(original);
+    ::_close(capture[0]);
+    ::_close(capture[1]);
+    ::_close(guest[0]);
+    ::_close(guest[1]);
+}
+
+int main(int argc, char** argv) {
+    if (argc == 2 && std::strcmp(argv[1], "--buffering") == 0) {
+        Buffering(2);
+        Buffering(1);
+        return 0;
+    }
     Split(2);
     Split(1);
     GuestText(1, "guest-printf\nguest-puts\n");
diff --git a/core/libs/tests/GuestHostStreams.cpp b/core/libs/tests/GuestHostStreams.cpp
index e31c1dad51..f05f9f4b1b 100644
--- a/core/libs/tests/GuestHostStreams.cpp
+++ b/core/libs/tests/GuestHostStreams.cpp
@@ -1,17 +1,14 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
+constexpr int GuestEperm = 1;
 constexpr int GuestEbadf = 9;
+constexpr int SceKernelErrorEperm = static_cast<int>(0x80020001);
 constexpr int SceKernelErrorEbadf = static_cast<int>(0x80020009);
 
 static bool Open(int fd) {
@@ -26,13 +23,17 @@ int main() {
     for (int fd = 0; fd < 3; ++fd) open[fd] = Open(fd);
     for (int fd = 0; fd < 3; ++fd) {
         if (!open[fd]) continue;
-        Require(close_nid_postfix(fd) == -1 && *__error_nid_postfix() == GuestEbadf);
-        Require(sceKernelClose(fd) == SceKernelErrorEbadf);
+        Require(close_nid_postfix(fd) == -1 && *__error_nid_postfix() == GuestEperm);
+        Require(sceKernelClose(fd) == SceKernelErrorEperm);
         Require(Open(fd));
     }
     int pipe[2];
     Require(pipe_nid_postfix(pipe) == 0);
     for (const int fd : pipe) Require(fd >= 3 || !open[fd]);
     Require(close_nid_postfix(pipe[0]) == 0 && close_nid_postfix(pipe[1]) == 0);
+    Require(close_nid_postfix(pipe[0]) == -1 && *__error_nid_postfix() == GuestEbadf);
+    Require(sceKernelClose(pipe[1]) == SceKernelErrorEbadf);
+    Require(close_nid_postfix(-1) == -1 && *__error_nid_postfix() == GuestEbadf);
+    Require(sceKernelClose(-1) == SceKernelErrorEbadf);
     return 0;
 }
diff --git a/core/libs/tests/GuestHostname.cpp b/core/libs/tests/GuestHostname.cpp
index 36e18845dc..9b6e788e19 100644
--- a/core/libs/tests/GuestHostname.cpp
+++ b/core/libs/tests/GuestHostname.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdio>
@@ -8,11 +9,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI gethostname_nid_postfix(char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "Hostname check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestHttp.cpp b/core/libs/tests/GuestHttp.cpp
index b70b78bba2..fbbdd525bf 100644
--- a/core/libs/tests/GuestHttp.cpp
+++ b/core/libs/tests/GuestHttp.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "SceTypes.hpp"
 #include "ProcessParametersFixture.hpp"
 #include <array>
@@ -9,51 +10,47 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <exception>
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceHttpUriParse(SceHttpUriElement*, const char*, void*, std::size_t*, std::size_t);
-int APS5_VABI sceHttpUriCopy(SceHttpUriElement*, const SceHttpUriElement*, void*, std::size_t, std::size_t*);
-int APS5_VABI sceHttpUriMerge(char*, const char*, const char*, std::size_t*, std::size_t, std::uint32_t);
-int APS5_VABI sceHttpSetInflateGZIPEnabled(int, int);
-int APS5_VABI sceHttpSetRequestStatusCallback(int, void (APS5_VABI *)(int, int, void*), void*);
-int APS5_VABI sceHttpSendRequest(int, const void*, std::size_t);
-int APS5_VABI sceHttpUriBuild(char*, std::size_t*, std::size_t, const SceHttpUriElement*, std::uint32_t);
-int APS5_VABI sceHttpUriEscape(char*, std::size_t*, std::size_t, const char*);
-int APS5_VABI sceHttpUriUnescape(char*, std::size_t*, std::size_t, const char*);
-int APS5_VABI sceHttpUriSweepPath(char*, const char*, std::size_t);
-int APS5_VABI sceHttpCreateEpoll(int, HttpEpollHandle*);
-int APS5_VABI sceHttpDestroyEpoll(int, HttpEpollHandle);
-int APS5_VABI sceHttpWaitRequest(HttpEpollHandle, HttpNBEvent*, int, int);
-int APS5_VABI sceHttpAbortWaitRequest(HttpEpollHandle);
-int APS5_VABI sceHttpInit_nid_postfix(int, int, std::uint64_t);
-int APS5_VABI sceHttpTerm_nid_postfix(int);
-int APS5_VABI sceHttpAuthCacheFlush(int);
-int APS5_VABI sceHttpCookieFlush(int);
-int APS5_VABI sceHttpReadData(int, void*, std::size_t);
-int APS5_VABI sceHttpCreateRequest2(int, const char*, const char*, std::uint64_t);
-int APS5_VABI sceHttpsEnableOption(int, std::uint32_t);
-int APS5_VABI sceHttpsLoadCert(int, int, void*, void*, void*);
-int APS5_VABI sceHttpGetLastErrno(int, int*);
-int APS5_VABI sceHttpSetResponseHeaderMaxSize(int, std::uint64_t);
-int APS5_VABI sceHttpSetRecvBlockSize(int, std::uint32_t);
-int APS5_VABI sceHttpRedirectCacheFlush(int);
-int APS5_VABI sceHttpsUnloadCert(int);
-int APS5_VABI sceHttpsSetSslVersion(int, int);
-int APS5_VABI sceHttpsGetSslError(int, int*, std::uint32_t*);
-int APS5_VABI sceHttpSetRedirectCallback(int, HttpRedirectCallback, void*);
-int APS5_VABI sceHttpSetCookieRecvCallback(int, HttpCookieRecvCallback, void*);
-int APS5_VABI sceHttpSetAuthInfoCallback(int, HttpAuthInfoCallback, void*);
-int APS5_VABI sceHttpParseStatusLine(const char*, std::size_t, std::int32_t*, std::int32_t*, std::int32_t*, const char**, std::size_t*);
-}
-
 alignas(16) static std::array<std::byte, 0x40> processParameters{};
 
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool Equal(const char* left, const char* right) { return std::strcmp(left, right) == 0; }
 
+
+static_assert(sizeof(HttpMemoryPoolStats) == 24);
+
+template <typename TCall>
+static bool Throws(TCall call) {
+    try {
+        call();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+static void CheckPoolStatsRejected(int id, int expected) {
+    alignas(HttpMemoryPoolStats) unsigned char buffer[sizeof(HttpMemoryPoolStats) + 16];
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    Require(sceHttpGetMemoryPoolStats(id, reinterpret_cast<HttpMemoryPoolStats*>(buffer)) == expected);
+    for (unsigned char byte : buffer) Require(byte == 0x5a);
+}
+
+static void CheckPoolStats(int id, std::size_t poolSize) {
+    alignas(HttpMemoryPoolStats) unsigned char buffer[sizeof(HttpMemoryPoolStats) + 16];
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    Require(sceHttpGetMemoryPoolStats(id, reinterpret_cast<HttpMemoryPoolStats*>(buffer)) == 0);
+    HttpMemoryPoolStats stats;
+    std::memcpy(&stats, buffer, sizeof(stats));
+    Require(stats.poolSize == poolSize);
+    Require(stats.peakUsedSize == 0 && stats.usedSize == 0);
+    for (std::size_t i = sizeof(stats); i < sizeof(buffer); ++i) Require(buffer[i] == 0x5a);
+}
+
 static void CheckUriParseCharacters() {
     char pool[256];
     SceHttpUriElement element{};
@@ -63,15 +60,174 @@ static void CheckUriParseCharacters() {
     Require(Equal(element.scheme, "aZ09+.-") && element.port == 0);
     for (unsigned value = 128; value <= 255; ++value) {
         const std::string byte(1, static_cast<char>(value));
-        const std::string urls[] = {
-            "http://" + byte + "/", "http://[" + byte + "]/", byte + "://host/",
-            "a" + byte + "://host/", "http://host:" + byte + "/"
-        };
-        for (const auto& url : urls) {
+        for (const auto& url : {"http://[" + byte + "]/", "http://host:" + byte + "/"}) {
             std::size_t required = 0;
             Require(sceHttpUriParse(nullptr, url.c_str(), nullptr, &required, 0) == static_cast<int>(0x80433060));
             Require(sceHttpUriParse(&element, url.c_str(), pool, nullptr, sizeof(pool)) == static_cast<int>(0x80433060));
         }
+        Require(sceHttpUriParse(&element, ("http://" + byte + "/").c_str(), pool, nullptr, sizeof(pool)) == 0);
+        Require(Equal(element.hostname, "") && element.path == byte + "/");
+        Require(sceHttpUriParse(&element, (byte + "://host/").c_str(), pool, nullptr, sizeof(pool)) == 0);
+        Require(element.opaque && Equal(element.scheme, "") && Equal(element.hostname, "") && element.path == byte + "://host/");
+        Require(sceHttpUriParse(&element, ("a" + byte + "://host/").c_str(), pool, nullptr, sizeof(pool)) == 0);
+        Require(Equal(element.scheme, "") && Equal(element.hostname, "a") && element.path == byte + "://host/");
+    }
+}
+
+struct UriParseCase {
+    const char* url;
+    int opaque;
+    std::uint16_t port;
+    const char* scheme;
+    const char* username;
+    const char* password;
+    const char* hostname;
+    const char* path;
+    const char* query;
+    const char* fragment;
+    std::size_t pathSpace = 0;
+};
+
+static void CheckUriParseAsMeasured() {
+    constexpr UriParseCase cases[] = {
+        {"http://bad host/", 0, 80, "http", "", "", "bad", " host/", "", ""},
+        {"http://ex%41mple.com/", 0, 80, "http", "", "", "ex", "%41mple.com/", "", ""},
+        {"http://h\t/", 0, 80, "http", "", "", "h", "\t/", "", ""},
+        {"not a url", 1, 0, "", "", "", "not", " a url", "", ""},
+        {"example.com/a", 1, 0, "", "", "", "example.com", "/a", "", ""},
+        {"mailto:x", 1, 0, "mailto", "", "", "x", "", "", ""},
+        {"abc:def", 1, 0, "abc", "", "", "def", "", "", ""},
+        {"http:", 1, 80, "http", "", "", "", "", "", ""},
+        {"https:h", 1, 443, "https", "", "", "h", "", "", ""},
+        {"//host/x", 0, 0, "", "", "", "host", "/x", "", ""},
+        {"", 1, 0, "", "", "", "", "", "", ""},
+        {"?q", 1, 0, "", "", "", "", "", "?q", ""},
+        {"http://host:65536/", 0, 0, "http", "", "", "host", "/", "", ""},
+        {"http://h:65535", 0, 65535, "http", "", "", "h", "", "", ""},
+        {"http://h:0080/", 0, 80, "http", "", "", "h", "/", "", ""},
+        {"http://h:00000/", 0, 0, "http", "", "", "h", "/", "", ""},
+        {"http://host:/", 0, 80, "http", "", "", "host", "/", "", ""},
+        {"http://[::1]x/", 0, 80, "http", "", "", "::1", "x/", "", ""},
+        {"http://[::1]]/", 0, 80, "http", "", "", "::1", "]/", "", ""},
+        {"http://[::1]:/", 0, 80, "http", "", "", "::1", "/", "", ""},
+        {"http://[]/", 0, 80, "http", "", "", "", "/", "", ""},
+        {"http://[.]/", 0, 80, "http", "", "", ".", "/", "", ""},
+        {"http://u@h@i/", 0, 80, "http", "u", "", "h", "@i/", "", ""},
+        {"http://u s@h/", 0, 80, "http", "", "", "u", " s@h/", "", ""},
+        {"http://u:p:q@h/", 0, 80, "http", "u", "p:q", "h", "/", "", ""},
+        {"http://u%41@h/", 0, 80, "http", "u%41", "", "h", "/", "", ""},
+        {"http://h@/", 0, 80, "http", "h", "", "", "/", "", ""},
+        {"http://[::1]@h/", 0, 80, "http", "", "", "::1", "@h/", "", ""},
+        {"http://u@[::1]:8/", 0, 8, "http", "u", "", "::1", "/", "", ""},
+        {".@h/", 1, 0, "", ".", "", "h", "/", "", ""},
+        {"http://.a/", 0, 80, "http", "", "", "", ".a/", "", ""},
+        {"http://-a/", 0, 80, "http", "", "", "-a", "/", "", ""},
+        {"http://a..b/", 0, 80, "http", "", "", "a..b", "/", "", ""},
+        {"a.", 1, 0, "", "", "", "a.", "", "", ""},
+        {"http://h/a/..", 0, 80, "http", "", "", "h", "/a/..", "", ""},
+        {"http://h/a/.", 0, 80, "http", "", "", "h", "/a/.", "", ""},
+        {"http://h/a/b/../../..", 0, 80, "http", "", "", "h", "/..", "", "", 13},
+        {"http://h/../../a", 0, 80, "http", "", "", "h", "/a", "", "", 8},
+        {"http://h/a//b/../c", 0, 80, "http", "", "", "h", "/a//c", "", "", 10},
+        {"http://h/a/.../../b", 0, 80, "http", "", "", "h", "/a/b", "", "", 11},
+        {"http://h/./a/../b/", 0, 80, "http", "", "", "h", "/b/", "", "", 10},
+        {"./a", 1, 0, "", "", "", "", "./a", "", ""},
+        {"a/../b", 1, 0, "", "", "", "a", "/b", "", "", 5},
+        {"1x://h/", 1, 0, "", "", "", "1x", "//h/", "", ""},
+        {"-x://h/", 0, 0, "-x", "", "", "h", "/", "", ""},
+        {"s_x://h/p", 1, 0, "", "", "", "s_x", "//h/p", "", ""},
+        {"s:x://h/p", 1, 0, "s", "", "", "x", "//h/p", "", ""},
+        {"s@x://h/p", 1, 0, "", "s", "", "x", "//h/p", "", ""},
+        {"httpx://h/", 0, 80, "httpx", "", "", "h", "/", "", ""},
+        {"httpsx://h/", 0, 443, "httpsx", "", "", "h", "/", "", ""},
+        {"HTTPx://h/", 0, 80, "HTTPx", "", "", "h", "/", "", ""},
+        {"htt://h/", 0, 0, "htt", "", "", "h", "/", "", ""},
+        {"ws://h/", 0, 0, "ws", "", "", "h", "/", "", ""},
+        {"https://h:80/", 0, 80, "https", "", "", "h", "/", "", ""},
+        {"http://h/p?q#f#g", 0, 80, "http", "", "", "h", "/p", "?q", "#f#g"},
+        {"http://h/p#f?q", 0, 80, "http", "", "", "h", "/p", "", "#f?q"},
+        {"http://h?", 0, 80, "http", "", "", "h", "", "?", ""},
+    };
+    char pool[256];
+    for (const auto& row : cases) {
+        SceHttpUriElement element{};
+        std::size_t required = 0;
+        Require(sceHttpUriParse(nullptr, row.url, nullptr, &required, 0) == 0);
+        const std::size_t size = std::strlen(row.scheme) + std::strlen(row.username) + std::strlen(row.password) + std::strlen(row.hostname)
+            + (row.pathSpace != 0 ? row.pathSpace : std::strlen(row.path)) + std::strlen(row.query) + std::strlen(row.fragment) + 7;
+        Require(required == size);
+        required = 77;
+        Require(sceHttpUriParse(&element, row.url, pool, &required, size - 1) == static_cast<int>(0x80431022) && required == 77);
+        Require(sceHttpUriParse(&element, row.url, pool, &required, sizeof(pool)) == 0 && required == size);
+        Require(element.opaque == row.opaque && element.port == row.port);
+        Require(Equal(element.scheme, row.scheme) && Equal(element.username, row.username) && Equal(element.password, row.password));
+        Require(Equal(element.hostname, row.hostname) && Equal(element.path, row.path));
+        Require(Equal(element.query, row.query) && Equal(element.fragment, row.fragment));
+    }
+    for (const char* url : {"http://[::1/", "http://[a b]/", "http://[a%b]/", "http://[a@b]/", "http://host:80a/", "http://h:65537/", "http://h:99999/",
+                            "http://h:000080/", "http://h:80?q", "http://h:80#f", "http://h:80 /", "http://h: 80/", "http://h:+80/", "http://h:-1/",
+                            "http://h:80:81/", "http://[::1]:8a/", "http://a:b/p"}) {
+        std::size_t required = 77;
+        Require(sceHttpUriParse(nullptr, url, nullptr, &required, 0) == static_cast<int>(0x80433060) && required == 77);
+    }
+}
+
+struct UriMergeCase {
+    const char* base;
+    const char* relative;
+    std::size_t sizeOnly;
+    const char* merged;
+};
+
+static void CheckUriMergeAsMeasured() {
+    constexpr UriMergeCase cases[] = {
+        {"http://user:pw@example.com:8080/a/b/c?q=1#f", "?x", 0x84, "http://user:pw@example.com:8080/a/b/?x"},
+        {"http://user:pw@example.com:8080/a/b/c?q=1#f", "#y", 0x84, "http://user:pw@example.com:8080/a/b/#y"},
+        {"http://user:pw@example.com:8080/a/b/c?q=1#f", "../../../../d", 0x9a, "http://user:pw@example.com:8080/a/b/../../../../d"},
+        {"http://user:pw@example.com:8080/a/b/c?q=1#f", "http:d", 0x8c, "http://user:pw@example.com:8080/a/b/http:d"},
+        {"http://user:pw@example.com:8080/a/b/c?q=1#f", "//other.com/x", 0x9a, "//other.com/x"},
+        {"http://example.com", "../d", 0x44, "http://example.com/../d"},
+        {"http://example.com/a/./b/../c", "d", 0x5f, "http://example.com/a/d"},
+        {"not a url", "d", 0x26, "not a url/d"},
+        {"example.com/a", "b", 0x32, "example.com/b"},
+        {"http://[::1]:80/a/b", "c", 0x3c, "http://::1/a/c"},
+        {"http://ex ample.com/a", "c", 0x47, "http://ex ample.com/c"},
+        {"http://example.com/a", "//bad host/x", 0x5a, "//bad host/x"},
+        {"//host/a/b", "c", 0x27, "//host/a/c"},
+        {"/a/b", "c", 0x17, "/a/c"},
+        {"a/b", "c", 0x14, "a/c"},
+        {"", "c", 0xb, "/c"},
+        {"", "", 0x9, "/"},
+        {"mailto:x@y", "c", 0x27, "mailto:x@y/c"},
+        {"http://h", "?q", 0x22, "http://h/?q"},
+        {"https://h:443/a", "c", 0x31, "https://h/c"},
+        {"http://h:0/a", "c", 0x2a, "http://h/c"},
+        {"http://h:65536/a", "c", 0x32, "http://h/c"},
+        {"http://:p@h/a", "c", 0x2d, "http://:p@h/c"},
+        {"http://bad host/", "./x", 0x3c, "http://bad host/./x"},
+        {"http://h/a", "http://bad host/", 0x44, "http://bad host/"},
+        {"http://h/a", "HTTPS://Other.com/", 0x48, "HTTPS://Other.com/"},
+        {"http://h/a", "//o", 0x2a, "//o"},
+        {"http://h/a", "x:y", 0x2a, "http://h/x:y"},
+        {"http://h/a", "d e", 0x2a, "http://h/d e"},
+        {"http://h/a", "..", 0x28, "http://h/.."},
+        {"http://h/a/./b/../c", "../d", 0x47, "http://h/a/../d"},
+        {"http://h/a?q#f", "", 0x30, "http://h/"},
+        {"not a url", "//x/y", 0x2e, "//x/y"},
+    };
+    char merged[512];
+    for (const auto& row : cases) {
+        std::size_t required = 0;
+        Require(sceHttpUriMerge(nullptr, row.base, row.relative, &required, 0, 0) == 0 && required == row.sizeOnly);
+        std::memset(merged, 'Z', sizeof(merged));
+        required = 77;
+        Require(sceHttpUriMerge(merged, row.base, row.relative, &required, row.sizeOnly - 1, 0) == static_cast<int>(0x80431022));
+        Require(merged[0] == 'Z');
+        Require(sceHttpUriMerge(merged, row.base, row.relative, &required, sizeof(merged), 0) == 0 && Equal(merged, row.merged));
+    }
+    for (const char* base : {"http://[::1/a", "http://h:80a/a"}) {
+        std::size_t required = 77;
+        Require(sceHttpUriMerge(merged, base, "c", &required, sizeof(merged), 0) == static_cast<int>(0x80433060) && required == 77);
     }
 }
 
@@ -96,6 +252,163 @@ static void CheckUriEscapeBytes() {
     }
 }
 
+struct StatusLineCase {
+    bool tildeFill;
+    const char* line;
+    std::size_t length;
+    int result;
+    std::int32_t major;
+    std::int32_t minor;
+    std::int32_t code;
+    long reasonOffset;
+    std::size_t phraseLength;
+};
+
+static void CheckStatusLineAsMeasured() {
+    constexpr int parseInvalidResponse = static_cast<int>(0x80432060);
+    constexpr StatusLineCase cases[] = {
+        {false, "HTTP/1.1 200 OK\r\n", 17, 17, 1, 1, 200, 12, 0x3},
+        {false, "HTTP/1.0 404 Not Found\n", 23, 23, 1, 0, 404, 12, 0xa},
+        {false, "HTTP/1.1 200 OK", 15, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {false, "HTTP/1.1 200\r\n", 14, 14, 1, 1, 200, 12, 0x0},
+        {false, "HTTP/1.1 200 \r\n", 15, 15, 1, 1, 200, 12, 0x1},
+        {false, "HTTP/2 200 OK\r\n", 15, parseInvalidResponse, 2, 0, -7, -1, 0xabcd},
+        {false, "HTTP/10.20 999 X\r\n", 18, 18, 10, 20, 999, 14, 0x2},
+        {false, "HTTP/1.1 20 OK\r\n", 16, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {false, "HTTP/1.1 2000 OK\r\n", 18, 18, 1, 1, 200, 12, 0x4},
+        {false, "HTTP/1.1 abc OK\r\n", 17, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {false, "http/1.1 200 OK\r\n", 17, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {false, "HTTP/1.1  200 OK\r\n", 18, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {false, "HTTP/1.1\t200 OK\r\n", 17, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {false, "HTTP/1.1 200OK\r\n", 16, 16, 1, 1, 200, 12, 0x2},
+        {false, "ICY 200 OK\r\n", 12, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {false, "HTTP/1.1 200 OK\r", 16, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {false, "HTTP/1.1 200 OK\r\nX: y", 21, 17, 1, 1, 200, 12, 0x3},
+        {false, "HTTP/1.1 200 OK\r\r\n", 18, 18, 1, 1, 200, 12, 0x4},
+        {false, "HTTP/.1 200 OK\r\n", 16, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {false, "HTTP/1. 200 OK\r\n", 16, parseInvalidResponse, 1, 0, -7, -1, 0xabcd},
+        {false, "HTTP/4294967297.1 200 OK\n", 25, 25, 1, 1, 200, 21, 0x3},
+        {false, "HTTP/1.1 -12 OK\n", 16, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {false, " HTTP/1.1 200 OK\n", 17, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {false, "HTTP/1.1 200 A\nB\n", 17, 15, 1, 1, 200, 12, 0x2},
+        {false, "HTTP/1.1 200\n", 13, 13, 1, 1, 200, 12, 0x0},
+        {false, "HTTP/1.1 200 OK\n", 15, 16, 1, 1, 200, 12, 0x3},
+        {false, "HTTP/1.1 200 OK\n", 12, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {false, "HTTP/1.1 200 OK\n", 11, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {false, "HTTP/1.1 200 OK\n", 8, 16, 1, 1, 200, 12, 0x3},
+        {false, "HTTP/1.1 200 OK\n", 7, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {false, "HTTP/1.1 200 OK\n", 0, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 0, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 1, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 2, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 3, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 4, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 5, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 6, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 7, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 8, 16, 1, 1, 200, 12, 0x3},
+        {true, "HTTP/1.1 200 OK\n", 9, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 10, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 11, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 12, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 13, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 14, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK\n", 15, 16, 1, 1, 200, 12, 0x3},
+        {true, "HTTP/1.1 200 OK\n", 16, 16, 1, 1, 200, 12, 0x3},
+        {true, "HTTP/10.20 999 X\n", 0, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 1, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 2, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 3, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 4, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 5, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 6, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 7, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 8, 17, 10, 20, 999, 14, 0x2},
+        {true, "HTTP/10.20 999 X\n", 9, 17, 10, 20, 999, 14, 0x2},
+        {true, "HTTP/10.20 999 X\n", 10, 17, 10, 20, 999, 14, 0x2},
+        {true, "HTTP/10.20 999 X\n", 11, parseInvalidResponse, 10, 20, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 12, parseInvalidResponse, 10, 20, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 13, parseInvalidResponse, 10, 20, -7, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 14, parseInvalidResponse, 10, 20, 999, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 15, parseInvalidResponse, 10, 20, 999, -1, 0xabcd},
+        {true, "HTTP/10.20 999 X\n", 16, 17, 10, 20, 999, 14, 0x2},
+        {true, "HTTP/10.20 999 X\n", 17, 17, 10, 20, 999, 14, 0x2},
+        {true, "HTTP/1.12 200 OK\n", 0, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 1, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 2, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 3, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 4, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 5, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 6, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 7, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 8, 17, 1, 12, 200, 13, 0x3},
+        {true, "HTTP/1.12 200 OK\n", 9, 17, 1, 12, 200, 13, 0x3},
+        {true, "HTTP/1.12 200 OK\n", 10, parseInvalidResponse, 1, 12, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 11, parseInvalidResponse, 1, 12, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 12, parseInvalidResponse, 1, 12, -7, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 13, parseInvalidResponse, 1, 12, 200, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 14, parseInvalidResponse, 1, 12, 200, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 15, parseInvalidResponse, 1, 12, 200, -1, 0xabcd},
+        {true, "HTTP/1.12 200 OK\n", 16, 17, 1, 12, 200, 13, 0x3},
+        {true, "HTTP/1.12 200 OK\n", 17, 17, 1, 12, 200, 13, 0x3},
+        {true, "HTTP/12.1 200 OK\n", 0, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 1, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 2, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 3, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 4, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 5, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 6, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 7, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 8, 17, 12, 1, 200, 13, 0x3},
+        {true, "HTTP/12.1 200 OK\n", 9, 17, 12, 1, 200, 13, 0x3},
+        {true, "HTTP/12.1 200 OK\n", 10, parseInvalidResponse, 12, 1, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 11, parseInvalidResponse, 12, 1, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 12, parseInvalidResponse, 12, 1, -7, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 13, parseInvalidResponse, 12, 1, 200, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 14, parseInvalidResponse, 12, 1, 200, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 15, parseInvalidResponse, 12, 1, 200, -1, 0xabcd},
+        {true, "HTTP/12.1 200 OK\n", 16, 17, 12, 1, 200, 13, 0x3},
+        {true, "HTTP/12.1 200 OK\n", 17, 17, 12, 1, 200, 13, 0x3},
+        {true, "HTTP/1.1 200\n", 0, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 1, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 2, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 3, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 4, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 5, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 6, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 7, parseInvalidResponse, 0, 0, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 8, 13, 1, 1, 200, 12, 0x0},
+        {true, "HTTP/1.1 200\n", 9, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 10, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 11, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200\n", 12, 13, 1, 1, 200, 12, 0x0},
+        {true, "HTTP/1.1 200\n", 13, 13, 1, 1, 200, 12, 0x0},
+        {true, "HTTP/1.1 200 OK", 15, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK", 8, 255, 1, 1, 200, 12, 0xf2},
+        {true, "HTTP/1.1 200 OK", 9, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK", 12, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {true, "HTTP/1.1 200 OK", 13, parseInvalidResponse, 1, 1, 200, -1, 0xabcd},
+        {true, "HTTP/1.1 2", 8, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1 20", 8, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+        {true, "HTTP/1.1", 8, parseInvalidResponse, 1, 1, -7, -1, 0xabcd},
+    };
+    static char buffer[256];
+    for (const auto& row : cases) {
+        std::memset(buffer, row.tildeFill ? '~' : '\0', sizeof(buffer));
+        std::memcpy(buffer, row.line, std::strlen(row.line));
+        if (row.tildeFill) buffer[sizeof(buffer) - 2] = '\n';
+        buffer[sizeof(buffer) - 1] = '\0';
+        std::int32_t major = -7;
+        std::int32_t minor = -7;
+        std::int32_t code = -7;
+        const char* reason = nullptr;
+        std::size_t phraseLength = 0xabcd;
+        Require(sceHttpParseStatusLine(buffer, row.length, &major, &minor, &code, &reason, &phraseLength) == row.result);
+        Require(major == row.major && minor == row.minor && code == row.code && phraseLength == row.phraseLength);
+        Require(row.reasonOffset < 0 ? reason == nullptr : reason == buffer + row.reasonOffset);
+    }
+}
+
 static int APS5_VABI AuthInfo(int, int, const char*, char*, char*, int, std::uint8_t**, std::uint64_t*, int*, void*) { std::abort(); }
 static void APS5_VABI RequestStatusCallback(int, int, void* argument) {
     ++*static_cast<int*>(argument);
@@ -140,7 +453,7 @@ int main() {
     const char* url = "https://user:secret@example.com:8443/a/./b/../c?x=1&y=2#top";
     std::size_t required = 0;
     Require(sceHttpUriParse(nullptr, url, nullptr, &required, 0) == 0);
-    Require(required == 6 + 5 + 7 + 12 + 5 + 9 + 5);
+    Require(required == 6 + 5 + 7 + 12 + 12 + 9 + 5);
 
     char pool[256];
     SceHttpUriElement element;
@@ -150,6 +463,7 @@ int main() {
     Require(Equal(element.scheme, "https") && Equal(element.username, "user") && Equal(element.password, "secret"));
     Require(Equal(element.hostname, "example.com") && element.port == 8443);
     Require(Equal(element.path, "/a/c") && Equal(element.query, "?x=1&y=2") && Equal(element.fragment, "#top"));
+    Require(element.path == pool + 30 && element.query == pool + 42 && element.fragment == pool + 51);
 
     char built[256];
     Require(sceHttpUriBuild(nullptr, &required, 0, &element, buildAll) == 0);
@@ -196,10 +510,11 @@ int main() {
 
     Require(sceHttpUriParse(&element, nullptr, pool, nullptr, sizeof(pool)) == invalidUrl);
     Require(sceHttpUriParse(nullptr, url, nullptr, nullptr, 0) == invalidValue);
-    Require(sceHttpUriParse(nullptr, "http://host:65536/", nullptr, &required, 0) == invalidUrl);
+    Require(sceHttpUriParse(nullptr, "http://host:65537/", nullptr, &required, 0) == invalidUrl);
     Require(sceHttpUriParse(nullptr, "http://host:80a/", nullptr, &required, 0) == invalidUrl);
     Require(sceHttpUriParse(nullptr, "http://[::1/", nullptr, &required, 0) == invalidUrl);
-    Require(sceHttpUriParse(nullptr, "http://bad host/", nullptr, &required, 0) == invalidUrl);
+    Require(sceHttpUriParse(nullptr, "http://host:80?q", nullptr, &required, 0) == invalidUrl);
+    CheckUriParseAsMeasured();
     Require(sceHttpUriBuild(built, nullptr, sizeof(built), nullptr, buildAll) == invalidUrl);
     Require(sceHttpUriBuild(nullptr, nullptr, 0, &element, buildAll) == invalidValue);
 
@@ -346,9 +661,10 @@ int main() {
     Require(sceHttpUriMerge(merged, base, nullptr, &required, sizeof(merged), 0) == invalidValue);
     Require(sceHttpUriMerge(merged, base, "./x", &required, sizeof(merged), 1) == invalidValue);
     Require(sceHttpUriMerge(nullptr, nullptr, nullptr, &required, 0, 1) == invalidValue);
-    Require(sceHttpUriMerge(merged, "http://bad host/", "./x", &required, sizeof(merged), 0) == invalidUrl);
-    Require(sceHttpUriMerge(merged, base, "http://bad host/", &required, sizeof(merged), 0) == invalidUrl);
+    Require(sceHttpUriMerge(merged, "http://[::1/", "./x", &required, sizeof(merged), 0) == invalidUrl);
+    Require(sceHttpUriMerge(merged, "http://h:80a/a", "c", &required, sizeof(merged), 0) == invalidUrl);
     Require(required == 123);
+    CheckUriMergeAsMeasured();
 
     constexpr int beforeInit = static_cast<int>(0x80431001);
     constexpr int aborted = static_cast<int>(0x80431080);
@@ -360,6 +676,10 @@ int main() {
     flushCaches(0, beforeInit);
     flushCaches(-1, beforeInit);
     flushCaches(request, beforeInit);
+    CheckPoolStatsRejected(0, beforeInit);
+    CheckPoolStatsRejected(-1, beforeInit);
+    CheckPoolStatsRejected(request, beforeInit);
+    Require(Throws([] { sceHttpGetMemoryPoolStats(0, nullptr); }));
     HttpEpollHandle epoll = nullptr;
     HttpNBEvent events[2]{};
     Require(sceHttpCreateEpoll(1, &epoll) == beforeInit);
@@ -373,6 +693,14 @@ int main() {
     flushCaches(-1, invalidId);
     flushCaches(INT32_MAX, invalidId);
     flushCaches(request, invalidId);
+    CheckPoolStats(context, 0x10000);
+    CheckPoolStats(context, 0x10000);
+    CheckPoolStatsRejected(0, invalidId);
+    CheckPoolStatsRejected(-1, invalidId);
+    CheckPoolStatsRejected(INT32_MAX, invalidId);
+    CheckPoolStatsRejected(request, invalidId);
+    Require(Throws([context] { sceHttpGetMemoryPoolStats(context, nullptr); }));
+    Require(Throws([] { sceHttpGetMemoryPoolStats(INT32_MAX, nullptr); }));
     Require(sceHttpCreateEpoll(-1, &epoll) == invalidId);
     Require(sceHttpCreateEpoll(context, nullptr) == invalidValue);
     Require(sceHttpCreateEpoll(context, &epoll) == 0 && epoll != nullptr);
@@ -414,11 +742,15 @@ int main() {
     Require(waitWokenBy([&] { Require(sceHttpDestroyEpoll(context, epoll) == 0); }) == 0);
 
     Require(sceHttpCreateEpoll(context, &epoll) == 0);
-    const int otherContext = sceHttpInit_nid_postfix(0, 0, 0x10000);
+    const int otherContext = sceHttpInit_nid_postfix(0, 0, 0x23000);
     Require(otherContext > 0 && otherContext != context);
     flushCaches(otherContext, 0);
+    CheckPoolStats(otherContext, 0x23000);
+    CheckPoolStats(context, 0x10000);
     Require(sceHttpTerm_nid_postfix(otherContext) == 0);
     flushCaches(otherContext, invalidId);
+    CheckPoolStatsRejected(otherContext, invalidId);
+    CheckPoolStats(context, 0x10000);
     flushCaches(context, 0);
     Require(sceHttpTerm_nid_postfix(otherContext) == invalidId);
     Require(sceHttpWaitRequest(epoll, events, 2, 0) == 0);
@@ -426,13 +758,23 @@ int main() {
     Require(sceHttpWaitRequest(epoll, events, 2, 0) == beforeInit);
     Require(sceHttpTerm_nid_postfix(context) == beforeInit);
     flushCaches(context, beforeInit);
-    const int newContext = sceHttpInit_nid_postfix(0, 0, 0x10000);
+    CheckPoolStatsRejected(context, beforeInit);
+    const int newContext = sceHttpInit_nid_postfix(0, 0, 0x123456000ull);
     Require(newContext > 0 && newContext != context && newContext != otherContext);
     flushCaches(context, invalidId);
     flushCaches(otherContext, invalidId);
     flushCaches(newContext, 0);
+    CheckPoolStatsRejected(context, invalidId);
+    CheckPoolStatsRejected(otherContext, invalidId);
+    CheckPoolStats(newContext, 0x123456000ull);
     Require(sceHttpTerm_nid_postfix(newContext) == 0);
     flushCaches(newContext, beforeInit);
+    CheckPoolStatsRejected(newContext, beforeInit);
+    const int emptyPoolContext = sceHttpInit_nid_postfix(0, 0, 0);
+    Require(emptyPoolContext > 0);
+    CheckPoolStats(emptyPoolContext, 0);
+    CheckPoolStatsRejected(newContext, invalidId);
+    Require(sceHttpTerm_nid_postfix(emptyPoolContext) == 0);
 
     char data[16];
     Require(sceHttpReadData(1, data, sizeof(data)) == network);
@@ -509,8 +851,9 @@ int main() {
     Require(parse("HTTP/1.1 2x0 OK\n", 16) == parseInvalidResponse);
     Require(parse("HTTP/1.1 20", 11) == parseInvalidResponse);
     Require(parse(response, 15) == parseInvalidResponse);
-    Require(parse(response, 16) == parseInvalidResponse);
     Require(phrase == nullptr && phraseLength == 0);
+    Require(parse(response, 16) == 17 && phrase == response + 12 && phraseLength == 3);
+    CheckStatusLineAsMeasured();
     auto sweep = [](const char* src, const char* expected) {
         char swept[128];
         std::memset(swept, 'x', sizeof(swept));
@@ -562,5 +905,89 @@ int main() {
         Require(sceHttpUriCopy(nullptr, &source, nullptr, 0, nullptr) == static_cast<int>(0x804311FE));
         SceHttpUriElement empty{};
         Require(sceHttpUriCopy(&copy, &empty, pool, sizeof(pool), &needed) == 0 && needed == 5 && copy.scheme != nullptr && copy.scheme[0] == 0);
+        Require(copy.scheme == pool && copy.hostname == pool + 1 && copy.path == pool + 2 && copy.username == pool + 3 && copy.password == pool + 4);
+
+        auto allBytes = [](const void* data, std::size_t size, unsigned char value) {
+            const auto* bytes = static_cast<const unsigned char*>(data);
+            for (std::size_t i = 0; i < size; ++i) {
+                if (bytes[i] != value) return false;
+            }
+            return true;
+        };
+        std::memset(pool, '~', sizeof(pool));
+        std::memset(&copy, 0x5a, sizeof(copy));
+        Require(sceHttpUriCopy(&copy, &source, pool, 64, &needed) == 0 && needed == 30);
+        Require(copy.scheme == pool && copy.hostname == pool + 5 && copy.path == pool + 17 && copy.username == pool + 22 && copy.password == pool + 27);
+        Require(allBytes(pool + 30, 34, 0) && pool[64] == '~' && copy.query == nullptr && copy.fragment == nullptr);
+        Require(allBytes(reinterpret_cast<const unsigned char*>(&copy) + 4, 4, 0) && allBytes(copy.reserved, sizeof(copy.reserved), 0));
+
+        std::memset(pool, '~', sizeof(pool));
+        std::memset(&copy, 0x5a, sizeof(copy));
+        needed = 0xabcd;
+        Require(sceHttpUriCopy(&copy, &source, pool, 29, &needed) == static_cast<int>(0x80431022) && needed == 0xabcd);
+        Require(allBytes(&copy, sizeof(copy), 0) && allBytes(pool, 29, 0) && pool[29] == '~');
+        std::memset(pool, '~', sizeof(pool));
+        Require(sceHttpUriCopy(&copy, &empty, pool, 0, &needed) == static_cast<int>(0x80431022) && pool[0] == '~' && needed == 0xabcd);
+        Require(sceHttpUriCopy(&copy, &source, pool, 4, nullptr) == static_cast<int>(0x80431022));
+
+        std::memset(pool, '~', sizeof(pool));
+        Require(sceHttpUriCopy(nullptr, &source, pool, sizeof(pool), &needed) == 0 && needed == 30 && pool[0] == '~');
+        Require(sceHttpUriCopy(nullptr, &source, pool, sizeof(pool), nullptr) == static_cast<int>(0x804311FE));
+        std::memset(&copy, 0x5a, sizeof(copy));
+        Require(sceHttpUriCopy(&copy, &source, nullptr, 64, &needed) == 0 && needed == 30 && allBytes(&copy, sizeof(copy), 0x5a));
+        Require(sceHttpUriCopy(&copy, &source, nullptr, 64, nullptr) == static_cast<int>(0x804311FE) && allBytes(&copy, sizeof(copy), 0x5a));
+        needed = 0xabcd;
+        Require(sceHttpUriCopy(&copy, nullptr, pool, sizeof(pool), &needed) == static_cast<int>(0x80433060) && needed == 0xabcd && allBytes(&copy, sizeof(copy), 0x5a));
+        Require(sceHttpUriCopy(nullptr, nullptr, nullptr, 0, nullptr) == static_cast<int>(0x80433060));
+
+        char scheme[] = "SCH";
+        char user[] = "usr";
+        char pass[] = "pwd";
+        char host[] = "hostname";
+        char path[] = "/p/q";
+        char query[] = "?query";
+        char fragment[] = "#frag";
+        char blank[] = "";
+        SceHttpUriElement manual{};
+        manual.opaque = 7;
+        manual.scheme = scheme;
+        manual.username = user;
+        manual.password = pass;
+        manual.hostname = host;
+        manual.path = path;
+        manual.query = query;
+        manual.fragment = fragment;
+        manual.port = 1234;
+        std::memset(manual.reserved, 0x11, sizeof(manual.reserved));
+        Require(sceHttpUriCopy(&copy, &manual, pool, sizeof(pool), &needed) == 0 && needed == 26 && copy.opaque == 0 && copy.port == 1234);
+        Require(Equal(copy.scheme, "SCH") && copy.hostname == pool + 4 && Equal(copy.hostname, "hostname") && copy.path == pool + 13 && Equal(copy.path, "/p/q"));
+        Require(copy.username == pool + 18 && Equal(copy.username, "usr") && copy.password == pool + 22 && Equal(copy.password, "pwd"));
+        Require(copy.query == nullptr && copy.fragment == nullptr && allBytes(copy.reserved, sizeof(copy.reserved), 0));
+
+        SceHttpUriElement mixed{};
+        mixed.hostname = host;
+        mixed.username = blank;
+        mixed.query = query;
+        mixed.port = 80;
+        Require(sceHttpUriCopy(&copy, &mixed, pool, sizeof(pool), &needed) == 0 && needed == 13 && copy.port == 80);
+        Require(copy.scheme == pool && copy.hostname == pool + 1 && copy.path == pool + 10 && copy.username == pool + 11 && copy.password == pool + 12);
+
+        SceHttpUriElement inPlace = manual;
+        Require(sceHttpUriCopy(&inPlace, &inPlace, pool, sizeof(pool), &needed) == 0 && needed == 5 && inPlace.port == 0);
+        Require(inPlace.scheme == pool && inPlace.hostname == pool + 1 && inPlace.password == pool + 4 && inPlace.password[0] == 0);
+        inPlace = manual;
+        Require(sceHttpUriCopy(&inPlace, &inPlace, nullptr, 0, &needed) == 0 && needed == 26 && inPlace.scheme == scheme);
+
+        alignas(SceHttpUriElement) char hostPool[256];
+        auto* inside = reinterpret_cast<SceHttpUriElement*>(hostPool + 160);
+        std::memcpy(static_cast<void*>(inside), &manual, sizeof(manual));
+        Require(sceHttpUriCopy(&copy, inside, hostPool, sizeof(hostPool), &needed) == 0 && needed == 5 && copy.port == 0 && copy.hostname[0] == 0);
+
+        std::memcpy(hostPool + 200, "HOSTINPOOL", 11);
+        SceHttpUriElement pooled = manual;
+        pooled.hostname = hostPool + 200;
+        Require(sceHttpUriCopy(nullptr, &pooled, hostPool, sizeof(hostPool), &needed) == 0 && needed == 28);
+        Require(sceHttpUriCopy(&copy, &pooled, hostPool, sizeof(hostPool), &needed) == 0 && needed == 18 && copy.hostname == hostPool + 4 && copy.hostname[0] == 0);
+        Require(Equal(copy.path, "/p/q") && copy.path == hostPool + 5 && copy.port == 1234);
     }
 }
diff --git a/core/libs/tests/GuestHttp2.cpp b/core/libs/tests/GuestHttp2.cpp
index 102369b0c4..286b03b042 100644
--- a/core/libs/tests/GuestHttp2.cpp
+++ b/core/libs/tests/GuestHttp2.cpp
@@ -1,48 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceHttp2/include/Http2.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceHttp2Init(int, int, std::size_t, int);
-int APS5_VABI sceHttp2CreateTemplate(int, const char*, int, int);
-int APS5_VABI sceHttp2CreateRequestWithURL(int, const char*, const char*, std::uint64_t);
-int APS5_VABI sceHttp2CreateCookieBox(std::size_t);
-int APS5_VABI sceHttp2DeleteCookieBox(int);
-int APS5_VABI sceHttp2SetCookieBox(int, int);
-int APS5_VABI sceHttp2CookieFlush(int);
-int APS5_VABI sceHttp2SetRequestNoContentLength(int);
-int APS5_VABI sceHttp2SendRequest(int, const void*, std::size_t);
-int APS5_VABI sceHttp2SendRequestAsync(int, const void*, std::size_t, Http2AsyncOption*, void*);
-int APS5_VABI sceHttp2WaitAsync(int, Http2AsyncResult*, std::uint32_t*, void*);
-int APS5_VABI sceHttp2DeleteRequest(int);
-int APS5_VABI sceHttp2DeleteTemplate(int);
-int APS5_VABI sceHttp2SetMinSslVersion(int, std::uint32_t);
-int APS5_VABI sceHttp2SslEnableOption(int, std::uint32_t);
-int APS5_VABI sceHttp2SslDisableOption(int, std::uint32_t);
-int APS5_VABI sceHttp2Term(int);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddUserEventEdge(KernelEqueue eq, int id);
-int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
-uintptr_t APS5_VABI sceKernelGetEventId(const KernelEvent* ev);
-void* APS5_VABI sceKernelGetEventUserData(const KernelEvent* ev);
-}
-
-struct Http2MemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-extern "C" {
-int APS5_VABI sceHttp2GetMemoryPoolStats(int, Http2MemoryPoolStats*);
-int APS5_VABI sceHttp2SetResolveRetry(int, std::int32_t);
-int APS5_VABI sceHttp2WebSocketSetPingInterval(std::int32_t, std::uint32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static constexpr int InvalidId = static_cast<int>(0x817B1100);
diff --git a/core/libs/tests/GuestHttpOptions.cpp b/core/libs/tests/GuestHttpOptions.cpp
index 461c44658f..e396f51ccd 100644
--- a/core/libs/tests/GuestHttpOptions.cpp
+++ b/core/libs/tests/GuestHttpOptions.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -5,36 +6,6 @@
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceHttpInit_nid_postfix(int, int, std::uint64_t);
-int APS5_VABI sceHttpTerm_nid_postfix(int);
-int APS5_VABI sceHttpCreateTemplate(int, const char*, int, int);
-int APS5_VABI sceHttpDeleteTemplate(int);
-int APS5_VABI sceHttpCreateConnectionWithURL(int, const char*, int);
-int APS5_VABI sceHttpDeleteConnection(int);
-int APS5_VABI sceHttpCreateRequestWithURL(int, int, const char*, std::uint64_t);
-int APS5_VABI sceHttpDeleteRequest(int);
-int APS5_VABI sceHttpSetAutoRedirect(int, int);
-int APS5_VABI sceHttpGetAutoRedirect(int, int*);
-int APS5_VABI sceHttpSetNonblock(int, int);
-int APS5_VABI sceHttpGetNonblock(int, int*);
-int APS5_VABI sceHttpTrySetNonblock(int, int);
-int APS5_VABI sceHttpTryGetNonblock(int, int*);
-int APS5_VABI sceHttpSetAcceptEncodingGZIPEnabled(int, int);
-int APS5_VABI sceHttpGetAcceptEncodingGZIPEnabled(int, int*);
-int APS5_VABI sceHttpSetDefaultAcceptEncodingGZIPEnabled(int, int);
-int APS5_VABI sceHttpCreateEpoll(int, HttpEpollHandle*);
-int APS5_VABI sceHttpDestroyEpoll(int, HttpEpollHandle);
-int APS5_VABI sceHttpSetEpoll(int, HttpEpollHandle, void*);
-int APS5_VABI sceHttpUnsetEpoll(int);
-int APS5_VABI sceHttpGetEpoll(int, HttpEpollHandle*, void**);
-int APS5_VABI sceHttpCacheRedirectedConnectionEnabled(int, int);
-int APS5_VABI sceHttpsEnableOptionPrivate(int, std::uint32_t);
-int APS5_VABI sceHttpsDisableOptionPrivate(int, std::uint32_t);
-int APS5_VABI sceHttpAbortRequestForce(int);
-int APS5_VABI sceHttpSetProxy(int, int, int, const char*, std::uint16_t);
-}
-
 namespace {
 
 constexpr int BeforeInit = static_cast<int>(0x80431001u);
@@ -73,6 +44,40 @@ void CheckAutoRedirect(int context) {
     Require(sceHttpDeleteConnection(connection) == 0 && sceHttpDeleteTemplate(pattern) == 0, "delete failed");
 }
 
+void CheckAuthEnabled(int context) {
+    const int pattern = sceHttpCreateTemplate(context, "anyps5-test", 2, 0);
+    Require(Get(sceHttpGetAuthEnabled, pattern) == 0, "authentication is enabled by default");
+    Require(sceHttpSetAuthEnabled(pattern, 1) == 0 && Get(sceHttpGetAuthEnabled, pattern) == 1, "sceHttpGetAuthEnabled did not return the set value");
+    const int connection = sceHttpCreateConnectionWithURL(pattern, "http://example.com/", 1);
+    const int request = sceHttpCreateRequestWithURL(connection, 0, "http://example.com/a", 0);
+    Require(Get(sceHttpGetAuthEnabled, connection) == 1 && Get(sceHttpGetAuthEnabled, request) == 1, "a child did not inherit its parent's authentication option");
+    Require(sceHttpSetAuthEnabled(request, 0) == 0 && Get(sceHttpGetAuthEnabled, request) == 0, "authentication could not be disabled on a request");
+    Require(Get(sceHttpGetAuthEnabled, connection) == 1 && Get(sceHttpGetAuthEnabled, pattern) == 1, "setting a request changed its parent options");
+    int value = -1;
+    Require(sceHttpGetAuthEnabled(request, nullptr) == InvalidValue, "a null authentication output was not refused");
+    Require(sceHttpGetAuthEnabled(UnknownId, nullptr) == InvalidValue, "the authentication output pointer is not checked before the id");
+    Require(sceHttpGetAuthEnabled(UnknownId, &value) == InvalidId && sceHttpSetAuthEnabled(UnknownId, 1) == InvalidId, "an unknown id was not refused for authentication options");
+    Require(sceHttpDeleteRequest(request) == 0 && sceHttpGetAuthEnabled(request, &value) == InvalidId, "a deleted request still has authentication options");
+    Require(sceHttpDeleteConnection(connection) == 0 && sceHttpDeleteTemplate(pattern) == 0, "delete failed");
+}
+
+void CheckCookieEnabled(int context) {
+    const int pattern = sceHttpCreateTemplate(context, "anyps5-test", 2, 0);
+    Require(Get(sceHttpGetCookieEnabled, pattern) == 0, "a template enables cookies by default");
+    Require(sceHttpSetCookieEnabled(pattern, 1) == 0 && Get(sceHttpGetCookieEnabled, pattern) == 1, "the cookie-enabled getter does not return what was set");
+    const int connection = sceHttpCreateConnectionWithURL(pattern, "http://example.com/", 1);
+    const int request = sceHttpCreateRequestWithURL(connection, 0, "http://example.com/a", 0);
+    Require(Get(sceHttpGetCookieEnabled, connection) == 1 && Get(sceHttpGetCookieEnabled, request) == 1, "a child did not inherit its parent's cookie option");
+    Require(sceHttpSetCookieEnabled(request, 0) == 0 && Get(sceHttpGetCookieEnabled, request) == 0, "the cookie option could not be disabled on a child");
+    Require(Get(sceHttpGetCookieEnabled, connection) == 1 && Get(sceHttpGetCookieEnabled, pattern) == 1, "changing a child changed its parent or sibling");
+    int value = -1;
+    Require(sceHttpGetCookieEnabled(request, nullptr) == InvalidValue, "a null cookie output was not refused");
+    Require(sceHttpSetCookieEnabled(pattern, -1) == InvalidValue && sceHttpSetCookieEnabled(pattern, 2) == InvalidValue, "an invalid cookie-enabled value was accepted");
+    Require(sceHttpGetCookieEnabled(UnknownId, &value) == InvalidId && sceHttpSetCookieEnabled(UnknownId, 1) == InvalidId, "an unknown id was not refused for cookie options");
+    Require(sceHttpDeleteRequest(request) == 0 && sceHttpGetCookieEnabled(request, &value) == InvalidId, "a deleted request retained its cookie option");
+    Require(sceHttpDeleteConnection(connection) == 0 && sceHttpDeleteTemplate(pattern) == 0, "delete failed");
+}
+
 void CheckNonblock(int context) {
     const int pattern = sceHttpCreateTemplate(context, "anyps5-test", 2, 0);
     Require(Get(sceHttpGetNonblock, pattern) == 0 && Get(sceHttpTryGetNonblock, pattern) == 0, "a template is nonblocking by default");
@@ -145,6 +150,8 @@ void CheckTermEndsOptions() {
     int value = -1;
     HttpEpollHandle bound = nullptr;
     Require(sceHttpGetAutoRedirect(pattern, &value) == BeforeInit && sceHttpSetAutoRedirect(pattern, 0) == BeforeInit, "the redirect option outlived the last sceHttpTerm");
+    Require(sceHttpGetAuthEnabled(pattern, &value) == BeforeInit && sceHttpSetAuthEnabled(pattern, 0) == BeforeInit, "the authentication option outlived the last sceHttpTerm");
+    Require(sceHttpGetCookieEnabled(pattern, &value) == BeforeInit && sceHttpSetCookieEnabled(pattern, 0) == BeforeInit, "the cookie option outlived the last sceHttpTerm");
     Require(sceHttpGetNonblock(connection, &value) == BeforeInit && sceHttpTryGetNonblock(connection, &value) == BeforeInit, "the nonblocking getters work after the last sceHttpTerm");
     Require(sceHttpSetNonblock(connection, 1) == BeforeInit && sceHttpTrySetNonblock(connection, 1) == BeforeInit, "the nonblocking setters work after the last sceHttpTerm");
     Require(sceHttpGetAcceptEncodingGZIPEnabled(pattern, &value) == BeforeInit && sceHttpSetAcceptEncodingGZIPEnabled(pattern, 1) == BeforeInit, "the gzip option outlived the last sceHttpTerm");
@@ -163,6 +170,8 @@ void CheckUnobservedOptions(int context) {
     const int pattern = sceHttpCreateTemplate(context, "anyps5-test", 2, 0);
     const int connection = sceHttpCreateConnectionWithURL(pattern, "http://example.com/", 1);
     const int request = sceHttpCreateRequestWithURL(connection, 0, "http://example.com/a", 0);
+    Require(sceHttpAddRequestHeader(request, "X-Test", "value", 0) == 0 && sceHttpRemoveRequestHeader(request, "X-Test") == 0, "offline request header calls failed");
+    Require(sceHttpRemoveRequestHeader(UnknownId, nullptr) == 0, "offline header removal started validating arguments");
     Require(sceHttpCacheRedirectedConnectionEnabled(pattern, 0) == 0 && sceHttpCacheRedirectedConnectionEnabled(request, 1) == 0, "sceHttpCacheRedirectedConnectionEnabled refused a live object");
     Require(sceHttpCacheRedirectedConnectionEnabled(UnknownId, 1) == InvalidId, "sceHttpCacheRedirectedConnectionEnabled took an unknown id");
     for (const auto option : {sceHttpsEnableOptionPrivate, sceHttpsDisableOptionPrivate}) {
@@ -188,6 +197,8 @@ int main() {
     const int context = sceHttpInit_nid_postfix(1, 1, 0x10000);
     Require(context > 0, "sceHttpInit failed");
     CheckAutoRedirect(context);
+    CheckAuthEnabled(context);
+    CheckCookieEnabled(context);
     CheckNonblock(context);
     CheckAcceptEncodingGzip(context);
     CheckEpoll(context);
diff --git a/core/libs/tests/GuestHttpResponseHeader.cpp b/core/libs/tests/GuestHttpResponseHeader.cpp
index 76bbc60b5d..46244f8153 100644
--- a/core/libs/tests/GuestHttpResponseHeader.cpp
+++ b/core/libs/tests/GuestHttpResponseHeader.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceHttp/include/Http.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdio>
@@ -13,8 +14,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceHttpParseResponseHeader(const char*, std::size_t, const char*, const char**, std::size_t*);
-
 static void Require(bool value) {
     if (!value) {
         std::fputs("HTTP response header check failed\n", stderr);
diff --git a/core/libs/tests/GuestImeDialog.cpp b/core/libs/tests/GuestImeDialog.cpp
index 574398c192..cd5fce7fcb 100644
--- a/core/libs/tests/GuestImeDialog.cpp
+++ b/core/libs/tests/GuestImeDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceImeDialog/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
@@ -7,15 +8,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceImeDialogInit(const Param*, const ExtendedParam*);
-int APS5_VABI sceImeDialogGetStatus(void);
-int APS5_VABI sceImeDialogGetResult(Result*);
-int APS5_VABI sceImeDialogAbort(void);
-int APS5_VABI sceImeDialogTerm(void);
-int APS5_VABI sceImeDialogForceClose(void);
-}
-
 namespace {
 
 constexpr int StatusNone = 0;
@@ -25,6 +17,7 @@ constexpr std::uint32_t EndStatusOk = 0;
 constexpr std::uint32_t EndStatusUserCanceled = 1;
 constexpr std::uint32_t EndStatusAborted = 2;
 constexpr int ErrorBusy = static_cast<int>(0x80bc0001u);
+constexpr int ErrorSuspending = static_cast<int>(0x80bc0009u);
 constexpr int ErrorNotOpened = static_cast<int>(0x80bc0002u);
 constexpr int ErrorNotInUse = static_cast<int>(0x80bc0107u);
 constexpr int ErrorInvalidMaxTextLength = static_cast<int>(0x80bc0016u);
@@ -177,6 +170,13 @@ int main() {
     Open(param);
     Close();
 
+    Require(sceImeDialogGetPanelPositionAndForm(nullptr) == ErrorNotOpened);
+    std::uint32_t panelWidth = 0;
+    std::uint32_t panelHeight = 0;
+    Require(sceImeDialogGetPanelSize(nullptr, &panelWidth, &panelHeight) == 0 && panelWidth == 1920 && panelHeight == 1080);
+    panelWidth = 0;
+    panelHeight = 0;
+    Require(sceImeDialogGetPanelSizeExtended(nullptr, nullptr, &panelWidth, &panelHeight) == 0 && panelWidth == 1920 && panelHeight == 1080);
     Require(sceImeDialogInit(nullptr, nullptr) == ErrorInvalidAddress);
     const Param empty = DialogParam(buffer, 0);
     Require(sceImeDialogInit(&empty, nullptr) == ErrorInvalidMaxTextLength);
@@ -186,4 +186,21 @@ int main() {
     Require(sceImeDialogInit(&noBuffer, nullptr) == ErrorInvalidInputTextBuffer);
     Require(sceImeDialogGetStatus() == StatusNone);
     Require(!ImeCapturesKeyboard_nid_postfix());
+
+    std::uint32_t star = 0xa5a5a5a5u;
+    const auto starAddress = static_cast<std::int64_t>(reinterpret_cast<std::uintptr_t>(&star));
+    Require(sceImeDialogGetCurrentStarState(starAddress) == ErrorNotInUse && star == 0xa5a5a5a5u);
+    Require(sceImeDialogSetPanelPosition(640, 360) == ErrorNotInUse);
+    Require(sceImeDialogInitInternal(nullptr, nullptr) == ErrorInvalidAddress);
+    Require(sceImeDialogInitInternal(&empty, nullptr) == ErrorInvalidMaxTextLength);
+    Require(sceImeDialogGetStatus() == StatusNone);
+    Require(sceImeDialogInitInternal(&param, nullptr) == 0);
+    Require(sceImeDialogGetStatus() == StatusRunning && ImeCapturesKeyboard_nid_postfix());
+    Require(sceImeDialogInitInternal(&param, nullptr) == ErrorBusy);
+    Require(sceImeDialogGetCurrentStarState(0) == ErrorInvalidAddress);
+    Require(sceImeDialogGetCurrentStarState(starAddress) == 0 && star == 0);
+    Require(sceImeDialogSetPanelPosition(640, 360) == ErrorSuspending);
+    Require(sceImeDialogAbort() == 0);
+    Require(sceImeDialogSetPanelPosition(0, 0) == ErrorSuspending);
+    Close();
 }
diff --git a/core/libs/tests/GuestImeFilterText.cpp b/core/libs/tests/GuestImeFilterText.cpp
index bac9e2daa2..f2f6cf3e11 100644
--- a/core/libs/tests/GuestImeFilterText.cpp
+++ b/core/libs/tests/GuestImeFilterText.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceIme/include/ImeFilterText.hpp"
 #include <cstdint>
@@ -7,11 +8,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceImeFilterText(char16_t* dst, int32_t* out_length, uint32_t capacity,
-                               const ime_filter::FilterParam* param, const char16_t* src, uint32_t src_length);
-}
-
 namespace {
 
 constexpr int kInvalidParam = static_cast<int>(0x80bc0030u);
diff --git a/core/libs/tests/GuestImeKeyboard.cpp b/core/libs/tests/GuestImeKeyboard.cpp
index 180a47106f..449089bc13 100644
--- a/core/libs/tests/GuestImeKeyboard.cpp
+++ b/core/libs/tests/GuestImeKeyboard.cpp
@@ -1,15 +1,9 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceImeKeyboardOpen(int32_t user_id, const KeyboardParam* param);
-int APS5_VABI sceImeKeyboardClose(int32_t user_id);
-int APS5_VABI sceImeKeyboardGetInfo(uint32_t resource_id, KeyboardInfo* info);
-int APS5_VABI sceImeKeyboardSetMode(int32_t user_id, uint32_t mode);
-}
-
 static_assert(sizeof(KeyboardInfo) == 36);
 
 constexpr int AlreadyOpened = static_cast<int>(0x80bc0001u);
diff --git a/core/libs/tests/GuestImeOpen.cpp b/core/libs/tests/GuestImeOpen.cpp
index 39c7278c1e..04cefbca47 100644
--- a/core/libs/tests/GuestImeOpen.cpp
+++ b/core/libs/tests/GuestImeOpen.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceIme/include/ImeInput.hpp"
 #include "prx/libSceVideoOut/include/ImeTextInput.hpp"
@@ -10,16 +11,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceImeOpen_nid_postfix(const Param* param, const ExtendedParam* extended);
-int APS5_VABI sceImeClose_nid_postfix(void);
-int APS5_VABI sceImeUpdate(EventHandler handler);
-int APS5_VABI sceImeSetText(const char16_t* text, uint32_t length);
-int APS5_VABI sceImeSetCaret(const Caret* caret);
-int APS5_VABI sceImeGetPanelPositionAndForm(PositionAndForm* form);
-void APS5_VABI sceImeParamInit(Param* param);
-}
-
 namespace {
 
 constexpr int Busy = static_cast<int>(0x80bc0001u);
@@ -181,6 +172,7 @@ struct Buffers {
 Param MakeParam(Buffers& buffers, uint32_t maxLength) {
     Param param;
     sceImeParamInit(&param);
+
     param.user_id = 1;
     param.max_text_length = maxLength;
     param.input_text_buffer = buffers.text;
diff --git a/core/libs/tests/GuestImeParameters.cpp b/core/libs/tests/GuestImeParameters.cpp
index 23f590a389..82ec0959f8 100644
--- a/core/libs/tests/GuestImeParameters.cpp
+++ b/core/libs/tests/GuestImeParameters.cpp
@@ -1,22 +1,10 @@
+#include "prx/libSceIme/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-void APS5_VABI sceImeParamInit(Param* param);
-int APS5_VABI sceImeGetPanelSize(const Param* param, uint32_t* width, uint32_t* height);
-int APS5_VABI sceImeClose_nid_postfix(void);
-int APS5_VABI sceImeGetPanelPositionAndForm(PositionAndForm* form);
-int APS5_VABI sceImeSetCaret(const Caret* caret);
-int APS5_VABI sceImeSetText(const char16_t* text, uint32_t length);
-int APS5_VABI sceImeSetTextGeometry(TextAreaMode mode, const TextGeometry* geometry);
-int APS5_VABI sceImeKeyboardOpen(int32_t user_id, const KeyboardParam* param);
-int APS5_VABI sceImeKeyboardClose(int32_t user_id);
-int APS5_VABI sceImeKeyboardGetResourceId(int32_t user_id, KeyboardResourceIdArray* resource_ids);
-}
-
 static_assert(sizeof(Param) == 96);
 static_assert(offsetof(Param, option) == 32);
 static_assert(offsetof(Param, reserved) == 88);
@@ -36,6 +24,7 @@ static void CheckInitialization() {
     std::memset(&guarded, 0xa5, sizeof(guarded));
     sceImeParamInit(nullptr);
     sceImeParamInit(&guarded.param);
+
     Require(guarded.param.user_id == -1, "initial user must be invalid");
     const auto* bytes = reinterpret_cast<const unsigned char*>(&guarded.param);
     for (size_t i = sizeof(guarded.param.user_id); i < sizeof(Param); ++i) {
@@ -47,6 +36,7 @@ static void CheckInitialization() {
     guarded.param.option = 0x4000;
     guarded.param.max_text_length = 32;
     sceImeParamInit(&guarded.param);
+
     Require(guarded.param.user_id == -1 && guarded.param.type == 0 &&
             guarded.param.option == 0 && guarded.param.max_text_length == 0,
             "reinitialization must reset previous values");
diff --git a/core/libs/tests/GuestIndexedDraw.cpp b/core/libs/tests/GuestIndexedDraw.cpp
index 3c6ed23b0b..14333e04f6 100644
--- a/core/libs/tests/GuestIndexedDraw.cpp
+++ b/core/libs/tests/GuestIndexedDraw.cpp
@@ -1,15 +1,11 @@
+#include "prx/libSceAgc/DcbDraw/include/IndexBuffer.hpp"
+#include "prx/libSceAgc/DcbDraw/include/DrawIndexed.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Pm4.hpp"
 #include <array>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t* APS5_VABI sceAgcDcbSetIndexCount(CommandBuffer*, std::uint32_t);
-std::uint32_t APS5_VABI sceAgcDcbSetIndexCountGetSize();
-std::uint32_t* APS5_VABI sceAgcDcbDrawIndex(CommandBuffer*, std::uint32_t, const volatile void*, std::uint64_t);
-std::uint32_t APS5_VABI sceAgcDcbDrawIndexGetSize();
-}
 static void Require(bool condition) { if (!condition) std::abort(); }
 template<typename TAction> static void Reject(TAction action) {
     bool rejected = false;
diff --git a/core/libs/tests/GuestInetAddress.cpp b/core/libs/tests/GuestInetAddress.cpp
index 80447cad5d..444bfb5b21 100644
--- a/core/libs/tests/GuestInetAddress.cpp
+++ b/core/libs/tests/GuestInetAddress.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,13 +7,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-int APS5_VABI inet_aton_nid_postfix(const char* text, std::uint32_t* address);
-std::uint32_t APS5_VABI inet_addr_nid_postfix(const char* text);
-char* APS5_VABI inet_ntoa_nid_postfix(std::uint32_t address);
-char* APS5_VABI inet_ntoa_r_nid_postfix(std::uint32_t address, char* buffer, std::uint32_t size);
-}
-
 namespace {
 
 void Require(bool value, const char* what) {
@@ -64,5 +59,14 @@ int main() {
     Require(inet_ntoa_r_nid_postfix(Network(1, 2, 3, 4), buffer, sizeof(buffer)) == buffer && std::string(buffer) == "1.2.3.4", "inet_ntoa_r");
     char tiny[4] = {'k', 'e', 'e', 'p'};
     Require(inet_ntoa_r_nid_postfix(Network(1, 2, 3, 4), tiny, sizeof(tiny)) == tiny, "inet_ntoa_r small buffer returns it");
+
+    char exact[14];
+    std::memset(exact, 'z', sizeof(exact));
+    Require(__inet_ntoa_r_nid_postfix(Network(192, 168, 0, 255), exact, sizeof(exact)) == exact && std::string(exact) == "192.168.0.255", "__inet_ntoa_r");
+    char oneShort[13];
+    std::memset(oneShort, 'z', sizeof(oneShort));
+    *__error_nid_postfix() = 0;
+    Require(__inet_ntoa_r_nid_postfix(Network(192, 168, 0, 255), oneShort, sizeof(oneShort)) == oneShort && *__error_nid_postfix() == 28, "__inet_ntoa_r small buffer");
+    Require(std::string(oneShort, sizeof(oneShort)) == std::string(sizeof(oneShort), 'z') && std::string(text) == "255.255.255.255", "__inet_ntoa_r leaves the buffers");
     return 0;
 }
diff --git a/core/libs/tests/GuestInitOnce.cpp b/core/libs/tests/GuestInitOnce.cpp
new file mode 100644
index 0000000000..c7140ac745
--- /dev/null
+++ b/core/libs/tests/GuestInitOnce.cpp
@@ -0,0 +1,49 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <thread>
+
+namespace {
+
+constexpr unsigned long InitFailed = 4;
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "init once: %s\n", message);
+    std::abort();
+}
+
+int Begin(void** once) {
+    int pending = -1;
+    Require(__std_init_once_begin_initialize_clr_nid_postfix(once, 0, &pending, nullptr) == 1, "begin returns 1");
+    return pending;
+}
+
+}
+
+int main() {
+    alignas(8) void* once = nullptr;
+    Require(Begin(&once) == 1, "the first caller runs the initialization");
+    Require(reinterpret_cast<std::uintptr_t>(once) == 1, "a running initialization marks the object");
+    Require(__std_init_once_complete_clr_nid_postfix(&once, InitFailed, nullptr) == 1, "complete a failed initialization");
+    Require(once == nullptr, "a failed initialization resets the object");
+    Require(Begin(&once) == 1, "a caller after a failure runs the initialization again");
+
+    std::atomic<bool> waiterDone{false};
+    std::atomic<int> waiterPending{-1};
+    std::thread waiter([&] {
+        waiterPending = Begin(&once);
+        waiterDone = true;
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    Require(!waiterDone, "a second caller waits while the initialization runs");
+    Require(__std_init_once_complete_clr_nid_postfix(&once, 0, nullptr) == 1, "complete the initialization");
+    waiter.join();
+    Require(waiterPending == 0, "the waiting caller sees the initialization done");
+    Require(reinterpret_cast<std::uintptr_t>(once) == 2, "a completed initialization marks the object");
+    Require(Begin(&once) == 0, "a later caller does not run the initialization");
+    return 0;
+}
diff --git a/core/libs/tests/GuestIntegerBuiltins.cpp b/core/libs/tests/GuestIntegerBuiltins.cpp
index 64f5cbb0e1..e0b4eaac19 100644
--- a/core/libs/tests/GuestIntegerBuiltins.cpp
+++ b/core/libs/tests/GuestIntegerBuiltins.cpp
@@ -1,73 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-using Int128 = __int128;
-using Uint128 = unsigned __int128;
-
-extern "C" {
-std::int64_t APS5_VABI __ashldi3_nid_postfix(std::int64_t, int);
-std::int64_t APS5_VABI __ashrdi3_nid_postfix(std::int64_t, int);
-std::int64_t APS5_VABI __lshrdi3_nid_postfix(std::int64_t, int);
-Int128 APS5_VABI __ashlti3_nid_postfix(Int128, int);
-Int128 APS5_VABI __ashrti3_nid_postfix(Int128, int);
-Int128 APS5_VABI __lshrti3_nid_postfix(Int128, int);
-int APS5_VABI __clzsi2_nid_postfix(std::uint32_t);
-int APS5_VABI __clzdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __clzti2_nid_postfix(Uint128);
-int APS5_VABI __ctzsi2_nid_postfix(std::uint32_t);
-int APS5_VABI __ctzdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __ctzti2_nid_postfix(Uint128);
-int APS5_VABI __ffsdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __ffsti2_nid_postfix(Uint128);
-int APS5_VABI __paritysi2_nid_postfix(std::uint32_t);
-int APS5_VABI __paritydi2_nid_postfix(std::uint64_t);
-int APS5_VABI __parityti2_nid_postfix(Uint128);
-int APS5_VABI __popcountsi2_nid_postfix(std::uint32_t);
-int APS5_VABI __popcountdi2_nid_postfix(std::uint64_t);
-int APS5_VABI __popcountti2_nid_postfix(Uint128);
-int APS5_VABI __cmpdi2_nid_postfix(std::int64_t, std::int64_t);
-int APS5_VABI __cmpti2_nid_postfix(Int128, Int128);
-int APS5_VABI __ucmpdi2_nid_postfix(std::uint64_t, std::uint64_t);
-int APS5_VABI __ucmpti2_nid_postfix(Uint128, Uint128);
-std::int64_t APS5_VABI __negdi2_nid_postfix(std::int64_t);
-Int128 APS5_VABI __negti2_nid_postfix(Int128);
-std::int64_t APS5_VABI __muldi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __multi3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __divsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __divdi3_nid_postfix(std::int64_t, std::int64_t);
-std::int32_t APS5_VABI __modsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __moddi3_nid_postfix(std::int64_t, std::int64_t);
-std::uint32_t APS5_VABI __udivsi3_nid_postfix(std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI __udivdi3_nid_postfix(std::uint64_t, std::uint64_t);
-std::uint32_t APS5_VABI __umodsi3_nid_postfix(std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI __umoddi3_nid_postfix(std::uint64_t, std::uint64_t);
-std::int32_t APS5_VABI __divmodsi4_nid_postfix(std::int32_t, std::int32_t, std::int32_t*);
-std::int64_t APS5_VABI __divmoddi4_nid_postfix(std::int64_t, std::int64_t, std::int64_t*);
-std::uint32_t APS5_VABI __udivmodsi4_nid_postfix(std::uint32_t, std::uint32_t, std::uint32_t*);
-std::uint64_t APS5_VABI __udivmoddi4_nid_postfix(std::uint64_t, std::uint64_t, std::uint64_t*);
-Uint128 APS5_VABI __udivmodti4_nid_postfix(Uint128, Uint128, Uint128*);
-std::int32_t APS5_VABI __mulosi4_nid_postfix(std::int32_t, std::int32_t, int*);
-std::int64_t APS5_VABI __mulodi4_nid_postfix(std::int64_t, std::int64_t, int*);
-Int128 APS5_VABI __muloti4_nid_postfix(Int128, Int128, int*);
-std::int32_t APS5_VABI __mulvsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __mulvdi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __mulvti3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __addvsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __addvdi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __addvti3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __subvsi3_nid_postfix(std::int32_t, std::int32_t);
-std::int64_t APS5_VABI __subvdi3_nid_postfix(std::int64_t, std::int64_t);
-Int128 APS5_VABI __subvti3_nid_postfix(Int128, Int128);
-std::int32_t APS5_VABI __negvsi2_nid_postfix(std::int32_t);
-std::int64_t APS5_VABI __negvdi2_nid_postfix(std::int64_t);
-Int128 APS5_VABI __negvti2_nid_postfix(Int128);
-std::int32_t APS5_VABI __absvsi2_nid_postfix(std::int32_t);
-std::int64_t APS5_VABI __absvdi2_nid_postfix(std::int64_t);
-Int128 APS5_VABI __absvti2_nid_postfix(Int128);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestInterfaces.cpp b/core/libs/tests/GuestInterfaces.cpp
index 5b69f12016..6306850521 100644
--- a/core/libs/tests/GuestInterfaces.cpp
+++ b/core/libs/tests/GuestInterfaces.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -7,9 +8,11 @@
 #include <arpa/inet.h>
 #include <ifaddrs.h>
 #include <net/if.h>
-#include <net/if_arp.h>
 #include <netinet/in.h>
+#ifdef __linux__
+#include <net/if_arp.h>
 #include <netpacket/packet.h>
+#endif
 #include <sys/ioctl.h>
 #include <sys/socket.h>
 #include <unistd.h>
@@ -25,15 +28,6 @@
 #include <cstring>
 #include <vector>
 
-struct GuestInterfaceAddress {
-    GuestInterfaceAddress* next;
-    char* name;
-    std::uint32_t flags;
-    void* address;
-    void* netmask;
-    void* destination;
-    void* data;
-};
 static_assert(sizeof(GuestInterfaceAddress) == 56);
 static_assert(offsetof(GuestInterfaceAddress, flags) == 16);
 static_assert(offsetof(GuestInterfaceAddress, address) == 24);
@@ -41,13 +35,6 @@ static_assert(offsetof(GuestInterfaceAddress, netmask) == 32);
 static_assert(offsetof(GuestInterfaceAddress, destination) == 40);
 static_assert(offsetof(GuestInterfaceAddress, data) == 48);
 
-extern "C" {
-int APS5_VABI getifaddrs_nid_postfix(GuestInterfaceAddress** list);
-void APS5_VABI freeifaddrs_nid_postfix(GuestInterfaceAddress* list);
-void APS5_VABI free_nid_postfix(void* pointer);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct HostInterfaceAddress {
@@ -76,7 +63,7 @@ static HostInterfaceAddress HostAddress(const sockaddr* address) {
     return entry;
 }
 
-#ifndef _WIN32
+#ifdef __linux__
 static std::uint64_t SysfsCounter(const char* name, const char* file) {
     std::ifstream input(std::string("/sys/class/net/") + name + "/statistics/" + file);
     unsigned long long value = 0;
@@ -151,6 +138,7 @@ static std::vector<HostInterfaceAddress> HostSnapshot() {
     try {
         for (auto* item = host; item; item = item->ifa_next) {
             if (!item->ifa_addr) continue;
+#ifdef __linux__
             if (item->ifa_addr->sa_family == AF_PACKET) {
                 const auto& link = *reinterpret_cast<const sockaddr_ll*>(item->ifa_addr);
                 HostInterfaceAddress entry{};
@@ -165,6 +153,7 @@ static std::vector<HostInterfaceAddress> HostSnapshot() {
                 members.insert(members.begin(), entry);
                 continue;
             }
+#endif
             if (item->ifa_addr->sa_family != AF_INET && item->ifa_addr->sa_family != AF_INET6) continue;
             Require(item->ifa_netmask != nullptr);
             HostInterfaceAddress entry = HostAddress(item->ifa_addr);
@@ -192,7 +181,7 @@ int main() {
     const std::uint8_t loopbackAddress[] = {127, 0, 0, 1};
     const std::uint8_t loopbackMask[] = {255, 0, 0, 0};
     bool matched = false;
-#ifndef _WIN32
+#ifdef __linux__
     bool linkChecked = false;
     SendLoopbackDatagram();
 #endif
@@ -211,7 +200,7 @@ int main() {
             Require((item->flags & ~knownFlags) == 0);
             const auto* address = static_cast<const std::uint8_t*>(item->address);
             Require(address != nullptr && reinterpret_cast<std::uintptr_t>(address) % 8 == 0);
-#ifndef _WIN32
+#ifdef __linux__
             if (address[1] == 18) {
                 Require(item->netmask == nullptr && item->destination == nullptr);
                 const auto* data = static_cast<const std::uint8_t*>(item->data);
@@ -293,15 +282,17 @@ int main() {
         }
         matched = equal && entries == host.size() && loopback;
         freeifaddrs_nid_postfix(list);
+
     }
     Require(matched);
-#ifndef _WIN32
+#ifdef __linux__
     Require(linkChecked);
 #endif
     GuestInterfaceAddress* released = nullptr;
     Require(getifaddrs_nid_postfix(&released) == 0 && released != nullptr);
     free_nid_postfix(released);
     freeifaddrs_nid_postfix(nullptr);
+
     *__error_nid_postfix() = 0;
     Require(getifaddrs_nid_postfix(nullptr) == -1);
     Require(*__error_nid_postfix() == 14);
diff --git a/core/libs/tests/GuestItimer.cpp b/core/libs/tests/GuestItimer.cpp
index 4e1e9d5845..7a688d67d0 100644
--- a/core/libs/tests/GuestItimer.cpp
+++ b/core/libs/tests/GuestItimer.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -12,33 +14,14 @@
 #include <thread>
 #include <typeinfo>
 
-struct GuestItimerval {
-    KernelTimeval interval;
-    KernelTimeval value;
-};
 static_assert(sizeof(GuestItimerval) == 32 && offsetof(GuestItimerval, value) == 16);
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-struct GuestTimespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
 
 using Handler = void (APS5_VABI *)(int);
 using TerminateHandler = void (*)();
 extern "C" {
-int APS5_VABI setitimer_nid_postfix(int, const GuestItimerval*, GuestItimerval*);
-int APS5_VABI getitimer_nid_postfix(int, GuestItimerval*);
+
 unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int);
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI _sigprocmask_nid_postfix(int, const GuestSignalSet*, GuestSignalSet*);
-int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet*, void*, const GuestTimespec*);
-int APS5_VABI sigpending_nid_postfix(GuestSignalSet*);
-int* APS5_VABI __error_nid_postfix();
-void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
-std::type_info* APS5_VABI __cxa_current_exception_type_nid_postfix();
-TerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(TerminateHandler);
+
 }
 
 static void Require(bool value, const char* message) {
@@ -140,6 +123,7 @@ int main(int argc, char** argv) {
         bool threw = false;
         try {
             setitimer_nid_postfix(cpu, &valid, &previous);
+
         } catch (const std::runtime_error&) {
             threw = true;
         }
@@ -150,6 +134,7 @@ int main(int argc, char** argv) {
     const GuestItimerval tiny{{0, 999}, {1, 0}};
     try {
         setitimer_nid_postfix(0, &tiny, nullptr);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -189,8 +174,8 @@ int main(int argc, char** argv) {
     Require(GuestAlarm_nid_no_patch(0) == 0, "setitimer did not cancel the alarm");
 
     const GuestSignalSet alarmSet{{1u << 13, 0, 0, 0}};
-    const GuestTimespec poll{0, 0};
-    const GuestTimespec patience{2, 0};
+    const KernelTimespec poll{0, 0};
+    const KernelTimespec patience{2, 0};
     GuestSignalSet unblocked{};
     Require(_sigprocmask_nid_postfix(1, &alarmSet, &unblocked) == 0, "blocking SIGALRM failed");
     ExpireOnce();
@@ -220,6 +205,7 @@ int main(int argc, char** argv) {
 
     Require(signal_nid_postfix(14, OnAlarm) == ignore, "SIGALRM handler was not installed");
     _ZSt13set_terminatePFvvE_nid_postfix(OnTerminate);
+
     const GuestItimerval handled{{0, 250000}, {0, 50000}};
     Require(setitimer_nid_postfix(0, &handled, nullptr) == 0, "arming the handled timer failed");
     std::this_thread::sleep_for(std::chrono::seconds(2));
diff --git a/core/libs/tests/GuestJitSharedMemory.cpp b/core/libs/tests/GuestJitSharedMemory.cpp
index 66ed8a4838..02a9cf253f 100644
--- a/core/libs/tests/GuestJitSharedMemory.cpp
+++ b/core/libs/tests/GuestJitSharedMemory.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
@@ -7,19 +8,6 @@
 #include <cstring>
 #include <source_location>
 
-extern "C" {
-int APS5_VABI sceKernelJitCreateSharedMemory(const char*, std::size_t, int, int*);
-int APS5_VABI sceKernelJitCreateAliasOfSharedMemory(int, int, int*);
-int APS5_VABI sceKernelJitMapSharedMemory(int, int, void**);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-}
-
 namespace {
 
 constexpr std::size_t Size = 0x10000;
@@ -79,10 +67,10 @@ void WriteThroughAliasRunsThroughExecutableView() {
     Require(close_nid_postfix(fd) == 0);
     auto* again = static_cast<unsigned char*>(Map(alias, Read));
     Require(again[Size - 1] == 0x5a);
-    Require(sceKernelMunmap(again, Size) == 0);
-    Require(sceKernelMunmap(writable, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(writable), Size) == 0);
     Require(Call(executable) == 0x12345678);
-    Require(sceKernelMunmap(executable, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(executable), Size) == 0);
     Require(close_nid_postfix(alias) == 0);
 }
 
@@ -98,8 +86,8 @@ void OneViewWritesAndRuns() {
     Require(close_nid_postfix(fd) == 0);
     auto* view = static_cast<unsigned char*>(Map(duplicate, Read | Execute));
     Require(Call(view) == 42);
-    Require(sceKernelMunmap(view, Size) == 0);
-    Require(sceKernelMunmap(code, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(view), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(code), Size) == 0);
     Require(close_nid_postfix(duplicate) == 0);
 }
 
@@ -114,7 +102,7 @@ void MmapOfTheDescriptorSharesTheObject() {
     view[0x300] = 0x6b;
     Require(jit[0x300] == 0x6b);
     Require(munmap_nid_postfix(mapped, Size) == 0);
-    Require(sceKernelMunmap(const_cast<unsigned char*>(jit), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(const_cast<unsigned char*>(jit)), Size) == 0);
     Require(close_nid_postfix(fd) == 0);
 }
 
@@ -138,9 +126,9 @@ void Dup2KeepsTheDescriptorTableInStep() {
     address = nullptr;
     Require(sceKernelJitMapSharedMemory(target, Read, &address) == SCE_KERNEL_ERROR_EBADF);
     Require(address == nullptr);
-    Require(sceKernelMunmap(same, Size) == 0);
-    Require(sceKernelMunmap(readable, Size) == 0);
-    Require(sceKernelMunmap(writable, Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(same), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(readable), Size) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(writable), Size) == 0);
     Require(close_nid_postfix(plain) == 0);
     Require(close_nid_postfix(target) == 0);
     Require(close_nid_postfix(fd) == 0);
@@ -187,6 +175,8 @@ int main() {
     WriteThroughAliasRunsThroughExecutableView();
     OneViewWritesAndRuns();
     Dup2KeepsTheDescriptorTableInStep();
+#ifndef __APPLE__
     MmapOfTheDescriptorSharesTheObject();
+#endif
     InvalidArgumentsAreRejected();
 }
diff --git a/core/libs/tests/GuestJobManager.cpp b/core/libs/tests/GuestJobManager.cpp
index 7258ae6694..7690957c0b 100644
--- a/core/libs/tests/GuestJobManager.cpp
+++ b/core/libs/tests/GuestJobManager.cpp
@@ -1,4 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libSceJobManager/include/Api.hpp"
 #include "SceTypes.hpp"
+#include <array>
 #include <atomic>
 #include <chrono>
 #include <cstdint>
@@ -9,61 +13,9 @@
 #include <string>
 #include <thread>
 #include <vector>
-
-struct MemorySizeQueryParams {
-    std::uint32_t version;
-    std::uint32_t workers;
-    std::uint32_t sequences;
-    std::uint32_t invocations;
-    std::uint32_t dispatches;
-    std::uint32_t syncPoints;
-    std::uint32_t waits;
-    std::uint32_t computeSequences;
-    std::uint64_t computeQueueMask;
-};
-
-struct ConfigParams {
-    std::uint32_t version;
-    std::uint32_t threadFlags;
-    std::uint32_t stackSize;
-    std::uint32_t priority;
-    const char* threadName;
-    std::uint32_t spinMicroseconds;
-    std::uint32_t computeAffinity;
-    std::uint32_t computePriority;
-    std::uint32_t reserved;
-};
-
-using JobEntry = void (APS5_VABI*)(void*, std::uint32_t);
-
-struct Sequence {
-    APS5_VABI virtual int Dispatch(JobEntry, void*, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int SyncPoint() = 0;
-    APS5_VABI virtual int Wait() = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-};
-
-struct SequenceFactory {
-    APS5_VABI virtual int Create(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int Destroy(Sequence*) = 0;
-    APS5_VABI virtual void CompleteDestructor() = 0;
-    APS5_VABI virtual void DeletingDestructor() = 0;
-    APS5_VABI virtual int CreateCompute(Sequence**, std::uint32_t, std::uint32_t, std::uint32_t, std::uint32_t, const char*) = 0;
-    APS5_VABI virtual int DestroyCompute(Sequence*) = 0;
-};
-
-extern "C" {
-void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void*);
-void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void*);
-std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams*);
-int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void*, void*, std::uint64_t, std::uint32_t, std::uint32_t, std::uint32_t, std::uint64_t, const ConfigParams*);
-int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void*, void*, std::uint64_t, std::uint32_t, std::uint32_t, const ConfigParams*);
-int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void*);
-SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void*, std::uint32_t);
-SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void*, std::uint32_t);
-int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void*, std::uint32_t);
-}
+#ifdef _WIN32
+#include <windows.h>
+#endif
 
 #define Construct _ZN3sce3Job10JobManagerC1Ev
 #define Destruct _ZN3sce3Job10JobManagerD1Ev
@@ -176,10 +128,10 @@ static void ValidationCase() {
     Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == AlreadyInitialized);
     Require(SetPersistentThreadCount(manager.storage, 3) == InvalidArgument);
     Require(SetPersistentThreadCount(manager.storage, 2) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
     Require(factory != nullptr && Factories(manager.storage, 1) != nullptr && factory != Factories(manager.storage, 1));
     Require(UnifiedFactories(manager.storage, 0) != nullptr);
-    Sequence* sequence = nullptr;
+    ISequence* sequence = nullptr;
     Require(factory->Create(nullptr, 1, 1, 1, 1, nullptr) == NullArgument);
     Require(factory->Create(&sequence, 0, 0, 0, 0, nullptr) == OutOfRange);
     Require(factory->Create(&sequence, 0x8000, 1, 1, 1, nullptr) == OutOfRange);
@@ -187,13 +139,13 @@ static void ValidationCase() {
     Require(factory->Create(&sequence, 1, 1, 0x100, 1, nullptr) == OutOfRange);
     Require(factory->Create(&sequence, 1, 1, 1, 0x40, nullptr) == OutOfRange);
     Require(factory->CreateCompute(&sequence, 1, 1, 1, 1, nullptr) == NoneFree && sequence == nullptr);
-    Sequence* first = nullptr;
-    Sequence* second = nullptr;
+    ISequence* first = nullptr;
+    ISequence* second = nullptr;
     Require(factory->Create(&first, 8, 8, 2, 2, "first") == 0 && first != nullptr);
     Require(factory->Create(&second, 8, 8, 2, 2, "second") == 0 && second != nullptr && second != first);
     Require(factory->Create(&sequence, 8, 8, 2, 2, "third") == NoneFree);
     Require(factory->DestroyCompute(first) == Invalid);
-    Require(factory->Destroy(reinterpret_cast<Sequence*>(block.memory)) == Invalid);
+    Require(factory->Destroy(reinterpret_cast<ISequence*>(block.memory)) == Invalid);
     Require(factory->Destroy(first) == 0 && factory->Destroy(first) == Invalid);
     Require(factory->Create(&sequence, 8, 8, 2, 2, "again") == 0 && sequence == first);
     Require(sequence->Dispatch(nullptr, nullptr, 1, nullptr) == NullArgument);
@@ -219,8 +171,8 @@ static void DispatchCase() {
     Block block(SizeFor(4, 1, 8, 2, 2));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
-    Sequence* sequence = nullptr;
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 0x7fff, 8, 2, 2, "dispatch") == 0);
     Tally tally(1000);
     Tally single(1);
@@ -251,8 +203,8 @@ static void OrderingCase() {
     Block block(SizeFor(4, 1, 8, 4, 2));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 1);
-    Sequence* sequence = nullptr;
+    ISequenceFactory* factory = Factories(manager.storage, 1);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 256, 8, 4, 2, "ordering") == 0);
     std::atomic<std::uint32_t> finished{0};
     std::atomic<std::uint32_t> early{0};
@@ -273,7 +225,7 @@ static void OrderingCase() {
 }
 
 struct Nested {
-    Sequence* sequence;
+    ISequence* sequence;
     std::atomic<bool> barrierAppended{false};
     std::atomic<bool> followerAppended{false};
     std::atomic<bool> leaderFinished{false};
@@ -295,11 +247,66 @@ static void APS5_VABI LeaderJob(void* argument, std::uint32_t) {
     nested.leaderFinished = true;
 }
 
+static void RequireParked(int clock);
+
+struct WorkerWait {
+    int spareClock = 0;
+    ISequence* child;
+    std::atomic<bool> publisherEntered{false};
+    std::atomic<bool> spareEntered{false};
+    std::atomic<bool> publish{false};
+    std::atomic<bool> finished{false};
+    std::atomic<unsigned> childCalls{0};
+};
+
+static void APS5_VABI WorkerWaitChild(void* argument, std::uint32_t) {
+    ++static_cast<WorkerWait*>(argument)->childCalls;
+}
+
+static void APS5_VABI WorkerWaitPublisher(void* argument, std::uint32_t index) {
+    auto& state = *static_cast<WorkerWait*>(argument);
+    if (index != 0) {
+        Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), &state.spareClock) == 0);
+        state.spareEntered = true;
+        return;
+    }
+    state.publisherEntered = true;
+    while (!state.publish) std::this_thread::yield();
+    Require(state.child->Dispatch(WorkerWaitChild, &state, 1, "child") == 0);
+    Require(state.child->Wait() == 0);
+    state.finished = true;
+}
+
+static void WorkerWaitCase() {
+    Block block(SizeFor(2, 2, 4, 0, 4));
+    ManagerObject manager;
+    const ConfigParams config{0, 0x21fff, 0x10000, 0x2bc, "WorkerWait", 0, 0, 0, 0};
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, &config) == 0);
+    Require(SetPersistentThreadCount(manager.storage, 0) == 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* publisher = nullptr;
+    WorkerWait state{};
+    Require(factory->Create(&publisher, 2, 1, 0, 1, "publisher") == 0);
+    Require(factory->Create(&state.child, 1, 1, 0, 1, "child") == 0);
+    Require(publisher->Dispatch(WorkerWaitPublisher, &state, 2, "park spare") == 0);
+    auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+    while ((!state.publisherEntered || !state.spareEntered) && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(state.publisherEntered && state.spareEntered);
+    RequireParked(state.spareClock);
+    state.publish = true;
+    deadline = std::chrono::steady_clock::now() + std::chrono::seconds(3);
+    while (!state.finished && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(state.finished && state.childCalls == 1);
+    Require(publisher->Wait() == 0);
+    Require(factory->Destroy(publisher) == 0 && factory->Destroy(state.child) == 0);
+    Require(Shutdown(manager.storage) == 0);
+}
+
 static void NestedCase() {
     Block block(SizeFor(2, 1, 4, 2, 2));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 2, 1, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
     Nested nested{};
     Require(factory->Create(&nested.sequence, 16, 4, 2, 2, "nested") == 0);
     Require(nested.sequence->Dispatch(LeaderJob, &nested, 1, "leader") == 0);
@@ -323,8 +330,8 @@ static void LimitsCase() {
     Block block(SizeFor(2, 2, 2, 1, 1));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == 0);
-    SequenceFactory* factory = Factories(manager.storage, 0);
-    Sequence* sequence = nullptr;
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 4, 2, 1, 1, "limits") == 0);
     for (int round = 0; round < 3; ++round) {
         Require(sequence->Dispatch(Nothing, nullptr, 2, nullptr) == 0);
@@ -348,6 +355,15 @@ static void LimitsCase() {
     Require(factory->Create(&sequence, 4, 2, 1, 1, "waits") == 0);
     Require(sequence->Wait() == 0 && sequence->Wait() == 0);
     Require(factory->Destroy(sequence) == 0);
+    Require(Shutdown(manager.storage) == 0);
+}
+
+static void NodePoolCase() {
+    Block block(SizeFor(2, 2, 2, 1, 1));
+    ManagerObject manager;
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, nullptr) == 0);
+    ISequenceFactory* factory = Factories(manager.storage, 0);
+    ISequence* sequence = nullptr;
     Require(factory->Create(&sequence, 0x7fff, 0x3ff, 0xff, 1, "nodes") == 0);
     int result = 0;
     int accepted = 0;
@@ -413,9 +429,9 @@ static void PriorityCase() {
     Block block(SizeFor(1, 3, 8, 2, 4));
     ManagerObject manager;
     Require(Initialize(manager.storage, block.memory, block.bytes, 1, 3, nullptr) == 0);
-    Sequence* gate = nullptr;
-    Sequence* low = nullptr;
-    Sequence* high = nullptr;
+    ISequence* gate = nullptr;
+    ISequence* low = nullptr;
+    ISequence* high = nullptr;
     Require(Factories(manager.storage, 0)->Create(&gate, 4, 4, 1, 1, "gate") == 0);
     Require(Factories(manager.storage, 0)->Create(&low, 4, 4, 1, 1, "low") == 0);
     Require(Factories(manager.storage, 1)->Create(&high, 4, 4, 1, 1, "high") == 0);
@@ -437,8 +453,8 @@ static void ShutdownCase() {
     ManagerObject manager;
     for (int round = 0; round < 3; ++round) {
         Require(Initialize(manager.storage, block.memory, block.bytes, 3, 2, nullptr) == 0);
-        SequenceFactory* factory = UnifiedFactories(manager.storage, 0);
-        Sequence* sequence = nullptr;
+        ISequenceFactory* factory = UnifiedFactories(manager.storage, 0);
+        ISequence* sequence = nullptr;
         Tally tally(64);
         Require(factory->Create(&sequence, 64, 8, 2, 2, "shutdown") == 0);
         Require(sequence->Dispatch(CountJob, &tally, 64, nullptr) == 0 && sequence->Wait() == 0 && tally.calls == 64);
@@ -453,16 +469,257 @@ static void ShutdownCase() {
     }
 }
 
-int main(int argc, char** argv) {
-    const std::string name = argc > 1 ? argv[1] : "";
+static void APS5_VABI CaptureWorkerClock(void* argument, std::uint32_t) {
+    Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), static_cast<int*>(argument)) == 0);
+}
+
+static std::int64_t CpuNanos(int clock) {
+    KernelTimespec time{};
+    Require(sceKernelClockGettime(clock, &time) == 0);
+    return time.tv_sec * 1000000000LL + time.tv_nsec;
+}
+
+static void RequireParked(int clock) {
+    std::this_thread::sleep_for(std::chrono::milliseconds(30));
+    const auto start = CpuNanos(clock);
+    std::this_thread::sleep_for(std::chrono::milliseconds(80));
+    Require(CpuNanos(clock) - start < 20000000);
+}
+
+static void WorkerPolicyCase() {
+    for (const std::uint32_t mode : {0x10000u, 0x20000u}) {
+        for (const std::uint32_t spin : {0u, 50u}) {
+            Block block(SizeFor(1, 1, 8, 2, 2));
+            ManagerObject manager;
+            const ConfigParams config{0, mode | 0x1fff, 0x10000, 0x2bc, "WorkerPolicy", spin, 0, 0, 0};
+            Require(Initialize(manager.storage, block.memory, block.bytes, 1, 1, &config) == 0);
+            auto* factory = Factories(manager.storage, 0);
+            ISequence* sequence = nullptr;
+            Require(factory->Create(&sequence, 8, 8, 2, 2, "worker policy") == 0);
+            int clock = 0;
+            Require(sequence->Dispatch(CaptureWorkerClock, &clock, 1, nullptr) == 0 && sequence->Wait() == 0);
+            RequireParked(clock);
+            for (int round = 0; round < 2; ++round) {
+                Require(SetPersistentThreadCount(manager.storage, 1) == 0);
+                RequireParked(clock);
+                Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0);
+                const auto start = CpuNanos(clock);
+                const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+                while (CpuNanos(clock) - start < 30000000 && std::chrono::steady_clock::now() < deadline) {
+                    std::this_thread::sleep_for(std::chrono::milliseconds(10));
+                }
+                Require(CpuNanos(clock) - start >= 30000000);
+                Require(SetPersistentThreadCount(manager.storage, 0) == 0);
+                RequireParked(clock);
+            }
+            Require(SetPersistentThreadCount(manager.storage, 1) == 0);
+            Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0);
+            Require(Shutdown(manager.storage) == 0);
+        }
+    }
+}
+
+static void WorkerWakeCase() {
+    Block block(SizeFor(4, 1, 8, 2, 2));
+    ManagerObject manager;
+    for (const std::uint32_t mode : {0x10000u, 0x20000u}) {
+        const ConfigParams config{0, mode | 0x1fff, 0x10000, 0x2bc, "WorkerWake", 50, 0, 0, 0};
+        Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, &config) == 0);
+        ISequence* sequence = nullptr;
+        auto* factory = Factories(manager.storage, 0);
+        Require(factory->Create(&sequence, 1024, 8, 2, 2, "worker wake") == 0);
+        for (std::uint32_t round = 0; round < 60; ++round) {
+            Require(SetPersistentThreadCount(manager.storage, round % 5) == 0);
+            Tally tally(257);
+            Require(sequence->Dispatch(CountJob, &tally, 257, nullptr) == 0);
+            Require(sequence->SyncPoint() == 0);
+            Require(sequence->Dispatch(CountJob, &tally, 257, nullptr) == 0);
+            Require(sequence->Wait() == 0 && tally.calls == 514);
+            for (const auto& count : tally.seen) Require(count == 2);
+        }
+        Require(factory->Destroy(sequence) == 0);
+        Require(Shutdown(manager.storage) == 0);
+    }
+}
+
+struct HeldWorker {
+    std::atomic<bool> started{false};
+    std::atomic<bool> release{false};
+};
+
+struct SpinClock {
+    int guest = 0;
+    std::int64_t reference = 0;
+#ifdef _WIN32
+    HANDLE thread = nullptr;
+    ~SpinClock() { if (thread != nullptr) CloseHandle(thread); }
+#endif
+};
+
+static std::int64_t SpinCpuUnits(const SpinClock& clock);
+
+static void APS5_VABI CaptureSpinClock(void* argument, std::uint32_t) {
+    auto& clock = *static_cast<SpinClock*>(argument);
+    CaptureWorkerClock(&clock.guest, 0);
+#ifdef _WIN32
+    clock.thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, FALSE, GetCurrentThreadId());
+    Require(clock.thread != nullptr);
+#endif
+    const auto before = SpinCpuUnits(clock);
+    const auto until = std::chrono::steady_clock::now() + std::chrono::milliseconds(5);
+    while (std::chrono::steady_clock::now() < until) {}
+    clock.reference = SpinCpuUnits(clock) - before;
+    Require(clock.reference > 0);
+}
+
+static std::int64_t SpinCpuUnits(const SpinClock& clock) {
+#ifdef _WIN32
+    ULONG64 cycles = 0;
+    Require(QueryThreadCycleTime(clock.thread, &cycles));
+    return static_cast<std::int64_t>(cycles);
+#else
+    return CpuNanos(clock.guest);
+#endif
+}
+
+static void APS5_VABI HoldWorker(void* argument, std::uint32_t) {
+    auto& worker = *static_cast<HeldWorker*>(argument);
+    worker.started = true;
+    worker.started.notify_one();
+    worker.release.wait(false);
+}
+
+struct SpinSample {
+    std::int64_t consumed;
+    std::int64_t reference;
+};
+
+static SpinSample MeasureWorkerSpin(std::uint32_t spin, std::uint32_t rounds, bool pending) {
+    Block block(SizeFor(2, 2, 4, 2, 2));
+    ManagerObject manager;
+    const ConfigParams config{0, 0x10003, 0x10000, 0x2bc, "WorkerSpin", spin, 0, 0, 0};
+    Require(Initialize(manager.storage, block.memory, block.bytes, 2, 2, &config) == 0);
+    auto* factory = Factories(manager.storage, 0);
+    ISequence* held = nullptr;
+    ISequence* pulse = nullptr;
+    Require(factory->Create(&held, 4, 4, 2, 2, "held worker") == 0);
+    Require(factory->Create(&pulse, 4, 4, 2, 2, "idle worker") == 0);
+    HeldWorker worker;
+    Require(held->Dispatch(HoldWorker, &worker, 1, nullptr) == 0);
+    worker.started.wait(false);
+    if (pending) {
+        Require(held->SyncPoint() == 0);
+        Require(held->Dispatch(Nothing, nullptr, 1, nullptr) == 0);
+    }
+    SpinClock clock;
+    Require(pulse->Dispatch(CaptureSpinClock, &clock, 1, nullptr) == 0 && pulse->Wait() == 0);
+    RequireParked(clock.guest);
+    const auto before = SpinCpuUnits(clock);
+    for (std::uint32_t round = 0; round < rounds; ++round) {
+        Require(pulse->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && pulse->Wait() == 0);
+        Require(sceKernelUsleep_nid_postfix(1000) == 0);
+    }
+    const auto consumed = SpinCpuUnits(clock) - before;
+    RequireParked(clock.guest);
+    Require(!worker.release);
+    worker.release = true;
+    worker.release.notify_one();
+    Require(held->Wait() == 0);
+    Require(factory->Destroy(held) == 0 && factory->Destroy(pulse) == 0);
+    Require(Shutdown(manager.storage) == 0);
+    return {consumed, clock.reference};
+}
+
+static void WorkerSpinCase() {
+    constexpr std::uint32_t rounds = 512;
+    const auto parked = MeasureWorkerSpin(0, rounds, true);
+    const auto spinning = MeasureWorkerSpin(50, rounds, true);
+    const auto noPending = MeasureWorkerSpin(50, rounds, false);
+#ifdef _WIN32
+    constexpr const char* units = "cycles";
+#else
+    constexpr const char* units = "ns";
+#endif
+    std::fprintf(stderr, "idle worker CPU over %u pulses (%s): spin=0 %lld, spin=50 %lld, no pending work %lld, 5ms active reference %lld\n", rounds, units,
+        static_cast<long long>(parked.consumed), static_cast<long long>(spinning.consumed), static_cast<long long>(noPending.consumed), static_cast<long long>(spinning.reference));
+    const auto interval = spinning.reference * rounds / 100;
+    Require(spinning.consumed > parked.consumed + interval / 3);
+    Require(spinning.consumed < parked.consumed + interval * 5);
+    Require(noPending.consumed < parked.consumed + interval / 3);
+}
+
+struct WorkerClocks {
+    std::array<int, 4> clocks{};
+    std::atomic<unsigned int> arrived{0};
+    std::atomic<bool> release{false};
+};
+
+static void APS5_VABI CaptureWorkerClocks(void* argument, std::uint32_t index) {
+    auto& workers = *static_cast<WorkerClocks*>(argument);
+    CaptureWorkerClock(&workers.clocks[index], 0);
+    ++workers.arrived;
+    while (!workers.release) std::this_thread::yield();
+}
+
+static void WorkerCountCase() {
+    Block block(SizeFor(4, 1, 8, 2, 2));
+    ManagerObject manager;
+    const ConfigParams config{0, 0x1000f, 0x10000, 0x2bc, "WorkerCount", 0, 0, 0, 0};
+    Require(Initialize(manager.storage, block.memory, block.bytes, 4, 1, &config) == 0);
+    ISequence* sequence = nullptr;
+    Require(Factories(manager.storage, 0)->Create(&sequence, 8, 8, 2, 2, "worker count") == 0);
+    WorkerClocks workers;
+    Require(sequence->Dispatch(CaptureWorkerClocks, &workers, 4, nullptr) == 0);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    while (workers.arrived != 4 && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
+    Require(workers.arrived == 4);
+    workers.release = true;
+    Require(sequence->Wait() == 0);
+    for (const std::uint32_t persistent : {2u, 4u}) {
+        Require(SetPersistentThreadCount(manager.storage, 0) == 0);
+        for (const int clock : workers.clocks) RequireParked(clock);
+        Require(SetPersistentThreadCount(manager.storage, persistent) == 0);
+        for (std::uint32_t job = 0; job < persistent; ++job) {
+            Require(sequence->Dispatch(Nothing, nullptr, 1, nullptr) == 0 && sequence->Wait() == 0);
+        }
+        std::array<std::int64_t, 4> starts{};
+        for (std::size_t index = 0; index < starts.size(); ++index) starts[index] = CpuNanos(workers.clocks[index]);
+        const auto until = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+        unsigned int active = 0;
+        do {
+            std::this_thread::sleep_for(std::chrono::milliseconds(20));
+            active = 0;
+            for (std::size_t index = 0; index < starts.size(); ++index) {
+                if (CpuNanos(workers.clocks[index]) - starts[index] >= 30000000) ++active;
+            }
+        } while (active < persistent && std::chrono::steady_clock::now() < until);
+        Require(active == persistent);
+    }
+    Require(Shutdown(manager.storage) == 0);
+}
+
+int RunJobManagerCase(const char* caseName) {
+    const std::string name = caseName;
     if (name == "memory") MemoryCase();
     else if (name == "validation") ValidationCase();
     else if (name == "dispatch") DispatchCase();
     else if (name == "ordering") OrderingCase();
     else if (name == "limits") LimitsCase();
+    else if (name == "node_pool") NodePoolCase();
     else if (name == "nested") NestedCase();
     else if (name == "priority") PriorityCase();
     else if (name == "shutdown") ShutdownCase();
+    else if (name == "worker_policy") WorkerPolicyCase();
+    else if (name == "worker_wait") WorkerWaitCase();
+    else if (name == "worker_wake") WorkerWakeCase();
+    else if (name == "worker_spin") WorkerSpinCase();
+    else if (name == "worker_count") WorkerCountCase();
     else return 2;
     return 0;
 }
+
+#ifndef ANYPS5_JOB_MANAGER_REFERENCE
+int main(int argc, char** argv) {
+    return RunJobManagerCase(argc > 1 ? argv[1] : "");
+}
+#endif
diff --git a/core/libs/tests/GuestJpegDec.cpp b/core/libs/tests/GuestJpegDec.cpp
index 6a8273a54e..6c6183b175 100644
--- a/core/libs/tests/GuestJpegDec.cpp
+++ b/core/libs/tests/GuestJpegDec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegDec/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Jpeg.hpp"
@@ -25,14 +26,6 @@ static_assert(offsetof(JpegDecImageInfo, component_id) == 0xC && offsetof(JpegDe
 static_assert(offsetof(JpegDecImageInfo, coefficient_mem_size) == 0x14 && offsetof(JpegDecImageInfo, suitable_csc_attribute) == 0x18);
 static_assert(offsetof(JpegDecImageInfo, output_image_width) == 0x1C && offsetof(JpegDecImageInfo, output_image_height) == 0x20);
 
-extern "C" {
-std::int32_t APS5_VABI sceJpegDecQueryMemorySize(const JpegDecCreateParam*);
-std::int32_t APS5_VABI sceJpegDecCreate(const JpegDecCreateParam*, void*, std::uint32_t, void**);
-std::int32_t APS5_VABI sceJpegDecDelete(void*);
-std::int32_t APS5_VABI sceJpegDecParseHeader(const JpegDecParseParam*, JpegDecImageInfo*);
-std::int32_t APS5_VABI sceJpegDecDecode(void*, const JpegDecDecodeParam*, JpegDecImageInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestJpegEnc.cpp b/core/libs/tests/GuestJpegEnc.cpp
index 8206423e5f..c97ce0d6a1 100644
--- a/core/libs/tests/GuestJpegEnc.cpp
+++ b/core/libs/tests/GuestJpegEnc.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJpegEnc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Jpeg.hpp"
@@ -8,13 +9,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI sceJpegEncQueryMemorySize(const JpegEncCreateParam*);
-std::int32_t APS5_VABI sceJpegEncCreate(const JpegEncCreateParam*, void*, std::uint32_t, void**);
-std::int32_t APS5_VABI sceJpegEncDelete(void*);
-std::int32_t APS5_VABI sceJpegEncEncode(void*, const JpegEncEncodeParam*, JpegEncOutputInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 alignas(4) static unsigned char image[16 * 16 * 4];
@@ -209,7 +203,7 @@ int main() {
     rgba.image_pitch = pitch;
     rgba.compression_ratio = 0;
     info = {};
-    Require(sceJpegEncEncode(handle, &rgba, &info) == 0);
+    Require(sceJpegEncEncode(handle, &rgba, &info) == static_cast<std::int32_t>(info.size) && info.size > 0);
     Require(info.height == 16);
     Require(ReadFrame(jpeg, info.size) == std::pair{3, std::uint8_t{0x22}});
     Require(AverageError(expected, DecodeOutput(info)) < 6);
@@ -225,7 +219,7 @@ int main() {
     JpegEncEncodeParam bgra = rgba;
     bgra.pixel_format = 1;
     info = {};
-    Require(sceJpegEncEncode(handle, &bgra, &info) == 0);
+    Require(sceJpegEncEncode(handle, &bgra, &info) == static_cast<std::int32_t>(info.size) && info.size > 0);
     Require(ReadFrame(jpeg, info.size) == std::pair{3, std::uint8_t{0x22}});
     Require(AverageError(expected, DecodeOutput(info)) < 6);
 
@@ -242,7 +236,7 @@ int main() {
     yuv.image_pitch = 16 * 2;
     yuv.pixel_format = 10;
     info = {};
-    Require(sceJpegEncEncode(handle, &yuv, &info) == 0);
+    Require(sceJpegEncEncode(handle, &yuv, &info) == static_cast<std::int32_t>(info.size) && info.size > 0);
     Require(AverageError(std::vector<std::uint8_t>(16 * 16 * 3, 100), DecodeOutput(info)) < 3);
 
     static unsigned char gray[16 * 16];
@@ -257,7 +251,7 @@ int main() {
     y8.color_space = 2;
     y8.sampling_type = 0;
     info = {};
-    Require(sceJpegEncEncode(handle, &y8, &info) == 0);
+    Require(sceJpegEncEncode(handle, &y8, &info) == static_cast<std::int32_t>(info.size) && info.size > 0);
     Require(ReadFrame(jpeg, info.size) == std::pair{1, std::uint8_t{0x11}});
     const auto decodedGray = DecodeOutput(info, 1);
     Require(AverageError(std::vector<std::uint8_t>(gray, gray + sizeof(gray)), decodedGray) < 6);
@@ -265,11 +259,11 @@ int main() {
     rgba.sampling_type = 1;
     rgba.compression_ratio = 0;
     info = {};
-    Require(sceJpegEncEncode(handle, &rgba, &info) == 0);
+    Require(sceJpegEncEncode(handle, &rgba, &info) == static_cast<std::int32_t>(info.size) && info.size > 0);
     Require(ReadFrame(jpeg, info.size) == std::pair{3, std::uint8_t{0x21}});
 
     std::memset(jpeg, 0, sizeof(jpeg));
-    Require(sceJpegEncEncode(handle, &rgba, nullptr) == 0);
+    Require(sceJpegEncEncode(handle, &rgba, nullptr) == static_cast<std::int32_t>(info.size));
     Require(jpeg[0] == 0xFF && jpeg[1] == 0xD8);
 
     JpegEncEncodeParam tooSmall = rgba;
@@ -303,7 +297,7 @@ int main() {
         p.jpeg_size = sizeof(restarted);
         p.restart_interval = restart;
         JpegEncOutputInfo out{};
-        Require(sceJpegEncEncode(handle, &p, &out) == 0);
+        Require(sceJpegEncEncode(handle, &p, &out) == static_cast<std::int32_t>(out.size));
         Require(IsJpeg(restarted, out.size) && out.height == wideHeight);
         const auto decoded = Decoder::Jpeg::Decode({restarted, out.size});
         Require(decoded.has_value() && decoded->width == wideWidth && decoded->height == wideHeight);
diff --git a/core/libs/tests/GuestJson.cpp b/core/libs/tests/GuestJson.cpp
index c20ffcbd83..1cc2993f93 100644
--- a/core/libs/tests/GuestJson.cpp
+++ b/core/libs/tests/GuestJson.cpp
@@ -1,5 +1,8 @@
+#include "prx/libSceJson2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
+#include <clocale>
+#include <cmath>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -7,146 +10,17 @@
 #include <limits>
 #include <stdexcept>
 #include <string>
+#include <utility>
 #include <vector>
 
-struct Value { void* node; };
-struct String { void* text; };
-struct Array { void* items; };
-struct Object { void* items; };
-struct Iterator { void* position; };
-struct Pair {
-    String key;
-    std::uint64_t reserved;
-    Value value;
-};
-using NullAccessCallback = const Value& (APS5_VABI*)(std::int32_t, const Value*, void*);
+using namespace SceJson2;
+
 using SetNullAccessCallback = int (APS5_VABI*)(void*, NullAccessCallback, void*);
-using TypeMismatchHandler = const Value& (APS5_VABI*)(std::int32_t, const Value*, const Value*, void*);
-using SpecialFloatHandler = Value* (APS5_VABI*)(Value*, std::int32_t, double, const Value*, void*, bool*);
-using ElementAccessFailureHandler = void (APS5_VABI*)(std::int32_t, const String*, const std::size_t*, const Value*, const Value*, void*);
 
 extern "C" {
-int APS5_VABI _ZN3sce4Json11InitializerC1Ev(void*);
-int APS5_VABI _ZN3sce4Json11InitializerD1Ev(void*);
-int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE(void*, const void*);
-int APS5_VABI _ZN3sce4Json11Initializer9terminateEv(void*);
-int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallBackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void*, NullAccessCallback, void*);
-int APS5_VABI _ZN3sce4Json11Initializer27setGlobalNullAccessCallbackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_(void*, NullAccessCallback, void*);
-void APS5_VABI _ZN3sce4Json5Value21setNullAccessCallBackEPFRKS1_NS0_9ValueTypeEPS2_PvES6_(NullAccessCallback, void*);
-int APS5_VABI _ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(Value*, TypeMismatchHandler, void*);
-int APS5_VABI _ZN3sce4Json5Value22setSpecialFloatHandlerEPFKS1_NS0_12FunctionTypeEdPS2_PvPbES5_(Value*, SpecialFloatHandler, void*);
-int APS5_VABI _ZN3sce4Json5Value30setElementAccessFailureHandlerEPFviPKNS0_6StringEPKmPKS1_S8_PvES9_(Value*, ElementAccessFailureHandler, void*);
-int APS5_VABI _ZN3sce4Json5Value3setEd(Value*, double);
-int APS5_VABI _ZN3sce4Json5Value3setERKS1_(Value*, const Value*);
-Value* APS5_VABI _ZN3sce4Json5ValueaSERKS1_(Value*, const Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKS1_(Value*, const Value*);
-void APS5_VABI _ZN3sce4Json6StringC1Ev(String*);
-void APS5_VABI _ZN3sce4Json6StringC1EPKc(String*, const char*);
-void APS5_VABI _ZN3sce4Json6StringD1Ev(String*);
-const char* APS5_VABI _ZNK3sce4Json6String5c_strEv(const String*);
-std::size_t APS5_VABI _ZNK3sce4Json6String6lengthEv(const String*);
-bool APS5_VABI _ZNK3sce4Json6String5emptyEv(const String*);
-void APS5_VABI _ZN3sce4Json5ArrayC1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(Array*, const Array*);
-void APS5_VABI _ZN3sce4Json5Array5clearEv(Array*);
-const Value* APS5_VABI _ZNK3sce4Json5Array5frontEv(const Array*);
-Value* APS5_VABI _ZNK3sce4Json5Array8iteratorptEv(const Iterator*);
-void APS5_VABI _ZN3sce4Json5ArrayD1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(Array*, const Value*);
-Iterator* APS5_VABI _ZNK3sce4Json5Array5beginEv(Iterator*, const Array*);
-Iterator* APS5_VABI _ZNK3sce4Json5Array3endEv(Iterator*, const Array*);
-std::size_t APS5_VABI _ZNK3sce4Json5Array4sizeEv(const Array*);
-const Value* APS5_VABI _ZNK3sce4Json5Array4backEv(const Array*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEv(Iterator*);
-Value* APS5_VABI _ZNK3sce4Json5Array8iteratordeEv(const Iterator*);
-bool APS5_VABI _ZNK3sce4Json5Array8iteratorneERKS2_(const Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json6ObjectC1Ev(Object*);
-void APS5_VABI _ZN3sce4Json6ObjectD1Ev(Object*);
-Value* APS5_VABI _ZN3sce4Json6ObjectixERKNS0_6StringE(Object*, const String*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object5beginEv(Iterator*, const Object*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object3endEv(Iterator*, const Object*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorD1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEv(Iterator*);
-Pair* APS5_VABI _ZNK3sce4Json6Object8iteratordeEv(const Iterator*);
-Pair* APS5_VABI _ZNK3sce4Json6Object8iteratorptEv(const Iterator*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object4findERKNS0_6StringE(Iterator*, const Object*, const String*);
-int APS5_VABI _ZNK3sce4Json6String7compareEPKc(const String*, const char*);
-int APS5_VABI _ZNK3sce4Json6String7compareERKS1_(const String*, const String*);
-std::size_t APS5_VABI _ZNK3sce4Json6String4sizeEv(const String*);
-std::size_t APS5_VABI _ZNK3sce4Json6String8capacityEv(const String*);
-bool APS5_VABI _ZNK3sce4Json6StringeqEPKc(const String*, const char*);
-bool APS5_VABI _ZNK3sce4Json6StringeqERKS1_(const String*, const String*);
+
 extern std::size_t _ZN3sce4Json6String4nposE;
-void APS5_VABI _ZN3sce4Json6String5clearEv(String*);
-void APS5_VABI _ZN3sce4Json6String6resizeEm(String*, std::size_t);
-void APS5_VABI _ZN3sce4Json6String7reserveEm(String*, std::size_t);
-String* APS5_VABI _ZN3sce4Json6String6appendERKS1_(String*, const String*);
-String* APS5_VABI _ZN3sce4Json6String6appendEPKc(String*, const char*);
-String* APS5_VABI _ZN3sce4Json6String6appendEPKcm(String*, const char*, std::size_t);
-String* APS5_VABI _ZN3sce4Json6StringpLEPKc(String*, const char*);
-String* APS5_VABI _ZN3sce4Json6StringpLEh(String*, unsigned char);
-String* APS5_VABI _ZNK3sce4Json6String6substrEmm(String*, const String*, std::size_t, std::size_t);
-std::size_t APS5_VABI _ZNK3sce4Json6String4findEcm(const String*, char, std::size_t);
-std::size_t APS5_VABI _ZNK3sce4Json6String5rfindEcm(const String*, char, std::size_t);
-bool APS5_VABI _ZNK3sce4Json6Object8iteratorneERKS2_(const Iterator*, const Iterator*);
-bool APS5_VABI _ZNK3sce4Json6Object8iteratoreqERKS2_(const Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json5ValueC1Ev(Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1Eb(Value*, bool);
-void APS5_VABI _ZN3sce4Json5ValueC1Ed(Value*, double);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(Value*, const Object*);
-void APS5_VABI _ZN3sce4Json5ValueD1Ev(Value*);
-void APS5_VABI _ZN3sce4Json5Value5clearEv(Value*);
-int APS5_VABI _ZN3sce4Json5Value3setEl(Value*, std::int64_t);
-int APS5_VABI _ZN3sce4Json5Value3setEm(Value*, std::uint64_t);
-int APS5_VABI _ZN3sce4Json5Value3setEPKc(Value*, const char*);
-std::int32_t APS5_VABI _ZNK3sce4Json5Value7getTypeEv(const Value*);
-const bool* APS5_VABI _ZNK3sce4Json5Value10getBooleanEv(const Value*);
-const std::int64_t* APS5_VABI _ZNK3sce4Json5Value10getIntegerEv(const Value*);
-const std::uint64_t* APS5_VABI _ZNK3sce4Json5Value11getUIntegerEv(const Value*);
-const double* APS5_VABI _ZNK3sce4Json5Value7getRealEv(const Value*);
-const String* APS5_VABI _ZNK3sce4Json5Value9getStringEv(const Value*);
-const Array* APS5_VABI _ZNK3sce4Json5Value8getArrayEv(const Value*);
-std::size_t APS5_VABI _ZNK3sce4Json5Value5countEv(const Value*);
-const Value* APS5_VABI _ZNK3sce4Json5ValueixEPKc(const Value*, const char*);
-Value* APS5_VABI _ZN3sce4Json5Value10referValueERKNS0_6StringE(Value*, const String*);
-const Value* APS5_VABI _ZNK3sce4Json5ValueixEm(const Value*, std::size_t);
-int APS5_VABI _ZN3sce4Json5Value9serializeERNS0_6StringE(Value*, String*);
-int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(Value*, const char*, std::size_t);
-int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(Value*, int (APS5_VABI*)(char&, void*), void*);
-bool APS5_VABI _ZNK3sce4Json6Object5emptyEv(const Object*);
-std::size_t APS5_VABI _ZNK3sce4Json6Object4sizeEv(const Object*);
-const Object* APS5_VABI _ZNK3sce4Json5Value9getObjectEv(const Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(Value*, std::int32_t);
-const Value* APS5_VABI _ZNK3sce4Json5Value8getValueEm(const Value*, std::size_t);
-const Value* APS5_VABI _ZNK3sce4Json5Value8getValueERKNS0_6StringE(const Value*, const String*);
-Value* APS5_VABI _ZN3sce4Json5Value10referValueEm(Value*, std::size_t);
-void APS5_VABI _ZN3sce4Json14InitParameter2C1Ev(void*);
-void APS5_VABI _ZN3sce4Json14InitParameter2C2Ev(void*);
-void APS5_VABI _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(void*, void*, void*);
-void APS5_VABI _ZN3sce4Json14InitParameter217setFileBufferSizeEm(void*, std::size_t);
-int APS5_VABI _ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(void*, const void*);
-void APS5_VABI _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(void*, void*, void*);
-void APS5_VABI _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(void*, std::int32_t);
-void APS5_VABI _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(void*, void*, void*, std::size_t);
-void APS5_VABI _ZN3sce4Json6Object4PairC1Ev(Pair*);
-void APS5_VABI _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(Pair*, const String*, const Value*);
-void APS5_VABI _ZN3sce4Json6Object4PairD1Ev(Pair*);
-Iterator* APS5_VABI _ZN3sce4Json6Object6insertERKNS1_4PairE(Iterator*, Object*, const Pair*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorC1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iteratoraSERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iteratorppEi(Iterator*, Iterator*, int);
-void APS5_VABI _ZN3sce4Json5Array8iteratorC1Ev(Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iteratoraSERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iteratorppEi(Iterator*, Iterator*, int);
-void APS5_VABI _ZN3sce4Json12MemAllocator11notifyErrorEimPv(void*, int, std::size_t, void*);
-bool APS5_VABI _ZNK3sce4Json5ValuecvbEv(const Value*);
-void APS5_VABI _ZN3sce4Json5Value4swapERS1_(Value*, Value*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorC1ERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json5Array8iterator7advanceEm(Iterator*, std::size_t);
-void APS5_VABI _ZN3sce4Json6Object8iteratorC1ERKS2_(Iterator*, const Iterator*);
-Iterator* APS5_VABI _ZN3sce4Json6Object8iterator7advanceEm(Iterator*, std::size_t);
-void APS5_VABI _ZN3sce4Json6Object5eraseERKNS0_6StringE(Object*, const String*);
+
 }
 
 static void Check(bool value, int line) {
@@ -157,7 +31,6 @@ static void Check(bool value, int line) {
 }
 #define Require(value) Check((value), __LINE__)
 
-enum : std::int32_t { TypeNull, TypeBoolean, TypeInteger, TypeUInteger, TypeReal, TypeString, TypeArray, TypeObject };
 constexpr int JsonErrorParse = static_cast<int>(0x80848101);
 
 static Value fallback{};
@@ -166,7 +39,7 @@ static std::int32_t lastRequested = -1;
 static const Value* lastParent = nullptr;
 static void* lastContext = nullptr;
 
-static const Value& APS5_VABI OnNullAccess(std::int32_t requested, const Value* parent, void* context) {
+static const Value& APS5_VABI OnNullAccess(ValueType requested, const Value* parent, void* context) {
     ++callbackCalls;
     lastRequested = requested;
     lastParent = parent;
@@ -177,9 +50,11 @@ static const Value& APS5_VABI OnNullAccess(std::int32_t requested, const Value*
 static std::string Serialize(Value& value) {
     String out{};
     _ZN3sce4Json6StringC1Ev(&out);
+
     Require(_ZN3sce4Json5Value9serializeERNS0_6StringE(&value, &out) == 0);
     std::string text(_ZNK3sce4Json6String5c_strEv(&out), _ZNK3sce4Json6String6lengthEv(&out));
     _ZN3sce4Json6StringD1Ev(&out);
+
     return text;
 }
 
@@ -193,6 +68,7 @@ static void ParseAndRoundTrip() {
         " \"pi\": 1.5, \"ok\": true, \"none\": null, \"list\": [1, \"two\", [3]] }";
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text.c_str(), text.size()) == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&root) == TypeObject);
     Require(_ZNK3sce4Json5Value5countEv(&root) == 8);
@@ -211,6 +87,7 @@ static void ParseAndRoundTrip() {
     String absent{};
     _ZN3sce4Json6StringC1EPKc(&present, "ok");
     _ZN3sce4Json6StringC1EPKc(&absent, "applyToAll");
+
     Require(_ZN3sce4Json5Value10referValueERKNS0_6StringE(&root, &present) == &Member(root, "ok"));
     Require(_ZN3sce4Json5Value10referValueERKNS0_6StringE(&root, &absent) == nullptr);
     Require(_ZNK3sce4Json5Value5countEv(&root) == 8);
@@ -221,13 +98,15 @@ static void ParseAndRoundTrip() {
     const Array* array = _ZNK3sce4Json5Value8getArrayEv(&list);
     Require(_ZNK3sce4Json5Array4sizeEv(array) == 3);
     std::vector<std::int32_t> types;
-    Iterator it{}, end{};
+    ArrayIterator it{}, end{};
     _ZNK3sce4Json5Array5beginEv(&it, array);
     _ZNK3sce4Json5Array3endEv(&end, array);
+
     for (; _ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end); _ZN3sce4Json5Array8iteratorppEv(&it))
         types.push_back(_ZNK3sce4Json5Value7getTypeEv(_ZNK3sce4Json5Array8iteratordeEv(&it)));
     _ZN3sce4Json5Array8iteratorD1Ev(&it);
     _ZN3sce4Json5Array8iteratorD1Ev(&end);
+
     Require((types == std::vector<std::int32_t>{TypeUInteger, TypeString, TypeArray}));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5ValueixEm(_ZNK3sce4Json5ValueixEm(&list, 2), 0)) == 3);
 
@@ -236,6 +115,7 @@ static void ParseAndRoundTrip() {
                           "\"name\":\"x\xc3\xa9\\n\",\"neg\":-5,\"none\":null,\"ok\":true,\"pi\":1.5}");
     Value reparsed{};
     _ZN3sce4Json5ValueC1Ev(&reparsed);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&reparsed, serialized.c_str(), serialized.size()) == 0);
     Require(Serialize(reparsed) == serialized);
     _ZN3sce4Json5ValueD1Ev(&reparsed);
@@ -248,6 +128,7 @@ static void ParseAndRoundTrip() {
     bool nullTextRejected = false;
     try {
         _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, nullptr, 10);
+
     } catch (const std::invalid_argument&) {
         nullTextRejected = true;
     }
@@ -258,6 +139,7 @@ static void ParseAndRoundTrip() {
         bool unverified = false;
         try {
             _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, overflow, std::strlen(overflow));
+
         } catch (const std::runtime_error& error) {
             unverified = std::string(error.what()).find("unverified") != std::string::npos;
         }
@@ -265,6 +147,7 @@ static void ParseAndRoundTrip() {
         Require(_ZNK3sce4Json5Value7getTypeEv(&root) == TypeObject && _ZNK3sce4Json5Value5countEv(&root) == 8);
     }
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static std::string Nested(std::size_t depth, bool objects) {
@@ -278,6 +161,7 @@ static std::string Nested(std::size_t depth, bool objects) {
 static void NestingDepth() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     for (const bool objects : {false, true}) {
         const std::string accepted = Nested(512, objects);
         Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, accepted.c_str(), accepted.size()) == 0);
@@ -287,14 +171,47 @@ static void NestingDepth() {
         }
     }
     _ZN3sce4Json5ValueD1Ev(&root);
+
+}
+
+static void ArrayAssignment() {
+    Array source{}, target{};
+    _ZN3sce4Json5ArrayC1Ev(&source);
+    _ZN3sce4Json5ArrayC1Ev(&target);
+
+    Value flag{}, real{};
+    _ZN3sce4Json5ValueC1Eb(&flag, true);
+    _ZN3sce4Json5ValueC1Ed(&real, 1.5);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&source, &flag);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&source, &real);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&source, &flag);
+    _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&target, &real);
+
+    Require(_ZN3sce4Json5ArrayaSERKS1_(&target, &source) == &target);
+    Require(_ZNK3sce4Json5Array4sizeEv(&target) == 3);
+    Require(_ZNK3sce4Json5Array4sizeEv(&source) == 3);
+    _ZN3sce4Json5Array5clearEv(&source);
+
+    Require(_ZNK3sce4Json5Array4sizeEv(&target) == 3);
+    Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array5frontEv(&target)));
+    Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array4backEv(&target)));
+    Require(_ZN3sce4Json5ArrayaSERKS1_(&target, &target) == &target);
+    Require(_ZNK3sce4Json5Array4sizeEv(&target) == 3);
+    _ZN3sce4Json5ValueD1Ev(&flag);
+    _ZN3sce4Json5ValueD1Ev(&real);
+    _ZN3sce4Json5ArrayD1Ev(&source);
+    _ZN3sce4Json5ArrayD1Ev(&target);
+
 }
 
 static void ObjectsAndArrays() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String alpha{}, beta{};
     _ZN3sce4Json6StringC1EPKc(&alpha, "alpha");
     _ZN3sce4Json6StringC1EPKc(&beta, "beta");
+
     Require(_ZNK3sce4Json6Object5emptyEv(&object));
     Value* first = _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &alpha);
     Require(!_ZNK3sce4Json6Object5emptyEv(&object));
@@ -304,9 +221,10 @@ static void ObjectsAndArrays() {
     Require(_ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &alpha) == first);
 
     std::vector<std::string> keys;
-    Iterator it{}, end{};
+    ObjectIterator it{}, end{};
     _ZNK3sce4Json6Object5beginEv(&it, &object);
     _ZNK3sce4Json6Object3endEv(&end, &object);
+
     for (; _ZNK3sce4Json6Object8iteratorneERKS2_(&it, &end); _ZN3sce4Json6Object8iteratorppEv(&it)) {
         const Pair* pair = _ZNK3sce4Json6Object8iteratordeEv(&it);
         keys.emplace_back(_ZNK3sce4Json6String5c_strEv(&pair->key));
@@ -314,10 +232,12 @@ static void ObjectsAndArrays() {
     }
     _ZN3sce4Json6Object8iteratorD1Ev(&it);
     _ZN3sce4Json6Object8iteratorD1Ev(&end);
+
     Require((keys == std::vector<std::string>{"alpha", "beta"}));
 
     Value wrapped{};
     _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(&wrapped, &object);
+
     Require(Serialize(wrapped) == "{\"alpha\":1,\"beta\":\"b\"}");
     _ZN3sce4Json5ValueD1Ev(&wrapped);
     _ZN3sce4Json6StringD1Ev(&alpha);
@@ -326,6 +246,7 @@ static void ObjectsAndArrays() {
 
     Array array{};
     _ZN3sce4Json5ArrayC1Ev(&array);
+
     Value flag{}, real{};
     _ZN3sce4Json5ValueC1Eb(&flag, true);
     _ZN3sce4Json5ValueC1Ed(&real, 2.5);
@@ -333,23 +254,29 @@ static void ObjectsAndArrays() {
     _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&array, &real);
     _ZN3sce4Json5ValueD1Ev(&flag);
     _ZN3sce4Json5ValueD1Ev(&real);
+
     Require(_ZNK3sce4Json5Array4sizeEv(&array) == 2);
     Require(*_ZNK3sce4Json5Value7getRealEv(_ZNK3sce4Json5Array4backEv(&array)) == 2.5);
+    ArrayIterator arrayIt{}, arrayEnd{};
     int visited = 0;
-    _ZNK3sce4Json5Array5beginEv(&it, &array);
-    _ZNK3sce4Json5Array3endEv(&end, &array);
-    for (; _ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end); _ZN3sce4Json5Array8iteratorppEv(&it)) ++visited;
+    _ZNK3sce4Json5Array5beginEv(&arrayIt, &array);
+    _ZNK3sce4Json5Array3endEv(&arrayEnd, &array);
+
+    for (; _ZNK3sce4Json5Array8iteratorneERKS2_(&arrayIt, &arrayEnd); _ZN3sce4Json5Array8iteratorppEv(&arrayIt)) ++visited;
     Require(visited == 2);
     Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array5frontEv(&array)));
-    _ZNK3sce4Json5Array5beginEv(&it, &array);
-    Require(_ZNK3sce4Json5Array8iteratorptEv(&it) == _ZNK3sce4Json5Array8iteratordeEv(&it));
+    _ZNK3sce4Json5Array5beginEv(&arrayIt, &array);
+
+    Require(_ZNK3sce4Json5Array8iteratorptEv(&arrayIt) == _ZNK3sce4Json5Array8iteratordeEv(&arrayIt));
     Array copy{};
     _ZN3sce4Json5ArrayC1ERKS1_(&copy, &array);
     _ZN3sce4Json5Array5clearEv(&array);
+
     Require(_ZNK3sce4Json5Array4sizeEv(&array) == 0);
     bool threw = false;
     try {
         _ZNK3sce4Json5Array5frontEv(&array);
+
     } catch (const std::out_of_range&) {
         threw = true;
     }
@@ -357,20 +284,39 @@ static void ObjectsAndArrays() {
     Require(_ZNK3sce4Json5Array4sizeEv(&copy) == 2);
     Require(*_ZNK3sce4Json5Value10getBooleanEv(_ZNK3sce4Json5Array5frontEv(&copy)));
     Require(*_ZNK3sce4Json5Value7getRealEv(_ZNK3sce4Json5Array4backEv(&copy)) == 2.5);
+    _ZN3sce4Json5Array9pop_frontEv(&copy);
+
+    Require(_ZNK3sce4Json5Array4sizeEv(&copy) == 1);
+    Require(*_ZNK3sce4Json5Value7getRealEv(_ZNK3sce4Json5Array5frontEv(&copy)) == 2.5);
+    _ZN3sce4Json5Array9pop_frontEv(&copy);
+
+    Require(_ZNK3sce4Json5Array5emptyEv(&copy));
+    threw = false;
+    try {
+        _ZN3sce4Json5Array9pop_frontEv(&copy);
+
+    } catch (const std::out_of_range&) {
+        threw = true;
+    }
+    Require(threw && _ZNK3sce4Json5Array5emptyEv(&copy));
     _ZN3sce4Json5ArrayD1Ev(&copy);
     _ZN3sce4Json5ArrayD1Ev(&array);
+
 }
 
 static void ObjectPair() {
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "answer");
+
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     Require(_ZN3sce4Json5Value3setEPKc(&value, "forty-two") == 0);
 
     Pair pair{};
     std::memset(&pair, 0x5a, sizeof(pair));
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&pair, &key, &value);
+
     Require(pair.reserved == 0);
     Require(pair.key.text != key.text && pair.value.node != value.node);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&pair.key), "answer") == 0);
@@ -380,38 +326,46 @@ static void ObjectPair() {
     Require(_ZN3sce4Json5Value3setEl(&value, 7) == 0);
     _ZN3sce4Json6StringD1Ev(&key);
     _ZN3sce4Json5ValueD1Ev(&value);
+
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&pair.key), "answer") == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&pair.value) == TypeString);
     _ZN3sce4Json6Object4PairD1Ev(&pair);
+
     Require(pair.key.text == nullptr && pair.value.node == nullptr);
 }
 
 static void ArrayIteratorCopies() {
     Array array{};
     _ZN3sce4Json5ArrayC1Ev(&array);
+
     for (std::int64_t i = 1; i <= 3; ++i) {
         Value item{};
         _ZN3sce4Json5ValueC1Ev(&item);
+
         Require(_ZN3sce4Json5Value3setEl(&item, i) == 0);
         _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&array, &item);
         _ZN3sce4Json5ValueD1Ev(&item);
+
     }
 
-    Iterator it{};
+    ArrayIterator it{};
     std::memset(&it, 0x5a, sizeof(it));
     _ZN3sce4Json5Array8iteratorC1Ev(&it);
-    Require(it.position != nullptr);
 
-    Iterator begin{}, end{};
+    Require(it.state != nullptr);
+
+    ArrayIterator begin{}, end{};
     _ZNK3sce4Json5Array5beginEv(&begin, &array);
     _ZNK3sce4Json5Array3endEv(&end, &array);
+
     Require(_ZN3sce4Json5Array8iteratoraSERKS2_(&it, &begin) == &it);
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &begin));
 
     std::vector<std::int64_t> seen;
-    Iterator previous{};
+    ArrayIterator previous{};
     while (_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end)) {
         _ZN3sce4Json5Array8iteratorD1Ev(&previous);
+
         Require(_ZN3sce4Json5Array8iteratorppEi(&previous, &it, 0) == &previous);
         seen.push_back(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&previous)));
         Require(_ZNK3sce4Json5Array8iteratorneERKS2_(&previous, &it));
@@ -420,9 +374,9 @@ static void ArrayIteratorCopies() {
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &end));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&previous)) == 3);
     Require(_ZN3sce4Json5Array8iteratoraSERKS2_(&it, &end) == &it);
-    Require(it.position == nullptr);
+    Require(it.state == nullptr);
     Require(_ZN3sce4Json5Array8iteratoraSERKS2_(&it, &begin) == &it);
-    Require(it.position == nullptr);
+    Require(it.state == nullptr);
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&it, &begin));
 
     _ZN3sce4Json5Array8iteratorD1Ev(&previous);
@@ -436,19 +390,23 @@ static void AllocatorNotifyError() {
     int allocator = 0x1234;
     int userData = 0x5678;
     _ZN3sce4Json12MemAllocator11notifyErrorEimPv(&allocator, -1, 64, &userData);
+
     Require(allocator == 0x1234 && userData == 0x5678);
 }
 
 static void ObjectFind() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String alpha{}, beta{}, gamma{};
     _ZN3sce4Json6StringC1EPKc(&alpha, "alpha");
     _ZN3sce4Json6StringC1EPKc(&beta, "beta");
     _ZN3sce4Json6StringC1EPKc(&gamma, "gamma");
-    Iterator found{}, end{};
+
+    ObjectIterator found{}, end{};
     _ZNK3sce4Json6Object3endEv(&end, &object);
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &alpha);
+
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
     _ZN3sce4Json6Object8iteratorD1Ev(&end);
@@ -458,7 +416,8 @@ static void ObjectFind() {
     Require(_ZN3sce4Json5Value3setEPKc(second, "b") == 0);
     _ZNK3sce4Json6Object3endEv(&end, &object);
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
-    Iterator* returned = _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &beta);
+
+    ObjectIterator* returned = _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &beta);
     Require(returned == &found);
     Require(_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     const Pair* pair = _ZNK3sce4Json6Object8iteratorptEv(&found);
@@ -466,9 +425,11 @@ static void ObjectFind() {
     Require(&pair->value == second);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&pair->key), "beta") == 0);
     _ZN3sce4Json6Object8iteratorppEv(&found);
+
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&found, &object, &gamma);
+
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&found, &end));
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
     _ZN3sce4Json6Object8iteratorD1Ev(&found);
@@ -489,49 +450,56 @@ static void ObjectFind() {
     _ZN3sce4Json6StringD1Ev(&beta);
     _ZN3sce4Json6StringD1Ev(&gamma);
     _ZN3sce4Json6ObjectD1Ev(&object);
+
 }
 
 static void ObjectIteratorCopies() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String key1{}, key2{};
     _ZN3sce4Json6StringC1EPKc(&key1, "one");
     _ZN3sce4Json6StringC1EPKc(&key2, "two");
+
     Value val1{}, val2{};
     _ZN3sce4Json5ValueC1Ev(&val1);
     _ZN3sce4Json5ValueC1Ev(&val2);
+
     Require(_ZN3sce4Json5Value3setEl(&val1, 10) == 0);
     Require(_ZN3sce4Json5Value3setEl(&val2, 20) == 0);
     Pair p1{}, p2{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p1, &key1, &val1);
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p2, &key2, &val2);
-    Iterator ins1{}, ins2{};
+
+    ObjectIterator ins1{}, ins2{};
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&ins1, &object, &p1) == &ins1);
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&ins2, &object, &p2) == &ins2);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins1);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins2);
 
-    Iterator it{};
+    ObjectIterator it{};
     std::memset(&it, 0x5a, sizeof(it));
     _ZN3sce4Json6Object8iteratorC1Ev(&it);
-    Require(it.position != nullptr);
+
+    Require(it.state != nullptr);
     _ZN3sce4Json6Object8iteratorD1Ev(&it);
 
-    Iterator begin{}, end{};
+    ObjectIterator begin{}, end{};
     _ZNK3sce4Json6Object5beginEv(&begin, &object);
     _ZNK3sce4Json6Object3endEv(&end, &object);
 
     Require(!_ZNK3sce4Json6Object8iteratoreqERKS2_(&begin, &end));
     Require(_ZNK3sce4Json6Object8iteratorneERKS2_(&begin, &end));
 
-    Iterator post{};
+    ObjectIterator post{};
     Require(_ZN3sce4Json6Object8iteratorppEi(&post, &begin, 0) == &post);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&post)->key), "one") == 0);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&begin)->key), "two") == 0);
     _ZN3sce4Json6Object8iteratorD1Ev(&post);
 
-    Iterator assigned{};
+    ObjectIterator assigned{};
     _ZN3sce4Json6Object8iteratorC1Ev(&assigned);
+
     Require(_ZN3sce4Json6Object8iteratoraSERKS2_(&assigned, &begin) == &assigned);
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&assigned, &begin));
     Require(!_ZNK3sce4Json6Object8iteratorneERKS2_(&assigned, &begin));
@@ -552,16 +520,20 @@ static void ObjectIteratorCopies() {
 static void ObjectInsert() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "score");
+
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     Require(_ZN3sce4Json5Value3setEl(&value, 100) == 0);
     Pair pair{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&pair, &key, &value);
 
-    Iterator inserted{}, end{};
+    ObjectIterator inserted{}, end{};
     _ZNK3sce4Json6Object3endEv(&end, &object);
+
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&inserted, &object, &pair) == &inserted);
     Require(_ZNK3sce4Json6Object8iteratorneERKS2_(&inserted, &end));
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 1);
@@ -570,7 +542,7 @@ static void ObjectInsert() {
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&p->value) == 100);
 
     Require(_ZN3sce4Json5Value3setEl(&pair.value, 200) == 0);
-    Iterator duplicate{};
+    ObjectIterator duplicate{};
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&duplicate, &object, &pair) == &duplicate);
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&duplicate, &inserted));
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 1);
@@ -579,16 +551,20 @@ static void ObjectInsert() {
 
     String otherKey{};
     _ZN3sce4Json6StringC1EPKc(&otherKey, "other");
+
     Value otherValue{};
     _ZN3sce4Json5ValueC1Ev(&otherValue);
+
     Require(_ZN3sce4Json5Value3setEPKc(&otherValue, "str") == 0);
     Pair otherPair{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&otherPair, &otherKey, &otherValue);
-    Iterator otherInserted{};
+
+    ObjectIterator otherInserted{};
     Require(_ZN3sce4Json6Object6insertERKNS1_4PairE(&otherInserted, &object, &otherPair) == &otherInserted);
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
-    Iterator first{};
+    ObjectIterator first{};
     _ZNK3sce4Json6Object5beginEv(&first, &object);
+
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&first, &otherInserted));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&_ZNK3sce4Json6Object8iteratordeEv(&inserted)->value) == 100);
     _ZN3sce4Json6Object8iteratorD1Ev(&first);
@@ -608,43 +584,56 @@ static void ObjectInsert() {
 static void ObjectKeyOrder() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     for (const char* name : {"z", "\xc3\xa9", "a", "A", ""}) {
         String key{};
         _ZN3sce4Json6StringC1EPKc(&key, name);
         _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &key);
         _ZN3sce4Json6StringD1Ev(&key);
+
     }
-    Iterator member{};
+    ObjectIterator member{};
     _ZNK3sce4Json6Object5beginEv(&member, &object);
+
     for (const char* expected : {"", "A", "a", "z", "\xc3\xa9"}) {
         Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&member)->key), expected) == 0);
         _ZN3sce4Json6Object8iteratorppEv(&member);
+
     }
     _ZN3sce4Json6Object8iteratorD1Ev(&member);
+
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "a");
+
     Value* existing = _ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &key);
     _ZN3sce4Json6String6appendEPKcm(&key, "\0suffix", 7);
+
     Require(_ZN3sce4Json6ObjectixERKNS0_6StringE(&object, &key) == existing);
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&member, &object, &key);
+
     Require(&_ZNK3sce4Json6Object8iteratordeEv(&member)->value == existing);
     _ZN3sce4Json6Object8iteratorD1Ev(&member);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 5);
     _ZN3sce4Json6Object5eraseERKNS0_6StringE(&object, &key);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 4);
     _ZN3sce4Json6StringD1Ev(&key);
     _ZN3sce4Json6ObjectD1Ev(&object);
+
 }
 
 static void ParseDuplicateKeys() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     for (const char* text : {R"({"a":1,"a":2})", R"({"a":[1,2],"a":2})", R"({"a":{"old":true},"a":2})", R"({"a":1,"a\u0000suffix":2})"}) {
         Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, std::strlen(text)) == 0);
         Require(_ZNK3sce4Json5Value5countEv(&root) == 1);
         Require(Serialize(root) == R"({"a":2})");
     }
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static void StringComparison() {
@@ -652,6 +641,7 @@ static void StringComparison() {
     _ZN3sce4Json6StringC1EPKc(&left, "a");
     _ZN3sce4Json6StringC1EPKc(&right, "a");
     _ZN3sce4Json6String6appendEPKcm(&left, "\0suffix", 7);
+
     Require(_ZNK3sce4Json6StringeqERKS1_(&left, &right));
     Require(_ZNK3sce4Json6StringeqEPKc(&left, "a"));
     Require(_ZNK3sce4Json6String7compareERKS1_(&left, &right) == 0);
@@ -661,6 +651,7 @@ static void StringComparison() {
     Require(_ZNK3sce4Json6String7compareEPKc(&left, "\xff") == -158);
     _ZN3sce4Json6StringD1Ev(&right);
     _ZN3sce4Json6StringD1Ev(&left);
+
 }
 
 static void StringMethods() {
@@ -670,21 +661,65 @@ static void StringMethods() {
     String suffix{};
     _ZN3sce4Json6StringC1EPKc(&base, "a/b/c");
     _ZN3sce4Json6StringC1EPKc(&suffix, "-tail");
+
     Require(_ZNK3sce4Json6String4findEcm(&base, '/', 0) == 1);
     Require(_ZNK3sce4Json6String4findEcm(&base, '/', 2) == 3);
     Require(_ZNK3sce4Json6String4findEcm(&base, 'z', 0) == _ZN3sce4Json6String4nposE);
     Require(_ZNK3sce4Json6String5rfindEcm(&base, '/', _ZN3sce4Json6String4nposE) == 3);
     Require(_ZNK3sce4Json6String5rfindEcm(&base, '/', 2) == 1);
+    const std::size_t npos = _ZN3sce4Json6String4nposE;
+    Require(_ZNK3sce4Json6String2atEm(&base, 0) == 'a');
+    Require(_ZNK3sce4Json6String2atEm(&base, 4) == 'c');
+    bool atRefused = false;
+    try {
+        _ZNK3sce4Json6String2atEm(&base, 5);
+
+    } catch (const std::out_of_range&) {
+        atRefused = true;
+    }
+    Require(atRefused);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "/b", 0) == 1);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "/", 2) == 3);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "", 5) == 5);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "", 6) == npos);
+    Require(_ZNK3sce4Json6String4findEPKcm(&base, "b/d", 0) == npos);
+    Require(_ZNK3sce4Json6String4findEPKcmm(&base, "b/d", 0, 2) == 2);
+    Require(_ZNK3sce4Json6String4findEPKcmm(&base, nullptr, 3, 0) == 3);
+    Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "/", npos) == 3);
+    Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "/", 2) == 1);
+    Require(_ZNK3sce4Json6String5rfindEPKcm(&base, "", npos) == 5);
+    Require(_ZNK3sce4Json6String5rfindEPKcmm(&base, "a/x", npos, 2) == 0);
+    Require(_ZNK3sce4Json6String5rfindEPKcmm(&base, "zz", npos, 2) == npos);
+    String needle{};
+    _ZN3sce4Json6StringC1EPKc(&needle, "/c");
+
+    Require(_ZNK3sce4Json6String4findERKS1_m(&base, &needle, 0) == 3);
+    Require(_ZNK3sce4Json6String4findERKS1_m(&base, &needle, 4) == npos);
+    Require(_ZNK3sce4Json6String5rfindERKS1_m(&base, &needle, npos) == 3);
+    Require(_ZNK3sce4Json6String5rfindERKS1_m(&base, &needle, 2) == npos);
+    _ZN3sce4Json6StringD1Ev(&needle);
+
+    bool findRefused = false;
+    try {
+        _ZNK3sce4Json6String4findEPKcm(&base, nullptr, 0);
+
+    } catch (const std::invalid_argument&) {
+        findRefused = true;
+    }
+    Require(findRefused);
     String part{};
     Require(_ZNK3sce4Json6String6substrEmm(&part, &base, 2, 3) == &part);
     Require(text(part) == "b/c");
     _ZN3sce4Json6StringD1Ev(&part);
+
     Require(_ZNK3sce4Json6String6substrEmm(&part, &base, 5, _ZN3sce4Json6String4nposE) == &part);
     Require(text(part).empty());
     _ZN3sce4Json6StringD1Ev(&part);
+
     bool refused = false;
     try {
         _ZNK3sce4Json6String6substrEmm(&part, &base, 6, 1);
+
     } catch (const std::out_of_range&) {
         refused = true;
     }
@@ -693,10 +728,12 @@ static void StringMethods() {
     Require(_ZNK3sce4Json6String6lengthEv(&base) == 5);
     String match{};
     _ZN3sce4Json6StringC1EPKc(&match, "a/b/c");
+
     Require(_ZNK3sce4Json6StringeqERKS1_(&base, &match));
     Require(_ZNK3sce4Json6String7compareERKS1_(&base, &match) == 0);
     _ZN3sce4Json6StringD1Ev(&match);
     _ZN3sce4Json6String7reserveEm(&base, 64);
+
     Require(_ZNK3sce4Json6String8capacityEv(&base) >= 64);
     Require(_ZN3sce4Json6String6appendERKS1_(&base, &suffix) == &base);
     Require(_ZN3sce4Json6String6appendEPKc(&base, "!") == &base);
@@ -705,73 +742,91 @@ static void StringMethods() {
     Require(_ZN3sce4Json6StringpLEh(&base, '?') == &base);
     Require(text(base) == "a/b/c-tail!12+?");
     _ZN3sce4Json6String6resizeEm(&base, 5);
+
     Require(_ZNK3sce4Json6String4sizeEv(&base) == 5);
     Require(text(base) == "a/b/c");
     _ZN3sce4Json6String6appendERKS1_(&base, &base);
+
     Require(text(base) == "a/b/ca/b/c");
     _ZN3sce4Json6String5clearEv(&base);
+
     Require(text(base).empty());
     _ZN3sce4Json6StringD1Ev(&suffix);
     _ZN3sce4Json6StringD1Ev(&base);
+
 }
 
 static void ValueSwap() {
     Value v1{}, v2{};
     _ZN3sce4Json5ValueC1Ev(&v1);
     _ZN3sce4Json5ValueC1Ev(&v2);
+
     Require(_ZN3sce4Json5Value3setEl(&v1, 123) == 0);
     Require(_ZN3sce4Json5Value3setEPKc(&v2, "hello") == 0);
     _ZN3sce4Json5Value4swapERS1_(&v1, &v2);
+
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&v2) == 123);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(_ZNK3sce4Json5Value9getStringEv(&v1)), "hello") == 0);
     Require(_ZN3sce4Json5Value3setEl(&v1, -456) == 0);
     const auto* firstStorage = _ZNK3sce4Json5Value10getIntegerEv(&v1);
     const auto* secondStorage = _ZNK3sce4Json5Value10getIntegerEv(&v2);
     _ZN3sce4Json5Value4swapERS1_(&v1, &v2);
+
     Require(_ZNK3sce4Json5Value10getIntegerEv(&v1) == firstStorage && *firstStorage == 123);
     Require(_ZNK3sce4Json5Value10getIntegerEv(&v2) == secondStorage && *secondStorage == -456);
     _ZN3sce4Json5Value4swapERS1_(&v1, &v1);
+
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&v1) == 123);
     _ZN3sce4Json5ValueD1Ev(&v1);
     _ZN3sce4Json5ValueD1Ev(&v2);
+
 }
 
 static void ArrayIteratorAdvance() {
     Array array{};
     _ZN3sce4Json5ArrayC1Ev(&array);
+
     for (int i = 0; i < 5; ++i) {
         Value val{};
         _ZN3sce4Json5ValueC1Ev(&val);
         _ZN3sce4Json5Value3setEl(&val, i * 10);
         _ZN3sce4Json5Array9push_backERKNS0_5ValueE(&array, &val);
         _ZN3sce4Json5ValueD1Ev(&val);
+
     }
-    Iterator begin{};
+    ArrayIterator begin{};
     _ZNK3sce4Json5Array5beginEv(&begin, &array);
-    Iterator copy{};
+
+    ArrayIterator copy{};
     _ZN3sce4Json5Array8iteratorC1ERKS2_(&copy, &begin);
+
     Require(_ZN3sce4Json5Array8iterator7advanceEm(&copy, 3) == &copy);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&copy)) == 30);
-    Iterator end{};
+    ArrayIterator end{};
     _ZNK3sce4Json5Array3endEv(&end, &array);
     _ZN3sce4Json5Array8iterator7advanceEm(&copy, std::numeric_limits<std::size_t>::max());
+
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&copy, &end));
     _ZN3sce4Json5Array8iteratorppEv(&copy);
+
     Require(!_ZNK3sce4Json5Array8iteratorneERKS2_(&copy, &end));
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Array8iteratordeEv(&begin)) == 0);
     _ZN3sce4Json5Array8iteratorD1Ev(&end);
     _ZN3sce4Json5Array8iteratorD1Ev(&begin);
     _ZN3sce4Json5Array8iteratorD1Ev(&copy);
     _ZN3sce4Json5ArrayD1Ev(&array);
+
 }
 
 static void ObjectOperations() {
     Object object{};
     _ZN3sce4Json6ObjectC1Ev(&object);
+
     String k1{}, k2{}, k3{};
     _ZN3sce4Json6StringC1EPKc(&k1, "alpha");
     _ZN3sce4Json6StringC1EPKc(&k2, "beta");
     _ZN3sce4Json6StringC1EPKc(&k3, "gamma");
+
     Value v1{}, v2{}, v3{};
     _ZN3sce4Json5ValueC1Ev(&v1);
     _ZN3sce4Json5ValueC1Ev(&v2);
@@ -779,11 +834,13 @@ static void ObjectOperations() {
     _ZN3sce4Json5Value3setEl(&v1, 1);
     _ZN3sce4Json5Value3setEl(&v2, 2);
     _ZN3sce4Json5Value3setEl(&v3, 3);
+
     Pair p1{}, p2{}, p3{};
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p1, &k1, &v1);
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p2, &k2, &v2);
     _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&p3, &k3, &v3);
-    Iterator ins{};
+
+    ObjectIterator ins{};
     _ZN3sce4Json6Object6insertERKNS1_4PairE(&ins, &object, &p3);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins);
     _ZN3sce4Json6Object6insertERKNS1_4PairE(&ins, &object, &p2);
@@ -791,16 +848,20 @@ static void ObjectOperations() {
     _ZN3sce4Json6Object6insertERKNS1_4PairE(&ins, &object, &p1);
     _ZN3sce4Json6Object8iteratorD1Ev(&ins);
 
-    Iterator begin{};
+    ObjectIterator begin{};
     _ZNK3sce4Json6Object5beginEv(&begin, &object);
-    Iterator copy{};
+
+    ObjectIterator copy{};
     _ZN3sce4Json6Object8iteratorC1ERKS2_(&copy, &begin);
+
     Require(_ZN3sce4Json6Object8iterator7advanceEm(&copy, 2) == &copy);
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&copy)->key), "gamma") == 0);
     _ZN3sce4Json6Object8iterator7advanceEm(&copy, 1);
+
     bool endRejected = false;
     try {
         _ZN3sce4Json6Object8iterator7advanceEm(&copy, 1);
+
     } catch (const std::out_of_range&) {
         endRejected = true;
     }
@@ -810,13 +871,16 @@ static void ObjectOperations() {
 
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 3);
     _ZN3sce4Json6Object5eraseERKNS0_6StringE(&object, &k2);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
     _ZN3sce4Json6Object5eraseERKNS0_6StringE(&object, &k2);
+
     Require(_ZNK3sce4Json6Object4sizeEv(&object) == 2);
 
-    Iterator findResult{}, end{};
+    ObjectIterator findResult{}, end{};
     _ZNK3sce4Json6Object4findERKNS0_6StringE(&findResult, &object, &k2);
     _ZNK3sce4Json6Object3endEv(&end, &object);
+
     Require(_ZNK3sce4Json6Object8iteratoreqERKS2_(&findResult, &end));
     _ZN3sce4Json6Object8iteratorD1Ev(&findResult);
     _ZN3sce4Json6Object8iteratorD1Ev(&end);
@@ -845,10 +909,12 @@ static void NullAccess(SetNullAccessCallback setCallback) {
     int context = 0;
     Require(setCallback(initializer, OnNullAccess, &context) == 0);
     _ZN3sce4Json5ValueC1Ev(&fallback);
+
     Require(_ZN3sce4Json5Value3setEl(&fallback, 99) == 0);
 
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"present\":\"text\"}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     Require(&Member(root, "missing") == &fallback);
@@ -865,33 +931,40 @@ static void NullAccess(SetNullAccessCallback setCallback) {
     Require(callbackCalls == 4);
     _ZN3sce4Json5ValueD1Ev(&root);
     _ZN3sce4Json5ValueD1Ev(&fallback);
+
     Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
 }
 
 static void ValueAccess() {
     for (std::int32_t type = TypeNull; type <= TypeObject; ++type) {
         Value typed{};
-        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&typed, type);
+        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&typed, static_cast<ValueType>(type));
+
         Require(_ZNK3sce4Json5Value7getTypeEv(&typed) == type);
         Require(_ZNK3sce4Json5Value5countEv(&typed) == 0);
         _ZN3sce4Json5ValueD1Ev(&typed);
+
     }
 
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"list\":[10,20,30],\"name\":\"value\",\"flag\":true}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     Require(_ZNK3sce4Json6Object4sizeEv(_ZNK3sce4Json5Value9getObjectEv(&root)) == 3);
-    Iterator member{};
+    ObjectIterator member{};
     _ZNK3sce4Json6Object5beginEv(&member, _ZNK3sce4Json5Value9getObjectEv(&root));
+
     for (const char* expected : {"flag", "list", "name"}) {
         Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&_ZNK3sce4Json6Object8iteratordeEv(&member)->key), expected) == 0);
         _ZN3sce4Json6Object8iteratorppEv(&member);
+
     }
     _ZN3sce4Json6Object8iteratorD1Ev(&member);
 
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "list");
+
     const Value* list = _ZNK3sce4Json5Value8getValueERKNS0_6StringE(&root, &key);
     Require(_ZNK3sce4Json5Value7getTypeEv(list) == TypeArray);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Value8getValueEm(list, 1)) == 20);
@@ -909,23 +982,26 @@ static void ValueAccess() {
 
     String missing{};
     _ZN3sce4Json6StringC1EPKc(&missing, "missing");
+
     Require(_ZNK3sce4Json5Value7getTypeEv(_ZNK3sce4Json5Value8getValueERKNS0_6StringE(&root, &missing)) == TypeNull);
     _ZN3sce4Json6StringD1Ev(&missing);
     _ZN3sce4Json5ValueD1Ev(&root);
 
     alignas(16) std::uint8_t parameter[40];
     std::memset(parameter, 0xff, sizeof(parameter));
-    _ZN3sce4Json14InitParameter2C1Ev(parameter);
+    _ZN3sce4Json14InitParameter2C1Ev(reinterpret_cast<SceJson2::InitParameter2*>(parameter));
+
     int allocator = 0;
     int userData = 0;
-    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(parameter, &allocator, &userData);
-    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(parameter, 4096);
+    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(reinterpret_cast<SceJson2::InitParameter2*>(parameter), &allocator, &userData);
+    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 4096);
+
     void* stored[3]{};
     std::memcpy(stored, parameter, sizeof(stored));
     Require(stored[0] == &allocator && stored[1] == &userData && reinterpret_cast<std::uintptr_t>(stored[2]) == 4096);
     alignas(16) std::uint8_t initializer[16]{};
     Require(_ZN3sce4Json11InitializerC1Ev(initializer) == 0);
-    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, parameter) == 0);
+    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, reinterpret_cast<const SceJson2::InitParameter2*>(parameter)) == 0);
     Require(_ZN3sce4Json11Initializer9terminateEv(initializer) == 0);
     Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
 }
@@ -933,11 +1009,13 @@ static void ValueAccess() {
 static void InitParameter2BaseConstructor() {
     alignas(16) std::uint8_t parameter[40];
     std::memset(parameter, 0xff, sizeof(parameter));
-    _ZN3sce4Json14InitParameter2C1Ev(parameter);
+    _ZN3sce4Json14InitParameter2C1Ev(reinterpret_cast<SceJson2::InitParameter2*>(parameter));
+
     alignas(16) std::uint8_t baseStorage[72];
     std::memset(baseStorage, 0xff, sizeof(baseStorage));
     auto* baseParameter = baseStorage + 16;
-    _ZN3sce4Json14InitParameter2C2Ev(baseParameter);
+    _ZN3sce4Json14InitParameter2C2Ev(reinterpret_cast<SceJson2::InitParameter2*>(baseParameter));
+
     Require(std::memcmp(parameter, baseParameter, sizeof(parameter)) == 0);
     void* defaultAllocator;
     void* defaultUserData;
@@ -948,8 +1026,9 @@ static void InitParameter2BaseConstructor() {
     Require(defaultAllocator == nullptr && defaultUserData == nullptr && defaultFileBufferSize == 0);
     int allocator = 0;
     int userData = 0;
-    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(baseParameter, &allocator, &userData);
-    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(baseParameter, 4096);
+    _ZN3sce4Json14InitParameter212setAllocatorEPNS0_12MemAllocatorEPv(reinterpret_cast<SceJson2::InitParameter2*>(baseParameter), &allocator, &userData);
+    _ZN3sce4Json14InitParameter217setFileBufferSizeEm(reinterpret_cast<SceJson2::InitParameter2*>(baseParameter), 4096);
+
     void* storedAllocator;
     void* storedUserData;
     std::size_t storedFileBufferSize;
@@ -962,22 +1041,15 @@ static void InitParameter2BaseConstructor() {
         Require(baseStorage[i] == 0xff);
     alignas(16) std::uint8_t initializer[16]{};
     Require(_ZN3sce4Json11InitializerC1Ev(initializer) == 0);
-    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, baseParameter) == 0);
+    Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, reinterpret_cast<const SceJson2::InitParameter2*>(baseParameter)) == 0);
     Require(_ZN3sce4Json11Initializer9terminateEv(initializer) == 0);
     Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
 }
 
-struct StoredInitParameter2 {
-    void* allocator;
-    void* userData;
-    std::size_t fileBufferSize;
-    std::int32_t specialFloatFormatType;
-    std::uint32_t reserved[3];
-};
-static_assert(sizeof(StoredInitParameter2) == 40);
+static_assert(sizeof(InitParameter2) == 40);
 
-static StoredInitParameter2 Stored(const std::uint8_t* parameter) {
-    StoredInitParameter2 stored{};
+static InitParameter2 Stored(const std::uint8_t* parameter) {
+    InitParameter2 stored{};
     std::memcpy(&stored, parameter, sizeof(stored));
     return stored;
 }
@@ -989,32 +1061,33 @@ static bool Untouched(const std::uint8_t* parameter, std::size_t from) {
 }
 
 static void InitParameters() {
-    using Constructor = void (APS5_VABI*)(void*);
+    using Constructor = decltype(&_ZN3sce4Json14InitParameter2C1Ev);
     for (Constructor construct : {_ZN3sce4Json14InitParameter2C1Ev, _ZN3sce4Json14InitParameter2C2Ev}) {
         alignas(16) std::uint8_t parameter[40];
         std::memset(parameter, 0xff, sizeof(parameter));
-        construct(parameter);
-        StoredInitParameter2 stored = Stored(parameter);
+        construct(reinterpret_cast<InitParameter2*>(parameter));
+        InitParameter2 stored = Stored(parameter);
         Require(stored.allocator == nullptr && stored.userData == nullptr && stored.fileBufferSize == 0);
         Require(stored.specialFloatFormatType == 2);
         Require(stored.reserved[0] == 0 && stored.reserved[1] == 0 && stored.reserved[2] == 0);
 
         int allocParam = 0;
         int userData = 0;
-        _ZN3sce4Json14InitParameter217setFileBufferSizeEm(parameter, 8192);
-        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(parameter, 2);
-        _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(parameter, &allocParam, &userData);
+        _ZN3sce4Json14InitParameter217setFileBufferSizeEm(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 8192);
+        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 2);
+        _ZN3sce4Json18InitParameterRtti216setAllocatorRttiEPNS0_14AllocParamRttiEPv(reinterpret_cast<SceJson2::InitParameter2*>(parameter), &allocParam, &userData);
+
         stored = Stored(parameter);
         Require(stored.allocator == &allocParam && stored.userData == &userData && stored.fileBufferSize == 8192);
         Require(stored.specialFloatFormatType == 2);
         Require(stored.reserved[0] == 0 && stored.reserved[1] == 0 && stored.reserved[2] == 0);
 
-        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(parameter, 0);
+        _ZN3sce4Json14InitParameter225setSpecialFloatFormatTypeENS0_22SpecialFloatFormatTypeE(reinterpret_cast<SceJson2::InitParameter2*>(parameter), 0);
         Require(Stored(parameter).specialFloatFormatType == 0 && Stored(parameter).fileBufferSize == 8192);
 
         alignas(16) std::uint8_t initializer[16]{};
         Require(_ZN3sce4Json11InitializerC1Ev(initializer) == 0);
-        Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, parameter) == 0);
+        Require(_ZN3sce4Json11Initializer10initializeEPKNS0_14InitParameter2E(initializer, reinterpret_cast<const SceJson2::InitParameter2*>(parameter)) == 0);
         Require(_ZN3sce4Json11Initializer9terminateEv(initializer) == 0);
         Require(_ZN3sce4Json11InitializerD1Ev(initializer) == 0);
     }
@@ -1023,7 +1096,8 @@ static void InitParameters() {
     std::memset(rttiParameter, 0xff, sizeof(rttiParameter));
     int allocParam = 0;
     int userData = 0;
-    _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(rttiParameter, &allocParam, &userData, 4096);
+    _ZN3sce4Json17InitParameterRttiC1EPNS0_14AllocParamRttiEPvm(reinterpret_cast<InitParameterRtti*>(rttiParameter), &allocParam, &userData, 4096);
+
     void* rttiStored[3]{};
     std::memcpy(rttiStored, rttiParameter, sizeof(rttiStored));
     Require(rttiStored[0] == &allocParam && rttiStored[1] == &userData && reinterpret_cast<std::uintptr_t>(rttiStored[2]) == 4096);
@@ -1033,30 +1107,38 @@ static void InitParameters() {
 static void ValueClear() {
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
 
     Require(_ZN3sce4Json5Value3setEl(&value, 12345) == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeInteger);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
 
     Require(_ZN3sce4Json5Value3setEPKc(&value, "test string") == 0);
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeString);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
 
     Object obj{};
     _ZN3sce4Json6ObjectC1Ev(&obj);
+
     String key{};
     _ZN3sce4Json6StringC1EPKc(&key, "prop");
+
     Value* item = _ZN3sce4Json6ObjectixERKNS0_6StringE(&obj, &key);
     _ZN3sce4Json5Value3setEl(item, 999);
     _ZN3sce4Json5ValueD1Ev(&value);
     _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(&value, &obj);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeObject);
     _ZN3sce4Json5Value5clearEv(&value);
+
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeNull);
     _ZN3sce4Json6StringD1Ev(&key);
     _ZN3sce4Json6ObjectD1Ev(&obj);
@@ -1090,6 +1172,7 @@ static int APS5_VABI ReadNext(char& ch, void* context) {
 static void IntegerRepresentation() {
     Value value{};
     _ZN3sce4Json5ValueC1Ev(&value);
+
     for (const char* text : {"0", "1", "9223372036854775807", "9223372036854775808", "18446744073709551615"}) {
         Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&value, text, std::strlen(text)) == 0);
         Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeUInteger);
@@ -1107,11 +1190,13 @@ static void IntegerRepresentation() {
     Require(*_ZNK3sce4Json5Value11getUIntegerEv(&value) == (std::uint64_t{1} << 63));
     Require(_ZNK3sce4Json5Value7getTypeEv(&value) == TypeInteger);
     _ZN3sce4Json5ValueD1Ev(&value);
+
 }
 
 static void StreamParse() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     ReadState valid{"{\"list\": [1, 2.5, true]}", 0, 0};
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPFiRcPvES5_(&root, ReadNext, &valid) == 0);
     Require(valid.calls == static_cast<int>(std::strlen(valid.text)));
@@ -1136,6 +1221,7 @@ static void StreamParse() {
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, "01", 2) == 0);
     Require(Serialize(root) == "1");
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static void StaticNullAccess() {
@@ -1146,10 +1232,12 @@ static void StaticNullAccess() {
     int context = 0;
     _ZN3sce4Json5Value21setNullAccessCallBackEPFRKS1_NS0_9ValueTypeEPS2_PvES6_(OnNullAccess, &context);
     _ZN3sce4Json5ValueC1Ev(&fallback);
+
     Require(_ZN3sce4Json5Value3setEl(&fallback, 99) == 0);
 
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"present\":\"text\"}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     Require(&Member(root, "missing") == &fallback);
@@ -1163,6 +1251,7 @@ static void StaticNullAccess() {
     Require(callbackCalls == 2);
     _ZN3sce4Json5ValueD1Ev(&root);
     _ZN3sce4Json5ValueD1Ev(&fallback);
+
 }
 
 static Value replacement{};
@@ -1172,7 +1261,7 @@ static const Value* mismatchValue = nullptr;
 static const Value* mismatchSecond = nullptr;
 static void* mismatchContext = nullptr;
 
-static const Value& APS5_VABI OnTypeMismatch(std::int32_t requested, const Value* value, const Value* second, void* context) {
+static const Value& APS5_VABI OnTypeMismatch(ValueType requested, const Value* value, const Value* second, void* context) {
     ++mismatchCalls;
     mismatchRequested = requested;
     mismatchValue = value;
@@ -1181,17 +1270,19 @@ static const Value& APS5_VABI OnTypeMismatch(std::int32_t requested, const Value
     return replacement;
 }
 
-static void RequireMismatch(int calls, std::int32_t requested, const Value* value, void* context) {
+static void RequireMismatch(int calls, ValueType requested, const Value* value, void* context) {
     Require(mismatchCalls == calls && mismatchRequested == requested && mismatchValue == value);
     Require(mismatchSecond == nullptr && mismatchContext == context);
 }
 
 static void ValueTypeMismatchHandler() {
     _ZN3sce4Json5ValueC1Ev(&replacement);
+
     Require(_ZN3sce4Json5Value3setEl(&replacement, 42) == 0);
     int context = 0;
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     Require(_ZN3sce4Json5Value22setTypeMismatchHandlerEPFRKS1_NS0_9ValueTypeEPS2_S5_PvES6_(&root, OnTypeMismatch, &context) == 0);
     const char text[] = "{\"name\":\"text\",\"none\":null,\"list\":[true]}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
@@ -1213,6 +1304,7 @@ static void ValueTypeMismatchHandler() {
 
     Value later{};
     _ZN3sce4Json5ValueC1Ev(&later);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&later, text, sizeof(text) - 1) == 0);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&Member(later, "name")) == 0);
     Require(mismatchCalls == 4);
@@ -1223,6 +1315,7 @@ static void ValueTypeMismatchHandler() {
 
     Value other{};
     _ZN3sce4Json5ValueC1Ev(&other);
+
     Require(_ZN3sce4Json5Value3setEPKc(&other, "other") == 0);
     Require(_ZN3sce4Json5ValueaSERKS1_(&root, &other) == &root);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&root) == 42);
@@ -1234,11 +1327,13 @@ static void ValueTypeMismatchHandler() {
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&root) == 42);
     RequireMismatch(7, TypeInteger, &root, &context);
     _ZN3sce4Json5Value5clearEv(&root);
+
     Require(_ZN3sce4Json5Value3setEPKc(&root, "cleared") == 0);
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&root) == 42);
     RequireMismatch(8, TypeInteger, &root, &context);
     Value copy{};
     _ZN3sce4Json5ValueC1ERKS1_(&copy, &root);
+
     Require(*_ZNK3sce4Json5Value10getIntegerEv(&copy) == 0);
     Require(mismatchCalls == 8);
 
@@ -1250,6 +1345,7 @@ static void ValueTypeMismatchHandler() {
     _ZN3sce4Json5ValueD1Ev(&later);
     _ZN3sce4Json5ValueD1Ev(&root);
     _ZN3sce4Json5ValueD1Ev(&replacement);
+
 }
 
 static int failureCalls = 0;
@@ -1271,6 +1367,7 @@ static bool ThrowsUnverified(const TAccess& access) {
 static void ValueElementAccessFailureHandler() {
     Value root{};
     _ZN3sce4Json5ValueC1Ev(&root);
+
     const char text[] = "{\"list\":[1],\"key\":2}";
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, text, sizeof(text) - 1) == 0);
     int context = 0;
@@ -1281,6 +1378,7 @@ static void ValueElementAccessFailureHandler() {
     Require(*_ZNK3sce4Json5Value10getIntegerEv(_ZNK3sce4Json5Value8getValueEm(&list, 0)) == 1);
     String missing{};
     _ZN3sce4Json6StringC1EPKc(&missing, "missing");
+
     Require(ThrowsUnverified([&] { _ZNK3sce4Json5ValueixEPKc(&root, "missing"); }));
     Require(ThrowsUnverified([&] { _ZNK3sce4Json5Value8getValueERKNS0_6StringE(&root, &missing); }));
     Require(ThrowsUnverified([&] { _ZNK3sce4Json5ValueixEm(&root, 0); }));
@@ -1292,6 +1390,7 @@ static void ValueElementAccessFailureHandler() {
     Require(_ZNK3sce4Json5Value7getTypeEv(_ZNK3sce4Json5Value8getValueEm(&list, 1)) == TypeNull);
     _ZN3sce4Json6StringD1Ev(&missing);
     _ZN3sce4Json5ValueD1Ev(&root);
+
 }
 
 static int specialFloatCalls = 0;
@@ -1299,49 +1398,59 @@ static int specialFloatCalls = 0;
 static Value* APS5_VABI OnSpecialFloat(Value* result, std::int32_t, double, const Value*, void*, bool*) {
     ++specialFloatCalls;
     _ZN3sce4Json5ValueC1Ev(result);
+
     return result;
 }
 
 static void ValueSpecialFloatHandler() {
     Value real{};
     _ZN3sce4Json5ValueC1Ed(&real, std::numeric_limits<double>::quiet_NaN());
+
     int context = 0;
     Require(_ZN3sce4Json5Value22setSpecialFloatHandlerEPFKS1_NS0_12FunctionTypeEdPS2_PvPbES5_(&real, OnSpecialFloat, &context) == 0);
     String out{};
     _ZN3sce4Json6StringC1Ev(&out);
+
     Require(ThrowsUnverified([&] { _ZN3sce4Json5Value9serializeERNS0_6StringE(&real, &out); }));
     Require(_ZN3sce4Json5Value3setEd(&real, std::numeric_limits<double>::infinity()) == 0);
     Require(ThrowsUnverified([&] { _ZN3sce4Json5Value9serializeERNS0_6StringE(&real, &out); }));
     _ZN3sce4Json6StringD1Ev(&out);
+
     Require(_ZN3sce4Json5Value3setEd(&real, 2.5) == 0);
     Require(Serialize(real) == "2.5");
     Require(specialFloatCalls == 0);
     _ZN3sce4Json5ValueD1Ev(&real);
+
 }
 
 static void ValueOperatorBool() {
     Value nullVal{};
     _ZN3sce4Json5ValueC1Ev(&nullVal);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&nullVal));
     _ZN3sce4Json5ValueD1Ev(&nullVal);
 
     Value typedNull{};
     _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&typedNull, TypeNull);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&typedNull));
     _ZN3sce4Json5ValueD1Ev(&typedNull);
 
     Value boolFalse{};
     _ZN3sce4Json5ValueC1Eb(&boolFalse, false);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&boolFalse));
     _ZN3sce4Json5ValueD1Ev(&boolFalse);
 
     Value boolTrue{};
     _ZN3sce4Json5ValueC1Eb(&boolTrue, true);
+
     Require(_ZNK3sce4Json5ValuecvbEv(&boolTrue));
     _ZN3sce4Json5ValueD1Ev(&boolTrue);
 
     Value scalar{};
     _ZN3sce4Json5ValueC1Ev(&scalar);
+
     for (std::int64_t value : {std::int64_t{0}, std::int64_t{1}, std::int64_t{-1}}) {
         Require(_ZN3sce4Json5Value3setEl(&scalar, value) == 0);
         Require(_ZNK3sce4Json5ValuecvbEv(&scalar) == (value != 0));
@@ -1359,25 +1468,111 @@ static void ValueOperatorBool() {
         Require(_ZNK3sce4Json5ValuecvbEv(&scalar) == (*text != 0));
     }
     _ZN3sce4Json5ValueD1Ev(&scalar);
+
     for (std::int32_t type : {TypeArray, TypeObject}) {
         Value container{};
-        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&container, type);
+        _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&container, static_cast<ValueType>(type));
+
         Require(_ZNK3sce4Json5ValuecvbEv(&container));
         _ZN3sce4Json5ValueD1Ev(&container);
+
     }
 
     Value cleared{};
     _ZN3sce4Json5ValueC1Eb(&cleared, true);
+
     Require(_ZNK3sce4Json5ValuecvbEv(&cleared));
     _ZN3sce4Json5Value5clearEv(&cleared);
+
     Require(!_ZNK3sce4Json5ValuecvbEv(&cleared));
     _ZN3sce4Json5ValueD1Ev(&cleared);
+
 }
 
-int main() {
+static int NumericLocale() {
+    const std::string previous = std::setlocale(LC_NUMERIC, nullptr);
+    const char* selected = nullptr;
+    for (const char* name : {"xx_COMMA", "de_DE.UTF-8", "de_DE.utf8", "de-DE", "German_Germany.1252", "fr_FR.UTF-8"}) {
+        if (std::setlocale(LC_NUMERIC, name) && std::strcmp(std::localeconv()->decimal_point, ",") == 0) {
+            selected = name;
+            break;
+        }
+    }
+    if (!selected) {
+        std::setlocale(LC_NUMERIC, previous.c_str());
+        std::fprintf(stderr, "No decimal-comma numeric locale is installed\n");
+        return 77;
+    }
+    std::printf("JSON numeric locale: %s\n", selected);
+    int failures = 0;
+    const auto check = [&](bool success, const char* operation, const char* actual) {
+        if (!success) {
+            std::fprintf(stderr, "%s failed: %s\n", operation, actual);
+            ++failures;
+        }
+    };
+    for (const auto number : {1.5, -0.125, 1.25e30, std::numeric_limits<double>::max(),
+                              std::numeric_limits<double>::min(), std::numeric_limits<double>::denorm_min()}) {
+        Value value{};
+        _ZN3sce4Json5ValueC1Ed(&value, number);
+
+        const auto text = Serialize(value);
+        check(text.find(',') == std::string::npos, "Decimal-point serialization", text.c_str());
+        Value parsed{};
+        _ZN3sce4Json5ValueC1Ev(&parsed);
+
+        const int result = _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&parsed, text.c_str(), text.size());
+        check(result == 0 && *_ZNK3sce4Json5Value7getRealEv(&parsed) == number, "Numeric round trip", text.c_str());
+        _ZN3sce4Json5ValueD1Ev(&parsed);
+        _ZN3sce4Json5ValueD1Ev(&value);
+
+    }
+    for (const auto [text, number] : {std::pair{"1.5", 1.5}, {"-1.25e2", -125.0},
+                                    {"4.9406564584124654e-324", std::numeric_limits<double>::denorm_min()},
+                                    {"2.4703282292062327e-324", 0.0},
+                                    {"2.4703282292062328e-324", std::numeric_limits<double>::denorm_min()},
+                                    {"18446744073709551616", 18446744073709551616.0},
+                                    {"1e-999", 0.0}, {"-1e-999", -0.0}}) {
+        Value value{};
+        _ZN3sce4Json5ValueC1Ev(&value);
+
+        const int result = _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&value, text, std::strlen(text));
+        const auto parsed = *_ZNK3sce4Json5Value7getRealEv(&value);
+        check(result == 0 && parsed == number && std::signbit(parsed) == std::signbit(number), "Decimal-point parsing", text);
+        _ZN3sce4Json5ValueD1Ev(&value);
+
+    }
+    Value root{};
+    _ZN3sce4Json5ValueC1Ev(&root);
+
+    constexpr char document[] = "{\"list\":[2.5,-0.125],\"value\":1.5}";
+    check(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, document, sizeof(document) - 1) == 0,
+          "Nested numeric parsing", document);
+    const auto serialized = Serialize(root);
+    check(serialized == document, "Nested numeric serialization", serialized.c_str());
+    check(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, "1,5", 3) == 0 && _ZNK3sce4Json5Value7getTypeEv(&root) == TypeUInteger &&
+          *_ZNK3sce4Json5Value11getUIntegerEv(&root) == 1, "Stop at a decimal comma", "1,5");
+    bool overflow = false;
+    try {
+        _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&root, "1e309", 5);
+
+    } catch (const std::runtime_error&) {
+        overflow = true;
+    }
+    check(overflow, "Retain overflow rejection", "1e309");
+    _ZN3sce4Json5ValueD1Ev(&root);
+
+    check(std::strcmp(std::localeconv()->decimal_point, ",") == 0, "Preserve host locale", selected);
+    std::setlocale(LC_NUMERIC, previous.c_str());
+    return failures ? 1 : 0;
+}
+
+int main(int argc, char** argv) {
+    if (argc == 2 && std::strcmp(argv[1], "--numeric-locale") == 0) return NumericLocale();
     ParseAndRoundTrip();
     NestingDepth();
     ObjectsAndArrays();
+    ArrayAssignment();
     ObjectFind();
     ObjectPair();
     ObjectInsert();
diff --git a/core/libs/tests/GuestJxr.cpp b/core/libs/tests/GuestJxr.cpp
new file mode 100644
index 0000000000..6c295e4822
--- /dev/null
+++ b/core/libs/tests/GuestJxr.cpp
@@ -0,0 +1,75 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceJxr/include/Api.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+void* lastFreed = nullptr;
+int frees = 0;
+
+void* APS5_VABI Allocate(std::size_t size) { return std::malloc(size); }
+void APS5_VABI Free(void* pointer) {
+    if (pointer != nullptr) {
+        lastFreed = pointer;
+        ++frees;
+    }
+    std::free(pointer);
+}
+void* APS5_VABI Reallocate(void* pointer, std::size_t size) { return std::realloc(pointer, size); }
+void* APS5_VABI Calloc(std::size_t count, std::size_t size) { return std::calloc(count, size); }
+void* APS5_VABI Align(std::size_t, std::size_t size) { return std::malloc(size); }
+void* APS5_VABI Realign(void* pointer, std::size_t size, std::size_t) { return std::realloc(pointer, size); }
+int APS5_VABI PosixAlign(void** pointer, std::size_t, std::size_t size) {
+    *pointer = std::malloc(size);
+    return *pointer ? 0 : 12;
+}
+
+void InitializeHeap() {
+    alignas(16) static std::array<std::byte, 0x40> process{};
+    alignas(16) static std::array<std::byte, 0x38> libc{};
+    alignas(16) static std::array<std::byte, 0x78> replacement{};
+    const auto write = [](auto& data, std::size_t offset, auto value) {
+        std::memcpy(data.data() + offset, &value, sizeof(value));
+    };
+    write(process, 0, std::uint64_t{0x40});
+    write(process, 8, std::uint32_t{0x4942524f});
+    write(process, 0x38, libc.data());
+    write(libc, 0, std::uint64_t{0x38});
+    write(libc, 0x30, replacement.data());
+    write(replacement, 0, std::uint64_t{0x78});
+    write(replacement, 8, std::uint64_t{2});
+    write(replacement, 0x20, reinterpret_cast<void*>(&Allocate));
+    write(replacement, 0x28, reinterpret_cast<void*>(&Free));
+    write(replacement, 0x30, reinterpret_cast<void*>(&Calloc));
+    write(replacement, 0x38, reinterpret_cast<void*>(&Reallocate));
+    write(replacement, 0x40, reinterpret_cast<void*>(&Align));
+    write(replacement, 0x48, reinterpret_cast<void*>(&Realign));
+    write(replacement, 0x50, reinterpret_cast<void*>(&PosixAlign));
+    ApplicationHeapInitialize_nid_no_patch(process.data());
+}
+
+}
+
+int main() {
+    InitializeHeap();
+    void* memory = malloc_nid_postfix(64);
+    Require(memory != nullptr);
+    void* const allocated = memory;
+    Require(PKFree_nid_postfix(&memory) == 0);
+    Require(memory == nullptr);
+    Require(frees == 1 && lastFreed == allocated);
+    Require(PKFree_nid_postfix(&memory) == 0);
+    Require(memory == nullptr);
+    Require(frees == 1);
+    Require(PKFree_nid_postfix(nullptr) == 0);
+    Require(frees == 1);
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelAppArchive.cpp b/core/libs/tests/GuestKernelAppArchive.cpp
index 2eb8aae01f..f09c256ba8 100644
--- a/core/libs/tests/GuestKernelAppArchive.cpp
+++ b/core/libs/tests/GuestKernelAppArchive.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "AppArchiveFixture.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -16,48 +19,10 @@
 #include <typeinfo>
 #include <vector>
 
-struct KernelIovec {
-    void* base;
-    std::size_t length;
-};
-
 extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-std::int64_t APS5_VABI sceKernelRead(int d, void* buf, std::size_t nbytes);
-std::int64_t APS5_VABI sceKernelWrite(int d, const void* buf, std::size_t nbytes);
-std::int64_t APS5_VABI sceKernelPread(int d, void* buf, std::size_t nbytes, std::int64_t offset);
-std::int64_t APS5_VABI sceKernelReadv(int d, const KernelIovec* iov, int iovcnt);
-std::int64_t APS5_VABI sceKernelPreadv(int d, const KernelIovec* iov, int iovcnt, std::int64_t offset);
-std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence);
-int APS5_VABI sceKernelStat(const char* path, FileStat* sb);
-int APS5_VABI sceKernelFstat(int d, FileStat* sb);
-int APS5_VABI sceKernelCheckReachability(const char* path);
-int APS5_VABI dup_nid_postfix(int d);
-int APS5_VABI dup2_nid_postfix(int from, int to);
-int APS5_VABI close_nid_postfix(int d);
-std::int64_t APS5_VABI pread_nid_postfix(int d, void* buf, std::size_t nbytes, std::int64_t offset);
-std::int64_t APS5_VABI lseek_nid_postfix(int d, std::int64_t offset, int whence);
-int APS5_VABI fcntl_nid_postfix(int d, int command, ...);
-int APS5_VABI ioctl_nid_postfix(int d, std::uint64_t request, void* argument);
-void* APS5_VABI opendir_nid_postfix(const char* path);
-void* APS5_VABI fdopen_nid_postfix(int d, const char* mode);
-int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest* req, std::int32_t size, std::int32_t prio, std::int32_t* id);
-int APS5_VABI sceKernelAioWaitRequest(std::int32_t id, std::int32_t* state, std::uint32_t* usec);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t id, std::int32_t* ret);
-int APS5_VABI flock_nid_postfix(int d, int operation);
-int APS5_VABI _fstatfs_nid_postfix(int d, void* buf);
-int APS5_VABI ftruncate_nid_postfix(int d, std::int64_t length);
-int APS5_VABI sceKernelFsync(int d);
-int APS5_VABI sceKernelFdatasync(int d);
-int APS5_VABI sceKernelGetdents(int d, char* buf, int nbytes);
-int APS5_VABI sceKernelFchmod(int d, std::uint16_t mode);
-int APS5_VABI sceKernelFutimes(int d, const void* times);
-void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-void* APS5_VABI __cxa_current_primary_exception_nid_postfix();
-std::type_info* APS5_VABI __cxa_current_exception_type_nid_postfix();
+
 using TerminateHandler = void (*)();
-TerminateHandler APS5_VABI _ZSt13set_terminatePFvvE_nid_postfix(TerminateHandler);
+
 }
 
 namespace {
@@ -146,7 +111,7 @@ void Reads() {
     KernelAioRwRequest request{65530, 20, buffer.data(), &result, fd};
     std::int32_t id = 0;
     std::int32_t state = 0;
-    Check(sceKernelAioSubmitReadCommands(&request, 1, 0, &id) == 0);
+    Check(sceKernelAioSubmitReadCommands(&request, 1, 1, &id) == 0);
     Check(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
     Check(result.return_value == 20 && std::equal(buffer.begin(), buffer.begin() + 20, expected.begin() + 65530));
     std::int32_t removed = 0;
@@ -198,7 +163,7 @@ void Refusals() {
     Check(fd >= 0);
     Check(NotImplemented([fd] { (void)fdopen_nid_postfix(fd, "r"); }));
     Check(NotImplemented([fd] { (void)flock_nid_postfix(fd, 1); }));
-    Check(NotImplemented([fd] { alignas(8) char statfs[512]; (void)_fstatfs_nid_postfix(fd, statfs); }));
+    Check(NotImplemented([fd] { alignas(8) char statfs[512]; (void)_fstatfs_nid_postfix(fd, reinterpret_cast<KernelStatfs*>(statfs)); }));
     Check(NotImplemented([fd] { (void)ftruncate_nid_postfix(fd, 0); }));
     Check(NotImplemented([fd] { (void)sceKernelFsync(fd); }));
     Check(NotImplemented([fd] { (void)sceKernelFdatasync(fd); }));
@@ -243,6 +208,7 @@ int main(int argc, char** argv) {
         const int fd = sceKernelOpen("/app0/Data/Small.txt", SCE_KERNEL_O_RDONLY, 0);
         Check(fd >= 0);
         _ZSt13set_terminatePFvvE_nid_postfix(OnMmapRefused);
+
         (void)mmap_nid_postfix(nullptr, 16384, 1, 2, fd, 0);
         return 1;
     } else if (mode == "plain") {
diff --git a/core/libs/tests/GuestKernelErrors.cpp b/core/libs/tests/GuestKernelErrors.cpp
index 1932625356..34289a629a 100644
--- a/core/libs/tests/GuestKernelErrors.cpp
+++ b/core/libs/tests/GuestKernelErrors.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libSceSaveData/SaveDataCore.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -8,55 +13,14 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI sceKernelCreateSema(KernelSema*, const char*, std::uint32_t, int, int, void*);
-int APS5_VABI sceKernelDeleteSema(KernelSema);
-int APS5_VABI sceKernelSignalSema(KernelSema, int);
-int APS5_VABI sceKernelPollSema(KernelSema, int);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelDeleteUserEvent(KernelEqueue eq, int id);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_init_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_settype_nid_postfix(PthreadMutexattr* attr, int type);
-int APS5_VABI pthread_mutexattr_destroy_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-int APS5_VABI sceKernelCreateEventFlag(KernelEventFlag* ef, const char* name, std::uint32_t attr, std::uint64_t init_pattern, const void* param);
-int APS5_VABI sceKernelDeleteEventFlag(KernelEventFlag ef);
-int APS5_VABI sceKernelOpenEventFlag(KernelEventFlag* ef, const char* name);
-int APS5_VABI sceKernelSetEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern);
-int APS5_VABI sceKernelClearEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern);
-int APS5_VABI sceKernelCancelEventFlag(KernelEventFlag ef, std::uint64_t set_pattern, int* num_wait_threads);
-int APS5_VABI sceKernelPollEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern, std::uint32_t wait_mode, std::uint64_t* result_pat);
-int APS5_VABI sceKernelWaitEventFlag(KernelEventFlag ef, std::uint64_t bit_pattern, std::uint32_t wait_mode, std::uint64_t* result_pat, KernelUseconds* timeout);
+
 int APS5_Test_GetEventFlagWaiterCount(KernelEventFlag handle);
 }
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EPERM = static_cast<int>(0x80020001);
-static constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
-static constexpr int SCE_KERNEL_ERROR_EBADF = static_cast<int>(0x80020009);
-static constexpr int SCE_KERNEL_ERROR_EDEADLK = static_cast<int>(0x8002000B);
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
-static constexpr int SCE_KERNEL_ERROR_EACCES = static_cast<int>(0x8002000D);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
-static constexpr int SCE_KERNEL_ERROR_ECANCELED = static_cast<int>(0x80020055);
 static constexpr std::uint32_t EVF_ATTR_SINGLE = 0x10;
 static constexpr std::uint32_t EVF_ATTR_MULTI = 0x20;
+static constexpr std::uint32_t EVF_ATTR_SHARED = 0x100;
 static constexpr std::uint32_t EVF_WAITMODE_AND = 0x01;
 static constexpr std::uint32_t EVF_WAITMODE_OR = 0x02;
 static constexpr std::uint32_t EVF_WAITMODE_CLEAR_ALL = 0x10;
@@ -92,9 +56,9 @@ int main() {
     Require(sceKernelCreateSema(&semaphore, "limit", 1, 1, 3, nullptr) == SCE_OK);
     Require(sceKernelSignalSema(semaphore, 3) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelSignalSema(semaphore, 2) == SCE_OK);
-    Require(sceKernelSignalSema(semaphore, 0) == SCE_OK);
+    Require(sceKernelSignalSema(semaphore, 0) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollSema(semaphore, 3) == SCE_OK);
-    Require(sceKernelSignalSema(semaphore, 0) == SCE_OK);
+    Require(sceKernelSignalSema(semaphore, 0) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollSema(semaphore, 1) == SCE_KERNEL_ERROR_EBUSY);
     Require(sceKernelDeleteSema(semaphore) == SCE_OK);
 
@@ -198,6 +162,13 @@ int main() {
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
     Require(sceKernelCreateEventFlag(&ef, "test", EVF_ATTR_SINGLE | EVF_ATTR_MULTI, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelCreateEventFlag(&ef, "test", EVF_ATTR_MULTI | 0x1000u, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    for (const std::uint32_t attr : {0x03u, 0x13u, 0x23u, 0x103u, 0x130u, 0x04u, 0x08u, 0x40u, 0x80u, 0x200u, 0x80000000u, 0xffffffffu}) {
+        Require(sceKernelCreateEventFlag(&ef, "test_bad_attr", attr, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    }
+    for (const std::uint32_t attr : {0x02u, 0x11u, 0x12u, 0x21u, 0x22u}) {
+        Require(sceKernelCreateEventFlag(&ef, "test_attr", attr, 0, nullptr) == SCE_OK);
+        Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    }
     Require(sceKernelDeleteEventFlag(nullptr) == SCE_KERNEL_ERROR_ESRCH);
     Require(sceKernelSetEventFlag(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
     Require(sceKernelClearEventFlag(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
@@ -205,18 +176,89 @@ int main() {
     Require(sceKernelWaitEventFlag(nullptr, 1, EVF_WAITMODE_OR, nullptr, nullptr) == SCE_KERNEL_ERROR_ESRCH);
     Require(sceKernelCancelEventFlag(nullptr, 0, nullptr) == SCE_KERNEL_ERROR_ESRCH);
 
-    KernelEventFlag opened = nullptr;
-    Require(sceKernelOpenEventFlag(nullptr, "test") == SCE_KERNEL_ERROR_EINVAL);
-    Require(sceKernelOpenEventFlag(&opened, nullptr) == SCE_KERNEL_ERROR_EINVAL);
-    Require(sceKernelOpenEventFlag(&opened, "SceShellCoreUtilAppFocus") == SCE_KERNEL_ERROR_ENOENT && opened == nullptr);
-    Require(sceKernelCreateEventFlag(&ef, "test_open", EVF_ATTR_MULTI, 0x05, nullptr) == SCE_OK);
-    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_OK && opened == ef);
-    Require(sceKernelSetEventFlag(opened, 0x08) == SCE_OK);
-    std::uint64_t openedPattern = 0;
-    Require(sceKernelPollEventFlag(ef, 0x08, EVF_WAITMODE_OR, &openedPattern) == SCE_OK && openedPattern == 0x0d);
+    Require(sceKernelCreateEventFlag(&ef, "", EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
-    opened = nullptr;
-    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_KERNEL_ERROR_ENOENT && opened == nullptr);
+    Require(sceKernelCreateEventFlag(&ef, "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn", EVF_ATTR_SHARED | EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    for (const std::uint32_t attr : {EVF_ATTR_MULTI, EVF_ATTR_SHARED | EVF_ATTR_MULTI}) {
+        Require(sceKernelCreateEventFlag(&ef, "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn", attr, 0, nullptr) == SCE_KERNEL_ERROR_ENAMETOOLONG);
+    }
+
+    KernelEventFlag opened = nullptr;
+    Require(sceKernelOpenEventFlag(nullptr, "test") == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelOpenEventFlag(&opened, nullptr) == SCE_KERNEL_ERROR_EFAULT && opened == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "") == SCE_KERNEL_ERROR_ESRCH && opened == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn") == SCE_KERNEL_ERROR_ENAMETOOLONG && opened == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "SceShellCoreUtilAppFocus") == SCE_KERNEL_ERROR_ESRCH && opened == nullptr);
+    Require(sceKernelCloseEventFlag(nullptr) == SCE_KERNEL_ERROR_ESRCH);
+
+    KernelEventFlag plain = nullptr;
+    Require(sceKernelCreateEventFlag(&plain, "test_open", EVF_ATTR_MULTI, 0x01, nullptr) == SCE_OK);
+    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_KERNEL_ERROR_ESRCH && opened == nullptr);
+    Require(sceKernelCloseEventFlag(plain) == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelSetEventFlag(plain, 0x02) == SCE_OK);
+    KernelEventFlag plainTwin = nullptr;
+    Require(sceKernelCreateEventFlag(&plainTwin, "test_open", EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(plainTwin) == SCE_OK);
+
+    Require(sceKernelCreateEventFlag(&ef, "test_open", EVF_ATTR_SHARED | EVF_ATTR_MULTI, 0x05, nullptr) == SCE_OK);
+    KernelEventFlag sharedTwin = nullptr;
+    Require(sceKernelCreateEventFlag(&sharedTwin, "test_open", EVF_ATTR_SHARED | EVF_ATTR_MULTI, 0, nullptr) == SCE_KERNEL_ERROR_EPERM && sharedTwin == nullptr);
+    Require(sceKernelOpenEventFlag(&opened, "test_open") == SCE_OK && opened != nullptr && opened != ef && opened != plain);
+    Require(sceKernelOpenEventFlag(nullptr, "test_open") == SCE_KERNEL_ERROR_EFAULT);
+    KernelEventFlag openedTwice = nullptr;
+    Require(sceKernelOpenEventFlag(&openedTwice, "test_open") == SCE_OK && openedTwice != opened && openedTwice != ef);
+    Require(sceKernelSetEventFlag(opened, 0x08) == SCE_OK);
+    Require(sceKernelClearEventFlag(openedTwice, ~std::uint64_t{0x04}) == SCE_OK);
+    std::uint64_t openedPattern = 0;
+    Require(sceKernelPollEventFlag(ef, 0x08, EVF_WAITMODE_OR, &openedPattern) == SCE_OK && openedPattern == 0x09);
+    Require(sceKernelDeleteEventFlag(opened) == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelCloseEventFlag(ef) == SCE_KERNEL_ERROR_EPERM);
+    Require(sceKernelCloseEventFlag(openedTwice) == SCE_OK);
+    Require(sceKernelCloseEventFlag(openedTwice) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelSetEventFlag(openedTwice, 0x01) == SCE_KERNEL_ERROR_ESRCH);
+
+    std::atomic<int> orphanWaitRes{-1};
+    std::uint64_t orphanWaitPat = 0xdeadbeef;
+    std::thread orphanWaiter([&] {
+        orphanWaitRes = sceKernelWaitEventFlag(opened, 0x80, EVF_WAITMODE_OR, &orphanWaitPat, nullptr);
+    });
+    WaitForEventFlagWaiters(opened, 1);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    orphanWaiter.join();
+    Require(orphanWaitRes == SCE_KERNEL_ERROR_EACCES && orphanWaitPat == 0);
+    KernelEventFlag reopened = nullptr;
+    Require(sceKernelOpenEventFlag(&reopened, "test_open") == SCE_KERNEL_ERROR_ESRCH && reopened == nullptr);
+    std::uint64_t orphanPattern = 0xdeadbeef;
+    Require(sceKernelPollEventFlag(opened, 0, EVF_WAITMODE_OR, &orphanPattern) == SCE_KERNEL_ERROR_EINVAL && orphanPattern == 0xdeadbeef);
+    Require(sceKernelPollEventFlag(opened, 0x01, EVF_WAITMODE_OR, &orphanPattern) == SCE_KERNEL_ERROR_EACCES && orphanPattern == 0);
+    orphanPattern = 0xdeadbeef;
+    KernelUseconds orphanTimeout = 1000;
+    Require(sceKernelWaitEventFlag(opened, 0x01, EVF_WAITMODE_OR, &orphanPattern, &orphanTimeout) == SCE_KERNEL_ERROR_EACCES && orphanPattern == 0 && orphanTimeout == 1000);
+    Require(sceKernelSetEventFlag(opened, 0x02) == SCE_OK);
+    Require(sceKernelClearEventFlag(opened, 0) == SCE_OK);
+    int orphanCount = -1;
+    Require(sceKernelCancelEventFlag(opened, 0x04, &orphanCount) == SCE_OK && orphanCount == 0);
+    Require(sceKernelDeleteEventFlag(opened) == SCE_KERNEL_ERROR_EPERM);
+
+    Require(sceKernelCreateEventFlag(&ef, "test_open", EVF_ATTR_SHARED | EVF_ATTR_SINGLE, 0x01, nullptr) == SCE_OK);
+    Require(sceKernelOpenEventFlag(&reopened, "test_open") == SCE_OK && reopened != opened);
+    Require(sceKernelCloseEventFlag(opened) == SCE_OK);
+    Require(sceKernelCloseEventFlag(opened) == SCE_KERNEL_ERROR_ESRCH);
+    std::atomic<int> sharedSingleRes{-1};
+    std::uint64_t sharedSinglePat = 0;
+    std::thread sharedSingleWaiter([&] {
+        sharedSingleRes = sceKernelWaitEventFlag(ef, 0x80, EVF_WAITMODE_OR, &sharedSinglePat, nullptr);
+    });
+    WaitForEventFlagWaiters(ef, 1);
+    openedPattern = 0xdeadbeef;
+    Require(sceKernelPollEventFlag(reopened, 0x01, EVF_WAITMODE_OR, &openedPattern) == SCE_KERNEL_ERROR_EPERM && openedPattern == 0);
+    Require(sceKernelSetEventFlag(reopened, 0x80) == SCE_OK);
+    sharedSingleWaiter.join();
+    Require(sharedSingleRes == SCE_OK && sharedSinglePat == 0x81);
+    Require(sceKernelCloseEventFlag(reopened) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+    Require(sceKernelDeleteEventFlag(plain) == SCE_OK);
 
     Require(sceKernelCreateEventFlag(&ef, "flag", EVF_ATTR_MULTI, 0x15, nullptr) == SCE_OK);
     std::uint64_t pattern = 0;
@@ -224,6 +266,16 @@ int main() {
     Require(sceKernelPollEventFlag(ef, 1, 0, &pattern) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollEventFlag(ef, 1, EVF_WAITMODE_AND | EVF_WAITMODE_OR, &pattern) == SCE_KERNEL_ERROR_EINVAL);
     Require(sceKernelPollEventFlag(ef, 1, EVF_WAITMODE_AND | EVF_WAITMODE_CLEAR_ALL | EVF_WAITMODE_CLEAR_PAT, &pattern) == SCE_KERNEL_ERROR_EINVAL);
+    for (const std::uint32_t mode : {0x04u, 0x40u, 0x100u, 0x80000000u, 0x103u}) {
+        pattern = 0xdeadbeef;
+        Require(sceKernelPollEventFlag(ef, 1, mode, &pattern) == SCE_KERNEL_ERROR_EINVAL && pattern == 0xdeadbeef);
+    }
+    for (const std::uint32_t mode : {EVF_WAITMODE_OR | 0x04u, EVF_WAITMODE_OR | 0x08u, EVF_WAITMODE_AND | 0x40u, EVF_WAITMODE_AND | 0x100u, EVF_WAITMODE_OR | 0x80000000u,
+                                     EVF_WAITMODE_OR | 0xffffff00u}) {
+        Require(sceKernelPollEventFlag(ef, 0x10, mode, &pattern) == SCE_OK && pattern == 0x15);
+    }
+    Require(sceKernelPollEventFlag(ef, 0x10, EVF_WAITMODE_OR | EVF_WAITMODE_CLEAR_PAT | 0x100u, &pattern) == SCE_OK && pattern == 0x15);
+    Require(sceKernelSetEventFlag(ef, 0x10) == SCE_OK);
 
     Require(sceKernelPollEventFlag(ef, 0x20, EVF_WAITMODE_OR, &pattern) == SCE_KERNEL_ERROR_EBUSY);
     Require(pattern == 0x15);
@@ -261,7 +313,43 @@ int main() {
 
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
 
-    Require(sceKernelCreateEventFlag(&ef, "single", EVF_ATTR_SINGLE | 0x02u, 0, nullptr) == SCE_OK);
+    Require(sceKernelCreateEventFlag(&ef, "single", EVF_ATTR_SINGLE | 0x02u, 0x04, nullptr) == SCE_OK);
+    std::atomic<int> singleRes{-1};
+    std::uint64_t singlePat = 0xdeadbeef;
+    std::thread singleWaiter([&] {
+        singleRes = sceKernelWaitEventFlag(ef, 0x01, EVF_WAITMODE_AND, &singlePat, nullptr);
+    });
+    WaitForEventFlagWaiters(ef, 1);
+    pattern = 0xdeadbeef;
+    Require(sceKernelPollEventFlag(ef, 0x04, EVF_WAITMODE_AND, &pattern) == SCE_KERNEL_ERROR_EPERM && pattern == 0);
+    pattern = 0xdeadbeef;
+    Require(sceKernelWaitEventFlag(ef, 0x04, EVF_WAITMODE_AND, &pattern, nullptr) == SCE_KERNEL_ERROR_EPERM && pattern == 0);
+    waitThreads = -1;
+    Require(sceKernelCancelEventFlag(ef, 0x08, &waitThreads) == SCE_OK && waitThreads == 1);
+    singleWaiter.join();
+    Require(singleRes == SCE_KERNEL_ERROR_ECANCELED && singlePat == 0);
+    Require(sceKernelPollEventFlag(ef, 0x08, EVF_WAITMODE_AND, &pattern) == SCE_OK && pattern == 0x08);
+    Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
+
+    Require(sceKernelCreateEventFlag(&ef, "multi_cancel", EVF_ATTR_MULTI, 0x01, nullptr) == SCE_OK);
+    std::atomic<int> cancelRes1{-1};
+    std::atomic<int> cancelRes2{-1};
+    std::uint64_t cancelPat1 = 0xdeadbeef;
+    std::uint64_t cancelPat2 = 0xdeadbeef;
+    std::thread cancelT1([&] {
+        cancelRes1 = sceKernelWaitEventFlag(ef, 0x02, EVF_WAITMODE_AND, &cancelPat1, nullptr);
+    });
+    std::thread cancelT2([&] {
+        cancelRes2 = sceKernelWaitEventFlag(ef, 0x04, EVF_WAITMODE_OR, &cancelPat2, nullptr);
+    });
+    WaitForEventFlagWaiters(ef, 2);
+    waitThreads = -1;
+    Require(sceKernelCancelEventFlag(ef, 0x05, &waitThreads) == SCE_OK && waitThreads == 2);
+    cancelT1.join();
+    cancelT2.join();
+    Require(cancelRes1 == SCE_KERNEL_ERROR_ECANCELED && cancelPat1 == 0);
+    Require(cancelRes2 == SCE_KERNEL_ERROR_ECANCELED && cancelPat2 == 0);
+    Require(sceKernelPollEventFlag(ef, 0x05, EVF_WAITMODE_AND, &pattern) == SCE_OK && pattern == 0x05);
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
 
     Require(sceKernelCreateEventFlag(&ef, "imm_sat", EVF_ATTR_MULTI, 0x05, nullptr) == SCE_OK);
@@ -323,8 +411,9 @@ int main() {
     Require(sceKernelCreateEventFlag(&ef, "del_waiters", EVF_ATTR_MULTI, 0, nullptr) == SCE_OK);
     std::atomic<int> delRes1{-1};
     std::atomic<int> delRes2{-1};
+    std::uint64_t delPat = 0xdeadbeef;
     std::thread delT1([&] {
-        delRes1 = sceKernelWaitEventFlag(ef, 0x01, EVF_WAITMODE_AND, nullptr, nullptr);
+        delRes1 = sceKernelWaitEventFlag(ef, 0x01, EVF_WAITMODE_AND, &delPat, nullptr);
     });
     std::thread delT2([&] {
         delRes2 = sceKernelWaitEventFlag(ef, 0x02, EVF_WAITMODE_AND, nullptr, nullptr);
@@ -333,7 +422,7 @@ int main() {
     Require(sceKernelDeleteEventFlag(ef) == SCE_OK);
     delT1.join();
     delT2.join();
-    Require(delRes1 == SCE_KERNEL_ERROR_EACCES);
+    Require(delRes1 == SCE_KERNEL_ERROR_EACCES && delPat == 0);
     Require(delRes2 == SCE_KERNEL_ERROR_EACCES);
 
     for (int iter = 0; iter < 50; ++iter) {
diff --git a/core/libs/tests/GuestKernelFcntl.cpp b/core/libs/tests/GuestKernelFcntl.cpp
index b75d3c22a9..1e57a5b542 100644
--- a/core/libs/tests/GuestKernelFcntl.cpp
+++ b/core/libs/tests/GuestKernelFcntl.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -14,23 +17,7 @@
 #include <sys/socket.h>
 #include <unistd.h>
 #endif
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI __sys_socketex_nid_postfix(const char*, int, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI _fcntl_nid_postfix(int, int, ...);
-int APS5_VABI ioctl_nid_postfix(int, std::uint64_t, void*);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelFcntl(int, int, ...);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static constexpr int DuplicateCommand = 0;
 static constexpr int GetDescriptorFlags = 1;
@@ -199,6 +186,7 @@ static void SocketsKeepTheirPath() {
 }
 
 static void FileFlagsRoundTrip() {
+    std::remove("kernel_fcntl_probe.bin");
     const int file = sceKernelOpen("kernel_fcntl_probe.bin", CreateReadWrite, 0644);
     Require(file >= 0);
     Require(sceKernelFcntl(file, GetFlags) == ReadWrite);
@@ -275,12 +263,26 @@ static void FileFlagsRoundTrip() {
     Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append));
     Require(fcntl_nid_postfix(appending, SetFlags, Append | NonBlocking) == 0);
     Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append | NonBlocking));
-#ifdef _WIN32
-    Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, 0); }, "fcntl: changing O_APPEND on a file is not implemented"));
-#else
+    Require(write_nid_postfix(appending, "ab", 2) == 2);
     Require(fcntl_nid_postfix(appending, SetFlags, 0) == 0);
     Require(fcntl_nid_postfix(appending, GetFlags) == WriteOnly);
-#endif
+    Require(sceKernelLseek(appending, 0, FromStart) == 0);
+    Require(write_nid_postfix(appending, "X", 1) == 1);
+    const int sharing = fcntl_nid_postfix(appending, DuplicateCommand, 0);
+    Require(sharing >= 0);
+    Require(fcntl_nid_postfix(sharing, SetFlags, Append) == 0);
+    Require(fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append));
+    Require(sceKernelLseek(appending, 0, FromStart) == 0);
+    Require(write_nid_postfix(appending, "c", 1) == 1);
+    Require(fcntl_nid_postfix(sharing, SetFlags, 0) == 0);
+    Require(sceKernelLseek(appending, 0, FromStart) == 0);
+    Require(write_nid_postfix(appending, "Y", 1) == 1);
+    Require(close_nid_postfix(sharing) == 0);
+    const int reading = sceKernelOpen("kernel_fcntl_probe.bin", ReadOnly, 0);
+    Require(reading >= 0);
+    char written[16]{};
+    Require(sceKernelRead(reading, written, sizeof(written)) == 8 && std::memcmp(written, "Ybcdeabc", 8) == 0);
+    Require(sceKernelClose(reading) == 0);
     Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, Append | 0x80); }, "fcntl: changing O_FSYNC on a file is not implemented"));
     Require(sceKernelClose(appending) == 0);
     std::remove("kernel_fcntl_probe.bin");
@@ -425,8 +427,10 @@ static void RecordLocksBelongToTheProcess() {
 static void PipeFlagsRoundTrip() {
     int pipe[2];
     Require(pipe_nid_postfix(pipe) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadOnly);
-    Require(fcntl_nid_postfix(pipe[1], GetFlags) == WriteOnly);
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadWrite);
+    Require(fcntl_nid_postfix(pipe[1], GetFlags) == ReadWrite);
+    const int duplicate = fcntl_nid_postfix(pipe[1], DuplicateCommand, 20);
+    Require(duplicate >= 20 && fcntl_nid_postfix(duplicate, GetFlags) == ReadWrite && close_nid_postfix(duplicate) == 0);
     Require(fcntl_nid_postfix(pipe[1], SetDescriptorFlags, 1) == 0);
     Require(fcntl_nid_postfix(pipe[1], GetDescriptorFlags) == 1);
     Require(fcntl_nid_postfix(pipe[0], GetDescriptorFlags) == 0);
@@ -436,7 +440,7 @@ static void PipeFlagsRoundTrip() {
     Require(fcntl_nid_postfix(pipe[1], GetDescriptorFlags) == 0);
 
     Require(fcntl_nid_postfix(pipe[0], SetFlags, fcntl_nid_postfix(pipe[0], GetFlags) | NonBlocking) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadOnly | NonBlocking));
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadWrite | NonBlocking));
     char buffer[8] = {};
     RequireFailure(static_cast<int>(read_nid_postfix(pipe[0], buffer, sizeof(buffer))), GuestEagain);
     Require(write_nid_postfix(pipe[1], "abc", 3) == 3);
@@ -448,10 +452,10 @@ static void PipeFlagsRoundTrip() {
 
     int off = 0;
     Require(ioctl_nid_postfix(pipe[0], NonblockingRequest, &off) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadOnly);
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == ReadWrite);
     int on = 1;
     Require(ioctl_nid_postfix(pipe[0], NonblockingRequest, &on) == 0);
-    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadOnly | NonBlocking));
+    Require(fcntl_nid_postfix(pipe[0], GetFlags) == (ReadWrite | NonBlocking));
 
     Require(fcntl_nid_postfix(pipe[1], SetFlags, NonBlocking) == 0);
     char block[1024] = {};
diff --git a/core/libs/tests/GuestKernelIsStack.cpp b/core/libs/tests/GuestKernelIsStack.cpp
index 968cdc981f..e9fdbae01d 100644
--- a/core/libs/tests/GuestKernelIsStack.cpp
+++ b/core/libs/tests/GuestKernelIsStack.cpp
@@ -1,24 +1,16 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
-int APS5_VABI sceKernelMapFlexibleMemory(void** addr, std::size_t len, int prot, int flags);
-int APS5_VABI sceKernelMunmap(std::uint64_t addr, std::size_t len);
-int APS5_VABI sceKernelVirtualQuery(const void* addr, int flags, VirtualQueryInfo* info, std::uint64_t infoSize);
-}
-
 static constexpr int SCE_OK = 0;
 #ifdef ANYPS5_ENABLE_ASAN
 static constexpr std::uintptr_t APPLICATION_AREA_END = 0x000010FC00000000ull;
 #else
 static constexpr std::uintptr_t APPLICATION_AREA_END = 0x000000FC00000000ull;
 #endif
-static constexpr int SCE_KERNEL_ERROR_EACCES = static_cast<int>(0x8002000d);
 static int global = 0;
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestKernelRename.cpp b/core/libs/tests/GuestKernelRename.cpp
index 6b74a12f95..22cbbdbf65 100644
--- a/core/libs/tests/GuestKernelRename.cpp
+++ b/core/libs/tests/GuestKernelRename.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdio>
@@ -11,9 +12,7 @@
 #else
 #include <dlfcn.h>
 #endif
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-}
+
 using RenameFunction = int (APS5_VABI*)(const char*, const char*);
 static RenameFunction LoadKernelRename() {
 #ifdef _WIN32
diff --git a/core/libs/tests/GuestKernelStackProtect.cpp b/core/libs/tests/GuestKernelStackProtect.cpp
index a980ea9d09..2574e5e198 100644
--- a/core/libs/tests/GuestKernelStackProtect.cpp
+++ b/core/libs/tests/GuestKernelStackProtect.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <atomic>
@@ -18,18 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
-void* APS5_VABI mmap_nid_postfix(void* address, std::size_t length, int protection, int flags, int descriptor, std::int64_t offset) noexcept;
-int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
-int* APS5_VABI __error_nid_postfix();
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr std::uintptr_t Page = 0x4000;
 static constexpr std::size_t GuardBytes = 0x10000;
diff --git a/core/libs/tests/GuestKernelSync.cpp b/core/libs/tests/GuestKernelSync.cpp
index fbe8391437..6386538124 100644
--- a/core/libs/tests/GuestKernelSync.cpp
+++ b/core/libs/tests/GuestKernelSync.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <algorithm>
 #include <cstdint>
@@ -12,19 +15,7 @@
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #endif
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, unsigned short);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-int APS5_VABI sceKernelMkdir(const char*, unsigned short);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelUnlink(const char*);
-int APS5_VABI sceKernelChmod_nid_postfix(const char*, std::uint16_t);
-void APS5_VABI sceKernelSync();
-void APS5_VABI sync_nid_postfix();
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-int APS5_VABI fclose_nid_postfix(void*);
-}
+
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Kernel sync check failed at line %d\n", line);
@@ -50,7 +41,7 @@ int main() {
     Require(sceKernelMkdir("kernel_sync_probe/existing.bin/child", 0777) == static_cast<int>(0x80020014u));
     const int reader = sceKernelOpen("kernel_sync_probe/existing.bin", 0x0, 0);
     Require(reader >= 0 && sceKernelClose(reader) == 0);
-    void* stream = fopen_nid_postfix("kernel_sync_probe/existing.bin", "r");
+    FileStream* stream = fopen_nid_postfix("kernel_sync_probe/existing.bin", "r");
     Require(stream != nullptr && fclose_nid_postfix(stream) == 0);
     Require(!Recorded("kernel_sync_probe/existing.bin"));
     stream = fopen_nid_postfix("kernel_sync_probe/existing.bin", "a");
@@ -63,27 +54,33 @@ int main() {
     Require(Recorded("kernel_sync_probe/moved.bin"));
     Require(sceKernelUnlink("kernel_sync_probe/moved.bin") == 0);
     sceKernelSync();
+
     Require(!Recorded("kernel_sync_probe/data.bin") && !Recorded("kernel_sync_probe/moved.bin"));
     sceKernelSync();
+
     const int locked = sceKernelOpen("kernel_sync_probe/read_only.bin", 0x1 | 0x200, 0644);
     Require(locked >= 0 && sceKernelWrite(locked, "data", 4) == 4 && sceKernelClose(locked) == 0);
     Require(sceKernelChmod_nid_postfix("kernel_sync_probe/read_only.bin", 0444) == 0);
     Require(Recorded("kernel_sync_probe/read_only.bin"));
     sceKernelSync();
+
     Require(sceKernelChmod_nid_postfix("kernel_sync_probe/read_only.bin", 0644) == 0);
 #ifdef _WIN32
     const auto exclusive = CreateFileW(ResolvePath_nid_no_patch("kernel_sync_probe/read_only.bin").c_str(), GENERIC_READ, FILE_SHARE_READ,
         nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
     Require(exclusive != INVALID_HANDLE_VALUE);
     sceKernelSync();
+
     CloseHandle(exclusive);
 #endif
     sceKernelSync();
+
     const int synced = sceKernelOpen("kernel_sync_probe/synced.bin", 0x1 | 0x200 | 0x400, 0644);
     Require(synced >= 0 && sceKernelWrite(synced, "data", 4) == 4 && sceKernelClose(synced) == 0);
     Require(Recorded("kernel_sync_probe/synced.bin"));
     Require(sceKernelUnlink("kernel_sync_probe/synced.bin") == 0);
     sync_nid_postfix();
+
     Require(!Recorded("kernel_sync_probe/synced.bin"));
     std::filesystem::remove_all("kernel_sync_probe");
 }
diff --git a/core/libs/tests/GuestKernelSys.cpp b/core/libs/tests/GuestKernelSys.cpp
index 40d3afffb0..a3c4eeebf1 100644
--- a/core/libs/tests/GuestKernelSys.cpp
+++ b/core/libs/tests/GuestKernelSys.cpp
@@ -1,7 +1,13 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/RemoveTree.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
+#include "prx/libkernel/KernelErrors.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <chrono>
@@ -27,43 +33,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI fstatfs_nid_postfix(int, void*);
-int APS5_VABI _fstatfs_nid_postfix(int, void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI readlink_nid_postfix(const char*, char*, std::size_t);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-std::int64_t APS5_VABI pathconf_nid_postfix(const char*, int);
-int APS5_VABI fchdir_nid_postfix(int);
-int APS5_VABI chdir_nid_postfix(const char*);
-int APS5_VABI chroot_nid_postfix(const char*);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI setsid_nid_postfix(void);
-int APS5_VABI link_nid_postfix(const char*, const char*);
-int APS5_VABI symlink_nid_postfix(const char*, const char*);
-int APS5_VABI openat_nid_postfix(int, const char*, int, ...);
-int APS5_VABI unlinkat_nid_postfix(int, const char*, int);
-std::int64_t APS5_VABI readlinkat_nid_postfix(int, const char*, char*, std::size_t);
-int APS5_VABI mkdirat_nid_postfix(int, const char*, std::uint16_t);
-int APS5_VABI renameat_nid_postfix(int, const char*, int, const char*);
-int APS5_VABI fchmodat_nid_postfix(int, const char*, int, int);
-int APS5_VABI fchown_nid_postfix(int, std::uint32_t, std::uint32_t);
-int APS5_VABI fstatat_nid_postfix(int, const char*, FileStat*, int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Kernel sys check failed at line %u (guest errno %d)\n", location.line(), *__error_nid_postfix());
@@ -78,6 +47,7 @@ int Error() {
 bool PathconfThrows(const char* path, int name) {
     try {
         pathconf_nid_postfix(path, name);
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -87,15 +57,93 @@ bool PathconfThrows(const char* path, int name) {
 bool ChrootThrows(const std::string& path) {
     try {
         chroot_nid_postfix(path.c_str());
+
     } catch (const std::runtime_error& error) {
         return std::strstr(error.what(), path.c_str()) != nullptr;
     }
     return false;
 }
 
+template <typename Call>
+bool ThrowsNaming(Call call, const char* text) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        return std::strstr(error.what(), text) != nullptr;
+    }
+    return false;
+}
+
+void OwnershipAndLinkTests(const std::filesystem::path& root) {
+    constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
+    const auto file = (root / "owned.txt").string();
+    std::ofstream(file).put('x');
+    const auto missing = (root / "missing.txt").string();
+    const auto throughFile = file + "/inner";
+    const auto linked = (root / "linked.txt").string();
+    const auto other = (root / "other.txt").string();
+    Require(chown_nid_postfix(file.c_str(), 0, 0) == 0);
+    Require(chown_nid_postfix(file.c_str(), Unchanged, Unchanged) == 0);
+    Require(lchown_nid_postfix(file.c_str(), 0, Unchanged) == 0);
+    Require(fchownat_nid_postfix(-100, file.c_str(), Unchanged, 0, 0) == 0);
+    Require(fchownat_nid_postfix(-100, file.c_str(), 0, 0, 0x200) == 0);
+    for (const auto call : {chown_nid_postfix, lchown_nid_postfix}) {
+        Require(call(missing.c_str(), 0, 0) == -1 && Error() == 2);
+        Require(call(throughFile.c_str(), 0, 0) == -1 && Error() == 20);
+        Require(call("", 0, 0) == -1 && Error() == 2);
+        Require(call(nullptr, 0, 0) == -1 && Error() == 14);
+    }
+    Require(fchownat_nid_postfix(-100, missing.c_str(), 0, 0, 0) == -1 && Error() == 2);
+    Require(fchownat_nid_postfix(-100, file.c_str(), 0, 0, 0x400) == -1 && Error() == 22);
+    Require(chown_nid_postfix(missing.c_str(), 1000, 0) == -1 && Error() == 2);
+    Require(chown_nid_postfix(nullptr, 1000, 0) == -1 && Error() == 14);
+    Require(lchown_nid_postfix(throughFile.c_str(), 0, 1000) == -1 && Error() == 20);
+    Require(fchownat_nid_postfix(-100, missing.c_str(), 1000, 0, 0) == -1 && Error() == 2);
+    Require(fchownat_nid_postfix(4321, "owned.txt", 1000, 0, 0) == -1 && Error() == 9);
+    Require(fchownat_nid_postfix(-100, file.c_str(), 1000, 0, 0x400) == -1 && Error() == 22);
+    Require(ThrowsNaming([&] { chown_nid_postfix(file.c_str(), 1000, 0); }, "chown: an owner"));
+    Require(ThrowsNaming([&] { lchown_nid_postfix(file.c_str(), 0, 1000); }, "lchown: a group"));
+    Require(ThrowsNaming([&] { fchownat_nid_postfix(-100, file.c_str(), 5, Unchanged, 0); }, "fchownat: an owner"));
+    const int directory = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(directory >= 0);
+    Require(fchownat_nid_postfix(directory, "owned.txt", 0, 0, 0) == 0);
+    Require(fchownat_nid_postfix(directory, "missing.txt", 0, 0, 0) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(-100, file.c_str(), -100, linked.c_str(), 0) == 0);
+    Require(std::filesystem::hard_link_count(file) == 2);
+    Require(linkat_nid_postfix(-100, file.c_str(), -100, linked.c_str(), 0x400) == -1 && Error() == 17);
+    Require(linkat_nid_postfix(-100, missing.c_str(), -100, other.c_str(), 0x400) == -1 && Error() == 2);
+    Require(linkat_nid_postfix(-100, file.c_str(), -100, other.c_str(), 0x200) == -1 && Error() == 22);
+    Require(linkat_nid_postfix(-100, nullptr, -100, other.c_str(), 0) == -1 && Error() == 14);
+    Require(linkat_nid_postfix(-100, "", -100, other.c_str(), 0) == -1 && Error() == 2);
+    Require(ThrowsNaming([&] { linkat_nid_postfix(directory, "owned.txt", -100, other.c_str(), 0); }, "linkat: a relative path"));
+    Require(ThrowsNaming([&] { linkat_nid_postfix(-100, file.c_str(), directory, "other.txt", 0); }, "linkat: a relative path"));
+    const auto symbolic = (root / "owned.link").string();
+    const auto dangling = (root / "dangling.link").string();
+    if (symlink_nid_postfix("owned.txt", symbolic.c_str()) == 0) {
+        Require(symlink_nid_postfix("missing.txt", dangling.c_str()) == 0);
+        Require(chown_nid_postfix(symbolic.c_str(), 0, 0) == 0 && lchown_nid_postfix(symbolic.c_str(), 0, 0) == 0);
+        Require(chown_nid_postfix(dangling.c_str(), 0, 0) == -1 && Error() == 2);
+        Require(lchown_nid_postfix(dangling.c_str(), 0, 0) == 0);
+        Require(fchownat_nid_postfix(-100, dangling.c_str(), 0, 0, 0) == -1 && Error() == 2);
+        Require(fchownat_nid_postfix(-100, dangling.c_str(), 0, 0, 0x200) == 0);
+        Require(ThrowsNaming([&] { linkat_nid_postfix(-100, symbolic.c_str(), -100, other.c_str(), 0); }, "symbolic link itself"));
+        Require(linkat_nid_postfix(-100, symbolic.c_str(), -100, other.c_str(), 0x400) == 0);
+#ifdef _WIN32
+        Require((GetFileAttributesW(std::filesystem::path(other).c_str()) & FILE_ATTRIBUTE_REPARSE_POINT) == 0);
+#else
+        Require(!std::filesystem::is_symlink(std::filesystem::symlink_status(other)));
+#endif
+        Require(std::filesystem::hard_link_count(file) == 3);
+        Require(std::filesystem::remove(other) && std::filesystem::remove(symbolic) && std::filesystem::remove(dangling));
+    }
+    Require(sceKernelClose(directory) == 0);
+    Require(std::filesystem::remove(linked) && std::filesystem::remove(file));
+}
+
 bool SymlinkTargetThrows(const char* target, const std::string& created) {
     try {
         symlink_nid_postfix(target, created.c_str());
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -144,6 +192,26 @@ void CheckSymlinkTargetRestrictions(const std::filesystem::path& root) {
     }
 }
 
+void CheckCondattrClock() {
+    constexpr KernelClockid Realtime = 0;
+    constexpr KernelClockid Monotonic = 4;
+    PthreadCondattr attr = nullptr;
+    KernelClockid clock = -1;
+    Require(scePthreadCondattrGetclock(nullptr, &clock) == SCE_KERNEL_ERROR_EINVAL && clock == -1);
+    Require(scePthreadCondattrGetclock(nullptr, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadCondattrGetclock(&attr, &clock) == SCE_KERNEL_ERROR_EINVAL && clock == -1);
+    Require(scePthreadCondattrInit(&attr) == 0 && attr != nullptr);
+    Require(scePthreadCondattrGetclock(&attr, &clock) == 0 && clock == Realtime);
+    Require(scePthreadCondattrSetclock(&attr, Monotonic) == 0);
+    Require(scePthreadCondattrGetclock(&attr, &clock) == 0 && clock == Monotonic);
+    bool getclockThrew = false;
+    try { scePthreadCondattrGetclock(&attr, nullptr); } catch (const std::runtime_error&) { getclockThrew = true; }
+    Require(getclockThrew);
+    Require(scePthreadCondattrDestroy(&attr) == 0 && attr == nullptr);
+    clock = -1;
+    Require(scePthreadCondattrGetclock(&attr, &clock) == SCE_KERNEL_ERROR_EINVAL && clock == -1);
+}
+
 void CheckPathconf(const std::filesystem::path& root, const std::string& file) {
     const auto directory = root.generic_string();
     for (const auto& path : {file, directory}) {
@@ -258,33 +326,119 @@ void DirectoryRenameTests(const std::filesystem::path& parent) {
     Require(std::filesystem::remove(original) && std::filesystem::remove(moved) && std::filesystem::remove(fixture));
 }
 
+static void CheckProcessQueries() {
+    KernelTitleWorkaround workaround{1, 0, {(1ull << 3) | (1ull << 0x39), ~0ull}};
+    std::int32_t enabled = -1;
+    Require(sceKernelTitleWorkaroundIsEnabled(nullptr, 3, &enabled) == static_cast<int>(0x8002000E));
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 3, nullptr) == static_cast<int>(0x8002000E));
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 0x3A, &enabled) == static_cast<int>(0x80020016) && enabled == -1);
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, -1, &enabled) == static_cast<int>(0x80020016) && enabled == -1);
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 3, &enabled) == 0 && enabled == 1);
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 4, &enabled) == 0 && enabled == 0);
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 63, &enabled) == static_cast<int>(0x80020016));
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 0x39, &enabled) == 0 && enabled == 1);
+    Require(sceKernelTitleWorkaroundIsEnabled(&workaround, 0x38, &enabled) == 0 && enabled == 0);
+    Require(sceKernelGetProcessType(getpid_nid_postfix()) == 0);
+    Require(sceKernelGetProcessType(-1) == 0 && sceKernelGetProcessType(0) == 0);
+    Require(sceKernelGetProcessType(getpid_nid_postfix() + 1) == static_cast<int>(0x80020003));
+}
+
+template <typename F>
+bool DescriptorPathconfThrows(F fn, int descriptor, int name) {
+    try {
+        fn(descriptor, name);
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
+template <typename F>
+void CheckDescriptorPathconf(F fn, int descriptor) {
+    Require(fn(descriptor, 1) == 32767);
+    Require(fn(descriptor, 4) == 255);
+    Require(fn(descriptor, 5) == 1024);
+    Require(fn(descriptor, 6) == 512);
+    Require(fn(descriptor, 7) == 1);
+    Require(fn(descriptor, 8) == 1);
+    Require(fn(descriptor, 12) == 64);
+    *__error_nid_postfix() = 0;
+    Require(fn(descriptor, 15) == -1 && Error() == 0);
+    Require(fn(descriptor, 18) == 1024);
+    Require(fn(descriptor, 54) == 0);
+    Require(fn(descriptor, 55) == 0);
+    for (const int name : {0, 11, 61, 62, 65, -1})
+        Require(fn(descriptor, name) == -1 && Error() == 22);
+    Require(fn(descriptor, 53) == 200112);
+    for (const int name : {2, 3, 9, 10, 14, 16, 17, 21, 59, 60, 63, 64})
+        Require(DescriptorPathconfThrows(fn, descriptor, name));
+    Require(fn(-1, 4) == -1 && Error() == 9);
+    Require(fn(descriptor + 1000, 4) == -1 && Error() == 9);
+}
+
+template <typename F>
+void CheckPipePathconf(F fn) {
+    int ends[2]{-1, -1};
+    Require(pipe_nid_postfix(ends) == 0);
+    for (const int end : ends) {
+        Require(fn(end, 6) == 512);
+        Require(fn(end, 53) == 200112);
+        for (const int name : {0, 1, 4, 5, 7, 8, 12, 18, 54, 55, 61, -1})
+            Require(fn(end, name) == -1 && Error() == 22);
+    }
+    Require(close_nid_postfix(ends[0]) == 0 && close_nid_postfix(ends[1]) == 0);
+}
+
 int main() {
 #ifdef _WIN32
     auto hostDirectorySpelling = std::filesystem::current_path().native();
     CharUpperBuffW(hostDirectorySpelling.data(), static_cast<DWORD>(hostDirectorySpelling.size()));
     Require(SetCurrentDirectoryW(hostDirectorySpelling.c_str()) != 0);
 #endif
+    CheckProcessQueries();
     Require(setsid_nid_postfix() == -1 && Error() == 1);
     Require(umask_nid_postfix(0) == 022);
     Require(umask_nid_postfix(07777) == 0);
     Require(umask_nid_postfix(022) == 07777);
+    CheckCondattrClock();
     const auto root = std::filesystem::path("anyps5-kernel-sys-test-" +
         std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
     Require(std::filesystem::create_directory(root));
     DirectoryRenameTests(root);
+    OwnershipAndLinkTests(root);
     const auto file = (root / "file.txt").string();
     std::ofstream(file).put('x');
     CheckPathconf(root, file);
     const int descriptor = open_nid_postfix(file.c_str(), 0, 0);
     Require(descriptor >= 0);
-    unsigned char viaPublic[472] = {};
-    unsigned char viaSyscall[472] = {};
-    Require(fstatfs_nid_postfix(descriptor, viaPublic) == 0 && _fstatfs_nid_postfix(descriptor, viaSyscall) == 0);
+    KernelStatfs publicStats{};
+    auto* viaPublic = reinterpret_cast<unsigned char*>(&publicStats);
+    KernelStatfs syscallStats{};
+    auto* viaSyscall = reinterpret_cast<unsigned char*>(&syscallStats);
+    Require(fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(viaPublic)) == 0 && _fstatfs_nid_postfix(descriptor, reinterpret_cast<KernelStatfs*>(viaSyscall)) == 0);
     Require(std::memcmp(viaPublic, viaSyscall, 4) == 0 && std::memcmp(viaPublic + 16, viaSyscall + 16, 8) == 0);
     Require(std::memcmp(viaPublic + 280, viaSyscall + 280, 16) == 0);
     Require(fstatfs_nid_postfix(descriptor, nullptr) == -1 && Error() == 14);
+    FileStat viaFstat{};
+    FileStat viaUnderscore{};
+    Require(fstat_nid_postfix(descriptor, &viaFstat) == 0 && _fstat_nid_postfix(descriptor, &viaUnderscore) == 0);
+    Require(std::memcmp(&viaFstat, &viaUnderscore, sizeof(FileStat)) == 0 && viaFstat.st_size == 1);
+    Require(fstat_nid_postfix(descriptor, nullptr) == -1 && Error() == 14);
+    CheckDescriptorPathconf(fpathconf_nid_postfix, descriptor);
+    CheckDescriptorPathconf(_fpathconf_nid_postfix, descriptor);
+    CheckPipePathconf(fpathconf_nid_postfix);
+    CheckPipePathconf(_fpathconf_nid_postfix);
     Require(close_nid_postfix(descriptor) == 0);
-    Require(fstatfs_nid_postfix(-1, viaPublic) == -1 && Error() == 9);
+    Require(fstatfs_nid_postfix(-1, reinterpret_cast<KernelStatfs*>(viaPublic)) == -1 && Error() == 9);
+    Require(fstat_nid_postfix(descriptor, &viaFstat) == -1 && Error() == 9);
+    Require(fstat_nid_postfix(-1, &viaFstat) == -1 && Error() == 9);
+    Require(fpathconf_nid_postfix(descriptor, 4) == -1 && Error() == 9);
+    Require(_fpathconf_nid_postfix(descriptor, 4) == -1 && Error() == 9);
+    const int dirDescriptor = open_nid_postfix(root.generic_string().c_str(), 0, 0);
+    Require(dirDescriptor >= 0);
+    CheckDescriptorPathconf(fpathconf_nid_postfix, dirDescriptor);
+    CheckDescriptorPathconf(_fpathconf_nid_postfix, dirDescriptor);
+    Require(close_nid_postfix(dirDescriptor) == 0);
     char buffer[64];
     for (const auto& component : {std::string("missing"), std::string("file.txt")}) {
         const auto prefix = root.generic_string() + "/" + component + "/../";
@@ -297,6 +451,19 @@ int main() {
         Require(symlink_nid_postfix("file.txt", created.c_str()) == -1 && Error() == expected);
         Require(std::filesystem::hard_link_count(file) == 1 && !std::filesystem::exists(root / "new.txt"));
     }
+    for (const std::size_t length : {std::size_t{1024}, std::size_t{1100}}) {
+        const auto tooLong = std::string(length, 'a');
+        const auto created = (root / "target-too-long").string();
+        Require(symlink_nid_postfix(tooLong.c_str(), created.c_str()) == -1 && Error() == 63);
+        Require(!std::filesystem::exists(std::filesystem::symlink_status(root / "target-too-long")));
+    }
+    {
+        const auto longest = std::string(1023, 'a');
+        const auto created = (root / "target-longest").string();
+        const int made = symlink_nid_postfix(longest.c_str(), created.c_str());
+        Require(made == 0 || Error() != 63);
+        if (made == 0) Require(RemoveSymlink(created));
+    }
     Require(readlink_nid_postfix(file.c_str(), buffer, sizeof(buffer)) == -1 && Error() == 22);
     Require(readlink_nid_postfix(root.string().c_str(), buffer, sizeof(buffer)) == -1 && Error() == 22);
     Require(readlink_nid_postfix((root / "missing").string().c_str(), buffer, sizeof(buffer)) == -1 && Error() == 2);
@@ -417,6 +584,19 @@ int main() {
     Require(fileDescriptor >= 0);
     Require(fchdir_nid_postfix(-1) == -1 && Error() == 9);
     Require(fchdir_nid_postfix(fileDescriptor) == -1 && Error() == 20);
+    int pipeEnds[2] = {-1, -1};
+    Require(pipe_nid_postfix(pipeEnds) == 0);
+    Require(fchdir_nid_postfix(pipeEnds[0]) == -1 && Error() == 22);
+    Require(fchdir_nid_postfix(pipeEnds[1]) == -1 && Error() == 22);
+    Require(close_nid_postfix(pipeEnds[0]) == 0 && close_nid_postfix(pipeEnds[1]) == 0);
+    const int characterDevice = open_nid_postfix("/dev/random", 0, 0);
+    Require(characterDevice >= 0);
+    Require(fchdir_nid_postfix(characterDevice) == -1 && Error() == 20);
+    Require(close_nid_postfix(characterDevice) == 0);
+    const int socketDescriptor = socket_nid_postfix(2, 2, 0);
+    Require(socketDescriptor >= 0);
+    Require(fchdir_nid_postfix(socketDescriptor) == -1 && Error() == 22);
+    Require(close_nid_postfix(socketDescriptor) == 0);
     Require(fchdir_nid_postfix(directory) == 0);
     char directoryPath[1024];
     Require(getcwd_nid_postfix(directoryPath, sizeof(directoryPath)) == directoryPath);
@@ -562,6 +742,22 @@ int main() {
     const int plain = sceKernelOpen(file.c_str(), SCE_KERNEL_O_RDONLY, 0);
     Require(plain >= 0);
     Require(openat_nid_postfix(plain, "file.txt", SCE_KERNEL_O_RDONLY) == -1 && Error() == 20);
+    const int aliased = _openat_nid_postfix(base, "file.txt", SCE_KERNEL_O_RDONLY);
+    byte = 0;
+    Require(aliased >= 0 && sceKernelRead(aliased, &byte, 1) == 1 && byte == 'x');
+    Require(sceKernelClose(aliased) == 0);
+    const int aliasMade = _openat_nid_postfix(base, "alias.bin", SCE_KERNEL_O_WRONLY | SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL, 0600);
+    Require(aliasMade >= 0 && sceKernelClose(aliasMade) == 0 && std::filesystem::is_regular_file(root / "alias.bin"));
+#ifndef _WIN32
+    Require((std::filesystem::status(root / "alias.bin").permissions() & std::filesystem::perms::all) ==
+        (std::filesystem::perms::owner_read | std::filesystem::perms::owner_write));
+#endif
+    const int aliasWritten = _openat_nid_postfix(base, "alias.bin", SCE_KERNEL_O_WRONLY);
+    Require(aliasWritten >= 0 && sceKernelClose(aliasWritten) == 0);
+    Require(_openat_nid_postfix(base, "alias.bin", SCE_KERNEL_O_WRONLY | SCE_KERNEL_O_CREAT | SCE_KERNEL_O_EXCL, 0600) == -1 && Error() == 17);
+    Require(_openat_nid_postfix(base, "file.txt", SCE_KERNEL_O_ACCMODE) == -1 && Error() == 22);
+    Require(_openat_nid_postfix(-1, "file.txt", SCE_KERNEL_O_RDONLY) == -1 && Error() == 9);
+    Require(_openat_nid_postfix(plain, "file.txt", SCE_KERNEL_O_RDONLY) == -1 && Error() == 20);
     Require(readlinkat_nid_postfix(base, "file.txt", buffer, sizeof(buffer)) == -1 && Error() == 22);
     Require(readlinkat_nid_postfix(base, "missing.bin", buffer, sizeof(buffer)) == -1 && Error() == 2);
     Require(readlinkat_nid_postfix(base, "file.txt/child", buffer, sizeof(buffer)) == -1 && Error() == 20);
@@ -588,6 +784,19 @@ int main() {
     const std::string longName(256, 'a');
     Require(mkdirat_nid_postfix(base, longName.c_str(), 0700) == -1 && Error() == 63);
     Require(mkdirat_nid_postfix(base, "dir/../dotdot_dir", 0700) == 0 && std::filesystem::is_directory(root / "dotdot_dir"));
+#ifdef _WIN32
+    for (const DWORD linkFlags : {DWORD(0), DWORD(SYMBOLIC_LINK_FLAG_DIRECTORY)}) {
+        const auto loopLink = root / "mkdirat_loop";
+        if (CreateSymbolicLinkW(loopLink.c_str(), L"mkdirat_loop", linkFlags | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) == 0) {
+            Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+            std::fprintf(stderr, "symbolic links unavailable: the mkdirat loop case not tested\n");
+            break;
+        }
+        Require(mkdirat_nid_postfix(base, "mkdirat_loop/child", 0700) == -1 && Error() == 62);
+        Require(mkdirat_nid_postfix(base, "mkdirat_loop", 0700) == -1 && Error() == 17);
+        Require((linkFlags != 0 ? RemoveDirectoryW(loopLink.c_str()) : DeleteFileW(loopLink.c_str())) != 0);
+    }
+#endif
     Require(unlinkat_nid_postfix(plain, "file.txt", 0) == -1 && Error() == 20);
     Require(unlinkat_nid_postfix(-1, "file.txt", 0) == -1 && Error() == 9);
     Require(sceKernelClose(plain) == 0);
@@ -605,7 +814,8 @@ int main() {
     Require(unlinkat_nid_postfix(base, "file.txt", 0x800) == -1 && Error() == 20);
     Require(unlinkat_nid_postfix(base, ".", 0x800) == -1 && Error() == 22);
     Require(unlinkat_nid_postfix(base, "..", 0x800) == -1 && Error() == 22);
-    Require(unlinkat_nid_postfix(base, ".", 0) == -1 && Error() == 1);
+    Require(unlinkat_nid_postfix(base, ".", 0) == -1 && Error() == 22);
+    Require(unlinkat_nid_postfix(base, "..", 0) == -1 && Error() == 22);
     std::filesystem::create_directory(root / "usub");
     Require(unlinkat_nid_postfix(base, "usub", 0) == -1 && Error() == 1);
     std::filesystem::create_directory(root / "nonempty");
@@ -695,6 +905,38 @@ int main() {
     Require(symlink_nid_postfix("loop", (root / "loop").string().c_str()) == 0);
     Require(fchmodat_nid_postfix(base, "loop/x", 0600, 0) == -1 && Error() == 62);
     Require(fchmodat_nid_postfix(base, longName.c_str(), 0600, 0) == -1 && Error() == 63);
+#endif
+    const auto modeFile = (root / "file.txt").string();
+#ifndef _WIN32
+    const auto ownerOnly = std::filesystem::perms::owner_read | std::filesystem::perms::owner_write;
+    const auto readable = ownerOnly | std::filesystem::perms::group_read | std::filesystem::perms::others_read;
+#endif
+    Require(lchmod_nid_postfix(modeFile.c_str(), 0600) == 0);
+#ifndef _WIN32
+    Require((std::filesystem::status(modeFile).permissions() & std::filesystem::perms::all) == ownerOnly);
+#endif
+    Require(lchmod_nid_postfix(guestFile.c_str(), 0100644) == 0);
+#ifndef _WIN32
+    Require((std::filesystem::status(modeFile).permissions() & std::filesystem::perms::all) == readable);
+#endif
+    Require(lchmod_nid_postfix((root / "missing.bin").string().c_str(), 0600) == -1 && Error() == 2);
+    Require(lchmod_nid_postfix(nullptr, 0600) == -1 && Error() == 14);
+    Require(lchmod_nid_postfix("", 0600) == -1 && Error() == 2);
+#ifndef _WIN32
+    Require(lchmod_nid_postfix((root / "loop" / "x").string().c_str(), 0600) == -1 && Error() == 62);
+    Require(lchmod_nid_postfix((root / longName).string().c_str(), 0600) == -1 && Error() == 63);
+    const auto modeLink = (root / "mode-link.txt").string();
+    Require(symlink_nid_postfix("file.txt", modeLink.c_str()) == 0);
+#ifdef __APPLE__
+    Require(lchmod_nid_postfix(modeLink.c_str(), 0600) == 0);
+    Require((std::filesystem::symlink_status(modeLink).permissions() & std::filesystem::perms::all) == ownerOnly);
+#else
+    bool lchmodThrew = false;
+    try { lchmod_nid_postfix(modeLink.c_str(), 0600); } catch (const std::exception&) { lchmodThrew = true; }
+    Require(lchmodThrew);
+#endif
+    Require((std::filesystem::status(modeFile).permissions() & std::filesystem::perms::all) == readable);
+    Require(RemoveSymlink(modeLink));
 #endif
     Require(fchown_nid_postfix(base, 0, 0) == 0);
     Require(fchown_nid_postfix(base, 0xFFFFFFFFu, 0xFFFFFFFFu) == 0);
@@ -744,20 +986,27 @@ int main() {
     Require(junctionText.find('?') == std::string::npos && std::filesystem::equivalent(junctionText, junctionTarget, junctionError) && !junctionError);
     Require(std::filesystem::remove(junction) && std::filesystem::remove(junctionTarget));
 #endif
-#ifndef _WIN32
     if (created == 0) {
         const auto throughLink = (root / "through-link.bin").string();
         Require(link_nid_postfix(symbolic.c_str(), throughLink.c_str()) == 0);
+#ifdef _WIN32
+        Require((GetFileAttributesW(std::filesystem::path(throughLink).c_str()) & FILE_ATTRIBUTE_REPARSE_POINT) == 0);
+#else
         Require(!std::filesystem::is_symlink(std::filesystem::symlink_status(throughLink)));
+#endif
         Require(std::filesystem::equivalent(throughLink, original) && std::filesystem::hard_link_count(original) == 2);
         Require(std::filesystem::remove(throughLink) && std::filesystem::hard_link_count(original) == 1);
         Require(link_nid_postfix((root / "dangling").string().c_str(), throughLink.c_str()) == -1 && Error() == 2);
-        const auto directoryLink = (root / "directory-link").string();
-        Require(symlink_nid_postfix(".", directoryLink.c_str()) == 0);
-        Require(link_nid_postfix(directoryLink.c_str(), throughLink.c_str()) == -1 && Error() == 1);
+        const auto dotLink = (root / "dot-link").string();
+        Require(symlink_nid_postfix(".", dotLink.c_str()) == 0);
+        Require(link_nid_postfix(dotLink.c_str(), throughLink.c_str()) == -1 && Error() == 1);
+#ifdef _WIN32
+        Require(symlink_nid_postfix("loop-b", (root / "loop-a").string().c_str()) == 0);
+        Require(symlink_nid_postfix("loop-a", (root / "loop-b").string().c_str()) == 0);
+        Require(link_nid_postfix((root / "loop-a").string().c_str(), throughLink.c_str()) == -1 && Error() == 62);
+#endif
         Require(!std::filesystem::exists(std::filesystem::symlink_status(throughLink)));
     }
-#endif
     RemoveTree(root);
     return 0;
 }
diff --git a/core/libs/tests/GuestKernelSysAio.cpp b/core/libs/tests/GuestKernelSysAio.cpp
new file mode 100644
index 0000000000..200d3290b8
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysAio.cpp
@@ -0,0 +1,202 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <limits>
+#include <source_location>
+#include <string>
+
+namespace {
+
+}
+
+extern "C" {
+
+void AioHoldWorkerForTest_nid_no_patch(bool hold);
+}
+
+namespace {
+
+constexpr int Ebadf = 9;
+constexpr int Efault = 14;
+constexpr int Einval = 22;
+constexpr int Eagain = 35;
+constexpr int Einprogress = 36;
+constexpr int Eopnotsupp = 45;
+constexpr int Ecanceled = 85;
+constexpr int ORdonly = 0;
+constexpr int ORdwr = 2;
+constexpr int OCreat = 0x200;
+constexpr int OSync = 0x80;
+constexpr int ODsync = 0x1000000;
+constexpr int AioCanceled = 1;
+constexpr int AioAllDone = 3;
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+int Error() {
+    return *__error_nid_postfix();
+}
+
+GuestAiocb Request(int descriptor, void* buffer, std::uint64_t bytes, std::int64_t offset = 0) {
+    GuestAiocb request{};
+    request.fildes = descriptor;
+    request.buf = buffer;
+    request.nbytes = bytes;
+    request.offset = offset;
+    return request;
+}
+
+void Wait(GuestAiocb& request) {
+    const GuestAiocb* list[] = {&request};
+    Require(aio_suspend_nid_postfix(list, 1, nullptr) == 0);
+}
+
+void BeforeUse() {
+    GuestAiocb request{};
+    const GuestAiocb* list[] = {&request};
+    Require(aio_error_nid_postfix(&request) == Einval);
+    Require(aio_return_nid_postfix(&request) == -1 && Error() == Einval);
+    Require(aio_suspend_nid_postfix(list, 1, nullptr) == -1 && Error() == Eagain);
+}
+
+void Validation(int file, int readOnly) {
+    char buffer[8] = {};
+    Require(aio_read_nid_postfix(nullptr) == -1 && Error() == Efault);
+
+    auto bad = Request(-1, buffer, sizeof(buffer));
+    Require(aio_read_nid_postfix(&bad) == -1 && Error() == Ebadf);
+    Require(bad.status == -1 && bad.error == Ebadf && aio_error_nid_postfix(&bad) == Ebadf);
+
+    auto readOnlyWrite = Request(readOnly, buffer, sizeof(buffer));
+    Require(aio_write_nid_postfix(&readOnlyWrite) == -1 && Error() == Ebadf);
+
+    auto negative = Request(file, buffer, sizeof(buffer), -1);
+    Require(aio_read_nid_postfix(&negative) == -1 && Error() == Einval && negative.error == Einval);
+
+    auto huge = Request(file, buffer, std::uint64_t{std::numeric_limits<int>::max()} + 1);
+    Require(aio_read_nid_postfix(&huge) == -1 && Error() == Einval && huge.error == 0);
+
+    auto notify = Request(file, buffer, sizeof(buffer));
+    notify.sigevent.notify = 2;
+    Require(aio_read_nid_postfix(&notify) == -1 && Error() == Einval && notify.error == Einval);
+    notify.sigevent = {1, 0, 0, {}};
+    Require(aio_read_nid_postfix(&notify) == -1 && Error() == Einval);
+
+    int pipe[2] = {-1, -1};
+    Require(pipe_nid_postfix(pipe) == 0);
+    auto piped = Request(pipe[0], buffer, sizeof(buffer));
+    Require(aio_read_nid_postfix(&piped) == -1 && Error() == Eopnotsupp && piped.error == Eopnotsupp);
+    auto pipeSync = Request(pipe[1], nullptr, 0);
+    Require(aio_fsync_nid_postfix(OSync, &pipeSync) == -1 && Error() == Einval);
+    Require(close_nid_postfix(pipe[0]) == 0 && close_nid_postfix(pipe[1]) == 0);
+
+    auto sync = Request(file, nullptr, 0);
+    Require(aio_fsync_nid_postfix(0, &sync) == -1 && Error() == Einval);
+    Require(aio_fsync_nid_postfix(ODsync, &sync) == -1 && Error() == Einval);
+}
+
+void ReadAndWrite(int file) {
+    char text[] = "asynchronous";
+    auto write = Request(file, text, 12, 4);
+    Require(aio_write_nid_postfix(&write) == 0);
+    Wait(write);
+    Require(aio_error_nid_postfix(&write) == 0);
+    Require(aio_return_nid_postfix(&write) == 12 && write.status == 12 && write.error == 0);
+    Require(aio_return_nid_postfix(&write) == -1 && Error() == Einval);
+    Require(aio_error_nid_postfix(&write) == Einval);
+
+    char read[16] = {};
+    auto request = Request(file, read, sizeof(read), 6);
+    Require(aio_read_nid_postfix(&request) == 0);
+    Wait(request);
+    Require(aio_return_nid_postfix(&request) == 10 && std::memcmp(read, "ynchronous", 10) == 0);
+
+    auto empty = Request(file, read, 0, 0);
+    Require(aio_read_nid_postfix(&empty) == 0);
+    Wait(empty);
+    Require(aio_return_nid_postfix(&empty) == 0);
+
+    const GuestAiocb* none[] = {&request};
+    Require(aio_suspend_nid_postfix(none, 1, nullptr) == 0);
+    Require(aio_suspend_nid_postfix(none, 0, nullptr) == 0);
+    Require(aio_suspend_nid_postfix(none, -1, nullptr) == -1 && Error() == Einval);
+    Require(aio_suspend_nid_postfix(none, 257, nullptr) == -1 && Error() == Einval);
+    const KernelTimespec badTime{0, 1000000000};
+    Require(aio_suspend_nid_postfix(none, 1, &badTime) == -1 && Error() == Einval);
+}
+
+void Cancel(int file) {
+    char buffer[4] = {};
+    AioHoldWorkerForTest_nid_no_patch(true);
+    auto first = Request(file, buffer, sizeof(buffer));
+    auto second = Request(file, buffer, sizeof(buffer));
+    Require(aio_read_nid_postfix(&first) == 0 && aio_read_nid_postfix(&second) == 0);
+    Require(first.error == Einprogress && aio_error_nid_postfix(&first) == Einprogress);
+    const GuestAiocb* list[] = {&first};
+    const KernelTimespec brief{0, 5000000};
+    Require(aio_suspend_nid_postfix(list, 1, &brief) == -1 && Error() == Eagain);
+
+    Require(aio_cancel_nid_postfix(file, &first) == AioCanceled);
+    Require(aio_error_nid_postfix(&first) == Ecanceled && aio_error_nid_postfix(&second) == Einprogress);
+    Require(aio_suspend_nid_postfix(list, 1, &brief) == 0);
+    Require(aio_return_nid_postfix(&first) == -1 && Error() == Ecanceled);
+    Require(first.status == -1 && first.error == Ecanceled);
+    Require(aio_return_nid_postfix(&first) == -1 && Error() == Einval);
+    Require(aio_cancel_nid_postfix(file, &first) == AioAllDone);
+
+    Require(aio_cancel_nid_postfix(file, nullptr) == AioCanceled);
+    Require(aio_return_nid_postfix(&second) == -1 && Error() == Ecanceled);
+    Require(aio_cancel_nid_postfix(file, nullptr) == AioAllDone);
+    Require(aio_cancel_nid_postfix(-1, nullptr) == -1 && Error() == Ebadf);
+    AioHoldWorkerForTest_nid_no_patch(false);
+}
+
+void SyncOrder(int file) {
+    char text[] = "ordered";
+    AioHoldWorkerForTest_nid_no_patch(true);
+    auto write = Request(file, text, 7, 0);
+    auto sync = Request(file, nullptr, 0);
+    Require(aio_write_nid_postfix(&write) == 0 && aio_fsync_nid_postfix(OSync, &sync) == 0);
+    Require(aio_error_nid_postfix(&sync) == Einprogress);
+    AioHoldWorkerForTest_nid_no_patch(false);
+
+    GuestAiocb* done = nullptr;
+    Require(aio_waitcomplete_nid_postfix(&done, nullptr) == 7 && done == &write);
+    Require(aio_waitcomplete_nid_postfix(&done, nullptr) == 0 && done == &sync && sync.status == 0);
+    const KernelTimespec zero{0, 0};
+    Require(aio_waitcomplete_nid_postfix(&done, &zero) == -1 && Error() == Eagain && done == nullptr);
+    const KernelTimespec brief{0, 5000000};
+    Require(aio_waitcomplete_nid_postfix(&done, &brief) == -1 && Error() == Eagain);
+    const KernelTimespec badTime{0, -1};
+    Require(aio_waitcomplete_nid_postfix(&done, &badTime) == -1 && Error() == Einval);
+}
+
+}
+
+int main() {
+    const auto path = "anyps5-kernel-sys-aio-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".bin";
+    BeforeUse();
+    const int file = open_nid_postfix(path.c_str(), ORdwr | OCreat, 0600);
+    const int readOnly = open_nid_postfix(path.c_str(), ORdonly, 0);
+    Require(file >= 0 && readOnly >= 0);
+    Validation(file, readOnly);
+    ReadAndWrite(file);
+    Cancel(file);
+    SyncOrder(file);
+    Require(close_nid_postfix(readOnly) == 0 && close_nid_postfix(file) == 0);
+    Require(std::filesystem::remove(path));
+    std::puts("guest_kernel_sys_aio passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysBarrier.cpp b/core/libs/tests/GuestKernelSysBarrier.cpp
new file mode 100644
index 0000000000..084228c772
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysBarrier.cpp
@@ -0,0 +1,83 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <array>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+
+static constexpr int PROCESS_PRIVATE = 0;
+static constexpr int PROCESS_SHARED = 1;
+static constexpr int BARRIER_SERIAL_THREAD = -1;
+static constexpr int MS_ASYNC = 0x1;
+static constexpr int MS_INVALIDATE = 0x2;
+static constexpr unsigned WAITERS = 4;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+struct Context {
+    PthreadBarrierPrivate* barrier = nullptr;
+    std::atomic<int> serial{0};
+    std::atomic<int> released{0};
+};
+
+static void* APS5_VABI Waiter(void* arg) {
+    auto& context = *static_cast<Context*>(arg);
+    const int result = scePthreadBarrierWait(&context.barrier);
+    if (result == BARRIER_SERIAL_THREAD) ++context.serial;
+    else if (result == 0) ++context.released;
+    else std::abort();
+    return nullptr;
+}
+
+int main() {
+    PthreadBarrierattrPrivate* attr = nullptr;
+    Require(scePthreadBarrierattrInit(nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadBarrierattrInit(&attr) == 0 && attr != nullptr);
+    int pshared = -1;
+    Require(scePthreadBarrierattrGetpshared(&attr, &pshared) == 0 && pshared == PROCESS_PRIVATE);
+    Require(scePthreadBarrierattrSetpshared(&attr, PROCESS_SHARED) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadBarrierattrSetpshared(&attr, PROCESS_PRIVATE) == 0);
+
+    Context context;
+    Require(scePthreadBarrierInit(&context.barrier, &attr, 0, "zero") == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadBarrierInit(&context.barrier, &attr, 0x80000000u, "over") == SCE_KERNEL_ERROR_EINVAL && context.barrier == nullptr);
+    Require(scePthreadBarrierInit(nullptr, &attr, WAITERS, "null") == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadBarrierInit(&context.barrier, &attr, WAITERS, "barrier") == 0 && context.barrier != nullptr);
+    Require(scePthreadBarrierattrDestroy(&attr) == 0 && attr == nullptr);
+    Require(scePthreadBarrierattrDestroy(&attr) == SCE_KERNEL_ERROR_EINVAL);
+
+    for (int round = 0; round < 2; ++round) {
+        context.serial = 0;
+        context.released = 0;
+        std::array<Pthread, WAITERS> threads{};
+        for (auto& thread : threads) Require(scePthreadCreate(&thread, nullptr, Waiter, &context, nullptr) == 0);
+        for (auto& thread : threads) Require(scePthreadJoin(thread, nullptr) == 0);
+        Require(context.serial == 1 && context.released == static_cast<int>(WAITERS) - 1);
+    }
+    Require(scePthreadBarrierDestroy(&context.barrier) == 0 && context.barrier == nullptr);
+    Require(scePthreadBarrierDestroy(&context.barrier) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadBarrierWait(nullptr) == SCE_KERNEL_ERROR_EINVAL);
+
+    PthreadBarrierPrivate* single = nullptr;
+    Require(scePthreadBarrierInit(&single, nullptr, 1, nullptr) == 0);
+    Require(scePthreadBarrierWait(&single) == BARRIER_SERIAL_THREAD);
+    Require(scePthreadBarrierDestroy(&single) == 0);
+
+    int clock = 0;
+    int posixClock = 0;
+    Require(scePthreadGetcpuclockid(scePthreadSelf(), &clock) == 0);
+    Require(pthread_getcpuclockid_nid_postfix(scePthreadSelf(), &posixClock) == 0 && clock == posixClock);
+    Require(scePthreadGetcpuclockid(scePthreadSelf(), nullptr) == SCE_KERNEL_ERROR_EFAULT);
+    Require(scePthreadGetcpuclockid(nullptr, &clock) == SCE_KERNEL_ERROR_EINVAL);
+
+    Require(pthread_setconcurrency_nid_postfix(3) == 0 && scePthreadGetconcurrency() == 3);
+    Require(pthread_setconcurrency_nid_postfix(0) == 0 && scePthreadGetconcurrency() == 0);
+
+    auto* unmapped = reinterpret_cast<void*>(static_cast<std::uintptr_t>(0x4000));
+    Require(sceKernelMsync(unmapped, 0x4000, 0) == SCE_KERNEL_ERROR_ENOMEM);
+    Require(sceKernelMsync(unmapped, 0x4000, MS_ASYNC | MS_INVALIDATE) == SCE_KERNEL_ERROR_EINVAL);
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysKtimer.cpp b/core/libs/tests/GuestKernelSysKtimer.cpp
new file mode 100644
index 0000000000..bb189576b4
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysKtimer.cpp
@@ -0,0 +1,180 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+#include <thread>
+#include <vector>
+
+namespace {
+
+}
+
+namespace {
+
+constexpr int Efault = 14;
+constexpr int Einval = 22;
+constexpr int Eagain = 35;
+constexpr int ClockRealtime = 0;
+constexpr int ClockMonotonic = 4;
+constexpr int ClockUptime = 5;
+constexpr int TimerAbstime = 1;
+constexpr std::int64_t Millisecond = 1000000;
+constexpr std::int64_t Second = 1000000000;
+
+const GuestSigevent None{0, 0, 0, {}};
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+int Error() {
+    return *__error_nid_postfix();
+}
+
+std::int64_t Nanoseconds(const KernelTimespec& time) {
+    return time.tv_sec * Second + time.tv_nsec;
+}
+
+int Create(int clock = ClockMonotonic) {
+    int id = -1;
+    Require(ktimer_create_nid_postfix(clock, &None, &id) == 0);
+    return id;
+}
+
+GuestItimerspec Get(int id) {
+    GuestItimerspec value{{-1, -1}, {-1, -1}};
+    Require(ktimer_gettime_nid_postfix(id, &value) == 0);
+    return value;
+}
+
+void Sleep(std::int64_t nanoseconds) {
+    std::this_thread::sleep_for(std::chrono::nanoseconds(nanoseconds));
+}
+
+void Creation() {
+    int id = -1;
+    const GuestSigevent badNotify{2, 0, 0, {}};
+    const GuestSigevent noSignal{1, 0, 0, {}};
+    const GuestSigevent badSignal{4, 129, 0, {}};
+    Require(ktimer_create_nid_postfix(ClockUptime, &None, &id) == -1 && Error() == Einval && id == -1);
+    Require(ktimer_create_nid_postfix(-1, &None, &id) == -1 && Error() == Einval);
+    Require(ktimer_create_nid_postfix(ClockMonotonic, &badNotify, &id) == -1 && Error() == Einval);
+    Require(ktimer_create_nid_postfix(ClockMonotonic, &noSignal, &id) == -1 && Error() == Einval);
+    Require(ktimer_create_nid_postfix(ClockMonotonic, &badSignal, &id) == -1 && Error() == Einval);
+    Require(ktimer_create_nid_postfix(ClockMonotonic, &None, nullptr) == -1 && Error() == Efault);
+
+    std::vector<int> ids;
+    for (int expected = 3; expected < 32; ++expected) {
+        ids.push_back(Create(expected % 2 == 0 ? ClockRealtime : ClockMonotonic));
+        Require(ids.back() == expected);
+    }
+    Require(ktimer_create_nid_postfix(ClockMonotonic, &None, &id) == -1 && Error() == Eagain);
+    Require(ktimer_delete_nid_postfix(7) == 0);
+    Require(Create() == 7);
+    for (const int each : ids) Require(ktimer_delete_nid_postfix(each) == 0);
+}
+
+void InvalidIds() {
+    GuestItimerspec value{};
+    const int id = Create();
+    Require(ktimer_delete_nid_postfix(id) == 0);
+    for (const int bad : {-1, 0, 2, id, 32}) {
+        Require(ktimer_delete_nid_postfix(bad) == -1 && Error() == Einval);
+        Require(ktimer_settime_nid_postfix(bad, 0, &value, nullptr) == -1 && Error() == Einval);
+        Require(ktimer_gettime_nid_postfix(bad, &value) == -1 && Error() == Einval);
+        Require(ktimer_getoverrun_nid_postfix(bad) == -1 && Error() == Einval);
+    }
+    Require(ktimer_settime_nid_postfix(id, 0, nullptr, nullptr) == -1 && Error() == Efault);
+}
+
+void Values() {
+    const int id = Create();
+    GuestItimerspec disarmed = Get(id);
+    Require(Nanoseconds(disarmed.it_value) == 0 && Nanoseconds(disarmed.it_interval) == 0);
+    for (const GuestItimerspec bad : {GuestItimerspec{{0, 0}, {-1, 0}}, GuestItimerspec{{0, 0}, {0, -1}}, GuestItimerspec{{0, 0}, {0, Second}},
+                                 GuestItimerspec{{-1, 0}, {1, 0}}, GuestItimerspec{{0, Second}, {1, 0}}})
+        Require(ktimer_settime_nid_postfix(id, 0, &bad, nullptr) == -1 && Error() == Einval);
+
+    const GuestItimerspec clear{{-1, 0}, {0, 0}};
+    Require(ktimer_settime_nid_postfix(id, 0, &clear, nullptr) == 0);
+    disarmed = Get(id);
+    Require(Nanoseconds(disarmed.it_value) == 0 && Nanoseconds(disarmed.it_interval) == 0);
+
+    const GuestItimerspec small{{0, 1}, {10, 0}};
+    Require(ktimer_settime_nid_postfix(id, 0, &small, nullptr) == 0);
+    GuestItimerspec old{};
+    const GuestItimerspec later{{0, 0}, {20, 0}};
+    Require(ktimer_settime_nid_postfix(id, 0, &later, &old) == 0);
+    Require(Nanoseconds(old.it_interval) == Millisecond);
+    Require(Nanoseconds(old.it_value) > 9 * Second && Nanoseconds(old.it_value) <= 10 * Second);
+    const GuestItimerspec tiny{{0, 0}, {0, 1}};
+    Require(ktimer_settime_nid_postfix(id, 0, &tiny, &old) == 0);
+    Require(Nanoseconds(old.it_value) > 19 * Second && Nanoseconds(old.it_value) <= 20 * Second);
+    const GuestItimerspec off{};
+    Require(ktimer_settime_nid_postfix(id, 0, &off, &old) == 0);
+    Require(Nanoseconds(old.it_interval) == 0 && Nanoseconds(old.it_value) <= Millisecond);
+    Require(ktimer_delete_nid_postfix(id) == 0);
+}
+
+void Expiry() {
+    const int id = Create();
+    const GuestItimerspec once{{0, 0}, {0, 30 * Millisecond}};
+    Require(ktimer_settime_nid_postfix(id, 0, &once, nullptr) == 0);
+    const auto running = Get(id);
+    Require(Nanoseconds(running.it_value) > 0 && Nanoseconds(running.it_value) <= 30 * Millisecond);
+    Sleep(60 * Millisecond);
+    const auto expired = Get(id);
+    Require(Nanoseconds(expired.it_value) == 0 && Nanoseconds(expired.it_interval) == 0);
+    Require(ktimer_getoverrun_nid_postfix(id) == 0);
+
+    const GuestItimerspec periodic{{0, 10 * Millisecond}, {0, 10 * Millisecond}};
+    Require(ktimer_settime_nid_postfix(id, 0, &periodic, nullptr) == 0);
+    Sleep(55 * Millisecond);
+    const auto period = Get(id);
+    Require(Nanoseconds(period.it_interval) == 10 * Millisecond);
+    Require(Nanoseconds(period.it_value) > 0 && Nanoseconds(period.it_value) <= 10 * Millisecond);
+    Require(ktimer_getoverrun_nid_postfix(id) == 0);
+    Require(ktimer_delete_nid_postfix(id) == 0);
+}
+
+void Absolute() {
+    for (const int clock : {ClockRealtime, ClockMonotonic}) {
+        const int id = Create(clock);
+        KernelTimespec now{};
+        Require(clock_gettime_nid_postfix(clock, &now) == 0);
+        const GuestItimerspec future{{0, 0}, {now.tv_sec + 5, now.tv_nsec}};
+        Require(ktimer_settime_nid_postfix(id, TimerAbstime, &future, nullptr) == 0);
+        const auto remaining = Get(id);
+        Require(Nanoseconds(remaining.it_value) > 4 * Second && Nanoseconds(remaining.it_value) <= 5 * Second);
+
+        const GuestItimerspec past{{0, 0}, {now.tv_sec - 1, now.tv_nsec}};
+        Require(ktimer_settime_nid_postfix(id, TimerAbstime, &past, nullptr) == 0);
+        Require(Nanoseconds(Get(id).it_value) == 0);
+        const GuestItimerspec pastPeriodic{{1, 0}, {now.tv_sec - 10, now.tv_nsec}};
+        Require(ktimer_settime_nid_postfix(id, TimerAbstime, &pastPeriodic, nullptr) == 0);
+        const auto moved = Get(id);
+        Require(Nanoseconds(moved.it_value) > 0 && Nanoseconds(moved.it_value) <= Second);
+        Require(Nanoseconds(moved.it_interval) == Second);
+        Require(ktimer_delete_nid_postfix(id) == 0);
+    }
+}
+
+}
+
+int main() {
+    Creation();
+    InvalidIds();
+    Values();
+    Expiry();
+    Absolute();
+    std::puts("guest_kernel_sys_ktimer passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysModuleInternal.cpp b/core/libs/tests/GuestKernelSysModuleInternal.cpp
new file mode 100644
index 0000000000..2674a6ab3d
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysModuleInternal.cpp
@@ -0,0 +1,83 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libkernel/KernelErrors.hpp"
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <string>
+#include <vector>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static std::vector<KernelModule> List(int (APS5_VABI* list)(KernelModule*, std::size_t, std::size_t*)) {
+    std::vector<KernelModule> handles(256, -1);
+    std::size_t count = 0;
+    Require(list(handles.data(), handles.size(), &count) == 0);
+    Require(count > 0 && count < handles.size());
+    handles.resize(count);
+    return handles;
+}
+
+static void CheckList() {
+    const auto internal = List(sceKernelGetModuleListInternal);
+    Require(internal == List(sceKernelGetModuleList));
+    std::vector<KernelModule> shorter(internal.size(), -1);
+    std::size_t untouched = 99;
+    Require(sceKernelGetModuleListInternal(shorter.data(), internal.size() - 1, &untouched) == SCE_KERNEL_ERROR_ENOMEM);
+    Require(untouched == 99 && shorter.back() == -1);
+    Require(sceKernelGetModuleListInternal(nullptr, 0, &untouched) == SCE_KERNEL_ERROR_EFAULT);
+    Require(sceKernelGetModuleListInternal(shorter.data(), shorter.size(), nullptr) == SCE_KERNEL_ERROR_EFAULT);
+}
+
+static void CheckEachModule() {
+    for (const auto handle : List(sceKernelGetModuleListInternal)) {
+        ModuleInfoEx extended{};
+        extended.st_size = sizeof(ModuleInfoEx);
+        Require(sceKernelGetModuleInfoInternal(handle, &extended) == 0);
+        ModuleInfo basic{};
+        basic.st_size = sizeof(ModuleInfo);
+        Require(sceKernelGetModuleInfo(handle, &basic) == 0);
+        Require(extended.st_size == sizeof(ModuleInfoEx) && extended.id == handle);
+        Require(std::string(extended.name) == basic.name && extended.segment_count == basic.segment_count);
+        for (std::uint32_t i = 0; i < basic.segment_count; ++i)
+            Require(extended.segments[i].address == basic.segments[i].address && extended.segments[i].size == basic.segments[i].size &&
+                    extended.segments[i].prot == basic.segments[i].prot);
+    }
+}
+
+static void CheckMatchesAddressLookup() {
+    ModuleInfoEx byAddress{};
+    byAddress.st_size = sizeof(ModuleInfoEx);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(&sceKernelGetModuleInfo), 1, &byAddress) == 0);
+    ModuleInfoEx byHandle{};
+    byHandle.st_size = sizeof(ModuleInfoEx);
+    Require(sceKernelGetModuleInfoInternal(byAddress.id, &byHandle) == 0);
+    Require(byAddress.st_size == 0 && byHandle.st_size == sizeof(ModuleInfoEx));
+    Require(std::memcmp(byHandle.name, byAddress.name, sizeof(ModuleInfoEx) - offsetof(ModuleInfoEx, name)) == 0);
+}
+
+static void CheckRefusals() {
+    const auto handle = List(sceKernelGetModuleListInternal).front();
+    for (const std::uint64_t size : {0x160, 0x1a4, 0x1b0, 0}) {
+        ModuleInfoEx sized{};
+        sized.st_size = size;
+        sized.name[0] = 'x';
+        Require(sceKernelGetModuleInfoInternal(handle, &sized) == SCE_KERNEL_ERROR_EINVAL);
+        Require(sized.st_size == size && sized.name[0] == 'x');
+    }
+    Require(sceKernelGetModuleInfoInternal(handle, nullptr) == SCE_KERNEL_ERROR_EFAULT);
+    ModuleInfoEx unknown{};
+    unknown.st_size = sizeof(ModuleInfoEx);
+    Require(sceKernelGetModuleInfoInternal(-1, &unknown) == SCE_KERNEL_ERROR_ESRCH && unknown.name[0] == '\0');
+}
+
+int main() {
+    CheckList();
+    CheckEachModule();
+    CheckMatchesAddressLookup();
+    CheckRefusals();
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysPselect.cpp b/core/libs/tests/GuestKernelSysPselect.cpp
new file mode 100644
index 0000000000..773ab2b80a
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysPselect.cpp
@@ -0,0 +1,101 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+
+namespace {
+
+constexpr int Einval = 22;
+constexpr int SigBlock = 1;
+constexpr int SigSetmask = 3;
+constexpr int SigUsr1 = 30;
+
+struct Timespec {
+    std::int64_t seconds;
+    std::int64_t nanoseconds;
+};
+
+struct SignalSet {
+    std::uint32_t bits[4]{};
+};
+
+struct DescriptorSet {
+    std::array<std::uint64_t, 1024 / 64> words{};
+    void Add(int descriptor) { words[descriptor / 64] |= std::uint64_t{1} << (descriptor % 64); }
+    bool Has(int descriptor) const { return ((words[descriptor / 64] >> (descriptor % 64)) & 1u) != 0; }
+};
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+int Error() {
+    return *__error_nid_postfix();
+}
+
+SignalSet CurrentMask() {
+    SignalSet current{};
+    Require(sigprocmask_nid_postfix(SigBlock, nullptr, &current) == 0);
+    return current;
+}
+
+bool Same(const SignalSet& left, const SignalSet& right) {
+    return std::memcmp(left.bits, right.bits, sizeof(left.bits)) == 0;
+}
+
+}
+
+int main() {
+    int descriptors[2]{-1, -1};
+    Require(pipe_nid_postfix(descriptors) == 0);
+    const int reader = descriptors[0];
+    const int writer = descriptors[1];
+    SignalSet blocked{};
+    blocked.bits[(SigUsr1 - 1) / 32] |= 1u << ((SigUsr1 - 1) % 32);
+    const SignalSet before = CurrentMask();
+    {
+        DescriptorSet read{};
+        read.Add(reader);
+        const Timespec limit{0, 200000000};
+        const auto start = std::chrono::steady_clock::now();
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit, &blocked) == 0);
+        Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(150));
+        Require(!read.Has(reader));
+        Require(Same(CurrentMask(), before));
+    }
+    Require(write_nid_postfix(writer, "x", 1) == 1);
+    {
+        DescriptorSet read{};
+        read.Add(reader);
+        const Timespec limit{0, 999999999};
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit, nullptr) == 1);
+        Require(read.Has(reader));
+    }
+    {
+        DescriptorSet read{};
+        read.Add(reader);
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, nullptr, &blocked) == 1);
+        Require(read.Has(reader));
+        Require(Same(CurrentMask(), before));
+    }
+    {
+        const Timespec invalid{0, 1000000000};
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, &invalid, &blocked) == -1 && Error() == Einval);
+        Require(Same(CurrentMask(), before));
+        const Timespec zero{0, 0};
+        Require(pselect_nid_postfix(-1, nullptr, nullptr, nullptr, &zero, nullptr) == -1 && Error() == Einval);
+    }
+    Require(sigprocmask_nid_postfix(SigSetmask, &before, nullptr) == 0);
+    Require(close_nid_postfix(reader) == 0 && close_nid_postfix(writer) == 0);
+    std::puts("pselect passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysPthread.cpp b/core/libs/tests/GuestKernelSysPthread.cpp
new file mode 100644
index 0000000000..1fbcc5054b
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysPthread.cpp
@@ -0,0 +1,58 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libkernel/Pthread/include/Atfork.hpp"
+#include <cstdlib>
+
+static constexpr int SCOPE_PROCESS = 0;
+static constexpr int SCOPE_SYSTEM = 2;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static void APS5_VABI Prepare() {}
+static void APS5_VABI Parent() {}
+static void APS5_VABI Child() {}
+
+static void TestScope() {
+    PthreadAttr attr{};
+    Require(scePthreadAttrInit(&attr) == 0);
+    int scope = -1;
+    Require(scePthreadAttrGetscope(&attr, &scope) == 0 && scope == SCOPE_SYSTEM);
+    Require(scePthreadAttrSetscope(&attr, SCOPE_PROCESS) == 0);
+    Require(scePthreadAttrGetscope(&attr, &scope) == 0 && scope == SCOPE_PROCESS);
+    for (const int invalid : {1, 3, -1}) {
+        Require(scePthreadAttrSetscope(&attr, invalid) == SCE_KERNEL_ERROR_EINVAL);
+        scope = -1;
+        Require(scePthreadAttrGetscope(&attr, &scope) == 0 && scope == SCOPE_PROCESS);
+    }
+    Require(scePthreadAttrSetscope(&attr, SCOPE_SYSTEM) == 0);
+    Require(scePthreadAttrGetscope(&attr, &scope) == 0 && scope == SCOPE_SYSTEM);
+    Require(scePthreadAttrGetscope(&attr, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadAttrGetscope(nullptr, &scope) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadAttrSetscope(nullptr, SCOPE_PROCESS) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadAttrDestroy(&attr) == 0);
+}
+
+static void TestConcurrency() {
+    Require(scePthreadSetconcurrency(3) == 0 && scePthreadGetconcurrency() == 3);
+    Require(scePthreadSetconcurrency(-1) == SCE_KERNEL_ERROR_EINVAL && scePthreadGetconcurrency() == 3);
+    Require(scePthreadSetconcurrency(0) == 0 && scePthreadGetconcurrency() == 0);
+}
+
+static void TestAtfork() {
+    const auto before = PthreadAtforkHandlers_nid_no_patch().size();
+    Require(scePthreadAtfork(Prepare, Parent, Child) == 0);
+    Require(scePthreadAtfork(nullptr, nullptr, nullptr) == 0);
+    const auto handlers = PthreadAtforkHandlers_nid_no_patch();
+    Require(handlers.size() == before + 2);
+    Require(handlers[before].prepare == Prepare && handlers[before].parent == Parent && handlers[before].child == Child);
+    Require(handlers[before + 1].prepare == nullptr && handlers[before + 1].parent == nullptr && handlers[before + 1].child == nullptr);
+}
+
+int main() {
+    TestScope();
+    TestConcurrency();
+    TestAtfork();
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysSdkVersion.cpp b/core/libs/tests/GuestKernelSysSdkVersion.cpp
new file mode 100644
index 0000000000..dc20a51ac8
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysSdkVersion.cpp
@@ -0,0 +1,44 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "ProcessParametersFixture.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+namespace {
+
+alignas(16) std::array<std::byte, 0x40> process{};
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "KERNEL SYS SDK VERSION: %s\n", message);
+        std::abort();
+    }
+}
+
+}
+
+int main() {
+    const std::uint64_t size = process.size();
+    const std::uint32_t magic = 0x4942524f;
+    const std::uint32_t ps4SdkVersion = 0x07008001;
+    const std::uint32_t ps5SdkVersion = 0x0a008001;
+    std::memcpy(process.data(), &size, sizeof(size));
+    std::memcpy(process.data() + 8, &magic, sizeof(magic));
+    std::memcpy(process.data() + 0x10, &ps4SdkVersion, sizeof(ps4SdkVersion));
+    std::memcpy(process.data() + 0x14, &ps5SdkVersion, sizeof(ps5SdkVersion));
+    Require(ProcessParametersFixture::Install(process.data(), process.size()), "process parameters were not installed");
+
+    Require(sceKernelGetCompiledSdkVersion(nullptr) == static_cast<int>(0x80020016), "null output is not EINVAL");
+    std::array<std::int32_t, 2> output{-1, 0x5a5a5a5a};
+    Require(sceKernelGetCompiledSdkVersion(output.data()) == 0, "query failed");
+    Require(output[0] == 0x07008001, "version is not the 32-bit field at offset 0x10 of the process parameters");
+    Require(output[1] == 0x5a5a5a5a, "the query wrote past the version");
+
+    std::puts("KERNEL SYS SDK VERSION tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestKernelSysThreadDefaults.cpp b/core/libs/tests/GuestKernelSysThreadDefaults.cpp
index 18a48b8f15..f38f272d56 100644
--- a/core/libs/tests/GuestKernelSysThreadDefaults.cpp
+++ b/core/libs/tests/GuestKernelSysThreadDefaults.cpp
@@ -1,23 +1,11 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI pthread_set_defaultstacksize_np_nid_postfix(std::size_t size);
-int APS5_VABI scePthreadSetDefaultstacksize(std::size_t size);
-void APS5_VABI scePthreadSetName(Pthread thread, const char* name);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, std::size_t* stackSize);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int POSIX_EINVAL = 22;
 static constexpr std::size_t INITIAL_DEFAULT = 1u << 20;
 
@@ -70,9 +58,11 @@ static void CheckDefaultStackSize() {
 static void CheckSetName() {
     char name[32] = {};
     scePthreadSetName(scePthreadSelf(), "renamed main");
+
     Require(scePthreadGetname(scePthreadSelf(), name) == 0);
     Require(std::strcmp(name, "renamed main") == 0);
     scePthreadSetName(scePthreadSelf(), nullptr);
+
     Require(scePthreadGetname(scePthreadSelf(), name) == 0);
     Require(name[0] == '\0');
 }
diff --git a/core/libs/tests/GuestKill.cpp b/core/libs/tests/GuestKill.cpp
index 7b75694ea5..162e1b47ed 100644
--- a/core/libs/tests/GuestKill.cpp
+++ b/core/libs/tests/GuestKill.cpp
@@ -1,16 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <csignal>
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 using Handler = void (APS5_VABI *)(int);
-extern "C" {
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI kill_nid_postfix(int, int);
-int APS5_VABI killpg_nid_postfix(int, int);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-}
+
 volatile std::sig_atomic_t received = 0;
 void APS5_VABI Callback(int value) { received = value; }
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestKqueue.cpp b/core/libs/tests/GuestKqueue.cpp
index 62085d4470..4400651e3c 100644
--- a/core/libs/tests/GuestKqueue.cpp
+++ b/core/libs/tests/GuestKqueue.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <cctype>
@@ -15,33 +17,14 @@
 #include <aclapi.h>
 #include <windows.h>
 #endif
+#include <fcntl.h>
+#ifdef _WIN32
+#include <io.h>
+#else
+#include <unistd.h>
+#endif
 
-extern "C" {
-int APS5_VABI kqueue_nid_postfix();
-int APS5_VABI kevent_nid_postfix(int, const KernelEvent*, int, KernelEvent*, int, const KernelTimespec*);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI rmdir_nid_postfix(const char*);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddFileEvent(KernelEqueue eq, int fd, int watch, void* udata);
-int APS5_VABI sceKernelDeleteFileEvent(KernelEqueue eq, int fd);
-int* APS5_VABI __error_nid_postfix();
-}
-
+static constexpr int GuestEperm = 1;
 static constexpr int GuestEnoent = 2;
 static constexpr int GuestEbadf = 9;
 static constexpr int GuestEinval = 22;
@@ -56,9 +39,13 @@ static constexpr int FirstSocket = 0x10000000;
 static constexpr std::int16_t EvfiltRead = -1;
 static constexpr std::int16_t EvfiltWrite = -2;
 static constexpr std::int16_t EvfiltVnode = -4;
+static constexpr std::int16_t EvfiltAio = -3;
 static constexpr std::int16_t EvfiltProc = -5;
 static constexpr std::int16_t EvfiltTimer = -7;
+static constexpr std::int16_t EvfiltProcdesc = -8;
+static constexpr std::int16_t EvfiltLio = -10;
 static constexpr std::int16_t EvfiltUser = -11;
+static constexpr std::int16_t EvfiltSendfile = -12;
 static constexpr std::uint16_t EvAdd = 0x0001;
 static constexpr std::uint16_t EvDelete = 0x0002;
 static constexpr std::uint16_t EvEnable = 0x0004;
@@ -186,7 +173,94 @@ static void Timers() {
     RequireFailure(Apply(kq, Change(3, EvfiltTimer, EvAdd, 0x10, 5)), GuestEinval);
     RequireFailure(Apply(kq, Change(3, EvfiltTimer, EvAdd, NoteUseconds | 0x1, 5)), GuestEinval);
     Require(Apply(kq, Change(4, EvfiltTimer, EvAdd, 0, 100000)) == 0);
-    Require(Throws([kq] { Apply(kq, Change(4, EvfiltTimer, EvAdd, 0, 5)); }));
+    Require(Apply(kq, Change(4, EvfiltTimer, EvAdd, 0, 5)) == 0);
+    const KernelTimespec fiftyMillis{0, 50000000};
+    Require(kevent_nid_postfix(kq, nullptr, 0, events, 4, &fiftyMillis) == 0);
+    Require(close_nid_postfix(kq) == 0);
+}
+
+static void TimerReadd() {
+    const int kq = kqueue_nid_postfix();
+    int first = 0;
+    int second = 0;
+    KernelEvent events[4]{};
+    Require(Apply(kq, Change(6, EvfiltTimer, EvAdd, 0, 10, &first)) == 0);
+    std::this_thread::sleep_for(std::chrono::milliseconds(100));
+    Require(Apply(kq, Change(6, EvfiltTimer, EvAdd, 0, 1000, &second)) == 0);
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == 6 && events[0].data >= 6 && events[0].udata == &second);
+    Require(Apply(kq, Change(6, EvfiltTimer, EvDelete)) == 0);
+
+    const auto armed = std::chrono::steady_clock::now();
+    Require(Apply(kq, Change(7, EvfiltTimer, EvAdd, 0, 50)) == 0);
+    Require(Apply(kq, Change(7, EvfiltTimer, EvAdd, 0, 10)) == 0);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 7);
+    Require(std::chrono::steady_clock::now() - armed >= std::chrono::milliseconds(49));
+    std::this_thread::sleep_for(std::chrono::milliseconds(120));
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == 7 && events[0].data >= 6);
+    Require(Apply(kq, Change(7, EvfiltTimer, EvDelete)) == 0);
+
+    Require(Apply(kq, Change(8, EvfiltTimer, EvAdd, 0, 10)) == 0);
+    Require(Apply(kq, Change(8, EvfiltTimer, EvAdd, 0, 100)) == 0);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 8);
+    std::this_thread::sleep_for(std::chrono::milliseconds(120));
+    Require(Poll(kq, events, 4) == 1 && events[0].ident == 8 && events[0].data >= 1 && events[0].data <= 4);
+    Require(Apply(kq, Change(8, EvfiltTimer, EvDelete)) == 0);
+
+    Require(Apply(kq, Change(9, EvfiltTimer, EvAdd, 0, 20)) == 0);
+    Require(Apply(kq, Change(9, EvfiltTimer, EvAdd | EvOneshot, 0, 20)) == 0);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 9);
+    Require(Wait(kq, events, 4) == 1 && events[0].ident == 9);
+    Require(Apply(kq, Change(9, EvfiltTimer, EvDelete)) == 0);
+
+    Require(Apply(kq, Change(10, EvfiltTimer, EvAdd | EvOneshot, 0, 100000)) == 0);
+    Require(Throws([kq] { Apply(kq, Change(10, EvfiltTimer, EvAdd, 0, 5)); }));
+    Require(Apply(kq, Change(11, EvfiltTimer, EvAdd, 0, 100000)) == 0);
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd, NoteUseconds, 5)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd, 0, 0)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd, 0, INTPTR_MAX)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvAdd | EvClear, 0, 5)); }));
+    Require(Throws([kq] { Apply(kq, Change(11, EvfiltTimer, EvEnable, 0, 5)); }));
+    Require(Apply(kq, Change(12, EvfiltTimer, EvAdd | EvDisable, 0, 100000)) == 0);
+    Require(Throws([kq] { Apply(kq, Change(12, EvfiltTimer, EvAdd, 0, 5)); }));
+    Require(close_nid_postfix(kq) == 0);
+}
+
+static void UnsupportedFilters() {
+    const int kq = kqueue_nid_postfix();
+    for (const std::int16_t filter : {EvfiltAio, EvfiltLio, EvfiltSendfile}) {
+        RequireFailure(Apply(kq, Change(0, filter, EvAdd)), GuestEperm);
+        RequireFailure(Apply(kq, Change(5, filter, EvAdd)), GuestEperm);
+        RequireFailure(Apply(kq, Change(5, filter, EvAdd | EvClear)), GuestEperm);
+        RequireFailure(Apply(kq, Change(5, filter, EvDelete)), GuestEnoent);
+        RequireFailure(Apply(kq, Change(5, filter, EvEnable)), GuestEnoent);
+        const KernelEvent add = Change(5, filter, EvAdd, 7, 9);
+        KernelEvent failed[1]{};
+        Require(kevent_nid_postfix(kq, &add, 1, failed, 1, nullptr) == 1);
+        Require(failed[0].flags == EvError && failed[0].data == GuestEperm && failed[0].fflags == 0);
+    }
+    int pipe[2];
+    Require(pipe_nid_postfix(pipe) == 0);
+    int pair[2];
+    Require(socketpair_nid_postfix(Unix, Stream, 0, pair) == 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pipe[0]), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pipe[1]), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pair[0]), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pair[0]), EvfiltProcdesc, EvDelete)), GuestEnoent);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(kq), EvfiltProcdesc, EvAdd)), GuestEinval);
+    RequireFailure(Apply(kq, Change(std::uintptr_t{1} << 40, EvfiltProcdesc, EvAdd)), GuestEbadf);
+    const KernelEvent attach = Change(static_cast<std::uintptr_t>(pipe[0]), EvfiltProcdesc, EvAdd, 7, 9);
+    KernelEvent failed[1]{};
+    Require(kevent_nid_postfix(kq, &attach, 1, failed, 1, nullptr) == 1);
+    Require(failed[0].flags == EvError && failed[0].data == GuestEinval && failed[0].fflags == 0);
+    const int random = open_nid_postfix("/dev/urandom", 0, 0);
+    Require(random >= 0);
+    Require(Throws([kq, random] { Apply(kq, Change(static_cast<std::uintptr_t>(random), EvfiltProcdesc, EvAdd)); }));
+    Require(Throws([kq] { Apply(kq, Change(2, EvfiltProcdesc, EvAdd)); }));
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(random), EvfiltProcdesc, EvDelete)), GuestEnoent);
+    Require(close_nid_postfix(random) == 0);
+    Require(close_nid_postfix(pipe[0]) == 0 && close_nid_postfix(pipe[1]) == 0);
+    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(pipe[0]), EvfiltProcdesc, EvAdd)), GuestEbadf);
     Require(close_nid_postfix(kq) == 0);
 }
 
@@ -828,7 +902,28 @@ static void Errors() {
 }
 
 static std::string TemporaryName(const char* stem) {
-    return std::string("anyps5-kqueue-") + stem + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    return std::string("anyps5-kqueue-") + stem + "-" + std::to_string(getpid_nid_postfix()) + "-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+}
+
+static void ProcdescOnFiles() {
+    const int kq = kqueue_nid_postfix();
+    const int other = kqueue_nid_postfix();
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(other), EvfiltProcdesc, EvAdd)), GuestEinval);
+    const auto path = TemporaryName("procdesc-file");
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create, 0644);
+    Require(file >= 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(file), EvfiltProcdesc, EvAdd)), GuestEinval);
+    Require(close_nid_postfix(file) == 0);
+    Require(std::filesystem::remove(path));
+    const auto folder = TemporaryName("procdesc-directory");
+    Require(std::filesystem::create_directory(folder));
+    const int directory = open_nid_postfix(folder.c_str(), Directory, 0);
+    Require(directory >= 0);
+    RequireFailure(Apply(kq, Change(static_cast<std::uintptr_t>(directory), EvfiltProcdesc, EvAdd)), GuestEinval);
+    Require(close_nid_postfix(directory) == 0);
+    Require(std::filesystem::remove(folder));
+    Require(close_nid_postfix(other) == 0);
+    Require(close_nid_postfix(kq) == 0);
 }
 
 static void FileWatch() {
@@ -1112,7 +1207,47 @@ static void Timeout() {
     Require(close_nid_postfix(kq) == 0);
 }
 
+static void ReplaceStandardInputWithNull() {
+#ifdef _WIN32
+    const int null = _open("NUL", _O_RDONLY);
+    Require(null >= 0);
+    if (null != 0) {
+        Require(_dup2(null, 0) == 0);
+        Require(_close(null) == 0);
+    }
+#else
+    const int null = ::open("/dev/null", O_RDONLY);
+    Require(null >= 0);
+    if (null != 0) {
+        Require(::dup2(null, 0) == 0);
+        Require(::close(null) == 0);
+    }
+#endif
+}
+
+static bool StandardInputAtEnd() {
+    char byte = 0;
+#ifdef _WIN32
+    return _read(0, &byte, 1) == 0;
+#else
+    return ::read(0, &byte, 1) == 0;
+#endif
+}
+
+static void StandardInputReplacement() {
+    ReplaceStandardInputWithNull();
+    Require(StandardInputAtEnd());
+#ifdef _WIN32
+    Require(_close(0) == 0);
+#else
+    Require(::close(0) == 0);
+#endif
+    ReplaceStandardInputWithNull();
+    Require(StandardInputAtEnd());
+}
+
 static void StandardInput() {
+    ReplaceStandardInputWithNull();
     const int copy = dup_nid_postfix(0);
     if (copy < 0) {
         Require(*__error_nid_postfix() == GuestEbadf);
@@ -1134,9 +1269,13 @@ static void StandardInput() {
 }
 
 int main() {
+    StandardInputReplacement();
     StandardInput();
     CreateAndClose();
     Timers();
+    TimerReadd();
+    UnsupportedFilters();
+    ProcdescOnFiles();
     PipeRead();
 #ifndef __APPLE__
     PipeWrite();
diff --git a/core/libs/tests/GuestLibcCndInitDefaultName.cpp b/core/libs/tests/GuestLibcCndInitDefaultName.cpp
index 6d5d046398..582215e686 100644
--- a/core/libs/tests/GuestLibcCndInitDefaultName.cpp
+++ b/core/libs/tests/GuestLibcCndInitDefaultName.cpp
@@ -1,13 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI _Cnd_init_with_default_name_override_nid_postfix(void** handle, const char* name);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TException, typename TCall>
@@ -28,6 +23,7 @@ int main() {
     Require(condition != nullptr);
     Require(_Cnd_signal_nid_postfix(&condition) == success);
     _Cnd_destroy_nid_postfix(&condition);
+
     Require(condition == nullptr);
 
     void* unnamed = nullptr;
@@ -37,6 +33,7 @@ int main() {
 
     RequireThrows<std::invalid_argument>([] {
         _Cnd_init_with_default_name_override_nid_postfix(nullptr, "NullHandle");
+
     });
     return 0;
 }
diff --git a/core/libs/tests/GuestLibcCndTimedWait.cpp b/core/libs/tests/GuestLibcCndTimedWait.cpp
index e85144f158..da073cf4f1 100644
--- a/core/libs/tests/GuestLibcCndTimedWait.cpp
+++ b/core/libs/tests/GuestLibcCndTimedWait.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <chrono>
@@ -14,23 +15,6 @@
 #include <windows.h>
 #endif
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
-extern "C" {
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_wait_nid_postfix(void** condition, void** mutex);
-int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
-int APS5_VABI _Cnd_timedwait_nid_postfix(void** condition, void** mutex, const Xtime* target);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 #ifdef _WIN32
@@ -181,4 +165,5 @@ int main() {
     RequireThrows<std::overflow_error>([&] { _Cnd_timedwait_nid_postfix(&condition, &mutex, &overflowSecTime); });
     _Cnd_destroy_nid_postfix(&condition);
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
diff --git a/core/libs/tests/GuestLibcFilesystem.cpp b/core/libs/tests/GuestLibcFilesystem.cpp
new file mode 100644
index 0000000000..fe53b7ff63
--- /dev/null
+++ b/core/libs/tests/GuestLibcFilesystem.cpp
@@ -0,0 +1,122 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <random>
+#include <set>
+#include <string>
+#include <system_error>
+
+namespace {
+
+constexpr int NoSuchFile = 2;
+constexpr int TypeNotFound = -1;
+constexpr int TypeRegular = 1;
+constexpr int TypeDirectory = 2;
+constexpr int TypeUnknown = 8;
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "filesystem: %s\n", message);
+    std::abort();
+}
+
+std::string root;
+
+std::string At(const char* name) {
+    return root + "/" + name;
+}
+
+void Write(const std::string& path, std::size_t bytes) {
+    std::ofstream file(path, std::ios::binary | std::ios::trunc);
+    file << std::string(bytes, 'x');
+}
+
+void TestStat() {
+    Write(At("file"), 7);
+    int perms = -1;
+    int error = -1;
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(At("file").c_str(), &perms, &error) == TypeRegular && error == 0, "regular file");
+    FileStat status{};
+    Require(stat_nid_postfix(At("file").c_str(), &status) == 0 && perms == (status.st_mode & 07777), "permission bits");
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(root.c_str(), nullptr, &error) == TypeDirectory && error == 0, "directory");
+    perms = 1234;
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(At("missing").c_str(), &perms, &error) == TypeNotFound && error == NoSuchFile && perms == 1234, "missing path");
+    Require(_ZNSt10filesystem5_StatEPKcPNS_5permsEPi_nid_postfix(At("file/below").c_str(), nullptr, &error) == TypeNotFound, "path below a file");
+    Require(_ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(At("file").c_str(), nullptr, &error) == TypeRegular && error == 0, "lstat of a regular file");
+    std::error_code link;
+    std::filesystem::create_symlink("file", At("link"), link);
+    if (!link) Require(_ZNSt10filesystem6_LstatEPKcPNS_5permsEPi_nid_postfix(At("link").c_str(), nullptr, &error) == TypeRegular, "lstat follows a link as the console does");
+}
+
+void TestSizeAndTime() {
+    int error = 0;
+    Require(_ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(At("file").c_str(), &error) == 7 && error == 0, "file size");
+    error = 0;
+    Require(_ZNSt10filesystem10_File_sizeEPKcPi_nid_postfix(At("missing").c_str(), &error) == UINT64_MAX && error == NoSuchFile, "size of a missing file");
+    std::int64_t seconds = 0;
+    std::int64_t nanoseconds = -1;
+    FileStat status{};
+    Require(stat_nid_postfix(At("file").c_str(), &status) == 0, "stat for time");
+    Require(_ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(At("file").c_str(), &seconds, &nanoseconds) == 0, "last write time");
+    Require(seconds == status.st_mtim.tv_sec && nanoseconds == status.st_mtim.tv_nsec, "last write time matches stat");
+    seconds = 5;
+    Require(_ZNSt10filesystem16_Last_write_timeEPKcPlS2__nid_postfix(At("missing").c_str(), &seconds, &nanoseconds) == NoSuchFile && seconds == 5, "time of a missing file");
+}
+
+void TestDirectories() {
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("made").c_str(), nullptr) == 1, "make a directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("made").c_str(), nullptr) == 0, "make an existing directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("absent/made").c_str(), nullptr) == -NoSuchFile, "make below a missing directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("copy").c_str(), At("missing").c_str()) == -NoSuchFile, "copy the mode of a missing directory");
+    Require(_ZNSt10filesystem9_Make_dirEPKcS1__nid_postfix(At("copy").c_str(), At("made").c_str()) == 1, "copy the mode of a directory");
+    Require(_ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(At("copy").c_str()), "remove a directory");
+    Require(!_ZNSt10filesystem11_Remove_dirEPKc_nid_postfix(At("copy").c_str()), "remove a missing directory");
+    char name[260];
+    int error = -1;
+    int type = -1;
+    Require(_ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(name, At("made").c_str(), &error, &type) == nullptr && error == 0 && name[0] == '\0', "an empty directory gives no handle");
+    Require(_ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(name, At("missing").c_str(), &error, &type) == nullptr && error == NoSuchFile, "a missing directory");
+    Write(At("made/one"), 1);
+    Write(At("made/two"), 2);
+    void* handle = _ZNSt10filesystem9_Open_dirERA260_cPKcRiRNS_9file_typeE_nid_postfix(name, At("made").c_str(), &error, &type);
+    Require(handle != nullptr && error == 0 && type == TypeUnknown, "open a directory");
+    std::set<std::string> names{name};
+    type = 0;
+    Require(_ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(name, handle, &type) == name && type == TypeUnknown, "read a directory");
+    names.insert(name);
+    Require(names == std::set<std::string>{"one", "two"}, "entries without dot entries");
+    Require(_ZNSt10filesystem9_Read_dirERA260_cPvRNS_9file_typeE_nid_postfix(name, handle, &type)[0] == '\0' && type == TypeUnknown, "end of the directory");
+    Require(_ZNSt10filesystem10_Close_dirEPv_nid_postfix(handle) == 0, "close a directory");
+}
+
+void TestFiles() {
+    Require(_ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(At("file").c_str(), 0600) == 0, "chmod");
+    Require(_ZNSt10filesystem6_ChmodEPKcNS_5permsE_nid_postfix(At("missing").c_str(), 0600) == -1, "chmod of a missing file");
+    Require(_ZNSt10filesystem7_UnlinkEPKc_nid_postfix(At("made/one").c_str()) == 0, "unlink");
+    Require(_ZNSt10filesystem7_UnlinkEPKc_nid_postfix(At("made/one").c_str()) == NoSuchFile, "unlink a missing file");
+    char current[260];
+    char expected[256];
+    Require(getcwd_nid_postfix(expected, sizeof(expected)) != nullptr, "getcwd");
+    Require(_ZNSt10filesystem12_Current_getERA260_c_nid_postfix(current) && std::strcmp(current, expected) == 0, "current directory");
+}
+
+}
+
+int main() {
+    root = "anyps5-libc-filesystem-" + std::to_string(std::random_device{}());
+    std::filesystem::create_directory(root);
+    TestStat();
+    TestSizeAndTime();
+    TestDirectories();
+    TestFiles();
+    std::error_code ignored;
+    std::filesystem::remove_all(root, ignored);
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibcMutexInitWithName.cpp b/core/libs/tests/GuestLibcMutexInitWithName.cpp
index 2501aef36b..a3faa64d90 100644
--- a/core/libs/tests/GuestLibcMutexInitWithName.cpp
+++ b/core/libs/tests/GuestLibcMutexInitWithName.cpp
@@ -1,14 +1,8 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI _Mtx_init_with_name_nid_postfix(void** handle, int type, const char* name);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TException, typename TCall>
@@ -33,9 +27,11 @@ int main() {
     Require(_Mtx_lock_nid_postfix(&mutex) == busy);
     Require(_Mtx_unlock_nid_postfix(&mutex) == success);
     _Mtx_destroy_nid_postfix(&mutex);
+
     Require(mutex == nullptr);
 
     RequireThrows<std::invalid_argument>([] {
         _Mtx_init_with_name_nid_postfix(nullptr, plain, "NullHandle");
+
     });
 }
diff --git a/core/libs/tests/GuestLibcRandomSeeding.cpp b/core/libs/tests/GuestLibcRandomSeeding.cpp
new file mode 100644
index 0000000000..33e46f6781
--- /dev/null
+++ b/core/libs/tests/GuestLibcRandomSeeding.cpp
@@ -0,0 +1,112 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
+static int failures = 0;
+
+static void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "%s\n", message);
+        ++failures;
+    }
+}
+
+static std::vector<std::int64_t> Draw(std::size_t count) {
+    std::vector<std::int64_t> values;
+    values.reserve(count);
+    for (std::size_t index = 0; index < count; ++index) values.push_back(random_nid_postfix());
+    return values;
+}
+
+static void RequireSequence(const std::vector<std::int64_t>& actual, const std::vector<std::int64_t>& expected, const char* message) {
+    Require(actual == expected, message);
+}
+
+static std::string FirstStateWord(const char* table) {
+    static const char* digits = "0123456789abcdef";
+    std::string text;
+    const unsigned char* bytes = reinterpret_cast<const unsigned char*>(table);
+    for (std::size_t index = 0; index < 8; ++index) {
+        text.push_back(digits[bytes[index] >> 4]);
+        text.push_back(digits[bytes[index] & 0x0f]);
+    }
+    return text;
+}
+
+struct StateCase {
+    std::int64_t size;
+    std::vector<std::int64_t> values;
+    const char* firstStateWord;
+};
+
+int main() {
+    RequireSequence(Draw(5), {1804289383, 846930886, 1681692777, 1714636915, 1957747793},
+        "a fresh process must draw the measured first five values");
+
+    srandom_nid_postfix(1);
+    RequireSequence(Draw(6), {1804289383, 846930886, 1681692777, 1714636915, 1957747793, 424238335},
+        "srandom(1) must match the measured sequence");
+
+    srandom_nid_postfix(0);
+    RequireSequence(Draw(6), {577655601, 1248161417, 192959563, 143633695, 541917479, 1903093295},
+        "srandom(0) must match the measured sequence");
+
+    srandom_nid_postfix(2);
+    RequireSequence(Draw(6), {1505335290, 1738766719, 190686788, 260874575, 747983061, 906156498},
+        "srandom(2) must match the measured sequence");
+
+    srandom_nid_postfix(12345);
+    RequireSequence(Draw(6), {383100999, 858300821, 357768173, 455528251, 133005921, 116285904},
+        "srandom(12345) must match the measured sequence");
+
+    srandom_nid_postfix(0xffffffffull);
+    RequireSequence(Draw(6), {254925627, 1205188300, 366127624, 1401405153, 76053476, 1604170158},
+        "srandom(0xffffffff) must match the measured sequence");
+
+    srandom_nid_postfix(0x80000000ull);
+    RequireSequence(Draw(6), {1336741213, 1210407648, 1447044896, 337392383, 82502902, 538660432},
+        "srandom(0x80000000) must match the measured sequence");
+
+    std::vector<char> tiny(16);
+    Require(initstate_nid_postfix(1, tiny.data(), 0) == nullptr, "initstate of 0 bytes must return null");
+    Require(initstate_nid_postfix(1, tiny.data(), 7) == nullptr, "initstate of 7 bytes must return null");
+
+    const std::array<StateCase, 13> states {{
+        {8, {1646035001, 1025921153, 510616708, 590357944, 771515668}, "000000001465fc2d"},
+        {15, {1646035001, 1025921153, 510616708, 590357944, 771515668}, "000000001465fc2d"},
+        {31, {1646035001, 1025921153, 510616708, 590357944, 771515668}, "000000001465fc2d"},
+        {32, {964237963, 406111040, 156505215, 1274863108, 1882652865}, "0100000082016ee0"},
+        {63, {964237963, 406111040, 156505215, 1274863108, 1882652865}, "0100000082016ee0"},
+        {64, {1894937090, 1645272306, 2143216519, 1889283008, 669383071}, "02000000fea8f5e2"},
+        {127, {1894937090, 1645272306, 2143216519, 1889283008, 669383071}, "02000000fea8f5e2"},
+        {128, {1804289383, 846930886, 1681692777, 1714636915, 1957747793}, "03000000b1391599"},
+        {129, {1804289383, 846930886, 1681692777, 1714636915, 1957747793}, "03000000b1391599"},
+        {255, {1804289383, 846930886, 1681692777, 1714636915, 1957747793}, "03000000b1391599"},
+        {256, {510644794, 625058908, 1816371419, 326864818, 1257431873}, "0400000032ba371f"},
+        {257, {510644794, 625058908, 1816371419, 326864818, 1257431873}, "0400000032ba371f"},
+        {1000, {510644794, 625058908, 1816371419, 326864818, 1257431873}, "0400000032ba371f"},
+    }};
+
+    std::vector<std::vector<char>> buffers;
+    for (const auto& state : states) {
+        buffers.emplace_back(static_cast<std::size_t>(state.size) + 16, static_cast<char>(0xa5));
+        char* const buffer = buffers.back().data();
+        char* const returned = initstate_nid_postfix(1, buffer, state.size);
+        Require(returned != nullptr, "initstate must not return null from 8 bytes up");
+        RequireSequence(Draw(5), state.values, "initstate must draw the measured values");
+        Require(FirstStateWord(buffer) == state.firstStateWord, "initstate must save the measured type word and first state word");
+    }
+
+    std::vector<char> last(128);
+    char* const replaced = initstate_nid_postfix(5, last.data(), 128);
+    Require(replaced != nullptr, "initstate must not return null from 8 bytes up");
+    Require(setstate_nid_postfix(replaced) != nullptr, "setstate of the state initstate returned must not return null");
+
+    return failures == 0 ? 0 : 1;
+}
diff --git a/core/libs/tests/GuestLibcStaticImports.cpp b/core/libs/tests/GuestLibcStaticImports.cpp
index a8068575dd..ff0cc2a7fc 100644
--- a/core/libs/tests/GuestLibcStaticImports.cpp
+++ b/core/libs/tests/GuestLibcStaticImports.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
 #include <cmath>
@@ -8,21 +9,6 @@
 #include <thread>
 #include <time.h>
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
-extern "C" {
-float APS5_VABI nearbyintf_nid_postfix(float x);
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_trylock_nid_postfix(void** handle);
-int APS5_VABI _Thrd_sleep_nid_postfix(const Xtime* target, Xtime* remaining);
-}
-
 namespace {
 
 void Require(bool value) {
@@ -156,6 +142,7 @@ void TestThrdSleep() {
 
     RequireThrows<std::invalid_argument>([] {
         _Thrd_sleep_nid_postfix(nullptr, nullptr);
+
     });
 }
 
diff --git a/core/libs/tests/GuestLibcThreads.cpp b/core/libs/tests/GuestLibcThreads.cpp
index 001558be39..1d2b3d7dff 100644
--- a/core/libs/tests/GuestLibcThreads.cpp
+++ b/core/libs/tests/GuestLibcThreads.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -8,53 +12,7 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
-void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
-int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
-int APS5_VABI _Mtx_unlock_nid_postfix(void** handle);
-int APS5_VABI _Cnd_init_nid_postfix(void** handle);
-void APS5_VABI _Cnd_destroy_nid_postfix(void** handle);
-int APS5_VABI _Cnd_wait_nid_postfix(void** condition, void** mutex);
-int APS5_VABI _Cnd_broadcast_nid_postfix(void** handle);
-int APS5_VABI _Cnd_signal_nid_postfix(void** handle);
 
-struct GuestPad {
-    unsigned (APS5_VABI* const* vtable)(GuestPad*);
-    void* condition;
-    void* mutex;
-    bool started;
-};
-
-void APS5_VABI _ZNSt4_PadC2Ev_nid_postfix(GuestPad* pad);
-void APS5_VABI _ZNSt4_PadD2Ev_nid_postfix(GuestPad* pad);
-void APS5_VABI _ZNSt4_Pad8_ReleaseEv_nid_postfix(GuestPad* pad);
-void APS5_VABI _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(GuestPad* pad, void** thread);
-int APS5_VABI _Thrd_join_nid_postfix(void* thread, int* code);
-int APS5_VABI _Thrd_detach_nid_postfix(void* thread);
-void RegisterPthreadCreate_nid_no_patch(int (APS5_VABI* fn)(void**, const void*, void* (APS5_VABI*)(void*), void*));
-void RegisterPthreadJoin_nid_no_patch(int (APS5_VABI* fn)(void*, void**));
-void RegisterPthreadDetach_nid_no_patch(int (APS5_VABI* fn)(void*));
-
-struct ThreadForwards {
-    int (APS5_VABI* once)(std::int32_t*, void (APS5_VABI*)(void));
-    int (APS5_VABI* keyCreate)(int*, void (APS5_VABI*)(void*));
-    int (APS5_VABI* keyDelete)(int);
-    void* (APS5_VABI* getSpecific)(int);
-    int (APS5_VABI* setSpecific)(int, void*);
-    int (APS5_VABI* equal)(void*, void*);
-    void* (APS5_VABI* self)();
-    void (APS5_VABI* exit)(void*);
-};
-void RegisterThreadForwards_nid_no_patch(const ThreadForwards* forwards);
-void APS5_VABI _Call_once_nid_postfix(std::int32_t* flag, void (APS5_VABI* function)(void));
-int APS5_VABI _Tss_create_nid_postfix(int* key, void (APS5_VABI* destructor)(void*));
-int APS5_VABI _Tss_delete_nid_postfix(int key);
-void* APS5_VABI _Tss_get_nid_postfix(int key);
-int APS5_VABI _Tss_set_nid_postfix(int key, void* value);
-int APS5_VABI _Thrd_equal_nid_postfix(void* first, void* second);
-void* APS5_VABI _Thrd_current_nid_postfix(void);
-int APS5_VABI _Mtx_current_owns_nid_postfix(void** handle);
-void* APS5_VABI scePthreadSelf();
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -98,10 +56,12 @@ static void MutexBasics() {
     RequireThrows<std::invalid_argument>([&] { _Mtx_lock_nid_postfix(&foreignMutex); });
     _Cnd_destroy_nid_postfix(&foreignCondition);
     _Mtx_destroy_nid_postfix(&mutex);
+
     Require(mutex == nullptr);
     RequireThrows<std::invalid_argument>([&] { _Mtx_lock_nid_postfix(&mutex); });
     void* emptyMutex = nullptr;
     _Mtx_destroy_nid_postfix(&emptyMutex);
+
     RequireThrows<std::invalid_argument>([] { _Mtx_destroy_nid_postfix(nullptr); });
 
     void* plainMutex = CreateMutex(plain);
@@ -119,11 +79,13 @@ static void MutexBasics() {
     Require(_Mtx_lock_nid_postfix(&defaultMutex) == success && _Mtx_lock_nid_postfix(&defaultMutex) == busy);
     Require(_Mtx_unlock_nid_postfix(&defaultMutex) == success);
     _Mtx_destroy_nid_postfix(&defaultMutex);
+
     void* unknownBitsMutex = nullptr;
     Require(_Mtx_init_nid_postfix(&unknownBitsMutex, tryable | 0x8) == success && unknownBitsMutex != nullptr);
     Require(_Mtx_lock_nid_postfix(&unknownBitsMutex) == success && _Mtx_lock_nid_postfix(&unknownBitsMutex) == busy);
     Require(_Mtx_unlock_nid_postfix(&unknownBitsMutex) == success);
     _Mtx_destroy_nid_postfix(&unknownBitsMutex);
+
     RequireThrows<std::invalid_argument>([] { _Mtx_init_nid_postfix(nullptr, tryable); });
     RequireThrows<std::invalid_argument>([] { _Mtx_lock_nid_postfix(nullptr); });
     RequireThrows<std::invalid_argument>([] { _Mtx_unlock_nid_postfix(nullptr); });
@@ -145,6 +107,7 @@ static void RecursiveMutex() {
     other.join();
     Require(acquired);
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
 
 static void MutualExclusion() {
@@ -161,6 +124,7 @@ static void MutualExclusion() {
     for (auto& worker : workers) worker.join();
     Require(counter == 80000);
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
 
 static void ConditionBroadcast() {
@@ -206,12 +170,15 @@ static void ConditionBroadcast() {
     RequireThrows<std::invalid_argument>([] { _Cnd_broadcast_nid_postfix(nullptr); });
     RequireThrows<std::invalid_argument>([] { _Cnd_init_nid_postfix(nullptr); });
     _Cnd_destroy_nid_postfix(&condition);
+
     Require(condition == nullptr);
     RequireThrows<std::invalid_argument>([&] { _Cnd_broadcast_nid_postfix(&condition); });
     void* emptyCondition = nullptr;
     _Cnd_destroy_nid_postfix(&emptyCondition);
+
     RequireThrows<std::invalid_argument>([] { _Cnd_destroy_nid_postfix(nullptr); });
     _Mtx_destroy_nid_postfix(&mutex);
+
 }
 
 static void ConditionSignal() {
@@ -219,6 +186,7 @@ static void ConditionSignal() {
     Require(_Cnd_init_nid_postfix(&condition) == success);
     Require(_Cnd_signal_nid_postfix(&condition) == success);
     _Cnd_destroy_nid_postfix(&condition);
+
 }
 
 struct TestPad {
@@ -260,6 +228,7 @@ static unsigned APS5_VABI TestPadGo(GuestPad* base) {
     auto* pad = reinterpret_cast<TestPad*>(base);
     pad->ran.store(true);
     _ZNSt4_Pad8_ReleaseEv_nid_postfix(base);
+
     return 42;
 }
 
@@ -268,15 +237,18 @@ static void PadLaunchAndJoin() {
     TestPad unregPad{};
     unregPad.vtable = vtable;
     _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&unregPad));
+
     RegisterPthreadCreate_nid_no_patch(nullptr);
     RegisterPthreadJoin_nid_no_patch(nullptr);
     void* unregThread = nullptr;
     RequireThrows<std::runtime_error>([&] {
         _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&unregPad), &unregThread);
+
     });
     RequireThrows<std::runtime_error>([&] {
         int code = 0;
         _Thrd_join_nid_postfix(&unregPad, &code);
+
     });
     _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&unregPad));
 
@@ -286,10 +258,13 @@ static void PadLaunchAndJoin() {
     TestPad pad{};
     pad.vtable = vtable;
     _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     void* thread = nullptr;
     _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&pad), &thread);
+
     Require(thread != nullptr && pad.started && pad.ran.load());
     _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     int code = 0;
     Require(_Thrd_join_nid_postfix(thread, &code) == success && code == 42);
     Require(_Thrd_join_nid_postfix(nullptr, &code) == 4);
@@ -309,10 +284,13 @@ static void PadDetach() {
     TestPad pad{};
     pad.vtable = vtable;
     _ZNSt4_PadC2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     void* thread = nullptr;
     _ZNSt4_Pad7_LaunchEPP7pthread_nid_postfix(reinterpret_cast<GuestPad*>(&pad), &thread);
+
     Require(thread != nullptr && pad.ran.load());
     _ZNSt4_PadD2Ev_nid_postfix(reinterpret_cast<GuestPad*>(&pad));
+
     Require(_Thrd_detach_nid_postfix(thread) == success);
     Require(_Thrd_detach_nid_postfix(nullptr) == 4);
 
@@ -355,10 +333,11 @@ static void APS5_VABI FakeExit(void*) { std::abort(); }
 static void APS5_VABI OnceTarget() {}
 
 static void ForwardedCalls() {
-    static const ThreadForwards fakes{FakeOnce, FakeKeyCreate, FakeKeyDelete, FakeGetSpecific, FakeSetSpecific, FakeEqual, FakeSelf, FakeExit};
+    static const ThreadForwards_nid_no_patch fakes{FakeOnce, FakeKeyCreate, FakeKeyDelete, FakeGetSpecific, FakeSetSpecific, FakeEqual, FakeSelf, FakeExit};
     RegisterThreadForwards_nid_no_patch(&fakes);
     std::int32_t flag = 0;
     _Call_once_nid_postfix(&flag, OnceTarget);
+
     Require(forwardLog.flag == &flag && forwardLog.function == OnceTarget);
     int key = 0;
     Require(_Tss_create_nid_postfix(&key, nullptr) == static_cast<int>(0x80020016) && key == 41);
@@ -374,8 +353,90 @@ static void ForwardedCalls() {
     RequireThrows<std::runtime_error>([] { _Tss_get_nid_postfix(0); });
 }
 
+struct VersionedShared {
+    PthreadMutex mutex = nullptr;
+    PthreadCond condition = nullptr;
+    std::atomic<int> stage{0};
+    int tryResult = -1;
+};
+
+static void* APS5_VABI VersionedWorker(void* argument) {
+    auto* shared = static_cast<VersionedShared*>(argument);
+    shared->tryResult = _ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared->mutex));
+    shared->stage = 1;
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared->mutex)) == success);
+    shared->stage = 2;
+    Require(_ZNSt8__sce_v211_Cnd_signalEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&shared->condition)) == success);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared->mutex)) == success);
+    return reinterpret_cast<void*>(std::intptr_t{42});
+}
+
+static void* APS5_VABI DetachedWorker(void*) { return nullptr; }
+
+static void VersionedSync() {
+    PthreadMutex recursiveMutex = reinterpret_cast<PthreadMutex>(std::uintptr_t{1});
+    Require(_ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(reinterpret_cast<void**>(&recursiveMutex), plain | recursive) == success && recursiveMutex != nullptr);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_trylockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    for (int unlock = 0; unlock < 3; ++unlock) Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&recursiveMutex)) == success);
+
+    PthreadMutex plainMutex = nullptr;
+    Require(_ZNSt8__sce_v219_Mtx_init_with_nameEPP13pthread_mutexiPKc_nid_postfix(reinterpret_cast<void**>(&plainMutex), plain, "") == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == busy);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+    PthreadCond unownedCondition = nullptr;
+    Require(_ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&unownedCondition)) == success);
+    Require(scePthreadMutexUnlock(&plainMutex) != 0);
+    Require(scePthreadCondWait(&unownedCondition, &plainMutex) != 0);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+    Require(_ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&unownedCondition), reinterpret_cast<void**>(&plainMutex)) == success);
+    Require(_ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&unownedCondition)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&plainMutex)) == success);
+
+    VersionedShared shared;
+    Require(_ZNSt8__sce_v29_Mtx_initEPP13pthread_mutexi_nid_postfix(reinterpret_cast<void**>(&shared.mutex), plain) == success);
+    Require(_ZNSt8__sce_v219_Cnd_init_with_nameEPP12pthread_condPKc_nid_postfix(reinterpret_cast<void**>(&shared.condition), "versioned") == success);
+    Require(_ZNSt8__sce_v29_Mtx_lockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.mutex)) == success);
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, VersionedWorker, &shared, "versioned") == 0);
+    while (shared.stage.load() == 0) std::this_thread::yield();
+    while (shared.stage.load() == 1) Require(_ZNSt8__sce_v29_Cnd_waitEPP12pthread_condPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.condition), reinterpret_cast<void**>(&shared.mutex)) == success);
+    Require(shared.tryResult == busy);
+    Require(_ZNSt8__sce_v211_Mtx_unlockEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.mutex)) == success);
+    int code = 0;
+    Require(_ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(thread, &code) == success && code == 42);
+    Require(_ZNSt8__sce_v210_Thrd_joinEP7pthreadPi_nid_postfix(thread, &code) == 4);
+    Require(_ZNSt8__sce_v214_Cnd_broadcastEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&shared.condition)) == success);
+    Require(_ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&shared.condition)) == success);
+    Require(_ZNSt8__sce_v212_Mtx_destroyEPP13pthread_mutex_nid_postfix(reinterpret_cast<void**>(&shared.mutex)) == success);
+
+    PthreadCond condition = nullptr;
+    Require(_ZNSt8__sce_v29_Cnd_initEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&condition)) == success);
+    Require(_ZNSt8__sce_v212_Cnd_destroyEPP12pthread_cond_nid_postfix(reinterpret_cast<void**>(&condition)) == success);
+
+    Pthread detached = nullptr;
+    Require(scePthreadCreate(&detached, nullptr, DetachedWorker, nullptr, "detached") == 0);
+    Require(_ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(detached) == success);
+    Require(_ZNSt8__sce_v212_Thrd_detachEP7pthread_nid_postfix(nullptr) == 4);
+    _ZNSt8__sce_v211_Thrd_yieldEv_nid_postfix();
+
+    Require(_ZNSt8__sce_v28_Thrd_idEv_nid_postfix() != nullptr);
+}
+
+static void ThreadHelpers() {
+    Require(_Thrd_yield_nid_postfix() == success);
+    std::thread other([&] {
+        Require(_Thrd_yield_nid_postfix() == success);
+    });
+    other.join();
+}
+
 int main() {
     KernelKeys();
+    VersionedSync();
     ForwardedCalls();
     MutexBasics();
     RecursiveMutex();
@@ -384,4 +445,5 @@ int main() {
     ConditionSignal();
     PadLaunchAndJoin();
     PadDetach();
+    ThreadHelpers();
 }
diff --git a/core/libs/tests/GuestLibreSsl3Digest.cpp b/core/libs/tests/GuestLibreSsl3Digest.cpp
new file mode 100644
index 0000000000..dcddacf406
--- /dev/null
+++ b/core/libs/tests/GuestLibreSsl3Digest.cpp
@@ -0,0 +1,50 @@
+#include "prx/libSceLibreSsl3/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include <stdexcept>
+#include <string>
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "LibreSSL3 digest check failed at line %u\n", location.line());
+    std::abort();
+}
+
+template<typename TAction> static void RequireThrows(TAction action, std::source_location location = std::source_location::current()) {
+    try { action(); } catch (const std::exception&) { return; }
+    Require(false, location);
+}
+
+static std::string Hex(const unsigned char* data, std::size_t size) {
+    static constexpr char digits[] = "0123456789abcdef";
+    std::string text;
+    for (std::size_t i = 0; i < size; ++i) {
+        text += digits[data[i] >> 4];
+        text += digits[data[i] & 15];
+    }
+    return text;
+}
+
+int main() {
+    const auto* abc = reinterpret_cast<const unsigned char*>("abc");
+    const std::string million(1000000, 'a');
+    const auto* many = reinterpret_cast<const unsigned char*>(million.data());
+    unsigned char digest[24];
+    std::memset(digest, 0xee, sizeof(digest));
+    Require(MD5_nid_postfix(abc, 3, digest) == digest && Hex(digest, 16) == "900150983cd24fb0d6963f7d28e17f72" && digest[16] == 0xee);
+    Require(MD5_nid_postfix(nullptr, 0, digest) == digest && Hex(digest, 16) == "d41d8cd98f00b204e9800998ecf8427e");
+    Require(MD5_nid_postfix(many, million.size(), digest) == digest && Hex(digest, 16) == "7707d6ae4e027c70eea2a935c2296f21");
+    std::memset(digest, 0xee, sizeof(digest));
+    Require(SHA1_nid_postfix(abc, 3, digest) == digest && Hex(digest, 20) == "a9993e364706816aba3e25717850c26c9cd0d89d" && digest[20] == 0xee);
+    Require(SHA1_nid_postfix(nullptr, 0, digest) == digest && Hex(digest, 20) == "da39a3ee5e6b4b0d3255bfef95601890afd80709");
+    Require(SHA1_nid_postfix(many, million.size(), digest) == digest && Hex(digest, 20) == "34aa973cd4c4daa4f61eeb2bdbad27316534016f");
+    RequireThrows([&] { MD5_nid_postfix(abc, 3, nullptr); });
+    RequireThrows([&] { SHA1_nid_postfix(abc, 3, nullptr); });
+    RequireThrows([&] { SHA1_nid_postfix(nullptr, 1, digest); });
+
+    std::puts("libSceLibreSsl3 digest tests passed");
+}
diff --git a/core/libs/tests/GuestLibreSslAes.cpp b/core/libs/tests/GuestLibreSslAes.cpp
new file mode 100644
index 0000000000..e36afbc5d8
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslAes.cpp
@@ -0,0 +1,219 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", what);
+    std::abort();
+}
+
+template<typename TAction> static void RequireThrows(TAction action, const char* what) {
+    try { action(); } catch (const std::exception&) { return; }
+    Require(false, what);
+}
+
+static std::vector<unsigned char> Bytes(const char* hex) {
+    std::vector<unsigned char> bytes;
+    for (; hex[0] && hex[1]; hex += 2) bytes.push_back(static_cast<unsigned char>(std::stoi(std::string(hex, 2), nullptr, 16)));
+    return bytes;
+}
+
+static std::string Hex(const unsigned char* data, std::size_t size) {
+    static constexpr char digits[] = "0123456789abcdef";
+    std::string text;
+    for (std::size_t i = 0; i < size; ++i) {
+        text += digits[data[i] >> 4];
+        text += digits[data[i] & 15];
+    }
+    return text;
+}
+
+static std::uint32_t Word(const std::vector<unsigned char>& bytes, std::size_t index) {
+    return std::uint32_t(bytes[4 * index]) << 24 | std::uint32_t(bytes[4 * index + 1]) << 16 | std::uint32_t(bytes[4 * index + 2]) << 8 | bytes[4 * index + 3];
+}
+
+static AesKey Sentinel() {
+    AesKey key;
+    for (std::uint32_t i = 0; i < 60; ++i) key.roundKeys[i] = 0xa5a50000u | i;
+    key.rounds = 0x5a5a;
+    return key;
+}
+
+template<typename TSetup> static void RequireSchedule(TSetup setup, const char* keyHex, const char* scheduleHex, const char* what) {
+    const auto userKey = Bytes(keyHex);
+    const auto schedule = Bytes(scheduleHex);
+    const std::size_t used = schedule.size() / 4;
+    const AesKey before = Sentinel();
+    AesKey key = before;
+    Require(setup(userKey.data(), static_cast<int>(userKey.size() * 8), &key) == 0 && key.rounds == static_cast<int>(used / 4 - 1), what);
+    for (std::size_t i = 0; i < 60; ++i) Require(key.roundKeys[i] == (i < used ? Word(schedule, i) : before.roundKeys[i]), what);
+}
+
+template<typename TSetup> static void RequireRefusalsKeepKey(TSetup setup, const char* what) {
+    const unsigned char userKey[32] {};
+    const AesKey before = Sentinel();
+    for (const int bits : {0, 64, 127, 129, 160, 224, 255, 384, 512, -128}) {
+        AesKey key = before;
+        Require(setup(userKey, bits, &key) == -2 && !std::memcmp(&key, &before, sizeof(key)), what);
+    }
+    for (const int bits : {128, 64}) {
+        AesKey key = before;
+        Require(setup(nullptr, bits, &key) == -1 && !std::memcmp(&key, &before, sizeof(key)), what);
+    }
+    Require(setup(userKey, 128, nullptr) == -1, what);
+}
+
+int main() {
+    const auto plain = Bytes("00112233445566778899aabbccddeeff");
+    const char* keys[3] {
+        "000102030405060708090a0b0c0d0e0f",
+        "000102030405060708090a0b0c0d0e0f1011121314151617",
+        "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+    };
+    const char* ciphers[3] {"69c4e0d86a7b0430d8cdb78070b4c55a", "dda97ca4864cdfe06eaf70a0ec0d7191", "8ea2b7ca516745bfeafc49904b496089"};
+    for (int i = 0; i < 3; ++i) {
+        const auto key = Bytes(keys[i]);
+        const int bits = static_cast<int>(key.size() * 8);
+        AesKey encrypt {}, decrypt {};
+        unsigned char out[16] {}, back[16] {};
+        Require(AES_set_encrypt_key_nid_postfix(key.data(), bits, &encrypt) == 0 && encrypt.rounds == 10 + 2 * i, "encrypt key");
+        Require(AES_set_decrypt_key_nid_postfix(key.data(), bits, &decrypt) == 0 && decrypt.rounds == encrypt.rounds, "decrypt key");
+        const int last = 4 * encrypt.rounds;
+        Require(!std::memcmp(decrypt.roundKeys, encrypt.roundKeys + last, 16) && !std::memcmp(decrypt.roundKeys + last, encrypt.roundKeys, 16), "decrypt key reverses the round keys");
+        AES_encrypt_nid_postfix(plain.data(), out, &encrypt);
+
+        Require(Hex(out, 16) == ciphers[i], "FIPS-197 appendix C cipher");
+        AES_decrypt_nid_postfix(out, back, &decrypt);
+
+        Require(!std::memcmp(back, plain.data(), 16), "FIPS-197 appendix C inverse cipher");
+        AES_ecb_encrypt_nid_postfix(plain.data(), out, &encrypt, 1);
+
+        Require(Hex(out, 16) == ciphers[i], "ECB encrypt");
+        AES_ecb_encrypt_nid_postfix(out, out, &decrypt, 0);
+
+        Require(!std::memcmp(out, plain.data(), 16), "ECB decrypt in place");
+    }
+
+    AesKey fipsKey {};
+    Require(AES_set_encrypt_key_nid_postfix(Bytes("2b7e151628aed2a6abf7158809cf4f3c").data(), 128, &fipsKey) == 0, "FIPS-197 appendix A key");
+    Require(fipsKey.roundKeys[4] == 0xa0fafe17 && fipsKey.roundKeys[43] == 0xb6630ca6, "FIPS-197 appendix A.1 expansion");
+    AesKey bad {};
+    bad.rounds = 7;
+    bad.roundKeys[0] = 1;
+    const unsigned char zero[32] {};
+    Require(AES_set_encrypt_key_nid_postfix(zero, 64, &bad) == -2 && bad.rounds == 7 && bad.roundKeys[0] == 1, "unsupported key length keeps the key");
+    Require(AES_set_decrypt_key_nid_postfix(zero, 129, &bad) == -2 && bad.rounds == 7 && bad.roundKeys[0] == 1, "unsupported decrypt key length keeps the key");
+    Require(AES_set_encrypt_key_nid_postfix(nullptr, 128, &bad) == -1 && AES_set_encrypt_key_nid_postfix(zero, 128, nullptr) == -1, "null key arguments");
+    unsigned char block[16] {};
+    RequireThrows([&] { AES_encrypt_nid_postfix(zero, block, &bad); }, "key schedule with an invalid round count");
+    RequireRefusalsKeepKey(&AES_set_encrypt_key_nid_postfix, "refused encrypt key setup leaves the key unchanged");
+    RequireRefusalsKeepKey(&AES_set_decrypt_key_nid_postfix, "refused decrypt key setup leaves the key unchanged");
+    RequireSchedule(&AES_set_encrypt_key_nid_postfix, "2b7e151628aed2a6abf7158809cf4f3c",
+        "2b7e151628aed2a6abf7158809cf4f3ca0fafe1788542cb123a339392a6c7605f2c295f27a96b9435935807a7359f67f3d80477d4716fe3e1e237e446d7a883b"
+        "ef44a541a8525b7fb671253bdb0bad00d4d1c6f87c839d87caf2b8bc11f915bc6d88a37a110b3efddbf98641ca0093fd4e54f70e5f5fc9f384a64fb24ea6dc4f"
+        "ead27321b58dbad2312bf5607f8d292fac7766f319fadc2128d12941575c006ed014f9a8c9ee2589e13f0cc8b6630ca6",
+        "FIPS-197 appendix A.1 AES-128 encrypt schedule");
+    RequireSchedule(&AES_set_encrypt_key_nid_postfix, "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b",
+        "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7bfe0c91f72402f5a5ec12068e6c827f6b0e7a95b95c56fec24db7b4bd69b5411885a74796e92538fd"
+        "e75fad44bb095386485af05721efb14fa448f6d94d6dce24aa326360113b30e6a25e7ed583b1cf9a27f939436a94f767c0a69407d19da4e1ec1786eb6fa64971"
+        "485f703222cb8755e26d135233f0b7b340beeb282f18a2596747d26b458c553ea7e1466c9411f1df821f750aad07d753ca4005388fcc5006282d166abc3ce7b5"
+        "e98ba06f448c773c8ecc720401002202",
+        "FIPS-197 appendix A.2 AES-192 encrypt schedule");
+    RequireSchedule(&AES_set_encrypt_key_nid_postfix, "603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4",
+        "603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff49ba354118e6925afa51a8b5f2067fcdea8b09c1a93d194cdbe49846eb75d5b9a"
+        "d59aecb85bf3c917fee94248de8ebe96b5a9328a2678a647983122292f6c79b3812c81addadf48ba24360af2fab8b46498c5bfc9bebd198e268c3ba709e04214"
+        "68007bacb2df331696e939e46c518d80c814e20476a9fb8a5025c02d59c58239de1369676ccc5a71fa2563959674ee155886ca5d2e2f31d77e0af1fa27cf73c3"
+        "749c47ab18501ddae2757e4f7401905acafaaae3e4d59b349adf6acebd10190dfe4890d1e6188d0b046df344706c631e",
+        "FIPS-197 appendix A.3 AES-256 encrypt schedule");
+    RequireSchedule(&AES_set_decrypt_key_nid_postfix, "2b7e151628aed2a6abf7158809cf4f3c",
+        "d014f9a8c9ee2589e13f0cc8b6630ca60c7b5a631319eafeb0398890664cfbb4df7d925a1f62b09da320626ed675732412c07647c01f22c7bc42d2f37555114a"
+        "6efcd876d2df54807c5df034c917c3b96ea30afcbc238cf6ae82a4b4b54a338d90884413d280860a12a128421bc897397c1f13f74208c219c021ae480969bf7b"
+        "cc7505eb3e17d1ee82296c51c94811332b3708a7f262d405bc3ebdbf4b617d622b7e151628aed2a6abf7158809cf4f3c",
+        "AES-128 decrypt schedule");
+    RequireSchedule(&AES_set_decrypt_key_nid_postfix, "8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b",
+        "e98ba06f448c773c8ecc720401002202ac491644e55710b746c08a75c89b2cada3979ac28e5ba6d8e12cc9e654b272baf3b42258b59ebb5cf8fb64fe491e06f3"
+        "4d65dfa2b1e5620dea899c312dcc3c1a5b6cfe3cc745a02bf8b9a572462a9904c5ddb7f8be933c760b4f46a6fc80bdafb5dc7ad0f7cffb09a7ec43939c295e17"
+        "5023b89a3bc51d84d04b19377b4e8b8e41b34544ab0592b9ce92f15e421381d9659763e78c817087123039436be6a51e9eb149c479d69c5dfeb4a27ceab6d7fd"
+        "8e73b0f7da0e6452c810f32b809079e5",
+        "AES-192 decrypt schedule");
+    RequireSchedule(&AES_set_decrypt_key_nid_postfix, "603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4",
+        "fe4890d1e6188d0b046df344706c631eada23f4963e23b2455427c8a5c70910457c96cf6074f07c0706abb07137f9241b668b621ce40046d36a047ae0932ed8e"
+        "34ad1e4450866b367725bcc76315294632526c367828b24cf8e043c33f92aa20c440b289642b757227a3d7f114309581d669a7334a7ade7a80c8f18fc772e9e3"
+        "25ba3c22a06bc7fb4388a2833393427054fb808b9c137949cab22ff547ba186c6c3d632985d1fbd9e3e36578701be0f34a7459f9c8e8f9c256a156bc8d083799"
+        "42107758e9ec98f066329ea193f8858b8ec6bff6829ca03b9e49af7edba96125603deb1015ca71be2b73aef0857d7781",
+        "AES-256 decrypt schedule");
+
+    const auto key = Bytes("2b7e151628aed2a6abf7158809cf4f3c");
+    const auto message = Bytes("6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e5130c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710");
+    AesKey encrypt {}, decrypt {};
+    AES_set_encrypt_key_nid_postfix(key.data(), 128, &encrypt);
+    AES_set_decrypt_key_nid_postfix(key.data(), 128, &decrypt);
+
+    std::vector<unsigned char> out(message.size() + 16), back(message.size() + 16);
+
+    auto iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    AES_cbc_encrypt_nid_postfix(message.data(), out.data(), 64, &encrypt, iv.data(), 1);
+
+    Require(Hex(out.data(), 64) == "7649abac8119b246cee98e9b12e9197d5086cb9b507219ee95db113a917678b273bed6b8e3c1743b7116e69e222295163ff1caa1681fac09120eca307586e1a7", "SP 800-38A F.2.1 CBC encrypt");
+    Require(Hex(iv.data(), 16) == "3ff1caa1681fac09120eca307586e1a7", "CBC encrypt returns the last cipher block as iv");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    std::memcpy(back.data(), out.data(), 64);
+    AES_cbc_encrypt_nid_postfix(back.data(), back.data(), 32, &decrypt, iv.data(), 0);
+    AES_cbc_encrypt_nid_postfix(back.data() + 32, back.data() + 32, 32, &decrypt, iv.data(), 0);
+
+    Require(!std::memcmp(back.data(), message.data(), 64) && Hex(iv.data(), 16) == "3ff1caa1681fac09120eca307586e1a7", "SP 800-38A F.2.2 CBC decrypt in place across calls");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    std::vector<unsigned char> partial(32, 0xee);
+    AES_cbc_encrypt_nid_postfix(message.data(), partial.data(), 20, &encrypt, iv.data(), 1);
+
+    Require(Hex(partial.data(), 16) == "7649abac8119b246cee98e9b12e9197d" && partial[31] != 0xee && Hex(iv.data(), 16) == Hex(partial.data() + 16, 16), "CBC encrypt pads a partial block with the iv and writes the whole block");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    std::vector<unsigned char> plainPartial(32, 0xee);
+    AES_cbc_encrypt_nid_postfix(partial.data(), plainPartial.data(), 20, &decrypt, iv.data(), 0);
+
+    Require(!std::memcmp(plainPartial.data(), message.data(), 20) && plainPartial[20] == 0xee && Hex(iv.data(), 16) == Hex(partial.data() + 16, 16), "CBC decrypt writes only the requested length");
+
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    int num = 0;
+    AES_cfb128_encrypt_nid_postfix(message.data(), out.data(), 5, &encrypt, iv.data(), &num, 1);
+    AES_cfb128_encrypt_nid_postfix(message.data() + 5, out.data() + 5, 32, &encrypt, iv.data(), &num, 1);
+
+    Require(num == 5, "CFB128 keeps the block position");
+    AES_cfb128_encrypt_nid_postfix(message.data() + 37, out.data() + 37, 27, &encrypt, iv.data(), &num, 1);
+
+    Require(Hex(out.data(), 64) == "3b3fd92eb72dad20333449f8e83cfb4ac8a64537a0b3a93fcde3cdad9f1ce58b26751f67a3cbb140b1808cf187a4f4dfc04b05357c5d1c0eeac4c66f9ff7f2e6" && num == 0, "SP 800-38A F.3.13 CFB128 encrypt in pieces");
+    iv = Bytes("000102030405060708090a0b0c0d0e0f");
+    num = 0;
+    AES_cfb128_encrypt_nid_postfix(out.data(), back.data(), 64, &encrypt, iv.data(), &num, 0);
+
+    Require(!std::memcmp(back.data(), message.data(), 64), "SP 800-38A F.3.14 CFB128 decrypt");
+    num = 16;
+    RequireThrows([&] { AES_cfb128_encrypt_nid_postfix(message.data(), out.data(), 1, &encrypt, iv.data(), &num, 1); }, "CFB128 position out of range");
+
+    auto counter = Bytes("f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff");
+    unsigned char keystream[16] {};
+    unsigned position = 0;
+    AES_ctr128_encrypt_nid_postfix(message.data(), out.data(), 7, &encrypt, counter.data(), keystream, &position);
+    AES_ctr128_encrypt_nid_postfix(message.data() + 7, out.data() + 7, 57, &encrypt, counter.data(), keystream, &position);
+
+    Require(Hex(out.data(), 64) == "874d6191b620e3261bef6864990db6ce9806f66b7970fdff8617187bb9fffdff5ae4df3edbd5d35e5b4f09020db03eab1e031dda2fbe03d1792170a0f3009cee", "SP 800-38A F.5.1 CTR encrypt in pieces");
+    Require(position == 0 && Hex(counter.data(), 16) == "f0f1f2f3f4f5f6f7f8f9fafbfcfdff03", "CTR advances the counter per block");
+    counter = Bytes("ffffffffffffffffffffffffffffffff");
+    position = 0;
+    AES_ctr128_encrypt_nid_postfix(message.data(), out.data(), 37, &encrypt, counter.data(), keystream, &position);
+
+    Require(Hex(out.data(), 37) == "e13338e36cb71962e00d020b4cedbd86d3dae15b04bb352fa0f59febfcb4da3e67da610697", "CTR counter wraps across all 128 bits");
+    Require(position == 5 && Hex(counter.data(), 16) == "00000000000000000000000000000002", "CTR position and counter after a partial block");
+    position = 16;
+    RequireThrows([&] { AES_ctr128_encrypt_nid_postfix(message.data(), out.data(), 1, &encrypt, counter.data(), keystream, &position); }, "CTR position out of range");
+
+    std::puts("libSceLibreSsl AES tests passed");
+}
diff --git a/core/libs/tests/GuestLibreSslDes.cpp b/core/libs/tests/GuestLibreSslDes.cpp
new file mode 100644
index 0000000000..6191facec5
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslDes.cpp
@@ -0,0 +1,75 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+
+using DesBlock = std::array<unsigned char, 8>;
+using DesSchedule = std::array<unsigned char, 128>;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+template<typename TAction>
+static void RequireThrows(TAction action) {
+    try { action(); } catch (const std::invalid_argument&) { return; }
+    std::abort();
+}
+
+static DesBlock Block(std::uint64_t value) {
+    DesBlock block{};
+    for (int index = 0; index < 8; ++index) block[index] = static_cast<unsigned char>(value >> (56 - 8 * index));
+    return block;
+}
+
+static void CheckVector(std::uint64_t key, std::uint64_t plain, std::uint64_t cipher) {
+    const auto keyBlock = Block(key);
+    DesSchedule schedule{};
+    schedule.fill(0xaa);
+    Require(DES_set_key_nid_postfix(keyBlock.data(), schedule.data()) == 0);
+    const auto plainBlock = Block(plain);
+    DesBlock output{};
+    DES_ecb_encrypt_nid_postfix(plainBlock.data(), output.data(), schedule.data(), 1);
+
+    Require(output == Block(cipher));
+    DES_ecb_encrypt_nid_postfix(output.data(), output.data(), schedule.data(), 0);
+
+    Require(output == plainBlock);
+    DesBlock again{};
+    DES_ecb_encrypt_nid_postfix(plainBlock.data(), again.data(), schedule.data(), 7);
+
+    Require(again == Block(cipher));
+}
+
+static void CheckParity() {
+    DesBlock key{0x00, 0x01, 0x02, 0x03, 0x12, 0x13, 0xfe, 0xff};
+    DES_set_odd_parity_nid_postfix(key.data());
+
+    Require(key == (DesBlock{0x01, 0x01, 0x02, 0x02, 0x13, 0x13, 0xfe, 0xfe}));
+    for (int value = 0; value < 256; ++value) {
+        DesBlock single{};
+        single.fill(static_cast<unsigned char>(value));
+        DES_set_odd_parity_nid_postfix(single.data());
+
+        Require((single[0] & 0xfe) == (value & 0xfe) && std::popcount(single[0]) % 2 == 1);
+    }
+}
+
+int main() {
+    CheckVector(0x133457799bbcdff1, 0x0123456789abcdef, 0x85e813540f0ab405);
+    CheckVector(0x0e329232ea6d0d73, 0x8787878787878787, 0x0000000000000000);
+    CheckVector(0x0101010101010101, 0x8000000000000000, 0x95f8a5e5dd31d900);
+    CheckParity();
+    DesSchedule schedule{};
+    const auto weak = Block(0x0101010101010101);
+    Require(DES_set_key_nid_postfix(weak.data(), schedule.data()) == 0);
+    const auto badParity = Block(0x0000000000000000);
+    Require(DES_set_key_nid_postfix(badParity.data(), schedule.data()) == 0);
+    RequireThrows([&] { DES_set_key_nid_postfix(nullptr, schedule.data()); });
+    RequireThrows([&] { DES_ecb_encrypt_nid_postfix(weak.data(), schedule.data(), nullptr, 1); });
+    RequireThrows([] { DES_set_odd_parity_nid_postfix(nullptr); });
+    return 0;
+}
diff --git a/core/libs/tests/GuestLibreSslDigest.cpp b/core/libs/tests/GuestLibreSslDigest.cpp
new file mode 100644
index 0000000000..ba0ae9d3e0
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslDigest.cpp
@@ -0,0 +1,184 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+using InitFunction = int (APS5_VABI*)(void*);
+using UpdateFunction = int (APS5_VABI*)(void*, const void*, std::size_t);
+using FinalFunction = int (APS5_VABI*)(unsigned char*, void*);
+
+template<typename TContext, auto TFunction>
+int APS5_VABI Initialize(void* context) { return TFunction(static_cast<TContext*>(context)); }
+
+template<typename TContext, auto TFunction>
+int APS5_VABI Update(void* context, const void* data, std::size_t size) { return TFunction(static_cast<TContext*>(context), data, size); }
+
+template<typename TContext, auto TFunction>
+int APS5_VABI Finalize(unsigned char* digest, void* context) { return TFunction(digest, static_cast<TContext*>(context)); }
+
+struct Algorithm {
+    const char* name;
+    InitFunction init;
+    UpdateFunction update;
+    FinalFunction final;
+    std::size_t contextSize;
+    std::size_t blockSize;
+    std::size_t digestSize;
+    const char* expected[6];
+};
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", what);
+    std::abort();
+}
+
+template<typename TAction> static void RequireThrows(TAction action, const char* what) {
+    try { action(); } catch (const std::exception&) { return; }
+    Require(false, what);
+}
+
+static std::string Hex(const unsigned char* data, std::size_t size) {
+    static constexpr char digits[] = "0123456789abcdef";
+    std::string text;
+    for (std::size_t i = 0; i < size; ++i) {
+        text += digits[data[i] >> 4];
+        text += digits[data[i] & 15];
+    }
+    return text;
+}
+
+static std::string Digest(const Algorithm& algorithm, const std::string& message, std::size_t chunk) {
+    alignas(16) unsigned char context[256] {};
+    unsigned char digest[64] {};
+    Require(algorithm.init(context) == 1, "init returns 1");
+    for (std::size_t offset = 0; offset < message.size(); offset += chunk) {
+        const auto length = std::min(chunk, message.size() - offset);
+        Require(algorithm.update(context, message.data() + offset, length) == 1, "update returns 1");
+    }
+    Require(algorithm.final(digest, context) == 1, "final returns 1");
+    return Hex(digest, algorithm.digestSize);
+}
+
+int main() {
+    const std::string messages[6] {
+        "",
+        "abc",
+        "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
+        "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
+        "12345678901234567890123456789012345678901234567890123456789012345678901234567890",
+        std::string(1000000, 'a'),
+    };
+    const Algorithm algorithms[] {
+        {"MD4", Initialize<Md4Context, MD4_Init_nid_postfix>, Update<Md4Context, MD4_Update_nid_postfix>, Finalize<Md4Context, MD4_Final_nid_postfix>, 92, 64, 16, {
+            "31d6cfe0d16ae931b73c59d7e0c089c0", "a448017aaf21d8525fc10ae87aa6729d", "4691a9ec81b1a6bd1ab8557240b245c5",
+            nullptr, "e33b4ddc9c38f2199c3e7b164fcc0536", nullptr}},
+        {"MD5", Initialize<Md5Context, MD5_Init_nid_postfix>, Update<Md5Context, MD5_Update_nid_postfix>, Finalize<Md5Context, MD5_Final_nid_postfix>, 92, 64, 16, {
+            "d41d8cd98f00b204e9800998ecf8427e", "900150983cd24fb0d6963f7d28e17f72", "8215ef0796a20bcaaae116d3876c664a",
+            "03dd8807a93175fb062dfb55dc7d359c", "57edf4a22be3c955ac49da2e2107b67a", "7707d6ae4e027c70eea2a935c2296f21"}},
+        {"SHA1", Initialize<Sha1Context, SHA1_Init_nid_postfix>, Update<Sha1Context, SHA1_Update_nid_postfix>, Finalize<Sha1Context, SHA1_Final_nid_postfix>, 96, 64, 20, {
+            "da39a3ee5e6b4b0d3255bfef95601890afd80709", "a9993e364706816aba3e25717850c26c9cd0d89d", "84983e441c3bd26ebaae4aa1f95129e5e54670f1",
+            "a49b2446a02c645bf419f995b67091253a04a259", "50abf5706a150990a08b2c5ea40fa0e585554732", "34aa973cd4c4daa4f61eeb2bdbad27316534016f"}},
+        {"SHA224", Initialize<Sha256Context, SHA224_Init_nid_postfix>, Update<Sha256Context, SHA224_Update_nid_postfix>, Finalize<Sha256Context, SHA224_Final_nid_postfix>, 112, 64, 28, {
+            "d14a028c2a3a2bc9476102bb288234c415a2b01f828ea62ac5b3e42f", "23097d223405d8228642a477bda255b32aadbce4bda0b3f7e36c9da7",
+            "75388b16512776cc5dba5da1fd890150b0c6455cb4f58b1952522525", "c97ca9a559850ce97a04a96def6d99a9e0e0e2ab14e6b8df265fc0b3",
+            "b50aecbe4e9bb0b57bc5f3ae760a8e01db24f203fb3cdcd13148046e", "20794655980c91d8bbb4c1ea97618a4bf03f42581948b2ee4ee7ad67"}},
+        {"SHA256", Initialize<Sha256Context, SHA256_Init_nid_postfix>, Update<Sha256Context, SHA256_Update_nid_postfix>, Finalize<Sha256Context, SHA256_Final_nid_postfix>, 112, 64, 32, {
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
+            "248d6a61d20638b8e5c026930c3e6039a33ce45964ff2167f6ecedd419db06c1", "cf5b16a778af8380036ce59e7b0492370b249b11e8f07a51afac45037afee9d1",
+            "f371bc4a311f2b009eef952dd83ca80e2b60026c8e935592d0f9c308453c813e", "cdc76e5c9914fb9281a1c7e284d73e67f1809a48a497200e046d39ccc7112cd0"}},
+        {"SHA384", Initialize<Sha512Context, SHA384_Init_nid_postfix>, Update<Sha512Context, SHA384_Update_nid_postfix>, Finalize<Sha512Context, SHA384_Final_nid_postfix>, 216, 128, 48, {
+            "38b060a751ac96384cd9327eb1b1e36a21fdb71114be07434c0cc7bf63f6e1da274edebfe76f65fbd51ad2f14898b95b",
+            "cb00753f45a35e8bb5a03d699ac65007272c32ab0eded1631a8b605a43ff5bed8086072ba1e7cc2358baeca134c825a7",
+            "3391fdddfc8dc7393707a65b1b4709397cf8b1d162af05abfe8f450de5f36bc6b0455a8520bc4e6f5fe95b1fe3c8452b",
+            "09330c33f71147e83d192fc782cd1b4753111b173b3b05d22fa08086e3b0f712fcc7c71a557e2db966c3e9fa91746039",
+            "b12932b0627d1c060942f5447764155655bd4da0c9afa6dd9b9ef53129af1b8fb0195996d2de9ca0df9d821ffee67026",
+            "9d0e1809716474cb086e834e310a4a1ced149e9c00f248527972cec5704c2a5b07b8b3dc38ecc4ebae97ddd87f3d8985"}},
+        {"SHA512", Initialize<Sha512Context, SHA512_Init_nid_postfix>, Update<Sha512Context, SHA512_Update_nid_postfix>, Finalize<Sha512Context, SHA512_Final_nid_postfix>, 216, 128, 64, {
+            "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e",
+            "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f",
+            "204a8fc6dda82f0a0ced7beb8e08a41657c16ef468b228a8279be331a703c33596fd15c13b1b07f9aa1d3bea57789ca031ad85c7a71dd70354ec631238ca3445",
+            "8e959b75dae313da8cf4f72814fc143f8f7779c6eb9f7fa17299aeadb6889018501d289e4900f7e4331b99dec4b5433ac7d329eeb6dd26545e96e55b874be909",
+            "72ec1ef1124a45b047e8b7c75a932195135bb61de24ec0d1914042246e0aec3a2354e093d76f3048b456764346900cb130d2a4fd5dd16abb5e30bcb850dee843",
+            "e718483d0ce769644e2e42c7bc15b4638e1f98b13b2044285632a803afa973ebde0ff244877ea60a4cb0432ce577c31beb009c5c2c49aa2e4eadb217ad8cc09b"}},
+    };
+
+    for (const auto& algorithm : algorithms) {
+        for (int i = 0; i < 6; ++i) {
+            if (!algorithm.expected[i]) continue;
+            const auto& message = messages[i];
+            const std::size_t chunks[] {message.size() ? message.size() : 1, 1, algorithm.blockSize - 1, algorithm.blockSize, algorithm.blockSize + 1, 1000};
+            for (auto chunk : chunks) {
+                if (i == 5 && chunk < 64) continue;
+                Require(Digest(algorithm, message, chunk) == algorithm.expected[i], algorithm.name);
+            }
+        }
+
+        alignas(16) unsigned char context[256] {};
+        alignas(16) unsigned char copy[256] {};
+        unsigned char digest[64] {};
+        unsigned char copyDigest[64] {};
+        const bool wide = algorithm.blockSize == 128;
+        const auto num = [&](const unsigned char* c) {
+            std::uint32_t value;
+            std::memcpy(&value, c + (wide ? 208 : (algorithm.contextSize == 112 ? 104 : algorithm.contextSize - 4)), 4);
+            return value;
+        };
+        const auto bitsLow = [&](const unsigned char* c) {
+            const std::size_t offset = wide ? 64 : (algorithm.contextSize == 96 ? 20 : algorithm.contextSize == 112 ? 32 : 16);
+            std::uint64_t value = 0;
+            std::memcpy(&value, c + offset, wide ? 8 : 4);
+            return value;
+        };
+        Require(algorithm.init(context) == 1, "init");
+        Require(algorithm.update(context, nullptr, 0) == 1, "empty update with null data");
+        Require(algorithm.update(context, "ab", 2) == 1, "partial update");
+        Require(num(context) == 2 && bitsLow(context) == 16, "context records the buffered bytes and the bit count");
+        std::memcpy(copy, context, sizeof(copy));
+        Require(algorithm.update(context, "c", 1) == 1 && algorithm.update(copy, "c", 1) == 1, "update of a copied context");
+        Require(algorithm.final(digest, context) == 1 && algorithm.final(copyDigest, copy) == 1, "final of a copied context");
+        Require(Hex(digest, algorithm.digestSize) == algorithm.expected[1] && !std::memcmp(digest, copyDigest, sizeof(digest)), "copied context digest");
+        if (!wide) Require(num(context) == 0, "final clears the buffered count");
+        RequireThrows([&] { algorithm.init(nullptr); }, "null context");
+        RequireThrows([&] { algorithm.update(context, nullptr, 1); }, "null data");
+        if (!wide) RequireThrows([&] { algorithm.final(nullptr, context); }, "null digest");
+    }
+
+    alignas(16) unsigned char context[256] {};
+    unsigned char digest[64] {};
+    Require(SHA512_Init_nid_postfix(reinterpret_cast<Sha512Context*>(context)) == 1 && SHA512_Final_nid_postfix(nullptr, reinterpret_cast<Sha512Context*>(context)) == 0, "SHA512_Final without a digest buffer");
+    SHA256_Init_nid_postfix(reinterpret_cast<Sha256Context*>(context));
+
+    std::uint32_t length = 33;
+    std::memcpy(context + 108, &length, 4);
+    Require(SHA256_Final_nid_postfix(digest, reinterpret_cast<Sha256Context*>(context)) == 0, "SHA256_Final with an oversized digest length");
+    SHA256_Init_nid_postfix(reinterpret_cast<Sha256Context*>(context));
+
+    length = 16;
+    std::memcpy(context + 108, &length, 4);
+    std::memset(digest, 0xee, sizeof(digest));
+    Require(SHA256_Final_nid_postfix(digest, reinterpret_cast<Sha256Context*>(context)) == 1 && Hex(digest, 16) == "e3b0c44298fc1c149afbf4c8996fb924" && digest[16] == 0xee, "SHA256_Final truncates to the digest length");
+    SHA512_Init_nid_postfix(reinterpret_cast<Sha512Context*>(context));
+
+    length = 32;
+    std::memcpy(context + 212, &length, 4);
+    RequireThrows([&] { SHA512_Final_nid_postfix(digest, reinterpret_cast<Sha512Context*>(context)); }, "SHA-512/256 digest length");
+    SHA256_Init_nid_postfix(reinterpret_cast<Sha256Context*>(context));
+
+    length = 64;
+    std::memcpy(context + 104, &length, 4);
+    RequireThrows([&] { SHA256_Update_nid_postfix(reinterpret_cast<Sha256Context*>(context), "a", 1); }, "corrupt buffered count");
+
+    const auto* abc = reinterpret_cast<const unsigned char*>("abc");
+    Require(SHA256_nid_postfix(abc, 3, digest) == digest && Hex(digest, 32) == "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad", "SHA256 one-shot");
+    Require(SHA256_nid_postfix(nullptr, 0, digest) == digest && Hex(digest, 32) == "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "SHA256 one-shot of nothing");
+    RequireThrows([&] { SHA256_nid_postfix(abc, 3, nullptr); }, "SHA256 one-shot without a digest buffer");
+    std::puts("libSceLibreSsl digest tests passed");
+}
diff --git a/core/libs/tests/GuestLibreSslRuntime.cpp b/core/libs/tests/GuestLibreSslRuntime.cpp
new file mode 100644
index 0000000000..7a67fb61ea
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslRuntime.cpp
@@ -0,0 +1,86 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <source_location>
+#include <stdexcept>
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "LibreSSL runtime check failed at line %u\n", location.line());
+    std::abort();
+}
+
+template<typename TAction> static void RequireThrows(TAction action, std::source_location location = std::source_location::current()) {
+    try { action(); } catch (const std::exception&) { return; }
+    Require(false, location);
+}
+
+static void InitializeHeap() {
+    void* const api[10] {};
+    ApplicationHeapRegister_nid_no_patch(api);
+}
+
+int main() {
+    InitializeHeap();
+    std::array<unsigned char, 4099> first {};
+    std::array<unsigned char, 4099> second {};
+    first.fill(0xa5);
+    Require(RAND_bytes_nid_postfix(first.data(), 0) == 1 && RAND_bytes_nid_postfix(first.data(), -5) == 1);
+    Require(RAND_bytes_nid_postfix(nullptr, 0) == 1);
+    Require(std::all_of(first.begin(), first.end(), [](unsigned char value) { return value == 0xa5; }));
+    Require(RAND_bytes_nid_postfix(first.data(), 3) == 1);
+    Require(std::all_of(first.begin() + 3, first.end(), [](unsigned char value) { return value == 0xa5; }));
+    Require(RAND_bytes_nid_postfix(first.data(), static_cast<int>(first.size())) == 1);
+    Require(RAND_bytes_nid_postfix(second.data(), static_cast<int>(second.size())) == 1);
+    Require(first != second);
+    std::array<std::size_t, 256> counts {};
+    for (const auto value : first) ++counts[value];
+    Require(*std::max_element(counts.begin(), counts.end()) < 64);
+    RequireThrows([] { RAND_bytes_nid_postfix(nullptr, 1); });
+
+    RAND_add_nid_postfix(first.data(), 16, 8.0);
+    RAND_add_nid_postfix(nullptr, 0, 0.0);
+    Require(RAND_status_nid_postfix() == 1);
+    Require(RAND_load_file_nid_postfix("/nonexistent", -1) == 123456);
+    Require(RAND_load_file_nid_postfix(nullptr, 1024) == 1024 && RAND_load_file_nid_postfix(nullptr, 0) == 0);
+    Require(RAND_load_file_nid_postfix(nullptr, 0x100000005) == 5);
+
+    char name[32];
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, sizeof(name)) == name && !std::strcmp(name, "/dev/urandom"));
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, 13) == name && !std::strcmp(name, "/dev/urandom"));
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, 12) == nullptr && !std::strcmp(name, "/dev/urando"));
+    std::memset(name, 'x', sizeof(name));
+    Require(RAND_file_name_nid_postfix(name, 0) == nullptr && name[0] == 'x');
+    Require(RAND_file_name_nid_postfix(nullptr, 0) == nullptr);
+    RequireThrows([] { RAND_file_name_nid_postfix(nullptr, 1); });
+
+    auto* block = static_cast<unsigned char*>(CRYPTO_malloc_nid_postfix(64, "file.c", 10));
+    Require(block != nullptr);
+    std::memset(block, 0x5a, 64);
+    CRYPTO_free_nid_postfix(block);
+
+    block = static_cast<unsigned char*>(CRYPTO_malloc_nid_postfix(32, nullptr, 0));
+    Require(block != nullptr);
+    free_nid_postfix(block);
+
+    block = static_cast<unsigned char*>(malloc_nid_postfix(16));
+    CRYPTO_free_nid_postfix(block);
+    CRYPTO_free_nid_postfix(nullptr);
+
+    Require(CRYPTO_malloc_nid_postfix(0, nullptr, 0) == nullptr);
+    Require(CRYPTO_malloc_nid_postfix(-1, nullptr, 0) == nullptr);
+    Require(CRYPTO_set_mem_functions_nid_postfix(reinterpret_cast<void*>(&std::malloc), reinterpret_cast<void*>(&std::realloc), reinterpret_cast<void*>(&std::free)) == 0);
+    Require(CRYPTO_set_mem_functions_nid_postfix(nullptr, nullptr, nullptr) == 0);
+    std::puts("libSceLibreSsl runtime tests passed");
+}
diff --git a/core/libs/tests/GuestLibreSslX509Errors.cpp b/core/libs/tests/GuestLibreSslX509Errors.cpp
new file mode 100644
index 0000000000..4b68ca300b
--- /dev/null
+++ b/core/libs/tests/GuestLibreSslX509Errors.cpp
@@ -0,0 +1,83 @@
+#include "prx/libSceLibreSsl/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <string>
+
+static constexpr std::uint64_t ExpectedHashes[] {
+    0x8b05d07b5566befULL, 0, 0x708834e4234778b5ULL, 0xefb3526cbf8b4d8fULL,
+    0xf9c246e135cdbad1ULL, 0xd42f63e9d35f4aa1ULL, 0xcccbec8974d6af08ULL, 0x8d443856acab19a4ULL,
+    0x8d2b572b67e1760ULL, 0xa3b575a1199d9fd1ULL, 0xbed7043d1daf8f09ULL, 0x2a0a7832fb23e29dULL,
+    0x265d14ebfd73f005ULL, 0x675282b2d8705cd0ULL, 0xade734fba45db83ULL, 0x2688e741036ec90fULL,
+    0xf75897f162ad286eULL, 0x74e217b21ed87663ULL, 0xa33689775feaef0eULL, 0xa3359b0eaed11517ULL,
+    0x6925fd54e311eb7cULL, 0xe6f75276f756e2e2ULL, 0xc9122d9145ee8c0fULL, 0xe88507a36fdaa6e6ULL,
+    0xe4225a4c8853b86fULL, 0x5ef1c83b11d335a6ULL, 0x9b6dfad0758a0221ULL, 0xfe7f0ff3aadd086ULL,
+    0x85a68d2a11031f82ULL, 0x72c1d177130ec956ULL, 0x44d8d6b5ed2f06edULL, 0x738e7dc7a61e12cdULL,
+    0xc1fe96db71c85021ULL, 0x26559c0cfe2f2f78ULL, 0xc3bf2a493ebacd94ULL, 0xa4206ad9f25787ddULL,
+    0x3f7344fff3aa908bULL, 0x23335a5daca94f1aULL, 0x1d9d2747a36c85e2ULL, 0xf07fa5bffdd43063ULL,
+    0x1bad38ca7c7bc1e8ULL, 0x7715922cd76c9dceULL, 0x82fcbf1e3440e64eULL, 0x6d1f21d68462a5d4ULL,
+    0x2e572ca0e246a7c9ULL, 0x5e23e31a525a543bULL, 0xa0bd09ebfc8cc89ULL, 0x85288e1dd50bdaceULL,
+    0xf659605c19b0997eULL, 0xddad96c31c47ffdeULL, 0x2ccb58faf48aae6aULL, 0x9973a358685fe222ULL,
+    0xe154c3e01bf7ba9bULL, 0x1e042e731311c0e8ULL, 0xa9af33b6e407c014ULL,
+};
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", message);
+    std::abort();
+}
+
+static std::uint64_t Hash(const char* text) {
+    Require(text != nullptr, "error string is non-null");
+    std::uint64_t value = 14695981039346656037ULL;
+    for (; *text; ++text) value = (value ^ static_cast<unsigned char>(*text)) * 1099511628211ULL;
+    return value;
+}
+
+int main() {
+    constexpr std::int64_t offsets[] {0, INT64_C(0x100000000), -INT64_C(0x100000000),
+                                    std::numeric_limits<std::int64_t>::min(), INT64_C(0x7fffffff00000000)};
+    for (std::int64_t code = 0; code < 55; ++code) {
+        if (code == 1) continue;
+        const char* stable = X509_verify_cert_error_string_nid_postfix(code);
+        for (const auto offset : offsets) {
+            const char* actual = X509_verify_cert_error_string_nid_postfix(code + offset);
+            Require(Hash(actual) == ExpectedHashes[code], "complete LibreSSL 2.5.4 message mapping");
+            Require(actual == stable, "known messages retain static storage across 64-bit aliases");
+        }
+    }
+
+    for (std::int64_t code = -300; code <= 300; ++code) {
+        if (code == 0 || (code >= 2 && code <= 54)) continue;
+        const std::string expected = "error number " + std::to_string(code);
+        const char* actual = X509_verify_cert_error_string_nid_postfix(code);
+        Require(actual && expected == actual, "unknown and newer codes retain the numeric fallback");
+    }
+
+    struct WideCase { std::int64_t error; const char* expected; };
+    constexpr WideCase wideCases[] {
+        {std::numeric_limits<std::int64_t>::max(), "error number 9223372036854775807"},
+        {std::numeric_limits<std::int64_t>::min() + 1, "error number -9223372036854775807"},
+        {INT64_C(4294967297), "error number 4294967297"},
+        {-INT64_C(4294967295), "error number -4294967295"},
+        {INT64_C(2147483648), "error number 2147483648"},
+        {-INT64_C(2147483648), "error number -2147483648"},
+        {INT64_C(4294967358), "error number 4294967358"},
+    };
+    for (const auto& item : wideCases) {
+        const char* actual = X509_verify_cert_error_string_nid_postfix(item.error);
+        Require(actual && std::strcmp(actual, item.expected) == 0, "fallback formats all 64 argument bits");
+    }
+
+    const char* shared = X509_verify_cert_error_string_nid_postfix(-123);
+    const char* known = X509_verify_cert_error_string_nid_postfix(10);
+    Require(std::strcmp(shared, "error number -123") == 0, "known lookup preserves unknown buffer");
+    const char* next = X509_verify_cert_error_string_nid_postfix(62);
+    Require(shared == next && std::strcmp(shared, "error number 62") == 0, "unknown results share overwritten storage");
+    Require(std::strcmp(known, "certificate has expired") == 0, "unknown formatting preserves known message");
+    Require(std::strcmp(X509_verify_cert_error_string_nid_postfix(0), "ok") == 0, "success message");
+    return 0;
+}
diff --git a/core/libs/tests/GuestLifecycle.cpp b/core/libs/tests/GuestLifecycle.cpp
index 11cb61e1ec..ccdf3cc1df 100644
--- a/core/libs/tests/GuestLifecycle.cpp
+++ b/core/libs/tests/GuestLifecycle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
 #include <cstdint>
@@ -10,19 +11,6 @@
 #include <dlfcn.h>
 #endif
 
-struct InitEnvParams {
-    int argc;
-    std::uint32_t pad;
-    const char* argv[3];
-};
-
-extern "C" {
-int APS5_VABI cxa_atexit_nid_postfix(void (APS5_VABI *)(void*), void*, void*);
-void APS5_VABI cxa_finalize_nid_postfix(void*);
-int APS5_VABI LibcInternalExtCxaThreadAtexit_nid_postfix(void (APS5_VABI *)(void*), void*, void*);
-void APS5_VABI init_env_nid_postfix(const InitEnvParams*);
-}
-
 namespace {
 
 void Require(bool value) {
@@ -54,10 +42,13 @@ int main() {
     Require(cxa_atexit_nid_postfix(Second, nullptr, first) == 0);
     Require(cxa_atexit_nid_postfix(Other, nullptr, second) == 0);
     cxa_finalize_nid_postfix(first);
+
     Require(secondAt == 0 && firstAt == 1 && otherAt == -1);
     cxa_finalize_nid_postfix(reinterpret_cast<void*>(3));
+
     Require(otherAt == -1);
     cxa_finalize_nid_postfix(second);
+
     Require(otherAt == 2);
 
     std::thread worker([] {
@@ -79,6 +70,7 @@ int main() {
 
     try {
         init_env_nid_postfix(nullptr);
+
     } catch (const std::runtime_error& error) {
         Require(std::strstr(error.what(), "not implemented") == nullptr);
         return 0;
diff --git a/core/libs/tests/GuestLoadExecHost.cpp b/core/libs/tests/GuestLoadExecHost.cpp
index bba40568d0..618d8f5ebf 100644
--- a/core/libs/tests/GuestLoadExecHost.cpp
+++ b/core/libs/tests/GuestLoadExecHost.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/General.hpp"
@@ -17,11 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI*)(void*), void*, void*);
-extern "C" int APS5_VABI getargc_nid_postfix();
-extern "C" const char** APS5_VABI getargv_nid_postfix();
-
 namespace {
 
 bool cleaned = false;
diff --git a/core/libs/tests/GuestLocale.cpp b/core/libs/tests/GuestLocale.cpp
index 71b71a1669..3baacd92f3 100644
--- a/core/libs/tests/GuestLocale.cpp
+++ b/core/libs/tests/GuestLocale.cpp
@@ -1,6 +1,9 @@
+#include "prx/libc/include/ApplicationHeap.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestLocale.hpp"
 #include <array>
 #include <cstdint>
+#include <cstdlib>
 #include <cstring>
 #include <cwchar>
 #include <climits>
@@ -11,29 +14,14 @@
 
 extern "C" {
 extern GuestLocale::Implementation* _ZSt21_sceLibcClassicLocale_nid_postfix;
-GuestLocale::Implementation* APS5_VABI _ZNSt6locale16_GetgloballocaleEv_nid_postfix();
-GuestLocale::Implementation* APS5_VABI _ZNSt6locale5_InitEv_nid_postfix();
-struct GuestLocaleFacade { GuestLocale::Implementation* implementation; };
-GuestLocaleFacade* APS5_VABI _ZNSt6locale7classicEv_nid_postfix();
-void APS5_VABI _ZNSt6locale5facet9_RegisterEv_nid_postfix(GuestLocale::Facet* self);
-void APS5_VABI _ZNSt8_LocinfoC1EPKc_nid_postfix(GuestLocale::LocinfoStorage* self, const char* localeName);
-void APS5_VABI _ZNSt8_LocinfoD1Ev_nid_postfix(GuestLocale::LocinfoStorage* self);
-void APS5_VABI _ZNSt8ios_baseD2Ev_nid_postfix(GuestLocale::IosBase* self);
-struct StreamManipulator {
-    GuestLocale::IosBase* (APS5_VABI* function)(GuestLocale::IosBase*, std::int32_t);
-    std::int32_t argument;
-};
-StreamManipulator APS5_VABI _ZSt4setwi_nid_postfix(std::int32_t width);
-void APS5_VABI _ZNSt8ios_base7_AddstdEPS__nid_postfix(GuestLocale::IosBase* self);
-const short* APS5_VABI _Getpctype_nid_postfix();
-const short* APS5_VABI _Getptolower_nid_postfix();
-const short* APS5_VABI _Getptoupper_nid_postfix();
-int APS5_VABI _Mbtowcx_nid_postfix(std::uint16_t* dst, const char* src, std::size_t count, std::mbstate_t* st);
-int APS5_VABI _Wctombx_nid_postfix(char* dst, std::uint16_t src, std::mbstate_t* st);
-void APS5_VABI _Locksyslock_nid_postfix();
-void APS5_VABI _Unlocksyslock_nid_postfix();
-std::uint32_t APS5_VABI _Towctrans_nid_postfix(std::uint32_t wc, std::uint64_t desc);
-int* APS5_VABI __error_nid_postfix();
+
+extern std::uint64_t _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix;
+extern std::uint64_t _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix;
+extern std::uint64_t _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix;
+extern std::uintptr_t _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix[17];
+extern std::uintptr_t _ZTVSt7codecvtIwc9_MbstatetE_nid_postfix[13];
+extern std::uintptr_t _ZTVSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix[14];
+extern std::uintptr_t _ZTVSt7collateIcE_nid_postfix[9];
 
 }
 
@@ -41,6 +29,17 @@ static void Require(bool condition) {
     if (!condition) throw std::runtime_error("Guest locale check failed");
 }
 
+void* APS5_VABI TestHeapAllocate(std::size_t bytes) { return std::malloc(bytes); }
+void APS5_VABI TestHeapFree(void* pointer) { std::free(pointer); }
+void* APS5_VABI TestHeapCalloc(std::size_t count, std::size_t bytes) { return std::calloc(count, bytes); }
+void* APS5_VABI TestHeapReallocate(void* pointer, std::size_t bytes) { return std::realloc(pointer, bytes); }
+void* APS5_VABI TestHeapAlign(std::size_t, std::size_t bytes) { return std::malloc(bytes); }
+void* APS5_VABI TestHeapRealign(void* pointer, std::size_t bytes, std::size_t) { return std::realloc(pointer, bytes); }
+int APS5_VABI TestHeapPosixAlign(void** pointer, std::size_t, std::size_t bytes) {
+    *pointer = std::malloc(bytes);
+    return *pointer == nullptr ? 12 : 0;
+}
+
 template<typename TAction>
 static void RequireException(TAction action) {
     bool caught = false;
@@ -52,6 +51,34 @@ static void RequireException(TAction action) {
     Require(caught);
 }
 
+static void CheckInputFacetObjects() {
+    Require(_ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix == 0 && _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix == 0);
+    _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 7;
+    _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 9;
+    Require(_ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix == 7 && _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix == 9);
+    _ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+    _ZNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+    for (const auto slot : _ZTVSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE_nid_postfix) Require(slot == 0);
+}
+
+static void CheckCodecvtWideVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7codecvtIwc9_MbstatetE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
+static void CheckCollateVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7collateIcE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
 static void CheckGuestCalls() {
     auto* locale = _ZSt21_sceLibcClassicLocale_nid_postfix;
     Require(locale != nullptr && locale == _ZNSt6locale16_GetgloballocaleEv_nid_postfix());
@@ -95,8 +122,10 @@ static void CheckLocinfoAlignment() {
     bytes.fill(std::byte{0x5a});
     auto* storage = reinterpret_cast<GuestLocale::LocinfoStorage*>(bytes.data() + 8);
     _ZNSt8_LocinfoC1EPKc_nid_postfix(storage, "C");
+
     for (std::size_t index = 0; index < bytes.size(); ++index) Require(bytes[index] == (index >= 8 && index < 72 ? std::byte{} : std::byte{0x5a}));
     _ZNSt8_LocinfoD1Ev_nid_postfix(storage);
+
     RequireException([&] { _ZNSt8_LocinfoC1EPKc_nid_postfix(storage, "unknown-locale"); });
     RequireException([] { _ZNSt8_LocinfoC1EPKc_nid_postfix(nullptr, "C"); });
 }
@@ -151,6 +180,7 @@ static void CheckStreamDestruction() {
     } object;
     object.stream.locale = &_ZSt21_sceLibcClassicLocale_nid_postfix;
     _ZNSt8ios_baseD2Ev_nid_postfix(&object.stream);
+
     Require(object.stream.locale == nullptr && object.before == 0x12345678 && object.after == 0x87654321);
     object.stream.locale = &_ZSt21_sceLibcClassicLocale_nid_postfix;
     object.stream.callbacks = &object;
@@ -188,31 +218,42 @@ static void CheckStandardStreams() {
     RequireException([&] { _ZNSt8ios_base7_AddstdEPS__nid_postfix(nullptr); });
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[0].stream);
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[1].stream);
+
     Require(streams[0].stream.standardStream == 1 && streams[1].stream.standardStream == 2);
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.standardStream == 1);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.locale == classic && streams[0].stream.standardStream == 1);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.locale == nullptr && streams[0].stream.standardStream == 1);
     streams[0].stream.locale = classic;
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[0].stream);
+
     Require(streams[0].stream.standardStream == 1);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[1].stream);
+
     Require(streams[1].stream.locale == nullptr && streams[1].stream.standardStream == 2);
     for (int index = 2; index < 7; ++index) {
         _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[index].stream);
+
         Require(streams[index].stream.standardStream == index + 1);
     }
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[7].stream);
     _ZNSt8ios_base7_AddstdEPS__nid_postfix(&streams[8].stream);
+
     Require(streams[7].stream.standardStream == 8 && streams[8].stream.standardStream == 8);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[7].stream);
+
     Require(streams[7].stream.locale == classic);
     _ZNSt8ios_baseD2Ev_nid_postfix(&streams[8].stream);
+
     Require(streams[8].stream.locale == nullptr);
     for (int index = 2; index < 7; ++index) {
         _ZNSt8ios_baseD2Ev_nid_postfix(&streams[index].stream);
+
         Require(streams[index].stream.locale == nullptr && streams[index].stream.standardStream == index + 1);
     }
     for (auto& object : streams) Require(object.before == 0x12345678 && object.after == 0x87654321);
@@ -240,7 +281,69 @@ static void CheckWideCaseTranslation() {
     }
 }
 
+static void CheckWideNumPutVtableObject() {
+    for (std::uintptr_t& slot : _ZTVSt7num_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE_nid_postfix) {
+        Require(slot == 0);
+        slot = 0x1111;
+        Require(slot == 0x1111);
+        slot = 0;
+    }
+}
+
+static void CheckFacetGetcat() {
+    const GuestLocale::Implementation* locale = _ZSt21_sceLibcClassicLocale_nid_postfix;
+    GuestLocale::Facet* codecvt = nullptr;
+    Require(_ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(&codecvt, &locale) == 2 && codecvt != nullptr);
+    auto* codecvtVtable = reinterpret_cast<const GuestLocale::CodecvtVtable*>(codecvt->vtable);
+    Require(codecvtVtable->alwaysNoconv(codecvt) && codecvtVtable->encoding(codecvt) == 1 && codecvtVtable->maxLength(codecvt) == 1);
+    const char* nextFrom = nullptr;
+    char target[4]{};
+    char* nextTo = nullptr;
+    Require(codecvtVtable->out(codecvt, nullptr, "ab", "ab" + 2, &nextFrom, target, target + 4, &nextTo) == 3);
+    Require(nextFrom == "ab" && nextTo == target);
+    Require(codecvtVtable->in(codecvt, nullptr, "ab", "ab" + 2, &nextFrom, target, target + 4, &nextTo) == 3);
+    nextTo = reinterpret_cast<char*>(0x10);
+    Require(codecvtVtable->unshift(codecvt, nullptr, nullptr, nullptr, &nextTo) == 0 && nextTo == nullptr);
+    Require(codecvtVtable->length(codecvt, nullptr, "ab", "ab" + 2, 5) == 2);
+    Require(codecvtVtable->length(codecvt, nullptr, "ab", "ab" + 2, 1) == 1);
+    GuestLocale::Facet* punct = nullptr;
+    Require(_ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(&punct, &locale) == 4 && punct != nullptr);
+    auto* punctVtable = reinterpret_cast<const GuestLocale::NumpunctVtable*>(punct->vtable);
+    auto* punctFacet = reinterpret_cast<const GuestLocale::NumpunctFacet*>(punct);
+    Require(punctVtable->decimalPoint(punctFacet) == '.' && punctVtable->thousandsSep(punctFacet) == ',');
+    GuestLocale::String name{};
+    Require(punctVtable->grouping(&name, punctFacet) == &name && name.size == 0);
+    const char* contents = name.size <= 15 ? name.buffer : name.pointer;
+    Require(punctVtable->falsename(&name, punctFacet)->size == 5 && std::memcmp(contents, "false", 5) == 0);
+    contents = name.size <= 15 ? name.buffer : name.pointer;
+    Require(punctVtable->truename(&name, punctFacet)->size == 4 && std::memcmp(contents, "true", 4) == 0);
+    GuestLocale::Facet* numPut = nullptr;
+    Require(_ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(&numPut, &locale) == 4 && numPut != nullptr);
+    GuestLocale::Facet* timePut = nullptr;
+    Require(_ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE7_GetcatEPPKNSt6locale5facetEPKS5__nid_postfix(&timePut, &locale) == 5 && timePut != nullptr);
+    _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 11;
+    Require(_ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix == 11);
+    _ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEE2idE_nid_postfix = 0;
+    for (GuestLocale::Facet* facet : {codecvt, punct, numPut, timePut}) {
+        facet->vtable->retain(facet);
+        facet->vtable->retain(facet);
+        Require(facet->references == 2);
+        facet->vtable->deleteObject(facet);
+    }
+    Require(_ZNSt7codecvtIcc9_MbstatetE7_GetcatEPPKNSt6locale5facetEPKS2__nid_postfix(nullptr, &locale) == 2);
+    Require(_ZNSt8numpunctIcE7_GetcatEPPKNSt6locale5facetEPKS1__nid_postfix(&punct, &locale) == 4);
+}
+
 int main() {
+    std::array<void*, 10> heapApi{};
+    heapApi[0] = reinterpret_cast<void*>(&TestHeapAllocate);
+    heapApi[1] = reinterpret_cast<void*>(&TestHeapFree);
+    heapApi[2] = reinterpret_cast<void*>(&TestHeapCalloc);
+    heapApi[3] = reinterpret_cast<void*>(&TestHeapReallocate);
+    heapApi[4] = reinterpret_cast<void*>(&TestHeapAlign);
+    heapApi[5] = reinterpret_cast<void*>(&TestHeapRealign);
+    heapApi[6] = reinterpret_cast<void*>(&TestHeapPosixAlign);
+    ApplicationHeapRegister_nid_no_patch(heapApi.data());
     CheckGuestCalls();
     CheckLocinfoAlignment();
     CheckCharacterTables();
@@ -249,9 +352,15 @@ int main() {
     CheckStreamWidth();
     CheckStandardStreams();
     CheckWideCaseTranslation();
+    CheckInputFacetObjects();
+    CheckCodecvtWideVtableObject();
+    CheckWideNumPutVtableObject();
+    CheckFacetGetcat();
+    CheckCollateVtableObject();
     _Locksyslock_nid_postfix();
     _Locksyslock_nid_postfix();
     _Unlocksyslock_nid_postfix();
     _Unlocksyslock_nid_postfix();
+
     std::cout << "Guest locale checks passed\n";
 }
diff --git a/core/libs/tests/GuestLoginDialog.cpp b/core/libs/tests/GuestLoginDialog.cpp
index 09e5d52663..6f919c7cc8 100644
--- a/core/libs/tests/GuestLoginDialog.cpp
+++ b/core/libs/tests/GuestLoginDialog.cpp
@@ -1,18 +1,9 @@
+#include "prx/libSceLoginDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 
-extern "C" {
-int APS5_VABI sceLoginDialogInitialize(void);
-int APS5_VABI sceLoginDialogOpen(const LoginDialogParam* param);
-int APS5_VABI sceLoginDialogUpdateStatus(void);
-int APS5_VABI sceLoginDialogGetStatus(void);
-int APS5_VABI sceLoginDialogGetResult(LoginDialogResult* result);
-int APS5_VABI sceLoginDialogClose(void);
-int APS5_VABI sceLoginDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestLoginService.cpp b/core/libs/tests/GuestLoginService.cpp
index a1fa20d143..dfee6d6f6c 100644
--- a/core/libs/tests/GuestLoginService.cpp
+++ b/core/libs/tests/GuestLoginService.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceLoginService/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
@@ -5,12 +6,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceLoginServiceInitialize(void);
-int APS5_VABI sceLoginServiceTerminate(void);
-int APS5_VABI sceLoginServiceRequestDevices(void* param);
-}
-
 static void Require(bool value) {
     if (!value) std::abort();
 }
@@ -20,7 +15,8 @@ int main() {
     Require(sceLoginServiceTerminate() == 0);
     unsigned char buffer[0x80]{};
     try {
-        sceLoginServiceRequestDevices(buffer);
+        sceLoginServiceRequestDevices(reinterpret_cast<const LoginServiceDeviceRequest*>(buffer));
+
     } catch (const std::runtime_error& error) {
         if (std::string(error.what()) == "sceLoginServiceRequestDevices not implemented") return 0;
         std::fprintf(stderr, "sceLoginServiceRequestDevices threw: %s\n", error.what());
diff --git a/core/libs/tests/GuestLowAddressMemory.cpp b/core/libs/tests/GuestLowAddressMemory.cpp
new file mode 100644
index 0000000000..3af824dcac
--- /dev/null
+++ b/core/libs/tests/GuestLowAddressMemory.cpp
@@ -0,0 +1,60 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/GuestArena.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "Low guest memory check failed at line %u\n", static_cast<unsigned>(location.line()));
+        std::abort();
+    }
+}
+
+int main() {
+    constexpr std::size_t page = 0x4000;
+    constexpr std::size_t bufferBytes = 64u << 20;
+    constexpr std::size_t stackBytes = 128u << 20;
+    constexpr std::uintptr_t lowLimit = 0x80000000;
+    const auto failed = reinterpret_cast<void*>(~std::uintptr_t{0});
+    auto* buffer = static_cast<unsigned char*>(mmap_nid_postfix(reinterpret_cast<void*>(0x20000000), bufferBytes, 3, 0x1002, -1, 0));
+    auto* stack = static_cast<unsigned char*>(mmap_nid_postfix(reinterpret_cast<void*>(0x40000000), stackBytes, 3, 0x1002, -1, 0));
+    std::fprintf(stderr, "Low guest memory: buffer=%p stack=%p\n", static_cast<void*>(buffer), static_cast<void*>(stack));
+    Require(buffer != failed && stack != failed);
+    const auto bufferAddress = reinterpret_cast<std::uintptr_t>(buffer);
+    const auto stackAddress = reinterpret_cast<std::uintptr_t>(stack);
+    Require(bufferAddress >= 0x20000000 && bufferAddress <= lowLimit - bufferBytes);
+    Require(stackAddress >= 0x40000000 && stackAddress <= lowLimit - stackBytes);
+    Require(GuestArena::GuestArenaContains_nid_postfix(buffer, bufferBytes));
+    Require(GuestArena::GuestArenaContains_nid_postfix(stack, stackBytes));
+    buffer[0] = 0x31;
+    buffer[bufferBytes - 1] = 0x32;
+    stack[0] = 0x41;
+    stack[stackBytes - 1] = 0x42;
+
+    void* collision = mmap_nid_postfix(buffer, page, 3, 0x1002, -1, 0);
+    Require(collision != failed && collision != buffer);
+    Require(buffer[0] == 0x31 && buffer[bufferBytes - 1] == 0x32);
+    Require(munmap_nid_postfix(collision, page) == 0);
+    Require(mmap_nid_postfix(buffer, page, 3, 0x5012, -1, 0) == failed && buffer[0] == 0x31);
+    Require(mmap_nid_postfix(buffer, page, 3, 0x1012, -1, 0) == buffer);
+    Require(buffer[0] == 0 && buffer[bufferBytes - 1] == 0x32);
+
+    Require(mprotect_nid_postfix(buffer, page, 1) == 0);
+    VirtualQueryInfo info{};
+    Require(sceKernelVirtualQuery(buffer, 0, &info, sizeof(info)) == 0 && info.protection == 1);
+    Require(mprotect_nid_postfix(buffer, page, 3) == 0);
+    buffer[0] = 0x51;
+
+    void* ordinary = mmap_nid_postfix(nullptr, page, 3, 0x1002, -1, 0);
+    Require(ordinary != failed && reinterpret_cast<std::uintptr_t>(ordinary) >= 0x200000000ull);
+    Require(munmap_nid_postfix(ordinary, page) == 0);
+    Require(munmap_nid_postfix(buffer, bufferBytes) == 0);
+    Require(munmap_nid_postfix(stack, stackBytes) == 0);
+    Require(mmap_nid_postfix(buffer, page, 3, 0x1002, -1, 0) == buffer);
+    Require(buffer[0] == 0);
+    Require(munmap_nid_postfix(buffer, page) == 0);
+}
diff --git a/core/libs/tests/GuestM4aacEnc.cpp b/core/libs/tests/GuestM4aacEnc.cpp
index d9f6f00888..0db4db35fa 100644
--- a/core/libs/tests/GuestM4aacEnc.cpp
+++ b/core/libs/tests/GuestM4aacEnc.cpp
@@ -1,28 +1,9 @@
+#include "prx/libSceM4aacEnc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int32_t APS5_VABI sceM4aacEncClearContext(int32_t m4aacEncHandle);
-int APS5_VABI sceM4aacEncClearContextEx();
-int32_t APS5_VABI sceM4aacEncCreateEncoder(int32_t channels, int32_t samplingRate, int32_t bitRate, int32_t inputFormat, int32_t outputFormat, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncCreateEncoderEx();
-int32_t APS5_VABI sceM4aacEncDeleteEncoder(int32_t m4aacEncHandle, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncDeleteEncoderEx();
-int32_t APS5_VABI sceM4aacEncEncode(int32_t m4aacEncHandle, void* pInput, uint32_t inputByte, void* pOutput, uint32_t* pOutputByte, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncEncodeEx();
-int APS5_VABI sceM4aacEncEncodeWithPriority();
-int APS5_VABI sceM4aacEncEncodeWithPriorityEx();
-int32_t APS5_VABI sceM4aacEncFlush(int32_t m4aacEncHandle, void* pOutput, uint32_t* pOutputByte, int32_t* pInternalError);
-int APS5_VABI sceM4aacEncFlushEx();
-int APS5_VABI sceM4aacEncFlushWithPriority();
-int APS5_VABI sceM4aacEncFlushWithPriorityEx();
-int APS5_VABI sceM4aacEncGetContext();
-int APS5_VABI sceM4aacEncInitialize();
-int APS5_VABI sceM4aacEncTerminate();
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp
index d7a52ec814..6a11dd9caa 100644
--- a/core/libs/tests/GuestMath.cpp
+++ b/core/libs/tests/GuestMath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <bit>
 #include <cerrno>
@@ -13,50 +14,10 @@
 #include <limits>
 #include <initializer_list>
 #include <xmmintrin.h>
-struct GuestFloatingPointEnvironment {
-    std::uint32_t control;
-    std::uint32_t status;
-    std::uint32_t tag;
-    unsigned char other[16];
-    std::uint32_t mxcsr;
-};
+
 static_assert(sizeof(GuestFloatingPointEnvironment) == 32);
 extern "C" {
-int APS5_VABI fegetenv_nid_postfix(GuestFloatingPointEnvironment*);
-double APS5_VABI atof_nid_postfix(const char*);
-double APS5_VABI strtod_nid_postfix(const char*, char**);
-double APS5_VABI wcstod_nid_postfix(const char16_t*, char16_t**);
-float APS5_VABI wcstof_nid_postfix(const char16_t*, char16_t**);
-long double APS5_VABI wcstold_nid_postfix(const char16_t*, char16_t**);
-float APS5_VABI strtof_nid_postfix(const char*, char**);
-long double APS5_VABI strtold_nid_postfix(const char*, char**);
-std::int64_t APS5_VABI strtol_nid_postfix(const char*, char**, int);
-std::uint64_t APS5_VABI strtoul_nid_postfix(const char*, char**, int);
-std::intmax_t APS5_VABI strtoimax_nid_postfix(const char*, char**, int);
-long long APS5_VABI strtoll_nid_postfix(const char*, char**, int);
-unsigned long long APS5_VABI strtoull_nid_postfix(const char*, char**, int);
-std::uintmax_t APS5_VABI strtoumax_nid_postfix(const char*, char**, int);
-unsigned long long APS5_VABI _Stoull_nid_postfix(const char*, char**, int);
-std::uint64_t APS5_VABI _Stoul_nid_postfix(const char*, char**, int);
-int APS5_VABI atoi_nid_postfix(const char*);
-std::int64_t APS5_VABI atol_nid_postfix(const char*);
-long long APS5_VABI atoll_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-double APS5_VABI sqrt_nid_postfix(double);
-float APS5_VABI sqrtf_nid_postfix(float);
-double APS5_VABI fabs_nid_postfix(double);
-int APS5_VABI abs_nid_postfix(int);
-double APS5_VABI trunc_nid_postfix(double);
-double APS5_VABI ceil_nid_postfix(double);
-double APS5_VABI floor_nid_postfix(double);
-float APS5_VABI truncf_nid_postfix(float);
-float APS5_VABI ceilf_nid_postfix(float);
-float APS5_VABI floorf_nid_postfix(float);
-double APS5_VABI nearbyint_nid_postfix(double);
-double APS5_VABI fma_nid_postfix(double, double, double);
-long double APS5_VABI acosl_nid_postfix(long double);
-long double APS5_VABI asinl_nid_postfix(long double);
-long double APS5_VABI frexpl_nid_postfix(long double, int*);
+
 struct LibcFloatConstant { std::uint32_t bits[4]; };
 extern LibcFloatConstant _FInf_nid_postfix;
 extern LibcFloatConstant _FNan_nid_postfix;
@@ -72,136 +33,9 @@ extern SonyDconst _LDenorm_nid_postfix;
 extern SonyDconst _LInf_nid_postfix;
 extern SonyDconst _LNan_nid_postfix;
 extern SonyDconst _LSnan_nid_postfix;
-short APS5_VABI _FDtest_nid_postfix(const float*);
-short APS5_VABI _Dtest_nid_postfix(const double*);
-int APS5_VABI __fpclassifyf_nid_postfix(float);
-int APS5_VABI isnanf_nid_postfix(float);
-int APS5_VABI __signbitl_nid_postfix(long double);
-float APS5_VABI fmodf_nid_postfix(float, float);
-double APS5_VABI fmod_nid_postfix(double, double);
-float APS5_VABI asinf_nid_postfix(float);
-float APS5_VABI acosf_nid_postfix(float);
-double APS5_VABI asin_nid_postfix(double);
-float APS5_VABI atan2f_nid_postfix(float, float);
-float APS5_VABI hypotf_nid_postfix(float, float);
-double APS5_VABI hypot_nid_postfix(double, double);
-double APS5_VABI fdim_nid_postfix(double, double);
-float APS5_VABI fdimf_nid_postfix(float, float);
-float APS5_VABI fabsf_nid_postfix(float);
-long double APS5_VABI fabsl_nid_postfix(long double);
-double APS5_VABI copysign_nid_postfix(double, double);
-float APS5_VABI copysignf_nid_postfix(float, float);
-double APS5_VABI remquo_nid_postfix(double, double, int*);
-float APS5_VABI remquof_nid_postfix(float, float, int*);
-float APS5_VABI fmaf_nid_postfix(float, float, float);
-long double APS5_VABI ceill_nid_postfix(long double);
-long double APS5_VABI floorl_nid_postfix(long double);
-float APS5_VABI tanf_nid_postfix(float);
-int APS5_VABI rand_nid_postfix();
-void APS5_VABI srand_nid_postfix(unsigned int);
-int APS5_VABI rand_r_nid_postfix(unsigned int*);
-float APS5_VABI log10f_nid_postfix(float);
-float APS5_VABI powf_nid_postfix(float, float);
-double APS5_VABI log1p_nid_postfix(double);
-float APS5_VABI log1pf_nid_postfix(float);
-double APS5_VABI expm1_nid_postfix(double);
-float APS5_VABI expm1f_nid_postfix(float);
-float APS5_VABI erff_nid_postfix(float);
-double APS5_VABI erf_nid_postfix(double);
-double APS5_VABI erfc_nid_postfix(double);
-float APS5_VABI erfcf_nid_postfix(float);
-double APS5_VABI lgamma_nid_postfix(double);
+
 extern int signgam_nid_postfix;
-float APS5_VABI logbf_nid_postfix(float);
-int APS5_VABI ilogb_nid_postfix(double);
-int APS5_VABI ilogbf_nid_postfix(float);
-double APS5_VABI exp2_nid_postfix(double);
-float APS5_VABI __powisf2_nid_postfix(float, int);
-double APS5_VABI __powidf2_nid_postfix(double, int);
-double APS5_VABI ldexp_nid_postfix(double, int);
-double APS5_VABI scalbn_nid_postfix(double, int);
-float APS5_VABI scalbnf_nid_postfix(float, int);
-float APS5_VABI nextafterf_nid_postfix(float, float);
-double APS5_VABI nextafter_nid_postfix(double, double);
-double APS5_VABI frexp_nid_postfix(double, int*);
-float APS5_VABI frexpf_nid_postfix(float, int*);
-std::int64_t APS5_VABI lround_nid_postfix(double);
-std::div_t APS5_VABI div_nid_postfix(int, int);
-double APS5_VABI sinh_nid_postfix(double);
-double APS5_VABI cosh_nid_postfix(double);
-float APS5_VABI coshf_nid_postfix(float);
-float APS5_VABI sinhf_nid_postfix(float);
-float APS5_VABI _FSinh_nid_postfix(float, float);
-float APS5_VABI _FCosh_nid_postfix(float, float);
-double APS5_VABI asinh_nid_postfix(double);
-float APS5_VABI asinhf_nid_postfix(float);
-double APS5_VABI acosh_nid_postfix(double);
-float APS5_VABI acoshf_nid_postfix(float);
-double APS5_VABI atanh_nid_postfix(double);
-float APS5_VABI atanhf_nid_postfix(float);
-std::int64_t APS5_VABI lroundf_nid_postfix(float);
-std::int64_t APS5_VABI llround_nid_postfix(double);
-std::int64_t APS5_VABI llroundf_nid_postfix(float);
-std::int64_t APS5_VABI llroundl_nid_postfix(long double);
-int APS5_VABI __isfinitef_nid_postfix(float);
-int APS5_VABI __isfinitel_nid_postfix(long double);
-int APS5_VABI __isnormal_nid_postfix(double);
-int APS5_VABI __isnormalf_nid_postfix(float);
-int APS5_VABI __isinff_nid_postfix(float);
-int APS5_VABI __isinf_nid_postfix(double);
-int APS5_VABI isnan_nid_postfix(double);
-int APS5_VABI isinf_nid_postfix(double);
-std::lldiv_t APS5_VABI lldiv_nid_postfix(long long, long long);
-std::lldiv_t APS5_VABI imaxdiv_nid_postfix(std::int64_t, std::int64_t);
-std::int64_t APS5_VABI labs_nid_postfix(std::int64_t);
-std::int64_t APS5_VABI llabs_nid_postfix(std::int64_t);
-std::int64_t APS5_VABI imaxabs_nid_postfix(std::int64_t);
-long double APS5_VABI scalbnl_nid_postfix(long double, int);
-float APS5_VABI significandf_nid_postfix(float);
-double APS5_VABI significand_nid_postfix(double);
-long double APS5_VABI acoshl_nid_postfix(long double);
-long double APS5_VABI asinhl_nid_postfix(long double);
-long double APS5_VABI atanhl_nid_postfix(long double);
-long double APS5_VABI atan2l_nid_postfix(long double, long double);
-long double APS5_VABI cbrtl_nid_postfix(long double);
-long double APS5_VABI erfl_nid_postfix(long double);
-long double APS5_VABI erfcl_nid_postfix(long double);
-long double APS5_VABI expm1l_nid_postfix(long double);
-long double APS5_VABI log1pl_nid_postfix(long double);
-long double APS5_VABI log2l_nid_postfix(long double);
-long double APS5_VABI lgammal_nid_postfix(long double);
-long double APS5_VABI tgammal_nid_postfix(long double);
-float APS5_VABI tgammaf_nid_postfix(float);
-long double APS5_VABI hypotl_nid_postfix(long double, long double);
-float APS5_VABI hypot3f_nid_postfix(float, float, float);
-double APS5_VABI hypot3_nid_postfix(double, double, double);
-long double APS5_VABI hypot3l_nid_postfix(long double, long double, long double);
-float APS5_VABI j0f_nid_postfix(float);
-float APS5_VABI j1f_nid_postfix(float);
-float APS5_VABI jnf_nid_postfix(int, float);
-float APS5_VABI y0f_nid_postfix(float);
-float APS5_VABI y1f_nid_postfix(float);
-float APS5_VABI ynf_nid_postfix(int, float);
-std::lldiv_t APS5_VABI ldiv_nid_postfix(std::int64_t, std::int64_t);
-float APS5_VABI nanf_nid_postfix(const char*);
-double APS5_VABI nan_nid_postfix(const char*);
-long double APS5_VABI atanl_nid_postfix(long double);
-long double APS5_VABI sinl_nid_postfix(long double);
-long double APS5_VABI cosl_nid_postfix(long double);
-long double APS5_VABI tanl_nid_postfix(long double);
-long double APS5_VABI sinhl_nid_postfix(long double);
-long double APS5_VABI coshl_nid_postfix(long double);
-long double APS5_VABI tanhl_nid_postfix(long double);
-long double APS5_VABI expl_nid_postfix(long double);
-long double APS5_VABI exp2l_nid_postfix(long double);
-long double APS5_VABI logl_nid_postfix(long double);
-long double APS5_VABI log10l_nid_postfix(long double);
-long double APS5_VABI powl_nid_postfix(long double, long double);
-long double APS5_VABI ldexpl_nid_postfix(long double, int);
-long double APS5_VABI truncl_nid_postfix(long double);
-long double APS5_VABI nearbyintl_nid_postfix(long double);
-double APS5_VABI logb_nid_postfix(double);
-double APS5_VABI remainder_nid_postfix(double, double);
+
 struct DinkumwareFloatCharacteristics {
     int digits;
     int mantissaDigits;
@@ -436,8 +270,9 @@ static void CheckNanConversions() {
             std::fprintf(stderr, "atof(\"%s\")\n", test.text);
             correct = false;
         }
+        const std::uint32_t expectedSingle = (test.bits >> 63 != 0 ? 0x80000000u : 0) | 0x7fc00000u;
         const auto single = std::bit_cast<std::uint32_t>(strtof_nid_postfix(test.text, &end));
-        if (single != 0x7fc00000u || end != test.text + test.sequenceUsed) {
+        if (single != expectedSingle || end != test.text + test.sequenceUsed) {
             std::fprintf(stderr, "strtof(\"%s\") = 0x%08x\n", test.text, static_cast<unsigned>(single));
             correct = false;
         }
@@ -460,7 +295,7 @@ static void CheckNanConversions() {
         }
         if (test.wideOtherMeasured) {
             const auto wideSingle = std::bit_cast<std::uint32_t>(wcstof_nid_postfix(wide, &wideEnd));
-            const bool singleOk = wideSingle == 0x7fc00000u && wideEnd == wide + test.sequenceUsed;
+            const bool singleOk = wideSingle == expectedSingle && wideEnd == wide + test.sequenceUsed;
             const long double wideExtended = wcstold_nid_postfix(wide, &wideEnd);
             if (!singleOk || !ExtendedBits(wideExtended, 0xc000000000000000ull, 0x7fff) || wideEnd != wide + test.sequenceUsed) {
                 std::fprintf(stderr, "wcstof/wcstold(\"%s\")\n", test.text);
@@ -486,7 +321,6 @@ static void CheckFloatUnderflowErrno() {
     errno = 7;
     Require(strtod_nid_postfix("1e-310", &end) == 1e-310 && errno == 7);
     Require(strtod_nid_postfix("-4.9406564584124654e-324", &end) == -0x1p-1074 && errno == 7);
-    Require(strtof_nid_postfix("1e-40", &end) == 1e-40f && errno == 7);
     Require(strtold_nid_postfix("1e-4940", &end) == 1e-4940L && errno == 7);
     Require(strtod_nid_postfix("1e-330", &end) == 0.0 && errno == ERANGE);
     errno = 0;
@@ -495,6 +329,49 @@ static void CheckFloatUnderflowErrno() {
     Require(strtod_nid_postfix("1e400", &end) == HUGE_VAL && errno == ERANGE);
     errno = 0;
     Require(strtod_nid_postfix("2.2250738585072014e-308", &end) == 0x1p-1022 && errno == 0);
+    Require(strtod_nid_postfix("0x1.8p-1075", &end) == 0x1p-1074 && errno == ERANGE);
+    errno = 0;
+    Require(strtod_nid_postfix("-0x1.000001p-1075", &end) == -0x1p-1074 && errno == ERANGE);
+    errno = 0;
+    Require(strtod_nid_postfix("0x1p-1074", &end) == 0x1p-1074 && strtod_nid_postfix("0x1.8p-1074", &end) == 0x1p-1073 && errno == 0);
+    Require(strtod_nid_postfix("0x1p-1076", &end) == 0.0 && errno == ERANGE);
+    errno = 0;
+    Require(strtod_nid_postfix("0x1p+1100", &end) == HUGE_VAL && errno == ERANGE);
+    errno = 7;
+    Require(strtold_nid_postfix("0x1p-16446", &end) == 0.0L && strtold_nid_postfix("0x1p+20000", &end) == HUGE_VALL && errno == 7);
+    Require(strtof_nid_postfix("0x1p-149", &end) == 0x1p-149f && strtof_nid_postfix("0x1.8p-149", &end) == 0x1p-148f && strtof_nid_postfix("0x1.000001p-149", &end) == 0x1p-149f && errno == 7);
+    Require(strtof_nid_postfix("1.40129846432481707092372958328991613128026194187651577175706828388979108268586060148663818836212158203125e-45", &end) == 0x1p-149f && strtof_nid_postfix("1.17549435e-38", &end) == 0x1p-126f && errno == 7);
+    Require(strtof_nid_postfix("0x1p-150", &end) == 0.0f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("0x1.8p-150", &end) == 0x1p-149f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("-0x0.0000018p-126", &end) == -0x1p-149f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("0x1.4p-149", &end) == 0x1p-149f && strtof_nid_postfix("0x1.cp-149", &end) == 0x1p-148f && errno == 7);
+    errno = 7;
+    Require(strtof_nid_postfix("0x1p+200", &end) == HUGE_VALF && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("1e-40", &end) == 1e-40f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("-1e-45", &end) == -0x1p-149f && errno == ERANGE);
+    errno = 7;
+    Require(strtof_nid_postfix("3e-45", &end) == 0x1p-148f && errno == ERANGE);
+    Require(strtof_nid_postfix("1e39", &end) == HUGE_VALF && errno == ERANGE);
+    errno = 0;
+}
+
+static void CheckAtanfConsoleBits() {
+    constexpr std::uint32_t cases[][2] = {
+        {0x3e80000bu, 0x3e7adbc5u}, {0x3e0007c9u, 0x3dfebd2au}, {0xbdccce4cu, 0xbdcc2090u},
+        {0x3ef00334u, 0x3ee07046u}, {0x3f40077eu, 0x3f24c148u}, {0x3fa009a5u, 0x3f656b6au},
+        {0x4080055cu, 0x3fa9b5a8u}, {0xbf12345eu, 0xbf04d718u}, {0x3f800000u, 0x3f490fdbu},
+        {0x4c800000u, 0x3fc90fdbu}, {0xcc800000u, 0xbfc90fdbu}, {0x7f800000u, 0x3fc90fdbu},
+        {0xff800000u, 0xbfc90fdbu}, {0x7fc00001u, 0x7fc00001u}, {0x80000000u, 0x80000000u},
+        {0x00000001u, 0x00000001u}, {0x39000000u, 0x39000000u},
+    };
+    for (const auto& [input, expected] : cases) {
+        Require(std::bit_cast<std::uint32_t>(atanf_nid_postfix(std::bit_cast<float>(input))) == expected);
+    }
 }
 
 static void CheckHypotSpecialValue() {
@@ -523,6 +400,13 @@ static void CheckPowfSpecialValue() {
     Require(std::bit_cast<std::uint32_t>(powf_nid_postfix(1.0f, std::bit_cast<float>(0x7f800001u))) == 0x3f800000u);
 }
 
+struct RestoreFloatingPointState {
+    std::fenv_t environment;
+    int error = errno;
+    RestoreFloatingPointState() { Require(std::fegetenv(&environment) == 0); }
+    ~RestoreFloatingPointState() { Require(std::fesetenv(&environment) == 0); errno = error; }
+};
+
 static void CheckAcosfErrno() {
     errno = 0;
     Require(std::bit_cast<std::uint32_t>(acosf_nid_postfix(2.0f)) == 0xffc00000u);
@@ -533,6 +417,47 @@ static void CheckAcosfErrno() {
     Require(errno == 0);
 }
 
+static void CheckFmodfErrno() {
+    const RestoreFloatingPointState saved;
+    const struct { std::uint32_t dividend; std::uint32_t divisor; std::uint32_t expected; bool invalid; bool nan; } cases[] = {
+        {0x3f800000u, 0x00000000u, 0u, true, true}, {0x3f800000u, 0x80000000u, 0u, true, true},
+        {0x7f800000u, 0x40000000u, 0u, true, true}, {0x7fc00000u, 0x40000000u, 0u, false, true},
+        {0x3f800000u, 0x7f800000u, 0x3f800000u, false, false}, {0xbf800000u, 0x7f800000u, 0xbf800000u, false, false},
+        {0x41280000u, 0x40000000u, 0x3f000000u, false, false}, {0xc1280000u, 0x40000000u, 0xbf000000u, false, false},
+        {0x41280000u, 0xc0000000u, 0x3f000000u, false, false}, {0xc1280000u, 0xc0000000u, 0xbf000000u, false, false},
+        {0x00000000u, 0x40000000u, 0x00000000u, false, false}, {0x80000000u, 0x40000000u, 0x80000000u, false, false},
+        {0x00000000u, 0x80000000u, 0u, true, true},
+        {0x3f800000u, 0x7fc00001u, 0u, false, true},
+        {0x00000000u, 0x7fc00001u, 0u, false, true},
+        {0x7f800001u, 0x40000000u, 0u, true, true},
+        {0x3f800000u, 0x7f800001u, 0u, true, true},
+        {0x00000003u, 0x00000002u, 0x00000001u, false, false},
+        {0x00800001u, 0x00800000u, 0x00000001u, false, false},
+        {0x80000001u, 0x3f800000u, 0x80000001u, false, false},
+    };
+    for (const auto& test : cases) {
+        std::feclearexcept(FE_ALL_EXCEPT);
+        *__error_nid_postfix() = 73;
+        const float result = fmodf_nid_postfix(std::bit_cast<float>(test.dividend), std::bit_cast<float>(test.divisor));
+        const std::uint32_t bits = std::bit_cast<std::uint32_t>(result);
+        const int invalid = std::fetestexcept(FE_INVALID) != 0;
+        const bool nan = std::isnan(result);
+        if (nan != test.nan || (!nan && bits != test.expected) || invalid != test.invalid || *__error_nid_postfix() != 73) {
+            std::fprintf(stderr, "Guest fmodf failed for %08x and %08x: got %08x, invalid %d, errno %d\n",
+                test.dividend, test.divisor, bits, invalid, *__error_nid_postfix());
+            std::abort();
+        }
+    }
+    std::feclearexcept(FE_ALL_EXCEPT);
+    std::feraiseexcept(FE_DIVBYZERO);
+    *__error_nid_postfix() = 73;
+    (void)fmodf_nid_postfix(1.0f, 0.0f);
+    if (*__error_nid_postfix() != 73 || std::fetestexcept(FE_DIVBYZERO) == 0) {
+        std::fprintf(stderr, "Guest fmodf dropped the floating-point environment\n");
+        std::abort();
+    }
+}
+
 static void CheckLongDouble() {
     Require(ExtendedBits(acosl_nid_postfix(-1.0L), 0xc90fdaa22168c235ull, 0x4000));
     Require(ExtendedBits(acosl_nid_postfix(0.0L), 0xc90fdaa22168c235ull, 0x3fff));
@@ -588,6 +513,35 @@ static long double MakeExtended(std::uint64_t mantissa, std::uint16_t signExpone
     return value;
 }
 
+static void CheckExpm1ConsoleBits() {
+    constexpr struct {
+        std::uint64_t input;
+        std::uint64_t expected;
+        int error;
+    } cases[] = {
+        {0x0000000000000000ull, 0x0000000000000000ull, 0}, {0x8000000000000000ull, 0x8000000000000000ull, 0},
+        {0x3c8fffffffffffffull, 0x3c8fffffffffffffull, 0}, {0x3c90000000000000ull, 0x3c90000000000000ull, 0},
+        {0x3fd62e42fefa39efull, 0x3fda827999fcef32ull, 0}, {0x3fd62e4300000000ull, 0x3fda82799b6f2366ull, 0},
+        {0x3ff0a2b1ffffffffull, 0x3ffd413c1a24d411ull, 0}, {0x3ff0a2b200000000ull, 0x3ffd413c1a24d414ull, 0},
+        {0xbfd0000000000000ull, 0xbfcc5041854df7d4ull, 0}, {0xbfe0000000000000ull, 0xbfd92e9a0720d3ecull, 0},
+        {0x3ff0000000000000ull, 0x3ffb7e151628aed2ull, 0}, {0xbff0000000000000ull, 0xbfe43a54e4e98864ull, 0},
+        {0x4043687a00000000ull, 0x436fffd8395c0c41ull, 0}, {0xc043687a00000000ull, 0xbff0000000000000ull, 0},
+        {0x4049000000000000ull, 0x44719103e4080b45ull, 0}, {0x40862e42fefa39efull, 0x7fefffffffffff2aull, 0},
+        {0x40862e42fefa39f0ull, 0x7ff0000000000000ull, ERANGE}, {0xc08f400000000000ull, 0xbff0000000000000ull, 0},
+        {0x7fefffffffffffffull, 0x7ff0000000000000ull, ERANGE}, {0xffefffffffffffffull, 0xbff0000000000000ull, 0},
+        {0x7ff0000000000000ull, 0x7ff0000000000000ull, 0}, {0xfff0000000000000ull, 0xbff0000000000000ull, 0},
+        {0x7ff8000000000001ull, 0x7ff8000000000001ull, 0}, {0xfff8000000000002ull, 0xfff8000000000002ull, 0},
+        {0x3fc78b9e474afed8ull, 0x3fc9d99e60806b35ull, 0}, {0xbf887a99bea50fb1ull, 0xbf88554c5b9d0cbbull, 0},
+        {0x3ff790fb0ae85390ull, 0x400ae5103402894bull, 0}, {0xbf840fe48e07e54dull, 0xbf83f6d1bcda4943ull, 0},
+        {0xbfbb1276066a31c7ull, 0xbfb9b098289dab68ull, 0}, {0x3fc07bc20a0c887eull, 0x3fc197828317c86cull, 0},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(expm1_nid_postfix(std::bit_cast<double>(item.input))) == item.expected);
+        Require(errno == (item.error != 0 ? item.error : 1234));
+    }
+}
+
 static void CheckAsinl() {
     const struct { std::uint64_t inputMantissa; std::uint16_t inputSignExponent; std::uint64_t outputMantissa; std::uint16_t outputSignExponent; } cases[] = {
         {0, 0x0000, 0, 0x0000}, {0, 0x8000, 0, 0x8000},
@@ -622,6 +576,21 @@ static void CheckAsinl() {
     *__error_nid_postfix() = 0;
 }
 
+static void CheckCbrtfConsoleBits() {
+    constexpr std::uint32_t cases[][2] = {
+        {0x00000123u, 0x28059605u}, {0x00400327u, 0x2a4b334bu}, {0x3f000555u, 0x3f4b32c7u}, {0x3fc00778u, 0x3f9287e5u},
+        {0x42000999u, 0x404b3509u}, {0x7e000bbcu, 0x544b362au}, {0xbf400dddu, 0xbf689d01u}, {0x80201002u, 0xaa215ff8u},
+        {0x00000000u, 0x00000000u}, {0x80000000u, 0x80000000u}, {0x00000001u, 0x26a14518u}, {0x007fffffu, 0x2a7fffffu},
+        {0x00800000u, 0x2a800000u}, {0x3f800000u, 0x3f800000u}, {0x41000000u, 0x40000000u}, {0xc1000000u, 0xc0000000u},
+        {0x7f7fffffu, 0x54cb2ff5u}, {0x7f800000u, 0x7f800000u}, {0xff800000u, 0xff800000u}, {0x7fc00001u, 0x7fc00001u},
+        {0xffc00002u, 0xffc00002u},
+    };
+    for (const auto& [input, expected] : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(cbrtf_nid_postfix(std::bit_cast<float>(input))) == expected && errno == 1234);
+    }
+}
+
 static void CheckIntegerConversions() {
     for (const long long numerator : {4294967301LL, -4294967301LL}) {
         for (const long long denominator : {3LL, -3LL}) {
@@ -796,13 +765,52 @@ static void CheckAsin() {
     std::feclearexcept(FE_ALL_EXCEPT);
     errno = 0;
     asin_nid_postfix(2.0);
+
     Require(std::fetestexcept(FE_INVALID));
     Require(errno == 0);
     std::feclearexcept(FE_ALL_EXCEPT);
     asin_nid_postfix(nan);
+
     Require(!std::fetestexcept(FE_INVALID));
 }
 
+static void CheckTrigfConsoleBits() {
+    constexpr struct {
+        std::uint32_t input;
+        std::uint32_t sine;
+        std::uint32_t cosine;
+        std::uint32_t tangent;
+        int error;
+    } cases[] = {
+        {0x3e801d5au, 0x3e7d9057u, 0x3f780703u, 0x3e82db72u, 0}, {0x3fc00321u, 0x3f7f5c46u, 0x3d90acbbu, 0x4161edb0u, 0},
+        {0x40400556u, 0x3e102d3eu, 0xbf7d7328u, 0xbe11a09du, 0}, {0x40c00781u, 0xbe8e9c41u, 0x3f75de78u, 0xbe947c92u, 0},
+        {0x412009acu, 0xbf0bc6b7u, 0xbf56790du, 0x3f26d71eu, 0}, {0x47000bbbu, 0x3eb0df2fu, 0x3f703d5au, 0x3ebc799eu, 0},
+        {0x4e000de0u, 0xbf664722u, 0x3edfade4u, 0xc003c6abu, 0}, {0x5f001006u, 0xbe0ecf11u, 0x3f7d7f8cu, 0xbe1037deu, 0},
+        {0x7e001112u, 0x3eabd0cbu, 0x3f7127beu, 0x3eb6645du, 0}, {0xc0400556u, 0xbe102d3eu, 0xbf7d7328u, 0x3e11a09du, 0},
+        {0x00000000u, 0x00000000u, 0x3f800000u, 0x00000000u, 0}, {0x80000000u, 0x80000000u, 0x3f800000u, 0x80000000u, 0},
+        {0x39000000u, 0x39000000u, 0x3f800000u, 0x39000000u, 0}, {0x3f490fdbu, 0x3f3504f3u, 0x3f3504f3u, 0x3f800000u, 0},
+        {0x40490fdbu, 0xb3bbbd2eu, 0xbf800000u, 0x33bbbd2fu, 0}, {0x4dc90fdbu, 0xbf3d5f98u, 0x3f2c42b6u, 0xbf8cb742u, 0},
+        {0x7f7fffffu, 0xbf0599b3u, 0x3f5a5f96u, 0xbf1c9ecau, 0}, {0xff7fffffu, 0x3f0599b3u, 0x3f5a5f96u, 0x3f1c9ecau, 0},
+        {0x7f800000u, 0xffc00000u, 0xffc00000u, 0xffc00000u, EDOM}, {0xff800000u, 0xffc00000u, 0xffc00000u, 0xffc00000u, EDOM},
+        {0x7fc00001u, 0x7fc00001u, 0x7fc00001u, 0x7fc00001u, 0},
+    };
+    for (const auto& item : cases) {
+        const float x = std::bit_cast<float>(item.input);
+        const int expected = item.error != 0 ? item.error : 1234;
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(sinf_nid_postfix(x)) == item.sine && errno == expected);
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(cosf_nid_postfix(x)) == item.cosine && errno == expected);
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(tanf_nid_postfix(x)) == item.tangent && errno == expected);
+        float sine = 0.0f;
+        float cosine = 0.0f;
+        sincosf_nid_postfix(x, &sine, &cosine);
+
+        Require(std::bit_cast<std::uint32_t>(sine) == item.sine && std::bit_cast<std::uint32_t>(cosine) == item.cosine);
+    }
+}
+
 static void CheckExtendedMath() {
     Require(ExtendedBits(atanl_nid_postfix(INFINITY), 0xc90fdaa22168c235ull, 0x3fff));
     Require(std::fabs(atanl_nid_postfix(1.0L) - 0.785398163397448309616L) < 1e-18L);
@@ -839,6 +847,14 @@ static void CheckExtendedMath() {
 
 static void CheckHyperbolic() {
     const double infinity = std::numeric_limits<double>::infinity();
+    Require(_Cosh_nid_postfix(0.0, 2.0) == 2.0);
+    Require(Near(_Cosh_nid_postfix(1.0, 2.0), 3.0861612696304874, 1e-15));
+    Require(Near(_Cosh_nid_postfix(-1.0, -2.0), -3.0861612696304874, 1e-15));
+    Require(std::isinf(_Cosh_nid_postfix(infinity, -1.0)) && std::signbit(_Cosh_nid_postfix(infinity, -1.0)));
+    Require(std::isnan(_Cosh_nid_postfix(infinity, 0.0)));
+    Require(Near(_Cosh_nid_postfix(711.0, 1e-300), 0x1.2190c08e2f1a4p+28, 1e-15));
+    Require(_Cosh_nid_postfix(720.0, 0.0) == 0.0 && !std::signbit(_Cosh_nid_postfix(720.0, 0.0)));
+    Require(_Cosh_nid_postfix(720.0, -0.0) == 0.0 && std::signbit(_Cosh_nid_postfix(720.0, -0.0)));
     Require(sinh_nid_postfix(0.) == 0. && std::signbit(sinh_nid_postfix(-0.)));
     Require(cosh_nid_postfix(0.) == 1. && coshf_nid_postfix(0.f) == 1.f);
     Require(asinh_nid_postfix(0.) == 0. && std::signbit(asinh_nid_postfix(-0.)) && std::signbit(asinhf_nid_postfix(-0.f)));
@@ -859,6 +875,52 @@ static void CheckHyperbolic() {
     Require(Near(acosh_nid_postfix(1e300), 691.4686750787736, 1e-15));
 }
 
+static void CheckAcoshfMsunBoundaries() {
+    Require(acoshf_nid_postfix(1.0f) == 0.0f && !std::signbit(acoshf_nid_postfix(1.0f)));
+    errno = EINTR;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    Require(std::isnan(acoshf_nid_postfix(0.5f)) && errno == EINTR && (std::fetestexcept(FE_INVALID) & FE_INVALID) != 0);
+    for (const std::uint32_t bits : {0x3f800001u, 0x3fffffffu, 0x40000000u, 0x40000001u,
+                                     0x4d7fffffu, 0x4d800000u, 0x4d800001u, 0x7f7fffffu}) {
+        const float x = std::bit_cast<float>(bits);
+        Require(Near(acoshf_nid_postfix(x), std::acosh(static_cast<double>(x)), 1e-6));
+    }
+    Require(std::isinf(acoshf_nid_postfix(INFINITY)) && acoshf_nid_postfix(INFINITY) > 0.0f);
+    Require(std::isnan(acoshf_nid_postfix(-INFINITY)));
+    Require(std::isnan(acoshf_nid_postfix(std::numeric_limits<float>::quiet_NaN())));
+}
+
+static void CheckCoshfMsunBoundaries() {
+    static constexpr struct {
+        std::uint32_t input;
+        std::uint32_t output;
+    } cases[] = {
+        {0x00000000u, 0x3f800000u},
+        {0x80000000u, 0x3f800000u},
+        {0x00000001u, 0x3f800000u},
+        {0x397fffffu, 0x3f800000u},
+        {0x39800000u, 0x3f800000u},
+        {0x3eb17217u, 0x3f87c3b6u},
+        {0x3eb17218u, 0x3f87c3b6u},
+        {0x3f800000u, 0x3fc583aau},
+        {0xbf800000u, 0x3fc583aau},
+        {0x410fffffu, 0x457d389cu},
+        {0x41100000u, 0x457d38acu},
+        {0x42b17216u, 0x7effff04u},
+        {0x42b17217u, 0x7effff84u},
+        {0x42b17218u, 0x7f000002u},
+        {0x42b2d4fbu, 0x7f7fff6cu},
+        {0x42b2d4fcu, 0x7f7fffecu},
+        {0xc2b2d4fcu, 0x7f7fffecu},
+    };
+    for (const auto& test : cases)
+        Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(std::bit_cast<float>(test.input))) == test.output);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(std::bit_cast<float>(0x42b2d4fdu))) == 0x7f800000u);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(INFINITY)) == 0x7f800000u);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(-INFINITY)) == 0x7f800000u);
+    Require(std::bit_cast<std::uint32_t>(coshf_nid_postfix(std::bit_cast<float>(0x7fc12345u))) == 0x7fc12345u);
+}
+
 static void CheckScaledHyperbolic() {
     const int rounding = std::fegetround();
     Require(std::fesetround(FE_TONEAREST) == 0);
@@ -1049,6 +1111,26 @@ static void RequireBytes(const void* constant, std::initializer_list<unsigned ch
     while (index < 16) Require(bytes[index++] == 0);
 }
 
+static void CheckLogfConsoleBits() {
+    constexpr struct {
+        std::uint32_t input;
+        std::uint32_t expected;
+        int error;
+    } cases[] = {
+        {0x00000983u, 0xc2bef664u, 0}, {0x3e003791u, 0xc004f9cfu, 0}, {0x3f7f0a10u, 0xbb76666fu, 0}, {0x3f81086bu, 0x3c03adacu, 0},
+        {0x40400de0u, 0x3f8ca894u, 0}, {0x5f00a041u, 0x422eb14eu, 0}, {0x3f800000u, 0x00000000u, 0}, {0x40000000u, 0x3f317218u, 0},
+        {0x00000001u, 0xc2ce8ed0u, 0}, {0x00800000u, 0xc2aeac50u, 0}, {0x7f7fffffu, 0x42b17218u, 0}, {0x7f800000u, 0x7f800000u, 0},
+        {0x3f800001u, 0x33ffffffu, 0}, {0x3f7fffffu, 0xb3800000u, 0}, {0x7fc00001u, 0x7fc00001u, 0},
+        {0x00000000u, 0xff800000u, ERANGE}, {0x80000000u, 0xff800000u, ERANGE}, {0x80000001u, 0xffc00000u, EDOM},
+        {0xbf800000u, 0xffc00000u, EDOM}, {0xff800000u, 0xffc00000u, EDOM}, {0xffc00002u, 0xffc00002u, EDOM},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(logf_nid_postfix(std::bit_cast<float>(item.input))) == item.expected);
+        Require(errno == (item.error != 0 ? item.error : 1234));
+    }
+}
+
 static void CheckDinkumwareConstants() {
     RequireBytes(&_Inf_nid_postfix, {0, 0, 0, 0, 0, 0, 0xf0, 0x7f});
     RequireBytes(&_Denorm_nid_postfix, {1});
@@ -1227,17 +1309,31 @@ static void CheckLongDoubleRounding(long double value, std::int64_t expected, bo
     }
 }
 
-static void CheckNoConversionIsPositiveZero() {
-    for (const char* text : {"", " ", "-", "+", "-.", "+.", "-x", "-.e1", "-e5", "- 1", "  -."}) {
+static void CheckNoConversionZero() {
+    for (const char* text : {"", " ", "-", " -", "+", "-.", "+.", "-x", "-.e1", "-e5", "- 1", "  -."}) {
         char* end = nullptr;
         const double parsed = strtod_nid_postfix(text, &end);
         Require(parsed == 0. && !std::signbit(parsed) && end == text);
+        const bool negative = std::strchr(text, '-') != nullptr;
+        const bool loneSign = negative && text[std::strlen(text) - 1] == '-';
         const float parsedFloat = strtof_nid_postfix(text, &end);
-        Require(parsedFloat == 0.f && !std::signbit(parsedFloat) && end == text);
+        Require(parsedFloat == 0.f && std::signbit(parsedFloat) == (negative && !loneSign) && end == text);
         const long double parsedLong = strtold_nid_postfix(text, &end);
-        Require(parsedLong == 0.L && !std::signbit(parsedLong) && end == text);
+        Require(parsedLong == 0.L && std::signbit(parsedLong) == negative && end == text);
         Require(!std::signbit(atof_nid_postfix(text)));
     }
+    for (const char* text : {"-i", "-in", "-N", "-nax"}) {
+        char* end = nullptr;
+        const float parsedFloat = strtof_nid_postfix(text, &end);
+        Require(parsedFloat == 0.f && std::signbit(parsedFloat) && end == text);
+        Require(!std::signbit(strtold_nid_postfix(text, nullptr)));
+    }
+    for (const char* text : {"-nan", "-NAN", " -nan(5)"}) {
+        char* end = nullptr;
+        const float parsedFloat = strtof_nid_postfix(text, &end);
+        Require(std::bit_cast<std::uint32_t>(parsedFloat) == 0xffc00000u && end == text + std::strlen(text));
+    }
+    Require(std::bit_cast<std::uint32_t>(strtof_nid_postfix("nan", nullptr)) == 0x7fc00000u);
     char* end = nullptr;
     const char negativeZero[] = "-0.0x";
     const double parsed = strtod_nid_postfix(negativeZero, &end);
@@ -1262,9 +1358,9 @@ static void CheckNoConversionIsPositiveZero() {
     const double parsedWide = wcstod_nid_postfix(wide, &wideEnd);
     Require(parsedWide == 0. && !std::signbit(parsedWide) && wideEnd == wide);
     const float parsedWideFloat = wcstof_nid_postfix(wide, &wideEnd);
-    Require(parsedWideFloat == 0.f && !std::signbit(parsedWideFloat) && wideEnd == wide);
+    Require(parsedWideFloat == 0.f && std::signbit(parsedWideFloat) && wideEnd == wide);
     const long double parsedWideLong = wcstold_nid_postfix(wide, &wideEnd);
-    Require(parsedWideLong == 0.L && !std::signbit(parsedWideLong) && wideEnd == wide);
+    Require(parsedWideLong == 0.L && std::signbit(parsedWideLong) && wideEnd == wide);
 }
 
 template<typename TValue, std::size_t TBytes>
@@ -1296,11 +1392,13 @@ static void CheckDinkumwareFloatCharacteristics() {
 int main() {
     CheckFloatClassification();
     CheckDinkumwareConstants();
-    CheckNoConversionIsPositiveZero();
+    CheckNoConversionZero();
     CheckMissingClassificationExports();
     CheckFloatMathExports();
     CheckIntegerConversions();
+    CheckCbrtfConsoleBits();
     CheckExtendedMath();
+    CheckTrigfConsoleBits();
     Require(atof_nid_postfix(" -12.5tail") == -12.5);
     char* end = nullptr;
     const char input[] = "0x1.8p+2 remainder";
@@ -1340,6 +1438,7 @@ int main() {
     Require(rand_r_nid_postfix(&randomState) == 16806 && randomState == 16806u);
     for (const unsigned int seed : {0u, 1u, 12345u, 0x7ffffffeu, 0xffffffffu}) {
         srand_nid_postfix(seed);
+
         randomState = seed;
         for (int step = 0; step < 8; ++step) Require(rand_r_nid_postfix(&randomState) == rand_nid_postfix());
     }
@@ -1406,6 +1505,7 @@ int main() {
     const auto gammaSign = [](double x) {
         signgam_nid_postfix = 7;
         lgamma_nid_postfix(x);
+
         return signgam_nid_postfix;
     };
     Require(gammaSign(0.5) == 1 && gammaSign(10.) == 1 && gammaSign(0.) == 1 && gammaSign(-0.) == -1);
@@ -1455,6 +1555,7 @@ int main() {
     CheckFegetenv();
     CheckLongDouble();
     CheckNearbyintl();
+    CheckExpm1ConsoleBits();
     CheckAsinl();
     Require(scalbn_nid_postfix(0.75, -2) == 0.1875);
     Require(scalbnf_nid_postfix(0.75f, 4) == 12.f);
@@ -1577,12 +1678,17 @@ int main() {
     Require(std::isinf(__powidf2_nid_postfix(-0.0, -3)) && std::signbit(__powidf2_nid_postfix(-0.0, -3)));
     Require(__powidf2_nid_postfix(2.0, -127) == 0x1p-127);
     CheckHyperbolic();
+    CheckAcoshfMsunBoundaries();
+    CheckCoshfMsunBoundaries();
     CheckScaledHyperbolic();
     CheckSinhf();
     CheckAtanhf();
+    CheckLogfConsoleBits();
     CheckHypotSpecialValue();
+    CheckAtanfConsoleBits();
     CheckFloatUnderflowErrno();
     CheckFmodErrno();
+    CheckFmodfErrno();
     CheckDoubleClassification();
     CheckIntegerAbsAndDivision();
     CheckScaling();
diff --git a/core/libs/tests/GuestMathExact.cpp b/core/libs/tests/GuestMathExact.cpp
index e601e88973..d9898fd653 100644
--- a/core/libs/tests/GuestMathExact.cpp
+++ b/core/libs/tests/GuestMathExact.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cfenv>
@@ -7,35 +8,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-long double APS5_VABI fdiml_nid_postfix(long double, long double);
-long double APS5_VABI fmodl_nid_postfix(long double, long double);
-long double APS5_VABI remquol_nid_postfix(long double, long double, int*);
-int APS5_VABI ilogbl_nid_postfix(long double);
-long double APS5_VABI roundl_nid_postfix(long double);
-long double APS5_VABI modfl_nid_postfix(long double, long double*);
-long double APS5_VABI nanl_nid_postfix(const char*);
-long double APS5_VABI scalblnl_nid_postfix(long double, std::int64_t);
-long double APS5_VABI fmal_nid_postfix(long double, long double, long double);
-double APS5_VABI scalb_nid_postfix(double, double);
-double APS5_VABI scalbln_nid_postfix(double, std::int64_t);
-long double APS5_VABI remainderl_nid_postfix(long double, long double);
-double APS5_VABI drem_nid_postfix(double, double);
-float APS5_VABI dremf_nid_postfix(float, float);
-std::int64_t APS5_VABI lrint_nid_postfix(double);
-double APS5_VABI rint_nid_postfix(double);
-float APS5_VABI rintf_nid_postfix(float);
-long double APS5_VABI rintl_nid_postfix(long double);
-long long APS5_VABI llrint_nid_postfix(double);
-int APS5_VABI finite_nid_postfix(double);
-int APS5_VABI __fpclassifyl_nid_postfix(long double);
-int APS5_VABI __isnanl_nid_postfix(long double);
-int APS5_VABI __isnormall_nid_postfix(long double);
-short APS5_VABI _LDtest_nid_postfix(const long double*);
-int APS5_VABI _Dclass_nid_postfix(double);
-short APS5_VABI _LDsign_nid_postfix(long double);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static long double Extended(std::uint16_t signExponent, std::uint64_t mantissa) {
@@ -70,6 +42,7 @@ static void CheckErrno() {
     Require(std::isnan(remquol_nid_postfix(1.0L, 0.0L, &quotient)) && errno == EDOM);
     errno = 0;
     remquol_nid_postfix(NAN, 0.0L, &quotient);
+
     Require(errno == 0);
     Require(remquol_nid_postfix(-7.0L, 2.0L, &quotient) == 1.0L && quotient == -4);
     errno = 0;
diff --git a/core/libs/tests/GuestMbus.cpp b/core/libs/tests/GuestMbus.cpp
index e867068157..4050f1d452 100644
--- a/core/libs/tests/GuestMbus.cpp
+++ b/core/libs/tests/GuestMbus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMbus/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,26 +7,6 @@
 #include <cstdlib>
 #include <stdexcept>
 
-struct DeviceServiceThreadParam;
-struct DeviceServiceInitParam {
-    std::uint32_t size;
-    std::uint32_t reserved;
-    const DeviceServiceThreadParam* threadParam;
-};
-struct DeviceServiceUsageFilter {
-    std::uint16_t usagePage;
-    std::uint16_t minimumUsage;
-    std::uint16_t maximumUsage;
-};
-
-extern "C" {
-std::int32_t APS5_VABI sceDeviceServiceInitialize(std::int32_t mode, const DeviceServiceInitParam* param);
-std::int32_t APS5_VABI sceDeviceServiceTerminate();
-std::int32_t APS5_VABI sceDeviceServiceGetEventState(std::int32_t clear);
-std::int32_t APS5_VABI sceDeviceServiceQueryDeviceInfo_(std::int32_t deviceClass, const DeviceServiceUsageFilter* filter, std::int32_t arg2, void* infos, std::int32_t maxInfos, std::int32_t* count, std::int32_t* reserved, std::uint32_t infoSize);
-std::int32_t APS5_VABI sceDeviceServiceGetGeneration();
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
diff --git a/core/libs/tests/GuestMemory.cpp b/core/libs/tests/GuestMemory.cpp
index d03a35de70..7f78313a05 100644
--- a/core/libs/tests/GuestMemory.cpp
+++ b/core/libs/tests/GuestMemory.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestAllocations.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
@@ -42,55 +45,6 @@
 #include <io.h>
 #endif
 
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI sceKernelMmap(void*, std::size_t, int, int, int, std::int64_t, void**);
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-int APS5_VABI madvise_nid_postfix(void*, std::size_t, int);
-int APS5_VABI mincore_nid_postfix(const void*, std::size_t, char*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelMapNamedFlexibleMemory(void**, std::size_t, int, int, const char*);
-int APS5_VABI sceKernelMapNamedFlexibleMemoryInternal(void**, std::size_t, int, int, const char*);
-int APS5_VABI sceKernelAvailableFlexibleMemorySize(std::size_t*);
-int APS5_VABI sceKernelInternalMemoryGetAvailableSize(std::size_t*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelReleaseFlexibleMemory(void*, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMtypeprotect(const void*, std::size_t, int, int);
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry*, int, int*, int);
-int APS5_VABI sceKernelMemoryPoolBatch(const KernelMemoryPoolBatchEntry*, int, int*, int);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
-int APS5_VABI sceKernelSetVirtualRangeName(const void*, std::uint64_t, const char*);
-int APS5_VABI sceKernelClearVirtualRangeName(const void*, std::uint64_t);
-int APS5_VABI sceKernelGetPageTableStats(int*, int*, int*, int*);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelEnableDmemAliasing();
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelAvailableDirectMemorySize(std::int64_t, std::int64_t, std::size_t, std::int64_t*, std::size_t*);
-int APS5_VABI sceKernelCheckedReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMemoryPoolReserve(void*, std::size_t, std::size_t, int, void**);
-int APS5_VABI sceKernelMemoryPoolCommit(void*, std::size_t, int, int, int);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI sceKernelAioInitializeImpl(void*, std::int32_t);
-int APS5_VABI sceKernelAioSubmitReadCommands(KernelAioRwRequest*, std::int32_t, std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelAioWaitRequest(std::int32_t, std::int32_t*, std::uint32_t*);
-int APS5_VABI sceKernelAioDeleteRequest(std::int32_t, std::int32_t*);
-int APS5_VABI sceKernelMlock_nid_postfix(void*, std::uint64_t);
-int APS5_VABI sceKernelGetDirectMemoryType(std::int64_t, int*, std::int64_t*, std::int64_t*);
-int APS5_VABI sceKernelBatchMap2(KernelBatchMapEntry*, int, int*, int);
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Guest memory check failed at %s:%u\n", location.file_name(), static_cast<unsigned>(location.line()));
@@ -113,12 +67,33 @@ static void CheckReleaseFlexibleMemory() {
     Require(sceKernelMapFlexibleMemory(&mapped, length, 3, 0) == 0 && mapped != nullptr);
     static_cast<volatile unsigned char*>(mapped)[length - 1] = 1;
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
+    auto* bytes = static_cast<volatile unsigned char*>(mapped);
+    Require(sceKernelMprotect(mapped, 0x4000, 1) == 0);
     Require(sceKernelReleaseFlexibleMemory(mapped, length) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
+    VirtualQueryInfo info{};
+    Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) == 0 && info.protection == 1);
+    Require(sceKernelVirtualQuery(static_cast<unsigned char*>(mapped) + length - 1, 0, &info, sizeof(info)) == 0 && info.protection == 3);
+    Require(bytes[length - 1] == 1);
+    bytes[length - 2] = 2;
+    Require(sceKernelReleaseFlexibleMemory(mapped, length) == 0);
+    Require(sceKernelReleaseFlexibleMemory(mapped, 0) == 0);
+    Require(sceKernelReleaseFlexibleMemory(reinterpret_cast<void*>(std::uintptr_t{0x7ff000000000}), length) == 0);
+    Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
+    Require(sceKernelReleaseFlexibleMemory(nullptr, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(static_cast<unsigned char*>(mapped) + 1, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(mapped, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(static_cast<unsigned char*>(mapped) + 0x1000, 0x4000) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(mapped, 0x6000) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelReleaseFlexibleMemory(reinterpret_cast<void*>(~std::uintptr_t{0x3fff}), 0x8000) == SCE_KERNEL_ERROR_EINVAL);
     void* again = mapped;
-    Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x90) == 0 && again == mapped);
+    Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x90) == SCE_KERNEL_ERROR_ENOMEM);
+    Require(bytes[length - 1] == 1 && bytes[length - 2] == 2);
+    again = mapped;
+    Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x10) == 0 && again == mapped);
     Require(static_cast<volatile unsigned char*>(again)[length - 1] == 0);
-    Require(sceKernelMunmap(again, length) == 0);
+    Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), length) == 0);
 }
 
 static void CheckFlexibleMappingIgnoresFlag8000() {
@@ -130,11 +105,11 @@ static void CheckFlexibleMappingIgnoresFlag8000() {
     Require(sceKernelMapFlexibleMemory(&mapped, length, 3, 0x8000) == 0 && mapped != nullptr);
     static_cast<volatile unsigned char*>(mapped)[length - 1] = 1;
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
     void* again = mapped;
     Require(sceKernelMapFlexibleMemory(&again, length, 3, 0x8090) == 0 && again == mapped);
     Require(static_cast<volatile unsigned char*>(again)[length - 1] == 0);
-    Require(sceKernelMunmap(again, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), length) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
     bool rejected = false;
     void* unknown = nullptr;
@@ -160,6 +135,7 @@ static void CheckInternalMemoryAvailableSize() {
     bool threw = false;
     try {
         sceKernelInternalMemoryGetAvailableSize(&available);
+
     } catch (const std::logic_error&) {
         threw = true;
     }
@@ -186,13 +162,13 @@ static void CheckNamedAndHintedMappings() {
     void* overwrite = first;
     Require(sceKernelMapFlexibleMemory(&overwrite, 0x4000, 3, 0x90) == static_cast<int>(0x8002000cu));
     Require(overwrite == first);
-    Require(sceKernelMunmap(hinted, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(hinted), length) == 0);
     void* exclusive = hinted;
     Require(sceKernelMapFlexibleMemory(&exclusive, length, 3, 0x90) == 0);
     Require(exclusive == hinted);
     static_cast<volatile unsigned char*>(exclusive)[0] = 1;
-    Require(sceKernelMunmap(exclusive, length) == 0);
-    Require(sceKernelMunmap(first, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(exclusive), length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), length) == 0);
 }
 
 static void CheckAudioCoprocessorProtection() {
@@ -205,7 +181,7 @@ static void CheckAudioCoprocessorProtection() {
     Require(static_cast<volatile unsigned char*>(writable)[length - 1] == 7);
     Require(sceKernelMprotect(writable, length, 0x3f2) == 0);
     static_cast<volatile unsigned char*>(writable)[0] = 9;
-    Require(sceKernelMunmap(writable, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(writable), length) == 0);
     bool rejected = false;
     void* undefined = nullptr;
     try { sceKernelMapFlexibleMemory(&undefined, length, 0x400, 0); } catch (const std::invalid_argument&) { rejected = true; }
@@ -241,7 +217,7 @@ static void CheckMprotectIgnoresUndefinedBits() {
         for (const auto undefined : {0u, 8u, 0x400u, 0x80000000u, 0xfffffc08u})
             check(mapping, static_cast<int>(static_cast<std::uint32_t>(protection) | undefined));
     }
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     std::int64_t physical = 0;
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, length, 0, 0, &physical) == 0);
     mapping = nullptr;
@@ -251,7 +227,7 @@ static void CheckMprotectIgnoresUndefinedBits() {
     check(mapping, 0x100);
     check(mapping, 0x200);
     check(mapping, 0x3f7);
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     Require(sceKernelReleaseDirectMemory(physical, length) == 0);
 }
 
@@ -289,7 +265,7 @@ static void CheckStrictMemoryProtectionBits() {
         Require(sceKernelGetDirectMemoryType(physical, &type, &start, &end) == 0 && type == 0);
         Require(bytes[0] == 5 && bytes[length - 1] == 7);
     }
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     Require(sceKernelReleaseDirectMemory(physical, length) == 0);
 }
 
@@ -313,14 +289,14 @@ static void CheckInternalNamedFlexibleMapping() {
     Require(sceKernelMapNamedFlexibleMemoryInternal(&mapped, length, 3, 0, "internal mapping") == 0 && mapped != nullptr);
     Require(std::strcmp(NameAt(mapped), "internal mapping") == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
     void* flagged = nullptr;
     Require(sceKernelMapNamedFlexibleMemoryInternal(&flagged, length, 3, 0x8000, "internal flag") == 0 && flagged != nullptr);
     Require(std::strcmp(NameAt(flagged), "internal flag") == 0);
     static_cast<volatile unsigned char*>(flagged)[length - 1] = 1;
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - length);
-    Require(sceKernelMunmap(flagged, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flagged), length) == 0);
     bool rejected = false;
     void* unknown = nullptr;
     try { sceKernelMapNamedFlexibleMemoryInternal(&unknown, length, 3, 0x20000, "internal mapping"); } catch (const std::exception&) { rejected = true; }
@@ -343,7 +319,7 @@ static void CheckFlexibleFixedReplacement() {
     Require(sceKernelMapFlexibleMemory(&replacement, page, 3, 0x10) == 0 && replacement == middle);
     Require(bytes[0] == 17 && bytes[page] == 0 && bytes[page * 2] == 19 && bytes[page * 3] == 20);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 4);
-    Require(sceKernelMunmap(base, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page * 4) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
 }
 
@@ -361,23 +337,23 @@ static void CheckMunmapScopedFlexibleRelease() {
     Require(sceKernelMapDirectMemory(&direct, page, 3, 0x10, phys, 0) == 0 && direct == static_cast<unsigned char*>(base) + page);
     std::size_t mid = 0;
     Require(sceKernelAvailableFlexibleMemorySize(&mid) == 0);
-    Require(sceKernelMunmap(direct, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(direct), page) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid);
     void* reserved = nullptr;
     Require(sceKernelReserveVirtualRange(&reserved, page * 2, 0, 0) == 0 && reserved != nullptr);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid);
-    Require(sceKernelMunmap(base, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == mid + page);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
     void* fresh = nullptr;
     Require(sceKernelMapFlexibleMemory(&fresh, page * 4, 3, 0) == 0 && fresh != nullptr);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 4);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(fresh) + page, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(fresh) + page), page * 2) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 2);
-    Require(sceKernelMunmap(fresh, page) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(fresh) + page * 3, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fresh), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(fresh) + page * 3), page) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
 }
 
@@ -409,7 +385,7 @@ static void CheckBatchMapStopsAtInvalidEntry() {
         Require(sceKernelBatchMap2(entries, 3, &processed, 0) == SCE_KERNEL_ERROR_EINVAL);
         Require(processed == 1);
         Require(entries[0].start != nullptr && entries[1].start == nullptr && entries[2].start == nullptr);
-        Require(sceKernelMunmap(entries[0].start, page) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(entries[0].start), page) == 0);
     }
     KernelBatchMapEntry entries[3] = {flexible(), flexible(), flexible()};
     entries[1].operation = protect;
@@ -425,7 +401,7 @@ static void CheckBatchMapStopsAtInvalidEntry() {
     processed = -1;
     Require(sceKernelBatchMap2(unmaps, 2, &processed, 0) == SCE_KERNEL_ERROR_EINVAL && processed == 1);
     Require(sceKernelBatchMap2(entries, 1, &processed, 0) == 0 && processed == 1);
-    Require(sceKernelMunmap(entries[0].start, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(entries[0].start), page) == 0);
 }
 
 static void CheckVirtualQueryFindsNeighbours() {
@@ -443,14 +419,14 @@ static void CheckVirtualQueryFindsNeighbours() {
     Require(info.start == reinterpret_cast<std::uintptr_t>(low) + page && info.end == reinterpret_cast<std::uintptr_t>(low) + page * 2 && info.protection == 1);
     Require(sceKernelVirtualQuery(lowBytes + page * 2, 0, &info, sizeof(info)) == 0);
     Require(info.start == reinterpret_cast<std::uintptr_t>(low) + page * 2 && info.end == reinterpret_cast<std::uintptr_t>(low) + page * 4 && info.protection == 3);
-    Require(sceKernelMunmap(lowBytes + page * 2, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(lowBytes + page * 2), page) == 0);
     Require(sceKernelVirtualQuery(lowBytes + page * 2, 0, &info, sizeof(info)) != 0);
     Require(sceKernelVirtualQuery(lowBytes + page * 2, 1, &info, sizeof(info)) == 0);
     Require(info.start == reinterpret_cast<std::uintptr_t>(low) + page * 3 && info.end == reinterpret_cast<std::uintptr_t>(low) + page * 4);
     Require(sceKernelVirtualQuery(lowBytes + page * 3, 0, &info, sizeof(info)) == 0 && info.start == reinterpret_cast<std::uintptr_t>(low) + page * 3);
-    Require(sceKernelMunmap(low, page * 2) == 0);
-    Require(sceKernelMunmap(lowBytes + page * 3, page) == 0);
-    Require(sceKernelMunmap(high, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(low), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(lowBytes + page * 3), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(high), page) == 0);
 }
 
 static void CheckReleaseFindsEveryDirectMapping() {
@@ -479,6 +455,23 @@ static void CheckReleaseFindsEveryDirectMapping() {
     for (std::size_t index = 0; index < pieces; ++index) Require(sceKernelVirtualQuery(mapped[index], 0, &info, sizeof(info)) != 0);
 }
 
+static void CheckReleaseSkipsFreePages() {
+    constexpr std::size_t page = 0x4000;
+    std::int64_t phys = 0;
+    Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 4, 0, 0, &phys) == 0);
+    void* mapped = nullptr;
+    Require(sceKernelMapDirectMemory(&mapped, page * 4, 3, 0, phys, 0) == 0);
+    Require(sceKernelReleaseDirectMemory(phys + static_cast<std::int64_t>(page), page) == 0);
+    Require(sceKernelReleaseDirectMemory(phys + static_cast<std::int64_t>(page), page) == 0);
+    Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
+    VirtualQueryInfo info{};
+    Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) != 0);
+    Require(sceKernelVirtualQuery(static_cast<unsigned char*>(mapped) + page * 3, 0, &info, sizeof(info)) == 0);
+    Require(sceKernelCheckedReleaseDirectMemory(phys, page) == SCE_KERNEL_ERROR_ENOENT);
+    Require(sceKernelCheckedReleaseDirectMemory(phys + static_cast<std::int64_t>(page * 3), page) == 0);
+    Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
+}
+
 static void CheckCheckedReleaseDirectMemory() {
     constexpr std::size_t page = 0x4000;
     std::int64_t phys = 0;
@@ -489,7 +482,7 @@ static void CheckCheckedReleaseDirectMemory() {
     Require(sceKernelCheckedReleaseDirectMemory(phys, page * 3) == SCE_KERNEL_ERROR_ENOENT);
     void* mapped = nullptr;
     Require(sceKernelMapDirectMemory(&mapped, page * 2, 3, 0, phys, 0) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelCheckedReleaseDirectMemory(phys + page, page) == 0);
     Require(sceKernelCheckedReleaseDirectMemory(phys, page * 2) == SCE_KERNEL_ERROR_ENOENT);
     Require(sceKernelCheckedReleaseDirectMemory(phys, page) == 0);
@@ -518,9 +511,9 @@ static void CheckDirectMemoryFollowsPhysicalPages() {
     Require(sceKernelMprotect(alias, page, 3) == 0);
     static_cast<unsigned char*>(alias)[5] = 22;
     Require(static_cast<unsigned char*>(first)[page + 5] == 22);
-    Require(sceKernelMunmap(alias, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
     static_cast<unsigned char*>(first)[page + 5] = 22;
-    Require(sceKernelMunmap(first, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 2) == 0);
     void* filler = nullptr;
     Require(sceKernelMapFlexibleMemory(&filler, page * 2, 3, 0) == 0);
     void* second = nullptr;
@@ -531,16 +524,16 @@ static void CheckDirectMemoryFollowsPhysicalPages() {
     void* fixed = reserved;
     Require(sceKernelMapDirectMemory(&fixed, page, 1, 0x10, phys, 0) == 0);
     Require(fixed == reserved && static_cast<unsigned char*>(fixed)[0] == 11);
-    Require(sceKernelMunmap(fixed, page) == 0);
-    Require(sceKernelMunmap(second, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fixed), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     std::int64_t again = 0;
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 2, 0, 0, &again) == 0 && again == phys);
     void* fresh = nullptr;
     Require(sceKernelMapDirectMemory(&fresh, page * 2, 3, 0, again, 0) == 0);
     Require(static_cast<unsigned char*>(fresh)[0] == 0 && static_cast<unsigned char*>(fresh)[page + 5] == 0);
-    Require(sceKernelMunmap(fresh, page * 2) == 0);
-    Require(sceKernelMunmap(filler, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fresh), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(filler), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(again, page * 2) == 0);
 }
 
@@ -564,11 +557,11 @@ static void CheckSparseDirectMemoryBacking() {
     Require(aliasBytes[page - 1] == 29 && aliasBytes[0] == 0);
     aliasBytes[page - 1] = 41;
     Require(lastBytes[page - 1] == 41 && firstBytes[0] == 17);
-    Require(sceKernelMunmap(last, page) == 0 && sceKernelMunmap(alias, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(last), page) == 0 && sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
     last = nullptr;
     Require(sceKernelMapDirectMemory(&last, page, 3, 0, physical + size - page, 0) == 0);
     Require(static_cast<unsigned char*>(last)[page - 1] == 41);
-    Require(sceKernelMunmap(first, page) == 0 && sceKernelMunmap(last, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page) == 0 && sceKernelMunmap(reinterpret_cast<std::uint64_t>(last), page) == 0);
     Require(sceKernelReleaseDirectMemory(physical, size) == 0);
 }
 
@@ -581,7 +574,7 @@ static void CheckSavedDirectMemorySurvivesCachePressure() {
         void* mapped = nullptr;
         Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, retained[index], bytes) == 0);
         std::memset(mapped, static_cast<int>(index + 1), bytes);
-        Require(sceKernelMunmap(mapped, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     }
     const auto temporary = [] {
         constexpr std::size_t small = 0x10000;
@@ -594,12 +587,12 @@ static void CheckSavedDirectMemorySurvivesCachePressure() {
             Require(std::all_of(data, data + small, [](unsigned char value) { return value == 0; }));
             data[7] = round;
             data[small - 1] = static_cast<unsigned char>(round + 0x40);
-            Require(sceKernelMunmap(mapped, small) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), small) == 0);
             mapped = nullptr;
             Require(sceKernelMapDirectMemory(&mapped, small, 3, 0, physical, 0) == 0);
             data = static_cast<unsigned char*>(mapped);
             for (std::size_t at = 0; at < small; ++at) Require(data[at] == (at == 7 ? round : at == small - 1 ? static_cast<unsigned char>(round + 0x40) : 0));
-            Require(sceKernelMunmap(mapped, small) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), small) == 0);
             Require(sceKernelReleaseDirectMemory(physical, small) == 0);
         }
     };
@@ -609,7 +602,7 @@ static void CheckSavedDirectMemorySurvivesCachePressure() {
         Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, retained[index], bytes) == 0);
         const auto* data = static_cast<const unsigned char*>(mapped);
         Require(std::all_of(data, data + bytes, [&](unsigned char value) { return value == index + 1; }));
-        Require(sceKernelMunmap(mapped, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
         Require(sceKernelReleaseDirectMemory(retained[index], bytes) == 0);
     }
     temporary();
@@ -640,7 +633,7 @@ static void CheckReusedDirectMemorySections() {
     auto physical = allocate();
     auto* data = map(physical);
     std::memset(data, 0x5a, bytes);
-    Require(sceKernelMunmap(data, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
     auto before = handles();
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
     const auto released = handles();
@@ -659,12 +652,12 @@ static void CheckReusedDirectMemorySections() {
     Require(data[page + 3] == 41);
     data[page * 2] = 53;
     Require(alias[page * 2] == 53);
-    Require(sceKernelMunmap(alias, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), bytes) == 0);
     Require(data[5] == 17 && data[page + 3] == 41 && data[page * 2] == 53);
-    Require(sceKernelMunmap(data, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
     data = map(physical);
     Require(data[5] == 17 && data[page + 3] == 41 && data[page * 2] == 53 && data[bytes - 1] == 29);
-    Require(sceKernelMunmap(data, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
     before = handles();
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
     Require(handles() == before - 1);
@@ -677,9 +670,9 @@ static void CheckReusedDirectMemorySections() {
             second = nullptr;
             Require(sceKernelMapDirectMemory(&second, page, 3, 0, physical + static_cast<std::int64_t>(page), 0) == 0);
             Require(static_cast<unsigned char*>(second)[page - 1] == round);
-            Require(sceKernelMunmap(second, page) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
         }
-        Require(sceKernelMunmap(data, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(data), bytes) == 0);
         Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
     }
 #endif
@@ -731,7 +724,7 @@ static void CheckFixedMappingReplacesPartialOverlap() {
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 3, 0, 0, &phys) == 0);
     void* reserved = nullptr;
     Require(sceKernelMapDirectMemory(&reserved, page * 3, 3, 0, phys, 0) == 0);
-    Require(sceKernelMunmap(reserved, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 3) == 0);
     void* head = reserved;
     Require(sceKernelMapDirectMemory(&head, page, 3, 0x10, phys, 0) == 0 && head == reserved);
     void* fixed = reserved;
@@ -742,7 +735,7 @@ static void CheckFixedMappingReplacesPartialOverlap() {
     Require(sceKernelVirtualQuery(fixed, 0, &info, sizeof(info)) == 0);
     Require(info.is_direct && info.offset == static_cast<std::uint64_t>(phys));
     Require(static_cast<unsigned char*>(fixed)[page * 2 + 7] == 0x5c);
-    Require(sceKernelMunmap(fixed, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(fixed), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -755,14 +748,14 @@ static void CheckFixedMappingOverHoleInsideAllocation() {
     auto* bytes = static_cast<unsigned char*>(mapped);
     bytes[7] = 0x11;
     bytes[page * 3 + 7] = 0x44;
-    Require(sceKernelMunmap(bytes + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page), page) == 0);
     void* fixed = bytes + page;
     Require(sceKernelMapDirectMemory(&fixed, page * 2, 3, 0x10, phys + static_cast<std::int64_t>(page), 0) == 0);
     Require(fixed == bytes + page);
     bytes[page * 2 + 7] = 0x33;
     Require(bytes[7] == 0x11 && bytes[page * 2 + 7] == 0x33 && bytes[page * 3 + 7] == 0x44);
-    Require(sceKernelMunmap(bytes + page * 2, page * 2) == 0);
-    Require(sceKernelMunmap(mapped, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page * 2), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 }
 
@@ -863,7 +856,7 @@ static void CheckMtypeprotect() {
     std::int64_t start = -1;
     std::int64_t end = -1;
     Require(sceKernelGetDirectMemoryType(phys + static_cast<std::int64_t>(page * 2), &type, &start, &end) == 0 && type == 2);
-    Require(sceKernelMunmap(mapped, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -875,7 +868,7 @@ static void CheckDirectMemoryGpuProtBits() {
     Require(sceKernelMapDirectMemory(&mapping, page, 0x3f2, 0, phys, 0) == 0);
     static_cast<unsigned char*>(mapping)[0] = 11;
     Require(static_cast<unsigned char*>(mapping)[0] == 11);
-    Require(sceKernelMunmap(mapping, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -909,16 +902,16 @@ static void CheckGpuAccessFollowsProtection() {
         const auto image = std::find_if(lease.begin(), lease.end(), [&](const auto& range) { return probe >= range->address && probe - range->address < range->bytes; });
         Require(image != lease.end() && !(*image)->releasable && !(*image)->gpu);
     }
-    Require(sceKernelMunmap(cpu, page) == 0);
-    Require(sceKernelMunmap(gpu, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(cpu), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(gpu), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     void* flexible = nullptr;
     Require(sceKernelMapNamedFlexibleMemory(&flexible, page, 3, 0, "cpu") == 0);
     Require(!GpuMapped(flexible));
-    Require(sceKernelMunmap(flexible, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
     Require(sceKernelMapNamedFlexibleMemory(&flexible, page, 0x33, 0, "gpu") == 0);
     Require(GpuMapped(flexible));
-    Require(sceKernelMunmap(flexible, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
 }
 
 static std::vector<std::pair<std::uintptr_t, std::size_t>> gpuMapped;
@@ -941,7 +934,7 @@ static void CheckClearingTheObserverWaitsForItsCalls() {
     GuestAllocations::GuestAllocationsSetGpuMapObserver_nid_postfix(nullptr);
     Require(observerDone);
     mapper.join();
-    Require(sceKernelMunmap(gpu, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(gpu), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -981,10 +974,10 @@ static void CheckGpuMapsAreObserved() {
     Require(sceKernelMapDirectMemory(&gpuRemap, page, 0x32, 0x10, remapPhys + static_cast<std::int64_t>(page), 0) == 0 && gpuRemap == gpuTarget);
     Require(gpuMapped.size() == 2 && gpuMapped.back().first == reinterpret_cast<std::uintptr_t>(gpuTarget) && gpuMapped.back().second == page);
     GuestAllocations::GuestAllocationsSetGpuMapObserver_nid_postfix(nullptr);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(remapPhys, page * 2) == 0);
-    Require(sceKernelMunmap(cpu, page) == 0);
-    Require(sceKernelMunmap(gpu, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(cpu), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(gpu), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -992,7 +985,7 @@ static void CheckHintedVirtualReservation() {
     constexpr std::size_t page = 0x4000;
     void* probe = nullptr;
     Require(sceKernelReserveVirtualRange(&probe, page * 8, 0, 0) == 0);
-    Require(sceKernelMunmap(probe, page * 8) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(probe), page * 8) == 0);
     void* const hint = static_cast<unsigned char*>(probe) + page * 2;
     void* placed = hint;
     Require(sceKernelReserveVirtualRange(&placed, page * 2, 0, 0) == 0);
@@ -1000,8 +993,8 @@ static void CheckHintedVirtualReservation() {
     void* above = hint;
     Require(sceKernelReserveVirtualRange(&above, page * 2, 0, 0) == 0);
     Require(above > hint);
-    Require(sceKernelMunmap(above, page * 2) == 0);
-    Require(sceKernelMunmap(placed, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(above), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(placed), page * 2) == 0);
 }
 
 static void CheckReservationHintWithoutRoomAbove() {
@@ -1017,15 +1010,15 @@ static void CheckReservationHintWithoutRoomAbove() {
     void* belowTheHint = lastPage;
     Require(sceKernelReserveVirtualRange(&belowTheHint, page * 2, 0, 0) == 0);
     Require(belowTheHint < lastPage && GuestArena::GuestArenaContains_nid_postfix(belowTheHint, page * 2));
-    Require(sceKernelMunmap(belowTheHint, page * 2) == 0);
-    Require(sceKernelMunmap(aboveTheArena, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(belowTheHint), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(aboveTheArena), page * 2) == 0);
 }
 
 static void CheckFixedVirtualReservation() {
     constexpr std::size_t page = 0x4000;
     void* probe = nullptr;
     Require(sceKernelReserveVirtualRange(&probe, page * 4, 0, 0) == 0);
-    Require(sceKernelMunmap(probe, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(probe), page * 4) == 0);
     void* const requested = static_cast<unsigned char*>(probe) + page;
     void* fixed = requested;
     Require(sceKernelReserveVirtualRange(&fixed, page * 2, 0x400010, 0) == 0);
@@ -1057,16 +1050,17 @@ static void CheckFixedVirtualReservation() {
     bool refused = false;
     try {
         sceKernelReserveVirtualRange(&reserved, page * 2, 0x90, 0);
+
     } catch (const std::exception&) {
         refused = true;
     }
     Require(refused);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     void* pooled = nullptr;
     Require(sceKernelMemoryPoolReserve(requested, page * 2, 0, 0x10, &pooled) == 0);
     Require(pooled == requested);
-    Require(sceKernelMunmap(pooled, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(pooled), page * 2) == 0);
 }
 
 static void CheckHintInsideReservation() {
@@ -1095,8 +1089,8 @@ static void CheckHintInsideReservation() {
     Require(sceKernelMapDirectMemory(&overlapping, page * 2, 3, 0, phys + page, 0) == 0);
     Require(overlapping != base + page);
     Require(static_cast<unsigned char*>(direct)[0] == 21 && static_cast<unsigned char*>(flexible)[0] == 22);
-    Require(sceKernelMunmap(overlapping, page * 2) == 0);
-    Require(sceKernelMunmap(reserved, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(overlapping), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -1121,7 +1115,7 @@ static void CheckReservedRangeIsNotCommitted() {
     Require(sceKernelVirtualQuery(static_cast<unsigned char*>(reserved) + page, 0, &info, sizeof(info)) == 0);
     Require(!info.is_committed && info.protection == 0);
     Require(info.start == start + page && info.end == start + page * 2);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -1142,7 +1136,7 @@ static void CheckNoOverwriteRefusesLiveMapping() {
     VirtualQueryInfo info{};
     Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) == 0);
     Require(info.is_direct && info.offset == static_cast<std::uint64_t>(phys));
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -1156,7 +1150,7 @@ static void CheckNoOverwriteRejectsHostOccupiedMapping() {
     constexpr std::size_t page = 0x4000;
     void* reservation = nullptr;
     Require(sceKernelReserveVirtualRange(&reservation, page * 4, 0, 0) == 0);
-    Require(sceKernelMunmap(reservation, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reservation), page * 4) == 0);
     void* target = static_cast<unsigned char*>(reservation) + page;
     GuestArena::GuestArenaCommit_nid_postfix(target, page, ReadWriteProtection, page);
     std::int64_t phys = 0;
@@ -1217,6 +1211,7 @@ static void CheckGuestModuleImageProtection() {
         bool failed = false;
         try {
             dlclose_nid_postfix(module);
+
         } catch (const std::runtime_error&) {
             failed = true;
         }
@@ -1257,6 +1252,7 @@ static void CheckGuestModuleImageProtection() {
     bool rejected = false;
     try {
         sceKernelMprotect(GetModuleHandleA("kernel32.dll"), page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1267,6 +1263,7 @@ static void CheckGuestModuleImageProtection() {
         const auto libkernel = GetModuleHandleA("libkernel.prx");
         Require(libkernel != nullptr);
         sceKernelMprotect(libkernel, page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1294,6 +1291,7 @@ static void CheckGuestModuleImageProtection() {
     rejected = false;
     try {
         sceKernelMprotect(plainTarget, page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1344,6 +1342,7 @@ static void CheckGuestModuleImageProtection() {
     bool rejected = false;
     try {
         sceKernelMprotect(reinterpret_cast<const void*>(&::getpid), page, 1);
+
     } catch (const std::invalid_argument&) {
         rejected = true;
     }
@@ -1371,8 +1370,8 @@ static void CheckUnhintedKernelMappingsLandInTheWindow() {
     const auto flexibleAddress = reinterpret_cast<std::uintptr_t>(flexible);
     Require(flexibleAddress >= windowStart);
     Require(flexibleAddress + page <= windowEnd);
-    Require(sceKernelMunmap(direct, page) == 0);
-    Require(sceKernelMunmap(flexible, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(direct), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -1382,13 +1381,13 @@ static void CheckUnmappedArenaRangeStaysReserved() {
     void* address = nullptr;
     Require(sceKernelMapNamedFlexibleMemory(&address, page, 3, 0, "reserved-after-unmap") == 0);
     Require(address != nullptr);
-    Require(sceKernelMunmap(address, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(address), page) == 0);
     void* hostile = mmap(address, page, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE, -1, 0);
     Require(hostile == MAP_FAILED && errno == EEXIST);
     void* again = nullptr;
     Require(sceKernelMapNamedFlexibleMemory(&again, page, 3, 0, "reserved-after-unmap-2") == 0);
     Require(again != nullptr);
-    Require(sceKernelMunmap(again, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), page) == 0);
 }
 #endif
 
@@ -1441,7 +1440,13 @@ static void CheckFixedMappingsReachTheApplicationAreaEnd() {
         0;
 #endif
     constexpr std::uintptr_t applicationAreaEnd = 0xFC00000000ull + expectedOffset;
-    Require(base == 0x200000000ull + expectedOffset && base + size == applicationAreaEnd);
+    constexpr std::uintptr_t expectedBase =
+#ifdef __APPLE__
+        0x200000000ull + expectedOffset;
+#else
+        expectedOffset == 0 ? 0x10000ull : 0x200000000ull + expectedOffset;
+#endif
+    Require(base == expectedBase && base + size == applicationAreaEnd);
     std::int64_t phys = 0;
     Require(sceKernelAllocateDirectMemory(0, 0x7fffffffffll, page * 2, 0, 0, &phys) == 0);
     void* const requested = reinterpret_cast<void*>(applicationAreaEnd - page * 2);
@@ -1462,8 +1467,8 @@ static void CheckFixedMappingsReachTheApplicationAreaEnd() {
         refused = true;
     }
     Require(refused && beyond == reinterpret_cast<void*>(applicationAreaEnd));
-    Require(sceKernelMunmap(alias, page) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 #ifdef _WIN32
@@ -1489,7 +1494,7 @@ static void CheckAliasOfReorderedSharedPages() {
     Require(bytes[6] == 0x33 && bytes[page + 6] == 0x44);
     GuestArena::GuestArenaUnmapAlias_nid_postfix(const_cast<unsigned char*>(alias));
     Require(bytes[5] == 0x22 && bytes[page + 5] == 0x11);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -1520,7 +1525,7 @@ static void CheckAliasAcrossDirectAllocations() {
         Require(VirtualQuery(alias + offset, &released, sizeof(released)) == sizeof(released) && released.State == MEM_FREE);
     }
     Require(bytes[5] == 0x11 && bytes[page + 5] == 0x22 && bytes[page * 2 + 5] == 0x33);
-    Require(sceKernelMunmap(mapped, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(first, page * 3) == 0);
 }
 
@@ -1542,7 +1547,7 @@ static void CheckAliasLeavesResidentRunsUnderAHostWrite() {
     Require(alias != nullptr && alias[5] == 0x11 && alias[page + 5] == 0x22);
     GuestArena::GuestArenaUnmapAlias_nid_postfix(const_cast<unsigned char*>(alias));
     Require(bytes[5] == 0x11 && bytes[page + 5] == 0x22);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 }
 
@@ -1559,7 +1564,7 @@ static void CheckAliasRefusesPagesThatAreNotSharedViews() {
     bool refused = false;
     try { GuestArena::GuestArenaMapAlias_nid_postfix(reinterpret_cast<std::uintptr_t>(reserved), page * 2); } catch (const std::runtime_error&) { refused = true; }
     Require(refused);
-    Require(sceKernelMunmap(reserved, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 #endif
@@ -1611,8 +1616,8 @@ static void CheckMlock() {
 #ifndef ANYPS5_ENABLE_ASAN
     Require(sceKernelMlock_nid_postfix(reserved, page) == outOfMemory);
 #endif
-    Require(sceKernelMunmap(reserved, page) == 0);
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
 #ifndef ANYPS5_ENABLE_ASAN
     Require(sceKernelMlock_nid_postfix(mapped, page) == outOfMemory);
 #endif
@@ -1640,8 +1645,8 @@ static void CheckSharedDirectMemoryLifecycle() {
     left[page] = 48;
     Require(sceKernelMprotect(inaccessible, page, 1) == 0);
     Require(static_cast<const unsigned char*>(inaccessible)[0] == 48);
-    Require(sceKernelMunmap(inaccessible, page) == 0);
-    Require(sceKernelMunmap(left + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(inaccessible), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(left + page), page) == 0);
     right[page] = 79;
     Require(left[0] == 31 && left[page * 2] == 63);
     void* middle = left + page;
@@ -1653,9 +1658,9 @@ static void CheckSharedDirectMemoryLifecycle() {
     left[page] = 95;
     Require(sceKernelMprotect(second, page * 3, 1) == 0);
     Require(right[page] == 95);
-    Require(sceKernelMunmap(first, page) == 0);
-    Require(sceKernelMunmap(left + page * 2, page) == 0);
-    Require(sceKernelMunmap(middle, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(left + page * 2), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(middle), page) == 0);
     Require(sceKernelMprotect(second, page * 3, 3) == 0);
     right[page * 2] = 111;
     void* reserved = nullptr;
@@ -1671,8 +1676,8 @@ static void CheckSharedDirectMemoryLifecycle() {
     Require(!info.is_direct && info.is_flexible && info.offset == 0);
     static_cast<unsigned char*>(fixed)[0] = 143;
     Require(right[page * 2] == 127);
-    Require(sceKernelMunmap(reserved, page * 3) == 0);
-    Require(sceKernelMunmap(second, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys + page, page) == 0);
     std::int64_t replacement = 0;
     Require(sceKernelAllocateDirectMemory(phys + page, phys + page * 2, page, 0, 0, &replacement) == 0);
@@ -1681,7 +1686,7 @@ static void CheckSharedDirectMemoryLifecycle() {
     Require(sceKernelMapDirectMemory(&mixed, page * 3, 3, 0, phys, 0) == 0);
     const auto* data = static_cast<const unsigned char*>(mixed);
     Require(data[0] == 31 && data[page] == 0 && data[page * 2] == 127);
-    Require(sceKernelMunmap(mixed, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mixed), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -1748,7 +1753,7 @@ static void CheckSingleDirectMappingTracksWritesWithoutFaults() {
     Require(g_accessViolations == 0);
     Require(collect(mapped, page * 4) == 2);
     Require(collect(mapped, page * 4) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(mapped) + page * 2, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(mapped) + page * 2), page) == 0);
     Require(bytes[page + 0x1000] == 7 && bytes[page * 3] == 9);
     bytes[0] = 5;
     Require(collect(mapped, page * 2) != 0);
@@ -1759,14 +1764,14 @@ static void CheckSingleDirectMappingTracksWritesWithoutFaults() {
     static_cast<volatile unsigned char*>(second)[0x1001] = 11;
     Require(bytes[page + 0x1001] == 11);
     Require(collect(mapped, page * 2) != 0);
-    Require(sceKernelMunmap(second, page) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(mapped) + page * 3, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(mapped) + page * 3), page) == 0);
     void* again = nullptr;
     Require(sceKernelMapDirectMemory(&again, page * 4, 3, 0, phys, 0) == 0);
     const auto* data = static_cast<const unsigned char*>(again);
     Require(data[0] == 5 && data[page + 0x1000] == 7 && data[page + 0x1001] == 11 && data[page * 2] == 0 && data[page * 3] == 9);
-    Require(sceKernelMunmap(again, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 #endif
 }
@@ -1831,7 +1836,7 @@ static void CheckLargeResidentWritesStopFaulting() {
     Require(mprotect_nid_postfix(mapped, bytes, 3) == 0);
     data[0x10000] = 97;
     Require(collect() == 1 && collect() == 0);
-    Require(sceKernelMunmap(mapped, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -1867,8 +1872,8 @@ static void CheckImportAccessDoesNotInventSharedWrites() {
     }
     Require(static_cast<unsigned char*>(second)[4097] == 73);
     Require(collect(first) == 0 && collect(second) == 0);
-    Require(sceKernelMunmap(first, bytes) == 0);
-    Require(sceKernelMunmap(second, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -1908,7 +1913,7 @@ static void CheckResidentCollectPreservesPartialWrites() {
     Require(collect(small, bytes - small, 1, true, false) == std::vector<std::uintptr_t>{small});
     Require(collect(small * 2, bytes - small * 2, bytes / small, true, true) == std::vector<std::uintptr_t>{0x200000});
     Require(collect(0, bytes, bytes / small, true, false).empty());
-    Require(sceKernelMunmap(mapped, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -1970,8 +1975,8 @@ static void CheckResidentCollectionDuringHostWrites() {
     Require(data[small + 11] == 4);
     const auto pages = collect();
     Require(std::find(pages.begin(), pages.end(), data + small) != pages.end());
-    Require(sceKernelMunmap(alias, 0x4000) == 0);
-    Require(sceKernelMunmap(mapped, bytes) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), 0x4000) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
     Require(sceKernelReleaseDirectMemory(physical, bytes) == 0);
 #endif
 }
@@ -2051,8 +2056,8 @@ static void CheckSecondDirectMappingWaitsForLeases() {
     static_cast<volatile unsigned char*>(second)[8] = 3;
     Require(static_cast<unsigned char*>(mapped)[page + 8] == 3);
     static_cast<volatile unsigned char*>(mapped)[page * 2 + 8] = 4;
-    Require(sceKernelMunmap(second, page) == 0);
-    Require(sceKernelMunmap(mapped, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 #endif
 }
@@ -2105,7 +2110,7 @@ static void CheckBreakingAResidentRunKeepsConcurrentAccesses() {
         std::array<void*, chunks> second{};
         go = true;
         for (std::size_t index = 0; index < chunks; ++index) {
-            if (unmap) Require(sceKernelMunmap(static_cast<unsigned char*>(mapped) + index * chunk + page, page) == 0);
+            if (unmap) Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(mapped) + index * chunk + page), page) == 0);
             else Require(sceKernelMapDirectMemory(&second[index], page, 3, 0, phys + static_cast<std::int64_t>(index * chunk + page), 0) == 0);
         }
         writer.join();
@@ -2118,16 +2123,16 @@ static void CheckBreakingAResidentRunKeepsConcurrentAccesses() {
             }
             if (unmap) continue;
             for (std::size_t offset = 0; offset < page; ++offset) Require(static_cast<unsigned char*>(second[index])[offset] == value(index * chunk + page + offset));
-            Require(sceKernelMunmap(second[index], page) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second[index]), page) == 0);
         }
         for (std::size_t index = 0; index < chunks; ++index) {
             auto* base = static_cast<unsigned char*>(mapped) + index * chunk;
             if (!unmap) {
-                Require(sceKernelMunmap(base, chunk) == 0);
+                Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), chunk) == 0);
                 continue;
             }
-            Require(sceKernelMunmap(base, page) == 0);
-            Require(sceKernelMunmap(base + page * 2, chunk - page * 2) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page) == 0);
+            Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base + page * 2), chunk - page * 2) == 0);
         }
         Require(sceKernelReleaseDirectMemory(phys, chunk * chunks) == 0);
     }
@@ -2152,13 +2157,13 @@ static void CheckRemappedDirectMemoryIsChargedOnce() {
         Require(sceKernelMapDirectMemory(&mapped, bytes, 3, 0, phys, 0) == 0);
         RequireResidentMapping(mapped);
         std::memset(mapped, 0xa5, bytes);
-        Require(sceKernelMunmap(mapped, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), bytes) == 0);
         void* again = nullptr;
         Require(sceKernelMapDirectMemory(&again, bytes, 3, 0, phys, 0) == 0);
         const auto* data = static_cast<const unsigned char*>(again);
         Require(data[0] == 0xa5 && data[bytes / 2] == 0xa5 && data[bytes - 1] == 0xa5);
         once = committed() - before < static_cast<std::int64_t>(bytes + bytes / 2);
-        Require(sceKernelMunmap(again, bytes) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), bytes) == 0);
         Require(sceKernelReleaseDirectMemory(phys, bytes) == 0);
     }
     Require(once);
@@ -2212,9 +2217,9 @@ static void CheckSharedWriteTracking() {
     collect(second, page * 3);
     static_cast<volatile unsigned char*>(third)[0] = 105;
     Require(collect(first, page * 3) == 1 && collect(second, page * 3) == 1);
-    Require(sceKernelMunmap(third, page) == 0);
-    Require(sceKernelMunmap(first, page * 3) == 0);
-    Require(sceKernelMunmap(second, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(third), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 #endif
 }
@@ -2257,7 +2262,7 @@ static void CheckSharedWritePages() {
     Require(bytes[page + small] == 5 && bytes[page + small * 2 - 1] == 5);
     Require(collect(page, small) == 0);
     Require(collect(0, page * 2) == 1);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     std::filesystem::remove(path);
 #endif
@@ -2300,8 +2305,8 @@ static void CheckSharedWritesDuringHostWrite() {
     Require(collect(first).empty() && collect(second).empty());
     left[small + 16] = 3;
     Require(right[small + 16] == 3 && collect(second) == std::vector<std::size_t>{small});
-    Require(sceKernelMunmap(first, page) == 0);
-    Require(sceKernelMunmap(second, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(second), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 #endif
 }
@@ -2334,7 +2339,7 @@ static void CheckFailedCollectKeepsWrites() {
     Require(sceKernelMprotect(const_cast<unsigned char*>(shared + page), page, 0) == 0);
     Require(!collect(mapped, page * 2, count));
     Require(collect(mapped, page, count) && count == 1);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
 #endif
 }
@@ -2416,8 +2421,8 @@ static void CheckPinnedSharedPages() {
     Require(protection(page) == PAGE_READONLY);
     bytes[page + 8] = 11;
     Require(collect() == 1);
-    Require(sceKernelMunmap(alias, page * 3) == 0);
-    Require(sceKernelMunmap(mapped, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 #endif
 }
@@ -2461,7 +2466,7 @@ static void CheckReadsIntoSharedWriteTracking() {
     KernelAioRwRequest request{static_cast<std::int64_t>(page), page, bytes, &result, fd};
     std::int32_t id = 0;
     std::int32_t state = 0;
-    Require(sceKernelAioSubmitReadCommands(&request, 1, 0, &id) == 0);
+    Require(sceKernelAioSubmitReadCommands(&request, 1, 1, &id) == 0);
     Require(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
     Require(result.state == 3 && result.return_value == static_cast<std::int64_t>(page));
     Require(std::memcmp(bytes, seed.data() + page, page) == 0);
@@ -2472,12 +2477,12 @@ static void CheckReadsIntoSharedWriteTracking() {
     Require(sceKernelPread(fd, mapped, page, 0) == static_cast<std::int64_t>(SCE_KERNEL_ERROR_EFAULT));
     KernelAioResult refusedResult{-1, 0};
     KernelAioRwRequest refusedRequest{0, page, bytes, &refusedResult, fd};
-    Require(sceKernelAioSubmitReadCommands(&refusedRequest, 1, 0, &id) == 0);
+    Require(sceKernelAioSubmitReadCommands(&refusedRequest, 1, 1, &id) == 0);
     Require(sceKernelAioWaitRequest(id, &state, nullptr) == 0);
     Require(refusedResult.return_value == static_cast<std::int64_t>(SCE_KERNEL_ERROR_EFAULT));
     Require(sceKernelAioDeleteRequest(id, &deleted) == 0);
     Require(sceKernelClose(fd) == 0);
-    Require(sceKernelMunmap(mapped, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 2) == 0);
     std::filesystem::remove(path);
 #endif
@@ -2532,7 +2537,7 @@ static void CheckWriteWatchArmedCollect() {
     Require(CollectArmedRuns(mapping, 0, length, runs) && runs == PageRuns{{5, 6}});
     Require(Written(mapping, length, {{length / small / 2, length / small}}));
     Require(Written(mapping, length, {}));
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
 }
 
 static bool CollectFreshRuns(const void* base, std::size_t offset, std::size_t bytes, PageRuns& runs) {
@@ -2560,7 +2565,7 @@ static void CheckWriteWatchFreshCollect() {
     Require(CollectFreshRuns(mapping, 0, length, runs) && runs.empty());
     bytes[200 * small] = 1;
     Require(Written(mapping, length, {{5, 6}, {200, 201}}));
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
 }
 
 static void CheckWriteWatch() {
@@ -2610,7 +2615,7 @@ static void CheckWriteWatch() {
     Require(Written(mapping, length, {{50, 51}}));
     constexpr std::size_t guestPage = 0x4000;
     auto* middle = const_cast<unsigned char*>(bytes + 4 * guestPage);
-    Require(sceKernelMunmap(middle, guestPage) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(middle), guestPage) == 0);
     Require(!GuestWriteWatch::GuestWriteWatchCovers_nid_postfix(address, length));
     Require(!CollectRuns(mapping, 0, length, runs) && runs.empty());
     void* fixed = middle;
@@ -2620,7 +2625,7 @@ static void CheckWriteWatch() {
     Require(Written(mapping, length, {}));
     middle[1] = 1;
     Require(Written(mapping, length, {{16, 17}}));
-    Require(sceKernelMunmap(mapping, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), length) == 0);
     Require(!GuestWriteWatch::GuestWriteWatchCovers_nid_postfix(address, small));
     constexpr std::size_t tableSpan = 0x200000;
     constexpr std::size_t spanned = 2 * tableSpan;
@@ -2660,7 +2665,7 @@ static void CheckDirectMemoryBackingNeedsNoFilesystem() {
     const auto backing = BackingOf(mapped);
     if (backing.rfind("/memfd:", 0) != 0) std::fprintf(stderr, "direct memory backing: %s\n", backing.c_str());
     Require(backing.rfind("/memfd:", 0) == 0);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page) == 0);
 }
 
@@ -2703,10 +2708,10 @@ static void CheckDirectMemorySharedBacking() {
     Require(!GuestArena::GuestArenaSharedBacking_nid_postfix(flexibleAddress, page * 2, &file, &offset));
     Require(GuestArena::GuestArenaSharedBacking_nid_postfix(flexibleAddress + page, page, &file, &offset) && offset == base + page * 2);
     close(file);
-    Require(sceKernelMunmap(high, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(high), page) == 0);
     Require(!GuestArena::GuestArenaSharedBacking_nid_postfix(flexibleAddress + page, page, &file, &offset));
-    Require(sceKernelMunmap(flexible, page) == 0);
-    Require(sceKernelMunmap(first, page * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 2) == 0);
     Require(!GuestArena::GuestArenaSharedBacking_nid_postfix(address, page, &file, &offset));
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 
@@ -2730,15 +2735,15 @@ static void CheckDirectMemorySharedBacking() {
     close(leftFile);
     close(rightFile);
     std::memset(leftView, 0x77, page);
-    Require(sceKernelMunmap(leftView, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(leftView), page) == 0);
     Require(sceKernelReleaseDirectMemory(left, page) == 0);
     std::int64_t again = 0;
     Require(sceKernelAllocateDirectMemory(left, left + static_cast<std::int64_t>(page), page, 0, 0, &again) == 0 && again == left);
     void* againView = nullptr;
     Require(sceKernelMapDirectMemory(&againView, page, 3, 0, again, 0) == 0);
     for (std::size_t i = 0; i < page; ++i) Require(static_cast<const unsigned char*>(againView)[i] == 0);
-    Require(sceKernelMunmap(againView, page) == 0);
-    Require(sceKernelMunmap(rightView, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(againView), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(rightView), page) == 0);
     Require(sceKernelReleaseDirectMemory(again, page) == 0);
     Require(sceKernelReleaseDirectMemory(right, page) == 0);
 }
@@ -2774,8 +2779,8 @@ static void CheckDirectMemoryWriteWatch() {
     Require(bytes[page + 7] == 3);
     Require(CollectRuns(first, 0, page, runs) && runs == PageRuns{{0, 1}});
     Require(CollectRuns(first, page * 2, page, runs) && runs.empty());
-    Require(sceKernelMunmap(alias, page) == 0);
-    Require(sceKernelMunmap(first, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alias), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(first), page * 3) == 0);
     Require(!GuestWriteWatch::GuestWriteWatchCovers_nid_postfix(address, page));
     void* flexible = nullptr;
     Require(sceKernelMapFlexibleMemory(&flexible, page * 3, 3, 0) == 0);
@@ -2789,7 +2794,7 @@ static void CheckDirectMemoryWriteWatch() {
     Require(Written(flexible, page * 3, {}));
     static_cast<volatile unsigned char*>(fixed)[9] = 4;
     Require(Written(flexible, page * 3, {{page / small, page / small + 1}}));
-    Require(sceKernelMunmap(flexible, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(flexible), page * 3) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 3) == 0);
 }
 
@@ -2809,12 +2814,12 @@ static void CheckDirectMemoryWriteWatchFollowsRemovedMappings() {
     Require(sceKernelMapDirectMemory(&pair, page * 2, 3, 0, phys + page, 0) == 0);
     Require(watched(whole, 0) && !watched(whole, page) && !watched(whole, page * 2) && watched(whole, page * 3));
     Require(!watched(pair, 0) && !watched(pair, page));
-    Require(sceKernelMunmap(pair, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(pair), page) == 0);
     void* single = nullptr;
     Require(sceKernelMapDirectMemory(&single, page, 3, 0, phys + page, 0) == 0);
     Require(!watched(single, 0) && watched(whole, 0) && watched(whole, page * 3));
-    Require(sceKernelMunmap(single, page) == 0);
-    Require(sceKernelMunmap(static_cast<unsigned char*>(pair) + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(single), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(static_cast<unsigned char*>(pair) + page), page) == 0);
     void* replaced = whole;
     Require(sceKernelMapDirectMemory(&replaced, page, 3, 0x10, phys + page * 3, 0) == 0 && replaced == whole);
     Require(!watched(whole, 0) && !watched(whole, page * 3));
@@ -2829,9 +2834,9 @@ static void CheckDirectMemoryWriteWatchFollowsRemovedMappings() {
     void* again = nullptr;
     Require(sceKernelMapDirectMemory(&again, page, 3, 0, phys, 0) == 0);
     Require(!watched(alone, 0) && !watched(again, 0));
-    Require(sceKernelMunmap(again, page) == 0);
-    Require(sceKernelMunmap(alone, page) == 0);
-    Require(sceKernelMunmap(whole, page * 4) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(again), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(alone), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(whole), page * 4) == 0);
     Require(sceKernelReleaseDirectMemory(phys, page * 4) == 0);
 }
 
@@ -2854,7 +2859,7 @@ static double MapAcrossBackingsSeconds(std::int64_t phys, std::size_t backings)
         std::uint64_t offset = 0;
         int type = 0;
         Require(QueryDirectMapping(last, &start, &end, &offset, &type) && start == last && end == last + page);
-        Require(sceKernelMunmap(mapped, page * backings) == 0);
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page * backings) == 0);
     }
     return best;
 }
@@ -2995,7 +3000,7 @@ static void CheckVirtualQuerySplitFlexibleRanges() {
         Require(info.protection == (index == 1 ? 1 : 3));
         Require(info.is_committed && info.is_flexible && !info.is_direct);
     }
-    Require(sceKernelMunmap(bytes + page, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page), page) == 0);
     for (std::size_t index : {std::size_t{0}, std::size_t{2}}) {
         VirtualQueryInfo info{};
         Require(sceKernelVirtualQuery(bytes + page * index, 0, &info, sizeof(info)) == 0);
@@ -3007,8 +3012,8 @@ static void CheckVirtualQuerySplitFlexibleRanges() {
     Require(next.start == reinterpret_cast<std::uintptr_t>(bytes + page * 2));
     Require(next.end == next.start + page && next.protection == 3);
     Require(bytes[0] == 17 && bytes[page * 2] == 29);
-    Require(sceKernelMunmap(bytes, page) == 0);
-    Require(sceKernelMunmap(bytes + page * 2, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes), page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(bytes + page * 2), page) == 0);
 }
 
 static void CheckVirtualQueryWireLayout() {
@@ -3038,7 +3043,7 @@ static void CheckVirtualQueryWireLayout() {
     Require(std::all_of(result.before.begin(), result.before.end(), [](auto byte) { return byte == 0xa5; }));
     Require(std::all_of(result.after.begin(), result.after.end(), [](auto byte) { return byte == 0x5a; }));
     Require(sceKernelClearVirtualRangeName(mapped, page) == 0);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
 }
 
 static void CheckVirtualQueryForNonReadableGuestRange() {
@@ -3051,7 +3056,7 @@ static void CheckVirtualQueryForNonReadableGuestRange() {
     Require(sceKernelVirtualQuery(mapped, 0, &info, sizeof(info)) == 0);
     Require(info.start == reinterpret_cast<std::uintptr_t>(mapped));
     Require(info.end == info.start + page && info.protection == 0);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
 }
 
 static void CheckPosixFixedAnonymousMapping() {
@@ -3087,7 +3092,7 @@ static void CheckPosixFixedAnonymousMapping() {
     memory[page] = 0x51;
     memory[page * 2 - 1] = 0x52;
     memory[page * 2] = 0x61;
-    Require(sceKernelMunmap(memory + page * 3, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory + page * 3), page) == 0);
     Require(mmap_nid_postfix(memory + page * 3, page, 3, exclusive, -1, 0) == memory + page * 3);
     Require(std::all_of(memory + page * 3, memory + page * 4, [](unsigned char value) { return value == 0; }));
     memory[page * 4 - 1] = 0x62;
@@ -3140,7 +3145,7 @@ static void CheckPosixFixedAnonymousReleasesFlexibleAccounting() {
     Require(mmap_nid_postfix(bytes + page, page, 3, fixed, -1, 0) == bytes + page);
     Require(bytes[0] == 0x31 && bytes[page] == 0 && bytes[page * 2] == 0x51);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 2);
-    Require(sceKernelMunmap(base, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page * 3) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
 }
 
@@ -3169,7 +3174,7 @@ static void CheckPosixFixedFileReleasesFlexibleAccounting() {
     Require(mmap_nid_postfix(bytes + page, page, 1, fixedShared, fd, 0) == bytes + page);
     Require(bytes[0] == 0x31 && bytes[page] == 0x6d && bytes[page * 2] == 0x51);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before - page * 2);
-    Require(sceKernelMunmap(base, page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), page * 3) == 0);
     Require(sceKernelAvailableFlexibleMemorySize(&available) == 0 && available == before);
     Require(sceKernelClose(fd) == 0);
     std::filesystem::remove(path);
@@ -3182,7 +3187,7 @@ static void CheckSceKernelMmap() {
     Require(sceKernelMmap(nullptr, page, 3, 0x1002, -1, 0, &mapped) == 0 && mapped != nullptr);
     static_cast<volatile unsigned char*>(mapped)[page - 1] = 7;
     Require(static_cast<volatile unsigned char*>(mapped)[page - 1] == 7);
-    Require(sceKernelMunmap(mapped, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), page) == 0);
     void* untouched = &mapped;
     Require(sceKernelMmap(nullptr, 0, 3, 0x1002, -1, 0, &untouched) == static_cast<int>(0x80020016u));
     Require(untouched == &mapped);
@@ -3217,7 +3222,6 @@ static void CheckVirtualQueryPartialMunmap() {
     Require(munmap_nid_postfix(memory + page * 2, page) == 0);
 }
 
-
 static void CheckAvailableDirectMemoryIsLargestFreeBlock() {
     constexpr std::int64_t window = 0x4000000;
     const std::int64_t top = static_cast<std::int64_t>(DIRECT_MEMORY_SIZE) - window;
@@ -3237,12 +3241,43 @@ static void CheckAvailableDirectMemoryIsLargestFreeBlock() {
     Require(start == top + 0x200000 && size == 0x400000);
     Require(sceKernelAvailableDirectMemorySize(top, top + window, 0x1000000, &start, &size) == 0);
     Require(start == top + 0x1000000 && size == static_cast<std::size_t>(window - 0x1000000));
-    Require(sceKernelAvailableDirectMemorySize(top, top + 0x200000, 0, &start, &size) == SCE_KERNEL_ERROR_ENOMEM);
-    Require(start == 0 && size == 0);
-    Require(sceKernelAvailableDirectMemorySize(top + window, top, 0, &start, &size) == SCE_KERNEL_ERROR_EAGAIN);
-    Require(sceKernelAvailableDirectMemorySize(-1, top + window, 0, &start, &size) == SCE_KERNEL_ERROR_EAGAIN);
-    Require(sceKernelAvailableDirectMemorySize(top, top + window, std::numeric_limits<std::size_t>::max(), &start, &size) == SCE_KERNEL_ERROR_EAGAIN);
-    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, nullptr, &size) == SCE_KERNEL_ERROR_EINVAL);
+    const std::int64_t run = top + 0x800000;
+    const auto untouched = [&](std::int64_t searchStart, std::int64_t searchEnd, std::size_t alignment, int expected) {
+        start = -7;
+        size = 7;
+        return sceKernelAvailableDirectMemorySize(searchStart, searchEnd, alignment, &start, &size) == expected && start == -7 && size == 7;
+    };
+    Require(untouched(top, top + 0x200000, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(top + window, top, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(run, run, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(0, -1, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(run + 0x1000, run + 0x3000, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(static_cast<std::int64_t>(DIRECT_MEMORY_SIZE), std::numeric_limits<std::int64_t>::max(), 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(std::numeric_limits<std::int64_t>::max() - 0x3ffe, std::numeric_limits<std::int64_t>::max(), 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(std::numeric_limits<std::int64_t>::max(), run + 0x100000, 0, SCE_KERNEL_ERROR_ENOMEM));
+    Require(untouched(run, std::numeric_limits<std::int64_t>::max(), std::size_t{1} << 62, SCE_KERNEL_ERROR_ENOMEM));
+    for (const std::size_t alignment : {std::size_t{3}, std::size_t{0x6000}, std::size_t{0xc000}, std::size_t{0x14000}, ~std::size_t{0x3fff}, std::numeric_limits<std::size_t>::max()}) {
+        Require(untouched(top, top + window, alignment, SCE_KERNEL_ERROR_EINVAL));
+        Require(untouched(top + window, top, alignment, SCE_KERNEL_ERROR_EINVAL));
+    }
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, nullptr, &size) == 0 && size == static_cast<std::size_t>(window - 0x800000));
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, &start, nullptr) == 0 && start == run);
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 0, nullptr, nullptr) == 0);
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, 3, nullptr, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelAvailableDirectMemorySize(-1, top + window, 0, &start, &size) == 0 && start >= 0 && static_cast<std::int64_t>(size) <= top + window - start);
+    Require(sceKernelAvailableDirectMemorySize(std::numeric_limits<std::int64_t>::min(), top + window, 0, &start, &size) == 0 && start >= 0);
+    Require(sceKernelAvailableDirectMemorySize(run, run + 0xfffff, 0, &start, &size) == 0 && start == run && size == 0xfffff);
+    Require(sceKernelAvailableDirectMemorySize(run, run + 0x3fff, 0, &start, &size) == 0 && start == run && size == 0x3fff);
+    Require(sceKernelAvailableDirectMemorySize(run + 1, run + 0x100000, 0, &start, &size) == 0 && start == run + 0x4000 && size == 0xfc000);
+    Require(sceKernelAvailableDirectMemorySize(run + 0x2000, run + 0x6000, 0, &start, &size) == 0 && start == run + 0x4000 && size == 0x2000);
+    Require(sceKernelAvailableDirectMemorySize(run + 0x2000, run + 0x10e000, 1, &start, &size) == 0 && start == run + 0x4000 && size == 0x10a000);
+    Require(sceKernelAvailableDirectMemorySize(run + 0x4000, run + 0x100000, 0x8000, &start, &size) == 0 && start == run + 0x8000 && size == 0xf8000);
+    Require(sceKernelAvailableDirectMemorySize(top, top + window, std::size_t{1} << 63, &start, &size) == 0);
+    Require(start == std::numeric_limits<std::int64_t>::min() && size == static_cast<std::size_t>(top + window) - (std::size_t{1} << 63));
+    std::int64_t divider = -1;
+    Require(sceKernelAllocateDirectMemory(run + 0x40000, run + 0x44000, 0x4000, 0, 0, &divider) == 0 && divider == run + 0x40000);
+    Require(sceKernelAvailableDirectMemorySize(run, run + 0x84000, 0, &start, &size) == 0 && start == run && size == 0x40000);
+    Require(sceKernelReleaseDirectMemory(divider, 0x4000) == 0);
 
     Require(sceKernelReleaseDirectMemory(first, 0x200000) == 0);
     Require(sceKernelReleaseDirectMemory(last, 0x200000) == 0);
@@ -3268,8 +3303,8 @@ static void CheckMunmapOverUnmappedPages() {
     Require(sceKernelVirtualQuery(memory, 0, &info, sizeof(info)) == SCE_KERNEL_ERROR_EACCES);
     Require(sceKernelVirtualQuery(memory + page * 2, 0, &info, sizeof(info)) == SCE_KERNEL_ERROR_EACCES);
     Require(munmap_nid_postfix(memory, page * 3) == 0);
-    Require(sceKernelMunmap(memory, page * 3) == 0);
-    Require(sceKernelMunmap(memory, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), page * 3) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), 0) == SCE_KERNEL_ERROR_EINVAL);
 }
 
 int main(int argc, char** argv) {
@@ -3303,6 +3338,7 @@ int main(int argc, char** argv) {
     CheckGuestModuleUsesFlexibleMemory();
     CheckBatchMapStopsAtInvalidEntry();
     CheckCheckedReleaseDirectMemory();
+    CheckReleaseSkipsFreePages();
     CheckAudioCoprocessorProtection();
     CheckMprotectIgnoresUndefinedBits();
     CheckStrictMemoryProtectionBits();
@@ -3467,7 +3503,7 @@ int main(int argc, char** argv) {
     Require(sceKernelReserveVirtualRange(&mincoreReserved, page, 0, 0) == 0);
     mincoreVec[0] = 0x55;
     Require(mincore_nid_postfix(mincoreReserved, page, mincoreVec) == 0 && mincoreVec[0] == 0);
-    Require(sceKernelMunmap(mincoreReserved, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mincoreReserved), page) == 0);
     Require(munmap_nid_postfix(memory + 1, page) == -1 && *__error_nid_postfix() == 22);
     Require(munmap_nid_postfix(memory, 0) == -1 && *__error_nid_postfix() == 22);
     Require(memory[0] == 42);
diff --git a/core/libs/tests/GuestMemoryPoolStats.cpp b/core/libs/tests/GuestMemoryPoolStats.cpp
index 7aec461e18..14d926ca31 100644
--- a/core/libs/tests/GuestMemoryPoolStats.cpp
+++ b/core/libs/tests/GuestMemoryPoolStats.cpp
@@ -1,3 +1,6 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
+#include "prx/libSceNet/include/Net.hpp"
+#include "prx/libSceHttp2/include/Http2.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,41 +9,19 @@
 #include <cstdlib>
 #include <cstring>
 
-struct PoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-struct NetPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-};
-
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::size_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetMemoryPoolStats(int, void*);
-int APS5_VABI sceHttp2Init(int, int, std::size_t, int);
-int APS5_VABI sceHttp2Term(int);
-int APS5_VABI sceHttp2GetMemoryPoolStats(int, void*);
-int APS5_VABI sceNetPoolCreate(const char*, int, int);
-int APS5_VABI sceNetPoolDestroy(int);
-int APS5_VABI sceNetGetMemoryPoolStats(int, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
-using StatsCall = int(APS5_VABI*)(int, void*);
-
-static void CheckRejected(StatsCall call, int id, int expected) {
-    std::array<unsigned char, 0x40> buffer;
-    buffer.fill(0x5a);
-    Require(call(id, buffer.data()) == expected);
-    for (std::size_t i = 0; i < sizeof(PoolStats); ++i) Require(buffer[i] == 0);
-    for (std::size_t i = sizeof(PoolStats); i < buffer.size(); ++i) Require(buffer[i] == 0x5a);
+template <typename TStats>
+static void CheckRejected(int (APS5_VABI *call)(int, TStats*), int id, int expected) {
+    struct {
+        TStats stats;
+        std::array<unsigned char, 0x40 - sizeof(TStats)> guard;
+    } buffer;
+    std::memset(&buffer, 0x5a, sizeof(buffer));
+    Require(call(id, &buffer.stats) == expected);
+    const auto* bytes = reinterpret_cast<const unsigned char*>(&buffer.stats);
+    for (std::size_t i = 0; i < sizeof(TStats); ++i) Require(bytes[i] == 0);
+    for (const auto byte : buffer.guard) Require(byte == 0x5a);
 }
 
 int main() {
@@ -50,12 +31,12 @@ int main() {
     constexpr int http2NullPointer = static_cast<int>(0x817B1225);
     constexpr int netBadDescriptor = static_cast<int>(0x80410109);
     constexpr int netInvalid = static_cast<int>(0x80410116);
-    static_assert(sizeof(PoolStats) == 0x20 && sizeof(NetPoolStats) == 0x18);
+    static_assert(sizeof(SceSsl::MemoryPoolStats) == 0x20 && sizeof(Http2MemoryPoolStats) == 0x20 && sizeof(NetMemoryPoolStats) == 0x18);
 
     const int ssl = sceSslInit_nid_postfix(0x40000);
     Require(ssl > 0);
-    PoolStats stats{};
-    Require(sceSslGetMemoryPoolStats(ssl, &stats) == 0 && stats.pool_size == 0x40000);
+    SceSsl::MemoryPoolStats sslStats{};
+    Require(sceSslGetMemoryPoolStats(ssl, &sslStats) == 0 && sslStats.poolSize == 0x40000);
     Require(sceSslGetMemoryPoolStats(ssl, nullptr) == sslInvalidValue);
     Require(sceSslGetMemoryPoolStats(12345, nullptr) == sslInvalidValue);
     CheckRejected(sceSslGetMemoryPoolStats, 12345, sslInvalidId);
@@ -63,7 +44,8 @@ int main() {
 
     const int http2 = sceHttp2Init(1, ssl, 0x40000, 1);
     Require(http2 > 0);
-    Require(sceHttp2GetMemoryPoolStats(http2, &stats) == 0 && stats.pool_size == 0x40000);
+    Http2MemoryPoolStats http2Stats{};
+    Require(sceHttp2GetMemoryPoolStats(http2, &http2Stats) == 0 && http2Stats.pool_size == 0x40000);
     Require(sceHttp2GetMemoryPoolStats(http2, nullptr) == http2NullPointer);
     Require(sceHttp2GetMemoryPoolStats(12345, nullptr) == http2NullPointer);
     CheckRejected(sceHttp2GetMemoryPoolStats, 12345, http2InvalidId);
@@ -76,14 +58,17 @@ int main() {
 
     const int pool = sceNetPoolCreate("stats", 0x20000, 0);
     Require(pool > 0);
-    NetPoolStats netStats{};
+    NetMemoryPoolStats netStats{};
     Require(sceNetGetMemoryPoolStats(pool, &netStats) == 0 && netStats.pool_size == 0x20000);
     Require(sceNetGetMemoryPoolStats(pool, nullptr) == netInvalid);
     Require(sceNetGetMemoryPoolStats(12345, nullptr) == netBadDescriptor);
-    std::array<unsigned char, 0x20> untouched;
-    untouched.fill(0x5a);
+    struct {
+        NetMemoryPoolStats stats;
+        std::array<unsigned char, 8> guard;
+    } untouched;
+    std::memset(&untouched, 0x5a, sizeof(untouched));
     auto buffer = untouched;
-    Require(sceNetGetMemoryPoolStats(12345, buffer.data()) == netBadDescriptor && buffer == untouched);
+    Require(sceNetGetMemoryPoolStats(12345, &buffer.stats) == netBadDescriptor && std::memcmp(&buffer, &untouched, sizeof(buffer)) == 0);
     Require(sceNetPoolDestroy(pool) == 0);
     Require(sceNetGetMemoryPoolStats(pool, nullptr) == netBadDescriptor);
     return 0;
diff --git a/core/libs/tests/GuestMemrchr.cpp b/core/libs/tests/GuestMemrchr.cpp
index 8715e30bf2..6f09c1f987 100644
--- a/core/libs/tests/GuestMemrchr.cpp
+++ b/core/libs/tests/GuestMemrchr.cpp
@@ -1,10 +1,7 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 
-extern "C" {
-void* APS5_VABI memrchr_nid_postfix(const void*, int, std::size_t);
-}
-
 int main() {
     const unsigned char bytes[] = {0xff, 0x01, 0xff, 0x00};
     const auto* found = static_cast<const unsigned char*>(memrchr_nid_postfix(bytes, 0xff, sizeof(bytes)));
diff --git a/core/libs/tests/GuestMessageDestructorAbi.cpp b/core/libs/tests/GuestMessageDestructorAbi.cpp
index 8c55dbc490..90d524adf0 100644
--- a/core/libs/tests/GuestMessageDestructorAbi.cpp
+++ b/core/libs/tests/GuestMessageDestructorAbi.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Runtime.hpp"
 #include <cstdio>
 #include <cstring>
@@ -10,10 +11,10 @@ using GuestDestroy = void (APS5_VABI *)(void*);
 using HostDestroy = void (*)(void*);
 using GuestThrowFunction = void (APS5_VABI *)(std::uintptr_t);
 struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
+
 struct Table { std::ptrdiff_t offset; const TypeRecord* type; GuestDestroy destroy; GuestDestroy deleteObject; GuestWhat what; };
 struct Message { std::size_t length; std::size_t capacity; std::atomic<std::ptrdiff_t> references; };
-static_assert(sizeof(Object) == 16);
+static_assert(sizeof(LibcException::ExceptionObject) == 16);
 
 extern "C" {
 extern const unsigned char _ZTVN10__cxxabiv117__class_type_infoE_nid_postfix[];
@@ -22,22 +23,12 @@ extern const unsigned char _ZTISt12out_of_range_nid_postfix[];
 extern const unsigned char _ZTISt11regex_error_nid_postfix[];
 extern const unsigned char _ZTISt13runtime_error_nid_postfix[];
 extern const unsigned char _ZTISt11logic_error_nid_postfix[];
-void APS5_VABI _ZNSt12out_of_rangeC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt12out_of_rangeC1ERKS__nid_postfix(Object*, const Object*);
-void APS5_VABI _ZNSt12out_of_rangeD1Ev_nid_postfix(Object*);
-void APS5_VABI _ZNSt11logic_errorC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt11logic_errorD1Ev_nid_postfix(Object*);
-[[noreturn]] void APS5_VABI _ZSt14_Xout_of_rangePKc_nid_postfix(const char*);
-[[noreturn]] void APS5_VABI _ZSt15_Xruntime_errorPKc_nid_postfix(const char*);
-[[noreturn]] void APS5_VABI _ZNKSt11logic_error8_DoraiseEv_nid_postfix(const Object*);
-[[noreturn]] void APS5_VABI _ZSt13_Xregex_errorNSt15regex_constants10error_typeE_nid_postfix(std::regex_constants::error_type);
+
 int APS5_VABI GuestOuter();
 void APS5_VABI GuestCleanup();
 void APS5_VABI GuestStdCapture();
 void APS5_VABI ProbeDestroy(GuestDestroy, void*, void*);
 const char* APS5_VABI ProbeWhat(GuestWhat, const void*, const void*);
-void APS5_VABI _ZNSt8bad_castC1Ev_nid_postfix(Object*);
-void APS5_VABI _ZNSt9bad_allocC1Ev_nid_postfix(Object*);
 
 TypeRecord FixtureBaseType{_ZTVN10__cxxabiv117__class_type_infoE_nid_postfix + 16, "11FixtureBase", nullptr};
 TypeRecord FixtureErrorType{_ZTVN10__cxxabiv120__si_class_type_infoE_nid_postfix + 16, "12FixtureError", &FixtureBaseType};
@@ -56,7 +47,7 @@ unsigned FixtureWhatChecked = 0;
     std::fprintf(stderr, "guest exception failure %u\n", code);
     ExitProcess(code);
 }
-const char* APS5_VABI FixtureWhat(const void* object) { return static_cast<const Object*>(object)->message; }
+const char* APS5_VABI FixtureWhat(const void* object) { return static_cast<const LibcException::ExceptionObject*>(object)->message; }
 void APS5_VABI FixtureDestroy(void* object) {
     if (object != FixtureLastObject) FixtureFail(11);
     ++FixtureDestroyed;
@@ -68,7 +59,7 @@ void APS5_VABI FixtureCheckWhat(const char* message) {
 }
 }
 
-static Object decoy{}, retained{};
+static LibcException::ExceptionObject decoy{}, retained{};
 static GuestDestroy registeredDestructor;
 static void* expectedObject;
 static void* poison;
@@ -129,18 +120,20 @@ static int TestVtable(const char* mode) {
     const bool plain = std::strstr(mode, "plain") != nullptr;
     const bool deleting = std::strstr(mode, "delete") != nullptr;
     const bool destroying = deleting || std::strstr(mode, "destroy") != nullptr;
-    auto* actual = static_cast<Object*>(std::malloc(sizeof(Object)));
-    auto* other = static_cast<Object*>(std::malloc(sizeof(Object)));
+    auto* actual = static_cast<LibcException::ExceptionObject*>(std::malloc(sizeof(LibcException::ExceptionObject)));
+    auto* other = static_cast<LibcException::ExceptionObject*>(std::malloc(sizeof(LibcException::ExceptionObject)));
     if (!actual || !other) FixtureFail(57);
     actual->message = other->message = nullptr;
     if (plain) {
         _ZNSt9bad_allocC1Ev_nid_postfix(actual);
         _ZNSt8bad_castC1Ev_nid_postfix(other);
+
     } else {
         _ZNSt12out_of_rangeC1EPKc_nid_postfix(actual, "actual virtual message");
         _ZNSt12out_of_rangeC1EPKc_nid_postfix(other, "unrelated virtual message");
+
     }
-    const Object originalOther = *other;
+    const LibcException::ExceptionObject originalOther = *other;
     watchedObject = actual;
     watchedMessage = plain ? nullptr : reinterpret_cast<Message*>(const_cast<char*>(actual->message)) - 1;
     foreignObject = other;
@@ -168,20 +161,21 @@ static int TestVtable(const char* mode) {
     if (!plain) {
         if (!deleting) _ZNSt12out_of_rangeD1Ev_nid_postfix(actual);
         _ZNSt12out_of_rangeD1Ev_nid_postfix(other);
+
     }
     if (!deleting) std::free(actual);
     std::free(other);
     return 0;
 }
 
-static Message* MessageHeader(const Object& object) {
+static Message* MessageHeader(const LibcException::ExceptionObject& object) {
     return reinterpret_cast<Message*>(const_cast<char*>(object.message)) - 1;
 }
 
 extern "C" void APS5_VABI ObserveDestroy(void* pointer) {
     if (pointer != expectedObject || ++callbacks != 1) FixtureFail(40);
     ProbeDestroy(registeredDestructor, pointer, poison);
-    if (static_cast<Object*>(pointer)->message != nullptr ||
+    if (static_cast<LibcException::ExceptionObject*>(pointer)->message != nullptr ||
         !decoy.message || std::strcmp(decoy.message, "unrelated message") ||
         (keepMessage && MessageHeader(retained)->references.load() != 0)) FixtureFail(41);
 }
@@ -191,12 +185,13 @@ extern "C" void APS5_VABI FixtureInspect(void* pointer) {
     if (header->_pad != 0 || !header->destructor) FixtureFail(42);
     expectedObject = pointer;
     GuestWhat what;
-    std::memcpy(&what, static_cast<const unsigned char*>(static_cast<Object*>(pointer)->vtable) +
+    std::memcpy(&what, static_cast<const unsigned char*>(static_cast<LibcException::ExceptionObject*>(pointer)->vtable) +
         2 * sizeof(void*), sizeof(what));
     const char* message = ProbeWhat(what, pointer, poison);
     if (!message || std::strcmp(message, expectedMessage)) FixtureFail(62);
     if (keepMessage) {
-        _ZNSt12out_of_rangeC1ERKS__nid_postfix(&retained, static_cast<Object*>(pointer));
+        _ZNSt12out_of_rangeC1ERKS__nid_postfix(&retained, static_cast<LibcException::ExceptionObject*>(pointer));
+
         if (MessageHeader(retained)->references.load() != 1) FixtureFail(43);
     }
     registeredDestructor = reinterpret_cast<GuestDestroy>(header->destructor);
@@ -255,7 +250,7 @@ int main(int argc, char** argv) {
     regularRelease = std::strcmp(argv[1], "release") == 0;
     keepMessage = std::strstr(argv[1], "unshared") == nullptr;
     FixtureArgument = reinterpret_cast<std::uintptr_t>(FixtureMessage);
-    Object raised{};
+    LibcException::ExceptionObject raised{};
     if (regex) {
         expectedMessage = "regular expression error";
         FixtureStdOutType = _ZTISt11regex_error_nid_postfix;
@@ -267,12 +262,14 @@ int main(int argc, char** argv) {
         FixtureThrow = reinterpret_cast<GuestThrowFunction>(_ZSt15_Xruntime_errorPKc_nid_postfix);
     } else if (doraise) {
         _ZNSt11logic_errorC1EPKc_nid_postfix(&raised, FixtureMessage);
+
         expectedMessage = FixtureMessage;
         FixtureStdOutType = _ZTISt11logic_error_nid_postfix;
         FixtureThrow = reinterpret_cast<GuestThrowFunction>(_ZNKSt11logic_error8_DoraiseEv_nid_postfix);
         FixtureArgument = reinterpret_cast<std::uintptr_t>(&raised);
     }
     _ZNSt12out_of_rangeC1EPKc_nid_postfix(&decoy, "unrelated message");
+
     poison = std::strstr(argv[1], "zero") ? nullptr : &decoy;
     GuestStdCapture();
     const char* expected = regex ? "regular expression error" : FixtureMessage;
@@ -282,6 +279,7 @@ int main(int argc, char** argv) {
         !decoy.message || std::strcmp(decoy.message, "unrelated message")) return 44;
     _ZNSt12out_of_rangeD1Ev_nid_postfix(&retained);
     _ZNSt12out_of_rangeD1Ev_nid_postfix(&decoy);
+
     if (doraise) _ZNSt11logic_errorD1Ev_nid_postfix(&raised);
     if (retained.message || decoy.message || (doraise && raised.message)) return 45;
     std::puts("guest message callback, retained ownership and release: PASS");
diff --git a/core/libs/tests/GuestMktime.cpp b/core/libs/tests/GuestMktime.cpp
index 97d72aeaa9..f3e74a4a6b 100644
--- a/core/libs/tests/GuestMktime.cpp
+++ b/core/libs/tests/GuestMktime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,14 +10,6 @@
 #include <cstring>
 #include <limits>
 
-extern "C" {
-std::int64_t APS5_VABI libc_mktime_nid_postfix(GuestTm*);
-std::int64_t APS5_VABI mktime_nid_postfix(GuestTm*);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-void APS5_VABI tzset_nid_postfix();
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-}
-
 using Converter = std::int64_t (APS5_VABI *)(GuestTm*);
 
 static void Require(bool value, const char* message) {
@@ -67,6 +61,7 @@ static void CheckFailure(Converter convert) {
 static void CheckZone(const char* zone) {
     Require(setenv_nid_postfix("TZ", zone, 1) == 0, "Could not set the time zone");
     tzset_nid_postfix();
+
     constexpr std::array<Converter, 2> converters{libc_mktime_nid_postfix, mktime_nid_postfix};
     constexpr std::array<std::int64_t, 8> timers{-86401, -2, -1, 0, 1, 59, 60, 86400};
     for (auto convert : converters) {
diff --git a/core/libs/tests/GuestMlock.cpp b/core/libs/tests/GuestMlock.cpp
index 79b571e9b2..71883b2b4c 100644
--- a/core/libs/tests/GuestMlock.cpp
+++ b/core/libs/tests/GuestMlock.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -15,17 +17,6 @@
 #include <string>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI mlock_nid_postfix(const void*, std::size_t);
-int APS5_VABI munlock_nid_postfix(const void*, std::size_t);
-int APS5_VABI mlockall_nid_postfix(int);
-int APS5_VABI munlockall_nid_postfix();
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void RequireLockAllInvalid(int flags) {
@@ -37,6 +28,7 @@ static void RequireLockAllUnsupported(int flags) {
     bool rejected = false;
     try {
         mlockall_nid_postfix(flags);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -140,9 +132,9 @@ int main() {
     *__error_nid_postfix() = untouched;
     Require(munlock_nid_postfix(reserved, page) == 0);
     Require(*__error_nid_postfix() == untouched);
-    Require(sceKernelMunmap(reserved, page) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(reserved), page) == 0);
 
-    Require(sceKernelMunmap(mapped, length) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapped), length) == 0);
 #ifndef ANYPS5_ENABLE_ASAN
     *__error_nid_postfix() = 0;
     Require(mlock_nid_postfix(mapped, page) == -1 && *__error_nid_postfix() == 12);
diff --git a/core/libs/tests/GuestModuleInfo.cpp b/core/libs/tests/GuestModuleInfo.cpp
index d596bf0280..85dd43c3fb 100644
--- a/core/libs/tests/GuestModuleInfo.cpp
+++ b/core/libs/tests/GuestModuleInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
@@ -11,18 +12,7 @@
 #include <source_location>
 #include <string>
 #include <vector>
-extern "C" {
-void* APS5_VABI dlopen_nid_postfix(const char*, int);
-void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-int APS5_VABI dlclose_nid_postfix(void*);
-int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t, int, ModuleInfoEx*);
-int APS5_VABI sceKernelGetModuleList(KernelModule*, std::size_t, std::size_t*);
-int APS5_VABI sceKernelGetModuleInfo(KernelModule, ModuleInfo*);
-int APS5_VABI sceKernelGetModuleList2(KernelModule*, std::size_t, std::size_t*);
-int APS5_VABI sceKernelGetModuleInfo2(KernelModule, ModuleInfo*);
-std::int32_t APS5_VABI sceKernelGetLibkernelTextLocation_nid_postfix(void**, std::size_t*);
-std::int32_t APS5_VABI sceKernelInternalMemoryGetModuleSegmentInfo_nid_postfix(InternalSegmentInfo*);
-}
+
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (!value) {
         std::fprintf(stderr, "module info check failed at line %u\n", location.line());
@@ -41,7 +31,7 @@ static bool ThrowsInvalidArgument(TFunction function) {
 static ModuleInfoEx Query(const void* address, int expected) {
     ModuleInfoEx info{};
     info.st_size = sizeof(ModuleInfoEx);
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 2, &info) == expected);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(address), 1, &info) == expected);
     return info;
 }
 int main(int argc, char** argv) {
@@ -51,7 +41,7 @@ int main(int argc, char** argv) {
     const void* add = dlsym_nid_postfix(module, "GuestModuleAdd");
     Require(add != nullptr);
     const auto info = Query(add, 0);
-    Require(info.st_size == sizeof(ModuleInfoEx));
+    Require(info.st_size == 0);
     Require(info.id == static_cast<KernelModule>(reinterpret_cast<std::intptr_t>(module)));
     Require(std::string(info.name) == std::string(argv[1]).substr(std::string(argv[1]).find_last_of("/\\") + 1));
     Require(info.segment_count > 0 && info.segment_count <= 4 && info.ref_count == 1);
@@ -169,10 +159,34 @@ int main(int argc, char** argv) {
     Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 2, nullptr) == SCE_KERNEL_ERROR_EFAULT);
     ModuleInfoEx invalid{};
     invalid.st_size = sizeof(ModuleInfoEx);
-    Require(ThrowsInvalidArgument([&] { sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 1, &invalid); }));
+    for (const int flags : {-1, 0, 3, 4, 8}) {
+        std::memset(&invalid, 0xbb, sizeof(invalid));
+        Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), flags, &invalid) == SCE_KERNEL_ERROR_EINVAL);
+        Require(std::all_of(reinterpret_cast<const unsigned char*>(&invalid), reinterpret_cast<const unsigned char*>(&invalid + 1), [](unsigned char value) { return value == 0; }));
+    }
+    Require(ThrowsInvalidArgument([&] { sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 0, nullptr); }));
+    std::vector<KernelModule> everyModule(64);
+    std::vector<KernelModule> titleOnlyModules(64);
+    std::size_t everyCount = 0;
+    std::size_t titleOnlyCount = 0;
+    Require(sceKernelGetModuleList(everyModule.data(), everyModule.size(), &everyCount) == 0);
+    Require(sceKernelGetModuleList2(titleOnlyModules.data(), titleOnlyModules.size(), &titleOnlyCount) == 0);
+    const auto systemModule = std::find_if(everyModule.begin(), everyModule.begin() + static_cast<std::ptrdiff_t>(everyCount),
+        [&](KernelModule handle) { return std::find(titleOnlyModules.begin(), titleOnlyModules.begin() + static_cast<std::ptrdiff_t>(titleOnlyCount), handle) == titleOnlyModules.begin() + static_cast<std::ptrdiff_t>(titleOnlyCount); });
+    Require(systemModule != everyModule.begin() + static_cast<std::ptrdiff_t>(everyCount));
+    ModuleInfo systemInfo{};
+    systemInfo.st_size = sizeof(ModuleInfo);
+    Require(sceKernelGetModuleInfo(*systemModule, &systemInfo) == 0 && systemInfo.segment_count > 0);
+    const auto systemAddress = static_cast<std::uintptr_t>(systemInfo.segments[0].address);
+    ModuleInfoEx anyModule{};
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(&Query), 2, &anyModule) == 0 && anyModule.segment_count > 0 && anyModule.st_size == 0);
+    Require(sceKernelGetModuleInfoFromAddr(systemAddress, 1, &anyModule) == 0 && anyModule.id == *systemModule);
+    std::memset(&anyModule, 0xbb, sizeof(anyModule));
+    Require(sceKernelGetModuleInfoFromAddr(systemAddress, 2, &anyModule) == SCE_KERNEL_ERROR_ESRCH && anyModule.segment_count == 0 && anyModule.name[0] == 0);
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 1, &anyModule) == 0 && anyModule.id == info.id);
     ModuleInfoEx unset{};
     unset.st_size = 0xf0000;
-    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 2, &unset) == 0 && unset.st_size == sizeof(ModuleInfoEx));
+    Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast<std::uintptr_t>(add), 1, &unset) == 0 && unset.st_size == 0);
     const auto again = Query(add, 0);
     Require(again.eh_frame_hdr_addr == info.eh_frame_hdr_addr && again.eh_frame_hdr_size == info.eh_frame_hdr_size);
     Require(again.eh_frame_addr == info.eh_frame_addr && again.eh_frame_size == info.eh_frame_size);
diff --git a/core/libs/tests/GuestMove.cpp b/core/libs/tests/GuestMove.cpp
index bbb55c541d..98d1e59b72 100644
--- a/core/libs/tests/GuestMove.cpp
+++ b/core/libs/tests/GuestMove.cpp
@@ -1,23 +1,10 @@
+#include "prx/libSceMove/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceMoveInit(void);
-int APS5_VABI sceMoveTerm(void);
-int APS5_VABI sceMoveOpen(std::int32_t userId, std::int32_t type, std::int32_t index);
-int APS5_VABI sceMoveClose(std::int32_t handle);
-int APS5_VABI sceMoveGetDeviceInfo(std::int32_t handle, void* info);
-int APS5_VABI sceMoveGetExtensionPortInfo(std::int32_t handle, void* data);
-int APS5_VABI sceMoveReadStateLatest(std::int32_t handle, void* data);
-int APS5_VABI sceMoveReadStateRecent(std::int32_t handle, std::int64_t timestamp, void* data, std::int32_t* outCount);
-int APS5_VABI sceMoveSetVibration(std::int32_t handle, std::uint8_t motor);
-int APS5_VABI sceMoveSetLightSphere(std::int32_t handle, std::uint8_t red, std::uint8_t green, std::uint8_t blue);
-int APS5_VABI sceMoveResetLightSphere(std::int32_t handle);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -102,6 +89,8 @@ int main() {
     Require(sceMoveInit() == kOk);
     Require(sceMoveInit() == kAlreadyInit);
 
+    RequireUnknownHandle(0);
+    RequireUnknownHandle(-1);
     RequireUnknownHandle(kFirstHandle);
 
     const std::int32_t first = sceMoveOpen(kUserId, 0, 0);
diff --git a/core/libs/tests/GuestMprotectUnmapped.cpp b/core/libs/tests/GuestMprotectUnmapped.cpp
index 8a4ed05199..326051d6ab 100644
--- a/core/libs/tests/GuestMprotectUnmapped.cpp
+++ b/core/libs/tests/GuestMprotectUnmapped.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "SceTypes.hpp"
@@ -6,16 +8,6 @@
 #include <cstdlib>
 #include <exception>
 
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMtypeprotect(const void*, std::size_t, int, int);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr std::size_t Page = 0x4000;
diff --git a/core/libs/tests/GuestMsgDialogNative.cpp b/core/libs/tests/GuestMsgDialogNative.cpp
index 8842c84299..21383b3c87 100644
--- a/core/libs/tests/GuestMsgDialogNative.cpp
+++ b/core/libs/tests/GuestMsgDialogNative.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceMsgDialog.native/libSceMsgDialog.native.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -5,16 +6,7 @@
 
 extern "C" {
 extern int SceMsgDialogNativeModuleLoaded_nid_no_patch;
-int APS5_VABI sceMsgDialogInitialize(void);
-int APS5_VABI sceMsgDialogOpen(const void* param);
-int APS5_VABI sceMsgDialogGetStatus(void);
-int APS5_VABI sceMsgDialogUpdateStatus(void);
-int APS5_VABI sceMsgDialogGetResult(MsgDialogResult* result);
-int APS5_VABI sceMsgDialogClose(void);
-int APS5_VABI sceMsgDialogTerminate(void);
-int APS5_VABI sceMsgDialogProgressBarInc(int target, std::uint32_t delta);
-int APS5_VABI sceMsgDialogProgressBarSetMsg(int target, const char* msg);
-int APS5_VABI sceMsgDialogProgressBarSetValue(int target, std::uint32_t rate);
+
 }
 
 namespace {
diff --git a/core/libs/tests/GuestMsync.cpp b/core/libs/tests/GuestMsync.cpp
index 451dd44583..e5dc64d5ce 100644
--- a/core/libs/tests/GuestMsync.cpp
+++ b/core/libs/tests/GuestMsync.cpp
@@ -1,18 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <limits>
 #include <source_location>
-#include <stdexcept>
-
-extern "C" {
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI msync_nid_postfix(void*, std::size_t, int);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
 
 namespace {
 constexpr std::size_t Page = 0x4000;
@@ -23,6 +16,7 @@ constexpr int Async = 0x1;
 constexpr int Invalidate = 0x2;
 constexpr int Invalid = 22;
 constexpr int NoMemory = 12;
+constexpr int Busy = 16;
 
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (condition) return;
@@ -40,15 +34,6 @@ bool Fails(void* address, std::size_t length, int flags, int error) {
     return msync_nid_postfix(address, length, flags) == -1 && *__error_nid_postfix() == error;
 }
 
-bool Throws(void* address, std::size_t length, int flags) {
-    try {
-        msync_nid_postfix(address, length, flags);
-    } catch (const std::runtime_error&) {
-        return true;
-    }
-    return false;
-}
-
 char* Map(std::size_t pages) {
     void* mapped = mmap_nid_postfix(nullptr, pages * Page, ReadWrite, PrivateAnonymous, -1, 0);
     Require(mapped != reinterpret_cast<void*>(static_cast<std::uintptr_t>(-1)));
@@ -69,7 +54,11 @@ int main() {
     Require(Fails(mapped, Page, Async | Invalidate, Invalid));
     const auto top = std::numeric_limits<std::uintptr_t>::max() & ~(Page - 1);
     Require(Fails(reinterpret_cast<void*>(top), 2 * Page, Sync, Invalid));
-    Require(Throws(mapped, Page, Invalidate));
+    Require(Fails(mapped, Page, Invalidate, Busy));
+    Require(Fails(mapped, 3 * Page, Sync | Invalidate, Busy));
+    Require(Fails(mapped + 1, 16, Invalidate, Busy));
+    Require(Fails(mapped, 0, Invalidate, Busy));
+    Require(Succeeds(mapped, Page, 0x8));
 
     Require(munmap_nid_postfix(mapped, 3 * Page) == 0);
     Require(Fails(mapped, Page, Sync, NoMemory));
diff --git a/core/libs/tests/GuestMultibyteLocale.cpp b/core/libs/tests/GuestMultibyteLocale.cpp
new file mode 100644
index 0000000000..682521486d
--- /dev/null
+++ b/core/libs/tests/GuestMultibyteLocale.cpp
@@ -0,0 +1,123 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+constexpr auto Invalid = static_cast<std::size_t>(-1);
+constexpr auto Incomplete = static_cast<std::size_t>(-2);
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "failed: %s\n", what);
+    std::abort();
+}
+
+static std::size_t Decode(const char* text, std::size_t count, std::uint16_t& value) {
+    unsigned char state[16]{};
+    value = 0xcccc;
+    *__error_nid_postfix() = 0;
+    return mbrtowc_nid_postfix(&value, text, count, state);
+}
+
+static void CheckDecoding() {
+    std::uint16_t value = 0;
+    Require(_Getmbcurmax_nid_postfix() == 3, "three bytes per character at most");
+    Require(Decode("A", 1, value) == 1 && value == 'A', "ASCII");
+    Require(Decode("\xc3\xa9", 2, value) == 2 && value == 0xe9, "two bytes");
+    Require(Decode("\xe2\x82\xac", 3, value) == 3 && value == 0x20ac, "three bytes");
+    Require(Decode("\xed\xa0\x80", 3, value) == 3 && value == 0xd800, "an encoded surrogate decodes");
+    Require(Decode("\xef\xbf\xbf", 3, value) == 3 && value == 0xffff, "U+FFFF decodes");
+    Require(Decode("\xc1\xbf", 2, value) == 2 && value == 0x7f, "an overlong form decodes");
+    Require(Decode("\xc0\x80", 2, value) == 0 && value == 0, "an overlong NUL ends the string");
+    Require(Decode("\xf0\x9f\x98\x80", 4, value) == Invalid && *__error_nid_postfix() == 86, "four-byte forms are rejected");
+    Require(Decode("\x80", 1, value) == Invalid && *__error_nid_postfix() == 86, "a lone continuation byte");
+    Require(Decode("\xe9", 1, value) == Incomplete, "a Latin-1 byte starts a three-byte form");
+    Require(Decode("\xe9" "A", 2, value) == Invalid, "the Latin-1 byte is not followed by a continuation");
+    Require(Decode("\xc3", 0, value) == Incomplete, "no bytes");
+}
+
+static void CheckState() {
+    unsigned char state[16]{};
+    std::uint16_t value = 0;
+    Require(mbrtowc_nid_postfix(&value, "\xe2", 1, state) == Incomplete && !mbsinit_nid_postfix(state), "a partial character is pending");
+    Require(mbrtowc_nid_postfix(&value, "\x82", 1, state) == Incomplete, "still pending");
+    Require(mbrtowc_nid_postfix(&value, "\xac", 1, state) == 1 && value == 0x20ac && mbsinit_nid_postfix(state), "the last byte completes it");
+    Require(mbrtowc_nid_postfix(&value, "\xc3", 1, state) == Incomplete, "pending again");
+    Require(mbrtowc_nid_postfix(&value, "A", 1, state) == Invalid && !mbsinit_nid_postfix(state), "an error leaves the state pending");
+    unsigned char pending[16];
+    std::memcpy(pending, state, sizeof(pending));
+    value = 0x7777;
+    Require(mbrtowc_nid_postfix(&value, nullptr, 0, state) == Incomplete && std::memcmp(state, pending, sizeof(pending)) == 0,
+        "a null string with no bytes to read is incomplete and leaves a pending state");
+    *__error_nid_postfix() = 0;
+    Require(mbrtowc_nid_postfix(&value, nullptr, 1, state) == Invalid && *__error_nid_postfix() == 86 && value == 0x7777
+            && std::memcmp(state, pending, sizeof(pending)) == 0,
+        "a null string in a pending state is an error and keeps the state");
+    Require(mbrlen_nid_postfix(nullptr, 0, state) == 0 && mbsinit_nid_postfix(state), "mbrlen with a null string resets the state");
+    unsigned char initial[16]{};
+    Require(mbrtowc_nid_postfix(&value, nullptr, 0, state) == Incomplete && std::memcmp(state, initial, sizeof(initial)) == 0,
+        "a null string with no bytes to read is incomplete in the initial state");
+    Require(mbrtowc_nid_postfix(&value, nullptr, 1, state) == 0 && value == 0x7777 && std::memcmp(state, initial, sizeof(initial)) == 0,
+        "a null string in the initial state converts nothing");
+    Require(mbsinit_nid_postfix(nullptr) == 1, "a null state is initial");
+
+    mbtowc_nid_postfix(nullptr, nullptr, 0);
+    Require(mbtowc_nid_postfix(&value, "\xc3", 1) == -1, "mbtowc reports a partial character as -1");
+    Require(mbtowc_nid_postfix(&value, "\xa9", 1) == 1 && value == 0xe9, "mbtowc keeps the partial character");
+    Require(mbtowc_nid_postfix(&value, "\xe2\x82\xac", 8) == 3 && value == 0x20ac, "mbtowc limits the count to three bytes");
+    mbtowc_nid_postfix(&value, "\xc3", 1);
+
+    Require(mbtowc_nid_postfix(nullptr, nullptr, 0) == 0 && mbtowc_nid_postfix(&value, "A", 1) == 1, "a null string resets mbtowc");
+    Require(mblen_nid_postfix("\xc3", 1) == -1 && mblen_nid_postfix("\xa9", 1) == -1, "mblen keeps no state");
+    Require(mblen_nid_postfix("\xe2\x82\xac", 3) == 3 && mblen_nid_postfix(nullptr, 0) == 0, "mblen");
+}
+
+static void CheckEncoding() {
+    char bytes[4] = {};
+    Require(wcrtomb_nid_postfix(bytes, 0x7f, nullptr) == 1 && bytes[0] == 0x7f, "one byte");
+    Require(wcrtomb_nid_postfix(bytes, 0xe9, nullptr) == 2 && std::memcmp(bytes, "\xc3\xa9", 2) == 0, "two bytes");
+    Require(wcrtomb_nid_postfix(bytes, 0xdc00, nullptr) == 3 && std::memcmp(bytes, "\xed\xb0\x80", 3) == 0, "a surrogate is encoded alone");
+    Require(wcrtomb_nid_postfix(nullptr, 0x20ac, nullptr) == 1, "a null buffer");
+    Require(wctomb_nid_postfix(bytes, 0xffff) == 3 && std::memcmp(bytes, "\xef\xbf\xbf", 3) == 0 && wctomb_nid_postfix(nullptr, 1) == 0, "wctomb");
+}
+
+static void CheckStrings() {
+    const char text[] = "a\xc3\xa9\xe2\x82\xac" "b";
+    std::uint16_t wide[8];
+    std::memset(wide, 0xcc, sizeof(wide));
+    Require(mbstowcs_nid_postfix(wide, text, 8) == 4 && wide[1] == 0xe9 && wide[2] == 0x20ac && wide[4] == 0, "mbstowcs");
+    Require(mbstowcs_nid_postfix(nullptr, text, 0) == 4, "mbstowcs counts characters");
+    std::memset(wide, 0xcc, sizeof(wide));
+    Require(mbstowcs_nid_postfix(wide, "a\xff", 8) == Invalid && wide[0] == 'a' && wide[1] == 0xcccc, "mbstowcs stops at an invalid byte");
+
+    unsigned char state[16]{};
+    const char* cursor = text;
+    std::memset(wide, 0xcc, sizeof(wide));
+    Require(mbsrtowcs_nid_postfix(wide, &cursor, 2, state) == 2 && cursor == text + 3, "mbsrtowcs advances by whole characters");
+    cursor = text;
+    std::memset(wide, 0xcc, sizeof(wide));
+    Require(mbsrtowcs_nid_postfix(wide, &cursor, 0, state) == 0 && wide[0] == 0 && cursor == text, "mbsrtowcs clears the first element");
+    const char invalid[] = "ab\xff";
+    cursor = invalid;
+    *__error_nid_postfix() = 0;
+    Require(mbsrtowcs_nid_postfix(wide, &cursor, 8, state) == Invalid && cursor == invalid + 2 && *__error_nid_postfix() == 86, "mbsrtowcs points at the invalid byte");
+
+    const std::uint16_t source[] = {'a', 0xe9, 0x20ac, 0};
+    char narrow[8];
+    std::memset(narrow, 'x', sizeof(narrow));
+    Require(wcstombs_nid_postfix(narrow, source, 8) == 6 && std::memcmp(narrow, "a\xc3\xa9\xe2\x82\xac\0", 7) == 0, "wcstombs");
+    std::memset(narrow, 'x', sizeof(narrow));
+    Require(wcstombs_nid_postfix(narrow, source, 4) == 4 && std::memcmp(narrow, "a\xc3\xa9\xe2x", 5) == 0, "wcstombs fills the capacity mid-character");
+    Require(wcstombs_nid_postfix(nullptr, source, 0) == 6, "wcstombs counts bytes");
+}
+
+int main() {
+    CheckDecoding();
+    CheckState();
+    CheckEncoding();
+    CheckStrings();
+    return 0;
+}
diff --git a/core/libs/tests/GuestMutexContention.cpp b/core/libs/tests/GuestMutexContention.cpp
index dbb0da5e2f..648e403aa7 100644
--- a/core/libs/tests/GuestMutexContention.cpp
+++ b/core/libs/tests/GuestMutexContention.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -11,19 +13,6 @@
 #include <vector>
 #include <windows.h>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr*);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr*, int);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr*);
-int APS5_VABI scePthreadMutexInit(PthreadMutex*, const PthreadMutexattr*, const char*);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex*);
-int APS5_VABI scePthreadMutexLock(PthreadMutex*);
-int APS5_VABI scePthreadMutexTimedlock(PthreadMutex*, KernelUseconds);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex*);
-}
-
 namespace {
 
 using Clock = std::chrono::steady_clock;
diff --git a/core/libs/tests/GuestMutexRaiseException.cpp b/core/libs/tests/GuestMutexRaiseException.cpp
index ecdd471b4e..6bfa05b6ac 100644
--- a/core/libs/tests/GuestMutexRaiseException.cpp
+++ b/core/libs/tests/GuestMutexRaiseException.cpp
@@ -1,52 +1,42 @@
-#include "SceTypes.hpp"
-#include <atomic>
-#include <chrono>
-#include <cstdlib>
-#include <mutex>
-#include <thread>
-
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI scePthreadMutexInit(PthreadMutex*, const PthreadMutexattr*, const char*);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex*);
-int APS5_VABI scePthreadMutexLock(PthreadMutex*);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex*);
-int APS5_VABI sceKernelInstallExceptionHandler(int, void*);
-int APS5_VABI sceKernelRemoveExceptionHandler(int);
-int APS5_VABI sceKernelRaiseException(Pthread, int);
-}
-
-static constexpr int SigUsr1 = 30;
-static void Require(bool value) { if (!value) std::abort(); }
-static std::atomic<int> deliveries{0};
-static void APS5_VABI Handler(int, void*) { deliveries.fetch_add(1); }
-
-struct Context { PthreadMutex mutex = nullptr; std::atomic<bool> started{false}; std::atomic<bool> acquired{false}; };
-static void* APS5_VABI Worker(void* opaque) {
-    auto& context = *static_cast<Context*>(opaque);
-    context.started.store(true);
-    Require(scePthreadMutexLock(&context.mutex) == 0);
-    context.acquired.store(true);
-    Require(scePthreadMutexUnlock(&context.mutex) == 0);
-    return nullptr;
-}
-
-int main() {
-    Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
-    Context context;
-    Require(scePthreadMutexInit(&context.mutex, nullptr, nullptr) == 0);
-    Require(scePthreadMutexLock(&context.mutex) == 0);
-    Pthread worker = nullptr;
-    Require(scePthreadCreate(&worker, nullptr, Worker, &context, "mutex wait") == 0);
-    while (!context.started.load()) std::this_thread::yield();
-    std::this_thread::sleep_for(std::chrono::milliseconds(10));
-    Require(sceKernelRaiseException(worker, SigUsr1) == 0);
-    for (int i = 0; i < 5000 && deliveries.load() == 0; ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
-    Require(deliveries.load() == 1);
-    Require(scePthreadMutexUnlock(&context.mutex) == 0);
-    Require(scePthreadJoin(worker, nullptr) == 0);
-    Require(context.acquired.load());
-    Require(scePthreadMutexDestroy(&context.mutex) == 0);
-    Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);
-}
\ No newline at end of file
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdlib>
+#include <mutex>
+#include <thread>
+
+static constexpr int SigUsr1 = 30;
+static void Require(bool value) { if (!value) std::abort(); }
+static std::atomic<int> deliveries{0};
+static void APS5_VABI Handler(int, void*) { deliveries.fetch_add(1); }
+
+struct Context { PthreadMutex mutex = nullptr; std::atomic<bool> started{false}; std::atomic<bool> acquired{false}; };
+static void* APS5_VABI Worker(void* opaque) {
+    auto& context = *static_cast<Context*>(opaque);
+    context.started.store(true);
+    Require(scePthreadMutexLock(&context.mutex) == 0);
+    context.acquired.store(true);
+    Require(scePthreadMutexUnlock(&context.mutex) == 0);
+    return nullptr;
+}
+
+int main() {
+    Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
+    Context context;
+    Require(scePthreadMutexInit(&context.mutex, nullptr, nullptr) == 0);
+    Require(scePthreadMutexLock(&context.mutex) == 0);
+    Pthread worker = nullptr;
+    Require(scePthreadCreate(&worker, nullptr, Worker, &context, "mutex wait") == 0);
+    while (!context.started.load()) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    Require(sceKernelRaiseException(worker, SigUsr1) == 0);
+    for (int i = 0; i < 5000 && deliveries.load() == 0; ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    Require(deliveries.load() == 1);
+    Require(scePthreadMutexUnlock(&context.mutex) == 0);
+    Require(scePthreadJoin(worker, nullptr) == 0);
+    Require(context.acquired.load());
+    Require(scePthreadMutexDestroy(&context.mutex) == 0);
+    Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);
+}
diff --git a/core/libs/tests/GuestNamedShmConcurrency.cpp b/core/libs/tests/GuestNamedShmConcurrency.cpp
index 60d91794a2..da44c93dba 100644
--- a/core/libs/tests/GuestNamedShmConcurrency.cpp
+++ b/core/libs/tests/GuestNamedShmConcurrency.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -14,16 +16,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI fchmod_nid_postfix(int, int);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 using Unlink = int (*)(const char*);
 constexpr std::int64_t Page = 0x4000;
@@ -143,9 +135,13 @@ void Run() {
 
     if (fchmod_nid_postfix(descriptor, 0400) != 0)
         throw std::runtime_error("changing shared-object permissions to read-only failed");
-    *__error_nid_postfix() = 0;
-    if (unlinkObject(object.name.c_str()) != -1 || *__error_nid_postfix() != 13)
-        throw std::runtime_error("unlink of a read-only shared object did not return EACCES");
+    if (::geteuid() != 0) {
+        *__error_nid_postfix() = 0;
+        if (unlinkObject(object.name.c_str()) != -1 || *__error_nid_postfix() != 13)
+            throw std::runtime_error("unlink of a read-only shared object did not return EACCES");
+    } else {
+        std::fprintf(stderr, "running as root, which ignores file permissions: the read-only unlink case not tested\n");
+    }
     if (fchmod_nid_postfix(descriptor, 0600) != 0)
         throw std::runtime_error("restoring shared-object permissions failed");
     if (unlinkObject(object.name.c_str()) != 0)
diff --git a/core/libs/tests/GuestNamedShmDescriptorReuse.cpp b/core/libs/tests/GuestNamedShmDescriptorReuse.cpp
index e2b7263e23..6af68772cb 100644
--- a/core/libs/tests/GuestNamedShmDescriptorReuse.cpp
+++ b/core/libs/tests/GuestNamedShmDescriptorReuse.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -15,17 +17,6 @@
 #include <unistd.h>
 #include <vector>
 
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 constexpr int ReadWrite = 2;
 constexpr int Create = 0x200;
diff --git a/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp b/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp
index 368fb3cc60..088119df94 100644
--- a/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp
+++ b/core/libs/tests/GuestNamedShmIoDescriptorReuse.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -14,19 +16,6 @@
 #include <sys/syscall.h>
 #include <unistd.h>
 
-struct GuestIovec { void* base; std::size_t length; };
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
 namespace {
 int original = -1;
 int replacement = -1;
@@ -76,7 +65,7 @@ void Run(int operation, int boundary) {
     swapped = false;
     armed = true;
     char payload[] = "bad!";
-    GuestIovec vector{payload, 4};
+    KernelIovec vector{payload, 4};
     std::int64_t result = 0;
     switch (operation) {
     case 0: result = write_nid_postfix(original, payload, 4); break;
@@ -115,6 +104,9 @@ extern "C" ssize_t readlink(const char* path, char* buffer, std::size_t length)
     }
     return result;
 }
+extern "C" ssize_t __readlink_chk(const char* path, char* buffer, std::size_t length, std::size_t) {
+    return readlink(path, buffer, length);
+}
 extern "C" int flock(int descriptor, int operation) {
     const int result = static_cast<int>(::syscall(SYS_flock, descriptor, operation));
     if (result == 0 && operation == LOCK_EX && armed && !replaceAtProbe && !replaceBeforeProbe && !swapped) {
diff --git a/core/libs/tests/GuestNamedShmLifecycle.cpp b/core/libs/tests/GuestNamedShmLifecycle.cpp
index a5c26b8bee..4c14b9cc3c 100644
--- a/core/libs/tests/GuestNamedShmLifecycle.cpp
+++ b/core/libs/tests/GuestNamedShmLifecycle.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "nid/Sha1.hpp"
 #include "prx/libc/include/GuestWriteWatch.hpp"
@@ -15,31 +17,6 @@
 #include <sys/mman.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI dup2_nid_postfix(int, int);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-std::int64_t APS5_VABI writev_nid_postfix(int, const struct GuestIovec*, int);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const struct GuestIovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
-struct GuestIovec {
-    void* base;
-    std::size_t length;
-};
-
 namespace {
 constexpr int ReadOnly = 0;
 constexpr int ReadWrite = 2;
@@ -115,7 +92,7 @@ void Run() {
     Require(write_nid_postfix(descriptor, "xy", 2) == 1, "cross-EOF write did not return its short length");
     Require(lseek_nid_postfix(descriptor, 0, SEEK_END) == static_cast<std::int64_t>(Page), "cross-EOF write changed object size");
     char vectorBytes[] = "uv";
-    GuestIovec vectorWrite{vectorBytes, 2};
+    KernelIovec vectorWrite{vectorBytes, 2};
     Require(pwritev_nid_postfix(descriptor, nullptr, 0, Page) == 0, "zero-vector positioned write on a writable descriptor failed");
     Require(pwritev_nid_postfix(descriptor, &vectorWrite, 1, Page) == 0, "positioned vector write at EOF grew the object");
     Require(pwritev_nid_postfix(descriptor, &vectorWrite, 1, Page - 1) == 1, "positioned vector write past EOF was not short");
diff --git a/core/libs/tests/GuestNamedShmOpen.cpp b/core/libs/tests/GuestNamedShmOpen.cpp
index dc6cebf447..82abbb8a07 100644
--- a/core/libs/tests/GuestNamedShmOpen.cpp
+++ b/core/libs/tests/GuestNamedShmOpen.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "nid/Sha1.hpp"
 #include <cstdio>
@@ -10,9 +12,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Require(bool value, const char* message) {
     if (!value) {
         throw std::runtime_error(std::string(message) + " (guest errno=" + std::to_string(*__error_nid_postfix()) + ")");
diff --git a/core/libs/tests/GuestNamedShmPermissions.cpp b/core/libs/tests/GuestNamedShmPermissions.cpp
index c6f8d4c1bf..332d7f6441 100644
--- a/core/libs/tests/GuestNamedShmPermissions.cpp
+++ b/core/libs/tests/GuestNamedShmPermissions.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "nid/Sha1.hpp"
 #include <cstdint>
@@ -9,9 +11,6 @@
 #include <unistd.h>
 #include <vector>
 
-extern "C" int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-extern "C" std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t);
-
 static void Require(bool condition, const char* message) {
     if (!condition) throw std::runtime_error(message);
 }
diff --git a/core/libs/tests/GuestNamedShmWindows.cpp b/core/libs/tests/GuestNamedShmWindows.cpp
new file mode 100644
index 0000000000..401ac8df2e
--- /dev/null
+++ b/core/libs/tests/GuestNamedShmWindows.cpp
@@ -0,0 +1,614 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/SharedMemory.hpp"
+#include "nid/Sha1.hpp"
+#include <windows.h>
+#include <aclapi.h>
+#include <io.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <cwchar>
+#include <filesystem>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <system_error>
+#include <thread>
+#include <utility>
+#include <vector>
+#include <barrier>
+#include <algorithm>
+
+
+namespace {
+constexpr int ReadOnly = 0;
+constexpr int ReadWrite = 2;
+constexpr int Create = 0x200;
+constexpr int Exclusive = 0x800;
+constexpr std::int64_t RaceSize = 4096;
+
+void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(std::string(message) + " (guest errno=" + std::to_string(*__error_nid_postfix()) + ")");
+}
+
+void RequireError(int descriptor, int expected, const char* message) {
+    Require(descriptor == -1 && *__error_nid_postfix() == expected, message);
+}
+
+void RequireNoAdministratorsAccess(HANDLE handle) {
+    PACL dacl = nullptr;
+    PSECURITY_DESCRIPTOR descriptor = nullptr;
+    const DWORD result = ::GetSecurityInfo(handle, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION,
+        nullptr, nullptr, &dacl, nullptr, &descriptor);
+    if (result != ERROR_SUCCESS || dacl == nullptr) {
+        if (descriptor != nullptr) ::LocalFree(descriptor);
+        Require(false, "reading named shared-memory object permissions failed");
+    }
+    SID_IDENTIFIER_AUTHORITY authority = SECURITY_NT_AUTHORITY;
+    PSID administrators = nullptr;
+    if (::AllocateAndInitializeSid(&authority, 2, SECURITY_BUILTIN_DOMAIN_RID,
+        DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &administrators) == FALSE) {
+        ::LocalFree(descriptor);
+        Require(false, "building the Administrators SID failed");
+    }
+    ACL_SIZE_INFORMATION information{};
+    const BOOL gotInformation = ::GetAclInformation(dacl, &information, sizeof(information), AclSizeInformation);
+    bool grantsAdministrators = false;
+    if (gotInformation) {
+        for (DWORD index = 0; index < information.AceCount; ++index) {
+            void* rawAce = nullptr;
+            if (!::GetAce(dacl, index, &rawAce)) continue;
+            const auto* header = static_cast<const ACE_HEADER*>(rawAce);
+            if (header->AceType != ACCESS_ALLOWED_ACE_TYPE) continue;
+            const auto* ace = static_cast<const ACCESS_ALLOWED_ACE*>(rawAce);
+            if (::EqualSid(const_cast<DWORD*>(&ace->SidStart), administrators) != FALSE) {
+                grantsAdministrators = true;
+                break;
+            }
+        }
+    }
+    ::FreeSid(administrators);
+    ::LocalFree(descriptor);
+    Require(gotInformation && !grantsAdministrators,
+        "named shared-memory object grants access to the Administrators group");
+}
+
+void RequireNoUnlinkedFiles(const std::string& name) {
+    const auto digest = Nid::Sha1(std::vector<std::uint8_t>(name.begin(), name.end()));
+    std::string prefix;
+    for (const auto byte : digest) {
+        prefix += "0123456789abcdef"[byte >> 4];
+        prefix += "0123456789abcdef"[byte & 15];
+    }
+    const auto directory = std::filesystem::temp_directory_path() / L"AnyPS5" / L"shm";
+    if (!std::filesystem::exists(directory)) return;
+    for (const auto& entry : std::filesystem::directory_iterator(directory)) {
+        const auto filename = entry.path().filename().string();
+        Require(!filename.starts_with(prefix + "-unlinked-"),
+                "closing the last descriptor did not reap its unlinked host object");
+    }
+}
+
+void VerifyUntrackedDescriptor(int descriptor) {
+    Require(File::IsSharedMemoryDescriptor_nid_no_patch(descriptor), "named descriptor was not tracked");
+    std::vector<wchar_t> path(32768);
+    const DWORD length = ::GetFinalPathNameByHandleW(reinterpret_cast<HANDLE>(::_get_osfhandle(descriptor)),
+        path.data(), static_cast<DWORD>(path.size()), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
+    Require(length > 0 && length < path.size(), "locating the tracked file failed");
+    const HANDLE handle = ::CreateFileW(path.data(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
+    Require(handle != INVALID_HANDLE_VALUE, "opening an untracked handle to the named file failed");
+    const int untracked = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), _O_RDONLY | _O_BINARY);
+    if (untracked < 0) ::CloseHandle(handle);
+    Require(untracked >= 0, "creating an untracked descriptor failed");
+    const bool classified = File::IsSharedMemoryDescriptor_nid_no_patch(untracked);
+    Require(::_close(untracked) == 0, "closing the untracked descriptor failed");
+    Require(!classified, "an untracked descriptor entered the named shared-memory path");
+    Require(!File::IsSharedMemoryDescriptor_nid_no_patch(untracked), "a closed untracked descriptor was classified as shared memory");
+}
+
+void VerifyConcurrentDescriptorReuse(const std::string& name) {
+    std::barrier start(3);
+    std::vector<int> okay(2, 1);
+    std::vector<std::thread> workers;
+    for (int index = 0; index < 2; ++index) {
+        workers.emplace_back([&, index] {
+            start.arrive_and_wait();
+            for (int iteration = 0; iteration < 64; ++iteration) {
+                const int descriptor = shm_open_nid_postfix(name.c_str(), ReadWrite, 0);
+                if (descriptor < 0) { okay[index] = 0; break; }
+                if (!File::IsSharedMemoryDescriptor_nid_no_patch(descriptor) ||
+                    pwrite_nid_disambig1_nid_postfix(descriptor, "x", 1, 64) != 0) okay[index] = 0;
+                if (close_nid_postfix(descriptor) != 0) okay[index] = 0;
+            }
+        });
+    }
+    start.arrive_and_wait();
+    for (auto& worker : workers) worker.join();
+    Require(okay[0] && okay[1], "concurrent close/open lost named-descriptor tracking or bounded writes");
+}
+
+bool RunResizeWriteRace(const std::string& name) {
+    const int descriptor = shm_open_nid_postfix(name.c_str(), ReadWrite, 0);
+    if (descriptor < 0) return false;
+    bool okay = true;
+    for (int iteration = 0; iteration < 300; ++iteration) {
+        const auto size = (iteration & 1) ? 0 : RaceSize;
+        if (ftruncate_nid_postfix(descriptor, size) != 0) { okay = false; break; }
+        if (pwrite_nid_disambig1_nid_postfix(descriptor, "x", 1, RaceSize / 2) < 0) { okay = false; break; }
+        struct _stat64 status{};
+        if (::_fstat64(descriptor, &status) != 0 || (status.st_size != 0 && status.st_size != RaceSize)) {
+            okay = false;
+            break;
+        }
+    }
+    close_nid_postfix(descriptor);
+    return okay;
+}
+
+void VerifyCrossProcessResizeWrite(const std::string& name, int descriptor) {
+    wchar_t executable[32768]{};
+    const DWORD length = ::GetModuleFileNameW(nullptr, executable, static_cast<DWORD>(std::size(executable)));
+    Require(length > 0 && length < std::size(executable), "locating the Windows shared-memory test executable failed");
+    std::vector<PROCESS_INFORMATION> workers;
+    for (int index = 0; index < 2; ++index) {
+        std::wstring command = L"\"" + std::wstring(executable, length) + L"\" --race " + std::wstring(name.begin(), name.end());
+        STARTUPINFOW startup{};
+        startup.cb = sizeof(startup);
+        PROCESS_INFORMATION process{};
+        Require(::CreateProcessW(nullptr, command.data(), nullptr, nullptr, FALSE, CREATE_NO_WINDOW,
+                                 nullptr, nullptr, &startup, &process) != FALSE,
+                "starting a cross-process shared-memory race worker failed");
+        workers.push_back(process);
+    }
+    const bool localSucceeded = RunResizeWriteRace(name);
+    bool childrenSucceeded = true;
+    for (const auto& process : workers) {
+        childrenSucceeded = childrenSucceeded && ::WaitForSingleObject(process.hProcess, 10000) == WAIT_OBJECT_0;
+        DWORD exitCode = 1;
+        childrenSucceeded = childrenSucceeded && ::GetExitCodeProcess(process.hProcess, &exitCode) && exitCode == 0;
+        ::CloseHandle(process.hThread);
+        ::CloseHandle(process.hProcess);
+    }
+    Require(localSucceeded && childrenSucceeded,
+            "cross-process truncate/write race produced an invalid shared-object size");
+    struct _stat64 status{};
+    Require(::_fstat64(descriptor, &status) == 0 && (status.st_size == 0 || status.st_size == RaceSize),
+            "cross-process truncate/write race left an invalid final size");
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0, "cross-process race cleanup failed");
+}
+
+void VerifyResizeReadPosition(const std::string& name) {
+    constexpr std::size_t payloadSize = 2u << 20;
+    const int descriptor = shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(descriptor >= 0 && ftruncate_nid_postfix(descriptor, payloadSize) == 0,
+            "creating the resize/read object failed");
+    const int resizer = dup_nid_postfix(descriptor);
+    Require(resizer >= 0, "duplicating the resize/read descriptor failed");
+    std::vector<char> payload(payloadSize, 'r');
+    Require(pwrite_nid_disambig1_nid_postfix(descriptor, payload.data(), payload.size(), 0) == payloadSize &&
+            lseek_nid_postfix(descriptor, 137, 0) == 137, "preparing the resize/read object failed");
+    std::barrier start(2);
+    bool resized = true;
+    std::thread resizing([&] {
+        start.arrive_and_wait();
+        for (int iteration = 0; iteration < 256; ++iteration)
+            if (ftruncate_nid_postfix(resizer, payloadSize + ((iteration & 1) ? 4096 : 0)) != 0) resized = false;
+    });
+    start.arrive_and_wait();
+    std::vector<char> output(payloadSize);
+    bool read = true;
+    for (int iteration = 0; iteration < 32; ++iteration)
+        if (pread_nid_postfix(descriptor, output.data(), output.size(), 0) != payloadSize || output != payload) read = false;
+    resizing.join();
+    Require(resized && read && lseek_nid_postfix(descriptor, 0, 1) == 137,
+            "concurrent resize/read changed the shared file position or contents");
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0 && close_nid_postfix(descriptor) == 0 && close_nid_postfix(resizer) == 0,
+            "resize/read cleanup failed");
+    RequireNoUnlinkedFiles(name);
+}
+
+void Run() {
+    const std::string base = "/anyps5-windows-named-" + std::to_string(::GetCurrentProcessId()) + "-" + std::to_string(::GetTickCount64());
+    const std::string name = base + "-lifecycle";
+    Require(shm_unlink_nid_postfix(name.c_str()) == -1 && *__error_nid_postfix() == 2,
+            "new test name unexpectedly existed");
+
+    *__error_nid_postfix() = 73;
+    const int original = shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(original >= 0 && *__error_nid_postfix() == 73, "exclusive creation failed or changed guest errno");
+    VerifyUntrackedDescriptor(original);
+    Require(ftruncate_nid_postfix(original, 64) == 0, "sizing the named object failed");
+    VerifyConcurrentDescriptorReuse(name);
+    const char originalBytes[] = "original";
+    Require(pwrite_nid_disambig1_nid_postfix(original, originalBytes, sizeof(originalBytes), 0) == sizeof(originalBytes),
+            "write to named object failed");
+
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600), 17,
+                 "exclusive creation replaced an existing named object");
+    const int reader = shm_open_nid_postfix(name.c_str(), ReadOnly, 0);
+    char contents[sizeof(originalBytes)]{};
+    Require(reader >= 0 && pread_nid_postfix(reader, contents, sizeof(contents), 0) == sizeof(contents) &&
+            std::memcmp(contents, originalBytes, sizeof(contents)) == 0, "reopen did not share the original contents");
+    *__error_nid_postfix() = 0;
+    Require(pwrite_nid_disambig1_nid_postfix(reader, "x", 1, 0) == -1 && *__error_nid_postfix() == 9,
+            "read-only descriptor accepted a write");
+    *__error_nid_postfix() = 0;
+    Require(pwrite_nid_disambig1_nid_postfix(reader, "x", 1, 64) == -1 && *__error_nid_postfix() == 9,
+            "read-only descriptor accepted a write at end of file");
+    *__error_nid_postfix() = 0;
+    Require(pwrite_nid_disambig1_nid_postfix(reader, "", 0, 64) == -1 && *__error_nid_postfix() == 9,
+            "read-only descriptor accepted a zero-length write");
+
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0, "unlink of named object failed");
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(name.c_str(), ReadOnly, 0), 2, "unlinked name remained openable");
+    std::memset(contents, 0, sizeof(contents));
+    Require(pread_nid_postfix(original, contents, sizeof(contents), 0) == sizeof(contents) &&
+            std::memcmp(contents, originalBytes, sizeof(contents)) == 0, "open descriptor stopped working after unlink");
+    const char updatedByte = 'X';
+    Require(pwrite_nid_disambig1_nid_postfix(original, &updatedByte, 1, 0) == 1,
+            "open descriptor stopped accepting writes after unlink");
+
+    const int replacement = shm_open_nid_postfix(name.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(replacement >= 0, "name could not be recreated while old descriptors remained open");
+    Require(ftruncate_nid_postfix(replacement, 64) == 0, "sizing the replacement object failed");
+    Require(fchmod_nid_postfix(original, 0400) == 0,
+            "fchmod failed on the old open object after unlink and name recreation");
+    Require(fchmod_nid_postfix(original, 0600) == 0,
+            "restoring mode on the old open object after name recreation failed");
+    std::memset(contents, 0x7f, sizeof(contents));
+    Require(pread_nid_postfix(replacement, contents, sizeof(contents), 0) == sizeof(contents) &&
+            std::memcmp(contents, "\0\0\0\0\0\0\0\0", sizeof(contents)) == 0,
+            "recreated name still referred to the unlinked object");
+    Require(pwrite_nid_disambig1_nid_postfix(replacement, "y", 1, 0) == 1,
+            "fchmod on the old descriptor changed the replacement object's permissions");
+    const char replacementBytes[] = "replacement";
+    Require(pwrite_nid_disambig1_nid_postfix(replacement, replacementBytes, sizeof(replacementBytes), 0) == sizeof(replacementBytes),
+            "write to replacement object failed");
+    std::memset(contents, 0, sizeof(contents));
+    Require(pread_nid_postfix(original, contents, sizeof(contents), 0) == sizeof(contents) &&
+            contents[0] == updatedByte && std::memcmp(contents + 1, originalBytes + 1, sizeof(originalBytes) - 2) == 0,
+            "replacement write changed the old open object");
+    Require(shm_unlink_nid_postfix(name.c_str()) == 0, "replacement unlink failed");
+    Require(close_nid_postfix(reader) == 0 && close_nid_postfix(original) == 0 && close_nid_postfix(replacement) == 0,
+            "closing lifecycle descriptors failed");
+    RequireNoUnlinkedFiles(name);
+
+    const std::string duplicateName = base + "-duplicate";
+    const int duplicateOriginal = shm_open_nid_postfix(duplicateName.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(duplicateOriginal >= 0 && ftruncate_nid_postfix(duplicateOriginal, 64) == 0,
+            "creating the duplicate test object failed");
+    const int duplicate = dup_nid_postfix(duplicateOriginal);
+    Require(duplicate >= 0 && pwrite_nid_disambig1_nid_postfix(duplicate, "d", 1, 0) == 1,
+            "dup lost shared-memory write access");
+    const int duplicateReader = shm_open_nid_postfix(duplicateName.c_str(), ReadOnly, 0);
+    Require(duplicateReader >= 0 && shm_unlink_nid_postfix(duplicateName.c_str()) == 0,
+            "unlinking the duplicate test object failed");
+    Require(close_nid_postfix(duplicateOriginal) == 0, "closing the duplicated original failed");
+    Require(dup2_nid_postfix(-1, duplicate) == -1,
+            "dup2 accepted an invalid source");
+    Require(pwrite_nid_disambig1_nid_postfix(duplicate, "e", 1, 0) == 1,
+            "failed dup2 destroyed its shared-memory target");
+    Require(dup2_nid_postfix(duplicateReader, duplicate) == duplicate,
+            "dup2 could not replace a shared-memory target");
+    Require(pwrite_nid_disambig1_nid_postfix(duplicate, "f", 1, 0) == -1 && *__error_nid_postfix() == 9,
+            "dup2 lost shared-memory read-only access");
+    Require(close_nid_postfix(duplicateReader) == 0, "closing the duplicate reader failed");
+    const std::string replacementName = base + "-duplicate-replacement";
+    const int duplicateReplacement = shm_open_nid_postfix(replacementName.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(duplicateReplacement >= 0 && dup2_nid_postfix(duplicateReplacement, duplicate) == duplicate,
+            "dup2 could not replace the last unlinked descriptor");
+    RequireNoUnlinkedFiles(duplicateName);
+    Require(shm_unlink_nid_postfix(replacementName.c_str()) == 0 &&
+            close_nid_postfix(duplicateReplacement) == 0 && close_nid_postfix(duplicate) == 0,
+            "cleaning up dup2 replacement descriptors failed");
+    RequireNoUnlinkedFiles(replacementName);
+    VerifyResizeReadPosition(base + "-resize-read");
+
+    const std::string concurrentName = base + "-exclusive-race";
+    constexpr int contenderCount = 12;
+    std::vector<int> descriptors(contenderCount, -2);
+    std::vector<int> errors(contenderCount, 0);
+    std::vector<std::thread> contenders;
+    contenders.reserve(contenderCount);
+    for (int index = 0; index < contenderCount; ++index) {
+        contenders.emplace_back([&, index] {
+            descriptors[index] = shm_open_nid_postfix(concurrentName.c_str(), ReadWrite | Create | Exclusive, 0600);
+            errors[index] = *__error_nid_postfix();
+        });
+    }
+    for (auto& contender : contenders) contender.join();
+    int created = 0;
+    for (int index = 0; index < contenderCount; ++index) {
+        if (descriptors[index] >= 0) {
+            ++created;
+            Require(close_nid_postfix(descriptors[index]) == 0, "closing exclusive-race descriptor failed");
+        } else {
+            Require(errors[index] == 17, "exclusive-race loser did not receive EEXIST");
+        }
+    }
+    Require(created == 1, "exclusive create race produced more or fewer than one winner");
+    Require(shm_unlink_nid_postfix(concurrentName.c_str()) == 0, "exclusive-race cleanup failed");
+
+    const std::string raceName = base + "-cross-process-race";
+    const int raceDescriptor = shm_open_nid_postfix(raceName.c_str(), ReadWrite | Create | Exclusive, 0600);
+    Require(raceDescriptor >= 0 && ftruncate_nid_postfix(raceDescriptor, RaceSize) == 0,
+            "cross-process race object creation failed");
+    VerifyCrossProcessResizeWrite(raceName, raceDescriptor);
+    Require(close_nid_postfix(raceDescriptor) == 0, "closing cross-process race descriptor failed");
+
+    const std::string permissionsName = base + "-permissions";
+    const int restricted = shm_open_nid_postfix(permissionsName.c_str(), ReadWrite | Create | Exclusive, 0400);
+    Require(restricted >= 0, "read-only mode creation failed");
+    RequireNoAdministratorsAccess(reinterpret_cast<HANDLE>(::_get_osfhandle(restricted)));
+    Require(close_nid_postfix(restricted) == 0, "closing read-only mode object failed");
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(permissionsName.c_str(), ReadWrite, 0), 13,
+                 "mode 0400 allowed a later read-write open");
+    const int restrictedReader = shm_open_nid_postfix(permissionsName.c_str(), ReadOnly, 0);
+    Require(restrictedReader >= 0, "mode 0400 rejected a read-only open");
+    Require(fchmod_nid_postfix(restrictedReader, 0600) == 0,
+            "fchmod could not restore write permission on a named object");
+    const int restoredWriter = shm_open_nid_postfix(permissionsName.c_str(), ReadWrite, 0);
+    Require(restoredWriter >= 0, "mode 0600 after fchmod rejected read-write open");
+    Require(fchmod_nid_postfix(restoredWriter, 0400) == 0,
+            "fchmod could not remove write permission on a named object");
+    *__error_nid_postfix() = 0;
+    Require(shm_unlink_nid_postfix(permissionsName.c_str()) == -1 && *__error_nid_postfix() == 13,
+            "unlink of a read-only named object did not return EACCES");
+    Require(fchmod_nid_postfix(restoredWriter, 0600) == 0,
+            "fchmod could not restore permission before unlink");
+    Require(shm_unlink_nid_postfix(permissionsName.c_str()) == 0,
+            "owner could not unlink a writable named object");
+    Require(close_nid_postfix(restoredWriter) == 0, "closing restored writer failed");
+    Require(close_nid_postfix(restrictedReader) == 0, "closing restricted reader failed");
+
+    const std::string noPermissionsName = base + "-mode-zero";
+    const int noPermissions = shm_open_nid_postfix(noPermissionsName.c_str(), ReadWrite | Create | Exclusive, 0000);
+    Require(noPermissions >= 0 && fchmod_nid_postfix(noPermissions, 0600) == 0,
+            "fchmod could not restore access to a mode 0000 named object");
+    Require(shm_unlink_nid_postfix(noPermissionsName.c_str()) == 0 && close_nid_postfix(noPermissions) == 0,
+            "mode 0000 object cleanup failed");
+
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix(nullptr, ReadWrite, 0), 14, "null name did not return EFAULT");
+    *__error_nid_postfix() = 0;
+    RequireError(shm_open_nid_postfix("relative", ReadWrite, 0), 22, "relative name did not return EINVAL");
+    std::puts("Windows named shared-memory lifecycle checks passed");
+}
+
+bool EnvironmentEntryHasKey(const std::wstring& entry, const wchar_t* key) {
+    const auto separator = entry.find(L'=');
+    return separator != std::wstring::npos && separator == std::wcslen(key) &&
+        ::CompareStringOrdinal(entry.data(), static_cast<int>(separator), key, static_cast<int>(separator), TRUE) == CSTR_EQUAL;
+}
+
+std::vector<wchar_t> EnvironmentWithTempPath(const std::wstring& path) {
+    std::vector<std::wstring> entries;
+    LPWCH environment = ::GetEnvironmentStringsW();
+    if (environment == nullptr) throw std::runtime_error("reading the Windows environment failed");
+    try {
+        for (const wchar_t* current = environment; *current != L'\0'; current += std::wcslen(current) + 1) {
+            std::wstring entry(current);
+            if (!EnvironmentEntryHasKey(entry, L"TMP") && !EnvironmentEntryHasKey(entry, L"TEMP"))
+                entries.push_back(std::move(entry));
+        }
+    } catch (...) {
+        ::FreeEnvironmentStringsW(environment);
+        throw;
+    }
+    ::FreeEnvironmentStringsW(environment);
+    entries.push_back(L"TMP=" + path);
+    entries.push_back(L"TEMP=" + path);
+    std::sort(entries.begin(), entries.end(), [](const auto& left, const auto& right) {
+        return ::CompareStringOrdinal(left.c_str(), -1, right.c_str(), -1, TRUE) == CSTR_LESS_THAN;
+    });
+    std::vector<wchar_t> block;
+    for (const auto& entry : entries) {
+        block.insert(block.end(), entry.begin(), entry.end());
+        block.push_back(L'\0');
+    }
+    block.push_back(L'\0');
+    return block;
+}
+
+bool SameDirectory(HANDLE left, HANDLE right) {
+    BY_HANDLE_FILE_INFORMATION leftInfo{}, rightInfo{};
+    return ::GetFileInformationByHandle(left, &leftInfo) && ::GetFileInformationByHandle(right, &rightInfo) &&
+        leftInfo.dwVolumeSerialNumber == rightInfo.dwVolumeSerialNumber &&
+        leftInfo.nFileIndexHigh == rightInfo.nFileIndexHigh && leftInfo.nFileIndexLow == rightInfo.nFileIndexLow;
+}
+
+std::filesystem::path ExtendedPath(const std::filesystem::path& path) {
+    wchar_t fullPath[32768]{};
+    const DWORD length = ::GetFullPathNameW(path.c_str(), static_cast<DWORD>(std::size(fullPath)), fullPath, nullptr);
+    if (length == 0 || length >= std::size(fullPath))
+        throw std::runtime_error("getting the full private temporary path failed");
+    std::wstring full(fullPath, length);
+    if (full.starts_with(L"\\\\?\\")) return full;
+    if (full.starts_with(L"\\\\")) return L"\\\\?\\UNC\\" + full.substr(2);
+    return L"\\\\?\\" + full;
+}
+
+std::filesystem::path DosPath(const std::filesystem::path& path) {
+    const auto& native = path.native();
+    if (native.starts_with(L"\\\\?\\UNC\\")) return L"\\\\" + native.substr(8);
+    if (native.starts_with(L"\\\\?\\")) return native.substr(4);
+    return path;
+}
+
+void RemovePrivateDirectory(const std::filesystem::path& directory) {
+    WIN32_FIND_DATAW entry{};
+    const HANDLE search = ::FindFirstFileW((directory / L"*").c_str(), &entry);
+    if (search == INVALID_HANDLE_VALUE) {
+        if (::GetLastError() != ERROR_FILE_NOT_FOUND)
+            throw std::runtime_error("enumerating the private temporary directory for cleanup failed");
+    } else {
+        try {
+            do {
+                if (std::wcscmp(entry.cFileName, L".") == 0 || std::wcscmp(entry.cFileName, L"..") == 0) continue;
+                if (entry.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
+                    throw std::runtime_error("the private temporary directory contains a reparse point");
+                const auto child = directory / entry.cFileName;
+                if (entry.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) RemovePrivateDirectory(child);
+                else if (!::DeleteFileW(child.c_str()))
+                    throw std::runtime_error("removing a private temporary file failed");
+            } while (::FindNextFileW(search, &entry));
+            if (::GetLastError() != ERROR_NO_MORE_FILES)
+                throw std::runtime_error("enumerating the private temporary directory for cleanup failed");
+        } catch (...) {
+            ::FindClose(search);
+            throw;
+        }
+        ::FindClose(search);
+    }
+    if (!::RemoveDirectoryW(directory.c_str()))
+        throw std::runtime_error("removing the private temporary directory failed");
+}
+
+int RunWithShortTempPath(bool longPath) {
+    wchar_t tempBuffer[32768]{};
+    const DWORD tempLength = ::GetTempPathW(static_cast<DWORD>(std::size(tempBuffer)), tempBuffer);
+    if (tempLength == 0 || tempLength >= std::size(tempBuffer))
+        throw std::runtime_error("locating the Windows temporary directory failed");
+    const std::filesystem::path parent(std::wstring(tempBuffer, tempLength));
+    std::filesystem::path baseRoot;
+    bool created = false;
+    for (unsigned attempt = 0; attempt < 16; ++attempt) {
+        baseRoot = parent / (L"AnyPS5-Temp-Regression-" + std::to_wstring(::GetCurrentProcessId()) + L"-" +
+            std::to_wstring(::GetTickCount64()) + L"-" + std::to_wstring(attempt));
+        if (::CreateDirectoryW(baseRoot.c_str(), nullptr)) {
+            created = true;
+            break;
+        }
+        if (::GetLastError() != ERROR_ALREADY_EXISTS) throw std::runtime_error("creating a private temporary directory failed");
+    }
+    if (!created) throw std::runtime_error("creating a unique private temporary directory failed");
+    const auto cleanupRoot = ExtendedPath(baseRoot);
+    std::filesystem::path longRoot = cleanupRoot;
+    const auto cleanup = [&] {
+        RemovePrivateDirectory(cleanupRoot);
+    };
+
+    try {
+        std::vector<wchar_t> shortBuffer(32768);
+        DWORD shortLength = ::GetShortPathNameW(longRoot.c_str(), shortBuffer.data(), static_cast<DWORD>(shortBuffer.size()));
+        if (shortLength == 0)
+            throw std::runtime_error("GetShortPathNameW failed (Win32 error " + std::to_string(::GetLastError()) + ")");
+        if (shortLength >= shortBuffer.size())
+            throw std::runtime_error("GetShortPathNameW required a buffer of " + std::to_string(shortLength) + " characters");
+        std::filesystem::path shortRoot(std::wstring(shortBuffer.data(), shortLength));
+        if (longPath) {
+            bool aliasAvailable = true;
+            bool longAliasReady = false;
+            for (unsigned level = 0; level < 80; ++level) {
+                longRoot /= L"LongSharedMemoryTempDirectoryRegressionSegment";
+                if (!::CreateDirectoryW(longRoot.c_str(), nullptr))
+                    throw std::runtime_error("creating the nested long temporary directory failed (Win32 error " + std::to_string(::GetLastError()) + ")");
+                shortLength = ::GetShortPathNameW(longRoot.c_str(), shortBuffer.data(), static_cast<DWORD>(shortBuffer.size()));
+                if (shortLength == 0)
+                    throw std::runtime_error("GetShortPathNameW failed for nested path (Win32 error " + std::to_string(::GetLastError()) + ")");
+                if (shortLength >= shortBuffer.size())
+                    throw std::runtime_error("GetShortPathNameW required a buffer of " + std::to_string(shortLength) + " characters");
+                shortRoot = std::filesystem::path(std::wstring(shortBuffer.data(), shortLength));
+                if (::CompareStringOrdinal(longRoot.filename().c_str(), -1, shortRoot.filename().c_str(), -1, TRUE) == CSTR_EQUAL) {
+                    aliasAvailable = false;
+                    break;
+                }
+                if (DosPath(longRoot).native().size() > MAX_PATH + 64 && DosPath(shortRoot).native().size() < MAX_PATH - 64) {
+                    longAliasReady = true;
+                    break;
+                }
+            }
+            if (!aliasAvailable) {
+                std::puts("long-short-temp regression skipped: this volume did not create an 8.3 alias for the nested directory");
+                cleanup();
+                return 77;
+            }
+            if (!longAliasReady)
+                throw std::runtime_error("nested private path did not exceed MAX_PATH with a usable short alias");
+        }
+        if (::CompareStringOrdinal(longRoot.filename().c_str(), -1, shortRoot.filename().c_str(), -1, TRUE) == CSTR_EQUAL) {
+            std::puts("short-temp regression skipped: this volume did not create an 8.3 alias for the private directory");
+            cleanup();
+            return 77;
+        }
+        const HANDLE longHandle = ::CreateFileW(longRoot.c_str(), FILE_READ_ATTRIBUTES,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (longHandle == INVALID_HANDLE_VALUE) throw std::runtime_error("opening the long temporary path failed");
+        const HANDLE shortHandle = ::CreateFileW(shortRoot.c_str(), FILE_READ_ATTRIBUTES,
+            FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+            FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+        if (shortHandle == INVALID_HANDLE_VALUE) {
+            ::CloseHandle(longHandle);
+            throw std::runtime_error("opening the 8.3 temporary alias failed");
+        }
+        const bool isSameDirectory = SameDirectory(longHandle, shortHandle);
+        ::CloseHandle(shortHandle);
+        ::CloseHandle(longHandle);
+        if (!isSameDirectory) throw std::runtime_error("the short temporary path did not identify the created directory");
+        std::wprintf(L"%ls regression verified 8.3 directory alias (%llu/%llu characters):\n%ls\n%ls\n",
+            longPath ? L"long-short-temp" : L"short-temp",
+            static_cast<unsigned long long>(longRoot.native().size()),
+            static_cast<unsigned long long>(shortRoot.native().size()), longRoot.c_str(), shortRoot.c_str());
+        std::fflush(stdout);
+
+        wchar_t executable[32768]{};
+        const DWORD executableLength = ::GetModuleFileNameW(nullptr, executable, static_cast<DWORD>(std::size(executable)));
+        if (executableLength == 0 || executableLength >= std::size(executable))
+            throw std::runtime_error("locating the Windows shared-memory test executable failed");
+        std::wstring command = L"\"" + std::wstring(executable, executableLength) + L"\" --short-temp-child";
+        auto environment = EnvironmentWithTempPath(DosPath(shortRoot).native());
+        STARTUPINFOW startup{};
+        startup.cb = sizeof(startup);
+        PROCESS_INFORMATION process{};
+        if (!::CreateProcessW(nullptr, command.data(), nullptr, nullptr, FALSE,
+                CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT, environment.data(), nullptr, &startup, &process))
+            throw std::runtime_error("starting the short temporary path child failed");
+        const DWORD wait = ::WaitForSingleObject(process.hProcess, 16000);
+        DWORD exitCode = 1;
+        const bool childSucceeded = wait == WAIT_OBJECT_0 && ::GetExitCodeProcess(process.hProcess, &exitCode) && exitCode == 0;
+        if (wait != WAIT_OBJECT_0) {
+            ::TerminateProcess(process.hProcess, 1);
+            ::WaitForSingleObject(process.hProcess, 1000);
+        }
+        if (!childSucceeded)
+            std::fprintf(stderr, "%s child failed: wait=%lu exit=%lu\n", longPath ? "long-short-temp" : "short-temp",
+                static_cast<unsigned long>(wait), static_cast<unsigned long>(exitCode));
+        ::CloseHandle(process.hThread);
+        ::CloseHandle(process.hProcess);
+        cleanup();
+        return childSucceeded ? 0 : 1;
+    } catch (...) {
+        cleanup();
+        throw;
+    }
+}
+}
+
+int main(int argumentCount, char** arguments) {
+    try {
+        if (argumentCount == 3 && std::string_view(arguments[1]) == "--race")
+            return RunResizeWriteRace(arguments[2]) ? 0 : 1;
+        if (argumentCount == 2 && std::string_view(arguments[1]) == "--short-temp")
+            return RunWithShortTempPath(false);
+        if (argumentCount == 2 && std::string_view(arguments[1]) == "--long-short-temp")
+            return RunWithShortTempPath(true);
+        if (argumentCount == 2 && std::string_view(arguments[1]) == "--short-temp-child") {
+            Run();
+            return 0;
+        }
+        Run();
+        return 0;
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+}
diff --git a/core/libs/tests/GuestNanosleep.cpp b/core/libs/tests/GuestNanosleep.cpp
index c97b6c1f13..6ae6cbbd17 100644
--- a/core/libs/tests/GuestNanosleep.cpp
+++ b/core/libs/tests/GuestNanosleep.cpp
@@ -1,20 +1,14 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI _nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI sceKernelNanosleep(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int* APS5_VABI __error_nid_postfix();
-}
-
 using Nanosleep = int (APS5_VABI *)(const KernelTimespec*, KernelTimespec*);
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EFAULT = static_cast<int>(0x8002000E);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 
 static constexpr int GUEST_EACCES = 13;
 static constexpr int GUEST_EFAULT = 14;
diff --git a/core/libs/tests/GuestNanosleepLongRequest.cpp b/core/libs/tests/GuestNanosleepLongRequest.cpp
index b2b6ec9cd6..c68722401f 100644
--- a/core/libs/tests/GuestNanosleepLongRequest.cpp
+++ b/core/libs/tests/GuestNanosleepLongRequest.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <atomic>
@@ -8,12 +10,6 @@
 #include <source_location>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI nanosleep_nid_postfix(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-int APS5_VABI sceKernelNanosleep(const KernelTimespec* rqtp, KernelTimespec* rmtp);
-}
-
 static void Require(bool value, std::source_location location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "%s:%u: requirement failed\n", location.file_name(), location.line());
diff --git a/core/libs/tests/GuestNetBufferValidation.cpp b/core/libs/tests/GuestNetBufferValidation.cpp
new file mode 100644
index 0000000000..cf734de324
--- /dev/null
+++ b/core/libs/tests/GuestNetBufferValidation.cpp
@@ -0,0 +1,73 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <winsock2.h>
+#else
+#include <sys/socket.h>
+#endif
+#include <climits>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <source_location>
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/Socket/include/SocketPoll.hpp"
+
+static void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (!condition) {
+        std::fprintf(stderr, "check failed at line %u\n", location.line());
+        std::abort();
+    }
+}
+
+int main() {
+    Require(sceNetInit_nid_postfix() == 0);
+    for (const int family : {2, 28}) {
+        for (const int type : {1, 2}) {
+            const int socket = sceNetSocket("buffer-validation", family, type, type == 1 ? 6 : 17);
+            Require(socket >= 0);
+            std::shared_ptr<void> owner;
+            std::uintptr_t native = 0;
+            Require(KernelFindSocketNative_nid_no_patch(socket, &owner, &native));
+            for (const int option : {0x1001, 0x1002}) {
+                const auto nativeBuffer = [&] {
+                    int value = 0;
+#ifdef _WIN32
+                    int size = sizeof(value);
+#else
+                    socklen_t size = sizeof(value);
+#endif
+                    Require(::getsockopt(native, SOL_SOCKET, option == 0x1001 ? SO_SNDBUF : SO_RCVBUF,
+                        reinterpret_cast<char*>(&value), &size) == 0);
+                    return value;
+                };
+                const int initial = 32768;
+                Require(sceNetSetsockopt(socket, 0xffff, option, &initial, sizeof(initial)) == 0);
+                const int originalNative = nativeBuffer();
+                for (const int invalid : {0, -1, -4096, INT_MIN}) {
+                    Require(sceNetSetsockopt(socket, 0xffff, option, &invalid, sizeof(invalid)) == static_cast<int>(0x80410116u));
+                    Require(*sceNetErrnoLoc() == 22);
+                    Require(setsockopt_nid_postfix(socket, 0xffff, option, &invalid, sizeof(invalid)) == -1);
+                    Require(*__error_nid_postfix() == 22);
+                    int value = 0;
+                    std::uint32_t size = sizeof(value);
+                    Require(sceNetGetsockopt(socket, 0xffff, option, &value, &size) == 0 && value == initial);
+                    Require(nativeBuffer() == originalNative);
+                }
+                Require(sceNetSetsockopt(socket, 0xffff, option, nullptr, sizeof(initial)) == static_cast<int>(0x80410116u));
+                Require(sceNetSetsockopt(socket, 0xffff, option, &initial, 3) == static_cast<int>(0x80410116u));
+                const int valid = 8192;
+                Require(sceNetSetsockopt(socket, 0xffff, option, &valid, sizeof(valid)) == 0);
+                int value = 0;
+                std::uint32_t size = sizeof(value);
+                Require(sceNetGetsockopt(socket, 0xffff, option, &value, &size) == 0 && value == valid);
+            }
+            Require(sceNetSocketClose(socket) == 0);
+        }
+    }
+    const int zero = 0;
+    Require(sceNetSetsockopt(-1, 0xffff, 0x1001, &zero, sizeof(zero)) == static_cast<int>(0x80410109u));
+    Require(*sceNetErrnoLoc() == 9);
+}
diff --git a/core/libs/tests/GuestNetCtl.cpp b/core/libs/tests/GuestNetCtl.cpp
index f45a66dc77..9a0e595f2b 100644
--- a/core/libs/tests/GuestNetCtl.cpp
+++ b/core/libs/tests/GuestNetCtl.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -31,26 +32,13 @@ struct NetCtlDefaultRoute {
 };
 #endif
 
-union NetCtlInfoV6;
 
 extern "C" {
-int APS5_VABI sceNetCtlInit(void);
-int APS5_VABI sceNetCtlCheckCallback(void);
-int APS5_VABI sceNetCtlGetInfo(int, NetCtlInfo*);
-int APS5_VABI sceNetCtlGetNatInfo(NetCtlNatInfo*);
-int APS5_VABI sceNetCtlGetState(int*);
-int APS5_VABI sceNetCtlGetStateV6(int*);
-int APS5_VABI sceNetCtlGetInfoV6(std::uint32_t, NetCtlInfoV6*);
-int APS5_VABI sceNetCtlGetResult(int, int*);
-int APS5_VABI sceNetCtlGetResultV6(int, int*);
+
 #ifdef __APPLE__
 std::size_t NetCtlDefaultRoutes_nid_no_patch(const char*, std::size_t, NetCtlDefaultRoute*, std::size_t);
 #endif
-int APS5_VABI sceNetCtlRegisterCallback(NetCtlCallback, void*, int*);
-int APS5_VABI sceNetCtlRegisterCallbackV6(NetCtlCallback, void*, int*);
-void APS5_VABI sceNetCtlTerm(void);
-int APS5_VABI sceNetCtlUnregisterCallback(int);
-int APS5_VABI sceNetCtlUnregisterCallbackV6(int);
+
 }
 
 namespace {
@@ -283,6 +271,9 @@ int main() {
     Require(sceNetCtlRegisterCallbackV6(nullptr, nullptr, nullptr) == kErrInvalidAddr);
     Require(sceNetCtlUnregisterCallback(-1) == invalidId);
     Require(sceNetCtlUnregisterCallbackV6(-1) == invalidId);
+    Require(sceNetCtlRegisterCallbackForNpToolkit(nullptr, nullptr, nullptr) == kErrInvalidAddr);
+    Require(sceNetCtlUnregisterCallbackForNpToolkit(-1) == invalidId);
+    Require(sceNetCtlCheckCallbackForNpToolkit() == 0);
     CheckCallbacks();
 
     Require(sceNetCtlGetStateV6(nullptr) == kErrInvalidAddr);
@@ -290,25 +281,16 @@ int main() {
     Require(sceNetCtlGetStateV6(&stateV6) == 0);
     Require(stateV6 == 0 || stateV6 == kStateIpObtained);
     Require(sceNetCtlGetResult(0, nullptr) == kErrInvalidAddr);
-    int errorCode = -1;
-    bool resultUnsupported = false;
-    try {
-        sceNetCtlGetResult(0, &errorCode);
-    } catch (const std::logic_error&) {
-        resultUnsupported = true;
+    Require(sceNetCtlGetResult(kEventDisconnected, nullptr) == kErrInvalidAddr);
+    for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) {
+        int errorCode = -1;
+        Require(sceNetCtlGetResult(eventType, &errorCode) == 0 && errorCode == 0);
     }
-    Require(resultUnsupported && errorCode == -1);
     Require(sceNetCtlGetResultV6(kEventIpObtained, nullptr) == kErrInvalidAddr);
     for (const int eventType : {kEventDisconnected, 2, kEventIpObtained}) {
         int errorCodeV6 = -1;
         Require(sceNetCtlGetResultV6(eventType, &errorCodeV6) == 0 && errorCodeV6 == 0);
     }
-    for (const int eventType : {0, 4, -1}) {
-        int errorCodeV6 = -1;
-        bool threw = false;
-        try { sceNetCtlGetResultV6(eventType, &errorCodeV6); } catch (const std::runtime_error&) { threw = true; }
-        Require(threw && errorCodeV6 == -1);
-    }
     NetCtlInfo info{};
     Require(sceNetCtlGetInfo(0, &info) == kErrInvalidCode);
     Require(sceNetCtlGetInfo(22, &info) == kErrInvalidCode);
diff --git a/core/libs/tests/GuestNetCtlAp.cpp b/core/libs/tests/GuestNetCtlAp.cpp
index 3689260ee4..d9db3b4796 100644
--- a/core/libs/tests/GuestNetCtlAp.cpp
+++ b/core/libs/tests/GuestNetCtlAp.cpp
@@ -1,23 +1,11 @@
+#include "prx/libSceNetCtlAp/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNetCtlApInit(void);
-void APS5_VABI sceNetCtlApTerm(void);
-int APS5_VABI sceNetCtlApCheckCallback(void);
-int APS5_VABI sceNetCtlApClearEvent(int eventType);
-int APS5_VABI sceNetCtlApRegisterCallback(void (APS5_VABI *func)(int, void*), void* arg, int* cid);
-int APS5_VABI sceNetCtlApUnregisterCallback(int cid);
-int APS5_VABI sceNetCtlApGetResult(int eventType, int* errorCode);
-int APS5_VABI sceNetCtlApGetInfo(void* info);
-int APS5_VABI sceNetCtlApGetState(int* state);
-int APS5_VABI sceNetCtlApStop(void);
-int APS5_VABI sceNetCtlApGetConnectInfo(const char* optStr, void* connectInfo);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -107,7 +95,7 @@ int main() {
         cids[i] = -1;
         Require(sceNetCtlApRegisterCallback(Callback, &cids[i], &cids[i]) == 0 && cids[i] == i);
     }
-    int extra = -1;
+    int extra = 0x5a5a;
     Require(sceNetCtlApRegisterCallback(Callback, nullptr, &extra) == kErrCallbackMax && extra == -1);
     Require(sceNetCtlApRegisterCallback(nullptr, nullptr, &extra) == kErrInvalidAddr);
     Require(sceNetCtlApRegisterCallback(Callback, nullptr, nullptr) == kErrInvalidAddr);
@@ -122,6 +110,7 @@ int main() {
     bool threw = false;
     try {
         sceNetCtlApInit();
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -135,5 +124,6 @@ int main() {
     Require(sceNetCtlApGetState(&state) == 0 && state == 0);
     sceNetCtlApTerm();
     sceNetCtlApTerm();
+
     RequireUninitialized();
 }
diff --git a/core/libs/tests/GuestNetCtlApDialog.cpp b/core/libs/tests/GuestNetCtlApDialog.cpp
index f17c171e56..82b0318b87 100644
--- a/core/libs/tests/GuestNetCtlApDialog.cpp
+++ b/core/libs/tests/GuestNetCtlApDialog.cpp
@@ -1,19 +1,10 @@
+#include "prx/libSceNetCtlApDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 
-extern "C" {
-int APS5_VABI sceNetCtlApDialogInitialize(void);
-int APS5_VABI sceNetCtlApDialogTerminate(void);
-int APS5_VABI sceNetCtlApDialogOpen(const NetCtlApDialogParam* param);
-int APS5_VABI sceNetCtlApDialogClose(void);
-int APS5_VABI sceNetCtlApDialogUpdateStatus(void);
-int APS5_VABI sceNetCtlApDialogGetStatus(void);
-int APS5_VABI sceNetCtlApDialogGetResult(void* result);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -48,7 +39,7 @@ int main() {
     Require(sceNetCtlApDialogTerminate() == kErrNotInitialized);
     Require(sceNetCtlApDialogOpen(&param) == kErrNotInitialized);
     Require(sceNetCtlApDialogClose() == kErrNotInitialized);
-    Require(sceNetCtlApDialogGetResult(result) == kErrNotInitialized);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kErrNotInitialized);
     Require(sceNetCtlApDialogGetStatus() == kStatusNone);
     Require(sceNetCtlApDialogUpdateStatus() == kStatusNone);
 
@@ -59,9 +50,9 @@ int main() {
 
     Require(sceNetCtlApDialogOpen(nullptr) == kErrArgNull);
     Require(sceNetCtlApDialogGetStatus() == kStatusInitialized);
-    Require(sceNetCtlApDialogGetResult(result) == static_cast<int>(0x80B8000Au));
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == static_cast<int>(0x80B8000Au));
     std::memset(result + 4, 0, 36);
-    Require(sceNetCtlApDialogGetResult(result) == kErrNotFinished);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kErrNotFinished);
 
     param.size = 103;
     Require(sceNetCtlApDialogOpen(&param) == static_cast<int>(0x80B8000Au));
@@ -80,7 +71,7 @@ int main() {
     Require(sceNetCtlApDialogUpdateStatus() == kStatusFinished);
 
     Require(sceNetCtlApDialogGetResult(nullptr) == kErrArgNull);
-    Require(sceNetCtlApDialogGetResult(result) == kResultUserCanceled);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kResultUserCanceled);
     RequireCanceled(result);
 
     Require(sceNetCtlApDialogOpen(&param) == 0);
@@ -92,6 +83,6 @@ int main() {
     Require(sceNetCtlApDialogInitialize() == 0);
     Require(sceNetCtlApDialogClose() == static_cast<int>(0x80B8000Bu));
     Require(sceNetCtlApDialogGetStatus() == kStatusInitialized);
-    Require(sceNetCtlApDialogGetResult(result) == kErrNotFinished);
+    Require(sceNetCtlApDialogGetResult(reinterpret_cast<NetCtlApDialogResult*>(result)) == kErrNotFinished);
     Require(sceNetCtlApDialogTerminate() == 0);
 }
diff --git a/core/libs/tests/GuestNetThread.cpp b/core/libs/tests/GuestNetThread.cpp
new file mode 100644
index 0000000000..abdc2c22d8
--- /dev/null
+++ b/core/libs/tests/GuestNetThread.cpp
@@ -0,0 +1,73 @@
+#include "prx/libSceNet/include/Net.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <thread>
+
+namespace {
+
+constexpr int Einval = 22;
+constexpr int Eopnotsupp = 45;
+constexpr int NetError = static_cast<int>(0x80410100u);
+
+
+
+struct Run {
+    std::atomic<int> started{0};
+    std::atomic<bool> pastExit{false};
+};
+
+Run run;
+
+void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", what);
+    std::abort();
+}
+
+void APS5_VABI Count(void* arg) {
+    ++static_cast<Run*>(arg)->started;
+}
+
+void APS5_VABI ExitEarly(void* arg) {
+    auto* run = static_cast<Run*>(arg);
+    ++run->started;
+    sceNetThreadExit();
+    run->pastExit = true;
+}
+
+}
+
+int main() {
+    NetThreadParameter counting{Count, &run, 0, 0};
+    Pthread thread = nullptr;
+    Require(sceNetThreadCreate(&thread, &counting, "anyps5-net-thread") == 0 && thread != nullptr, "sceNetThreadCreate failed");
+    Require(sceNetThreadJoin(thread) == 0, "sceNetThreadJoin failed");
+    Require(run.started == 1, "the thread did not run its entry with its argument");
+
+    Pthread untouched = reinterpret_cast<Pthread>(&run);
+    *sceNetErrnoLoc() = 0;
+    Require(sceNetThreadCreate(&untouched, nullptr, "anyps5-net-thread") == (NetError | Einval), "a null parameter was not refused with EINVAL");
+    Require(*sceNetErrnoLoc() == Einval && untouched == reinterpret_cast<Pthread>(&run), "a refused create set no errno or wrote the thread");
+
+    NetThreadParameter exiting{ExitEarly, &run, 0, 1};
+    Require(sceNetThreadCreate(&thread, &exiting, nullptr) == 0, "sceNetThreadCreate failed without a name");
+    Require(sceNetThreadJoin(thread) == 0, "joining an exited thread failed");
+    Require(run.started == 2 && !run.pastExit, "sceNetThreadExit did not end the thread");
+
+    static NetThreadParameter detached{Count, &run, 0, 0};
+    Require(sceNetThreadCreate(nullptr, &detached, "anyps5-net-thread") == 0, "a null thread output was refused");
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+    while (run.started != 3 && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    Require(run.started == 3, "the thread created without an output did not run");
+
+    *sceNetErrnoLoc() = 0;
+    Require(sceNetEmulationGet(nullptr, 0) == (NetError | Eopnotsupp) && *sceNetErrnoLoc() == Eopnotsupp, "sceNetEmulationGet did not return EOPNOTSUPP");
+    *sceNetErrnoLoc() = 0;
+    Require(sceNetEmulationSet(nullptr, 0) == (NetError | Eopnotsupp) && *sceNetErrnoLoc() == Eopnotsupp, "sceNetEmulationSet did not return EOPNOTSUPP");
+    std::puts("net thread tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNewHandler.cpp b/core/libs/tests/GuestNewHandler.cpp
index 04a5d9a8a1..29b5acfc3c 100644
--- a/core/libs/tests/GuestNewHandler.cpp
+++ b/core/libs/tests/GuestNewHandler.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -11,15 +12,7 @@
 
 extern "C" {
 using Handler = void (APS5_VABI*)();
-Handler APS5_VABI _ZSt15set_new_handlerPFvvE_nid_postfix(Handler);
-Handler APS5_VABI _ZSt15get_new_handlerv_nid_postfix();
-void* APS5_VABI _Znwm_nid_postfix(std::size_t);
-void* APS5_VABI _Znam_nid_postfix(std::size_t);
-void* APS5_VABI _ZnwmSt11align_val_t_nid_postfix(std::size_t, std::size_t);
-void* APS5_VABI _ZnwmRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void* APS5_VABI _ZnamRKSt9nothrow_t_nid_postfix(std::size_t, const void*) noexcept;
-void APS5_VABI _ZdlPv_nid_postfix(void*);
-void APS5_VABI _ZdlPvSt11align_val_t_nid_postfix(void*, std::size_t);
+
 }
 
 namespace {
@@ -27,6 +20,7 @@ namespace {
 alignas(16) std::array<std::byte, 64> storage{};
 unsigned failuresLeft = 0;
 unsigned allocations = 0;
+unsigned releases = 0;
 unsigned handlerCalls = 0;
 std::size_t lastSize = 0;
 std::size_t lastAlignment = 0;
@@ -50,7 +44,7 @@ void* APS5_VABI allocate(std::size_t bytes) {
     return storage.data();
 }
 
-void APS5_VABI release(void*) {}
+void APS5_VABI release(void*) { ++releases; }
 void* APS5_VABI allocateZeroed(std::size_t count, std::size_t bytes) { return allocate(count * bytes); }
 void* APS5_VABI reallocate(void*, std::size_t bytes) { return allocate(bytes); }
 void* APS5_VABI align(std::size_t alignment, std::size_t bytes) {
@@ -80,6 +74,7 @@ void APS5_VABI allocatingHandler() {
 void Reset(unsigned failures) {
     failuresLeft = failures;
     allocations = 0;
+    releases = 0;
     handlerCalls = 0;
 }
 
@@ -138,6 +133,17 @@ int main(int argc, char** argv) {
 
     REQUIRE(_ZSt15get_new_handlerv_nid_postfix() == nullptr);
 
+    Reset(0);
+    void* nothrowPointer = _Znwm_nid_postfix(8);
+    const int nothrowTag = 0;
+    REQUIRE(nothrowPointer == storage.data() && releases == 0);
+    _ZdlPvRKSt9nothrow_t_nid_postfix(nothrowPointer, &nothrowTag);
+
+    REQUIRE(releases == 1);
+    _ZdlPvRKSt9nothrow_t_nid_postfix(nullptr, &nothrowTag);
+
+    REQUIRE(releases == 1);
+
     Reset(1);
     REQUIRE(Throws([] { _Znwm_nid_postfix(8); }) && handlerCalls == 0 && allocations == 1);
     Reset(1);
@@ -186,6 +192,7 @@ int main(int argc, char** argv) {
     void* aligned = _ZnwmSt11align_val_t_nid_postfix(24, 16);
     REQUIRE(aligned == storage.data() && lastSize == 24 && lastAlignment == 16 && allocations == 1);
     _ZdlPvSt11align_val_t_nid_postfix(aligned, 16);
+
     Reset(1);
     REQUIRE(Throws([] { _ZnwmSt11align_val_t_nid_postfix(8, 32); }) && handlerCalls == 0 && allocations == 1);
 
@@ -193,6 +200,7 @@ int main(int argc, char** argv) {
     REQUIRE(_ZnwmSt11align_val_t_nid_postfix(0, 16) == storage.data() && lastSize == 1 && lastAlignment == 16);
     Reset(2);
     _ZSt15set_new_handlerPFvvE_nid_postfix(&countingHandler);
+
     REQUIRE(_ZnwmSt11align_val_t_nid_postfix(8, 16) == storage.data() && handlerCalls == 2 && allocations == 3);
     _ZSt15set_new_handlerPFvvE_nid_postfix(nullptr);
 
diff --git a/core/libs/tests/GuestNpAuth.cpp b/core/libs/tests/GuestNpAuth.cpp
index 95b11eddc5..a1920ceb5c 100644
--- a/core/libs/tests/GuestNpAuth.cpp
+++ b/core/libs/tests/GuestNpAuth.cpp
@@ -1,24 +1,9 @@
+#include "prx/libSceNpAuth/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <cstdint>
 #include <cstdlib>
-
-extern "C" {
-int APS5_VABI sceNpAuthAbortRequest(int req_id);
-int APS5_VABI sceNpAuthCreateAsyncRequest(const void* param);
-int APS5_VABI sceNpAuthCreateRequest(void);
-int APS5_VABI sceNpAuthDeleteRequest(int req_id);
-int APS5_VABI sceNpAuthGetAuthorizationCode(int req_id, const void* param, void* auth_code);
-int APS5_VABI sceNpAuthGetAuthorizationCodeA(int req_id, const void* param, void* auth_code, int* issuer_id);
-int APS5_VABI sceNpAuthGetAuthorizationCodeV3(int req_id, const void* param, void* auth_code, int* issuer_id);
-int APS5_VABI sceNpAuthGetAuthorizedAppCode(std::int32_t, const NpAuthAuthorizedAppCodeParameter*, char*, std::int32_t*, bool*);
-int APS5_VABI sceNpAuthGetIdToken(int req_id, const void* param, void* id_token);
-int APS5_VABI sceNpAuthGetIdTokenA(int req_id, const void* param, void* id_token);
-int APS5_VABI sceNpAuthGetIdTokenV3(int req_id, const void* param, void* id_token);
-int APS5_VABI sceNpAuthPollAsync(int req_id, int* result);
-int APS5_VABI sceNpAuthSetTimeout(int req_id, int resolve_retry, uint32_t resolve_timeout, uint32_t connect_timeout, uint32_t send_timeout, uint32_t receive_timeout);
-int APS5_VABI sceNpAuthWaitAsync(int req_id, int* result);
-}
+#include <initializer_list>
 
 static void Require(bool condition) {
     if (!condition) {
@@ -26,7 +11,43 @@ static void Require(bool condition) {
     }
 }
 
+static void RequireUnstarted(int request) {
+    constexpr int invalidId = static_cast<int>(0x80550307);
+    constexpr int sentinel = 0x13579bdf;
+    for (int attempt = 0; attempt != 3; ++attempt) {
+        int result = sentinel;
+        Require(sceNpAuthPollAsync(request, &result) == invalidId);
+        Require(result == sentinel);
+        Require(sceNpAuthWaitAsync(request, &result) == invalidId);
+        Require(result == sentinel);
+    }
+}
+
+static void CheckUnstartedAborts() {
+    constexpr int aborted = static_cast<int>(0x80550304);
+    alignas(8) char parameter[16]{};
+    alignas(8) char output[16]{};
+    for (const bool async : {false, true}) {
+        const int request = async ? sceNpAuthCreateAsyncRequest(nullptr) : sceNpAuthCreateRequest();
+        Require(request > 0);
+        RequireUnstarted(request);
+        Require(sceNpAuthAbortRequest(request) == 0);
+        Require(sceNpAuthAbortRequest(request) == 0);
+        RequireUnstarted(request);
+        for (auto getter : {sceNpAuthGetIdToken, sceNpAuthGetIdTokenV3, sceNpAuthGetAuthorizationCode}) {
+            Require(getter(request, parameter, output) == aborted);
+            RequireUnstarted(request);
+        }
+        int issuer = 0x2468ace;
+        Require(sceNpAuthGetAuthorizationCodeV3(request, parameter, output, &issuer) == aborted);
+        Require(issuer == 0x2468ace);
+        RequireUnstarted(request);
+        Require(sceNpAuthDeleteRequest(request) == 0);
+    }
+}
+
 int main() {
+    CheckUnstartedAborts();
     constexpr int invalidArgument = static_cast<int>(0x80550301);
     constexpr int signedOut = static_cast<int>(0x80550006);
     constexpr int aborted = static_cast<int>(0x80550304);
@@ -130,8 +151,8 @@ int main() {
     Require(sceNpAuthGetIdTokenV3(abortedReq, param, token) == aborted);
     Require(sceNpAuthGetAuthorizationCodeV3(abortedReq, param, authCode, &issuerId) == aborted);
     int abortedWait = 0;
-    Require(sceNpAuthWaitAsync(abortedReq, &abortedWait) == 0);
-    Require(abortedWait == aborted);
+    Require(sceNpAuthWaitAsync(abortedReq, &abortedWait) == invalidId);
+    Require(abortedWait == 0);
 
     const int syncReqA = sceNpAuthCreateRequest();
     Require(sceNpAuthGetIdTokenA(syncReqA, nullptr, token) == invalidArgument);
diff --git a/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp b/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp
index a5d7f6fe17..b644c62ed3 100644
--- a/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp
+++ b/core/libs/tests/GuestNpAuthAuthorizedAppCode.cpp
@@ -1,14 +1,9 @@
+#include "prx/libSceNpAuth/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpAuthCreateRequest();
-int APS5_VABI sceNpAuthDeleteRequest(int);
-int APS5_VABI sceNpAuthGetAuthorizedAppCode(std::int32_t, const NpAuthAuthorizedAppCodeParameter*, char*, std::int32_t*, bool*);
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
@@ -41,6 +36,7 @@ int main() {
     bool threw = false;
     try {
         sceNpAuthGetAuthorizedAppCode(requestId, &parameter, code.data(), nullptr, &authorizationRequired);
+
     } catch (const std::logic_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp b/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp
index aedef7375a..a8fecd529b 100644
--- a/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp
+++ b/core/libs/tests/GuestNpAuthAuthorizedAppDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpAuthAuthorizedAppDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -5,18 +6,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceNpAuthAuthorizedAppDialogInitialize(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogOpen(const NpAuthAuthorizedAppDialogParam* param);
-int APS5_VABI sceNpAuthAuthorizedAppDialogUpdateStatus(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogGetStatus(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogGetResult(std::int32_t* result);
-int APS5_VABI sceNpAuthAuthorizedAppDialogClose(void);
-int APS5_VABI sceNpAuthAuthorizedAppDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestNpCommerceDialog.cpp b/core/libs/tests/GuestNpCommerceDialog.cpp
index 9cb602b2b0..58383cb878 100644
--- a/core/libs/tests/GuestNpCommerceDialog.cpp
+++ b/core/libs/tests/GuestNpCommerceDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCommerce/include/Api.hpp"
 #include "ProcessParametersFixture.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 #include <array>
@@ -9,19 +10,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceNpCommerceDialogInitialize();
-int APS5_VABI sceNpCommerceDialogOpen(const NpCommerceDialogParam* param);
-int APS5_VABI sceNpCommerceDialogOpen2(const NpCommerceDialogParam2* param);
-int APS5_VABI sceNpCommerceDialogUpdateStatus(void);
-int APS5_VABI sceNpCommerceDialogGetStatus(void);
-int APS5_VABI sceNpCommerceDialogGetResult(NpCommerceDialogResult* result);
-int APS5_VABI sceNpCommerceDialogClose(void);
-int APS5_VABI sceNpCommerceDialogTerminate();
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -31,6 +19,7 @@ alignas(16) std::array<std::byte, 64> process{};
 constexpr int statusNone = 0;
 constexpr int statusInitialized = 1;
 constexpr int statusFinished = 3;
+constexpr int errorAlreadyInitialized = static_cast<int>(0x80B80004u);
 constexpr std::int32_t resultUserCanceled = 1;
 
 void RequireCanceledResult(std::uint64_t userData, bool clearsReserved) {
@@ -72,6 +61,19 @@ int main() {
     Require(sceNpCommerceDialogGetResult(nullptr) == static_cast<int>(0x80B8000Du));
     NpCommerceDialogResult result{};
     Require(sceNpCommerceDialogGetResult(&result) == static_cast<int>(0x80B80003u));
+
+    Require(sceNpCommerceDialogInitializeInternal() == 0);
+    Require(sceNpCommerceDialogGetStatus() == statusInitialized);
+    Require(sceNpCommerceDialogInitializeInternal() == errorAlreadyInitialized);
+    Require(sceNpCommerceDialogInitialize() == errorAlreadyInitialized);
+    Require(sceNpCommerceDialogGetStatus() == statusInitialized);
+    Require(sceNpCommerceDialogTerminate() == 0);
+    Require(sceNpCommerceDialogGetStatus() == statusNone);
+    Require(sceNpCommerceDialogInitialize() == 0);
+    Require(sceNpCommerceDialogInitializeInternal() == errorAlreadyInitialized);
+    Require(sceNpCommerceDialogGetStatus() == statusInitialized);
+    Require(sceNpCommerceDialogTerminate() == 0);
+    Require(sceNpCommerceDialogGetStatus() == statusNone);
     Require(sceNpCommerceDialogInitialize() == 0);
     Require(sceNpCommerceDialogClose() == static_cast<int>(0x80B8000Bu));
     Require(sceNpCommerceDialogGetResult(&result) == static_cast<int>(0x80B80005u));
@@ -142,6 +144,7 @@ int main() {
     bool threw = false;
     try {
         sceNpCommerceDialogOpen2(&param2);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestNpCommon.cpp b/core/libs/tests/GuestNpCommon.cpp
new file mode 100644
index 0000000000..fc8817dbf1
--- /dev/null
+++ b/core/libs/tests/GuestNpCommon.cpp
@@ -0,0 +1,148 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+static constexpr int INVALID_ARGUMENT = static_cast<int>(0x80550003);
+static constexpr int INVALID_PLATFORM_TYPE = static_cast<int>(0x80550004);
+static constexpr int NOT_MATCH = static_cast<int>(0x80550609);
+static constexpr int COND_TIMEDOUT = static_cast<int>(0x8055800B);
+static constexpr int MUTEX_BUSY = static_cast<int>(0x8055800F);
+
+static bool expect(bool condition, const char* message) {
+    if (!condition) std::fprintf(stderr, "%s\n", message);
+    return condition;
+}
+
+static NpOnlineId onlineId(const char* text) {
+    NpOnlineId id{};
+    std::strncpy(id.data, text, sizeof(id.data));
+    return id;
+}
+
+static NpIdFull npIdWithTag(const char* handle, std::uint32_t tag) {
+    NpIdFull id{};
+    id.handle = onlineId(handle);
+    std::memcpy(id.opt + 4, &tag, sizeof(tag));
+    return id;
+}
+
+static int testIds() {
+    const NpOnlineId kestrel = onlineId("kestrel_77");
+    const NpOnlineId kestrelCopy = onlineId("kestrel_77");
+    const NpOnlineId heron = onlineId("heron-4");
+    bool ok = expect(sceNpCmpOnlineId(nullptr, &kestrel) == INVALID_ARGUMENT, "a null online ID was compared");
+    ok &= expect(sceNpCmpOnlineId(&kestrel, &kestrelCopy) == 0, "equal online IDs did not match");
+    ok &= expect(sceNpCmpOnlineId(&kestrel, &heron) == NOT_MATCH, "different online IDs matched");
+
+    NpIdFull low = npIdWithTag("kestrel_77", 0x00347370);
+    NpIdFull high = low;
+    high.reserved[7] = 1;
+    std::int32_t order = 5;
+    ok &= expect(sceNpCmpNpIdInOrder(&low, &high, nullptr) == INVALID_ARGUMENT, "a null order was accepted");
+    ok &= expect(sceNpCmpNpIdInOrder(&low, &high, &order) == 0 && order == -1, "reserved bytes did not order the NpIds");
+    ok &= expect(sceNpCmpNpIdInOrder(&high, &low, &order) == 0 && order == 1, "the reverse order is not 1");
+    ok &= expect(sceNpCmpNpIdInOrder(&low, &low, &order) == 0 && order == 0, "an NpId is not equal to itself");
+    high = low;
+    high.opt[0] = 9;
+    high.reserved[0] = 0;
+    low.reserved[0] = 200;
+    ok &= expect(sceNpCmpNpIdInOrder(&low, &high, &order) == 0 && order == -1, "opt did not take precedence over reserved");
+    const NpIdFull heronId = npIdWithTag("heron-4", 0);
+    ok &= expect(sceNpCmpNpIdInOrder(&heronId, &low, &order) == 0 && order == -1, "the handle did not take precedence");
+
+    const NpIdFull none = npIdWithTag("heron-4", 0);
+    const NpIdFull ps3 = npIdWithTag("heron-4", 0x00337370);
+    const NpIdFull vita = npIdWithTag("heron-4", 0x32707370);
+    const NpIdFull ps4 = npIdWithTag("heron-4", 0x00347370);
+    const NpIdFull other = npIdWithTag("heron-4", 0x00357370);
+    ok &= expect(sceNpGetPlatformType(nullptr) == INVALID_ARGUMENT, "a null NpId has a platform");
+    ok &= expect(sceNpGetPlatformType(&none) == 0, "an untagged NpId is not platform 0");
+    ok &= expect(sceNpGetPlatformType(&ps3) == 1, "the ps3 tag is not platform 1");
+    ok &= expect(sceNpGetPlatformType(&vita) == 2, "the psp2 tag is not platform 2");
+    ok &= expect(sceNpGetPlatformType(&ps4) == 3, "the ps4 tag is not platform 3");
+    ok &= expect(sceNpGetPlatformType(&other) == INVALID_PLATFORM_TYPE, "an unknown tag was accepted");
+
+    NpOnlineId unterminated = onlineId("abcdefghijklmnop");
+    unterminated.data[16] = 'q';
+    ok &= expect(sceNpIntIsValidOnlineId(nullptr) == 0, "a null online ID is valid");
+    ok &= expect(sceNpIntIsValidOnlineId(&kestrel) == 1, "kestrel_77 is not valid");
+    ok &= expect(sceNpIntIsValidOnlineId(&heron) == 1, "heron-4 is not valid");
+    const NpOnlineId sixteen = onlineId("abcdefghijklmnop");
+    const NpOnlineId shortId = onlineId("ab");
+    const NpOnlineId leadingDash = onlineId("-heron");
+    const NpOnlineId dotted = onlineId("her.on");
+    ok &= expect(sceNpIntIsValidOnlineId(&sixteen) == 1, "a 16 character ID is not valid");
+    ok &= expect(sceNpIntIsValidOnlineId(&unterminated) == 0, "an unterminated ID is valid");
+    ok &= expect(sceNpIntIsValidOnlineId(&shortId) == 0, "a 2 character ID is valid");
+    ok &= expect(sceNpIntIsValidOnlineId(&leadingDash) == 0, "an ID starting with '-' is valid");
+    ok &= expect(sceNpIntIsValidOnlineId(&dotted) == 0, "an ID with '.' is valid");
+    return ok ? 0 : 1;
+}
+
+static void* APS5_VABI returnTicket(void* arg) {
+    return reinterpret_cast<void*>(reinterpret_cast<std::uintptr_t>(arg) + 1);
+}
+
+static int testSync() {
+    PthreadMutex plain = nullptr;
+    PthreadMutex recursive = nullptr;
+    bool ok = expect(sceNpMutexInit(&plain, "np-plain", 0) == 0 && plain, "a plain mutex was not created");
+    ok &= expect(sceNpLwMutexInit(&recursive, "np-recursive", 1) == 0 && recursive, "a recursive mutex was not created");
+    if (!ok) return 1;
+    ok &= expect(sceNpMutexLock(&plain) == 0, "the plain mutex did not lock");
+    ok &= expect(sceNpMutexTryLock(&plain) == MUTEX_BUSY, "a held plain mutex did not report BUSY");
+    ok &= expect(sceNpMutexUnlock(&plain) == 0, "the plain mutex did not unlock");
+    ok &= expect(sceNpLwMutexTryLock(&recursive) == 0 && sceNpLwMutexTryLock(&recursive) == 0, "flag 1 did not make the mutex recursive");
+    ok &= expect(sceNpLwMutexUnlock(&recursive) == 0 && sceNpLwMutexUnlock(&recursive) == 0, "the recursive mutex did not unlock twice");
+    ok &= expect(sceNpLwMutexLock(&recursive) == 0, "the recursive mutex did not lock via sceNpLwMutexLock");
+    ok &= expect(sceNpLwMutexUnlock(&recursive) == 0, "the recursive mutex did not unlock");
+    ok &= expect(sceNpLwMutexDestroy(&recursive) == 0, "the recursive mutex was not destroyed");
+
+    PthreadCond cond = nullptr;
+    ok &= expect(sceNpCondInit(&cond, "np-cond", 0) == 0 && cond, "a condition was not created");
+    ok &= expect(sceNpMutexLock(&plain) == 0, "the plain mutex did not lock for the wait");
+    ok &= expect(sceNpCondTimedwait(&cond, &plain, 2000) == COND_TIMEDOUT, "a timed wait did not report TIMEDOUT");
+    ok &= expect(sceNpMutexUnlock(&plain) == 0, "the mutex was not held after the wait");
+    ok &= expect(sceNpCondSignal(&cond) == 0, "signalling without waiters failed");
+    ok &= expect(sceNpCondDestroy(&cond) == 0, "the condition was not destroyed");
+    ok &= expect(sceNpMutexDestroy(&plain) == 0, "the plain mutex was not destroyed");
+
+    Pthread thread = nullptr;
+    void* retval = nullptr;
+    ok &= expect(scePthreadCreate(&thread, nullptr, returnTicket, reinterpret_cast<void*>(0x4140), "np-join") == 0, "the thread was not created");
+    ok &= expect(sceNpJoinThread(thread, &retval) == 0 && retval == reinterpret_cast<void*>(0x4141), "the join did not return the thread result");
+    return ok ? 0 : 1;
+}
+
+static int testClock() {
+    KernelTimespec before{};
+    KernelTimespec after{};
+    std::int64_t usec = -1;
+    sceKernelClockGettime(4, &before);
+
+    bool ok = expect(sceNpGetSystemClockUsec(&usec) == 0, "the clock was not read");
+    sceKernelClockGettime(4, &after);
+
+    ok &= expect(usec >= before.tv_sec * 1000000 + before.tv_nsec / 1000 && usec <= after.tv_sec * 1000000 + after.tv_nsec / 1000, "the clock is not the monotonic kernel clock in microseconds");
+    char version[12];
+    std::memset(version, 'x', sizeof(version));
+    sceNpGetSdkVersion(version);
+
+    ok &= expect(std::strcmp(version, "1.00") == 0, "the version is not 1.00");
+    ok &= expect(version[8] == 'x', "the version was written past 8 bytes");
+    return ok ? 0 : 1;
+}
+
+int main(int argc, char** argv) {
+    if (argc != 2) return 2;
+    int status = 2;
+    if (std::strcmp(argv[1], "ids") == 0) status = testIds();
+    else if (std::strcmp(argv[1], "sync") == 0) status = testSync();
+    else if (std::strcmp(argv[1], "clock") == 0) status = testClock();
+    if (status == 0) std::printf("NpCommon %s tests passed\n", argv[1]);
+    return status;
+}
diff --git a/core/libs/tests/GuestNpCommonRuntime.cpp b/core/libs/tests/GuestNpCommonRuntime.cpp
new file mode 100644
index 0000000000..7b2ad35b4c
--- /dev/null
+++ b/core/libs/tests/GuestNpCommonRuntime.cpp
@@ -0,0 +1,414 @@
+#include "prx/libSceNpCommon/include/Api.hpp"
+#include "SceTypes.hpp"
+
+#include <atomic>
+#include <chrono>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <thread>
+
+namespace {
+
+constexpr int NpIpcAlreadyInitialized = static_cast<int>(0x80559D00);
+constexpr int NpIpcNotInitialized = static_cast<int>(0x80559D01);
+constexpr int NpOutOfMemory = static_cast<int>(0x80550005);
+constexpr int NpNullObject = static_cast<int>(0x80558005);
+constexpr int NpNotInitialized = static_cast<int>(0x80558001);
+constexpr int NpAlreadyInitialized = static_cast<int>(0x80558002);
+constexpr int NpAlreadyQueued = static_cast<int>(0x80558006);
+constexpr int NpUtilInvalid = static_cast<int>(0x80550601);
+constexpr int NpUtilBufferTooSmall = static_cast<int>(0x80550602);
+constexpr int NpUtilOutOfRange = static_cast<int>(0x8055060A);
+constexpr int NpUtilInvalidCharacter = static_cast<int>(0x80550608);
+constexpr int NpInvalidFormat = static_cast<int>(0x80558003);
+constexpr int NpInvalidCharacter = static_cast<int>(0x80558004);
+constexpr int NpBufferTooSmall = static_cast<int>(0x80558008);
+constexpr int NpOutOfRange = static_cast<int>(0x8055800E);
+constexpr int NpInvalidArgument = static_cast<int>(0x80558009);
+constexpr int NpEventFlagBusy = static_cast<int>(0x8055800C);
+constexpr int NpSemaBusy = static_cast<int>(0x8055800D);
+constexpr std::uint32_t EventFlagWaitAnd = 1;
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::abort();
+}
+
+void* APS5_VABI ReturnArgument(void* arg) {
+    Pthread self {};
+    Require(sceNpThreadGetId(&self) == 0 && self != nullptr, "a created thread can read its id");
+    return arg;
+}
+
+void TestAtomics() {
+    std::int32_t value = 5;
+    Require(sceNpAtomicInc32(&value) == 5 && value == 6, "increment returns the previous value");
+    Require(sceNpAtomicDec32(&value) == 6 && value == 5, "decrement returns the previous value");
+    Require(sceNpAtomicCas32(&value, 4, 9) == 5 && value == 5, "a failed compare-and-swap returns the current value");
+    Require(sceNpAtomicCas32(&value, 5, 9) == 5 && value == 9, "a successful compare-and-swap returns the previous value");
+}
+
+void TestSemaphoresAndFlags() {
+    KernelSema sema {};
+    Require(sceNpCreateSema(&sema, 0, 0, 2, "NpSema") == 0, "a semaphore is created");
+    Require(sceNpPollSema(sema) == NpSemaBusy, "an empty semaphore reports the busy error");
+    Require(sceNpSignalSema(sema) == 0 && sceNpPollSema(sema) == 0, "a signalled semaphore can be taken once");
+    Require(sceNpDeleteSema(sema) == 0, "the semaphore is deleted");
+
+    KernelEventFlag flag {};
+    Require(sceNpCreateEventFlag(&flag, "NpFlag", 0, 0) == 0, "an event flag is created");
+    std::uint64_t result = 0;
+    Require(sceNpPollEventFlag(flag, 1, EventFlagWaitAnd, &result) == NpEventFlagBusy, "a clear event flag reports the busy error");
+    Require(sceNpSetEventFlag(flag, 1) == 0 && sceNpPollEventFlag(flag, 1, EventFlagWaitAnd, &result) == 0 && result == 1, "a set bit is polled");
+    Require(sceNpDeleteEventFlag(flag) == 0, "the event flag is deleted");
+}
+
+void TestThreads() {
+    Require(sceNpThreadGetId(nullptr) == NpInvalidArgument, "a null thread id output is refused");
+    Pthread thread {};
+    int marker = 0;
+    Require(sceNpCreateThread(&thread, ReturnArgument, &marker, 0, 0x10000, 0, "NpThread") == 0, "a thread is created");
+    void* value = nullptr;
+    Require(sceNpJoinThread(thread, &value) == 0 && value == &marker, "the thread is joined with its return value");
+}
+
+void UseAllocator(const NpAllocator& allocator) {
+    auto* block = static_cast<std::uint8_t*>(allocator.allocate(64, allocator.context));
+    Require(block != nullptr, "the allocator hands out memory");
+    block[63] = 0x5A;
+    block = static_cast<std::uint8_t*>(allocator.reallocate(block, 256, allocator.context));
+    Require(block != nullptr && block[63] == 0x5A, "reallocation keeps the contents");
+    allocator.release(block, allocator.context);
+    allocator.release(nullptr, allocator.context);
+}
+
+void TestHeaps() {
+    NpMemoryHeap memoryHeap {};
+    Require(sceNpMemoryHeapInit(nullptr, 0x1000, "np-test") == NpNullObject, "a null memory heap is refused");
+    Require(sceNpMemoryHeapInit(&memoryHeap, 0x1001, "np-test") == 0, "a memory heap is created");
+    Require(memoryHeap.memory.size == 0x4000 && memoryHeap.memory.address != nullptr && memoryHeap.heap.mspace != nullptr,
+        "the memory heap size is rounded up to 16 KiB");
+    NpAllocatorEx allocatorEx {};
+    sceNpMemoryHeapGetAllocatorEx(&memoryHeap, 0x1234, &allocatorEx);
+
+    Require(allocatorEx.allocator.context == &memoryHeap && allocatorEx.outOfMemoryError == 0x1234,
+        "the extended allocator carries the caller's error code");
+    UseAllocator(allocatorEx.allocator);
+    sceNpMemoryHeapDestroy(&memoryHeap);
+
+    Require(memoryHeap.memory.address == nullptr && memoryHeap.heap.mspace == nullptr, "destroying clears the memory heap");
+
+    NpKernelMemory memory {};
+    void* address = nullptr;
+    Require(sceNpAllocateKernelMemoryWithAlignment(0x10, "np-test", &address, nullptr) == NpNullObject,
+        "kernel memory needs an object");
+    Require(sceNpAllocateKernelMemoryWithAlignment(0x10, "np-test", &address, &memory) == 0
+            && address == memory.address && memory.size == 0x4000,
+        "kernel memory is mapped in 16 KiB units");
+    NpHeap heap {};
+    Require(sceNpHeapInit(&heap, memory.address, memory.size, "np-test") == 0 && heap.mspace != nullptr, "a heap is created");
+    NpAllocator allocator {};
+    sceNpHeapGetAllocator(&heap, &allocator);
+
+    Require(allocator.context == &heap, "the heap allocator uses the heap as its context");
+    UseAllocator(allocator);
+    NpHeapStat stat {};
+    Require(sceNpHeapGetStat(&heap, &stat) == 0 && stat.maxInuseSize >= stat.currentInuseSize, "heap statistics are reported");
+    sceNpHeapDestroy(&heap);
+
+    Require(heap.mspace == nullptr, "destroying clears the heap");
+    Require(sceNpFreeKernelMemory(&memory) == 0 && memory.address == nullptr, "kernel memory is released");
+    Require(sceNpFreeKernelMemory(nullptr) == NpNullObject, "freeing needs an object");
+
+    Require(sceNpArchInit() == 0 && sceNpArchInit() == 0, "the library initialises more than once");
+    NpAllocatorEx* global = sceNpGlobalHeapGetAllocatorExPtr();
+    Require(global->outOfMemoryError == NpOutOfMemory, "the global allocator reports the library's out-of-memory error");
+    UseAllocator(global->allocator);
+    sceNpArchTerm();
+
+    UseAllocator(sceNpGlobalHeapGetAllocatorExPtr()->allocator);
+    sceNpArchTerm();
+
+    Require(sceNpIpc2ClientTerm() == NpIpcNotInitialized, "the ipc client must be started before it stops");
+    Require(sceNpIpc2ClientInit() == 0 && sceNpIpc2ClientInit() == NpIpcAlreadyInitialized, "the ipc client starts once");
+    Require(sceNpIpc2ClientTerm() == 0 && sceNpIpc2ClientInit() == 0 && sceNpIpc2ClientTerm() == 0, "the ipc client restarts");
+}
+
+struct CalloutRecord {
+    std::atomic<int> order {0};
+    std::atomic<int> first {0};
+    std::atomic<int> second {0};
+};
+
+CalloutRecord g_callouts;
+
+void APS5_VABI RecordFirst(void*) {
+    g_callouts.first = ++g_callouts.order;
+}
+
+void APS5_VABI RecordSecond(void*) {
+    g_callouts.second = ++g_callouts.order;
+}
+
+void APS5_VABI RecordUnexpected(void*) {
+    Require(false, "a stopped callout does not run");
+}
+
+void TestCallouts() {
+    NpCalloutContext context {};
+    NpCallout callout {};
+    Require(sceNpCalloutStartOnCtx(&context, &callout, 0, RecordFirst, nullptr) == NpNotInitialized, "a context must be initialised first");
+    Require(sceNpCalloutInitCtx(&context, "np-callout", 0x4000, 0, 0) == 0, "a callout context starts");
+    Require(sceNpCalloutInitCtx(&context, "np-callout", 0x4000, 0, 0) == NpAlreadyInitialized, "a context starts once");
+
+    NpCallout stopped {};
+    int wasPending = 0;
+    Require(sceNpCalloutStartOnCtx(&context, &stopped, 60000000, RecordUnexpected, nullptr) == 0, "a distant callout is queued");
+    Require(sceNpCalloutStartOnCtx(&context, &stopped, 60000000, RecordUnexpected, nullptr) == NpAlreadyQueued,
+        "a queued callout cannot be queued again");
+    Require(sceNpCalloutStopOnCtx(&context, &stopped, &wasPending) == 0 && wasPending == 1, "a queued callout is removed");
+    Require(sceNpCalloutStopOnCtx(&context, &stopped, &wasPending) == 0 && wasPending == 0, "removing twice reports nothing pending");
+
+    NpCallout queuedFirst {};
+    NpCallout queuedSecond {};
+    Require(sceNpCalloutStartOnCtx(&context, &queuedFirst, 30000000, RecordUnexpected, nullptr) == 0, "an earlier distant callout is queued");
+    Require(sceNpCalloutStartOnCtx(&context, &queuedSecond, 60000000, RecordUnexpected, nullptr) == 0, "a later distant callout is queued");
+    const std::uint64_t queuedDeadline = queuedFirst.deadline;
+    Require(sceNpCalloutStartOnCtx(&context, &queuedFirst, 0, RecordFirst, &context) == NpAlreadyQueued,
+        "the earlier callout cannot be queued again");
+    Require(queuedFirst.next == &queuedSecond && queuedFirst.deadline == queuedDeadline && queuedFirst.handler == RecordUnexpected &&
+        queuedFirst.arg == nullptr, "a rejected start leaves the queued callout unchanged");
+    Require(sceNpCalloutStopOnCtx(&context, &queuedSecond, &wasPending) == 0 && wasPending == 1,
+        "the later callout is still pending after the rejected start");
+    Require(sceNpCalloutStopOnCtx(&context, &queuedFirst, &wasPending) == 0 && wasPending == 1, "the earlier callout is still pending");
+
+    NpCallout later {};
+    Require(sceNpCalloutStartOnCtx(&context, &later, 20000, RecordSecond, nullptr) == 0, "a later callout is queued");
+    Require(sceNpCalloutStartOnCtx(&context, &callout, 1000, RecordFirst, nullptr) == 0, "an earlier callout is queued");
+    for (int i = 0; i < 2000 && g_callouts.second == 0; ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    Require(g_callouts.first == 1 && g_callouts.second == 2, "callouts run in deadline order");
+    sceNpCalloutTermCtx(&context);
+
+    Require(context.initialized == 0, "terminating clears the context");
+    sceNpCalloutTermCtx(&context);
+
+}
+
+bool Equals(const char* actual, const char* expected) {
+    return std::strcmp(actual, expected) == 0;
+}
+
+void TestIds() {
+    Require(sceNpUtilCmpAccountId(7, 7) == 0 && sceNpUtilCmpAccountId(7, 8) == 1, "account ids compare for equality");
+
+    constexpr int NullArgument = static_cast<int>(0x80550003);
+    constexpr int InvalidNpId = static_cast<int>(0x80550605);
+    constexpr int NotMatch = static_cast<int>(0x80550609);
+    auto makeNpId = [](const char* name, std::uint32_t opt, std::uint32_t platform) {
+        std::array<std::uint8_t, 0x24> id{};
+        std::memcpy(id.data(), name, std::strlen(name));
+        std::memcpy(id.data() + 0x14, &opt, sizeof(opt));
+        std::memcpy(id.data() + 0x18, &platform, sizeof(platform));
+        id[0x1C] = 1;
+        return id;
+    };
+    const auto alice = makeNpId("Alice_01", 5, 0x11223344);
+    auto other = alice;
+    Require(sceNpCmpNpId(nullptr, alice.data()) == NullArgument && sceNpCmpNpId(alice.data(), nullptr) == NullArgument, "null NpIds are refused");
+    Require(sceNpCmpNpId(alice.data(), other.data()) == 0, "identical NpIds match");
+    other[0x1C] = 0;
+    Require(sceNpCmpNpId(alice.data(), other.data()) == InvalidNpId && sceNpCmpNpId(other.data(), alice.data()) == InvalidNpId, "the flag byte at 0x1C must be 1");
+    Require(sceNpCmpNpId(makeNpId("Bob-2", 5, 0x11223344).data(), alice.data()) == NotMatch, "different online ids do not match");
+    Require(sceNpCmpNpId(makeNpId("Alice_01", 6, 0x11223344).data(), alice.data()) == NotMatch, "different words at 0x14 do not match");
+    Require(sceNpCmpNpId(makeNpId("Alice_01", 5, 0).data(), alice.data()) == 0, "an empty first byte at 0x18 on the first id matches");
+    Require(sceNpCmpNpId(alice.data(), makeNpId("Alice_01", 5, 0).data()) == 0, "an empty first byte at 0x18 on the second id matches");
+    Require(sceNpCmpNpId(alice.data(), makeNpId("Alice_01", 5, 0x11223355).data()) == NotMatch, "different words at 0x18 do not match");
+
+    Require(sceNpIntIsOnlineIdString("Alice_01") && sceNpIntIsOnlineIdString("Bob-2"), "letters, digits, '_' and '-' are allowed");
+    Require(!sceNpIntIsOnlineIdString("ab") && !sceNpIntIsOnlineIdString("abcdefghijklmnopq"), "online ids are 3 to 16 characters");
+    Require(!sceNpIntIsOnlineIdString("1abc") && !sceNpIntIsOnlineIdString("ab.c") && !sceNpIntIsOnlineIdString(nullptr),
+        "online ids start with a letter and use no other symbols");
+}
+
+void TestJsonText() {
+    char escaped[64] = {};
+    Require(sceNpUtilJsonEscape(escaped, sizeof(escaped), "a\"b/\n\x01", 7) == 0 && Equals(escaped, "a\\\"b\\/\\n\\u0001"),
+        "json escaping covers quotes, solidus, newlines and controls");
+    std::strcpy(escaped, "x");
+    Require(sceNpUtilJsonEscape(escaped, sizeof(escaped), "yz", 2) == 0 && Equals(escaped, "xyz"), "escaping appends to the buffer");
+    Require(sceNpUtilJsonEscape(escaped, 6, "a", 1) == NpUtilBufferTooSmall, "escaping needs room for one escape");
+    Require(sceNpUtilJsonEscape(escaped, sizeof(escaped), nullptr, 1) == NpUtilInvalid, "escaping needs a source");
+
+    char text[32] = {};
+    std::size_t length = 0;
+    Require(sceNpUtilJsonUnescape(text, sizeof(text), "a\\nb\\u0041", 10, &length) == 0 && Equals(text, "a\nbA") && length == 5,
+        "json unescaping decodes escapes and counts the terminator");
+    Require(sceNpUtilJsonUnescape(text, sizeof(text), "\\uD83D\\uDE00", 12, &length) == 0 && Equals(text, "\xF0\x9F\x98\x80")
+            && length == 5,
+        "surrogate pairs become one UTF-8 character");
+    Require(sceNpUtilJsonUnescape(text, sizeof(text), "\\u00G1", 6, &length) == NpUtilBufferTooSmall && Equals(text, "\\u00G1"),
+        "a bad unicode escape is copied and reported");
+    Require(sceNpUtilJsonUnescape(nullptr, sizeof(text), "abc", 3, &length) == 0 && length == 4, "a null buffer reports the size");
+    Require(sceNpUtilJsonUnescape(text, 3, "abc", 3, &length) == NpUtilBufferTooSmall, "unescaping needs room for the terminator");
+
+    char one[4] = {};
+    std::size_t consumed = 0;
+    Require(sceNpUtilJsonGetOneChar(one, sizeof(one), "\\u00e9x", 7, &length, &consumed) == 0 && length == 2 && consumed == 6
+            && std::memcmp(one, "\xC3\xA9", 2) == 0,
+        "one escaped character is decoded");
+    Require(sceNpUtilJsonGetOneChar(one, sizeof(one), "\xE6\x97\xA5", 3, &length, &consumed) == 0 && length == 3 && consumed == 3,
+        "one UTF-8 character is copied");
+    Require(sceNpUtilJsonGetOneChar(one, sizeof(one), "\xE6\x97", 2, &length, &consumed) == NpUtilBufferTooSmall && length == 0
+            && consumed == 3,
+        "a cut UTF-8 character reports its full length");
+    Require(sceNpUtilJsonGetOneChar(one, 1, "\xC3\xA9", 2, &length, &consumed) == NpUtilBufferTooSmall && length == 2,
+        "a short buffer still reports the decoded size");
+
+    const char* character = nullptr;
+    const char* japanese = "\xE6\x97\xA5" "a";
+    Require(sceNpUtilGetNthChar(1, japanese, &character) == 0 && character == japanese + 3, "characters are counted, not bytes");
+    Require(sceNpUtilGetNthChar(10, "abc", &character) == 0 && *character == '\0', "counting stops at the end");
+    Require(sceNpUtilGetNthChar(2, "a\x01b", &character) == NpUtilInvalidCharacter, "control characters are refused");
+
+    char url[32] = {};
+    Require(sceNpUtilHttpUrlEncode(url, sizeof(url), "a b=c*", 6, &length) == 0 && Equals(url, "a+b%3Dc*") && length == 9,
+        "form encoding keeps the safe set and escapes the rest");
+    Require(sceNpUtilHttpUrlEncode(nullptr, 0, "@", 1, &length) == 0 && length == 4, "a null buffer reports the encoded size");
+    Require(sceNpUtilHttpUrlEncode(url, 3, "@", 1, &length) == NpUtilBufferTooSmall, "encoding needs room for the terminator");
+}
+
+void TestTitleIds() {
+    NpTitleIdParts parts {{'A', 'B', 'C', 'D', '1', '2', '3', '4', '5'}, 0, 7};
+    char titleId[13] = {};
+    Require(sceNpUtilBuildTitleId(&parts, titleId, sizeof(titleId)) == 0 && Equals(titleId, "ABCD12345_07"), "the index is two digits");
+    Require(sceNpUtilBuildTitleId(&parts, titleId, 12) == NpUtilBufferTooSmall, "a title id needs 13 bytes");
+    parts.index = 100;
+    Require(sceNpUtilBuildTitleId(&parts, titleId, sizeof(titleId)) == NpUtilOutOfRange, "the index is at most 99");
+}
+
+void TestLanguagesAndDebugIds() {
+    char code[6] = {};
+    char tag[36] = {};
+    Require(sceNpUtilGetNpLanguageCode(1, code) == 0 && Equals(code, "en"), "language 1 is English");
+    Require(sceNpUtilGetNpLanguageCode2(20, tag) == 0 && Equals(tag, "es-419"), "language 20 is Latin American Spanish");
+    Require(Equals(sceNpUtilGetNpLanguageCodeStr(11), "zh-CN") && Equals(sceNpUtilGetNpLanguageCode2Str(30), "uk-UA"),
+        "language strings are returned directly");
+    Require(sceNpUtilGetNpLanguageCode(31, code) == NpUtilInvalid && sceNpUtilGetNpLanguageCodeStr(31) == nullptr,
+        "unknown languages are refused");
+    Require(sceNpUtilGetNpLanguageCode2(0, nullptr) == NpUtilInvalid, "a language code needs a buffer");
+    const std::uint32_t first = sceNpDbgAssignDebugId();
+    Require(first != 0 && sceNpDbgAssignDebugId() == first + 1, "debug ids count up");
+}
+
+void TestBase64() {
+    const std::uint8_t payload[] = {1, 2, 3, 4, 5};
+    char text[16] = {};
+    Require(sceNpBase64Encoder(payload, text, 5) == 8 && Equals(text, "AQIDBAU="), "base64 pads the last group");
+    Require(sceNpBase64Encoder(payload, text, 0) == 0, "an empty payload encodes to nothing");
+    Require(sceNpBase64GetDecodeSize("AQIDBAU=", 8) == 5 && sceNpBase64GetDecodeSize("AQ==", 4) == 1,
+        "the decoded size follows the padding");
+    Require(sceNpBase64GetDecodeSize("", 0) == NpInvalidFormat && sceNpBase64GetDecodeSize("AQI", 3) == NpInvalidFormat,
+        "base64 needs whole groups");
+    Require(sceNpBase64GetDecodeSize("AQ=A", 4) == NpInvalidCharacter && sceNpBase64GetDecodeSize("A=AAAQID", 8) == NpInvalidCharacter,
+        "padding is only allowed at the end");
+    std::uint8_t bytes[8] = {};
+    Require(sceNpBase64Decoder("AQIDBAU=", 8, bytes, sizeof(bytes)) == 5 && std::memcmp(bytes, payload, 5) == 0,
+        "base64 decodes back to the payload");
+    Require(sceNpBase64Decoder("AQID", 4, bytes, 2) == NpInvalidFormat, "decoding refuses a short buffer");
+    Require(sceNpBase64Decoder("AQ?D", 4, bytes, 3) == NpInvalidCharacter, "decoding refuses characters outside the alphabet");
+
+    const std::uint8_t url[] = {0xFB, 0x00};
+    std::memset(text, 0, sizeof(text));
+    Require(sceNpBase64UrlEncoder(url, text, 1) == 2 && Equals(text, "-w"), "base64url leaves out the padding");
+    Require(sceNpBase64UrlEncoder(url, text, 2) == 3 && Equals(text, "-wA"), "base64url writes three characters for two bytes");
+    Require(sceNpBase64UrlGetDecodeSize("-wA", 3) == 2 && sceNpBase64UrlGetDecodeSize("-w==", 4) == 1,
+        "base64url accepts padded and unpadded tails");
+    Require(sceNpBase64UrlGetDecodeSize("", 0) == NpInvalidCharacter && sceNpBase64UrlGetDecodeSize("AAAAA", 5) == NpInvalidCharacter,
+        "a single trailing character cannot be decoded");
+    Require(sceNpBase64UrlGetDecodeSize("+w==", 4) == NpInvalidCharacter, "base64url refuses the standard alphabet");
+    Require(sceNpBase64UrlDecoder("-wA", 3, bytes, 2) == 2 && bytes[0] == 0xFB && bytes[1] == 0, "base64url decodes a short tail");
+    Require(sceNpBase64UrlDecoder("-w", 2, bytes, 0) == NpInvalidFormat, "base64url decoding refuses a short buffer");
+}
+
+void TestNumbers() {
+    Require(sceNpHexToInt('a') == 10 && sceNpHexToInt('F') == 15 && sceNpHexToInt('g') == -1, "hex digits are read");
+    Require(sceNpIntToHex(10, false) == 'a' && sceNpIntToHex(15, true) == 'F' && sceNpIntToHex(9, true) == '9', "hex digits are written");
+
+    char text[32] = {};
+    std::size_t length = 0;
+    Require(sceNpUInt32ToStr(text, sizeof(text), 255, 16, 3, &length) == 0 && Equals(text, "0XFF") && length == 4,
+        "the hex prefix follows the case flag");
+    Require(sceNpUInt32ToStr(text, sizeof(text), 8, 8, 2, &length) == 0 && Equals(text, "010") && length == 3, "octal gets a zero prefix");
+    Require(sceNpUInt32ToStr(text, sizeof(text), 0, 10, 4, &length) == 0 && Equals(text, "0") && length == 1, "zero has no sign");
+    Require(sceNpUInt32ToStr(text, 4, 1234, 10, 0, &length) == NpBufferTooSmall, "the terminator must fit");
+    Require(sceNpUInt32ToStr(text, sizeof(text), 1, 37, 0, &length) == NpInvalidArgument, "the radix is limited to 36");
+    Require(sceNpUInt32ToStr(nullptr, 0, 42, 10, 4, &length) == 0 && length == 3, "a null buffer reports the length");
+    Require(sceNpInt32ToStr(text, sizeof(text), -2147483647 - 1, 10, 0, &length) == 0 && Equals(text, "-2147483648"),
+        "a negative 32-bit value always has a sign");
+    Require(sceNpInt32ToStr(text, 3, -42, 10, 0, &length) == NpBufferTooSmall, "the sign takes buffer space");
+    Require(sceNpInt64ToStr(text, sizeof(text), -42, 10, 0, &length) == 0 && Equals(text, "42") && length == 2,
+        "a 64-bit value only gets a sign with the sign flag");
+    Require(sceNpInt64ToStr(text, sizeof(text), -42, 10, 4, &length) == 0 && Equals(text, "-42"), "the sign flag writes the minus");
+    Require(sceNpUInt64ToStr(text, sizeof(text), UINT64_MAX, 16, 3, &length) == 0 && Equals(text, "0XFFFFFFFFFFFFFFFF") && length == 18,
+        "the full 64-bit range is formatted");
+
+    std::int32_t value32 = 0;
+    std::size_t parsed = 0;
+    Require(sceNpStrToInt32("-567abc", &value32, 10, &parsed) == 0 && value32 == -567 && parsed == 4, "parsing stops at the first non-digit");
+    Require(sceNpStrToInt32("0x1A", &value32, 0, &parsed) == 0 && value32 == 26, "base zero follows the prefix");
+    Require(sceNpStrToInt32("invalid", &value32, 10, &parsed) == NpOutOfRange, "no digits is an error");
+    parsed = 0;
+    Require(sceNpStrToInt32("3000000000", &value32, 10, &parsed) == NpOutOfRange && parsed == 10,
+        "the length is reported before the 32-bit range check");
+    std::int64_t value64 = 0;
+    Require(sceNpStrToInt64("-9223372036854775808", &value64, 10, nullptr) == 0 && value64 == INT64_MIN, "the 64-bit minimum parses");
+    Require(sceNpStrToInt64("99999999999999999999", &value64, 10, nullptr) == NpOutOfRange, "64-bit overflow is an error");
+    std::uint32_t unsigned32 = 0;
+    Require(sceNpStrToUInt32("4294967295", &unsigned32, 10, nullptr) == 0 && unsigned32 == UINT32_MAX, "the 32-bit maximum parses");
+    Require(sceNpStrToUInt32("4294967296", &unsigned32, 10, nullptr) == NpOutOfRange, "32-bit unsigned overflow is an error");
+    std::uint64_t unsigned64 = 0;
+    Require(sceNpStrToUInt64("0xFFFFFFFFFFFFFFFF", &unsigned64, 0, nullptr) == 0 && unsigned64 == UINT64_MAX, "the 64-bit maximum parses");
+    Require(sceNpStrToUInt64("18446744073709551616", &unsigned64, 10, nullptr) == NpOutOfRange, "64-bit unsigned overflow is an error");
+}
+
+void TestHexAndCopies() {
+    const std::uint8_t data[] = {0x0A, 0xFE};
+    char text[8] = {};
+    Require(sceNpStrBuildHex(text, 5, data, 2, false) == 0 && Equals(text, "0afe"), "bytes are written as lowercase hex");
+    Require(sceNpStrBuildHex(text, 5, data, 2, true) == 0 && Equals(text, "0AFE"), "bytes are written as uppercase hex");
+    Require(sceNpStrBuildHex(text, 4, data, 2, false) == NpBufferTooSmall, "hex output needs room for the terminator");
+    std::uint8_t bytes[4] = {};
+    Require(sceNpStrParseHex("0aFE", bytes, 2) == 0 && bytes[0] == 0x0A && bytes[1] == 0xFE, "hex is read in either case");
+    Require(sceNpStrParseHex("0AF", bytes, 2) == NpInvalidArgument, "odd hex is refused");
+    Require(sceNpStrParseHex("0AFE", bytes, 1) == NpBufferTooSmall, "hex parsing checks the output size");
+    Require(sceNpStrParseHex("0AG1", bytes, 2) == NpInvalidArgument, "non-hex characters are refused");
+    Require(sceNpStrnParseHex("DEADBEEF1234", 8, bytes, 4) == 0 && bytes[0] == 0xDE && bytes[3] == 0xEF, "a hex prefix is read");
+
+    char copy[8] = {};
+    Require(sceNpStrcpyToBuf(copy, 6, "Hello") == 0 && Equals(copy, "Hello"), "a string that fits is copied");
+    Require(sceNpStrcpyToBuf(copy, 5, "Hello") == NpBufferTooSmall, "a string without room for its terminator is refused");
+    Require(sceNpStrncpyToBuf(copy, 6, "Hello World", 5) == 0 && Equals(copy, "Hello"), "the length limit sizes the copy");
+    Require(sceNpStrncpyToBuf(copy, 5, "Hello World", 5) == NpBufferTooSmall, "the limited string still needs a terminator");
+}
+
+}
+
+int main() {
+    TestAtomics();
+    TestSemaphoresAndFlags();
+    TestThreads();
+    TestHeaps();
+    TestBase64();
+    TestNumbers();
+    TestHexAndCopies();
+    TestCallouts();
+    TestIds();
+    TestLanguagesAndDebugIds();
+    TestJsonText();
+    TestTitleIds();
+    std::puts("guest np common runtime: PASS");
+}
diff --git a/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp b/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp
index 99f3f83152..13cc9a8491 100644
--- a/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp
+++ b/core/libs/tests/GuestNpCppWebApiIntrusivePtr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -7,57 +8,11 @@
 
 using Deleter = void (APS5_VABI*)(void*);
 
-struct IntrusivePtr {
-    void* object;
-    Deleter deleter;
-    void* libContext;
-};
-
 using Construct = void (APS5_VABI*)(IntrusivePtr*);
 using Copy = void (APS5_VABI*)(IntrusivePtr*, const IntrusivePtr*);
 using Destroy = void (APS5_VABI*)(IntrusivePtr*);
 using Access = void* (APS5_VABI*)(const IntrusivePtr*);
 
-extern "C" {
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEC1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEC1Ev(IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1ERS7_(IntrusivePtr*, const IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_(IntrusivePtr*, const IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEED1Ev(IntrusivePtr*);
-
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122GetRankingResponseBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V123RecordScoreResponseBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V15EntryEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6BinaryEEptEv(const IntrusivePtr*);
-void* APS5_VABI _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEEdeEv(const IntrusivePtr*);
-
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEED1Ev(IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEEC1EPNS2_10LibContextE(IntrusivePtr*, void*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEED1Ev(IntrusivePtr*);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEE8pushBackERKS8_(IntrusivePtr*, const IntrusivePtr*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1EPS6_PFvS8_EPNS2_10LibContextE(IntrusivePtr*, void*, Deleter, void*);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEED1Ev(IntrusivePtr*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static constexpr std::size_t ObjectSize = 0x40;
@@ -193,11 +148,13 @@ static void TestSharedOwnership() {
 
     IntrusivePtr owner;
     _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1Ev(&owner);
+
     owner.object = object;
     owner.deleter = RecordDelete;
 
     IntrusivePtr argument;
     _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_(&argument, &owner);
+
     Require(_ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEptEv(&argument) == object);
     Require(ReadCount(object, 0) == 2);
 
@@ -222,6 +179,7 @@ static void TestVectorPushBackReleasesElements() {
 
     IntrusivePtr vector;
     _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V126RequestPlayerSessionPlayerEEEEC1EPNS2_10LibContextE(&vector, &context);
+
     Require(vector.object == nullptr);
     Require(vector.deleter == nullptr);
     Require(vector.libContext == &context);
@@ -257,6 +215,7 @@ static void TestAdoptedVectorBodyDestroyedThroughDeleter() {
 
     IntrusivePtr vector;
     _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS2_6StringEEEEC1EPS6_PFvS8_EPNS2_10LibContextE(&vector, body, RecordDelete, &context);
+
     Require(vector.object == body);
     Require(vector.deleter == RecordDelete);
     Require(vector.libContext == &context);
@@ -279,6 +238,11 @@ int main() {
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V130GetBoardDefinitionResponseBodyEEC1Ev,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEEC1Ev,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEC1Ev,
     };
     for (const auto construct : constructors) TestConstruct(construct);
 
@@ -293,12 +257,39 @@ int main() {
         _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEEptEv,
         _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6BinaryEEptEv,
         _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEEdeEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V113BasicPresenceEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEE3getEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEE3getEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEdeEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEdeEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorImEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEdeEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEEptEv,
+        _ZNK3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEEdeEv,
     };
     for (const auto access : accessors) TestAccess(access);
 
     const Copy copies[] = {
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V121GetRankingRequestBodyEEC1ERS7_,
         _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V122RecordScoreRequestBodyEEC1ERS7_,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEEC1ERS7_,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEEC1ERS7_,
+        _ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEEC1ERS7_,
     };
     for (const auto copy : copies) TestCopy(copy);
 
@@ -311,6 +302,18 @@ int main() {
         {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V14UserEED1Ev, 0},
         {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_12Leaderboards2V19RecordApi26RecordScoreResponseHeadersEED1Ev, 0},
         {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_12Leaderboards2V15EntryEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_15ProfanityFilter2V219WebApiFilterRequestEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_18ResponseHeaderBaseEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6StringEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_11UserProfile2V113BasicPresenceEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V57ProductEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_13InGameCatalog2V59ContainerEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V132GetMultiDataStatusesResponseBodyEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS1_17TitleCloudStorage2V15OwnerEED1Ev, 0},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V53SkuEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V57ProductEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_13InGameCatalog2V59ContainerEEEEEED1Ev, VectorReferenceCountOffset},
+        {_ZN3sce2Np9CppWebApi6Common12IntrusivePtrINS2_6VectorINS3_INS1_17TitleCloudStorage2V110DataStatusEEEEEED1Ev, VectorReferenceCountOffset},
     };
     for (const auto& testCase : destructors) TestDestroy(testCase);
 
diff --git a/core/libs/tests/GuestNpCppWebApiOffline.cpp b/core/libs/tests/GuestNpCppWebApiOffline.cpp
new file mode 100644
index 0000000000..ed22df2b30
--- /dev/null
+++ b/core/libs/tests/GuestNpCppWebApiOffline.cpp
@@ -0,0 +1,30 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+using SelfCall = int (APS5_VABI*)(void*);
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", what);
+    std::abort();
+}
+
+static void TestIteratorDestructors() {
+    unsigned char iterator[0x20];
+    std::memset(iterator, 0x5a, sizeof(iterator));
+    const SelfCall destructors[] = {
+        _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_13InGameCatalog2V57ProductEEEED2Ev,
+        _ZN3sce2Np9CppWebApi6Common13ConstIteratorINS2_12IntrusivePtrINS1_17TitleCloudStorage2V110DataStatusEEEED2Ev,
+    };
+    for (const auto call : destructors) Require(call(iterator) == 0, "an iterator destructor failed");
+    for (const auto byte : iterator) Require(byte == 0x5a, "an iterator destructor wrote to the iterator");
+}
+
+int main() {
+    TestIteratorDestructors();
+    std::puts("NpCppWebApi offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpCppWebApiSignedOut.cpp b/core/libs/tests/GuestNpCppWebApiSignedOut.cpp
new file mode 100644
index 0000000000..826ceb8fa0
--- /dev/null
+++ b/core/libs/tests/GuestNpCppWebApiSignedOut.cpp
@@ -0,0 +1,126 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+static constexpr int NotSignedIn = static_cast<int>(0x80552907);
+
+using Object = int (APS5_VABI*)(void*);
+using Call = int (APS5_VABI*)();
+
+struct RequestFlow {
+    Object transactionConstruct;
+    Object transactionDestroy;
+    Call setOnFinishedCallback;
+    Call setResponseInformationOption;
+    Call start;
+    Call finish;
+    Call getResponseHeaders;
+    Object parameterConstruct;
+    Object parameterDestroy;
+    Call initialize;
+    Call terminate;
+    Call call;
+};
+
+static const RequestFlow flows[] = {
+    {
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv,
+        _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V118GetFriendsResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_,
+        _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsC1Ev,
+        _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriendsD1Ev,
+        _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends10initializeEPNS1_6Common10LibContextEPKc,
+        _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi21ParameterToGetFriends9terminateEv,
+        _ZN3sce2Np9CppWebApi11UserProfile2V110FriendsApi10getFriendsEiRKNS4_21ParameterToGetFriendsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_18GetFriendsResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE,
+    },
+    {
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv,
+        _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V124GetBlockingUsersResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_,
+        _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersC1Ev,
+        _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsersD1Ev,
+        _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers10initializeEPNS1_6Common10LibContextE,
+        _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi27ParameterToGetBlockingUsers9terminateEv,
+        _ZN3sce2Np9CppWebApi11UserProfile2V19BlocksApi16getBlockingUsersEiRKNS4_27ParameterToGetBlockingUsersERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_24GetBlockingUsersResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE,
+    },
+    {
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv,
+        _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_11UserProfile2V125GetBasicPresencesResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_,
+        _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesC1Ev,
+        _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresencesD1Ev,
+        _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences10initializeEPNS1_6Common10LibContextEPKc,
+        _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi28ParameterToGetBasicPresences9terminateEv,
+        _ZN3sce2Np9CppWebApi11UserProfile2V111PresenceApi17getBasicPresencesEiRKNS4_28ParameterToGetBasicPresencesERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_25GetBasicPresencesResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE,
+    },
+    {
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv,
+        _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_15ProfanityFilter2V223FilterProfanityResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_,
+        _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityC1Ev,
+        _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanityD1Ev,
+        _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity10initializeEPNS1_6Common10LibContextEPKcSA_NS6_12IntrusivePtrINS3_19WebApiFilterRequestEEE,
+        _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi26ParameterToFilterProfanity9terminateEv,
+        _ZN3sce2Np9CppWebApi15ProfanityFilter2V212ProfanityApi15filterProfanityEiRKNS4_26ParameterToFilterProfanityERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_23FilterProfanityResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE,
+    },
+    {
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEEC1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEED1Ev,
+        _ZN3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE21setOnFinishedCallbackEPFvliS8_PvEPFvliSC_ESC_,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE28setResponseInformationOptionEP37SceNpWebApi2ResponseInformationOption,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE5startEPNS2_10LibContextE,
+        _ZN3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE6finishEv,
+        _ZNK3sce2Np9CppWebApi6Common15TransactionBaseINS2_12IntrusivePtrINS1_30CommunicationRestrictionStatus2V338CommunicationRestrictionStatusResponseEEENS4_INS2_18ResponseHeaderBaseEEEE18getResponseHeadersERSA_,
+        _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusC1Ev,
+        _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatusD1Ev,
+        _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus10initializeEPNS1_6Common10LibContextEm,
+        _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi44ParameterToGetCommunicationRestrictionStatus9terminateEv,
+        _ZN3sce2Np9CppWebApi30CommunicationRestrictionStatus2V333CommunicationRestrictionStatusApi33getCommunicationRestrictionStatusEiRKNS4_44ParameterToGetCommunicationRestrictionStatusERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_38CommunicationRestrictionStatusResponseEEENSA_INS8_18ResponseHeaderBaseEEEEE,
+    },
+};
+
+static void TestRequestFlow(const RequestFlow& flow) {
+    alignas(16) unsigned char transaction[0x100];
+    alignas(16) unsigned char parameter[0x100];
+    std::memset(transaction, 0x5a, sizeof(transaction));
+    std::memset(parameter, 0x5a, sizeof(parameter));
+
+    Require(flow.transactionConstruct(transaction) == 0);
+    Require(flow.setOnFinishedCallback() == 0);
+    Require(flow.setResponseInformationOption() == 0);
+    Require(flow.parameterConstruct(parameter) == 0);
+    Require(flow.initialize() == 0);
+    Require(flow.call() == NotSignedIn);
+    Require(flow.start() == NotSignedIn);
+    Require(flow.getResponseHeaders() == NotSignedIn);
+    Require(flow.finish() == 0);
+    Require(flow.terminate() == 0);
+    Require(flow.parameterDestroy(parameter) == 0);
+    Require(flow.transactionDestroy(transaction) == 0);
+}
+
+int main() {
+    for (const auto& flow : flows) TestRequestFlow(flow);
+    Require(_ZN3sce2Np9CppWebApi15ProfanityFilter2V226WebApiFilterRequestFactory6createEPNS1_6Common10LibContextEPKcPNS5_12IntrusivePtrINS3_19WebApiFilterRequestEEE() == NotSignedIn);
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpCppWebApiString.cpp b/core/libs/tests/GuestNpCppWebApiString.cpp
index 18a4dd25a6..6d50a21eb3 100644
--- a/core/libs/tests/GuestNpCppWebApiString.cpp
+++ b/core/libs/tests/GuestNpCppWebApiString.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpCppWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,16 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(void* self, void* libContext);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6StringD1Ev(void* self);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6String6appendEPKc(void* self, const char* text);
-const char* APS5_VABI _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(const void* self);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(void* self, void* libContext);
-void APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(void* self);
-int APS5_VABI _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(void* self, const void* element);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -81,18 +72,17 @@ void TestConstructedStringIsEmpty() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
     Require(Load<std::int32_t>(storage, kReferenceCountOffset) == 0);
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
     Require(Load<std::uint64_t>(storage, kBufferSizeOffset) == 0);
     Require(Load<void*>(storage, kLibContextOffset) == &libContext);
     Require(GuardIntact(storage));
 
-    const char* text = _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes);
+    const char* text = _ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes));
     Require(text != nullptr && text[0] == '\0');
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
     Require(Load<std::uint64_t>(storage, kBufferSizeOffset) == 0);
     Require(GuardIntact(storage));
@@ -102,29 +92,28 @@ void TestNullLibContextIsStored() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, nullptr);
-
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), nullptr);
     Require(Load<void*>(storage, kLibContextOffset) == nullptr);
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
-    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes)[0] == '\0');
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes))[0] == '\0');
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
+
 }
 
 void TestAppendBuildsAndClearsBuffer() {
     std::uint64_t libContext = 1;
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, "rank") == 0);
-    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes), "rank") == 0);
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, "ing") == 0);
-    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes), "ranking") == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), "rank") == 0);
+    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes)), "rank") == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), "ing") == 0);
+    Require(std::strcmp(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes)), "ranking") == 0);
     Require(Load<char*>(storage, kBufferOffset) != nullptr);
     Require(GuardIntact(storage));
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
     Require(Load<std::uint64_t>(storage, kBufferSizeOffset) == 0);
     Require(GuardIntact(storage));
@@ -135,11 +124,12 @@ void TestAppendNullKeepsEmpty() {
     Storage storage;
     std::memset(storage.bytes, kFill, sizeof(storage.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(storage.bytes, &libContext);
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(storage.bytes, nullptr) == 0);
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), nullptr) == 0);
     Require(Load<char*>(storage, kBufferOffset) == nullptr);
-    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(storage.bytes)[0] == '\0');
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(storage.bytes);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5c_strEv(reinterpret_cast<const CommonString*>(storage.bytes))[0] == '\0');
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
+
 }
 
 void TestVectorPushBackCopiesStringContent() {
@@ -149,15 +139,15 @@ void TestVectorPushBackCopiesStringContent() {
     std::memset(vector.bytes, kFill, sizeof(vector.bytes));
     std::memset(element.bytes, kFill, sizeof(element.bytes));
 
-    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(vector.bytes, &libContext);
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEEC1EPNS2_10LibContextE(reinterpret_cast<IntrusivePtr*>(vector.bytes), &libContext);
     Require(VectorGuardIntact(vector));
 
-    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(element.bytes, &libContext);
-    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(element.bytes, "privilege") == 0);
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(element.bytes), &libContext);
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(element.bytes), "privilege") == 0);
     char* elementBuffer = Load<char*>(element, kBufferOffset);
     Require(elementBuffer != nullptr);
 
-    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(vector.bytes, element.bytes) == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEE8pushBackERKS4_(reinterpret_cast<IntrusivePtr*>(vector.bytes), element.bytes) == 0);
 
     void* body;
     std::memcpy(&body, vector.bytes + kObjectOffset, sizeof(body));
@@ -173,13 +163,76 @@ void TestVectorPushBackCopiesStringContent() {
     Require(storedBuffer != elementBuffer);
     Require(std::strcmp(storedBuffer, "privilege") == 0);
 
-    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(element.bytes);
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(element.bytes));
     Require(std::strcmp(storedBuffer, "privilege") == 0);
 
-    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(vector.bytes);
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_6StringEED1Ev(reinterpret_cast<IntrusivePtr*>(vector.bytes));
     Require(VectorGuardIntact(vector));
 }
 
+void TestStringEmptyAndEquals() {
+    std::uint64_t libContext = 1;
+    Storage storage;
+    std::memset(storage.bytes, kFill, sizeof(storage.bytes));
+
+    _ZN3sce2Np9CppWebApi6Common6StringC1EPNS2_10LibContextE(reinterpret_cast<CommonString*>(storage.bytes), &libContext);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5emptyEv(reinterpret_cast<const CommonString*>(storage.bytes)) == 1);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), "rank") == 0);
+
+    Require(_ZN3sce2Np9CppWebApi6Common6String6appendEPKc(reinterpret_cast<CommonString*>(storage.bytes), "rank") == 0);
+    Require(_ZNK3sce2Np9CppWebApi6Common6String5emptyEv(reinterpret_cast<const CommonString*>(storage.bytes)) == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), "rank") == 1);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), "rank2") == 0);
+    Require(_ZN3sce2Np9CppWebApi6Common6StringeqEPKc(reinterpret_cast<const CommonString*>(storage.bytes), nullptr) == 0);
+    Require(GuardIntact(storage));
+
+    _ZN3sce2Np9CppWebApi6Common6StringD1Ev(reinterpret_cast<CommonString*>(storage.bytes));
+}
+
+int g_elementDeleterCalls = 0;
+void APS5_VABI ElementDeleter(void*) { ++g_elementDeleterCalls; }
+
+void TestIntrusivePtrVectorPushBack() {
+    std::uint64_t libContext = 1;
+    VectorStorage vector;
+    std::memset(vector.bytes, kFill, sizeof(vector.bytes));
+
+    alignas(8) unsigned char element[0x18];
+    alignas(8) unsigned char elementObject[0x10];
+    std::memset(element, 0, sizeof(element));
+    std::memset(elementObject, 0, sizeof(elementObject));
+    g_elementDeleterCalls = 0;
+
+    void* object = elementObject;
+    auto* deleter = &ElementDeleter;
+    std::memcpy(element + 0x00, &object, sizeof(void*));
+    std::memcpy(element + 0x08, &deleter, sizeof(void*));
+    std::memcpy(element + 0x10, &libContext, sizeof(void*));
+
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEEC1EPNS2_10LibContextE(reinterpret_cast<IntrusivePtr*>(vector.bytes), &libContext);
+    Require(VectorGuardIntact(vector));
+
+    Require(_ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEE8pushBackERKS8_(reinterpret_cast<IntrusivePtr*>(vector.bytes), element) == 0);
+
+    void* body;
+    std::memcpy(&body, vector.bytes + kObjectOffset, sizeof(body));
+    Require(body != nullptr);
+    Require(LoadBody<std::int32_t>(body, kBodyReferenceCountOffset) == 1);
+    Require(LoadBody<std::int32_t>(body, kBodyElementKindOffset) == 1);
+    Require(LoadBody<std::uint64_t>(body, kBodySizeOffset) == 1);
+    Require(*reinterpret_cast<std::int32_t*>(elementObject) == 1);
+
+    _ZN3sce2Np9CppWebApi6Common6VectorINS2_12IntrusivePtrINS1_14SessionManager2V112JoinableUserEEEED1Ev(reinterpret_cast<IntrusivePtr*>(vector.bytes));
+    Require(g_elementDeleterCalls == 1);
+    Require(VectorGuardIntact(vector));
+}
+
+void TestOfflineResponses() {
+    Require(_ZNK3sce2Np9CppWebApi6Common11TransactionINS2_12IntrusivePtrINS1_14SessionManager2V130PostPlayerSessionsResponseBodyEEENS4_INS2_18ResponseHeaderBaseEEEE11hasResponseEv() == 0);
+    Require(_ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi17getPlayerSessionsEiRKNS4_28ParameterToGetPlayerSessionsERNS1_6Common11TransactionINS8_12IntrusivePtrINS3_29GetPlayerSessionsResponseBodyEEENSA_INS8_18ResponseHeaderBaseEEEEE() == static_cast<int>(0x80552907));
+    Require(_ZN3sce2Np9CppWebApi14SessionManager2V117PlayerSessionsApi26setPlayerSessionPropertiesEiRKNS4_37ParameterToSetPlayerSessionPropertiesERNS1_6Common11TransactionINS8_15DefaultResponseENS8_12IntrusivePtrINS8_18ResponseHeaderBaseEEEEE() == static_cast<int>(0x80552907));
+}
+
 }
 
 int main() {
@@ -188,4 +241,7 @@ int main() {
     TestAppendBuildsAndClearsBuffer();
     TestAppendNullKeepsEmpty();
     TestVectorPushBackCopiesStringContent();
+    TestStringEmptyAndEquals();
+    TestIntrusivePtrVectorPushBack();
+    TestOfflineResponses();
 }
diff --git a/core/libs/tests/GuestNpFriendListDialog.cpp b/core/libs/tests/GuestNpFriendListDialog.cpp
new file mode 100644
index 0000000000..f06898db7b
--- /dev/null
+++ b/core/libs/tests/GuestNpFriendListDialog.cpp
@@ -0,0 +1,63 @@
+#include "prx/libSceNpFriendListDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000D);
+constexpr int kResultUserCanceled = 1;
+
+}
+
+int main() {
+    std::int64_t param = 0;
+    std::int32_t result[2] = {-1, -1};
+
+    Require(sceNpFriendListDialogTerminate() == kErrNotInitialized);
+    Require(sceNpFriendListDialogOpenA(&param) == kErrNotInitialized);
+    Require(sceNpFriendListDialogClose() == kErrNotInitialized);
+    Require(sceNpFriendListDialogGetResultA(result) == kErrNotInitialized);
+    Require(sceNpFriendListDialogGetStatus() == kStatusNone);
+    Require(sceNpFriendListDialogUpdateStatus() == kStatusNone);
+
+    Require(sceNpFriendListDialogInitialize() == 0);
+    Require(sceNpFriendListDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceNpFriendListDialogGetStatus() == kStatusInitialized);
+    Require(sceNpFriendListDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceNpFriendListDialogOpenA(nullptr) == kErrArgNull);
+    Require(sceNpFriendListDialogGetResultA(result) == kErrNotFinished);
+
+    Require(sceNpFriendListDialogOpenA(&param) == 0);
+    Require(sceNpFriendListDialogGetStatus() == kStatusFinished);
+    Require(sceNpFriendListDialogUpdateStatus() == kStatusFinished);
+
+    Require(sceNpFriendListDialogGetResultA(nullptr) == kErrArgNull);
+    Require(sceNpFriendListDialogGetResultA(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(result[1] == -1);
+
+    Require(sceNpFriendListDialogClose() == 0);
+    Require(sceNpFriendListDialogTerminate() == 0);
+    Require(sceNpFriendListDialogTerminate() == kErrNotInitialized);
+    Require(sceNpFriendListDialogGetStatus() == kStatusNone);
+    Require(sceNpFriendListDialogUpdateStatus() == kStatusNone);
+
+    Require(sceNpFriendListDialogInitialize() == 0);
+    Require(sceNpFriendListDialogUpdateStatus() == kStatusInitialized);
+    Require(sceNpFriendListDialogClose() == 0);
+    Require(sceNpFriendListDialogUpdateStatus() == kStatusFinished);
+    result[0] = -1;
+    Require(sceNpFriendListDialogGetResultA(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(sceNpFriendListDialogTerminate() == 0);
+}
diff --git a/core/libs/tests/GuestNpGameIntent.cpp b/core/libs/tests/GuestNpGameIntent.cpp
index dbf030f79e..dd362cdad4 100644
--- a/core/libs/tests/GuestNpGameIntent.cpp
+++ b/core/libs/tests/GuestNpGameIntent.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpGameIntent/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -5,20 +6,6 @@
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpGameIntentInitParamInit(NpGameIntentInitParam* param);
-int APS5_VABI sceNpGameIntentInfoInit(NpGameIntentInfo* info);
-int APS5_VABI sceNpGameIntentInitialize(const void* initParam);
-int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo);
-int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize);
-int APS5_VABI sceNpGameIntentVshInitialize(void);
-int APS5_VABI sceNpGameIntentVshTerminate(void);
-int APS5_VABI sceNpGameIntentTerminate(void);
-int APS5_VABI sceNpAppLauncherInitialize(const void* initParam);
-int APS5_VABI sceNpAppLauncherLaunchApp(void);
-int APS5_VABI sceNpAppLauncherTerminate(void);
-}
-
 static void Require(bool value, const char* what) {
     if (value) return;
     std::printf("NpGameIntent: %s\n", what);
diff --git a/core/libs/tests/GuestNpManager.cpp b/core/libs/tests/GuestNpManager.cpp
index 9c51efbe00..43c844bb62 100644
--- a/core/libs/tests/GuestNpManager.cpp
+++ b/core/libs/tests/GuestNpManager.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpManager/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
@@ -7,48 +8,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceNpGetAccountCountryA(int user_id, void* country_code);
-int APS5_VABI sceNpGetNpId(int user_id, NpId* np_id);
-int APS5_VABI sceNpGetOnlineId(int user_id, NpOnlineId* online_id);
-int APS5_VABI sceNpGetUserIdByAccountId(std::uint64_t account_id, int* user_id);
-int APS5_VABI sceNpUnknown_8weiQyIdI3A(int userId, const NpOnlineId* buffer);
-int APS5_VABI sceNpUnknown_WxLcN76q19o(void);
-int APS5_VABI sceNpGetAccountCountry(const NpOnlineId* online_id, void* country_code);
-int APS5_VABI sceNpGetAccountDateOfBirth(const NpOnlineId* online_id, void* date_of_birth);
-int APS5_VABI sceNpGetAccountLanguage(int req_id, const NpOnlineId* online_id, void* language);
-int APS5_VABI sceNpGetParentalControlInfo(int req_id, const NpOnlineId* online_id, std::int8_t* age, void* info);
-int APS5_VABI sceNpGetUserIdByOnlineId(const NpOnlineId* online_id, int* user_id);
-int APS5_VABI sceNpCheckPlus(int req_id, const void* param, void* result);
-int APS5_VABI sceNpNotifyPlusFeature(const void* param);
-int APS5_VABI sceNpGetAccountId(const NpOnlineId* online_id, std::uint64_t* account_id);
-int APS5_VABI sceNpSetGamePresenceOnline(int req_id, const NpOnlineId* online_id, std::uint32_t presence);
-int APS5_VABI sceNpRegisterPlusEventCallback(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterPlusEventCallback(void);
-int APS5_VABI sceNpIsPlusMember(int user_id, bool* is_member);
-int APS5_VABI sceNpSetContentRestriction(const NpContentRestriction* restriction);
-}
-
-extern "C" {
-int APS5_VABI sceNpCreateRequest(void);
-int APS5_VABI sceNpCreateAsyncRequest(const NpCreateAsyncRequestParameter* param);
-int APS5_VABI sceNpDeleteRequest(int reqId);
-int APS5_VABI sceNpSetTimeout(int reqId, std::int32_t resolveRetry, std::uint32_t resolveTimeout,
-    std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout);
-}
-
-extern "C" {
-int APS5_VABI sceNpCheckCallback(void);
-int APS5_VABI sceNpCheckCallbackForLib(void);
-int APS5_VABI sceNpRegisterStateCallback(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterStateCallback(void);
-int APS5_VABI sceNpRegisterStateCallbackA(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterStateCallbackA(int callbackId);
-int APS5_VABI sceNpRegisterNpReachabilityStateCallback(void* callback, void* userdata);
-void APS5_VABI sceNpRegisterGamePresenceCallback(void* callback, void* userdata);
-int APS5_VABI sceNpUnregisterNpReachabilityStateCallback(void);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80550003u);
@@ -126,27 +85,28 @@ void CheckStateCallbacksA() {
     int userdata[9]{};
     Require(sceNpRegisterStateCallbackA(nullptr, &userdata[0]) == InvalidArgument, "null state callback");
     int ids[8]{};
-    ids[0] = sceNpRegisterStateCallbackA(callbacks[0], &userdata[0]);
+    ids[0] = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[0]), &userdata[0]);
     Require(ids[0] >= 1 && ids[0] <= 8, "state callback id outside 1..8");
-    Require(sceNpRegisterStateCallbackA(callbacks[0], &userdata[1]) == AlreadyRegistered, "duplicate state callback");
+    Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[0]), &userdata[1]) == AlreadyRegistered, "duplicate state callback");
     Require(stateCallsA[0].calls == 0, "registering calls the state callback");
     Require(sceNpRegisterNpReachabilityStateCallback(reinterpret_cast<void*>(&AbortingReachabilityCallback), nullptr) == 0,
         "registering the reachability callback");
     sceNpRegisterGamePresenceCallback(nullptr, nullptr);
     sceNpRegisterGamePresenceCallback(reinterpret_cast<void*>(&AbortingGamePresenceCallback), &userdata[0]);
+
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed");
     Require(SignedOutOnce(stateCallsA[0], &userdata[0]), "sceNpCheckCallback must deliver SIGNED_OUT once");
     Require(sceNpUnregisterNpReachabilityStateCallback() == 0, "unregistering the reachability callback");
     Require(sceNpCheckCallback() == 0, "second sceNpCheckCallback failed");
     Require(stateCallsA[0].calls == 1, "the second sceNpCheckCallback delivered the state again");
     for (int index = 1; index < 8; ++index) {
-        ids[index] = sceNpRegisterStateCallbackA(callbacks[index], &userdata[index]);
+        ids[index] = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[index]), &userdata[index]);
         Require(ids[index] >= 1 && ids[index] <= 8, "state callback id outside 1..8");
         for (int other = 0; other < index; ++other) {
             Require(ids[index] != ids[other], "two state callbacks got the same id");
         }
     }
-    Require(sceNpRegisterStateCallbackA(callbacks[8], &userdata[8]) == CallbackMax, "ninth state callback");
+    Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[8]), &userdata[8]) == CallbackMax, "ninth state callback");
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with eight callbacks");
     for (int index = 0; index < 8; ++index) {
         Require(SignedOutOnce(stateCallsA[index], &userdata[index]), "each callback gets SIGNED_OUT once");
@@ -157,10 +117,10 @@ void CheckStateCallbacksA() {
     Require(sceNpUnregisterStateCallbackA(ids[3]) == 0, "unregistering one state callback");
     for (int index = 0; index < 8; ++index) {
         if (index == 3) continue;
-        Require(sceNpRegisterStateCallbackA(callbacks[index], &userdata[index]) == AlreadyRegistered,
+        Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[index]), &userdata[index]) == AlreadyRegistered,
             "unregistering one id removed another callback");
     }
-    Require(sceNpRegisterStateCallbackA(callbacks[3], &userdata[3]) == ids[3], "registering again takes the freed slot");
+    Require(sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[3]), &userdata[3]) == ids[3], "registering again takes the freed slot");
     Require(sceNpCheckCallbackForLib() == 0, "sceNpCheckCallbackForLib failed after registering again");
     for (int index = 0; index < 8; ++index) {
         Require(stateCallsA[index].calls == (index == 3 ? 2 : 1), "only the registration made again gets SIGNED_OUT");
@@ -173,13 +133,13 @@ void CheckStateCallbacksA() {
         Require(sceNpUnregisterStateCallbackA(ids[index]) == 0, "unregistering a state callback");
     }
     Require(sceNpUnregisterStateCallbackA(ids[0]) == NotRegistered, "unregistering a state callback twice");
-    const int removed = sceNpRegisterStateCallbackA(callbacks[8], &userdata[8]);
+    const int removed = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(callbacks[8]), &userdata[8]);
     Require(removed >= 1 && removed <= 8, "a freed slot is reused");
     Require(sceNpUnregisterStateCallbackA(removed) == 0, "unregistering before sceNpCheckCallback");
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with no callbacks");
     Require(stateCallsA[8].calls == 0, "an unregistered callback was called");
     SelfUnregister self{};
-    self.id = sceNpRegisterStateCallbackA(reinterpret_cast<void*>(&SelfUnregisteringCallback), &self);
+    self.id = sceNpRegisterStateCallbackA(reinterpret_cast<NpStateCallbackA>(reinterpret_cast<void*>(&SelfUnregisteringCallback)), &self);
     Require(self.id >= 1 && self.id <= 8, "state callback id outside 1..8");
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with a callback that unregisters itself");
     Require(self.calls == 1 && self.result == 0, "a state callback must be able to unregister itself");
@@ -192,8 +152,8 @@ void CheckLegacyStateCallback() {
     auto* callback = reinterpret_cast<void*>(&LegacyStateCallback);
     Require(sceNpUnregisterStateCallback() == NotRegistered, "unregistering with no legacy callback");
     Require(sceNpRegisterStateCallback(nullptr, &userdata) == InvalidArgument, "null legacy callback");
-    Require(sceNpRegisterStateCallback(callback, &userdata) == 0, "registering the legacy callback");
-    Require(sceNpRegisterStateCallback(callback, nullptr) == AlreadyRegistered, "duplicate legacy callback");
+    Require(sceNpRegisterStateCallback(reinterpret_cast<NpStateCallback>(callback), &userdata) == 0, "registering the legacy callback");
+    Require(sceNpRegisterStateCallback(reinterpret_cast<NpStateCallback>(callback), nullptr) == AlreadyRegistered, "duplicate legacy callback");
     legacyStateCall.npId = &sentinel;
     Require(sceNpCheckCallback() == 0, "sceNpCheckCallback failed with the legacy callback");
     Require(SignedOutOnce(legacyStateCall, &userdata), "the legacy callback must get SIGNED_OUT with no NpId");
@@ -229,6 +189,33 @@ void CheckRequestTimeouts() {
     Require(sceNpSetTimeout(asyncId, 2, 0, 0, 0, 0) == RequestNotFound, "deleted async request");
 }
 
+void CheckAsyncRequestLifecycle() {
+    NpCreateAsyncRequestParameter param{};
+    const int unusedAsyncResult = sceNpCreateAsyncRequest(&param);
+    Require(unusedAsyncResult > 0, "sceNpCreateAsyncRequest must return a positive request id");
+    const int deletedId = sceNpCreateAsyncRequest(&param);
+    Require(sceNpDeleteRequest(deletedId) == 0, "initial delete");
+
+    constexpr int resultSentinel = 0x5a5a5a5a;
+    const int unknownIds[] = {0, -1, 0x7fffffff, deletedId};
+    for (const int id : unknownIds) {
+        int result = resultSentinel;
+        Require(sceNpPollAsync(id, &result) == RequestNotFound, "poll must reject an absent or deleted id");
+        Require(result == resultSentinel, "poll must not touch the result for an absent or deleted id");
+        Require(sceNpPollAsync(id, nullptr) == InvalidArgument,
+            "poll must reject a null result before the id");
+        Require(sceNpAbortRequest(id) == RequestNotFound, "abort must reject an absent or deleted id");
+        Require(sceNpDeleteRequest(id) == RequestNotFound, "delete must reject an absent or deleted id");
+    }
+
+    int result = resultSentinel;
+    Require(sceNpPollAsync(unusedAsyncResult, &result) == 0, "poll on a live async request");
+    Require(result == SignedOut, "poll must report the signed-out result on a live async request");
+    Require(sceNpAbortRequest(unusedAsyncResult) == 0, "abort on a live request");
+    Require(sceNpDeleteRequest(unusedAsyncResult) == 0, "delete after abort");
+    Require(sceNpDeleteRequest(unusedAsyncResult) == RequestNotFound, "second delete");
+}
+
 void CheckOnlineIdQueries() {
     NpOnlineId onlineId{};
     std::memcpy(onlineId.data, "player", 6);
@@ -275,12 +262,69 @@ void CheckOnlineIdQueries() {
     Require(std::memcmp(output, untouched, sizeof(output)) == 0 && age == 0x5a && userId == 0x5a5a && accountId == 0x5a5a, "a failed query wrote its output");
     try {
         sceNpNotifyPlusFeature(output);
+
         Require(false, "sceNpNotifyPlusFeature must report that it is not implemented");
     } catch (const std::runtime_error& error) {
         Require(std::string(error.what()) == "sceNpNotifyPlusFeature not implemented", "sceNpNotifyPlusFeature threw");
     }
 }
 
+void CheckUserIdQueries() {
+    constexpr int InvalidUserId = -1;
+    constexpr int OtherUserId = 0x10000;
+    constexpr int NeverCreated = 0x7fffffff;
+    unsigned char output[64];
+    std::memset(output, 0x5a, sizeof(output));
+    unsigned char untouched[64];
+    std::memset(untouched, 0x5a, sizeof(untouched));
+    std::int8_t age = 0x5a;
+    const int request = sceNpCreateRequest();
+    Require(request > 0, "sceNpCreateRequest must return a positive request id");
+    for (const int userId : {InitialUserId, OtherUserId}) {
+        Require(sceNpCheckNpAvailabilityA(request, userId) == SignedOut, "sceNpCheckNpAvailabilityA must report the user as signed out");
+        Require(sceNpGetAccountLanguageA(request, userId, output) == SignedOut, "sceNpGetAccountLanguageA must report the user as signed out");
+        Require(sceNpGetParentalControlInfoA(request, userId, &age, output) == SignedOut, "sceNpGetParentalControlInfoA must report the user as signed out");
+        Require(sceNpGetAccountDateOfBirthA(userId, output) == SignedOut, "sceNpGetAccountDateOfBirthA must report the user as signed out");
+    }
+    Require(sceNpCheckNpAvailabilityA(request, InvalidUserId) == InvalidArgument, "sceNpCheckNpAvailabilityA must reject the invalid user id");
+    Require(sceNpCheckNpAvailabilityA(0, InitialUserId) == InvalidArgument, "sceNpCheckNpAvailabilityA must reject request id 0");
+    Require(sceNpCheckNpAvailabilityA(NeverCreated, InitialUserId) == RequestNotFound, "sceNpCheckNpAvailabilityA must reject a request that was never created");
+    Require(sceNpCheckNpAvailabilityA(NeverCreated, InvalidUserId) == InvalidArgument, "sceNpCheckNpAvailabilityA must check the user before the request");
+    Require(sceNpGetAccountLanguageA(request, InitialUserId, nullptr) == InvalidArgument, "sceNpGetAccountLanguageA must reject a null output");
+    Require(sceNpGetAccountLanguageA(request, InvalidUserId, output) == InvalidArgument, "sceNpGetAccountLanguageA must reject the invalid user id");
+    Require(sceNpGetAccountLanguageA(0, InitialUserId, output) == InvalidArgument, "sceNpGetAccountLanguageA must reject request id 0");
+    Require(sceNpGetAccountLanguageA(NeverCreated, InitialUserId, output) == RequestNotFound, "sceNpGetAccountLanguageA must reject a request that was never created");
+    Require(sceNpGetAccountLanguageA(NeverCreated, InitialUserId, nullptr) == InvalidArgument, "sceNpGetAccountLanguageA must check the output before the request");
+    Require(sceNpGetParentalControlInfoA(request, InitialUserId, nullptr, output) == InvalidArgument, "sceNpGetParentalControlInfoA must reject a null age");
+    Require(sceNpGetParentalControlInfoA(request, InitialUserId, &age, nullptr) == InvalidArgument, "sceNpGetParentalControlInfoA must reject a null info");
+    Require(sceNpGetParentalControlInfoA(request, InvalidUserId, &age, output) == InvalidArgument, "sceNpGetParentalControlInfoA must reject the invalid user id");
+    Require(sceNpGetParentalControlInfoA(0, InitialUserId, &age, output) == InvalidArgument, "sceNpGetParentalControlInfoA must reject request id 0");
+    Require(sceNpGetParentalControlInfoA(NeverCreated, InitialUserId, &age, output) == RequestNotFound, "sceNpGetParentalControlInfoA must reject a request that was never created");
+    Require(sceNpGetParentalControlInfoA(NeverCreated, InvalidUserId, &age, output) == InvalidArgument, "sceNpGetParentalControlInfoA must check the user before the request");
+    Require(sceNpGetAccountDateOfBirthA(InitialUserId, nullptr) == InvalidArgument, "sceNpGetAccountDateOfBirthA must reject a null output");
+    Require(sceNpGetAccountDateOfBirthA(InvalidUserId, output) == InvalidArgument, "sceNpGetAccountDateOfBirthA must reject the invalid user id");
+    Require(sceNpDeleteRequest(request) == 0, "sceNpDeleteRequest failed");
+    Require(sceNpCheckNpAvailabilityA(request, InitialUserId) == RequestNotFound, "sceNpCheckNpAvailabilityA must reject a deleted request");
+    Require(sceNpGetAccountLanguageA(request, InitialUserId, output) == RequestNotFound, "sceNpGetAccountLanguageA must reject a deleted request");
+    Require(sceNpGetParentalControlInfoA(request, InitialUserId, &age, output) == RequestNotFound, "sceNpGetParentalControlInfoA must reject a deleted request");
+    Require(std::memcmp(output, untouched, sizeof(output)) == 0 && age == 0x5a, "a signed-out account query wrote its output");
+    constexpr std::uint32_t Sentinel = 0x5a5a5a5au;
+    constexpr std::uint32_t Offline = 0;
+    NpOnlineId onlineId{};
+    std::memcpy(onlineId.data, "player", 6);
+    for (const int userId : {InitialUserId, OtherUserId}) {
+        std::uint32_t status = Sentinel;
+        Require(sceNpGetGamePresenceStatusA(userId, &status) == 0 && status == Offline, "sceNpGetGamePresenceStatusA must report the user as offline");
+    }
+    std::uint32_t status = Sentinel;
+    Require(sceNpGetGamePresenceStatusA(InvalidUserId, &status) == InvalidArgument, "sceNpGetGamePresenceStatusA must reject the invalid user id");
+    Require(sceNpGetGamePresenceStatusA(InitialUserId, nullptr) == InvalidArgument, "sceNpGetGamePresenceStatusA must reject a null status");
+    Require(sceNpGetGamePresenceStatus(nullptr, &status) == InvalidArgument, "sceNpGetGamePresenceStatus must reject a null online id");
+    Require(sceNpGetGamePresenceStatus(&onlineId, nullptr) == InvalidArgument, "sceNpGetGamePresenceStatus must reject a null status");
+    Require(status == Sentinel, "a rejected presence query wrote its status");
+    Require(sceNpGetGamePresenceStatus(&onlineId, &status) == 0 && status == Offline, "sceNpGetGamePresenceStatus must report the online id as offline");
+}
+
 }
 
 struct ContentRestrictionFields {
@@ -325,9 +369,11 @@ void CheckPlusAndContentRestriction() {
 
 int main() {
     CheckOnlineIdQueries();
+    CheckUserIdQueries();
     CheckStateCallbacksA();
     CheckLegacyStateCallback();
     CheckRequestTimeouts();
+    CheckAsyncRequestLifecycle();
     CheckPlusAndContentRestriction();
     NpId npId{};
     std::memset(&npId, 0x5a, sizeof(npId));
@@ -358,6 +404,7 @@ int main() {
     NpOnlineId buffer{};
     try {
         sceNpUnknown_8weiQyIdI3A(0x10000, &buffer);
+
         Require(false, "sceNpUnknown_8weiQyIdI3A must report that it is not implemented");
     } catch (const std::runtime_error& error) {
         Require(std::string(error.what()) == "sceNpUnknown_8weiQyIdI3A not implemented",
@@ -365,6 +412,7 @@ int main() {
     }
     try {
         sceNpUnknown_WxLcN76q19o();
+
         Require(false, "sceNpUnknown_WxLcN76q19o must report that it is not implemented");
     } catch (const std::runtime_error& error) {
         Require(std::string(error.what()) == "sceNpUnknown_WxLcN76q19o not implemented",
diff --git a/core/libs/tests/GuestNpMatching2Offline.cpp b/core/libs/tests/GuestNpMatching2Offline.cpp
new file mode 100644
index 0000000000..796c217bdf
--- /dev/null
+++ b/core/libs/tests/GuestNpMatching2Offline.cpp
@@ -0,0 +1,92 @@
+#include "prx/libSceNpMatching2/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+
+
+
+
+
+namespace {
+
+constexpr int ResolverTimedOut = static_cast<int>(0x804101E2u);
+constexpr int NotInitialized = static_cast<int>(0x80550C03u);
+constexpr int ContextMax = static_cast<int>(0x80550C04u);
+constexpr int ContextNotStarted = static_cast<int>(0x80550C08u);
+constexpr int InvalidArgument = static_cast<int>(0x80550C0Au);
+constexpr int InvalidContextId = static_cast<int>(0x80550C0Bu);
+
+int failures = 0;
+
+void Require(bool value, const char* name, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s: %s\n", name, what);
+    ++failures;
+}
+
+}
+
+int main() {
+    NpMatching2InitializeParameter init{};
+    NpMatching2CreateContextParameter create{};
+    create.size = 0x28;
+    unsigned char requestOpt[24] = {};
+    std::uint16_t context = 77;
+
+    Require(sceNpMatching2CreateContext(nullptr, nullptr) == NotInitialized, "sceNpMatching2CreateContext", "a call before initialization did not return NOT_INITIALIZED first");
+    Require(sceNpMatching2DestroyContext(1) == NotInitialized, "sceNpMatching2DestroyContext", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2ContextStart(1, 0) == NotInitialized, "sceNpMatching2ContextStart", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2ContextStop(1) == NotInitialized, "sceNpMatching2ContextStop", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterContextCallback(nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterContextCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterRoomEventCallback(1, nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterRoomEventCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterRoomMessageCallback(1, nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterRoomMessageCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2RegisterSignalingCallback(1, nullptr, nullptr) == NotInitialized, "sceNpMatching2RegisterSignalingCallback", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpMatching2SetDefaultRequestOptParam(1, nullptr) == NotInitialized, "sceNpMatching2SetDefaultRequestOptParam", "a call before initialization did not return NOT_INITIALIZED first");
+
+    init.size = 0x30;
+    Require(sceNpMatching2Initialize(&init) == 0, "sceNpMatching2Initialize", "initialization failed");
+
+    Require(sceNpMatching2CreateContext(nullptr, &context) == InvalidArgument, "sceNpMatching2CreateContext", "a null parameter was taken");
+    create.size = 0x30;
+    Require(sceNpMatching2CreateContext(&create, &context) == InvalidArgument, "sceNpMatching2CreateContext", "parameter size 0x30 was taken");
+    create.size = 0x28;
+    Require(sceNpMatching2CreateContext(&create, nullptr) == InvalidArgument, "sceNpMatching2CreateContext", "a null output was taken");
+    Require(context == 77, "sceNpMatching2CreateContext", "a refused call wrote the context id");
+    Require(sceNpMatching2CreateContext(&create, &context) == 0 && context == 1, "sceNpMatching2CreateContext", "the first context is not id 1");
+    Require(sceNpMatching2DestroyContext(1) == 0, "sceNpMatching2DestroyContext", "destroying context 1 failed");
+    std::uint16_t created = 0;
+    for (std::uint16_t expected = 2; expected <= 10; ++expected) {
+        Require(sceNpMatching2CreateContext(&create, &created) == 0 && created == expected, "sceNpMatching2CreateContext", "a context id was reused before the ids up to 10 were handed out");
+    }
+    Require(sceNpMatching2CreateContext(&create, &created) == 0 && created == 1, "sceNpMatching2CreateContext", "after id 10 the allocation did not wrap to the free id 1");
+    created = 77;
+    Require(sceNpMatching2CreateContext(&create, &created) == ContextMax && created == 77, "sceNpMatching2CreateContext", "an eleventh context did not return CONTEXT_MAX");
+    Require(sceNpMatching2DestroyContext(11) == InvalidContextId, "sceNpMatching2DestroyContext", "an unknown context was destroyed");
+
+    Require(sceNpMatching2ContextStart(1, 0) == ResolverTimedOut, "sceNpMatching2ContextStart", "starting a context did not return the offline resolver timeout");
+    Require(sceNpMatching2ContextStart(99, 0) == ResolverTimedOut, "sceNpMatching2ContextStart", "the offline answer did not come before the context check");
+    Require(sceNpMatching2ContextStop(1) == ContextNotStarted, "sceNpMatching2ContextStop", "a context that never started did not return CONTEXT_NOT_STARTED");
+    Require(sceNpMatching2ContextStop(99) == InvalidContextId, "sceNpMatching2ContextStop", "an unknown context was taken");
+
+    Require(sceNpMatching2RegisterContextCallback(nullptr, nullptr) == 0, "sceNpMatching2RegisterContextCallback", "registering the context callback failed");
+    Require(sceNpMatching2RegisterRoomEventCallback(99, nullptr, nullptr) == InvalidContextId, "sceNpMatching2RegisterRoomEventCallback", "an unknown context was taken");
+    Require(sceNpMatching2RegisterRoomEventCallback(1, nullptr, nullptr) == 0, "sceNpMatching2RegisterRoomEventCallback", "registering failed");
+    Require(sceNpMatching2RegisterRoomMessageCallback(99, nullptr, nullptr) == InvalidContextId, "sceNpMatching2RegisterRoomMessageCallback", "an unknown context was taken");
+    Require(sceNpMatching2RegisterRoomMessageCallback(1, nullptr, nullptr) == 0, "sceNpMatching2RegisterRoomMessageCallback", "registering failed");
+    Require(sceNpMatching2RegisterSignalingCallback(99, nullptr, nullptr) == InvalidContextId, "sceNpMatching2RegisterSignalingCallback", "an unknown context was taken");
+    Require(sceNpMatching2RegisterSignalingCallback(1, nullptr, nullptr) == 0, "sceNpMatching2RegisterSignalingCallback", "registering failed");
+    Require(sceNpMatching2SetDefaultRequestOptParam(99, nullptr) == InvalidArgument, "sceNpMatching2SetDefaultRequestOptParam", "a null option was not refused before the context");
+    Require(sceNpMatching2SetDefaultRequestOptParam(99, requestOpt) == InvalidContextId, "sceNpMatching2SetDefaultRequestOptParam", "an unknown context was taken");
+    Require(sceNpMatching2SetDefaultRequestOptParam(1, requestOpt) == 0, "sceNpMatching2SetDefaultRequestOptParam", "setting the default option failed");
+
+    Require(sceNpMatching2Terminate() == 0, "sceNpMatching2Terminate", "termination failed");
+    Require(sceNpMatching2DestroyContext(1) == NotInitialized, "sceNpMatching2DestroyContext", "a context was destroyed after termination");
+    Require(sceNpMatching2Initialize(&init) == 0, "sceNpMatching2Initialize", "initializing again failed");
+    Require(sceNpMatching2RegisterRoomEventCallback(5, nullptr, nullptr) == InvalidContextId, "sceNpMatching2Terminate", "a context created before termination is still found");
+    Require(sceNpMatching2CreateContext(&create, &created) == 0 && created == 1, "sceNpMatching2Terminate", "termination did not restart the context ids at 1");
+    Require(sceNpMatching2Terminate() == 0, "sceNpMatching2Terminate", "the second termination failed");
+
+    if (failures != 0) return 1;
+    std::puts("NpMatching2 offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpPartner.cpp b/core/libs/tests/GuestNpPartner.cpp
index 700570470a..e57e29c5c5 100644
--- a/core/libs/tests/GuestNpPartner.cpp
+++ b/core/libs/tests/GuestNpPartner.cpp
@@ -1,13 +1,8 @@
+#include "prx/libSceNpPartner001/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpEAAccessInitialize(void);
-int APS5_VABI sceNpEAAccessTerminate(void);
-int APS5_VABI sceNpHasEAAccessSubscription(int, bool*);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestNpParty.cpp b/core/libs/tests/GuestNpParty.cpp
index d47398d76a..fbda80be4a 100644
--- a/core/libs/tests/GuestNpParty.cpp
+++ b/core/libs/tests/GuestNpParty.cpp
@@ -1,26 +1,74 @@
+#include "prx/libSceNpParty/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" int APS5_VABI sceNpPartyGetState(std::uint16_t* state);
+namespace {
 
-int main() {
+constexpr int kAlreadyInitialized = static_cast<int>(0x80552502u);
+constexpr int kNotInitialized = static_cast<int>(0x80552503u);
+constexpr int kInvalidArgument = static_cast<int>(0x80552504u);
+constexpr int kNotInParty = static_cast<int>(0x80552506u);
+
+bool check(bool value, const char* message) {
+    if (!value) std::fprintf(stderr, "%s\n", message);
+    return value;
+}
+
+bool stateTests() {
     std::uint16_t states[3];
     std::memset(states, 0xa5, sizeof(states));
-    if (sceNpPartyGetState(nullptr) != static_cast<int>(0x80552504u)) {
-        std::fprintf(stderr, "a null state was not refused with INVALID_ARGUMENT\n");
-        return 1;
-    }
-    if (sceNpPartyGetState(&states[1]) != 0 || states[1] != 2) {
-        std::fprintf(stderr, "the state is not NOT_IN_PARTY\n");
-        return 1;
-    }
-    if (states[0] != 0xa5a5 || states[2] != 0xa5a5) {
-        std::fprintf(stderr, "sceNpPartyGetState wrote past its 16-bit state\n");
-        return 1;
-    }
-    std::puts("NpParty state tests passed");
+    return check(sceNpPartyGetState(nullptr) == kInvalidArgument, "a null state was not refused with INVALID_ARGUMENT")
+        && check(sceNpPartyGetState(&states[1]) == 0 && states[1] == 2, "the state is not NOT_IN_PARTY")
+        && check(states[0] == 0xa5a5 && states[2] == 0xa5a5, "sceNpPartyGetState wrote past its 16-bit state")
+        && check(sceNpPartyGetStateAsUserA(1, nullptr) == kInvalidArgument, "a null user state was not refused with INVALID_ARGUMENT")
+        && check(sceNpPartyGetStateAsUserA(1, &states[0]) == 0 && states[0] == 2, "the user state is not NOT_IN_PARTY")
+        && check(states[2] == 0xa5a5, "sceNpPartyGetStateAsUserA wrote past its 16-bit state");
+}
+
+bool lifecycleTests() {
+    std::uint64_t param[4] = {};
+    std::uint64_t handlers[8] = {};
+    return check(sceNpPartyTerminate() == kNotInitialized, "terminate before initialize did not fail")
+        && check(sceNpPartyCheckCallback() == kNotInitialized, "check callback before initialize did not fail")
+        && check(sceNpPartyRegisterHandlerA(handlers, nullptr) == kNotInitialized, "register handler before initialize did not fail")
+        && check(sceNpPartyInitialize(nullptr) == kInvalidArgument, "a null initialize param was not refused")
+        && check(sceNpPartyInitialize(param) == 0, "initialize failed")
+        && check(sceNpPartyInitialize(param) == kAlreadyInitialized, "a second initialize did not fail")
+        && check(sceNpPartyRegisterHandlerA(nullptr, nullptr) == kInvalidArgument, "null handlers were not refused")
+        && check(sceNpPartyRegisterHandlerA(handlers, param) == 0, "register handler failed")
+        && check(sceNpPartyCheckCallback() == 0, "check callback failed")
+        && check(sceNpPartyTerminate() == 0, "terminate failed")
+        && check(sceNpPartyTerminate() == kNotInitialized, "a second terminate did not fail")
+        && check(sceNpPartyInitialize(param) == 0, "initialize after terminate failed")
+        && check(sceNpPartyTerminate() == 0, "terminate after reinitialize failed");
+}
+
+bool notInPartyTests() {
+    std::uint8_t out[64];
+    std::memset(out, 0xa5, sizeof(out));
+    bool ok = check(sceNpPartyGetId(nullptr) == kInvalidArgument, "a null party id was not refused")
+        && check(sceNpPartyGetId(out) == kNotInParty, "get id did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMembersA(nullptr) == kInvalidArgument, "a null member list was not refused")
+        && check(sceNpPartyGetMembersA(out) == kNotInParty, "get members did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMemberInfoA(1, nullptr) == kInvalidArgument, "a null member info was not refused")
+        && check(sceNpPartyGetMemberInfoA(1, out) == kNotInParty, "get member info did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMemberSessionInfo(1, nullptr) == kInvalidArgument, "a null session info was not refused")
+        && check(sceNpPartyGetMemberSessionInfo(1, out) == kNotInParty, "get session info did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMemberVoiceInfo(1, 2, nullptr) == kInvalidArgument, "a null voice state was not refused")
+        && check(sceNpPartyGetMemberVoiceInfo(1, 2, out) == kNotInParty, "get voice info did not report NOT_IN_PARTY")
+        && check(sceNpPartySendBinaryMessage(nullptr) == kInvalidArgument, "null send params were not refused")
+        && check(sceNpPartySendBinaryMessage(out) == kNotInParty, "send did not report NOT_IN_PARTY");
+    for (std::uint8_t byte : out) ok = ok && check(byte == 0xa5, "a NOT_IN_PARTY call wrote its output");
+    return ok;
+}
+
+}
+
+int main() {
+    if (!stateTests() || !lifecycleTests() || !notInPartyTests()) return 1;
+    std::puts("NpParty tests passed");
     return 0;
 }
diff --git a/core/libs/tests/GuestNpProfileDialog.cpp b/core/libs/tests/GuestNpProfileDialog.cpp
new file mode 100644
index 0000000000..cb7fa68f8d
--- /dev/null
+++ b/core/libs/tests/GuestNpProfileDialog.cpp
@@ -0,0 +1,159 @@
+#include "prx/libSceNpProfileDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003u);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004u);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005u);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000Du);
+constexpr std::int32_t kResultUserCanceled = 1;
+
+constexpr std::size_t kParamSize = 128;
+constexpr std::size_t kParamASize = 120;
+constexpr std::size_t kParamUserData = 88;
+constexpr std::size_t kParamAUserData = 80;
+constexpr std::size_t kResultSize = 48;
+constexpr std::uint8_t kSentinel = 0x5a;
+
+template <typename TValue>
+void Store(std::uint8_t* bytes, std::size_t offset, TValue value) {
+    std::memcpy(bytes + offset, &value, sizeof(value));
+}
+
+template <typename TValue>
+TValue Load(const std::uint8_t* bytes, std::size_t offset) {
+    TValue value;
+    std::memcpy(&value, bytes + offset, sizeof(value));
+    return value;
+}
+
+void MakeParam(std::uint8_t* bytes, std::size_t capacity, std::uint64_t size, std::uint32_t mode, std::size_t userDataOffset, void* userData) {
+    std::memset(bytes, 0, capacity);
+    Store<std::uint64_t>(bytes, 0, 48);
+    Store<std::uint64_t>(bytes, 48, size);
+    Store<std::uint32_t>(bytes, 56, mode);
+    Store<std::int32_t>(bytes, 60, 1);
+    Store<void*>(bytes, userDataOffset, userData);
+}
+
+template <typename TCall>
+void RequireThrows(TCall call) {
+    bool threw = false;
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        threw = std::string(error.what()).find("not implemented") == std::string::npos;
+    }
+    Require(threw);
+}
+
+void RequireCanceled(const std::uint8_t* result, void* userData) {
+    Require(Load<std::int32_t>(result, 0) == 0);
+    Require(Load<std::int32_t>(result, 4) == kResultUserCanceled);
+    Require(Load<void*>(result, 8) == userData);
+    for (std::size_t i = 16; i < kResultSize; ++i) Require(result[i] == 0);
+    for (std::size_t i = kResultSize; i < kResultSize + 16; ++i) Require(result[i] == kSentinel);
+}
+
+}
+
+int main() {
+    alignas(8) std::uint8_t param[kParamSize + 16];
+    alignas(8) std::uint8_t paramA[kParamASize + 16];
+    alignas(8) std::uint8_t result[kResultSize + 16];
+    int first = 0;
+    int second = 0;
+    std::memset(result, kSentinel, sizeof(result));
+    MakeParam(param, sizeof(param), kParamSize, 1, kParamUserData, &first);
+    MakeParam(paramA, sizeof(paramA), kParamASize, 1, kParamAUserData, &second);
+
+    Require(sceNpProfileDialogTerminate() == kErrNotInitialized);
+    Require(sceNpProfileDialogClose() == kErrNotInitialized);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotInitialized);
+    Require(sceNpProfileDialogGetResult(nullptr) == kErrNotInitialized);
+    Require(sceNpProfileDialogGetStatus() == kStatusNone);
+    Require(sceNpProfileDialogUpdateStatus() == kStatusNone);
+    RequireThrows([&] { sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(param)); });
+    RequireThrows([&] { sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(paramA)); });
+    Require(sceNpProfileDialogGetStatus() == kStatusNone);
+    Require(result[0] == kSentinel);
+
+    Require(sceNpProfileDialogInitialize() == 0);
+    Require(sceNpProfileDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceNpProfileDialogGetStatus() == kStatusInitialized);
+    Require(sceNpProfileDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotFinished);
+    Require(result[0] == kSentinel);
+    RequireThrows([] { sceNpProfileDialogGetResult(nullptr); });
+    RequireThrows([] { sceNpProfileDialogClose(); });
+    Require(sceNpProfileDialogGetStatus() == kStatusInitialized);
+
+    Require(sceNpProfileDialogOpen(nullptr) == kErrArgNull);
+    Require(sceNpProfileDialogOpenA(nullptr) == kErrArgNull);
+    Require(sceNpProfileDialogGetStatus() == kStatusInitialized);
+
+    alignas(8) std::uint8_t wrong[kParamSize + 16];
+    MakeParam(wrong, sizeof(wrong), kParamASize, 1, kParamUserData, &first);
+    RequireThrows([&] { sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(wrong)); });
+    MakeParam(wrong, sizeof(wrong), kParamSize, 1, kParamAUserData, &second);
+    RequireThrows([&] { sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(wrong)); });
+    MakeParam(wrong, sizeof(wrong), kParamSize, 0, kParamUserData, &first);
+    RequireThrows([&] { sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(wrong)); });
+    MakeParam(wrong, sizeof(wrong), kParamASize, 5, kParamAUserData, &second);
+    RequireThrows([&] { sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(wrong)); });
+    Require(sceNpProfileDialogGetStatus() == kStatusInitialized);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotFinished);
+
+    std::uint8_t paramCopy[sizeof(param)];
+    std::memcpy(paramCopy, param, sizeof(param));
+    Require(sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(param)) == 0);
+    Require(std::memcmp(param, paramCopy, sizeof(param)) == 0);
+    Require(sceNpProfileDialogGetStatus() == kStatusFinished);
+    Require(sceNpProfileDialogUpdateStatus() == kStatusFinished);
+    Require(sceNpProfileDialogGetResult(nullptr) == kErrArgNull);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == 0);
+    RequireCanceled(result, &first);
+    RequireThrows([] { sceNpProfileDialogClose(); });
+    Require(sceNpProfileDialogGetStatus() == kStatusFinished);
+
+    for (std::uint32_t mode = 1; mode <= 4; ++mode) {
+        Store<std::uint32_t>(paramA, 56, mode);
+        std::uint8_t paramACopy[sizeof(paramA)];
+        std::memcpy(paramACopy, paramA, sizeof(paramA));
+        std::memset(result, kSentinel, sizeof(result));
+        Require(sceNpProfileDialogOpenA(reinterpret_cast<const SceNpProfileDialogParamA*>(paramA)) == 0);
+        Require(std::memcmp(paramA, paramACopy, sizeof(paramA)) == 0);
+        Require(sceNpProfileDialogUpdateStatus() == kStatusFinished);
+        Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == 0);
+        RequireCanceled(result, &second);
+    }
+
+    Require(sceNpProfileDialogTerminate() == 0);
+    Require(sceNpProfileDialogTerminate() == kErrNotInitialized);
+    Require(sceNpProfileDialogGetStatus() == kStatusNone);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotInitialized);
+
+    Require(sceNpProfileDialogInitialize() == 0);
+    std::memset(result, kSentinel, sizeof(result));
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == kErrNotFinished);
+    Require(result[0] == kSentinel);
+    Store<std::uint32_t>(param, 56, 4);
+    Require(sceNpProfileDialogOpen(reinterpret_cast<const SceNpProfileDialogParam*>(param)) == 0);
+    Require(sceNpProfileDialogGetResult(reinterpret_cast<SceNpProfileDialogResult*>(result)) == 0);
+    RequireCanceled(result, &first);
+    Require(sceNpProfileDialogTerminate() == 0);
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpPs4Imports.cpp b/core/libs/tests/GuestNpPs4Imports.cpp
new file mode 100644
index 0000000000..b863dd65b5
--- /dev/null
+++ b/core/libs/tests/GuestNpPs4Imports.cpp
@@ -0,0 +1,143 @@
+#include "prx/libSceNpTrophy/include/Api.hpp"
+#include "prx/libSceNpSignaling/include/Api.hpp"
+#include "prx/libSceNpMatching2/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <stdexcept>
+#include <string>
+#include <system_error>
+#include <vector>
+
+namespace {
+
+constexpr int Matching2AlreadyInitialized = static_cast<int>(0x80550C02u);
+constexpr int Matching2NotInitialized = static_cast<int>(0x80550C03u);
+constexpr int Matching2InvalidArgument = static_cast<int>(0x80550C0Au);
+constexpr int TrophyInvalidArgument = static_cast<int>(0x80551604u);
+constexpr int TrophyInvalidTrophyId = static_cast<int>(0x8055160au);
+constexpr int TrophyInvalidGroupId = static_cast<int>(0x8055160bu);
+constexpr int TrophyNotRegistered = static_cast<int>(0x8055160fu);
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "NpPs4Imports: %s\n", message);
+        std::abort();
+    }
+}
+
+template <typename TCall>
+void RequireNotImplemented(TCall call, const std::string& name) {
+    try {
+        call();
+    } catch (const std::runtime_error& error) {
+        Require(std::string(error.what()) == name + " not implemented", "a declared function threw another error");
+        return;
+    }
+    Require(false, "a declared function returned");
+}
+
+void WriteBigEndian(std::vector<std::uint8_t>& bytes, std::size_t at, std::uint64_t value, std::size_t width) {
+    for (std::size_t index = 0; index < width; ++index) bytes[at + index] = static_cast<std::uint8_t>(value >> (8u * (width - 1u - index)));
+}
+
+void WriteTrophyPackage(const std::filesystem::path& path) {
+    const char* const names[] = {"TROPCONF.ESFM", "TROP000.PNG", "TROP001.PNG", "TROP002.PNG", "ICON0.PNG"};
+    constexpr std::size_t count = sizeof(names) / sizeof(names[0]);
+    std::vector<std::uint8_t> bytes(0x60 + count * 0x40 + count * 16, 0u);
+    WriteBigEndian(bytes, 0x00, 0xdca24d00u, 4);
+    WriteBigEndian(bytes, 0x08, bytes.size(), 8);
+    WriteBigEndian(bytes, 0x10, count, 4);
+    WriteBigEndian(bytes, 0x14, 0x40u, 4);
+    for (std::size_t index = 0; index < count; ++index) {
+        const auto entry = 0x60 + index * 0x40;
+        std::memcpy(bytes.data() + entry, names[index], std::strlen(names[index]));
+        WriteBigEndian(bytes, entry + 32, 0x60 + count * 0x40 + index * 16, 8);
+        WriteBigEndian(bytes, entry + 40, 16u, 8);
+    }
+    std::filesystem::create_directories(path.parent_path());
+    std::ofstream(path, std::ios::binary).write(reinterpret_cast<const char*>(bytes.data()), static_cast<std::streamsize>(bytes.size()));
+}
+
+void CheckTrophyInfo() {
+    constexpr int user = 0x10000000;
+    constexpr std::uint32_t label = 7u;
+    const std::filesystem::path package = "app0/sce_sys/trophy/trophy07.trp";
+    const std::filesystem::path state = "_trophy/trophy07.268435456";
+    std::filesystem::remove(state);
+    WriteTrophyPackage(package);
+    int context = -1;
+    int handle = -1;
+    Require(sceNpTrophyCreateContext(&context, user, label, 0u) == 0 && sceNpTrophyCreateHandle(&handle) == 0, "trophy context or handle not created");
+    GameDetails game{};
+    GameData gameData{};
+    game.size = sizeof(game);
+    gameData.size = sizeof(gameData);
+    Require(sceNpTrophyGetGameInfo(context, handle, &game, &gameData) == TrophyNotRegistered, "game info answered before registration");
+    Require(sceNpTrophyRegisterContext(context, handle, 0u) == 0, "trophy context not registered");
+    Require(sceNpTrophyGetGameInfo(context, handle, nullptr, nullptr) == TrophyInvalidArgument, "game info without outputs accepted");
+    game.size = sizeof(game) - 8u;
+    Require(sceNpTrophyGetGameInfo(context, handle, &game, nullptr) == TrophyInvalidArgument, "game details of a wrong size accepted");
+    game.size = sizeof(game);
+    std::memset(game.title, 'x', sizeof(game.title));
+    Require(sceNpTrophyGetGameInfo(context, handle, &game, &gameData) == 0, "game info refused");
+    Require(game.numTrophies == 3u && game.numGroups == 0u && game.numPlatinum + game.numGold + game.numSilver + game.numBronze == 0u && game.title[0] == '\0', "game details are not the package's three trophies with unknown grades");
+    Require(gameData.unlockedTrophies == 0u && gameData.progressPercentage == 0u, "game data reports progress before an unlock");
+    int platinum = 0;
+    Require(sceNpTrophyUnlockTrophy(context, handle, 1, &platinum) == 0, "trophy 1 not unlocked");
+    Require(sceNpTrophyGetGameInfo(context, handle, nullptr, &gameData) == 0 && gameData.unlockedTrophies == 1u && gameData.progressPercentage == 33u, "game data does not count the unlock");
+    TrophyDetails trophy{};
+    TrophyData trophyData{};
+    trophy.size = sizeof(trophy);
+    trophyData.size = sizeof(trophyData);
+    Require(sceNpTrophyGetTrophyInfo(context, handle, 1, &trophy, &trophyData) == 0, "trophy info refused");
+    Require(trophy.trophyId == 1 && trophy.trophyGrade == 0 && trophy.groupId == -1 && !trophy.hidden && trophy.name[0] == '\0' && trophyData.trophyId == 1 && trophyData.unlocked, "trophy 1 info is wrong");
+    Require(sceNpTrophyGetTrophyInfo(context, handle, 0, nullptr, &trophyData) == 0 && trophyData.trophyId == 0 && !trophyData.unlocked, "trophy 0 reported unlocked");
+    Require(sceNpTrophyGetTrophyInfo(context, handle, 3, &trophy, &trophyData) == TrophyInvalidTrophyId, "a trophy past the package accepted");
+    GroupDetails group{};
+    GroupData groupData{};
+    group.size = sizeof(group);
+    groupData.size = sizeof(groupData);
+    Require(sceNpTrophyGetGroupInfo(context, handle, -1, &group, &groupData) == 0, "base game group refused");
+    Require(group.groupId == -1 && group.numTrophies == 3u && groupData.groupId == -1 && groupData.unlockedTrophies == 1u && groupData.progressPercentage == 33u, "base game group info is wrong");
+    Require(sceNpTrophyGetGroupInfo(context, handle, 0, &group, &groupData) == TrophyInvalidGroupId, "a group the package does not have accepted");
+    std::filesystem::remove(state);
+    std::filesystem::remove(package);
+    std::error_code ignored;
+    for (auto directory = package.parent_path(); !directory.empty(); directory = directory.parent_path()) std::filesystem::remove(directory, ignored);
+    std::filesystem::remove(state.parent_path(), ignored);
+}
+
+void CheckMatching2() {
+    unsigned char param[0x30]{};
+    const auto setSize = [&](std::uint64_t size) { std::memcpy(param + 0x20, &size, sizeof(size)); };
+    Require(sceNpMatching2Terminate() == Matching2NotInitialized, "NpMatching2 terminated before initialization");
+    Require(sceNpMatching2Initialize(nullptr) == Matching2InvalidArgument, "a null NpMatching2 parameter was accepted");
+    setSize(0x20u);
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == Matching2InvalidArgument, "an NpMatching2 parameter of size 0x20 was accepted");
+    setSize(0x28u);
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == 0, "an NpMatching2 parameter of size 0x28 was refused");
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == Matching2AlreadyInitialized, "NpMatching2 initialized twice");
+    Require(sceNpMatching2Terminate() == 0, "NpMatching2 did not terminate");
+    setSize(0x30u);
+    Require(sceNpMatching2Initialize(reinterpret_cast<const NpMatching2InitializeParameter*>(param)) == 0, "an NpMatching2 parameter with an SSL pool was refused");
+    Require(sceNpMatching2Terminate() == 0, "NpMatching2 did not terminate after the SSL form");
+}
+
+void CheckSignaling() {
+    RequireNotImplemented([] { sceNpSignalingDeactivateConnection(); }, "sceNpSignalingDeactivateConnection");
+}
+
+}
+
+int main() {
+    CheckTrophyInfo();
+    CheckMatching2();
+    CheckSignaling();
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpReachability.cpp b/core/libs/tests/GuestNpReachability.cpp
index e6995ac80d..1c16e32fe7 100644
--- a/core/libs/tests/GuestNpReachability.cpp
+++ b/core/libs/tests/GuestNpReachability.cpp
@@ -1,14 +1,7 @@
+#include "prx/libSceNpManager/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceNpRegisterNpReachabilityStateCallback(void*, void*);
-int APS5_VABI sceNpUnregisterNpReachabilityStateCallback();
-int APS5_VABI sceNpGetNpReachabilityState(int, uint32_t*);
-int APS5_VABI sceNpCheckCallback();
-int APS5_VABI sceNpCheckNpAvailability(int, const NpOnlineId*, std::uint8_t*);
-}
-
 static constexpr int ErrorArgument = static_cast<int>(0x80550003);
 static constexpr int ErrorAlreadyRegistered = static_cast<int>(0x80550008);
 static constexpr int ErrorNotRegistered = static_cast<int>(0x80550009);
diff --git a/core/libs/tests/GuestNpScoreOffline.cpp b/core/libs/tests/GuestNpScoreOffline.cpp
new file mode 100644
index 0000000000..15cc132c95
--- /dev/null
+++ b/core/libs/tests/GuestNpScoreOffline.cpp
@@ -0,0 +1,200 @@
+#include "prx/libSceNpScoreRanking/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+namespace {
+
+constexpr int SignedOut = static_cast<int>(0x80550006u);
+constexpr int InvalidArgument = static_cast<int>(0x80550704u);
+constexpr int TooManyObjects = static_cast<int>(0x80550706u);
+constexpr int Aborted = static_cast<int>(0x80550707u);
+constexpr int InsufficientArgument = static_cast<int>(0x8055070Cu);
+constexpr int InvalidId = static_cast<int>(0x8055070Eu);
+constexpr int InvalidAlignment = static_cast<int>(0x80550714u);
+constexpr int TooManyNpId = static_cast<int>(0x80550719u);
+constexpr int PollFinished = 0;
+constexpr int PollRunning = 1;
+
+int failures = 0;
+int context = 0;
+unsigned char selfNpId[36];
+unsigned char npIds[2 * 36];
+unsigned char ranks[2 * 0x88];
+unsigned char comments[2 * 64];
+unsigned char infos[2 * 200];
+unsigned char board[24];
+unsigned char manyNpIds[101 * 36];
+unsigned char manyRanks[101 * 0x88];
+
+void Require(bool value, const char* name, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s: %s\n", name, what);
+    ++failures;
+}
+
+int NewRequest() {
+    return sceNpScoreCreateRequest(context);
+}
+
+bool Untouched() {
+    for (const unsigned char value : ranks) if (value != 0xA5) return false;
+    for (const unsigned char value : comments) if (value != 0xA5) return false;
+    for (const unsigned char value : infos) if (value != 0xA5) return false;
+    for (const unsigned char value : board) if (value != 0xA5) return false;
+    return true;
+}
+
+void CheckOffline(const char* name, int status, int req) {
+    Require(status == SignedOut, name, "valid arguments did not return SIGNED_OUT");
+    int result = 0;
+    Require(sceNpScorePollAsync(req, &result) == PollFinished && result == SignedOut, name, "the request did not finish with SIGNED_OUT");
+}
+
+void CheckContexts() {
+    Require(sceNpScoreCreateNpTitleCtx(0xFFFFFFFFu, nullptr) == InvalidArgument, "sceNpScoreCreateNpTitleCtx", "the invalid service label was not refused before the null NpId");
+    Require(sceNpScoreCreateNpTitleCtx(0, nullptr) == InsufficientArgument, "sceNpScoreCreateNpTitleCtx", "a null NpId was taken");
+    context = sceNpScoreCreateNpTitleCtx(0, selfNpId);
+    Require(context == 1, "sceNpScoreCreateNpTitleCtx", "the first context is not id 1");
+    Require(sceNpScoreCreateRequest(context + 100) == InvalidId, "sceNpScoreCreateRequest", "an unknown context was taken");
+    int extra[31];
+    for (int& entry : extra) entry = sceNpScoreCreateNpTitleCtx(1, selfNpId);
+    Require(extra[30] == 32, "sceNpScoreCreateNpTitleCtx", "32 contexts could not be created");
+    Require(sceNpScoreCreateNpTitleCtx(1, selfNpId) == TooManyObjects, "sceNpScoreCreateNpTitleCtx", "a 33rd context did not return TOO_MANY_OBJECTS");
+    const int kept = sceNpScoreCreateRequest(extra[0]);
+    Require(kept == 1, "sceNpScoreCreateRequest", "the first request is not id 1");
+    for (const int entry : extra) Require(sceNpScoreDeleteNpTitleCtx(entry) == 0, "sceNpScoreDeleteNpTitleCtx", "deleting a context failed");
+    Require(sceNpScoreDeleteRequest(kept) == InvalidId, "sceNpScoreDeleteNpTitleCtx", "a request of a deleted context was kept");
+    Require(sceNpScoreDeleteNpTitleCtx(extra[0]) == InvalidId, "sceNpScoreDeleteNpTitleCtx", "a deleted context was found");
+    int requests[32];
+    for (int& entry : requests) entry = NewRequest();
+    Require(requests[31] > 0, "sceNpScoreCreateRequest", "32 requests could not be created");
+    Require(NewRequest() == TooManyObjects, "sceNpScoreCreateRequest", "a 33rd request did not return TOO_MANY_OBJECTS");
+    for (const int entry : requests) sceNpScoreDeleteRequest(entry);
+    Require(sceNpScoreDeleteRequest(requests[0]) == InvalidId, "sceNpScoreDeleteRequest", "a deleted request was found");
+}
+
+void CheckRequests() {
+    int req = NewRequest();
+    int result = 7;
+    Require(sceNpScorePollAsync(req + 100, &result) == InvalidId, "sceNpScorePollAsync", "an unknown request was taken");
+    Require(sceNpScorePollAsync(req, &result) == PollRunning && result == 7, "sceNpScorePollAsync", "an unstarted request was not running");
+    Require(sceNpScoreAbortRequest(req + 100) == InvalidId, "sceNpScoreAbortRequest", "an unknown request was taken");
+    Require(sceNpScoreAbortRequest(req) == 0, "sceNpScoreAbortRequest", "aborting failed");
+    Require(sceNpScorePollAsync(req, nullptr) == PollFinished, "sceNpScorePollAsync", "a null result was not accepted");
+    Require(sceNpScorePollAsync(req, &result) == PollFinished && result == Aborted, "sceNpScoreAbortRequest", "an aborted request did not finish with ABORTED");
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == Aborted, "sceNpScoreRecordScore", "an aborted request did not return ABORTED");
+    sceNpScoreDeleteRequest(req);
+
+    req = NewRequest();
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreRecordScore", "the first call did not return SIGNED_OUT");
+    Require(sceNpScoreAbortRequest(req) == 0, "sceNpScoreAbortRequest", "aborting a finished request failed");
+    Require(sceNpScorePollAsync(req, &result) == PollFinished && result == SignedOut, "sceNpScoreAbortRequest", "aborting a finished request changed its result");
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, nullptr, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreRecordScore", "a finished request was not reused");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckRecord() {
+    NpScoreGameInfo info{};
+    std::uint32_t tmpRank = 77;
+    const int req = NewRequest();
+    info.infoSize = 190;
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, &info, &tmpRank, nullptr, &info) == InvalidArgument, "sceNpScoreRecordScore", "an option was taken");
+    Require(sceNpScoreRecordScore(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidArgument, "sceNpScoreRecordScore", "190 bytes of game info were taken");
+    Require(sceNpScoreRecordScoreAsync(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidArgument, "sceNpScoreRecordScoreAsync", "190 bytes of game info were taken");
+    info.infoSize = 189;
+    Require(sceNpScoreRecordScore(req + 100, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr) == InvalidId, "sceNpScoreRecordScore", "an unknown request was taken");
+    Require(sceNpScorePollAsync(req, nullptr) == PollRunning, "sceNpScoreRecordScore", "a refused call finished the request");
+    CheckOffline("sceNpScoreRecordScoreAsync", sceNpScoreRecordScoreAsync(req, 1, 5, nullptr, &info, &tmpRank, nullptr, nullptr), req);
+    Require(tmpRank == 77, "sceNpScoreRecordScoreAsync", "a rank was written");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckRange() {
+    const int req = NewRequest();
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, board) == InvalidArgument, "sceNpScoreGetRankingByRange", "an option was taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 101 * 0x80, nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRange", "101 ranks were taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 0, nullptr, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRange", "rank 0 was not refused before the null array");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, nullptr, 3, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByRange", "a null rank array was not refused before its size");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByRange", "zero ranks were taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "a rank array size other than 0x80 per rank was taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 64, nullptr, 0, 2, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "a comment array size other than 64 per rank was taken");
+    Require(sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 128, infos, 200, 2, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByRange", "an info array size other than 200 per rank was taken");
+    Require(sceNpScoreGetRankingByRange(req + 100, 1, 1, ranks, 0x100, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr) == InvalidId, "sceNpScoreGetRankingByRange", "an unknown request was taken");
+    CheckOffline("sceNpScoreGetRankingByRange", sceNpScoreGetRankingByRange(req, 1, 1, ranks, 0x100, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr), req);
+    Require(sceNpScoreGetRankingByRangeAsync(req, 1, 1, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByRangeAsync", "valid arguments did not return SIGNED_OUT");
+    Require(sceNpScoreGetRankingByRangeAsync(req, 1, 0, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetRankingByRangeAsync", "rank 0 was taken");
+    Require(sceNpScoreGetRankingByRangeAsync(req, 1, 1, manyRanks, 100 * 0x80, nullptr, 0, nullptr, 0, 100, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByRangeAsync", "100 ranks did not return SIGNED_OUT");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckNpId() {
+    const int req = NewRequest();
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, board) == InvalidArgument, "sceNpScoreGetRankingByNpId", "an option was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, nullptr, 0, nullptr, 0, nullptr, 0, nullptr, 0, 102, nullptr, nullptr, nullptr) == TooManyNpId, "sceNpScoreGetRankingByNpId", "102 NpIds were not refused before the null arrays");
+    Require(sceNpScoreGetRankingByNpId(req, 1, nullptr, 36, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByNpId", "a null NpId array was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, nullptr, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetRankingByNpId", "a null rank array was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 24, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "an NpId array size other than 36 per NpId was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "a rank array size other than 0x88 per NpId was taken");
+    Require(sceNpScoreGetRankingByNpId(req, 1, npIds, 36, ranks, 0x88, comments, 128, nullptr, 0, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetRankingByNpId", "a comment array size other than 64 per NpId was taken");
+    CheckOffline("sceNpScoreGetRankingByNpId", sceNpScoreGetRankingByNpId(req, 1, npIds, 72, ranks, 0x110, comments, 128, infos, 400, 2, nullptr, nullptr, nullptr), req);
+    Require(sceNpScoreGetRankingByNpIdAsync(req, 1, npIds, 0, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByNpIdAsync", "zero NpIds did not return SIGNED_OUT");
+    Require(sceNpScoreGetRankingByNpIdAsync(req, 1, manyNpIds, sizeof(manyNpIds), manyRanks, sizeof(manyRanks), nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetRankingByNpIdAsync", "101 NpIds did not return SIGNED_OUT");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckFriends() {
+    const int req = NewRequest();
+    const std::uint32_t zero = 0;
+    const std::uint32_t five = 5;
+    const NpScoreFriendRankingOption shortOption{16, nullptr, nullptr};
+    const NpScoreFriendRankingOption rankZero{24, &zero, nullptr};
+    const NpScoreFriendRankingOption rankFive{24, &five, nullptr};
+    Require(sceNpScoreGetFriendsRanking(req, 1, 0, nullptr, 0x80, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, &shortOption) == InvalidArgument, "sceNpScoreGetFriendsRanking", "a null rank array was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 0, ranks, 0x88, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &shortOption) == InvalidAlignment, "sceNpScoreGetFriendsRanking", "the rank array size was not checked before the option");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 0, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &rankFive) == InvalidArgument, "sceNpScoreGetFriendsRanking", "an option without includeSelf was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &shortOption) == InvalidArgument, "sceNpScoreGetFriendsRanking", "an option size other than 24 was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, nullptr, 0, 1, nullptr, nullptr, &rankZero) == InvalidArgument, "sceNpScoreGetFriendsRanking", "start rank 0 was taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 101 * 0x80, nullptr, 0, nullptr, 0, 101, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpScoreGetFriendsRanking", "101 friends were taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0, nullptr, 0, nullptr, 0, 0, nullptr, nullptr, nullptr) == InsufficientArgument, "sceNpScoreGetFriendsRanking", "zero friends were taken");
+    Require(sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, nullptr, 0, infos, 400, 1, nullptr, nullptr, nullptr) == InvalidAlignment, "sceNpScoreGetFriendsRanking", "an info array size other than 200 per friend was taken");
+    CheckOffline("sceNpScoreGetFriendsRanking", sceNpScoreGetFriendsRanking(req, 1, 1, ranks, 0x80, comments, 64, infos, 200, 1, nullptr, nullptr, &rankFive), req);
+    Require(sceNpScoreGetFriendsRankingAsync(req, 1, 0, ranks, 0x100, nullptr, 0, nullptr, 0, 2, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetFriendsRankingAsync", "valid arguments did not return SIGNED_OUT");
+    Require(sceNpScoreGetFriendsRankingAsync(req, 1, 0, manyRanks, 100 * 0x80, nullptr, 0, nullptr, 0, 100, nullptr, nullptr, nullptr) == SignedOut, "sceNpScoreGetFriendsRankingAsync", "100 friends did not return SIGNED_OUT");
+    sceNpScoreDeleteRequest(req);
+
+}
+
+void CheckBoard() {
+    const int req = NewRequest();
+    Require(sceNpScoreGetBoardInfo(req, 1, board, board) == InvalidArgument, "sceNpScoreGetBoardInfo", "an option was taken");
+    Require(sceNpScoreGetBoardInfo(req + 100, 1, board, nullptr) == InvalidId, "sceNpScoreGetBoardInfo", "an unknown request was taken");
+    CheckOffline("sceNpScoreGetBoardInfo", sceNpScoreGetBoardInfo(req, 1, board, nullptr), req);
+    sceNpScoreDeleteRequest(req);
+
+}
+
+}
+
+int main() {
+    std::memset(ranks, 0xA5, sizeof(ranks));
+    std::memset(comments, 0xA5, sizeof(comments));
+    std::memset(infos, 0xA5, sizeof(infos));
+    std::memset(board, 0xA5, sizeof(board));
+    CheckContexts();
+    CheckRequests();
+    CheckRecord();
+    CheckRange();
+    CheckNpId();
+    CheckFriends();
+    CheckBoard();
+    Require(Untouched(), "libSceNpScoreRanking", "an output array was written");
+    if (failures != 0) return 1;
+    std::puts("NpScoreRanking offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpSessionSignaling.cpp b/core/libs/tests/GuestNpSessionSignaling.cpp
index 982664e90c..1818d3df1b 100644
--- a/core/libs/tests/GuestNpSessionSignaling.cpp
+++ b/core/libs/tests/GuestNpSessionSignaling.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpSessionSignaling/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,18 +6,6 @@
 #include <cstring>
 #include <array>
 
-extern "C" {
-int APS5_VABI sceNpSessionSignalingInitialize(void* param);
-int APS5_VABI sceNpSessionSignalingCreateContext(const void* param, std::uint32_t* contextId);
-int APS5_VABI sceNpSessionSignalingCreateContext2(const void* param, std::uint32_t* contextId);
-int APS5_VABI sceNpSessionSignalingDestroyContext(std::uint32_t contextId);
-int APS5_VABI sceNpSessionSignalingDeactivate(std::uint32_t contextId, std::uint32_t connectionId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetLocalNetInfo(std::int32_t contextId, void* info);
-int APS5_VABI sceNpSessionSignalingRequestPrepare(std::uint32_t contextId, std::uint32_t* requestId);
-std::int32_t APS5_VABI sceNpSessionSignalingGetConnectionStatus(std::int32_t contextId, std::int32_t connectionId, std::int32_t* status, void* peerAddress, std::uint16_t* peerPort);
-int APS5_VABI sceNpSessionSignalingTerminate(void);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80553303u);
@@ -43,10 +32,10 @@ int main() {
     Require(sceNpSessionSignalingCreateContext2(nullptr, nullptr) == NotInitialized, "initialization check precedes context arguments");
     Require(sceNpSessionSignalingGetConnectionStatus(0, 0, nullptr, nullptr, nullptr) == NotInitialized, "status before initialize");
     Require(sceNpSessionSignalingInitialize(nullptr) == InvalidArgument, "null initialize parameter");
-    Require(sceNpSessionSignalingInitialize(initializeParam) == InvalidArgument, "zero pool size");
+    Require(sceNpSessionSignalingInitialize(reinterpret_cast<const SessionSignalingInitParam*>(initializeParam)) == InvalidArgument, "zero pool size");
     const std::uint64_t poolSize = 4 * 1024 * 1024;
     std::memcpy(initializeParam + 8, &poolSize, sizeof(poolSize));
-    Require(sceNpSessionSignalingInitialize(initializeParam) == 0, "initialize failed");
+    Require(sceNpSessionSignalingInitialize(reinterpret_cast<const SessionSignalingInitParam*>(initializeParam)) == 0, "initialize failed");
     Require(sceNpSessionSignalingInitialize(nullptr) == AlreadyInitialized, "initialization check precedes initialize arguments");
     alignas(8) unsigned char contextParam[56] = {};
     std::uint32_t contextId = 0;
@@ -54,24 +43,24 @@ int main() {
     Require(contextId == 0, "invalid context parameter wrote an id");
     Require(sceNpSessionSignalingCreateContext2(nullptr, &contextId) == InvalidArgument, "null context2 parameter");
     Require(contextId == 0, "invalid context2 parameter wrote an id");
-    Require(sceNpSessionSignalingCreateContext(contextParam, nullptr) == InvalidArgument, "null context id");
-    Require(sceNpSessionSignalingCreateContext2(contextParam, nullptr) == InvalidArgument, "null context2 id");
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == 0, "context creation failed");
+    Require(sceNpSessionSignalingCreateContext(reinterpret_cast<const SessionSignalingContextParam1*>(contextParam), nullptr) == InvalidArgument, "null context id");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), nullptr) == InvalidArgument, "null context2 id");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == 0, "context creation failed");
     const auto firstId = contextId;
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == ContextLimit, "duplicate user context");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == ContextLimit, "duplicate user context");
     Require(contextId == firstId, "duplicate context modified output");
     std::array<std::uint32_t, 9> otherContexts{};
     for (std::int32_t userId = 1; userId <= 9; ++userId) {
         std::memcpy(contextParam, &userId, sizeof(userId));
-        Require(sceNpSessionSignalingCreateContext2(contextParam, &otherContexts[userId - 1]) == 0, "create remaining contexts");
+        Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &otherContexts[userId - 1]) == 0, "create remaining contexts");
     }
     const std::int32_t overflowUser = 10;
     std::memcpy(contextParam, &overflowUser, sizeof(overflowUser));
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == ContextLimit, "context limit");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == ContextLimit, "context limit");
     Require(contextId == firstId, "context limit modified output");
     Require(sceNpSessionSignalingDestroyContext(firstId) == 0, "destroy first context");
     Require(sceNpSessionSignalingDestroyContext(firstId) == ContextNotFound, "destroy stale context");
-    Require(sceNpSessionSignalingCreateContext2(contextParam, &contextId) == 0, "reuse context slot");
+    Require(sceNpSessionSignalingCreateContext2(reinterpret_cast<const SessionSignalingContextParam2*>(contextParam), &contextId) == 0, "reuse context slot");
     Require(contextId != firstId, "reused context kept stale id");
 
     std::uint32_t requestId = 0xa5a5a5a5u;
@@ -87,7 +76,7 @@ int main() {
     unsigned char untouched[sizeof(info)];
     std::memcpy(untouched, info, sizeof(info));
     Require(sceNpSessionSignalingGetLocalNetInfo(netContextId, nullptr) == InvalidArgument, "null info");
-    Require(sceNpSessionSignalingGetLocalNetInfo(netContextId, info) == Unavailable, "local net info without network");
+    Require(sceNpSessionSignalingGetLocalNetInfo(netContextId, reinterpret_cast<SessionSignalingLocalNetInfo*>(info)) == Unavailable, "local net info without network");
     Require(std::memcmp(info, untouched, sizeof(info)) == 0, "failed query modified the info");
 
     std::int32_t status = 0x5a5a5a5a;
@@ -101,10 +90,42 @@ int main() {
     Require(sceNpSessionSignalingDeactivate(firstId, 1) == ContextNotFound, "deactivate stale context");
     Require(sceNpSessionSignalingDeactivate(contextId, 1) == GroupNotFound, "deactivate nonexistent group");
 
+    Require(sceNpSessionSignalingGetGroupInfo(netContextId, 1, nullptr) == InvalidArgument, "null group info");
+    Require(sceNpSessionSignalingGetGroupInfo(netContextId, 1, reinterpret_cast<SessionSignalingGroupInfo*>(info)) == GroupNotFound, "group info without a session");
+    Require(std::memcmp(info, untouched, sizeof(info)) == 0, "failed group query modified the info");
+
+    const unsigned char sessionId[48] = {};
+    const unsigned char peer[40] = {};
+    std::int32_t found = 0x5a5a5a5a;
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, nullptr, reinterpret_cast<std::uint32_t*>(&found)) == InvalidArgument, "null session id");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, reinterpret_cast<const char*>(sessionId), nullptr) == InvalidArgument, "null group id");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, reinterpret_cast<const char*>(sessionId), reinterpret_cast<std::uint32_t*>(&found)) == GroupNotFound, "group from session id without a session");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress(netContextId, 0x0100007fu, 3658, nullptr) == InvalidArgument, "null connection id from net address");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress(netContextId, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == ConnectionNotFound, "connection from net address without a session");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0x0100007fu, 3658, nullptr) == InvalidArgument, "null connection id from group net address");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == GroupNotFound, "connection from group net address without a session");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, nullptr, reinterpret_cast<std::uint32_t*>(&found)) == InvalidArgument, "null peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), nullptr) == InvalidArgument, "null connection id from peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), reinterpret_cast<std::uint32_t*>(&found)) == ConnectionNotFound, "connection from peer address without a session");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, nullptr, reinterpret_cast<std::uint32_t*>(&found)) == InvalidArgument, "null group peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), nullptr) == InvalidArgument, "null connection id from group peer address");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress2(netContextId, 1, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), reinterpret_cast<std::uint32_t*>(&found)) == GroupNotFound, "connection from group peer address without a session");
+    Require(sceNpSessionSignalingGetGroupInfo(firstId, 1, reinterpret_cast<SessionSignalingGroupInfo*>(info)) == ContextNotFound, "group info stale context");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(firstId, reinterpret_cast<const char*>(sessionId), reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "group from session id stale context");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress(firstId, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "connection from net address stale context");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(firstId, 1, 0x0100007fu, 3658, reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "connection from group net address stale context");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(firstId, reinterpret_cast<const SessionSignalingPeerAddress*>(peer), reinterpret_cast<std::uint32_t*>(&found)) == ContextNotFound, "connection from peer address stale context");
+    Require(found == 0x5a5a5a5a, "a failed lookup wrote an id");
+
     Require(sceNpSessionSignalingTerminate() == 0, "terminate failed");
     Require(sceNpSessionSignalingDestroyContext(contextId) == NotInitialized, "destroy after terminate");
+    Require(sceNpSessionSignalingGetGroupInfo(netContextId, 1, nullptr) == NotInitialized, "group info after terminate");
+    Require(sceNpSessionSignalingGetGroupFromSessionId(netContextId, nullptr, nullptr) == NotInitialized, "group from session id after terminate");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress(netContextId, 0, 0, nullptr) == NotInitialized, "connection from net address after terminate");
+    Require(sceNpSessionSignalingGetConnectionFromNetAddress2(netContextId, 1, 0, 0, nullptr) == NotInitialized, "connection from group net address after terminate");
+    Require(sceNpSessionSignalingGetConnectionFromPeerAddress(netContextId, nullptr, nullptr) == NotInitialized, "connection from peer address after terminate");
     Require(sceNpSessionSignalingTerminate() == NotInitialized, "repeated terminate");
-    Require(sceNpSessionSignalingInitialize(initializeParam) == 0, "reinitialize");
+    Require(sceNpSessionSignalingInitialize(reinterpret_cast<const SessionSignalingInitParam*>(initializeParam)) == 0, "reinitialize");
     Require(sceNpSessionSignalingRequestPrepare(contextId, &requestId) == ContextNotFound, "reinitialize retained a context");
     Require(sceNpSessionSignalingTerminate() == 0, "final terminate");
 }
diff --git a/core/libs/tests/GuestNpSignalingOffline.cpp b/core/libs/tests/GuestNpSignalingOffline.cpp
new file mode 100644
index 0000000000..4bc7234683
--- /dev/null
+++ b/core/libs/tests/GuestNpSignalingOffline.cpp
@@ -0,0 +1,126 @@
+#include "prx/libSceNpSignaling/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+namespace {
+
+constexpr int SignedOut = static_cast<int>(0x80550006u);
+constexpr int NotInitialized = static_cast<int>(0x80552701u);
+constexpr int AlreadyInitialized = static_cast<int>(0x80552702u);
+constexpr int CtxIdNotAvailable = static_cast<int>(0x80552704u);
+constexpr int CtxNotFound = static_cast<int>(0x80552705u);
+constexpr int ConnNotFound = static_cast<int>(0x8055270Eu);
+constexpr int InvalidArgument = static_cast<int>(0x80552715u);
+constexpr int OwnNpId = static_cast<int>(0x80552716u);
+
+struct SignalingNpId {
+    char handle[16];
+    char term;
+    char dummy[3];
+    std::uint8_t opt[8];
+    std::uint8_t reserved[8];
+};
+static_assert(sizeof(SignalingNpId) == 36);
+
+int failures = 0;
+
+void Require(bool value, const char* name, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s: %s\n", name, what);
+    ++failures;
+}
+
+SignalingNpId MakeNpId(const char* handle) {
+    SignalingNpId id{};
+    std::memcpy(id.handle, handle, std::strlen(handle));
+    return id;
+}
+
+}
+
+int main() {
+    const SignalingNpId owner = MakeNpId("player_1");
+    const SignalingNpId peer = MakeNpId("peer-2");
+    const SignalingNpId maximum = MakeNpId("abcdefghijklmnop");
+    const SignalingNpId tooShort = MakeNpId("ab");
+    const SignalingNpId leadingUnderscore = MakeNpId("_player");
+    const SignalingNpId withDot = MakeNpId("pl.ayer");
+    SignalingNpId latin = MakeNpId("pl\xE9yer");
+    SignalingNpId upper = MakeNpId("Player9");
+    SignalingNpId unterminated = MakeNpId("player_1");
+    unterminated.term = 'x';
+    unsigned char info[64];
+    std::memset(info, 0xA5, sizeof(info));
+    int context = -7;
+    int connection = -7;
+
+    Require(sceNpSignalingCreateContext(nullptr, nullptr, nullptr, nullptr) == NotInitialized, "sceNpSignalingCreateContext", "a call before initialization did not return NOT_INITIALIZED first");
+    Require(sceNpSignalingDeleteContext(1) == NotInitialized, "sceNpSignalingDeleteContext", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpSignalingSetContextOption(1, 1, 1) == NotInitialized, "sceNpSignalingSetContextOption", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpSignalingActivateConnection(1, nullptr, nullptr) == NotInitialized, "sceNpSignalingActivateConnection", "a call before initialization did not return NOT_INITIALIZED first");
+    Require(sceNpSignalingTerminateConnection(1, 1) == NotInitialized, "sceNpSignalingTerminateConnection", "a call before initialization did not return NOT_INITIALIZED");
+    Require(sceNpSignalingGetConnectionInfo(1, 1, 1, nullptr) == NotInitialized, "sceNpSignalingGetConnectionInfo", "a call before initialization did not return NOT_INITIALIZED first");
+    Require(sceNpSignalingTerminate() == NotInitialized, "sceNpSignalingTerminate", "terminating before initialization did not return NOT_INITIALIZED");
+
+    Require(sceNpSignalingInitialize(0, 0, 0, 0) == 0, "sceNpSignalingInitialize", "initialization failed");
+    Require(sceNpSignalingInitialize(0, 0, 0, 0) == AlreadyInitialized, "sceNpSignalingInitialize", "a second initialization did not return ALREADY_INITIALIZED");
+
+    Require(sceNpSignalingCreateContext(nullptr, nullptr, nullptr, &context) == InvalidArgument, "sceNpSignalingCreateContext", "a null SignalingNpId was taken");
+    Require(sceNpSignalingCreateContext(&owner, nullptr, nullptr, nullptr) == InvalidArgument, "sceNpSignalingCreateContext", "a null output was taken");
+    Require(sceNpSignalingCreateContext(&tooShort, nullptr, nullptr, &context) == InvalidArgument, "sceNpSignalingCreateContext", "a two-character online ID was taken");
+    Require(sceNpSignalingCreateContext(&leadingUnderscore, nullptr, nullptr, &context) == InvalidArgument, "sceNpSignalingCreateContext", "an online ID starting with '_' was taken");
+    Require(sceNpSignalingCreateContext(&withDot, nullptr, nullptr, &context) == InvalidArgument, "sceNpSignalingCreateContext", "an online ID with '.' was taken");
+    Require(sceNpSignalingCreateContext(&unterminated, nullptr, nullptr, &context) == InvalidArgument, "sceNpSignalingCreateContext", "an unterminated online ID was taken");
+    Require(sceNpSignalingCreateContext(&latin, nullptr, nullptr, &context) == InvalidArgument, "sceNpSignalingCreateContext", "an online ID with a byte outside ASCII was taken");
+    Require(context == -7, "sceNpSignalingCreateContext", "a refused call wrote the context id");
+
+    Require(sceNpSignalingCreateContext(&owner, nullptr, nullptr, &context) == 0 && context == 1, "sceNpSignalingCreateContext", "the first context is not id 1");
+    Require(sceNpSignalingActivateConnection(context, &upper, &connection) == SignedOut, "sceNpSignalingActivateConnection", "an online ID with upper-case letters and digits was refused");
+    int created = 0;
+    Require(sceNpSignalingCreateContext(&maximum, nullptr, nullptr, &created) == 0 && created == 2, "sceNpSignalingCreateContext", "the second context is not id 2");
+    Require(sceNpSignalingDeleteContext(2) == 0, "sceNpSignalingDeleteContext", "deleting context 2 failed");
+    for (int expected = 3; expected <= 8; ++expected) {
+        Require(sceNpSignalingCreateContext(&maximum, nullptr, nullptr, &created) == 0 && created == expected, "sceNpSignalingCreateContext", "a context id was reused before the ids up to 8 were handed out");
+    }
+    Require(sceNpSignalingCreateContext(&maximum, nullptr, nullptr, &created) == 0 && created == 2, "sceNpSignalingCreateContext", "after id 8 the allocation did not wrap to the free id 2");
+    created = -7;
+    Require(sceNpSignalingCreateContext(&owner, nullptr, nullptr, &created) == CtxIdNotAvailable && created == -7, "sceNpSignalingCreateContext", "a ninth context did not return CTXID_NOT_AVAILABLE");
+
+    Require(sceNpSignalingSetContextOption(99, 2, 5) == CtxNotFound, "sceNpSignalingSetContextOption", "an unknown context was not refused before the option");
+    Require(sceNpSignalingSetContextOption(context, 2, 0) == InvalidArgument, "sceNpSignalingSetContextOption", "option id 2 was taken");
+    Require(sceNpSignalingSetContextOption(context, 1, 2) == InvalidArgument, "sceNpSignalingSetContextOption", "flag value 2 was taken");
+    Require(sceNpSignalingSetContextOption(context, 1, 0) == 0, "sceNpSignalingSetContextOption", "clearing the flag failed");
+    Require(sceNpSignalingSetContextOption(context, 1, 1) == 0, "sceNpSignalingSetContextOption", "setting the flag failed");
+
+    Require(sceNpSignalingActivateConnection(context, nullptr, &connection) == InvalidArgument, "sceNpSignalingActivateConnection", "a null peer was taken");
+    Require(sceNpSignalingActivateConnection(context, &peer, nullptr) == InvalidArgument, "sceNpSignalingActivateConnection", "a null output was taken");
+    Require(sceNpSignalingActivateConnection(99, &tooShort, &connection) == InvalidArgument, "sceNpSignalingActivateConnection", "an invalid peer was not refused before the context");
+    Require(sceNpSignalingActivateConnection(99, &peer, &connection) == CtxNotFound, "sceNpSignalingActivateConnection", "an unknown context was taken");
+    Require(sceNpSignalingActivateConnection(context, &owner, &connection) == OwnNpId, "sceNpSignalingActivateConnection", "the context's own SignalingNpId did not return OWN_NP_ID");
+    Require(sceNpSignalingActivateConnection(context, &peer, &connection) == SignedOut, "sceNpSignalingActivateConnection", "a valid peer did not return SIGNED_OUT");
+    Require(connection == -7, "sceNpSignalingActivateConnection", "a connection id was written");
+
+    Require(sceNpSignalingTerminateConnection(99, 1) == CtxNotFound, "sceNpSignalingTerminateConnection", "an unknown context was taken");
+    Require(sceNpSignalingTerminateConnection(context, 1) == ConnNotFound, "sceNpSignalingTerminateConnection", "a connection that was never created was found");
+    Require(sceNpSignalingGetConnectionInfo(99, 1, 1, nullptr) == InvalidArgument, "sceNpSignalingGetConnectionInfo", "a null output was not refused before the context");
+    Require(sceNpSignalingGetConnectionInfo(99, 1, 1, info) == CtxNotFound, "sceNpSignalingGetConnectionInfo", "an unknown context was taken");
+    Require(sceNpSignalingGetConnectionInfo(context, 1, 1, info) == ConnNotFound, "sceNpSignalingGetConnectionInfo", "a connection that was never created was found");
+    Require(info[0] == 0xA5 && info[63] == 0xA5, "sceNpSignalingGetConnectionInfo", "connection information was written");
+
+    Require(sceNpSignalingDeleteContext(99) == 0, "sceNpSignalingDeleteContext", "deleting an unknown context failed");
+    Require(sceNpSignalingDeleteContext(context) == 0, "sceNpSignalingDeleteContext", "deleting a context failed");
+    Require(sceNpSignalingSetContextOption(context, 1, 1) == CtxNotFound, "sceNpSignalingSetContextOption", "a deleted context was found");
+
+    Require(sceNpSignalingTerminate() == 0, "sceNpSignalingTerminate", "termination failed");
+    Require(sceNpSignalingCreateContext(&owner, nullptr, nullptr, &created) == NotInitialized, "sceNpSignalingCreateContext", "a context was created after termination");
+    Require(sceNpSignalingInitialize(0, 0, 0, 0) == 0, "sceNpSignalingInitialize", "initializing again failed");
+    Require(sceNpSignalingSetContextOption(2, 1, 1) == CtxNotFound, "sceNpSignalingTerminate", "a context created before termination is still found");
+    Require(sceNpSignalingCreateContext(&owner, nullptr, nullptr, &created) == 0 && created == 1, "sceNpSignalingCreateContext", "termination did not release the contexts and restart the ids at 1");
+    Require(sceNpSignalingTerminate() == 0, "sceNpSignalingTerminate", "the second termination failed");
+
+    if (failures != 0) return 1;
+    std::puts("NpSignaling offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpSnsFacebookDialog.cpp b/core/libs/tests/GuestNpSnsFacebookDialog.cpp
new file mode 100644
index 0000000000..347a2dcfe3
--- /dev/null
+++ b/core/libs/tests/GuestNpSnsFacebookDialog.cpp
@@ -0,0 +1,63 @@
+#include "prx/libSceNpSnsFacebookDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000D);
+constexpr int kResultUserCanceled = 1;
+
+}
+
+int main() {
+    std::int64_t param = 0;
+    std::int32_t result[2] = {-1, -1};
+
+    Require(sceNpSnsFacebookDialogTerminate() == kErrNotInitialized);
+    Require(sceNpSnsFacebookDialogOpen(&param) == kErrNotInitialized);
+    Require(sceNpSnsFacebookDialogClose() == kErrNotInitialized);
+    Require(sceNpSnsFacebookDialogGetResult(result) == kErrNotInitialized);
+    Require(sceNpSnsFacebookDialogGetStatus() == kStatusNone);
+    Require(sceNpSnsFacebookDialogUpdateStatus() == kStatusNone);
+
+    Require(sceNpSnsFacebookDialogInitialize() == 0);
+    Require(sceNpSnsFacebookDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceNpSnsFacebookDialogGetStatus() == kStatusInitialized);
+    Require(sceNpSnsFacebookDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceNpSnsFacebookDialogOpen(nullptr) == kErrArgNull);
+    Require(sceNpSnsFacebookDialogGetResult(result) == kErrNotFinished);
+
+    Require(sceNpSnsFacebookDialogOpen(&param) == 0);
+    Require(sceNpSnsFacebookDialogGetStatus() == kStatusFinished);
+    Require(sceNpSnsFacebookDialogUpdateStatus() == kStatusFinished);
+
+    Require(sceNpSnsFacebookDialogGetResult(nullptr) == kErrArgNull);
+    Require(sceNpSnsFacebookDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(result[1] == -1);
+
+    Require(sceNpSnsFacebookDialogClose() == 0);
+    Require(sceNpSnsFacebookDialogTerminate() == 0);
+    Require(sceNpSnsFacebookDialogTerminate() == kErrNotInitialized);
+    Require(sceNpSnsFacebookDialogGetStatus() == kStatusNone);
+    Require(sceNpSnsFacebookDialogUpdateStatus() == kStatusNone);
+
+    Require(sceNpSnsFacebookDialogInitialize() == 0);
+    Require(sceNpSnsFacebookDialogUpdateStatus() == kStatusInitialized);
+    Require(sceNpSnsFacebookDialogClose() == 0);
+    Require(sceNpSnsFacebookDialogUpdateStatus() == kStatusFinished);
+    result[0] = -1;
+    Require(sceNpSnsFacebookDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(sceNpSnsFacebookDialogTerminate() == 0);
+}
diff --git a/core/libs/tests/GuestNpTrophy.cpp b/core/libs/tests/GuestNpTrophy.cpp
index e8a9b8749f..51da08e5d2 100644
--- a/core/libs/tests/GuestNpTrophy.cpp
+++ b/core/libs/tests/GuestNpTrophy.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTrophy/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -9,18 +10,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceNpTrophyCreateContext(int* context, int userId, std::uint32_t serviceLabel, std::uint64_t options);
-int APS5_VABI sceNpTrophyDestroyContext(int context);
-int APS5_VABI sceNpTrophyCreateHandle(int* handle);
-int APS5_VABI sceNpTrophyDestroyHandle(int handle);
-int APS5_VABI sceNpTrophyRegisterContext(int context, int handle, std::uint64_t options);
-int APS5_VABI sceNpTrophyGetTrophyUnlockState(int context, int handle, std::uint32_t* flags, std::uint32_t* count);
-int APS5_VABI sceNpTrophyUnlockTrophy(int context, int handle, int trophyId, int* platinumId);
-int APS5_VABI sceNpTrophyGetGameIcon(int context, int handle, void* buffer, std::uint64_t* size);
-int APS5_VABI sceNpTrophyGetTrophyIcon(int context, int handle, int trophyId, void* buffer, std::uint64_t* size);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80551604u);
@@ -78,10 +67,10 @@ int main() {
     Require(sceNpTrophyCreateHandle(&handle) == 0, "create the handle");
 
     std::uint32_t flags[4] = {}, count = 0;
-    Require(sceNpTrophyGetTrophyUnlockState(context, handle, flags, &count) == NotRegistered, "state before registration");
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == NotRegistered, "state before registration");
     Require(sceNpTrophyRegisterContext(context, handle, 0) == 0, "register the context");
     Require(sceNpTrophyRegisterContext(context, handle, 0) == AlreadyRegistered, "register twice");
-    Require(sceNpTrophyGetTrophyUnlockState(context, handle, flags, &count) == 0 && count == 2 && flags[0] == 0, "two trophies, none unlocked");
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == 0 && count == 2 && flags[0] == 0, "two trophies, none unlocked");
 
     std::uint64_t size = 0;
     Require(sceNpTrophyGetGameIcon(context, handle, nullptr, &size) == 0 && size == 9, "game icon size");
@@ -96,7 +85,7 @@ int main() {
     Require(sceNpTrophyUnlockTrophy(context, handle, 2, &platinum) == InvalidTrophyId, "unlock a trophy past the count");
     Require(sceNpTrophyUnlockTrophy(context, handle, 1, &platinum) == 0 && platinum == -1, "unlock trophy 1");
     Require(sceNpTrophyUnlockTrophy(context, handle, 1, &platinum) == AlreadyUnlocked, "unlock trophy 1 twice");
-    Require(sceNpTrophyGetTrophyUnlockState(context, handle, flags, &count) == 0 && flags[0] == 2u, "trophy 1 unlocked");
+    Require(sceNpTrophyGetTrophyUnlockState(context, handle, reinterpret_cast<TrophyFlagArray*>(flags), &count) == 0 && flags[0] == 2u, "trophy 1 unlocked");
     size = sizeof(icon);
     Require(sceNpTrophyGetTrophyIcon(context, handle, 1, icon, &size) == 0 && size == 6 && std::memcmp(icon, "second", 6) == 0, "icon of the unlocked trophy");
     int saved = -1;
diff --git a/core/libs/tests/GuestNpTrophy2.cpp b/core/libs/tests/GuestNpTrophy2.cpp
index 165d4347f1..2dcaa5f409 100644
--- a/core/libs/tests/GuestNpTrophy2.cpp
+++ b/core/libs/tests/GuestNpTrophy2.cpp
@@ -1,17 +1,11 @@
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libSceNpTrophy2/include/NpTrophy2Constants.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
+#include <cstddef>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceNpTrophy2RegisterUnlockCallback(void*, void*);
-int APS5_VABI sceNpTrophy2UnregisterUnlockCallback();
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetGroupInfo(int, int, int, NpTrophy2GroupDetails*, NpTrophy2GroupData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-int APS5_VABI sceNpTrophy2ShowTrophyList(int);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void APS5_VABI OnUnlock(int, int, void*) {}
@@ -57,4 +51,8 @@ int main() {
     Require(sceNpTrophy2GetTrophyInfo(1, 1, 3, nullptr, &trophyData) == 0);
     Require(trophyData.trophy_id == 3);
     Require(ThrowsInvalidArgument([] { sceNpTrophy2GetTrophyInfo(1, 1, 3, nullptr, nullptr); }));
+    std::size_t iconSize = 1234;
+    Require(sceNpTrophy2GetRewardIcon(1, 1, 1, nullptr, &iconSize) == SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND);
+    Require(iconSize == 0);
+    Require(sceNpTrophy2GetRewardIcon(1, 1, 1, nullptr, nullptr) == SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND);
 }
diff --git a/core/libs/tests/GuestNpTrophyData.cpp b/core/libs/tests/GuestNpTrophyData.cpp
index 5c4eaf025a..6810f8a3da 100644
--- a/core/libs/tests/GuestNpTrophyData.cpp
+++ b/core/libs/tests/GuestNpTrophyData.cpp
@@ -1,7 +1,10 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
 
+#include <algorithm>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
@@ -17,25 +20,8 @@
 struct NpUniversalDataSystemEvent;
 struct NpUniversalDataSystemEventPropertyObject;
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemRegisterContext(int, int, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateHandle(int*);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetGroupInfo(int, int, int, NpTrophy2GroupDetails*, NpTrophy2GroupData*);
-int APS5_VABI sceNpTrophy2GetGroupInfoArray(int, int, uint32_t, uint32_t, NpTrophy2GroupDetails*, NpTrophy2GroupData*, uint32_t*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-int APS5_VABI sceNpTrophy2GetTrophyInfoArray(int, int, uint32_t, uint32_t, NpTrophy2Details*, NpTrophy2Data*, uint32_t*);
-}
-
 static constexpr int InitialUser = 0x10000000;
+static constexpr int InvalidTrophyId = static_cast<int>(0x8055390Au);
 
 static const char TropConf[] = R"({"defaultLanguage":"en-US","trophies":[
     {"id":"0","grade":"P"},
@@ -168,8 +154,18 @@ static void ReportTrophyData(int context) {
     Require(details.trophy_grade == 1 && std::strcmp(details.name, "All of them") == 0, "the platinum is not reported");
     const auto steps = Trophy(context, 5, &details);
     Require(details.target.type == 1 && details.target.value == 5 && !steps.unlocked && steps.progress.type == 1 && steps.progress.value == 0, "the progressive trophy does not report its target");
-    NpTrophy2Data unknown{};
-    Require(ThrowsInvalidArgument([context, &unknown] { sceNpTrophy2GetTrophyInfo(context, 1, 99, nullptr, &unknown); }), "a trophy that is not in the package was reported");
+    const auto untouched = [](const void* bytes, std::size_t size) {
+        const auto* first = static_cast<const unsigned char*>(bytes);
+        return std::all_of(first, first + size, [](unsigned char byte) { return byte == 0x5a; });
+    };
+    for (const int unknownId : {8, 99, -1}) {
+        NpTrophy2Details unknownDetails{};
+        NpTrophy2Data unknown{};
+        std::memset(&unknownDetails, 0x5a, sizeof(unknownDetails));
+        std::memset(&unknown, 0x5a, sizeof(unknown));
+        Require(sceNpTrophy2GetTrophyInfo(context, 1, unknownId, &unknownDetails, &unknown) == InvalidTrophyId, "a trophy that is not in the package did not return the invalid trophy id error");
+        Require(untouched(&unknownDetails, sizeof(unknownDetails)) && untouched(&unknown, sizeof(unknown)), "a trophy that is not in the package wrote its details or data");
+    }
 
     std::vector<NpTrophy2Details> list(10);
     std::vector<NpTrophy2Data> listed(10);
diff --git a/core/libs/tests/GuestNpTrophyStats.cpp b/core/libs/tests/GuestNpTrophyStats.cpp
index a8e94f7516..0128a97160 100644
--- a/core/libs/tests/GuestNpTrophyStats.cpp
+++ b/core/libs/tests/GuestNpTrophyStats.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 #include "prx/libSceNpTrophy2/include/TrophyStore.hpp"
@@ -21,26 +23,6 @@
 struct NpUniversalDataSystemEvent;
 struct NpUniversalDataSystemEventPropertyObject;
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemRegisterContext(int, int, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateHandle(int*);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt32(NpUniversalDataSystemEventPropertyObject*, const char*, uint32_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt64(NpUniversalDataSystemEventPropertyObject*, const char*, int64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetUInt64(NpUniversalDataSystemEventPropertyObject*, const char*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetFloat32(NpUniversalDataSystemEventPropertyObject*, const char*, float);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetObject(NpUniversalDataSystemEventPropertyObject*, const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-}
-
 static constexpr int InitialUser = 0x10000000;
 
 static const char TropConf[] = R"({"defaultLanguage":"en-US","trophies":[
@@ -165,13 +147,13 @@ private:
     int saved = -1;
 };
 
-struct Uds {
+struct UdsSession {
     int context = 0;
     int handle = 0;
 };
 
-static Uds OpenUds(std::uint32_t serviceLabel) {
-    Uds uds;
+static UdsSession OpenUds(std::uint32_t serviceLabel) {
+    UdsSession uds;
     Require(sceNpUniversalDataSystemCreateContext(&uds.context, InitialUser, serviceLabel, 0) == 0, "UDS context was not created");
     Require(sceNpUniversalDataSystemCreateHandle(&uds.handle) == 0, "UDS handle was not created");
     Require(sceNpUniversalDataSystemRegisterContext(uds.context, uds.handle, 0) == 0, "UDS context was not registered");
@@ -179,7 +161,7 @@ static Uds OpenUds(std::uint32_t serviceLabel) {
 }
 
 template <typename TSet>
-static void Post(const Uds& uds, const char* name, TSet set) {
+static void Post(const UdsSession& uds, const char* name, TSet set) {
     NpUniversalDataSystemEventPropertyObject* properties = nullptr;
     Require(sceNpUniversalDataSystemCreateEventPropertyObject(&properties) == 0, "property object was not created");
     set(properties);
diff --git a/core/libs/tests/GuestNpTrophyUnlocks.cpp b/core/libs/tests/GuestNpTrophyUnlocks.cpp
index be3d6e2859..ba632255da 100644
--- a/core/libs/tests/GuestNpTrophyUnlocks.cpp
+++ b/core/libs/tests/GuestNpTrophyUnlocks.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceNpUniversalDataSystem/include/Api.hpp"
+#include "prx/libSceNpTrophy2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceNpTrophy2/include/NpTrophy2Types.hpp"
 
@@ -12,21 +14,6 @@
 struct NpUniversalDataSystemEvent;
 struct NpUniversalDataSystemEventPropertyObject;
 
-extern "C" {
-int APS5_VABI sceNpUniversalDataSystemCreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemRegisterContext(int, int, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateHandle(int*);
-int APS5_VABI sceNpUniversalDataSystemCreateEvent(const char*, const NpUniversalDataSystemEventPropertyObject*, NpUniversalDataSystemEvent**, NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEvent(NpUniversalDataSystemEvent*);
-int APS5_VABI sceNpUniversalDataSystemPostEvent(int, int, const void*, uint64_t);
-int APS5_VABI sceNpUniversalDataSystemCreateEventPropertyObject(NpUniversalDataSystemEventPropertyObject**);
-int APS5_VABI sceNpUniversalDataSystemDestroyEventPropertyObject(NpUniversalDataSystemEventPropertyObject*);
-int APS5_VABI sceNpUniversalDataSystemEventPropertyObjectSetInt32(NpUniversalDataSystemEventPropertyObject*, const char*, int32_t);
-int APS5_VABI sceNpTrophy2CreateContext(int*, int, uint32_t, uint64_t);
-int APS5_VABI sceNpTrophy2GetGameInfo(int, int, NpTrophy2GameDetails*, NpTrophy2GameData*);
-int APS5_VABI sceNpTrophy2GetTrophyInfo(int, int, int, NpTrophy2Details*, NpTrophy2Data*);
-}
-
 static constexpr int InitialUser = 0x10000000;
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestNpTus.cpp b/core/libs/tests/GuestNpTus.cpp
index 11d9cf5cf5..b80d87fa8b 100644
--- a/core/libs/tests/GuestNpTus.cpp
+++ b/core/libs/tests/GuestNpTus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTus/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -5,37 +6,6 @@
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t serviceLabel, int userId);
-int APS5_VABI sceNpTusDeleteNpTitleCtx(int titleCtxId);
-int APS5_VABI sceNpTusCreateRequest(int titleCtxId);
-int APS5_VABI sceNpTusDeleteRequest(int reqId);
-int APS5_VABI sceNpTusAbortRequest(int reqId);
-int APS5_VABI sceNpTusPollAsync(int reqId, int* result);
-int APS5_VABI sceNpTusGetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusWaitAsync(int reqId, int* result);
-int APS5_VABI sceNpTusGetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, int arrayLen, void* option);
-}
-
 static constexpr int SIGNED_OUT = static_cast<int>(0x80550006);
 static constexpr int INVALID_ARGUMENT = static_cast<int>(0x80550704);
 static constexpr int TOO_MANY_OBJECTS = static_cast<int>(0x80550706);
@@ -51,6 +21,34 @@ static void RequireFinished(int reqId, int expected) {
     Require(sceNpTusPollAsync(reqId, &result) == 0 && result == expected);
 }
 
+static void CheckTssTitleContexts() {
+    const int shared = sceNpTssCreateNpTitleCtxA(0, 1);
+    Require(shared > 0);
+    const int request = sceNpTusCreateRequest(shared);
+    Require(request > 0);
+    Require(sceNpTusDeleteNpTitleCtx(shared) == 0);
+    Require(sceNpTusDeleteNpTitleCtx(shared) == INVALID_ID);
+    Require(sceNpTusDeleteRequest(request) == INVALID_ID);
+
+    const NpId npId{};
+    Require(sceNpTssCreateNpTitleCtx(0, nullptr) == INSUFFICIENT_ARGUMENT);
+    Require(sceNpTssCreateNpTitleCtx(0xFFFFFFFFu, nullptr) == INSUFFICIENT_ARGUMENT);
+    Require(sceNpTssCreateNpTitleCtx(0xFFFFFFFFu, &npId) == INVALID_ARGUMENT);
+
+    std::array<int, 32> contexts{};
+    for (std::size_t index = 0; index < contexts.size(); ++index) {
+        const std::size_t form = index % 3;
+        contexts[index] = form == 0 ? sceNpTusCreateNpTitleCtxA(0, 1) : form == 1 ? sceNpTssCreateNpTitleCtxA(0, 1) : sceNpTssCreateNpTitleCtx(0, &npId);
+        Require(contexts[index] > 0);
+    }
+    Require(sceNpTssCreateNpTitleCtxA(0, 1) == TOO_MANY_OBJECTS);
+    Require(sceNpTssCreateNpTitleCtx(0, &npId) == TOO_MANY_OBJECTS);
+    Require(sceNpTusCreateNpTitleCtxA(0, 1) == TOO_MANY_OBJECTS);
+    Require(sceNpTssCreateNpTitleCtx(0, nullptr) == INSUFFICIENT_ARGUMENT);
+    Require(sceNpTssCreateNpTitleCtx(0xFFFFFFFFu, &npId) == INVALID_ARGUMENT);
+    for (const int context : contexts) Require(sceNpTusDeleteNpTitleCtx(context) == 0);
+}
+
 static void CheckMultiSlotVariables() {
     const int context = sceNpTusCreateNpTitleCtxA(0, 1);
     Require(context > 0);
@@ -271,4 +269,5 @@ int main() {
     Require(sceNpTusCreateRequest(contexts[1]) > 0);
     for (const int child : children) Require(sceNpTusPollAsync(child, &result) == INVALID_ID);
     for (std::size_t index = 1; index < contexts.size(); ++index) Require(sceNpTusDeleteNpTitleCtx(contexts[index]) == 0);
+    CheckTssTitleContexts();
 }
diff --git a/core/libs/tests/GuestNpTusOffline.cpp b/core/libs/tests/GuestNpTusOffline.cpp
index af24d244c8..565dcceaa4 100644
--- a/core/libs/tests/GuestNpTusOffline.cpp
+++ b/core/libs/tests/GuestNpTusOffline.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpTus/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,95 +6,6 @@
 #include <cstring>
 #include <functional>
 
-extern "C" {
-int APS5_VABI sceNpTusCreateNpTitleCtxA(std::uint32_t, int);
-int APS5_VABI sceNpTusCreateRequest(int);
-int APS5_VABI sceNpTusDeleteRequest(int);
-int APS5_VABI sceNpTusWaitAsync(int, int*);
-int APS5_VABI sceNpTssGetSmallStorage(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
-int APS5_VABI sceNpTssGetSmallStorageAsync(int reqId, void* data, std::uint64_t maxSize, std::uint64_t* contentLength, void* option);
-int APS5_VABI sceNpTusAddAndGetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusAddAndGetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int64_t inVariable, const void* isLastChangedAuthor, const void* isLastChangedDate, void* outVariable, std::uint64_t outVariableSize, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotData(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotDataA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotDataAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusDeleteMultiSlotDataAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
-int APS5_VABI sceNpTusGetFriendsDataStatus(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetFriendsDataStatusAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetFriendsVariable(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetFriendsVariableAsync(int reqId, std::int32_t slotId, std::int32_t includeSelf, std::int32_t sortType, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatus(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusA(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusAsync(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSave(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiSlotDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatus(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserDataStatusVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* statusArray, std::uint64_t statusArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariable(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableA(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableAsync(int reqId, const void* targetNpIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveAsync(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableVUser(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusGetMultiUserVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
-int APS5_VABI sceNpTusSetDataA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusSetDataVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
-int APS5_VABI sceNpTusTryAndSetVariable(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableA(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableAsync(int reqId, const void* targetNpId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSave(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveAsync(int reqId, std::uint64_t targetAccountId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const std::uint64_t* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-int APS5_VABI sceNpTusTryAndSetVariableVUserAsync(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
-}
-
 namespace {
 
 constexpr int SignedOut = static_cast<int>(0x80550006u);
@@ -137,11 +49,13 @@ void CheckAsync(const char* name, const std::function<int(int)>& valid, const st
     int result = 0;
     Require(sceNpTusWaitAsync(req, &result) == 0 && result == SignedOut, name, "the request did not finish signed out");
     sceNpTusDeleteRequest(req);
+
     Require(unknownRequest() == InvalidId, name, "an unknown request was not refused with INVALID_ID");
     if (withOption) {
         req = NewRequest();
         Require(withOption(req) == InvalidArgument, name, "a non-null option was not refused with INVALID_ARGUMENT");
         sceNpTusDeleteRequest(req);
+
     }
 }
 
@@ -149,6 +63,7 @@ void CheckSync(const char* name, const std::function<int(int)>& call) {
     const int req = NewRequest();
     Require(call(req) == SignedOut, name, "the synchronous call did not return SIGNED_OUT");
     sceNpTusDeleteRequest(req);
+
 }
 
 }
@@ -261,6 +176,7 @@ int main() {
         Require(sceNpTusGetFriendsVariableAsync(req, 1, 0, 5, buffer, sizeof(buffer), 2, nullptr) == InvalidArgument, "sceNpTusGetFriendsVariableAsync", "sort type 5 was taken");
         Require(sceNpTusGetFriendsVariableAsync(req, 1, 0, 1, buffer, sizeof(buffer), 101, nullptr) == TooManyNpId, "sceNpTusGetFriendsVariableAsync", "101 friends were taken");
         sceNpTusDeleteRequest(req);
+
     }
     if (failures != 0) return 1;
     std::puts("NpTus offline request tests passed");
diff --git a/core/libs/tests/GuestNpUtilityOffline.cpp b/core/libs/tests/GuestNpUtilityOffline.cpp
new file mode 100644
index 0000000000..42c76ec96c
--- /dev/null
+++ b/core/libs/tests/GuestNpUtilityOffline.cpp
@@ -0,0 +1,129 @@
+#include "prx/libSceNpUtility/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+
+namespace {
+
+constexpr int SignedOut = static_cast<int>(0x80550006u);
+constexpr int InvalidArgument = static_cast<int>(0x80550704u);
+constexpr int TooManyObjects = static_cast<int>(0x80550706u);
+constexpr int Aborted = static_cast<int>(0x80550707u);
+constexpr int InsufficientArgument = static_cast<int>(0x8055070Cu);
+constexpr int InvalidId = static_cast<int>(0x8055070Eu);
+constexpr int InvalidType = static_cast<int>(0x80550711u);
+constexpr int PollFinished = 0;
+constexpr int PollRunning = 1;
+constexpr int WordFilterTitleCtxBase = 0x01000000;
+constexpr int WordFilterRequestBase = 0x02000000;
+
+int failures = 0;
+unsigned char selfNpId[36];
+unsigned char npId[36];
+char sanitized[0x402];
+char longComment[0x402];
+const std::uint64_t asyncParam[3] = {0x18, 0, 0};
+const std::uint64_t wrongAsyncParam[3] = {0x10, 0, 0};
+
+void Require(bool value, const char* name, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "%s: %s\n", name, what);
+    ++failures;
+}
+
+void CheckLookup() {
+    NpOnlineId onlineId{};
+    std::strcpy(onlineId.data, "player_1");
+    Require(sceNpLookupCreateTitleCtx(nullptr) == InsufficientArgument, "sceNpLookupCreateTitleCtx", "a null NpId was taken");
+    const int context = sceNpLookupCreateTitleCtx(selfNpId);
+    Require(context == 1, "sceNpLookupCreateTitleCtx", "the first lookup context is not id 1");
+    Require(sceNpLookupCreateRequest(context + 100) == InvalidId, "sceNpLookupCreateRequest", "an unknown context was taken");
+    const int req = sceNpLookupCreateRequest(context);
+    Require(req == 1, "sceNpLookupCreateRequest", "the first lookup request is not id 1");
+    std::memset(npId, 0xA5, sizeof(npId));
+    Require(sceNpLookupNpId(req, nullptr, nullptr, &onlineId) == InvalidArgument, "sceNpLookupNpId", "an option was not refused before the null arguments");
+    Require(sceNpLookupNpId(req, nullptr, npId, nullptr) == InsufficientArgument, "sceNpLookupNpId", "a null online ID was taken");
+    Require(sceNpLookupNpId(req, &onlineId, nullptr, nullptr) == InsufficientArgument, "sceNpLookupNpId", "a null NpId output was taken");
+    Require(sceNpLookupNpId(req + 100, &onlineId, npId, nullptr) == InvalidId, "sceNpLookupNpId", "an unknown request was taken");
+    Require(sceNpLookupNpId(req, &onlineId, npId, nullptr) == SignedOut, "sceNpLookupNpId", "the lookup did not return SIGNED_OUT");
+    Require(sceNpLookupNpId(req, &onlineId, npId, nullptr) == InvalidType, "sceNpLookupNpId", "a used request did not return INVALID_TYPE");
+    Require(npId[0] == 0xA5 && npId[35] == 0xA5, "sceNpLookupNpId", "an NpId was written");
+    Require(sceNpLookupDeleteRequest(req) == 0, "sceNpLookupDeleteRequest", "deleting the request failed");
+    Require(sceNpLookupDeleteRequest(req) == InvalidId, "sceNpLookupDeleteRequest", "a deleted request was found");
+    int requests[32];
+    for (int& request : requests) request = sceNpLookupCreateRequest(context);
+    Require(requests[31] > 0, "sceNpLookupCreateRequest", "32 requests could not be created");
+    Require(sceNpLookupCreateRequest(context) == TooManyObjects, "sceNpLookupCreateRequest", "a 33rd request did not return TOO_MANY_OBJECTS");
+    Require(sceNpLookupDeleteTitleCtx(context) == 0, "sceNpLookupDeleteTitleCtx", "deleting the context failed");
+    Require(sceNpLookupDeleteRequest(requests[0]) == InvalidId, "sceNpLookupDeleteTitleCtx", "a request of the deleted context was kept");
+    Require(sceNpLookupDeleteTitleCtx(context) == InvalidId, "sceNpLookupDeleteTitleCtx", "a deleted context was found");
+    int contexts[32];
+    for (int& entry : contexts) entry = sceNpLookupCreateTitleCtx(selfNpId);
+    Require(contexts[0] == 2 && contexts[31] == 33, "sceNpLookupCreateTitleCtx", "lookup context ids do not keep counting from 2");
+    Require(sceNpLookupCreateTitleCtx(selfNpId) == TooManyObjects, "sceNpLookupCreateTitleCtx", "a 33rd context did not return TOO_MANY_OBJECTS");
+    for (const int entry : contexts) sceNpLookupDeleteTitleCtx(entry);
+}
+
+void CheckWordFilter() {
+    Require(sceNpWordFilterCreateTitleCtx(nullptr) == InsufficientArgument, "sceNpWordFilterCreateTitleCtx", "a null NpId was taken");
+    const int context = sceNpWordFilterCreateTitleCtx(selfNpId);
+    Require(context == WordFilterTitleCtxBase + 1, "sceNpWordFilterCreateTitleCtx", "the first word filter context is not 0x01000001");
+    Require(sceNpWordFilterCreateAsyncRequest(context, nullptr) == InvalidArgument, "sceNpWordFilterCreateAsyncRequest", "a null parameter was taken");
+    Require(sceNpWordFilterCreateAsyncRequest(context, wrongAsyncParam) == InvalidArgument, "sceNpWordFilterCreateAsyncRequest", "a parameter size other than 0x18 was taken");
+    Require(sceNpWordFilterCreateAsyncRequest(context + 100, asyncParam) == InvalidId, "sceNpWordFilterCreateAsyncRequest", "an unknown context was taken");
+    const int sync = sceNpWordFilterCreateRequest(context);
+    Require(sync == WordFilterRequestBase + 1, "sceNpWordFilterCreateRequest", "the first word filter request is not 0x02000001");
+    std::memset(longComment, 'a', 0x400);
+    longComment[0x400] = 0;
+    Require(sceNpWordFilterCensorComment(sync, nullptr, &sanitized) == InsufficientArgument, "sceNpWordFilterCensorComment", "a null comment was not refused before the option");
+    Require(sceNpWordFilterCensorComment(sync, "word", &sanitized) == InvalidArgument, "sceNpWordFilterCensorComment", "an option was taken");
+    longComment[0x400] = 'a';
+    Require(sceNpWordFilterCensorComment(sync, longComment, nullptr) == InvalidArgument, "sceNpWordFilterCensorComment", "a 0x401-byte comment was taken");
+    Require(sceNpWordFilterCensorComment(sync + 100, "word", nullptr) == InvalidId, "sceNpWordFilterCensorComment", "an unknown request was taken");
+    longComment[0x400] = 0;
+    Require(sceNpWordFilterCensorComment(sync, longComment, nullptr) == SignedOut, "sceNpWordFilterCensorComment", "a 0x400-byte comment did not return SIGNED_OUT");
+    Require(sceNpWordFilterCensorComment(sync, "word", nullptr) == InvalidType, "sceNpWordFilterCensorComment", "a used request did not return INVALID_TYPE");
+    int result = 7;
+    Require(sceNpWordFilterPollAsync(sync, &result) == InvalidId && result == 7, "sceNpWordFilterPollAsync", "a synchronous request was polled");
+    Require(sceNpWordFilterDeleteRequest(sync) == 0, "sceNpWordFilterDeleteRequest", "deleting the request failed");
+
+    const int async = sceNpWordFilterCreateAsyncRequest(context, asyncParam);
+    Require(async == WordFilterRequestBase + 2, "sceNpWordFilterCreateAsyncRequest", "the asynchronous request did not take the next id");
+    Require(sceNpWordFilterPollAsync(async, nullptr) == InvalidArgument, "sceNpWordFilterPollAsync", "a null result was taken");
+    Require(sceNpWordFilterPollAsync(async + 100, &result) == InvalidId, "sceNpWordFilterPollAsync", "an unknown request was taken");
+    Require(sceNpWordFilterPollAsync(async, &result) == PollRunning && result == 7, "sceNpWordFilterPollAsync", "an unstarted request was not running");
+    std::memset(sanitized, 'z', sizeof(sanitized));
+    Require(sceNpWordFilterSanitizeComment(async, "word", nullptr, nullptr) == InsufficientArgument, "sceNpWordFilterSanitizeComment", "a null output was taken");
+    Require(sceNpWordFilterSanitizeComment(async, nullptr, sanitized, &result) == InsufficientArgument, "sceNpWordFilterSanitizeComment", "a null comment was not refused before the option");
+    Require(sceNpWordFilterSanitizeComment(async, "word", sanitized, &result) == InvalidArgument, "sceNpWordFilterSanitizeComment", "an option was taken");
+    Require(sceNpWordFilterSanitizeComment(async, "word", sanitized, nullptr) == 0, "sceNpWordFilterSanitizeComment", "the asynchronous request did not start");
+    Require(sceNpWordFilterPollAsync(async, &result) == PollFinished && result == SignedOut, "sceNpWordFilterPollAsync", "the request did not finish with SIGNED_OUT");
+    Require(sanitized[0] == 'z' && sanitized[4] == 'z', "sceNpWordFilterSanitizeComment", "a sanitized comment was written");
+    Require(sceNpWordFilterAbortRequest(async) == 0, "sceNpWordFilterAbortRequest", "aborting a finished request failed");
+    Require(sceNpWordFilterPollAsync(async, &result) == PollFinished && result == SignedOut, "sceNpWordFilterAbortRequest", "aborting a finished request changed its result");
+
+    const int aborted = sceNpWordFilterCreateAsyncRequest(context, asyncParam);
+    Require(sceNpWordFilterAbortRequest(aborted + 100) == InvalidId, "sceNpWordFilterAbortRequest", "an unknown request was taken");
+    Require(sceNpWordFilterAbortRequest(aborted) == 0, "sceNpWordFilterAbortRequest", "aborting failed");
+    Require(sceNpWordFilterPollAsync(aborted, &result) == PollFinished && result == Aborted, "sceNpWordFilterAbortRequest", "an aborted request did not finish with ABORTED");
+    Require(sceNpWordFilterCensorComment(aborted, "word", nullptr) == Aborted, "sceNpWordFilterCensorComment", "an aborted request did not return ABORTED");
+
+    const int kept = sceNpWordFilterCreateRequest(context);
+    Require(sceNpWordFilterDeleteTitleCtx(context) == 0, "sceNpWordFilterDeleteTitleCtx", "deleting the context failed");
+    Require(sceNpWordFilterDeleteRequest(kept) == InvalidId, "sceNpWordFilterDeleteTitleCtx", "a request of the deleted context was kept");
+    Require(sceNpWordFilterDeleteTitleCtx(context) == InvalidId, "sceNpWordFilterDeleteTitleCtx", "a deleted context was found");
+    Require(sceNpLookupDeleteTitleCtx(context) == InvalidId, "sceNpLookupDeleteTitleCtx", "a word filter context was found among the lookup contexts");
+}
+
+}
+
+int main() {
+    std::memset(selfNpId, 0, sizeof(selfNpId));
+    std::strcpy(reinterpret_cast<char*>(selfNpId), "player_1");
+    CheckLookup();
+    CheckWordFilter();
+    if (failures != 0) return 1;
+    std::puts("NpUtility offline tests passed");
+    return 0;
+}
diff --git a/core/libs/tests/GuestNpWebApi.cpp b/core/libs/tests/GuestNpWebApi.cpp
index 9281e58632..55fc787258 100644
--- a/core/libs/tests/GuestNpWebApi.cpp
+++ b/core/libs/tests/GuestNpWebApi.cpp
@@ -1,19 +1,9 @@
+#include "prx/libSceNpWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize);
-int APS5_VABI sceNpWebApiTerminate(int libCtxId);
-int APS5_VABI sceNpWebApiCreateHandle(int libCtxId);
-int APS5_VABI sceNpWebApiDeleteHandle(int libCtxId, int handleId);
-int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterParam, std::size_t filterParamNum);
-int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId);
-int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, unsigned npServiceLabel, const void* filterParam, std::size_t filterParamNum);
-int APS5_VABI sceNpWebApiDeleteServicePushEventFilter(int libCtxId, int filterId);
-}
-
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80552902u);
diff --git a/core/libs/tests/GuestNpWebApi2.cpp b/core/libs/tests/GuestNpWebApi2.cpp
index 1adccd989d..6144dccf18 100644
--- a/core/libs/tests/GuestNpWebApi2.cpp
+++ b/core/libs/tests/GuestNpWebApi2.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceNpWebApi2/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,31 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-struct NpWebApi2MemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-extern "C" {
-int APS5_VABI sceNpWebApi2Initialize(int, std::size_t);
-int APS5_VABI sceNpWebApi2InitializeForPresence(int, std::uint64_t);
-int APS5_VABI sceNpWebApi2IntInitialize(const NpWebApi2IntInitializeArgs*);
-int APS5_VABI sceNpWebApi2IntInitialize2(const NpWebApi2IntInitialize2Args*);
-int APS5_VABI sceNpWebApi2Terminate(int);
-int APS5_VABI sceNpWebApi2GetMemoryPoolStats(int, NpWebApi2MemoryPoolStats*);
-int APS5_VABI sceNpWebApi2PushEventCreateHandle(int);
-int APS5_VABI sceNpWebApi2PushEventAbortHandle(int, int);
-int APS5_VABI sceNpWebApi2PushEventDeleteHandle(int, int);
-int APS5_VABI sceNpWebApi2PushEventSetHandleTimeout(int, int, std::uint32_t);
-int APS5_VABI sceNpWebApi2CreateUserContext(int, int);
-int APS5_VABI sceNpWebApi2CreateRequest(int, const char*, const char*, const char*, const void*, std::int64_t*);
-int APS5_VABI sceNpWebApi2SetRequestTimeout(std::int64_t, std::uint32_t);
-int APS5_VABI sceNpWebApi2AddWebTraceTag(std::int64_t, const char*);
-int APS5_VABI sceNpWebApi2DeleteRequest(std::int64_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestOfflineImports.cpp b/core/libs/tests/GuestOfflineImports.cpp
index 54acdb9e0c..3dd2c7a0b7 100644
--- a/core/libs/tests/GuestOfflineImports.cpp
+++ b/core/libs/tests/GuestOfflineImports.cpp
@@ -1,3 +1,7 @@
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
+#include "prx/libSceRudp/include/Api.hpp"
+#include "prx/libSceNpEntitlementAccess/include/Api.hpp"
+#include "prx/libSceHttp/include/Http.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -6,32 +10,6 @@
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
-#include <string_view>
-
-extern "C" {
-int APS5_VABI sceVideoRecordingGetInfo(std::int32_t info, void* data, std::size_t size);
-int APS5_VABI sceVideoRecordingSetInfo(std::int32_t info, const void* data, std::size_t size);
-int APS5_VABI sceNpEntitlementAccessAbortRequest(std::int64_t);
-int APS5_VABI sceNpEntitlementAccessDeleteRequest(std::int64_t);
-int APS5_VABI sceHttpSetCookieEnabled(int, int);
-int APS5_VABI sceHttpSendRequest(int, const void*, std::size_t);
-int APS5_VABI sceNpEntitlementAccessGetEntitlementKey(
-    std::uint32_t, const NpUnifiedEntitlementLabel*, NpEntitlementAccessEntitlementKey*);
-int APS5_VABI sceNpEntitlementAccessGetGameTrialsFlag(std::uint32_t*);
-int APS5_VABI sceNpEntitlementAccessGetPftFlag(std::uint32_t*);
-int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
-int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfoList(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabels, std::uint32_t labelCount, const NpEntitlementAccessListParameter* parameter, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfoList(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* infos, std::uint32_t capacity, std::int32_t* firstResult, std::int32_t* secondResult, std::int32_t* thirdResult);
-int APS5_VABI sceNpEntitlementAccessRequestUnifiedEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollUnifiedEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessUnifiedInfo* info);
-int APS5_VABI sceNpEntitlementAccessRequestServiceEntitlementInfo(std::int32_t userId, std::uint32_t serviceLabel, const NpServiceEntitlementLabel* entitlementLabel, std::int64_t* requestId);
-int APS5_VABI sceNpEntitlementAccessPollServiceEntitlementInfo(std::int64_t requestId, std::int32_t* result, NpEntitlementAccessServiceInfo* info);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpActivate(std::int32_t, const void*, std::uint32_t);
-int APS5_VABI sceRudpGetStatus(void*, std::size_t);
-int APS5_VABI sceRudpEnd();
-}
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -65,31 +43,21 @@ int main() {
         bool deleteFailed = false;
         try {
             sceNpEntitlementAccessAbortRequest(requestId);
+
         } catch (const std::logic_error&) {
             abortFailed = true;
         }
         try {
             sceNpEntitlementAccessDeleteRequest(requestId);
+
         } catch (const std::logic_error&) {
             deleteFailed = true;
         }
         Require(abortFailed && deleteFailed);
     }
 
-    constexpr int invalidValue = static_cast<int>(0x804311FE);
     constexpr int network = static_cast<int>(0x80431063);
-    Require(sceHttpSetCookieEnabled(1, 0) == 0);
     Require(sceHttpSendRequest(1, nullptr, 0) == network);
-    bool cookieUnsupported = false;
-    try {
-        sceHttpSetCookieEnabled(1, 1);
-    } catch (const std::runtime_error& error) {
-        cookieUnsupported = std::string_view(error.what()) == "sceHttpSetCookieEnabled not implemented";
-    }
-    Require(cookieUnsupported);
-    for (int enabled : {-1, 2, 0x100}) {
-        Require(sceHttpSetCookieEnabled(1, enabled) == invalidValue);
-    }
 
     constexpr int parameter = static_cast<int>(0x817D0002);
     constexpr int noEntitlement = static_cast<int>(0x817D0007);
diff --git a/core/libs/tests/GuestOnce.cpp b/core/libs/tests/GuestOnce.cpp
index 3e60f58ec3..be0de52b29 100644
--- a/core/libs/tests/GuestOnce.cpp
+++ b/core/libs/tests/GuestOnce.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -6,20 +9,9 @@
 #include <cstdlib>
 #include <thread>
 
-struct GuestOnce { std::int32_t state; void* mutex; };
 static_assert(sizeof(GuestOnce) == 16 && offsetof(GuestOnce, mutex) == 8);
 using Initializer = void (APS5_VABI *)();
-extern "C" {
-int APS5_VABI pthread_once_nid_postfix(GuestOnce*, Initializer);
-int APS5_VABI scePthreadOnce(std::int32_t* once, Initializer init);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-void APS5_VABI scePthreadExit(void* retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-void APS5_VABI scePthreadTestcancel();
-Pthread APS5_VABI scePthreadSelf();
-void APS5_VABI __pthread_cleanup_push_imp_nid_postfix(void (APS5_VABI* routine)(void*), void* argument, void* info);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static GuestOnce control{}, nested{}, retry{};
 static std::atomic<int> calls{0}, arrived{0};
@@ -41,12 +33,14 @@ static void APS5_VABI ExitInsideInitializer() { scePthreadExit(nullptr); }
 static void APS5_VABI CancelInsideInitializer() {
     Require(scePthreadCancel(scePthreadSelf()) == 0);
     scePthreadTestcancel();
+
 }
 static void APS5_VABI CountRetry() { ++retried; }
 static void APS5_VABI AbortCleanup(void*) { std::abort(); }
 static void APS5_VABI PushAndThrow() {
     std::uintptr_t info[8];
     __pthread_cleanup_push_imp_nid_postfix(AbortCleanup, nullptr, info);
+
     throw 7;
 }
 static GuestOnce pushed{};
diff --git a/core/libs/tests/GuestOperationMode.cpp b/core/libs/tests/GuestOperationMode.cpp
index b3fe29f518..e0f08ff13c 100644
--- a/core/libs/tests/GuestOperationMode.cpp
+++ b/core/libs/tests/GuestOperationMode.cpp
@@ -1,10 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <stdexcept>
-extern "C" {
-void APS5_VABI sceKernelGetOperationMode(int* mode, int* submode);
-int APS5_VABI sceKernelIsTrinityMode(void);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static bool Throws(int* mode, int* submode) {
     try { sceKernelGetOperationMode(mode, submode); } catch (const std::invalid_argument&) { return true; }
@@ -13,6 +11,7 @@ static bool Throws(int* mode, int* submode) {
 int main() {
     int out[4] = {-1, -1, -1, -1};
     sceKernelGetOperationMode(&out[0], &out[2]);
+
     Require(out[0] == 2 && out[1] == -1);
     Require(out[2] == 0 && out[3] == -1);
     int value = -1;
diff --git a/core/libs/tests/GuestOpusCeltDec.cpp b/core/libs/tests/GuestOpusCeltDec.cpp
index 3245cc824e..653acfe878 100644
--- a/core/libs/tests/GuestOpusCeltDec.cpp
+++ b/core/libs/tests/GuestOpusCeltDec.cpp
@@ -1,18 +1,12 @@
+#include "prx/libSceOpusCeltDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
 #include <cstdint>
 #include <cstdlib>
+#include <cstdio>
 #include <stdexcept>
-
-extern "C" {
-int APS5_VABI sceOpusCeltDecInitialize(std::uint32_t*);
-int APS5_VABI sceOpusCeltDecTerminate(const std::uint32_t*);
-int APS5_VABI sceOpusCeltDecGetSize(int);
-int APS5_VABI sceOpusCeltDecCreateEx(const std::uint32_t*, void*, int, int);
-int APS5_VABI sceOpusCeltDecDecode(void*, const std::uint8_t*, int, std::int16_t*, int);
-int APS5_VABI sceOpusCeltDecDestroy(void*);
-}
+#include <opus.h>
 
 namespace {
 
@@ -128,18 +122,30 @@ int main() {
     for (int rate : {0, 22050, 44100, 96000})
         Require(sceOpusCeltDecCreateEx(&context, unsupported.data(), rate, 2) == static_cast<int>(errorBase + 2));
     for (int rate : {8000, 12000, 16000, 24000, 48000}) {
-        std::array<std::uint8_t, 640> toneState{};
-        Require(sceOpusCeltDecCreateEx(&context, toneState.data(), rate, 2) == 0);
-        const int samples = 960 * rate / 48000;
-        std::array<std::int16_t, 1922> tone{};
-        for (int frame = 0; frame < 4; ++frame) {
-            tone.fill(12345);
-            RequireThrows([&] { sceOpusCeltDecDecode(toneState.data(), CELT_TONE[frame], 60, tone.data() + 1, samples * 4 - 1); });
-            Require(sceOpusCeltDecDecode(toneState.data(), CELT_TONE[frame], 60, tone.data() + 1, samples * 4) == samples * 4);
-            Require(tone[0] == 12345 && tone[samples * 2 + 1] == 12345);
-            if (frame == 1 || frame == 2) RequireTone(tone.data() + 1, samples, 2, rate);
+        for (int channels : {1, 2}) {
+            std::array<std::uint8_t, 640> toneState{};
+            Require(sceOpusCeltDecCreateEx(&context, toneState.data(), rate, channels) == 0);
+            int error = OPUS_OK;
+            auto* reference = opus_decoder_create(rate, channels, &error);
+            Require(reference && error == OPUS_OK);
+            const int samples = 960 * rate / 48000;
+            std::array<std::int16_t, 1922> tone{};
+            for (int frame = 0; frame < 4; ++frame) {
+                tone.fill(12345);
+                RequireThrows([&] { sceOpusCeltDecDecode(toneState.data(), CELT_TONE[frame], 60, tone.data() + 1, samples * channels * 2 - 1); });
+                Require(sceOpusCeltDecDecode(toneState.data(), CELT_TONE[frame], 60, tone.data() + 1, samples * channels * 2) == samples * channels * 2);
+                Require(tone[0] == 12345 && tone[samples * channels + 1] == 12345);
+                std::array<std::int16_t, 1920> expected{};
+                Require(opus_decode(reference, CELT_TONE[frame], 60, expected.data(), samples, 0) == samples);
+                if (!std::equal(expected.begin(), expected.begin() + samples * channels, tone.begin() + 1)) {
+                    std::fprintf(stderr, "CELT PCM differs from libopus at %d Hz, %d channels, frame %d\n", rate, channels, frame);
+                    std::abort();
+                }
+                if (frame == 1 || frame == 2) RequireTone(tone.data() + 1, samples, channels, rate);
+            }
+            opus_decoder_destroy(reference);
+            Require(sceOpusCeltDecDestroy(toneState.data()) == 0);
         }
-        Require(sceOpusCeltDecDestroy(toneState.data()) == 0);
     }
 
     Require(sceOpusCeltDecDestroy(state.data()) == 0);
diff --git a/core/libs/tests/GuestOpusDec.cpp b/core/libs/tests/GuestOpusDec.cpp
index e19fb78141..24eddac922 100644
--- a/core/libs/tests/GuestOpusDec.cpp
+++ b/core/libs/tests/GuestOpusDec.cpp
@@ -1,19 +1,14 @@
+#include "prx/libSceOpusDec/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
 #include <cmath>
 #include <cstdint>
 #include <cstdlib>
+#include <cstdio>
+#include <span>
 #include <stdexcept>
-
-extern "C" {
-int APS5_VABI sceOpusDecInitialize(std::uint32_t*);
-int APS5_VABI sceOpusDecTerminate(const std::uint32_t*);
-int APS5_VABI sceOpusDecGetSize(int);
-int APS5_VABI sceOpusDecCreateEx(const std::uint32_t*, void*, int, int);
-int APS5_VABI sceOpusDecDecode(void*, const std::uint8_t*, int, std::int16_t*, int);
-int APS5_VABI sceOpusDecDestroy(void*);
-}
+#include <opus.h>
 
 namespace {
 
@@ -46,12 +41,56 @@ const std::uint8_t OPUS_NARROWBAND[] = {
     10, 0, 0x08, 0x85, 0x89, 0x9D, 0x73, 0x0F, 0xC2, 0xB1, 0xE2, 0x48,
 };
 
+void CheckReference(int rate, int channels) {
+    std::uint32_t context = 0;
+    std::array<std::uint8_t, 640> state{};
+    Require(sceOpusDecInitialize(&context) == 0);
+    Require(sceOpusDecCreateEx(&context, state.data(), rate, channels) == 0);
+    int error = OPUS_OK;
+    auto* reference = opus_decoder_create(rate, channels, &error);
+    Require(reference && error == OPUS_OK);
+    std::array<std::uint8_t, 1500> longPacket{};
+    auto* repacketizer = opus_repacketizer_create();
+    Require(repacketizer != nullptr);
+    for (int i = 0; i < 6; ++i) Require(opus_repacketizer_cat(repacketizer, OPUS_STEREO + 2, OPUS_STEREO[0]) == OPUS_OK);
+    const int longSize = opus_repacketizer_out(repacketizer, longPacket.data() + 2, static_cast<opus_int32>(longPacket.size() - 2));
+    Require(longSize > 0);
+    opus_repacketizer_destroy(repacketizer);
+    longPacket[0] = static_cast<std::uint8_t>(longSize);
+    longPacket[1] = static_cast<std::uint8_t>(longSize >> 8);
+    for (auto packets : {std::span<const std::uint8_t>(OPUS_NARROWBAND), std::span<const std::uint8_t>(OPUS_STEREO),
+             std::span<const std::uint8_t>(OPUS_NARROWBAND), std::span<const std::uint8_t>(longPacket.data(), longSize + 2)}) {
+        for (std::size_t offset = 0; offset < packets.size();) {
+            const int bytes = packets[offset] | (packets[offset + 1] << 8);
+            const auto* packet = packets.data() + offset + 2;
+            std::array<std::int16_t, 11520> expected{};
+            const int samples = opus_decode(reference, packet, bytes, expected.data(), 5760, 0);
+            Require(samples > 0);
+            const int count = samples * channels;
+            std::array<std::int16_t, 11522> actual{};
+            actual.fill(12345);
+            Require(sceOpusDecDecode(state.data(), packet, bytes, actual.data() + 1, count * 2 + 1) == count * 2);
+            if (!std::equal(expected.begin(), expected.begin() + count, actual.begin() + 1)) {
+                std::fprintf(stderr, "Opus PCM differs from libopus at %d Hz, %d channels, packet offset %zu\n", rate, channels, offset);
+                std::abort();
+            }
+            Require(actual.front() == 12345 && std::all_of(actual.begin() + count + 1, actual.end(), [](auto value) { return value == 12345; }));
+            offset += bytes + 2;
+        }
+    }
+    opus_decoder_destroy(reference);
+    Require(sceOpusDecDestroy(state.data()) == 0);
+    Require(sceOpusDecTerminate(&context) == 0);
+}
+
 } // namespace
 
 int main() {
     constexpr std::uint32_t errorBase = 0x81740000u;
     Require(sceOpusDecInitialize(nullptr) == static_cast<int>(errorBase + 13));
     Require(sceOpusDecDestroy(nullptr) == static_cast<int>(errorBase));
+    for (int rate : {8000, 12000, 16000, 24000, 48000})
+        for (int channels : {1, 2}) CheckReference(rate, channels);
     std::uint32_t context = 0, otherContext = 0;
     Require(sceOpusDecInitialize(&context) == 0);
     std::array<std::uint8_t, 640> invalidState{};
diff --git a/core/libs/tests/GuestOverflowError.cpp b/core/libs/tests/GuestOverflowError.cpp
index 9bfb21a082..7b7e633934 100644
--- a/core/libs/tests/GuestOverflowError.cpp
+++ b/core/libs/tests/GuestOverflowError.cpp
@@ -1,10 +1,11 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
+
 struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const void* what; };
 
 extern "C" {
@@ -12,8 +13,7 @@ extern const TypeRecord _ZTISt13runtime_error_nid_postfix;
 extern const TypeRecord _ZTISt14overflow_error_nid_postfix;
 extern const Vtable _ZTVSt13runtime_error_nid_postfix;
 extern const Vtable _ZTVSt14overflow_error_nid_postfix;
-void APS5_VABI _ZNSt13runtime_errorC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(Object*);
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -27,12 +27,15 @@ int main() {
     const auto& runtimeTable = _ZTVSt13runtime_error_nid_postfix;
     Require(table.offset == 0 && table.type == &type);
     Require(table.destroy == runtimeTable.destroy && table.deleteObject == runtimeTable.deleteObject && table.what == runtimeTable.what);
-    Object object{};
+    LibcException::ExceptionObject object{};
     _ZNSt13runtime_errorC1EPKc_nid_postfix(&object, "value too large");
+
     Require(object.message != nullptr && std::strcmp(object.message, "value too large") == 0);
     _ZNSt14overflow_errorD1Ev_nid_postfix(&object);
+
     Require(object.message == nullptr);
     _ZNSt14overflow_errorD1Ev_nid_postfix(&object);
+
     Require(object.message == nullptr);
     return 0;
 }
diff --git a/core/libs/tests/GuestPad.cpp b/core/libs/tests/GuestPad.cpp
index 335c38cea7..e7c2f60371 100644
--- a/core/libs/tests/GuestPad.cpp
+++ b/core/libs/tests/GuestPad.cpp
@@ -6,6 +6,7 @@
 #include <array>
 #include <chrono>
 #include <cstdlib>
+#include <cstdio>
 #include <cstring>
 #include <filesystem>
 #include <fstream>
@@ -13,30 +14,6 @@
 #include <thread>
 #include <utility>
 
-extern "C" {
-int APS5_VABI scePadOpen_nid_postfix(int, int, int, const void*);
-int APS5_VABI scePadOpenExt(int, int, int, const void*);
-int APS5_VABI scePadClose_nid_postfix(int);
-int APS5_VABI scePadGetHandle(int, int, int);
-int APS5_VABI scePadSetVibrationTriggerEffectWeakWhileEmbeddedMicInUse(bool);
-int APS5_VABI scePadSetVibrationMode(int, int);
-int APS5_VABI scePadInit_nid_postfix(void);
-int APS5_VABI scePadUnknown_n3kSX62fgNo();
-int APS5_VABI scePadRead_nid_postfix(int, PadData*, int);
-int APS5_VABI scePadReadState(int, PadData*);
-int APS5_VABI scePadSetTiltCorrectionState(int, bool);
-int APS5_VABI scePadResetOrientation(int);
-int APS5_VABI scePadSetAngularVelocityDeadbandState(int, bool);
-int APS5_VABI scePadSetAngularVelocityBiasCorrectionState(int, bool);
-int APS5_VABI scePadIsRemoteController(int, bool*);
-int APS5_VABI scePadGetAccessibilityControllerState(int, std::uint32_t*);
-int APS5_VABI scePadGetControllerInformation(int, PadControllerInformation*);
-int APS5_VABI scePadGetExtControllerInformation(int, void*);
-int APS5_VABI scePadResetLightBar(int);
-int APS5_VABI scePadSetLightBar(int, const PadLightBarParam*);
-int APS5_VABI scePadSetMotionSensorState(int, bool);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckInputCommands() {
@@ -149,6 +126,17 @@ static void CheckAngularVelocityDeadband(int handle) {
     PadPublishInput_nid_postfix(PadInputState{});
 }
 
+static void CheckStickDeadZones(int handle) {
+    PadControllerInformation info{};
+    Require(scePadGetControllerInformation(handle, &info) == PAD_OK);
+    Require(info.stickInfo.deadZoneLeft == 13 && info.stickInfo.deadZoneRight == 13);
+    std::array<std::uint8_t, 0x2c> extended{};
+    Require(scePadGetExtControllerInformation(handle, extended.data()) == PAD_OK);
+    PadControllerInformation base{};
+    std::memcpy(&base, extended.data(), sizeof(base));
+    Require(base.stickInfo.deadZoneLeft == 13 && base.stickInfo.deadZoneRight == 13);
+}
+
 static void CheckTouchContact() {
     PadInputState touch;
     touch.buttons = static_cast<std::uint32_t>(Pad::PadButton::TouchPad);
@@ -296,6 +284,96 @@ static void CheckReadStateHandle(int handle) {
     Require(scePadReadState(handle, nullptr) == PAD_ERROR_INVALID_ARG);
 }
 
+static void CheckSpecialPort(int user, int handle) {
+    constexpr int noHandle = static_cast<int>(0x80920008);
+    constexpr int alreadyOpened = static_cast<int>(0x80920004);
+    const int special = scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr);
+    Require(special > 0 && special != handle);
+    Require(scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr) == alreadyOpened);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == special);
+    Require(scePadGetHandle(user, 0, 0) == handle);
+    PadData data[2];
+    std::memset(data, 0xff, sizeof(data));
+    Require(scePadRead_nid_postfix(special, nullptr, 1) == PAD_ERROR_INVALID_ARG);
+    Require(scePadRead_nid_postfix(special, data, 0) == PAD_ERROR_INVALID_ARG);
+    Require(scePadRead_nid_postfix(special, data, 2) == 1);
+    Require(!data[0].connected && data[0].connected_count == 0 && data[0].buttons == 0 && data[0].timestamp == 0);
+    Require(data[0].left_stick_x == 0x80 && data[0].left_stick_y == 0x80 && data[0].right_stick_x == 0x80 && data[0].right_stick_y == 0x80);
+    Require(data[0].analog_buttons_l2 == 0 && data[0].orientation_x == 0.0f && data[0].orientation_w == 1.0f);
+    Require(data[0].acceleration_x == 0.0f && data[0].acceleration_y == 1.0f && data[0].acceleration_z == 0.0f && data[0].touch_data_touch_num == 0);
+    Require(data[1].buttons == 0xffffffff);
+    std::memset(data, 0xff, sizeof(data[0]));
+    Require(scePadReadState(special, nullptr) == PAD_ERROR_INVALID_ARG);
+    Require(scePadReadState(special, data) == PAD_OK);
+    Require(!data[0].connected && data[0].connected_count == 0 && data[0].buttons == 0);
+    Require(data[0].left_stick_x == 0x80 && data[0].orientation_w == 1.0f && data[0].acceleration_y == 1.0f);
+    PadControllerInformation info;
+    std::memset(&info, 0xff, sizeof(info));
+    Require(scePadGetControllerInformation(special, nullptr) == PAD_ERROR_INVALID_ARG);
+    Require(scePadGetControllerInformation(special, &info) == PAD_OK);
+    Require(!info.connected && info.connectedCount == 0 && info.deviceClass == 0);
+    PadDeviceClassData classData;
+    std::memset(&classData, 0xff, sizeof(classData));
+    Require(scePadDeviceClassParseData(special, data, &classData) == PAD_OK);
+    Require(!classData.dataValid && classData.deviceClass == 0);
+    PadDeviceClassExtendedInformation extended;
+    std::memset(&extended, 0xff, sizeof(extended));
+    Require(scePadDeviceClassGetExtendedInformation(special, &extended) == PAD_OK);
+    Require(extended.deviceClass == -1 && extended.reserved[0] == 0);
+    Require(scePadDeviceClassGetExtendedInformation(handle, &extended) == PAD_OK);
+    Require(extended.deviceClass == 0);
+    const PadVibrationParam vibration{0, 0};
+    const PadLightBarParam lightBar{0, 0, 255};
+    Require(scePadSetVibration(special, nullptr) == PAD_ERROR_INVALID_ARG);
+    Require(scePadSetVibration(special, &vibration) == PAD_OK);
+    Require(scePadSetLightBar(special, &lightBar) == PAD_OK);
+    Require(scePadResetLightBar(special) == PAD_OK);
+    Require(scePadSetMotionSensorState(special, true) == PAD_OK);
+    Require(scePadResetOrientation(special) == PAD_OK);
+    Require(scePadReadState(handle, data) == PAD_OK);
+    Require(data[0].connected);
+    Require(scePadGetControllerInformation(handle, &info) == PAD_OK);
+    Require(info.connected && info.connectedCount == 1);
+    Require(scePadClose_nid_postfix(special) == PAD_OK);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    Require(scePadClose_nid_postfix(special) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadRead_nid_postfix(special, data, 1) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadReadState(special, data) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadGetControllerInformation(special, &info) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadGetHandle(user, 0, 0) == handle);
+    Require(scePadReadState(handle, data) == PAD_OK);
+    const int other = user + 1;
+    const int first = scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr);
+    const int second = scePadOpen_nid_postfix(other, PAD_PORT_TYPE_SPECIAL, 0, nullptr);
+    Require(first > 0 && second > 0 && first != second && second != handle);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == first);
+    Require(scePadGetHandle(other, PAD_PORT_TYPE_SPECIAL, 0) == second);
+    Require(scePadOpen_nid_postfix(other, PAD_PORT_TYPE_SPECIAL, 0, nullptr) == alreadyOpened);
+    Require(scePadClose_nid_postfix(first) == PAD_OK);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    Require(scePadGetHandle(other, PAD_PORT_TYPE_SPECIAL, 0) == second);
+    Require(scePadRead_nid_postfix(first, data, 1) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadRead_nid_postfix(second, data, 1) == 1);
+    Require(!data[0].connected);
+    const int again = scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr);
+    Require(again > 0 && again != second);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == again);
+    Require(scePadClose_nid_postfix(again) == PAD_OK);
+    Require(scePadClose_nid_postfix(second) == PAD_OK);
+    Require(scePadGetHandle(other, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    std::array<int, 16> handles{};
+    for (int i = 0; i < 16; ++i) {
+        handles[i] = scePadOpen_nid_postfix(user + i, PAD_PORT_TYPE_SPECIAL, 0, nullptr);
+        Require(handles[i] > 0 && handles[i] != handle && (i == 0 || handles[i] != handles[i - 1]));
+    }
+    Require(scePadOpen_nid_postfix(user + 16, PAD_PORT_TYPE_SPECIAL, 0, nullptr) == static_cast<int>(0x809b0081));
+    Require(scePadGetHandle(user + 16, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    Require(scePadGetHandle(user + 15, PAD_PORT_TYPE_SPECIAL, 0) == handles[15]);
+    for (int i = 0; i < 16; ++i) Require(scePadClose_nid_postfix(handles[i]) == PAD_OK);
+    Require(scePadGetHandle(user + 15, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    Require(scePadGetHandle(user, 0, 0) == handle);
+}
+
 static void CheckRemoteController(int handle) {
     bool remote = true;
     Require(scePadIsRemoteController(handle + 1, &remote) == PAD_ERROR_INVALID_HANDLE);
@@ -305,6 +383,48 @@ static void CheckRemoteController(int handle) {
     Require(!remote);
 }
 
+static void CheckTrackerDevices(int handle) {
+    for (const int candidate : {handle, handle + 1}) {
+        Require(!scePadIsDS4Connected(candidate));
+        Require(!scePadIsBlasterConnected(candidate));
+        Require(!scePadIsMoveConnected(candidate));
+    }
+}
+
+static void CheckSystemRemote(int handle) {
+    constexpr int noHandle = static_cast<int>(0x80920008);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0) == noHandle);
+    const int remote = scePadOpen_nid_postfix(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0, nullptr);
+    Require(remote > 0 && remote != handle);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0) == remote);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 1) == noHandle);
+    PadData drained[64]{};
+    scePadRead_nid_postfix(handle, drained, 64);
+    PadInputState pressed;
+    pressed.buttons = static_cast<std::uint32_t>(Pad::PadButton::Cross);
+    PadPublishInput_nid_postfix(pressed);
+    PadData data{};
+    data.buttons = ~0u;
+    data.connected = true;
+    Require(scePadReadState(remote, &data) == PAD_OK);
+    Require(data.buttons == 0 && !data.connected);
+    Require(scePadReadState(remote, nullptr) == PAD_ERROR_INVALID_ARG);
+    PadData queued[4]{};
+    queued[0].connected = true;
+    Require(scePadRead_nid_postfix(remote, queued, 4) == 1);
+    Require(queued[0].buttons == 0 && !queued[0].connected);
+    PadLightBarParam lightBar{1, 2, 3};
+    Require(scePadSetLightBar(remote, &lightBar) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadReadState(handle, &data) == PAD_OK);
+    Require((data.buttons & pressed.buttons) != 0 && data.connected);
+    PadPublishInput_nid_postfix(PadInputState{});
+    scePadRead_nid_postfix(handle, drained, 64);
+    Require(scePadClose_nid_postfix(remote) == PAD_OK);
+    Require(scePadGetHandle(PAD_USER_ID_SYSTEM, PAD_PORT_TYPE_REMOTE, 0) == noHandle);
+    Require(scePadReadState(remote, &data) == PAD_ERROR_INVALID_HANDLE);
+    Require(scePadReadState(handle, &data) == PAD_OK);
+}
+
 static void CheckAccessibilityControllerState(int handle) {
     std::uint32_t state = 7;
     Require(scePadGetAccessibilityControllerState(handle + 1, nullptr) == PAD_ERROR_INVALID_ARG);
@@ -314,6 +434,15 @@ static void CheckAccessibilityControllerState(int handle) {
     Require(state == 0);
 }
 
+static void CheckControllerType(int handle) {
+    std::int32_t type = -1;
+    Require(scePadGetControllerType(handle + 1, nullptr) == PAD_ERROR_INVALID_ARG);
+    Require(scePadGetControllerType(handle + 1, &type) == PAD_ERROR_INVALID_HANDLE);
+    Require(type == -1);
+    Require(scePadGetControllerType(handle, &type) == PAD_OK);
+    Require(type == PAD_CONTROLLER_TYPE_DUAL_SENSE);
+}
+
 static void CheckInjectedState(const std::filesystem::path& path) {
     PadInputState physical;
     physical.buttons = 0x2000;
@@ -372,12 +501,53 @@ static void CheckInjectedState(const std::filesystem::path& path) {
     PadPublishInput_nid_postfix(PadInputState{});
 }
 
+static void CheckInjectedQueueTimes(const std::filesystem::path& path) {
+    PadData drained[64]{};
+    Pad::Read(drained, 64);
+    PadInputState physical;
+    physical.buttons = 0x2000;
+    PadPublishInput_nid_postfix(physical);
+    const auto before = Pad::ReadState();
+    std::ofstream(path) << "5 16384 300\n";
+    PadData pressed{};
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    do {
+        pressed = Pad::ReadState();
+        if ((pressed.buttons & 0x4000) != 0) break;
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    } while (std::chrono::steady_clock::now() < deadline);
+    Require(pressed.buttons == 0x6000 && pressed.timestamp > before.timestamp);
+    PadData queued{};
+    Require(Pad::Read(&queued, 1) == 1);
+    Require(queued.buttons == pressed.buttons);
+    if (queued.timestamp < pressed.timestamp) {
+        std::fputs("queued input predates its injected button press\n", stderr);
+        std::abort();
+    }
+    physical.sticks[0] = 130;
+    PadPublishInput_nid_postfix(physical);
+    std::this_thread::sleep_for(std::chrono::milliseconds(310));
+    const auto released = Pad::ReadState();
+    Require(released.buttons == 0x2000 && released.timestamp > pressed.timestamp);
+    Require(Pad::Read(&queued, 1) == 1);
+    Require(queued.buttons == released.buttons && queued.left_stick_x == 130);
+    if (queued.timestamp < released.timestamp) {
+        std::fputs("queued input predates its injected button release\n", stderr);
+        std::abort();
+    }
+    PadPublishInput_nid_postfix(PadInputState{});
+}
+
 int main() {
     CheckInputCommands();
     std::uint32_t accessibilityState = 7;
     Require(scePadGetAccessibilityControllerState(PAD_HANDLE, nullptr) == PAD_ERROR_NOT_INITIALIZED);
     Require(scePadGetAccessibilityControllerState(PAD_HANDLE, &accessibilityState) == PAD_ERROR_NOT_INITIALIZED);
     Require(accessibilityState == 7);
+    std::int32_t controllerType = -1;
+    Require(scePadGetControllerType(PAD_HANDLE, nullptr) == PAD_ERROR_NOT_INITIALIZED);
+    Require(scePadGetControllerType(PAD_HANDLE, &controllerType) == PAD_ERROR_NOT_INITIALIZED);
+    Require(controllerType == -1);
     Require(scePadUnknown_n3kSX62fgNo() == static_cast<int>(0x80920005));
     const auto path = std::filesystem::temp_directory_path() / ("anyps5-pad-state-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
     struct Cleanup {
@@ -426,30 +596,43 @@ int main() {
     Require(scePadOpenExt(user, PAD_PORT_TYPE_SPECIAL, 1, wheel) == PAD_ERROR_INVALID_ARG);
     Require(scePadOpenExt(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr) == PAD_ERROR_INVALID_ARG);
     Require(scePadGetHandle(user, 0, 0) == noHandle);
-    Require(scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr) == static_cast<int>(0x80920007));
+    const int earlySpecial = scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr);
+    Require(earlySpecial > 0);
     Require(scePadGetHandle(user, 0, 0) == noHandle);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == earlySpecial);
+    Require(scePadClose_nid_postfix(earlySpecial) == PAD_OK);
+    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
+    PadSetPortConnected_nid_postfix(1, true);
     Require(scePadInit_nid_postfix() == 0);
+    PadInfo initInfo{};
+    Require(scePadGetInfo_nid_postfix(&initInfo) == PAD_OK);
+    Require(initInfo.connectedCount[0] == 2);
+    Require(initInfo.padTypeInfo[0].connectPort == 0);
+    Require(initInfo.padTypeInfo[1].connectPort == 1);
+    PadSetPortConnected_nid_postfix(1, false);
     Require(scePadUnknown_n3kSX62fgNo() == PAD_OK);
     const int handle = scePadOpen_nid_postfix(user, 0, 0, nullptr);
     Require(handle > 0);
     Require(scePadUnknown_n3kSX62fgNo() == PAD_OK);
     Require(scePadGetHandle(user, 0, 0) == handle);
-    Require(scePadOpen_nid_postfix(user, PAD_PORT_TYPE_SPECIAL, 0, nullptr) == static_cast<int>(0x80920007));
-    Require(scePadGetHandle(user, PAD_PORT_TYPE_SPECIAL, 0) == noHandle);
-    Require(scePadGetHandle(user, 0, 0) == handle);
+    CheckSpecialPort(user, handle);
     CheckTiltCorrection(handle);
     CheckAngularVelocityDeadband(handle);
     CheckTouchContact();
     CheckVirtualTouchContact();
     CheckTouchPadInformation(handle);
+    CheckStickDeadZones(handle);
     CheckPartialTrigger();
     CheckReadQueue(handle);
     CheckTapBetweenReads();
     CheckLatchedPressLifetime(handle);
     CheckReadStateHandle(handle);
     CheckRemoteController(handle);
+    CheckTrackerDevices(handle);
     CheckAccessibilityControllerState(handle);
+    CheckControllerType(handle);
     CheckInjectedState(commandPath);
+    CheckInjectedQueueTimes(commandPath);
     PadLightBarParam lightBar{255, 128, 64};
     Require(scePadSetLightBar(handle, &lightBar) == PAD_OK);
     Require(scePadSetLightBar(handle, nullptr) == PAD_ERROR_INVALID_ARG);
@@ -466,7 +649,7 @@ int main() {
     Require(scePadSetVibrationMode(handle, 5) == 0);
     Require(scePadSetVibrationMode(handle, 6) == PAD_ERROR_INVALID_ARG);
     Require(scePadSetVibrationMode(handle, -1) == PAD_ERROR_INVALID_ARG);
-    Require(scePadGetHandle(0xff, 16, 0) == handle);
+    CheckSystemRemote(handle);
     Require(scePadGetHandle(user, 16, 0) == noHandle);
     Require(scePadGetHandle(user, 0, 1) == noHandle);
     Require(scePadClose_nid_postfix(handle) == 0);
@@ -478,4 +661,42 @@ int main() {
     Require(scePadSetAngularVelocityDeadbandState(handle + 1, true) == PAD_ERROR_INVALID_HANDLE);
     Require(scePadSetAngularVelocityBiasCorrectionState(handle, false) == PAD_OK);
     Require(scePadSetAngularVelocityBiasCorrectionState(handle + 1, false) == PAD_ERROR_INVALID_HANDLE);
+    PadInfo info{};
+    Require(scePadGetInfo_nid_postfix(&info) == PAD_OK);
+    Require(info.maxConnectCount == PAD_MAX_CONTROLLERS);
+    Require(info.connectedCount[0] == 1);
+    Require(info.padTypeInfo[0].connectPort == 0);
+
+    const int user2 = 0x10000001;
+    Require(scePadGetHandle(user2, 0, 0) == noHandle);
+    const int handle2 = scePadOpen_nid_postfix(user2, 0, 0, nullptr);
+    Require(handle2 == PAD_HANDLE_BASE + 1);
+    Require(scePadGetHandle(user2, 0, 0) == handle2);
+
+    PadInputState p2Input{};
+    p2Input.buttons = static_cast<std::uint32_t>(Pad::PadButton::Triangle);
+    PadPublishInputForPort_nid_postfix(1, p2Input);
+    PadData p2Data{};
+    Require(scePadReadState(handle2, &p2Data) == 0);
+    Require((p2Data.buttons & static_cast<std::uint32_t>(Pad::PadButton::Triangle)) != 0);
+
+    Require(scePadSetVibrationMode(handle2, 1) == 0);
+    std::uint32_t p2AccessState = 7;
+    Require(scePadGetAccessibilityControllerState(handle2, &p2AccessState) == PAD_OK);
+    Require(p2AccessState == 0);
+
+    PadSetPortConnected_nid_postfix(1, true);
+    Require(scePadGetInfo_nid_postfix(&info) == PAD_OK);
+    Require(info.connectedCount[0] == 2);
+    Require(info.padTypeInfo[0].connectPort == 0);
+    Require(info.padTypeInfo[1].connectPort == 1);
+    PadSetPortConnected_nid_postfix(1, false);
+    Require(scePadGetInfo_nid_postfix(&info) == PAD_OK);
+    Require(info.connectedCount[0] == 1);
+    Require(info.padTypeInfo[0].connectPort == 0);
+
+    Require(scePadClose_nid_postfix(handle2) == 0);
+    Require(scePadGetHandle(user2, 0, 0) == noHandle);
+    Require(scePadSetAngularVelocityDeadbandState(handle2, false) == PAD_OK);
+    Require(scePadSetAngularVelocityDeadbandState(handle2 + 1, false) == PAD_ERROR_INVALID_HANDLE);
 }
diff --git a/core/libs/tests/GuestPadVibrationMode.cpp b/core/libs/tests/GuestPadVibrationMode.cpp
index 1d826fedb1..3b82071a1f 100644
--- a/core/libs/tests/GuestPadVibrationMode.cpp
+++ b/core/libs/tests/GuestPadVibrationMode.cpp
@@ -3,13 +3,6 @@
 #include <cstdlib>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI scePadInit_nid_postfix(void);
-int APS5_VABI scePadOpen_nid_postfix(int userId, int type, int index, const void* param);
-int APS5_VABI scePadClose_nid_postfix(int handle);
-int APS5_VABI scePadSetVibrationMode(int handle, int mode);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestPageTableStats.cpp b/core/libs/tests/GuestPageTableStats.cpp
index eba38dd12c..18b33b9f39 100644
--- a/core/libs/tests/GuestPageTableStats.cpp
+++ b/core/libs/tests/GuestPageTableStats.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 
@@ -7,17 +8,6 @@
 #include <cstdlib>
 #include <source_location>
 
-extern "C" {
-int APS5_VABI sceKernelGetPageTableStats(int*, int*, int*, int*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-int APS5_VABI sceKernelReserveVirtualRange(void**, std::size_t, int, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Page table stats check failed at %s:%u\n", location.file_name(), static_cast<unsigned>(location.line()));
@@ -76,7 +66,7 @@ static void CheckCpuGranules() {
     RequireTaken(before, 1, 0);
     Map(base + PageTableGranule, 0x4000, 0);
     RequireTaken(before, 2, 0);
-    Require(sceKernelMunmap(base, GpuDirectorySpan * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), GpuDirectorySpan * 2) == 0);
     RequireTaken(before, 0, 0);
 }
 
@@ -89,7 +79,7 @@ static void CheckGpuEntries() {
     RequireTaken(before, 3, 4);
     Map(base + GpuDirectorySpan, 0x4000, 0x33);
     RequireTaken(before, 4, 6);
-    Require(sceKernelMunmap(base, GpuDirectorySpan * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), GpuDirectorySpan * 2) == 0);
     RequireTaken(before, 0, 0);
 }
 
@@ -106,13 +96,26 @@ static void CheckGpuDirectMapping() {
     Require(sceKernelMapDirectMemory(&small, 0x10000, 0x33, 0x10, phys + static_cast<std::int64_t>(2 * PageTableGranule), 0x10000) == 0);
     Require(small == base + 2 * PageTableGranule + 0x10000);
     RequireTaken(before, 3, 2);
-    Require(sceKernelMunmap(base, GpuDirectorySpan * 2) == 0);
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(base), GpuDirectorySpan * 2) == 0);
     Require(sceKernelReleaseDirectMemory(phys, 3 * PageTableGranule) == 0);
     RequireTaken(before, 0, 0);
 }
 
+static void CheckTraceMemoryStats() {
+    std::uint64_t first[2] = {0xaaaaaaaaaaaaaaaaull, 0xaaaaaaaaaaaaaaaaull};
+    std::uint64_t second[2] = {0xaaaaaaaaaaaaaaaaull, 0xaaaaaaaaaaaaaaaaull};
+    Require(sceKernelGetTraceMemoryStats(first, second) == 0);
+    Require(first[0] == 0 && first[1] == 0xaaaaaaaaaaaaaaaaull && second[0] == 0 && second[1] == 0xaaaaaaaaaaaaaaaaull);
+    first[0] = 1;
+    Require(sceKernelGetTraceMemoryStats(first, nullptr) == 0 && first[0] == 0);
+    second[0] = 1;
+    Require(sceKernelGetTraceMemoryStats(nullptr, second) == 0 && second[0] == 0);
+    Require(sceKernelGetTraceMemoryStats(nullptr, nullptr) == 0);
+}
+
 int main() {
     CheckRejectedArguments();
+    CheckTraceMemoryStats();
     CheckCpuGranules();
     CheckGpuEntries();
     CheckGpuDirectMapping();
diff --git a/core/libs/tests/GuestParentProcess.cpp b/core/libs/tests/GuestParentProcess.cpp
index 203cfe3a00..6098a0766a 100644
--- a/core/libs/tests/GuestParentProcess.cpp
+++ b/core/libs/tests/GuestParentProcess.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #ifdef _WIN32
@@ -5,12 +7,7 @@
 #else
 #include <unistd.h>
 #endif
-extern "C" {
-int APS5_VABI getpid_nid_postfix(void);
-int APS5_VABI getppid_nid_postfix(void);
-int APS5_VABI getsid_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     const int self = getpid_nid_postfix();
@@ -21,6 +18,72 @@ int main() {
     Require(*__error_nid_postfix() == 3);
     Require(getsid_nid_postfix(-1) == -1);
     Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(-1, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(0, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(self, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(-1, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgid_nid_postfix(123456, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, 0) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, self) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, 123456) == -1);
+    Require(*__error_nid_postfix() == 1);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(-1, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(0, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(self, -1) == -1);
+    Require(*__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(-1, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(setpgrp_nid_postfix(123456, 0) == -1);
+    Require(*__error_nid_postfix() == 3);
     const int parent = getppid_nid_postfix();
     Require(parent > 0 && parent != getpid_nid_postfix());
     Require(getppid_nid_postfix() == parent);
diff --git a/core/libs/tests/GuestPathCase.cpp b/core/libs/tests/GuestPathCase.cpp
index 18b87e9c6e..675bd28809 100644
--- a/core/libs/tests/GuestPathCase.cpp
+++ b/core/libs/tests/GuestPathCase.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -8,21 +10,6 @@
 #include <fstream>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-int APS5_VABI chdir_nid_postfix(const char*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI remove_nid_postfix(const char*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckRead(const std::string& path, char expected) {
diff --git a/core/libs/tests/GuestPathErrors.cpp b/core/libs/tests/GuestPathErrors.cpp
index 3da76d9739..9eb21a8c7a 100644
--- a/core/libs/tests/GuestPathErrors.cpp
+++ b/core/libs/tests/GuestPathErrors.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -12,26 +15,6 @@
 #include <string>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelUnlink(const char* path);
-int APS5_VABI sceKernelClose(int d);
-int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
-int APS5_VABI unlink_nid_postfix(const char* path);
-int APS5_VABI sceKernelStat(const char* path, FileStat* sb);
-int APS5_VABI stat_nid_postfix(const char* path, FileStat* sb);
-int APS5_VABI lstat_nid_postfix(const char* path, FileStat* sb);
-int APS5_VABI sceKernelMkdir(const char* path, std::uint16_t mode);
-int APS5_VABI sceKernelRmdir(const char* path);
-int APS5_VABI mkdir_nid_postfix(const char* path, std::uint16_t mode);
-int APS5_VABI rmdir_nid_postfix(const char* path);
-int APS5_VABI sceKernelRename(const char* from, const char* to);
-int APS5_VABI rename_nid_postfix(const char* from, const char* to);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char* path, std::int64_t length);
-int APS5_VABI truncate_nid_postfix(const char* path, std::int64_t length);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, int line) {
diff --git a/core/libs/tests/GuestPathLifetime.cpp b/core/libs/tests/GuestPathLifetime.cpp
index 44e8f59072..041de1ffb8 100644
--- a/core/libs/tests/GuestPathLifetime.cpp
+++ b/core/libs/tests/GuestPathLifetime.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include <cstdio>
@@ -9,8 +10,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-
 namespace {
 
 int events[2];
diff --git a/core/libs/tests/GuestPathNameLength.cpp b/core/libs/tests/GuestPathNameLength.cpp
index e07722661b..c6197d2e8f 100644
--- a/core/libs/tests/GuestPathNameLength.cpp
+++ b/core/libs/tests/GuestPathNameLength.cpp
@@ -1,22 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <string>
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI mkdir_nid_postfix(const char*, int);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI stat_nid_postfix(const char*, void*);
-int APS5_VABI access_nid_postfix(const char*, int);
-int APS5_VABI chflags_nid_postfix(const char*, std::uint64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ErrorNoEntry = 2;
@@ -32,7 +21,7 @@ bool Fails(long result, int error) { return result == -1 && *__error_nid_postfix
 
 bool TooLong(const std::string& path) {
     unsigned char status[256];
-    return Fails(stat_nid_postfix(path.c_str(), status), ErrorNameTooLong);
+    return Fails(stat_nid_postfix(path.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong);
 }
 
 }
@@ -42,11 +31,12 @@ int main() {
     const std::string longName(256, 'n');
     const std::string longPath(1100, 'p');
     const std::string maxName(255, 'm');
-    Require(Fails(stat_nid_postfix(longName.c_str(), status), ErrorNameTooLong), "stat of a name above NAME_MAX (255) must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix(longName.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a name above NAME_MAX (255) must fail with ENAMETOOLONG (63)");
     rmdir_nid_postfix("anyps5_name_length");
+
     Require(mkdir_nid_postfix("anyps5_name_length", 0755) == 0, "mkdir of the test directory failed");
-    Require(Fails(stat_nid_postfix(("anyps5_name_length/" + longName).c_str(), status), ErrorNameTooLong), "stat of a long final component below an existing directory must fail with ENAMETOOLONG (63)");
-    Require(Fails(stat_nid_postfix(("anyps5_name_length/missing/" + longName).c_str(), status), ErrorNoEntry), "stat of a long component below a missing directory must fail with ENOENT (2), the lookup stops there first");
+    Require(Fails(stat_nid_postfix(("anyps5_name_length/" + longName).c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a long final component below an existing directory must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix(("anyps5_name_length/missing/" + longName).c_str(), reinterpret_cast<FileStat*>(status)), ErrorNoEntry), "stat of a long component below a missing directory must fail with ENOENT (2), the lookup stops there first");
     const std::string below = "anyps5_name_length/";
     const std::string name255(255, 'n');
     Require(!TooLong(below + name255), "a final component of exactly 255 bytes must not be too long");
@@ -55,11 +45,13 @@ int main() {
     Require(TooLong(below + longName + "/"), "a long component followed by a trailing slash must fail with ENAMETOOLONG (63)");
     Require(!TooLong(below + std::string(200, 'n') + "\\" + std::string(100, 'n')), "a backslash separates components here, so 200 + 100 bytes around it are accepted (FreeBSD would refuse the 301-byte name)");
     const std::string block = name255 + "/";
+#ifndef __APPLE__
     Require(!TooLong(block + block + block + name255), "a path of exactly 1023 bytes must not be too long");
+#endif
     Require(TooLong(block + block + block + block), "a path of exactly 1024 bytes must fail with ENAMETOOLONG (63)");
     Require(rmdir_nid_postfix("anyps5_name_length") == 0, "rmdir of the test directory failed");
-    Require(Fails(stat_nid_postfix((longName + "/x").c_str(), status), ErrorNameTooLong), "stat of a long first component must fail with ENAMETOOLONG (63)");
-    Require(Fails(stat_nid_postfix(longPath.c_str(), status), ErrorNameTooLong), "stat of a path of 1100 bytes must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix((longName + "/x").c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a long first component must fail with ENAMETOOLONG (63)");
+    Require(Fails(stat_nid_postfix(longPath.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNameTooLong), "stat of a path of 1100 bytes must fail with ENAMETOOLONG (63)");
     Require(Fails(access_nid_postfix(longName.c_str(), 0), ErrorNameTooLong), "access of a long name must fail with ENAMETOOLONG (63)");
     Require(Fails(chflags_nid_postfix(longName.c_str(), 0), ErrorNameTooLong), "chflags of a long name must fail with ENAMETOOLONG (63)");
     Require(Fails(unlink_nid_postfix(longName.c_str()), ErrorNameTooLong), "unlink of a long name must fail with ENAMETOOLONG (63)");
@@ -69,6 +61,6 @@ int main() {
     Require(Fails(rename_nid_postfix(longName.c_str(), "anyps5_name_length_target"), ErrorNameTooLong), "rename from a long name must fail with ENAMETOOLONG (63)");
     Require(Fails(rename_nid_postfix("anyps5_name_length_source", longName.c_str()), ErrorNameTooLong), "rename to a long name must fail with ENAMETOOLONG (63)");
 
-    Require(Fails(stat_nid_postfix(maxName.c_str(), status), ErrorNoEntry), "a name of exactly 255 bytes is not too long");
+    Require(Fails(stat_nid_postfix(maxName.c_str(), reinterpret_cast<FileStat*>(status)), ErrorNoEntry), "a name of exactly 255 bytes is not too long");
     return 0;
 }
diff --git a/core/libs/tests/GuestPlayGo.cpp b/core/libs/tests/GuestPlayGo.cpp
index c03f4761ca..cf8538a5b3 100644
--- a/core/libs/tests/GuestPlayGo.cpp
+++ b/core/libs/tests/GuestPlayGo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayGo/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -14,20 +15,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-int APS5_VABI scePlayGoInitialize(const PlayGoInitParams*);
-int APS5_VABI scePlayGoOpen(int*, const void*);
-int APS5_VABI scePlayGoClose(int);
-int APS5_VABI scePlayGoGetLanguageMask(int, std::uint64_t*);
-int APS5_VABI scePlayGoSetLanguageMask(int, std::uint64_t);
-int APS5_VABI scePlayGoGetSupportedOptionalChunk(int, std::uint32_t, PlayGoOptionalChunk*);
-int APS5_VABI scePlayGoGetOptionalChunk(int, std::uint32_t, PlayGoOptionalChunk*);
-int APS5_VABI scePlayGoSetToDoList(int, const PlayGoToDo*, std::uint32_t);
-int APS5_VABI scePlayGoGetToDoList(int, PlayGoToDo*, std::uint32_t, std::uint32_t*);
-int APS5_VABI scePlayGoGetLocus(int, const std::uint16_t*, std::uint32_t, std::int8_t*);
-int APS5_VABI scePlayGoGetChunkId(int, std::uint16_t*, std::uint32_t, std::uint32_t*);
-}
-
 static void Require(bool value, const std::source_location location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "requirement failed at line %u\n", location.line());
@@ -175,6 +162,7 @@ static int CheckRejectedLayout(const char* root, const char* fileName) {
     bool threw = false;
     try {
         scePlayGoGetLocus(handle, &chunk, 1, &locus);
+
     } catch (const std::runtime_error& error) {
         threw = std::string_view(error.what()).find(fileName) != std::string_view::npos;
     }
@@ -221,6 +209,7 @@ static int CheckUnknownUnlistedChunkAnswer(const char* root) {
     bool threw = false;
     try {
         scePlayGoGetLocus(handle, &unlisted, 1, &locus);
+
     } catch (const std::runtime_error& error) {
         threw = std::string_view(error.what()).find("APS5_PLAYGO_UNLISTED_CHUNKS must be installed or absent") != std::string_view::npos;
     }
diff --git a/core/libs/tests/GuestPlayGoDialog.cpp b/core/libs/tests/GuestPlayGoDialog.cpp
index 0a8291f96c..e8a89d8e49 100644
--- a/core/libs/tests/GuestPlayGoDialog.cpp
+++ b/core/libs/tests/GuestPlayGoDialog.cpp
@@ -1,19 +1,10 @@
+#include "prx/libScePlayGoDialog/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI scePlayGoDialogInitialize(void);
-int APS5_VABI scePlayGoDialogTerminate(void);
-int APS5_VABI scePlayGoDialogOpen(const void* param);
-int APS5_VABI scePlayGoDialogClose(void);
-int APS5_VABI scePlayGoDialogUpdateStatus(void);
-int APS5_VABI scePlayGoDialogGetStatus(void);
-int APS5_VABI scePlayGoDialogGetResult(PlayGoDialogResult* result);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestPlayerReviewDialog.cpp b/core/libs/tests/GuestPlayerReviewDialog.cpp
index 45621694d4..c14e478429 100644
--- a/core/libs/tests/GuestPlayerReviewDialog.cpp
+++ b/core/libs/tests/GuestPlayerReviewDialog.cpp
@@ -1,21 +1,10 @@
+#include "prx/libSceCdlgPlayerReview/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include "prx/libSceUserService/UserService.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI scePlayerReviewDialogInitialize(void);
-int APS5_VABI scePlayerReviewDialogTerminate(void);
-int APS5_VABI scePlayerReviewDialogOpen(const void* param);
-int APS5_VABI scePlayerReviewDialogClose(void);
-int APS5_VABI scePlayerReviewDialogGetStatus(void);
-int APS5_VABI scePlayerReviewDialogUpdateStatus(void);
-int APS5_VABI scePlayerReviewDialogGetResult(void* result);
-}
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
@@ -44,13 +33,13 @@ int main() {
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_NONE);
     Require(scePlayerReviewDialogOpen(&param) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(scePlayerReviewDialogClose() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
 
     Require(scePlayerReviewDialogInitialize() == 0);
     Require(scePlayerReviewDialogInitialize() == COMMON_DIALOG_ERROR_ALREADY_INITIALIZED);
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
     Require(scePlayerReviewDialogUpdateStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_ERROR_NOT_FINISHED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_ERROR_NOT_FINISHED);
     Require(scePlayerReviewDialogTerminate() == 0);
     Require(scePlayerReviewDialogTerminate() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_NONE);
@@ -86,7 +75,7 @@ int main() {
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_FINISHED);
     Require(scePlayerReviewDialogUpdateStatus() == COMMON_DIALOG_STATUS_FINISHED);
     Require(scePlayerReviewDialogGetResult(nullptr) == COMMON_DIALOG_ERROR_ARG_NULL);
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_RESULT_USER_CANCELED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_RESULT_USER_CANCELED);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == COMMON_DIALOG_RESULT_USER_CANCELED);
     Require(scePlayerReviewDialogClose() == static_cast<int>(0x80B8000Bu));
@@ -100,7 +89,7 @@ int main() {
     Require(scePlayerReviewDialogGetStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
     Require(scePlayerReviewDialogUpdateStatus() == COMMON_DIALOG_STATUS_INITIALIZED);
     result[2] = -1;
-    Require(scePlayerReviewDialogGetResult(result) == COMMON_DIALOG_ERROR_NOT_FINISHED);
+    Require(scePlayerReviewDialogGetResult(reinterpret_cast<CommonDialogResultPrefix*>(result)) == COMMON_DIALOG_ERROR_NOT_FINISHED);
     Require(result[0] == -1 && result[1] == -1 && result[3] == -1);
     Require(result[2] == -1);
     Require(scePlayerReviewDialogTerminate() == 0);
diff --git a/core/libs/tests/GuestPlayerSelectionDialog.cpp b/core/libs/tests/GuestPlayerSelectionDialog.cpp
index 4d3e163d12..4b1c516bd1 100644
--- a/core/libs/tests/GuestPlayerSelectionDialog.cpp
+++ b/core/libs/tests/GuestPlayerSelectionDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePlayerSelectionDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -5,19 +6,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI scePlayerSelectionDialogInitialize(void);
-int APS5_VABI scePlayerSelectionDialogOpen(const PlayerSelectionDialogParam* param);
-int APS5_VABI scePlayerSelectionDialogUpdateStatus(void);
-int APS5_VABI scePlayerSelectionDialogGetStatus(void);
-int APS5_VABI scePlayerSelectionDialogGetResult(PlayerSelectionDialogResult* result);
-int APS5_VABI scePlayerSelectionDialogParamInitialize(void* param);
-int APS5_VABI scePlayerSelectionDialogClose(void);
-int APS5_VABI scePlayerSelectionDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -47,6 +35,7 @@ int main() {
     bool threw = false;
     try {
         scePlayerSelectionDialogParamInitialize(&param);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestPngDec.cpp b/core/libs/tests/GuestPngDec.cpp
index 4ee4031ad2..f7dab4a743 100644
--- a/core/libs/tests/GuestPngDec.cpp
+++ b/core/libs/tests/GuestPngDec.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngDec/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Png.hpp"
@@ -8,14 +9,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI scePngDecQueryMemorySize(const PngDecCreateParam*);
-std::int32_t APS5_VABI scePngDecCreate(const PngDecCreateParam*, void*, std::uint32_t, void**);
-std::int32_t APS5_VABI scePngDecDelete(void*);
-std::int32_t APS5_VABI scePngDecParseHeader(const PngDecParseParam*, PngDecImageInfo*);
-std::int32_t APS5_VABI scePngDecDecode(void*, const PngDecDecodeParam*, PngDecImageInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
diff --git a/core/libs/tests/GuestPngEnc.cpp b/core/libs/tests/GuestPngEnc.cpp
index d8227b3bab..53cbcd808f 100644
--- a/core/libs/tests/GuestPngEnc.cpp
+++ b/core/libs/tests/GuestPngEnc.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePngEnc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "Decoder/Png.hpp"
@@ -7,13 +8,6 @@
 #include <utility>
 #include <vector>
 
-extern "C" {
-int APS5_VABI scePngEncQueryMemorySize(const PngEncCreateParam*);
-int APS5_VABI scePngEncCreate(const PngEncCreateParam*, void*, std::uint32_t, void**);
-int APS5_VABI scePngEncDelete(void*);
-int APS5_VABI scePngEncEncode(void*, const PngEncEncodeParam*, PngEncOutputInfo*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestPoll.cpp b/core/libs/tests/GuestPoll.cpp
index 131e75eb9d..8d9c7ee484 100644
--- a/core/libs/tests/GuestPoll.cpp
+++ b/core/libs/tests/GuestPoll.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -7,6 +9,7 @@
 #include <unistd.h>
 #endif
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
 #include <chrono>
@@ -16,33 +19,7 @@
 #include <stdexcept>
 #include <string>
 #include <thread>
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI kqueue_nid_postfix();
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int* APS5_VABI __error_nid_postfix();
-}
+
 #ifdef _WIN32
 using NativeSocket = SOCKET;
 constexpr NativeSocket NativeInvalid = INVALID_SOCKET;
@@ -61,6 +38,46 @@ constexpr short Hup = 0x10;
 constexpr short Invalid = 0x20;
 constexpr short ReadNormal = 0x40;
 constexpr short WriteBand = 0x100;
+constexpr std::int16_t EvfiltUser = -11;
+constexpr std::uint16_t EvAdd = 0x0001;
+constexpr std::uint16_t EvClear = 0x0020;
+constexpr std::uint32_t NoteTrigger = 0x01000000;
+static KernelEvent UserEvent(std::uint16_t flags, std::uint32_t fflags) {
+    KernelEvent change{};
+    change.ident = 7;
+    change.filter = EvfiltUser;
+    change.flags = flags;
+    change.fflags = fflags;
+    return change;
+}
+static void PollsKqueues(int socket) {
+    const int queue = kqueue_nid_postfix();
+    Require(queue >= 0);
+    GuestPollDescriptor kq{queue, static_cast<short>(In | ReadNormal | Out | Priority | ReadBand | WriteBand), -1};
+    Require(poll_nid_postfix(&kq, 1, 0) == 0 && kq.revents == 0);
+    const auto added = UserEvent(EvAdd | EvClear, 0);
+    Require(kevent_nid_postfix(queue, &added, 1, nullptr, 0, nullptr) == 0);
+    Require(poll_nid_postfix(&kq, 1, 0) == 0 && kq.revents == 0);
+    const auto start = std::chrono::steady_clock::now();
+    Require(poll_nid_postfix(&kq, 1, 30) == 0 && kq.revents == 0);
+    Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(25));
+    std::thread trigger([queue] {
+        std::this_thread::sleep_for(std::chrono::milliseconds(20));
+        const auto triggered = UserEvent(0, NoteTrigger);
+        Require(kevent_nid_postfix(queue, &triggered, 1, nullptr, 0, nullptr) == 0);
+    });
+    GuestPollDescriptor mixed[2]{{socket, In, -1}, {queue, static_cast<short>(In | Out), -1}};
+    Require(poll_nid_postfix(mixed, 2, -1) == 1);
+    trigger.join();
+    Require(mixed[0].revents == 0 && mixed[1].revents == In);
+    Require(poll_nid_postfix(&kq, 1, 0) == 1 && kq.revents == (In | ReadNormal));
+    KernelEvent events[1]{};
+    const KernelTimespec zero{0, 0};
+    Require(kevent_nid_postfix(queue, nullptr, 0, events, 1, &zero) == 1);
+    Require(poll_nid_postfix(&kq, 1, 0) == 0 && kq.revents == 0);
+    Require(close_nid_postfix(queue) == 0);
+    Require(poll_nid_postfix(&kq, 1, 0) == 1 && kq.revents == Invalid);
+}
 static void PollsFilesAndDirectories(int socket) {
     constexpr int ReadWrite = 0x0002, Create = 0x0200, DirectoryFlag = 0x00020000;
     const auto stamp = std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
@@ -71,16 +88,16 @@ static void PollsFilesAndDirectories(int socket) {
     Require(mkdir_nid_postfix(directoryPath.c_str(), 0755) == 0);
     const int directory = open_nid_postfix(directoryPath.c_str(), DirectoryFlag, 0);
     Require(directory >= 0);
-    PollDescriptor vnode{file, static_cast<short>(In | Out | ReadNormal | Priority | ReadBand | WriteBand), -1};
+    GuestPollDescriptor vnode{file, static_cast<short>(In | Out | ReadNormal | Priority | ReadBand | WriteBand), -1};
     Require(poll_nid_postfix(&vnode, 1, 0) == 1 && vnode.revents == (In | Out | ReadNormal));
     vnode.events = static_cast<short>(Priority | ReadBand | WriteBand);
     Require(poll_nid_postfix(&vnode, 1, 0) == 0 && vnode.revents == 0);
     const auto start = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&vnode, 1, 30) == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(25));
-    PollDescriptor folder{directory, static_cast<short>(In | Out), -1};
+    GuestPollDescriptor folder{directory, static_cast<short>(In | Out), -1};
     Require(poll_nid_postfix(&folder, 1, -1) == 1 && folder.revents == (In | Out));
-    PollDescriptor mixed[3]{{socket, In, -1}, {file, Out, -1}, {directory, ReadNormal, -1}};
+    GuestPollDescriptor mixed[3]{{socket, In, -1}, {file, Out, -1}, {directory, ReadNormal, -1}};
     Require(poll_nid_postfix(mixed, 3, -1) == 2);
     Require(mixed[0].revents == 0 && mixed[1].revents == Out && mixed[2].revents == ReadNormal);
     Require(close_nid_postfix(directory) == 0 && close_nid_postfix(file) == 0);
@@ -90,9 +107,9 @@ static void PollsFilesAndDirectories(int socket) {
 static void TestPipes(int socket) {
     int ends[2];
     Require(pipe_nid_postfix(ends) == 0);
-    PollDescriptor empty[2]{{ends[0], In, -1}, {ends[1], Out, -1}};
+    GuestPollDescriptor empty[2]{{ends[0], In, -1}, {ends[1], Out, -1}};
     Require(poll_nid_postfix(empty, 2, 0) == 1 && empty[0].revents == 0 && empty[1].revents == Out);
-    PollDescriptor reader{ends[0], In | ReadNormal, -1};
+    GuestPollDescriptor reader{ends[0], In | ReadNormal, -1};
     const auto start = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&reader, 1, 50) == 0 && reader.revents == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(40));
@@ -102,13 +119,13 @@ static void TestPipes(int socket) {
     Require(shortWait >= std::chrono::milliseconds(40) && shortWait < std::chrono::milliseconds(200));
     Require(write_nid_postfix(ends[1], "wake", 4) == 4);
     Require(poll_nid_postfix(&reader, 1, 1000) == 1 && reader.revents == (In | ReadNormal));
-    PollDescriptor writer{ends[1], In, -1};
+    GuestPollDescriptor writer{ends[1], In, -1};
     Require(poll_nid_postfix(&writer, 1, 0) == 0 && writer.revents == 0);
-    PollDescriptor readerOut{ends[0], Out, -1};
+    GuestPollDescriptor readerOut{ends[0], Out, -1};
     bool threw = false;
     try { poll_nid_postfix(&readerOut, 1, 0); } catch (const std::runtime_error&) { threw = true; }
     Require(threw);
-    PollDescriptor mixed[2]{{socket, In, -1}, {ends[0], In, -1}};
+    GuestPollDescriptor mixed[2]{{socket, In, -1}, {ends[0], In, -1}};
     Require(poll_nid_postfix(mixed, 2, 1000) == 1 && mixed[0].revents == 0 && mixed[1].revents == In);
     char buffer[8]{};
     Require(read_nid_postfix(ends[0], buffer, sizeof(buffer)) == 4);
@@ -135,14 +152,14 @@ static void TestPipes(int socket) {
     Require(read_nid_postfix(ends[0], buffer, sizeof(buffer)) == 1);
     Require(poll_nid_postfix(&reader, 1, 0) == 1 && reader.revents == (In | ReadNormal | Hup));
     Require(read_nid_postfix(ends[0], buffer, sizeof(buffer)) == 0);
-    PollDescriptor closedPipe{ends[1], In, -1};
+    GuestPollDescriptor closedPipe{ends[1], In, -1};
     Require(poll_nid_postfix(&closedPipe, 1, 0) == 1 && closedPipe.revents == Invalid);
     Require(close_nid_postfix(ends[0]) == 0);
     int full[2];
     Require(pipe_nid_postfix(full) == 0);
     static char block[4096];
     std::int64_t queued = 0;
-    PollDescriptor fill{full[1], Out, -1};
+    GuestPollDescriptor fill{full[1], Out, -1};
     while (poll_nid_postfix(&fill, 1, 0) == 1) {
         Require(fill.revents == Out && queued < (1 << 20));
         Require(write_nid_postfix(full[1], block, 256) == 256);
@@ -160,7 +177,7 @@ static void TestPipes(int socket) {
     int other[2];
     Require(pipe_nid_postfix(other) == 0);
     Require(close_nid_postfix(other[0]) == 0);
-    PollDescriptor orphan{other[1], Out, -1};
+    GuestPollDescriptor orphan{other[1], Out, -1};
     Require(poll_nid_postfix(&orphan, 1, 0) == 1 && orphan.revents == Hup);
     orphan.events = In | Out;
     Require(poll_nid_postfix(&orphan, 1, 0) == 1 && orphan.revents == (In | Hup));
@@ -177,12 +194,12 @@ static void PollsUrgentData() {
     const int client = socket_nid_postfix(2, 1, 0);
     Require(client >= 0 && fcntl_nid_postfix(client, 4, 4) == 0);
     if (connect_nid_postfix(client, address.data(), address.size()) != 0)
-        Require(*__error_nid_postfix() == 35 || *__error_nid_postfix() == 36);
-    PollDescriptor connecting{client, Priority | Out, -1};
+        Require(*__error_nid_postfix() == 36);
+    GuestPollDescriptor connecting{client, Priority | Out, -1};
     Require(poll_nid_postfix(&connecting, 1, 1000) == 1 && connecting.revents == Out);
     const int server = accept_nid_postfix(listener, nullptr, nullptr);
     Require(server >= 0);
-    PollDescriptor pair[2]{{server, Priority | Out, -1}, {client, In | Priority | Out | ReadBand, -1}};
+    GuestPollDescriptor pair[2]{{server, Priority | Out, -1}, {client, In | Priority | Out | ReadBand, -1}};
     Require(poll_nid_postfix(pair, 2, 0) == 2 && pair[0].revents == Out && pair[1].revents == Out);
     char byte = 'u';
     Require(send_nid_postfix(client, &byte, 1, 1) == -1 && *__error_nid_postfix() == 45);
@@ -196,14 +213,14 @@ static void PollsUrgentData() {
     Require(::connect(peer, reinterpret_cast<const sockaddr*>(&native), sizeof(native)) == 0);
     const int urgent = accept_nid_postfix(listener, nullptr, nullptr);
     Require(urgent >= 0);
-    PollDescriptor waiting{urgent, Priority, -1};
+    GuestPollDescriptor waiting{urgent, Priority, -1};
     Require(poll_nid_postfix(&waiting, 1, 0) == 0 && waiting.revents == 0);
     Require(::send(peer, "u", 1, MSG_OOB) == 1);
     Require(poll_nid_postfix(&waiting, 1, 1000) == 1 && waiting.revents == Priority);
-    PollDescriptor bands{urgent, In | Priority | Out, -1};
+    GuestPollDescriptor bands{urgent, In | Priority | Out, -1};
     Require(poll_nid_postfix(&bands, 1, 0) == 1 && bands.revents == (Priority | Out));
 #ifdef _WIN32
-    PollDescriptor band{urgent, ReadBand, -1};
+    GuestPollDescriptor band{urgent, ReadBand, -1};
     Require(poll_nid_postfix(&band, 1, 0) == 1 && band.revents == ReadBand);
 #endif
     CloseNative(peer);
@@ -212,8 +229,41 @@ static void PollsUrgentData() {
     Require(close_nid_postfix(client) == 0);
     Require(close_nid_postfix(listener) == 0);
 }
+static void PollsAStreamWhosePeerClosed() {
+    const int listener = socket_nid_postfix(2, 1, 0);
+    Require(listener >= 0);
+    std::array<unsigned char, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(listener, address.data(), address.size()) == 0);
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(listener, address.data(), &size) == 0 && listen_nid_postfix(listener, 4) == 0);
+    const int client = socket_nid_postfix(2, 1, 0);
+    Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0);
+    const int server = accept_nid_postfix(listener, nullptr, nullptr);
+    Require(server >= 0);
+
+    Require(shutdown_nid_postfix(client, 1) == 0);
+    GuestPollDescriptor wait{server, In, 0};
+    Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == In);
+    wait = {server, static_cast<short>(In | Out), 0};
+    Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == (In | Out));
+    wait = {server, ReadNormal, 0};
+    Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == ReadNormal);
+    wait = {server, Out, 0};
+    Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == Out);
+    char byte;
+    Require(recv_nid_postfix(server, &byte, 1, 0) == 0);
+
+    Require(shutdown_nid_postfix(server, 1) == 0);
+    wait = {server, In, 0};
+    Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == (In | Hup));
+    wait = {client, In, 0};
+    Require(poll_nid_postfix(&wait, 1, 1000) == 1 && wait.revents == (In | Hup));
+    for (const int descriptor : {client, server, listener}) Require(close_nid_postfix(descriptor) == 0);
+}
+
 int main() {
     PollsUrgentData();
+    PollsAStreamWhosePeerClosed();
     const int listener = socket_nid_postfix(2, 1, 0);
     Require(listener >= 0 && listener < 1024);
     std::array<unsigned char, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
@@ -221,7 +271,7 @@ int main() {
     std::uint32_t size = address.size();
     Require(getsockname_nid_postfix(listener, address.data(), &size) == 0);
     Require(listen_nid_postfix(listener, 4) == 0);
-    PollDescriptor single{listener, In, -1};
+    GuestPollDescriptor single{listener, In, -1};
     Require(poll_nid_postfix(&single, 1, 0) == 0 && single.revents == 0);
     const auto start = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&single, 1, 50) == 0);
@@ -231,7 +281,7 @@ int main() {
     Require(poll_nid_postfix(&single, 1, 1000) == 1 && single.revents == In);
     const int server = accept_nid_postfix(listener, nullptr, nullptr);
     Require(server >= 0);
-    PollDescriptor pair[3]{{server, In, 0}, {-1, In, 7}, {client, Out, 0}};
+    GuestPollDescriptor pair[3]{{server, In, 0}, {-1, In, 7}, {client, Out, 0}};
     Require(poll_nid_postfix(pair, 3, 1000) == 1);
     Require(pair[0].revents == 0 && pair[1].revents == 0 && pair[2].revents == Out);
     const char message[] = "poll";
@@ -243,7 +293,7 @@ int main() {
     Require(close_nid_postfix(client) == 0);
     Require(poll_nid_postfix(pair, 1, 1000) == 1 && (pair[0].revents & (In | Hup)) != 0);
     Require(recv_nid_postfix(server, buffer, sizeof(buffer), 0) == 0);
-    PollDescriptor closed[2]{{client, In, 0}, {listener, In, 0}};
+    GuestPollDescriptor closed[2]{{client, In, 0}, {listener, In, 0}};
     Require(poll_nid_postfix(closed, 2, -1) == 1 && closed[0].revents == Invalid && closed[1].revents == 0);
     Require(poll_nid_postfix(nullptr, 0, 10) == 0);
     const auto shortWaitStart = std::chrono::steady_clock::now();
@@ -258,33 +308,23 @@ int main() {
     for (const char* path : {"/dev/urandom", "/dev/random"}) {
         const int random = open_nid_postfix(path, 0, 0);
         Require(random >= 0);
-        PollDescriptor device{random, static_cast<short>(In | Out | Priority), -1};
+        GuestPollDescriptor device{random, static_cast<short>(In | Out | Priority), -1};
         Require(poll_nid_postfix(&device, 1, 0) == 1 && device.revents == In);
         device.events = static_cast<short>(ReadNormal | Out);
         Require(poll_nid_postfix(&device, 1, 0) == 1 && device.revents == ReadNormal);
         device.events = static_cast<short>(Out | Priority | ReadBand | WriteBand);
         Require(poll_nid_postfix(&device, 1, -1) == 1 && device.revents == (Out | Priority | ReadBand | WriteBand));
-        PollDescriptor mixed[2]{{listener, In, 0}, {random, Out, 0}};
+        GuestPollDescriptor mixed[2]{{listener, In, 0}, {random, Out, 0}};
         Require(poll_nid_postfix(mixed, 2, -1) == 1 && mixed[0].revents == 0 && mixed[1].revents == Out);
         Require(close_nid_postfix(random) == 0);
     }
-    PollDescriptor console[3]{{0, static_cast<short>(In | ReadNormal | Out), -1}, {1, static_cast<short>(In | Out | WriteBand), -1}, {2, Out, -1}};
+    GuestPollDescriptor console[3]{{0, static_cast<short>(In | ReadNormal | Out), -1}, {1, static_cast<short>(In | Out | WriteBand), -1}, {2, Out, -1}};
     Require(poll_nid_postfix(console, 3, 0) == 2);
     Require(console[0].revents == 0 && console[1].revents == Out && console[2].revents == Out);
-    PollDescriptor input{0, In, -1};
+    GuestPollDescriptor input{0, In, -1};
     const auto inputStart = std::chrono::steady_clock::now();
     Require(poll_nid_postfix(&input, 1, 30) == 0 && input.revents == 0);
     Require(std::chrono::steady_clock::now() - inputStart >= std::chrono::milliseconds(25));
-    const int queue = kqueue_nid_postfix();
-    Require(queue >= 0);
-    PollDescriptor unknown[2]{{listener, In, 0}, {queue, In, 0}};
-    bool unsupported = false;
-    try {
-        poll_nid_postfix(unknown, 2, 0);
-    } catch (const std::runtime_error&) {
-        unsupported = true;
-    }
-    Require(unsupported);
-    Require(close_nid_postfix(queue) == 0);
+    PollsKqueues(listener);
     Require(close_nid_postfix(listener) == 0);
 }
diff --git a/core/libs/tests/GuestPositionedClose.cpp b/core/libs/tests/GuestPositionedClose.cpp
index 3d44da1f08..1d89c27276 100644
--- a/core/libs/tests/GuestPositionedClose.cpp
+++ b/core/libs/tests/GuestPositionedClose.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/PreciseWait.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -13,12 +15,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Positioned close check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestPositionedRace.cpp b/core/libs/tests/GuestPositionedRace.cpp
index 6c936c56b4..90c3257cf6 100644
--- a/core/libs/tests/GuestPositionedRace.cpp
+++ b/core/libs/tests/GuestPositionedRace.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -12,13 +14,7 @@
 #include <fstream>
 #include <string>
 #include <thread>
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-std::int64_t APS5_VABI sceKernelRead(int d, void* buf, std::size_t nbytes);
-std::int64_t APS5_VABI sceKernelPread(int d, void* buf, std::size_t nbytes, std::int64_t offset);
-std::int64_t APS5_VABI sceKernelLseek(int d, std::int64_t offset, int whence);
-}
+
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Positioned race check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestPosixFilesystem.cpp b/core/libs/tests/GuestPosixFilesystem.cpp
index 0e3326d3d0..c18d690982 100644
--- a/core/libs/tests/GuestPosixFilesystem.cpp
+++ b/core/libs/tests/GuestPosixFilesystem.cpp
@@ -1,4 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
+#include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
 #include <cstdlib>
@@ -17,18 +22,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI mkstemp_nid_postfix(char*);
-int APS5_VABI isatty_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-}
-
 static void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "POSIX filesystem check failed at line %u (guest errno %d)\n", location.line(), *__error_nid_postfix());
@@ -134,6 +127,52 @@ int main() {
     Require(isatty_nid_postfix(slave) == 1 && *__error_nid_postfix() == 123);
     Require(::close(slave) == 0 && ::close(terminal) == 0);
 #endif
+    Require(setenv_nid_postfix("WEBKIT_WRAP_SET", "set", 1) == 0);
+    char* const variable = getenv_nid_postfix("WEBKIT_WRAP_SET");
+    Require(variable != nullptr && std::strcmp(variable, "set") == 0 && __wrap_getenv("WEBKIT_WRAP_SET") == variable);
+    Require(getenv_nid_postfix("WEBKIT_WRAP_UNSET") == nullptr && __wrap_getenv("WEBKIT_WRAP_UNSET") == nullptr);
+    Require(access_nid_postfix(pattern.c_str(), 0) == 0 && __wrap_access(pattern.c_str(), 0) == 0);
+    Require(access_nid_postfix("/anyps5-posix-test/absent", 0) == -1);
+    const int accessError = *__error_nid_postfix();
+    *__error_nid_postfix() = 0;
+    Require(__wrap_access("/anyps5-posix-test/absent", 0) == -1 && *__error_nid_postfix() == accessError && accessError == 2);
+    std::array<char, 1024> expectedDirectory{};
+    std::array<char, 1024> wrappedDirectory{};
+    Require(getcwd_nid_postfix(expectedDirectory.data(), expectedDirectory.size()) == expectedDirectory.data());
+    Require(__wrap_getcwd(wrappedDirectory.data(), wrappedDirectory.size()) == wrappedDirectory.data());
+    Require(std::strcmp(expectedDirectory.data(), wrappedDirectory.data()) == 0);
+    Require(getcwd_nid_postfix(wrappedDirectory.data(), 1) == nullptr);
+    const int directoryError = *__error_nid_postfix();
+    *__error_nid_postfix() = 0;
+    Require(__wrap_getcwd(wrappedDirectory.data(), 1) == nullptr && *__error_nid_postfix() == directoryError && directoryError == 34);
+    FileStat expectedStatus{};
+    FileStat wrappedStatus{};
+    Require(lstat_nid_postfix(pattern.c_str(), &expectedStatus) == 0 && __wrap_lstat(pattern.c_str(), &wrappedStatus) == 0);
+    Require((wrappedStatus.st_mode & 0170000) == 0100000 && wrappedStatus.st_size == static_cast<std::int64_t>(sizeof(payload)));
+    Require(std::memcmp(&expectedStatus, &wrappedStatus, sizeof(FileStat)) == 0);
+    const auto notAfter = [](const KernelTimespec& earlier, const KernelTimespec& later) {
+        return earlier.tv_sec < later.tv_sec || (earlier.tv_sec == later.tv_sec && earlier.tv_nsec <= later.tv_nsec);
+    };
+    KernelTimespec before{};
+    KernelTimespec during{};
+    KernelTimespec after{};
+    Require(clock_gettime_nid_postfix(4, &before) == 0 && __wrap_clock_gettime(4, &during) == 0 && clock_gettime_nid_postfix(4, &after) == 0);
+    Require(notAfter(before, during) && notAfter(during, after));
+    Require(clock_gettime_nid_postfix(4, nullptr) == -1 && *__error_nid_postfix() == 14);
+    *__error_nid_postfix() = 0;
+    Require(__wrap_clock_gettime(4, nullptr) == -1 && *__error_nid_postfix() == 14);
+    constexpr std::size_t page = 0x4000;
+    void* const failed = reinterpret_cast<void*>(static_cast<std::uintptr_t>(-1));
+    void* const mapped = __wrap_mmap(nullptr, page, 3, 0x1002, -1, 0);
+    Require(mapped != failed);
+    auto* const bytes = static_cast<volatile unsigned char*>(mapped);
+    bytes[0] = 0x5a;
+    bytes[page - 1] = 0xa5;
+    Require(bytes[0] == 0x5a && bytes[page - 1] == 0xa5);
+    Require(munmap_nid_postfix(mapped, page) == 0);
+    Require(mmap_nid_postfix(nullptr, page, 8, 0x1002, -1, 0) == failed && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 0;
+    Require(__wrap_mmap(nullptr, page, 8, 0x1002, -1, 0) == failed && *__error_nid_postfix() == 22);
     RemovePathAlias_nid_no_patch("/anyps5-posix-test");
     Require(std::filesystem::remove_all(root) > 0);
 }
diff --git a/core/libs/tests/GuestPosixNamedSem.cpp b/core/libs/tests/GuestPosixNamedSem.cpp
new file mode 100644
index 0000000000..99ab8cb8a5
--- /dev/null
+++ b/core/libs/tests/GuestPosixNamedSem.cpp
@@ -0,0 +1,125 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <stdexcept>
+#include <string>
+#include <thread>
+
+static constexpr int GUEST_ENOENT = 2;
+static constexpr int GUEST_EEXIST = 17;
+static constexpr int GUEST_EINVAL = 22;
+static constexpr int GUEST_EAGAIN = 35;
+static constexpr int GUEST_ENAMETOOLONG = 63;
+static constexpr int O_CREAT_FLAG = 0x200;
+static constexpr int O_EXCL_FLAG = 0x800;
+
+static void Require(bool condition, int line) {
+    if (!condition) {
+        std::fprintf(stderr, "line %d failed, errno=%d\n", line, *__error_nid_postfix());
+        std::abort();
+    }
+}
+#define REQUIRE(condition) Require(condition, __LINE__)
+
+template <typename Call>
+static bool Throws(Call call) {
+    try {
+        call();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+static bool OpenFails(const char* name, int flags, int error) {
+    *__error_nid_postfix() = 0;
+    return sem_open_nid_postfix(name, flags, 0600, 1) == nullptr && *__error_nid_postfix() == error;
+}
+
+static bool UnlinkFails(const char* name, int error) {
+    *__error_nid_postfix() = 0;
+    return sem_unlink_nid_postfix(name) == -1 && *__error_nid_postfix() == error;
+}
+
+static int Value(void* sem) {
+    int value = -1;
+    REQUIRE(sem_getvalue_nid_postfix(sem, &value) == 0);
+    return value;
+}
+
+static void CheckNames() {
+    REQUIRE(OpenFails("relative", O_CREAT_FLAG, GUEST_EINVAL));
+    REQUIRE(OpenFails("/anyps5-named-flags", 0x1, GUEST_EINVAL));
+    REQUIRE(OpenFails("/anyps5-named-flags", O_CREAT_FLAG | 0x2, GUEST_EINVAL));
+    REQUIRE(OpenFails("/anyps5-named-missing", 0, GUEST_ENOENT));
+    REQUIRE(OpenFails("/anyps5-named-missing", O_EXCL_FLAG, GUEST_ENOENT));
+    const std::string longPath = "/" + std::string(1015, 'p');
+    REQUIRE(OpenFails(longPath.c_str(), O_CREAT_FLAG, GUEST_ENAMETOOLONG));
+    REQUIRE(UnlinkFails(longPath.c_str(), GUEST_ENAMETOOLONG));
+    const std::string longFile = "/" + std::string(252, 'f');
+    REQUIRE(OpenFails(longFile.c_str(), O_CREAT_FLAG, GUEST_ENAMETOOLONG));
+    REQUIRE(OpenFails(longFile.c_str(), 0x1, GUEST_EINVAL));
+    REQUIRE(UnlinkFails(longFile.c_str(), GUEST_ENAMETOOLONG));
+    const std::string longestFile = "/" + std::string(251, 'f');
+    void* longest = sem_open_nid_postfix(longestFile.c_str(), O_CREAT_FLAG, 0600, 0);
+    REQUIRE(longest != nullptr && sem_close_nid_postfix(longest) == 0 && sem_unlink_nid_postfix(longestFile.c_str()) == 0);
+    REQUIRE(UnlinkFails("relative", GUEST_ENOENT));
+    REQUIRE(UnlinkFails("/anyps5-named-missing", GUEST_ENOENT));
+    REQUIRE(Throws([] { sem_open_nid_postfix(nullptr, 0); }));
+    REQUIRE(Throws([] { sem_unlink_nid_postfix(nullptr); }));
+}
+
+static void CheckLifetime() {
+    const char* name = "/anyps5-named-lifetime";
+    void* sem = sem_open_nid_postfix(name, O_CREAT_FLAG | O_EXCL_FLAG, 0600, 2);
+    REQUIRE(sem != nullptr && Value(sem) == 2);
+    REQUIRE(sem_open_nid_postfix(name, 0) == sem);
+    REQUIRE(sem_open_nid_postfix(name, O_CREAT_FLAG, 0600, 9) == sem && Value(sem) == 2);
+    REQUIRE(OpenFails(name, O_CREAT_FLAG | O_EXCL_FLAG, GUEST_EEXIST));
+    REQUIRE(sem_trywait_nid_postfix(sem) == 0 && sem_trywait_nid_postfix(sem) == 0);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_trywait_nid_postfix(sem) == -1 && *__error_nid_postfix() == GUEST_EAGAIN);
+    std::thread poster([name] {
+        void* other = sem_open_nid_postfix(name, 0);
+        REQUIRE(other != nullptr && sem_post_nid_postfix(other) == 0 && sem_close_nid_postfix(other) == 0);
+    });
+    REQUIRE(sem_wait_nid_postfix(sem) == 0);
+    poster.join();
+    REQUIRE(sem_post_nid_postfix(sem) == 0 && sem_post_nid_postfix(sem) == 0 && Value(sem) == 2);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_destroy_nid_postfix(sem) == -1 && *__error_nid_postfix() == GUEST_EINVAL && Value(sem) == 2);
+    for (int open = 0; open < 3; ++open) REQUIRE(sem_close_nid_postfix(sem) == 0);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_close_nid_postfix(sem) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+
+    void* reopened = sem_open_nid_postfix(name, 0);
+    REQUIRE(reopened != nullptr && Value(reopened) == 2);
+    REQUIRE(sem_unlink_nid_postfix(name) == 0);
+    REQUIRE(UnlinkFails(name, GUEST_ENOENT));
+    REQUIRE(OpenFails(name, 0, GUEST_ENOENT));
+    REQUIRE(sem_post_nid_postfix(reopened) == 0 && Value(reopened) == 3);
+    void* recreated = sem_open_nid_postfix(name, O_CREAT_FLAG | O_EXCL_FLAG, 0600, 5);
+    REQUIRE(recreated != nullptr && recreated != reopened && Value(recreated) == 5 && Value(reopened) == 3);
+    REQUIRE(sem_close_nid_postfix(reopened) == 0);
+    REQUIRE(sem_close_nid_postfix(recreated) == 0 && sem_unlink_nid_postfix(name) == 0);
+}
+
+static void CheckUnnamed() {
+    std::uintptr_t storage[2] = {};
+    REQUIRE(sem_init_nid_postfix(storage, 0, 1) == 0);
+    *__error_nid_postfix() = 0;
+    REQUIRE(sem_close_nid_postfix(storage) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    REQUIRE(Value(storage) == 1 && sem_destroy_nid_postfix(storage) == 0);
+    REQUIRE(Throws([] { sem_close_nid_postfix(nullptr); }));
+}
+
+int main() {
+    CheckNames();
+    CheckLifetime();
+    CheckUnnamed();
+    return 0;
+}
diff --git a/core/libs/tests/GuestPosixRandom.cpp b/core/libs/tests/GuestPosixRandom.cpp
index 396fcc3aa1..e4f7307064 100644
--- a/core/libs/tests/GuestPosixRandom.cpp
+++ b/core/libs/tests/GuestPosixRandom.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -7,9 +8,6 @@
 #include <cstdlib>
 #include <source_location>
 
-extern "C" void APS5_VABI arc4random_buf_nid_postfix(void*, std::size_t);
-extern "C" std::uint32_t APS5_VABI arc4random_nid_postfix();
-
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Posix random check failed at line %u\n", location.line());
@@ -22,15 +20,18 @@ int main() {
     std::array<unsigned char, 4099> second{};
     first.fill(0xa5);
     arc4random_buf_nid_postfix(first.data(), 0);
+
     Require(std::all_of(first.begin(), first.end(), [](unsigned char value) { return value == 0xa5; }));
     for (const std::size_t size : {1u, 3u, 5u, 4098u}) {
         first.fill(0xa5);
         arc4random_buf_nid_postfix(first.data(), size);
+
         Require(std::all_of(first.begin() + static_cast<std::ptrdiff_t>(size), first.end(),
             [](unsigned char value) { return value == 0xa5; }));
     }
     arc4random_buf_nid_postfix(first.data(), first.size());
     arc4random_buf_nid_postfix(second.data(), second.size());
+
     Require(first != second);
     std::array<std::size_t, 256> counts{};
     for (const auto value : first) ++counts[value];
diff --git a/core/libs/tests/GuestPosixScalarIo.cpp b/core/libs/tests/GuestPosixScalarIo.cpp
index ec96da483a..ea79971ed5 100644
--- a/core/libs/tests/GuestPosixScalarIo.cpp
+++ b/core/libs/tests/GuestPosixScalarIo.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
@@ -20,30 +23,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-int* APS5_VABI __error_nid_postfix();
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI _read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI _write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-int APS5_VABI sceKernelUnlink(const char*);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI sceKernelUtimes_nid_postfix(const char*, const void*);
-int APS5_VABI sceKernelMkdir(const char*, std::uint16_t);
-int APS5_VABI sceKernelRmdir(const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "POSIX scalar I/O check failed at line %d (guest errno %d)\n", line, *__error_nid_postfix());
@@ -145,6 +124,7 @@ int main() {
     bool limitDiagnosticPreserved = false;
     try {
         write_nid_postfix(descriptor, payload, static_cast<std::int64_t>(std::numeric_limits<unsigned int>::max()) + 1);
+
     } catch (const std::runtime_error& error) {
         limitDiagnosticPreserved = std::string(error.what()).find("nbytes exceeds platform limit") != std::string::npos;
     }
diff --git a/core/libs/tests/GuestPosixSem.cpp b/core/libs/tests/GuestPosixSem.cpp
index f6a2963120..89e0a0b511 100644
--- a/core/libs/tests/GuestPosixSem.cpp
+++ b/core/libs/tests/GuestPosixSem.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
@@ -9,16 +11,6 @@
 #include <initializer_list>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sem_init_nid_postfix(void*, int, unsigned int);
-int APS5_VABI sem_destroy_nid_postfix(void*);
-int APS5_VABI sem_post_nid_postfix(void*);
-int APS5_VABI sem_trywait_nid_postfix(void*);
-int APS5_VABI sem_timedwait_nid_postfix(void*, const KernelTimespec*);
-int APS5_VABI sem_getvalue_nid_postfix(void*, int*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/tests/GuestPosixSpawn.cpp b/core/libs/tests/GuestPosixSpawn.cpp
index 5b714f2fb0..ecfb146655 100644
--- a/core/libs/tests/GuestPosixSpawn.cpp
+++ b/core/libs/tests/GuestPosixSpawn.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libSceLibcInternal/include/Spawn.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -10,33 +12,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI posix_spawnattr_init_nid_postfix(PosixSpawnAttributes**);
-int APS5_VABI posix_spawnattr_destroy_nid_postfix(PosixSpawnAttributes**);
-int APS5_VABI posix_spawnattr_setflags_nid_postfix(PosixSpawnAttributes**, std::int16_t);
-int APS5_VABI posix_spawnattr_setsigdefault_nid_postfix(PosixSpawnAttributes**, const GuestSignalSet*);
-int APS5_VABI posix_spawnattr_getflags_nid_postfix(PosixSpawnAttributes* const*, std::int16_t*);
-int APS5_VABI posix_spawnattr_getpgroup_nid_postfix(PosixSpawnAttributes* const*, std::int32_t*);
-int APS5_VABI posix_spawnattr_getschedparam_nid_postfix(PosixSpawnAttributes* const*, std::int32_t*);
-int APS5_VABI posix_spawnattr_getschedpolicy_nid_postfix(PosixSpawnAttributes* const*, std::int32_t*);
-int APS5_VABI posix_spawnattr_getsigdefault_nid_postfix(PosixSpawnAttributes* const*, GuestSignalSet*);
-int APS5_VABI posix_spawnattr_getsigmask_nid_postfix(PosixSpawnAttributes* const*, GuestSignalSet*);
-int APS5_VABI posix_spawnattr_setpgroup_nid_postfix(PosixSpawnAttributes**, std::int32_t);
-int APS5_VABI posix_spawnattr_setschedparam_nid_postfix(PosixSpawnAttributes**, const std::int32_t*);
-int APS5_VABI posix_spawnattr_setschedpolicy_nid_postfix(PosixSpawnAttributes**, std::int32_t);
-int APS5_VABI posix_spawnattr_setsigmask_nid_postfix(PosixSpawnAttributes**, const GuestSignalSet*);
-int APS5_VABI posix_spawn_file_actions_init_nid_postfix(PosixSpawnFileActions**);
-int APS5_VABI posix_spawn_file_actions_destroy_nid_postfix(PosixSpawnFileActions**);
-int APS5_VABI posix_spawn_file_actions_addopen_nid_postfix(PosixSpawnFileActions**, int, const char*, int, std::uint16_t);
-int APS5_VABI posix_spawn_file_actions_adddup2_nid_postfix(PosixSpawnFileActions**, int, int);
-int APS5_VABI posix_spawn_file_actions_addclose_nid_postfix(PosixSpawnFileActions**, int);
-int APS5_VABI posix_spawn_nid_postfix(std::int32_t*, const char*, PosixSpawnFileActions* const*, PosixSpawnAttributes* const*, char* const*, char* const*);
-int APS5_VABI posix_spawnp_nid_postfix(std::int32_t*, const char*, PosixSpawnFileActions* const*, PosixSpawnAttributes* const*, char* const*, char* const*);
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI unsetenv_nid_postfix(const char*);
-int APS5_VABI chdir_nid_postfix(const char*);
-}
-
 static void Require(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "Posix spawn check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestProcessArguments.cpp b/core/libs/tests/GuestProcessArguments.cpp
index fa0f5584b8..d32233f67b 100644
--- a/core/libs/tests/GuestProcessArguments.cpp
+++ b/core/libs/tests/GuestProcessArguments.cpp
@@ -1,11 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" int APS5_VABI getargc_nid_postfix(void);
-extern "C" const char** APS5_VABI getargv_nid_postfix(void);
-
 static void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/tests/GuestProgramName.cpp b/core/libs/tests/GuestProgramName.cpp
index 48be372cc8..7436649aa5 100644
--- a/core/libs/tests/GuestProgramName.cpp
+++ b/core/libs/tests/GuestProgramName.cpp
@@ -1,11 +1,13 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <cstring>
 
 extern "C" {
-const char* APS5_VABI getprogname_nid_postfix();
+
 extern const char* __progname_nid_postfix;
-int* APS5_VABI __error_nid_postfix();
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -14,12 +16,14 @@ int main() {
     const char* const original = __progname_nid_postfix;
     *__error_nid_postfix() = 45;
     Require(getprogname_nid_postfix() == original);
+    Require(_getprogname_nid_postfix() == original);
     Require(std::strcmp(getprogname_nid_postfix(), "eboot.bin") == 0);
     Require(*__error_nid_postfix() == 45);
 
     char renamed[] = "quake2";
     __progname_nid_postfix = renamed;
     Require(getprogname_nid_postfix() == renamed);
+    Require(_getprogname_nid_postfix() == renamed);
     renamed[0] = 'Q';
     Require(std::strcmp(getprogname_nid_postfix(), "Quake2") == 0);
 
diff --git a/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp b/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp
index 27f0e6dff8..f3f512f138 100644
--- a/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp
+++ b/core/libs/tests/GuestProprietaryVoiceChatHelper.cpp
@@ -1,17 +1,10 @@
+#include "prx/libSceProprietaryVoiceChatHelperPrx/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
 #include <cstdlib>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceProprietaryVoiceChatHelperInitialize();
-int APS5_VABI sceProprietaryVoiceChatHelperTerminate();
-int APS5_VABI sceProprietaryVoiceChatHelperSetVoiceChatState();
-int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChatUsageState();
-int APS5_VABI sceProprietaryVoiceChatHelperGetVoiceChat();
-}
-
 static void Require(bool value, const char* what) {
     if (value) return;
     std::printf("ProprietaryVoiceChatHelper: %s\n", what);
diff --git a/core/libs/tests/GuestProtectionReport.cpp b/core/libs/tests/GuestProtectionReport.cpp
index 87a3d29b52..00bf0c9ab7 100644
--- a/core/libs/tests/GuestProtectionReport.cpp
+++ b/core/libs/tests/GuestProtectionReport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
@@ -5,17 +6,6 @@
 #include <cstdlib>
 #include <exception>
 
-extern "C" {
-int APS5_VABI mprotect_nid_postfix(void*, std::size_t, int) noexcept;
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(std::uint64_t, std::size_t);
-int APS5_VABI sceKernelVirtualQuery(const void*, int, VirtualQueryInfo*, std::uint64_t);
-int APS5_VABI sceKernelQueryMemoryProtection(void*, void**, void**, int*);
-}
-
 namespace {
 
 constexpr std::size_t Page = 0x4000;
diff --git a/core/libs/tests/GuestPsml.cpp b/core/libs/tests/GuestPsml.cpp
index 882a4b5d04..b23fb204b6 100644
--- a/core/libs/tests/GuestPsml.cpp
+++ b/core/libs/tests/GuestPsml.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePsml_debug/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -7,28 +8,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement1100(void* requirement, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateContext1100(void** context, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1100(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetContextBufferRequirement800M3_2(void* requirement, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateContext800M3_2(void** context, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateContext1300(void** context, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket900(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1000(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacket1300(void* context, void* commandBuffer, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrInit();
-std::int32_t APS5_VABI scePsmlMfsrGetSharedResourcesInitRequirement(void* requirement, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrCreateSharedResources(void** sharedResources, const void* param);
-std::int32_t APS5_VABI scePsmlMfsrReleaseSharedResources(void* sharedResources);
-std::int32_t APS5_VABI scePsmlMfsrReleaseContext(void* context);
-std::int32_t APS5_VABI scePsmlMfsrGetDispatchMfsrPacketSizeInDwords(void* context, std::uint32_t* packetSizeInDwords);
-std::int32_t APS5_VABI scePsmlMfsrSelectConfig(void* config);
-std::int32_t APS5_VABI scePsmlMfsrGetMipmapBias(void* context, float* bias, std::uint32_t dimension);
-std::int32_t APS5_VABI scePsmlMfsrRequestCapture(void* context);
-std::int32_t APS5_VABI scePsmlMfsrIsCaptureInProgress(void* context);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -37,20 +16,15 @@ constexpr std::int32_t kErrNotInitialized = static_cast<std::int32_t>(0x8A810001
 constexpr std::int32_t kErrInvalidArgument = static_cast<std::int32_t>(0x8A810005);
 constexpr std::int32_t kErrNullOutput = static_cast<std::int32_t>(0x8A810009);
 
-struct CommandBuffer {
-    std::uint32_t* cursor;
-    std::uint32_t sizeInDwords;
-};
-
-using CreateContext = std::int32_t (APS5_VABI*)(void**, const void*);
 using GetDispatchPacket = std::int32_t (APS5_VABI*)(void*, void*, const void*);
 
-void CreateContextUntouched(CreateContext create) {
+template <typename TParam>
+void CreateContextUntouched(std::int32_t (APS5_VABI* create)(void**, const TParam*)) {
     std::array<std::uint8_t, 0x158> param{};
     std::uint64_t contextStorage = 0;
     void* const sentinel = &contextStorage;
     void* context = sentinel;
-    Require(create(&context, param.data()) == kErrNotInitialized);
+    Require(create(&context, reinterpret_cast<const TParam*>(param.data())) == kErrNotInitialized);
     Require(context == sentinel);
     Require(create(nullptr, nullptr) == kErrNotInitialized);
 }
@@ -61,7 +35,7 @@ void DispatchPacketUntouched(GetDispatchPacket dispatch) {
     std::array<std::uint32_t, 64> dwords;
     dwords.fill(0xa5a5a5a5u);
     const auto untouchedDwords = dwords;
-    CommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
     Require(dispatch(&contextStorage, &commandBuffer, param.data()) == kErrNotInitialized);
     Require(dispatch(nullptr, &commandBuffer, nullptr) == kErrNotInitialized);
     Require(commandBuffer.cursor == dwords.data());
@@ -79,29 +53,10 @@ bool Throws(TCall call, const char* text) {
     return false;
 }
 
-struct Requirement {
-    std::uint64_t blockBytes;
-    std::uint64_t alignment;
-    std::uint64_t blockCount;
-};
-
-struct Block {
-    std::uint64_t address;
-    std::uint64_t bytes;
-};
-
-struct SharedParam {
-    std::uint32_t type;
-    std::uint32_t reserved;
-    const Block* blocks;
-    std::uint64_t blockCount;
-    std::uint64_t reserved2;
-};
-
 struct ContextParam {
     std::array<std::uint8_t, 0x60> bytes{};
 
-    void Set(const Block* blocks, std::uint64_t count, void* shared) {
+    void Set(const MfsrBlock* blocks, std::uint64_t count, void* shared) {
         std::memcpy(bytes.data() + 0x08, &blocks, sizeof(blocks));
         std::memcpy(bytes.data() + 0x10, &count, sizeof(count));
         std::memcpy(bytes.data() + 0x38, &shared, sizeof(shared));
@@ -117,8 +72,8 @@ struct ContextParam {
     }
 };
 
-std::vector<Block> Blocks(const Requirement& requirement, std::uint64_t first) {
-    std::vector<Block> blocks(requirement.blockCount);
+std::vector<MfsrBlock> Blocks(const MfsrRequirement& requirement, std::uint64_t first) {
+    std::vector<MfsrBlock> blocks(requirement.blockCount);
     for (std::size_t i = 0; i < blocks.size(); ++i) blocks[i] = {first + i * requirement.blockBytes, requirement.blockBytes};
     return blocks;
 }
@@ -127,8 +82,8 @@ void SetupBeforeInit() {
     std::uint64_t storage = 0;
     void* const sentinel = &storage;
     void* handle = sentinel;
-    Requirement requirement{1, 2, 3};
-    SharedParam sharedParam{};
+    MfsrRequirement requirement{1, 2, 3};
+    MfsrSharedResourcesParam sharedParam{};
     Require(scePsmlMfsrGetSharedResourcesInitRequirement(&requirement, &sharedParam) == kErrNotInitialized);
     Require(requirement.blockBytes == 1 && requirement.alignment == 2 && requirement.blockCount == 3);
     Require(scePsmlMfsrCreateSharedResources(&handle, &sharedParam) == kErrNotInitialized);
@@ -151,8 +106,8 @@ void SetupAfterInit() {
     Require(scePsmlMfsrInit() == 0);
     Require(scePsmlMfsrInit() == 0);
 
-    SharedParam sharedParam{};
-    Requirement shared{};
+    MfsrSharedResourcesParam sharedParam{};
+    MfsrRequirement shared{};
     Require(scePsmlMfsrGetSharedResourcesInitRequirement(&shared, &sharedParam) == 0);
     Require(shared.blockBytes == 0x200000 && shared.alignment == 0x200000 && shared.blockCount == 52);
 
@@ -165,14 +120,14 @@ void SetupAfterInit() {
 
     ContextParam contextParam;
     contextParam.Set(nullptr, 0, sharedResources);
-    Requirement context{};
-    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(&context, contextParam.bytes.data()) == 0);
+    MfsrRequirement context{};
+    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(&context, reinterpret_cast<const MfsrContextParam*>(contextParam.bytes.data())) == 0);
     Require(context.blockBytes == 0x200000 && context.alignment == 0x200000 && context.blockCount == 4);
 
     const auto contextBlocks = Blocks(context, 0x20000000);
     contextParam.Set(contextBlocks.data(), contextBlocks.size(), sharedResources);
     void* mfsrContext = nullptr;
-    Require(scePsmlMfsrCreateContext800M3_2(&mfsrContext, contextParam.bytes.data()) == 0);
+    Require(scePsmlMfsrCreateContext800M3_2(&mfsrContext, reinterpret_cast<const MfsrContextParam*>(contextParam.bytes.data())) == 0);
     Require(mfsrContext != nullptr && mfsrContext != sharedResources);
 
     std::uint32_t packetDwords = 0;
@@ -202,7 +157,7 @@ void SetupAfterInit() {
     dimensionsParam.Set(contextBlocks.data(), contextBlocks.size(), sharedResources);
     dimensionsParam.SetInputDimensions(1920, 1080);
     void* dimensionContext = nullptr;
-    Require(scePsmlMfsrCreateContext800M3_2(&dimensionContext, dimensionsParam.bytes.data()) == 0);
+    Require(scePsmlMfsrCreateContext800M3_2(&dimensionContext, reinterpret_cast<const MfsrContextParam*>(dimensionsParam.bytes.data())) == 0);
     Require(scePsmlMfsrGetMipmapBias(dimensionContext, &bias, 3840) == 0);
     Require(bias == 0.0f);
     Require(scePsmlMfsrGetMipmapBias(dimensionContext, &bias, 1920) == 0);
@@ -218,7 +173,7 @@ void SetupAfterInit() {
     descriptorParam.Set(contextBlocks.data(), contextBlocks.size(), sharedResources);
     descriptorParam.SetDescriptor0(descriptor.data());
     void* descriptorContext = nullptr;
-    Require(scePsmlMfsrCreateContext800M3_2(&descriptorContext, descriptorParam.bytes.data()) == 0);
+    Require(scePsmlMfsrCreateContext800M3_2(&descriptorContext, reinterpret_cast<const MfsrContextParam*>(descriptorParam.bytes.data())) == 0);
     Require(scePsmlMfsrGetMipmapBias(descriptorContext, &bias, 2560) == 0);
     Require(bias == 0.0f);
     Require(scePsmlMfsrReleaseContext(descriptorContext) == 0);
@@ -231,8 +186,8 @@ void SetupAfterInit() {
 }
 
 void RefusedAfterInit() {
-    SharedParam sharedParam{};
-    Requirement requirement{};
+    MfsrSharedResourcesParam sharedParam{};
+    MfsrRequirement requirement{};
     sharedParam.type = 1;
     Require(Throws([&] { scePsmlMfsrGetSharedResourcesInitRequirement(&requirement, &sharedParam); }, "type 1 is not supported"));
 
@@ -254,12 +209,12 @@ void RefusedAfterInit() {
     ContextParam contextParam;
     contextParam.Set(blocks.data(), blocks.size(), &foreign);
     void* context = nullptr;
-    Require(Throws([&] { scePsmlMfsrCreateContext800M3_2(&context, contextParam.bytes.data()); }, "shared resources handle was not created"));
+    Require(Throws([&] { scePsmlMfsrCreateContext800M3_2(&context, reinterpret_cast<const MfsrContextParam*>(contextParam.bytes.data())); }, "shared resources handle was not created"));
     Require(context == nullptr);
 
     std::array<std::uint8_t, 0x158> param{};
     std::array<std::uint32_t, 64> dwords{};
-    CommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
     Require(Throws([&] { scePsmlMfsrGetContextBufferRequirement1100(&requirement, param.data()); }, "not implemented"));
     Require(Throws([&] { scePsmlMfsrCreateContext1300(&context, param.data()); }, "not implemented"));
     Require(Throws([&] { scePsmlMfsrGetDispatchMfsrPacket900(&foreign, &commandBuffer, param.data()); }, "not implemented"));
@@ -289,7 +244,7 @@ int main() {
     std::array<std::uint32_t, 64> dwords;
     dwords.fill(0xa5a5a5a5u);
     const auto untouchedDwords = dwords;
-    CommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
+    MfsrCommandBuffer commandBuffer{dwords.data(), static_cast<std::uint32_t>(dwords.size())};
     Require(scePsmlMfsrGetDispatchMfsrPacket1100(&contextStorage, &commandBuffer, param.data()) == kErrNotInitialized);
     Require(commandBuffer.cursor == dwords.data());
     Require(commandBuffer.sizeInDwords == dwords.size());
@@ -301,7 +256,7 @@ int main() {
     std::array<std::uint8_t, 0x18> olderRequirement;
     olderRequirement.fill(0xa5);
     const auto untouchedOlderRequirement = olderRequirement;
-    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(olderRequirement.data(), param.data()) == kErrNotInitialized);
+    Require(scePsmlMfsrGetContextBufferRequirement800M3_2(reinterpret_cast<MfsrRequirement*>(olderRequirement.data()), reinterpret_cast<const MfsrContextParam*>(param.data())) == kErrNotInitialized);
     Require(olderRequirement == untouchedOlderRequirement);
     Require(scePsmlMfsrGetContextBufferRequirement800M3_2(nullptr, nullptr) == kErrNotInitialized);
 
diff --git a/core/libs/tests/GuestPthreadAttr.cpp b/core/libs/tests/GuestPthreadAttr.cpp
index 5afa252aa8..5e905c13e9 100644
--- a/core/libs/tests/GuestPthreadAttr.cpp
+++ b/core/libs/tests/GuestPthreadAttr.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstddef>
@@ -5,42 +7,7 @@
 #include <future>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadSetprio(Pthread thread, int prio);
-int APS5_VABI scePthreadSetaffinity(Pthread thread, KernelCpumask mask);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
-int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, std::size_t* stackSize);
-int APS5_VABI scePthreadAttrGetdetachstate(const PthreadAttr* attr, int* state);
-int APS5_VABI scePthreadAttrGetsolosched(const PthreadAttr* attr, int* solosched);
-int APS5_VABI pthread_attr_setstacksize_nid_postfix(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI pthread_attr_setsolosched_np_nid_postfix(PthreadAttr* attr, int solosched);
-int APS5_VABI pthread_attr_getinheritsched_nid_postfix(const PthreadAttr* attr, int* inherit_sched);
-int APS5_VABI pthread_attr_setinheritsched_nid_postfix(PthreadAttr* attr, int inherit_sched);
-int APS5_VABI pthread_attr_getscope_nid_postfix(const PthreadAttr* attr, int* scope);
-int APS5_VABI pthread_attr_setscope_nid_postfix(PthreadAttr* attr, int scope);
-int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr);
-int APS5_VABI pthread_attr_setschedparam_nid_postfix(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI pthread_attr_setschedpolicy_nid_postfix(PthreadAttr* attr, int policy);
-int APS5_VABI pthread_attr_getschedpolicy_nid_postfix(const PthreadAttr* attr, int* policy);
-int APS5_VABI scePthreadAttrSetdetachstate(PthreadAttr* attr, int state);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-Pthread APS5_VABI scePthreadSelf();
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int EXPLICIT_SCHED = 0;
 static constexpr int INHERIT_SCHED = 4;
 static constexpr int SCOPE_PROCESS = 0;
@@ -54,7 +21,6 @@ static constexpr std::size_t STACK_SIZE = 2u << 20;
 static constexpr std::size_t MIN_STACK_SIZE = 16384;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_ENOTSUP = 45;
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
 static constexpr int DETACH_DETACHED = 1;
 static constexpr int DETACHED_THREADS = 32;
 
@@ -67,12 +33,6 @@ struct ReportedAttributes {
     int detachState = -1;
 };
 
-extern "C" {
-int APS5_VABI pthread_attr_setstack_nid_postfix(PthreadAttr* attr, void* addr, std::size_t size);
-int APS5_VABI pthread_attr_getstack_nid_postfix(const PthreadAttr* attr, void** addr, std::size_t* size);
-int APS5_VABI pthread_attr_getstackaddr_nid_postfix(const PthreadAttr* attr, void** addr);
-}
-
 static ReportedAttributes Query(Pthread thread) {
     PthreadAttr attr = nullptr;
     Require(scePthreadAttrInit(&attr) == SCE_OK);
@@ -101,8 +61,6 @@ static void CheckStackSizeLimit() {
     Require(scePthreadAttrDestroy(&attr) == SCE_OK);
 }
 
-extern "C" int APS5_VABI scePthreadAttrSetsolosched(PthreadAttr* attr, int solosched);
-
 static void CheckSoloSched() {
     PthreadAttr attr = nullptr;
     Require(pthread_attr_setsolosched_np_nid_postfix(nullptr, 1) == GUEST_EINVAL);
@@ -207,6 +165,7 @@ static void CheckSchedulingAttributes() {
     bool threw = false;
     try {
         pthread_attr_getinheritsched_nid_postfix(&attr, nullptr);
+
     } catch (const std::exception&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestPthreadAttrErrors.cpp b/core/libs/tests/GuestPthreadAttrErrors.cpp
index 06c2e15832..97636eb722 100644
--- a/core/libs/tests/GuestPthreadAttrErrors.cpp
+++ b/core/libs/tests/GuestPthreadAttrErrors.cpp
@@ -1,29 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, std::size_t* stackSize);
-int APS5_VABI scePthreadAttrSetdetachstate(PthreadAttr* attr, int state);
-int APS5_VABI scePthreadAttrGetdetachstate(const PthreadAttr* attr, int* state);
-int APS5_VABI scePthreadAttrSetschedpolicy(PthreadAttr* attr, int policy);
-int APS5_VABI scePthreadAttrGetschedpolicy(const PthreadAttr* attr, int* policy);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrGetinheritsched(const PthreadAttr* attr, int* inheritSched);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetaffinity(PthreadAttr* attr, KernelCpumask mask);
-int APS5_VABI scePthreadAttrGetaffinity(const PthreadAttr* attr, KernelCpumask* mask);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
-static constexpr int SCE_KERNEL_ERROR_EOPNOTSUPP = static_cast<int>(0x8002002Du);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
diff --git a/core/libs/tests/GuestPthreadAttrStack.cpp b/core/libs/tests/GuestPthreadAttrStack.cpp
index faf907527a..4193f08fe6 100644
--- a/core/libs/tests/GuestPthreadAttrStack.cpp
+++ b/core/libs/tests/GuestPthreadAttrStack.cpp
@@ -1,19 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** stackAddress, std::size_t* stackSize);
-int APS5_VABI scePthreadAttrGetstackaddr(const PthreadAttr* attr, void** stackAddress);
-int APS5_VABI scePthreadAttrGetguardsize(const PthreadAttr* attr, std::size_t* guardSize);
-int APS5_VABI scePthreadAttrSetguardsize(PthreadAttr* attr, std::size_t guardSize);
-int APS5_VABI scePthreadAttrSetstack(PthreadAttr* attr, void* stackAddress, std::size_t stackSize);
-int APS5_VABI scePthreadAttrSetstackaddr(PthreadAttr* attr, void* stackAddress);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int SceEinval = static_cast<int>(0x80020016u);
 static constexpr std::size_t DefaultStackSize = 1u << 20;
diff --git a/core/libs/tests/GuestPthreadBarrier.cpp b/core/libs/tests/GuestPthreadBarrier.cpp
index 163c97b14c..3b314e9430 100644
--- a/core/libs/tests/GuestPthreadBarrier.cpp
+++ b/core/libs/tests/GuestPthreadBarrier.cpp
@@ -1,24 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
 #include <cstdlib>
 #include <stdexcept>
 
-struct GuestBarrier;
-struct GuestBarrierattr;
-
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_barrierattr_init_nid_postfix(GuestBarrierattr** attr);
-int APS5_VABI pthread_barrierattr_destroy_nid_postfix(GuestBarrierattr** attr);
-int APS5_VABI pthread_barrierattr_getpshared_nid_postfix(GuestBarrierattr* const* attr, int* pshared);
-int APS5_VABI pthread_barrierattr_setpshared_nid_postfix(GuestBarrierattr** attr, int pshared);
-int APS5_VABI pthread_barrier_init_nid_postfix(GuestBarrier** barrier, GuestBarrierattr* const* attr, unsigned count);
-int APS5_VABI pthread_barrier_wait_nid_postfix(GuestBarrier** barrier);
-int APS5_VABI pthread_barrier_destroy_nid_postfix(GuestBarrier** barrier);
-}
-
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int PROCESS_PRIVATE = 0;
 static constexpr int PROCESS_SHARED = 1;
@@ -28,7 +14,7 @@ static constexpr unsigned WAITERS = 4;
 static void Require(bool value) { if (!value) std::abort(); }
 
 struct Context {
-    GuestBarrier* barrier = nullptr;
+    PthreadBarrierPrivate* barrier = nullptr;
     std::atomic<int> serial{0};
     std::atomic<int> released{0};
 };
@@ -57,7 +43,7 @@ static void RunWaiters(Context& context) {
 }
 
 int main() {
-    GuestBarrierattr* missing = nullptr;
+    PthreadBarrierattrPrivate* missing = nullptr;
     int pshared = -1;
     Require(pthread_barrierattr_init_nid_postfix(nullptr) == GUEST_EINVAL);
     Require(pthread_barrierattr_destroy_nid_postfix(nullptr) == GUEST_EINVAL);
@@ -68,7 +54,7 @@ int main() {
     Require(pthread_barrierattr_setpshared_nid_postfix(&missing, PROCESS_PRIVATE) == GUEST_EINVAL);
     Require(pshared == -1);
 
-    GuestBarrierattr* attr = nullptr;
+    PthreadBarrierattrPrivate* attr = nullptr;
     Require(pthread_barrierattr_init_nid_postfix(&attr) == 0 && attr != nullptr);
     Require(pthread_barrierattr_getpshared_nid_postfix(&attr, &pshared) == 0 && pshared == PROCESS_PRIVATE);
     Require(pthread_barrierattr_setpshared_nid_postfix(&attr, 2) == GUEST_EINVAL);
@@ -88,7 +74,7 @@ int main() {
     catch (const std::invalid_argument&) { rejected = true; }
     Require(rejected);
 
-    GuestBarrier* invalid = nullptr;
+    PthreadBarrierPrivate* invalid = nullptr;
     Require(pthread_barrier_init_nid_postfix(nullptr, &attr, 1) == GUEST_EINVAL);
     Require(pthread_barrier_init_nid_postfix(&invalid, &attr, 0) == GUEST_EINVAL && invalid == nullptr);
     Require(pthread_barrier_init_nid_postfix(&invalid, &attr, 0x80000000u) == GUEST_EINVAL && invalid == nullptr);
@@ -120,7 +106,7 @@ int main() {
         Require(destroyed.serial == 1);
     }
 
-    GuestBarrier* single = nullptr;
+    PthreadBarrierPrivate* single = nullptr;
     Require(pthread_barrierattr_init_nid_postfix(&attr) == 0);
     Require(pthread_barrier_init_nid_postfix(&single, &attr, 1) == 0);
     Require(pthread_barrier_wait_nid_postfix(&single) == BARRIER_SERIAL_THREAD);
diff --git a/core/libs/tests/GuestPthreadCancel.cpp b/core/libs/tests/GuestPthreadCancel.cpp
index 81cc47ebde..9309d74dae 100644
--- a/core/libs/tests/GuestPthreadCancel.cpp
+++ b/core/libs/tests/GuestPthreadCancel.cpp
@@ -1,3 +1,10 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -5,42 +12,7 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-void APS5_VABI scePthreadExit(void* retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* old_state);
-int APS5_VABI scePthreadSetcanceltype(int type, int* old_type);
-void APS5_VABI scePthreadTestcancel();
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
-int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
-int APS5_VABI scePthreadSemWait(PthreadSem* sem);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-int APS5_VABI pthread_cancel_nid_postfix(Pthread thread);
-int APS5_VABI pthread_setcanceltype_nid_postfix(int type, int* old_type);
-int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value);
-int APS5_VABI sem_destroy_nid_postfix(void* sem);
-int APS5_VABI sem_wait_nid_postfix(void* sem);
-int APS5_VABI sem_timedwait_nid_postfix(void* sem, const KernelTimespec* abstime);
-int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value);
-void APS5_VABI __pthread_cleanup_push_imp_nid_postfix(void (APS5_VABI* routine)(void*), void* argument, void* info);
-void APS5_VABI __pthread_cleanup_pop_imp_nid_postfix(int execute);
-void APS5_VABI pthread_cleanup_push_nid_postfix(void (APS5_VABI* routine)(void*), void* argument);
-void APS5_VABI pthread_cleanup_pop_nid_postfix(int execute);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int CANCEL_ENABLE = 0;
@@ -80,6 +52,7 @@ static void* APS5_VABI CondWaiter(void*) {
     std::uintptr_t info[8];
     Require(scePthreadMutexLock(&shared.mutex) == SCE_OK);
     __pthread_cleanup_push_imp_nid_postfix(UnlockMutex, nullptr, info);
+
     shared.ready.store(true);
     for (;;) Require(scePthreadCondWait(&shared.cond, &shared.mutex) == SCE_OK);
 }
@@ -87,6 +60,7 @@ static void* APS5_VABI CondWaiter(void*) {
 static void* APS5_VABI SemWaiter(void*) {
     shared.ready.store(true);
     scePthreadSemWait(&shared.sem);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -94,6 +68,7 @@ static void* APS5_VABI SemWaiter(void*) {
 static void* APS5_VABI PosixSemWaiter(void*) {
     shared.ready.store(true);
     sem_wait_nid_postfix(&shared.posixSem);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -144,6 +119,7 @@ static void* APS5_VABI Idler(void*) {
 static void* APS5_VABI Joiner(void*) {
     shared.ready.store(true);
     scePthreadJoin(shared.target, nullptr);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -160,10 +136,12 @@ static void* APS5_VABI Disabled(void*) {
     while (!shared.release.load()) {
         sceKernelUsleep_nid_postfix(1000);
         scePthreadTestcancel();
+
     }
     shared.survived.store(true);
     Require(scePthreadSetcancelstate(CANCEL_ENABLE, &old) == SCE_OK && old == CANCEL_DISABLE);
     scePthreadTestcancel();
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -175,6 +153,7 @@ static void* APS5_VABI Asynchronous(void*) {
     shared.ready.store(true);
     while (!shared.release.load()) std::this_thread::sleep_for(std::chrono::milliseconds(1));
     scePthreadSetcancelstate(CANCEL_ENABLE, nullptr);
+
     shared.returned.store(true);
     return nullptr;
 }
@@ -185,8 +164,10 @@ static void* APS5_VABI Handlers(void*) {
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{1}), first);
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{2}), second);
     __pthread_cleanup_pop_imp_nid_postfix(0);
+
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{3}), second);
     __pthread_cleanup_pop_imp_nid_postfix(1);
+
     scePthreadExit(reinterpret_cast<void*>(std::intptr_t{7}));
     return nullptr;
 }
@@ -196,8 +177,10 @@ static void* APS5_VABI HeapHandlers(void*) {
     __pthread_cleanup_push_imp_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{1}), first);
     pthread_cleanup_push_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{2}));
     pthread_cleanup_pop_nid_postfix(0);
+
     pthread_cleanup_push_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{3}));
     __pthread_cleanup_pop_imp_nid_postfix(1);
+
     pthread_cleanup_push_nid_postfix(RecordOrder, reinterpret_cast<void*>(std::intptr_t{4}));
     scePthreadExit(reinterpret_cast<void*>(std::intptr_t{8}));
     return nullptr;
diff --git a/core/libs/tests/GuestPthreadCancelRecovery.cpp b/core/libs/tests/GuestPthreadCancelRecovery.cpp
index 297f761a92..e7f647ad7c 100644
--- a/core/libs/tests/GuestPthreadCancelRecovery.cpp
+++ b/core/libs/tests/GuestPthreadCancelRecovery.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
+#include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <array>
@@ -17,46 +22,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* oldState);
-int APS5_VABI scePthreadSetcanceltype(int type, int* oldType);
-void APS5_VABI scePthreadTestcancel();
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI scePthreadCondTimedwait(PthreadCond* cond, PthreadMutex* mutex, KernelUseconds usec);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_wait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_cond_timedwait_nid_postfix(PthreadCond* cond, PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* time);
-int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
-int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
-int APS5_VABI scePthreadSemWait(PthreadSem* sem);
-int APS5_VABI scePthreadSemTimedwait(PthreadSem* sem, KernelUseconds usec);
-int APS5_VABI scePthreadSemGetvalue(PthreadSem* sem, int* value);
-int APS5_VABI sem_init_nid_postfix(void* sem, int pshared, unsigned int value);
-int APS5_VABI sem_destroy_nid_postfix(void* sem);
-int APS5_VABI sem_wait_nid_postfix(void* sem);
-int APS5_VABI sem_reltimedwait_np_nid_postfix(void* sem, std::uint32_t usec);
-int APS5_VABI sem_getvalue_nid_postfix(void* sem, int* value);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-void APS5_VABI __pthread_cleanup_push_imp_nid_postfix(void (APS5_VABI* routine)(void*), void* argument, void* info);
-void APS5_VABI __pthread_cleanup_pop_imp_nid_postfix(int execute);
-}
-
 static constexpr int CANCEL_ENABLE = 0;
 static constexpr int CANCEL_DISABLE = 1;
 static constexpr int CANCEL_DEFERRED = 0;
@@ -121,6 +86,7 @@ static void APS5_VABI Record(void* value) {
 static void APS5_VABI CleanupWithPoints(void*) {
     Record(reinterpret_cast<void*>(std::uintptr_t{2}));
     scePthreadTestcancel();
+
     Require(sceKernelUsleep_nid_postfix(1) == 0);
     Record(reinterpret_cast<void*>(std::uintptr_t{3}));
 }
@@ -150,6 +116,7 @@ static void* APS5_VABI PendingToken(void*) {
     Require(scePthreadSetspecific(key, &normalResult) == 0);
     __pthread_cleanup_push_imp_nid_postfix(Record, reinterpret_cast<void*>(std::uintptr_t{1}), first);
     __pthread_cleanup_push_imp_nid_postfix(CleanupWithPoints, nullptr, second);
+
     Gate();
     WaitForToken();
     returned = true;
@@ -161,6 +128,7 @@ static void CheckDefaults() {
     Require(scePthreadSetcancelstate(CANCEL_ENABLE, &old) == 0 && old == CANCEL_ENABLE);
     Require(scePthreadSetcanceltype(CANCEL_DEFERRED, &old) == 0 && old == CANCEL_DEFERRED);
     scePthreadTestcancel();
+
 }
 
 static void* APS5_VABI ConsumeToken(void*) {
@@ -198,17 +166,21 @@ static void* APS5_VABI ConditionWaiter(void*) {
     Require(scePthreadMutexLock(&mutex) == 0);
     std::uintptr_t info[8];
     __pthread_cleanup_push_imp_nid_postfix(Unlock, nullptr, info);
+
     Signal(ready);
     while (!conditionReleased) Require(scePthreadCondTimedwait(&cond, &mutex, WAIT_MICROSECONDS) == 0);
     Require(scePthreadMutexUnlock(&mutex) == 0);
     __pthread_cleanup_pop_imp_nid_postfix(0);
+
     if (disabled) {
         stage = 1;
         scePthreadTestcancel();
+
         int old = -1;
         Require(scePthreadSetcancelstate(CANCEL_ENABLE, &old) == 0 && old == CANCEL_DISABLE);
         stage = 2;
         scePthreadTestcancel();
+
     }
     returned = true;
     return &normalResult;
@@ -279,6 +251,7 @@ static void* APS5_VABI SignaledConditionWaiter(void* value) {
     for (int level = 0; level < context.lockCount; ++level) Require(scePthreadMutexLock(&context.mutex) == 0);
     std::uintptr_t cleanup[8];
     __pthread_cleanup_push_imp_nid_postfix(UnlockSignaledCondition, &worker, cleanup);
+
     context.ready.fetch_add(1);
     int result = 0;
     do {
@@ -303,6 +276,7 @@ static void* APS5_VABI SignaledConditionWaiter(void* value) {
     } while (result == 0 && !context.released);
     context.results[worker.index] = result;
     __pthread_cleanup_pop_imp_nid_postfix(1);
+
     return nullptr;
 }
 
diff --git a/core/libs/tests/GuestPthreadCondattr.cpp b/core/libs/tests/GuestPthreadCondattr.cpp
index 237ac4374e..fb96e05b2d 100644
--- a/core/libs/tests/GuestPthreadCondattr.cpp
+++ b/core/libs/tests/GuestPthreadCondattr.cpp
@@ -1,17 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI scePthreadCondattrInit(PthreadCondattr* attr);
-int APS5_VABI scePthreadCondattrDestroy(PthreadCondattr* attr);
-int APS5_VABI scePthreadCondattrSetclock(PthreadCondattr* attr, KernelClockid clockId);
-int APS5_VABI pthread_condattr_setclock_nid_postfix(PthreadCondattr* attr, KernelClockid clockId);
-int APS5_VABI pthread_condattr_setpshared_nid_postfix(PthreadCondattr* attr, int pshared);
-int APS5_VABI pthread_condattr_getpshared_nid_postfix(const PthreadCondattr* attr, int* pshared);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int SceEinval = static_cast<int>(0x80020016u);
 static constexpr int GuestEinval = 22;
@@ -31,6 +24,8 @@ int main() {
     Require(pthread_condattr_setpshared_nid_postfix(&unset, 0) == GuestEinval);
     Require(pthread_condattr_getpshared_nid_postfix(nullptr, &sharing) == GuestEinval && sharing == -1);
     Require(pthread_condattr_getpshared_nid_postfix(&unset, &sharing) == GuestEinval && sharing == -1);
+    Require(scePthreadCondattrSetpshared(&unset, 0) == SceEinval);
+    Require(scePthreadCondattrGetpshared(nullptr, &sharing) == SceEinval && sharing == -1);
 
     PthreadCondattr attr = nullptr;
     Require(scePthreadCondattrInit(&attr) == SCE_OK);
@@ -38,6 +33,9 @@ int main() {
         Require(scePthreadCondattrSetclock(&attr, clock) == SCE_OK);
         Require(pthread_condattr_setclock_nid_postfix(&attr, clock) == 0);
     }
+    Require(scePthreadCondattrSetpshared(&attr, 1) == SceEinval);
+    Require(scePthreadCondattrSetpshared(&attr, 0) == SCE_OK);
+    Require(scePthreadCondattrGetpshared(&attr, &sharing) == SCE_OK && sharing == 0);
     Require(pthread_condattr_getpshared_nid_postfix(&attr, &sharing) == 0 && sharing == 0);
     for (const int invalid : {1, 2, -1}) {
         Require(pthread_condattr_setpshared_nid_postfix(&attr, invalid) == GuestEinval);
@@ -50,6 +48,7 @@ int main() {
     bool threw = false;
     try {
         pthread_condattr_getpshared_nid_postfix(&attr, nullptr);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestPthreadDestroyedObjects.cpp b/core/libs/tests/GuestPthreadDestroyedObjects.cpp
index a9a041cfc0..3232f4c87e 100644
--- a/core/libs/tests/GuestPthreadDestroyedObjects.cpp
+++ b/core/libs/tests/GuestPthreadDestroyedObjects.cpp
@@ -1,25 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libkernel/Pthread/include/Cond.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTrylock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadCondInit(PthreadCond* cond, const PthreadCondattr* attr, const char* name);
-int APS5_VABI scePthreadCondDestroy(PthreadCond* cond);
-int APS5_VABI scePthreadCondSignal(PthreadCond* cond);
-int APS5_VABI scePthreadCondBroadcast(PthreadCond* cond);
-int APS5_VABI scePthreadCondWait(PthreadCond* cond, PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_cond_signal_nid_postfix(PthreadCond* cond);
-int APS5_VABI pthread_cond_destroy_nid_postfix(PthreadCond* cond);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
 static constexpr int POSIX_EINVAL = 22;
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -34,6 +21,21 @@ int main() {
     Require(pthread_mutex_lock_nid_postfix(&mutex) == POSIX_EINVAL);
     Require(mutex == reinterpret_cast<PthreadMutex>(std::uintptr_t{2}));
 
+    PthreadMutex uninitialized = nullptr;
+    Require(scePthreadMutexUnlock(&uninitialized) == SCE_KERNEL_ERROR_EPERM);
+    Require(uninitialized == nullptr);
+    Require(scePthreadMutexLock(&uninitialized) == SCE_OK);
+    Require(scePthreadMutexUnlock(&uninitialized) == SCE_OK);
+    Require(scePthreadMutexUnlock(&uninitialized) == SCE_KERNEL_ERROR_EPERM);
+    Require(scePthreadMutexDestroy(&uninitialized) == SCE_OK);
+
+    PthreadMutex adaptive = reinterpret_cast<PthreadMutex>(std::uintptr_t{1});
+    Require(scePthreadMutexUnlock(&adaptive) == SCE_KERNEL_ERROR_EPERM);
+    Require(adaptive == reinterpret_cast<PthreadMutex>(std::uintptr_t{1}));
+    Require(scePthreadMutexLock(&adaptive) == SCE_OK);
+    Require(scePthreadMutexUnlock(&adaptive) == SCE_OK);
+    Require(scePthreadMutexDestroy(&adaptive) == SCE_OK);
+
     PthreadCond cond = nullptr;
     Require(scePthreadCondInit(&cond, nullptr, "destroyed") == SCE_OK);
     Require(scePthreadCondDestroy(&cond) == SCE_OK);
diff --git a/core/libs/tests/GuestPthreadDestructorLifetime.cpp b/core/libs/tests/GuestPthreadDestructorLifetime.cpp
index 4bddcb951c..2001d54acb 100644
--- a/core/libs/tests/GuestPthreadDestructorLifetime.cpp
+++ b/core/libs/tests/GuestPthreadDestructorLifetime.cpp
@@ -1,23 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
 #include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadCancel(Pthread thread);
-void APS5_VABI scePthreadExit(void* retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetthreadid();
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-}
-
 struct Context {
     PthreadKey key = -1;
     Pthread expected = nullptr;
diff --git a/core/libs/tests/GuestPthreadFrameChain.cpp b/core/libs/tests/GuestPthreadFrameChain.cpp
index d9c491090f..b0d3fc5822 100644
--- a/core/libs/tests/GuestPthreadFrameChain.cpp
+++ b/core/libs/tests/GuestPthreadFrameChain.cpp
@@ -1,13 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr std::uintptr_t ChainReach = std::uintptr_t{64} << 10;
 
diff --git a/core/libs/tests/GuestPthreadGetname.cpp b/core/libs/tests/GuestPthreadGetname.cpp
index f8545f6078..fe3554d545 100644
--- a/core/libs/tests/GuestPthreadGetname.cpp
+++ b/core/libs/tests/GuestPthreadGetname.cpp
@@ -1,18 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdlib>
 #include <cstring>
 #include <string>
 
-extern "C" {
-Pthread APS5_VABI pthread_self_nid_postfix(void);
-int APS5_VABI pthread_rename_np_nid_postfix(Pthread thread, const char* name);
-int APS5_VABI pthread_getname_np_nid_postfix(Pthread thread, char* name);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-}
-
 static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_EFAULT = 14;
 
diff --git a/core/libs/tests/GuestPthreadJoinDetach.cpp b/core/libs/tests/GuestPthreadJoinDetach.cpp
index 48a982989e..20c8014765 100644
--- a/core/libs/tests/GuestPthreadJoinDetach.cpp
+++ b/core/libs/tests/GuestPthreadJoinDetach.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <atomic>
@@ -7,10 +8,6 @@
 #include <mutex>
 #include <thread>
 
-extern "C" int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" int APS5_VABI scePthreadDetach(Pthread thread);
-
 static constexpr int SCE_OK = 0;
 
 static void Require(bool condition, const char* message) {
diff --git a/core/libs/tests/GuestPthreadJoinSelf.cpp b/core/libs/tests/GuestPthreadJoinSelf.cpp
index 2fec26bef7..6277b58467 100644
--- a/core/libs/tests/GuestPthreadJoinSelf.cpp
+++ b/core/libs/tests/GuestPthreadJoinSelf.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -5,16 +7,7 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** retval);
-int APS5_VABI scePthreadDetach(Pthread thread);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EDEADLK = static_cast<int>(0x8002000Bu);
 static constexpr int GUEST_EDEADLK = 11;
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestPthreadKey.cpp b/core/libs/tests/GuestPthreadKey.cpp
index ae87651a61..bbe608bc54 100644
--- a/core/libs/tests/GuestPthreadKey.cpp
+++ b/core/libs/tests/GuestPthreadKey.cpp
@@ -1,21 +1,11 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadKeyCreate(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI scePthreadKeyDelete(PthreadKey key);
-void* APS5_VABI scePthreadGetspecific(PthreadKey key);
-int APS5_VABI scePthreadSetspecific(PthreadKey key, void* value);
-int APS5_VABI pthread_key_create_nid_postfix(PthreadKey* key, pthread_key_destructor_func_t destructor);
-int APS5_VABI pthread_key_delete_nid_postfix(PthreadKey key);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
diff --git a/core/libs/tests/GuestPthreadMutexErrors.cpp b/core/libs/tests/GuestPthreadMutexErrors.cpp
index da1083b121..ed2b0eb297 100644
--- a/core/libs/tests/GuestPthreadMutexErrors.cpp
+++ b/core/libs/tests/GuestPthreadMutexErrors.cpp
@@ -1,38 +1,13 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexattrSetprotocol(PthreadMutexattr* attr, int protocol);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexGetspinloops(PthreadMutex* mutex, int* count);
-int APS5_VABI scePthreadMutexSetspinloops(PthreadMutex* mutex, int count);
-int APS5_VABI scePthreadMutexGetyieldloops(PthreadMutex* mutex, int* count);
-int APS5_VABI scePthreadMutexSetyieldloops(PthreadMutex* mutex, int count);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_reltimedlock_np_nid_postfix(PthreadMutex* mutex, KernelUseconds usec);
-int APS5_VABI pthread_mutex_isowned_np_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_getspinloops_np_nid_postfix(PthreadMutex* mutex, int* count);
-int APS5_VABI pthread_mutex_setspinloops_np_nid_postfix(PthreadMutex* mutex, int count);
-int APS5_VABI pthread_mutex_getyieldloops_np_nid_postfix(PthreadMutex* mutex, int* count);
-int APS5_VABI pthread_mutex_setyieldloops_np_nid_postfix(PthreadMutex* mutex, int count);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010u);
 
 static constexpr int POSIX_EDEADLK = 11;
 static constexpr int POSIX_EINVAL = 22;
diff --git a/core/libs/tests/GuestPthreadMutexattr.cpp b/core/libs/tests/GuestPthreadMutexattr.cpp
index 48dd291a5b..58774211dd 100644
--- a/core/libs/tests/GuestPthreadMutexattr.cpp
+++ b/core/libs/tests/GuestPthreadMutexattr.cpp
@@ -1,35 +1,19 @@
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI pthread_mutexattr_init_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_destroy_nid_postfix(PthreadMutexattr* attr);
-int APS5_VABI pthread_mutexattr_getpshared_nid_postfix(const PthreadMutexattr* attr, int* pshared);
-int APS5_VABI pthread_mutexattr_setpshared_nid_postfix(PthreadMutexattr* attr, int pshared);
-int APS5_VABI pthread_mutexattr_setprotocol_nid_postfix(PthreadMutexattr* attr, int protocol);
-int APS5_VABI pthread_mutexattr_getprotocol_nid_postfix(const PthreadMutexattr* attr, int* protocol);
-int APS5_VABI pthread_mutexattr_setprioceiling_nid_postfix(PthreadMutexattr* attr, int prioceiling);
-int APS5_VABI pthread_mutexattr_getprioceiling_nid_postfix(const PthreadMutexattr* attr, int* prioceiling);
-int APS5_VABI pthread_mutexattr_settype_nid_postfix(PthreadMutexattr* attr, int type);
-int APS5_VABI pthread_mutexattr_gettype_nid_postfix(const PthreadMutexattr* attr, int* type);
-int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_timedlock_nid_postfix(PthreadMutex* mutex, const KernelTimespec* abstime);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-}
-
 static constexpr int GUEST_EINVAL = 22;
+static constexpr int SCE_OK = 0;
+static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
 static constexpr int PRIO_NONE = 0;
 static constexpr int PRIO_INHERIT = 1;
 static constexpr int PRIO_PROTECT = 2;
-static constexpr int SCHED_RR = 3;
+static constexpr int GuestSched_Rr = 3;
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -80,6 +64,78 @@ static void CheckType() {
     Require(pthread_mutexattr_gettype_nid_postfix(nullptr, &type) == GUEST_EINVAL && type == -1);
 }
 
+static void CheckKind() {
+    PthreadMutexattr attr = nullptr;
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_getkind_np_nid_postfix(nullptr) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_setkind_np_nid_postfix(nullptr, 2) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_setkind_np_nid_postfix(&attr, 2) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+    Require(pthread_mutexattr_init_nid_postfix(&attr) == 0);
+    Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == 1);
+    int type = -1;
+    for (const int kind : {2, 3, 4, 1}) {
+        Require(pthread_mutexattr_setkind_np_nid_postfix(&attr, kind) == 0);
+        Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == kind);
+        Require(pthread_mutexattr_gettype_nid_postfix(&attr, &type) == 0 && type == kind);
+    }
+    Require(pthread_mutexattr_settype_nid_postfix(&attr, 2) == 0);
+    Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == 2);
+    for (const int invalid : {0, 5, -1})
+        Require(Throws([&] { pthread_mutexattr_setkind_np_nid_postfix(&attr, invalid); }));
+    Require(pthread_mutexattr_getkind_np_nid_postfix(attr) == 2);
+    PthreadMutex mutex = nullptr;
+    Require(pthread_mutex_init_nid_postfix(&mutex, &attr) == 0);
+    Require(pthread_mutex_lock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_lock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_unlock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_unlock_nid_postfix(&mutex) == 0);
+    Require(pthread_mutex_destroy_nid_postfix(&mutex) == 0);
+    Require(pthread_mutexattr_destroy_nid_postfix(&attr) == 0);
+    *__error_nid_postfix() = 0;
+    Require(pthread_mutexattr_setkind_np_nid_postfix(&attr, 2) == -1 && *__error_nid_postfix() == GUEST_EINVAL);
+}
+
+static void CheckSceAccessors() {
+    PthreadMutexattr attr = nullptr;
+    int value = -1;
+    Require(scePthreadMutexattrGettype(nullptr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetprotocol(&attr, PRIO_NONE) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetprioceiling(&attr, 300) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetpshared(nullptr, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetpshared(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(value == -1);
+    Require(scePthreadMutexattrInit(&attr) == SCE_OK);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_OK && value == 1);
+    Require(scePthreadMutexattrSettype(&attr, 3) == SCE_OK);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_OK && value == 3);
+    Require(Throws([&] { scePthreadMutexattrGettype(&attr, nullptr); }));
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_OK && value == PRIO_NONE);
+    for (const int invalid : {-1, 3})
+        Require(scePthreadMutexattrSetprotocol(&attr, invalid) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_OK && value == PRIO_NONE);
+    Require(scePthreadMutexattrSetprotocol(&attr, PRIO_INHERIT) == SCE_OK);
+    Require(scePthreadMutexattrGetprotocol(&attr, &value) == SCE_OK && value == PRIO_INHERIT);
+    Require(scePthreadMutexattrSetprioceiling(&attr, 300) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetprotocol(&attr, PRIO_PROTECT) == SCE_OK);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_OK && value == sched_get_priority_max_nid_postfix(GuestSched_Rr));
+    Require(scePthreadMutexattrSetprioceiling(&attr, 300) == SCE_OK);
+    Require(scePthreadMutexattrGetprioceiling(&attr, &value) == SCE_OK && value == 300);
+    int protocol = -1;
+    Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_PROTECT);
+    Require(scePthreadMutexattrGetpshared(&attr, &value) == SCE_OK && value == 0);
+    Require(scePthreadMutexattrSetpshared(&attr, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadMutexattrSetpshared(&attr, 0) == SCE_OK);
+    Require(scePthreadMutexattrGetpshared(&attr, &value) == SCE_OK && value == 0);
+    Require(scePthreadMutexattrDestroy(&attr) == SCE_OK);
+    Require(scePthreadMutexattrGettype(&attr, &value) == SCE_KERNEL_ERROR_EINVAL);
+}
+
 static void CheckProcessSharing() {
     PthreadMutexattr attr = nullptr;
     int sharing = -1;
@@ -127,6 +183,8 @@ static void CheckInvalidPriorityAttribute(PthreadMutexattr* attr) {
 
 int main() {
     CheckType();
+    CheckKind();
+    CheckSceAccessors();
     CheckProcessSharing();
     CheckTimedlockInvalidDeadline();
     PthreadMutexattr attr = nullptr;
@@ -143,7 +201,7 @@ int main() {
     Require(pthread_mutexattr_setprioceiling_nid_postfix(&attr, 300) == GUEST_EINVAL);
     Require(pthread_mutexattr_setprotocol_nid_postfix(&attr, PRIO_PROTECT) == 0);
     Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_PROTECT);
-    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(SCHED_RR));
+    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(GuestSched_Rr));
     Require(pthread_mutexattr_setprioceiling_nid_postfix(&attr, 300) == 0);
     Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == 300);
     PthreadMutex mutex = nullptr;
@@ -153,7 +211,7 @@ int main() {
     Require(pthread_mutex_destroy_nid_postfix(&mutex) == 0);
     Require(pthread_mutexattr_setprotocol_nid_postfix(&attr, PRIO_PROTECT) == 0);
     Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_PROTECT);
-    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(SCHED_RR));
+    Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == 0 && ceiling == sched_get_priority_max_nid_postfix(GuestSched_Rr));
     Require(pthread_mutexattr_setprotocol_nid_postfix(&attr, PRIO_NONE) == 0);
     Require(pthread_mutexattr_getprotocol_nid_postfix(&attr, &protocol) == 0 && protocol == PRIO_NONE);
     Require(pthread_mutexattr_getprioceiling_nid_postfix(&attr, &ceiling) == GUEST_EINVAL);
diff --git a/core/libs/tests/GuestPthreadRename.cpp b/core/libs/tests/GuestPthreadRename.cpp
index e3fdbd18b1..ccfa5ced39 100644
--- a/core/libs/tests/GuestPthreadRename.cpp
+++ b/core/libs/tests/GuestPthreadRename.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <cstdio>
@@ -5,15 +7,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI pthread_rename_np_nid_postfix(Pthread thread, const char* name);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckStoredName(Pthread thread, const std::string& expected) {
diff --git a/core/libs/tests/GuestPthreadRwlock.cpp b/core/libs/tests/GuestPthreadRwlock.cpp
index b7f54df37e..937edc4b09 100644
--- a/core/libs/tests/GuestPthreadRwlock.cpp
+++ b/core/libs/tests/GuestPthreadRwlock.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -6,35 +10,9 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_init_nid_postfix(PthreadRwlock* rwlock, const PthreadRwlockattr* attr);
-int APS5_VABI pthread_rwlockattr_init_nid_postfix(PthreadRwlockattr* attr);
-int APS5_VABI pthread_rwlockattr_destroy_nid_postfix(PthreadRwlockattr* attr);
-int APS5_VABI pthread_rwlockattr_getpshared_nid_postfix(const PthreadRwlockattr* attr, int* pshared);
-int APS5_VABI pthread_rwlockattr_setpshared_nid_postfix(PthreadRwlockattr* attr, int pshared);
-int APS5_VABI pthread_rwlock_rdlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_unlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_tryrdlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_trywrlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_timedrdlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI scePthreadRwlockInit(PthreadRwlock* rwlock, const PthreadRwlockattr* attr, const char* name);
-int APS5_VABI scePthreadRwlockDestroy(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockRdlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockWrlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockTryrdlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockUnlock(PthreadRwlock* rwlock);
-}
-
 using TimedLock = int (APS5_VABI *)(PthreadRwlock*, const KernelTimespec*);
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
 static constexpr int GUEST_EPERM = 1;
 static constexpr int GUEST_EDEADLK = 11;
 static constexpr int GUEST_EBUSY = 16;
@@ -312,6 +290,52 @@ static void CheckWaitingWriterHoldsBackNewReaders() {
     Require(pthread_rwlock_destroy_nid_postfix(&recursive) == 0);
 }
 
+using RelativeLock = int (APS5_VABI *)(PthreadRwlock*, KernelUseconds);
+
+static void ExpectRelativeTimeout(RelativeLock lock, PthreadRwlock* rwlock) {
+    const auto start = std::chrono::steady_clock::now();
+    Require(lock(rwlock, 20000) == GUEST_ETIMEDOUT);
+    Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(15));
+    Require(lock(rwlock, 0) == GUEST_ETIMEDOUT);
+}
+
+static void CheckRelativeTimeouts() {
+    PthreadRwlock fresh[2] = {};
+    Require(pthread_rwlock_reltimedrdlock_np_nid_postfix(&fresh[0], 0) == 0);
+    Require(pthread_rwlock_reltimedwrlock_np_nid_postfix(&fresh[1], 0) == 0);
+    for (auto& lock : fresh) {
+        Require(lock != nullptr && lock != DestroyedRwlock);
+        Require(pthread_rwlock_unlock_nid_postfix(&lock) == 0);
+        Require(pthread_rwlock_destroy_nid_postfix(&lock) == 0);
+        Require(pthread_rwlock_reltimedrdlock_np_nid_postfix(&lock, 0) == GUEST_EINVAL);
+        Require(pthread_rwlock_reltimedwrlock_np_nid_postfix(&lock, 0) == GUEST_EINVAL);
+    }
+
+    PthreadRwlock rwlock = nullptr;
+    Require(pthread_rwlock_reltimedwrlock_np_nid_postfix(&rwlock, 5000000) == 0);
+    Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
+
+    Holder reader{&rwlock, false};
+    Start(reader);
+    Require(pthread_rwlock_reltimedrdlock_np_nid_postfix(&rwlock, 0) == 0);
+    Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
+    ExpectRelativeTimeout(pthread_rwlock_reltimedwrlock_np_nid_postfix, &rwlock);
+    reader.release.store(true);
+    Require(pthread_rwlock_reltimedwrlock_np_nid_postfix(&rwlock, 5000000) == 0);
+    Require(scePthreadJoin(reader.thread, nullptr) == SCE_OK);
+    Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
+
+    Holder writer{&rwlock, true};
+    Start(writer);
+    ExpectRelativeTimeout(pthread_rwlock_reltimedrdlock_np_nid_postfix, &rwlock);
+    ExpectRelativeTimeout(pthread_rwlock_reltimedwrlock_np_nid_postfix, &rwlock);
+    writer.release.store(true);
+    Require(pthread_rwlock_reltimedrdlock_np_nid_postfix(&rwlock, 5000000) == 0);
+    Require(scePthreadJoin(writer.thread, nullptr) == SCE_OK);
+    Require(pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
+    Require(pthread_rwlock_destroy_nid_postfix(&rwlock) == 0);
+}
+
 template <typename Call>
 static bool Throws(Call call) {
     try {
@@ -349,11 +373,53 @@ static void CheckAttrProcessSharing() {
     Require(pthread_rwlockattr_destroy_nid_postfix(&attr) == 0);
 }
 
+static void CheckAttrSettype() {
+    PthreadRwlockattr attr = nullptr;
+    Require(pthread_rwlockattr_init_nid_postfix(&attr) == 0);
+    for (const int type : {1, 2}) {
+        Require(scePthreadRwlockattrSettype(&attr, type) == SCE_OK);
+        PthreadRwlock rwlock = nullptr;
+        Require(pthread_rwlock_init_nid_postfix(&rwlock, &attr) == 0);
+        Require(pthread_rwlock_wrlock_nid_postfix(&rwlock) == 0 && pthread_rwlock_unlock_nid_postfix(&rwlock) == 0);
+        Require(pthread_rwlock_destroy_nid_postfix(&rwlock) == 0);
+    }
+    for (const int type : {0, 3, -1, static_cast<int>(0x80000000u)}) Require(scePthreadRwlockattrSettype(&attr, type) == SCE_KERNEL_ERROR_EINVAL);
+    Require(pthread_rwlockattr_destroy_nid_postfix(&attr) == 0);
+    Require(scePthreadRwlockattrSettype(&attr, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadRwlockattrSettype(nullptr, 1) == SCE_KERNEL_ERROR_EINVAL);
+}
+
+static void CheckAttrType() {
+    PthreadRwlockattr attr = nullptr;
+    Require(pthread_rwlockattr_init_nid_postfix(&attr) == 0);
+    int type = -1;
+    Require(pthread_rwlockattr_gettype_np_nid_postfix(&attr, &type) == 0 && type == 0);
+    Require(scePthreadRwlockattrGettype(&attr, &type) == SCE_OK && type == 0);
+    for (const int set : {1, 2}) {
+        Require(scePthreadRwlockattrSettype(&attr, set) == SCE_OK);
+        Require(pthread_rwlockattr_gettype_np_nid_postfix(&attr, &type) == 0 && type == set);
+        Require(scePthreadRwlockattrGettype(&attr, &type) == SCE_OK && type == set);
+    }
+    Require(Throws([&] { pthread_rwlockattr_gettype_np_nid_postfix(&attr, nullptr); }));
+    int pshared = -1;
+    Require(scePthreadRwlockattrGetpshared(&attr, &pshared) == SCE_OK && pshared == PROCESS_PRIVATE);
+    Require(scePthreadRwlockattrSetpshared(&attr, 1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadRwlockattrSetpshared(&attr, PROCESS_PRIVATE) == SCE_OK);
+    Require(pthread_rwlockattr_destroy_nid_postfix(&attr) == 0);
+    PthreadRwlockattr unset = nullptr;
+    Require(Throws([&] { pthread_rwlockattr_gettype_np_nid_postfix(nullptr, &type); }));
+    Require(Throws([&] { pthread_rwlockattr_gettype_np_nid_postfix(&unset, &type); }));
+    Require(Throws([&] { scePthreadRwlockattrGettype(&unset, &type); }));
+}
+
 int main() {
+    CheckAttrSettype();
     CheckAttrProcessSharing();
+    CheckAttrType();
     CheckWaitingWriterHoldsBackNewReaders();
     CheckConcurrentFirstWrlockExcludes();
     CheckDeadlinesBeyondTheClockRange();
+    CheckRelativeTimeouts();
     const KernelTimespec invalid{0, NANOS_PER_SECOND};
     PthreadRwlock fresh[4] = {};
     Require(pthread_rwlock_tryrdlock_nid_postfix(&fresh[0]) == 0);
diff --git a/core/libs/tests/GuestPthreadSchedparam.cpp b/core/libs/tests/GuestPthreadSchedparam.cpp
index 171d3fc5be..71d9ab1a58 100644
--- a/core/libs/tests/GuestPthreadSchedparam.cpp
+++ b/core/libs/tests/GuestPthreadSchedparam.cpp
@@ -1,33 +1,13 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <cstdint>
 #include <future>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI scePthreadGetschedparam(Pthread thread, int* policy, KernelSchedParam* param);
-int APS5_VABI scePthreadSetschedparam(Pthread thread, int policy, const KernelSchedParam* param);
-int APS5_VABI pthread_getschedparam_nid_postfix(Pthread thread, int* policy, KernelSchedParam* param);
-int APS5_VABI pthread_getprio_nid_postfix(Pthread thread);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI pthread_setschedparam_nid_postfix(Pthread thread, int policy, const KernelSchedParam* param);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI pthread_attr_get_np_nid_postfix(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetschedpolicy(const PthreadAttr* attr, int* policy);
-int APS5_VABI scePthreadAttrGetschedparam(const PthreadAttr* attr, KernelSchedParam* param);
-int APS5_VABI scePthreadAttrSetinheritsched(PthreadAttr* attr, int inheritSched);
-int APS5_VABI scePthreadAttrSetschedpolicy(PthreadAttr* attr, int policy);
-int APS5_VABI scePthreadAttrSetschedparam(PthreadAttr* attr, const KernelSchedParam* param);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_ESRCH = 3;
 static constexpr int GUEST_SCHED_FIFO = 1;
diff --git a/core/libs/tests/GuestPthreadSecondJoin.cpp b/core/libs/tests/GuestPthreadSecondJoin.cpp
index 4db4d57034..3bca2b8745 100644
--- a/core/libs/tests/GuestPthreadSecondJoin.cpp
+++ b/core/libs/tests/GuestPthreadSecondJoin.cpp
@@ -1,20 +1,14 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadDetach(Pthread thread);
-int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** retval);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003u);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
 static constexpr int GUEST_ESRCH = 3;
 static constexpr std::size_t REUSED_SLOT_ROUNDS = 64;
 
@@ -40,7 +34,7 @@ int main() {
     result = reinterpret_cast<void*>(std::uintptr_t{0x55});
     Require(scePthreadJoin(thread, &result) == SCE_KERNEL_ERROR_ESRCH);
     Require(result == reinterpret_cast<void*>(std::uintptr_t{0x55}));
-    Require(scePthreadDetach(thread) == SCE_KERNEL_ERROR_EINVAL);
+    Require(scePthreadDetach(thread) == SCE_KERNEL_ERROR_ESRCH);
     Require(pthread_join_nid_postfix(thread, &result) == GUEST_ESRCH);
     Require(result == reinterpret_cast<void*>(std::uintptr_t{0x55}));
 
@@ -62,4 +56,18 @@ int main() {
     Require(result == reinterpret_cast<void*>(std::uintptr_t{0x55}));
     Require(scePthreadDetach(detached) == SCE_KERNEL_ERROR_EINVAL);
     release = true;
+
+    Pthread named = nullptr;
+    char name[64] = {};
+    Require(scePthreadCreate(&named, nullptr, Finish, nullptr, "0123456789abcdefghijklmnopqrstu") == SCE_OK);
+    Require(scePthreadGetname(named, name) == SCE_OK && std::strcmp(name, "0123456789abcdefghijklmnopqrstu") == 0);
+    Require(scePthreadJoin(named, nullptr) == SCE_OK);
+    Pthread untouched = reinterpret_cast<Pthread>(std::uintptr_t{0x77});
+    Require(scePthreadCreate(&untouched, nullptr, Finish, nullptr, "0123456789abcdefghijklmnopqrstuv") == SCE_KERNEL_ERROR_ENAMETOOLONG);
+    Require(untouched == reinterpret_cast<Pthread>(std::uintptr_t{0x77}));
+    Pthread unnamed = nullptr;
+    std::memset(name, 'x', sizeof(name));
+    Require(scePthreadCreate(&unnamed, nullptr, Finish, nullptr, nullptr) == SCE_OK);
+    Require(scePthreadGetname(unnamed, name) == SCE_OK && name[0] == 0);
+    Require(scePthreadJoin(unnamed, nullptr) == SCE_OK);
 }
diff --git a/core/libs/tests/GuestPthreadSem.cpp b/core/libs/tests/GuestPthreadSem.cpp
index 574228ddf4..c2f4373538 100644
--- a/core/libs/tests/GuestPthreadSem.cpp
+++ b/core/libs/tests/GuestPthreadSem.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -7,23 +9,7 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadSemInit(PthreadSem* sem, int flag, unsigned int value, const char* name);
-int APS5_VABI scePthreadSemDestroy(PthreadSem* sem);
-int APS5_VABI scePthreadSemPost(PthreadSem* sem);
-int APS5_VABI scePthreadSemWait(PthreadSem* sem);
-int APS5_VABI scePthreadSemTrywait(PthreadSem* sem);
-int APS5_VABI scePthreadSemTimedwait(PthreadSem* sem, unsigned int usec);
-int APS5_VABI scePthreadSemGetvalue(PthreadSem* sem, int* value);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016u);
-static constexpr int SCE_KERNEL_ERROR_EOVERFLOW = static_cast<int>(0x80020054u);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
diff --git a/core/libs/tests/GuestPthreadSpin.cpp b/core/libs/tests/GuestPthreadSpin.cpp
index ca7e2b6926..2308710c88 100644
--- a/core/libs/tests/GuestPthreadSpin.cpp
+++ b/core/libs/tests/GuestPthreadSpin.cpp
@@ -1,25 +1,15 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdlib>
 #include <stdexcept>
 
-struct PthreadSpinlockPrivate;
 using PthreadSpinlock = PthreadSpinlockPrivate*;
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_spin_init_nid_postfix(PthreadSpinlock* lock, int pshared);
-int APS5_VABI pthread_spin_destroy_nid_postfix(PthreadSpinlock* lock);
-int APS5_VABI pthread_spin_lock_nid_postfix(PthreadSpinlock* lock);
-int APS5_VABI pthread_spin_trylock_nid_postfix(PthreadSpinlock* lock);
-int APS5_VABI pthread_spin_unlock_nid_postfix(PthreadSpinlock* lock);
-}
-
 static constexpr int GUEST_EPERM = 1;
 static constexpr int GUEST_EBUSY = 16;
 static constexpr int GUEST_EINVAL = 22;
-static constexpr int PTHREAD_PROCESS_PRIVATE = 0;
-static constexpr int PTHREAD_PROCESS_SHARED = 1;
+static constexpr int GuestPthread_Process_Private = 0;
+static constexpr int GuestPthread_Process_Shared = 1;
 static constexpr int Increments = 200000;
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -49,9 +39,9 @@ static void* APS5_VABI Incrementer(void* arg) {
 }
 
 static void ArgumentErrors() {
-    Require(pthread_spin_init_nid_postfix(nullptr, PTHREAD_PROCESS_PRIVATE) == GUEST_EINVAL);
+    Require(pthread_spin_init_nid_postfix(nullptr, GuestPthread_Process_Private) == GUEST_EINVAL);
     PthreadSpinlock lock = nullptr;
-    Require(pthread_spin_init_nid_postfix(&lock, PTHREAD_PROCESS_SHARED) == GUEST_EINVAL);
+    Require(pthread_spin_init_nid_postfix(&lock, GuestPthread_Process_Shared) == GUEST_EINVAL);
     Require(pthread_spin_init_nid_postfix(&lock, 2) == GUEST_EINVAL);
     Require(pthread_spin_init_nid_postfix(&lock, -1) == GUEST_EINVAL);
     Require(lock == nullptr);
@@ -75,6 +65,7 @@ static void SingleThread(int pshared) {
     bool threw = false;
     try {
         pthread_spin_lock_nid_postfix(&lock);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -90,7 +81,7 @@ static void SingleThread(int pshared) {
 
 static void HeldByAnotherThread() {
     Shared shared;
-    Require(pthread_spin_init_nid_postfix(&shared.lock, PTHREAD_PROCESS_PRIVATE) == 0);
+    Require(pthread_spin_init_nid_postfix(&shared.lock, GuestPthread_Process_Private) == 0);
     Require(pthread_spin_lock_nid_postfix(&shared.lock) == 0);
     Pthread thread = nullptr;
     Require(scePthreadCreate(&thread, nullptr, Contender, &shared, nullptr) == 0);
@@ -103,7 +94,7 @@ static void HeldByAnotherThread() {
 
 static void MutualExclusion() {
     Shared shared;
-    Require(pthread_spin_init_nid_postfix(&shared.lock, PTHREAD_PROCESS_PRIVATE) == 0);
+    Require(pthread_spin_init_nid_postfix(&shared.lock, GuestPthread_Process_Private) == 0);
     Pthread first = nullptr;
     Pthread second = nullptr;
     Require(scePthreadCreate(&first, nullptr, Incrementer, &shared, nullptr) == 0);
@@ -116,7 +107,7 @@ static void MutualExclusion() {
 
 int main() {
     ArgumentErrors();
-    SingleThread(PTHREAD_PROCESS_PRIVATE);
+    SingleThread(GuestPthread_Process_Private);
     HeldByAnotherThread();
     MutualExclusion();
 }
diff --git a/core/libs/tests/GuestPthreadStack.cpp b/core/libs/tests/GuestPthreadStack.cpp
index 5fcbe7ac52..d0e2472a70 100644
--- a/core/libs/tests/GuestPthreadStack.cpp
+++ b/core/libs/tests/GuestPthreadStack.cpp
@@ -1,11 +1,15 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #ifdef __linux__
 #include "prx/libc/include/GuestAllocations.hpp"
+#include <cerrno>
 #include <atomic>
 #include <cstdio>
 #include <chrono>
 #include <thread>
 #include <string>
+#include <vector>
+#include <sys/mman.h>
 #include <sys/syscall.h>
 #include <unistd.h>
 #endif
@@ -14,16 +18,9 @@
 #include <cstdlib>
 
 extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t stackSize);
-int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** stackAddress, std::size_t* stackSize);
-Pthread APS5_VABI scePthreadSelf();
+
 #ifdef __linux__
-int APS5_VABI scePthreadDetach(Pthread thread);
+
 #endif
 }
 
@@ -32,6 +29,20 @@ static constexpr std::size_t FRAME_SIZE = 4096;
 static constexpr std::size_t FRAME_MARGIN = 2 * FRAME_SIZE;
 static constexpr std::size_t HOST_CALL_STACK = 256 * 1024;
 static constexpr std::size_t STACK_SIZES[] = {16384, 65536, 1u << 20, 16u << 20};
+#ifdef __linux__
+static void* lastGuestStack = nullptr;
+static std::size_t lastGuestStackSize = 0;
+#endif
+
+#ifdef __linux__
+extern bool GuestThreadStackHostRangeOverlaps(std::uintptr_t start, std::uintptr_t end);
+static std::atomic<unsigned> observedUnmaps{0};
+
+static void ObserveUnmap(std::uintptr_t address, std::size_t bytes) {
+    if (GuestThreadStackHostRangeOverlaps(address, address + bytes)) std::abort();
+    observedUnmaps.fetch_add(1, std::memory_order_relaxed);
+}
+#endif
 
 thread_local unsigned char threadLocalBlock[512 * 1024];
 
@@ -61,6 +72,10 @@ static void* APS5_VABI Worker(void* arg) {
     void* address = nullptr;
     std::size_t size = 0;
     Require(scePthreadAttrGetstack(&attr, &address, &size) == SCE_OK);
+#ifdef __linux__
+    lastGuestStack = address;
+    lastGuestStackSize = size;
+#endif
     Require(scePthreadAttrDestroy(&attr) == SCE_OK);
     Require(size == requested);
 
@@ -78,33 +93,56 @@ static void* APS5_VABI Worker(void* arg) {
 }
 
 #ifdef __linux__
-bool GuestThreadStackHostRangeOverlaps(std::uintptr_t start, std::uintptr_t end);
-static std::atomic<unsigned> observedUnmaps{0};
-static std::atomic<std::uintptr_t> retiredStackWord{0};
-static std::atomic<bool> retiredUnmapped{false};
-static std::atomic<bool> detachedDone{false};
-static int detachedTid = 0;
+struct StackProbe {
+    std::size_t requested = 0;
+    std::uintptr_t stack = 0;
+    std::uintptr_t markerAddress = 0;
+    std::uintptr_t marker = 0;
+    std::atomic<bool> done{false};
+    int hostTid = 0;
+};
 
-static void* APS5_VABI DetachedWorker(void*) {
-    int local = 0;
-    detachedTid = static_cast<int>(syscall(SYS_gettid));
-    retiredStackWord.store(reinterpret_cast<std::uintptr_t>(&local), std::memory_order_relaxed);
-    detachedDone.store(true, std::memory_order_release);
+static void* APS5_VABI RetainedStackWorker(void* opaque) {
+    auto& probe = *static_cast<StackProbe*>(opaque);
+    PthreadAttr attr = nullptr;
+    Require(scePthreadAttrInit(&attr) == SCE_OK);
+    Require(scePthreadAttrGet(scePthreadSelf(), &attr) == SCE_OK);
+    void* address = nullptr;
+    std::size_t size = 0;
+    Require(scePthreadAttrGetstack(&attr, &address, &size) == SCE_OK);
+    Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+    Require(size == probe.requested);
+    probe.stack = reinterpret_cast<std::uintptr_t>(address);
+    probe.markerAddress = probe.stack + size - 4096;
+    *reinterpret_cast<std::uintptr_t*>(probe.markerAddress) = probe.marker;
+    Require(*reinterpret_cast<const std::uintptr_t*>(probe.markerAddress) == probe.marker);
+    probe.hostTid = static_cast<int>(syscall(SYS_gettid));
+    probe.done.store(true, std::memory_order_release);
     return nullptr;
 }
 
-static void* APS5_VABI ReaperWorker(void*) {
-    return nullptr;
-}
-
-static void ObserveUnmap(std::uintptr_t address, std::size_t bytes) {
-    if (GuestThreadStackHostRangeOverlaps(address, address + bytes)) {
-        std::fprintf(stderr, "Retired stack still owns host-only pages after unmap\n");
-        std::abort();
+static void WaitForProbe(StackProbe& probe) {
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
+    while (!probe.done.load(std::memory_order_acquire)) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
     }
-    observedUnmaps.fetch_add(1, std::memory_order_relaxed);
-    const auto retired = retiredStackWord.load(std::memory_order_relaxed);
-    if (retired >= address && retired - address < bytes) retiredUnmapped.store(true, std::memory_order_relaxed);
+    const auto task = "/proc/self/task/" + std::to_string(probe.hostTid);
+    while (access(task.c_str(), F_OK) == 0) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+}
+
+static void RequireCachedStackDiscarded(const StackProbe& probe) {
+    const auto range = GuestAllocations::GuestAllocationsLookup_nid_postfix(probe.markerAddress, false);
+    Require(range != nullptr && range->readable && range->writable);
+    Require(*reinterpret_cast<const std::uintptr_t*>(probe.markerAddress) == 0);
+}
+
+static bool ReusesOneOf(const StackProbe& probe, const StackProbe* previous, std::size_t count) {
+    for (std::size_t i = 0; i < count; ++i) if (probe.stack == previous[i].stack) return true;
+    return false;
 }
 #endif
 
@@ -122,26 +160,91 @@ int main() {
         void* result = nullptr;
         Require(scePthreadJoin(thread, &result) == SCE_OK);
         Require(result == &stackSize);
+#ifdef __linux__
+        if (stackSize == STACK_SIZES[sizeof(STACK_SIZES) / sizeof(STACK_SIZES[0]) - 1]) {
+            const auto pageSize = static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+            const auto stackAddress = reinterpret_cast<std::uintptr_t>(lastGuestStack);
+            const auto firstPageAddress = stackAddress - stackAddress % pageSize;
+            const auto leadingBytes = stackAddress - firstPageAddress;
+            const auto pageCount = (leadingBytes + lastGuestStackSize + pageSize - 1) / pageSize;
+            std::vector<unsigned char> residency(pageCount);
+            if (mincore(reinterpret_cast<void*>(firstPageAddress), pageCount * pageSize, residency.data()) == 0) {
+                for (std::size_t page = 0; page < pageCount; ++page)
+                    Require((residency[page] & 1u) == 0);
+            } else {
+                Require(errno == ENOMEM);
+            }
+        }
+#endif
     }
 #ifdef __linux__
-    Pthread detached = nullptr;
-    Require(scePthreadCreate(&detached, nullptr, DetachedWorker, nullptr, nullptr) == SCE_OK);
-    Require(scePthreadDetach(detached) == SCE_OK);
-    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(2);
-    while (!detachedDone.load(std::memory_order_acquire)) {
-        Require(std::chrono::steady_clock::now() < deadline);
-        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    constexpr std::size_t JoinedStackSize = 81920;
+    StackProbe joined[6];
+    for (std::size_t i = 0; i < 6; ++i) {
+        joined[i].requested = JoinedStackSize;
+        joined[i].marker = 0x77000000u + i;
+        PthreadAttr attr = nullptr;
+        Require(scePthreadAttrInit(&attr) == SCE_OK);
+        Require(scePthreadAttrSetstacksize(&attr, JoinedStackSize) == SCE_OK);
+        Pthread thread = nullptr;
+        Require(scePthreadCreate(&thread, &attr, RetainedStackWorker, &joined[i], nullptr) == SCE_OK);
+        Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+        Require(scePthreadJoin(thread, nullptr) == SCE_OK);
+        RequireCachedStackDiscarded(joined[i]);
     }
-    const auto task = "/proc/self/task/" + std::to_string(detachedTid);
-    while (access(task.c_str(), F_OK) == 0) {
-        Require(std::chrono::steady_clock::now() < deadline);
-        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    StackProbe joinedReuse;
+    joinedReuse.requested = JoinedStackSize;
+    joinedReuse.marker = 0x7700ffffu;
+    PthreadAttr joinedAttr = nullptr;
+    Require(scePthreadAttrInit(&joinedAttr) == SCE_OK);
+    Require(scePthreadAttrSetstacksize(&joinedAttr, JoinedStackSize) == SCE_OK);
+    Pthread joinedThread = nullptr;
+    Require(scePthreadCreate(&joinedThread, &joinedAttr, RetainedStackWorker, &joinedReuse, nullptr) == SCE_OK);
+    Require(scePthreadAttrDestroy(&joinedAttr) == SCE_OK);
+    Require(scePthreadJoin(joinedThread, nullptr) == SCE_OK);
+    Require(ReusesOneOf(joinedReuse, joined, 6));
+    RequireCachedStackDiscarded(joinedReuse);
+
+    constexpr std::size_t DetachedStackSize = 114688;
+    StackProbe detached[5];
+    for (std::size_t i = 0; i < 5; ++i) {
+        detached[i].requested = DetachedStackSize;
+        detached[i].marker = 0x77300000u + i;
+        PthreadAttr attr = nullptr;
+        Require(scePthreadAttrInit(&attr) == SCE_OK);
+        Require(scePthreadAttrSetstacksize(&attr, DetachedStackSize) == SCE_OK);
+        Pthread thread = nullptr;
+        Require(scePthreadCreate(&thread, &attr, RetainedStackWorker, &detached[i], nullptr) == SCE_OK);
+        Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+        Require(scePthreadDetach(thread) == SCE_OK);
+        WaitForProbe(detached[i]);
+    }
+    StackProbe detachedReuse;
+    detachedReuse.requested = DetachedStackSize;
+    detachedReuse.marker = 0x7730ffffu;
+    PthreadAttr detachedAttr = nullptr;
+    Require(scePthreadAttrInit(&detachedAttr) == SCE_OK);
+    Require(scePthreadAttrSetstacksize(&detachedAttr, DetachedStackSize) == SCE_OK);
+    Pthread detachedThread = nullptr;
+    Require(scePthreadCreate(&detachedThread, &detachedAttr, RetainedStackWorker, &detachedReuse, nullptr) == SCE_OK);
+    Require(scePthreadAttrDestroy(&detachedAttr) == SCE_OK);
+    Require(scePthreadJoin(detachedThread, nullptr) == SCE_OK);
+    for (const auto& probe : detached) RequireCachedStackDiscarded(probe);
+    Require(ReusesOneOf(detachedReuse, detached, 5));
+    RequireCachedStackDiscarded(detachedReuse);
+
+    for (std::size_t stackSize = 4u << 20; stackSize <= 20u << 20; stackSize += 1u << 20) {
+        PthreadAttr attr = nullptr;
+        Require(scePthreadAttrInit(&attr) == SCE_OK);
+        Require(scePthreadAttrSetstacksize(&attr, stackSize) == SCE_OK);
+        Pthread thread = nullptr;
+        Require(scePthreadCreate(&thread, &attr, Worker, &stackSize, nullptr) == SCE_OK);
+        Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+        void* result = nullptr;
+        Require(scePthreadJoin(thread, &result) == SCE_OK);
+        Require(result == &stackSize);
     }
-    Pthread reaper = nullptr;
-    Require(scePthreadCreate(&reaper, nullptr, ReaperWorker, nullptr, nullptr) == SCE_OK);
-    Require(scePthreadJoin(reaper, nullptr) == SCE_OK);
-    Require(retiredUnmapped.load(std::memory_order_relaxed));
-    GuestAllocations::GuestAllocationsSetUnmapObserver_nid_postfix(nullptr);
     Require(observedUnmaps.load(std::memory_order_relaxed) != 0);
+    GuestAllocations::GuestAllocationsSetUnmapObserver_nid_postfix(nullptr);
 #endif
 }
diff --git a/core/libs/tests/GuestPthreadTimedLocks.cpp b/core/libs/tests/GuestPthreadTimedLocks.cpp
index ae2a8187fa..601619c9cd 100644
--- a/core/libs/tests/GuestPthreadTimedLocks.cpp
+++ b/core/libs/tests/GuestPthreadTimedLocks.cpp
@@ -1,24 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_rwlock_wrlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_unlock_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_destroy_nid_postfix(PthreadRwlock* rwlock);
-int APS5_VABI pthread_rwlock_timedrdlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_rwlock_timedwrlock_nid_postfix(PthreadRwlock* rwlock, const KernelTimespec* abstime);
-int APS5_VABI pthread_mutex_init_nid_postfix(PthreadMutex* mutex, const PthreadMutexattr* attr);
-int APS5_VABI pthread_mutex_lock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_unlock_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_destroy_nid_postfix(PthreadMutex* mutex);
-int APS5_VABI pthread_mutex_timedlock_nid_postfix(PthreadMutex* mutex, const KernelTimespec* abstime);
-}
-
 static constexpr int SCE_OK = 0;
 static constexpr int GUEST_EDEADLK = 11;
 static constexpr auto HoldTime = std::chrono::milliseconds(50);
diff --git a/core/libs/tests/GuestQsort.cpp b/core/libs/tests/GuestQsort.cpp
index f27a089c63..00e7f72ef2 100644
--- a/core/libs/tests/GuestQsort.cpp
+++ b/core/libs/tests/GuestQsort.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -8,14 +9,6 @@
 #include <cstring>
 #include <vector>
 
-extern "C" {
-int APS5_VABI mergesort_nid_postfix(void*, std::size_t, std::size_t, int (APS5_VABI*)(const void*, const void*));
-int* APS5_VABI __error_nid_postfix();
-void APS5_VABI qsort_nid_postfix(void*, std::size_t, std::size_t, int (APS5_VABI*)(const void*, const void*));
-int APS5_VABI qsort_s_nid_postfix(void*, std::size_t, std::size_t, int (APS5_VABI*)(const void*, const void*, void*), void*);
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void*);
-}
-
 namespace {
 
 bool failAllocation = false;
@@ -156,6 +149,7 @@ bool ExpectOrder(const char* name, const std::vector<int>& keys, const std::vect
     std::vector<Element> elements;
     for (std::size_t index = 0; index < keys.size(); ++index) elements.push_back({keys[index], static_cast<int>(index)});
     qsort_nid_postfix(elements.data(), elements.size(), sizeof(Element), CompareKeys);
+
     for (std::size_t index = 0; index < tags.size(); ++index) {
         if (elements[index].tag != tags[index]) {
             std::fprintf(stderr, "%s: element %zu has tag %d, expected %d\n", name, index, elements[index].tag, tags[index]);
@@ -175,6 +169,7 @@ bool ExpectSorted(std::size_t size, std::size_t count) {
     std::vector<unsigned char> counts(256);
     for (std::size_t index = 0; index < count; ++index) ++counts[bytes[index * size]];
     qsort_nid_postfix(bytes.data(), count, size, CompareFirstByte);
+
     for (std::size_t index = 0; index < count; ++index) {
         if (index > 0 && bytes[(index - 1) * size] > bytes[index * size]) {
             std::fprintf(stderr, "qsort of %zu %zu-byte elements is not sorted at %zu\n", count, size, index);
@@ -191,7 +186,6 @@ bool ExpectSorted(std::size_t size, std::size_t count) {
     return true;
 }
 
-
 bool CheckMergesort() {
     InitializeHeap();
     bool correct = true;
diff --git a/core/libs/tests/GuestRaiseException.cpp b/core/libs/tests/GuestRaiseException.cpp
index fd74e36771..205e6e4c81 100644
--- a/core/libs/tests/GuestRaiseException.cpp
+++ b/core/libs/tests/GuestRaiseException.cpp
@@ -1,3 +1,8 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
+#include "prx/libkernel/Pthread/include/Rwlock.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -13,33 +18,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
-int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
-int APS5_VABI sceKernelRaiseException(Pthread thread, int signum);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt);
-int APS5_VABI sceKernelDeleteSema(KernelSema sem);
-int APS5_VABI sceKernelSignalSema(KernelSema sem, int count);
-int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexTimedlock(PthreadMutex* mutex, KernelUseconds usec);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadRwlockInit(PthreadRwlock* rwlock, const PthreadRwlockattr* attr, const char* name);
-int APS5_VABI scePthreadRwlockDestroy(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockWrlock(PthreadRwlock* rwlock);
-int APS5_VABI scePthreadRwlockUnlock(PthreadRwlock* rwlock);
-int APS5_VABI sceKernelSyncOnAddressWait(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWake(void* address, std::int32_t count);
-}
-
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_ESRCH = static_cast<int>(0x80020003);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003c);
 static constexpr int SIGUSR1 = 30;
 static constexpr int Repeats = 50;
 static constexpr std::size_t R12Offset = 0xa0;
@@ -404,7 +382,6 @@ static void NestedWaitKeepsOuterWake() {
     Require(sceKernelDeleteSema(sem) == 0);
 }
 
-#ifdef _WIN32
 static constexpr int AddressRounds = 50;
 static std::uint32_t addressWord = 0;
 static std::uint32_t otherAddressWord = 0;
@@ -483,7 +460,36 @@ static void HandlerLeavesAddressLock(PthreadEntry entry, const char* name) {
     worker.stop.store(true);
     Require(scePthreadJoin(thread, nullptr) == 0);
 }
-#endif
+
+static std::uint32_t idleWord = 0;
+
+static void* APS5_VABI AddressIdle(void* arg) {
+    auto& worker = *static_cast<Worker*>(arg);
+    worker.id = std::this_thread::get_id();
+    worker.started.store(true);
+    worker.waitResult = sceKernelSyncOnAddressWait(&idleWord, 0, nullptr, "address idle");
+    return nullptr;
+}
+
+static void HandlerRunsInUnboundedAddressWait() {
+    Worker worker;
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, nullptr, AddressIdle, &worker, "address idle") == 0);
+    while (!worker.started.load()) std::this_thread::yield();
+    std::this_thread::sleep_for(std::chrono::milliseconds(50));
+    holdingEntered.store(false);
+    holdingLeft.store(false);
+    holdingRelease.store(false);
+    Require(sceKernelRaiseException(thread, SIGUSR1) == 0);
+    RequireInRound(AwaitWithin(holdingEntered, std::chrono::seconds(5)), "address idle", 0, "the handler did not run while the thread waited without a timeout");
+    RequireInRound(holdingThread.load() == worker.id, "address idle", 0, "the handler ran on another thread");
+    holdingRelease.store(true);
+    RequireInRound(AwaitWithin(holdingLeft, std::chrono::seconds(5)), "address idle", 0, "the handler did not return within 5 s of its release");
+    std::atomic_ref<std::uint32_t>(idleWord).store(1);
+    Require(sceKernelSyncOnAddressWake(&idleWord, 1) >= 0);
+    Require(scePthreadJoin(thread, nullptr) == 0);
+    Require(worker.waitResult == 0);
+}
 
 static void ExpectDelivery(int before, std::thread::id thread) {
     for (int attempt = 0; attempt < 5000 && calls.load() == before; ++attempt) std::this_thread::sleep_for(std::chrono::milliseconds(1));
@@ -551,6 +557,7 @@ int main() {
     bool rejected = false;
     try {
         sceKernelRaiseException(scePthreadSelf(), SIGUSR1);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -659,6 +666,7 @@ int main() {
     bool refused = false;
     try {
         sceKernelRaiseException(loopingThread, SIGUSR1);
+
     } catch (const std::runtime_error&) {
         refused = true;
     }
@@ -745,10 +753,9 @@ int main() {
     NestedWaitKeepsOuterWake();
     Require(sceKernelRemoveExceptionHandler(SIGUSR1) == 0);
 
-#ifdef _WIN32
     Require(sceKernelInstallExceptionHandler(SIGUSR1, reinterpret_cast<void*>(&HoldingHandler)) == 0);
     HandlerLeavesAddressLock(AddressWaking, "address waking");
     HandlerLeavesAddressLock(AddressWaiting, "address waiting");
+    HandlerRunsInUnboundedAddressWait();
     Require(sceKernelRemoveExceptionHandler(SIGUSR1) == 0);
-#endif
 }
diff --git a/core/libs/tests/GuestRaiseInHostCode.cpp b/core/libs/tests/GuestRaiseInHostCode.cpp
index 0a41f83ca8..e89332fc4c 100644
--- a/core/libs/tests/GuestRaiseInHostCode.cpp
+++ b/core/libs/tests/GuestRaiseInHostCode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <atomic>
@@ -8,14 +9,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI sceKernelInstallExceptionHandler(int, void*);
-int APS5_VABI sceKernelRemoveExceptionHandler(int);
-int APS5_VABI sceKernelRaiseException(Pthread, int);
-}
-
 static constexpr int SigUsr1 = 30;
 static constexpr int Raises = 100;
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestRaiseInSystemCall.cpp b/core/libs/tests/GuestRaiseInSystemCall.cpp
index 834594d260..f1b75ad913 100644
--- a/core/libs/tests/GuestRaiseInSystemCall.cpp
+++ b/core/libs/tests/GuestRaiseInSystemCall.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -10,14 +11,6 @@
 #include <thread>
 #include <windows.h>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI sceKernelInstallExceptionHandler(int, void*);
-int APS5_VABI sceKernelRemoveExceptionHandler(int);
-int APS5_VABI sceKernelRaiseException(Pthread, int);
-}
-
 static constexpr int SigUsr1 = 30;
 static constexpr int Raises = 10;
 static constexpr DWORD PipeBytes = 4096;
diff --git a/core/libs/tests/GuestRaiseNestedSleep.cpp b/core/libs/tests/GuestRaiseNestedSleep.cpp
index 839f831ecf..b5e27b4f5a 100644
--- a/core/libs/tests/GuestRaiseNestedSleep.cpp
+++ b/core/libs/tests/GuestRaiseNestedSleep.cpp
@@ -1,18 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceKernelInstallExceptionHandler(int signum, void* handler);
-int APS5_VABI sceKernelRemoveExceptionHandler(int signum);
-int APS5_VABI sceKernelRaiseException(Pthread thread, int signum);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
-}
-
 static constexpr int SIGUSR1 = 30;
 static constexpr int SCE_OK = 0;
 static constexpr KernelUseconds OuterSleep = 1000000;
diff --git a/core/libs/tests/GuestRandom.cpp b/core/libs/tests/GuestRandom.cpp
index df1d5f83c9..9ac352658a 100644
--- a/core/libs/tests/GuestRandom.cpp
+++ b/core/libs/tests/GuestRandom.cpp
@@ -1,11 +1,9 @@
+#include "prx/libSceRandom/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceRandomGetRandomNumber(void*, std::size_t);
-}
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     constexpr int invalid = static_cast<int>(0x817C0016);
diff --git a/core/libs/tests/GuestRandomDeviceSeed.cpp b/core/libs/tests/GuestRandomDeviceSeed.cpp
new file mode 100644
index 0000000000..0f2ffde1ad
--- /dev/null
+++ b/core/libs/tests/GuestRandomDeviceSeed.cpp
@@ -0,0 +1,91 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/HostEntropy.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+
+static void* entropyBuffer;
+static std::size_t entropySize;
+static bool failEntropy;
+
+void HostEntropy_nid_no_patch(void* buffer, std::size_t size) {
+    entropyBuffer = buffer;
+    entropySize = size;
+    if (failEntropy) throw std::runtime_error("entropy unavailable");
+    auto* bytes = static_cast<unsigned char*>(buffer);
+    for (std::size_t i = 0; i < size; ++i) bytes[i] = static_cast<unsigned char>(i * 37 + 11);
+}
+
+static void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "%s\n", message);
+        std::abort();
+    }
+}
+
+static std::uint32_t Word(const char* buffer, std::size_t index) {
+    std::uint32_t value;
+    std::memcpy(&value, buffer + sizeof(value) * index, sizeof(value));
+    return value;
+}
+
+int main() {
+    constexpr std::array<std::size_t, 5> sizes {8, 32, 64, 128, 256};
+    constexpr std::array<std::size_t, 5> degrees {1, 7, 15, 31, 63};
+    constexpr std::array<std::size_t, 5> separations {0, 3, 1, 3, 1};
+    std::array<char, 272> state{};
+    for (std::size_t type = 0; type < sizes.size(); ++type) {
+        state.fill(static_cast<char>(0xa5));
+        char* table = state.data() + 1;
+        char* previous = initstate_nid_postfix(42, table, static_cast<std::int64_t>(sizes[type]));
+        for (int i = 0; i < 5; ++i) random_nid_postfix();
+        const std::uint32_t header = Word(table, 0);
+        srandomdev_nid_postfix();
+        Require(entropyBuffer == table + 4, "srandomdev fills the active state after its header");
+        Require(entropySize == degrees[type] * 4, "srandomdev fills every generator word");
+        Require(Word(table, 0) == header, "srandomdev leaves the saved header untouched");
+        for (std::size_t i = 0; i < entropySize; ++i)
+            Require(static_cast<unsigned char>(table[4 + i]) == static_cast<unsigned char>(i * 37 + 11),
+                "srandomdev neither derives words from one seed nor advances the generator");
+        Require(state[0] == static_cast<char>(0xa5) &&
+            std::all_of(state.begin() + 1 + sizes[type], state.end(), [](char c) { return c == static_cast<char>(0xa5); }),
+            "srandomdev preserves the buffer guards");
+        const auto seeded = state;
+        if (type != 0) {
+            const std::uint32_t sum = Word(table, 1) + Word(table, 1 + separations[type]);
+            Require(random_nid_postfix() == sum / 2, "srandomdev resets the front and rear positions");
+            Require(Word(table, 1 + separations[type]) == sum, "random advances the newly seeded table");
+        } else {
+            std::int64_t x = static_cast<std::int32_t>(Word(table, 1));
+            if (x == 0) x = 123459876;
+            x = 16807 * (x % 127773) - 2836 * (x / 127773);
+            if (x < 0) x += 0x7fffffff;
+            const auto expected = x;
+            Require(random_nid_postfix() == static_cast<std::int64_t>(expected), "the linear generator uses the entropy word");
+        }
+        setstate_nid_postfix(previous);
+        Require(Word(table, 0) == type + (type == 0 ? 0 : 5), "the reseeded state saves its new position");
+        state = seeded;
+        const std::uint32_t resetHeader = static_cast<std::uint32_t>(type);
+        std::memcpy(table, &resetHeader, sizeof(resetHeader));
+        setstate_nid_postfix(table);
+        const auto beforeFailure = state;
+        failEntropy = true;
+        bool threw = false;
+        try {
+            srandomdev_nid_postfix();
+        } catch (const std::runtime_error&) {
+            threw = true;
+        }
+        failEntropy = false;
+        Require(threw, "srandomdev propagates entropy failures");
+        Require(state == beforeFailure, "an entropy failure before writing keeps the state");
+        setstate_nid_postfix(previous);
+    }
+}
diff --git a/core/libs/tests/GuestRandomState.cpp b/core/libs/tests/GuestRandomState.cpp
index 71511241be..a660db24f8 100644
--- a/core/libs/tests/GuestRandomState.cpp
+++ b/core/libs/tests/GuestRandomState.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -10,23 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-std::int64_t APS5_VABI random_nid_postfix();
-void APS5_VABI srandom_nid_postfix(std::uint64_t);
-char* APS5_VABI initstate_nid_postfix(std::uint64_t, char*, std::int64_t);
-char* APS5_VABI setstate_nid_postfix(char*);
-int* APS5_VABI __error_nid_postfix();
-double APS5_VABI erand48_nid_postfix(std::uint16_t*);
-std::int64_t APS5_VABI nrand48_nid_postfix(std::uint16_t*);
-std::int64_t APS5_VABI jrand48_nid_postfix(std::uint16_t*);
-double APS5_VABI drand48_nid_postfix();
-std::int64_t APS5_VABI lrand48_nid_postfix();
-std::int64_t APS5_VABI mrand48_nid_postfix();
-void APS5_VABI srand48_nid_postfix(std::int64_t);
-std::uint16_t* APS5_VABI seed48_nid_postfix(const std::uint16_t*);
-void APS5_VABI lcong48_nid_postfix(const std::uint16_t*);
-}
-
 static int failures = 0;
 
 static void Require(bool condition, const char* message) {
@@ -78,6 +62,7 @@ static void CheckRand48() {
 
     const std::uint16_t parameters[7] = {1, 0, 0, 3, 0, 0, 5};
     lcong48_nid_postfix(parameters);
+
     Require(lrand48_nid_postfix() == 0 && mrand48_nid_postfix() == 0, "lcong48 sets seed, multiplier and addend");
     std::uint16_t high[3] = {0, 0, 1};
     Require(jrand48_nid_postfix(high) == 196608 && SeedIs(high, 5, 0, 3), "lcong48 multiplier scales the seed");
@@ -90,6 +75,7 @@ static void CheckRand48() {
     Require(drand48_nid_postfix() == erand48_nid_postfix(again), "seed48 restores the default multiplier and addend");
     lcong48_nid_postfix(parameters);
     srand48_nid_postfix(0x1234abcd);
+
     std::uint16_t reset[3] = {0x330e, 0xabcd, 0x1234};
     Require(lrand48_nid_postfix() == nrand48_nid_postfix(reset), "srand48 restores the default multiplier and addend");
 
@@ -101,6 +87,7 @@ static void CheckRand48() {
     Require(jrand48_nid_postfix(ones) == 4294582547, "jrand48 matches the console for an all-ones seed");
     constexpr std::array<std::int64_t, 6> consoleMrand48 {178800969, 1952030186, 3585512650, 1443049011, 2428758494, 7588830};
     srand48_nid_postfix(1);
+
     for (const std::int64_t expected : consoleMrand48) Require(mrand48_nid_postfix() == expected, "mrand48 matches the console after srand48(1)");
 
 #ifndef _WIN32
@@ -113,6 +100,7 @@ static void CheckRand48() {
     }
     ::srand48(1234567);
     srand48_nid_postfix(1234567);
+
     for (int round = 0; round < 32; ++round) {
         Require(drand48_nid_postfix() == ::drand48(), "drand48 matches the host");
         Require(lrand48_nid_postfix() == ::lrand48(), "lrand48 matches the host");
@@ -123,23 +111,26 @@ static void CheckRand48() {
 
 int main() {
     CheckRand48();
-    constexpr Sequence seedOne {1408992891, 1638182910, 83848093, 145962118, 627851256};
-    constexpr Sequence seed12345 {1052984060, 1639322404, 1971525204, 2097956667, 2012147915};
+    constexpr Sequence seedOne {1804289383, 846930886, 1681692777, 1714636915, 1957747793};
+    constexpr Sequence seed12345 {383100999, 858300821, 357768173, 455528251, 133005921};
     constexpr std::array<Sequence, 5> seed42ByType {{
-        {2060028338, 1164936638, 481681973, 1763071474, 962919018},
-        {660273387, 1356916325, 287587791, 1132382070, 1497594867},
-        {1015209508, 12952757, 1418769128, 2005808989, 1212998434},
-        {745791173, 418148062, 949332769, 1480536337, 177711995},
-        {996638292, 1209745284, 1148231710, 400392963, 1149215164},
+        {413993338, 139015486, 2118548913, 1172713531, 191403351},
+        {769798547, 2024571666, 1204852799, 931293870, 1762463907},
+        {2051258974, 339992574, 1379825892, 1298392284, 825292997},
+        {71876166, 708592740, 1483128881, 907283241, 442951012},
+        {472624893, 994493761, 100792968, 176611971, 1804504504},
     }};
-    constexpr std::array<std::int64_t, 6> seed7Type1 {1271472800, 27686551, 1252069488, 1609001632, 28873941, 508017694};
+    constexpr std::array<std::int64_t, 6> seed7Type1 {1380991591, 1769076016, 21842418, 334161865, 1367472909, 1249858043};
 
     Require(Draw() == seedOne, "unseeded random must match srandom(1)");
     srandom_nid_postfix(1);
+
     Require(Draw() == seedOne, "srandom(1) sequence");
     srandom_nid_postfix(0x100000001ull);
+
     Require(Draw() == seedOne, "srandom must use the low 32 bits of the seed");
     srandom_nid_postfix(12345);
+
     Require(Draw() == seed12345, "srandom(12345) sequence");
 
     struct SizeCase {
@@ -167,14 +158,16 @@ int main() {
     }
     Require(defaultTable != nullptr && Word(defaultTable, 0) == 5 * 5 + 3, "default table must hold its rear position");
     Require(setstate_nid_postfix(defaultTable) == active, "setstate must return the previous state");
-    Require(random_nid_postfix() == 1533042628 && random_nid_postfix() == 1225903521,
+    Require(random_nid_postfix() == 116285904 && random_nid_postfix() == 591987137,
         "setstate on the default table must continue the srandom(12345) sequence");
 
     alignas(4) std::array<char, 32> small{};
     alignas(4) std::array<char, 64> large{};
     initstate_nid_postfix(7, small.data(), static_cast<std::int64_t>(small.size()));
+
     for (std::size_t i = 0; i < 3; ++i) Require(random_nid_postfix() == seed7Type1[i], "initstate(7) on 32 bytes");
     initstate_nid_postfix(7, large.data(), static_cast<std::int64_t>(large.size()));
+
     Require(setstate_nid_postfix(small.data()) == large.data(), "setstate must return the 64-byte state");
     Require(setstate_nid_postfix(large.data()) == small.data(), "setstate must return the 32-byte state");
     Require(Word(small.data(), 0) == 5 * 3 + 1, "setstate must save the rear position of the old state");
@@ -203,6 +196,7 @@ int main() {
     bool threw = false;
     try {
         initstate_nid_postfix(1, nullptr, 128);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -210,6 +204,7 @@ int main() {
     threw = false;
     try {
         setstate_nid_postfix(nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -218,9 +213,11 @@ int main() {
     constexpr std::size_t threadCount = 4;
     constexpr std::size_t callsPerThread = 2000;
     srandom_nid_postfix(99);
+
     std::vector<std::int64_t> serial(threadCount * callsPerThread);
     for (auto& value : serial) value = random_nid_postfix();
     srandom_nid_postfix(99);
+
     std::vector<std::int64_t> concurrent(threadCount * callsPerThread);
     std::vector<std::thread> threads;
     for (std::size_t t = 0; t < threadCount; ++t)
@@ -232,5 +229,25 @@ int main() {
     std::sort(concurrent.begin(), concurrent.end());
     Require(serial == concurrent, "concurrent calls must draw the serial sequence");
 
+    for (const std::int64_t size : {8, 32, 64, 128, 256}) {
+        std::array<char, 256> entropyState{};
+        char* previous = initstate_nid_postfix(42, entropyState.data(), size);
+        srandomdev_nid_postfix();
+        const std::size_t separation = size == 32 || size == 128 ? 3 : 1;
+        std::int64_t expected;
+        if (size == 8) {
+            std::int64_t x = static_cast<std::int32_t>(Word(entropyState.data(), 1));
+            if (x == 0) x = 123459876;
+            x = 16807 * (x % 127773) - 2836 * (x / 127773);
+            if (x < 0) x += 0x7fffffff;
+            expected = x;
+        } else {
+            const std::uint32_t sum = Word(entropyState.data(), 1) + Word(entropyState.data(), 1 + separation);
+            expected = sum >> 1;
+        }
+        Require(random_nid_postfix() == expected, "srandomdev seeds the shared library's active state from host entropy");
+        setstate_nid_postfix(previous);
+    }
+
     return failures == 0 ? 0 : 1;
 }
diff --git a/core/libs/tests/GuestRazorCpu.cpp b/core/libs/tests/GuestRazorCpu.cpp
index 69f35dbfa0..f938b7a80b 100644
--- a/core/libs/tests/GuestRazorCpu.cpp
+++ b/core/libs/tests/GuestRazorCpu.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRazorCpu/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,31 +6,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-std::uint32_t APS5_VABI sceRazorCpuIsCapturing(void);
-int APS5_VABI sceRazorCpuJobManagerDispatch(const char* label, std::uint16_t firstId, std::uint16_t secondId, std::uint16_t firstCount, std::uint16_t secondCount, std::uint64_t firstValue, std::uint64_t secondValue);
-int APS5_VABI sceRazorCpuJobManagerJob(std::uint16_t firstId, std::uint16_t secondId, std::uint16_t thirdId, std::uint16_t event);
-int APS5_VABI sceRazorCpuJobManagerSequence(const char* label, std::uint16_t firstId, std::uint16_t secondId, std::uint16_t event);
-int APS5_VABI sceRazorCpuPushMarker(const char* label, std::uint32_t color, std::uint32_t flags);
-int APS5_VABI sceRazorCpuNamedSync(const char* label);
-int APS5_VABI sceRazorCpuPushMarkerStatic(const char* name, std::uint32_t color, std::uint32_t flags);
-int APS5_VABI sceRazorCpuPopMarker(void);
-bool APS5_VABI sceRazorCpuFlushOccurred(std::uint64_t* timeSpentInFlush);
-int APS5_VABI sceRazorCpuPlotValue(const char* series, float value);
-int APS5_VABI sceRazorCpuWriteBookmark(const char* label, const char* description);
-int APS5_VABI sceRazorCpuSync(void);
-void APS5_VABI sceRazorCpuDisableFiberUserMarkers(void);
-int APS5_VABI sceRazorCpuInitDataTags(void* buffer, std::size_t size);
-int APS5_VABI sceRazorCpuShutdownDataTags(void);
-std::size_t APS5_VABI sceRazorCpuGetDataTagStorageSize(std::uint32_t tagCount);
-int APS5_VABI sceRazorCpuTagArray(const char* label, std::uint32_t category, void* array, std::size_t bufferSize, std::size_t elementSize);
-int APS5_VABI sceRazorCpuTagBuffer(const char* label, std::uint32_t category, void* buffer, std::size_t bufferSize);
-int APS5_VABI sceRazorCpuResizeTaggedBuffer(std::uint32_t category, void* buffer, std::size_t newBufferSize);
-int APS5_VABI sceRazorCpuUnTagBuffer(std::uint32_t category, void* buffer);
-int APS5_VABI sceRazorCpuBeginLogicalFileAccess(const char* filename, std::uint64_t tag, std::uint64_t size, std::uint8_t operation);
-int APS5_VABI sceRazorCpuEndLogicalFileAccess(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -91,6 +67,7 @@ int main() {
     bool threw = false;
     try {
         sceRazorCpuGetDataTagStorageSize(16);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestReallocalign.cpp b/core/libs/tests/GuestReallocalign.cpp
index fded34f311..ff924916d5 100644
--- a/core/libs/tests/GuestReallocalign.cpp
+++ b/core/libs/tests/GuestReallocalign.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -5,11 +6,6 @@
 #include <limits>
 #include <stdexcept>
 
-extern "C" {
-void* APS5_VABI reallocalign_nid_postfix(void*, std::size_t, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value) {
@@ -30,12 +26,28 @@ int main() {
     auto* shrunk = static_cast<unsigned char*>(reallocalign_nid_postfix(grown, 16, 16));
     Require(shrunk != nullptr && (reinterpret_cast<std::uintptr_t>(shrunk) % 16) == 0);
     for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
-    *__error_nid_postfix() = 0;
-    Require(reallocalign_nid_postfix(shrunk, 16, 0) == nullptr && *__error_nid_postfix() == 22);
-    *__error_nid_postfix() = 0;
-    Require(reallocalign_nid_postfix(shrunk, 16, 3) == nullptr && *__error_nid_postfix() == 22);
-    *__error_nid_postfix() = 0;
-    Require(reallocalign_nid_postfix(shrunk, std::numeric_limits<std::size_t>::max(), 16) == nullptr && *__error_nid_postfix() == 12);
+    shrunk = static_cast<unsigned char*>(reallocalign_nid_postfix(shrunk, 16, 0));
+    Require(shrunk != nullptr && (reinterpret_cast<std::uintptr_t>(shrunk) % 32) == 0);
     for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
-    Require(reallocalign_nid_postfix(shrunk, 0, 16) == nullptr);
+    shrunk = static_cast<unsigned char*>(reallocalign_nid_postfix(shrunk, 40, 100));
+    Require(shrunk != nullptr && (reinterpret_cast<std::uintptr_t>(shrunk) % 128) == 0);
+    for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
+    constexpr std::size_t max = std::numeric_limits<std::size_t>::max();
+    *__error_nid_postfix() = 77;
+    Require(reallocalign_nid_postfix(shrunk, max, 16) == nullptr && *__error_nid_postfix() == 77);
+    Require(reallocalign_nid_postfix(shrunk, max - 0x1008f, 16) == nullptr && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 77;
+    Require(reallocalign_nid_postfix(shrunk, max - 0x110ae, 4096) == nullptr && *__error_nid_postfix() == 77);
+    Require(reallocalign_nid_postfix(shrunk, max - 0x110af, 4096) == nullptr && *__error_nid_postfix() == 22);
+    *__error_nid_postfix() = 77;
+    Require(reallocalign_nid_postfix(shrunk, 16, std::size_t{1} << 63) == nullptr && *__error_nid_postfix() == 77);
+    for (int index = 0; index < 16; ++index) Require(shrunk[index] == 0x5a);
+    Require(reallocalign_nid_postfix(shrunk, 0, 16) == shrunk && malloc_usable_size_nid_postfix(shrunk) == 0);
+    free_nid_postfix(shrunk);
+
+    void* empty = reallocalign_nid_postfix(nullptr, 0, 0);
+    Require(empty != nullptr);
+    free_nid_postfix(empty);
+
+    return 0;
 }
diff --git a/core/libs/tests/GuestRealpath.cpp b/core/libs/tests/GuestRealpath.cpp
index faae73050f..52240b0a7f 100644
--- a/core/libs/tests/GuestRealpath.cpp
+++ b/core/libs/tests/GuestRealpath.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
@@ -11,13 +12,6 @@
 #include <fstream>
 #include <string>
 
-extern "C" {
-char* APS5_VABI realpath_nid_postfix(const char*, char*);
-int APS5_VABI chdir_nid_postfix(const char*);
-void APS5_VABI free_nid_postfix(void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool Resolves(const std::string& path, const std::string& expected) {
diff --git a/core/libs/tests/GuestRecordLockOwners.cpp b/core/libs/tests/GuestRecordLockOwners.cpp
index cbffd82062..416bb02141 100644
--- a/core/libs/tests/GuestRecordLockOwners.cpp
+++ b/core/libs/tests/GuestRecordLockOwners.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 
@@ -12,13 +15,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char* path, int flags, std::uint16_t mode);
-int APS5_VABI sceKernelClose(int d);
-int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 void Require(bool value, int line) {
diff --git a/core/libs/tests/GuestRefusedConnect.cpp b/core/libs/tests/GuestRefusedConnect.cpp
index 409f8ad97c..b78fccbe41 100644
--- a/core/libs/tests/GuestRefusedConnect.cpp
+++ b/core/libs/tests/GuestRefusedConnect.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <chrono>
@@ -5,22 +8,6 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetSocketClose(int);
-int* APS5_VABI sceNetErrnoLoc();
-}
-
 namespace {
 
 constexpr int GuestInet = 2;
diff --git a/core/libs/tests/GuestRegMgr.cpp b/core/libs/tests/GuestRegMgr.cpp
index dfdf074535..f9e8901ef4 100644
--- a/core/libs/tests/GuestRegMgr.cpp
+++ b/core/libs/tests/GuestRegMgr.cpp
@@ -1,13 +1,10 @@
+#include "prx/libSceRegMgr/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-std::int32_t APS5_VABI sceRegMgrNonSysGetInt(std::int64_t key, std::int32_t unk, std::int32_t* data);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
diff --git a/core/libs/tests/GuestRenameDot.cpp b/core/libs/tests/GuestRenameDot.cpp
index ed44b81e35..83260cf108 100644
--- a/core/libs/tests/GuestRenameDot.cpp
+++ b/core/libs/tests/GuestRenameDot.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -7,15 +9,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI mkdir_nid_postfix(const char*, int);
-int APS5_VABI rmdir_nid_postfix(const char*);
-int APS5_VABI rename_nid_postfix(const char*, const char*);
-int APS5_VABI sceKernelRename(const char*, const char*);
-int APS5_VABI stat_nid_postfix(const char*, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ErrorNoEntry = 2;
@@ -32,6 +25,7 @@ void Cleanup() {
     rmdir_nid_postfix(Source);
     rmdir_nid_postfix(Target);
     rmdir_nid_postfix(Moved);
+
     std::remove(PlainFile);
     std::remove(Loop);
 }
@@ -47,7 +41,7 @@ bool Fails(long result, int error) { return result == -1 && *__error_nid_postfix
 
 bool Exists(const char* path) {
     unsigned char status[256];
-    return stat_nid_postfix(path, status) == 0;
+    return stat_nid_postfix(path, reinterpret_cast<FileStat*>(status)) == 0;
 }
 
 }
diff --git a/core/libs/tests/GuestRenderingWait.cpp b/core/libs/tests/GuestRenderingWait.cpp
index a17c039713..352b8b1d1d 100644
--- a/core/libs/tests/GuestRenderingWait.cpp
+++ b/core/libs/tests/GuestRenderingWait.cpp
@@ -8,14 +8,7 @@
 #include <condition_variable>
 #include <cstdlib>
 #include <mutex>
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetWaitRenderingPacketSizeInDwords();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetFlipPacketSizeInDwords();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadsActivePacketSize();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadCompletePacketSize();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverGetSetWorkloadStreamInactivePacketSize();
-extern "C" std::uint32_t APS5_VABI sceAgcDriverNopDataGetPacketSize(std::uint32_t);
-extern "C" std::uint32_t APS5_VABI sceAgcDriverUserDataGetPacketSize(std::uint32_t);
-extern "C" std::uint32_t APS5_VABI sceAgcDriverWaitUntilSafeForRendering(std::uint32_t**, std::uint32_t, std::uint32_t, std::uint32_t, int);
+
 static void Require(bool value) { if (!value) std::abort(); }
 class Output final : public AgcDriver::IVideoOutput, public AgcDriver::IRenderingWait,
     public AgcDriver::IFlipRequest, public std::enable_shared_from_this<Output> {
diff --git a/core/libs/tests/GuestResolver.cpp b/core/libs/tests/GuestResolver.cpp
index 20f02e1d16..3773c62df8 100644
--- a/core/libs/tests/GuestResolver.cpp
+++ b/core/libs/tests/GuestResolver.cpp
@@ -1,3 +1,5 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <winsock2.h>
@@ -16,14 +18,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-GuestResolver::HostEntry* APS5_VABI gethostbyname_nid_postfix(const char*);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI getaddrinfo_nid_postfix(const char*, const char*, const GuestResolver::AddressInfo*, GuestResolver::AddressInfo**);
-void APS5_VABI freeaddrinfo_nid_postfix(GuestResolver::AddressInfo*);
-int APS5_VABI getnameinfo_nid_postfix(const void*, std::uint32_t, char*, std::uint32_t, char*, std::uint32_t, int);
-const char* APS5_VABI gai_strerror_nid_postfix(int);
-}
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Resolver check failed at line %u\n", location.line());
@@ -135,6 +129,7 @@ int main() {
             Require(std::strcmp(host, numeric) == 0 && std::strcmp(service, "27910") == 0);
         }
         freeaddrinfo_nid_postfix(result);
+
     }
     GuestResolver::AddressInfo* result = reinterpret_cast<GuestResolver::AddressInfo*>(1);
     hints.family = 1234;
@@ -145,4 +140,5 @@ int main() {
     hints.flags = 12;
     Require(getaddrinfo_nid_postfix("invalid-numeric-address", "1", &hints, &result) == 8 && !result);
     freeaddrinfo_nid_postfix(nullptr);
+
 }
diff --git a/core/libs/tests/GuestRtc.cpp b/core/libs/tests/GuestRtc.cpp
index 53e55fd327..10a2900e2f 100644
--- a/core/libs/tests/GuestRtc.cpp
+++ b/core/libs/tests/GuestRtc.cpp
@@ -1,74 +1,22 @@
+#include "prx/libSceRtc/include/Rtc.hpp"
 #include "SceTypes.hpp"
+#include "ProcessParametersFixture.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <ctime>
+#include <chrono>
 #include <exception>
+#include <filesystem>
+#include <fstream>
+#include <string>
+#include <string_view>
 #include <initializer_list>
 #include <limits>
 
-extern "C" {
-int APS5_VABI sceRtcCheckValid(const RtcDateTime*);
-int APS5_VABI sceRtcIsLeapYear(int);
-int APS5_VABI sceRtcGetDaysInMonth(int, int);
-int APS5_VABI sceRtcGetDayOfWeek(int, int, int);
-int APS5_VABI sceRtcGetTickResolution(void);
-int APS5_VABI sceRtcGetTick(const RtcDateTime*, RtcTick*);
-int APS5_VABI sceRtcSetTick(RtcDateTime*, const RtcTick*);
-int APS5_VABI sceRtcGetCurrentTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentNetworkTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentClock(RtcDateTime*, int);
-int APS5_VABI sceRtcGetCurrentClockLocalTime(RtcDateTime*);
-int APS5_VABI sceRtcConvertUtcToLocalTime(const RtcTick*, RtcTick*);
-int APS5_VABI sceRtcConvertLocalTimeToUtc(const RtcTick*, RtcTick*);
-int APS5_VABI sceRtcGetTime_t(const RtcDateTime*, std::int64_t*);
-int APS5_VABI sceRtcSetTime_t(RtcDateTime*, std::int64_t);
-int APS5_VABI sceRtcGetWin32FileTime(const RtcDateTime*, std::uint64_t*);
-int APS5_VABI sceRtcSetWin32FileTime(RtcDateTime*, std::uint64_t);
-int APS5_VABI sceRtcGetDosTime(const RtcDateTime*, std::uint32_t*);
-int APS5_VABI sceRtcSetDosTime(RtcDateTime*, std::uint32_t);
-int APS5_VABI sceRtcGetYear(const RtcDateTime*);
-int APS5_VABI sceRtcSetYear(RtcDateTime*, int);
-int APS5_VABI sceRtcGetMonth(const RtcDateTime*);
-int APS5_VABI sceRtcSetMonth(RtcDateTime*, int);
-int APS5_VABI sceRtcGetDay(const RtcDateTime*);
-int APS5_VABI sceRtcSetDay(RtcDateTime*, int);
-int APS5_VABI sceRtcGetHour(const RtcDateTime*);
-int APS5_VABI sceRtcSetHour(RtcDateTime*, int);
-int APS5_VABI sceRtcGetMinute(const RtcDateTime*);
-int APS5_VABI sceRtcSetMinute(RtcDateTime*, int);
-int APS5_VABI sceRtcGetSecond(const RtcDateTime*);
-int APS5_VABI sceRtcSetSecond(RtcDateTime*, int);
-int APS5_VABI sceRtcGetMicrosecond(const RtcDateTime*);
-int APS5_VABI sceRtcSetMicrosecond(RtcDateTime*, int);
-int APS5_VABI sceRtcFormatRFC3339(char*, const RtcTick*, int);
-int APS5_VABI sceRtcParseRFC3339(RtcTick*, const char*);
-int APS5_VABI sceRtcParseDateTime(RtcTick*, const char*);
-int APS5_VABI sceRtcTickAddTicks(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddMicroseconds(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddSeconds(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddMinutes(RtcTick*, const RtcTick*, std::int64_t);
-int APS5_VABI sceRtcTickAddHours(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddDays(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddWeeks(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddMonths(RtcTick*, const RtcTick*, std::int32_t);
-int APS5_VABI sceRtcTickAddYears(RtcTick*, const RtcTick*, std::int16_t);
-int APS5_VABI sceRtcFormatRFC3339LocalTime(char*, const RtcTick*);
-int APS5_VABI sceRtcFormatRFC2822(char*, const RtcTick*, int);
-int APS5_VABI sceRtcFormatRFC2822LocalTime(char*, const RtcTick*);
-int APS5_VABI sceRtcFormatRFC3339Precise(char*, const RtcTick*, int, int);
-int APS5_VABI sceRtcFormatRFC3339PreciseLocalTime(char*, const RtcTick*, int);
-int APS5_VABI sceRtcCompareTick(const RtcTick*, const RtcTick*);
-int APS5_VABI sceRtcGetCurrentAdNetworkTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentRawNetworkTick(RtcTick*);
-int APS5_VABI sceRtcGetCurrentDebugNetworkTick(RtcTick*);
-int APS5_VABI sceRtcSetCurrentTick(const RtcTick*);
-int APS5_VABI sceRtcSetCurrentNetworkTick(const RtcTick*);
-int APS5_VABI sceRtcSetCurrentAdNetworkTick(const RtcTick*);
-int APS5_VABI sceRtcSetCurrentDebugNetworkTick(const RtcTick*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void SetTimeZone(const char* zone) {
@@ -111,7 +59,40 @@ static int CallAdd(Add function, RtcTick* destination, const RtcTick* source, st
     std::abort();
 }
 
-int main() {
+static void SetCompiledSdkVersion(std::byte* process, std::uint32_t version) {
+    std::memcpy(process + 16, &version, sizeof(version));
+}
+
+static void EnterTitleDirectory(const char* titleId) {
+    const auto directory = std::filesystem::temp_directory_path() / ("rtc-test-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    std::filesystem::create_directories(directory / "app0" / "sce_sys");
+    std::filesystem::current_path(directory);
+    if (titleId == nullptr) return;
+    struct Entry { std::uint16_t key, format; std::uint32_t length, maximum, offset; };
+    const std::uint32_t header[5] = {0x46535000, 0x0101, 52, 72, 2};
+    const Entry entries[2] = {{0, 0x0204, 8, 8, 0}, {6, 0x0204, 10, 12, 8}};
+    std::ofstream file("app0/sce_sys/param.sfo", std::ios::binary);
+    file.write(reinterpret_cast<const char*>(header), sizeof(header));
+    file.write(reinterpret_cast<const char*>(entries), sizeof(entries));
+    file << std::string("TITLE\0TITLE_ID\0\0\0\0\0\0", 20) << std::string("Example\0", 8) << titleId << std::string("\0\0\0", 3);
+}
+
+int main(int argc, char** argv) {
+    static std::array<std::byte, 64> process{};
+    Require(ProcessParametersFixture::Install(process.data(), process.size()));
+    SetCompiledSdkVersion(process.data(), 0x01000051);
+    if (argc == 2 && std::string_view(argv[1]) == "ps5-title") {
+        EnterTitleDirectory(nullptr);
+        RtcDateTime untouched{0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaaaaaau};
+        RtcDateTime converted = untouched;
+        Require(sceRtcGetDayOfWeek(10000, 1, 1) == static_cast<int>(0x80B50008) && sceRtcGetDayOfWeek(0, 13, 1) == static_cast<int>(0x80B50009));
+        Require(sceRtcSetTime_t(&converted, -1) == static_cast<int>(0x80B50003) && Equal(converted, untouched));
+        char text[64];
+        RtcTick tick{std::numeric_limits<std::uint64_t>::max()};
+        Require(sceRtcFormatRFC3339(text, &tick, 1) == static_cast<int>(0x80B50003));
+        return 0;
+    }
+    EnterTitleDirectory("CUSA00000");
     constexpr int invalidPointer = static_cast<int>(0x80B50002);
     constexpr int invalidValue = static_cast<int>(0x80B50003);
     constexpr int badParse = static_cast<int>(0x80B50007);
@@ -134,6 +115,7 @@ int main() {
     Require(sceRtcGetDaysInMonth(10000, 1) == 31);
     Require(sceRtcGetDaysInMonth(9999, 1) == 31);
     Require(sceRtcGetDayOfWeek(1, 1, 1) == 1 && sceRtcGetDayOfWeek(2026, 9, 26) == 6);
+    Require(sceRtcGetDayOfWeek(10000, 1, 1) == 6);
     Require(sceRtcGetDayOfWeek(2023, 2, 29) == invalidDay);
 
     RtcDateTime leapDay{2024, 2, 29, 12, 34, 56, 789000};
@@ -156,7 +138,7 @@ int main() {
     tick.tick = maxTick;
     Require(sceRtcSetTick(&converted, &tick) == 0 && Equal(converted, RtcDateTime{9999, 12, 31, 23, 59, 59, 999999}));
     tick.tick = maxTick + 1;
-    Require(sceRtcSetTick(&converted, &tick) == invalidValue);
+    Require(sceRtcSetTick(&converted, &tick) == 0 && Equal(converted, RtcDateTime{10000, 1, 1, 0, 0, 0, 0}));
 
     Require(sceRtcGetCurrentClock(nullptr, 0) == invalidPointer);
     Require(sceRtcGetCurrentClock(&converted, 0) == 0 && sceRtcCheckValid(&converted) == 0);
@@ -171,10 +153,24 @@ int main() {
     RtcDateTime millennium{2000, 1, 1, 0, 0, 0, 0};
     Require(sceRtcGetTime_t(&millennium, &seconds) == 0 && seconds == 946684800);
     Require(sceRtcSetTime_t(&converted, 946684800) == 0 && Equal(converted, millennium));
-    Require(sceRtcSetTime_t(&converted, -1) == invalidValue);
+    Require(sceRtcSetTime_t(&converted, -1) == 0 && Equal(converted, RtcDateTime{2106, 2, 7, 6, 28, 15, 0}));
+    Require(sceRtcSetTime_t(&converted, 0x100000001ll) == 0 && Equal(converted, RtcDateTime{1970, 1, 1, 0, 0, 1, 0}));
+    Require(sceRtcSetTime_t(&converted, -0x80000000ll) == 0 && Equal(converted, RtcDateTime{2038, 1, 19, 3, 14, 8, 0}));
+    const RtcDateTime past2106{2106, 2, 7, 6, 28, 16, 0};
+    Require(sceRtcGetTime_t(&past2106, &seconds) == 0 && seconds == 0x100000000ll);
+    const RtcDateTime beforeEpoch{1969, 12, 31, 23, 59, 59, 0};
+    seconds = -1;
+    Require(sceRtcGetTime_t(&beforeEpoch, &seconds) == invalidYear && seconds == 0);
+    const RtcDateTime badMonth{1969, 13, 1, 0, 0, 0, 0};
+    seconds = -1;
+    Require(sceRtcGetTime_t(&badMonth, &seconds) == invalidMonth && seconds == -1);
     std::uint64_t fileTime = 0;
     Require(sceRtcGetWin32FileTime(&epoch, &fileTime) == 0 && fileTime == 116444736000000000ull);
     Require(sceRtcSetWin32FileTime(&converted, 116444736000000000ull) == 0 && Equal(converted, epoch));
+    const RtcDateTime before1601{1600, 12, 31, 23, 59, 59, 0};
+    fileTime = 1;
+    Require(sceRtcGetWin32FileTime(&before1601, &fileTime) == invalidYear && fileTime == 0);
+    Require(sceRtcSetWin32FileTime(&converted, std::numeric_limits<std::uint64_t>::max()) == 0 && Equal(converted, RtcDateTime{60056, 5, 28, 5, 36, 10, 955161}));
     std::uint32_t dosTime = 0xffffffffu;
     const RtcDateTime dosDate{2024, 2, 29, 12, 34, 57, 789000};
     Require(sceRtcGetDosTime(&dosDate, &dosTime) == 0 && dosTime == 0x585d645cu);
@@ -270,6 +266,22 @@ int main() {
         Require(sceRtcFormatRFC3339(text, &tick, offset) == invalidValue);
         Require(std::memcmp(text, original, sizeof(text)) == 0);
     }
+    RtcTick edge{maxTick + 1};
+    Require(sceRtcFormatRFC3339(text, &edge, 0) == invalidYear);
+    edge.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC3339(text, &edge, 0) == invalidYear);
+    edge.tick = maxTick;
+    Require(sceRtcFormatRFC3339(text, &edge, 1) == invalidYear);
+    edge.tick = 59999999;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == invalidYear);
+    edge.tick = 60000000;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == 0 && std::strcmp(text, "0001-01-01T00:00:00.00-00:01") == 0);
+    edge.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC3339(text, &edge, 1) == 0 && std::strcmp(text, "0001-01-01T00:00:59.99+00:01") == 0);
+    edge.tick = 1ull << 63;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == invalidYear);
+    edge.tick = maxTick + 1;
+    Require(sceRtcFormatRFC3339(text, &edge, -1) == 0 && std::strcmp(text, "9999-12-31T23:59:00.00-00:01") == 0);
     Require(sceRtcFormatRFC3339(nullptr, &tick, 1440) == invalidPointer);
     Require(sceRtcFormatRFC3339(text, nullptr, 1440) == invalidValue);
     {
@@ -775,7 +787,19 @@ int main() {
     Require(sceRtcFormatRFC2822(rfc2822, &tick, -1) == invalidValue);
     tick.tick = maxTick;
     Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == 0 && std::strcmp(rfc2822, "Fri, 31 Dec 9999 23:59:59 +0000") == 0);
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 1) == invalidYear);
+    tick.tick = maxTick + 1;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == invalidYear);
+    tick.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == invalidValue);
     Require(sceRtcFormatRFC2822(rfc2822, &tick, 1) == invalidValue);
+    tick.tick = 0ull - 60000000ull;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 1) == invalidValue);
+    tick.tick = 1ull << 63;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, 0) == invalidValue);
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, -1) == invalidYear);
+    tick.tick = maxTick + 1;
+    Require(sceRtcFormatRFC2822(rfc2822, &tick, -1) == 0 && std::strcmp(rfc2822, "Fri, 31 Dec 9999 23:59:00 -0001") == 0);
     tick.tick = leapDayTick;
     for (int offset : {1440, -1440, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()}) {
         std::memset(rfc2822, 'x', sizeof(rfc2822));
@@ -907,4 +931,40 @@ int main() {
         Require(sceRtcGetCurrentDebugNetworkTick(&current) == 0 && current.tick >= debugClock.tick && current.tick < debugClock.tick + 1000000);
         Require(sceRtcGetCurrentRawNetworkTick(&current) == 0 && current.tick > unixEpochTick);
     }
+    SetCompiledSdkVersion(process.data(), 0x02ffffff);
+    Require(sceRtcGetDayOfWeek(0, 13, 1) == invalidYear && sceRtcGetDayOfWeek(10000, 1, 1) == 6);
+    SetCompiledSdkVersion(process.data(), 0x03000000);
+    Require(sceRtcGetDayOfWeek(0, 13, 1) == invalidMonth && sceRtcGetDayOfWeek(10000, 1, 1) == invalidYear);
+    SetCompiledSdkVersion(process.data(), 0x05050001);
+    Require(sceRtcGetDayOfWeek(0, 13, 1) == invalidMonth && sceRtcGetDayOfWeek(10000, 13, 1) == invalidMonth && sceRtcGetDayOfWeek(2024, 0, 1) == invalidMonth);
+    Require(sceRtcGetDayOfWeek(0, 1, 0) == invalidYear && sceRtcGetDayOfWeek(10000, 2, 30) == invalidYear && sceRtcGetDayOfWeek(65536, 1, 1) == invalidYear);
+    Require(sceRtcGetDayOfWeek(2024, 2, 30) == invalidDay && sceRtcGetDayOfWeek(9999, 12, 31) == 5 && sceRtcGetDayOfWeek(1, 1, 1) == 1);
+    Require(sceRtcGetDaysInMonth(0, 13) == invalidYear && sceRtcGetDaysInMonth(10000, 1) == 31 && sceRtcIsLeapYear(10000) == 1);
+    RtcDateTime sentinel{0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaa, 0xaaaaaaaau};
+    RtcDateTime ranged = sentinel;
+    Require(sceRtcSetTime_t(&ranged, -1) == invalidValue && Equal(ranged, sentinel));
+    Require(sceRtcSetTime_t(&ranged, std::numeric_limits<std::int64_t>::min()) == invalidValue && Equal(ranged, sentinel));
+    Require(sceRtcSetTime_t(&ranged, 4294967296ll) == 0 && Equal(ranged, RtcDateTime{2106, 2, 7, 6, 28, 16, 0}));
+    Require(sceRtcSetTime_t(&ranged, 253402300800ll) == 0 && Equal(ranged, RtcDateTime{10000, 1, 1, 0, 0, 0, 0}));
+    Require(sceRtcSetTime_t(&ranged, 18446744073709ll) == 0 && Equal(ranged, RtcDateTime{1969, 12, 31, 23, 59, 59, 448384}));
+    Require(sceRtcSetTime_t(&ranged, std::numeric_limits<std::int64_t>::max()) == 0 && Equal(ranged, RtcDateTime{1969, 12, 31, 23, 59, 59, 0}));
+    char ranges[64];
+    RtcTick shifted{0};
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == invalidValue);
+    shifted.tick = 59999999;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == invalidValue);
+    shifted.tick = 60000000;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == 0 && std::strcmp(ranges, "0001-01-01T00:00:00.00-00:01") == 0);
+    shifted.tick = std::numeric_limits<std::uint64_t>::max();
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 1) == invalidValue && sceRtcFormatRFC3339(ranges, &shifted, 1439) == invalidValue);
+    shifted.tick = std::numeric_limits<std::uint64_t>::max() - 60000000 + 1;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 1) == invalidValue);
+    shifted.tick = std::numeric_limits<std::uint64_t>::max() - 60000000;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 1) == invalidYear);
+    shifted.tick = 1ull << 63;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, 0) == invalidYear && sceRtcFormatRFC3339(ranges, &shifted, -1) == invalidYear);
+    shifted.tick = maxTick + 1;
+    Require(sceRtcFormatRFC3339(ranges, &shifted, -1) == 0 && std::strcmp(ranges, "9999-12-31T23:59:00.00-00:01") == 0);
+    Require(sceRtcInit() == 0);
+    Require(sceRtcEnd() == 0);
 }
diff --git a/core/libs/tests/GuestRtprioThread.cpp b/core/libs/tests/GuestRtprioThread.cpp
new file mode 100644
index 0000000000..0d44857120
--- /dev/null
+++ b/core/libs/tests/GuestRtprioThread.cpp
@@ -0,0 +1,100 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+#include <thread>
+
+static constexpr int SCE_OK = 0;
+static constexpr int GUEST_SCHED_FIFO = 1;
+static constexpr int GUEST_SCHED_RR = 3;
+static constexpr int EXPLICIT_SCHED = 0;
+static constexpr int RTP_LOOKUP = 0;
+static constexpr int RTP_SET = 1;
+static constexpr std::uint16_t RTP_PRIO_REALTIME = 2;
+static constexpr std::uint16_t RTP_PRIO_FIFO = 10;
+static constexpr int GUEST_ESRCH = 3;
+static constexpr int GUEST_EFAULT = 14;
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+struct Report {
+    int policy;
+    int priority;
+    std::atomic<int> tid{0};
+    GuestRtPrio lookup{7, 7};
+    int lookupResult = -1;
+    std::atomic<bool> release{false};
+};
+
+static void* APS5_VABI Entry(void* arg) {
+    auto* report = static_cast<Report*>(arg);
+    report->lookupResult = rtprio_thread_nid_postfix(RTP_LOOKUP, 0, &report->lookup);
+    report->tid.store(scePthreadGetthreadid(), std::memory_order_release);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (!report->release.load(std::memory_order_acquire)) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::yield();
+    }
+    return nullptr;
+}
+
+static int LookupError(int function, int lwpid, GuestRtPrio* priority) {
+    *__error_nid_postfix() = 0;
+    Require(rtprio_thread_nid_postfix(function, lwpid, priority) == -1);
+    return *__error_nid_postfix();
+}
+
+static void CheckThread(int policy, int priority, std::uint16_t expectedType) {
+    Report report{policy, priority};
+    PthreadAttr attr = nullptr;
+    KernelSchedParam param{priority};
+    Require(scePthreadAttrInit(&attr) == SCE_OK);
+    Require(scePthreadAttrSetinheritsched(&attr, EXPLICIT_SCHED) == SCE_OK);
+    Require(scePthreadAttrSetschedpolicy(&attr, policy) == SCE_OK);
+    Require(scePthreadAttrSetschedparam(&attr, &param) == SCE_OK);
+    Pthread thread = nullptr;
+    Require(scePthreadCreate(&thread, &attr, Entry, &report, "rtprio") == SCE_OK);
+    Require(scePthreadAttrDestroy(&attr) == SCE_OK);
+    const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(10);
+    while (report.tid.load(std::memory_order_acquire) == 0) {
+        Require(std::chrono::steady_clock::now() < deadline);
+        std::this_thread::yield();
+    }
+    Require(report.lookupResult == 0 && report.lookup.type == expectedType && report.lookup.prio == priority);
+    GuestRtPrio fromCreator{7, 7};
+    Require(rtprio_thread_nid_postfix(RTP_LOOKUP, report.tid.load(), &fromCreator) == 0);
+    Require(fromCreator.type == expectedType && fromCreator.prio == priority);
+    bool threw = false;
+    try { rtprio_thread_nid_postfix(RTP_SET, report.tid.load(), &fromCreator); } catch (const std::exception&) { threw = true; }
+    Require(threw);
+    report.release.store(true, std::memory_order_release);
+    Require(scePthreadJoin(thread, nullptr) == SCE_OK);
+    Require(LookupError(RTP_LOOKUP, report.tid.load(), &fromCreator) == GUEST_ESRCH);
+}
+
+int main() {
+    int policy = -1;
+    KernelSchedParam param{};
+    Require(scePthreadGetschedparam(scePthreadSelf(), &policy, &param) == SCE_OK);
+    Require(policy == GUEST_SCHED_FIFO || policy == GUEST_SCHED_RR);
+    GuestRtPrio self{7, 7};
+    Require(rtprio_thread_nid_postfix(RTP_LOOKUP, 0, &self) == 0);
+    Require(self.type == (policy == GUEST_SCHED_FIFO ? RTP_PRIO_FIFO : RTP_PRIO_REALTIME) && self.prio == param.sched_priority);
+    GuestRtPrio byId{7, 7};
+    Require(rtprio_thread_nid_postfix(RTP_LOOKUP, scePthreadGetthreadid(), &byId) == 0);
+    Require(byId.type == self.type && byId.prio == self.prio);
+    CheckThread(GUEST_SCHED_FIFO, 512, RTP_PRIO_FIFO);
+    CheckThread(GUEST_SCHED_RR, 600, RTP_PRIO_REALTIME);
+    CheckThread(GUEST_SCHED_FIFO, 256, RTP_PRIO_FIFO);
+    Require(LookupError(2, 0, &self) == GUEST_ESRCH);
+    Require(LookupError(RTP_LOOKUP, 0, nullptr) == GUEST_EFAULT);
+    Require(LookupError(RTP_LOOKUP, 1, &self) == GUEST_ESRCH);
+    Require(LookupError(RTP_LOOKUP, 999999, &self) == GUEST_ESRCH);
+    bool threw = false;
+    try { rtprio_thread_nid_postfix(RTP_SET, 0, &self); } catch (const std::exception&) { threw = true; }
+    Require(threw);
+}
diff --git a/core/libs/tests/GuestRudpContextLifecycle.cpp b/core/libs/tests/GuestRudpContextLifecycle.cpp
index 51a119e0d8..766e84b8dd 100644
--- a/core/libs/tests/GuestRudpContextLifecycle.cpp
+++ b/core/libs/tests/GuestRudpContextLifecycle.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -10,21 +11,7 @@
 #include <utility>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpActivate(std::int32_t, const void*, std::uint32_t);
-int APS5_VABI sceRudpEnableInternalIOThread(std::uint32_t, std::uint32_t);
-int APS5_VABI sceRudpSetEventHandler(GuestRudpEventHandler, void*);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpBind(int, std::uint16_t, int, std::uint16_t);
-int APS5_VABI sceRudpSetOption(int, int, const void*, std::uint32_t);
-int APS5_VABI sceRudpGetOption(int, int, void*, std::uint32_t);
-int APS5_VABI sceRudpInitiate(int, const void*, std::uint32_t, std::uint16_t);
-int APS5_VABI sceRudpGetContextStatus(int, void*, std::uint32_t);
-int APS5_VABI sceRudpWrite(int, const void*, std::uint32_t, int);
-int APS5_VABI sceRudpRead(int, void*, std::uint32_t, int, void*);
-int APS5_VABI sceRudpTerminate(int);
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -78,6 +65,7 @@ static void CheckOptions(int context) {
         bool threw = false;
         try {
             sceRudpGetOption(context, option, &value, sizeof(value));
+
         } catch (const std::runtime_error&) {
             threw = true;
         }
@@ -91,6 +79,7 @@ static void CheckOptions(int context) {
                 threw = false;
                 try {
                     sceRudpGetOption(current, option, &value, sizeof(value));
+
                 } catch (const std::runtime_error&) {
                     threw = true;
                 }
@@ -176,6 +165,7 @@ int main() {
     bool activationUnsupported = false;
     try {
         sceRudpActivate(ctx, address, sizeof(address));
+
     } catch (const std::runtime_error&) {
         activationUnsupported = true;
     }
diff --git a/core/libs/tests/GuestRudpContextQueries.cpp b/core/libs/tests/GuestRudpContextQueries.cpp
index 76374d4b86..a45bc97d8e 100644
--- a/core/libs/tests/GuestRudpContextQueries.cpp
+++ b/core/libs/tests/GuestRudpContextQueries.cpp
@@ -1,17 +1,11 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
 #include <cstdlib>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpTerminate(int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpGetNumberOfPacketsToRead(int);
-int APS5_VABI sceRudpGetSizeWritable(int);
-int APS5_VABI sceRudpGetSizeReadable(int);
+
 }
 
 static void Require(bool value) {
diff --git a/core/libs/tests/GuestRudpPoll.cpp b/core/libs/tests/GuestRudpPoll.cpp
index 4ff92c482f..21274887b3 100644
--- a/core/libs/tests/GuestRudpPoll.cpp
+++ b/core/libs/tests/GuestRudpPoll.cpp
@@ -1,28 +1,18 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
+#include <algorithm>
 #include <array>
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <limits>
 #include <thread>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-struct GuestRudpPollEvent {
-    int ctxId;
-    std::uint16_t reqEvents;
-    std::uint16_t rtnEvents;
-};
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpTerminate(int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpPollCreate(std::size_t);
-int APS5_VABI sceRudpPollControl(int, int, int, std::uint16_t);
-int APS5_VABI sceRudpPollWait(int, GuestRudpPollEvent*, std::size_t, std::uint64_t);
-int APS5_VABI sceRudpPollDestroy(int);
+
 }
 
 static void Require(bool value) {
@@ -44,7 +34,7 @@ int main() {
     constexpr std::uint16_t write = 0x0002;
     constexpr std::uint64_t forever = std::numeric_limits<std::uint64_t>::max();
     alignas(16) static std::array<unsigned char, 0x10000> pool{};
-    std::array<GuestRudpPollEvent, 4> events{};
+    std::array<RudpPollEvent, 4> events{};
     const auto eventCount = static_cast<std::uint32_t>(events.size());
 
     Require(sceRudpPollCreate(1) == notInitialized);
@@ -92,6 +82,23 @@ int main() {
     Require(sceRudpPollWait(poll, events.data(), eventCount, 20000) == 0);
     Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(20));
 
+#ifdef _WIN32
+    for (const auto timeout : {100ULL, 1000ULL}) {
+        std::array<std::chrono::nanoseconds, 31> samples{};
+        for (auto& sample : samples) {
+            const auto before = std::chrono::steady_clock::now();
+            Require(sceRudpPollWait(poll, events.data(), eventCount, timeout) == 0);
+            sample = std::chrono::steady_clock::now() - before;
+            Require(sample >= std::chrono::microseconds(timeout));
+        }
+        std::sort(samples.begin(), samples.end());
+        const auto median = samples[samples.size() / 2];
+        std::fprintf(stderr, "sceRudpPollWait(%llu us) median: %lld ns\n", timeout,
+                     static_cast<long long>(median.count()));
+        Require(median < std::chrono::milliseconds(12));
+    }
+#endif
+
     Require(sceRudpTerminate(second) == 0);
     Require(sceRudpPollControl(poll, add, first, read) == 0);
     Require(sceRudpTerminate(first) == 0);
@@ -101,6 +108,19 @@ int main() {
     Require(sceRudpPollControl(poll, add, third, read) == 0);
     Require(sceRudpPollControl(other, add, third, read) == 0);
 
+    const int finitePoll = sceRudpPollCreate(1);
+    Require(finitePoll > 0);
+    int finiteResult = 0;
+    std::thread finiteWaiter([&] {
+        finiteResult = sceRudpPollWait(finitePoll, events.data(), eventCount, 1000000);
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    const auto destroyedAt = std::chrono::steady_clock::now();
+    Require(sceRudpPollDestroy(finitePoll) == 0);
+    finiteWaiter.join();
+    Require(finiteResult == invalidPoll);
+    Require(std::chrono::steady_clock::now() - destroyedAt < std::chrono::milliseconds(500));
+
     int destroyedResult = 0;
     std::thread destroyedWaiter([&] { destroyedResult = sceRudpPollWait(poll, events.data(), eventCount, forever); });
     std::this_thread::sleep_for(std::chrono::milliseconds(20));
diff --git a/core/libs/tests/GuestRudpPump.cpp b/core/libs/tests/GuestRudpPump.cpp
index 2cc7f5586f..26482bfeea 100644
--- a/core/libs/tests/GuestRudpPump.cpp
+++ b/core/libs/tests/GuestRudpPump.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -6,16 +7,6 @@
 #include <cstdlib>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpEnd();
-int APS5_VABI sceRudpProcessEvents(std::uint64_t timeout);
-int APS5_VABI sceRudpNetFlush();
-int APS5_VABI sceRudpGetMaxSegmentSize(std::uint16_t*);
-int APS5_VABI sceRudpNetReceived(int socketId, const void* data, std::size_t dataSize, const void* sourceAddress, std::uint32_t sourceAddressSize);
-int APS5_VABI sceRudpEnableInternalIOThread2(std::uint32_t, std::uint32_t, std::uint64_t);
-}
-
 static void Require(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "rudp check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestRudpStatus.cpp b/core/libs/tests/GuestRudpStatus.cpp
index ab845fffac..8aed90988d 100644
--- a/core/libs/tests/GuestRudpStatus.cpp
+++ b/core/libs/tests/GuestRudpStatus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceRudp/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -7,12 +8,7 @@
 #include <cstring>
 
 extern "C" {
-using GuestRudpEventHandler = void(APS5_VABI*)(int, int, int, void*);
-int APS5_VABI sceRudpInit_nid_postfix(void*, int);
-int APS5_VABI sceRudpGetStatus(void*, std::size_t);
-int APS5_VABI sceRudpCreateContext(GuestRudpEventHandler, void*, int*);
-int APS5_VABI sceRudpTerminate(int);
-int APS5_VABI sceRudpEnd();
+
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestRuneLocale.cpp b/core/libs/tests/GuestRuneLocale.cpp
index e677153ff7..b05986b76d 100644
--- a/core/libs/tests/GuestRuneLocale.cpp
+++ b/core/libs/tests/GuestRuneLocale.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cctype>
 #include <cerrno>
@@ -11,43 +12,7 @@ extern "C" {
 extern const unsigned char _DefaultRuneLocale_nid_postfix[4224];
 extern const unsigned char* _CurrentRuneLocale_nid_postfix;
 extern int __mb_sb_limit_nid_postfix;
-int APS5_VABI isalpha_nid_postfix(int);
-int APS5_VABI iscntrl_nid_postfix(int);
-int APS5_VABI isdigit_nid_postfix(int);
-int APS5_VABI isgraph_nid_postfix(int);
-int APS5_VABI islower_nid_postfix(int);
-int APS5_VABI isprint_nid_postfix(int);
-int APS5_VABI ispunct_nid_postfix(int);
-int APS5_VABI isspace_nid_postfix(int);
-int APS5_VABI isupper_nid_postfix(int);
-int APS5_VABI isxdigit_nid_postfix(int);
-int APS5_VABI isblank_nid_postfix(int);
-int APS5_VABI tolower_nid_postfix(int);
-int APS5_VABI toupper_nid_postfix(int);
-int APS5_VABI iswalnum_nid_postfix(std::uint32_t);
-int APS5_VABI iswalpha_nid_postfix(std::uint32_t);
-int APS5_VABI iswblank_nid_postfix(std::uint32_t);
-int APS5_VABI iswcntrl_nid_postfix(std::uint32_t);
-int APS5_VABI iswdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswgraph_nid_postfix(std::uint32_t);
-int APS5_VABI iswlower_nid_postfix(std::uint32_t);
-int APS5_VABI iswprint_nid_postfix(std::uint32_t);
-int APS5_VABI iswpunct_nid_postfix(std::uint32_t);
-int APS5_VABI iswspace_nid_postfix(std::uint32_t);
-int APS5_VABI iswupper_nid_postfix(std::uint32_t);
-int APS5_VABI iswxdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswctype_nid_postfix(std::uint32_t, std::uint64_t);
-std::uint64_t APS5_VABI wctype_nid_postfix(const char*);
-std::uint32_t APS5_VABI towlower_nid_postfix(std::uint32_t);
-std::uint32_t APS5_VABI towupper_nid_postfix(std::uint32_t);
-std::uint64_t APS5_VABI wctrans_nid_postfix(const char*);
-std::uint32_t APS5_VABI towctrans_nid_postfix(std::uint32_t, std::uint64_t);
-std::uint32_t APS5_VABI _Towlower_nid_postfix(std::uint32_t, const void*);
-std::uint32_t APS5_VABI _Towupper_nid_postfix(std::uint32_t, const void*);
-int APS5_VABI _Tolower_nid_postfix(int, const void*);
-int APS5_VABI _Toupper_nid_postfix(int, const void*);
-std::uint32_t APS5_VABI btowc_nid_postfix(int);
-int APS5_VABI wctob_nid_postfix(std::uint32_t);
+
 }
 
 void Require(bool condition, std::source_location location = std::source_location::current()) {
@@ -130,9 +95,11 @@ int main() {
     }
     Require(towlower_nid_postfix(0xffffffff) == 0xffffffff && towupper_nid_postfix(0xffffffff) == 0xffffffff);
     Require(btowc_nid_postfix(-1) == 0xffffffff && btowc_nid_postfix(0) == 0);
-    Require(btowc_nid_postfix('A') == 'A' && btowc_nid_postfix(0xe9) == 0xe9 && btowc_nid_postfix(-23) == 0xe9);
-    Require(wctob_nid_postfix('A') == 'A' && wctob_nid_postfix(0xe9) == 0xe9 && wctob_nid_postfix(0) == 0);
-    Require(wctob_nid_postfix(0x100) == -1 && wctob_nid_postfix(0x20ac) == -1 && wctob_nid_postfix(0xffffffff) == -1);
+    Require(btowc_nid_postfix('A') == 'A' && btowc_nid_postfix(0x7f) == 0x7f && btowc_nid_postfix(0x80) == 0xffffffff);
+    Require(btowc_nid_postfix(0xe9) == 0xffffffff && btowc_nid_postfix(-23) == 0xffffffff && btowc_nid_postfix(0x141) == 'A');
+    Require(wctob_nid_postfix('A') == 'A' && wctob_nid_postfix(0x7f) == 0x7f && wctob_nid_postfix(0x80) == -1 && wctob_nid_postfix(0) == 0);
+    Require(wctob_nid_postfix(0xe9) == -1 && wctob_nid_postfix(0x20ac) == -1 && wctob_nid_postfix(0xffffffff) == -1);
+    Require(wctob_nid_postfix(0x10041) == 'A' && wctob_nid_postfix(0x80000000) == 0);
     Require(wctrans_nid_postfix("tolower") == 1 && wctrans_nid_postfix("toupper") == 2);
     Require(wctrans_nid_postfix("") == 0 && wctrans_nid_postfix("TOLOWER") == 0 && wctrans_nid_postfix("tolowe") == 0);
     for (std::int64_t c = -300; c < 70000; ++c) {
@@ -147,5 +114,15 @@ int main() {
     }
     errno = 0;
     Require(towctrans_nid_postfix('A', 0) == 'A' && towctrans_nid_postfix('a', 3) == 'a' && errno == 0);
+    for (int c = -300; c < 0x1200; ++c) {
+        const auto byte = static_cast<unsigned char>(c);
+        errno = 0;
+        const std::uint32_t wide = btowc_nid_postfix(c);
+        const bool invalidLead = c != -1 && ((byte >= 0x80 && byte < 0xc0) || byte >= 0xf0);
+        Require(wide == (c != -1 && byte < 0x80 ? byte : 0xffffffffu) && errno == (invalidLead ? 86 : 0));
+    }
+    errno = 7;
+    Require(btowc_nid_postfix(0xc3) == 0xffffffff && btowc_nid_postfix(0xef) == 0xffffffff && btowc_nid_postfix(-1) == 0xffffffff && errno == 7);
+    Require(btowc_nid_postfix(0x41) == 'A' && errno == 7);
     return 0;
 }
diff --git a/core/libs/tests/GuestRuntimeLifecycle.cpp b/core/libs/tests/GuestRuntimeLifecycle.cpp
new file mode 100644
index 0000000000..2a4dd8a22d
--- /dev/null
+++ b/core/libs/tests/GuestRuntimeLifecycle.cpp
@@ -0,0 +1,135 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <dlfcn.h>
+#include <thread>
+#include <source_location>
+#include <pthread.h>
+
+namespace {
+struct Event { std::size_t args; const void* argp; };
+std::array<Event, 8> events{};
+std::atomic<unsigned> count{0};
+std::atomic<bool> entered{false}, releaseEntry{false};
+bool concurrent = false, reentrant = false;
+thread_local bool isLifecycleWaiter = false;
+std::atomic<bool> waiterObserved{false};
+std::atomic<unsigned> waiterReturns{0};
+const char* modulePath = nullptr;
+std::int32_t reentrantHandle = -1;
+void Require(bool ok, const std::source_location& where = std::source_location::current()) {
+    if (ok) return;
+    std::fprintf(stderr, "guest_runtime_lifecycle: failed at %u\n", where.line());
+    std::abort();
+}
+}
+
+extern "C" int pthread_cond_wait(pthread_cond_t* condition, pthread_mutex_t* mutex) {
+    using Wait = int (*)(pthread_cond_t*, pthread_mutex_t*);
+    static const auto actual = reinterpret_cast<Wait>(::dlsym(RTLD_NEXT, "pthread_cond_wait"));
+    Require(actual != nullptr);
+    if (isLifecycleWaiter) waiterObserved.store(true, std::memory_order_release);
+    const int result = actual(condition, mutex);
+    if (isLifecycleWaiter) waiterReturns.fetch_add(1, std::memory_order_relaxed);
+    return result;
+}
+
+extern "C" void APS5_VABI RecordArgs(std::size_t args, const void* argp) {
+    const auto index = count.fetch_add(1);
+    Require(index < events.size());
+    events[index] = {args, argp};
+    if (index == 0 && reentrant) {
+        reentrantHandle = sceKernelLoadStartModule(modulePath, 0, nullptr, 0, nullptr, nullptr);
+        Require(reentrantHandle > 0 && count.load() == 1);
+    }
+    if (index == 0 && concurrent) {
+        entered.store(true, std::memory_order_release);
+        const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+        while (!releaseEntry.load(std::memory_order_acquire)) {
+            Require(std::chrono::steady_clock::now() < limit);
+            std::this_thread::yield();
+        }
+    }
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 3);
+    concurrent = std::strcmp(argv[2], "concurrent") == 0;
+    reentrant = std::strcmp(argv[2], "reentrant") == 0;
+    modulePath = argv[1];
+    void* preload = ::dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    if (!preload) std::fprintf(stderr, "%s\n", ::dlerror());
+    Require(preload && count.load() == 0);
+    if (std::strcmp(argv[2], "never-start") == 0) {
+        Require(::dlclose(preload) == 0 && count.load() == 0);
+        return 0;
+    }
+    const std::uint64_t payload = 0xfeed0123;
+    const bool zeroStart = std::strcmp(argv[2], "zero-start") == 0;
+    const std::size_t requestedSize = zeroStart ? 0 : sizeof(payload);
+    const void* requestedPointer = zeroStart ? nullptr : &payload;
+    int result = -1;
+    std::int32_t first = -1, second = -1;
+    if (concurrent) {
+        std::thread one([&] { first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result); });
+        const auto limit = std::chrono::steady_clock::now() + std::chrono::seconds(5);
+        while (!entered.load(std::memory_order_acquire)) {
+            Require(std::chrono::steady_clock::now() < limit);
+            std::this_thread::yield();
+        }
+        std::thread two([&] {
+            isLifecycleWaiter = true;
+            second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr);
+            isLifecycleWaiter = false;
+        });
+        while (!waiterObserved.load(std::memory_order_acquire)) {
+            Require(std::chrono::steady_clock::now() < limit);
+            std::this_thread::yield();
+        }
+        Require(count.load() == 1);
+        releaseEntry.store(true, std::memory_order_release);
+        one.join();
+        two.join();
+        Require(waiterReturns.load() > 0);
+        std::fprintf(stderr, "Observed lifecycle waiter before initializer release; actual condition-wait returns=%u\n", waiterReturns.load());
+    } else {
+        first = sceKernelLoadStartModule(argv[1], requestedSize, requestedPointer, 0, nullptr, &result);
+        second = sceKernelLoadStartModule(argv[1], 0, nullptr, 0, nullptr, nullptr);
+    }
+    std::fprintf(stderr, "first=%d second=%d result=%x count=%u\n", first, second, result, count.load());
+    if (first < 0) std::fprintf(stderr, "loader error: %s\n", dlerror_nid_postfix());
+    Require(first > 0 && second > 0 && first != second && result == 0x5a17);
+    Require(count.load() == 2 && events[0].args == requestedSize && events[0].argp == requestedPointer);
+    Require(events[1].args == 0xa1 && events[1].argp == nullptr);
+    Require(sceKernelStopUnloadModule(first, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2);
+    Require(sceKernelStopUnloadModule(second, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 2);
+    if (reentrant) {
+        Require(reentrantHandle != first && reentrantHandle != second);
+        Require(::dlclose(preload) == 0 && count.load() == 2);
+        Require(sceKernelStopUnloadModule(reentrantHandle, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 4);
+    } else {
+        Require(::dlclose(preload) == 0 && count.load() == 4);
+    }
+    Require(events[2].args == 0xf1 && events[2].argp == nullptr);
+    Require(events[3].args == 0xfe && events[3].argp == nullptr);
+    if (std::strcmp(argv[2], "reload") == 0) {
+        void* resident = ::dlopen(argv[1], RTLD_NOW | RTLD_NOLOAD);
+        Require(resident == nullptr);
+        result = -1;
+        const auto reload = sceKernelLoadStartModule(argv[1], sizeof(payload), &payload, 0, nullptr, &result);
+        Require(reload > 0 && reload != first && reload != second && result == 0x5a17);
+        Require(count.load() == 6 && events[4].args == sizeof(payload) && events[4].argp == &payload);
+        Require(events[5].args == 0xa1 && events[5].argp == nullptr);
+        Require(sceKernelStopUnloadModule(reload, 0, nullptr, 0, nullptr, nullptr) == 0 && count.load() == 8);
+        Require(events[6].args == 0xf1 && events[6].argp == nullptr);
+        Require(events[7].args == 0xfe && events[7].argp == nullptr);
+        Require(::dlopen(argv[1], RTLD_NOW | RTLD_NOLOAD) == nullptr);
+    }
+}
diff --git a/core/libs/tests/GuestSafeErrors.cpp b/core/libs/tests/GuestSafeErrors.cpp
index 436ce48e09..b253f14d6c 100644
--- a/core/libs/tests/GuestSafeErrors.cpp
+++ b/core/libs/tests/GuestSafeErrors.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/WindowsFormatting.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -8,15 +10,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI strerror_s_nid_postfix(char*, std::size_t, int);
-std::size_t APS5_VABI strerrorlen_s_nid_postfix(int);
-int APS5_VABI strerror_r_nid_postfix(int, char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-void* APS5_VABI set_constraint_handler_s_nid_postfix(void*);
-void APS5_VABI ignore_handler_s_nid_postfix(const char*, void*, int);
-}
-
 namespace {
 
 void Require(bool condition, const char* message) {
@@ -96,8 +89,10 @@ void CheckConstraints() {
         Require(violations == before + 1 && violationBuffer == nullptr, "one callback for null destination");
     }
     set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(ignore_handler_s_nid_postfix));
+
     Require(strerror_s_nid_postfix(nullptr, 1, 2) == 22, "installed ignore handler returns to caller");
     set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(Constraint));
+
 }
 
 void CheckThreads() {
@@ -122,5 +117,6 @@ int main() {
     CheckConstraints();
     CheckThreads();
     set_constraint_handler_s_nid_postfix(previous);
+
     std::puts("safe error message checks passed");
 }
diff --git a/core/libs/tests/GuestSandboxCertificates.cpp b/core/libs/tests/GuestSandboxCertificates.cpp
index 2c76c900ba..5fb1e400b3 100644
--- a/core/libs/tests/GuestSandboxCertificates.cpp
+++ b/core/libs/tests/GuestSandboxCertificates.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include "SceTypes.hpp"
@@ -7,16 +10,7 @@
 #include <filesystem>
 #include <fstream>
 #include <string>
-extern "C" {
-const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-int APS5_VABI sceKernelOpen(const char*, int, unsigned short);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-int APS5_VABI sceKernelStat(const char*, FileStat*);
-void* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, void*);
-int APS5_VABI fclose_nid_postfix(void*);
-}
+
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Sandbox certificates check failed at line %d\n", line);
@@ -37,7 +31,7 @@ static std::string ReadKernel(const std::string& path) {
     return text;
 }
 static std::string ReadStream(const std::string& path) {
-    void* stream = fopen_nid_postfix(path.c_str(), "rb");
+    FileStream* stream = fopen_nid_postfix(path.c_str(), "rb");
     Require(stream != nullptr);
     std::string text;
     char buffer[4096];
diff --git a/core/libs/tests/GuestSandboxRandomWord.cpp b/core/libs/tests/GuestSandboxRandomWord.cpp
index 15eb6eb241..b9ec713584 100644
--- a/core/libs/tests/GuestSandboxRandomWord.cpp
+++ b/core/libs/tests/GuestSandboxRandomWord.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cctype>
 #include <cstdlib>
@@ -5,12 +7,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-const char* APS5_VABI sceKernelGetFsSandboxRandomWord();
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 int main() {
diff --git a/core/libs/tests/GuestSaveDataCancel.cpp b/core/libs/tests/GuestSaveDataCancel.cpp
index ce9c2e8c20..5f9612d5ce 100644
--- a/core/libs/tests/GuestSaveDataCancel.cpp
+++ b/core/libs/tests/GuestSaveDataCancel.cpp
@@ -1,14 +1,14 @@
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdint>
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI sceSaveDataCancel(std::uint32_t cancelArgument);
-
 int main() {
     try {
         sceSaveDataCancel(0);
+
     } catch (const std::runtime_error& error) {
         if (std::string(error.what()) == "sceSaveDataCancel not implemented") return 0;
         std::fprintf(stderr, "sceSaveDataCancel threw: %s\n", error.what());
diff --git a/core/libs/tests/GuestSaveDataConvert.cpp b/core/libs/tests/GuestSaveDataConvert.cpp
index 580d22e892..85fd30503b 100644
--- a/core/libs/tests/GuestSaveDataConvert.cpp
+++ b/core/libs/tests/GuestSaveDataConvert.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
@@ -10,13 +12,6 @@
 #include <system_error>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataConvert(const SaveDataConvert*);
-int APS5_VABI sceSaveDataGetConvertProgress(float*);
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-}
-
 namespace {
 
 constexpr int SaveDataErrorParameter = -2137063424;
@@ -67,6 +62,11 @@ int main() {
     Check(progress < 1.0f, "convert progress is below 1.0f after failed convert");
     Check(progress == 0.0f, "convert progress reports 0.0f after failed convert");
     Check(Convert("kept", sizeof("kept")) == 0, "an existing save converts");
+    SaveDataEvent event{};
+    Check(sceSaveDataGetEventResult(nullptr, &event) == 0, "successful conversion queues completion");
+    Check(event.type == 5 && event.error_code == 0, "conversion event reports successful conversion");
+    Check(event.user_id == 0x10000000 && std::strcmp(event.dir_name.data, "kept") == 0, "conversion event identifies the user and save");
+    Check(sceSaveDataGetEventResult(nullptr, &event) == SaveDataErrorNotFound, "conversion event is delivered once");
     Check(Read(kept) == std::vector<char>{'d', 'a', 't', 'a'}, "the converted save keeps its files");
     Check(sceSaveDataGetConvertProgress(&progress) == 0, "get convert progress succeeds after successful convert");
     Check(progress == 1.0f, "convert progress reports 1.0f after successful convert");
diff --git a/core/libs/tests/GuestSaveDataDelete.cpp b/core/libs/tests/GuestSaveDataDelete.cpp
index 0ebbce1462..b84152d310 100644
--- a/core/libs/tests/GuestSaveDataDelete.cpp
+++ b/core/libs/tests/GuestSaveDataDelete.cpp
@@ -1,3 +1,6 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "SceTypes.hpp"
@@ -13,17 +16,6 @@
 #include <system_error>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataDelete(const SaveDataDelete*);
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataMount3(const SaveDataMount3*, SaveDataMountResult*);
-int APS5_VABI sceSaveDataUmount2(std::uint32_t, const SaveDataMountPoint*);
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-}
-
 namespace {
 
 constexpr int SaveDataErrorParameter = -2137063424;
diff --git a/core/libs/tests/GuestSaveDataDialog.cpp b/core/libs/tests/GuestSaveDataDialog.cpp
index 1c3ffc702d..e3f2ef95bf 100644
--- a/core/libs/tests/GuestSaveDataDialog.cpp
+++ b/core/libs/tests/GuestSaveDataDialog.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveDataDialog/include/Api.hpp"
+#include "prx/libSceSaveDataDialog.native/include/Api.hpp"
 #include "prx/libSceSaveDataDialog.native/SaveDataDialog.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -5,19 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceSaveDataDialogInitialize();
-int APS5_VABI sceSaveDataDialogOpen(const void* param);
-int APS5_VABI sceSaveDataDialogGetStatus();
-int APS5_VABI sceSaveDataDialogUpdateStatus();
-int APS5_VABI sceSaveDataDialogIsReadyToDisplay();
-int APS5_VABI sceSaveDataDialogProgressBarInc(int target, std::uint32_t delta);
-int APS5_VABI sceSaveDataDialogProgressBarSetValue(int target, std::uint32_t rate);
-int APS5_VABI sceSaveDataDialogClose(const void* param);
-int APS5_VABI sceSaveDataDialogGetResult(void* result);
-int APS5_VABI sceSaveDataDialogTerminate();
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -106,6 +95,38 @@ int main() {
     Require(sceSaveDataDialogTerminate() == 0, "terminate");
     Require(sceSaveDataDialogTerminate() == SAVE_DATA_DIALOG_ERROR_NOT_INITIALIZED, "terminate when already terminated");
     Require(sceSaveDataDialogGetStatus() == SAVE_DATA_DIALOG_STATUS_NONE, "terminated state");
+
+    Require(sceSaveDataDialogInitialize() == 0, "re-initialize for empty selection");
+    SaveDataDialogParam emptySelectionParam{};
+    emptySelectionParam.size = sizeof(emptySelectionParam);
+    emptySelectionParam.mode = 1;
+    Require(sceSaveDataDialogOpen(&emptySelectionParam) == 0, "open selection dialog without items");
+    Require(sceSaveDataDialogGetStatus() == SAVE_DATA_DIALOG_STATUS_FINISHED, "selection finishes immediately");
+    SaveDataDirName emptySelectionDir{};
+    std::memset(emptySelectionDir.data, 'X', sizeof(emptySelectionDir.data));
+    SaveDataDialogResult emptySelectionResult{};
+    emptySelectionResult.dir_name = &emptySelectionDir;
+    Require(sceSaveDataDialogGetResult(&emptySelectionResult) == 0, "read empty selection result");
+    Require(emptySelectionDir.data[0] == '\0', "empty selection directory name must be null-terminated");
+    Require(emptySelectionResult.mode == emptySelectionParam.mode &&
+            emptySelectionResult.result == SAVE_DATA_DIALOG_RESULT_OK, "selection result status");
+    Require(sceSaveDataDialogTerminate() == 0, "terminate selection");
+
+    Require(sceSaveDataDialogInitialize() == 0, "re-initialize for empty result");
+    param = {};
+    param.size = sizeof(param);
+    param.mode = SAVE_DATA_DIALOG_MODE_PROGRESS_BAR;
+    Require(sceSaveDataDialogOpen(&param) == 0, "open progress without items");
+    Require(sceSaveDataDialogClose(nullptr) == 0, "close empty progress");
+    Require(sceSaveDataDialogUpdateStatus() == SAVE_DATA_DIALOG_STATUS_FINISHED, "finish empty progress");
+    SaveDataDirName emptySelected{};
+    std::memset(emptySelected.data, 'X', sizeof(emptySelected.data));
+    SaveDataDialogResult emptyResult{};
+    emptyResult.dir_name = &emptySelected;
+    Require(sceSaveDataDialogGetResult(&emptyResult) == 0, "read empty result");
+    Require(emptySelected.data[0] == '\0', "empty directory name must be null-terminated");
+    Require(sceSaveDataDialogTerminate() == 0, "terminate empty progress");
+
     Require(sceSaveDataDialogProgressBarInc(0, 10) == SAVE_DATA_DIALOG_ERROR_NOT_RUNNING, "progress inc after terminate");
     Require(sceSaveDataDialogProgressBarSetValue(0, 50) == SAVE_DATA_DIALOG_ERROR_NOT_RUNNING, "progress set value after terminate");
 }
diff --git a/core/libs/tests/GuestSaveDataMountStatus.cpp b/core/libs/tests/GuestSaveDataMountStatus.cpp
index 88557e574d..6f9f2ed126 100644
--- a/core/libs/tests/GuestSaveDataMountStatus.cpp
+++ b/core/libs/tests/GuestSaveDataMountStatus.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
@@ -8,18 +10,6 @@
 #include <string>
 #include <system_error>
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataMount3(const SaveDataMount3*, SaveDataMountResult*);
-int APS5_VABI sceSaveDataUmount2(std::uint32_t, const SaveDataMountPoint*);
-int APS5_VABI sceSaveDataGetMountInfo(const SaveDataMountPoint*, SaveDataMountInfo*);
-int APS5_VABI sceSaveDataGetParam(const SaveDataMountPoint*, std::uint32_t, void*, std::size_t, std::size_t*);
-int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint*, std::uint32_t, const void*, std::size_t);
-int APS5_VABI sceSaveDataLoadIcon(const SaveDataMountPoint*, SaveDataIcon*);
-int APS5_VABI sceSaveDataSaveIcon(const SaveDataMountPoint*, const SaveDataIcon*);
-int APS5_VABI sceSaveDataSaveIconByPath(const SaveDataMountPoint*, const char*);
-}
-
 namespace {
 
 constexpr std::uint32_t MountReadWrite = 2;
@@ -61,6 +51,10 @@ void CheckUnmountedCalls() {
     Check(sceSaveDataSetParam(nullptr, 1, buf, sizeof(buf)) == SaveDataErrorParameter, "setParam null point is PARAMETER");
     Check(sceSaveDataSetParam(&point, 1, nullptr, sizeof(buf)) == SaveDataErrorParameter, "setParam null buf is PARAMETER");
     Check(sceSaveDataSetParam(&point, 1, buf, sizeof(buf)) == SaveDataErrorNotMounted, "setParam unmounted point is NOT_MOUNTED");
+    Check(sceSaveDataBackup(nullptr) == SaveDataErrorParameter, "backup null backup is PARAMETER");
+    SaveDataBackup nullDirBackup{};
+    Check(sceSaveDataBackup(&nullDirBackup) == SaveDataErrorParameter, "backup null dir_name is PARAMETER");
+    Check(sceSaveDataGetEventResult(nullptr, nullptr) == SaveDataErrorParameter, "getEventResult null event is PARAMETER");
 }
 
 void CheckMountInfoAndParam(const SaveDataMountPoint* point) {
diff --git a/core/libs/tests/GuestSaveDataPs4.cpp b/core/libs/tests/GuestSaveDataPs4.cpp
index 6ee6868bd4..d707094961 100644
--- a/core/libs/tests/GuestSaveDataPs4.cpp
+++ b/core/libs/tests/GuestSaveDataPs4.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
@@ -8,19 +10,13 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI sceSaveDataTransferringMountPs4(const SaveDataTransferringMount*, SaveDataMountResult*);
-extern "C" int APS5_VABI sceSaveDataDirNameSearchPs4(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-extern "C" int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-extern "C" int APS5_VABI sceSaveDataInitialize(const void*);
-extern "C" int APS5_VABI sceSaveDataTerminate();
-extern "C" int APS5_VABI sceSaveDataSetupSaveDataMemory(std::int32_t, std::size_t, const SaveDataParam*);
-extern "C" int APS5_VABI sceSaveDataSetSaveDataMemory(std::int32_t, void*, std::size_t, std::int64_t);
-extern "C" int APS5_VABI sceSaveDataGetSaveDataMemory(std::int32_t, void*, std::size_t, std::int64_t);
-
 namespace {
 
 constexpr int SaveDataErrorNotFound = -2137063416;
 constexpr int SaveDataErrorNotInitialized = -2137063423;
+constexpr int SaveDataErrorParameter = -2137063424;
+constexpr int SaveDataErrorNotMounted = -2137063420;
+constexpr std::uint32_t MountReadWrite = 2;
 
 int failures = 0;
 
@@ -53,6 +49,11 @@ void TestTransferringMountPs4() {
     std::memset(&result, 0xAA, sizeof(result));
     Check(sceSaveDataTransferringMountPs4(&mount, &result) == SaveDataErrorNotFound, "TransferringMountPs4 returns NOT_FOUND");
     Check(result.mount_point.data[0] == '\0', "TransferringMountPs4 reports no mount point");
+    std::memset(&result, 0xAA, sizeof(result));
+    Check(sceSaveDataTransferringMount(&mount, &result) == SaveDataErrorNotFound, "TransferringMount returns NOT_FOUND");
+    Check(result.mount_point.data[0] == '\0', "TransferringMount reports no mount point");
+    Check(sceSaveDataTransferringMount(nullptr, nullptr) == SaveDataErrorNotFound, "TransferringMount handles null arguments");
+    Check(sceSaveDataTransferringMountPs4(nullptr, nullptr) == SaveDataErrorNotFound, "TransferringMountPs4 handles null arguments");
 }
 
 void TestDirNameSearchPs4() {
@@ -96,6 +97,23 @@ void TestSaveDataMemoryV1() {
     Check(sceSaveDataTerminate() == 0, "Terminate after v1 Initialize");
 }
 
+void TestMountPs4() {
+    SaveDataMountResult result{};
+    Check(sceSaveDataMount(nullptr, &result) == SaveDataErrorParameter, "null mount is PARAMETER");
+    SaveDataMountPs4 mount{};
+    Check(sceSaveDataMount(&mount, &result) == SaveDataErrorParameter, "null dir_name is PARAMETER");
+    Check(sceSaveDataUmount(nullptr) == SaveDataErrorParameter, "umount null point is PARAMETER");
+    SceSaveDataDirName dir{};
+    std::strcpy(dir.data, "kept");
+    mount.dir_name = &dir;
+    mount.mount_mode = MountReadWrite;
+    Check(ThrowsRuntimeError([&] { sceSaveDataMount(&mount, nullptr); }), "null mount_result throws");
+    Check(sceSaveDataMount(&mount, &result) == 0, "mount existing save directory succeeds");
+    Check(result.mount_point.data[0] != '\0', "mount writes mount point");
+    Check(sceSaveDataUmount(&result.mount_point) == 0, "umount mounted point succeeds");
+    Check(sceSaveDataUmount(&result.mount_point) == SaveDataErrorNotMounted, "umount unmounted point is NOT_MOUNTED");
+}
+
 }
 
 int main() {
@@ -107,6 +125,7 @@ int main() {
     TestTransferringMountPs4();
     TestDirNameSearchPs4();
     TestSaveDataMemoryV1();
+    TestMountPs4();
 
     std::filesystem::current_path(previous);
     std::error_code error;
diff --git a/core/libs/tests/GuestSaveDataSearch.cpp b/core/libs/tests/GuestSaveDataSearch.cpp
index 47613690d3..f3b0b4382a 100644
--- a/core/libs/tests/GuestSaveDataSearch.cpp
+++ b/core/libs/tests/GuestSaveDataSearch.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -12,15 +13,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataDirNameSearch(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-int APS5_VABI sceSaveDataDirNameSearch2(const SaveDataDirNameSearchCond*, SaveDataDirNameSearchResult*);
-int APS5_VABI sceSaveDataMount3(const SaveDataMount3*, SaveDataMountResult*);
-int APS5_VABI sceSaveDataUmount2(std::uint32_t, const SaveDataMountPoint*);
-int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint*, std::uint32_t, const void*, std::size_t);
-int APS5_VABI sceSaveDataGetMountInfo(const SaveDataMountPoint*, SaveDataMountInfo*);
-}
-
 static constexpr int SaveDataErrorParameter = -2137063424;
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestScanCount.cpp b/core/libs/tests/GuestScanCount.cpp
index 1ddfe19674..9c2df500c0 100644
--- a/core/libs/tests/GuestScanCount.cpp
+++ b/core/libs/tests/GuestScanCount.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -8,9 +9,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" int APS5_VABI sscanf_s_nid_postfix(const char*, const char*, ...);
-extern "C" int APS5_VABI vsscanf_s_nid_postfix(const char*, const char*, VaList*);
-
 static int APS5_VABI ScanList(const char* input, const char* format, ...) {
 #ifdef _WIN32
     __builtin_sysv_va_list args;
diff --git a/core/libs/tests/GuestSceNet.cpp b/core/libs/tests/GuestSceNet.cpp
index 4eb69f493e..b973785b8c 100644
--- a/core/libs/tests/GuestSceNet.cpp
+++ b/core/libs/tests/GuestSceNet.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNetCtl/include/NetCtl.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #define WIN32_LEAN_AND_MEAN
 #include <io.h>
@@ -13,6 +17,7 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/Socket/include/SocketSelectDeadline.hpp"
 #include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libSceNet/src/ResolverTestHooks.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -31,123 +36,52 @@
 extern "C" {
 extern const std::uint8_t in6addr_any_nid_postfix[16];
 extern const std::uint8_t in6addr_loopback_nid_postfix[16];
-int APS5_VABI sceNetInit_nid_postfix(void);
-int APS5_VABI sceNetShowNetstatWithMemory(int);
-int APS5_VABI sceNetShowNetstat(void);
-int APS5_VABI sceNetShowIfconfig(void);
-int APS5_VABI sceNetShowRoute(void);
-int APS5_VABI sceNetShowRoute6(void);
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetListen(int, int);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetGetpeername(int, void*, std::uint32_t*);
-int APS5_VABI sceNetGetSockInfo(int, void*, int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetAccept(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetSend(int, const void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-int APS5_VABI sceNetSocketClose(int);
-int APS5_VABI sceNetSocketAbort(int, int);
-int APS5_VABI sceNetShutdown(int, int);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
-int* APS5_VABI sceNetErrnoLoc(void);
-int APS5_VABI sceNetEtherNtostr(const NetEtherAddr*, char*, std::size_t);
-int APS5_VABI sceNetEtherStrton(const char*, NetEtherAddr*);
-int APS5_VABI sceNetEpollCreate(const char*, int);
-int APS5_VABI sceNetEpollControl(int, int, int, const NetEpollEvent*);
-int APS5_VABI sceNetEpollWait(int, NetEpollEvent*, int, int);
-int APS5_VABI sceNetEpollDestroy(int);
-int APS5_VABI sceNetEpollAbort(int, int);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
+
 extern const std::uint32_t sce_net_in6addr_any[4];
 extern const std::uint8_t sce_net_in6addr_linklocal_allnodes[16];
-int APS5_VABI sceNetResolverCreate(const char*, int, int);
-int APS5_VABI sceNetResolverStartNtoa(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartNtoa6(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartNtoaMultipleRecordsEx(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartNtoaMultipleRecords(int, const char*, void*, int, int, int);
-int APS5_VABI sceNetResolverStartAton(int, const void*, char*, int, int, int, int);
-int APS5_VABI sceNetResolverStartAton6(int, const void*, char*, int, int, int, int);
-int APS5_VABI sceNetResolverAbort(int, int);
-int APS5_VABI sceNetResolverDestroy(int);
-int APS5_VABI sceNetResolverGetError(int, int*);
-int APS5_VABI sceNetClearDnsCache(int);
-int APS5_VABI sceNetGetDnsInfo(std::uint32_t*, int);
-int APS5_VABI sceNetCtlInit(void);
-int APS5_VABI sceNetCtlGetState(int*);
-int APS5_VABI sceNetCtlGetInfo(int, NetCtlInfo*);
-int APS5_VABI sceNetCtlGetIfStat(NetCtlIfStat*);
-int APS5_VABI sceNetCtlRegisterCallback(NetCtlCallback, void*, int*);
-int APS5_VABI sceNetCtlUnregisterCallback(int);
-int APS5_VABI sceNetCtlRegisterCallbackV6(NetCtlCallback, void*, int*);
-int APS5_VABI sceNetCtlUnregisterCallbackV6(int);
+
 std::uint64_t NetCtlReadByteCounter_nid_no_patch(const char*);
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
+
 bool GuestSocketIsOpen_nid_no_patch(int);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-struct GuestPollEntry {
-    int descriptor;
-    short events;
-    short revents;
-};
-int APS5_VABI poll_nid_postfix(GuestPollEntry*, std::uint32_t, int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetInetPton(int, const char*, void*);
-int APS5_VABI sceNetInetPtonEx(int, const char*, void*, int);
-int APS5_VABI sceNetUsleep(int);
-void APS5_VABI sceNetGetSystemTime(std::uint64_t*);
-const char* APS5_VABI sceNetInetNtop(int, const void*, char*, std::uint32_t);
-int* APS5_VABI sceNetErrnoLoc(void);
-}
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t name_length;
-    NetIovec* iov;
-    int iov_length;
-    void* control;
-    std::uint32_t control_length;
-    int flags;
-};
-
-struct NetMemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-};
-
-extern "C" {
-std::int64_t APS5_VABI sceNetSendmsg(int, const NetMsghdr*, int);
-std::int64_t APS5_VABI sceNetRecvmsg(int, NetMsghdr*, int);
-int APS5_VABI sceNetPoolCreate(const char*, int, int);
-int APS5_VABI sceNetPoolDestroy(int);
-int APS5_VABI sceNetGetMemoryPoolStats(int, NetMemoryPoolStats*);
-const char* APS5_VABI sceNetGetIfName(std::uint32_t);
-int APS5_VABI sceNetGetRandom(std::uint32_t*);
-void* APS5_VABI sceNetMemoryAllocate(std::int32_t, int);
-void APS5_VABI sceNetMemoryFree(void*);
 }
 
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
 
+static bool FailResolverLookup(const char* hostname, int family, std::vector<std::array<std::uint8_t, 16>>&) {
+    Require(hostname != nullptr && (std::strcmp(hostname, "guest-sce-net.invalid.") == 0 ||
+        std::strcmp(hostname, "guest-sce-net.invalid") == 0));
+    Require(family == AF_INET || family == AF_INET6);
+    return false;
+}
+
+class ScopedResolverLookupOverride {
+public:
+    explicit ScopedResolverLookupOverride(GuestSceNetTest::ResolverLookup lookup) {
+        GuestSceNetTest::SetResolverLookupForTests_nid_no_patch(lookup);
+    }
+    ~ScopedResolverLookupOverride() {
+        GuestSceNetTest::SetResolverLookupForTests_nid_no_patch(nullptr);
+    }
+};
+
 static void APS5_VABI IgnoreNetCtlEvent(int, void*) {}
 
+struct NetCtlEventRecord {
+    int calls = 0;
+    int event = 0;
+    void* arg = nullptr;
+};
+
+static void APS5_VABI RecordNetCtlEvent(int event, void* arg) {
+    auto* record = static_cast<NetCtlEventRecord*>(arg);
+    ++record->calls;
+    record->event = event;
+    record->arg = arg;
+}
+
 static bool Failed(std::int64_t result, int error) {
     return result == static_cast<int>(0x80410100u | static_cast<unsigned>(error)) && *sceNetErrnoLoc() == error;
 }
@@ -251,11 +185,15 @@ static void CheckNetstat() {
         }
         Require(unsupported);
     }
+    Require(sceNetShowPolicy() == 0);
+    Require(sceNetShowNetstatEx(0) == 0);
     Require(sceNetShowRoute() == 0);
     Require(sceNetShowRoute6() == 0);
     Require(Failed(sceNetShowNetstatWithMemory(-1), 9));
+    Require(Failed(sceNetShowRouteWithMemory(-1), 9));
     const int pool = sceNetPoolCreate("netstat", 4096, 0);
     Require(pool > 0);
+    Require(sceNetShowRouteWithMemory(pool) == 0);
     const auto empty = CaptureNetstat(pool);
     Require(empty.find("bytes=4096 sockets=0") != std::string::npos);
     const int socket = sceNetSocket("netstat", 2, 1, 0);
@@ -276,6 +214,7 @@ static void CheckNetstat() {
     Require(CaptureNetstat(pool).find("sockets=0") != std::string::npos);
     Require(sceNetPoolDestroy(pool) == 0);
     Require(Failed(sceNetShowNetstatWithMemory(pool), 9));
+    Require(Failed(sceNetShowRouteWithMemory(pool), 9));
 }
 
 static void CheckPoolStats() {
@@ -307,14 +246,20 @@ static void CheckRandom() {
     Require(Failed(sceNetGetRandom(nullptr), 22));
     std::array<std::uint32_t, 8> values{};
     for (auto& value : values) Require(sceNetGetRandom(&value) == 0);
+    std::array<std::uint32_t, 2> guarded{0x5a5a5a5au, 0x5a5a5a5au};
+    Require(sceNetGetRandom(guarded.data()) == 0 && guarded[1] == 0x5a5a5a5au && *sceNetErrnoLoc() == 22);
     Require(std::any_of(values.begin() + 1, values.end(), [&](std::uint32_t value) { return value != values[0]; }));
 }
 
 static void CheckNetMemory() {
-    Require(sceNetMemoryAllocate(0, 0) == nullptr);
-    Require(sceNetMemoryAllocate(-1, 2) == nullptr);
-    Require(sceNetMemoryAllocate(0, 4) == nullptr);
-    Require(sceNetMemoryAllocate(INT32_MIN, -1) == nullptr);
+    *sceNetErrnoLoc() = 33;
+    for (const std::int32_t size : {0, -1, INT32_MIN}) {
+        Require(sceNetMemoryAllocate(size, 0) == nullptr);
+        Require(sceNetMemoryAllocate(size, 2) == nullptr);
+        Require(sceNetMemoryAllocate(size, 4) == nullptr);
+        Require(sceNetMemoryAllocate(size, -1) == nullptr);
+    }
+    Require(*sceNetErrnoLoc() == 33);
     auto* zeroed = static_cast<std::uint8_t*>(sceNetMemoryAllocate(4096, 2));
     Require(zeroed != nullptr);
     Require(std::all_of(zeroed, zeroed + 4096, [](std::uint8_t byte) { return byte == 0; }));
@@ -325,20 +270,20 @@ static void CheckNetMemory() {
     Require(zeroed[4095] == 0xa5);
     sceNetMemoryFree(plain);
     sceNetMemoryFree(zeroed);
+    for (const int flags : {1, 3, 4, 6, 8, 0x10, 0x100, 0x40000001, -5, INT32_MIN}) {
+        auto* block = static_cast<std::uint8_t*>(sceNetMemoryAllocate(16, flags));
+        Require(block != nullptr && reinterpret_cast<std::uintptr_t>(block) % 64 == 0);
+        if ((flags & 2) != 0) Require(std::all_of(block, block + 16, [](std::uint8_t byte) { return byte == 0; }));
+        std::memset(block, 0x5a, 16);
+        sceNetMemoryFree(block);
+    }
+    for (const std::int32_t size : {1, 7, 256, 65536}) {
+        void* block = sceNetMemoryAllocate(size, 0);
+        Require(block != nullptr && reinterpret_cast<std::uintptr_t>(block) % 64 == 0);
+        sceNetMemoryFree(block);
+    }
     sceNetMemoryFree(nullptr);
-    for (const int flags : {1, 0x40000001, -5}) {
-        auto* allocation = static_cast<std::uint8_t*>(sceNetMemoryAllocate(16, flags));
-        Require(allocation != nullptr);
-        if ((flags & 2) != 0) Require(std::all_of(allocation, allocation + 16, [](std::uint8_t byte) { return byte == 0; }));
-        sceNetMemoryFree(allocation);
-    }
-    bool threw = false;
-    try {
-        sceNetMemoryAllocate(16, 4);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
+    Require(*sceNetErrnoLoc() == 33);
 }
 
 static void CheckUnboundSocketName() {
@@ -598,6 +543,36 @@ static void CheckReceiveTimeout(int receiver, int sender, const std::array<std::
     Require(sceNetSetsockopt(receiver, 0xffff, 0x1006, &disabled, sizeof(disabled)) == 0);
 }
 
+static void CheckStreamReceiveTimeout() {
+    const int listener = sceNetSocket("stream-timeout", 2, 1, 6);
+    Require(listener >= 0);
+    std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(sceNetBind_nid_postfix(listener, address.data(), address.size()) == 0 && sceNetListen(listener, 1) == 0);
+    std::uint32_t size = address.size();
+    Require(sceNetGetsockname(listener, address.data(), &size) == 0);
+    const int client = sceNetSocket("stream-timeout-client", 2, 1, 6);
+    Require(client >= 0 && sceNetConnect(client, address.data(), address.size()) == 0);
+    const int accepted = sceNetAccept(listener, nullptr, nullptr);
+    Require(accepted >= 0);
+    const KernelTimeval timeout{0, 50000};
+    Require(sceNetSetsockopt(client, 0xffff, 0x1006, &timeout, sizeof(timeout)) == 0);
+    char buffer[8]{};
+    NetIovec in[] = {{buffer, sizeof(buffer)}};
+    NetMsghdr receive{nullptr, 0, in, 1, nullptr, 0, 0};
+    const auto start = std::chrono::steady_clock::now();
+    Require(Failed(sceNetRecv(client, buffer, sizeof(buffer), 0), 35));
+    Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(40));
+    Require(Failed(sceNetRecvfrom(client, buffer, sizeof(buffer), 0, nullptr, nullptr), 35));
+    Require(Failed(sceNetRecvmsg(client, &receive, 0), 35));
+    const char payload[] = "late";
+    Require(sceNetSend(accepted, payload, sizeof(payload), 0) == sizeof(payload));
+    Require(sceNetRecv(client, buffer, sizeof(buffer), 0) == sizeof(payload) && std::strcmp(buffer, payload) == 0);
+    Require(sceNetSend(client, payload, sizeof(payload), 0) == sizeof(payload));
+    std::memset(buffer, 0, sizeof(buffer));
+    Require(sceNetRecv(accepted, buffer, sizeof(buffer), 0) == sizeof(payload) && std::strcmp(buffer, payload) == 0);
+    for (const int descriptor : {client, accepted, listener}) Require(sceNetSocketClose(descriptor) == 0);
+}
+
 static void CheckMicrosecondTimeouts(int receiver) {
     const int receiveTimeout = 50000;
     const int sendTimeout = 70000;
@@ -761,6 +736,57 @@ static void CheckKernelTimeouts() {
     Require(sceNetSocketClose(descriptor) == 0);
 }
 
+static void CheckIoctl() {
+    const int socket = sceNetSocket("ioctl", 2, 2, 17);
+    Require(socket >= 0);
+    std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(sceNetBind_nid_postfix(socket, address.data(), address.size()) == 0);
+    std::uint32_t size = address.size();
+    Require(sceNetGetsockname(socket, address.data(), &size) == 0 && size == address.size());
+    for (const int enabled : {1, 0, 7}) {
+        int value = enabled;
+        Require(sceNetIoctl(socket, 0x8004667e, &value) == 0);
+        int nonblocking = -1;
+        std::uint32_t length = sizeof(nonblocking);
+        Require(sceNetGetsockopt(socket, 0xffff, 0x1200, &nonblocking, &length) == 0 && nonblocking == (enabled != 0 ? 1 : 0));
+        Require(fcntl_nid_postfix(socket, 3) == (enabled != 0 ? 2 | 4 : 2));
+    }
+    int disabled = 0;
+    int enabled = 1;
+    Require(sceNetIoctl(socket, 0x8004667e, &enabled) == 0);
+    char buffer[8]{};
+    Require(Failed(sceNetRecv(socket, buffer, sizeof(buffer), 0), 35));
+    int readable = -1;
+    Require(sceNetIoctl(socket, 0x4004667f, &readable) == 0 && readable == 0);
+    const char payload[5] = {'i', 'o', 'c', 't', 'l'};
+    Require(sceNetSendto(socket, payload, sizeof(payload), 0, address.data(), address.size()) == sizeof(payload));
+    GuestPollDescriptor entry{socket, 1, 0};
+    Require(poll_nid_postfix(&entry, 1, 1000) == 1 && entry.revents == 1);
+    Require(sceNetIoctl(socket, 0x4004667f, &readable) == 0 && readable == sizeof(payload));
+    Require(sceNetRecv(socket, buffer, sizeof(buffer), 0) == sizeof(payload));
+    Require(sceNetIoctl(socket, 0x4004667f, &readable) == 0 && readable == 0);
+    Require(Failed(sceNetIoctl(socket, 0x8004667e, nullptr), 14));
+    Require(Failed(sceNetIoctl(socket, 0x4004667f, nullptr), 14));
+    Require(Failed(sceNetIoctl(socket, 123, &readable), 25));
+    Require(Failed(sceNetIoctl(socket, 123, nullptr), 25));
+    Require(sceNetSocketClose(socket) == 0);
+    Require(Failed(sceNetIoctl(socket, 0x8004667e, &enabled), 9));
+    Require(Failed(sceNetIoctl(-1, 0x4004667f, &readable), 9));
+    const int random = open_nid_postfix("/dev/urandom", 0, 0);
+    Require(random >= 0);
+    Require(Failed(sceNetIoctl(random, 0x4004667f, &readable), 9));
+    Require(close_nid_postfix(random) == 0);
+
+    const int kernel = socket_nid_postfix(2, 2, 0);
+    Require(kernel >= 0);
+    std::array<std::uint8_t, 16> kernelAddress{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(kernel, kernelAddress.data(), kernelAddress.size()) == 0);
+    Require(sceNetIoctl(kernel, 0x8004667e, &enabled) == 0 && fcntl_nid_postfix(kernel, 3) == (2 | 4));
+    Require(sceNetIoctl(kernel, 0x8004667e, &disabled) == 0 && fcntl_nid_postfix(kernel, 3) == 2);
+    Require(sceNetIoctl(kernel, 0x4004667f, &readable) == 0 && readable == 0);
+    Require(close_nid_postfix(kernel) == 0);
+}
+
 static void CheckKernelStatusFlags() {
     const int descriptor = sceNetSocket("kernel-status", 2, 1, 6);
     Require(descriptor >= 0);
@@ -820,9 +846,24 @@ static void CheckInetPtonWhitespace() {
     for (const char* text : {" 1.2.3.4", "1.2.3.4x", "1.2.3.4.", "1.2.3.4\x01", "1.2.3.4\xa0", "1.2. 3.4", "1.2.3", "1.2.3 ", "01.2.3.4", "256.0.0.1"}) {
         CheckInetPtonRejects(2, text);
     }
-    for (const char* text : {"::1 ", "::1\t", " ::1", "::1x"}) {
+    for (const char* text : {"::1 ", "::1\t", " ::1", "::1x", "::ffff:1.2.3.4x", "::ffff:1.2.3.4\x01", "::ffff:01.2.3.4", "::ffff:1.2.3",
+                             "::ffff:0x1.2.3.4", "::ffff ", "::ffff:1.2 .3.4"}) {
         CheckInetPtonRejects(28, text);
     }
+    for (const char* text : {"::ffff:1.2.3.4 x", "::ffff:1.2.3.4\t", "::ffff:1.2.3.4\nzz", "::ffff:1.2.3.4 "}) {
+        std::array<std::uint8_t, 16> address{};
+        *sceNetErrnoLoc() = 123;
+        Require(sceNetInetPton(28, text, address.data()) == 1 && *sceNetErrnoLoc() == 123);
+        Require(address[10] == 0xff && address[11] == 0xff && address[12] == 1 && address[15] == 4);
+    }
+    std::array<std::uint8_t, 16> full{};
+    Require(sceNetInetPton(28, "1:2:3:4:5:6:1.2.3.4 z", full.data()) == 1 && full[1] == 1 && full[11] == 6 && full[12] == 1 && full[15] == 4);
+    *sceNetErrnoLoc() = 123;
+    Require(sceNetInetPton(2, "1.2.3.4", nullptr) == 1 && *sceNetErrnoLoc() == 123);
+    Require(sceNetInetPton(2, "abc", nullptr) == 0 && *sceNetErrnoLoc() == 123);
+    Require(sceNetInetPton(28, "::1", nullptr) < 0 && *sceNetErrnoLoc() == 22);
+    *sceNetErrnoLoc() = 123;
+    Require(sceNetInetPton(28, nullptr, full.data()) < 0 && *sceNetErrnoLoc() == 22);
 }
 
 struct AtonCase {
@@ -878,7 +919,9 @@ static void CheckInetPtonEx() {
     Require(sceNetInetPtonEx(2, "not an address", address.data(), 0) == 0);
     Require(Failed(sceNetInetPtonEx(99, "127.0.0.1", address.data(), 0), 47));
     Require(Failed(sceNetInetPtonEx(2, nullptr, address.data(), 0), 22));
-    Require(Failed(sceNetInetPtonEx(2, "127.0.0.1", nullptr, 0), 22));
+    *sceNetErrnoLoc() = 123;
+    Require(sceNetInetPtonEx(2, "127.0.0.1", nullptr, 0) == 1 && *sceNetErrnoLoc() == 123);
+    Require(sceNetInetPtonEx(2, "abc", nullptr, 0) == 0 && *sceNetErrnoLoc() == 123);
     for (const int flags : {1, 0x100, -1}) {
         address.fill(0);
         Require(sceNetInetPtonEx(2, "1.2.3", address.data(), flags) == 1);
@@ -1004,6 +1047,8 @@ static void CheckUsleep() {
     Require(std::chrono::steady_clock::now() - start >= std::chrono::microseconds(2000));
     *sceNetErrnoLoc() = 0;
     Require(Failed(sceNetUsleep(-1), 22));
+    *sceNetErrnoLoc() = 0;
+    Require(Failed(sceNetUsleep(INT32_MIN), 22));
 }
 
 static void CheckEpollIdent() {
@@ -1428,7 +1473,7 @@ static std::vector<int> RequireSockInfoList(int flags) {
         int socket = 0;
         std::memcpy(&socket, &listed[0x24], sizeof(socket));
         Require(sockets.empty() || socket > sockets.back());
-        std::array<std::uint8_t, 0xa0> single;
+        alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> single;
         Require(sceNetGetSockInfo(socket, single.data(), 1, 0) == 1 && std::equal(single.begin(), single.end(), listed));
         sockets.push_back(socket);
     }
@@ -1475,7 +1520,7 @@ static void CheckSockInfo() {
     Require(sceNetSetsockopt(datagram, 0xffff, 0x1001, &buffers[1], sizeof(buffers[1])) == 0);
     const auto configured = RequireSockInfo(datagram, 2, 0x200001, datagramAddress, listening);
     Require(std::memcmp(configured.data() + 0x64, buffers.data(), sizeof(buffers)) == 0);
-    std::array<std::uint8_t, 0xa0> record;
+    alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> record;
     record.fill(0xa5);
     Require(Failed(sceNetGetSockInfo(datagram, nullptr, 1, 0), 22));
     Require(Failed(sceNetGetSockInfo(datagram, record.data(), 0, 0), 22));
@@ -1498,6 +1543,185 @@ static void CheckSockInfo() {
     Require(RequireSockInfoList(0) == earlier);
 }
 
+static std::array<std::uint8_t, 0xa0> RequireSockInfo6(int socket, int type, bool ipv6, bool nonblock, const std::array<std::uint8_t, 28>& local,
+    const std::array<std::uint8_t, 28>& remote, int requestFlags) {
+    std::array<std::uint8_t, 0x140> records;
+    records.fill(0xa5);
+    Require(sceNetGetSockInfo6(socket, reinterpret_cast<NetSockInfo6*>(records.data()), 2, requestFlags) == 1);
+    std::array<std::uint8_t, 0xa0> expected{};
+    std::memcpy(expected.data() + 0x24, &socket, sizeof(socket));
+    expected[0x28] = static_cast<std::uint8_t>(type);
+    if (ipv6) {
+        std::memcpy(expected.data() + 0x6c, local.data() + 8, 16);
+        std::memcpy(expected.data() + 0x7c, remote.data() + 8, 16);
+    } else {
+        std::memcpy(expected.data() + 0x34, local.data() + 4, 4);
+        std::memcpy(expected.data() + 0x38, remote.data() + 4, 4);
+    }
+    std::memcpy(expected.data() + 0x3c, local.data() + 2, 2);
+    std::memcpy(expected.data() + 0x3e, remote.data() + 2, 2);
+    const int flags = 1 | (nonblock ? 0x200000 : 0) | (ipv6 ? 0x400000 : 0);
+    std::memcpy(expected.data() + 0x48, &flags, sizeof(flags));
+    for (const auto [offset, option] : {std::array{0x64, 0x1002}, std::array{0x68, 0x1001}}) {
+        int size = 0;
+        std::uint32_t length = sizeof(size);
+        Require(sceNetGetsockopt(socket, 0xffff, option, &size, &length) == 0 && size > 0);
+        std::memcpy(expected.data() + offset, &size, sizeof(size));
+    }
+    Require(std::equal(expected.begin(), expected.end(), records.begin()));
+    Require(std::all_of(records.begin() + 0xa0, records.end(), [](auto byte) { return byte == 0xa5; }));
+    return expected;
+}
+
+static std::vector<int> RequireSockInfo6List(int flags) {
+    const int count = sceNetGetSockInfo6(-1, nullptr, 0, flags);
+    Require(count >= 0);
+    std::vector<std::uint8_t> records(static_cast<std::size_t>(count + 1) * 0xa0, 0xa5);
+    Require(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(records.data()), count + 1, flags) == count);
+    Require(std::all_of(records.end() - 0xa0, records.end(), [](auto byte) { return byte == 0xa5; }));
+    std::vector<std::uint8_t> unbounded(records.size(), 0xa5);
+    Require(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(unbounded.data()), INT32_MAX, flags) == count && unbounded == records);
+    std::vector<int> sockets;
+    for (int index = 0; index < count; ++index) {
+        const auto listed = records.begin() + index * 0xa0;
+        int socket = 0;
+        int status = 0;
+        std::memcpy(&socket, &listed[0x24], sizeof(socket));
+        std::memcpy(&status, &listed[0x48], sizeof(status));
+        Require(sockets.empty() || socket > sockets.back());
+        Require((flags & 0x1000) != 0 || (status & 0x400000) != 0);
+        alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> single;
+        Require(sceNetGetSockInfo6(socket, reinterpret_cast<NetSockInfo6*>(single.data()), 1, flags) == 1 && std::equal(single.begin(), single.end(), listed));
+        sockets.push_back(socket);
+    }
+    for (const int limit : {1, 2}) {
+        const int written = std::min(count, limit);
+        std::vector<std::uint8_t> limited(records.size(), 0xa5);
+        Require(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(limited.data()), limit, flags) == written);
+        Require(std::equal(limited.begin(), limited.begin() + written * 0xa0, records.begin()));
+        Require(std::all_of(limited.begin() + written * 0xa0, limited.end(), [](auto byte) { return byte == 0xa5; }));
+    }
+    return sockets;
+}
+
+static std::vector<int> WithSockets(std::vector<int> sockets, std::initializer_list<int> added) {
+    sockets.insert(sockets.end(), added);
+    std::sort(sockets.begin(), sockets.end());
+    return sockets;
+}
+
+static void CheckSockInfo6() {
+    const auto earlier = RequireSockInfo6List(0);
+    const auto earlierAll = RequireSockInfo6List(0x1000);
+    Require(RequireSockInfo6List(0x40) == earlier && RequireSockInfo6List(0x1040) == earlierAll);
+    Require(std::includes(earlierAll.begin(), earlierAll.end(), earlier.begin(), earlier.end()));
+
+    const std::array<std::uint8_t, 28> unnamed{};
+    const int datagram = sceNetSocket("sockinfo6-inet", 2, 2, 17);
+    Require(datagram >= 0);
+    std::array<std::uint8_t, 28> inetAddress{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(sceNetBind_nid_postfix(datagram, inetAddress.data(), 16) == 0);
+    std::uint32_t size = 16;
+    Require(sceNetGetsockname(datagram, inetAddress.data(), &size) == 0 && size == 16);
+    const int nonblocking = 1;
+    Require(sceNetSetsockopt(datagram, 0xffff, 0x1200, &nonblocking, sizeof(nonblocking)) == 0);
+    RequireSockInfo6(datagram, 2, false, true, inetAddress, unnamed, 0x1000);
+    RequireSockInfo6(datagram, 2, false, true, inetAddress, unnamed, 0x1040);
+
+    alignas(NetSockInfo6) std::array<std::uint8_t, 0xa0> record;
+    record.fill(0xa5);
+    const auto untouched = [&record] { return std::all_of(record.begin(), record.end(), [](auto byte) { return byte == 0xa5; }); };
+    Require(Failed(sceNetGetSockInfo6(datagram, nullptr, 1, 0x1000), 22));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 0, 0x1000), 22));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), -1, 0x1000), 22));
+    Require(Failed(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(record.data()), 0, 0), 22));
+    Require(Failed(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(record.data()), -5, 0x1000), 22));
+    for (const int flags : {1, 0x41, 0x80, 0x1001, 0x2000, 0x400000, 0x1048}) {
+        Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 22));
+        Require(Failed(sceNetGetSockInfo6(-1, nullptr, 0, flags), 22));
+        Require(Failed(sceNetGetSockInfo6(-1, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 22));
+    }
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0), 47));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0x40), 47));
+    Require(untouched());
+    const int closed = sceNetSocket("sockinfo6-closed", 2, 2, 17);
+    Require(closed >= 0 && sceNetSocketClose(closed) == 0);
+    for (const int flags : {0, 0x40, 0x1000, 0x1040}) {
+        Require(Failed(sceNetGetSockInfo6(closed, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 9));
+        Require(Failed(sceNetGetSockInfo6(INT32_MAX, reinterpret_cast<NetSockInfo6*>(record.data()), 1, flags), 9));
+    }
+    Require(untouched());
+    Require(RequireSockInfo6List(0) == earlier);
+    Require(RequireSockInfo6List(0x1000) == WithSockets(earlierAll, {datagram}));
+
+    if (ipv6Unavailable) {
+        Require(sceNetSocketClose(datagram) == 0);
+        Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0x1000), 9));
+        Require(RequireSockInfo6List(0x1000) == earlierAll);
+        return;
+    }
+
+    const int udp = sceNetSocket("sockinfo6-datagram", 28, 2, 17);
+    Require(udp >= 0);
+    RequireSockInfo6(udp, 2, true, false, unnamed, unnamed, 0);
+    std::array<std::uint8_t, 28> udpAddress{28, 28};
+    udpAddress[23] = 1;
+    Require(sceNetBind_nid_postfix(udp, udpAddress.data(), udpAddress.size()) == 0);
+    size = udpAddress.size();
+    Require(sceNetGetsockname(udp, udpAddress.data(), &size) == 0 && size == udpAddress.size());
+    Require(udpAddress[2] != 0 || udpAddress[3] != 0);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0x40);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0x1000);
+    RequireSockInfo6(udp, 2, true, false, udpAddress, unnamed, 0x1040);
+
+    const int listener = sceNetSocket("sockinfo6-listener", 28, 1, 6);
+    std::array<std::uint8_t, 28> listening{28, 28};
+    listening[23] = 1;
+    Require(listener >= 0 && sceNetBind_nid_postfix(listener, listening.data(), listening.size()) == 0 && sceNetListen(listener, 1) == 0);
+    size = listening.size();
+    Require(sceNetGetsockname(listener, listening.data(), &size) == 0 && size == listening.size());
+    RequireSockInfo6(listener, 1, true, false, listening, unnamed, 0);
+    const int client = sceNetSocket("sockinfo6-client", 28, 1, 6);
+    Require(client >= 0 && sceNetConnect(client, listening.data(), listening.size()) == 0);
+    const int accepted = sceNetAccept(listener, nullptr, nullptr);
+    Require(accepted >= 0);
+    std::array<std::uint8_t, 28> clientAddress{};
+    size = clientAddress.size();
+    Require(sceNetGetsockname(client, clientAddress.data(), &size) == 0 && size == clientAddress.size());
+    Require(clientAddress[2] != 0 || clientAddress[3] != 0);
+    RequireSockInfo6(client, 1, true, false, clientAddress, listening, 0);
+    RequireSockInfo6(accepted, 1, true, false, listening, clientAddress, 0);
+
+    const int peer = sceNetSocket("sockinfo6-peer", 28, 2, 17);
+    std::array<std::uint8_t, 28> peerAddress{28, 28};
+    peerAddress[23] = 1;
+    Require(peer >= 0 && sceNetBind_nid_postfix(peer, peerAddress.data(), peerAddress.size()) == 0);
+    size = peerAddress.size();
+    Require(sceNetGetsockname(peer, peerAddress.data(), &size) == 0 && size == peerAddress.size());
+    Require(sceNetConnect(peer, udpAddress.data(), udpAddress.size()) == 0);
+    RequireSockInfo6(peer, 2, true, false, peerAddress, udpAddress, 0);
+    const std::array<int, 2> buffers{65536, 32768};
+    Require(sceNetSetsockopt(peer, 0xffff, 0x1200, &nonblocking, sizeof(nonblocking)) == 0);
+    Require(sceNetSetsockopt(peer, 0xffff, 0x1002, &buffers[0], sizeof(buffers[0])) == 0);
+    Require(sceNetSetsockopt(peer, 0xffff, 0x1001, &buffers[1], sizeof(buffers[1])) == 0);
+    const auto configured = RequireSockInfo6(peer, 2, true, true, peerAddress, udpAddress, 0);
+    Require(std::memcmp(configured.data() + 0x64, buffers.data(), sizeof(buffers)) == 0);
+    Require(std::all_of(configured.begin() + 0x34, configured.begin() + 0x3c, [](auto byte) { return byte == 0; }));
+    Require(sceNetGetSockInfo6(peer, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0x1040) == 1 && std::equal(configured.begin(), configured.end(), record.begin()));
+
+    Require(RequireSockInfo6List(0) == WithSockets(earlier, {udp, listener, client, accepted, peer}));
+    Require(RequireSockInfo6List(0x40) == WithSockets(earlier, {udp, listener, client, accepted, peer}));
+    Require(RequireSockInfo6List(0x1000) == WithSockets(earlierAll, {datagram, udp, listener, client, accepted, peer}));
+    Require(Failed(sceNetGetSockInfo6(datagram, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0), 47));
+
+    for (const int descriptor : {peer, accepted, client, listener, udp}) Require(sceNetSocketClose(descriptor) == 0);
+    Require(Failed(sceNetGetSockInfo6(udp, reinterpret_cast<NetSockInfo6*>(record.data()), 1, 0), 9));
+    Require(RequireSockInfo6List(0) == earlier);
+    Require(sceNetSocketClose(datagram) == 0);
+    Require(RequireSockInfo6List(0x1000) == earlierAll);
+}
+
 static void CheckDatagramDisconnect() {
     const int peer = sceNetSocket("disconnect-peer", 2, 2, 17);
     const int other = sceNetSocket("disconnect-other", 2, 2, 17);
@@ -1597,6 +1821,7 @@ int main() {
     CheckDatagramDisconnect();
     CheckCloseKernelSocket();
     CheckSockInfo();
+    CheckSockInfo6();
 
     const int closed = sceNetSocket("closed-by-kernel", 2, 2, 17);
     Require(closed >= 0);
@@ -1609,6 +1834,7 @@ int main() {
     CheckKernelTimeouts();
     CheckSocketError();
     CheckKernelStatusFlags();
+    CheckIoctl();
 
     const int listener = sceNetSocket(nullptr, 2, 1, 6);
     Require(listener >= 0);
@@ -1754,12 +1980,12 @@ int main() {
     Require(select_nid_postfix(std::max(kernel_socket, udp_sender) + 1, nullptr, mixed_writable, nullptr, wait_second) == 2);
     Require(((mixed_writable[kernel_socket / 64] >> (kernel_socket % 64)) & 1u) != 0);
     Require(((mixed_writable[udp_sender / 64] >> (udp_sender % 64)) & 1u) != 0);
-    GuestPollEntry net_read{udp_receiver, 1, 0};
+    GuestPollDescriptor net_read{udp_receiver, 1, 0};
     Require(poll_nid_postfix(&net_read, 1, 0) == 0 && net_read.revents == 0);
     Require(sceNetSendto(udp_sender, datagram, sizeof(datagram), 0, address.data(), address.size()) == sizeof(datagram));
     Require(poll_nid_postfix(&net_read, 1, 1000) == 1 && net_read.revents == 1);
     Require(sceNetRecvfrom(udp_receiver, datagram_result, sizeof(datagram_result), 0, nullptr, nullptr) == sizeof(datagram_result));
-    GuestPollEntry mixed_poll[2]{{kernel_socket, 4, 0}, {udp_sender, 4, 0}};
+    GuestPollDescriptor mixed_poll[2]{{kernel_socket, 4, 0}, {udp_sender, 4, 0}};
     Require(poll_nid_postfix(mixed_poll, 2, 1000) == 2 && mixed_poll[0].revents == 4 && mixed_poll[1].revents == 4);
     Require(close_nid_postfix(kernel_socket) == 0);
     std::uint64_t stdio_readable[16]{1};
@@ -1769,6 +1995,7 @@ int main() {
     stdio_readable[0] = 1;
     Require(select_nid_postfix(1, stdio_readable, nullptr, nullptr, poll_now) == 0 && stdio_readable[0] == 0);
     CheckReceiveTimeout(udp_receiver, udp_sender, address);
+    CheckStreamReceiveTimeout();
     CheckMicrosecondTimeouts(udp_receiver);
     CheckMessages(udp_receiver, udp_sender, address);
     Require(sceNetSocketClose(udp_sender) == 0);
@@ -1779,8 +2006,13 @@ int main() {
     int resolver_error = -1;
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
     std::array<std::uint8_t, 4> ipv4{};
-    Require(sceNetResolverStartNtoa(resolver, "guest-sce-net.invalid.", ipv4.data(), 5000000, 1, 0) ==
-        static_cast<int>(0x804101E1));
+    ipv4.fill(0xA5);
+    {
+        ScopedResolverLookupOverride lookupOverride(FailResolverLookup);
+        Require(sceNetResolverStartNtoa(resolver, "guest-sce-net.invalid.", ipv4.data(), 5000000, 1, 0) ==
+            static_cast<int>(0x804101E1));
+    }
+    Require(std::all_of(ipv4.begin(), ipv4.end(), [](std::uint8_t byte) { return byte == 0xA5; }));
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 &&
         resolver_error == static_cast<int>(0x804101E1));
     Require(sceNetResolverStartNtoa(resolver, nullptr, ipv4.data(), 5000000, 1, 0) == static_cast<int>(0x80410116));
@@ -1794,13 +2026,15 @@ int main() {
     Require(std::all_of(resolved6.begin(), resolved6.end() - 1, [](std::uint8_t byte) { return byte == 0; }) && resolved6[15] == 1);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
     Require(sceNetResolverStartNtoa6(resolver, nullptr, resolved6.data(), 5000000, 1, 0) == static_cast<int>(0x80410116));
+    const auto resolved6BeforeFailure = resolved6;
     Require(sceNetResolverStartNtoa6(resolver, "127.0.0.1", resolved6.data(), 5000000, 1, 0) == static_cast<int>(0x804101E1));
+    Require(resolved6 == resolved6BeforeFailure);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == static_cast<int>(0x804101E1));
     Require(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0) == 0);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
-    std::array<std::uint8_t, 512> records{};
+    alignas(NetResolverInfo) std::array<std::uint8_t, 512> records{};
     records.fill(0xA5);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) == 0);
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) == 0);
     std::int32_t record_family = 0;
     std::int32_t record_count = 0;
     std::int32_t record_count4 = 0;
@@ -1811,34 +2045,44 @@ int main() {
     Require(std::all_of(records.begin() + 32 * record_count, records.begin() + 320, [](std::uint8_t byte) { return byte == 0; }));
     Require(std::all_of(records.begin() + 328, records.begin() + 384, [](std::uint8_t byte) { return byte == 0; }));
     Require(std::all_of(records.begin() + 384, records.end(), [](std::uint8_t byte) { return byte == 0xA5; }));
+    const auto resolvedRecords = records;
     for (int first = 0; first < record_count; ++first) {
         for (int second = first + 1; second < record_count; ++second) {
             Require(std::memcmp(records.data() + 32 * first, records.data() + 32 * second, 4) != 0);
         }
     }
     const auto resolved = records;
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, nullptr, records.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, nullptr, reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22 && records == resolved);
     Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", nullptr, 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "guest-sce-net.invalid.", records.data(), 5000000, 1, 0) ==
-        static_cast<int>(0x804101E1) && records == resolved);
+    {
+        ScopedResolverLookupOverride lookupOverride(FailResolverLookup);
+        Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "guest-sce-net.invalid.", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
+            static_cast<int>(0x804101E1));
+    }
+    Require(records == resolvedRecords);
 
-    std::array<std::uint8_t, 512> plain{};
+    alignas(NetResolverInfo) std::array<std::uint8_t, 512> plain{};
     plain.fill(0xA5);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) == 0);
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) == 0);
     Require(plain == resolved);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, nullptr, plain.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, nullptr, reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22 && plain == resolved);
     Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", nullptr, 5000000, 1, 0) ==
         static_cast<int>(0x80410116) && *sceNetErrnoLoc() == 22);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "guest-sce-net.invalid", plain.data(), 5000000, 1, 0) ==
-        static_cast<int>(0x804101E1) && plain == resolved);
+    const auto resolvedPlain = plain;
+    {
+        ScopedResolverLookupOverride lookupOverride(FailResolverLookup);
+        Require(sceNetResolverStartNtoaMultipleRecords(resolver, "guest-sce-net.invalid", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
+            static_cast<int>(0x804101E1));
+    }
+    Require(plain == resolvedPlain);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == static_cast<int>(0x804101E1));
     for (const int flags : {0x1, 0x10000}) {
         bool threw = false;
-        try { sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, flags); }
+        try { sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, flags); }
         catch (const std::runtime_error&) { threw = true; }
         Require(threw && plain == resolved);
     }
@@ -1862,11 +2106,11 @@ int main() {
     Require(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0) == 0 && ipv4[0] == 127);
     Require(sceNetResolverGetError(resolver, &resolver_error) == 0 && resolver_error == 0);
     Require(sceNetResolverAbort(resolver, 1) == 0);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) == 0 && plain == resolved);
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) == 0 && plain == resolved);
     Require(sceNetResolverAbort(resolver, 2) == 0);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) == 0 && records == resolved);
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) == 0 && records == resolved);
     std::memset(reverse, 0x5A, sizeof(reverse));
     Require(sceNetResolverStartAton(resolver, loopback.data(), reverse, sizeof(reverse), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4 && reverse[0] == 0x5A);
@@ -1875,7 +2119,7 @@ int main() {
     Require(sceNetResolverAbort(resolver, 3) == 0);
     Require(sceNetResolverStartAton(resolver, loopback.data(), reverse, sizeof(reverse), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410104) && *sceNetErrnoLoc() == 4 && records == resolved);
     Require(sceNetResolverStartNtoa(resolver, "localhost", ipv4.data(), 5000000, 1, 0) == 0);
     for (const int flags : {0x4, -1}) {
@@ -1935,7 +2179,7 @@ int main() {
     const int other = sceNetResolverCreate("guest-sce-net-other", 0, 0);
     Require(other >= 0 && other != resolver);
     Require(sceNetResolverAbort(other, 3) == 0);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) == 0);
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) == 0);
     Require(sceNetResolverDestroy(other) == 0);
     Require(sceNetResolverAbort(other, 0) == static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9);
     Require(sceNetResolverAbort(-1, 1) == static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9);
@@ -1952,9 +2196,9 @@ int main() {
     resolver_error = -1;
     Require(sceNetResolverGetError(resolver, &resolver_error) == static_cast<int>(0x80410109) &&
         *sceNetErrnoLoc() == 9 && resolver_error == -1);
-    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", records.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecordsEx(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(records.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9 && records == resolved);
-    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", plain.data(), 5000000, 1, 0) ==
+    Require(sceNetResolverStartNtoaMultipleRecords(resolver, "localhost", reinterpret_cast<NetResolverInfo*>(plain.data()), 5000000, 1, 0) ==
         static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9 && plain == resolved);
     Require(sceNetResolverAbort(resolver, 1) == static_cast<int>(0x80410109) && *sceNetErrnoLoc() == 9);
 
@@ -1991,7 +2235,7 @@ int main() {
     {
         std::array<std::uint32_t, 3> dns{};
         dns.fill(0xA5A5A5A5u);
-        const int count = sceNetGetDnsInfo(dns.data(), 0);
+        const int count = sceNetGetDnsInfo(reinterpret_cast<NetDnsInfo*>(dns.data()), 0);
         Require(count >= 0 && count <= 2 && dns[2] == 0xA5A5A5A5u);
         Require(count == 0 || state == 3);
         for (int index = count; index < 2; ++index) Require(dns[index] == 0);
@@ -2009,7 +2253,7 @@ int main() {
         }
         for (const int flags : {0x1, -1}) {
             bool threw = false;
-            try { sceNetGetDnsInfo(dns.data(), flags); } catch (const std::runtime_error&) { threw = true; }
+            try { sceNetGetDnsInfo(reinterpret_cast<NetDnsInfo*>(dns.data()), flags); } catch (const std::runtime_error&) { threw = true; }
             Require(threw);
         }
         bool threw = false;
@@ -2067,6 +2311,46 @@ int main() {
         }
         Require(sceNetCtlUnregisterCallbackV6(0) == 0);
     }
+    {
+        int cid = -1;
+        Require(sceNetCtlRegisterCallbackForNpToolkit(nullptr, nullptr, &cid) == static_cast<int>(0x80412107));
+        Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, nullptr) == static_cast<int>(0x80412107));
+        int cids[8] = {};
+        for (int i = 0; i < 8; ++i) {
+            Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, &cids[i]) == 0);
+            Require(cids[i] == i);
+        }
+        Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, &cid) == static_cast<int>(0x80412103));
+        Require(sceNetCtlRegisterCallback(IgnoreNetCtlEvent, nullptr, &cid) == 0 && cid == 0);
+        Require(sceNetCtlUnregisterCallback(0) == 0);
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(-1) == static_cast<int>(0x80412105));
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(8) == static_cast<int>(0x80412105));
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(3) == 0);
+        Require(sceNetCtlRegisterCallbackForNpToolkit(IgnoreNetCtlEvent, nullptr, &cid) == 0);
+        Require(cid == 3);
+        for (int i = 0; i < 8; ++i) {
+            Require(sceNetCtlUnregisterCallbackForNpToolkit(i) == 0);
+        }
+
+        NetCtlEventRecord toolkit;
+        NetCtlEventRecord plain;
+        Require(sceNetCtlRegisterCallbackForNpToolkit(RecordNetCtlEvent, &toolkit, &cid) == 0 && cid == 0);
+        Require(sceNetCtlCheckCallback() == 0 && toolkit.calls == 0);
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0);
+        Require(toolkit.calls == 1 && toolkit.arg == &toolkit && (toolkit.event == 1 || toolkit.event == 3));
+        int current = -1;
+        Require(sceNetCtlGetState(&current) == 0 && toolkit.event == (current == 3 ? 3 : 1));
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0 && toolkit.calls == 1);
+        int plainCid = -1;
+        Require(sceNetCtlRegisterCallback(RecordNetCtlEvent, &plain, &plainCid) == 0);
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0 && plain.calls == 0);
+        Require(sceNetCtlCheckCallback() == 0 && plain.calls == 1 && toolkit.calls == 1);
+        Require(sceNetCtlUnregisterCallback(plainCid) == 0);
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(cid) == 0);
+        Require(sceNetCtlRegisterCallbackForNpToolkit(RecordNetCtlEvent, &toolkit, &cid) == 0);
+        Require(sceNetCtlCheckCallbackForNpToolkit() == 0 && toolkit.calls == 2);
+        Require(sceNetCtlUnregisterCallbackForNpToolkit(cid) == 0);
+    }
     if (ipv6Unavailable) {
         std::puts("skipped the IPv6 socket checks, the host has no usable IPv6 loopback");
         return 77;
diff --git a/core/libs/tests/GuestSceV2Exceptions.S b/core/libs/tests/GuestSceV2Exceptions.S
new file mode 100644
index 0000000000..8b076dc726
--- /dev/null
+++ b/core/libs/tests/GuestSceV2Exceptions.S
@@ -0,0 +1,72 @@
+.cfi_sections .eh_frame
+.text
+.globl SceV2Catch
+SceV2Catch:
+    .cfi_startproc
+#ifdef _WIN32
+    .cfi_personality 0x00, __gxx_personality_v0_nid_postfix
+    .cfi_lsda 0x00, .Lcatch_lsda
+#else
+    .cfi_personality 0x9b, .Lcatch_personality
+    .cfi_lsda 0x1b, .Lcatch_lsda
+#endif
+    pushq %rbp
+    .cfi_def_cfa_offset 16
+    .cfi_offset %rbp, -16
+    movq %rsp, %rbp
+    .cfi_def_cfa_register %rbp
+    subq $16, %rsp
+    movq %rdi, %rax
+    movq %rsi, %rdi
+.Lcatch_call:
+    call *%rax
+.Lcatch_call_end:
+    ud2
+.Lcatch_landing:
+    movl %edx, SceV2Selector(%rip)
+    movq %rax, %rdi
+    call __cxa_begin_catch_nid_postfix
+    movq %rax, %rdi
+    call SceV2Inspect
+    call __cxa_end_catch_nid_postfix
+    leave
+    .cfi_def_cfa %rsp, 8
+    ret
+    .cfi_endproc
+#ifdef _WIN32
+.section .rdata,"dr"
+#else
+.section .data.rel.ro,"aw",@progbits
+.p2align 3
+.Lcatch_personality:
+    .quad __gxx_personality_v0_nid_postfix
+.section .rodata
+#endif
+.Lcatch_lsda:
+#ifdef _WIN32
+    .byte 0xff, 0x80
+#else
+    .byte 0xff, 0x9b
+#endif
+    .uleb128 .Lcatch_types_end-.Lcatch_types_offset
+.Lcatch_types_offset:
+    .byte 0x01
+    .uleb128 .Lcatch_calls_end-.Lcatch_calls
+.Lcatch_calls:
+    .uleb128 .Lcatch_call-SceV2Catch
+    .uleb128 .Lcatch_call_end-.Lcatch_call
+    .uleb128 .Lcatch_landing-SceV2Catch
+    .uleb128 1
+.Lcatch_calls_end:
+    .byte 1, 1, 2, 0
+#ifdef _WIN32
+    .quad SceV2CatchType
+    .quad SceV2OtherType
+#else
+    .long SceV2CatchType-.
+    .long SceV2OtherType-.
+#endif
+.Lcatch_types_end:
+#ifndef _WIN32
+.section .note.GNU-stack,"",@progbits
+#endif
diff --git a/core/libs/tests/GuestSceV2Exceptions.cpp b/core/libs/tests/GuestSceV2Exceptions.cpp
new file mode 100644
index 0000000000..60765c0a45
--- /dev/null
+++ b/core/libs/tests/GuestSceV2Exceptions.cpp
@@ -0,0 +1,190 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+struct TypeRecord { const void* vtable; const char* name; const TypeRecord* base; };
+static_assert(sizeof(LibcException::ExceptionObject) == 16 && sizeof(LibcException::SystemErrorObject) == 32);
+
+using GuestWhat = const char* (APS5_VABI *)(const LibcException::ExceptionObject*);
+using Thrower = void (APS5_VABI *)(const void*);
+
+extern "C" {
+extern const TypeRecord _ZTISt9exception_nid_postfix;
+extern const TypeRecord _ZTISt9bad_alloc_nid_postfix;
+extern const TypeRecord _ZTISt12length_error_nid_postfix;
+extern const TypeRecord _ZTISt12system_error_nid_postfix;
+extern const TypeRecord _ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix;
+
+void APS5_VABI SceV2Catch(Thrower thrower, const void* argument);
+
+const void* SceV2CatchType = nullptr;
+const void* SceV2OtherType = nullptr;
+int SceV2Selector = 0;
+const void* SceV2Caught = nullptr;
+}
+
+static unsigned failures = 0;
+
+static void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "FAIL: %s\n", what);
+    ++failures;
+}
+
+static const TypeRecord* TypeOf(const LibcException::ExceptionObject* object) {
+    return static_cast<const TypeRecord*>(static_cast<const void* const*>(object->vtable)[-1]);
+}
+
+static const char* What(const LibcException::ExceptionObject* object) {
+    return reinterpret_cast<GuestWhat>(const_cast<void*>(static_cast<const void* const*>(object->vtable)[2]))(object);
+}
+
+static TypeRecord Named(const char* name) {
+    return {_ZTISt9exception_nid_postfix.vtable, name, nullptr};
+}
+
+static char inspected[256];
+static std::size_t inspectBytes = sizeof(LibcException::ExceptionObject);
+static LibcException::SystemErrorObject inspectedSystem {};
+
+extern "C" void APS5_VABI SceV2Inspect(void* object) {
+    const auto* exception = static_cast<const LibcException::ExceptionObject*>(object);
+    std::snprintf(inspected, sizeof(inspected), "%s|%s", TypeOf(exception)->name, What(exception));
+    std::memcpy(&inspectedSystem, object, inspectBytes);
+}
+
+struct Case { const char* label; Thrower thrower; const void* argument; const void* catchType; const void* otherType; int selector; const char* expected; };
+
+static void Run(const Case& test) {
+    SceV2CatchType = test.catchType;
+    SceV2OtherType = test.otherType;
+    SceV2Selector = 0;
+    inspected[0] = 0;
+    SceV2Catch(test.thrower, test.argument);
+    Require(SceV2Selector == test.selector, test.label);
+    if (std::strcmp(inspected, test.expected) != 0) {
+        std::fprintf(stderr, "  %s: got '%s', want '%s'\n", test.label, inspected, test.expected);
+        ++failures;
+    }
+}
+
+template<class TFunction>
+static Thrower AsThrower(TFunction function) {
+    return reinterpret_cast<Thrower>(function);
+}
+
+static void CheckThrowers() {
+    const TypeRecord logicError = Named("NSt8__sce_v211logic_errorE");
+    const TypeRecord runtimeError = Named("NSt8__sce_v213runtime_errorE");
+    const TypeRecord lengthError = Named("NSt8__sce_v212length_errorE");
+    const TypeRecord systemError = Named("NSt8__sce_v212system_errorE");
+    const TypeRecord unrelated = Named("NSt8__sce_v211range_errorE");
+    const void* exception = &_ZTISt9exception_nid_postfix;
+    const void* errorException = &_ZTINSt13__sce_cxxvers16_Error_exceptionE_nid_postfix;
+    const Case cases[] {
+        {"_Xlength_error", AsThrower(_ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix), "length", &logicError, &unrelated, 2,
+            "NSt8__sce_v212length_errorE|length"},
+        {"_Xlength_error is not std::length_error", AsThrower(_ZNSt8__sce_v214_Xlength_errorEPKc_nid_postfix), "length", &lengthError, &_ZTISt12length_error_nid_postfix, 2,
+            "NSt8__sce_v212length_errorE|length"},
+        {"_Xout_of_range", AsThrower(_ZNSt8__sce_v214_Xout_of_rangeEPKc_nid_postfix), "range", errorException, &runtimeError, 2,
+            "NSt8__sce_v212out_of_rangeE|range"},
+        {"_Xinvalid_argument", AsThrower(_ZNSt8__sce_v218_Xinvalid_argumentEPKc_nid_postfix), "argument", &logicError, &runtimeError, 2,
+            "NSt8__sce_v216invalid_argumentE|argument"},
+        {"_Xruntime_error", AsThrower(_ZNSt8__sce_v215_Xruntime_errorEPKc_nid_postfix), "runtime", &runtimeError, &logicError, 2,
+            "NSt8__sce_v213runtime_errorE|runtime"},
+        {"_Xoverflow_error", AsThrower(_ZNSt8__sce_v216_Xoverflow_errorEPKc_nid_postfix), nullptr, exception, &logicError, 2,
+            "NSt8__sce_v214overflow_errorE|"},
+        {"_Xbad_alloc", AsThrower(_ZNSt8__sce_v211_Xbad_allocEv_nid_postfix), nullptr, &_ZTISt9bad_alloc_nid_postfix, errorException, 2,
+            "St9bad_alloc|std::bad_alloc"},
+        {"_Xbad_function_call", AsThrower(_ZNSt8__sce_v219_Xbad_function_callEv_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v217bad_function_callE|bad function call"},
+        {"_Throw(bad_optional_access)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_19bad_optional_accessE_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v219bad_optional_accessE|Bad optional access"},
+        {"_Throw(bad_weak_ptr)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_12bad_weak_ptrE_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v212bad_weak_ptrE|bad_weak_ptr"},
+        {"_Throw(bad_variant_access)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_18bad_variant_accessE_nid_postfix), nullptr, exception, errorException, 2,
+            "NSt8__sce_v218bad_variant_accessE|bad variant access"},
+        {"_Throw_Cpp_error", AsThrower(_ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix), reinterpret_cast<const void*>(1), &systemError, &_ZTISt12system_error_nid_postfix, 2,
+            "NSt8__sce_v212system_errorE|invalid argument: invalid argument"},
+    };
+    for (const auto& test : cases) Run(test);
+}
+
+static void CheckCopies() {
+    const TypeRecord runtimeError = Named("NSt8__sce_v213runtime_errorE");
+    const TypeRecord systemError = Named("NSt8__sce_v212system_errorE");
+    const TypeRecord logicError = Named("NSt8__sce_v211logic_errorE");
+
+    LibcException::ExceptionObject range {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(&range, "range copy");
+    Run({"_Throw(range_error)", AsThrower(_ZNSt8__sce_v26_ThrowERKNS_11range_errorE_nid_postfix), &range, &runtimeError, &logicError, 2,
+        "NSt8__sce_v211range_errorE|range copy"});
+    Require(inspectedSystem.base.message == range.message, "_Throw(range_error) shares the message");
+    _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(&range);
+
+    LibcException::SystemErrorObject error {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(&error.base, "system copy");
+    error.code = {0, 5, _ZSt16generic_categoryv_nid_postfix()};
+    inspectBytes = sizeof(LibcException::SystemErrorObject);
+    SceV2CatchType = &runtimeError;
+    SceV2OtherType = &logicError;
+    SceV2Catch(AsThrower(_ZNSt8__sce_v26_ThrowERKNS_12system_errorE_nid_postfix), &error);
+    Require(std::strcmp(inspected, "NSt8__sce_v212system_errorE|system copy") == 0, "_Throw(system_error) type and message");
+    Require(inspectedSystem.code.value == 5, "_Throw(system_error) copies the code value");
+    Require(inspectedSystem.code.category == error.code.category, "_Throw(system_error) copies the category");
+
+    SceV2CatchType = &systemError;
+    SceV2Catch(AsThrower(_ZNSt8__sce_v28ios_base6_ThrowERKNS0_7failureE_nid_postfix), &error);
+    Require(std::strcmp(inspected, "NSt8__sce_v28ios_base7failureE|system copy") == 0, "ios_base::_Throw(failure) type and message");
+    Require(inspectedSystem.code.value == 5, "ios_base::_Throw(failure) copies the code");
+    inspectBytes = sizeof(LibcException::ExceptionObject);
+    _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(&error.base);
+}
+
+static void CheckErrorException() {
+    LibcException::ExceptionObject empty {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC1EPKc_nid_postfix(&empty, nullptr);
+    Require(std::strcmp(_ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(&empty), "") == 0, "_Error_exception(nullptr) has an empty message");
+    Require(std::strcmp(TypeOf(&empty)->name, "NSt13__sce_cxxvers16_Error_exceptionE") == 0, "_Error_exception type name");
+    Require(TypeOf(&empty)->base == &_ZTISt9exception_nid_postfix, "_Error_exception derives from std::exception");
+
+    LibcException::ExceptionObject text {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC2EPKc_nid_postfix(&text, "text");
+    LibcException::ExceptionObject copy {};
+    _ZNSt13__sce_cxxvers16_Error_exceptionC1ERKS0__nid_postfix(&copy, &text);
+    Require(std::strcmp(_ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(&copy), "text") == 0, "_Error_exception copy keeps the message");
+    _ZNSt13__sce_cxxvers16_Error_exceptionD2Ev_nid_postfix(&text);
+    Require(std::strcmp(_ZNKSt13__sce_cxxvers16_Error_exception4whatEv_nid_postfix(&copy), "text") == 0, "_Error_exception copy outlives the source");
+    _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(&copy);
+    _ZNSt13__sce_cxxvers16_Error_exceptionD1Ev_nid_postfix(&empty);
+}
+
+static void CheckSyserrorMap() {
+    Require(std::strcmp(_ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(0), "success") == 0, "_Syserror_map(0)");
+    Require(_ZSt13_Syserror_mapi_nid_postfix(0) == nullptr, "unversioned _Syserror_map(0) stays null");
+    Require(std::strcmp(_ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(2), _ZSt13_Syserror_mapi_nid_postfix(2)) == 0, "_Syserror_map(2) matches the unversioned text");
+    Require(std::strcmp(_ZNSt8__sce_v213_Syserror_mapEi_nid_postfix(99999), "unknown error") == 0, "_Syserror_map(unknown)");
+    Require(_ZSt13_Syserror_mapi_nid_postfix(99999) == nullptr, "unversioned _Syserror_map(unknown) stays null");
+}
+
+static void CheckTicks() {
+    const auto before = _Xtime_get_ticks_nid_postfix();
+    const auto ticks = _ZNSt8__sce_v216_Xtime_get_ticksEv_nid_postfix();
+    const auto after = _Xtime_get_ticks_nid_postfix();
+    Require(before <= ticks && ticks <= after, "_Xtime_get_ticks is the unversioned clock");
+}
+
+int main() {
+    CheckErrorException();
+    CheckThrowers();
+    CheckCopies();
+    CheckSyserrorMap();
+    CheckTicks();
+    if (failures) return 1;
+    std::puts("guest std::__sce_v2 exceptions: PASS");
+    return 0;
+}
diff --git a/core/libs/tests/GuestSchedPriority.cpp b/core/libs/tests/GuestSchedPriority.cpp
index 5c175d9f37..34e03f1f99 100644
--- a/core/libs/tests/GuestSchedPriority.cpp
+++ b/core/libs/tests/GuestSchedPriority.cpp
@@ -1,23 +1,15 @@
+#include "prx/libkernel_sys/include/Api.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <initializer_list>
 #include <stdexcept>
-extern "C" int* APS5_VABI __error_nid_postfix();
+#include <ctime>
+
 extern "C" {
-int APS5_VABI sched_get_priority_max_nid_postfix(int policy);
-int APS5_VABI sched_get_priority_min_nid_postfix(int policy);
-int APS5_VABI getpriority_nid_postfix(int which, int who);
-int APS5_VABI setpriority_nid_postfix(int which, int who, int niceval);
-struct GuestRtPrio {
-    std::uint16_t type;
-    std::uint16_t prio;
-};
-int APS5_VABI rtprio_thread_nid_postfix(int function, int lwpid, GuestRtPrio* priority);
-int APS5_VABI pthread_setconcurrency_nid_postfix(int newLevel);
-int APS5_VABI pthread_getconcurrency_nid_postfix(void);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
+
 }
 static constexpr int PrioProcess = 0;
 static constexpr int PrioGroup = 1;
@@ -47,12 +39,26 @@ static void RequireSetError(int which, int who, int nice, int error) {
 }
 int main() {
     Require(Rejects(-1) && Rejects(2) && Rejects(5));
+    const int self = getpid_nid_postfix();
+    KernelTimespec interval{};
+    *__error_nid_postfix() = 13;
+    Require(sched_rr_get_interval_nid_postfix(0, &interval) == 0 && interval.tv_sec == 0 && interval.tv_nsec == 94000000 && *__error_nid_postfix() == 13);
+    interval.tv_sec = -1;
+    interval.tv_nsec = -1;
+    Require(sched_rr_get_interval_nid_postfix(0, &interval) == 0 && interval.tv_sec == 0 && interval.tv_nsec == 94000000);
+    interval = {};
+    Require(sched_rr_get_interval_nid_postfix(self, &interval) == 0 && interval.tv_sec == 0 && interval.tv_nsec == 94000000);
+    *__error_nid_postfix() = 0;
+    Require(sched_rr_get_interval_nid_postfix(-1, &interval) == -1 && *__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(sched_rr_get_interval_nid_postfix(self + 1, &interval) == -1 && *__error_nid_postfix() == 3);
+    *__error_nid_postfix() = 0;
+    Require(sched_rr_get_interval_nid_postfix(0, nullptr) == -1 && *__error_nid_postfix() == 14);
     for (int policy : {1, 3}) {
         Require(sched_get_priority_max_nid_postfix(policy) == 767);
         Require(sched_get_priority_min_nid_postfix(policy) == 256);
     }
     Require(Rejects(0) && Rejects(4));
-    const int self = getpid_nid_postfix();
     RequireNice(PrioProcess, 0);
     RequireNice(PrioProcess, self);
     RequireNice(PrioGroup, 0);
@@ -80,14 +86,12 @@ int main() {
     Require(setpriority_nid_postfix(PrioProcess, 0, -99) == 0 && getpriority_nid_postfix(PrioProcess, 0) == -20);
     Require(setpriority_nid_postfix(PrioProcess, 0, 0) == 0 && getpriority_nid_postfix(PrioProcess, 0) == 0);
     GuestRtPrio rtprio{7, 7};
+    Require(rtprio_thread_nid_postfix(0, 0, &rtprio) == 0 && rtprio.type == 10 && rtprio.prio == 700);
     bool rtprioThrew = false;
-    try { rtprio_thread_nid_postfix(0, 0, &rtprio); } catch (const std::exception&) { rtprioThrew = true; }
-    Require(rtprioThrew);
-    rtprioThrew = false;
     try { rtprio_thread_nid_postfix(1, 0, &rtprio); } catch (const std::exception&) { rtprioThrew = true; }
     Require(rtprioThrew);
     *__error_nid_postfix() = 0;
-    Require(rtprio_thread_nid_postfix(2, 0, &rtprio) == -1 && *__error_nid_postfix() == 22);
+    Require(rtprio_thread_nid_postfix(2, 0, &rtprio) == -1 && *__error_nid_postfix() == 3);
     *__error_nid_postfix() = 0;
     Require(rtprio_thread_nid_postfix(0, 0, nullptr) == -1 && *__error_nid_postfix() == 14);
     *__error_nid_postfix() = 0;
diff --git a/core/libs/tests/GuestScreenShot.cpp b/core/libs/tests/GuestScreenShot.cpp
new file mode 100644
index 0000000000..fe9a121fed
--- /dev/null
+++ b/core/libs/tests/GuestScreenShot.cpp
@@ -0,0 +1,114 @@
+#include "prx/libSceScreenShot/include/Api.hpp"
+#include "ProcessParametersFixture.hpp"
+#include "SceTypes.hpp"
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <random>
+#include <string>
+
+namespace {
+
+constexpr int ErrorArgument = static_cast<int>(0x80BE0001);
+constexpr int ErrorOverlayFile = static_cast<int>(0x80BE0003);
+constexpr int ErrorOverlaySize = static_cast<int>(0x80BE000E);
+
+alignas(16) std::array<std::byte, 0x40> process{};
+std::string pathPrefix;
+
+void Require(bool condition, const char* message) {
+    if (condition) return;
+    std::fprintf(stderr, "ScreenShot: %s\n", message);
+    std::abort();
+}
+
+void InstallProcessParameters(std::uint32_t sdkVersion) {
+    const std::uint64_t size = process.size();
+    const std::uint32_t magic = 0x4942524f;
+    std::memcpy(process.data(), &size, sizeof(size));
+    std::memcpy(process.data() + 8, &magic, sizeof(magic));
+    std::memcpy(process.data() + 0x10, &sdkVersion, sizeof(sdkVersion));
+    Require(ProcessParametersFixture::Install(process.data(), process.size()), "process parameters were not installed");
+}
+
+class TempPath {
+public:
+    explicit TempPath(const char* tag) : name(pathPrefix + tag) {}
+    ~TempPath() {
+        std::error_code error;
+        std::filesystem::remove_all(name, error);
+    }
+    const char* c_str() const { return name.c_str(); }
+    void Fill(std::size_t bytes) const {
+        std::ofstream file(name, std::ios::binary | std::ios::trunc);
+        const std::string chunk(4096, 'x');
+        for (std::size_t written = 0; written < bytes; written += chunk.size()) {
+            file.write(chunk.data(), static_cast<std::streamsize>(std::min(chunk.size(), bytes - written)));
+        }
+    }
+
+private:
+    std::string name;
+};
+
+void TestDisableState() {
+    int value = -1;
+    Require(sceScreenShotIsDisabled(0, &value) == 0 && value == 0, "capture starts enabled");
+    Require(sceScreenShotDisable() == 0, "disable");
+    Require(sceScreenShotIsDisabled(0, &value) == 0 && value == 1, "disable is reported");
+    Require(sceScreenShotEnable() == 0, "enable");
+    Require(sceScreenShotIsDisabled(0, &value) == 0 && value == 0, "enable is reported");
+    value = 7;
+    Require(sceScreenShotIsDisabled(-1, &value) == ErrorArgument && value == 7, "id -1 is rejected");
+    Require(sceScreenShotIsDisabled(0, nullptr) == ErrorArgument, "null result is rejected");
+    Require(sceScreenShotDisableNotification() == 0 && sceScreenShotEnableNotification() == 0, "notification toggles");
+}
+
+void TestOverlay(bool large) {
+    const int maxX = large ? 3839 : 1919;
+    const int maxY = large ? 2159 : 1079;
+    const std::size_t maxSize = large ? 8u << 20 : 2u << 20;
+    TempPath image("image");
+    image.Fill(4096);
+    Require(sceScreenShotSetOverlayImage(image.c_str(), 0, 0) == 0, "overlay at the origin");
+    Require(sceScreenShotSetOverlayImage(image.c_str(), maxX, maxY) == 0, "overlay at the last offsets");
+    Require(sceScreenShotSetOverlayImage(image.c_str(), maxX + 1, 0) == ErrorArgument, "x past the screen");
+    Require(sceScreenShotSetOverlayImage(image.c_str(), 0, maxY + 1) == ErrorArgument, "y past the screen");
+    Require(sceScreenShotSetOverlayImage(image.c_str(), -1, 0) == ErrorArgument, "negative x");
+    Require(sceScreenShotSetOverlayImage(nullptr, 0, 0) == ErrorArgument, "null path");
+    const std::string longPath(1024, 'a');
+    Require(sceScreenShotSetOverlayImage(longPath.c_str(), 0, 0) == ErrorArgument, "path of 1024 characters");
+    TempPath missing("missing");
+    Require(sceScreenShotSetOverlayImage(missing.c_str(), 0, 0) == ErrorOverlayFile, "missing file");
+    TempPath directory("directory");
+    std::filesystem::create_directory(directory.c_str());
+    Require(sceScreenShotSetOverlayImage(directory.c_str(), 0, 0) == ErrorOverlayFile, "directory");
+    TempPath empty("empty");
+    empty.Fill(0);
+    Require(sceScreenShotSetOverlayImage(empty.c_str(), 0, 0) == ErrorOverlaySize, "empty file");
+    TempPath full("full");
+    full.Fill(maxSize);
+    Require(sceScreenShotSetOverlayImage(full.c_str(), 0, 0) == 0, "file at the size limit");
+    full.Fill(maxSize + 1);
+    Require(sceScreenShotSetOverlayImage(full.c_str(), 0, 0) == ErrorOverlaySize, "file past the size limit");
+    for (int origin = 1; origin <= 9; ++origin) Require(sceScreenShotSetOverlayImageWithOrigin(image.c_str(), 0, 0, origin) == 0, "origins 1 to 9");
+    Require(sceScreenShotSetOverlayImageWithOrigin(image.c_str(), 0, 0, 0) == ErrorArgument, "origin 0");
+    Require(sceScreenShotSetOverlayImageWithOrigin(image.c_str(), 0, 0, 10) == ErrorArgument, "origin 10");
+    Require(sceScreenShotSetOverlayImageWithOrigin(nullptr, 0, 0, 0) == ErrorArgument, "origin checked first");
+}
+
+}
+
+int main(int argc, char** argv) {
+    const bool large = argc > 1 && std::strcmp(argv[1], "large") == 0;
+    pathPrefix = std::string("anyps5-screenshot-") + (large ? "large-" : "small-") + std::to_string(std::random_device{}()) + "-";
+    InstallProcessParameters(large ? 0x3500000u : 0x34fffffu);
+    TestDisableState();
+    TestOverlay(large);
+    return 0;
+}
diff --git a/core/libs/tests/GuestSearch.cpp b/core/libs/tests/GuestSearch.cpp
index f1572c3640..55d2862aba 100644
--- a/core/libs/tests/GuestSearch.cpp
+++ b/core/libs/tests/GuestSearch.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdlib>
@@ -7,7 +8,7 @@
 #include <cstdio>
 #include <source_location>
 using Comparator = int (APS5_VABI *)(const void*, const void*);
-extern "C" void* APS5_VABI bsearch_nid_postfix(const void*, const void*, std::size_t, std::size_t, Comparator);
+
 static void Require(bool value, std::source_location location = std::source_location::current()) {
     if (!value) { std::fprintf(stderr, "Guest search failed at line %u\n", location.line()); std::abort(); }
 }
diff --git a/core/libs/tests/GuestSelect.cpp b/core/libs/tests/GuestSelect.cpp
index 979415e15d..55c7be7b9a 100644
--- a/core/libs/tests/GuestSelect.cpp
+++ b/core/libs/tests/GuestSelect.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SceTypes.hpp"
 #include <array>
@@ -24,25 +26,6 @@ struct GuestDescriptorSet {
     }
 };
 
-extern "C" {
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI unlink_nid_postfix(const char*);
-int APS5_VABI kqueue_nid_postfix();
-int APS5_VABI kevent_nid_postfix(int, const KernelEvent*, int, KernelEvent*, int, const KernelTimespec*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int GuestEbadf = 9;
diff --git a/core/libs/tests/GuestSelectWait.cpp b/core/libs/tests/GuestSelectWait.cpp
index a21b7b320a..3c9044117d 100644
--- a/core/libs/tests/GuestSelectWait.cpp
+++ b/core/libs/tests/GuestSelectWait.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <chrono>
@@ -10,11 +12,6 @@ struct GuestTimeval {
     std::int64_t microseconds;
 };
 
-extern "C" {
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
diff --git a/core/libs/tests/GuestSemCanceledWake.cpp b/core/libs/tests/GuestSemCanceledWake.cpp
index 526888bcb0..8bf56c413a 100644
--- a/core/libs/tests/GuestSemCanceledWake.cpp
+++ b/core/libs/tests/GuestSemCanceledWake.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include "prx/libkernel/Pthread/include/Cancel.hpp"
 #include <atomic>
@@ -6,19 +7,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
-int APS5_VABI scePthreadJoin(Pthread, void**);
-int APS5_VABI scePthreadCancel(Pthread);
-int APS5_VABI scePthreadSetcancelstate(int, int*);
-int APS5_VABI scePthreadSemInit(PthreadSem*, int, unsigned, const char*);
-int APS5_VABI scePthreadSemDestroy(PthreadSem*);
-int APS5_VABI scePthreadSemPost(PthreadSem*);
-int APS5_VABI scePthreadSemWait(PthreadSem*);
-int APS5_VABI scePthreadSemTimedwait(PthreadSem*, KernelUseconds);
-int APS5_VABI scePthreadSemGetvalue(PthreadSem*, int*);
-}
-
 namespace {
 
 void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestSemaphore.cpp b/core/libs/tests/GuestSemaphore.cpp
index 5392fa1603..bc843e1a5a 100644
--- a/core/libs/tests/GuestSemaphore.cpp
+++ b/core/libs/tests/GuestSemaphore.cpp
@@ -1,24 +1,12 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Semaphore/include/Semaphore.hpp"
 #include "SceTypes.hpp"
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelCreateSema(KernelSema* sem, const char* name, uint32_t attr, int init, int max, void* opt);
-int APS5_VABI sceKernelDeleteSema(KernelSema sem);
-int APS5_VABI sceKernelPollSema(KernelSema sem, int need);
-int APS5_VABI sceKernelSignalSema(KernelSema sem, int count);
-int APS5_VABI sceKernelWaitSema(KernelSema sem, int need, KernelUseconds* time);
-int APS5_VABI sceKernelCancelSema(KernelSema sem, int count, int* threads);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EBUSY = static_cast<int>(0x80020010);
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
-static constexpr int SCE_KERNEL_ERROR_ECANCELED = static_cast<int>(0x80020055);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -35,7 +23,37 @@ static void* APS5_VABI Wait(void* arg) {
     return nullptr;
 }
 
+static void RequireInvalidArguments() {
+    KernelSema rejected = nullptr;
+    Require(sceKernelCreateSema(&rejected, "rejected", 0, 5, 3, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelCreateSema(&rejected, "rejected", 0, 0, 0, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelCreateSema(&rejected, "rejected", 0, -1, 3, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelCreateSema(&rejected, nullptr, 0, 0, 1, nullptr) == SCE_KERNEL_ERROR_EINVAL);
+    Require(rejected == nullptr);
+
+    KernelSema sem = nullptr;
+    Require(sceKernelCreateSema(&sem, "limits", 0, 2, 3, nullptr) == SCE_OK);
+    Require(sceKernelPollSema(sem, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, -1) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 4) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 100) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 3) == SCE_KERNEL_ERROR_EBUSY);
+    Require(sceKernelSignalSema(sem, 0) == SCE_KERNEL_ERROR_EINVAL);
+    Require(sceKernelPollSema(sem, 2) == SCE_OK);
+    Require(sceKernelSignalSema(sem, 3) == SCE_OK);
+    Require(sceKernelPollSema(sem, 3) == SCE_OK);
+    Require(sceKernelDeleteSema(sem) == SCE_OK);
+}
+
 int main() {
+    KernelUseconds nullTimeout = 1000;
+    int nullWaiters = -1;
+    Require(sceKernelWaitSema(nullptr, 1, nullptr) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelWaitSema(nullptr, 1, &nullTimeout) == SCE_KERNEL_ERROR_ESRCH && nullTimeout == 1000);
+    Require(sceKernelPollSema(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelSignalSema(nullptr, 1) == SCE_KERNEL_ERROR_ESRCH);
+    Require(sceKernelCancelSema(nullptr, 0, &nullWaiters) == SCE_KERNEL_ERROR_ESRCH && nullWaiters == -1);
+    Require(sceKernelDeleteSema(nullptr) == SCE_KERNEL_ERROR_ESRCH);
     KernelSema sem = nullptr;
     Require(sceKernelCreateSema(&sem, "cancel", 0, 1, 3, nullptr) == SCE_OK);
 
@@ -85,4 +103,6 @@ int main() {
     Require(sceKernelSignalSema(sem, 1) == SCE_OK);
     Require(sceKernelWaitSema(sem, 1, nullptr) == SCE_OK);
     Require(sceKernelDeleteSema(sem) == SCE_OK);
+
+    RequireInvalidArguments();
 }
diff --git a/core/libs/tests/GuestSendfile.cpp b/core/libs/tests/GuestSendfile.cpp
index d8aa5f363e..388a426d80 100644
--- a/core/libs/tests/GuestSendfile.cpp
+++ b/core/libs/tests/GuestSendfile.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -6,27 +8,7 @@
 #include <string>
 #include <thread>
 #include <vector>
-struct Iovec {
-    const void* base;
-    std::uint64_t length;
-};
-struct Hdtr {
-    const Iovec* headers;
-    int headerCount;
-    const Iovec* trailers;
-    int trailerCount;
-};
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI ioctl_nid_postfix(int, std::uint64_t, void*);
-int APS5_VABI sendfile_nid_postfix(int, int, std::int64_t, std::uint64_t, const Hdtr*, std::int64_t*, int);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static bool Fails(int result, int error) { return result == -1 && *__error_nid_postfix() == error; }
 static std::string Receive(int descriptor, std::size_t length) {
@@ -59,9 +41,9 @@ int main() {
     const int file = OpenWritten("sendfile_probe.bin", content);
     int pair[2];
     Require(socketpair_nid_postfix(1, 1, 0, pair) == 0);
-    const Iovec header[] = {{"GET", 3}, {" ", 1}};
-    const Iovec trailer[] = {{"END", 3}};
-    const Hdtr parts{header, 2, trailer, 1};
+    KernelIovec header[] = {{const_cast<char*>("GET"), 3}, {const_cast<char*>(" "), 1}};
+    KernelIovec trailer[] = {{const_cast<char*>("END"), 3}};
+    const GuestSendfileHeaders parts{header, 2, trailer, 1};
     std::int64_t sent = -1;
     Require(sendfile_nid_postfix(file, pair[0], 5, 10, &parts, &sent, 0) == 0 && sent == 17);
     Require(Receive(pair[1], 17) == "GET " + content.substr(5, 10) + "END");
@@ -75,21 +57,21 @@ int main() {
     Require(Receive(pair[1], 4) == content.substr(content.size() - 4));
     Require(sendfile_nid_postfix(file, pair[0], size + 10, 0, &parts, &sent, 0) == 0 && sent == 7);
     Require(Receive(pair[1], 7) == "GET END");
-    const Hdtr nullHeaders{nullptr, 5, trailer, 1};
+    const GuestSendfileHeaders nullHeaders{nullptr, 5, trailer, 1};
     Require(sendfile_nid_postfix(file, pair[0], 0, 3, &nullHeaders, nullptr, 0) == 0);
     Require(Receive(pair[1], 6) == content.substr(0, 3) + "END");
     Require(lseek_nid_postfix(file, 0, 1) == 0);
 
     sent = 77;
     Require(Fails(sendfile_nid_postfix(file, pair[0], -1, 0, nullptr, &sent, 0), 22) && sent == 77);
-    const std::vector<Iovec> many(1025, Iovec{"x", 1});
-    const Hdtr tooMany{many.data(), 1025, nullptr, 0};
+    std::vector<KernelIovec> many(1025, KernelIovec{const_cast<char*>("x"), 1});
+    const GuestSendfileHeaders tooMany{many.data(), 1025, nullptr, 0};
     Require(Fails(sendfile_nid_postfix(file, pair[0], 0, 0, &tooMany, &sent, 0), 22) && sent == 77);
-    const Hdtr negative{nullptr, 0, trailer, -1};
+    const GuestSendfileHeaders negative{nullptr, 0, trailer, -1};
     Require(Fails(sendfile_nid_postfix(file, pair[0], 0, 0, &negative, &sent, 0), 22) && sent == 77);
     Require(Fails(sendfile_nid_postfix(pair[1], pair[0], 0, 0, nullptr, &sent, 0), 22) && sent == 0);
     sent = 77;
-    Require(Fails(sendfile_nid_postfix(file, file, 0, 0, nullptr, &sent, 0), 9) && sent == 0);
+    Require(Fails(sendfile_nid_postfix(file, file, 0, 0, nullptr, &sent, 0), 38) && sent == 0);
     const int datagram = socket_nid_postfix(2, 2, 0);
     Require(datagram >= 0);
     sent = 77;
@@ -108,10 +90,13 @@ int main() {
     Require(sent > 0 && sent < static_cast<std::int64_t>(large.size()));
     Require(Receive(pair[1], static_cast<std::size_t>(sent)) == large.substr(0, static_cast<std::size_t>(sent)));
 
+    Require(close_nid_postfix(unconnected) == 0);
+    sent = 77;
+    Require(Fails(sendfile_nid_postfix(file, unconnected, 0, 0, nullptr, &sent, 0), 9) && sent == 0);
     Require(close_nid_postfix(largeFile) == 0 && close_nid_postfix(file) == 0);
     sent = 77;
     Require(Fails(sendfile_nid_postfix(file, pair[0], 0, 0, nullptr, &sent, 0), 9) && sent == 77);
-    Require(close_nid_postfix(datagram) == 0 && close_nid_postfix(unconnected) == 0);
+    Require(close_nid_postfix(datagram) == 0);
     Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0);
     std::filesystem::remove("sendfile_probe.bin");
     std::filesystem::remove("sendfile_large.bin");
diff --git a/core/libs/tests/GuestServiceDatabase.cpp b/core/libs/tests/GuestServiceDatabase.cpp
index 30caec9095..e89a3d5985 100644
--- a/core/libs/tests/GuestServiceDatabase.cpp
+++ b/core/libs/tests/GuestServiceDatabase.cpp
@@ -1,3 +1,4 @@
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libScePosixForWebKit/GuestResolver.hpp"
 #include <cerrno>
@@ -8,8 +9,6 @@
 #include <source_location>
 #include <thread>
 
-extern "C" GuestResolver::ServiceEntry* APS5_VABI getservbyname_nid_postfix(const char*, const char*);
-
 void Require(bool condition, std::source_location location = std::source_location::current()) {
     if (!condition) {
         std::fprintf(stderr, "Service database check failed at line %u\n", location.line());
diff --git a/core/libs/tests/GuestSetrlimit.cpp b/core/libs/tests/GuestSetrlimit.cpp
index a869eec59c..f86c83edfb 100644
--- a/core/libs/tests/GuestSetrlimit.cpp
+++ b/core/libs/tests/GuestSetrlimit.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,17 +7,6 @@
 #include <limits>
 #include <stdexcept>
 
-struct ResourceLimit {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-
-extern "C" {
-int APS5_VABI getrlimit_nid_postfix(int, ResourceLimit*);
-int APS5_VABI setrlimit_nid_postfix(int, const ResourceLimit*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int GUEST_RLIMIT_DATA = 2;
@@ -29,23 +20,24 @@ static constexpr std::int64_t GUEST_RLIM_INFINITY = std::numeric_limits<std::int
 
 static void Require(bool value) { if (!value) std::abort(); }
 
-static bool Throws(int resource, const ResourceLimit& limit) {
+static bool Throws(int resource, const GuestResourceLimit& limit) {
     try {
         setrlimit_nid_postfix(resource, &limit);
+
     } catch (const std::runtime_error&) {
         return true;
     }
     return false;
 }
 
-static void RequireError(int resource, const ResourceLimit* limit, int error) {
+static void RequireError(int resource, const GuestResourceLimit* limit, int error) {
     *__error_nid_postfix() = 0;
     Require(setrlimit_nid_postfix(resource, limit) == -1);
     Require(*__error_nid_postfix() == error);
 }
 
 int main() {
-    const ResourceLimit infinity{GUEST_RLIM_INFINITY, GUEST_RLIM_INFINITY};
+    const GuestResourceLimit infinity{GUEST_RLIM_INFINITY, GUEST_RLIM_INFINITY};
     RequireError(-1, nullptr, GUEST_EFAULT);
     RequireError(GUEST_RLIM_NLIMITS, nullptr, GUEST_EFAULT);
     RequireError(-1, &infinity, GUEST_EINVAL);
@@ -53,35 +45,41 @@ int main() {
 
     static constexpr int unchanged[] = {GUEST_RLIMIT_STACK, GUEST_RLIMIT_RSS, GUEST_RLIMIT_MEMLOCK};
     for (int resource : unchanged) {
-        ResourceLimit before{};
+        GuestResourceLimit before{};
         Require(getrlimit_nid_postfix(resource, &before) == 0);
         *__error_nid_postfix() = 13;
         Require(setrlimit_nid_postfix(resource, &before) == 0 && *__error_nid_postfix() == 13);
-        ResourceLimit after{};
+        GuestResourceLimit after{};
         Require(getrlimit_nid_postfix(resource, &after) == 0 && after.rlim_cur == before.rlim_cur && after.rlim_max == before.rlim_max);
     }
-    ResourceLimit processes{};
+    GuestResourceLimit processes{};
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1604 && processes.rlim_max == 1604);
-    Require(Throws(GUEST_RLIMIT_NPROC, processes));
-    Require(Throws(GUEST_RLIMIT_STACK, ResourceLimit{0x100000, 0x200000}));
+    Require(setrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0);
+    Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1443 && processes.rlim_max == 1443);
+    const GuestResourceLimit noProcesses{0, 0};
+    Require(setrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &noProcesses) == 0);
+    Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1 && processes.rlim_max == 1);
+    Require(setrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &infinity) == 0);
+    Require(getrlimit_nid_postfix(GUEST_RLIMIT_NPROC, &processes) == 0 && processes.rlim_cur == 1443 && processes.rlim_max == 1443);
+    Require(Throws(GUEST_RLIMIT_STACK, GuestResourceLimit{0x100000, 0x200000}));
 
-    ResourceLimit current{};
+    GuestResourceLimit current{};
     Require(getrlimit_nid_postfix(GUEST_RLIMIT_DATA, &current) == 0);
     *__error_nid_postfix() = 13;
     Require(setrlimit_nid_postfix(GUEST_RLIMIT_DATA, &current) == 0);
     Require(*__error_nid_postfix() == 13);
 
     if (current.rlim_cur > 0) {
-        const ResourceLimit changed{current.rlim_cur - 1, current.rlim_max};
+        const GuestResourceLimit changed{current.rlim_cur - 1, current.rlim_max};
         Require(Throws(GUEST_RLIMIT_DATA, changed));
     }
-    const ResourceLimit softAboveHard{GUEST_RLIM_INFINITY, current.rlim_max};
+    const GuestResourceLimit softAboveHard{GUEST_RLIM_INFINITY, current.rlim_max};
     if (current.rlim_cur == current.rlim_max)
         Require(setrlimit_nid_postfix(GUEST_RLIMIT_DATA, &softAboveHard) == 0);
     else
         Require(Throws(GUEST_RLIMIT_DATA, softAboveHard));
 
-    const ResourceLimit negative{-1, -2};
+    const GuestResourceLimit negative{-1, -2};
     if (current.rlim_cur == GUEST_RLIM_INFINITY && current.rlim_max == GUEST_RLIM_INFINITY)
         Require(setrlimit_nid_postfix(GUEST_RLIMIT_DATA, &negative) == 0);
     else
diff --git a/core/libs/tests/GuestShaderLink.cpp b/core/libs/tests/GuestShaderLink.cpp
index f5b510652b..5c39b6fffe 100644
--- a/core/libs/tests/GuestShaderLink.cpp
+++ b/core/libs/tests/GuestShaderLink.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceAgc/Shader/include/LinkShaders.hpp"
+#include "prx/libSceAgc/Misc/include/RegisterDefaults.hpp"
 #include "SceShaders.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceAgc/Shader/include/ShaderConstants.hpp"
@@ -6,9 +8,7 @@
 #include <cstring>
 #include <stdexcept>
 #include <span>
-extern "C" int APS5_VABI sceAgcLinkShaders(ShaderRegister*, ShaderRegister*, const void*, const Shader*, const Shader*, std::uint32_t);
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults();
-extern "C" void* APS5_VABI sceAgcGetRegisterDefaults2(std::uint32_t);
+
 static void Require(bool value) { if (!value) std::abort(); }
 static unsigned preparations = 0;
 static unsigned mappings = 0;
diff --git a/core/libs/tests/GuestShare.cpp b/core/libs/tests/GuestShare.cpp
index 0ef5a51bc5..a3e197e8a4 100644
--- a/core/libs/tests/GuestShare.cpp
+++ b/core/libs/tests/GuestShare.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceShare/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -5,17 +6,6 @@
 #include <initializer_list>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceShareCaptureScreenshotExtended(const void* extended_param, std::int32_t* req_id);
-int APS5_VABI sceShareCaptureScreenshot(const void* param, std::int32_t* req_id);
-int APS5_VABI sceShareCaptureVideoClip(const void* param, std::int32_t* req_id);
-int APS5_VABI sceShareCaptureVideoClipExtended(const void* extended_param, std::int32_t* req_id);
-int APS5_VABI sceShareGetCurrentStatus(std::uint32_t feature_flag, void* status);
-int APS5_VABI sceShareOpenMenuForContent(const void* content_id);
-int APS5_VABI sceShareGetRunningStatus(std::uint32_t* status);
-int APS5_VABI sceShareSetContentParamForApplicationTitle(const char* application_title);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -29,25 +19,26 @@ int main() {
     using Capture = int (APS5_VABI*)(const void*, std::int32_t*);
     std::int32_t reqId = 7;
     constexpr std::int32_t invalidParam = static_cast<std::int32_t>(0x81960002);
-    for (Capture capture : {sceShareCaptureScreenshotExtended, sceShareCaptureVideoClipExtended}) {
+    const auto checkExtended = [&]<typename TParam>(int (APS5_VABI* capture)(const TParam*, std::int32_t*), std::uint64_t size) {
         std::uint64_t fields[5]{};
-        const std::uint64_t size = capture == sceShareCaptureScreenshotExtended ? 24 : 40;
         reqId = 7;
-        Require(capture(fields, &reqId) == invalidParam && reqId == 7);
+        Require(capture(reinterpret_cast<const TParam*>(fields), &reqId) == invalidParam && reqId == 7);
         Require(capture(nullptr, &reqId) == invalidParam && reqId == 7);
         fields[0] = size;
-        Require(capture(fields, &reqId) == notSupported && reqId == -1);
-        Require(capture(fields, nullptr) == notSupported);
+        Require(capture(reinterpret_cast<const TParam*>(fields), &reqId) == notSupported && reqId == -1);
+        Require(capture(reinterpret_cast<const TParam*>(fields), nullptr) == notSupported);
         if (size == 40) {
             fields[2] = 1;
             reqId = 7;
-            Require(capture(fields, &reqId) == invalidParam && reqId == -1);
+            Require(capture(reinterpret_cast<const TParam*>(fields), &reqId) == invalidParam && reqId == -1);
             fields[3] = 1;
-            Require(capture(fields, nullptr) == notSupported);
+            Require(capture(reinterpret_cast<const TParam*>(fields), nullptr) == notSupported);
             fields[3] |= std::uint64_t{1} << 32;
-            Require(capture(fields, nullptr) == invalidParam);
+            Require(capture(reinterpret_cast<const TParam*>(fields), nullptr) == invalidParam);
         }
-    }
+    };
+    checkExtended(sceShareCaptureScreenshotExtended, 24);
+    checkExtended(sceShareCaptureVideoClipExtended, 40);
 
     for (Capture capture : {sceShareCaptureScreenshot, sceShareCaptureVideoClip}) {
         reqId = 7;
@@ -64,13 +55,13 @@ int main() {
 
     std::uint8_t status[18];
     std::memset(status, 0x5a, sizeof(status));
-    Require(sceShareGetCurrentStatus(1, status) == 0);
+    Require(sceShareGetCurrentStatus(1, reinterpret_cast<ShareCurrentStatus*>(status)) == 0);
     for (std::size_t index = 0; index < sizeof(status); ++index) Require(status[index] == (index < 16 ? 0 : 0x5a));
     std::memset(status, 0x5a, sizeof(status));
-    Require(sceShareGetCurrentStatus(0xffffffffu, status) == 0);
+    Require(sceShareGetCurrentStatus(0xffffffffu, reinterpret_cast<ShareCurrentStatus*>(status)) == 0);
     Require(status[0] == 0 && status[15] == 0 && status[16] == 0x5a);
     std::memset(status, 0x5a, sizeof(status));
-    Require(sceShareGetCurrentStatus(0, status) == invalidParam);
+    Require(sceShareGetCurrentStatus(0, reinterpret_cast<ShareCurrentStatus*>(status)) == invalidParam);
     Require(status[0] == 0x5a);
     Require(sceShareGetCurrentStatus(1, nullptr) == invalidParam);
     std::uint32_t running[2]{0xffffffffu, 0x5a5a5a5au};
diff --git a/core/libs/tests/GuestSharePlay.cpp b/core/libs/tests/GuestSharePlay.cpp
index 269d05fb4d..1bb330a5a8 100644
--- a/core/libs/tests/GuestSharePlay.cpp
+++ b/core/libs/tests/GuestSharePlay.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSharePlay/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
@@ -6,13 +7,6 @@
 #include <exception>
 #include <span>
 
-extern "C" {
-int APS5_VABI sceSharePlayInitialize(void*, std::size_t);
-int APS5_VABI sceSharePlayTerminate(void);
-int APS5_VABI sceSharePlayGetCurrentConnectionInfoA(SharePlayConnectionInfoA*);
-int APS5_VABI sceSharePlayProhibitController(std::uint8_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
@@ -50,8 +44,8 @@ int main() {
     Require(sceSharePlayProhibitController(1) == 0);
     Require(sceSharePlayProhibitController(1) == 0);
     Require(sceSharePlayProhibitController(0) == 0);
-    Require(Throws([] { sceSharePlayProhibitController(2); }));
-    Require(Throws([] { sceSharePlayProhibitController(255); }));
+    Require(sceSharePlayProhibitController(2) == invalidArgument);
+    Require(sceSharePlayProhibitController(255) == invalidArgument);
     Require(sceSharePlayTerminate() == 0);
     std::memset(&info, 0x5a, sizeof(info));
     Require(sceSharePlayGetCurrentConnectionInfoA(&info) == notInitialized);
diff --git a/core/libs/tests/GuestShmOpen.cpp b/core/libs/tests/GuestShmOpen.cpp
index ff4f8fb16c..6d6461d725 100644
--- a/core/libs/tests/GuestShmOpen.cpp
+++ b/core/libs/tests/GuestShmOpen.cpp
@@ -1,19 +1,12 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 #include <stdexcept>
-extern "C" {
-int APS5_VABI shm_open_nid_postfix(const char*, int, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-int APS5_VABI close_nid_postfix(int);
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t) noexcept;
-int APS5_VABI munmap_nid_postfix(void*, std::size_t) noexcept;
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static const char* const anonymous = reinterpret_cast<const char*>(1);
 static void RequireInvalid(const char* path, int flags) {
@@ -68,13 +61,7 @@ int main() {
     RequireInvalid("/anyps5-shm", 0x1);
     RequireInvalid("/anyps5-shm", 0x202 | 0x8);
 #ifdef _WIN32
-    bool threw = false;
-    try {
-        shm_open_nid_postfix("/anyps5-shm", 0x202, 0600);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
+    RequireInvalid("", 0x202);
 #else
     RequireInvalid("", 0x202);
 #endif
diff --git a/core/libs/tests/GuestSigaltstack.cpp b/core/libs/tests/GuestSigaltstack.cpp
index 6260846fd8..afd3787ccc 100644
--- a/core/libs/tests/GuestSigaltstack.cpp
+++ b/core/libs/tests/GuestSigaltstack.cpp
@@ -1,17 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 #include <thread>
-struct GuestStack {
-    void* sp;
-    std::size_t size;
-    int flags;
-};
-extern "C" {
-int APS5_VABI sigaltstack_nid_postfix(const GuestStack*, GuestStack*);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static GuestStack Query() {
     GuestStack current;
diff --git a/core/libs/tests/GuestSignalSets.cpp b/core/libs/tests/GuestSignalSets.cpp
index 786ddae94b..4cce1b63a4 100644
--- a/core/libs/tests/GuestSignalSets.cpp
+++ b/core/libs/tests/GuestSignalSets.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <climits>
@@ -7,21 +9,8 @@
 #include <cstring>
 #include <initializer_list>
 
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-
 extern "C" {
-int APS5_VABI sigemptyset_nid_postfix(GuestSignalSet*);
-int APS5_VABI sigfillset_nid_postfix(GuestSignalSet*);
-int APS5_VABI sigaddset_nid_postfix(GuestSignalSet*, int);
-int APS5_VABI sigdelset_nid_postfix(GuestSignalSet*, int);
-int APS5_VABI sigismember_nid_postfix(const GuestSignalSet*, int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI _sigprocmask_nid_postfix(int, const GuestSignalSet*, GuestSignalSet*);
-int APS5_VABI sigprocmask_nid_postfix(int, const void*, void*);
-[[gnu::returns_twice]] int APS5_VABI sigsetjmp_nid_postfix(std::uint64_t* buffer, int saveMask);
-[[noreturn]] void APS5_VABI siglongjmp_nid_postfix(std::uint64_t* buffer, int value);
+
 int APS5_VABI JumpKeepingCalleeSaved(std::uint64_t* buffer);
 }
 
diff --git a/core/libs/tests/GuestSignals.cpp b/core/libs/tests/GuestSignals.cpp
index 7f4740ac07..715ff0478c 100644
--- a/core/libs/tests/GuestSignals.cpp
+++ b/core/libs/tests/GuestSignals.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <csignal>
 #include <initializer_list>
@@ -9,33 +11,15 @@
 #include <chrono>
 #include <thread>
 using Handler = void (APS5_VABI *)(int);
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
+
 extern "C" {
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI raise_nid_postfix(int);
-int APS5_VABI kill_nid_postfix(int, int);
-int APS5_VABI getpid_nid_postfix();
-int APS5_VABI pthread_kill_nid_postfix(void*, int);
-void* APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadCreate(void** thread, const void* attr, void* (APS5_VABI *entry)(void*), void* arg, const char* name);
-int APS5_VABI scePthreadJoin(void* thread, void** retval);
-int APS5_VABI sigaction_nid_postfix(int, const void*, void*);
-int APS5_VABI sigprocmask_nid_postfix(int, const void*, void*);
-int APS5_VABI pthread_sigmask_nid_postfix(int, const void*, void*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sigsuspend_nid_postfix(const GuestSignalSet*);
-int APS5_VABI _is_signal_return_nid_postfix(std::uint64_t);
+
 unsigned int APS5_VABI GuestAlarm_nid_no_patch(unsigned int);
-int APS5_VABI sigpending_nid_postfix(GuestSignalSet*);
+
 }
-struct GuestSigaction {
-    std::uintptr_t handler;
-    int flags;
-    GuestSignalSet mask;
-};
+
 static_assert(sizeof(GuestSigaction) == 32);
+extern GuestSignalSet _sigintr_nid_postfix;
 static bool Same(const GuestSigaction& left, const GuestSigaction& right) {
     return left.handler == right.handler && left.flags == right.flags && std::memcmp(&left.mask, &right.mask, sizeof(left.mask)) == 0;
 }
@@ -54,7 +38,7 @@ void* APS5_VABI SuspendEntry(void* arg) {
     return nullptr;
 }
 struct SuspendSender {
-    void* target = nullptr;
+    Pthread target = nullptr;
     int result = -1;
 };
 struct EndingThread {
@@ -79,6 +63,7 @@ GuestSignalSet maskInHandler{};
 void APS5_VABI MaskCallback(int value) {
     received = value;
     sigprocmask_nid_postfix(1, nullptr, &maskInHandler);
+
 }
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
@@ -102,11 +87,11 @@ int main() {
     Require(pthread_kill_nid_postfix(nullptr, 15) == 3);
     Require(pthread_kill_nid_postfix(nullptr, 128) == 3);
     Require(pthread_kill_nid_postfix(nullptr, 129) == 22);
-    Require(pthread_kill_nid_postfix(reinterpret_cast<void*>(std::uintptr_t{0x10}), 15) == 3);
-    Require(pthread_kill_nid_postfix(reinterpret_cast<void*>(std::uintptr_t{0x10}), 0) == 3);
+    Require(pthread_kill_nid_postfix(reinterpret_cast<Pthread>(std::uintptr_t{0x10}), 15) == 3);
+    Require(pthread_kill_nid_postfix(reinterpret_cast<Pthread>(std::uintptr_t{0x10}), 0) == 3);
     {
         EndingThread ending;
-        void* thread = nullptr;
+        Pthread thread = nullptr;
         Require(scePthreadCreate(&thread, nullptr, EndingEntry, &ending, nullptr) == 0);
         Require(pthread_kill_nid_postfix(thread, 0) == 0);
         ending.release.store(true);
@@ -198,6 +183,7 @@ int main() {
     bool rejected = false;
     try {
         raise_nid_postfix(6);
+
     } catch (const std::runtime_error&) {
         rejected = true;
     }
@@ -250,10 +236,10 @@ int main() {
     Require(signal_nid_postfix(30, Callback) != invalid);
     received = 0;
     SuspendWait wait{&empty, 0, 0};
-    void* suspender = nullptr;
+    Pthread suspender = nullptr;
     Require(scePthreadCreate(&suspender, nullptr, SuspendEntry, &wait, nullptr) == 0);
     SuspendSender sender{suspender, -1};
-    void* senderThread = nullptr;
+    Pthread senderThread = nullptr;
     Require(scePthreadCreate(&senderThread, nullptr, SuspendSend, &sender, nullptr) == 0);
     Require(scePthreadJoin(senderThread, nullptr) == 0 && sender.result == 0);
     Require(scePthreadJoin(suspender, nullptr) == 0);
@@ -268,10 +254,10 @@ int main() {
     Require(signal_nid_postfix(73, Callback) != invalid);
     received = 0;
     SuspendWait highWait{&suspendMask, 0, 0};
-    void* highSuspender = nullptr;
+    Pthread highSuspender = nullptr;
     Require(scePthreadCreate(&highSuspender, nullptr, SuspendEntry, &highWait, nullptr) == 0);
     SuspendSender highSender{highSuspender, -1};
-    void* highSenderThread = nullptr;
+    Pthread highSenderThread = nullptr;
     Require(scePthreadCreate(&highSenderThread, nullptr, SuspendSend, &highSender, nullptr) == 0);
     Require(scePthreadJoin(highSenderThread, nullptr) == 0 && highSender.result == 0);
     Require(scePthreadJoin(highSuspender, nullptr) == 0);
@@ -398,4 +384,93 @@ int main() {
     Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
     Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0);
     Require(sigaction_nid_postfix(30, &restored, nullptr) == 0);
+
+    const GuestSigaction caught{callback, 0, {}};
+    received = 0;
+    Require(sigaction_nid_postfix(30, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &userSignal, nullptr) == 0);
+    Require(raise_nid_postfix(30) == 0 && received == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == userSignal.bits[0]);
+    Require(sigaction_nid_postfix(30, &restored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == userSignal.bits[0]);
+    Require(sigaction_nid_postfix(30, &ignored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(sigaction_nid_postfix(30, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+    Require(sigprocmask_nid_postfix(3, &userSignal, nullptr) == 0);
+    Require(raise_nid_postfix(30) == 0 && received == 0);
+    Require(signal_nid_postfix(30, ignore) == Callback);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(signal_nid_postfix(30, Callback) == ignore);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+    Require(signal_nid_postfix(30, nullptr) == Callback);
+
+    const GuestSignalSet windowSignal{{1u << 27, 0, 0, 0}};
+    Require(sigaction_nid_postfix(28, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &windowSignal, nullptr) == 0);
+    Require(raise_nid_postfix(28) == 0 && received == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == windowSignal.bits[0]);
+    Require(sigaction_nid_postfix(28, &restored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(sigaction_nid_postfix(28, &caught, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+    Require(sigaction_nid_postfix(28, &restored, nullptr) == 0);
+
+    const GuestSignalSet continueSignal{{1u << 18, 0, 0, 0}};
+    Require(sigprocmask_nid_postfix(3, &continueSignal, nullptr) == 0);
+    Require(raise_nid_postfix(19) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == continueSignal.bits[0]);
+    Require(signal_nid_postfix(19, nullptr) == nullptr);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0 && received == 0);
+
+    const GuestSignalSet highSignal{{0, 1u << 7, 0, 0}};
+    Require(sigprocmask_nid_postfix(3, &highSignal, nullptr) == 0);
+    Require(raise_nid_postfix(40) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[1] == highSignal.bits[1]);
+    Require(sigaction_nid_postfix(40, &ignored, nullptr) == 0);
+    Require(sigpending_nid_postfix(&pendingIgnored) == 0 && pendingIgnored.bits[0] == 0 && pendingIgnored.bits[1] == 0);
+    Require(sigaction_nid_postfix(40, &restored, nullptr) == 0);
+    Require(sigprocmask_nid_postfix(3, &noneBlocked, nullptr) == 0);
+    Require(_sigintr_nid_postfix.bits[0] == 0 && _sigintr_nid_postfix.bits[1] == 0 && _sigintr_nid_postfix.bits[2] == 0 &&
+        _sigintr_nid_postfix.bits[3] == 0);
+    GuestSigaction interruptible{};
+    Require(signal_nid_postfix(30, Callback) == nullptr);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
+    _sigintr_nid_postfix.bits[0] = 1u << 29;
+    Require(signal_nid_postfix(30, Callback) == Callback);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 &&
+        interruptible.handler == reinterpret_cast<std::uintptr_t>(Callback) && interruptible.flags == 0);
+    signal_nid_postfix(31, Callback);
+
+    Require(sigaction_nid_postfix(31, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
+    _sigintr_nid_postfix.bits[3] = 1u << 31;
+    Require(signal_nid_postfix(128, Callback) == nullptr);
+    Require(sigaction_nid_postfix(128, nullptr, &interruptible) == 0 && interruptible.flags == 0);
+    _sigintr_nid_postfix.bits[0] = 0;
+    _sigintr_nid_postfix.bits[3] = 0;
+    Require(signal_nid_postfix(30, Callback) == Callback);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
+    Require(signal_nid_postfix(30, nullptr) == Callback && signal_nid_postfix(31, nullptr) == Callback &&
+        signal_nid_postfix(128, nullptr) == Callback);
+    Require(signal_nid_postfix(30, Callback) == nullptr);
+    Require(siginterrupt_nid_postfix(30, 1) == 0 && _sigintr_nid_postfix.bits[0] == (1u << 29));
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 &&
+        interruptible.handler == reinterpret_cast<std::uintptr_t>(Callback) && interruptible.flags == 0);
+    Require(signal_nid_postfix(30, Callback) == Callback);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 && interruptible.flags == 0);
+    Require(siginterrupt_nid_postfix(30, 0) == 0 && _sigintr_nid_postfix.bits[0] == 0);
+    Require(sigaction_nid_postfix(30, nullptr, &interruptible) == 0 &&
+        interruptible.handler == reinterpret_cast<std::uintptr_t>(Callback) && interruptible.flags == 0x2);
+    Require(siginterrupt_nid_postfix(128, 1) == 0 && _sigintr_nid_postfix.bits[3] == (1u << 31));
+    Require(sigaction_nid_postfix(128, nullptr, &interruptible) == 0 && interruptible.handler == 0 && interruptible.flags == 0);
+    Require(siginterrupt_nid_postfix(128, 0) == 0 && _sigintr_nid_postfix.bits[3] == 0);
+    Require(sigaction_nid_postfix(128, nullptr, &interruptible) == 0 && interruptible.flags == 0x2);
+    for (const int badSignal : {0, -1, 129}) {
+        *__error_nid_postfix() = 0;
+        Require(siginterrupt_nid_postfix(badSignal, 1) == -1 && *__error_nid_postfix() == 22);
+    }
+    Require(_sigintr_nid_postfix.bits[0] == 0 && _sigintr_nid_postfix.bits[3] == 0);
+    Require(signal_nid_postfix(30, nullptr) == Callback);
+    Require(sigaction_nid_postfix(128, &restored, nullptr) == 0);
 }
diff --git a/core/libs/tests/GuestSigninDialog.cpp b/core/libs/tests/GuestSigninDialog.cpp
index d8410fcbd5..0082e506f1 100644
--- a/core/libs/tests/GuestSigninDialog.cpp
+++ b/core/libs/tests/GuestSigninDialog.cpp
@@ -1,18 +1,9 @@
+#include "prx/libSceSigninDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceSigninDialogInitialize(void);
-int APS5_VABI sceSigninDialogOpen(const void* param);
-int APS5_VABI sceSigninDialogUpdateStatus(void);
-int APS5_VABI sceSigninDialogGetStatus(void);
-int APS5_VABI sceSigninDialogGetResult(void* result);
-int APS5_VABI sceSigninDialogClose(void);
-int APS5_VABI sceSigninDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestSigtimedwait.cpp b/core/libs/tests/GuestSigtimedwait.cpp
index 0663a3ce2f..4c0101000c 100644
--- a/core/libs/tests/GuestSigtimedwait.cpp
+++ b/core/libs/tests/GuestSigtimedwait.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <atomic>
@@ -6,13 +8,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <thread>
-struct GuestSignalSet {
-    std::uint32_t bits[4];
-};
-struct GuestTimespec {
-    std::int64_t seconds;
-    std::int64_t nanoseconds;
-};
+
 struct GuestSiginfo {
     std::int32_t signo;
     std::int32_t error;
@@ -28,22 +24,7 @@ struct GuestSiginfo {
     std::int32_t tail;
 };
 using Handler = void (APS5_VABI *)(int);
-extern "C" {
-int APS5_VABI sigtimedwait_nid_postfix(const GuestSignalSet*, void*, const GuestTimespec*);
-int APS5_VABI sigwaitinfo_nid_postfix(const GuestSignalSet*, void*);
-int APS5_VABI sigwait_nid_postfix(const GuestSignalSet*, int*);
-int APS5_VABI pause_nid_postfix(void);
-Handler APS5_VABI signal_nid_postfix(int, Handler);
-int APS5_VABI raise_nid_postfix(int);
-int APS5_VABI kill_nid_postfix(int, int);
-int APS5_VABI _sigprocmask_nid_postfix(int, const GuestSignalSet*, GuestSignalSet*);
-int APS5_VABI getpid_nid_postfix(void);
-Pthread APS5_VABI scePthreadSelf(void);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI pthread_kill_nid_postfix(Pthread thread, int guest);
-int* APS5_VABI __error_nid_postfix();
-}
+
 volatile int received = 0;
 void APS5_VABI Callback(int value) { received = value; }
 static void Require(bool value) { if (!value) std::abort(); }
@@ -97,8 +78,8 @@ static void CheckTimeoutWithUnrelatedSignals() {
     const GuestSignalSet blocked{{(1u << 1) | (1u << 12), 0, 0, 0}};
     const GuestSignalSet pipe{{1u << 12, 0, 0, 0}};
     const GuestSignalSet interrupt{{1u << 1, 0, 0, 0}};
-    const GuestTimespec timeout{0, 200000000};
-    const GuestTimespec poll{0, 0};
+    const KernelTimespec timeout{0, 200000000};
+    const KernelTimespec poll{0, 0};
     GuestSignalSet previous{};
     Require(_sigprocmask_nid_postfix(1, &blocked, &previous) == 0);
     TimeoutSender sender{scePthreadSelf()};
@@ -122,8 +103,8 @@ int main() {
     const GuestSignalSet empty{{0, 0, 0, 0}};
     const GuestSignalSet pipe{{1u << 12, 0, 0, 0}};
     const GuestSignalSet interrupt{{1u << 1, 0, 0, 0}};
-    const GuestTimespec poll{0, 0};
-    const GuestTimespec expired{0, 1000000000};
+    const KernelTimespec poll{0, 0};
+    const KernelTimespec expired{0, 1000000000};
     GuestSiginfo info{};
     int taken = -1;
     *__error_nid_postfix() = 0;
@@ -189,7 +170,7 @@ int main() {
     Require(sigtimedwait_nid_postfix(&pipe, nullptr, nullptr) == 13);
     JoinSender(senderThread, sender);
     senderThread = StartSender(sender);
-    const GuestTimespec patience{1, 0};
+    const KernelTimespec patience{1, 0};
     Require(sigtimedwait_nid_postfix(&pipe, &info, &patience) == 13 && info.signo == 13);
     JoinSender(senderThread, sender);
     Require(signal_nid_postfix(15, Callback) != reinterpret_cast<Handler>(static_cast<std::uintptr_t>(-1)));
diff --git a/core/libs/tests/GuestSleepCancel.cpp b/core/libs/tests/GuestSleepCancel.cpp
index 463a4a0cbe..a77fbe126f 100644
--- a/core/libs/tests/GuestSleepCancel.cpp
+++ b/core/libs/tests/GuestSleepCancel.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <atomic>
@@ -9,15 +10,6 @@
 #include <string_view>
 #include <thread>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** result);
-int APS5_VABI scePthreadCancel(Pthread thread);
-int APS5_VABI scePthreadSetcancelstate(int state, int* oldState);
-void APS5_VABI scePthreadTestcancel();
-unsigned int APS5_VABI sleep_nid_postfix(unsigned int seconds);
-}
-
 static void Require(bool value, std::source_location location = std::source_location::current()) {
     if (value) return;
     std::fprintf(stderr, "%s:%u: requirement failed\n", location.file_name(), location.line());
@@ -46,6 +38,7 @@ static void* APS5_VABI Sleeper(void*) {
     if (disabled) {
         Require(scePthreadSetcancelstate(0, nullptr) == 0);
         scePthreadTestcancel();
+
         Require(false);
     }
     return nullptr;
diff --git a/core/libs/tests/GuestSleepWake.cpp b/core/libs/tests/GuestSleepWake.cpp
index 177ef4b990..d4477301c6 100644
--- a/core/libs/tests/GuestSleepWake.cpp
+++ b/core/libs/tests/GuestSleepWake.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/Time/include/Time.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -6,7 +7,7 @@
 #include <thread>
 
 extern "C" {
-int APS5_VABI sceKernelUsleep_nid_postfix(KernelUseconds microseconds);
+
 void KernelWakeSleepers_nid_no_patch();
 void KernelNoteGpuSubmit_nid_no_patch();
 }
diff --git a/core/libs/tests/GuestSocialScreenDialog.cpp b/core/libs/tests/GuestSocialScreenDialog.cpp
new file mode 100644
index 0000000000..dcbb9c085e
--- /dev/null
+++ b/core/libs/tests/GuestSocialScreenDialog.cpp
@@ -0,0 +1,63 @@
+#include "prx/libSceSocialScreenDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000D);
+constexpr int kResultUserCanceled = 1;
+
+}
+
+int main() {
+    std::int64_t param = 0;
+    std::int32_t result[2] = {-1, -1};
+
+    Require(sceSocialScreenDialogTerminate() == kErrNotInitialized);
+    Require(sceSocialScreenDialogOpen(&param) == kErrNotInitialized);
+    Require(sceSocialScreenDialogClose() == kErrNotInitialized);
+    Require(sceSocialScreenDialogGetResult(result) == kErrNotInitialized);
+    Require(sceSocialScreenDialogGetStatus() == kStatusNone);
+    Require(sceSocialScreenDialogUpdateStatus() == kStatusNone);
+
+    Require(sceSocialScreenDialogInitialize() == 0);
+    Require(sceSocialScreenDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceSocialScreenDialogGetStatus() == kStatusInitialized);
+    Require(sceSocialScreenDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceSocialScreenDialogOpen(nullptr) == kErrArgNull);
+    Require(sceSocialScreenDialogGetResult(result) == kErrNotFinished);
+
+    Require(sceSocialScreenDialogOpen(&param) == 0);
+    Require(sceSocialScreenDialogGetStatus() == kStatusFinished);
+    Require(sceSocialScreenDialogUpdateStatus() == kStatusFinished);
+
+    Require(sceSocialScreenDialogGetResult(nullptr) == kErrArgNull);
+    Require(sceSocialScreenDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(result[1] == -1);
+
+    Require(sceSocialScreenDialogClose() == 0);
+    Require(sceSocialScreenDialogTerminate() == 0);
+    Require(sceSocialScreenDialogTerminate() == kErrNotInitialized);
+    Require(sceSocialScreenDialogGetStatus() == kStatusNone);
+    Require(sceSocialScreenDialogUpdateStatus() == kStatusNone);
+
+    Require(sceSocialScreenDialogInitialize() == 0);
+    Require(sceSocialScreenDialogUpdateStatus() == kStatusInitialized);
+    Require(sceSocialScreenDialogClose() == 0);
+    Require(sceSocialScreenDialogUpdateStatus() == kStatusFinished);
+    result[0] = -1;
+    Require(sceSocialScreenDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(sceSocialScreenDialogTerminate() == 0);
+}
diff --git a/core/libs/tests/GuestSocketAddressLength.cpp b/core/libs/tests/GuestSocketAddressLength.cpp
index d18dd5910c..a95958f7a6 100644
--- a/core/libs/tests/GuestSocketAddressLength.cpp
+++ b/core/libs/tests/GuestSocketAddressLength.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -5,15 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int Stream = 1;
@@ -77,11 +70,72 @@ void FullAddressesStillWork() {
     Require(close_nid_postfix(stream) == 0, "close failed");
 }
 
+std::array<std::uint8_t, 255> PaddedLoopback(int family) {
+    std::array<std::uint8_t, 255> address{};
+    if (family == 2) {
+        const auto v4 = Loopback();
+        std::memcpy(address.data(), v4.data(), v4.size());
+    } else {
+        address[0] = 28;
+        address[1] = 28;
+        address[23] = 1;
+    }
+    return address;
+}
+
+void LongAddressesAreInvalid(int family, int type) {
+    const std::uint32_t size = family == 2 ? 16 : 28;
+    auto address = PaddedLoopback(family);
+    const int descriptor = socket_nid_postfix(family, type, 0);
+    const int listener = type == Stream ? socket_nid_postfix(family, Stream, 0) : descriptor;
+    Require(descriptor >= 0 && listener >= 0, "socket failed");
+    for (std::uint32_t length = size + 1; length <= address.size(); ++length) {
+        Require(Fails(bind_nid_postfix(descriptor, address.data(), length), ErrorInvalid), "bind with an address longer than sockaddr_in or sockaddr_in6 must fail with EINVAL (22)");
+    }
+    Require(bind_nid_postfix(listener, address.data(), size) == 0, "bind with an address of exactly the size of sockaddr_in or sockaddr_in6 failed");
+    if (type == Stream) Require(listen_nid_postfix(listener, 1) == 0, "listen failed");
+    std::uint32_t named = size;
+    Require(getsockname_nid_postfix(listener, address.data(), &named) == 0 && named == size, "getsockname failed");
+    for (std::uint32_t length = size + 1; length <= address.size(); ++length) {
+        Require(Fails(connect_nid_postfix(descriptor, address.data(), length), ErrorInvalid), "connect with an address longer than sockaddr_in or sockaddr_in6 must fail with EINVAL (22)");
+    }
+    if (family == 28 && type == Datagram) {
+        for (std::uint32_t length = size + 1; length <= address.size(); ++length) {
+            Require(Fails(sendto_nid_postfix(descriptor, "x", 1, 0, address.data(), length), ErrorInvalid), "sendto on an AF_INET6 datagram socket with an address longer than sockaddr_in6 must fail with EINVAL (22)");
+        }
+        Require(sendto_nid_postfix(descriptor, "x", 1, 0, address.data(), size) == 1, "sendto with an address of exactly the size of sockaddr_in6 failed");
+    }
+    Require(connect_nid_postfix(descriptor, address.data(), size) == 0, "connect with an address of exactly the size of sockaddr_in or sockaddr_in6 failed");
+    Require(close_nid_postfix(descriptor) == 0, "close failed");
+    if (listener != descriptor) Require(close_nid_postfix(listener) == 0, "close failed");
+}
+
+void LongMappedAddressesBindOnlyDualStackDatagramSockets() {
+    const int datagram = socket_nid_postfix(28, Datagram, 0);
+    Require(datagram >= 0, "socket failed");
+    std::array<std::uint8_t, 29> mapped{29, 28};
+    mapped[18] = 0xff;
+    mapped[19] = 0xff;
+    mapped[20] = 127;
+    mapped[23] = 1;
+    Require(Fails(bind_nid_postfix(datagram, mapped.data(), mapped.size()), ErrorInvalid), "bind of a long IPv4-mapped address with IPV6_V6ONLY set must fail with EINVAL (22)");
+    const int off = 0;
+    Require(setsockopt_nid_postfix(datagram, 41, 27, &off, sizeof(off)) == 0, "clearing IPV6_V6ONLY failed");
+    Require(bind_nid_postfix(datagram, mapped.data(), mapped.size()) == 0, "udp6_bind passes a long IPv4-mapped address to in_pcbbind without IPV6_V6ONLY, so bind must succeed");
+    Require(Fails(sendto_nid_postfix(datagram, "x", 1, 0, mapped.data(), mapped.size()), ErrorInvalid), "udp6_send checks the length before the IPv4-mapped case, so sendto must fail with EINVAL (22)");
+    Require(close_nid_postfix(datagram) == 0, "close failed");
+}
+
 }
 
 int main() {
     ShortAddressesAreInvalid();
     ArgumentsAreCheckedBeforeTheDescriptor();
     FullAddressesStillWork();
+    LongAddressesAreInvalid(2, Stream);
+    LongAddressesAreInvalid(2, Datagram);
+    LongAddressesAreInvalid(28, Stream);
+    LongAddressesAreInvalid(28, Datagram);
+    LongMappedAddressesBindOnlyDualStackDatagramSockets();
     return 0;
 }
diff --git a/core/libs/tests/GuestSocketConnectListening.cpp b/core/libs/tests/GuestSocketConnectListening.cpp
index 0f42c12bdb..fb5e900c3d 100644
--- a/core/libs/tests/GuestSocketConnectListening.cpp
+++ b/core/libs/tests/GuestSocketConnectListening.cpp
@@ -1,20 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int Inet = 2;
diff --git a/core/libs/tests/GuestSocketDescriptorFlags.cpp b/core/libs/tests/GuestSocketDescriptorFlags.cpp
index ef8772f738..6d14f3997a 100644
--- a/core/libs/tests/GuestSocketDescriptorFlags.cpp
+++ b/core/libs/tests/GuestSocketDescriptorFlags.cpp
@@ -1,18 +1,10 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int DuplicateDescriptor = 0;
diff --git a/core/libs/tests/GuestSocketDescriptors.cpp b/core/libs/tests/GuestSocketDescriptors.cpp
index 9a0ac4f5e6..3a66b41464 100644
--- a/core/libs/tests/GuestSocketDescriptors.cpp
+++ b/core/libs/tests/GuestSocketDescriptors.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -25,32 +28,6 @@ struct GuestDescriptorSet {
     }
 };
 
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI dup_nid_postfix(int);
-int APS5_VABI dup2_nid_postfix(int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int APS5_VABI select_nid_postfix(int, void*, void*, void*, const void*);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket descriptor check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -159,7 +136,7 @@ static void CloseReleasesNumber() {
     Require(files.back() == socket);
     unsigned char bytes[4]{};
     Require(read_nid_postfix(socket, bytes, sizeof(bytes)) == sizeof(bytes));
-    PollDescriptor entry{socket, In, 0};
+    GuestPollDescriptor entry{socket, In, 0};
     Require(poll_nid_postfix(&entry, 1, 0) == 1 && entry.revents == In);
     for (const int file : files) Require(close_nid_postfix(file) == 0);
     const int kernelClosed = Socket();
diff --git a/core/libs/tests/GuestSocketEvents.cpp b/core/libs/tests/GuestSocketEvents.cpp
index 1ef4eea859..59bd2bb4ad 100644
--- a/core/libs/tests/GuestSocketEvents.cpp
+++ b/core/libs/tests/GuestSocketEvents.cpp
@@ -1,37 +1,17 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
+#include <atomic>
 #include <chrono>
 #include <cstdint>
 #include <cstdlib>
+#include <filesystem>
 #include <stdexcept>
+#include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI pipe_nid_postfix(int*);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceKernelAddReadEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
-int APS5_VABI sceKernelDeleteReadEvent(KernelEqueue eq, int fd);
-int APS5_VABI sceKernelAddWriteEvent(KernelEqueue eq, int fd, std::size_t size, void* udata);
-int APS5_VABI sceKernelDeleteWriteEvent(KernelEqueue eq, int fd);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ENOENT = static_cast<int>(0x80020002);
-static constexpr int SCE_KERNEL_ERROR_EBADF = static_cast<int>(0x80020009);
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003c);
 static constexpr int EVFILT_READ = -1;
 static constexpr int EVFILT_WRITE = -2;
 static constexpr std::uint16_t EV_EOF = 0x8000;
@@ -96,8 +76,83 @@ static void PipeReadEvents() {
     Require(sceKernelDeleteEqueue(eq) == SCE_OK);
 }
 
+static void RegularFileEvents() {
+    const std::string path = "anyps5-equeue-file-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const int file = open_nid_postfix(path.c_str(), 0x0002 | 0x0200, 0644);
+    Require(file >= 0);
+    Require(write_nid_postfix(file, "0123456789", 10) == 10);
+    Require(lseek_nid_postfix(file, 2, 0) == 2);
+    KernelEqueue eq = 0;
+    Require(sceKernelCreateEqueue(&eq, "file") == SCE_OK);
+    const KernelUseconds shortTimeout = 20000;
+    const KernelUseconds timeout = 1000000;
+    int marker = 0;
+    int count = 0;
+    std::array<KernelEvent, 4> events{};
+    Require(sceKernelAddReadEvent(eq, file, 1, &marker) == SCE_OK);
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &timeout) == SCE_OK);
+    Require(count == 1 && events[0].ident == static_cast<std::uintptr_t>(file) && events[0].filter == EVFILT_READ);
+    Require(events[0].data == 8 && events[0].udata == &marker);
+    Require(lseek_nid_postfix(file, 0, 2) == 10);
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &shortTimeout) == SCE_KERNEL_ERROR_ETIMEDOUT);
+    const int appender = open_nid_postfix(path.c_str(), 0x0002, 0);
+    Require(appender >= 0);
+    std::thread writer([appender] {
+        std::this_thread::sleep_for(std::chrono::milliseconds(50));
+        Require(lseek_nid_postfix(appender, 0, 2) == 10);
+        Require(write_nid_postfix(appender, "abc", 3) == 3);
+    });
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, nullptr) == SCE_OK);
+    writer.join();
+    Require(count == 1 && events[0].data == 3);
+    Require(sceKernelDeleteReadEvent(eq, file) == SCE_OK);
+    Require(sceKernelAddWriteEvent(eq, file, 0, nullptr) == SCE_OK);
+    Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &timeout) == SCE_OK);
+    Require(count == 1 && events[0].filter == EVFILT_WRITE && events[0].data == 0);
+    Require(sceKernelDeleteWriteEvent(eq, file) == SCE_OK);
+    Require(Rejects(sceKernelAddReadEvent, eq, file, 64));
+    Require(Rejects(sceKernelAddWriteEvent, eq, file, 64));
+    Require(sceKernelAddReadEvent(eq, file, 0, nullptr) == SCE_OK);
+    Require(close_nid_postfix(file) == 0);
+    Require(sceKernelDeleteReadEvent(eq, file) == SCE_KERNEL_ERROR_ENOENT);
+    Require(sceKernelAddReadEvent(eq, file, 0, nullptr) == SCE_KERNEL_ERROR_EBADF);
+    Require(close_nid_postfix(appender) == 0);
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+    Require(std::filesystem::remove(path));
+}
+
+static void CloseWhileWaitingOnFile() {
+    const std::string path = "anyps5-equeue-close-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const int created = open_nid_postfix(path.c_str(), 0x0002 | 0x0200, 0644);
+    Require(created >= 0);
+    Require(close_nid_postfix(created) == 0);
+    KernelEqueue eq = 0;
+    Require(sceKernelCreateEqueue(&eq, "close") == SCE_OK);
+    std::atomic<bool> stop{false};
+    std::thread waiter([eq, &stop] {
+        const KernelUseconds timeout = 1000;
+        std::array<KernelEvent, 4> events{};
+        int count = 0;
+        while (!stop.load()) {
+            Require(sceKernelWaitEqueue(eq, events.data(), events.size(), &count, &timeout) == SCE_KERNEL_ERROR_ETIMEDOUT);
+        }
+    });
+    for (int i = 0; i < 2000; ++i) {
+        const int file = open_nid_postfix(path.c_str(), 0x0002, 0);
+        Require(file >= 0);
+        Require(sceKernelAddReadEvent(eq, file, 0, nullptr) == SCE_OK);
+        Require(close_nid_postfix(file) == 0);
+    }
+    stop.store(true);
+    waiter.join();
+    Require(sceKernelDeleteEqueue(eq) == SCE_OK);
+    Require(std::filesystem::remove(path));
+}
+
 int main() {
     PipeReadEvents();
+    RegularFileEvents();
+    CloseWhileWaitingOnFile();
     const int listener = socket_nid_postfix(2, 1, 6);
     Require(listener >= 0);
     std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
diff --git a/core/libs/tests/GuestSocketHostWrite.cpp b/core/libs/tests/GuestSocketHostWrite.cpp
index df022d1f8a..a49e49d08d 100644
--- a/core/libs/tests/GuestSocketHostWrite.cpp
+++ b/core/libs/tests/GuestSocketHostWrite.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 #include "prx/libc/include/GuestArena.hpp"
@@ -12,57 +16,8 @@
 #include <cstring>
 #include <thread>
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t nameLength;
-    NetIovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
 static_assert(sizeof(NetMsghdr) == 48 && offsetof(NetMsghdr, iov) == 16 && offsetof(NetMsghdr, flags) == 44);
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetListen(int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetAccept(int, void*, std::uint32_t*);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetRecvmsg(int, NetMsghdr*, int);
-int APS5_VABI sceNetSocketClose(int);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI sceKernelAllocateDirectMemory(std::int64_t, std::int64_t, std::size_t, std::size_t, int, std::int64_t*);
-int APS5_VABI sceKernelMapDirectMemory(void**, std::size_t, int, int, std::int64_t, std::size_t);
-int APS5_VABI sceKernelMprotect(void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int APS5_VABI sceKernelReleaseDirectMemory(std::int64_t, std::size_t);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -94,6 +49,7 @@ int main(int argc, char** argv) {
     const auto create = [&] {
         return net ? sceNetSocket(nullptr, 2, stream ? 1 : 2, stream ? 6 : 17) :
             socket_nid_postfix(2, stream ? 1 : 2, stream ? 6 : 17);
+
     };
     int receiver = create();
     const int sender = create();
@@ -156,6 +112,7 @@ int main(int argc, char** argv) {
         do {
             result = net ? sceNetRecv(receiver, buffer.data(), buffer.size(), 2) :
                 recv_nid_postfix(receiver, buffer.data(), buffer.size(), 2);
+
             if (result == sizeof(payload) || (result < 0 && *error != 35)) break;
             std::this_thread::sleep_for(std::chrono::milliseconds(1));
         } while (std::chrono::steady_clock::now() < deadline);
@@ -312,8 +269,8 @@ int main(int argc, char** argv) {
             Require(sceKernelMprotect(static_cast<char*>(outputMapping) + page, page, 3) == 0,
                 "restore bytes beyond the sender address");
         }
-        Require(sceKernelMunmap(outputTwin, page * 2) == 0, "unmap the second sender output mapping");
-        Require(sceKernelMunmap(outputMapping, page * 2) == 0, "unmap sender outputs");
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(outputTwin), page * 2) == 0, "unmap the second sender output mapping");
+        Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(outputMapping), page * 2) == 0, "unmap sender outputs");
         Require(sceKernelReleaseDirectMemory(outputPhysical, page * 2) == 0, "release sender output memory");
     }
     reset();
@@ -355,7 +312,7 @@ int main(int argc, char** argv) {
         waitForPacket();
         Require(sceNetRecvmsg(receiver, message, 0) == static_cast<int>(0x8041010eu) && *error == 14,
             "read-only message outputs fail with EFAULT");
-        Require(message->flags == -1 && message->controlLength == 123, "rejected message outputs unchanged");
+        Require(message->flags == -1 && message->control_length == 123, "rejected message outputs unchanged");
         Require(receive(recovery.data(), recovery.size(), 0, nullptr, nullptr) == sizeof(payload),
             "a rejected message preserves queued data");
         Require(sceKernelMprotect(twin, page, 3) == 0, "restore receive message write permission");
@@ -411,7 +368,7 @@ int main(int argc, char** argv) {
     Require(Protection(buffer) == PAGE_READONLY, "completed receive can be rearmed");
     Require((net ? sceNetSocketClose(sender) : close_nid_postfix(sender)) == 0, "close sender");
     Require((net ? sceNetSocketClose(receiver) : close_nid_postfix(receiver)) == 0, "close receiver");
-    Require(sceKernelMunmap(twin, page * 2) == 0, "unmap the second direct memory mapping");
-    Require(sceKernelMunmap(mapping, page * 2) == 0, "unmap direct memory");
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(twin), page * 2) == 0, "unmap the second direct memory mapping");
+    Require(sceKernelMunmap(reinterpret_cast<std::uint64_t>(mapping), page * 2) == 0, "unmap direct memory");
     Require(sceKernelReleaseDirectMemory(physical, page * 2) == 0, "release direct memory");
 }
diff --git a/core/libs/tests/GuestSocketOnNonSocket.cpp b/core/libs/tests/GuestSocketOnNonSocket.cpp
index 953bd473d0..49c9d54ea0 100644
--- a/core/libs/tests/GuestSocketOnNonSocket.cpp
+++ b/core/libs/tests/GuestSocketOnNonSocket.cpp
@@ -1,25 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ErrorBadDescriptor = 9;
diff --git a/core/libs/tests/GuestSocketOptions.cpp b/core/libs/tests/GuestSocketOptions.cpp
index 7ab20ba2f4..f100a443a7 100644
--- a/core/libs/tests/GuestSocketOptions.cpp
+++ b/core/libs/tests/GuestSocketOptions.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -5,21 +7,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI poll_nid_postfix(void*, std::uint32_t, int);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int Stream = 1;
@@ -35,6 +22,9 @@ constexpr int SoReusePort = 0x200;
 constexpr int SoTimestamp = 0x400;
 constexpr int SoNoSigpipe = 0x800;
 constexpr int SoSendBuffer = 0x1001;
+constexpr int SoReceiveBuffer = 0x1002;
+constexpr int SoSendLowWater = 0x1003;
+constexpr int SoReceiveLowWater = 0x1004;
 constexpr int SoError = 0x1007;
 constexpr int SoType = 0x1008;
 constexpr int ErrorInvalid = 22;
@@ -48,12 +38,6 @@ struct Linger {
     std::int32_t seconds;
 };
 
-struct PollDescriptor {
-    std::int32_t descriptor;
-    std::int16_t events;
-    std::int16_t revents;
-};
-
 void Require(bool condition, const char* what) {
     if (condition) return;
     std::fprintf(stderr, "%s (errno %d)\n", what, *__error_nid_postfix());
@@ -95,7 +79,7 @@ std::array<std::uint8_t, 16> Listen(int* listener) {
 }
 
 void WaitUntilSettled(int descriptor) {
-    PollDescriptor entry{descriptor, 0x1 | 0x4, 0};
+    GuestPollDescriptor entry{descriptor, 0x1 | 0x4, 0};
     Require(poll_nid_postfix(&entry, 1, 6000) == 1, "the nonblocking connect did not settle within 6 s");
 }
 
@@ -154,16 +138,41 @@ void BooleanOptionsReportTheirBit() {
     Require(GetInt(datagram, SoBroadcast) == SoBroadcast, "SO_BROADCAST reads back as its bit");
     SetInt(stream, SoNoSigpipe, 1);
     Require(GetInt(stream, SoNoSigpipe) == SoNoSigpipe, "SO_NOSIGPIPE reads back as its bit");
-    for (const int option : {SoReusePort, SoDebug, SoUseLoopback, SoTimestamp}) {
-        const int one = 1;
-        Require(SetFails(stream, SolSocket, option, &one, sizeof(one), ErrorNoProtocolOption), "an option no title needs must fail with ENOPROTOOPT (42)");
+    for (const int option : {SoReusePort, SoDebug, SoUseLoopback, SoTimestamp, 0x2000, 0x10000}) {
+        Require(GetInt(stream, option) == 0, "a kept flag starts off");
+        SetInt(stream, option, 5);
+        Require(GetInt(stream, option) == option, "a kept flag reads back as its bit");
+        SetInt(stream, option, 0);
+        Require(GetInt(stream, option) == 0, "a kept flag turns off");
+    }
+    for (const int option : {0x4000, 0x8000}) {
+        SetInt(stream, option, 1);
         int value = 0;
         std::uint32_t size = sizeof(value);
-        Require(getsockopt_nid_postfix(stream, SolSocket, option, &value, &size) == -1 && *__error_nid_postfix() == ErrorNoProtocolOption, "getsockopt of an option no title needs must fail with ENOPROTOOPT (42)");
+        Require(getsockopt_nid_postfix(stream, SolSocket, option, &value, &size) == -1 && *__error_nid_postfix() == ErrorNoProtocolOption, "SO_NO_OFFLOAD and SO_NO_DDP are accepted but cannot be read");
     }
+    const unsigned char narrowFlag = 1;
+    Require(SetFails(stream, SolSocket, SoDebug, &narrowFlag, 1, ErrorInvalid), "a flag shorter than an int must fail with EINVAL (22)");
     Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0, "close failed");
 }
 
+void ReusePortSharesAPort() {
+    const int first = socket_nid_postfix(2, Datagram, 0);
+    const int second = socket_nid_postfix(2, Datagram, 0);
+    const int third = socket_nid_postfix(2, Datagram, 0);
+    Require(first >= 0 && second >= 0 && third >= 0, "socket failed");
+    SetInt(first, SoReusePort, 1);
+    SetInt(second, SoReusePort, 1);
+    Require(GetInt(first, SoReusePort) == SoReusePort && GetInt(first, 0x4) == 0, "SO_REUSEPORT does not read back as SO_REUSEADDR");
+    auto address = Loopback(0);
+    Require(bind_nid_postfix(first, address.data(), address.size()) == 0, "bind failed");
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(first, address.data(), &size) == 0, "getsockname failed");
+    Require(bind_nid_postfix(second, address.data(), address.size()) == 0, "a second SO_REUSEPORT socket must bind the same port");
+    Require(bind_nid_postfix(third, address.data(), address.size()) == -1 && *__error_nid_postfix() == 48, "a socket without SO_REUSEPORT must fail with EADDRINUSE (48)");
+    Require(close_nid_postfix(first) == 0 && close_nid_postfix(second) == 0 && close_nid_postfix(third) == 0, "close failed");
+}
+
 void LingerFollowsFreeBsd() {
     const int stream = socket_nid_postfix(2, Stream, 0);
     Require(stream >= 0, "socket failed");
@@ -204,6 +213,171 @@ void LengthsFollowFreeBsd() {
     Require(close_nid_postfix(stream) == 0, "close failed");
 }
 
+void BuffersFollowThePs5() {
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    const int datagram = socket_nid_postfix(28, Datagram, 0);
+    Require(stream >= 0 && datagram >= 0, "socket failed");
+    Require(GetInt(stream, SoSendBuffer) == 32768 && GetInt(stream, SoReceiveBuffer) == 65536, "a stream socket starts with 32768 and 65536 bytes");
+    Require(GetInt(stream, SoSendLowWater) == 2048 && GetInt(stream, SoReceiveLowWater) == 1, "the low-water marks start at 2048 and 1");
+    Require(GetInt(datagram, SoSendBuffer) == 9216 && GetInt(datagram, SoReceiveBuffer) == 42080, "a datagram socket starts with 9216 and 42080 bytes");
+    SetInt(stream, SoSendBuffer, 1000);
+    Require(GetInt(stream, SoSendBuffer) == 1000 && GetInt(stream, SoSendLowWater) == 1000, "a smaller buffer is kept and lowers its low-water mark");
+    SetInt(stream, SoReceiveBuffer, 524289);
+    Require(GetInt(stream, SoReceiveBuffer) == 524288, "a buffer above 512 KiB is limited to 524288 bytes");
+    SetInt(stream, SoSendBuffer, 5592405);
+    Require(GetInt(stream, SoSendBuffer) == 524288, "the largest reservation is accepted and limited");
+    const int tooLarge = 5592406;
+    Require(SetFails(stream, SolSocket, SoSendBuffer, &tooLarge, sizeof(tooLarge), 55), "a reservation above sb_max must fail with ENOBUFS (55)");
+    Require(GetInt(stream, SoSendBuffer) == 524288, "a failed reservation keeps the buffer");
+    SetInt(stream, SoReceiveLowWater, 600000);
+    Require(GetInt(stream, SoReceiveLowWater) == 524288, "a low-water mark above the buffer is limited to it");
+    SetInt(stream, SoReceiveBuffer, 50);
+    Require(GetInt(stream, SoReceiveLowWater) == 50, "a smaller buffer lowers the low-water mark");
+    const int zero = 0;
+    Require(SetFails(stream, SolSocket, SoReceiveLowWater, &zero, sizeof(zero), ErrorInvalid), "a low-water mark below 1 must fail with EINVAL (22)");
+    int pair[2] = {-1, -1};
+    Require(socketpair_nid_postfix(1, Stream, 0, pair) == 0, "socketpair failed");
+    Require(GetInt(pair[0], SoSendBuffer) == 8192 && GetInt(pair[0], SoReceiveBuffer) == 8192, "an AF_UNIX stream socket starts with 8192 bytes each way");
+    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed");
+    Require(socketpair_nid_postfix(1, Datagram, 0, pair) == 0, "socketpair failed");
+    Require(GetInt(pair[0], SoSendBuffer) == 2048 && GetInt(pair[0], SoReceiveBuffer) == 4096, "an AF_UNIX datagram socket starts with 2048 and 4096 bytes");
+    Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0, "close failed");
+    Require(close_nid_postfix(stream) == 0 && close_nid_postfix(datagram) == 0, "close failed");
+    const int listener = socket_nid_postfix(2, Stream, 0);
+    Require(listener >= 0, "socket failed");
+    auto address = Loopback(0);
+    Require(bind_nid_postfix(listener, address.data(), address.size()) == 0 && listen_nid_postfix(listener, 1) == 0, "listen failed");
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(listener, address.data(), &size) == 0, "getsockname failed");
+    SetInt(listener, SoReceiveBuffer, 3000);
+    SetInt(listener, SoSendLowWater, 700);
+    const int client = socket_nid_postfix(2, Stream, 0);
+    Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0, "connect failed");
+    const int accepted = accept_nid_postfix(listener, nullptr, nullptr);
+    Require(accepted >= 0, "accept failed");
+    Require(GetInt(accepted, SoReceiveBuffer) == 3000 && GetInt(accepted, SoSendLowWater) == 700 && GetInt(accepted, SoSendBuffer) == 32768, "an accepted socket takes the listener's buffers");
+    Require(close_nid_postfix(accepted) == 0 && close_nid_postfix(client) == 0 && close_nid_postfix(listener) == 0, "close failed");
+}
+
+void NullValues() {
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    Require(stream >= 0, "socket failed");
+    Require(SetFails(stream, SolSocket, SoKeepAlive, nullptr, sizeof(int), 14), "a null value with a length must fail with EFAULT (14)");
+    Require(SetFails(-1, SolSocket, SoKeepAlive, nullptr, sizeof(int), 14), "the null value is checked before the descriptor");
+    Require(SetFails(stream, SolSocket, 0x7fff, nullptr, sizeof(int), 14), "the null value is checked before the option");
+    Require(SetFails(stream, SolSocket, SoKeepAlive, nullptr, 0, ErrorInvalid), "a null value without a length must fail with EINVAL (22)");
+    std::uint32_t size = sizeof(int);
+    Require(getsockopt_nid_postfix(stream, SolSocket, SoSendBuffer, nullptr, &size) == 0 && size == 0, "getsockopt without a value succeeds with length 0");
+    Require(close_nid_postfix(stream) == 0, "close failed");
+}
+
+int GetIp(int descriptor, int option) {
+    int value = -12345;
+    std::uint32_t size = sizeof(value);
+    Require(getsockopt_nid_postfix(descriptor, 0, option, &value, &size) == 0 && size == sizeof(value), "getsockopt of an IPPROTO_IP option failed");
+    return value;
+}
+
+bool SetIp(int descriptor, int option, int value) {
+    return setsockopt_nid_postfix(descriptor, 0, option, &value, sizeof(value)) == 0;
+}
+
+void IpLevelFollowsThePs5() {
+    constexpr int IpTypeOfService = 3;
+    constexpr int IpTimeToLive = 4;
+    constexpr int IpMulticastTimeToLive = 10;
+    constexpr int IpMulticastLoop = 11;
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    const int datagram6 = socket_nid_postfix(28, Datagram, 0);
+    Require(datagram >= 0 && datagram6 >= 0, "socket failed");
+    Require(GetIp(datagram, IpTimeToLive) == 64 && GetIp(datagram, IpTypeOfService) == 0, "IP_TTL starts at 64 and IP_TOS at 0");
+    Require(GetIp(datagram, IpMulticastTimeToLive) == 1 && GetIp(datagram, IpMulticastLoop) == 1, "IP_MULTICAST_TTL and IP_MULTICAST_LOOP start at 1");
+    Require(SetIp(datagram, IpTimeToLive, 32) && GetIp(datagram, IpTimeToLive) == 32, "IP_TTL reads back");
+    Require(SetIp(datagram, IpTimeToLive, 300) && GetIp(datagram, IpTimeToLive) == 44, "IP_TTL keeps the low byte");
+    Require(SetIp(datagram, IpTimeToLive, -1) && GetIp(datagram, IpTimeToLive) == 255, "IP_TTL of -1 reads back as 255");
+    Require(SetIp(datagram, IpTimeToLive, 0) && GetIp(datagram, IpTimeToLive) == 0, "IP_TTL of 0 is kept");
+    const unsigned char byte = 9;
+    Require(SetFails(datagram, 0, IpTimeToLive, &byte, 1, ErrorInvalid), "a one-byte IP_TTL must fail with EINVAL (22)");
+    Require(SetIp(datagram, IpTypeOfService, 0x1ff) && GetIp(datagram, IpTypeOfService) == 0xff, "IP_TOS keeps the low byte");
+    const unsigned char seven = 7;
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastTimeToLive, &seven, 1) == 0 && GetIp(datagram, IpMulticastTimeToLive) == 7, "a one-byte IP_MULTICAST_TTL is accepted");
+    const int tooLarge = 300;
+    Require(SetFails(datagram, 0, IpMulticastTimeToLive, &tooLarge, sizeof(tooLarge), ErrorInvalid) && GetIp(datagram, IpMulticastTimeToLive) == 7, "IP_MULTICAST_TTL above 255 must fail with EINVAL (22)");
+    unsigned char narrow = 0xaa;
+    std::uint32_t size = 1;
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastTimeToLive, &narrow, &size) == 0 && size == 1 && narrow == 7, "a one-byte read gets the IP_MULTICAST_TTL byte");
+    Require(SetIp(datagram, IpMulticastLoop, 5) && GetIp(datagram, IpMulticastLoop) == 1, "IP_MULTICAST_LOOP reads back as 1");
+    Require(SetIp(datagram, IpMulticastLoop, 0) && GetIp(datagram, IpMulticastLoop) == 0, "IP_MULTICAST_LOOP can be turned off");
+    Require(SetIp(datagram, IpMulticastLoop, 1) && SetIp(datagram, IpMulticastLoop, 0x100) && GetIp(datagram, IpMulticastLoop) == 0, "an int IP_MULTICAST_LOOP keeps only its low byte");
+    int value = 0;
+    size = sizeof(value);
+    Require(getsockopt_nid_postfix(datagram6, 0, IpTimeToLive, &value, &size) == -1 && *__error_nid_postfix() == ErrorInvalid, "IPPROTO_IP on an AF_INET6 socket must fail with EINVAL (22)");
+    size = sizeof(value);
+    Require(getsockopt_nid_postfix(datagram, 0, 0x7777, &value, &size) == -1 && *__error_nid_postfix() == ErrorNoProtocolOption, "an unknown IPPROTO_IP option must fail with ENOPROTOOPT (42)");
+    size = sizeof(value);
+    Require(getsockopt_nid_postfix(datagram, 99, 1, &value, &size) == -1 && *__error_nid_postfix() == ErrorInvalid, "an unknown level must fail with EINVAL (22)");
+    Require(SetFails(datagram, 99, 1, &value, sizeof(value), ErrorInvalid), "setsockopt at an unknown level must fail with EINVAL (22)");
+    Require(close_nid_postfix(datagram) == 0 && close_nid_postfix(datagram6) == 0, "close failed");
+}
+
+void MulticastMembership() {
+    constexpr int IpMulticastInterface = 9;
+    constexpr int IpAddMembership = 12;
+    constexpr int IpDropMembership = 13;
+    constexpr int ErrorNotSupported = 45;
+    constexpr int ErrorAddressNotAvailable = 49;
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    const int stream = socket_nid_postfix(2, Stream, 0);
+    Require(datagram >= 0 && stream >= 0, "socket failed");
+    const std::array<std::uint8_t, 8> group{224, 0, 0, 251, 0, 0, 0, 0};
+    const std::array<std::uint8_t, 8> unicast{10, 0, 0, 1, 0, 0, 0, 0};
+    const std::array<std::uint8_t, 8> other{224, 0, 0, 253, 0, 0, 0, 0};
+    Require(SetFails(stream, 0, IpAddMembership, group.data(), group.size(), ErrorNotSupported), "a stream socket must fail a membership with EOPNOTSUPP (45)");
+    Require(SetFails(datagram, 0, IpAddMembership, group.data(), 7, ErrorInvalid), "a short membership must fail with EINVAL (22)");
+    Require(SetFails(datagram, 0, IpAddMembership, unicast.data(), unicast.size(), ErrorInvalid), "a group that is not multicast must fail with EINVAL (22)");
+    Require(SetFails(datagram, 0, IpDropMembership, other.data(), other.size(), ErrorAddressNotAvailable), "dropping a group never joined must fail with EADDRNOTAVAIL (49)");
+    std::array<std::uint8_t, 4> address{0xaa, 0xaa, 0xaa, 0xaa};
+    std::uint32_t size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && size == 4 && address == std::array<std::uint8_t, 4>{}, "IP_MULTICAST_IF starts at INADDR_ANY");
+    const std::array<std::uint8_t, 4> loopback{127, 0, 0, 1};
+    const std::array<std::uint8_t, 12> anyIndex{};
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastInterface, anyIndex.data(), anyIndex.size()) == 0, "an ip_mreqn without an index selects the default interface");
+    size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && address == std::array<std::uint8_t, 4>{}, "the default interface reads back as INADDR_ANY");
+    Require(SetFails(datagram, 0, IpMulticastInterface, loopback.data(), 2, ErrorInvalid), "a short IP_MULTICAST_IF must fail with EINVAL (22)");
+    Require(close_nid_postfix(datagram) == 0 && close_nid_postfix(stream) == 0, "close failed");
+}
+
+void MulticastOnTheHost() {
+    constexpr int IpMulticastInterface = 9;
+    constexpr int IpAddMembership = 12;
+    constexpr int IpDropMembership = 13;
+    constexpr int ErrorAddressInUse = 48;
+    constexpr int ErrorAddressNotAvailable = 49;
+    const int datagram = socket_nid_postfix(2, Datagram, 0);
+    Require(datagram >= 0, "socket failed");
+    const std::array<std::uint8_t, 8> group{224, 0, 0, 251, 0, 0, 0, 0};
+    Require(setsockopt_nid_postfix(datagram, 0, IpAddMembership, group.data(), group.size()) == 0, "joining 224.0.0.251 through INADDR_ANY failed");
+    Require(SetFails(datagram, 0, IpAddMembership, group.data(), group.size(), ErrorAddressInUse), "joining twice must fail with EADDRINUSE (48)");
+    Require(setsockopt_nid_postfix(datagram, 0, IpDropMembership, group.data(), group.size()) == 0, "drop failed");
+    Require(SetFails(datagram, 0, IpDropMembership, group.data(), group.size(), ErrorAddressNotAvailable), "dropping twice must fail with EADDRNOTAVAIL (49)");
+    const std::array<std::uint8_t, 8> throughLoopback{224, 0, 0, 252, 127, 0, 0, 1};
+    const std::array<std::uint8_t, 8> anyInterface{224, 0, 0, 252, 0, 0, 0, 0};
+    Require(setsockopt_nid_postfix(datagram, 0, IpAddMembership, throughLoopback.data(), throughLoopback.size()) == 0, "joining 224.0.0.252 through 127.0.0.1 failed");
+    Require(setsockopt_nid_postfix(datagram, 0, IpDropMembership, anyInterface.data(), anyInterface.size()) == 0, "a drop through INADDR_ANY leaves the group on any interface");
+    Require(SetFails(datagram, 0, IpDropMembership, anyInterface.data(), anyInterface.size(), ErrorAddressNotAvailable), "dropping it again must fail with EADDRNOTAVAIL (49)");
+    const std::array<std::uint8_t, 4> loopback{127, 0, 0, 1};
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastInterface, loopback.data(), loopback.size()) == 0, "selecting the loopback interface for IP_MULTICAST_IF failed");
+    std::array<std::uint8_t, 4> address{0xaa, 0xaa, 0xaa, 0xaa};
+    std::uint32_t size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && size == 4 && address == loopback, "IP_MULTICAST_IF reads back");
+    const std::array<std::uint8_t, 12> anyIndex{};
+    Require(setsockopt_nid_postfix(datagram, 0, IpMulticastInterface, anyIndex.data(), anyIndex.size()) == 0, "an ip_mreqn without an index selects the default interface");
+    size = address.size();
+    Require(getsockopt_nid_postfix(datagram, 0, IpMulticastInterface, address.data(), &size) == 0 && address == std::array<std::uint8_t, 4>{}, "the default interface reads back as INADDR_ANY");
+    Require(close_nid_postfix(datagram) == 0, "close failed");
+}
+
 void UnknownRequestsFail() {
     const int stream = socket_nid_postfix(2, Stream, 0);
     Require(stream >= 0, "socket failed");
@@ -218,12 +392,21 @@ void UnknownRequestsFail() {
 
 }
 
-int main() {
+int main(int argc, char** argv) {
+    if (argc > 1 && std::strcmp(argv[1], "multicast") == 0) {
+        MulticastOnTheHost();
+        return 0;
+    }
     ReportsTypeAndListening();
     ReportsAndClearsTheConnectError();
     BooleanOptionsReportTheirBit();
+    ReusePortSharesAPort();
     LingerFollowsFreeBsd();
     LengthsFollowFreeBsd();
+    BuffersFollowThePs5();
+    NullValues();
+    IpLevelFollowsThePs5();
+    MulticastMembership();
     UnknownRequestsFail();
     return 0;
 }
diff --git a/core/libs/tests/GuestSocketPair.cpp b/core/libs/tests/GuestSocketPair.cpp
index ec71ffc24c..9beb7ea55f 100644
--- a/core/libs/tests/GuestSocketPair.cpp
+++ b/core/libs/tests/GuestSocketPair.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
@@ -7,47 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-
-extern "C" {
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI recvmsg_nid_postfix(int, Msghdr*, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI fstat_nid_disambig1_nid_postfix(int, FileStat*);
-int APS5_VABI sceKernelFstat(int, FileStat*);
-int APS5_VABI sceKernelMapFlexibleMemory(void**, std::size_t, int, int);
-int APS5_VABI sceKernelMprotect(const void*, std::size_t, int);
-int APS5_VABI sceKernelMunmap(void*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template<typename TFunction>
@@ -81,7 +42,7 @@ static bool Fails(int domain, int type, int protocol, int error) {
 }
 
 static bool Readable(int descriptor, short accepted = In) {
-    PollDescriptor waited{descriptor, In, 0};
+    GuestPollDescriptor waited{descriptor, In, 0};
     return poll_nid_postfix(&waited, 1, 2000) == 1 && (waited.revents & accepted) != 0;
 }
 
@@ -104,7 +65,7 @@ static bool Unnamed(int descriptor, int (APS5_VABI *query)(int, void*, std::uint
     return query(descriptor, name, &length) == 0 && length == 4 && name[0] == 16 && name[1] == 1 && name[4] == 0xaa;
 }
 
-static bool ReceiveFaults(int descriptor, Msghdr* message) {
+static bool ReceiveFaults(int descriptor, GuestMsghdr* message) {
     *__error_nid_postfix() = 0;
     return recvmsg_nid_postfix(descriptor, message, 0) == -1 && *__error_nid_postfix() == 14;
 }
@@ -122,26 +83,26 @@ static void CheckReceiveMessageFaults() {
     auto* readOnly = writable + page;
     auto* inaccessible = writable + 2 * page;
     char data[16]{};
-    Iovec good{data, sizeof(data)};
-    auto* readOnlyMessage = reinterpret_cast<Msghdr*>(readOnly);
+    KernelIovec good{data, sizeof(data)};
+    auto* readOnlyMessage = reinterpret_cast<GuestMsghdr*>(readOnly);
     *readOnlyMessage = {nullptr, 0, &good, 1, nullptr, 0, -1};
-    auto* readOnlyVector = reinterpret_cast<Iovec*>(readOnly + 64);
+    auto* readOnlyVector = reinterpret_cast<KernelIovec*>(readOnly + 64);
     *readOnlyVector = {data, sizeof(data)};
     Require(sceKernelMprotect(readOnly, page, 1) == 0 && sceKernelMprotect(inaccessible, page, 0) == 0);
     int pair[2] = {-1, -1};
     Require(socketpair_nid_postfix(Unix, Datagram, 0, pair) == 0);
 
     Require(Queue(pair[0], pair[1], "x"));
-    Require(ReceiveFaults(pair[1], reinterpret_cast<Msghdr*>(0x1000)));
-    Require(ReceiveFaults(pair[1], reinterpret_cast<Msghdr*>(inaccessible)));
-    Msghdr message{nullptr, 0, reinterpret_cast<Iovec*>(0x1000), 1, nullptr, 0, -1};
+    Require(ReceiveFaults(pair[1], reinterpret_cast<GuestMsghdr*>(0x1000)));
+    Require(ReceiveFaults(pair[1], reinterpret_cast<GuestMsghdr*>(inaccessible)));
+    GuestMsghdr message{nullptr, 0, reinterpret_cast<KernelIovec*>(0x1000), 1, nullptr, 0, -1};
     Require(ReceiveFaults(pair[1], &message));
-    message.iov = reinterpret_cast<Iovec*>(inaccessible);
+    message.iov = reinterpret_cast<KernelIovec*>(inaccessible);
     Require(ReceiveFaults(pair[1], &message));
     char peeked[4]{};
     Require(recv_nid_postfix(pair[1], peeked, sizeof(peeked), Peek) == 1 && peeked[0] == 'x');
 
-    Iovec vector{reinterpret_cast<void*>(0x1000), sizeof(data)};
+    KernelIovec vector{reinterpret_cast<void*>(0x1000), sizeof(data)};
     message = {nullptr, 0, &vector, 1, nullptr, 0, -1};
     Require(ReceiveFaults(pair[1], &message));
     vector.base = inaccessible;
@@ -164,7 +125,7 @@ static void CheckReceiveMessageFaults() {
     Require(Queue(pair[0], pair[1], "abcd") && recvmsg_nid_postfix(pair[1], &message, 0) == 4);
     Require(std::memcmp(writable, "abcd", 4) == 0 && message.flags == 0 && message.controlLength == 0);
     Require(message.nameLength == 16 && name[0] == 16 && name[1] == Unix && name[16] == 0xa5);
-    Iovec vectors[2]{{writable, 2}, {inaccessible, 16}};
+    KernelIovec vectors[2]{{writable, 2}, {inaccessible, 16}};
     message = {nullptr, 0, vectors, 2, nullptr, 0, -1};
     Require(Queue(pair[0], pair[1], "ef") && recvmsg_nid_postfix(pair[1], &message, 0) == 2 && std::memcmp(writable, "ef", 2) == 0);
     message = {readOnly + 128, 0, readOnlyVector, 1, nullptr, 0, -1};
@@ -172,7 +133,7 @@ static void CheckReceiveMessageFaults() {
     Require(std::memcmp(data, "gh", 2) == 0 && message.nameLength == 0);
 
     Require(close_nid_postfix(pair[0]) == 0 && close_nid_postfix(pair[1]) == 0);
-    Require(sceKernelMprotect(memory, page * 3, 3) == 0 && sceKernelMunmap(memory, page * 3) == 0);
+    Require(sceKernelMprotect(memory, page * 3, 3) == 0 && sceKernelMunmap(reinterpret_cast<std::uint64_t>(memory), page * 3) == 0);
 }
 
 int main(int argc, char** argv) {
@@ -188,7 +149,7 @@ int main(int argc, char** argv) {
     Require(Exchange(pair[1], pair[0], "other way"));
     Require(Unnamed(pair[0], getsockname_nid_postfix) && Unnamed(pair[1], getpeername_nid_postfix));
 
-    PollDescriptor polled[2] = {{pair[1], In, 0}, {pair[0], Out, 0}};
+    GuestPollDescriptor polled[2] = {{pair[1], In, 0}, {pair[0], Out, 0}};
     Require(poll_nid_postfix(polled, 2, 0) == 1 && polled[0].revents == 0 && (polled[1].revents & Out) != 0);
     const char ping[] = "ping";
     Require(send_nid_postfix(pair[0], ping, sizeof(ping), 0) == sizeof(ping));
@@ -213,9 +174,9 @@ int main(int argc, char** argv) {
     Require(Exchange(pair[1], pair[0], "still open"));
     Require(close_nid_postfix(pair[0]) == 0);
     Require(Readable(pair[1], In | Hup) && recv_nid_postfix(pair[1], received, sizeof(received), 0) == 0);
-#ifndef _WIN32
-    Require(send_nid_postfix(pair[1], ping, sizeof(ping), NoSignal) == -1 && *__error_nid_postfix() == 32);
-#endif
+    std::int64_t sent = 0;
+    for (int i = 0; i < 100 && sent >= 0; ++i) sent = send_nid_postfix(pair[1], ping, sizeof(ping), NoSignal);
+    Require(sent == -1 && *__error_nid_postfix() == 32);
     Require(close_nid_postfix(pair[1]) == 0);
     Require(close_nid_postfix(pair[1]) == -1 && *__error_nid_postfix() == 9);
 
@@ -273,8 +234,8 @@ int main(int argc, char** argv) {
     Require(send_nid_postfix(pair[0], "record", 6, 0) == 6);
     Require(send_nid_postfix(pair[0], "next", 4, 0) == 4);
     char part[2]{};
-    Iovec piece{part, sizeof(part)};
-    Msghdr message{nullptr, 0, &piece, 1, nullptr, 0, -1};
+    KernelIovec piece{part, sizeof(part)};
+    GuestMsghdr message{nullptr, 0, &piece, 1, nullptr, 0, -1};
     const auto truncated = recvmsg_nid_postfix(pair[1], &message, 0);
     if (truncated != 2 || message.flags != 0x10) {
         std::fprintf(stderr, "recvmsg of a 6-byte SOCK_SEQPACKET record into 2 bytes returned %lld with msg_flags 0x%x, expected 2 with MSG_TRUNC (0x10)\n",
diff --git a/core/libs/tests/GuestSocketPortZero.cpp b/core/libs/tests/GuestSocketPortZero.cpp
index 070b9c8982..f450f75277 100644
--- a/core/libs/tests/GuestSocketPortZero.cpp
+++ b/core/libs/tests/GuestSocketPortZero.cpp
@@ -1,20 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
 
 static void Require(bool value, const char* message) {
     if (!value) {
@@ -45,7 +36,28 @@ static void CheckDatagram(int family) {
     Require(connect_nid_postfix(probe, address.data(), size) == -1 && *__error_nid_postfix() == 49,
         "connect to port 0 on an unconnected datagram socket must fail with EADDRNOTAVAIL (49)");
     Require(getpeername_nid_postfix(probe, name.data(), &length) == -1 && *__error_nid_postfix() == 57, "still unconnected");
-    Require(close_nid_postfix(probe) == 0, "close");
+    const int peer = socket_nid_postfix(family, 2, 0);
+    Require(peer >= 0, "peer");
+    const int bound = bind_nid_postfix(peer, address.data(), size);
+    if (bound < 0 && family == 28 && *__error_nid_postfix() == 49) {
+        Require(close_nid_postfix(peer) == 0 && close_nid_postfix(probe) == 0, "close");
+        return;
+    }
+    Require(bound == 0, "bind peer");
+    Address target{};
+    length = target.size();
+    Require(getsockname_nid_postfix(peer, target.data(), &length) == 0, "peer name");
+    Require(connect_nid_postfix(probe, target.data(), size) == 0, "connect to the peer");
+    length = name.size();
+    Require(getpeername_nid_postfix(probe, name.data(), &length) == 0, "connected");
+    Require(connect_nid_postfix(probe, address.data(), size) == -1 && *__error_nid_postfix() == 49,
+        "connect to port 0 on a connected datagram socket must fail with EADDRNOTAVAIL (49)");
+    length = name.size();
+    Require(getpeername_nid_postfix(probe, name.data(), &length) == -1 && *__error_nid_postfix() == 57,
+        "connect to port 0 must disconnect a connected datagram socket");
+    Require(send_nid_postfix(probe, "x", 1, 0) == -1 && *__error_nid_postfix() == 39,
+        "send without an address after the disconnect must fail with EDESTADDRREQ (39)");
+    Require(close_nid_postfix(peer) == 0 && close_nid_postfix(probe) == 0, "close");
 }
 
 static void CheckStream(int family) {
diff --git a/core/libs/tests/GuestSocketReadWrite.cpp b/core/libs/tests/GuestSocketReadWrite.cpp
index 5a8d48781b..f320cf6569 100644
--- a/core/libs/tests/GuestSocketReadWrite.cpp
+++ b/core/libs/tests/GuestSocketReadWrite.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -9,47 +12,6 @@
 #include <csignal>
 #endif
 
-struct PollDescriptor {
-    int descriptor;
-    short events;
-    short revents;
-};
-
-struct Iovec {
-    void* base;
-    std::size_t length;
-};
-
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI poll_nid_postfix(PollDescriptor*, std::uint32_t, int);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceKernelClose(int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-std::int64_t APS5_VABI _read_nid_postfix(int, void*, std::size_t);
-std::int64_t APS5_VABI _write_nid_postfix(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-std::int64_t APS5_VABI sceKernelWrite(int, const void*, std::size_t);
-std::int64_t APS5_VABI sceKernelReadv(int, const Iovec*, int);
-std::int64_t APS5_VABI sceKernelWritev(int, const Iovec*, int);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI preadv_nid_postfix(int, const Iovec*, int, std::int64_t);
-std::int64_t APS5_VABI pwritev_nid_postfix(int, const Iovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwrite(int, const void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelPreadv(int, const Iovec*, int, std::int64_t);
-std::int64_t APS5_VABI sceKernelPwritev(int, const Iovec*, int, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket read/write check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -65,7 +27,7 @@ constexpr int KernelBadDescriptor = static_cast<int>(0x80020009u);
 constexpr int KernelIllegalSeek = static_cast<int>(0x8002001du);
 
 static bool Readable(int descriptor, short accepted = In) {
-    PollDescriptor waited{descriptor, In, 0};
+    GuestPollDescriptor waited{descriptor, In, 0};
     return poll_nid_postfix(&waited, 1, 2000) == 1 && (waited.revents & accepted) != 0;
 }
 
@@ -105,28 +67,28 @@ int main() {
 
     const char vectorFirst[] = "vector ";
     const char vectorSecond[] = "write";
-    Iovec vectorWrite[] = {{const_cast<char*>(vectorFirst), sizeof(vectorFirst) - 1},
+    KernelIovec vectorWrite[] = {{const_cast<char*>(vectorFirst), sizeof(vectorFirst) - 1},
         {const_cast<char*>(vectorSecond), sizeof(vectorSecond)}};
     Require(sceKernelWritev(client, vectorWrite, 2) == sizeof(vectorFirst) + sizeof(vectorSecond) - 1);
     char vectorReadFirst[sizeof(vectorFirst) - 1]{};
     char vectorReadSecond[sizeof(vectorSecond)]{};
-    Iovec vectorRead[] = {{vectorReadFirst, sizeof(vectorReadFirst)}, {vectorReadSecond, sizeof(vectorReadSecond)}};
+    KernelIovec vectorRead[] = {{vectorReadFirst, sizeof(vectorReadFirst)}, {vectorReadSecond, sizeof(vectorReadSecond)}};
     Require(Readable(server) && sceKernelReadv(server, vectorRead, 2) == sizeof(vectorFirst) + sizeof(vectorSecond) - 1);
     Require(std::memcmp(vectorReadFirst, "vector ", sizeof(vectorReadFirst)) == 0 && std::strcmp(vectorReadSecond, "write") == 0);
 
     const char sceVectorFirst[] = "sceKernel";
     const char sceVectorSecond[] = "Writev";
-    Iovec sceVectorWrite[] = {{const_cast<char*>(sceVectorFirst), sizeof(sceVectorFirst) - 1},
+    KernelIovec sceVectorWrite[] = {{const_cast<char*>(sceVectorFirst), sizeof(sceVectorFirst) - 1},
         {const_cast<char*>(sceVectorSecond), sizeof(sceVectorSecond)}};
     Require(sceKernelWritev(client, sceVectorWrite, 2) == sizeof(sceVectorFirst) + sizeof(sceVectorSecond) - 1);
     char sceVectorReadFirst[sizeof(sceVectorFirst) - 1]{};
     char sceVectorReadSecond[sizeof(sceVectorSecond)]{};
-    Iovec sceVectorRead[] = {{sceVectorReadFirst, sizeof(sceVectorReadFirst)}, {sceVectorReadSecond, sizeof(sceVectorReadSecond)}};
+    KernelIovec sceVectorRead[] = {{sceVectorReadFirst, sizeof(sceVectorReadFirst)}, {sceVectorReadSecond, sizeof(sceVectorReadSecond)}};
     Require(Readable(server) && sceKernelReadv(server, sceVectorRead, 2) == sizeof(sceVectorFirst) + sizeof(sceVectorSecond) - 1);
     Require(std::memcmp(sceVectorReadFirst, "sceKernel", sizeof(sceVectorReadFirst)) == 0 && std::strcmp(sceVectorReadSecond, "Writev") == 0);
 
     const char positionedWrite[] = "positioned";
-    Iovec positionedIov[] = {{const_cast<char*>(positionedWrite), sizeof(positionedWrite)}};
+    KernelIovec positionedIov[] = {{const_cast<char*>(positionedWrite), sizeof(positionedWrite)}};
     *__error_nid_postfix() = 0;
     Require(pread_nid_postfix(server, received, 1, 0) == -1 && *__error_nid_postfix() == 29);
     Require(pwrite_nid_disambig1_nid_postfix(client, positionedWrite, 1, 0) == -1 && *__error_nid_postfix() == 29);
@@ -141,18 +103,16 @@ int main() {
     *__error_nid_postfix() = 0;
     Require(read_nid_postfix(server, received, sizeof(received)) == -1 && *__error_nid_postfix() == 35);
     Require(sceKernelRead(server, received, sizeof(received)) == KernelAgain);
-    Iovec emptyRead[] = {{received, sizeof(received)}};
+    KernelIovec emptyRead[] = {{received, sizeof(received)}};
     Require(sceKernelReadv(server, emptyRead, 1) == KernelAgain);
 
     Require(read_nid_postfix(server, received, 0) == 0 && sceKernelRead(server, received, 0) == 0);
     Require(close_nid_postfix(client) == 0);
     Require(Readable(server, In | Hup) && read_nid_postfix(server, received, sizeof(received)) == 0);
     Require(sceKernelRead(server, received, sizeof(received)) == 0);
-#ifndef _WIN32
     std::int64_t written = 0;
     for (int i = 0; i < 100 && written >= 0; ++i) written = write_nid_postfix(server, request, sizeof(request));
     Require(written == -1 && *__error_nid_postfix() == 32);
-#endif
     Require(close_nid_postfix(server) == 0);
     *__error_nid_postfix() = 0;
     Require(read_nid_postfix(server, received, sizeof(received)) == -1 && *__error_nid_postfix() == 9);
diff --git a/core/libs/tests/GuestSocketStreamOptions.cpp b/core/libs/tests/GuestSocketStreamOptions.cpp
index f85a693f17..63ba1ec240 100644
--- a/core/libs/tests/GuestSocketStreamOptions.cpp
+++ b/core/libs/tests/GuestSocketStreamOptions.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <csignal>
@@ -5,25 +7,6 @@
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI shutdown_nid_postfix(int, int);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI write_nid_postfix(int, const char*, std::int64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket stream option check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -91,12 +74,13 @@ int main() {
     Require(client >= 0 && connect_nid_postfix(client, address.data(), address.size()) == 0);
     const int server = accept_nid_postfix(listener, nullptr, nullptr);
     Require(server >= 0);
-    Require(Set(listener, SocketLevel, NoSigpipe, 1) && Set(listener, TcpLevel, TcpNoDelay, 1));
+    Require(Set(listener, SocketLevel, NoSigpipe, 1) && Set(listener, TcpLevel, TcpNoDelay, 1) && Set(listener, TcpLevel, 0x100, 60));
     const int secondClient = socket_nid_postfix(2, 1, 0);
     Require(secondClient >= 0 && connect_nid_postfix(secondClient, address.data(), address.size()) == 0);
     const int inheriting = accept_nid_postfix(listener, nullptr, nullptr);
     Require(inheriting >= 0);
     Require(Get(inheriting, SocketLevel, NoSigpipe) == NoSigpipe && Get(inheriting, TcpLevel, TcpNoDelay) == 4);
+    Require(Get(inheriting, TcpLevel, 0x100) == 60 && Get(server, TcpLevel, 0x100) == 7200);
     Require(Get(server, SocketLevel, NoSigpipe) == 0 && Get(server, TcpLevel, TcpNoDelay) == 0);
     Require(close_nid_postfix(inheriting) == 0 && close_nid_postfix(secondClient) == 0);
     const int datagram = socket_nid_postfix(2, 2, 0);
@@ -114,7 +98,21 @@ int main() {
     int value = 0;
     Require(Set(client, TcpLevel, TcpNoDelay, 0) && Get(client, TcpLevel, TcpNoDelay) == 0);
     Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &one, sizeof(one) - 1), Invalid));
-    Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &one, sizeof(one)), NoProtocolOption));
+    Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &one, sizeof(one)), Invalid));
+    const int fresh = socket_nid_postfix(2, 1, 0);
+    Require(fresh >= 0 && Get(fresh, TcpLevel, TcpMaximumSegment) == 536);
+    for (const int segment : {1000, 175, 0, -1}) {
+        Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, TcpMaximumSegment, &segment, sizeof(segment)), Invalid));
+    }
+    Require(Set(fresh, TcpLevel, TcpMaximumSegment, 300) && Get(fresh, TcpLevel, TcpMaximumSegment) == 300);
+    Require(Get(fresh, TcpLevel, 0x100) == 7200 && Get(fresh, TcpLevel, 0x200) == 75 && Get(fresh, TcpLevel, 0x400) == 8);
+    Require(Set(fresh, TcpLevel, 0x100, 60) && Get(fresh, TcpLevel, 0x100) == 60);
+    Require(Set(fresh, TcpLevel, 0x100, 0) && Get(fresh, TcpLevel, 0x100) == 7200);
+    Require(Set(fresh, TcpLevel, 0x200, 10) && Get(fresh, TcpLevel, 0x200) == 10);
+    Require(Set(fresh, TcpLevel, 0x400, 3) && Get(fresh, TcpLevel, 0x400) == 3);
+    Require(Set(fresh, TcpLevel, 0x400, -1) && Get(fresh, TcpLevel, 0x400) == -1);
+    Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, 0x7777, &one, sizeof(one)), NoProtocolOption));
+    Require(close_nid_postfix(fresh) == 0);
     length = sizeof(value);
     Require(Fails(setsockopt_nid_postfix(datagram, TcpLevel, TcpNoDelay, &one, sizeof(one)), Invalid));
     Require(Fails(getsockopt_nid_postfix(datagram, TcpLevel, TcpNoDelay, &value, &length), Invalid));
@@ -124,13 +122,13 @@ int main() {
     char received = 0;
     Require(Get(server, SocketLevel, NonBlockingOption) == 0);
     Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) == 0);
-    Require(Set(server, SocketLevel, NonBlockingOption, 5) && Get(server, SocketLevel, NonBlockingOption) == 1);
+    Require(Set(server, SocketLevel, NonBlockingOption, 5) && Get(server, SocketLevel, NonBlockingOption) == 0x100);
     Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) != 0);
     Require(Fails(recv_nid_postfix(server, &received, sizeof(received), 0), Again));
     Require(Set(server, SocketLevel, NonBlockingOption, 0) && Get(server, SocketLevel, NonBlockingOption) == 0);
     Require((fcntl_nid_postfix(server, GetStatusFlags) & NonBlockingFlag) == 0);
     Require(Fails(setsockopt_nid_postfix(server, SocketLevel, NonBlockingOption, &one, sizeof(one) - 1), Invalid));
-    Require(Set(datagram, SocketLevel, NonBlockingOption, 1) && Get(datagram, SocketLevel, NonBlockingOption) == 1);
+    Require(Set(datagram, SocketLevel, NonBlockingOption, 1) && Get(datagram, SocketLevel, NonBlockingOption) == 0x100);
     Require(Fails(recv_nid_postfix(datagram, &received, sizeof(received), 0), Again));
 
 #ifndef _WIN32
diff --git a/core/libs/tests/GuestSocketTimeouts.cpp b/core/libs/tests/GuestSocketTimeouts.cpp
index 2ff28a2173..104d70406e 100644
--- a/core/libs/tests/GuestSocketTimeouts.cpp
+++ b/core/libs/tests/GuestSocketTimeouts.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <chrono>
@@ -11,40 +13,6 @@ struct Timeval {
     std::int64_t microseconds;
 };
 
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI recvmsg_nid_postfix(int, Msghdr*, int);
-std::int64_t APS5_VABI read_nid_postfix(int, void*, std::uint64_t);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "socket timeout check failed at line %d, errno %d\n", line, *__error_nid_postfix());
@@ -115,8 +83,8 @@ int main() {
     Require(Fails(recv_nid_postfix(datagram, &byte, sizeof(byte), 0), WouldBlock));
     Require(Clock::now() - started >= std::chrono::milliseconds(59));
     Require(Fails(recvfrom_nid_postfix(datagram, &byte, sizeof(byte), 0, nullptr, nullptr), WouldBlock));
-    Iovec part{&byte, sizeof(byte)};
-    Msghdr message{nullptr, 0, &part, 1, nullptr, 0, 0};
+    KernelIovec part{&byte, sizeof(byte)};
+    GuestMsghdr message{nullptr, 0, &part, 1, nullptr, 0, 0};
     Require(Fails(recvmsg_nid_postfix(datagram, &message, 0), WouldBlock));
     Require(Fails(read_nid_postfix(datagram, &byte, sizeof(byte)), WouldBlock));
     Require(Set(datagram, ReceiveTimeout, 60, 0) == 0);
diff --git a/core/libs/tests/GuestSoftwareVersion.cpp b/core/libs/tests/GuestSoftwareVersion.cpp
index d572e1722b..1343316e32 100644
--- a/core/libs/tests/GuestSoftwareVersion.cpp
+++ b/core/libs/tests/GuestSoftwareVersion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstddef>
@@ -5,22 +7,10 @@
 #include <cstdlib>
 #include <cstring>
 
-struct SceKernelProsperoSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
-
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, versionString) == 0x08);
 static_assert(offsetof(SceKernelProsperoSystemSwVersion, version) == 0x24);
 static_assert(sizeof(SceKernelProsperoSystemSwVersion) == 0x28);
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sceKernelGetProsperoSystemSwVersion_nid_postfix(SceKernelProsperoSystemSwVersion*);
-int APS5_VABI sceKernelGetAllowedSdkVersionOnSystem_nid_postfix(std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckProsperoSystemSwVersion() {
diff --git a/core/libs/tests/GuestSsl.cpp b/core/libs/tests/GuestSsl.cpp
index 4aa00482b6..f4d57bc7a2 100644
--- a/core/libs/tests/GuestSsl.cpp
+++ b/core/libs/tests/GuestSsl.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "ProcessParametersFixture.hpp"
 #include <array>
@@ -8,37 +9,6 @@
 #include <exception>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::size_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetCaCerts(int, void*);
-int APS5_VABI sceSslFreeCaCerts(int, void*);
-int APS5_VABI sceSslGetCaList(int, void*);
-int APS5_VABI sceSslFreeCaList(int, void*);
-int APS5_VABI sceSslUnloadCert(int);
-int APS5_VABI sceSslCreateConnection(int, int, const char*);
-int APS5_VABI sceSslDeleteConnection(int);
-int APS5_VABI sceSslSetVerifyCallback(int, int (APS5_VABI *)(int, unsigned int, void**, int, void*), void*);
-int APS5_VABI sceSslConnect(int);
-int APS5_VABI sceSslRead(int, void*, std::size_t, int);
-int APS5_VABI sceSslWrite(int, void*, std::size_t, int);
-int APS5_VABI sceSslClose(int);
-int APS5_VABI sceSslEnableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslDisableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslSetMinSslVersion(int, int);
-int APS5_VABI sceSslSetAlpn(int, const char*);
-const char* APS5_VABI sceSslGetAlpnSelected(int);
-}
-
-struct SslMemoryPoolStats {
-    std::size_t pool_size;
-    std::size_t max_inuse_size;
-    std::size_t current_inuse_size;
-    std::int32_t reserved;
-};
-
-extern "C" int APS5_VABI sceSslGetMemoryPoolStats(int, SslMemoryPoolStats*);
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
@@ -53,17 +23,6 @@ static bool Throws(TCall call) {
 
 static int APS5_VABI VerifyCallback(int, unsigned int, void**, int, void*) { return 0; }
 
-struct SslCaCerts {
-    void* certs;
-    std::size_t num;
-    void* pool;
-};
-
-struct SslCaList {
-    void** certs;
-    int num;
-};
-
 int main() {
     static std::array<std::byte, 64> parameters{};
     const std::uint64_t processSize = parameters.size();
@@ -77,17 +36,18 @@ int main() {
     int marker = 0;
     const int context = sceSslInit_nid_postfix(0x10000);
     Require(context > 0);
-    SslMemoryPoolStats stats{1, 1, 1, 1};
+    SceSsl::MemoryPoolStats stats{1, 1, 1, 1};
     Require(sceSslGetMemoryPoolStats(context, &stats) == 0);
-    Require(stats.pool_size == 0x10000 && stats.max_inuse_size == 0 && stats.current_inuse_size == 0 && stats.reserved == 0);
+    Require(stats.poolSize == 0x10000 && stats.maxInuseSize == 0 && stats.currentInuseSize == 0 && stats.reserved == 0);
     Require(sceSslGetCaCerts(context, nullptr) == invalidValue);
     Require(sceSslFreeCaCerts(context, nullptr) == invalidArg);
 
-    SslCaCerts certs{&marker, 3, &marker};
+    SceSsl::Data certificateMarker{};
+    SceSsl::CaCerts certs{&certificateMarker, 3, &marker};
     Require(sceSslGetCaCerts(context, &certs) == notFound);
     Require(certs.certs == nullptr && certs.num == 0 && certs.pool == nullptr);
 
-    certs = {&marker, 3, &marker};
+    certs = {&certificateMarker, 3, &marker};
     Require(sceSslFreeCaCerts(context, &certs) == 0);
     Require(certs.certs == nullptr && certs.num == 0 && certs.pool == nullptr);
 
@@ -95,13 +55,13 @@ int main() {
     Require(sceSslFreeCaList(context, nullptr) == invalidArg);
 
     void* handle = &marker;
-    SslCaList list{&handle, 3};
+    SceSsl::CaList list{&handle, 3};
     Require(sceSslGetCaList(context, &list) == notFound);
     Require(list.certs == nullptr && list.num == 0);
     Require(sceSslFreeCaList(context, &list) == 0);
     Require(list.certs == nullptr && list.num == 0);
 
-    SslCaList foreign{&handle, 1};
+    SceSsl::CaList foreign{&handle, 1};
     Require(Throws([&] { sceSslFreeCaList(context, &foreign); }));
     foreign = {nullptr, 1};
     Require(Throws([&] { sceSslFreeCaList(context, &foreign); }));
@@ -187,9 +147,9 @@ int main() {
     Require(sceSslGetCaList(context, &list) == invalidId);
     Require(list.certs == &handle && list.num == 3);
     Require(sceSslGetCaCerts(context, nullptr) == invalidId);
-    certs = {&marker, 3, &marker};
+    certs = {&certificateMarker, 3, &marker};
     Require(sceSslGetCaCerts(context, &certs) == invalidId);
-    Require(certs.certs == &marker && certs.num == 3 && certs.pool == &marker);
+    Require(certs.certs == &certificateMarker && certs.num == 3 && certs.pool == &marker);
     Require(Throws([&] { sceSslFreeCaList(context, &list); }));
     for (const std::uint32_t sdkVersion : {0u, 0x074fffffu, 0x07500000u, 0x09000000u}) {
         std::memcpy(parameters.data() + 16, &sdkVersion, sizeof(sdkVersion));
diff --git a/core/libs/tests/GuestSslLoad.cpp b/core/libs/tests/GuestSslLoad.cpp
index b59ad7c6c5..92507f0183 100644
--- a/core/libs/tests/GuestSslLoad.cpp
+++ b/core/libs/tests/GuestSslLoad.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #include "prx/libSceSsl/SslTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SslCertificateFixture.hpp"
@@ -10,32 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::uint64_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetMemoryPoolStats(int, SceSsl::MemoryPoolStats*);
-int APS5_VABI sceSslLoadCert(int, int, SceSsl::Data**, SceSsl::Data*, SceSsl::Data*);
-int APS5_VABI sceSslUnloadCert(int);
-int APS5_VABI sceSslGetCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslFreeCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslGetCaCerts(int, SceSsl::CaCerts*);
-int APS5_VABI sceSslFreeCaCerts(int, SceSsl::CaCerts*);
-int APS5_VABI sceSslCreateConnection(int, int, const char*);
-int APS5_VABI sceSslDeleteConnection(int);
-int APS5_VABI sceSslSetVerifyCallback(int, int (APS5_VABI *)(int, unsigned int, void**, int, void*), void*);
-int APS5_VABI sceSslGetSerialNumber(int, void*, unsigned char*, std::size_t*);
-void* APS5_VABI sceSslGetSubjectName(int, void*);
-void* APS5_VABI sceSslGetIssuerName(int, void*);
-int APS5_VABI sceSslGetNameEntryCount(int, void*);
-int APS5_VABI sceSslGetNameEntryInfo(int, void*, int, char*, std::size_t, char*, std::size_t, std::size_t*);
-int APS5_VABI sceSslFreeSslCertName(int, void*);
-int APS5_VABI sceSslClose(int);
-int APS5_VABI sceSslGetNotBefore(int, void*, SceSsl::RtcTick*);
-int APS5_VABI sceSslGetNotAfter(int, void*, SceSsl::RtcTick*);
-int APS5_VABI sceSslGetFingerprint(int, void*, int, unsigned char*);
-int APS5_VABI sceSslGetPem(int, void*, char*, std::size_t*);
-}
-
 namespace {
 
 constexpr int NotFound = static_cast<int>(0x8095F004);
diff --git a/core/libs/tests/GuestSslPs5Readers.cpp b/core/libs/tests/GuestSslPs5Readers.cpp
index 3075a601e9..60aeebcbde 100644
--- a/core/libs/tests/GuestSslPs5Readers.cpp
+++ b/core/libs/tests/GuestSslPs5Readers.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSsl/include/Ssl.hpp"
 #include "prx/libSceSsl/SslTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "SslCertificateFixture.hpp"
@@ -11,22 +12,6 @@
 #include <vector>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::uint64_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslLoadCert(int, int, SceSsl::Data**, SceSsl::Data*, SceSsl::Data*);
-int APS5_VABI sceSslUnloadCert(int);
-int APS5_VABI sceSslGetCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslFreeCaList(int, SceSsl::CaList*);
-int APS5_VABI sceSslGetSerialNumber(int, void*, unsigned char*, std::size_t*);
-void* APS5_VABI sceSslGetSubjectName(int, void*);
-void* APS5_VABI sceSslGetIssuerName(int, void*);
-int APS5_VABI sceSslGetNameEntryCount(int, void*);
-int APS5_VABI sceSslGetNameEntryInfo(int, void*, int, char*, std::size_t, char*, std::size_t, std::size_t*);
-int APS5_VABI sceSslFreeSslCertName(int, void*);
-int APS5_VABI sceSslGetPem(int, void*, char*, std::size_t*);
-}
-
 namespace {
 
 void Check(bool value, const char* message) {
diff --git a/core/libs/tests/GuestSslTransport.cpp b/core/libs/tests/GuestSslTransport.cpp
index 927dc47414..94aafaf622 100644
--- a/core/libs/tests/GuestSslTransport.cpp
+++ b/core/libs/tests/GuestSslTransport.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSsl/include/Ssl.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #ifdef _WIN32
 #include <winsock2.h>
 #else
@@ -28,38 +31,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceSslInit_nid_postfix(std::uint64_t);
-int APS5_VABI sceSslTerm_nid_postfix(int);
-int APS5_VABI sceSslGetMemoryPoolStats(int, SceSsl::MemoryPoolStats*);
-int APS5_VABI sceSslLoadCert(int, int, SceSsl::Data**, SceSsl::Data*, SceSsl::Data*);
-int APS5_VABI sceSslCreateConnection(int, int, const char*);
-int APS5_VABI sceSslDeleteConnection(int);
-int APS5_VABI sceSslSetVerifyCallback(int, int (APS5_VABI *)(int, unsigned int, void**, int, void*), void*);
-int APS5_VABI sceSslConnect(int);
-int APS5_VABI sceSslRead(int, void*, std::size_t, int);
-int APS5_VABI sceSslWrite(int, void*, std::size_t, int);
-int APS5_VABI sceSslClose(int);
-int APS5_VABI sceSslEnableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslDisableVerifyOption(int, std::uint32_t);
-int APS5_VABI sceSslSetMinSslVersion(int, int);
-int APS5_VABI sceSslSetAlpn(int, const char*);
-const char* APS5_VABI sceSslGetAlpnSelected(int);
-void* APS5_VABI sceSslGetSubjectName(int, void*);
-int APS5_VABI sceSslGetNameEntryCount(int, void*);
-int APS5_VABI sceSslGetNameEntryInfo(int, void*, int, char*, std::size_t, char*, std::size_t, std::size_t*);
-int APS5_VABI sceSslFreeSslCertName(int, void*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI close_nid_postfix(int);
-int APS5_VABI sceNetInit_nid_postfix();
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetSocketClose(int);
-}
-
 namespace {
 
 constexpr int ParallelConnections = 4;
@@ -312,6 +283,7 @@ struct Sockets {
     int Set(int descriptor, int option, const void* value, std::uint32_t length) const {
         return net ? sceNetSetsockopt(descriptor, GuestSocketLevel, option, value, length)
                    : setsockopt_nid_postfix(descriptor, GuestSocketLevel, option, value, length);
+
     }
 
     int Close(int descriptor) const { return net ? sceNetSocketClose(descriptor) : close_nid_postfix(descriptor); }
@@ -458,13 +430,10 @@ int main(int argc, char** argv) {
     Require(selected && std::strcmp(selected, "http/1.1") == 0, "the negotiated ALPN protocol is not reported");
     Require(sceSslWrite(connection, buffer.data(), 1, 1) == ErrorInvalidValue, "unknown write flags were accepted");
     char request[] = "ping";
-    Require(sceSslWrite(connection, request, 4, 0) == 4, "write the request");
-    Require(sceSslRead(connection, buffer.data(), buffer.size(), 4) == ErrorInvalidValue, "unknown read flags were accepted");
-    Require(sceSslRead(0, nullptr, 1, -1) == ErrorInvalidValue, "read flags did not precede other validation");
-    Require(sceSslRead(connection, buffer.data(), 2, 3) == 2 && std::memcmp(buffer.data(), "po", 2) == 0, "short peek failed");
-    Require(sceSslRead(connection, buffer.data(), 4, 3) == 4 && std::memcmp(buffer.data(), "pong", 4) == 0, "repeated larger peek consumed bytes");
+    Require(sceSslSend(connection, request, 4) == 4, "send the request");
     Require(sceSslRead(connection, buffer.data(), 2, 1) == 2 && std::memcmp(buffer.data(), "po", 2) == 0, "a partial read did not return the available bytes");
-    Require(sceSslRead(connection, buffer.data(), buffer.size(), 0) == 2 && std::memcmp(buffer.data(), "ng", 2) == 0, "a full read did not stop at the end of the stream");
+    Require(sceSslRecv(connection, buffer.data(), 2) == 2 && std::memcmp(buffer.data(), "ng", 2) == 0, "receive did not fill the remaining reply");
+    Require(sceSslRecv(connection, buffer.data(), buffer.size()) == 0, "receive did not stop at the end of the stream");
     Require(sceSslRead(connection, buffer.data(), buffer.size(), 1) == 0, "close notify did not end the stream");
     Require(sceSslClose(connection) == 0, "close the connection");
     Require(sceSslRead(connection, buffer.data(), buffer.size(), 0) == 0, "a read after the close did not return 0");
diff --git a/core/libs/tests/GuestStandardStreams.cpp b/core/libs/tests/GuestStandardStreams.cpp
index c37c580e6b..0f459b1e83 100644
--- a/core/libs/tests/GuestStandardStreams.cpp
+++ b/core/libs/tests/GuestStandardStreams.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
@@ -17,68 +18,17 @@
 #include <stdexcept>
 #ifdef _WIN32
 #include <fcntl.h>
+#include <windows.h>
 #else
 #include <unistd.h>
 #endif
 extern "C" {
-FileStream* APS5_VABI fopen_nid_postfix(const char*, const char*);
-void APS5_VABI clearerr_unlocked_nid_postfix(FileStream*);
-int APS5_VABI fileno_unlocked_nid_postfix(FileStream*);
-char* APS5_VABI fgetln_nid_postfix(FileStream*, std::size_t*);
-std::size_t APS5_VABI fread_nid_postfix(void*, std::size_t, std::size_t, FileStream*);
-std::size_t APS5_VABI fwrite_nid_postfix(const void*, std::size_t, std::size_t, FileStream*);
-FileStream* APS5_VABI freopen_nid_postfix(const char*, const char*, FileStream*);
-int APS5_VABI fseeko_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftello_nid_postfix(FileStream*);
-int APS5_VABI fseek_nid_postfix(FileStream*, std::int64_t, int);
-std::int64_t APS5_VABI ftell_nid_postfix(FileStream*);
-int* APS5_VABI __error_nid_postfix();
+
 extern FileStream* __stdinp_nid_postfix;
 extern FileStream* __stdoutp_nid_postfix;
 extern FileStream* __stderrp_nid_postfix;
 extern int __isthreaded_nid_postfix;
-int APS5_VABI fprintf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI fputs_nid_postfix(const char*, FileStream*);
-int APS5_VABI printf_nid_postfix(const char*, ...);
-int APS5_VABI vprintf_nid_postfix(const char*, void*);
-int APS5_VABI puts_nid_postfix(const char*);
-int APS5_VABI vfprintf_nid_postfix(FileStream*, const char*, void*);
-int APS5_VABI vsprintf_nid_postfix(char*, const char*, void*);
-int APS5_VABI fgetc_nid_postfix(FileStream*);
-int APS5_VABI fputc_nid_postfix(int, FileStream*);
-int APS5_VABI getc_unlocked_nid_postfix(FileStream*);
-int APS5_VABI putc_unlocked_nid_postfix(int, FileStream*);
-int APS5_VABI fputwc_nid_postfix(char16_t, FileStream*);
-int APS5_VABI fputws_nid_postfix(const char16_t*, FileStream*);
-std::int32_t APS5_VABI getwc_nid_postfix(FileStream*);
-std::int32_t APS5_VABI getwchar_nid_postfix();
-int APS5_VABI putwc_nid_postfix(char16_t, FileStream*);
-int APS5_VABI putwchar_nid_postfix(char16_t);
-char16_t* APS5_VABI fgetws_nid_postfix(char16_t*, int, FileStream*);
-int APS5_VABI getchar_unlocked_nid_postfix();
-int APS5_VABI putchar_unlocked_nid_postfix(int);
-int APS5_VABI fscanf_nid_postfix(FileStream*, const char*, ...);
-int APS5_VABI __srget_nid_postfix(FileStream*);
-int APS5_VABI __swbuf_nid_postfix(int, FileStream*);
-int APS5_VABI ungetc_nid_postfix(int, FileStream*);
-char* APS5_VABI fgets_nid_postfix(char*, int, FileStream*);
-int APS5_VABI feof_nid_postfix(FileStream*);
-int APS5_VABI ferror_nid_postfix(FileStream*);
-int APS5_VABI feof_unlocked_nid_postfix(FileStream*);
-int APS5_VABI ferror_unlocked_nid_postfix(FileStream*);
-int APS5_VABI fileno_nid_postfix(FileStream*);
-void APS5_VABI clearerr_nid_postfix(FileStream*);
-void APS5_VABI rewind_nid_postfix(FileStream*);
-int APS5_VABI setvbuf_nid_postfix(FileStream*, char*, int, std::size_t);
-void APS5_VABI setbuf_nid_postfix(FileStream*, char*);
-FileStream* APS5_VABI fdopen_nid_postfix(int, const char*);
-int APS5_VABI fclose_nid_postfix(FileStream*);
-int APS5_VABI fflush_nid_postfix(FileStream*);
-int APS5_VABI _Getmbcurmax_nid_postfix();
-int APS5_VABI ___mb_cur_max_nid_postfix();
-void APS5_VABI flockfile_nid_postfix(FileStream*);
-void APS5_VABI funlockfile_nid_postfix(FileStream*);
-int APS5_VABI ftrylockfile_nid_postfix(FileStream*);
+
 }
 static void Require(bool value) { if (!value) std::abort(); }
 static int APS5_VABI WriteFormatted(FileStream* stream, const char* format, ...) {
@@ -89,7 +39,7 @@ static int APS5_VABI WriteFormatted(FileStream* stream, const char* format, ...)
     std::va_list args;
     va_start(args, format);
 #endif
-    const int result = vfprintf_nid_postfix(stream, format, args);
+    const int result = vfprintf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
@@ -105,7 +55,7 @@ static int APS5_VABI PrintStandard(const char* format, ...) {
     std::va_list args;
     va_start(args, format);
 #endif
-    const int result = vprintf_nid_postfix(format, args);
+    const int result = vprintf_nid_postfix(format, reinterpret_cast<VaList*>(args));
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
@@ -121,7 +71,7 @@ static int APS5_VABI FormatString(char* buffer, const char* format, ...) {
     std::va_list args;
     va_start(args, format);
 #endif
-    const int result = vsprintf_nid_postfix(buffer, format, args);
+    const int result = vsprintf_nid_postfix(buffer, format, reinterpret_cast<VaList*>(args));
 #ifdef _WIN32
     __builtin_sysv_va_end(args);
 #else
@@ -162,6 +112,7 @@ static void CheckUnlockedStreams() {
     stream.SetError();
     Require(putc_unlocked_nid_postfix('R', &stream) == 'R' && (guest.flags & 0x40));
     clearerr_nid_postfix(&stream);
+
     Require(!(guest.flags & 0x40));
     stream.Close();
 
@@ -171,6 +122,7 @@ static void CheckUnlockedStreams() {
     Require(putc_unlocked_nid_postfix('X', &readOnly) == EOF && (readOnly.GuestState().flags & 0x40));
     Require(ferror_unlocked_nid_postfix(&readOnly) == 1 && feof_unlocked_nid_postfix(&readOnly) == 0);
     clearerr_unlocked_nid_postfix(&readOnly);
+
     Require(ferror_unlocked_nid_postfix(&readOnly) == 0);
     readOnly.Close();
     Require(CheckFileBytes(filename, "A", "rb", false));
@@ -186,6 +138,7 @@ static void CheckUnlockedQueries() {
     stream.SetError();
     Require(feof_unlocked_nid_postfix(&stream) == 1 && ferror_unlocked_nid_postfix(&stream) == 1);
     clearerr_unlocked_nid_postfix(&stream);
+
     Require(feof_unlocked_nid_postfix(&stream) == 0 && ferror_unlocked_nid_postfix(&stream) == 0);
     Require(std::fgetc(stream.GetHandle()) == EOF && std::ungetc('Q', stream.GetHandle()) == 'Q');
     Require(feof_unlocked_nid_postfix(&stream) == 0 && ferror_unlocked_nid_postfix(&stream) == 0);
@@ -195,6 +148,7 @@ static void CheckUnlockedQueries() {
     Require(fgetc_nid_postfix(&stream) == 0x7f && feof_nid_postfix(&stream) == 0);
     Require(fgetc_nid_postfix(&stream) == -1 && feof_nid_postfix(&stream) != 0);
     clearerr_unlocked_nid_postfix(&stream);
+
     Require(feof_nid_postfix(&stream) == 0 && ferror_nid_postfix(&stream) == 0);
     Require(fileno_unlocked_nid_postfix(&stream) == fileno_nid_postfix(&stream) && fileno_unlocked_nid_postfix(&stream) >= 0);
     Require(fileno_unlocked_nid_postfix(nullptr) == -1);
@@ -219,6 +173,7 @@ static void CheckTryLock() {
     Require(ftrylockfile_nid_postfix(&stream) == 0);
     Require(tryFromOtherThread() == -1);
     funlockfile_nid_postfix(&stream);
+
     Require(tryFromOtherThread() == -1);
     std::atomic<bool> written = false;
     std::thread writer([&] {
@@ -228,14 +183,17 @@ static void CheckTryLock() {
     std::this_thread::sleep_for(std::chrono::milliseconds(50));
     Require(!written && fputc_nid_postfix('A', &stream) == 'A');
     funlockfile_nid_postfix(&stream);
+
     writer.join();
     Require(written && tryFromOtherThread() == 0);
     std::atomic<bool> held = false, release = false;
     std::thread owner([&] {
         flockfile_nid_postfix(&stream);
+
         held = true;
         while (!release) std::this_thread::yield();
         funlockfile_nid_postfix(&stream);
+
     });
     while (!held) std::this_thread::yield();
     const int contended = ftrylockfile_nid_postfix(&stream);
@@ -243,6 +201,7 @@ static void CheckTryLock() {
     owner.join();
     Require(contended == -1 && ftrylockfile_nid_postfix(&stream) == 0);
     funlockfile_nid_postfix(&stream);
+
     Require(tryFromOtherThread() == 0);
     Require(fseeko_nid_postfix(&stream, 0, SEEK_SET) == 0);
     Require(fgetc_nid_postfix(&stream) == 'A' && fgetc_nid_postfix(&stream) == 'B');
@@ -263,9 +222,11 @@ static void CheckUnlockedStreamLock(bool write, int (APS5_VABI *query)(FileStrea
     int result = EOF;
     std::thread owner([&] {
         flockfile_nid_postfix(&stream);
+
         held = true;
         while (!release) std::this_thread::yield();
         funlockfile_nid_postfix(&stream);
+
     });
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(1);
     while (!held && std::chrono::steady_clock::now() < deadline) std::this_thread::yield();
@@ -301,6 +262,7 @@ static void CheckFgetsSize() {
     FileStream stream(std::tmpfile());
     Require(fwrite_nid_postfix("line\n", 1, 5, &stream) == 5);
     rewind_nid_postfix(&stream);
+
     for (const int size : {0, -1, std::numeric_limits<int>::min()}) {
         char buffer[8];
         std::memset(buffer, '!', sizeof(buffer));
@@ -310,6 +272,7 @@ static void CheckFgetsSize() {
         Require(buffer[0] == '!' && ftello_nid_postfix(&stream) == 0);
         Require(ferror_nid_postfix(&stream) != 0);
         clearerr_nid_postfix(&stream);
+
         Require(ferror_nid_postfix(&stream) == 0);
     }
     char line[8]{};
@@ -323,14 +286,17 @@ static void CheckRewind() {
     Require(fwrite_nid_postfix("ab", 1, 2, &stream) == 2);
     *__error_nid_postfix() = 7;
     rewind_nid_postfix(&stream);
+
     Require(*__error_nid_postfix() == 7 && ftello_nid_postfix(&stream) == 0);
     Require(fgetc_nid_postfix(&stream) == 'a' && ungetc_nid_postfix('z', &stream) == 'z');
     rewind_nid_postfix(&stream);
+
     Require(fgetc_nid_postfix(&stream) == 'a' && fgetc_nid_postfix(&stream) == 'b' && fgetc_nid_postfix(&stream) == EOF);
     Require(feof_nid_postfix(&stream) != 0);
     stream.SetError();
     Require(ferror_nid_postfix(&stream) != 0);
     rewind_nid_postfix(&stream);
+
     Require(feof_nid_postfix(&stream) == 0 && ferror_nid_postfix(&stream) == 0 && fgetc_nid_postfix(&stream) == 'a');
     stream.Close();
     int pipeEnds[2];
@@ -353,6 +319,7 @@ static void CheckRewind() {
     Require(fgetc_nid_postfix(&pipe) == 'q' && fgetc_nid_postfix(&pipe) == EOF && feof_nid_postfix(&pipe) != 0);
     *__error_nid_postfix() = 0;
     rewind_nid_postfix(&pipe);
+
     Require(*__error_nid_postfix() == 29 && feof_nid_postfix(&pipe) == 0 && ferror_nid_postfix(&pipe) == 0);
     pipe.Close();
 }
@@ -623,7 +590,7 @@ int main(int argc, char** argv) {
     if (argc > 1 && std::string_view(argv[1]) == "--exclusive-stdout") return CheckExclusiveStandardOutput();
     CheckClosedStreamWrites();
     CheckDescriptorAccessModes();
-    Require(_Getmbcurmax_nid_postfix() == 1 && _Getmbcurmax_nid_postfix() == ___mb_cur_max_nid_postfix());
+    Require(_Getmbcurmax_nid_postfix() == 3 && ___mb_cur_max_nid_postfix() == 1);
     CheckFlushWhileReading();
     Require(fdopen_nid_postfix(-1, "rb") == nullptr && *__error_nid_postfix() == 9);
     Require(fdopen_nid_postfix(0, nullptr) == nullptr && *__error_nid_postfix() == 22);
@@ -641,6 +608,7 @@ int main(int argc, char** argv) {
     auto* wrapped = fdopen_nid_postfix(descriptor, "r+b");
     Require(wrapped != nullptr && fileno_nid_postfix(wrapped) == descriptor);
     setbuf_nid_postfix(wrapped, nullptr);
+
     Require(fseek_nid_postfix(wrapped, 0, SEEK_SET) == 0);
     char contents[32]{};
     Require(fgets_nid_postfix(contents, sizeof(contents), wrapped) == contents && std::strcmp(contents, "retained") == 0);
@@ -713,6 +681,7 @@ int main(int argc, char** argv) {
     Require(fgetc_nid_postfix(&stream) == EOF);
     Require(feof_nid_postfix(&stream) && (guest.flags & 0x20));
     clearerr_nid_postfix(&stream);
+
     Require(!feof_nid_postfix(&stream) && !(guest.flags & 0x20));
     stream.Close();
     Require(guest.flags == 0 && guest.descriptor == -1);
@@ -744,17 +713,21 @@ int main(int argc, char** argv) {
     Require(wideBuf[0] == u'E' && wideBuf[1] == u'n' && wideBuf[2] == u'd' && wideBuf[3] == 0);
     Require(fgetws_nid_postfix(wideBuf, 16, &wideIo) == nullptr);
     Require(feof_nid_postfix(&wideIo));
-    Require(fgetws_nid_postfix(wideBuf, 0, &wideIo) == nullptr && *__error_nid_postfix() == 22);
-    Require(ferror_nid_postfix(&wideIo));
     clearerr_nid_postfix(&wideIo);
+
+    *__error_nid_postfix() = 0;
+    Require(fgetws_nid_postfix(wideBuf, 0, &wideIo) == nullptr && *__error_nid_postfix() == 0);
+    Require(fgetws_nid_postfix(wideBuf, -1, &wideIo) == nullptr && *__error_nid_postfix() == 0);
+    Require(!ferror_nid_postfix(&wideIo));
     Require(fgetws_nid_postfix(nullptr, 16, &wideIo) == nullptr && *__error_nid_postfix() == 22);
     Require(ferror_nid_postfix(&wideIo));
     clearerr_nid_postfix(&wideIo);
+
     Require(fgetws_nid_postfix(wideBuf, 16, nullptr) == nullptr && *__error_nid_postfix() == 22);
     wideBuf[0] = u'X';
     wideBuf[1] = u'Y';
     std::rewind(wideIo.GetHandle());
-    Require(fgetws_nid_postfix(wideBuf, 1, &wideIo) == wideBuf && wideBuf[0] == 0 && wideBuf[1] == u'Y');
+    Require(fgetws_nid_postfix(wideBuf, 1, &wideIo) == nullptr && wideBuf[0] == u'X' && wideBuf[1] == u'Y');
     Require(fgetc_nid_postfix(&wideIo) == 'H');
     wideIo.Close();
 
@@ -778,7 +751,7 @@ int main(int argc, char** argv) {
     Require(fputc_nid_postfix(0xff, &midErr) == 0xff);
     std::rewind(midErr.GetHandle());
     char16_t midBuf[16]{};
-    Require(fgetws_nid_postfix(midBuf, 16, &midErr) == nullptr);
+    Require(fgetws_nid_postfix(midBuf, 16, &midErr) == midBuf && midBuf[0] == u'A' && midBuf[1] == 0);
     Require(ferror_nid_postfix(&midErr));
     midErr.Close();
 
@@ -891,6 +864,7 @@ int main(int argc, char** argv) {
     FileStream locked(std::tmpfile());
     flockfile_nid_postfix(&locked);
     flockfile_nid_postfix(&locked);
+
     std::atomic<bool> lockedWrite = false;
     std::thread writer([&] {
         Require(fputc_nid_postfix('B', &locked) == 'B');
@@ -899,9 +873,11 @@ int main(int argc, char** argv) {
     std::this_thread::sleep_for(std::chrono::milliseconds(50));
     Require(!lockedWrite && fputc_nid_postfix('A', &locked) == 'A');
     funlockfile_nid_postfix(&locked);
+
     std::this_thread::sleep_for(std::chrono::milliseconds(50));
     Require(!lockedWrite);
     funlockfile_nid_postfix(&locked);
+
     writer.join();
     Require(lockedWrite && fseeko_nid_postfix(&locked, 0, SEEK_SET) == 0);
     Require(fgetc_nid_postfix(&locked) == 'A' && fgetc_nid_postfix(&locked) == 'B');
@@ -920,6 +896,14 @@ int main(int argc, char** argv) {
     CheckStandardStreamDeleteSharing();
     const std::string standardFilename = "anyps5-standard-reopen-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
     Require(freopen_nid_postfix(standardFilename.c_str(), "w", __stdoutp_nid_postfix) == __stdoutp_nid_postfix);
+    const HANDLE hostOutput = ::GetStdHandle(STD_OUTPUT_HANDLE);
+    Require(hostOutput != nullptr && hostOutput != INVALID_HANDLE_VALUE);
+    Require(hostOutput != reinterpret_cast<HANDLE>(::_get_osfhandle(::_fileno(stdout))));
+    DWORD handleFlags = 0;
+    Require(::GetHandleInformation(hostOutput, &handleFlags) != 0);
+    constexpr char hostMessage[] = "host stdout preserved\n";
+    DWORD hostWritten = 0;
+    Require(::WriteFile(hostOutput, hostMessage, sizeof(hostMessage) - 1, &hostWritten, nullptr) != 0 && hostWritten == sizeof(hostMessage) - 1);
     Require(printf_nid_postfix("standard output") == 15 && fflush_nid_postfix(__stdoutp_nid_postfix) == 0);
     { std::ifstream input(standardFilename, std::ios::binary); std::string contents; std::getline(input, contents);
       Require(contents == "standard output"); }
diff --git a/core/libs/tests/GuestStatvfs.cpp b/core/libs/tests/GuestStatvfs.cpp
index 2019801dc0..ba87a280b0 100644
--- a/core/libs/tests/GuestStatvfs.cpp
+++ b/core/libs/tests/GuestStatvfs.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/General.hpp"
 #include <array>
 #include <chrono>
@@ -18,9 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI statvfs_nid_postfix(const char*, void*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "statvfs check failed at line %d\n", line);
@@ -33,7 +32,7 @@ static void RequireVolume(const char* path, const std::filesystem::path& native)
     std::array<std::uint64_t, 13> output;
     output.fill(0xA5A5A5A5A5A5A5A5ull);
     *__error_nid_postfix() = 12345;
-    Require(statvfs_nid_postfix(path, output.data() + 1) == 0);
+    Require(statvfs_nid_postfix(path, reinterpret_cast<LibcStatvfs*>(output.data() + 1)) == 0);
     Require(*__error_nid_postfix() == 12345);
     Require(output.front() == 0xA5A5A5A5A5A5A5A5ull && output.back() == output.front());
     const auto* fields = output.data() + 1;
@@ -49,7 +48,7 @@ static void RequireError(const char* path, int error) {
     output.fill(0x5A5A5A5A5A5A5A5Aull);
     const auto saved = output;
     *__error_nid_postfix() = 0;
-    const int result = statvfs_nid_postfix(path, output.data());
+    const int result = statvfs_nid_postfix(path, reinterpret_cast<LibcStatvfs*>(output.data()));
     if (result != -1)
         std::fprintf(stderr, "path %s: expected failure, got %d\n", path ? path : "(null)", result);
     Require(result == -1);
diff --git a/core/libs/tests/GuestStdExecuteOnce.cpp b/core/libs/tests/GuestStdExecuteOnce.cpp
index d189ddcd71..9bead6d3e1 100644
--- a/core/libs/tests/GuestStdExecuteOnce.cpp
+++ b/core/libs/tests/GuestStdExecuteOnce.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -5,7 +6,7 @@
 #include <thread>
 
 using Callback = int (APS5_VABI *)(void*, void*, void**);
-extern "C" int APS5_VABI std_execute_once_nid_postfix(int*, Callback, void*);
+
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::atomic<int> calls{0}, arrived{0};
@@ -53,6 +54,7 @@ int main() {
 
     try {
         std_execute_once_nid_postfix(&throwing, Throw, nullptr);
+
         std::abort();
     } catch (int value) {
         Require(value == 7 && throwing == 0);
diff --git a/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp
new file mode 100644
index 0000000000..a0e900ce98
--- /dev/null
+++ b/core/libs/tests/GuestStdThreadHardwareConcurrency.cpp
@@ -0,0 +1,14 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdio>
+#include <thread>
+
+int main() {
+    const unsigned result = _ZNSt6thread20hardware_concurrencyEv_nid_postfix();
+    if (result != std::thread::hardware_concurrency()) {
+        std::fprintf(stderr, "guest processor hint %u differs from std::thread::hardware_concurrency %u\n",
+            result, std::thread::hardware_concurrency());
+        return 1;
+    }
+    return 0;
+}
diff --git a/core/libs/tests/GuestStdioVariadic.cpp b/core/libs/tests/GuestStdioVariadic.cpp
index 62ead8be7f..0fa24de842 100644
--- a/core/libs/tests/GuestStdioVariadic.cpp
+++ b/core/libs/tests/GuestStdioVariadic.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdarg>
@@ -9,13 +10,7 @@
 
 extern "C" {
 extern FileStream* __stdinp_nid_postfix;
-int APS5_VABI vfscanf_nid_postfix(FileStream*, const char*, void*);
-int APS5_VABI vscanf_nid_postfix(const char*, void*);
-int APS5_VABI scanf_nid_postfix(const char*, ...);
-int APS5_VABI vfwprintf_nid_postfix(FileStream*, const char16_t*, void*);
-int APS5_VABI fwprintf_nid_postfix(FileStream*, const char16_t*, ...);
-int APS5_VABI vswscanf_nid_postfix(const char16_t*, const char16_t*, void*);
-int APS5_VABI vswscanf_s_nid_postfix(const char16_t*, const char16_t*, void*);
+
 }
 
 #ifdef _WIN32
@@ -34,39 +29,71 @@ static void Require(bool value, const char* what) {
 
 static int APS5_VABI ScanStream(FileStream* stream, const char* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfscanf_nid_postfix(stream, format, args);
+    const int result = vfscanf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanInput(const char* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vscanf_nid_postfix(format, args);
+    const int result = vscanf_nid_postfix(format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI PrintWide(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfwprintf_nid_postfix(stream, format, args);
+    const int result = vfwprintf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanWide(const char16_t* input, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vswscanf_nid_postfix(input, format, args);
+    const int result = vswscanf_nid_postfix(input, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanWideSized(const char16_t* input, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vswscanf_s_nid_postfix(input, format, args);
+    const int result = vswscanf_s_nid_postfix(input, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
+static long APS5_VABI SumThroughCopy(int count, ...) {
+    APS5_VA_BEGIN(count);
+    unsigned char before[24];
+    std::memcpy(before, &args, sizeof(before));
+#ifdef _WIN32
+    __builtin_sysv_va_list copy;
+#else
+    std::va_list copy;
+#endif
+    _Vacopy_nid_postfix(reinterpret_cast<unsigned char*>(&copy), reinterpret_cast<const unsigned char*>(&args));
+
+    Require(std::memcmp(&copy, &args, sizeof(before)) == 0, "_Vacopy copies all 24 bytes");
+    long sum = 0;
+    for (int index = 0; index < count; ++index) sum += __builtin_va_arg(copy, long) * (index + 1);
+    Require(std::memcmp(&args, before, sizeof(before)) == 0, "_Vacopy leaves the source untouched");
+    for (int index = 0; index < count; ++index) sum -= __builtin_va_arg(args, long);
+    APS5_VA_END();
+    return sum;
+}
+
+static void CheckVacopy() {
+    long expected = 0;
+    for (long index = 1; index <= 9; ++index) expected += index * 100 * index - index * 100;
+    Require(SumThroughCopy(9, 100L, 200L, 300L, 400L, 500L, 600L, 700L, 800L, 900L) == expected, "_Vacopy copy reads every argument");
+    unsigned char overlap[32];
+    for (int index = 0; index < 32; ++index) overlap[index] = static_cast<unsigned char>(index);
+    _Vacopy_nid_postfix(overlap + 8, overlap);
+
+    const unsigned char shifted[32] = {0, 1, 2, 3, 4, 5, 6, 7, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23};
+    Require(std::memcmp(overlap, shifted, sizeof(overlap)) == 0, "_Vacopy copies the overflow area before the offsets");
+}
+
 static std::string Contents(FileStream& stream) {
     std::fflush(stream.GetHandle());
     std::rewind(stream.GetHandle());
@@ -110,5 +137,6 @@ int main() {
     char16_t letters[4]{};
     Require(ScanWideSized(u"abcdef", u"%3ls", letters, 4u) == 1 && std::u16string(letters) == u"abc", "vswscanf_s %ls with a size");
     Require(ScanWideSized(u"abcdef", u"%ls", letters, 4u) == 0 && letters[0] == 0, "vswscanf_s rejects a too small buffer");
+    CheckVacopy();
     return 0;
 }
diff --git a/core/libs/tests/GuestStrftime.cpp b/core/libs/tests/GuestStrftime.cpp
index eef399eda0..f4a40f8712 100644
--- a/core/libs/tests/GuestStrftime.cpp
+++ b/core/libs/tests/GuestStrftime.cpp
@@ -1,14 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include <cstddef>
 #include <cstdio>
 #include <cstring>
 
-extern "C" {
-std::size_t APS5_VABI strftime_nid_postfix(char*, std::size_t, const char*, const GuestTm*);
-char* APS5_VABI asctime_nid_postfix(const GuestTm*);
-}
-
 namespace {
 
 GuestTm MakeTime(int year, int hour, int wday, int yday, int isdst) {
diff --git a/core/libs/tests/GuestStrings.cpp b/core/libs/tests/GuestStrings.cpp
index ef2f2f0a69..8debeb251f 100644
--- a/core/libs/tests/GuestStrings.cpp
+++ b/core/libs/tests/GuestStrings.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libScePosixForWebKit/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -8,46 +10,6 @@
 #include <cstdlib>
 #include <string>
 
-extern "C" {
-void APS5_VABI bcopy_nid_postfix(const void*, void*, std::size_t);
-char* APS5_VABI basename_nid_postfix(const char*);
-char* APS5_VABI basename_r_nid_postfix(const char*, char*);
-char* APS5_VABI __inet_ntoa_nid_postfix(unsigned int);
-char* APS5_VABI dirname_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-long long APS5_VABI strtonum_nid_postfix(const char*, long long, long long, const char**);
-int APS5_VABI strcasecmp_nid_postfix(const char*, const char*);
-int APS5_VABI strncasecmp_nid_postfix(const char*, const char*, std::size_t);
-std::size_t APS5_VABI strnlen_nid_postfix(const char*, std::size_t);
-std::size_t APS5_VABI strnlen_s_nid_postfix(const char*, std::size_t);
-char* APS5_VABI strncat_nid_postfix(char*, const char*, std::size_t);
-char* APS5_VABI strpbrk_nid_postfix(const char*, const char*);
-const char* APS5_VABI strchr_nid_postfix(const char*, int);
-char* APS5_VABI strrchr_nid_postfix(const char*, int);
-std::size_t APS5_VABI strcspn_nid_postfix(const char*, const char*);
-std::size_t APS5_VABI strlcat_nid_postfix(char*, const char*, std::size_t);
-char* APS5_VABI stpcpy_nid_postfix(char*, const char*);
-char* APS5_VABI strtok_r_nid_postfix(char*, const char*, char**);
-char* APS5_VABI strtok_nid_postfix(char*, const char*);
-char* APS5_VABI strsep_nid_postfix(char**, const char*);
-char* APS5_VABI strcasestr_nid_postfix(const char*, const char*);
-int APS5_VABI strcpy_s_nid_postfix(char*, std::size_t, const char*);
-int APS5_VABI strncpy_s_nid_postfix(char*, std::size_t, const char*, std::size_t);
-int APS5_VABI strcat_s_nid_postfix(char*, std::size_t, const char*);
-int APS5_VABI strncat_s_nid_postfix(char*, std::size_t, const char*, std::size_t);
-int APS5_VABI memcpy_s_nid_postfix(void*, std::size_t, const void*, std::size_t);
-int APS5_VABI memmove_s_nid_postfix(void*, std::size_t, const void*, std::size_t);
-int APS5_VABI memset_s_nid_postfix(void*, std::size_t, int, std::size_t);
-void* APS5_VABI memccpy_nid_postfix(void*, const void*, int, std::size_t);
-void* APS5_VABI memmem_nid_postfix(const void*, std::size_t, const void*, std::size_t);
-char* APS5_VABI strnstr_nid_postfix(const char*, const char*, std::size_t);
-std::size_t APS5_VABI strxfrm_nid_postfix(char*, const char*, std::size_t);
-int APS5_VABI snprintf_s_nid_postfix(char*, std::size_t, const char*, ...);
-int APS5_VABI sscanf_s_nid_postfix(const char*, const char*, ...);
-int APS5_VABI __inet_aton_nid_postfix(const char*, void*);
-std::uint32_t APS5_VABI __inet_addr_nid_postfix(const char*);
-}
-
 static void Require(bool condition) {
     if (!condition) {
         std::fputs("Guest string check failed\n", stderr);
@@ -131,6 +93,13 @@ static void CheckBoundsCheckedFunctions() {
     Require(memcpy_s_nid_postfix(bytes, 2, source, 4) == 34 && bytes[0] == 0 && bytes[1] == 0 && bytes[2] == 3);
     char overlap[6] = "abcde";
     Require(memmove_s_nid_postfix(overlap + 1, 5, overlap, 3) == 0 && std::strcmp(overlap, "aabce") == 0);
+    char strOverlap[16] = "abcdef";
+    Require(strncpy_s_nid_postfix(strOverlap + 1, 10, strOverlap, 3) == 22 && strOverlap[1] == '\0');
+    char catOverlap[16] = "abcdef";
+    Require(strncat_s_nid_postfix(catOverlap + 3, 10, catOverlap, 3) == 22 && catOverlap[3] == '\0');
+    char nonOverlap[16] = {};
+    std::strcpy(nonOverlap + 8, "cd");
+    Require(strcpy_s_nid_postfix(nonOverlap, SIZE_MAX >> 1, nonOverlap + 8) == 0 && std::strcmp(nonOverlap, "cd") == 0);
     Require(memset_s_nid_postfix(bytes, sizeof(bytes), 9, 8) == 22 && bytes[0] == 9 && bytes[3] == 9);
     char sentinel[4] = {1, 2, 3, 4};
     Require(memset_s_nid_postfix(sentinel, sizeof(sentinel), 7, 2) == 0 && sentinel[1] == 7 && sentinel[2] == 3);
@@ -174,18 +143,17 @@ static void CheckSecureStringSizeLimits() {
 
 static void CheckCaseInsensitiveComparison() {
     Require(strcasecmp_nid_postfix("", "") == 0 && strcasecmp_nid_postfix("AbC", "aBc") == 0);
-    Require(strcasecmp_nid_postfix("A", "b") == 'a' - 'b' && strcasecmp_nid_postfix("b", "A") == 'b' - 'a');
-    Require(strcasecmp_nid_postfix("ab", "A") == 'b' && strcasecmp_nid_postfix("AB", "a") == 'b');
-    Require(strcasecmp_nid_postfix("A", "aB") == -'b' && strcasecmp_nid_postfix("a", "AB") == -'b');
-    Require(strcasecmp_nid_postfix("", "Z") == -'z' && strcasecmp_nid_postfix("Z", "") == 'z');
-    Require(strncasecmp_nid_postfix("abc", "ABD", 2) == 0 && strncasecmp_nid_postfix("abc", "ABD", 3) == 'c' - 'd');
-    Require(strncasecmp_nid_postfix("Ab", "a", 2) == 'b' && strncasecmp_nid_postfix("a", "AB", 5) == -'b');
-    Require(strncasecmp_nid_postfix("Q", "", 1) == 'q' && strncasecmp_nid_postfix("", "Q", 1) == -'q');
+    Require(strcasecmp_nid_postfix("A", "b") == -1 && strcasecmp_nid_postfix("b", "A") == 1);
+    Require(strcasecmp_nid_postfix("ab", "A") == 1 && strcasecmp_nid_postfix("AB", "a") == 1);
+    Require(strcasecmp_nid_postfix("A", "aB") == -1 && strcasecmp_nid_postfix("a", "AB") == -1);
+    Require(strcasecmp_nid_postfix("", "Z") == -1 && strcasecmp_nid_postfix("Z", "") == 1);
+    Require(strncasecmp_nid_postfix("abc", "ABD", 2) == 0 && strncasecmp_nid_postfix("abc", "ABD", 3) == -1);
+    Require(strncasecmp_nid_postfix("Ab", "a", 2) == 1 && strncasecmp_nid_postfix("a", "AB", 5) == -1);
+    Require(strncasecmp_nid_postfix("Q", "", 1) == 1 && strncasecmp_nid_postfix("", "Q", 1) == -1);
     Require(strncasecmp_nid_postfix("x", "y", 0) == 0 && strncasecmp_nid_postfix("same", "SAME", 99) == 0);
 }
 
 static void CheckSscanfS() {
-#ifndef _WIN32
     int number = 0;
     char word[4] = "zz";
     char letter = 0;
@@ -202,7 +170,6 @@ static void CheckSscanfS() {
     Require(sscanf_s_nid_postfix("7 %", "%d %%%n", &number, &position) == 1 && position == 3);
     Require(sscanf_s_nid_postfix("   ", "%d", &number) == EOF);
     Require(sscanf_s_nid_postfix("x", "%d", &number) == 0);
-#endif
 }
 
 static bool CheckDirnameLengths() {
@@ -258,6 +225,7 @@ static void CheckBcopy() {
                 auto expected = original;
                 for (std::size_t i = 0; i < count; ++i) expected[destination + i] = original[source + i];
                 bcopy_nid_postfix(actual.data() + source, actual.data() + destination, count);
+
                 Require(actual == expected);
             }
         }
@@ -265,8 +233,10 @@ static void CheckBcopy() {
     auto destination = original;
     destination.fill(0xff);
     bcopy_nid_postfix(original.data(), destination.data(), original.size());
+
     Require(destination == original);
     bcopy_nid_postfix(nullptr, nullptr, 0);
+
 }
 
 static void CheckStrtonum() {
diff --git a/core/libs/tests/GuestSyncOnAddress.cpp b/core/libs/tests/GuestSyncOnAddress.cpp
index c43e7a66fe..e320373917 100644
--- a/core/libs/tests/GuestSyncOnAddress.cpp
+++ b/core/libs/tests/GuestSyncOnAddress.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -8,17 +10,7 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelSyncOnAddressWait(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait32(std::uint32_t* address, std::uint32_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait64(std::uint64_t* address, std::uint64_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait8(std::uint8_t* address, std::uint8_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWait16(std::uint16_t* address, std::uint16_t expected, const KernelUseconds* timeout, const char* name);
-int APS5_VABI sceKernelSyncOnAddressWake(void* address, std::int32_t count);
-}
-
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_ETIMEDOUT = static_cast<int>(0x8002003C);
 static constexpr KernelUseconds FAILSAFE_TIMEOUT = 10000000;
 static constexpr auto SETTLE = std::chrono::milliseconds(100);
 
diff --git a/core/libs/tests/GuestSysarch.cpp b/core/libs/tests/GuestSysarch.cpp
index f2c4551138..b6533c2e65 100644
--- a/core/libs/tests/GuestSysarch.cpp
+++ b/core/libs/tests/GuestSysarch.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <cstdint>
@@ -6,13 +8,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sysarch(int number, void* args);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall> static std::string Thrown(TCall call) {
diff --git a/core/libs/tests/GuestSyslog.cpp b/core/libs/tests/GuestSyslog.cpp
index 0d55e1a440..c0a954c07a 100644
--- a/core/libs/tests/GuestSyslog.cpp
+++ b/core/libs/tests/GuestSyslog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
@@ -11,13 +12,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-void APS5_VABI syslog_nid_postfix(int, const char*, ...);
-void APS5_VABI openlog_nid_postfix(const char*, int, int);
-void APS5_VABI closelog_nid_postfix();
-int APS5_VABI setlogmask_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     auto* captured = std::tmpfile();
@@ -33,33 +27,42 @@ int main() {
     *__error_nid_postfix() = 2;
     Require(setlogmask_nid_postfix(0) == 0xff);
     syslog_nid_postfix(6, "station %s at %d kbps", "radio", 128);
+
     const int afterFirst = *__error_nid_postfix();
     syslog_nid_postfix(16 | 3, "open: %m, %%m kept, %d%%\n", 50);
     syslog_nid_postfix(0x10000 | 4, "masked");
     syslog_nid_postfix(7, "");
+
     Require(setlogmask_nid_postfix(1 << 3) == 0xff);
     Require(setlogmask_nid_postfix(0) == (1 << 3));
     int count = -1;
     syslog_nid_postfix(7, "suppressed %m%n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     syslog_nid_postfix(16 | 3, "allowed: %m");
+
     Require(*__error_nid_postfix() == 2);
     syslog_nid_postfix(0x10000 | 7, "suppressed %n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     Require(setlogmask_nid_postfix(1 << 4) == (1 << 3));
     syslog_nid_postfix(0x10000 | 4, "warning without diagnostic");
     syslog_nid_postfix(0x10000 | 7, "both suppressed %n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     Require(setlogmask_nid_postfix(0x100) == (1 << 4));
     Require(setlogmask_nid_postfix(0) == 0x100);
     syslog_nid_postfix(0x10000 | 3, "no priorities enabled %n", &count);
+
     Require(count == -1 && *__error_nid_postfix() == 2);
     Require(setlogmask_nid_postfix(-1) == 0x100);
     Require(setlogmask_nid_postfix(0) == -1);
     syslog_nid_postfix(7, "negative mask");
+
     Require(setlogmask_nid_postfix(0x55) == -1);
     for (int priority = 0; priority < 8; ++priority)
         syslog_nid_postfix(16 | priority, "level %d", priority);
+
     std::thread([] { Require(setlogmask_nid_postfix(0xff) == 0x55); }).join();
     Require(setlogmask_nid_postfix(0) == 0xff);
     syslog_nid_postfix(7, "mask shared across threads");
@@ -73,6 +76,7 @@ int main() {
     openlog_nid_postfix("closing", 1, 0);
     closelog_nid_postfix();
     syslog_nid_postfix(6, "identity cleared, options and facility retained");
+
     std::fflush(stderr);
 #ifdef _WIN32
     Require(::_dup2(saved, ::_fileno(stderr)) == 0 && ::_close(saved) == 0);
diff --git a/core/libs/tests/GuestSysmodule.cpp b/core/libs/tests/GuestSysmodule.cpp
index f98548f2ce..b416232025 100644
--- a/core/libs/tests/GuestSysmodule.cpp
+++ b/core/libs/tests/GuestSysmodule.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSysmodule/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceSysmodule/ModuleTable.hpp"
@@ -18,20 +20,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceSysmoduleIsLoaded(std::uint16_t id);
-int APS5_VABI sceSysmoduleLoadModule(std::uint16_t id);
-int APS5_VABI sceSysmoduleUnloadModule(std::uint16_t id);
-int APS5_VABI sceSysmoduleLoadModuleInternal(std::uint32_t id);
-int APS5_VABI sceSysmoduleUnloadModuleInternal(std::uint32_t id);
-int APS5_VABI sceSysmoduleIsLoadedInternal(std::uint32_t id);
-int APS5_VABI sceSysmoduleLoadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
-int APS5_VABI sceSysmoduleUnloadModuleInternalWithArg(std::uint32_t id, int argc, void* argv, std::uint64_t unk, int* ret);
-int APS5_VABI sceSysmoduleGetModuleInfoForUnwind(std::uint64_t addr, int flags, ModuleInfoForUnwind* info);
-int APS5_VABI sceSysmoduleGetModuleHandleInternal(std::uint32_t id, std::int32_t* handle);
-int APS5_VABI sceKernelDlsym(std::int32_t handle, const char* symbol, void** addr);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -110,6 +98,7 @@ void CheckUnwindInfo() {
     bool threw = false;
     try {
         sceSysmoduleGetModuleInfoForUnwind(reinterpret_cast<std::uint64_t>(gap), 0, &info);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
diff --git a/core/libs/tests/GuestSystemCommand.cpp b/core/libs/tests/GuestSystemCommand.cpp
index 23290b0822..9eb03d0240 100644
--- a/core/libs/tests/GuestSystemCommand.cpp
+++ b/core/libs/tests/GuestSystemCommand.cpp
@@ -1,9 +1,8 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
-extern "C" {
-int APS5_VABI system_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 int main() {
     *__error_nid_postfix() = 13;
diff --git a/core/libs/tests/GuestSystemConfiguration.cpp b/core/libs/tests/GuestSystemConfiguration.cpp
index c6726534a9..ec022beb6f 100644
--- a/core/libs/tests/GuestSystemConfiguration.cpp
+++ b/core/libs/tests/GuestSystemConfiguration.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
@@ -5,34 +8,16 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <ctime>
 #include <stdexcept>
 #include <vector>
-struct SceKernelSystemSwVersion {
-    std::uint64_t size;
-    char versionString[0x1C];
-    std::uint32_t version;
-};
+
 static_assert(offsetof(SceKernelSystemSwVersion, size) == 0x00);
 static_assert(offsetof(SceKernelSystemSwVersion, versionString) == 0x08);
 static_assert(offsetof(SceKernelSystemSwVersion, version) == 0x24);
 static_assert(sizeof(SceKernelSystemSwVersion) == 0x28);
 extern "C" {
-std::int64_t APS5_VABI sysconf_nid_postfix(int);
-int APS5_VABI getpagesize_nid_postfix();
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI sysctl_nid_postfix(const int*, std::uint32_t, void*, std::size_t*, const void*, std::size_t);
-int APS5_VABI sysctlbyname_nid_postfix(const char*, void*, std::size_t*, const void*, std::size_t);
-int APS5_VABI sysctlnametomib_nid_postfix(const char*, int*, std::size_t*);
-int APS5_VABI sceKernelGetSystemSwVersion_nid_postfix(SceKernelSystemSwVersion*);
-int APS5_VABI getpid_nid_postfix();
-void* APS5_VABI mmap_nid_postfix(void*, std::size_t, int, int, int, std::int64_t);
-int APS5_VABI munmap_nid_postfix(void*, std::size_t);
-std::uint64_t APS5_VABI sceKernelGetTscFrequency(void);
-struct GuestRlimitTest {
-    std::int64_t rlim_cur;
-    std::int64_t rlim_max;
-};
-int APS5_VABI getrlimit_nid_postfix(int resource, GuestRlimitTest* limit);
+
 extern char** environ_nid_postfix;
 }
 static void Require(bool value) { if (!value) std::abort(); }
@@ -64,6 +49,7 @@ static void CheckProcessorCountSysctl() {
     const int unknown[] = {6, 99};
     try {
         sysctl_nid_postfix(unknown, 2, &value, &length, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -249,6 +235,29 @@ static void CheckUnansweredSysctl() {
         Require(size == 4 && untouched[0] == 0x5a5a5a5a && untouched[1] == 0x5a5a5a5a && untouched[2] == 0x5a5a5a5a);
     }
 }
+static void CheckUnknownSysctlName() {
+    static constexpr const char* name = "kern.anyps5_no_such_name";
+    unsigned char buffer[16];
+    std::memset(buffer, 0xaa, sizeof(buffer));
+    std::size_t length = sizeof(buffer);
+    *__error_nid_postfix() = 13;
+    Require(sysctlbyname_nid_postfix(name, buffer, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 2);
+    Require(length == sizeof(buffer) && Untouched(buffer, sizeof(buffer)));
+
+    length = 77;
+    *__error_nid_postfix() = 13;
+    Require(sysctlbyname_nid_postfix(name, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 2 && length == 77);
+
+    int mib[4] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t mibLength = 4;
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix(name, mib, &mibLength) == -1 && *__error_nid_postfix() == 2);
+    Require(mibLength == 4 && mib[0] == 0x5a5a5a5a && mib[1] == 0x5a5a5a5a && mib[2] == 0x5a5a5a5a && mib[3] == 0x5a5a5a5a);
+
+    mibLength = 0;
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix(name, nullptr, &mibLength) == -1 && *__error_nid_postfix() == 2 && mibLength == 0);
+}
 static void CheckPathnameSysctl() {
     *__error_nid_postfix() = 13;
     char buffer[32] = {};
@@ -383,8 +392,60 @@ static void CheckOsReleaseDateSysctl() {
     length = sizeof(value);
     Require(sysctl_nid_postfix(deeper, 3, &value, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 20);
 }
+struct BootTimeval {
+    std::int64_t tv_sec;
+    std::int64_t tv_usec;
+};
+static_assert(sizeof(BootTimeval) == 16);
+
+static void CheckBootTimeSysctl() {
+    const int mib[] = {1, 21};
+    *__error_nid_postfix() = 13;
+    std::size_t length = 0;
+    Require(sysctl_nid_postfix(mib, 2, nullptr, &length, nullptr, 0) == 0 && length == sizeof(BootTimeval));
+    length = 0;
+    Require(sysctlbyname_nid_postfix("kern.boottime", nullptr, &length, nullptr, 0) == 0 && length == sizeof(BootTimeval));
+    BootTimeval first{};
+    length = sizeof(first);
+    Require(sysctl_nid_postfix(mib, 2, &first, &length, nullptr, 0) == 0 && length == sizeof(first));
+    Require(first.tv_sec > 0 && first.tv_sec <= static_cast<std::int64_t>(std::time(nullptr)));
+    Require(first.tv_usec >= 0 && first.tv_usec < 1000000);
+    KernelTimespec now{};
+    KernelTimespec uptime{};
+    Require(clock_gettime_nid_postfix(5, &uptime) == 0 && clock_gettime_nid_postfix(0, &now) == 0);
+    const std::int64_t drift = (first.tv_sec + uptime.tv_sec - now.tv_sec) * 1000000 + first.tv_usec + uptime.tv_nsec / 1000 - now.tv_nsec / 1000;
+    Require(drift > -1000000 && drift < 1000000);
+    BootTimeval second{};
+    length = sizeof(second);
+    Require(sysctl_nid_postfix(mib, 2, &second, &length, nullptr, 0) == 0 && length == sizeof(second));
+    Require(second.tv_sec == first.tv_sec && second.tv_usec == first.tv_usec);
+    BootTimeval named{};
+    length = 32;
+    Require(sysctlbyname_nid_postfix("kern.boottime", &named, &length, nullptr, 0) == 0 && length == sizeof(named));
+    Require(named.tv_sec == first.tv_sec && named.tv_usec == first.tv_usec);
+    Require(*__error_nid_postfix() == 13);
+
+    int namedMib[3] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t mibLength = 3;
+    Require(sysctlnametomib_nid_postfix("kern.boottime", namedMib, &mibLength) == 0 && mibLength == 2);
+    Require(namedMib[0] == 1 && namedMib[1] == 21 && namedMib[2] == 0x5a5a5a5a);
+
+    unsigned char truncated[16];
+    std::memset(truncated, 0xaa, sizeof(truncated));
+    length = 8;
+    Require(sysctl_nid_postfix(mib, 2, truncated, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 12);
+    Require(length == 8 && std::memcmp(truncated, &first.tv_sec, 8) == 0 && truncated[8] == 0xaa);
+    std::memset(truncated, 0xaa, sizeof(truncated));
+    length = 8;
+    Require(sysctlbyname_nid_postfix("kern.boottime", truncated, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 12);
+    Require(length == 8 && truncated[8] == 0xaa);
+
+    length = sizeof(first);
+    Require(sysctl_nid_postfix(mib, 2, &first, &length, &first, sizeof(first)) == -1 && *__error_nid_postfix() == 1);
+    Require(sysctlbyname_nid_postfix("kern.boottime", &first, &length, &first, sizeof(first)) == -1 && *__error_nid_postfix() == 1);
+}
 static void CheckLeafWithTrailingComponent() {
-    const int leaves[][2] = {{6, 3}, {6, 2}, {6, 5}, {6, 7}, {1, 24}, {1, 37}, {1, 50}};
+    const int leaves[][2] = {{6, 3}, {6, 2}, {6, 5}, {6, 7}, {1, 21}, {1, 24}, {1, 37}, {1, 50}};
     for (const auto& leaf : leaves) {
         const int mib[] = {leaf[0], leaf[1], 0};
         char buffer[8] = {};
@@ -432,12 +493,38 @@ static void CheckMeasuredAbsentSysctlMibs() {
         bool threw = false;
         try {
             sysctl_nid_postfix(entry.mib, entry.length, buffer, &length, buffer, sizeof(buffer));
+
         } catch (const std::runtime_error&) {
             threw = true;
         }
         Require(threw);
     }
 }
+static void CheckVersionLimits() {
+    unsigned char first[4];
+    unsigned char second[4];
+    std::memset(first, 0xaa, sizeof(first));
+    std::memset(second, 0xaa, sizeof(second));
+    *__error_nid_postfix() = 13;
+    Require(sceKernelGetSystemExVersion(reinterpret_cast<char*>(first + 1), reinterpret_cast<char*>(second + 1)) == 0 && *__error_nid_postfix() == 13);
+    Require(first[0] == 0xaa && first[1] == 0 && first[2] == 0xaa && second[0] == 0xaa && second[1] == 0 && second[2] == 0xaa);
+    std::memset(first, 0xaa, sizeof(first));
+    Require(sceKernelGetSystemExVersion(reinterpret_cast<char*>(first), nullptr) == 22 && first[0] == 0xaa);
+    Require(sceKernelGetSystemExVersion(nullptr, reinterpret_cast<char*>(first)) == 22 && first[0] == 0xaa);
+    Require(sceKernelGetSystemExVersion(nullptr, nullptr) == 22 && *__error_nid_postfix() == 13);
+
+    std::memset(first, 0xaa, sizeof(first));
+    Require(sysKernelGetLowerLimitSysexVersion_nid_postfix(reinterpret_cast<char*>(first + 1)) == 0);
+    Require(first[0] == 0xaa && first[1] == 0 && first[2] == 0xaa);
+    Require(sysKernelGetLowerLimitSysexVersion_nid_postfix(nullptr) == SCE_KERNEL_ERROR_EINVAL);
+
+    struct {
+        std::uint32_t version;
+        std::uint32_t after;
+    } update{0xaaaaaaaau, 0xaaaaaaaau};
+    Require(sysKernelGetLowerLimitUpdVersion_nid_postfix(&update.version) == 0 && update.version == 0 && update.after == 0xaaaaaaaau);
+    Require(sysKernelGetLowerLimitUpdVersion_nid_postfix(nullptr) == SCE_KERNEL_ERROR_EINVAL && *__error_nid_postfix() == 13);
+}
 static void CheckSystemSwVersion() {
     *__error_nid_postfix() = 13;
     Require(sceKernelGetSystemSwVersion_nid_postfix(nullptr) == SCE_KERNEL_ERROR_EFAULT && *__error_nid_postfix() == 13);
@@ -523,6 +610,7 @@ static void CheckOvercommitSysctl() {
     length = sizeof(value);
     try {
         sysctlbyname_nid_postfix("vm.overcommit", &value, &length, &value, sizeof(value));
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -636,6 +724,27 @@ static void CheckVmmapSysctl() {
     const int tooLong[] = {1, 14, 32, self, 0};
     Require(sysctl_nid_postfix(tooLong, 5, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 22);
 }
+static void CheckEnvSysctl() {
+    const int self = getpid_nid_postfix();
+    const int mib[] = {1, 14, 35, self};
+    *__error_nid_postfix() = 13;
+    std::size_t length = 7;
+    Require(sysctl_nid_postfix(mib, 4, nullptr, &length, nullptr, 0) == 0 && length == 0);
+    unsigned char buffer[16];
+    std::memset(buffer, 0xaa, sizeof(buffer));
+    length = sizeof(buffer);
+    Require(sysctl_nid_postfix(mib, 4, buffer, &length, nullptr, 0) == 0 && length == 0 && buffer[0] == 0xaa);
+    Require(*__error_nid_postfix() == 13);
+    length = sizeof(buffer);
+    Require(sysctl_nid_postfix(mib, 4, buffer, &length, buffer, sizeof(buffer)) == -1 && *__error_nid_postfix() == 1);
+    const int foreign[] = {1, 14, 35, self + 1000};
+    Require(sysctl_nid_postfix(foreign, 4, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 3);
+    const int current[] = {1, 14, 35, -1};
+    Require(sysctl_nid_postfix(current, 4, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 3);
+    Require(sysctl_nid_postfix(mib, 3, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 22);
+    const int tooLong[] = {1, 14, 35, self, 0};
+    Require(sysctl_nid_postfix(tooLong, 5, nullptr, &length, nullptr, 0) == -1 && *__error_nid_postfix() == 22);
+}
 static void CheckPseudoRandomMibSysctl() {
     const int mib[] = {1, 50};
     *__error_nid_postfix() = 13;
@@ -670,6 +779,7 @@ static void CheckPseudoRandomMibSysctl() {
     bool threw = false;
     try {
         sysctl_nid_postfix(mib, 2, &value, &length, &value, sizeof(value));
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -688,6 +798,7 @@ static void CheckNameToMib() {
         {"hw.physmem", {6, 5}, 2},
         {"hw.realmem", {6, 12}, 2},
         {"kern.arandom", {1, 37}, 2},
+        {"kern.boottime", {1, 21}, 2},
         {"kern.rng_pseudo", {1, 50}, 2},
         {"kern.proc.pathname", {1, 14, 12}, 3},
     };
@@ -749,18 +860,18 @@ static void CheckNameToMib() {
     char tooLong[1025];
     std::memset(tooLong, 'a', sizeof(tooLong) - 1);
     tooLong[sizeof(tooLong) - 1] = 0;
-    Require(sysctlnametomib_nid_postfix(tooLong, mib, &size) == -1 && *__error_nid_postfix() == 63);
+    int tooLongMib[4] = {0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::size_t tooLongMibSize = 4;
+    Require(sysctlnametomib_nid_postfix(tooLong, tooLongMib, &tooLongMibSize) == -1 && *__error_nid_postfix() == 63);
+    Require(tooLongMibSize == 4 && tooLongMib[0] == 0x5a5a5a5a && tooLongMib[1] == 0x5a5a5a5a && tooLongMib[2] == 0x5a5a5a5a && tooLongMib[3] == 0x5a5a5a5a);
     tooLong[1023] = 0;
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix(tooLong, tooLongMib, &tooLongMibSize) == -1 && *__error_nid_postfix() == 2 && tooLongMibSize == 4);
+    Require(tooLongMib[0] == 0x5a5a5a5a && tooLongMib[1] == 0x5a5a5a5a && tooLongMib[2] == 0x5a5a5a5a && tooLongMib[3] == 0x5a5a5a5a);
     bool threw = false;
-    try {
-        sysctlnametomib_nid_postfix(tooLong, mib, &size);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
-    threw = false;
     try {
         sysctlnametomib_nid_postfix(nullptr, mib, &size);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
@@ -768,17 +879,13 @@ static void CheckNameToMib() {
     threw = false;
     try {
         sysctlnametomib_nid_postfix("hw.ncpu", mib, nullptr);
+
     } catch (const std::invalid_argument&) {
         threw = true;
     }
     Require(threw);
-    threw = false;
-    try {
-        sysctlnametomib_nid_postfix("kern.cp_times", mib, &size);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
+    *__error_nid_postfix() = 13;
+    Require(sysctlnametomib_nid_postfix("kern.anyps5_no_such_name", mib, &size) == -1 && *__error_nid_postfix() == 2);
 }
 int main() {
     CheckProcessorCountSysctl();
@@ -790,24 +897,28 @@ int main() {
 #endif
     CheckTscFrequencySysctl();
     CheckUnansweredSysctl();
+    CheckUnknownSysctlName();
     CheckPathnameSysctl();
     CheckSystemStringSysctl();
     CheckSystemStringNames();
     CheckOsReleaseDateSysctl();
+    CheckBootTimeSysctl();
     CheckLeafWithTrailingComponent();
     CheckMeasuredAbsentSysctlMibs();
     CheckSystemSwVersion();
+    CheckVersionLimits();
     CheckPseudoRandomSysctl();
     CheckSdkVersionSysctl();
     CheckOvercommitSysctl();
     CheckArandomSysctl();
     CheckVmmapSysctl();
+    CheckEnvSysctl();
     CheckPseudoRandomMibSysctl();
     CheckNameToMib();
     *__error_nid_postfix() = 13;
     Require(sysconf_nid_postfix(1) == 262144);
     Require(sysconf_nid_postfix(3) == 128);
-    GuestRlimitTest nofileLimit{};
+    GuestResourceLimit nofileLimit{};
     Require(getrlimit_nid_postfix(8, &nofileLimit) == 0);
     Require(sysconf_nid_postfix(5) == nofileLimit.rlim_cur);
     Require(sysconf_nid_postfix(47) == 0x4000);
diff --git a/core/libs/tests/GuestSystemExit.cpp b/core/libs/tests/GuestSystemExit.cpp
index 4cf3ad3931..a760b7a5b9 100644
--- a/core/libs/tests/GuestSystemExit.cpp
+++ b/core/libs/tests/GuestSystemExit.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
@@ -22,14 +24,9 @@
 #include <mach-o/dyld.h>
 #include <vector>
 #endif
-extern "C" int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-extern "C" int APS5_VABI __cxa_atexit_nid_postfix(void (APS5_VABI *func)(void*), void* arg, void* dsoHandle);
-extern "C" void APS5_VABI _Exit_nid_postfix(int);
-extern "C" void APS5_VABI exit_nid_postfix(int);
-extern "C" void APS5_VABI catchReturnFromMain_nid_postfix(int);
+
 using GuestQuickExitCallback = void (APS5_VABI*)();
-extern "C" int APS5_VABI at_quick_exit_nid_postfix(GuestQuickExitCallback);
-extern "C" void APS5_VABI quick_exit_nid_postfix(int);
+
 namespace {
 std::atomic<bool> awaiting{false};
 void AwaitExit() {
@@ -70,14 +67,24 @@ void WINAPI UnexpectedDetach(PVOID) { TerminateProcess(GetCurrentProcess(), 4);
 #endif
 constexpr char RelaunchMarker[] = "ANYPS5_TEST_RELAUNCH_MARKER";
 constexpr char MainExecutable[] = "ANYPS5_TEST_MAIN_EXECUTABLE";
-void SetVariable(const char* name, const char* value) {
+void SetVariable(const char* name, const std::filesystem::path& value) {
 #ifdef _WIN32
-    Require(SetEnvironmentVariableA(name, value) != 0);
-    Require(_putenv_s(name, value) == 0);
+    const std::wstring wideName = std::filesystem::path(name).wstring();
+    Require(SetEnvironmentVariableW(wideName.c_str(), value.c_str()) != 0);
+    Require(_wputenv_s(wideName.c_str(), value.c_str()) == 0);
 #else
-    Require(setenv(name, value, 1) == 0);
+    Require(setenv(name, value.c_str(), 1) == 0);
 #endif
 }
+std::filesystem::path PathVariable(const char* name) {
+#ifdef _WIN32
+    const wchar_t* value = _wgetenv(std::filesystem::path(name).wstring().c_str());
+#else
+    const char* value = std::getenv(name);
+#endif
+    Require(value != nullptr);
+    return value;
+}
 std::filesystem::path OwnExecutable() {
 #ifdef _WIN32
     std::wstring executable(32768, L'\0');
@@ -94,9 +101,7 @@ std::filesystem::path OwnExecutable() {
 #endif
 }
 void AppendMarker(const std::string& line) {
-    const char* marker = std::getenv(RelaunchMarker);
-    Require(marker != nullptr);
-    std::ofstream(marker, std::ios::app) << line << '\n';
+    std::ofstream(PathVariable(RelaunchMarker), std::ios::app) << line << '\n';
 }
 void MainShutdown() {
     AppendMarker("shutdown");
@@ -149,7 +154,7 @@ int RunChild(const std::filesystem::path& self, const char* mode) {
 int DriveNestedExit() {
     const auto self = OwnExecutable();
     const auto marker = std::filesystem::temp_directory_path() / ("anyps5-nested-exit-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".txt");
-    SetVariable(RelaunchMarker, marker.string().c_str());
+    SetVariable(RelaunchMarker, marker);
     const int code = RunChild(self, "--nested-exit");
     std::string text;
     {
@@ -166,7 +171,7 @@ int DriveNestedExit() {
 int DriveExitOrder() {
     const auto self = OwnExecutable();
     const auto marker = std::filesystem::temp_directory_path() / ("anyps5-exit-order-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".txt");
-    SetVariable(RelaunchMarker, marker.string().c_str());
+    SetVariable(RelaunchMarker, marker);
     const int code = RunChild(self, "--exit-order");
     std::string text;
     {
@@ -185,8 +190,8 @@ int DriveRelaunch() {
     const auto secondary = self.parent_path() / ("picker.picker.bin" + self.extension().string());
     std::filesystem::copy_file(self, secondary, std::filesystem::copy_options::overwrite_existing);
     const auto marker = std::filesystem::temp_directory_path() / ("anyps5-relaunch-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()) + ".txt");
-    SetVariable(RelaunchMarker, marker.string().c_str());
-    SetVariable(MainExecutable, self.string().c_str());
+    SetVariable(RelaunchMarker, marker);
+    SetVariable(MainExecutable, self);
     Require(RunChild(self, "--relaunch") == 0);
     std::string text;
     for (int attempt = 0; attempt < 200 && text.find("relaunched") == std::string::npos; ++attempt) {
@@ -235,6 +240,7 @@ int main(int argc, char** argv) {
             LibcSetEndFlush_nid_no_patch(ExitFlushAfterDrain);
         }
         _Exit_nid_postfix(7);
+
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--requested-exit-driver") == 0) {
         Require(RunChild(OwnExecutable(), "--requested-exit") == 0);
@@ -248,16 +254,19 @@ int main(int argc, char** argv) {
         Require(slot != FLS_OUT_OF_INDEXES && FlsSetValue(slot, &slot));
 #endif
         _Exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--return-from-main") == 0) {
         catchReturnFromMain_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--quick-exit") == 0) {
         Require(at_quick_exit_nid_postfix(QuickFirst) == 0);
         Require(at_quick_exit_nid_postfix(QuickSecond) == 0);
         quick_exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--nested-exit-driver") == 0) {
@@ -269,6 +278,7 @@ int main(int argc, char** argv) {
         Require(__cxa_atexit_nid_postfix(CheckShutdownStillRunning, nullptr, nullptr) == 0);
         Require(__cxa_atexit_nid_postfix(ExitingHandler, nullptr, nullptr) == 0);
         exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--exit-order-driver") == 0) {
@@ -278,6 +288,7 @@ int main(int argc, char** argv) {
         LibcRegisterShutdown_nid_postfix(GuestExitShutdown);
         Require(__cxa_atexit_nid_postfix(CheckShutdownStillRunning, nullptr, nullptr) == 0);
         exit_nid_postfix(0);
+
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--relaunch-driver") == 0) {
@@ -300,8 +311,7 @@ int main(int argc, char** argv) {
         return 2;
     }
     if (argc > firstArgument && std::strcmp(argv[firstArgument], "--relaunched") == 0) {
-        const char* main = std::getenv(MainExecutable);
-        Require(main != nullptr && std::filesystem::equivalent(OwnExecutable(), main));
+        Require(std::filesystem::equivalent(OwnExecutable(), PathVariable(MainExecutable)));
         AppendMarker("relaunched");
         return 0;
     }
diff --git a/core/libs/tests/GuestSystemFont.cpp b/core/libs/tests/GuestSystemFont.cpp
index f7f07156cf..5195bee16c 100644
--- a/core/libs/tests/GuestSystemFont.cpp
+++ b/core/libs/tests/GuestSystemFont.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceFontFt/include/Api.hpp"
+#include "prx/libSceFont/include/Api.hpp"
 #include "prx/libSceFont/include/FontTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -17,31 +19,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceFontMemoryInit(FontMemory*, void*, std::uint32_t, const FontMemoryInterface*, void*, FontMemoryDestroyFunction, void*);
-int APS5_VABI sceFontCreateLibrary(const FontMemory*, const void*, FontLibrary*);
-int APS5_VABI sceFontDestroyLibrary(FontLibrary*);
-int APS5_VABI sceFontSupportSystemFonts(FontLibrary);
-int APS5_VABI sceFontSupportExternalFonts(FontLibrary, std::uint32_t, std::uint32_t);
-int APS5_VABI sceFontOpenFontSet(FontLibrary, std::uint32_t, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontMemory(FontLibrary, const void*, std::uint32_t, const FontOpenDetail*, FontHandle*);
-int APS5_VABI sceFontOpenFontInstance(FontHandle, FontHandle, FontHandle*);
-int APS5_VABI sceFontCloseFont(FontHandle);
-int APS5_VABI sceFontSetScalePixel(FontHandle, float, float);
-int APS5_VABI sceFontGetCharGlyphMetrics(FontHandle, std::uint32_t, FontGlyphMetrics*);
-int APS5_VABI sceFontGetHorizontalLayout(FontHandle, FontHorizontalLayout*);
-int APS5_VABI sceFontGetKerning(FontHandle, std::uint32_t, std::uint32_t, FontKerning*);
-int APS5_VABI sceFontCreateRenderer(const FontMemory*, const void*, FontRenderer*);
-int APS5_VABI sceFontDestroyRenderer(FontRenderer*);
-int APS5_VABI sceFontBindRenderer(FontHandle, FontRenderer);
-int APS5_VABI sceFontUnbindRenderer(FontHandle);
-int APS5_VABI sceFontSetupRenderScalePixel(FontHandle, float, float);
-void APS5_VABI sceFontRenderSurfaceInit(FontRenderSurface*, void*, int, int, int, int);
-int APS5_VABI sceFontRenderCharGlyphImageHorizontal(FontHandle, std::uint32_t, FontRenderSurface*, float, float, FontGlyphMetrics*, FontRenderOutput*);
-const void* APS5_VABI sceFontSelectLibraryFt(int);
-const void* APS5_VABI sceFontSelectRendererFt(int);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "System font check failed at line %d\n", line);
@@ -127,9 +104,9 @@ static void WriteFile(const std::filesystem::path& path, const std::vector<unsig
 
 static void SetFontDirectory(const std::filesystem::path& directory) {
 #ifdef _WIN32
-    Require(_putenv_s("ANYPS5_SYSTEM_FONTS", directory.string().c_str()) == 0);
+    Require(_wputenv_s(L"ANYPS5_SYSTEM_FONTS", directory.wstring().c_str()) == 0);
 #else
-    Require(::setenv("ANYPS5_SYSTEM_FONTS", directory.string().c_str(), 1) == 0);
+    Require(::setenv("ANYPS5_SYSTEM_FONTS", directory.c_str(), 1) == 0);
 #endif
 }
 
@@ -187,6 +164,7 @@ static int RenderedPixels(FontHandle font, std::uint32_t code, float& advance) {
     std::vector<std::uint8_t> pixels(128 * 128);
     FontRenderSurface surface{};
     sceFontRenderSurfaceInit(&surface, pixels.data(), 128, 1, 128, 128);
+
     FontGlyphMetrics metrics{};
     FontRenderOutput result{};
     const int rc = sceFontRenderCharGlyphImageHorizontal(font, code, &surface, 10.0f, 100.0f, &metrics, &result);
@@ -208,7 +186,7 @@ int main() {
     const std::filesystem::path root = std::filesystem::temp_directory_path() / ("anyps5_guest_system_font-" + std::to_string(std::random_device{}()));
     std::filesystem::remove_all(root);
     const std::filesystem::path empty = root / "empty";
-    const std::filesystem::path fonts = root / "fonts";
+    const std::filesystem::path fonts = root / std::filesystem::path(u8"fonts-a\u00e7\u00e3o-\u65e5\u672c");
     std::filesystem::create_directories(empty);
     std::filesystem::create_directories(fonts);
     WriteFile(fonts / "SST-Bold.otf", SquareGlyphFont('A', 700));
@@ -239,6 +217,7 @@ int main() {
     bool threw = false;
     try {
         sceFontOpenFontSet(library, EuropeanBold, 1, nullptr, &font);
+
     } catch (const std::runtime_error&) {
         threw = true;
     }
@@ -338,6 +317,29 @@ int main() {
     Require(RenderedPixels(mixed, 0x4E00, advance) > 0 && advance == 63.0f);
     Require(RenderedPixels(mixed, 0x0627, advance) > 0 && advance == 66.0f);
     Require(RenderedPixels(mixed, 0xAC00, advance) == SCE_FONT_ERROR_NO_SUPPORT_GLYPH);
+    std::vector<std::uint8_t> untouched(128 * 128);
+    FontRenderSurface measuring{};
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 0, 1, 0, 31);
+
+    FontGlyphMetrics measured{};
+    FontRenderOutput measuredResult{};
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_OK);
+    Require(measured.Horizontal.advance == 60.0f && measured.width > 0.0f && measuredResult.ImageMetrics.advance > 0.0f);
+    Require(measuredResult.UpdateRect.w == 0 && measuredResult.UpdateRect.h == 0);
+    for (const std::uint8_t pixel : untouched) Require(pixel == 0);
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 128, 1, 128, 0);
+
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_OK && measured.Horizontal.advance == 60.0f);
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 128, 1, 128, 128);
+
+    measuring.width = -1;
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_ERROR_NO_SUPPORT_SURFACE);
+    sceFontRenderSurfaceInit(&measuring, untouched.data(), 0, 1, 128, 128);
+
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_ERROR_NO_SUPPORT_SURFACE);
+    sceFontRenderSurfaceInit(&measuring, nullptr, 0, 1, 0, 31);
+
+    Require(sceFontRenderCharGlyphImageHorizontal(mixed, 'A', &measuring, 10.0f, 100.0f, &measured, &measuredResult) == SCE_FONT_ERROR_NO_SUPPORT_SURFACE);
     Require(sceFontUnbindRenderer(mixed) == SCE_FONT_OK);
     Require(sceFontDestroyRenderer(&renderer) == SCE_FONT_OK);
 
diff --git a/core/libs/tests/GuestSystemGesture.cpp b/core/libs/tests/GuestSystemGesture.cpp
index 656f943aca..23970e8b82 100644
--- a/core/libs/tests/GuestSystemGesture.cpp
+++ b/core/libs/tests/GuestSystemGesture.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemGesture/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -9,30 +10,6 @@
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceSystemGestureClose(std::int32_t);
-std::int32_t APS5_VABI sceSystemGestureOpen(std::int32_t, const void*);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEvents(std::int32_t, void*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEventsCount(std::int32_t);
-int APS5_VABI sceSystemGestureGetTouchEvents(std::int32_t, const void*, void*, std::uint32_t, std::uint32_t*);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByIndex(std::int32_t, std::uint32_t, void*);
-int APS5_VABI sceSystemGestureGetTouchEventByIndex(std::int32_t, const void*, std::uint32_t, void*);
-int APS5_VABI sceSystemGestureGetTouchEventByEventID(std::int32_t, const void*, std::uint32_t, void*);
-int APS5_VABI sceSystemGestureAppendTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureCreateTouchRecognizer(std::int32_t, void*, std::int32_t, const void*, const void*);
-int APS5_VABI sceSystemGestureGetTouchRecognizerInformation(std::int32_t, const void*, void*);
-int APS5_VABI sceSystemGestureRemoveTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureResetTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureUpdateTouchRecognizer(std::int32_t, void*);
-int APS5_VABI sceSystemGestureUpdateTouchRecognizerRectangle(std::int32_t, void*, const void*);
-int APS5_VABI sceSystemGestureResetPrimitiveTouchRecognizer(std::int32_t);
-int APS5_VABI sceSystemGestureUpdateAllTouchRecognizer(std::int32_t);
-int APS5_VABI sceSystemGestureUpdatePrimitiveTouchRecognizer(std::int32_t, const SystemGestureTouchPadData*);
-int APS5_VABI sceSystemGestureInitializePrimitiveTouchRecognizer();
-int APS5_VABI sceSystemGestureFinalizePrimitiveTouchRecognizer(void);
-int APS5_VABI sceSystemGestureGetPrimitiveTouchEventByPrimitiveID(std::int32_t, std::uint16_t, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool SameRectangle(const SystemGestureRectangle& left, const SystemGestureRectangle& right) {
@@ -228,13 +205,13 @@ int main() {
     buffer.fill(0x5a);
     const auto original = buffer;
     std::uint32_t count = 7;
-    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, buffer.data(), 4, &count) == 0);
+    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data()), 4, &count) == 0);
     Require(count == 0);
     Require(buffer == original);
 
     count = 7;
-    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, buffer.data(), 4, nullptr) == invalidArgument);
-    Require(sceSystemGestureGetPrimitiveTouchEvents(handle + 1, buffer.data(), 4, &count) == invalidHandle);
+    Require(sceSystemGestureGetPrimitiveTouchEvents(handle, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data()), 4, nullptr) == invalidArgument);
+    Require(sceSystemGestureGetPrimitiveTouchEvents(handle + 1, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data()), 4, &count) == invalidHandle);
     Require(count == 7);
 
     Require(sceSystemGestureGetPrimitiveTouchEventsCount(handle) == 0);
@@ -244,17 +221,17 @@ int main() {
     SystemGestureTouchRecognizer recognizer{};
     SystemGestureRectangle rectangle{};
     count = 7;
-    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, buffer.data(), 4, &count) == 0 && count == 0);
-    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, buffer.data(), 4, nullptr) == invalidArgument);
-    Require(sceSystemGestureGetTouchEvents(handle + 1, &recognizer, buffer.data(), 4, &count) == invalidHandle);
-    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle, 0, buffer.data()) == indexOutOfArray);
-    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle + 1, 0, buffer.data()) == invalidHandle);
-    Require(sceSystemGestureGetTouchEventByIndex(handle, &recognizer, 0, buffer.data()) == indexOutOfArray);
-    Require(sceSystemGestureGetTouchEventByIndex(handle + 1, &recognizer, 0, buffer.data()) == invalidHandle);
-    Require(sceSystemGestureGetTouchEventByIndex(handle, nullptr, 0, buffer.data()) == invalidArgument);
-    Require(sceSystemGestureGetTouchEventByEventID(handle, &recognizer, 0, buffer.data()) == indexOutOfArray);
-    Require(sceSystemGestureGetTouchEventByEventID(handle + 1, &recognizer, 0, buffer.data()) == invalidHandle);
-    Require(sceSystemGestureGetTouchEventByEventID(handle, nullptr, 0, buffer.data()) == invalidArgument);
+    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data()), 4, &count) == 0 && count == 0);
+    Require(sceSystemGestureGetTouchEvents(handle, &recognizer, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data()), 4, nullptr) == invalidArgument);
+    Require(sceSystemGestureGetTouchEvents(handle + 1, &recognizer, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data()), 4, &count) == invalidHandle);
+    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle, 0, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data())) == indexOutOfArray);
+    Require(sceSystemGestureGetPrimitiveTouchEventByIndex(handle + 1, 0, reinterpret_cast<SystemGesturePrimitiveTouchEvent*>(buffer.data())) == invalidHandle);
+    Require(sceSystemGestureGetTouchEventByIndex(handle, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == indexOutOfArray);
+    Require(sceSystemGestureGetTouchEventByIndex(handle + 1, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidHandle);
+    Require(sceSystemGestureGetTouchEventByIndex(handle, nullptr, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidArgument);
+    Require(sceSystemGestureGetTouchEventByEventID(handle, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == indexOutOfArray);
+    Require(sceSystemGestureGetTouchEventByEventID(handle + 1, &recognizer, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidHandle);
+    Require(sceSystemGestureGetTouchEventByEventID(handle, nullptr, 0, reinterpret_cast<SystemGestureTouchEvent*>(buffer.data())) == invalidArgument);
     Require(buffer == original);
 
     Require(sceSystemGestureAppendTouchRecognizer(handle, &recognizer) == 0);
@@ -280,6 +257,7 @@ int main() {
     Require(sceSystemGestureUpdateAllTouchRecognizer(handle + 1) == invalidHandle);
     Require(sceSystemGestureUpdatePrimitiveTouchRecognizer(handle + 1, nullptr) == invalidArgument);
 
+    Require(sceSystemGestureDebugGetVersion() == 0x6a00);
     TestTouchRecognizerInformation(handle, invalidArgument, invalidHandle);
     TestPrimitiveTouchEvents(handle, invalidArgument, invalidHandle, indexOutOfArray);
     std::array<std::int32_t, 7> otherHandles{};
diff --git a/core/libs/tests/GuestSystemKillApp.cpp b/core/libs/tests/GuestSystemKillApp.cpp
index 3ebfe28013..b42f9d8de6 100644
--- a/core/libs/tests/GuestSystemKillApp.cpp
+++ b/core/libs/tests/GuestSystemKillApp.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include <cstdio>
@@ -5,10 +6,7 @@
 #include <cstring>
 #include <initializer_list>
 #include <stdexcept>
-extern "C" int APS5_VABI sceSystemServiceGetAppIdOfRunningBigApp(void);
-extern "C" int APS5_VABI sceSystemServiceKillApp(int, int, int, int);
-extern "C" int APS5_VABI sceLncUtilKillApp(unsigned);
-extern "C" int APS5_VABI sceLncUtilKillAppWithReason(unsigned, int);
+
 namespace {
 bool cleaned = false;
 bool finished = false;
diff --git a/core/libs/tests/GuestSystemService.cpp b/core/libs/tests/GuestSystemService.cpp
index 9ad6c43d4c..8a197d97b5 100644
--- a/core/libs/tests/GuestSystemService.cpp
+++ b/core/libs/tests/GuestSystemService.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include <cstddef>
@@ -7,12 +8,6 @@
 #include <initializer_list>
 #include <stdexcept>
 
-extern "C" int APS5_VABI sceSystemServiceGetHdrToneMapLuminance(SystemServiceHdrToneMapLuminance* luminance);
-extern "C" int APS5_VABI sceSystemServiceParamGetString(int paramId, char* buf, std::size_t bufSize);
-extern "C" int APS5_VABI sceSystemServiceLaunchApp(const char* titleId, const char* const* arguments, const void* param);
-extern "C" int APS5_VABI sceSystemServiceAddLocalProcessForPsmKit(const char* path, const char* const* arguments, const void* param);
-extern "C" int APS5_VABI sceSystemServiceKillLocalProcessForPsmKit(int handle);
-
 namespace {
 
 constexpr int browserUnavailable = static_cast<int>(0x8002002Du);
@@ -40,27 +35,6 @@ bool LaunchAppThrows(const char* titleId, const char* const* arguments, const vo
 
 }
 
-extern "C" int APS5_VABI sceSystemServicePowerTick(void);
-extern "C" int APS5_VABI sceSystemServiceIsBgmPlaying(void);
-extern "C" int APS5_VABI sceShellCoreUtilIsBgmPlaying(void);
-extern "C" int APS5_VABI sceSystemServiceReportAbnormalTermination(const void* info);
-extern "C" int APS5_VABI sceSystemServiceDisableMusicPlayer(void);
-extern "C" int APS5_VABI sceSystemServiceReenableMusicPlayer(void);
-extern "C" int APS5_VABI sceSystemServiceDisableMediaPlay(void);
-extern "C" int APS5_VABI sceSystemServiceReenableMediaPlay(void);
-extern "C" int APS5_VABI sceSystemServiceLaunchWebBrowser(const char* uri);
-extern "C" int APS5_VABI sceSystemServiceShowControllerSettings(void);
-extern "C" int APS5_VABI sceSystemServiceShowDisplaySafeAreaSettings(void);
-extern "C" int APS5_VABI sceSystemServiceOpenChallengeActivity(void);
-extern "C" int APS5_VABI sceSystemServiceGetStatus(SystemServiceStatus* status);
-extern "C" int APS5_VABI sceSystemServiceGetDisplaySafeAreaInfo(SystemServiceDisplaySafeAreaInfo* info);
-extern "C" int APS5_VABI sceSystemServiceGetNoticeScreenSkipFlag(bool* value);
-extern "C" int APS5_VABI sceSystemServiceSetNoticeScreenSkipFlag(void);
-extern "C" int APS5_VABI sceSystemServiceDisableNoticeScreenSkipFlagAutoSet(void);
-extern "C" int APS5_VABI sceSystemServiceHideSplashScreen(void);
-extern "C" int APS5_VABI sceSystemServiceReceiveEvent(SystemServiceEvent* event);
-extern "C" void APS5_VABI sceSystemServiceInitializePlayerDialogParam(SystemServicePlayerDialogParam* param);
-
 namespace {
 
 void TestPlayerDialogParam() {
diff --git a/core/libs/tests/GuestSystemServiceAppTitleId.cpp b/core/libs/tests/GuestSystemServiceAppTitleId.cpp
new file mode 100644
index 0000000000..7fee52ec8e
--- /dev/null
+++ b/core/libs/tests/GuestSystemServiceAppTitleId.cpp
@@ -0,0 +1,132 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
+#include "SceTypes.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <limits>
+#include <string_view>
+
+namespace {
+
+constexpr char Sentinel = 0x5A;
+
+struct GuardedBuffer {
+    char bytes[10 + 6];
+    GuardedBuffer() { std::memset(bytes, Sentinel, sizeof(bytes)); }
+    bool Untouched() const {
+        for (const char byte : bytes) {
+            if (byte != Sentinel) return false;
+        }
+        return true;
+    }
+    bool GuardIntact() const {
+        for (std::size_t index = 10; index < sizeof(bytes); ++index) {
+            if (bytes[index] != Sentinel) return false;
+        }
+        return true;
+    }
+};
+
+void Require(bool value) { if (!value) std::abort(); }
+
+template<typename TCall>
+bool Throws(TCall call) {
+    try {
+        call();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+bool GetAppIdThrows(const char* titleId) {
+    return Throws([&] { static_cast<void>(sceSystemServiceGetAppId(titleId)); });
+}
+
+bool GetAppTitleIdThrows(int appId, GuardedBuffer& buffer) {
+    return Throws([&] { static_cast<void>(sceSystemServiceGetAppTitleId(appId, buffer.bytes)); }) && buffer.Untouched();
+}
+
+bool LncGetAppTitleIdThrows(std::uint32_t appId, GuardedBuffer& buffer) {
+    return Throws([&] { static_cast<void>(sceLncUtilGetAppTitleId(static_cast<std::int32_t>(appId), buffer.bytes)); }) && buffer.Untouched();
+}
+
+void CheckOtherApplications(int runningAppId) {
+    const int otherAppIds[] = {runningAppId + 1, runningAppId - 1, 0, -1, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()};
+    for (const int appId : otherAppIds) {
+        GuardedBuffer buffer;
+        Require(GetAppTitleIdThrows(appId, buffer));
+        Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(appId), buffer));
+    }
+    GuardedBuffer buffer;
+    Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(runningAppId) | 0x80000000u, buffer));
+    Require(LncGetAppTitleIdThrows(std::numeric_limits<std::uint32_t>::max(), buffer));
+}
+
+void CheckNullBuffers(int runningAppId) {
+    Require(Throws([&] { static_cast<void>(sceSystemServiceGetAppTitleId(runningAppId, nullptr)); }));
+    Require(Throws([&] { static_cast<void>(sceLncUtilGetAppTitleId(runningAppId, nullptr)); }));
+    Require(Throws([&] { static_cast<void>(sceSystemServiceGetAppTitleId(runningAppId + 1, nullptr)); }));
+    Require(GetAppIdThrows(nullptr));
+}
+
+void CheckKnownTitle(int runningAppId) {
+    constexpr std::string_view titleId = "PPSA00000";
+    Require(runningAppId >= 0);
+    Require(sceSystemServiceGetAppId("PPSA00000") == runningAppId);
+    Require(sceSystemServiceGetAppId("PPSA00000") == runningAppId);
+    const char* const otherTitles[] = {"PPSA00001", "PPSA00010", "ppsa00000", "PPSA0000", "PPSA000000", "PPSA00000 ", " PPSA00000", "CUSA00000", ""};
+    for (const char* other : otherTitles) {
+        Require(GetAppIdThrows(other));
+    }
+
+    GuardedBuffer buffer;
+    Require(sceSystemServiceGetAppTitleId(runningAppId, buffer.bytes) == 0);
+    Require(std::memcmp(buffer.bytes, "PPSA00000", titleId.size() + 1) == 0);
+    Require(buffer.GuardIntact());
+    Require(sceSystemServiceGetAppId(buffer.bytes) == runningAppId);
+
+    GuardedBuffer lncBuffer;
+    Require(sceLncUtilGetAppTitleId(runningAppId, lncBuffer.bytes) == 0);
+    Require(std::memcmp(lncBuffer.bytes, "PPSA00000", titleId.size() + 1) == 0);
+    Require(lncBuffer.GuardIntact());
+
+    GuardedBuffer dirty;
+    std::memset(dirty.bytes, 'x', 10);
+    Require(sceSystemServiceGetAppTitleId(runningAppId, dirty.bytes) == 0);
+    Require(std::strcmp(dirty.bytes, "PPSA00000") == 0 && dirty.GuardIntact());
+
+    CheckOtherApplications(runningAppId);
+    CheckNullBuffers(runningAppId);
+}
+
+void CheckLongTitle(int runningAppId) {
+    Require(sceSystemServiceGetAppId("PPSA000000") == runningAppId);
+    Require(GetAppIdThrows("PPSA00000"));
+    Require(GetAppIdThrows("PPSA0000000"));
+    GuardedBuffer buffer;
+    Require(GetAppTitleIdThrows(runningAppId, buffer));
+    Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(runningAppId), buffer));
+}
+
+void CheckMissingMetadata(int runningAppId) {
+    Require(GetAppIdThrows("PPSA00000"));
+    Require(GetAppIdThrows(nullptr));
+    GuardedBuffer buffer;
+    Require(GetAppTitleIdThrows(runningAppId, buffer));
+    Require(LncGetAppTitleIdThrows(static_cast<std::uint32_t>(runningAppId), buffer));
+}
+
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 2);
+    const std::string_view mode = argv[1];
+    const int runningAppId = sceSystemServiceGetAppIdOfRunningBigApp();
+    if (mode == "known") CheckKnownTitle(runningAppId);
+    else if (mode == "long") CheckLongTitle(runningAppId);
+    else if (mode == "missing") CheckMissingMetadata(runningAppId);
+    else Require(false);
+}
diff --git a/core/libs/tests/GuestSystemServiceLanguage.cpp b/core/libs/tests/GuestSystemServiceLanguage.cpp
index cf65b0d3c8..8e1aefdf3a 100644
--- a/core/libs/tests/GuestSystemServiceLanguage.cpp
+++ b/core/libs/tests/GuestSystemServiceLanguage.cpp
@@ -1,11 +1,11 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include <cstdlib>
 #include <limits>
 #include <stdexcept>
 #include <string>
-
-extern "C" int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value);
+#include <utility>
 
 namespace {
 
@@ -38,6 +38,11 @@ bool ParameterRejected(int paramId) {
     return false;
 }
 
+bool Answers(int paramId) {
+    return (paramId >= 1 && paramId <= 5) || (paramId >= SYSTEM_SERVICE_PARAM_ID_100 && paramId <= 111) || (paramId >= 200 && paramId <= 213) ||
+        paramId == 300 || paramId == SYSTEM_SERVICE_PARAM_ID_400;
+}
+
 bool Rejected(const char* value) {
     SetLanguage(value);
     return ParameterRejected(SYSTEM_SERVICE_PARAM_ID_LANG) && ParameterRejected(SYSTEM_SERVICE_PARAM_ID_400);
@@ -46,21 +51,11 @@ bool Rejected(const char* value) {
 }
 
 int main() {
-    for (int paramId = -1; paramId <= 1001; ++paramId) {
+    for (int paramId = -1; paramId <= 2048; ++paramId) {
         Require(sceSystemServiceParamGetInt(paramId, nullptr) == SYSTEM_SERVICE_ERROR_PARAMETER);
-        if ((paramId >= 1 && paramId <= 5) || paramId == 7 || paramId == 400 || paramId == 1000) continue;
+        if (Answers(paramId)) continue;
         int value = -12345;
-        if ((paramId >= 100 && paramId <= 111) || (paramId >= 200 && paramId <= 213) || paramId == 300) {
-            bool threw = false;
-            try {
-                static_cast<void>(sceSystemServiceParamGetInt(paramId, &value));
-            } catch (const std::runtime_error&) {
-                threw = true;
-            }
-            Require(threw);
-        } else {
-            Require(sceSystemServiceParamGetInt(paramId, &value) == SYSTEM_SERVICE_ERROR_PARAMETER);
-        }
+        Require(sceSystemServiceParamGetInt(paramId, &value) == SYSTEM_SERVICE_ERROR_PARAMETER);
         Require(value == -12345);
     }
     for (int paramId : {std::numeric_limits<int>::min(), std::numeric_limits<int>::max()}) {
@@ -85,7 +80,23 @@ int main() {
     SetLanguage("arabic");
     Require(sceSystemServiceParamGetInt(SYSTEM_SERVICE_PARAM_ID_LANG, nullptr) == SYSTEM_SERVICE_ERROR_PARAMETER);
     Require(sceSystemServiceParamGetInt(SYSTEM_SERVICE_PARAM_ID_400, nullptr) == SYSTEM_SERVICE_ERROR_PARAMETER);
-    int enterButton = -1;
-    Require(sceSystemServiceParamGetInt(SYSTEM_SERVICE_PARAM_ID_ENTER_BUTTON_ASSIGN, &enterButton) == SYSTEM_SERVICE_OK);
-    Require(enterButton == SYSTEM_SERVICE_PARAM_ENTER_BUTTON_CROSS);
+    for (int paramId : {0, SYSTEM_SERVICE_PARAM_ID_SYSTEM_NAME, SYSTEM_SERVICE_PARAM_ID_GAME_PARENTAL_LEVEL, 8, 20, 401, 999,
+                        SYSTEM_SERVICE_PARAM_ID_ENTER_BUTTON_ASSIGN, 1001, 1008}) {
+        int unknown = -1;
+        Require(sceSystemServiceParamGetInt(paramId, &unknown) == SYSTEM_SERVICE_ERROR_PARAMETER);
+        Require(unknown == -1);
+        Require(sceSystemServiceParamGetInt(paramId, nullptr) == SYSTEM_SERVICE_ERROR_PARAMETER);
+    }
+    constexpr std::pair<int, int> measured[] = {
+        {100, 0}, {101, 1}, {102, 2}, {103, 100}, {104, 0x20202}, {105, 0}, {106, 0}, {107, 100}, {108, 0}, {109, 100}, {110, 0x20202},
+        {111, 0}, {200, 0}, {201, 0}, {202, 0}, {203, 0}, {204, 0}, {205, 0}, {206, 0}, {207, 0}, {208, 0}, {209, 1}, {210, 71},
+        {211, 0}, {212, 0}, {213, 0}, {300, 0},
+    };
+    for (const auto& [paramId, expected] : measured) {
+        Require(Answers(paramId));
+        int value = -1;
+        Require(sceSystemServiceParamGetInt(paramId, &value) == SYSTEM_SERVICE_OK);
+        Require(value == expected);
+        Require(sceSystemServiceParamGetInt(paramId, nullptr) == SYSTEM_SERVICE_ERROR_PARAMETER);
+    }
 }
diff --git a/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp b/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
index ec83ac1c10..777c63ba32 100644
--- a/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
+++ b/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdio>
 #include <cstdlib>
@@ -6,11 +8,6 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-extern "C" {
-int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-int APS5_VABI dup2_nid_postfix(int, int);
-}
-
 namespace {
 
 constexpr const char* Marker = "APS5_LOAD_EXEC_STANDARD_ERROR";
diff --git a/core/libs/tests/GuestSystemServicePathBoundary.cpp b/core/libs/tests/GuestSystemServicePathBoundary.cpp
index da8e6927f0..8d80cb489a 100644
--- a/core/libs/tests/GuestSystemServicePathBoundary.cpp
+++ b/core/libs/tests/GuestSystemServicePathBoundary.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
@@ -8,8 +9,6 @@
 #include <stdexcept>
 #include <windows.h>
 
-extern "C" int APS5_VABI sceSystemServiceLoadExec(const char*, const char* const*);
-
 namespace {
 
 void Require(bool value) {
diff --git a/core/libs/tests/GuestSystemServiceTimeZone.cpp b/core/libs/tests/GuestSystemServiceTimeZone.cpp
index 7f61bcf1fe..cb0e4c65c8 100644
--- a/core/libs/tests/GuestSystemServiceTimeZone.cpp
+++ b/core/libs/tests/GuestSystemServiceTimeZone.cpp
@@ -1,10 +1,9 @@
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libSceSystemService/SystemService.hpp"
 #include <cstdlib>
 #include <ctime>
 
-extern "C" int APS5_VABI sceSystemServiceParamGetInt(int paramId, int* value);
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestTcp.cpp b/core/libs/tests/GuestTcp.cpp
index 332b9ebede..71878e7021 100644
--- a/core/libs/tests/GuestTcp.cpp
+++ b/core/libs/tests/GuestTcp.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -8,24 +10,6 @@
 #include <cstring>
 #include <thread>
 
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI listen_nid_postfix(int, int);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI accept_nid_postfix(int, void*, std::uint32_t*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI shutdown_nid_postfix(int, int);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition) {
     if (!condition) std::abort();
 }
@@ -277,11 +261,9 @@ int main() {
     Require(send_nid_postfix(client, request, sizeof(request), 0x20000) == -1 && *__error_nid_postfix() == 32);
 
     Require(close_nid_postfix(accepted) == 0);
-#ifndef _WIN32
     std::int64_t sent = 0;
     for (int i = 0; i < 100 && sent >= 0; ++i) sent = send_nid_postfix(client, request, sizeof(request), 0x20000);
     Require(sent == -1 && *__error_nid_postfix() == 32);
-#endif
     Require(close_nid_postfix(client) == 0);
     Require(close_nid_postfix(listener) == 0);
     Require(close_nid_postfix(listener) == -1 && *__error_nid_postfix() == 9);
diff --git a/core/libs/tests/GuestTerminal.cpp b/core/libs/tests/GuestTerminal.cpp
index ad27b96a30..8fabd1454f 100644
--- a/core/libs/tests/GuestTerminal.cpp
+++ b/core/libs/tests/GuestTerminal.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -8,24 +10,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI tcgetattr_nid_postfix(int, void*);
-int APS5_VABI tcsetattr_nid_postfix(int, int, const void*);
-int APS5_VABI tcsendbreak_nid_postfix(int, int);
-int APS5_VABI tcdrain_nid_postfix(int);
-int APS5_VABI tcflush_nid_postfix(int, int);
-int APS5_VABI tcflow_nid_postfix(int, int);
-int APS5_VABI tcgetpgrp_nid_postfix(int);
-int APS5_VABI tcsetpgrp_nid_postfix(int, int);
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI pipe_nid_postfix(int*);
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI socketpair_nid_postfix(int, int, int, int*);
-int APS5_VABI mkdir_nid_postfix(const char*, unsigned short);
-int APS5_VABI close_nid_postfix(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "terminal check failed at line %d, errno %d\n", line, *__error_nid_postfix());
diff --git a/core/libs/tests/GuestTermiosSpeed.cpp b/core/libs/tests/GuestTermiosSpeed.cpp
index cc0a4c76b4..1ad51b5903 100644
--- a/core/libs/tests/GuestTermiosSpeed.cpp
+++ b/core/libs/tests/GuestTermiosSpeed.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstddef>
@@ -14,8 +15,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 using SetSpeed = int (APS5_VABI*)(void*, std::uint32_t);
diff --git a/core/libs/tests/GuestTextToSpeech2.cpp b/core/libs/tests/GuestTextToSpeech2.cpp
index 93de9dc755..13cab7e16c 100644
--- a/core/libs/tests/GuestTextToSpeech2.cpp
+++ b/core/libs/tests/GuestTextToSpeech2.cpp
@@ -1,24 +1,14 @@
+#include "prx/libSceTextToSpeech2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 
-extern "C" {
-std::int32_t APS5_VABI sceTextToSpeech2Initialize(const void* param);
-int APS5_VABI sceTextToSpeech2Open(const void* parameter);
-int APS5_VABI sceTextToSpeech2Cancel();
-int APS5_VABI sceTextToSpeech2Close();
-int APS5_VABI sceTextToSpeech2GetSpeechStatus(std::int32_t* status);
-int APS5_VABI sceTextToSpeech2Speak(const void* parameter);
-int APS5_VABI sceTextToSpeech2Terminate();
-int APS5_VABI sceTextToSpeech2GetSystemStatus(std::int32_t* status);
-}
-
 int main() {
     constexpr std::int32_t unsupported = static_cast<std::int32_t>(0x8002002D);
     const std::uint32_t param[16]{0x2000000, 0x26c};
-    if (sceTextToSpeech2Initialize(param) != unsupported) {
+    if (sceTextToSpeech2Initialize(reinterpret_cast<const TextToSpeechInitParameter*>(param)) != unsupported) {
         std::puts("TextToSpeech2: initialization did not report the unsupported operation");
         std::abort();
     }
diff --git a/core/libs/tests/GuestThermalSensors.cpp b/core/libs/tests/GuestThermalSensors.cpp
index 3c051911a6..2fcdb8a5a7 100644
--- a/core/libs/tests/GuestThermalSensors.cpp
+++ b/core/libs/tests/GuestThermalSensors.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <algorithm>
@@ -11,9 +12,7 @@
 
 extern "C" {
 void ReadThermalSensors_nid_no_patch(const char* root, int celsius[3]);
-int APS5_VABI sceKernelGetCpuTemperature(int* outCelsius);
-int APS5_VABI sceKernelGetSocSensorTemperature(int sensorId, int* outCelsius);
-int APS5_VABI sceKernelGetSocPowerConsumption(void* consumption);
+
 }
 
 static void Require(bool value) {
diff --git a/core/libs/tests/GuestThreadAtexit.cpp b/core/libs/tests/GuestThreadAtexit.cpp
index f37fd5d526..ebcfc1eeeb 100644
--- a/core/libs/tests/GuestThreadAtexit.cpp
+++ b/core/libs/tests/GuestThreadAtexit.cpp
@@ -1,17 +1,11 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI _sceLibcInternalThreadAtexit_nid_postfix(void (APS5_VABI* destructor)(void*), void* object, void* dsoSymbol);
-void APS5_VABI _sceLibcInternalThreadDtors_nid_postfix();
-}
-
 namespace {
 
 using Destructor = void (APS5_VABI*)(void*);
@@ -47,6 +41,7 @@ void* APS5_VABI Worker(void*) {
 bool DestructorsThrow() {
     try {
         _sceLibcInternalThreadDtors_nid_postfix();
+
     } catch (const std::runtime_error&) {
         return true;
     }
@@ -61,9 +56,11 @@ int main() {
     Require(Register(RecordAndRegister, 2) == 0);
     Require(Register(Record, 3) == 0);
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls == std::vector<std::intptr_t>{3, 2, 9, 1});
     Require(callers == std::vector<Pthread>(4, mainThread));
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls.size() == 4);
 
     calls.clear();
@@ -83,5 +80,6 @@ int main() {
     Require(DestructorsThrow());
     Require(calls.empty());
     _sceLibcInternalThreadDtors_nid_postfix();
+
     Require(calls == std::vector<std::intptr_t>{6});
 }
diff --git a/core/libs/tests/GuestThreadCallbackAbi.cpp b/core/libs/tests/GuestThreadCallbackAbi.cpp
index 4fe7aa04ca..a5e6abb9f6 100644
--- a/core/libs/tests/GuestThreadCallbackAbi.cpp
+++ b/core/libs/tests/GuestThreadCallbackAbi.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
@@ -12,12 +13,6 @@
 
 using GuestDestructor = void(APS5_VABI *)(void*);
 
-extern "C" {
-int APS5_VABI __cxa_thread_atexit_impl_nid_postfix(GuestDestructor, void*, void*);
-int APS5_VABI __cxa_thread_atexit_nid_postfix(GuestDestructor, void*, void*);
-int APS5_VABI LibcInternalExtCxaThreadAtexit_nid_postfix(GuestDestructor, void*, void*);
-}
-
 namespace {
 
 struct Call {
diff --git a/core/libs/tests/GuestThreadCpuClock.cpp b/core/libs/tests/GuestThreadCpuClock.cpp
index 15946c4aec..5d5aabcff7 100644
--- a/core/libs/tests/GuestThreadCpuClock.cpp
+++ b/core/libs/tests/GuestThreadCpuClock.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -5,20 +9,8 @@
 #include <cstdlib>
 #include <thread>
 
-extern "C" {
-int APS5_VABI pthread_getcpuclockid_nid_postfix(Pthread thread, int* clockId);
-Pthread APS5_VABI pthread_self_nid_postfix(void);
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-int APS5_VABI clock_getres_nid_postfix(int clockId, KernelTimespec* res);
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI sceKernelClockGettime(KernelClockid clockId, KernelTimespec* tp);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static constexpr int GUEST_EFAULT = 14;
 static constexpr int GUEST_EINVAL = 22;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = static_cast<int>(0x80020016);
 static constexpr int GUEST_CLOCK_MONOTONIC = 4;
 static constexpr int GUEST_CLOCK_THREAD_CPUTIME_ID = 14;
 static constexpr std::int64_t NANOS_PER_SECOND = 1000000000LL;
diff --git a/core/libs/tests/GuestThreadSanitizer.cpp b/core/libs/tests/GuestThreadSanitizer.cpp
index 4403a31564..7c69247cd9 100644
--- a/core/libs/tests/GuestThreadSanitizer.cpp
+++ b/core/libs/tests/GuestThreadSanitizer.cpp
@@ -1,8 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 
-extern "C" int APS5_VABI sceKernelIsThreadSanitizerEnabled(void);
-
 int main() {
     if (sceKernelIsThreadSanitizerEnabled() != 0) std::abort();
     return 0;
diff --git a/core/libs/tests/GuestThreadSelf.cpp b/core/libs/tests/GuestThreadSelf.cpp
index 87e38f6c0a..ae09ff38d4 100644
--- a/core/libs/tests/GuestThreadSelf.cpp
+++ b/core/libs/tests/GuestThreadSelf.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/KernelErrors.hpp"
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
+#include "prx/libkernel/Pthread/include/Mutex.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -9,38 +13,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-int APS5_VABI scePthreadDetach(Pthread thread);
-int APS5_VABI pthread_join_nid_postfix(Pthread thread, void** value);
-int APS5_VABI pthread_detach_nid_postfix(Pthread thread);
-void APS5_VABI scePthreadExit(void* retval);
-Pthread APS5_VABI scePthreadSelf();
-int APS5_VABI scePthreadGetthreadid(void);
-int APS5_VABI pthread_getthreadid_np_nid_postfix(void);
-void APS5_VABI scePthreadTestcancel();
-void APS5_VABI pthread_testcancel_nid_postfix(void);
-int APS5_VABI scePthreadSetcancelstate(int state, int* old_state);
-int APS5_VABI scePthreadSetcanceltype(int type, int* old_type);
-void APS5_VABI pthread_set_name_np_nid_postfix(Pthread thread, const char* name);
-int APS5_VABI scePthreadGetname(Pthread thread, char* name);
-int APS5_VABI scePthreadMutexattrInit(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrDestroy(PthreadMutexattr* attr);
-int APS5_VABI scePthreadMutexattrSettype(PthreadMutexattr* attr, int type);
-int APS5_VABI scePthreadMutexInit(PthreadMutex* mutex, const PthreadMutexattr* attr, const char* name);
-int APS5_VABI scePthreadMutexDestroy(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexLock(PthreadMutex* mutex);
-int APS5_VABI scePthreadMutexUnlock(PthreadMutex* mutex);
-int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-int APS5_VABI scePthreadAttrGetstackaddr(const PthreadAttr* attr, void** stack_addr);
-int APS5_VABI scePthreadAttrGetstacksize(const PthreadAttr* attr, size_t* stack_size);
-int APS5_VABI mprotect_nid_postfix(void* address, std::size_t length, int protection) noexcept;
-int APS5_VABI sceKernelIsStack(void* addr, void** start, void** end);
-}
-
 static bool StackContains(Pthread thread, const void* address) {
     PthreadAttr attr = nullptr;
     if (scePthreadAttrInit(&attr) != 0 || scePthreadAttrGet(thread, &attr) != 0) return false;
@@ -48,20 +20,18 @@ static bool StackContains(Pthread thread, const void* address) {
     size_t size = 0;
     const bool queried = scePthreadAttrGetstackaddr(&attr, &stack) == 0 && scePthreadAttrGetstacksize(&attr, &size) == 0;
     scePthreadAttrDestroy(&attr);
+
     const auto begin = reinterpret_cast<std::uintptr_t>(stack);
     const auto value = reinterpret_cast<std::uintptr_t>(address);
     return queried && stack != nullptr && size != 0 && value >= begin && value - begin < size;
 }
 
 static constexpr int SCE_OK = 0;
-static constexpr int SCE_KERNEL_ERROR_EINVAL = 0x80020016;
-static constexpr int SCE_KERNEL_ERROR_EPERM = 0x80020001;
-static constexpr int SCE_KERNEL_ERROR_EDEADLK = 0x8002000b;
 static constexpr int GUEST_EDEADLK = 11;
 static constexpr int GUEST_EINVAL = 22;
 static constexpr int MUTEX_TYPE_RECURSIVE = 2;
-static constexpr int PTHREAD_CANCEL_ENABLE = 0;
-static constexpr int PTHREAD_CANCEL_ASYNCHRONOUS = 2;
+static constexpr int GuestPthread_Cancel_Enable = 0;
+static constexpr int GuestPthread_Cancel_Asynchronous = 2;
 static constexpr std::intptr_t WorkerRetval = 0x1234;
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -78,6 +48,7 @@ static void ReportedStack(Pthread thread, std::uintptr_t* begin, std::uintptr_t*
     size_t size = 0;
     Require(scePthreadAttrGetstackaddr(&attr, &stack) == SCE_OK && scePthreadAttrGetstacksize(&attr, &size) == SCE_OK);
     scePthreadAttrDestroy(&attr);
+
     *begin = reinterpret_cast<std::uintptr_t>(stack);
     *end = *begin + size;
 }
@@ -165,12 +136,14 @@ static void* APS5_VABI Worker(void* arg) {
     context.posixJoinSelf = pthread_join_nid_postfix(context.selfFromWorker, nullptr);
     int oldState = -1;
     int oldType = -1;
-    context.testcancelReturned = scePthreadSetcancelstate(PTHREAD_CANCEL_ENABLE, &oldState) == SCE_OK &&
-        scePthreadSetcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, &oldType) == SCE_OK;
+    context.testcancelReturned = scePthreadSetcancelstate(GuestPthread_Cancel_Enable, &oldState) == SCE_OK &&
+        scePthreadSetcanceltype(GuestPthread_Cancel_Asynchronous, &oldType) == SCE_OK;
     scePthreadTestcancel();
     pthread_testcancel_nid_postfix();
-    context.testcancelReturned = context.testcancelReturned && oldState == PTHREAD_CANCEL_ENABLE;
+
+    context.testcancelReturned = context.testcancelReturned && oldState == GuestPthread_Cancel_Enable;
     scePthreadExit(reinterpret_cast<void*>(WorkerRetval));
+
     return nullptr;
 }
 
@@ -229,14 +202,15 @@ int main() {
 
     scePthreadTestcancel();
     pthread_testcancel_nid_postfix();
-
     Require(scePthreadMutexUnlock(&mutex) == SCE_OK);
     Require(scePthreadMutexDestroy(&mutex) == SCE_OK);
 
     char name[32] = {'x'};
     pthread_set_name_np_nid_postfix(mainSelf, "q2-main");
+
     Require(scePthreadGetname(mainSelf, name) == SCE_OK && std::strcmp(name, "q2-main") == 0);
     pthread_set_name_np_nid_postfix(mainSelf, nullptr);
+
     Require(scePthreadGetname(mainSelf, name) == SCE_OK && name[0] == '\0');
     pthread_set_name_np_nid_postfix(nullptr, "ignored");
 
diff --git a/core/libs/tests/GuestTimeConversion.cpp b/core/libs/tests/GuestTimeConversion.cpp
index 7b11ebe2ef..fee547cf32 100644
--- a/core/libs/tests/GuestTimeConversion.cpp
+++ b/core/libs/tests/GuestTimeConversion.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include <array>
@@ -15,24 +17,11 @@
 #include <thread>
 
 extern "C" {
-GuestTm* APS5_VABI libc_gmtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI gmtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI libc_localtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI localtime_nid_postfix(const std::int64_t*);
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-char* APS5_VABI asctime_nid_postfix(const GuestTm*);
-std::int64_t APS5_VABI mktime_nid_postfix(GuestTm*);
-std::size_t APS5_VABI strftime_nid_postfix(char*, std::size_t, const char*, const GuestTm*);
-void APS5_VABI tzset_nid_postfix(void);
+
 extern char* tzname_nid_postfix[2];
 extern std::int64_t timezone_nid_postfix;
 extern int daylight_nid_postfix;
-char* APS5_VABI ctime_nid_postfix(const std::int64_t*);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-double APS5_VABI libc_difftime_nid_postfix(std::int64_t, std::int64_t);
-double APS5_VABI difftime_nid_postfix(std::int64_t, std::int64_t);
+
 }
 
 using Converter = GuestTm* (APS5_VABI *)(const std::int64_t*);
@@ -302,13 +291,70 @@ static void CheckLocalRange() {
     Require(localtime_s_nid_postfix(&overflow, &scratch) == nullptr, "Unrepresentable negative local time was accepted");
 }
 
-#ifndef _WIN32
+#ifdef _WIN32
+extern "C" long* __cdecl __dstbias(void);
+
+struct DaylightBiasFixture {
+    long saved = *__dstbias();
+    ~DaylightBiasFixture() { *__dstbias() = saved; }
+    void Apply() const { *__dstbias() = -3600; }
+};
+
+struct ZoneOffset {
+    const char* zone;
+    std::int64_t timer;
+    long offset;
+    int isdst;
+};
+
+static void CheckPosixFormZoneOffsets() {
+    DaylightBiasFixture bias;
+    constexpr std::array<ZoneOffset, 4> expectations{{
+        {"PST8PDT", 979560000, -28800, 0},
+        {"PST8PDT", 995198400, -25200, 1},
+        {"EST5EDT", 979560000, -18000, 0},
+        {"EST5EDT", 995198400, -14400, 1},
+    }};
+    for (const ZoneOffset& expected : expectations) {
+        Require(setenv_nid_postfix("TZ", expected.zone, 1) == 0, "Could not set the POSIX-form time zone");
+        tzset_nid_postfix();
+        bias.Apply();
+        GuestTm local{};
+        Require(localtime_s_nid_postfix(&expected.timer, &local) == &local, "Local conversion in a POSIX-form zone failed");
+        if (local.tm_gmtoff != expected.offset || local.tm_isdst != expected.isdst) {
+            long hostTimezone = -1;
+            long hostDstBias = -1;
+            _get_timezone(&hostTimezone);
+            _get_dstbias(&hostDstBias);
+            std::tm hostLocal{};
+            const __time64_t hostTimer = expected.timer;
+            _localtime64_s(&hostLocal, &hostTimer);
+            std::fprintf(stderr, "%s at %lld: offset %ld daylight %d, expected %ld daylight %d (host timezone %ld dstbias %ld daylight %d)\n", expected.zone, static_cast<long long>(expected.timer), static_cast<long>(local.tm_gmtoff), local.tm_isdst, expected.offset, expected.isdst, hostTimezone, hostDstBias, hostLocal.tm_isdst);
+            std::abort();
+        }
+    }
+    Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
+    tzset_nid_postfix();
+}
+#endif
+
 static void CheckRegionZones() {
+#ifdef _WIN32
+    constexpr std::array<const char*, 2> zones{"PST8PDT", "EST5EDT"};
+    constexpr std::array<std::int64_t, 11> timers{-62135553600, -12609691200, -5016340800, -5000011200, -2732356800, -2209032000, -2208988800, -2208945600, -631108800, 979560000, 995198400};
+#else
     constexpr std::array<const char*, 4> zones{"America/Los_Angeles", "Europe/Berlin", "Asia/Kolkata", "America/Argentina/Buenos_Aires"};
     constexpr std::array<std::int64_t, 9> timers{-62135553600, -12609691200, -5016340800, -5000011200, -2732356800, -2209032000, -2208988800, -2208945600, -631108800};
+#endif
+#ifdef _WIN32
+    DaylightBiasFixture bias;
+#endif
     for (const char* zone : zones) {
         Require(setenv_nid_postfix("TZ", zone, 1) == 0, "Could not set the region time zone");
         tzset_nid_postfix();
+#ifdef _WIN32
+        bias.Apply();
+#endif
         for (const std::int64_t timer : timers) {
             GuestTm local{};
             Require(localtime_s_nid_postfix(&timer, &local) == &local, "Local conversion in a region zone failed");
@@ -326,8 +372,8 @@ static void CheckRegionZones() {
     }
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
 }
-#endif
 
 static void CheckGuestZone() {
     const std::int64_t moment = 172800;
@@ -343,25 +389,31 @@ static void CheckGuestZone() {
     Require(mktime_nid_postfix(&calendar) == moment, "mktime ignored the guest TZ");
     Require(setenv_nid_postfix("TZ", "UTC+3", 1) == 0, "Could not change the guest time zone");
     tzset_nid_postfix();
+
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_hour == 21 && result.tm_mday == 2 && result.tm_gmtoff == -10800,
         "tzset ignored the guest TZ");
     Require(timezone_nid_postfix == 10800 && daylight_nid_postfix == 1, "tzset did not set timezone and daylight for UTC+3");
     Require(setenv_nid_postfix("TZ", "", 1) == 0, "Could not empty the guest time zone");
     tzset_nid_postfix();
+
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_hour == 0 && result.tm_mday == 3 && result.tm_gmtoff == 0,
         "An empty guest TZ was not treated as UTC");
     Require(timezone_nid_postfix == 0 && daylight_nid_postfix == 1, "tzset did not set timezone and daylight for UTC");
     Require(setenv_nid_postfix("TZ", "EST5EDT", 1) == 0, "Could not set a daylight saving guest time zone");
     tzset_nid_postfix();
+
     Require(timezone_nid_postfix == 18000 && daylight_nid_postfix == 1, "timezone is not the standard offset of a daylight saving zone");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
     Require(setenv_nid_postfix("TZ", "EST5", 1) == 0, "Could not set the guest time zone without tzset");
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_hour == 19 && result.tm_gmtoff == -18000,
         "localtime ignored a guest TZ change made without tzset");
-    Require(std::strcmp(tzname_nid_postfix[0], "EST") == 0, "Implicit guest TZ update did not refresh tzname");
+    Require(std::strcmp(tzname_nid_postfix[0], "EST") == 0 && std::strcmp(tzname_nid_postfix[1], "   ") == 0,
+        "Implicit guest TZ update did not refresh tzname");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
 }
 
 static bool ZoneFieldsConsistent(const GuestTm& time, std::int64_t instant, int hour) {
@@ -379,7 +431,11 @@ static void CheckZoneRace() {
     std::atomic<bool> stop{false};
     std::atomic<int> torn{0};
     std::thread flipper([&] {
-        for (bool west = false; !stop.load(); west = !west) setenv_nid_postfix("TZ", west ? "UTC-5" : "UTC+3", 1);
+        for (bool west = false; !stop.load(); west = !west) {
+            setenv_nid_postfix("TZ", west ? "UTC-5" : "UTC+3", 1);
+
+            std::this_thread::yield();
+        }
     });
     std::array<std::thread, 6> readers;
     for (auto& reader : readers) {
@@ -403,6 +459,7 @@ static void CheckZoneRace() {
     Require(torn == 0, "A time conversion mixed the fields of two time zones while TZ changed");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
 }
 
 #ifdef _WIN32
@@ -414,12 +471,14 @@ static void CheckRejectedZone() {
     bool thrown = false;
     try {
         localtime_s_nid_postfix(&moment, &result);
+
     } catch (const std::runtime_error&) {
         thrown = true;
     }
     Require(thrown, "localtime accepted a TZ the host cannot hold");
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not restore the guest time zone");
     tzset_nid_postfix();
+
     Require(localtime_s_nid_postfix(&moment, &result) == &result && result.tm_gmtoff == 7200, "localtime did not recover after a rejected TZ");
 }
 #endif
@@ -427,6 +486,7 @@ static void CheckRejectedZone() {
 int main() {
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not set the guest time zone");
     tzset_nid_postfix();
+
     constexpr std::array<UtcCase, 7> utcCases{{
         {0, 70, 0, 1, 0, 0, 0, 4, 0},
         {-1, 69, 11, 31, 23, 59, 59, 3, 364},
@@ -508,8 +568,9 @@ int main() {
 
     CheckFreeBsdConversions();
     CheckLocalRange();
-#ifndef _WIN32
     CheckRegionZones();
+#ifdef _WIN32
+    CheckPosixFormZoneOffsets();
 #endif
     CheckLiteralConversions();
 
@@ -524,13 +585,16 @@ int main() {
 #endif
     Require(setenv_nid_postfix("TZ", "UTC-5", 1) == 0, "Could not set the guest time zone");
     tzset_nid_postfix();
+
     GuestTm shifted{};
     Require(localtime_s_nid_postfix(&epoch, &shifted) == &shifted && shifted.tm_hour == 5 && shifted.tm_gmtoff == 18000,
         "tzset did not pick up the new TZ");
-    Require(tzname_nid_postfix[0] != nullptr && std::strcmp(tzname_nid_postfix[0], "UTC") == 0 && tzname_nid_postfix[1] != nullptr,
-        "tzname does not name the zone tzset set");
+    Require(tzname_nid_postfix[0] != nullptr && std::strcmp(tzname_nid_postfix[0], "UTC") == 0 && tzname_nid_postfix[1] != nullptr &&
+            std::strcmp(tzname_nid_postfix[1], "   ") == 0,
+        "tzname does not name the zone tzset set and leave the daylight name blank");
     Require(setenv_nid_postfix("TZ", "EST5EDT", 1) == 0, "Could not set the guest time zone");
     tzset_nid_postfix();
+
     Require(std::strcmp(tzname_nid_postfix[0], "EST") == 0 && std::strcmp(tzname_nid_postfix[1], "EDT") == 0,
         "tzname does not name the standard and daylight zones");
 }
diff --git a/core/libs/tests/GuestTimeExtras.cpp b/core/libs/tests/GuestTimeExtras.cpp
index 6fc9d4cde0..f03c36ce64 100644
--- a/core/libs/tests/GuestTimeExtras.cpp
+++ b/core/libs/tests/GuestTimeExtras.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/SonyCrt.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
 #include <cstdint>
@@ -7,24 +9,6 @@
 #include <limits>
 #include <random>
 
-struct Xtime {
-    std::int64_t sec;
-    std::int64_t nsec;
-};
-
-extern "C" {
-GuestTm* APS5_VABI gmtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI localtime_s_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI gmtime_r_nid_postfix(const std::int64_t*, GuestTm*);
-GuestTm* APS5_VABI localtime_r_nid_postfix(const std::int64_t*, GuestTm*);
-std::int64_t APS5_VABI timegm_nid_postfix(GuestTm*);
-void APS5_VABI tzset_nid_postfix();
-int APS5_VABI setenv_nid_postfix(const char*, const char*, int);
-int APS5_VABI xtime_get_nid_postfix(Xtime*, int);
-Xtime APS5_VABI _Xtime_to_ts_nid_postfix(const Xtime*);
-Xtime APS5_VABI _Xtime_diff_to_ts_nid_postfix(const Xtime*);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -156,6 +140,7 @@ static void CheckXtime() {
 int main() {
     Require(setenv_nid_postfix("TZ", "UTC-2", 1) == 0, "Could not set the time zone");
     tzset_nid_postfix();
+
     CheckReentrantConversions();
     CheckTimegmCases();
     CheckXtime();
diff --git a/core/libs/tests/GuestTimedJoin.cpp b/core/libs/tests/GuestTimedJoin.cpp
new file mode 100644
index 0000000000..928c3bb73b
--- /dev/null
+++ b/core/libs/tests/GuestTimedJoin.cpp
@@ -0,0 +1,177 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <atomic>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <limits>
+#include <thread>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+static_assert(sizeof(KernelTimespec)==16 && alignof(KernelTimespec)==8 && offsetof(KernelTimespec,tv_nsec)==8);
+
+using TimedJoin = decltype(&pthread_timedjoin_np_nid_postfix);
+static TimedJoin timedJoin;
+
+void Require(bool value,const char* message) {
+    if (!value) { std::fprintf(stderr,"timed join: %s\n",message); std::abort(); }
+}
+
+KernelTimespec After(int milliseconds) {
+    KernelTimespec result{};
+    Require(clock_gettime_nid_postfix(0,&result)==0,"read realtime");
+    result.tv_nsec+=static_cast<std::int64_t>(milliseconds)*1000000;
+    result.tv_sec+=result.tv_nsec/1000000000;
+    result.tv_nsec%=1000000000;
+    return result;
+}
+
+struct Gate { std::atomic<bool> release{false}, entered{false}, leaving{false}; };
+void* APS5_VABI Worker(void* argument) {
+    auto& gate=*static_cast<Gate*>(argument);
+    gate.entered.store(true,std::memory_order_release);
+    while (!gate.release.load(std::memory_order_acquire)) std::this_thread::yield();
+    gate.leaving.store(true,std::memory_order_release);
+    return reinterpret_cast<void*>(std::uintptr_t{0x12345678});
+}
+
+void Wait(const std::atomic<bool>& flag) {
+    const auto deadline=std::chrono::steady_clock::now()+std::chrono::seconds(3);
+    while (!flag.load(std::memory_order_acquire)) {
+        Require(std::chrono::steady_clock::now()<deadline,"worker handshake timed out");
+        std::this_thread::yield();
+    }
+}
+
+Pthread Start(Gate& gate) {
+    Pthread thread=nullptr;
+    Require(pthread_create_nid_postfix(&thread,nullptr,Worker,&gate)==0,"create worker");
+    Wait(gate.entered);
+    return thread;
+}
+
+struct JoinTask { Pthread target; std::atomic<bool> entered{false}; int result=-1; void* value=reinterpret_cast<void*>(std::uintptr_t{0x55}); };
+void* APS5_VABI Joiner(void* argument) {
+    auto& task=*static_cast<JoinTask*>(argument);
+    const auto deadline=After(3000);
+    task.entered.store(true,std::memory_order_release);
+    task.result=timedJoin(task.target,&task.value,&deadline);
+    return nullptr;
+}
+
+void AwaitClaim(Pthread target) {
+    const KernelTimespec past{0,0};
+    const auto until=std::chrono::steady_clock::now()+std::chrono::seconds(2);
+    for (;;) {
+        const int result=timedJoin(target,nullptr,&past);
+        if (result==45) return;
+        Require(result==60,"claim probe returns timeout or ENOTSUP");
+        Require(std::chrono::steady_clock::now()<until,"joiner did not claim target");
+        std::this_thread::yield();
+    }
+}
+
+void Basic() {
+    const KernelTimespec valid=After(1000);
+    for (const KernelTimespec invalid: {KernelTimespec{-1,0},KernelTimespec{0,-1},KernelTimespec{0,1000000000}}) {
+        Require(timedJoin(nullptr,nullptr,&invalid)==22,"invalid deadline precedes null thread");
+        Require(timedJoin(pthread_self_nid_postfix(),nullptr,&invalid)==22,"invalid deadline precedes self join");
+    }
+    Require(timedJoin(nullptr,nullptr,nullptr)==22,"null deadline");
+    Require(timedJoin(nullptr,nullptr,&valid)==22,"null thread");
+    Require(timedJoin(pthread_self_nid_postfix(),nullptr,&valid)==11,"self join");
+    Gate gate;
+    Pthread thread=Start(gate);
+    struct { std::uint64_t before=0xa5a5a5a5; void* value=reinterpret_cast<void*>(std::uintptr_t{0x55}); std::uint64_t after=0x5a5a5a5a; } result;
+    const KernelTimespec past{0,0};
+    *__error_nid_postfix()=123;
+    Require(timedJoin(thread,&result.value,&past)==60,"past deadline expires");
+    Require(result.value==reinterpret_cast<void*>(std::uintptr_t{0x55}),"timeout preserves return slot");
+    Require(*__error_nid_postfix()==123,"POSIX error preserves errno");
+    const auto deadline=After(50);
+    const auto originalDeadline=deadline;
+    const auto started=std::chrono::steady_clock::now();
+    Require(timedJoin(thread,&result.value,&deadline)==60,"future deadline expires");
+    Require(std::chrono::steady_clock::now()-started>=std::chrono::milliseconds(25),"wait did not expire immediately");
+    Require(deadline.tv_sec==originalDeadline.tv_sec && deadline.tv_nsec==originalDeadline.tv_nsec,"deadline input is unchanged");
+    gate.release.store(true,std::memory_order_release);
+    const KernelTimespec distant{std::numeric_limits<std::int64_t>::max(),999999999};
+    Require(timedJoin(thread,&result.value,&distant)==0,"timeout leaves target joinable; distant deadline does not overflow");
+    Require(result.value==reinterpret_cast<void*>(std::uintptr_t{0x12345678}),"joined return value");
+    Require(result.before==0xa5a5a5a5 && result.after==0x5a5a5a5a,"return-slot bounds");
+    Require(timedJoin(thread,nullptr,&valid)==3,"already joined target");
+    Require(timedJoin(thread,nullptr,nullptr)==22,"deadline validation precedes joined state");
+    Gate done;
+    Pthread completed=Start(done);
+    done.release.store(true,std::memory_order_release);
+    Wait(done.leaving);
+    const auto until=std::chrono::steady_clock::now()+std::chrono::seconds(2);
+    for (;;) {
+        const int joined=timedJoin(completed,nullptr,&past);
+        if (joined==0) break;
+        Require(joined==60 && std::chrono::steady_clock::now()<until,"completed thread joins with an expired deadline");
+        std::this_thread::yield();
+    }
+    Gate detached;
+    Pthread detachedThread=Start(detached);
+    Require(pthread_detach_nid_postfix(detachedThread)==0,"detach worker");
+    Require(timedJoin(detachedThread,nullptr,&valid)==22,"detached target");
+    detached.release.store(true,std::memory_order_release);
+    Wait(detached.leaving);
+}
+
+void Contention(bool cancel) {
+    Gate gate;
+    Pthread target=Start(gate);
+    JoinTask task{target};
+    Pthread joiner=nullptr;
+    Require(pthread_create_nid_postfix(&joiner,nullptr,Joiner,&task)==0,"create competing joiner");
+    Wait(task.entered);
+    AwaitClaim(target);
+    if (cancel) {
+        Require(pthread_cancel_nid_postfix(joiner)==0,"cancel blocked timed join");
+        void* canceled=nullptr;
+        Require(pthread_join_nid_postfix(joiner,&canceled)==0 && canceled==reinterpret_cast<void*>(std::uintptr_t{1}),"joiner is canceled");
+        Require(task.result==-1 && task.value==reinterpret_cast<void*>(std::uintptr_t{0x55}),"canceled join did not return or write result");
+        const KernelTimespec past{0,0};
+        Require(timedJoin(target,nullptr,&past)==60,"cancellation releases join claim");
+        gate.release.store(true,std::memory_order_release);
+        const auto deadline=After(1000);
+        Require(timedJoin(target,nullptr,&deadline)==0,"cancellation preserves target joinability");
+    } else {
+        gate.release.store(true,std::memory_order_release);
+        Require(pthread_join_nid_postfix(joiner,nullptr)==0,"join successful joiner");
+        Require(task.result==0 && task.value==reinterpret_cast<void*>(std::uintptr_t{0x12345678}),"competing join succeeds once");
+    }
+}
+
+int main(int argc,char** argv) {
+    Require(argc==2,"expected kernel path");
+#ifdef _WIN32
+    const auto library=LoadLibraryA(argv[1]);
+    Require(library!=nullptr,"load kernel");
+    timedJoin=reinterpret_cast<TimedJoin>(GetProcAddress(library,"pthread_timedjoin_np_nid_postfix"));
+#else
+    const auto library=dlopen(argv[1],RTLD_NOW);
+    Require(library!=nullptr,"load kernel");
+    timedJoin=reinterpret_cast<TimedJoin>(dlsym(library,"pthread_timedjoin_np_nid_postfix"));
+#endif
+    Require(timedJoin!=nullptr,"pthread_timedjoin_np export is missing");
+    Basic();
+    Contention(false);
+    Contention(true);
+#ifdef _WIN32
+    Require(FreeLibrary(library)!=0,"release kernel lookup handle");
+#else
+    Require(dlclose(library)==0,"release kernel lookup handle");
+#endif
+    std::puts("timed join checks passed");
+}
diff --git a/core/libs/tests/GuestTruncate.cpp b/core/libs/tests/GuestTruncate.cpp
index 1e037fd9d8..732a8394be 100644
--- a/core/libs/tests/GuestTruncate.cpp
+++ b/core/libs/tests/GuestTruncate.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -18,16 +21,6 @@ extern "C" _invalid_parameter_handler _set_thread_local_invalid_parameter_handle
 #include <unistd.h>
 #endif
 
-extern "C" {
-int APS5_VABI truncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI sceKernelTruncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI sceKernelFtruncate(int, std::int64_t);
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int GuestEnoent = 2;
diff --git a/core/libs/tests/GuestTruncateExtend.cpp b/core/libs/tests/GuestTruncateExtend.cpp
index 66dcffd80e..789105ba61 100644
--- a/core/libs/tests/GuestTruncateExtend.cpp
+++ b/core/libs/tests/GuestTruncateExtend.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -8,18 +10,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI open_nid_postfix(const char*, int, int);
-int APS5_VABI close_nid_postfix(int);
-std::int64_t APS5_VABI write_nid_postfix(int, const void*, std::uint64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::uint64_t, std::int64_t);
-std::int64_t APS5_VABI lseek_nid_postfix(int, std::int64_t, int);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI truncate_nid_postfix(const char*, std::int64_t);
-int APS5_VABI unlink_nid_postfix(const char*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 namespace {
 
 constexpr int ReadOnly = 0;
@@ -30,6 +20,7 @@ constexpr char FileName[] = "anyps5_truncate_extend_file";
 
 void Cleanup() {
     unlink_nid_postfix(FileName);
+
 }
 
 void Require(bool condition, const char* what) {
diff --git a/core/libs/tests/GuestTruncateRace.cpp b/core/libs/tests/GuestTruncateRace.cpp
index 29f2f3a3e1..e4602f6415 100644
--- a/core/libs/tests/GuestTruncateRace.cpp
+++ b/core/libs/tests/GuestTruncateRace.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
 #include <barrier>
@@ -11,18 +13,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelFtruncate(int, std::int64_t);
-int APS5_VABI ftruncate_nid_postfix(int, std::int64_t);
-int APS5_VABI dup_nid_postfix(int);
-std::int64_t APS5_VABI sceKernelLseek(int, std::int64_t, int);
-std::int64_t APS5_VABI sceKernelPread(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI pread_nid_postfix(int, void*, std::size_t, std::int64_t);
-std::int64_t APS5_VABI sceKernelRead(int, void*, std::size_t);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Truncate race check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestUdp.cpp b/core/libs/tests/GuestUdp.cpp
index ae2ba5fe9a..ac6d36fa4c 100644
--- a/core/libs/tests/GuestUdp.cpp
+++ b/core/libs/tests/GuestUdp.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
@@ -7,45 +9,7 @@
 #include <initializer_list>
 #include <thread>
 #include <chrono>
-extern "C" {
-int APS5_VABI socket_nid_postfix(int, int, int);
-int APS5_VABI connect_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-int APS5_VABI setsockopt_nid_postfix(int, int, int, const void*, std::uint32_t);
-int APS5_VABI getsockopt_nid_postfix(int, int, int, void*, std::uint32_t*);
-int APS5_VABI bind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI getsockname_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI getpeername_nid_postfix(int, void*, std::uint32_t*);
-int APS5_VABI ioctl_nid_postfix(int, std::uint64_t, void*);
-int APS5_VABI _ioctl_nid_postfix(int, std::uint64_t, void*);
-std::int64_t APS5_VABI send_nid_postfix(int, const void*, std::uint64_t, int);
-std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int);
-std::int64_t APS5_VABI sendto_nid_postfix(int, const void*, std::uint64_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI recvfrom_nid_postfix(int, void*, std::uint64_t, int, void*, std::uint32_t*);
-int APS5_VABI close_nid_postfix(int);
-const char* APS5_VABI inet_ntop_nid_postfix(int, const void*, char*, std::uint32_t);
-int APS5_VABI inet_pton_nid_postfix(int, const char*, void*);
-int* APS5_VABI __error_nid_postfix();
-}
-struct Iovec {
-    void* base;
-    std::uint64_t length;
-};
-struct Msghdr {
-    void* name;
-    std::uint32_t nameLength;
-    Iovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-extern "C" {
-std::int64_t APS5_VABI sendmsg_nid_postfix(int, const Msghdr*, int);
-std::int64_t APS5_VABI recvmsg_nid_postfix(int, Msghdr*, int);
-std::int64_t APS5_VABI sceKernelReadv(int, const Iovec*, int);
-std::int64_t APS5_VABI sceKernelWritev(int, const Iovec*, int);
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckAddressLengths(int family) {
@@ -89,8 +53,8 @@ static void CheckAddressLengths(int family) {
         Require(size == copied && std::memcmp(address.data(), expected.data(), copied) == 0);
         Require(std::all_of(address.begin() + copied, address.end(), [](auto byte) { return byte == 0xa5; }));
         address.fill(0xa5);
-        Iovec vector{received, sizeof(received)};
-        Msghdr message{address.data(), capacity, &vector, 1, nullptr, 0, -1};
+        KernelIovec vector{received, sizeof(received)};
+        GuestMsghdr message{address.data(), capacity, &vector, 1, nullptr, 0, -1};
         Require(recvmsg_nid_postfix(receiver, &message, 0) == sizeof(payload));
         Require(message.nameLength == copied && std::memcmp(received, payload, sizeof(payload)) == 0);
         Require(std::memcmp(address.data(), expected.data(), copied) == 0);
@@ -99,6 +63,31 @@ static void CheckAddressLengths(int family) {
     Require(close_nid_postfix(sender) == 0 && close_nid_postfix(receiver) == 0);
 }
 
+static void CheckSendToPortZero() {
+    const int receiver = socket_nid_postfix(2, 2, 0);
+    const int sender = socket_nid_postfix(2, 2, 0);
+    Require(receiver >= 0 && sender >= 0);
+    std::array<unsigned char, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(receiver, address.data(), address.size()) == 0);
+    std::uint32_t size = address.size();
+    Require(getsockname_nid_postfix(receiver, address.data(), &size) == 0);
+    std::array<unsigned char, 16> portZero{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(sendto_nid_postfix(sender, "x", 1, 0, portZero.data(), portZero.size()) == -1 && *__error_nid_postfix() == 49);
+    char buffer[4];
+    Require(recv_nid_postfix(receiver, buffer, sizeof(buffer), 0x80) == -1 && *__error_nid_postfix() == 35);
+    Require(sendto_nid_postfix(sender, "x", 1, 0, address.data(), address.size()) == 1);
+    Require(recv_nid_postfix(receiver, buffer, sizeof(buffer), 0) == 1);
+    const int bound = socket_nid_postfix(2, 2, 0);
+    Require(bound >= 0);
+    std::array<unsigned char, 16> bindAddress{16, 2, 0, 0, 127, 0, 0, 1};
+    Require(bind_nid_postfix(bound, bindAddress.data(), bindAddress.size()) == 0);
+    Require(sendto_nid_postfix(bound, "x", 1, 0, portZero.data(), portZero.size()) == 1);
+    Require(recv_nid_postfix(receiver, buffer, sizeof(buffer), 0x80) == -1 && *__error_nid_postfix() == 35);
+    std::array<unsigned char, 16> anyDestination{16, 2, 0, 0, 0, 0, 0, 0};
+    Require(sendto_nid_postfix(bound, "x", 1, 0, anyDestination.data(), anyDestination.size()) == -1 && *__error_nid_postfix() == 49);
+    Require(close_nid_postfix(bound) == 0 && close_nid_postfix(receiver) == 0 && close_nid_postfix(sender) == 0);
+}
+
 static void CheckDontWait() {
     const int receiver = socket_nid_postfix(2, 2, 0);
     const int sender = socket_nid_postfix(2, 2, 0);
@@ -108,8 +97,8 @@ static void CheckDontWait() {
     std::uint32_t size = address.size();
     Require(getsockname_nid_postfix(receiver, address.data(), &size) == 0);
     char buffer[16]{};
-    Iovec vector{buffer, sizeof(buffer)};
-    Msghdr message{nullptr, 0, &vector, 1, nullptr, 0, 0};
+    KernelIovec vector{buffer, sizeof(buffer)};
+    GuestMsghdr message{nullptr, 0, &vector, 1, nullptr, 0, 0};
     const auto start = std::chrono::steady_clock::now();
     Require(recv_nid_postfix(receiver, buffer, sizeof(buffer), 0x80) == -1 && *__error_nid_postfix() == 35);
     Require(recvfrom_nid_postfix(receiver, buffer, sizeof(buffer), 0x80, nullptr, nullptr) == -1 && *__error_nid_postfix() == 35);
@@ -136,6 +125,7 @@ int main() {
     CheckAddressLengths(2);
     CheckAddressLengths(28);
     CheckDontWait();
+    CheckSendToPortZero();
     const int receiver = socket_nid_postfix(2, 2, 0);
     const int sender = socket_nid_postfix(2, 2, 17);
     Require(receiver >= 0 && sender >= 0 && receiver != sender);
@@ -147,11 +137,11 @@ int main() {
     Require(connect_nid_postfix(sender, destination.data(), destination.size()) == 0);
     char vectorHead[] = "atomic ";
     char vectorTail[] = "datagram";
-    Iovec vectorOutput[]{{vectorHead, sizeof(vectorHead) - 1}, {vectorTail, sizeof(vectorTail)}};
+    KernelIovec vectorOutput[]{{vectorHead, sizeof(vectorHead) - 1}, {vectorTail, sizeof(vectorTail)}};
     Require(sceKernelWritev(sender, vectorOutput, 2) == sizeof(vectorHead) + sizeof(vectorTail) - 1);
     char vectorFirst[sizeof(vectorHead) - 1]{};
     char vectorSecond[sizeof(vectorTail)]{};
-    Iovec vectorInput[]{{vectorFirst, sizeof(vectorFirst)}, {vectorSecond, sizeof(vectorSecond)}};
+    KernelIovec vectorInput[]{{vectorFirst, sizeof(vectorFirst)}, {vectorSecond, sizeof(vectorSecond)}};
     Require(sceKernelReadv(receiver, vectorInput, 2) == sizeof(vectorHead) + sizeof(vectorTail) - 1);
     Require(std::memcmp(vectorFirst, "atomic ", sizeof(vectorFirst)) == 0 && std::strcmp(vectorSecond, "datagram") == 0);
     int enabled = 1;
@@ -211,8 +201,8 @@ int main() {
     Require(_ioctl_nid_postfix(receiver, 123, &queued) == -1 && *__error_nid_postfix() == 25);
     char head[] = "scatter ";
     char tail[] = "gather";
-    Iovec parts[2]{{head, 8}, {tail, 6}};
-    Msghdr outgoing{nullptr, 0, parts, 2, nullptr, 0, 0};
+    KernelIovec parts[2]{{head, 8}, {tail, 6}};
+    GuestMsghdr outgoing{nullptr, 0, parts, 2, nullptr, 0, 0};
     Require(sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
     const auto wait = [&] {
         queued = 0;
@@ -224,22 +214,31 @@ int main() {
     };
     wait();
     char first[4]{}, second[16]{};
-    Iovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
+    KernelIovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
     source.fill(0);
     unsigned char control[8]{};
-    Msghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, control, sizeof(control), -1};
+    GuestMsghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, control, sizeof(control), -1};
+    Require(recvmsg_nid_postfix(receiver, &incoming, 2) == 14 && incoming.flags == 2);
+    incoming.nameLength = static_cast<std::uint32_t>(source.size());
+    incoming.controlLength = sizeof(control);
     Require(recvmsg_nid_postfix(receiver, &incoming, 0) == 14);
     Require(std::memcmp(first, "scat", 4) == 0 && std::memcmp(second, "ter gather", 10) == 0);
     Require(incoming.flags == 0 && incoming.controlLength == 0 && incoming.nameLength == 16 && source[1] == 2 && source[4] == 127);
     Require(sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
     wait();
     char shortBuffer[5]{};
-    Iovec single{shortBuffer, sizeof(shortBuffer)};
-    Msghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
-    Require(recvmsg_nid_postfix(receiver, &truncated, 0) == 5);
-    Require(std::memcmp(shortBuffer, "scatt", 5) == 0 && truncated.flags == 0x10);
+    KernelIovec single{shortBuffer, sizeof(shortBuffer)};
+    GuestMsghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
+    Require(recvmsg_nid_postfix(receiver, &truncated, 2) == 5 && truncated.flags == 0x12);
+    Require(recvmsg_nid_postfix(receiver, &truncated, 0x80) == 5);
+    Require(std::memcmp(shortBuffer, "scatt", 5) == 0 && truncated.flags == 0x90);
     Require(recvmsg_nid_postfix(receiver, &truncated, 0) == -1 && *__error_nid_postfix() == 35);
-    Msghdr oversized{nullptr, 0, parts, 1025, nullptr, 0, 0};
+    KernelIovec none{shortBuffer, 0};
+    GuestMsghdr empty{nullptr, 0, &none, 1, nullptr, 0, -1};
+    Require(fcntl_nid_postfix(receiver, 4, 2) == 0);
+    Require(recvmsg_nid_postfix(receiver, &empty, 0) == 0 && empty.flags == 0);
+    Require(fcntl_nid_postfix(receiver, 4, 6) == 0);
+    GuestMsghdr oversized{nullptr, 0, parts, 1025, nullptr, 0, 0};
     Require(sendmsg_nid_postfix(sender, &oversized, 0) == -1 && *__error_nid_postfix() == 40);
     Require(recvmsg_nid_postfix(receiver, nullptr, 0) == -1 && *__error_nid_postfix() == 14);
     Require(close_nid_postfix(receiver) == 0);
diff --git a/core/libs/tests/GuestUlobjmgr.cpp b/core/libs/tests/GuestUlobjmgr.cpp
index 0fd79500f7..3f6795a979 100644
--- a/core/libs/tests/GuestUlobjmgr.cpp
+++ b/core/libs/tests/GuestUlobjmgr.cpp
@@ -1,12 +1,8 @@
+#include "prx/ulobjmgr/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI _sceUlobjmgrRegisterObject(std::uint64_t object, std::int32_t kind, std::uint32_t* id);
-int APS5_VABI _sceUlobjmgrUnregisterObject(std::uint32_t id);
-}
-
 namespace {
 
 constexpr int einval = 22;
diff --git a/core/libs/tests/GuestUltCondition.cpp b/core/libs/tests/GuestUltCondition.cpp
index 5bec09da1b..2f5c980fe4 100644
--- a/core/libs/tests/GuestUltCondition.cpp
+++ b/core/libs/tests/GuestUltCondition.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -9,18 +10,6 @@
 #include <string>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceUltFinalize();
-int APS5_VABI sceUltMutexCreate(void*, const char*, void*, const UltMutexOptParam*, std::uint32_t);
-int APS5_VABI sceUltMutexLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-int APS5_VABI sceUltMutexDestroy(void*);
-int APS5_VABI _sceUltConditionVariableCreate(void*, const char*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltConditionVariableWait(void*);
-int APS5_VABI sceUltConditionVariableSignal(void*);
-int APS5_VABI sceUltConditionVariableDestroy(void*);
-}
-
 constexpr int Null = -2139029503;
 constexpr int Invalid = -2139029500;
 constexpr int Permission = -2139029499;
@@ -65,6 +54,9 @@ static void Validation() {
     Object unused;
     CHECK(sceUltMutexDestroy(nullptr) == Null);
     CHECK(sceUltMutexDestroy(&unused) == State);
+    CHECK(sceUltConditionVariableCreate(nullptr, nullptr, nullptr, nullptr, 0) == Null);
+    CHECK(sceUltConditionVariableCreate(&unused, nullptr, &unused, nullptr, 0) == Invalid);
+    CHECK(sceUltConditionVariableCreate(&f.condition, nullptr, &f.mutex, nullptr, 0) == State);
     CHECK(_sceUltConditionVariableCreate(nullptr, nullptr, nullptr, nullptr, 0) == Null);
     CHECK(_sceUltConditionVariableCreate(&unused, nullptr, &unused, nullptr, 0) == Invalid);
     CHECK(_sceUltConditionVariableCreate(&f.condition, nullptr, &f.mutex, nullptr, 0) == State);
diff --git a/core/libs/tests/GuestUltQueue.cpp b/core/libs/tests/GuestUltQueue.cpp
index 4cfcf13881..7a2a1ef562 100644
--- a/core/libs/tests/GuestUltQueue.cpp
+++ b/core/libs/tests/GuestUltQueue.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <array>
 #include <atomic>
@@ -10,21 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-std::uint64_t APS5_VABI sceUltWaitingQueueResourcePoolGetWorkAreaSize(std::uint32_t, std::uint32_t);
-std::uint64_t APS5_VABI sceUltQueueDataResourcePoolGetWorkAreaSize(std::uint32_t, std::uint64_t, std::uint32_t);
-int APS5_VABI sceUltQueueDataResourcePoolCreate(void*, const char*, std::uint32_t, std::uint64_t, std::uint32_t, void*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltQueueDataResourcePoolDestroy(void*);
-int APS5_VABI sceUltQueueCreate(void*, const char*, std::uint64_t, void*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltQueueDestroy(void*);
-int APS5_VABI sceUltQueuePush(void*, const void*);
-int APS5_VABI sceUltQueueTryPush(void*, const void*);
-int APS5_VABI sceUltQueuePop(void*, void*);
-int APS5_VABI sceUltQueueTryPop(void*, void*);
-}
-
 static constexpr int Null = -2139029503;
 static constexpr int Alignment = -2139029502;
 static constexpr int Range = -2139029501;
diff --git a/core/libs/tests/GuestUltSync.cpp b/core/libs/tests/GuestUltSync.cpp
index 2a368aa57b..a9d52c921a 100644
--- a/core/libs/tests/GuestUltSync.cpp
+++ b/core/libs/tests/GuestUltSync.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -9,41 +10,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-int APS5_VABI sceUltMutexCreate(void*, const char*, void*, const UltMutexOptParam*, std::uint32_t);
-int APS5_VABI sceUltMutexLock(void*);
-int APS5_VABI sceUltMutexTryLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-int APS5_VABI sceUltMutexDestroy(void*);
-int APS5_VABI sceUltSemaphoreOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltQueueOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltQueueDataResourcePoolOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltWaitingQueueResourcePoolOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltWaitingQueueResourcePoolCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*);
-int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void*);
-int APS5_VABI sceUltReaderWriterLockOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI sceUltReaderWriterLockCreate(void*, const char*, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltReaderWriterLockDestroy(void*);
-int APS5_VABI sceUltReaderWriterLockLockRead(void*);
-int APS5_VABI sceUltReaderWriterLockTryLockRead(void*);
-int APS5_VABI sceUltReaderWriterLockUnlockRead(void*);
-int APS5_VABI sceUltReaderWriterLockLockWrite(void*);
-int APS5_VABI sceUltReaderWriterLockTryLockWrite(void*);
-int APS5_VABI sceUltReaderWriterLockUnlockWrite(void*);
-std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t, std::uint32_t);
-int APS5_VABI sceUltUlthreadRuntimeCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadRuntimeDestroy(void*);
-int APS5_VABI sceUltUlthreadCreate(void*, const char*, UltUlthreadEntry, std::uint64_t, void*, std::uint64_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadTryJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadGetSelf(void**);
-int APS5_VABI sceUltUlthreadYield();
-int APS5_VABI sceUltUlthreadExit(std::int32_t);
-}
-
 namespace {
 
 constexpr int Ok = 0;
@@ -96,19 +62,19 @@ void MutexTryLock() {
 }
 
 void OptParams() {
-    using Initializer = int (APS5_VABI *)(void*, std::uint32_t);
+    using Initializer = decltype(&sceUltSemaphoreOptParamInitialize);
     for (const Initializer initialize : {sceUltSemaphoreOptParamInitialize, sceUltQueueOptParamInitialize, sceUltQueueDataResourcePoolOptParamInitialize,
-                                         sceUltWaitingQueueResourcePoolOptParamInitialize, sceUltUlthreadOptParamInitialize, sceUltReaderWriterLockOptParamInitialize}) {
-        std::uint8_t bytes[136];
+                                         sceUltWaitingQueueResourcePoolOptParamInitialize, sceUltUlthreadOptParamInitialize, sceUltReaderWriterLockOptParamInitialize,
+                                         sceUltConditionVariableOptParamInitialize, _sceUltConditionVariableOptParamInitialize}) {
+        alignas(UltOptParam) std::uint8_t bytes[136];
         std::memset(bytes, 0xa5, sizeof(bytes));
         CHECK(initialize(nullptr, 0) == Null);
-        CHECK(initialize(bytes, 0) == Ok);
+        CHECK(initialize(reinterpret_cast<UltOptParam*>(bytes), 0) == Ok);
         for (std::size_t index = 0; index < 128; ++index) CHECK(bytes[index] == 0);
         for (std::size_t index = 128; index < sizeof(bytes); ++index) CHECK(bytes[index] == 0xa5);
     }
 }
 
-
 void WaitUntil(const std::atomic<bool>& flag) {
     const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(5);
     while (!flag.load() && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(1));
@@ -270,6 +236,7 @@ std::int32_t APS5_VABI ExitingEntry(std::uint64_t status) {
     if (sceUltUlthreadGetSelf(&self) == Ok) gSelf = self;
     gYield = sceUltUlthreadYield();
     sceUltUlthreadExit(static_cast<std::int32_t>(status));
+
     gPastExit = true;
     return -1;
 }
diff --git a/core/libs/tests/GuestUltThread.cpp b/core/libs/tests/GuestUltThread.cpp
index 32b8be2972..50fef67d4c 100644
--- a/core/libs/tests/GuestUltThread.cpp
+++ b/core/libs/tests/GuestUltThread.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUlt/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <cstdio>
@@ -11,41 +12,6 @@
 struct UltConditionVariableInfo;
 struct UltWaitingThreadInfo;
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-std::uint64_t APS5_VABI sceUltUlthreadRuntimeGetWorkAreaSize(std::uint32_t, std::uint32_t);
-int APS5_VABI sceUltUlthreadRuntimeCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadCreate(void*, const char*, UltUlthreadEntry, std::uint64_t, void*, std::uint64_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltUlthreadJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadTryJoin(void*, std::int32_t*);
-int APS5_VABI sceUltUlthreadRuntimeDestroy(void*);
-int APS5_VABI _sceUltUlthreadRuntimeOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltUlthreadRuntimeCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*);
-int APS5_VABI _sceUltUlthreadCreate(void*, const char*, UltUlthreadEntry, std::uint64_t, void*, std::uint64_t, void*, const void*);
-int APS5_VABI _sceUltWaitingQueueResourcePoolCreate(void*, const char*, std::uint32_t, std::uint32_t, void*, const void*);
-int APS5_VABI _sceUltSemaphoreCreate(void*, const char*, std::uint32_t, void*, const void*);
-int APS5_VABI sceUltSemaphoreTryAcquire(void*, std::int32_t);
-int APS5_VABI sceUltSemaphoreAcquire(void*, std::int32_t);
-int APS5_VABI sceUltSemaphoreRelease(void*, std::int32_t);
-int APS5_VABI _sceUltMutexOptParamInitialize(void*, std::uint32_t);
-int APS5_VABI _sceUltMutexCreate(void*, const char*, void*, const void*);
-int APS5_VABI sceUltMutexLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-int APS5_VABI _sceUltQueueDataResourcePoolCreate(void*, const char*, std::uint32_t, std::uint64_t, std::uint32_t, void*, void*, const void*);
-int APS5_VABI _sceUltQueueCreate(void*, const char*, std::uint64_t, void*, void*, const void*);
-int APS5_VABI sceUltQueuePush(void*, const void*);
-int APS5_VABI sceUltQueuePop(void*, void*);
-int APS5_VABI sceUltMutexDestroy(void*);
-int APS5_VABI sceUltWaitingQueueResourcePoolDestroy(void*);
-int APS5_VABI sceUltSemaphoreDestroy(void*);
-int APS5_VABI sceUltQueueDestroy(void*);
-int APS5_VABI sceUltQueueDataResourcePoolDestroy(void*);
-int APS5_VABI sceUltConditionVariableDestroy(void*);
-int APS5_VABI sceUltReaderWriterLockDestroy(void*);
-int APS5_VABI sceUltGetConditionVariableInfo(void*, UltConditionVariableInfo*, UltWaitingThreadInfo*, std::uint32_t);
-}
-
 static constexpr int Ok = 0;
 static constexpr int Null = -2139029503;
 static constexpr int Alignment = -2139029502;
@@ -123,6 +89,7 @@ static void Validation() {
     bool threwInfo = false;
     try {
         sceUltGetConditionVariableInfo(nullptr, nullptr, nullptr, 0);
+
     } catch (const std::runtime_error&) {
         threwInfo = true;
     }
@@ -139,7 +106,7 @@ static void TryJoin() {
     std::uint8_t optParam[128];
     std::memset(optParam, 0xff, sizeof(optParam));
     CHECK(_sceUltUlthreadRuntimeOptParamInitialize(nullptr, 0) == Null);
-    CHECK(_sceUltUlthreadRuntimeOptParamInitialize(optParam, 0) == Ok && optParam[0] == 0);
+    CHECK(_sceUltUlthreadRuntimeOptParamInitialize(reinterpret_cast<UltUlthreadRuntimeOptParam*>(optParam), 0) == Ok && optParam[0] == 0);
     CHECK(_sceUltUlthreadRuntimeCreate(&runtime, "runtime", 1, 1, nullptr, nullptr) == Ok);
     CHECK(_sceUltUlthreadCreate(&thread, "parked", Parked, 0x3C, nullptr, 0, &runtime, nullptr) == Ok);
     while (!gStarted.load(std::memory_order_acquire)) std::this_thread::yield();
@@ -217,29 +184,29 @@ static void UnderscoredCreate() {
     alignas(8) static std::uint8_t mutex[256];
     std::memset(mutexOptParam, 0xFF, sizeof(mutexOptParam));
     CHECK(_sceUltMutexOptParamInitialize(nullptr, 0) == Null);
-    CHECK(_sceUltMutexOptParamInitialize(mutexOptParam + 1, 0) == Alignment);
+    CHECK(_sceUltMutexOptParamInitialize(reinterpret_cast<UltMutexOptParam*>(mutexOptParam + 1), 0) == Alignment);
     CHECK(mutexOptParam[0] == 0xFF && mutexOptParam[127] == 0xFF);
-    CHECK(_sceUltMutexOptParamInitialize(mutexOptParam, 0x12345678) == Ok);
+    CHECK(_sceUltMutexOptParamInitialize(reinterpret_cast<UltMutexOptParam*>(mutexOptParam), 0x12345678) == Ok);
     UltMutexOptParam options{};
     std::memcpy(&options, mutexOptParam, sizeof(options));
     CHECK(options.header[0] == 0x6C696275 && options.header[1] == 0x6C746D61 && options.header[2] == 0x67696300);
     CHECK(options.buildVersion == 0x12345678 && options.attribute == 0);
     for (std::size_t index = 16; index < 128; ++index) CHECK(mutexOptParam[index] == 0);
     for (std::size_t index = 128; index < sizeof(mutexOptParam); ++index) CHECK(mutexOptParam[index] == 0xFF);
-    CHECK(_sceUltMutexCreate(mutex, nullptr, pool, mutexOptParam) == Null);
-    CHECK(_sceUltMutexCreate(mutex, "mutex", nullptr, mutexOptParam) == Null);
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam + 1) == Alignment);
+    CHECK(_sceUltMutexCreate(mutex, nullptr, pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Null);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", nullptr, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Null);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam + 1)) == Alignment);
     mutexOptParam[127] = 1;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Invalid);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Invalid);
     mutexOptParam[127] = 0;
     mutexOptParam[16] = 2;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Invalid);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Invalid);
     mutexOptParam[16] = 0;
     mutexOptParam[0] = 0;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Invalid);
-    CHECK(_sceUltMutexOptParamInitialize(mutexOptParam, 0) == Ok);
-    CHECK(_sceUltMutexCreate(nullptr, "mutex", pool, mutexOptParam) == Null);
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Ok);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Invalid);
+    CHECK(_sceUltMutexOptParamInitialize(reinterpret_cast<UltMutexOptParam*>(mutexOptParam), 0) == Ok);
+    CHECK(_sceUltMutexCreate(nullptr, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Null);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Ok);
     CHECK(sceUltMutexLock(mutex) == Ok);
     CHECK(sceUltMutexLock(mutex) == State);
     std::thread foreignUnlock([&] { CHECK(sceUltMutexUnlock(mutex) == Permission); });
@@ -248,7 +215,7 @@ static void UnderscoredCreate() {
     CHECK(sceUltMutexUnlock(mutex) == Permission);
     CHECK(sceUltMutexDestroy(mutex) == Ok);
     mutexOptParam[16] = 1;
-    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, mutexOptParam) == Ok);
+    CHECK(_sceUltMutexCreate(mutex, "mutex", pool, reinterpret_cast<const UltMutexOptParam*>(mutexOptParam)) == Ok);
     CHECK(sceUltMutexLock(mutex) == Ok);
     CHECK(sceUltMutexLock(mutex) == Ok);
     CHECK(sceUltMutexUnlock(mutex) == Ok);
diff --git a/core/libs/tests/GuestUmtxOp.cpp b/core/libs/tests/GuestUmtxOp.cpp
index 97eef1d837..ee4befc68f 100644
--- a/core/libs/tests/GuestUmtxOp.cpp
+++ b/core/libs/tests/GuestUmtxOp.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Time/include/Time.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
@@ -8,12 +11,6 @@
 #include <thread>
 #include <vector>
 
-extern "C" {
-int APS5_VABI _umtx_op_nid_postfix(void* object, int operation, std::uint64_t value, void* sizeArgument, void* timeArgument);
-int* APS5_VABI __error_nid_postfix();
-int APS5_VABI clock_gettime_nid_postfix(int clockId, KernelTimespec* tp);
-}
-
 static constexpr int UMTX_OP_WAIT = 2;
 static constexpr int UMTX_OP_WAKE = 3;
 static constexpr int UMTX_OP_MUTEX_LOCK = 5;
diff --git a/core/libs/tests/GuestUnderscoreEntries.cpp b/core/libs/tests/GuestUnderscoreEntries.cpp
new file mode 100644
index 0000000000..6d62580b8f
--- /dev/null
+++ b/core/libs/tests/GuestUnderscoreEntries.cpp
@@ -0,0 +1,286 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/FileFlags.hpp"
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <csignal>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <set>
+#include <string>
+
+static_assert(sizeof(GuestSigaction) == 32);
+
+static_assert(sizeof(GuestMsghdr) == 48);
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "underscore entry check failed at line %d, errno %d\n", line, *__error_nid_postfix());
+        std::abort();
+    }
+}
+#define Require(value) Check((value), __LINE__)
+
+constexpr int Inet = 2;
+constexpr int Stream = 1;
+constexpr int Datagram = 2;
+constexpr int TcpLevel = 6;
+constexpr int TcpNoDelay = 1;
+constexpr int UnknownTcpOption = 0x7777;
+constexpr int OutOfBand = 0x1;
+constexpr int Truncated = 0x10;
+constexpr int Interrupted = 4;
+constexpr int BadDescriptor = 9;
+constexpr int BadAddress = 14;
+constexpr int Invalid = 22;
+constexpr int NoProtocolOption = 42;
+constexpr int NotSupported = 45;
+
+using Address = std::array<std::uint8_t, 16>;
+
+static bool Fails(std::int64_t result, int error) {
+    return result == -1 && *__error_nid_postfix() == error;
+}
+
+static bool Filled(const Address& address, std::uint8_t value) {
+    return std::all_of(address.begin(), address.end(), [value](std::uint8_t byte) { return byte == value; });
+}
+
+static void StreamSockets() {
+    const int listener = socket_nid_postfix(Inet, Stream, 0);
+    Require(listener >= 0);
+    Address address{16, Inet, 0, 0, 127, 0, 0, 1};
+    Require(_bind_nid_postfix(listener, address.data(), address.size()) == 0);
+    Require(Fails(_bind_nid_postfix(listener, address.data(), address.size()), Invalid));
+    Require(_listen_nid_postfix(listener, 4) == 0);
+    std::uint32_t size = address.size();
+    Require(_getsockname_nid_postfix(listener, address.data(), &size) == 0 && size == 16);
+    Require(address[0] == 16 && address[1] == Inet && (address[2] != 0 || address[3] != 0) && address[4] == 127 && address[7] == 1);
+
+    const int client = socket_nid_postfix(Inet, Stream, 0);
+    Require(client >= 0);
+    Require(Fails(_accept_nid_postfix(client, nullptr, nullptr), Invalid));
+    Require(_connect_nid_postfix(client, address.data(), address.size()) == 0);
+    Address peer;
+    peer.fill(0xa5);
+    size = peer.size();
+    const int accepted = _accept_nid_postfix(listener, peer.data(), &size);
+    Require(accepted >= 0 && size == 16);
+    Address local{};
+    size = local.size();
+    Require(_getsockname_nid_postfix(client, local.data(), &size) == 0 && size == 16 && local == peer);
+    Address remote{};
+    size = remote.size();
+    Require(_getpeername_nid_postfix(client, remote.data(), &size) == 0 && size == 16 && remote == address);
+    remote.fill(0);
+    size = remote.size();
+    Require(_getpeername_nid_postfix(accepted, remote.data(), &size) == 0 && size == 16 && remote == local);
+
+    int value = -1;
+    std::uint32_t valueSize = sizeof(value);
+    Require(_getsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &value, &valueSize) == 0 && value == 0 && valueSize == sizeof(value));
+    const int enabled = 1;
+    Require(_setsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &enabled, sizeof(enabled)) == 0);
+    valueSize = sizeof(value);
+    Require(_getsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &value, &valueSize) == 0 && value == 4 && valueSize == sizeof(value));
+    Require(Fails(_setsockopt_nid_postfix(client, TcpLevel, UnknownTcpOption, &enabled, sizeof(enabled)), NoProtocolOption));
+
+    const char text[] = "underscore stream";
+    Require(_sendto_nid_postfix(client, text, sizeof(text), 0, nullptr, 0) == sizeof(text));
+    char received[sizeof(text)]{};
+    Address sender;
+    sender.fill(0xa5);
+    std::uint32_t senderSize = sender.size();
+    Require(_recvfrom_nid_postfix(accepted, received, sizeof(received), 0, sender.data(), &senderSize) == sizeof(text));
+    Require(std::memcmp(received, text, sizeof(text)) == 0 && senderSize == 0 && Filled(sender, 0xa5));
+
+    for (const int descriptor : {accepted, client, listener}) Require(close_nid_postfix(descriptor) == 0);
+    Address untouched;
+    untouched.fill(0xa5);
+    std::uint32_t untouchedSize = 7;
+    value = -1;
+    Require(Fails(_getsockname_nid_postfix(listener, untouched.data(), &untouchedSize), BadDescriptor));
+    Require(Fails(_getpeername_nid_postfix(client, untouched.data(), &untouchedSize), BadDescriptor));
+    Require(Fails(_accept_nid_postfix(listener, untouched.data(), &untouchedSize), BadDescriptor));
+    Require(Fails(_getsockopt_nid_postfix(client, TcpLevel, TcpNoDelay, &value, &untouchedSize), BadDescriptor));
+    Require(Fails(_listen_nid_postfix(listener, 4), BadDescriptor));
+    Require(Filled(untouched, 0xa5) && untouchedSize == 7 && value == -1);
+}
+
+static void DatagramSockets() {
+    const int receiver = socket_nid_postfix(Inet, Datagram, 0);
+    const int sender = socket_nid_postfix(Inet, Datagram, 0);
+    Require(receiver >= 0 && sender >= 0);
+    Address destination{16, Inet, 0, 0, 127, 0, 0, 1};
+    Require(_bind_nid_postfix(receiver, destination.data(), destination.size()) == 0);
+    std::uint32_t size = destination.size();
+    Require(_getsockname_nid_postfix(receiver, destination.data(), &size) == 0 && size == 16 && (destination[2] != 0 || destination[3] != 0));
+    Require(Fails(_listen_nid_postfix(receiver, 1), NotSupported));
+
+    const char datagram[] = "underscore datagram";
+    Require(Fails(_sendto_nid_postfix(sender, datagram, sizeof(datagram), OutOfBand, destination.data(), destination.size()), NotSupported));
+    Require(_sendto_nid_postfix(sender, datagram, sizeof(datagram), 0, destination.data(), destination.size()) == sizeof(datagram));
+    Address senderName{};
+    size = senderName.size();
+    Require(_getsockname_nid_postfix(sender, senderName.data(), &size) == 0 && size == 16);
+    char buffer[32]{};
+    Address source{};
+    size = source.size();
+    Require(_recvfrom_nid_postfix(receiver, buffer, sizeof(buffer), 0, source.data(), &size) == sizeof(datagram));
+    Require(std::strcmp(buffer, datagram) == 0 && size == 16 && source[0] == 16 && source[1] == Inet);
+    Require(source[2] == senderName[2] && source[3] == senderName[3] && source[4] == 127 && source[7] == 1);
+
+    char head[] = "scatter ";
+    char tail[] = "gather";
+    KernelIovec parts[2]{{head, 8}, {tail, 6}};
+    GuestMsghdr outgoing{destination.data(), static_cast<std::uint32_t>(destination.size()), parts, 2, nullptr, 0, 0};
+    Require(_sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
+    char first[4]{};
+    char second[16]{};
+    KernelIovec pieces[2]{{first, sizeof(first)}, {second, sizeof(second)}};
+    source.fill(0);
+    GuestMsghdr incoming{source.data(), static_cast<std::uint32_t>(source.size()), pieces, 2, nullptr, 0, -1};
+    Require(_recvmsg_nid_postfix(receiver, &incoming, 0) == 14);
+    Require(std::memcmp(first, "scat", 4) == 0 && std::memcmp(second, "ter gather", 10) == 0);
+    Require(incoming.flags == 0 && incoming.nameLength == 16 && source[2] == senderName[2] && source[3] == senderName[3] && source[4] == 127);
+    Require(_sendmsg_nid_postfix(sender, &outgoing, 0) == 14);
+    char shortBuffer[5]{};
+    KernelIovec single{shortBuffer, sizeof(shortBuffer)};
+    GuestMsghdr truncated{nullptr, 0, &single, 1, nullptr, 0, 0};
+    Require(_recvmsg_nid_postfix(receiver, &truncated, 0) == 5 && std::memcmp(shortBuffer, "scatt", 5) == 0 && truncated.flags == Truncated);
+    Require(Fails(_sendmsg_nid_postfix(sender, nullptr, 0), BadAddress));
+    Require(Fails(_recvmsg_nid_postfix(receiver, nullptr, 0), BadAddress));
+
+    Require(Fails(_connect_nid_postfix(sender, destination.data(), 15), Invalid));
+    Require(_connect_nid_postfix(sender, destination.data(), destination.size()) == 0);
+    Address peer{};
+    size = peer.size();
+    Require(_getpeername_nid_postfix(sender, peer.data(), &size) == 0 && size == 16 && peer == destination);
+    Require(_sendto_nid_postfix(sender, datagram, sizeof(datagram), 0, nullptr, 0) == sizeof(datagram));
+    std::memset(buffer, 0, sizeof(buffer));
+    Require(_recvfrom_nid_postfix(receiver, buffer, sizeof(buffer), 0, nullptr, nullptr) == sizeof(datagram) && std::strcmp(buffer, datagram) == 0);
+
+    Require(close_nid_postfix(receiver) == 0 && close_nid_postfix(sender) == 0);
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    source.fill(0xa5);
+    size = 9;
+    const int enabled = 1;
+    Require(Fails(_recvfrom_nid_postfix(receiver, buffer, sizeof(buffer), 0, source.data(), &size), BadDescriptor));
+    Require(Fails(_recvmsg_nid_postfix(receiver, &incoming, 0), BadDescriptor));
+    Require(Fails(_sendto_nid_postfix(sender, datagram, sizeof(datagram), 0, nullptr, 0), BadDescriptor));
+    Require(Fails(_sendmsg_nid_postfix(sender, &outgoing, 0), BadDescriptor));
+    Require(Fails(_bind_nid_postfix(receiver, destination.data(), destination.size()), BadDescriptor));
+    Require(Fails(_connect_nid_postfix(sender, destination.data(), destination.size()), BadDescriptor));
+    Require(Fails(_setsockopt_nid_postfix(sender, TcpLevel, TcpNoDelay, &enabled, sizeof(enabled)), BadDescriptor));
+    Require(std::all_of(std::begin(buffer), std::end(buffer), [](char byte) { return byte == 0x5a; }));
+    Require(Filled(source, 0xa5) && size == 9);
+}
+
+static std::set<std::string> Names(const char* records, int bytes) {
+    std::set<std::string> names;
+    for (int offset = 0; offset < bytes;) {
+        std::uint16_t recordLength = 0;
+        std::memcpy(&recordLength, records + offset + 4, sizeof(recordLength));
+        Require(recordLength >= 12 && offset + recordLength <= bytes);
+        names.emplace(records + offset + 8, static_cast<std::uint8_t>(records[offset + 7]));
+        offset += recordLength;
+    }
+    return names;
+}
+
+static void DirectoryEntries() {
+    const auto root = std::filesystem::path("anyps5-underscore-entries-test-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directory(root));
+    { std::ofstream stream(root / "entry"); }
+    const int directory = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(directory >= 0);
+    std::array<char, 4096> records{};
+    std::int64_t base = -1;
+    const int read = _getdirentries_nid_postfix(directory, records.data(), static_cast<int>(records.size()), &base);
+    Require(read > 0 && base == 0);
+    const std::set<std::string> listed{".", "..", "entry"};
+    Require(Names(records.data(), read) == listed);
+    Require(sceKernelLseek(directory, 0, 0) == 0);
+    std::array<char, 4096> expected{};
+    std::int64_t expectedBase = -1;
+    Require(getdirentries_nid_postfix(directory, expected.data(), static_cast<int>(expected.size()), &expectedBase) == read);
+    Require(expectedBase == base && std::memcmp(expected.data(), records.data(), static_cast<std::size_t>(read)) == 0);
+    std::int64_t end = -1;
+    Require(_getdirentries_nid_postfix(directory, records.data(), static_cast<int>(records.size()), &end) == 0 && end > 0);
+
+    records.fill(0x5a);
+    std::int64_t untouched = 1234;
+    Require(Fails(_getdirentries_nid_postfix(directory, records.data(), 0, &untouched), Invalid));
+    Require(Fails(_getdirentries_nid_postfix(directory, nullptr, 64, &untouched), BadAddress));
+    Require(sceKernelClose(directory) == 0);
+    Require(Fails(_getdirentries_nid_postfix(directory, records.data(), static_cast<int>(records.size()), &untouched), BadDescriptor));
+    Require(untouched == 1234 && std::all_of(records.begin(), records.end(), [](char byte) { return byte == 0x5a; }));
+    std::filesystem::remove_all(root);
+}
+
+volatile std::sig_atomic_t received = 0;
+
+void APS5_VABI Handler(int value) {
+    received = value;
+}
+
+static bool Same(const GuestSigaction& left, const GuestSigaction& right) {
+    return left.handler == right.handler && left.flags == right.flags && std::memcmp(&left.mask, &right.mask, sizeof(left.mask)) == 0;
+}
+
+static void Signals() {
+    const auto handler = reinterpret_cast<std::uintptr_t>(Handler);
+    const GuestSigaction term{handler, 0, {{0x4000, 0, 0, 0x80000000u}}};
+    GuestSigaction initial{};
+    Require(_sigaction_nid_postfix(15, nullptr, &initial) == 0);
+    GuestSigaction previous;
+    std::memset(&previous, 0xa5, sizeof(previous));
+    Require(_sigaction_nid_postfix(15, &term, &previous) == 0 && Same(previous, initial));
+    received = 0;
+    Require(raise_nid_postfix(15) == 0 && received == 15);
+    GuestSigaction current;
+    std::memset(&current, 0xa5, sizeof(current));
+    Require(_sigaction_nid_postfix(15, nullptr, &current) == 0 && Same(current, term));
+
+    GuestSigaction untouched;
+    std::memset(&untouched, 0xa5, sizeof(untouched));
+    for (const int invalid : {0, 129}) {
+        std::memset(&current, 0xa5, sizeof(current));
+        Require(Fails(_sigaction_nid_postfix(invalid, &term, &current), Invalid) && std::memcmp(&current, &untouched, sizeof(current)) == 0);
+    }
+    for (const int fixed : {9, 17}) {
+        std::memset(&current, 0xa5, sizeof(current));
+        Require(Fails(_sigaction_nid_postfix(fixed, &term, &current), Invalid) && std::memcmp(&current, &untouched, sizeof(current)) == 0);
+    }
+    Require(_sigaction_nid_postfix(15, &initial, &current) == 0 && Same(current, term));
+
+    const GuestSigaction user{handler, 0, {}};
+    GuestSigaction initialUser{};
+    Require(_sigaction_nid_postfix(30, &user, &initialUser) == 0);
+    const GuestSignalSet blocked{{1u << 29, 0, 0, 0}};
+    const GuestSignalSet empty{{0, 0, 0, 0}};
+    GuestSignalSet saved{};
+    Require(sigprocmask_nid_postfix(3, &blocked, &saved) == 0);
+    received = 0;
+    Require(raise_nid_postfix(30) == 0 && received == 0);
+    Require(Fails(_sigsuspend_nid_postfix(&empty), Interrupted) && received == 30);
+    GuestSignalSet restored{};
+    Require(sigprocmask_nid_postfix(1, nullptr, &restored) == 0 && std::memcmp(&restored, &blocked, sizeof(restored)) == 0);
+    Require(sigprocmask_nid_postfix(3, &saved, nullptr) == 0);
+    Require(_sigaction_nid_postfix(30, &initialUser, nullptr) == 0);
+}
+
+int main() {
+    StreamSockets();
+    DatagramSockets();
+    DirectoryEntries();
+    Signals();
+}
diff --git a/core/libs/tests/GuestUnwindModuleInfo.cpp b/core/libs/tests/GuestUnwindModuleInfo.cpp
index d0519e368b..d863dcfea1 100644
--- a/core/libs/tests/GuestUnwindModuleInfo.cpp
+++ b/core/libs/tests/GuestUnwindModuleInfo.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "tests/GuestUnwindModuleInfoFixture.hpp"
 #include <cstdint>
@@ -9,17 +10,13 @@
 #include <windows.h>
 #include <psapi.h>
 
-extern "C" int APS5_VABI sceKernelGetModuleInfoForUnwind(uint64_t addr, int flags, ModuleInfoForUnwind* info);
-extern "C" void* APS5_VABI dlopen_nid_postfix(const char*, int);
-extern "C" void* APS5_VABI dlsym_nid_postfix(void*, const char*);
-extern "C" int APS5_VABI dlclose_nid_postfix(void*);
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static bool Throws(std::uint64_t address) {
     ModuleInfoForUnwind info{};
     try {
         sceKernelGetModuleInfoForUnwind(address, 0, &info);
+
     } catch (const std::runtime_error&) {
         return true;
     }
diff --git a/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp b/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
index 222fa17660..da327fc32d 100644
--- a/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
+++ b/core/libs/tests/GuestUnwindModuleInfoFailureLinux.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <cstdint>
@@ -5,8 +6,6 @@
 #include <stdexcept>
 #include <string_view>
 
-extern "C" int APS5_VABI sceKernelGetModuleInfoForUnwind(std::uint64_t address, int flags, ModuleInfoForUnwind* info);
-
 static std::uint64_t expectedAddress = 0;
 static int calls = 0;
 
@@ -16,7 +15,7 @@ static void Require(bool value, const char* message) {
 
 extern "C" int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info) {
     Require(address == expectedAddress, "module lookup received the wrong address");
-    Require(flags == 2, "module lookup received the wrong flags");
+    Require(flags == 1, "module lookup received the wrong flags");
     Require(info != nullptr && info->st_size == sizeof(ModuleInfoEx), "module lookup received the wrong structure size");
     ++calls;
     return SCE_KERNEL_ERROR_ESRCH;
@@ -29,6 +28,7 @@ int main() {
         bool threw = false;
         try {
             sceKernelGetModuleInfoForUnwind(expectedAddress, 1, &info);
+
         } catch (const std::runtime_error& error) {
             threw = std::string_view(error.what()) == "sceKernelGetModuleInfoForUnwind: failed to query guest module information";
         }
diff --git a/core/libs/tests/GuestUnwindModuleInfoLinux.cpp b/core/libs/tests/GuestUnwindModuleInfoLinux.cpp
index c7c126b26d..22aae73eb4 100644
--- a/core/libs/tests/GuestUnwindModuleInfoLinux.cpp
+++ b/core/libs/tests/GuestUnwindModuleInfoLinux.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -5,13 +6,6 @@
 #include <link.h>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceKernelGetModuleInfoForUnwind(uint64_t addr, int flags, ModuleInfoForUnwind* info);
-void* APS5_VABI dlopen_nid_postfix(const char* path, int flags);
-void* APS5_VABI dlsym_nid_postfix(void* handle, const char* name);
-int APS5_VABI dlclose_nid_postfix(void* handle);
-}
-
 static void Require(bool value, const char* message) {
     if (!value) throw std::runtime_error(message);
 }
diff --git a/core/libs/tests/GuestUpdateEnv.cpp b/core/libs/tests/GuestUpdateEnv.cpp
new file mode 100644
index 0000000000..5de6f53321
--- /dev/null
+++ b/core/libs/tests/GuestUpdateEnv.cpp
@@ -0,0 +1,275 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <barrier>
+#include <csignal>
+#include <stdexcept>
+#include <thread>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <xmmintrin.h>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+struct Environment {
+    std::array<std::uint32_t,7> x87;
+    std::uint32_t mxcsr;
+};
+static_assert(sizeof(Environment)==32 && offsetof(Environment,mxcsr)==28);
+using UpdateEnvironment=int (APS5_VABI*)(const Environment*);
+
+UpdateEnvironment updateEnvironment;
+
+void Require(bool condition,const char* message) {
+    if(!condition) { std::fprintf(stderr,"feupdateenv: %s\n",message); std::exit(1); }
+}
+Environment Read() {
+    Environment result;
+    asm volatile("fnstenv %0\n\tfldcw %0" : "=m"(result.x87));
+    result.mxcsr=_mm_getcsr();
+    return result;
+}
+void Write(const Environment& value) {
+    asm volatile("fldenv %0" : : "m"(value.x87) : "st","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)");
+    _mm_setcsr(value.mxcsr);
+}
+bool Same(const Environment& a,const Environment& b){return a.x87==b.x87 && a.mxcsr==b.mxcsr;}
+void Matrix() {
+    const auto original=Read();
+    auto clean=original;
+    clean.x87[0]|=0x3f;
+    clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    unsigned cases=0;
+    for(unsigned x87=0;x87<64;++x87)
+        for(unsigned sse=0;sse<64;++sse)
+            for(unsigned pattern=0;pattern<4;++pattern)
+                for(unsigned rounding=0;rounding<16;++rounding) {
+                    auto saved=clean;
+                    constexpr unsigned precisions[]{0u,0x200u,0x300u,0u};
+                    saved.x87[0]=(saved.x87[0]&~0x300u)|precisions[pattern];
+                    saved.x87[0]=(saved.x87[0]&~0xc00u)|((rounding&3)<<10);
+                    saved.mxcsr=(saved.mxcsr&~0x6000u)|((rounding>>2)<<13);
+                    const unsigned savedX87=pattern==0?0:pattern==1?0x15:pattern==2?0x2a:0x3f;
+                    const unsigned savedSse=pattern==0?0x3f:pattern==1?0x2a:pattern==2?0x15:0;
+                    saved.x87[1]|=savedX87;
+                    saved.mxcsr|=savedSse;
+                    Write(saved);
+                    saved=Read();
+                    auto pending=clean;
+                    pending.x87[1]|=x87;
+                    pending.mxcsr|=sse;
+                    Write(pending);
+                    const auto input=saved;
+                    *__error_nid_postfix()=123;
+                    const int result=updateEnvironment(&saved);
+                    const auto after=Read();
+                    const int error=*__error_nid_postfix();
+                    Write(clean);
+                    auto expected=input;
+                    expected.x87[1]|=x87|sse;
+                    expected.mxcsr|=x87|sse;
+                    Require(result==0 && error==123,"return/errno");
+                    Require(after.x87==expected.x87 && after.mxcsr==expected.mxcsr,"restore saved controls and raise old union in both units");
+                    Require(std::memcmp(&input,&saved,sizeof(input))==0,"input unchanged");
+                    ++cases;
+                }
+    Write(original);
+    std::printf("feupdateenv: %u flag/rounding combinations passed\n",cases);
+}
+
+void TagsAndPointers() {
+    const auto entry=Read();
+    auto clean=entry;
+    clean.x87[0]|=0x3f; clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    Write(clean);
+    const auto original=Read();
+    asm volatile("fninit\n\tfld1\n\tfldpi" : : : "st","st(1)");
+    const auto desired=Read();
+    asm volatile("fninit" : : : "st","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)");
+    const int result=updateEnvironment(&desired);
+    const auto after=Read();
+    Write(original);
+    Require(result==0 && Same(after,desired),"nonempty x87 tag/TOP and instruction pointer restored");
+    GuestFloatingPointEnvironment guestSaved;
+    Require(fegetenv_nid_postfix(&guestSaved)==0,"save using existing guest fegetenv");
+    asm volatile("fninit" : : : "st","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)");
+    Environment saved;
+    std::memcpy(&saved, &guestSaved, sizeof(saved));
+    Require(updateEnvironment(&saved)==0,"restore guest fegetenv output");
+    const auto restored=Read();
+    Write(original);
+    Require(Same(saved,restored),"guest fegetenv round trip");
+    Write(entry);
+}
+
+void BoundsAndErrors() {
+    const auto entry=Read();
+    auto clean=entry;
+    clean.x87[0]|=0x3f; clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    Write(clean);
+    const auto original=Read();
+#ifdef _WIN32
+    SYSTEM_INFO info{};
+    GetSystemInfo(&info);
+    const auto page=static_cast<std::size_t>(info.dwPageSize);
+    auto* memory=static_cast<unsigned char*>(VirtualAlloc(nullptr,2*page,MEM_RESERVE|MEM_COMMIT,PAGE_READWRITE));
+    Require(memory!=nullptr,"allocate guard pages");
+    DWORD previous;
+    Require(VirtualProtect(memory+page,page,PAGE_NOACCESS,&previous)!=0,"protect trailing page");
+#else
+    const auto page=static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+    auto* memory=static_cast<unsigned char*>(mmap(nullptr,2*page,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0));
+    Require(memory!=MAP_FAILED,"allocate guard pages");
+    Require(mprotect(memory+page,page,PROT_NONE)==0,"protect trailing page");
+#endif
+    auto* end=reinterpret_cast<Environment*>(memory+page-sizeof(Environment));
+    std::memcpy(end,&original,sizeof(original));
+#ifdef _WIN32
+    Require(VirtualProtect(memory,page,PAGE_READONLY,&previous)!=0,"input read-only");
+#else
+    Require(mprotect(memory,page,PROT_READ)==0,"input read-only");
+#endif
+    const int result=updateEnvironment(end);
+    const auto after=Read();
+    Require(result==0 && Same(after,original),"exact32-byte read at guard-page boundary");
+#ifdef _WIN32
+    Require(VirtualFree(memory,0,MEM_RELEASE)!=0,"release guard pages");
+#else
+    Require(munmap(memory,2*page)==0,"release guard pages");
+#endif
+    bool rejected=false;
+    *__error_nid_postfix()=123;
+    try { updateEnvironment(nullptr); } catch(const std::invalid_argument&) { rejected=true; }
+    Require(rejected && Same(Read(),original) && *__error_nid_postfix()==123,"null rejected without state or errno change");
+    alignas(16) std::array<std::uint32_t,128> extended;
+    asm volatile("fxsave %0" : "=m"(extended));
+    const auto supported=extended[7] ? extended[7] : 0xffbfu;
+    for(unsigned bit=0;bit<32;++bit) {
+        const auto reserved=1u<<bit;
+        if((supported&reserved)!=0) continue;
+        auto desired=original;
+        desired.x87[0]^=0xc00;
+        desired.mxcsr|=reserved;
+        rejected=false;
+        try { updateEnvironment(&desired); } catch(const std::invalid_argument&) { rejected=true; }
+        Require(rejected && Same(Read(),original) && *__error_nid_postfix()==123,"host-unsupported MXCSR rejected before x87 changes");
+    }
+    Write(entry);
+}
+
+void MasksAndThreads() {
+    const auto original=Read();
+    auto clean=original;
+    clean.x87[0]|=0x3f; clean.x87[1]&=~0xffu;
+    clean.mxcsr=(clean.mxcsr&~0x3fu)|(0x3f<<7);
+    for(unsigned a=0;a<64;++a) for(unsigned b=0;b<64;++b) {
+        auto desired=clean;
+        desired.x87[0]=(desired.x87[0]&~0x3fu)|a;
+        desired.mxcsr=(desired.mxcsr&~(0x3fu<<7))|(b<<7);
+        Write(clean);
+        Require(updateEnvironment(&desired)==0,"independent exception masks");
+        const auto actual=Read(); Write(clean);
+        Require(Same(actual,desired),"exception masks preserved");
+    }
+    alignas(16) std::array<std::uint32_t,128> state;
+    asm volatile("fxsave %0" : "=m"(state));
+    const auto supported=state[7]?state[7]:0xffbfu;
+    for(unsigned mode:{0u,0x40u,0x8000u,0x8040u}) {
+        if(mode&~supported) continue;
+        auto desired=clean; desired.mxcsr=(desired.mxcsr&~0x8040u)|mode;
+        Require(updateEnvironment(&desired)==0,"supported DAZ/FTZ return");
+        const auto actual=Read(); Write(clean);
+        Require(Same(actual,desired),"supported DAZ/FTZ restored");
+    }
+    std::barrier ready(2);
+    auto worker=[&](unsigned rounding,unsigned flags) {
+        const auto entry=Read();
+        auto desired=clean;
+        desired.x87[0]=(desired.x87[0]&~0xc00u)|(rounding<<10);
+        desired.mxcsr=(desired.mxcsr&~0x6000u)|(rounding<<13);
+        auto pending=clean; pending.mxcsr|=flags;
+        ready.arrive_and_wait();
+        Write(pending);
+        *__error_nid_postfix()=static_cast<int>(flags);
+        const int result=updateEnvironment(&desired);
+        const int error=*__error_nid_postfix();
+        const auto after=Read();
+        ready.arrive_and_wait();
+        Write(entry);
+        desired.x87[1]|=flags; desired.mxcsr|=flags;
+        Require(result==0 && error==static_cast<int>(flags),"thread return/errno");
+        Require(Same(after,desired),"thread environment and flag union");
+    };
+    std::thread a(worker,1,4),b(worker,2,8);a.join();b.join();
+    Write(original);
+}
+volatile std::sig_atomic_t entered=0;
+#ifdef _WIN32
+unsigned expectedFlag;
+DWORD expectedException;
+LONG CALLBACK Trap(EXCEPTION_POINTERS* exception) {
+    const auto& state=exception->ContextRecord->FltSave;
+    const auto active=state.StatusWord&~state.ControlWord&0x3f;
+    const auto code=exception->ExceptionRecord->ExceptionCode;
+    const bool denormal=expectedFlag==2 && code==EXCEPTION_FLT_INVALID_OPERATION;
+    if(entered && active==expectedFlag && (code==expectedException || denormal)) std::_Exit(0);
+    return EXCEPTION_CONTINUE_SEARCH;
+}
+#else
+void Trap(int){std::_Exit(entered?0:1);}
+#endif
+void Pending(unsigned bit,unsigned source) {
+    Require(bit<6 && source<3,"trap arguments");
+#ifdef _WIN32
+    constexpr DWORD codes[]{EXCEPTION_FLT_INVALID_OPERATION,EXCEPTION_FLT_DENORMAL_OPERAND,EXCEPTION_FLT_DIVIDE_BY_ZERO,EXCEPTION_FLT_OVERFLOW,EXCEPTION_FLT_UNDERFLOW,EXCEPTION_FLT_INEXACT_RESULT};
+    expectedFlag=1u<<bit;expectedException=codes[bit];
+    Require(AddVectoredExceptionHandler(1,Trap)!=nullptr,"install trap handler");
+#else
+    Require(std::signal(SIGFPE,Trap)!=SIG_ERR,"install trap handler");
+#endif
+    auto desired=Read();
+    desired.x87[0]=(desired.x87[0]|0x3f)&~(1u<<bit);
+    desired.x87[1]&=~0xffu;
+    desired.mxcsr=(desired.mxcsr&~0x3fu)|(0x3f<<7);
+    auto pending=desired;pending.x87[0]|=0x3f;
+    if(source==0) pending.x87[1]|=1u<<bit;
+    else if(source==1) pending.mxcsr|=1u<<bit;
+    else desired.x87[1]|=1u<<bit;
+    Write(pending);
+    entered=1;
+    updateEnvironment(&desired);
+    entered=0;
+    Require(false,"enabled pending exception did not trap during feupdateenv");
+}
+
+int main(int argc,char** argv) {
+    Require(argc==2 || argc==4,"expected libc path and optional trap bit/source");
+#ifdef _WIN32
+    const auto library=LoadLibraryA(argv[1]);
+    Require(library!=nullptr,"load libc");
+    updateEnvironment=reinterpret_cast<UpdateEnvironment>(GetProcAddress(library,"feupdateenv_nid_postfix"));
+#else
+    const auto library=dlopen(argv[1],RTLD_NOW);
+    Require(library!=nullptr,"load libc");
+    updateEnvironment=reinterpret_cast<UpdateEnvironment>(dlsym(library,"feupdateenv_nid_postfix"));
+#endif
+    Require(updateEnvironment!=nullptr,"export is missing");
+    if(argc==4) Pending(static_cast<unsigned>(std::atoi(argv[2])),static_cast<unsigned>(std::atoi(argv[3])));
+    Matrix(); TagsAndPointers(); BoundsAndErrors(); MasksAndThreads();
+#ifdef _WIN32
+    Require(FreeLibrary(library)!=0,"release library lookup handle");
+#else
+    Require(dlclose(library)==0,"release library lookup handle");
+#endif
+}
diff --git a/core/libs/tests/GuestUsbStorage.cpp b/core/libs/tests/GuestUsbStorage.cpp
new file mode 100644
index 0000000000..43a173d247
--- /dev/null
+++ b/core/libs/tests/GuestUsbStorage.cpp
@@ -0,0 +1,242 @@
+#include "prx/libSceUsbStorage/UsbStorage.hpp"
+
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <stdexcept>
+#include <string_view>
+
+namespace {
+
+int g_attr = 0;
+
+void APS5_VABI CallbackStub(const UsbStorageEvent*, void*) {}
+
+UsbStorageCallback Callback() {
+    return &CallbackStub;
+}
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "USBSTORAGE: %s\n", message);
+        std::abort();
+    }
+}
+
+void TestInitializeAndTerminate() {
+    Require(sceUsbStorageInit(nullptr) == 0, "initialize with a null attribute");
+    Require(sceUsbStorageInit(&g_attr) == 0, "initialize with an attribute");
+    Require(sceUsbStorageTerm() == 0, "terminate");
+    Require(sceUsbStorageInit(nullptr) == 0, "initialize after terminate");
+    Require(sceUsbStorageTerm() == 0, "terminate again");
+}
+
+void TestRegisterCallbacks() {
+    bool threw = false;
+    try {
+        sceUsbStorageRegisterCallback(1, Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallback not implemented";
+    }
+    Require(threw, "register callback of event type 1 did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageRegisterCallback(2, Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallback not implemented";
+    }
+    Require(threw, "register callback of event type 2 did not throw its marker");
+    Require(sceUsbStorageRegisterCallback(1, nullptr, nullptr) == UsbStorage::InvalidArgument, "register a null callback");
+    Require(sceUsbStorageRegisterCallback(0, Callback(), nullptr) == UsbStorage::InvalidArgument, "register callback of event type 0");
+    Require(sceUsbStorageRegisterCallback(3, Callback(), nullptr) == UsbStorage::InvalidArgument, "register callback of event type 3");
+    Require(sceUsbStorageRegisterCallback(-1, Callback(), nullptr) == UsbStorage::InvalidArgument, "register callback of a negative event type");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallback(1, Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallback not implemented";
+    }
+    Require(threw, "unregister callback of event type 1 did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallback(2, Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallback not implemented";
+    }
+    Require(threw, "unregister callback of event type 2 did not throw its marker");
+    Require(sceUsbStorageUnregisterCallback(1, nullptr) == UsbStorage::InvalidArgument, "unregister a null callback");
+    Require(sceUsbStorageUnregisterCallback(0, Callback()) == UsbStorage::InvalidArgument, "unregister callback of event type 0");
+}
+
+void TestMapCallbacks() {
+    bool threw = false;
+    try {
+        sceUsbStorageRegisterCallbackForMapAvailable(0, "/data", Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallbackForMapAvailable not implemented";
+    }
+    Require(threw, "register map-available callback did not throw its marker");
+    Require(sceUsbStorageRegisterCallbackForMapAvailable(0, nullptr, Callback(), nullptr) == UsbStorage::InvalidArgument, "register map-available callback with a null directory");
+    Require(sceUsbStorageRegisterCallbackForMapAvailable(0, "/data", nullptr, nullptr) == UsbStorage::InvalidArgument, "register a null map-available callback");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallbackForMapAvailable(0, "/data", Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallbackForMapAvailable not implemented";
+    }
+    Require(threw, "unregister map-available callback did not throw its marker");
+    Require(sceUsbStorageUnregisterCallbackForMapAvailable(0, nullptr, Callback()) == UsbStorage::InvalidArgument, "unregister map-available callback with a null directory");
+    Require(sceUsbStorageUnregisterCallbackForMapAvailable(0, "/data", nullptr) == UsbStorage::InvalidArgument, "unregister a null map-available callback");
+    threw = false;
+    try {
+        sceUsbStorageRegisterCallbackForMapUnavailable(0, "/data", Callback(), nullptr);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRegisterCallbackForMapUnavailable not implemented";
+    }
+    Require(threw, "register map-unavailable callback did not throw its marker");
+    Require(sceUsbStorageRegisterCallbackForMapUnavailable(0, nullptr, Callback(), nullptr) == UsbStorage::InvalidArgument, "register map-unavailable callback with a null directory");
+    Require(sceUsbStorageRegisterCallbackForMapUnavailable(0, "/data", nullptr, nullptr) == UsbStorage::InvalidArgument, "register a null map-unavailable callback");
+    threw = false;
+    try {
+        sceUsbStorageUnregisterCallbackForMapUnavailable(0, "/data", Callback());
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageUnregisterCallbackForMapUnavailable not implemented";
+    }
+    Require(threw, "unregister map-unavailable callback did not throw its marker");
+    Require(sceUsbStorageUnregisterCallbackForMapUnavailable(0, nullptr, Callback()) == UsbStorage::InvalidArgument, "unregister map-unavailable callback with a null directory");
+    Require(sceUsbStorageUnregisterCallbackForMapUnavailable(0, "/data", nullptr) == UsbStorage::InvalidArgument, "unregister a null map-unavailable callback");
+}
+
+void TestNoDevice() {
+    std::uint32_t devices[4]{0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a, 0x5a5a5a5a};
+    std::int32_t count = -1;
+    Require(sceUsbStorageGetDeviceList(devices, &count) == 0, "get the device list");
+    Require(count == 0, "no usb storage device is attached");
+    Require(devices[0] == 0x5a5a5a5a && devices[3] == 0x5a5a5a5a, "the device list was written");
+    Require(sceUsbStorageGetDeviceList(nullptr, &count) == UsbStorage::InvalidArgument, "get the device list without a device array");
+    Require(sceUsbStorageGetDeviceList(devices, nullptr) == UsbStorage::InvalidArgument, "get the device list without a count");
+
+    std::uint8_t info[16];
+    std::memset(info, 0x5a, sizeof(info));
+    auto* const infoRecord = reinterpret_cast<UsbStorageDeviceInfo*>(info);
+    Require(sceUsbStorageGetDeviceInfo(0, infoRecord) == UsbStorage::DeviceNotFound, "get device info of device 0");
+    Require(sceUsbStorageGetDeviceInfo(1, infoRecord) == UsbStorage::DeviceNotFound, "get device info of device 1");
+    Require(info[0] == 0x5a && info[15] == 0x5a, "device info was written");
+    Require(sceUsbStorageGetDeviceInfo(0, nullptr) == UsbStorage::InvalidArgument, "get device info without an info buffer");
+
+    std::uint8_t exists = 1;
+    Require(sceUsbStorageIsExist(0, "/mnt/usb0", &exists) == true && exists == 0, "device 0 does not exist");
+    exists = 1;
+    Require(sceUsbStorageIsExist(1, nullptr, &exists) == true && exists == 0, "device 1 does not exist");
+    exists = 1;
+    Require(sceUsbStorageIsExist(0xffffffffu, "/mnt/usb0", &exists) == true && exists == 0, "no device id exists");
+}
+
+void TestMapRequests() {
+    char mountPoint[16];
+    std::uint64_t mountId = 0x5a5a5a5a5a5a5a5aull;
+    std::int32_t status = 0x5a5a5a5a;
+    std::memset(mountPoint, 0x5a, sizeof(mountPoint));
+    Require(sceUsbStorageRequestMap(0, "/data", 0, 0, mountPoint, &mountId) == UsbStorage::DeviceNotFound, "request a map of device 0");
+    Require(sceUsbStorageRequestMap(1, nullptr, 0, 0, nullptr, nullptr) == UsbStorage::DeviceNotFound, "request a map of device 1");
+    Require(mountId == 0x5a5a5a5a5a5a5a5aull && mountPoint[0] == static_cast<char>(0x5a), "the map request wrote its outputs");
+    std::memset(mountPoint, 0x5a, sizeof(mountPoint));
+    Require(sceUsbStorageRequestMapWSB(0, "/data", 0, 0, mountPoint, &status) == UsbStorage::DeviceNotFound, "request a WSB map of device 0");
+    Require(sceUsbStorageRequestMapWSB(0, nullptr, 0, 0, nullptr, nullptr) == UsbStorage::DeviceNotFound, "request a WSB map without a subpath");
+    Require(mountPoint[0] == static_cast<char>(0x5a) && status == 0x5a5a5a5a, "the WSB map request wrote its outputs");
+    Require(sceUsbStorageRequestUnmap(0, nullptr) == UsbStorage::InvalidArgument, "unmap a null directory");
+    bool threw = false;
+    try {
+        sceUsbStorageRequestUnmap(0, "/mnt/usb0");
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRequestUnmap not implemented";
+    }
+    Require(threw, "unmap a directory did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageRequestUnmap(7, "/mnt/usb7");
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageRequestUnmap not implemented";
+    }
+    Require(threw, "unmap a directory of another device did not throw its marker");
+}
+
+void TestGetdents() {
+    std::int32_t fd = -1;
+    std::uint64_t bufferSize = 0x5a5a5a5a5a5a5a5aull;
+    Require(sceUsbStorageGetdentsOpen(0, &fd, &bufferSize) == UsbStorage::DeviceNotFound, "open a getdents scan of device 0");
+    Require(sceUsbStorageGetdentsOpen(3, &fd, &bufferSize) == UsbStorage::DeviceNotFound, "open a getdents scan of device 3");
+    Require(fd == -1 && bufferSize == 0x5a5a5a5a5a5a5a5aull, "the getdents open wrote its outputs");
+    Require(sceUsbStorageGetdentsOpen(0, nullptr, &bufferSize) == UsbStorage::InvalidArgument, "open a getdents scan without a descriptor");
+    Require(sceUsbStorageGetdentsOpen(0, &fd, nullptr) == UsbStorage::InvalidArgument, "open a getdents scan without a buffer size");
+
+    std::uint8_t buffer[64];
+    std::uint64_t bytesRead = 0x5a5a5a5a5a5a5a5aull;
+    std::memset(buffer, 0x5a, sizeof(buffer));
+    Require(sceUsbStorageGetdentsRead(1, buffer, sizeof(buffer), &bytesRead) == UsbStorage::NotSupported, "read a getdents scan that was never opened");
+    Require(bytesRead == 0, "the getdents read did not answer zero bytes");
+    Require(buffer[0] == 0x5a, "the getdents read wrote the buffer");
+    Require(sceUsbStorageGetdentsRead(1, nullptr, sizeof(buffer), &bytesRead) == UsbStorage::InvalidArgument, "read a getdents scan without a buffer");
+    Require(sceUsbStorageGetdentsRead(1, buffer, sizeof(buffer), nullptr) == UsbStorage::InvalidArgument, "read a getdents scan without a byte count");
+
+    bool threw = false;
+    try {
+        sceUsbStorageGetdentsClose(1);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageGetdentsClose not implemented";
+    }
+    Require(threw, "close a getdents scan that was never opened did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageGetdentsClose(0);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageGetdentsClose not implemented";
+    }
+    Require(threw, "close descriptor 0 did not throw its marker");
+}
+
+void TestThrowingExports() {
+    char mountPoint[8]{};
+    bool threw = false;
+    try {
+        sceUsbStorageGetMountPointOfShellCore(0, mountPoint);
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageGetMountPointOfShellCore not implemented";
+    }
+    Require(threw, "get the mount point of shell core did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageClearFakeWriteProtection();
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageClearFakeWriteProtection not implemented";
+    }
+    Require(threw, "clear fake write protection did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageSetFakeMapLockForDebug();
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageSetFakeMapLockForDebug not implemented";
+    }
+    Require(threw, "set fake map lock for debug did not throw its marker");
+    threw = false;
+    try {
+        sceUsbStorageSetFakeWriteProtection();
+    } catch (const std::runtime_error& error) {
+        threw = std::string_view(error.what()) == "sceUsbStorageSetFakeWriteProtection not implemented";
+    }
+    Require(threw, "set fake write protection did not throw its marker");
+}
+
+}
+
+int main() {
+    TestInitializeAndTerminate();
+    TestRegisterCallbacks();
+    TestMapCallbacks();
+    TestNoDevice();
+    TestMapRequests();
+    TestGetdents();
+    TestThrowingExports();
+    return 0;
+}
diff --git a/core/libs/tests/GuestUsbStorageDialog.cpp b/core/libs/tests/GuestUsbStorageDialog.cpp
index e21bcc50eb..56615792bb 100644
--- a/core/libs/tests/GuestUsbStorageDialog.cpp
+++ b/core/libs/tests/GuestUsbStorageDialog.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUsbStorageDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
@@ -8,18 +9,6 @@
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include "prx/libSceUserService/UserService.hpp"
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* param);
-int APS5_VABI sceUserServiceTerminate();
-int APS5_VABI sceUsbStorageDialogInitialize(void);
-int APS5_VABI sceUsbStorageDialogOpen(const UsbStorageDialogParam* param);
-int APS5_VABI sceUsbStorageDialogUpdateStatus(void);
-int APS5_VABI sceUsbStorageDialogGetStatus(void);
-int APS5_VABI sceUsbStorageDialogGetResult(UsbStorageDialogResult* result);
-int APS5_VABI sceUsbStorageDialogClose(void);
-int APS5_VABI sceUsbStorageDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestUsbd.cpp b/core/libs/tests/GuestUsbd.cpp
index 59e59542b0..512bee8071 100644
--- a/core/libs/tests/GuestUsbd.cpp
+++ b/core/libs/tests/GuestUsbd.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceUsbd/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <chrono>
@@ -12,44 +13,6 @@
 
 namespace {
 
-struct UsbdTimeval {
-    std::int64_t seconds;
-    std::int64_t microseconds;
-};
-
-}
-
-extern "C" {
-std::int32_t APS5_VABI sceUsbdInit();
-void APS5_VABI sceUsbdExit();
-std::int64_t APS5_VABI sceUsbdGetDeviceList(void*** list);
-void APS5_VABI sceUsbdFreeDeviceList(void** list, std::int32_t unrefDevices);
-std::int32_t APS5_VABI sceUsbdHandleEventsTimeout(const UsbdTimeval* timeout);
-std::int32_t APS5_VABI sceUsbdOpen(void* device, void** deviceHandle);
-void APS5_VABI sceUsbdClose(void* deviceHandle);
-void* APS5_VABI sceUsbdRefDevice(void* device);
-void APS5_VABI sceUsbdUnrefDevice(void* device);
-std::uint8_t APS5_VABI sceUsbdGetBusNumber(void* device);
-std::uint8_t APS5_VABI sceUsbdGetDeviceAddress(void* device);
-std::int32_t APS5_VABI sceUsbdGetDeviceDescriptor(void* device, void* descriptor);
-std::int32_t APS5_VABI sceUsbdGetConfigDescriptor(void* device, std::uint8_t configIndex, void** config);
-std::int32_t APS5_VABI sceUsbdGetActiveConfigDescriptor(void* device, void** config);
-std::int32_t APS5_VABI sceUsbdClaimInterface(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdReleaseInterface(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdSetConfiguration(void* deviceHandle, std::int32_t configuration);
-std::int32_t APS5_VABI sceUsbdResetDevice(void* deviceHandle);
-std::int32_t APS5_VABI sceUsbdCheckConnected(void* deviceHandle);
-std::int32_t APS5_VABI sceUsbdKernelDriverActive(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdAttachKernelDriver(void* deviceHandle, std::int32_t interfaceNumber);
-std::int32_t APS5_VABI sceUsbdControlTransfer(void* deviceHandle, std::uint8_t requestType, std::uint8_t request, std::uint16_t value, std::uint16_t index, std::uint8_t* data, std::uint16_t length, std::uint32_t timeout);
-std::int32_t APS5_VABI sceUsbdGetStringDescriptor(void* deviceHandle, std::uint8_t descriptorIndex, std::uint16_t languageId, std::uint8_t* data, std::int32_t length);
-std::int32_t APS5_VABI sceUsbdSubmitTransfer(void* transfer);
-void* APS5_VABI sceUsbdAllocTransfer(std::int32_t isoPackets);
-void APS5_VABI sceUsbdFreeTransfer(void* transfer);
-void APS5_VABI sceUsbdFillInterruptTransfer(void* transfer, void* deviceHandle, std::uint8_t endpoint, std::uint8_t* buffer, std::int32_t length, void* callback, void* userData, std::uint32_t timeout);
-std::int32_t APS5_VABI sceUsbdCancelTransfer(void* transfer);
-std::int32_t APS5_VABI sceUsbdEventHandlingOk();
-void APS5_VABI sceUsbdFreeConfigDescriptor(void* config);
 }
 
 namespace {
@@ -73,26 +36,11 @@ bool Throws(TCall call) {
     return false;
 }
 
-struct HostTransfer {
-    void* deviceHandle;
-    std::uint8_t flags;
-    std::uint8_t endpoint;
-    std::uint8_t type;
-    std::uint32_t timeout;
-    std::int32_t status;
-    std::int32_t length;
-    std::int32_t actualLength;
-    void (APS5_VABI* callback)(HostTransfer*);
-    void* userData;
-    std::uint8_t* buffer;
-    std::int32_t numIsoPackets;
-};
-
-void APS5_VABI MarkDone(HostTransfer* transfer) {
+void APS5_VABI MarkDone(UsbdTransfer* transfer) {
     *static_cast<int*>(transfer->userData) += 1;
 }
 
-void APS5_VABI MarkDoneThenSignal(HostTransfer* transfer) {
+void APS5_VABI MarkDoneThenSignal(UsbdTransfer* transfer) {
     auto* notified = static_cast<std::atomic<bool>*>(transfer->userData);
     notified->store(true, std::memory_order_release);
 }
@@ -118,6 +66,7 @@ void Device() {
         if ((descriptor[8] | descriptor[9] << 8) == vendor && (descriptor[10] | descriptor[11] << 8) == product) device = sceUsbdRefDevice(list[index]);
     }
     sceUsbdFreeDeviceList(list, 1);
+
     Require(device != nullptr, "the APS5_USBD_DEVICE device was not listed");
     std::printf("device bus %u address %u\n", sceUsbdGetBusNumber(device), sceUsbdGetDeviceAddress(device));
     void* config = nullptr;
@@ -125,13 +74,21 @@ void Device() {
     const auto* raw = static_cast<const std::uint8_t*>(config);
     Require(raw[1] == 2 && raw[4] > 0, "active config descriptor is not a configuration with interfaces");
     const std::uint8_t interfaces = raw[4];
+    const std::uint8_t activeValue = raw[5];
     sceUsbdFreeConfigDescriptor(config);
+
     Require(Throws([&] { sceUsbdFreeConfigDescriptor(config); }), "a config descriptor was freed twice");
     Require(sceUsbdGetConfigDescriptor(device, 0, &config) == 0, "config descriptor 0 failed");
     sceUsbdFreeConfigDescriptor(config);
+    Require(sceUsbdGetConfigDescriptorByValue(device, activeValue, &config) == 0 && config != nullptr, "config descriptor by value failed");
+    Require(static_cast<const std::uint8_t*>(config)[5] == activeValue, "config descriptor by value has another configuration value");
+    sceUsbdFreeConfigDescriptor(config);
+    Require(sceUsbdGetConfigDescriptorByValue(device, 0, &config) == static_cast<std::int32_t>(0x80240005) && config == nullptr, "configuration value 0 was found");
     void* handle = nullptr;
     Require(sceUsbdOpen(device, &handle) == 0 && handle != nullptr, "opening the device failed");
     Require(sceUsbdCheckConnected(handle) == 0, "an open device was reported disconnected");
+    std::int32_t configuration = -1;
+    Require(sceUsbdGetConfiguration(handle, &configuration) == 0 && configuration == activeValue, "configuration differs from the active config descriptor");
     std::uint8_t text[256] = {};
     if (descriptor[15] != 0) {
         const std::int32_t length = sceUsbdGetStringDescriptor(handle, descriptor[15], 0x409, text, sizeof(text));
@@ -139,10 +96,31 @@ void Device() {
         std::string product_name;
         for (std::int32_t index = 2; index + 1 < length; index += 2) product_name += static_cast<char>(text[index]);
         std::printf("product \"%s\"\n", product_name.c_str());
+        char ascii[256] = {};
+        const std::int32_t asciiLength = sceUsbdGetStringDescriptorAscii(handle, descriptor[15], reinterpret_cast<std::uint8_t*>(ascii), sizeof(ascii));
+        Require(asciiLength >= 0 && std::strlen(ascii) == static_cast<std::size_t>(asciiLength), "ASCII product string length differs from its terminated length");
+        std::printf("ASCII product \"%s\"\n", ascii);
+        std::uint8_t languages[4] = {};
+        Require(sceUsbdGetStringDescriptor(handle, 0, 0, languages, sizeof(languages)) == 4, "language ID string descriptor failed");
+        std::uint8_t first[256] = {};
+        const std::int32_t firstLength = sceUsbdGetStringDescriptor(handle, descriptor[15], static_cast<std::uint16_t>(languages[2] | languages[3] << 8), first, sizeof(first));
+        Require(firstLength >= 2 && first[1] == 3, "product string descriptor in the first language failed");
+        const std::int32_t end = first[0] < firstLength ? first[0] : firstLength;
+        std::string printable;
+        for (std::int32_t index = 2; index + 1 < end; index += 2) {
+            if (first[index + 1] == 0 && first[index] >= 0x20 && first[index] <= 0x7E && first[index] != '<' && first[index] != '>') printable += static_cast<char>(first[index]);
+        }
+        Require(printable == ascii, "ASCII product string differs from the printable characters of the product string");
+        char shortAscii[4] = {'x', 'x', 'x', 'x'};
+        const std::int32_t shortLength = sceUsbdGetStringDescriptorAscii(handle, descriptor[15], reinterpret_cast<std::uint8_t*>(shortAscii), sizeof(shortAscii));
+        Require(shortLength >= 0 && shortLength <= 3 && shortAscii[shortLength] == 0 && std::strncmp(shortAscii, ascii, static_cast<std::size_t>(shortLength)) == 0, "a short ASCII buffer was not filled with a terminated prefix");
     }
     std::uint8_t again[18] = {};
     Require(sceUsbdControlTransfer(handle, 0x80, 6, 0x0100, 0, again, sizeof(again), 1000) == 18, "synchronous device descriptor request failed");
     Require(std::memcmp(again, descriptor, sizeof(again)) == 0, "device descriptor read over the wire differs from the cached one");
+    std::uint8_t wire[18] = {};
+    Require(sceUsbdGetDescriptor(handle, 1, 0, wire, sizeof(wire)) == 18, "device descriptor request through sceUsbdGetDescriptor failed");
+    Require(std::memcmp(wire, descriptor, sizeof(wire)) == 0, "device descriptor read through sceUsbdGetDescriptor differs from the cached one");
     for (std::int32_t interfaceNumber = 0; interfaceNumber < interfaces; ++interfaceNumber) {
         Require(sceUsbdClaimInterface(handle, interfaceNumber) == 0, "claiming an interface failed");
         Require(sceUsbdReleaseInterface(handle, interfaceNumber) == 0, "releasing an interface failed");
@@ -172,7 +150,7 @@ void Device() {
     Require(interruptAddress != 0 && interruptMax != 0, "the device has no interrupt IN endpoint");
     sceUsbdFreeConfigDescriptor(config);
 
-    auto* transfer = static_cast<HostTransfer*>(sceUsbdAllocTransfer(0));
+    auto* transfer = reinterpret_cast<UsbdTransfer*>(sceUsbdAllocTransfer(0));
     std::uint8_t setup[8 + 18] = {0x80, 6, 0x00, 0x01, 0x00, 0x00, 18, 0};
     int done = 0;
     transfer->deviceHandle = handle;
@@ -182,8 +160,8 @@ void Device() {
     transfer->length = sizeof(setup);
     transfer->callback = MarkDone;
     transfer->userData = &done;
-    Require(sceUsbdSubmitTransfer(transfer) == 0, "submitting an asynchronous control transfer failed");
-    Require(Throws([&] { sceUsbdFreeTransfer(transfer); }), "an in-flight transfer was freed");
+    Require(sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == 0, "submitting an asynchronous control transfer failed");
+    Require(Throws([&] { sceUsbdFreeTransfer(reinterpret_cast<UsbdTransfer*>(transfer)); }), "an in-flight transfer was freed");
     Pump(done);
     Require(done == 1 && transfer->status == 0 && transfer->actualLength == 18, "asynchronous control transfer did not complete");
     Require(std::memcmp(setup + 8, descriptor, 18) == 0, "asynchronous device descriptor differs from the cached one");
@@ -193,14 +171,15 @@ void Device() {
         for (int round = 0; round < 300 && !broken; ++round) {
             std::atomic<bool> notified{false};
             std::uint8_t blink[64] = {};
-            sceUsbdFillInterruptTransfer(transfer, handle, interruptAddress, blink, interruptMax, reinterpret_cast<void*>(&MarkDoneThenSignal), &notified, 0);
-            const int submitResult = sceUsbdSubmitTransfer(transfer);
+            sceUsbdFillInterruptTransfer(reinterpret_cast<UsbdTransfer*>(transfer), handle, interruptAddress, blink, interruptMax, &MarkDoneThenSignal, &notified, 0);
+
+            const int submitResult = sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
             if (submitResult != 0) {
                 broken = true;
                 break;
             }
             std::thread canceller([&] {
-                const int outcome = sceUsbdCancelTransfer(transfer);
+                const int outcome = sceUsbdCancelTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
                 if (outcome != 0 && outcome != static_cast<std::int32_t>(0x80240005)) broken = true;
             });
             while (!notified.load(std::memory_order_acquire)) {
@@ -212,11 +191,13 @@ void Device() {
     }
     Require(!broken, "the cancel race failed");
 
-    Require(sceUsbdCancelTransfer(transfer) == static_cast<std::int32_t>(0x80240005), "cancelling a completed transfer did not report not found");
-    sceUsbdFreeTransfer(transfer);
+    Require(sceUsbdCancelTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == static_cast<std::int32_t>(0x80240005), "cancelling a completed transfer did not report not found");
+    sceUsbdFreeTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
     sceUsbdClose(handle);
+
     Require(Throws([&] { sceUsbdClose(handle); }), "a handle was closed twice");
     sceUsbdUnrefDevice(device);
+
     std::puts("USBD device tests passed");
 }
 
@@ -232,8 +213,10 @@ int main(int argc, char** argv) {
         Require(sceUsbdGetDeviceDescriptor(list[index], deviceDescriptor) == 0 && deviceDescriptor[0] == 18 && deviceDescriptor[1] == 1, "listed device has no device descriptor");
         Require(sceUsbdRefDevice(list[index]) == list[index], "listed device was not referenced");
         sceUsbdUnrefDevice(list[index]);
+
     }
     sceUsbdFreeDeviceList(list, 1);
+
     Require(Throws([&] { sceUsbdFreeDeviceList(list, 1); }), "a device list was freed twice");
     Require(sceUsbdGetDeviceList(nullptr) == invalidArgument, "null list accepted");
     Require(sceUsbdHandleEventsTimeout(nullptr) == invalidArgument, "null timeout accepted");
@@ -249,9 +232,11 @@ int main(int argc, char** argv) {
     Require(Throws([&] { sceUsbdOpen(nullptr, &handle); }), "opening a null device did not throw");
     Require(Throws([&] { sceUsbdOpen(&foreign, &handle); }), "opening a device that was never listed did not throw");
     sceUsbdClose(nullptr);
+
     Require(Throws([&] { sceUsbdClose(&foreign); }), "closing a handle that was never opened did not throw");
     Require(sceUsbdRefDevice(nullptr) == nullptr, "null device was referenced");
     sceUsbdUnrefDevice(nullptr);
+
     Require(Throws([&] { sceUsbdRefDevice(&foreign); }), "referencing a device that was never listed did not throw");
     Require(Throws([&] { sceUsbdUnrefDevice(&foreign); }), "unreferencing a device that was never listed did not throw");
     Require(sceUsbdGetBusNumber(nullptr) == 0 && sceUsbdGetDeviceAddress(nullptr) == 0, "null device reported a bus or address");
@@ -273,28 +258,55 @@ int main(int argc, char** argv) {
     Require(Throws([&] { sceUsbdControlTransfer(&foreign, 0x80, 6, 0x100, 0, descriptor, 18, 1000); }), "control transfer on a handle that was never opened did not throw");
     Require(sceUsbdGetStringDescriptor(nullptr, 1, 0x409, descriptor, 18) == invalidArgument, "null handle string descriptor accepted");
     Require(sceUsbdGetStringDescriptor(&foreign, 1, 0x409, descriptor, 0) == invalidArgument, "empty string descriptor buffer accepted");
+    descriptor[0] = 0x55;
+    Require(sceUsbdGetStringDescriptorAscii(nullptr, 1, descriptor, 18) == invalidArgument, "null handle ASCII string descriptor accepted");
+    Require(sceUsbdGetStringDescriptorAscii(&foreign, 1, nullptr, 18) == invalidArgument && sceUsbdGetStringDescriptorAscii(&foreign, 1, descriptor, 0) == invalidArgument, "missing ASCII string buffer accepted");
+    Require(descriptor[0] == 0x55, "a rejected ASCII string request wrote the buffer");
+    Require(Throws([&] { sceUsbdGetStringDescriptorAscii(&foreign, 1, descriptor, 18); }), "ASCII string request on a handle that was never opened did not throw");
+    Require(sceUsbdGetDescriptor(nullptr, 1, 0, descriptor, 18) == invalidArgument, "null handle descriptor request accepted");
+    Require(sceUsbdGetDescriptor(&foreign, 1, 0, nullptr, 18) == invalidArgument && sceUsbdGetDescriptor(&foreign, 1, 0, descriptor, 0) == invalidArgument, "missing descriptor buffer accepted");
+    Require(Throws([&] { sceUsbdGetDescriptor(&foreign, 1, 0, descriptor, 18); }), "descriptor request on a handle that was never opened did not throw");
+    std::int32_t configuration = -1;
+    Require(sceUsbdGetConfiguration(nullptr, &configuration) == invalidArgument && sceUsbdGetConfiguration(&foreign, nullptr) == invalidArgument, "null configuration query accepted");
+    Require(configuration == -1, "a rejected configuration query wrote the output");
+    Require(Throws([&] { sceUsbdGetConfiguration(&foreign, &configuration); }), "configuration of a handle that was never opened did not throw");
+    Require(sceUsbdGetConfigDescriptorByValue(nullptr, 1, &config) == invalidArgument && sceUsbdGetConfigDescriptorByValue(&foreign, 1, nullptr) == invalidArgument, "null config by value argument accepted");
+    Require(Throws([&] { sceUsbdGetConfigDescriptorByValue(&foreign, 1, &config); }), "config by value of a device that was never listed did not throw");
     Require(Throws([&] { sceUsbdClaimInterface(&foreign, 0); }), "claiming on a handle that was never opened did not throw");
-    auto* transfer = static_cast<std::uint8_t*>(sceUsbdAllocTransfer(2));
+    auto* transfer = reinterpret_cast<std::uint8_t*>(sceUsbdAllocTransfer(2));
     Require(transfer != nullptr, "transfer allocation failed");
     Require(*reinterpret_cast<std::int32_t*>(transfer + 56) == 2, "iso packet count not stored");
     Require(sceUsbdAllocTransfer(-1) == nullptr, "negative iso packet count accepted");
     std::uint8_t buffer[8] = {};
     int user = 0;
-    sceUsbdFillInterruptTransfer(transfer, nullptr, 0x81, buffer, 8, reinterpret_cast<void*>(&Require), &user, 250);
+    sceUsbdFillInterruptTransfer(reinterpret_cast<UsbdTransfer*>(transfer), nullptr, 0x81, buffer, 8, reinterpret_cast<UsbdTransferCallback>(&Require), &user, 250);
+
     Require(transfer[9] == 0x81 && transfer[10] == 3, "endpoint or interrupt type not filled");
     Require(*reinterpret_cast<std::uint32_t*>(transfer + 12) == 250 && *reinterpret_cast<std::int32_t*>(transfer + 20) == 8, "timeout or length not filled");
     Require(*reinterpret_cast<void**>(transfer + 40) == &user && *reinterpret_cast<std::uint8_t**>(transfer + 48) == buffer, "user data or buffer not filled");
-    Require(sceUsbdCancelTransfer(transfer) == static_cast<std::int32_t>(0x80240005), "cancelling an unsubmitted transfer did not report not found");
+    Require(sceUsbdCancelTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == static_cast<std::int32_t>(0x80240005), "cancelling an unsubmitted transfer did not report not found");
     Require(sceUsbdSubmitTransfer(nullptr) == invalidArgument, "null transfer submitted");
-    Require(sceUsbdSubmitTransfer(transfer) == invalidArgument, "transfer without a handle submitted");
-    sceUsbdFillInterruptTransfer(transfer, &foreign, 0x81, buffer, 8, reinterpret_cast<void*>(&Require), &user, 250);
-    Require(Throws([&] { sceUsbdSubmitTransfer(transfer); }), "submitting on a handle that was never opened did not throw");
-    sceUsbdFreeTransfer(transfer);
+    Require(sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer)) == invalidArgument, "transfer without a handle submitted");
+    sceUsbdFillInterruptTransfer(reinterpret_cast<UsbdTransfer*>(transfer), &foreign, 0x81, buffer, 8, reinterpret_cast<UsbdTransferCallback>(&Require), &user, 250);
+
+    Require(Throws([&] { sceUsbdSubmitTransfer(reinterpret_cast<UsbdTransfer*>(transfer)); }), "submitting on a handle that was never opened did not throw");
+    sceUsbdFreeTransfer(reinterpret_cast<UsbdTransfer*>(transfer));
     sceUsbdFreeTransfer(nullptr);
+
     Require(sceUsbdEventHandlingOk() == 1, "event handling not allowed");
     sceUsbdFreeConfigDescriptor(nullptr);
+
+    Require(Throws([] { sceUsbdFillControlSetup(nullptr, 0x80, 6, 0x0100, 0, 18); }), "null control setup buffer accepted");
+    std::uint8_t setupBuffer[8] = {};
+    sceUsbdFillControlSetup(setupBuffer, 0x80, 6, 0x0100, 0x0409, 18);
+
+    Require(setupBuffer[0] == 0x80 && setupBuffer[1] == 6, "request type or request not filled");
+    Require(setupBuffer[2] == 0x00 && setupBuffer[3] == 0x01, "value not filled little-endian");
+    Require(setupBuffer[4] == 0x09 && setupBuffer[5] == 0x04, "index not filled little-endian");
+    Require(setupBuffer[6] == 18 && setupBuffer[7] == 0, "length not filled little-endian");
     if (argc == 2 && std::strcmp(argv[1], "device") == 0) Device();
     sceUsbdExit();
+
     std::puts("USBD tests passed");
     return 0;
 }
diff --git a/core/libs/tests/GuestUserContext.cpp b/core/libs/tests/GuestUserContext.cpp
index c616e2260d..46fb68c1d5 100644
--- a/core/libs/tests/GuestUserContext.cpp
+++ b/core/libs/tests/GuestUserContext.cpp
@@ -1,3 +1,6 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/AsmMacros.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/System/include/UserContext.hpp"
@@ -16,15 +19,6 @@
 using ContextEntry = void (APS5_VABI*)();
 
 extern "C" {
-[[gnu::returns_twice]] int APS5_VABI getcontext_nid_postfix(UserUcontext* context);
-int APS5_VABI setcontext_nid_postfix(const UserUcontext* context);
-void APS5_VABI makecontext_nid_postfix(UserUcontext* context, ContextEntry entry, int count, ...);
-[[gnu::returns_twice]] int APS5_VABI setjmp_nid_postfix(std::uint64_t* buffer);
-[[noreturn]] void APS5_VABI longjmp_nid_postfix(std::uint64_t* buffer, int value);
-[[gnu::returns_twice]] int APS5_VABI sigsetjmp_nid_postfix(std::uint64_t* buffer, int saveMask);
-[[noreturn]] void APS5_VABI siglongjmp_nid_postfix(std::uint64_t* buffer, int value);
-int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
-int* APS5_VABI __error_nid_postfix();
 
 int APS5_VABI CaptureKnownRegisters(UserUcontext* context);
 void CaptureReturnAddress();
@@ -238,24 +232,29 @@ void CheckErrors() {
     invalid.stackPointer = g_contextStack.bytes;
     invalid.stackSize = StackBytes;
     makecontext_nid_postfix(&invalid, &EntryThunk, 7);
+
     Require(invalid.mcontext.len == 0, "makecontext invalidates a context with more than six arguments");
     invalid = context;
     invalid.stackPointer = g_contextStack.bytes;
     invalid.stackSize = 2047;
     makecontext_nid_postfix(&invalid, &EntryThunk, 0);
+
     Require(invalid.mcontext.len == 0, "makecontext invalidates a context with a stack below MINSIGSTKSZ");
     invalid = context;
     invalid.stackPointer = nullptr;
     invalid.stackSize = StackBytes;
     makecontext_nid_postfix(&invalid, &EntryThunk, 0);
+
     Require(invalid.mcontext.len == 0, "makecontext invalidates a context without a stack");
     invalid = context;
     invalid.stackPointer = g_contextStack.bytes;
     invalid.stackSize = StackBytes;
     invalid.mcontext.len = 0;
     makecontext_nid_postfix(&invalid, &EntryThunk, 0);
+
     Require(invalid.mcontext.len == 0 && invalid.mcontext.rip == context.mcontext.rip, "makecontext leaves a context without a valid mc_len untouched");
     makecontext_nid_postfix(nullptr, &EntryThunk, 0);
+
 }
 
 void CheckCapture() {
@@ -331,6 +330,7 @@ void CheckRestore() {
             std::memcpy(image + FxsaveXmm + index * 8, &value, sizeof(value));
         }
         setcontext_nid_postfix(&target);
+
         Require(false, "setcontext returned from a valid context");
     }
     const auto& machine = target.mcontext;
@@ -374,6 +374,7 @@ namespace {
         if (sigsetjmp_nid_postfix(from->jump, 1) == 0) {
             if (to->started) siglongjmp_nid_postfix(to->jump, 1);
             setcontext_nid_postfix(&to->context);
+
             Require(false, "setcontext into the job returned");
         }
         return;
@@ -381,6 +382,7 @@ namespace {
     if (setjmp_nid_postfix(from->jump) == 0) {
         if (to->started) longjmp_nid_postfix(to->jump, 1);
         setcontext_nid_postfix(&to->context);
+
         Require(false, "setcontext into the job returned");
     }
 }
@@ -415,8 +417,10 @@ void CheckMakecontext() {
         context.stackSize = StackBytes;
         context.link = &caller;
         makecontext_nid_postfix(&context, &EntryThunk, 6, 0x8000000000000001ull, 0x8000000000000002ull, 0x8000000000000003ull, 0x8000000000000004ull, 0x8000000000000005ull, 0x8000000000000006ull);
+
         Require(context.mcontext.len == sizeof(UserMcontext), "makecontext keeps the context valid");
         setcontext_nid_postfix(&context);
+
         Require(false, "setcontext into the made context returned");
     }
     Require(g_entries == 1, "the made context runs once and resumes uc_link");
@@ -448,6 +452,7 @@ void CheckJumpBuffers(bool signalJumps) {
     g_job.context.stackSize = StackBytes;
     g_job.context.link = nullptr;
     makecontext_nid_postfix(&g_job.context, &JobEntry, 0);
+
     for (int round = 1; round <= 4; ++round) {
         Switch(&g_dispatcher, &g_job);
         Require(g_jobRuns == round, "the job runs once per switch");
@@ -473,6 +478,7 @@ void CheckSignalMask() {
         phase = 1;
         Require(sigprocmask_nid_postfix(GuestSigSetmask, second, nullptr) == 0, "set the second mask");
         setcontext_nid_postfix(&context);
+
         Require(false, "setcontext returned from a valid context");
     }
     std::uint32_t current[4] = {};
@@ -488,6 +494,7 @@ int ExitFromContext() {
     context.link = nullptr;
     makecontext_nid_postfix(&context, &ReturnWithoutLink, 0);
     setcontext_nid_postfix(&context);
+
     return 1;
 }
 
diff --git a/core/libs/tests/GuestUserService.cpp b/core/libs/tests/GuestUserService.cpp
index 4e6e1809a4..d42de627a9 100644
--- a/core/libs/tests/GuestUserService.cpp
+++ b/core/libs/tests/GuestUserService.cpp
@@ -2,32 +2,38 @@
 #include "prx/libSceUserService/UserService.hpp"
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
-
-extern "C" {
-int APS5_VABI sceUserServiceGetForegroundUser(int* user_id);
-int APS5_VABI sceUserServiceGetRegisteredUserIdList(UserServiceRegisteredUserIdList* user_id_list);
-int APS5_VABI sceUserServiceGetUserColor(int user_id, int* color);
-int APS5_VABI sceUserServiceGetNpAccountId(int user_id, std::uint64_t* account_id);
-int APS5_VABI sceUserServiceGetAgeLevel(int user_id, std::uint32_t* age_level);
-int APS5_VABI sceUserServiceGetAccessibilityChatTranscription(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityKeyremapEnable();
-int APS5_VABI sceUserServiceGetAccessibilityPressAndHoldDelay(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityTriggerEffect(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityVibration(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityZoom();
-int APS5_VABI sceUserServiceGetAccessibilityZoomEnabled(int user_id, std::int32_t* value);
-int APS5_VABI sceUserServiceGetAccessibilityZoomFollowFocus(int user_id, std::int32_t* value);
-}
+#include <string>
+#include <utility>
 
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
 
+void SetLanguage(const char* value) {
+#ifdef _WIN32
+    Require(_putenv_s("ANYPS5_LANGUAGE", value != nullptr ? value : "") == 0);
+#else
+    Require((value != nullptr ? ::setenv("ANYPS5_LANGUAGE", value, 1) : ::unsetenv("ANYPS5_LANGUAGE")) == 0);
+#endif
+}
+
 }
 
 int main() {
     Require(sceUserServiceGetForegroundUser(nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    int32_t userNumber = -1;
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserNumber(123, &userNumber) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID, &userNumber) == USER_SERVICE_OK);
+    Require(userNumber == 1);
+
+    int32_t privacy = -1;
+    Require(sceUserServiceGetPlatformPrivacyWs1(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetPlatformPrivacyWs1(USER_SERVICE_INITIAL_USER_ID, &privacy) == USER_SERVICE_OK);
+    Require(privacy == 0);
+
     int foreground = -1;
     Require(sceUserServiceGetForegroundUser(&foreground) == USER_SERVICE_OK);
     Require(foreground == USER_SERVICE_INITIAL_USER_ID);
@@ -44,6 +50,48 @@ int main() {
     Require(sceUserServiceGetUserColor(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
     Require(sceUserServiceGetUserColor(123, &color) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
     Require(sceUserServiceGetUserColor(USER_SERVICE_INITIAL_USER_ID, &color) == USER_SERVICE_OK);
+
+    SetLanguage(nullptr);
+    using KeyboardSetting = decltype(&sceUserServiceGetKeyboardType);
+    const std::pair<KeyboardSetting, std::int32_t> keyboardSettings[] = {
+        {sceUserServiceGetKeyboardType, 20}, {sceUserServiceGetJapaneseInputType, 0}, {sceUserServiceGetTraditionalChineseInputType, 0}};
+    for (const auto& [setting, expected] : keyboardSettings) {
+        std::int32_t value = 0x5A5A;
+        Require(setting(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+        Require(setting(123, &value) == USER_SERVICE_ERROR_UNKNOWN_USER && value == 0x5A5A);
+        Require(setting(USER_SERVICE_USER_ID_INVALID, &value) == USER_SERVICE_ERROR_UNKNOWN_USER && value == 0x5A5A);
+        Require(setting(USER_SERVICE_INITIAL_USER_ID, &value) == USER_SERVICE_OK && value == expected);
+    }
+    constexpr std::int32_t keyboardTypeByLanguage[] = {37, 20, 26, 21, 17, 28, 29, 33, 34, 38, 39, 40, 23, 35, 16, 30, 31, 32, 19, 36, 22, 41, 25, 44, 48, 43, 47, 42, 46, 45};
+    for (int language = 0; language < 30; ++language) {
+        SetLanguage(std::to_string(language).c_str());
+        std::int32_t value = 0x5A5A;
+        Require(sceUserServiceGetKeyboardType(USER_SERVICE_INITIAL_USER_ID, &value) == USER_SERVICE_OK && value == keyboardTypeByLanguage[language]);
+        Require(sceUserServiceGetKeyboardType(123, &value) == USER_SERVICE_ERROR_UNKNOWN_USER && value == keyboardTypeByLanguage[language]);
+        for (const auto variant : {sceUserServiceGetJapaneseInputType, sceUserServiceGetTraditionalChineseInputType}) {
+            value = 0x5A5A;
+            Require(variant(USER_SERVICE_INITIAL_USER_ID, &value) == USER_SERVICE_OK && value == 0);
+        }
+    }
+    SetLanguage("30");
+    std::int32_t fallback = 0x5A5A;
+    Require(sceUserServiceGetKeyboardType(USER_SERVICE_INITIAL_USER_ID, &fallback) == USER_SERVICE_OK && fallback == 20);
+    for (const char* malformed : {"arabic", "-1", "31", "1x", ""}) {
+        SetLanguage(malformed);
+        std::int32_t untouched = 0x5A5A;
+        bool rejected = false;
+        try {
+            sceUserServiceGetKeyboardType(USER_SERVICE_INITIAL_USER_ID, &untouched);
+        } catch (const std::runtime_error& error) {
+            rejected = std::string(error.what()).find("ANYPS5_LANGUAGE") != std::string::npos;
+        }
+        const bool configured = malformed[0] != '\0';
+        Require(rejected == configured && untouched == (configured ? 0x5A5A : 20));
+        untouched = 0x5A5A;
+        Require(sceUserServiceGetKeyboardType(123, &untouched) == USER_SERVICE_ERROR_UNKNOWN_USER && untouched == 0x5A5A);
+        Require(sceUserServiceGetJapaneseInputType(USER_SERVICE_INITIAL_USER_ID, &untouched) == USER_SERVICE_OK && untouched == 0);
+    }
+    SetLanguage(nullptr);
     Require(color == 0);
 
     std::uint64_t account_id = 0xdeadbeefu;
@@ -86,9 +134,18 @@ int main() {
         Require(setting.get(USER_SERVICE_INITIAL_USER_ID, &value) == USER_SERVICE_OK);
         Require(value == setting.value);
     }
+    int initialUser = -1;
+    Require(sceUserServiceGetInitialUser(nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetInitialUser(&initialUser) == USER_SERVICE_OK && initialUser == USER_SERVICE_INITIAL_USER_ID);
+    Require(sceUserServiceGetGamePresets(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    UserServiceGamePresets presets{};
+    presets.difficulty = 0x5a;
+    Require(sceUserServiceGetGamePresets(0, &presets) == USER_SERVICE_ERROR_INVALID_ARGUMENT && presets.difficulty == 0x5a);
+    Require(sceUserServiceGetGamePresets(USER_SERVICE_INITIAL_USER_ID, &presets) == USER_SERVICE_OK && presets.difficulty == 0);
+    std::int32_t accessibilityValue = 0;
     bool threwKeyremap = false;
     try {
-        sceUserServiceGetAccessibilityKeyremapEnable();
+        sceUserServiceGetAccessibilityKeyremapEnable(USER_SERVICE_INITIAL_USER_ID, &accessibilityValue);
     } catch (const std::runtime_error&) {
         threwKeyremap = true;
     }
@@ -96,9 +153,43 @@ int main() {
 
     bool threwZoom = false;
     try {
-        sceUserServiceGetAccessibilityZoom();
+        sceUserServiceGetAccessibilityZoom(USER_SERVICE_INITIAL_USER_ID, &accessibilityValue);
     } catch (const std::runtime_error&) {
         threwZoom = true;
     }
     Require(threwZoom);
+
+    char name[32]{};
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID, nullptr, sizeof(name)) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserName(123, name, sizeof(name)) == USER_SERVICE_ERROR_UNKNOWN_USER);
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID, name, 5) == USER_SERVICE_ERROR_BUFFER_TOO_SHORT);
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID, name, sizeof(name)) == USER_SERVICE_OK);
+    Require(std::strcmp(name, "Player") == 0);
+    Require(sceUserServiceGetUserName(USER_SERVICE_INITIAL_USER_ID + 1, name, sizeof(name)) == USER_SERVICE_OK);
+    Require(std::strcmp(name, "Player2") == 0);
+
+    std::int32_t number = -1;
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID, nullptr) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserNumber(123, &number) == USER_SERVICE_ERROR_INVALID_ARGUMENT);
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID, &number) == USER_SERVICE_OK);
+    Require(number == 1);
+    Require(sceUserServiceGetUserNumber(USER_SERVICE_INITIAL_USER_ID + 1, &number) == USER_SERVICE_OK);
+    Require(number == 2);
+
+    Require(sceUserServiceGetUserColor(USER_SERVICE_INITIAL_USER_ID + 1, &color) == USER_SERVICE_OK);
+    Require(color == 1);
+
+    UserServiceSetUserConnected_nid_postfix(1, true);
+    Require(sceUserServiceGetRegisteredUserIdList(&registered) == USER_SERVICE_OK);
+    Require(registered.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    Require(registered.user_id[1] == USER_SERVICE_INITIAL_USER_ID + 1);
+    for (int i = 2; i < 16; ++i) {
+        Require(registered.user_id[i] == USER_SERVICE_USER_ID_INVALID);
+    }
+    UserServiceSetUserConnected_nid_postfix(1, false);
+    Require(sceUserServiceGetRegisteredUserIdList(&registered) == USER_SERVICE_OK);
+    Require(registered.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    for (int i = 1; i < 16; ++i) {
+        Require(registered.user_id[i] == USER_SERVICE_USER_ID_INVALID);
+    }
 }
diff --git a/core/libs/tests/GuestUserServiceLifecycle.cpp b/core/libs/tests/GuestUserServiceLifecycle.cpp
index 550acb5353..99a61cc97b 100644
--- a/core/libs/tests/GuestUserServiceLifecycle.cpp
+++ b/core/libs/tests/GuestUserServiceLifecycle.cpp
@@ -4,14 +4,6 @@
 #include <cstring>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceUserServiceInitialize(const UserServiceInitParam* params);
-int APS5_VABI sceUserServiceInitialize2(std::int32_t priority, KernelCpumask affinityMask);
-int APS5_VABI sceUserServiceTerminate(void);
-int APS5_VABI sceUserServiceGetLoginUserIdList(UserServiceLoginUserIdList* user_id_list);
-int APS5_VABI sceUserServiceGetEvent(SceUserServiceEvent* event);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
@@ -82,6 +74,42 @@ int main() {
 
     Require(sceUserServiceInitialize(nullptr) == USER_SERVICE_OK);
     RequireLoginOnce();
+
+    UserServiceSetUserConnected_nid_postfix(1, true);
+    SceUserServiceEvent event{};
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 0 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 1);
+    Require(sceUserServiceGetLoginUserIdList(&list) == USER_SERVICE_OK);
+    Require(list.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    Require(list.user_id[1] == USER_SERVICE_INITIAL_USER_ID + 1);
+
+    UserServiceSetUserConnected_nid_postfix(1, false);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 1 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 1);
+    Require(sceUserServiceGetLoginUserIdList(&list) == USER_SERVICE_OK);
+    Require(list.user_id[0] == USER_SERVICE_INITIAL_USER_ID);
+    Require(list.user_id[1] == USER_SERVICE_USER_ID_INVALID);
+
+    for (int i = 0; i < 50; ++i) {
+        UserServiceSetUserConnected_nid_postfix(1, true);
+        UserServiceSetUserConnected_nid_postfix(1, false);
+    }
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_ERROR_NO_EVENT);
+
+    UserServiceSetUserConnected_nid_postfix(2, true);
+    UserServiceSetUserConnected_nid_postfix(2, false);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_ERROR_NO_EVENT);
+
+    UserServiceSetUserConnected_nid_postfix(2, true);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 0 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 2);
+    UserServiceSetUserConnected_nid_postfix(2, false);
+    UserServiceSetUserConnected_nid_postfix(2, true);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_ERROR_NO_EVENT);
+    UserServiceSetUserConnected_nid_postfix(2, false);
+    Require(sceUserServiceGetEvent(&event) == USER_SERVICE_OK);
+    Require(event.event_type == 1 && event.user_id == USER_SERVICE_INITIAL_USER_ID + 2);
+
     Require(sceUserServiceTerminate() == USER_SERVICE_OK);
 
     TestThreadPriority();
diff --git a/core/libs/tests/GuestUserServiceUserName.cpp b/core/libs/tests/GuestUserServiceUserName.cpp
index f755162970..15ad3469e3 100644
--- a/core/libs/tests/GuestUserServiceUserName.cpp
+++ b/core/libs/tests/GuestUserServiceUserName.cpp
@@ -5,10 +5,6 @@
 #include <cstring>
 #include <initializer_list>
 
-extern "C" {
-int APS5_VABI sceUserServiceGetUserName(int user_id, char* name, std::size_t size);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestUtime.cpp b/core/libs/tests/GuestUtime.cpp
index 884cff4e47..48417ce88f 100644
--- a/core/libs/tests/GuestUtime.cpp
+++ b/core/libs/tests/GuestUtime.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/Api.hpp"
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -12,17 +14,8 @@
 #include <sys/stat.h>
 #endif
 
-struct LibcUtimbuf {
-    std::int64_t actime;
-    std::int64_t modtime;
-};
 static_assert(sizeof(LibcUtimbuf) == 16);
 
-extern "C" {
-int APS5_VABI utime_nid_postfix(const char*, const LibcUtimbuf*);
-int* APS5_VABI __error_nid_postfix();
-}
-
 static void Require(bool condition, int line) {
     if (!condition) {
         std::fprintf(stderr, "Utime check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestUtimeForwarding.cpp b/core/libs/tests/GuestUtimeForwarding.cpp
index 870d83d404..146ca8f7bd 100644
--- a/core/libs/tests/GuestUtimeForwarding.cpp
+++ b/core/libs/tests/GuestUtimeForwarding.cpp
@@ -1,15 +1,9 @@
+#include "prx/libSceLibcInternal/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <cstdio>
 #include <cstdlib>
 #include <initializer_list>
 
-struct LibcUtimbuf {
-    std::int64_t actime;
-    std::int64_t modtime;
-};
-
-extern "C" int APS5_VABI utime_nid_postfix(const char*, const LibcUtimbuf*);
-
 namespace {
 int guestError;
 int backendResult;
diff --git a/core/libs/tests/GuestVdecsw.cpp b/core/libs/tests/GuestVdecsw.cpp
index 14fdca44a9..d30d2421aa 100644
--- a/core/libs/tests/GuestVdecsw.cpp
+++ b/core/libs/tests/GuestVdecsw.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVdecsw/include/Api.hpp"
 #include <array>
 #include <cstddef>
 #include <cstdint>
@@ -9,160 +10,29 @@
 #include "prx/libc/include/General.hpp"
 #include "Vp9Fixture.hpp"
 #include "H264Fixture.hpp"
+#include "HevcFixture.hpp"
 
-struct ComputeMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-};
+using namespace SceVdecsw;
 
-struct ComputeConfigInfo {
-    std::uint64_t thisSize;
-    std::uint16_t computePipeId;
-    std::uint16_t computeQueueId;
-    bool checkMemoryType;
-};
+static_assert(sizeof(SceVideodec2::Vp9PictureInfo) == 0x58 && offsetof(SceVideodec2::Vp9PictureInfo, ptsData) == 0x10 && offsetof(SceVideodec2::Vp9PictureInfo, profile) == 0x28 && offsetof(SceVideodec2::Vp9PictureInfo, bitDepth) == 0x38 && offsetof(SceVideodec2::Vp9PictureInfo, colorSpace) == 0x3c && offsetof(SceVideodec2::Vp9PictureInfo, renderHeight) == 0x50);
 
-struct DecoderConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-    std::uint64_t computeQueue;
-    std::uint64_t cpuAffinityMask;
-    std::int32_t cpuThreadPriority;
-    bool optimizeProgressiveVideo;
-    std::uint8_t reserved[19];
-};
-
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct InputResult {
-    std::uint64_t thisSize;
-    const void* decodedAu;
-    std::uint32_t outputFrameCount;
-    std::uint32_t reserved;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isLastFrame;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    bool isDiscardedFrame;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
-
-static_assert(sizeof(Vp9PictureInfo) == 0x58 && offsetof(Vp9PictureInfo, ptsData) == 0x10 && offsetof(Vp9PictureInfo, profile) == 0x28 && offsetof(Vp9PictureInfo, bitDepth) == 0x38 && offsetof(Vp9PictureInfo, colorSpace) == 0x3c && offsetof(Vp9PictureInfo, renderHeight) == 0x50);
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInMbsMinus1;
-    std::uint32_t picHeightInMapUnitsMinus1;
-    std::uint8_t frameMbsOnlyFlag;
-    std::uint8_t frameCroppingFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-    std::uint8_t vui[44];
-};
-
-static_assert(sizeof(DecoderConfigInfo) == 0x50 && sizeof(OutputInfo) == 0x38 && offsetof(OutputInfo, isLastFrame) == 9 && offsetof(OutputInfo, pictureCount) == 0xb && sizeof(AvcPictureInfo) == 0x78);
-
-extern "C" {
-int APS5_VABI sceVdecswQueryComputeMemoryInfo(ComputeMemoryInfo*);
-int APS5_VABI sceVdecswAllocateComputeQueue(const ComputeConfigInfo*, const ComputeMemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVdecswReleaseComputeQueue(std::uint64_t);
-int APS5_VABI sceVdecswQueryDecoderMemoryInfo(const DecoderConfigInfo*, DecoderMemoryInfo*);
-int APS5_VABI sceVdecswCreateDecoder(const DecoderConfigInfo*, const DecoderMemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVdecswDeleteDecoder(std::uint64_t);
-int APS5_VABI sceVdecswSetDecodeInput(std::uint64_t, const InputData*);
-int APS5_VABI sceVdecswTrySyncDecodeInput(std::uint64_t, InputResult*);
-int APS5_VABI sceVdecswSyncDecodeInput(std::uint64_t, InputResult*);
-int APS5_VABI sceVdecswSetDecodeOutput(std::uint64_t, const FrameBuffer*);
-int APS5_VABI sceVdecswTrySyncDecodeOutput(std::uint64_t, OutputInfo*);
-int APS5_VABI sceVdecswSyncDecodeOutput(std::uint64_t, OutputInfo*);
-int APS5_VABI sceVdecswGetVp9PictureInfo(const OutputInfo*, Vp9PictureInfo*);
-int APS5_VABI sceVdecswGetAvcPictureInfo(const OutputInfo*, AvcPictureInfo*, AvcPictureInfo*);
-int APS5_VABI sceVdecswGetHevcPictureInfo(const OutputInfo*, void*);
-int APS5_VABI sceVdecswFinalizeDecodeSequence(std::uint64_t);
-int APS5_VABI sceVdecswResetDecoder(std::uint64_t);
-}
+static_assert(sizeof(HevcPictureInfo) == 0xb8 && offsetof(HevcPictureInfo, idrPictureFlag) == 0x93 && offsetof(HevcPictureInfo, frameCroppingFlag) == 0xa5);
+static_assert(sizeof(SceVdecsw::DecoderConfigInfo) == 0x50 && sizeof(OutputInfo) == 0x38 && offsetof(OutputInfo, isLastFrame) == 9 && offsetof(OutputInfo, pictureCount) == 0xb && sizeof(AvcPictureInfo) == 0x78);
 
 namespace {
 
+using namespace SceVdecsw;
+
 using namespace H264Fixture;
+using namespace HevcFixture;
 using namespace Vp9Fixture;
 
 constexpr int OutputPending = static_cast<int>(0x81510115u);
 constexpr int InputQueueEmpty = static_cast<int>(0x81510116u);
+constexpr std::uint32_t CodecAvc = 1;
+constexpr std::uint32_t CodecHevc = 974921;
 constexpr std::uint32_t CodecVp9 = 2382845;
+constexpr std::array<std::size_t, 6> HevcDisplayOrderUnits{0, 3, 2, 1, 5, 4};
 
 void check(bool condition, const std::string& message) {
     if (!condition) throw std::runtime_error(message);
@@ -171,14 +41,14 @@ void check(bool condition, const std::string& message) {
 struct Session {
     std::uint64_t queue = 0;
     std::uint64_t decoder = 0;
-    DecoderMemoryInfo memory{sizeof(DecoderMemoryInfo)};
+    SceVideodec2::DecoderMemoryInfo memory{sizeof(SceVideodec2::DecoderMemoryInfo)};
 
-    Session() {
-        ComputeMemoryInfo compute{sizeof(ComputeMemoryInfo)};
+    explicit Session(std::uint32_t codec = CodecAvc, std::uint32_t profile = 100, std::uint32_t level = 42) {
+        SceVideodec2::ComputeMemoryInfo compute{sizeof(SceVideodec2::ComputeMemoryInfo)};
         check(sceVdecswQueryComputeMemoryInfo(&compute) == 0 && compute.cpuGpuMemorySize != 0, "compute memory query failed");
-        const ComputeConfigInfo computeConfig{sizeof(ComputeConfigInfo), 3, 3, true};
+        const SceVideodec2::ComputeConfigInfo computeConfig{sizeof(SceVideodec2::ComputeConfigInfo), 3, 3, true};
         check(sceVdecswAllocateComputeQueue(&computeConfig, &compute, &queue) == 0, "compute queue allocation failed");
-        DecoderConfigInfo config{sizeof(DecoderConfigInfo), 1, 1, 100, 42, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3, queue, 0x3f, 0, true, {}};
+        SceVdecsw::DecoderConfigInfo config{{sizeof(SceVdecsw::DecoderConfigInfo), 1, codec, profile, level, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3}, queue, 0x3f, 0, true, {}};
         check(sceVdecswQueryDecoderMemoryInfo(&config, &memory) == 0 && memory.maxFrameBufferSize != 0, "decoder memory query failed");
         check(sceVdecswCreateDecoder(&config, &memory, &decoder) == 0, "decoder creation failed");
     }
@@ -186,6 +56,7 @@ struct Session {
     ~Session() {
         sceVdecswDeleteDecoder(decoder);
         sceVdecswReleaseComputeQueue(queue);
+
     }
 };
 
@@ -230,7 +101,7 @@ void testDecode() {
     };
     std::uint32_t produced = 0;
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
         InputResult consumed{sizeof(InputResult)};
         check(sceVdecswTrySyncDecodeInput(session.decoder, &consumed) == 0 && consumed.decodedAu == units[unit].data(), "an access unit was not consumed");
@@ -245,10 +116,81 @@ void testDecode() {
     check(sceVdecswTrySyncDecodeInput(session.decoder, &result) == InputQueueEmpty, "a finalized decoder did not report an empty input queue");
 }
 
+void testHevc() {
+    Session session(CodecHevc, 1, 30);
+    const auto units = hevcUnits(HevcStream.data(), HevcStream.size());
+    check(units.size() == HevcHashes.size(), "unexpected HEVC access unit count");
+    std::vector<std::uint8_t> buffer(session.memory.maxFrameBufferSize);
+    std::size_t pictures = 0;
+    bool ended = false;
+    const auto drain = [&] {
+        for (;;) {
+            const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
+            check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "HEVC output buffer was rejected");
+            OutputInfo output{sizeof(OutputInfo)};
+            const auto status = sceVdecswTrySyncDecodeOutput(session.decoder, &output);
+            if (status == OutputPending) return;
+            check(status == 0, "HEVC output sync failed");
+            if (!output.isValid) {
+                ended = true;
+                return;
+            }
+            check(pictures < HevcHashes.size() && output.codecType == CodecHevc && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == Height, "unexpected HEVC picture geometry");
+            HevcPictureInfo info{sizeof(HevcPictureInfo)};
+            check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "HEVC picture info missing");
+            const auto unit = HevcDisplayOrderUnits[pictures];
+            check(info.ptsData == 1000 + unit && info.dtsData == unit && info.attachedData == 0xa0 + unit, "HEVC pictures out of display order");
+            check(info.idrPictureFlag == (pictures == 0 ? 1 : 0) && info.irapPictureFlag == (pictures == 0 ? 1 : 0), "HEVC random access flags differ");
+            check(info.generalProfileIdc == 1 && info.generalLevelIdc == 30 && info.bitDepthLumaMinus8 == 0 && info.bitDepthChromaMinus8 == 0, "HEVC profile, level or bit depth differs");
+            check(info.picWidthInLumaSamples == Width && info.picHeightInLumaSamples == Height && info.conformanceWindowFlag == 0 && info.frameCroppingFlag == 0, "HEVC picture geometry in the picture info is wrong");
+            AvcPictureInfo avc{sizeof(AvcPictureInfo)};
+            bool avcThrows = false;
+            try {
+                sceVdecswGetAvcPictureInfo(&output, &avc, nullptr);
+
+            } catch (const std::exception&) {
+                avcThrows = true;
+            }
+            check(avcThrows, "AVC picture info was returned for an HEVC picture");
+            check(hashNv12(buffer.data(), output.framePitch, output.frameHeight) == HevcHashes[pictures], "HEVC picture " + std::to_string(pictures) + " differs from the reference");
+            ++pictures;
+        }
+    };
+    for (std::size_t unit = 0; unit < units.size(); ++unit) {
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "HEVC decode input was rejected");
+        InputResult consumed{sizeof(InputResult)};
+        check(sceVdecswTrySyncDecodeInput(session.decoder, &consumed) == 0 && consumed.decodedAu == units[unit].data(), "an HEVC access unit was not consumed");
+        drain();
+    }
+    check(sceVdecswFinalizeDecodeSequence(session.decoder) == 0, "HEVC finalize failed");
+    while (!ended) drain();
+    check(pictures == HevcHashes.size(), "missing HEVC pictures after finalizing the sequence");
+}
+
+void testHevcCrop() {
+    Session session(CodecHevc, 1, 30);
+    std::vector<std::uint8_t> buffer(session.memory.maxFrameBufferSize);
+    const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
+    check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "cropped HEVC output buffer was rejected");
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), HevcCroppedStream.data(), HevcCroppedStream.size(), 1000, 0, 0xa0};
+    check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "cropped HEVC decode input was rejected");
+    InputResult consumed{sizeof(InputResult)};
+    check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "the cropped HEVC access unit was not consumed");
+    check(sceVdecswFinalizeDecodeSequence(session.decoder) == 0, "cropped HEVC finalize failed");
+    OutputInfo output{sizeof(OutputInfo)};
+    check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid && output.frameWidth == 64 && output.frameHeight == 40, "unexpected cropped HEVC picture geometry");
+    HevcPictureInfo info{sizeof(HevcPictureInfo)};
+    check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "cropped HEVC picture info missing");
+    check(info.picWidthInLumaSamples == 64 && info.picHeightInLumaSamples == 40, "cropped HEVC coded size differs");
+    check(info.conformanceWindowFlag == 1 && info.confWinLeftOffset == 0 && info.confWinRightOffset == 0 && info.confWinTopOffset == 0 && info.confWinBottomOffset == 2, "HEVC conformance window differs");
+    check(info.frameCroppingFlag == 1 && info.frameCropLeftOffset == 0 && info.frameCropRightOffset == 0 && info.frameCropTopOffset == 0 && info.frameCropBottomOffset == 2, "HEVC frame cropping differs");
+}
+
 void testWithoutOutput() {
     Session session;
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
     InputResult result{sizeof(InputResult)};
     check(sceVdecswTrySyncDecodeInput(session.decoder, &result) == 0 && result.decodedAu == units[0].data(), "an input was not decoded before an output buffer was set");
@@ -268,7 +210,7 @@ void testSyncWrappers() {
     InputResult idle{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &idle) == InputQueueEmpty, "sync input on an idle decoder did not report an empty queue");
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
     InputResult result{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &result) == 0 && result.decodedAu == units[0].data(), "sync input did not consume the access unit");
@@ -278,26 +220,28 @@ void testSyncWrappers() {
     check(sceVdecswFinalizeDecodeSequence(session.decoder) == 0, "finalize failed");
     OutputInfo output{sizeof(OutputInfo)};
     check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid && output.isLastFrame, "sync output did not return the finalized picture");
+    HevcPictureInfo hevc{sizeof(HevcPictureInfo)};
     bool hevcThrows = false;
     try {
-        sceVdecswGetHevcPictureInfo(&output, &result);
+        sceVdecswGetHevcPictureInfo(&output, &hevc);
+
     } catch (const std::exception&) {
         hevcThrows = true;
     }
-    check(hevcThrows, "GetHevcPictureInfo must still throw");
+    check(hevcThrows, "HEVC picture info was returned for an H.264 picture");
 }
 
 struct Vp9Session {
     std::uint64_t queue = 0;
     std::uint64_t decoder = 0;
-    DecoderMemoryInfo memory{sizeof(DecoderMemoryInfo)};
+    SceVideodec2::DecoderMemoryInfo memory{sizeof(SceVideodec2::DecoderMemoryInfo)};
 
     Vp9Session() {
-        ComputeMemoryInfo compute{sizeof(ComputeMemoryInfo)};
+        SceVideodec2::ComputeMemoryInfo compute{sizeof(SceVideodec2::ComputeMemoryInfo)};
         check(sceVdecswQueryComputeMemoryInfo(&compute) == 0 && compute.cpuGpuMemorySize != 0, "compute memory query failed");
-        const ComputeConfigInfo computeConfig{sizeof(ComputeConfigInfo), 3, 3, true};
+        const SceVideodec2::ComputeConfigInfo computeConfig{sizeof(SceVideodec2::ComputeConfigInfo), 3, 3, true};
         check(sceVdecswAllocateComputeQueue(&computeConfig, &compute, &queue) == 0, "compute queue allocation failed");
-        DecoderConfigInfo config{sizeof(DecoderConfigInfo), 1, CodecVp9, 0, 0, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3, queue, 0x3f, 0, true, {}};
+        SceVdecsw::DecoderConfigInfo config{{sizeof(SceVdecsw::DecoderConfigInfo), 1, CodecVp9, 0, 0, static_cast<std::int32_t>(Width), static_cast<std::int32_t>(Height), 4, 3}, queue, 0x3f, 0, true, {}};
         check(sceVdecswQueryDecoderMemoryInfo(&config, &memory) == 0 && memory.maxFrameBufferSize != 0, "VP9 decoder memory query failed");
         check(sceVdecswCreateDecoder(&config, &memory, &decoder) == 0, "VP9 decoder creation failed");
     }
@@ -305,6 +249,7 @@ struct Vp9Session {
     ~Vp9Session() {
         sceVdecswDeleteDecoder(decoder);
         sceVdecswReleaseComputeQueue(queue);
+
     }
 };
 
@@ -318,20 +263,20 @@ bool throws(TAction action) {
     return false;
 }
 
-Vp9PictureInfo sentinelVp9Info(std::uint64_t size = sizeof(Vp9PictureInfo)) {
-    Vp9PictureInfo info;
+SceVideodec2::Vp9PictureInfo sentinelVp9Info(std::uint64_t size = sizeof(SceVideodec2::Vp9PictureInfo)) {
+    SceVideodec2::Vp9PictureInfo info;
     std::memset(&info, 0xcc, sizeof(info));
     info.thisSize = size;
     return info;
 }
 
-bool sameBytes(const Vp9PictureInfo& left, const Vp9PictureInfo& right) {
-    return std::memcmp(&left, &right, sizeof(Vp9PictureInfo)) == 0;
+bool sameBytes(const SceVideodec2::Vp9PictureInfo& left, const SceVideodec2::Vp9PictureInfo& right) {
+    return std::memcmp(&left, &right, sizeof(SceVideodec2::Vp9PictureInfo)) == 0;
 }
 
-void checkVp9Info(const Vp9PictureInfo& info, std::size_t picture) {
+void checkVp9Info(const SceVideodec2::Vp9PictureInfo& info, std::size_t picture) {
     const std::string name = "VP9 picture " + std::to_string(picture);
-    check(info.thisSize == sizeof(Vp9PictureInfo) && info.isValid, name + " has no picture info");
+    check(info.thisSize == sizeof(SceVideodec2::Vp9PictureInfo) && info.isValid, name + " has no picture info");
     check(info.ptsData == 1000 + picture && info.dtsData == picture && info.attachedData == 0xa0 + picture, name + " timestamps differ");
     check(info.profile == 0 && info.bitDepth == 8 && info.colorRange == 0 && info.colorSpace == 0 && info.numFrames == 1 && info.intraOnly == 0, name + " coded header fields differ");
     check(info.keyFrameFlag == (picture == 0 ? 1u : 0u), name + " key frame flag differs");
@@ -376,7 +321,7 @@ void testVp9PictureInfo() {
         }
     };
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "VP9 decode input was rejected");
         InputResult consumed{sizeof(InputResult)};
         check(sceVdecswTrySyncDecodeInput(session.decoder, &consumed) == 0 && consumed.decodedAu == units[unit].data(), "a VP9 access unit was not consumed");
@@ -412,21 +357,21 @@ void testVp9PictureInfo() {
     unknown.frameBuffer = nullptr;
     check(throws([&] { sceVdecswGetVp9PictureInfo(&unknown, &info); }) && sameBytes(info, unchanged), "a null frame buffer was accepted");
 
-    const auto head = offsetof(Vp9PictureInfo, profile);
+    const auto head = offsetof(SceVideodec2::Vp9PictureInfo, profile);
     auto partial = sentinelVp9Info(head);
     check(sceVdecswGetVp9PictureInfo(&outputs[2], &partial) == 0, "a VP9 picture info with a short size field was rejected");
     check(partial.thisSize == head && partial.isValid && partial.ptsData == 1002 && partial.dtsData == 2 && partial.attachedData == 0xa2, "the leading VP9 picture info fields were not written");
     check(partial.profile == unchanged.profile && partial.frameWidth == unchanged.frameWidth && partial.renderHeight == unchanged.renderHeight, "a VP9 picture info with a short size field was written beyond it");
 
     struct Oversized {
-        Vp9PictureInfo info;
+        SceVideodec2::Vp9PictureInfo info;
         std::uint8_t tail[64];
     } oversized;
     std::memset(&oversized, 0xcc, sizeof(oversized));
     oversized.info.thisSize = sizeof(Oversized);
     check(sceVdecswGetVp9PictureInfo(&outputs[3], &oversized.info) == 0, "a VP9 picture info with a long size field was rejected");
     check(oversized.info.thisSize == sizeof(Oversized), "a long VP9 picture info size field was changed");
-    oversized.info.thisSize = sizeof(Vp9PictureInfo);
+    oversized.info.thisSize = sizeof(SceVideodec2::Vp9PictureInfo);
     checkVp9Info(oversized.info, 3);
     for (const auto byte : oversized.tail) check(byte == 0xcc, "a VP9 picture info with a long size field was written beyond the structure");
 
@@ -440,7 +385,7 @@ void testVp9PictureInfo() {
 void testVp9PictureInfoOfAvcPicture() {
     Session session;
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "decode input was rejected");
     InputResult result{sizeof(InputResult)};
     check(sceVdecswSyncDecodeInput(session.decoder, &result) == 0, "the access unit was not consumed");
@@ -457,9 +402,29 @@ void testVp9PictureInfoOfAvcPicture() {
 
 }
 
+void testHevcMain10() {
+    Session session(CodecHevc, 2, 30);
+    std::vector<std::uint8_t> buffer(session.memory.maxFrameBufferSize);
+    const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
+    check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "Main 10 HEVC output buffer was rejected");
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), HevcMain10Stream.data(), HevcMain10Stream.size(), 1000, 0, 0xa0};
+    check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "Main 10 HEVC decode input was rejected");
+    InputResult consumed{sizeof(InputResult)};
+    check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "the Main 10 HEVC access unit was not consumed");
+    check(sceVdecswFinalizeDecodeSequence(session.decoder) == 0, "Main 10 HEVC finalize failed");
+    OutputInfo output{sizeof(OutputInfo)};
+    check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid, "the Main 10 HEVC picture was not output");
+    HevcPictureInfo info{sizeof(HevcPictureInfo)};
+    check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "Main 10 HEVC picture info missing");
+    check(info.generalProfileIdc == 2 && info.bitDepthLumaMinus8 == 2 && info.bitDepthChromaMinus8 == 2, "Main 10 HEVC profile or bit depth differs");
+}
+
 int main() {
     try {
         testDecode();
+        testHevc();
+        testHevcCrop();
+        testHevcMain10();
         testWithoutOutput();
         testSyncWrappers();
         testVp9PictureInfo();
diff --git a/core/libs/tests/GuestVectorAlgorithms.cpp b/core/libs/tests/GuestVectorAlgorithms.cpp
index c3b858bac6..f596b715b6 100644
--- a/core/libs/tests/GuestVectorAlgorithms.cpp
+++ b/core/libs/tests/GuestVectorAlgorithms.cpp
@@ -1,28 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-struct MinMaxPointers {
-    const void* minimum;
-    const void* maximum;
-};
-
-extern "C" {
-const void* APS5_VABI __std_find_trivial_2_nid_postfix(const void*, const void*, std::uint16_t);
-const void* APS5_VABI __std_find_trivial_unsized_1_nid_postfix(const void*, std::uint8_t);
-const void* APS5_VABI __std_find_trivial_unsized_4_nid_postfix(const void*, std::uint32_t);
-std::size_t APS5_VABI __std_count_trivial_8_nid_postfix(const void*, const void*, std::uint64_t);
-const void* APS5_VABI __std_min_element_1_nid_postfix(const void*, const void*, bool);
-const void* APS5_VABI __std_max_element_4_nid_postfix(const void*, const void*, bool);
-MinMaxPointers APS5_VABI __std_minmax_element_2_nid_postfix(const void*, const void*, bool);
-MinMaxPointers APS5_VABI __std_minmax_element_8_nid_postfix(const void*, const void*, bool);
-void APS5_VABI __std_reverse_trivially_swappable_2_nid_postfix(void*, void*);
-void APS5_VABI __std_reverse_copy_trivially_copyable_8_nid_postfix(const void*, const void*, void*);
-void APS5_VABI __std_swap_ranges_trivially_swappable_noalias_nid_postfix(void*, void*, void*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 static void CheckFindAndCount() {
@@ -48,6 +30,36 @@ static void CheckUnsizedRescan() {
     bytes[3] = 0;
     bytes[20] = 0;
     Require(__std_find_trivial_unsized_1_nid_postfix(bytes + 8, 'x') == bytes + 70);
+
+    alignas(32) std::uint16_t halves[32] = {};
+    halves[0] = 17;
+    halves[4] = 17;
+    halves[20] = 17;
+    Require(__std_find_trivial_unsized_2_nid_postfix(halves + 1, 17) == halves + 4);
+    halves[4] = 0;
+    Require(__std_find_trivial_unsized_2_nid_postfix(halves + 1, 17) == halves);
+    halves[0] = 0;
+    Require(__std_find_trivial_unsized_2_nid_postfix(halves + 1, 17) == halves + 20);
+
+    alignas(32) std::uint32_t quads[16] = {};
+    quads[0] = 42;
+    quads[5] = 42;
+    quads[12] = 42;
+    Require(__std_find_trivial_unsized_4_nid_postfix(quads + 1, 42) == quads + 5);
+    quads[5] = 0;
+    Require(__std_find_trivial_unsized_4_nid_postfix(quads + 1, 42) == quads);
+    quads[0] = 0;
+    Require(__std_find_trivial_unsized_4_nid_postfix(quads + 1, 42) == quads + 12);
+
+    alignas(32) std::uint64_t wides[8] = {};
+    wides[0] = 99;
+    wides[2] = 99;
+    wides[6] = 99;
+    Require(__std_find_trivial_unsized_8_nid_postfix(wides + 1, 99) == wides + 2);
+    wides[2] = 0;
+    Require(__std_find_trivial_unsized_8_nid_postfix(wides + 1, 99) == wides);
+    wides[0] = 0;
+    Require(__std_find_trivial_unsized_8_nid_postfix(wides + 1, 99) == wides + 6);
 }
 
 static void CheckMinMax() {
@@ -73,10 +85,12 @@ static void CheckMinMax() {
 static void CheckReverseAndSwap() {
     std::uint16_t halves[] = {1, 2, 3, 4, 5};
     __std_reverse_trivially_swappable_2_nid_postfix(halves, halves + 5);
+
     Require(halves[0] == 5 && halves[1] == 4 && halves[2] == 3 && halves[3] == 2 && halves[4] == 1);
     const std::uint64_t wides[] = {1, 2, 3};
     std::uint64_t reversed[4] = {9, 9, 9, 9};
     __std_reverse_copy_trivially_copyable_8_nid_postfix(wides, wides + 3, reversed);
+
     Require(reversed[0] == 3 && reversed[1] == 2 && reversed[2] == 1 && reversed[3] == 9);
     unsigned char left[37], right[37];
     for (int i = 0; i < 37; ++i) {
@@ -84,6 +98,7 @@ static void CheckReverseAndSwap() {
         right[i] = static_cast<unsigned char>(100 + i);
     }
     __std_swap_ranges_trivially_swappable_noalias_nid_postfix(left, left + 37, right);
+
     for (int i = 0; i < 37; ++i) Require(left[i] == 100 + i && right[i] == i);
 }
 
diff --git a/core/libs/tests/GuestVideoOutColorSpace.cpp b/core/libs/tests/GuestVideoOutColorSpace.cpp
index 1c081f65f9..d794feff72 100644
--- a/core/libs/tests/GuestVideoOutColorSpace.cpp
+++ b/core/libs/tests/GuestVideoOutColorSpace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -8,18 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option);
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutColorSpaceConversionSettings* settings);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size);
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size);
-int APS5_VABI sceVideoOutSetGlobalBlendSpace(int handle, uint32_t space, uint32_t option);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 
diff --git a/core/libs/tests/GuestVideoOutCursor.cpp b/core/libs/tests/GuestVideoOutCursor.cpp
index 214293bdd2..283d91bccf 100644
--- a/core/libs/tests/GuestVideoOutCursor.cpp
+++ b/core/libs/tests/GuestVideoOutCursor.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -6,13 +7,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceVideoOutCursorEnable(std::int32_t handle, std::int32_t index, const void* address);
-int APS5_VABI sceVideoOutCursorDisable(std::int32_t handle, std::int32_t index);
-int APS5_VABI sceVideoOutCursorSetImageAddress(std::int32_t handle, std::int32_t index, const void* address);
-int APS5_VABI sceVideoOutCursorSetPosition(std::int32_t handle, std::int32_t index, std::uint32_t x, std::uint32_t y);
-}
-
 static bool ReportsNotImplemented(const std::string& name, const std::function<int()>& call) {
     try {
         call();
diff --git a/core/libs/tests/GuestVideoOutHdr.cpp b/core/libs/tests/GuestVideoOutHdr.cpp
index a6e78ed34d..08fc189878 100644
--- a/core/libs/tests/GuestVideoOutHdr.cpp
+++ b/core/libs/tests/GuestVideoOutHdr.cpp
@@ -1,3 +1,7 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceVideoOut/include/Output.hpp"
+#include "prx/libSceVideoOut/include/Event.hpp"
+#include "prx/libSceSystemService/include/SystemService.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
@@ -14,19 +18,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutGetOutputStatus(int handle, VideoOutOutputStatus* status);
-int APS5_VABI sceVideoOutGetOutputStatusWithVrr(int handle, void* status);
-int APS5_VABI sceVideoOutAddOutputModeEvent(KernelEqueue eq, int handle, void* udata);
-int APS5_VABI sceVideoOutGetEventId(const KernelEvent* ev);
-int APS5_VABI sceKernelCreateEqueue(KernelEqueue* eq, const char* name);
-int APS5_VABI sceKernelDeleteEqueue(KernelEqueue eq);
-int APS5_VABI sceKernelWaitEqueue(KernelEqueue eq, KernelEvent* ev, int num, int* out, const KernelUseconds* timo);
-int APS5_VABI sceSystemServiceGetHdrToneMapLuminance(SystemServiceHdrToneMapLuminance* luminance);
-}
-
 namespace {
 
 constexpr int SystemUser = 255;
diff --git a/core/libs/tests/GuestVideoOutHighFrameRate.cpp b/core/libs/tests/GuestVideoOutHighFrameRate.cpp
index 3e4f4c4437..541436b236 100644
--- a/core/libs/tests/GuestVideoOutHighFrameRate.cpp
+++ b/core/libs/tests/GuestVideoOutHighFrameRate.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -7,16 +8,6 @@
 #include <fstream>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int, int, int, const void*);
-int APS5_VABI sceVideoOutClose(int);
-int APS5_VABI sceVideoOutIsOutputSupported(int, std::uint64_t, const VideoOutOutputOptions*, void*, std::uint64_t);
-int APS5_VABI sceVideoOutConfigureOutput(int, std::uint64_t, const VideoOutOutputOptions*, void*, std::uint64_t);
-int APS5_VABI sceVideoOutWaitVblank(int);
-int APS5_VABI sceVideoOutGetOutputStatus(int, VideoOutOutputStatus*);
-int APS5_VABI sceVideoOutGetResolutionStatus(int, VideoOutResolutionStatus*);
-}
-
 static constexpr int Unsupported = static_cast<int>(0x80290016u);
 
 static void Require(bool value, const char* message) {
diff --git a/core/libs/tests/GuestVideoOutOutputMode.cpp b/core/libs/tests/GuestVideoOutOutputMode.cpp
index 82ce4bc2fa..7c86474ea9 100644
--- a/core/libs/tests/GuestVideoOutOutputMode.cpp
+++ b/core/libs/tests/GuestVideoOutOutputMode.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -8,14 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutInitializeOutputOptions(VideoOutOutputOptions* options);
-int APS5_VABI sceVideoOutIsOutputSupported(int handle, std::uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, std::uint64_t reserved);
-int APS5_VABI sceVideoOutConfigureOutput(int handle, std::uint64_t mode, const VideoOutOutputOptions* options, void* reservedPtr, std::uint64_t reserved);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 static constexpr int HMD2_MAIN_BUS = 0x20;
diff --git a/core/libs/tests/GuestVideoOutResolutionStatus.cpp b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
index e401ad3023..338783ec96 100644
--- a/core/libs/tests/GuestVideoOutResolutionStatus.cpp
+++ b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -8,14 +9,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutGetOutputStatus(int handle, VideoOutOutputStatus* status);
-int APS5_VABI sceVideoOutGetOutputStatusWithVrr(int handle, void* status);
-int APS5_VABI sceVideoOutGetResolutionStatus(int handle, VideoOutResolutionStatus* status);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 static constexpr int NEVER_OPENED_HANDLE = 2;
diff --git a/core/libs/tests/GuestVideoOutWqhdDetection.cpp b/core/libs/tests/GuestVideoOutWqhdDetection.cpp
index c0e68b0c49..0e543eaade 100644
--- a/core/libs/tests/GuestVideoOutWqhdDetection.cpp
+++ b/core/libs/tests/GuestVideoOutWqhdDetection.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoOut/include/Output.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/Shutdown.hpp"
 #include "tests/VideoOutTestEnvironment.hpp"
@@ -6,13 +7,6 @@
 #include <cstring>
 #include <stdexcept>
 
-extern "C" {
-int APS5_VABI sceVideoOutOpen(int userId, int busType, int index, const void* param);
-int APS5_VABI sceVideoOutClose(int handle);
-int APS5_VABI sceVideoOutGetOutputStatus(int handle, VideoOutOutputStatus* status);
-int APS5_VABI sceVideoOutAllowOutputResolutionWqhdDetection(int handle);
-}
-
 static constexpr int SYSTEM_USER = 255;
 static constexpr int MAIN_BUS = 0;
 static constexpr int NEVER_OPENED_HANDLE = 2;
diff --git a/core/libs/tests/GuestVideoRecording.cpp b/core/libs/tests/GuestVideoRecording.cpp
index 3338094cac..ff7b12233e 100644
--- a/core/libs/tests/GuestVideoRecording.cpp
+++ b/core/libs/tests/GuestVideoRecording.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideoRecordingP/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <array>
@@ -6,16 +7,6 @@
 #include <cstdlib>
 #include <exception>
 
-extern "C" {
-void APS5_VABI _sceVideoRecordingQueryParam_nid_postfix(void* param);
-int APS5_VABI sceVideoRecordingGetStatus(void);
-int APS5_VABI sceVideoRecordingQueryMemSize(const void* param);
-int APS5_VABI sceVideoRecordingOpen(const char* path, const void* param, void* heap, int heapSize);
-int APS5_VABI sceVideoRecordingStart(void);
-int APS5_VABI sceVideoRecordingStop(void);
-int APS5_VABI sceVideoRecordingClose(int discard);
-}
-
 namespace {
 
 constexpr int StatusNone = 0;
@@ -49,10 +40,10 @@ int main() {
     std::array<std::uint8_t, 64> heap{};
     heap.fill(Sentinel);
 
-    Require(Throws([&] { _sceVideoRecordingQueryParam_nid_postfix(param.data()); }), "the default parameters were produced");
-    Require(Throws([&] { sceVideoRecordingQueryMemSize(param.data()); }), "a heap size was reported");
+    Require(Throws([&] { _sceVideoRecordingQueryParam_nid_postfix(reinterpret_cast<VideoRecordingQueryParam*>(param.data())); }), "the default parameters were produced");
+    Require(Throws([&] { sceVideoRecordingQueryMemSize(reinterpret_cast<const VideoRecordingParam*>(param.data())); }), "a heap size was reported");
     Require(Throws([&] { sceVideoRecordingQueryMemSize(nullptr); }), "a heap size was reported for no parameters");
-    Require(Throws([&] { sceVideoRecordingOpen("clip.mp4", param.data(), heap.data(), static_cast<int>(heap.size())); }), "the recorder opened");
+    Require(Throws([&] { sceVideoRecordingOpen("clip.mp4", reinterpret_cast<const VideoRecordingParam*>(param.data()), heap.data(), static_cast<int>(heap.size())); }), "the recorder opened");
     Require(Throws([&] { sceVideoRecordingStart(); }), "the encoder started");
     Require(Throws([&] { sceVideoRecordingStop(); }), "the encoder stopped");
     Require(Throws([&] { sceVideoRecordingClose(0); }), "the recorder closed");
@@ -62,6 +53,9 @@ int main() {
     for (const std::uint8_t value : heap) Require(value == Sentinel, "the heap was written");
     Require(sceVideoRecordingGetStatus() == StatusNone, "a failed open changed the status");
 
+    Require(sceVideoRecordingGetInfo(0xa001, nullptr, 0) == static_cast<int>(0x80a80006), "info 0xa001 validation");
+    Require(sceVideoRecordingGetInfo(0xa005, nullptr, 0) == static_cast<int>(0x80a80006), "info 0xa005 validation");
+    Require(sceVideoRecordingGetInfo(0, nullptr, 0) == static_cast<int>(0x80a80003), "unknown info validation");
     std::puts("VideoRecording tests passed");
     return 0;
 }
diff --git a/core/libs/tests/GuestVideodec.cpp b/core/libs/tests/GuestVideodec.cpp
index f4ad8e987e..236336d978 100644
--- a/core/libs/tests/GuestVideodec.cpp
+++ b/core/libs/tests/GuestVideodec.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
+#include "prx/libSceVideodec/include/Api.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <stdexcept>
@@ -6,96 +8,16 @@
 #include "prx/libc/include/General.hpp"
 #include "H264Fixture.hpp"
 
-struct ConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint64_t videodecFlags;
-};
-
-struct ResourceInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct Ctrl {
-    std::uint64_t thisSize;
-    void* handle;
-    std::uint64_t version;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-};
-
-struct AvcInfo {
-    std::uint32_t numUnitsInTick;
-    std::uint32_t timeScale;
-    std::uint8_t fixedFrameRateFlag;
-    std::uint8_t aspectRatioIdc;
-    std::uint16_t sarWidth;
-    std::uint16_t sarHeight;
-    std::uint8_t colourPrimaries;
-    std::uint8_t transferCharacteristics;
-    std::uint8_t matrixCoefficients;
-    std::uint8_t videoFullRangeFlag;
-    std::uint32_t frameCropLeftOffset;
-    std::uint32_t frameCropRightOffset;
-    std::uint32_t frameCropTopOffset;
-    std::uint32_t frameCropBottomOffset;
-};
-
-union CodecInfo {
-    std::uint8_t reserved[64];
-    AvcInfo avc;
-};
-
-struct PictureInfo {
-    std::uint64_t thisSize;
-    std::uint32_t isValid;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    std::uint32_t isErrorPic;
-    std::uint64_t ptsData;
-    std::uint64_t attachedData;
-    CodecInfo codec;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
+using namespace SceVideodec;
 
 static_assert(sizeof(PictureInfo) == 112 && sizeof(AvcInfo) == 36);
 static_assert(sizeof(ConfigInfo) == 40 && sizeof(ResourceInfo) == 56 && sizeof(Ctrl) == 24);
-
-extern "C" {
-int APS5_VABI sceVideodecCreateDecoder(const ConfigInfo*, const ResourceInfo*, Ctrl*);
-int APS5_VABI sceVideodecDecode(Ctrl*, const InputData*, FrameBuffer*, PictureInfo*);
-int APS5_VABI sceVideodecDeleteDecoder(Ctrl*);
-int APS5_VABI sceVideodecFlush(Ctrl*, FrameBuffer*, PictureInfo*);
-int APS5_VABI sceVideodecReset(Ctrl*);
-}
+static_assert(sizeof(SceVideodec2::DecoderConfigInfo) == 40 && sizeof(SceVideodec2::DecoderMemoryInfo) == 72);
 
 namespace {
 
+using namespace SceVideodec;
+
 using namespace H264Fixture;
 
 constexpr int ErrorApiFail = static_cast<int>(0x80C10000);
@@ -105,6 +27,7 @@ constexpr int ErrorAuSize = static_cast<int>(0x80C10009);
 constexpr int ErrorAuPointer = static_cast<int>(0x80C1000A);
 constexpr int ErrorFrameBufferSize = static_cast<int>(0x80C1000B);
 constexpr int ErrorFrameBufferPointer = static_cast<int>(0x80C1000C);
+constexpr int ErrorConfigInfo = static_cast<int>(0x80C1000E);
 constexpr int ErrorArgumentPointer = static_cast<int>(0x80C1000F);
 
 constexpr std::uint32_t Pitch = 64;
@@ -148,7 +71,7 @@ void testDecode(const std::vector<std::vector<std::uint8_t>>& units, std::uint32
         timestamps.push_back(picture.ptsData);
     };
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         auto target = session.MakeTarget();
         PictureInfo picture{sizeof(PictureInfo)};
         const auto status = sceVideodecDecode(&session.ctrl, &input, &target, &picture);
@@ -193,22 +116,22 @@ void testErrors() {
     foreign.handle = reinterpret_cast<void*>(static_cast<std::uintptr_t>(0x1234));
     check(sceVideodecDeleteDecoder(&foreign) == ErrorHandle, "an unknown decoder was deleted");
     check(sceVideodecReset(&foreign) == ErrorHandle, "an unknown decoder was reset");
-    const InputData empty{sizeof(InputData), nullptr, 0, 0, 0, 0};
+    const SceVideodec2::InputData empty{sizeof(SceVideodec2::InputData), nullptr, 0, 0, 0, 0};
     FrameBuffer frame{sizeof(FrameBuffer), nullptr, 0};
     PictureInfo picture{sizeof(PictureInfo)};
     check(sceVideodecDecode(nullptr, &empty, &frame, &picture) == ErrorArgumentPointer, "a null control block was accepted");
     check(sceVideodecDecode(&ctrl, &empty, &frame, &picture) == ErrorAuPointer, "a null access unit was accepted");
-    const InputData sized{sizeof(InputData), reinterpret_cast<const std::uint8_t*>(&config), 0, 0, 0, 0};
+    const SceVideodec2::InputData sized{sizeof(SceVideodec2::InputData), reinterpret_cast<const std::uint8_t*>(&config), 0, 0, 0, 0};
     check(sceVideodecDecode(&ctrl, &sized, &frame, &picture) == ErrorAuSize, "an empty access unit was accepted");
     FrameBuffer missing{sizeof(FrameBuffer), nullptr, FrameBytes};
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 0, 0, 0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 0, 0, 0};
     check(sceVideodecDecode(&ctrl, &input, &missing, &picture) == ErrorFrameBufferPointer, "a null frame buffer was accepted");
     std::vector<std::uint8_t> storage(static_cast<std::size_t>(FrameBytes));
     FrameBuffer shortBuffer{sizeof(FrameBuffer), storage.data(), FrameBytes - 1};
     int refusals = 0;
     for (std::size_t unit = 0; unit < units.size(); ++unit) {
-        const InputData unit0{sizeof(InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
+        const SceVideodec2::InputData unit0{sizeof(SceVideodec2::InputData), units[unit].data(), units[unit].size(), 1000 + unit, unit, 0xa0 + unit};
         const auto status = sceVideodecDecode(&ctrl, &unit0, &shortBuffer, &picture);
         check(status == 0 || status == ErrorFrameBufferSize, "a decode failed");
         if (status == ErrorFrameBufferSize) ++refusals;
@@ -221,7 +144,7 @@ void testErrors() {
 void testReset() {
     Session session;
     const auto units = accessUnits(false);
-    const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
+    const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000, 0, 0xa0};
     auto target = session.MakeTarget();
     PictureInfo picture{sizeof(PictureInfo)};
     check(sceVideodecDecode(&session.ctrl, &input, &target, &picture) == 0, "decode failed");
@@ -230,6 +153,50 @@ void testReset() {
     check(!picture.isValid, "a reset decoder produced a picture");
 }
 
+void testQueryResourceInfo(std::int32_t width, std::int32_t height, std::uint32_t profile, std::uint32_t level) {
+    const ConfigInfo config{sizeof(ConfigInfo), 1, profile, level, width, height, 4, 0};
+    ResourceInfo resource{sizeof(ResourceInfo)};
+    check(sceVideodecQueryResourceInfo(&config, &resource) == 0, "the resource query failed");
+    const SceVideodec2::DecoderConfigInfo mapped{sizeof(SceVideodec2::DecoderConfigInfo), 1, 1, profile, level, width, height, 4, 1};
+    SceVideodec2::DecoderMemoryInfo memory{sizeof(SceVideodec2::DecoderMemoryInfo)};
+    check(sceVideodec2QueryDecoderMemoryInfo_nid_postfix(&mapped, &memory) == 0, "the Videodec2 memory query failed");
+    check(resource.thisSize == sizeof(ResourceInfo), "the resource information size was changed");
+    check(resource.cpuMemorySize == memory.cpuMemorySize, "the CPU memory size differs from libSceVideodec2");
+    check(resource.cpuGpuMemorySize == memory.cpuGpuMemorySize, "the CPU-GPU memory size differs from libSceVideodec2");
+    check(resource.maxFrameBufferSize == memory.maxFrameBufferSize, "the frame buffer size differs from libSceVideodec2");
+    check(resource.frameBufferAlignment == memory.frameBufferAlignment, "the frame buffer alignment differs from libSceVideodec2");
+}
+
+void testQueryResourceInfo() {
+    testQueryResourceInfo(static_cast<std::int32_t>(Width), static_cast<std::int32_t>(CodedHeight), 100, 42);
+    testQueryResourceInfo(1920, 1080, 100, 42);
+    testQueryResourceInfo(3840, 2160, 100, 51);
+    const ConfigInfo config{sizeof(ConfigInfo), 1, 100, 42, static_cast<std::int32_t>(Width),
+                            static_cast<std::int32_t>(CodedHeight), 4, 0};
+    ResourceInfo resource{sizeof(ResourceInfo)};
+    check(sceVideodecQueryResourceInfo(&config, &resource) == 0, "the resource query failed");
+    check(resource.maxFrameBufferSize >= FrameBytes, "the frame buffer size does not hold a decoded picture");
+    Ctrl ctrl{sizeof(Ctrl)};
+    check(sceVideodecCreateDecoder(&config, &resource, &ctrl) == 0, "the queried resources were refused");
+    check(sceVideodecDeleteDecoder(&ctrl) == 0, "the decoder was not deleted");
+    check(sceVideodecQueryResourceInfo(nullptr, &resource) == ErrorArgumentPointer, "a null configuration was accepted");
+    check(sceVideodecQueryResourceInfo(&config, nullptr) == ErrorArgumentPointer, "null resource information was accepted");
+    const ResourceInfo sentinel{sizeof(ResourceInfo), 7, nullptr, 7, nullptr, 7, 7};
+    auto refused = sentinel;
+    auto shortConfig = config;
+    shortConfig.thisSize = sizeof(ConfigInfo) - 8;
+    check(sceVideodecQueryResourceInfo(&shortConfig, &refused) == ErrorStructSize, "a short configuration was accepted");
+    auto shortResource = sentinel;
+    shortResource.thisSize = sizeof(ResourceInfo) - 8;
+    check(sceVideodecQueryResourceInfo(&config, &shortResource) == ErrorStructSize, "short resource information was accepted");
+    auto unsized = config;
+    unsized.maxFrameWidth = 0;
+    check(sceVideodecQueryResourceInfo(&unsized, &refused) == ErrorConfigInfo, "a configuration without a frame size was accepted");
+    check(refused.cpuMemorySize == 7 && refused.cpuGpuMemorySize == 7 && refused.maxFrameBufferSize == 7 && refused.frameBufferAlignment == 7,
+          "a refused query wrote the resource information");
+    check(shortResource.cpuMemorySize == 7 && shortResource.maxFrameBufferSize == 7, "a refused query wrote the resource information");
+}
+
 }
 
 int main() {
@@ -238,6 +205,7 @@ int main() {
         testDecodeCropped();
         testErrors();
         testReset();
+        testQueryResourceInfo();
         std::puts("Videodec tests passed");
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/libs/tests/GuestVideodec2.cpp b/core/libs/tests/GuestVideodec2.cpp
index 986837aa66..f6caa14b4b 100644
--- a/core/libs/tests/GuestVideodec2.cpp
+++ b/core/libs/tests/GuestVideodec2.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -11,209 +12,72 @@
 #include <vector>
 #include "prx/libc/include/General.hpp"
 #include "H264Fixture.hpp"
+#include "HevcFixture.hpp"
 #include "Vp9Fixture.hpp"
 
-struct DecoderConfigInfo {
-    std::uint64_t thisSize;
-    std::uint32_t resourceType;
-    std::uint32_t codecType;
-    std::uint32_t profile;
-    std::uint32_t maxLevel;
-    std::int32_t maxFrameWidth;
-    std::int32_t maxFrameHeight;
-    std::int32_t maxDpbFrameCount;
-    std::uint32_t decodePipelineDepth;
-};
-
-struct DecoderMemoryInfo {
-    std::uint64_t thisSize;
-    std::uint64_t cpuMemorySize;
-    void* cpuMemory;
-    std::uint64_t gpuMemorySize;
-    void* gpuMemory;
-    std::uint64_t cpuGpuMemorySize;
-    void* cpuGpuMemory;
-    std::uint64_t maxFrameBufferSize;
-    std::uint32_t frameBufferAlignment;
-};
-
-struct InputData {
-    std::uint64_t thisSize;
-    const std::uint8_t* auData;
-    std::uint64_t auSize;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-};
-
-struct FrameBuffer {
-    std::uint64_t thisSize;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    bool isAccepted;
-};
-
-struct OutputInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    bool isErrorFrame;
-    std::uint8_t pictureCount;
-    std::uint32_t codecType;
-    std::uint32_t frameWidth;
-    std::uint32_t framePitch;
-    std::uint32_t frameHeight;
-    void* frameBuffer;
-    std::uint64_t frameBufferSize;
-    std::uint32_t frameFormat;
-    std::uint32_t framePitchInBytes;
-};
-
-struct AvcPictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint8_t idrPictureFlag;
-    std::uint8_t profileIdc;
-    std::uint8_t levelIdc;
-    std::uint32_t picWidthInLumaSamples;
-    std::uint32_t picHeightInLumaSamples;
-};
-
-struct Vp9PictureInfo {
-    std::uint64_t thisSize;
-    bool isValid;
-    std::uint64_t ptsData;
-    std::uint64_t dtsData;
-    std::uint64_t attachedData;
-    std::uint32_t profile;
-    std::uint32_t level;
-    std::uint32_t keyFrameFlag;
-    std::uint32_t intraOnly;
-    std::uint8_t bitDepth;
-    std::uint8_t colorRange;
-    std::uint32_t colorSpace;
-    std::uint32_t numFrames;
-    std::uint32_t frameWidth;
-    std::uint32_t frameHeight;
-    std::uint32_t renderWidth;
-    std::uint32_t renderHeight;
-};
+using namespace SceVideodec2;
 
 static_assert(sizeof(Vp9PictureInfo) == 88);
 static_assert(offsetof(Vp9PictureInfo, colorSpace) == 60);
 
-extern "C" {
-int APS5_VABI sceVideodec2QueryDecoderMemoryInfo_nid_postfix(const DecoderConfigInfo*, DecoderMemoryInfo*);
-int APS5_VABI sceVideodec2CreateDecoder_nid_postfix(const DecoderConfigInfo*, const DecoderMemoryInfo*, std::uint64_t*);
-int APS5_VABI sceVideodec2DeleteDecoder_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2Decode_nid_postfix(std::uint64_t, const InputData*, FrameBuffer*, OutputInfo*);
-int APS5_VABI sceVideodec2Flush_nid_postfix(std::uint64_t, FrameBuffer*, OutputInfo*);
-int APS5_VABI sceVideodec2Reset_nid_postfix(std::uint64_t);
-int APS5_VABI sceVideodec2GetPictureInfo_nid_postfix(const OutputInfo*, AvcPictureInfo*, void*);
-int APS5_VABI sceVideodec2GetVp9PictureInfo_nid_postfix(const OutputInfo*, Vp9PictureInfo*);
-int APS5_VABI sceVideodec2GetAvcPictureInfo_nid_postfix(const OutputInfo*, AvcPictureInfo*, AvcPictureInfo*);
-}
-
 namespace {
 
-using namespace H264Fixture;
+using namespace SceVideodec2;
 
+using namespace H264Fixture;
+using namespace HevcFixture;
 
 constexpr std::uint32_t CodecHevc = 974921;
 constexpr std::uint32_t CodecVp9 = 2382845;
 
-constexpr std::array<std::uint8_t, 933> HevcStream{
-    0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x10, 0x00, 0x00, 0x00, 0x01, 0x40, 0x01, 0x0c, 0x01, 0xff,
-    0xff, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00, 0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e,
-    0x95, 0x90, 0x09, 0x00, 0x00, 0x00, 0x01, 0x42, 0x01, 0x01, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00,
-    0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e, 0xa0, 0x20, 0x82, 0x96, 0x59, 0x59, 0x2e,
-    0x4c, 0xaf, 0x01, 0x68, 0x08, 0x00, 0x00, 0x03, 0x00, 0x08, 0x00, 0x00, 0x03, 0x00, 0xf0, 0x40,
-    0x00, 0x00, 0x00, 0x01, 0x44, 0x01, 0xc1, 0x73, 0xd0, 0x89, 0x00, 0x00, 0x01, 0x28, 0x01, 0xaf,
-    0x08, 0xe0, 0xbb, 0xcb, 0xc1, 0x71, 0x26, 0x0f, 0xbf, 0x6c, 0xcb, 0x4d, 0x2b, 0x2c, 0xf4, 0x08,
-    0xe0, 0x17, 0xeb, 0x16, 0xcc, 0x07, 0xd8, 0xdd, 0x11, 0xf8, 0x5e, 0x73, 0x79, 0x57, 0xcb, 0x69,
-    0xa3, 0x1c, 0x9c, 0x43, 0x14, 0xdb, 0x61, 0x0e, 0xc5, 0xc6, 0x9c, 0x9c, 0xf8, 0xf2, 0x07, 0x35,
-    0xf1, 0x98, 0x6c, 0x1a, 0x86, 0x53, 0x5a, 0xcd, 0x4d, 0xda, 0xff, 0xfb, 0x01, 0xda, 0xc3, 0x61,
-    0xb7, 0x8c, 0xae, 0xc9, 0x76, 0xe4, 0x05, 0xd6, 0xfd, 0xe4, 0xcd, 0x93, 0x2c, 0xb1, 0x41, 0x29,
-    0xce, 0x22, 0xf7, 0x77, 0x64, 0x0f, 0x1f, 0xd2, 0xc3, 0x68, 0x32, 0x2f, 0x83, 0xd7, 0x53, 0xbe,
-    0x23, 0xff, 0x8c, 0x46, 0x18, 0x33, 0x90, 0x28, 0xa3, 0xef, 0xd7, 0xb1, 0x46, 0x84, 0xa0, 0xc2,
-    0xd4, 0xd9, 0xce, 0xdf, 0x0a, 0x05, 0xec, 0xad, 0x63, 0xa4, 0x78, 0x27, 0x80, 0x4e, 0x3b, 0x4c,
-    0xa6, 0x42, 0xbc, 0xe3, 0x39, 0x4d, 0xc4, 0xd3, 0x44, 0xf1, 0x22, 0xd0, 0x64, 0x9f, 0xd0, 0x88,
-    0x7f, 0x39, 0x6d, 0x06, 0xc7, 0x79, 0x75, 0x2a, 0x44, 0x3d, 0x21, 0x41, 0x53, 0x60, 0x8d, 0x08,
-    0x9f, 0xd0, 0x34, 0xa6, 0x72, 0x70, 0x3b, 0xa9, 0xfa, 0x62, 0xb1, 0x19, 0x9b, 0x0b, 0xa2, 0xfc,
-    0xb4, 0xb3, 0x2c, 0x58, 0xad, 0xc6, 0xf3, 0xea, 0xc4, 0xd0, 0xf9, 0xea, 0x9e, 0xa7, 0xa4, 0x87,
-    0xb8, 0x19, 0x68, 0xf1, 0xc1, 0x6b, 0x87, 0xa5, 0x99, 0xa0, 0x69, 0x24, 0x28, 0x80, 0xba, 0xd2,
-    0x57, 0xc6, 0xc0, 0x1e, 0x69, 0x1b, 0xce, 0x96, 0xcd, 0x85, 0x9d, 0x59, 0x32, 0x92, 0x71, 0xe7,
-    0x15, 0xf2, 0x9b, 0x71, 0x4b, 0xd4, 0xb6, 0x99, 0xb0, 0x71, 0x9b, 0x9b, 0xdb, 0x33, 0x28, 0x86,
-    0x5e, 0x44, 0xf3, 0x5d, 0x5d, 0x7b, 0x87, 0x6c, 0x99, 0x8a, 0x6d, 0xaf, 0xf8, 0xdd, 0x39, 0x14,
-    0xc0, 0x10, 0x85, 0xaf, 0x3a, 0x77, 0x60, 0x8b, 0xb7, 0x5f, 0x67, 0x45, 0xb4, 0xa7, 0xe7, 0x44,
-    0x77, 0x0a, 0xb9, 0xe1, 0xb2, 0xbe, 0xde, 0x1b, 0x5a, 0xb8, 0xc8, 0x9b, 0x1f, 0x15, 0x37, 0xdc,
-    0xeb, 0x55, 0x12, 0x37, 0xa1, 0xab, 0x9c, 0xcd, 0xdd, 0x42, 0x5d, 0x90, 0x89, 0xc5, 0x99, 0x54,
-    0x6e, 0x9a, 0xd2, 0x71, 0x07, 0xe3, 0x81, 0x20, 0xad, 0xd4, 0x7c, 0xad, 0x69, 0xaf, 0xc7, 0x2d,
-    0x7c, 0x84, 0xf1, 0x5d, 0x43, 0x4a, 0x3c, 0xf6, 0xf8, 0x7e, 0x6a, 0xb2, 0xdd, 0x00, 0xda, 0x30,
-    0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x30, 0x00, 0x00, 0x01, 0x02, 0x01, 0xd0, 0x19, 0x5f, 0x84,
-    0x31, 0x84, 0x50, 0x62, 0xcd, 0x44, 0xa6, 0x4e, 0xbb, 0x2e, 0x87, 0xda, 0x21, 0x25, 0x1c, 0x13,
-    0xfe, 0xc2, 0x97, 0xa3, 0xd5, 0xfd, 0xe2, 0x62, 0xd6, 0xe5, 0x50, 0x7a, 0xda, 0x98, 0x8d, 0xcf,
-    0xbe, 0x40, 0x5d, 0x69, 0xb6, 0x5f, 0xdc, 0x32, 0x68, 0x05, 0x67, 0x70, 0xfd, 0xa0, 0xd3, 0xcd,
-    0x88, 0xeb, 0x12, 0x2e, 0xac, 0xf5, 0x57, 0xa2, 0xc2, 0x81, 0x22, 0x6b, 0x8d, 0x69, 0x6d, 0xac,
-    0x41, 0x05, 0x5b, 0x0b, 0x79, 0xe0, 0x86, 0x05, 0x86, 0x8b, 0x02, 0x51, 0x7d, 0x6e, 0x13, 0x63,
-    0x36, 0xe6, 0x89, 0x22, 0x75, 0xd9, 0xb0, 0x39, 0x27, 0xcd, 0xac, 0x78, 0xe0, 0x3a, 0x6a, 0x17,
-    0x15, 0x05, 0x83, 0x3a, 0xe9, 0x38, 0x7c, 0x75, 0x38, 0xf3, 0xd8, 0x42, 0x57, 0xa1, 0xef, 0x68,
-    0xb8, 0xb5, 0x44, 0xfe, 0x4d, 0x66, 0xa1, 0x09, 0xc5, 0x62, 0xff, 0x87, 0x7e, 0xdb, 0x41, 0x6f,
-    0x4d, 0x5f, 0x16, 0x49, 0xef, 0xca, 0xda, 0x67, 0x01, 0x29, 0x0b, 0xd6, 0xd8, 0xfc, 0x0b, 0x22,
-    0xc8, 0x28, 0xff, 0xb4, 0xb3, 0xa9, 0xf8, 0x9b, 0x78, 0x7d, 0x33, 0xbf, 0xa6, 0x9b, 0x39, 0x64,
-    0x57, 0x41, 0x1f, 0x27, 0x05, 0xfc, 0xcd, 0x44, 0xcd, 0xb2, 0xea, 0x79, 0xe0, 0x00, 0x00, 0x00,
-    0x01, 0x46, 0x01, 0x50, 0x00, 0x00, 0x01, 0x02, 0x01, 0xe0, 0x44, 0x97, 0xe1, 0x8f, 0x40, 0x3d,
-    0x73, 0xde, 0xdf, 0xf5, 0x1c, 0xff, 0xf6, 0xe2, 0x12, 0x16, 0x3d, 0xb6, 0x75, 0xad, 0x9e, 0xb5,
-    0x2b, 0xe7, 0x4a, 0x40, 0xe9, 0x91, 0xd6, 0x86, 0x86, 0x2d, 0xcb, 0xe4, 0xb6, 0x58, 0x4a, 0x2d,
-    0x7b, 0x1b, 0xdb, 0xc5, 0x48, 0x2d, 0x09, 0x4d, 0x32, 0x30, 0xde, 0xaa, 0x61, 0xc2, 0x27, 0x64,
-    0x54, 0x71, 0x89, 0x32, 0x05, 0xc0, 0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x50, 0x00, 0x00, 0x01,
-    0x00, 0x01, 0xe0, 0x24, 0xff, 0xfa, 0x2c, 0x6e, 0xdc, 0x78, 0x3d, 0x08, 0x6d, 0x3b, 0xcf, 0xcc,
-    0xb6, 0x16, 0xeb, 0x9d, 0x5f, 0x46, 0x0b, 0x24, 0x0e, 0x97, 0x99, 0x06, 0x00, 0x00, 0x00, 0x01,
-    0x46, 0x01, 0x30, 0x00, 0x00, 0x01, 0x02, 0x01, 0xd0, 0x28, 0x95, 0xd7, 0xdc, 0x41, 0xc0, 0x61,
-    0x14, 0xd6, 0xee, 0xd4, 0xe8, 0x24, 0x3e, 0x7f, 0x82, 0x22, 0xb0, 0x20, 0xb9, 0xf1, 0x69, 0x9b,
-    0xfe, 0xcc, 0xb7, 0x2e, 0xbd, 0xdb, 0x20, 0xfa, 0xe5, 0x97, 0xd9, 0x95, 0x1d, 0x7e, 0x49, 0x35,
-    0x69, 0xdb, 0x40, 0xa3, 0x5c, 0x0f, 0x74, 0x6f, 0x00, 0x3d, 0x36, 0x05, 0xc0, 0xc4, 0x37, 0x15,
-    0xf9, 0x01, 0x2d, 0xdf, 0xcb, 0x70, 0x3d, 0xfa, 0x47, 0xec, 0x80, 0x07, 0x48, 0x08, 0xc8, 0x54,
-    0xd3, 0xe3, 0x00, 0xa3, 0xe4, 0xce, 0x40, 0x05, 0x0b, 0x51, 0x73, 0x56, 0x33, 0x82, 0xa8, 0x0a,
-    0xc0, 0xd3, 0xc5, 0xf1, 0xeb, 0x32, 0x8e, 0x4e, 0xa7, 0x6f, 0xb2, 0x64, 0x43, 0x54, 0x71, 0xd4,
-    0xaf, 0xc0, 0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x50, 0x00, 0x00, 0x01, 0x00, 0x01, 0xe0, 0x82,
-    0x2f, 0x5f, 0xdc, 0x63, 0x70, 0x3f, 0xaf, 0x66, 0x75, 0x52, 0xe7, 0x7f, 0x62, 0xfb, 0x84, 0x9c,
-    0xef, 0x60, 0x8f, 0xfa, 0x7e, 0x5f, 0x8b, 0x40, 0x15, 0x34, 0x69, 0xe2, 0xc4, 0xfc, 0xff, 0x53,
-    0xb8, 0x1e, 0xc7, 0x20, 0x55, 0xdb, 0x5e, 0x05, 0xbd, 0x7a, 0x85, 0xb4, 0xb7, 0xc1, 0x8d, 0xdb,
-    0x0f, 0xa6, 0xab, 0xb9, 0x00, 0x2a, 0xdb, 0x83, 0xa0, 0xb0, 0xc5, 0x76, 0x6e, 0xe1, 0xb8, 0x72,
-    0xfd, 0x09, 0x61, 0x19, 0xe0,
-};
-
-constexpr std::array<std::uint64_t, 6> HevcHashes{
-    0x7291c31ee57c5065ull, 0x37b15adc47810098ull, 0xc84737b65a65b247ull,
-    0xe39bc891f8286267ull, 0x734caf1ba961b3c2ull, 0x7deb44bd1ed30531ull,
-};
-
-constexpr std::array<std::uint8_t, 234> HevcMain10Stream{
-    0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x10, 0x00, 0x00, 0x00, 0x01, 0x40, 0x01, 0x0c, 0x01, 0xff,
-    0xff, 0x02, 0x20, 0x00, 0x00, 0x03, 0x00, 0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e,
-    0x95, 0x98, 0x09, 0x00, 0x00, 0x00, 0x01, 0x42, 0x01, 0x01, 0x02, 0x20, 0x00, 0x00, 0x03, 0x00,
-    0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e, 0xa0, 0x20, 0x82, 0x93, 0x65, 0x95, 0x9a,
-    0xe4, 0xca, 0xf0, 0x16, 0x80, 0x80, 0x00, 0x00, 0x03, 0x00, 0x80, 0x00, 0x00, 0x0f, 0x04, 0x00,
-    0x00, 0x00, 0x01, 0x44, 0x01, 0xc1, 0x73, 0xd0, 0x89, 0x00, 0x00, 0x01, 0x28, 0x01, 0xaf, 0x08,
-    0x60, 0xf2, 0xfb, 0x04, 0xef, 0x67, 0x67, 0xdc, 0xc7, 0x8e, 0xc7, 0x42, 0x63, 0xeb, 0x7d, 0x28,
-    0x73, 0x95, 0x14, 0x0c, 0x71, 0x10, 0x8b, 0x65, 0x04, 0xbd, 0x03, 0xe6, 0x04, 0x35, 0xb9, 0x9b,
-    0xec, 0x60, 0x2e, 0xea, 0xcf, 0xd0, 0xdd, 0x2d, 0x3a, 0x62, 0x33, 0x9d, 0x7a, 0x74, 0xb0, 0xeb,
-    0x0c, 0x06, 0xe6, 0xa5, 0x30, 0xa7, 0xea, 0xed, 0xc2, 0xa5, 0x8e, 0x7c, 0xda, 0x1b, 0x9d, 0xe4,
-    0xac, 0x2b, 0x38, 0xdb, 0x9c, 0xe8, 0x51, 0x34, 0x46, 0xd2, 0x04, 0x1a, 0x77, 0x87, 0x7a, 0x19,
-    0x70, 0xf9, 0x4f, 0xcb, 0x03, 0x3c, 0x74, 0x25, 0xb9, 0x92, 0x3b, 0x95, 0xe9, 0xd8, 0xaa, 0x9b,
-    0x6b, 0x9b, 0x1f, 0x70, 0x25, 0x2a, 0xe7, 0x6c, 0xc3, 0x7e, 0x55, 0x39, 0xf5, 0x06, 0x5a, 0x23,
-    0xb1, 0x2e, 0xf6, 0x01, 0xac, 0x71, 0xb9, 0x20, 0xb4, 0xef, 0x1d, 0x42, 0x7e, 0x0e, 0x01, 0x1d,
-    0xaf, 0x0a, 0x13, 0x04, 0x8e, 0x03, 0x4d, 0x1e, 0xc4, 0xe0,
-};
+constexpr std::array<std::uint8_t, 658> AvcIpppStream{
+    0x00, 0x00, 0x00, 0x01, 0x09, 0x10, 0x00, 0x00, 0x00, 0x01, 0x67, 0x42, 0xc0, 0x0a, 0xda, 0x11,
+    0xec, 0x04, 0x40, 0x00, 0x00, 0x03, 0x00, 0x40, 0x00, 0x00, 0x0f, 0x03, 0xc4, 0x89, 0xa8, 0x00,
+    0x00, 0x00, 0x01, 0x68, 0xce, 0x0f, 0x2c, 0x80, 0x00, 0x00, 0x01, 0x65, 0x88, 0x84, 0x09, 0x7f,
+    0xe4, 0x5e, 0xd2, 0xf1, 0x40, 0x00, 0x40, 0x07, 0xc5, 0x00, 0x02, 0x50, 0x06, 0x46, 0x28, 0xcd,
+    0x0f, 0x80, 0x38, 0x07, 0xff, 0xc0, 0x07, 0xd8, 0x76, 0x33, 0x23, 0x81, 0xce, 0x7d, 0x73, 0x08,
+    0x2f, 0xc0, 0xff, 0x1f, 0xc1, 0x61, 0x01, 0x2f, 0xc1, 0x00, 0x01, 0xf0, 0x19, 0x8d, 0x80, 0x38,
+    0xd1, 0x0d, 0xcc, 0x7a, 0x99, 0xdf, 0xff, 0xda, 0x00, 0x3d, 0x82, 0x8e, 0xf2, 0x8f, 0x22, 0x18,
+    0x94, 0x07, 0x24, 0x94, 0x45, 0x22, 0x44, 0x5c, 0xb8, 0x7f, 0xe1, 0xa2, 0x99, 0xa3, 0xef, 0xe2,
+    0x80, 0x01, 0x9f, 0x03, 0x81, 0x0e, 0x01, 0x80, 0x70, 0x00, 0x10, 0x05, 0x00, 0x04, 0x00, 0x02,
+    0x00, 0x6e, 0xbf, 0x6f, 0x66, 0xdb, 0x0c, 0x3f, 0x7c, 0x5b, 0xcc, 0xf6, 0x6c, 0xcc, 0x30, 0xe1,
+    0x8c, 0x1c, 0x00, 0x04, 0x04, 0x80, 0x00, 0x42, 0x73, 0xfd, 0x1f, 0xfe, 0x20, 0x00, 0x13, 0x00,
+    0x01, 0x08, 0xf8, 0x80, 0x00, 0x20, 0x2c, 0x1f, 0x04, 0xbb, 0xf3, 0xc0, 0x23, 0xdd, 0x63, 0x6f,
+    0xf9, 0xe1, 0x04, 0x82, 0x53, 0x90, 0x01, 0x89, 0xe5, 0x89, 0x44, 0x5a, 0xf8, 0x39, 0xe0, 0x03,
+    0x20, 0x10, 0x50, 0x00, 0x25, 0xf9, 0x8d, 0xe0, 0x04, 0xf3, 0x62, 0xfd, 0x35, 0x7d, 0x77, 0x7e,
+    0x0b, 0xe1, 0x4d, 0xfe, 0x85, 0x2b, 0xef, 0xe8, 0xf0, 0x80, 0xa2, 0x80, 0x03, 0x04, 0x00, 0x06,
+    0xc0, 0x72, 0x80, 0x02, 0x8c, 0x14, 0xe0, 0x9d, 0xcd, 0xe8, 0x3f, 0xe9, 0xb5, 0x9b, 0x06, 0x4d,
+    0x5e, 0x80, 0xa2, 0x1f, 0x06, 0xda, 0xdf, 0x36, 0xfd, 0xa1, 0x0f, 0xfe, 0x08, 0xb0, 0x26, 0x48,
+    0xaf, 0x17, 0xe9, 0xc5, 0x9f, 0xbf, 0xba, 0x2e, 0x69, 0xa9, 0xe6, 0x7c, 0xbf, 0x4f, 0xfe, 0xc1,
+    0x64, 0x0a, 0xaa, 0x69, 0xda, 0x43, 0xff, 0xf9, 0xfd, 0xfc, 0xff, 0x77, 0xe9, 0x1e, 0x20, 0x18,
+    0x30, 0x1f, 0x80, 0x12, 0xe4, 0x51, 0x4d, 0x9b, 0xff, 0x9b, 0x83, 0xa0, 0x01, 0x72, 0xd1, 0x7f,
+    0x83, 0xa2, 0xe9, 0x82, 0x73, 0x13, 0xd3, 0x8d, 0x59, 0x95, 0x1f, 0xa6, 0x70, 0x4a, 0xeb, 0xb5,
+    0xe0, 0x42, 0x10, 0xc0, 0x02, 0x00, 0x1c, 0x20, 0x00, 0x28, 0x14, 0x68, 0xe0, 0x1a, 0x82, 0xd4,
+    0x87, 0x10, 0x00, 0x46, 0x54, 0x41, 0xc1, 0x81, 0x9a, 0x0c, 0x5d, 0xd0, 0x03, 0xd8, 0x0f, 0x52,
+    0x07, 0x2c, 0x00, 0x7a, 0x92, 0x12, 0x02, 0xdc, 0x01, 0x67, 0x3a, 0xc1, 0xa4, 0x5a, 0x83, 0x95,
+    0xc0, 0x30, 0x02, 0xf8, 0x49, 0xe2, 0x1e, 0x2b, 0xd5, 0x4a, 0x29, 0xa9, 0x6d, 0xf2, 0xc0, 0x7b,
+    0x27, 0x2c, 0xb3, 0xde, 0x18, 0x00, 0x11, 0x71, 0xe0, 0x70, 0x02, 0x0c, 0x34, 0x07, 0x06, 0x01,
+    0xa2, 0x90, 0x71, 0x40, 0x05, 0x12, 0x98, 0x01, 0x01, 0x63, 0xe2, 0xa8, 0xc0, 0xb8, 0xe0, 0xe0,
+    0xf0, 0x06, 0x8a, 0x41, 0xd0, 0x01, 0x59, 0x12, 0x08, 0x30, 0x7d, 0x39, 0x02, 0x1d, 0x5e, 0x01,
+    0x80, 0x26, 0x39, 0x0f, 0xc1, 0xef, 0x83, 0xc3, 0xf8, 0x3c, 0x7c, 0x4f, 0x86, 0xdd, 0x50, 0x6d,
+    0x69, 0xd0, 0xef, 0xe9, 0x70, 0x35, 0xc4, 0xb3, 0x84, 0x40, 0x00, 0x40, 0x48, 0x00, 0x54, 0x84,
+    0x00, 0x0d, 0x51, 0x81, 0xc3, 0x80, 0x3d, 0xd2, 0x1c, 0x20, 0x1c, 0xca, 0xa0, 0x10, 0x1a, 0x46,
+    0x38, 0x04, 0x06, 0xd0, 0x75, 0x00, 0x2f, 0x48, 0x1e, 0x80, 0x3f, 0x49, 0x14, 0xc0, 0x3f, 0xc4,
+    0x52, 0x01, 0x7e, 0x78, 0x36, 0x19, 0x08, 0x43, 0xf6, 0xc5, 0xc0, 0x01, 0xf8, 0x9f, 0x6e, 0x65,
+    0xa4, 0xff, 0xff, 0x86, 0x0e, 0xf8, 0x00, 0x8b, 0xfb, 0xe4, 0xf4, 0x00, 0x57, 0x5c, 0x07, 0x4b,
+    0x80, 0x66, 0xe3, 0xd2, 0xcd, 0xa7, 0x03, 0xa0, 0x41, 0x81, 0x20, 0x00, 0x20, 0x24, 0x80, 0x73,
+    0x80, 0x0e, 0x52, 0x0e, 0xe5, 0xc0, 0x27, 0xd9, 0x08, 0x9c, 0x6c, 0xa6, 0x58, 0x86, 0xc5, 0xe9,
+    0x0e, 0x40, 0x0c, 0xc8, 0x17, 0x5c, 0x50, 0x1a, 0xc1, 0x74, 0x47, 0x9f, 0xf0, 0x81, 0x0d, 0xb0,
+    0x00, 0x00, 0x00, 0x01, 0x09, 0x30, 0x00, 0x00, 0x01, 0x41, 0x9a, 0x20, 0x25, 0xde, 0x49, 0xba,
+    0xbd, 0x70, 0x47, 0xbd, 0x5a, 0xa0, 0x00, 0x00, 0x00, 0x01, 0x09, 0x30, 0x00, 0x00, 0x01, 0x41,
+    0x9a, 0x40, 0x2d, 0xc4, 0xf0, 0x47, 0x55, 0xf7, 0xfa, 0xdf, 0xe0, 0x97, 0xbb, 0xee, 0xad, 0xf0,
+    0x43, 0xd5, 0x7b, 0x00, 0x00, 0x00, 0x01, 0x09, 0x30, 0x00, 0x00, 0x01, 0x41, 0x9a, 0x60, 0x35,
+    0xc6, 0xc0};
 
 void check(bool condition, const std::string& message) {
     if (!condition) throw std::runtime_error(message);
 }
 
-
 template <typename TAction>
 void checkThrows(TAction action) {
     bool threw = false;
@@ -257,23 +121,14 @@ void testFailures() {
             input.auData = unit.data();
             input.auSize = unit.size();
             sceVideodec2Decode_nid_postfix(handle, &input, &frame, &output);
+
         }
         sceVideodec2Flush_nid_postfix(handle, &frame, &output);
+
     });
     check(sceVideodec2DeleteDecoder_nid_postfix(handle) == 0, "delete failed");
 }
 
-std::vector<std::vector<std::uint8_t>> hevcUnits(const std::uint8_t* stream, std::size_t size) {
-    std::vector<std::size_t> starts;
-    for (std::size_t index = 0; index + 4 < size; ++index) {
-        if (stream[index] == 0 && stream[index + 1] == 0 && stream[index + 2] == 0 && stream[index + 3] == 1 && ((stream[index + 4] >> 1u) & 0x3fu) == 35) starts.push_back(index);
-    }
-    starts.push_back(size);
-    std::vector<std::vector<std::uint8_t>> units;
-    for (std::size_t unit = 0; unit + 1 < starts.size(); ++unit) units.emplace_back(stream + starts[unit], stream + starts[unit + 1]);
-    return units;
-}
-
 using Vp9Fixture::Vp9Hashes;
 using Vp9Fixture::ivfFrames;
 
@@ -723,6 +578,48 @@ void testEmptyAccessUnit() {
     check(sceVideodec2DeleteDecoder_nid_postfix(handle) == 0, "delete failed");
 }
 
+void testFlushAfterEveryUnit() {
+    std::vector<std::vector<std::uint8_t>> units;
+    for (std::size_t index = 0; index + 4 < AvcIpppStream.size(); ++index) {
+        if (AvcIpppStream[index] == 0 && AvcIpppStream[index + 1] == 0 && AvcIpppStream[index + 2] == 0 && AvcIpppStream[index + 3] == 1 && (AvcIpppStream[index + 4] & 0x1fu) == 9) units.emplace_back();
+        check(!units.empty(), "the IPPP stream does not start with an access unit delimiter");
+        units.back().push_back(AvcIpppStream[index]);
+    }
+    for (std::size_t index = AvcIpppStream.size() - 4; index < AvcIpppStream.size(); ++index) units.back().push_back(AvcIpppStream[index]);
+    check(units.size() == 4, "unexpected IPPP access unit count");
+    std::vector<std::uint8_t> buffer(frameBufferBytes());
+    const auto decode = [&](bool flushEachUnit) {
+        const auto handle = createDecoder(1, 66);
+        std::vector<std::uint64_t> hashes;
+        const auto take = [&](const OutputInfo& output, const FrameBuffer& frame) {
+            if (!output.isValid) return false;
+            check(frame.isAccepted && output.frameWidth == Width && output.frameHeight == CodedHeight, "unexpected IPPP picture");
+            hashes.push_back(hashNv12(buffer.data(), output.framePitch, output.frameHeight));
+            return true;
+        };
+        const auto flush = [&] {
+            FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size(), false};
+            OutputInfo output{sizeof(OutputInfo)};
+            check(sceVideodec2Flush_nid_postfix(handle, &frame, &output) == 0, "flush failed");
+            return take(output, frame);
+        };
+        for (std::size_t unit = 0; unit < units.size(); ++unit) {
+            const InputData input{sizeof(InputData), units[unit].data(), units[unit].size(), 3000 + unit, unit, 0};
+            FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size(), false};
+            OutputInfo output{sizeof(OutputInfo)};
+            check(sceVideodec2Decode_nid_postfix(handle, &input, &frame, &output) == 0, "IPPP decode failed");
+            take(output, frame);
+            if (flushEachUnit) flush();
+        }
+        while (flush()) {}
+        check(sceVideodec2DeleteDecoder_nid_postfix(handle) == 0, "delete failed");
+        return hashes;
+    };
+    const auto reference = decode(false);
+    check(reference.size() == units.size(), "an IPPP picture is missing without flushes");
+    check(decode(true) == reference, "a flush after each access unit lost or changed the pictures that follow it");
+}
+
 void testDecodeAfterFlush() {
     std::vector<std::uint8_t> buffer(frameBufferBytes());
     const auto handle = createDecoder(1, 100);
@@ -891,6 +788,7 @@ int main() {
         testTenBit();
         testDecodeAfterFlush();
         testEmptyAccessUnit();
+        testFlushAfterEveryUnit();
         testPictureOwnership();
         testConcurrentOwnership();
         std::puts("Videodec2 tests passed");
diff --git a/core/libs/tests/GuestVideodec2Unimplemented.cpp b/core/libs/tests/GuestVideodec2Unimplemented.cpp
index 6f2fc0ef0a..25eb1d8a77 100644
--- a/core/libs/tests/GuestVideodec2Unimplemented.cpp
+++ b/core/libs/tests/GuestVideodec2Unimplemented.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVideodec2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdio>
@@ -5,22 +6,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-int APS5_VABI sceVideodec2TermLibrary();
-int APS5_VABI sceVideodec2QueryLibraryInfo();
-int APS5_VABI sceVideodec2QueryDecoderInfo();
-int APS5_VABI sceVideodec2MapMemory();
-int APS5_VABI sceVideodec2MapDirectMemory(void* decoder, const void* memory);
-int APS5_VABI sceVideodec2PresetDecoderConfigInfo();
-int APS5_VABI sceVideodec2PresetDecoderConfigInfoAvc();
-int APS5_VABI sceVideodec2PresetDecoderConfigInfoHevc();
-int APS5_VABI sceVideodec2PresetDecoderConfigInfoVp9();
-int APS5_VABI sceVideodec2CreateDecoderBid();
-int APS5_VABI sceVideodec2CreateHevcDecoder();
-int APS5_VABI sceVideodec2QueryHevcDecoderMemoryInfo();
-int APS5_VABI sceVideodec2GetHevcPictureInfo();
-}
-
 static bool ReportsNotImplemented(const std::string& name, const std::function<int()>& call) {
     try {
         call();
diff --git a/core/libs/tests/GuestVoice.cpp b/core/libs/tests/GuestVoice.cpp
index cb12940acb..112adf8c4d 100644
--- a/core/libs/tests/GuestVoice.cpp
+++ b/core/libs/tests/GuestVoice.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoice/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
@@ -9,33 +10,6 @@
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceVoiceInit(const VoiceInitParam*, std::int32_t);
-int APS5_VABI sceVoiceSetThreadsParams(const VoiceThreadsParams*);
-int APS5_VABI sceVoiceStart(const VoiceStartParam*);
-int APS5_VABI sceVoiceStop();
-int APS5_VABI sceVoiceEnd_nid_postfix();
-int APS5_VABI sceVoiceCreatePort(std::uint32_t*, const VoicePortParam*);
-int APS5_VABI sceVoiceDeletePort(std::uint32_t);
-int APS5_VABI sceVoiceConnectIPortToOPort(std::uint32_t, std::uint32_t);
-int APS5_VABI sceVoiceDisconnectIPortFromOPort(std::uint32_t, std::uint32_t);
-int APS5_VABI sceVoiceGetVolume(std::uint32_t, float*);
-int APS5_VABI sceVoiceSetMuteFlag(std::uint32_t, std::uint8_t);
-int APS5_VABI sceVoiceSetVolume(std::uint32_t, float);
-int APS5_VABI sceVoiceGetBitRate(std::uint32_t, std::uint32_t*);
-int APS5_VABI sceVoiceGetMuteFlag(std::uint32_t, bool*);
-int APS5_VABI sceVoiceGetPortInfo(std::uint32_t, VoicePortInfo*);
-int APS5_VABI sceVoiceReadFromOPort(std::uint32_t, void*, std::uint32_t*);
-int APS5_VABI sceVoiceResetPort(std::uint32_t);
-int APS5_VABI sceVoicePausePort(std::uint32_t);
-int APS5_VABI sceVoiceResumePort(std::uint32_t);
-int APS5_VABI sceVoicePausePortAll(void);
-int APS5_VABI sceVoiceResumePortAll(void);
-int APS5_VABI sceVoiceGetResourceInfo(VoiceResourceInfo*);
-int APS5_VABI sceVoiceEnableChat(void);
-int APS5_VABI sceVoiceDisableChat(void);
-}
-
 namespace {
 
 constexpr int NotInitialized = static_cast<int>(0x804E0801u);
@@ -70,6 +44,9 @@ void TestNotInitialized() {
     Require(std::memcmp(&info, &sentinel, sizeof(info)) == 0);
     Require(sceVoicePausePortAll() == NotInitialized);
     Require(sceVoiceResumePortAll() == NotInitialized);
+    Require(sceVoiceSetMuteFlagAll(true) == NotInitialized);
+    Require(sceVoiceSetBitRate(0, 16000) == NotInitialized);
+    Require(sceVoiceUpdatePort(0, nullptr) == NotInitialized);
 }
 
 std::uint32_t CreatePort(std::int32_t type, float volume) {
@@ -139,6 +116,24 @@ int main() {
     Require(sceVoiceSetThreadsParams(&threads) == invalidArgument);
     threads.mode = 1;
     RequireThrows([&] { sceVoiceSetThreadsParams(&threads); });
+    VoiceThreadsParams scheduled{1, 700, 0x7f, 700, 0, 0x7f, 700, 0, 0x7f};
+    Require(sceVoiceSetThreadsParams(&scheduled) == 0);
+    scheduled = {1, 256, 0x1fff, 767, 0, 1, 512, 0, 0x1000};
+    Require(sceVoiceSetThreadsParams(&scheduled) == 0);
+    for (const auto priority : {255, 768, 0, -1}) {
+        for (int slot = 0; slot < 3; ++slot) {
+            VoiceThreadsParams outside{1, 700, 0x7f, 700, 0, 0x7f, 700, 0, 0x7f};
+            (slot == 0 ? outside.firstPriority : slot == 1 ? outside.secondPriority : outside.thirdPriority) = priority;
+            RequireThrows([&] { sceVoiceSetThreadsParams(&outside); });
+        }
+    }
+    for (const std::uint64_t affinity : {std::uint64_t{0}, std::uint64_t{0x2000}, std::uint64_t{0x3fff}, UINT64_MAX}) {
+        for (int slot = 0; slot < 3; ++slot) {
+            VoiceThreadsParams outside{1, 700, 0x7f, 700, 0, 0x7f, 700, 0, 0x7f};
+            (slot == 0 ? outside.firstAffinity : slot == 1 ? outside.secondAffinity : outside.thirdAffinity) = affinity;
+            RequireThrows([&] { sceVoiceSetThreadsParams(&outside); });
+        }
+    }
     threads.mode = 0;
     Require(sceVoiceStart(nullptr) == invalidArgument);
     Require(sceVoiceStart(&start) == invalidArgument);
@@ -155,6 +150,8 @@ int main() {
     start.mem_size = 0x40000;
     Require(sceVoiceSetThreadsParams(nullptr) == invalidArgument);
     Require(sceVoiceSetThreadsParams(&threads) == static_cast<std::int32_t>(0x804e080bu));
+    scheduled = {1, 700, 0x7f, 700, 0, 0x7f, 700, 0, 0x7f};
+    Require(sceVoiceSetThreadsParams(&scheduled) == static_cast<std::int32_t>(0x804e080bu));
     Require(sceVoiceGetResourceInfo(nullptr) == invalidArgument);
     struct ResourceOutput {
         VoiceResourceInfo info;
@@ -220,6 +217,56 @@ int main() {
     Require(sceVoiceReadFromOPort(output, data, &size) == 0 && size == 0);
     Require(sceVoiceDisconnectIPortFromOPort(input, output) == 0);
 
+    Require(sceVoiceGetMuteFlag(input, &muted) == 0 && !muted);
+    Require(sceVoiceSetMuteFlagAll(true) == 0);
+    Require(sceVoiceGetMuteFlag(input, &muted) == 0 && muted);
+    Require(sceVoiceSetMuteFlagAll(false) == 0);
+    Require(sceVoiceGetMuteFlag(input, &muted) == 0 && !muted);
+    Require(sceVoiceGetMuteFlag(output, &muted) == 0 && muted);
+
+    std::uint32_t portBitrate = 0;
+    Require(sceVoiceSetBitRate(input, 7300) == 0);
+    Require(sceVoiceGetBitRate(input, &portBitrate) == 0 && portBitrate == 7300);
+    VoicePortInfo rateInfo{};
+    Require(sceVoiceGetPortInfo(input, &rateInfo) == 0 && rateInfo.frame_size == 19);
+    Require(sceVoiceSetBitRate(output + 1, 7300) == portNotFound);
+    Require(sceVoiceSetBitRate(128, 7300) == invalidPort);
+    RequireThrows([&] { sceVoiceSetBitRate(output, 7300); });
+    RequireThrows([&] { sceVoiceSetBitRate(input, 7301); });
+    RequireThrows([&] { sceVoiceSetBitRate(input, 0x80000000u); });
+    Require(sceVoiceGetBitRate(input, &portBitrate) == 0 && portBitrate == 7300);
+
+    VoicePortParam update{};
+    update.port_type = 2;
+    update.mute = 1;
+    update.volume = 0.75f;
+    update.voice.bitrate = 14400;
+    Require(sceVoiceUpdatePort(input, &update) == 0);
+    Require(sceVoiceGetMuteFlag(input, &muted) == 0 && muted);
+    Require(sceVoiceGetVolume(input, &volume) == 0 && volume == 0.75f);
+    Require(sceVoiceGetBitRate(input, &portBitrate) == 0 && portBitrate == 14400);
+    Require(sceVoiceGetPortInfo(input, &rateInfo) == 0 && rateInfo.frame_size == 27);
+    update.voice.bitrate = 1;
+    RequireThrows([&] { sceVoiceUpdatePort(input, &update); });
+    Require(sceVoiceGetBitRate(input, &portBitrate) == 0 && portBitrate == 14400);
+    update.voice.bitrate = 14400;
+    update.port_type = 3;
+    RequireThrows([&] { sceVoiceUpdatePort(input, &update); });
+    RequireThrows([&] { sceVoiceUpdatePort(input, nullptr); });
+    Require(sceVoiceUpdatePort(output + 1, &update) == portNotFound);
+    Require(sceVoiceUpdatePort(128, &update) == invalidPort);
+    VoicePortParam pcm{};
+    pcm.port_type = 3;
+    pcm.volume = std::numeric_limits<float>::quiet_NaN();
+    Require(sceVoiceUpdatePort(output, &pcm) == 0);
+    Require(sceVoiceGetMuteFlag(output, &muted) == 0 && !muted);
+    Require(sceVoiceGetVolume(output, &volume) == 0 && volume == 0.0f);
+    pcm.volume = 0.25f;
+    pcm.mute = 1;
+    Require(sceVoiceUpdatePort(output, &pcm) == 0);
+
+    Require(sceVoiceSetMuteFlagAll(true) == 0);
+
     Require(sceVoiceDeletePort(input) == 0);
     Require(sceVoiceResetPort(input) == portNotFound);
     Require(sceVoicePausePort(input) == portNotFound);
@@ -406,4 +453,17 @@ int main() {
     }
     Require(sceVoiceEnd_nid_postfix() == 0);
 
+    Require(sceVoiceVADSetVersion(0) == 0 && sceVoiceVADSetVersion(1) == 0);
+    Require(sceVoiceVADSetVersion(2) == invalidArgument && sceVoiceVADSetVersion(-1) == invalidArgument);
+    init.app_type = 0x10000000;
+    start.mem_size = 0x40000;
+    Require(sceVoiceInitHQ(nullptr, 100) == invalidArgument && sceVoiceInitHQ(&init, 0) == invalidArgument);
+    Require(sceVoiceInitHQ(&init, 100) == 0);
+    Require(sceVoiceInitHQ(&init, 100) == AlreadyInitialized);
+    Require(sceVoiceInit(&init, 100) == AlreadyInitialized);
+    Require(sceVoiceStart(&start) == 0);
+    Require(sceVoiceEnd_nid_postfix() == 0);
+    Require(sceVoiceInit(&init, 100) == 0);
+    Require(sceVoiceInitHQ(&init, 100) == AlreadyInitialized);
+    Require(sceVoiceEnd_nid_postfix() == 0);
 }
diff --git a/core/libs/tests/GuestVoiceChat.cpp b/core/libs/tests/GuestVoiceChat.cpp
index 0a94bcefa8..0b80ea67e8 100644
--- a/core/libs/tests/GuestVoiceChat.cpp
+++ b/core/libs/tests/GuestVoiceChat.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoiceChat/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
 #include <cstdint>
@@ -5,22 +6,9 @@
 #include <cstdlib>
 
 extern "C" {
-int APS5_VABI sceVoiceChatInitialize(void* param);
-int APS5_VABI sceVoiceChatTerminate(void);
-int APS5_VABI sceVoiceChatRegisterHandlers(void* a);
-int APS5_VABI sceVoiceChatRegisterMicEventHandler(void* a, void* b);
-int APS5_VABI sceVoiceChatRegisterChannelEventHandler(void* a, void* b);
-int APS5_VABI sceVoiceChatUnregisterMicEventHandler(void* a);
-int APS5_VABI sceVoiceChatProcessEvent(void);
-int APS5_VABI sceVoiceChatStartChannelEvent(void* a);
-int APS5_VABI sceVoiceChatStopChannelEvent(void* a);
-int APS5_VABI sceVoiceChatGetMicState(int32_t* state);
-int APS5_VABI sceVoiceChatGetUserVoiceVolumeGain(void* a, int32_t* gain);
-int APS5_VABI sceVoiceChatSetUserVoiceVolumeGain(void* a, int32_t gain);
-int APS5_VABI sceVoiceChatGetActiveChannel(void* channel);
-int APS5_VABI sceVoiceChatCreateRequest(void* a, void* b);
+
 int APS5_VABI sceVoiceChatRequestAcsTts(int requestId, void* a, void* b);
-int APS5_VABI sceVoiceChatAbortRequest(int requestId);
+
 }
 
 static void Require(bool value, const char* what) {
diff --git a/core/libs/tests/GuestVoicePortAttr.cpp b/core/libs/tests/GuestVoicePortAttr.cpp
index ceaa036b65..3bdcc5e6de 100644
--- a/core/libs/tests/GuestVoicePortAttr.cpp
+++ b/core/libs/tests/GuestVoicePortAttr.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVoice/include/Api.hpp"
 #include "SceTypes.hpp"
 
 #include <array>
@@ -8,14 +9,6 @@
 #include <stdexcept>
 #include <string_view>
 
-extern "C" {
-int APS5_VABI sceVoiceInit(const VoiceInitParam*, int32_t);
-int APS5_VABI sceVoiceEnd_nid_postfix(void);
-int APS5_VABI sceVoiceCreatePort(uint32_t*, const VoicePortParam*);
-int APS5_VABI sceVoiceDeletePort(uint32_t);
-int APS5_VABI sceVoiceGetPortAttr(uint32_t, int32_t, void*, int32_t);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
diff --git a/core/libs/tests/GuestVoiceQoS.cpp b/core/libs/tests/GuestVoiceQoS.cpp
index b4d318548e..ebd15d8af0 100644
--- a/core/libs/tests/GuestVoiceQoS.cpp
+++ b/core/libs/tests/GuestVoiceQoS.cpp
@@ -1,36 +1,10 @@
+#include "prx/libSceVoiceQoS/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <stdexcept>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceVoiceQoSInit(void*, std::uint32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSEnd();
-int APS5_VABI sceVoiceQoSCreateLocalEndpoint(std::int32_t*, std::int32_t, std::int32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSDeleteLocalEndpoint(std::int32_t);
-int APS5_VABI sceVoiceQoSCreateRemoteEndpoint(std::int32_t*);
-int APS5_VABI sceVoiceQoSDeleteRemoteEndpoint(std::int32_t);
-int APS5_VABI sceVoiceQoSConnect(std::int32_t*, std::int32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSDisconnect(std::int32_t);
-int APS5_VABI sceVoiceQoSSetLocalEndpointAttribute(std::int32_t, std::int32_t, const void*, std::int32_t);
-int APS5_VABI sceVoiceQoSSetRemoteEndpointAttribute(std::int32_t, std::int32_t, const void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetLocalEndpointAttribute(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetRemoteEndpointAttribute(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetConnectionAttribute(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSGetLocalEndpoint(std::int32_t, std::int32_t*);
-int APS5_VABI sceVoiceQoSGetRemoteEndpoint(std::int32_t, std::int32_t*);
-int APS5_VABI sceVoiceQoSEnableChat();
-int APS5_VABI sceVoiceQoSDisableChat();
-int APS5_VABI sceVoiceQoSGetStatus(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSDebugGetStatus(std::int32_t, std::int32_t, void*, std::int32_t);
-int APS5_VABI sceVoiceQoSInitHQ(void*, std::uint32_t, std::int32_t);
-int APS5_VABI sceVoiceQoSSetMode();
-int APS5_VABI sceVoiceQoSTerminate();
-int APS5_VABI sceVoiceQoSReadPacket(std::int32_t, void*, std::uint32_t*);
-int APS5_VABI sceVoiceQoSWritePacket(std::int32_t, const void*, std::uint32_t*);
-}
-
 static void Require(bool value) { if (!value) std::abort(); }
 
 template <typename TCall>
diff --git a/core/libs/tests/GuestVorbisDec.cpp b/core/libs/tests/GuestVorbisDec.cpp
index 80bce8c123..9b44ce165b 100644
--- a/core/libs/tests/GuestVorbisDec.cpp
+++ b/core/libs/tests/GuestVorbisDec.cpp
@@ -1,99 +1,613 @@
-#include "SceTypes.hpp"
+#include "prx/libSceVorbisDec/include/Api.hpp"
+#include "prx/libSceVorbisDec/include/GuestVorbisFile.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
+#include <vorbis/vorbisenc.h>
+#include <vorbis/vorbisfile.h>
+
+#include <algorithm>
+#include <array>
+#include <cmath>
+#include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
+#include <vector>
 
-extern "C" {
-int APS5_VABI sceVorbisDecOpenCallbacks(void);
-int APS5_VABI sceVorbisDecClear(void);
-int APS5_VABI sceVorbisDecBitrate(void);
-int APS5_VABI sceVorbisDecBitrateInstant(void);
-int APS5_VABI sceVorbisDecStreams(void);
-int APS5_VABI sceVorbisDecSeekable(void);
-int APS5_VABI sceVorbisDecSerialNumber(void);
-int APS5_VABI sceVorbisDecRawTotal(void);
-int APS5_VABI sceVorbisDecPcmTotal(void);
-int APS5_VABI sceVorbisDecTimeTotal(void);
-int APS5_VABI sceVorbisDecRawSeek(void);
-int APS5_VABI sceVorbisDecPcmSeek(void);
-int APS5_VABI sceVorbisDecPcmSeekPage(void);
-int APS5_VABI sceVorbisDecTimeSeek(void);
-int APS5_VABI sceVorbisDecTimeSeekPage(void);
-int APS5_VABI sceVorbisDecRawSeekLap(void);
-int APS5_VABI sceVorbisDecPcmSeekLap(void);
-int APS5_VABI sceVorbisDecPcmSeekPageLap(void);
-int APS5_VABI sceVorbisDecTimeSeekLap(void);
-int APS5_VABI sceVorbisDecTimeSeekPageLap(void);
-int APS5_VABI sceVorbisDecRawTell(void);
-int APS5_VABI sceVorbisDecPcmTell(void);
-int APS5_VABI sceVorbisDecTimeTell(void);
-int APS5_VABI sceVorbisDecInfo(void);
-int APS5_VABI sceVorbisDecComment(void);
-int APS5_VABI sceVorbisDecRead(void);
-int APS5_VABI sceVorbisDecReadFloat(void);
-int APS5_VABI sceVorbisDecReadFilter(void);
-int APS5_VABI sceVorbisDecCrossLap(void);
-int APS5_VABI sceVorbisDecHalfrate(void);
-int APS5_VABI sceVorbisDecHalfrateP(void);
-int APS5_VABI sceVorbisDecGetDecodePriority(void);
-int APS5_VABI sceVorbisDecSetDecodePriority(void);
-int APS5_VABI sceVorbisDecGetLastDecodeError(void);
+using namespace VorbisDec;
+
+namespace {
+
+constexpr int FirstSerial = 0x1234abcd;
+constexpr int SecondSerial = -0x61c88647;
+constexpr int FirstChannels = 3;
+constexpr int SecondChannels = 2;
+constexpr long FirstRate = 44100;
+constexpr long SecondRate = 22050;
+constexpr long FirstSamples = 44100;
+constexpr long SecondSamples = 11025;
+constexpr std::int64_t DecodedBytes = (FirstSamples * FirstChannels + SecondSamples * SecondChannels) * 2;
+constexpr unsigned char Pattern = 0xA5;
+
+void Check(bool value, int line) {
+    if (value) return;
+    std::fprintf(stderr, "VorbisDec check failed at line %d\n", line);
+    std::abort();
 }
+#define Require(value) Check((value), __LINE__)
 
-template <typename TCall>
-static bool Throws(TCall call) {
+template <typename TException, typename TCall>
+bool Throws(TCall call) {
     try {
         call();
-    } catch (const std::runtime_error&) {
+    } catch (const TException&) {
         return true;
     }
     return false;
 }
 
-static void Require(bool value, const char* what) {
-    if (value) return;
-    std::printf("VorbisDec test failed: %s\n", what);
-    std::abort();
+struct Source {
+    const std::vector<unsigned char>* bytes = nullptr;
+    std::size_t position = 0;
+    int closes = 0;
+    void* probe = nullptr;
+    std::int64_t probed = -1;
+    bool throwOnRead = false;
+    bool throwOnClose = false;
+};
+
+std::size_t ReadBytes(Source& source, void* buffer, std::size_t size, std::size_t count) {
+    if (source.throwOnRead) throw std::runtime_error("read callback");
+    if (source.probe) source.probed = sceVorbisDecStreams(source.probe);
+    if (size == 0) return 0;
+    const std::size_t items = std::min(count, (source.bytes->size() - source.position) / size);
+    if (items != 0) std::memcpy(buffer, source.bytes->data() + source.position, items * size);
+    source.position += items * size;
+    return items;
+}
+
+int SeekBytes(Source& source, std::int64_t offset, int whence) {
+    const auto size = static_cast<std::int64_t>(source.bytes->size());
+    const std::int64_t base = whence == SEEK_SET ? 0 : whence == SEEK_CUR ? static_cast<std::int64_t>(source.position) : size;
+    if (offset < -base || offset > size - base) return -1;
+    source.position = static_cast<std::size_t>(base + offset);
+    return 0;
+}
+
+std::size_t APS5_VABI GuestRead(void* buffer, std::size_t size, std::size_t count, void* source) {
+    return ReadBytes(*static_cast<Source*>(source), buffer, size, count);
+}
+
+int APS5_VABI GuestSeek(void* source, std::int64_t offset, int whence) {
+    return SeekBytes(*static_cast<Source*>(source), offset, whence);
+}
+
+int APS5_VABI GuestClose(void* source) {
+    auto& closing = *static_cast<Source*>(source);
+    ++closing.closes;
+    if (closing.throwOnClose) throw std::runtime_error("close callback");
+    return 0;
+}
+
+std::int64_t APS5_VABI GuestTell(void* source) {
+    return static_cast<std::int64_t>(static_cast<Source*>(source)->position);
+}
+
+std::size_t HostRead(void* buffer, std::size_t size, std::size_t count, void* source) {
+    return ReadBytes(*static_cast<Source*>(source), buffer, size, count);
+}
+
+int HostSeek(void* source, ogg_int64_t offset, int whence) {
+    return SeekBytes(*static_cast<Source*>(source), offset, whence);
+}
+
+int HostClose(void* source) {
+    ++static_cast<Source*>(source)->closes;
+    return 0;
+}
+
+long HostTell(void* source) {
+    return static_cast<long>(static_cast<Source*>(source)->position);
+}
+
+constexpr GuestCallbacks SeekableCallbacks{GuestRead, GuestSeek, GuestClose, GuestTell};
+constexpr GuestCallbacks StreamingCallbacks{GuestRead, nullptr, GuestClose, nullptr};
+const ov_callbacks HostSeekableCallbacks{HostRead, HostSeek, HostClose, HostTell};
+const ov_callbacks HostStreamingCallbacks{HostRead, nullptr, HostClose, nullptr};
+
+struct GuestFile {
+    alignas(16) std::array<unsigned char, 1024> bytes;
+
+    GuestFile() { bytes.fill(Pattern); }
+
+    void* Get() { return bytes.data(); }
+
+    bool Untouched() const {
+        return std::all_of(bytes.begin(), bytes.end(), [](unsigned char value) { return value == Pattern; });
+    }
+};
+
+struct FilterLog {
+    int calls = 0;
+    std::int64_t firstChannels = 0;
+    std::int64_t lastChannels = 0;
+    std::int64_t samples = 0;
+};
+
+void Halve(float** pcm, std::int64_t channels, std::int64_t samples) {
+    for (std::int64_t channel = 0; channel < channels; ++channel)
+        for (std::int64_t index = 0; index < samples; ++index) pcm[channel][index] *= 0.5f;
+}
+
+void APS5_VABI GuestHalve(float** pcm, std::int64_t channels, std::int64_t samples, void* param) {
+    auto* log = static_cast<FilterLog*>(param);
+    if (log->calls++ == 0) log->firstChannels = channels;
+    log->lastChannels = channels;
+    log->samples += samples;
+    Halve(pcm, channels, samples);
+}
+
+void HostHalve(float** pcm, long channels, long samples, void*) {
+    Halve(pcm, channels, samples);
+}
+
+void AppendPage(std::vector<unsigned char>& out, const ogg_page& page) {
+    out.insert(out.end(), page.header, page.header + page.header_len);
+    out.insert(out.end(), page.body, page.body + page.body_len);
+}
+
+void EncodeLink(std::vector<unsigned char>& out, int serial, int channels, long rate, long samples, const char* title) {
+    vorbis_info info;
+    vorbis_info_init(&info);
+    Require(vorbis_encode_init_vbr(&info, channels, rate, 0.1f) == 0);
+    vorbis_comment comment;
+    vorbis_comment_init(&comment);
+    vorbis_comment_add_tag(&comment, "TITLE", title);
+    vorbis_comment_add_tag(&comment, "ARTIST", "AnyPS5");
+    vorbis_dsp_state dsp;
+    Require(vorbis_analysis_init(&dsp, &info) == 0);
+    vorbis_block block;
+    vorbis_block_init(&dsp, &block);
+    ogg_stream_state stream;
+    ogg_stream_init(&stream, serial);
+    ogg_packet identification;
+    ogg_packet comments;
+    ogg_packet codebooks;
+    vorbis_analysis_headerout(&dsp, &comment, &identification, &comments, &codebooks);
+    ogg_stream_packetin(&stream, &identification);
+    ogg_stream_packetin(&stream, &comments);
+    ogg_stream_packetin(&stream, &codebooks);
+    ogg_page page;
+    while (ogg_stream_flush(&stream, &page) != 0) AppendPage(out, page);
+    for (long done = 0;;) {
+        const long count = std::min(1024L, samples - done);
+        if (count > 0) {
+            float** buffer = vorbis_analysis_buffer(&dsp, static_cast<int>(count));
+            for (int channel = 0; channel < channels; ++channel) {
+                const double frequency = 220.0 * (channel + 1) + 37.0 * serial / 1e9;
+                for (long index = 0; index < count; ++index) {
+                    buffer[channel][index] = static_cast<float>(0.3 * std::sin(6.283185307179586 * frequency * static_cast<double>(done + index) / static_cast<double>(rate)));
+                }
+            }
+        }
+        vorbis_analysis_wrote(&dsp, static_cast<int>(count));
+        done += count;
+        while (vorbis_analysis_blockout(&dsp, &block) == 1) {
+            vorbis_analysis(&block, nullptr);
+            vorbis_bitrate_addblock(&block);
+            ogg_packet packet;
+            while (vorbis_bitrate_flushpacket(&dsp, &packet) == 1) {
+                ogg_stream_packetin(&stream, &packet);
+                while (ogg_stream_pageout_fill(&stream, &page, 1024) != 0) AppendPage(out, page);
+            }
+        }
+        if (count == 0) break;
+    }
+    while (ogg_stream_flush(&stream, &page) != 0) AppendPage(out, page);
+    ogg_stream_clear(&stream);
+    vorbis_block_clear(&block);
+    vorbis_dsp_clear(&dsp);
+    vorbis_comment_clear(&comment);
+    vorbis_info_clear(&info);
+}
+
+std::int64_t RequireSameRead(void* vf, OggVorbis_File& reference, int bigEndian = 0, int word = 2, int isSigned = 1) {
+    std::array<char, 4096> guest{};
+    std::array<char, 4096> host{};
+    int guestStream = -1;
+    int hostStream = -1;
+    const std::int64_t got = sceVorbisDecRead(vf, guest.data(), static_cast<int>(guest.size()), bigEndian, word, isSigned, &guestStream);
+    const long expected = ov_read(&reference, host.data(), static_cast<int>(host.size()), bigEndian, word, isSigned, &hostStream);
+    Require(got == expected);
+    Require(got <= 0 || (guestStream == hostStream && std::memcmp(guest.data(), host.data(), static_cast<std::size_t>(got)) == 0));
+    return got;
+}
+
+std::int64_t DecodeTogether(void* vf, OggVorbis_File& reference) {
+    std::int64_t total = 0;
+    for (;;) {
+        const std::int64_t got = RequireSameRead(vf, reference);
+        Require(got >= 0 || got == OV_HOLE);
+        if (got == 0) return total;
+        if (got > 0) total += got;
+    }
+}
+
+void RequireSameTells(void* vf, OggVorbis_File& reference) {
+    Require(sceVorbisDecPcmTell(vf) == ov_pcm_tell(&reference));
+    Require(sceVorbisDecRawTell(vf) == ov_raw_tell(&reference));
+    Require(sceVorbisDecTimeTell(vf) == ov_time_tell(&reference));
+}
+
+void TestSeekable(const std::vector<unsigned char>& stream) {
+    GuestFile guest;
+    GuestFile probe;
+    void* vf = guest.Get();
+    Source source{&stream};
+    source.probe = probe.Get();
+    Require(sceVorbisDecOpenCallbacks(&source, vf, nullptr, 0, SeekableCallbacks) == 0);
+    Require(source.probed == 0 && source.closes == 0);
+    Source referenceSource{&stream};
+    OggVorbis_File reference{};
+    Require(ov_open_callbacks(&referenceSource, &reference, nullptr, 0, HostSeekableCallbacks) == 0);
+
+    Require(sceVorbisDecStreams(vf) == 2 && sceVorbisDecSeekable(vf) == 1);
+    Require(sceVorbisDecSerialNumber(vf, 0) == FirstSerial && sceVorbisDecSerialNumber(vf, 1) == SecondSerial);
+    Require(sceVorbisDecSerialNumber(vf, -1) == FirstSerial && sceVorbisDecSerialNumber(vf, 7) == SecondSerial);
+    Require(sceVorbisDecPcmTotal(vf, 0) == FirstSamples && sceVorbisDecPcmTotal(vf, 1) == SecondSamples);
+    Require(sceVorbisDecPcmTotal(vf, -1) == FirstSamples + SecondSamples && sceVorbisDecPcmTotal(vf, 2) == OV_EINVAL);
+    Require(sceVorbisDecRawTotal(vf, -1) == ov_raw_total(&reference, -1) && sceVorbisDecRawTotal(vf, -1) > 0);
+    Require(sceVorbisDecRawTotal(vf, 0) == ov_raw_total(&reference, 0) && sceVorbisDecRawTotal(vf, 1) == ov_raw_total(&reference, 1));
+    Require(sceVorbisDecTimeTotal(vf, 0) == 1.0 && sceVorbisDecTimeTotal(vf, 1) == 0.5 && sceVorbisDecTimeTotal(vf, -1) == 1.5);
+    Require(sceVorbisDecBitrate(vf, -1) == ov_bitrate(&reference, -1) && sceVorbisDecBitrate(vf, 1) == ov_bitrate(&reference, 1));
+    Require(sceVorbisDecBitrate(vf, -1) > 0 && sceVorbisDecBitrate(vf, 2) == OV_EINVAL);
+    Require(sceVorbisDecBitrateInstant(vf) == OV_FALSE);
+
+    GuestInfo* first = sceVorbisDecInfo(vf, 0);
+    GuestInfo* second = sceVorbisDecInfo(vf, 1);
+    Require(first && second && first != second && sceVorbisDecInfo(vf, 0) == first);
+    Require(sceVorbisDecInfo(vf, -1) == first && sceVorbisDecInfo(vf, 2) == nullptr);
+    Require(first->version == 0 && first->channels == FirstChannels && first->rate == FirstRate);
+    Require(second->version == 0 && second->channels == SecondChannels && second->rate == SecondRate);
+    for (int link = 0; link < 2; ++link) {
+        const GuestInfo* info = sceVorbisDecInfo(vf, link);
+        const vorbis_info* host = ov_info(&reference, link);
+        Require(info->bitrate_upper == host->bitrate_upper && info->bitrate_nominal == host->bitrate_nominal);
+        Require(info->bitrate_lower == host->bitrate_lower && info->bitrate_window == host->bitrate_window && info->codec_setup != nullptr);
+    }
+    const GuestComment* comment = sceVorbisDecComment(vf, 1);
+    Require(comment && comment->comments == 2 && comment->comment_lengths[0] == 12 && comment->comment_lengths[1] == 13);
+    Require(std::strcmp(comment->user_comments[0], "TITLE=second") == 0 && std::strcmp(comment->user_comments[1], "ARTIST=AnyPS5") == 0);
+    Require(std::strcmp(comment->vendor, ov_comment(&reference, 1)->vendor) == 0);
+    Require(sceVorbisDecComment(vf, -1) == sceVorbisDecComment(vf, 0) && sceVorbisDecComment(vf, 2) == nullptr);
+    Require(std::strcmp(sceVorbisDecComment(vf, 0)->user_comments[0], "TITLE=first") == 0);
+
+    const std::int64_t firstRead = RequireSameRead(vf, reference);
+    Require(firstRead > 0 && sceVorbisDecBitrateInstant(vf) == ov_bitrate_instant(&reference));
+    Require(sceVorbisDecInfo(vf, -1) == first);
+    Require(firstRead + DecodeTogether(vf, reference) == DecodedBytes);
+    Require(sceVorbisDecPcmTell(vf) == FirstSamples + SecondSamples && sceVorbisDecTimeTell(vf) == 1.5);
+    RequireSameTells(vf, reference);
+    Require(sceVorbisDecInfo(vf, -1) == second && sceVorbisDecSerialNumber(vf, -1) == SecondSerial);
+
+    Require(sceVorbisDecPcmSeek(vf, 0) == 0 && ov_pcm_seek(&reference, 0) == 0);
+    Require(DecodeTogether(vf, reference) == DecodedBytes);
+
+    Require(sceVorbisDecPcmSeek(vf, 1000) == 0 && ov_pcm_seek(&reference, 1000) == 0);
+    Require(sceVorbisDecPcmTell(vf) == 1000);
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0 && RequireSameRead(vf, reference, 1, 2, 0) > 0 && RequireSameRead(vf, reference, 0, 1, 0) > 0);
+    Require(sceVorbisDecPcmSeekPage(vf, FirstSamples + 3000) == ov_pcm_seek_page(&reference, FirstSamples + 3000));
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0 && sceVorbisDecInfo(vf, -1) == second);
+    Require(sceVorbisDecTimeSeek(vf, 0.25) == 0 && ov_time_seek(&reference, 0.25) == 0);
+    Require(sceVorbisDecPcmTell(vf) == FirstRate / 4);
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0 && sceVorbisDecInfo(vf, -1) == first);
+    Require(sceVorbisDecTimeSeekPage(vf, 1.2) == ov_time_seek_page(&reference, 1.2));
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0);
+    const auto middle = static_cast<std::int64_t>(stream.size() / 2);
+    Require(sceVorbisDecRawSeek(vf, middle) == 0 && ov_raw_seek(&reference, middle) == 0);
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0);
+
+    Require(sceVorbisDecPcmSeekLap(vf, 5000) == 0 && ov_pcm_seek_lap(&reference, 5000) == 0);
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0 && RequireSameRead(vf, reference) > 0);
+    Require(sceVorbisDecPcmSeekPageLap(vf, 30000) == ov_pcm_seek_page_lap(&reference, 30000));
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0);
+    Require(sceVorbisDecRawSeekLap(vf, middle / 2) == ov_raw_seek_lap(&reference, middle / 2));
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0);
+    Require(sceVorbisDecTimeSeekLap(vf, 1.1) == 0 && ov_time_seek_lap(&reference, 1.1) == 0);
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0 && sceVorbisDecInfo(vf, -1) == second);
+    Require(sceVorbisDecTimeSeekPageLap(vf, 0.75) == ov_time_seek_page_lap(&reference, 0.75));
+    RequireSameTells(vf, reference);
+    Require(RequireSameRead(vf, reference) > 0 && sceVorbisDecInfo(vf, -1) == first);
+
+    Require(sceVorbisDecPcmSeek(vf, -1) == OV_EINVAL && sceVorbisDecPcmSeek(vf, FirstSamples + SecondSamples + 1) == OV_EINVAL);
+    Require(sceVorbisDecTimeSeek(vf, -0.5) == OV_EINVAL && sceVorbisDecTimeSeek(vf, 2.0) == OV_EINVAL);
+    Require(sceVorbisDecRawSeek(vf, -1) == OV_EINVAL && sceVorbisDecRawSeek(vf, middle * 3) == OV_EINVAL);
+
+    Require(source.closes == 0 && sceVorbisDecClear(vf) == 0 && source.closes == 1);
+    Require(sceVorbisDecStreams(vf) == 0 && sceVorbisDecInfo(vf, 0) == nullptr && sceVorbisDecPcmTell(vf) == OV_EINVAL);
+    Require(sceVorbisDecClear(vf) == 0 && source.closes == 1);
+    Require(ov_clear(&reference) == 0 && referenceSource.closes == 1);
+    Require(source.probed == 0 && guest.Untouched() && probe.Untouched());
+}
+
+void TestStreaming(const std::vector<unsigned char>& stream) {
+    GuestFile guest;
+    void* vf = guest.Get();
+    const auto* initial = reinterpret_cast<const char*>(stream.data());
+    Source source{&stream, 64};
+    Require(sceVorbisDecOpenCallbacks(&source, vf, initial, 64, StreamingCallbacks) == 0);
+    Source referenceSource{&stream, 64};
+    OggVorbis_File reference{};
+    Require(ov_open_callbacks(&referenceSource, &reference, initial, 64, HostStreamingCallbacks) == 0);
+
+    Require(sceVorbisDecSeekable(vf) == 0 && sceVorbisDecStreams(vf) == 1);
+    Require(sceVorbisDecPcmTotal(vf, -1) == OV_EINVAL && sceVorbisDecRawTotal(vf, 0) == OV_EINVAL && sceVorbisDecTimeTotal(vf, -1) == OV_EINVAL);
+    Require(sceVorbisDecRawSeek(vf, 0) == OV_ENOSEEK && sceVorbisDecPcmSeek(vf, 0) == OV_ENOSEEK && sceVorbisDecTimeSeekPage(vf, 0.0) == OV_ENOSEEK);
+    Require(sceVorbisDecBitrate(vf, 0) == ov_bitrate(&reference, 0) && sceVorbisDecBitrate(vf, 1) == ov_bitrate(&reference, 1));
+    Require(sceVorbisDecSerialNumber(vf, 3) == FirstSerial);
+    GuestInfo* info = sceVorbisDecInfo(vf, 0);
+    Require(info && info == sceVorbisDecInfo(vf, 5) && info == sceVorbisDecInfo(vf, -1));
+    Require(info->channels == FirstChannels && info->rate == FirstRate);
+    const GuestComment* comment = sceVorbisDecComment(vf, 4);
+    Require(comment && std::strcmp(comment->user_comments[0], "TITLE=first") == 0);
+
+    Require(DecodeTogether(vf, reference) == DecodedBytes);
+    Require(info->channels == SecondChannels && info->rate == SecondRate && sceVorbisDecInfo(vf, 0) == info);
+    Require(std::strcmp(comment->user_comments[0], "TITLE=second") == 0);
+    Require(sceVorbisDecSerialNumber(vf, 0) == SecondSerial);
+    RequireSameTells(vf, reference);
+    Require(sceVorbisDecClear(vf) == 0 && source.closes == 1);
+    Require(ov_clear(&reference) == 0 && referenceSource.closes == 1);
+    Require(guest.Untouched());
+}
+
+void TestFloatAndFilter(const std::vector<unsigned char>& stream) {
+    GuestFile guest;
+    void* vf = guest.Get();
+    Source source{&stream};
+    Require(sceVorbisDecOpenCallbacks(&source, vf, nullptr, 0, SeekableCallbacks) == 0);
+    Source referenceSource{&stream};
+    OggVorbis_File reference{};
+    Require(ov_open_callbacks(&referenceSource, &reference, nullptr, 0, HostSeekableCallbacks) == 0);
+
+    for (int round = 0; round < 6; ++round) {
+        float** pcm = nullptr;
+        float** hostPcm = nullptr;
+        int guestStream = -1;
+        int hostStream = -1;
+        const std::int64_t got = sceVorbisDecReadFloat(vf, &pcm, 300, &guestStream);
+        const long expected = ov_read_float(&reference, &hostPcm, 300, &hostStream);
+        Require(got == expected && got > 0 && got <= 300 && guestStream == hostStream && guestStream == 0);
+        for (int channel = 0; channel < FirstChannels; ++channel) {
+            Require(std::memcmp(pcm[channel], hostPcm[channel], static_cast<std::size_t>(got) * sizeof(float)) == 0);
+        }
+    }
+    Require(sceVorbisDecReadFloat(vf, nullptr, 50, nullptr) == ov_read_float(&reference, nullptr, 50, nullptr));
+    RequireSameTells(vf, reference);
+
+    FilterLog log;
+    std::int64_t total = 0;
+    for (;;) {
+        std::array<char, 4096> guestBytes{};
+        std::array<char, 4096> hostBytes{};
+        int guestStream = -1;
+        int hostStream = -1;
+        const std::int64_t got = sceVorbisDecReadFilter(vf, guestBytes.data(), static_cast<int>(guestBytes.size()), 0, 2, 1, &guestStream, GuestHalve, &log);
+        const long expected = ov_read_filter(&reference, hostBytes.data(), static_cast<int>(hostBytes.size()), 0, 2, 1, &hostStream, HostHalve, nullptr);
+        Require(got == expected && got >= 0);
+        if (got == 0) break;
+        Require(guestStream == hostStream && std::memcmp(guestBytes.data(), hostBytes.data(), static_cast<std::size_t>(got)) == 0);
+        total += got;
+    }
+    Require(total > 0 && log.calls > 0 && log.samples > 0 && log.firstChannels == FirstChannels && log.lastChannels == SecondChannels);
+
+    Require(sceVorbisDecPcmSeek(vf, 0) == 0 && ov_pcm_seek(&reference, 0) == 0);
+    std::array<char, 4096> filtered{};
+    std::array<char, 4096> plain{};
+    int bitstream = -1;
+    const int calls = log.calls;
+    const std::int64_t got = sceVorbisDecReadFilter(vf, filtered.data(), static_cast<int>(filtered.size()), 0, 2, 1, &bitstream, nullptr, &log);
+    Require(got > 0 && got == ov_read(&reference, plain.data(), static_cast<int>(plain.size()), 0, 2, 1, &bitstream));
+    Require(std::memcmp(filtered.data(), plain.data(), static_cast<std::size_t>(got)) == 0 && log.calls == calls);
+    Require(sceVorbisDecClear(vf) == 0 && source.closes == 1 && ov_clear(&reference) == 0);
+    Require(guest.Untouched());
+}
+
+void TestHalfrate(const std::vector<unsigned char>& stream) {
+    GuestFile guest;
+    void* vf = guest.Get();
+    Source source{&stream};
+    Require(sceVorbisDecOpenCallbacks(&source, vf, nullptr, 0, SeekableCallbacks) == 0);
+    Source referenceSource{&stream};
+    OggVorbis_File reference{};
+    Require(ov_open_callbacks(&referenceSource, &reference, nullptr, 0, HostSeekableCallbacks) == 0);
+
+    Require(sceVorbisDecHalfrateP(vf) == 0);
+    Require(RequireSameRead(vf, reference) > 0 && RequireSameRead(vf, reference) > 0);
+    Require(sceVorbisDecHalfrate(vf, 1) == 0 && ov_halfrate(&reference, 1) == 0);
+    Require(sceVorbisDecHalfrateP(vf) == 1 && ov_halfrate_p(&reference) == 1);
+    RequireSameTells(vf, reference);
+    const std::int64_t half = DecodeTogether(vf, reference);
+    Require(half > 0 && half < DecodedBytes / 2);
+    RequireSameTells(vf, reference);
+    Require(sceVorbisDecPcmTell(vf) > FirstSamples);
+    Require(sceVorbisDecHalfrate(vf, 0) == 0 && sceVorbisDecHalfrateP(vf) == 0);
+    Require(sceVorbisDecClear(vf) == 0 && source.closes == 1 && ov_clear(&reference) == 0);
+    Require(guest.Untouched());
+}
+
+void TestCrossLap(const std::vector<unsigned char>& stream) {
+    GuestFile first;
+    GuestFile second;
+    GuestFile closed;
+    GuestFile otherClosed;
+    Source firstSource{&stream};
+    Source secondSource{&stream};
+    Require(sceVorbisDecOpenCallbacks(&secondSource, second.Get(), nullptr, 0, SeekableCallbacks) == 0);
+    firstSource.probe = second.Get();
+    Require(sceVorbisDecOpenCallbacks(&firstSource, first.Get(), nullptr, 0, SeekableCallbacks) == 0);
+    Require(firstSource.probed == 2);
+    Source firstReferenceSource{&stream};
+    Source secondReferenceSource{&stream};
+    OggVorbis_File firstReference{};
+    OggVorbis_File secondReference{};
+    Require(ov_open_callbacks(&firstReferenceSource, &firstReference, nullptr, 0, HostSeekableCallbacks) == 0);
+    Require(ov_open_callbacks(&secondReferenceSource, &secondReference, nullptr, 0, HostSeekableCallbacks) == 0);
+
+    Require(RequireSameRead(first.Get(), firstReference) > 0 && RequireSameRead(first.Get(), firstReference) > 0);
+    Require(sceVorbisDecPcmSeek(second.Get(), FirstSamples + 2000) == 0 && ov_pcm_seek(&secondReference, FirstSamples + 2000) == 0);
+    Require(sceVorbisDecCrossLap(first.Get(), second.Get()) == 0 && ov_crosslap(&firstReference, &secondReference) == 0);
+    for (int round = 0; round < 3; ++round) {
+        Require(RequireSameRead(second.Get(), secondReference) > 0);
+        Require(RequireSameRead(first.Get(), firstReference) > 0);
+    }
+    RequireSameTells(first.Get(), firstReference);
+    RequireSameTells(second.Get(), secondReference);
+    Require(sceVorbisDecCrossLap(first.Get(), first.Get()) == 0);
+    Require(sceVorbisDecCrossLap(first.Get(), closed.Get()) == OV_EINVAL && sceVorbisDecCrossLap(closed.Get(), second.Get()) == OV_EINVAL);
+    Require(sceVorbisDecCrossLap(closed.Get(), otherClosed.Get()) == OV_EINVAL && sceVorbisDecCrossLap(closed.Get(), closed.Get()) == 0);
+    Require(sceVorbisDecCrossLap(nullptr, nullptr) == 0);
+    OggVorbis_File zeroed{};
+    Require(sceVorbisDecCrossLap(closed.Get(), nullptr) == OV_EINVAL && ov_crosslap(&zeroed, nullptr) == OV_EINVAL);
+    Require(Throws<std::invalid_argument>([&] { sceVorbisDecCrossLap(first.Get(), nullptr); }));
+    Require(Throws<std::invalid_argument>([&] { sceVorbisDecCrossLap(nullptr, closed.Get()); }));
+    Require(sceVorbisDecClear(first.Get()) == 0 && sceVorbisDecClear(second.Get()) == 0);
+    Require(firstSource.closes == 1 && secondSource.closes == 1);
+    Require(ov_clear(&firstReference) == 0 && ov_clear(&secondReference) == 0);
+    Require(first.Untouched() && second.Untouched() && closed.Untouched() && otherClosed.Untouched());
+}
+
+void TestNeverOpened() {
+    GuestFile guest;
+    void* vf = guest.Get();
+    Require(sceVorbisDecStreams(vf) == 0 && sceVorbisDecSeekable(vf) == 0);
+    Require(sceVorbisDecSerialNumber(vf, -1) == 0 && sceVorbisDecSerialNumber(vf, 0) == 0 && sceVorbisDecSerialNumber(vf, 3) == 0);
+    Require(sceVorbisDecBitrate(vf, -1) == OV_EINVAL && sceVorbisDecBitrate(vf, 0) == OV_EINVAL && sceVorbisDecBitrateInstant(vf) == OV_EINVAL);
+    Require(sceVorbisDecRawTotal(vf, -1) == OV_EINVAL && sceVorbisDecPcmTotal(vf, 0) == OV_EINVAL && sceVorbisDecTimeTotal(vf, -1) == OV_EINVAL);
+    Require(sceVorbisDecRawSeek(vf, 0) == OV_EINVAL && sceVorbisDecPcmSeek(vf, 0) == OV_EINVAL && sceVorbisDecPcmSeekPage(vf, 0) == OV_EINVAL);
+    Require(sceVorbisDecTimeSeek(vf, 0.0) == OV_EINVAL && sceVorbisDecTimeSeekPage(vf, 0.0) == OV_EINVAL);
+    Require(sceVorbisDecRawSeekLap(vf, 0) == OV_EINVAL && sceVorbisDecPcmSeekLap(vf, 0) == OV_EINVAL && sceVorbisDecPcmSeekPageLap(vf, 0) == OV_EINVAL);
+    Require(sceVorbisDecTimeSeekLap(vf, 0.0) == OV_EINVAL && sceVorbisDecTimeSeekPageLap(vf, 0.0) == OV_EINVAL);
+    Require(sceVorbisDecRawTell(vf) == OV_EINVAL && sceVorbisDecPcmTell(vf) == OV_EINVAL && sceVorbisDecTimeTell(vf) == OV_EINVAL);
+    Require(sceVorbisDecInfo(vf, -1) == nullptr && sceVorbisDecInfo(vf, 0) == nullptr);
+    Require(sceVorbisDecComment(vf, -1) == nullptr && sceVorbisDecComment(vf, 0) == nullptr);
+    std::array<char, 64> buffer{};
+    int bitstream = 7;
+    Require(sceVorbisDecRead(vf, buffer.data(), static_cast<int>(buffer.size()), 0, 2, 1, &bitstream) == OV_EINVAL && bitstream == 7);
+    float** pcm = nullptr;
+    Require(sceVorbisDecReadFloat(vf, &pcm, 64, &bitstream) == OV_EINVAL && pcm == nullptr && bitstream == 7);
+    FilterLog log;
+    Require(sceVorbisDecReadFilter(vf, buffer.data(), static_cast<int>(buffer.size()), 0, 2, 1, &bitstream, GuestHalve, &log) == OV_EINVAL);
+    Require(log.calls == 0 && bitstream == 7);
+    Require(sceVorbisDecHalfrate(vf, 1) == OV_EINVAL && sceVorbisDecHalfrateP(vf) == OV_EINVAL);
+    Require(sceVorbisDecClear(vf) == 0 && sceVorbisDecClear(nullptr) == 0);
+    Require(guest.Untouched());
+
+    Source source;
+    Require(Throws<std::invalid_argument>([&] { sceVorbisDecOpenCallbacks(&source, nullptr, nullptr, 0, SeekableCallbacks); }));
+    Require(Throws<std::invalid_argument>([] { sceVorbisDecStreams(nullptr); }));
+    Require(Throws<std::invalid_argument>([] { sceVorbisDecInfo(nullptr, 0); }));
+    Require(Throws<std::invalid_argument>([] { sceVorbisDecPcmSeek(nullptr, 0); }));
+}
+
+void TestFailedOpens(const std::vector<unsigned char>& stream) {
+    GuestFile guest;
+    void* vf = guest.Get();
+    std::vector<unsigned char> noise(8192);
+    std::uint32_t state = 0x2545f491;
+    for (auto& value : noise) {
+        state = state * 1664525u + 1013904223u;
+        value = static_cast<unsigned char>(state >> 24);
+    }
+    Source noiseSource{&noise};
+    Require(sceVorbisDecOpenCallbacks(&noiseSource, vf, nullptr, 0, SeekableCallbacks) == OV_ENOTVORBIS);
+    Require(noiseSource.closes == 0 && sceVorbisDecStreams(vf) == 0 && sceVorbisDecInfo(vf, 0) == nullptr);
+    Require(sceVorbisDecClear(vf) == 0 && noiseSource.closes == 0);
+
+    Source untold{&stream};
+    constexpr GuestCallbacks NoTell{GuestRead, GuestSeek, GuestClose, nullptr};
+    Require(sceVorbisDecOpenCallbacks(&untold, vf, nullptr, 0, NoTell) == OV_EINVAL);
+    Require(untold.closes == 0 && sceVorbisDecStreams(vf) == 0 && sceVorbisDecClear(vf) == 0 && untold.closes == 0);
+
+    constexpr GuestCallbacks NoRead{nullptr, GuestSeek, GuestClose, GuestTell};
+    Source unread{&stream};
+    OggVorbis_File reference{};
+    const ov_callbacks hostNoRead{nullptr, HostSeek, HostClose, HostTell};
+    Require(sceVorbisDecOpenCallbacks(&unread, vf, nullptr, 0, NoRead) == ov_open_callbacks(&unread, &reference, nullptr, 0, hostNoRead));
+    Require(unread.closes == 0 && sceVorbisDecStreams(vf) == 0);
+
+    Require(sceVorbisDecOpenCallbacks(nullptr, vf, nullptr, 0, SeekableCallbacks) == OV_ENOTVORBIS);
+
+    Source previous{&stream};
+    Source next{&stream};
+    Require(sceVorbisDecOpenCallbacks(&previous, vf, nullptr, 0, SeekableCallbacks) == 0);
+    Require(sceVorbisDecOpenCallbacks(&next, vf, nullptr, 0, StreamingCallbacks) == 0);
+    Require(previous.closes == 0 && sceVorbisDecSeekable(vf) == 0 && sceVorbisDecStreams(vf) == 1);
+    Require(sceVorbisDecClear(vf) == 0 && previous.closes == 0 && next.closes == 1);
+
+    Source unsized{&stream};
+    Require(sceVorbisDecOpenCallbacks(&unsized, vf, nullptr, std::int64_t{1} << 32, SeekableCallbacks) == 0);
+    Require(sceVorbisDecStreams(vf) == 2 && sceVorbisDecClear(vf) == 0 && unsized.closes == 1);
+
+    const auto* initial = reinterpret_cast<const char*>(stream.data());
+    const auto size = static_cast<std::int64_t>(stream.size());
+    Require(sceVorbisDecOpenCallbacks(nullptr, vf, initial, size, SeekableCallbacks) == 0);
+    Require(ov_open_callbacks(nullptr, &reference, initial, static_cast<long>(size), HostSeekableCallbacks) == 0);
+    Require(sceVorbisDecSeekable(vf) == 0 && DecodeTogether(vf, reference) == DecodedBytes);
+    Require(sceVorbisDecClear(vf) == 0 && ov_clear(&reference) == 0);
+    Require(guest.Untouched());
+}
+
+void TestThrowingCallbacks(const std::vector<unsigned char>& stream) {
+    GuestFile guest;
+    Source source{&stream};
+    Require(sceVorbisDecOpenCallbacks(&source, guest.Get(), nullptr, 0, SeekableCallbacks) == 0);
+    std::array<char, 4096> buffer{};
+    int bitstream = -1;
+    source.throwOnRead = true;
+    bool threw = false;
+    for (int call = 0; call < 1024 && !threw; ++call) {
+        threw = Throws<std::runtime_error>([&] { sceVorbisDecRead(guest.Get(), buffer.data(), static_cast<int>(buffer.size()), 0, 2, 1, &bitstream); });
+    }
+    Require(threw);
+    source.throwOnRead = false;
+    source.throwOnClose = true;
+    Require(Throws<std::runtime_error>([&] { sceVorbisDecClear(guest.Get()); }));
+    Require(source.closes == 1 && sceVorbisDecStreams(guest.Get()) == 0);
+    Require(sceVorbisDecClear(guest.Get()) == 0 && source.closes == 1);
+    Require(guest.Untouched());
+}
+
 }
 
 int main() {
-    Require(Throws([] { sceVorbisDecOpenCallbacks(); }), "sceVorbisDecOpenCallbacks must throw");
-    Require(Throws([] { sceVorbisDecClear(); }), "sceVorbisDecClear must throw");
-    Require(Throws([] { sceVorbisDecBitrate(); }), "sceVorbisDecBitrate must throw");
-    Require(Throws([] { sceVorbisDecBitrateInstant(); }), "sceVorbisDecBitrateInstant must throw");
-    Require(Throws([] { sceVorbisDecStreams(); }), "sceVorbisDecStreams must throw");
-    Require(Throws([] { sceVorbisDecSeekable(); }), "sceVorbisDecSeekable must throw");
-    Require(Throws([] { sceVorbisDecSerialNumber(); }), "sceVorbisDecSerialNumber must throw");
-    Require(Throws([] { sceVorbisDecRawTotal(); }), "sceVorbisDecRawTotal must throw");
-    Require(Throws([] { sceVorbisDecPcmTotal(); }), "sceVorbisDecPcmTotal must throw");
-    Require(Throws([] { sceVorbisDecTimeTotal(); }), "sceVorbisDecTimeTotal must throw");
-    Require(Throws([] { sceVorbisDecRawSeek(); }), "sceVorbisDecRawSeek must throw");
-    Require(Throws([] { sceVorbisDecPcmSeek(); }), "sceVorbisDecPcmSeek must throw");
-    Require(Throws([] { sceVorbisDecPcmSeekPage(); }), "sceVorbisDecPcmSeekPage must throw");
-    Require(Throws([] { sceVorbisDecTimeSeek(); }), "sceVorbisDecTimeSeek must throw");
-    Require(Throws([] { sceVorbisDecTimeSeekPage(); }), "sceVorbisDecTimeSeekPage must throw");
-    Require(Throws([] { sceVorbisDecRawSeekLap(); }), "sceVorbisDecRawSeekLap must throw");
-    Require(Throws([] { sceVorbisDecPcmSeekLap(); }), "sceVorbisDecPcmSeekLap must throw");
-    Require(Throws([] { sceVorbisDecPcmSeekPageLap(); }), "sceVorbisDecPcmSeekPageLap must throw");
-    Require(Throws([] { sceVorbisDecTimeSeekLap(); }), "sceVorbisDecTimeSeekLap must throw");
-    Require(Throws([] { sceVorbisDecTimeSeekPageLap(); }), "sceVorbisDecTimeSeekPageLap must throw");
-    Require(Throws([] { sceVorbisDecRawTell(); }), "sceVorbisDecRawTell must throw");
-    Require(Throws([] { sceVorbisDecPcmTell(); }), "sceVorbisDecPcmTell must throw");
-    Require(Throws([] { sceVorbisDecTimeTell(); }), "sceVorbisDecTimeTell must throw");
-    Require(Throws([] { sceVorbisDecInfo(); }), "sceVorbisDecInfo must throw");
-    Require(Throws([] { sceVorbisDecComment(); }), "sceVorbisDecComment must throw");
-    Require(Throws([] { sceVorbisDecRead(); }), "sceVorbisDecRead must throw");
-    Require(Throws([] { sceVorbisDecReadFloat(); }), "sceVorbisDecReadFloat must throw");
-    Require(Throws([] { sceVorbisDecReadFilter(); }), "sceVorbisDecReadFilter must throw");
-    Require(Throws([] { sceVorbisDecCrossLap(); }), "sceVorbisDecCrossLap must throw");
-    Require(Throws([] { sceVorbisDecHalfrate(); }), "sceVorbisDecHalfrate must throw");
-    Require(Throws([] { sceVorbisDecHalfrateP(); }), "sceVorbisDecHalfrateP must throw");
-    Require(Throws([] { sceVorbisDecGetDecodePriority(); }), "sceVorbisDecGetDecodePriority must throw");
-    Require(Throws([] { sceVorbisDecSetDecodePriority(); }), "sceVorbisDecSetDecodePriority must throw");
-    Require(Throws([] { sceVorbisDecGetLastDecodeError(); }), "sceVorbisDecGetLastDecodeError must throw");
+    std::vector<unsigned char> stream;
+    EncodeLink(stream, FirstSerial, FirstChannels, FirstRate, FirstSamples, "first");
+    EncodeLink(stream, SecondSerial, SecondChannels, SecondRate, SecondSamples, "second");
+
+    TestSeekable(stream);
+    TestStreaming(stream);
+    TestFloatAndFilter(stream);
+    TestHalfrate(stream);
+    TestCrossLap(stream);
+    TestNeverOpened();
+    TestFailedOpens(stream);
+    TestThrowingCallbacks(stream);
+
+    Require(Throws<std::runtime_error>([] { sceVorbisDecGetDecodePriority(); }));
+    Require(Throws<std::runtime_error>([] { sceVorbisDecSetDecodePriority(); }));
+    Require(Throws<std::runtime_error>([] { sceVorbisDecGetLastDecodeError(); }));
 
     std::puts("All VorbisDec guest tests passed");
     return 0;
diff --git a/core/libs/tests/GuestVrServiceDialog.cpp b/core/libs/tests/GuestVrServiceDialog.cpp
new file mode 100644
index 0000000000..95f074d84c
--- /dev/null
+++ b/core/libs/tests/GuestVrServiceDialog.cpp
@@ -0,0 +1,63 @@
+#include "prx/libSceVrServiceDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+
+namespace {
+
+void Require(bool value) { if (!value) std::abort(); }
+
+constexpr int kStatusNone = 0;
+constexpr int kStatusInitialized = 1;
+constexpr int kStatusFinished = 3;
+constexpr int kErrNotInitialized = static_cast<int>(0x80B80003);
+constexpr int kErrAlreadyInitialized = static_cast<int>(0x80B80004);
+constexpr int kErrNotFinished = static_cast<int>(0x80B80005);
+constexpr int kErrArgNull = static_cast<int>(0x80B8000D);
+constexpr int kResultUserCanceled = 1;
+
+}
+
+int main() {
+    std::int64_t param = 0;
+    std::int32_t result[2] = {-1, -1};
+
+    Require(sceVrServiceDialogTerminate() == kErrNotInitialized);
+    Require(sceVrServiceDialogOpen(&param) == kErrNotInitialized);
+    Require(sceVrServiceDialogClose() == kErrNotInitialized);
+    Require(sceVrServiceDialogGetResult(result) == kErrNotInitialized);
+    Require(sceVrServiceDialogGetStatus() == kStatusNone);
+    Require(sceVrServiceDialogUpdateStatus() == kStatusNone);
+
+    Require(sceVrServiceDialogInitialize() == 0);
+    Require(sceVrServiceDialogInitialize() == kErrAlreadyInitialized);
+    Require(sceVrServiceDialogGetStatus() == kStatusInitialized);
+    Require(sceVrServiceDialogUpdateStatus() == kStatusInitialized);
+
+    Require(sceVrServiceDialogOpen(nullptr) == kErrArgNull);
+    Require(sceVrServiceDialogGetResult(result) == kErrNotFinished);
+
+    Require(sceVrServiceDialogOpen(&param) == 0);
+    Require(sceVrServiceDialogGetStatus() == kStatusFinished);
+    Require(sceVrServiceDialogUpdateStatus() == kStatusFinished);
+
+    Require(sceVrServiceDialogGetResult(nullptr) == kErrArgNull);
+    Require(sceVrServiceDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(result[1] == -1);
+
+    Require(sceVrServiceDialogClose() == 0);
+    Require(sceVrServiceDialogTerminate() == 0);
+    Require(sceVrServiceDialogTerminate() == kErrNotInitialized);
+    Require(sceVrServiceDialogGetStatus() == kStatusNone);
+    Require(sceVrServiceDialogUpdateStatus() == kStatusNone);
+
+    Require(sceVrServiceDialogInitialize() == 0);
+    Require(sceVrServiceDialogUpdateStatus() == kStatusInitialized);
+    Require(sceVrServiceDialogClose() == 0);
+    Require(sceVrServiceDialogUpdateStatus() == kStatusFinished);
+    result[0] = -1;
+    Require(sceVrServiceDialogGetResult(result) == 0);
+    Require(result[0] == kResultUserCanceled);
+    Require(sceVrServiceDialogTerminate() == 0);
+}
diff --git a/core/libs/tests/GuestVrSetupDialog.cpp b/core/libs/tests/GuestVrSetupDialog.cpp
index decf0c81e2..3297365257 100644
--- a/core/libs/tests/GuestVrSetupDialog.cpp
+++ b/core/libs/tests/GuestVrSetupDialog.cpp
@@ -1,18 +1,9 @@
+#include "prx/libSceVrSetupDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 
-extern "C" {
-int APS5_VABI sceVrSetupDialogInitialize(void);
-int APS5_VABI sceVrSetupDialogOpen(const VrSetupDialogParam* param);
-int APS5_VABI sceVrSetupDialogUpdateStatus(void);
-int APS5_VABI sceVrSetupDialogGetStatus(void);
-int APS5_VABI sceVrSetupDialogGetResult(std::int32_t* result);
-int APS5_VABI sceVrSetupDialogClose(void);
-int APS5_VABI sceVrSetupDialogTerminate(void);
-}
-
 namespace {
 
 void Require(bool value) { if (!value) std::abort(); }
diff --git a/core/libs/tests/GuestVrTracker2.cpp b/core/libs/tests/GuestVrTracker2.cpp
index 0bbe3a869e..461c90bca7 100644
--- a/core/libs/tests/GuestVrTracker2.cpp
+++ b/core/libs/tests/GuestVrTracker2.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceVrTracker2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "ProcessParametersFixture.hpp"
 
@@ -9,17 +10,7 @@
 #include <stdexcept>
 
 extern "C" {
-std::int32_t APS5_VABI VrTracker2NotInitialized();
-std::int32_t APS5_VABI sceVrTracker2Finalize();
-std::int32_t APS5_VABI VrTracker2ClearWideResult(void* result);
-std::int32_t APS5_VABI VrTracker2ClearNarrowResult(void* result);
-std::int32_t APS5_VABI VrTracker2CheckSecondThenReportNotInitialized(const void* first, const void* second);
-std::int32_t APS5_VABI VrTracker2Accept();
-std::int32_t APS5_VABI VrTracker2FillDefaults(void* output);
-std::int32_t APS5_VABI VrTracker2ClearWord(void* output);
-std::int32_t APS5_VABI sceVrTracker2QueryMemory(const void* parameter, void* requirement);
-struct VrTracker2InitializeParameter;
-std::int32_t APS5_VABI sceVrTracker2Initialize(const VrTracker2InitializeParameter* parameter);
+
 }
 
 namespace {
@@ -98,17 +89,17 @@ int main() {
     parameter.back() = 0xAA;
     std::array<std::uint8_t, 40> requirement{};
     requirement.fill(0xAA);
-    Require(sceVrTracker2QueryMemory(parameter.data(), requirement.data()) == 0, "query return");
+    Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == 0, "query return");
     const std::array<std::uint8_t, 12> fields{0x20, 0, 0, 0, 0, 0, 0, 0x02, 0, 0, 0x01, 0};
     Require(std::memcmp(requirement.data(), fields.data(), fields.size()) == 0, "query fields");
     Require(AllEqual(requirement.data() + 12, requirement.data() + 32, 0) && AllEqual(requirement.data() + 32, requirement.data() + 40, 0xAA), "query writes 32 bytes");
-    Require(sceVrTracker2QueryMemory(nullptr, requirement.data()) == InvalidArgument, "query null parameter");
-    Require(sceVrTracker2QueryMemory(parameter.data(), nullptr) == InvalidArgument, "query null requirement");
+    Require(sceVrTracker2QueryMemory(nullptr, reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == InvalidArgument, "query null parameter");
+    Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), nullptr) == InvalidArgument, "query null requirement");
     for (std::size_t offset = 4; offset < 32; ++offset) {
         auto rejected = parameter;
         rejected[offset] = 1;
         requirement.fill(0xAA);
-        Require(sceVrTracker2QueryMemory(rejected.data(), requirement.data()) == InvalidArgument, "query reserved byte");
+        Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(rejected.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == InvalidArgument, "query reserved byte");
         Require(AllEqual(requirement.data(), requirement.data() + 40, 0xAA), "query rejection leaves output");
     }
     const std::uint64_t processSize = process.size();
@@ -121,7 +112,7 @@ int main() {
         for (const std::uint32_t mode : {1000u, 1001u}) {
             std::memcpy(parameter.data() + 4, &mode, sizeof(mode));
             requirement.fill(0xAA);
-            const auto result = sceVrTracker2QueryMemory(parameter.data(), requirement.data());
+            const auto result = sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data()));
             if (version < 0x1000000) {
                 Require(result == InvalidArgument, "query SDK restriction");
                 Require(AllEqual(requirement.data(), requirement.data() + requirement.size(), 0xAA), "SDK rejection preserves output");
@@ -136,7 +127,7 @@ int main() {
         }
     }
     parameter[0] = 0x21;
-    Require(sceVrTracker2QueryMemory(parameter.data(), requirement.data()) == InvalidArgument, "query size");
+    Require(sceVrTracker2QueryMemory(reinterpret_cast<const VrTracker2MemoryParameter*>(parameter.data()), reinterpret_cast<VrTracker2MemoryRequirement*>(requirement.data())) == InvalidArgument, "query size");
 
     Require(Throws([] { sceVrTracker2Initialize(nullptr); }), "unknown export");
     return 0;
diff --git a/core/libs/tests/GuestVrTrackerDevices.cpp b/core/libs/tests/GuestVrTrackerDevices.cpp
new file mode 100644
index 0000000000..d34384fa7a
--- /dev/null
+++ b/core/libs/tests/GuestVrTrackerDevices.cpp
@@ -0,0 +1,183 @@
+#include "prx/libSceVrTracker/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdlib>
+#include <stdexcept>
+
+namespace {
+
+constexpr int NotInit = static_cast<int>(0x81260801u);
+constexpr int AlreadyInitialized = static_cast<int>(0x81260802u);
+constexpr int DeviceNotRegistered = static_cast<int>(0x81260803u);
+constexpr int DeviceAlreadyRegistered = static_cast<int>(0x81260804u);
+constexpr int ArgumentInvalid = static_cast<int>(0x81260806u);
+constexpr int NotExecuteGpuSubmit = static_cast<int>(0x81260815u);
+constexpr std::uint32_t Untouched = 0xa5a5a5a5u;
+constexpr int Hmd = 0;
+constexpr int Pad = 1;
+constexpr int Move = 2;
+constexpr int Gun = 3;
+
+struct QueryResult {
+    std::uint32_t words[16];
+};
+
+std::uint8_t g_onion[16];
+std::uint8_t g_garlic[16];
+std::uint8_t g_work[16];
+
+void Require(bool value) { if (!value) std::abort(); }
+
+template <typename TFunction>
+void RequireThrows(TFunction function) {
+    try { function(); } catch (const std::runtime_error&) { return; }
+    std::abort();
+}
+
+QueryResult FreshResult() {
+    QueryResult result;
+    for (auto& word : result.words) word = Untouched;
+    return result;
+}
+
+VrTrackerLegacy::InitParam ValidInit() {
+    VrTrackerLegacy::InitParam init{};
+    init.size = sizeof(init);
+    init.direct_memory_onion_size = 0x400000;
+    init.direct_memory_onion_alignment = 0x10000;
+    init.direct_memory_garlic_size = 0x3000000;
+    init.direct_memory_garlic_alignment = 0x10000;
+    init.work_memory_size = 0x1000000;
+    init.work_memory_alignment = 0x10000;
+    init.direct_memory_onion = g_onion;
+    init.direct_memory_garlic = g_garlic;
+    init.work_memory = g_work;
+    return init;
+}
+
+int Recalibrate(std::uint32_t deviceType, std::uint32_t size = sizeof(VrTrackerLegacy::RecalibrateParam)) {
+    VrTrackerLegacy::RecalibrateParam param{};
+    param.size = size;
+    param.device_type = deviceType;
+    return sceVrTrackerRecalibrate(&param);
+}
+
+void CheckQueryMemory() {
+    VrTrackerLegacy::QueryMemoryParam query{sizeof(VrTrackerLegacy::QueryMemoryParam)};
+    auto result = FreshResult();
+    Require(sceVrTrackerQueryMemory(&query, &result) == 0);
+    Require(result.words[0] == Untouched);
+    Require(result.words[1] == 0x400000 && result.words[2] == 0x10000);
+    Require(result.words[3] == 0x3000000 && result.words[4] == 0x10000);
+    Require(result.words[5] == 0x1000000 && result.words[6] == 0x10000);
+    Require(result.words[7] == Untouched);
+
+    query.calibration_settings.move_position = 1;
+    query.profile = 100;
+    Require(sceVrTrackerQueryMemory(&query, &result) == 0 && result.words[1] == 0x800000);
+
+    auto rejected = FreshResult();
+    VrTrackerLegacy::QueryMemoryParam bad = query;
+    bad.profile = 1;
+    Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
+    bad = query;
+    bad.calibration_settings.hmd_position = 1;
+    Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
+    bad = query;
+    bad.calibration_settings.pad_position = 2;
+    Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
+    bad = query;
+    bad.size = sizeof(VrTrackerLegacy::QueryMemoryParam) - 1;
+    Require(sceVrTrackerQueryMemory(&bad, &rejected) == ArgumentInvalid);
+    Require(sceVrTrackerQueryMemory(nullptr, &rejected) == ArgumentInvalid);
+    Require(sceVrTrackerQueryMemory(&query, nullptr) == ArgumentInvalid);
+    Require(rejected.words[1] == Untouched);
+}
+
+void CheckBeforeInit() {
+    Require(sceVrTrackerTerm() == NotInit);
+    Require(sceVrTrackerRegisterDevice(Pad, 5) == NotInit);
+    Require(sceVrTrackerUnregisterDevice(5) == NotInit);
+    Require(Recalibrate(Pad) == NotInit);
+    Require(sceVrTrackerSetDurationUntilStatusNotTracking(Pad, 10) == NotInit);
+    Require(sceVrTrackerGpuWaitAndCpuProcess() == NotInit);
+}
+
+void CheckInit() {
+    auto bad = ValidInit();
+    bad.size = sizeof(VrTrackerLegacy::InitParam) - 8;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.size = 144;
+    RequireThrows([&] { sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)); });
+    bad = ValidInit();
+    bad.calibration_settings.move_position = 1;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.direct_memory_onion_size = 0x800000;
+    bad.gpu_pipe_id = 7;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.gpu_pipe_id = 0;
+    bad.gpu_queue_id = 8;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.gpu_queue_id = 0;
+    bad.work_memory = nullptr;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    bad.work_memory = g_work;
+    bad.direct_memory_garlic_alignment = 0x1000;
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&bad)) == ArgumentInvalid);
+    Require(sceVrTrackerInit(nullptr) == ArgumentInvalid);
+    Require(sceVrTrackerTerm() == NotInit);
+
+    const auto init = ValidInit();
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&init)) == 0);
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&init)) == AlreadyInitialized);
+    Require(sceVrTrackerInit(nullptr) == AlreadyInitialized);
+    Require(sceVrTrackerGpuWaitAndCpuProcess() == NotExecuteGpuSubmit);
+}
+
+void CheckDevices() {
+    Require(sceVrTrackerRegisterDevice(Pad, 5) == 0);
+    Require(sceVrTrackerRegisterDevice(Pad, 6) == DeviceAlreadyRegistered);
+    Require(sceVrTrackerRegisterDevice2(Move, 7) == 0);
+    Require(sceVrTrackerRegisterDeviceInternal(Gun, 8, 5, 0) == ArgumentInvalid);
+    Require(sceVrTrackerRegisterDevice(4, 8) == ArgumentInvalid);
+    Require(sceVrTrackerRegisterDevice(-1, 8) == ArgumentInvalid);
+    Require(sceVrTrackerRegisterDevice(Hmd, 9) == 0);
+
+    Require(Recalibrate(Pad) == 0);
+    Require(Recalibrate(Move) == 0);
+    Require(Recalibrate(Hmd) == DeviceNotRegistered);
+    Require(Recalibrate(Gun) == DeviceNotRegistered);
+    Require(Recalibrate(4) == ArgumentInvalid);
+    Require(Recalibrate(Pad, sizeof(VrTrackerLegacy::RecalibrateParam) + 4) == ArgumentInvalid);
+    Require(sceVrTrackerRecalibrate(nullptr) == ArgumentInvalid);
+
+    Require(sceVrTrackerSetDurationUntilStatusNotTracking(Gun, 10) == 0);
+    Require(sceVrTrackerSetDurationUntilStatusNotTracking(4, 10) == ArgumentInvalid);
+
+    Require(sceVrTrackerUnregisterDevice(5) == 0);
+    Require(sceVrTrackerUnregisterDevice(5) == ArgumentInvalid);
+    Require(sceVrTrackerUnregisterDevice(-1) == ArgumentInvalid);
+    Require(Recalibrate(Pad) == DeviceNotRegistered);
+    Require(sceVrTrackerRegisterDevice(Pad, 6) == 0);
+    Require(sceVrTrackerUnregisterDevice(9) == 0);
+}
+
+void CheckTerm() {
+    Require(sceVrTrackerTerm() == 0);
+    Require(sceVrTrackerTerm() == NotInit);
+    Require(sceVrTrackerRegisterDevice(Gun, 8) == NotInit);
+    const auto init = ValidInit();
+    Require(sceVrTrackerInit(reinterpret_cast<const VrTrackerInitParam*>(&init)) == 0);
+    Require(sceVrTrackerRegisterDevice(Move, 11) == DeviceAlreadyRegistered);
+    Require(sceVrTrackerTerm() == 0);
+}
+
+} // namespace
+
+int main() {
+    CheckQueryMemory();
+    CheckBeforeInit();
+    CheckInit();
+    CheckDevices();
+    CheckTerm();
+}
diff --git a/core/libs/tests/GuestWaitpid.cpp b/core/libs/tests/GuestWaitpid.cpp
index 8ef90e7b19..9b958641cb 100644
--- a/core/libs/tests/GuestWaitpid.cpp
+++ b/core/libs/tests/GuestWaitpid.cpp
@@ -1,12 +1,9 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdlib>
 #include <initializer_list>
-extern "C" {
-int APS5_VABI wait_nid_postfix(int*);
-int APS5_VABI waitpid_nid_postfix(int, int*, int);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix();
-}
+
 constexpr int noChild = 10;
 constexpr int invalidArgument = 22;
 constexpr int untouched = 0x5a5a5a5a;
diff --git a/core/libs/tests/GuestWcsrtombs.cpp b/core/libs/tests/GuestWcsrtombs.cpp
index 745e809903..b9139ceaa8 100644
--- a/core/libs/tests/GuestWcsrtombs.cpp
+++ b/core/libs/tests/GuestWcsrtombs.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,9 +6,6 @@
 #include <cstdlib>
 #include <cstring>
 
-extern "C" std::size_t APS5_VABI wcsrtombs_nid_postfix(char*, const std::uint16_t**, std::size_t, void*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Require(bool value, const char* message) {
     if (!value) {
         std::fprintf(stderr, "%s\n", message);
@@ -18,9 +16,8 @@ static void Require(bool value, const char* message) {
 int main() {
     const std::uint16_t text[] = {'a', 'b', 'c', 0};
     const std::uint16_t empty[] = {0};
-    const std::uint16_t invalid[] = {'a', 0x100, 'b', 0};
+    const std::uint16_t twoBytes[] = {'a', 0x100, 'b', 0};
     const std::uint16_t bytes[] = {0x7f, 0x80, 0xe9, 0xff, 0};
-    constexpr auto Failed = static_cast<std::size_t>(-1);
     std::uint64_t state[2]{};
     char out[8];
     const auto* source = text;
@@ -46,8 +43,8 @@ int main() {
     Require(wcsrtombs_nid_postfix(out, &source, 1, state) == 0, "empty string length");
     Require(source == nullptr && out[0] == 0 && out[1] == 'x', "empty string terminator");
     source = bytes;
-    Require(wcsrtombs_nid_postfix(out, &source, sizeof(out), state) == 4, "guest single-byte conversion length");
-    Require(source == nullptr && std::memcmp(out, "\x7f\x80\xe9\xff\0", 5) == 0, "guest high bytes");
+    Require(wcsrtombs_nid_postfix(out, &source, sizeof(out), state) == 7, "UTF-8 conversion length");
+    Require(source == nullptr && std::memcmp(out, "\x7f\xc2\x80\xc3\xa9\xc3\xbf\0", 8) == 0, "high characters become two UTF-8 bytes");
 
     source = text;
     Require(wcsrtombs_nid_postfix(nullptr, &source, 0, state) == 3 && source == text, "length query ignores capacity and preserves source");
@@ -55,21 +52,16 @@ int main() {
     source = empty;
     Require(wcsrtombs_nid_postfix(nullptr, &source, 0, state) == 0 && source == empty, "empty length query");
 
-    source = invalid;
+    source = twoBytes;
     std::memset(out, 'x', sizeof(out));
-    *__error_nid_postfix() = 0;
-    Require(wcsrtombs_nid_postfix(out, &source, sizeof(out), state) == Failed, "invalid character fails conversion");
-    Require(*__error_nid_postfix() == 86, "invalid character uses guest EILSEQ");
-    Require(source == invalid + 1 && std::memcmp(out, "axxxxxxx", 8) == 0, "error preserves prefix and identifies invalid character");
     *__error_nid_postfix() = 7;
-    Require(wcsrtombs_nid_postfix(out, &source, 0, state) == 0 && source == invalid + 1, "zero capacity does not convert invalid character");
-    Require(*__error_nid_postfix() == 7, "zero capacity preserves errno");
-
-    source = invalid;
-    Require(wcsrtombs_nid_postfix(nullptr, &source, 0, state) == Failed, "length query rejects invalid character");
-    Require(*__error_nid_postfix() == 86 && source == invalid, "failed length query preserves source and reports guest EILSEQ");
-    source = invalid;
-    *__error_nid_postfix() = 7;
-    Require(wcsrtombs_nid_postfix(out, &source, 1, state) == 1 && source == invalid + 1, "capacity stops before invalid character");
-    Require(*__error_nid_postfix() == 7, "unconverted invalid character does not set errno");
+    Require(wcsrtombs_nid_postfix(out, &source, sizeof(out), state) == 4, "a character above 0xff converts");
+    Require(source == nullptr && std::memcmp(out, "a\xc4\x80" "b\0", 5) == 0, "U+0100 becomes C4 80");
+    Require(*__error_nid_postfix() == 7, "conversion preserves errno");
+    source = twoBytes;
+    Require(wcsrtombs_nid_postfix(nullptr, &source, 0, state) == 4 && source == twoBytes, "length query counts UTF-8 bytes");
+    source = twoBytes;
+    std::memset(out, 'x', sizeof(out));
+    Require(wcsrtombs_nid_postfix(out, &source, 2, state) == 1 && source == twoBytes + 1, "a character that does not fit stops the conversion");
+    Require(std::memcmp(out, "axxxxxxx", 8) == 0, "no partial character is written");
 }
diff --git a/core/libs/tests/GuestWcsrtombsS.cpp b/core/libs/tests/GuestWcsrtombsS.cpp
index 44a4206540..2169489807 100644
--- a/core/libs/tests/GuestWcsrtombsS.cpp
+++ b/core/libs/tests/GuestWcsrtombsS.cpp
@@ -1,11 +1,9 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" int APS5_VABI wcsrtombs_s_nid_postfix(
-    std::size_t*, char*, std::size_t, const std::uint16_t**, std::size_t, void*);
-extern "C" int APS5_VABI wcstombs_s_nid_postfix(std::size_t*, char*, std::size_t, const std::uint16_t*, std::size_t);
 static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr auto Failed = static_cast<std::size_t>(-1);
@@ -33,7 +31,7 @@ int main() {
     auto run = Convert(text, 0, 0, false);
     Require(run.status == 0 && run.result == 3 && run.source == text);
     run = Convert(wide, 0, Huge, false);
-    Require(run.status == 86 && run.result == Failed && run.source == wide);
+    Require(run.status == 0 && run.result == 4 && run.source == wide);
     run = Convert(text, 5, 1, false);
     Require(run.status == 22 && run.result == Failed && run.source == text);
 
@@ -54,7 +52,7 @@ int main() {
     Require(run.status == 34 && run.result == Failed && run.source == text + 1 && std::memcmp(run.out, "\0x", 2) == 0);
 
     run = Convert(wide, 8, 8);
-    Require(run.status == 86 && run.result == Failed && run.source == wide && std::memcmp(run.out, "a\0xx", 4) == 0);
+    Require(run.status == 0 && run.result == 4 && run.source == nullptr && std::memcmp(run.out, "a\xc4\x80" "b\0", 5) == 0);
 
     run = Convert(text, 0, 8);
     Require(run.status == 22 && run.result == Failed && run.source == text && run.out[0] == 'x');
@@ -92,6 +90,9 @@ int main() {
     Require(wcstombs_s_nid_postfix(&result, narrow, sizeof(narrow), nullptr, sizeof(narrow)) == 22);
     Require(result == Failed && narrow[0] == '\0');
     std::memset(narrow, 'x', sizeof(narrow));
-    Require(wcstombs_s_nid_postfix(&result, narrow, sizeof(narrow), wide, sizeof(narrow)) == 86 && result == Failed);
-    Require(std::memcmp(narrow, "a\0xx", 4) == 0);
+    Require(wcstombs_s_nid_postfix(&result, narrow, sizeof(narrow), wide, sizeof(narrow)) == 0 && result == 4);
+    Require(std::memcmp(narrow, "a\xc4\x80" "b\0x", 6) == 0);
+    std::memset(narrow, 'x', sizeof(narrow));
+    Require(wcstombs_s_nid_postfix(&result, narrow, sizeof(narrow), wide, 2) == 0 && result == 1);
+    Require(std::memcmp(narrow, "a\0x", 3) == 0);
 }
diff --git a/core/libs/tests/GuestWebBrowserDialog.cpp b/core/libs/tests/GuestWebBrowserDialog.cpp
index bb391077a8..01fdca210e 100644
--- a/core/libs/tests/GuestWebBrowserDialog.cpp
+++ b/core/libs/tests/GuestWebBrowserDialog.cpp
@@ -1,19 +1,9 @@
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libSceCommonDialog/CommonDialog.hpp"
 #include <cstdint>
 #include <cstdlib>
 
-extern "C" {
-int APS5_VABI sceWebBrowserDialogInitialize(void);
-int APS5_VABI sceWebBrowserDialogTerminate(void);
-int APS5_VABI sceWebBrowserDialogOpen(const void* param);
-int APS5_VABI sceWebBrowserDialogOpenForPredeterminedContent(const void* param, const WebBrowserDialogAllowList* allowList);
-int APS5_VABI sceWebBrowserDialogClose(void);
-int APS5_VABI sceWebBrowserDialogGetStatus(void);
-int APS5_VABI sceWebBrowserDialogUpdateStatus(void);
-int APS5_VABI sceWebBrowserDialogGetResult(WebBrowserDialogResult* result);
-}
-
 namespace {
 
 constexpr int COMMON_DIALOG_STATUS_NONE = 0;
@@ -37,6 +27,8 @@ int main() {
     result.result = 0x5a5a5a5a;
 
     Require(sceWebBrowserDialogTerminate() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
+    Require(sceWebBrowserDialogSetCookie(nullptr) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
+    Require(sceWebBrowserDialogResetCookie(nullptr) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(sceWebBrowserDialogGetStatus() == COMMON_DIALOG_STATUS_NONE);
     Require(sceWebBrowserDialogClose() == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
     Require(sceWebBrowserDialogOpen(param) == COMMON_DIALOG_ERROR_NOT_INITIALIZED);
diff --git a/core/libs/tests/GuestWebBrowserDialogCookies.cpp b/core/libs/tests/GuestWebBrowserDialogCookies.cpp
new file mode 100644
index 0000000000..32deb3db57
--- /dev/null
+++ b/core/libs/tests/GuestWebBrowserDialogCookies.cpp
@@ -0,0 +1,125 @@
+#include "prx/libSceWebBrowserDialog/include/Api.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <string>
+
+namespace {
+
+constexpr int NOT_INITIALIZED = static_cast<int>(0x80B80003u);
+constexpr int INVALID_STATE = static_cast<int>(0x80B80006u);
+constexpr int NOT_RUNNING = static_cast<int>(0x80B8000Bu);
+constexpr int PARAM_INVALID = static_cast<int>(0x80B8000Au);
+constexpr int ARG_NULL = static_cast<int>(0x80B8000Du);
+
+void Require(bool value, const char* what) {
+    if (value) return;
+    std::fprintf(stderr, "FAIL: %s\n", what);
+    std::abort();
+}
+
+WebBrowserDialogCookieParam Cookie(const char* url, const char* cookie) {
+    WebBrowserDialogCookieParam param {};
+    param.size = sizeof(param);
+    param.address = url;
+    param.cookie = cookie;
+    return param;
+}
+
+WebBrowserDialogResetCookieParam Reset() {
+    WebBrowserDialogResetCookieParam param {};
+    param.size = sizeof(param);
+    return param;
+}
+
+void CheckSetCookieParameters() {
+    auto valid = Cookie("https://example.com", "a=b");
+    Require(sceWebBrowserDialogSetCookie(&valid) == 0, "valid SetCookie");
+    Require(sceWebBrowserDialogSetCookie(nullptr) == ARG_NULL, "SetCookie null");
+
+    auto wrongSize = valid;
+    wrongSize.size = sizeof(WebBrowserDialogResetCookieParam);
+    Require(sceWebBrowserDialogSetCookie(&wrongSize) == PARAM_INVALID, "SetCookie size");
+    auto noUrl = Cookie(nullptr, "a=b");
+    Require(sceWebBrowserDialogSetCookie(&noUrl) == PARAM_INVALID, "SetCookie null url");
+    auto emptyUrl = Cookie("", "a=b");
+    Require(sceWebBrowserDialogSetCookie(&emptyUrl) == PARAM_INVALID, "SetCookie empty url");
+    auto noCookie = Cookie("https://example.com", nullptr);
+    Require(sceWebBrowserDialogSetCookie(&noCookie) == PARAM_INVALID, "SetCookie null cookie");
+    auto emptyCookie = Cookie("https://example.com", "");
+    Require(sceWebBrowserDialogSetCookie(&emptyCookie) == PARAM_INVALID, "SetCookie empty cookie");
+
+    const std::string longestUrl(0x7ff, 'u');
+    const std::string longUrl(0x800, 'u');
+    auto longest = Cookie(longestUrl.c_str(), "a=b");
+    Require(sceWebBrowserDialogSetCookie(&longest) == 0, "SetCookie 2047-byte url");
+    auto tooLong = Cookie(longUrl.c_str(), "a=b");
+    Require(sceWebBrowserDialogSetCookie(&tooLong) == PARAM_INVALID, "SetCookie 2048-byte url");
+
+    const std::string longestCookie(0xfff, 'c');
+    const std::string longCookie(0x1000, 'c');
+    auto longestValue = Cookie("https://example.com", longestCookie.c_str());
+    Require(sceWebBrowserDialogSetCookie(&longestValue) == 0, "SetCookie 4095-byte cookie");
+    auto tooLongValue = Cookie("https://example.com", longCookie.c_str());
+    Require(sceWebBrowserDialogSetCookie(&tooLongValue) == PARAM_INVALID, "SetCookie 4096-byte cookie");
+
+    auto reserved = valid;
+    reserved.reserved[255] = 1;
+    Require(sceWebBrowserDialogSetCookie(&reserved) == PARAM_INVALID, "SetCookie reserved");
+}
+
+void CheckResetCookieParameters() {
+    auto valid = Reset();
+    Require(sceWebBrowserDialogResetCookie(&valid) == 0, "valid ResetCookie");
+    Require(sceWebBrowserDialogResetCookie(nullptr) == ARG_NULL, "ResetCookie null");
+    auto wrongSize = valid;
+    wrongSize.size = sizeof(WebBrowserDialogCookieParam);
+    Require(sceWebBrowserDialogResetCookie(&wrongSize) == PARAM_INVALID, "ResetCookie size");
+    auto reserved = valid;
+    reserved.reserved[0] = 1;
+    Require(sceWebBrowserDialogResetCookie(&reserved) == PARAM_INVALID, "ResetCookie reserved");
+}
+
+void CheckOpenDialog() {
+    std::uint8_t open[64] = {};
+    auto cookie = Cookie("https://example.com", "a=b");
+    auto reset = Reset();
+    Require(sceWebBrowserDialogOpen(open) == 0, "Open");
+    Require(sceWebBrowserDialogSetCookie(&cookie) == INVALID_STATE, "SetCookie while open");
+    Require(sceWebBrowserDialogSetCookie(nullptr) == INVALID_STATE, "SetCookie checks the open dialog before null");
+    Require(sceWebBrowserDialogResetCookie(nullptr) == ARG_NULL, "ResetCookie checks null before the open dialog");
+    Require(sceWebBrowserDialogResetCookie(&reset) == INVALID_STATE, "ResetCookie while open");
+    Require(sceWebBrowserDialogUpdateStatus() == 3, "UpdateStatus finished");
+    Require(sceWebBrowserDialogSetCookie(&cookie) == 0, "SetCookie after UpdateStatus");
+    Require(sceWebBrowserDialogResetCookie(&reset) == 0, "ResetCookie after UpdateStatus");
+
+    Require(sceWebBrowserDialogOpen(open) == 0, "second Open");
+    Require(sceWebBrowserDialogClose() == NOT_RUNNING, "Close of a finished dialog");
+    Require(sceWebBrowserDialogSetCookie(&cookie) == 0, "SetCookie after Close");
+
+    Require(sceWebBrowserDialogOpen(open) == 0, "third Open");
+    Require(sceWebBrowserDialogTerminate() == 0, "Terminate");
+    Require(sceWebBrowserDialogInitialize() == 0, "Initialize again");
+    Require(sceWebBrowserDialogResetCookie(&reset) == 0, "ResetCookie after Terminate");
+}
+
+}
+
+int main() {
+    auto cookie = Cookie("https://example.com", "a=b");
+    auto reset = Reset();
+    Require(sceWebBrowserDialogSetCookie(&cookie) == NOT_INITIALIZED, "SetCookie before Initialize");
+    Require(sceWebBrowserDialogSetCookie(nullptr) == NOT_INITIALIZED, "SetCookie null before Initialize");
+    Require(sceWebBrowserDialogResetCookie(&reset) == NOT_INITIALIZED, "ResetCookie before Initialize");
+    Require(sceWebBrowserDialogResetCookie(nullptr) == NOT_INITIALIZED, "ResetCookie null before Initialize");
+
+    Require(sceWebBrowserDialogInitialize() == 0, "Initialize");
+    CheckSetCookieParameters();
+    CheckResetCookieParameters();
+    CheckOpenDialog();
+    Require(sceWebBrowserDialogTerminate() == 0, "final Terminate");
+    std::puts("guest web browser dialog cookies: PASS");
+    return 0;
+}
diff --git a/core/libs/tests/GuestWideConversion.cpp b/core/libs/tests/GuestWideConversion.cpp
index 07b28e68ca..5590c6124a 100644
--- a/core/libs/tests/GuestWideConversion.cpp
+++ b/core/libs/tests/GuestWideConversion.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cerrno>
 #include <cstddef>
@@ -8,25 +9,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" {
-std::uint64_t APS5_VABI _WStoul_nid_postfix(const char16_t*, char16_t**, int);
-int APS5_VABI _Iswctype_nid_postfix(std::uint32_t, std::uint64_t);
-int APS5_VABI swscanf_nid_postfix(const char16_t*, const char16_t*, ...);
-int APS5_VABI swscanf_s_nid_postfix(const char16_t*, const char16_t*, ...);
-int APS5_VABI iswalnum_nid_postfix(std::uint32_t);
-int APS5_VABI iswalpha_nid_postfix(std::uint32_t);
-int APS5_VABI iswcntrl_nid_postfix(std::uint32_t);
-int APS5_VABI iswdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswgraph_nid_postfix(std::uint32_t);
-int APS5_VABI iswlower_nid_postfix(std::uint32_t);
-int APS5_VABI iswprint_nid_postfix(std::uint32_t);
-int APS5_VABI iswpunct_nid_postfix(std::uint32_t);
-int APS5_VABI iswspace_nid_postfix(std::uint32_t);
-int APS5_VABI iswupper_nid_postfix(std::uint32_t);
-int APS5_VABI iswxdigit_nid_postfix(std::uint32_t);
-int APS5_VABI iswblank_nid_postfix(std::uint32_t);
-}
-
 static int failures = 0;
 
 static void Require(bool condition, const char* message) {
@@ -134,18 +116,25 @@ static void CheckScan() {
     Require(swscanf_s_nid_postfix(u"x", u"%2lc", pair, std::size_t{2}) == 0, "%2lc short input");
     Require(swscanf_s_nid_postfix(u"cab12", u"%l[abc]%d", text, std::size_t{6}, &first) == 2 && std::u16string(text) == u"cab" && first == 12, "%l[");
     Require(swscanf_s_nid_postfix(u"été!", u"%l[^!]", text, std::size_t{6}) == 1 && std::u16string(text) == u"été", "%l[^");
+    char16_t untouched[4] = {u'?', u'?', u'?', u'?'};
+    Require(swscanf_s_nid_postfix(u"Āb cd", u"%S", untouched, std::size_t{4}) == 0 && untouched[0] == u'?', "%S is an invalid conversion");
+    Require(swscanf_s_nid_postfix(u"7 Āb", u"%d%lS", &first, untouched, std::size_t{4}) == 1 && first == 7 && untouched[0] == u'?', "%lS stops after the earlier assignment");
+    Require(swscanf_s_nid_postfix(u"Āyz", u"%2C", untouched, std::size_t{4}) == 0 && untouched[0] == u'?', "%C is an invalid conversion");
+    Require(swscanf_s_nid_postfix(u"5 6", u"%hC%d", &first) == 0 && first == 7, "%hC stops before later conversions");
     std::int64_t count = -1;
     Require(swscanf_s_nid_postfix(u" 12 ab", u"%d %ln", &first, &count) == 1 && count == 4, "%ln");
 
     double real = 0;
     Require(swscanf_s_nid_postfix(u"1.5e3", u"%lf", &real) == 1 && real == 1500.0, "%lf");
-    Require(swscanf_s_nid_postfix(u"1e+x", u"%lf", &real) == 0, "%lf incomplete exponent is a matching failure");
+    Require(swscanf_s_nid_postfix(u"1e+", u"%lf", &real) == 1 && real == 1.0, "%lf converts the mantissa of an incomplete exponent");
     long double extended = 0;
     Require(swscanf_s_nid_postfix(u"2.25", u"%Lf", &extended) == 1 && extended == 2.25L, "%Lf");
     float single = 0;
     Require(swscanf_s_nid_postfix(u"-inf", u"%f", &single) == 1 && single == -std::numeric_limits<float>::infinity(), "%f infinity");
 
     Require(swscanf_s_nid_postfix(u"a", u"b%d", &first) == 0, "literal mismatch is a matching failure");
+    Require(swscanf_s_nid_postfix(u"", u"x") == 0, "literal at end of input returns zero");
+    Require(swscanf_s_nid_postfix(u"", u"%%") == -1, "percent literal at end of input is an input failure");
     Require(swscanf_s_nid_postfix(u"", u"%d", &first) == -1, "empty input is an input failure");
     Require(swscanf_s_nid_postfix(u"   ", u"%ls", text, std::size_t{6}) == -1, "white space only is an input failure");
     Require(swscanf_s_nid_postfix(u"5", u"%d%d", &first, &second) == 1, "input failure after a conversion");
@@ -155,7 +144,7 @@ static void CheckScan() {
     Require(swscanf_s_nid_postfix(u"5", nullptr) == -1, "null format");
     Require(Throws([&] { swscanf_s_nid_postfix(u"abc", u"%l[a-c]", text, std::size_t{6}); }), "scanset range throws");
     Require(Throws([&] { swscanf_s_nid_postfix(u"5", u"%Ld", &wide); }), "%Ld throws");
-    Require(Throws([&] { swscanf_s_nid_postfix(u"Ā", u"%s", narrow, std::size_t{4}); }), "unconvertible narrow %s throws");
+    Require(swscanf_s_nid_postfix(u"Ā", u"%s", narrow, std::size_t{4}) == 1 && std::strcmp(narrow, "\xc4\x80") == 0, "narrow %s stores UTF-8");
 }
 
 static void CheckUnsizedScan() {
@@ -193,6 +182,11 @@ static void CheckUnsizedScan() {
     Require(swscanf_nid_postfix(u" q7", u"%c%d", &letter, &first) == 1 && letter == ' ', "swscanf %c does not skip white space");
     Require(swscanf_nid_postfix(u"cab12", u"%l[abc]%d", text, &first) == 2 && std::u16string(text) == u"cab" && first == 12, "swscanf %l[");
     Require(swscanf_nid_postfix(u"été!", u"%l[^!]", text) == 1 && std::u16string(text) == u"été", "swscanf %l[^");
+    char16_t untouched[4] = {u'?', u'?', u'?', u'?'};
+    Require(swscanf_nid_postfix(u"Āb cd", u"%S", untouched) == 0 && untouched[0] == u'?', "swscanf %S is an invalid conversion");
+    Require(swscanf_nid_postfix(u"7 Āb 9", u"%d%3S%d", &first, untouched, &second) == 1 && first == 7 && untouched[0] == u'?', "swscanf stops at %S");
+    Require(swscanf_nid_postfix(u"Āyz", u"%lC", untouched) == 0 && untouched[0] == u'?', "swscanf %lC is an invalid conversion");
+    Require(swscanf_nid_postfix(u"abc", u"%*S") == 0, "swscanf suppressed %S is an invalid conversion");
     Require(swscanf_nid_postfix(u"key=val", u"%[^=]=%s", narrow, narrow + 4) == 2 && std::strcmp(narrow, "key") == 0 && std::strcmp(narrow + 4, "val") == 0, "swscanf %[^");
     std::int64_t count = -1;
     Require(swscanf_nid_postfix(u" 12 ab", u"%d %ln", &first, &count) == 1 && count == 4, "swscanf %ln");
@@ -203,13 +197,15 @@ static void CheckUnsizedScan() {
 
     double real = 0;
     Require(swscanf_nid_postfix(u"1.5e3", u"%lf", &real) == 1 && real == 1500.0, "swscanf %lf");
-    Require(swscanf_nid_postfix(u"1e+x", u"%lf", &real) == 0, "swscanf %lf incomplete exponent is a matching failure");
+    Require(swscanf_nid_postfix(u"1e+", u"%lf", &real) == 1 && real == 1.0, "swscanf %lf converts the mantissa of an incomplete exponent");
     long double extended = 0;
     Require(swscanf_nid_postfix(u"2.25", u"%Lf", &extended) == 1 && extended == 2.25L, "swscanf %Lf");
     float single = 0;
     Require(swscanf_nid_postfix(u"-inf", u"%f", &single) == 1 && single == -std::numeric_limits<float>::infinity(), "swscanf %f infinity");
 
     Require(swscanf_nid_postfix(u"a", u"b%d", &first) == 0, "swscanf literal mismatch is a matching failure");
+    Require(swscanf_nid_postfix(u"", u"x") == 0, "swscanf literal at end of input returns zero");
+    Require(swscanf_nid_postfix(u"", u"%%") == -1, "swscanf percent literal at end of input is an input failure");
     Require(swscanf_nid_postfix(u"3 x", u"%d%d", &first, &second) == 1 && first == 3, "swscanf partial match");
     Require(swscanf_nid_postfix(u"", u"%d", &first) == -1, "swscanf empty input is an input failure");
     Require(swscanf_nid_postfix(u"", u"%ls", text) == -1, "swscanf empty input before %ls");
@@ -220,7 +216,7 @@ static void CheckUnsizedScan() {
     Require(Throws([&] { swscanf_nid_postfix(u"abc", u"%l[a-c]", text); }), "swscanf scanset range throws");
     Require(Throws([&] { swscanf_nid_postfix(u"5", u"%Ld", &wide); }), "swscanf %Ld throws");
     Require(Throws([&] { swscanf_nid_postfix(u"1", u"%lp", &pointer); }), "swscanf %lp throws");
-    Require(Throws([&] { swscanf_nid_postfix(u"Ā", u"%s", narrow); }), "swscanf unconvertible narrow %s throws");
+    Require(swscanf_nid_postfix(u"Ā", u"%s", narrow) == 1 && std::strcmp(narrow, "\xc4\x80") == 0, "swscanf narrow %s stores UTF-8");
 }
 
 int main() {
diff --git a/core/libs/tests/GuestWideFormatting.cpp b/core/libs/tests/GuestWideFormatting.cpp
index 8ebfa2753e..56b278d8ae 100644
--- a/core/libs/tests/GuestWideFormatting.cpp
+++ b/core/libs/tests/GuestWideFormatting.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libc/include/GuestTime.hpp"
@@ -8,16 +9,6 @@
 #include <stdexcept>
 #include <string>
 
-extern "C" int APS5_VABI vswprintf_nid_postfix(char16_t*, std::size_t, const char16_t*, VaList*);
-extern "C" int APS5_VABI snwprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, ...);
-extern "C" int APS5_VABI vswprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, VaList*);
-extern "C" int APS5_VABI swprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, ...);
-extern "C" int APS5_VABI vsnwprintf_s_nid_postfix(char16_t*, std::size_t, const char16_t*, VaList*);
-extern "C" int APS5_VABI swprintf_nid_postfix(char16_t*, std::size_t, const char16_t*, ...);
-extern "C" std::size_t APS5_VABI strftime_nid_postfix(char*, std::size_t, const char*, const GuestTm*);
-extern "C" std::size_t APS5_VABI wcsftime_nid_postfix(char16_t*, std::size_t, const char16_t*, const GuestTm*);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static int APS5_VABI Format(char16_t* buffer, std::size_t size, const char16_t* format, ...) {
 #ifdef _WIN32
     __builtin_sysv_va_list args;
@@ -212,7 +203,8 @@ static void CheckSwprintf() {
 
 static bool WcsftimeThrows(char16_t* buffer, const char16_t* format, const GuestTm* time) {
     try {
-        wcsftime_nid_postfix(buffer, 16, format, time);
+        wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 16, reinterpret_cast<const std::uint16_t*>(format), time);
+
     } catch (const std::invalid_argument&) {
         return true;
     }
@@ -246,31 +238,33 @@ static void CheckWcsftime() {
         char16_t wide[128];
         const std::size_t length = strftime_nid_postfix(narrow, sizeof(narrow), item.narrow, &time);
         Require(length != 0, "wcsftime reference strftime");
-        Require(wcsftime_nid_postfix(wide, 128, item.wide, &time) == length, "wcsftime length matches strftime");
+        Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(wide), 128, reinterpret_cast<const std::uint16_t*>(item.wide), &time) == length, "wcsftime length matches strftime");
         for (std::size_t index = 0; index <= length; ++index)
             Require(wide[index] == static_cast<unsigned char>(narrow[index]), "wcsftime output matches strftime");
     }
     char16_t buffer[32];
-    Require(wcsftime_nid_postfix(buffer, 32, u"%Y-%m-%d %H:%M:%S", &time) == 19
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%Y-%m-%d %H:%M:%S"), &time) == 19
         && buffer == std::u16string(u"2024-02-29 13:05:09"), "wcsftime date and time");
-    Require(wcsftime_nid_postfix(buffer, 32, u"%a %b %j %p", &time) == 14
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%a %b %j %p"), &time) == 14
         && buffer == std::u16string(u"Thu Feb 060 PM"), "wcsftime names");
-    Require(wcsftime_nid_postfix(buffer, 32, u"%%", &time) == 1 && buffer == std::u16string(u"%"), "wcsftime percent");
-    Require(wcsftime_nid_postfix(buffer, 20, u"%Y-%m-%d %H:%M:%S", &time) == 19, "wcsftime exact fit");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%%"), &time) == 1 && buffer == std::u16string(u"%"), "wcsftime percent");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 20, reinterpret_cast<const std::uint16_t*>(u"%Y-%m-%d %H:%M:%S"), &time) == 19, "wcsftime exact fit");
 
     int& error = *__error_nid_postfix();
     for (auto& unit : buffer) unit = u'x';
     error = 5;
-    Require(wcsftime_nid_postfix(buffer, 19, u"%Y-%m-%d %H:%M:%S", &time) == 0 && error == 5 && buffer[0] == u'x',
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 19, reinterpret_cast<const std::uint16_t*>(u"%Y-%m-%d %H:%M:%S"), &time) == 0 && error == 5 && buffer[0] == u'x',
         "wcsftime overflow");
-    Require(wcsftime_nid_postfix(buffer, 1, u"%Y", &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime one unit");
-    Require(wcsftime_nid_postfix(buffer, 0, u"%Y", &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime zero size");
-    Require(wcsftime_nid_postfix(buffer, 32, u"", &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime empty format");
-    Require(wcsftime_nid_postfix(nullptr, 32, u"%Y", &time) == 0 && error == 5, "wcsftime null buffer");
-    Require(wcsftime_nid_postfix(buffer, 32, u"%Y \u20ac", &time) == 0 && error == 86 && buffer[0] == u'x',
-        "wcsftime unconvertible format");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 1, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime one unit");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 0, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime zero size");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u""), &time) == 0 && error == 5 && buffer[0] == u'x', "wcsftime empty format");
+    Require(wcsftime_nid_postfix(nullptr, 32, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 5, "wcsftime null buffer");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 32, reinterpret_cast<const std::uint16_t*>(u"%Y \u20ac"), &time) == 6 && buffer == std::u16string(u"2024 \u20ac"),
+        "wcsftime passes a character above 0xff through UTF-8");
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), 7, reinterpret_cast<const std::uint16_t*>(u"%Y \u20ac"), &time) == 6, "wcsftime sizes the narrow buffer for three-byte characters");
+    for (auto& unit : buffer) unit = u'x';
     error = 5;
-    Require(wcsftime_nid_postfix(buffer, SIZE_MAX, u"%Y", &time) == 0 && error == 22 && buffer[0] == u'x',
+    Require(wcsftime_nid_postfix(reinterpret_cast<std::uint16_t*>(buffer), SIZE_MAX, reinterpret_cast<const std::uint16_t*>(u"%Y"), &time) == 0 && error == 22 && buffer[0] == u'x',
         "wcsftime oversized buffer");
     Require(WcsftimeThrows(buffer, nullptr, &time), "wcsftime null format");
     Require(WcsftimeThrows(buffer, u"%Y", nullptr), "wcsftime null time");
diff --git a/core/libs/tests/GuestWideStreamScan.cpp b/core/libs/tests/GuestWideStreamScan.cpp
index 0da21861b0..857a72001f 100644
--- a/core/libs/tests/GuestWideStreamScan.cpp
+++ b/core/libs/tests/GuestWideStreamScan.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdarg>
@@ -8,15 +9,7 @@
 
 extern "C" {
 extern FileStream* __stdinp_nid_postfix;
-int APS5_VABI vfwscanf_nid_postfix(FileStream*, const char16_t*, void*);
-int APS5_VABI vfwscanf_s_nid_postfix(FileStream*, const char16_t*, void*);
-int APS5_VABI vwscanf_nid_postfix(const char16_t*, void*);
-int APS5_VABI vwscanf_s_nid_postfix(const char16_t*, void*);
-int APS5_VABI fwscanf_nid_postfix(FileStream*, const char16_t*, ...);
-int APS5_VABI fwscanf_s_nid_postfix(FileStream*, const char16_t*, ...);
-int APS5_VABI wscanf_nid_postfix(const char16_t*, ...);
-int APS5_VABI wscanf_s_nid_postfix(const char16_t*, ...);
-std::int32_t APS5_VABI fgetwc_nid_postfix(FileStream*);
+
 }
 
 #ifdef _WIN32
@@ -35,28 +28,28 @@ static void Require(bool value, const char* what) {
 
 static int APS5_VABI ScanStream(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfwscanf_nid_postfix(stream, format, args);
+    const int result = vfwscanf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanStreamSized(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vfwscanf_s_nid_postfix(stream, format, args);
+    const int result = vfwscanf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanInput(const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vwscanf_nid_postfix(format, args);
+    const int result = vwscanf_nid_postfix(format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
 
 static int APS5_VABI ScanInputSized(const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
-    const int result = vwscanf_s_nid_postfix(format, args);
+    const int result = vwscanf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
     APS5_VA_END();
     return result;
 }
@@ -101,6 +94,14 @@ static void CheckConsumption() {
     Require(fgetwc_nid_postfix(stream) == u'b', "the mismatching character is pushed back");
     Close(stream);
 
+    stream = Open("");
+    Require(ScanStream(stream, u"x") == 0, "a literal at end of input returns zero");
+    Close(stream);
+
+    stream = Open("");
+    Require(ScanStream(stream, u"%%") == -1, "a percent literal at end of input is an input failure");
+    Close(stream);
+
     stream = Open("x");
     Require(ScanStream(stream, u"%d", &value) == 0, "a letter is not an integer");
     Require(fgetwc_nid_postfix(stream) == u'x', "the rejected letter is pushed back");
@@ -120,6 +121,10 @@ static void CheckConsumption() {
     Require(ScanStream(stream, u"%lf", &real) == 1 && real == 2.5, "a float");
     Require(fgetwc_nid_postfix(stream) == u'x', "the character after the float");
     Close(stream);
+
+    stream = Open("1e+");
+    Require(ScanStream(stream, u"%lf", &real) == 1 && real == 1.0, "an incomplete exponent converts its mantissa");
+    Close(stream);
 }
 
 static void CheckWideText() {
diff --git a/core/libs/tests/GuestWideStrings.cpp b/core/libs/tests/GuestWideStrings.cpp
index 30f48c4efb..db3553fee9 100644
--- a/core/libs/tests/GuestWideStrings.cpp
+++ b/core/libs/tests/GuestWideStrings.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <climits>
 #include <cstddef>
@@ -10,55 +11,6 @@
 #include <cstring>
 #include <string>
 
-extern "C" {
-std::size_t APS5_VABI c32rtomb_nid_postfix(char* destination, std::uint32_t value, void* state);
-std::size_t APS5_VABI c16rtomb_nid_postfix(char* destination, std::uint16_t unit, void* state);
-std::size_t APS5_VABI mbrtoc32_nid_postfix(std::uint32_t* destination, const char* source, std::size_t count, void* state);
-std::size_t APS5_VABI mbrtoc16_nid_postfix(std::uint16_t* destination, const char* source, std::size_t count, void* state);
-int APS5_VABI mblen_nid_postfix(const char* source, std::size_t count);
-int APS5_VABI wctomb_nid_postfix(char* destination, std::uint16_t value);
-int* APS5_VABI __error_nid_postfix();
-const char16_t* APS5_VABI wmemchr_nid_postfix(const char16_t* s, char16_t c, std::size_t n);
-int APS5_VABI wmemcmp_nid_postfix(const char16_t* s1, const char16_t* s2, std::size_t n);
-char16_t* APS5_VABI wmemcpy_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-char16_t* APS5_VABI wmemmove_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-std::size_t APS5_VABI wcslen_nid_postfix(const char16_t* s);
-std::size_t APS5_VABI wcsnlen_s_nid_postfix(const char16_t* s, std::size_t maxlen);
-int APS5_VABI wcscmp_nid_postfix(const char16_t* s1, const char16_t* s2);
-int APS5_VABI wcsncmp_nid_postfix(const char16_t* s1, const char16_t* s2, std::size_t n);
-char16_t* APS5_VABI wcscpy_nid_postfix(char16_t* dest, const char16_t* src);
-char16_t* APS5_VABI wcscat_nid_postfix(char16_t* dest, const char16_t* src);
-char16_t* APS5_VABI wcsncpy_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-int APS5_VABI wmemcpy_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wmemmove_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wcsncpy_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-char16_t* APS5_VABI wcsncat_nid_postfix(char16_t* dest, const char16_t* src, std::size_t n);
-int APS5_VABI wcsncat_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src, std::size_t count);
-int APS5_VABI wcscat_s_nid_postfix(char16_t* dest, std::size_t destsz, const char16_t* src);
-const char16_t* APS5_VABI wcschr_nid_postfix(const char16_t* s, char16_t c);
-const char16_t* APS5_VABI wcsrchr_nid_postfix(const char16_t* s, char16_t c);
-const char16_t* APS5_VABI wcsstr_nid_postfix(const char16_t* haystack, const char16_t* needle);
-const char16_t* APS5_VABI wcspbrk_nid_postfix(const char16_t* s, const char16_t* accept);
-std::size_t APS5_VABI wcsspn_nid_postfix(const char16_t* s, const char16_t* accept);
-std::size_t APS5_VABI wcscspn_nid_postfix(const char16_t* s, const char16_t* reject);
-char16_t* APS5_VABI wcstok_nid_postfix(char16_t* text, const char16_t* delimiters, char16_t** last);
-char16_t* APS5_VABI wmemset_nid_postfix(char16_t* s, char16_t c, std::size_t n);
-double APS5_VABI wcstod_nid_postfix(const char16_t* str, char16_t** endptr);
-float APS5_VABI wcstof_nid_postfix(const char16_t* str, char16_t** endptr);
-long double APS5_VABI wcstold_nid_postfix(const char16_t* str, char16_t** endptr);
-long long APS5_VABI wcstol_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-long long APS5_VABI wcstoll_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-long long APS5_VABI wcstoimax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-unsigned long long APS5_VABI wcstoumax_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-unsigned long long APS5_VABI strtouq_nid_postfix(const char* str, char** endptr, int base);
-char* APS5_VABI rindex_nid_postfix(const char* s, int c);
-int APS5_VABI flsl_nid_postfix(std::int64_t mask);
-unsigned long long APS5_VABI wcstoul_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-unsigned long long APS5_VABI wcstoull_nid_postfix(const char16_t* str, char16_t** endptr, int base);
-int APS5_VABI wcscoll_nid_postfix(const char16_t* first, const char16_t* second);
-std::size_t APS5_VABI wcsxfrm_nid_postfix(char16_t* destination, const char16_t* source, std::size_t count);
-}
-
 namespace {
 
 void require(bool condition) {
@@ -121,7 +73,7 @@ int main() {
         require(mblen_nid_postfix(nullptr, 1) == 0 && mblen_nid_postfix("ab", 2) == 1 && mblen_nid_postfix("", 1) == 0);
         require(wctomb_nid_postfix(nullptr, 0x41) == 0);
         require(wctomb_nid_postfix(out, 0x42) == 1 && out[0] == 'B');
-        require(wctomb_nid_postfix(out, 0x263a) == -1);
+        require(wctomb_nid_postfix(out, 0x263a) == 3 && std::memcmp(out, "\xe2\x98\xba", 3) == 0);
     }
     const char16_t split[] = {u'a', u'b', 0, u'c', 0};
     require(wcslen_nid_postfix(u"") == 0);
@@ -148,11 +100,13 @@ int main() {
 
     char16_t buffer[8];
     wmemset_nid_postfix(buffer, 0xaaaa, 8);
+
     require(wcscpy_nid_postfix(buffer, u"wide") == buffer);
     require(same(buffer, u"wide", 5) && buffer[5] == 0xaaaa);
 
     char16_t concatenated[8];
     wmemset_nid_postfix(concatenated, 0xaaaa, 8);
+
     concatenated[0] = 0;
     require(wcscat_nid_postfix(concatenated, u"ab") == concatenated);
     require(wcscat_nid_postfix(concatenated, u"世") == concatenated);
@@ -165,6 +119,7 @@ int main() {
     require(same(buffer, padded, 6));
     wmemset_nid_postfix(buffer, 0xaaaa, 8);
     wcsncpy_nid_postfix(buffer, u"abcdef", 3);
+
     const char16_t truncated[] = {u'a', u'b', u'c', 0xaaaa};
     require(same(buffer, truncated, 4));
 
@@ -174,9 +129,11 @@ int main() {
     require(wmemcpy_s_nid_postfix(nullptr, 16, u"abc", 3) == 22);
     require(wmemcpy_s_nid_postfix(memBuf, 16, nullptr, 3) == 22 && memBuf[0] == 0);
     wmemset_nid_postfix(memBuf, u'Z', 16);
+
     require(wmemcpy_s_nid_postfix(memBuf, 4, u"12345", 5) == 34 && memBuf[0] == 0 && memBuf[3] == 0);
     require(wmemcpy_s_nid_postfix(memBuf, ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, u"a", 1) == 34);
     wmemcpy_s_nid_postfix(memBuf, 16, u"abcdefgh", 8);
+
     require(wmemcpy_s_nid_postfix(memBuf + 2, 8, memBuf, 4) == 22 && memBuf[2] == 0);
 
     wmemcpy_s_nid_postfix(memBuf, 16, u"0123456789", 10);
@@ -203,10 +160,26 @@ int main() {
     require(wcsncpy_s_nid_postfix(strBuf, 5, u"hello", 5) == 34 && strBuf[0] == 0);
     require(wcsncpy_s_nid_postfix(strBuf, ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, u"a", 1) == 34);
     wcsncpy_s_nid_postfix(strBuf, 16, u"abcdef", 6);
+
     require(wcsncpy_s_nid_postfix(strBuf + 1, 10, strBuf, 3) == 22 && strBuf[1] == 0);
 
+    char16_t cpyBuf[16];
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 16, reinterpret_cast<const std::uint16_t*>(u"wide")) == 0 && same(cpyBuf, u"wide", 5));
+    void* previousHandler = set_constraint_handler_s_nid_postfix(reinterpret_cast<void*>(&ignore_handler_s_nid_postfix));
+    require(wcscpy_s_nid_postfix(nullptr, 16, reinterpret_cast<const std::uint16_t*>(u"wide")) == 22);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 0, reinterpret_cast<const std::uint16_t*>(u"wide")) == 22);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 16, nullptr) == 22 && cpyBuf[0] == 0);
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 4, reinterpret_cast<const std::uint16_t*>(u"wide")) == 34 && cpyBuf[0] == 0);
+    cpyBuf[0] = 0x1234;
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), ((SIZE_MAX >> 1) / sizeof(char16_t)) + 1, reinterpret_cast<const std::uint16_t*>(u"a")) == 34 && cpyBuf[0] == 0x1234);
+    wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf), 16, reinterpret_cast<const std::uint16_t*>(u"abcdef"));
+
+    require(wcscpy_s_nid_postfix(reinterpret_cast<std::uint16_t*>(cpyBuf + 1), 10, reinterpret_cast<const std::uint16_t*>(cpyBuf)) == 22 && cpyBuf[1] == 0);
+    set_constraint_handler_s_nid_postfix(previousHandler);
+
     char16_t ncatBuf[16];
     wmemset_nid_postfix(ncatBuf, 0xaaaa, 16);
+
     ncatBuf[0] = 0;
     require(wcsncat_nid_postfix(ncatBuf, u"hello", 3) == ncatBuf);
     require(same(ncatBuf, u"hel", 4) && ncatBuf[4] == 0xaaaa);
@@ -216,19 +189,32 @@ int main() {
     wcsncpy_s_nid_postfix(strBuf, 16, u"hello", 5);
     require(wcsncat_s_nid_postfix(strBuf, 16, u" world", 6) == 0 && same(strBuf, u"hello world", 12));
     wcsncpy_s_nid_postfix(strBuf, 16, u"foo", 3);
+
     require(wcsncat_s_nid_postfix(strBuf, 16, u"barbaz", 3) == 0 && same(strBuf, u"foobar", 7));
     wcsncpy_s_nid_postfix(strBuf, 8, u"abc", 3);
+
     require(wcsncat_s_nid_postfix(strBuf, 8, u"1234", 4) == 0 && same(strBuf, u"abc1234", 8));
     wcsncpy_s_nid_postfix(strBuf, 8, u"abc", 3);
+
     require(wcsncat_s_nid_postfix(strBuf, 8, u"12345", 5) == 34 && strBuf[0] == 0);
     wmemset_nid_postfix(strBuf, u'x', 4);
+
     require(wcsncat_s_nid_postfix(strBuf, 4, u"a", 1) == 34 && strBuf[0] == 0);
     wcsncpy_s_nid_postfix(strBuf, 16, u"abc", 3);
+
+    require(wcsncat_s_nid_postfix(strBuf, 16, strBuf + 1, 2) == 0 && same(strBuf, u"abcbc", 6));
+    const char16_t splitSource[] = u"abc\0xyz";
+    std::memcpy(strBuf, splitSource, sizeof(splitSource));
+    require(wcsncat_s_nid_postfix(strBuf, 16, strBuf + 4, 3) == 22 && strBuf[0] == 0);
+    wcsncpy_s_nid_postfix(strBuf, 16, u"abc", 3);
+
     require(wcscat_s_nid_postfix(strBuf, 16, u"def") == 0 && same(strBuf, u"abcdef", 7));
     wcsncpy_s_nid_postfix(strBuf, 8, u"12345", 5);
+
     require(wcscat_s_nid_postfix(strBuf, 8, u"6789") == 34 && strBuf[0] == 0);
     require(wcscat_s_nid_postfix(nullptr, 8, u"a") == 22);
     wcsncpy_s_nid_postfix(strBuf, 8, u"123", 3);
+
     require(wcscat_s_nid_postfix(strBuf, 8, nullptr) == 22 && strBuf[0] == 0);
 
     const char16_t* text = u"a世b世c";
@@ -341,11 +327,23 @@ int main() {
     require(wcstod_nid_postfix(scientific, &end) == 350.0 && end == scientific + 5);
     require(wcstod_nid_postfix(letters, &end) == 0.0 && end == letters);
     require(wcstof_nid_postfix(u"0.25", nullptr) == 0.25f);
+    const char16_t* sign = u" -x";
+    require(std::signbit(wcstof_nid_postfix(sign, &end)) && end == sign && std::signbit(wcstold_nid_postfix(sign, &end)) && !std::signbit(wcstod_nid_postfix(sign, &end)));
+    *__error_nid_postfix() = 0;
+    require(wcstof_nid_postfix(u"0x1p+200", nullptr) == HUGE_VALF && *__error_nid_postfix() == ERANGE);
+    *__error_nid_postfix() = 0;
+    require(wcstof_nid_postfix(u"1e-45", nullptr) == 0x1p-149f && *__error_nid_postfix() == ERANGE);
+    *__error_nid_postfix() = 0;
+    require(wcstof_nid_postfix(u"0x1p-149", nullptr) == 0x1p-149f && *__error_nid_postfix() == 0);
+    require(wcstof_nid_postfix(u"0x1.8p-150", nullptr) == 0x1p-149f && *__error_nid_postfix() == ERANGE);
+    const char16_t* loneSign = u" -";
+    const float loneSignValue = wcstof_nid_postfix(loneSign, &end);
+    require(loneSignValue == 0.f && !std::signbit(loneSignValue) && end == loneSign && std::signbit(wcstold_nid_postfix(loneSign, &end)));
     const char16_t* half = u"-1.5é";
     require(wcstold_nid_postfix(half, &end) == -1.5L && end == half + 4);
     const char16_t* wideNan = u" -nan(0x123)é";
     require(std::bit_cast<std::uint64_t>(wcstod_nid_postfix(wideNan, &end)) == 0xfff8000000000123u && end == wideNan + 12);
-    require(std::bit_cast<std::uint32_t>(wcstof_nid_postfix(wideNan, &end)) == 0x7fc00000u && end == wideNan + 12);
+    require(std::bit_cast<std::uint32_t>(wcstof_nid_postfix(wideNan, &end)) == 0xffc00000u && end == wideNan + 12);
     const long double wideExtended = wcstold_nid_postfix(wideNan, &end);
     std::uint64_t significand;
     std::memcpy(&significand, &wideExtended, sizeof(significand));
@@ -357,8 +355,10 @@ int main() {
 
     char16_t transformed[8];
     wmemset_nid_postfix(transformed, 0xaaaa, 8);
+
     require(wcsxfrm_nid_postfix(transformed, u"wide", 8) == 4 && same(transformed, u"wide", 5) && transformed[5] == 0xaaaa);
     wmemset_nid_postfix(transformed, 0xaaaa, 8);
+
     require(wcsxfrm_nid_postfix(transformed, u"much too long", 4) == 13);
     if (!same(transformed, u"muc", 4)) std::fputs("wcsxfrm did not copy and terminate its truncated result\n", stderr);
     require(same(transformed, u"muc", 4) && transformed[4] == 0xaaaa);
@@ -382,6 +382,7 @@ int main() {
         TransformCase{u"\x7fff\x8000\xffff\xd83d\xde00", 6, 5, u"\x7fff\x8000\xffff\xd83d\xde00", 6}
     }) {
         wmemset_nid_postfix(transformed, 0xaaaa, 8);
+
         require(wcsxfrm_nid_postfix(transformed, test.source, test.count) == test.length);
         require(same(transformed, test.expected, test.written));
         for (std::size_t index = test.written; index < 8; ++index) require(transformed[index] == 0xaaaa);
diff --git a/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
index 865e59e92f..1c5227b3f8 100644
--- a/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
+++ b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
@@ -1,6 +1,8 @@
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/File/include/FileFlags.hpp"
+#include "prx/libkernel/File/include/File.hpp"
+#include "prx/libkernel/include/Api.hpp"
 #include <windows.h>
 #include <winioctl.h>
 #include <array>
@@ -15,13 +17,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
-int APS5_VABI sceKernelClose(int);
-int APS5_VABI sceKernelGetdents(int, char*, int);
-int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Directory link type check failed at line %d\n", line);
diff --git a/core/libs/tests/GuestWorkingDirectory.cpp b/core/libs/tests/GuestWorkingDirectory.cpp
index de3ea75fc1..f14f721431 100644
--- a/core/libs/tests/GuestWorkingDirectory.cpp
+++ b/core/libs/tests/GuestWorkingDirectory.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
 #include "prx/libc/include/GuestHeap.hpp"
@@ -8,11 +9,7 @@
 #include <cstring>
 #include <fstream>
 #include <limits>
-extern "C" {
-int APS5_VABI chdir_nid_postfix(const char*);
-char* APS5_VABI getcwd_nid_postfix(char*, std::size_t);
-int* APS5_VABI __error_nid_postfix();
-}
+
 static void Require(bool value) { if (!value) std::abort(); }
 static int allocations = 0;
 static int releases = 0;
diff --git a/core/libs/tests/GuestZlib.cpp b/core/libs/tests/GuestZlib.cpp
index e893ab95e5..9f8a857137 100644
--- a/core/libs/tests/GuestZlib.cpp
+++ b/core/libs/tests/GuestZlib.cpp
@@ -1,20 +1,15 @@
+#include "prx/libSceZlib/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
 #include <array>
+#include <chrono>
 #include <cstdint>
 #include <cstdlib>
 #include <cstdio>
 #include <source_location>
 #include <cstring>
 #include <stdexcept>
-
-extern "C" {
-std::int32_t APS5_VABI sceZlibInitialize(const void*, std::uint64_t);
-std::int32_t APS5_VABI sceZlibFinalize();
-std::int32_t APS5_VABI sceZlibInflate(const void*, std::uint32_t, void*, std::uint32_t, std::uint64_t*);
-std::int32_t APS5_VABI sceZlibWaitForDone(std::uint64_t*, std::uint32_t*);
-std::int32_t APS5_VABI sceZlibGetResult(std::uint64_t, std::uint32_t*, std::int32_t*);
-}
+#include <thread>
 
 static void Require(bool value, const std::source_location& location = std::source_location::current()) {
     if (value) return;
@@ -59,17 +54,20 @@ int main() {
         Require(sceZlibInflate(input, inputLength, output, capacity, &id) == 0);
         Require(id > previous);
         previous = id;
-        RequireThrows([&] { sceZlibInflate(input, inputLength, output, capacity, &id); });
-        std::uint32_t timeout = 0;
-        RequireThrows([&] { sceZlibWaitForDone(&id, &timeout); });
         std::uint64_t completed;
         Require(sceZlibWaitForDone(&completed, nullptr) == 0);
         Require(completed == id);
+        std::uint32_t timeout = 0;
+        Require(sceZlibWaitForDone(&completed, &timeout) == static_cast<std::int32_t>(0x81120027));
         Require(sceZlibGetResult(id + 1, &produced, &status) == static_cast<std::int32_t>(0x81120002));
+        Require(sceZlibGetResult(id, nullptr, &status) == static_cast<std::int32_t>(0x81120016));
         Require(sceZlibGetResult(id, &produced, &status) == 0);
         if (status != expectedStatus) std::fprintf(stderr, "input=%u capacity=%u status=%x expected=%x produced=%u\n", inputLength, capacity, static_cast<unsigned>(status), static_cast<unsigned>(expectedStatus), produced);
         Require(status == expectedStatus && produced <= capacity);
-        RequireThrows([&] { sceZlibGetResult(id, &produced, &status); });
+        std::uint32_t producedAgain = 0;
+        std::int32_t statusAgain = 0;
+        Require(sceZlibGetResult(id, &producedAgain, &statusAgain) == 0);
+        Require(producedAgain == produced && statusAgain == status);
         Require(std::all_of(storage.begin(), storage.begin() + 2048, [](auto byte) { return byte == 0xA5; }));
         Require(std::all_of(storage.begin() + 2048 + capacity, storage.end(), [](auto byte) { return byte == 0xA5; }));
     };
@@ -84,7 +82,55 @@ int main() {
     decode(compressed.data(), compressed.size() - 1, 65536, static_cast<std::int32_t>(0x811200FF));
     decode(compressed.data(), compressed.size() - 4, 8192, static_cast<std::int32_t>(0x811200FF));
     decode(compressed.data(), compressed.size() - 1, 8192, static_cast<std::int32_t>(0x811200FF));
+    alignas(2048) std::array<std::uint8_t, 3 * 8192> batch{};
+    std::array<std::uint64_t, 3> ids{};
+    for (std::size_t index = 0; index < ids.size(); ++index)
+        Require(sceZlibInflate(compressed.data(), compressed.size(), batch.data() + index * 8192, 8192, &ids[index]) == 0);
+    Require(ids[0] < ids[1] && ids[1] < ids[2]);
+    for (std::uint64_t expected : ids) {
+        std::uint64_t completed = 0;
+        Require(sceZlibWaitForDone(&completed, nullptr) == 0);
+        Require(completed == expected);
+    }
+    for (std::size_t index = 0; index < ids.size(); ++index) {
+        Require(sceZlibGetResult(ids[index], &produced, &status) == 0);
+        Require(status == 0 && produced == expectedLength);
+        Require(std::memcmp(batch.data() + index * 8192, text, sizeof(text) - 1) == 0);
+    }
+    std::uint64_t completed = 0;
+    std::uint32_t timeout = 0;
+    Require(sceZlibInflate(compressed.data(), compressed.size(), output, 8192, &id) == 0);
+    Require(sceZlibWaitForDone(&completed, &timeout) == 0);
+    Require(completed == id);
+    timeout = 20000;
+    const auto start = std::chrono::steady_clock::now();
+    Require(sceZlibWaitForDone(&completed, &timeout) == static_cast<std::int32_t>(0x81120027));
+    const auto waited = std::chrono::steady_clock::now() - start;
+    Require(waited >= std::chrono::microseconds(20000) && waited < std::chrono::seconds(1));
+    std::thread waiter([&] { Require(sceZlibWaitForDone(&completed, nullptr) == 0); });
+    std::this_thread::sleep_for(std::chrono::milliseconds(10));
+    Require(sceZlibInflate(compressed.data(), compressed.size(), output, 8192, &id) == 0);
+    waiter.join();
+    Require(completed == id);
+    Require(sceZlibInflate(compressed.data(), compressed.size(), output, 8192, &id) == 0);
     Require(sceZlibFinalize() == 0);
+    Require(sceZlibInitialize(nullptr, 0) == 0);
+    Require(sceZlibGetResult(id, &produced, &status) == static_cast<std::int32_t>(0x81120002));
+    bool interrupted = false;
+    std::thread interruptedWaiter([&] {
+        std::uint32_t longTimeout = 5000000;
+        const auto waitStart = std::chrono::steady_clock::now();
+        try {
+            interrupted = sceZlibWaitForDone(&completed, &longTimeout) == static_cast<std::int32_t>(0x81120032);
+        } catch (const std::runtime_error&) {
+            interrupted = true;
+        }
+        Require(std::chrono::steady_clock::now() - waitStart < std::chrono::seconds(1));
+    });
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    Require(sceZlibFinalize() == 0);
+    interruptedWaiter.join();
+    Require(interrupted);
     Require(sceZlibGetResult(id, &produced, &status) == static_cast<std::int32_t>(0x81120032));
     std::array<std::uint8_t, 65536> scratch{};
     RequireThrows([&] { sceZlibInitialize(scratch.data(), scratch.size()); });
diff --git a/core/libs/tests/HevcFixture.hpp b/core/libs/tests/HevcFixture.hpp
new file mode 100644
index 0000000000..7bacee3a02
--- /dev/null
+++ b/core/libs/tests/HevcFixture.hpp
@@ -0,0 +1,133 @@
+#pragma once
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <vector>
+
+namespace HevcFixture {
+
+inline constexpr std::array<std::uint8_t, 933> HevcStream{
+    0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x10, 0x00, 0x00, 0x00, 0x01, 0x40, 0x01, 0x0c, 0x01, 0xff,
+    0xff, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00, 0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e,
+    0x95, 0x90, 0x09, 0x00, 0x00, 0x00, 0x01, 0x42, 0x01, 0x01, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00,
+    0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e, 0xa0, 0x20, 0x82, 0x96, 0x59, 0x59, 0x2e,
+    0x4c, 0xaf, 0x01, 0x68, 0x08, 0x00, 0x00, 0x03, 0x00, 0x08, 0x00, 0x00, 0x03, 0x00, 0xf0, 0x40,
+    0x00, 0x00, 0x00, 0x01, 0x44, 0x01, 0xc1, 0x73, 0xd0, 0x89, 0x00, 0x00, 0x01, 0x28, 0x01, 0xaf,
+    0x08, 0xe0, 0xbb, 0xcb, 0xc1, 0x71, 0x26, 0x0f, 0xbf, 0x6c, 0xcb, 0x4d, 0x2b, 0x2c, 0xf4, 0x08,
+    0xe0, 0x17, 0xeb, 0x16, 0xcc, 0x07, 0xd8, 0xdd, 0x11, 0xf8, 0x5e, 0x73, 0x79, 0x57, 0xcb, 0x69,
+    0xa3, 0x1c, 0x9c, 0x43, 0x14, 0xdb, 0x61, 0x0e, 0xc5, 0xc6, 0x9c, 0x9c, 0xf8, 0xf2, 0x07, 0x35,
+    0xf1, 0x98, 0x6c, 0x1a, 0x86, 0x53, 0x5a, 0xcd, 0x4d, 0xda, 0xff, 0xfb, 0x01, 0xda, 0xc3, 0x61,
+    0xb7, 0x8c, 0xae, 0xc9, 0x76, 0xe4, 0x05, 0xd6, 0xfd, 0xe4, 0xcd, 0x93, 0x2c, 0xb1, 0x41, 0x29,
+    0xce, 0x22, 0xf7, 0x77, 0x64, 0x0f, 0x1f, 0xd2, 0xc3, 0x68, 0x32, 0x2f, 0x83, 0xd7, 0x53, 0xbe,
+    0x23, 0xff, 0x8c, 0x46, 0x18, 0x33, 0x90, 0x28, 0xa3, 0xef, 0xd7, 0xb1, 0x46, 0x84, 0xa0, 0xc2,
+    0xd4, 0xd9, 0xce, 0xdf, 0x0a, 0x05, 0xec, 0xad, 0x63, 0xa4, 0x78, 0x27, 0x80, 0x4e, 0x3b, 0x4c,
+    0xa6, 0x42, 0xbc, 0xe3, 0x39, 0x4d, 0xc4, 0xd3, 0x44, 0xf1, 0x22, 0xd0, 0x64, 0x9f, 0xd0, 0x88,
+    0x7f, 0x39, 0x6d, 0x06, 0xc7, 0x79, 0x75, 0x2a, 0x44, 0x3d, 0x21, 0x41, 0x53, 0x60, 0x8d, 0x08,
+    0x9f, 0xd0, 0x34, 0xa6, 0x72, 0x70, 0x3b, 0xa9, 0xfa, 0x62, 0xb1, 0x19, 0x9b, 0x0b, 0xa2, 0xfc,
+    0xb4, 0xb3, 0x2c, 0x58, 0xad, 0xc6, 0xf3, 0xea, 0xc4, 0xd0, 0xf9, 0xea, 0x9e, 0xa7, 0xa4, 0x87,
+    0xb8, 0x19, 0x68, 0xf1, 0xc1, 0x6b, 0x87, 0xa5, 0x99, 0xa0, 0x69, 0x24, 0x28, 0x80, 0xba, 0xd2,
+    0x57, 0xc6, 0xc0, 0x1e, 0x69, 0x1b, 0xce, 0x96, 0xcd, 0x85, 0x9d, 0x59, 0x32, 0x92, 0x71, 0xe7,
+    0x15, 0xf2, 0x9b, 0x71, 0x4b, 0xd4, 0xb6, 0x99, 0xb0, 0x71, 0x9b, 0x9b, 0xdb, 0x33, 0x28, 0x86,
+    0x5e, 0x44, 0xf3, 0x5d, 0x5d, 0x7b, 0x87, 0x6c, 0x99, 0x8a, 0x6d, 0xaf, 0xf8, 0xdd, 0x39, 0x14,
+    0xc0, 0x10, 0x85, 0xaf, 0x3a, 0x77, 0x60, 0x8b, 0xb7, 0x5f, 0x67, 0x45, 0xb4, 0xa7, 0xe7, 0x44,
+    0x77, 0x0a, 0xb9, 0xe1, 0xb2, 0xbe, 0xde, 0x1b, 0x5a, 0xb8, 0xc8, 0x9b, 0x1f, 0x15, 0x37, 0xdc,
+    0xeb, 0x55, 0x12, 0x37, 0xa1, 0xab, 0x9c, 0xcd, 0xdd, 0x42, 0x5d, 0x90, 0x89, 0xc5, 0x99, 0x54,
+    0x6e, 0x9a, 0xd2, 0x71, 0x07, 0xe3, 0x81, 0x20, 0xad, 0xd4, 0x7c, 0xad, 0x69, 0xaf, 0xc7, 0x2d,
+    0x7c, 0x84, 0xf1, 0x5d, 0x43, 0x4a, 0x3c, 0xf6, 0xf8, 0x7e, 0x6a, 0xb2, 0xdd, 0x00, 0xda, 0x30,
+    0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x30, 0x00, 0x00, 0x01, 0x02, 0x01, 0xd0, 0x19, 0x5f, 0x84,
+    0x31, 0x84, 0x50, 0x62, 0xcd, 0x44, 0xa6, 0x4e, 0xbb, 0x2e, 0x87, 0xda, 0x21, 0x25, 0x1c, 0x13,
+    0xfe, 0xc2, 0x97, 0xa3, 0xd5, 0xfd, 0xe2, 0x62, 0xd6, 0xe5, 0x50, 0x7a, 0xda, 0x98, 0x8d, 0xcf,
+    0xbe, 0x40, 0x5d, 0x69, 0xb6, 0x5f, 0xdc, 0x32, 0x68, 0x05, 0x67, 0x70, 0xfd, 0xa0, 0xd3, 0xcd,
+    0x88, 0xeb, 0x12, 0x2e, 0xac, 0xf5, 0x57, 0xa2, 0xc2, 0x81, 0x22, 0x6b, 0x8d, 0x69, 0x6d, 0xac,
+    0x41, 0x05, 0x5b, 0x0b, 0x79, 0xe0, 0x86, 0x05, 0x86, 0x8b, 0x02, 0x51, 0x7d, 0x6e, 0x13, 0x63,
+    0x36, 0xe6, 0x89, 0x22, 0x75, 0xd9, 0xb0, 0x39, 0x27, 0xcd, 0xac, 0x78, 0xe0, 0x3a, 0x6a, 0x17,
+    0x15, 0x05, 0x83, 0x3a, 0xe9, 0x38, 0x7c, 0x75, 0x38, 0xf3, 0xd8, 0x42, 0x57, 0xa1, 0xef, 0x68,
+    0xb8, 0xb5, 0x44, 0xfe, 0x4d, 0x66, 0xa1, 0x09, 0xc5, 0x62, 0xff, 0x87, 0x7e, 0xdb, 0x41, 0x6f,
+    0x4d, 0x5f, 0x16, 0x49, 0xef, 0xca, 0xda, 0x67, 0x01, 0x29, 0x0b, 0xd6, 0xd8, 0xfc, 0x0b, 0x22,
+    0xc8, 0x28, 0xff, 0xb4, 0xb3, 0xa9, 0xf8, 0x9b, 0x78, 0x7d, 0x33, 0xbf, 0xa6, 0x9b, 0x39, 0x64,
+    0x57, 0x41, 0x1f, 0x27, 0x05, 0xfc, 0xcd, 0x44, 0xcd, 0xb2, 0xea, 0x79, 0xe0, 0x00, 0x00, 0x00,
+    0x01, 0x46, 0x01, 0x50, 0x00, 0x00, 0x01, 0x02, 0x01, 0xe0, 0x44, 0x97, 0xe1, 0x8f, 0x40, 0x3d,
+    0x73, 0xde, 0xdf, 0xf5, 0x1c, 0xff, 0xf6, 0xe2, 0x12, 0x16, 0x3d, 0xb6, 0x75, 0xad, 0x9e, 0xb5,
+    0x2b, 0xe7, 0x4a, 0x40, 0xe9, 0x91, 0xd6, 0x86, 0x86, 0x2d, 0xcb, 0xe4, 0xb6, 0x58, 0x4a, 0x2d,
+    0x7b, 0x1b, 0xdb, 0xc5, 0x48, 0x2d, 0x09, 0x4d, 0x32, 0x30, 0xde, 0xaa, 0x61, 0xc2, 0x27, 0x64,
+    0x54, 0x71, 0x89, 0x32, 0x05, 0xc0, 0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x50, 0x00, 0x00, 0x01,
+    0x00, 0x01, 0xe0, 0x24, 0xff, 0xfa, 0x2c, 0x6e, 0xdc, 0x78, 0x3d, 0x08, 0x6d, 0x3b, 0xcf, 0xcc,
+    0xb6, 0x16, 0xeb, 0x9d, 0x5f, 0x46, 0x0b, 0x24, 0x0e, 0x97, 0x99, 0x06, 0x00, 0x00, 0x00, 0x01,
+    0x46, 0x01, 0x30, 0x00, 0x00, 0x01, 0x02, 0x01, 0xd0, 0x28, 0x95, 0xd7, 0xdc, 0x41, 0xc0, 0x61,
+    0x14, 0xd6, 0xee, 0xd4, 0xe8, 0x24, 0x3e, 0x7f, 0x82, 0x22, 0xb0, 0x20, 0xb9, 0xf1, 0x69, 0x9b,
+    0xfe, 0xcc, 0xb7, 0x2e, 0xbd, 0xdb, 0x20, 0xfa, 0xe5, 0x97, 0xd9, 0x95, 0x1d, 0x7e, 0x49, 0x35,
+    0x69, 0xdb, 0x40, 0xa3, 0x5c, 0x0f, 0x74, 0x6f, 0x00, 0x3d, 0x36, 0x05, 0xc0, 0xc4, 0x37, 0x15,
+    0xf9, 0x01, 0x2d, 0xdf, 0xcb, 0x70, 0x3d, 0xfa, 0x47, 0xec, 0x80, 0x07, 0x48, 0x08, 0xc8, 0x54,
+    0xd3, 0xe3, 0x00, 0xa3, 0xe4, 0xce, 0x40, 0x05, 0x0b, 0x51, 0x73, 0x56, 0x33, 0x82, 0xa8, 0x0a,
+    0xc0, 0xd3, 0xc5, 0xf1, 0xeb, 0x32, 0x8e, 0x4e, 0xa7, 0x6f, 0xb2, 0x64, 0x43, 0x54, 0x71, 0xd4,
+    0xaf, 0xc0, 0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x50, 0x00, 0x00, 0x01, 0x00, 0x01, 0xe0, 0x82,
+    0x2f, 0x5f, 0xdc, 0x63, 0x70, 0x3f, 0xaf, 0x66, 0x75, 0x52, 0xe7, 0x7f, 0x62, 0xfb, 0x84, 0x9c,
+    0xef, 0x60, 0x8f, 0xfa, 0x7e, 0x5f, 0x8b, 0x40, 0x15, 0x34, 0x69, 0xe2, 0xc4, 0xfc, 0xff, 0x53,
+    0xb8, 0x1e, 0xc7, 0x20, 0x55, 0xdb, 0x5e, 0x05, 0xbd, 0x7a, 0x85, 0xb4, 0xb7, 0xc1, 0x8d, 0xdb,
+    0x0f, 0xa6, 0xab, 0xb9, 0x00, 0x2a, 0xdb, 0x83, 0xa0, 0xb0, 0xc5, 0x76, 0x6e, 0xe1, 0xb8, 0x72,
+    0xfd, 0x09, 0x61, 0x19, 0xe0,
+};
+
+inline constexpr std::array<std::uint8_t, 234> HevcMain10Stream{
+    0x00, 0x00, 0x00, 0x01, 0x46, 0x01, 0x10, 0x00, 0x00, 0x00, 0x01, 0x40, 0x01, 0x0c, 0x01, 0xff,
+    0xff, 0x02, 0x20, 0x00, 0x00, 0x03, 0x00, 0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e,
+    0x95, 0x98, 0x09, 0x00, 0x00, 0x00, 0x01, 0x42, 0x01, 0x01, 0x02, 0x20, 0x00, 0x00, 0x03, 0x00,
+    0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e, 0xa0, 0x20, 0x82, 0x93, 0x65, 0x95, 0x9a,
+    0xe4, 0xca, 0xf0, 0x16, 0x80, 0x80, 0x00, 0x00, 0x03, 0x00, 0x80, 0x00, 0x00, 0x0f, 0x04, 0x00,
+    0x00, 0x00, 0x01, 0x44, 0x01, 0xc1, 0x73, 0xd0, 0x89, 0x00, 0x00, 0x01, 0x28, 0x01, 0xaf, 0x08,
+    0x60, 0xf2, 0xfb, 0x04, 0xef, 0x67, 0x67, 0xdc, 0xc7, 0x8e, 0xc7, 0x42, 0x63, 0xeb, 0x7d, 0x28,
+    0x73, 0x95, 0x14, 0x0c, 0x71, 0x10, 0x8b, 0x65, 0x04, 0xbd, 0x03, 0xe6, 0x04, 0x35, 0xb9, 0x9b,
+    0xec, 0x60, 0x2e, 0xea, 0xcf, 0xd0, 0xdd, 0x2d, 0x3a, 0x62, 0x33, 0x9d, 0x7a, 0x74, 0xb0, 0xeb,
+    0x0c, 0x06, 0xe6, 0xa5, 0x30, 0xa7, 0xea, 0xed, 0xc2, 0xa5, 0x8e, 0x7c, 0xda, 0x1b, 0x9d, 0xe4,
+    0xac, 0x2b, 0x38, 0xdb, 0x9c, 0xe8, 0x51, 0x34, 0x46, 0xd2, 0x04, 0x1a, 0x77, 0x87, 0x7a, 0x19,
+    0x70, 0xf9, 0x4f, 0xcb, 0x03, 0x3c, 0x74, 0x25, 0xb9, 0x92, 0x3b, 0x95, 0xe9, 0xd8, 0xaa, 0x9b,
+    0x6b, 0x9b, 0x1f, 0x70, 0x25, 0x2a, 0xe7, 0x6c, 0xc3, 0x7e, 0x55, 0x39, 0xf5, 0x06, 0x5a, 0x23,
+    0xb1, 0x2e, 0xf6, 0x01, 0xac, 0x71, 0xb9, 0x20, 0xb4, 0xef, 0x1d, 0x42, 0x7e, 0x0e, 0x01, 0x1d,
+    0xaf, 0x0a, 0x13, 0x04, 0x8e, 0x03, 0x4d, 0x1e, 0xc4, 0xe0,
+};
+
+inline constexpr std::array<std::uint8_t, 378> HevcCroppedStream{
+    0x00, 0x00, 0x00, 0x01, 0x40, 0x01, 0x0c, 0x01, 0xff, 0xff, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00,
+    0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03, 0x00, 0x1e, 0x95, 0x98, 0x09, 0x00, 0x00, 0x00, 0x01,
+    0x42, 0x01, 0x01, 0x01, 0x60, 0x00, 0x00, 0x03, 0x00, 0x90, 0x00, 0x00, 0x03, 0x00, 0x00, 0x03,
+    0x00, 0x1e, 0xa0, 0x20, 0x82, 0x9f, 0x79, 0x65, 0x66, 0xab, 0xca, 0xf0, 0x16, 0x80, 0x80, 0x00,
+    0x00, 0x03, 0x00, 0x80, 0x00, 0x00, 0x0f, 0x04, 0x00, 0x00, 0x00, 0x01, 0x44, 0x01, 0xc1, 0x73,
+    0xd1, 0x89, 0x00, 0x00, 0x01, 0x28, 0x01, 0xaf, 0x08, 0x59, 0xf2, 0xec, 0x80, 0xf9, 0x31, 0xa3,
+    0xfa, 0x90, 0xca, 0x97, 0x42, 0xb5, 0x6f, 0xcb, 0xc8, 0xd2, 0x51, 0xa2, 0x3f, 0xe0, 0x0d, 0x82,
+    0x6f, 0x1f, 0x37, 0xd4, 0x65, 0x18, 0x78, 0x60, 0x51, 0x3b, 0x98, 0xd0, 0x44, 0xfa, 0xff, 0x0b,
+    0xd5, 0xdc, 0x09, 0xea, 0xf7, 0x79, 0xb4, 0xd2, 0xbc, 0x97, 0x53, 0xf2, 0x7d, 0x10, 0x5c, 0xc8,
+    0x3a, 0xe0, 0xa7, 0xd8, 0xe2, 0xfc, 0x1d, 0x80, 0x09, 0xcd, 0x31, 0x09, 0xa4, 0xa9, 0x05, 0x5d,
+    0x08, 0x74, 0x50, 0xf5, 0xbe, 0xf9, 0xc8, 0xa6, 0xef, 0xe4, 0xff, 0xd6, 0x86, 0x02, 0xb6, 0xa2,
+    0x3f, 0x73, 0x80, 0xdb, 0x4e, 0x76, 0xa8, 0xc7, 0xac, 0x4b, 0x5b, 0xbf, 0xe1, 0x88, 0x18, 0xce,
+    0x14, 0x5e, 0xf4, 0xb3, 0x57, 0xe6, 0x83, 0xe1, 0x94, 0x8f, 0x55, 0x77, 0xbb, 0x1c, 0x77, 0xd3,
+    0x9e, 0xdc, 0xd5, 0x8a, 0x61, 0xb2, 0xf4, 0x77, 0xb8, 0xd1, 0x27, 0x5c, 0x41, 0x75, 0x0a, 0x82,
+    0xf5, 0xe8, 0x32, 0x45, 0xae, 0x94, 0x07, 0xcb, 0xde, 0x35, 0x53, 0x3c, 0x0d, 0xf6, 0x5d, 0x1f,
+    0x97, 0x0b, 0x04, 0x90, 0x4b, 0xd3, 0xf6, 0x04, 0x58, 0x26, 0xe2, 0x08, 0xe5, 0xb3, 0xa3, 0x05,
+    0x5a, 0x8f, 0x6b, 0x03, 0x4b, 0x0a, 0xd4, 0x63, 0x9d, 0x2e, 0xe2, 0x19, 0xa3, 0xde, 0xb5, 0x53,
+    0xf2, 0x07, 0xdc, 0xc8, 0xda, 0x2c, 0xfa, 0x2e, 0x62, 0x39, 0xf3, 0xfa, 0x2a, 0x77, 0xc2, 0xb9,
+    0x76, 0x63, 0x58, 0xd3, 0xf8, 0xa6, 0xcb, 0x2b, 0xa4, 0xa8, 0xc8, 0x4a, 0xed, 0xbe, 0x8e, 0xf0,
+    0xc9, 0x12, 0xf4, 0xb2, 0x91, 0xad, 0xd2, 0x18, 0xcc, 0x0c, 0x4d, 0x56, 0xd9, 0xa3, 0x09, 0x6c,
+    0x01, 0x3a, 0xa4, 0xa5, 0x10, 0x98, 0x4d, 0x85, 0x92, 0xa2, 0xfa, 0x50, 0xfe, 0x2d, 0x42, 0xab,
+    0xf3, 0x98, 0xe7, 0x16, 0xf1, 0x0b, 0xac, 0x74, 0x5d, 0xcd, 0xfa, 0xe3, 0x75, 0xf3, 0x66, 0x1e,
+    0xf0, 0xa3, 0xad, 0x82, 0x8e, 0x25, 0x2c, 0x8f, 0xe1, 0xac, 0xcb, 0xca, 0x0b, 0x19, 0x32, 0x83,
+    0x4a, 0xfd, 0x30, 0xc4, 0xe5, 0x97, 0x73, 0xfd, 0x43, 0xd0,
+};
+
+inline constexpr std::array<std::uint64_t, 6> HevcHashes{
+    0x7291c31ee57c5065ull, 0x37b15adc47810098ull, 0xc84737b65a65b247ull,
+    0xe39bc891f8286267ull, 0x734caf1ba961b3c2ull, 0x7deb44bd1ed30531ull,
+};
+
+inline std::vector<std::vector<std::uint8_t>> hevcUnits(const std::uint8_t* stream, std::size_t size) {
+    std::vector<std::size_t> starts;
+    for (std::size_t index = 0; index + 4 < size; ++index) {
+        if (stream[index] == 0 && stream[index + 1] == 0 && stream[index + 2] == 0 && stream[index + 3] == 1 && ((stream[index + 4] >> 1u) & 0x3fu) == 35) starts.push_back(index);
+    }
+    starts.push_back(size);
+    std::vector<std::vector<std::uint8_t>> units;
+    for (std::size_t unit = 0; unit + 1 < starts.size(); ++unit) units.emplace_back(stream + starts[unit], stream + starts[unit + 1]);
+    return units;
+}
+
+}
diff --git a/core/libs/tests/IrDumpMemory.cpp b/core/libs/tests/IrDumpMemory.cpp
new file mode 100644
index 0000000000..e68b9567f0
--- /dev/null
+++ b/core/libs/tests/IrDumpMemory.cpp
@@ -0,0 +1,96 @@
+#include "Translation/TranslationContext.hpp"
+#include "RdnaDecoder/RdnaMemoryOpDecoder.hpp"
+#include <array>
+#include <cstdio>
+#include <initializer_list>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+using namespace ShaderRecompiler;
+
+static void Require(bool value, const std::string& message) {
+    if (!value) throw std::runtime_error(message);
+}
+
+static RdnaInstruction Smem(std::uint32_t pc, std::uint32_t opcode, std::uint32_t destination, std::uint32_t base, std::uint32_t offset) {
+    const std::array<std::uint32_t, 2> code{(0x3du << 26u) | (opcode << 18u) | (destination << 6u) | (base / 2u), (125u << 25u) | offset};
+    return DecodeRdnaSmem(pc, code, 0u);
+}
+
+static RdnaInstruction Ds(std::uint32_t pc, std::uint32_t opcode, std::uint32_t offset0, std::uint32_t offset1, std::uint32_t address, std::uint32_t destination) {
+    const std::array<std::uint32_t, 2> code{(0x36u << 26u) | (opcode << 18u) | (offset1 << 8u) | offset0, (destination << 24u) | address};
+    return DecodeRdnaDs(pc, code, 0u);
+}
+
+static void Translate(IrProgram& program, std::initializer_list<RdnaInstruction> instructions) {
+    auto& block = program.CreateBlock();
+    program.SetEntryBlock(block);
+    program.BlockOrder() = {&block};
+    program.Metadata().blockInfo.resize(1);
+    TranslationContext context(program, block, 256);
+    for (const auto& instruction : instructions) {
+        context.TranslateInstruction(instruction);
+    }
+}
+
+static std::vector<std::string> Lines(const std::string& dump, const std::string& opcode) {
+    std::vector<std::string> lines;
+    std::istringstream stream(dump);
+    for (std::string line; std::getline(stream, line);) {
+        if (line.find(" " + opcode + " ") != std::string::npos) lines.push_back(line);
+    }
+    return lines;
+}
+
+static void RequireLines(const std::string& dump, const std::string& opcode, std::initializer_list<const char*> suffixes) {
+    const auto lines = Lines(dump, opcode);
+    Require(lines.size() == suffixes.size(), dump + "\nexpected " + std::to_string(suffixes.size()) + " " + opcode + " lines, found " + std::to_string(lines.size()));
+    std::size_t index = 0;
+    for (const std::string suffix : suffixes) {
+        const auto& line = lines[index++];
+        Require(line.size() >= suffix.size() && line.compare(line.size() - suffix.size(), suffix.size(), suffix) == 0, dump + "\nexpected \"" + line + "\" to end with \"" + suffix + "\"");
+    }
+}
+
+static void CheckOffsets() {
+    IrProgram program;
+    Translate(program, {
+        Smem(0x12de0u, 0x00u, 4u, 0u, 0x54u),
+        Smem(0x12de8u, 0x0au, 12u, 8u, 0x60u),
+        Ds(0x12df0u, 0x37u, 3u, 9u, 1u, 2u),
+    });
+    const auto dump = ProgramToString(program);
+    RequireLines(dump, "LoadAddressU32", {" [pc=0x00012de0 off=0x54]"});
+    RequireLines(dump, "ReadConstBuffer", {" [pc=0x00012de8 off=0x60]", " [pc=0x00012de8 off=0x64]", " [pc=0x00012de8 off=0x68]", " [pc=0x00012de8 off=0x6c]"});
+    RequireLines(dump, "LoadSharedU32", {" [pc=0x00012df0 off=0xc]", " [pc=0x00012df0 off=0x24]"});
+    Require(dump.find("  %1 = GetScalarRegister s0 (U32; uses=1)\n") != std::string::npos, dump + "\nexpected register reads without memory fields");
+}
+
+static void CheckMissingMemoryInfo() {
+    IrProgram program;
+    Translate(program, {Smem(0x40u, 0x00u, 4u, 0u, 0x54u)});
+    program.Resources().memoryInfo.clear();
+    const auto dump = ProgramToString(program);
+    RequireLines(dump, "LoadAddressU32", {" [pc=0x00000040 mem=?]"});
+    bool rejected = false;
+    try {
+        ValidateProgram(program, false);
+    } catch (const std::runtime_error& error) {
+        rejected = std::string(error.what()) == "LoadAddressU32 has an invalid memory-info index";
+        Require(rejected, std::string("unexpected validation failure: ") + error.what());
+    }
+    Require(rejected, "validation accepted a memory instruction without memory info");
+}
+
+int main() {
+    try {
+        CheckOffsets();
+        CheckMissingMemoryInfo();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "%s\n", error.what());
+        return 1;
+    }
+    return 0;
+}
diff --git a/core/libs/tests/JobManagerComputeProgress.cpp b/core/libs/tests/JobManagerComputeProgress.cpp
new file mode 100644
index 0000000000..fb0d90da1c
--- /dev/null
+++ b/core/libs/tests/JobManagerComputeProgress.cpp
@@ -0,0 +1,27 @@
+#include "prx/libSceJobManager/ComputeProgress.hpp"
+#include <cstdint>
+#include <iostream>
+#include <stdexcept>
+
+int main() {
+    try {
+        JobManager::ComputeProgress progress;
+        if (progress.Publish(0xfffffffd) != 0xfffffffd || progress.Collect(0xfffffffc) != 0xfffffffc)
+            throw std::runtime_error("partial retirement before wrap failed");
+        if (progress.Publish(5) != 2 || progress.Collect(2) != 6 || progress.Collect(2) != 0)
+            throw std::runtime_error("batched completion across wrap failed");
+        if (progress.Publish(9) != 11 || progress.Collect(5) != 3 || progress.Collect(11) != 6)
+            throw std::runtime_error("partial retirement after wrap failed");
+        bool rejected = false;
+        try {
+            progress.Collect(12);
+        } catch (const std::runtime_error&) {
+            rejected = true;
+        }
+        if (!rejected || progress.Collect(11) != 0) throw std::runtime_error("an invalid completion changed retirement state");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/libs/tests/JobManagerReference.cpp b/core/libs/tests/JobManagerReference.cpp
new file mode 100644
index 0000000000..690f118f53
--- /dev/null
+++ b/core/libs/tests/JobManagerReference.cpp
@@ -0,0 +1,78 @@
+#include "prx/libSceJobManager/include/Api.hpp"
+#include "SceTypes.hpp"
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <windows.h>
+
+struct SequenceFactory;
+
+int RunJobManagerCase(const char* name);
+
+template <typename T>
+static T Resolve(const char* nid) {
+    const bool host = std::getenv("ANYPS5_JOB_MANAGER_HOST") != nullptr;
+    const char* library = host ? "libSceJobManager.prx" : "libSceJobManager.prx.guest.prx";
+    HMODULE module = GetModuleHandleA(library);
+    if (module == nullptr && host) module = LoadLibraryA("libs\\libSceJobManager.prx");
+    const FARPROC symbol = module != nullptr ? GetProcAddress(module, nid) : nullptr;
+    if (symbol == nullptr) {
+        std::fprintf(stderr, "JobManager reference: missing %s in %s (Windows error %lu)\n", nid, library, GetLastError());
+        std::exit(3);
+    }
+    return reinterpret_cast<T>(symbol);
+}
+
+extern "C" {
+
+void APS5_VABI _ZN3sce3Job10JobManagerC1Ev(void* self) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManagerC1Ev)>("cwMzzdesLlY");
+    call(self);
+}
+
+void APS5_VABI _ZN3sce3Job10JobManagerD1Ev(void* self) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManagerD1Ev)>("4g1ee34TMH8");
+    call(self);
+}
+
+std::uint64_t APS5_VABI _ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE(const MemorySizeQueryParams* query) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager27calculateRequiredMemorySizeEPKNS1_21MemorySizeQueryParamsE)>("Nm2BhAwYNFk");
+    return call(query);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, std::uint32_t computeSequences, std::uint64_t mask, const ConfigParams* config) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager10initializeEPvmjjjmPKNS1_12ConfigParamsE)>("GS9DSbzC+MY");
+    return call(self, memory, size, workers, sequences, computeSequences, mask, config);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE(void* self, void* memory, std::uint64_t size, std::uint32_t workers, std::uint32_t sequences, const ConfigParams* config) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager10initializeEPvmjjPKNS1_12ConfigParamsE)>("d205iUFMyyE");
+    return call(self, memory, size, workers, sequences, config);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager8shutdownEv(void* self) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager8shutdownEv)>("chxnvsxxfBY");
+    return call(self);
+}
+
+SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager27getSequenceFactoryInterfaceENS1_8PriorityE)>("W-yXgQmaozU");
+    return call(self, priority);
+}
+
+SequenceFactory* APS5_VABI _ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE(void* self, std::uint32_t priority) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager34getUnifiedSequenceFactoryInterfaceENS1_8PriorityE)>("L5jTAtk3HKA");
+    return call(self, priority);
+}
+
+int APS5_VABI _ZN3sce3Job10JobManager24setPersistentThreadCountEj(void* self, std::uint32_t count) {
+    static const auto call = Resolve<decltype(&_ZN3sce3Job10JobManager24setPersistentThreadCountEj)>("VTKezfYu-v4");
+    return call(self, count);
+}
+
+int APS5_VABI Run_nid_no_patch() {
+    const char* name = std::getenv("ANYPS5_JOB_MANAGER_CASE");
+    return name != nullptr ? RunJobManagerCase(name) : 2;
+}
+
+}
diff --git a/core/libs/tests/JsonCopyFailure.cpp b/core/libs/tests/JsonCopyFailure.cpp
index 6f95b142e3..9ca2af1239 100644
--- a/core/libs/tests/JsonCopyFailure.cpp
+++ b/core/libs/tests/JsonCopyFailure.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceJson2/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdint>
@@ -5,58 +6,10 @@
 #include <cstdlib>
 #include <cstring>
 #include <new>
+#include <type_traits>
 #include <initializer_list>
 
-struct Value { void* node; };
-struct String { void* text; };
-struct Array { void* items; };
-struct Object { void* items; };
-struct Iterator { void* state; };
-struct Pair { String key; std::uint64_t reserved; Value value; };
-
-extern "C" {
-Iterator* APS5_VABI _ZNK3sce4Json5Array5beginEv(Iterator*, const Array*);
-Iterator* APS5_VABI _ZNK3sce4Json6Object5beginEv(Iterator*, const Object*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorC1ERKS2_(Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorC1ERKS2_(Iterator*, const Iterator*);
-void APS5_VABI _ZN3sce4Json5Array8iteratorD1Ev(Iterator*);
-void APS5_VABI _ZN3sce4Json6Object8iteratorD1Ev(Iterator*);
-void APS5_VABI _ZN3sce4Json5Value4swapERS1_(Value*, Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1Ev(Value*);
-void APS5_VABI _ZN3sce4Json5ValueC1EPKc(Value*, const char*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6StringE(Value*, const String*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_5ArrayE(Value*, const Array*);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(Value*, const Object*);
-void APS5_VABI _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(Value*, std::int32_t);
-void APS5_VABI _ZN3sce4Json5ValueC1ERKS1_(Value*, const Value*);
-void APS5_VABI _ZN3sce4Json5ValueD1Ev(Value*);
-Value* APS5_VABI _ZN3sce4Json5ValueaSERKS1_(Value*, const Value*);
-int APS5_VABI _ZN3sce4Json5Value3setERKNS0_5ArrayE(Value*, const Array*);
-int APS5_VABI _ZN3sce4Json5Value3setERKNS0_6ObjectE(Value*, const Object*);
-int APS5_VABI _ZN3sce4Json5Value3setENS0_9ValueTypeE(Value*, std::int32_t);
-std::int32_t APS5_VABI _ZNK3sce4Json5Value7getTypeEv(const Value*);
-const Array* APS5_VABI _ZNK3sce4Json5Value8getArrayEv(const Value*);
-const Object* APS5_VABI _ZNK3sce4Json5Value9getObjectEv(const Value*);
-int APS5_VABI _ZN3sce4Json5Value9serializeERNS0_6StringE(Value*, String*);
-int APS5_VABI _ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(Value*, const char*, std::size_t);
-void APS5_VABI _ZN3sce4Json6StringC1Ev(String*);
-void APS5_VABI _ZN3sce4Json6StringC1EPKc(String*, const char*);
-void APS5_VABI _ZN3sce4Json6StringD1Ev(String*);
-const char* APS5_VABI _ZNK3sce4Json6String5c_strEv(const String*);
-void APS5_VABI _ZN3sce4Json5ArrayC1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5ArrayC1ERKS1_(Array*, const Array*);
-void APS5_VABI _ZN3sce4Json5ArrayD1Ev(Array*);
-void APS5_VABI _ZN3sce4Json5Array9push_backERKNS0_5ValueE(Array*, const Value*);
-std::size_t APS5_VABI _ZNK3sce4Json5Array4sizeEv(const Array*);
-const Value* APS5_VABI _ZNK3sce4Json5Array5frontEv(const Array*);
-void APS5_VABI _ZN3sce4Json6ObjectC1Ev(Object*);
-void APS5_VABI _ZN3sce4Json6ObjectC1ERKS1_(Object*, const Object*);
-void APS5_VABI _ZN3sce4Json6ObjectD1Ev(Object*);
-Object* APS5_VABI _ZN3sce4Json6ObjectaSERKS1_(Object*, const Object*);
-std::size_t APS5_VABI _ZNK3sce4Json6Object4sizeEv(const Object*);
-void APS5_VABI _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(Pair*, const String*, const Value*);
-void APS5_VABI _ZN3sce4Json6Object4PairD1Ev(Pair*);
-}
+using namespace SceJson2;
 
 static std::ptrdiff_t allocationBudget = -1;
 static std::size_t liveAllocations = 0;
@@ -95,9 +48,11 @@ static void Require(bool condition, const char* message) {
 static void CheckValue(const Value& value, const char* expected) {
     String output{};
     _ZN3sce4Json6StringC1Ev(&output);
+
     Require(_ZN3sce4Json5Value9serializeERNS0_6StringE(const_cast<Value*>(&value), &output) == 0, "serialization failed");
     Require(std::strcmp(_ZNK3sce4Json6String5c_strEv(&output), expected) == 0, "value changed");
     _ZN3sce4Json6StringD1Ev(&output);
+
 }
 
 enum class Operation {
@@ -115,6 +70,7 @@ static bool Run(Operation operation, const Value& source, const char* expected,
     const bool typeSetter = operation == Operation::SetTypeArray || operation == Operation::SetTypeObject || operation == Operation::SetTypeString;
     if (operation == Operation::ValueAssign || operation == Operation::SetArray || operation == Operation::SetObject || typeSetter) {
         _ZN3sce4Json5ValueC1EPKc(&result, "previous");
+
         valueReady = true;
     }
     if (operation == Operation::ArrayAppend) { _ZN3sce4Json5ArrayC1Ev(&arrayResult); arrayReady = true; }
@@ -133,14 +89,14 @@ static bool Run(Operation operation, const Value& source, const char* expected,
             case Operation::ValueObject: _ZN3sce4Json5ValueC1ERKNS0_6ObjectE(&result, &object); valueReady = true; break;
             case Operation::ValueString: _ZN3sce4Json5ValueC1ERKNS0_6StringE(&result, &text); valueReady = true; break;
             case Operation::ValueText: _ZN3sce4Json5ValueC1EPKc(&result, _ZNK3sce4Json6String5c_strEv(&text)); valueReady = true; break;
-            case Operation::ValueTypeString: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, 5); valueReady = true; break;
-            case Operation::ValueTypeArray: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, 6); valueReady = true; break;
-            case Operation::ValueTypeObject: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, 7); valueReady = true; break;
+            case Operation::ValueTypeString: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, static_cast<ValueType>(5)); valueReady = true; break;
+            case Operation::ValueTypeArray: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, static_cast<ValueType>(6)); valueReady = true; break;
+            case Operation::ValueTypeObject: _ZN3sce4Json5ValueC1ENS0_9ValueTypeE(&result, static_cast<ValueType>(7)); valueReady = true; break;
             case Operation::SetArray: _ZN3sce4Json5Value3setERKNS0_5ArrayE(&result, &array); break;
             case Operation::SetObject: _ZN3sce4Json5Value3setERKNS0_6ObjectE(&result, &object); break;
-            case Operation::SetTypeArray: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, 6); break;
-            case Operation::SetTypeObject: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, 7); break;
-            case Operation::SetTypeString: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, 5); break;
+            case Operation::SetTypeArray: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, static_cast<ValueType>(6)); break;
+            case Operation::SetTypeObject: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, static_cast<ValueType>(7)); break;
+            case Operation::SetTypeString: _ZN3sce4Json5Value3setENS0_9ValueTypeE(&result, static_cast<ValueType>(5)); break;
             case Operation::PairCopy: _ZN3sce4Json6Object4PairC1ERKNS0_6StringERKNS0_5ValueE(&pair, &text, &source); pairReady = true; break;
         }
         succeeded = true;
@@ -154,16 +110,19 @@ static bool Run(Operation operation, const Value& source, const char* expected,
             CheckValue(result, "\"previous\"");
         }
         _ZN3sce4Json5ValueD1Ev(&result);
+
     }
     if (arrayReady) {
         const auto count = _ZNK3sce4Json5Array4sizeEv(&arrayResult);
         Require(count == (succeeded ? (operation == Operation::ArrayAppend ? 1 : 3) : 0), "array contents changed");
         if (succeeded && operation == Operation::ArrayAppend) CheckValue(*_ZNK3sce4Json5Array5frontEv(&arrayResult), expected);
         _ZN3sce4Json5ArrayD1Ev(&arrayResult);
+
     }
     if (objectReady) {
         Require(_ZNK3sce4Json6Object4sizeEv(&objectResult) == (succeeded ? 2 : 0), "object contents changed");
         _ZN3sce4Json6ObjectD1Ev(&objectResult);
+
     }
     if (pairReady) { CheckValue(pair.value, expected); _ZN3sce4Json6Object4PairD1Ev(&pair); }
     return succeeded;
@@ -178,9 +137,11 @@ int main() {
     String text{};
     _ZN3sce4Json5ValueC1Ev(&objectValue);
     _ZN3sce4Json5ValueC1Ev(&arrayValue);
+
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&objectValue, objectJson, std::strlen(objectJson)) == 0, "prepare object");
     Require(_ZN3sce4Json6Parser5parseERNS0_5ValueEPKcm(&arrayValue, arrayJson, std::strlen(arrayJson)) == 0, "prepare array");
     _ZN3sce4Json6StringC1EPKc(&text, "a sufficiently long string to require its own allocation");
+
     const auto* array = _ZNK3sce4Json5Value8getArrayEv(&arrayValue);
     const auto* object = _ZNK3sce4Json5Value9getObjectEv(&objectValue);
     struct Case { const char* name; Operation operation; const Value* source; const char* expected; };
@@ -221,18 +182,20 @@ int main() {
         }
         Require(succeeded, "copy never succeeded");
     }
-    for (bool objectIterator : {false, true}) {
+    const auto checkIterator = [&]<bool TObject>() {
+        constexpr bool objectIterator = TObject;
+        using TIterator = std::conditional_t<TObject, ObjectIterator, ArrayIterator>;
         activeCase = objectIterator ? "object iterator copy" : "array iterator copy";
         const auto before = liveAllocations;
-        Iterator source{};
-        if (objectIterator) _ZNK3sce4Json6Object5beginEv(&source, object);
+        TIterator source{};
+        if constexpr (objectIterator) _ZNK3sce4Json6Object5beginEv(&source, object);
         else _ZNK3sce4Json5Array5beginEv(&source, array);
         for (activeBudget = 0; activeBudget <= 1; ++activeBudget) {
-            Iterator copy{};
+            TIterator copy{};
             bool succeeded = false;
             allocationBudget = activeBudget;
             try {
-                if (objectIterator) _ZN3sce4Json6Object8iteratorC1ERKS2_(&copy, &source);
+                if constexpr (objectIterator) _ZN3sce4Json6Object8iteratorC1ERKS2_(&copy, &source);
                 else _ZN3sce4Json5Array8iteratorC1ERKS2_(&copy, &source);
                 succeeded = true;
             } catch (const std::bad_alloc&) {
@@ -241,13 +204,15 @@ int main() {
             allocationBudget = -1;
             Require(succeeded == (activeBudget == 1), "iterator allocation failure ignored");
             if (succeeded) Require(copy.state != source.state, "iterator copy shares owned storage");
-            if (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&copy);
+            if constexpr (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&copy);
             else _ZN3sce4Json5Array8iteratorD1Ev(&copy);
         }
-        if (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&source);
+        if constexpr (objectIterator) _ZN3sce4Json6Object8iteratorD1Ev(&source);
         else _ZN3sce4Json5Array8iteratorD1Ev(&source);
         Require(liveAllocations == before, "iterator copy leaked allocations");
-    }
+    };
+    checkIterator.operator()<false>();
+    checkIterator.operator()<true>();
     activeCase = "value swap";
     bool swapSucceeded = false;
     for (activeBudget = 0; activeBudget < 256 && !swapSucceeded; ++activeBudget) {
@@ -255,9 +220,11 @@ int main() {
         Value first{}, second{};
         _ZN3sce4Json5ValueC1ERKS1_(&first, &objectValue);
         _ZN3sce4Json5ValueC1ERKS1_(&second, &arrayValue);
+
         allocationBudget = activeBudget;
         try {
             _ZN3sce4Json5Value4swapERS1_(&first, &second);
+
             swapSucceeded = true;
         } catch (const std::bad_alloc&) {
             ++failures;
@@ -269,6 +236,7 @@ int main() {
         }
         _ZN3sce4Json5ValueD1Ev(&first);
         _ZN3sce4Json5ValueD1Ev(&second);
+
         Require(liveAllocations == before, "swap leaked allocations");
         CheckValue(objectValue, objectJson);
         CheckValue(arrayValue, arrayJson);
@@ -277,6 +245,7 @@ int main() {
     _ZN3sce4Json6StringD1Ev(&text);
     _ZN3sce4Json5ValueD1Ev(&arrayValue);
     _ZN3sce4Json5ValueD1Ev(&objectValue);
+
     Require(liveAllocations == initial, "source cleanup leaked allocations");
     std::printf("JSON copy cleanup: %zu operations, %u allocation failures, no leaks\n", sizeof(cases) / sizeof(cases[0]) + 3, failures);
 }
diff --git a/core/libs/tests/KernelError.cpp b/core/libs/tests/KernelError.cpp
index 9355bd4b64..52c41c28db 100644
--- a/core/libs/tests/KernelError.cpp
+++ b/core/libs/tests/KernelError.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include "prx/libkernel/KernelErrors.hpp"
 #include <array>
@@ -6,9 +8,6 @@
 #include <stdexcept>
 #include <utility>
 
-extern "C" std::int32_t APS5_VABI sceKernelError(std::int32_t);
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 static void Require(bool value) { if (!value) throw std::runtime_error("Kernel error conversion check failed"); }
 
 int main() {
diff --git a/core/libs/tests/Mspace.cpp b/core/libs/tests/Mspace.cpp
index 0741744299..a50f82f104 100644
--- a/core/libs/tests/Mspace.cpp
+++ b/core/libs/tests/Mspace.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <cstdint>
@@ -8,42 +9,6 @@
 #include <stdexcept>
 #include <thread>
 
-extern "C" {
-int* APS5_VABI __error_nid_postfix();
-void* APS5_VABI sceLibcMspaceCreate_nid_postfix(const char*, void*, std::size_t, unsigned);
-int APS5_VABI sceLibcMspaceDestroy_nid_postfix(void*);
-void* APS5_VABI sceLibcMspaceMalloc_nid_postfix(void*, std::size_t);
-void* APS5_VABI sceLibcMspaceCalloc_nid_postfix(void*, std::size_t, std::size_t);
-void* APS5_VABI sceLibcMspaceRealloc_nid_postfix(void*, void*, std::size_t);
-void APS5_VABI sceLibcMspaceFree_nid_postfix(void*, void*);
-int APS5_VABI sceLibcMspacePosixMemalign_nid_postfix(void*, void**, std::size_t, std::size_t);
-std::size_t APS5_VABI sceLibcMspaceMallocUsableSize_nid_postfix(const void*);
-void* APS5_VABI sceLibcMspaceMemalign_nid_postfix(void*, std::size_t, std::size_t);
-void* APS5_VABI sceLibcMspaceAlignedAlloc_nid_postfix(void*, std::size_t, std::size_t);
-void* APS5_VABI sceLibcMspaceReallocalign_nid_postfix(void*, void*, std::size_t, std::size_t);
-int APS5_VABI sceLibcMspaceMallocStats_nid_postfix(void*, void*);
-int APS5_VABI sceLibcMspaceMallocStatsFast_nid_postfix(void*, void*);
-void* APS5_VABI sceLibcPafMspaceCreate_nid_postfix(const char*, void*, std::size_t, unsigned, const void*);
-int APS5_VABI sceLibcPafMspaceDestroy_nid_postfix(void*);
-void* APS5_VABI sceLibcPafMspaceMalloc_nid_postfix(void*, std::size_t, const void*);
-void APS5_VABI sceLibcPafMspaceFree_nid_postfix(void*, void*, const void*);
-void* APS5_VABI sceLibcPafMspaceCalloc_nid_postfix(void*, std::size_t, std::size_t, const void*);
-void* APS5_VABI sceLibcPafMspaceRealloc_nid_postfix(void*, void*, std::size_t, const void*);
-void* APS5_VABI sceLibcPafMspaceReallocalign_nid_postfix(void*, void*, std::size_t, std::size_t, const void*);
-void* APS5_VABI sceLibcPafMspaceMemalign_nid_postfix(void*, std::size_t, std::size_t, const void*);
-int APS5_VABI sceLibcPafMspacePosixMemalign_nid_postfix(void*, void**, std::size_t, std::size_t, const void*);
-int APS5_VABI sceLibcPafMspaceMallocStats_nid_postfix(void*, void*);
-int APS5_VABI sceLibcPafMspaceMallocStatsFast_nid_postfix(void*, void*);
-}
-struct MallocManagedSize {
-    std::uint16_t size;
-    std::uint16_t version;
-    std::uint32_t reserved;
-    std::size_t maxSystemSize;
-    std::size_t currentSystemSize;
-    std::size_t maxInuseSize;
-    std::size_t currentInuseSize;
-};
 static void Require(bool value) {
     if (!value) { std::fputs("Mspace check failed\n", stderr); std::abort(); }
 }
@@ -87,6 +52,7 @@ static void CheckPaf() {
     sceLibcPafMspaceFree_nid_postfix(arena, aligned, &owner);
     sceLibcPafMspaceFree_nid_postfix(arena, posixAligned, &owner);
     sceLibcPafMspaceFree_nid_postfix(arena, nullptr, &owner);
+
     Require(sceLibcPafMspaceDestroy_nid_postfix(arena) == 0);
     Require(sceLibcPafMspaceDestroy_nid_postfix(arena) == -1);
 }
@@ -205,14 +171,17 @@ int main() {
     Require(sceLibcMspaceCalloc_nid_postfix(arena, std::numeric_limits<std::size_t>::max(), 2) == nullptr);
     sceLibcMspaceFree_nid_postfix(arena, blocker);
     sceLibcMspaceFree_nid_postfix(arena, aligned);
+
     Require(sceLibcMspaceRealloc_nid_postfix(arena, grown, 0) == nullptr);
     void* large = sceLibcMspaceMalloc_nid_postfix(arena, storage.size() - 256);
     Require(large != nullptr); // freeing coalesced all the fragmented blocks
     sceLibcMspaceFree_nid_postfix(arena, large);
+
     void* head = sceLibcMspaceMalloc_nid_postfix(arena, 64);
     Require(head != nullptr && sceLibcMspaceRealloc_nid_postfix(arena, head, 1024) == head);
     Require(sceLibcMspaceMallocUsableSize_nid_postfix(head) == 1024);
     sceLibcMspaceFree_nid_postfix(arena, head);
+
     std::array<void*, 2000> small{};
     for (auto& pointer : small) {
         pointer = sceLibcMspaceMalloc_nid_postfix(arena, 16);
@@ -224,6 +193,7 @@ int main() {
     large = sceLibcMspaceMalloc_nid_postfix(arena, storage.size() - 256);
     Require(large != nullptr);
     sceLibcMspaceFree_nid_postfix(arena, large);
+
     std::array<std::thread, 4> workers;
     for (auto& worker : workers) worker = std::thread([&] {
         for (int i = 0; i < 1000; ++i) {
@@ -232,6 +202,7 @@ int main() {
             std::memset(pointer, 42, 97);
             Require(sceLibcMspaceMallocUsableSize_nid_postfix(pointer) >= 97);
             sceLibcMspaceFree_nid_postfix(arena, pointer);
+
         }
     });
     for (auto& worker : workers) worker.join();
@@ -263,6 +234,7 @@ int main() {
     Require(rounded && (reinterpret_cast<std::uintptr_t>(rounded) & 127) == 0);
     Require(sceLibcMspaceMallocStatsFast_nid_postfix(arena, &stats) == 0 && stats.currentInuseSize >= 100);
     sceLibcMspaceFree_nid_postfix(arena, memaligned);
+
     void* region = sceLibcMspaceMalloc_nid_postfix(arena, 8192);
     Require(region != nullptr);
     Require(sceLibcMspaceCreate_nid_postfix("outside", static_cast<unsigned char*>(region) + 8192, 4096, 0) == nullptr);
@@ -274,6 +246,7 @@ int main() {
     Require(sceLibcMspaceCreate_nid_postfix("flags", storage.data(), storage.size(), 2) == nullptr);
     Require(sceLibcMspaceDestroy_nid_postfix(nested) == 0);
     sceLibcMspaceFree_nid_postfix(arena, region);
+
     Require(sceLibcMspaceDestroy_nid_postfix(arena) == 0);
     Require(sceLibcMspaceMalloc_nid_postfix(arena, 8) == nullptr);
     Require(sceLibcMspaceCreate_nid_postfix("reuse", storage.data(), storage.size(), 0) == arena);
diff --git a/core/libs/tests/NetDontWait.cpp b/core/libs/tests/NetDontWait.cpp
index 7507f2fde5..c91b7d0bb7 100644
--- a/core/libs/tests/NetDontWait.cpp
+++ b/core/libs/tests/NetDontWait.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libSceNet/include/Net.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -12,42 +14,6 @@
 #include <utility>
 #include <vector>
 
-struct NetIovec {
-    void* base;
-    std::uint64_t length;
-};
-
-struct NetMsghdr {
-    void* name;
-    std::uint32_t nameLength;
-    NetIovec* iov;
-    int iovLength;
-    void* control;
-    std::uint32_t controlLength;
-    int flags;
-};
-
-extern "C" {
-int APS5_VABI sceNetSocket(const char*, int, int, int);
-int APS5_VABI sceNetSocketClose(int);
-int APS5_VABI sceNetSocketAbort(int, int);
-int APS5_VABI sceNetBind_nid_postfix(int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockname(int, void*, std::uint32_t*);
-int APS5_VABI sceNetListen(int, int);
-int APS5_VABI sceNetConnect(int, const void*, std::uint32_t);
-int APS5_VABI sceNetAccept(int, void*, std::uint32_t*);
-int APS5_VABI sceNetSetsockopt(int, int, int, const void*, std::uint32_t);
-int APS5_VABI sceNetGetsockopt(int, int, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetSend(int, const void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetSendto(int, const void*, std::size_t, int, const void*, std::uint32_t);
-std::int64_t APS5_VABI sceNetSendmsg(int, const NetMsghdr*, int);
-std::int64_t APS5_VABI sceNetRecv(int, void*, std::size_t, int);
-std::int64_t APS5_VABI sceNetRecvfrom(int, void*, std::size_t, int, void*, std::uint32_t*);
-std::int64_t APS5_VABI sceNetRecvmsg(int, NetMsghdr*, int);
-int* APS5_VABI sceNetErrnoLoc();
-int APS5_VABI fcntl_nid_postfix(int, int, ...);
-}
-
 namespace {
 
 constexpr int DontWait = 0x80;
diff --git a/core/libs/tests/NetEmptyStream.cpp b/core/libs/tests/NetEmptyStream.cpp
new file mode 100644
index 0000000000..5757b2bdb1
--- /dev/null
+++ b/core/libs/tests/NetEmptyStream.cpp
@@ -0,0 +1,145 @@
+#include "prx/libSceNet/libSceNet.hpp"
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <future>
+#include <string_view>
+
+namespace {
+
+void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "empty stream: %s\n", message);
+    std::exit(1);
+}
+
+void SetOption(int descriptor, int option, int value) {
+    Require(sceNetSetsockopt(descriptor, 0xffff, option, &value, sizeof(value)) == 0, "set option");
+}
+
+struct Pair {
+    int sender;
+    int receiver;
+
+    explicit Pair(bool datagram) {
+        const int listener = sceNetSocket("empty-listener", 2, datagram ? 2 : 1, 0);
+        sender = sceNetSocket("empty-sender", 2, datagram ? 2 : 1, 0);
+        Require(listener >= 0 && sender >= 0, "create sockets");
+        std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+        Require(sceNetBind_nid_postfix(listener, address.data(), address.size()) == 0, "bind receiver");
+        std::uint32_t size = address.size();
+        Require(sceNetGetsockname(listener, address.data(), &size) == 0, "get receiver name");
+        if (!datagram) Require(sceNetListen(listener, 1) == 0, "listen");
+        Require(sceNetConnect(sender, address.data(), size) == 0, "connect sender");
+        if (datagram) receiver = listener;
+        else {
+            receiver = sceNetAccept(listener, nullptr, nullptr);
+            Require(receiver >= 0, "accept");
+            Require(sceNetSocketClose(listener) == 0, "close listener");
+        }
+        SetOption(receiver, 0x1106, 2000000);
+    }
+
+    ~Pair() {
+        Require(sceNetSocketClose(receiver) == 0 && sceNetSocketClose(sender) == 0, "close pair");
+    }
+
+    void Send() {
+        Require(sceNetSend(sender, "x", 1, 0) == 1, "send byte");
+    }
+};
+
+struct Result {
+    std::int64_t count;
+    int error;
+};
+
+Result Receive(std::string_view api, int descriptor, int flags, bool nullBuffer, bool datagram) {
+    char payload = 'p';
+    char control = 'c';
+    std::array<unsigned char, 16> address;
+    address.fill(0xaa);
+    std::uint32_t addressLength = address.size();
+    std::int64_t count;
+    if (api == "recv") count = sceNetRecv(descriptor, nullBuffer ? nullptr : &payload, 0, flags);
+    else if (api == "recvfrom")
+        count = sceNetRecvfrom(descriptor, nullBuffer ? nullptr : &payload, 0, flags, address.data(), &addressLength);
+    else {
+        NetIovec vector{&payload, 0};
+        NetMsghdr message{address.data(), addressLength, nullBuffer ? nullptr : &vector, nullBuffer ? 0 : 1, &control, 1, 0x4000};
+        count = sceNetRecvmsg(descriptor, &message, flags);
+        if (count >= 0) {
+            Require(message.control_length == 0, "control length is not zero");
+            Require(message.flags == (datagram ? 0x10 : 0), "unexpected output flags");
+            addressLength = message.name_length;
+        }
+    }
+    const int error = *sceNetErrnoLoc();
+    Require(payload == 'p' && control == 'c', "empty receive modified payload or control storage");
+    if (count >= 0 && api != "recv") {
+        Require(addressLength == (datagram ? 16u : 0u), "wrong sender length for an empty receive");
+        if (!datagram) Require(std::all_of(address.begin(), address.end(), [](unsigned char byte) { return byte == 0xaa; }),
+            "empty stream receive wrote a sender address");
+    }
+    return {count, error};
+}
+
+void Check(std::string_view api, std::string_view mode) {
+    const bool datagram = mode == "datagram";
+    Pair pair(datagram);
+    if (mode == "errors") {
+        auto result = Receive(api, -1, 0, false, false);
+        Require(result.count < 0 && result.error == 9, "invalid descriptor became an empty success");
+        result = Receive(api, pair.receiver, 1, false, false);
+        Require(result.count < 0 && result.error == 45, "unsupported flags became an empty success");
+        const int fresh = sceNetSocket("empty-unconnected", 2, 1, 0);
+        Require(fresh >= 0, "create unconnected socket");
+        result = Receive(api, fresh, 0, false, false);
+        std::fprintf(stderr, "unconnected result=%lld errno=%d\n", static_cast<long long>(result.count), result.error);
+        Require(result.count < 0 && result.error == 57, "fresh stream socket did not report ENOTCONN");
+        std::array<std::uint8_t, 16> address{16, 2, 0, 0, 127, 0, 0, 1};
+        Require(sceNetBind_nid_postfix(fresh, address.data(), address.size()) == 0, "bind unconnected socket");
+        result = Receive(api, fresh, 0, false, false);
+        Require(result.count < 0 && result.error == 57, "bound stream socket did not report ENOTCONN");
+        Require(sceNetListen(fresh, 1) == 0, "listen on unconnected socket");
+        result = Receive(api, fresh, 0, false, false);
+        Require(result.count < 0 && result.error == 57, "listening socket did not report ENOTCONN");
+        Require(sceNetSocketClose(fresh) == 0, "close unconnected socket");
+        return;
+    }
+    if (mode == "queued" || datagram) pair.Send();
+    if (mode == "nonblocking") SetOption(pair.receiver, 0x1200, 1);
+    const int flags = mode == "dontwait" ? 0x80 : mode == "peek" ? 0x82 : 0;
+    auto pending = std::async(std::launch::async, [&] { return Receive(api, pair.receiver, flags, mode == "nullbuf", datagram); });
+    const bool ready = pending.wait_for(std::chrono::milliseconds(500)) == std::future_status::ready;
+    if (!ready) {
+        pair.Send();
+        Require(pending.wait_for(std::chrono::seconds(2)) == std::future_status::ready, "cleanup receive did not finish");
+    }
+    const auto result = pending.get();
+    Require(ready, "zero-length receive waited for peer data");
+    Require(result.count == 0, "zero-length receive did not return zero");
+    if (mode == "queued") {
+        char byte = 0;
+        Require(sceNetRecv(pair.receiver, &byte, 1, 0) == 1 && byte == 'x', "empty stream receive consumed data");
+    }
+    if (datagram) {
+        char byte = 0;
+        Require(sceNetRecv(pair.receiver, &byte, 1, 0x80) < 0 && *sceNetErrnoLoc() == 35,
+            "zero-length datagram receive did not consume its packet");
+    }
+    std::printf("%.*s/%.*s: zero return, output sentinels and transport semantics preserved\n",
+        static_cast<int>(api.size()), api.data(), static_cast<int>(mode.size()), mode.data());
+}
+
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 3, "expected API and mode");
+    const std::string_view api(argv[1]);
+    Require(api == "recv" || api == "recvfrom" || api == "recvmsg", "unknown API");
+    Check(api, argv[2]);
+}
diff --git a/core/libs/tests/PthreadStart.cpp b/core/libs/tests/PthreadStart.cpp
index 8750d5eb5e..8dac3f063a 100644
--- a/core/libs/tests/PthreadStart.cpp
+++ b/core/libs/tests/PthreadStart.cpp
@@ -1,3 +1,5 @@
+#include "prx/libkernel/include/Api.hpp"
+#include "prx/libkernel/Pthread/include/ThreadLifecycle.hpp"
 #include "prx/libkernel/Pthread/include/Pthread.hpp"
 #include <future>
 #include <iostream>
@@ -6,17 +8,6 @@
 #include <windows.h>
 #endif
 
-extern "C" int APS5_VABI scePthreadCreate(Pthread* thread, const PthreadAttr* attr, PthreadEntry entry, void* arg, const char* name);
-extern "C" int APS5_VABI scePthreadJoin(Pthread thread, void** retval);
-extern "C" int APS5_VABI scePthreadAttrInit(PthreadAttr* attr);
-extern "C" int APS5_VABI scePthreadAttrDestroy(PthreadAttr* attr);
-extern "C" int APS5_VABI scePthreadAttrGet(Pthread thread, PthreadAttr* attr);
-extern "C" int APS5_VABI scePthreadAttrSetstacksize(PthreadAttr* attr, std::size_t size);
-extern "C" int APS5_VABI scePthreadAttrGetstack(const PthreadAttr* attr, void** address, std::size_t* size);
-extern "C" Pthread APS5_VABI scePthreadSelf();
-extern "C" void APS5_VABI scePthreadExit(void* retval);
-extern "C" int APS5_VABI scePthreadDetach(Pthread thread);
-
 struct ThreadContext {
     Pthread thread = nullptr;
     std::promise<void> checked;
diff --git a/core/libs/tests/SaveDataMemoryGrowth.cpp b/core/libs/tests/SaveDataMemoryGrowth.cpp
index 87d06e2a33..908bc48688 100644
--- a/core/libs/tests/SaveDataMemoryGrowth.cpp
+++ b/core/libs/tests/SaveDataMemoryGrowth.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
@@ -12,12 +13,6 @@
 #include <windows.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Save-data memory growth check failed at line %d\n", line);
diff --git a/core/libs/tests/SaveDataMemoryJournal.cpp b/core/libs/tests/SaveDataMemoryJournal.cpp
index e661a1fd1f..b1af602123 100644
--- a/core/libs/tests/SaveDataMemoryJournal.cpp
+++ b/core/libs/tests/SaveDataMemoryJournal.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <algorithm>
@@ -13,14 +14,6 @@
 #include <string>
 #include <vector>
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataGetSaveDataMemory2(SaveDataMemoryGet2*);
-int APS5_VABI sceSaveDataSetSaveDataMemory2(const SaveDataMemorySet2*);
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
-}
-
 static void Check(bool value, int line) {
     if (!value) {
         std::fprintf(stderr, "Save-data memory journal check failed at line %d\n", line);
diff --git a/core/libs/tests/SaveDataMemoryMetadata.cpp b/core/libs/tests/SaveDataMemoryMetadata.cpp
index b3acb20559..f498a26fef 100644
--- a/core/libs/tests/SaveDataMemoryMetadata.cpp
+++ b/core/libs/tests/SaveDataMemoryMetadata.cpp
@@ -1,3 +1,5 @@
+#include "prx/libSceSaveData/include/Api.hpp"
+#include "prx/libSceSaveData.native/include/Api.hpp"
 #include "SceTypes.hpp"
 #include <algorithm>
 #include <array>
@@ -25,16 +27,6 @@
 #include <sys/resource.h>
 #endif
 
-extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate();
-int APS5_VABI sceSaveDataCreateTransactionResource(std::uint32_t);
-int APS5_VABI sceSaveDataDeleteTransactionResource(std::int32_t);
-int APS5_VABI sceSaveDataSetSaveDataMemory2(const SaveDataMemorySet2*);
-int APS5_VABI sceSaveDataSyncSaveDataMemory(const void*);
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
-}
-
 namespace {
 constexpr int kSaveDataNotInitialized = -2137063423;
 }
diff --git a/core/libs/tests/SaveDataWriteReplacement.cpp b/core/libs/tests/SaveDataWriteReplacement.cpp
index e874060c9f..ef57bfe136 100644
--- a/core/libs/tests/SaveDataWriteReplacement.cpp
+++ b/core/libs/tests/SaveDataWriteReplacement.cpp
@@ -1,3 +1,4 @@
+#include "prx/libSceSaveData/include/Api.hpp"
 #include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 
@@ -13,11 +14,9 @@
 #include <vector>
 
 extern "C" {
-int APS5_VABI sceSaveDataInitialize3(const void*);
-int APS5_VABI sceSaveDataTerminate(void);
-int APS5_VABI sceSaveDataSetupSaveDataMemory2(const SaveDataMemorySetup2*, SaveDataMemorySetupResult*);
+
 #ifndef SAVEDATA_NATIVE_BACKEND
-int APS5_VABI sceSaveDataSyncSaveDataMemory(const void*);
+
 #endif
 }
 
diff --git a/core/libs/tests/ScalarCall.cpp b/core/libs/tests/ScalarCall.cpp
index c4d38b87c4..0faf175176 100644
--- a/core/libs/tests/ScalarCall.cpp
+++ b/core/libs/tests/ScalarCall.cpp
@@ -5,6 +5,7 @@
 #include "RdnaDecoder/RdnaMemoryOpDecoder.hpp"
 #include "ControlFlow/GraphBuilder.hpp"
 #include <array>
+#include <cstdint>
 #include <cstdio>
 #include <algorithm>
 #include <initializer_list>
@@ -12,6 +13,7 @@
 #include <span>
 #include <stdexcept>
 #include <string>
+#include <tuple>
 #include <vector>
 
 using namespace ShaderRecompiler;
@@ -43,6 +45,11 @@ static RdnaInstruction Sop1(std::uint32_t pc, std::uint32_t destination, std::ui
     return DecodeRdnaSop1(pc, code, 0u);
 }
 
+static RdnaInstruction Sop2(std::uint32_t pc, std::uint32_t destination, std::uint32_t op, std::uint32_t source0, std::uint32_t source1) {
+    const std::array<std::uint32_t, 1> code{0x80000000u | (op << 23u) | (destination << 16u) | (source1 << 8u) | source0};
+    return DecodeRdnaSop2(pc, code, 0u);
+}
+
 static RdnaInstruction Sopp(std::uint32_t pc, std::uint32_t op, std::uint32_t immediate = 0u) {
     const std::array<std::uint32_t, 1> code{0xbf800000u | (op << 16u) | immediate};
     return DecodeRdnaSopp(pc, code, 0u);
@@ -236,6 +243,21 @@ static void CheckTableCalls() {
     Require(table(10u, 0xbf810000u, 12u).empty());
     Require(table(5u, 0x28000008u).size() == 1u && table(5u, 0x28000008u)[0].entryOffset == 8u);
     Require(table(0u, 0xbe940380u).empty());
+    const auto slice = [&](std::uint32_t load, std::uint32_t bufferLoad) {
+        auto code = caller;
+        code[1] = load;
+        code[4] = bufferLoad;
+        return FindTableCalls(RdnaInstructionDecoder{}.Decode(code), swappc);
+    };
+    for (const auto& [load, bufferLoad, offset] : {std::tuple{0xf40c0606u, 0xf428020cu, 0x270u}, std::tuple{0xf40c0606u, 0xf428020eu, 0x280u}, std::tuple{0xf4100606u, 0xf4280210u, 0x290u}, std::tuple{0xf4100606u, 0xf4280212u, 0x2a0u}}) {
+        const auto sliced = slice(load, bufferLoad);
+        Require(sliced.size() == 1u && sliced[0].userDataRegister == 12u && sliced[0].descriptorOffset == offset && sliced[0].entryOffset == 0u && sliced[0].entryStride == 16u);
+    }
+    Require(slice(0xf40c0606u, 0xf4280210u).empty());
+    Require(slice(0xf40c0606u, 0xf428020du).empty());
+    Require(slice(0xf40c0686u, 0xf428020eu).empty());
+    Require(slice(0xf40c0686u, 0xf428020cu).empty());
+    Require(slice(0xf40c0586u, 0xf428020eu).empty());
     auto readsLane = caller;
     readsLane.insert(readsLane.begin(), {0xd4c2000bu, 0x00020300u});
     const auto readsLaneProgram = RdnaInstructionDecoder{}.Decode(readsLane);
@@ -255,27 +277,69 @@ static void CheckTableCalls() {
     const std::vector<std::vector<TableCallee>> callees{{{0x1122334455ull, first}, {0x66778899aaull, second}}};
     const auto linkedCalls = LinkCalls(program, {}, {}, calls, callees);
     const auto& linked = linkedCalls.code;
-    Require(linkedCalls.fallbacks == std::vector<std::uint32_t>{50u * 4u});
+    Require(linkedCalls.fallbacks == std::vector<std::uint32_t>{53u * 4u});
     ExpectThrow("is shared with another call", [&] { static_cast<void>(BuildCode(linked, swappc)); });
     SwappcInfo linkedSwappc = swappc;
     linkedSwappc.linkedCallFallbacks = linkedCalls.fallbacks;
-    Require(linked.size() == 59u && linked[9] == 0xbf820001u && linked[11] == 0xbf850010u && linked[58] == 0xbf9f0000u);
-    Require(linked[12] == 0xbf07ff0eu && linked[13] == 0x22334455u && linked[14] == 0xbf850004u && linked[15] == 0xbf07ff0fu && linked[16] == 0x11u && linked[17] == 0xbf850001u && linked[18] == 0xbf82001bu);
-    Require(linked[20] == 0x778899aau && linked[26] == 0xbf078080u && linked[27] == 0xbf820016u && linked[34] == 0xbf068080u && linked[35] == 0xbf82000au && linked[44] == 0xbf068080u && linked[45] == 0xbf820004u);
-    Require(linked[46] == 0xbb0e0005u && linked[47] == 0xbf82ffdau && linked[48] == 0xbb0e0006u && linked[49] == 0xbf82ffd8u && linked[50] == 0xbe8e210eu && linked[51] == 0xbf82ffd6u);
-    Require(std::equal(first.begin(), first.end(), linked.begin() + 52) && std::equal(second.begin(), second.end(), linked.begin() + 55));
+    Require(linked.size() == 56u && linked[9] == 0xbf820001u && linked[11] == 0xbf850007u && linked[55] == 0xbf9f0000u);
+    Require(linked[12] == 0xbf07ff0eu && linked[13] == 0x22334455u && linked[14] == 0xbf850010u && linked[15] == 0xbf07ff0fu && linked[16] == 0x11u && linked[17] == 0xbf85000du && linked[18] == 0xbf820007u);
+    Require(linked[19] == 0xbf07ff0eu && linked[21] == 0xbf850010u && linked[24] == 0xbf85000du && linked[25] == 0xbf068080u && linked[26] == 0xbb0e0001u && linked[27] == 0xbf82ffeeu);
+    Require(linked[32] == 0x778899aau && linked[33] == 0xbf850010u && linked[37] == 0xbf820007u && linked[40] == 0xbf85000bu && linked[43] == 0xbf850008u && linked[45] == 0xbb0e0001u && linked[46] == 0xbf82ffecu);
+    Require(linked[50] == 0xbf078080u && linked[51] == 0xbf820001u && linked[52] == 0xbf068080u && linked[53] == 0xbe8e210eu && linked[54] == 0xbf82fff7u);
+    Require(std::equal(first.begin(), first.end(), linked.begin() + 28) && std::equal(second.begin(), second.end(), linked.begin() + 47));
     const auto cfg = BuildCode(linked, linkedSwappc);
     const auto block = [&](std::uint32_t word) { return cfg.FindBlockByProgramCounter(word * 4u).id; };
-    Require(cfg.FindBlockByProgramCounter(46u * 4u).terminator.trueBlock == block(52u));
-    Require(cfg.FindBlockByProgramCounter(52u * 4u).terminator.trueBlock == block(47u));
-    Require(cfg.FindBlockByProgramCounter(48u * 4u).terminator.trueBlock == block(55u));
-    Require(cfg.FindBlockByProgramCounter(55u * 4u).terminator.trueBlock == block(49u));
-    Require(cfg.unlinkedCallProgramCounters == std::vector<std::uint32_t>{50u * 4u});
+    Require(cfg.FindBlockByProgramCounter(26u * 4u).terminator.trueBlock == block(28u));
+    Require(cfg.FindBlockByProgramCounter(28u * 4u).terminator.trueBlock == block(27u));
+    Require(cfg.FindBlockByProgramCounter(45u * 4u).terminator.trueBlock == block(47u));
+    Require(cfg.FindBlockByProgramCounter(47u * 4u).terminator.trueBlock == block(46u));
+    Require(cfg.unlinkedCallProgramCounters == std::vector<std::uint32_t>{53u * 4u});
     static_cast<void>(TranslateCode(linked, linkedSwappc));
 
-    std::vector<std::uint32_t> large(0x8000u, 0xbf800000u);
-    const std::vector<std::vector<TableCallee>> far{{{0x10ull, large}, {0x20ull, first}}};
-    ExpectThrow("out of s_call_b64 range", [&] { static_cast<void>(LinkCalls(program, {}, {}, calls, far)); });
+    std::vector<std::uint32_t> large(0x3000u, 0xbf800000u);
+    large.push_back(0xbe80200eu);
+    const std::vector<std::vector<TableCallee>> far{{{0x10ull, large}, {0x20ull, large}, {0x30ull, large}, {0x40ull, first}}};
+    const auto farLinked = LinkCalls(program, {}, {}, calls, far);
+    const auto farCall = 12u + 3u * (16u + 0x3001u) + 14u;
+    Require(farLinked.code[farCall] == 0xbb0e0001u && std::equal(first.begin(), first.end(), farLinked.code.begin() + farCall + 2u));
+    SwappcInfo farSwappc = swappc;
+    farSwappc.linkedCallFallbacks = farLinked.fallbacks;
+    const auto farCfg = BuildCode(farLinked.code, farSwappc);
+    Require(farCfg.FindBlockByProgramCounter(farCall * 4u).terminator.trueBlock == farCfg.FindBlockByProgramCounter((farCall + 2u) * 4u).id);
+    Require(farCfg.FindBlockByProgramCounter((farCall + 2u) * 4u).terminator.trueBlock == farCfg.FindBlockByProgramCounter((farCall + 1u) * 4u).id);
+    auto twoCallers = caller;
+    twoCallers.pop_back();
+    twoCallers.insert(twoCallers.end(), caller.begin(), caller.end());
+    const auto twoProgram = RdnaInstructionDecoder{}.Decode(twoCallers);
+    auto secondCall = calls[0];
+    secondCall.programCounter += 40u;
+    const std::array<TableCall, 2> twoCalls{calls[0], secondCall};
+    const std::vector<std::vector<TableCallee>> twoCallees{far[0], {{0x50ull, first}, {0x60ull, second}}};
+    const auto twoLinked = LinkCalls(twoProgram, {}, {}, twoCalls, twoCallees);
+    const auto& two = twoLinked.code;
+    const auto follow = [&](std::size_t word, std::size_t& hops) {
+        hops = 0;
+        while (two[word] >> 16u == 0xbf82u) {
+            word = static_cast<std::size_t>(static_cast<std::int64_t>(word) + 1 + static_cast<std::int16_t>(two[word] & 0xffffu));
+            ++hops;
+        }
+        return word;
+    };
+    std::size_t hops = 0;
+    Require(follow(9u, hops) == 23u && hops == 1u && two[21] >> 16u == 0xbf82u && two[22] >> 16u == 0xbf82u);
+    Require(follow(39u, hops) == 10u && hops == 1u);
+    const auto secondChain = follow(19u, hops);
+    Require(hops == 6u && two[secondChain] == 0xbf850007u && two[secondChain + 1u] == 0xbf07ff0eu && two[secondChain + 2u] == 0x50u);
+    Require(two[secondChain + 15u] == 0xbb0e0001u && std::equal(first.begin(), first.end(), two.begin() + static_cast<std::ptrdiff_t>(secondChain + 17u)));
+    Require(follow(secondChain + 16u, hops) == 20u && hops == 6u);
+    SwappcInfo twoSwappc = swappc;
+    twoSwappc.linkedCallFallbacks = twoLinked.fallbacks;
+    const auto twoCfg = BuildCode(two, twoSwappc);
+    Require(twoCfg.FindBlockByProgramCounter(static_cast<std::uint32_t>(secondChain + 15u) * 4u).terminator.trueBlock == twoCfg.FindBlockByProgramCounter(static_cast<std::uint32_t>(secondChain + 17u) * 4u).id);
+    Require(twoCfg.unlinkedCallProgramCounters.size() == 2u);
+    std::vector<std::uint32_t> oversized(0x8000u, 0xbf800000u);
+    const std::vector<std::vector<TableCallee>> overflows{{{0x10ull, oversized}, {0x20ull, first}}};
+    ExpectThrow("out of the 16-bit branch range", [&] { static_cast<void>(LinkCalls(program, {}, {}, calls, overflows)); });
 
     const std::vector<std::uint32_t> jumpTable{
         0xbe8c1f00u, 0x800cff0cu, 0x00000058u, 0x820d800du, 0x83928202u, 0xd4c40016u, 0x02000500u, 0x8f128212u, 0xf4000386u, 0x24000000u,
@@ -290,6 +354,10 @@ static void CheckTableCalls() {
     ExpectThrow("escapes the constant-offset call/return model", [] {
         Build({Sop1(0u, 0u, 3u, 8u), Call(4u, 8u, 2u), Sopp(8u, 2u, 0xfffdu), Sopp(12u, 1u), Sop1(16u, 0u, 0x20u, 8u)});
     });
+    static_cast<void>(Build({Call(0u, 8u, 3u), Sop2(4u, 8u, 0x15u, 0u, 2u), Sop2(8u, 10u, 0x1bu, 8u, 2u), Sopp(12u, 1u), Sop1(16u, 0u, 0x20u, 8u)}));
+    ExpectThrow("escapes the constant-offset call/return model", [] {
+        Build({Call(0u, 8u, 3u), Sop2(4u, 8u, 0x0eu, 0u, 2u), Sop2(8u, 10u, 0x1bu, 8u, 2u), Sopp(12u, 1u), Sop1(16u, 0u, 0x20u, 8u)});
+    });
 }
 
 enum class HoistedShape { InLoop, Hoisted, SecondWriterOnArm, LoadOnArmOnly, WriterAfterCall, WriterAfterLoop, CallOnArm, ConstantPointer, SkipsNullTarget, LongBranchWriter };
diff --git a/core/libs/tests/UnwindCallbackAbi.cpp b/core/libs/tests/UnwindCallbackAbi.cpp
index 18fb85df1d..c0fbcbbc2b 100644
--- a/core/libs/tests/UnwindCallbackAbi.cpp
+++ b/core/libs/tests/UnwindCallbackAbi.cpp
@@ -1,3 +1,5 @@
+#include "prx/libc/include/exceptions/Runtime.hpp"
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/exceptions/Unwind.hpp"
 
 #include <cstdint>
@@ -5,11 +7,6 @@
 #include <cstdlib>
 #include <string>
 
-extern "C" _Unwind_Reason_Code APS5_VABI _Unwind_Backtrace_nid_postfix(_Unwind_Trace_Fn trace, void* argument);
-extern "C" _Unwind_Reason_Code APS5_VABI _Unwind_ForcedUnwind_nid_postfix(_Unwind_Exception* exception, _Unwind_Stop_Fn stop, void* argument);
-extern "C" _Unwind_Ptr APS5_VABI _Unwind_GetRegionStart_nid_postfix(_Unwind_Context* context);
-extern "C" void* APS5_VABI __cxa_begin_catch_nid_postfix(void* exception);
-extern "C" void APS5_VABI __cxa_end_catch_nid_postfix();
 extern "C" [[gnu::noinline]] void BacktraceFromHere();
 extern "C" [[gnu::noinline]] void ForceUnwindFromHere();
 
@@ -85,6 +82,7 @@ void CheckDeleteException() {
     exception.exception_class = ForeignClass;
     exception.exception_cleanup = GuestCleanup;
     _Unwind_DeleteException_nid_postfix(&exception);
+
     CheckCleanup(exception);
 }
 
@@ -94,6 +92,7 @@ void CheckEndCatch(std::uint64_t exceptionClass, Cleanup function) {
     exception.exception_cleanup = function;
     __cxa_begin_catch_nid_postfix(&exception);
     __cxa_end_catch_nid_postfix();
+
     CheckCleanup(exception);
 }
 
@@ -110,6 +109,7 @@ extern "C" void ForceUnwindFromHere() {
     _Unwind_Exception exception {};
     exception.exception_class = ForeignClass;
     _Unwind_ForcedUnwind_nid_postfix(&exception, Stop, &stopArgument);
+
     Require(stop.count == 1, "_Unwind_ForcedUnwind calls the stop function once");
     Require(stop.version == 1, "the stop function gets version 1");
     Require(stop.actions == (_UA_CLEANUP_PHASE | _UA_FORCE_UNWIND), "the stop function gets _UA_CLEANUP_PHASE | _UA_FORCE_UNWIND");
diff --git a/core/libs/tests/WindowsBacktraceReport.cpp b/core/libs/tests/WindowsBacktraceReport.cpp
index d16340e2b3..b7c91f7aa4 100644
--- a/core/libs/tests/WindowsBacktraceReport.cpp
+++ b/core/libs/tests/WindowsBacktraceReport.cpp
@@ -1,3 +1,4 @@
+#include "prx/libc/include/Api.hpp"
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
@@ -6,8 +7,6 @@
 #include "../prx/libc/include/general/VabiMacros.hpp"
 #include "../prx/libc/include/FailureReport.hpp"
 
-extern "C" int* APS5_VABI __error_nid_postfix();
-
 namespace {
 
 void KeptReport() noexcept {
diff --git a/core/libs/tests/WindowsWriteWatch.cpp b/core/libs/tests/WindowsWriteWatch.cpp
index b44c48af61..7a42cdea83 100644
--- a/core/libs/tests/WindowsWriteWatch.cpp
+++ b/core/libs/tests/WindowsWriteWatch.cpp
@@ -172,6 +172,149 @@ void CheckPrivate() {
     VirtualFree(memory, 0, MEM_RELEASE);
 }
 
+MEMORY_BASIC_INFORMATION RegionAt(const void* address) {
+    MEMORY_BASIC_INFORMATION info{};
+    Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "private commit query failed");
+    return info;
+}
+
+void CheckPrivateCommitCarvesPlaceholders() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 256;
+    constexpr std::size_t Span = Pages * Page;
+    constexpr std::size_t Reserved = std::size_t{1} << 30;
+    auto* holder = static_cast<unsigned char*>(mappings.Reserve(nullptr, Reserved));
+    Require(holder != nullptr, "cannot reserve a placeholder for private commits");
+    auto* memory = holder + Page;
+    const auto page = [&](std::size_t index) { return memory + index * Page; };
+    const auto at = [](const unsigned char* pointer) { return reinterpret_cast<std::uintptr_t>(pointer); };
+    auto before = Mappings::MemoryQueries();
+    auto created = mappings.Commit(memory, Span, PAGE_READWRITE, Page, true);
+    const auto queries = Mappings::MemoryQueries() - before;
+    Require(queries == 1, ("committing 256 fresh pages queried the address space " + std::to_string(queries) + " times").c_str());
+    Require(created.size() == 1 && created[0].first == at(memory) && created[0].second == Span, "a fresh commit did not report its range as one created range");
+    for (std::size_t index = 0; index < Pages; ++index) {
+        const auto info = RegionAt(page(index));
+        Require(info.State == MEM_COMMIT && info.Type == MEM_PRIVATE && info.AllocationBase == page(index) && info.RegionSize == Page && info.Protect == PAGE_READWRITE, "a committed page is not a read-write allocation of its own");
+    }
+    const auto prefix = RegionAt(holder);
+    Require(prefix.State == MEM_RESERVE && prefix.AllocationBase == holder && prefix.RegionSize == Page, "the placeholder before the commit changed");
+    const auto suffix = RegionAt(page(Pages));
+    Require(suffix.State == MEM_RESERVE && suffix.AllocationBase == page(Pages) && suffix.RegionSize == Reserved - Page - Span, "the placeholder after the commit changed");
+    for (std::size_t index = 0; index < Pages; ++index) page(index)[8] = static_cast<unsigned char>(index + 1);
+    mappings.Reset(page(11), Page);
+    const auto released = RegionAt(page(11));
+    Require(released.State == MEM_RESERVE && released.AllocationBase == page(11) && released.RegionSize == Page, "a released page did not become a placeholder of its own");
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(11), Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0].first == at(page(11)) && created[0].second == Page && page(11)[8] == 0, "recommitting a released page was not one fresh allocation");
+    for (std::size_t index = 0; index < Pages; ++index) {
+        if (index != 11) Require(page(index)[8] == static_cast<unsigned char>(index + 1), "a release or commit changed a neighbouring page");
+    }
+    created = mappings.Commit(memory, Span, PAGE_READONLY, Page, true);
+    Require(created.empty() && RegionAt(page(0)).Protect == PAGE_READONLY && RegionAt(page(Pages - 1)).Protect == PAGE_READONLY, "a protection change reported fresh memory or missed a page");
+    mappings.Commit(memory, Span, PAGE_READWRITE, Page, true);
+    std::array<void*, 32> written{};
+    std::size_t count = written.size();
+    mappings.Collect(at(page(40)), 4 * Page, written.data(), &count, true);
+    page(41)[4096 + 3] = 1;
+    count = written.size();
+    Require(mappings.Collect(at(page(40)), 4 * Page, written.data(), &count, true, Collection::Armed) && count == 1 && written[0] == page(41) + 4096, "a carved page lost its write watch");
+    mappings.Reset(page(20), 2 * Page);
+    mappings.Reset(page(22), 2 * Page);
+    created = mappings.Commit(page(20), 4 * Page, PAGE_READWRITE, 4 * Page, true);
+    Require(created.size() == 1 && created[0].second == 4 * Page && RegionAt(page(23)).AllocationBase == page(20), "a commit over two placeholders was not one allocation");
+    mappings.Reset(memory, Span);
+    Require(VirtualFree(holder, Reserved, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(holder, 0, MEM_RELEASE), "cannot release the private commit placeholder");
+}
+
+void CheckPrivateCommitEdgeLayouts() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 32;
+    auto* memory = static_cast<unsigned char*>(mappings.Reserve(nullptr, Pages * Page));
+    Require(memory != nullptr, "cannot reserve a placeholder for private commit edges");
+    const auto page = [&](std::size_t index) { return memory + index * Page; };
+    const auto range = [&](std::size_t first, std::size_t count) { return std::make_pair(reinterpret_cast<std::uintptr_t>(page(first)), count * Page); };
+    const auto region = [&](std::size_t first, std::size_t count, DWORD state) {
+        const auto info = RegionAt(page(first));
+        return info.State == state && info.AllocationBase == page(first) && info.RegionSize == count * Page;
+    };
+    const auto ownPages = [&](std::size_t first, std::size_t count) {
+        for (auto index = first; index < first + count; ++index) {
+            if (!region(index, 1, MEM_COMMIT)) return false;
+        }
+        return true;
+    };
+    auto before = Mappings::MemoryQueries();
+    auto created = mappings.Commit(page(2), 4 * Page, PAGE_READWRITE, 4 * Page, true);
+    Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0] == range(2, 4), "a whole-range granule inside a placeholder was not one created range from one query");
+    Require(region(0, 2, MEM_RESERVE) && region(2, 4, MEM_COMMIT) && region(6, Pages - 6, MEM_RESERVE), "a whole-range granule inside a placeholder was not one allocation between two placeholders");
+    page(2)[8] = 0x5a;
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(0), 8 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 3 && created.size() == 2 && created[0] == range(0, 2) && created[1] == range(6, 2), "a commit around a committed piece did not create exactly the placeholders around it");
+    Require(ownPages(0, 2) && region(2, 4, MEM_COMMIT) && page(2)[8] == 0x5a && ownPages(6, 2) && region(8, Pages - 8, MEM_RESERVE), "a commit around a committed piece changed the piece or the layout");
+    for (std::size_t index = 0; index < 8; ++index) page(index)[8] = static_cast<unsigned char>(index + 1);
+    mappings.Reset(page(6), 2 * Page);
+    Require(region(6, 2, MEM_RESERVE) && ownPages(0, 2) && region(2, 4, MEM_COMMIT) && page(1)[8] == 2 && page(5)[8] == 6 && region(8, Pages - 8, MEM_RESERVE), "a partial release of carved pages changed a neighbour");
+    mappings.Reset(page(2), 4 * Page);
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(2), 4 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 1 && created.size() == 1 && created[0] == range(2, 4) && ownPages(2, 4) && page(2)[8] == 0 && page(5)[8] == 0, "a fixed remap was not carved into fresh pages");
+    Require(page(1)[8] == 2 && region(6, 2, MEM_RESERVE), "a fixed remap changed a neighbour");
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(6), 4 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before <= 2 && created.size() == 1 && created[0] == range(6, 4) && ownPages(6, 4) && region(10, Pages - 10, MEM_RESERVE), "a commit over adjacent placeholders was not carved page by page");
+    bool refused = false;
+    try {
+        mappings.Commit(page(12), Page, PAGE_READWRITE, 0, true);
+    } catch (const std::invalid_argument&) {
+        refused = true;
+    }
+    Require(refused && region(10, Pages - 10, MEM_RESERVE), "a zero commit granule was accepted or changed the placeholder");
+    mappings.Commit(page(10), 3 * Page, PAGE_READWRITE, 3 * Page, true);
+    mappings.Reset(page(10), 3 * Page);
+    created = mappings.Commit(page(10), 4 * Page, PAGE_READWRITE, 2 * Page, true);
+    Require(created.size() == 1 && created[0] == range(10, 4) && region(10, 2, MEM_COMMIT) && region(12, 2, MEM_COMMIT) && region(14, Pages - 14, MEM_RESERVE), "a granule crossing the end of a carved placeholder did not take the coalescing path");
+    mappings.Reset(memory, 14 * Page);
+    Require(VirtualFree(memory, Pages * Page, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(memory, 0, MEM_RELEASE), "cannot release the private commit edge placeholder");
+}
+
+void CheckPrivateCommitTails() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    constexpr std::size_t Pages = 8;
+    auto* memory = static_cast<unsigned char*>(mappings.Reserve(nullptr, Pages * Page));
+    Require(memory != nullptr, "cannot reserve a placeholder for private commit tails");
+    const auto page = [&](std::size_t index) { return memory + index * Page; };
+    const auto at = [](const unsigned char* pointer) { return reinterpret_cast<std::uintptr_t>(pointer); };
+    const auto allocation = [](const unsigned char* base, std::size_t bytes, DWORD state) {
+        const auto info = RegionAt(base);
+        return info.State == state && info.AllocationBase == base && info.RegionSize == bytes;
+    };
+    const auto unwatched = [](unsigned char* base) {
+        std::array<void*, 4> written{};
+        ULONG_PTR count = written.size();
+        DWORD granularity = 0;
+        return GetWriteWatch(0, base, Small, written.data(), &count, &granularity) != 0;
+    };
+    auto before = Mappings::MemoryQueries();
+    auto created = mappings.Commit(page(1), 2 * Page + Small, PAGE_READWRITE, Page, false);
+    Require(Mappings::MemoryQueries() - before == 1 && created.size() == 1 && created[0].first == at(page(1)) && created[0].second == 2 * Page + Small, "a commit with a short last piece was not one created range from one query");
+    Require(allocation(page(0), Page, MEM_RESERVE) && allocation(page(1), Page, MEM_COMMIT) && allocation(page(2), Page, MEM_COMMIT) && allocation(page(3), Small, MEM_COMMIT) && allocation(page(3) + Small, (Pages - 3) * Page - Small, MEM_RESERVE), "a short last piece was not its own allocation before the rest of the placeholder");
+    page(3)[Small - 1] = 7;
+    Require(unwatched(page(1)) && unwatched(page(3)), "an unwatched commit carved write-watched pages");
+    before = Mappings::MemoryQueries();
+    created = mappings.Commit(page(5), 3 * Page, PAGE_READWRITE, Page, true);
+    Require(Mappings::MemoryQueries() - before == 1 && created.size() == 1 && created[0].first == at(page(5)) && created[0].second == 3 * Page, "a commit to the end of a placeholder was not one created range from one query");
+    Require(allocation(page(3) + Small, 2 * Page - Small, MEM_RESERVE) && allocation(page(5), Page, MEM_COMMIT) && allocation(page(6), Page, MEM_COMMIT) && allocation(page(7), Page, MEM_COMMIT) && page(3)[Small - 1] == 7, "a commit to the end of a placeholder changed the placeholder before it or a neighbour");
+    mappings.Reset(page(1), 2 * Page + Small);
+    mappings.Reset(page(5), 3 * Page);
+    Require(VirtualFree(memory, Pages * Page, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS) && VirtualFree(memory, 0, MEM_RELEASE), "cannot release the private commit tail placeholder");
+}
+
 void CheckForgottenSectionKeepsNoPages() {
     auto& mappings = Mappings::Get();
     HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr);
@@ -216,6 +359,180 @@ void CheckConcurrentWrites() {
     region.Collect(Collection::Armed);
     Require(region.Collect(Collection::Armed).empty(), "concurrent writes did not settle");
 }
+
+void CheckComparedWhenShared() {
+    auto& mappings = Mappings::Get();
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, 2 * Bytes, nullptr);
+    auto* first = static_cast<unsigned char*>(mappings.Reserve(nullptr, 2 * Bytes));
+    auto* second = static_cast<unsigned char*>(mappings.Reserve(nullptr, 2 * Bytes));
+    Require(section && first && second, "cannot allocate compared sharing test memory");
+    mappings.ForgetSection(section);
+    const auto collect = [&](unsigned char* address, std::size_t bytes) {
+        std::array<void*, 32> pages{};
+        std::size_t count = pages.size();
+        return mappings.Collect(reinterpret_cast<std::uintptr_t>(address), bytes, pages.data(), &count, true);
+    };
+    const auto protection = [](unsigned char* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "compared sharing protection query failed");
+        return info;
+    };
+    mappings.Map(first, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(protection(first).Type == MEM_PRIVATE, "the compared sharing test memory is not resident");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes);
+    Require(collect(first, 2 * Bytes), "a resident page to be compared when shared stopped being collected");
+    mappings.Map(second, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(protection(first).Type == MEM_MAPPED && protection(second).Type == MEM_MAPPED, "a second mapping kept the first resident");
+    Require(!collect(first, Bytes) && !collect(second, Bytes), "a page to be compared when shared was collected once shared");
+    Require(!collect(first, 2 * Bytes), "a collect over a page to be compared when shared succeeded once shared");
+    Require(protection(first).Protect == PAGE_READWRITE && protection(second).Protect == PAGE_READWRITE, "a page to be compared when shared was armed once shared");
+    const auto before = faults.load();
+    first[8] = 0x5a;
+    second[Small + 8] = 0xa5;
+    Require(faults.load() == before && second[8] == 0x5a && first[Small + 8] == 0xa5, "a store into a page to be compared when shared faulted once shared");
+    Require(collect(first + Bytes, Bytes), "a shared page that was never to be compared stopped being collected");
+    mappings.Reset(first, 2 * Bytes);
+    mappings.Reset(second, 2 * Bytes);
+    for (auto* reserved : {first, second}) {
+        VirtualFree(reserved, 2 * Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(reserved, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+}
+
+void CheckResidentOnlyComparedWhenShared() {
+    auto& mappings = Mappings::Get();
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr);
+    auto* first = static_cast<unsigned char*>(mappings.Reserve(nullptr, Bytes));
+    auto* second = static_cast<unsigned char*>(mappings.Reserve(nullptr, Bytes));
+    Require(section && first && second, "cannot allocate resident-only sharing test memory");
+    mappings.ForgetSection(section);
+    mappings.Map(first, Bytes, section, 0, PAGE_READWRITE, true, true);
+    MEMORY_BASIC_INFORMATION info{};
+    Require(VirtualQuery(first, &info, sizeof(info)) == sizeof(info) && info.Type == MEM_PRIVATE, "the resident-only sharing test memory is not resident");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes, true);
+    mappings.Map(second, Bytes, section, 0, PAGE_READWRITE, true, true);
+    std::array<void*, 32> pages{};
+    std::size_t count = pages.size();
+    Require(!mappings.Collect(reinterpret_cast<std::uintptr_t>(first), Bytes, pages.data(), &count, true), "a resident page marked to be compared was collected once shared");
+    const auto before = faults.load();
+    first[8] = 0x3c;
+    Require(faults.load() == before && second[8] == 0x3c, "a store into a resident page marked to be compared faulted once shared");
+    mappings.Reset(first, Bytes);
+    mappings.Reset(second, Bytes);
+    for (auto* reserved : {first, second}) {
+        VirtualFree(reserved, Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(reserved, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+    Region region;
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(region.first), Bytes, true);
+    Require(region.Collect(Collection::All, 0, 1) == Pages(0, 1), "marking only resident pages changed a shared view");
+    Require(region.Protection(0) == PAGE_READONLY, "a shared view outside a resident-only mark was not armed");
+}
+
+void CheckComparedWhenSharedRemapped() {
+    auto& mappings = Mappings::Get();
+    constexpr std::size_t Page = 16384;
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, Bytes, nullptr);
+    std::array<unsigned char*, 3> reserved{};
+    for (auto& address : reserved) address = static_cast<unsigned char*>(mappings.Reserve(nullptr, Bytes));
+    Require(section && reserved[0] && reserved[1] && reserved[2], "cannot allocate remapped compared sharing test memory");
+    mappings.ForgetSection(section);
+    const auto collect = [&](unsigned char* address) {
+        std::array<void*, 32> pages{};
+        std::size_t count = pages.size();
+        return mappings.Collect(reinterpret_cast<std::uintptr_t>(address), Page, pages.data(), &count, true);
+    };
+    const auto memory = [](unsigned char* address) {
+        MEMORY_BASIC_INFORMATION info{};
+        Require(VirtualQuery(address, &info, sizeof(info)) == sizeof(info), "remapped compared sharing query failed");
+        return info;
+    };
+    const auto share = [&] {
+        mappings.Map(reserved[1], Page, section, 0, PAGE_READWRITE, true, true);
+        mappings.Map(reserved[2], Page, section, 0, PAGE_READWRITE, true, true);
+        Require(memory(reserved[1]).Type == MEM_MAPPED && memory(reserved[2]).Type == MEM_MAPPED, "the remapped page is not shared");
+    };
+    const auto unmapShared = [&] {
+        mappings.Reset(reserved[1], Page);
+        mappings.Reset(reserved[2], Page);
+    };
+    mappings.Map(reserved[0], Page, section, 0, PAGE_READWRITE, true, true);
+    Require(memory(reserved[0]).Type == MEM_PRIVATE, "the remapped compared sharing test memory is not resident");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(reserved[0]), Page);
+    mappings.Reset(reserved[0], Page);
+    share();
+    Require(!collect(reserved[1]) && !collect(reserved[2]), "a page to be compared when shared was collected after every view was unmapped and it was mapped again");
+    Require(memory(reserved[1]).Protect == PAGE_READWRITE && memory(reserved[2]).Protect == PAGE_READWRITE, "a page to be compared when shared was armed after every view was unmapped and it was mapped again");
+    const auto before = faults.load();
+    reserved[1][8] = 0x6b;
+    Require(faults.load() == before && reserved[2][8] == 0x6b, "a store into a remapped page to be compared faulted once shared");
+    unmapShared();
+    mappings.ForgetSection(section);
+    share();
+    Require(collect(reserved[1]) && memory(reserved[2]).Protect == PAGE_READONLY, "a forgotten section's handle value kept its pages compared when shared");
+    unmapShared();
+    for (auto* address : reserved) {
+        VirtualFree(address, Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(address, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+}
+
+void CheckComparedPagesReportedOnce() {
+    auto& mappings = Mappings::Get();
+    HANDLE section = CreateFileMappingW(INVALID_HANDLE_VALUE, nullptr, PAGE_EXECUTE_READWRITE | SEC_RESERVE, 0, 2 * Bytes, nullptr);
+    std::array<unsigned char*, 3> reserved{};
+    for (auto& address : reserved) address = static_cast<unsigned char*>(mappings.Reserve(nullptr, 2 * Bytes));
+    Require(section && reserved[0] && reserved[1] && reserved[2], "cannot allocate compared page report test memory");
+    mappings.ForgetSection(section);
+    const auto listed = [&](unsigned char* base, std::size_t begin, std::size_t count, bool unreported) {
+        const auto address = reinterpret_cast<std::uintptr_t>(base);
+        auto cursor = address + begin * Small;
+        const auto end = cursor + count * Small;
+        std::set<std::size_t> result;
+        while (cursor < end) {
+            std::array<void*, 3> pages{};
+            std::size_t available = pages.size();
+            mappings.ComparedPages(cursor, end - cursor, pages.data(), &available, unreported);
+            for (std::size_t i = 0; i < available; ++i) result.insert((reinterpret_cast<std::uintptr_t>(pages[i]) - address) / Small);
+            if (available < pages.size()) break;
+            cursor = reinterpret_cast<std::uintptr_t>(pages[available - 1]) + Small;
+        }
+        return result;
+    };
+    auto* first = reserved[0];
+    auto* second = reserved[1];
+    mappings.Map(first, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes);
+    Require(listed(first, 0, 32, false).empty() && listed(first, 0, 32, true).empty(), "a resident page to be compared was listed before it was shared");
+    mappings.Map(second, 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(listed(first, 0, 32, false) == Pages(0, 16) && listed(second, 0, 32, false) == Pages(0, 16), "the compared pages of both mappings were not listed once shared");
+    Require(listed(first, 2, 4, true) == Pages(2, 6), "a partial take did not report exactly its compared pages");
+    std::set<std::size_t> rest = Pages(0, 2);
+    rest.insert(6);
+    for (std::size_t page = 7; page < 16; ++page) rest.insert(page);
+    Require(listed(first, 0, 32, true) == rest, "a compared page was reported twice or not at all");
+    Require(listed(first, 0, 32, true).empty() && listed(first, 0, 32, false) == Pages(0, 16), "a compared page was reported again, or a listing consumed its mark");
+    Require(listed(second, 0, 32, true) == Pages(0, 16) && listed(second, 0, 32, true).empty(), "the second mapping's compared pages were not reported exactly once");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first), Bytes);
+    Require(listed(first, 0, 32, true).empty() && listed(second, 0, 32, true).empty(), "marking compared pages again reported them again");
+    mappings.CompareWhenShared(reinterpret_cast<std::uintptr_t>(first + Bytes), Bytes);
+    Require(listed(first, 16, 16, true) == Pages(16, 32) && listed(second, 16, 16, true) == Pages(16, 32), "shared pages newly marked to be compared were not reported in every mapping");
+    mappings.Map(reserved[2], 2 * Bytes, section, 0, PAGE_READWRITE, true, true);
+    Require(listed(reserved[2], 0, 32, true) == Pages(0, 32) && listed(first, 0, 32, true).empty(), "a new mapping of compared pages was not reported, or reported the others again");
+    for (auto* address : reserved) mappings.Reset(address, 2 * Bytes);
+    for (auto* address : reserved) {
+        VirtualFree(address, 2 * Bytes, MEM_RELEASE | MEM_COALESCE_PLACEHOLDERS);
+        VirtualFree(address, 0, MEM_RELEASE);
+    }
+    mappings.ForgetSection(section);
+    CloseHandle(section);
+}
 }
 
 int main() {
@@ -230,6 +547,13 @@ int main() {
         CheckPrivate();
         CheckConcurrentWrites();
         CheckForgottenSectionKeepsNoPages();
+        CheckComparedWhenShared();
+        CheckResidentOnlyComparedWhenShared();
+        CheckComparedWhenSharedRemapped();
+        CheckComparedPagesReportedOnce();
+        CheckPrivateCommitCarvesPlaceholders();
+        CheckPrivateCommitEdgeLayouts();
+        CheckPrivateCommitTails();
         std::cout << "Windows deferred write-watch tests passed\n";
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
diff --git a/core/libs/tests/numeric-locale/comma.charmap b/core/libs/tests/numeric-locale/comma.charmap
new file mode 100644
index 0000000000..cbfea3c784
--- /dev/null
+++ b/core/libs/tests/numeric-locale/comma.charmap
@@ -0,0 +1,135 @@
+<code_set_name> ANYPS5_COMMA
+<comment_char> %
+<escape_char> /
+<mb_cur_max> 1
+<mb_cur_min> 1
+CHARMAP
+<U0000> /x00
+<U0001> /x01
+<U0002> /x02
+<U0003> /x03
+<U0004> /x04
+<U0005> /x05
+<U0006> /x06
+<U0007> /x07
+<U0008> /x08
+<U0009> /x09
+<U000A> /x0a
+<U000B> /x0b
+<U000C> /x0c
+<U000D> /x0d
+<U000E> /x0e
+<U000F> /x0f
+<U0010> /x10
+<U0011> /x11
+<U0012> /x12
+<U0013> /x13
+<U0014> /x14
+<U0015> /x15
+<U0016> /x16
+<U0017> /x17
+<U0018> /x18
+<U0019> /x19
+<U001A> /x1a
+<U001B> /x1b
+<U001C> /x1c
+<U001D> /x1d
+<U001E> /x1e
+<U001F> /x1f
+<U0020> /x20
+<U0021> /x21
+<U0022> /x22
+<U0023> /x23
+<U0024> /x24
+<U0025> /x25
+<U0026> /x26
+<U0027> /x27
+<U0028> /x28
+<U0029> /x29
+<U002A> /x2a
+<U002B> /x2b
+<U002C> /x2c
+<U002D> /x2d
+<U002E> /x2e
+<U002F> /x2f
+<U0030> /x30
+<U0031> /x31
+<U0032> /x32
+<U0033> /x33
+<U0034> /x34
+<U0035> /x35
+<U0036> /x36
+<U0037> /x37
+<U0038> /x38
+<U0039> /x39
+<U003A> /x3a
+<U003B> /x3b
+<U003C> /x3c
+<U003D> /x3d
+<U003E> /x3e
+<U003F> /x3f
+<U0040> /x40
+<U0041> /x41
+<U0042> /x42
+<U0043> /x43
+<U0044> /x44
+<U0045> /x45
+<U0046> /x46
+<U0047> /x47
+<U0048> /x48
+<U0049> /x49
+<U004A> /x4a
+<U004B> /x4b
+<U004C> /x4c
+<U004D> /x4d
+<U004E> /x4e
+<U004F> /x4f
+<U0050> /x50
+<U0051> /x51
+<U0052> /x52
+<U0053> /x53
+<U0054> /x54
+<U0055> /x55
+<U0056> /x56
+<U0057> /x57
+<U0058> /x58
+<U0059> /x59
+<U005A> /x5a
+<U005B> /x5b
+<U005C> /x5c
+<U005D> /x5d
+<U005E> /x5e
+<U005F> /x5f
+<U0060> /x60
+<U0061> /x61
+<U0062> /x62
+<U0063> /x63
+<U0064> /x64
+<U0065> /x65
+<U0066> /x66
+<U0067> /x67
+<U0068> /x68
+<U0069> /x69
+<U006A> /x6a
+<U006B> /x6b
+<U006C> /x6c
+<U006D> /x6d
+<U006E> /x6e
+<U006F> /x6f
+<U0070> /x70
+<U0071> /x71
+<U0072> /x72
+<U0073> /x73
+<U0074> /x74
+<U0075> /x75
+<U0076> /x76
+<U0077> /x77
+<U0078> /x78
+<U0079> /x79
+<U007A> /x7a
+<U007B> /x7b
+<U007C> /x7c
+<U007D> /x7d
+<U007E> /x7e
+<U007F> /x7f
+END CHARMAP
diff --git a/core/libs/tests/numeric-locale/comma.locale b/core/libs/tests/numeric-locale/comma.locale
new file mode 100644
index 0000000000..3207685c62
--- /dev/null
+++ b/core/libs/tests/numeric-locale/comma.locale
@@ -0,0 +1,5 @@
+LC_NUMERIC
+decimal_point "<U002C>"
+thousands_sep ""
+grouping -1
+END LC_NUMERIC
diff --git a/core/libs/tests/test_public_headers.py b/core/libs/tests/test_public_headers.py
new file mode 100644
index 0000000000..8aa05f692b
--- /dev/null
+++ b/core/libs/tests/test_public_headers.py
@@ -0,0 +1,218 @@
+import argparse
+import concurrent.futures
+import importlib.util
+import json
+import re
+import subprocess
+import sys
+from functools import cache
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+LIBS = ROOT / "core/libs"
+sys.dont_write_bytecode = True
+SPEC = importlib.util.spec_from_file_location("nid_names", ROOT / "tools/nid_names.py")
+NIDS = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(NIDS)
+DECLARATION = re.compile(r"(?:\bAPS5_VABI\s+|^[ \t]*[A-Za-z_][\w:*&<> \t]*?[ \t]+)(\w+)\s*\([^;{}]*\)\s*(?:noexcept\s*)?;", re.M)
+INCLUDE = re.compile(r'^\s*#\s*include\s*"([^"]+)"', re.M)
+TYPE_TOKEN = re.compile(r"\bnamespace\s*([\w:]*)\s*\{|\bextern\s*\{|\b(?:struct|union|class)\s+(\w+)\s*([;{])|\busing\s+(\w+)\s*=|[{}]")
+
+
+@cache
+def code(text):
+    return NIDS.CPP_TOKEN.sub(lambda match: match.group() if match.group("code") else re.sub(r"[^\n]", " ", match.group()), text)
+
+
+def declared_types(text):
+    scopes = []
+    result = set()
+    for token in TYPE_TOKEN.finditer(text):
+        namespace, name, ending, alias = token.groups()
+        if namespace is not None:
+            scopes.append(namespace or None)
+        elif name or alias:
+            if None not in scopes:
+                result.add("::".join([scope for scope in scopes if scope] + [name or alias]))
+            if ending == "{":
+                scopes.append(name)
+        elif token.group().startswith("extern"):
+            scopes.append("")
+        elif token.group() == "{":
+            scopes.append(None)
+        elif scopes:
+            scopes.pop()
+    return result
+
+
+@cache
+def source_text(path):
+    return path.read_text(encoding="utf-8")
+
+
+@cache
+def included_headers(header):
+    result = []
+    for name in INCLUDE.findall(source_text(header)):
+        candidates = {path.resolve() for path in (header.parent / name, LIBS / name) if path.is_file()}
+        if len(candidates) != 1:
+            raise RuntimeError(f"{header}: include {name} resolves to {len(candidates)} files")
+        result.append(candidates.pop())
+    return result
+
+
+def reachable(header, visited):
+    if header in visited:
+        return
+    visited.add(header)
+    for included in included_headers(header):
+        reachable(included, visited)
+
+
+def exported_definitions(text):
+    text = text.replace("\\\n", "").replace("\\\r\n", "")
+    masked = code(text)
+    ranges = []
+    for match in re.finditer(r"\bnamespace\s*\{", masked):
+        depth = 1
+        end = match.end()
+        while depth and end < len(masked):
+            depth += (masked[end] == "{") - (masked[end] == "}")
+            end += 1
+        ranges.append((match.start(), end))
+    result = set()
+    position = 0
+    parentheses = 0
+    for match in NIDS.DEFINITION.finditer(masked):
+        prefix = masked[position:match.start()]
+        parentheses += prefix.count("(") - prefix.count(")")
+        position = match.start()
+        if parentheses:
+            continue
+        if any(start < match.start() < end for start, end in ranges):
+            continue
+        start = max(masked.rfind(delimiter, 0, match.start()) for delimiter in ";{}") + 1
+        if re.search(r"\b(?:static|GCC_HIDDEN_FN)\b", masked[start:match.start()]):
+            continue
+        result.add(match.group(1))
+    return result
+
+
+def audit():
+    umbrellas = sorted(path / f"{path.name}.hpp" for path in (LIBS / "prx").iterdir() if path.is_dir())
+    if not umbrellas:
+        raise RuntimeError("No library umbrella headers found")
+    missing = [str(path.relative_to(ROOT)) for path in umbrellas if not path.is_file()]
+    if missing:
+        raise RuntimeError("Missing library umbrella headers: " + ", ".join(missing))
+    exports = {}
+    for umbrella in umbrellas:
+        included = set()
+        reachable(umbrella.resolve(), included)
+        for source in NIDS.source_files(umbrella.parent):
+            if "tools" in source.relative_to(umbrella.parent).parts:
+                continue
+            text = source_text(source).replace("\\\n", "").replace("\\\r\n", "")
+            aliases = {name for nid, name in NIDS.source_aliases(text)} if "APS5_EXPORT" in text else set()
+            definitions = exported_definitions(text)
+            if any(macro in text for macro in NIDS.ASM_FUNCTION_MACROS):
+                definitions.update(NIDS.source_assembly_definitions(text))
+            for name in definitions | aliases:
+                if name.endswith(("_nid_no_patch", "_nid_no_patch_cut")):
+                    continue
+                exports.setdefault(name, []).append((source, included))
+    declarations = {name: [] for name in exports}
+    for source in sorted((ROOT / "core").rglob("*")):
+        if source.suffix not in {".cpp", ".h", ".hpp"}:
+            continue
+        text = code(source_text(source))
+        resolved = source.resolve()
+        for match in DECLARATION.finditer(text):
+            if match.group(1) not in declarations:
+                continue
+            prefix = match.group()[:match.start(1) - match.start()]
+            if re.search(r"\b(?:return|co_return|throw|else|case)\b|&&|\|\|", prefix):
+                continue
+            declarations[match.group(1)].append((resolved, text.count("\n", 0, match.start()) + 1))
+    errors = []
+    headers = set(umbrellas)
+    for name, definitions in exports.items():
+        found = declarations[name]
+        if len(found) != 1 or found[0][0].suffix not in {".h", ".hpp"}:
+            locations = ", ".join(f"{path.relative_to(ROOT)}:{line}" for path, line in found)
+            errors.append(f"{name}: expected exactly one header declaration; found {len(found)}: {locations}")
+            continue
+        header = found[0][0]
+        headers.add(header)
+        for source, included in definitions:
+            if header not in included:
+                errors.append(f"{name}: {header.relative_to(ROOT)} is not included by {source.parent} library umbrella")
+    if errors:
+        raise RuntimeError("\n".join(errors))
+    public_types = set()
+    for header in headers:
+        text = code(source_text(header))
+        public_types.update(declared_types(text))
+    for source in sorted((ROOT / "core").rglob("*.cpp")):
+        text = code(source_text(source))
+        types = declared_types(text)
+        for name in sorted(public_types & types):
+            errors.append(f"{source.relative_to(ROOT)}: duplicate public type {name}; include its header")
+    if errors:
+        raise RuntimeError("\n".join(errors))
+    return umbrellas, sorted(headers), len(exports)
+
+
+def compile_headers(compiler, compiler_args, groups, workers=4):
+    macros = subprocess.run([compiler, *compiler_args, "-dM", "-E", "-x", "c++", "-"], input="", text=True, capture_output=True, check=True).stdout
+    warnings = ["-Werror"]
+    if re.search(r"^#define __clang__\b", macros, re.M):
+        warnings.append("-Wno-return-type-c-linkage")
+
+    def compile_one(group):
+        includes = "".join(f'#include "{header.relative_to(LIBS).as_posix()}"\n' for header in group)
+        result = subprocess.run([compiler, *compiler_args, "-std=c++20", *warnings, "-fsyntax-only", "-x", "c++", f"-I{LIBS}", f"-I{ROOT / '3rdparty/freetype/include'}", "-"], input=includes * 2, text=True, capture_output=True)
+        if result.returncode:
+            raise RuntimeError(f"Header compilation failed: {group}\n{result.stdout}{result.stderr}")
+
+    with concurrent.futures.ThreadPoolExecutor(max_workers=workers) as pool:
+        list(pool.map(compile_one, groups))
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--compiler")
+    parser.add_argument("--compiler-arg", action="append", default=[])
+    parser.add_argument("--manifest", type=Path)
+    parser.add_argument("--audit-only", action="store_true")
+    parser.add_argument("--batch-index", type=int)
+    parser.add_argument("--batch-count", type=int, default=64)
+    args = parser.parse_args()
+    if args.batch_count < 1:
+        parser.error("--batch-count must be positive")
+    if args.audit_only and args.batch_index is not None:
+        parser.error("--audit-only cannot be combined with --batch-index")
+    if not args.audit_only and not args.compiler:
+        parser.error("--compiler is required for header compilation")
+    if args.batch_index is not None:
+        if not args.manifest or not 0 <= args.batch_index < args.batch_count:
+            parser.error("a batch requires --manifest and an index within --batch-count")
+        groups = [[LIBS / name for name in group] for group in json.loads(args.manifest.read_text(encoding="utf-8"))]
+        selected = groups[args.batch_index::args.batch_count]
+        if not selected:
+            raise RuntimeError("Header compilation batch is empty")
+        compile_headers(args.compiler, args.compiler_arg, selected, workers=1)
+        print(f"Batch {args.batch_index}: {len(selected)} header compilation units verified")
+        return
+    umbrellas, headers, count = audit()
+    groups = [[header] for header in headers] + [umbrellas]
+    if args.manifest:
+        args.manifest.write_text(json.dumps([[header.relative_to(LIBS).as_posix() for header in group] for group in groups]), encoding="utf-8")
+    print(f"{len(umbrellas)} libraries, {count} exports: unique declarations and umbrella coverage verified", flush=True)
+    if not args.audit_only:
+        compile_headers(args.compiler, args.compiler_arg, groups)
+        print("Standalone headers verified")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index 31560112a0..55968ce9c2 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -33,6 +33,7 @@ add_library(relinker_core STATIC
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/NativePath.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/FileIdentity.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/Amd64OnlyConverter.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/RedZoneFramer.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/InstructionScanner.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/X64InstructionDecoder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/X64InstructionRewriter.cpp
@@ -52,6 +53,7 @@ add_library(relinker_core STATIC
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreOperands.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/ScalarCompareOperands.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/MaskedStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/AndnLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/relinker/src/parsing/ElfReader.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/relinker/src/analysis/SyscallScanner.cpp
@@ -98,6 +100,11 @@ if(BUILD_TESTING)
     add_test(NAME andn_lowering COMMAND andn_lowering_tests)
     set_tests_properties(andn_lowering PROPERTIES TIMEOUT 20)
 
+    add_test_executable(masked_store_lowering_tests ${CMAKE_CURRENT_SOURCE_DIR}/codegen/tests/MaskedStoreLoweringTests.cpp)
+    target_link_libraries(masked_store_lowering_tests PRIVATE relinker_core)
+    add_test(NAME masked_store_lowering COMMAND masked_store_lowering_tests)
+    set_tests_properties(masked_store_lowering PROPERTIES TIMEOUT 20)
+
     add_test_executable(relinker_conversion_tests ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/ConversionTests.cpp)
     target_link_libraries(relinker_conversion_tests PRIVATE relinker_core)
     add_test(NAME relinker_conversion COMMAND relinker_conversion_tests)
@@ -106,6 +113,11 @@ if(BUILD_TESTING)
     target_link_libraries(relinker_game_patch_tests PRIVATE relinker_core)
     add_test(NAME relinker_game_patch COMMAND relinker_game_patch_tests)
     set_tests_properties(relinker_game_patch PROPERTIES TIMEOUT 30)
+
+    add_test_executable(call_registry_writer_tests ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/CallRegistryWriterTests.cpp)
+    target_link_libraries(call_registry_writer_tests PRIVATE relinker_core)
+    add_test(NAME call_registry_writer COMMAND call_registry_writer_tests)
+    set_tests_properties(call_registry_writer PROPERTIES TIMEOUT 20)
 endif()
 
 if(ANYPS5_BUILD_WASM)
@@ -160,6 +172,16 @@ if(WIN32)
         add_test(NAME windows_dependency_diagnostics COMMAND windows_dependency_diagnostics_tests)
     endif()
 
+    if(NOT ANYPS5_RELINKER_ONLY)
+        add_test_executable(windows_import_identity_tests EXCLUDE_FROM_ALL ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/tests/WindowsImportIdentityTests.cpp)
+        target_link_libraries(windows_import_identity_tests PRIVATE relinker_core)
+        if(BUILD_TESTING)
+            set_target_properties(windows_import_identity_tests PROPERTIES EXCLUDE_FROM_ALL FALSE)
+            add_dependencies(windows_import_identity_tests libs)
+            add_test(NAME windows_import_identity COMMAND windows_import_identity_tests "${CMAKE_BINARY_DIR}/core/libs/libs")
+        endif()
+    endif()
+
     add_test_executable(amd64_only_windows_tests EXCLUDE_FROM_ALL
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/tests/Amd64OnlyWindowsTests.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/src/windows/WindowsTrampolineBuilder.cpp
@@ -188,6 +210,7 @@ if(WIN32)
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreOperands.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/ScalarCompareOperands.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/MaskedStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/AndnLowering.cpp
     )
     target_include_directories(amd64_only_windows_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/include ${CMAKE_CURRENT_SOURCE_DIR}/domain/include ${CMAKE_CURRENT_SOURCE_DIR}/io/include ${CMAKE_CURRENT_SOURCE_DIR}/codegen/include ${CMAKE_CURRENT_SOURCE_DIR}/../libs/prx/libc/src/specifics/windows)
@@ -238,6 +261,19 @@ if(BUILD_TESTING)
     add_test(NAME sdk_mman_syscall COMMAND sdk_mman_syscall_tests)
     set_tests_properties(sdk_mman_syscall PROPERTIES TIMEOUT 20)
 
+    add_test_executable(code_data_scanning_tests
+        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/CodeDataScanningTests.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/src/analysis/SyscallScanner.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/InstructionScanner.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/X64InstructionDecoder.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/DecodedInstruction.cpp)
+    target_include_directories(code_data_scanning_tests PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}/domain/include
+        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/include
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/include)
+    add_test(NAME code_data_scanning COMMAND code_data_scanning_tests)
+    set_tests_properties(code_data_scanning PROPERTIES TIMEOUT 20)
+
     add_test_executable(runtime_layout_tests ${CMAKE_CURRENT_SOURCE_DIR}/cli/tests/RuntimeLayoutTests.cpp)
     target_include_directories(runtime_layout_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/cli/include)
     add_test(NAME runtime_layout COMMAND runtime_layout_tests)
@@ -266,6 +302,16 @@ if(BUILD_TESTING)
     add_test(NAME rewrite_boundaries COMMAND rewrite_boundaries_tests)
     set_tests_properties(rewrite_boundaries PROPERTIES TIMEOUT 20)
 
+    add_test_executable(red_zone_framer_tests ${CMAKE_CURRENT_SOURCE_DIR}/codegen/tests/RedZoneFramerTests.cpp)
+    target_link_libraries(red_zone_framer_tests PRIVATE relinker_core)
+    add_test(NAME red_zone_framer COMMAND red_zone_framer_tests)
+    if(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64|AMD64")
+        add_test_executable(red_zone_framer_execution_tests ${CMAKE_CURRENT_SOURCE_DIR}/codegen/tests/RedZoneFramerExecutionTests.cpp)
+        target_link_libraries(red_zone_framer_execution_tests PRIVATE relinker_core)
+        add_test(NAME red_zone_framer_execution COMMAND red_zone_framer_execution_tests)
+        set_tests_properties(red_zone_framer_execution PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 60)
+    endif()
+
     add_test_executable(cli_args_tests
         ${CMAKE_CURRENT_SOURCE_DIR}/cli/tests/CliArgsTests.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/cli/src/CliArgs.cpp
@@ -369,12 +415,15 @@ if(BUILD_TESTING)
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/StubBodyBuilder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/ByteWriter.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/BufferUtils.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libs/nid/src/NidCompute.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libs/nid/src/Sha1.cpp
     )
     target_include_directories(linux_load_pages_tests PRIVATE
         ${CMAKE_CURRENT_SOURCE_DIR}/domain/include
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/include
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/include
         ${CMAKE_CURRENT_SOURCE_DIR}/io/include
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libs/nid/include
     )
     add_test(NAME linux_load_pages COMMAND linux_load_pages_tests)
     set_tests_properties(linux_load_pages PROPERTIES TIMEOUT 20)
@@ -401,6 +450,7 @@ if(BUILD_TESTING)
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreOperands.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/WideStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/ScalarCompareOperands.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/MaskedStoreLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/src/x86/AndnLowering.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/src/linux/LinuxElfPatcher.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/src/general/SegmentFilter.cpp
@@ -409,12 +459,15 @@ if(BUILD_TESTING)
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/ByteWriter.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/io/src/BufferUtils.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libs/nid/src/NidCompute.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libs/nid/src/Sha1.cpp
     )
     target_include_directories(amd64_only_converter_tests PRIVATE
         ${CMAKE_CURRENT_SOURCE_DIR}/domain/include
         ${CMAKE_CURRENT_SOURCE_DIR}/codegen/include
         ${CMAKE_CURRENT_SOURCE_DIR}/elfpatcher/include
         ${CMAKE_CURRENT_SOURCE_DIR}/io/include
+        ${CMAKE_CURRENT_SOURCE_DIR}/../libs/nid/include
     )
     if(APPLE AND (CMAKE_OSX_ARCHITECTURES STREQUAL "x86_64" OR (NOT CMAKE_OSX_ARCHITECTURES AND CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")))
         target_link_options(amd64_only_converter_tests PRIVATE "LINKER:-pagezero_size,0x10000")
@@ -573,6 +626,13 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_executables.py $<TARGET_FILE:relinker>)
         add_test(NAME game_patches COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_game_patches.py $<TARGET_FILE:relinker>)
+        if(Python3_VERSION VERSION_GREATER_EQUAL 3.11)
+            add_test(NAME patch_advisor_unit COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_SOURCE_DIR}/tools/tests/test_suggest_patches.py)
+            add_test(NAME patch_advisor_integration COMMAND ${Python3_EXECUTABLE}
+                ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_patch_advisor.py $<TARGET_FILE:relinker>)
+            set_tests_properties(patch_advisor_integration PROPERTIES TIMEOUT 40)
+        endif()
         add_test(NAME sce_module_path COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_sce_module_path.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_guest_stack COMMAND ${Python3_EXECUTABLE}
@@ -598,6 +658,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_host_libc.py $<TARGET_FILE:relinker>)
         add_test(NAME windows_named_imports COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_named_imports.py $<TARGET_FILE:relinker>)
+        add_test(NAME linux_named_imports COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_named_imports.py $<TARGET_FILE:relinker>)
         add_library(guest_module_args_host SHARED elfpatcher/tests/GuestModuleArgsHost.cpp)
         target_include_directories(guest_module_args_host PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../libs)
         set_target_properties(guest_module_args_host PROPERTIES
@@ -616,6 +678,7 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_unused_import_dependencies.py
             $<TARGET_FILE:relinker> $<TARGET_FILE:guest_module_args_host>)
         set_property(TEST guest_unused_import_dependencies APPEND PROPERTY LABELS relinker)
+        add_asan_test_options(guest_unused_import_dependencies verify_asan_link_order=0)
         add_test(NAME guest_export_lookup COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_export_lookup.py $<TARGET_FILE:relinker>)
         set_tests_properties(guest_export_lookup PROPERTIES TIMEOUT 30)
@@ -625,6 +688,7 @@ if(BUILD_TESTING)
         add_asan_test_options(guest_module_args verify_asan_link_order=0)
         add_asan_test_options(guest_deferred_dependencies verify_asan_link_order=0)
         add_asan_test_options(guest_module_fini verify_asan_link_order=0)
+        add_asan_test_options(guest_unused_import_dependencies verify_asan_link_order=0)
         add_test(NAME guest_needed_nested_modules COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_needed_nested_modules.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_zero_initializer COMMAND ${Python3_EXECUTABLE}
@@ -632,6 +696,10 @@ if(BUILD_TESTING)
             $<TARGET_FILE:relinker> $<TARGET_FILE:guest_module_args_host>)
         set_tests_properties(guest_zero_initializer PROPERTIES TIMEOUT 30)
         add_asan_test_options(guest_zero_initializer verify_asan_link_order=0)
+        add_test(NAME linux_guest_named_imports COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_guest_named_imports.py
+            $<TARGET_FILE:relinker> $<TARGET_FILE:guest_module_args_host>)
+        add_asan_test_options(linux_guest_named_imports verify_asan_link_order=0)
         set(windows_stdio_host_arguments)
         if(WIN32)
             if(MINGW)
@@ -669,6 +737,14 @@ if(BUILD_TESTING)
         add_test(NAME windows_import_modules COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_import_modules.py
             $<TARGET_FILE:relinker> ${windows_stdio_host_arguments})
+        if(WIN32)
+            foreach(kernelVariant IN ITEMS sys web)
+                add_test(NAME windows_kernel_variant_${kernelVariant} COMMAND ${Python3_EXECUTABLE}
+                    ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_windows_kernel_variant_imports.py
+                    $<TARGET_FILE:relinker> libkernel_${kernelVariant}.prx)
+                set_tests_properties(windows_kernel_variant_${kernelVariant} PROPERTIES TIMEOUT 30)
+            endforeach()
+        endif()
         add_test(NAME elf_header COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_elf_header.py $<TARGET_FILE:relinker>)
         add_test(NAME weak_imports COMMAND ${Python3_EXECUTABLE}
diff --git a/core/relinker/cli/include/Cli.hpp b/core/relinker/cli/include/Cli.hpp
index cb379408f0..2625b44aac 100644
--- a/core/relinker/cli/include/Cli.hpp
+++ b/core/relinker/cli/include/Cli.hpp
@@ -16,6 +16,7 @@ struct Args {
     bool skipSceModule = false;
     bool toIntel = false;
     bool toRosetta = false;
+    bool frameRedZone = false;
     bool writeRegistry = false;
     bool toWindows = false;
     bool toMacos = false;
diff --git a/core/relinker/cli/src/CliArgs.cpp b/core/relinker/cli/src/CliArgs.cpp
index 3fa915c6d2..47166d9972 100644
--- a/core/relinker/cli/src/CliArgs.cpp
+++ b/core/relinker/cli/src/CliArgs.cpp
@@ -13,7 +13,7 @@
 namespace Cli {
 
 const char* Usage() {
-    return "Usage: relinker [--help] [--windows | --macos] [--windows-diagnostics] [--windows-gui] [--trace-imports] [--windows-fixed-base <address>] [--linux-fixed-base <address>] [--macos-fixed-base <address>] [--skip-syscall-check | --trap-sdk-syscall-stubs] [--skip-sce-module | --sce-module-path <path>] [--exclude-sce-module <file>]... [--module-dir <dir>]... [--executable <path>]... [--to-intel] [--to-rosetta] [unused-filter=0|1|2] [--registry] [--rpath <path>] [--lazy-binding] [--autorun] [--patches <file> | --no-patches] <input.elf> <output.elf>\n"
+    return "Usage: relinker [--help] [--windows | --macos] [--windows-diagnostics] [--windows-gui] [--trace-imports] [--windows-fixed-base <address>] [--linux-fixed-base <address>] [--macos-fixed-base <address>] [--skip-syscall-check | --trap-sdk-syscall-stubs] [--skip-sce-module | --sce-module-path <path>] [--exclude-sce-module <file>]... [--module-dir <dir>]... [--executable <path>]... [--to-intel] [--to-rosetta] [--frame-red-zone] [unused-filter=0|1|2] [--registry] [--rpath <path>] [--lazy-binding] [--autorun] [--patches <file> | --no-patches] <input.elf> <output.elf>\n"
            "       relinker --verify-patches <file> [--verify-output] [--skip-sce-module | --sce-module-path <path>] [--exclude-sce-module <file>]... [--module-dir <dir>]... [--executable <path>]... <path>\n"
            "Example: relinker input.elf output.elf";
 }
@@ -105,6 +105,8 @@ Args ParseArgs(int argc, char* argv[]) {
             args.executables.push_back(argv[++i]);
         } else if (arg == "--to-intel") {
             args.toIntel = true;
+        } else if (arg == "--frame-red-zone") {
+            args.frameRedZone = true;
         } else if (arg == "--to-rosetta") {
             args.toRosetta = true;
             args.toIntel = true;
diff --git a/core/relinker/cli/tests/AutorunExitTests.cpp b/core/relinker/cli/tests/AutorunExitTests.cpp
index c4883221a5..c773826ee9 100644
--- a/core/relinker/cli/tests/AutorunExitTests.cpp
+++ b/core/relinker/cli/tests/AutorunExitTests.cpp
@@ -9,9 +9,28 @@
 #include <stdexcept>
 #include <string>
 #include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+std::filesystem::path ExecutablePath(const char* argument) {
+#ifdef _WIN32
+    static_cast<void>(argument);
+    std::vector<wchar_t> filename(32768);
+    const auto size = GetModuleFileNameW(nullptr, filename.data(), static_cast<DWORD>(filename.size()));
+    if (size == 0 || size >= filename.size()) throw std::runtime_error("Cannot locate the autorun test executable");
+    return std::filesystem::path(filename.data());
+#else
+    return std::filesystem::absolute(argument);
+#endif
+}
+
+}
 
 int main(int, char* argv[]) {
-    const auto executable = std::filesystem::absolute(argv[0]);
+    const auto executable = ExecutablePath(argv[0]);
     const auto name = executable.stem().string();
     if (name.starts_with("anyps5-autorun-child-")) {
         if (name.find("signal") != std::string::npos) std::raise(SIGILL);
diff --git a/core/relinker/codegen/include/codegen/CodegenTypes.hpp b/core/relinker/codegen/include/codegen/CodegenTypes.hpp
index 021f2bf059..9b116f3657 100644
--- a/core/relinker/codegen/include/codegen/CodegenTypes.hpp
+++ b/core/relinker/codegen/include/codegen/CodegenTypes.hpp
@@ -76,6 +76,7 @@ struct DecodedInstructionInfo {
     bool IsTwoByteOpcode;
     std::uint8_t Opcode;
     std::uint8_t ModRmRegField;
+    std::size_t ModRmOffset = 0;
 };
 
 }
diff --git a/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp b/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp
index c3df3388cc..8f71e35555 100644
--- a/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp
+++ b/core/relinker/codegen/include/codegen/x86/Amd64OnlySubstitutionTable.hpp
@@ -42,6 +42,7 @@ inline constexpr Entry kRdseed = {"RDSEED", nullptr, 0};
 inline constexpr Entry kRdpid = {"RDPID", nullptr, 0};
 inline constexpr Entry kRdtscp = {"RDTSCP", nullptr, 0};
 inline constexpr Entry kClwb = {"CLWB", nullptr, 0};
+inline constexpr Entry kXsaveopt = {"XSAVEOPT", nullptr, 0};
 inline constexpr Entry kWideStore = {"256-bit store", nullptr, 0};
 inline constexpr Entry kScalarCompare = {"scalar compare", nullptr, 0};
 inline constexpr Entry kExtrq = {"EXTRQ", nullptr, 0};
diff --git a/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp b/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp
index 4176cc4cff..d1c86aff41 100644
--- a/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp
+++ b/core/relinker/codegen/include/codegen/x86/DecodedInstruction.hpp
@@ -27,6 +27,7 @@ struct DecodedInstruction {
     [[nodiscard]] bool IsRdpid() const;
     [[nodiscard]] bool IsRdtscp() const;
     [[nodiscard]] bool IsClwb() const;
+    [[nodiscard]] bool IsXsaveopt() const;
 
 private:
     [[nodiscard]] std::size_t _skipPrefixesAndRex(bool* outHasOperandSizePrefix, bool* outHasRepnePrefix, bool* outHasRepPrefix) const;
diff --git a/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp b/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp
index 9986e79286..998c321b29 100644
--- a/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp
+++ b/core/relinker/codegen/include/codegen/x86/IAmd64OnlyInstructionMatcher.hpp
@@ -27,7 +27,8 @@ public:
 
     virtual void EmitOutOfLine(
         StubBodyBuilder& body,
-        std::span<const std::uint8_t> instruction
+        std::span<const std::uint8_t> instruction,
+        bool allowInPlace = false
     ) const = 0;
 };
 
diff --git a/core/relinker/codegen/include/codegen/x86/MaskedStoreLowering.hpp b/core/relinker/codegen/include/codegen/x86/MaskedStoreLowering.hpp
new file mode 100644
index 0000000000..d03957a542
--- /dev/null
+++ b/core/relinker/codegen/include/codegen/x86/MaskedStoreLowering.hpp
@@ -0,0 +1,27 @@
+#ifndef CODEGEN_X86_MASKEDSTORELOWERING_HPP
+#define CODEGEN_X86_MASKEDSTORELOWERING_HPP
+
+#include <codegen/x86/StubBodyBuilder.hpp>
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <vector>
+
+namespace Codegen {
+
+struct MaskedStoreOperands {
+    const char* Name;
+    std::uint8_t ElementSize;
+    bool Wide;
+    std::uint8_t Mask;
+    MemoryOperand Memory;
+    std::vector<std::uint8_t> Instruction;
+    std::size_t DisplacementOffset;
+};
+
+[[nodiscard]] std::optional<MaskedStoreOperands> DecodeMaskedStore(const std::uint8_t* data, std::size_t length);
+void EmitMaskedStore(StubBodyBuilder& body, const MaskedStoreOperands& operands);
+
+}
+
+#endif
diff --git a/core/relinker/codegen/include/codegen/x86/RedZoneFramer.hpp b/core/relinker/codegen/include/codegen/x86/RedZoneFramer.hpp
new file mode 100644
index 0000000000..a23fa23206
--- /dev/null
+++ b/core/relinker/codegen/include/codegen/x86/RedZoneFramer.hpp
@@ -0,0 +1,47 @@
+#ifndef CODEGEN_X86_REDZONEFRAMER_HPP
+#define CODEGEN_X86_REDZONEFRAMER_HPP
+
+#include <codegen/CodegenTypes.hpp>
+#include <domain/Types.hpp>
+#include <cstddef>
+#include <cstdint>
+#include <map>
+#include <string>
+#include <vector>
+
+namespace Codegen {
+
+struct RedZoneFunction {
+    std::uint64_t Begin = 0;
+    std::uint64_t End = 0;
+};
+
+struct RedZoneFrameReport {
+    std::size_t Functions = 0;
+    std::size_t RedZoneFunctions = 0;
+    std::size_t Framed = 0;
+    std::size_t FramedWithoutFramePointer = 0;
+    std::size_t Exits = 0;
+    std::size_t MovedOperands = 0;
+    std::size_t OperandStubs = 0;
+    std::size_t StubbedOperands = 0;
+    std::map<std::string, std::size_t> Skipped;
+};
+
+struct RedZoneDisplacement {
+    Domain::FileByteOffset Offset;
+    std::vector<std::uint8_t> Bytes;
+};
+
+std::vector<TrampolineSite> FrameRedZoneFunctions(
+    const std::vector<std::uint8_t>& fileBytes,
+    const std::vector<Domain::ProgramHeader>& codeSegments,
+    const std::vector<RedZoneFunction>& functions,
+    const std::vector<TrampolineSite>& existing,
+    RedZoneFrameReport& report,
+    std::vector<RedZoneDisplacement>& displacements
+);
+
+}
+
+#endif
diff --git a/core/relinker/codegen/src/Amd64OnlyConverter.cpp b/core/relinker/codegen/src/Amd64OnlyConverter.cpp
index 8f312031fe..de510c4224 100644
--- a/core/relinker/codegen/src/Amd64OnlyConverter.cpp
+++ b/core/relinker/codegen/src/Amd64OnlyConverter.cpp
@@ -56,6 +56,7 @@ public:
     ) : _seg(seg), _matches(matches), _ph(ph), _branchTargets(branchTargets), _pending(pending), _claimed(claimed), _matcher(matcher) {}
 
     [[nodiscard]] std::optional<Placement> Window(const std::size_t index) const {
+        std::optional<Placement> fallback;
         for (const bool avoidSegment : {true, false}) {
             if (index + 1 < _matches.size() && (_pending.contains(index + 1) || _movable(index + 1, true, avoidSegment))) {
                 if (auto placement = _relocate(index, index, index + 1))
@@ -65,8 +66,10 @@ public:
                 if (auto placement = _relocate(index, index - 1, index))
                     return placement;
             }
+            if (!fallback && index + 1 < _matches.size() && _pending.contains(index + 1))
+                fallback = _relocate(index, index, index + 1, true);
         }
-        return std::nullopt;
+        return fallback;
     }
 
     [[nodiscard]] std::optional<Placement> Island(const std::size_t index) {
@@ -130,7 +133,7 @@ private:
         };
     }
 
-    [[nodiscard]] std::optional<Placement> _relocate(const std::size_t index, const std::size_t first, const std::size_t last) const {
+    [[nodiscard]] std::optional<Placement> _relocate(const std::size_t index, const std::size_t first, const std::size_t last, const bool allowInPlace = false) const {
         if (_entered(_address(first), _end(last)))
             return std::nullopt;
         StubBodyBuilder body;
@@ -138,7 +141,7 @@ private:
         try {
             for (auto k = first; k <= last; ++k) {
                 if (_pending.contains(k)) {
-                    _matcher.EmitOutOfLine(body, _bytes(k));
+                    _matcher.EmitOutOfLine(body, _bytes(k), allowInPlace);
                     if (k != index)
                         placement.Consumed.push_back(k);
                 } else {
diff --git a/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp b/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp
index 739a3aea7f..065e2ad80e 100644
--- a/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp
+++ b/core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp
@@ -15,6 +15,7 @@
 #include <codegen/x86/ScalarCompareOperands.hpp>
 #include <codegen/x86/WideStoreLowering.hpp>
 #include <codegen/x86/WideStoreOperands.hpp>
+#include <codegen/x86/MaskedStoreLowering.hpp>
 #include <codegen/x86/AndnLowering.hpp>
 #include <codegen/x86/X64InstructionDecoder.hpp>
 #include <codegen/x86/X64OpcodeConstants.hpp>
@@ -172,7 +173,8 @@ public:
 
     void EmitOutOfLine(
         StubBodyBuilder& body,
-        std::span<const std::uint8_t> instruction
+        std::span<const std::uint8_t> instruction,
+        bool allowInPlace = false
     ) const override;
 
 private:
@@ -258,6 +260,11 @@ std::optional<Amd64OnlyMatch> Amd64OnlyInstructionMatcher::_matchRosetta(const D
     }
     if (instr.IsClwb())
         return _inPlace(kClwb, instr.Length, {});
+    if (instr.IsXsaveopt()) {
+        std::vector<std::uint8_t> replacement(instr.Data, instr.Data + instr.Length);
+        replacement[instr.OpcodeOffset() + 2] &= static_cast<std::uint8_t>(~(2u << X64OpcodeConstants::ModRmRegShift));
+        return Amd64OnlyMatch{kXsaveopt.Name, instr.Length, Amd64OnlyLowering::InPlace, std::move(replacement), {}, 0};
+    }
     if (instr.IsRdpid())
         return _trampoline(kRdpid.Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { body.Raw(_rdpidReplacement(instr)); }), true);
     if (instr.IsRdtscp())
@@ -266,6 +273,8 @@ std::optional<Amd64OnlyMatch> Amd64OnlyInstructionMatcher::_matchRosetta(const D
         return _trampoline(kWideStore.Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { _wideStoreLowering.EmitOutOfLine(body, *wide); }), false, true);
     if (const auto compare = DecodeScalarCompare(instr.Data, instr.Length))
         return _trampoline(kScalarCompare.Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { _emitScalarCompare(body, instr, *compare); }), true);
+    if (const auto masked = DecodeMaskedStore(instr.Data, instr.Length))
+        return _trampoline(masked->Name, instr.Length, _outOfLine(instr.Length, trailing, [&](StubBodyBuilder& body) { EmitMaskedStore(body, *masked); }));
     return std::nullopt;
 }
 
@@ -325,6 +334,10 @@ const char* Amd64OnlyInstructionMatcher::_emitOutOfLine(StubBodyBuilder& body, c
         _emitScalarCompare(body, instr, *compare);
         return kScalarCompare.Name;
     }
+    if (const auto masked = _target == Amd64OnlyTarget::Rosetta ? DecodeMaskedStore(instr.Data, instr.Length) : std::nullopt) {
+        EmitMaskedStore(body, *masked);
+        return masked->Name;
+    }
     return nullptr;
 }
 
@@ -355,8 +368,12 @@ const char* Amd64OnlyInstructionMatcher::_emitInPlace(StubBodyBuilder& body, con
     return nullptr;
 }
 
-void Amd64OnlyInstructionMatcher::EmitOutOfLine(StubBodyBuilder& body, const std::span<const std::uint8_t> instruction) const {
-    if (_emitOutOfLine(body, DecodedInstruction{instruction.data(), instruction.size()}) == nullptr)
+void Amd64OnlyInstructionMatcher::EmitOutOfLine(StubBodyBuilder& body, const std::span<const std::uint8_t> instruction, const bool allowInPlace) const {
+    const DecodedInstruction instr{instruction.data(), instruction.size()};
+    const auto* emitted = _emitOutOfLine(body, instr);
+    if (emitted == nullptr && allowInPlace)
+        emitted = _emitInPlace(body, instr);
+    if (emitted == nullptr)
         throw CodegenException("AMD-only instruction has no out-of-line lowering");
     body.Advance(instruction.size());
 }
diff --git a/core/relinker/codegen/src/x86/DecodedInstruction.cpp b/core/relinker/codegen/src/x86/DecodedInstruction.cpp
index d54ce541bc..fa32c87812 100644
--- a/core/relinker/codegen/src/x86/DecodedInstruction.cpp
+++ b/core/relinker/codegen/src/x86/DecodedInstruction.cpp
@@ -324,6 +324,21 @@ bool DecodedInstruction::IsClwb() const {
            ((modrm >> ModRmModShift) & ModRmModMask) != ModRmModRegister && ((modrm >> ModRmRegShift) & ModRmRegMask) == 6;
 }
 
+bool DecodedInstruction::IsXsaveopt() const {
+    bool operandSizeOverride = false;
+    bool repnePrefix = false;
+    bool repPrefix = false;
+    const std::size_t pos = _skipPrefixesAndRex(&operandSizeOverride, &repnePrefix, &repPrefix);
+
+    if (operandSizeOverride || repnePrefix || repPrefix || pos + 2 >= Length) {
+        return false;
+    }
+
+    const auto modrm = Data[pos + 2];
+    return Data[pos] == TwoByteOpcodeEscape && Data[pos + 1] == TwoByteGrp15 &&
+           ((modrm >> ModRmModShift) & ModRmModMask) != ModRmModRegister && ((modrm >> ModRmRegShift) & ModRmRegMask) == 6;
+}
+
 bool DecodedInstruction::IsMovntss() const {
     bool operandSizeOverride = false;
     bool repnePrefix = false;
diff --git a/core/relinker/codegen/src/x86/MaskedStoreLowering.cpp b/core/relinker/codegen/src/x86/MaskedStoreLowering.cpp
new file mode 100644
index 0000000000..642cee81ff
--- /dev/null
+++ b/core/relinker/codegen/src/x86/MaskedStoreLowering.cpp
@@ -0,0 +1,102 @@
+#include <codegen/x86/MaskedStoreLowering.hpp>
+#include <codegen/CodegenException.hpp>
+#include <algorithm>
+#include <array>
+#include <limits>
+
+namespace Codegen {
+
+namespace {
+
+constexpr std::int32_t kFrameSize = 128 + 3 * 8;
+constexpr std::uint8_t kAddress = 0;
+constexpr std::uint8_t kVexMap0F38 = 0x02;
+constexpr std::uint8_t kVexPp66 = 0x01;
+
+bool _prefix(std::uint8_t value) {
+    return value == 0x2E || value == 0x36 || value == 0x3E || value == 0x26 || value == 0x64 || value == 0x65 || value == 0x67;
+}
+
+void _append32(std::vector<std::uint8_t>& bytes, std::int32_t value) {
+    for (unsigned shift = 0; shift < 32; shift += 8)
+        bytes.push_back(static_cast<std::uint8_t>(static_cast<std::uint32_t>(value) >> shift));
+}
+
+void _address(StubBodyBuilder& body, const MemoryOperand& memory) {
+    auto displacement = static_cast<std::int64_t>(memory.Displacement);
+    if (memory.StackBase) displacement += kFrameSize;
+    const bool address32 = std::find(memory.Prefixes.begin(), memory.Prefixes.end(), 0x67) != memory.Prefixes.end();
+    if (!address32 && displacement > std::numeric_limits<std::int32_t>::max())
+        throw CodegenException("Masked store stack displacement does not fit after spilling");
+    const auto mod = memory.StackBase ? 2 : memory.Mod;
+    auto bytes = memory.Prefixes;
+    bytes.push_back(static_cast<std::uint8_t>(0x48 | memory.RexIndexBase));
+    bytes.push_back(0x8D);
+    bytes.push_back(static_cast<std::uint8_t>((mod << 6) | (kAddress << 3) | memory.Rm));
+    if (memory.Rm == 4) bytes.push_back(memory.Sib);
+    const auto offset = bytes.size();
+    if (mod == 1) bytes.push_back(static_cast<std::uint8_t>(displacement));
+    if (mod == 2 || (mod == 0 && (memory.RipRelative || (memory.Rm == 4 && (memory.Sib & 7) == 5))))
+        _append32(bytes, static_cast<std::int32_t>(displacement));
+    if (memory.RipRelative)
+        body.RipRelative(bytes, offset, static_cast<std::int64_t>(memory.InstructionLength) + memory.Displacement);
+    else
+        body.Raw(bytes);
+}
+
+}
+
+std::optional<MaskedStoreOperands> DecodeMaskedStore(const std::uint8_t* data, const std::size_t length) {
+    std::size_t vex = 0;
+    while (vex < length && _prefix(data[vex])) ++vex;
+    if (vex + 5 > length || data[vex] != 0xC4 || (data[vex + 1] & 0x1F) != kVexMap0F38 || (data[vex + 2] & 3) != kVexPp66 || (data[vex + 4] >> 6) == 3)
+        return std::nullopt;
+    const bool w = (data[vex + 2] & 0x80) != 0;
+    const char* name = nullptr;
+    std::uint8_t elementSize = 4;
+    if (data[vex + 3] == 0x2E && !w) {
+        name = "VMASKMOVPS";
+    } else if (data[vex + 3] == 0x2F && !w) {
+        name = "VMASKMOVPD";
+        elementSize = 8;
+    } else if (data[vex + 3] == 0x8E) {
+        name = w ? "VPMASKMOVQ" : "VPMASKMOVD";
+        elementSize = w ? 8 : 4;
+    } else {
+        return std::nullopt;
+    }
+    const auto extensions = static_cast<std::uint8_t>(~data[vex + 1]);
+    const auto rex = static_cast<std::uint8_t>(((extensions & 0x20) >> 5) | ((extensions & 0x40) >> 5));
+    auto memory = DecodeMemoryOperand(data, length, vex + 4, rex, {data, data + vex});
+    if (vex + 4 + memory.EncodedSize != length)
+        throw CodegenException("Masked store memory operand has trailing bytes");
+    const auto displacementOffset = vex + 5 + (memory.Rm == 4 ? 1 : 0);
+    return MaskedStoreOperands{name, elementSize, (data[vex + 2] & 4) != 0, static_cast<std::uint8_t>((~data[vex + 2] >> 3) & 15),
+        std::move(memory), std::vector<std::uint8_t>(data, data + length), displacementOffset};
+}
+
+void EmitMaskedStore(StubBodyBuilder& body, const MaskedStoreOperands& operands) {
+    const auto& memory = operands.Memory;
+    body.Raw(std::array<std::uint8_t, 8>{0x48, 0x8D, 0x64, 0x24, 0x80, 0x9C, 0x50, 0x51});
+    _address(body, memory);
+    body.Raw(std::array<std::uint8_t, 5>{0xC4, static_cast<std::uint8_t>(operands.Mask >= 8 ? 0xC1 : 0xE1),
+        static_cast<std::uint8_t>(0x78 | (operands.Wide ? 4 : 0) | (operands.ElementSize == 8 ? 1 : 0)), 0x50,
+        static_cast<std::uint8_t>(0xC8 | (operands.Mask & 7))});
+    const auto elements = (operands.Wide ? 32u : 16u) / operands.ElementSize;
+    for (unsigned element = 0; element < elements; ++element) {
+        std::vector<std::uint8_t> probes;
+        for (const auto offset : {element * operands.ElementSize, element * operands.ElementSize + operands.ElementSize - 1u}) {
+            probes.insert(probes.end(), memory.Prefixes.begin(), memory.Prefixes.end());
+            probes.insert(probes.end(), {0xF0, 0x80, 0x48, static_cast<std::uint8_t>(offset), 0x00});
+        }
+        body.Raw(std::array<std::uint8_t, 5>{0xF6, 0xC1, static_cast<std::uint8_t>(1u << element), 0x74, static_cast<std::uint8_t>(probes.size())});
+        body.Raw(probes);
+    }
+    body.Raw(std::array<std::uint8_t, 11>{0x59, 0x58, 0x9D, 0x48, 0x8D, 0xA4, 0x24, 0x80, 0x00, 0x00, 0x00});
+    if (memory.RipRelative)
+        body.RipRelative(operands.Instruction, operands.DisplacementOffset, static_cast<std::int64_t>(memory.InstructionLength) + memory.Displacement);
+    else
+        body.Raw(operands.Instruction);
+}
+
+}
diff --git a/core/relinker/codegen/src/x86/RedZoneFramer.cpp b/core/relinker/codegen/src/x86/RedZoneFramer.cpp
new file mode 100644
index 0000000000..cfe714faef
--- /dev/null
+++ b/core/relinker/codegen/src/x86/RedZoneFramer.cpp
@@ -0,0 +1,441 @@
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <codegen/IInstructionScanner.hpp>
+#include <codegen/x86/X64InstructionDecoder.hpp>
+#include <algorithm>
+#include <cstring>
+#include <iterator>
+#include <limits>
+#include <map>
+#include <optional>
+#include <set>
+
+namespace Codegen {
+
+namespace {
+
+constexpr std::uint8_t kRegRsp = 4;
+constexpr std::uint8_t kRegRbp = 5;
+constexpr std::size_t kJumpBytes = 5;
+constexpr std::int64_t kRedZoneBytes = 0x80;
+constexpr std::int64_t kStackAlignment = 16;
+constexpr std::uint8_t kJumpBack[] = {0xe9, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<std::uint8_t> lowerRsp(const std::int64_t shift) {
+    return {0x48, 0x8d, 0x64, 0x24, static_cast<std::uint8_t>(-shift)};
+}
+
+std::vector<std::uint8_t> raiseRsp(const std::int64_t shift) {
+    const auto value = static_cast<std::uint32_t>(shift);
+    return {0x48, 0x8d, 0xa4, 0x24, static_cast<std::uint8_t>(value), static_cast<std::uint8_t>(value >> 8), static_cast<std::uint8_t>(value >> 16), static_cast<std::uint8_t>(value >> 24)};
+}
+
+struct Insn {
+    std::size_t Offset;
+    std::size_t Length;
+    DecodedInstructionInfo Info;
+};
+
+std::optional<std::uint8_t> pushedRegister(const std::uint8_t* code, const Insn& insn) {
+    if (insn.Length == 1 && code[0] >= 0x50 && code[0] <= 0x57 && code[0] != 0x50 + kRegRsp) return static_cast<std::uint8_t>(code[0] - 0x50);
+    if (insn.Length == 2 && code[0] == 0x41 && code[1] >= 0x50 && code[1] <= 0x57) return static_cast<std::uint8_t>(code[1] - 0x50 + 8);
+    return std::nullopt;
+}
+
+std::optional<std::uint8_t> poppedRegister(const std::uint8_t* code, const Insn& insn) {
+    if (insn.Length == 1 && code[0] >= 0x58 && code[0] <= 0x5f && code[0] != 0x58 + kRegRsp) return static_cast<std::uint8_t>(code[0] - 0x58);
+    if (insn.Length == 2 && code[0] == 0x41 && code[1] >= 0x58 && code[1] <= 0x5f) return static_cast<std::uint8_t>(code[1] - 0x58 + 8);
+    return std::nullopt;
+}
+
+std::optional<std::int64_t> rspAdjustment(const std::uint8_t* code, const Insn& insn) {
+    std::int32_t value = 0;
+    if (insn.Length == 4 && code[0] == 0x48 && code[1] == 0x83 && (code[2] == 0xec || code[2] == 0xc4)) {
+        const std::int64_t amount = static_cast<std::int8_t>(code[3]);
+        return code[2] == 0xec ? -amount : amount;
+    }
+    if (insn.Length == 7 && code[0] == 0x48 && code[1] == 0x81 && (code[2] == 0xec || code[2] == 0xc4)) {
+        std::memcpy(&value, code + 3, 4);
+        return code[2] == 0xec ? -std::int64_t{value} : std::int64_t{value};
+    }
+    if (insn.Length == 5 && std::memcmp(code, "\x48\x8d\x64\x24", 4) == 0) return static_cast<std::int8_t>(code[4]);
+    if (insn.Length == 8 && std::memcmp(code, "\x48\x8d\xa4\x24", 4) == 0) {
+        std::memcpy(&value, code + 4, 4);
+        return value;
+    }
+    return std::nullopt;
+}
+
+struct MemoryUse {
+    bool UsesRsp = false;
+    bool RegisterRsp = false;
+    bool RbpBased = false;
+    std::int64_t RbpDisp = 0;
+    bool RspBased = false;
+    std::int64_t RspDisp = 0;
+    std::uint8_t Mod = 0;
+    std::size_t DispOffset = 0;
+    bool Indexed = false;
+    bool Address = false;
+};
+
+void extensionBits(const std::uint8_t* code, const Insn& insn, bool& r, bool& x, bool& b) {
+    const auto& info = insn.Info;
+    r = x = b = false;
+    if (info.RexPrefix != 0) {
+        r = (info.RexPrefix & 4) != 0;
+        x = (info.RexPrefix & 2) != 0;
+        b = (info.RexPrefix & 1) != 0;
+        return;
+    }
+    const auto lead = code[info.OpcodeOffset];
+    if ((lead == 0xc4 || lead == 0x8f || lead == 0x62) && info.OpcodeOffset + 1 < insn.Length) {
+        r = (code[info.OpcodeOffset + 1] & 0x80) == 0;
+        x = (code[info.OpcodeOffset + 1] & 0x40) == 0;
+        b = (code[info.OpcodeOffset + 1] & 0x20) == 0;
+    } else if (lead == 0xc5 && info.OpcodeOffset + 1 < insn.Length) {
+        r = (code[info.OpcodeOffset + 1] & 0x80) == 0;
+    }
+}
+
+bool twoByteRegisterIsGeneral(const std::uint8_t op) {
+    return (op >= 0x40 && op <= 0x4f) || op == 0xa3 || op == 0xa4 || op == 0xa5 || op == 0xab || op == 0xac || op == 0xad || op == 0xaf || op == 0xb0 || op == 0xb1 || op == 0xb3 || op == 0xb6 || op == 0xb7 || op == 0xb8 || (op >= 0xbb && op <= 0xbf) || op == 0xc0 || op == 0xc1 || op == 0xc3;
+}
+
+bool twoByteRmIsGeneral(const std::uint8_t op) {
+    return twoByteRegisterIsGeneral(op) || op == 0x6e || op == 0x7e || op == 0xba;
+}
+
+bool vexGeneralUsesRsp(const std::uint8_t* code, const Insn& insn, const std::uint8_t mod, const std::uint8_t reg, const std::uint8_t rm, const bool r, const bool b) {
+    const auto at = insn.Info.OpcodeOffset;
+    const auto lead = code[at];
+    if ((lead != 0xc4 && lead != 0xc5) || at + 3 >= insn.Length) return false;
+    const auto map = lead == 0xc5 ? std::uint8_t{1} : static_cast<std::uint8_t>(code[at + 1] & 0x1f);
+    const auto vvvv = static_cast<std::uint8_t>((~code[lead == 0xc5 ? at + 1 : at + 2] >> 3) & 0xf);
+    const auto op = code[lead == 0xc5 ? at + 2 : at + 3];
+    const bool general = (map == 2 && (op == 0xf2 || op == 0xf3 || op == 0xf5 || op == 0xf6 || op == 0xf7)) || (map == 3 && op == 0xf0);
+    return general && ((reg == kRegRsp && !r) || (mod == 3 && rm == kRegRsp && !b) || vvvv == kRegRsp);
+}
+
+MemoryUse memoryUse(const std::uint8_t* code, const Insn& insn) {
+    MemoryUse use;
+    const auto& info = insn.Info;
+    if (!info.HasModRm || info.ModRmOffset == 0 || info.ModRmOffset >= insn.Length) return use;
+    bool r = false;
+    bool x = false;
+    bool b = false;
+    extensionBits(code, insn, r, x, b);
+    const auto modrm = info.ModRmByte;
+    const auto mod = static_cast<std::uint8_t>(modrm >> 6);
+    const auto reg = static_cast<std::uint8_t>((modrm >> 3) & 7);
+    const auto rm = static_cast<std::uint8_t>(modrm & 7);
+    const bool vex = info.RexPrefix == 0 && (code[info.OpcodeOffset] == 0xc4 || code[info.OpcodeOffset] == 0xc5 || code[info.OpcodeOffset] == 0x62 || code[info.OpcodeOffset] == 0x8f);
+    if (!vex && !info.IsTwoByteOpcode && reg == kRegRsp && !r) {
+        const auto op = info.Opcode;
+        if ((op <= 0x3f && (op & 7) <= 3) || (op >= 0x84 && op <= 0x8b) || op == 0x8d) use.UsesRsp = use.RegisterRsp = true;
+    }
+    if (!vex && info.IsTwoByteOpcode && ((reg == kRegRsp && !r && twoByteRegisterIsGeneral(info.Opcode)) || (mod == 3 && rm == kRegRsp && !b && twoByteRmIsGeneral(info.Opcode)))) use.UsesRsp = use.RegisterRsp = true;
+    if (vex && vexGeneralUsesRsp(code, insn, mod, reg, rm, r, b)) use.UsesRsp = use.RegisterRsp = true;
+    if (mod == 3) {
+        const bool generalPurpose = !vex && !info.IsTwoByteOpcode && !(info.Opcode >= 0xd8 && info.Opcode <= 0xdf);
+        if (generalPurpose && rm == kRegRsp && !b) use.UsesRsp = use.RegisterRsp = true;
+        return use;
+    }
+    std::size_t at = info.ModRmOffset + 1;
+    std::uint8_t base = rm;
+    bool baseExtended = b;
+    bool indexed = false;
+    if (rm == 4) {
+        if (at >= insn.Length) return use;
+        const auto sib = code[at++];
+        base = sib & 7;
+        indexed = ((sib >> 3) & 7) != 4 || x;
+        if (mod == 0 && base == 5) return use;
+    } else if (mod == 0 && rm == 5) {
+        return use;
+    }
+    std::int64_t disp = 0;
+    if (mod == 1 && at < insn.Length) disp = static_cast<std::int8_t>(code[at]);
+    if (mod == 2 && at + 4 <= insn.Length) {
+        std::int32_t value = 0;
+        std::memcpy(&value, code + at, 4);
+        disp = value;
+    }
+    if (base == kRegRsp && !baseExtended) {
+        use.UsesRsp = true;
+        use.RspBased = true;
+        use.RspDisp = disp;
+        use.Mod = mod;
+        use.DispOffset = at;
+        use.Indexed = indexed;
+        use.Address = !vex && !info.IsTwoByteOpcode && info.Opcode == 0x8d;
+    }
+    if (base == kRegRbp && !baseExtended && mod != 0) {
+        use.RbpBased = true;
+        use.RbpDisp = disp;
+    }
+    return use;
+}
+
+std::optional<std::vector<std::uint8_t>> movedDisplacement(const MemoryUse& use, const std::int64_t shift) {
+    const auto moved = use.RspDisp + shift;
+    if (use.Mod == 1 && moved <= std::numeric_limits<std::int8_t>::max()) return std::vector<std::uint8_t>{static_cast<std::uint8_t>(moved)};
+    if (use.Mod == 2 && moved <= std::numeric_limits<std::int32_t>::max()) {
+        const auto value = static_cast<std::uint32_t>(static_cast<std::int32_t>(moved));
+        return std::vector<std::uint8_t>{static_cast<std::uint8_t>(value), static_cast<std::uint8_t>(value >> 8), static_cast<std::uint8_t>(value >> 16), static_cast<std::uint8_t>(value >> 24)};
+    }
+    return std::nullopt;
+}
+
+std::optional<std::vector<std::uint8_t>> withDisplacement(const std::uint8_t* code, const Insn& insn, const MemoryUse& use, const std::int64_t disp) {
+    if (disp < std::numeric_limits<std::int32_t>::min() || disp > std::numeric_limits<std::int32_t>::max()) return std::nullopt;
+    const std::size_t oldBytes = use.Mod == 1 ? 1 : use.Mod == 2 ? 4 : 0;
+    if (use.DispOffset + oldBytes > insn.Length) return std::nullopt;
+    const bool narrow = disp >= std::numeric_limits<std::int8_t>::min() && disp <= std::numeric_limits<std::int8_t>::max();
+    std::vector<std::uint8_t> bytes(code, code + use.DispOffset);
+    bytes[insn.Info.ModRmOffset] = static_cast<std::uint8_t>((bytes[insn.Info.ModRmOffset] & 0x3f) | (narrow ? 0x40 : 0x80));
+    const auto value = static_cast<std::uint32_t>(static_cast<std::int32_t>(disp));
+    for (std::size_t index = 0; index < (narrow ? 1u : 4u); ++index) bytes.push_back(static_cast<std::uint8_t>(value >> (8 * index)));
+    bytes.insert(bytes.end(), code + use.DispOffset + oldBytes, code + insn.Length);
+    return bytes;
+}
+
+struct OperandStub {
+    std::size_t First;
+    std::size_t Last;
+    std::size_t Begin;
+    std::size_t End;
+    std::vector<std::uint8_t> Body;
+    std::size_t Operands = 0;
+};
+
+void frameSegment(
+    const std::vector<std::uint8_t>& fileBytes,
+    const Domain::ProgramHeader& ph,
+    const std::vector<RedZoneFunction>& functions,
+    const std::vector<TrampolineSite>& existing,
+    std::vector<TrampolineSite>& sites,
+    std::vector<RedZoneDisplacement>& displacements,
+    RedZoneFrameReport& report
+) {
+    const auto segOffset = static_cast<std::size_t>(ph.Offset);
+    const auto segSize = static_cast<std::size_t>(ph.FileSize);
+    if (segOffset > fileBytes.size() || segSize > fileBytes.size() - segOffset) return;
+    const std::vector<std::uint8_t> seg(fileBytes.begin() + static_cast<std::ptrdiff_t>(segOffset), fileBytes.begin() + static_cast<std::ptrdiff_t>(segOffset + segSize));
+    const auto scanner = MakeInstructionScanner();
+    const X64InstructionDecoder decoder;
+
+    std::set<std::size_t> targets;
+    for (const auto& match : scanner->ScanCodeSection(seg, 0, seg.size())) {
+        const auto info = decoder.DecodeInstruction(seg.data() + match.Offset, match.Length);
+        if (!info.HasBranchTarget || info.HasRipRelativeDisp || info.FlowKind == ControlFlowKind::Call) continue;
+        const auto target = static_cast<std::int64_t>(match.Offset + match.Length) + info.BranchDisp;
+        if (target >= 0 && static_cast<std::size_t>(target) < seg.size()) targets.insert(static_cast<std::size_t>(target));
+    }
+    std::vector<std::pair<std::size_t, std::size_t>> taken;
+    for (const auto& site : existing) {
+        if (site.Address < ph.MappedAddress || site.Address >= ph.MappedAddress + segSize) continue;
+        const auto at = static_cast<std::size_t>(site.Address - ph.MappedAddress);
+        taken.emplace_back(at, at + site.Length);
+    }
+    const auto overlapsExisting = [&](const std::size_t begin, const std::size_t end) {
+        return std::any_of(taken.begin(), taken.end(), [&](const auto& range) { return begin < range.second && range.first < end; });
+    };
+    const auto targetInside = [&](const std::size_t begin, const std::size_t end) {
+        const auto hit = targets.upper_bound(begin);
+        return hit != targets.end() && *hit < end;
+    };
+    for (const auto& function : functions) {
+        if (function.Begin < ph.MappedAddress || function.End <= function.Begin || function.End - ph.MappedAddress > segSize) continue;
+        const auto start = static_cast<std::size_t>(function.Begin - ph.MappedAddress);
+        const auto limit = static_cast<std::size_t>(function.End - ph.MappedAddress);
+        ++report.Functions;
+        const auto skip = [&](const char* reason) { ++report.Skipped[reason]; };
+
+        const std::vector<std::uint8_t> code(seg.begin() + static_cast<std::ptrdiff_t>(start), seg.begin() + static_cast<std::ptrdiff_t>(limit));
+        std::vector<Insn> body;
+        for (const auto& match : scanner->ScanCodeSection(code, 0, code.size())) {
+            if (code[match.Offset] == 0xcc && match.Length == 1) break;
+            body.push_back({start + static_cast<std::size_t>(match.Offset), match.Length, decoder.DecodeInstruction(code.data() + match.Offset, match.Length)});
+        }
+        if (body.size() < 3) continue;
+        const auto at = [&](const std::size_t k) { return seg.data() + body[k].Offset; };
+        const bool rbpPrologue = body[0].Length == 1 && at(0)[0] == 0x55 && body[1].Length == 3 && std::memcmp(at(1), "\x48\x89\xe5", 3) == 0;
+        std::vector<std::uint8_t> pushed;
+        std::size_t p = rbpPrologue ? 2 : 0;
+        while (p < body.size())
+            if (const auto reg = pushedRegister(at(p), body[p])) { pushed.push_back(*reg); ++p; } else break;
+        std::int64_t allocation = 0;
+        if (!rbpPrologue && p < body.size())
+            if (const auto adjustment = rspAdjustment(at(p), body[p]); adjustment && *adjustment < 0) { allocation = -*adjustment; ++p; }
+        std::vector<std::uint8_t> expected(pushed.begin(), pushed.end());
+        if (rbpPrologue) expected.insert(expected.begin(), kRegRbp);
+        const auto popsBefore = [&](const std::size_t k) -> std::optional<std::size_t> {
+            std::size_t q = k;
+            std::vector<std::uint8_t> popped;
+            while (q > p && popped.size() < expected.size())
+                if (const auto reg = poppedRegister(at(q - 1), body[q - 1])) { popped.push_back(*reg); --q; } else break;
+            if (popped != expected) return std::nullopt;
+            return q;
+        };
+        std::set<std::size_t> frees;
+        if (allocation > 0)
+            for (std::size_t k = p; k < body.size(); ++k)
+                if (body[k].Info.FlowKind == ControlFlowKind::Return)
+                    if (const auto q = popsBefore(k); q && *q > p && rspAdjustment(at(*q - 1), body[*q - 1]) == allocation) frees.insert(*q - 1);
+
+        bool leaf = true;
+        bool redZone = false;
+        const char* reason = nullptr;
+        std::vector<std::pair<std::size_t, std::size_t>> exits;
+        std::map<std::size_t, std::pair<std::size_t, std::vector<std::uint8_t>>> moves;
+        std::vector<std::size_t> stubbed;
+        const auto functionEnd = limit;
+        std::int64_t depth = 0;
+        bool wholeRedZone = rbpPrologue;
+        for (std::size_t k = p; k < body.size(); ++k) {
+            const auto use = memoryUse(at(k), body[k]);
+            if (!use.RspBased) continue;
+            if (use.RspDisp < 0) depth = std::max(depth, -use.RspDisp);
+            if (use.Indexed || (use.Address && use.RspDisp < 0)) wholeRedZone = true;
+        }
+        const auto shift = wholeRedZone ? kRedZoneBytes : std::min(kRedZoneBytes, (depth + kStackAlignment - 1) / kStackAlignment * kStackAlignment);
+        for (std::size_t k = p; k < body.size(); ++k) {
+            const auto& insn = body[k];
+            const auto* code = at(k);
+            const auto flow = insn.Info.FlowKind;
+            if (flow == ControlFlowKind::Call || flow == ControlFlowKind::IndirectCall) { leaf = false; break; }
+            if (frees.contains(k)) continue;
+            const auto use = memoryUse(code, insn);
+            if (use.RbpBased && rbpPrologue && use.RbpDisp < -static_cast<std::int64_t>(8 * pushed.size())) redZone = true;
+            if (use.RspBased && use.RspDisp < 0) redZone = true;
+            if (reason != nullptr) continue;
+            if (code[insn.Info.OpcodeOffset] == 0xc9 || code[insn.Info.OpcodeOffset] == 0xc8) { reason = "leave or enter"; continue; }
+            if (rbpPrologue) {
+                if (use.UsesRsp) { reason = "other use of rsp"; continue; }
+            } else {
+                if (use.RegisterRsp) { reason = "other use of rsp"; continue; }
+                if (use.RspBased) {
+                    if (code[insn.Info.OpcodeOffset] == 0x62) { reason = "rsp operand that cannot move with rsp"; continue; }
+                    if (overlapsExisting(insn.Offset, insn.Offset + insn.Length)) { reason = "overlaps another stub"; continue; }
+                    if (auto moved = movedDisplacement(use, shift)) moves.emplace(k, std::pair{insn.Offset + use.DispOffset, std::move(*moved)});
+                    else stubbed.push_back(k);
+                }
+            }
+            if (flow == ControlFlowKind::IndirectJump) { reason = "indirect jump"; continue; }
+            if ((flow == ControlFlowKind::UnconditionalJump || flow == ControlFlowKind::ConditionalBranch) && insn.Info.HasBranchTarget) {
+                const auto target = static_cast<std::int64_t>(insn.Offset + insn.Length) + insn.Info.BranchDisp;
+                if (insn.Info.HasRipRelativeDisp || target < static_cast<std::int64_t>(start) || target >= static_cast<std::int64_t>(functionEnd)) { reason = "branch leaves the function"; continue; }
+            }
+            if (flow == ControlFlowKind::Return) {
+                if (insn.Length != 1 || code[0] != 0xc3) { reason = "ret with an immediate"; continue; }
+                const auto pops = popsBefore(k);
+                if (!pops) { reason = "exit does not pop the prologue's registers"; continue; }
+                auto q = *pops;
+                if (allocation > 0) {
+                    if (q == p || !frees.contains(q - 1)) { reason = "exit does not free the prologue's allocation"; continue; }
+                    --q;
+                }
+                const auto siteStart = body[q].Offset;
+                const auto siteEnd = insn.Offset + 1;
+                if (siteEnd - siteStart < kJumpBytes) { reason = "exit shorter than a jump"; continue; }
+                if (targetInside(siteStart, siteEnd)) { reason = "branch into an exit"; continue; }
+                exits.emplace_back(siteStart, siteEnd);
+            }
+        }
+        if (!leaf || !redZone) continue;
+        ++report.RedZoneFunctions;
+        const auto prologueEnd = p > 0 ? body[p - 1].Offset + body[p - 1].Length : start;
+        if (reason == nullptr && ((pushed.empty() && allocation == 0) || prologueEnd - start < kJumpBytes)) reason = "prologue shorter than a jump";
+        if (reason == nullptr && targetInside(start, prologueEnd)) reason = "branch into the prologue";
+        if (reason == nullptr && exits.empty()) reason = "no ret exit";
+        if (reason == nullptr && (overlapsExisting(start, prologueEnd) || std::any_of(exits.begin(), exits.end(), [&](const auto& exit) { return overlapsExisting(exit.first, exit.second); }))) reason = "overlaps another stub";
+        std::vector<OperandStub> stubs;
+        const auto overlapsSite = [&](const std::size_t begin, const std::size_t end) {
+            if (begin < prologueEnd && start < end) return true;
+            if (std::any_of(exits.begin(), exits.end(), [&](const auto& exit) { return begin < exit.second && exit.first < end; })) return true;
+            return std::any_of(stubs.begin(), stubs.end(), [&](const OperandStub& stub) { return begin < stub.End && stub.Begin < end; });
+        };
+        for (const auto k : stubbed) {
+            if (reason != nullptr) break;
+            if (!stubs.empty() && k < stubs.back().Last) continue;
+            OperandStub stub{k, k, body[k].Offset, body[k].Offset, {}};
+            while (stub.Last < body.size() && stub.End - stub.Begin < kJumpBytes) {
+                const auto& covered = body[stub.Last];
+                if (covered.Offset != stub.End || covered.Info.FlowKind != ControlFlowKind::Sequential || covered.Info.HasRipRelativeDisp || frees.contains(stub.Last)) break;
+                const auto use = memoryUse(at(stub.Last), covered);
+                const auto bytes = use.RspBased ? withDisplacement(at(stub.Last), covered, use, use.RspDisp + shift) : std::vector<std::uint8_t>(at(stub.Last), at(stub.Last) + covered.Length);
+                if (!bytes) break;
+                stub.Body.insert(stub.Body.end(), bytes->begin(), bytes->end());
+                if (use.RspBased) ++stub.Operands;
+                stub.End += covered.Length;
+                ++stub.Last;
+            }
+            while (stub.End - stub.Begin < kJumpBytes && stub.First > p) {
+                const auto j = stub.First - 1;
+                const auto& prior = body[j];
+                if (prior.Offset + prior.Length != stub.Begin || prior.Info.FlowKind != ControlFlowKind::Sequential || prior.Info.HasRipRelativeDisp || frees.contains(j)) break;
+                const auto use = memoryUse(at(j), prior);
+                const auto bytes = use.RspBased ? withDisplacement(at(j), prior, use, use.RspDisp + shift) : std::vector<std::uint8_t>(at(j), at(j) + prior.Length);
+                if (!bytes) break;
+                stub.Body.insert(stub.Body.begin(), bytes->begin(), bytes->end());
+                if (use.RspBased) ++stub.Operands;
+                stub.Begin = prior.Offset;
+                stub.First = j;
+            }
+            if (stub.End - stub.Begin < kJumpBytes || targetInside(stub.Begin, stub.End) || overlapsSite(stub.Begin, stub.End) || overlapsExisting(stub.Begin, stub.End)) reason = "rsp operand that cannot move and has no room for a stub";
+            else stubs.push_back(std::move(stub));
+        }
+        if (reason != nullptr) { skip(reason); continue; }
+        for (const auto& stub : stubs)
+            for (auto k = stub.First; k < stub.Last; ++k) moves.erase(k);
+
+        const auto addSite = [&](const std::size_t begin, const std::size_t end, std::vector<std::uint8_t> code) {
+            TrampolineSite site;
+            site.Offset = ph.Offset + begin;
+            site.Address = ph.MappedAddress + begin;
+            site.Length = end - begin;
+            site.OriginalBytes.assign(seg.begin() + static_cast<std::ptrdiff_t>(begin), seg.begin() + static_cast<std::ptrdiff_t>(end));
+            site.ReturnBranchOffset = code.size();
+            code.insert(code.end(), std::begin(kJumpBack), std::end(kJumpBack));
+            site.Body = std::move(code);
+            taken.emplace_back(begin, end);
+            sites.push_back(std::move(site));
+        };
+        const auto original = [&](const std::size_t begin, const std::size_t end) { return std::vector<std::uint8_t>(seg.begin() + static_cast<std::ptrdiff_t>(begin), seg.begin() + static_cast<std::ptrdiff_t>(end)); };
+        auto entry = original(start, prologueEnd);
+        const auto lower = lowerRsp(shift);
+        entry.insert(entry.end(), lower.begin(), lower.end());
+        addSite(start, prologueEnd, std::move(entry));
+        for (const auto& exit : exits) {
+            auto code = raiseRsp(shift);
+            const auto tail = original(exit.first, exit.second);
+            code.insert(code.end(), tail.begin(), tail.end());
+            addSite(exit.first, exit.second, std::move(code));
+        }
+        for (auto& stub : stubs) addSite(stub.Begin, stub.End, std::move(stub.Body));
+        for (auto& [k, move] : moves) displacements.push_back({ph.Offset + move.first, std::move(move.second)});
+        ++report.Framed;
+        if (!rbpPrologue) ++report.FramedWithoutFramePointer;
+        report.Exits += exits.size();
+        report.MovedOperands += moves.size();
+        report.OperandStubs += stubs.size();
+        for (const auto& stub : stubs) report.StubbedOperands += stub.Operands;
+    }
+}
+
+}
+
+std::vector<TrampolineSite> FrameRedZoneFunctions(
+    const std::vector<std::uint8_t>& fileBytes,
+    const std::vector<Domain::ProgramHeader>& codeSegments,
+    const std::vector<RedZoneFunction>& functions,
+    const std::vector<TrampolineSite>& existing,
+    RedZoneFrameReport& report,
+    std::vector<RedZoneDisplacement>& displacements
+) {
+    std::vector<TrampolineSite> sites;
+    for (const auto& ph : codeSegments) frameSegment(fileBytes, ph, functions, existing, sites, displacements, report);
+    return sites;
+}
+
+}
diff --git a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
index b22c3f8726..0c2f5571c9 100644
--- a/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionDecoder.cpp
@@ -393,6 +393,7 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
         const std::uint8_t modrm = data[modrmPos];
         info.HasModRm = true;
         info.ModRmByte = modrm;
+        info.ModRmOffset = modrmPos;
         info.ModRmRegField = (modrm >> ModRmRegShift) & ModRmRegMask;
         const std::uint8_t mod = registerOnly ? ModRmModRegister : (modrm >> ModRmModShift) & ModRmModMask;
         const std::uint8_t rm = modrm & ModRmRmMask;
@@ -489,6 +490,7 @@ DecodedInstructionInfo X64InstructionDecoder::DecodeInstruction(
             std::uint8_t modrm = data[pos];
             info.HasModRm = true;
             info.ModRmByte = modrm;
+            info.ModRmOffset = pos;
             std::uint8_t reg = (modrm >> ModRmRegShift) & ModRmRegMask;
             info.ModRmRegField = reg;
             std::uint8_t mod = (modrm >> ModRmModShift) & ModRmModMask;
diff --git a/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp b/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp
index 212bdaee22..82990dd9ac 100644
--- a/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp
+++ b/core/relinker/codegen/src/x86/X64InstructionRewriter.cpp
@@ -96,6 +96,66 @@ RewriteResult X64InstructionRewriter::Rewrite(
     const auto cutStart = static_cast<std::int64_t>(offset);
     const std::int64_t cutEnd = cutStart + oldLength;
 
+    if (delta != 0) {
+        const auto sectionSize = static_cast<std::int64_t>(codeSection.size());
+
+        for (const auto& match : matches) {
+            const auto matchOffset = static_cast<std::int64_t>(match.Offset);
+            if (matchOffset >= cutStart && matchOffset < cutEnd)
+                continue;
+
+            const auto info = decoder.DecodeInstruction(
+                codeSection.data() + match.Offset, match.Length);
+
+            if (!info.TruncatesBranchTarget)
+                continue;
+
+            const auto opcodeLength = info.IsTwoByteOpcode ? 2u : 1u;
+            const auto displacementSize =
+                info.Length - info.OpcodeOffset - opcodeLength;
+            const auto displacementOffset =
+                match.Offset + info.Length - displacementSize;
+
+            std::int64_t branchDisplacement = 0;
+
+            if (displacementSize == 1) {
+                branchDisplacement =
+                    static_cast<std::int8_t>(codeSection[displacementOffset]);
+            } else if (displacementSize == 2) {
+                const auto raw = static_cast<std::uint16_t>(
+                    static_cast<std::uint16_t>(codeSection[displacementOffset]) |
+                    (static_cast<std::uint16_t>(
+                        codeSection[displacementOffset + 1]) << 8));
+                branchDisplacement = static_cast<std::int16_t>(raw);
+            } else {
+                throw CodegenException(
+                    "Unexpected displacement size for truncated relative branch",
+                    match.Offset);
+            }
+
+            const auto rawTargetPosition =
+                matchOffset + static_cast<std::int64_t>(info.Length)
+                + branchDisplacement;
+            if (rawTargetPosition < 0 || rawTargetPosition > 0xFFFF) {
+                throw CodegenException(
+                    "Cannot change code length while a truncated relative branch target wraps at 16 bits",
+                    match.Offset);
+            }
+            const auto targetPosition = rawTargetPosition;
+
+            const bool instrShifts =
+                matchOffset >= cutEnd && matchOffset < sectionSize;
+            const bool targetShifts =
+                targetPosition >= cutEnd && targetPosition < sectionSize;
+
+            if (instrShifts != targetShifts) {
+                throw CodegenException(
+                    "Cannot change code length while a truncated relative branch moves",
+                    match.Offset);
+            }
+        }
+    }
+
     std::vector<std::uint8_t> rewritten;
     rewritten.reserve(codeSection.size() + static_cast<std::size_t>(delta > 0 ? delta : 0));
     rewritten.insert(rewritten.end(), codeSection.begin(), codeSection.begin() + offset);
diff --git a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
index a03384cea7..ca2cf46715 100644
--- a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
+++ b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
@@ -21,6 +21,7 @@
 #include <elfpatcher/general/SegmentFilter.hpp>
 #include <elfpatcher/linux/LinuxElfPatcher.hpp>
 #include <io/ByteWriter.hpp>
+#include <algorithm>
 #include <array>
 #include <cmath>
 #include <cstring>
@@ -689,8 +690,8 @@ void rosettaSubstitutions() {
     const auto intel = Codegen::MakeAmd64OnlyInstructionMatcher();
     const auto rosetta = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
     const auto match = [](const auto& matcher, const Bytes& bytes) { return matcher->Match(bytes.data(), bytes.size()); };
-    for (const auto& bytes : {Bytes{0x0F, 0xC7, 0xF8}, Bytes{0xF3, 0x0F, 0xC7, 0xF8}, Bytes{0x66, 0x0F, 0xAE, 0x30}, Bytes{0x0F, 0x01, 0xF9}})
-        require(!match(intel, bytes).has_value(), "RDSEED, RDPID, CLWB or RDTSCP was converted for an Intel host");
+    for (const auto& bytes : {Bytes{0x0F, 0xC7, 0xF8}, Bytes{0xF3, 0x0F, 0xC7, 0xF8}, Bytes{0x66, 0x0F, 0xAE, 0x30}, Bytes{0x0F, 0x01, 0xF9}, Bytes{0x0F, 0xAE, 0x37}})
+        require(!match(intel, bytes).has_value(), "RDSEED, RDPID, CLWB, RDTSCP or XSAVEOPT was converted for an Intel host");
     const auto rdseed = match(rosetta, {0x48, 0x0F, 0xC7, 0xF9});
     require(rdseed && rdseed->Lowering == Amd64OnlyLowering::InPlace && rdseed->ReplacementBytes == Bytes{0x48, 0x0F, 0xC7, 0xF1} && rdseed->InstructionName == "RDSEED", "RDSEED was not rewritten to RDRAND");
     const auto rdseed16 = match(rosetta, {0x66, 0x41, 0x0F, 0xC7, 0xFA});
@@ -700,6 +701,18 @@ void rosettaSubstitutions() {
     require(clwb && clwb->Lowering == Amd64OnlyLowering::InPlace && clwb->ReplacementBytes == Bytes{0x66, 0x0F, 0x1F, 0x44, 0x00, 0x00} && clwb->InstructionName == "CLWB", "CLWB was not replaced by a NOP");
     require(!match(rosetta, {0x66, 0x0F, 0xAE, 0xF1}).has_value(), "TPAUSE (the register form of 66 0F AE /6) was taken for CLWB");
     require(!match(rosetta, {0x66, 0x0F, 0xAE, 0x38}).has_value(), "CLFLUSHOPT was taken for CLWB");
+    const auto xsaveopt = match(rosetta, {0x0F, 0xAE, 0x37});
+    require(xsaveopt && xsaveopt->Lowering == Amd64OnlyLowering::InPlace && xsaveopt->ReplacementBytes == Bytes{0x0F, 0xAE, 0x27} && xsaveopt->InstructionName == "XSAVEOPT", "XSAVEOPT was not rewritten to XSAVE");
+    const auto xsaveopt64 = match(rosetta, {0x48, 0x0F, 0xAE, 0x74, 0x24, 0x40});
+    require(xsaveopt64 && xsaveopt64->ReplacementBytes == Bytes{0x48, 0x0F, 0xAE, 0x64, 0x24, 0x40}, "XSAVEOPT64 with an RSP-relative operand was not rewritten to XSAVE64");
+    const auto xsaveoptR12 = match(rosetta, {0x41, 0x0F, 0xAE, 0x34, 0x24});
+    require(xsaveoptR12 && xsaveoptR12->ReplacementBytes == Bytes{0x41, 0x0F, 0xAE, 0x24, 0x24}, "XSAVEOPT with an extended base register was not rewritten to XSAVE");
+    const auto xsaveoptRip = match(rosetta, {0x0F, 0xAE, 0x35, 0x00, 0x01, 0x00, 0x00});
+    require(xsaveoptRip && xsaveoptRip->ReplacementBytes == Bytes{0x0F, 0xAE, 0x25, 0x00, 0x01, 0x00, 0x00}, "RIP-relative XSAVEOPT was not rewritten to XSAVE with the same displacement");
+    const auto xsaveoptFs = match(rosetta, {0x64, 0x0F, 0xAE, 0x34, 0x25, 0x40, 0x00, 0x00, 0x00});
+    require(xsaveoptFs && xsaveoptFs->ReplacementBytes == Bytes{0x64, 0x0F, 0xAE, 0x24, 0x25, 0x40, 0x00, 0x00, 0x00}, "FS-relative XSAVEOPT was not rewritten to XSAVE");
+    for (const auto& other : {Bytes{0x0F, 0xAE, 0x27}, Bytes{0x0F, 0xAE, 0x2F}, Bytes{0x0F, 0xAE, 0x3F}, Bytes{0x0F, 0xAE, 0xF0}, Bytes{0xF3, 0x0F, 0xAE, 0xF0}, Bytes{0xF2, 0x0F, 0xAE, 0xF1}, Bytes{0xF3, 0x0F, 0xAE, 0x37}})
+        require(!match(rosetta, other).has_value(), "XSAVE, XRSTOR, CLFLUSH, MFENCE, UMONITOR, UMWAIT or a prefixed 0F AE /6 was taken for XSAVEOPT");
     const auto rdpid = match(rosetta, {0xF3, 0x41, 0x0F, 0xC7, 0xFB});
     require(rdpid && rdpid->Lowering == Amd64OnlyLowering::Trampoline && rdpid->Optional && rdpid->InstructionName == "RDPID", "RDPID was not lowered through an optional stub");
     require(rdpid->ReturnBranchOffset == 6 && Bytes(rdpid->StubBody.begin(), rdpid->StubBody.begin() + 7) == Bytes{0x41, 0xBB, 0, 0, 0, 0, 0xE9}, "RDPID r11 stub does not load 0 before returning");
@@ -836,6 +849,21 @@ void converterWideStoreWindows() {
     expected.insert(expected.end(), {0xC5, 0xF8, 0x11, 0x0E, 0xC4, 0xE3, 0x7D, 0x19, 0x4E, 0x10, 0x01});
     require(paired.Trampolines.size() == 1 && paired.Trampolines[0].Length == 8 && body(paired.Trampolines[0]) == expected && paired.Reports.size() == 1, "A 256-bit store followed by another was not lowered with it in one stub");
 
+    const auto withRdseed = convert(withStore({}, {0x0F, 0xC7, 0xF8, 0xC3}));
+    expected = halves;
+    expected.insert(expected.end(), {0x0F, 0xC7, 0xF0});
+    require(withRdseed.Trampolines.size() == 1 && withRdseed.Trampolines[0].Length == 7 && body(withRdseed.Trampolines[0]) == expected && withRdseed.Reports.size() == 1, "A 256-bit store followed by an in-place site did not move its replacement into the stub");
+
+    const auto withClwb = convert(withStore({}, {0x66, 0x0F, 0xAE, 0x37, 0xC3}));
+    expected = halves;
+    expected.insert(expected.end(), {0x0F, 0x1F, 0x40, 0x00});
+    require(withClwb.Trampolines.size() == 1 && withClwb.Trampolines[0].Length == 8 && body(withClwb.Trampolines[0]) == expected, "A 256-bit store followed by CLWB did not move its replacement into the stub");
+
+    const auto withRipStore = convert(withStore({}, {0xF3, 0x0F, 0x2B, 0x05, 0x40, 0x00, 0x00, 0x00, 0xC3}));
+    expected = halves;
+    expected.insert(expected.end(), {0xF3, 0x0F, 0x11, 0x05, 0x00, 0x00, 0x00, 0x00});
+    require(withRipStore.Trampolines.size() == 1 && withRipStore.Trampolines[0].Length == 12 && body(withRipStore.Trampolines[0]) == expected && withRipStore.Trampolines[0].Relocations.size() == 1 && withRipStore.Trampolines[0].Relocations[0].SiteTarget == 0x4C && withRipStore.Trampolines[0].Relocations[0].InstructionEnd == 19, "A 256-bit store followed by a RIP-relative in-place site did not relocate its replacement");
+
     const Bytes push = {0x48, 0x8D, 0x64, 0x24, 0xF8, 0x50, 0x48, 0x8D, 0x05, 0, 0, 0, 0, 0x48, 0x89, 0x44, 0x24, 0x08, 0x58};
     const auto ripCalled = convert(withStore({}, {0xFF, 0x15, 0x10, 0x00, 0x00, 0x00}));
     expected = halves;
@@ -1958,6 +1986,79 @@ void mcommitExecution() {
     }
     munmap(code, 4096);
 }
+
+void wideStoreExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0xC5, 0xFC, 0x11, 0x00};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "256-bit store stub was not produced");
+    auto body = match->StubBody;
+    body[match->ReturnBranchOffset] = 0xC3;
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the stub");
+    std::memcpy(code, body.data(), body.size());
+    alignas(32) std::uint8_t source[32];
+    for (std::size_t index = 0; index < sizeof(source); ++index) source[index] = static_cast<std::uint8_t>(index + 1);
+    auto* pages = static_cast<std::uint8_t*>(mmap(nullptr, 8192, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    require(pages != MAP_FAILED, "cannot map the destination pages");
+    for (const std::size_t offset : {std::size_t{0}, std::size_t{1}, std::size_t{4080}}) {
+        std::memset(pages, 0, 8192);
+        auto* destination = pages + offset;
+        asm volatile(
+            "vmovups (%[source]), %%ymm0\n\t"
+            "sub $128, %%rsp\n\t"
+            "call *%[code]\n\t"
+            "add $128, %%rsp\n\t"
+            :
+            : [source] "r"(source), [code] "r"(code), "a"(destination)
+            : "memory", "ymm0");
+        require(std::memcmp(destination, source, sizeof(source)) == 0, "256-bit store stub did not write both halves");
+        require(std::all_of(pages, destination, [](const std::uint8_t value) { return value == 0; }), "256-bit store stub wrote before its operand");
+        require(std::all_of(destination + sizeof(source), pages + 8192, [](const std::uint8_t value) { return value == 0; }),
+                "256-bit store stub wrote past its operand");
+    }
+    munmap(pages, 8192);
+    munmap(code, 4096);
+}
+
+void xsaveoptExecution() {
+    const Bytes site = {0x48, 0x0F, 0xAE, 0x37};
+    const auto match = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta)->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::InPlace, "XSAVEOPT64 was not rewritten in place");
+    auto body = match->ReplacementBytes;
+    body.push_back(0xC3);
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the XSAVEOPT replacement");
+    std::memcpy(code, body.data(), body.size());
+    alignas(64) std::uint8_t area[1024] = {};
+    alignas(32) std::uint8_t pattern[32];
+    alignas(32) std::uint8_t restored[32] = {};
+    for (std::size_t i = 0; i < sizeof(pattern); ++i)
+        pattern[i] = static_cast<std::uint8_t>(0xA0 + i);
+    asm volatile(
+        "vmovdqu (%[pattern]), %%ymm3\n\t"
+        "mov %[area], %%rdi\n\t"
+        "mov $7, %%eax\n\t"
+        "xor %%edx, %%edx\n\t"
+        "sub $128, %%rsp\n\t"
+        "call *%[code]\n\t"
+        "add $128, %%rsp\n\t"
+        "vpxor %%ymm3, %%ymm3, %%ymm3\n\t"
+        "mov $7, %%eax\n\t"
+        "xor %%edx, %%edx\n\t"
+        "xrstor64 (%%rdi)\n\t"
+        "vmovdqu %%ymm3, (%[restored])\n\t"
+        "vzeroupper\n\t"
+        :
+        : [pattern] "r"(pattern), [area] "r"(area), [code] "r"(code), [restored] "r"(restored)
+        : "rax", "rdx", "rdi", "xmm3", "memory");
+    munmap(code, 4096);
+    std::uint64_t components = 0;
+    std::memcpy(&components, area + 512, sizeof(components));
+    require((components & 6) == 6, "XSAVE did not mark the SSE and AVX state as saved");
+    require(std::memcmp(area + 160 + 3 * 16, pattern, 16) == 0 && std::memcmp(area + 576 + 3 * 16, pattern + 16, 16) == 0, "XSAVE did not store YMM3 in the standard format");
+    require(std::memcmp(restored, pattern, sizeof(pattern)) == 0, "XRSTOR did not restore YMM3 from the area XSAVE wrote");
+}
 #else
 void reciprocalExecution() {}
 void registerFormExecution() {}
@@ -1968,6 +2069,7 @@ void immediateFormExecution() {}
 void ripRelativeExecution() {}
 void rdpruExecution() {}
 void mcommitExecution() {}
+void xsaveoptExecution() {}
 #endif
 
 #if defined(__x86_64__) && (defined(__linux__) || defined(__APPLE__))
@@ -2002,6 +2104,7 @@ void rdtscpExecution() {
 }
 #else
 void rdtscpExecution() {}
+void wideStoreExecution() {}
 #endif
 
 void scannerZeroTail() {
@@ -2055,12 +2158,14 @@ int main() {
         converterInPlaceFollower();
         converterClzero();
         rosettaSubstitutions();
+        xsaveoptExecution();
         converterRosetta();
         rosettaScalarCompares();
         converterRosettaScalarCompare();
         rosettaLegacyScalarCompares();
         converterRosettaLegacyScalarCompare();
         rdtscpExecution();
+        wideStoreExecution();
         wideStoreSplit();
         converterWideStoreWindows();
         converterClaimedFollower();
diff --git a/core/relinker/codegen/tests/MaskedStoreLoweringTests.cpp b/core/relinker/codegen/tests/MaskedStoreLoweringTests.cpp
new file mode 100644
index 0000000000..5517011feb
--- /dev/null
+++ b/core/relinker/codegen/tests/MaskedStoreLoweringTests.cpp
@@ -0,0 +1,368 @@
+#include <codegen/x86/MaskedStoreLowering.hpp>
+#include <codegen/x86/IAmd64OnlyInstructionMatcher.hpp>
+#include <codegen/CodegenException.hpp>
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <stdexcept>
+#include <string>
+#include <vector>
+#if (defined(__linux__) || defined(__APPLE__)) && defined(__x86_64__)
+#include <signal.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+void require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+struct Form {
+    std::uint8_t Opcode;
+    bool W;
+    const char* Name;
+    std::uint8_t ElementSize;
+};
+
+constexpr std::array kForms{
+    Form{0x2E, false, "VMASKMOVPS", 4},
+    Form{0x2F, false, "VMASKMOVPD", 8},
+    Form{0x8E, false, "VPMASKMOVD", 4},
+    Form{0x8E, true, "VPMASKMOVQ", 8},
+};
+
+Bytes maskedStore(const Form& form, bool wide, std::uint8_t mask, std::uint8_t source, std::uint8_t rexIndexBase, Bytes memory, const Bytes& prefixes = {}) {
+    Bytes bytes = prefixes;
+    bytes.insert(bytes.end(), {0xC4,
+        static_cast<std::uint8_t>(((source & 8) != 0 ? 0 : 0x80) | ((rexIndexBase & 2) != 0 ? 0 : 0x40) | ((rexIndexBase & 1) != 0 ? 0 : 0x20) | 0x02),
+        static_cast<std::uint8_t>((form.W ? 0x80 : 0) | ((~mask & 15) << 3) | (wide ? 4 : 0) | 0x01), form.Opcode});
+    memory.at(0) = static_cast<std::uint8_t>(memory[0] | ((source & 7) << 3));
+    bytes.insert(bytes.end(), memory.begin(), memory.end());
+    return bytes;
+}
+
+bool rejected(const Bytes& bytes) {
+    try {
+        (void)Codegen::DecodeMaskedStore(bytes.data(), bytes.size());
+    } catch (const Codegen::CodegenException&) {
+        return true;
+    }
+    return false;
+}
+
+void decoding() {
+    for (const auto& form : kForms) {
+        for (const bool wide : {false, true}) {
+            for (std::uint8_t mask = 0; mask < 16; ++mask) {
+                for (std::uint8_t source = 0; source < 16; ++source) {
+                    const auto bytes = maskedStore(form, wide, mask, source, 0, {0x07});
+                    const auto operands = Codegen::DecodeMaskedStore(bytes.data(), bytes.size());
+                    require(operands && std::string(operands->Name) == form.Name && operands->ElementSize == form.ElementSize && operands->Wide == wide && operands->Mask == mask, "Masked store decoding changed the form, width or mask register");
+                    require(operands->Memory.Rm == 7 && operands->Memory.Mod == 0 && operands->Memory.RexIndexBase == 0 && operands->Instruction == bytes, "Masked store decoding changed the memory operand");
+                }
+            }
+        }
+    }
+    const auto extended = maskedStore(kForms[0], true, 3, 4, 3, {0x84, 0xD1, 0x78, 0x56, 0x34, 0x12}, {0x64, 0x67});
+    const auto operands = Codegen::DecodeMaskedStore(extended.data(), extended.size());
+    require(operands && operands->Memory.RexIndexBase == 3 && operands->Memory.Sib == 0xD1 && operands->Memory.Displacement == 0x12345678 && operands->Memory.Prefixes == Bytes{0x64, 0x67}, "Masked store extensions, SIB or prefixes were lost");
+    const auto rip = maskedStore(kForms[1], false, 1, 2, 0, {0x05, 0x10, 0x00, 0x00, 0x00});
+    const auto ripOperands = Codegen::DecodeMaskedStore(rip.data(), rip.size());
+    require(ripOperands && ripOperands->Memory.RipRelative && ripOperands->DisplacementOffset == 5 && ripOperands->Memory.Displacement == 0x10, "RIP-relative masked store was not recognised");
+    const auto stack = maskedStore(kForms[2], false, 1, 2, 0, {0x44, 0x24, 0x08});
+    const auto stackOperands = Codegen::DecodeMaskedStore(stack.data(), stack.size());
+    require(stackOperands && stackOperands->Memory.StackBase && stackOperands->DisplacementOffset == 6, "RSP-based masked store was not recognised");
+    for (const auto& bytes : {
+             Bytes{0xC4, 0xE2, 0x75, 0x2C, 0x07}, Bytes{0xC4, 0xE2, 0x75, 0x2D, 0x07}, Bytes{0xC4, 0xE2, 0x75, 0x8C, 0x07},
+             Bytes{0xC4, 0xE2, 0xF5, 0x2E, 0x07}, Bytes{0xC4, 0xE2, 0xF5, 0x2F, 0x07}, Bytes{0xC4, 0xE2, 0x75, 0x2E, 0xC7},
+             Bytes{0xC4, 0xE1, 0x75, 0x2E, 0x07}, Bytes{0xC4, 0xE2, 0x74, 0x2E, 0x07}, Bytes{0xC5, 0xF5, 0x2E, 0x07},
+             Bytes{0xC4, 0xE2, 0x75, 0x2E}, Bytes{0x66, 0xC4, 0xE2, 0x75, 0x2E, 0x07}})
+        require(!Codegen::DecodeMaskedStore(bytes.data(), bytes.size()), "A load, register form, other map or prefix matched a masked store");
+    require(rejected(Bytes{0xC4, 0xE2, 0x75, 0x2E, 0x07, 0x00}), "A masked store with trailing bytes was accepted");
+    require(rejected(Bytes{0xC4, 0xE2, 0x75, 0x2E, 0x47}), "A truncated masked store was accepted");
+}
+
+void body() {
+    const auto site = maskedStore(kForms[1], false, 1, 2, 0, {0x07});
+    Codegen::StubBodyBuilder builder;
+    Codegen::EmitMaskedStore(builder, *Codegen::DecodeMaskedStore(site.data(), site.size()));
+    const auto lowered = builder.Finish();
+    const Bytes expected{
+        0x48, 0x8D, 0x64, 0x24, 0x80, 0x9C, 0x50, 0x51, 0x48, 0x8D, 0x07, 0xC4, 0xE1, 0x79, 0x50, 0xC9,
+        0xF6, 0xC1, 0x01, 0x74, 0x0A, 0xF0, 0x80, 0x48, 0x00, 0x00, 0xF0, 0x80, 0x48, 0x07, 0x00,
+        0xF6, 0xC1, 0x02, 0x74, 0x0A, 0xF0, 0x80, 0x48, 0x08, 0x00, 0xF0, 0x80, 0x48, 0x0F, 0x00,
+        0x59, 0x58, 0x9D, 0x48, 0x8D, 0xA4, 0x24, 0x80, 0x00, 0x00, 0x00, 0xC4, 0xE2, 0x71, 0x2F, 0x17};
+    require(Bytes(lowered.Bytes.begin(), lowered.Bytes.begin() + static_cast<std::ptrdiff_t>(lowered.ReturnBranchOffset)) == expected, "VMASKMOVPD stub does not probe its elements before the store");
+    const auto segment = maskedStore(kForms[0], true, 9, 2, 0, {0x44, 0x24, 0x08}, {0x64});
+    Codegen::StubBodyBuilder segmentBuilder;
+    Codegen::EmitMaskedStore(segmentBuilder, *Codegen::DecodeMaskedStore(segment.data(), segment.size()));
+    const auto segmentBody = segmentBuilder.Finish().Bytes;
+    const Bytes lea{0x64, 0x48, 0x8D, 0x84, 0x24, 0xA0, 0x00, 0x00, 0x00, 0xC4, 0xC1, 0x7C, 0x50, 0xC9};
+    require(std::search(segmentBody.begin(), segmentBody.end(), lea.begin(), lea.end()) == segmentBody.begin() + 8, "RSP-based masked store address does not skip the spill frame");
+    const Bytes probe{0x64, 0xF0, 0x80, 0x48, 0x1F, 0x00};
+    require(std::search(segmentBody.begin(), segmentBody.end(), probe.begin(), probe.end()) != segmentBody.end(), "Masked store probes lost the segment prefix");
+    const auto overflow = maskedStore(kForms[0], false, 1, 2, 0, {0x84, 0x24, 0xFF, 0xFF, 0xFF, 0x7F});
+    bool thrown = false;
+    try {
+        Codegen::StubBodyBuilder overflowBuilder;
+        Codegen::EmitMaskedStore(overflowBuilder, *Codegen::DecodeMaskedStore(overflow.data(), overflow.size()));
+    } catch (const Codegen::CodegenException&) {
+        thrown = true;
+    }
+    require(thrown, "An overflowing stack displacement was silently wrapped");
+}
+
+void matching() {
+    const auto intel = Codegen::MakeAmd64OnlyInstructionMatcher();
+    const auto rosetta = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    for (const auto& form : kForms) {
+        const auto bytes = maskedStore(form, true, 1, 0, 0, {0x00});
+        require(!intel->Match(bytes.data(), bytes.size()), "Intel mode lowered a masked store");
+        const auto match = rosetta->Match(bytes.data(), bytes.size());
+        require(match && match->InstructionName == form.Name && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline && !match->Optional, "Rosetta mode did not require a masked store trampoline");
+        const std::array<std::span<const std::uint8_t>, 2> sequence{bytes, bytes};
+        require(rosetta->MatchSequence(sequence, {}).has_value(), "A masked store sequence could not move out of line");
+    }
+    const Bytes load{0xC4, 0xE2, 0x75, 0x2C, 0x00};
+    require(!rosetta->Match(load.data(), load.size()), "Rosetta mode lowered a masked load");
+}
+
+#if (defined(__linux__) || defined(__APPLE__)) && defined(__x86_64__)
+
+constexpr std::size_t kPage = 4096;
+constexpr std::size_t kDataPages = 16;
+constexpr std::uint8_t kFill = 0xA5;
+constexpr std::uint8_t kSentinel = 0x5A;
+
+std::uint8_t* protectedPage = nullptr;
+volatile sig_atomic_t faults = 0;
+
+void onFault(int number, siginfo_t* info, void*) {
+    const auto* address = static_cast<const std::uint8_t*>(info->si_addr);
+    if (address < protectedPage || address >= protectedPage + kPage) {
+        signal(number, SIG_DFL);
+        return;
+    }
+    faults = faults + 1;
+    mprotect(protectedPage, kPage, PROT_READ | PROT_WRITE);
+}
+
+struct alignas(32) Machine {
+    std::uint8_t Ymm[16][32];
+    std::uint64_t Gpr[7];
+    std::uint64_t Flags;
+    std::uint64_t Stack;
+    std::uint64_t Code;
+};
+
+static_assert(offsetof(Machine, Gpr) == 512 && offsetof(Machine, Flags) == 568 && offsetof(Machine, Stack) == 576 && offsetof(Machine, Code) == 584);
+
+void run(Machine& machine) {
+    asm volatile(
+        "mov %%rsp, %%r12\n\t"
+        "mov %[machine], %%r13\n\t"
+        "vmovdqu 0(%%r13), %%ymm0\n\t"
+        "vmovdqu 32(%%r13), %%ymm1\n\t"
+        "vmovdqu 64(%%r13), %%ymm2\n\t"
+        "vmovdqu 96(%%r13), %%ymm3\n\t"
+        "vmovdqu 128(%%r13), %%ymm4\n\t"
+        "vmovdqu 160(%%r13), %%ymm5\n\t"
+        "vmovdqu 192(%%r13), %%ymm6\n\t"
+        "vmovdqu 224(%%r13), %%ymm7\n\t"
+        "vmovdqu 256(%%r13), %%ymm8\n\t"
+        "vmovdqu 288(%%r13), %%ymm9\n\t"
+        "vmovdqu 320(%%r13), %%ymm10\n\t"
+        "vmovdqu 352(%%r13), %%ymm11\n\t"
+        "vmovdqu 384(%%r13), %%ymm12\n\t"
+        "vmovdqu 416(%%r13), %%ymm13\n\t"
+        "vmovdqu 448(%%r13), %%ymm14\n\t"
+        "vmovdqu 480(%%r13), %%ymm15\n\t"
+        "mov 512(%%r13), %%rax\n\t"
+        "mov 520(%%r13), %%rcx\n\t"
+        "mov 528(%%r13), %%rbx\n\t"
+        "mov 536(%%r13), %%rsi\n\t"
+        "mov 544(%%r13), %%rdi\n\t"
+        "mov 552(%%r13), %%r9\n\t"
+        "mov 560(%%r13), %%r10\n\t"
+        "mov 576(%%r13), %%rsp\n\t"
+        "pushq 568(%%r13)\n\t"
+        "popfq\n\t"
+        "call *584(%%r13)\n\t"
+        "pushfq\n\t"
+        "popq 568(%%r13)\n\t"
+        "mov %%rsp, 576(%%r13)\n\t"
+        "mov %%r12, %%rsp\n\t"
+        "mov %%rax, 512(%%r13)\n\t"
+        "mov %%rcx, 520(%%r13)\n\t"
+        "mov %%rbx, 528(%%r13)\n\t"
+        "mov %%rsi, 536(%%r13)\n\t"
+        "mov %%rdi, 544(%%r13)\n\t"
+        "mov %%r9, 552(%%r13)\n\t"
+        "mov %%r10, 560(%%r13)\n\t"
+        "vmovdqu %%ymm0, 0(%%r13)\n\t"
+        "vmovdqu %%ymm1, 32(%%r13)\n\t"
+        "vmovdqu %%ymm2, 64(%%r13)\n\t"
+        "vmovdqu %%ymm3, 96(%%r13)\n\t"
+        "vmovdqu %%ymm4, 128(%%r13)\n\t"
+        "vmovdqu %%ymm5, 160(%%r13)\n\t"
+        "vmovdqu %%ymm6, 192(%%r13)\n\t"
+        "vmovdqu %%ymm7, 224(%%r13)\n\t"
+        "vmovdqu %%ymm8, 256(%%r13)\n\t"
+        "vmovdqu %%ymm9, 288(%%r13)\n\t"
+        "vmovdqu %%ymm10, 320(%%r13)\n\t"
+        "vmovdqu %%ymm11, 352(%%r13)\n\t"
+        "vmovdqu %%ymm12, 384(%%r13)\n\t"
+        "vmovdqu %%ymm13, 416(%%r13)\n\t"
+        "vmovdqu %%ymm14, 448(%%r13)\n\t"
+        "vmovdqu %%ymm15, 480(%%r13)\n\t"
+        "vzeroupper\n\t"
+        :
+        : [machine] "r"(&machine)
+        : "rax", "rcx", "rbx", "rsi", "rdi", "r9", "r10", "r12", "r13",
+          "xmm0", "xmm1", "xmm2", "xmm3", "xmm4", "xmm5", "xmm6", "xmm7",
+          "xmm8", "xmm9", "xmm10", "xmm11", "xmm12", "xmm13", "xmm14", "xmm15", "memory", "cc");
+}
+
+struct Addressing {
+    Bytes Memory;
+    std::uint8_t RexIndexBase;
+    std::uint8_t Mask;
+    std::uint8_t Source;
+};
+
+enum Register { Rax, Rcx, Rbx, Rsi, Rdi, R9, R10 };
+
+const std::array kAddressings{
+    Addressing{{0x07}, 0, 1, 2},
+    Addressing{{0x44, 0x5E, 0x7F}, 0, 9, 14},
+    Addressing{{0x84, 0x88, 0x00, 0xF0, 0xFF, 0xFF}, 0, 15, 0},
+    Addressing{{0x04, 0xD1}, 3, 3, 8},
+    Addressing{{0x44, 0x24, 0x40}, 0, 12, 5},
+    Addressing{{0x05, 0x00, 0x00, 0x00, 0x00}, 0, 6, 11},
+};
+
+void execution() {
+    const auto region = static_cast<std::uint8_t*>(mmap(nullptr, (kDataPages + 2) * kPage, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0));
+    require(region != MAP_FAILED, "Cannot map masked store test pages");
+    auto* const code = region;
+    auto* const data = region + kPage;
+    protectedPage = data + kDataPages * kPage;
+    struct sigaction action {};
+    action.sa_sigaction = onFault;
+    action.sa_flags = SA_SIGINFO;
+    sigemptyset(&action.sa_mask);
+    struct sigaction previousSegv {};
+    struct sigaction previousBus {};
+    sigaction(SIGSEGV, &action, &previousSegv);
+    sigaction(SIGBUS, &action, &previousBus);
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const std::array<std::uint8_t, 6> patterns{0xFF, 0x00, 0x01, 0x80, 0x55, 0xFE};
+    std::uint64_t runs = 0;
+    for (const auto& form : kForms) {
+        for (const bool wide : {false, true}) {
+            const auto elements = (wide ? 32u : 16u) / form.ElementSize;
+            for (std::size_t mode = 0; mode < kAddressings.size(); ++mode) {
+                const auto& addressing = kAddressings[mode];
+                const auto site = maskedStore(form, wide, addressing.Mask, addressing.Source, addressing.RexIndexBase, addressing.Memory);
+                const auto match = matcher->Match(site.data(), site.size());
+                require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "Masked store stub was not produced");
+                for (const int offset : {-40, -16, -4, -2, 0, 8}) {
+                    auto* const target = protectedPage + offset;
+                    const bool stackBased = mode == 4;
+                    auto* const stack = stackBased ? target + 8 - 0x40 : data + kDataPages / 2 * kPage;
+                    auto body = match->StubBody;
+                    const auto siteAddress = mode == 5 ? reinterpret_cast<std::uint64_t>(target) - site.size() : reinterpret_cast<std::uint64_t>(code);
+                    Codegen::ApplyStubRelocations(body, match->Relocations, siteAddress, reinterpret_cast<std::uint64_t>(code), 0);
+                    body.at(match->ReturnBranchOffset) = 0xC3;
+                    require(body.size() <= kPage, "Masked store stub exceeds its code page");
+                    std::memcpy(code, body.data(), body.size());
+                    for (const auto pattern : patterns) {
+                        Machine machine{};
+                        for (unsigned reg = 0; reg < 16; ++reg)
+                            for (unsigned byte = 0; byte < 32; ++byte)
+                                machine.Ymm[reg][byte] = static_cast<std::uint8_t>(reg * 37 + byte * 11 + 1);
+                        for (unsigned element = 0; element < 32u / form.ElementSize; ++element) {
+                            const bool active = element >= elements || (pattern >> element & 1) != 0;
+                            auto* lane = machine.Ymm[addressing.Mask] + element * form.ElementSize;
+                            std::memset(lane, active ? 0x00 : 0xFF, form.ElementSize);
+                            lane[0] = 0x01;
+                            lane[form.ElementSize - 1] = active ? 0x80 : 0x7F;
+                        }
+                        machine.Gpr[Rax] = 0x1111111111111111ull;
+                        machine.Gpr[Rcx] = 0x2222222222222222ull;
+                        machine.Gpr[Rbx] = 8;
+                        machine.Gpr[Rsi] = reinterpret_cast<std::uint64_t>(target) - 0x7F - 16;
+                        machine.Gpr[Rdi] = reinterpret_cast<std::uint64_t>(target);
+                        machine.Gpr[R9] = reinterpret_cast<std::uint64_t>(target) - 5 * 8;
+                        machine.Gpr[R10] = 5;
+                        if (mode == 2) {
+                            machine.Gpr[Rcx] = 3;
+                            machine.Gpr[Rax] = reinterpret_cast<std::uint64_t>(target) + 0x1000 - 12;
+                        }
+                        machine.Flags = (runs & 1) != 0 ? 0x8D7 : 0x002;
+                        machine.Stack = reinterpret_cast<std::uint64_t>(stack);
+                        machine.Code = reinterpret_cast<std::uint64_t>(code);
+                        const auto input = machine;
+                        require(mprotect(protectedPage, kPage, PROT_READ | PROT_WRITE) == 0, "Cannot unprotect the watched page");
+                        std::memset(target - 16, kFill, 64);
+                        std::memset(stack - 8 - 128, kSentinel, 128);
+                        require(mprotect(protectedPage, kPage, PROT_READ) == 0, "Cannot protect the watched page");
+                        faults = 0;
+                        run(machine);
+                        ++runs;
+                        bool touchesProtected = false;
+                        for (unsigned element = 0; element < elements; ++element) {
+                            const bool active = (pattern >> element & 1) != 0;
+                            for (unsigned byte = 0; byte < form.ElementSize; ++byte) {
+                                const auto at = element * form.ElementSize + byte;
+                                require(target[at] == (active ? input.Ymm[addressing.Source][at] : kFill), "Masked store wrote an inactive element or lost an active one");
+                                touchesProtected = touchesProtected || (active && target + at >= protectedPage);
+                            }
+                        }
+                        for (int at = -16; at < 0; ++at)
+                            require(target[at] == kFill, "Masked store wrote before its operand");
+                        for (unsigned at = elements * form.ElementSize; at < 48; ++at)
+                            require(target[at] == kFill, "Masked store wrote past its operand");
+                        require(faults == (touchesProtected ? 1 : 0), "Masked store stub did not fault exactly once on the protected page");
+                        for (unsigned at = 0; at < 128; ++at)
+                            require(stack[-8 - 128 + static_cast<int>(at)] == kSentinel, "Masked store stub wrote into the red zone");
+                        require(std::memcmp(machine.Ymm, input.Ymm, sizeof(input.Ymm)) == 0, "Masked store stub changed a vector register");
+                        require(std::memcmp(machine.Gpr, input.Gpr, sizeof(input.Gpr)) == 0, "Masked store stub changed a general register");
+                        require((machine.Flags & 0x8D5) == (input.Flags & 0x8D5), "Masked store stub changed the flags");
+                        require(machine.Stack == input.Stack, "Masked store stub did not restore RSP");
+                    }
+                }
+            }
+        }
+    }
+    sigaction(SIGSEGV, &previousSegv, nullptr);
+    sigaction(SIGBUS, &previousBus, nullptr);
+    munmap(region, (kDataPages + 2) * kPage);
+    std::cout << runs << " masked store executions\n";
+}
+#else
+void execution() { std::cout << "Masked store execution checks require a Linux/macOS x86-64 build\n"; }
+#endif
+
+}
+
+int main() {
+    try {
+        decoding();
+        body();
+        matching();
+        execution();
+        std::cout << "Masked store lowering checks passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/codegen/tests/RedZoneFramerExecutionTests.cpp b/core/relinker/codegen/tests/RedZoneFramerExecutionTests.cpp
new file mode 100644
index 0000000000..7d940524b9
--- /dev/null
+++ b/core/relinker/codegen/tests/RedZoneFramerExecutionTests.cpp
@@ -0,0 +1,286 @@
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <codegen/x86/StubBodyBuilder.hpp>
+#include <algorithm>
+#include <cstdint>
+#include <cstring>
+#include <iostream>
+#include <limits>
+#include <span>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+#if defined(__linux__) && defined(__x86_64__)
+#include <signal.h>
+#include <sys/mman.h>
+#include <ucontext.h>
+#endif
+
+#if defined(__linux__) && defined(__x86_64__)
+
+namespace {
+
+void require(const bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+constexpr std::size_t kArenaBytes = 0x10000;
+constexpr std::size_t kStubBase = 0x4000;
+constexpr std::size_t kRunnerBase = 0xc000;
+constexpr std::uint8_t kClobber = 0xa5;
+constexpr std::uint64_t kA = 0x1111, kB = 0x2222, kC = 0x3333, kD = 0x4444;
+
+std::uint8_t* arena = nullptr;
+volatile sig_atomic_t steps = 0;
+
+void clobberBelowRsp(int, siginfo_t*, void* context) {
+    auto& registers = static_cast<ucontext_t*>(context)->uc_mcontext.gregs;
+    const auto rip = static_cast<std::uintptr_t>(registers[REG_RIP]);
+    const auto base = reinterpret_cast<std::uintptr_t>(arena);
+    if (rip < base || rip >= base + kArenaBytes) {
+        registers[REG_EFL] &= ~static_cast<greg_t>(0x100);
+        return;
+    }
+    std::memset(reinterpret_cast<void*>(static_cast<std::uintptr_t>(registers[REG_RSP]) - 0x80), kClobber, 0x80);
+    steps = steps + 1;
+}
+
+const std::vector<std::uint8_t> Runner{
+    0x53, 0x4c, 0x89, 0xc3, 0x48, 0x89, 0xf8, 0x48, 0x89, 0xf7, 0x48, 0x89, 0xd6, 0x48, 0x89, 0xca,
+    0x4d, 0x85, 0xc9, 0x74, 0x0a, 0x9c, 0x48, 0x81, 0x0c, 0x24, 0x00, 0x01, 0x00, 0x00, 0x9d,
+    0xff, 0xd0, 0x9c, 0x48, 0x81, 0x24, 0x24, 0xff, 0xfe, 0xff, 0xff, 0x9d, 0x5b, 0xc3,
+};
+
+struct Leaf {
+    const char* Name;
+    std::vector<std::uint8_t> Code;
+    std::uint64_t Expected;
+};
+
+const std::vector<std::uint8_t> FramelessPushes{0x53, 0x41, 0x56, 0x41, 0x57};
+const std::vector<std::uint8_t> FramelessPops{0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xc3};
+
+std::vector<std::uint8_t> frameless(const std::vector<std::uint8_t>& body) {
+    std::vector<std::uint8_t> bytes = FramelessPushes;
+    bytes.insert(bytes.end(), body.begin(), body.end());
+    bytes.insert(bytes.end(), FramelessPops.begin(), FramelessPops.end());
+    return bytes;
+}
+
+std::vector<Leaf> framedLeaves() {
+    return {
+        {"frameless leaf spilling 0x10 below rsp", frameless({
+            0x48, 0x89, 0x7c, 0x24, 0xf0, 0x48, 0x89, 0x74, 0x24, 0xf8, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x48, 0x03, 0x44, 0x24, 0xf0, 0x48, 0x03, 0x44, 0x24, 0xf8, 0xff, 0xc9, 0x75, 0xf2,
+        }), 8 * (kA + kB)},
+        {"leaf reaching 0x28 below rsp", frameless({
+            0x48, 0x89, 0x7c, 0x24, 0xd8, 0x48, 0x89, 0x74, 0x24, 0xe8, 0x48, 0x89, 0x54, 0x24, 0xf0, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x48, 0x03, 0x44, 0x24, 0xd8, 0x48, 0x03, 0x44, 0x24, 0xe8, 0x48, 0x03, 0x44, 0x24, 0xf0, 0xff, 0xc9, 0x75, 0xed,
+        }), 8 * (kA + kB + kC)},
+        {"leaf reading its saved rbx at +0x10 moved in place", frameless({
+            0x48, 0x89, 0x7c, 0x24, 0xf0, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x48, 0x03, 0x44, 0x24, 0xf0, 0x48, 0x03, 0x44, 0x24, 0x10, 0xff, 0xc9, 0x75, 0xf2,
+        }), 8 * (kA + kD)},
+        {"leaf taking the address of a slot 0x20 below rsp", frameless({
+            0x4c, 0x8d, 0x74, 0x24, 0xe0, 0x49, 0x89, 0x3e, 0x49, 0x89, 0x76, 0x08, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x49, 0x03, 0x06, 0x49, 0x03, 0x46, 0x08, 0xff, 0xc9, 0x75, 0xf5,
+        }), 8 * (kA + kB)},
+        {"inflate_fast-shaped leaf allocating 0x40 after six pushes", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x7c, 0x24, 0x00, 0x48, 0x89, 0x74, 0x24, 0x08, 0x48, 0x89, 0x54, 0x24, 0x38,
+            0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0, 0x48, 0x03, 0x44, 0x24, 0x08, 0x48, 0x03, 0x44, 0x24, 0xe0, 0x48, 0x03, 0x44, 0x24, 0x00,
+            0xff, 0xc9, 0x75, 0xed, 0x48, 0x8b, 0x54, 0x24, 0x38,
+            0x48, 0x83, 0xc4, 0x40, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kB + 2 * kA)},
+    };
+}
+
+std::vector<Leaf> stubbedLeaves() {
+    return {
+        {"inflate_fast-shaped leaf with operands at rsp and at 0x60 shifted by 0x20", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x70,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x34, 0x24, 0x48, 0x89, 0x54, 0x24, 0x60, 0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0,
+            0x48, 0x03, 0x44, 0x24, 0xe0, 0x48, 0x03, 0x04, 0x24, 0x48, 0x03, 0x44, 0x24, 0x60, 0xff, 0xc9, 0x75, 0xee,
+            0x48, 0x83, 0xc4, 0x70, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kA + kB + kC)},
+        {"leaf shifted by the whole red zone reading its saved rbx at +0x8", {
+            0x41, 0x57, 0x53, 0x41, 0x56, 0x4c, 0x8d, 0x74, 0x24, 0xe0, 0x49, 0x89, 0x3e, 0x31, 0xc0, 0xb9, 0x08, 0x00, 0x00, 0x00,
+            0x49, 0x03, 0x06, 0x48, 0x03, 0x44, 0x24, 0x08, 0xff, 0xc9, 0x75, 0xf4, 0x41, 0x5e, 0x5b, 0x41, 0x5f, 0xc3,
+        }, 8 * (kA + kD)},
+    };
+}
+
+std::vector<Leaf> backwardStubbedLeaves() {
+    return {
+        {"inflate_fast-shaped leaf comparing at rsp between an add and a jne", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x7c, 0x24, 0x00, 0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0,
+            0x48, 0x03, 0x44, 0x24, 0xe0, 0x49, 0x01, 0xf8, 0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xeb,
+            0x48, 0x83, 0xc4, 0x40, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kA + kB)},
+        {"leaf comparing at rsp after a load below rsp that heads its loop", {
+            0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40,
+            0x48, 0x89, 0x7c, 0x24, 0xe0, 0x48, 0x89, 0x7c, 0x24, 0x00, 0xb9, 0x04, 0x00, 0x00, 0x00, 0x31, 0xc0,
+            0x48, 0x03, 0x44, 0x24, 0xe0, 0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xee,
+            0x48, 0x83, 0xc4, 0x40, 0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3,
+        }, 4 * (kA + kB)},
+    };
+}
+
+void writeRel32(std::uint8_t* at, const std::uint64_t target, const std::uint64_t next) {
+    const auto displacement = static_cast<std::int64_t>(target) - static_cast<std::int64_t>(next);
+    require(displacement >= std::numeric_limits<std::int32_t>::min() && displacement <= std::numeric_limits<std::int32_t>::max(), "a stub jump is out of rel32 range");
+    const auto value = static_cast<std::uint32_t>(static_cast<std::int32_t>(displacement));
+    for (std::size_t index = 0; index < 4; ++index) at[index] = static_cast<std::uint8_t>(value >> (index * 8));
+}
+
+std::vector<std::uint8_t> callTo(const std::size_t from, const std::size_t target) {
+    std::vector<std::uint8_t> bytes{0xe8, 0, 0, 0, 0};
+    const auto displacement = static_cast<std::uint32_t>(static_cast<std::int32_t>(target) - static_cast<std::int32_t>(from + 5));
+    for (std::size_t index = 0; index < 4; ++index) bytes[1 + index] = static_cast<std::uint8_t>(displacement >> (index * 8));
+    return bytes;
+}
+
+struct Image {
+    std::vector<std::uint8_t> Bytes;
+    std::vector<std::size_t> Starts;
+    std::vector<std::size_t> Ends;
+};
+
+Image place(const std::vector<Leaf>& leaves) {
+    Image image;
+    std::size_t at = 0x40;
+    for (const auto& leaf : leaves) {
+        image.Starts.push_back(at);
+        at += (leaf.Code.size() + 15) / 16 * 16 + 16;
+    }
+    for (const auto start : image.Starts) {
+        const auto call = callTo(image.Bytes.size(), start);
+        image.Bytes.insert(image.Bytes.end(), call.begin(), call.end());
+    }
+    image.Bytes.push_back(0xc3);
+    for (std::size_t index = 0; index < leaves.size(); ++index) {
+        image.Bytes.resize(image.Starts[index], 0xcc);
+        image.Bytes.insert(image.Bytes.end(), leaves[index].Code.begin(), leaves[index].Code.end());
+        image.Ends.push_back(image.Bytes.size());
+    }
+    image.Bytes.resize((image.Bytes.size() + 15) / 16 * 16 + 16, 0xcc);
+    require(image.Bytes.size() <= kStubBase, "the leaves do not fit before the stubs");
+    return image;
+}
+
+struct Framing {
+    Codegen::RedZoneFrameReport Report;
+    std::vector<Codegen::TrampolineSite> Sites;
+    std::vector<Codegen::RedZoneDisplacement> Displacements;
+};
+
+Framing load(const Image& image, const bool frame) {
+    std::fill_n(arena, kArenaBytes, 0xcc);
+    std::copy(image.Bytes.begin(), image.Bytes.end(), arena);
+    std::copy(Runner.begin(), Runner.end(), arena + kRunnerBase);
+    Framing framing;
+    if (!frame) return framing;
+    const auto base = reinterpret_cast<std::uint64_t>(arena);
+    const std::vector<Domain::ProgramHeader> segments{{1, 5, 0, base, base, image.Bytes.size(), image.Bytes.size(), 16}};
+    std::vector<Codegen::RedZoneFunction> functions;
+    for (std::size_t index = 0; index < image.Starts.size(); ++index) functions.push_back({base + image.Starts[index], base + image.Ends[index]});
+    framing.Sites = Codegen::FrameRedZoneFunctions(image.Bytes, segments, functions, {}, framing.Report, framing.Displacements);
+    for (const auto& moved : framing.Displacements) std::copy(moved.Bytes.begin(), moved.Bytes.end(), arena + moved.Offset);
+    std::size_t cursor = kStubBase;
+    for (const auto& site : framing.Sites) {
+        const auto at = static_cast<std::size_t>(site.Address - base);
+        require(std::equal(site.OriginalBytes.begin(), site.OriginalBytes.end(), arena + at), "a framed site's bytes changed before it was patched");
+        cursor = (cursor + 15) / 16 * 16;
+        require(cursor + site.Body.size() <= kRunnerBase, "the stubs do not fit before the runner");
+        auto* stub = arena + cursor;
+        std::copy(site.Body.begin(), site.Body.end(), stub);
+        Codegen::ApplyStubRelocations(std::span<std::uint8_t>(stub, site.ReturnBranchOffset), site.Relocations, site.Address, base + cursor, site.Offset);
+        writeRel32(stub + site.ReturnBranchOffset + 1, site.Address + site.Length, base + cursor + site.ReturnBranchOffset + 5);
+        std::fill_n(arena + at, site.Length, 0x90);
+        arena[at] = 0xe9;
+        writeRel32(arena + at + 1, base + cursor, site.Address + 5);
+        cursor += site.Body.size();
+    }
+    return framing;
+}
+
+struct Run {
+    std::uint64_t Result;
+    int Steps;
+};
+
+Run run(const std::size_t start, const bool clobber) {
+    using Entry = std::uint64_t (*)(std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t, std::uint64_t);
+    const auto entry = reinterpret_cast<Entry>(arena + kRunnerBase);
+    steps = 0;
+    const auto result = entry(reinterpret_cast<std::uint64_t>(arena + start), kA, kB, kC, kD, clobber ? 1 : 0);
+    return {result, static_cast<int>(steps)};
+}
+
+std::string hex(const std::uint64_t value) {
+    std::ostringstream text;
+    text << "0x" << std::hex << value;
+    return text.str();
+}
+
+Codegen::RedZoneFrameReport runLeaves(const std::vector<Leaf>& leaves) {
+    const auto image = place(leaves);
+    load(image, false);
+    std::vector<Run> plain, clobbered;
+    for (std::size_t index = 0; index < leaves.size(); ++index) {
+        plain.push_back(run(image.Starts[index], false));
+        clobbered.push_back(run(image.Starts[index], true));
+        require(plain.back().Result == leaves[index].Expected, std::string(leaves[index].Name) + ": the unframed leaf returned " + hex(plain.back().Result) + " without the clobber, not " + hex(leaves[index].Expected));
+        require(clobbered.back().Steps > 0, std::string(leaves[index].Name) + ": the clobber did not run");
+        require(clobbered.back().Result != leaves[index].Expected, std::string(leaves[index].Name) + ": the unframed leaf survived writes below rsp, so the case proves nothing");
+    }
+    const auto framing = load(image, true);
+    require(framing.Report.Framed == leaves.size(), "only " + std::to_string(framing.Report.Framed) + " of " + std::to_string(leaves.size()) + " leaves were framed");
+    for (std::size_t index = 0; index < leaves.size(); ++index) {
+        const auto calm = run(image.Starts[index], false);
+        const auto framed = run(image.Starts[index], true);
+        require(calm.Result == leaves[index].Expected, std::string(leaves[index].Name) + ": the framed leaf returned " + hex(calm.Result) + " without the clobber, not " + hex(leaves[index].Expected));
+        require(framed.Steps > 0, std::string(leaves[index].Name) + ": the clobber did not run over the framed leaf");
+        require(framed.Result == leaves[index].Expected, std::string(leaves[index].Name) + ": the framed leaf returned " + hex(framed.Result) + " under writes below rsp, not " + hex(leaves[index].Expected));
+        std::cout << leaves[index].Name << ": unframed " << hex(plain[index].Result) << " alone and " << hex(clobbered[index].Result) << " under the clobber (" << clobbered[index].Steps << " steps); framed " << hex(framed.Result) << " under the clobber (" << framed.Steps << " steps)\n";
+    }
+    return framing.Report;
+}
+
+}
+
+int main() {
+    try {
+        struct sigaction action {};
+        action.sa_sigaction = clobberBelowRsp;
+        action.sa_flags = SA_SIGINFO;
+        sigemptyset(&action.sa_mask);
+        require(sigaction(SIGTRAP, &action, nullptr) == 0, "cannot install the SIGTRAP handler");
+        void* mapped = mmap(nullptr, kArenaBytes, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        if (mapped == MAP_FAILED) {
+            std::cout << "skipped: no writable and executable memory\n";
+            return 77;
+        }
+        arena = static_cast<std::uint8_t*>(mapped);
+        runLeaves(framedLeaves());
+        const auto stubbed = runLeaves(stubbedLeaves());
+        require(stubbed.OperandStubs == 3 && stubbed.StubbedOperands == 5, "the leaves were framed with " + std::to_string(stubbed.OperandStubs) + " operand stubs carrying " + std::to_string(stubbed.StubbedOperands) + " rsp operands, not 3 carrying 5");
+        const auto backward = runLeaves(backwardStubbedLeaves());
+        require(backward.OperandStubs == 2 && backward.StubbedOperands == 3 && backward.MovedOperands == 5, "the leaves comparing at rsp before a branch were framed with " + std::to_string(backward.OperandStubs) + " operand stubs carrying " + std::to_string(backward.StubbedOperands) + " rsp operands and " + std::to_string(backward.MovedOperands) + " moved in place, not 2 carrying 3 and 5");
+        std::cout << "red-zone framer execution tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << "red-zone framer execution tests failed: " << error.what() << '\n';
+        return 1;
+    }
+}
+
+#else
+
+int main() {
+    std::cout << "skipped: the red-zone framer execution tests single-step x86-64 code on Linux\n";
+    return 77;
+}
+
+#endif
diff --git a/core/relinker/codegen/tests/RedZoneFramerTests.cpp b/core/relinker/codegen/tests/RedZoneFramerTests.cpp
new file mode 100644
index 0000000000..31466fcfdb
--- /dev/null
+++ b/core/relinker/codegen/tests/RedZoneFramerTests.cpp
@@ -0,0 +1,625 @@
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <cstdint>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+void require(const bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+constexpr std::uint64_t Base = 0x1000;
+
+std::vector<std::uint8_t> padTo(std::vector<std::uint8_t> bytes, const std::size_t size) {
+    bytes.resize(size, 0xcc);
+    return bytes;
+}
+
+void append(std::vector<std::uint8_t>& bytes, const std::vector<std::uint8_t>& more) {
+    bytes.insert(bytes.end(), more.begin(), more.end());
+}
+
+std::vector<std::uint8_t> callTo(const std::size_t from, const std::size_t target) {
+    const auto displacement = static_cast<std::int32_t>(target) - static_cast<std::int32_t>(from + 5);
+    return {0xe8, static_cast<std::uint8_t>(displacement), static_cast<std::uint8_t>(displacement >> 8), static_cast<std::uint8_t>(displacement >> 16), static_cast<std::uint8_t>(displacement >> 24)};
+}
+
+const std::vector<std::uint8_t> Prologue{0x55, 0x48, 0x89, 0xe5, 0x41, 0x57, 0x53};
+const std::vector<std::uint8_t> Exit{0x5b, 0x41, 0x5f, 0x5d, 0xc3};
+const std::vector<std::uint8_t> StoreBelowPushes{0x48, 0x89, 0x7d, 0xe8};
+const std::vector<std::uint8_t> LoadBelowPushes{0x48, 0x8b, 0x45, 0xe8};
+const std::vector<std::uint8_t> LoadAbovePushes{0x48, 0x8b, 0x45, 0x08};
+
+std::vector<std::uint8_t> leaf(const std::vector<std::uint8_t>& body) {
+    std::vector<std::uint8_t> bytes = Prologue;
+    append(bytes, body);
+    append(bytes, Exit);
+    return bytes;
+}
+
+struct Image {
+    std::vector<std::uint8_t> bytes;
+    std::vector<Domain::ProgramHeader> segments;
+    std::vector<Codegen::RedZoneFunction> functions;
+};
+
+Image image(const std::vector<std::vector<std::uint8_t>>& functions) {
+    Image result;
+    std::vector<std::size_t> starts;
+    std::size_t at = 0x40;
+    for (const auto& function : functions) {
+        starts.push_back(at);
+        at += (function.size() + 15) / 16 * 16 + 16;
+    }
+    std::vector<std::uint8_t> caller;
+    for (const auto start : starts) append(caller, callTo(caller.size(), start));
+    caller.push_back(0xc3);
+    result.bytes = padTo(caller, 0x40);
+    for (std::size_t index = 0; index < functions.size(); ++index) {
+        result.bytes = padTo(result.bytes, starts[index]);
+        append(result.bytes, functions[index]);
+        result.functions.push_back({Base + starts[index], Base + starts[index] + functions[index].size()});
+    }
+    result.bytes = padTo(result.bytes, (result.bytes.size() + 15) / 16 * 16 + 16);
+    result.segments.push_back({1, 5, 0, Base, Base, result.bytes.size(), result.bytes.size(), 16});
+    return result;
+}
+
+void framesRedZoneLeaf() {
+    std::vector<std::uint8_t> body = StoreBelowPushes;
+    append(body, LoadBelowPushes);
+    const auto input = image({leaf(body)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.RedZoneFunctions == 1 && report.Framed == 1 && report.Exits == 1, "a red-zone leaf was not framed");
+    require(sites.size() == 2, "a framed leaf needs one prologue and one exit site");
+    require(displacements.empty() && report.FramedWithoutFramePointer == 0, "a leaf with a frame pointer had rsp operands moved");
+
+    const auto& entry = sites[0];
+    require(entry.Address == Base + 0x40 && entry.Length == Prologue.size(), "the prologue site does not cover the pushes");
+    require(entry.OriginalBytes == Prologue, "the prologue site lost its bytes");
+    std::vector<std::uint8_t> entryBody = Prologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0x80, 0xe9, 0, 0, 0, 0});
+    require(entry.Body == entryBody && entry.ReturnBranchOffset == Prologue.size() + 5, "the prologue stub does not lower rsp after the pushes");
+
+    const auto& exit = sites[1];
+    require(exit.Address == Base + 0x40 + Prologue.size() + body.size() && exit.Length == Exit.size(), "the exit site does not cover the pops and ret");
+    std::vector<std::uint8_t> exitBody{0x48, 0x8d, 0xa4, 0x24, 0x80, 0, 0, 0};
+    append(exitBody, Exit);
+    append(exitBody, {0xe9, 0, 0, 0, 0});
+    require(exit.Body == exitBody && exit.ReturnBranchOffset == 8 + Exit.size(), "the exit stub does not raise rsp before the pops");
+}
+
+const std::vector<std::uint8_t> FramelessPrologue{0x53, 0x41, 0x56, 0x41, 0x57};
+const std::vector<std::uint8_t> FramelessExit{0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xc3};
+const std::vector<std::uint8_t> StoreBelowRsp{0x48, 0x89, 0x7c, 0x24, 0xf0};
+const std::vector<std::uint8_t> LoadBelowRsp{0x48, 0x8b, 0x44, 0x24, 0xf0};
+const std::vector<std::uint8_t> LoadAboveRsp{0x48, 0x8b, 0x44, 0x24, 0x08};
+const std::vector<std::uint8_t> LoadFarAboveRsp{0x48, 0x8b, 0x44, 0x24, 0x78};
+const std::vector<std::uint8_t> LoadAtRsp{0x48, 0x8b, 0x04, 0x24};
+const std::vector<std::uint8_t> StoreDeepBelowRsp{0x48, 0x89, 0x74, 0x24, 0xd8};
+const std::vector<std::uint8_t> LoadDeepBelowRsp{0x48, 0x8b, 0x44, 0x24, 0xd8};
+const std::vector<std::uint8_t> AddressBelowRsp{0x48, 0x8d, 0x44, 0x24, 0xe0};
+const std::vector<std::uint8_t> AddressAboveRsp{0x48, 0x8d, 0x44, 0x24, 0x08};
+const std::vector<std::uint8_t> StoreIndexedBelowRsp{0x48, 0x89, 0x7c, 0xcc, 0xf0};
+const std::vector<std::uint8_t> StoreImmediateFarAboveRsp{0xc7, 0x44, 0x24, 0x7c, 0x78, 0x56, 0x34, 0x12};
+const std::vector<std::uint8_t> LoadIndexedAtRsp{0x48, 0x8b, 0x04, 0xcc};
+const std::vector<std::uint8_t> AddRdxToRax{0x48, 0x01, 0xd0};
+const std::vector<std::uint8_t> VexStoreAtRsp{0xc5, 0xf8, 0x11, 0x04, 0x24};
+const std::vector<std::uint8_t> EvexStoreBelowRsp{0x62, 0xf1, 0x7c, 0x48, 0x11, 0x44, 0x24, 0xff};
+const std::vector<std::uint8_t> LoadRipRelative{0x48, 0x8b, 0x05, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<std::uint8_t> stubBody(std::vector<std::uint8_t> code) {
+    append(code, {0xe9, 0, 0, 0, 0});
+    return code;
+}
+
+std::vector<std::uint8_t> framelessLeaf(const std::vector<std::uint8_t>& prologue, const std::vector<std::uint8_t>& body, const std::vector<std::uint8_t>& exit) {
+    std::vector<std::uint8_t> bytes = prologue;
+    append(bytes, body);
+    append(bytes, exit);
+    return bytes;
+}
+
+void framesLeafWithoutFramePointer() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadBelowRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.RedZoneFunctions == 1 && report.Framed == 1 && report.FramedWithoutFramePointer == 1 && report.MovedOperands == 2, "a leaf that only pushes was not framed");
+    require(sites.size() == 2, "a framed leaf needs one prologue and one exit site");
+    const auto& entry = sites[0];
+    require(entry.Address == Base + 0x40 && entry.Length == FramelessPrologue.size(), "the prologue site does not cover the pushes");
+    std::vector<std::uint8_t> entryBody = FramelessPrologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0xf0, 0xe9, 0, 0, 0, 0});
+    require(entry.Body == entryBody, "the prologue stub does not lower rsp by the leaf's depth below rsp after the pushes");
+    const auto& exit = sites[1];
+    require(exit.Address == Base + 0x40 + FramelessPrologue.size() + body.size() && exit.OriginalBytes == FramelessExit, "the exit site does not cover the pops and ret");
+    std::vector<std::uint8_t> exitBody{0x48, 0x8d, 0xa4, 0x24, 0x10, 0, 0, 0};
+    append(exitBody, FramelessExit);
+    append(exitBody, {0xe9, 0, 0, 0, 0});
+    require(exit.Body == exitBody, "the exit stub does not raise rsp by the leaf's depth below rsp before the pops");
+    const auto storeDisplacement = 0x40 + FramelessPrologue.size() + 4;
+    const auto loadDisplacement = storeDisplacement + StoreBelowRsp.size();
+    require(displacements.size() == 2, "both rsp operands must move");
+    require(displacements[0].Offset == storeDisplacement && displacements[0].Bytes == std::vector<std::uint8_t>{0x00}, "the store below rsp was not moved to the lowered rsp");
+    require(displacements[1].Offset == loadDisplacement && displacements[1].Bytes == std::vector<std::uint8_t>{0x00}, "the load below rsp was not moved to the lowered rsp");
+}
+
+void shiftsByTheDeepestOperandBelowRsp() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, StoreDeepBelowRsp);
+    append(body, LoadDeepBelowRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && sites.size() == 2 && displacements.size() == 3, "a leaf reaching 0x28 bytes below rsp was not framed");
+    std::vector<std::uint8_t> entryBody = FramelessPrologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0xd0, 0xe9, 0, 0, 0, 0});
+    require(sites[0].Body == entryBody, "rsp is not lowered by the deepest displacement rounded up to 16");
+    require(std::vector<std::uint8_t>(sites[1].Body.begin(), sites[1].Body.begin() + 8) == std::vector<std::uint8_t>{0x48, 0x8d, 0xa4, 0x24, 0x30, 0, 0, 0}, "rsp is not raised by the shift it was lowered by");
+    require(displacements[0].Bytes == std::vector<std::uint8_t>{0x20} && displacements[1].Bytes == std::vector<std::uint8_t>{0x08} && displacements[2].Bytes == std::vector<std::uint8_t>{0x08}, "the operands below rsp were not moved by the shift");
+}
+
+void movesPositiveOperandsThatFitAfterTheShift() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadAboveRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.MovedOperands == 2 && sites.size() == 2, "a leaf with an 8-bit displacement above rsp that fits after the shift was not framed");
+    const auto loadDisplacement = 0x40 + FramelessPrologue.size() + StoreBelowRsp.size() + 4;
+    require(displacements.size() == 2 && displacements[1].Offset == loadDisplacement && displacements[1].Bytes == std::vector<std::uint8_t>{0x18}, "the load above rsp was not moved in place by the shift");
+}
+
+void shiftsByTheWholeRedZoneForAddressesBelowRsp() {
+    std::vector<std::uint8_t> below = StoreBelowRsp;
+    append(below, AddressBelowRsp);
+    std::vector<std::uint8_t> above = StoreBelowRsp;
+    append(above, AddressAboveRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, below, FramelessExit), framelessLeaf(FramelessPrologue, above, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && sites.size() == 4 && displacements.size() == 4, "leaves that take the address of a stack slot were not framed");
+    require(sites[0].Body[FramelessPrologue.size() + 4] == 0x80 && displacements[0].Bytes == std::vector<std::uint8_t>{0x70} && displacements[1].Bytes == std::vector<std::uint8_t>{0x60}, "a leaf that takes the address of a slot below rsp was not shifted by the whole red zone");
+    require(sites[2].Body[FramelessPrologue.size() + 4] == 0xf0 && displacements[2].Bytes == std::vector<std::uint8_t>{0x00} && displacements[3].Bytes == std::vector<std::uint8_t>{0x18}, "a leaf that only takes the address of a slot above rsp was shifted by more than its depth");
+}
+
+void shiftsByTheWholeRedZoneForIndexedOperands() {
+    std::vector<std::uint8_t> body = StoreIndexedBelowRsp;
+    append(body, LoadBelowRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && sites.size() == 2 && displacements.size() == 2, "a leaf with an indexed operand below rsp was not framed");
+    require(sites[0].Body[FramelessPrologue.size() + 4] == 0x80 && displacements[0].Bytes == std::vector<std::uint8_t>{0x70} && displacements[1].Bytes == std::vector<std::uint8_t>{0x70}, "a leaf whose indexed operand can reach deeper than its displacement was not shifted by the whole red zone");
+}
+
+void stubsOperandsWhoseDisplacementOverflows() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadFarAboveRsp);
+    append(body, StoreImmediateFarAboveRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.MovedOperands == 1 && report.OperandStubs == 2 && report.StubbedOperands == 2 && sites.size() == 4, "a leaf whose 8-bit displacements above rsp overflow after the shift was not framed with operand stubs");
+    const auto load = Base + 0x40 + FramelessPrologue.size() + StoreBelowRsp.size();
+    require(sites[2].Address == load && sites[2].Length == LoadFarAboveRsp.size() && sites[2].OriginalBytes == LoadFarAboveRsp, "the stub site does not cover the load that cannot move in place");
+    require(sites[2].Body == stubBody({0x48, 0x8b, 0x84, 0x24, 0x88, 0x00, 0x00, 0x00}) && sites[2].ReturnBranchOffset == 8, "the load was not re-encoded with a 32-bit displacement moved by the shift");
+    require(sites[3].Address == load + LoadFarAboveRsp.size() && sites[3].OriginalBytes == StoreImmediateFarAboveRsp, "the stub site does not cover the store of an immediate that cannot move in place");
+    require(sites[3].Body == stubBody({0xc7, 0x84, 0x24, 0x8c, 0x00, 0x00, 0x00, 0x78, 0x56, 0x34, 0x12}), "the store lost its immediate when its displacement was widened");
+    require(displacements.size() == 1 && displacements[0].Bytes == std::vector<std::uint8_t>{0x00}, "the store below rsp was not moved in place");
+}
+
+void stubsOperandsAtRspWithTheInstructionsAfterThem() {
+    std::vector<std::uint8_t> atRsp = StoreBelowRsp;
+    append(atRsp, LoadAtRsp);
+    append(atRsp, LoadAboveRsp);
+    std::vector<std::uint8_t> indexed = StoreBelowRsp;
+    append(indexed, LoadIndexedAtRsp);
+    append(indexed, AddRdxToRax);
+    const auto input = image({framelessLeaf(FramelessPrologue, atRsp, FramelessExit), framelessLeaf(FramelessPrologue, indexed, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && report.MovedOperands == 2 && report.OperandStubs == 2 && report.StubbedOperands == 3 && sites.size() == 6, "leaves with operands at rsp were not framed with operand stubs");
+    const auto first = 0x40 + FramelessPrologue.size() + StoreBelowRsp.size();
+    require(sites[2].Address == Base + first && sites[2].Length == LoadAtRsp.size() + LoadAboveRsp.size(), "the stub site does not run on to the next instruction to make room for its jump");
+    require(sites[2].Body == stubBody({0x48, 0x8b, 0x44, 0x24, 0x10, 0x48, 0x8b, 0x44, 0x24, 0x18}), "the load at rsp and the load the stub covers after it were not both moved by the shift");
+    for (const auto& displacement : displacements) require(displacement.Offset < first || displacement.Offset >= first + sites[2].Length, "an rsp operand inside a stub site was also moved in place");
+    require(sites[3].Body[FramelessPrologue.size() + 4] == 0x80, "a leaf with an indexed operand at rsp was not shifted by the whole red zone");
+    require(sites[5].OriginalBytes.size() == LoadIndexedAtRsp.size() + AddRdxToRax.size() && sites[5].Body == stubBody({0x48, 0x8b, 0x84, 0xcc, 0x80, 0x00, 0x00, 0x00, 0x48, 0x01, 0xd0}), "the indexed load at rsp was not re-encoded with a 32-bit displacement of 0x80 ahead of the add it covers");
+}
+
+void stubsVexOperandsAtRsp() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, VexStoreAtRsp);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.OperandStubs == 1 && report.StubbedOperands == 1 && sites.size() == 3, "a leaf with a VEX store at rsp was not framed with an operand stub");
+    require(sites[2].OriginalBytes == VexStoreAtRsp && sites[2].Body == stubBody({0xc5, 0xf8, 0x11, 0x44, 0x24, 0x10}), "the VEX store at rsp was not re-encoded with an 8-bit displacement moved by the shift");
+}
+
+void stubsOperandsAtRspWithTheInstructionsBeforeThem() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadAtRsp);
+    append(body, LoadRipRelative);
+    const auto input = image({framelessLeaf(FramelessPrologue, body, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.MovedOperands == 0 && report.OperandStubs == 1 && report.StubbedOperands == 2 && sites.size() == 3 && displacements.empty(), "a leaf whose short operand at rsp sits before a rip-relative instruction was not framed with a stub over the instruction before it");
+    const auto store = Base + 0x40 + FramelessPrologue.size();
+    require(sites[2].Address == store && sites[2].Length == StoreBelowRsp.size() + LoadAtRsp.size(), "the stub site does not start at the store before the operand at rsp");
+    require(sites[2].Body == stubBody({0x48, 0x89, 0x7c, 0x24, 0x00, 0x48, 0x8b, 0x44, 0x24, 0x10}), "the store before the operand and the operand at rsp were not both moved by the shift");
+}
+
+void skipsLeavesWithOperandsThatCannotMove() {
+    std::vector<std::uint8_t> evex = StoreBelowRsp;
+    append(evex, EvexStoreBelowRsp);
+    std::vector<std::uint8_t> beforeExit = StoreBelowRsp;
+    append(beforeExit, LoadAtRsp);
+    std::vector<std::uint8_t> beforeTarget = StoreBelowRsp;
+    append(beforeTarget, LoadAtRsp);
+    append(beforeTarget, {0xff, 0xc0, 0x3b, 0x44, 0x24, 0xf0, 0x72, 0xf8});
+    const auto input = image({framelessLeaf(FramelessPrologue, evex, FramelessExit), framelessLeaf(FramelessPrologue, beforeExit, FramelessExit), framelessLeaf(FramelessPrologue, beforeTarget, FramelessExit), framelessLeaf({0x41, 0x56, 0x41, 0x57}, StoreBelowRsp, {0x41, 0x5f, 0x41, 0x5e, 0xc3})});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.RedZoneFunctions == 4, "a leaf whose rsp operands can neither move nor be stubbed, or whose prologue is too short, was framed");
+    require(report.Skipped.at("rsp operand that cannot move with rsp") == 1, "an EVEX operand, whose 8-bit displacement is scaled, was not refused");
+    require(report.Skipped.at("rsp operand that cannot move and has no room for a stub") == 2, "an operand at rsp followed by an exit or a branch target was not refused for want of room");
+    require(report.Skipped.at("prologue shorter than a jump") == 1, "the leaf with a short prologue was not reported with its reason");
+}
+
+void skipsLeavesThatCopyRsp() {
+    std::vector<std::uint8_t> withCmov = StoreBelowRsp;
+    append(withCmov, {0x48, 0x0f, 0x45, 0xc4});
+    std::vector<std::uint8_t> withShlx = StoreBelowRsp;
+    append(withShlx, {0xc4, 0xe2, 0xf1, 0xf7, 0xc4});
+    const auto input = image({framelessLeaf(FramelessPrologue, withCmov, FramelessExit), framelessLeaf(FramelessPrologue, withShlx, FramelessExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.Skipped.at("other use of rsp") == 2, "a leaf that copies rsp into another register was framed");
+}
+
+const std::vector<std::uint8_t> InflatePrologue{0x55, 0x41, 0x57, 0x41, 0x56, 0x41, 0x55, 0x41, 0x54, 0x53, 0x48, 0x83, 0xec, 0x40};
+const std::vector<std::uint8_t> InflatePops{0x5b, 0x41, 0x5c, 0x41, 0x5d, 0x41, 0x5e, 0x41, 0x5f, 0x5d, 0xc3};
+const std::vector<std::uint8_t> InflateFree{0x48, 0x83, 0xc4, 0x40};
+
+std::vector<std::uint8_t> inflateExit() {
+    std::vector<std::uint8_t> bytes = InflateFree;
+    append(bytes, InflatePops);
+    return bytes;
+}
+
+std::vector<std::uint8_t> inflateBody() {
+    return {
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0x48, 0x89, 0x74, 0x24, 0x08,
+        0x48, 0x89, 0x54, 0x24, 0x38,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+        0x48, 0x03, 0x44, 0x24, 0x08,
+        0x48, 0x03, 0x44, 0x24, 0xe0,
+        0x48, 0x03, 0x44, 0x24, 0x00,
+        0xff, 0xc9,
+        0x75, 0xed,
+        0x48, 0x8b, 0x54, 0x24, 0x38,
+    };
+}
+
+std::vector<std::uint8_t> inflateCompareBody(const std::vector<std::uint8_t>& prior, const std::uint8_t back) {
+    std::vector<std::uint8_t> bytes{
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+        0x48, 0x03, 0x44, 0x24, 0xe0,
+    };
+    append(bytes, prior);
+    append(bytes, {0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, back});
+    return bytes;
+}
+
+const std::vector<std::uint8_t> AddRdiToR8{0x49, 0x01, 0xf8};
+const std::vector<std::uint8_t> CompareRdiAtRspShifted{0x48, 0x39, 0x7c, 0x24, 0x20};
+
+void stubsShortOperandsAtRspBeforeABranchWithTheInstructionsBeforeThem() {
+    const auto withAdd = inflateCompareBody(AddRdiToR8, 0xeb);
+    std::vector<std::uint8_t> withLoad{
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+        0x48, 0x03, 0x44, 0x24, 0xe0,
+        0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xee,
+    };
+    const auto input = image({framelessLeaf(InflatePrologue, withAdd, inflateExit()), framelessLeaf(InflatePrologue, withLoad, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && report.OperandStubs == 2 && report.StubbedOperands == 3 && report.MovedOperands == 5 && sites.size() == 6 && report.Skipped.empty(), "inflate_fast's 4-byte cmp at rsp between an instruction and a branch was not framed with a stub over the instruction before it");
+    const auto add = input.functions[0].Begin + InflatePrologue.size() + 22;
+    require(sites[2].Address == add && sites[2].Length == AddRdiToR8.size() + 4, "the stub site does not start at the add before the cmp at rsp");
+    std::vector<std::uint8_t> addBody = AddRdiToR8;
+    append(addBody, CompareRdiAtRspShifted);
+    require(sites[2].Body == stubBody(addBody), "the add was not copied ahead of the cmp re-encoded with a displacement of the shift");
+    const auto load = input.functions[1].Begin + InflatePrologue.size() + 17;
+    require(sites[5].Address == load && sites[5].Length == 9, "the stub site does not start at the load before the cmp at rsp");
+    std::vector<std::uint8_t> loadBody{0x48, 0x03, 0x44, 0x24, 0x00};
+    append(loadBody, CompareRdiAtRspShifted);
+    require(sites[5].Body == stubBody(loadBody), "the load before the cmp, itself an rsp operand, was not moved by the shift in the stub");
+    for (const auto& displacement : displacements) {
+        const auto at = Base + displacement.Offset;
+        require((at < sites[2].Address || at >= sites[2].Address + sites[2].Length) && (at < sites[5].Address || at >= sites[5].Address + sites[5].Length), "an rsp operand inside a stub site was also moved in place");
+    }
+}
+
+void skipsShortOperandsAtRspWhoseWidenedStubCoversABranchTarget() {
+    std::vector<std::uint8_t> body{
+        0x48, 0x89, 0x7c, 0x24, 0xe0,
+        0x48, 0x89, 0x7c, 0x24, 0x00,
+        0xb9, 0x04, 0x00, 0x00, 0x00,
+        0x31, 0xc0,
+    };
+    append(body, AddRdiToR8);
+    append(body, {0x48, 0x39, 0x3c, 0x24, 0x75, 0x03, 0x48, 0x01, 0xf0, 0xff, 0xc9, 0x75, 0xf3});
+    const auto input = image({framelessLeaf(InflatePrologue, body, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.RedZoneFunctions == 1 && report.Skipped.at("rsp operand that cannot move and has no room for a stub") == 1, "a cmp at rsp whose loop branches back to it was framed with a stub that starts at the add before it");
+}
+
+void framesLeavesThatAllocateBelowTheirPushes() {
+    const auto body = inflateBody();
+    const auto input = image({framelessLeaf(InflatePrologue, body, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.RedZoneFunctions == 1 && report.Framed == 1 && report.FramedWithoutFramePointer == 1 && report.Exits == 1 && sites.size() == 2, "a leaf that allocates with sub after its pushes and spills below its allocation was not framed");
+    const auto& entry = sites[0];
+    require(entry.Address == Base + 0x40 && entry.OriginalBytes == InflatePrologue, "the prologue site does not cover the pushes and the sub");
+    std::vector<std::uint8_t> entryBody = InflatePrologue;
+    append(entryBody, {0x48, 0x8d, 0x64, 0x24, 0xe0, 0xe9, 0, 0, 0, 0});
+    require(entry.Body == entryBody, "the prologue stub does not lower rsp by 0x20 after the sub");
+    const auto& exit = sites[1];
+    require(exit.Address == Base + 0x40 + InflatePrologue.size() + body.size() && exit.OriginalBytes == inflateExit(), "the exit site does not cover the add, the pops and the ret");
+    std::vector<std::uint8_t> exitBody{0x48, 0x8d, 0xa4, 0x24, 0x20, 0, 0, 0};
+    append(exitBody, inflateExit());
+    append(exitBody, {0xe9, 0, 0, 0, 0});
+    require(exit.Body == exitBody, "the exit stub does not raise rsp by 0x20 before the add");
+    const std::vector<std::uint8_t> moved{0x00, 0x20, 0x28, 0x58, 0x28, 0x00, 0x20, 0x58};
+    require(displacements.size() == moved.size() && report.MovedOperands == moved.size(), "not every rsp operand of the allocating leaf was moved");
+    for (std::size_t index = 0; index < moved.size(); ++index)
+        require(displacements[index].Bytes == std::vector<std::uint8_t>{moved[index]}, "an rsp operand of the allocating leaf was not moved by 0x20 from the post-sub rsp");
+    require(displacements[0].Offset == 0x40 + InflatePrologue.size() + 4, "the spill below the allocation was not the first operand moved");
+}
+
+void framesLeavesThatAllocateWithLeaOrALargeSub() {
+    const std::vector<std::uint8_t> leaPrologue{0x53, 0x41, 0x56, 0x48, 0x8d, 0x64, 0x24, 0xc0};
+    const std::vector<std::uint8_t> leaExit{0x48, 0x8d, 0x64, 0x24, 0x40, 0x41, 0x5e, 0x5b, 0xc3};
+    const std::vector<std::uint8_t> largePrologue{0x53, 0x48, 0x81, 0xec, 0x00, 0x01, 0x00, 0x00};
+    const std::vector<std::uint8_t> largeExit{0x48, 0x81, 0xc4, 0x00, 0x01, 0x00, 0x00, 0x5b, 0xc3};
+    std::vector<std::uint8_t> largeBody = StoreBelowRsp;
+    append(largeBody, {0x48, 0x8b, 0x84, 0x24, 0x80, 0x00, 0x00, 0x00});
+    const auto input = image({framelessLeaf(leaPrologue, StoreBelowRsp, leaExit), framelessLeaf(largePrologue, largeBody, largeExit)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && sites.size() == 4 && displacements.size() == 3, "leaves that allocate with lea or a 32-bit sub were not framed");
+    require(sites[0].OriginalBytes == leaPrologue && sites[1].OriginalBytes == leaExit, "the lea allocation and free are not part of the prologue and exit sites");
+    require(sites[2].OriginalBytes == largePrologue && sites[3].OriginalBytes == largeExit, "the 32-bit sub and add are not part of the prologue and exit sites");
+    require(displacements[2].Bytes == std::vector<std::uint8_t>{0x90, 0x00, 0x00, 0x00}, "the 32-bit displacement into the allocation was not moved by the shift");
+}
+
+void skipsAllocatingLeavesWithoutAMatchingFree() {
+    const std::vector<std::uint8_t> otherFree{0x48, 0x83, 0xc4, 0x30};
+    std::vector<std::uint8_t> wrongFree = otherFree;
+    append(wrongFree, InflatePops);
+    std::vector<std::uint8_t> moreRsp = StoreBelowRsp;
+    append(moreRsp, {0x48, 0x83, 0xec, 0x08});
+    const auto input = image({framelessLeaf(InflatePrologue, StoreBelowRsp, InflatePops), framelessLeaf(InflatePrologue, StoreBelowRsp, wrongFree), framelessLeaf(InflatePrologue, moreRsp, inflateExit())});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && displacements.empty() && report.RedZoneFunctions == 3, "an allocating leaf without a matching free, or with more rsp arithmetic, was framed");
+    require(report.Skipped.at("exit does not free the prologue's allocation") == 1, "an exit that does not free the allocation was not reported with its own reason");
+    require(report.Skipped.at("other use of rsp") == 2, "an add of another size before the pops, or more rsp arithmetic in the body, was not reported as another use of rsp");
+}
+
+Image calledThenUncalled(const std::vector<std::uint8_t>& called, const std::vector<std::uint8_t>& uncalled) {
+    Image result;
+    result.bytes = callTo(0, 0x40);
+    result.bytes.push_back(0xc3);
+    result.bytes = padTo(result.bytes, 0x40);
+    append(result.bytes, called);
+    result.bytes.resize(0x60, 0x90);
+    append(result.bytes, uncalled);
+    result.bytes = padTo(result.bytes, 0x80);
+    result.segments.push_back({1, 5, 0, Base, Base, result.bytes.size(), result.bytes.size(), 16});
+    result.functions.push_back({Base + 0x40, Base + 0x40 + called.size()});
+    result.functions.push_back({Base + 0x60, Base + 0x60 + uncalled.size()});
+    return result;
+}
+
+void framesEachFunctionFromItsOwnFde() {
+    std::vector<std::uint8_t> body = StoreBelowRsp;
+    append(body, LoadBelowRsp);
+    const auto input = calledThenUncalled(framelessLeaf(FramelessPrologue, body, FramelessExit), framelessLeaf(FramelessPrologue, StoreBelowRsp, FramelessExit));
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Functions == 2 && report.Framed == 2 && report.Exits == 2 && sites.size() == 4 && displacements.size() == 3, "two adjacent functions were not framed each by its own FDE");
+    require(sites[0].Address < Base + 0x60 && sites[1].Address + sites[1].Length <= Base + 0x60 && displacements[0].Offset < 0x60 && displacements[1].Offset < 0x60, "the first function's frame runs past its FDE end");
+    require(sites[2].Address == Base + 0x60 && sites[2].OriginalBytes == FramelessPrologue && displacements[2].Offset > 0x60, "the function reached without a call was not framed from its own FDE start");
+}
+
+void treatsATailCallPastTheFdeEndAsLeaving() {
+    std::vector<std::uint8_t> called = FramelessPrologue;
+    append(called, StoreBelowRsp);
+    append(called, {0x85, 0xff, 0x75, 0x06});
+    append(called, FramelessExit);
+    append(called, {0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xe9, 0x02, 0x00, 0x00, 0x00});
+    const auto input = calledThenUncalled(called, framelessLeaf(FramelessPrologue, StoreBelowRsp, FramelessExit));
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Skipped.at("branch leaves the function") == 1, "the tail call past the FDE end was not reported as leaving the function");
+    require(report.Framed == 1 && sites.size() == 2 && sites[0].Address == Base + 0x60, "the tail-called function was not framed from its own FDE start");
+}
+
+void framesALeafAfterAJumpWithoutInt3FromItsOwnFde() {
+    std::vector<std::uint8_t> first = FramelessPrologue;
+    append(first, StoreBelowRsp);
+    append(first, {0x31, 0xc0, 0xeb, 0x06});
+    append(first, FramelessExit);
+    append(first, {0x48, 0x3b, 0x44, 0x24, 0xf0, 0x73, 0xf3, 0x48, 0xff, 0xc0, 0xeb, 0xf4});
+    require(first.size() == 0x20, "the first leaf must end where the second starts");
+    std::vector<std::uint8_t> second = StoreBelowRsp;
+    append(second, LoadBelowRsp);
+    const auto input = calledThenUncalled(first, framelessLeaf(FramelessPrologue, second, FramelessExit));
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 2 && report.Exits == 2 && sites.size() == 4 && displacements.size() == 4, "a leaf right after a jmp without int3 padding was not framed on its own");
+    require(sites[1].Address + sites[1].Length <= Base + 0x60 && displacements[1].Offset < 0x60, "the leaf ending in a jmp took the next leaf into its body");
+    require(sites[2].Address == Base + 0x60 && sites[2].OriginalBytes == FramelessPrologue && displacements[2].Offset > 0x60, "the leaf after the jmp was not framed from its own FDE start");
+}
+
+void keepsColdBlocksAfterARetInsideTheFde() {
+    std::vector<std::uint8_t> leaf = FramelessPrologue;
+    append(leaf, StoreBelowRsp);
+    append(leaf, {0x85, 0xff, 0x74, 0x12});
+    append(leaf, LoadBelowRsp);
+    append(leaf, FramelessExit);
+    append(leaf, {0x0f, 0x1f, 0x80, 0x00, 0x00, 0x00, 0x00});
+    append(leaf, {0x48, 0x8b, 0x54, 0x24, 0xf0});
+    append(leaf, FramelessExit);
+    const auto input = image({leaf});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && report.Exits == 2 && sites.size() == 3, "the exit of a cold block after the ret inside the FDE was not framed");
+    require(displacements.size() == 3 && displacements[2].Offset == 0x40 + 0x20 + 4 && displacements[2].Bytes == std::vector<std::uint8_t>{0x00}, "the rsp operand of a cold block after the ret inside the FDE was not moved");
+}
+
+void keepsLoopsAlignedAfterAJump() {
+    std::vector<std::uint8_t> loop = FramelessPrologue;
+    append(loop, StoreBelowRsp);
+    append(loop, {0x31, 0xc0, 0xeb, 0x04, 0x66, 0x90, 0xff, 0xc0, 0x3b, 0x44, 0x24, 0xf0, 0x72, 0xf8});
+    append(loop, FramelessExit);
+    const auto input = image({loop});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(report.Framed == 1 && sites.size() == 2 && displacements.size() == 2, "a leaf whose loop header is aligned after a jump was not framed");
+}
+
+void leavesOtherFunctions() {
+    std::vector<std::uint8_t> nonLeaf = Prologue;
+    append(nonLeaf, StoreBelowPushes);
+    append(nonLeaf, {0xff, 0xd0});
+    append(nonLeaf, Exit);
+    const auto input = image({leaf(LoadAbovePushes), nonLeaf});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {}, report, displacements);
+    require(sites.empty() && report.RedZoneFunctions == 0, "a leaf without red-zone use or a function that calls was framed");
+}
+
+void skipsSitesTakenByOtherStubs() {
+    const auto input = image({leaf(StoreBelowPushes)});
+    Codegen::TrampolineSite other{};
+    other.Address = Base + 0x40;
+    other.Length = 5;
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, input.functions, {other}, report, displacements);
+    require(sites.empty() && report.Skipped.at("overlaps another stub") == 1, "a site over another stub was framed");
+}
+
+void framesAPointerOnlyFunctionByItsOwnBounds() {
+    const auto first = leaf(StoreBelowPushes);
+    std::vector<std::uint8_t> secondBody = StoreBelowPushes;
+    append(secondBody, LoadBelowPushes);
+    const auto second = leaf(secondBody);
+    std::vector<std::uint8_t> bytes = callTo(0, 0x40);
+    bytes.push_back(0xc3);
+    bytes = padTo(bytes, 0x40);
+    append(bytes, first);
+    const auto secondStart = bytes.size();
+    append(bytes, second);
+    bytes = padTo(bytes, (bytes.size() + 15) / 16 * 16 + 16);
+    const std::vector<Domain::ProgramHeader> segments{{1, 5, 0, Base, Base, bytes.size(), bytes.size(), 16}};
+    const std::vector<Codegen::RedZoneFunction> functions{{Base + 0x40, Base + 0x40 + first.size()}, {Base + secondStart, Base + secondStart + second.size()}};
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(bytes, segments, functions, {}, report, displacements);
+    require(report.Functions == 2 && report.Framed == 2 && report.Exits == 2, "a function reached only through a pointer was not framed by its own bounds");
+    require(sites.size() == 4, "two framed leaves need two prologue and two exit sites");
+    require(sites[2].Address == Base + secondStart && sites[2].OriginalBytes == Prologue, "the second function's prologue site is not at its own start");
+    require(sites[1].Address + sites[1].Length == Base + 0x40 + first.size(), "the first function's exit runs past its end");
+}
+
+void leavesCodeWithoutAFunctionRange() {
+    const auto input = image({leaf(StoreBelowPushes)});
+    Codegen::RedZoneFrameReport report;
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    const auto sites = Codegen::FrameRedZoneFunctions(input.bytes, input.segments, {}, {}, report, displacements);
+    require(sites.empty() && report.Functions == 0, "code without a function range was framed");
+}
+
+}
+
+int main() {
+    try {
+        framesRedZoneLeaf();
+        leavesOtherFunctions();
+        skipsSitesTakenByOtherStubs();
+        framesLeafWithoutFramePointer();
+        shiftsByTheDeepestOperandBelowRsp();
+        movesPositiveOperandsThatFitAfterTheShift();
+        shiftsByTheWholeRedZoneForAddressesBelowRsp();
+        shiftsByTheWholeRedZoneForIndexedOperands();
+        framesLeavesThatAllocateBelowTheirPushes();
+        framesLeavesThatAllocateWithLeaOrALargeSub();
+        skipsAllocatingLeavesWithoutAMatchingFree();
+        stubsOperandsWhoseDisplacementOverflows();
+        stubsOperandsAtRspWithTheInstructionsAfterThem();
+        stubsVexOperandsAtRsp();
+        stubsOperandsAtRspWithTheInstructionsBeforeThem();
+        stubsShortOperandsAtRspBeforeABranchWithTheInstructionsBeforeThem();
+        skipsShortOperandsAtRspWhoseWidenedStubCoversABranchTarget();
+        skipsLeavesWithOperandsThatCannotMove();
+        skipsLeavesThatCopyRsp();
+        framesEachFunctionFromItsOwnFde();
+        treatsATailCallPastTheFdeEndAsLeaving();
+        framesALeafAfterAJumpWithoutInt3FromItsOwnFde();
+        keepsColdBlocksAfterARetInsideTheFde();
+        keepsLoopsAlignedAfterAJump();
+        framesAPointerOnlyFunctionByItsOwnBounds();
+        leavesCodeWithoutAFunctionRange();
+        std::cout << "red-zone framer tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << "red-zone framer tests failed: " << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/codegen/tests/RewriteBoundaryTests.cpp b/core/relinker/codegen/tests/RewriteBoundaryTests.cpp
index fa9ee00553..dd1bd9a185 100644
--- a/core/relinker/codegen/tests/RewriteBoundaryTests.cpp
+++ b/core/relinker/codegen/tests/RewriteBoundaryTests.cpp
@@ -2,26 +2,114 @@
 #include <iostream>
 #include <stdexcept>
 
-static void Require(bool ok) { if (!ok) throw std::runtime_error("Invalid rewrite boundary accepted"); }
+static void Require(bool ok) {
+    if (!ok)
+        throw std::runtime_error("Invalid rewrite boundary accepted");
+}
+
+static void RequireTruncatedBranchRejected(bool ok) {
+    if (!ok)
+        throw std::runtime_error(
+            "Length-changing rewrite accepted a section with a truncated relative branch");
+}
 
 int main() {
     try {
         const Codegen::X64InstructionRewriter rewriter;
-        for (const auto& code : {std::vector<std::uint8_t>{0xB8, 0x90, 0x90, 0x90, 0x90, 0xC3},
-                               std::vector<std::uint8_t>{0x48, 0x8B, 0x05, 0x90, 0x90, 0x90, 0x90, 0xC3},
-                               std::vector<std::uint8_t>{0xE8, 0x90, 0x90, 0x90, 0x90, 0xC3}}) {
+
+        for (const auto& code : {
+                 std::vector<std::uint8_t>{
+                     0xB8, 0x90, 0x90, 0x90, 0x90, 0xC3},
+                 std::vector<std::uint8_t>{
+                     0x48, 0x8B, 0x05, 0x90, 0x90, 0x90, 0x90, 0xC3},
+                 std::vector<std::uint8_t>{
+                     0xE8, 0x90, 0x90, 0x90, 0x90, 0xC3}
+             }) {
             const auto original = code;
-            for (std::size_t offset = 1; offset + 1 < code.size(); ++offset) {
+
+            for (std::size_t offset = 1;
+                 offset + 1 < code.size();
+                 ++offset) {
                 bool rejected = false;
-                try { (void)rewriter.Rewrite(code, {offset, {0x90}}); }
-                catch (const std::exception&) { rejected = true; }
+
+                try {
+                    (void)rewriter.Rewrite(code, {offset, {0x90}});
+                } catch (const std::exception&) {
+                    rejected = true;
+                }
+
                 Require(rejected && code == original);
             }
+
             const auto result = rewriter.Rewrite(code, {0, {0x90}});
-            Require(result.Bytes == std::vector<std::uint8_t>{0x90, 0xC3});
+
+            Require(result.Bytes == std::vector<std::uint8_t>{
+                0x90, 0xC3});
         }
-        const auto result = rewriter.Rewrite({0x90, 0x90, 0xC3}, {1, {0x90, 0x90}});
-        Require(result.Bytes == std::vector<std::uint8_t>{0x90, 0x90, 0x90, 0xC3});
-        std::cout << "18 rewrite boundary cases passed\n";
-    } catch (const std::exception& error) { std::cerr << error.what() << '\n'; return 1; }
+
+        const auto result = rewriter.Rewrite(
+            {0x90, 0x90, 0xC3},
+            {1, {0x90, 0x90}});
+
+        Require(result.Bytes == std::vector<std::uint8_t>{
+            0x90, 0x90, 0x90, 0xC3});
+
+        for (const auto& code : {
+                 std::vector<std::uint8_t>{
+                     0x66, 0xEB, 0x01, 0x90, 0xC3},
+                 std::vector<std::uint8_t>{
+                     0x90, 0x66, 0xEB, 0xFC, 0xC3}
+             }) {
+            bool rejected = false;
+
+            try {
+                const auto offset =
+                    code[0] == 0x66 ? std::size_t{3} : std::size_t{0};
+
+                (void)rewriter.Rewrite(code, {offset, {0x66, 0x90}});
+            } catch (const std::exception&) {
+                rejected = true;
+            }
+
+            RequireTruncatedBranchRejected(rejected);
+        }
+
+        const auto unaffected = rewriter.Rewrite(
+            {0x66, 0xEB, 0x00, 0x90, 0x90, 0xC3},
+            {4, {0x66, 0x90}});
+
+        Require(unaffected.Bytes == std::vector<std::uint8_t>{
+            0x66, 0xEB, 0x00, 0x90, 0x66, 0x90, 0xC3});
+
+        std::vector<std::uint8_t> forwardWraparound(0x10004, 0x90);
+        forwardWraparound[0xFFFA] = 0x66;
+        forwardWraparound[0xFFFB] = 0xEB;
+        forwardWraparound[0xFFFC] = 0x03;
+
+        bool forwardWraparoundRejected = false;
+        try {
+            (void)rewriter.Rewrite(forwardWraparound, {10, {0x66, 0x90}});
+        } catch (const std::exception&) {
+            forwardWraparoundRejected = true;
+        }
+        RequireTruncatedBranchRejected(forwardWraparoundRejected);
+
+        std::vector<std::uint8_t> backwardWraparound(0x10004, 0x90);
+        backwardWraparound[0] = 0x66;
+        backwardWraparound[1] = 0xEB;
+        backwardWraparound[2] = 0xFC;
+
+        bool backwardWraparoundRejected = false;
+        try {
+            (void)rewriter.Rewrite(backwardWraparound, {0xFFFE, {0x66, 0x90}});
+        } catch (const std::exception&) {
+            backwardWraparoundRejected = true;
+        }
+        RequireTruncatedBranchRejected(backwardWraparoundRejected);
+
+        std::cout << "21 rewrite boundary cases passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
 }
diff --git a/core/relinker/domain/include/domain/Types.hpp b/core/relinker/domain/include/domain/Types.hpp
index dd181853e0..6757f8507a 100644
--- a/core/relinker/domain/include/domain/Types.hpp
+++ b/core/relinker/domain/include/domain/Types.hpp
@@ -106,6 +106,7 @@ struct SysVDynamicSection {
     std::vector<GuestRuntime> GuestModules;
     std::map<VirtualAddress, std::string> ImportModules;
     std::set<VirtualAddress> FunctionImports;
+    std::set<VirtualAddress> NamedImports;
     std::set<std::string> UnmatchedImportModules;
     std::vector<std::string> NeededLibraries;
 };
diff --git a/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp b/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp
index 9da009bc08..b8b6b853b6 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/general/ElfConstants.hpp
@@ -139,20 +139,14 @@ inline constexpr std::int64_t DT_OS_SYMTABSZ = 0x6100003f;
 inline constexpr std::uint32_t R_X86_64_NONE = 0;
 inline constexpr std::uint32_t R_X86_64_64 = 1;
 inline constexpr std::uint32_t R_X86_64_PC32 = 2;
-inline constexpr std::uint32_t R_X86_64_GOT32 = 3;
-inline constexpr std::uint32_t R_X86_64_PLT32 = 4;
 inline constexpr std::uint32_t R_X86_64_COPY = 5;
 inline constexpr std::uint32_t R_X86_64_GLOB_DAT = 6;
 inline constexpr std::uint32_t R_X86_64_JUMP_SLOT = 7;
 inline constexpr std::uint32_t R_X86_64_RELATIVE = 8;
-inline constexpr std::uint32_t R_X86_64_GOTPCREL = 9;
 inline constexpr std::uint32_t R_X86_64_32 = 10;
-inline constexpr std::uint32_t R_X86_64_32S = 11;
 inline constexpr std::uint32_t R_X86_64_DTPMOD64 = 16;
 inline constexpr std::uint32_t R_X86_64_DTPOFF64 = 17;
 inline constexpr std::uint32_t R_X86_64_TPOFF64 = 18;
-inline constexpr std::uint32_t R_X86_64_GOTPCRELX = 41;
-inline constexpr std::uint32_t R_X86_64_REX_GOTPCRELX = 42;
 inline constexpr std::uint32_t R_X86_64_IRELATIVE = 37;
 
 inline constexpr std::uint8_t STB_GLOBAL = 1;
@@ -170,6 +164,7 @@ inline constexpr std::uint32_t SHT_PROGBITS = 1;
 inline constexpr std::uint32_t SHT_SYMTAB = 2;
 inline constexpr std::uint32_t SHT_STRTAB = 3;
 inline constexpr std::uint32_t SHT_DYNAMIC = 6;
+inline constexpr std::uint32_t SHT_NOBITS = 8;
 inline constexpr std::uint32_t SHT_DYNSYM = 11;
 inline constexpr std::uint32_t SHF_WRITE = 0x1;
 inline constexpr std::uint32_t SHF_ALLOC = 0x2;
diff --git a/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp b/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp
index 5ca491e9bf..1dcc28bbd0 100644
--- a/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp
+++ b/core/relinker/elfpatcher/include/elfpatcher/general/GuestModuleWriter.hpp
@@ -9,7 +9,7 @@ namespace Elfpatcher {
 
 class GuestModuleWriter {
 public:
-    std::vector<std::uint8_t> WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath) const;
+    std::vector<std::uint8_t> WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath, bool deferInitialization = false) const;
     std::vector<std::uint8_t> WriteWindows(const Relinker::GuestImage& image, Domain::GuestRuntime& runtime, const std::function<void(std::string_view)>& message = {}) const;
     std::vector<std::uint8_t> WriteMacOs(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath, const std::function<void(std::string_view)>& message = {}) const;
 };
diff --git a/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp b/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp
index fc23e28dea..f53da5a100 100644
--- a/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp
+++ b/core/relinker/elfpatcher/src/general/ProgramHeaderLayoutBuilder.cpp
@@ -13,6 +13,8 @@ namespace Elfpatcher {
 
 namespace {
 
+constexpr std::size_t kExtendedProgramHeaderCount = 0xffff;
+
 bool hasWritableLoadCoverage(
     const std::vector<Domain::ProgramHeader>& headers,
     const Domain::ProgramHeader& relro
@@ -152,6 +154,8 @@ std::vector<Domain::ProgramHeader> ProgramHeaderLayoutBuilder::_outputHeaders(co
     auto kept = _keptHeaders(originalHeaders);
     if (std::none_of(kept.begin(), kept.end(), [](const Domain::ProgramHeader& ph) { return ph.Type == PT_GNU_STACK; }))
         kept.push_back(Domain::ProgramHeader{PT_GNU_STACK, PF_R | PF_W, 0, 0, 0, 0, 0, 16});
+    if (kept.size() >= kExtendedProgramHeaderCount - kSyntheticProgramHeaderCount)
+        throw Domain::RelinkerException("Extended program header counts are not supported");
     return kept;
 }
 
diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index df116a307c..b2f84ae52d 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -4,10 +4,13 @@
 #include <elfpatcher/general/SectionHeaderTableRequest.hpp>
 #include <codegen/x86/Amd64OnlySubstitutionTable.hpp>
 #include <codegen/x86/StubBodyBuilder.hpp>
+#include <domain/ImportModule.hpp>
 #include <io/BufferUtils.hpp>
+#include <nid/NidCompute.hpp>
 #include <algorithm>
 #include <limits>
 #include <map>
+#include <set>
 #include <span>
 #include <sstream>
 #include <string>
@@ -82,7 +85,6 @@ std::vector<std::uint8_t> RebasedRelocations(const std::vector<std::uint8_t>& ta
         case R_X86_64_GLOB_DAT:
         case R_X86_64_JUMP_SLOT:
         case R_X86_64_32:
-        case R_X86_64_32S:
         case R_X86_64_DTPMOD64:
         case R_X86_64_DTPOFF64:
         case R_X86_64_TPOFF64:
@@ -190,6 +192,46 @@ std::vector<TracedImport> TracedImports(const Domain::SysVDynamicSection& dynSec
     return imports;
 }
 
+Domain::SysVDynamicSection ImportsByNid(Domain::SysVDynamicSection dynSection) {
+    RequireWholeEntries(dynSection.DynamicSegmentData, kDynEntrySize, "Executable dependency table");
+    for (std::size_t entry = 0; entry < dynSection.DynamicSegmentData.size(); entry += kDynEntrySize) {
+        if (static_cast<std::int64_t>(Io::ReadU64(dynSection.DynamicSegmentData, entry)) != DT_NEEDED)
+            continue;
+        const auto offset = Io::ReadU64(dynSection.DynamicSegmentData, entry + 8);
+        if (offset >= dynSection.DynStrData.size())
+            throw Domain::RelinkerException("DT_NEEDED string offset is out of bounds", offset);
+        const auto name = ReadDynamicString(dynSection.DynStrData, static_cast<std::uint32_t>(offset));
+        const auto library = Domain::NeededLibraryName(name);
+        if (library == name)
+            continue;
+        Io::WriteU64(dynSection.DynamicSegmentData, entry + 8, dynSection.DynStrData.size());
+        Io::AppendString(dynSection.DynStrData, library);
+    }
+    for (auto& library : dynSection.NeededLibraries)
+        library = Domain::NeededLibraryName(library);
+
+    std::set<std::uint64_t> symbols;
+    for (const auto* table : {&dynSection.RelaData, &dynSection.RelaPltData}) {
+        RequireWholeEntries(*table, kRelaEntrySize, "Relocation table");
+        for (std::size_t entry = 0; entry < table->size(); entry += kRelaEntrySize)
+            if (dynSection.NamedImports.contains(Io::ReadU64(*table, entry)))
+                symbols.insert(Io::ReadU64(*table, entry + 8) >> 32);
+    }
+    for (const auto symbol : symbols) {
+        if (symbol >= dynSection.DynSymData.size() / kSymEntrySize)
+            throw Domain::RelinkerException("Invalid import symbol index", symbol);
+        const auto symbolOffset = static_cast<std::size_t>(symbol * kSymEntrySize);
+        const auto name = ReadDynamicString(dynSection.DynStrData, Io::ReadU32(dynSection.DynSymData, symbolOffset));
+        if (name.empty() || name.find('#') != std::string::npos)
+            continue;
+        if (dynSection.DynStrData.size() > std::numeric_limits<std::uint32_t>::max())
+            throw Domain::RelinkerException("Dynamic string table too large");
+        Io::WriteU32(dynSection.DynSymData, symbolOffset, static_cast<std::uint32_t>(dynSection.DynStrData.size()));
+        Io::AppendString(dynSection.DynStrData, Nid::ComputeNid(name, ""));
+    }
+    return dynSection;
+}
+
 std::vector<std::uint8_t> TracePrologue(const std::uint64_t vaddr, const std::uint64_t table, const std::uint64_t tableEnd, const std::uint64_t function) {
     std::vector<std::uint8_t> code = {0x52, 0x53, 0x41, 0x54, 0x48, 0x83, 0xec, 0x08};
     const auto rip = [&](std::initializer_list<std::uint8_t> opcode, const std::uint64_t target) {
@@ -297,13 +339,14 @@ void LinuxElfPatcher::_appendTrampoline(
 std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     std::vector<std::uint8_t> sourceElf,
     const std::vector<Domain::ProgramHeader>& originalHeaders,
-    const Domain::SysVDynamicSection& dynSection,
+    const Domain::SysVDynamicSection& sourceDynSection,
     const std::uint64_t originalPltGotVaddr,
     const std::string& runPath,
     const bool lazyBinding,
     const bool dependencyDiagnostics,
     const std::vector<Codegen::TrampolineSite>& trampolines)
 {
+    const auto dynSection = ImportsByNid(sourceDynSection);
     if (dependencyDiagnostics)
         throw Domain::RelinkerException("Linux target does not support --windows-diagnostics");
     if (_fixedBase && lazyBinding)
diff --git a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp
index 76b91f97dc..316a1cc318 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxGuestModuleWriter.cpp
@@ -9,7 +9,7 @@
 
 namespace Elfpatcher {
 
-std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath) const {
+std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestImage& image, const std::vector<std::string>& dependencies, const std::string& runPath, const bool deferInitialization) const {
     auto bytes = image.Bytes;
     std::vector<Domain::ProgramHeader> headers;
     std::uint64_t end = 0;
@@ -35,7 +35,7 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
     const auto extraOffset = bytes.size();
     const auto extraAddress = Io::AlignUp64(end, 0x4000);
     const auto address = [&] { return extraAddress + bytes.size() - extraOffset; };
-    const bool passesModuleArgs = image.HasInit;
+    const bool passesModuleArgs = image.HasInit && !deferInitialization;
     std::uint64_t argsSlot = 0;
     std::uint64_t resultSlot = 0;
     if (passesModuleArgs) {
@@ -83,6 +83,39 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
         Io::WriteU64(relaData, entry, slot);
         Io::WriteU64(relaData, entry + 8, (symbol << 32) | kGlobDat);
     };
+    std::uint64_t lifecycleTable = 0;
+    if (deferInitialization) {
+        constexpr char exportName[] = "__aps5_guest_lifecycle_nid_no_patch";
+        if (std::any_of(image.Symbols.begin(), image.Symbols.end(), [&](const auto& symbol) { return symbol.Name == exportName; }))
+            throw Domain::RelinkerException("Reserved guest lifecycle export is already present");
+        Io::AlignBuffer(bytes, 8);
+        lifecycleTable = address();
+        const auto pointer = [&](std::uint64_t target, bool relocate = true) {
+            const auto slot = address();
+            Io::AppendU64(bytes, 0);
+            if (!relocate) return;
+            Io::AppendU64(relaData, slot);
+            Io::AppendU64(relaData, 8);
+            Io::AppendU64(relaData, target);
+        };
+        Io::AppendU64(bytes, 0x415053354c494658ull);
+        pointer(0);
+        pointer(image.Init, image.HasInit);
+        pointer(image.Fini, image.Fini != 0);
+        Io::AppendU64(bytes, image.InitArray.size());
+        Io::AppendU64(bytes, image.FiniArray.size());
+        Io::AppendU64(bytes, 0);
+        Io::AppendU64(bytes, 0);
+        for (const auto slot : image.InitArray) pointer(slot);
+        for (const auto slot : image.FiniArray) pointer(slot);
+        const auto entry = symbols.size();
+        symbols.resize(entry + 24, 0);
+        Io::WriteU32(symbols, entry, addString(exportName));
+        symbols[entry + 4] = 0x11;
+        Io::WriteU16(symbols, entry + 6, 1);
+        Io::WriteU64(symbols, entry + 8, lifecycleTable);
+        Io::WriteU64(symbols, entry + 16, address() - lifecycleTable);
+    }
     if (passesModuleArgs) {
         argsImport = addUndefinedImport("__aps5_get_pending_module_args_nid_no_patch");
         resultImport = addUndefinedImport("__aps5_set_module_init_result_nid_no_patch");
@@ -156,8 +189,33 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
         Io::AppendU32(bytes, static_cast<std::uint32_t>(distance));
         return start;
     };
-    const auto init = lifecycle(image.Init);
-    const auto fini = finalizer(image.Fini);
+    const auto init = deferInitialization ? 0 : lifecycle(image.Init);
+    auto fini = deferInitialization ? 0 : finalizer(image.Fini);
+    if (deferInitialization && (image.Fini != 0 || !image.FiniArray.empty())) {
+        fini = address();
+        bytes.insert(bytes.end(), {0x48, 0x83, 0x3d});
+        Io::AppendU32(bytes, stubDisplacement(lifecycleTable + 48, address() + 5));
+        bytes.push_back(2);
+        bytes.insert(bytes.end(), {0x0f, 0x85});
+        const auto skip = bytes.size();
+        Io::AppendU32(bytes, 0);
+        bytes.insert(bytes.end(), {0x48, 0xc7, 0x05});
+        Io::AppendU32(bytes, stubDisplacement(lifecycleTable + 48, address() + 8));
+        Io::AppendU32(bytes, 4);
+        bytes.insert(bytes.end(), {0x48, 0x83, 0xec, 8});
+        for (auto slot = image.FiniArray.rbegin(); slot != image.FiniArray.rend(); ++slot) {
+            bytes.insert(bytes.end(), {0x48, 0x8b, 0x05});
+            Io::AppendU32(bytes, stubDisplacement(*slot, address() + 4));
+            bytes.insert(bytes.end(), {0x48, 0x85, 0xc0, 0x74, 8, 0x31, 0xff, 0x31, 0xf6, 0x31, 0xd2, 0xff, 0xd0});
+        }
+        if (image.Fini != 0) {
+            bytes.insert(bytes.end(), {0x31, 0xff, 0x31, 0xf6, 0x31, 0xd2, 0xe8});
+            Io::AppendU32(bytes, stubDisplacement(image.Fini, address() + 4));
+        }
+        bytes.insert(bytes.end(), {0x48, 0x83, 0xc4, 8});
+        Io::WriteU32(bytes, skip, static_cast<std::uint32_t>(bytes.size() - skip - 4));
+        bytes.push_back(0xc3);
+    }
     Io::AlignBuffer(bytes, 8);
     const auto dynamicOffset = bytes.size();
     const auto dynamicAddress = address();
@@ -181,8 +239,8 @@ std::vector<std::uint8_t> GuestModuleWriter::WriteLinux(const Relinker::GuestIma
         tag(20, 7);
         tag(3, image.Got);
     }
-    if (!image.InitArray.empty()) { tag(25, image.InitArray.front()); tag(27, image.InitArray.size() * 8); }
-    if (!image.FiniArray.empty()) { tag(26, image.FiniArray.front()); tag(28, image.FiniArray.size() * 8); }
+    if (!deferInitialization && !image.InitArray.empty()) { tag(25, image.InitArray.front()); tag(27, image.InitArray.size() * 8); }
+    if (!deferInitialization && !image.FiniArray.empty()) { tag(26, image.FiniArray.front()); tag(28, image.FiniArray.size() * 8); }
     if (init != 0) tag(12, init);
     if (fini != 0) tag(13, fini);
     tag(30, DF_BIND_NOW | (image.Symbolic ? DF_SYMBOLIC : 0));
diff --git a/core/relinker/elfpatcher/src/macos/MacOsImage.cpp b/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
index 43a00cd7af..b864c5640e 100644
--- a/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
+++ b/core/relinker/elfpatcher/src/macos/MacOsImage.cpp
@@ -87,11 +87,13 @@ constexpr std::uint8_t EntryStub[] = {
     0x4c, 0xc4, 0x08, 0x49, 0xff, 0xc0, 0xeb, 0xed, 0x48, 0xc7, 0x44, 0xfc, 0x08, 0x00, 0x00, 0x00,
     0x00, 0x4c, 0x8d, 0x54, 0xfc, 0x10, 0x45, 0x31, 0xc0, 0x49, 0x39, 0xc8, 0x74, 0x0d, 0x4e, 0x8b,
     0x0c, 0xc2, 0x4f, 0x89, 0x0c, 0xc2, 0x49, 0xff, 0xc0, 0xeb, 0xee, 0x49, 0xc7, 0x04, 0xca, 0x00,
-    0x00, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x48, 0x8d, 0x3d, 0x00, 0x00, 0x00, 0x00, 0xff, 0x15, 0x00,
-    0x00, 0x00, 0x00, 0x0f, 0x0b,
+    0x00, 0x00, 0x00, 0x48, 0x89, 0xe6, 0x48, 0x8d, 0x3d, 0x00, 0x00, 0x00, 0x00, 0x48, 0x83, 0xec,
+    0x10, 0x0f, 0xae, 0x1c, 0x24, 0xc7, 0x44, 0x24, 0x04, 0xc0, 0x9f, 0x00, 0x00, 0x0f, 0xae, 0x54,
+    0x24, 0x04, 0xff, 0x15, 0x00, 0x00, 0x00, 0x00, 0x0f, 0xae, 0x14, 0x24, 0x48, 0x83, 0xc4, 0x10,
+    0x0f, 0x0b,
 };
 constexpr std::size_t EntryStubEntryDisplacement = 0x69;
-constexpr std::size_t EntryStubStartDisplacement = 0x6f;
+constexpr std::size_t EntryStubStartDisplacement = 0x84;
 
 struct Section {
     std::string Name;
@@ -423,6 +425,9 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
     const auto guestSegments = segments.size();
     auto sections = image.BuildSections();
     for (const auto& trap : tls.GsTraps) {
+        const auto target = tls.BranchTargets.upper_bound(trap.Rva);
+        if (target != tls.BranchTargets.end() && *target < trap.Rva + trap.Length)
+            throw Domain::RelinkerException("Branch enters a guest GS instruction", *target);
         if (input.Trampolines != nullptr) {
             for (const auto& site : *input.Trampolines) {
                 const auto siteRva = image.GetRva(site.Address, site.Length);
diff --git a/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp b/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp
index dbcca232a2..2be086cc21 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp
@@ -157,6 +157,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
     std::vector<std::uint32_t> searchCounts;
     std::vector<bool> platformTlsResolvers;
     std::vector<bool> imported(libraries.size());
+    std::vector<bool> executableImports(guestModules.size());
     const bool unscopedImports = std::any_of(imports.begin(), imports.end(), [](const auto& import) { return import.Library.empty(); });
     for (const auto& import : imports) {
         const auto library = Domain::NeededLibraryName(import.Library);
@@ -167,6 +168,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
             const bool guestName = index < guestModules.size() &&
                 std::find(guestModules[index].Names.begin(), guestModules[index].Names.end(), import.Library) != guestModules[index].Names.end();
             if (import.Library.empty() || name == library || guestName) order.push_back(CheckedRva(index));
+            if (import.TargetModule < 0 && !import.Library.empty() && index < guestModules.size() && (name == library || guestName)) executableImports[index] = true;
         }
         if (order.empty()) throw Domain::RelinkerException("Import module is not a dependency: " + import.Library);
         const bool hostModule = !import.Library.empty() &&
@@ -249,6 +251,11 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
     const auto searched = addString("Searched libraries:\n");
     const auto indent = addString("  ");
     const auto enteringElf = addString("Transferring control to ELF entry point\n");
+    std::vector<std::uint32_t> deferredImports;
+    for (std::size_t index = 0; index < guestModules.size(); ++index) {
+        if (guestModules[index].DeferInitialization && executableImports[index])
+            deferredImports.push_back(addString("Deferred module " + guestModules[index].Path + ": the executable imports from it, but it starts only when the title loads it\n"));
+    }
     std::vector<std::uint32_t> resolvedPaths;
     for (std::size_t index = 0; index < libraries.size(); ++index)
         resolvedPaths.push_back(reserve(PathCapacity));
@@ -717,6 +724,7 @@ WindowsEntryStub WindowsEntryStubBuilder::Build(const std::uint32_t dataRva, con
         code.Emit({0x85, 0xc0});
         unresolvedBranches.push_back(code.Branch({0x0f, 0x85}));
     }
+    for (const auto message : deferredImports) writeString(message);
     guestStartup.Initialize(code, guestModules, handles);
     writeString(enteringElf);
     code.Rip({0x48, 0x8d, 0x0d}, shellLibrary);
diff --git a/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp b/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp
index 71b149d37f..7bd368ac26 100644
--- a/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp
+++ b/core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp
@@ -86,8 +86,6 @@ PeRelocations WindowsRelocationBuilder::Apply(WindowsLoadImage& image, const Dom
 std::vector<std::uint8_t> WindowsRelocationBuilder::BuildBaseRelocations(const std::vector<std::uint32_t>& targets) const {
     std::map<std::uint32_t, std::vector<std::uint16_t>> pages;
     for (const auto target : targets) {
-        if ((target & 0xfffu) > 0x1000u - 8)
-            throw Domain::RelinkerException("Base relocation target crosses a page boundary", target);
         auto& entries = pages[target & ~0xfffu];
         const auto entry = static_cast<std::uint16_t>(0xa000u | (target & 0xfffu));
         if (std::find(entries.begin(), entries.end(), entry) == entries.end())
diff --git a/core/relinker/elfpatcher/tests/EntryStubTests.cpp b/core/relinker/elfpatcher/tests/EntryStubTests.cpp
index 2dc67f2ec2..1fe8dc32e9 100644
--- a/core/relinker/elfpatcher/tests/EntryStubTests.cpp
+++ b/core/relinker/elfpatcher/tests/EntryStubTests.cpp
@@ -118,6 +118,23 @@ void windowsStubRejectsAnOverlongAllocatorPath() {
     throw std::runtime_error("an allocator path past the startup buffer was accepted");
 }
 
+void windowsLibSceAmprObjectImportsFallBackToTheLibcProvider() {
+    using namespace Elfpatcher::Windows;
+    const auto nativeImports = WindowsImportBuilder().Build(0x1000);
+    const std::vector<std::string> libraries{"libSceAmpr.prx", "libc.prx"};
+    const std::vector<PeImport> amprImport{{.Name = "-mLzBSk-VGs", .TargetRva = 0x2000, .Addend = 0, .Library = "libSceAmpr.prx"}};
+    const auto amprStub = WindowsEntryStubBuilder().Build(0x40000, 0x1000, nativeImports, libraries, amprImport, "$ORIGIN/libs", false, false);
+    const std::vector<std::uint8_t> fallbackOrder{0, 0, 0, 0, 1, 0, 0, 0};
+    require(std::search(amprStub.Data.Data.begin(), amprStub.Data.Data.end(), fallbackOrder.begin(), fallbackOrder.end()) != amprStub.Data.Data.end(),
+            "a libSceAmpr-qualified locale object import does not fall back to libc");
+
+    const std::vector<PeImport> libcImport{{.Name = "-mLzBSk-VGs", .TargetRva = 0x2000, .Addend = 0, .Library = "libc.prx"}};
+    const auto libcStub = WindowsEntryStubBuilder().Build(0x40000, 0x1000, nativeImports, libraries, libcImport, "$ORIGIN/libs", false, false);
+    const std::vector<std::uint8_t> libcOrder{1, 0, 0, 0};
+    require(std::search(libcStub.Data.Data.begin(), libcStub.Data.Data.end(), libcOrder.begin(), libcOrder.end()) != libcStub.Data.Data.end(),
+            "a libc-qualified locale object import does not resolve through libc");
+}
+
 void windowsKernelVariantImportsSearchCanonicalKernelAfterTheRequestedVariant() {
     using namespace Elfpatcher::Windows;
     const auto nativeImports = WindowsImportBuilder().Build(0x1000);
@@ -153,6 +170,7 @@ int main() {
         windowsStubLoadsTheAllocatorOnRequest("C:/Games/Title/libs", u"C:\\Games\\Title\\libs\\", {0x48, 0x8d, 0x0d});
         windowsStubLoadsTheAllocatorOnRequest("$ORIGIN/libs", u"libs\\", {0x48, 0x8d, 0x35});
         windowsStubRejectsAnOverlongAllocatorPath();
+        windowsLibSceAmprObjectImportsFallBackToTheLibcProvider();
         windowsKernelVariantImportsSearchCanonicalKernelAfterTheRequestedVariant();
         windowsKernelVariantDependenciesLoadCanonicalKernel();
     } catch (const std::exception& error) {
diff --git a/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp b/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp
index 18748830de..c86b61da23 100644
--- a/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp
+++ b/core/relinker/elfpatcher/tests/ProgramLayoutRangeTests.cpp
@@ -149,6 +149,27 @@ int main() {
         bool stackSlotRejected = false;
         try { (void)writeSingle(6); } catch (const std::exception&) { stackSlotRejected = true; }
         Require(stackSlotRejected, "layout must refuse to drop the synthetic stack when its slot is missing");
-        std::cout << "21 program layout cases passed\n";
+        constexpr std::uint16_t extendedCount = 0xffff;
+        std::vector<Domain::ProgramHeader> manyHeaders(extendedCount - Elfpatcher::kSyntheticProgramHeaderCount - 2);
+        manyHeaders.front() = singleLoad.front();
+        Require(builder.RequiredProgramHeaderCount(manyHeaders) == extendedCount - 1, "largest ordinary count changed");
+        const auto writeMany = [&builder](const std::vector<Domain::ProgramHeader>& headers, std::vector<std::uint8_t>& bytes, std::uint16_t count) {
+            const std::uint64_t extraOffset = 0x1000;
+            const std::uint64_t extraSize = static_cast<std::uint64_t>(count) * 56;
+            Elfpatcher::ProgramHeaderLayoutRequest request{extraOffset, 56, count, headers, extraOffset,
+                builder.ComputeExtraBlockVaddr(headers, extraOffset), extraSize, extraOffset, 16, extraOffset + 16, 8};
+            return builder.WriteLayout(bytes, request);
+        };
+        std::vector<std::uint8_t> largeOutput(0x1000 + static_cast<std::uint64_t>(extendedCount) * 56, 0xA5);
+        Require(writeMany(manyHeaders, largeOutput, extendedCount - 1) == extendedCount - 1, "largest ordinary layout rejected");
+        manyHeaders.push_back({});
+        rejected = false;
+        try { builder.RequiredProgramHeaderCount(manyHeaders); } catch (const Domain::RelinkerException&) { rejected = true; }
+        Require(rejected, "extended program header count accepted");
+        const auto beforeLarge = largeOutput;
+        rejected = false;
+        try { writeMany(manyHeaders, largeOutput, extendedCount); } catch (const Domain::RelinkerException&) { rejected = true; }
+        Require(rejected && largeOutput == beforeLarge, "extended count written without section-zero encoding");
+        std::cout << "25 program layout cases passed\n";
     } catch (const std::exception& error) { std::cerr << error.what() << '\n'; return 1; }
 }
diff --git a/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp b/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp
index 15197aa868..45ce2bf954 100644
--- a/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp
+++ b/core/relinker/elfpatcher/tests/WindowsDependencyDiagnosticsTests.cpp
@@ -242,8 +242,8 @@ void expectDiagnostic(const Fs::path& runner, const std::vector<std::string>& ex
 int main() {
     try {
         checkRuntimeDependencies();
-        std::vector<char> filename(32768);
-        const auto size = GetModuleFileNameA(nullptr, filename.data(), static_cast<DWORD>(filename.size()));
+        std::vector<wchar_t> filename(32768);
+        const auto size = GetModuleFileNameW(nullptr, filename.data(), static_cast<DWORD>(filename.size()));
         if (size == 0 || size >= filename.size())
             throw std::runtime_error("Cannot locate diagnostic tests");
         const auto directory = createFixtureDirectory(Fs::path(filename.data()).parent_path());
diff --git a/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp b/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp
new file mode 100644
index 0000000000..ffe753bfaf
--- /dev/null
+++ b/core/relinker/elfpatcher/tests/WindowsImportIdentityTests.cpp
@@ -0,0 +1,162 @@
+#define WIN32_LEAN_AND_MEAN
+#define NOMINMAX
+#include <windows.h>
+#include <elfpatcher/windows/WindowsEntryStubBuilder.hpp>
+#include <elfpatcher/windows/WindowsImportBuilder.hpp>
+#include <elfpatcher/windows/WindowsPeWriter.hpp>
+#include <array>
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <random>
+#include <stdexcept>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+namespace Fs = std::filesystem;
+using namespace Elfpatcher::Windows;
+
+constexpr std::uint32_t GotRva = LoadRva + 0x1000;
+constexpr std::array<const char*, 3> LocaleObjects{"-mLzBSk-VGs", "a54t8+k7KpY", "KfcTPbeaOqg"};
+
+void require(const bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+Fs::path createFixtureDirectory(const Fs::path& parent) {
+    std::random_device random;
+    for (int attempt = 0; attempt < 100; ++attempt) {
+        auto name = Fs::path("windows-import-identity-");
+        name += std::to_string(GetCurrentProcessId()) + "-" + std::to_string(random());
+        const auto directory = parent / name;
+        if (Fs::create_directory(directory)) return directory;
+    }
+    throw std::runtime_error("Cannot create a unique import identity fixture directory");
+}
+
+void appendDisplacement(std::vector<std::uint8_t>& code, const std::int32_t displacement) {
+    for (int i = 0; i < 4; ++i) code.push_back(static_cast<std::uint8_t>((static_cast<std::uint32_t>(displacement) >> (8 * i)) & 0xffu));
+}
+
+// For each pair of GOT slots: mov rax,[a]; cmp rax,[b]; jne fail. Then xor eax,eax; ret. fail: mov eax,1; ret.
+std::vector<std::uint8_t> compareCode(const std::vector<std::pair<int, int>>& pairs) {
+    std::vector<std::uint8_t> code;
+    const auto failOffset = static_cast<std::int32_t>(pairs.size() * 16 + 3);
+    for (std::size_t i = 0; i < pairs.size(); ++i) {
+        const auto base = static_cast<std::uint32_t>(i * 16);
+        code.insert(code.end(), {0x48, 0x8b, 0x05});
+        appendDisplacement(code, static_cast<std::int32_t>(GotRva + 8u * static_cast<std::uint32_t>(pairs[i].first)) - static_cast<std::int32_t>(LoadRva + base + 7));
+        code.insert(code.end(), {0x48, 0x3b, 0x05});
+        appendDisplacement(code, static_cast<std::int32_t>(GotRva + 8u * static_cast<std::uint32_t>(pairs[i].second)) - static_cast<std::int32_t>(LoadRva + base + 14));
+        code.push_back(0x75);
+        code.push_back(static_cast<std::uint8_t>(failOffset - static_cast<std::int32_t>(base + 16)));
+    }
+    code.insert(code.end(), {0x31, 0xc0, 0xc3});
+    code.insert(code.end(), {0xb8, 0x01, 0x00, 0x00, 0x00, 0xc3});
+    return code;
+}
+
+std::uint32_t slot(const int index) {
+    return GotRva + 8u * static_cast<std::uint32_t>(index);
+}
+
+void generateProbe(const Fs::path& file, const std::string& libraries, const std::vector<PeImport>& peImports, const std::vector<std::pair<int, int>>& pairs) {
+    const std::vector<std::string> loaded{"libSceAmpr.prx", "libkernel.prx", "libc.prx"};
+    PeSection entry{".guest", LoadRva, SectionRead | SectionExecute | 0x20u, compareCode(pairs)};
+    PeSection got{".got", GotRva, SectionRead | SectionWrite | 0x40u, std::vector<std::uint8_t>(8 * 8)};
+    const auto imports = WindowsImportBuilder().Build(LoadRva + 0x2000);
+    const auto startup = WindowsEntryStubBuilder().Build(LoadRva + 0x3000, entry.Rva, imports, loaded, peImports, libraries, false, false);
+    std::array<PeDirectory, 16> directories{};
+    directories[1] = imports.Directory;
+    directories[3] = startup.ExceptionDirectory;
+    directories[12] = imports.AddressTable;
+    const auto image = WindowsPeWriter().Write({entry, got, imports.Section, startup.Data, startup.Code}, startup.Code.Rva, directories, false, ImageBase, false);
+    std::ofstream stream(file, std::ios::binary);
+    stream.write(reinterpret_cast<const char*>(image.data()), static_cast<std::streamsize>(image.size()));
+    require(static_cast<bool>(stream), "Cannot write " + file.string());
+}
+
+DWORD runProbe(const Fs::path& probe, std::string& output) {
+    SECURITY_ATTRIBUTES security{sizeof(SECURITY_ATTRIBUTES), nullptr, TRUE};
+    HANDLE input = nullptr;
+    HANDLE written = nullptr;
+    require(CreatePipe(&input, &written, &security, 0) && SetHandleInformation(input, HANDLE_FLAG_INHERIT, 0), "Cannot create the probe's pipe");
+    STARTUPINFOW startup{};
+    startup.cb = sizeof(startup);
+    startup.dwFlags = STARTF_USESTDHANDLES;
+    startup.hStdOutput = written;
+    startup.hStdError = written;
+    startup.hStdInput = GetStdHandle(STD_INPUT_HANDLE);
+    PROCESS_INFORMATION process{};
+    const auto filename = probe.wstring();
+    require(CreateProcessW(filename.c_str(), nullptr, nullptr, nullptr, TRUE, CREATE_NO_WINDOW, nullptr, probe.parent_path().wstring().c_str(), &startup, &process) != 0,
+        "Cannot start " + probe.filename().string() + ": " + std::to_string(GetLastError()));
+    CloseHandle(written);
+    if (WaitForSingleObject(process.hProcess, 120000) != WAIT_OBJECT_0) {
+        TerminateProcess(process.hProcess, 1);
+        throw std::runtime_error(probe.filename().string() + " timed out");
+    }
+    DWORD status = 0;
+    require(GetExitCodeProcess(process.hProcess, &status) != 0, "Cannot read the probe's exit code");
+    char buffer[4096];
+    DWORD size = 0;
+    while (ReadFile(input, buffer, sizeof(buffer), &size, nullptr) && size != 0) output.append(buffer, size);
+    CloseHandle(input);
+    CloseHandle(process.hThread);
+    CloseHandle(process.hProcess);
+    return status;
+}
+
+// The generated probes load libc.prx next to the other libraries; its compiler runtime DLLs sit next to this test.
+void copyRuntime(const Fs::path& directory) {
+    wchar_t self[MAX_PATH];
+    const auto length = GetModuleFileNameW(nullptr, self, MAX_PATH);
+    if (length == 0 || length >= MAX_PATH) return;
+    const auto own = Fs::path(self).parent_path();
+    for (const char* name : {"libgcc_s_seh-1.dll", "libstdc++-6.dll", "libwinpthread-1.dll"}) {
+        std::error_code error;
+        if (Fs::exists(own / name, error)) Fs::copy_file(own / name, directory / name, Fs::copy_options::overwrite_existing, error);
+    }
+}
+
+}
+
+int main(int argc, char** argv) {
+    if (argc != 2) {
+        std::cerr << "usage: windows_import_identity_tests <patched libraries directory>\n";
+        return 2;
+    }
+    try {
+        const auto libraries = Fs::absolute(argv[1]).string();
+        const auto directory = createFixtureDirectory(Fs::temp_directory_path());
+        copyRuntime(directory);
+        std::vector<PeImport> same;
+        for (int i = 0; i < 3; ++i) {
+            same.push_back({.Name = LocaleObjects[i], .TargetRva = slot(2 * i), .Addend = 0, .Library = "libSceAmpr.prx"});
+            same.push_back({.Name = LocaleObjects[i], .TargetRva = slot(2 * i + 1), .Addend = 0, .Library = "libc.prx"});
+        }
+        generateProbe(directory / "same.exe", libraries, same, {{0, 1}, {2, 3}, {4, 5}});
+        const std::vector<PeImport> different{
+            {.Name = LocaleObjects[0], .TargetRva = slot(0), .Addend = 0, .Library = "libSceAmpr.prx"},
+            {.Name = "k+AXqu2-eBc", .TargetRva = slot(6), .Addend = 0, .Library = "libkernel.prx"},
+        };
+        generateProbe(directory / "different.exe", libraries, different, {{0, 6}});
+        std::string output;
+        const auto sameStatus = runProbe(directory / "same.exe", output);
+        require(sameStatus == 0, "A libSceAmpr.prx-qualified import of the locale objects did not resolve to libc's object (exit " + std::to_string(sameStatus) + ")\n" + output);
+        output.clear();
+        const auto differentStatus = runProbe(directory / "different.exe", output);
+        require(differentStatus == 1, "The probe did not tell two different addresses apart (exit " + std::to_string(differentStatus) + ")\n" + output);
+        std::error_code error;
+        Fs::remove_all(directory, error);
+        std::cout << "Windows import identity tests passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+    return 0;
+}
diff --git a/core/relinker/io/src/FileIdentity.cpp b/core/relinker/io/src/FileIdentity.cpp
index 351058935a..5f2b5cc967 100644
--- a/core/relinker/io/src/FileIdentity.cpp
+++ b/core/relinker/io/src/FileIdentity.cpp
@@ -47,6 +47,18 @@ bool SameFile(const std::filesystem::path& first, const std::filesystem::path& s
 #ifdef _WIN32
     return FileIdentity(first) == FileIdentity(second);
 #else
+    for (const auto* path : {&first, &second}) {
+        std::error_code error;
+        const auto status = std::filesystem::status(*path, error);
+        if (error) throw std::filesystem::filesystem_error("Cannot determine file identity", *path, error);
+        if (!std::filesystem::exists(status)) {
+            throw std::filesystem::filesystem_error(
+                "Cannot determine file identity",
+                *path,
+                std::make_error_code(std::errc::no_such_file_or_directory)
+            );
+        }
+    }
     return std::filesystem::equivalent(first, second);
 #endif
 }
diff --git a/core/relinker/io/tests/FileIdentityTests.cpp b/core/relinker/io/tests/FileIdentityTests.cpp
index 41e6bdc5e7..763b71af1c 100644
--- a/core/relinker/io/tests/FileIdentityTests.cpp
+++ b/core/relinker/io/tests/FileIdentityTests.cpp
@@ -17,10 +17,16 @@ void write(const std::filesystem::path& path, const std::string& text) {
     require(std::filesystem::is_regular_file(path), "Cannot create " + path.string());
 }
 
-void requireMissing(const std::filesystem::path& first, const std::filesystem::path& second) {
+void requireMissing(
+    const std::filesystem::path& first,
+    const std::filesystem::path& second,
+    const std::filesystem::path& missing
+) {
     try {
         Io::SameFile(first, second);
-    } catch (const std::filesystem::filesystem_error&) {
+    } catch (const std::filesystem::filesystem_error& error) {
+        require(error.code() == std::errc::no_such_file_or_directory, "SameFile reported the wrong error for a missing path");
+        require(error.path1() == missing, "SameFile reported the wrong missing path");
         return;
     }
     throw std::runtime_error("SameFile accepted a missing file");
@@ -41,8 +47,9 @@ void run(const std::filesystem::path& directory) {
     require(!Io::SameFile(first, copy), "A copy with the same contents is the same file");
     require(Io::SameFile(folder, directory / "folder" / "."), "Two spellings of one directory differ");
     require(!Io::SameFile(first, folder), "A file is the same as a directory");
-    requireMissing(directory / "missing.bin", first);
-    requireMissing(first, directory / "missing.bin");
+    const auto missing = directory / "missing.bin";
+    requireMissing(missing, first, missing);
+    requireMissing(first, missing, missing);
 }
 
 }
diff --git a/core/relinker/main.cpp b/core/relinker/main.cpp
index 98bca27396..6f2a15fe2e 100644
--- a/core/relinker/main.cpp
+++ b/core/relinker/main.cpp
@@ -57,6 +57,7 @@ ConvertedExecutable Convert(const Cli::Args& args, const std::string& inputPath,
     options.Target = args.toWindows ? Relinker::TargetSystem::Windows : args.toMacos ? Relinker::TargetSystem::MacOs : Relinker::TargetSystem::Linux;
     options.ToIntel = args.toIntel;
     options.ToRosetta = args.toRosetta;
+    options.FrameRedZone = args.frameRedZone;
     options.SkipSyscallCheck = args.skipSyscallCheck;
     options.TrapSdkSyscallStubs = args.trapSdkSyscallStubs;
     options.UnusedFilterLevel = args.unusedFilterLevel;
@@ -337,10 +338,17 @@ int Run(const int argc, char* argv[]) {
         if (!manifestPath.empty()) manifestText = Relinker::GamePatch::WriteManifest(appliedPatches, mainTarget, Io::Utf8Path(patchFile), executables.front().LinuxBase);
 
         const Elfpatcher::Linux::LinuxDesktopEntryWriter desktopEntryWriter;
-        const auto desktopEntry = args.toWindows || args.toMacos ? std::nullopt : desktopEntryWriter.Prepare(Io::NativePath(args.inputPath).parent_path() / "sce_sys", Io::NativePath(absPath));
+        const auto metadataRoot = Io::NativePath(args.inputPath).parent_path() / "sce_sys";
+        const auto desktopEntry = args.toWindows || args.toMacos ? std::nullopt : desktopEntryWriter.Prepare(metadataRoot, Io::NativePath(absPath));
+        std::vector<std::filesystem::path> metadataInputs;
+        if (args.toWindows || desktopEntry) metadataInputs.push_back(metadataRoot / "icon0.png");
+        if (desktopEntry) metadataInputs.push_back(metadataRoot / "param.json");
 
         const auto checkOutputInputs = [&](const std::filesystem::path& path, const char* kind) {
             if (!std::filesystem::exists(path)) return;
+            for (const auto& input : metadataInputs)
+                if (std::filesystem::exists(input) && SameOutputFile(input, path))
+                    throw Domain::RelinkerException(std::string(kind) + " output would overwrite input metadata: " + Io::Utf8Path(path));
             for (const auto& executable : executables)
                 if (SameOutputFile(Io::NativePath(executable.InputPath), path))
                     throw Domain::RelinkerException(std::string(kind) + " output would overwrite the input executable: " + Io::Utf8Path(path));
diff --git a/core/relinker/relinker/include/relinker/guest/GuestImage.hpp b/core/relinker/relinker/include/relinker/guest/GuestImage.hpp
index 6be45157af..8fe4507a89 100644
--- a/core/relinker/relinker/include/relinker/guest/GuestImage.hpp
+++ b/core/relinker/relinker/include/relinker/guest/GuestImage.hpp
@@ -57,6 +57,7 @@ struct GuestImage {
     std::uint64_t Got = 0;
     bool UsePlatformTlsResolver = true;
     bool Symbolic = false;
+    std::vector<std::size_t> NamedImports;
 };
 
 class GuestImageReader {
diff --git a/core/relinker/relinker/include/relinker/patching/GamePatch.hpp b/core/relinker/relinker/include/relinker/patching/GamePatch.hpp
index 6b76048dfb..e04f9605e3 100644
--- a/core/relinker/relinker/include/relinker/patching/GamePatch.hpp
+++ b/core/relinker/relinker/include/relinker/patching/GamePatch.hpp
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <codegen/CodegenTypes.hpp>
+#include <codegen/x86/RedZoneFramer.hpp>
 #include <relinker/domain/RelinkResult.hpp>
 #include <relinker/parsing/ElfReader.hpp>
 #include <cstdint>
@@ -83,6 +84,8 @@ struct WriterSites {
     std::span<const WriterRange> Traps;
     std::span<const std::uint8_t> RelaData;
     std::span<const std::uint8_t> RelaPltData;
+    std::span<const Codegen::TrampolineSite> RedZoneSites = {};
+    std::span<const Codegen::RedZoneDisplacement> RedZoneDisplacements = {};
 };
 
 enum class VerifyStatus { Applicable, Applied, NotChecked, Mismatch };
diff --git a/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp b/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp
index 6998e95873..3a45a1ea10 100644
--- a/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp
+++ b/core/relinker/relinker/include/relinker/pipeline/Conversion.hpp
@@ -15,6 +15,7 @@ struct ConversionOptions {
     std::uint32_t UnusedFilterLevel = 0;
     bool ToIntel = false;
     bool ToRosetta = false;
+    bool FrameRedZone = false;
     bool SkipSyscallCheck = false;
     bool TrapSdkSyscallStubs = false;
     bool LazyBinding = false;
diff --git a/core/relinker/relinker/src/analysis/CallSiteResolver.cpp b/core/relinker/relinker/src/analysis/CallSiteResolver.cpp
index 91fe531f9c..b615250ae8 100644
--- a/core/relinker/relinker/src/analysis/CallSiteResolver.cpp
+++ b/core/relinker/relinker/src/analysis/CallSiteResolver.cpp
@@ -26,7 +26,7 @@ std::optional<std::size_t> ripRelativeDispOffset(const std::vector<std::uint8_t>
     while (cur < end) {
         std::uint8_t b = text[cur];
         if (b >= RexMin && b <= RexMax) {
-            if (b & RexWBit) hasRexW = true;
+            hasRexW = (b & RexWBit) != 0;
             ++cur;
             continue;
         }
diff --git a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
index 645dd46f3a..2e7d216a7f 100644
--- a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
+++ b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
@@ -6,6 +6,7 @@
 #include <codegen/IInstructionScanner.hpp>
 #include <codegen/x86/X64InstructionDecoder.hpp>
 #include <codegen/CodegenException.hpp>
+#include <elfpatcher/general/ElfConstants.hpp>
 #include <io/BufferUtils.hpp>
 #include <algorithm>
 #include <bit>
@@ -272,7 +273,8 @@ std::set<Domain::VirtualAddress> CodeInstructionCollector::Collect(const std::ve
         symbols = table(6, 0x61000039, symbolCount * 24);
         for (std::uint64_t index = 0; index < symbolCount; ++index) {
             const auto offset = symbols + index * 24;
-            if ((bytes[offset + 4] & 15) == 2 && Io::ReadU16(bytes, offset + 6) != 0) {
+            const auto section = Io::ReadU16(bytes, offset + 6);
+            if ((bytes[offset + 4] & 15) == 2 && section != 0 && section != Elfpatcher::SHN_ABS) {
                 const auto address = Io::ReadU64(bytes, offset + 8);
                 addRoot(address);
                 addFunction(address, Io::ReadU64(bytes, offset + 16), true);
diff --git a/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp b/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp
index da812ba58e..d8c89bcffb 100644
--- a/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp
+++ b/core/relinker/relinker/src/analysis/UnusedNidFilter/ControlFlowGraph.cpp
@@ -103,13 +103,16 @@ void buildGraph(std::span<const std::uint8_t> text, VirtualAddress textVaddr, Vi
             if (followCodeAddresses && info.HasRipRelativeDisp && text[bufOff + info.OpcodeOffset] == 0x8d && (info.RexPrefix & 8)) {
                 std::int32_t displacement = 0;
                 std::memcpy(&displacement, text.data() + bufOff + info.RipRelativeDispOffset, 4);
-                enqueue(nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement)));
+                auto target = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement));
+                if (info.AddressSize32) target = static_cast<std::uint32_t>(target);
+                enqueue(target);
             }
 
             if (data != nullptr && info.HasRipRelativeDisp && !info.IsTwoByteOpcode && info.Opcode == 0x8D) {
                 std::int32_t displacement = 0;
                 std::memcpy(&displacement, text.data() + bufOff + info.RipRelativeDispOffset, 4);
-                const auto base = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement));
+                auto base = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(displacement));
+                if (info.AddressSize32) base = static_cast<std::uint32_t>(base);
                 takeAddress(base);
                 for (VirtualAddress target : ReadRelativeTableTargets(*data, base, textVaddr, text.size())) takeAddress(target);
             }
@@ -129,6 +132,7 @@ void buildGraph(std::span<const std::uint8_t> text, VirtualAddress textVaddr, Vi
                         std::int32_t disp = 0;
                         std::memcpy(&disp, text.data() + bufOff + info.RipRelativeDispOffset, 4);
                         VirtualAddress slotVaddr = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(disp));
+                        if (info.AddressSize32) slotVaddr = static_cast<std::uint32_t>(slotVaddr);
                         auto resolved = relativeRelocations.TargetOfSlot(slotVaddr);
                         if (resolved.has_value())
                             enqueue(*resolved);
@@ -141,6 +145,7 @@ void buildGraph(std::span<const std::uint8_t> text, VirtualAddress textVaddr, Vi
                         std::int32_t disp = 0;
                         std::memcpy(&disp, text.data() + bufOff + info.RipRelativeDispOffset, 4);
                         VirtualAddress slotVaddr = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(disp));
+                        if (info.AddressSize32) slotVaddr = static_cast<std::uint32_t>(slotVaddr);
                         auto resolved = relativeRelocations.TargetOfSlot(slotVaddr);
                         if (resolved.has_value())
                             enqueue(*resolved);
diff --git a/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp b/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp
index 9d1e5a3c2e..18dc887f88 100644
--- a/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp
+++ b/core/relinker/relinker/src/analysis/UnusedNidFilter/GotAccessIndex.cpp
@@ -43,8 +43,10 @@ std::unique_ptr<IGotAccessIndex> BuildGotAccessIndex(
         VirtualAddress nextVaddr = va + static_cast<VirtualAddress>(info.Length);
         std::int32_t disp = 0;
         std::memcpy(&disp, text.data() + bufOff + info.RipRelativeDispOffset, 4);
-        if (disp < 0 && nextVaddr < static_cast<VirtualAddress>(-static_cast<std::int64_t>(disp))) continue;
-        if (disp > 0 && std::numeric_limits<VirtualAddress>::max() - nextVaddr < static_cast<VirtualAddress>(disp)) continue;
+        if (!info.AddressSize32) {
+            if (disp < 0 && nextVaddr < static_cast<VirtualAddress>(-static_cast<std::int64_t>(disp))) continue;
+            if (disp > 0 && std::numeric_limits<VirtualAddress>::max() - nextVaddr < static_cast<VirtualAddress>(disp)) continue;
+        }
         VirtualAddress target = nextVaddr + static_cast<VirtualAddress>(static_cast<std::int64_t>(disp));
         if (info.AddressSize32) target = static_cast<std::uint32_t>(target);
         accessed.insert(target);
diff --git a/core/relinker/relinker/src/analysis/ValidationPolicy.cpp b/core/relinker/relinker/src/analysis/ValidationPolicy.cpp
index dfd0a11798..47d65ac011 100644
--- a/core/relinker/relinker/src/analysis/ValidationPolicy.cpp
+++ b/core/relinker/relinker/src/analysis/ValidationPolicy.cpp
@@ -11,20 +11,14 @@ void ValidationPolicy::_initializeSupportedRelocationTypes() {
         R_X86_64_NONE,
         R_X86_64_64,
         R_X86_64_PC32,
-        R_X86_64_GOT32,
-        R_X86_64_PLT32,
         R_X86_64_COPY,
         R_X86_64_GLOB_DAT,
         R_X86_64_JUMP_SLOT,
         R_X86_64_RELATIVE,
-        R_X86_64_GOTPCREL,
         R_X86_64_32,
-        R_X86_64_32S,
         R_X86_64_DTPMOD64,
         R_X86_64_DTPOFF64,
         R_X86_64_TPOFF64,
-        R_X86_64_GOTPCRELX,
-        R_X86_64_REX_GOTPCRELX,
     };
 }
 
diff --git a/core/relinker/relinker/src/guest/GuestImageReader.cpp b/core/relinker/relinker/src/guest/GuestImageReader.cpp
index 49a209c9d4..6010508de0 100644
--- a/core/relinker/relinker/src/guest/GuestImageReader.cpp
+++ b/core/relinker/relinker/src/guest/GuestImageReader.cpp
@@ -162,6 +162,8 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
         if (!importModules.emplace(value >> 48, string(value & 0xffffffffu)).second) fail("Duplicate import module ID");
     std::vector<std::string> neededLibraries;
     for (const auto offset : needed) neededLibraries.push_back(string(offset));
+    const bool consoleFileNames = std::any_of(neededLibraries.begin(), neededLibraries.end(),
+        [](const std::string& name) { return Domain::NeededLibraryName(name) != name; });
     std::map<std::string, std::size_t> exports;
     for (std::uint64_t offset = 0; offset < symSize; offset += 24) {
         auto name = string(Io::ReadU32(bytes, symOffset + offset));
@@ -195,6 +197,7 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
         if (image.Dynamic.DynStrData.size() > std::numeric_limits<std::uint32_t>::max()) fail("String table too large");
         Io::WriteU32(image.Dynamic.DynSymData, offset, static_cast<std::uint32_t>(image.Dynamic.DynStrData.size()));
         Io::AppendString(image.Dynamic.DynStrData, name);
+        if (consoleFileNames && section == 0 && !name.empty() && name == qualifiedName) image.NamedImports.push_back(image.Symbols.size());
         image.Symbols.push_back(symbol);
     }
     if (tags.contains(14)) {
@@ -283,8 +286,8 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
     if (image.HasInit) mapped(image.Init, 1, 1);
     if (image.Fini != 0) mapped(image.Fini, 1, 1);
     const auto readLifecycleArray = [&](std::uint64_t addressTag, std::uint64_t sizeTag, std::vector<std::uint64_t>& entries) {
-        if (!tags.contains(addressTag) && !tags.contains(sizeTag)) return;
-        if (!tags.contains(sizeTag) || (tags.at(sizeTag) != 0 && !tags.contains(addressTag))) fail("Incomplete guest lifecycle array");
+        if (!tags.contains(sizeTag)) return;
+        if (tags.at(sizeTag) != 0 && !tags.contains(addressTag)) fail("Incomplete guest lifecycle array");
         const auto size = tags.at(sizeTag);
         if (size == 0) return;
         if (size % 8 != 0) fail("Unaligned guest lifecycle array size");
diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
index 1ffd34e19d..31dc35aa0d 100644
--- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
+++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
@@ -6,6 +6,7 @@
 #include <domain/ImportModule.hpp>
 #include <io/NativePath.hpp>
 #include <io/BufferUtils.hpp>
+#include <nid/NidCompute.hpp>
 #include <algorithm>
 #include <functional>
 #include <limits>
@@ -42,6 +43,37 @@ std::vector<std::string> ReadNeededNames(const Domain::SysVDynamicSection& dynam
     return names;
 }
 
+std::string SymbolName(const Domain::SysVDynamicSection& dynamic, const std::size_t index) {
+    if (dynamic.DynSymData.size() % 24 != 0 || index >= dynamic.DynSymData.size() / 24) throw Domain::RelinkerException("Invalid symbol index");
+    const auto nameOffset = Io::ReadU32(dynamic.DynSymData, index * 24);
+    if (nameOffset >= dynamic.DynStrData.size()) throw Domain::RelinkerException("Invalid symbol name offset");
+    const auto start = dynamic.DynStrData.begin() + nameOffset;
+    const auto end = std::find(start, dynamic.DynStrData.end(), 0);
+    if (end == dynamic.DynStrData.end()) throw Domain::RelinkerException("Unterminated symbol name");
+    return std::string(start, end);
+}
+
+std::set<std::string> ExportedNames(const Domain::SysVDynamicSection& dynamic) {
+    std::set<std::string> names;
+    for (std::size_t index = 1; index < dynamic.DynSymData.size() / 24; ++index) {
+        const auto info = dynamic.DynSymData[index * 24 + 4];
+        const auto visibility = dynamic.DynSymData[index * 24 + 5] & 3;
+        if (Io::ReadU16(dynamic.DynSymData, index * 24 + 6) != 0 && (info >> 4) != 0 && visibility != 1 && visibility != 2)
+            names.insert(SymbolName(dynamic, index));
+    }
+    return names;
+}
+
+void BindNamedImportsByNid(GuestImage& image, const std::set<std::string>& kept) {
+    for (const auto index : image.NamedImports) {
+        const auto name = SymbolName(image.Dynamic, index);
+        if (name.ends_with(GuestSymbolSuffix) || kept.contains(name)) continue;
+        if (image.Dynamic.DynStrData.size() > std::numeric_limits<std::uint32_t>::max()) throw Domain::RelinkerException("Guest string table too large");
+        Io::WriteU32(image.Dynamic.DynSymData, index * 24, static_cast<std::uint32_t>(image.Dynamic.DynStrData.size()));
+        Io::AppendString(image.Dynamic.DynStrData, Nid::ComputeNid(name, ""));
+    }
+}
+
 std::string FoldFilename(std::string name) {
     for (auto& character : name) if (character >= 'A' && character <= 'Z') character = static_cast<char>(character + ('a' - 'A'));
     return name;
@@ -292,12 +324,14 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
         return directory == "." ? std::string("app0") : "app0/" + directory;
     };
     if (!windows) {
+        const auto executableExports = macos ? std::set<std::string>{} : ExportedNames(dynamic);
         for (auto& image : images) {
             for (std::size_t index = 1; index < image.Symbols.size(); ++index) {
                 const auto& symbol = image.Symbols[index];
                 const bool exported = symbol.Section != 0 && (symbol.Info >> 4) != 0 && symbol.Visibility != 1 && symbol.Visibility != 2;
                 if (((symbol.Section == 0 && !declaresHost(symbol.Library)) || exported) && exports.contains(symbol.Name)) rename(image.Dynamic.DynSymData, image.Dynamic.DynStrData, index, symbol.Name);
             }
+            if (!macos) BindNamedImportsByNid(image, executableExports);
         }
     }
     std::vector<std::size_t> order;
@@ -314,17 +348,18 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
     std::vector<std::string> hostLibraries;
     std::vector<std::vector<std::string>> moduleHostLibraries(images.size());
     std::set<std::string> uniqueHosts;
+    const auto hostLibrary = [&](const std::string& name) { return windows || macos ? name : Domain::NeededLibraryName(name); };
     const auto addHost = [&](const std::string& name, const bool startup) {
         if (findGuest(name) != guestNames.end()) return;
         if (name.empty() || name.find_first_of("/\\:$") != std::string::npos) throw Domain::RelinkerException("Invalid host dependency: " + name);
-        if (startup && uniqueHosts.insert(name).second) hostLibraries.push_back(name);
+        if (const auto host = hostLibrary(name); startup && uniqueHosts.insert(host).second) hostLibraries.push_back(host);
     };
     for (const auto& name : neededNames) addHost(name, true);
     for (std::size_t index = 0; index < images.size(); ++index) {
         auto& hosts = moduleHostLibraries[index];
         for (const auto& dependency : images[index].Dependencies) {
             addHost(dependency, windows || !deferred(index));
-            if (findGuest(dependency) == guestNames.end()) hosts.push_back(dependency);
+            if (findGuest(dependency) == guestNames.end()) hosts.push_back(hostLibrary(dependency));
         }
         if (!windows && !macos && images[index].HasInit) {
             if (std::find(hosts.begin(), hosts.end(), "libkernel.prx") == hosts.end()) hosts.push_back("libkernel.prx");
@@ -404,7 +439,10 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
                 needed.push_back("$ORIGIN/" + dependencyPath.lexically_relative(image.SourcePath.parent_path()).generic_string());
             }
             needed.insert(needed.end(), moduleHostLibraries[index].begin(), moduleHostLibraries[index].end());
-            output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath);
+            const auto directory = image.SourcePath.parent_path();
+            const bool deferLinuxStart = isRuntime(index) && directory != root / "sce_module" &&
+                directory != root / "sce_modules" && directory != root / "prx";
+            output = macos ? Elfpatcher::GuestModuleWriter().WriteMacOs(image, needed, guestRunPath, message) : Elfpatcher::GuestModuleWriter().WriteLinux(image, needed, guestRunPath, deferLinuxStart);
         }
         if (windows) {
             for (const auto& [name, provider] : guestNames) {
@@ -425,7 +463,7 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
         dynamic.GuestModules.push_back(std::move(runtime));
         std::vector<std::string> neededLibraries;
         for (const auto& name : image.Dependencies)
-            if (findGuest(name) == guestNames.end()) neededLibraries.push_back(name);
+            if (findGuest(name) == guestNames.end()) neededLibraries.push_back(hostLibrary(name));
         artifacts.push_back({target, std::move(output), std::move(imports), image.SourcePath, std::move(neededLibraries)});
         progress.Report({Domain::ProgressStage::Modules, Io::Utf8Path(image.SourcePath), artifacts.size(), order.size()});
     }
diff --git a/core/relinker/relinker/src/output/CallRegistryWriter.cpp b/core/relinker/relinker/src/output/CallRegistryWriter.cpp
index 8878c6496c..f79f7fa68b 100644
--- a/core/relinker/relinker/src/output/CallRegistryWriter.cpp
+++ b/core/relinker/relinker/src/output/CallRegistryWriter.cpp
@@ -1,5 +1,6 @@
 #include <relinker/output/CallRegistryWriter.hpp>
 #include <cstdint>
+#include <locale>
 #include <sstream>
 
 namespace Relinker {
@@ -66,6 +67,7 @@ static std::string _jsonString(const std::string& s) {
 
 static std::string _hexOffset(FileByteOffset v) {
     std::ostringstream oss;
+    oss.imbue(std::locale::classic());
     oss << "\"0x" << std::hex << std::uppercase << v << "\"";
     return oss.str();
 }
diff --git a/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp b/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp
index 0d8bdd763f..a0044b4765 100644
--- a/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp
+++ b/core/relinker/relinker/src/output/SysVDynamicSectionBuilder.cpp
@@ -1,5 +1,7 @@
 #include <relinker/output/SysVDynamicSectionBuilder.hpp>
 #include <elfpatcher/general/ElfConstants.hpp>
+#include <domain/ImportModule.hpp>
+#include <algorithm>
 #include <cstring>
 
 namespace Relinker {
@@ -77,6 +79,9 @@ SysVDynamicSection SysVDynamicSectionBuilder::BuildDynamicSection(
 
     _appendElfSym(result.DynSymData, 0, 0, 0, 0, 0, 0);
 
+    const bool consoleFileNames = std::any_of(neededLibraries.begin(), neededLibraries.end(),
+        [](const std::string& name) { return Domain::NeededLibraryName(name) != name; });
+
     auto stripHashSuffix = [](const std::string& value) -> std::string {
         const auto hashPos = value.find('#');
         if (hashPos == std::string::npos) return value;
@@ -98,6 +103,7 @@ SysVDynamicSection SysVDynamicSectionBuilder::BuildDynamicSection(
     for (const auto& ref : nidReferences) {
         if (!ref.Library.empty()) result.ImportModules.emplace(ref.RelocationAddress, ref.Library);
         if (ref.Function) result.FunctionImports.insert(ref.RelocationAddress);
+        if (consoleFileNames && ref.Library.empty() && !ref.Nid.empty() && ref.Nid.find('#') == std::string::npos) result.NamedImports.insert(ref.RelocationAddress);
         std::uint32_t relType = ref.RelocationTypeValue;
         if (relType == 0) relType = R_X86_64_JUMP_SLOT;
 
diff --git a/core/relinker/relinker/src/parsing/ElfReader.cpp b/core/relinker/relinker/src/parsing/ElfReader.cpp
index 3f9da02d4c..82f5e304ae 100644
--- a/core/relinker/relinker/src/parsing/ElfReader.cpp
+++ b/core/relinker/relinker/src/parsing/ElfReader.cpp
@@ -220,6 +220,12 @@ std::vector<SectionHeader> ElfReader::ReadSectionHeaders() const {
         sh.Info = _readU32At(offset + 0x2c);
         sh.EntrySize = _readU64At(offset + kShdrEntSizeOffset);
 
+        if (sh.Type != SHT_NULL && sh.Type != SHT_NOBITS && sh.SectionSize != 0) {
+            if (!_rangeFits(sh.Offset, sh.SectionSize, _fileBuffer.size())) {
+                throw RelinkerException("Section offset out of bounds", sh.Offset);
+            }
+        }
+
         sh.Name = _resolveShdrName(nameOffset, header);
 
         headers.push_back(sh);
diff --git a/core/relinker/relinker/src/patching/GamePatch.cpp b/core/relinker/relinker/src/patching/GamePatch.cpp
index 403264c79b..12f6451372 100644
--- a/core/relinker/relinker/src/patching/GamePatch.cpp
+++ b/core/relinker/relinker/src/patching/GamePatch.cpp
@@ -240,6 +240,15 @@ PatchEntry BuildEntry(const Table& table, const std::size_t headerLine, std::set
     return entry;
 }
 
+std::string Describe(const PatchEntry& entry) {
+    return "patch " + entry.Target + " va=" + HexValue(entry.VirtualAddress) + " (line " + std::to_string(entry.Line) + ")";
+}
+
+void ValidateWidth(const PatchEntry& entry) {
+    if (entry.Expected.empty() || entry.Expected.size() != entry.Value.size())
+        throw Domain::RelinkerException(Describe(entry) + ": expected and value must have the same nonzero width");
+}
+
 struct EntryRange {
     std::optional<PatchedRange> Range;
     std::string Reason;
@@ -275,14 +284,13 @@ std::vector<EntryRange> ResolveEach(const ElfReader& reader, const std::vector<P
     const auto segments = reader.ReadProgramHeaders();
     const auto header = reader.ReadHeader();
     std::vector<EntryRange> resolved;
-    for (const auto& entry : entries) resolved.push_back(ResolveEntry(segments, reader.GetFileSize(), header, entry));
+    for (const auto& entry : entries) {
+        ValidateWidth(entry);
+        resolved.push_back(ResolveEntry(segments, reader.GetFileSize(), header, entry));
+    }
     return resolved;
 }
 
-std::string Describe(const PatchEntry& entry) {
-    return "patch " + entry.Target + " va=" + HexValue(entry.VirtualAddress) + " (line " + std::to_string(entry.Line) + ")";
-}
-
 bool Overlaps(const std::uint64_t firstOffset, const std::uint64_t firstLength, const std::uint64_t secondOffset, const std::uint64_t secondLength) {
     return firstOffset < secondOffset + secondLength && secondOffset < firstOffset + firstLength;
 }
@@ -431,7 +439,10 @@ std::vector<PatchedRange> ResolveRanges(const ElfReader& reader, const std::vect
 std::vector<AppliedPatch> ApplyPatches(std::vector<std::uint8_t>& bytes, const std::string& target, const std::vector<PatchEntry>& entries, const std::vector<PatchedRange>& ranges) {
     if (entries.size() != ranges.size()) throw Domain::RelinkerException("Patch ranges do not match patch entries");
     for (std::size_t index = 0; index < entries.size(); ++index) {
+        ValidateWidth(entries[index]);
         const auto& range = ranges[index];
+        if (range.Length != entries[index].Expected.size())
+            throw Domain::RelinkerException(Describe(entries[index]) + ": range length does not match the patch width", range.Offset);
         if (range.Offset > bytes.size() || range.Length > bytes.size() - range.Offset) throw Domain::RelinkerException(Describe(entries[index]) + ": range exceeds the image", range.Offset);
         const auto first = bytes.begin() + static_cast<std::ptrdiff_t>(range.Offset);
         if (!std::equal(entries[index].Expected.begin(), entries[index].Expected.end(), first))
@@ -470,6 +481,8 @@ void CheckOverlaps(const std::string& target, const std::vector<PatchedRange>& p
     for (const auto& site : writers.Trampolines) sites.push_back({site.Offset, site.Length, "Intel trampoline site"});
     for (const auto& patch : writers.RelinkPatches) sites.push_back({patch.Offset, patch.Bytes.size(), "relinker patch"});
     sites.insert(sites.end(), writers.Traps.begin(), writers.Traps.end());
+    for (const auto& site : writers.RedZoneSites) sites.push_back({site.Offset, site.Length, "red-zone frame site"});
+    for (const auto& moved : writers.RedZoneDisplacements) sites.push_back({moved.Offset, moved.Bytes.size(), "red-zone moved displacement"});
     const auto relaViolation = [&](const std::span<const std::uint8_t> table, const char* name, const PatchedRange& range) {
         for (std::size_t position = 0; position + 24 <= table.size(); position += 24) {
             std::uint64_t relocation = 0;
diff --git a/core/relinker/relinker/src/pipeline/Conversion.cpp b/core/relinker/relinker/src/pipeline/Conversion.cpp
index 1cf1879466..1f371ecbca 100644
--- a/core/relinker/relinker/src/pipeline/Conversion.cpp
+++ b/core/relinker/relinker/src/pipeline/Conversion.cpp
@@ -18,6 +18,8 @@
 #include <relinker/pipeline/RelinkerPipeline.hpp>
 #include <relinker/guest/GuestImage.hpp>
 #include <codegen/IAmd64OnlyConverter.hpp>
+#include <codegen/x86/RedZoneFramer.hpp>
+#include <relinker/analysis/UnusedNidFilter/EhFrameReader.hpp>
 #include <map>
 #include <codegen/CodegenException.hpp>
 #include <algorithm>
@@ -41,6 +43,7 @@ ConversionOutput Conversion::Convert(ConversionInput input, const ConversionOpti
     if (options.Target != TargetSystem::Linux && options.Target != TargetSystem::Windows && options.Target != TargetSystem::MacOs) throw Domain::RelinkerException("Unknown target system");
     if (options.ToRosetta && (!options.ToIntel || options.Target == TargetSystem::Windows)) throw Domain::RelinkerException("Rosetta conversion requires Intel lowering and a non-Windows target");
     if (options.UnusedFilterLevel > 2) throw Domain::RelinkerException("Unused NID filter level must be 0, 1 or 2");
+    if (options.FrameRedZone && options.Target != TargetSystem::Windows) throw Domain::RelinkerException("Red-zone framing requires a Windows target: only Windows exception dispatch writes below RSP");
     if (input.InputPath.empty() || input.OutputPath.empty()) throw Domain::RelinkerException("Input and output names are required");
     if (input.InputPath.lexically_normal() == input.OutputPath.lexically_normal()) throw Domain::RelinkerException("Executable output would overwrite the input executable");
     if (!input.Modules.empty() && input.ModuleRoot.empty()) throw Domain::RelinkerException("Module root is required");
@@ -105,7 +108,27 @@ ConversionOutput Conversion::Convert(ConversionInput input, const ConversionOpti
             throw Domain::RelinkerException("Relinker patch exceeds source image", patch.Offset);
         for (std::size_t index = 0; index < patch.Bytes.size(); ++index) sourceBytes[patch.Offset + index] = patch.Bytes[index];
     }
-    GamePatch::CheckOverlaps(options.TargetName, patchedRanges, {.RelinkPatches = result.Patches, .RelaData = result.DynamicSection.RelaData, .RelaPltData = result.DynamicSection.RelaPltData});
+    const auto intelSites = trampolines.size();
+    std::vector<Codegen::RedZoneDisplacement> displacements;
+    if (options.FrameRedZone) {
+        const auto headers = Relinker::ElfReader(sourceBytes).ReadProgramHeaders();
+        std::vector<Domain::ProgramHeader> codeSegments;
+        for (const auto& header : headers) if (header.Type == 1 && (header.Flags & 1) != 0) codeSegments.push_back(header);
+        std::vector<Codegen::RedZoneFunction> functions;
+        for (const auto& region : Relinker::UnusedNidFilter::ReadExceptionFunctions(sourceBytes, headers, {}, {})) functions.push_back({region.Begin, region.End});
+        if (functions.empty()) throw Domain::RelinkerException("Red-zone framing needs function bounds from the executable's .eh_frame, and it has none");
+        Codegen::RedZoneFrameReport report;
+        auto framed = Codegen::FrameRedZoneFunctions(sourceBytes, codeSegments, functions, trampolines, report, displacements);
+        for (const auto& moved : displacements) {
+            if (moved.Offset > sourceBytes.size() || moved.Bytes.size() > sourceBytes.size() - moved.Offset)
+                throw Domain::RelinkerException("Red-zone displacement exceeds source image", moved.Offset);
+            std::copy(moved.Bytes.begin(), moved.Bytes.end(), sourceBytes.begin() + static_cast<std::ptrdiff_t>(moved.Offset));
+        }
+        { std::ostringstream message; message << "Red-zone framing: " << report.Functions << " functions, " << report.RedZoneFunctions << " leaf functions keep values below RSP, " << report.Framed << " framed (" << report.FramedWithoutFramePointer << " without a frame pointer, " << report.MovedOperands << " rsp operands moved, " << report.StubbedOperands << " in " << report.OperandStubs << " operand stubs; " << report.Exits << " exits)\n"; inputProgress.Message(message.str()); }
+        for (const auto& [reason, count] : report.Skipped) { std::ostringstream message; message << "Red-zone framing: skipped " << count << ": " << reason << '\n'; inputProgress.Message(message.str()); }
+        trampolines.insert(trampolines.end(), std::make_move_iterator(framed.begin()), std::make_move_iterator(framed.end()));
+    }
+    GamePatch::CheckOverlaps(options.TargetName, patchedRanges, {.RelinkPatches = result.Patches, .RelaData = result.DynamicSection.RelaData, .RelaPltData = result.DynamicSection.RelaPltData, .RedZoneSites = std::span<const Codegen::TrampolineSite>(trampolines).subspan(intelSites), .RedZoneDisplacements = displacements});
 
     if (!options.Patches.empty()) {
         for (auto& module : input.Modules) {
diff --git a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
index 78ce7cd35a..77044446d2 100644
--- a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
+++ b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
@@ -346,9 +346,14 @@ RelinkResult RelinkerPipeline::Relink() {
             const std::uint32_t symIdx = static_cast<std::uint32_t>(rInfo >> 32);
             const std::uint32_t relType = static_cast<std::uint32_t>(rInfo & 0xffffffff);
 
+            validationPolicy->ValidateRelocationTypeSupported(relType, pos);
+
             if (relType == R_X86_64_NONE)
                 continue;
 
+            if (plt && relType != R_X86_64_JUMP_SLOT)
+                throw RelinkerException("Unsupported PLT relocation type", pos);
+
             if (relType == 8) {
                 if (symIdx != 0 && !isZeroSectionSymbol(symIdx))
                     throw RelinkerException("RELATIVE relocation has a nonzero symbol index", pos);
@@ -377,9 +382,6 @@ RelinkResult RelinkerPipeline::Relink() {
     extractRela(dynRelaOffset, dynRelaSize, false);
     extractRela(dynJmpRelOffset, dynJmpRelSize, true);
 
-    for (const auto& ref : nidRefs)
-        validationPolicy->ValidateRelocationTypeSupported(ref.RelocationTypeValue, ref.RelocationTableOffset);
-
     std::vector<std::pair<VirtualAddress, VirtualAddress>> unwindRanges;
     std::vector<std::vector<CodeRange>> segmentUnwindRanges(executableSegments.size());
     if (std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_SCE_DYNLIBDATA; })) {
diff --git a/core/relinker/relinker/tests/CallRegistryWriterTests.cpp b/core/relinker/relinker/tests/CallRegistryWriterTests.cpp
new file mode 100644
index 0000000000..542f386b46
--- /dev/null
+++ b/core/relinker/relinker/tests/CallRegistryWriterTests.cpp
@@ -0,0 +1,81 @@
+#include <relinker/output/CallRegistryWriter.hpp>
+#include <iostream>
+#include <locale>
+#include <sstream>
+#include <stdexcept>
+#include <string>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+class GroupedPunctuation : public std::numpunct<char> {
+public:
+    explicit GroupedPunctuation(char separator) : separator(separator) {}
+
+protected:
+    char do_thousands_sep() const override { return separator; }
+    std::string do_grouping() const override { return "\3"; }
+
+private:
+    char separator;
+};
+
+class ScopedLocale {
+public:
+    explicit ScopedLocale(const std::locale& locale) : previous(std::locale::global(locale)) {}
+    ~ScopedLocale() { std::locale::global(previous); }
+
+private:
+    std::locale previous;
+};
+
+void RegistryOffsets() {
+    Relinker::CallRegistryWriter writer;
+    Relinker::CallRegistryEntry entry;
+    entry.Nid = "testNid";
+    entry.Library = "test.prx";
+    entry.RelocationTypeString = "R_X86_64_JUMP_SLOT";
+    entry.RelocationOffset = 0x12345678;
+    entry.TargetSection = ".text";
+    entry.TargetOffset = 0xabcdef0123456789ULL;
+    entry.CallSites = {0, 0xfff, 0x1000, 0xffffffffffffffffULL};
+    entry.CallSitesResolved = true;
+    entry.Weak = true;
+    std::string registry;
+    std::string imports;
+    std::string libraries;
+    {
+        const ScopedLocale classic(std::locale::classic());
+        registry = writer.WriteCallRegistry({entry});
+        imports = writer.WriteModuleImports({entry});
+        libraries = writer.WriteNeededLibraries({entry.Library});
+    }
+    Require(registry.find("\"relocationOffset\": \"0x12345678\"") != std::string::npos, "relocation offset is not canonical hexadecimal");
+    Require(registry.find("\"targetOffset\": \"0xABCDEF0123456789\"") != std::string::npos, "target offset is not canonical hexadecimal");
+    Require(registry.find("\"callSites\": [\"0x0\", \"0xFFF\", \"0x1000\", \"0xFFFFFFFFFFFFFFFF\"]") != std::string::npos, "call sites are not canonical hexadecimal");
+    Require(imports.find("\"targetOffset\": \"0xABCDEF0123456789\"") != std::string::npos, "module target offset is not canonical hexadecimal");
+    for (const char separator : {',', '.'}) {
+        const ScopedLocale grouped(std::locale(std::locale::classic(), new GroupedPunctuation(separator)));
+        std::ostringstream control;
+        control << std::hex << 0x12345678;
+        Require(control.str().find(separator) != std::string::npos, "grouping locale is not active");
+        Require(writer.WriteCallRegistry({entry}) == registry, "call registry depends on the host locale");
+        Require(writer.WriteModuleImports({entry}) == imports, "module imports depend on the host locale");
+        Require(writer.WriteNeededLibraries({entry.Library}) == libraries, "needed libraries depend on the host locale");
+        Require(std::use_facet<std::numpunct<char>>(std::locale()).thousands_sep() == separator, "registry writer changed the global locale");
+    }
+}
+
+}
+
+int main() {
+    try {
+        RegistryOffsets();
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/relinker/tests/CallSiteResolverTests.cpp b/core/relinker/relinker/tests/CallSiteResolverTests.cpp
index f06fab07fa..6dd410e448 100644
--- a/core/relinker/relinker/tests/CallSiteResolverTests.cpp
+++ b/core/relinker/relinker/tests/CallSiteResolverTests.cpp
@@ -31,6 +31,8 @@ int main() {
         check("RIP-relative function pointer load", {0x48, 0x8b, 0x05, 0xf9, 0, 0, 0}, true);
         check("REX-prefixed indirect call", {0x48, 0xff, 0x15, 0xf9, 0, 0, 0}, true);
         check("multiple REX prefixes on pointer load", {0x40, 0x48, 0x8b, 0x05, 0xf8, 0, 0, 0}, true);
+        check("earlier REX.W does not widen a pointer load", {0x48, 0x40, 0x8b, 0x05, 0xf8, 0, 0, 0}, false);
+        check("final REX.W widens a pointer load", {0x48, 0x40, 0x48, 0x8b, 0x05, 0xf7, 0, 0, 0}, true);
         check("pointer load without REX.W", {0x40, 0x8b, 0x05, 0xf9, 0, 0, 0}, false);
         check("register pointer load", {0x48, 0x8b, 0x00}, false);
         check("increment memory", {0xff, 0x05, 0xfa, 0, 0, 0}, false);
diff --git a/core/relinker/relinker/tests/CodeDataScanningTests.cpp b/core/relinker/relinker/tests/CodeDataScanningTests.cpp
new file mode 100644
index 0000000000..0b2e06c47c
--- /dev/null
+++ b/core/relinker/relinker/tests/CodeDataScanningTests.cpp
@@ -0,0 +1,86 @@
+#include "TestProgress.hpp"
+#include <relinker/analysis/SyscallScanner.hpp>
+#include <codegen/CodegenException.hpp>
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+using Bytes = std::vector<std::uint8_t>;
+
+constexpr std::size_t DataOffset = 6;
+constexpr std::size_t RoutineOffset = 14;
+constexpr std::array<std::uint8_t, 8> UndecodableData{0x0f, 0x78, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55};
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+Bytes Fixture(bool syscall) {
+    constexpr std::array<std::uint8_t, DataOffset> entry{0xe8, 0x09, 0x00, 0x00, 0x00, 0xc3};
+    Bytes code(RoutineOffset, 0x90);
+    std::copy(entry.begin(), entry.end(), code.begin());
+    if (syscall) code.insert(code.end(), {0xb8, 0x09, 0x00, 0x00, 0x00, 0x0f, 0x05});
+    code.push_back(0xc3);
+    return code;
+}
+
+void CheckUndecodableData(Domain::FileByteOffset origin) {
+    TestProgress progress;
+    const auto scanner = Relinker::MakeSyscallScanner(progress);
+    auto code = Fixture(false);
+    Require(scanner->ScanCodeSectionForSyscalls(code, origin, code.size()).empty(), "Valid code across a padding gap was rejected");
+    std::copy(UndecodableData.begin(), UndecodableData.end(), code.begin() + DataOffset);
+    try {
+        scanner->ScanCodeSectionForSyscalls(code, origin, code.size());
+    } catch (const Codegen::CodegenException& error) {
+        Require(error.FailureOffset == origin + DataOffset, "Decode failure did not identify the embedded data");
+        Require(std::string(error.what()).find("Cannot decode instruction: Unsupported 0F 78 opcode without SSE4A prefix") != std::string::npos, "Unexpected embedded-data decode failure");
+        std::cout << "Embedded-data decode rejection reproduced at " << error.FailureOffset << '\n';
+        return;
+    }
+    throw std::runtime_error("Embedded-data scanning changed; update the known-gap fixture and debt entry");
+}
+
+void CheckForbiddenInstruction(const Bytes& code, Domain::FileByteOffset origin, std::size_t offset, const std::string& number) {
+    for (const bool trap : {false, true}) {
+        TestProgress progress;
+        try {
+            Relinker::MakeSyscallScanner(progress, trap)->ScanCodeSectionForSyscalls(code, origin, code.size());
+        } catch (const Domain::RelinkerException& error) {
+            Require(error.FailureOffset == origin + offset, "Forbidden instruction reported at the wrong offset");
+            Require(std::string(error.what()).find("Forbidden syscall instruction at code offset 0x") != std::string::npos, "Unexpected syscall rejection");
+            Require(number.empty() || std::string(error.what()).find(number) != std::string::npos, "Lost the reachable routine's syscall number");
+            continue;
+        }
+        throw std::runtime_error("Forbidden instruction was not reported");
+    }
+}
+
+void CheckGapAndReachableRoutine(Domain::FileByteOffset origin) {
+    auto code = Fixture(false);
+    code[DataOffset] = 0x0f;
+    code[DataOffset + 1] = 0x05;
+    CheckForbiddenInstruction(code, origin, DataOffset, {});
+    CheckForbiddenInstruction(Fixture(true), origin, RoutineOffset + 5, "syscall number 9");
+}
+
+}
+
+int main() {
+    try {
+        for (const auto origin : {std::uint64_t{0}, std::uint64_t{0x123400}, std::uint64_t{0x100000000}}) {
+            CheckUndecodableData(origin);
+            CheckGapAndReachableRoutine(origin);
+        }
+        std::cout << "Embedded-code-data known-gap and reachable-code controls passed\n";
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 94a34990c1..092f5fa398 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -142,6 +142,26 @@ void CheckRelocatedTransfers() {
     RequireOffsets(*unresolved, {0, 6, 7, 8});
 }
 
+void CheckAddressSizeOverride() {
+    constexpr auto slot = TextAddress + 0x1000;
+    Bytes text{0x67, 0xff, 0x15, 0, 0, 0, 0, 0x90, 0xc3, 0x67, 0xff, 0x25, 0, 0, 0, 0, 0x90, 0x90, 0xc3};
+    SetDisplacement(text, 3, 7, slot);
+    SetDisplacement(text, 12, 16, slot + 8);
+    Pointers pointers;
+    pointers.Slots = {{static_cast<std::uint32_t>(slot), TextAddress + 9}, {static_cast<std::uint32_t>(slot + 8), TextAddress + 18}};
+    RequireOffsets(*BuildControlFlowGraph(text, TextAddress, TextAddress, {}, pointers), {0, 7, 8, 9, 18});
+    RequireOffsets(*BuildControlFlowGraph(text, TextAddress, TextAddress + 9, {}, pointers), {9, 18});
+
+    Bytes lea(17, 0x90);
+    const Bytes opcode{0x67, 0x48, 0x8d, 0x05};
+    std::copy(opcode.begin(), opcode.end(), lea.begin());
+    SetDisplacement(lea, 4, 8, TextAddress + 16);
+    lea[8] = lea[16] = 0xc3;
+    const Pointers missing;
+    RequireOffsets(*BuildControlFlowGraph(lea, TextAddress, TextAddress, {}, missing, true), {0, 8});
+    RequireOffsets(*BuildAddressTakenControlFlowGraph(lea, TextAddress, TextAddress, {}, missing, {}), {0, 8});
+}
+
 void CheckCodeAddresses() {
     Bytes text(17, 0x90);
     text[0] = 0x48;
@@ -354,6 +374,7 @@ int main() {
         CheckCallsBeforeZeroPadding();
         CheckCallsThatStillFallThrough();
         CheckRelocatedTransfers();
+        CheckAddressSizeOverride();
         CheckCodeAddresses();
         CheckSpeculativeRoots();
         CheckTrailingZeroRoots();
diff --git a/core/relinker/relinker/tests/ConversionTests.cpp b/core/relinker/relinker/tests/ConversionTests.cpp
index 3357892f5e..4b27916736 100644
--- a/core/relinker/relinker/tests/ConversionTests.cpp
+++ b/core/relinker/relinker/tests/ConversionTests.cpp
@@ -127,6 +127,35 @@ void convert() {
     require(progress.Events.back().Completed != 1 || progress.Events.back().Stage != Domain::ProgressStage::Executable, "Failed conversion reported completion");
 }
 
+void runtimeLifecyclePolicy() {
+    TestProgress progress;
+    const Relinker::Conversion converter(progress);
+    for (const auto* directory : {"sce_module", "sce_modules", "prx", "Media/Plugins"}) {
+        auto source = input();
+        const auto parent = source.ModuleRoot / directory;
+        auto module = fixture();
+        Io::WriteU64(module, 0x2080, 12);
+        Io::WriteU64(module, 0x2088, 0x1000);
+        Io::WriteU64(module, 208, 160);
+        Io::WriteU64(module, 216, 160);
+        source.Modules.push_back({parent / "plugin.prx", std::move(module)});
+        source.RuntimeDirectories.push_back(parent);
+        const auto output = converter.Convert(std::move(source), {});
+        const auto& bytes = output.Modules.at(0).Bytes;
+        const auto headers = Io::ReadU64(bytes, 32);
+        bool initializesOnMapping = false;
+        for (std::uint16_t index = 0; index < Io::ReadU16(bytes, 56); ++index) {
+            const auto header = headers + index * 56;
+            if (Io::ReadU32(bytes, header) != 2) continue;
+            const auto dynamic = Io::ReadU64(bytes, header + 8);
+            const auto end = dynamic + Io::ReadU64(bytes, header + 32);
+            for (auto offset = dynamic; offset < end; offset += 16)
+                if (Io::ReadU64(bytes, offset) == 12) initializesOnMapping = Io::ReadU64(bytes, offset + 8) != 0;
+        }
+        require(initializesOnMapping == (std::string_view(directory) != "Media/Plugins"), "Default SDK directories lost their mapping initializer");
+    }
+}
+
 void fixedBase() {
     TestProgress progress;
     const Relinker::Conversion converter(progress);
@@ -256,9 +285,9 @@ void baseRelocations() {
     require(Io::ReadU32(relocs, 4) == 12, "Wrong base relocation block size");
     require(Io::ReadU16(relocs, 8) == 0xa000, "Wrong first relocation entry");
     require(Io::ReadU16(relocs, 10) == 0xa008, "Wrong second relocation entry");
-    reject([&] { (void)builder.BuildBaseRelocations({0x10ffc}); });
-    reject([&] { (void)builder.BuildBaseRelocations({0x10ffd}); });
-    reject([&] { (void)builder.BuildBaseRelocations({0x10fff}); });
+    const auto spanning = builder.BuildBaseRelocations({0x10ffc, 0x10fff});
+    require(spanning.size() == 12 && Io::ReadU32(spanning, 0) == 0x10000, "A page-spanning base relocation was not placed in its first page");
+    require(Io::ReadU16(spanning, 8) == 0xaffc && Io::ReadU16(spanning, 10) == 0xafff, "Wrong page-spanning base relocation entries");
 }
 
 std::size_t fileOffset(const std::vector<std::uint8_t>& pe, std::uint32_t address) {
@@ -300,17 +329,62 @@ void runtimeDirectories() {
     }
 }
 
+void relocationValidation() {
+    TestProgress progress;
+    const Relinker::Conversion converter(progress);
+    {
+        auto source = input();
+        Io::WriteU64(source.Executable, 0x2058, 24);
+        Io::WriteU64(source.Executable, 0x2700, 0x2000);
+        Io::WriteU64(source.Executable, 0x2708, (static_cast<std::uint64_t>(0x9999) << 32) | 0x99);
+        Io::WriteU64(source.Executable, 0x2710, 0);
+        try {
+            converter.Convert(source, {});
+            throw std::runtime_error("Unsupported relocation type was accepted");
+        } catch (const Domain::RelinkerException& error) {
+            require(std::string(error.what()).find("Unsupported relocation type 0x99") != std::string::npos, "Wrong error for unsupported relocation");
+            require(error.FailureOffset == 0x2700, "Wrong failure offset for unsupported relocation");
+        }
+    }
+    {
+        auto source = input();
+        const std::vector<std::pair<std::uint64_t, std::uint64_t>> tags{
+            {5, 0x2600}, {10, 1}, {6, 0x2620}, {11, 24}, {7, 0x2700}, {8, 0}, {9, 24}, {4, 0x2680},
+            {3, 0x2000}, {20, 7}, {23, 0x2780}, {2, 24}, {0, 0}
+        };
+        const auto at = 64 + 2 * 56;
+        Io::WriteU64(source.Executable, at + 32, tags.size() * 16);
+        Io::WriteU64(source.Executable, at + 40, tags.size() * 16);
+        for (std::size_t index = 0; index < tags.size(); ++index) {
+            Io::WriteU64(source.Executable, 0x2000 + index * 16, tags[index].first);
+            Io::WriteU64(source.Executable, 0x2008 + index * 16, tags[index].second);
+        }
+        Io::WriteU64(source.Executable, 0x2780, 0x2000);
+        Io::WriteU64(source.Executable, 0x2788, (static_cast<std::uint64_t>(1) << 32) | 8);
+        Io::WriteU64(source.Executable, 0x2790, 0);
+        try {
+            converter.Convert(source, {});
+            throw std::runtime_error("Unsupported PLT relocation type was accepted");
+        } catch (const Domain::RelinkerException& error) {
+            require(std::string(error.what()) == "Unsupported PLT relocation type", "Wrong error for unsupported PLT relocation");
+            require(error.FailureOffset == 0x2780, "Wrong failure offset for unsupported PLT relocation");
+        }
+    }
+}
+
 }
 
 int main() {
     try {
         convert();
+        runtimeLifecyclePolicy();
         fixedBase();
         scanning();
         diagnosticContext();
         cancellation();
         baseRelocations();
         runtimeDirectories();
+        relocationValidation();
     } catch (const std::exception& error) {
         std::cerr << error.what() << '\n';
         return 1;
diff --git a/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp b/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp
index 154238155d..b1122ee8a7 100644
--- a/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp
+++ b/core/relinker/relinker/tests/ElfReaderBoundsTests.cpp
@@ -233,6 +233,41 @@ int main() {
             bytes.resize(128 + 3 * 64 - 1);
             RejectSections(std::move(bytes));
         }},
+        {"section file range past end of file", [] {
+            auto bytes = Fixture();
+            Write<std::uint64_t>(bytes, 216, 0x2f0);
+            RejectSections(std::move(bytes));
+        }},
+        {"section file range offset overflow", [] {
+            auto bytes = Fixture();
+            Write<std::uint64_t>(bytes, 216, std::numeric_limits<std::uint64_t>::max() - 15);
+            RejectSections(std::move(bytes));
+        }},
+        {"section ending at end of file", [] {
+            auto bytes = Fixture();
+            Write<std::uint64_t>(bytes, 216, 0x2e0);
+            Write<std::uint64_t>(bytes, 224, 32);
+            const auto sections = Relinker::ElfReader(std::move(bytes)).ReadSectionHeaders();
+            Require(sections.size() == 3 && sections[1].Offset + sections[1].SectionSize == 0x300);
+        }},
+        {"unbacked SHT_NOBITS section with range past end of file", [] {
+            auto bytes = Fixture();
+            Write<std::uint32_t>(bytes, 196, 8);
+            Write<std::uint64_t>(bytes, 216, 0x2f0);
+            Write<std::uint64_t>(bytes, 224, 0x1000);
+            const auto sections = Relinker::ElfReader(std::move(bytes)).ReadSectionHeaders();
+            Require(sections.size() == 3 && sections[1].Type == 8);
+        }},
+        {"empty section beyond end of file", [] {
+            constexpr std::uint64_t offsets[] = {0x300, 0x301, std::numeric_limits<std::uint64_t>::max()};
+            for (const std::uint64_t offset : offsets) {
+                auto bytes = Fixture();
+                Write<std::uint64_t>(bytes, 216, offset);
+                Write<std::uint64_t>(bytes, 224, 0);
+                const auto sections = Relinker::ElfReader(std::move(bytes)).ReadSectionHeaders();
+                Require(sections.size() == 3 && sections[1].Offset == offset && sections[1].SectionSize == 0);
+            }
+        }},
         {"translation program header stride", [] {
             for (const std::uint16_t stride : {0, 48, 64}) {
                 auto bytes = Fixture();
diff --git a/core/relinker/relinker/tests/GamePatchTests.cpp b/core/relinker/relinker/tests/GamePatchTests.cpp
index bde267682d..0b6ab99a13 100644
--- a/core/relinker/relinker/tests/GamePatchTests.cpp
+++ b/core/relinker/relinker/tests/GamePatchTests.cpp
@@ -282,6 +282,54 @@ void applyAndMismatch() {
     require(PatchTarget(bytes, "other", entries).Applied.empty() && bytes == original, "entry hit another target");
 }
 
+void programmaticWidths() {
+    auto bytes = twoSegmentFixture();
+    const auto original = bytes;
+    const ElfReader reader(original);
+    const std::vector<PatchEntry> invalid{
+        entry("t", 0x1000, {0}, {9, 8}),
+        entry("t", 0x1000, {0, 1}, {9}),
+        entry("t", 0x1000, {}, {}),
+        entry("t", 0x1000, {}, {9}),
+        entry("t", 0x1000, {0}, {}),
+    };
+    for (const auto& patch : invalid) {
+        const std::vector<PatchEntry> entries{entry("t", 0x1100, {0x80}, {1}), patch};
+        rejects([&] { ResolveRanges(reader, entries); }, "same nonzero width");
+        rejects([&] { PatchTarget(bytes, "t", entries); }, "same nonzero width");
+        require(bytes == original, "an invalid patch width wrote bytes");
+        rejects([&] { ApplyPatches(bytes, "t", entries, {{0x2000, 1, 0x1100}, {0x1000, patch.Expected.size(), 0x1000}}); }, "same nonzero width");
+        require(bytes == original, "direct application of an invalid patch width wrote bytes");
+        for (const bool outputMode : {false, true}) {
+            PatchFile file;
+            file.MainTarget = "t";
+            file.Entries = entries;
+            rejects([&] { VerifyPatches(file, {{"t", original}}, {}, outputMode); }, "same nonzero width");
+        }
+    }
+}
+
+void applicationRangeWidths() {
+    const std::vector<std::uint8_t> original{0, 1, 2, 3};
+    auto bytes = original;
+    const std::vector<PatchEntry> entries{entry("t", 0x1000, {0}, {9}), entry("t", 0x1002, {2, 3}, {8, 7})};
+    for (const std::uint64_t length : {0u, 1u, 3u}) {
+        rejects([&] { ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}, {2, length, 0x1002}}); }, "range length does not match");
+        require(bytes == original, "a mismatched range length wrote bytes");
+    }
+    rejects([&] { ApplyPatches(bytes, "t", {entry("t", 0x1003, {3, 4}, {8, 7})}, {{3, 1, 0x1003}}); }, "range length does not match");
+    require(bytes == original, "a truncated comparison range wrote bytes");
+    for (const std::uint64_t offset : std::array<std::uint64_t, 4>{3, 4, 5, UINT64_MAX}) {
+        rejects([&] { ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}, {offset, 2, 0x1002}}); }, "range exceeds the image");
+        require(bytes == original, "an out-of-bounds patch wrote bytes");
+    }
+    rejects([&] { ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}}); }, "ranges do not match");
+    require(bytes == original, "a missing range wrote bytes");
+    const auto applied = ApplyPatches(bytes, "t", entries, {{0, 1, 0x1000}, {2, 2, 0x1002}});
+    require(bytes == std::vector<std::uint8_t>({9, 1, 8, 7}) && applied.size() == 2, "valid boundary patches failed");
+    require(ApplyPatches(bytes, "t", {}, {}).empty(), "empty patch list was rejected");
+}
+
 void overlapWithWriters() {
     const std::vector<PatchedRange> patched{{0x1010, 2, 0x401010}};
     const auto reject = [&](const WriterSites& sites, const std::string& writer) { rejects([&] { CheckOverlaps("t", patched, sites); }, writer); };
@@ -305,6 +353,14 @@ void overlapWithWriters() {
     CheckOverlaps("t", patched, {.Traps = trapBefore});
     const std::vector<WriterRange> window{{0x100f, 4, "window"}};
     reject({.Traps = window}, "window");
+    const std::vector<Codegen::TrampolineSite> frame{{0x1011, 0x401011, 5, {}, {}, 0}};
+    reject({.RedZoneSites = frame}, "red-zone frame site");
+    const std::vector<Codegen::TrampolineSite> frameBefore{{0x100b, 0x40100b, 5, {}, {}, 0}};
+    CheckOverlaps("t", patched, {.RedZoneSites = frameBefore});
+    const std::vector<Codegen::RedZoneDisplacement> moved{{0x100f, {0x10, 0, 0, 0}}};
+    reject({.RedZoneDisplacements = moved}, "red-zone moved displacement");
+    const std::vector<Codegen::RedZoneDisplacement> movedBefore{{0x100f, {0x10}}};
+    CheckOverlaps("t", patched, {.RedZoneDisplacements = movedBefore});
 }
 
 void conversion() {
@@ -340,11 +396,68 @@ void conversion() {
     rejects([&] { converter.Convert(conversionInput(executable), failing); }, "expected 07 found 00");
     failing.Patches = {entry("custom-name.bin", 0x1000, {0xc3, 0}, {0, 0}), entry("custom-name.bin", 0x1001, {0}, {1})};
     rejects([&] { converter.Convert(conversionInput(executable), failing); }, "overlaps");
+    for (const auto target : {TargetSystem::Linux, TargetSystem::Windows, TargetSystem::MacOs}) {
+        failing.Target = target;
+        for (const char* name : {"custom-name.bin", "sce_module/plugin.prx"}) {
+            failing.Patches = {entry(name, 0x1001, {0}, {9, 8})};
+            rejects([&] { converter.Convert(conversionInput(executable), failing); }, "same nonzero width");
+        }
+    }
 
     const auto repeated = converter.Convert(conversionInput(executable), plain);
     require(repeated.Executable == baseline.Executable && repeated.Modules.front().Bytes == baseline.Modules.front().Bytes, "no entries changed the output");
 }
 
+std::vector<std::uint8_t> framedLeafFixture() {
+    auto bytes = conversionFixture();
+    Io::WriteU64(bytes, 64 + 32, 0x80);
+    Io::WriteU64(bytes, 64 + 40, 0x80);
+    std::fill(bytes.begin() + 0x1000, bytes.begin() + 0x1080, 0xcc);
+    const std::vector<std::uint8_t> caller{0xe8, 0x3b, 0x00, 0x00, 0x00, 0xc3};
+    const std::vector<std::uint8_t> leaf{0x53, 0x41, 0x56, 0x41, 0x57, 0x48, 0x89, 0x7c, 0x24, 0xf0, 0x48, 0x8b, 0x04, 0x24, 0x48, 0x8b, 0x44, 0x24, 0x08, 0x41, 0x5f, 0x41, 0x5e, 0x5b, 0xc3};
+    std::copy(caller.begin(), caller.end(), bytes.begin() + 0x1000);
+    std::copy(leaf.begin(), leaf.end(), bytes.begin() + 0x1040);
+    const auto ehFrameHeader = 64 + 7 * 56;
+    Io::WriteU32(bytes, ehFrameHeader, 0x6474e550);
+    Io::WriteU32(bytes, ehFrameHeader + 4, 4);
+    for (const auto field : {8, 16, 24}) Io::WriteU64(bytes, ehFrameHeader + field, 0x2900);
+    Io::WriteU64(bytes, ehFrameHeader + 32, 32);
+    Io::WriteU64(bytes, ehFrameHeader + 40, 32);
+    Io::WriteU64(bytes, ehFrameHeader + 48, 4);
+    Io::WriteU32(bytes, 0x2800, 9);
+    const std::vector<std::uint8_t> cie{1, 0, 1, 0x78, 16};
+    std::copy(cie.begin(), cie.end(), bytes.begin() + 0x2808);
+    Io::WriteU32(bytes, 0x2840, 20);
+    Io::WriteU32(bytes, 0x2844, 0x44);
+    Io::WriteU64(bytes, 0x2848, 0x1040);
+    Io::WriteU64(bytes, 0x2850, leaf.size());
+    bytes[0x2900] = 1;
+    bytes[0x2902] = 3;
+    Io::WriteU64(bytes, 0x2904, 0x2800);
+    Io::WriteU32(bytes, 0x290c, 1);
+    Io::WriteU64(bytes, 0x2910, 0x1040);
+    Io::WriteU64(bytes, 0x2918, 0x2840);
+    return bytes;
+}
+
+void framedLeafPatches() {
+    TestProgress progress;
+    const Conversion converter(progress);
+    const auto executable = framedLeafFixture();
+    ConversionOptions options;
+    options.TargetName = "custom-name.bin";
+    options.Target = TargetSystem::Windows;
+    options.FrameRedZone = true;
+    converter.Convert(conversionInput(executable), options);
+    require(progress.Messages.find("1 framed (1 without a frame pointer, 1 rsp operands moved, 2 in 1 operand stubs; 1 exits)") != std::string::npos, "the fixture's leaf was not framed with a moved displacement and an operand stub: " + progress.Messages);
+    options.Patches = {entry("custom-name.bin", 0x1010, {0xcc}, {0x90})};
+    require(converter.Convert(conversionInput(executable), options).AppliedPatches.size() == 1, "a patch outside the framed leaf was not applied");
+    options.Patches = {entry("custom-name.bin", 0x1049, {0xf0}, {0xe8})};
+    rejects([&] { converter.Convert(conversionInput(executable), options); }, "overlaps red-zone moved displacement at off=0x1049 length 1");
+    options.Patches = {entry("custom-name.bin", 0x104c, {0x04}, {0x0c})};
+    rejects([&] { converter.Convert(conversionInput(executable), options); }, "overlaps red-zone frame site at off=0x104a length 9");
+}
+
 void targets() {
     const std::vector<PatchEntry> entries{entry("a.elf", 1, {0}, {1}), entry("sce_module/libc.prx", 1, {0}, {1})};
     MatchTargets(entries, {"a.elf", "b.elf", "sce_module/libc.prx"});
@@ -529,8 +642,11 @@ int main() {
         ranges();
         headerRange();
         applyAndMismatch();
+        programmaticWidths();
+        applicationRangeWidths();
         overlapWithWriters();
         conversion();
+        framedLeafPatches();
         targets();
         verify();
         rangeFailureInVerify();
diff --git a/core/relinker/relinker/tests/test_executable_tls_relocations.py b/core/relinker/relinker/tests/test_executable_tls_relocations.py
index 5ce918047b..8f9db5e449 100644
--- a/core/relinker/relinker/tests/test_executable_tls_relocations.py
+++ b/core/relinker/relinker/tests/test_executable_tls_relocations.py
@@ -3,7 +3,9 @@ has them in its GOT. The Linux ELF keeps them dynamic and symbolless, with the v
 TLS block as the addend, for the dynamic loader to resolve against where it puts the block; a named one
 against a defined STT_TLS symbol is folded the same way, and one against an import stays named, typed
 STT_TLS. The Windows and macOS images resolve TPOFF64 and DTPOFF64 statically against their block,
-AlignUp(p_memsz, p_align) below the thread pointer, and reject what they cannot express."""
+AlignUp(p_memsz, p_align) below the thread pointer, and reject what they cannot express. Every target
+rejects the link-time types GOT32, PLT32, GOTPCREL, 32S, GOTPCRELX and REX_GOTPCRELX, which glibc's
+ld.so does not apply."""
 
 from pathlib import Path
 import struct
@@ -18,6 +20,8 @@ from test_tls_function_coverage import pe_bytes_at
 PT_LOAD = 1
 PT_TLS = 7
 DTPMOD64, DTPOFF64, TPOFF64, TPOFF32 = 16, 17, 18, 23
+LINK_TIME = {3: "got32", 4: "plt32", 9: "gotpcrel", 11: "32s", 41: "gotpcrelx", 42: "rex-gotpcrelx"}
+TARGETS = {(): "linux", ("--lazy-binding",): "lazy", ("--windows",): "windows", ("--macos",): "macos"}
 TLS_MEMSZ, TLS_ALIGN = 0x24, 16
 TLS_BLOCK = 0x30
 DEFAULT_BASE = 0x400000
@@ -137,6 +141,8 @@ def main():
 
         failures = [
             ("tpoff32", [(0x1000, TPOFF32, NULL, 0)], True, (), "Unsupported relocation type 0x17"),
+            ("tpoff32-invalid-sym", [(0x1000, TPOFF32, 0x1234, 0)], True, (), "Unsupported relocation type 0x17"),
+            ("unknown-reloc-invalid-sym", [(0x1000, 0x99, 0x1234, 0)], True, (), "Unsupported relocation type 0x99"),
             ("not-tls-symbol", [(0x1000, TPOFF64, DATA_SYMBOL, 0)], True, (), "not STT_TLS"),
             ("no-tls-segment", [(0x1000, TPOFF64, NULL, 0)], False, (), "without a PT_TLS segment"),
             ("dtpmod-addend", [(0x1000, DTPMOD64, NULL, 1)], True, (), "DTPMOD64 relocation has a nonzero addend"),
@@ -144,7 +150,8 @@ def main():
             ("windows-import", [(0x1000, TPOFF64, IMPORTED, 0)], True, ("--windows",), "Imported TLS relocation"),
             ("macos-dtpmod", [(0x1000, DTPMOD64, NULL, 0)], True, ("--macos",), "DTPMOD64 relocation is not supported"),
             ("macos-import", [(0x1000, TPOFF64, IMPORTED, 0)], True, ("--macos",), "Imported TLS relocation"),
-        ]
+        ] + [(f"{target}-{name}", [(0x1000, kind, NULL, 0)], True, flags, f"Unsupported relocation type {kind:#x}")
+             for kind, name in LINK_TIME.items() for flags, target in TARGETS.items()]
         for name, relocations, has_tls, flags, error in failures:
             result, output = relink(relinker, directory, name, image(relocations, has_tls), *flags)
             assert result.returncode == 2 and error in result.stderr, (name, result.returncode, result.stderr)
diff --git a/core/relinker/relinker/tests/test_guest_absolute_symbols.py b/core/relinker/relinker/tests/test_guest_absolute_symbols.py
index a0c0056e57..77a57f1fba 100644
--- a/core/relinker/relinker/tests/test_guest_absolute_symbols.py
+++ b/core/relinker/relinker/tests/test_guest_absolute_symbols.py
@@ -12,13 +12,14 @@ from test_macos_output import MachO
 ABSOLUTE = 0xFFF1
 COMMON = 0xFFF2
 VALUE = 0x1234
+SIZE = 0x10
 ADDEND = 0x10
 TARGET = 0x2320
 
 
-def module_with_section(section):
+def module_with_section(section, size=0):
     image = module_with_symbol(True)
-    struct.pack_into("<HQQ", image, 0x898 + 6, section, VALUE, 0)
+    struct.pack_into("<HQQ", image, 0x898 + 6, section, VALUE, size)
     struct.pack_into("<Q", image, 0x668, 24)
     struct.pack_into("<QQq", image, 0x900, TARGET, (1 << 32) | 1, ADDEND)
     return image
@@ -73,10 +74,10 @@ def main():
     with tempfile.TemporaryDirectory(prefix="anyps5-guest-absolute-") as directory:
         work = Path(directory)
 
-        def convert(name, system, section):
+        def convert(name, system, section, size=0):
             case = work / f"{name}-{system}"
             (case / "sce_module").mkdir(parents=True)
-            (case / "sce_module" / "module.prx").write_bytes(module_with_section(section))
+            (case / "sce_module" / "module.prx").write_bytes(module_with_section(section, size))
             source = case / "input.elf"
             source.write_bytes(main_fixture())
             output = case / ("output.exe" if system == "windows" else "output.elf")
@@ -86,15 +87,16 @@ def main():
             return result, case / "app0" / "sce_module" / "module.prx.guest.prx"
 
         for system in ("linux", "windows", "macos"):
-            result, artifact = convert("absolute", system, ABSOLUTE)
-            assert result.returncode == 0, (system, result.stdout, result.stderr)
-            data = artifact.read_bytes()
-            if system == "windows":
-                assert any(value == VALUE + ADDEND for _, value in pe_qwords(data)), "absolute relocation value missing"
-            elif system == "macos":
-                assert any(value == VALUE + ADDEND for _, value in macho_qwords(data)), "absolute relocation value missing"
-            else:
-                assert elf_relocation(data) == (1, ABSOLUTE, VALUE, ADDEND)
+            for size in (0, SIZE):
+                result, artifact = convert(f"absolute-{size}", system, ABSOLUTE, size)
+                assert result.returncode == 0, (system, size, result.stdout, result.stderr)
+                data = artifact.read_bytes()
+                if system == "windows":
+                    assert any(value == VALUE + ADDEND for _, value in pe_qwords(data)), "absolute relocation value missing"
+                elif system == "macos":
+                    assert any(value == VALUE + ADDEND for _, value in macho_qwords(data)), "absolute relocation value missing"
+                else:
+                    assert elf_relocation(data) == (1, ABSOLUTE, VALUE, ADDEND)
 
             result, artifact = convert("common", system, COMMON)
             assert result.returncode == 2 and "Unsupported special symbol section" in result.stderr, result.stderr
diff --git a/core/relinker/relinker/tests/test_guest_deferred_dependencies.py b/core/relinker/relinker/tests/test_guest_deferred_dependencies.py
index 7d27de5530..1a155bc31e 100644
--- a/core/relinker/relinker/tests/test_guest_deferred_dependencies.py
+++ b/core/relinker/relinker/tests/test_guest_deferred_dependencies.py
@@ -124,8 +124,8 @@ def main():
                                      env={**os.environ, "ANYPS5_GUEST_MODULE_ARGS": str(events)})
                 assert run.returncode == 42, (root, run.returncode, run.stdout, run.stderr)
                 recorded = events.read_text() if events.exists() else ""
-                assert recorded.count("args=") == (1 if root in ("executable", "bundled", "imported") else 0), (root, recorded)
-                load_and_record(case, libraries / "libc.prx", runtime / "plugin.prx.guest.prx")
+                assert recorded.count("args=") == 0, (root, recorded)
+                load_and_record(case, libraries / "libc.prx", runtime / "provider.prx.guest.prx")
     print("Guest deferred dependency tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_guest_module_args.py b/core/relinker/relinker/tests/test_guest_module_args.py
index ea9ecf0f18..0ee80ca6f3 100644
--- a/core/relinker/relinker/tests/test_guest_module_args.py
+++ b/core/relinker/relinker/tests/test_guest_module_args.py
@@ -105,6 +105,11 @@ def check_lifecycle_host(relinker, host, work, linux, deferred):
                                  env={**os.environ, 'ANYPS5_GUEST_MODULE_ARGS': str(events)},
                                  capture_output=True, text=True, timeout=30)
             assert run.returncode == 0, (run.returncode, run.stdout, run.stderr)
+            assert not events.exists(), events.read_text()
+            run = subprocess.run([sys.executable, __file__, '--load', str(libraries / 'libkernel.prx'), str(initializer)],
+                                 env={**os.environ, 'ANYPS5_GUEST_MODULE_ARGS': str(events)},
+                                 capture_output=True, text=True, timeout=30)
+            assert run.returncode == 0, (run.returncode, run.stdout, run.stderr)
         assert events.read_text() == 'result=0\n', events.read_text()
 
 
@@ -161,7 +166,20 @@ def main():
         host = ctypes.CDLL(sys.argv[2], mode=ctypes.RTLD_GLOBAL if sys.platform == 'darwin' else ctypes.DEFAULT_MODE)
         host.SetPendingArgs.argtypes = [ctypes.c_size_t, ctypes.c_void_p]
         host.SetPendingArgs(ARGS, ARGP)
-        ctypes.CDLL(sys.argv[3])
+        module = ctypes.CDLL(sys.argv[3])
+        try:
+            table = (ctypes.c_uint64 * 8).in_dll(module, '__aps5_guest_lifecycle_nid_no_patch')
+        except ValueError:
+            return
+        assert table[0] == 0x415053354c494658 and table[6] == 0
+        table[6] = 1
+        returned = ctypes.CFUNCTYPE(ctypes.c_int, ctypes.c_size_t, ctypes.c_void_p, ctypes.c_void_p)(table[2])(ARGS, ARGP, None) if table[2] else 0
+        for index in range(table[4]):
+            callback = ctypes.c_void_p.from_address(ctypes.c_uint64.from_address(ctypes.addressof(table) + 64 + index * 8).value).value
+            if callback:
+                ctypes.CFUNCTYPE(None, ctypes.c_int, ctypes.c_void_p, ctypes.c_void_p)(callback)(0, None, None)
+        host.__aps5_set_module_init_result_nid_no_patch(returned)
+        table[6] = 2
         return
     relinker = Path(sys.argv[1]).resolve()
     host = Path(sys.argv[2]).resolve()
diff --git a/core/relinker/relinker/tests/test_guest_module_dir.py b/core/relinker/relinker/tests/test_guest_module_dir.py
index 7f2022a918..95e4f087ac 100644
--- a/core/relinker/relinker/tests/test_guest_module_dir.py
+++ b/core/relinker/relinker/tests/test_guest_module_dir.py
@@ -10,6 +10,7 @@ from test_guest_intel_trampolines import main_fixture, pe_sections
 from test_guest_module_directories import module_with_symbol, needed_libraries
 from test_guest_needed_modules import executable_with_needed, module_with_needed
 from test_macos_output import MachO
+from test_windows_import_modules import executable, provider
 
 
 def pe_export_names(data):
@@ -199,6 +200,21 @@ def main():
             else:
                 assert "$ORIGIN/app0/Media/Modules/needed.prx.guest.prx" in needed_libraries(output.read_bytes()), needed_libraries(output.read_bytes())
 
+            for directory, deferred in (("Media/Modules", True), ("sce_module", False)):
+                case = work / f"{windows}-imported-{deferred}"
+                (case / directory).mkdir(parents=True)
+                (case / directory / "needed.prx").write_bytes(provider(42))
+                result, output = convert(case, windows, ["--module-dir", directory] if deferred else [], executable("needed.prx"))
+                assert result.returncode == 0, (result.stdout, result.stderr)
+                line = f"Deferred module app0/{directory}/needed.prx.guest.prx: the executable imports from it, but it starts only when the title loads it\n"
+                if windows:
+                    assert (line.encode() in output.read_bytes()) == deferred, directory
+                    if os.name == "nt":
+                        run = subprocess.run([str(output)], capture_output=True, text=True, timeout=30)
+                        assert run.returncode == 42 and (line in run.stdout) == deferred, (directory, run.returncode, run.stdout, run.stderr)
+                else:
+                    assert f"$ORIGIN/app0/{directory}/needed.prx.guest.prx" in needed_libraries(output.read_bytes()), needed_libraries(output.read_bytes())
+
             case = work / f"{windows}-root"
             case.mkdir()
             (case / "root.prx").write_bytes(module_with_symbol(True))
diff --git a/core/relinker/relinker/tests/test_guest_module_identity.py b/core/relinker/relinker/tests/test_guest_module_identity.py
index 68e60adc56..ec440ea2f8 100644
--- a/core/relinker/relinker/tests/test_guest_module_identity.py
+++ b/core/relinker/relinker/tests/test_guest_module_identity.py
@@ -98,7 +98,7 @@ def main():
                     assert not artifact.exists(), artifact
                     assert len(list((output.parent / 'app0').rglob('*.guest.prx'))) == 1
                     if not windows:
-                        assert 'libGuest.suprx' in needed_libraries(output.read_bytes())
+                        assert 'libGuest.prx' in needed_libraries(output.read_bytes())
 
             result, output = convert(f'outside-ambiguous-{windows}', windows, 'libGuest.suprx', module_directory='.',
                 providers={'one.prx': declared_provider(22, ('libGuest',))},
@@ -187,7 +187,7 @@ def main():
                 if windows:
                     run(output, error='Failed to load module:')
                 else:
-                    assert request in needed_libraries(output.read_bytes())
+                    assert request.replace('.suprx', '.prx') in needed_libraries(output.read_bytes())
 
         providers = {'wrong.prx': declared_provider(11, ('other',)),
                      'right.prx': declared_provider(22, ('libGuest',))}
diff --git a/core/relinker/relinker/tests/test_guest_needed_modules.py b/core/relinker/relinker/tests/test_guest_needed_modules.py
index 6b2b18f2c8..6388feb414 100644
--- a/core/relinker/relinker/tests/test_guest_needed_modules.py
+++ b/core/relinker/relinker/tests/test_guest_needed_modules.py
@@ -186,7 +186,7 @@ def main():
             assert output.exists(), output
             assert not list((case / "app0").rglob("*.guest.prx"))
             if not windows:
-                assert needed_libraries(output.read_bytes()) == ["needed.debug_prx" if "debug-name" in case.name else "needed.prx"]
+                assert needed_libraries(output.read_bytes()) == ["needed.prx"]
 
             case = work / f"{windows}-ambiguous"
             for name in ("first", "second"):
diff --git a/core/relinker/relinker/tests/test_guest_needed_nested_modules.py b/core/relinker/relinker/tests/test_guest_needed_nested_modules.py
index 4b226cff99..7dac9fb615 100644
--- a/core/relinker/relinker/tests/test_guest_needed_nested_modules.py
+++ b/core/relinker/relinker/tests/test_guest_needed_nested_modules.py
@@ -62,7 +62,7 @@ def main():
                     assert output.is_file()
                     assert not list((output.parent / 'app0').rglob('*.guest.prx'))
                     if not windows:
-                        assert needed_libraries(output.read_bytes()) == ['libGuest.suprx']
+                        assert needed_libraries(output.read_bytes()) == ['libGuest.prx']
                     result, output = convert(f'{label}-{identity}-excluded', windows, 'libGuest.suprx', files, (filename,))
                     assert result.returncode == 2 and 'Excluded guest module file not found' in result.stderr, result.stderr
                     assert not output.exists()
diff --git a/core/relinker/relinker/tests/test_guest_none_relocations.py b/core/relinker/relinker/tests/test_guest_none_relocations.py
index 44d55ed646..9ebc28509d 100644
--- a/core/relinker/relinker/tests/test_guest_none_relocations.py
+++ b/core/relinker/relinker/tests/test_guest_none_relocations.py
@@ -76,6 +76,11 @@ def change_tag(image, tag, value=None, replacement=None):
     raise AssertionError(f"Missing dynamic tag {tag:#x}")
 
 
+def unsized_lifecycle(rela, sce, initial):
+    image = module(rela, sce=sce, lifecycle=True, initial=initial)
+    return change_tag(change_tag(image, 27, replacement=0x61000001), 28, replacement=0x61000001)
+
+
 def check_output(data, system, rela, plt, initial):
     expected_rela = [(entry[0], entry[1] & 0xffffffff, entry[2])
                      if (entry[1] & 0xffffffff) == 8 and entry[1] >> 32 else entry
@@ -123,6 +128,7 @@ def invalid_cases(sce):
     entry = 0x61000033 if sce else 9
     address = 0x6100002f if sce else 7
     plt_format = 0x6100002b if sce else 20
+    yield "lifecycle-without-address", change_tag(module([RELATIVE], sce=sce, lifecycle=True, initial=0), 25, replacement=0x61000001), "Incomplete guest lifecycle array"
     yield "partial-entry", change_tag(module([NOOP], sce=sce), size, 23), "Invalid relocation table size"
     yield "entry-size", change_tag(module([NOOP], sce=sce), entry, 16), "Invalid RELA entry size"
     yield "unmapped-table", change_tag(module([NOOP], sce=sce), address, 0xffffffffffffffff), ("SCE table exceeds" if sce else "Unmapped ELF address")
@@ -186,6 +192,15 @@ def main():
                             executed = subprocess.run([sys.executable, __file__, "--load", str(artifact)],
                                                       capture_output=True, text=True, timeout=10)
                             assert executed.returncode == 0, (executed.stdout, executed.stderr)
+            for name, rela, initial in (("unsized-lifecycle", [RELATIVE], UNCHANGED),
+                                        ("unsized-lifecycle-unread", [(TARGET, 0, FUNCTION)], FUNCTION)):
+                image = unsized_lifecycle(rela, sce, initial)
+                for system in ("linux", "windows", "macos"):
+                    result, artifact, output = convert(f"{sce}-{name}", system, image)
+                    assert result.returncode == 0, (sce, name, system, result.stdout, result.stderr)
+                    check_output(artifact.read_bytes(), system, rela, [], initial)
+                    if system == "linux":
+                        assert not {25, 26, 27, 28} & set(dynamic_tags(artifact.read_bytes())), name
             for name, image, error in invalid_cases(sce):
                 result, artifact, output = convert(f"{sce}-{name}", "linux", image)
                 assert result.returncode == 2 and error in result.stderr, (sce, name, result.stderr)
diff --git a/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py
new file mode 100644
index 0000000000..d7bd720160
--- /dev/null
+++ b/core/relinker/relinker/tests/test_guest_runtime_lifecycle.py
@@ -0,0 +1,57 @@
+from pathlib import Path
+import os
+import struct
+import subprocess
+import sys
+import tempfile
+
+from test_guest_module_args import args_module
+
+
+def lifecycle_module():
+    image = args_module()
+    tags = []
+    for offset in range(0x2000, 0x2300, 16):
+        tag, value = struct.unpack_from("<qQ", image, offset)
+        if tag == 0:
+            break
+        tags.append((tag, 72 if tag == 8 else value))
+    tags += [(13, 0x1080), (25, 0x2880), (27, 8), (26, 0x2888), (28, 8), (0, 0)]
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", image, 0x2000 + index * 16, *tag)
+    struct.pack_into("<QQ", image, 120 + 32, len(tags) * 16, len(tags) * 16)
+    struct.pack_into("<QQq", image, 0x2718, 0x2880, 8, 0x10c0)
+    struct.pack_into("<QQq", image, 0x2730, 0x2888, 8, 0x1100)
+    for address, marker in ((0x1080, 0xfe), (0x10c0, 0xa1), (0x1100, 0xf1)):
+        code = b"\x48\x83\xec\x08\xbf" + struct.pack("<I", marker) + b"\x31\xf6\xff\x15"
+        code += struct.pack("<i", 0x2820 - address - len(code) - 4)
+        code += b"\x48\x83\xc4\x08\xc3"
+        image[address:address + len(code)] = code
+    return image
+
+
+def main():
+    relinker, executable, libraries = map(lambda p: Path(p).resolve(), sys.argv[1:4])
+    with tempfile.TemporaryDirectory(prefix="anyps5-runtime-lifecycle-") as directory:
+        root = Path(directory)
+        plugins = root / "Media" / "Plugins"
+        plugins.mkdir(parents=True)
+        (plugins / "args.prx").write_bytes(lifecycle_module())
+        from test_guest_module_directories import module_with_symbol
+        bundled = root / "sce_module"
+        bundled.mkdir()
+        (bundled / "dummy.prx").write_bytes(module_with_symbol(False))
+        source = root / "main.elf"
+        from test_guest_intel_trampolines import main_fixture
+        source.write_bytes(main_fixture())
+        run = subprocess.run([str(relinker), "--skip-syscall-check", "--module-dir", "Media/Plugins", "--rpath", str(libraries), str(source), str(root / "app.elf")], capture_output=True, text=True, timeout=30)
+        assert run.returncode == 0, (run.stdout, run.stderr)
+        module = root / "app0/Media/Plugins/args.prx.guest.prx"
+        for mode in ("never-start", "start", "zero-start", "concurrent", "reentrant", "reload"):
+            run = subprocess.run([str(executable), "./" + module.name, mode], cwd=module.parent, env=os.environ, capture_output=True, text=True, timeout=10)
+            assert run.returncode == 0, (mode, run.returncode, run.stdout, run.stderr)
+    print("Runtime module initialization and finalization passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py b/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py
index f3054ee7bd..264c6a251e 100644
--- a/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py
+++ b/core/relinker/relinker/tests/test_guest_unused_import_dependencies.py
@@ -9,7 +9,7 @@ import tempfile
 from guest_import_fixtures import dynamic
 from test_guest_deferred_dependencies import page_aligned
 from test_guest_intel_trampolines import main_fixture
-from test_guest_module_args import args_module
+from test_guest_module_args import args_module, load_and_record
 from test_guest_module_directories import module_with_symbol, needed_libraries
 from test_guest_module_dir import pe_export_names
 from test_guest_needed_modules import module_with_needed
@@ -98,7 +98,8 @@ def main():
                     else:
                         assert run.returncode == 42, (kind, run.returncode, run.stdout, run.stderr)
                         recorded = events.read_text() if events.exists() else ''
-                        assert recorded.count('args=') == (1 if kind in ('referenced', 'weak-referenced', 'plt', 'needed') else 0), (kind, recorded)
+                        assert recorded.count('args=') == 0, (kind, recorded)
+                        load_and_record(case, libraries / 'libc.prx', case / provider)
                 cases += 1
             cycle = Path(directory) / f'{system}-cycle'
             (cycle / 'sce_module').mkdir(parents=True)
diff --git a/core/relinker/relinker/tests/test_guest_zero_initializer.py b/core/relinker/relinker/tests/test_guest_zero_initializer.py
index 7cc9a40ef7..8d8a5d14d0 100644
--- a/core/relinker/relinker/tests/test_guest_zero_initializer.py
+++ b/core/relinker/relinker/tests/test_guest_zero_initializer.py
@@ -8,10 +8,10 @@ import tempfile
 
 from guest_import_fixtures import executable
 from test_guest_intel_trampolines import main_fixture, pe_sections
-from test_guest_module_args import ARGP, ARGS, GETTER, RETURNED, SETTER, macho_binds
+from test_guest_module_args import ARGP, ARGS, GETTER, RETURNED, SETTER, load_and_record, macho_binds
 from test_guest_module_directories import needed_libraries
 from test_guest_module_dir import pe_export_names
-from test_guest_symbol_names import dynamic_tags, imported_symbols
+from test_guest_symbol_names import dynamic_tags, file_offset, imported_symbols, module_symbols
 
 PREINIT_SLOT = 0x2900
 SHARED = 0x100
@@ -85,6 +85,46 @@ def convert(relinker, work, preinit, options, base=0):
     return output, work / 'app0' / 'sce_module' / (name + '.guest.prx')
 
 
+def check_deferred_linux(relinker, work, host, preinit, has_init, native):
+    (work / 'sce_module').mkdir(parents=True)
+    plugins = work / 'plugins'
+    plugins.mkdir()
+    source = work / 'input.elf'
+    source.write_bytes(main_fixture())
+    image = zero_init_module(preinit)
+    if not has_init:
+        for position in range(0x2000, 0x2300, 16):
+            if struct.unpack_from('<q', image, position)[0] == 12:
+                struct.pack_into('<q', image, position, 21)
+                break
+        else:
+            raise AssertionError('Fixture has no DT_INIT tag to remove')
+    (plugins / 'zero.prx').write_bytes(image)
+    libraries = work / 'libs'
+    libraries.mkdir()
+    provider = libraries / 'libc.prx'
+    shutil.copyfile(host, provider)
+    shutil.copyfile(host, libraries / 'libkernel.prx')
+    result = subprocess.run([str(relinker), '--skip-syscall-check', '--module-dir', 'plugins',
+                             '--rpath', '$ORIGIN/libs', str(source), str(work / 'output.elf')],
+                            capture_output=True, text=True, timeout=30)
+    assert result.returncode == 0, (preinit, has_init, result.stdout, result.stderr)
+    converted = work / 'app0/plugins/zero.prx.guest.prx'
+    image = converted.read_bytes()
+    assert ('libkernel.prx' in needed_libraries(image)) == has_init, 'Deferred initializer dependency does not match DT_INIT presence'
+    tags = dynamic_tags(image)
+    assert tags.get(12, 0) == 0 and tags.get(25, 0) == 0, 'Deferred Linux module has an eager initializer'
+    index = module_symbols(image).index('__aps5_guest_lifecycle_nid_no_patch') + 1
+    table, = struct.unpack_from('<Q', image, file_offset(image, tags[6]) + index * 24 + 8)
+    relocations = [struct.unpack_from('<QQq', image, file_offset(image, tags[7]) + offset)
+                   for offset in range(0, tags[8], tags[9])]
+    init_relocations = [entry for entry in relocations if entry[0] == table + 16]
+    expected = [(table + 16, 8, 0)] if has_init else []
+    assert init_relocations == expected, (preinit, has_init, init_relocations, expected)
+    if native and has_init:
+        load_and_record(work, provider, converted)
+
+
 def main():
     if sys.argv[1] == '--load':
         import ctypes
@@ -138,6 +178,9 @@ def main():
                 assert run.returncode == 0, (preinit, run.returncode, run.stdout, run.stderr)
                 recorded = events.read_text()
                 assert f'args={ARGS:016x} argp={ARGP:016x}\nresult={RETURNED}\n' == recorded, (preinit, recorded)
+        for preinit, has_init in ((False, True), (True, True), (False, False)):
+            check_deferred_linux(relinker, work / f'linux-runtime-{preinit}-{has_init}',
+                                 host, preinit, has_init, linux)
         for index, options in enumerate(([], ['--macos'], ['--windows'])):
             convert(relinker, work / f'outside-{index}', False, options, 0x1000)
     print('Guest zero initializer tests passed' if linux else 'Guest zero initializer tests passed: native execution skipped')
diff --git a/core/relinker/relinker/tests/test_jmprel_table_bounds.py b/core/relinker/relinker/tests/test_jmprel_table_bounds.py
index 504e1f9109..ed7bb8f41e 100644
--- a/core/relinker/relinker/tests/test_jmprel_table_bounds.py
+++ b/core/relinker/relinker/tests/test_jmprel_table_bounds.py
@@ -124,6 +124,11 @@ def main():
                         "Symbol table entry out of bounds", target=output_target)
                     run(relinker, work, prefix + "-none", fixture(symbol_bytes=0, symbol_index=0xFFFFFFFF,
                                                                  relocation_type=0, **options), target=output_target)
+                else:
+                    run(relinker, work, prefix + "-unsupported-plt-type", fixture(relocation_type=6, **options),
+                        "Unsupported PLT relocation type", target=output_target)
+                    run(relinker, work, prefix + "-relative-in-plt", fixture(relocation_type=8, **options),
+                        "Unsupported PLT relocation type", target=output_target)
     print("Jump relocation table bounds tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_linux_eh_frame_header.py b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
index a80a1eb1ed..bb34e1e852 100644
--- a/core/relinker/relinker/tests/test_linux_eh_frame_header.py
+++ b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
@@ -131,19 +131,25 @@ def main():
             assert struct.unpack_from("<Q", elf, 0x20)[0] >= len(image), "The grown program header table must be moved past the input"
             assert elf[64 + 5 * 56:64 + 6 * 56] == image[64 + 5 * 56:64 + 6 * 56], "Bytes after the input program header table changed"
 
-        image = fixture(5, with_frame=False)
-        headers = image[64:64 + 4 * 56]
-        headers += struct.pack("<IIQQQQQQ", 4, 0, 0, 0, 0, 0, 0, 1) * 65530
-        struct.pack_into("<Q", image, 32, len(image))
-        struct.pack_into("<H", image, 56, 65534)
-        image += headers
-        source = Path(directory) / "overflowing-header-count.elf"
-        output = source.with_suffix(".out")
-        source.write_bytes(image)
-        result = subprocess.run([str(relinker), "--skip-sce-module", str(source), str(output)], capture_output=True, text=True, timeout=20)
-        assert result.returncode == 2, (result.returncode, result.stdout, result.stderr)
-        assert "Not enough program header slots: need 65537, available 65534" in result.stderr, result.stderr
-        assert not output.exists(), "An unrepresentable header count must not produce an executable"
+        for padding_count in (65527, 65528, 65530):
+            image = fixture(5, with_frame=False)
+            headers = image[64:64 + 4 * 56]
+            headers += struct.pack("<IIQQQQQQ", 4, 0, 0, 0, 0, 0, 0, 1) * padding_count
+            struct.pack_into("<Q", image, 32, len(image))
+            struct.pack_into("<H", image, 56, 4 + padding_count)
+            image += headers
+            source = Path(directory) / f"header-count-{padding_count}.elf"
+            output = source.with_suffix(".out")
+            source.write_bytes(image)
+            result = subprocess.run([str(relinker), "--skip-sce-module", str(source), str(output)], capture_output=True, text=True, timeout=20)
+            if padding_count == 65527:
+                assert result.returncode == 0, (result.returncode, result.stdout, result.stderr)
+                assert len(program_headers(output.read_bytes())) == 65534
+            else:
+                assert result.returncode == 2, (result.returncode, result.stdout, result.stderr)
+                assert "Extended program header counts are not supported" in result.stderr, result.stderr
+                assert not output.exists(), "An unsupported extended count must not produce an executable"
+            assert source.read_bytes() == image, "Source changed"
     print("Linux eh_frame header test passed")
 
 
diff --git a/core/relinker/relinker/tests/test_linux_fixed_base.py b/core/relinker/relinker/tests/test_linux_fixed_base.py
index ee31ad59ef..ce9f4118c5 100644
--- a/core/relinker/relinker/tests/test_linux_fixed_base.py
+++ b/core/relinker/relinker/tests/test_linux_fixed_base.py
@@ -186,7 +186,7 @@ def main():
         for name, image, base, error in (
             ("unaligned", fixture(alignment=0x20000), 0x410000, "is not a multiple of the PT_LOAD alignment 0x20000"),
             ("beyond-user-space", fixture(memory_size=0x100000), 0x7FFFFFFF0000, "outside the Linux user address space"),
-            ("unsupported-type", fixture(relocation_type=9), BASE, "Relocation type 9 cannot be placed at a fixed Linux base"),
+            ("unsupported-type", fixture(relocation_type=11), BASE, "Unsupported relocation type 0xb"),
             ("negative-target", fixture(addend=-16), BASE, "Relocation target -16 lies below the image at a fixed Linux base"),
         ):
             result, output = relink(relinker, work, name, image, "--linux-fixed-base", hex(base))
diff --git a/core/relinker/relinker/tests/test_linux_guest_named_imports.py b/core/relinker/relinker/tests/test_linux_guest_named_imports.py
new file mode 100644
index 0000000000..7f087e7343
--- /dev/null
+++ b/core/relinker/relinker/tests/test_linux_guest_named_imports.py
@@ -0,0 +1,128 @@
+import os
+from pathlib import Path
+import platform
+import shutil
+import struct
+import subprocess
+import sys
+import tempfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent / "macos"))
+
+from guest_import_fixtures import executable
+from nid import nid
+from test_guest_deferred_dependencies import page_aligned
+from test_guest_intel_trampolines import main_fixture
+from test_guest_module_directories import needed_libraries
+from test_guest_needed_modules import module_with_needed
+from test_guest_symbol_names import guest_module, imported_symbols, module_symbols, relink
+from test_linux_load_alignment import fixture
+from test_windows_import_modules import consumer
+
+PROVIDER = "int provided(void) __asm__(\"\\\"%s\\\"\");\nint provided(void) { return 22; }\n"
+
+
+def guest_with_needed(symbols, needed):
+    image = guest_module(symbols)
+    size, = struct.unpack_from("<Q", image, 0x618)
+    name = needed.encode() + b"\0"
+    assert size + len(name) <= 0x40
+    image[0x800 + size:0x800 + size + len(name)] = name
+    struct.pack_into("<Q", image, 0x618, size + len(name))
+    struct.pack_into("<qQqQ", image, 0x680, 1, size, 0, 0)
+    struct.pack_into("<QQ", image, 176 + 32, 10 * 16, 10 * 16)
+    return image
+
+
+def exporting_executable(name, info=0x12, other=0):
+    image = fixture()
+    strings = b"\0" + name.encode() + b"\0"
+    image[0x4600:0x4600 + len(strings)] = strings
+    image[0x4210:0x4216] = bytes.fromhex("b82a000000c3")
+    struct.pack_into("<IBBHQQ", image, 0x4900, 0, 0, 0, 0, 0, 0)
+    struct.pack_into("<IBBHQQ", image, 0x4918, 1, info, other, 1, 0x210, 6)
+    tags = [(5, 0x600), (10, len(strings)), (6, 0x900), (11, 24), (7, 0x700), (8, 0), (9, 24), (0x6100003f, 48), (0, 0)]
+    struct.pack_into("<IIQQQQQQ", image, 120, 2, 6, 0x4800, 0x800, 0x800, len(tags) * 16, len(tags) * 16, 8)
+    for index, tag in enumerate(tags):
+        struct.pack_into("<qQ", image, 0x4800 + index * 16, *tag)
+    return image
+
+
+def provider(work, name, symbol):
+    source = work / (name + ".c")
+    source.write_text(PROVIDER % symbol)
+    library = work / (name + ".so")
+    subprocess.run([os.environ.get("CC", "cc"), "-shared", "-fPIC", str(source), "-o", str(library)], check=True)
+    return library
+
+
+def run_consumer(relinker, host, case, library):
+    (case / "sce_module").mkdir(parents=True)
+    (case / "sce_module" / "consumer.prx").write_bytes(page_aligned(consumer("available.sprx", symbol="shared")))
+    image = main_fixture()
+    code = bytes.fromhex("b83c000000bf2a0000000f05")
+    image[0x4000:0x4000 + len(code)] = code
+    source = case / "input.elf"
+    source.write_bytes(image)
+    output = case / "output.elf"
+    result = subprocess.run([str(relinker), "--skip-syscall-check", str(source), str(output)],
+                            capture_output=True, text=True, timeout=30)
+    assert result.returncode == 0, (result.stdout, result.stderr)
+    module = case / "app0" / "sce_module" / "consumer.prx.guest.prx"
+    assert "available.prx" in needed_libraries(module.read_bytes()), needed_libraries(module.read_bytes())
+    assert nid("shared") in module_symbols(module.read_bytes()), module_symbols(module.read_bytes())
+    libraries = case / "libs"
+    libraries.mkdir()
+    for name in ("libc.prx", "libkernel.prx"):
+        shutil.copyfile(host, libraries / name)
+    shutil.copyfile(library, libraries / "available.prx")
+    output.chmod(0o755)
+    return subprocess.run([str(output)], capture_output=True, text=True, timeout=30,
+                          env={**os.environ, "ANYPS5_GUEST_MODULE_ARGS": str(case / "events.txt")})
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    host = Path(sys.argv[2]).resolve()
+    runnable = sys.platform.startswith("linux") and platform.machine() in ("x86_64", "AMD64")
+    with tempfile.TemporaryDirectory(prefix="anyps5-linux-guest-named-imports-") as directory:
+        work = Path(directory)
+
+        guest = relink(relinker, work / "guest", executable("libkernel_web.sprx", "shared"), {
+            "user.sprx": guest_with_needed([("shared", True), ("BBBBBBBBBBB", False), ("CCCCCCCCCCC#C#C", False)], "libkernel_web.sprx"),
+            "plain.prx": guest_module([("DDDDDDDDDDD", False)]),
+        })
+        assert imported_symbols(guest.read_bytes()) == {"shared#guest"}, imported_symbols(guest.read_bytes())
+        modules = guest.parent / "app0" / "sce_module"
+        symbols = module_symbols((modules / "user.sprx.guest.prx").read_bytes())
+        assert symbols == ["shared#guest", nid("BBBBBBBBBBB"), "CCCCCCCCCCC"], symbols
+        symbols = module_symbols((modules / "plain.prx.guest.prx").read_bytes())
+        assert symbols == ["DDDDDDDDDDD"], symbols
+
+        dependencies = relink(relinker, work / "dependencies", executable("available.prx"), {
+            "user.prx": module_with_needed((b"libSceLibcInternal.sprx", b"libkernel_web.sprx"), (0, 1)),
+        })
+        needed = needed_libraries(dependencies.read_bytes())
+        assert needed == ["$ORIGIN/app0/sce_module/user.prx.guest.prx", "available.prx", "libSceLibcInternal.prx", "libkernel_web.prx", "libc.prx"], needed
+        needed = needed_libraries((dependencies.parent / "app0" / "sce_module" / "user.prx.guest.prx").read_bytes())
+        assert needed == ["libSceLibcInternal.prx", "libkernel_web.prx", "libc.prx"], needed
+
+        for label, info, other, kept in (("global", 0x12, 0, True), ("weak", 0x22, 0, True), ("protected", 0x12, 3, True),
+                                         ("internal", 0x12, 1, False), ("hidden", 0x12, 2, False), ("local", 0x02, 0, False)):
+            exported = relink(relinker, work / ("executable-" + label), exporting_executable("FixtureExport#A#B", info, other), {
+                "user.prx": guest_with_needed([("FixtureExport", False), ("BBBBBBBBBBB", False)], "libkernel_web.sprx"),
+            })
+            symbols = module_symbols((exported.parent / "app0" / "sce_module" / "user.prx.guest.prx").read_bytes())
+            expected = "FixtureExport" if kept else nid("FixtureExport")
+            assert symbols == [expected, nid("BBBBBBBBBBB")], (label, symbols)
+
+        if runnable:
+            result = run_consumer(relinker, host, work / "by-nid", provider(work, "by-nid", nid("shared")))
+            assert result.returncode == 42, (result.returncode, result.stdout, result.stderr)
+            result = run_consumer(relinker, host, work / "by-name", provider(work, "by-name", "shared"))
+            assert result.returncode != 0 and nid("shared") in result.stderr, (result.returncode, result.stdout, result.stderr)
+    print("Linux guest named import tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_linux_named_imports.py b/core/relinker/relinker/tests/test_linux_named_imports.py
new file mode 100644
index 0000000000..ca23674315
--- /dev/null
+++ b/core/relinker/relinker/tests/test_linux_named_imports.py
@@ -0,0 +1,84 @@
+import os
+from pathlib import Path
+import platform
+import subprocess
+import sys
+import tempfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent / "macos"))
+
+from guest_import_fixtures import executable
+from nid import nid
+from test_guest_module_directories import module_with_symbol, needed_libraries
+from test_guest_symbol_names import imported_symbols
+
+
+def library(work, name, symbol, value):
+    source = work / (name + ".c")
+    source.write_text("#include <unistd.h>\n"
+                      f"int exported(void) __asm__(\"\\\"{symbol}\\\"\");\n"
+                      f"int exported(void) {{ _exit({value}); }}\n")
+    output = work / (name + ".so")
+    subprocess.run([os.environ.get("CC", "cc"), "-shared", "-fPIC", str(source), "-o", str(output)], check=True)
+    return output.read_bytes()
+
+
+def convert(relinker, case, image, module=None):
+    case.mkdir()
+    if module is not None:
+        (case / "sce_module").mkdir()
+        (case / "sce_module" / "bundled.prx").write_bytes(module)
+    source = case / "input.elf"
+    source.write_bytes(image)
+    output = case / "output.elf"
+    options = [] if module is not None else ["--skip-sce-module"]
+    result = subprocess.run([str(relinker), *options, str(source), str(output)], capture_output=True, text=True, timeout=30)
+    assert result.returncode == 0, (case.name, result.stdout, result.stderr)
+    return output
+
+
+def run(output, library):
+    (output.parent / "libs").mkdir()
+    (output.parent / "libs" / "available.prx").write_bytes(library)
+    output.chmod(0o755)
+    return subprocess.run([str(output)], capture_output=True, text=True, timeout=30)
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    runnable = sys.platform.startswith("linux") and platform.machine() in ("x86_64", "AMD64")
+    with tempfile.TemporaryDirectory(prefix="anyps5-linux-named-imports-") as directory:
+        work = Path(directory)
+        cases = {
+            "sprx": convert(relinker, work / "sprx", executable("available.sprx", "shared")),
+            "prx": convert(relinker, work / "prx", executable("available.prx", "shared")),
+            "qualified": convert(relinker, work / "qualified", executable("available.sprx", "shared#A#B")),
+            "name": convert(relinker, work / "name", executable("available.sprx", "shared")),
+            "guest": convert(relinker, work / "guest", executable("bundled.prx", "shared", extra_dependencies=("available.sprx",)),
+                             module_with_symbol(True)),
+        }
+        image = cases["sprx"].read_bytes()
+        assert imported_symbols(image) == {nid("shared")}, imported_symbols(image)
+        assert needed_libraries(image) == ["available.prx"], needed_libraries(image)
+        assert imported_symbols(cases["prx"].read_bytes()) == {"shared"}
+        assert imported_symbols(cases["qualified"].read_bytes()) == {"shared"}
+        image = cases["guest"].read_bytes()
+        assert imported_symbols(image) == {"shared#guest"}, imported_symbols(image)
+        assert "available.prx" in needed_libraries(image), needed_libraries(image)
+        if not runnable:
+            return
+        by_nid = library(work, "by-nid", nid("shared"), 22)
+        by_name = library(work, "by-name", "shared", 44)
+        result = run(cases["sprx"], by_nid)
+        assert result.returncode == 22, (result.returncode, result.stdout, result.stderr)
+        result = run(cases["prx"], by_name)
+        assert result.returncode == 44, (result.returncode, result.stdout, result.stderr)
+        result = run(cases["qualified"], by_nid)
+        assert result.returncode != 0 and "undefined symbol: shared" in result.stderr, (result.returncode, result.stderr)
+        result = run(cases["name"], by_name)
+        assert result.returncode != 0 and f"undefined symbol: {nid('shared')}" in result.stderr, (result.returncode, result.stderr)
+    print("Linux named import tests passed")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_macos_gs_traps.py b/core/relinker/relinker/tests/test_macos_gs_traps.py
index de0426bc5f..bdafa42de8 100644
--- a/core/relinker/relinker/tests/test_macos_gs_traps.py
+++ b/core/relinker/relinker/tests/test_macos_gs_traps.py
@@ -54,6 +54,15 @@ def check_trapped(name, code, instruction):
         raise SystemExit(f"{name}: the GS access was left in the code")
 
 
+def check_refused(relinker, directory, name, body, message):
+    source = Path(directory) / f"{name}.elf"
+    source.write_bytes(bytes(make_image("register", "unwind", body=body)))
+    result = subprocess.run([str(relinker), "--macos", "--skip-sce-module", str(source), str(Path(directory) / name)],
+                            capture_output=True, text=True, timeout=60)
+    if result.returncode == 0 or message not in result.stdout + result.stderr:
+        raise SystemExit(f"{name}: expected the relinker to refuse with {message!r}: {result.stdout}{result.stderr}")
+
+
 def check_untouched(name, code, instruction):
     if instruction + b"\xc3" not in code:
         raise SystemExit(f"{name}: a non-memory GS instruction was replaced")
@@ -72,6 +81,8 @@ def main():
         image = make_image("register", "unwind", body=instruction + b"\xc3")
         struct.pack_into("<I", image, 176, 0)
         check_trapped("gs-without-pt-tls", convert(relinker, directory, "gs-without-pt-tls", image), instruction)
+        check_refused(relinker, directory, "branch-into-gs", bytes.fromhex("74 01 65 48 8b 0c 25 78 03 00 00 c3"),
+                      "Branch enters a guest GS instruction")
     print("macOS GS trap checks passed")
 
 
diff --git a/core/relinker/relinker/tests/test_macos_output.py b/core/relinker/relinker/tests/test_macos_output.py
index 694ed2e2eb..fd9407a851 100644
--- a/core/relinker/relinker/tests/test_macos_output.py
+++ b/core/relinker/relinker/tests/test_macos_output.py
@@ -114,8 +114,26 @@ def check_structure(name, data):
     return macho
 
 
+def check_main_entry_mxcsr(macho, data):
+    stub = data[macho.entryoff:]
+    setup = bytes.fromhex("4883ec100fae1c24c7442404c09f00000fae542404")
+    call = stub.find(bytes.fromhex("ff15"))
+    check(call >= len(setup), "entry stub does not initialize guest MXCSR before its start call")
+    check(stub[call - len(setup):call] == setup, "entry stub does not save host MXCSR and load guest MXCSR 0x9fc0")
+    entry = stub.find(bytes.fromhex("488d3d"))
+    entry_target = IMAGE_BASE + macho.entryoff + entry + 7 + struct.unpack_from("<i", stub, entry + 3)[0]
+    check(any(segment["initprot"] & PROT_EXEC and segment["vmaddr"] <= entry_target < segment["vmaddr"] + segment["vmsize"] for segment in macho.segments),
+          "entry stub does not point at executable guest code")
+    start_target = IMAGE_BASE + macho.entryoff + call + 6 + struct.unpack_from("<i", stub, call + 2)[0]
+    meta_segment = macho.segment("__APS5DATA")
+    check(meta_segment["vmaddr"] <= start_target < meta_segment["vmaddr"] + meta_segment["vmsize"], "entry stub start call does not point at its bound start slot")
+    restore = bytes.fromhex("0fae14244883c4100f0b")
+    check(stub[call + 6:call + 6 + len(restore)] == restore, "entry stub does not restore host MXCSR after the guest start call")
+
+
 def check_imports(data):
     macho = check_structure("import", data)
+    check_main_entry_mxcsr(macho, data)
     check("@rpath/libc.prx" in macho.dylibs, f"import: libc.prx is not a dependency: {macho.dylibs}")
     linkedit = macho.segment("__LINKEDIT")
     binds = data[linkedit["fileoff"]:linkedit["fileoff"] + linkedit["filesize"]]
diff --git a/core/relinker/relinker/tests/test_none_relocations.py b/core/relinker/relinker/tests/test_none_relocations.py
index ca10af8fd0..d541f0a9c5 100644
--- a/core/relinker/relinker/tests/test_none_relocations.py
+++ b/core/relinker/relinker/tests/test_none_relocations.py
@@ -127,16 +127,39 @@ def main():
         assert overflow_result.returncode == 2 and "Relocation target address overflow" in overflow_result.stderr, overflow_result.stderr
         assert not overflow_output.exists()
         page_image = image_with_relocations([(0xffc, 8, 0x210)], False, False)
+        page_image[0x200:0x206] = b"\xff\x25" + struct.pack("<i", 0xffc - 0x206)
         page_image.extend(bytes(0x1000))
         struct.pack_into("<QQ", page_image, 64 + 32, len(page_image), len(page_image))
-        page_source = work / "invalid-base-relocation-page-crossing.elf"
+        page_source = work / "base-relocation-page-crossing.elf"
         page_source.write_bytes(page_image)
-        page_output = work / "invalid-base-relocation-page-crossing.exe"
+        page_output = work / "base-relocation-page-crossing.exe"
         page_result = subprocess.run([str(relinker), "--skip-sce-module", "--windows",
                                       str(page_source), str(page_output)],
                                      capture_output=True, text=True, timeout=20)
-        assert page_result.returncode == 2 and "Base relocation target crosses a page boundary" in page_result.stderr, page_result.stderr
-        assert not page_output.exists()
+        assert page_result.returncode == 0 and page_output.read_bytes().startswith(b"MZ"), page_result.stderr
+        if os.name == "nt":
+            run = subprocess.run([str(page_output)], capture_output=True, timeout=20)
+            assert run.returncode == 42, ("page-crossing relocation", run.returncode, run.stderr)
+            moved = bytearray(page_output.read_bytes())
+            optional_header = struct.unpack_from("<I", moved, 0x3c)[0] + 24
+            characteristics = struct.unpack_from("<H", moved, optional_header + 70)[0]
+            struct.pack_into("<H", moved, optional_header + 70, characteristics | 0x40)
+            moved_output = work / "base-relocation-page-crossing-moved.exe"
+            moved_output.write_bytes(moved)
+            for _ in range(3):
+                run = subprocess.run([str(moved_output)], capture_output=True, timeout=20)
+                assert run.returncode == 42, ("page-crossing relocation after the loader moved the image", run.returncode, run.stderr)
+        past_end_image = image_with_relocations([(0x1ffc, 8, 0x210)], False, False)
+        past_end_image.extend(bytes(0x1000))
+        struct.pack_into("<QQ", past_end_image, 64 + 32, len(past_end_image), len(past_end_image))
+        past_end_source = work / "invalid-base-relocation-past-end.elf"
+        past_end_source.write_bytes(past_end_image)
+        past_end_output = work / "invalid-base-relocation-past-end.exe"
+        past_end_result = subprocess.run([str(relinker), "--skip-sce-module", "--windows",
+                                          str(past_end_source), str(past_end_output)],
+                                         capture_output=True, text=True, timeout=20)
+        assert past_end_result.returncode == 2 and "ELF address is not contained in PT_LOAD memory" in past_end_result.stderr, past_end_result.stderr
+        assert not past_end_output.exists()
     print("No-op executable relocation tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_output_collisions.py b/core/relinker/relinker/tests/test_output_collisions.py
index 4213674c46..0361c30544 100644
--- a/core/relinker/relinker/tests/test_output_collisions.py
+++ b/core/relinker/relinker/tests/test_output_collisions.py
@@ -50,6 +50,93 @@ def case_sensitive(directory):
     return sensitive
 
 
+def metadata_case(case, windows):
+    command, outputs, inputs = prepare(case, windows)
+    metadata = case / "sce_sys"
+    metadata.mkdir(exist_ok=True)
+    icon = metadata / "icon0.png"
+    param = metadata / "param.json"
+    icon.write_bytes(png(1, 1))
+    param.write_text(json.dumps({"titleId": "PPSA00000", "defaultLanguage": "en-US",
+                                "localizedParameters": {"en-US": {"titleName": "Sample Title"}}}), encoding="utf-8")
+    for path in outputs.values():
+        path.write_bytes(b"previous output")
+    inputs.update({icon: icon.read_bytes(), param: param.read_bytes()})
+    return command, outputs, inputs
+
+
+def tree_snapshot(root):
+    return {path.relative_to(root): ("link", os.readlink(path)) if path.is_symlink()
+            else ("directory", None) if path.is_dir() else ("file", path.read_bytes())
+            for path in root.rglob("*")}
+
+
+def metadata_inputs(relinker, work):
+    checked = 0
+
+    def rejected(case, command):
+        before = tree_snapshot(case)
+        result = subprocess.run([str(relinker), *command], cwd=case,
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        assert result.returncode == 2 and "output would overwrite input metadata" in result.stderr, (
+            case.name, result.returncode, result.stdout, result.stderr)
+        assert tree_snapshot(case) == before, case
+
+    for windows in (False, True):
+        for name in (("icon0.png",) if windows else ("icon0.png", "param.json")):
+            case = work / f"metadata-direct-{windows}-{name}"
+            command, _, _ = metadata_case(case, windows)
+            rejected(case, [*command[:-1], str(case / "sce_sys" / name)])
+            checked += 1
+            outputs = ("executable", "module", "registry", "module-registry", "needed", "module-needed")
+            outputs += ("diagnostics",) if windows else ("icon", "desktop")
+            for alias in ("hardlink", "symlink"):
+                for output in outputs:
+                    case = work / f"metadata-{windows}-{name}-{alias}-{output}"
+                    command, paths, _ = metadata_case(case, windows)
+                    destination = paths[output]
+                    destination.unlink()
+                    metadata = case / "sce_sys" / name
+                    if alias == "hardlink":
+                        os.link(metadata, destination)
+                    else:
+                        try:
+                            destination.symlink_to(metadata)
+                        except (OSError, NotImplementedError) as error:
+                            print(f"Metadata symlink case skipped: {error}")
+                            continue
+                    rejected(case, command)
+                    checked += 1
+        case = work / f"metadata-distinct-{windows}"
+        command, paths, inputs = metadata_case(case, windows)
+        result = subprocess.run([str(relinker), *command], cwd=case,
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        assert result.returncode == 0, (result.stdout, result.stderr)
+        for path, original in inputs.items():
+            assert path.read_bytes() == original, path
+        assert paths["executable"].read_bytes().startswith(b"MZ" if windows else b"\x7fELF")
+
+    for format, name in (("windows", "param.json"), ("macos", "icon0.png"), ("linux-no-icon", "param.json")):
+        case = work / f"metadata-unused-{format}"
+        command, _, inputs = metadata_case(case, format == "windows")
+        if format == "macos":
+            command.insert(0, "--macos")
+        if format == "linux-no-icon":
+            icon = case / "sce_sys/icon0.png"
+            icon.unlink()
+            inputs.pop(icon)
+        output = case / "sce_sys" / name
+        result = subprocess.run([str(relinker), *command[:-1], str(output)], cwd=case,
+                                capture_output=True, text=True, encoding="utf-8", timeout=20)
+        assert result.returncode == 0, (format, result.stdout, result.stderr)
+        magic = b"MZ" if format == "windows" else b"\xcf\xfa\xed\xfe" if format == "macos" else b"\x7fELF"
+        assert output.read_bytes().startswith(magic), output
+        for path, original in inputs.items():
+            if path != output:
+                assert path.read_bytes() == original, path
+    return checked
+
+
 def filesystem_aliases(relinker, work):
     if os.name == "nt":
         return
@@ -91,6 +178,7 @@ def main():
     checked = 0
     with tempfile.TemporaryDirectory(prefix="anyps5-output-collisions-") as directory:
         work = Path(directory)
+        metadata_checked = metadata_inputs(relinker, work)
         filesystem_aliases(relinker, work)
         for windows, existing in itertools.product((False, True), repeat=2):
             case = work / f"needed-secondary-{windows}-{existing}"
@@ -213,7 +301,7 @@ def main():
                 assert not list(case.rglob(".anyps5-output-identity-*"))
             finally:
                 output.chmod(stat.S_IWRITE)
-    print(f"Output collision tests passed: {checked} hard-link pairs, direct paths, and identity controls")
+    print(f"Output collision tests passed: {checked} hard-link pairs, {metadata_checked} metadata protections, direct paths, and identity controls")
 
 
 if __name__ == "__main__":
diff --git a/core/relinker/relinker/tests/test_patch_advisor.py b/core/relinker/relinker/tests/test_patch_advisor.py
new file mode 100644
index 0000000000..bed41997bd
--- /dev/null
+++ b/core/relinker/relinker/tests/test_patch_advisor.py
@@ -0,0 +1,56 @@
+import hashlib
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+
+from test_game_patches import patch_site, patch_text
+from test_guest_intel_trampolines import main_fixture
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    advisor = Path(__file__).resolve().parents[4] / "tools" / "suggest_patches.py"
+    image = bytes(main_fixture())
+    address, expected = patch_site(image)
+    with tempfile.TemporaryDirectory(prefix="anyps5-patch-advisor-") as directory:
+        root = Path(directory)
+        source = root / "eboot.bin"
+        source.write_bytes(image)
+        catalog = root / "catalog"
+        catalog.mkdir()
+        patch = catalog / "patch.toml"
+        patch.write_text(patch_text(address, expected, "flip_bit"))
+        metadata = root / "param.json"
+        metadata.write_text(json.dumps({"titleId": "TEST00001", "contentVersion": "01.000.000"}))
+
+        def advise(digest, patches=("patch.toml",)):
+            (catalog / "index.json").write_text(json.dumps({"format": 1, "entries": [{
+                "titleId": "TEST00001", "contentVersion": "01.000.000", "patch": name,
+                "targets": {"eboot.bin": digest}
+            } for name in patches]}))
+            return subprocess.run([sys.executable, str(advisor), "--catalog", str(catalog),
+                                   "--param-json", str(metadata), "--input", str(source),
+                                   "--relinker", f"./{relinker.name}", "--skip-sce-module"],
+                                  cwd=relinker.parent, capture_output=True, text=True, timeout=30)
+
+        result = advise(hashlib.sha256(image).hexdigest())
+        assert result.returncode == 0 and f"Recommended: {patch}" in result.stdout, (result.stdout, result.stderr)
+        broken = catalog / "broken.toml"
+        broken.write_text(patch_text(address, expected, "broken").replace('description = "flip one bit"',
+                                                                     r'description = "flip \"one\" bit"'))
+        result = advise(hashlib.sha256(image).hexdigest(), ("broken.toml", "patch.toml"))
+        assert result.returncode == 0 and "relinker error (exit 2)" in result.stdout and f"Recommended: {patch}" in result.stdout, (result.stdout, result.stderr)
+        result = advise(hashlib.sha256(image).hexdigest(), ("broken.toml",))
+        assert result.returncode == 2 and "relinker error (exit 2)" in result.stdout, (result.stdout, result.stderr)
+        patch.write_text(patch_text(address, expected ^ 1, "wrong_byte"))
+        result = advise(hashlib.sha256(image).hexdigest())
+        assert result.returncode == 1 and "rejected by relinker" in result.stdout, (result.stdout, result.stderr)
+        patch.write_text(patch_text(address, expected, "flip_bit"))
+        result = advise(hashlib.sha256(b"other build").hexdigest())
+        assert result.returncode == 1 and "SHA-256 mismatch" in result.stdout, (result.stdout, result.stderr)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 8325f6bac5..4687c088bf 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -58,6 +58,7 @@ def alu_check_body(opcode, register, base, value, result, flags_masked):
         emit(bytes.fromhex("0f 85 00 00 00 00"))
         jumps.append(len(code) - 4)
 
+    emit(b"\x53")
     emit(bytes.fromhex("64 c7 04 25 28 00 00 00") + struct.pack("<I", value & 0xffffffff))
     for target in (0, 1, 3):
         move_immediate(target, base)
@@ -74,8 +75,8 @@ def alu_check_body(opcode, register, base, value, result, flags_masked):
         fail_unless_equal()
     emit(bytes.fromhex("83 fa") + bytes([flags_masked]))
     fail_unless_equal()
-    emit(bytes.fromhex("b8 2a 00 00 00 c3 b8 01 00 00 00 c3"))
-    failure = len(code) - 6
+    emit(bytes.fromhex("b8 2a 00 00 00 5b c3 b8 01 00 00 00 5b c3"))
+    failure = len(code) - 7
     for position in jumps:
         struct.pack_into("<i", code, position, failure - position - 4)
     return bytes(code)
@@ -702,7 +703,7 @@ def main():
                         assert expected in stub, (case, expected.hex(), stub.hex())
         if args.group in ("all", "alu_execution"):
             for name, image in alu_execution_cases():
-                convert(name, image)
+                convert(name, image, tls_address=0x1241)
         if args.group in ("all", "register_address_loads"):
             for name, image, address, instruction, register, wide, moved in register_load_cases():
                 convert(name, image, tls_address=address)
@@ -719,14 +720,14 @@ def main():
                 head, tail = register_alu_stub(instruction, opcode, register, wide)
                 assert stub.startswith(head) and tail + moved in stub, (name, head.hex(), (tail + moved).hex(), stub.hex())
         if args.group in ("all", "moved_branch"):
-            prologue = bytes.fromhex("48 c7 c3 f0 ff ff ff 48 31 c0")
-            rel8_body = prologue + bytes.fromhex("64 48 33 03 75 06 31 c0 c3 90 90 90 b8 2a 00 00 00 c3")
-            rel32_body = prologue + bytes.fromhex("64 48 33 03 0f 85") + struct.pack("<i", 0x1259 - 0x1254) + bytes.fromhex("31 c0 c3 90 90 b8 2a 00 00 00 c3")
-            jmp_body = prologue + bytes.fromhex("64 48 33 03 eb 06 b8 01 00 00 00 c3 90 b8 2a 00 00 00 c3")
+            prologue = bytes.fromhex("53 48 c7 c3 f0 ff ff ff 48 31 c0")
+            rel8_body = prologue + bytes.fromhex("64 48 33 03 75 07 31 c0 5b c3 90 90 90 b8 2a 00 00 00 5b c3")
+            rel32_body = prologue + bytes.fromhex("64 48 33 03 0f 85") + struct.pack("<i", 0x125B - 0x1255) + bytes.fromhex("31 c0 5b c3 90 90 b8 2a 00 00 00 5b c3")
+            jmp_body = prologue + bytes.fromhex("64 48 33 03 eb 07 b8 01 00 00 00 5b c3 90 b8 2a 00 00 00 5b c3")
             for name, body, access, target, branch_opcode in (
-                ("moved-rel8-branch", rel8_body, 0x124A, 0x1256, "0f 85"),
-                ("moved-rel32-branch", rel32_body, 0x124A, 0x1259, "0f 85"),
-                ("moved-rel8-jump", jmp_body, 0x124A, 0x1256, "e9"),
+                ("moved-rel8-branch", rel8_body, 0x124B, 0x1258, "0f 85"),
+                ("moved-rel32-branch", rel32_body, 0x124B, 0x125B, "0f 85"),
+                ("moved-rel8-jump", jmp_body, 0x124B, 0x1258, "e9"),
             ):
                 image = make_image("register", "unwind", body=body)
                 convert(name, image, tls_address=access)
diff --git a/core/relinker/relinker/tests/test_to_rosetta.py b/core/relinker/relinker/tests/test_to_rosetta.py
index 72bc4640d8..ed0740868e 100644
--- a/core/relinker/relinker/tests/test_to_rosetta.py
+++ b/core/relinker/relinker/tests/test_to_rosetta.py
@@ -12,8 +12,10 @@ RDSEED = bytes.fromhex("0fc7f8")
 RDRAND = bytes.fromhex("0fc7f0")
 CLWB = bytes.fromhex("660fae37")
 NOP4 = bytes.fromhex("0f1f4000")
-SITES = RDSEED + CLWB + b"\xc3"
-LOWERED = RDRAND + NOP4 + b"\xc3"
+XSAVEOPT = bytes.fromhex("480fae37")
+XSAVE = bytes.fromhex("480fae27")
+SITES = RDSEED + CLWB + XSAVEOPT + b"\xc3"
+LOWERED = RDRAND + NOP4 + XSAVE + b"\xc3"
 
 
 def executable(code=SITES):
@@ -38,18 +40,18 @@ def main():
             result, output = relink(relinker, directory, "keep" + "".join(options), *options)
             assert result.returncode == 0, (options, result.stdout, result.stderr)
             data = output.read_bytes()
-            assert SITES in data and LOWERED not in data, f"{options or 'a plain relink'} changed RDSEED or CLWB"
+            assert SITES in data and LOWERED not in data, f"{options or 'a plain relink'} changed RDSEED, CLWB or XSAVEOPT"
         for options in (("--to-rosetta",), ("--to-rosetta", "--to-intel")):
             result, output = relink(relinker, directory, "lower" + "".join(options), *options)
             assert result.returncode == 0, (options, result.stdout, result.stderr)
             data = output.read_bytes()
-            assert LOWERED in data and SITES not in data, f"{options} did not lower RDSEED and CLWB"
+            assert LOWERED in data and SITES not in data, f"{options} did not lower RDSEED, CLWB and XSAVEOPT"
         for options, lowered in ((("--macos",), False), (("--macos", "--to-intel"), False), (("--macos", "--to-rosetta"), True)):
             result, output = relink(relinker, directory, "macos" + "".join(options), *options)
             assert result.returncode == 0, (options, result.stdout, result.stderr)
             data = output.read_bytes()
             assert data[:4] == bytes.fromhex("cffaedfe"), f"{options} did not write a Mach-O"
-            assert (LOWERED in data and SITES not in data) if lowered else (SITES in data and LOWERED not in data), f"{options} {'did not lower' if lowered else 'changed'} RDSEED and CLWB"
+            assert (LOWERED in data and SITES not in data) if lowered else (SITES in data and LOWERED not in data), f"{options} {'did not lower' if lowered else 'changed'} RDSEED, CLWB and XSAVEOPT"
         result, _ = relink(relinker, directory, "windows", "--to-rosetta", "--windows")
         assert result.returncode != 0 and "--to-rosetta conflicts with --windows" in result.stdout + result.stderr, "--to-rosetta together with --windows was accepted"
         andn = bytes.fromhex("c4e2f0f2c6c3")
@@ -62,6 +64,16 @@ def main():
                 assert (andn not in output.read_bytes()) == lowered, f"{options} {'did not lower' if lowered else 'changed'} ANDN"
                 if lowered:
                     assert "ANDN" in result.stdout, result.stdout
+        masked = bytes.fromhex("c4e2752e07c3")
+        for target in ((), ("--macos",)):
+            for conversion in ((), ("--to-intel",), ("--to-rosetta",)):
+                options = target + conversion
+                result, output = relink(relinker, directory, "masked" + "".join(options), *options, code=masked)
+                assert result.returncode == 0, (options, result.stdout, result.stderr)
+                lowered = conversion == ("--to-rosetta",)
+                assert (masked not in output.read_bytes()) == lowered, f"{options} {'did not lower' if lowered else 'changed'} VMASKMOVPS"
+                if lowered:
+                    assert "VMASKMOVPS" in result.stdout, result.stdout
     print("--to-rosetta integration tests passed")
 
 
diff --git a/core/relinker/relinker/tests/test_unused_filter_indirect.py b/core/relinker/relinker/tests/test_unused_filter_indirect.py
index eda91aa3a0..7b0197ee6e 100644
--- a/core/relinker/relinker/tests/test_unused_filter_indirect.py
+++ b/core/relinker/relinker/tests/test_unused_filter_indirect.py
@@ -113,6 +113,9 @@ def cases():
     yield "got-slot-address-size", True, build(
         at_offset([(0, b"\x67\x48\x8d\x05" + struct.pack("<i", -2056) + b"\xc3")]),
         code_vaddr=0x100001000)
+    yield "got-slot-address-size-underflow", True, build(
+        at_offset([(0, b"\x67\x48\x8d\x05\x00\xe0\xff\xff\xc3")]),
+        slot_vaddr=(CODE + 8 - 0x2000) & 0xffffffff)
     yield "got-slot-underflow-discard", False, build(
         at_offset([(0, b"\x48\x8d\x05\x00\xe0\xff\xff\xc3")]),
         slot_vaddr=(CODE + 7 - 0x2000) & 0xffffffffffffffff)
diff --git a/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py b/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py
new file mode 100644
index 0000000000..2335566e12
--- /dev/null
+++ b/core/relinker/relinker/tests/test_windows_kernel_variant_imports.py
@@ -0,0 +1,77 @@
+import os
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from guest_import_fixtures import executable
+from test_windows_import_modules import provider
+
+
+def main():
+    assert os.name == 'nt', 'This test executes Windows startup stubs'
+    relinker = Path(sys.argv[1]).resolve()
+    variant = sys.argv[2]
+    assert variant in ('libkernel_sys.prx', 'libkernel_web.prx')
+    with tempfile.TemporaryDirectory(prefix='anyps5-kernel-variant-') as directory:
+        work = Path(directory)
+        modules = work / 'helpers' / 'prx'
+        modules.mkdir(parents=True)
+        for name, value in (('variant', 11), ('canonical', 22), ('runtime', 33), ('guest', 44)):
+            (modules / (name + '.prx')).write_bytes(provider(value))
+        empty = provider(0)
+        empty[0x800:0x80c] = b'\0other#A#B\0\0'
+        (modules / 'empty.prx').write_bytes(empty)
+        source = modules.parent / 'input.elf'
+        source.write_bytes(executable('variant.prx', 'shared#A#B'))
+        result = subprocess.run([str(relinker), '--windows', str(source), str(modules.parent / 'output.exe')],
+                                capture_output=True, text=True, timeout=30)
+        assert result.returncode == 0, result.stderr
+        converted = modules.parent / 'app0' / 'prx'
+        images = {name: (converted / (name + '.prx.guest.prx')).read_bytes()
+                  for name in ('variant', 'canonical', 'runtime', 'guest', 'empty')}
+        cases = (
+            ('runtime-fallback', 'empty', 'empty', 'runtime', 33),
+            ('variant-first', 'variant', 'canonical', 'runtime', 11),
+            ('canonical-before-runtime', 'empty', 'canonical', 'runtime', 22),
+            ('missing', 'empty', 'empty', 'empty', None),
+            ('guest-isolation', 'empty', 'empty', 'runtime', 33),
+            ('guest-cannot-fill-missing', 'empty', 'empty', 'empty', None),
+            ('unrelated-host', 'empty', 'empty', 'empty', None),
+            ('guest-requested-variant', 'variant', 'canonical', 'runtime', 44),
+            ('unqualified', 'variant', 'canonical', 'runtime', 11),
+        )
+        for label, requested, canonical, runtime, expected in cases:
+            case = work / label
+            libraries = case / 'libs'
+            libraries.mkdir(parents=True)
+            (case / 'prx').mkdir()
+            for name, image in ((variant, requested), ('libkernel.prx', canonical), ('libc.prx', runtime)):
+                (libraries / name).write_bytes(images[image])
+            if label.startswith('guest-'):
+                guests = case / 'sce_module'
+                guests.mkdir()
+                names = (variant,) if label == 'guest-requested-variant' else ('libkernel.prx', 'libc.prx')
+                for name in names:
+                    (guests / name).write_bytes(provider(44))
+            extra = ('unrelated.prx',) if label == 'unrelated-host' else ()
+            if extra:
+                (libraries / extra[0]).write_bytes(images['guest'])
+            source = case / 'input.elf'
+            symbol = 'shared' if label == 'unqualified' else 'shared#A#B'
+            source.write_bytes(executable(variant, symbol, extra_dependencies=extra))
+            output = case / 'output.exe'
+            result = subprocess.run([str(relinker), '--windows', str(source), str(output)],
+                                    capture_output=True, text=True, timeout=30)
+            assert result.returncode == 0, (variant, label, result.stderr)
+            result = subprocess.run([str(output)], capture_output=True, text=True, timeout=30)
+            if expected is None:
+                assert result.returncode & 0xffffffff == 0xc0000139, (label, result.returncode, result.stderr)
+                assert 'unresolved ELF import shared' in result.stderr, (label, result.stderr)
+            else:
+                assert result.returncode == expected, (variant, label, result.returncode, result.stderr)
+    print(variant + ': runtime, precedence and isolation checks passed')
+
+
+if __name__ == '__main__':
+    main()
diff --git a/core/shader/recompiler/BdaAbi.hpp b/core/shader/recompiler/BdaAbi.hpp
index 0c84230b80..f5df5fcbcd 100644
--- a/core/shader/recompiler/BdaAbi.hpp
+++ b/core/shader/recompiler/BdaAbi.hpp
@@ -35,7 +35,7 @@ inline bool RangesOrdered(const Range* ranges, std::size_t count) {
 }
 
 enum class FaultState : std::uint32_t { Empty, Writing, Ready };
-enum class FaultReason : std::uint32_t { Unmapped = 1, Permission, Overflow, InvalidTable, InvalidRectangle, LoopLimit, Unaligned, InvalidDescriptor, ImageTable, UnlinkedCall };
+enum class FaultReason : std::uint32_t { Unmapped = 1, Permission, Overflow, InvalidTable, InvalidRectangle, LoopLimit, Unaligned, InvalidDescriptor, ImageTable, UnlinkedCall, WindowLaneSpill };
 
 struct Fault {
     FaultState state;
diff --git a/core/shader/recompiler/CMakeLists.txt b/core/shader/recompiler/CMakeLists.txt
index ad13332d35..7ef4a942a8 100644
--- a/core/shader/recompiler/CMakeLists.txt
+++ b/core/shader/recompiler/CMakeLists.txt
@@ -43,6 +43,7 @@ function(add_shader_recompiler target runtimeTarget)
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/RdnaOpcode.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/RdnaProgram.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/RdnaInstructionDecoder.cpp
+            ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/GcnInstructionDecoder.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/RdnaScalarOpDecoder.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/RdnaVectorOpDecoder.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
@@ -100,6 +101,7 @@ function(add_shader_recompiler target runtimeTarget)
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/SsaBuilder/SsaRegisterStateCleanup.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/ConstantFolder.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/DeadCodeEliminator.cpp
+            ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/UnobservedPhiEliminator.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/HostInterpolationChecker.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/ReadLaneEliminator.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/Optimization/src/MaskedSelectEliminator.cpp
@@ -129,6 +131,7 @@ function(add_shader_recompiler target runtimeTarget)
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAnalysis.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp
+            ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvAlu/SpirvAluEmitterRegisters.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvFlowEmitter.cpp
             ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvImageEmitter.cpp
@@ -175,6 +178,9 @@ function(add_shader_recompiler target runtimeTarget)
 
     if(ANYPS5_ENABLE_SPIRV_TOOLS)
         target_sources(${target} PRIVATE ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvOptimizer.cpp)
+        if(WIN32)
+            set_source_files_properties(${CMAKE_CURRENT_FUNCTION_LIST_DIR}/SpirvBackend/src/SpirvOptimizer.cpp TARGET_DIRECTORY ${target} PROPERTIES COMPILE_DEFINITIONS _WIN32_WINNT=0x0602)
+        endif()
     endif()
 
     set(shaderCacheGeneratedDir "${CMAKE_CURRENT_BINARY_DIR}/${target}_generated")
@@ -188,7 +194,9 @@ function(add_shader_recompiler target runtimeTarget)
     get_target_property(shaderCacheCompiledSources ${target} SOURCES)
     list(APPEND shaderCacheRecompilerSources ${shaderCacheCompiledSources})
     list(REMOVE_DUPLICATES shaderCacheRecompilerSources)
-    set(shaderCacheKeySources "${PROJECT_SOURCE_DIR}/core/libs/prx/libc/include/HostThreadLocal.hpp")
+    set(shaderCacheKeySources
+            "${PROJECT_SOURCE_DIR}/core/libs/prx/libc/include/HostThreadLocal.hpp"
+            "${PROJECT_SOURCE_DIR}/core/libs/prx/libc/include/general/AtomicSharedPtr.hpp")
     foreach(source IN LISTS shaderCacheKeySources)
         if(NOT EXISTS "${source}")
             message(FATAL_ERROR "Shader disk cache key source does not exist: ${source}")
@@ -246,6 +254,7 @@ function(add_shader_recompiler target runtimeTarget)
             ImageTableAbi::PoisonCode
             ImageTableAbi::PoisonReasonName
             ImageTableAbi::TableHeader
+            FmaskLayoutOf
             IsFmaskTextureFormat
             PipelineSpecialization::IsWorkgroupOffset
             PipelineSpecialization::WorkgroupOffsetBase
@@ -271,6 +280,11 @@ function(add_shader_recompiler target runtimeTarget)
             ReleaseUndrawnResourcePlan
             ResourceMaterializer::SpecializationNanoseconds
             RuntimeAbi::RequireVersion
+            GcnGuestShaders
+            SetGcnGuestShaders
+            GcnImageTilingIndex
+            GcnImagePitch
+            GcnImagePow2Pad
             RuntimeAbi::HeapCapacity
             SampledTextureNumericClass
             SetDebugProbeActive
diff --git a/core/shader/recompiler/CacheKey.hpp b/core/shader/recompiler/CacheKey.hpp
index d95621f9a1..8c5d2b2678 100644
--- a/core/shader/recompiler/CacheKey.hpp
+++ b/core/shader/recompiler/CacheKey.hpp
@@ -4,7 +4,10 @@
 #include "Recompiler.hpp"
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include "prx/libc/include/HostThreadLocal.hpp"
+#include <algorithm>
+#include <bit>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <type_traits>
 
@@ -217,6 +220,11 @@ private:
         append(key, value.positionLocation);
         append(key, value.sampleLocations);
         append(key, value.targetOutputMode);
+        append(key, value.targetMerge.target);
+        append(key, value.targetMerge.mask);
+        append(key, value.targetMerge.samples);
+        append(key, value.targetMerge.depthStencilWrites);
+        append(key, value.targetMerge.depthStencilTests);
         append(key, value.sampleOrder);
     }
 
@@ -233,6 +241,10 @@ private:
         append(key, value.fetchEmbedded);
         append(key, value.paClVsOutCntl);
         append(key, value.depthRemapMode);
+        append(key, value.pointList);
+        append(key, std::bit_cast<std::uint32_t>(value.pointSize));
+        append(key, std::bit_cast<std::uint32_t>(value.pointSizeMin));
+        append(key, std::bit_cast<std::uint32_t>(value.pointSizeMax));
         if (value.resourcesNum > value.resources.size()) throw std::runtime_error("Shader cache: invalid vertex resource count");
         append(key, value.resourcesNum);
         for (std::uint32_t i = 0; i < value.resourcesNum; ++i) {
@@ -265,13 +277,35 @@ private:
         append(key, value.maxEvaluationOutputComponents);
     }
 
+    static void appendFeatureDigest(std::vector<std::uint64_t>& key, std::span<const std::uint32_t> capabilities, std::span<const std::string_view> extensions) {
+        std::uint64_t low = 0xcbf29ce484222325ull;
+        std::uint64_t high = 0x6a09e667f3bcc909ull;
+        const auto mix = [&](std::uint64_t value) {
+            low = (low ^ value) * 0x100000001b3ull;
+            high = (high ^ (value * 0x9e3779b97f4a7c15ull)) * 0xff51afd7ed558ccdull;
+            high ^= high >> 29u;
+        };
+        mix(capabilities.size());
+        for (const auto capability : capabilities) mix(capability);
+        mix(extensions.size());
+        for (const auto extension : extensions) {
+            mix(extension.size());
+            for (std::size_t offset = 0; offset < extension.size(); offset += sizeof(std::uint64_t)) {
+                std::uint64_t chunk = 0;
+                std::memcpy(&chunk, extension.data() + offset, std::min(sizeof(std::uint64_t), extension.size() - offset));
+                mix(chunk);
+            }
+        }
+        key.push_back(low);
+        key.push_back(high);
+    }
+
     static void append(std::vector<std::uint64_t>& key, const SpirvTarget& value) {
         append(key, value.vulkanVersion);
         append(key, value.spirvVersion);
         append(key, value.subgroupSize);
         append(key, value.bdaAbiVersion);
-        append(key, value.supportedCapabilities);
-        append(key, value.supportedExtensions);
+        appendFeatureDigest(key, value.supportedCapabilities, value.supportedExtensions);
         append(key, value.fragmentShaderBarycentricEnabled);
         append(key, value.maxWorkgroupSize);
         append(key, value.maxWorkgroupInvocations);
@@ -292,6 +326,10 @@ private:
         append(key, value.float32FlushToZero);
         append(key, value.waveLdsMemoryBarriers);
         append(key, value.float32DenormPreserve);
+        append(key, value.fusedExactArithmetic);
+        append(key, value.largePixelFunctionLdsBuffer);
+        append(key, value.pixelFunctionStorageDwords);
+        append(key, value.deviceScopeLdsMemoryBarriers);
     }
 };
 
diff --git a/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp b/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
index 5a2459f5af..6eb1bae337 100644
--- a/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
+++ b/core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp
@@ -479,7 +479,7 @@ bool isFetchCall(const RdnaProgram& program, std::uint32_t index, const SwappcIn
     const std::uint32_t targetRegister = scalarIndex(instruction.source0);
     const bool userDataPair = swappc != nullptr && targetRegister != NoScalarRegister &&
         targetRegister >= swappc->userDataBaseRegister && targetRegister + 1u < swappc->userDataBaseRegister + swappc->userDataCount &&
-        std::none_of(program.instructions.begin(), program.instructions.end(), [&](const RdnaInstruction& other) {
+        std::none_of(program.instructions.begin(), GcnGuestShaders() ? program.instructions.begin() + index : program.instructions.end(), [&](const RdnaInstruction& other) {
             return writesScalar(other, targetRegister) || writesScalar(other, targetRegister + 1u);
         });
     return swappc != nullptr && swappc->fetchCallAllowed && positional && (userDataPair || outsideProgram);
@@ -503,11 +503,9 @@ bool overwritesScalar(const RdnaInstruction& instruction, std::uint32_t reg, std
                 case RdnaOpcode::SBitset1B64:
                 case RdnaOpcode::SSwappcB64:
                 case RdnaOpcode::SSetpcB64: return false;
-                case RdnaOpcode::SMovB64:
-                case RdnaOpcode::SGetpcB64: return first != NoScalarRegister && reg >= first && reg - first < 2u;
-                default: return first != NoScalarRegister && reg == first;
+                default: return first != NoScalarRegister && reg >= first && reg - first < std::max(instruction.dataDwordCount, 1u);
             }
-        case RdnaInstructionFamily::SOP2: return first != NoScalarRegister && reg == first;
+        case RdnaInstructionFamily::SOP2: return first != NoScalarRegister && reg >= first && reg - first < std::max(instruction.dataDwordCount, 1u);
         case RdnaInstructionFamily::SOPK: return instruction.op == RdnaOpcode::SMovkI32 && reg == first;
         case RdnaInstructionFamily::VOP1:
         case RdnaInstructionFamily::VOP2:
@@ -715,9 +713,10 @@ struct LinkEscape {
 
 template <typename TError>
 LinkEscape requireReturnAddressesStayInCalls(const RdnaProgram& program, const std::vector<SwappcCall>& calls, const std::vector<std::uint32_t>& unlinked, std::uint32_t knownWaveSize, const TError& escapeError) {
+    const bool gcn = GcnGuestShaders();
     std::set<std::uint32_t> links;
     for (const auto& call : calls) {
-        if (!call.fetch) links.insert(call.linkRegister);
+        if (!call.fetch || gcn) links.insert(call.linkRegister);
     }
     const auto size = static_cast<std::uint32_t>(program.instructions.size());
     const auto successors = [&](std::uint32_t index) {
@@ -776,7 +775,7 @@ LinkEscape requireReturnAddressesStayInCalls(const RdnaProgram& program, const s
                 if (holds[index] == 0u || writesLink(index) || instruction.family == RdnaInstructionFamily::SOPC || findReturnAt(calls, index) != nullptr) continue;
                 const bool inside = std::ranges::any_of(calls, [&](const SwappcCall& call) { return !call.fetch && call.linkRegister == link && index >= call.targetIndex && index <= call.returnIndex; });
                 if (inside || !(((holds[index] & 1u) != 0u && readsScalarDword(instruction, link, waveSize)) || ((holds[index] & 2u) != 0u && readsScalarDword(instruction, link + 1u, waveSize)))) continue;
-                const auto owner = std::ranges::find_if(calls, [&](const SwappcCall& call) { return !call.fetch && call.linkRegister == link; });
+                const auto owner = std::ranges::find_if(calls, [&](const SwappcCall& call) { return (!call.fetch || gcn) && call.linkRegister == link; });
                 return escapeError(*owner, instruction);
             }
         }
@@ -897,7 +896,7 @@ std::vector<SwappcCall> analyzeSwappcCalls(const RdnaProgram& program, const Swa
                 continue;
             }
             const bool outsideRegion = regionEnd != InvalidControlFlowId && (index < call.targetIndex || index > regionEnd);
-            if (outsideRegion) continue;
+            if (outsideRegion || (call.fetch && GcnGuestShaders())) continue;
             if (touchesLinkRegister(instruction, call.linkRegister)) {
                 throw escapeError(call, instruction);
             }
@@ -1292,7 +1291,8 @@ std::set<std::uint32_t> branchLabels(const RdnaProgram& program) {
 
 bool unchangedUntil(const RdnaProgram& program, std::uint32_t reg, std::uint32_t reader, std::uint32_t waveSize) {
     for (std::uint32_t index = 0; index < program.instructions.size(); ++index) {
-        if (!writesScalar(program.instructions[index], reg, waveSize)) continue;
+        const bool readerWritesAfterReading = index == reader && GcnGuestShaders();
+        if (readerWritesAfterReading || !writesScalar(program.instructions[index], reg, waveSize)) continue;
         if (index <= reader) return false;
         for (std::uint32_t later = index; later < program.instructions.size(); ++later) {
             const auto& instruction = program.instructions[later];
@@ -1402,7 +1402,7 @@ std::vector<UserDataCall> FindUserDataCalls(const RdnaProgram& program, const Sw
         const auto source = scalarIndex(instruction.source0);
         if (link == NoScalarRegister || source == NoScalarRegister || source % 2u != 0u) continue;
         std::uint32_t pair = NoScalarRegister;
-        if (source != link && userData(source) && userData(source + 1u) && unchanged(source, index) && unchanged(source + 1u, index)) {
+        if ((source != link || GcnGuestShaders()) && userData(source) && userData(source + 1u) && unchanged(source, index) && unchanged(source + 1u, index)) {
             pair = source;
         } else {
             std::uint32_t low = 0, high = 0;
@@ -1526,7 +1526,9 @@ std::vector<TableCall> FindTableCalls(const RdnaProgram& program, const SwappcIn
         if (!sameBlockWriter && !reachingWriter(program, lowLoad, {descriptor, descriptor + 1u, descriptor + 2u, descriptor + 3u}, descriptorLoad, swappc.waveSize)) continue;
         const auto& table = program.instructions[descriptorLoad];
         const auto pointer = scalarIndex(table.source0);
-        if (table.op != RdnaOpcode::SLoadDwordx4 || !isScalar(table.destination, descriptor) || pointer == NoScalarRegister || pointer % 2u != 0u || table.source1.kind != RdnaOperandKind::Null ||
+        const auto loaded = scalarIndex(table.destination);
+        if ((table.op != RdnaOpcode::SLoadDwordx4 && table.op != RdnaOpcode::SLoadDwordx8 && table.op != RdnaOpcode::SLoadDwordx16) || loaded == NoScalarRegister || descriptor < loaded ||
+            (descriptor - loaded) % 4u != 0u || descriptor - loaded + 4u > table.dataDwordCount || pointer == NoScalarRegister || pointer % 2u != 0u || table.source1.kind != RdnaOperandKind::Null ||
             table.memoryOffset >= 0x100000u || (table.memoryOffset & 3u) != 0u) continue;
         std::optional<std::uint64_t> constantPointer;
         if (!(userData(pointer) && userData(pointer + 1u) && unchangedUntil(program, pointer, descriptorLoad, swappc.waveSize) && unchangedUntil(program, pointer + 1u, descriptorLoad, swappc.waveSize))) {
@@ -1548,7 +1550,7 @@ std::vector<TableCall> FindTableCalls(const RdnaProgram& program, const SwappcIn
             if (shifted.op != RdnaOpcode::SLshlB32 || !isScalar(shifted.destination, offset) || !isImmediate(shifted.source1, shift) || shift < 2u || shift > 24u) continue;
             stride = 1u << shift;
         }
-        calls.push_back({instruction.programCounter, link, target, constantPointer ? 0u : pointer, table.memoryOffset, load.memoryOffset + lowDword * 4u, stride, constantPointer});
+        calls.push_back({instruction.programCounter, link, target, constantPointer ? 0u : pointer, table.memoryOffset + (descriptor - loaded) * 4u, load.memoryOffset + lowDword * 4u, stride, constantPointer});
     }
     return calls;
 }
@@ -1580,6 +1582,7 @@ LinkedCalls LinkCalls(const RdnaProgram& program, std::span<const UserDataCall>
         linked[word] = 0xbb000000u | (userDataCalls[call].linkRegister << 16u) | static_cast<std::uint32_t>(offset);
         linked.insert(linked.end(), userDataCallees[call].begin(), userDataCallees[call].end());
     }
+    std::vector<std::pair<std::size_t, std::size_t>> stations;
     for (std::size_t call = 0; call < tableCalls.size(); ++call) {
         const auto& table = tableCalls[call];
         const auto& callees = tableCallees[call];
@@ -1587,41 +1590,50 @@ LinkedCalls LinkCalls(const RdnaProgram& program, std::span<const UserDataCall>
         const auto at = "the table callees of the call at program counter " + toHexString(table.programCounter);
         const auto original = linked[word];
         const auto count = callees.size();
-        const auto dispatch = linked.size();
-        const auto zero = dispatch + 1u;
-        const auto one = zero + count * 7u + 2u;
-        const auto calls = one + count * 8u + 2u;
-        const auto fault = calls + count * 2u;
+        const auto relays = 2u * (tableCalls.size() - call - 1u);
+        std::vector<std::size_t> path;
+        for (const auto& [position, block] : stations) path.push_back(position + 2u * (call - block - 1u));
+        const auto station = [&] {
+            if (relays == 0u) return;
+            stations.push_back({linked.size(), call});
+            linked.insert(linked.end(), relays, 0u);
+        };
+        station();
+        const auto start = linked.size();
+        std::vector<std::size_t> segments(count + 1u);
+        segments[0] = start + 1u;
+        for (std::size_t callee = 0; callee < count; ++callee) segments[callee + 1u] = segments[callee] + 16u + callees[callee].code.size() + relays;
+        const auto one = [&](std::size_t callee) { return segments[callee] + (callee < count ? 7u : 2u); };
+        const auto back = [&](std::size_t callee) { return callee != 0u ? segments[callee - 1u] + 15u : path.empty() ? word + 1u : path.back() + 1u; };
+        const auto fault = segments[count] + 3u;
         const auto branch = [&](std::uint32_t opcode, std::size_t target) { linked.push_back(branchWord(opcode, linked.size(), target, at.c_str())); };
-        linked[word] = branchWord(0xbf820000u, word, dispatch, at.c_str());
-        branch(0xbf850000u, one);
-        for (const bool sccOne : {false, true}) {
-            for (std::size_t callee = 0; callee < count; ++callee) {
-                const auto next = linked.size() + (sccOne ? 8u : 7u);
+        for (std::size_t hop = 0; hop < path.size(); ++hop) {
+            linked[path[hop]] = branchWord(0xbf820000u, path[hop], hop + 1u < path.size() ? path[hop + 1u] : start, at.c_str());
+            linked[path[hop] + 1u] = branchWord(0xbf820000u, path[hop] + 1u, hop == 0u ? word + 1u : path[hop - 1u] + 1u, at.c_str());
+        }
+        linked[word] = branchWord(0xbf820000u, word, path.empty() ? start : path.front(), at.c_str());
+        branch(0xbf850000u, one(0u));
+        for (std::size_t callee = 0; callee < count; ++callee) {
+            for (const bool sccOne : {false, true}) {
+                const auto next = sccOne ? one(callee + 1u) : segments[callee + 1u];
                 linked.insert(linked.end(), {0xbf07ff00u | table.targetRegister, static_cast<std::uint32_t>(callees[callee].target)});
                 branch(0xbf850000u, next);
                 linked.insert(linked.end(), {0xbf07ff00u | (table.targetRegister + 1u), static_cast<std::uint32_t>(callees[callee].target >> 32u)});
                 branch(0xbf850000u, next);
                 if (sccOne) linked.push_back(0xbf068080u);
-                branch(0xbf820000u, calls + callee * 2u);
+                else branch(0xbf820000u, segments[callee] + 14u);
             }
-            linked.push_back(sccOne ? 0xbf068080u : 0xbf078080u);
-            branch(0xbf820000u, fault);
-        }
-        for (std::size_t callee = 0; callee < count; ++callee) {
-            linked.push_back(0u);
-            branch(0xbf820000u, word + 1u);
+            linked.push_back(0xbb000001u | (table.linkRegister << 16u));
+            branch(0xbf820000u, back(callee));
+            linked.insert(linked.end(), callees[callee].code.begin(), callees[callee].code.end());
+            station();
         }
+        linked.push_back(0xbf078080u);
+        branch(0xbf820000u, fault);
+        linked.push_back(0xbf068080u);
         fallbacks.push_back(static_cast<std::uint32_t>(linked.size() * 4u));
         linked.push_back(original);
-        branch(0xbf820000u, word + 1u);
-        for (std::size_t callee = 0; callee < count; ++callee) {
-            const auto site = calls + callee * 2u;
-            const auto offset = static_cast<std::int64_t>(linked.size()) - static_cast<std::int64_t>(site) - 1;
-            if (offset > 0x7fff) throw std::invalid_argument(at + " land out of s_call_b64 range");
-            linked[site] = 0xbb000000u | (table.linkRegister << 16u) | static_cast<std::uint32_t>(offset);
-            linked.insert(linked.end(), callees[callee].code.begin(), callees[callee].code.end());
-        }
+        branch(0xbf820000u, back(count));
     }
     linked.push_back(0xbf9f0000u);
     return {std::move(linked), std::move(fallbacks)};
diff --git a/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp b/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp
index 11a9d92195..62014408a5 100644
--- a/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp
+++ b/core/shader/recompiler/ControlFlow/src/RequestSerializer.cpp
@@ -1,4 +1,5 @@
 #include "ControlFlow/RequestSerializer.hpp"
+#include <bit>
 #include <stdexcept>
 
 namespace ShaderRecompiler {
@@ -239,7 +240,7 @@ ConservativeZExport readConservativeZExport(Reader& reader) {
 
 ColorExportPacking readColorExportPacking(Reader& reader) {
     const auto value = reader.ReadU8();
-    if (value > static_cast<std::uint8_t>(ColorExportPacking::Float11_11_10)) {
+    if (value > static_cast<std::uint8_t>(ColorExportPacking::Unorm4_4_4_4)) {
         throw std::runtime_error("RequestSerializer: invalid ColorExportPacking value");
     }
     return static_cast<ColorExportPacking>(value);
@@ -356,6 +357,12 @@ void writePixelInfo(Writer& writer, const ShaderPixelStageInfo& info) {
     for (const std::uint8_t location : info.sampleLocations) writer.WriteU8(location);
     writer.WriteBool(info.stencilOperationValueExport);
     for (const std::uint32_t order : info.sampleOrder) writer.WriteU32(order);
+    writer.WriteU8(info.targetMerge.target);
+    writer.WriteU32(info.targetMerge.mask);
+    writer.WriteU8(info.targetMerge.samples);
+    for (const std::uint32_t word : info.targetMerge.descriptor) writer.WriteU32(word);
+    writer.WriteBool(info.targetMerge.depthStencilWrites);
+    writer.WriteBool(info.targetMerge.depthStencilTests);
 }
 
 ShaderPixelStageInfo readPixelInfo(Reader& reader, std::uint32_t version) {
@@ -427,6 +434,16 @@ ShaderPixelStageInfo readPixelInfo(Reader& reader, std::uint32_t version) {
     if (version >= 42u) {
         for (std::uint32_t& order : info.sampleOrder) order = reader.ReadU32();
     }
+    if (version >= 46u) {
+        info.targetMerge.target = reader.ReadU8();
+        const auto mask = reader.ReadU32();
+        if (mask > 0xffffu) throw std::runtime_error("invalid recompile request target merge mask");
+        info.targetMerge.mask = static_cast<std::uint16_t>(mask);
+        info.targetMerge.samples = reader.ReadU8();
+        for (std::uint32_t& word : info.targetMerge.descriptor) word = reader.ReadU32();
+        info.targetMerge.depthStencilWrites = reader.ReadBool();
+        info.targetMerge.depthStencilTests = reader.ReadBool();
+    }
     if (version < 5u) {
         const auto input = [](PixelInput value, bool present) { return present ? PixelInputBit(value) : 0u; };
         info.inputAddr = input(PixelInput::PerspectiveSample, info.hasPerspectiveCenterVgpr && inputAddrOrCenterVgpr == 2u) | input(PixelInput::PerspectiveCenter, info.hasPerspectiveCenterVgpr) |
@@ -831,7 +848,7 @@ std::string RequestSerializer::Serialize(const RecompileRequest& request) const
     std::string buffer;
     Writer writer(buffer);
     writer.WriteU32(0x41505335u);
-    writer.WriteU32(42u);
+    writer.WriteU32(46u);
     writeShaderBinary(writer, request.shader);
     writeGuestContext(writer, request.context);
     writeSpirvTarget(writer, request.target);
@@ -863,6 +880,15 @@ std::string RequestSerializer::Serialize(const RecompileRequest& request) const
     }
     writer.WriteBool(request.target.float32FlushToZero);
     writer.WriteBool(request.target.float32DenormPreserve);
+    if (request.context.vertex.has_value()) {
+        writer.WriteBool(request.context.vertex->pointList);
+        writer.WriteU32(std::bit_cast<std::uint32_t>(request.context.vertex->pointSize));
+        writer.WriteU32(std::bit_cast<std::uint32_t>(request.context.vertex->pointSizeMin));
+        writer.WriteU32(std::bit_cast<std::uint32_t>(request.context.vertex->pointSizeMax));
+    }
+    writer.WriteBool(request.target.fusedExactArithmetic);
+    writer.WriteBool(request.target.largePixelFunctionLdsBuffer);
+    writer.WriteU32(request.target.pixelFunctionStorageDwords);
     return base64Encode(buffer);
 }
 
@@ -871,7 +897,7 @@ DeserializedRequest RequestSerializer::Deserialize(std::string_view text) const
     Reader reader(decoded);
     if (reader.ReadU32() != 0x41505335u) throw std::runtime_error("invalid recompile request signature");
     const auto version = reader.ReadU32();
-    if (version < 1u || version > 42u) throw std::runtime_error("unsupported recompile request serialization version");
+    if (version < 1u || version > 46u) throw std::runtime_error("unsupported recompile request serialization version");
     DeserializedRequest result{};
     result.request.shader = readShaderBinary(reader, result.shaderCode, result.shaderHeader);
     result.request.context = readGuestContext(reader, result, version);
@@ -917,6 +943,19 @@ DeserializedRequest RequestSerializer::Deserialize(std::string_view text) const
     }
     if (version >= 36u) result.request.target.float32FlushToZero = reader.ReadBool();
     if (version >= 41u) result.request.target.float32DenormPreserve = reader.ReadBool();
+    if (version >= 43u && result.request.context.vertex.has_value()) {
+        auto& vertex = *result.request.context.vertex;
+        vertex.pointList = reader.ReadBool();
+        vertex.pointSize = std::bit_cast<float>(reader.ReadU32());
+        vertex.pointSizeMin = std::bit_cast<float>(reader.ReadU32());
+        vertex.pointSizeMax = std::bit_cast<float>(reader.ReadU32());
+        result.vertex = vertex;
+    }
+    if (version >= 44u) result.request.target.fusedExactArithmetic = reader.ReadBool();
+    if (version >= 45u) {
+        result.request.target.largePixelFunctionLdsBuffer = reader.ReadBool();
+        result.request.target.pixelFunctionStorageDwords = reader.ReadU32();
+    }
     if (version >= 21u && reader.Remaining() != 0u) throw std::runtime_error("RequestSerializer: unexpected trailing data");
     return result;
 }
diff --git a/core/shader/recompiler/ControlFlow/src/Structurizer.cpp b/core/shader/recompiler/ControlFlow/src/Structurizer.cpp
index 3267461138..8684767d4a 100644
--- a/core/shader/recompiler/ControlFlow/src/Structurizer.cpp
+++ b/core/shader/recompiler/ControlFlow/src/Structurizer.cpp
@@ -2335,7 +2335,8 @@ void Structurizer::canonicalizeNaturalLoops(ControlFlowGraph& graph, bool routeL
             });
             const auto& header = graph.FindBlock(loop.headerBlock);
             const bool semanticSelfLoop = latches.size() == 1u && latches.front() == header.id && header.instructionBegin != header.instructionEnd;
-            if (latches.size() <= 1u && !latchInInnerLoop && !semanticSelfLoop) {
+            const bool semanticLatch = latches.size() == 1u && graph.FindBlock(latches.front()).instructionBegin != graph.FindBlock(latches.front()).instructionEnd && graph.FindBlock(latches.front()).predecessors.size() == 1u;
+            if (latches.size() <= 1u && !latchInInnerLoop && !semanticSelfLoop && !semanticLatch) {
                 continue;
             }
 
diff --git a/core/shader/recompiler/Deserialize.cpp b/core/shader/recompiler/Deserialize.cpp
index 6f1b3a0ca9..5bc2aec696 100644
--- a/core/shader/recompiler/Deserialize.cpp
+++ b/core/shader/recompiler/Deserialize.cpp
@@ -165,6 +165,7 @@ int main(int argc, char** argv) {
         translateOptions.stage = stageKind;
         translateOptions.waveSize = request.context.waveSize;
         translateOptions.userDataBaseRegister = request.context.userDataBaseRegister;
+        translateOptions.gcnLegacyVertexInputs = GcnGuestShaders() && request.context.userDataBaseRegister == 0u;
         translateOptions.userDataCount = static_cast<std::uint32_t>(request.context.userData.size());
         translateOptions.scratchDwords = request.context.compute.has_value() ? request.context.compute->scratchDwords : 0u;
         translateOptions.sharedMemoryBytes = request.context.compute.has_value() && static_cast<std::uint64_t>(request.context.compute->ldsSizeDwords) * 4u + 4u > request.target.maxWorkgroupSharedMemoryBytes ? request.context.compute->ldsSizeDwords * 4u : 0u;
diff --git a/core/shader/recompiler/FragmentOutputSpecialization.hpp b/core/shader/recompiler/FragmentOutputSpecialization.hpp
index 00894c6af1..e3360cceaf 100644
--- a/core/shader/recompiler/FragmentOutputSpecialization.hpp
+++ b/core/shader/recompiler/FragmentOutputSpecialization.hpp
@@ -32,7 +32,7 @@ inline std::vector<std::uint32_t> SpecializeFragmentOutputs(std::vector<std::uin
             reversed = constant.value;
         }
         if (constant.id < PipelineSpecialization::ExportPackingBase || constant.id >= PipelineSpecialization::ExportPackingBase + 8u) continue;
-        if (constant.value > static_cast<std::uint32_t>(ColorExportPacking::Float11_11_10)) throw std::runtime_error("invalid prepared fragment export packing");
+        if (constant.value > static_cast<std::uint32_t>(ColorExportPacking::Unorm4_4_4_4)) throw std::runtime_error("invalid prepared fragment export packing");
         if (constant.value != static_cast<std::uint32_t>(ColorExportPacking::None)) packed.insert(constant.id - PipelineSpecialization::ExportPackingBase);
     }
     if (packed.empty() && !dualSource && reversed == 0u) return words;
diff --git a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp
index 307b83cdff..e639277ea3 100644
--- a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp
+++ b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/Resources.hpp
@@ -96,6 +96,7 @@ struct ImageResource {
     bool volumeArraySampleCompatible = false;
     bool flatLineCompatible = true;
     bool flatVolumeLineCompatible = true;
+    bool dimensionQueryOnly = true;
     bool foldTexelOffsetsOnly = false;
     bool convertedSamples = false;
     bool remappedDepth1D = false;
@@ -105,6 +106,7 @@ struct ImageResource {
     std::uint32_t emulatedCompare = 0;
     std::uint32_t table = NoTable;
     TableOperation tableOperation = TableOperation::Supported;
+    bool targetMerge = false;
 
     bool operator==(const ImageResource& other) const = default;
 };
diff --git a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/ShaderInfo.hpp b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/ShaderInfo.hpp
index 1440effcb2..76c0af830f 100644
--- a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/ShaderInfo.hpp
+++ b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrMetadata/ShaderInfo.hpp
@@ -37,6 +37,7 @@ struct ShaderInfo {
     bool dispatchThreadLimit = false;
     bool rasterPrimitive = false;
     bool layerExported = false;
+    bool smoothOffsetBarycentrics = false;
 
     bool operator==(const ShaderInfo& other) const = default;
 };
diff --git a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp
index c1ed5e72ed..c6b34841ba 100644
--- a/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp
+++ b/core/shader/recompiler/IntermediateRepresentation/include/IntermediateRepresentation/IrOpcode.hpp
@@ -74,6 +74,7 @@ enum class IrOpcode : std::uint16_t {
     Reference,
     ReferenceU32,
     UnlinkedCall,
+    WindowLaneGuard,
     GetUserData,
     GetShaderBase,
     ShaderClock,
diff --git a/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp b/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp
index b3622f4c6a..22ec648a27 100644
--- a/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/src/IrOpcode.cpp
@@ -115,6 +115,7 @@ constexpr std::array<OpcodeMeta, static_cast<std::size_t>(IrOpcode::Count)> Meta
     makeMeta("Reference", Void, U1),
     makeMeta("ReferenceU32", Void, U32),
     makeMeta("UnlinkedCall", Void, U32, U32, U32),
+    makeMeta("WindowLaneGuard", Void, U32, U32, U32, U32, U32),
     makeMeta("GetUserData", U32, ScalarReg),
     makeMeta("GetShaderBase", U64),
     makeMeta("ShaderClock", U64),
@@ -894,6 +895,7 @@ bool IrOpcodeHasSideEffects(IrOpcode opcode) {
         case IrOpcode::Reference:
         case IrOpcode::ReferenceU32:
         case IrOpcode::UnlinkedCall:
+        case IrOpcode::WindowLaneGuard:
         case IrOpcode::SetTessellationAttribute:
         case IrOpcode::InterpolateHostP2:
         case IrOpcode::SetThreadBitScalarRegister:
diff --git a/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp b/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp
index 08dba6b1d9..4278d1a771 100644
--- a/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/src/IrProgram.cpp
@@ -173,6 +173,21 @@ std::string formatHex64(std::uint64_t value) {
     return stream.str();
 }
 
+bool carriesMemoryInfo(IrOpcode opcode) {
+    return opcode == IrOpcode::ReadConstBuffer || AddressOpcodeInfoOf(opcode).access != AddressAccess::None || BufferComponentCount(opcode) != 0u || SharedComponentCount(opcode) != 0u || ImageOpcodeInfoOf(opcode).access != ImageAccess::None;
+}
+
+std::string memoryToString(const IrProgram& program, const IrValue& inst) {
+    const auto flags = inst.Flags<MemoryFlags>();
+    const auto& memoryInfo = program.Resources().memoryInfo;
+    if (flags.index >= memoryInfo.size()) {
+        return " [pc=" + formatHex32(flags.pc) + " mem=?]";
+    }
+    std::ostringstream stream;
+    stream << " [pc=" << formatHex32(flags.pc) << " off=0x" << std::hex << memoryInfo[flags.index].offset << "]";
+    return stream.str();
+}
+
 std::string valueToString(const std::map<const IrValue*, std::size_t>& ids, const IrValue* value) {
     if (value == nullptr) {
         return "<null>";
@@ -404,7 +419,11 @@ std::string ProgramToString(const IrProgram& program) {
                     text += valueToString(ids, inst->Argument(index));
                 }
             }
-            text += " (" + TypeToString(inst->Type()) + "; uses=" + std::to_string(inst->UseCount()) + ")\n";
+            text += " (" + TypeToString(inst->Type()) + "; uses=" + std::to_string(inst->UseCount()) + ")";
+            if (carriesMemoryInfo(inst->Opcode())) {
+                text += memoryToString(program, *inst);
+            }
+            text += "\n";
         }
     }
     return text;
@@ -586,11 +605,11 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             if (fixedSignature && inst->ArgumentCount() != IrOpcodeOperandCount(inst->Opcode())) {
                 fail(std::string(IrOpcodeName(inst->Opcode())) + " has " + std::to_string(inst->ArgumentCount()) + " arguments, expected " + std::to_string(IrOpcodeOperandCount(inst->Opcode())));
             }
+            if (carriesMemoryInfo(inst->Opcode()) && inst->Flags<MemoryFlags>().index >= program.Resources().memoryInfo.size()) {
+                fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
+            }
             if (inst->Opcode() == IrOpcode::ReadConstBuffer) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (memory.kind != ResourceKind::ScalarBuffer) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid scalar-memory resource kind");
@@ -603,9 +622,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto addressInfo = AddressOpcodeInfoOf(inst->Opcode());
             if (addressInfo.access != AddressAccess::None) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (!IsAddressResourceKind(memory.kind) || (memory.kind == ResourceKind::ScalarAddress && inst->Opcode() != IrOpcode::LoadAddressU32)) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid address resource kind");
@@ -620,9 +636,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto bufferComponents = BufferComponentCount(inst->Opcode());
             if (bufferComponents != 0u) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (memory.kind != ResourceKind::Buffer && memory.kind != ResourceKind::ScalarBuffer) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has a non-buffer resource kind");
@@ -637,9 +650,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto sharedComponents = SharedComponentCount(inst->Opcode());
             if (sharedComponents != 0u) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if ((memory.kind != ResourceKind::Lds && memory.kind != ResourceKind::Gds) || memory.resource != 0u || memory.sampler != 0u || memory.componentCount == 0u || memory.componentIndex >= memory.componentCount) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has invalid shared-memory metadata");
@@ -657,9 +667,6 @@ void ValidateProgram(const IrProgram& program, bool requireSsa) {
             const auto imageInfo = ImageOpcodeInfoOf(inst->Opcode());
             if (imageInfo.access != ImageAccess::None) {
                 const auto memoryIndex = inst->Flags<MemoryFlags>().index;
-                if (memoryIndex >= program.Resources().memoryInfo.size()) {
-                    fail(std::string(IrOpcodeName(inst->Opcode())) + " has an invalid memory-info index");
-                }
                 const auto& memory = program.Resources().memoryInfo[memoryIndex];
                 if (memory.kind != ResourceKind::Image || imageInfo.resourceClass == ImageResourceClass::None) {
                     fail(std::string(IrOpcodeName(inst->Opcode())) + " has invalid image-memory metadata");
diff --git a/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp b/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp
index 3aef0d5211..6e820d5fe3 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/DeadCodeEliminator.hpp
@@ -10,6 +10,7 @@ namespace ShaderRecompiler {
 class DeadCodeEliminator {
 public:
     void Eliminate(IrProgram& program) const;
+    void EliminateUnobservedPhis(IrProgram& program) const;
     void Eliminate(std::span<IrBlock* const> blocks) const;
     void RemoveIdentities(IrProgram& program) const;
     void RemoveIdentities(std::span<IrBlock* const> blocks) const;
diff --git a/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp b/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp
index a52432123a..8fdbe75a07 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/ReadLaneEliminator.hpp
@@ -8,6 +8,7 @@ namespace ShaderRecompiler {
 
 struct ReadLaneEliminationStats {
     std::uint32_t rewrittenReads = 0;
+    std::uint32_t guardedStores = 0;
 };
 
 class ReadLaneEliminator {
diff --git a/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp b/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp
index 1425a5ec58..ae3696883c 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/ResourceMaterializer.hpp
@@ -20,6 +20,7 @@ struct ImageTableElement {
     bool depthCompare = false;
     DescriptorBindingKind kind = DescriptorBindingKind::Buffers;
     std::uint32_t samplers = 0;
+    bool atomic = false;
 };
 
 struct ImageTableSamplerElement {
diff --git a/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp b/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp
index 84034d4306..299b838494 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/ShaderStageInputInfo.hpp
@@ -141,6 +141,10 @@ struct ShaderVertexInputInfo {
     std::uint32_t scratchSizeDwords = 0;
     std::uint32_t hostSubgroupSize = 64;
     std::uint32_t paClVsOutCntl = 0;
+    bool pointList = false;
+    float pointSize = 1.0f;
+    float pointSizeMin = 0.0f;
+    float pointSizeMax = 0.0f;
     ShaderClipSpaceTransform clipSpace;
     ShaderDepthRemap depthRemap;
     ShaderMeshInputInfo mesh;
@@ -195,6 +199,11 @@ struct ShaderPixelInputInfo {
     bool psIteratesSamples = false;
     PixelPositionLocation psPositionLocation = PixelPositionLocation::Center;
     std::array<std::uint8_t, 32> sampleLocations{};
+    std::uint8_t mergeTarget = 0;
+    std::uint16_t mergeMask = 0;
+    std::uint8_t mergeSamples = 1;
+    bool mergeDepthStencilWrites = false;
+    bool mergeDepthStencilTests = false;
     std::array<std::uint32_t, 4> sampleOrder{};
     ShaderStageRuntime stage;
 
diff --git a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp
index d666acd0f8..776a3c6dd9 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtEvaluator.hpp
@@ -74,6 +74,12 @@ struct InaccessibleRead {
     std::uint64_t address = 0;
 };
 
+enum class EvaluatorReads : std::uint8_t {
+    Nothing,
+    Arguments,
+    Closure,
+};
+
 class DenseValues {
 public:
     struct Slot {
@@ -173,6 +179,8 @@ public:
     BasicEvaluator& operator=(const BasicEvaluator&) = delete;
 
     static bool MayEvaluate(const IrResourcePlan& program, IrValue* value, const IrValue* activeMask = nullptr);
+    static bool MayDecide(const IrResourcePlan& program, IrValue* value);
+    static EvaluatorReads Reads(const IrResourcePlan& program, const IrValue& value);
     bool Evaluate(TNode value, std::uint32_t& result);
     bool EvaluateWide(TNode value, std::uint64_t& result);
     void ReportInaccessibleReads(InaccessibleRead* sink) { _inaccessible = sink; }
diff --git a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp
index fa1310cff9..34a381669e 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtInstructionPredicates.hpp
@@ -10,6 +10,7 @@ namespace ShaderRecompiler::Detail {
 
 bool IsRawRead(const IrResourcePlan& program, const IrValue& inst);
 bool IsRawRead(const IrResourcePlan& program, IrOpcode op, std::uint32_t memoryIndex);
+bool IsMemoryRead(IrOpcode opcode);
 bool LoadedFromMemory(const IrValue& handle);
 bool IsDescriptorHandle(IrOpcode opcode);
 bool IsRuntimeSelect(IrOpcode opcode);
diff --git a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp
index 0dcb1a168d..2e833ba3e7 100644
--- a/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp
+++ b/core/shader/recompiler/Optimization/include/Optimization/SrtWalker/SrtTape.hpp
@@ -26,7 +26,7 @@ private:
     static std::shared_ptr<const SrtTape> Compile(const IrResourcePlan& plan);
     enum class Op : std::uint8_t {
         Fail, Const, UserData, ShaderBase, Read, ReadConstBuffer, ExtractHalf, AddCarry, ConstructU64,
-        ConvertF32U32, ConvertU32F32, FPMul32, FPTrunc32, FPIsNan32, FPOrdLessThanEqual32, FPOrdGreaterThanEqual32,
+        ConvertF32U32, ConvertU32F32, FPMul32, FPTrunc32, FPIsNan32, FPOrdLessThanEqual32, FPOrdGreaterThanEqual32, FPUnordLessThanEqual32, FPUnordGreaterThanEqual32,
         IAdd32, IAdd64, ISub32, ISub64, IMul32, IMul64, SMin32, UMin32, BitwiseAnd32, BitwiseAnd64, BitwiseOr32, BitwiseXor32, BitwiseNot32,
         ShiftLeftLogical32, ShiftLeftLogical64, ShiftRightLogical32, ShiftRightLogical64, ShiftRightArithmetic32, ShiftRightArithmetic64,
         BitFieldUExtract, BitFieldSExtract, BitFieldInsert, Select, IEqual32, INotEqual32, SLessThan32, ULessThan32, UGreaterThan32,
diff --git a/core/shader/recompiler/Optimization/src/ConstantFolder.cpp b/core/shader/recompiler/Optimization/src/ConstantFolder.cpp
index 1eb0dd3650..a7419f9c3a 100644
--- a/core/shader/recompiler/Optimization/src/ConstantFolder.cpp
+++ b/core/shader/recompiler/Optimization/src/ConstantFolder.cpp
@@ -245,14 +245,23 @@ bool runsAllStartingLanes(const IrProgram& program, const IrBlock* target) {
     return false;
 }
 
-bool holdsStartingLanes(const IrProgram& program, const IrValue& word, std::uint32_t index, std::uint32_t depth = 0) {
+enum class LaneCoverage { Real, Quads };
+
+bool holdsStartingLanes(const IrProgram& program, const IrValue& word, std::uint32_t index, LaneCoverage coverage, std::uint32_t depth = 0) {
     if (depth > 8u) return false;
     if (word.Opcode() == IrOpcode::BitwiseAnd32) {
-        return holdsStartingLanes(program, resolveArg(word, 0), index, depth + 1u) && holdsStartingLanes(program, resolveArg(word, 1), index, depth + 1u);
+        return holdsStartingLanes(program, resolveArg(word, 0), index, coverage, depth + 1u) && holdsStartingLanes(program, resolveArg(word, 1), index, coverage, depth + 1u);
     }
     if (word.Opcode() == IrOpcode::BitwiseOr32) {
-        return holdsStartingLanes(program, resolveArg(word, 0), index, depth + 1u) || holdsStartingLanes(program, resolveArg(word, 1), index, depth + 1u);
+        return holdsStartingLanes(program, resolveArg(word, 0), index, coverage, depth + 1u) || holdsStartingLanes(program, resolveArg(word, 1), index, coverage, depth + 1u);
     }
+    if (word.Opcode() == IrOpcode::CompositeExtractU64 && isImmediateU32(resolveArg(word, 1), index)) {
+        const auto& mask = resolveArg(word, 0);
+        if (mask.Opcode() != IrOpcode::WqmU64) return false;
+        const auto& lanes = resolveArg(mask, 0);
+        return lanes.Opcode() == IrOpcode::CompositeConstructU64 && holdsStartingLanes(program, resolveArg(lanes, index), index, LaneCoverage::Real, depth + 1u);
+    }
+    if (coverage == LaneCoverage::Quads) return false;
     if (word.Opcode() != IrOpcode::CompositeExtractU32x4 || !isImmediateU32(resolveArg(word, 1), index)) return false;
     const auto& ballot = resolveArg(word, 0);
     if (ballot.Opcode() != IrOpcode::Ballot || !runsAllStartingLanes(program, ballot.Parent())) return false;
@@ -291,13 +300,8 @@ bool foldStartingQuadBitTest(const IrProgram& program, IrBuilder& builder, IrVal
     } else if (program.WaveSize() != 32u) {
         return false;
     }
-    if (low->Opcode() != IrOpcode::CompositeExtractU64 || !isImmediateU32(resolveArg(*low, 1), 0u)) return false;
-    const auto& wqm = resolveArg(*low, 0);
-    if (high != nullptr && (high->Opcode() != IrOpcode::CompositeExtractU64 || &resolveArg(*high, 0) != &wqm || !isImmediateU32(resolveArg(*high, 1), 1u))) return false;
-    if (wqm.Opcode() != IrOpcode::WqmU64) return false;
-    const auto& lanes = resolveArg(wqm, 0);
-    if (lanes.Opcode() != IrOpcode::CompositeConstructU64 || !holdsStartingLanes(program, resolveArg(lanes, 0), 0u)) return false;
-    if (high != nullptr && !holdsStartingLanes(program, resolveArg(lanes, 1), 1u)) return false;
+    if (!holdsStartingLanes(program, *low, 0u, LaneCoverage::Quads)) return false;
+    if (high != nullptr && !holdsStartingLanes(program, *high, 1u, LaneCoverage::Quads)) return false;
     replaceWith(inst, builder.ConstantBool(true));
     return true;
 }
diff --git a/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp b/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
index 170b97d6b8..f11023d4b4 100644
--- a/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
+++ b/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
@@ -1,5 +1,6 @@
 #include "Optimization/DescriptorBindingBuilder.hpp"
 #include "Optimization/ResourceMaterializer.hpp"
+#include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include "SpirvBackend/SpirvEmitterHelpers.hpp"
 #include "SpirvBackend/SpirvBufferFormat.hpp"
 #include <spirv/unified1/spirv.hpp>
@@ -138,6 +139,7 @@ std::vector<std::uint32_t> GuestBuffersDescriptor(const std::vector<std::uint32_
 
 std::vector<std::uint32_t> GuestSamplersDescriptor(const std::vector<std::uint32_t>& resources, const ResourceSnapshot& snapshot) {
     std::vector<std::uint32_t> result;
+    result.reserve(resources.size() * 4u);
     std::uint32_t dwordCount = 0;
     for (std::size_t i = 0; i < resources.size(); i++) {
         const std::uint32_t r = resources[i];
@@ -355,6 +357,8 @@ DescriptorBindingPlan DescriptorBindingBuilder::Prepare(const IrBindingLayout& l
     }
     for (std::uint32_t index = 0; index < info.images.size() && !registrationModules; ++index) {
         if (info.images[index].table != NoTable) continue;
+        const auto& modes = info.runtimeImageModes.at(index);
+        if (std::ranges::any_of(modes, [](const ImageResource& mode) { return mode.conversionFormat == FmaskExpansion; })) plan.specialization.push_back({PipelineSpecialization::FmaskFormatBase + index, modes.at(imageModes[index]).conversionFormat == FmaskExpansion ? (snapshot.images.at(index).dwords[1] >> 20u) & 0x1ffu : 0u});
         const auto first = PipelineSpecialization::ImageBase + index * PipelineSpecialization::ImageWords;
         plan.specialization.push_back({first, imageModes[index]});
         for (std::uint32_t component = 0; component < 4u; ++component) plan.specialization.push_back({first + 1u + component, (snapshot.images.at(index).dwords[3] >> (component * 3u)) & 7u});
@@ -564,6 +568,7 @@ void DescriptorBindingBuilder::Populate(BindingAllocationResult& allocation, con
     auto shaderData = needsShaderData ? ShaderDataDwordsFor(layout, userDataBase, snapshot, partialThreads, plan.imageMetadata, plan.runtimeState) : std::vector<std::uint32_t>{};
     allocation.shaderDataUserWords.clear();
     if (needsShaderData) {
+        allocation.shaderDataUserWords.reserve(layout.userDataRegisters.size());
         for (const auto reg : layout.userDataRegisters) allocation.shaderDataUserWords.push_back(reg - userDataBase);
     }
     std::vector<DescriptorBinding> bindings;
@@ -610,7 +615,7 @@ void DescriptorBindingBuilder::Populate(BindingAllocationResult& allocation, con
                 physical.imageShapes.push_back(ImageShapeForResource(shape));
                 physical.imageDepthCompare.push_back(element.depthCompare);
                 physical.imageWritten.push_back(ImageBindingResourceClass(element.kind) == ImageResourceClass::Storage);
-                physical.imageAtomic.push_back(false);
+                physical.imageAtomic.push_back(element.atomic);
                 std::uint32_t samplers = 0;
                 for (std::uint32_t sampler = 0; sampler < entry.tableSamplerMasks.size(); ++sampler) {
                     if ((element.samplers & (1u << sampler)) != 0u) samplers |= entry.tableSamplerMasks[sampler];
diff --git a/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp b/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp
index 97fbe47cb2..d2ebf74e9b 100644
--- a/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp
+++ b/core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp
@@ -1,6 +1,8 @@
 #include "Optimization/ReadLaneEliminator.hpp"
 #include <algorithm>
 #include <list>
+#include <map>
+#include <set>
 #include <queue>
 #include <stdexcept>
 #include <unordered_map>
@@ -52,44 +54,13 @@ struct LaneFlow {
 
 struct WindowFlows {
     const IrProgram* program = nullptr;
-    std::unordered_set<std::uint32_t> spillSlots;
     std::unordered_map<std::uint64_t, LaneFlow> flows;
     std::unordered_set<std::uint64_t> computing;
+    std::vector<std::pair<IrValue*, std::uint32_t>>* folded = nullptr;
 };
 
 thread_local WindowFlows* windowFlows = nullptr;
 
-std::unordered_set<std::uint32_t> collectLaneSpillSlots(const IrProgram& program) {
-    std::unordered_set<std::uint32_t> candidates;
-    std::unordered_set<std::uint32_t> rejected;
-    const auto immediateSlot = [](const IrValue& inst, std::uint32_t& slot) {
-        const IrValue* index = inst.Argument(0)->Resolve();
-        if (!isImmediateU32(*index)) return false;
-        slot = index->ImmediateU32();
-        return true;
-    };
-    for (const auto& block : program.Blocks()) {
-        for (const IrValue* inst : block->Instructions()) {
-            std::uint32_t slot = 0;
-            if (inst->Opcode() == IrOpcode::StoreVectorWindow) {
-                if (!immediateSlot(*inst, slot)) continue;
-                candidates.insert(slot);
-                if (inst->Argument(1)->Resolve()->Opcode() != IrOpcode::WriteLane) rejected.insert(slot);
-            } else if (inst->Opcode() == IrOpcode::LoadVectorWindow) {
-                if (!immediateSlot(*inst, slot)) continue;
-                candidates.insert(slot);
-                for (const IrUse& use : inst->OperandUses()) {
-                    const bool laneRead = use.user->Opcode() == IrOpcode::ReadLane && use.operand == 0u;
-                    const bool chained = use.user->Opcode() == IrOpcode::WriteLane && use.operand == 2u;
-                    if (!laneRead && !chained) rejected.insert(slot);
-                }
-            }
-        }
-    }
-    for (const auto slot : rejected) candidates.erase(slot);
-    return candidates;
-}
-
 LaneState windowLoadLane(const IrValue* load, std::uint32_t lane, std::uint32_t waveSize);
 
 LaneState storedLane(IrValue* value, std::uint32_t slot, std::uint32_t lane, std::uint32_t waveSize, const LaneFlow& flow) {
@@ -117,7 +88,6 @@ const LaneFlow* laneFlow(std::uint32_t slot, std::uint32_t lane, std::uint32_t w
     if (const auto found = flows.flows.find(key); found != flows.flows.end()) return &found->second;
     if (!flows.computing.insert(key).second) return nullptr;
     LaneFlow flow;
-    const bool spill = flows.spillSlots.contains(slot);
     const auto& blocks = flows.program->Blocks();
     constexpr int MaxPasses = 64;
     bool settled = false;
@@ -144,11 +114,7 @@ const LaneFlow* laneFlow(std::uint32_t slot, std::uint32_t lane, std::uint32_t w
                     }
                 } else if (inst->Opcode() == IrOpcode::StoreVectorWindow) {
                     const IrValue* index = inst->Argument(0)->Resolve();
-                    if (!isImmediateU32(*index)) {
-                        if (!spill) running = {LaneState::Kind::Unknown, nullptr};
-                        continue;
-                    }
-                    if (index->ImmediateU32() != slot) continue;
+                    if (!isImmediateU32(*index) || index->ImmediateU32() != slot) continue;
                     running = storedLane(inst->Argument(1), slot, lane, waveSize, flow);
                 }
             }
@@ -177,8 +143,98 @@ LaneState windowLoadLane(const IrValue* load, std::uint32_t lane, std::uint32_t
 
 WindowLane windowLane(IrValue* load, std::uint32_t lane, std::uint32_t waveSize) {
     const LaneState state = windowLoadLane(load, lane, waveSize);
-    if (state.kind == LaneState::Kind::Known) return {state.value, true};
-    return {};
+    if (state.kind != LaneState::Kind::Known) return {};
+    if (windowFlows != nullptr && windowFlows->folded != nullptr) windowFlows->folded->emplace_back(load, lane);
+    return {state.value, true};
+}
+
+IrValue* laneSource(IrValue* value, std::uint32_t lane, std::uint32_t waveSize) {
+    for (;;) {
+        value = value->Resolve();
+        if (value->Opcode() == IrOpcode::WriteLane) {
+            const IrValue* selector = value->Argument(1)->Resolve();
+            if (!isImmediateU32(*selector) || selector->ImmediateU32() % waveSize == lane) return nullptr;
+            value = value->Argument(2);
+            continue;
+        }
+        if (value->Opcode() != IrOpcode::LoadVectorWindow || !isImmediateU32(*value->Argument(0)->Resolve())) return nullptr;
+        return value;
+    }
+}
+
+IrValue& immediate(IrProgram& program, std::uint32_t value) {
+    IrValue& constant = program.CreateValue(IrOpcode::Void, IrType::U32);
+    constant.SetImmediateU32(value);
+    return constant;
+}
+
+std::size_t guardSpilledLanes(IrProgram& program, const std::vector<std::pair<IrValue*, std::uint32_t>>& folded, std::uint32_t waveSize) {
+    const auto keyOf = [](std::uint32_t slot, std::uint32_t lane) { return (static_cast<std::uint64_t>(slot) << 32u) | lane; };
+    std::map<std::uint64_t, std::unordered_set<const IrValue*>> used;
+    std::vector<std::uint64_t> work;
+    const auto use = [&](IrValue* load, std::uint32_t lane) {
+        const auto key = keyOf(load->Argument(0)->Resolve()->ImmediateU32(), lane);
+        if (!used[key].insert(load).second) return false;
+        work.push_back(key);
+        return true;
+    };
+    for (const auto& [load, lane] : folded) use(load, lane);
+    std::unordered_map<const IrValue*, std::set<std::uint64_t>> guarded;
+    while (!work.empty()) {
+        const auto key = work.back();
+        work.pop_back();
+        const auto slot = static_cast<std::uint32_t>(key >> 32u);
+        const auto lane = static_cast<std::uint32_t>(key);
+        const auto& usedLoads = used[key];
+        std::unordered_map<const IrBlock*, bool> liveIn;
+        for (bool changed = true; changed;) {
+            changed = false;
+            for (auto block = program.Blocks().rbegin(); block != program.Blocks().rend(); ++block) {
+                bool live = false;
+                for (const IrBlock* successor : (*block)->Successors()) live = live || liveIn[successor];
+                for (auto inst = (*block)->Instructions().rbegin(); inst != (*block)->Instructions().rend(); ++inst) {
+                    IrValue* value = *inst;
+                    if (value->Opcode() == IrOpcode::LoadVectorWindow) {
+                        live = live || usedLoads.contains(value);
+                        continue;
+                    }
+                    if (value->Opcode() != IrOpcode::StoreVectorWindow) continue;
+                    const IrValue* index = value->Argument(0)->Resolve();
+                    if (!isImmediateU32(*index)) {
+                        if (live) guarded[value].insert(key);
+                        continue;
+                    }
+                    if (index->ImmediateU32() != slot) continue;
+                    if (live) {
+                        if (IrValue* source = laneSource(value->Argument(1), lane, waveSize); source != nullptr && use(source, lane)) changed = true;
+                    }
+                    live = false;
+                }
+                if (const auto found = liveIn.find(block->get()); found == liveIn.end() || found->second != live) {
+                    changed = changed || live || found != liveIn.end();
+                    liveIn[block->get()] = live;
+                }
+            }
+        }
+    }
+    std::size_t guards = 0;
+    for (const auto& block : program.Blocks()) {
+        for (IrValue* store : std::vector<IrValue*>(block->Instructions().begin(), block->Instructions().end())) {
+            const auto found = guarded.find(store);
+            if (found == guarded.end()) continue;
+            IrValue& current = program.CreateValue(IrOpcode::LoadVectorWindow, IrType::U32);
+            current.AddArgument(store->Argument(0));
+            block->InsertInstructionBefore(store, &current);
+            for (const auto key : found->second) {
+                IrValue& guard = program.CreateValue(IrOpcode::WindowLaneGuard, IrType::Void);
+                for (IrValue* argument : {store->Argument(0), store->Argument(1), &current, &immediate(program, static_cast<std::uint32_t>(key >> 32u)), &immediate(program, static_cast<std::uint32_t>(key))}) guard.AddArgument(argument);
+                block->InsertInstructionBefore(store, &guard);
+                ++guards;
+            }
+        }
+    }
+    if (guards != 0u) program.Info().usesFaultBuffer = true;
+    return guards;
 }
 
 ChainResult searchChain(IrValue* value, std::uint32_t lane, std::uint32_t waveSize) {
@@ -362,7 +418,7 @@ ReadLaneEliminationStats ReadLaneEliminator::Eliminate(IrProgram& program, std::
     }
     WindowFlows flows;
     flows.program = &program;
-    flows.spillSlots = collectLaneSpillSlots(program);
+    std::vector<std::pair<IrValue*, std::uint32_t>> folded;
     struct FlowScope {
         ~FlowScope() { windowFlows = nullptr; }
     } flowScope;
@@ -381,6 +437,7 @@ ReadLaneEliminationStats ReadLaneEliminator::Eliminate(IrProgram& program, std::
             const std::uint32_t lane = selector->ImmediateU32() % waveSize;
             const ChainResult chain = searchChain(inst->Argument(0), lane, waveSize);
             if (chain.write != nullptr) {
+                if (chain.value->Opcode() == IrOpcode::LoadVectorWindow) folded.emplace_back(chain.value, lane);
                 inst->ReplaceUsesWith(chain.scalar, true);
                 stats.rewrittenReads++;
                 continue;
@@ -397,10 +454,14 @@ ReadLaneEliminationStats ReadLaneEliminator::Eliminate(IrProgram& program, std::
             }
 
             PhiMap phiMap;
-            inst->ReplaceUsesWith(getRealValue(program, phiMap, chain.value, lane, waveSize), true);
+            flows.folded = &folded;
+            IrValue* real = getRealValue(program, phiMap, chain.value, lane, waveSize);
+            flows.folded = nullptr;
+            inst->ReplaceUsesWith(real, true);
             stats.rewrittenReads++;
         }
     }
+    stats.guardedStores = static_cast<std::uint32_t>(guardSpilledLanes(program, folded, waveSize));
     return stats;
 }
 
diff --git a/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp b/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp
index 6e8c4e269d..df61fa400d 100644
--- a/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp
+++ b/core/shader/recompiler/Optimization/src/RedundantValueEliminator.cpp
@@ -122,12 +122,21 @@ bool Recomputable(IrOpcode opcode) {
         case IrOpcode::FPTrunc32:
         case IrOpcode::FPFract32:
         case IrOpcode::FPRoundEven32:
+        case IrOpcode::GetSrtResource:
+        case IrOpcode::ReadConst:
             return true;
         default:
             return false;
     }
 }
 
+bool ClobbersReadConst(IrOpcode opcode) {
+    const auto buffer = BufferAccessOf(opcode);
+    if (buffer == BufferAccess::Write || buffer == BufferAccess::Atomic) return true;
+    const auto address = AddressOpcodeInfoOf(opcode).access;
+    return address == AddressAccess::Write || address == AddressAccess::Atomic || opcode == IrOpcode::Barrier;
+}
+
 struct Operand {
     const IrValue* value;
     IrType type;
@@ -145,11 +154,12 @@ struct ValueKey {
     IrOpcode opcode;
     IrType type;
     std::uint64_t flags;
+    std::uint64_t memoryEpoch = 0;
     std::array<const IrValue*, 4> operands{};
     std::size_t operandCount = 0;
 
     bool operator==(const ValueKey& other) const {
-        if (opcode != other.opcode || type != other.type || flags != other.flags || operandCount != other.operandCount) return false;
+        if (opcode != other.opcode || type != other.type || flags != other.flags || memoryEpoch != other.memoryEpoch || operandCount != other.operandCount) return false;
         for (std::size_t index = 0; index < operandCount; ++index) {
             if (operands[index] != other.operands[index] && OperandOf(operands[index]) != OperandOf(other.operands[index])) return false;
         }
@@ -159,7 +169,7 @@ struct ValueKey {
 
 struct ValueKeyHash {
     std::size_t operator()(const ValueKey& key) const {
-        std::size_t hash = static_cast<std::size_t>(key.opcode) * 0x9e3779b97f4a7c15ull ^ static_cast<std::size_t>(key.type) ^ std::hash<std::uint64_t>{}(key.flags) * 31u;
+        std::size_t hash = static_cast<std::size_t>(key.opcode) * 0x9e3779b97f4a7c15ull ^ static_cast<std::size_t>(key.type) ^ std::hash<std::uint64_t>{}(key.flags) * 31u ^ std::hash<std::uint64_t>{}(key.memoryEpoch) * 131u;
         for (const auto* argument : std::span(key.operands).first(key.operandCount)) {
             const auto operand = OperandOf(argument);
             hash = hash * 1099511628211ull ^ std::hash<const void*>{}(operand.value) ^ std::hash<std::uint64_t>{}(operand.immediate) * 7u ^ static_cast<std::size_t>(operand.type);
@@ -222,13 +232,61 @@ std::vector<std::vector<IrBlock*>> DominatorChildren(const std::vector<IrBlock*>
 
 RedundantValueEliminationStats RedundantValueEliminator::Eliminate(IrProgram& program) const {
     RedundantValueEliminationStats stats;
+    if (program.BlockOrder().empty()) return stats;
+    const auto order = ReversePostOrder(*program.BlockOrder().front());
+    std::unordered_map<const IrBlock*, std::size_t> index;
+    const auto children = DominatorChildren(order, index);
+    for (const auto* block : program.BlockOrder()) {
+        if (!index.contains(block)) throw std::runtime_error("redundant value elimination: block " + std::to_string(block->Id()) + " is unreachable from the entry block");
+    }
+    std::uint64_t nextClobberEpoch = order.size() + 2u;
+    std::vector<std::uint64_t> firstClobber(order.size(), 0u);
+    std::vector<std::uint64_t> lastClobber(order.size(), 0u);
+    for (std::size_t position = 0; position < order.size(); ++position) {
+        firstClobber[position] = nextClobberEpoch;
+        for (const auto* inst : order[position]->Instructions()) {
+            if (ClobbersReadConst(inst->Opcode())) lastClobber[position] = nextClobberEpoch++;
+        }
+    }
+    std::vector<std::uint64_t> entryEpoch(order.size(), 0u);
+    const auto exitEpoch = [&](std::size_t position) -> std::uint64_t {
+        if (entryEpoch[position] == 0u) return 0u;
+        return lastClobber[position] != 0u ? lastClobber[position] : entryEpoch[position];
+    };
+    for (bool changed = true; changed;) {
+        changed = false;
+        for (std::size_t position = 0; position < order.size(); ++position) {
+            std::uint64_t candidate = position == 0u ? 1u : 0u;
+            for (const IrBlock* predecessor : order[position]->Predecessors()) {
+                const auto found = index.find(predecessor);
+                if (found == index.end()) continue;
+                const auto incoming = exitEpoch(found->second);
+                if (incoming == 0u) continue;
+                if (candidate == 0u) {
+                    candidate = incoming;
+                } else if (candidate != incoming) {
+                    candidate = position + 2u;
+                }
+            }
+            if (candidate != entryEpoch[position]) {
+                entryEpoch[position] = candidate;
+                changed = true;
+            }
+        }
+    }
     std::unordered_map<ValueKey, IrValue*, ValueKeyHash> available;
     std::vector<const ValueKey*> added;
     std::unordered_map<const IrValue*, IrValue*> replacements;
-    const auto visit = [&](IrBlock& block) {
-        for (auto* inst : block.Instructions()) {
+    const auto visit = [&](std::size_t position) {
+        std::uint64_t epoch = entryEpoch[position];
+        std::uint64_t nextClobber = firstClobber[position];
+        for (auto* inst : order[position]->Instructions()) {
+            if (ClobbersReadConst(inst->Opcode())) {
+                epoch = nextClobber++;
+                continue;
+            }
             if (!Recomputable(inst->Opcode()) || inst->HasImmediate() || !inst->HasUses()) continue;
-            ValueKey key{inst->Opcode(), inst->Type(), inst->Flags<std::uint64_t>()};
+            ValueKey key{inst->Opcode(), inst->Type(), inst->Flags<std::uint64_t>(), inst->Opcode() == IrOpcode::ReadConst ? epoch : 0u};
             key.operandCount = inst->ArgumentCount();
             if (key.operandCount > key.operands.size()) continue;
             for (std::size_t index = 0; index < key.operandCount; ++index) key.operands[index] = inst->Argument(index)->Resolve();
@@ -242,22 +300,15 @@ RedundantValueEliminationStats RedundantValueEliminator::Eliminate(IrProgram& pr
             ++stats.replacedValues;
         }
     };
-    if (program.BlockOrder().empty()) return stats;
-    const auto order = ReversePostOrder(*program.BlockOrder().front());
-    std::unordered_map<const IrBlock*, std::size_t> index;
-    const auto children = DominatorChildren(order, index);
-    for (const auto* block : program.BlockOrder()) {
-        if (!index.contains(block)) throw std::runtime_error("redundant value elimination: block " + std::to_string(block->Id()) + " is unreachable from the entry block");
-    }
     std::vector<std::pair<std::size_t, std::size_t>> stack{{0u, 0u}};
     std::vector<std::size_t> scopes{added.size()};
-    visit(*order[0]);
+    visit(0u);
     while (!stack.empty()) {
         auto& [position, next] = stack.back();
         if (next < children[position].size()) {
             const auto child = index.at(children[position][next++]);
             scopes.push_back(added.size());
-            visit(*order[child]);
+            visit(child);
             stack.emplace_back(child, 0u);
             continue;
         }
@@ -277,6 +328,9 @@ RedundantValueEliminationStats RedundantValueEliminator::Eliminate(IrProgram& pr
         replaced(info.indirectTarget);
     }
     for (auto*& read : program.Metadata().dynamicReads) replaced(read);
+    for (auto& descriptor : program.Resources().descriptorSources) {
+        for (auto*& dword : descriptor.dwords) replaced(dword);
+    }
     return stats;
 }
 
diff --git a/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp b/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
index 16bbae5c22..921b9bb653 100644
--- a/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
+++ b/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
@@ -1,9 +1,11 @@
 #include "Optimization/ResourceMaterializer.hpp"
 #include "Optimization/SrtWalker/SrtFlatSlotClasses.hpp"
 #include "Optimization/SrtWalker/SrtEvaluator.hpp"
+#include "Optimization/SrtWalker/SrtInstructionPredicates.hpp"
 #include "Optimization/ShaderStageInputInfo.hpp"
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include "RdnaDecoder/RdnaImageOpDecoder.hpp"
+#include "RdnaDecoder/RdnaInstructionDecoder.hpp"
 #include "SpirvBackend/SpirvBufferFormat.hpp"
 #include "ThreadOwned.hpp"
 #include "ImageTableAbi.hpp"
@@ -24,6 +26,7 @@
 #include <optional>
 #include <span>
 #include <unordered_map>
+#include <unordered_set>
 #include <stdexcept>
 #include <string>
 #include <utility>
@@ -118,6 +121,19 @@ RdnaImageDimension descriptorDimension(const DescriptorValue& descriptor, RdnaIm
     }
 }
 
+std::uint32_t imageCoordinates(RdnaImageDimension dimension) {
+    switch (dimension) {
+        case RdnaImageDimension::Dim1D: return 1u;
+        case RdnaImageDimension::Dim1DArray: case RdnaImageDimension::Dim2D: return 2u;
+        case RdnaImageDimension::Dim2DMsaaArray: return 4u;
+        default: return 3u;
+    }
+}
+
+bool multisamplePlaneRead(const ImageResource& image) {
+    return image.dimension == RdnaImageDimension::Dim2D && image.resourceClass == ImageResourceClass::Sampled && image.table == NoTable && !image.depthCompare && !image.r128 && image.cubeFaceCompatible;
+}
+
 bool validImageDescriptor(const DescriptorValue& descriptor, bool r128) {
     const auto type = rawImageType(descriptor);
     const auto format = rawImageFormat(descriptor);
@@ -191,7 +207,8 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
     if (!validImageDescriptor(descriptor, base.r128)) {
         return rejectImage(invalidImageReason(descriptor), "image descriptor is invalid");
     }
-    decoded.dimension = descriptorDimension(descriptor, base.dimension);
+    const bool queryLayers = base.dimension == RdnaImageDimension::Dim1D && base.dimensionQueryOnly && rawImageType(descriptor) == ImageType::Color2DArray;
+    decoded.dimension = descriptorDimension(descriptor, queryLayers ? RdnaImageDimension::Dim2DArray : base.dimension);
     if (base.depthCompare) {
         if (decoded.dimension == RdnaImageDimension::Dim1D) {
             decoded.dimension = RdnaImageDimension::Dim2D;
@@ -199,8 +216,12 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
             decoded.dimension = RdnaImageDimension::Dim2DArray;
         }
     }
+    if (GcnGuestShaders() && imageCoordinates(decoded.dimension) != imageCoordinates(base.dimension)) {
+        throw std::runtime_error("GCN image instruction on a descriptor of type " + std::to_string(static_cast<std::uint32_t>(rawImageType(descriptor))) + " needs a different address count than its inferred dimension; not implemented");
+    }
     decoded.cube = descriptorIsCube(descriptor);
     const auto format = rawImageFormat(descriptor);
+    if (decoded.dimension == RdnaImageDimension::Dim2DMsaa && rawImageType(descriptor) == ImageType::Color2DMsaa && multisamplePlaneRead(base) && !IsFmaskTextureFormat(format) && !IsDepthBitsTexture(descriptor.dwords[1], descriptor.dwords[3])) decoded.dimension = RdnaImageDimension::Dim2D;
     if (base.atomic64 && format != IrBufferFormat::Format32_32UInt && format != IrBufferFormat::Format32_32SInt && format != IrBufferFormat::Format32_32Float) {
         return rejectImage(PoisonReason::InvalidFormat, "64-bit atomic image descriptor uses an unsupported format " + std::to_string(static_cast<std::uint32_t>(format)));
     }
@@ -214,9 +235,14 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
     if (decoded.fmask && (storage || base.depthCompare || table)) {
         return rejectImage(PoisonReason::Fmask, "FMASK requires a direct sampled image load");
     }
-    if (decoded.fmask && format != IrBufferFormat::Fmask32_S8_F8) return rejectImage(PoisonReason::Fmask, "FMASK format is not implemented");
-    if (decoded.fmask && (descriptor.dwords[6] & (3u << 20u)) != 0u) return rejectImage(PoisonReason::Fmask, "FMASK CMASK compression is not implemented");
+    if (decoded.fmask && !FmaskLayoutOf(format).has_value()) return rejectImage(PoisonReason::Fmask, "FMASK format is not implemented");
+    if (decoded.fmask && ((descriptor.dwords[6] & (1u << 20u)) != 0u || ((descriptor.dwords[6] & (1u << 21u)) != 0u && (descriptor.dwords[6] >> 24u) == 0u && descriptor.dwords[7] == 0u))) return rejectImage(PoisonReason::Fmask, "FMASK CMASK compression is not implemented without readable metadata");
+    if (decoded.fmask && (descriptor.dwords[6] & (1u << 21u)) != 0u && format != IrBufferFormat::Fmask32_S8_F8) return rejectImage(PoisonReason::Fmask, "FMASK CMASK compression is implemented only for 8-sample, 8-fragment FMASK");
     if (decoded.fmask && (base.packed || base.byElements != 0u)) return rejectImage(PoisonReason::Fmask, "packed FMASK image reads are not implemented");
+    for (std::uint32_t component = 0; decoded.fmask && component < 4u; ++component) {
+        const auto selector = (descriptorImageSwizzle(descriptor) >> (component * 3u)) & 7u;
+        if (selector != 0u && selector != 1u && selector != 4u) return rejectImage(PoisonReason::Fmask, "FMASK destination channel selector is not implemented");
+    }
     if (base.packed) {
         if (table || (!storage && descriptorImageSwizzle(descriptor) != ShaderImageIdentitySwizzle)) {
             return rejectImage(PoisonReason::InvalidFormat, "packed image access requires a direct image, with identity swizzle when sampled");
@@ -237,7 +263,8 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
         }
     }
     const bool nativeRepacked = format == IrBufferFormat::Format10_11_11Float && !storage && !base.packed;
-    decoded.conversionFormat = RemapTextureFormat(format) != format && !nativeRepacked ? format : IrBufferFormat::Invalid;
+    const auto remappedFormat = storage ? RemapStorageTextureFormat(format) : RemapTextureFormat(format);
+    decoded.conversionFormat = remappedFormat != format && !nativeRepacked ? format : IrBufferFormat::Invalid;
     if (format == IrBufferFormat::Format11_11_10UNorm || (format == IrBufferFormat::Format10_11_11Float && !nativeRepacked)) {
         const bool floating = format == IrBufferFormat::Format10_11_11Float;
         if (!base.srgbDecodeCompatible) {
@@ -252,6 +279,7 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
             if (((descriptorImageSwizzle(descriptor) >> (component * 3u)) & 7u) == 7u) return rejectImage(PoisonReason::Conversion, "selects a channel the converted image format does not have");
         }
     }
+    if (decoded.fmask && format != IrBufferFormat::Fmask32_S8_F8) decoded.conversionFormat = FmaskExpansion;
     decoded.srgbDecode = !storage && !base.depthCompare && (srgbDecodeFormats & SrgbDecodeBit(format)) != 0u;
     if (decoded.srgbDecode && !base.srgbDecodeCompatible) {
         return rejectImage(PoisonReason::SrgbUnsupported, "samples or gathers an sRGB image the device cannot sample, which is not implemented");
@@ -262,7 +290,7 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
     const bool wideSint = format == IrBufferFormat::Format32SInt || format == IrBufferFormat::Format32_32SInt || format == IrBufferFormat::Format32_32_32_32SInt;
     const bool narrowSint = format == IrBufferFormat::Format16SInt || format == IrBufferFormat::Format8_8SInt || format == IrBufferFormat::Format16_16SInt || format == IrBufferFormat::Format8_8_8_8SInt || format == IrBufferFormat::Format16_16_16_16SInt;
     const bool rawSintStorage = storage && (wideSint || (narrowSint && !base.packed)) && base.written && !base.read && !base.atomic;
-    decoded.numericClass = base.atomic || decoded.fmask ? IrTextureNumericClass::Uint : nativeRepacked ? IrTextureNumericClass::Float : SampledTextureNumericClass(format);
+    decoded.numericClass = base.atomic || decoded.fmask ? IrTextureNumericClass::Uint : nativeRepacked ? IrTextureNumericClass::Float : SampledTextureNumericClass(remappedFormat);
     if (!storage && !base.depthCompare && IsDepthBitsTexture(descriptor.dwords[1], descriptor.dwords[3])) {
         decoded.depthBits = true;
         if (!base.depthBitsCompatible) return rejectImage(PoisonReason::DepthBits16, "runtime image reads depth bits as unsupported 16-bit results");
@@ -281,7 +309,9 @@ ImageDecode inspectImageDescriptor(const DescriptorValue& descriptor, const Imag
             decoded.conversionFormat = format;
         }
     } else if (decoded.numericClass == IrTextureNumericClass::Unsupported || (base.depthCompare && decoded.numericClass != IrTextureNumericClass::Float)) {
-        return rejectImage(PoisonReason::NumericClass, "sampled image descriptor uses an unsupported format");
+        char words[96];
+        std::snprintf(words, sizeof(words), " (T# %08x %08x %08x %08x %08x %08x %08x %08x)", descriptor.dwords[0], descriptor.dwords[1], descriptor.dwords[2], descriptor.dwords[3], descriptor.dwords[4], descriptor.dwords[5], descriptor.dwords[6], descriptor.dwords[7]);
+        return rejectImage(PoisonReason::NumericClass, std::string("sampled image descriptor uses an unsupported format") + words);
     }
     return result;
 }
@@ -640,6 +670,7 @@ private:
 
 struct WordsIndexTag {};
 struct ElementIndexTag {};
+struct SamplerIndexTag {};
 struct PoisonIndexTag {};
 struct TableRecordsTag {};
 
@@ -1285,6 +1316,12 @@ void materializeSnapshot(const IrResourcePlan& plan, const SrtRuntime& runtime,
         throw std::runtime_error("materialization sources are missing buffer descriptors");
     }
     snapshot.buffers.assign(values.begin(), values.begin() + plan.info.buffers.size());
+    if (GcnGuestShaders()) {
+        for (auto& buffer : snapshot.buffers) {
+            buffer.dwords[1] &= GcnBufferWord1Mask;
+            buffer.dwords[3] = GcnBufferWord3(buffer.dwords[1], buffer.dwords[3]);
+        }
+    }
     cursor += plan.info.buffers.size();
 
     snapshot.images.resize(plan.info.images.size());
@@ -1305,6 +1342,10 @@ void materializeSnapshot(const IrResourcePlan& plan, const SrtRuntime& runtime,
         if (descriptor.dwordCount != 8u) {
             throw std::runtime_error("image descriptor has an invalid width");
         }
+        if (GcnGuestShaders()) {
+            const auto words = GcnImageWords(std::span<const std::uint32_t, 8>(descriptor.dwords.data(), 8u));
+            std::copy(words.begin(), words.end(), descriptor.dwords.begin());
+        }
         const auto activity = plan.descriptorSources.size() + i;
         if (activity < activeSources.size() && activeSources[activity] == 0u) {
             descriptor = DescriptorValue{};
@@ -1646,6 +1687,7 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
         return Abi::PoisonCode(*index);
     };
     HashScratchIndex elementIndex{threadScratch<HashSlot, ElementIndexTag>()};
+    HashScratchIndex samplerIndex{threadScratch<HashSlot, SamplerIndexTag>()};
     std::vector<std::uint32_t> directSamplers(info.images.size(), 0u);
     for (const auto& pair : info.sampledPairs) {
         if (info.samplers.at(pair.sampler).table == NoTable) directSamplers.at(pair.image) |= 1u << pair.sampler;
@@ -1674,17 +1716,17 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
                 auto element = words.dwords;
                 if (mode.conversionFormat != IrBufferFormat::Invalid || mode.depthBits) element[3] = (element[3] & ~0xfffu) | ShaderImageIdentitySwizzle;
                 const auto kind = DescriptorBindingForImage(mode);
-                const auto hash = hashWords(element, (static_cast<std::uint64_t>(mode.dimension) << 16u) ^ (static_cast<std::uint64_t>(mode.depthCompare) << 8u) ^ static_cast<std::uint64_t>(kind));
+                const auto hash = hashWords(element, (static_cast<std::uint64_t>(image.atomic) << 24u) ^ (static_cast<std::uint64_t>(mode.dimension) << 16u) ^ (static_cast<std::uint64_t>(mode.depthCompare) << 8u) ^ static_cast<std::uint64_t>(kind));
                 auto index = elementIndex.Find(hash, [&](std::uint32_t known) {
                     const auto& entry = out.elements[known];
-                    return entry.words == element && entry.dimension == mode.dimension && entry.depthCompare == mode.depthCompare && entry.kind == kind;
+                    return entry.words == element && entry.dimension == mode.dimension && entry.depthCompare == mode.depthCompare && entry.kind == kind && entry.atomic == image.atomic;
                 });
                 if (!index.has_value() && out.elements.size() >= Abi::ImageElementBudget) {
                     record[Abi::ImageRecordFlags] = poison(resource, PoisonReason::Budget, &words);
                 } else {
                     if (!index.has_value()) {
                         index = static_cast<std::uint32_t>(out.elements.size());
-                        out.elements.push_back({element, mode.dimension, mode.depthCompare, kind, 0u});
+                        out.elements.push_back({element, mode.dimension, mode.depthCompare, kind, 0u, image.atomic});
                         elementIndex.Insert(hash, *index);
                     }
                     out.elements[*index].samplers |= directSamplers[resource];
@@ -1703,19 +1745,29 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
             record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Unnormalized, &words);
         } else if (((words.dwords[0] >> 29u) & 3u) != 0u) {
             record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Reduction, &words);
-        } else if (out.samplers.size() + Abi::SamplerEntryElements > Abi::SamplerElementBudget) {
-            record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Budget, &words);
         } else {
-            record[Abi::SamplerRecordElement] = static_cast<std::uint32_t>(out.samplers.size());
-            for (std::uint32_t variant = 0; variant < 2u; variant++) {
-                const bool compare = variant == 1u;
-                for (std::uint32_t point = 0; point < 2u; point++) {
-                    ImageTableSamplerElement element;
-                    std::copy_n(words.dwords.begin(), 4u, element.words.begin());
-                    element.compare = compare;
-                    element.point = point != 0u;
-                    out.samplers.push_back(element);
+            const auto hash = hashWords(std::span(words.dwords.data(), 4u), 0);
+            auto index = samplerIndex.Find(hash, [&](std::uint32_t known) {
+                return std::equal(words.dwords.begin(), words.dwords.begin() + 4u, out.samplers[known].words.begin());
+            });
+            if (!index.has_value() && out.samplers.size() + Abi::SamplerEntryElements > Abi::SamplerElementBudget) {
+                record[Abi::SamplerRecordFlags] = poison(resource, PoisonReason::Budget, &words);
+            } else {
+                if (!index.has_value()) {
+                    index = static_cast<std::uint32_t>(out.samplers.size());
+                    for (std::uint32_t variant = 0; variant < 2u; variant++) {
+                        const bool compare = variant == 1u;
+                        for (std::uint32_t point = 0; point < 2u; point++) {
+                            ImageTableSamplerElement element;
+                            std::copy_n(words.dwords.begin(), 4u, element.words.begin());
+                            element.compare = compare;
+                            element.point = point != 0u;
+                            out.samplers.push_back(element);
+                        }
+                    }
+                    samplerIndex.Insert(hash, *index);
                 }
+                record[Abi::SamplerRecordElement] = *index;
             }
         }
         const auto offset = static_cast<std::uint32_t>(out.map.size());
@@ -1787,7 +1839,12 @@ ResolvedImageTables ResourceMaterializer::ResolveImageTables(const ShaderInfo& i
 }
 
 std::shared_ptr<const ResolvedImageTables> ResourceMaterializer::ResolveImageTablesShared(const ShaderInfo& info, const ResourceSnapshot& snapshot, std::uint64_t memoKey) {
-    if (memoKey == 0u || snapshot.tables.tables.empty() || !TableResolutionReuse()) return std::make_shared<const ResolvedImageTables>(ResolveImageTables(info, snapshot, memoKey));
+    if (snapshot.tables.tables.empty()) {
+        static const auto none = std::make_shared<const ResolvedImageTables>();
+        static_cast<void>(ResolveImageTables(info, snapshot, memoKey));
+        return none;
+    }
+    if (memoKey == 0u || !TableResolutionReuse()) return std::make_shared<const ResolvedImageTables>(ResolveImageTables(info, snapshot, memoKey));
     auto reducing = reducingSamplers(info, snapshot);
     auto& memo = resolutionMemo();
     auto& totals = tableReuseTotals();
@@ -1823,6 +1880,7 @@ std::shared_ptr<const ResolvedImageTables> ResourceMaterializer::ResolveImageTab
 }
 
 std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageResource& image) {
+    if (image.targetMerge) return {image};
     const bool table = image.table != NoTable;
     if (table && image.tableOperation == TableOperation::Unsupported) return {};
     std::vector<ImageResource> modes;
@@ -1839,7 +1897,7 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
         mode.shaderSwizzle = ShaderImageIdentitySwizzle;
         if (conversion == IrBufferFormat::Format11_11_10UNorm || conversion == IrBufferFormat::Format10_11_11Float) mode.shaderSwizzle = 0x2acu;
         modes.push_back(mode);
-        const bool volumeLoad = (image.dimension == RdnaImageDimension::Dim2D || image.dimension == RdnaImageDimension::Dim2DArray) && image.fmaskCompatible;
+        const bool volumeLoad = (image.dimension == RdnaImageDimension::Dim2D || image.dimension == RdnaImageDimension::Dim2DArray) && image.fmaskCompatible && conversion != FmaskExpansion;
         const bool volumeStore = image.dimension == RdnaImageDimension::Dim2DArray && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage;
         const bool volumePlaneBias = image.dimension == RdnaImageDimension::Dim2D && image.singleMipPlaneBiasCompatible && !storage && image.table == NoTable && conversion == IrBufferFormat::Invalid;
         const bool volumeArraySample = image.dimension == RdnaImageDimension::Dim2DArray && image.volumeArraySampleCompatible && !storage && image.table == NoTable && conversion == IrBufferFormat::Invalid;
@@ -1848,6 +1906,12 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             volume.dimension = RdnaImageDimension::Dim3D;
             modes.push_back(volume);
         }
+        const bool arrayStore = image.dimension == RdnaImageDimension::Dim3D && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage;
+        if (arrayStore && !depth && packed == IrBufferFormat::Invalid && image.byElements == 0u) {
+            auto array = mode;
+            array.dimension = RdnaImageDimension::Dim2DArray;
+            modes.push_back(array);
+        }
         if (image.dimension == RdnaImageDimension::Dim2DMsaa && image.fmaskCompatible && image.cubeFaceCompatible && !table && !storage && !depth && conversion == IrBufferFormat::Invalid && packed == IrBufferFormat::Invalid && image.byElements == 0u) {
             auto plane = mode;
             plane.dimension = RdnaImageDimension::Dim2D;
@@ -1882,11 +1946,24 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             line.dimension = RdnaImageDimension::Dim1D;
             modes.push_back(line);
         }
-        if (image.dimension == RdnaImageDimension::Dim1D && !storage && !depth && conversion == IrBufferFormat::Invalid && packed == IrBufferFormat::Invalid) {
+        const bool planeAdded = image.dimension == RdnaImageDimension::Dim1D && !storage && !depth && conversion == IrBufferFormat::Invalid && packed == IrBufferFormat::Invalid;
+        if (planeAdded) {
             auto plane = mode;
             plane.dimension = RdnaImageDimension::Dim2D;
             modes.push_back(plane);
         }
+        if (image.dimension == RdnaImageDimension::Dim1D && image.dimensionQueryOnly && !storage) {
+            for (const auto dimension : {RdnaImageDimension::Dim2D, RdnaImageDimension::Dim2DArray, RdnaImageDimension::Dim3D}) {
+                if (dimension == RdnaImageDimension::Dim2D && planeAdded) continue;
+                auto view = mode;
+                view.dimension = dimension;
+                modes.push_back(view);
+            }
+            auto cube = mode;
+            cube.dimension = RdnaImageDimension::Dim2DArray;
+            cube.cube = true;
+            modes.push_back(cube);
+        }
         if (image.dimension == RdnaImageDimension::Dim1DArray || image.dimension == RdnaImageDimension::Dim2DArray || image.dimension == RdnaImageDimension::Dim2DMsaaArray) {
             auto plain = mode;
             plain.dimension = image.dimension == RdnaImageDimension::Dim1DArray ? RdnaImageDimension::Dim1D : image.dimension == RdnaImageDimension::Dim2DArray ? RdnaImageDimension::Dim2D : RdnaImageDimension::Dim2DMsaa;
@@ -1923,11 +2000,17 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             append(IrTextureNumericClass::Uint, IrBufferFormat::Format11_11_10UInt, IrBufferFormat::Invalid, false, false);
             if ((image.srgbDecodeCompatible || (image.convertedSamples && convertedSampleCompatible(image))) && image.depthBitsCompatible) append(IrTextureNumericClass::Uint, IrBufferFormat::Format11_11_10UNorm, IrBufferFormat::Invalid, false, false);
             if (image.srgbDecodeCompatible && image.depthBitsCompatible) append(IrTextureNumericClass::Uint, IrBufferFormat::Format10_11_11Float, IrBufferFormat::Invalid, false, false);
+            if (storage) {
+                for (const auto format : {IrBufferFormat::Format5_6_5UNorm, IrBufferFormat::Format5_5_5_1UNorm, IrBufferFormat::Format4_4_4_4UNorm}) {
+                    append(IrTextureNumericClass::Uint, format, IrBufferFormat::Invalid, false, false);
+                }
+            }
             if (!storage) {
                 if (image.depthBitsCompatible) {
                     append(IrTextureNumericClass::Float, IrBufferFormat::Invalid, IrBufferFormat::Invalid, true, false);
                     append(IrTextureNumericClass::Float, IrBufferFormat::Invalid, IrBufferFormat::Invalid, true, true);
                 }
+                if (image.fmaskCompatible && !table) append(IrTextureNumericClass::Uint, FmaskExpansion, IrBufferFormat::Invalid, false, false);
             }
         }
     }
@@ -2137,63 +2220,141 @@ void ResourceMaterializer::PrepareImageModes(ShaderInfo& info) {
 
 namespace {
 
+std::vector<const IrValue*> pathToMemoryRead(const IrValue& handle) {
+    std::unordered_map<const IrValue*, const IrValue*> parents;
+    std::vector<const IrValue*> queue;
+    const auto visit = [&](const IrValue* argument, const IrValue* parent) {
+        if (argument == nullptr) return;
+        argument = argument->Resolve();
+        if (!argument->HasImmediate() && parents.emplace(argument, parent).second) queue.push_back(argument);
+    };
+    for (const auto* argument : handle.Arguments()) visit(argument, nullptr);
+    for (std::size_t index = 0; index < queue.size(); ++index) {
+        const auto* value = queue[index];
+        if (Detail::IsMemoryRead(value->Opcode())) {
+            std::vector<const IrValue*> path;
+            for (const auto* step = parents.at(value); step != nullptr; step = parents.at(step)) path.push_back(step);
+            return path;
+        }
+        for (const auto* argument : value->Arguments()) visit(argument, value);
+    }
+    return {};
+}
+
 void ownPlanValues(IrResourcePlan& plan) {
     std::vector<IrValue**> roots;
     for (auto& source : plan.descriptorSources) {
         for (auto& dword : source.dwords) roots.push_back(&dword);
     }
     for (auto& read : plan.srtReads) roots.push_back(&read.value);
-    for (auto& block : plan.controlFlow) roots.push_back(&block.condition);
     for (auto& value : plan.uniformFill.values) roots.push_back(&value);
+    const auto closures = roots.size();
+    for (auto& block : plan.controlFlow) roots.push_back(&block.condition);
 
-    std::unordered_map<const IrValue*, IrValue*> clones;
-    std::vector<const IrValue*> order;
-    std::vector<const IrValue*> pending;
-    for (const auto* root : roots) {
-        if (*root != nullptr) pending.push_back(*root);
-    }
-    while (!pending.empty()) {
-        const auto* value = pending.back();
-        pending.pop_back();
-        if (!clones.emplace(value, nullptr).second) continue;
-        order.push_back(value);
-        for (const auto* argument : value->Arguments()) {
-            if (argument != nullptr) pending.push_back(argument);
+    std::unordered_set<const IrValue*> whole;
+    std::unordered_set<const IrValue*> linked;
+    for (;;) {
+        std::unordered_map<const IrValue*, IrValue*> clones;
+        std::unordered_set<const IrValue*> closed;
+        std::unordered_set<const IrValue*> opened;
+        std::unordered_set<const IrValue*> handles;
+        std::vector<const IrValue*> phis;
+        std::vector<const IrValue*> order;
+        std::vector<std::pair<const IrValue*, bool>> pending;
+        for (std::size_t index = 0; index < roots.size(); ++index) {
+            if (*roots[index] != nullptr) pending.emplace_back(*roots[index], index < closures);
         }
-    }
-    plan.valueStorage.Reserve(order.size());
-    for (const auto* value : order) {
-        auto* clone = plan.valueStorage.Create(value->Opcode(), value->Type(), static_cast<std::uint32_t>(plan.valueStorage.Size()));
-        clone->SetFlags(value->Flags<std::uint64_t>());
-        if (value->HasImmediate()) clone->SetImmediateU64(value->ImmediateU64());
-        clone->SetRegister(value->Register());
-        clones[value] = clone;
-    }
-    std::unordered_map<const IrBlock*, IrBlock*> blocks;
-    const auto blockFor = [&](const IrBlock* block) {
-        auto& clone = blocks[block];
-        if (clone == nullptr) {
-            plan.blockStorage.push_back(std::make_unique<IrBlock>(block->Id()));
-            clone = plan.blockStorage.back().get();
+        while (!pending.empty()) {
+            const auto value = pending.back().first;
+            const auto closure = pending.back().second || whole.contains(value);
+            pending.pop_back();
+            if (clones.emplace(value, nullptr).second) order.push_back(value);
+            auto reads = closure ? Detail::EvaluatorReads::Closure : Detail::Evaluator::Reads(plan, *value);
+            if (reads == Detail::EvaluatorReads::Nothing && linked.contains(value)) reads = Detail::EvaluatorReads::Arguments;
+            if (reads == Detail::EvaluatorReads::Nothing || closed.contains(value)) continue;
+            if (closure) {
+                closed.insert(value);
+            } else if (!opened.insert(value).second) {
+                continue;
+            } else if (value->IsPhi()) {
+                phis.push_back(value);
+            }
+            for (const auto* argument : value->Arguments()) {
+                if (argument != nullptr) pending.emplace_back(argument, closure);
+            }
+            if (!closure && reads == Detail::EvaluatorReads::Closure && value->ArgumentCount() != 0u && value->Argument(0) != nullptr) {
+                const auto* handle = value->Argument(0)->Resolve();
+                handles.insert(handle);
+                if (opened.insert(handle).second) {
+                    for (const auto* argument : handle->Arguments()) {
+                        if (argument != nullptr) pending.emplace_back(argument, false);
+                    }
+                }
+            }
         }
-        return clone;
-    };
-    for (const auto* value : order) {
-        std::vector<IrValue*> arguments;
-        std::vector<IrBlock*> phiBlocks;
-        arguments.reserve(value->ArgumentCount());
-        if (value->IsPhi()) phiBlocks.reserve(value->ArgumentCount());
-        for (std::size_t index = 0; index < value->ArgumentCount(); index++) {
-            const auto* argument = value->Argument(index);
-            arguments.push_back(argument == nullptr ? nullptr : clones.at(argument));
-            if (value->IsPhi()) phiBlocks.push_back(blockFor(value->PhiBlock(index)));
+        IrValueArena storage;
+        storage.Reserve(order.size());
+        for (const auto* value : order) {
+            auto* clone = storage.Create(value->Opcode(), value->Type(), static_cast<std::uint32_t>(storage.Size()));
+            clone->SetFlags(value->Flags<std::uint64_t>());
+            if (value->HasImmediate()) clone->SetImmediateU64(value->ImmediateU64());
+            clone->SetRegister(value->Register());
+            clones[value] = clone;
         }
-        clones.at(value)->SetDetachedOperands(std::move(arguments), std::move(phiBlocks));
+        std::vector<std::unique_ptr<IrBlock>> blockStorage;
+        std::unordered_map<const IrBlock*, IrBlock*> blocks;
+        const auto blockFor = [&](const IrBlock* block) {
+            auto& clone = blocks[block];
+            if (clone == nullptr) {
+                blockStorage.push_back(std::make_unique<IrBlock>(block->Id()));
+                clone = blockStorage.back().get();
+            }
+            return clone;
+        };
+        for (const auto* value : order) {
+            const auto count = closed.contains(value) || opened.contains(value) ? value->ArgumentCount() : 0u;
+            std::vector<IrValue*> arguments;
+            std::vector<IrBlock*> phiBlocks;
+            arguments.reserve(count);
+            if (value->IsPhi()) phiBlocks.reserve(count);
+            for (std::size_t index = 0; index < count; index++) {
+                const auto* argument = value->Argument(index);
+                arguments.push_back(argument == nullptr ? nullptr : clones.at(argument));
+                if (value->IsPhi()) phiBlocks.push_back(blockFor(value->PhiBlock(index)));
+            }
+            clones.at(value)->SetDetachedOperands(std::move(arguments), std::move(phiBlocks));
+        }
+        const auto resolvesAlike = [&](const IrValue* phi) {
+            try {
+                const auto* expected = ResolveInvariantPhi(plan, const_cast<IrValue*>(phi));
+                const auto* copied = ResolveInvariantPhi(plan, clones.at(phi));
+                if (expected == nullptr) return copied == nullptr;
+                const auto found = clones.find(expected);
+                return found != clones.end() && found->second == copied;
+            } catch (const std::exception&) {
+                return false;
+            }
+        };
+        bool grown = false;
+        for (const auto* phi : phis) {
+            if (!closed.contains(phi) && !resolvesAlike(phi)) grown = whole.insert(phi).second || grown;
+        }
+        for (const auto* handle : handles) {
+            if (closed.contains(handle) || Detail::LoadedFromMemory(*clones.at(handle))) continue;
+            const auto path = pathToMemoryRead(*handle);
+            bool linkedStep = false;
+            for (const auto* step : path) linkedStep = linked.insert(step).second || linkedStep;
+            if (!path.empty()) grown = (linkedStep || whole.insert(handle).second) || grown;
+        }
+        if (grown) continue;
+        plan.valueStorage = std::move(storage);
+        plan.blockStorage = std::move(blockStorage);
+        for (auto* root : roots) {
+            if (*root != nullptr) *root = clones.at(*root);
+        }
+        plan.denseValueIds = true;
+        return;
     }
-    for (auto* root : roots) {
-        if (*root != nullptr) *root = clones.at(*root);
-    }
-    plan.denseValueIds = true;
 }
 
 void buildCompactPlan(IrResourcePlan& plan) {
@@ -2273,9 +2434,8 @@ IrResourcePlan ResourceMaterializer::ExtractPlan(const IrProgram& program) const
     PrepareImageModes(plan.info);
     plan.uniformFill = source.uniformFill;
     for (auto& block : plan.controlFlow) {
-        if (block.condition != nullptr && !Detail::Evaluator::MayEvaluate(source, block.condition)) block.condition = nullptr;
+        if (block.condition != nullptr && !Detail::Evaluator::MayDecide(source, block.condition)) block.condition = nullptr;
     }
-    ownPlanValues(plan);
     const auto addSource = [&plan](std::uint32_t index) {
         if (index >= plan.descriptorSources.size()) {
             throw std::runtime_error("ResourceMaterializer::ExtractPlan resource references an unknown descriptor source");
@@ -2302,6 +2462,7 @@ IrResourcePlan ResourceMaterializer::ExtractPlan(const IrProgram& program) const
     }
     plan.pureFlatSlots = Detail::ComputePureFlatSlots(plan);
     plan.guardedSrtSlots = Detail::ComputeGuardedFlatSlots(plan);
+    ownPlanValues(plan);
     buildCompactPlan(plan);
     return plan;
 }
diff --git a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp
index 0ffeb3be74..ee6873ef41 100644
--- a/core/shader/recompiler/Optimization/src/ResourceTracker.cpp
+++ b/core/shader/recompiler/Optimization/src/ResourceTracker.cpp
@@ -751,6 +751,68 @@ private:
         return true;
     }
 
+    IrValue* UnwrapTableRead(IrValue* value) const {
+        if (value == nullptr) return nullptr;
+        value = value->Resolve();
+        if (!value->IsPhi()) return value;
+        IrValue* candidate = nullptr;
+        std::vector<IrValue*> pending{value};
+        std::unordered_set<const IrValue*> visited;
+        while (!pending.empty()) {
+            auto* current = pending.back()->Resolve();
+            pending.pop_back();
+            if (!visited.insert(current).second) continue;
+            if (current->IsPhi()) {
+                for (std::size_t i = 0; i < current->ArgumentCount(); i++) {
+                    pending.push_back(current->Argument(i));
+                }
+                continue;
+            }
+            std::uint32_t memoryIndex = 0;
+            IrValue* key = nullptr;
+            std::uint32_t stride = 0;
+            std::uint32_t addend = 0;
+            if (ScalarReadMemory(*current, memoryIndex) == nullptr || !MemoryIndexBelongsTo(memoryIndex, *current) ||
+                !MatchAffineOffset(current->Argument(1), key, stride, addend)) {
+                return nullptr;
+            }
+            if (candidate == nullptr) {
+                candidate = current;
+            } else if (!EquivalentValue(m_program.Resources(), candidate, current)) {
+                std::uint32_t candidateIndex = 0;
+                const auto* candMem = ScalarReadMemory(*candidate, candidateIndex);
+                const auto* curMem = ScalarReadMemory(*current, memoryIndex);
+                if (candMem == nullptr || curMem == nullptr || candMem->offset != curMem->offset ||
+                    !EquivalentValue(m_program.Resources(), candidate->Argument(0), current->Argument(0)) ||
+                    !EquivalentValue(m_program.Resources(), candidate->Argument(1), current->Argument(1))) {
+                    return nullptr;
+                }
+            }
+        }
+        return candidate;
+    }
+
+    bool BlockDominates(const IrBlock* dominator, const IrBlock* block) const {
+        if (dominator == block) return true;
+        std::vector<const IrBlock*> pending{block};
+        std::unordered_set<const IrBlock*> visited{block};
+        while (!pending.empty()) {
+            const IrBlock* current = pending.back();
+            pending.pop_back();
+            if (current->Predecessors().empty()) return false;
+            for (const IrBlock* predecessor : current->Predecessors()) {
+                if (predecessor != dominator && visited.insert(predecessor).second) pending.push_back(predecessor);
+            }
+        }
+        return true;
+    }
+
+    bool AvailableAt(IrValue* value, const IrBlock* block) const {
+        value = value->Resolve();
+        if (value->HasImmediate() || value->Parent() == nullptr) return true;
+        return BlockDominates(value->Parent(), block);
+    }
+
     bool TryMakeIndirectColumn(IrValue& handle, IrValue& descriptorPointer, bool sampler, std::uint32_t words, std::uint32_t descriptorOffset, std::uint32_t descriptorImmediate, TableColumnPlan& plan) {
         std::vector<PointerHop> hops;
         IrValue* pointer = &descriptorPointer;
@@ -788,7 +850,10 @@ private:
         IrValue* offset = nullptr;
         std::uint32_t first = 0;
         for (std::uint32_t dword = 0; dword < 2u; dword++) {
-            IrValue* read = pointer->Argument(dword)->Resolve();
+            IrValue* read = UnwrapTableRead(pointer->Argument(dword));
+            if (read == nullptr) {
+                return false;
+            }
             std::uint32_t memoryIndex = 0;
             const MemoryInfo* memory = ScalarReadMemory(*read, memoryIndex);
             if (memory == nullptr || !MemoryIndexBelongsTo(memoryIndex, *read)) {
@@ -802,6 +867,9 @@ private:
                 return false;
             }
         }
+        if (!AvailableAt(offset, handle.Parent())) {
+            return false;
+        }
         IrValue* key = nullptr;
         std::uint32_t stride = 0;
         std::uint32_t addend = 0;
@@ -1707,7 +1775,7 @@ private:
                 continue;
             }
             image.table = next++;
-            if (image.atomic || image.packed || image.byElements != 0u) {
+            if (image.atomic64 || image.packed || image.byElements != 0u) {
                 image.tableOperation = TableOperation::Unsupported;
             }
         }
@@ -1879,6 +1947,7 @@ private:
         const bool flatLineAccess = image.dimension == RdnaImageDimension::Dim2DArray ? flatLineLevelZero || flatLineExplicitLod : flatLineLoad || flatLineSample || flatLineExplicitLod;
         image.flatLineCompatible = image.flatLineCompatible && flatLineAccess && !memory.imagePacked && memory.imageByElements == 0u;
         image.flatVolumeLineCompatible = image.flatVolumeLineCompatible && (flatLineLoad || flatLineSample) && !memory.imagePacked && memory.imageByElements == 0u;
+        image.dimensionQueryOnly = image.dimensionQueryOnly && op == IrOpcode::ImageQueryDimensions;
         if ((memory.imageSampleFlags & RdnaImageSampleFlagCompare) != 0u) {
             constexpr auto unsupported = RdnaImageSampleFlagLod | RdnaImageSampleFlagDerivative;
             if (op == IrOpcode::ImageGatherRaw || (memory.imageSampleFlags & unsupported) != 0u) image.emulatedCompare |= EmulatedCompare::Unsupported;
diff --git a/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp b/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp
index b7f35bb4c1..472ade83d6 100644
--- a/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp
+++ b/core/shader/recompiler/Optimization/src/ShaderInfoCollector.cpp
@@ -1,4 +1,5 @@
 #include "Optimization/ShaderInfoCollector.hpp"
+#include "Optimization/ResourceMaterializer.hpp"
 #include <algorithm>
 #include <array>
 #include <cstdint>
@@ -285,6 +286,8 @@ void CollectPixelInputs(const IrProgram& program, const ShaderPixelInputInfo* pi
     std::array<bool, 32> perVertex {};
     std::array<bool, 32> interpolated {};
     std::array<bool, 32> halfRead {};
+    std::array<bool, 32> readsP10 {};
+    std::array<bool, 32> readsP20 {};
     for (const auto& block : program.Blocks()) {
         for (const IrValue* inst : block->Instructions()) {
             if (inst->Opcode() == IrOpcode::GetAttribute) {
@@ -298,7 +301,9 @@ void CollectPixelInputs(const IrProgram& program, const ShaderPixelInputInfo* pi
                 const auto input = inst->Argument(0)->Resolve()->ImmediateU32();
                 const auto mode = inst->Argument(2)->Resolve()->ImmediateU32();
                 read[input] = true;
-                perVertex[input] = perVertex[input] || mode == 1u || !IsPixelParameterFlat(*pixel, input);
+                readsP10[input] = readsP10[input] || mode == 0u;
+                readsP20[input] = readsP20[input] || mode == 1u;
+                perVertex[input] = perVertex[input] || (readsP10[input] && readsP20[input]) || !IsPixelParameterFlat(*pixel, input);
             } else if (inst->Opcode() == IrOpcode::GetInterpolationParameterF16) {
                 const auto input = inst->Argument(0)->Resolve()->ImmediateU32();
                 const bool high = inst->Argument(3)->Resolve()->ImmediateU32() != 0u;
@@ -419,8 +424,11 @@ void CollectBuiltinInputs(const IrProgram& program, ShaderInfo& info) {
                     AddInput(info, kind, 0, 1, "gl_SampleMaskIn");
                     break;
                 case StageInputKind::BaryCoordSmooth:
+                    AddInput(info, StageInputKind::BaryCoordSmooth, 0, 3, "gl_BaryCoordKHR");
+                    break;
                 case StageInputKind::BaryCoordSmoothCenter:
                 case StageInputKind::BaryCoordSmoothSample:
+                    info.smoothOffsetBarycentrics = true;
                     AddInput(info, StageInputKind::BaryCoordSmooth, 0, 3, "gl_BaryCoordKHR");
                     if (kind == StageInputKind::BaryCoordSmoothSample && program.Metadata().pixelIteratesSamples) AddInput(info, StageInputKind::SampleId, 0, 1, "gl_SampleID");
                     break;
@@ -548,6 +556,25 @@ std::uint16_t SamplerUseOf(IrOpcode opcode, std::uint32_t flags, IrShaderStage s
     return static_cast<std::uint16_t>(use);
 }
 
+void AddTargetMerge(const ShaderPixelInputInfo& pixel, ShaderInfo& info) {
+    if (info.runtimeImageModes.size() != info.images.size() || std::ranges::any_of(info.images, [](const ImageResource& image) { return image.targetMerge; })) {
+        return Fail("color target merge image cannot join the prepared images");
+    }
+    ImageResource image;
+    image.source = std::numeric_limits<std::uint32_t>::max();
+    image.resourceClass = ImageResourceClass::Storage;
+    image.numericClass = IrTextureNumericClass::Uint;
+    image.dimension = pixel.mergeSamples > 1u ? RdnaImageDimension::Dim2DMsaa : RdnaImageDimension::Dim2D;
+    image.read = true;
+    image.written = true;
+    image.fmaskCompatible = false;
+    image.targetMerge = true;
+    info.images.push_back(image);
+    info.runtimeImageModes.push_back(ResourceMaterializer::RuntimeImageModes(image));
+    AddInput(info, StageInputKind::FragCoord, 0, 4, "gl_FragCoord");
+    if (pixel.mergeSamples > 1u) AddInput(info, StageInputKind::SampleId, 0, 1, "gl_SampleID");
+}
+
 void CollectSamplerUses(const IrProgram& program, ShaderInfo& info) {
     for (auto& sampler : info.samplers) {
         sampler.uses = 0;
@@ -596,7 +623,7 @@ void ShaderInfoCollector::Collect(IrProgram& program, const ShaderStageInputInfo
             return SharedAccessOf(inst->Opcode()) == SharedAccess::Atomic && inst->Type() == IrType::U64;
         });
     });
-    next.usesFaultBuffer = next.usesFaultBuffer || (next.sharedMemoryBytes != 0u && ldsAtomic64);
+    next.usesFaultBuffer = next.usesFaultBuffer || ldsAtomic64;
     switch (program.Resources().stage) {
         case IrShaderStage::Vertex:
         case IrShaderStage::Local:
@@ -620,6 +647,8 @@ void ShaderInfoCollector::Collect(IrProgram& program, const ShaderStageInputInfo
     }
     CollectBuiltinInputs(program, next);
     CollectOutputs(program, inputInfo, next);
+    if (program.Resources().stage == IrShaderStage::Pixel && inputInfo.pixel->mergeMask != 0u) AddTargetMerge(*inputInfo.pixel, next);
+    if ((program.Resources().stage == IrShaderStage::Vertex || program.Resources().stage == IrShaderStage::Mesh) && inputInfo.vertex != nullptr && inputInfo.vertex->pointList) AddOutput(next, StageOutputKind::PointSize, 0, 0, "gl_PointSize");
     CollectSamplerUses(program, next);
     program.Info() = std::move(next);
     program.Metadata().shaderInfoComplete = true;
diff --git a/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp b/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp
index 3369a7457a..75d62f0546 100644
--- a/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp
+++ b/core/shader/recompiler/Optimization/src/SrtWalker/SrtEvaluator.cpp
@@ -289,6 +289,8 @@ std::optional<std::size_t> evaluatedArguments(IrOpcode opcode) {
         case IrOpcode::FPMul32:
         case IrOpcode::FPOrdLessThanEqual32:
         case IrOpcode::FPOrdGreaterThanEqual32:
+        case IrOpcode::FPUnordLessThanEqual32:
+        case IrOpcode::FPUnordGreaterThanEqual32:
         case IrOpcode::BitwiseAnd32:
         case IrOpcode::BitwiseAnd64:
         case IrOpcode::BitwiseOr32:
@@ -447,8 +449,53 @@ bool BasicEvaluator<TNode>::MayEvaluate(const IrResourcePlan& program, IrValue*
     return known.at(value->Resolve());
 }
 
+template<typename TNode>
+bool BasicEvaluator<TNode>::MayDecide(const IrResourcePlan& program, IrValue* value) {
+    if (value == nullptr) return false;
+    if (MayEvaluate(program, value)) return true;
+    value = value->Resolve();
+    const auto decides = [&program, value](std::size_t index) { return value->Argument(index) != nullptr && MayDecide(program, value->Argument(index)); };
+    switch (value->Opcode()) {
+        case IrOpcode::LogicalNot: return value->ArgumentCount() == 1u && decides(0);
+        case IrOpcode::LogicalAnd:
+        case IrOpcode::LogicalOr: return value->ArgumentCount() == 2u && (decides(0) || decides(1));
+        case IrOpcode::ULessThan32:
+        case IrOpcode::UGreaterThan32: return value->ArgumentCount() == 2u && (MayEvaluate(program, value->Argument(0)) || MayEvaluate(program, value->Argument(1)));
+        default: return false;
+    }
+}
+
+template<typename TNode>
+EvaluatorReads BasicEvaluator<TNode>::Reads(const IrResourcePlan& program, const IrValue& value) {
+    if (value.IsIdentity()) {
+        return EvaluatorReads::Arguments;
+    }
+    if (value.HasImmediate()) {
+        return EvaluatorReads::Nothing;
+    }
+    switch (value.Opcode()) {
+        case IrOpcode::LoadAddressU32:
+        case IrOpcode::ReadConstBuffer: return IsRawRead(program, value) ? EvaluatorReads::Closure : EvaluatorReads::Nothing;
+        case IrOpcode::CompositeConstructU32x2:
+        case IrOpcode::IAddCarry32:
+        case IrOpcode::GetUserData:
+        case IrOpcode::GetShaderBase:
+        case IrOpcode::Phi:
+        case IrOpcode::ReadFirstLane:
+        case IrOpcode::BitCastU32F32:
+        case IrOpcode::BitCastF32U32:
+        case IrOpcode::CompositeExtractU64:
+        case IrOpcode::CompositeExtractU32x2:
+        case IrOpcode::ReadConst: return EvaluatorReads::Arguments;
+        default: return evaluatedArguments(value.Opcode()) ? EvaluatorReads::Arguments : EvaluatorReads::Nothing;
+    }
+}
+
 template<typename TNode>
 bool BasicEvaluator<TNode>::EvaluateInst(const TNode& inst, std::uint64_t& result) {
+    if (Reads(_program, *inst.Value()) == EvaluatorReads::Nothing) {
+        return false;
+    }
     std::uint64_t a = 0;
     std::uint64_t b = 0;
     std::uint64_t c = 0;
@@ -599,6 +646,18 @@ bool BasicEvaluator<TNode>::EvaluateInst(const TNode& inst, std::uint64_t& resul
                 return true;
             }
             return false;
+        case IrOpcode::FPUnordLessThanEqual32:
+            if (binary()) {
+                result = !(Float32(a) > Float32(b)) ? 1u : 0u;
+                return true;
+            }
+            return false;
+        case IrOpcode::FPUnordGreaterThanEqual32:
+            if (binary()) {
+                result = !(Float32(a) < Float32(b)) ? 1u : 0u;
+                return true;
+            }
+            return false;
         case IrOpcode::BitwiseAnd32:
             if (binary()) {
                 result = static_cast<std::uint32_t>(a & b);
@@ -762,29 +821,41 @@ bool BasicEvaluator<TNode>::EvaluateInst(const TNode& inst, std::uint64_t& resul
             }
             return false;
         case IrOpcode::ULessThan32:
-            if (binary()) {
-                result = static_cast<std::uint32_t>(a) < static_cast<std::uint32_t>(b) ? 1u : 0u;
+        case IrOpcode::UGreaterThan32: {
+            const bool greater = inst.Opcode() == IrOpcode::UGreaterThan32;
+            const bool first = Arg(inst, 0, a);
+            if (first && static_cast<std::uint32_t>(a) == (greater ? 0u : 0xffffffffu)) {
+                result = 0u;
                 return true;
             }
-            return false;
-        case IrOpcode::UGreaterThan32:
-            if (binary()) {
-                result = static_cast<std::uint32_t>(a) > static_cast<std::uint32_t>(b) ? 1u : 0u;
+            const bool second = Arg(inst, 1, b);
+            if (second && static_cast<std::uint32_t>(b) == (greater ? 0xffffffffu : 0u)) {
+                result = 0u;
                 return true;
             }
-            return false;
+            if (!first || !second) return false;
+            const auto lhs = static_cast<std::uint32_t>(greater ? b : a);
+            const auto rhs = static_cast<std::uint32_t>(greater ? a : b);
+            result = lhs < rhs ? 1u : 0u;
+            return true;
+        }
         case IrOpcode::LogicalAnd:
-            if (binary()) {
-                result = (a != 0u) && (b != 0u) ? 1u : 0u;
+        case IrOpcode::LogicalOr: {
+            const bool decisive = inst.Opcode() == IrOpcode::LogicalOr;
+            const bool first = Arg(inst, 0, a);
+            if (first && (a != 0u) == decisive) {
+                result = decisive ? 1u : 0u;
                 return true;
             }
-            return false;
-        case IrOpcode::LogicalOr:
-            if (binary()) {
-                result = (a != 0u) || (b != 0u) ? 1u : 0u;
+            const bool second = Arg(inst, 1, b);
+            if (second && (b != 0u) == decisive) {
+                result = decisive ? 1u : 0u;
                 return true;
             }
-            return false;
+            if (!first || !second) return false;
+            result = decisive ? 0u : 1u;
+            return true;
+        }
         case IrOpcode::LogicalXor:
             if (binary()) {
                 result = (a != 0u) != (b != 0u) ? 1u : 0u;
diff --git a/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp b/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp
index 855fd960af..140e1e7a2b 100644
--- a/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp
+++ b/core/shader/recompiler/Optimization/src/SrtWalker/SrtInstructionPredicates.cpp
@@ -20,6 +20,10 @@ bool IsRawRead(const IrResourcePlan& program, IrOpcode op, std::uint32_t index)
     return (op == IrOpcode::LoadAddressU32 && kind == ResourceKind::ScalarAddress) || (op == IrOpcode::ReadConstBuffer && kind == ResourceKind::ScalarBuffer);
 }
 
+bool IsMemoryRead(IrOpcode opcode) {
+    return opcode == IrOpcode::ReadConst || opcode == IrOpcode::LoadAddressU32 || opcode == IrOpcode::ReadConstBuffer;
+}
+
 bool LoadedFromMemory(const IrValue& handle) {
     std::vector<const IrValue*> pending;
     std::vector<const IrValue*> visited;
@@ -31,8 +35,7 @@ bool LoadedFromMemory(const IrValue& handle) {
         value = value->Resolve();
         if (value->HasImmediate() || std::find(visited.begin(), visited.end(), value) != visited.end()) continue;
         visited.push_back(value);
-        const auto opcode = value->Opcode();
-        if (opcode == IrOpcode::ReadConst || opcode == IrOpcode::LoadAddressU32 || opcode == IrOpcode::ReadConstBuffer) return true;
+        if (IsMemoryRead(value->Opcode())) return true;
         for (std::size_t index = 0; index < value->ArgumentCount(); ++index) pending.push_back(value->Argument(index));
     }
     return false;
diff --git a/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp b/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp
index b18206cf38..208b02d774 100644
--- a/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp
+++ b/core/shader/recompiler/Optimization/src/SrtWalker/SrtTape.cpp
@@ -245,6 +245,8 @@ private:
             case IrOpcode::FPIsNan32: return operation(Op::FPIsNan32, value, context, depth, 1);
             case IrOpcode::FPOrdLessThanEqual32: return operation(Op::FPOrdLessThanEqual32, value, context, depth, 2);
             case IrOpcode::FPOrdGreaterThanEqual32: return operation(Op::FPOrdGreaterThanEqual32, value, context, depth, 2);
+            case IrOpcode::FPUnordLessThanEqual32: return operation(Op::FPUnordLessThanEqual32, value, context, depth, 2);
+            case IrOpcode::FPUnordGreaterThanEqual32: return operation(Op::FPUnordGreaterThanEqual32, value, context, depth, 2);
             case IrOpcode::BitwiseAnd32: return operation(Op::BitwiseAnd32, value, context, depth, 2);
             case IrOpcode::BitwiseAnd64: return operation(Op::BitwiseAnd64, value, context, depth, 2);
             case IrOpcode::BitwiseOr32: return operation(Op::BitwiseOr32, value, context, depth, 2);
@@ -343,6 +345,44 @@ bool SrtTape::evaluate(Frame& frame, std::uint32_t index, std::uint64_t& result)
 }
 
 bool SrtTape::compute(Frame& frame, const Node& node, std::uint64_t& result) const {
+    if (node.op == Op::LogicalAnd || node.op == Op::LogicalOr) {
+        const bool decisive = node.op == Op::LogicalOr;
+        std::uint64_t first = 0;
+        std::uint64_t second = 0;
+        const bool firstEvaluated = evaluate(frame, node.arguments[0], first);
+        if (firstEvaluated && (first != 0u) == decisive) {
+            result = decisive ? 1u : 0u;
+            return true;
+        }
+        const bool secondEvaluated = evaluate(frame, node.arguments[1], second);
+        if (secondEvaluated && (second != 0u) == decisive) {
+            result = decisive ? 1u : 0u;
+            return true;
+        }
+        if (!firstEvaluated || !secondEvaluated) return false;
+        result = decisive ? 0u : 1u;
+        return true;
+    }
+    if (node.op == Op::ULessThan32 || node.op == Op::UGreaterThan32) {
+        const bool greater = node.op == Op::UGreaterThan32;
+        std::uint64_t first = 0;
+        std::uint64_t second = 0;
+        const bool firstEvaluated = evaluate(frame, node.arguments[0], first);
+        if (firstEvaluated && static_cast<std::uint32_t>(first) == (greater ? 0u : 0xffffffffu)) {
+            result = 0u;
+            return true;
+        }
+        const bool secondEvaluated = evaluate(frame, node.arguments[1], second);
+        if (secondEvaluated && static_cast<std::uint32_t>(second) == (greater ? 0xffffffffu : 0u)) {
+            result = 0u;
+            return true;
+        }
+        if (!firstEvaluated || !secondEvaluated) return false;
+        const auto lhs = static_cast<std::uint32_t>(greater ? second : first);
+        const auto rhs = static_cast<std::uint32_t>(greater ? first : second);
+        result = lhs < rhs ? 1u : 0u;
+        return true;
+    }
     std::array<std::uint64_t, 5> operand{};
     std::int32_t origin = -1;
     for (std::uint8_t index = 0; index < node.argumentCount; ++index) {
@@ -426,6 +466,8 @@ bool SrtTape::compute(Frame& frame, const Node& node, std::uint64_t& result) con
         case Op::FPIsNan32: result = std::isnan(float32(a)) ? 1u : 0u; return true;
         case Op::FPOrdLessThanEqual32: result = float32(a) <= float32(b) ? 1u : 0u; return true;
         case Op::FPOrdGreaterThanEqual32: result = float32(a) >= float32(b) ? 1u : 0u; return true;
+        case Op::FPUnordLessThanEqual32: result = !(float32(a) > float32(b)) ? 1u : 0u; return true;
+        case Op::FPUnordGreaterThanEqual32: result = !(float32(a) < float32(b)) ? 1u : 0u; return true;
         case Op::IAdd32: result = static_cast<std::uint32_t>(a + b); return true;
         case Op::IAdd64: result = a + b; return true;
         case Op::ISub32: result = static_cast<std::uint32_t>(a - b); return true;
@@ -483,10 +525,10 @@ bool SrtTape::compute(Frame& frame, const Node& node, std::uint64_t& result) con
         case Op::IEqual32: result = static_cast<std::uint32_t>(a) == static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
         case Op::INotEqual32: result = static_cast<std::uint32_t>(a) != static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
         case Op::SLessThan32: result = std::bit_cast<std::int32_t>(static_cast<std::uint32_t>(a)) < std::bit_cast<std::int32_t>(static_cast<std::uint32_t>(b)) ? 1u : 0u; return true;
-        case Op::ULessThan32: result = static_cast<std::uint32_t>(a) < static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
-        case Op::UGreaterThan32: result = static_cast<std::uint32_t>(a) > static_cast<std::uint32_t>(b) ? 1u : 0u; return true;
-        case Op::LogicalAnd: result = (a != 0u) && (b != 0u) ? 1u : 0u; return true;
-        case Op::LogicalOr: result = (a != 0u) || (b != 0u) ? 1u : 0u; return true;
+        case Op::ULessThan32:
+        case Op::UGreaterThan32: return false;
+        case Op::LogicalAnd:
+        case Op::LogicalOr: return false;
         case Op::LogicalXor: result = (a != 0u) != (b != 0u) ? 1u : 0u; return true;
         case Op::LogicalNot: result = a == 0u ? 1u : 0u; return true;
     }
diff --git a/core/shader/recompiler/Optimization/src/TessellationLowering.cpp b/core/shader/recompiler/Optimization/src/TessellationLowering.cpp
index 79a616db94..690d3bde1e 100644
--- a/core/shader/recompiler/Optimization/src/TessellationLowering.cpp
+++ b/core/shader/recompiler/Optimization/src/TessellationLowering.cpp
@@ -253,6 +253,82 @@ bool Implies(IrValue* rawPredicate, IrValue* rawCondition) {
     return predicate->Opcode() == IrOpcode::LogicalAnd && (Implies(predicate->Argument(0), condition) || Implies(predicate->Argument(1), condition));
 }
 
+bool ImpliesNot(IrValue* rawPredicate, IrValue* rawCondition) {
+    IrValue* predicate = rawPredicate->Resolve();
+    IrValue* condition = rawCondition->Resolve();
+    if (condition->HasImmediate() && condition->Type() == IrType::Bool && !condition->ImmediateBool()) return true;
+    if (condition->Opcode() == IrOpcode::LogicalNot) return Implies(predicate, condition->Argument(0));
+    if (predicate->Opcode() == IrOpcode::LogicalNot) return Implies(condition, predicate->Argument(0));
+    return predicate->Opcode() == IrOpcode::LogicalAnd && (ImpliesNot(predicate->Argument(0), condition) || ImpliesNot(predicate->Argument(1), condition));
+}
+
+bool CarriesRelativeBits(IrOpcode opcode) {
+    switch (opcode) {
+    case IrOpcode::Identity:
+    case IrOpcode::Phi:
+    case IrOpcode::IAdd32:
+    case IrOpcode::ISub32:
+    case IrOpcode::IMul32:
+    case IrOpcode::ShiftLeftLogical32:
+    case IrOpcode::ShiftRightLogical32:
+    case IrOpcode::ShiftRightArithmetic32:
+    case IrOpcode::BitwiseAnd32:
+    case IrOpcode::BitwiseOr32:
+    case IrOpcode::BitwiseXor32:
+    case IrOpcode::BitwiseNot32:
+    case IrOpcode::BitFieldUExtract:
+    case IrOpcode::BitFieldSExtract:
+    case IrOpcode::BitFieldInsert:
+    case IrOpcode::Select:
+    case IrOpcode::SelectU1:
+    case IrOpcode::SelectU32:
+    case IrOpcode::SelectF32:
+    case IrOpcode::BitCastU32F32:
+    case IrOpcode::BitCastF32U32:
+    case IrOpcode::BitCastU16F16:
+    case IrOpcode::BitCastF16U16:
+    case IrOpcode::ConvertF32U32:
+    case IrOpcode::ConvertU32F32:
+    case IrOpcode::ConvertF32S32:
+    case IrOpcode::ConvertS32F32:
+    case IrOpcode::ConvertFToU32:
+    case IrOpcode::ConvertUToF32:
+    case IrOpcode::ConvertFToI32:
+    case IrOpcode::ConvertIToF32:
+    case IrOpcode::ConvertF32F16:
+    case IrOpcode::ConvertF16F32:
+    case IrOpcode::ConvertU16U32:
+    case IrOpcode::ConvertU32U16:
+    case IrOpcode::ConvertU8U32:
+    case IrOpcode::ConvertU32U8:
+    case IrOpcode::FPAdd32:
+    case IrOpcode::FPSub32:
+    case IrOpcode::FPMul32:
+    case IrOpcode::FPMad32:
+    case IrOpcode::FPFma32:
+    case IrOpcode::FFma32:
+    case IrOpcode::FPMin32:
+    case IrOpcode::FPMax32:
+    case IrOpcode::FPNeg32:
+    case IrOpcode::FPAbs32:
+    case IrOpcode::CompositeConstructU64:
+    case IrOpcode::CompositeConstructU32x2:
+    case IrOpcode::CompositeConstructU32x3:
+    case IrOpcode::CompositeConstructU32x4:
+    case IrOpcode::CompositeExtractU64:
+    case IrOpcode::CompositeExtractU32x2:
+    case IrOpcode::CompositeExtractU32x3:
+    case IrOpcode::CompositeExtractU32x4:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool IsRelativeSelect(IrOpcode opcode) {
+    return opcode == IrOpcode::Select || opcode == IrOpcode::SelectU1 || opcode == IrOpcode::SelectU32 || opcode == IrOpcode::SelectF32;
+}
+
 class AddressEvaluator {
 public:
     AddressEvaluator(std::uint32_t vertexCount, std::int64_t relativeCount) : vertexCount(vertexCount), relativeCount(relativeCount) {}
@@ -784,33 +860,86 @@ private:
         return address && address->dynamic && address->relative == stride;
     }
 
+    bool dependsOnRelative(IrValue* raw, IrValue* rawPredicate) {
+        if (raw == nullptr) return false;
+        IrValue* value = raw->Resolve();
+        IrValue* predicate = rawPredicate == nullptr ? nullptr : rawPredicate->Resolve();
+        if (value->HasImmediate()) return false;
+        const auto key = std::pair<const IrValue*, const IrValue*>{value, predicate};
+        if (const auto found = dependence.find(key); found != dependence.end()) return found->second == Dependence::Yes;
+        const auto inserted = dependence.emplace(key, Dependence::Visiting);
+        if (!inserted.second) return false;
+        const bool result = [&] {
+            if (const auto form = evaluator.Evaluate(value, predicate)) return form->relative != 0;
+            if (IsRelativeSelect(value->Opcode()) && predicate != nullptr) {
+                IrValue* condition = value->Argument(0);
+                if (Implies(predicate, condition)) return dependsOnRelative(value->Argument(1), predicate);
+                if (ImpliesNot(predicate, condition)) return dependsOnRelative(value->Argument(2), predicate);
+            }
+            for (IrValue* argument : value->Arguments()) {
+                if (dependsOnRelative(argument, predicate)) return true;
+            }
+            return false;
+        }();
+        inserted.first->second = result ? Dependence::Yes : Dependence::No;
+        return result;
+    }
+
+    bool windowLoadObserves(IrValue* store) {
+        IrBlock* start = store->Parent();
+        if (start == nullptr) return true;
+        std::unordered_set<IrBlock*> seen;
+        std::vector<IrBlock*> pending = start->Successors();
+        bool loops = false;
+        while (!pending.empty()) {
+            IrBlock* block = pending.back();
+            pending.pop_back();
+            if (block == nullptr) continue;
+            if (block == start) {
+                loops = true;
+                continue;
+            }
+            if (!seen.insert(block).second) continue;
+            for (IrValue* inst : block->Instructions()) {
+                if (inst->Opcode() == IrOpcode::LoadVectorWindow) return true;
+            }
+            for (IrBlock* next : block->Successors()) pending.push_back(next);
+        }
+        bool after = false;
+        for (IrValue* inst : start->Instructions()) {
+            if (inst == store) {
+                after = true;
+                continue;
+            }
+            if (inst->Opcode() == IrOpcode::LoadVectorWindow && (after || loops)) return true;
+        }
+        return false;
+    }
+
+    IrValue* effectPredicate(IrValue* user) const {
+        if (!user->MayHaveSideEffects() || user->ArgumentCount() == 0u) return nullptr;
+        IrValue* last = user->Argument(user->ArgumentCount() - 1u);
+        if (last == nullptr || last->Resolve()->Type() != IrType::Bool) return nullptr;
+        return last;
+    }
+
     bool usedAsData(const std::vector<IrValue*>& bases) {
+        dependence.clear();
         std::vector<IrValue*> pending(bases.begin(), bases.end());
         std::unordered_set<IrValue*> visited(bases.begin(), bases.end());
         while (!pending.empty()) {
             IrValue* value = pending.back();
             pending.pop_back();
             for (IrValue* user : value->Uses()) {
-                switch (user->Opcode()) {
-                case IrOpcode::Identity:
-                case IrOpcode::IAdd32:
-                case IrOpcode::ISub32:
-                case IrOpcode::IMul32:
-                case IrOpcode::ShiftLeftLogical32:
-                case IrOpcode::ShiftRightLogical32:
-                case IrOpcode::BitwiseAnd32:
-                case IrOpcode::BitwiseOr32:
-                case IrOpcode::BitFieldUExtract:
-                case IrOpcode::SelectU32:
-                case IrOpcode::Phi:
+                if (user == nullptr) continue;
+                if (CarriesRelativeBits(user->Opcode())) {
                     if (visited.insert(user).second) pending.push_back(user);
                     continue;
-                default:
-                    break;
                 }
                 if (dynamicInputAddress(user, value)) continue;
-                const auto address = evaluator.Evaluate(value, nullptr);
-                if (!address || address->relative != 0) return true;
+                if (!dependsOnRelative(value, effectPredicate(user))) continue;
+                if (user->Opcode() == IrOpcode::StoreVectorWindow && !windowLoadObserves(user)) continue;
+                return true;
             }
         }
         return false;
@@ -1075,10 +1204,13 @@ private:
     bool merged;
     AddressEvaluator evaluator;
     std::vector<Access> accesses;
+    enum class Dependence : std::uint8_t { Visiting, No, Yes };
+
     std::uint32_t localStride;
     std::uint32_t controlStride = 0;
     std::uint32_t patchStride = 0;
     std::uint32_t sharedStride = 0;
+    std::map<std::pair<const IrValue*, const IrValue*>, Dependence> dependence;
 };
 
 }
diff --git a/core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp b/core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp
new file mode 100644
index 0000000000..a4ef3bc3f8
--- /dev/null
+++ b/core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp
@@ -0,0 +1,42 @@
+#include "Optimization/DeadCodeEliminator.hpp"
+#include <algorithm>
+#include <unordered_set>
+#include <vector>
+
+namespace ShaderRecompiler {
+
+void DeadCodeEliminator::EliminateUnobservedPhis(IrProgram& program) const {
+    std::unordered_set<IrValue*> phis;
+    for (IrBlock* block : program.BlockOrder()) {
+        for (IrValue* value : block->Instructions()) {
+            if (value->IsPhi()) phis.insert(value);
+        }
+    }
+    std::unordered_set<IrValue*> observed;
+    std::vector<IrValue*> pending;
+    for (IrValue* phi : phis) {
+        if (std::ranges::any_of(phi->Uses(), [&](IrValue* user) { return !phis.contains(user); })) {
+            observed.insert(phi);
+            pending.push_back(phi);
+        }
+    }
+    while (!pending.empty()) {
+        IrValue* value = pending.back();
+        pending.pop_back();
+        for (IrValue* argument : value->Arguments()) {
+            if (phis.contains(argument) && observed.insert(argument).second) pending.push_back(argument);
+        }
+    }
+    std::vector<IrValue*> unobserved;
+    for (IrValue* phi : phis) {
+        if (observed.contains(phi)) continue;
+        unobserved.push_back(phi);
+        for (std::size_t index = 0; index < phi->ArgumentCount(); ++index) phi->ReplaceArgument(index, nullptr);
+    }
+    for (IrValue* phi : unobserved) {
+        phi->Parent()->RemoveInstruction(phi);
+        phi->Invalidate();
+    }
+}
+
+}
diff --git a/core/shader/recompiler/PipelineSpecialization.hpp b/core/shader/recompiler/PipelineSpecialization.hpp
index ae9ec178cf..2adcd7e04a 100644
--- a/core/shader/recompiler/PipelineSpecialization.hpp
+++ b/core/shader/recompiler/PipelineSpecialization.hpp
@@ -42,6 +42,7 @@ inline constexpr std::uint32_t DescriptorIndexBase = 16384u;
 inline constexpr std::uint32_t DescriptorIndexStride = 128u;
 inline constexpr std::uint32_t FoldOffsetBase = 57344u;
 inline constexpr std::uint32_t UnnormalizedBaseLevelBase = 57408u;
+inline constexpr std::uint32_t FmaskFormatBase = 57472u;
 
 inline constexpr std::uint32_t DescriptorIndex(std::uint32_t binding, std::uint32_t element) {
     return DescriptorIndexBase + binding * DescriptorIndexStride + element;
diff --git a/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp b/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp
index 5eb41904a0..83c1f217aa 100644
--- a/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp
+++ b/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaDescriptorFormat.hpp
@@ -2,7 +2,10 @@
 #define CORE_SHADER_RECOMPILIER_RDNADECODER_INCLUDE_RDNADECODER_RDNADESCRIPTORFORMAT_HPP
 
 #include "IntermediateRepresentation/IrMetadata.hpp"
+#include <array>
 #include <cstdint>
+#include <optional>
+#include <span>
 
 namespace ShaderRecompiler {
 
@@ -19,11 +22,32 @@ enum class ImageType : std::uint32_t {
 
 [[nodiscard]] IrTextureNumericClass VertexInputNumericClass(IrBufferFormat format);
 [[nodiscard]] bool IsFmaskTextureFormat(IrBufferFormat format);
+
+struct FmaskLayout {
+    std::uint32_t samples;
+    std::uint32_t fragments;
+    std::uint32_t sampleBits;
+    std::uint32_t storageBits;
+};
+
+inline constexpr IrBufferFormat FmaskExpansion = IrBufferFormat::Fmask8_S2_F1;
+
+[[nodiscard]] std::optional<FmaskLayout> FmaskLayoutOf(IrBufferFormat format);
 [[nodiscard]] IrTextureNumericClass SampledTextureNumericClass(IrBufferFormat format);
 [[nodiscard]] IrBufferFormat RemapTextureFormat(IrBufferFormat format);
+[[nodiscard]] IrBufferFormat RemapStorageTextureFormat(IrBufferFormat format);
 [[nodiscard]] std::uint32_t DepthBitsTextureWidth(std::uint32_t word1, std::uint32_t word3);
 [[nodiscard]] bool IsDepthBitsTexture(std::uint32_t word1, std::uint32_t word3);
 
+[[nodiscard]] const std::array<std::uint8_t, 128>& GcnBufferFormats();
+[[nodiscard]] std::uint32_t GcnBufferWord3(std::uint32_t word1, std::uint32_t word3);
+inline constexpr std::uint32_t GcnBufferWord1Mask = 0xffff0fffu;
+[[nodiscard]] std::uint32_t GcnImageFormat(std::uint32_t dataFormat, std::uint32_t numberFormat);
+[[nodiscard]] std::array<std::uint32_t, 8> GcnImageWords(std::span<const std::uint32_t, 8> words);
+[[nodiscard]] constexpr std::uint32_t GcnImageTilingIndex(std::uint32_t word7) { return word7 & 0x1fu; }
+[[nodiscard]] constexpr bool GcnImagePow2Pad(std::uint32_t word7) { return ((word7 >> 5u) & 1u) != 0u; }
+[[nodiscard]] constexpr std::uint32_t GcnImagePitch(std::uint32_t word7) { return ((word7 >> 6u) & 0x3fffu) + 1u; }
+
 [[nodiscard]] constexpr std::uint32_t SrgbDecodeBit(IrBufferFormat format) {
     switch (format) {
         case IrBufferFormat::Format8Srgb: return 1u;
diff --git a/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaInstructionDecoder.hpp b/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaInstructionDecoder.hpp
index 9456f38cd1..d52379a7c3 100644
--- a/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaInstructionDecoder.hpp
+++ b/core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaInstructionDecoder.hpp
@@ -21,6 +21,10 @@ private:
 
 RdnaInstructionFamily GetRdnaInstructionFamily(std::uint32_t word);
 RdnaInstruction DecodeRdnaInstruction(std::uint32_t programCounter, std::span<const std::uint32_t> code, std::uint32_t wordIndex);
+RdnaInstruction DecodeRdnaEncodedInstruction(std::uint32_t programCounter, std::span<const std::uint32_t> code, std::uint32_t wordIndex);
+RdnaInstruction DecodeGcnInstruction(std::uint32_t programCounter, std::span<const std::uint32_t> code, std::uint32_t wordIndex);
+void SetGcnGuestShaders(bool enabled);
+bool GcnGuestShaders();
 RdnaProgram DecodeRdnaFrontProgram(std::span<const std::uint32_t> front);
 void DecodeRdnaProgram(std::span<const std::uint32_t> code, RdnaProgram& program);
 RdnaOperand DecodeRdnaScalarSource(std::uint32_t code, std::uint32_t programCounter);
diff --git a/core/shader/recompiler/RdnaDecoder/src/GcnInstructionDecoder.cpp b/core/shader/recompiler/RdnaDecoder/src/GcnInstructionDecoder.cpp
new file mode 100644
index 0000000000..e5ccedb328
--- /dev/null
+++ b/core/shader/recompiler/RdnaDecoder/src/GcnInstructionDecoder.cpp
@@ -0,0 +1,349 @@
+#include "RdnaDecoder/RdnaInstructionDecoder.hpp"
+#include "GcnOpcodeTables.hpp"
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <optional>
+#include <span>
+#include <stdexcept>
+#include <string>
+
+namespace ShaderRecompiler {
+
+namespace {
+
+std::atomic<bool> g_gcnGuestShaders{false};
+
+constexpr std::uint32_t LiteralSource = 0xffu;
+constexpr std::uint32_t VccSdst = 106u;
+constexpr std::uint32_t NullSoffset = 0x7du;
+constexpr std::uint32_t LinkedCallSopk = 0x16u;
+constexpr std::uint32_t CodeEndSopp = 0x1fu;
+constexpr std::uint32_t SetRegImmSopk = 0x15u;
+
+template <std::size_t N>
+std::optional<std::uint32_t> mapOpcode(const std::array<std::pair<std::uint16_t, std::uint16_t>, N>& table, std::uint32_t opcode) {
+    const auto found = std::lower_bound(table.begin(), table.end(), opcode, [](const auto& entry, std::uint32_t value) { return entry.first < value; });
+    if (found == table.end() || found->first != opcode) return std::nullopt;
+    return found->second;
+}
+
+[[noreturn]] void unsupported(const char* family, std::uint32_t opcode, std::uint32_t programCounter) {
+    throw UnsupportedInstructionError(std::string("GCN ") + family + " opcode " + std::to_string(opcode) + " at program counter " + std::to_string(programCounter) + " is not implemented");
+}
+
+std::uint32_t replaceBits(std::uint32_t word, std::uint32_t shift, std::uint32_t width, std::uint32_t value) {
+    const std::uint32_t mask = ((1u << width) - 1u) << shift;
+    return (word & ~mask) | ((value << shift) & mask);
+}
+
+bool hasLiteral(std::uint32_t source) {
+    return source == LiteralSource;
+}
+
+struct Encoded {
+    std::array<std::uint32_t, 4> words{};
+    std::uint32_t rdnaWords = 0;
+    std::uint32_t gcnWords = 0;
+};
+
+std::uint32_t literalAt(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    if (index >= code.size()) throw std::out_of_range("GCN literal constant at program counter " + std::to_string(programCounter) + " is past the end of the code");
+    return code[index];
+}
+
+Encoded encodeScalar(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto word = code[index];
+    Encoded out;
+    out.gcnWords = 1;
+    std::uint32_t opcode = 0;
+    std::optional<std::uint32_t> mapped;
+    bool literal = false;
+    const auto prefix9 = word >> 23u;
+    if (prefix9 == 0x17du) {
+        opcode = (word >> 8u) & 0xffu;
+        mapped = mapOpcode(GcnTables::Sop1, opcode);
+        if (!mapped) unsupported("SOP1", opcode, programCounter);
+        out.words[0] = replaceBits(word, 8, 8, *mapped);
+        literal = hasLiteral(word & 0xffu);
+    } else if (prefix9 == 0x17eu) {
+        opcode = (word >> 16u) & 0x7fu;
+        mapped = mapOpcode(GcnTables::Sopc, opcode);
+        if (!mapped) unsupported("SOPC", opcode, programCounter);
+        out.words[0] = replaceBits(word, 16, 7, *mapped);
+        literal = hasLiteral(word & 0xffu) || hasLiteral((word >> 8u) & 0xffu);
+    } else if (prefix9 == 0x17fu) {
+        opcode = (word >> 16u) & 0x7fu;
+        mapped = opcode == CodeEndSopp ? std::optional<std::uint32_t>(CodeEndSopp) : mapOpcode(GcnTables::Sopp, opcode);
+        if (!mapped) unsupported("SOPP", opcode, programCounter);
+        out.words[0] = replaceBits(word, 16, 7, *mapped);
+    } else if ((word >> 28u) == 0xbu) {
+        opcode = (word >> 23u) & 0x1fu;
+        mapped = opcode == LinkedCallSopk ? std::optional<std::uint32_t>(LinkedCallSopk) : mapOpcode(GcnTables::Sopk, opcode);
+        if (!mapped) unsupported("SOPK", opcode, programCounter);
+        out.words[0] = replaceBits(word, 23, 5, *mapped);
+        literal = opcode == SetRegImmSopk;
+    } else {
+        opcode = (word >> 23u) & 0x7fu;
+        mapped = mapOpcode(GcnTables::Sop2, opcode);
+        if (!mapped) unsupported("SOP2", opcode, programCounter);
+        out.words[0] = replaceBits(word, 23, 7, *mapped);
+        literal = hasLiteral(word & 0xffu) || hasLiteral((word >> 8u) & 0xffu);
+    }
+    out.rdnaWords = 1;
+    if (literal) {
+        out.words[1] = literalAt(code, index + 1, programCounter);
+        out.rdnaWords = out.gcnWords = 2;
+    }
+    return out;
+}
+
+Encoded encodeSmrd(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto word = code[index];
+    const auto opcode = (word >> 22u) & 0x1fu;
+    const auto mapped = mapOpcode(GcnTables::Smrd, opcode);
+    if (!mapped) unsupported("SMRD", opcode, programCounter);
+    const auto sdst = (word >> 15u) & 0x7fu;
+    const auto sbase = (word >> 9u) & 0x3fu;
+    const bool immediate = ((word >> 8u) & 1u) != 0;
+    const auto offset = word & 0xffu;
+    if (!immediate && offset == LiteralSource) unsupported("SMRD literal-offset", opcode, programCounter);
+    Encoded out;
+    out.gcnWords = 1;
+    out.rdnaWords = 2;
+    out.words[0] = (0x3du << 26u) | (*mapped << 18u) | (sdst << 6u) | sbase;
+    out.words[1] = immediate ? (NullSoffset << 25u) | (offset * 4u) : (offset << 25u);
+    return out;
+}
+
+Encoded encodeVop3Words(std::uint32_t word0, std::uint32_t word1, std::uint32_t rdnaOpcode, bool carryOut) {
+    Encoded out;
+    out.gcnWords = 2;
+    out.rdnaWords = 2;
+    const auto vdst = word0 & 0xffu;
+    std::uint32_t encoded = (0x35u << 26u) | (rdnaOpcode << 16u) | vdst;
+    if (carryOut) {
+        encoded |= ((word0 >> 8u) & 0x7fu) << 8u;
+    } else {
+        encoded |= ((word0 >> 8u) & 0x7u) << 8u;
+        encoded |= ((word0 >> 11u) & 1u) << 15u;
+    }
+    out.words[0] = encoded;
+    out.words[1] = word1;
+    return out;
+}
+
+std::optional<std::uint32_t> reversedShift(std::uint32_t gcnVop3Opcode) {
+    switch (gcnVop3Opcode) {
+        case 0x115u: return 0x116u;
+        case 0x117u: return 0x118u;
+        case 0x119u: return 0x11au;
+        case 0x161u: return 0x2ffu;
+        case 0x162u: return 0x300u;
+        case 0x163u: return 0x301u;
+        default: return std::nullopt;
+    }
+}
+
+bool compareWritesExec(std::uint32_t gcnVop3Opcode) {
+    return gcnVop3Opcode < 0x100u && (gcnVop3Opcode & 0x10u) != 0;
+}
+
+std::uint32_t swapSources(std::uint32_t word1) {
+    const auto src0 = word1 & 0x1ffu;
+    const auto src1 = (word1 >> 9u) & 0x1ffu;
+    const auto neg0 = (word1 >> 29u) & 1u;
+    const auto neg1 = (word1 >> 30u) & 1u;
+    word1 = (word1 & ~0x3ffffu & ~(3u << 29u)) | src1 | (src0 << 9u) | (neg1 << 29u) | (neg0 << 30u);
+    return word1;
+}
+
+std::uint32_t swapAbsolute(std::uint32_t word0) {
+    const auto abs0 = (word0 >> 8u) & 1u;
+    const auto abs1 = (word0 >> 9u) & 1u;
+    return (word0 & ~(3u << 8u)) | (abs1 << 8u) | (abs0 << 9u);
+}
+
+bool gcnVop3bCarryOut(std::uint32_t opcode) {
+    switch (opcode) {
+        case 0x125u: case 0x126u: case 0x127u: case 0x128u: case 0x129u: case 0x12au: case 0x16du: case 0x16eu: case 0x176u: case 0x177u: return true;
+        default: return false;
+    }
+}
+
+Encoded encodeVop3(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    if (index + 1 >= code.size()) throw std::out_of_range("truncated GCN VOP3 instruction");
+    const auto word0 = code[index];
+    const auto opcode = (word0 >> 17u) & 0x1ffu;
+    if (compareWritesExec(opcode)) unsupported("VOP3 v_cmpx (writes both the scalar destination and EXEC)", opcode, programCounter);
+    if (const auto shift = reversedShift(opcode)) return encodeVop3Words(swapAbsolute(word0), swapSources(code[index + 1]), *shift, false);
+    const auto mapped = mapOpcode(GcnTables::Vop3, opcode);
+    if (!mapped) unsupported("VOP3", opcode, programCounter);
+    return encodeVop3Words(word0, code[index + 1], *mapped, gcnVop3bCarryOut(opcode));
+}
+
+Encoded promoteToVop3(std::uint32_t gcnVop3Opcode, std::uint32_t vdst, std::uint32_t src0, std::uint32_t src1, std::uint32_t src2, bool carryOut, std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto shift = reversedShift(gcnVop3Opcode);
+    const auto mapped = shift ? shift : mapOpcode(GcnTables::Vop3, gcnVop3Opcode);
+    if (!mapped) unsupported("VOP3-promoted", gcnVop3Opcode, programCounter);
+    const std::uint32_t word0 = carryOut ? (vdst | (VccSdst << 8u)) : vdst;
+    const std::uint32_t word1 = shift ? (src1 | (src0 << 9u) | (src2 << 18u)) : (src0 | (src1 << 9u) | (src2 << 18u));
+    auto out = encodeVop3Words(word0, word1, *mapped, carryOut);
+    out.gcnWords = 1;
+    if (hasLiteral(src0)) {
+        out.words[2] = literalAt(code, index + 1, programCounter);
+        out.rdnaWords = 3;
+        out.gcnWords = 2;
+    }
+    return out;
+}
+
+Encoded encodeVop2(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto word = code[index];
+    const auto opcode = (word >> 25u) & 0x3fu;
+    const auto src0 = word & 0x1ffu;
+    if (const auto mapped = mapOpcode(GcnTables::Vop2, opcode)) {
+        Encoded out;
+        out.words[0] = replaceBits(word, 25, 6, *mapped);
+        out.rdnaWords = out.gcnWords = 1;
+        const bool constantK = opcode == 0x20u || opcode == 0x21u;
+        if (hasLiteral(src0) || constantK) {
+            out.words[1] = literalAt(code, index + 1, programCounter);
+            out.rdnaWords = out.gcnWords = 2;
+        }
+        return out;
+    }
+    const auto vdst = (word >> 17u) & 0xffu;
+    const auto vsrc1 = (word >> 9u) & 0xffu;
+    const bool laneSelect = opcode == 0x01u || opcode == 0x02u;
+    const bool carryOut = opcode == 0x25u || opcode == 0x26u || opcode == 0x27u;
+    return promoteToVop3(0x100u + opcode, vdst, src0, laneSelect ? vsrc1 : 0x100u + vsrc1, 0, carryOut, code, index, programCounter);
+}
+
+Encoded encodeVop1(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto word = code[index];
+    const auto opcode = (word >> 9u) & 0xffu;
+    const auto src0 = word & 0x1ffu;
+    if (const auto mapped = mapOpcode(GcnTables::Vop1, opcode)) {
+        Encoded out;
+        out.words[0] = replaceBits(word, 9, 8, *mapped);
+        out.rdnaWords = out.gcnWords = 1;
+        if (hasLiteral(src0)) {
+            out.words[1] = literalAt(code, index + 1, programCounter);
+            out.rdnaWords = out.gcnWords = 2;
+        }
+        return out;
+    }
+    return promoteToVop3(0x180u + opcode, (word >> 17u) & 0xffu, src0, 0, 0, false, code, index, programCounter);
+}
+
+Encoded encodeVopc(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto word = code[index];
+    const auto opcode = (word >> 17u) & 0xffu;
+    if (compareWritesExec(opcode)) unsupported("VOPC v_cmpx (writes both VCC and EXEC)", opcode, programCounter);
+    const auto mapped = mapOpcode(GcnTables::Vopc, opcode);
+    if (!mapped) unsupported("VOPC", opcode, programCounter);
+    Encoded out;
+    out.words[0] = replaceBits(word, 17, 8, *mapped);
+    out.rdnaWords = out.gcnWords = 1;
+    if (hasLiteral(word & 0x1ffu)) {
+        out.words[1] = literalAt(code, index + 1, programCounter);
+        out.rdnaWords = out.gcnWords = 2;
+    }
+    return out;
+}
+
+Encoded encodeDs(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    if (index + 1 >= code.size()) throw std::out_of_range("truncated GCN DS instruction");
+    const auto word0 = code[index];
+    const auto opcode = (word0 >> 18u) & 0xffu;
+    const auto mapped = mapOpcode(GcnTables::Ds, opcode);
+    if (!mapped) unsupported("DS", opcode, programCounter);
+    Encoded out;
+    out.words[0] = replaceBits(word0, 18, 8, *mapped);
+    out.words[1] = code[index + 1];
+    out.rdnaWords = out.gcnWords = 2;
+    return out;
+}
+
+Encoded encodeMubuf(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    if (index + 1 >= code.size()) throw std::out_of_range("truncated GCN MUBUF instruction");
+    const auto word0 = code[index];
+    const auto opcode = (word0 >> 18u) & 0x7fu;
+    const auto mapped = mapOpcode(GcnTables::Mubuf, opcode);
+    if (!mapped) unsupported("MUBUF", opcode, programCounter);
+    if (((word0 >> 15u) & 1u) != 0) unsupported("MUBUF addr64", opcode, programCounter);
+    Encoded out;
+    out.words[0] = replaceBits(replaceBits(word0, 18, 7, *mapped & 0x7fu), 25, 1, *mapped >> 7u);
+    out.words[1] = code[index + 1];
+    out.rdnaWords = out.gcnWords = 2;
+    return out;
+}
+
+Encoded encodeMimg(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    if (index + 1 >= code.size()) throw std::out_of_range("truncated GCN MIMG instruction");
+    const auto word0 = code[index];
+    const auto opcode = (word0 >> 18u) & 0x7fu;
+    const auto mapped = mapOpcode(GcnTables::Mimg, opcode);
+    if (!mapped) unsupported("MIMG", opcode, programCounter);
+    const bool array = ((word0 >> 14u) & 1u) != 0;
+    Encoded out;
+    out.words[0] = replaceBits(replaceBits(replaceBits(word0, 18, 7, *mapped & 0x7fu), 14, 1, 0), 0, 8, (*mapped >> 7u) | ((array ? 5u : 1u) << 3u));
+    out.words[1] = code[index + 1] & 0x03ffffffu;
+    out.rdnaWords = out.gcnWords = 2;
+    return out;
+}
+
+Encoded encodePassThrough(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t words, const char* family) {
+    if (index + words > code.size()) throw std::out_of_range(std::string("truncated GCN ") + family + " instruction");
+    Encoded out;
+    for (std::uint32_t i = 0; i < words; ++i) out.words[i] = code[index + i];
+    out.rdnaWords = out.gcnWords = words;
+    return out;
+}
+
+Encoded encodeGcn(std::span<const std::uint32_t> code, std::uint32_t index, std::uint32_t programCounter) {
+    const auto word = code[index];
+    if ((word >> 31u) == 0) {
+        switch ((word >> 25u) & 0x3fu) {
+            case 0x3eu: return encodeVopc(code, index, programCounter);
+            case 0x3fu: return encodeVop1(code, index, programCounter);
+            default: return encodeVop2(code, index, programCounter);
+        }
+    }
+    if ((word >> 30u) == 2u) return encodeScalar(code, index, programCounter);
+    switch (word >> 26u) {
+        case 0x30u: case 0x31u: return encodeSmrd(code, index, programCounter);
+        case 0x32u: return encodePassThrough(code, index, 1, "VINTRP");
+        case 0x34u: return encodeVop3(code, index, programCounter);
+        case 0x36u: return encodeDs(code, index, programCounter);
+        case 0x38u: return encodeMubuf(code, index, programCounter);
+        case 0x3eu: return encodePassThrough(code, index, 2, "EXP");
+        case 0x37u: unsupported("FLAT", (word >> 18u) & 0x7fu, programCounter);
+        case 0x3au: unsupported("MTBUF", (word >> 16u) & 7u, programCounter);
+        case 0x3cu: return encodeMimg(code, index, programCounter);
+        default: break;
+    }
+    throw std::invalid_argument("unknown GCN instruction family at program counter " + std::to_string(programCounter) + " raw word " + std::to_string(word));
+}
+
+}
+
+void SetGcnGuestShaders(bool enabled) {
+    g_gcnGuestShaders.store(enabled, std::memory_order_release);
+}
+
+bool GcnGuestShaders() {
+    return g_gcnGuestShaders.load(std::memory_order_acquire);
+}
+
+RdnaInstruction DecodeGcnInstruction(std::uint32_t programCounter, std::span<const std::uint32_t> code, std::uint32_t wordIndex) {
+    if (wordIndex >= code.size()) throw std::out_of_range("word index is out of the code span bounds");
+    const auto encoded = encodeGcn(code, wordIndex, programCounter);
+    auto instruction = DecodeRdnaEncodedInstruction(programCounter, std::span<const std::uint32_t>(encoded.words.data(), encoded.rdnaWords), 0);
+    instruction.wordCount = encoded.gcnWords;
+    return instruction;
+}
+
+}
diff --git a/core/shader/recompiler/RdnaDecoder/src/GcnOpcodeTables.hpp b/core/shader/recompiler/RdnaDecoder/src/GcnOpcodeTables.hpp
new file mode 100644
index 0000000000..cbe30ec329
--- /dev/null
+++ b/core/shader/recompiler/RdnaDecoder/src/GcnOpcodeTables.hpp
@@ -0,0 +1,187 @@
+#ifndef CORE_SHADER_RECOMPILIER_RDNADECODER_SRC_GCNOPCODETABLES_HPP
+#define CORE_SHADER_RECOMPILIER_RDNADECODER_SRC_GCNOPCODETABLES_HPP
+
+#include <array>
+#include <cstdint>
+#include <utility>
+
+namespace ShaderRecompiler::GcnTables {
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 47> Sop1{{
+    {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7}, {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa},
+    {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf}, {0x10, 0x10}, {0x11, 0x11}, {0x12, 0x12},
+    {0x13, 0x13}, {0x14, 0x14}, {0x15, 0x15}, {0x16, 0x16}, {0x17, 0x17}, {0x18, 0x18}, {0x19, 0x19}, {0x1a, 0x1a},
+    {0x1b, 0x1b}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1e, 0x1e}, {0x1f, 0x1f}, {0x20, 0x20}, {0x21, 0x21}, {0x22, 0x22},
+    {0x24, 0x24}, {0x25, 0x25}, {0x26, 0x26}, {0x27, 0x27}, {0x28, 0x28}, {0x29, 0x29}, {0x2a, 0x2a}, {0x2b, 0x2b},
+    {0x2c, 0x2c}, {0x2d, 0x2d}, {0x2e, 0x2e}, {0x2f, 0x2f}, {0x30, 0x30}, {0x31, 0x31}, {0x34, 0x34},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 42> Sop2{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa}, {0xb, 0xb}, {0xe, 0xe}, {0xf, 0xf}, {0x10, 0x10}, {0x11, 0x11},
+    {0x12, 0x12}, {0x13, 0x13}, {0x14, 0x14}, {0x15, 0x15}, {0x16, 0x16}, {0x17, 0x17}, {0x18, 0x18}, {0x19, 0x19},
+    {0x1a, 0x1a}, {0x1b, 0x1b}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1e, 0x1e}, {0x1f, 0x1f}, {0x20, 0x20}, {0x21, 0x21},
+    {0x22, 0x22}, {0x23, 0x23}, {0x24, 0x24}, {0x25, 0x25}, {0x26, 0x26}, {0x27, 0x27}, {0x28, 0x28}, {0x29, 0x29},
+    {0x2a, 0x2a}, {0x2c, 0x2c},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 16> Sopc{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 6> Sopk{{
+    {0x0, 0x0}, {0x2, 0x2}, {0x10, 0x10}, {0x12, 0x12}, {0x13, 0x13}, {0x15, 0x15},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 21> Sopp{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7}, {0x8, 0x8},
+    {0x9, 0x9}, {0xa, 0xa}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf}, {0x10, 0x10}, {0x11, 0x11},
+    {0x12, 0x12}, {0x13, 0x13}, {0x14, 0x14}, {0x15, 0x15}, {0x16, 0x16},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 13> Smrd{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa},
+    {0xb, 0xb}, {0xc, 0xc}, {0x1d, 0x21}, {0x1e, 0x24}, {0x1f, 0x21},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 58> Vop1{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf}, {0x10, 0x10},
+    {0x11, 0x11}, {0x12, 0x12}, {0x13, 0x13}, {0x14, 0x14}, {0x15, 0x15}, {0x16, 0x16}, {0x17, 0x17}, {0x18, 0x18},
+    {0x19, 0x19}, {0x1a, 0x1a}, {0x20, 0x20}, {0x21, 0x21}, {0x22, 0x22}, {0x23, 0x23}, {0x24, 0x24}, {0x25, 0x25},
+    {0x27, 0x27}, {0x2a, 0x2a}, {0x2b, 0x2b}, {0x2e, 0x2e}, {0x2f, 0x2f}, {0x31, 0x31}, {0x33, 0x33}, {0x34, 0x34},
+    {0x35, 0x35}, {0x36, 0x36}, {0x37, 0x37}, {0x38, 0x38}, {0x39, 0x39}, {0x3a, 0x3a}, {0x3b, 0x3b}, {0x3c, 0x3c},
+    {0x3d, 0x3d}, {0x3e, 0x3e}, {0x3f, 0x3f}, {0x40, 0x40}, {0x41, 0x41}, {0x42, 0x42}, {0x43, 0x43}, {0x44, 0x44},
+    {0x54, 0x54}, {0x55, 0x55},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 37> Vop2{{
+    {0x0, 0x1}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7}, {0x8, 0x8}, {0x9, 0x9},
+    {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xf, 0xf}, {0x10, 0x10}, {0x11, 0x11}, {0x12, 0x12}, {0x13, 0x13},
+    {0x14, 0x14}, {0x16, 0x16}, {0x18, 0x18}, {0x1a, 0x1a}, {0x1b, 0x1b}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1f, 0x1f},
+    {0x20, 0x20}, {0x21, 0x21}, {0x28, 0x28}, {0x29, 0x29}, {0x2a, 0x2a}, {0x2f, 0x2f}, {0x32, 0x32}, {0x33, 0x33},
+    {0x34, 0x34}, {0x35, 0x35}, {0x39, 0x39}, {0x3a, 0x3a}, {0x3b, 0x3b},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 216> Vopc{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf},
+    {0x10, 0x10}, {0x11, 0x11}, {0x12, 0x12}, {0x13, 0x13}, {0x14, 0x14}, {0x15, 0x15}, {0x16, 0x16}, {0x17, 0x17},
+    {0x18, 0x18}, {0x19, 0x19}, {0x1a, 0x1a}, {0x1b, 0x1b}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1e, 0x1e}, {0x1f, 0x1f},
+    {0x20, 0x20}, {0x21, 0x21}, {0x22, 0x22}, {0x23, 0x23}, {0x24, 0x24}, {0x25, 0x25}, {0x26, 0x26}, {0x27, 0x27},
+    {0x28, 0x28}, {0x29, 0x29}, {0x2a, 0x2a}, {0x2b, 0x2b}, {0x2c, 0x2c}, {0x2d, 0x2d}, {0x2e, 0x2e}, {0x2f, 0x2f},
+    {0x30, 0x30}, {0x31, 0x31}, {0x32, 0x32}, {0x33, 0x33}, {0x34, 0x34}, {0x35, 0x35}, {0x36, 0x36}, {0x37, 0x37},
+    {0x38, 0x38}, {0x39, 0x39}, {0x3a, 0x3a}, {0x3b, 0x3b}, {0x3c, 0x3c}, {0x3d, 0x3d}, {0x3e, 0x3e}, {0x3f, 0x3f},
+    {0x40, 0x0}, {0x41, 0x1}, {0x42, 0x2}, {0x43, 0x3}, {0x44, 0x4}, {0x45, 0x5}, {0x46, 0x6}, {0x47, 0x7},
+    {0x48, 0x8}, {0x49, 0x9}, {0x4a, 0xa}, {0x4b, 0xb}, {0x4c, 0xc}, {0x4d, 0xd}, {0x4e, 0xe}, {0x4f, 0xf},
+    {0x50, 0x10}, {0x51, 0x11}, {0x52, 0x12}, {0x53, 0x13}, {0x54, 0x14}, {0x55, 0x15}, {0x56, 0x16}, {0x57, 0x17},
+    {0x58, 0x18}, {0x59, 0x19}, {0x5a, 0x1a}, {0x5b, 0x1b}, {0x5c, 0x1c}, {0x5d, 0x1d}, {0x5e, 0x1e}, {0x5f, 0x1f},
+    {0x60, 0x20}, {0x61, 0x21}, {0x62, 0x22}, {0x63, 0x23}, {0x64, 0x24}, {0x65, 0x25}, {0x66, 0x26}, {0x67, 0x27},
+    {0x68, 0x28}, {0x69, 0x29}, {0x6a, 0x2a}, {0x6b, 0x2b}, {0x6c, 0x2c}, {0x6d, 0x2d}, {0x6e, 0x2e}, {0x6f, 0x2f},
+    {0x70, 0x30}, {0x71, 0x31}, {0x72, 0x32}, {0x73, 0x33}, {0x74, 0x34}, {0x75, 0x35}, {0x76, 0x36}, {0x77, 0x37},
+    {0x78, 0x38}, {0x79, 0x39}, {0x7a, 0x3a}, {0x7b, 0x3b}, {0x7c, 0x3c}, {0x7d, 0x3d}, {0x7e, 0x3e}, {0x7f, 0x3f},
+    {0x80, 0x80}, {0x81, 0x81}, {0x82, 0x82}, {0x83, 0x83}, {0x84, 0x84}, {0x85, 0x85}, {0x86, 0x86}, {0x87, 0x87},
+    {0x88, 0x88}, {0x89, 0x89}, {0x8a, 0x8a}, {0x8b, 0x8b}, {0x8c, 0x8c}, {0x8d, 0x8d}, {0x8e, 0x8e}, {0x90, 0x90},
+    {0x91, 0x91}, {0x92, 0x92}, {0x93, 0x93}, {0x94, 0x94}, {0x95, 0x95}, {0x96, 0x96}, {0x97, 0x97}, {0x98, 0x98},
+    {0xa0, 0xa0}, {0xa1, 0xa1}, {0xa2, 0xa2}, {0xa3, 0xa3}, {0xa4, 0xa4}, {0xa5, 0xa5}, {0xa6, 0xa6}, {0xa7, 0xa7},
+    {0xa8, 0xa8}, {0xa9, 0xa9}, {0xaa, 0xaa}, {0xab, 0xab}, {0xac, 0xac}, {0xad, 0xad}, {0xae, 0xae}, {0xb0, 0xb0},
+    {0xb1, 0xb1}, {0xb2, 0xb2}, {0xb3, 0xb3}, {0xb4, 0xb4}, {0xb5, 0xb5}, {0xb6, 0xb6}, {0xb7, 0xb7}, {0xb8, 0xb8},
+    {0xc0, 0xc0}, {0xc1, 0xc1}, {0xc2, 0xc2}, {0xc3, 0xc3}, {0xc4, 0xc4}, {0xc5, 0xc5}, {0xc6, 0xc6}, {0xc7, 0xc7},
+    {0xc8, 0xc8}, {0xc9, 0xc9}, {0xca, 0xca}, {0xcb, 0xcb}, {0xcc, 0xcc}, {0xcd, 0xcd}, {0xce, 0xce}, {0xcf, 0xcf},
+    {0xd0, 0xd0}, {0xd1, 0xd1}, {0xd2, 0xd2}, {0xd3, 0xd3}, {0xd4, 0xd4}, {0xd5, 0xd5}, {0xd6, 0xd6}, {0xd7, 0xd7},
+    {0xe0, 0xe0}, {0xe1, 0xe1}, {0xe2, 0xe2}, {0xe3, 0xe3}, {0xe4, 0xe4}, {0xe5, 0xe5}, {0xe6, 0xe6}, {0xe7, 0xe7},
+    {0xf0, 0xf0}, {0xf1, 0xf1}, {0xf2, 0xf2}, {0xf3, 0xf3}, {0xf4, 0xf4}, {0xf5, 0xf5}, {0xf6, 0xf6}, {0xf7, 0xf7},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 324> Vop3{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0x10, 0x10},
+    {0x11, 0x11}, {0x12, 0x12}, {0x13, 0x13}, {0x14, 0x14}, {0x15, 0x15}, {0x16, 0x16}, {0x17, 0x17}, {0x18, 0x18},
+    {0x19, 0x19}, {0x1a, 0x1a}, {0x1b, 0x1b}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1e, 0x1e}, {0x20, 0x20}, {0x21, 0x21},
+    {0x22, 0x22}, {0x23, 0x23}, {0x24, 0x24}, {0x25, 0x25}, {0x26, 0x26}, {0x27, 0x27}, {0x28, 0x28}, {0x29, 0x29},
+    {0x2a, 0x2a}, {0x2b, 0x2b}, {0x2c, 0x2c}, {0x2d, 0x2d}, {0x2e, 0x2e}, {0x30, 0x30}, {0x31, 0x31}, {0x32, 0x32},
+    {0x33, 0x33}, {0x34, 0x34}, {0x35, 0x35}, {0x36, 0x36}, {0x37, 0x37}, {0x38, 0x38}, {0x39, 0x39}, {0x3a, 0x3a},
+    {0x3b, 0x3b}, {0x3c, 0x3c}, {0x3d, 0x3d}, {0x3e, 0x3e}, {0x80, 0x80}, {0x81, 0x81}, {0x82, 0x82}, {0x83, 0x83},
+    {0x84, 0x84}, {0x85, 0x85}, {0x86, 0x86}, {0x87, 0x87}, {0x88, 0x88}, {0x89, 0x89}, {0x8a, 0x8a}, {0x8b, 0x8b},
+    {0x8c, 0x8c}, {0x8d, 0x8d}, {0x8e, 0x8e}, {0x90, 0x90}, {0x91, 0x91}, {0x92, 0x92}, {0x93, 0x93}, {0x94, 0x94},
+    {0x95, 0x95}, {0x96, 0x96}, {0x97, 0x97}, {0x98, 0x98}, {0xa0, 0xa0}, {0xa1, 0xa1}, {0xa2, 0xa2}, {0xa3, 0xa3},
+    {0xa4, 0xa4}, {0xa5, 0xa5}, {0xa6, 0xa6}, {0xa7, 0xa7}, {0xa8, 0xa8}, {0xa9, 0xa9}, {0xaa, 0xaa}, {0xab, 0xab},
+    {0xac, 0xac}, {0xad, 0xad}, {0xae, 0xae}, {0xb0, 0xb0}, {0xb1, 0xb1}, {0xb2, 0xb2}, {0xb3, 0xb3}, {0xb4, 0xb4},
+    {0xb5, 0xb5}, {0xb6, 0xb6}, {0xb7, 0xb7}, {0xb8, 0xb8}, {0xc0, 0xc0}, {0xc1, 0xc1}, {0xc2, 0xc2}, {0xc3, 0xc3},
+    {0xc4, 0xc4}, {0xc5, 0xc5}, {0xc6, 0xc6}, {0xc7, 0xc7}, {0xc8, 0xc8}, {0xc9, 0xc9}, {0xca, 0xca}, {0xcb, 0xcb},
+    {0xcc, 0xcc}, {0xcd, 0xcd}, {0xce, 0xce}, {0xcf, 0xcf}, {0xd0, 0xd0}, {0xd1, 0xd1}, {0xd2, 0xd2}, {0xd3, 0xd3},
+    {0xd4, 0xd4}, {0xd5, 0xd5}, {0xd6, 0xd6}, {0xd7, 0xd7}, {0xe0, 0xe0}, {0xe1, 0xe1}, {0xe2, 0xe2}, {0xe3, 0xe3},
+    {0xe4, 0xe4}, {0xe5, 0xe5}, {0xe6, 0xe6}, {0xe7, 0xe7}, {0xf0, 0xf0}, {0xf1, 0xf1}, {0xf2, 0xf2}, {0xf3, 0xf3},
+    {0xf4, 0xf4}, {0xf5, 0xf5}, {0xf6, 0xf6}, {0xf7, 0xf7}, {0x100, 0x101}, {0x101, 0x360}, {0x102, 0x361}, {0x103, 0x103},
+    {0x104, 0x104}, {0x105, 0x105}, {0x106, 0x106}, {0x107, 0x107}, {0x108, 0x108}, {0x109, 0x109}, {0x10a, 0x10a}, {0x10b, 0x10b},
+    {0x10c, 0x10c}, {0x10f, 0x10f}, {0x110, 0x110}, {0x111, 0x111}, {0x112, 0x112}, {0x113, 0x113}, {0x114, 0x114}, {0x116, 0x116},
+    {0x118, 0x118}, {0x11a, 0x11a}, {0x11b, 0x11b}, {0x11c, 0x11c}, {0x11d, 0x11d}, {0x11e, 0x363}, {0x11f, 0x11f}, {0x120, 0x120},
+    {0x121, 0x121}, {0x122, 0x364}, {0x123, 0x365}, {0x124, 0x366}, {0x125, 0x30f}, {0x126, 0x310}, {0x127, 0x319}, {0x128, 0x128},
+    {0x12b, 0x362}, {0x12d, 0x368}, {0x12e, 0x369}, {0x12f, 0x12f}, {0x130, 0x36a}, {0x131, 0x36b}, {0x132, 0x132}, {0x133, 0x133},
+    {0x134, 0x134}, {0x135, 0x135}, {0x139, 0x139}, {0x13a, 0x13a}, {0x13b, 0x13b}, {0x140, 0x140}, {0x141, 0x141}, {0x142, 0x142},
+    {0x143, 0x143}, {0x144, 0x144}, {0x145, 0x145}, {0x146, 0x146}, {0x147, 0x147}, {0x148, 0x148}, {0x149, 0x149}, {0x14a, 0x14a},
+    {0x14b, 0x14b}, {0x14c, 0x14c}, {0x14d, 0x14d}, {0x14e, 0x14e}, {0x14f, 0x14f}, {0x150, 0x150}, {0x151, 0x151}, {0x152, 0x152},
+    {0x153, 0x153}, {0x154, 0x154}, {0x155, 0x155}, {0x156, 0x156}, {0x157, 0x157}, {0x158, 0x158}, {0x159, 0x159}, {0x15a, 0x15a},
+    {0x15b, 0x15b}, {0x15c, 0x15c}, {0x15d, 0x15d}, {0x15e, 0x15e}, {0x15f, 0x15f}, {0x160, 0x160}, {0x164, 0x164}, {0x165, 0x165},
+    {0x166, 0x166}, {0x167, 0x167}, {0x168, 0x168}, {0x169, 0x169}, {0x16a, 0x16a}, {0x16b, 0x16b}, {0x16c, 0x16c}, {0x16d, 0x16d},
+    {0x16e, 0x16e}, {0x16f, 0x16f}, {0x170, 0x170}, {0x171, 0x171}, {0x172, 0x172}, {0x173, 0x173}, {0x174, 0x174}, {0x175, 0x175},
+    {0x176, 0x176}, {0x177, 0x177}, {0x180, 0x180}, {0x181, 0x181}, {0x182, 0x182}, {0x183, 0x183}, {0x184, 0x184}, {0x185, 0x185},
+    {0x186, 0x186}, {0x187, 0x187}, {0x188, 0x188}, {0x18a, 0x18a}, {0x18b, 0x18b}, {0x18c, 0x18c}, {0x18d, 0x18d}, {0x18e, 0x18e},
+    {0x18f, 0x18f}, {0x190, 0x190}, {0x191, 0x191}, {0x192, 0x192}, {0x193, 0x193}, {0x194, 0x194}, {0x195, 0x195}, {0x196, 0x196},
+    {0x197, 0x197}, {0x198, 0x198}, {0x199, 0x199}, {0x19a, 0x19a}, {0x1a0, 0x1a0}, {0x1a1, 0x1a1}, {0x1a2, 0x1a2}, {0x1a3, 0x1a3},
+    {0x1a4, 0x1a4}, {0x1a5, 0x1a5}, {0x1a7, 0x1a7}, {0x1aa, 0x1aa}, {0x1ab, 0x1ab}, {0x1ae, 0x1ae}, {0x1af, 0x1af}, {0x1b1, 0x1b1},
+    {0x1b3, 0x1b3}, {0x1b4, 0x1b4}, {0x1b5, 0x1b5}, {0x1b6, 0x1b6}, {0x1b7, 0x1b7}, {0x1b8, 0x1b8}, {0x1b9, 0x1b9}, {0x1ba, 0x1ba},
+    {0x1bb, 0x1bb}, {0x1bc, 0x1bc}, {0x1bd, 0x1bd}, {0x1be, 0x1be}, {0x1bf, 0x1bf}, {0x1c0, 0x1c0}, {0x1c1, 0x1c1}, {0x1c2, 0x1c2},
+    {0x1c3, 0x1c3}, {0x1c4, 0x1c4}, {0x1d4, 0x1d4}, {0x1d5, 0x1d5}, {0x303, 0x303}, {0x307, 0x307}, {0x308, 0x308}, {0x30d, 0x30d},
+    {0x30e, 0x30e}, {0x314, 0x314}, {0x346, 0x346}, {0x347, 0x347}, {0x351, 0x351}, {0x354, 0x354}, {0x357, 0x357}, {0x35e, 0x35e},
+    {0x36d, 0x36d}, {0x36f, 0x36f}, {0x371, 0x371}, {0x372, 0x372},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 56> Mubuf{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf},
+    {0x18, 0x18}, {0x1a, 0x1a}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1e, 0x1e}, {0x1f, 0x1f}, {0x30, 0x30}, {0x31, 0x31},
+    {0x32, 0x32}, {0x33, 0x33}, {0x35, 0x35}, {0x36, 0x36}, {0x37, 0x37}, {0x38, 0x38}, {0x39, 0x39}, {0x3a, 0x3a},
+    {0x3b, 0x3b}, {0x3c, 0x3c}, {0x3d, 0x3d}, {0x3e, 0x3e}, {0x3f, 0x3f}, {0x40, 0x40}, {0x50, 0x50}, {0x51, 0x51},
+    {0x52, 0x52}, {0x53, 0x53}, {0x55, 0x55}, {0x56, 0x56}, {0x57, 0x57}, {0x58, 0x58}, {0x59, 0x59}, {0x5a, 0x5a},
+    {0x5b, 0x5b}, {0x5c, 0x5c}, {0x5d, 0x5d}, {0x5e, 0x5e}, {0x5f, 0x5f}, {0x60, 0x60}, {0x70, 0x71}, {0x71, 0x71},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 124> Ds{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x6, 0x6}, {0x7, 0x7},
+    {0x8, 0x8}, {0x9, 0x9}, {0xa, 0xa}, {0xb, 0xb}, {0xc, 0xc}, {0xd, 0xd}, {0xe, 0xe}, {0xf, 0xf},
+    {0x10, 0x10}, {0x11, 0x11}, {0x12, 0x12}, {0x13, 0x13}, {0x14, 0x14}, {0x18, 0x18}, {0x19, 0x19}, {0x1a, 0x1a},
+    {0x1b, 0x1b}, {0x1c, 0x1c}, {0x1d, 0x1d}, {0x1e, 0x1e}, {0x1f, 0x1f}, {0x20, 0x20}, {0x21, 0x21}, {0x22, 0x22},
+    {0x23, 0x23}, {0x24, 0x24}, {0x25, 0x25}, {0x26, 0x26}, {0x27, 0x27}, {0x28, 0x28}, {0x29, 0x29}, {0x2a, 0x2a},
+    {0x2b, 0x2b}, {0x2c, 0x2c}, {0x2d, 0x2d}, {0x2e, 0x2e}, {0x2f, 0x2f}, {0x30, 0x30}, {0x31, 0x31}, {0x32, 0x32},
+    {0x33, 0x33}, {0x34, 0x34}, {0x35, 0x35}, {0x36, 0x36}, {0x37, 0x37}, {0x38, 0x38}, {0x39, 0x39}, {0x3a, 0x3a},
+    {0x3b, 0x3b}, {0x3c, 0x3c}, {0x3d, 0x3d}, {0x3e, 0x3e}, {0x3f, 0x3f}, {0x40, 0x40}, {0x41, 0x41}, {0x42, 0x42},
+    {0x43, 0x43}, {0x44, 0x44}, {0x45, 0x45}, {0x46, 0x46}, {0x47, 0x47}, {0x48, 0x48}, {0x49, 0x49}, {0x4a, 0x4a},
+    {0x4b, 0x4b}, {0x4c, 0x4c}, {0x4d, 0x4d}, {0x4e, 0x4e}, {0x4f, 0x4f}, {0x50, 0x50}, {0x51, 0x51}, {0x52, 0x52},
+    {0x53, 0x53}, {0x60, 0x60}, {0x61, 0x61}, {0x62, 0x62}, {0x63, 0x63}, {0x64, 0x64}, {0x65, 0x65}, {0x66, 0x66},
+    {0x67, 0x67}, {0x68, 0x68}, {0x69, 0x69}, {0x6a, 0x6a}, {0x6b, 0x6b}, {0x6c, 0x6c}, {0x6d, 0x6d}, {0x6e, 0x6e},
+    {0x6f, 0x6f}, {0x70, 0x70}, {0x71, 0x71}, {0x72, 0x72}, {0x73, 0x73}, {0x76, 0x76}, {0x77, 0x77}, {0x78, 0x78},
+    {0x7e, 0x7e}, {0x80, 0x80}, {0x81, 0x81}, {0x82, 0x82}, {0x83, 0x83}, {0x84, 0x84}, {0x85, 0x85}, {0x86, 0x86},
+    {0x87, 0x87}, {0x88, 0x88}, {0x89, 0x89}, {0x8a, 0x8a}, {0x8b, 0x8b}, {0x8d, 0x8d}, {0x92, 0x92}, {0x93, 0x93},
+    {0xde, 0xde}, {0xdf, 0xdf}, {0xfe, 0xfe}, {0xff, 0xff},
+}};
+
+inline constexpr std::array<std::pair<std::uint16_t, std::uint16_t>, 92> Mimg{{
+    {0x0, 0x0}, {0x1, 0x1}, {0x2, 0x2}, {0x3, 0x3}, {0x4, 0x4}, {0x5, 0x5}, {0x8, 0x8}, {0x9, 0x9},
+    {0xa, 0xa}, {0xb, 0xb}, {0xe, 0xe}, {0xf, 0xf}, {0x10, 0x10}, {0x11, 0x11}, {0x12, 0x12}, {0x14, 0x14},
+    {0x15, 0x15}, {0x16, 0x16}, {0x17, 0x17}, {0x18, 0x18}, {0x19, 0x19}, {0x1a, 0x1a}, {0x1b, 0x1b}, {0x1c, 0x1c},
+    {0x1d, 0x1d}, {0x1e, 0x1e}, {0x1f, 0x1f}, {0x20, 0x20}, {0x21, 0x21}, {0x22, 0x22}, {0x23, 0x23}, {0x24, 0x24},
+    {0x25, 0x25}, {0x26, 0x26}, {0x27, 0x27}, {0x28, 0x28}, {0x29, 0x29}, {0x2a, 0x2a}, {0x2b, 0x2b}, {0x2c, 0x2c},
+    {0x2d, 0x2d}, {0x2e, 0x2e}, {0x2f, 0x2f}, {0x30, 0x30}, {0x31, 0x31}, {0x32, 0x32}, {0x33, 0x33}, {0x34, 0x34},
+    {0x35, 0x35}, {0x36, 0x36}, {0x37, 0x37}, {0x38, 0x38}, {0x39, 0x39}, {0x3a, 0x3a}, {0x3b, 0x3b}, {0x3c, 0x3c},
+    {0x3d, 0x3d}, {0x3e, 0x3e}, {0x3f, 0x3f}, {0x40, 0x40}, {0x41, 0x41}, {0x44, 0x44}, {0x45, 0x45}, {0x46, 0x46},
+    {0x47, 0x47}, {0x48, 0x48}, {0x49, 0x49}, {0x4c, 0x4c}, {0x4d, 0x4d}, {0x4e, 0x4e}, {0x4f, 0x4f}, {0x50, 0x50},
+    {0x51, 0x51}, {0x54, 0x54}, {0x55, 0x55}, {0x56, 0x56}, {0x57, 0x57}, {0x58, 0x58}, {0x59, 0x59}, {0x5c, 0x5c},
+    {0x5d, 0x5d}, {0x5e, 0x5e}, {0x5f, 0x5f}, {0x60, 0x60}, {0x68, 0x68}, {0x69, 0x69}, {0x6a, 0x6a}, {0x6b, 0x6b},
+    {0x6c, 0x6c}, {0x6d, 0x6d}, {0x6e, 0x6e}, {0x6f, 0x6f},
+}};
+
+}
+
+#endif
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp
index c3d1a68701..acdbad34d0 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp
@@ -1,6 +1,7 @@
 #include "RdnaDecoder/RdnaDescriptorFormat.hpp"
 #include <algorithm>
 #include <array>
+#include <utility>
 
 namespace ShaderRecompiler {
 
@@ -111,6 +112,21 @@ bool IsFmaskTextureFormat(IrBufferFormat format) {
     return format >= IrBufferFormat::Fmask8_S2_F1 && format <= IrBufferFormat::Fmask64_S16_F8;
 }
 
+std::optional<FmaskLayout> FmaskLayoutOf(IrBufferFormat format) {
+    switch (format) {
+        case IrBufferFormat::Fmask8_S2_F1: return FmaskLayout{2u, 1u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S4_F1: return FmaskLayout{4u, 1u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S8_F1: return FmaskLayout{8u, 1u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S2_F2: return FmaskLayout{2u, 2u, 1u, 8u};
+        case IrBufferFormat::Fmask8_S4_F2: return FmaskLayout{4u, 2u, 2u, 8u};
+        case IrBufferFormat::Fmask8_S4_F4: return FmaskLayout{4u, 4u, 2u, 8u};
+        case IrBufferFormat::Fmask16_S8_F2: return FmaskLayout{8u, 2u, 2u, 16u};
+        case IrBufferFormat::Fmask32_S8_F4: return FmaskLayout{8u, 4u, 4u, 32u};
+        case IrBufferFormat::Fmask32_S8_F8: return FmaskLayout{8u, 8u, 4u, 32u};
+        default: return std::nullopt;
+    }
+}
+
 IrTextureNumericClass SampledTextureNumericClass(IrBufferFormat format) {
     const FormatInfo* info = FindFormatInfo(format);
     if (info == nullptr || !info->sampled) {
@@ -126,6 +142,17 @@ IrBufferFormat RemapTextureFormat(IrBufferFormat format) {
     return format == IrBufferFormat::Format11_11_10UNorm || format == IrBufferFormat::Format11_11_10UInt || format == IrBufferFormat::Format10_11_11Float ? IrBufferFormat::Format32UInt : format;
 }
 
+IrBufferFormat RemapStorageTextureFormat(IrBufferFormat format) {
+    switch (format) {
+        case IrBufferFormat::Format5_6_5UNorm:
+        case IrBufferFormat::Format5_5_5_1UNorm:
+        case IrBufferFormat::Format4_4_4_4UNorm:
+            return IrBufferFormat::Format16UInt;
+        default:
+            return RemapTextureFormat(format);
+    }
+}
+
 std::uint32_t DepthBitsTextureWidth(std::uint32_t word1, std::uint32_t word3) {
     const auto format = static_cast<IrBufferFormat>((word1 >> 20u) & 0x1ffu);
     const auto swizzle = (word3 >> 20u) & 0x1fu;
@@ -139,6 +166,76 @@ bool IsDepthBitsTexture(std::uint32_t word1, std::uint32_t word3) {
     return DepthBitsTextureWidth(word1, word3) != 0u;
 }
 
+const std::array<std::uint8_t, 128>& GcnBufferFormats() {
+    static const auto table = [] {
+        std::array<std::uint8_t, 128> formats{};
+        struct Family { std::uint32_t data; std::uint32_t first; bool normalized; bool floating; };
+        constexpr std::array<Family, 10> normalizedFamilies{{
+            {1u, 1u, true, false}, {2u, 7u, true, true}, {3u, 14u, true, false}, {5u, 23u, true, true}, {6u, 30u, true, true},
+            {7u, 37u, true, true}, {8u, 44u, true, false}, {9u, 50u, true, false}, {10u, 56u, true, false}, {12u, 65u, true, true},
+        }};
+        for (const auto& family : normalizedFamilies) {
+            for (std::uint32_t number = 0; number < 6u; ++number) formats[(family.data << 3u) | number] = static_cast<std::uint8_t>(family.first + number);
+            if (family.floating) formats[(family.data << 3u) | 7u] = static_cast<std::uint8_t>(family.first + 6u);
+        }
+        constexpr std::array<std::pair<std::uint32_t, std::uint32_t>, 4> wideFamilies{{{4u, 20u}, {11u, 62u}, {13u, 72u}, {14u, 75u}}};
+        for (const auto& [data, first] : wideFamilies) {
+            formats[(data << 3u) | 4u] = static_cast<std::uint8_t>(first);
+            formats[(data << 3u) | 5u] = static_cast<std::uint8_t>(first + 1u);
+            formats[(data << 3u) | 7u] = static_cast<std::uint8_t>(first + 2u);
+        }
+        return formats;
+    }();
+    return table;
+}
+
+std::uint32_t GcnImageFormat(std::uint32_t dataFormat, std::uint32_t numberFormat) {
+    constexpr std::uint32_t Unorm = 0u, Snorm = 1u, Float = 7u, Srgb = 9u;
+    if (dataFormat < 16u && numberFormat < 8u) return GcnBufferFormats()[(dataFormat << 3u) | numberFormat];
+    switch (dataFormat) {
+        case 1u: return numberFormat == Srgb ? 128u : 0u;
+        case 3u: return numberFormat == Srgb ? 129u : 0u;
+        case 10u: return numberFormat == Srgb ? 130u : 0u;
+        case 16u: return numberFormat == Unorm ? 133u : 0u;
+        case 17u: return numberFormat == Unorm ? 134u : 0u;
+        case 18u: return numberFormat == Unorm ? 135u : 0u;
+        case 19u: return numberFormat == Unorm ? 136u : 0u;
+        case 34u: return numberFormat == Float ? 132u : 0u;
+        case 35u: return numberFormat == Unorm ? 169u : numberFormat == Srgb ? 170u : 0u;
+        case 36u: return numberFormat == Unorm ? 171u : numberFormat == Srgb ? 172u : 0u;
+        case 37u: return numberFormat == Unorm ? 173u : numberFormat == Srgb ? 174u : 0u;
+        case 38u: return numberFormat == Unorm ? 175u : numberFormat == Snorm ? 176u : 0u;
+        case 39u: return numberFormat == Unorm ? 177u : numberFormat == Snorm ? 178u : 0u;
+        case 40u: return numberFormat == Unorm ? 179u : numberFormat == Snorm ? 180u : 0u;
+        case 41u: return numberFormat == Unorm ? 181u : numberFormat == Srgb ? 182u : 0u;
+        default: return 0u;
+    }
+}
+
+std::array<std::uint32_t, 8> GcnImageWords(std::span<const std::uint32_t, 8> gcn) {
+    const auto format = GcnImageFormat((gcn[1] >> 20u) & 0x3fu, (gcn[1] >> 26u) & 0xfu);
+    const auto width = gcn[2] & 0x3fffu;
+    const auto height = (gcn[2] >> 14u) & 0x3fffu;
+    const auto type = gcn[3] >> 28u;
+    const auto lastLevel = (gcn[3] >> 16u) & 0xfu;
+    const bool layered = type == 11u || type == 12u || type == 13u || type == 15u;
+    std::array<std::uint32_t, 8> words{};
+    words[0] = gcn[0];
+    words[1] = (gcn[1] & 0x000fffffu) | (format << 20u) | ((width & 3u) << 30u);
+    words[2] = (width >> 2u) | (height << 14u);
+    words[3] = (gcn[3] & 0x000fffffu) | (type << 28u);
+    words[4] = (layered ? (gcn[5] >> 13u) & 0x1fffu : gcn[4] & 0x1fffu) | ((gcn[5] & 0x1fffu) << 16u);
+    words[5] = lastLevel << 4u;
+    words[7] = ((gcn[3] >> 20u) & 0x1fu) | (((gcn[3] >> 25u) & 1u) << 5u) | (((gcn[4] >> 13u) & 0x3fffu) << 6u);
+    return words;
+}
+
+std::uint32_t GcnBufferWord3(std::uint32_t word1, std::uint32_t word3) {
+    const std::uint32_t format = GcnBufferFormats()[(word3 >> 12u) & 0x7fu];
+    const std::uint32_t outOfBounds = ((word1 >> 16u) & 0x3fffu) != 0u ? 1u : 3u;
+    return (word3 & 0xc0e00fffu) | (format << 12u) | (outOfBounds << 28u);
+}
+
 IrTextureNumericClass VertexInputNumericClass(IrBufferFormat format) {
     switch (format) {
     case IrBufferFormat::Format8UInt:
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaInstructionDecoder.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaInstructionDecoder.cpp
index abdb151c23..29cdbcc01b 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaInstructionDecoder.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaInstructionDecoder.cpp
@@ -90,6 +90,11 @@ RdnaInstructionFamily GetRdnaInstructionFamily(std::uint32_t word) {
 }
 
 RdnaInstruction DecodeRdnaInstruction(std::uint32_t programCounter, std::span<const std::uint32_t> code, std::uint32_t wordIndex) {
+    if (GcnGuestShaders()) return DecodeGcnInstruction(programCounter, code, wordIndex);
+    return DecodeRdnaEncodedInstruction(programCounter, code, wordIndex);
+}
+
+RdnaInstruction DecodeRdnaEncodedInstruction(std::uint32_t programCounter, std::span<const std::uint32_t> code, std::uint32_t wordIndex) {
     if (wordIndex >= code.size()) {
         throw std::out_of_range("word index is out of the code span bounds");
     }
diff --git a/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp b/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
index 98950f77cb..c1e192ce0b 100644
--- a/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
+++ b/core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp
@@ -935,6 +935,23 @@ RdnaInstruction DecodeRdnaFlat(std::uint32_t programCounter, std::span<const std
         instruction.sourceCount = 1;
         return instruction;
     }
+    if (seg == 1u) {
+        const RdnaOperand zero = scalarSource(128u);
+        instruction.source0 = saddr == 0x7Du ? vectorRegister(addr) : zero;
+        instruction.source1 = zero;
+        if (saddr != 0x7Du && saddr != 0x7Fu) {
+            instruction.source1 = scalarSource(saddr);
+            if (instruction.source1.kind != RdnaOperandKind::ScalarRegister &&
+                instruction.source1.kind != RdnaOperandKind::VccLo &&
+                instruction.source1.kind != RdnaOperandKind::VccHi &&
+                instruction.source1.kind != RdnaOperandKind::M0 &&
+                instruction.source1.kind != RdnaOperandKind::ExecLo) {
+                throw std::runtime_error("FLAT scratch scalar offset register is unsupported");
+            }
+        }
+        instruction.sourceCount = 2;
+        return instruction;
+    }
     instruction.source0 = vectorRegister(addr);
     if (seg == 0u || saddr == 0x7Du || saddr == 0x7Fu) {
         if (addr == 255u) {
diff --git a/core/shader/recompiler/Recompiler.cpp b/core/shader/recompiler/Recompiler.cpp
index ad94823d64..fad7606ef9 100644
--- a/core/shader/recompiler/Recompiler.cpp
+++ b/core/shader/recompiler/Recompiler.cpp
@@ -153,6 +153,10 @@ std::uint32_t DeviceMemoryLdsBytes(const RecompileRequest& request) {
     return bytes + 4u > request.target.maxWorkgroupSharedMemoryBytes ? static_cast<std::uint32_t>(bytes) : 0u;
 }
 
+bool HardwareFloat32Flush(const RecompileRequest& request) {
+    return request.target.float32FlushToZero && (!request.context.floatMode.has_value() || ((request.context.floatMode->floatMode >> 4u) & 3u) == 0u);
+}
+
 std::atomic<std::uint64_t> frontEndBuilds{0};
 
 }
@@ -169,7 +173,7 @@ struct PreparedControlFlow {
 
     bool Matches(const RecompileRequest& request, const SwappcInfo& swappcInfo) const {
         return stage == request.shader.stage && mergedHull == MergedHullStage(request) && swappc.fetchCallAllowed == swappcInfo.fetchCallAllowed &&
-               swappc.userDataBaseRegister == swappcInfo.userDataBaseRegister && swappc.userDataCount == swappcInfo.userDataCount &&
+               swappc.userDataBaseRegister == swappcInfo.userDataBaseRegister && swappc.userDataCount == swappcInfo.userDataCount && swappc.waveSize == swappcInfo.waveSize &&
                std::ranges::equal(fallbacks, swappcInfo.linkedCallFallbacks) && std::ranges::equal(code, request.shader.code);
     }
 
@@ -189,7 +193,7 @@ struct PreparedControlFlow {
 
 std::shared_ptr<const PreparedControlFlow> ShaderPreparationContext::AcquireFrontend(const RecompileRequest& request) {
     const auto inputInfo = RequestInputInfo(request);
-    const SwappcInfo swappc{inputInfo.vertex != nullptr, request.context.userDataBaseRegister, static_cast<std::uint32_t>(request.context.userData.size()), 0u, request.context.linkedCallFallbacks};
+    const SwappcInfo swappc{inputInfo.vertex != nullptr, request.context.userDataBaseRegister, static_cast<std::uint32_t>(request.context.userData.size()), request.context.waveSize, request.context.linkedCallFallbacks};
     static const bool reuse = std::getenv("APS5_NO_PERF_FRONTEND_PAIR") == nullptr;
     if (reuse && frontend != nullptr && frontend->Matches(request, swappc)) {
         return frontend;
@@ -231,6 +235,7 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat
     translateOptions.shaderHash = request.shader.codeAddress;
     translateOptions.waveSize = request.context.waveSize;
     translateOptions.userDataBaseRegister = request.context.userDataBaseRegister;
+    translateOptions.gcnLegacyVertexInputs = GcnGuestShaders() && request.context.userDataBaseRegister == 0u;
     translateOptions.userDataCount = static_cast<std::uint32_t>(request.context.userData.size());
     translateOptions.scratchDwords = request.context.compute.has_value() ? request.context.compute->scratchDwords : 0u;
     translateOptions.sharedMemoryBytes = DeviceMemoryLdsBytes(request);
@@ -239,8 +244,9 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat
     translateOptions.nativeFloat16 = supports(spv::CapabilityFloat16) && supports(spv::CapabilityRoundingModeRTE) && supports(spv::CapabilityDenormPreserve);
     translateOptions.interpolationFunctions = supports(spv::CapabilityInterpolationFunction);
     translateOptions.floatMode = request.context.floatMode;
-    translateOptions.float32FlushToZero = request.target.float32FlushToZero;
+    translateOptions.float32FlushToZero = HardwareFloat32Flush(request);
     translateOptions.inputInfo = inputInfo;
+    translateOptions.float32DenormPreserve = request.target.float32DenormPreserve;
 
     constexpr InstructionTranslator translator;
 
@@ -325,6 +331,8 @@ IrProgram PrepareResourceProgram(const RecompileRequest& request, ShaderPreparat
         tessellationLowering.Lower(program, inputInfo.vertex->tess, request.target.tessellation ? &*request.target.tessellation : nullptr);
     }
 
+    deadCodeEliminator.EliminateUnobservedPhis(program);
+    deadCodeEliminator.Eliminate(program);
     constexpr SrtWalker srtWalker;
     srtWalker.BuildPlan(program);
     deadCodeEliminator.Eliminate(program);
@@ -492,11 +500,7 @@ std::shared_ptr<SourceEntry> getSource(const RecompileRequest& request, ShaderPr
             std::vector<std::byte> planKey;
             if (disk) {
                 ShaderDiskCache::BuildPlanKey(request, HostSubgroupSize(request), planKey);
-                IrResourcePlan loaded;
-                if (ShaderDiskCache::LoadPlan(planKey, loaded)) {
-                    loaded.shaderHash = request.shader.codeAddress;
-                    source->plan = std::make_shared<const IrResourcePlan>(std::move(loaded));
-                }
+                source->plan = ShaderDiskCache::LoadSharedPlan(planKey, request.shader.codeAddress);
             }
             if (source->plan == nullptr) {
                 try {
@@ -602,8 +606,11 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
     targetOptions.float16DenormPreserve = request.target.float16DenormPreserve;
     targetOptions.spannedWaves = request.target.spannedWaves;
     targetOptions.robustBufferAccess2 = request.target.robustBufferAccess2;
-    targetOptions.float32FlushToZero = request.target.float32FlushToZero;
+    targetOptions.float32FlushToZero = HardwareFloat32Flush(request);
     targetOptions.float32DenormPreserve = request.target.float32DenormPreserve;
+    targetOptions.fusedExactArithmetic = request.target.fusedExactArithmetic;
+    targetOptions.largePixelFunctionLdsBuffer = request.target.largePixelFunctionLdsBuffer;
+    targetOptions.pixelFunctionStorageDwords = request.target.pixelFunctionStorageDwords;
     targetOptions.meshBarycentricPixel = request.shader.stage == ShaderStage::Fragment && request.graphics && request.graphics->mesh;
     if (request.shader.stage == ShaderStage::Mesh && request.graphics && request.graphics->meshBarycentrics) {
         const auto& paired = *request.graphics->meshBarycentrics;
@@ -638,6 +645,7 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
         if (budget.bytes > limits.maxOutputMemoryBytes) throw std::runtime_error("barycentric emulation on the mesh path needs " + std::to_string(budget.bytes) + " bytes of mesh output memory, the device allows " + std::to_string(limits.maxOutputMemoryBytes));
     }
     targetOptions.waveLdsMemoryBarriers = request.target.waveLdsMemoryBarriers;
+    targetOptions.deviceScopeLdsMemoryBarriers = request.target.deviceScopeLdsMemoryBarriers;
 
     constexpr SpirvEmitter spirvEmitter;
     CompiledShaderArtifact result;
@@ -648,30 +656,34 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
     } catch (const SpannedWaveUnsupported& error) {
         std::fprintf(stderr, "[spanned-wave] 0x%llx falls back to two lanes per invocation: %s\n", static_cast<unsigned long long>(request.shader.codeAddress), error.what());
         targetOptions.spannedWaves = false;
-        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions);
+        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions, &emitted);
     }
     if (registration && result.spirv.size() > request.target.registrationWordLimit) {
         registration = false;
         program.Metadata().bindingLayoutComplete = false;
         bindings = bindingAllocator.Allocate(program, request.layout, false, stencilReplay);
         targetOptions.registrationModules = false;
-        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions);
+        result.spirv = spirvEmitter.Emit(program, inputInfo, bindings, targetOptions, &emitted);
     }
     result.registrationModule = registration;
     if (request.shader.stage == ShaderStage::Mesh && request.graphics) result.meshBarycentrics = request.graphics->meshBarycentrics;
     result.stencilReplaySafe = (request.shader.stage == ShaderStage::Vertex || stencilReplay) && StencilReplaySafe(program);
+    result.bdaWrites = program.Info().bdaWrites;
     if (stencilReplay) {
         result.stencilReferences = StencilReferenceValues(program, request.context.pixel.has_value() && request.context.pixel->stencilOperationValueExport ? 8u : 0u);
         result.stencilReferenceDword = bindings.layout.stencilReferenceDword;
     }
 
     result.bdaAbiVersion = program.Info().usesDma || program.Info().usesFaultBuffer ? request.target.bdaAbiVersion : 0u;
+    result.windowLaneGuards = 0;
+    for (const auto& block : program.Blocks()) result.windowLaneGuards += static_cast<std::uint32_t>(std::ranges::count_if(block->Instructions(), [](const IrValue* value) { return value->Opcode() == IrOpcode::WindowLaneGuard; }));
     result.memoryOffsetDword = bindings.layout.memoryOffsetDword;
     result.shaderDataDwords = bindings.layout.ShaderDataDwords();
     result.imageMetadataDword = bindings.layout.ImageMetadataDword();
     result.runtimeImageCount = bindings.layout.runtimeImageCount;
     result.hostSubgroupSize = HostSubgroupSize(request);
     result.fullSubgroups = emitted.fullSubgroups;
+    result.functionLdsBuffer = emitted.functionLdsBuffer;
     result.vertexOffsetSgpr = program.Info().vertexOffsetSgpr;
     result.instanceOffsetSgpr = program.Info().instanceOffsetSgpr;
     result.vertexOffsetShared = program.Info().vertexOffsetShared;
@@ -685,7 +697,7 @@ CompiledVariant emitVariant(const RecompileRequest& request, IrProgram& program)
         result.fragmentParameters = DescribeFragmentParameters(program, inputInfo);
         const auto& inputs = program.Info().inputs;
         const auto reads = [&](StageInputKind kind) { return std::any_of(inputs.begin(), inputs.end(), [&](const auto& input) { return input.kind == kind; }); };
-        if (program.Metadata().barycentricEmulation) result.barycentricEmulation = {true, reads(StageInputKind::BaryCoordSmooth), reads(StageInputKind::BaryCoordNoPerspective)};
+        if (program.Metadata().barycentricEmulation) result.barycentricEmulation = {true, reads(StageInputKind::BaryCoordSmooth), reads(StageInputKind::BaryCoordNoPerspective), program.Info().smoothOffsetBarycentrics};
     }
     if (request.shader.stage == ShaderStage::Vertex || request.shader.stage == ShaderStage::Local) {
         if (inputInfo.vertex == nullptr) throw std::runtime_error("vertex input metadata is missing");
@@ -832,17 +844,19 @@ std::shared_ptr<const SpecializedModule> buildSpecializedModule(const CompiledSh
 #endif
     auto module = std::make_shared<SpecializedModule>();
     std::map<std::uint32_t, std::uint32_t> bindingNumbers;
+    std::unordered_set<std::uint32_t> functionLdsBuffer;
     for (std::size_t cursor = 5; cursor < materialized.size();) {
         const auto count = materialized[cursor] >> 16u;
         const auto op = static_cast<spv::Op>(materialized[cursor] & 0xffffu);
         if (op == spv::OpDecorate && count == 4u && materialized[cursor + 2u] == spv::DecorationBinding) bindingNumbers.emplace(materialized[cursor + 1u], materialized[cursor + 3u]);
-        if (op == spv::OpVariable && count >= 4u) {
+        if (op == spv::OpDecorate && count == 4u && materialized[cursor + 2u] == spv::DecorationDescriptorSet && materialized[cursor + 3u] == PixelFunctionLdsDescriptorSet) functionLdsBuffer.insert(materialized[cursor + 1u]);
+        if (op == spv::OpVariable && count >= 4u && !functionLdsBuffer.contains(materialized[cursor + 2u])) {
             if (const auto found = bindingNumbers.find(materialized[cursor + 2u]); found != bindingNumbers.end()) module->bindings.push_back(found->second);
             module->pushData |= materialized[cursor + 3u] == spv::StorageClassPushConstant;
         }
         cursor += count;
     }
-    module->spirv = std::move(materialized);
+    module->spirv = InternSpirv(std::move(materialized));
     module->specializationId = constants.empty() ? 0u : nextVariantId();
     return module;
 }
@@ -979,7 +993,24 @@ std::shared_ptr<const SpecializedModule> specializeModule(const CompiledShaderAr
     return entry->module;
 }
 
-RecompileResult materializeResult(const CompiledVariant& variant, const RecompileRequest& request, const ResourceSnapshot& snapshot, bool registrationDefaults = false) {
+const ResourceSnapshot& mergeTargetImage(const CompiledVariant& variant, const RecompileRequest& request, const ResourceSnapshot& snapshot, bool registrationDefaults, ResourceSnapshot& merged) {
+    const auto& images = variant.info.info.images;
+    const auto image = std::ranges::find_if(images, [](const ImageResource& candidate) { return candidate.targetMerge; });
+    if (image == images.end() || registrationDefaults) return snapshot;
+    if (!request.context.pixel || request.context.pixel->targetMerge.mask == 0u) throw std::runtime_error("ShaderRecompiler: a color target merge variant was materialized without the merged target");
+    if (image + 1 != images.end() || snapshot.images.size() + 1u != images.size()) throw std::runtime_error("ShaderRecompiler: the captured images do not precede the color target merge image");
+    merged = snapshot;
+    DescriptorValue descriptor;
+    std::ranges::copy(request.context.pixel->targetMerge.descriptor, descriptor.dwords.begin());
+    descriptor.dwordCount = 8u;
+    descriptor.availableDwordMask = 0xffu;
+    merged.images.push_back(descriptor);
+    return merged;
+}
+
+RecompileResult materializeResult(const CompiledVariant& variant, const RecompileRequest& request, const ResourceSnapshot& captured, bool registrationDefaults = false) {
+    ResourceSnapshot merged;
+    const auto& snapshot = mergeTargetImage(variant, request, captured, registrationDefaults, merged);
     RecompileResult result;
     const auto& artifact = variant.artifact;
     static_cast<CompiledShaderArtifact&>(result) = {
@@ -1000,12 +1031,14 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
         .instanceOffsetConflict = artifact.instanceOffsetConflict,
         .hostSubgroupSize = artifact.hostSubgroupSize,
         .fullSubgroups = artifact.fullSubgroups,
+        .functionLdsBuffer = artifact.functionLdsBuffer,
         .parameterExports = artifact.parameterExports,
         .fragmentParameters = artifact.fragmentParameters,
         .barycentricEmulation = artifact.barycentricEmulation,
         .meshBarycentrics = artifact.meshBarycentrics,
         .stencilReferences = artifact.stencilReferences,
         .stencilReplaySafe = artifact.stencilReplaySafe,
+        .bdaWrites = artifact.bdaWrites,
         .stencilReferenceDword = artifact.stencilReferenceDword,
         .variantId = artifact.variantId
     };
@@ -1055,7 +1088,13 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
             formatComponents = 1u;
             for (std::uint32_t component = 0; component < 4u; ++component) {
                 const auto selector = (input.outputMask & (1u << component)) != 0u ? (resource.fields[3] >> (component * 3u)) & 7u : 0u;
-                if (selector == 2u || selector == 3u) throw std::runtime_error("reserved prepared vertex component selector");
+                if (selector == 2u || selector == 3u) {
+                    const auto& fields = resource.fields;
+                    char message[192];
+                    std::snprintf(message, sizeof(message), "reserved prepared vertex component selector %u at location %u component %u (V#=[%08x %08x %08x %08x])",
+                        selector, input.location, component, fields[0], fields[1], fields[2], fields[3]);
+                    throw std::runtime_error(message);
+                }
                 if (selector >= 4u) formatComponents = std::max(formatComponents, selector - 3u);
                 selectors |= selector << (component * 3u);
             }
@@ -1125,6 +1164,7 @@ RecompileResult materializeResult(const CompiledVariant& variant, const Recompil
     DescriptorBindingBuilder{}.Populate(bindings, variant.bindings, *bindingPlan, variant.info.userDataBase, snapshot, partialThreads(request), &tables);
     result.workgroupMemoryDwords = WorkgroupMemoryStrideDwords(variant.info.info);
     result.bindings = std::move(bindings.bindings);
+    if (std::ranges::none_of(result.bindings, [](const DescriptorBinding& binding) { return binding.role == DescriptorRole::BdaPagetable || binding.role == DescriptorRole::FaultBuffer; })) result.bdaAbiVersion = 0u;
     result.pushConstants = std::move(bindings.pushConstants);
     result.readsDepthRemapPush = depthRemap;
     if (request.shader.stage == ShaderStage::Compute) {
@@ -1167,6 +1207,20 @@ bool sameLayout(const BindingLayout& left, const BindingLayout& right) {
 
 }
 
+SharedSpirv InternSpirv(std::vector<std::uint32_t> words) {
+    SharedSpirv spirv(std::move(words));
+    const auto hash = spirv.ContentHash();
+    static std::mutex mutex;
+    static std::unordered_map<std::uint64_t, std::vector<SharedSpirv>> interned;
+    std::lock_guard lock(mutex);
+    auto& candidates = interned[hash.low ^ (hash.high * 0x9e3779b97f4a7c15ull)];
+    for (const auto& candidate : candidates) {
+        if (candidate.ContentHash() == hash && candidate == spirv) return candidate;
+    }
+    candidates.push_back(spirv);
+    return spirv;
+}
+
 MeshOutputBudget MeshBarycentricOutputBudget(const MeshConfiguration& mesh, const MeshTargetLimits& limits, const MeshOutputUse& use) {
     const auto alignUp = [](std::uint64_t value, std::uint64_t granularity) { return granularity <= 1u ? value : (value + granularity - 1u) / granularity * granularity; };
     MeshOutputBudget budget;
@@ -1395,6 +1449,11 @@ std::uint64_t snapshotHash(const RecompileRequest& request, const ResourceSnapsh
         mix(request.context.pixel->reversedBlend);
         mix(static_cast<std::uint64_t>(request.context.pixel->rasterPrimitive));
         mix(request.context.pixel->layerExported);
+        const auto& merge = request.context.pixel->targetMerge;
+        mix(merge.target);
+        mix(merge.mask);
+        mix(merge.samples);
+        for (const auto word : merge.descriptor) mix(word);
     }
     if (request.context.vertex) {
         const auto& vertex = *request.context.vertex;
diff --git a/core/shader/recompiler/Recompiler.hpp b/core/shader/recompiler/Recompiler.hpp
index 127ed88d5b..9462ba0721 100644
--- a/core/shader/recompiler/Recompiler.hpp
+++ b/core/shader/recompiler/Recompiler.hpp
@@ -3,6 +3,7 @@
 
 #include "RuntimeAbi.hpp"
 #include "PipelineSpecialization.hpp"
+#include "prx/libc/include/general/AtomicSharedPtr.hpp"
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -12,6 +13,7 @@
 #include <memory>
 #include <optional>
 #include <span>
+#include <ranges>
 #include <utility>
 #include <string_view>
 #include <vector>
@@ -34,6 +36,17 @@ struct MemoryRegion {
     std::span<const std::byte> bytes;
 };
 
+class MemoryRegionView : public std::span<const MemoryRegion> {
+    using Base = std::span<const MemoryRegion>;
+public:
+    using Base::Base;
+    constexpr MemoryRegionView() noexcept = default;
+    constexpr MemoryRegionView(Base value) noexcept : Base(value) {}
+    template <std::ranges::contiguous_range TRange>
+        requires (!std::ranges::borrowed_range<TRange>)
+    MemoryRegionView(TRange&&) = delete;
+};
+
 struct ShaderBinary {
     ShaderStage stage;
     std::uint64_t codeAddress;
@@ -113,7 +126,8 @@ enum class ConservativeZExport : std::uint8_t {
 enum class ColorExportPacking : std::uint8_t {
     None,
     Unorm10_11_11,
-    Float11_11_10
+    Float11_11_10,
+    Unorm4_4_4_4
 };
 
 enum class RasterPrimitive : std::uint8_t {
@@ -150,6 +164,17 @@ inline constexpr std::uint32_t One = 3u;
 
 }
 
+struct TargetMerge {
+    std::uint8_t target = 0;
+    std::uint16_t mask = 0;
+    std::uint8_t samples = 1;
+    std::array<std::uint32_t, 8> descriptor{};
+    bool depthStencilWrites = false;
+    bool depthStencilTests = false;
+
+    bool operator==(const TargetMerge&) const = default;
+};
+
 struct ShaderPixelStageInfo {
     std::uint32_t interpolatorCount;
     std::array<std::uint32_t, 32> interpolatorSettings;
@@ -190,6 +215,7 @@ struct ShaderPixelStageInfo {
     bool iteratesSamples = false;
     PixelPositionLocation positionLocation = PixelPositionLocation::Center;
     std::array<std::uint8_t, 32> sampleLocations{};
+    TargetMerge targetMerge{};
     std::array<std::uint32_t, 4> sampleOrder{};
 };
 
@@ -214,6 +240,10 @@ struct ShaderVertexStageInfo {
     bool fetchEmbedded;
     std::uint32_t paClVsOutCntl = 0;
     std::uint32_t depthRemapMode = 0;
+    bool pointList = false;
+    float pointSize = 1.0f;
+    float pointSizeMin = 0.0f;
+    float pointSizeMax = 0.0f;
 };
 
 struct ShaderFloatMode {
@@ -237,7 +267,7 @@ struct GuestContext {
     std::optional<ShaderComputeStageInfo> compute;
     std::optional<ShaderPixelStageInfo> pixel;
     std::optional<ShaderVertexStageInfo> vertex;
-    std::span<const MemoryRegion> memory;
+    MemoryRegionView memory;
     std::optional<ShaderFloatMode> floatMode;
     std::span<const std::uint32_t> linkedCallFallbacks;
     bool convertedSamples = false;
@@ -293,6 +323,10 @@ struct SpirvTarget {
     bool float32FlushToZero = false;
     bool waveLdsMemoryBarriers = false;
     bool float32DenormPreserve = false;
+    bool fusedExactArithmetic = false;
+    bool largePixelFunctionLdsBuffer = false;
+    std::uint32_t pixelFunctionStorageDwords = 4096u;
+    bool deviceScopeLdsMemoryBarriers = false;
 };
 
 struct BindingLayout {
@@ -377,6 +411,7 @@ struct FragmentParameter {
     bool custom = false;
     bool flatP10 = false;
     bool vertexOrder = false;
+    bool flatP20 = false;
     bool operator==(const FragmentParameter&) const = default;
 };
 
@@ -384,6 +419,7 @@ struct BarycentricEmulation {
     bool active = false;
     bool smooth = false;
     bool linear = false;
+    bool smoothOffset = false;
     bool operator==(const BarycentricEmulation&) const = default;
 };
 
@@ -508,6 +544,7 @@ struct BarycentricEmulationLayout {
     std::uint32_t smoothLocation = NoLocation;
     std::uint32_t linearLocation = NoLocation;
     std::uint32_t positionsLocation = NoLocation;
+    std::uint32_t reciprocalWLocation = NoLocation;
     std::vector<std::pair<std::uint32_t, std::uint32_t>> perVertexLocations;
 };
 
@@ -626,6 +663,8 @@ private:
     std::shared_ptr<Holder> holder;
 };
 
+[[nodiscard]] SharedSpirv InternSpirv(std::vector<std::uint32_t> words);
+
 struct VertexInput {
     std::uint32_t location;
     std::uint32_t components;
@@ -653,6 +692,7 @@ struct CompiledShaderArtifact {
     std::vector<std::uint32_t> runtimeImageResources;
     bool registrationModule = false;
     std::uint32_t bdaAbiVersion = 0;
+    std::uint32_t windowLaneGuards = 0;
     std::uint32_t runtimeAbiVersion = RuntimeAbi::Version;
     std::vector<VertexInput> vertexInputs;
     std::int32_t vertexOffsetSgpr = -1;
@@ -663,12 +703,14 @@ struct CompiledShaderArtifact {
     bool instanceOffsetConflict = false;
     std::uint32_t hostSubgroupSize = 0;
     bool fullSubgroups = false;
+    bool functionLdsBuffer = false;
     std::vector<std::uint32_t> parameterExports;
     std::vector<FragmentParameter> fragmentParameters;
     BarycentricEmulation barycentricEmulation;
     std::optional<MeshBarycentricLayout> meshBarycentrics;
     std::vector<std::uint32_t> stencilReferences;
     bool stencilReplaySafe = false;
+    bool bdaWrites = false;
     std::uint32_t stencilReferenceDword = 0xffffffffu;
     std::uint64_t variantId = 0;
 };
@@ -703,7 +745,18 @@ struct PipelineIdentity {
     auto operator<=>(const PipelineIdentity&) const = default;
 };
 
+struct ResultKeyMemo {
+    mutable AtomicSharedPtr<const std::vector<std::uint32_t>> words;
+    ResultKeyMemo() = default;
+    ResultKeyMemo(const ResultKeyMemo&) {}
+    ResultKeyMemo& operator=(const ResultKeyMemo&) {
+        words.store(nullptr, std::memory_order_relaxed);
+        return *this;
+    }
+};
+
 struct RecompileResult : CompiledShaderArtifact, ShaderInvocation {
+    ResultKeyMemo drawKeyMemo;
     bool cacheHit = false;
     std::uint32_t workgroupMemoryDwords = 0;
     std::vector<std::uint32_t> shaderDataUserWords;
@@ -720,7 +773,7 @@ struct RecompileResult : CompiledShaderArtifact, ShaderInvocation {
         };
         mix(specialization.size());
         for (const auto& constant : specialization) mix(constant.id | (static_cast<std::uint64_t>(constant.value) << 32u));
-        mix(hostSubgroupSize | (fullSubgroups ? 0x10000u : 0u) | (static_cast<std::uint64_t>(workgroupMemoryDwords) << 32u));
+        mix(hostSubgroupSize | (fullSubgroups ? 0x10000u : 0u) | (functionLdsBuffer ? 0x20000u : 0u) | (static_cast<std::uint64_t>(workgroupMemoryDwords) << 32u));
         mix(bindings.size());
         for (const auto& binding : bindings) mix(binding.descriptorSet | (static_cast<std::uint64_t>(binding.binding) << 16u) | (static_cast<std::uint64_t>(binding.kind) << 40u) | (static_cast<std::uint64_t>(binding.count) << 48u));
         if (identity.Empty()) identity.low = 1;
diff --git a/core/shader/recompiler/ShaderCacheVersion.cmake b/core/shader/recompiler/ShaderCacheVersion.cmake
index 847a513496..f4477ed1e1 100644
--- a/core/shader/recompiler/ShaderCacheVersion.cmake
+++ b/core/shader/recompiler/ShaderCacheVersion.cmake
@@ -26,6 +26,7 @@ endforeach()
 list(SORT sources)
 list(SORT guard)
 get_filename_component(rootReal "${ROOT}" REALPATH)
+get_filename_component(recompilerReal "${RECOMPILER_DIR}" REALPATH)
 set(sourcesReal)
 foreach(source IN LISTS sources)
     get_filename_component(real "${source}" REALPATH)
@@ -39,8 +40,11 @@ foreach(source IN LISTS sources)
     if(NOT EXISTS "${source}")
         continue()
     endif()
-    file(SHA256 "${source}" digest)
-    file(RELATIVE_PATH relative "${ROOT}" "${source}")
+    get_filename_component(sourceReal "${source}" REALPATH)
+    file(READ "${source}" text)
+    string(REPLACE "\r\n" "\n" text "${text}")
+    string(SHA256 digest "${text}")
+    file(RELATIVE_PATH relative "${rootReal}" "${sourceReal}")
     string(APPEND manifest "${relative} ${digest}\n")
     if(NOT source MATCHES "\\.(cpp|hpp|h)$")
         continue()
@@ -50,11 +54,11 @@ foreach(source IN LISTS sources)
         string(REGEX MATCHALL "\"APS5_[A-Z0-9_]+\"" names "${line}")
         list(APPEND switches ${names})
     endforeach()
-    string(FIND "${source}" "${RECOMPILER_DIR}/" inRecompiler)
+    string(FIND "${sourceReal}" "${recompilerReal}/" inRecompiler)
     if(NOT inRecompiler EQUAL 0)
         continue()
     endif()
-    get_filename_component(sourceDirectory "${source}" DIRECTORY)
+    get_filename_component(sourceDirectory "${sourceReal}" DIRECTORY)
     file(STRINGS "${source}" lines ENCODING UTF-8 REGEX "^[ \t]*#[ \t]*include[ \t]*\"[^\"]+\"")
     foreach(line IN LISTS lines)
         string(REGEX REPLACE "^[ \t]*#[ \t]*include[ \t]*\"([^\"]+)\".*$" "\\1" included "${line}")
@@ -65,7 +69,7 @@ foreach(source IN LISTS sources)
                 break()
             endif()
         endforeach()
-        file(RELATIVE_PATH relativeSource "${ROOT}" "${source}")
+        file(RELATIVE_PATH relativeSource "${rootReal}" "${sourceReal}")
         if(NOT resolved)
             continue()
         endif()
diff --git a/core/shader/recompiler/ShaderDiskCache.cpp b/core/shader/recompiler/ShaderDiskCache.cpp
index bcda9f0c40..aca1cb4eea 100644
--- a/core/shader/recompiler/ShaderDiskCache.cpp
+++ b/core/shader/recompiler/ShaderDiskCache.cpp
@@ -1,4 +1,5 @@
 #include "ShaderDiskCache.hpp"
+#include "RdnaDecoder/RdnaInstructionDecoder.hpp"
 #include "CacheKey.hpp"
 #include "ShaderCachePack.hpp"
 #include "ShaderCacheDirectory.hpp"
@@ -86,7 +87,7 @@ namespace ShaderRecompiler::ShaderDiskCache {
 #if defined(__linux__) && defined(__x86_64__) && defined(__GLIBCXX__)
 static_assert(sizeof(CompiledShaderArtifact) == 280, "CompiledShaderArtifact changed: update the artifact encoder");
 static_assert(sizeof(ShaderInvocation) == 216, "ShaderInvocation changed: update the invocation encoder");
-static_assert(sizeof(RecompileResult) == 528, "RecompileResult changed: update EncodeResult and DecodeResult");
+static_assert(sizeof(RecompileResult) == 544, "RecompileResult changed: update EncodeResult and DecodeResult");
 static_assert(sizeof(DescriptorBinding) == 656, "DescriptorBinding changed: update the binding encoder");
 static_assert(sizeof(VertexAttribute) == 32, "VertexAttribute changed: update the attribute encoder");
 static_assert(sizeof(VertexInput) == 16, "VertexInput changed: update the vertex input encoder");
@@ -94,7 +95,7 @@ static_assert(sizeof(FragmentParameter) == 16, "FragmentParameter changed: updat
 static_assert(sizeof(CompiledShaderInfo) == 352, "CompiledShaderInfo changed: update the info encoder");
 static_assert(sizeof(ShaderInfo) == 232, "ShaderInfo changed: update the info encoder");
 static_assert(sizeof(BufferResource) == 32, "BufferResource changed: update the info encoder");
-static_assert(sizeof(ImageResource) == 92, "ImageResource changed: update the info encoder");
+static_assert(sizeof(ImageResource) == 96, "ImageResource changed: update the info encoder");
 static_assert(sizeof(SamplerResource) == 24, "SamplerResource changed: update the info encoder");
 static_assert(sizeof(SampledResourcePair) == 12, "SampledResourcePair changed: update the info encoder");
 static_assert(sizeof(StageInput) == 56, "StageInput changed: update the info encoder");
@@ -138,9 +139,9 @@ constexpr std::size_t fieldCount() {
     }
 }
 
-static_assert(fieldCount<ShaderInfo>() == 23, "ShaderInfo changed: update the info encoder");
+static_assert(fieldCount<ShaderInfo>() == 24, "ShaderInfo changed: update the info encoder");
 static_assert(fieldCount<BufferResource>() == 12, "BufferResource changed: update the info encoder");
-static_assert(fieldCount<ImageResource>() == 41, "ImageResource changed: update the info encoder");
+static_assert(fieldCount<ImageResource>() == 43, "ImageResource changed: update the info encoder");
 static_assert(fieldCount<SamplerResource>() == 8, "SamplerResource changed: update the info encoder");
 static_assert(fieldCount<SampledResourcePair>() == 3, "SampledResourcePair changed: update the info encoder");
 static_assert(fieldCount<StageInput>() == 5, "StageInput changed: update the info encoder");
@@ -173,6 +174,49 @@ std::size_t PayloadOffset(std::size_t keyBytes) {
     return (sizeof(FileHeader) + keyBytes + alignment - 1) / alignment * alignment;
 }
 
+class SharedPlanTable {
+public:
+    std::shared_ptr<const IrResourcePlan> Get(std::span<const std::byte> payload, std::uint64_t shaderHash) {
+        const Key key{HashBytes(payload), HashBytes(payload, 0x5eed0003ull), payload.size(), shaderHash};
+        {
+            std::lock_guard lock(mutex);
+            if (const auto found = plans.find(key); found != plans.end()) {
+                if (auto plan = found->second.lock()) return plan;
+            }
+        }
+        IrResourcePlan decoded;
+        if (!DecodePlan(payload, decoded)) return nullptr;
+        decoded.shaderHash = shaderHash;
+        auto plan = std::make_shared<const IrResourcePlan>(std::move(decoded));
+        std::lock_guard lock(mutex);
+        auto& slot = plans[key];
+        if (auto existing = slot.lock()) return existing;
+        slot = plan;
+        if (++inserts % 1024u == 0u) std::erase_if(plans, [](const auto& entry) { return entry.second.expired(); });
+        return plan;
+    }
+
+private:
+    struct Key {
+        std::uint64_t low;
+        std::uint64_t high;
+        std::uint64_t bytes;
+        std::uint64_t shaderHash;
+        bool operator==(const Key&) const = default;
+    };
+    struct KeyHash {
+        std::size_t operator()(const Key& key) const { return static_cast<std::size_t>(key.low ^ (key.high * 0x9e3779b97f4a7c15ull) ^ (key.shaderHash * 0xff51afd7ed558ccdull)); }
+    };
+    std::mutex mutex;
+    std::unordered_map<Key, std::weak_ptr<const IrResourcePlan>, KeyHash> plans;
+    std::uint64_t inserts = 0;
+};
+
+SharedPlanTable& sharedPlans() {
+    static SharedPlanTable table;
+    return table;
+}
+
 class MappedFile {
 public:
     MappedFile(const void* data, std::size_t size) : data(data), size(size) {}
@@ -469,6 +513,7 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
     writer.Value(result.runtimeAbiVersion);
     writer.Values(std::span<const std::uint32_t>(result.spirv.Words()));
     writer.Value(result.bdaAbiVersion);
+    writer.Value(result.windowLaneGuards);
     writer.Value(result.memoryOffsetDword);
     writer.Value(result.shaderDataDwords);
     writer.Value(result.imageMetadataDword);
@@ -494,6 +539,7 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
     writer.Value(result.instanceOffsetConflict);
     writer.Value(result.hostSubgroupSize);
     writer.Value(result.fullSubgroups);
+    writer.Value(result.functionLdsBuffer);
     writer.Values(std::span<const std::uint32_t>(result.parameterExports));
     writer.List(result.fragmentParameters, [](Writer& out, const FragmentParameter& parameter) {
         out.Value(parameter.location);
@@ -503,10 +549,12 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
         out.Value(parameter.custom);
         out.Value(parameter.flatP10);
         out.Value(parameter.vertexOrder);
+        out.Value(parameter.flatP20);
     });
     writer.Value(result.barycentricEmulation.active);
     writer.Value(result.barycentricEmulation.smooth);
     writer.Value(result.barycentricEmulation.linear);
+    writer.Value(result.barycentricEmulation.smoothOffset);
     writer.Value(result.meshBarycentrics.has_value());
     if (result.meshBarycentrics) {
         writer.Value(result.meshBarycentrics->emulation.active);
@@ -520,6 +568,7 @@ void encodeArtifact(Writer& writer, const CompiledShaderArtifact& result) {
     }
     writer.Values(std::span<const std::uint32_t>(result.stencilReferences));
     writer.Value(result.stencilReplaySafe);
+    writer.Value(result.bdaWrites);
     writer.Value(result.stencilReferenceDword);
 }
 
@@ -527,6 +576,7 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
     reader.Value(result.runtimeAbiVersion);
     result.spirv = reader.Spirv();
     reader.Value(result.bdaAbiVersion);
+    reader.Value(result.windowLaneGuards);
     reader.Value(result.memoryOffsetDword);
     reader.Value(result.shaderDataDwords);
     reader.Value(result.imageMetadataDword);
@@ -552,6 +602,7 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
     reader.Value(result.instanceOffsetConflict);
     reader.Value(result.hostSubgroupSize);
     reader.Value(result.fullSubgroups);
+    reader.Value(result.functionLdsBuffer);
     reader.Values(result.parameterExports);
     reader.List(result.fragmentParameters, 10, [](Reader& in, FragmentParameter& parameter) {
         in.Value(parameter.location);
@@ -561,10 +612,12 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
         in.Value(parameter.custom);
         in.Value(parameter.flatP10);
         in.Value(parameter.vertexOrder);
+        in.Value(parameter.flatP20);
     });
     reader.Value(result.barycentricEmulation.active);
     reader.Value(result.barycentricEmulation.smooth);
     reader.Value(result.barycentricEmulation.linear);
+    reader.Value(result.barycentricEmulation.smoothOffset);
     bool hasMeshBarycentrics = false;
     reader.Value(hasMeshBarycentrics);
     result.meshBarycentrics.reset();
@@ -582,6 +635,7 @@ void decodeArtifact(Reader& reader, CompiledShaderArtifact& result) {
     }
     reader.Values(result.stencilReferences);
     reader.Value(result.stencilReplaySafe);
+    reader.Value(result.bdaWrites);
     reader.Value(result.stencilReferenceDword);
     result.variantId = 0;
 }
@@ -745,6 +799,7 @@ void encodeShaderInfo(Writer& writer, const ShaderInfo& info) {
         out.Value(image.volumeArraySampleCompatible);
         out.Value(image.flatLineCompatible);
         out.Value(image.flatVolumeLineCompatible);
+        out.Value(image.dimensionQueryOnly);
         out.Value(image.foldTexelOffsetsOnly);
         out.Value(image.convertedSamples);
         out.Value(image.remappedDepth1D);
@@ -754,6 +809,7 @@ void encodeShaderInfo(Writer& writer, const ShaderInfo& info) {
         out.Value(image.emulatedCompare);
         out.Value(image.table);
         out.Value(image.tableOperation);
+        out.Value(image.targetMerge);
     });
     writer.Value(!info.runtimeImageModes.empty());
     writer.List(info.samplers, [](Writer& out, const SamplerResource& sampler) {
@@ -798,6 +854,7 @@ void encodeShaderInfo(Writer& writer, const ShaderInfo& info) {
     writer.Value(info.dispatchThreadLimit);
     writer.Value(info.rasterPrimitive);
     writer.Value(info.layerExported);
+    writer.Value(info.smoothOffsetBarycentrics);
 }
 
 void decodeShaderInfo(Reader& reader, ShaderInfo& info) {
@@ -850,6 +907,7 @@ void decodeShaderInfo(Reader& reader, ShaderInfo& info) {
         in.Value(image.volumeArraySampleCompatible);
         in.Value(image.flatLineCompatible);
         in.Value(image.flatVolumeLineCompatible);
+        in.Value(image.dimensionQueryOnly);
         in.Value(image.foldTexelOffsetsOnly);
         in.Value(image.convertedSamples);
         in.Value(image.remappedDepth1D);
@@ -859,6 +917,7 @@ void decodeShaderInfo(Reader& reader, ShaderInfo& info) {
         in.Value(image.emulatedCompare);
         in.Value(image.table);
         in.Value(image.tableOperation);
+        in.Value(image.targetMerge);
     });
     bool preparedImageModes = false;
     reader.Value(preparedImageModes);
@@ -905,6 +964,7 @@ void decodeShaderInfo(Reader& reader, ShaderInfo& info) {
     reader.Value(info.dispatchThreadLimit);
     reader.Value(info.rasterPrimitive);
     reader.Value(info.layerExported);
+    reader.Value(info.smoothOffsetBarycentrics);
 }
 
 void encodeInfo(Writer& writer, const CompiledShaderInfo& compiled) {
@@ -1401,6 +1461,18 @@ public:
         return load(key, [&](std::span<const std::byte> file, std::shared_ptr<const void>) { return DecodePlanEntry(file, key, plan); }, planHits, planMisses, planLoadFailures);
     }
 
+    std::shared_ptr<const IrResourcePlan> LoadSharedPlan(std::span<const std::byte> key, std::uint64_t shaderHash) {
+        std::shared_ptr<const IrResourcePlan> plan;
+        load(key, [&](std::span<const std::byte> file, std::shared_ptr<const void>) {
+            std::span<const std::byte> payload;
+            const auto status = unwrapEntry(file, key, payload);
+            if (status != LoadStatus::Loaded) return status;
+            plan = sharedPlans().Get(payload, shaderHash);
+            return plan != nullptr ? LoadStatus::Loaded : LoadStatus::Rejected;
+        }, planHits, planMisses, planLoadFailures);
+        return plan;
+    }
+
     void Store(std::vector<std::byte> key, std::shared_ptr<const CompiledVariant> variant) {
         enqueue({std::move(key), std::move(variant), nullptr});
     }
@@ -1780,6 +1852,7 @@ void BuildKey(const RecompileRequest& request, std::uint32_t hostSubgroupSize, s
     writer.Value(FileMagic);
     writer.Value(FormatVersion);
     writer.Value(SourceVersion());
+    writer.Value(static_cast<std::uint8_t>(GcnGuestShaders()));
     thread_local std::vector<std::uint64_t>* memoryKeySlot = nullptr;
     auto& memoryKey = ThreadOwned(memoryKeySlot);
     RecompileCacheKey::Build(request, memoryKey);
@@ -1800,6 +1873,7 @@ void BuildPlanKey(const RecompileRequest& request, std::uint32_t hostSubgroupSiz
     writer.Value(FileMagic);
     writer.Value(FormatVersion);
     writer.Value(SourceVersion());
+    writer.Value(static_cast<std::uint8_t>(GcnGuestShaders()));
     writer.Value(PlanEntryKind);
     thread_local std::vector<std::uint64_t>* memoryKeySlot = nullptr;
     auto& memoryKey = ThreadOwned(memoryKeySlot);
@@ -1908,6 +1982,11 @@ bool LoadPlan(std::span<const std::byte> key, IrResourcePlan& plan) {
     return instance.Enabled() && instance.LoadPlan(key, plan);
 }
 
+std::shared_ptr<const IrResourcePlan> LoadSharedPlan(std::span<const std::byte> key, std::uint64_t shaderHash) {
+    auto& instance = store();
+    return instance.Enabled() ? instance.LoadSharedPlan(key, shaderHash) : nullptr;
+}
+
 void StorePlan(std::vector<std::byte> key, std::shared_ptr<const IrResourcePlan> plan) {
     auto& instance = store();
     if (instance.Enabled() && plan != nullptr) instance.StorePlan(std::move(key), std::move(plan));
diff --git a/core/shader/recompiler/ShaderDiskCache.hpp b/core/shader/recompiler/ShaderDiskCache.hpp
index e5acfa71f9..d4cf9e2f30 100644
--- a/core/shader/recompiler/ShaderDiskCache.hpp
+++ b/core/shader/recompiler/ShaderDiskCache.hpp
@@ -13,7 +13,7 @@
 
 namespace ShaderRecompiler::ShaderDiskCache {
 
-inline constexpr std::uint32_t FormatVersion = 44;
+inline constexpr std::uint32_t FormatVersion = 47;
 
 enum class LoadStatus {
     Loaded,
@@ -71,6 +71,7 @@ void BuildPlanKey(const RecompileRequest& request, std::uint32_t hostSubgroupSiz
 void Store(std::vector<std::byte> key, std::shared_ptr<const CompiledVariant> variant);
 [[nodiscard]] std::shared_ptr<const CompiledVariant> Persist(std::span<const std::byte> key, const CompiledVariant& variant);
 [[nodiscard]] bool LoadPlan(std::span<const std::byte> key, IrResourcePlan& plan);
+[[nodiscard]] std::shared_ptr<const IrResourcePlan> LoadSharedPlan(std::span<const std::byte> key, std::uint64_t shaderHash);
 void StorePlan(std::vector<std::byte> key, std::shared_ptr<const IrResourcePlan> plan);
 void Flush();
 void Shutdown();
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp
index ee435ffc67..2dbe8f7d03 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvAnalysis.hpp
@@ -39,6 +39,8 @@ struct SpirvRequirements {
 
 [[nodiscard]] SpirvRequirements AnalyzeProgramRequirements(const IrProgram& program);
 inline constexpr std::uint32_t FunctionLdsDwordLimit = 8192u;
+inline constexpr std::uint32_t PixelFunctionStorageDwords = 4096u;
+inline constexpr std::uint32_t PixelFunctionLdsDescriptorSet = 2u;
 [[nodiscard]] std::uint32_t FunctionLdsDwords(const IrProgram& program);
 [[nodiscard]] std::unordered_map<const IrValue*, std::uint32_t> FunctionLdsLaneAddresses(const IrProgram& program);
 [[nodiscard]] std::unordered_set<const IrValue*> WaveUniformValues(const IrProgram& program);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp
index 8c8c56b4ad..146fb2318a 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitter.hpp
@@ -30,6 +30,7 @@ struct SpirvTargetOptions {
     bool robustBufferAccess2 = false;
     bool float32FlushToZero = false;
     bool float32DenormPreserve = false;
+    bool fusedExactArithmetic = false;
     bool meshBarycentricPixel = false;
     bool meshBarycentricVertex = false;
     std::uint32_t barycentricSmoothLocation = 0xffffffffu;
@@ -38,10 +39,14 @@ struct SpirvTargetOptions {
     std::vector<std::uint32_t> meshExportedLocations;
     std::vector<std::pair<std::uint32_t, std::uint32_t>> meshPerVertexLocations;
     bool waveLdsMemoryBarriers = false;
+    bool largePixelFunctionLdsBuffer = false;
+    std::uint32_t pixelFunctionStorageDwords = 4096u;
+    bool deviceScopeLdsMemoryBarriers = false;
 };
 
 struct SpirvEmitInfo {
     bool fullSubgroups = false;
+    bool functionLdsBuffer = false;
 };
 
 struct SpannedWaveUnsupported : std::runtime_error {
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp
index 96951cf815..4be0132c1d 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterHelpers.hpp
@@ -70,6 +70,7 @@ void DecorateTableNonUniform(SpirvEmitterState& state, std::uint32_t id);
 bool TablePointSampled(const ImageResource& image);
 bool TableModeEmitted(const ImageResource& mode);
 std::uint32_t StorageImageDescriptorPointer(SpirvEmitterState& state, std::uint32_t resource);
+std::uint32_t EmitStorageImageRead(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t coord, std::uint32_t sample);
 void EmitStorageImageWrite(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t mipLod, std::uint32_t coord, std::uint32_t texel, std::uint32_t sample);
 std::uint32_t ExecutionModelForStage(IrShaderStage stage);
 std::uint32_t ConstantI32(SpirvEmitterState& state, std::int32_t value);
@@ -100,6 +101,7 @@ DppTargetLane EmitDppMirrorTargetLane(SpirvEmitterState& state, std::uint32_t su
 DppTargetLane EmitDppTargetLane(SpirvEmitterState& state, std::uint32_t control);
 std::uint32_t InputVariableForKind(const SpirvEmitterState& state, StageInputKind kind);
 bool OrderedPixelShader(const SpirvEmitterState& state);
+void FlushColorTargetMerge(SpirvEmitterState& state);
 const SpirvInputBinding* SpirvInputBindingForParameter(const SpirvEmitterState& state, std::uint32_t location);
 std::uint32_t EmitVertexParameterComponentU32(SpirvEmitterState& state, const SpirvInputBinding& input, std::uint32_t component);
 std::uint32_t EmitInputComponentU32(SpirvEmitterState& state, StageInputKind kind, std::uint32_t component);
@@ -112,6 +114,7 @@ void EmitMemoryOffsets(SpirvEmitterState& state);
 std::uint32_t LdsDwordCount(const SpirvEmitterState& state);
 bool LdsInDeviceMemory(const SpirvEmitterState& state);
 std::uint32_t LdsMemorySemantics(const SpirvEmitterState& state);
+std::uint32_t LdsMemoryBarrierScope(const SpirvEmitterState& state);
 void EmitLdsBufferBase(SpirvEmitterState& state);
 std::uint32_t EmitLdsLockPointer(SpirvEmitterState& state);
 std::uint32_t EmitLdsBufferU64Pointer(SpirvEmitterState& state, std::uint32_t index);
@@ -154,6 +157,7 @@ std::uint32_t EmitF16BitsToF32Decoded(SpirvEmitterState& state, std::uint32_t bi
 void EmitProgram(SpirvEmitterState& state);
 void DefineGetBdaPointer(SpirvEmitterState& state);
 void DefineDot2F32F16Function(SpirvEmitterState& state);
+void DefineReciprocalCorrectionFunction(SpirvEmitterState& state);
 void EmitLabel(SpirvEmitterState& state, std::uint32_t label);
 std::uint32_t Unary(SpirvEmitterState& state, std::uint32_t opcode, std::uint32_t type, std::uint32_t value);
 std::uint32_t Binary(SpirvEmitterState& state, std::uint32_t opcode, std::uint32_t type, std::uint32_t lhs, std::uint32_t rhs);
@@ -161,8 +165,8 @@ std::uint32_t Select(SpirvEmitterState& state, std::uint32_t type, std::uint32_t
 std::uint32_t AtomicIncrement(SpirvEmitterState& state, std::uint32_t old, std::uint32_t limit);
 std::uint32_t AtomicDecrement(SpirvEmitterState& state, std::uint32_t old, std::uint32_t limit);
 std::uint32_t AtomicUSubSat(SpirvEmitterState& state, std::uint32_t old, std::uint32_t value);
-std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue);
-std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator);
+std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue, bool flush);
+std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator, bool flush);
 
 template<std::uint32_t TOpcode, IrType TValueType, typename... TArguments>
 std::uint32_t EmitNative(SpirvEmitterState& state, TArguments... arguments) {
@@ -276,7 +280,8 @@ std::uint32_t AtomicUpdateTyped(SpirvEmitterState& state, std::uint32_t pointer,
     EmitLabel(state, cont);
     state.module.AddFunction(spv::OpBranch, header);
     EmitLabel(state, merge);
-    if (kind != ResourceKind::Lds || !state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, scope), ConstantU32(state, spv::MemorySemanticsAcquireReleaseMask | memory));
+    const auto fenceScope = kind == ResourceKind::Lds ? LdsMemoryBarrierScope(state) : scope;
+    if (kind != ResourceKind::Lds || !state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, fenceScope), ConstantU32(state, spv::MemorySemanticsAcquireReleaseMask | memory));
     return observed;
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp
index a8f03e192a..c442047480 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterInstructions.hpp
@@ -221,6 +221,7 @@ std::uint32_t EmitFPCmpClass32(SpirvEmitterState& state, std::uint32_t value, st
 void EmitReference(SpirvValueEmitContext& context);
 void EmitReferenceU32(SpirvValueEmitContext& context);
 void EmitUnlinkedCall(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint32_t low, std::uint32_t high, std::uint32_t programCounter);
+void EmitWindowLaneGuard(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint32_t index, std::uint32_t value, std::uint32_t current, std::uint32_t slot, std::uint32_t lane);
 void EmitControlNop(SpirvValueEmitContext& context);
 void EmitWaitcnt(SpirvValueEmitContext& context);
 void EmitSendmsg(SpirvValueEmitContext& context);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp
index dc3a268ee3..5c75b23f82 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvEmitterState.hpp
@@ -113,6 +113,7 @@ struct SpirvEmitterState {
     bool robustBufferAccess2 = false;
     bool float32FlushToZero = false;
     bool float32DenormPreserve = false;
+    bool fusedExactArithmetic = false;
     bool meshBarycentricPixel = false;
     bool meshBarycentricVertex = false;
     std::uint32_t barycentricSmoothLocation = 0xffffffffu;
@@ -128,6 +129,7 @@ struct SpirvEmitterState {
     std::uint32_t pixelFlatPositions = 0;
     std::map<std::pair<std::uint32_t, std::uint32_t>, std::uint32_t> solvedBarycentrics;
     bool waveLdsMemoryBarriers = false;
+    bool deviceScopeLdsMemoryBarriers = false;
     std::unordered_set<const IrValue*> sharedLaneValues;
     std::uint32_t laneHalf = 0;
     std::uint32_t spirvVersion = 0x00010300u;
@@ -142,6 +144,14 @@ struct SpirvEmitterState {
     std::vector<std::uint32_t> memoryByteOffsets;
     std::map<std::array<std::uint32_t, 6>, std::uint32_t> formattedBufferFunctions;
     std::map<std::array<std::uint32_t, 6>, std::uint32_t> formattedGpuBufferFunctions;
+    struct BufferLengthCacheEntry {
+        std::array<const IrValue*, 4> descriptor{};
+        std::uint32_t variable = 0;
+        std::uint32_t element = 0;
+        std::uint32_t label = 0;
+        std::uint32_t length = 0;
+    };
+    std::vector<BufferLengthCacheEntry> bufferLengths;
     std::uint32_t bufferFormatTable = 0;
     std::uint32_t bdaPagetableVariable = 0;
     std::uint32_t faultBufferVariable = 0;
@@ -158,6 +168,8 @@ struct SpirvEmitterState {
     bool nativeF16ModesEmitted = false;
     bool f16DenormPreserveEmitted = false;
     std::uint32_t dot2F32F16Function = 0;
+    std::uint32_t reciprocalCorrectionFunction = 0;
+    std::array<std::uint32_t, 3> reciprocalTables {};
     std::map<std::pair<bool, std::uint32_t>, std::uint32_t> interpolateFunctions;
     bool integerInterpolation = false;
     std::array<std::array<std::uint32_t, 2>, 2> bdaDwordReadFunctions {};
@@ -187,6 +199,7 @@ struct SpirvEmitterState {
     std::uint32_t loopGuardVisits = 0;
     std::uint32_t loopGuardPc = 0;
     std::uint32_t srgbTableVariable = 0;
+    std::uint32_t gcnBufferFormatVariable = 0;
     std::uint32_t gdsVariable = 0;
     std::uint32_t gdsLength = 0;
     std::uint32_t pushConstantVariable = 0;
@@ -196,6 +209,7 @@ struct SpirvEmitterState {
     std::uint32_t ldsBufferVariable = 0;
     std::uint32_t ldsBufferU64Variable = 0;
     std::uint32_t ldsBufferBase = 0;
+    bool pixelFunctionLdsBuffer = false;
     std::uint32_t numWorkgroupsVariable = 0;
     std::array<std::uint32_t, 2> scratchVariable {};
     std::array<std::uint32_t, 2> vectorWindowVariable {};
@@ -219,6 +233,8 @@ struct SpirvEmitterState {
     std::uint32_t currentLabel = 0;
     const IrBlock* currentBlock = nullptr;
     std::uint32_t pixelValidMaskVariable = 0;
+    std::uint32_t mergeWordVariable = 0;
+    std::uint32_t mergePendingVariable = 0;
     std::uint32_t quadPixelUncovered = 0;
     std::uint32_t sampleMaskInputVariable = 0;
     std::uint32_t quadSampleCoverage = 0;
@@ -226,6 +242,7 @@ struct SpirvEmitterState {
     std::uint32_t subgroupLocalInvocationIdVariable = 0;
     std::uint32_t subgroupIdVariable = 0;
     std::uint32_t perVertexVariable = 0;
+    std::uint32_t barycentricReciprocalWVariable = 0;
     std::uint32_t pointSizeVariable = 0;
     std::uint32_t clipDistanceVariable = 0;
     std::optional<std::uint32_t> zeroPositionClipIndex;
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp
index 53a851625b..18e703456f 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvBufferAccess.hpp
@@ -13,6 +13,7 @@ void EmitMemoryOffsets(SpirvEmitterState& state);
 std::uint32_t LdsDwordCount(const SpirvEmitterState& state);
 bool LdsInDeviceMemory(const SpirvEmitterState& state);
 std::uint32_t LdsMemorySemantics(const SpirvEmitterState& state);
+std::uint32_t LdsMemoryBarrierScope(const SpirvEmitterState& state);
 void EmitLdsBufferBase(SpirvEmitterState& state);
 std::uint32_t EmitLdsLockPointer(SpirvEmitterState& state);
 std::uint32_t EmitLdsBufferU64Pointer(SpirvEmitterState& state, std::uint32_t index);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp
index b38633af2e..5ff7152418 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvMemory/SpirvDescriptors.hpp
@@ -21,6 +21,7 @@ void DecorateTableNonUniform(SpirvEmitterState& state, std::uint32_t id);
 bool TablePointSampled(const ImageResource& image);
 bool TableModeEmitted(const ImageResource& mode);
 std::uint32_t StorageImageDescriptorPointer(SpirvEmitterState& state, std::uint32_t resource);
+std::uint32_t EmitStorageImageRead(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t coord, std::uint32_t sample);
 void EmitStorageImageWrite(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t mipLod, std::uint32_t coord, std::uint32_t texel, std::uint32_t sample);
 const RdnaImageDimensionInfo& RdnaImageDimensionInfoFor(RdnaImageDimension dimension);
 [[noreturn]] void ExitDescriptorBindingFailure(const SpirvEmitterState& state, DescriptorBindingKind kind, std::uint32_t resource, const char* reason);
diff --git a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp
index 661caa053c..f50d5c6f37 100644
--- a/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp
+++ b/core/shader/recompiler/SpirvBackend/include/SpirvBackend/SpirvOptimizer.hpp
@@ -8,6 +8,7 @@
 namespace ShaderRecompiler {
 
 [[nodiscard]] std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand = false, bool optimize = true, bool specialize = false);
+[[nodiscard]] std::uint64_t OptimizerHostThreads();
 
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp b/core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp
index 6f86243daf..00cc69e109 100644
--- a/core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp
@@ -77,6 +77,8 @@ public:
         };
         const auto smooth = barycentricOutput(layout.smoothLocation);
         const auto linear = barycentricOutput(layout.linearLocation);
+        const auto reciprocalW = barycentricOutput(layout.reciprocalWLocation);
+        if (reciprocalW != 0u) builder.AddAnnotation(spv::OpDecorate, reciprocalW, spv::DecorationNoPerspective);
         std::vector<std::uint32_t> perVertexOutputs;
         for (const auto& parameter : perVertex) {
             perVertexOutputs.push_back(addInterface(spv::StorageClassOutput, vertexArrayType));
@@ -94,11 +96,18 @@ public:
             for (std::uint32_t vertex = 0; vertex < 3u; ++vertex) values[location][vertex] = load(vec4FloatType, result(spv::OpAccessChain, ptrInputVec4, inputs[location], constant(intType, vertex)));
         }
         for (std::uint32_t vertex = 0; vertex < 3u; ++vertex) {
-            store(position, load(vec4FloatType, result(spv::OpAccessChain, ptrInputVec4, glIn, constant(intType, vertex), constant(intType, 0u))));
+            const auto clipPosition = load(vec4FloatType, result(spv::OpAccessChain, ptrInputVec4, glIn, constant(intType, vertex), constant(intType, 0u)));
+            store(position, clipPosition);
             for (std::size_t i = 0; i < passed.size(); ++i) store(passedOutputs[i], values[passed[i]][vertex]);
             const auto weights = result(spv::OpCompositeConstruct, vec3FloatType, vertex == 0u ? one : zero, vertex == 1u ? one : zero, vertex == 2u ? one : zero);
             if (smooth != 0u) store(smooth, weights);
             if (linear != 0u) store(linear, weights);
+            if (reciprocalW != 0u) {
+                const auto clipW = result(spv::OpCompositeExtract, floatType, clipPosition, 3u);
+                const auto reciprocal = result(spv::OpFDiv, floatType, one, clipW);
+                const auto reciprocalWeights = result(spv::OpCompositeConstruct, vec3FloatType, vertex == 0u ? reciprocal : zero, vertex == 1u ? reciprocal : zero, vertex == 2u ? reciprocal : zero);
+                store(reciprocalW, reciprocalWeights);
+            }
             for (std::size_t i = 0; i < perVertex.size(); ++i) {
                 for (std::uint32_t source = 0; source < 3u; ++source) store(result(spv::OpAccessChain, ptrOutputVec4, perVertexOutputs[i], constant(intType, source)), values[perVertex[i].sourceLocation][source]);
             }
@@ -251,6 +260,8 @@ public:
         };
         const auto smooth = barycentricOutput(layout.smoothLocation);
         const auto linear = barycentricOutput(layout.linearLocation);
+        const auto reciprocalW = barycentricOutput(layout.reciprocalWLocation);
+        if (reciprocalW != 0u) builder.AddAnnotation(spv::OpDecorate, reciprocalW, spv::DecorationNoPerspective);
         std::vector<std::uint32_t> perVertexOutputs;
         for (const auto& parameter : perVertex) {
             perVertexOutputs.push_back(addInterface(spv::StorageClassOutput, vertexArrayType));
@@ -275,6 +286,16 @@ public:
         for (std::size_t i = 0; i < passed.size(); ++i) store(passedOutputs[i], load(vec4FloatType, result(spv::OpAccessChain, ptrInputVec4, inputs[passed[i]], passedFlat[i] ? constant(intType, provokingVertex) : index)));
         if (smooth != 0u) store(smooth, weights);
         if (linear != 0u) store(linear, weights);
+        if (reciprocalW != 0u) {
+            std::array<std::uint32_t, 3> reciprocalWeights{};
+            for (std::uint32_t source = 0; source < 3u; ++source) {
+                const auto clipPosition = load(vec4FloatType, result(spv::OpAccessChain, ptrInputVec4, glIn, constant(intType, source), constant(intType, 0u)));
+                const auto clipW = result(spv::OpCompositeExtract, floatType, clipPosition, 3u);
+                const auto inverseW = result(spv::OpFDiv, floatType, one, clipW);
+                reciprocalWeights[source] = result(spv::OpFMul, floatType, weight(source), inverseW);
+            }
+            store(reciprocalW, result(spv::OpCompositeConstruct, vec3FloatType, reciprocalWeights[0], reciprocalWeights[1], reciprocalWeights[2]));
+        }
         for (std::size_t i = 0; i < perVertex.size(); ++i) {
             for (std::uint32_t source = 0; source < 3u; ++source) store(result(spv::OpAccessChain, ptrOutputVec4, perVertexOutputs[i], constant(intType, source)), load(vec4FloatType, result(spv::OpAccessChain, ptrInputVec4, inputs[perVertex[i].sourceLocation], constant(intType, source))));
         }
@@ -370,6 +391,7 @@ BarycentricEmulationLayout LayoutBarycentricEmulation(std::span<const FragmentPa
     if (emulation.smooth) layout.smoothLocation = take(1u);
     if (emulation.linear) layout.linearLocation = take(1u);
     if (meshPositions) layout.positionsLocation = take(3u);
+    if (emulation.smoothOffset) layout.reciprocalWLocation = take(1u);
     for (const auto& parameter : parameters) {
         if (parameter.perVertex) layout.perVertexLocations.emplace_back(parameter.location, take(3u));
     }
@@ -404,9 +426,9 @@ RecompileResult BuildBarycentricGeometryShader(const RecompileResult& vertex, co
     const auto emulated = CollectEmulatedInterface(vertex, fragment);
     const auto passed = static_cast<std::uint32_t>(emulated.passed.size());
     const auto perVertex = static_cast<std::uint32_t>(emulated.perVertex.size());
-    const auto outputComponents = 4u + 4u * passed + 3u * emulated.barycentrics + 12u * perVertex;
+    const auto outputComponents = 4u + 4u * passed + 3u * (emulated.barycentrics + (emulated.layout.reciprocalWLocation != BarycentricEmulationLayout::NoLocation ? 1u : 0u)) + 12u * perVertex;
     const auto inputComponents = 4u + 4u * emulated.sources;
-    const auto fragmentComponents = 4u * (passed + emulated.barycentrics + 3u * perVertex);
+    const auto fragmentComponents = 4u * (passed + emulated.barycentrics + 3u * perVertex + (emulated.layout.reciprocalWLocation != BarycentricEmulationLayout::NoLocation ? 1u : 0u));
     require(limits->maxGeometryOutputVertices >= 3u && outputComponents <= limits->maxGeometryOutputComponents && 3u * outputComponents <= limits->maxGeometryTotalOutputComponents && inputComponents <= limits->maxGeometryInputComponents && fragmentComponents <= limits->maxFragmentInputComponents, "the emulated barycentric interface exceeds device limits");
     BarycentricGeometryEmitter emitter(target.spirvVersion);
     RecompileResult result;
@@ -429,8 +451,8 @@ BarycentricTessellationShaders BuildBarycentricTessellationShaders(const Recompi
     const auto clipDistances = VertexClipDistanceCount(vertex.spirv.Words());
     require(clipDistances == 0u || std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), spv::CapabilityClipDistance) != target.supportedCapabilities.end(), "the vertex clip distances need shaderClipDistance");
     const auto controlComponents = 4u + clipDistances + 4u * emulated.sources;
-    const auto evaluationOutputComponents = 4u + clipDistances + 4u * passed + 3u * emulated.barycentrics + 12u * perVertex;
-    const auto fragmentComponents = 4u * (passed + emulated.barycentrics + 3u * perVertex);
+    const auto evaluationOutputComponents = 4u + clipDistances + 4u * passed + 3u * (emulated.barycentrics + (emulated.layout.reciprocalWLocation != BarycentricEmulationLayout::NoLocation ? 1u : 0u)) + 12u * perVertex;
+    const auto fragmentComponents = 4u * (passed + emulated.barycentrics + 3u * perVertex + (emulated.layout.reciprocalWLocation != BarycentricEmulationLayout::NoLocation ? 1u : 0u));
     const auto& limits = *target.tessellation;
     require(limits.maxPatchSize >= 3u && controlComponents <= limits.maxControlPerVertexInputComponents && controlComponents <= limits.maxControlPerVertexOutputComponents && 3u * controlComponents + 4u <= limits.maxControlTotalOutputComponents && limits.maxControlPerPatchOutputComponents >= 4u && controlComponents <= limits.maxEvaluationInputComponents && evaluationOutputComponents <= limits.maxEvaluationOutputComponents && fragmentComponents <= maxFragmentInputComponents, "the emulated barycentric interface exceeds device limits");
     std::set<std::uint32_t> sourceSet(emulated.passed.begin(), emulated.passed.end());
diff --git a/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp b/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp
index bbf6dcc0f6..ed3483d923 100644
--- a/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/RectListShaders.cpp
@@ -26,20 +26,32 @@ struct Parameter {
     bool missing = false;
 };
 
+struct PerVertexSource {
+    std::uint32_t inputLocation;
+    std::uint32_t outputLocation;
+};
+
+struct Emulation {
+    std::vector<std::uint32_t> barycentrics;
+    std::vector<PerVertexSource> perVertex;
+};
+
 void require(bool condition, const char* message) {
     if (!condition) throw std::runtime_error(std::string("Rect-list SPIR-V: ") + message);
 }
 
 class RectListEmitter {
 public:
-    RectListEmitter(const std::vector<Parameter>& parameters, spv::ExecutionModel model, std::uint32_t version, std::uint32_t faultBinding, std::uint32_t clipDistances) : builder(version), faultBinding(faultBinding), version(version), clipDistances(clipDistances), parameters(parameters) {
+    RectListEmitter(const std::vector<Parameter>& parameters, const Emulation& emulation, spv::ExecutionModel model, std::uint32_t version, std::uint32_t faultBinding, std::uint32_t clipDistances) : builder(version), faultBinding(faultBinding), version(version), clipDistances(clipDistances), parameters(parameters), emulation(emulation) {
         builder.AddMemoryModel(spv::AddressingModelLogical, spv::MemoryModelGLSL450);
 
         voidType = type(spv::OpTypeVoid);
         uintType = type(spv::OpTypeInt, 32u, 0u);
         intType = type(spv::OpTypeInt, 32u, 1u);
         floatType = type(spv::OpTypeFloat, 32u);
+        vec3FloatType = type(spv::OpTypeVector, floatType, 3u);
         vec4FloatType = type(spv::OpTypeVector, floatType, 4u);
+        vertexArrayType = array(vec4FloatType, 3u);
         functionType = type(spv::OpTypeFunction, voidType);
 
             perVertexType = builder.DecoratedType(spv::OpTypeStruct, {{spv::OpMemberDecorate, {0u, spv::DecorationBuiltIn, spv::BuiltInPosition}}, {spv::OpMemberDecorate, {0u, spv::DecorationInvariant}}, {spv::OpDecorate, {spv::DecorationBlock}}}, vec4FloatType);
@@ -51,13 +63,14 @@ public:
 
         ptrInputVec4Float = pointer(spv::StorageClassInput, vec4FloatType);
         ptrOutputVec4Float = pointer(spv::StorageClassOutput, vec4FloatType);
+        ptrInputVec3Float = pointer(spv::StorageClassInput, vec3FloatType);
+        ptrOutputVec3Float = pointer(spv::StorageClassOutput, vec3FloatType);
         if (model == spv::ExecutionModelTessellationControl) {
             boolType = type(spv::OpTypeBool);
             vec2BoolType = type(spv::OpTypeVector, boolType, 2u);
             vec2FloatType = type(spv::OpTypeVector, floatType, 2u);
             ptrOutputFloat = pointer(spv::StorageClassOutput, floatType);
         } else {
-            vec3FloatType = type(spv::OpTypeVector, floatType, 3u);
             ptrInputFloat = pointer(spv::StorageClassInput, floatType);
         }
     }
@@ -155,6 +168,22 @@ public:
             store(access(ptrOutputVec4Float, outputs[i], invocation), value);
         }
 
+        if (!emulation.barycentrics.empty()) {
+            const auto zero = constant(floatType, 0);
+            std::array<std::uint32_t, 3> weight {};
+            for (std::uint32_t i = 0; i < weight.size(); i++) {
+                const auto own = result(spv::OpSelect, floatType, result(spv::OpIEqual, boolType, index, intConstant(i)), floatOne, zero);
+                weight[i] = result(spv::OpSelect, floatType, fourth, barycentric[i], own);
+            }
+            const auto weights = result(spv::OpCompositeConstruct, vec3FloatType, weight[0], weight[1], weight[2]);
+            for (const auto output : barycentricOutputs) store(access(ptrOutputVec3Float, output, invocation), weights);
+        }
+        for (std::size_t i = 0; i < emulation.perVertex.size(); i++) {
+            for (std::uint32_t source = 0; source < 3u; source++) {
+                store(access(ptrOutputVec4Float, perVertexOutputs[i], invocation, intConstant(source)), load(vec4FloatType, access(ptrInputVec4Float, perVertexInputs[i], intConstant(source))));
+            }
+        }
+
         emit(spv::OpReturn);
         emit(spv::OpFunctionEnd);
         return builder.Finalize();
@@ -178,6 +207,8 @@ public:
         for (std::uint32_t i = 0; i < parameters.size(); i++) {
             store(outputs[i], load(vec4FloatType, access(ptrInputVec4Float, inputs[i], index)));
         }
+        for (std::size_t i = 0; i < barycentricOutputs.size(); i++) store(barycentricOutputs[i], load(vec3FloatType, access(ptrInputVec3Float, barycentricInputs[i], index)));
+        for (std::size_t i = 0; i < emulation.perVertex.size(); i++) store(perVertexOutputs[i], load(vertexArrayType, access(pointer(spv::StorageClassInput, vertexArrayType), perVertexInputs[i], index)));
 
         emit(spv::OpReturn);
         emit(spv::OpFunctionEnd);
@@ -344,6 +375,23 @@ private:
             decorate(inputs[i], spv::DecorationLocation, location);
             locations[location] = inputs[i];
         }
+        for (const auto location : emulation.barycentrics) {
+            if (tessControl) continue;
+            barycentricInputs.push_back(addInterface(spv::StorageClassInput, array(vec3FloatType, 4u)));
+            decorate(barycentricInputs.back(), spv::DecorationLocation, location);
+        }
+        for (const auto& source : emulation.perVertex) {
+            if (!tessControl) {
+                perVertexInputs.push_back(addInterface(spv::StorageClassInput, array(vertexArrayType, 4u)));
+                decorate(perVertexInputs.back(), spv::DecorationLocation, source.outputLocation);
+                continue;
+            }
+            if (locations[source.inputLocation] == 0) {
+                locations[source.inputLocation] = addInterface(spv::StorageClassInput, vertexArrayType);
+                decorate(locations[source.inputLocation], spv::DecorationLocation, source.inputLocation);
+            }
+            perVertexInputs.push_back(locations[source.inputLocation]);
+        }
     }
 
     void defineOutputs(spv::ExecutionModel model) {
@@ -367,6 +415,14 @@ private:
             outputs[i] = addInterface(spv::StorageClassOutput, tessControl ? array(vec4FloatType, 4u) : vec4FloatType);
             decorate(outputs[i], spv::DecorationLocation, parameters[i].outputLocation);
         }
+        for (const auto location : emulation.barycentrics) {
+            barycentricOutputs.push_back(addInterface(spv::StorageClassOutput, tessControl ? array(vec3FloatType, 4u) : vec3FloatType));
+            decorate(barycentricOutputs.back(), spv::DecorationLocation, location);
+        }
+        for (const auto& source : emulation.perVertex) {
+            perVertexOutputs.push_back(addInterface(spv::StorageClassOutput, tessControl ? array(vertexArrayType, 4u) : vertexArrayType));
+            decorate(perVertexOutputs.back(), spv::DecorationLocation, source.outputLocation);
+        }
     }
 
     std::uint32_t interpolate(std::uint32_t v0, std::uint32_t v1, std::uint32_t v2, const std::array<std::uint32_t, 3>& barycentric) {
@@ -382,9 +438,14 @@ private:
     std::uint32_t clipDistances;
     std::uint32_t fault = 0;
     const std::vector<Parameter>& parameters;
+    const Emulation& emulation;
     std::vector<std::uint32_t> interfaces;
     std::vector<std::uint32_t> inputs;
     std::vector<std::uint32_t> outputs;
+    std::vector<std::uint32_t> barycentricInputs;
+    std::vector<std::uint32_t> barycentricOutputs;
+    std::vector<std::uint32_t> perVertexInputs;
+    std::vector<std::uint32_t> perVertexOutputs;
     std::uint32_t main = 0;
     std::uint32_t voidType = 0;
     std::uint32_t boolType = 0;
@@ -395,6 +456,7 @@ private:
     std::uint32_t vec2FloatType = 0;
     std::uint32_t vec3FloatType = 0;
     std::uint32_t vec4FloatType = 0;
+    std::uint32_t vertexArrayType = 0;
     std::uint32_t functionType = 0;
     std::uint32_t perVertexType = 0;
     std::uint32_t clipArrayType = 0;
@@ -404,6 +466,8 @@ private:
     std::uint32_t ptrInputVec4Float = 0;
     std::uint32_t ptrOutputFloat = 0;
     std::uint32_t ptrOutputVec4Float = 0;
+    std::uint32_t ptrInputVec3Float = 0;
+    std::uint32_t ptrOutputVec3Float = 0;
     std::uint32_t glIn = 0;
     std::uint32_t glOut = 0;
     std::uint32_t clipIn = 0;
@@ -422,25 +486,42 @@ RectListShaders BuildRectListShaders(const RecompileResult& vertex, const Recomp
     require(target.spirvVersion >= 0x00010300u && target.spirvVersion <= 0x00010500u, "unsupported SPIR-V target version");
     require(std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), spv::CapabilityTessellation) != target.supportedCapabilities.end(), "tessellation capability is unavailable");
     std::vector<Parameter> parameters;
+    Emulation emulation;
+    BarycentricEmulationLayout layout;
+    if (fragment.barycentricEmulation.active) {
+        layout = LayoutBarycentricEmulation(fragment.fragmentParameters, fragment.barycentricEmulation);
+        for (const auto location : {layout.smoothLocation, layout.linearLocation}) {
+            if (location != BarycentricEmulationLayout::NoLocation) emulation.barycentrics.push_back(location);
+        }
+    }
     std::set<std::uint32_t> locations;
     for (const auto& input : fragment.fragmentParameters) {
         require(input.location < 32 && input.sourceLocation < 32 && locations.insert(input.location).second, "invalid fragment parameter location");
         require(!input.custom, "custom per-vertex interpolation is unsupported");
         const bool exported = std::find(vertex.parameterExports.begin(), vertex.parameterExports.end(), input.sourceLocation) != vertex.parameterExports.end();
+        if (fragment.barycentricEmulation.active && input.perVertex) {
+            require(exported, "an emulated per-vertex parameter is not exported by the vertex shader");
+            const auto relocated = std::find_if(layout.perVertexLocations.begin(), layout.perVertexLocations.end(), [&](const auto& entry) { return entry.first == input.location; });
+            require(relocated != layout.perVertexLocations.end(), "an emulated per-vertex parameter has no location");
+            emulation.perVertex.push_back({input.sourceLocation, relocated->second});
+            continue;
+        }
         parameters.push_back({input.sourceLocation, input.location, input.flat, !exported});
     }
+    const auto emulatedSlots = static_cast<std::uint32_t>(emulation.barycentrics.size() + emulation.perVertex.size() * 3u);
     const auto& limits = *target.tessellation;
     const std::uint32_t perVertexComponents = std::min({limits.maxControlPerVertexInputComponents, limits.maxControlPerVertexOutputComponents, limits.maxEvaluationInputComponents, limits.maxEvaluationOutputComponents});
-    if (const std::size_t capacity = perVertexComponents / 4u > 0u ? perVertexComponents / 4u - 1u : 0u; parameters.size() > capacity) {
+    require(emulatedSlots == 0u || perVertexComponents / 4u > emulatedSlots, "emulated barycentrics exceed the tessellation interface limits");
+    if (const std::size_t capacity = perVertexComponents / 4u > emulatedSlots ? perVertexComponents / 4u - 1u - emulatedSlots : 0u; parameters.size() > capacity) {
         parameters.resize(capacity);
     }
-    const auto components = static_cast<std::uint32_t>((parameters.size() + 1) * 4);
+    const auto components = static_cast<std::uint32_t>((parameters.size() + emulatedSlots + 1) * 4);
     require(limits.maxPatchSize >= 4 && components <= limits.maxControlPerVertexInputComponents && components <= limits.maxControlPerVertexOutputComponents && components <= limits.maxEvaluationInputComponents && components <= limits.maxEvaluationOutputComponents && limits.maxControlPerPatchOutputComponents >= 6 && components * 4 + 6 <= limits.maxControlTotalOutputComponents, "tessellation interface exceeds device limits");
     const auto clipDistances = VertexClipDistanceCount(vertex.spirv.Words());
     require(clipDistances == 0u || std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), spv::CapabilityClipDistance) != target.supportedCapabilities.end(), "the vertex clip distances need shaderClipDistance");
     const auto faultBinding = RuntimeAbi::BindingNumber(RuntimeAbi::Stage::TessellationControl, RuntimeAbi::Binding::FaultBuffer);
-    RectListEmitter control(parameters, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
-    RectListEmitter evaluation(parameters, spv::ExecutionModelTessellationEvaluation, target.spirvVersion, faultBinding, clipDistances);
+    RectListEmitter control(parameters, emulation, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
+    RectListEmitter evaluation(parameters, emulation, spv::ExecutionModelTessellationEvaluation, target.spirvVersion, faultBinding, clipDistances);
     RectListShaders shaders;
     shaders.control.spirv = control.EmitControl(0u);
     shaders.control.bindings.push_back({DescriptorKind::StorageBuffer, DescriptorRole::FaultBuffer, 0, faultBinding, 1, {}});
@@ -452,7 +533,7 @@ RectListShaders BuildRectListShaders(const RecompileResult& vertex, const Recomp
 #endif
     shaders.lastVertexControl = shaders.control;
     if (std::any_of(parameters.begin(), parameters.end(), [](const Parameter& parameter) { return parameter.flat && !parameter.missing; })) {
-        RectListEmitter lastVertexControl(parameters, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
+        RectListEmitter lastVertexControl(parameters, emulation, spv::ExecutionModelTessellationControl, target.spirvVersion, faultBinding, clipDistances);
         shaders.lastVertexControl.spirv = lastVertexControl.EmitControl(2u);
 #if ANYPS5_ENABLE_SPIRV_TOOLS
         shaders.lastVertexControl.spirv = ValidateAndOptimizeSpirv(shaders.lastVertexControl.spirv, target.vulkanVersion, target.spirvVersion);
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
index d609c27286..abf7b6fce4 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp
@@ -7,6 +7,7 @@
 #include <algorithm>
 #include <array>
 #include <initializer_list>
+#include <map>
 #include <optional>
 #include <string>
 #include <unordered_set>
@@ -139,6 +140,20 @@ std::uint32_t EmitExt(SpirvEmitterState& state, std::uint32_t type, std::uint32_
     return result;
 }
 
+namespace {
+
+std::uint32_t ExactMul(SpirvEmitterState& state, std::uint32_t lhs, std::uint32_t rhs) {
+    if (state.fusedExactArithmetic) return EmitExt(state, TypeF32(state), GLSLstd450Fma, {lhs, rhs, ConstantF32(state, 0x80000000u)});
+    return Exact(state, Binary(state, spv::OpFMul, TypeF32(state), lhs, rhs));
+}
+
+std::uint32_t ExactSub(SpirvEmitterState& state, std::uint32_t lhs, std::uint32_t rhs) {
+    if (state.fusedExactArithmetic) return EmitExt(state, TypeF32(state), GLSLstd450Fma, {ConstantF32(state, 0xbf800000u), rhs, lhs});
+    return Exact(state, Binary(state, spv::OpFSub, TypeF32(state), lhs, rhs));
+}
+
+}
+
 std::uint32_t EmitDppWriteCondition(SpirvValueEmitContext& ctx, const IrValue& inst) {
     auto& state = ctx.state;
     const auto flags = inst.Flags<DppMoveFlags>();
@@ -322,74 +337,126 @@ public:
     explicit EntryLaneWalk(IrShaderStage stage) : everyInvocationEnters(EveryInvocationEnters(stage)) {}
 
     bool ZeroBit(const IrValue* bit) {
-        bit = Resolved(bit);
-        if (bit == nullptr || !Spend()) return false;
-        if (bit->HasImmediate()) return bit->Type() == IrType::Bool && !bit->ImmediateBool();
-        if (Is(bit, IrOpcode::LogicalAnd)) return HelperOrFalseConjunct(bit) || ZeroBit(bit->Argument(0)) || ZeroBit(bit->Argument(1));
-        if (Is(bit, IrOpcode::SelectU1)) return ZeroBit(bit->Argument(1)) && ZeroBit(bit->Argument(2));
-        if (Is(bit, IrOpcode::Phi)) return Incoming(bit, [this](const IrValue* incoming) { return ZeroBit(incoming); });
-        if (Is(bit, IrOpcode::IEqual32)) return HelperTest(bit);
-        const auto words = LaneBitWords(bit);
-        return words && Word((*words)[0], 0u) && Word((*words)[1], 1u);
+        return Prove(bit, Proof::ZeroBit, [this](const IrValue* value) {
+            if (value->HasImmediate()) return value->Type() == IrType::Bool && !value->ImmediateBool();
+            if (Is(value, IrOpcode::LogicalAnd)) return HelperOrFalseConjunct(value) || ZeroBit(value->Argument(0)) || ZeroBit(value->Argument(1));
+            if (Is(value, IrOpcode::SelectU1)) return ZeroBit(value->Argument(1)) && ZeroBit(value->Argument(2));
+            if (Is(value, IrOpcode::Phi)) return Incoming(value, [this](const IrValue* incoming) { return ZeroBit(incoming); });
+            if (Is(value, IrOpcode::IEqual32)) return HelperTest(value);
+            const auto words = LaneBitWords(value);
+            return words && Word((*words)[0], 0u) && Word((*words)[1], 1u);
+        });
     }
 
 private:
+    enum class Proof : std::uint8_t { ZeroBit, NotHelper, LowWord, HighWord, LowWord64, HighWord64 };
+    using Key = std::pair<const IrValue*, Proof>;
+    struct Assumption {
+        std::size_t depth;
+        std::uint64_t order;
+    };
+    static constexpr std::size_t Unbounded = static_cast<std::size_t>(-1);
+
     bool Spend() {
         if (budget == 0u) return false;
         --budget;
         return true;
     }
 
-    bool NotHelper(const IrValue* predicate) {
-        predicate = Resolved(predicate);
-        if (predicate == nullptr || !Spend()) return false;
-        if (predicate->HasImmediate()) return everyInvocationEnters && predicate->Type() == IrType::Bool && predicate->ImmediateBool();
-        switch (predicate->Opcode()) {
-            case IrOpcode::LogicalAnd: return NotHelper(predicate->Argument(0)) || NotHelper(predicate->Argument(1));
-            case IrOpcode::IEqual32: return HelperTest(predicate);
-            default: return ZeroBit(predicate);
+    template<typename TCheck>
+    bool Prove(const IrValue* value, Proof proof, TCheck&& check) {
+        value = Resolved(value);
+        if (value == nullptr) return false;
+        const Key key{value, proof};
+        if (const auto found = settled.find(key); found != settled.end()) return found->second;
+        if (const auto found = active.find(key); found != active.end()) return Assume(found->second);
+        if (const auto found = assumed.find(key); found != assumed.end()) return Assume(found->second.depth);
+        if (!Spend()) return false;
+        const auto outer = dependency;
+        const auto depth = active.size();
+        const auto mark = created;
+        dependency = Unbounded;
+        active.emplace(key, depth);
+        const bool result = check(value);
+        active.erase(key);
+        const auto inner = dependency;
+        const bool holds = result && inner >= depth;
+        for (auto entry = assumed.begin(); entry != assumed.end();) {
+            if (entry->second.order < mark) {
+                ++entry;
+                continue;
+            }
+            if (result && !holds) {
+                entry->second.depth = std::min(entry->second.depth, inner);
+                ++entry;
+                continue;
+            }
+            if (holds) settled.emplace(entry->first, true);
+            entry = assumed.erase(entry);
         }
+        if (result && !holds) assumed.emplace(key, Assumption{inner, created++});
+        else settled.emplace(key, result);
+        dependency = result && !holds ? std::min(outer, inner) : outer;
+        return result;
+    }
+
+    bool Assume(std::size_t depth) {
+        dependency = std::min(dependency, depth);
+        return true;
+    }
+
+    bool NotHelper(const IrValue* predicate) {
+        return Prove(predicate, Proof::NotHelper, [this](const IrValue* value) {
+            if (value->HasImmediate()) return everyInvocationEnters && value->Type() == IrType::Bool && value->ImmediateBool();
+            switch (value->Opcode()) {
+                case IrOpcode::LogicalAnd: return NotHelper(value->Argument(0)) || NotHelper(value->Argument(1));
+                case IrOpcode::IEqual32: return HelperTest(value);
+                default: return ZeroBit(value);
+            }
+        });
     }
 
     bool Word(const IrValue* word, std::uint32_t half) {
-        word = Resolved(word);
-        if (word == nullptr || !Spend()) return false;
-        if (word->HasImmediate()) return IsU32(word, 0u);
-        switch (word->Opcode()) {
-            case IrOpcode::CompositeExtractU32x4: {
-                const auto* ballot = Resolved(word->Argument(0));
-                return IsU32(word->Argument(1), half) && Is(ballot, IrOpcode::Ballot) && NotHelper(ballot->Argument(0));
+        return Prove(word, half == 0u ? Proof::LowWord : Proof::HighWord, [this, half](const IrValue* value) {
+            if (value->HasImmediate()) return IsU32(value, 0u);
+            switch (value->Opcode()) {
+                case IrOpcode::CompositeExtractU32x4: {
+                    const auto* ballot = Resolved(value->Argument(0));
+                    return IsU32(value->Argument(1), half) && Is(ballot, IrOpcode::Ballot) && NotHelper(ballot->Argument(0));
+                }
+                case IrOpcode::CompositeExtractU64: return IsU32(value->Argument(1), half) && Word64(value->Argument(0), half);
+                case IrOpcode::BitwiseAnd32: return Word(value->Argument(0), half) || Word(value->Argument(1), half);
+                case IrOpcode::BitwiseOr32: return Word(value->Argument(0), half) && Word(value->Argument(1), half);
+                case IrOpcode::Phi: return Incoming(value, [this, half](const IrValue* incoming) { return Word(incoming, half); });
+                default: return false;
             }
-            case IrOpcode::CompositeExtractU64: return IsU32(word->Argument(1), half) && Word64(word->Argument(0), half);
-            case IrOpcode::BitwiseAnd32: return Word(word->Argument(0), half) || Word(word->Argument(1), half);
-            case IrOpcode::BitwiseOr32: return Word(word->Argument(0), half) && Word(word->Argument(1), half);
-            case IrOpcode::Phi: return Incoming(word, [this, half](const IrValue* incoming) { return Word(incoming, half); });
-            default: return false;
-        }
+        });
     }
 
     bool Word64(const IrValue* mask, std::uint32_t half) {
-        mask = Resolved(mask);
-        if (mask == nullptr || !Spend()) return false;
-        if (mask->HasImmediate()) return mask->Type() == IrType::U64 && static_cast<std::uint32_t>(mask->ImmediateU64() >> (32u * half)) == 0u;
-        switch (mask->Opcode()) {
-            case IrOpcode::CompositeConstructU64: return Word(mask->Argument(half), half);
-            case IrOpcode::Phi: return Incoming(mask, [this, half](const IrValue* incoming) { return Word64(incoming, half); });
-            default: return false;
-        }
+        return Prove(mask, half == 0u ? Proof::LowWord64 : Proof::HighWord64, [this, half](const IrValue* value) {
+            if (value->HasImmediate()) return value->Type() == IrType::U64 && static_cast<std::uint32_t>(value->ImmediateU64() >> (32u * half)) == 0u;
+            switch (value->Opcode()) {
+                case IrOpcode::CompositeConstructU64: return Word(value->Argument(half), half);
+                case IrOpcode::Phi: return Incoming(value, [this, half](const IrValue* incoming) { return Word64(incoming, half); });
+                default: return false;
+            }
+        });
     }
 
     template<typename TCheck>
-    bool Incoming(const IrValue* phi, TCheck&& check) {
-        if (!phis.insert(phi).second) return true;
+    static bool Incoming(const IrValue* phi, TCheck&& check) {
         bool result = phi->ArgumentCount() != 0u;
         for (std::size_t index = 0; result && index < phi->ArgumentCount(); ++index) result = check(phi->Argument(index));
-        phis.erase(phi);
         return result;
     }
 
     bool everyInvocationEnters;
-    std::unordered_set<const IrValue*> phis;
+    std::map<Key, std::size_t> active;
+    std::map<Key, Assumption> assumed;
+    std::map<Key, bool> settled;
+    std::size_t dependency = Unbounded;
+    std::uint64_t created = 0u;
     std::uint32_t budget = 2048u;
 };
 
@@ -916,14 +983,6 @@ std::uint32_t EmitFPMedTri32(SpirvEmitterState& state, std::uint32_t arg0, std::
     return value(Select(state, u32, anyNan, min3, median));
 }
 
-std::uint32_t EmitFPRecip32(SpirvEmitterState& state, std::uint32_t arg0) {
-    return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), arg0);
-}
-
-std::uint32_t EmitFPRecipIFlag32(SpirvEmitterState& state, std::uint32_t arg0) {
-    return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), arg0);
-}
-
 std::uint32_t EmitFPRecipSqrt32(SpirvEmitterState& state, std::uint32_t arg0) {
     return EmitExt(state, TypeF32(state), GLSLstd450InverseSqrt, {arg0});
 }
@@ -941,13 +1000,13 @@ std::uint32_t Log2SeriesNearOne(SpirvEmitterState& state, std::uint32_t differen
     for (const std::uint32_t coefficient : {0x3e124925u, 0xbe2aaaabu, 0x3e4ccccdu, 0xbe800000u, 0x3eaaaaabu, 0xbf000000u, 0x3f800000u}) {
         polynomial = Exact(state, EmitExt(state, TypeF32(state), GLSLstd450Fma, {polynomial, difference, ConstantF32(state, coefficient)}));
     }
-    const auto product = Exact(state, Binary(state, spv::OpFMul, TypeF32(state), difference, polynomial));
-    return Exact(state, Binary(state, spv::OpFMul, TypeF32(state), product, ConstantF32(state, 0x3fb8aa3bu)));
+    const auto product = ExactMul(state, difference, polynomial);
+    return ExactMul(state, product, ConstantF32(state, 0x3fb8aa3bu));
 }
 
 std::uint32_t EmitFPLog2(SpirvEmitterState& state, std::uint32_t arg0) {
     const auto value = EmitExt(state, TypeF32(state), GLSLstd450Log2, {arg0});
-    const auto difference = Exact(state, Binary(state, spv::OpFSub, TypeF32(state), arg0, ConstantF32(state, 0x3f800000u)));
+    const auto difference = ExactSub(state, arg0, ConstantF32(state, 0x3f800000u));
     const auto series = Log2SeriesNearOne(state, difference);
     const auto valueBits = Unary(state, spv::OpBitcast, TypeU32(state), value);
     const auto seriesBits = Unary(state, spv::OpBitcast, TypeU32(state), series);
@@ -958,16 +1017,16 @@ std::uint32_t EmitFPLog2(SpirvEmitterState& state, std::uint32_t arg0) {
 }
 
 std::uint32_t SinTurnSeries(SpirvEmitterState& state, std::uint32_t turns) {
-    const auto square = Exact(state, Binary(state, spv::OpFMul, TypeF32(state), turns, turns));
+    const auto square = ExactMul(state, turns, turns);
     auto polynomial = ConstantF32(state, 0xc17183a8u);
     for (const std::uint32_t coefficient : {0x42283c1au, 0xc2996966u, 0x42a335e3u, 0xc2255de7u, 0x40c90fdbu}) {
         polynomial = Exact(state, EmitExt(state, TypeF32(state), GLSLstd450Fma, {polynomial, square, ConstantF32(state, coefficient)}));
     }
-    return Exact(state, Binary(state, spv::OpFMul, TypeF32(state), turns, polynomial));
+    return ExactMul(state, turns, polynomial);
 }
 
 std::uint32_t CosTurnSeries(SpirvEmitterState& state, std::uint32_t turns) {
-    const auto square = Exact(state, Binary(state, spv::OpFMul, TypeF32(state), turns, turns));
+    const auto square = ExactMul(state, turns, turns);
     auto polynomial = ConstantF32(state, 0x40fce9c5u);
     for (const std::uint32_t coefficient : {0xc1d368f9u, 0x4270fa83u, 0xc2aae9e4u, 0x4281e0f8u, 0xc19de9e6u, 0x3f800000u}) {
         polynomial = Exact(state, EmitExt(state, TypeF32(state), GLSLstd450Fma, {polynomial, square, ConstantF32(state, coefficient)}));
@@ -994,9 +1053,9 @@ std::uint32_t EmitFPSin(SpirvEmitterState& state, std::uint32_t arg0) {
     const auto absolute = EmitExt(state, TypeF32(state), GLSLstd450FAbs, {cycle});
     const auto signBits = Binary(state, spv::OpBitwiseAnd, TypeU32(state), Unary(state, spv::OpBitcast, TypeU32(state), cycle), ConstantU32(state, 0x80000000u));
     const auto nearHalf = Binary(state, spv::OpFOrdGreaterThan, TypeBool(state), absolute, ConstantF32(state, 0x3e800000u));
-    const auto distance = Select(state, TypeF32(state), nearHalf, Exact(state, Binary(state, spv::OpFSub, TypeF32(state), ConstantF32(state, 0x3f000000u), absolute)), absolute);
+    const auto distance = Select(state, TypeF32(state), nearHalf, ExactSub(state, ConstantF32(state, 0x3f000000u), absolute), absolute);
     const auto pastEighth = Binary(state, spv::OpFOrdGreaterThan, TypeBool(state), distance, ConstantF32(state, 0x3e000000u));
-    const auto series = Select(state, TypeF32(state), pastEighth, CosTurnSeries(state, Exact(state, Binary(state, spv::OpFSub, TypeF32(state), ConstantF32(state, 0x3e800000u), distance))), SinTurnSeries(state, distance));
+    const auto series = Select(state, TypeF32(state), pastEighth, CosTurnSeries(state, ExactSub(state, ConstantF32(state, 0x3e800000u), distance)), SinTurnSeries(state, distance));
     const auto value = SeriesWhenFar(state, EmitExt(state, TypeF32(state), GLSLstd450Sin, {Binary(state, spv::OpFMul, TypeF32(state), absolute, ConstantF32(state, 0x40c90fdbu))}), series);
     const auto linearConstant = Select(state, TypeF32(state), nearHalf, ConstantF32(state, 0x40c90fdbu), ConstantF32(state, 0x40c90fd5u));
     const auto result = TrigLinearNearZero(state, value, distance, linearConstant);
@@ -1006,10 +1065,10 @@ std::uint32_t EmitFPSin(SpirvEmitterState& state, std::uint32_t arg0) {
 std::uint32_t EmitFPCos(SpirvEmitterState& state, std::uint32_t arg0) {
     const auto cycle = EmitTrigCycleF32(state, arg0, false);
     const auto absolute = EmitExt(state, TypeF32(state), GLSLstd450FAbs, {cycle});
-    const auto distance = Exact(state, Binary(state, spv::OpFSub, TypeF32(state), ConstantF32(state, 0x3e800000u), absolute));
+    const auto distance = ExactSub(state, ConstantF32(state, 0x3e800000u), absolute);
     const auto low = CosTurnSeries(state, absolute);
     const auto middle = SinTurnSeries(state, distance);
-    const auto high = Unary(state, spv::OpFNegate, TypeF32(state), CosTurnSeries(state, Exact(state, Binary(state, spv::OpFSub, TypeF32(state), ConstantF32(state, 0x3f000000u), absolute))));
+    const auto high = Unary(state, spv::OpFNegate, TypeF32(state), CosTurnSeries(state, ExactSub(state, ConstantF32(state, 0x3f000000u), absolute)));
     const auto pastEighth = Binary(state, spv::OpFOrdGreaterThan, TypeBool(state), absolute, ConstantF32(state, 0x3e000000u));
     const auto pastThreeEighths = Binary(state, spv::OpFOrdGreaterThan, TypeBool(state), absolute, ConstantF32(state, 0x3ec00000u));
     const auto series = Select(state, TypeF32(state), pastThreeEighths, high, Select(state, TypeF32(state), pastEighth, middle, low));
@@ -1414,14 +1473,17 @@ std::uint32_t EmitFPUnordGreaterThanEqual32(SpirvEmitterState& state, std::uint3
 }
 
 std::uint32_t EmitFPAdd32(SpirvEmitterState& state, std::uint32_t arg0, std::uint32_t arg1) {
+    if (state.fusedExactArithmetic) return EmitGlsl<GLSLstd450Fma, IrType::F32>(state, ConstantF32(state, 0x3f800000u), arg0, arg1);
     return Exact(state, EmitNative<spv::OpFAdd, IrType::F32>(state, arg0, arg1));
 }
 
 std::uint32_t EmitFPSub32(SpirvEmitterState& state, std::uint32_t arg0, std::uint32_t arg1) {
+    if (state.fusedExactArithmetic) return EmitGlsl<GLSLstd450Fma, IrType::F32>(state, ConstantF32(state, 0xbf800000u), arg1, arg0);
     return Exact(state, EmitNative<spv::OpFSub, IrType::F32>(state, arg0, arg1));
 }
 
 std::uint32_t EmitFPMul32(SpirvEmitterState& state, std::uint32_t arg0, std::uint32_t arg1) {
+    if (state.fusedExactArithmetic) return EmitGlsl<GLSLstd450Fma, IrType::F32>(state, arg0, arg1, ConstantF32(state, 0x80000000u));
     return Exact(state, EmitNative<spv::OpFMul, IrType::F32>(state, arg0, arg1));
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp
new file mode 100644
index 0000000000..69a21a884c
--- /dev/null
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp
@@ -0,0 +1,502 @@
+#include "SpirvBackend/SpirvEmitterHelpers.hpp"
+#include "SpirvBackend/SpirvEmitterInstructions.hpp"
+#include "IntermediateRepresentation/IrBlock.hpp"
+#include "IntermediateRepresentation/IrValue.hpp"
+#include <spirv/unified1/spirv.hpp>
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <span>
+
+namespace ShaderRecompiler {
+namespace {
+
+constexpr std::array<std::uint32_t, 32> ReciprocalConstant{
+    0x04000000u, 0x03e0f83eu, 0x03c3c3c3u, 0x03a83a83u, 0x038e38e3u, 0x03759f22u, 0x035e50d7u, 0x03483483u,
+    0x03333333u, 0x031f3831u, 0x030c30c3u, 0x02fa0be8u, 0x02e8ba2eu, 0x02d82d82u, 0x02c8590bu, 0x02b93105u,
+    0x02aaaaaau, 0x029cbc14u, 0x028f5c28u, 0x02828282u, 0x02762762u, 0x026a439fu, 0x025ed097u, 0x0253c825u,
+    0x02492492u, 0x023ee08fu, 0x0234f72cu, 0x022b63cbu, 0x02222222u, 0x02192e29u, 0x02108421u, 0x02082082u,
+};
+
+constexpr std::array<std::uint32_t, 32> ReciprocalLinear{
+    0x001ffff2u, 0x001e16feu, 0x001c588au, 0x001abfcfu, 0x001948a9u, 0x0017ef84u, 0x0016b143u, 0x00158b2cu,
+    0x00147adcu, 0x00137e3bu, 0x0012936eu, 0x0011b8d2u, 0x0010ecf2u, 0x00102e83u, 0x000f7c5cu, 0x000ed575u,
+    0x000e38e1u, 0x000da5cau, 0x000d1b6fu, 0x000c9924u, 0x000c1e4au, 0x000baa54u, 0x000b3cbfu, 0x000ad517u,
+    0x000a72efu, 0x000a15e6u, 0x0009bda3u, 0x000969d3u, 0x00091a2au, 0x0008ce64u, 0x00088642u, 0x00084187u,
+};
+
+constexpr std::array<std::uint32_t, 32> ReciprocalHigherOrder{
+    0x0785ffb6u, 0x06a9e92du, 0x05ecd536u, 0x0548c377u, 0x04bab3a2u, 0x043ea577u, 0x03d198c0u, 0x03728d4eu,
+    0x031e82f9u, 0x02d479a0u, 0x02927126u, 0x02576970u, 0x0223626au, 0x01f55c00u, 0x01cb5622u, 0x01a550c1u,
+    0x01844bd0u, 0x01654744u, 0x014a4313u, 0x01313f35u, 0x011a3ba2u, 0x01063852u, 0x00f33540u, 0x00e23266u,
+    0x00d22fbfu, 0x00c42d47u, 0x00b72afau, 0x00ab28d4u, 0x00a026d2u, 0x009624f2u, 0x008c232fu, 0x00832189u,
+};
+
+constexpr std::array<std::uint32_t, 1025> ReciprocalCorrectionStarts{
+    0x00000000u, 0x00020000u, 0x00040002u, 0x000a0008u, 0x0012000cu, 0x00160014u, 0x001a0018u, 0x0023001cu,
+    0x00280026u, 0x00290029u, 0x002f002cu, 0x00320031u, 0x00390038u, 0x0042003eu, 0x00480045u, 0x004a004au,
+    0x004f004du, 0x00550052u, 0x00570056u, 0x005d005bu, 0x005f005eu, 0x00640061u, 0x006b0069u, 0x0076006fu,
+    0x007d0077u, 0x0082007eu, 0x00850084u, 0x008d0088u, 0x00920090u, 0x00990097u, 0x00a0009cu, 0x00a400a3u,
+    0x00ab00a8u, 0x00ab00abu, 0x00b000adu, 0x00b700b5u, 0x00bb00b8u, 0x00be00bdu, 0x00c100c1u, 0x00c300c3u,
+    0x00c900c5u, 0x00d000cdu, 0x00d300d2u, 0x00d800d5u, 0x00db00dau, 0x00de00dcu, 0x00e100dfu, 0x00e900e3u,
+    0x00ea00e9u, 0x00ef00edu, 0x00f300f1u, 0x00fb00f7u, 0x00fb00fbu, 0x00ff00feu, 0x01060105u, 0x01080106u,
+    0x010c010au, 0x0112010fu, 0x01150112u, 0x011a0117u, 0x011c011bu, 0x01240120u, 0x012b0126u, 0x0132012fu,
+    0x01360135u, 0x013b0137u, 0x013f013du, 0x01490143u, 0x014a0149u, 0x014e014du, 0x014f014fu, 0x01540151u,
+    0x01580158u, 0x015b0158u, 0x0161015du, 0x01650163u, 0x01670166u, 0x016a0169u, 0x016d016bu, 0x0170016eu,
+    0x01730173u, 0x01750175u, 0x017b0179u, 0x01830181u, 0x01860184u, 0x01870187u, 0x018c018au, 0x0191018fu,
+    0x01970194u, 0x01a1019eu, 0x01a601a4u, 0x01ab01a8u, 0x01b001acu, 0x01b701b5u, 0x01c101bfu, 0x01c701c4u,
+    0x01cd01cbu, 0x01d001cfu, 0x01d501d4u, 0x01d701d6u, 0x01de01ddu, 0x01e301e2u, 0x01e601e5u, 0x01eb01eau,
+    0x01eb01ebu, 0x01ee01ecu, 0x01f001f0u, 0x01f601f4u, 0x01fa01f7u, 0x01fb01fbu, 0x020101feu, 0x02030201u,
+    0x020a0207u, 0x020e020cu, 0x02140212u, 0x02170217u, 0x021d021cu, 0x0220021du, 0x02210221u, 0x02280225u,
+    0x0230022bu, 0x02370233u, 0x023b023bu, 0x023f023bu, 0x02470241u, 0x024b0249u, 0x024f024cu, 0x02540250u,
+    0x02560255u, 0x025a0257u, 0x025a025au, 0x025f025cu, 0x0261025fu, 0x02660264u, 0x02670267u, 0x026d026bu,
+    0x026f026fu, 0x02710271u, 0x02740274u, 0x02760276u, 0x02790276u, 0x027e027cu, 0x0282027fu, 0x02830283u,
+    0x02850285u, 0x02880285u, 0x028d028du, 0x028f028eu, 0x0292028fu, 0x02960293u, 0x029b029au, 0x02a0029du,
+    0x02aa02a5u, 0x02b302acu, 0x02b602b4u, 0x02b902b8u, 0x02bc02bbu, 0x02be02bdu, 0x02c302c0u, 0x02c902c5u,
+    0x02ce02cau, 0x02d202d0u, 0x02d302d2u, 0x02d802d6u, 0x02db02dau, 0x02de02deu, 0x02e102deu, 0x02e102e1u,
+    0x02e602e2u, 0x02ec02eau, 0x02f002eeu, 0x02f502f2u, 0x02f602f6u, 0x02f802f7u, 0x02fc02fau, 0x030002fdu,
+    0x03040302u, 0x03060304u, 0x030a0309u, 0x030d030cu, 0x0310030fu, 0x03130311u, 0x03160316u, 0x031c0319u,
+    0x031f031du, 0x03260322u, 0x0330032au, 0x03350332u, 0x03380337u, 0x033c0339u, 0x0341033du, 0x03470344u,
+    0x034b0349u, 0x034d034cu, 0x034d034du, 0x03500350u, 0x03530350u, 0x03570354u, 0x035a0358u, 0x035b035bu,
+    0x0361035fu, 0x03620361u, 0x03660363u, 0x03680366u, 0x03690368u, 0x036b036au, 0x036d036cu, 0x0370036eu,
+    0x03720371u, 0x03750375u, 0x03790376u, 0x037f037bu, 0x03830382u, 0x03870384u, 0x038a0389u, 0x0390038du,
+    0x03950393u, 0x03960395u, 0x03990396u, 0x039e039bu, 0x039f039fu, 0x03a303a2u, 0x03a503a5u, 0x03ab03a8u,
+    0x03af03aeu, 0x03b103b0u, 0x03b403b3u, 0x03b603b4u, 0x03b803b8u, 0x03bc03b9u, 0x03c003beu, 0x03c303c0u,
+    0x03c503c3u, 0x03c503c5u, 0x03c603c5u, 0x03ca03c8u, 0x03ca03cau, 0x03cc03cbu, 0x03cf03cdu, 0x03d303d0u,
+    0x03d503d4u, 0x03d803d7u, 0x03da03d9u, 0x03dc03dbu, 0x03de03dcu, 0x03de03deu, 0x03e203e0u, 0x03e703e5u,
+    0x03e903e8u, 0x03ea03eau, 0x03ed03ebu, 0x03ef03eeu, 0x03f103efu, 0x03f503f2u, 0x03fb03f7u, 0x03fe03fbu,
+    0x04080401u, 0x040d040bu, 0x040e040eu, 0x040f040eu, 0x04130411u, 0x04130413u, 0x04150414u, 0x04160415u,
+    0x04180416u, 0x041b041au, 0x041e041du, 0x0420041fu, 0x04240421u, 0x04280428u, 0x042b042bu, 0x042d042bu,
+    0x042f042fu, 0x04330431u, 0x04330433u, 0x04350433u, 0x04380436u, 0x043d043bu, 0x043f043eu, 0x0441043fu,
+    0x04450443u, 0x04460445u, 0x04460446u, 0x044a0449u, 0x0450044eu, 0x04560454u, 0x04590457u, 0x045e045bu,
+    0x04640462u, 0x04650464u, 0x046b0466u, 0x046c046cu, 0x0470046eu, 0x04750473u, 0x04780477u, 0x047b047au,
+    0x0480047eu, 0x04810480u, 0x04830481u, 0x04850483u, 0x04870486u, 0x048b0488u, 0x048f048eu, 0x0490048fu,
+    0x04920492u, 0x04940492u, 0x04970497u, 0x049b049au, 0x049f049eu, 0x04a1049fu, 0x04a304a2u, 0x04a504a5u,
+    0x04a704a6u, 0x04a904a8u, 0x04ad04abu, 0x04b304afu, 0x04b504b5u, 0x04b604b5u, 0x04b804b7u, 0x04bc04bbu,
+    0x04c104beu, 0x04c204c2u, 0x04c404c3u, 0x04c404c4u, 0x04c504c5u, 0x04c704c6u, 0x04c804c7u, 0x04c904c9u,
+    0x04c904c9u, 0x04ce04cdu, 0x04d004cfu, 0x04d304d2u, 0x04d304d3u, 0x04d604d6u, 0x04d904d7u, 0x04dc04d9u,
+    0x04e004dfu, 0x04e004e0u, 0x04e104e0u, 0x04e204e1u, 0x04e404e4u, 0x04e404e4u, 0x04e704e7u, 0x04eb04e8u,
+    0x04ef04edu, 0x04f304f2u, 0x04f704f4u, 0x04fb04f9u, 0x04fd04fdu, 0x05030500u, 0x05090505u, 0x050d050bu,
+    0x05130510u, 0x05140514u, 0x05160515u, 0x05160516u, 0x051a0518u, 0x051d051bu, 0x051e051du, 0x0520051fu,
+    0x05260523u, 0x05280527u, 0x05290529u, 0x052d052au, 0x0531052eu, 0x05320531u, 0x05350533u, 0x053a0538u,
+    0x053d053bu, 0x053f053fu, 0x05420542u, 0x05420542u, 0x05440542u, 0x05480546u, 0x054c054bu, 0x054f054eu,
+    0x054f054fu, 0x0551054fu, 0x05530552u, 0x05550553u, 0x05570557u, 0x055c0559u, 0x055e055du, 0x055e055eu,
+    0x055f055fu, 0x0563055fu, 0x05660566u, 0x05690568u, 0x056c056bu, 0x056d056cu, 0x056e056du, 0x05710571u,
+    0x05720572u, 0x05720572u, 0x05730573u, 0x05750573u, 0x05760575u, 0x05790578u, 0x057f057cu, 0x05830581u,
+    0x05850585u, 0x05870587u, 0x058e0589u, 0x058f058eu, 0x05930592u, 0x05980595u, 0x059c059au, 0x05a205a0u,
+    0x05a205a2u, 0x05a305a3u, 0x05a805a6u, 0x05aa05a9u, 0x05ac05acu, 0x05ad05adu, 0x05b005adu, 0x05b705b2u,
+    0x05ba05b9u, 0x05bb05bbu, 0x05bd05bbu, 0x05bd05bdu, 0x05bf05bfu, 0x05c305c1u, 0x05c605c4u, 0x05c605c6u,
+    0x05c705c7u, 0x05c905c8u, 0x05ca05c9u, 0x05cd05ccu, 0x05cf05cdu, 0x05d105d0u, 0x05d305d2u, 0x05d605d4u,
+    0x05d805d6u, 0x05d905d8u, 0x05dc05dau, 0x05dc05dcu, 0x05de05dcu, 0x05df05deu, 0x05e005e0u, 0x05e405e3u,
+    0x05e705e5u, 0x05ec05eau, 0x05ee05edu, 0x05f205f1u, 0x05f305f2u, 0x05f705f4u, 0x05f905f8u, 0x05fb05fbu,
+    0x05fd05fcu, 0x06000600u, 0x06050604u, 0x06050605u, 0x06090609u, 0x060c060bu, 0x0610060fu, 0x06100610u,
+    0x06130610u, 0x06140613u, 0x061a0618u, 0x061b061au, 0x061d061cu, 0x06250622u, 0x06260625u, 0x06280628u,
+    0x062a0629u, 0x062b062bu, 0x062e062cu, 0x062e062eu, 0x06300630u, 0x06330632u, 0x06350635u, 0x06370636u,
+    0x06390638u, 0x063a063au, 0x063b063au, 0x063d063cu, 0x0641063eu, 0x06420641u, 0x06450643u, 0x06480646u,
+    0x064e064au, 0x064f064fu, 0x06510651u, 0x06530652u, 0x06570656u, 0x06580658u, 0x065a0659u, 0x065d065cu,
+    0x065e065eu, 0x0661065fu, 0x06630662u, 0x06640664u, 0x06660666u, 0x06670666u, 0x06690668u, 0x066b0669u,
+    0x066d066du, 0x066e066du, 0x06710670u, 0x06720671u, 0x06740673u, 0x06760676u, 0x06780678u, 0x067a0679u,
+    0x067c067cu, 0x067e067eu, 0x067f067eu, 0x06820680u, 0x06860685u, 0x068a0688u, 0x068c068cu, 0x068e068cu,
+    0x06990690u, 0x069b069au, 0x069b069bu, 0x069e069cu, 0x06a206a0u, 0x06a506a4u, 0x06a606a5u, 0x06ab06aau,
+    0x06ad06adu, 0x06b006afu, 0x06b406b1u, 0x06b406b4u, 0x06b606b5u, 0x06ba06b8u, 0x06ba06bau, 0x06be06bdu,
+    0x06c106c1u, 0x06c506c2u, 0x06c806c6u, 0x06c906c9u, 0x06ce06ccu, 0x06ce06ceu, 0x06d306d3u, 0x06d706d4u,
+    0x06dd06dcu, 0x06dd06ddu, 0x06de06ddu, 0x06e006deu, 0x06e406e1u, 0x06e506e5u, 0x06e806e8u, 0x06e906e8u,
+    0x06ed06ebu, 0x06ee06eeu, 0x06f106eeu, 0x06f206f2u, 0x06f606f3u, 0x06fa06f9u, 0x06fc06fbu, 0x06fd06fdu,
+    0x07000700u, 0x07020700u, 0x07070703u, 0x070a0709u, 0x070c070cu, 0x070d070cu, 0x070d070du, 0x070f070eu,
+    0x07100710u, 0x07120710u, 0x07120712u, 0x07140714u, 0x07150714u, 0x07160715u, 0x07170717u, 0x071a0719u,
+    0x0720071eu, 0x07230720u, 0x07260725u, 0x07290727u, 0x072a0729u, 0x072d072bu, 0x072f072eu, 0x0732072fu,
+    0x07340733u, 0x07370735u, 0x07370737u, 0x07380737u, 0x073a0739u, 0x073b073au, 0x073e073eu, 0x07410740u,
+    0x07420741u, 0x07440743u, 0x07450744u, 0x07460746u, 0x07480747u, 0x074b074au, 0x074b074bu, 0x074e074du,
+    0x0751074eu, 0x07520751u, 0x07550755u, 0x07580757u, 0x07590759u, 0x075c075bu, 0x075f075fu, 0x0760075fu,
+    0x07610760u, 0x07660766u, 0x07690769u, 0x076a0769u, 0x076d076bu, 0x076e076eu, 0x0771076fu, 0x07740772u,
+    0x07780774u, 0x077a0778u, 0x077d077cu, 0x077e077du, 0x0781077fu, 0x07830782u, 0x07830783u, 0x07840783u,
+    0x07870786u, 0x07890788u, 0x078a0789u, 0x078c078bu, 0x078d078du, 0x078d078du, 0x078e078eu, 0x07920792u,
+    0x07930792u, 0x07970796u, 0x07990799u, 0x079a0799u, 0x079d079au, 0x079e079eu, 0x07a007a0u, 0x07a007a0u,
+    0x07a207a0u, 0x07a407a3u, 0x07a507a5u, 0x07a507a5u, 0x07a807a6u, 0x07ac07abu, 0x07ad07adu, 0x07ad07adu,
+    0x07b207aeu, 0x07b407b3u, 0x07b607b6u, 0x07b907b9u, 0x07bd07bcu, 0x07be07bdu, 0x07bf07beu, 0x07c207bfu,
+    0x07c407c4u, 0x07c507c5u, 0x07c507c5u, 0x07c607c5u, 0x07c707c6u, 0x07c907c8u, 0x07ca07cau, 0x07cc07cau,
+    0x07d007ceu, 0x07d307d1u, 0x07d407d4u, 0x07d607d6u, 0x07d607d6u, 0x07d907d8u, 0x07db07dbu, 0x07dc07dbu,
+    0x07de07ddu, 0x07df07dfu, 0x07e207e0u, 0x07e807e5u, 0x07eb07e9u, 0x07eb07ebu, 0x07ee07eeu, 0x07ef07efu,
+    0x07f407f1u, 0x07f407f4u, 0x07f807f7u, 0x07f807f8u, 0x07f807f8u, 0x07fc07fau, 0x07fe07fcu, 0x080207ffu,
+    0x08040803u, 0x08060806u, 0x08080806u, 0x080a0809u, 0x080a080au, 0x080d080bu, 0x08120810u, 0x08130813u,
+    0x08160814u, 0x08180818u, 0x081b0819u, 0x081e081eu, 0x0821081eu, 0x08220821u, 0x08240824u, 0x08270826u,
+    0x08270827u, 0x082b0829u, 0x082e082cu, 0x082f082eu, 0x0830082fu, 0x08310830u, 0x08320832u, 0x08340833u,
+    0x08360834u, 0x08360836u, 0x08380837u, 0x08390839u, 0x083d083bu, 0x083f083du, 0x08410840u, 0x08410841u,
+    0x08420841u, 0x08440843u, 0x08450845u, 0x08470846u, 0x084a0849u, 0x084d084bu, 0x084e084eu, 0x084f084fu,
+    0x08530852u, 0x08540854u, 0x08550855u, 0x08570855u, 0x085a0858u, 0x085b085au, 0x085c085cu, 0x085d085cu,
+    0x085d085du, 0x08630861u, 0x08650864u, 0x08670865u, 0x086a0867u, 0x086e086cu, 0x08710871u, 0x08730872u,
+    0x08760873u, 0x08790878u, 0x08790879u, 0x087b087au, 0x087c087bu, 0x087c087cu, 0x087d087du, 0x0880087eu,
+    0x08810881u, 0x08830883u, 0x08870886u, 0x08890888u, 0x088d088cu, 0x088e088du, 0x088f088fu, 0x08900890u,
+    0x08920890u, 0x08960894u, 0x08970896u, 0x08970897u, 0x08990898u, 0x089d089cu, 0x089f089du, 0x08a208a2u,
+    0x08a408a4u, 0x08a808a7u, 0x08a908a8u, 0x08ab08aau, 0x08ae08acu, 0x08af08aeu, 0x08b108b0u, 0x08b208b2u,
+    0x08b408b2u, 0x08b608b4u, 0x08b808b7u, 0x08bb08b9u, 0x08bc08bcu, 0x08bd08bcu, 0x08bd08bdu, 0x08be08beu,
+    0x08c008bfu, 0x08c108c0u, 0x08c508c3u, 0x08ca08c8u, 0x08cd08ccu, 0x08ce08cdu, 0x08ce08ceu, 0x08d108d0u,
+    0x08d208d2u, 0x08d408d4u, 0x08d408d4u, 0x08d508d5u, 0x08d808d6u, 0x08dc08d9u, 0x08dc08dcu, 0x08dd08ddu,
+    0x08e008dfu, 0x08e408e2u, 0x08e408e4u, 0x08e508e4u, 0x08e708e6u, 0x08e808e7u, 0x08eb08e9u, 0x08f008eeu,
+    0x08f308f2u, 0x08f608f4u, 0x08f608f6u, 0x08f908f9u, 0x08fc08f9u, 0x08fe08fcu, 0x09010901u, 0x09020902u,
+    0x09040902u, 0x09050904u, 0x09060906u, 0x09080907u, 0x090b090au, 0x090d090du, 0x090f090eu, 0x09100910u,
+    0x09140913u, 0x09160915u, 0x09190917u, 0x091d091cu, 0x091f091eu, 0x09220920u, 0x09260926u, 0x092a0929u,
+    0x092d092bu, 0x092e092du, 0x09320931u, 0x09340933u, 0x09350935u, 0x093b0938u, 0x093e093du, 0x0943093fu,
+    0x09450945u, 0x09470946u, 0x09480947u, 0x094d0949u, 0x094f094fu, 0x09500950u, 0x09550951u, 0x09560955u,
+    0x09560956u, 0x09570957u, 0x09590957u, 0x095c095au, 0x095c095cu, 0x095e095eu, 0x09600960u, 0x09610960u,
+    0x09630962u, 0x09650964u, 0x09670967u, 0x096b096au, 0x096e096du, 0x09720970u, 0x09740974u, 0x09740974u,
+    0x09750975u, 0x09790978u, 0x097d097bu, 0x097f097fu, 0x097f097fu, 0x09810981u, 0x09820981u, 0x09850983u,
+    0x098b0985u, 0x098b098bu, 0x0990098du, 0x09920990u, 0x09940993u, 0x09950994u, 0x09990998u, 0x099e099cu,
+    0x099f099eu, 0x09a209a1u, 0x09a309a3u, 0x09a509a4u, 0x09a909a7u, 0x09ad09aau, 0x09b009adu, 0x09b209b0u,
+    0x09b209b2u, 0x09b409b2u, 0x09b509b4u, 0x09b509b5u, 0x09b609b5u, 0x09b609b6u, 0x09b909b8u, 0x09bb09bbu,
+    0x09be09bdu, 0x09bf09beu, 0x09c109c0u, 0x09c109c1u, 0x09c209c1u, 0x09c409c3u, 0x09c709c6u, 0x09c909c9u,
+    0x09ce09cbu, 0x09ce09ceu, 0x09cf09ceu, 0x09cf09cfu, 0x09d109d0u, 0x09d509d2u, 0x09d909d8u, 0x09d909d9u,
+    0x09de09ddu, 0x09e009dfu, 0x09e209e1u, 0x09e609e3u, 0x09e809e8u, 0x09e809e8u, 0x09ec09e9u, 0x09ef09eeu,
+    0x09f109f1u, 0x09f209f2u, 0x09f409f3u, 0x09f509f4u, 0x09f609f5u, 0x09f909f6u, 0x09fa09f9u, 0x09fd09fbu,
+    0x09fe09feu, 0x09ff09ffu, 0x0a030a02u, 0x0a060a05u, 0x0a090a08u, 0x0a0c0a0bu, 0x0a120a0eu, 0x0a140a13u,
+    0x0a170a16u, 0x0a190a18u, 0x0a1b0a1au, 0x0a1c0a1cu, 0x0a1d0a1du, 0x0a200a1fu, 0x0a220a20u, 0x0a250a24u,
+    0x0a280a27u, 0x0a2b0a2au, 0x0a2d0a2cu, 0x0a300a2du, 0x0a320a31u, 0x0a360a35u, 0x0a380a36u, 0x0a3c0a3au,
+    0x0a3d0a3cu, 0x0a3d0a3du, 0x0a3d0a3du, 0x0a3e0a3du, 0x0a400a3fu, 0x0a400a40u, 0x0a410a41u, 0x0a420a41u,
+    0x0a420a42u, 0x0a440a43u, 0x0a440a44u, 0x0a440a44u, 0x0a470a47u, 0x0a490a47u, 0x0a490a49u, 0x0a4b0a4au,
+    0x0a4e0a4cu, 0x0a500a4eu, 0x0a530a52u, 0x0a540a54u, 0x0a560a55u, 0x0a570a56u, 0x0a580a58u, 0x0a590a58u,
+    0x0a590a59u, 0x0a5d0a5cu, 0x0a5e0a5du, 0x0a5f0a5fu, 0x0a600a5fu, 0x0a640a62u, 0x0a660a64u, 0x0a670a66u,
+    0x0a6a0a68u, 0x0a6b0a6bu, 0x0a6e0a6eu, 0x0a700a6fu, 0x0a710a71u, 0x0a720a71u, 0x0a730a73u, 0x0a740a74u,
+    0x0a750a75u, 0x0a760a76u, 0x0a780a77u, 0x0a7b0a79u, 0x0a7c0a7bu, 0x0a7e0a7cu, 0x0a7e0a7eu, 0x0a7f0a7eu,
+    0x0a820a7fu, 0x0a840a83u, 0x0a860a85u, 0x0a880a86u, 0x0a8a0a89u, 0x0a8c0a8bu, 0x0a8f0a8du, 0x0a910a90u,
+    0x0a910a91u, 0x0a950a92u, 0x0a970a96u, 0x0a990a98u, 0x0a9b0a99u, 0x0a9d0a9du, 0x0a9f0a9du, 0x0aa00aa0u,
+    0x0aa40aa0u, 0x0aa50aa4u, 0x0aaa0aa6u, 0x0aab0aaau, 0x0aaf0aacu, 0x0ab00aafu, 0x0ab10ab1u, 0x0ab40ab1u,
+    0x0ab50ab4u, 0x0aba0ab9u, 0x0abd0abbu, 0x0abf0abeu, 0x0ac20ac0u, 0x0ac50ac3u, 0x0ac50ac5u, 0x0ac80ac8u,
+    0x00000ac9u,
+};
+
+constexpr std::array<std::uint32_t, 1381> ReciprocalCorrections{
+    0x09230922u, 0x0dcd0dccu, 0x01d101d0u, 0x04e704e6u, 0x0e8d0e8cu, 0x05df05deu, 0x07a507a4u, 0x085b085au,
+    0x0f7f0f7eu, 0x0e070e06u, 0x01a901a8u, 0x0bdf0bdeu, 0x06e306e2u, 0x04db04dau, 0x02650264u, 0x0a430a42u,
+    0x0fda0e3au, 0x039b0fdbu, 0x03df03deu, 0x0ca30ca2u, 0x096e0c74u, 0x0df5096fu, 0x0e7c0b2au, 0x09020e7du,
+    0x08c409abu, 0x005b005au, 0x096e072eu, 0x0e7d096fu, 0x04ff07a9u, 0x07530752u, 0x0a830a82u, 0x04670466u,
+    0x087f087eu, 0x06ef0524u, 0x02880cb3u, 0x05b70289u, 0x0d2b0d2au, 0x05d5013eu, 0x08fb0ef3u, 0x03020a8du,
+    0x0906042eu, 0x089f00d9u, 0x0f340ea5u, 0x03790f43u, 0x045b045au, 0x01b60f1fu, 0x02970938u, 0x062d0626u,
+    0x02b408cfu, 0x0f670c20u, 0x02b50068u, 0x0cdd0cdcu, 0x06e10ebeu, 0x00ab0c9eu, 0x08a7076du, 0x01230da0u,
+    0x02590258u, 0x056e051eu, 0x0ecb08ffu, 0x02ba06dcu, 0x03ac0396u, 0x03c303adu, 0x03720927u, 0x01250031u,
+    0x12f6018fu, 0x058e0035u, 0x001101e0u, 0x0a6f06a0u, 0x03c2017eu, 0x0975055fu, 0x06490f45u, 0x09520742u,
+    0x074d051fu, 0x087204f7u, 0x0c5a0a55u, 0x01650c5bu, 0x01f30dabu, 0x0d5b0364u, 0x087f0368u, 0x0e730953u,
+    0x036101bcu, 0x064a1e36u, 0x03a602d2u, 0x0d240954u, 0x081e002au, 0x06690e87u, 0x035b0e6bu, 0x0aa9058au,
+    0x044a0018u, 0x06f504f5u, 0x01160bbbu, 0x068101bfu, 0x02790121u, 0x033b0e62u, 0x0dc80b27u, 0x046b014du,
+    0x00a70cb1u, 0x03a10230u, 0x03320549u, 0x092708ddu, 0x00640c76u, 0x193b01acu, 0x02eb0998u, 0x0fa30e9du,
+    0x0d680286u, 0x0ae40808u, 0x03870f6du, 0x09fa0451u, 0x0a960098u, 0x09ef0cbeu, 0x031702c2u, 0x017d0185u,
+    0x02ed03c8u, 0x003e0453u, 0x068801c4u, 0x0f4d0d62u, 0x0b360fe3u, 0x0afb0293u, 0x064a0c79u, 0x042a0ed6u,
+    0x014e0c5du, 0x03530535u, 0x0499039fu, 0x02460953u, 0x086f0303u, 0x07b50d76u, 0x0dc40928u, 0x024e0a5au,
+    0x068304ecu, 0x07b2076au, 0x07750f6fu, 0x0d3c02a5u, 0x0c6c03bfu, 0x086a00c7u, 0x02b50270u, 0x00ad06cdu,
+    0x05b00515u, 0x097b063cu, 0x04d00df2u, 0x09890e9cu, 0x0d830992u, 0x0f40009au, 0x0d86022bu, 0x0ee70e34u,
+    0x09560897u, 0x0d240cf7u, 0x06650343u, 0x0488008fu, 0x06bf053cu, 0x0ba80c1cu, 0x0caf0c32u, 0x071f0d84u,
+    0x0ded0b02u, 0x07c40558u, 0x00220b18u, 0x018b04cdu, 0x098d05e3u, 0x0b1e0fb9u, 0x01710dc4u, 0x030b0accu,
+    0x0f4d0a1cu, 0x01b20fcbu, 0x0273021bu, 0x0b27092du, 0x0d640d14u, 0x08cb0258u, 0x06b10bb5u, 0x0ab506a2u,
+    0x01281af9u, 0x0eb00d04u, 0x06b102d1u, 0x0bc70b39u, 0x096b0783u, 0x062b0d74u, 0x01500e6fu, 0x1a11033bu,
+    0x09ad0f37u, 0x07150d85u, 0x0a480fabu, 0x081b098eu, 0x0c850be0u, 0x03fc04bfu, 0x0e160d48u, 0x0e130c66u,
+    0x075c01f8u, 0x03580e3du, 0x00bd0877u, 0x064602b4u, 0x052b0697u, 0x00bd0c4du, 0x02270179u, 0x096e06bbu,
+    0x011c0a9cu, 0x04f80a78u, 0x0fcb020bu, 0x17e301a8u, 0x0e9909d5u, 0x0cbf06abu, 0x072d019du, 0x07110d1eu,
+    0x03e60785u, 0x0f5807b7u, 0x076b0114u, 0x009f08b3u, 0x048b0153u, 0x09ed0879u, 0x0eeb0a69u, 0x05c500e7u,
+    0x06530d54u, 0x18010680u, 0x06b502c8u, 0x0a8209f2u, 0x062204f0u, 0x10440a5au, 0x042e0254u, 0x0ca908a8u,
+    0x0073003au, 0x074103a5u, 0x025a1908u, 0x02a10ce1u, 0x03e503c9u, 0x06ab043cu, 0x097008a3u, 0x05c20d91u,
+    0x03250b4cu, 0x0cc70a0fu, 0x071a006eu, 0x00710c41u, 0x0b5a00b4u, 0x00300e76u, 0x08fa0994u, 0x0dfa0973u,
+    0x054104cfu, 0x0d5c0d47u, 0x0abf0257u, 0x021d0bc4u, 0x043c03c3u, 0x0e16087fu, 0x09b30eafu, 0x17000164u,
+    0x07750726u, 0x02f208d3u, 0x03f306e3u, 0x06280379u, 0x0dce0ae4u, 0x02c400c3u, 0x09d6067cu, 0x0bf10552u,
+    0x09eb00bau, 0x0f890af0u, 0x03640035u, 0x00520f97u, 0x05590223u, 0x0c16028du, 0x0d840c21u, 0x068c0130u,
+    0x00360f87u, 0x0598018eu, 0x080f07c4u, 0x04110cc6u, 0x09e404eeu, 0x089802d2u, 0x0ed60c97u, 0x0cd10722u,
+    0x0ecf0dbbu, 0x0f6008f8u, 0x0b650931u, 0x06dc0cc0u, 0x0a9e07ddu, 0x0ed90ca7u, 0x01150058u, 0x0d020745u,
+    0x06e80cc6u, 0x086f072au, 0x013f0e21u, 0x0fc61bdeu, 0x06ff00cau, 0x061a0d5fu, 0x073b06cfu, 0x0f650a40u,
+    0x0bc60234u, 0x00280bd0u, 0x0bcd00c3u, 0x006e0f98u, 0x057e04c6u, 0x01ae07d0u, 0x09d7043du, 0x08710d0eu,
+    0x08220b46u, 0x0a3909c6u, 0x0c320ab3u, 0x02e70dd1u, 0x0d850f0bu, 0x027f0ddcu, 0x0599044cu, 0x07710a83u,
+    0x1b610ae2u, 0x0cca0b68u, 0x001c06aau, 0x002f08a7u, 0x0b990a66u, 0x04a4043du, 0x09c402d4u, 0x0ba20ba9u,
+    0x02680fe7u, 0x0b8908a8u, 0x09ce0491u, 0x01af0966u, 0x0c3e0797u, 0x02750f5cu, 0x02d70a0du, 0x0057064au,
+    0x0126018au, 0x0ed30792u, 0x0a5504c3u, 0x0cef04b9u, 0x07d10de6u, 0x0f5d0a98u, 0x0f8a0d52u, 0x03c60aebu,
+    0x0caf088fu, 0x06b406eau, 0x09040a91u, 0x0bbb0a57u, 0x08a6003au, 0x0f590de3u, 0x06020fb7u, 0x008e083du,
+    0x01940124u, 0x07a101bbu, 0x0f1e0c68u, 0x092c0310u, 0x09b4096du, 0x0d120297u, 0x02b70e2du, 0x0c2e19ceu,
+    0x118d00a9u, 0x0cf7067fu, 0x01790e25u, 0x0dd91421u, 0x0f040dfeu, 0x0b3c0133u, 0x033b013bu, 0x0ac2048eu,
+    0x0d050bcdu, 0x0da40eddu, 0x0ae2046fu, 0x0d1602a4u, 0x01d20669u, 0x0f9b0f24u, 0x04cb1b07u, 0x0d2f06feu,
+    0x0f4c0ad0u, 0x076e0fd4u, 0x039a0ea2u, 0x05b203a2u, 0x0cfe0fc6u, 0x00040000u, 0x0cee04a8u, 0x0a9313e9u,
+    0x08e60433u, 0x03370317u, 0x0f12092cu, 0x0e8e06b0u, 0x07191400u, 0x02480745u, 0x1bc10a4fu, 0x0930051du,
+    0x18de0e5fu, 0x069f051au, 0x0e8e0abbu, 0x09a10231u, 0x0fe10afbu, 0x02f70146u, 0x0a38020cu, 0x0b380995u,
+    0x0b420727u, 0x091a0494u, 0x07361c40u, 0x0c320376u, 0x09b10949u, 0x0a270370u, 0x059302c5u, 0x0f4a06cbu,
+    0x0e1e069eu, 0x0e0503f9u, 0x0df6017cu, 0x07cb0184u, 0x0c1d08bau, 0x0e3500b8u, 0x02730c99u, 0x0a3f06ebu,
+    0x063d06e2u, 0x05ff086cu, 0x0a8208b7u, 0x085f0660u, 0x02dd0f51u, 0x06130576u, 0x061a0581u, 0x00380e54u,
+    0x06b102dfu, 0x0752029eu, 0x1c810abbu, 0x0a4502dbu, 0x0ecb0d85u, 0x051a01a6u, 0x09ea0774u, 0x0e390cf0u,
+    0x04c40019u, 0x055100cfu, 0x037206c8u, 0x049403b8u, 0x005a153du, 0x0243011du, 0x00ac007cu, 0x088c06f7u,
+    0x0ce70b5cu, 0x0e7b0d84u, 0x040902a2u, 0x031a084bu, 0x002e064au, 0x0c9d0cd2u, 0x00c8036cu, 0x0f1a07a7u,
+    0x07420150u, 0x0b850f5du, 0x0bb20072u, 0x0cae0dbau, 0x06891371u, 0x04f40adfu, 0x08360659u, 0x12810f3bu,
+    0x019108fdu, 0x037e0c9du, 0x0f2f0b57u, 0x0cc405a8u, 0x064a07d5u, 0x08340f67u, 0x02410d1fu, 0x08c506cbu,
+    0x0d3e0d7fu, 0x088a0198u, 0x0d3b0eb6u, 0x08340031u, 0x01591f7du, 0x03e20cdfu, 0x0cf30c50u, 0x00fe1ef7u,
+    0x050f01c4u, 0x07ac0c36u, 0x0658057du, 0x02c80743u, 0x0d3e0d4cu, 0x06570264u, 0x01ee0e6eu, 0x0ab30a4bu,
+    0x01160098u, 0x00e307e3u, 0x07da050bu, 0x0349013eu, 0x00d10568u, 0x023014d7u, 0x0efa02a0u, 0x0b9f0f6au,
+    0x0ff50d0fu, 0x034e08b8u, 0x03f40a10u, 0x09d60958u, 0x09670336u, 0x02d70e9du, 0x08490548u, 0x073f0012u,
+    0x007c0b8fu, 0x19120fc8u, 0x0ed008dcu, 0x0d890533u, 0x030802fbu, 0x0e410c8du, 0x1cb80224u, 0x0e7d08fcu,
+    0x18c108beu, 0x06ef0e4bu, 0x0b0b0b85u, 0x02bb019cu, 0x09331414u, 0x01900342u, 0x063b1bf8u, 0x0d2a0d59u,
+    0x0b7a090du, 0x087f0e27u, 0x06dc046du, 0x05380a6du, 0x09070314u, 0x0ce40ee0u, 0x0a8d09b7u, 0x0e680367u,
+    0x0d920486u, 0x091b0288u, 0x0d010fb4u, 0x09d80eceu, 0x0ea6048au, 0x02da0b5du, 0x01570b88u, 0x016c078bu,
+    0x074d037cu, 0x08be078du, 0x025f0b3fu, 0x05360c4cu, 0x09b706f9u, 0x04b00b46u, 0x0c1208ebu, 0x1e8a0a46u,
+    0x00080f72u, 0x003a0021u, 0x13f402cfu, 0x0642053du, 0x00e700aau, 0x04b10ad4u, 0x0fa00e90u, 0x00970eb0u,
+    0x04740b05u, 0x16710ba9u, 0x0a3007d6u, 0x0b8a0a4fu, 0x0d2d0af9u, 0x02e109bbu, 0x0c650d75u, 0x0f5c01d9u,
+    0x01990f6fu, 0x0ea30ac5u, 0x0d1507b3u, 0x0f7a0ed1u, 0x05ec0455u, 0x01b609e8u, 0x04bd0cc1u, 0x07bd0bd0u,
+    0x02470b13u, 0x062a19afu, 0x04da0a7cu, 0x0ee308cau, 0x0be5000fu, 0x046d0ef7u, 0x050d0eccu, 0x04780947u,
+    0x0b141721u, 0x04a30c26u, 0x00f30e27u, 0x086a0034u, 0x0efb0e58u, 0x09470553u, 0x0f770bf9u, 0x0c100059u,
+    0x077b02e8u, 0x0e8507d0u, 0x0e3f075fu, 0x073601c9u, 0x05640dd8u, 0x075f0a4bu, 0x0ee60e3du, 0x057a0212u,
+    0x0db10c5au, 0x067f0008u, 0x039301bbu, 0x085e0565u, 0x0efa0bc3u, 0x03380f6fu, 0x0cba0034u, 0x14d7100fu,
+    0x096d006eu, 0x03d40d1au, 0x049609eeu, 0x0f7f0b78u, 0x0a0e08feu, 0x01e20b90u, 0x0e6705b0u, 0x0d3310c3u,
+    0x055f0302u, 0x096b08c2u, 0x1acc09c1u, 0x08aa0345u, 0x037602c2u, 0x057504d4u, 0x0f3b0ee8u, 0x0aa00f66u,
+    0x04fc0215u, 0x0e43005eu, 0x0ba60350u, 0x04c81cf9u, 0x0df707afu, 0x069707cbu, 0x0ed70965u, 0x007b05bcu,
+    0x0c960f1au, 0x05f60c04u, 0x0e800dcbu, 0x09c70f82u, 0x04b40612u, 0x04e30c57u, 0x09c508b9u, 0x045b1f4au,
+    0x0aa814d7u, 0x0c2b0ecbu, 0x180a1ef5u, 0x0ab0045du, 0x039100b3u, 0x0c7c0587u, 0x0d5b02a9u, 0x002d000eu,
+    0x09720c68u, 0x0ecf0231u, 0x03c70afau, 0x0d6c06f5u, 0x01320bcfu, 0x04e811cfu, 0x0cdf0f7bu, 0x06ca09deu,
+    0x0b0e06c8u, 0x01230562u, 0x0fb20b65u, 0x02c70882u, 0x08c40749u, 0x0d480b66u, 0x177103cfu, 0x06ca09f2u,
+    0x063c0456u, 0x0add00d5u, 0x0b3308afu, 0x0ea30f84u, 0x0b7204d7u, 0x04e70e35u, 0x043b0a95u, 0x18450cbfu,
+    0x0fd70a2bu, 0x0c8c03e2u, 0x087a008au, 0x1dd31d76u, 0x00300f35u, 0x0bd6084eu, 0x01050d8bu, 0x06600568u,
+    0x0c9e0c4du, 0x13550f6au, 0x15bc073au, 0x082306ddu, 0x02500c6cu, 0x15710e9bu, 0x084f1eedu, 0x0a5f0949u,
+    0x046a000eu, 0x092317f2u, 0x0cd11c78u, 0x05570228u, 0x061c008bu, 0x092d081du, 0x04b40b07u, 0x01b706ecu,
+    0x099414f2u, 0x120d0a3cu, 0x0e600a1bu, 0x1719049cu, 0x08da0984u, 0x0627033eu, 0x011a09c4u, 0x0727010du,
+    0x04f0082cu, 0x057a015du, 0x1a8509d7u, 0x0d2b1cccu, 0x097d0792u, 0x01c80e69u, 0x02bb0366u, 0x009b0c68u,
+    0x0a2909f7u, 0x0e7d071au, 0x0e941c04u, 0x03a911d3u, 0x0a240957u, 0x0c940bf4u, 0x0b5f0b28u, 0x028e0fc5u,
+    0x08ae0d84u, 0x05d20c71u, 0x05710aedu, 0x052e0a9cu, 0x054e0ac8u, 0x0f880c7eu, 0x0ef6083du, 0x006f0a28u,
+    0x19d50787u, 0x02ac0f28u, 0x0a5f033cu, 0x1e5c0c9bu, 0x0d2f0553u, 0x0fe60f84u, 0x08ae0214u, 0x09d1016au,
+    0x083d0d58u, 0x11e00e5du, 0x02ea0e50u, 0x0e27081du, 0x028002eau, 0x099205d2u, 0x0c5e0726u, 0x09ba1e66u,
+    0x00290ef6u, 0x05b50223u, 0x079305efu, 0x06e31f47u, 0x00b00e11u, 0x02b0028fu, 0x09fe0634u, 0x024901d1u,
+    0x07251586u, 0x0a681520u, 0x02571e25u, 0x0e8802c8u, 0x0f130029u, 0x1aa606ecu, 0x1c6015fau, 0x0f990ef3u,
+    0x089406f0u, 0x02b30befu, 0x0f1b0d89u, 0x04a60145u, 0x10980c5bu, 0x06a2017fu, 0x167f1e12u, 0x0b0c19a0u,
+    0x19a500ceu, 0x04f6018eu, 0x0e710c36u, 0x00120f15u, 0x00001e03u, 0x0156194fu, 0x14b80330u, 0x1e570bc2u,
+    0x01050f3du, 0x1af905a8u, 0x09eb0862u, 0x0d5f05b1u, 0x048c03ebu, 0x0963061au, 0x19dc019du, 0x04691bebu,
+    0x07f20e07u, 0x0fcf0bbbu, 0x1cc007fdu, 0x1e800b64u, 0x04651b38u, 0x0b9d0a7du, 0x0b720005u, 0x0fd6063du,
+    0x06ae11bau, 0x013816b1u, 0x082c021bu, 0x03221beau, 0x16f906f8u, 0x025001a2u, 0x009f1a20u, 0x0acd100fu,
+    0x0cbf0ef2u, 0x0569036du, 0x070e102bu, 0x06210b4du, 0x18fa0d3eu, 0x04fd0b06u, 0x084507b6u, 0x0bea1a45u,
+    0x08be0573u, 0x0d0a1be9u, 0x192700a4u, 0x0ad60a34u, 0x05410f23u, 0x08c40c2du, 0x08bf026du, 0x007e09bbu,
+    0x012c1041u, 0x0a5911b9u, 0x18a202c8u, 0x0b540a76u, 0x07af0530u, 0x040309e1u, 0x11f90406u, 0x0b5f032fu,
+    0x0db00d5eu, 0x081b07deu, 0x0e291f5eu, 0x1ab202d6u, 0x0ab60b13u, 0x0b3107b4u, 0x069c11f8u, 0x09a3163eu,
+    0x056b026cu, 0x042608b5u, 0x01c30788u, 0x079414e1u, 0x085f054fu, 0x02fd1d41u, 0x169e0794u, 0x0d5d1680u,
+    0x074f1ffcu, 0x192e091au, 0x1b411e08u, 0x0b4f0a9au, 0x0e570b1eu, 0x0288001fu, 0x078e05a2u, 0x01b01c0du,
+    0x069313e1u, 0x0ad708feu, 0x0ed01dcfu, 0x060b0a56u, 0x03c807e4u, 0x1fbc0d62u, 0x038c1d8du, 0x033609fcu,
+    0x09ca086au, 0x0a260bacu, 0x0f7708e4u, 0x0774040fu, 0x0e340e69u, 0x0cfe0e3fu, 0x0e9f0fbfu, 0x0a4f0715u,
+    0x01160fcdu, 0x075f0642u, 0x0a3f090du, 0x0dac0382u, 0x03b40ce9u, 0x16410523u, 0x0355003eu, 0x02590d33u,
+    0x0c6516bdu, 0x088f05c3u, 0x068a0971u, 0x0f4b0dd7u, 0x07d9004fu, 0x086a1548u, 0x07341000u, 0x068c0274u,
+    0x00090000u, 0x001b0012u, 0x002d0024u, 0x003f0036u, 0x03a006e2u, 0x0c7a0985u, 0x13a310f2u, 0x0b491025u,
+    0x033800d3u, 0x1c7206e3u, 0x0c691176u, 0x1a11016bu, 0x0cc20b72u, 0x05710df1u, 0x15680f1au, 0x0cd108aau,
+    0x04630ce6u, 0x0c35050eu, 0x046004afu, 0x0fed061du, 0x1be00967u, 0x0d1d16c4u, 0x0f640e55u, 0x07e00417u,
+    0x14190c5au, 0x1d921554u, 0x1df90ea5u, 0x0eb00a5eu, 0x110309cau, 0x0e5a0df9u, 0x0e690a65u, 0x075801eeu,
+    0x0db30a05u, 0x0ee30f7bu, 0x04cf02d1u, 0x008a094du, 0x08a51872u, 0x0e300bd0u, 0x09450f24u, 0x0fb7016cu,
+    0x00960bcbu, 0x0ade00f8u, 0x10940bfcu, 0x075e1465u, 0x031a0539u, 0x00111b10u, 0x0b15187bu, 0x035200b4u,
+    0x0a2e1bdeu, 0x112e195bu, 0x095a13eau, 0x09ce085eu, 0x18060f1du, 0x07130d9du, 0x182d0b88u, 0x1c990a9du,
+    0x1ac702fdu, 0x01cc0bf4u, 0x04ea04d7u, 0x05870cd2u, 0x0afe0a48u, 0x0d421cb2u, 0x02d71310u, 0x0df21bf7u,
+    0x0c0e165eu, 0x040a0165u, 0x015401adu, 0x11a0021bu, 0x0daa0d0eu, 0x07780545u, 0x0a3c098eu, 0x1f620f4bu,
+    0x04da034du, 0x038f1e83u, 0x01ef0a87u, 0x014e0b47u, 0x19c6028du, 0x1264026bu, 0x075b0a7eu, 0x0480044cu,
+    0x0c4a1acbu, 0x0024022fu, 0x11820dc5u, 0x08241f8fu, 0x07c00859u, 0x03f50058u, 0x0d1a0430u, 0x099306a9u,
+    0x00d60f4du, 0x0eb308b5u, 0x10360779u, 0x0c6e0606u, 0x05e603b3u, 0x032a0b25u, 0x11c00ea9u, 0x1632033eu,
+    0x0d40078bu, 0x022710a8u, 0x03530a0fu, 0x07f206edu, 0x02c209e0u, 0x0f9a0cd0u, 0x0e1f1817u, 0x099f0fc7u,
+    0x00331fbeu, 0x05a814f9u, 0x08cb16f3u, 0x0b0004ccu, 0x07430d5du, 0x04330e7eu, 0x17e20c33u, 0x03ec1ddcu,
+    0x03ea1604u, 0x0eac0c76u, 0x00210000u, 0x0d0d19dcu, 0x0ae615fcu, 0x1b300887u, 0x0a060fdbu, 0x1d4a08dau,
+    0x0ef51ff9u, 0x0514076fu, 0x0258005fu, 0x0d641050u, 0x015b0045u, 0x08090032u, 0x0c250a8du, 0x07030422u,
+    0x0d180a87u, 0x00860588u, 0x0e5608c4u, 0x11110c54u, 0x15110b74u, 0x096d0068u, 0x089c0b25u, 0x064102dau,
+    0x15cd048au, 0x00f308f1u, 0x0ddb1fb3u, 0x0d8e06aau, 0x07360644u, 0x02910f00u, 0x076e16bfu, 0x00420000u,
+    0x0f821945u, 0x1e1202c5u, 0x08170125u, 0x07d50672u, 0x03131806u, 0x1b5904beu, 0x0c5a03dau, 0x104908f8u,
+    0x0f6e1de5u, 0x1c2016a6u, 0x01ec02b7u, 0x0bbc11f9u, 0x1df102d1u, 0x0e880345u, 0x06190350u, 0x1935015eu,
+    0x0185006bu, 0x03640955u, 0x165711ceu, 0x0a3102fbu, 0x08d802fbu, 0x0c760ac8u, 0x07ed0103u, 0x02040b8eu,
+    0x0ff50cdcu, 0x1e6707c3u, 0x0d351edfu, 0x1ea41e21u, 0x00450603u, 0x055c0b12u, 0x0fab1f82u, 0x08430a7eu,
+    0x005419ddu, 0x076416beu, 0x08c3014au, 0x0b9d19a3u, 0x09a112b2u, 0x1b6906d8u, 0x0262011cu, 0x014715f9u,
+    0x076d15e0u, 0x0aae0380u, 0x086d022eu, 0x1fe3003eu, 0x01071660u, 0x135d0e1du, 0x070a16c5u, 0x0c7c0ad7u,
+    0x1f540663u, 0x061612b5u, 0x1ce40423u, 0x06561183u, 0x03b904ccu, 0x04470860u, 0x0c0e0a18u, 0x1a4f0997u,
+    0x00670b7du, 0x0e9f113du, 0x0a601481u, 0x05560d5bu, 0x08cb0a58u, 0x1e190c37u, 0x164301fbu, 0x03370418u,
+    0x04c20a9cu, 0x023918a4u, 0x079b0010u, 0x069f00a9u, 0x00a40146u, 0x141c0687u, 0x13d91a7eu, 0x10b81811u,
+    0x0b62170au, 0x1bc10fbbu, 0x017d00a1u, 0x04a707dcu, 0x019c08d3u, 0x03dd1ea4u, 0x0c190f3au, 0x071b028eu,
+    0x09990925u, 0x01570979u, 0x0529006fu, 0x03e118f1u, 0x1b7e01d2u, 0x14d609cbu, 0x11280c7eu, 0x01b90190u,
+    0x006b09b0u, 0x0f0c0566u, 0x043a0d40u, 0x055c05e4u, 0x0f510979u, 0x17a50103u, 0x0f3c0688u, 0x126c1269u,
+    0x05251cbfu, 0x000704d9u, 0x19910048u, 0x0fe21090u, 0x1ecb17b3u, 0x0f2e0c18u, 0x05460a35u, 0x07560314u,
+    0x0d68054du, 0x13291e85u, 0x0d751c10u, 0x1d4815b4u, 0x041d08f3u, 0x0f8107b4u, 0x0b520641u, 0x02f20cefu,
+    0x09e70742u, 0x19e004d9u, 0x0e2d0c5du, 0x00201b11u, 0x108e0118u, 0x03cf03ccu, 0x003b0b77u, 0x012a08d5u,
+    0x0aca09a4u, 0x0ed80807u, 0x18171265u, 0x057f097fu, 0x043d01cau, 0x005d0c51u, 0x1efd079au, 0x0c03012fu,
+    0x184e1258u, 0x00310000u, 0x1f960f23u, 0x11f00ff4u, 0x140f038du, 0x0a421607u, 0x01620388u, 0x0eee0d9bu,
+    0x0cd80a39u, 0x0aea0d38u, 0x05b90ba7u, 0x0d250730u, 0x07830276u, 0x0c2915f9u, 0x0ba20be3u, 0x0aa60303u,
+    0x0e861e0cu, 0x1fbb07aeu, 0x04bf0d1cu, 0x11b4005au, 0x10b11792u, 0x1d870202u, 0x023b0bfdu, 0x15b81f61u,
+    0x0b3008bcu, 0x0cf01148u, 0x10800ec6u, 0x0fd8018bu, 0x00e314c5u, 0x005805d4u, 0x08961309u, 0x15a400cbu,
+    0x1b481956u, 0x04770015u, 0x0d021957u, 0x16a713feu, 0x008b0876u, 0x1d5318c1u, 0x09a70279u, 0x08d703cau,
+    0x05310a00u, 0x0dba1a6bu, 0x03970e3eu, 0x00301562u, 0x1cc214d6u, 0x168c0949u, 0x1a0206b1u, 0x0def0f0cu,
+    0x02460055u, 0x03ca05c4u, 0x0b591ac3u, 0x188f128eu, 0x01980a22u, 0x156502a8u, 0x07cd100cu, 0x1a7004b2u,
+    0x0151007eu, 0x1863023du, 0x0ac10a73u, 0x05df1469u, 0x146f0666u, 0x0f27043bu, 0x17161f46u, 0x0a7314a8u,
+    0x05d90c56u, 0x0bb215d3u, 0x03ba0edeu, 0x08c716d7u, 0x14450138u, 0x02d01b31u, 0x0eea0cc4u, 0x016d0326u,
+    0x058404c4u, 0x03c5066du, 0x066105deu, 0x05ef014cu, 0x056d05a8u, 0x17c0165cu, 0x02b109a3u, 0x0382092cu,
+    0x13e707dcu, 0x0c8a143du, 0x05550d36u, 0x13b916adu, 0x0e9f0f47u, 0x0f3f137cu, 0x0c1010d1u, 0x04c80072u,
+    0x006403e8u, 0x06a20a4au, 0x0a3e004au, 0x03720f4eu, 0x0eae0d91u, 0x05980076u, 0x1bf10a5au, 0x15191332u,
+    0x1b980322u, 0x0bdc1ad4u, 0x121a1ef7u, 0x048f03feu, 0x17000b34u, 0x18fc0c20u, 0x04e61979u, 0x12241579u,
+    0x074a14d7u, 0x05860361u, 0x000e0be1u, 0x0030001fu, 0x00520041u, 0x00f61e9bu, 0x00130615u, 0x0c7e0964u,
+    0x045f00cdu, 0x14061a21u, 0x023d085bu, 0x093d06fbu, 0x046d0deau, 0x0a6407d6u, 0x194d1640u, 0x00a6085bu,
+    0x013009bcu, 0x058116a0u, 0x09541decu, 0x03c01dd0u, 0x0d240864u, 0x05950108u, 0x16761db9u, 0x0ef606a8u,
+    0x15fe05ebu, 0x0f7715e9u, 0x174d1f96u, 0x1e3504a6u, 0x0165004bu, 0x02130278u, 0x09a90a61u, 0x177d063cu,
+    0x09070105u, 0x05ca1855u, 0x1a051152u, 0x07851330u, 0x1df209a7u, 0x00001f55u, 0x07440007u, 0x1a5d1cbfu,
+    0x0cbc0885u, 0x089f00d2u, 0x02e91d3au, 0x0bf9092bu, 0x11551958u, 0x19b503cau, 0x06b40a1au, 0x18110ed0u,
+    0x05bf07a6u, 0x03cf07fdu, 0x1d4008f3u, 0x0bf312c8u, 0x000a070au, 0x0e1a0abeu, 0x1e5e1dc8u, 0x128006c2u,
+    0x0d861299u, 0x0ba303c8u, 0x07761fceu, 0x0b7409f7u, 0x09bd1efcu, 0x05ad184fu, 0x0aba1b89u, 0x00790713u,
+    0x0a631655u, 0x09640f98u, 0x132f196du, 0x043e0351u, 0x13c707c7u, 0x08630605u, 0x0ee30212u, 0x0e6e0397u,
+    0x0f0a1ebcu, 0x0fc41ec8u, 0x0c651a13u, 0x0ada1d6cu, 0x09571288u, 0x062a0916u, 0x087e14b4u, 0x0bd70e45u,
+    0x172611e8u, 0x0e6815b9u, 0x12850c43u, 0x17db14a3u, 0x0f9b1a71u, 0x07021de6u, 0x08f01334u, 0x1dba1ccbu,
+    0x07bd01d0u, 0x16440166u, 0x017a1ad3u, 0x1d210b61u, 0x160c1080u, 0x070c0405u, 0x0537192bu, 0x08d412acu,
+    0x0b1d0786u, 0x0a560117u, 0x04a20130u, 0x04ca0b7bu, 0x082709bfu, 0x0da50a93u, 0x19590007u, 0x16ba068bu,
+    0x1ed401c3u, 0x00b50f57u, 0x165c0a4fu, 0x0a680e76u, 0x010c1db6u, 0x0a7c07e9u, 0x12e818f3u, 0x1f991014u,
+    0x155c02f6u, 0x0e7600f4u, 0x0747008eu, 0x1a6413d0u, 0x0d0303b6u, 0x12d105e2u, 0x04bc03e6u, 0x01741353u,
+    0x12c1062du, 0x1a8c0f24u, 0x046606d9u, 0x11c106d6u, 0x18850fa7u, 0x0cce097au, 0x1f9b1509u, 0x000001eeu,
+    0x003e001fu, 0x1b2c08b8u, 0x152b0237u, 0x1deb04ebu, 0x14001b2fu, 0x11280499u, 0x006b1be7u, 0x160015e1u,
+    0x00f41df0u, 0x08181371u, 0x01530a86u, 0x0da20b03u, 0x0a820433u, 0x049c0ab5u, 0x0816059fu, 0x0d640e1fu,
+    0x0cd00303u, 0x1f9b1d50u, 0x0f040c3cu, 0x19e017dbu, 0x0fb20b51u, 0x18fa0384u, 0x0d4f08e4u, 0x0a890da6u,
+    0x07e7120fu, 0x1de00cf4u, 0x04e01320u, 0x0826070au, 0x1a740ff8u, 0x012a1619u, 0x1a2d0481u, 0x00741488u,
+    0x069d0388u, 0x11f00f3cu, 0x03ff1615u, 0x1720071eu, 0x00001486u,
+};
+
+template<std::size_t Size>
+std::uint32_t DefineTable(SpirvEmitterState& state, const std::array<std::uint32_t, Size>& values) {
+    std::array<std::uint32_t, Size> words{};
+    for (std::size_t index = 0; index < Size; ++index) words[index] = ConstantU32(state, values[index]);
+    const auto arrayType = state.module.Type(spv::OpTypeArray, TypeU32(state), ConstantU32(state, static_cast<std::uint32_t>(Size)));
+    const auto table = state.module.Constant(spv::OpConstantComposite, arrayType, std::span<const std::uint32_t>(words));
+    return state.module.DefineInitializedGlobalVariable(TypePointer(state, spv::StorageClassPrivate, arrayType), spv::StorageClassPrivate, table);
+}
+
+std::uint32_t LoadTable(SpirvEmitterState& state, std::uint32_t table, std::uint32_t index) {
+    const auto pointer = state.module.AllocateId();
+    state.module.AddFunction(spv::OpAccessChain, TypePointer(state, spv::StorageClassPrivate, TypeU32(state)), pointer, table, index);
+    const auto value = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, TypeU32(state), value, pointer);
+    return value;
+}
+
+std::array<std::uint32_t, 2> MultiplyExtended(SpirvEmitterState& state, std::uint32_t lhs, std::uint32_t rhs) {
+    const auto product = state.module.AllocateId();
+    state.module.AddFunction(spv::OpUMulExtended, TypeU32Pair(state), product, lhs, rhs);
+    std::array<std::uint32_t, 2> words{state.module.AllocateId(), state.module.AllocateId()};
+    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), words[0], product, 0u);
+    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), words[1], product, 1u);
+    return words;
+}
+
+std::uint32_t ReciprocalCorrection(SpirvEmitterState& state, std::uint32_t mantissa) {
+    const auto u32 = TypeU32(state);
+    const auto boolean = TypeBool(state);
+    const auto op = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t value) { return Binary(state, opcode, u32, lhs, ConstantU32(state, value)); };
+    const auto starts = DefineTable(state, ReciprocalCorrectionStarts);
+    const auto corrections = DefineTable(state, ReciprocalCorrections);
+    const auto halfword = [&](std::uint32_t table, std::uint32_t index, std::uint32_t last) {
+        const auto clamped = Select(state, u32, Binary(state, spv::OpULessThan, boolean, index, ConstantU32(state, last)), index, ConstantU32(state, last));
+        const auto word = LoadTable(state, table, op(spv::OpShiftRightLogical, clamped, 1u));
+        return op(spv::OpBitwiseAnd, Binary(state, spv::OpShiftRightLogical, u32, word, op(spv::OpShiftLeftLogical, op(spv::OpBitwiseAnd, clamped, 1u), 4u)), 0xffffu);
+    };
+    const auto lastStart = static_cast<std::uint32_t>(ReciprocalCorrectionStarts.size() * 2u - 1u);
+    const auto lastCorrection = static_cast<std::uint32_t>(ReciprocalCorrections.size() * 2u - 1u);
+    const auto bucket = op(spv::OpShiftRightLogical, mantissa, 12u);
+    const auto key = op(spv::OpBitwiseAnd, mantissa, 0xfffu);
+    const auto end = halfword(starts, op(spv::OpIAdd, bucket, 1u), lastStart);
+    auto first = halfword(starts, bucket, lastStart);
+    auto remaining = Binary(state, spv::OpISub, u32, end, first);
+    for (const std::uint32_t step : {8u, 4u, 2u, 1u}) {
+        const auto probe = op(spv::OpBitwiseAnd, halfword(corrections, op(spv::OpIAdd, first, step - 1u), lastCorrection), 0xfffu);
+        const auto inside = Binary(state, spv::OpULessThanEqual, boolean, ConstantU32(state, step), remaining);
+        const auto skip = Binary(state, spv::OpLogicalAnd, boolean, inside, Binary(state, spv::OpULessThan, boolean, probe, key));
+        first = Select(state, u32, skip, op(spv::OpIAdd, first, step), first);
+        remaining = Select(state, u32, skip, op(spv::OpISub, remaining, step), remaining);
+    }
+    const auto entry = halfword(corrections, first, lastCorrection);
+    const auto hit = Binary(state, spv::OpLogicalAnd, boolean, Binary(state, spv::OpULessThan, boolean, first, end), Binary(state, spv::OpIEqual, boolean, op(spv::OpBitwiseAnd, entry, 0xfffu), key));
+    const auto delta = Select(state, u32, Binary(state, spv::OpINotEqual, boolean, op(spv::OpBitwiseAnd, entry, 0x1000u), ConstantU32(state, 0u)), ConstantU32(state, 1u), ConstantU32(state, 0xffffffffu));
+    return Select(state, u32, hit, delta, ConstantU32(state, 0u));
+}
+
+bool ExactReciprocal() {
+    static const bool exact = std::getenv("APS5_EXACT_RCP") != nullptr;
+    return exact;
+}
+
+std::uint32_t DeviceReciprocal(SpirvEmitterState& state, std::uint32_t value) {
+    return Binary(state, spv::OpFDiv, TypeF32(state), ConstantF32(state, 0x3f800000u), value);
+}
+
+std::uint32_t HardwareReciprocal(SpirvEmitterState& state, std::uint32_t value) {
+    const auto u32 = TypeU32(state);
+    const auto f32 = TypeF32(state);
+    const auto boolean = TypeBool(state);
+    const auto op = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t constant) { return Binary(state, opcode, u32, lhs, ConstantU32(state, constant)); };
+    const auto add = [&](std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, spv::OpIAdd, u32, lhs, rhs); };
+    const auto sub = [&](std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, spv::OpISub, u32, lhs, rhs); };
+    const auto test = [&](spv::Op opcode, std::uint32_t lhs, std::uint32_t rhs) { return Binary(state, opcode, boolean, lhs, rhs); };
+    const auto pick = [&](std::uint32_t condition, std::uint32_t whenTrue, std::uint32_t whenFalse) { return Select(state, u32, condition, ConstantU32(state, whenTrue), ConstantU32(state, whenFalse)); };
+    if (state.reciprocalTables[0] == 0u) {
+        state.reciprocalTables = {DefineTable(state, ReciprocalConstant), DefineTable(state, ReciprocalLinear), DefineTable(state, ReciprocalHigherOrder)};
+    }
+    const auto bits = Unary(state, spv::OpBitcast, u32, value);
+    const auto exponent = op(spv::OpBitwiseAnd, op(spv::OpShiftRightLogical, bits, 23u), 0xffu);
+    const auto mantissa = op(spv::OpBitwiseAnd, bits, 0x7fffffu);
+    const auto segment = op(spv::OpShiftRightLogical, mantissa, 18u);
+    const auto fraction = op(spv::OpBitwiseAnd, mantissa, 0x3ffffu);
+    const auto constant = LoadTable(state, state.reciprocalTables[0], segment);
+    const auto linearFactor = LoadTable(state, state.reciprocalTables[1], segment);
+    const auto higherOrder = LoadTable(state, state.reciprocalTables[2], segment);
+
+    const auto linearProduct = MultiplyExtended(state, linearFactor, fraction);
+    const auto wide = test(spv::OpUGreaterThanEqual, linearProduct[1], ConstantU32(state, 64u));
+    const auto shift = pick(wide, 15u, 14u);
+    const auto quotient = Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpShiftLeftLogical, u32, linearProduct[1], sub(ConstantU32(state, 32u), shift)), Binary(state, spv::OpShiftRightLogical, u32, linearProduct[0], shift));
+    const auto midpoint = pick(wide, 0x4000u, 0x2000u);
+    const auto remainder = Binary(state, spv::OpBitwiseAnd, u32, linearProduct[0], pick(wide, 0x7fffu, 0x3fffu));
+    const auto odd = test(spv::OpINotEqual, op(spv::OpBitwiseAnd, quotient, 1u), ConstantU32(state, 0u));
+    const auto roundUp = Binary(state, spv::OpLogicalOr, boolean, test(spv::OpUGreaterThan, remainder, midpoint), Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpIEqual, remainder, midpoint), odd));
+    const auto rounded = add(quotient, pick(roundUp, 1u, 0u));
+    const auto linear = Binary(state, spv::OpShiftLeftLogical, u32, rounded, pick(wide, 1u, 0u));
+
+    const auto half = op(spv::OpShiftRightLogical, fraction, 1u);
+    const auto quadraticProduct = MultiplyExtended(state, op(spv::OpBitwiseAnd, higherOrder, 0xffffu), half);
+    const auto shiftedHigh = Binary(state, spv::OpBitwiseOr, u32, op(spv::OpShiftLeftLogical, quadraticProduct[1], 18u), op(spv::OpShiftRightLogical, quadraticProduct[0], 14u));
+    const auto shiftedLow = op(spv::OpShiftLeftLogical, quadraticProduct[0], 18u);
+    const auto cubicProduct = MultiplyExtended(state, Binary(state, spv::OpIMul, u32, op(spv::OpShiftRightLogical, higherOrder, 16u), fraction), half);
+    const auto innerLow = sub(shiftedLow, cubicProduct[0]);
+    const auto innerHigh = sub(sub(shiftedHigh, cubicProduct[1]), pick(test(spv::OpULessThan, shiftedLow, cubicProduct[0]), 1u, 0u));
+    const auto upper = MultiplyExtended(state, innerHigh, half);
+    const auto lower = MultiplyExtended(state, innerLow, half);
+    const auto upperPart = Binary(state, spv::OpBitwiseOr, u32, op(spv::OpShiftLeftLogical, upper[1], 15u), op(spv::OpShiftRightLogical, upper[0], 17u));
+    const auto carryPart = op(spv::OpShiftRightLogical, add(op(spv::OpBitwiseAnd, upper[0], 0x1ffffu), lower[1]), 17u);
+    const auto quadratic = add(upperPart, carryPart);
+
+    const auto sum = add(sub(op(spv::OpShiftLeftLogical, constant, 4u), linear), op(spv::OpIAdd, op(spv::OpShiftLeftLogical, quadratic, 1u), 32u));
+    const auto dropped = op(spv::OpBitwiseAnd, sum, 63u);
+    const auto nearCut = Binary(state, spv::OpLogicalOr, boolean, test(spv::OpULessThan, dropped, ConstantU32(state, 2u)), test(spv::OpUGreaterThanEqual, dropped, ConstantU32(state, 62u)));
+    const auto correction = EmitValueOrZeroIfCondition(state, nearCut, [&] {
+        const auto result = state.module.AllocateId();
+        state.module.AddFunction(spv::OpFunctionCall, u32, result, state.reciprocalCorrectionFunction, mantissa);
+        return result;
+    });
+    const auto normalized = add(op(spv::OpIAdd, op(spv::OpShiftRightLogical, sum, 6u), 0x3e800000u), correction);
+    const auto resultExponent = sub(op(spv::OpIAdd, op(spv::OpShiftRightLogical, normalized, 23u), 127u), exponent);
+    const auto exactBits = Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpBitwiseOr, u32, op(spv::OpBitwiseAnd, bits, 0x80000000u), op(spv::OpShiftLeftLogical, resultExponent, 23u)), op(spv::OpBitwiseAnd, normalized, 0x7fffffu));
+    const auto normalInput = Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpINotEqual, exponent, ConstantU32(state, 0u)), test(spv::OpINotEqual, exponent, ConstantU32(state, 0xffu)));
+    const auto normalResult = Binary(state, spv::OpLogicalAnd, boolean, test(spv::OpSGreaterThan, resultExponent, ConstantU32(state, 0u)), test(spv::OpSLessThan, resultExponent, ConstantU32(state, 0xffu)));
+    const auto approximate = DeviceReciprocal(state, value);
+    return Select(state, f32, Binary(state, spv::OpLogicalAnd, boolean, normalInput, normalResult), Unary(state, spv::OpBitcast, f32, exactBits), approximate);
+}
+
+}
+
+void DefineReciprocalCorrectionFunction(SpirvEmitterState& state) {
+    bool used = false;
+    for (const IrBlock* block : state.program.BlockOrder()) {
+        for (const IrValue* inst : block->Instructions()) used = used || inst->Opcode() == IrOpcode::FPRecip32 || inst->Opcode() == IrOpcode::FPRecipIFlag32;
+    }
+    if (!used || !ExactReciprocal()) return;
+    const auto u32 = TypeU32(state);
+    state.reciprocalCorrectionFunction = state.module.AllocateId();
+    state.module.AddName(state.reciprocalCorrectionFunction, "rcp_f32_correction");
+    state.module.AddFunction(spv::OpFunction, u32, state.reciprocalCorrectionFunction, spv::FunctionControlDontInlineMask, state.module.Type(spv::OpTypeFunction, u32, u32));
+    const auto mantissa = state.module.AllocateId();
+    state.module.AddFunction(spv::OpFunctionParameter, u32, mantissa);
+    EmitLabel(state, state.module.AllocateId());
+    state.module.AddFunction(spv::OpReturnValue, ReciprocalCorrection(state, mantissa));
+    state.module.AddFunction(spv::OpFunctionEnd);
+}
+
+std::uint32_t EmitFPRecip32(SpirvEmitterState& state, std::uint32_t arg0) {
+    if (!ExactReciprocal()) return DeviceReciprocal(state, arg0);
+    if (state.reciprocalCorrectionFunction == 0u) FailEmit("v_rcp_f32 correction function was not defined before function emission");
+    return HardwareReciprocal(state, arg0);
+}
+
+std::uint32_t EmitFPRecipIFlag32(SpirvEmitterState& state, std::uint32_t arg0) {
+    if (!ExactReciprocal()) return DeviceReciprocal(state, arg0);
+    if (state.reciprocalCorrectionFunction == 0u) FailEmit("v_rcp_iflag_f32 correction function was not defined before function emission");
+    return HardwareReciprocal(state, arg0);
+}
+
+}
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvBufferFormat.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvBufferFormat.cpp
index 76ecba7a65..cc3168fec5 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvBufferFormat.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvBufferFormat.cpp
@@ -55,6 +55,9 @@ SpirvFormatComponentType GetFormatComponentType(IrBufferFormat format) {
         case IrBufferFormat::Format10_10_10_2UNorm:
         case IrBufferFormat::Format8_8_8_8UNorm:
         case IrBufferFormat::Format16_16_16_16UNorm:
+        case IrBufferFormat::Format5_6_5UNorm:
+        case IrBufferFormat::Format5_5_5_1UNorm:
+        case IrBufferFormat::Format4_4_4_4UNorm:
             return SpirvFormatComponentType::Unorm;
         case IrBufferFormat::Format8SNorm:
         case IrBufferFormat::Format16SNorm:
@@ -110,6 +113,12 @@ SpirvBufferFormatInfo GetFormatInfo(IrBufferFormat format) {
     }
     const auto type = GetFormatComponentType(format);
     switch (format) {
+        case IrBufferFormat::Format5_6_5UNorm:
+            return {format, type, 3u, 2u, {5u, 6u, 5u, 0u}, {0u, 5u, 11u, 0u}, true};
+        case IrBufferFormat::Format5_5_5_1UNorm:
+            return {format, type, 4u, 2u, {5u, 5u, 5u, 1u}, {0u, 5u, 10u, 15u}, true};
+        case IrBufferFormat::Format4_4_4_4UNorm:
+            return {format, type, 4u, 2u, {4u, 4u, 4u, 4u}, {0u, 4u, 8u, 12u}, true};
         case IrBufferFormat::Format8UNorm:
         case IrBufferFormat::Format8SNorm:
         case IrBufferFormat::Format8UScaled:
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp
index 17d2db36bf..96ddd6f796 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvEmitter.cpp
@@ -279,7 +279,14 @@ std::vector<std::uint32_t> SpirvEmitter::Emit(const IrProgram& program, const Sh
     state.float32FlushToZero = target.float32FlushToZero;
     state.waveLdsMemoryBarriers = target.waveLdsMemoryBarriers;
     state.float32DenormPreserve = target.float32DenormPreserve;
+    state.fusedExactArithmetic = target.fusedExactArithmetic;
+    state.deviceScopeLdsMemoryBarriers = target.deviceScopeLdsMemoryBarriers;
     state.hostSubgroupSize = target.subgroupSize;
+    if (target.largePixelFunctionLdsBuffer && program.Resources().stage == IrShaderStage::Pixel && state.requirements.functionLds && state.requirements.functionLdsDwords > target.pixelFunctionStorageDwords) {
+        state.pixelFunctionLdsBuffer = true;
+        state.requirements.subgroupLocalInvocationId = true;
+        state.requirements.subgroupBallot = true;
+    }
     if (state.requirements.ldsLock && LdsInDeviceMemory(state) && std::find(target.supportedCapabilities.begin(), target.supportedCapabilities.end(), static_cast<std::uint32_t>(spv::CapabilityInt64Atomics)) != target.supportedCapabilities.end()) {
         state.requirements.ldsLock = false;
         state.requirements.ldsBufferInt64Atomics = true;
@@ -318,7 +325,10 @@ std::vector<std::uint32_t> SpirvEmitter::Emit(const IrProgram& program, const Sh
     EmitModuleHeader(state, bindings);
     EmitProgram(state);
     state.module.EmitEntryPoint(ExecutionModelForStage(state.program.Resources().stage), state.mainFunc, "main", state.interfaceVariables);
-    if (info != nullptr) info->fullSubgroups = state.spannedWave;
+    if (info != nullptr) {
+        info->fullSubgroups = state.spannedWave;
+        info->functionLdsBuffer = state.pixelFunctionLdsBuffer;
+    }
     return state.module.Finalize();
 }
 
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp
index 4cd661b16a..60c9ac8779 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp
@@ -90,6 +90,7 @@ void EmitReturnTerminator(SpirvValueEmitContext& ctx) {
             RecordBdaFaultWords(state, ConstantU32(state, static_cast<std::uint32_t>(hash)), ConstantU32(state, static_cast<std::uint32_t>(hash >> 32u)), ConstantU32(state, state.loopGuardLimit), EmitBinaryU32(state, spv::OpISub, pc, ConstantU32(state, 1u)), BdaAbi::FaultReason::LoopLimit);
         });
     }
+    FlushColorTargetMerge(state);
     if (OrderedPixelShader(state)) {
         state.module.AddFunction(spv::OpEndInvocationInterlockEXT);
     }
@@ -308,6 +309,7 @@ void EmitDirectInstruction(SpirvValueEmitContext& ctx, const IrValue& inst) {
         case IrOpcode::Reference: return Invoke(EmitReference, ctx, inst);
         case IrOpcode::ReferenceU32: return Invoke(EmitReferenceU32, ctx, inst);
         case IrOpcode::UnlinkedCall: return Invoke(EmitUnlinkedCall, ctx, inst);
+        case IrOpcode::WindowLaneGuard: return Invoke(EmitWindowLaneGuard, ctx, inst);
         case IrOpcode::GetUserData: return Invoke(EmitGetUserData, ctx, inst);
         case IrOpcode::GetShaderBase: return Invoke(EmitGetShaderBase, ctx, inst);
         case IrOpcode::ShaderClock: return Invoke(EmitShaderClock, ctx, inst);
@@ -865,6 +867,7 @@ void EmitControlFlow(SpirvValueEmitContext& context, StructuredFunctionState& fu
         if (block == nullptr) {
             context.Fail("structured control flow contains a null block");
         }
+        state.bufferLengths.clear();
         const BlockInfo* info = BlockInfoFor(program, block);
         if (info == nullptr) {
             context.Fail("structured control flow block has no terminator metadata");
@@ -920,6 +923,15 @@ void EmitUnlinkedCall(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint
     StopBdaInvocationIf(state, ConstantBool(state, true));
 }
 
+void EmitWindowLaneGuard(SpirvValueEmitContext& ctx, const IrValue& inst, std::uint32_t index, std::uint32_t value, std::uint32_t current, std::uint32_t slot, std::uint32_t lane) {
+    auto& state = ctx.state;
+    if (state.faultBufferVariable == 0) ctx.Fail(inst, "checks a spilled lane without a fault buffer");
+    const auto boolean = TypeBool(state);
+    const auto ownLane = Binary(state, spv::OpIEqual, boolean, EmitSubgroupLocalInvocationId(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), lane, ConstantU32(state, state.program.WaveSize() - 1u)));
+    const auto overwritten = Binary(state, spv::OpLogicalAnd, boolean, Binary(state, spv::OpIEqual, boolean, index, slot), Binary(state, spv::OpINotEqual, boolean, value, current));
+    EmitIfCondition(state, Binary(state, spv::OpLogicalAnd, boolean, ownLane, overwritten), [&] { RecordBdaFaultWords(state, slot, lane, value, ConstantU32(state, 0u), BdaAbi::FaultReason::WindowLaneSpill); });
+}
+
 void EmitControlNop(SpirvValueEmitContext& context) {
     EmitVoid(context);
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
index 772f4f8f4c..601bed36a2 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
@@ -246,6 +246,10 @@ bool VolumeSliceAddress(const ImageEmitAccess& access) {
     return access.mem.imageDimension == RdnaImageDimension::Dim2DArray && access.image.dimension == RdnaImageDimension::Dim3D;
 }
 
+bool ArraySliceAddress(const ImageEmitAccess& access) {
+    return access.mem.imageDimension == RdnaImageDimension::Dim3D && access.image.dimension == RdnaImageDimension::Dim2DArray;
+}
+
 std::uint32_t VolumeSliceInRange(SpirvValueEmitContext& ctx, const ImageEmitAccess& access, std::uint32_t image, std::optional<std::uint32_t> lod) {
     auto& state = ctx.state;
     state.module.EmitCapability(spv::CapabilityImageQuery);
@@ -449,6 +453,10 @@ std::uint32_t QueryDimensions(SpirvValueEmitContext& ctx, const ImageEmitAccess&
     if (access.mem.imageDimension == RdnaImageDimension::Dim3D && dimension == RdnaImageDimension::Dim2D) {
         result[2] = ConstantU32(state, 1);
     }
+    const auto requested = access.mem.imageDimension;
+    if ((requested == RdnaImageDimension::Dim1D || requested == RdnaImageDimension::Dim2D || requested == RdnaImageDimension::Dim2DMsaa) && dimension != RdnaImageDimension::Dim3D) {
+        result[2] = ConstantU32(state, 0);
+    }
     if (info.multisampled == 0u) {
         result[3] = state.module.AllocateId();
         state.module.AddFunction(spv::OpImageQueryLevels, TypeU32(state), result[3], image);
@@ -489,7 +497,21 @@ std::uint32_t FoldedOffsetCoord(SpirvValueEmitContext& ctx, const ImageEmitAcces
     auto& state = ctx.state;
     const auto components = setup.dimensionInfo.spatialComponents;
     const auto type = components == 1u ? TypeF32(state) : TypeF32Vector(state, components);
-    const auto sum = Binary(state, spv::OpFAdd, type, setup.coord, Unary(state, spv::OpConvertSToF, type, PackedOffset(ctx, access, setup.layout)));
+    const auto offset = Unary(state, spv::OpConvertSToF, type, PackedOffset(ctx, access, setup.layout));
+    if (state.fusedExactArithmetic) {
+        auto one = ConstantF32(state, 0x3f800000u);
+        if (components != 1u) {
+            const auto ones = state.module.AllocateId();
+            std::vector<std::uint32_t> words{spv::OpCompositeConstruct, type, ones};
+            words.insert(words.end(), components, one);
+            state.module.AddFunction(words);
+            one = ones;
+        }
+        const auto fused = state.module.AllocateId();
+        state.module.AddFunction(spv::OpExtInst, type, fused, GlslStd450(state), GLSLstd450Fma, one, setup.coord, offset);
+        return fused;
+    }
+    const auto sum = Binary(state, spv::OpFAdd, type, setup.coord, offset);
     state.module.AddAnnotation(spv::OpDecorate, sum, spv::DecorationNoContraction);
     return sum;
 }
@@ -521,29 +543,66 @@ SpirvBufferFormatInfo ImageConversionFormat(const ImageResource& image) {
         return {};
     }
     const auto info = GetFormatInfo(format);
-    if (SampledTextureNumericClass(format) != IrTextureNumericClass::Uint || RemapTextureFormat(format) == format || (info.type != SpirvFormatComponentType::Uint && info.type != SpirvFormatComponentType::Unorm && info.type != SpirvFormatComponentType::Float) || !info.packedBitfield || info.byteSize != sizeof(std::uint32_t) || info.componentCount == 0u || info.componentCount > 4u) {
-        throw std::runtime_error("image conversion format is not a packed 32-bit unsigned integer, unorm or float format");
+    const auto remapped = image.resourceClass == ImageResourceClass::Storage ? RemapStorageTextureFormat(format) : RemapTextureFormat(format);
+    if (SampledTextureNumericClass(remapped) != IrTextureNumericClass::Uint || remapped == format || (info.type != SpirvFormatComponentType::Uint && info.type != SpirvFormatComponentType::Unorm && info.type != SpirvFormatComponentType::Float) || !info.packedBitfield || (info.byteSize != 2u && info.byteSize != 4u) || info.componentCount == 0u || info.componentCount > 4u) {
+        throw std::runtime_error("image conversion format is not a packed 16-bit or 32-bit unsigned integer, unorm or float format");
     }
     return info;
 }
 
 void RequireConvertedUnormAccess(SpirvValueEmitContext& ctx, const ImageEmitAccess& access, const SpirvBufferFormatInfo& info) {
-    if (access.mem.dataBits == 16u) {
+    if (access.mem.dataBits == 16u && info.byteSize != 2u) {
         ctx.Fail(access.inst, info.type == SpirvFormatComponentType::Float ? "reads or writes a converted float image with 16-bit data, which is not implemented" : "reads or writes a converted unorm image with 16-bit data, which is not implemented");
     }
     for (std::uint32_t component = 0; component < 4u; component++) {
         const auto selector = (access.image.shaderSwizzle >> (component * 3u)) & 7u;
-        if (selector >= 4u && selector - 4u >= info.componentCount) {
+        if (selector >= 4u && selector - 4u >= info.componentCount && info.byteSize != 2u) {
             ctx.Fail(access.inst, "selects a channel the converted image format does not have");
         }
     }
 }
 
+std::uint32_t ExpandFmaskTexel(SpirvEmitterState& state, const ImageEmitAccess& access, std::uint32_t texel) {
+    const auto resource = access.mem.resource;
+    const auto u32 = TypeU32(state);
+    const auto format = state.registrationModules
+        ? Binary(state, spv::OpBitwiseAnd, u32, Binary(state, spv::OpShiftRightLogical, u32, RuntimeImageDword(state, resource, offsetof(RuntimeAbi::ResourceMetadata, descriptor) / sizeof(std::uint32_t) + 1u), ConstantU32(state, 20u)), ConstantU32(state, 0x1ffu))
+        : state.module.SpecializationConstant(u32, PipelineSpecialization::FmaskFormatBase + resource, 0u);
+    auto layout = ConstantU32(state, 0u);
+    for (auto value = static_cast<std::uint32_t>(IrBufferFormat::Fmask8_S2_F1); value <= static_cast<std::uint32_t>(IrBufferFormat::Fmask64_S16_F8); ++value) {
+        const auto fmask = FmaskLayoutOf(static_cast<IrBufferFormat>(value));
+        if (!fmask.has_value()) continue;
+        layout = Select(state, u32, Binary(state, spv::OpIEqual, TypeBool(state), format, ConstantU32(state, value)), ConstantU32(state, fmask->sampleBits | (fmask->samples << 8u) | (fmask->fragments << 16u)), layout);
+    }
+    const auto sampleBits = Binary(state, spv::OpBitwiseAnd, u32, layout, ConstantU32(state, 0xffu));
+    const auto samples = Binary(state, spv::OpBitwiseAnd, u32, Binary(state, spv::OpShiftRightLogical, u32, layout, ConstantU32(state, 8u)), ConstantU32(state, 0xffu));
+    const auto fragments = Binary(state, spv::OpShiftRightLogical, u32, layout, ConstantU32(state, 16u));
+    const auto packed = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeExtract, u32, packed, texel, 0u);
+    auto expanded = ConstantU32(state, 0u);
+    for (std::uint32_t sample = 0; sample < 8u; ++sample) {
+        const auto field = state.module.AllocateId();
+        state.module.AddFunction(spv::OpBitFieldUExtract, u32, field, packed, Binary(state, spv::OpIMul, u32, sampleBits, ConstantU32(state, sample)), sampleBits);
+        const auto fragment = Select(state, u32, Binary(state, spv::OpUGreaterThanEqual, TypeBool(state), field, fragments), ConstantU32(state, 8u), field);
+        const auto nibble = Select(state, u32, Binary(state, spv::OpULessThan, TypeBool(state), ConstantU32(state, sample), samples), fragment, ConstantU32(state, 0u));
+        expanded = Binary(state, spv::OpBitwiseOr, u32, expanded, Binary(state, spv::OpShiftLeftLogical, u32, nibble, ConstantU32(state, sample * 4u)));
+    }
+    const std::array<std::uint32_t, 4> components{expanded, ConstantU32(state, 0u), ConstantU32(state, 0u), ConstantU32(state, 0u)};
+    std::uint32_t selected[4] = {};
+    for (std::uint32_t component = 0; component < 4u; component++) selected[component] = RuntimeSwizzledComponent(state, RuntimeImageSwizzle(state, resource, component), components);
+    const auto result = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeConstruct, TypeU32Vector(state, 4), result, selected[0], selected[1], selected[2], selected[3]);
+    return result;
+}
+
 std::uint32_t UnpackImageTexel(SpirvValueEmitContext& ctx, const ImageEmitAccess& access, std::uint32_t texel) {
     auto& state = ctx.state;
     if (access.image.srgbDecode) {
         return DecodeSrgbTexel(state, texel);
     }
+    if (access.image.conversionFormat == FmaskExpansion) {
+        return ExpandFmaskTexel(state, access, texel);
+    }
     const auto info = ImageConversionFormat(access.image);
     if (info.format == IrBufferFormat::Invalid) {
         return texel;
@@ -722,7 +781,8 @@ std::uint32_t PackImageTexel(SpirvValueEmitContext& ctx, const ImageEmitAccess&
         state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), value, texel, component);
         auto clamped = value;
         if (unorm) {
-            clamped = EmitFormatStoreComponent(state, info, component, value);
+            if (access.mem.dataBits == 16u) clamped = Unary(state, spv::OpBitcast, TypeU32(state), EmitF16BitsToF32(state, value));
+            clamped = EmitFormatStoreComponent(state, info, component, clamped);
         } else {
             const auto maximum = ConstantU32(state, info.componentBits[component] == 32u ? UINT32_MAX : (1u << info.componentBits[component]) - 1u);
             const auto within = Binary(state, spv::OpULessThan, TypeBool(state), value, maximum);
@@ -1073,8 +1133,8 @@ void EmitWriteOp(SpirvValueEmitContext& ctx, const ImageEmitAccess& access) {
     auto& state = ctx.state;
     const bool uintImage = access.image.numericClass == IrTextureNumericClass::Uint;
     auto condition = ctx.Arg(access.inst, 3);
-    if (VolumeSliceAddress(access)) {
-        if (access.image.mipMode == ImageMipMode::DynamicStorage) ctx.Fail(access.inst, "stores a 2D-array address to a 3D image with dynamic mips, which is not implemented");
+    if (VolumeSliceAddress(access) || ArraySliceAddress(access)) {
+        if (access.image.mipMode == ImageMipMode::DynamicStorage) ctx.Fail(access.inst, "stores a 2D-array address to a 3D image or a 3D address to a 2D-array image with dynamic mips, which is not implemented");
         const auto image = state.module.AllocateId();
         state.module.AddFunction(spv::OpLoad, ImageType(state, access.image), image, StorageImageDescriptorPointer(state, access.mem.resource));
         condition = Binary(state, spv::OpLogicalAnd, TypeBool(state), condition, VolumeSliceInRange(ctx, access, image, std::nullopt));
@@ -1122,13 +1182,13 @@ void EmitAtomicOp(SpirvValueEmitContext& ctx, const ImageEmitAccess& access) {
         }
         if (opcode == IrOpcode::ImageAtomicFMin32 || opcode == IrOpcode::ImageAtomicFMax32) {
             return AtomicUpdate(state, pointer, ResourceKind::Image, [&](std::uint32_t current) {
-                return AtomicFloatMinMax(state, current, value, opcode == IrOpcode::ImageAtomicFMax32);
+                return AtomicFloatMinMax(state, current, value, opcode == IrOpcode::ImageAtomicFMax32, access.mem.flushDenormals);
             });
         }
         if (opcode == IrOpcode::ImageAtomicFCmpSwap32) {
             const auto comparator = ctx.Arg(access.inst, 3);
             return AtomicUpdate(state, pointer, ResourceKind::Image, [&](std::uint32_t current) {
-                return AtomicFloatCompareSwap(state, current, value, comparator);
+                return AtomicFloatCompareSwap(state, current, value, comparator, access.mem.flushDenormals);
             });
         }
         const auto old = state.module.AllocateId();
@@ -1195,8 +1255,16 @@ void EmitPackedHorizontalGatherOp(SpirvValueEmitContext& ctx, const ImageEmitAcc
             return value;
         };
         const auto texelFloor = [&](std::uint32_t address, std::uint32_t length, bool centre) {
-            auto scaled = Binary(state, spv::OpFMul, TypeF32(state), AddressF32(ctx, access, address), Unary(state, spv::OpConvertSToF, TypeF32(state), length));
-            state.module.AddAnnotation(spv::OpDecorate, scaled, spv::DecorationNoContraction);
+            const auto addressF32 = AddressF32(ctx, access, address);
+            const auto lengthF32 = Unary(state, spv::OpConvertSToF, TypeF32(state), length);
+            std::uint32_t scaled = 0;
+            if (state.fusedExactArithmetic) {
+                scaled = state.module.AllocateId();
+                state.module.AddFunction(spv::OpExtInst, TypeF32(state), scaled, GlslStd450(state), GLSLstd450Fma, addressF32, lengthF32, ConstantF32(state, 0x80000000u));
+            } else {
+                scaled = Binary(state, spv::OpFMul, TypeF32(state), addressF32, lengthF32);
+                state.module.AddAnnotation(spv::OpDecorate, scaled, spv::DecorationNoContraction);
+            }
             if (centre) {
                 scaled = Binary(state, spv::OpFSub, TypeF32(state), scaled, ConstantF32(state, 0x3f000000u));
             }
@@ -1977,7 +2045,7 @@ void EmitImage(SpirvValueEmitContext& ctx, const IrValue& inst) {
     state.tableAccess = {};
     if (tables) {
         EmitLabel(state, invalid);
-        if (returnsValue) incoming.insert(incoming.end(), {ConstantU32CompositeZero(state, 4u), invalid});
+        if (returnsValue) incoming.insert(incoming.end(), {ZeroResult(ctx, inst), invalid});
         state.module.AddFunction(spv::OpBranch, merge);
     } else if (exits) {
         EmitLabel(state, invalid);
@@ -1994,7 +2062,7 @@ void EmitImage(SpirvValueEmitContext& ctx, const IrValue& inst) {
         EmitLabel(state, guardSkip);
         state.module.AddFunction(spv::OpBranch, guardMerge);
         EmitLabel(state, guardMerge);
-        if (returnsValue) state.module.AddFunction(spv::OpPhi, TypeId(state, inst.Type()), guardedId, resultId, merge, ConstantU32CompositeZero(state, 4u), guardSkip);
+        if (returnsValue) state.module.AddFunction(spv::OpPhi, TypeId(state, inst.Type()), guardedId, resultId, merge, ZeroResult(ctx, inst), guardSkip);
     }
     if (returnsValue) ctx.definitions.emplace(&inst, guardedId);
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp
index 192b60cc27..e2f95214ee 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp
@@ -70,10 +70,55 @@ bool LdsInDeviceMemory(const SpirvEmitterState& state) {
 }
 
 std::uint32_t LdsMemorySemantics(const SpirvEmitterState& state) {
-    return spv::MemorySemanticsWorkgroupMemoryMask | (LdsInDeviceMemory(state) ? spv::MemorySemanticsUniformMemoryMask : 0u);
+    return spv::MemorySemanticsWorkgroupMemoryMask | (LdsInDeviceMemory(state) || state.pixelFunctionLdsBuffer ? spv::MemorySemanticsUniformMemoryMask : 0u);
+}
+
+void EmitPixelFunctionLdsBase(SpirvEmitterState& state) {
+    if (!state.pixelFunctionLdsBuffer) return;
+    if (state.ldsBufferVariable == 0u || state.hostSubgroupSize == 0u) FailEmit("pixel function LDS buffer was not declared");
+    const auto element = [&](std::uint32_t dword) {
+        const auto pointer = state.module.AllocateId();
+        state.module.AddFunction(spv::OpAccessChain, TypeStorageBufferElementPointer(state), pointer, state.ldsBufferVariable, ConstantU32(state, 0u), ConstantU32(state, dword));
+        return pointer;
+    };
+    const auto slotVar = state.module.AllocateId();
+    state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), slotVar, spv::StorageClassFunction, ConstantU32(state, 0u));
+    const auto elected = state.module.AllocateId();
+    state.module.AddFunction(spv::OpGroupNonUniformElect, TypeBool(state), elected, ConstantU32(state, spv::ScopeSubgroup));
+    EmitIfCondition(state, elected, [&] {
+        const auto acquired = state.module.AllocateId();
+        state.module.AddFunction(spv::OpAtomicIAdd, TypeU32(state), acquired, element(0u), ConstantU32(state, spv::ScopeDevice), ConstantU32(state, spv::MemorySemanticsAcquireReleaseMask | spv::MemorySemanticsUniformMemoryMask), ConstantU32(state, 1u));
+        const auto capacity = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), capacity, element(2u));
+        const auto exhausted = state.module.AllocateId();
+        state.module.AddFunction(spv::OpUGreaterThanEqual, TypeBool(state), exhausted, acquired, capacity);
+        EmitIfCondition(state, exhausted, [&] {
+            state.module.AddFunction(spv::OpAtomicStore, element(1u), ConstantU32(state, spv::ScopeDevice), ConstantU32(state, spv::MemorySemanticsReleaseMask | spv::MemorySemanticsUniformMemoryMask), ConstantU32(state, 1u));
+        });
+        const auto claimed = state.module.AllocateId();
+        state.module.AddFunction(spv::OpSelect, TypeU32(state), claimed, exhausted, ConstantU32(state, 0u), acquired);
+        state.module.AddFunction(spv::OpStore, slotVar, claimed);
+    });
+    const auto local = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, TypeU32(state), local, slotVar);
+    const auto slot = state.module.AllocateId();
+    state.module.AddFunction(spv::OpGroupNonUniformBroadcastFirst, TypeU32(state), slot, ConstantU32(state, spv::ScopeSubgroup), local);
+    std::uint32_t lane;
+    if (state.splitSubgroup) {
+        if (state.subgroupLocalInvocationIdVariable == 0) FailEmit("pixel function LDS lane was not declared");
+        lane = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), lane, state.subgroupLocalInvocationIdVariable);
+    } else lane = EmitSubgroupLocalInvocationId(state);
+    const auto within = EmitAddU32(state, EmitBinaryU32(state, spv::OpIMul, slot, ConstantU32(state, state.hostSubgroupSize)), lane);
+    state.ldsBufferBase = EmitAddU32(state, EmitBinaryU32(state, spv::OpIMul, within, ConstantU32(state, FunctionLdsDwordLimit)), ConstantU32(state, 3u));
+}
+
+std::uint32_t LdsMemoryBarrierScope(const SpirvEmitterState& state) {
+    return state.deviceScopeLdsMemoryBarriers ? spv::ScopeDevice : spv::ScopeWorkgroup;
 }
 
 void EmitLdsBufferBase(SpirvEmitterState& state) {
+    EmitPixelFunctionLdsBase(state);
     if (!LdsInDeviceMemory(state)) {
         return;
     }
@@ -125,6 +170,12 @@ MemoryResourceAccess PrepareMemoryResourceAccess(SpirvEmitterState& state, const
     access.kind = mem.kind;
     switch (mem.kind) {
     case ResourceKind::Lds:
+        if (state.pixelFunctionLdsBuffer) {
+            if (state.ldsBufferVariable == 0u || state.ldsBufferBase == 0u) FailEmit("pixel function LDS buffer was not prepared at function entry");
+            access.objectPointer = state.ldsBufferVariable;
+            access.length = ConstantU32(state, LdsDwordCount(state));
+            return access;
+        }
         if (LdsInDeviceMemory(state)) {
             if (state.ldsBufferVariable == 0u || state.ldsBufferBase == 0u) {
                 FailEmit("device memory LDS was not prepared at function entry");
@@ -203,6 +254,9 @@ std::uint32_t GuardedElementIndex(SpirvEmitterState& state, const MemoryResource
 }
 
 std::uint32_t EmitMemoryElementPointer(SpirvEmitterState& state, const MemoryResourceAccess& access, std::uint32_t index) {
+    if (access.kind == ResourceKind::Lds && state.pixelFunctionLdsBuffer) {
+        return EmitStorageBufferElementPointer(state, access, EmitAddU32(state, state.ldsBufferBase, index), TypeStorageBufferElementPointer(state));
+    }
     if (access.kind == ResourceKind::Lds && LdsInDeviceMemory(state)) {
         return EmitStorageBufferElementPointer(state, access, EmitAddU32(state, state.ldsBufferBase, index), TypeStorageBufferElementPointer(state));
     }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp
index 946baa6068..7a5fe34450 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp
@@ -233,6 +233,27 @@ std::uint32_t StorageImageDescriptorPointer(SpirvEmitterState& state, std::uint3
     return DescriptorElementPointer(state, pointerType, variable, arrayIndex, kind, resource, "storage image descriptor array was not emitted");
 }
 
+std::uint32_t EmitStorageImageRead(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t coord, std::uint32_t sample) {
+    const auto& image = state.program.Info().images.at(resource);
+    if (image.resourceClass != ImageResourceClass::Storage || image.table != NoTable || image.mipMode == ImageMipMode::DynamicStorage || image.atomic) {
+        FailEmit("storage image read requested for an image that is not one plain storage descriptor");
+    }
+    if (std::ranges::find(state.supportedCapabilities, spv::CapabilityStorageImageReadWithoutFormat) == state.supportedCapabilities.end()) FailEmit("storage image reads without a format are unavailable on the target device");
+    state.module.EmitCapability(spv::CapabilityStorageImageReadWithoutFormat);
+    const auto imageType = ImageType(state, image);
+    const auto descriptor = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, imageType, descriptor, StorageImageDescriptorPointer(state, resource));
+    const auto texel = state.module.AllocateId();
+    const auto texelType = ImageVectorType(state, image.numericClass, 4u);
+    if (RdnaImageDimensionInfoFor(image.dimension).multisampled != 0u) {
+        if (sample == 0u) FailEmit("multisampled storage image read requires a sample");
+        state.module.AddFunction(spv::OpImageRead, texelType, texel, descriptor, coord, spv::ImageOperandsSampleMask, sample);
+    } else {
+        state.module.AddFunction(spv::OpImageRead, texelType, texel, descriptor, coord);
+    }
+    return texel;
+}
+
 void EmitStorageImageWrite(SpirvEmitterState& state, std::uint32_t resource, std::uint32_t mipLod, std::uint32_t coord, std::uint32_t texel, std::uint32_t sample) {
     const auto& image = state.runtimeImage != nullptr ? *state.runtimeImage : state.program.Info().images.at(resource);
     if (image.resourceClass != ImageResourceClass::Storage) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp
index a8068f0415..f71d15cbca 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvEmitterHelpers.cpp
@@ -218,7 +218,7 @@ void DefineInputs(SpirvEmitterState& state) {
         const auto reads = [&](StageInputKind kind) {
             return std::any_of(state.inputs.begin(), state.inputs.end(), [&](const SpirvInputBinding& input) { return input.kind == kind; });
         };
-        emulation = LayoutBarycentricEmulation(parameters, {true, reads(StageInputKind::BaryCoordSmooth), reads(StageInputKind::BaryCoordNoPerspective)}, state.meshBarycentricPixel);
+        emulation = LayoutBarycentricEmulation(parameters, {true, reads(StageInputKind::BaryCoordSmooth), reads(StageInputKind::BaryCoordNoPerspective), state.program.Info().smoothOffsetBarycentrics}, state.meshBarycentricPixel);
         if (state.meshBarycentricPixel && emulation.positionsLocation != BarycentricEmulationLayout::NoLocation) {
             state.pixelFlatPositions = DefineInterfaceVariable(state, state.module.Type(spv::OpTypeArray, TypeF32Vector(state, 4u), ConstantU32(state, 3u)), spv::StorageClassInput, "meshBarycentricPositions");
             state.module.AddAnnotation(spv::OpDecorate, state.pixelFlatPositions, spv::DecorationLocation, emulation.positionsLocation);
@@ -226,6 +226,11 @@ void DefineInputs(SpirvEmitterState& state) {
             state.module.EmitCapability(spv::CapabilityMeshShadingEXT);
             state.module.EmitExtension("SPV_EXT_mesh_shader");
         }
+        if (emulation.reciprocalWLocation != BarycentricEmulationLayout::NoLocation) {
+            state.barycentricReciprocalWVariable = DefineInterfaceVariable(state, TypeF32Vector(state, 3u), spv::StorageClassInput, "gl_BarycentricReciprocalW");
+            state.module.AddAnnotation(spv::OpDecorate, state.barycentricReciprocalWVariable, spv::DecorationNoPerspective);
+            state.module.AddAnnotation(spv::OpDecorate, state.barycentricReciprocalWVariable, spv::DecorationLocation, emulation.reciprocalWLocation);
+        }
     }
     for (auto& input : state.inputs) {
         if (pixelStage && input.kind == StageInputKind::Parameter) {
@@ -547,6 +552,7 @@ void DefineDescriptors(SpirvEmitterState& state) {
             const auto& image = *selected;
             const auto name = "image_" + std::to_string(static_cast<std::uint32_t>(binding.kind));
             state.imageVariables.at(ImageBindingIndex(binding.kind)) = Define(ArrayType(ImageType(state, image)), name.c_str(), spv::StorageClassUniformConstant);
+            if (std::ranges::any_of(binding.resources, [&](std::uint32_t resource) { return state.program.Info().images.at(resource).targetMerge; })) state.module.AddAnnotation(spv::OpDecorate, state.imageVariables.at(ImageBindingIndex(binding.kind)), spv::DecorationCoherent);
             if (image.dimension == RdnaImageDimension::Dim1D || image.dimension == RdnaImageDimension::Dim1DArray) {
                 state.module.EmitCapability(image.resourceClass == ImageResourceClass::Sampled ? spv::CapabilitySampled1D : spv::CapabilityImage1D);
             }
@@ -569,6 +575,14 @@ void DefineDescriptors(SpirvEmitterState& state) {
             for (const auto variable : {state.ldsBufferVariable, state.ldsBufferU64Variable}) state.module.AddAnnotation(spv::OpDecorate, variable, spv::DecorationAliased);
         }
     }
+    if (state.pixelFunctionLdsBuffer) {
+        state.ldsBufferVariable = state.module.DefineGlobalVariable(TypePointer(state, spv::StorageClassStorageBuffer, StorageBufferBlockType(state)), spv::StorageClassStorageBuffer);
+        state.module.AddName(state.ldsBufferVariable, "pixel_function_lds");
+        state.module.AddAnnotation(spv::OpDecorate, state.ldsBufferVariable, spv::DecorationDescriptorSet, PixelFunctionLdsDescriptorSet);
+        state.module.AddAnnotation(spv::OpDecorate, state.ldsBufferVariable, spv::DecorationBinding, 0u);
+        state.module.AddAnnotation(spv::OpDecorate, state.ldsBufferVariable, spv::DecorationCoherent);
+        if (state.spirvVersion >= 0x00010400u) state.interfaceVariables.push_back(state.ldsBufferVariable);
+    }
 }
 
 }
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp
index 4c05ffe094..ed3215659b 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvInputOutput.cpp
@@ -49,11 +49,15 @@ namespace ShaderRecompiler
         const auto& pixel = *inputInfo.pixel;
         std::vector<FragmentParameter> result;
         std::array<bool, 32> readsP10{};
+        std::array<bool, 32> readsP20{};
         for (const auto& block : program.Blocks()) {
             for (const auto* instruction : block->Instructions()) {
-                if (instruction->Opcode() != IrOpcode::GetInterpolationParameter || instruction->Argument(2)->Resolve()->ImmediateU32() != 0u) continue;
+                if (instruction->Opcode() != IrOpcode::GetInterpolationParameter) continue;
+                const auto mode = instruction->Argument(2)->Resolve()->ImmediateU32();
                 const auto attribute = instruction->Argument(0)->Resolve()->ImmediateU32();
-                if (attribute < readsP10.size()) readsP10[attribute] = true;
+                if (attribute >= readsP10.size()) continue;
+                readsP10[attribute] = readsP10[attribute] || mode == 0u;
+                readsP20[attribute] = readsP20[attribute] || mode == 1u;
             }
         }
         for (const auto& input : program.Info().inputs) {
@@ -61,14 +65,16 @@ namespace ShaderRecompiler
             const auto location = PixelInputLocation(pixel, input.location);
             const bool flat = PixelInputIsFlat(pixel, input.location);
             const bool flatP10 = flat && !input.perVertex && input.location < readsP10.size() && readsP10[input.location];
+            const bool flatP20 = flat && !input.perVertex && input.location < readsP20.size() && readsP20[input.location];
             const bool vertexOrder = input.perVertex && (input.location >= 32u || (program.Metadata().pixelVertexOrderInputs >> input.location & 1u) != 0u);
             const auto existing = std::find_if(result.begin(), result.end(), [&](const auto& parameter) { return parameter.location == location; });
             if (existing != result.end()) {
                 existing->flatP10 = existing->flatP10 || flatP10;
+                existing->flatP20 = existing->flatP20 || flatP20;
                 existing->vertexOrder = existing->vertexOrder || vertexOrder;
                 continue;
             }
-            result.push_back({location, location, flat, input.perVertex, PixelInputIsCustom(pixel, input.location), flatP10, vertexOrder});
+            result.push_back({location, location, flat, input.perVertex, PixelInputIsCustom(pixel, input.location), flatP10, vertexOrder, flatP20});
         }
         return result;
     }
@@ -150,7 +156,7 @@ namespace ShaderRecompiler
     }
 
     bool OrderedPixelShader(const SpirvEmitterState& state) {
-        return state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && state.inputInfo.pixel->psOrderedPixelShader;
+        return state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && (state.inputInfo.pixel->psOrderedPixelShader || state.inputInfo.pixel->mergeMask != 0u);
     }
 
     const SpirvInputBinding* SpirvInputBindingForParameter(const SpirvEmitterState& state, std::uint32_t location) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp
index d997a174eb..78314c2247 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp
@@ -916,7 +916,7 @@ std::uint32_t Atomic32(SpirvValueEmitContext& ctx, const IrValue& inst, const Me
             const auto old = EmitAtomicOperation(ctx, inst, pointer, scope);
             if (lds) {
                 const std::uint32_t semantics = spv::MemorySemanticsAcquireReleaseMask | LdsMemorySemantics(state);
-                if (!state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, scope), ConstantU32(state, semantics));
+                if (!state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, LdsMemoryBarrierScope(state)), ConstantU32(state, semantics));
             } else {
                 EmitDeviceAtomicMemoryBarrier(state);
             }
@@ -957,6 +957,7 @@ std::uint32_t BufferAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst) {
 struct AtomicFloatBits {
     SpirvEmitterState& state;
     bool wide;
+    bool flushInputs = false;
     std::uint32_t type() const { return wide ? TypeScalarU64(state) : TypeU32(state); }
     std::uint32_t constant(std::uint64_t value) const {
         return wide ? state.module.Constant(spv::OpConstant, TypeScalarU64(state), static_cast<std::uint32_t>(value), static_cast<std::uint32_t>(value >> 32u)) : ConstantU32(state, static_cast<std::uint32_t>(value));
@@ -986,6 +987,8 @@ struct AtomicFloatBits {
         return Binary(state, spv::OpLogicalOr, TypeBool(state), same, zeros);
     }
     std::uint32_t minMax(std::uint32_t old, std::uint32_t source, bool maxValue) const {
+        old = flush(old, flushInputs);
+        source = flush(source, flushInputs);
         const auto better = test(maxValue ? spv::OpUGreaterThan : spv::OpULessThan, orderKey(source), orderKey(old));
         auto result = select(better, source, old);
         result = select(nan(old), source, result);
@@ -995,7 +998,7 @@ struct AtomicFloatBits {
         return select(signalingNan(source), op(spv::OpBitwiseOr, source, constant(quiet())), result);
     }
     std::uint32_t compareSwap(std::uint32_t old, std::uint32_t comparator, std::uint32_t desired) const {
-        return select(equal(old, comparator), desired, old);
+        return select(equal(flush(old, flushInputs), flush(comparator, flushInputs)), desired, old);
     }
     std::uint32_t increment(std::uint32_t old, std::uint32_t limit) const {
         return select(test(spv::OpUGreaterThanEqual, old, limit), constant(0u), op(spv::OpIAdd, old, constant(1u)));
@@ -1007,8 +1010,9 @@ struct AtomicFloatBits {
 };
 
 std::uint32_t BufferFloatAtomic(SpirvValueEmitContext& ctx, const IrValue& inst, bool maxValue) {
-    return EmitAtomicUpdate(ctx, inst, BufferMemory(ctx, inst), [maxValue](SpirvEmitterState& state, std::uint32_t old, std::uint32_t value) {
-        return AtomicFloatBits{state, false}.minMax(old, value, maxValue);
+    const auto& mem = BufferMemory(ctx, inst);
+    return EmitAtomicUpdate(ctx, inst, mem, [maxValue, flush = mem.flushDenormals](SpirvEmitterState& state, std::uint32_t old, std::uint32_t value) {
+        return AtomicFloatBits{state, false, flush}.minMax(old, value, maxValue);
     });
 }
 
@@ -1033,10 +1037,7 @@ std::uint32_t SharedAtomicUpdate(SpirvValueEmitContext& ctx, const IrValue& inst
     return EmitAtomicAccess(ctx, inst, mem, [&](std::uint32_t pointer) {
         const auto next = [&](std::uint32_t current) { return replacement(state, current); };
         if (InFunctionStorage(state, mem.kind)) return UpdateFunctionElement(state, pointer, next);
-        const auto old = AtomicUpdate(state, pointer, mem.kind, next);
-        const std::uint32_t semantics = spv::MemorySemanticsAcquireReleaseMask | LdsMemorySemantics(state);
-        if (!state.insideLdsLock) state.module.AddFunction(spv::OpMemoryBarrier, ConstantU32(state, spv::ScopeWorkgroup), ConstantU32(state, semantics));
-        return old;
+        return AtomicUpdate(state, pointer, mem.kind, next);
     });
 }
 
@@ -1044,8 +1045,7 @@ std::uint32_t SharedFloatMinMax(SpirvValueEmitContext& ctx, const IrValue& inst,
     const auto data = ctx.Arg(inst, 1);
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomicUpdate(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old) {
-        const AtomicFloatBits bits{state, false};
-        return bits.minMax(bits.flush(old, flush), bits.flush(data, flush), maxValue);
+        return AtomicFloatBits{state, false, flush}.minMax(old, data, maxValue);
     });
 }
 
@@ -1089,7 +1089,7 @@ std::uint32_t AddressAtomicOpcode(IrOpcode opcode) {
     }
 }
 
-std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator) {
+std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator, bool flush) {
     switch (opcode) {
     case IrOpcode::AddressAtomicSwap32:
     case IrOpcode::AddressAtomicCmpSwap32:
@@ -1110,11 +1110,11 @@ std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::u
     case IrOpcode::AddressAtomicUSubSat32:
         return AtomicUSubSat(state, old, value);
     case IrOpcode::AddressAtomicFMin32:
-        return AtomicFloatBits{state, false}.minMax(old, value, false);
+        return AtomicFloatBits{state, false, flush}.minMax(old, value, false);
     case IrOpcode::AddressAtomicFMax32:
-        return AtomicFloatBits{state, false}.minMax(old, value, true);
+        return AtomicFloatBits{state, false, flush}.minMax(old, value, true);
     case IrOpcode::AddressAtomicFCmpSwap32:
-        return AtomicFloatBits{state, false}.compareSwap(old, comparator, value);
+        return AtomicFloatBits{state, false, flush}.compareSwap(old, comparator, value);
     default:
         throw std::runtime_error("FlatAtomicNext32: opcode has no aperture lowering");
     }
@@ -1122,6 +1122,7 @@ std::uint32_t FlatAtomicNext32(SpirvEmitterState& state, IrOpcode opcode, std::u
 
 std::uint32_t ApertureAtomic32(SpirvValueEmitContext& ctx, const IrValue& inst, ResourceKind kind, std::uint32_t address, std::uint32_t byteOffset, std::uint32_t value, std::uint32_t comparator) {
     auto& state = ctx.state;
+    const bool flush = ctx.Memory(inst).flushDenormals;
     const auto instruction = ConstantU32(state, inst.Flags<MemoryFlags>().pc);
     const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), byteOffset, ConstantU32(state, 3u)), ConstantU32(state, 0u));
     EmitIfCondition(state, unaligned, [&] { RecordBdaFault(state, address, ConstantU32(state, 4u), instruction, BdaAbi::FaultReason::Unaligned); });
@@ -1136,20 +1137,20 @@ std::uint32_t ApertureAtomic32(SpirvValueEmitContext& ctx, const IrValue& inst,
         return EmitValueOrZeroIfCondition(state, EmitMemoryElementInBounds(state, resource, index), [&] {
             const auto pointer = EmitMemoryElementPointer(state, resource, index);
             if (kind == ResourceKind::Lds) {
-                const auto update = [&]() { return AtomicUpdate(state, pointer, kind, [&](std::uint32_t current) { return FlatAtomicNext32(state, opcode, current, value, comparator); }); };
+                const auto update = [&]() { return AtomicUpdate(state, pointer, kind, [&](std::uint32_t current) { return FlatAtomicNext32(state, opcode, current, value, comparator, flush); }); };
                 return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU32(state), ConstantU32(state, 0u), update) : update();
             }
             const auto old = state.module.AllocateId();
             state.module.AddFunction(spv::OpLoad, TypeU32(state), old, pointer);
-            state.module.AddFunction(spv::OpStore, pointer, FlatAtomicNext32(state, opcode, old, value, comparator));
+            state.module.AddFunction(spv::OpStore, pointer, FlatAtomicNext32(state, opcode, old, value, comparator, flush));
             return old;
         });
     });
 }
 
-std::uint32_t FlatAtomicNext64(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator) {
+std::uint32_t FlatAtomicNext64(SpirvEmitterState& state, IrOpcode opcode, std::uint32_t old, std::uint32_t value, std::uint32_t comparator, bool flush) {
     const auto u64 = TypeScalarU64(state);
-    const AtomicFloatBits bits{state, true};
+    const AtomicFloatBits bits{state, true, flush};
     const auto winner = [&](spv::Op compare) {
         return Select(state, u64, Binary(state, compare, TypeBool(state), old, value), old, value);
     };
@@ -1193,6 +1194,7 @@ std::uint32_t FlatAtomicNext64(SpirvEmitterState& state, IrOpcode opcode, std::u
 
 std::uint32_t ApertureAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst, ResourceKind kind, std::uint32_t address, std::uint32_t byteOffset, std::uint32_t value, std::uint32_t comparator) {
     auto& state = ctx.state;
+    const bool flush = ctx.Memory(inst).flushDenormals;
     const auto instruction = ConstantU32(state, inst.Flags<MemoryFlags>().pc);
     const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), byteOffset, ConstantU32(state, 7u)), ConstantU32(state, 0u));
     EmitIfCondition(state, unaligned, [&] { RecordBdaFault(state, address, ConstantU32(state, 8u), instruction, BdaAbi::FaultReason::Unaligned); });
@@ -1207,7 +1209,7 @@ std::uint32_t ApertureAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst,
     const auto opcode = inst.Opcode();
     return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&] {
         return EmitValueOrDefaultIfCondition(state, EmitMemoryElementInBounds(state, resource, high), TypeU64(state), ConstantU64(state, 0u), [&] {
-            if (kind == ResourceKind::Lds && state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return FlatAtomicNext64(state, opcode, old, value, comparator); });
+            if (kind == ResourceKind::Lds && state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return FlatAtomicNext64(state, opcode, old, value, comparator, flush); });
             const auto update = [&]() {
                 const auto lowPointer = EmitMemoryElementPointer(state, resource, low);
                 const auto highPointer = EmitMemoryElementPointer(state, resource, high);
@@ -1217,7 +1219,7 @@ std::uint32_t ApertureAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst,
                 state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer);
                 const auto old = state.module.AllocateId();
                 state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue);
-                const auto next = Unary(state, spv::OpBitcast, TypeU64(state), FlatAtomicNext64(state, opcode, Unary(state, spv::OpBitcast, TypeScalarU64(state), old), value, comparator));
+                const auto next = Unary(state, spv::OpBitcast, TypeU64(state), FlatAtomicNext64(state, opcode, Unary(state, spv::OpBitcast, TypeScalarU64(state), old), value, comparator, flush));
                 const auto nextLow = state.module.AllocateId();
                 const auto nextHigh = state.module.AllocateId();
                 state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u);
@@ -1254,7 +1256,7 @@ std::uint32_t AddressAtomic(SpirvValueEmitContext& ctx, const IrValue& inst) {
             if (inst.Opcode() == IrOpcode::AddressAtomicUSubSat32) {
                 return AtomicUpdate(state, pointer, mem.kind, [&](std::uint32_t current) { return AtomicUSubSat(state, current, value); });
             }
-            const AtomicFloatBits bits{state, wide};
+            const AtomicFloatBits bits{state, wide, mem.flushDenormals};
             const auto update = [&](auto&& replacement) { return AtomicUpdateTyped(state, pointer, mem.kind, scalarType, replacement); };
             switch (inst.Opcode()) {
             case IrOpcode::AddressAtomicFCmpSwap32:
@@ -1439,31 +1441,31 @@ std::uint32_t SharedAtomic64(SpirvValueEmitContext& ctx, const IrValue& inst, TR
         const auto low = EmitMemoryElementIndex(state, resource, rawIndex);
         const auto high = EmitMemoryElementIndex(state, resource, Binary(state, spv::OpIAdd, TypeU32(state), rawIndex, ConstantU32(state, 1u)));
         return EmitValueOrDefaultIfCondition(state, EmitMemoryElementInBounds(state, resource, high), TypeU64(state), ConstantU64(state, 0u), [&]() {
-            if (state.requirements.ldsBufferInt64Atomics) {
-                const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), low, ConstantU32(state, 1u)), ConstantU32(state, 0u));
-                EmitIfCondition(state, unaligned, [&] { RecordBdaFaultWords(state, Binary(state, spv::OpShiftLeftLogical, TypeU32(state), rawIndex, ConstantU32(state, 2u)), ConstantU32(state, 0u), ConstantU32(state, 8u), ConstantU32(state, inst.Flags<MemoryFlags>().pc), BdaAbi::FaultReason::Unaligned); });
-                const auto aligned = Unary(state, spv::OpLogicalNot, TypeBool(state), unaligned);
-                return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&]() { return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return replacement(state, old); }); });
-            }
-            const auto update = [&]() {
-                const auto lowPointer = EmitMemoryElementPointer(state, resource, low);
-                const auto highPointer = EmitMemoryElementPointer(state, resource, high);
-                const auto lowValue = state.module.AllocateId();
-                const auto highValue = state.module.AllocateId();
-                state.module.AddFunction(spv::OpLoad, TypeU32(state), lowValue, lowPointer);
-                state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer);
-                const auto old = state.module.AllocateId();
-                state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue);
-                const auto next = Unary(state, spv::OpBitcast, TypeU64(state), replacement(state, Unary(state, spv::OpBitcast, TypeScalarU64(state), old)));
-                const auto nextLow = state.module.AllocateId();
-                const auto nextHigh = state.module.AllocateId();
-                state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u);
-                state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextHigh, next, 1u);
-                state.module.AddFunction(spv::OpStore, lowPointer, nextLow);
-                state.module.AddFunction(spv::OpStore, highPointer, nextHigh);
-                return old;
-            };
-            return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU64(state), ConstantU64(state, 0u), update) : update();
+            const auto unaligned = Binary(state, spv::OpINotEqual, TypeBool(state), Binary(state, spv::OpBitwiseAnd, TypeU32(state), rawIndex, ConstantU32(state, 1u)), ConstantU32(state, 0u));
+            EmitIfCondition(state, unaligned, [&] { RecordBdaFaultWords(state, Binary(state, spv::OpShiftLeftLogical, TypeU32(state), rawIndex, ConstantU32(state, 2u)), ConstantU32(state, 0u), ConstantU32(state, 8u), ConstantU32(state, inst.Flags<MemoryFlags>().pc), BdaAbi::FaultReason::Unaligned); });
+            const auto aligned = Unary(state, spv::OpLogicalNot, TypeBool(state), unaligned);
+            return EmitValueOrDefaultIfCondition(state, aligned, TypeU64(state), ConstantU64(state, 0u), [&]() {
+                if (state.requirements.ldsBufferInt64Atomics) return LdsBufferAtomic64(state, low, [&](std::uint32_t old) { return replacement(state, old); });
+                const auto update = [&]() {
+                    const auto lowPointer = EmitMemoryElementPointer(state, resource, low);
+                    const auto highPointer = EmitMemoryElementPointer(state, resource, high);
+                    const auto lowValue = state.module.AllocateId();
+                    const auto highValue = state.module.AllocateId();
+                    state.module.AddFunction(spv::OpLoad, TypeU32(state), lowValue, lowPointer);
+                    state.module.AddFunction(spv::OpLoad, TypeU32(state), highValue, highPointer);
+                    const auto old = state.module.AllocateId();
+                    state.module.AddFunction(spv::OpCompositeConstruct, TypeU64(state), old, lowValue, highValue);
+                    const auto next = Unary(state, spv::OpBitcast, TypeU64(state), replacement(state, Unary(state, spv::OpBitcast, TypeScalarU64(state), old)));
+                    const auto nextLow = state.module.AllocateId();
+                    const auto nextHigh = state.module.AllocateId();
+                    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextLow, next, 0u);
+                    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), nextHigh, next, 1u);
+                    state.module.AddFunction(spv::OpStore, lowPointer, nextLow);
+                    state.module.AddFunction(spv::OpStore, highPointer, nextHigh);
+                    return old;
+                };
+                return state.requirements.ldsLock ? LockedLdsUpdate(state, TypeU64(state), ConstantU64(state, 0u), update) : update();
+            });
         });
     });
 }
@@ -1491,8 +1493,7 @@ std::uint32_t SharedAtomic64Select(SpirvValueEmitContext& ctx, const IrValue& in
 std::uint32_t SharedFloatMinMax64(SpirvValueEmitContext& ctx, const IrValue& inst, bool maxValue) {
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomic64Binary(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old, std::uint32_t data) {
-        const AtomicFloatBits bits{state, true};
-        return bits.minMax(bits.flush(old, flush), bits.flush(data, flush), maxValue);
+        return AtomicFloatBits{state, true, flush}.minMax(old, data, maxValue);
     });
 }
 
@@ -1522,13 +1523,12 @@ std::uint32_t AtomicUSubSat(SpirvEmitterState& state, std::uint32_t old, std::ui
     return Select(state, TypeU32(state), fits, difference, ConstantU32(state, 0u));
 }
 
-std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue) {
-    return AtomicFloatBits{state, false}.minMax(old, source, maxValue);
+std::uint32_t AtomicFloatMinMax(SpirvEmitterState& state, std::uint32_t old, std::uint32_t source, bool maxValue, bool flush) {
+    return AtomicFloatBits{state, false, flush}.minMax(old, source, maxValue);
 }
 
-std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator) {
-    const AtomicFloatBits bits{state, false};
-    return bits.select(bits.equal(old, comparator), desired, old);
+std::uint32_t AtomicFloatCompareSwap(SpirvEmitterState& state, std::uint32_t old, std::uint32_t desired, std::uint32_t comparator, bool flush) {
+    return AtomicFloatBits{state, false, flush}.compareSwap(old, comparator, desired);
 }
 
 std::uint32_t EmitReadConst(SpirvValueEmitContext& ctx, const IrValue& inst) {
@@ -1948,8 +1948,7 @@ std::uint32_t EmitSharedAtomicCmpstF32(SpirvValueEmitContext& ctx, const IrValue
     const auto source = ctx.Arg(inst, 2);
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomicUpdate(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old) {
-        const AtomicFloatBits bits{state, false};
-        return bits.select(bits.equal(bits.flush(old, flush), bits.flush(compare, flush)), source, old);
+        return AtomicFloatBits{state, false, flush}.compareSwap(old, compare, source);
     });
 }
 
@@ -2051,8 +2050,7 @@ std::uint32_t EmitSharedAtomicCmpstF64(SpirvValueEmitContext& ctx, const IrValue
     const auto source = ScalarU64Argument(ctx, inst, 2u);
     const bool flush = SharedMemory(ctx, inst).flushDenormals;
     return SharedAtomic64(ctx, inst, [&](SpirvEmitterState& state, std::uint32_t old) {
-        const AtomicFloatBits bits{state, true};
-        return bits.select(bits.equal(bits.flush(old, flush), bits.flush(compare, flush)), source, old);
+        return AtomicFloatBits{state, true, flush}.compareSwap(old, compare, source);
     });
 }
 
@@ -2118,24 +2116,27 @@ std::uint32_t EmitBufferAtomicFCmpSwap32(SpirvValueEmitContext& ctx, const IrVal
     const auto comparator = ctx.Arg(inst, inst.ArgumentCount() - 2u);
     const auto& mem = BufferMemory(ctx, inst);
     return EmitAtomicAccess(ctx, inst, mem, [&](std::uint32_t pointer) {
-        return AtomicUpdate(ctx.state, pointer, mem.kind, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, false}.compareSwap(old, comparator, desired); });
+        return AtomicUpdate(ctx.state, pointer, mem.kind, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, false, mem.flushDenormals}.compareSwap(old, comparator, desired); });
     });
 }
 
 std::uint32_t EmitBufferAtomicFCmpSwap64(SpirvValueEmitContext& ctx, const IrValue& inst) {
     const auto desired = ScalarU64Argument(ctx, inst, 3u);
     const auto comparator = ScalarU64Argument(ctx, inst, 2u);
-    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true}.compareSwap(old, comparator, desired); });
+    const bool flush = BufferMemory(ctx, inst).flushDenormals;
+    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true, flush}.compareSwap(old, comparator, desired); });
 }
 
 std::uint32_t EmitBufferAtomicFMin64(SpirvValueEmitContext& ctx, const IrValue& inst) {
     const auto value = ScalarU64Argument(ctx, inst, 2u);
-    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true}.minMax(old, value, false); });
+    const bool flush = BufferMemory(ctx, inst).flushDenormals;
+    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true, flush}.minMax(old, value, false); });
 }
 
 std::uint32_t EmitBufferAtomicFMax64(SpirvValueEmitContext& ctx, const IrValue& inst) {
     const auto value = ScalarU64Argument(ctx, inst, 2u);
-    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true}.minMax(old, value, true); });
+    const bool flush = BufferMemory(ctx, inst).flushDenormals;
+    return BufferAtomic64Update(ctx, inst, [&](std::uint32_t old) { return AtomicFloatBits{ctx.state, true, flush}.minMax(old, value, true); });
 }
 
 std::uint32_t EmitBufferAtomicInc64(SpirvValueEmitContext& ctx, const IrValue& inst) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp
index ddde52c8e9..cab4d0b74c 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp
@@ -192,22 +192,46 @@ private:
     std::unordered_set<const IrValue*> active;
 };
 
-std::uint32_t IndexedWindowSlots(const IrProgram& program) {
+constexpr std::uint64_t MaxNarrowedSwitchCases = 4096;
+
+std::uint32_t IndexedWindowSlots(const IrProgram& program, std::uint32_t laneCount) {
     const auto window = program.Metadata().vectorWindowSize;
     WindowIndexBounds bounds;
     std::uint64_t reached = 0;
+    std::uint64_t dynamicAccesses = 0;
     for (const auto& block : program.Blocks()) {
         for (const IrValue* inst : block->Instructions()) {
             if (inst->Opcode() != IrOpcode::LoadVectorWindow && inst->Opcode() != IrOpcode::StoreVectorWindow) continue;
             const IrValue* index = inst->Argument(0)->Resolve();
             if (index->HasImmediate()) continue;
+            ++dynamicAccesses;
             const auto bound = bounds.Of(*index);
             if (bound && *bound < window / 2u) reached = std::max(reached, *bound + 1u);
         }
     }
+    if (reached == 0u || dynamicAccesses * (window - reached) * laneCount > MaxNarrowedSwitchCases) return 0u;
     return static_cast<std::uint32_t>(reached);
 }
 
+bool WritesGuestMemory(const IrProgram& program) {
+    const auto& info = program.Info();
+    const auto writtenImage = [](const ImageResource& image) { return !image.targetMerge && (image.written || image.atomic || image.atomic64); };
+    const auto writtenModes = [&](const std::vector<ImageResource>& modes) { return std::ranges::any_of(modes, writtenImage); };
+    const auto writtenBuffer = [](const BufferResource& buffer) { return buffer.written || buffer.atomic; };
+    if (info.bdaWrites || std::ranges::any_of(info.buffers, writtenBuffer) || std::ranges::any_of(info.images, writtenImage) || std::ranges::any_of(info.runtimeImageModes, writtenModes)) return true;
+    const auto& memory = program.Resources().memoryInfo;
+    for (const auto& block : program.Blocks()) {
+        for (const IrValue* inst : block->Instructions()) {
+            const auto access = SharedAccessOf(inst->Opcode());
+            if (access == SharedAccess::None || access == SharedAccess::Read) continue;
+            const auto index = inst->Flags<MemoryFlags>().index;
+            if (index >= memory.size()) FailEmit("a shared memory access has no memory metadata");
+            if (memory[index].kind == ResourceKind::Gds) return true;
+        }
+    }
+    return false;
+}
+
 }
 
 void DefineModule(SpirvEmitterState& state) {
@@ -216,7 +240,7 @@ void DefineModule(SpirvEmitterState& state) {
     DefineOutputs(state);
     DefineTessellationInterfaces(state);
     DefineDescriptors(state);
-    if (state.requirements.functionLds) {
+    if (state.requirements.functionLds && !state.pixelFunctionLdsBuffer) {
         state.ldsVariable = state.module.AllocateId();
     }
     if (state.requirements.functionScratch) {
@@ -226,7 +250,7 @@ void DefineModule(SpirvEmitterState& state) {
     }
     if (const auto window = state.program.Metadata().vectorWindowSize; window != 0u) {
         static const bool narrowWindow = std::getenv("APS5_NO_WINDOW_NARROWING") == nullptr;
-        state.vectorWindowIndexed = narrowWindow ? IndexedWindowSlots(state.program) : 0u;
+        state.vectorWindowIndexed = narrowWindow ? IndexedWindowSlots(state.program, state.laneCount) : 0u;
         for (std::uint32_t half = 0; half < state.laneCount; half++) {
             state.vectorWindowVariable.at(half) = state.module.AllocateId();
             if (state.vectorWindowIndexed == 0u) continue;
@@ -386,12 +410,22 @@ void DefineModule(SpirvEmitterState& state) {
             state.module.EmitExtension("SPV_EXT_shader_stencil_export");
             state.module.AddExecutionMode(state.mainFunc, spv::ExecutionModeStencilRefReplacingEXT);
         }
-        if (pixel.psEarlyZ && !pixel.psAlphaToCoverage && !pixel.QuadMasked()) {
+        const bool merge = pixel.mergeMask != 0u;
+        if (merge && (state.depthVariable != 0 || state.stencilRefVariable != 0 || pixel.psDepthExportEnable || pixel.psSampleMaskExportEnable || pixel.psStencilRefExportEnable || pixel.psAlphaToCoverage || pixel.QuadMasked() || (pixel.psPixelKillEnable && !pixel.psEarlyZ && pixel.mergeDepthStencilWrites))) {
+            throw std::runtime_error("a partial write of a packed color target merges inside the pixel shader after early depth and stencil tests, which a shader that kills pixels under late tests of a draw writing depth or stencil, exports depth, stencil or coverage, or runs with a quad sample mask cannot use");
+        }
+        if (merge && pixel.mergeSamples > 1u && WritesGuestMemory(state.program)) {
+            throw std::runtime_error("a partial write of a multisampled packed color target runs the pixel shader once per sample, which a shader that writes guest memory (stores, atomics or GDS) cannot use: each covered sample would repeat its writes");
+        }
+        if (merge && !pixel.psEarlyZ && pixel.mergeDepthStencilTests && WritesGuestMemory(state.program)) {
+            throw std::runtime_error("a partial write of a packed color target merges inside the pixel shader after early depth and stencil tests, which a shader that writes guest memory (stores, atomics or GDS) under late tests cannot use: the pixels the tests reject would still write it");
+        }
+        if ((pixel.psEarlyZ && !pixel.psAlphaToCoverage && !pixel.QuadMasked()) || merge) {
             state.module.AddExecutionMode(state.mainFunc, spv::ExecutionModeEarlyFragmentTests);
         }
-        if (pixel.psOrderedPixelShader) {
+        if (pixel.psOrderedPixelShader || merge) {
             if (std::find(state.supportedCapabilities.begin(), state.supportedCapabilities.end(), static_cast<std::uint32_t>(spv::CapabilityFragmentShaderPixelInterlockEXT)) == state.supportedCapabilities.end()) {
-                throw std::runtime_error("a primitive-ordered pixel shader needs the fragmentShaderPixelInterlock feature, which the device lacks");
+                throw std::runtime_error(merge ? "a partial write of a packed color target needs the fragmentShaderPixelInterlock feature, which the device lacks" : "a primitive-ordered pixel shader needs the fragmentShaderPixelInterlock feature, which the device lacks");
             }
             state.module.EmitCapability(spv::CapabilityFragmentShaderPixelInterlockEXT);
             state.module.EmitExtension("SPV_EXT_fragment_shader_interlock");
@@ -402,7 +436,7 @@ void DefineModule(SpirvEmitterState& state) {
         state.module.AddExecutionMode(state.mainFunc, spv::ExecutionModeDerivativeGroupLinearKHR);
     }
     state.module.AddName(state.mainFunc, "main");
-    if (state.requirements.functionLds) {
+    if (state.requirements.functionLds && !state.pixelFunctionLdsBuffer) {
         state.module.AddName(state.ldsVariable, "lds_dwords");
     }
     if (state.requirements.functionScratch) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp
index 4a8d6a526c..1bc242f265 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp
@@ -9,6 +9,7 @@
 #include "PipelineSpecialization.hpp"
 #include <algorithm>
 #include <array>
+#include <bit>
 #include <limits>
 #include <stdexcept>
 
@@ -141,7 +142,10 @@ std::uint32_t EmitSampleOffset(SpirvEmitterState& state) {
 }
 
 std::uint32_t EmitOffsetBarycentricU32(SpirvEmitterState& state, StageInputKind kind, std::uint32_t component) {
-    const auto variable = InputVariableForKind(state, BarycentricInputOf(kind));
+    const bool smoothOffset = kind == StageInputKind::BaryCoordSmoothCenter || kind == StageInputKind::BaryCoordSmoothSample;
+    const auto variable = smoothOffset && state.barycentricReciprocalWVariable != 0u
+        ? state.barycentricReciprocalWVariable
+        : InputVariableForKind(state, BarycentricInputOf(kind));
     if (variable == 0u) {
         throw std::runtime_error("an offset barycentric read lacks its barycentric input");
     }
@@ -155,6 +159,20 @@ std::uint32_t EmitOffsetBarycentricU32(SpirvEmitterState& state, StageInputKind
     state.module.AddFunction(spv::OpExtInst, TypeF32Vector(state, 3u), weights, GlslStd450(state), GLSLstd450InterpolateAtOffset, variable, offset);
     const auto weight = state.module.AllocateId();
     state.module.AddFunction(spv::OpCompositeExtract, TypeF32(state), weight, weights, component + 1u);
+    if (smoothOffset && state.barycentricReciprocalWVariable != 0u) {
+        std::array<std::uint32_t, 3> components{};
+        for (std::uint32_t index = 0; index < components.size(); ++index) {
+            components[index] = state.module.AllocateId();
+            state.module.AddFunction(spv::OpCompositeExtract, TypeF32(state), components[index], weights, index);
+        }
+        const auto firstSum = state.module.AllocateId();
+        state.module.AddFunction(spv::OpFAdd, TypeF32(state), firstSum, components[0], components[1]);
+        const auto sum = state.module.AllocateId();
+        state.module.AddFunction(spv::OpFAdd, TypeF32(state), sum, firstSum, components[2]);
+        const auto normalized = state.module.AllocateId();
+        state.module.AddFunction(spv::OpFDiv, TypeF32(state), normalized, weight, sum);
+        return Unary(state, spv::OpBitcast, TypeU32(state), normalized);
+    }
     return Unary(state, spv::OpBitcast, TypeU32(state), weight);
 }
 
@@ -428,7 +446,9 @@ std::uint32_t SelectExportPacking(SpirvEmitterState& state, std::uint32_t target
     const auto packing = state.module.SpecializationConstant(TypeU32(state), PipelineSpecialization::ExportPackingBase + target, static_cast<std::uint32_t>(ColorExportPacking::None));
     const auto packed = EmitCompareU32Constant(state, spv::OpINotEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::None));
     const auto floating = EmitCompareU32Constant(state, spv::OpIEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::Float11_11_10));
-    const auto word = Select(state, TypeU32(state), floating, PackExport(state, IrBufferFormat::Format10_11_11Float, color), PackExport(state, IrBufferFormat::Format11_11_10UNorm, color));
+    const auto small = EmitCompareU32Constant(state, spv::OpIEqual, packing, static_cast<std::uint32_t>(ColorExportPacking::Unorm4_4_4_4));
+    const auto wide = Select(state, TypeU32(state), floating, PackExport(state, IrBufferFormat::Format10_11_11Float, color), PackExport(state, IrBufferFormat::Format11_11_10UNorm, color));
+    const auto word = Select(state, TypeU32(state), small, PackExport(state, IrBufferFormat::Format4_4_4_4UNorm, color), wide);
     std::array<std::uint32_t, 4> components{};
     for (std::uint32_t component = 0; component < components.size(); ++component) {
         const auto unpacked = state.module.AllocateId();
@@ -440,6 +460,39 @@ std::uint32_t SelectExportPacking(SpirvEmitterState& state, std::uint32_t target
     return result;
 }
 
+struct MergeTexel {
+    std::uint32_t resource;
+    std::uint32_t coord;
+    std::uint32_t sample;
+};
+
+MergeTexel MergeTargetTexel(SpirvEmitterState& state) {
+    const auto& pixel = PixelInfo(state);
+    const auto& images = state.program.Info().images;
+    const auto image = std::ranges::find_if(images, [](const ImageResource& candidate) { return candidate.targetMerge; });
+    if (image == images.end()) FailEmit("the color target merge image was not collected");
+    if (InputVariableForKind(state, StageInputKind::FragCoord) == 0u || (pixel.mergeSamples > 1u && InputVariableForKind(state, StageInputKind::SampleId) == 0u)) FailEmit("the color target merge inputs were not declared");
+    if (state.mergeWordVariable == 0u || state.mergePendingVariable == 0u) FailEmit("the color target merge variables were not declared");
+    const auto position = [&](std::uint32_t component) { return Unary(state, spv::OpConvertFToU, TypeU32(state), Unary(state, spv::OpBitcast, TypeF32(state), EmitBuiltinU32(state, StageInputKind::FragCoord, component))); };
+    const auto x = position(0u);
+    const auto y = position(1u);
+    const auto coord = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeConstruct, TypeU32Vector(state, 2u), coord, x, y);
+    return {static_cast<std::uint32_t>(image - images.begin()), coord, pixel.mergeSamples > 1u ? EmitBuiltinU32(state, StageInputKind::SampleId, 0u) : 0u};
+}
+
+void MergeColorTarget(SpirvEmitterState& state, std::uint32_t color) {
+    const auto& pixel = PixelInfo(state);
+    const auto [resource, coord, sample] = MergeTargetTexel(state);
+    const auto stored = state.module.AllocateId();
+    state.module.AddFunction(spv::OpCompositeExtract, TypeU32(state), stored, EmitStorageImageRead(state, resource, coord, sample), 0u);
+    const auto word = PackExport(state, IrBufferFormat::Format4_4_4_4UNorm, color);
+    const auto kept = EmitBinaryU32(state, spv::OpBitwiseAnd, stored, ConstantU32(state, ~static_cast<std::uint32_t>(pixel.mergeMask)));
+    const auto merged = EmitOrU32(state, kept, EmitBinaryU32(state, spv::OpBitwiseAnd, word, ConstantU32(state, pixel.mergeMask)));
+    state.module.AddFunction(spv::OpStore, state.mergeWordVariable, merged);
+    state.module.AddFunction(spv::OpStore, state.mergePendingVariable, ConstantU32(state, 1u));
+}
+
 bool AlphaToCoverage(const SpirvEmitterState& state) {
     return state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && state.inputInfo.pixel->psAlphaToCoverage;
 }
@@ -582,6 +635,10 @@ std::uint32_t ExportVector(SpirvValueEmitContext& ctx, std::uint32_t data, const
     return vector;
 }
 
+float PointSizeFloor(const ShaderVertexInputInfo& vertex) {
+    return std::max(vertex.pointSizeMin, std::numeric_limits<float>::min());
+}
+
 void EmitAuxPositionExport(SpirvValueEmitContext& ctx, std::uint32_t data, const ExportInfo& exp) {
     auto& state = ctx.state;
     if (state.inputInfo.vertex == nullptr) {
@@ -614,7 +671,13 @@ void EmitAuxPositionExport(SpirvValueEmitContext& ctx, std::uint32_t data, const
         const auto f32 = state.module.AllocateId();
         state.module.AddFunction(spv::OpBitcast, TypeF32(state), f32, raw);
         if (output.pointSize) {
-            state.module.AddFunction(spv::OpStore, state.pointSizeVariable, f32);
+            auto size = f32;
+            if (state.inputInfo.vertex->pointList) {
+                size = state.module.AllocateId();
+                state.module.AddFunction(spv::OpExtInst, TypeF32(state), size, GlslStd450(state), GLSLstd450FClamp, f32, ConstantF32(state, std::bit_cast<std::uint32_t>(PointSizeFloor(*state.inputInfo.vertex))), ConstantF32(state, std::bit_cast<std::uint32_t>(state.inputInfo.vertex->pointSizeMax)));
+            }
+            const auto pointer = state.program.Resources().stage == IrShaderStage::Mesh ? MeshOutputPointer(state, StageOutputKind::PointSize) : state.pointSizeVariable;
+            state.module.AddFunction(spv::OpStore, pointer, size);
             continue;
         }
         const auto storeDistance = [&](StageOutputKind kind, std::uint32_t variable, std::uint32_t index) {
@@ -744,6 +807,26 @@ std::uint32_t ConvertPositionToClipSpace(SpirvEmitterState& state, std::uint32_t
 
 }
 
+void FlushColorTargetMerge(SpirvEmitterState& state) {
+    if (state.mergePendingVariable == 0u) return;
+    const auto pending = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, TypeU32(state), pending, state.mergePendingVariable);
+    auto write = Binary(state, spv::OpINotEqual, TypeBool(state), pending, ConstantU32(state, 0u));
+    if (state.pixelValidMaskVariable != 0u) {
+        const auto valid = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), valid, state.pixelValidMaskVariable);
+        write = Binary(state, spv::OpLogicalAnd, TypeBool(state), write, Binary(state, spv::OpINotEqual, TypeBool(state), valid, ConstantU32(state, 0u)));
+    }
+    EmitIfCondition(state, write, [&] {
+        const auto [resource, coord, sample] = MergeTargetTexel(state);
+        const auto merged = state.module.AllocateId();
+        state.module.AddFunction(spv::OpLoad, TypeU32(state), merged, state.mergeWordVariable);
+        const auto texel = state.module.AllocateId();
+        state.module.AddFunction(spv::OpCompositeConstruct, TypeU32Vector(state, 4u), texel, merged, ConstantU32(state, 0u), ConstantU32(state, 0u), ConstantU32(state, 0u));
+        EmitStorageImageWrite(state, resource, 0u, coord, texel, sample);
+    });
+}
+
 namespace {
 
 std::uint32_t MeshArray(SpirvEmitterState& state, std::uint32_t storage, std::uint32_t type, std::uint32_t count) {
@@ -772,7 +855,7 @@ std::uint32_t MeshOutputType(SpirvEmitterState& state, StageOutputKind kind) {
     if (kind == StageOutputKind::Layer) {
         return TypeU32(state);
     }
-    return IsMeshDistance(kind) ? TypeF32(state) : TypeF32Vector(state, 4u);
+    return IsMeshDistance(kind) || kind == StageOutputKind::PointSize ? TypeF32(state) : TypeF32Vector(state, 4u);
 }
 
 std::uint32_t MeshDistancePointer(SpirvEmitterState& state, const SpirvOutputBinding& output, std::uint32_t vertex) {
@@ -840,6 +923,20 @@ std::uint32_t TessellationPointer(SpirvValueEmitContext& ctx, const IrValue& ins
         state.module.AddFunction(spv::OpAccessChain, type, pointer, variable, vertex, ConstantU32(state, constant % stride / 16u), ConstantU32(state, constant % stride % 16u / 4u));
         return pointer;
     }
+    if (inst.Argument(1)->HasImmediate()) {
+        const auto value = inst.Argument(1)->ImmediateU32();
+        const auto offset = patch ? value : value % stride;
+        const auto attribute = ConstantU32(state, offset >> 4u);
+        const auto component = ConstantU32(state, (offset >> 2u) & 3u);
+        if (kind == TessellationAttribute::LocalOutput || patch) {
+            state.module.AddFunction(spv::OpAccessChain, type, pointer, variable, attribute, component);
+            return pointer;
+        }
+        const bool own = kind == TessellationAttribute::ControlOutput || (kind == TessellationAttribute::ControlShared && !sharedRead);
+        const auto controlPoint = kind == TessellationAttribute::ControlInput ? std::min(value / stride, state.inputInfo.vertex->tess.inputControlPoints - 1u) : kind == TessellationAttribute::EvaluationInput ? std::min(value / stride, state.inputInfo.vertex->tess.outputControlPoints - 1u) : value / stride;
+        state.module.AddFunction(spv::OpAccessChain, type, pointer, variable, own ? EmitLaneId(state) : ConstantU32(state, controlPoint), attribute, component);
+        return pointer;
+    }
     const auto offset = patch ? address : EmitBinaryU32(state, spv::OpUMod, address, ConstantU32(state, stride));
     const auto attribute = EmitBinaryU32(state, spv::OpShiftRightLogical, offset, ConstantU32(state, 4u));
     const auto component = EmitBinaryU32(state, spv::OpBitwiseAnd, EmitBinaryU32(state, spv::OpShiftRightLogical, offset, ConstantU32(state, 2u)), ConstantU32(state, 3u));
@@ -962,7 +1059,7 @@ void DefineMeshOutputs(SpirvEmitterState& state) {
             output.meshDataVariable = MeshArray(state, spv::StorageClassPrivate, TypeF32(state), state.laneCount);
             continue;
         }
-        if (output.kind != StageOutputKind::Position && output.kind != StageOutputKind::Parameter && output.kind != StageOutputKind::Layer) {
+        if (output.kind != StageOutputKind::Position && output.kind != StageOutputKind::Parameter && output.kind != StageOutputKind::Layer && output.kind != StageOutputKind::PointSize) {
             throw std::runtime_error("unsupported mesh output kind");
         }
         const auto type = MeshOutputType(state, output.kind);
@@ -978,7 +1075,7 @@ void DefineMeshOutputs(SpirvEmitterState& state) {
         if (output.kind == StageOutputKind::Parameter) {
             state.module.AddAnnotation(spv::OpDecorate, output.variableId, spv::DecorationLocation, output.location);
         } else if (output.kind != StageOutputKind::Layer) {
-            state.module.AddAnnotation(spv::OpDecorate, output.variableId, spv::DecorationBuiltIn, spv::BuiltInPosition);
+            state.module.AddAnnotation(spv::OpDecorate, output.variableId, spv::DecorationBuiltIn, output.kind == StageOutputKind::PointSize ? spv::BuiltInPointSize : spv::BuiltInPosition);
         }
         if (output.kind == StageOutputKind::Position) {
             state.module.AddAnnotation(spv::OpDecorate, output.variableId, spv::DecorationInvariant);
@@ -1069,6 +1166,15 @@ void EmitMeshEntryPoint(SpirvEmitterState& state) {
     EmitLabel(state, state.module.AllocateId());
     for (std::uint32_t half = 0; half < state.laneCount; half++) {
         state.module.AddFunction(spv::OpStore, MeshElement(state, state.meshPrimitiveData, spv::StorageClassPrivate, TypeU32(state), ConstantU32(state, half)), ConstantU32(state, 0x80000000u));
+        if (state.inputInfo.vertex->pointList) {
+            const auto& vertex = *state.inputInfo.vertex;
+            const bool fromVertex = (vertex.paClVsOutCntl & (1u << 16u)) != 0u;
+            if (!fromVertex && !(vertex.pointSize > 0.0f)) FailEmit("mesh points need a positive PA_SU_POINT_SIZE");
+            if (fromVertex && !(vertex.pointSizeMax > 0.0f)) FailEmit("mesh point sizes need a positive PA_SU_POINT_MINMAX maximum");
+            const auto size = fromVertex ? std::clamp(vertex.pointSize, PointSizeFloor(vertex), vertex.pointSizeMax) : vertex.pointSize;
+            state.laneHalf = half;
+            state.module.AddFunction(spv::OpStore, MeshOutputPointer(state, StageOutputKind::PointSize), ConstantF32(state, std::bit_cast<std::uint32_t>(size)));
+        }
     }
     const auto firstInvocation = state.module.AllocateId();
     state.laneHalf = 0;
@@ -1475,12 +1581,17 @@ void EmitProgram(SpirvEmitterState& state) {
         state.pixelValidMaskVariable = state.module.AllocateId();
         state.module.AddName(state.pixelValidMaskVariable, "pixel_valid_mask_active");
     }
+    if (state.program.Resources().stage == IrShaderStage::Pixel && state.inputInfo.pixel != nullptr && state.inputInfo.pixel->mergeMask != 0u) {
+        state.mergeWordVariable = state.module.AllocateId();
+        state.mergePendingVariable = state.module.AllocateId();
+    }
     for (const IrBlock* block : program.BlockOrder()) {
         const auto label = state.module.AllocateId();
         state.labels.emplace(block, label);
     }
     DefineGetBdaPointer(state);
     DefineDot2F32F16Function(state);
+    DefineReciprocalCorrectionFunction(state);
     for (const IrBlock* block : program.BlockOrder()) {
         const bool needsScratch = std::any_of(block->Instructions().begin(), block->Instructions().end(), [](const IrValue* inst) {
             return inst->Opcode() == IrOpcode::SwizzleU32;
@@ -1501,7 +1612,7 @@ void EmitProgram(SpirvEmitterState& state) {
     }
     state.module.AddFunction(spv::OpFunction, TypeVoid(state), state.meshGuestFunc != 0u ? state.meshGuestFunc : state.pixelGuestFunc != 0u ? state.pixelGuestFunc : state.mainFunc, spv::FunctionControlMaskNone, TypeFunction(state));
     EmitLabel(state, state.entryLabel);
-    if (state.requirements.functionLds) {
+    if (state.requirements.functionLds && !state.pixelFunctionLdsBuffer) {
         state.module.AddFunction(spv::OpVariable, TypeU32ArrayPointer(state, spv::StorageClassFunction, LdsStorageDwords(state)), state.ldsVariable, spv::StorageClassFunction);
     }
     if (state.requirements.functionScratch) {
@@ -1523,6 +1634,10 @@ void EmitProgram(SpirvEmitterState& state) {
     if (state.pixelValidMaskVariable != 0u) {
         state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), state.pixelValidMaskVariable, spv::StorageClassFunction);
     }
+    if (state.mergePendingVariable != 0u) {
+        state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), state.mergeWordVariable, spv::StorageClassFunction);
+        state.module.AddFunction(spv::OpVariable, TypePointer(state, spv::StorageClassFunction, TypeU32(state)), state.mergePendingVariable, spv::StorageClassFunction, ConstantU32(state, 0u));
+    }
     for (std::uint32_t half = 0; half < state.laneCount; half++) {
         auto& lane = half == 0u ? ctx : high;
         if (lane.scratchU32Variable != 0u) {
@@ -1559,6 +1674,14 @@ void EmitProgram(SpirvEmitterState& state) {
     }
     if (AlphaToCoverage(state)) StoreCoverage(state, ConstantI32(state, -1));
     EmitBdaAnchors(state);
+    if (state.pointSizeVariable != 0u && state.inputInfo.vertex != nullptr && state.inputInfo.vertex->pointList) {
+        const auto& vertex = *state.inputInfo.vertex;
+        const bool fromVertex = (vertex.paClVsOutCntl & (1u << 16u)) != 0u;
+        if (!fromVertex && !(vertex.pointSize > 0.0f)) FailEmit("a point list without a vertex point size needs a positive PA_SU_POINT_SIZE");
+        if (fromVertex && !(vertex.pointSizeMax > 0.0f)) FailEmit("a vertex point size needs a positive PA_SU_POINT_MINMAX maximum");
+        const auto size = fromVertex ? std::clamp(vertex.pointSize, PointSizeFloor(vertex), vertex.pointSizeMax) : vertex.pointSize;
+        state.module.AddFunction(spv::OpStore, state.pointSizeVariable, ConstantF32(state, std::bit_cast<std::uint32_t>(size)));
+    }
     if (OrderedPixelShader(state)) {
         state.module.AddFunction(spv::OpBeginInvocationInterlockEXT);
     }
@@ -1611,6 +1734,7 @@ void EmitProgram(SpirvEmitterState& state) {
         if (state.quadSampleCoverage != 0u) StoreCoverage(state, ConstantI32(state, -1));
     }
     if (program.BlockOrder().empty()) {
+        FlushColorTargetMerge(state);
         if (OrderedPixelShader(state)) {
             state.module.AddFunction(spv::OpEndInvocationInterlockEXT);
         }
@@ -1898,6 +2022,10 @@ void EmitSetAttribute(SpirvValueEmitContext& ctx, const IrValue& inst) {
             value = mapped;
             if (exp.index == 0u && !uintOutput && AlphaToCoverage(state)) StoreAlphaCoverage(state, value);
             const auto mode = MrtOutputMode(state, exp);
+            if (PixelInfo(state).mergeMask != 0u && exp.index == PixelInfo(state).mergeTarget) {
+                if (uintOutput || mode == 5u || mode == 6u) FailEmit("a partial write of a packed color target cannot take an integer or 16-bit normalized export");
+                MergeColorTarget(state, value);
+            }
             if (!uintOutput && mode != 5u && mode != 6u) value = SelectExportPacking(state, exp.index, value);
         }
         if (exp.kind == ExportTargetKind::Position) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp
index 4a319c4f65..2b089a3e8f 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvOptimizer.cpp
@@ -3,16 +3,59 @@
 #include <spirv-tools/optimizer.hpp>
 #include <spirv/unified1/spirv.hpp>
 #include <array>
+#include <atomic>
 #include <cstdlib>
+#include <exception>
 #include <map>
 #include <stdexcept>
 #include <string>
+#include <thread>
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#else
+#include <pthread.h>
+#endif
 
 namespace ShaderRecompiler {
 
 namespace {
 
 constexpr std::uint32_t ScalarReplacementLimit = 64;
+constexpr std::uintptr_t InlineOptimizerStackBytes = 256 * 1024;
+
+std::atomic<std::uint64_t> optimizerHostThreads{0};
+
+bool StackHoldsOptimizer() {
+#ifdef _WIN32
+    ULONG_PTR low = 0;
+    ULONG_PTR high = 0;
+    GetCurrentThreadStackLimits(&low, &high);
+#else
+    struct Bounds {
+        std::uintptr_t low = 0;
+        std::uintptr_t high = 0;
+        Bounds() {
+            pthread_attr_t attributes;
+            if (pthread_getattr_np(pthread_self(), &attributes) != 0) return;
+            void* base = nullptr;
+            std::size_t size = 0;
+            if (pthread_attr_getstack(&attributes, &base, &size) == 0 && base != nullptr) {
+                low = reinterpret_cast<std::uintptr_t>(base);
+                high = low + size;
+            }
+            pthread_attr_destroy(&attributes);
+        }
+    };
+    thread_local const Bounds bounds;
+    const auto low = bounds.low;
+    const auto high = bounds.high;
+#endif
+    const auto frame = reinterpret_cast<std::uintptr_t>(__builtin_frame_address(0));
+    return frame >= low && frame < high && frame - low >= InlineOptimizerStackBytes;
+}
 
 bool HasLimitedUseTypes(std::span<const std::uint32_t> spirv) {
     if (spirv.size() < 5) throw std::runtime_error("SPIRV-Tools: incomplete module header");
@@ -101,9 +144,7 @@ std::vector<std::uint32_t> CollapseBlockBallots(std::span<const std::uint32_t> s
     return collapsed;
 }
 
-}
-
-std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand, bool optimize, bool specialize) {
+std::vector<std::uint32_t> ValidateAndOptimizeSpirvInline(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand, bool optimize, bool specialize) {
     spv_target_env environment;
     const auto apiVersion = vulkanVersion & ~0xfffu;
     std::uint32_t maxSpirvVersion = 0;
@@ -222,3 +263,26 @@ std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_
 }
 
 }
+
+std::vector<std::uint32_t> ValidateAndOptimizeSpirv(std::span<const std::uint32_t> spirv, std::uint32_t vulkanVersion, std::uint32_t spirvVersion, bool allowOffsetTextureOperand, bool optimize, bool specialize) {
+    if (StackHoldsOptimizer()) return ValidateAndOptimizeSpirvInline(spirv, vulkanVersion, spirvVersion, allowOffsetTextureOperand, optimize, specialize);
+    std::vector<std::uint32_t> result;
+    std::exception_ptr failure;
+    std::thread host([&] {
+        try {
+            result = ValidateAndOptimizeSpirvInline(spirv, vulkanVersion, spirvVersion, allowOffsetTextureOperand, optimize, specialize);
+        } catch (...) {
+            failure = std::current_exception();
+        }
+    });
+    optimizerHostThreads.fetch_add(1, std::memory_order_relaxed);
+    host.join();
+    if (failure) std::rethrow_exception(failure);
+    return result;
+}
+
+std::uint64_t OptimizerHostThreads() {
+    return optimizerHostThreads.load(std::memory_order_relaxed);
+}
+
+}
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
index aa7dc2bbe8..f3736dc698 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
@@ -5,8 +5,11 @@
 #include "SpirvBackend/SpirvMemory/SpirvSubgroup.hpp"
 #include "SpirvBackend/SpirvMemory/SpirvInputOutput.hpp"
 #include "PipelineSpecialization.hpp"
+#include "RdnaDecoder/RdnaDescriptorFormat.hpp"
+#include "RdnaDecoder/RdnaInstructionDecoder.hpp"
 #include <algorithm>
 #include <array>
+#include <span>
 #include <utility>
 #include <string>
 #include <vector>
@@ -47,6 +50,23 @@ std::uint32_t nonzero(SpirvEmitterState& state, std::uint32_t value) {
     return Binary(state, spv::OpINotEqual, TypeBool(state), value, ConstantU32(state, 0u));
 }
 
+std::uint32_t gcnWord3(SpirvEmitterState& state, std::uint32_t word1, std::uint32_t word3) {
+    const auto u32 = TypeU32(state);
+    const auto& formats = GcnBufferFormats();
+    std::array<std::uint32_t, 128> words{};
+    for (std::size_t index = 0; index < words.size(); ++index) words[index] = ConstantU32(state, formats[index]);
+    const auto arrayType = state.module.Type(spv::OpTypeArray, u32, ConstantU32(state, static_cast<std::uint32_t>(words.size())));
+    if (state.gcnBufferFormatVariable == 0) state.gcnBufferFormatVariable = state.module.DefineGlobalVariable(TypePointer(state, spv::StorageClassPrivate, arrayType), spv::StorageClassPrivate);
+    state.module.AddFunction(spv::OpStore, state.gcnBufferFormatVariable, state.module.Constant(spv::OpConstantComposite, arrayType, std::span<const std::uint32_t>(words)));
+    const auto pointer = state.module.AllocateId();
+    state.module.AddFunction(spv::OpAccessChain, TypePointer(state, spv::StorageClassPrivate, u32), pointer, state.gcnBufferFormatVariable, field(state, word3, 12u, 7u));
+    const auto format = state.module.AllocateId();
+    state.module.AddFunction(spv::OpLoad, u32, format, pointer);
+    const auto outOfBounds = Select(state, u32, nonzero(state, field(state, word1, 16u, 14u)), ConstantU32(state, 1u << 28u), ConstantU32(state, 3u << 28u));
+    const auto kept = Binary(state, spv::OpBitwiseAnd, u32, word3, ConstantU32(state, 0xc0e00fffu));
+    return Binary(state, spv::OpBitwiseOr, u32, Binary(state, spv::OpBitwiseOr, u32, kept, Binary(state, spv::OpShiftLeftLogical, u32, format, ConstantU32(state, 12u))), outOfBounds);
+}
+
 void faultIf(SpirvValueEmitContext& context, const IrValue& instruction, std::uint32_t condition, std::uint32_t address, std::uint32_t bytes, BdaAbi::FaultReason reason) {
     auto& state = context.state;
     EmitIfCondition(state, condition, [&] { RecordBdaFault(state, address, ConstantU32(state, bytes), BdaInstructionPc(state, instruction), reason); });
@@ -60,14 +80,16 @@ RuntimeDescriptor descriptor(SpirvValueEmitContext& context, const IrValue& inst
     const auto& memory = context.Memory(instruction);
     const bool runtime = memory.gpuDescriptor || state.registrationModules;
     const auto first = PipelineSpecialization::BufferBase + memory.resource * PipelineSpecialization::BufferWords;
-    const auto word1 = runtime ? context.Arg(*handle, 1u) : state.module.SpecializationConstant(TypeU32(state), first, 0u);
+    auto word1 = runtime ? context.Arg(*handle, 1u) : state.module.SpecializationConstant(TypeU32(state), first, 0u);
+    if (runtime && GcnGuestShaders()) word1 = Binary(state, spv::OpBitwiseAnd, TypeU32(state), word1, ConstantU32(state, GcnBufferWord1Mask));
     const bool runtimeFormat = memory.gpuDescriptor || (state.registrationModules && !state.program.Info().buffers.at(memory.resource).descriptorFormatted);
-    const auto word3 = runtimeFormat ? context.Arg(*handle, 3u) : state.module.SpecializationConstant(TypeU32(state), first + 1u, 0u);
+    auto word3 = runtimeFormat ? context.Arg(*handle, 3u) : state.module.SpecializationConstant(TypeU32(state), first + 1u, 0u);
+    if (runtimeFormat && GcnGuestShaders()) word3 = gcnWord3(state, word1, word3);
     const auto u32 = TypeU32(state);
     auto base = ConstantU32(state, 0u);
     if (memory.gpuDescriptor || BufferAccessOf(instruction.Opcode()) == BufferAccess::Atomic) {
         const auto u64 = TypeScalarU64(state);
-        const auto high = Binary(state, spv::OpShiftLeftLogical, u64, Unary(state, spv::OpUConvert, u64, field(state, context.Arg(*handle, 1u), 0u, 16u)), BdaConstant(state, 32u));
+        const auto high = Binary(state, spv::OpShiftLeftLogical, u64, Unary(state, spv::OpUConvert, u64, field(state, GcnGuestShaders() ? Binary(state, spv::OpBitwiseAnd, u32, context.Arg(*handle, 1u), ConstantU32(state, GcnBufferWord1Mask)) : context.Arg(*handle, 1u), 0u, 16u)), BdaConstant(state, 32u));
         base = Binary(state, spv::OpBitwiseOr, u64, Unary(state, spv::OpUConvert, u64, context.Arg(*handle, 0u)), high);
     }
     auto invalid = nonzero(state, field(state, word3, 30u, 2u));
@@ -142,8 +164,20 @@ MemoryResourceAccess directAccess(SpirvValueEmitContext& context, const IrValue&
     state.module.AddFunction(spv::OpAccessChain, wide ? TypeStorageBufferU64Pointer(state) : TypeStorageBufferPointer(state), access.objectPointer, variable, ConstantU32(state, element));
     access.byteOffset = state.memoryByteOffsets.at(element);
     access.memoryAccess = memory.coherent ? spv::MemoryAccessVolatileMask : 0u;
-    access.length = state.module.AllocateId();
-    state.module.AddFunction(spv::OpArrayLength, TypeU32(state), access.length, access.objectPointer, 0u);
+    {
+        const auto* descriptor = instruction.Argument(0u)->Resolve();
+        std::array<const IrValue*, 4> key{};
+        for (std::size_t index = 0; index < key.size(); ++index) key[index] = descriptor->Argument(index)->Resolve();
+        const auto found = std::find_if(state.bufferLengths.begin(), state.bufferLengths.end(), [&](const auto& entry) {
+            return entry.descriptor == key && entry.variable == variable && entry.element == element && entry.label == state.currentLabel;
+        });
+        if (found != state.bufferLengths.end()) access.length = found->length;
+        else {
+            access.length = state.module.AllocateId();
+            state.module.AddFunction(spv::OpArrayLength, TypeU32(state), access.length, access.objectPointer, 0u);
+            state.bufferLengths.push_back({key, variable, element, state.currentLabel, access.length});
+        }
+    }
     return access;
 }
 
@@ -446,7 +480,7 @@ std::uint32_t genericFormattedLoad(SpirvValueEmitContext& context, const IrValue
             const auto fromMemory = Binary(state, spv::OpUGreaterThanEqual, boolean, selectors[output], constant(4u));
             required[component] = Binary(state, spv::OpLogicalOr, boolean, required[component], both(state, fromMemory, equal(state, selected[output], constant(component))));
         }
-        required[component] = both(state, active[component], required[component]);
+        required[component] = Select(state, boolean, active[component], required[component], ConstantBool(state, false));
         const auto componentOffset = field(state, byteOffsets, component * 8u, 8u);
         const auto bytes = Select(state, u32, packed, constant(4u), Binary(state, spv::OpShiftRightLogical, u32, bits[component], constant(3u)));
         const auto offset = Binary(state, spv::OpIAdd, u32, resource.offset != 0u ? resource.offset : Binary(state, spv::OpIAdd, u32, context.Arg(instruction, 2u), constant(memory.offset)), componentOffset);
@@ -454,21 +488,23 @@ std::uint32_t genericFormattedLoad(SpirvValueEmitContext& context, const IrValue
         if (memory.gpuDescriptor) {
             const auto u64 = TypeScalarU64(state);
             const auto guest = Binary(state, spv::OpIAdd, u64, resource.base, Unary(state, spv::OpUConvert, u64, addresses[component].guest));
-            const auto overflow = both(state, active[component], Binary(state, spv::OpULessThan, boolean, guest, resource.base));
+            const auto overflow = Select(state, boolean, active[component], Binary(state, spv::OpULessThan, boolean, guest, resource.base), ConstantBool(state, false));
             EmitIfCondition(state, overflow, [&] { RecordBdaFault(state, resource.base, constant(0u), BdaInstructionPc(state, instruction), BdaAbi::FaultReason::Overflow); });
             StopBdaInvocationIf(state, overflow);
             addresses[component].guest = guest;
         }
-        inBounds = both(state, inBounds, Binary(state, spv::OpLogicalOr, boolean, Unary(state, spv::OpLogicalNot, boolean, required[component]), addresses[component].inBounds));
+        inBounds = Select(state, boolean, required[component], both(state, inBounds, addresses[component].inBounds), inBounds);
     }
     std::array<std::uint32_t, 4> values{};
     for (std::uint32_t component = 0; component < 4u; ++component) {
-        values[component] = EmitValueOrZeroIfCondition(state, both(state, inBounds, required[component]), [&] {
+        values[component] = EmitValueOrZeroIfCondition(state, Select(state, boolean, required[component], inBounds, ConstantBool(state, false)), [&] {
             const auto width = Select(state, u32, packed, constant(32u), bits[component]);
             const auto dword = equal(state, width, constant(32u));
-            const auto raw = EmitValueIfElse(state, dword, u32, [&] { return readBuffer(context, instruction, addresses[component].guest, 32u); }, [&] {
-                return EmitBdaReadBytes(context, instruction, addresses[component].guest, Binary(state, spv::OpShiftRightLogical, u32, width, constant(3u)));
-            });
+            const auto raw = memory.gpuDescriptor
+                ? EmitValueIfElse(state, dword, u32, [&] { return readBuffer(context, instruction, addresses[component].guest, 32u); }, [&] {
+                    return EmitBdaReadBytes(context, instruction, addresses[component].guest, Binary(state, spv::OpShiftRightLogical, u32, width, constant(3u)));
+                })
+                : Binary(state, spv::OpShiftRightLogical, u32, readBuffer(context, instruction, addresses[component].guest, 32u), Select(state, u32, dword, constant(0u), Binary(state, spv::OpShiftLeftLogical, u32, EmitAndConstant(state, addresses[component].guest, 3u), constant(3u))));
             const auto bitOffset = Select(state, u32, packed, field(state, bitOffsets, component * 8u, 8u), constant(0u));
             const auto unsignedField = EmitBitFieldUExtract(state, raw, bitOffset, bits[component]);
             const auto signedField = state.module.AllocateId();
@@ -526,7 +562,8 @@ std::uint32_t formattedDispatch(SpirvValueEmitContext& context, const IrValue& i
     }
     const auto* word = instruction.Argument(0)->Resolve()->Argument(3)->Resolve();
     if (memory.gpuDescriptor && word->HasImmediate()) {
-        const auto format = static_cast<IrBufferFormat>((word->ImmediateU32() >> 12u) & 0x7fu);
+        const auto bits = (word->ImmediateU32() >> 12u) & 0x7fu;
+        const auto format = static_cast<IrBufferFormat>(GcnGuestShaders() ? GcnBufferFormats()[bits] : bits);
         if (format == IrBufferFormat::Invalid) context.Fail(instruction, "formatted buffer instruction has an invalid constant format");
         return formatted(context, instruction, resource, GetFormatInfo(format), components, store, data);
     }
@@ -539,15 +576,15 @@ std::uint32_t formatSwitch(SpirvValueEmitContext& context, const IrValue& instru
     const auto& memory = context.Memory(instruction);
     const auto format = field(state, resource.word3, 12u, 7u);
     constexpr std::uint32_t count = static_cast<std::uint32_t>(IrBufferFormat::Format32_32_32_32Float);
-    if (!store && memory.gpuDescriptor) {
+    if (!store) {
         const auto type = components == 1u ? TypeU32(state) : TypeU32Composite(state, components);
         const auto zero = components == 1u ? ConstantU32(state, 0u) : ConstantU32CompositeZero(state, components);
         const auto unsupported = Binary(state, spv::OpLogicalOr, TypeBool(state), equal(state, format, ConstantU32(state, 0u)), Binary(state, spv::OpUGreaterThan, TypeBool(state), format, ConstantU32(state, count)));
         const auto result = EmitValueIfElse(state, unsupported, type, [&] {
-            RecordBdaFault(state, resource.base, ConstantU32(state, 0u), BdaInstructionPc(state, instruction), BdaAbi::FaultReason::InvalidDescriptor);
+            if (memory.gpuDescriptor) RecordBdaFault(state, resource.base, ConstantU32(state, 0u), BdaInstructionPc(state, instruction), BdaAbi::FaultReason::InvalidDescriptor);
             return zero;
         }, [&] { return genericFormattedLoad(context, instruction, resource, components, format, count); });
-        StopBdaInvocationIf(state, unsupported);
+        if (memory.gpuDescriptor) StopBdaInvocationIf(state, unsupported);
         return result;
     }
     const auto merge = state.module.AllocateId();
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp
index d77a063d72..a47da0f9dd 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvSpecialization.cpp
@@ -580,6 +580,8 @@ public:
         vectorTypes.Reset(bound);
         removed.Reset(bound);
         aliases.Reset(bound);
+        composites.Reset(bound);
+        privateTables.Reset(bound);
         for (std::size_t cursor = 5; cursor < words.size();) {
             const auto count = words[cursor] >> 16u;
             if (count == 0u || count > words.size() - cursor) throw std::runtime_error("truncated prepared SPIR-V instruction");
@@ -596,8 +598,30 @@ public:
             if (op == spv::OpConstant && types.contains(instruction.at(1)) && types.at(instruction[1]).width <= 32u) values.emplace(instruction.at(2), instruction.at(3));
             if (op == spv::OpConstantTrue || op == spv::OpConstantFalse) values.emplace(instruction.at(2), op == spv::OpConstantTrue ? 1u : 0u);
             if ((op == spv::OpConstant || op == spv::OpConstantTrue || op == spv::OpConstantFalse) && values.contains(instruction.at(2))) canonical.emplace(std::pair{instruction.at(1), values.at(instruction[2])}, instruction[2]);
+            if (op == spv::OpConstantComposite && instruction.size() >= 3u) composites.emplace(instruction.at(2), std::vector<std::uint32_t>(instruction.begin() + 3, instruction.end()));
+            if (op == spv::OpVariable && instruction.size() == 5u && (instruction[3] == spv::StorageClassPrivate || instruction[3] == spv::StorageClassFunction) && composites.contains(instruction[4])) privateTables.emplace(instruction.at(2), instruction[4]);
             cursor += count;
         }
+        IdTable<std::uint32_t> tablePointers;
+        tablePointers.Reset(bound);
+        for (const auto& instruction : instructions) {
+            const auto op = Opcode(instruction);
+            if ((op == spv::OpAccessChain || op == spv::OpInBoundsAccessChain) && instruction.size() == 5u && privateTables.contains(instruction[3])) {
+                tablePointers.emplace(instruction[2], instruction[3]);
+                continue;
+            }
+            if (op == spv::OpLoad && instruction.size() == 4u && tablePointers.contains(instruction[3])) continue;
+            if (op == spv::OpVariable || op == spv::OpEntryPoint) continue;
+            std::uint32_t switchLiteralWords = 1u;
+            if (op == spv::OpSwitch && instruction.size() > 1u) {
+                const auto* selectorType = resultTypes.find(instruction[1]);
+                if (selectorType != nullptr && types.contains(*selectorType) && types.at(*selectorType).width == 64u) switchLiteralWords = 2u;
+            }
+            VisitIdOperands(instruction, switchLiteralWords, [&](std::size_t index) {
+                privateTables.erase(instruction[index]);
+                if (const auto* table = tablePointers.find(instruction[index])) privateTables.erase(*table);
+            });
+        }
     }
 
     std::vector<std::uint32_t> Run() {
@@ -637,11 +661,17 @@ private:
         return found != nullptr && *found == type;
     }
 
-    std::optional<std::uint32_t> evaluate(const Instruction& instruction) const {
+    std::optional<std::uint32_t> evaluate(const Instruction& instruction, const IdTable<std::pair<std::uint32_t, std::uint32_t>>& constPointers) const {
         const auto op = Opcode(instruction);
         if (instruction.size() < 4u) return std::nullopt;
         const auto* type = types.find(instruction[1]);
         if (type == nullptr || type->width > 32u) return std::nullopt;
+        if (op == spv::OpLoad && instruction.size() == 4u) {
+            const auto* pointer = constPointers.find(instruction[3]);
+            if (pointer == nullptr) return std::nullopt;
+            const auto& elements = composites.at(pointer->first);
+            return pointer->second < elements.size() ? value(elements[pointer->second]) : std::nullopt;
+        }
         const auto left = value(instruction[3]);
         if (!left) return std::nullopt;
         if (op == spv::OpCopyObject) return left;
@@ -690,16 +720,42 @@ private:
         extracts.Reset(bound);
         IdTable<std::uint32_t> bitcasts;
         bitcasts.Reset(bound);
+        IdTable<std::pair<std::uint32_t, std::uint32_t>> constPointers;
+        constPointers.Reset(bound);
         for (auto& instruction : instructions) {
             if (instruction.empty()) continue;
             auto op = Opcode(instruction);
             if (op == spv::OpFunction) function = true;
             if (op == spv::OpFunctionEnd) function = false;
             if (!function) continue;
+            if ((op == spv::OpAccessChain || op == spv::OpInBoundsAccessChain) && instruction.size() == 5u && privateTables.contains(instruction[3])) {
+                if (const auto index = value(instruction[4])) constPointers.emplace(instruction[2], std::pair{privateTables.at(instruction[3]), *index});
+            }
             if (op == spv::OpSelect && instruction.size() == 6u) {
                 if (const auto condition = value(instruction[3])) {
                     instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[*condition != 0u ? 4u : 5u]});
                     changed = true;
+                } else if (instruction[4] == instruction[5]) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[4]});
+                    changed = true;
+                }
+            }
+            if (op == spv::OpLogicalAnd && instruction.size() == 5u) {
+                if (const auto left = value(instruction[3]); left && *left != 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[4]});
+                    changed = true;
+                } else if (const auto right = value(instruction[4]); right && *right != 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[3]});
+                    changed = true;
+                }
+            }
+            if (op == spv::OpLogicalOr && instruction.size() == 5u) {
+                if (const auto left = value(instruction[3]); left && *left == 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[4]});
+                    changed = true;
+                } else if (const auto right = value(instruction[4]); right && *right == 0u) {
+                    instruction = Make(spv::OpCopyObject, {instruction[1], instruction[2], instruction[3]});
+                    changed = true;
                 }
             }
             if (op == spv::OpVectorExtractDynamic && instruction.size() == 5u) {
@@ -742,7 +798,7 @@ private:
                 }
             }
             if (op == spv::OpCopyObject && values.contains(instruction.at(2))) continue;
-            const auto result = evaluate(instruction);
+            const auto result = evaluate(instruction, constPointers);
             if (!result) continue;
             const auto type = types.at(instruction[1]);
             const auto bits = type.width == 32u ? *result : *result & ((1u << type.width) - 1u);
@@ -1092,6 +1148,8 @@ private:
     IdSet vectorTypes;
     IdSet removed;
     IdTable<std::uint32_t> aliases;
+    IdTable<std::vector<std::uint32_t>> composites;
+    IdTable<std::uint32_t> privateTables;
     std::map<std::pair<std::uint32_t, std::uint32_t>, std::uint32_t> canonical;
 };
 
diff --git a/core/shader/recompiler/StencilReplay.cpp b/core/shader/recompiler/StencilReplay.cpp
index fae2057358..30bc43b765 100644
--- a/core/shader/recompiler/StencilReplay.cpp
+++ b/core/shader/recompiler/StencilReplay.cpp
@@ -270,6 +270,7 @@ private:
             if (lowBallot && highBallot) {
                 const auto low = onHelper(lowBallot->Argument(0), depth + 1u), high = onHelper(highBallot->Argument(0), depth + 1u);
                 if (low && high && *low == 0u && *high == 0u) result = HelperMask::RealOnly;
+                else if (Boolean(lowBallot->Argument(0), true) && Boolean(highBallot->Argument(0), true)) result = HelperMask::QuadStable;
             } else if (mask.low->Opcode() == IrOpcode::BitwiseAnd32 && (waveSize == 32u || mask.high->Opcode() == IrOpcode::BitwiseAnd32)) {
                 const auto pair = [&](unsigned low, unsigned high) { return ReplayMask{mask.low->Argument(low)->Resolve(), waveSize == 32u ? mask.low->Argument(low)->Resolve() : mask.high->Argument(high)->Resolve()}; };
                 const auto combine = [&](unsigned firstHigh, unsigned secondHigh) {
@@ -692,7 +693,7 @@ bool StencilReferenceDefinedForKeptInvocations(const IrProgram& program) {
 }
 
 bool StencilReplaySafe(const IrProgram& program) {
-    if (program.Info().sharedMemoryBytes != 0u || program.Info().bdaWrites || program.Info().usesDma || (program.Info().usesFaultBuffer && program.Resources().guardedSrtSlots.empty())) return false;
+    if (program.Info().sharedMemoryBytes != 0u || program.Info().bdaWrites || (program.Info().usesFaultBuffer && program.Resources().guardedSrtSlots.empty())) return false;
     if (program.Info().usesFaultBuffer && !FaultControlFlowAcyclic(program)) return false;
     for (const auto& input : program.Info().inputs) if (input.kind == StageInputKind::PrimitiveId) return false;
     bool masks = false;
diff --git a/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp b/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp
index e54dfdec75..21f6bc7e0e 100644
--- a/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp
+++ b/core/shader/recompiler/Translation/include/Translation/InstructionTranslator.hpp
@@ -36,6 +36,8 @@ struct TranslateOptions {
     bool interpolationFunctions = false;
     bool nativeFloat16 = false;
     bool float32FlushToZero = false;
+    bool float32DenormPreserve = false;
+    bool gcnLegacyVertexInputs = false;
     std::optional<ShaderFloatMode> floatMode;
     ShaderStageInputInfo inputInfo;
     const EmbeddedFetchPlan* embeddedFetch = nullptr;
diff --git a/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp b/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp
index a7748044c4..00da5a7db5 100644
--- a/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp
+++ b/core/shader/recompiler/Translation/include/Translation/TranslationContext.hpp
@@ -25,6 +25,7 @@ public:
     }
     void SetEntryRounding(const RoundingState& state) { setRounding(state); }
     void SetNativeFloat16(bool enabled) { nativeFloat16 = enabled; }
+    void SetFloat32DenormPreserve(bool enabled) { float32DenormPreserve = enabled; }
     void SetFloat32FlushToZero(bool enabled) { float32FlushToZero = enabled; }
     void AddBranchCondition(const BasicBlock& source, BlockInfo& info);
     void TranslateCodeTableLoad(const RdnaInstruction& instruction, const ControlFlowGraph::CodeTableLoad& table);
@@ -81,7 +82,7 @@ private:
     IrU32 flushTinyF16Conversion(IrF32 value, IrU32 bits);
     void writeF16Conversion(const RdnaOperand& operand, IrF32 value, std::initializer_list<IrValue*> sources);
     IrU32 readU32(const RdnaOperand& operand);
-    IrU32 flushF32Denormal(IrU32 bits);
+    IrU32 flushF32Denormal(IrU32 bits, std::uint32_t flushBit = 1u);
     IrF32 flushTinyProduct(IrValue* lhs, IrValue* rhs, IrValue* product, IrValue* addend = nullptr, bool afterRounding = true);
     IrU32 quietNan32(IrU32 bits);
     IrU32 quietNan16(IrU32 bits);
@@ -112,6 +113,7 @@ private:
     std::array<IrU32, 2> writeMask(const RdnaOperand& operand, IrU1 value, bool write64 = false);
     void writeCompareResult(const RdnaOperand& operand, IrU1 value);
     MemoryFlags addMemoryInfo(const MemoryInfo& memory, std::uint32_t pc);
+    bool floatAtomicFlush(IrOpcode opcode) const;
     ExportFlags addExportInfo(const RdnaInstruction& inst);
     AddressOperands readAddressOperands(const RdnaInstruction& inst, std::uint32_t firstSource);
     IrU32 getResourceDword(std::uint32_t index, std::uint32_t dword);
@@ -157,7 +159,6 @@ private:
     bool dsWrite2(const RdnaInstruction& inst);
     bool dsSrc2(const RdnaInstruction& inst, IrOpcode opcode);
     bool dsAtomic2(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue);
-    bool sharedFloatFlush(IrOpcode opcode) const;
     bool dsAtomic64(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue);
     bool dsCondxchg32(const RdnaInstruction& inst);
     bool dsAppendConsume(const RdnaInstruction& inst, IrOpcode opcode);
@@ -387,6 +388,7 @@ private:
     RdnaOpcode currentOpcode = RdnaOpcode::Unknown;
     std::uint32_t f32DenormalFlush = 0u;
     bool float32FlushToZero = false;
+    bool float32DenormPreserve = false;
     std::uint32_t currentProgramCounter = 0;
     std::uint32_t currentVectorLimit = 1;
 };
diff --git a/core/shader/recompiler/Translation/src/ConvertInstructions.cpp b/core/shader/recompiler/Translation/src/ConvertInstructions.cpp
index d14b698c77..4dfdf3ed3b 100644
--- a/core/shader/recompiler/Translation/src/ConvertInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/ConvertInstructions.cpp
@@ -215,15 +215,22 @@ void TranslationContext::vCvtPknormF32(const RdnaInstruction& inst, bool signedV
 }
 
 void TranslationContext::vCvtPkU8F32(const RdnaInstruction& inst) {
-    const IrF32 source(ir.BitCastF32(*readOperand(sourceAt(inst, 0u), IrType::U32)));
+    const IrU32 bits = flushF32Denormal(IrU32(*readOperand(sourceAt(inst, 0u), IrType::U32)));
+    const IrF32 source(ir.BitCastF32(bits.Value()));
     const IrF32 zero(ir.ConstantF32(0.0f));
     const IrU1 nan(ir.Emit(IrOpcode::FPIsNan32, IrType::U1, {&source.Value()}));
     const IrU1 low(ir.Emit(IrOpcode::FPOrdLessThanEqual32, IrType::U1, {&source.Value(), &zero.Value()}));
     const IrU1 high(ir.Emit(IrOpcode::FPOrdGreaterThanEqual32, IrType::U1, {&source.Value(), &ir.ConstantF32(255.0f)}));
-    const IrF32 rounded(ir.Emit(IrOpcode::FPRoundEven32, IrType::F32, {&source.Value()}));
+    const std::uint32_t roundMode = floatMode.has_value() ? floatMode->floatMode & 3u : 0u;
+    const IrOpcode rounding = roundMode == 1u ? IrOpcode::FPCeil32 : roundMode == 2u ? IrOpcode::FPFloor32 : roundMode == 3u ? IrOpcode::FPTrunc32 : IrOpcode::FPRoundEven32;
+    const IrF32 rounded(ir.Emit(rounding, IrType::F32, {&source.Value()}));
     const IrF32 bounded = selectF32(high, IrF32(ir.ConstantF32(255.0f)), rounded);
     const IrF32 safe = selectF32(IrU1(ir.LogicalOr(nan.Value(), low.Value())), zero, bounded);
-    const IrU32 byteValue(ir.Emit(IrOpcode::ConvertU32F32, IrType::U32, {&safe.Value()}));
+    IrU32 byteValue(ir.Emit(IrOpcode::ConvertU32F32, IrType::U32, {&safe.Value()}));
+    if (roundMode == 1u && (f32DenormalFlush & 1u) == 0u) {
+        const IrU1 positiveDenormal(ir.ULessThan(ir.ISub(bits.Value(), ir.Constant(1u)), ir.Constant(0x007fffffu)));
+        byteValue = IrU32(ir.Select(positiveDenormal.Value(), ir.Constant(1u), byteValue.Value()));
+    }
     const IrU32 index(ir.BitwiseAnd(readU32(sourceAt(inst, 1u)).Value(), ir.Constant(3u)));
     const IrU32 shift(ir.ShiftLeftLogical(index.Value(), ir.Constant(3u)));
     const IrU32 mask(ir.ShiftLeftLogical(ir.Constant(0xffu), shift.Value()));
diff --git a/core/shader/recompiler/Translation/src/InstructionTranslator.cpp b/core/shader/recompiler/Translation/src/InstructionTranslator.cpp
index cbd1075512..08393a3942 100644
--- a/core/shader/recompiler/Translation/src/InstructionTranslator.cpp
+++ b/core/shader/recompiler/Translation/src/InstructionTranslator.cpp
@@ -367,6 +367,9 @@ void emitEntryPrologue(IrProgram& program, IrBlock& entryBlock, const TranslateO
         program.Metadata().pixelIteratesSamples = iterated;
         const bool offsets = options.interpolationFunctions && options.fragmentShaderBarycentricEnabled;
         const bool centers = iterated && offsets;
+        if (ps->mergeSamples > 1u && !offsets && ps->SampleLocationsOffCenter() && (loaded(PixelInput::PerspectiveCenter) || loaded(PixelInput::LinearCenter))) {
+            throw std::runtime_error("a partial write of a multisampled packed color target runs the pixel shader once per sample, and without interpolation functions and fragment shader barycentrics its centre-located barycentrics would follow the sample");
+        }
         const bool sampleOffsets = offsets && ps->SampleLocationsOffCenter();
         const auto smoothSample = sampleOffsets ? StageInputKind::BaryCoordSmoothSample : StageInputKind::BaryCoordSmooth;
         const auto linearSample = sampleOffsets ? StageInputKind::BaryCoordNoPerspectiveSample : StageInputKind::BaryCoordNoPerspective;
@@ -446,8 +449,13 @@ void emitEntryPrologue(IrProgram& program, IrBlock& entryBlock, const TranslateO
             entryIr.SetScalarReg(static_cast<ScalarReg>(2), entryIr.Constant((lanes << 12u) | (lanes << 22u)));
             entryIr.SetScalarReg(static_cast<ScalarReg>(3), entryIr.Constant(lanes | (lanes << 8u)));
         }
-        setVector(static_cast<VectorReg>(5), drawIndex(StageInputKind::VertexIndex));
-        setVector(static_cast<VectorReg>(8), drawIndex(StageInputKind::InstanceIndex));
+        if (options.gcnLegacyVertexInputs) {
+            setVector(static_cast<VectorReg>(0), drawIndex(StageInputKind::VertexIndex));
+            for (std::uint32_t reg = 1u; reg <= 3u; reg++) setVector(static_cast<VectorReg>(reg), drawIndex(StageInputKind::InstanceIndex));
+        } else {
+            setVector(static_cast<VectorReg>(5), drawIndex(StageInputKind::VertexIndex));
+            setVector(static_cast<VectorReg>(8), drawIndex(StageInputKind::InstanceIndex));
+        }
     }
 }
 
@@ -591,6 +599,7 @@ IrProgram InstructionTranslator::Translate(const RdnaProgram& decoded, const Con
         context.SetPixelInput(options.inputInfo.pixel, options.fragmentShaderBarycentricEnabled);
         context.SetFloatMode(options.floatMode);
         context.SetNativeFloat16(options.nativeFloat16);
+        context.SetFloat32DenormPreserve(options.float32DenormPreserve);
         context.SetFloat32FlushToZero(options.float32FlushToZero);
         context.SetEntryRounding(entryRounding.at(cfgBlock.id));
         for (std::uint32_t index = cfgBlock.instructionBegin; index < cfgBlock.instructionEnd; index++) {
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp
index 0b6d08a2c3..680ad0ab17 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/BufferInstructions.cpp
@@ -203,7 +203,8 @@ bool TranslationContext::bufferStore(const RdnaInstruction& inst) {
 }
 
 bool TranslationContext::bufferAtomic(const RdnaInstruction& inst, IrOpcode opcode) {
-    const MemoryInfo memory = bufferMemoryInfoFromInstruction(inst);
+    MemoryInfo memory = bufferMemoryInfoFromInstruction(inst);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     IrValue* resource = getBufferResource(memory);
     const BufferAddress address = readBufferAddress(inst);
     const MemoryFlags flags = addMemoryInfo(memory, inst.programCounter);
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp
index 862c65f29b..1115a0615a 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp
@@ -179,7 +179,8 @@ bool TranslationContext::flatStore(const RdnaInstruction& inst) {
 }
 
 bool TranslationContext::flatAtomic(const RdnaInstruction& inst, IrOpcode opcode) {
-    const MemoryInfo memory = flatMemoryInfoFromInstruction(inst);
+    MemoryInfo memory = flatMemoryInfoFromInstruction(inst);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     const AddressOperands address = readAddressOperands(inst, 0u);
     const MemoryFlags flags = addMemoryInfo(memory, inst.programCounter);
     IrValue& active = ir.GetExec();
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp
index c20f9b798c..7815ee9ccd 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/ImageInstructions.cpp
@@ -92,7 +92,8 @@ bool TranslationContext::imageAtomic(const RdnaInstruction& inst, IrOpcode opcod
     if (inst.dataBits == 64u) {
         opcode = imageAtomic64Opcode(opcode);
     }
-    const MemoryInfo memory = imageMemoryInfoFromInstruction(inst);
+    MemoryInfo memory = imageMemoryInfoFromInstruction(inst);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     IrValue* resource = getImageResource(memory);
     IrValue* address = makeImageAddress(inst, inst.source0);
     const MemoryFlags flags = addMemoryInfo(memory, inst.programCounter);
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp
index bff55b085e..75ec8a790c 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp
@@ -32,13 +32,44 @@ MemoryFlags TranslationContext::addMemoryInfo(const MemoryInfo& memory, std::uin
     return MemoryFlags{index, pc};
 }
 
+bool TranslationContext::floatAtomicFlush(IrOpcode opcode) const {
+    switch (opcode) {
+    case IrOpcode::SharedAtomicFMin32:
+    case IrOpcode::SharedAtomicFMax32:
+    case IrOpcode::SharedAtomicCmpstF32:
+    case IrOpcode::SharedAtomicFAdd32:
+    case IrOpcode::BufferAtomicFMin32:
+    case IrOpcode::BufferAtomicFMax32:
+    case IrOpcode::BufferAtomicFCmpSwap32:
+    case IrOpcode::AddressAtomicFMin32:
+    case IrOpcode::AddressAtomicFMax32:
+    case IrOpcode::AddressAtomicFCmpSwap32:
+    case IrOpcode::ImageAtomicFMin32:
+    case IrOpcode::ImageAtomicFMax32:
+    case IrOpcode::ImageAtomicFCmpSwap32:
+        return !floatMode.has_value() || ((floatMode->floatMode >> 4u) & 1u) == 0u;
+    case IrOpcode::SharedAtomicFMin64:
+    case IrOpcode::SharedAtomicFMax64:
+    case IrOpcode::SharedAtomicCmpstF64:
+    case IrOpcode::BufferAtomicFMin64:
+    case IrOpcode::BufferAtomicFMax64:
+    case IrOpcode::BufferAtomicFCmpSwap64:
+    case IrOpcode::AddressAtomicFMin64:
+    case IrOpcode::AddressAtomicFMax64:
+    case IrOpcode::AddressAtomicFCmpSwap64:
+        return floatMode.has_value() && ((floatMode->floatMode >> 6u) & 1u) == 0u;
+    default:
+        return false;
+    }
+}
+
 TranslationContext::AddressOperands TranslationContext::readAddressOperands(const RdnaInstruction& inst, std::uint32_t firstSource) {
     const ResourceKind kind = flatSegmentResourceKind(inst);
     const IrU32 low = readU32(sourceAt(inst, firstSource));
     const RdnaOperand& highOrBase = sourceAt(inst, firstSource + 1u);
     if (kind == ResourceKind::Scratch) {
         IrValue& resource = ir.Emit(IrOpcode::GetScratchResource, IrOpcodeType(IrOpcode::GetScratchResource), {});
-        IrValue& offset = highOrBase.kind != RdnaOperandKind::VectorRegister ? readU32(highOrBase).Value() : low.Value();
+        IrValue& offset = ir.IAdd(low.Value(), readU32(highOrBase).Value());
         return AddressOperands{&resource, &offset, &ir.Constant(0u)};
     }
     if (kind == ResourceKind::Global && highOrBase.kind != RdnaOperandKind::VectorRegister) {
diff --git a/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp b/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp
index a781713ddc..a79d94da4c 100644
--- a/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp
@@ -32,7 +32,7 @@ MemoryInfo sharedMemoryInfoFromInstruction(const RdnaInstruction& inst) {
 
 bool TranslationContext::dsAtomic(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue) {
     MemoryInfo memory = sharedMemoryInfoFromInstruction(inst);
-    memory.flushDenormals = sharedFloatFlush(opcode);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     memory.flushDenormalResults = opcode == IrOpcode::SharedAtomicFAdd32 && (!floatMode.has_value() || ((floatMode->floatMode >> 5u) & 1u) == 0u);
     const IrU32 address = readU32(inst.source0);
     const IrU32 value = readU32(inst.source1);
@@ -213,25 +213,9 @@ bool TranslationContext::dsSrc2(const RdnaInstruction& inst, IrOpcode opcode) {
     return true;
 }
 
-bool TranslationContext::sharedFloatFlush(IrOpcode opcode) const {
-    switch (opcode) {
-    case IrOpcode::SharedAtomicFMin32:
-    case IrOpcode::SharedAtomicFMax32:
-    case IrOpcode::SharedAtomicCmpstF32:
-    case IrOpcode::SharedAtomicFAdd32:
-        return !floatMode.has_value() || ((floatMode->floatMode >> 4u) & 1u) == 0u;
-    case IrOpcode::SharedAtomicFMin64:
-    case IrOpcode::SharedAtomicFMax64:
-    case IrOpcode::SharedAtomicCmpstF64:
-        return floatMode.has_value() && ((floatMode->floatMode >> 6u) & 1u) == 0u;
-    default:
-        return false;
-    }
-}
-
 bool TranslationContext::dsAtomic2(const RdnaInstruction& inst, IrOpcode opcode, bool returnsValue) {
     MemoryInfo memory = sharedMemoryInfoFromInstruction(inst);
-    memory.flushDenormals = sharedFloatFlush(opcode);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     const IrU32 address = readU32(inst.source0);
     const IrU32 data0 = readU32(inst.source1);
     const IrU32 data1 = readU32(inst.source2);
@@ -246,7 +230,7 @@ bool TranslationContext::dsAtomic64(const RdnaInstruction& inst, IrOpcode opcode
         throw std::runtime_error("64-bit GDS atomics are not supported");
     }
     MemoryInfo memory = sharedMemoryInfoFromInstruction(inst);
-    memory.flushDenormals = sharedFloatFlush(opcode);
+    memory.flushDenormals = floatAtomicFlush(opcode);
     const IrU32 address = readU32(inst.source0);
     const IrU64 data0 = readU64(inst.source1);
     IrValue& active = ir.GetExec();
diff --git a/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp b/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp
index ecffac9de7..23ec115894 100644
--- a/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp
+++ b/core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp
@@ -167,6 +167,12 @@ ShaderStageInputInfo BuildShaderStageInputInfo(ShaderStageKind stage, const Gues
         pixelStorage.psIteratesSamples = pixel.iteratesSamples;
         pixelStorage.psPositionLocation = pixel.positionLocation;
         pixelStorage.sampleLocations = pixel.sampleLocations;
+        if (pixel.targetMerge.mask != 0u && (pixel.targetMerge.target >= 8u || (pixel.targetMerge.samples != 1u && pixel.targetMerge.samples != 2u && pixel.targetMerge.samples != 4u && pixel.targetMerge.samples != 8u))) throw std::runtime_error("ShaderInputInfoBuilder: invalid color target merge");
+        pixelStorage.mergeTarget = pixel.targetMerge.target;
+        pixelStorage.mergeMask = pixel.targetMerge.mask;
+        pixelStorage.mergeSamples = pixel.targetMerge.samples;
+        pixelStorage.mergeDepthStencilWrites = pixel.targetMerge.depthStencilWrites;
+        pixelStorage.mergeDepthStencilTests = pixel.targetMerge.depthStencilTests;
         pixelStorage.sampleOrder = pixel.sampleOrder;
         ShaderStageInputInfo result;
         result.pixel = &pixelStorage;
@@ -190,6 +196,10 @@ ShaderStageInputInfo BuildShaderStageInputInfo(ShaderStageKind stage, const Gues
         vertexStorage.fetchEmbedded = vertex.fetchEmbedded;
         vertexStorage.paClVsOutCntl = vertex.paClVsOutCntl;
         vertexStorage.depthRemap = {vertex.depthRemapMode};
+        vertexStorage.pointList = vertex.pointList;
+        vertexStorage.pointSize = vertex.pointSize;
+        vertexStorage.pointSizeMin = vertex.pointSizeMin;
+        vertexStorage.pointSizeMax = vertex.pointSizeMax;
         vertexStorage.fetchExternal = false;
         vertexStorage.fetchAttribReg = static_cast<int>(vertex.fetchAttribReg);
         vertexStorage.fetchBufferReg = static_cast<int>(vertex.fetchBufferReg);
@@ -235,6 +245,7 @@ ShaderStageInputInfo BuildShaderStageInputInfo(ShaderStageKind stage, const Gues
             target.provokingVertex = mesh->provokingVertex;
             target.esgsItemSize = mesh->esgsItemSize;
             target.outputPrimitiveSize = mesh->outputPrimitiveSize;
+            if (target.outputPrimitiveSize == 1u) vertexStorage.pointList = true;
         }
         ShaderStageInputInfo result;
         result.vertex = &vertexStorage;
diff --git a/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp b/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp
index d54715a372..ebec2355da 100644
--- a/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp
+++ b/core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp
@@ -145,8 +145,8 @@ RdnaOperand TranslationContext::plainOperand(const RdnaOperand& operand) {
     return result;
 }
 
-IrU32 TranslationContext::flushF32Denormal(IrU32 bits) {
-    if ((f32DenormalFlush & 1u) == 0u) return bits;
+IrU32 TranslationContext::flushF32Denormal(IrU32 bits, std::uint32_t flushBit) {
+    if ((f32DenormalFlush & flushBit) == 0u) return bits;
     if (bits.Value().HasImmediate()) {
         const std::uint32_t value = bits.Value().ImmediateU32();
         return (value & 0x7f800000u) == 0u ? IrU32(ir.Constant(value & 0x80000000u)) : bits;
@@ -156,7 +156,7 @@ IrU32 TranslationContext::flushF32Denormal(IrU32 bits) {
 }
 
 IrF32 TranslationContext::flushTinyProduct(IrValue* lhs, IrValue* rhs, IrValue* product, IrValue* addend, bool afterRounding) {
-    if ((f32DenormalFlush & 2u) == 0u || keepsProductOutOfTinyRange(*lhs) || keepsProductOutOfTinyRange(*rhs)) return IrF32(*product);
+    if ((f32DenormalFlush & 2u) == 0u || ((f32DenormalFlush & 1u) != 0u && (keepsProductOutOfTinyRange(*lhs) || keepsProductOutOfTinyRange(*rhs)))) return IrF32(*product);
     IrValue& lhsBits = ir.BitCastU32(*lhs);
     IrValue& rhsBits = ir.BitCastU32(*rhs);
     const std::uint32_t roundMode = floatMode.has_value() ? floatMode->floatMode & 3u : 0u;
@@ -249,7 +249,7 @@ void TranslationContext::writeOperand(const RdnaOperand& operand, IrValue* value
     }
     IrType type = value->Type();
     if (type == IrType::F32) {
-        if ((f32DenormalFlush & 2u) != 0u) value = &ir.BitCastF32(flushF32Denormal(IrU32(ir.BitCastU32(*value))).Value());
+        if ((f32DenormalFlush & 2u) != 0u) value = &ir.BitCastF32(flushF32Denormal(IrU32(ir.BitCastU32(*value)), 2u).Value());
         value = &applyF32ResultModifiers(operand, IrF32(*value)).Value();
         type = IrType::F32;
     }
diff --git a/core/shader/recompiler/Translation/src/VectorInstructions.cpp b/core/shader/recompiler/Translation/src/VectorInstructions.cpp
index c02cdba51e..f94148689f 100644
--- a/core/shader/recompiler/Translation/src/VectorInstructions.cpp
+++ b/core/shader/recompiler/Translation/src/VectorInstructions.cpp
@@ -49,12 +49,30 @@ std::uint32_t TranslationContext::f32DenormalFlushFor(const RdnaInstruction& ins
     case RdnaOpcode::VSubrevF32:
     case RdnaOpcode::VMulF32:
     case RdnaOpcode::VMulLegacyF32:
+        if (floatMode.has_value() && (floatMode->floatMode & 3u) == 0u) {
+            const std::uint32_t denormals = (floatMode->floatMode >> 4u) & 3u;
+            if (denormals == 1u || denormals == 2u) {
+                if (!float32DenormPreserve || float32FlushToZero) {
+                    throw std::runtime_error("f32 denormal mode " + std::to_string(denormals) + " at pc " + std::to_string(inst.programCounter) + " needs DenormPreserve 32, which the device does not offer for this shader");
+                }
+                return denormals == 1u ? 2u : 1u;
+            }
+        }
+        flush = 3u;
+        break;
     case RdnaOpcode::VMullitF32:
+        flush = 3u;
+        break;
     case RdnaOpcode::VMinF32:
     case RdnaOpcode::VMaxF32:
     case RdnaOpcode::VMin3F32:
     case RdnaOpcode::VMax3F32:
     case RdnaOpcode::VMed3F32:
+        if (!floatMode.has_value() || ((floatMode->floatMode >> 4u) & 1u) == 0u) return 3u;
+        if (((floatMode->floatMode >> 4u) & 3u) == 1u && (!float32DenormPreserve || float32FlushToZero)) {
+            throw std::runtime_error("f32 denormal mode 1 at pc " + std::to_string(inst.programCounter) + " needs DenormPreserve 32, which the device does not offer for this shader");
+        }
+        return 0u;
     case RdnaOpcode::VFractF32:
     case RdnaOpcode::VFloorF32:
     case RdnaOpcode::VCeilF32:
@@ -119,6 +137,12 @@ std::uint32_t TranslationContext::f32DenormalFlushFor(const RdnaInstruction& ins
     }
     const std::uint32_t denormals = floatMode.has_value() ? (floatMode->floatMode >> 4u) & 3u : 0u;
     if (denormals == 1u || denormals == 2u) {
+        if (inst.op == RdnaOpcode::VMullitF32 && (denormals == 2u || (floatMode->floatMode & 3u) == 0u)) {
+            if (!float32DenormPreserve || float32FlushToZero) {
+                throw std::runtime_error("f32 denormal mode " + std::to_string(denormals) + " at pc " + std::to_string(inst.programCounter) + " needs DenormPreserve 32, which the device does not offer for this shader");
+            }
+            return denormals == 1u ? 2u : 1u;
+        }
         throw std::runtime_error("f32 denormal mode " + std::to_string(denormals) + " at pc " + std::to_string(inst.programCounter) + " is not implemented");
     }
     if (denormals != 0u) return 0u;
diff --git a/core/shader/recompiler/tests/RequestSerializerTests.cpp b/core/shader/recompiler/tests/RequestSerializerTests.cpp
index 2696063735..8229447e9e 100644
--- a/core/shader/recompiler/tests/RequestSerializerTests.cpp
+++ b/core/shader/recompiler/tests/RequestSerializerTests.cpp
@@ -7,6 +7,8 @@
 #include <stdexcept>
 #include <string>
 #include <string_view>
+#include <type_traits>
+#include <utility>
 #include <vector>
 
 namespace {
@@ -45,6 +47,62 @@ void Require(bool condition) {
     if (!condition) std::abort();
 }
 
+template <typename TRange>
+concept AssignableMemory = requires(ShaderRecompiler::GuestContext& context, TRange&& range) {
+    context.memory = std::forward<TRange>(range);
+};
+
+using Region = ShaderRecompiler::MemoryRegion;
+using Regions = std::vector<Region>;
+using RegionArray = std::array<Region, 1>;
+using RegionView = ShaderRecompiler::MemoryRegionView;
+
+static_assert(!AssignableMemory<Regions>);
+static_assert(!AssignableMemory<const Regions>);
+static_assert(!AssignableMemory<RegionArray>);
+static_assert(!AssignableMemory<std::initializer_list<Region>>);
+static_assert(AssignableMemory<Regions&> && AssignableMemory<const Regions&>);
+static_assert(AssignableMemory<RegionArray&> && AssignableMemory<const RegionArray&>);
+static_assert(AssignableMemory<std::span<const Region>> && AssignableMemory<RegionView>);
+static_assert(sizeof(RegionView) == sizeof(std::span<const Region>));
+static_assert(alignof(RegionView) == alignof(std::span<const Region>));
+static_assert(std::is_trivially_copyable_v<RegionView>);
+static_assert(std::is_nothrow_constructible_v<RegionView, std::span<const Region>>);
+static_assert([] {
+    const RegionArray owned{{{0x1000u, {}}}};
+    const RegionView view{std::span<const Region>(owned)};
+    return view.size() == 1u && view.front().guestAddress == 0x1000u;
+}());
+
+void VerifyMemoryView() {
+    const std::array<std::byte, 4> bytes{std::byte{1}, std::byte{2}, std::byte{3}, std::byte{4}};
+    Regions owned{{0x1000u, bytes}};
+    const Regions frozen = owned;
+    Region array[]{{0x2000u, bytes}};
+    RegionArray standard{{{0x3000u, bytes}}};
+    ShaderRecompiler::RecompileRequest request{};
+    request.context.memory = owned;
+    Require(request.context.memory.data() == owned.data());
+    owned.front().guestAddress = 0x4000u;
+    Require(request.context.memory.front().guestAddress == 0x4000u);
+    request.context.memory = frozen;
+    Require(request.context.memory.data() == frozen.data());
+    request.context.memory = array;
+    Require(request.context.memory.data() == array);
+    request.context.memory = standard;
+    Require(request.context.memory.data() == standard.data());
+    request.context.memory = std::span<const Region>(owned).first(1);
+    const auto copy = request;
+    Require(copy.context.memory.data() == owned.data() && copy.context.memory.front().bytes.data() == bytes.data());
+    request.context.memory = {owned.data(), owned.size()};
+    const ShaderRecompiler::RequestSerializer serializer;
+    const auto replay = serializer.Deserialize(serializer.Serialize(request));
+    Require(replay.request.context.memory.size() == 1u && replay.request.context.memory.front().guestAddress == 0x4000u);
+    Require(std::ranges::equal(replay.request.context.memory.front().bytes, bytes));
+    request.context.memory = {};
+    Require(request.context.memory.empty());
+}
+
 void InsertMeshBarycentricFlag(std::vector<std::uint8_t>& bytes) {
     constexpr std::array<std::uint8_t, 20> draw{0x00, 0x34, 0xef, 0xcd, 0xab, 0x00, 0x00, 0x00, 57u, 0u, 0u, 0u, 4u, 0u, 0u, 0u, 9u, 0u, 0u, 0u};
     const auto at = std::search(bytes.begin(), bytes.end(), draw.begin(), draw.end());
@@ -52,9 +110,34 @@ void InsertMeshBarycentricFlag(std::vector<std::uint8_t>& bytes) {
     bytes.insert(at + static_cast<std::ptrdiff_t>(draw.size()), 0u);
 }
 
-void InsertPixelDefaultsAfterFrontFace(std::vector<std::uint8_t>& bytes, bool sampleOrder = true) {
+// Pixel info bytes that follow the stencil operation value flag: the sample order (version 42),
+// then the default color target merge (version 46, 40 bytes with samples = 1 at offset 5).
+std::vector<std::uint8_t> PixelTailDefaults(bool sampleOrder, bool targetMerge) {
+    std::vector<std::uint8_t> tail(sampleOrder ? 16u : 0u, 0u);
+    if (targetMerge) {
+        tail.resize(tail.size() + 40u, 0u);
+        tail[tail.size() - 35u] = 1u;
+    }
+    return tail;
+}
+
+void EraseDefaultTargetMerge(std::vector<std::uint8_t>& bytes, std::ptrdiff_t offset) {
+    const auto merge = PixelTailDefaults(false, true);
+    const auto at = bytes.begin() + offset;
+    Require(bytes.end() - at > static_cast<std::ptrdiff_t>(merge.size()) && std::equal(merge.begin(), merge.end(), at));
+    bytes.erase(at, at + static_cast<std::ptrdiff_t>(merge.size()));
+}
+
+void InsertPixelDefaultsAfterFrontFace(std::vector<std::uint8_t>& bytes, bool sampleOrder = true, bool targetMerge = true) {
     bytes.insert(bytes.begin() + 261u, {0x0fu, 0xffu, 0xffu, 0u, 0u, 0xffu, 0xffu, 0u, 0u, 0xffu, 0xffu, 0u, 0u, 0xffu, 0xffu, 0u, 0u, 0u, 0u, 0u, 0u});
-    bytes.insert(bytes.begin() + 282u, sampleOrder ? 51u : 35u, 0u);
+    bytes.insert(bytes.begin() + 282u, 35u, 0u);
+    const auto tail = PixelTailDefaults(sampleOrder, targetMerge);
+    bytes.insert(bytes.begin() + 317u, tail.begin(), tail.end());
+}
+
+void AppendVertexTail(std::vector<std::uint8_t>& bytes) {
+    bytes.insert(bytes.end(), sizeof(std::uint64_t) + 1u + 5u + 1u + 1u, 0u);
+    bytes.insert(bytes.end(), {0u, 0u, 0u, 0x80u, 0x3fu, 0u, 0u, 0u, 0u, 0u, 0u, 0u, 0u});
 }
 
 std::vector<std::uint8_t> DecodeBase64(std::string_view text) {
@@ -94,6 +177,7 @@ std::string EncodeBase64(const std::vector<std::uint8_t>& bytes) {
 }
 
 int main() {
+    VerifyMemoryView();
     const ShaderRecompiler::RequestSerializer serializer;
 
     const auto historical = serializer.Deserialize(kHistoricalVersion21);
@@ -214,12 +298,15 @@ int main() {
             Require(request.graphics->draw.indexAddress == 0xabcdef3400u && request.graphics->draw.indexCount == 57u && request.graphics->draw.indexElementBytes == 4u && request.graphics->draw.instanceCount == 9u);
             Require(request.target.float16DenormPreserve == preserve);
             auto upgraded = bytes;
-            upgraded[4] = 42u;
+            upgraded[4] = 46u;
             InsertMeshBarycentricFlag(upgraded);
             if (fixture.pixel) upgraded.insert(upgraded.begin() + 258u, {0u, 0u, 0u});
             if (fixture.pixel) InsertPixelDefaultsAfterFrontFace(upgraded);
             if (fixture.tessellation) upgraded.insert(upgraded.end() - 35u, 6u, 0u);
-            upgraded.insert(upgraded.end(), sizeof(std::uint64_t) + 1u + 5u + 1u + 1u, 0u);
+            AppendVertexTail(upgraded);
+            upgraded.push_back(0u);
+            upgraded.push_back(0u);
+            upgraded.insert(upgraded.end(), {0u, 0x10u, 0u, 0u});
             Require(serializer.Serialize(request) == EncodeBase64(upgraded));
             auto truncated = bytes;
             truncated.pop_back();
@@ -254,12 +341,15 @@ int main() {
                     layerRejected = std::string_view(error.what()) == "RequestSerializer: truncated data";
                 }
                 Require(layerRejected);
-                layered[4] = 42u;
+                layered[4] = 46u;
                 InsertMeshBarycentricFlag(layered);
                 layered.insert(layered.begin() + 259u, {0u, 0u});
                 InsertPixelDefaultsAfterFrontFace(layered);
                 if (fixture.tessellation) layered.insert(layered.end() - 35u, 6u, 0u);
-                layered.insert(layered.end(), sizeof(std::uint64_t) + 1u + 5u + 1u + 1u, 0u);
+                AppendVertexTail(layered);
+                layered.push_back(0u);
+                layered.push_back(0u);
+                layered.insert(layered.end(), {0u, 0x10u, 0u, 0u});
                 Require(serializer.Serialize(layerReplay.request) == EncodeBase64(layered));
             }
         }
@@ -280,11 +370,14 @@ int main() {
             Require(replay.request.context.pixel->rasterPrimitive == ShaderRecompiler::RasterPrimitive::Rectangle);
             Require(replay.request.context.vertex->paClVsOutCntl == 0x00050a05u);
             Require(replay.request.target.float16DenormPreserve == preserve);
-            bytes[4] = 42u;
+            bytes[4] = 46u;
             InsertMeshBarycentricFlag(bytes);
             bytes.insert(bytes.begin() + 259u, {0u, 0u});
             InsertPixelDefaultsAfterFrontFace(bytes);
-            bytes.insert(bytes.end(), sizeof(std::uint64_t) + 1u + 5u + 1u + 1u, 0u);
+            AppendVertexTail(bytes);
+            bytes.push_back(0u);
+            bytes.push_back(0u);
+            bytes.insert(bytes.end(), {0u, 0x10u, 0u, 0u});
             Require(serializer.Serialize(replay.request) == EncodeBase64(bytes));
 
             auto truncated23 = DecodeBase64(encoded23);
@@ -408,13 +501,19 @@ int main() {
                 main38[4] = 38u;
                 InsertMeshBarycentricFlag(main38);
                 if (fixture.pixel) main38.insert(main38.begin() + 259u, {0u, 0u});
-                if (fixture.pixel) InsertPixelDefaultsAfterFrontFace(main38, false);
+                if (fixture.pixel) InsertPixelDefaultsAfterFrontFace(main38, false, false);
                 auto upgraded = main38;
-                upgraded[4] = 42u;
-                if (fixture.pixel) upgraded.insert(upgraded.begin() + 317u, 16u, 0u);
+                upgraded[4] = 46u;
+                if (fixture.pixel) {
+                    const auto tail = PixelTailDefaults(true, true);
+                    upgraded.insert(upgraded.begin() + 317u, tail.begin(), tail.end());
+                }
                 if (fixture.tessellation) upgraded.insert(upgraded.end() - 35u, 1u, 0u);
                 main38.insert(main38.end(), sizeof(std::uint64_t) + 1u + 5u + 1u, 0u);
-                upgraded.insert(upgraded.end(), sizeof(std::uint64_t) + 1u + 5u + 1u + 1u, 0u);
+                AppendVertexTail(upgraded);
+                upgraded.push_back(0u);
+                upgraded.push_back(0u);
+                upgraded.insert(upgraded.end(), {0u, 0x10u, 0u, 0u});
                 Require(serializer.Serialize(request) == EncodeBase64(upgraded));
                 const auto replay38 = serializer.Deserialize(EncodeBase64(main38));
                 Require(replay38.request.graphics.has_value() && replay38.request.graphics->tessellation.has_value() == fixture.tessellation);
@@ -422,6 +521,48 @@ int main() {
                 Require(replay38.request.graphics->draw.indexAddress == 0xabcdef3400u && replay38.request.graphics->draw.indexCount == 57u && replay38.request.graphics->draw.indexElementBytes == 4u && replay38.request.graphics->draw.instanceCount == 9u);
                 Require(replay38.request.target.float16DenormPreserve == preserve);
                 Require(serializer.Serialize(replay38.request) == EncodeBase64(upgraded));
+                if (fixture.tessellation) {
+                    for (const bool merged : {false, true}) {
+                        auto pointed = request;
+                        pointed.graphics->tessellation->mergedHull = merged;
+                        pointed.context.vertex->pointList = true;
+                        pointed.context.vertex->pointSize = 3.0f;
+                        pointed.context.vertex->pointSizeMin = 1.0f;
+                        pointed.context.vertex->pointSizeMax = 8.0f;
+                        auto version46 = DecodeBase64(serializer.Serialize(pointed));
+                        Require(version46.size() > 15u && version46[4] == 46u);
+                        const auto replay46 = serializer.Deserialize(EncodeBase64(version46));
+                        Require(replay46.request.graphics->tessellation->mergedHull == merged && replay46.request.context.vertex->pointList && replay46.request.context.vertex->pointSize == 3.0f && replay46.request.context.vertex->pointSizeMin == 1.0f && replay46.request.context.vertex->pointSizeMax == 8.0f);
+                        auto version45 = version46;
+                        if (fixture.pixel) EraseDefaultTargetMerge(version45, 333);
+                        version45[4] = 45u;
+                        auto version44 = version45;
+                        version44.resize(version44.size() - 4u);
+                        version44.pop_back();
+                        version44[4] = 44u;
+                        auto version43 = version44;
+                        version43.pop_back();
+                        version43[4] = 43u;
+                        const auto replay43 = serializer.Deserialize(EncodeBase64(version43));
+                        Require(serializer.Serialize(replay43.request) == EncodeBase64(version46));
+                        Require(replay43.request.graphics->tessellation->mergedHull == merged && replay43.request.context.vertex->pointList && replay43.request.context.vertex->pointSize == 3.0f && replay43.request.context.vertex->pointSizeMin == 1.0f && replay43.request.context.vertex->pointSizeMax == 8.0f);
+                        auto version42 = version43;
+                        version42.resize(version42.size() - 13u);
+                        version42[4] = 42u;
+                        const auto replay42 = serializer.Deserialize(EncodeBase64(version42));
+                        Require(replay42.request.graphics->tessellation->mergedHull == merged && !replay42.request.context.vertex->pointList && replay42.request.context.vertex->pointSize == 1.0f && replay42.request.context.vertex->pointSizeMin == 0.0f && replay42.request.context.vertex->pointSizeMax == 0.0f);
+                        auto version41 = version42;
+                        if (fixture.pixel) version41.erase(version41.begin() + 317u, version41.begin() + 333u);
+                        version41[4] = 41u;
+                        const auto replay41 = serializer.Deserialize(EncodeBase64(version41));
+                        Require(replay41.request.graphics->tessellation->mergedHull == merged && !replay41.request.context.vertex->pointList && replay41.request.context.vertex->pointSize == 1.0f && replay41.request.context.vertex->pointSizeMin == 0.0f && replay41.request.context.vertex->pointSizeMax == 0.0f);
+                        auto version39 = version41;
+                        version39.pop_back();
+                        version39[4] = 39u;
+                        const auto replay39 = serializer.Deserialize(EncodeBase64(version39));
+                        Require(replay39.request.graphics->tessellation->mergedHull == merged && !replay39.request.context.vertex->pointList && replay39.request.context.vertex->pointSize == 1.0f && replay39.request.context.vertex->pointSizeMin == 0.0f && replay39.request.context.vertex->pointSizeMax == 0.0f);
+                    }
+                }
                 for (const bool dither : {false, true}) {
                     if (!fixture.pixel && dither) continue;
                     auto main25 = bytes;
@@ -430,14 +571,17 @@ int main() {
                     const auto replay25 = serializer.Deserialize(EncodeBase64(main25));
                     Require(!fixture.pixel || (replay25.request.context.pixel->layerExported == layer && replay25.request.context.pixel->ditheredAlphaToCoverage == dither && replay25.request.context.pixel->reversedBlend == 0u));
                     Require(replay25.request.target.float16DenormPreserve == preserve && (!fixture.tessellation || replay25.request.graphics->tessellation->primitiveGroupSize == 37u));
-                    main25[4] = 42u;
+                    main25[4] = 46u;
                     InsertMeshBarycentricFlag(main25);
                     if (fixture.pixel) {
                         main25.insert(main25.begin() + 260u, 0u);
                         InsertPixelDefaultsAfterFrontFace(main25);
                     }
                     if (fixture.tessellation) main25.insert(main25.end() - 35u, 1u, 0u);
-                    main25.insert(main25.end(), sizeof(std::uint64_t) + 1u + 5u + 1u + 1u, 0u);
+                    AppendVertexTail(main25);
+                    main25.push_back(0u);
+                    main25.push_back(0u);
+                    main25.insert(main25.end(), {0u, 0x10u, 0u, 0u});
                     Require(serializer.Serialize(replay25.request) == EncodeBase64(main25));
                 }
             }
@@ -449,18 +593,23 @@ int main() {
         request.target.float16DenormPreserve = preserve;
         request.target.float32FlushToZero = !preserve;
         request.target.float32DenormPreserve = preserve;
+        request.target.largePixelFunctionLdsBuffer = !preserve;
+        request.target.pixelFunctionStorageDwords = preserve ? 2048u : 4096u;
         const auto encoded = serializer.Serialize(request);
         const auto replay = serializer.Deserialize(encoded);
-        Require(replay.request.target.float16DenormPreserve == preserve && replay.request.target.float32FlushToZero == !preserve && replay.request.target.float32DenormPreserve == preserve);
+        Require(replay.request.target.float16DenormPreserve == preserve && replay.request.target.float32FlushToZero == !preserve && replay.request.target.float32DenormPreserve == preserve && replay.request.target.largePixelFunctionLdsBuffer == !preserve && replay.request.target.pixelFunctionStorageDwords == request.target.pixelFunctionStorageDwords);
         auto bytes = DecodeBase64(encoded);
-        Require(bytes.size() >= 8u && bytes[4] == 42u && bytes[5] == 0u && bytes[6] == 0u && bytes[7] == 0u);
+        Require(bytes.size() >= 8u && bytes[4] == 46u && bytes[5] == 0u && bytes[6] == 0u && bytes[7] == 0u);
         auto version40 = bytes;
+        version40.resize(version40.size() - sizeof(std::uint32_t));
+        version40.pop_back();
+        version40.pop_back();
         version40.pop_back();
         version40[4] = 40u;
         const auto replay40 = serializer.Deserialize(EncodeBase64(version40));
         Require(!replay40.request.target.float32DenormPreserve && replay40.request.target.float32FlushToZero == !preserve);
         auto future = bytes;
-        future[4] = 43u;
+        future[4] = 47u;
         bool futureRejected = false;
         try {
             static_cast<void>(serializer.Deserialize(EncodeBase64(future)));
@@ -502,10 +651,21 @@ int main() {
     request.context.pixel = pixel;
     const auto orderEncoded = serializer.Serialize(request);
     Require(serializer.Deserialize(orderEncoded).request.context.pixel->sampleOrder == pixel.sampleOrder);
-    auto version41 = DecodeBase64(orderEncoded);
-    const auto order = std::search(version41.begin(), version41.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) + pixel.sampleLocations.size() + 1;
-    Require(version41.end() - order > static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)) && *order == 0x10u);
-    version41.erase(order, order + sizeof(pixel.sampleOrder));
+    auto version42 = DecodeBase64(orderEncoded);
+    const auto orderOffset = std::search(version42.begin(), version42.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) - version42.begin() + static_cast<std::ptrdiff_t>(pixel.sampleLocations.size() + 1u);
+    Require(version42.end() - version42.begin() > orderOffset + static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)) && version42[static_cast<std::size_t>(orderOffset)] == 0x10u);
+    EraseDefaultTargetMerge(version42, orderOffset + static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)));
+    version42.resize(version42.size() - 4u);
+    version42.pop_back();
+    version42.pop_back();
+    version42[4] = 42u;
+    const auto replay42 = serializer.Deserialize(EncodeBase64(version42));
+    Require(replay42.request.context.pixel.has_value() && replay42.request.context.pixel->sampleOrder == pixel.sampleOrder && replay42.request.context.pixel->targetMerge == ShaderRecompiler::TargetMerge{});
+    auto upgraded42 = replay42.request;
+    upgraded42.target = request.target;
+    Require(serializer.Serialize(upgraded42) == orderEncoded);
+    auto version41 = version42;
+    version41.erase(version41.begin() + orderOffset, version41.begin() + orderOffset + static_cast<std::ptrdiff_t>(sizeof(pixel.sampleOrder)));
     version41[4] = 41u;
     const auto replay41 = serializer.Deserialize(EncodeBase64(version41));
     Require(replay41.request.context.pixel.has_value() && replay41.request.context.pixel->sampleLocations == pixel.sampleLocations && replay41.request.context.pixel->sampleOrder == std::array<std::uint32_t, 4>{});
@@ -516,16 +676,118 @@ int main() {
         Require(serializer.Deserialize(serializer.Serialize(request)).request.target.spannedWaves == spanned);
         request.target.float32FlushToZero = true;
         auto version35 = DecodeBase64(serializer.Serialize(request));
+        version35.resize(version35.size() - sizeof(std::uint32_t));
+        version35.pop_back();
         version35.pop_back();
         const auto stencilOperationValue = std::search(version35.begin(), version35.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.begin() + 4) + pixel.sampleLocations.size();
         const auto pixelTail = static_cast<std::ptrdiff_t>(1u + sizeof(pixel.sampleOrder));
         Require(version35.end() - stencilOperationValue > pixelTail && std::all_of(stencilOperationValue, stencilOperationValue + pixelTail, [](std::uint8_t value) { return value == 0u; }));
+        EraseDefaultTargetMerge(version35, stencilOperationValue - version35.begin() + pixelTail);
         version35.erase(stencilOperationValue, stencilOperationValue + pixelTail);
         version35[4] = 35u;
         version35.pop_back();
+        version35.pop_back();
         const auto replay35 = serializer.Deserialize(EncodeBase64(version35));
         Require(replay35.request.target.spannedWaves == spanned && !replay35.request.target.float32FlushToZero);
     }
+    ShaderRecompiler::RecompileRequest pointRequest{};
+    pointRequest.context.vertex = ShaderRecompiler::ShaderVertexStageInfo{};
+    pointRequest.context.vertex->paClVsOutCntl = 0x01210000u;
+    pointRequest.context.vertex->pointList = true;
+    pointRequest.context.vertex->pointSize = 4.0f;
+    pointRequest.context.vertex->pointSizeMin = 0.5f;
+    pointRequest.context.vertex->pointSizeMax = 8.0f;
+    const auto pointEncoded = serializer.Serialize(pointRequest);
+    const auto pointReplay = serializer.Deserialize(pointEncoded);
+    Require(pointReplay.request.context.vertex.has_value() && pointReplay.request.context.vertex->paClVsOutCntl == 0x01210000u && pointReplay.request.context.vertex->pointList);
+    Require(pointReplay.request.context.vertex->pointSize == 4.0f && pointReplay.request.context.vertex->pointSizeMin == 0.5f && pointReplay.request.context.vertex->pointSizeMax == 8.0f);
+    Require(serializer.Serialize(pointReplay.request) == pointEncoded);
+    auto pointBytes = DecodeBase64(pointEncoded);
+    pointBytes.pop_back();
+    pointBytes.pop_back();
+    bool pointRejected = false;
+    try {
+        static_cast<void>(serializer.Deserialize(EncodeBase64(pointBytes)));
+    } catch (const std::runtime_error& error) {
+        pointRejected = std::string_view(error.what()) == "RequestSerializer: truncated data";
+    }
+    Require(pointRejected);
+
+    pointRequest.target.depthRangeRemap = true;
+    pointRequest.target.float32FlushToZero = true;
+    pointRequest.context.vertex->depthRemapMode = 2u;
+    const auto remappedPoint = serializer.Deserialize(serializer.Serialize(pointRequest));
+    Require(remappedPoint.request.target.depthRangeRemap && remappedPoint.request.context.vertex->depthRemapMode == 2u);
+    Require(serializer.Serialize(remappedPoint.request) == serializer.Serialize(pointRequest));
+
+    for (const bool spanned : {false, true}) {
+        for (const std::uint8_t version : {32u, 33u, 34u, 35u, 36u, 37u, 38u}) {
+            pointRequest.target.spannedWaves = spanned;
+            auto legacy = DecodeBase64(serializer.Serialize(pointRequest));
+            legacy.resize(legacy.size() - (version >= 36u ? 20u : version >= 35u ? 21u : 26u));
+            legacy[4] = version;
+            const auto replayLegacy = serializer.Deserialize(EncodeBase64(legacy));
+            Require(replayLegacy.request.target.spannedWaves == spanned);
+            Require(replayLegacy.request.target.float32FlushToZero == (version >= 36u));
+            Require(replayLegacy.request.target.depthRangeRemap == (version >= 35u));
+            Require(replayLegacy.request.context.vertex.has_value());
+            Require(replayLegacy.request.context.vertex->depthRemapMode == (version >= 35u ? 2u : 0u));
+            Require(replayLegacy.request.context.vertex->paClVsOutCntl == pointRequest.context.vertex->paClVsOutCntl);
+            Require(!replayLegacy.request.context.vertex->pointList && replayLegacy.request.context.vertex->pointSize == 1.0f);
+            Require(replayLegacy.request.context.vertex->pointSizeMin == 0.0f && replayLegacy.request.context.vertex->pointSizeMax == 0.0f);
+            const auto upgradedLegacy = DecodeBase64(serializer.Serialize(replayLegacy.request));
+            Require(upgradedLegacy[4] == 46u && upgradedLegacy.size() == legacy.size() + (version >= 36u ? 20u : version >= 35u ? 21u : 26u));
+        }
+    }
+
+    pixel.sampleOrder = {0x76543210u, 0x01234567u, 0x10325476u, 0x67452301u};
+    pointRequest.context.pixel = pixel;
+    const auto sampledPoint = serializer.Deserialize(serializer.Serialize(pointRequest));
+    Require(sampledPoint.request.context.vertex->pointList && sampledPoint.request.context.pixel->sampleOrder == pixel.sampleOrder);
+    auto legacy43 = DecodeBase64(serializer.Serialize(pointRequest));
+    const auto mergeOffset = std::search(legacy43.begin(), legacy43.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) - legacy43.begin() + static_cast<std::ptrdiff_t>(pixel.sampleLocations.size() + 1u + sizeof(pixel.sampleOrder));
+    EraseDefaultTargetMerge(legacy43, mergeOffset);
+    legacy43.resize(legacy43.size() - 4u);
+    legacy43.pop_back();
+    legacy43.pop_back();
+    legacy43[4] = 43u;
+    const auto pointReplay43 = serializer.Deserialize(EncodeBase64(legacy43));
+    Require(pointReplay43.request.context.pixel->sampleOrder == pixel.sampleOrder && pointReplay43.request.context.vertex->pointList && pointReplay43.request.context.vertex->pointSize == 4.0f);
+    Require(serializer.Serialize(pointReplay43.request) == serializer.Serialize(pointRequest));
+    auto legacy42 = legacy43;
+    legacy42.resize(legacy42.size() - 13u);
+    legacy42[4] = 42u;
+    const auto pointReplay42 = serializer.Deserialize(EncodeBase64(legacy42));
+    Require(pointReplay42.request.context.pixel->sampleOrder == pixel.sampleOrder && !pointReplay42.request.context.vertex->pointList && pointReplay42.request.context.vertex->pointSize == 1.0f);
+    pixel.sampleOrder = {};
+    pointRequest.context.pixel = pixel;
+    auto legacy34 = DecodeBase64(serializer.Serialize(pointRequest));
+    legacy34.resize(legacy34.size() - 26u);
+    const auto stencil34 = std::search(legacy34.begin(), legacy34.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.begin() + 4) + pixel.sampleLocations.size();
+    const auto legacyPixelTail = static_cast<std::ptrdiff_t>(1u + sizeof(pixel.sampleOrder));
+    Require(legacy34.end() - stencil34 > legacyPixelTail && std::all_of(stencil34, stencil34 + legacyPixelTail, [](std::uint8_t value) { return value == 0u; }));
+    EraseDefaultTargetMerge(legacy34, stencil34 - legacy34.begin() + legacyPixelTail);
+    legacy34.erase(stencil34, stencil34 + legacyPixelTail);
+    legacy34[4] = 34u;
+    const auto replay34 = serializer.Deserialize(EncodeBase64(legacy34));
+    Require(replay34.request.context.pixel.has_value() && replay34.request.context.pixel->iteratesSamples && replay34.request.context.pixel->positionLocation == pixel.positionLocation && replay34.request.context.pixel->sampleLocations == pixel.sampleLocations);
+    Require(replay34.request.context.vertex.has_value() && !replay34.request.context.vertex->pointList && replay34.request.context.vertex->pointSize == 1.0f);
+
+    for (const bool fused : {false, true}) {
+        request.target.fusedExactArithmetic = fused;
+        request.target.largePixelFunctionLdsBuffer = false;
+        auto bytes = DecodeBase64(serializer.Serialize(request));
+        Require(serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic == fused && bytes[bytes.size() - 6u] == (fused ? 1u : 0u) && bytes[bytes.size() - 5u] == 0u);
+        const auto fusedMerge = std::search(bytes.begin(), bytes.end(), pixel.sampleLocations.begin(), pixel.sampleLocations.end()) - bytes.begin() + static_cast<std::ptrdiff_t>(pixel.sampleLocations.size() + 1u + sizeof(pixel.sampleOrder));
+        EraseDefaultTargetMerge(bytes, fusedMerge);
+        bytes.resize(bytes.size() - 4u);
+        bytes.pop_back();
+        bytes[4] = 44u;
+        Require(serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic == fused);
+        bytes[4] = 43u;
+        bytes.pop_back();
+        Require(!serializer.Deserialize(EncodeBase64(bytes)).request.target.fusedExactArithmetic);
+    }
 
     return 0;
 }
diff --git a/core/shader/recompiler/tests/test_shader_cache_native_paths.py b/core/shader/recompiler/tests/test_shader_cache_native_paths.py
index b2f1e8c57f..9a28aab1e8 100644
--- a/core/shader/recompiler/tests/test_shader_cache_native_paths.py
+++ b/core/shader/recompiler/tests/test_shader_cache_native_paths.py
@@ -51,6 +51,24 @@ class ShaderCachePathTests(unittest.TestCase):
     def test_cjk(self):
         self.check_source_change('\u6e2c\u8a66 path')
 
+    def test_line_endings_keep_version(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / 'line endings'
+            source, listing, output = self.fixture(root)
+            text = '#include <cstdint>\nconst char* mode = "APS5_TEST_PATH";\nint value = 1;\n'
+            source.write_bytes(text.encode('utf-8'))
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            unix = output.read_bytes()
+            source.write_bytes(text.replace('\n', '\r\n').encode('utf-8'))
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertEqual(unix, output.read_bytes())
+            source.write_bytes(text.replace('= 1;', '= 2;').replace('\n', '\r\n').encode('utf-8'))
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertNotEqual(unix, output.read_bytes())
+
     def test_unicode_guard_rejects_unhashed_include(self):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary) / '\u0441\u0431\u043e\u0440\u043a\u0430'
@@ -74,5 +92,34 @@ class ShaderCachePathTests(unittest.TestCase):
             self.assertIn('does not hash', result.stdout + result.stderr)
             self.assertFalse(output.exists())
 
+    @unittest.skipUnless(sys.platform == 'win32', 'Windows path separator semantics require Windows host')
+    def test_windows_path_separators(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / 'windows separators'
+            source, listing, output = self.fixture(root)
+            windows_path = str(source).replace('/', '\\')
+            listing.write_text(f'sources {windows_path}\n', encoding='utf-8')
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            windows_version = output.read_bytes()
+            listing.write_text(f'sources {source.as_posix()}\n', encoding='utf-8')
+            result = self.run_script(root, listing, output)
+            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertEqual(windows_version, output.read_bytes())
+
+    @unittest.skipUnless(sys.platform == 'win32', 'Windows path separator semantics require Windows host')
+    def test_windows_path_separators_reject_unhashed_include(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary) / 'windows separators'
+            source, listing, output = self.fixture(root)
+            windows_path = str(source).replace('/', '\\')
+            listing.write_text(f'sources {windows_path}\n', encoding='utf-8')
+            (root / 'shared.hpp').write_text('int example();\n', encoding='utf-8')
+            source.write_text('#include "../shared.hpp"\n', encoding='utf-8')
+            result = self.run_script(root, listing, output)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn('does not hash', result.stdout + result.stderr)
+            self.assertFalse(output.exists())
+
 
 unittest.main()
diff --git a/demo/web/index.html b/demo/web/index.html
index e0d468febc..5d974cd58f 100644
--- a/demo/web/index.html
+++ b/demo/web/index.html
@@ -6,7 +6,7 @@
 <title>AnyPS5 · Converter</title><link rel="stylesheet" href="app.css"><script type="module" src="app.mjs"></script>
 </head>
 <body>
-<header><div class="bar"><a class="brand" href="./"><span class="mark" aria-hidden="true"><i></i><i></i><i></i><i></i></span>AnyPS5 <span>/ Converter</span></a><nav aria-label="Main navigation"><a href="https://alxcbtw.github.io/anyps5-roadmap/">Compatibility ↗</a><a href="https://github.com/boykopovar/AnyPS5">GitHub</a><a href="https://discord.gg/BHFztBPUe">Discord</a><button id="theme" class="plain" aria-label="Switch color theme">◐</button></nav></div></header>
+<header><div class="bar"><a class="brand" href="./"><span class="mark" aria-hidden="true"><i></i><i></i><i></i><i></i></span>AnyPS5 <span>/ Converter</span></a><nav aria-label="Main navigation"><a href="https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up">Game bring-up ↗</a><a href="https://github.com/boykopovar/AnyPS5">GitHub</a><a href="https://discord.gg/BHFztBPUe">Discord</a><button id="theme" class="plain" aria-label="Switch color theme">◐</button></nav></div></header>
 <main>
 <div class="intro"><p class="eyebrow">LOCAL CONVERSION</p><h1>PS5 apps to Windows/Linux converter</h1></div>
 <div id="browser-note" class="notice" role="status" hidden></div>
@@ -23,7 +23,7 @@
 <div id="done" class="done" hidden><h3>Ready to run.</h3><p id="result-info"></p><a id="download" class="button" hidden>Download ZIP</a><p id="result-note" class="fine">Extract the entire ZIP before launching the executable.</p></div>
 </section>
 <p class="limits">Memory downloads have a 256 MiB budget, checked against expanded files and output overhead. For multiple ZIPs, the limit applies to the combined bundle; larger batches require Save ZIP to disk in desktop Chrome or Edge. Executable and modules are limited to 256 MiB per app; the icon is also limited to 16 MiB and counts toward the Windows conversion limit. Use the native relinker for larger conversion inputs.</p>
-<p class="compatibility">Conversion does not guarantee that an app runs. Check the <a href="https://alxcbtw.github.io/anyps5-roadmap/">community compatibility list</a> for known blockers and reports.</p>
+<p class="compatibility">Conversion does not guarantee that an app runs. Check the <a href="https://github.com/boykopovar/AnyPS5/discussions/categories/game-bring-up">Game bring-up discussions</a> for known blockers and reports.</p>
 </main><footer><span>AnyPS5</span><div><a href="progress.html">Implementation progress</a><a href="history.html">Progress history</a><a href="https://github.com/boykopovar/AnyPS5/releases/latest">Latest release</a></div></footer>
 <noscript><p class="notice">JavaScript is required. You can also use the native relinker from GitHub Releases.</p></noscript>
 </body></html>
diff --git a/docs/dev/ARCHITECTURE.md b/docs/dev/ARCHITECTURE.md
index 32e2509783..6c47cfa197 100644
--- a/docs/dev/ARCHITECTURE.md
+++ b/docs/dev/ARCHITECTURE.md
@@ -124,15 +124,16 @@ flowchart LR
 
 - [`Recompiler.cpp`](../../core/shader/recompiler/Recompiler.cpp) runs the stages in this order. With `ANYPS5_ENABLE_SPIRV_TOOLS`, the SPIR-V is also validated and optimized with SPIRV-Tools.
 - `ShaderRecompiler::Recompile` keeps compiled variants in memory, and `ShaderDiskCache` stores them on disk so later runs reuse them. Before the writable cache, a miss is also looked up in read-only prebuilt packs and loose entry folders under `shader_cache/prebuilt`; pack entries are ordinary encoded cache entries behind a sorted key-hash index, validated by magic, compiler source version and index checksum when mapped, and a miss or rejected entry falls through to the writable cache and the compiler. Cache format 35 also stores the finite stencil-reference set, its replay-safety proof and reserved push-data word in the artifact and binding layouts. Entries from formats 31 to 34 are rejected.
-- The Vulkan pipelines are journaled as well ([`PipelineJournal.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp)): a graphics pipeline the store builds (`CachedPipeline`) or a compute pipeline a dispatch builds is appended to `pipelines.journal` next to the shader cache entries, as the materialized result of each stage (the specialized SPIR-V, bindings and push constants, through `ShaderDiskCache::EncodeResult`) plus the recipe the pipeline was built from (`GraphicsPipelineRecipe`: the stages' identities, vertex input layout, descriptor set layout keys and the state fields the `Pipeline` constructor reads, `CanonicalPipelineState`). When a `VulkanDevice` is created, the journal is loaded and its pipelines are built on a pool of `hardware_concurrency() / 2` threads (`APS5_PIPELINE_JOURNAL_THREADS`) while the title loads, so the first draw or dispatch of a configuration seen on an earlier run finds its pipeline resident. The pipeline stores key on `RecompileResult::Identity`, a hash of the module words, specialization constants, subgroup width and bindings that is the same on every run (`SharedSpirv::ContentHash`, computed once per shared module), rather than on the process-lifetime variant ids, and a graphics pipeline is built outside the store's mutex, so the replay threads and the queue workers build in parallel. A draw that arrives before its replayed entry builds the pipeline itself; the first inserted wins. A replayed entry enters the store at its least recently used end and a full store takes none, so the title's own pipelines are never evicted for a replayed one, and the optimized relink of a replayed pipeline (`OptimizedPipeline::Schedule`) waits for the first draw that binds it, so the relink thread serves the title's pipelines first. A device created without a window starts its replay at its first draw or dispatch rather than at creation, since `Driver::AttachWindow` usually replaces it before the title draws. The journal records a pipeline once (modules and recipes are deduplicated by content), keeps at most `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024), replays the first `APS5_PIPELINE_JOURNAL_ENTRIES` recorded (1024, the pipeline store's bound, `APS5_PIPELINE_STORE_ENTRIES`; a run reaches those first), and is disabled with `APS5_NO_PIPELINE_JOURNAL=1` or without a shader cache directory. The file header names the device (`PipelineJournalDeviceFingerprint`, the properties the driver's pipeline cache file is named by), so a journal written for another GPU or driver is started over rather than replayed; appends and reads hold `pipelines.journal.lock` against another process sharing the directory, and a device cancels its replay before it is replaced (`PrepareForReplacement`) or destroyed, so a replaced headless device never inserts entries the window's device then sweeps. `APS5_PROFILE_DRAW=1` prints a `[pipeline-journal]` summary when the replay finishes and at teardown.
+- The Vulkan pipelines are journaled as well ([`PipelineJournal.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp)): a graphics pipeline the store builds (`CachedPipeline`) or a compute pipeline a dispatch builds is appended to `pipelines.journal` next to the shader cache entries, as the materialized result of each stage (the specialized SPIR-V, bindings and push constants, through `ShaderDiskCache::EncodeResult`) plus the recipe the pipeline was built from (`GraphicsPipelineRecipe`: the stages' identities, vertex input layout, descriptor set layout keys and the state fields the `Pipeline` constructor reads, `CanonicalPipelineState`). When a `VulkanDevice` is created, the journal is loaded and its pipelines are built on a pool of `hardware_concurrency() / 2` threads (`APS5_PIPELINE_JOURNAL_THREADS`) while the title loads. The load parses the file a record at a time and keeps it open, and a replay thread reads an entry's modules from it when it builds that entry (a record that no longer reads back as loaded rejects the entry), so the replay holds the modules of the entries being built rather than the file, so the first draw or dispatch of a configuration seen on an earlier run finds its pipeline resident. The pipeline stores key on `RecompileResult::Identity`, a hash of the module words, specialization constants, subgroup width and bindings that is the same on every run (`SharedSpirv::ContentHash`, computed once per shared module), rather than on the process-lifetime variant ids, and a graphics pipeline is built outside the store's mutex, so the replay threads and the queue workers build in parallel. A draw that arrives before its replayed entry builds the pipeline itself; the first inserted wins. A replayed entry enters the store at its least recently used end and a full store takes none, so the title's own pipelines are never evicted for a replayed one, and the optimized relink of a replayed pipeline (`OptimizedPipeline::Schedule`) waits for the first draw that binds it, so the relink thread serves the title's pipelines first. A device created without a window starts its replay at its first draw or dispatch rather than at creation, since `Driver::AttachWindow` usually replaces it before the title draws. The journal records a pipeline once (modules and recipes are deduplicated by content), keeps at most `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024), replays the first `APS5_PIPELINE_JOURNAL_ENTRIES` recorded (1024, the pipeline store's bound, `APS5_PIPELINE_STORE_ENTRIES`; a run reaches those first), and is disabled with `APS5_NO_PIPELINE_JOURNAL=1` or without a shader cache directory. The file header names the device (`PipelineJournalDeviceFingerprint`, the properties the driver's pipeline cache file is named by), so a journal written for another GPU or driver is started over rather than replayed; appends and reads hold `pipelines.journal.lock` against another process sharing the directory, and a device cancels its replay before it is replaced (`PrepareForReplacement`) or destroyed, so a replaced headless device never inserts entries the window's device then sweeps. `APS5_PROFILE_DRAW=1` prints a `[pipeline-journal]` summary when the replay finishes and at teardown.
 - A compute shader whose LDS plus its lock dword exceeds the host's `maxComputeSharedMemorySize` is not given a `Workgroup` array. `Recompile` sets `ShaderInfo::sharedMemoryBytes` for it and the SPIR-V backend addresses the LDS in a coherent storage buffer at descriptor set 1 (`WorkgroupMemoryDescriptorSet`), with a slice of `RecompileResult::workgroupMemoryDwords` per workgroup, indexed by `WorkgroupID` and `NumWorkGroups`. `VulkanDevice` keeps one such buffer, sized from the dispatch dimensions, and binds it after the resource set; programs that fit keep using shared memory.
 - `Driver::RegisterShader` splits shader preparation in two. `PlanRegistered` runs on the registering guest thread: it validates the registers and entry point, decodes the code and builds the recompile request, so invalid registrations still fail there. The RDNA to IR translation and resource plan (`PrepareShader`) run on a background pool of `hardware_concurrency() / 2` detached threads (at least 2, 64 MiB stacks).
 - A thread that needs the GPU mutex, the committer's next item or the end of the committer's queue spins before it blocks (`HandoffSpin.hpp`): `GpuMutexType::lock` retries `try_lock` for the window, the committer polls its item count, and `DrawPipeline::Drain` polls it for twice the window, so a hand-off that completes within the window costs no kernel wake-up. The window is 150 us when the process may run on more than 8 logical processors (its affinity mask, via `CpuTopology`) and 0 otherwise, where the spinning threads would compete with the holder; `APS5_HANDOFF_SPIN_US=<n>` sets it (0 turns it off, at most 10000). Ordering and the lock's semantics are unchanged.
 - Queue 0's packet worker decodes, captures and prepares a draw and hands its recording (`Graphics::Draw` under the GPU lock) to a committer thread in [`DrawPipeline.cpp`](../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp), so the next packet is decoded while the previous draw is recorded. Each queued item carries the guest ranges it will write (`DrawWriteRanges`: written buffers and storage images, color targets with their DCC and CMASK, depth and stencil). A later packet that reads or writes one of those ranges, or that the pipeline can't order, drains it first; labels, submission ends, buffer fills and (with `APS5_PIPELINE_DMA=1`) DMA packets are queued as items instead. With `APS5_PIPELINE_DISPATCH=1` (off by default), a `DISPATCH_DIRECT` whose dispatch-cache entry hits with a recipe is queued as an item too, carrying the dispatch's written buffers and storage images (`DispatchWriteRanges`); the capture and the cache lookup stay on the worker and the recipe is recorded on the committer. A dispatch still drains when its lookup misses, when what it reads overlaps a write still pending, when the hit is verified against data or when its writes cannot be ranged (bindless access, GDS, fault buffer). An indirect draw resolved on the CPU (its records read by the worker) drains only when its records or its count overlap a queued write; the records it draws inline drain first, and its last drawn record is queued like a direct draw (`APS5_NO_PIPELINED_INDIRECT=1` drains at every indirect draw). An exception thrown by a commit is rethrown on the worker at its next enqueue or drain, as an inline draw error would be. On by default; `APS5_PIPELINED_DRAWS=0` records every draw inline, and `APS5_EXACT_DRAW_WRITES=0` widens the color and depth ranges to estimates.
 - A dispatch's resource build runs stage A (binding plan, buffers, descriptor set) without the GPU lock and stage B (image lookups) under it. Between them `VulkanDevice::presync` waits, still without the lock, for recorded work that writes a surface stage B would read on the CPU and for recorded work that writes the DCC keys of an image the dispatch binds (`ShaderResources::PresyncSurfaces`), so the locked `WaitForKeyWriters` finds nothing pending to synchronize with. A key range is waited for only when recorded work writes it, the key-store memo does not give its value (`DccKeyWritersPending`, without the mutex) and the pending stores do not give it either (`DccKeyWriterNeedsSync`, under the mutex, the same test `WaitForKeyWriters` makes before it synchronizes). Stage A's own key scan runs before that wait, and stage B compares it with the keys it reads under the lock as before. `APS5_NO_DCC_PRESYNC=1` leaves the key ranges out; `APS5_NO_PRESYNC=1` disables the whole pre-sync.
+- `APS5_DRAW_PIPELINE=1` (off by default, meant with `APS5_PIPELINED_DRAWS=32 APS5_PIPELINE_DISPATCH=1`) takes more of a draw off the worker. A `DrawFinisher` thread runs the second half of a direct pipelined draw (stage materialization, the draw cache insert and the hand-off to the committer) while the worker reads the next packets; the worker drains it before the next draw's cache lookup, before packets other than register writes and draws, and before guest reads, and finishes in place a draw whose stages may write memory (`ProgramWritesMemory`) or write through the BDA page table. The committer skips the fragment-output validation and storage-image layer scans whose inputs match its last commit (`CommitTrims`), and a resource or storage image proved current keeps its proof for the rest of the collect epoch until `GuestMemory::BreakProofs` (a CPU write, a write-back, a recorded write) moves `ProofSerial`. Color metadata passes go through the pipeline with their write ranges (`PipelinedColorMetadataPassWrites`) instead of draining it. A data-only hit whose shape entry belongs to an older draw replaces that entry in place at the second sight of the same read user words. On Linux the main image's pages get a page table entry, and capture pages are pooled across threads. `APS5_VERIFY_DRAW_PIPELINE=1` runs a full check next to 1 in 64 reused proofs and prints `[epoch-proofs]` counts.
 - The shader registry maps a code address to every header registered for that code, in registration order. Static, graphics and rectangle ABI resolution pick the header at the bound address (or one equal to it, `SameHeader`, which also takes a hull header fused by `sceAgcFuseShaderHalves` (type 3) as the registered back half (type 7) it copies, the fused registers aside; graphics ABI resolution then uses the fused header's shader registers); draws and dispatches pick the program by the stage's binary type (`RegisteredProgram`), and a front entry matching both type 2 and type 4 throws. Within a type the last registration wins; re-registering an identical earlier header makes its snapshot current again without preparing it again, and changed code drops the older headers.
 - The snapshot is published as pending. `SourceHandleFor`, `InvocationFor` and `ShaderPreparationTransaction::Edit` / `Read` wait for the pending job before reading `PreparedShaders`, and rethrow its failure. `APS5_SYNC_SHADER_PREPARE=1` prepares on the registering thread instead.
-- `APS5_LAZY_SHADER_PREPARE=1` retains registration validation and decoding but discards the temporary plan without queueing preparation. The snapshot is deferred, not pending; draws and dispatches prepare and cache it on first use. Explicit ABI resolution still prepares its requested stages. This opt-in mode takes precedence over synchronous registration preparation and trades background CPU/memory use for possible first-use stalls; disk caches and shader output are unchanged.
+- `APS5_LAZY_SHADER_PREPARE=1` retains registration validation and decoding but discards the temporary plan without queueing preparation. The snapshot is deferred, not pending; draws and dispatches prepare and cache it on first use. A compute or pixel stage's explicit ABI resolution (`ResolveShaderAbi`) plans the stage with the ABI's state, records the ABI and leaves its preparation to the shader's first use, which prepares it with that state (`PreparedShaders::deferredAbis`), so a shader that never draws or dispatches stays unprepared; a graphics-stage ABI is still prepared when it is resolved. This opt-in mode takes precedence over synchronous registration preparation and trades background CPU/memory use for possible first-use stalls; disk caches and shader output are unchanged.
 - On devices with graphics pipeline libraries (`SpirvTarget::registrationModules`), a vertex or pixel artifact is emitted in registration form: the buffer V# words, image modes, swizzles and mip ranges, depth-compare state, export mappings and vertex component selectors it used to specialize on per draw are read at run time (image `ResourceMetadata` and a few state dwords in the shader data), descriptor heaps keep every element in place (an unused one gets a null or placeholder descriptor), and the pixel stage's bindings live in descriptor set 1 so each stage's library depends only on its own set layout (`INDEPENDENT_SETS`). An artifact above `registrationWordLimit` SPIR-V words is re-emitted specialized, and `CompiledShaderArtifact::registrationModule` records which form it has. For artifacts in registration form, `RegistrationResult` materializes the module once, and `PrebuildStageLibrary` builds its pre-rasterization or fragment-shader library on a separate one-thread pool (`APS5_PREBUILD_THREADS`) with a fixed default state, pairing it with a stub stage. A later draw with that state finds both libraries in the store and only links.
 - A draw or dispatch whose state matches no artifact prepared at registration (a title that builds its static ABI state itself, without `sceAgcDriverResolve*Abi`) gets one prepared at use by `SourceHandleFor` or `InvocationFor`, logged once per artifact and kept in the snapshot for the next use.
 - A stage that `sceAgcDriverResolve*Abi` cannot prepare for the state the title creates its pipeline with (a compute shader that calls user-data pointers, a descriptor the resource plan rejects) is left to its first use like a stage deferred at registration: `ResolveShaderAbi` and `PrepareGraphicsStages` catch the failure inside their own preparation transaction, so the `ShaderPreparationScope` the title's call runs in still commits, log it once per shader, mark the shader deferred and record the ABI key, so a repeated call prepares nothing; `ResolvePreparedGraphics` skips a deferred stage's rectangles until a draw has prepared it. A draw or dispatch that cannot prepare the stage either fails as before. Driver failures, `ProcessShutdown` and a failure stored by the shader's registration preparation still propagate from the ABI call.
@@ -144,7 +145,7 @@ flowchart LR
 - Guest memory reaches the GPU through host imports (`VK_EXT_external_memory_host`) where the driver accepts them, and through copies otherwise ([`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp)). A registered range larger than the import window (64 MiB) is imported per window for buffer and fill accesses and whole for an address-based build. Live imports stay under a budget, with the least recently used import retired first (see TechnicalDebt, Host import windows and budget).
 - A guest protect or unmap that overlaps a plain host-pointer import retires the whole import before changing the guest range (`WaitForLeasesAndImports` in [`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp)). Later accesses import surviving registered ranges again; imports never keep the pages across a cut pinned in a trimmed state. `GuestAllocations::Range::backingSerial` distinguishes the original pages from replacements: untouched pieces of a split keep their serial, newly mapped or protected pieces get a fresh one, and every span passed to `RequireUnpinned` (including the other mappings of remapped direct memory and the resident runs touched by a 2 MiB unmap or remap) gets a fresh serial when the mutation ends.
 - A draw binds its vertex and index ranges in place from a host import, except with NVIDIA's Windows driver, which reads a host import of guest memory far slower than a buffer it allocated (Astro Bot at Crash Site on an RTX 5070 Ti: 164 against 45 ms of draws per frame), so they are copied there (`DrawInputsInPlaceUsable`, `Context::drawInputsInPlace`). `APS5_DRAW_INPUTS_IN_PLACE=1` binds them in place and `APS5_NO_DRAW_INPUTS_IN_PLACE=1` copies them on any device; the second wins.
-- On Windows, a host import of private `MEM_WRITE_WATCH` memory (singly mapped direct memory) stays on `GetWriteWatch` when `ProbeImportWriteProtection` shows the driver reports nothing written after the second GPU read and a GPU write, and a CPU store is collected (`decideImportWatch`). The driver marks every page of such an import written, asynchronously, until a GPU use of it completes (a read on the settle queue ends it even while main-queue work that used the import first is still running, and the first use of an earlier import of the same pages after that read marks nothing), so `settleImport` in [`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) copies 4 bytes out of the new import on a second queue of the graphics family, or on a queue of another copy-capable family when the graphics family has only one (`Context::settleQueue`, own pool and mutex) inside `ImportWatched`'s window and waits for it, for imports of 1 MiB or more; the main queue can't be used there because `importAllocation` holds the imports lock and `GpuMutex` comes before it in the lock order. A smaller import is compared when it is made, so a title that maps, imports and unmaps a small buffer around every submission does not block its mapping thread. Its 4-byte read is queued instead: the next import lookup that holds `GpuMutex` while the imports match the registry (`settleUnwatchedImports`) records the queued reads into one batch on the settle queue, and once the batch's fence has signalled a later lookup returns the import's whole 64 KiB blocks to the write watch (`GuestMemory::Rewatch` drops their marks and stamps every block as a CPU store), unless a live storage image overlaps them. Such an import stays compared: an image that took its generation before the stamp would take the stamp for a CPU store over the results it produces after it, and drop them. A settled import whose range had already left the watch returns the same way, and an import retired while its read is in flight is kept with that batch and freed once the batch has completed, without waiting for it; a guest unmap of its memory waits for the batch instead. `APS5_NO_DEFERRED_SETTLES` (any value) keeps every import under 1 MiB compared. Imports through a section alias keep tracking on the guest views, and every other Windows host import is compared. A device without such a queue keeps the comparisons. On Linux the settle queue is made when the device imports dma-buf memory, and every dma-buf import of 1 MiB or more is settled right after it is made, for another reason: the kernel maps an import's pages for the GPU at the first submission that uses it, which took about 2 s for a 3 GiB import on RADV and held up the title's frame. The import's buffer is shared with the settle queue's family instead of aliased, since a sparse import is bound to many memory objects.
+- On Windows, a host import of private `MEM_WRITE_WATCH` memory (singly mapped direct memory) stays on `GetWriteWatch` when `ProbeImportWriteProtection` shows the driver reports nothing written after the second GPU read and a GPU write, and a CPU store is collected (`decideImportWatch`). The driver marks every page of such an import written, asynchronously, until a GPU use of it completes (a read on the settle queue ends it even while main-queue work that used the import first is still running, and the first use of an earlier import of the same pages after that read marks nothing), so `settleImport` in [`GuestBufferMemory.cpp`](../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) copies 4 bytes out of the new import on a second queue of the graphics family, or on a queue of another copy-capable family when the graphics family has only one (`Context::settleQueue`, own pool and mutex) inside `ImportWatched`'s window and waits for it, for imports of 1 MiB or more; the main queue can't be used there because `importAllocation` holds the imports lock and `GpuMutex` comes before it in the lock order. A smaller import is compared when it is made, so a title that maps, imports and unmaps a small buffer around every submission does not block its mapping thread. Its 4-byte read is queued instead: the next import lookup that holds `GpuMutex` while the imports match the registry (`settleUnwatchedImports`) records the queued reads into one batch on the main queue, with barriers ordering earlier and later writes around the reads. Submission does not wait on the CPU, and once the batch's fence has signalled a later lookup returns the import's whole 64 KiB blocks to the write watch (`GuestMemory::Rewatch` drops their marks and stamps every block as a CPU store), unless a live storage image overlaps them. Such an import stays compared: an image that took its generation before the stamp would take the stamp for a CPU store over the results it produces after it, and drop them. A settled import whose range had already left the watch returns the same way, and an import retired while its read is in flight is kept with that batch and freed once the batch has completed, without waiting for it; a guest unmap of its memory waits for the batch instead. `APS5_NO_DEFERRED_SETTLES` (any value) keeps every import under 1 MiB compared. Imports through a section alias keep tracking on the guest views, and every other Windows host import is compared. A device without such a queue keeps the comparisons. On Linux the settle queue is made when the device imports dma-buf memory, and every dma-buf import of 1 MiB or more is settled right after it is made, for another reason: the kernel maps an import's pages for the GPU at the first submission that uses it, which took about 2 s for a 3 GiB import on RADV and held up the title's frame. The import's buffer is shared with the settle queue's family instead of aliased, since a sparse import is bound to many memory objects.
 
 ### Log output
 
diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md
index 1b1a1287ac..3693189557 100644
--- a/docs/dev/BUILD.md
+++ b/docs/dev/BUILD.md
@@ -31,9 +31,14 @@ git submodule update --init --recursive
 - Linux: GCC, G++, binutils. SDL's X11 backend requires X11 and Xext development headers (`libx11-dev` and `libxext-dev` on Debian/Ubuntu). SDL's Wayland backend requires the Wayland, xkbcommon and EGL development files (`libwayland-dev`, `libxkbcommon-dev` and `libegl-dev` on Debian/Ubuntu; `wayland-devel`, `libxkbcommon-devel` and `mesa-libEGL-devel` on Fedora), and `libdecor-0-dev` (`libdecor-devel`) for window decorations on GNOME. SDL loads both backends at run time and prefers Wayland when `WAYLAND_DISPLAY` is set; `SDL_VIDEODRIVER=x11` selects X11 (XWayland). Titles that bundle their own SDL read `SDL_VIDEODRIVER` too, and some of them fail to start with `x11`. Without the Wayland files configuration still succeeds, and the build uses X11 only. Audio output needs SDL's PipeWire, PulseAudio or ALSA backend, built from their development files (`libpipewire-0.3-dev`, `libpulse-dev` and `libasound2-dev` on Debian/Ubuntu; `pipewire-devel`, `pulseaudio-libs-devel` and `alsa-lib-devel` on Fedora). SDL loads them at run time. Without any of them SDL keeps only its silent dummy and disk drivers, so configuration fails.
 - Fedora: if CMake reports `Could NOT find Threads`, install `glibc-static` and `libstdc++-static` with `sudo dnf install glibc-static libstdc++-static`, then rerun configuration. The project enables static executable linking, and FFmpeg's thread check needs these libraries.
 - Windows: x86-64 MinGW-w64 GCC with POSIX threads. The compiler must provide DWARF exceptions with `-fno-asynchronous-unwind-tables`, or SEH exceptions for System V ABI functions; CMake checks these capabilities. WinLibs GCC 15.2.0 (`x86_64-ucrt-posix-seh`, release [`15.2.0posix-14.0.0-ucrt-r7`](https://github.com/brechtsanders/winlibs_mingw/releases/tag/15.2.0posix-14.0.0-ucrt-r7)) uses DWARF. [MSYS2 UCRT64 GCC](https://packages.msys2.org/packages/mingw-w64-ucrt-x86_64-gcc) 16.2.0-6 uses SEH. Add the selected toolchain's `bin` directory to `PATH` before configuring.
-- Windows antivirus software can quarantine the executables that the relinker tests create in the temp directory, which fails `optional_plt`, `empty_tls`, `windows_address_space` and `windows_icon`. Set `TEMP` and `TMP` to a directory the scanner excludes before running `ctest`.
+- Windows antivirus software can block or quarantine the executables that the relinker tests create and run, which fails `optional_plt`, `empty_tls`, `windows_address_space`, `windows_bss`, `windows_fixed_base` and `windows_icon`. CTest sets `TMPDIR`, `TEMP` and `TMP` of the relinker tests to `core/relinker/test-temp` in the build directory, so setting them before running `ctest` does not move these files; add that directory to the scanner's exclusions instead.
 - Bitdefender Advanced Threat Defense hooks Windows calls that `sceKernelRaiseException` makes while its target thread is suspended. When the target is suspended inside ntdll's exception dispatch while it holds an ntdll lock, the hook waits for that lock and `guest_raise_exception` hangs until its timeout. A scanning exception for the build directory does not prevent it; add `guest_raise_exception_tests.exe` to the Advanced Threat Defense exceptions.
 - FFmpeg binaries are downloaded during configuration unless `FFMPEG_PREBUILT_DIR` is set. With the WinLibs CMake, the download fails with status 60 (`SSL peer certificate or SSH remote key was not OK`) unless `SSL_CERT_FILE` names a CA bundle, for example `C:\Program Files\Git\ucrt64\etc\ssl\certs\ca-bundle.crt` from Git for Windows 2.56 and later (`mingw64` instead of `ucrt64` before 2.56), as in CI.
+- Windows: libusb's `version_describe.h` is generated by `build-aux/gen-describe.ps1`, which CMake runs with `-ExecutionPolicy Bypass`. An execution policy set by Group Policy (`MachinePolicy` or `UserPolicy` in `Get-ExecutionPolicy -List`) takes precedence over that switch ([about_Execution_Policies](https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-5.1)); with `Restricted` or `AllSigned` the build stops at `version_describe.h` with `running scripts is disabled on this system`. The script only starts `build-aux/gen-describe.sh` with the `bash.exe` of Git for Windows, so a `.cmd` file that runs the shell script directly can replace PowerShell for this step without changing the policy. CMake passes it the `.ps1` path as the fifth argument and the source and output paths as the sixth and seventh; configure with `-DLIBUSB_POWERSHELL_EXECUTABLE=<path of the .cmd file>`:
+
+  ```bat
+  @"C:\Program Files\Git\bin\bash.exe" "%~dpn5.sh" %6 %7
+  ```
 
 ## Web converter releases
 
@@ -82,6 +87,8 @@ If configuration reports `Could NOT find Python3` or selects an unusable interpr
 cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=gcc -DCMAKE_CXX_COMPILER=g++ -DPython3_EXECUTABLE="C:/path/to/python.exe"
 ```
 
+The documentation runs the Python tools as `python3`. With the python.org installer for Windows, which provides `python.exe` and the `py` launcher but no `python3.exe`, `python3` resolves to the Microsoft Store alias in `WindowsApps`, which prints `Python was not found` and exits with code 9009 (49 in Git Bash). Installs that provide `python3.exe`, such as the Python Install Manager, are not affected. In that case run these commands with `python` or `py -3`, for example `py -3 tools/check_conventions.py --base origin/main`.
+
 If `gen-describe.ps1` fails while generating libusb's `version_describe.h`, check the Bash path printed in the build output. A WindowsApps or System32 `bash.exe` can launch WSL and fail with `WSL_E_DEFAULT_DISTRO_NOT_FOUND` when no distribution is installed. Install Git for Windows with Bash, or use Portable Git, and put its `cmd` and `usr\bin` directories on `PATH` before retrying the build. Use Bash and `cygpath.exe` from the same Git installation.
 
 After `cmake --build build --target libs --parallel` succeeds, copy the toolchain's runtime DLLs beside the patched libraries:
@@ -125,7 +132,7 @@ Build configuration parameters:
 
 SDL and FreeType settings forced by the root `CMakeLists.txt` cannot be overridden with `-D`.
 
-With `ANYPS5_USE_SYSTEM_DEPS=ON` those libraries come from the system (on Debian and Ubuntu: `libsdl2-dev`, `libfreetype-dev`, `libvulkan-dev`, `spirv-headers`, `glslang-dev`, `glslang-tools` and `spirv-tools`). A missing package, Vulkan-Headers older than 1.4.310 (the agc driver uses `VK_KHR_maintenance8`), or an SDL2 without the HIDAPI joystick driver (sdl2-compat over SDL3, or a build with HIDAPI disabled, which breaks the pad and disk-audio tests), fails the configure with an error and never falls back to the submodule. The forced SDL and FreeType settings from the root `CMakeLists.txt` do not apply with the flag ON: the system SDL2 comes with whatever its distribution enabled. The prx libraries are shared objects, so SDL2 is linked from the system as a shared library; the default build keeps its own static SDL2. `ffmpeg-core`, `libjpeg-turbo`, `stb`, `VulkanMemoryAllocator` and `LibAtrac9` always stay bundled and still need `git submodule update --init`.
+With `ANYPS5_USE_SYSTEM_DEPS=ON` those libraries come from the system (on Debian and Ubuntu: `libsdl2-dev`, `libfreetype-dev`, `libvulkan-dev`, `spirv-headers`, `glslang-dev`, `glslang-tools` and `spirv-tools`). A missing package, Vulkan-Headers older than 1.4.310 (the agc driver uses `VK_KHR_maintenance8`), or an SDL2 without the HIDAPI joystick driver (sdl2-compat over SDL3, or a build with HIDAPI disabled, which breaks the pad and disk-audio tests), fails the configure with an error and never falls back to the submodule. The forced SDL and FreeType settings from the root `CMakeLists.txt` do not apply with the flag ON: the system SDL2 comes with whatever its distribution enabled. The prx libraries are shared objects, so SDL2 is linked from the system as a shared library; the default build keeps its own static SDL2. `ffmpeg-core`, `libjpeg-turbo`, `stb`, `VulkanMemoryAllocator`, `LibAtrac9`, `ogg` and `vorbis` always stay bundled and still need `git submodule update --init`.
 
 ## Quick syntax checks
 
@@ -157,7 +164,7 @@ On Windows MinGW frees `thread_local` objects before their destructors run, so t
 
 ## Compute pipeline replay
 
-Build `agc_compute_pipeline_replay` in the full build with `-DANYPS5_ENABLE_SPIRV_TOOLS=ON`; replay validates the captured module before calling Vulkan. Set `APS5_DUMP_COMPUTE_PIPELINES` to a dedicated empty directory before starting a title to save each uncached compute pipeline's final SPIR-V, descriptor layouts, push constant ranges, specialization values, subgroup size and creation flags before compilation. Files are named `compute-<identity>/capture.aps5cp`; identical records are deduplicated. Capture stops with an error at 128 records, 256 MiB total or 36 MiB per record (at most 8,388,608 SPIR-V words, or 32 MiB of shader code). Capture files contain shader code and device metadata, but no guest buffers or textures; review them before sharing.
+Build `agc_compute_pipeline_replay` in the full build with `-DANYPS5_ENABLE_SPIRV_TOOLS=ON`; replay validates the captured module before calling Vulkan. Set `APS5_DUMP_COMPUTE_PIPELINES` to a dedicated empty directory before starting a title to save each uncached compute pipeline's final SPIR-V, descriptor layouts, push constant ranges, specialization values, subgroup size and creation flags before compilation. Files are named `compute-<identity>/capture.aps5cp`; identical records are deduplicated. The pipelines of the start-up f32 denormal flush probe are not captured. Capture stops with an error at 128 records, 256 MiB total or 36 MiB per record (at most 8,388,608 SPIR-V words, or 32 MiB of shader code). Capture files contain shader code and device metadata, but no guest buffers or textures; review them before sharing.
 
 Set `APS5_DUMP_COMPUTE_MIN_WORDS` to capture only modules at or above that SPIR-V word count, for example `100000` when investigating large NVIDIA compilations. The default is `0` (all modules); values outside `0` through `8388608` fail. The filter applies only when capture is enabled.
 
@@ -186,13 +193,26 @@ build/core/libs/prx/libSceAgcDriver/agc_pm4_replay submits
 
 On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_driver_pm4_replay` captures submissions made with the libSceAgc command builders through the driver and checks the index, the held waits, the conditional ranges, the dwords, the decode and the outcome of each wait, then checks hand-made captures: each release route; a store of another queue to the awaited bytes that entered before or after the store of the waiting queue (unknown); the label history limit, with the stores after the label on the waiting queue or on another queue; a fill the history does not keep; a store in an earlier submission overwritten later; later stores, rejected values and a missing rewind tail (unreleased); the six captures of the reviews (a two-queue deadlock, a store of 0 behind a released wait on another queue, with and without that wait held at submit, and labels pushed out of the history by stores of another queue), none of whose waits may be released except the one held at submit; five groups of waits in eight submission orders with identical outcomes; an index without the held and conditional columns; corrupt captures; then a failed write. `agc_driver_pm4_replay_tool` runs the tool on the driver capture and checks its exit codes and report.
 
+## Frame capture and replay
+
+Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps); an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk.
+
+`agc_frame_replay <capture> [--no-pace] [--no-release] [--release-after-ms <n>] [--no-synthesize] [--strict] [--dump <address>:<bytes>:<file>]... [--frames <dir>]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers.
+
+```sh
+cmake --build build --target agc_frame_replay
+build/core/libs/prx/libSceAgcDriver/agc_frame_replay capture
+```
+
+On Windows use `agc_frame_replay.exe` and prepend `build/core/libs/libs/unpatched` to the process `PATH`. With `BUILD_TESTING=ON`, `agc_frame_capture` checks the file format (round trip, zero-block elision, truncated and corrupt files), and `agc_driver_frame_capture_eop` reserves and submits six EOP flips with `APS5_FRAME_CAPTURE_FRAMES=3` and checks that the capture starts after the first flipping submission and holds three frames of one reservation and one submission each, then that a flipping submission on another thread leaves this thread's flip count unchanged, and `agc_driver_frame_replay` captures two frames of CPU writes followed by DMA copies, the second from a block committed during the capture, replays them in `agc_frame_replay` and compares the copies.
+
 ## Pipeline statistics
 
 Set `APS5_PIPELINE_STATS=1` to capture and print driver statistics for each newly created graphics or compute pipeline. This requires `VK_KHR_pipeline_executable_properties` and `pipelineExecutableInfo`; an unsupported device fails with an error. Statistic names and units are driver-specific. Capturing statistics can increase pipeline compilation cost. The setting is disabled by default.
 
 ## Device loss reports
 
-On a device that supports `VK_EXT_device_fault`, the first `VK_ERROR_DEVICE_LOST` prints the driver's fault description, the faulting addresses and the vendor fault codes as `[device-fault]` lines. Set `APS5_GPU_CHECKPOINTS=1` to also record a `VK_NV_device_diagnostic_checkpoints` marker with the program address before each compute dispatch; the report then lists the last markers the GPU reached. Checkpoints are disabled by default and ignored on devices without the extension.
+On a device that supports `VK_EXT_device_fault`, the first `VK_ERROR_DEVICE_LOST` prints the driver's fault description, the faulting addresses and the vendor fault codes as `[device-fault]` lines. Set `APS5_GPU_CHECKPOINTS=1` to also record a `VK_NV_device_diagnostic_checkpoints` marker with the program address before each compute dispatch; the report then lists the last markers the GPU reached. On a device without that extension but with `VK_AMD_buffer_marker` (RADV and AMD's own drivers), each compute dispatch instead writes a numbered marker into a host-visible buffer when the GPU reaches it and another when it finishes; the report then names the programs of the last dispatch reached, of the last one finished and of up to eight dispatches between them. Checkpoints are disabled by default and ignored on devices without the extension.
 
 ## Worker sampler
 
diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md
index dd75c7f25f..3a728911cd 100644
--- a/docs/dev/ENVIRONMENT.md
+++ b/docs/dev/ENVIRONMENT.md
@@ -1,11 +1,13 @@
 # Environment variables
 
-The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetting`, `MaskFromEnvironment`, `EnvInt`, `GetEnvironmentVariableA`, `GetEnvironmentVariableW` with a wide literal, `configured`, `PipelineSwitch`, `environmentCount` and `addWideString` (the wide names the Windows entry stub reads). This table lists every `APS5_*` and `ANYPS5_*` name it reads, its kind, the value used when it is unset and what it does, one table per library. Regenerate the names with `python3 tools/env_reference.py --table`; the Conventions check fails when a name the code reads has no row here, or a row's name is no longer read.
+The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetting`, `MaskFromEnvironment`, `EnvInt`, `GetEnvironmentVariableA`, `GetEnvironmentVariableW` with a wide literal, `configured`, `PipelineSwitch`, `environmentCount`, `EnvironmentNumber` and `addWideString` (the wide names the Windows entry stub reads). This table lists every `APS5_*` and `ANYPS5_*` name it reads, its kind, the value used when it is unset and what it does, one table per library. Regenerate the names with `python3 tools/env_reference.py --table`; the Conventions check fails when a name the code reads has no row here, or a row's name is no longer read.
 
 ### core/libs
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
+| `ANYPS5_JOB_MANAGER_CASE` | string | `core/libs/tests/JobManagerReference.cpp` |  | selects the CPU fixture run by `tools/run_job_manager_reference.py` |
+| `ANYPS5_JOB_MANAGER_HOST` | presence | `core/libs/tests/JobManagerReference.cpp` |  | runs the reference adapter against the host fallback instead of the loaded guest module |
 | `ANYPS5_LOADEXEC_PARENT` | string | `core/libs/tests/GuestLoadExecHost.cpp` |  | variable the Windows entry stub reads; its wide name is built in `core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp` |
 | `ANYPS5_LOADEXEC_TEST_ROOT` | string | `core/libs/tests/GuestLoadExecHost.cpp` |  | directory the load-exec host test reads its guest executable from |
 | `ANYPS5_TEST_QUOTED_ARGV0` | presence | `core/libs/tests/GuestLoadExecHost.cpp` |  | makes the load-exec test's first argument one with quotes, a backslash and non-ASCII text |
@@ -28,6 +30,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_BDA_BYTE_READS` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp` |  | forces one address lookup and byte load per byte for BDA reads instead of a wide dword load |
 | `APS5_BDA_DWORD_STORES` | presence | `core/shader/recompiler/Translation/src/MemoryInstructions/FlatInstructions.cpp` |  | reverts BDA writes to one address store per dword instead of a wide multi-dword store |
 | `APS5_DUMP_IR` | string | `core/shader/recompiler/Recompiler.cpp` |  | hex code address (or all) of the programs whose IR is printed after each front-end pass |
+| `APS5_EXACT_RCP` | presence | `core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp` |  | emits `v_rcp_f32` and `v_rcp_iflag_f32` as the RDNA hardware reciprocal (bit-exact for normal inputs and results) instead of the driver's division; adds about 13k SPIR-V words to each shader that uses them |
 | `APS5_GATHER_CONST` | integer | `core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp` |  | integer every non-depth gather returns in all four texels instead of the sampled value |
 | `APS5_IMAGE_TABLE_KEY_SCAN` | integer | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` | 256 | number of image-table entries the key scan examines |
 | `APS5_IMAGE_TABLE_STRICT` | presence | `core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp` |  | sets image-table materialization to its strict form; 0 leaves it off |
@@ -81,6 +84,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_BARRIER_VALIDATE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | counts the barriers a hazard-tracking validator would emit and skip, by class and hazard kind |
 | `APS5_BATCH_CAP` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` | 64 | recorded work since the last submit at which a label batch, flush or reap is forced (0 disables the cap) |
 | `APS5_BDA_FLUSH` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | also flushes pending storage results over address-based shader regions, which are otherwise exempt |
+| `APS5_BDA_STAGING_MIN_THREADS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 512 | smallest dispatch, in threads, whose address-based build stages its written elements device-local; an indirect dispatch always does |
 | `APS5_BDA_TABLE_CACHE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp` | 8 | number of recently used BDA page tables kept in the cache (1 is the previous behaviour) |
 | `APS5_BLOCK_WRITEBACK_EACH` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | stores the touched units only on every write-back instead of widening repeated partial stores |
 | `APS5_BLOCK_WRITEBACK_FRAMES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` | 8 | window of presents within which repeated partial stores trigger the whole-image widening |
@@ -91,6 +95,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_CAPTURE_GPU_COPIES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | records GPU buffer copies in the capture trace (requires APS5_CAPTURE_TRACE) |
 | `APS5_CAPTURE_INPUTS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | records each draw's inputs in the capture trace (requires APS5_CAPTURE_TRACE) |
 | `APS5_CAPTURE_TRACE` | presence | `core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp` |  | writes capture events to capture-trace.log |
+| `APS5_CAPTURE_TRACE_PATH` | string | `core/libs/prx/libSceAgcDriver/Execution/include/CaptureTrace.hpp` | capture-trace.log | file path for the capture events log |
 | `APS5_CHECK_INDIRECT_ARGS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | reads GPU-side indirect draw records back on the CPU and prints the first ones |
 | `APS5_COMPLETION_STORE_SYNC` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | makes a store made by a completion action wait for later batches over its range |
 | `APS5_COPY_DESTINATION_STRICT` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | refuses a CPU copy whose destination has any pending writer, not only an unsettled one |
@@ -107,6 +112,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_CPU_STORES` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | writes packet stores on the CPU instead of recording them on the GPU |
 | `APS5_DCC_KEYS_EACH` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records every DCC key store at once instead of batching them |
 | `APS5_DEPTH_COPY_MIN_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 1024 | minimum surface size in KiB for a depth target to take the depth-copy path |
+| `APS5_DEPTH_PLANE_COPY_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp` | 256 | budget in MiB of the sampled depth-plane copies kept for reuse (least recently used copies leave first); `0` keeps every copy |
 | `APS5_DEPTH_PLANE_WHOLE_STORE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp` |  | stores a stale depth plane whole when memory over it is read, instead of only the 64 KiB units the read overlaps |
 | `APS5_DISPATCH_CACHE_BYTES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 268435456 | size of the dispatch cache in bytes (0 keeps the default of 256 MiB) |
 | `APS5_DISPATCH_CACHE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 8192 | number of dispatch cache entries; 0 picks a default from the variant count |
@@ -114,11 +120,12 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_DISPATCH_VARIANTS` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` | 4 | number of dispatch variants kept per cache entry, clamped to the maximum |
 | `APS5_DISPMOVE_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` | 1024 | upper bound in KiB on the read-only buffers a dispatch-cache hit moves into its template, above which the dispatch is prepared again |
 | `APS5_DRAIN_ALL` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | drains every packet, disabling the batched recording path |
-| `APS5_DRAIN_COMPLETION_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | records completion labels immediately instead of deferring them with the batch |
+| `APS5_DRAIN_COMPLETION_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | records completion labels immediately instead of deferring them with the batch, and drains a label recorded while a copied write-back is pending instead of storing it behind the write-backs |
 | `APS5_DRAW_CACHE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` | 4096 | number of entries in the draw cache; 0 keeps the default 4096 |
 | `APS5_DRAW_DRAIN` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketMemory.cpp` |  | treats draw packets as drains, waiting for them instead of recording ahead |
 | `APS5_DRAW_INPUTS_IN_PLACE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | binds draw vertex and index ranges in place from host imports also with NVIDIA's Windows driver, which copies them by default |
 | `APS5_DRAW_KEY_ALL_USER_WORDS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawRegisterKey.cpp` |  | includes all 32 user words in a draw's register key instead of the used count |
+| `APS5_DRAW_PIPELINE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp` |  | runs the second half of a pipelined draw on a draw finisher thread and keeps proofs for the collect epoch |
 | `APS5_DRAW_SNAPSHOT_MAX_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 64 | upper bound in MiB on the snapshot bytes a draw's bindings may take |
 | `APS5_DRAW_TRANSITIONS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | keeps the per-draw upload and download barriers and layout transitions instead of the lean recorded path |
 | `APS5_DRAW_UPLOAD_MAX` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 4096 | largest draw snapshot in bytes copied into the per-recorder upload chunk; 0 turns the chunk off |
@@ -145,8 +152,12 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_FLIP_READ_CHECK` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records the in-place reads of completed batches and checks them before the present blit's fence |
 | `APS5_FORCE_SDR` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/HostHdr.cpp` | unset | suppresses advertised HDR availability while retaining detected host capabilities; uses the existing SDR presentation path |
 | `APS5_FORCE_STRUCTURIZER_FALLBACK` | presence | `core/libs/prx/libSceAgcDriver/tests/ControlFlow.cpp` |  | makes the control-flow test expect the reach-flag fallback instead of no cloning |
+| `APS5_FRAME_CAPTURE` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` |  | directory in which the driver records a few frames of the title's driver calls and guest memory for `agc_frame_replay` |
+| `APS5_FRAME_CAPTURE_AT_FLIP` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 1 | frame boundary (CPU flip or submission that flips) at which the frame capture starts when no trigger file is set |
+| `APS5_FRAME_CAPTURE_FRAMES` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` | 10 | number of frame boundaries the frame capture records |
+| `APS5_FRAME_CAPTURE_TRIGGER` | string | `core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp` |  | file whose appearance starts the frame capture at the next frame boundary; a number in it replaces the frame count |
 | `APS5_FULL_BARRIERS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records every barrier instead of merging redundant ones |
-| `APS5_GPU_CHECKPOINTS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | attaches device diagnostic checkpoints through VK_NV_device_diagnostic_checkpoints |
+| `APS5_GPU_CHECKPOINTS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | attaches device diagnostic checkpoints through VK_NV_device_diagnostic_checkpoints, or buffer markers through VK_AMD_buffer_marker on a device without it |
 | `APS5_GPU_COPY_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` | 1024 | size cap in KiB on a descriptor sub-range copied through the GPU path, larger ones staying on the CPU |
 | `APS5_GPU_NO_WRITEBACK` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | skips writing GPU results back into guest memory |
 | `APS5_GPU_WAIT_TIMEOUT_MS` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp` | 1000 | milliseconds a GPU wait may run before a warning is printed |
@@ -164,7 +175,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_KEPT_DESCRIPTOR_SETS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` | 8 | number of freed dedicated image table descriptor sets kept for a later build with the same layout and sizes; 0 keeps none |
 | `APS5_KEYFLIP_DROP` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | drops a pending unit's results on a clear-code to uncompressed key flip, as before |
 | `APS5_KEYS_FILL_CLEAR` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | clears an image from DCC keys whose fill pattern it matches (only when set to 1) |
-| `APS5_LABEL_FLUSH_US` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` | 1000 | age in microseconds at which a pending label batch is recorded or submitted |
+| `APS5_LABEL_FLUSH_US` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | age in microseconds at which a pending label batch is recorded or submitted; unset is 1000 with batched label submission and 250 when `APS5_NO_LABEL_BATCH_SUBMIT` or `APS5_NO_LABEL_BATCHING` turns it off |
 | `APS5_LABEL_GATE_ALL` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | gates a label store on any pending completion, not only one overlapping the range |
 | `APS5_LABEL_LOCK_EACH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | records each label under the GpuMutex instead of deferring it |
 | `APS5_LABEL_OWN_LOCK` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketFlush.cpp` |  | makes a label flush take the GpuMutex itself instead of relying on a self-locking packet |
@@ -191,6 +202,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_ATOMIC_STAGING` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | binds atomic shader elements in place instead of staging them through a device-local buffer |
 | `APS5_NO_BARRIER_BATCH` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records the staging, write-back and label-run leading barriers that a covering barrier already orders, instead of leaving them out |
 | `APS5_NO_BARRIER_ELISION` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records every leading barrier instead of merging it into the following submission |
+| `APS5_NO_BDA_STAGING` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | binds the written elements of address-based compute builds in place in the host imports instead of staging them device-local |
 | `APS5_NO_BDA_TABLE_CACHE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp` |  | builds every BDA descriptor table instead of reusing the recent-table cache |
 | `APS5_NO_BLOCK_TRACKING` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | tracks array layers, or the whole surface, instead of 64 KiB blocks |
 | `APS5_NO_BUFFER_CLASSES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp` |  | matches exact sizes in the buffer pool instead of rounding up to size classes |
@@ -223,6 +235,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_DRAW_RESOURCE_CACHE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | builds every draw's shader resources instead of reusing a cached identical build |
 | `APS5_NO_DRAW_SRT_ENTRIES` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` |  | disables the draw cache's SRT entries, so every draw decodes its programs |
 | `APS5_NO_DRAW_STAGE_DATA_HITS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` |  | disables draw-cache hits that differ only in a stage's ShaderData words |
+| `APS5_NO_EMPTY_INDIRECT_SKIP` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp` |  | builds the stages of an indirect draw whose front program last took the CPU path even when none of its records draws anything, instead of reading its records first and skipping it |
 | `APS5_NO_EPOCH_COLLECT_MAP` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp` |  | drops the per-epoch map of completed collects, leaving only the fixed-size thread memo to answer a repeated collect |
 | `APS5_NO_EPOCH_REVALIDATE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | runs every Revalidate's per-element and per-region checks instead of the epoch gate |
 | `APS5_NO_FAST_REVALIDATE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | always repeats the resource lookups instead of using the fast proof |
@@ -255,6 +268,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_LABEL_BATCHING` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | turns off every label-batching behaviour, the label runs, queued labels and batched submit |
 | `APS5_NO_LABEL_BATCH_SUBMIT` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/DeferredLabels.cpp` |  | disables batched label submission |
 | `APS5_NO_LABEL_PACKET_FLUSH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketFlush.cpp` |  | disables the label flush between packets |
+| `APS5_NO_LABEL_READBACK_STORE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | leaves pending linear and small storage images on the GPU at a label instead of storing them before it |
 | `APS5_NO_LABEL_RUNS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | records every store in a run of its own between a barrier pair |
 | `APS5_NO_LABEL_SHORTCUT` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp` |  | disables the pending-label table shortcut in a memory wait |
 | `APS5_NO_LAYER_CLEAR` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp` |  | tracks every surface as one layer instead of per array layer |
@@ -293,6 +307,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_RESIDENT_PRESENT` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | always presents through guest memory instead of the resident image |
 | `APS5_NO_RESIDENT_TARGETS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | copies every render target in and out again instead of keeping it resident |
 | `APS5_NO_RESOURCE_CACHE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | disables the shared resource cache, so every dispatch builds its resources fresh |
+| `APS5_NO_RUN_MEMO` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | walks the lease for a host import's run of ranges on every lookup instead of reusing the bounds found for the same lease snapshot and import window block |
 | `APS5_NO_SAMPLED_FROM_STORAGE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | keeps every sampled texture a CPU snapshot instead of viewing the surface's storage image |
 | `APS5_NO_SAMPLER_CACHE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | creates a sampler per binding instead of caching them |
 | `APS5_NO_SEPARATE_QUEUED_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp` |  | lets a queued label enter the recorded table and replace a recorded entry of its dword |
@@ -328,6 +343,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_WRITE_EVIDENCE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/WriteEvidence.cpp` |  | disables the written-element evidence that lets a read skip the flush hook |
 | `APS5_NO_WRITE_ONLY_PASSES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | counts a buffer a draw only stores to as read and written, so the next draw storing to it begins a new render pass |
 | `APS5_NO_WRITTEN_SHADOW` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | binds written staging elements in place instead of through the written shadow |
+| `APS5_NV_DIAGNOSTICS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | creates the device with VK_NV_device_diagnostics_config and VK_NV_device_diagnostic_checkpoints where supported, for Nsight Aftermath crash dumps |
 | `APS5_PACKET_EPOCH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitStatistics.cpp` |  | makes queue workers bump the collect epoch before every packet |
 | `APS5_PIPELINED_DRAWS` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp` | 8 | depth of the queue-0 draw pipeline: 0 records draws inline, 1 selects the default depth of 8, and any other value is the depth capped at 256 |
 | `APS5_PIPELINE_DISPATCH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp` |  | records an eligible dispatch as an item in the queue-0 pipeline instead of running it inline |
@@ -335,8 +351,8 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_PIPELINE_DRAIN_FILLS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp` |  | runs queue-0 buffer fills through the draw pipeline to keep their order; any value stores them in place instead |
 | `APS5_PIPELINE_DRAIN_LABELS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | answers a queue-0 wait from the draw pipeline's own pending labels while it is busy; any value drains the pipeline at the wait |
 | `APS5_PIPELINE_DRAIN_SUBMISSIONS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | lets a submission end without submitting its recorded work, so it joins a later submit with the pipeline's queue; any value drains the pipeline and submits at the end of the submission |
-| `APS5_PIPELINE_JOURNAL_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | number of journal entries loaded at most; a longer journal is truncated to this count |
-| `APS5_PIPELINE_JOURNAL_MAX_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | size cap in MiB on the pipeline journal; later pipelines are not recorded once it is reached |
+| `APS5_PIPELINE_JOURNAL_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | number of journal entries loaded at most; a longer journal keeps its last entries, the ones recorded last |
+| `APS5_PIPELINE_JOURNAL_MAX_MIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` | 1024 | size cap in MiB on the pipeline journal; the file is rewritten down to three quarters of the cap when it is reached, keeping the newest pipelines and the modules they name and leaving room for later records |
 | `APS5_PIPELINE_JOURNAL_THREADS` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp` |  | threads that replay the journal's pipelines, 0 disables the replay; unset uses half the hardware threads, at least one |
 | `APS5_PIPELINE_STATS` | string | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | captures and prints driver statistics for each new pipeline, requiring `VK_KHR_pipeline_executable_properties`; `1` enables |
 | `APS5_PIPELINE_STORE_ENTRIES` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp` | 1024 | LRU bound on the entries of the pipeline store; an entry is evicted only once no recorded draw holds it |
@@ -376,6 +392,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_STORE_AT_LABEL` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | flushes every pending storage-image result when a label is written on the GPU |
 | `APS5_SUBMISSION_EPOCH_EACH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | bumps the guest-memory collect epoch on every submission instead of only when the submission is newer than the last bump |
 | `APS5_SUBMIT_AT_END` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | submits recorded work at the end of a submission even when a worker is queued |
+| `APS5_SUBMIT_PROGRESS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp` |  | enables opt-in pacing for eligible queue-zero submission prefixes within a shared nominal two-millisecond acknowledgement/timeline budget; timeout retains asynchronous acceptance |
 | `APS5_SUSPEND_DRAIN` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp` |  | drains the device at a suspend point |
 | `APS5_SYNC_COMPLETION_DRAWS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp` |  | keeps every draw with completion work synchronous |
 | `APS5_SYNC_DISPATCH` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | waits for every dispatch instead of batching it |
@@ -416,6 +433,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_TRACE_QUERY` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp` |  | prints every 16th page query with its cost |
 | `APS5_TRACE_RESOURCE_KEY_MISSES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | reports shader-resource cache key misses |
 | `APS5_TRACE_SECONDS` | string | `core/libs/prx/libSceAgcDriver/Execution/include/PerformanceTrace.hpp` |  | records from the first present `<start>` seconds after the first present for `<length>` seconds (whole numbers, `start:length`) |
+| `APS5_TRACE_SHADER_CORRELATION` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp` |  | traces shader selection and preparation failure tokens through draw batches |
 | `APS5_TRACE_SHADER_REGS` | string | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp` |  | prints a shader's registers for one hex program address, or `all` |
 | `APS5_TRACE_SHADOW` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/UnitShadow.cpp` |  | prints the first n shadow publishes, the first 64 seeds, every evict and retire |
 | `APS5_TRACE_SKIPS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderDiagnostics.cpp` |  | reports each distinct shader skip once |
@@ -432,6 +450,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_VERIFY_DATA_HITS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` |  | recomputes a dispatch data hit and aborts on a disagreement |
 | `APS5_VERIFY_DRAW_DATA_HITS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` |  | recomputes a draw data hit and aborts on a disagreement |
 | `APS5_VERIFY_DRAW_ENTRIES` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` |  | re-decodes every draw-cache hit through the full path and checks it |
+| `APS5_VERIFY_DRAW_PIPELINE` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | runs a full check next to 1 in 64 reused proofs and prints `[epoch-proofs]` counts |
 | `APS5_VERIFY_DRAW_RECIPE` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCache.cpp` |  | re-decodes a draw recipe instead of using the cache and checks the result |
 | `APS5_VERIFY_DRAW_SNAPSHOTS` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | re-reads a reused draw snapshot and counts the ones that differ |
 | `APS5_VERIFY_KNOWN_VALUES` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp` |  | serves known values through the hook too and counts mismatches |
@@ -449,7 +468,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_WRITE_EVIDENCE_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/WriteEvidence.cpp` | 16 | largest written range in KiB that the evidence may serve |
 | `APS5_WRITE_EVIDENCE_SAMPLE` | integer | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/WriteEvidence.cpp` | 16 | reads one in this many pending writes to sample them |
 | `APS5_WRITE_WATCH_IMPORTS` | string | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | how host imports are write-tracked: `probe`, `watch` or `unwatch` |
-| `APS5_WRITTEN_SHADOW_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` | 2048 | upper bound in KiB of the written staging window |
+| `APS5_WRITTEN_SHADOW_MAX_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` | 2048 (8192 on a discrete GPU) | upper bound in KiB of the written staging window; a set value is used as given on both device types |
 | `APS5_WRITTEN_SHADOW_MIN_KIB` | integer | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` | 16 | lower bound in KiB of the written staging window |
 
 ### libSceAjm.native
@@ -511,7 +530,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
-| `ANYPS5_LANGUAGE` | integer | `core/libs/prx/libSceSystemService/Export.cpp` | 1 | console language number returned by sceSystemServiceParamGetInt, defaulting to English US |
+| `ANYPS5_LANGUAGE` | integer | `core/libs/prx/libSceSystemService/SystemService.hpp` | 1 | console language number returned by sceSystemServiceParamGetInt, defaulting to English US |
 
 ### libSceVideoOut
 
@@ -520,6 +539,8 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `ANYPS5_INPUT_CONFIG` | string | `core/libs/prx/libSceVideoOut/src/InputMapping.cpp` |  | path of the input mapping file that binds host keys and mouse to guest pad actions |
 | `ANYPS5_REQUIRE_DISPLAY` | presence | `core/libs/prx/libSceVideoOut/tests/Flip.cpp` |  | makes video-out tests fail instead of skipping when no display or Vulkan device is available |
 | `APS5_NO_PAD_INPUT` | presence | `core/libs/prx/libSceVideoOut/src/PadInput.cpp` |  | ignores keyboard and mouse input so a measurement run is not advanced by a stray press |
+| `APS5_NO_WGI` | presence | `core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp` |  | turns off SDL's Windows.Gaming.Input joystick backend at default hint priority, on Windows hosts where it faults a few seconds into every run |
+| `APS5_OUTPUT_RESOLUTION` | string | `core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp` |  | `<width>x<height>` in pixels that replaces the host display's size when `sceVideoOutGetOutputStatus` and `sceVideoOutGetOutputStatusWithVrr` report the output resolution: 1 for a size below 3840 wide and 2160 high, 2 otherwise, as for the display; unset or empty follows the display, and any other value makes those calls throw |
 | `APS5_VIDEOOUT_TELEMETRY_DIR` | string | `core/libs/prx/libSceVideoOut/src/Telemetry.cpp` |  | directory where videoout.jsonl is appended with the pad and present telemetry lines; nothing is opened when unset or empty |
 
 ### libSceVideodec2
@@ -532,11 +553,12 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 
 | Name | Kind | Source | Default | Description |
 |------|------|--------|---------|-------------|
-| `APS5_CRASH_INDIRECT_MEMORY` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | dumps the words the faulting registers point at in the Windows crash report |
+| `APS5_CRASH_INDIRECT_MEMORY` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | adds to the Windows crash report up to 64 bytes from each pointer in the dump of the words the registers point at, as `[[reg+off]] @addr` lines; off when unset or empty |
+| `APS5_CRASH_STACK_BYTES` | integer | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` | 0 | bytes of the faulting thread's stack from rsp, decimal or 0x hexadecimal and at most 1048576, that the Windows crash report prints with the data at the stack words pointing outside the stack; 0 prints none |
 | `APS5_HANG_DUMP_SECS` | integer | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | seconds after which a watchdog dumps all threads and aborts |
 | `APS5_HEAP_CACHE_MIB` | integer | `core/libs/prx/libc/src/GuestHeap.cpp` | 4096 | size in MiB of the cache of freed large blocks before the oldest are decommitted |
 | `APS5_HELPER_AFFINITY_MASK` | integer | `core/libs/prx/libc/include/CpuTopology.hpp` |  | hex core mask that helper threads (deferred release, mirror refresh) are pinned to |
-| `APS5_LOG_TIMESTAMPS` | presence | `core/libs/prx/libc/include/general/LogMacros.hpp` |  | prefixes each log line with the milliseconds since the first log |
+| `APS5_LOG_TIMESTAMPS` | presence | `core/libs/prx/libc/include/general/LogMacros.hpp` |  | prefixes each log line with `[+S.UUUUUU s]`, the seconds with microsecond digits since the clock started at the first stamped line; on Windows each library has its own clock, started at that library's first stamped line |
 | `APS5_NO_PROCMAP_QUERY` | presence | `core/libs/prx/libc/include/specifics/linux/HostMapping.hpp` |  | skips the /proc/self/maps PROCMAP_QUERY ioctl and scans the maps file instead |
 | `APS5_NO_SSE4A_EMULATION` | presence | `core/libs/prx/libc/src/specifics/windows/CrashReport.cpp` |  | disables emulation of AMD-only SSE4a instructions, making such a fault fatal |
 | `APS5_NO_WRITE_WATCH` | presence | `core/libs/prx/libc/src/GuestArena.cpp` |  | disables write watching so guest buffers are fully re-read on every use |
@@ -560,7 +582,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_JOB_AFFINITY` | presence | `core/libs/prx/libkernel/Pthread/src/Thread.cpp` |  | disables pinning of job worker threads |
 | `APS5_NO_SLEEP_WAKE` | presence | `core/libs/prx/libkernel/Time/SleepWake.cpp` |  | keeps every sleep of 1 ms or less in full instead of ending it at a GPU batch, batch completion action or flip completion |
 | `APS5_NO_TIMER_RESOLUTION` | presence | `core/libs/prx/libkernel/Time/Time.cpp` |  | keeps the default 15.6 ms scheduler tick instead of raising it to 0.5 ms on Windows |
-| `APS5_TIME_SCALE` | integer | `core/libs/prx/libkernel/Time/Time.cpp` | 1 | factor applied to the guest monotonic clocks and TSC; sleeps still take real time |
+| `APS5_TIME_SCALE` | integer | `core/libs/prx/libkernel/Time/Time.cpp` | 1 | factor applied to the guest monotonic clocks and TSC; sleeps and host JobManager worker spin intervals still take real time |
 | `APS5_TRACE_APR` | presence | `core/libs/prx/libkernel/Apr/src/Apr.cpp` |  | logs every APR file read with its path, offset, size and destination |
 | `APS5_TRACE_MEMORY` | presence | `core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp` |  | logs direct-memory map, remap, protect, unmap and physical allocation operations |
 | `APS5_TRACE_SYNC` | presence | `core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp` |  | logs event-flag create, set and wait operations |
diff --git a/docs/dev/HW_ORACLE.md b/docs/dev/HW_ORACLE.md
index e48f86ed1a..c675934529 100644
--- a/docs/dev/HW_ORACLE.md
+++ b/docs/dev/HW_ORACLE.md
@@ -10,6 +10,8 @@ the tool, but differs from gfx1013 in more places. Say which GPU you measured on
 
 ## Requirements
 
+### Linux
+
 - Linux with the `amdgpu` driver and read/write access to `/dev/kfd` (usually the `render` group). Root is not needed.
 - The ROCm HSA runtime with its headers: `libhsa-runtime-dev` (Debian, Ubuntu), `rocm-runtime-devel` (Fedora),
   `hsa-rocr` (Arch), or AMD's ROCm packages. A runtime under `ROCM_PATH` or `/opt/rocm` is used first. The rest of ROCm
@@ -20,6 +22,17 @@ the tool, but differs from gfx1013 in more places. Say which GPU you measured on
 The first run builds `oracle.c` into `~/.cache/anyps5-hw-oracle/` (`HW_ORACLE_CACHE` overrides it). The target is read
 from the GPU (`HW_ORACLE_TARGET` overrides it).
 
+### Windows
+
+- AMD's Windows driver, which installs the HIP runtime (`amdhip64_6.dll`) and the code object manager (`amd_comgr_2.dll`)
+  in `System32`. ROCm, a C compiler, `clang` and `ld.lld` are not needed.
+- Python 3 from python.org or the Microsoft Store.
+
+On Windows `oracle_hip.py` replaces `oracle.c`: comgr assembles and links the kernel, and HIP runs it. The CLI, the Python
+interface and the results are the same as on Linux. `HW_ORACLE_RUNTIME` picks the runtime (`hip` on Windows, `hsa`
+elsewhere). `HW_ORACLE_HIP` and `HW_ORACLE_COMGR` name other DLLs. `ROCR_VISIBLE_DEVICES` selects the GPU, through
+`HIP_VISIBLE_DEVICES`, unless that variable is already set.
+
 ## Kernel
 
 `template.s` wraps the body under test. Per lane:
diff --git a/docs/dev/PROGRESS.md b/docs/dev/PROGRESS.md
index a1257f85a9..4e451630a3 100644
--- a/docs/dev/PROGRESS.md
+++ b/docs/dev/PROGRESS.md
@@ -22,6 +22,10 @@ Comparisons identify functions by library and name. When a head group becomes a
 
 Real removals and transitions back to stubs remain visible. Percentages retain the original snapshot totals, so eliminating duplicate accounting can change a percentage without changing available functionality. Older JSON snapshots without `shared_sources` are accepted.
 
+PR reports include a table of changed libraries with implemented export counts, declared totals, percentages before and after, and changes in percentage points (`pp`). The table uses the same two JSON snapshots as the global report. A library appears when its counts, export names or shared-source owner change, including when its counts stay equal. Unchanged libraries are omitted, and the table lists at most 100 libraries in name order with a count of omitted rows.
+
+New or removed libraries show `Not present` on the missing side. Libraries whose snapshots contain both counts and report zero exports show `No exports`; if either count is absent, the table shows `Counts unavailable`. Wrappers show `Shared sources` with the source library's name. These rows show `n/a` for the percentage change. The table retains the scanner's counting rules; it does not measure compatibility.
+
 Implemented definitions are also classified as behaviourally empty when their body holds only `(void)name;` discards and at most one constant return, bare `return;` or `throw`, including a return of a local `static` wrapper that is itself behaviourally empty; wrapper calls whose arguments contain calls do not qualify. Comparisons list newly implemented behaviourally empty functions without changing any count. Older JSON snapshots without `inert_names` are accepted.
 
 ## One library
diff --git a/docs/dev/debt/libSceAgc.md b/docs/dev/debt/libSceAgc.md
index ab5eaacf4e..aa30dca0b0 100644
--- a/docs/dev/debt/libSceAgc.md
+++ b/docs/dev/debt/libSceAgc.md
@@ -6,7 +6,7 @@
 - [sceAgcDcbSetCfRegisterDirect, sceAgcDcbSetCfRegisterRangeDirect](../../../core/libs/prx/libSceAgc/DcbState/src/Registers.cpp) (libSceAgc) - signatures follow [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/main/src/game_compat.c) and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Agc/SceAgc.cs), which agree; the SET_CONFIG_REG (0x68) packet is OpenAGC's. The driver does not execute SET_CONFIG_REG, so a submitted packet throws
 - [Command buffer cursors](../../../core/libs/prx/libSceAgc/Command/src/Packet.cpp) (libSceAgc) - a null `cursor_down` is taken as a buffer without downward allocations, whose limit is `top`. PPSA16064 builds one-packet buffers of 8 dwords that way; the console's handling is unconfirmed
 - [sceAgcGetRegisterDefaultsInternal](../../../core/libs/prx/libSceAgc/Misc/src/RegisterDefaults.cpp) (libSceAgc) - returns the version 0 internal table while `sceAgcGetRegisterDefaults` now returns the version 13 public one; which internal table a console returns is not known. [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/main/src/game_compat.c) returns the table of the version passed to `sceAgcInit` instead, and null before it
-- [sceAgcGetRegisterDefaults](../../../core/libs/prx/libSceAgc/Misc/src/RegisterDefaults.cpp) (libSceAgc) - returns the version 13 public table (137 keyed entries over 84 context blocks) because the console returns the running system software's table: [ps5-vulkan](https://github.com/mpereiraesaa/ps5-vulkan/blob/4bb0c8b1423698a7369efc22b829bf16a99e7128/src/color_runtime_defaults.h) measured 128 entries over 79 blocks on 10.x and 137 over 84 on 12.02 and 13.x, the shapes of the version 10 and version 11/13 tables here, and PPSA99011 refuses the version 0 table. The [type table](../../../core/libs/prx/libSceAgc/Command/src/RegisterDefaults.cpp) is handed out as 8-byte `{key, index << 2 | bank}` pairs, the layout ps5-vulkan and the homebrew sharing its `ps5_agc_registers.h` read; the compact 12-byte entries also pack the block's register count and stride above bit 10, and those bits are dropped. No console dump of the runtime type table was compared, and AnyPS5 does not choose 10.x or 12.02 by the system software a title targets
+- [sceAgcGetRegisterDefaults](../../../core/libs/prx/libSceAgc/Misc/src/RegisterDefaults.cpp) (libSceAgc) - returns the version 13 public table (137 keyed entries over 84 context blocks) because the console returns the running system software's table: [ps5-vulkan](https://github.com/mpereiraesaa/ps5-vulkan/blob/4bb0c8b1423698a7369efc22b829bf16a99e7128/src/color_runtime_defaults.h) measured 128 entries over 79 blocks on 10.x and 137 over 84 on 12.02 and 13.x, the shapes of the version 10 and version 11/13 tables here, and PPSA99011 refuses the version 0 table. The [type table](../../../core/libs/prx/libSceAgc/Command/src/RegisterDefaults.cpp) is handed out as 8-byte `{key, index << 2 | bank}` pairs, the layout ps5-vulkan and the homebrew sharing its `ps5_agc_registers.h` read; the compact 12-byte entries also pack the block's register count and stride above bit 10, and those bits are dropped. `sceAgcGetRegisterDefaults2`, `sceAgcGetRegisterDefaults2Internal`, `sceAgcGetRegisterDefaultsInternal` and `sceAgcInit` hand out the compact 12-byte entries (`RegisterDefaultsTypeLayout::Compact`): SDK-built code walks the tables of the first two with a 12-byte stride, reads the key at +0 and the bank and index from the low 10 bits of the word at +4, and keeps an all-ones sentinel for a key it does not find. Which layout the legacy internal call returns on a console is not known. No console dump of the runtime type table was compared, and AnyPS5 does not choose 10.x or 12.02 by the system software a title targets
 - [sceAgcInit](../../../core/libs/prx/libSceAgc/DcbState/src/Init.cpp) (libSceAgc) - versions 0–13 select their register-default tables and return 0; pointer-shaped or otherwise out-of-range values (>=14) return 0 without a register-default lookup. Console probe on firmware 13.60 ([#4808](https://github.com/boykopovar/AnyPS5/issues/4808#issuecomment-6149448503)): `sceAgcInit(&buf, 8)` (NID `kW3GLb7QfPg`) returns 0 and writes nothing; scalar versions 2–13 return `0x8A6C0004` there, while AnyPS5 still returns 0 for those scalars. The probe does not show that table 13 is selected for pointer-shaped calls. [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/main/src/game_compat.c) returns `0x80890001` above 12 for `sceAgcInit`, and falls back to version 11 in `sceAgcGetRegisterDefaults2`. PPSA99011, PPSA99995, [ps5-vulkan](https://github.com/mpereiraesaa/ps5-vulkan) and [prospero-win](https://github.com/mpereiraesaa/prospero-win) call that NID with a pointer-shaped first argument. `sceAgcInit_0090` (NID `23LRUSvYu1M`) checks the state pointer and then calls `sceAgcInit`, as OpenAGC does
 - [sceAgcSetSubmitMode](../../../core/libs/prx/libSceAgc/Misc/src/Suspend.cpp) (libSceAgc) - mode values unknown; only 0 is accepted
 - [sceAgcGetGsOversubscription](../../../core/libs/prx/libSceAgc/Shader/src/GsOversubscription.cpp) (libSceAgc) - signature and occupancy formula (base and expanded vertex/export capacities, budget shift, `GE_PC_ALLOC` / `SPI_SHADER_PGM_RSRC4_GS` encoding) follow KytyPS5 only, not confirmed on hardware or a title; a negative or NaN factor that gives a negative target, a missing GS context register or a zero `GE_MAX_OUTPUT_PER_SUBGROUP` throws
@@ -21,17 +21,16 @@
 - [sceAgcDcbSet{Cx,Sh,Uc}RegistersIndirectGetSize](../../../core/libs/prx/libSceAgc/DcbState/src/Registers.cpp) (libSceAgc) - the count argument is ignored: PPSA28416 calls them with leftover register contents (0xf5f5039c), so the real functions likely take none; the size is 20 bytes either way
 - [sceAgcUpdateInterpolantMapping_0100](../../../core/libs/prx/libSceAgc/Misc/src/ShaderFusion.cpp) (libSceAgc) - name from its NID (`k0E7vkgqAuE`); the `(regs, vs, ps)` arguments are the declared ones, behaviour unknown
 - [sceAgcWriteDataPatchSetDst, sceAgcWriteDataPatchSetCachePolicy and their Async forms](../../../core/libs/prx/libSceAgc/Patch/src/WaitRegMem.cpp) (libSceAgc) - the signatures `(packet, uint8 value)` are inferred from the other patch functions, as no public declaration was found; the value is taken in the encoding of the `dst` and `cachePolicy` arguments of `sceAgcDcbWriteData` (graphics) and `sceAgcAcbWriteData` (Async, compute), and the patched packet is the one those calls would write. `sceAgcAsyncWriteDataPatchSetAddressOrOffset` is assumed to patch the address like `sceAgcWriteDataPatchSetAddressOrOffset`, as the compute WRITE_DATA packet keeps it in the same dwords
-- [sceAgcCreateInterpolantMapping_10000](../../../core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp) (libSceAgc) - name from its NID (`dbOlWdppb4o`); same arguments as `sceAgcCreateInterpolantMapping_0100`; PPSA26344 passes three pointers at each of nine observed call sites (`0x9F914E`, `0x9F91E2`, `0x9F9216`, `0x1604BBD`, `0x16122D7`, `0x1618285`, `0x161838C`, `0x16184EE`, `0x1618607`), consistent with that argument assumption, but does not read the return value there, so its return type is not established. The `SPI_PS_INPUT_CNTL` bits for `is_f16` 2 inputs follow KytyPS5, not confirmed on hardware
+- [sceAgcCreateInterpolantMapping_10000](../../../core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp) (libSceAgc) - name from its NID (`dbOlWdppb4o`); same arguments as `sceAgcCreateInterpolantMapping_0100`; PPSA26344 passes three pointers at each of nine observed call sites (`0x9F914E`, `0x9F91E2`, `0x9F9216`, `0x1604BBD`, `0x16122D7`, `0x1618285`, `0x161838C`, `0x16184EE`, `0x1618607`), consistent with that argument assumption, but does not read the return value there, so its return type is not established.
 - [sceAgcGetDataPacketPayloadRange](../../../core/libs/prx/libSceAgc/Misc/src/PacketInfo.cpp) (libSceAgc) - signature, the `{base, size in bytes}` output and the type 0 range (header + 1, one dword longer than the type 1 payload) from KytyPS5 only, matching `sceAgcGetDataPacketPayloadAddress_0090`; prosper returns header + 2 for both types from that address function
 - [sceAgcGetDataPacketPayloadAddress](../../../core/libs/prx/libSceAgc/Misc/src/PacketInfo.cpp) (libSceAgc) - forward to `sceAgcGetDataPacketPayloadAddress_0090` and the inferred (addr, cmd, type) parameters follow SharpProspero and decrypted firmware 3.20 NID mapping; not verified on console hardware
+- [sceAgcAcbMemSemaphore, sceAgcDcbMemSemaphore](../../../core/libs/prx/libSceAgc/Acb/src/Sync.cpp) (libSceAgc) - signature (cb, semaphoreAddr, waitForMailbox, signalType, operation) inferred from PPSA03396, whose wrapper passes the address second and operation 6 (signal) or 7 (wait) last; the three trailing arguments go to the packet as-is
 - [sceAgcCbMemSemaphore](../../../core/libs/prx/libSceAgc/Cb/src/Sync.cpp) (libSceAgc) - signature (cb, semaphoreAddr, operation, modifier, value) follows SharpProspero; writes 4-dword PM4 0x39 packet with control word 0x80100000 following console oracle measurements in prosper (cases agcbuild_CbMemSemaphore_a/b/c); operation, modifier and value are unused
 - [sceAgcAsyncCondExecPatchSetCommandAddress, sceAgcAsyncCondExecPatchSetEnd](../../../core/libs/prx/libSceAgc/Patch/src/CondExec.cpp) (libSceAgc) - no reference has a body for them; they are assumed to patch the COND_EXEC packet like `sceAgcCondExecPatchSetCommandAddress` and `sceAgcCondExecPatchSetEnd`, since `sceAgcAcbCondExec` writes the same packet as `sceAgcDcbCondExec`, as `sceAgcAsyncRewindPatchSetRewindState` does for REWIND
-- [sceAgcAcbAtomicGds_0900](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - name from its NID (`gQkqkLttcpw`), signature unknown
+- [sceAgcAcbAtomicGds_0900](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - name from its NID (`gQkqkLttcpw`)
 - [sceAgcDcbPrimeUtcl2](../../../core/libs/prx/libSceAgc/DcbState/src/Display.cpp) (libSceAgc) - assumed to write the packet `sceAgcAcbPrimeUtcl2` writes: PRIME_UTCL2 has the same 5 dwords on the graphics and compute rings. Not confirmed on a title. Both write a NOP of that size, as there is no TLB to prime
 - [sceAgcDcbQueueEndOfShaderActionGetSize](../../../core/libs/prx/libSceAgc/DcbState/src/ContextState.cpp) (libSceAgc) - the builder is inline in the SDK and not exported; the size is assumed to be that of the RELEASE_MEM packet `sceAgcCbReleaseMem` writes (32 bytes), the same as `sceAgcAcbQueueEndOfShaderActionGetSize`, as in [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/main/src/game_compat.c) and [REmu](https://github.com/xnetcat/REmu/blob/main/crates/remu-runtime/src/agc_dcb.rs)
-- [sceAgcUpdateInterpolantMapping_10000](../../../core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp) (libSceAgc) - name from its NID (`vieBRwlh1Lw`), not in the aerolib NID list; the `(regs, gs, ps)` arguments of `sceAgcCreateInterpolantMapping_0100` come from OpenAGC only
 - [sceAgcDcbSetZPassPredicationEnableGetSize, sceAgcDcbSetPredicationDisableGetSize, sceAgcDcbSetBoolPredicationEnableGetSize](../../../core/libs/prx/libSceAgc/DcbState/src/Predication.cpp) (libSceAgc) - the builders are inline in the SDK and not exported; the size is assumed to be that of the SET_PREDICATION packet `sceAgcDcbSetPredication` writes (16 bytes)
-- [sceAgcUpdateInterpolantMapping_10000](../../../core/libs/prx/libSceAgc/Shader/src/InterpolantMapping.cpp) (libSceAgc) follows [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c) only, not confirmed on hardware: the `sceAgcCreateInterpolantMapping_10000` transform without the identity tail, so it writes one register per pixel shader input and none for a pixel shader without inputs, and a null pixel shader throws. For an `is_f16` 1 or 3 input whose `default_value` and `default_value_hi` differ it throws: OpenAGC takes `DEFAULT_VAL` from `default_value_hi`, while KytyPS5, sharpemu and `sceAgcCreateInterpolantMapping_10000` here take it from `default_value`
 - [sceAgcAcbWaitUntilSafeForRendering](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - `(buffer, videoOutHandle, displayBufferIndex)`, the declared arguments, which PPSA12544 (01.000.010) passes inside `waitUntilSafeForRendering` and `waitUntilSafeForRendering VR` markers on an asynchronous compute command buffer, ignoring the result. It writes the same rendering-wait packet as `sceAgcDcbWaitUntilSafeForRendering`, which the driver now accepts on compute queues too; the wait blocks only that queue's worker. Whether the console encodes the compute variant differently is not known
 - [sceAgcGetDefaultCxStateFlat](../../../core/libs/prx/libSceAgc/Misc/src/RegisterDefaults.cpp) (libSceAgc) - copies up to `size` bytes (clamped to 2048 bytes, the 512-dword `AgcContextState`) from the default context state initialized from the version 8 public register default groups (CX, SH, UC), indexed by register offset, following OpenAGC `src/context_state.c`; returns `0x80890001` on null destination; version selection without `sceAgcInit` is unverified
 - [sceAgcDcbSetIndexIndirectArgs, sceAgcDcbSetIndexIndirectArgsGetSize](../../../core/libs/prx/libSceAgc/DcbDraw/src/IndexBuffer.cpp) (libSceAgc) - the `(buffer, attributeAddress, attributeIndex)` signature, a 64-bit address and a 32-bit index, is [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L1742-L1757)'s. The console oracle in prosper measured the packet, an INDEX_ATTRIBUTES_INDIRECT (opcode 0x91) holding the low address dword, the high address dword and the index ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L172-L174)), and a size of 16 bytes ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/agc.golden.tsv#L67)). The console clears the low four address bits and keeps the low 16 bits of the index; here a nonzero address that is not 16-byte aligned, or an index above 0xffff, throws, as `sceAgcDcbSetIndexBuffer` throws for a misaligned address. A null address is written as 0, as the console writes it. No title is known to call them.
@@ -41,8 +40,11 @@
 ### Functional
 
 - [sceAgcDebugRaiseException](../../../core/libs/prx/libSceAgc/Misc/src/Debug.cpp) (libSceAgc) - logs the exception id and returns 0, as retail hardware does nothing per [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c); the trap (`ud2`) OpenAGC describes for development hardware is not reproduced. Neither is verified on a console. The `uint32` exception id is [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/6f0cddd4404ec5203e71fea77e75fc373299ba3f/src/libs/agc.cpp)'s claim; OpenAGC declares no arguments, so the logged id may be leftover register contents
-- [sceAgcSetAmmSemaphoreMemory](../../../core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp) - native registration first invokes a kernel ioctl and driver registration; host registration does not reproduce their memory-access checks or error propagation. Null, empty and address-wrapping ranges throw. The full range is cleared after successful registration; duplicate registration, alignment and label-range errors match the native wrapper.
-- [sceAgcDcbSetWorkloadsActive and sceAgcDcbSetWorkloadComplete](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) (libSceAgc) and [sceAgcDriverRegisterWorkloadStream](../../../core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp) (libSceAgcDriver) - the driver call records only the stream id (1 to 31; it returns 0 for any argument and keeps no stream record), and the DCB calls write the packets [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/agc.cpp) writes: an 18-dword (active) or 12-dword (complete) `IT_NOP` packet with the stream id, and for active the 64-bit mask of the workload ids, for complete the workload id and the 64-bit clear mask of that id. Both return null for a null command buffer, an unregistered or out-of-range stream, a workload id above 63, and for active a duplicate id or a count of 0 or above 63. The layouts and checks come from KytyPS5 alone; the console oracle in [prosper](https://github.com/mattias800/prosper/blob/main/prosper/tests/data/console_oracle/agcbuild.golden.tsv) measures the null return only for unregistered streams, not the packet contents of a registered one. The error codes the console driver returns for an invalid or repeated registration are unknown, so registration never fails here. PPSA29866 calls sceAgcDcbSetWorkloadsActive while building its command buffers (sceAgcDcbSetWorkloadComplete was not observed); nothing else was observed.
+- [sceAgcSetAmmSemaphoreMemory, sceAgcSetSemaphoreMemory, sceAgcGetSemaphoreLabel](../../../core/libs/prx/libSceAgc/Misc/src/Semaphore.cpp) (libSceAgc) - the checks, error codes and clearing are the firmware's, but two firmware steps are not reproduced. After its checks, the firmware validates the memory with libkernel `qSleeVC6lwI`: an ioctl `0xc018ac15` taking `{memory, size, 1}`. The AMM call always does this; the non-AMM call only for memory from 8 TiB up that ends below 15 TiB. The firmware then sends `{7: memory, 8: size, 0xb: 0 for AMM, 1 otherwise}` through sceAgcDriverPassInfoDownward. Neither step happens here, so a registration that the kernel or driver would refuse succeeds. A null memory with a non-zero size and a range that wraps the address space throw where the firmware would fault
+- [sceAgcDcbSetWorkloadsActive and sceAgcDcbSetWorkloadComplete](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) (libSceAgc) - the DCB calls write the packets [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/agc.cpp) writes: an 18-dword (active) or 12-dword (complete) `IT_NOP` packet with the stream id, and for active the 64-bit mask of the workload ids, for complete the workload id and the 64-bit clear mask of that id. Both return null for a null command buffer, an unregistered or out-of-range stream, a workload id above 63, and for active a duplicate id or a count of 0 or above 63. The layouts and checks come from KytyPS5 alone; the console oracle in [prosper](https://github.com/mattias800/prosper/blob/main/prosper/tests/data/console_oracle/agcbuild.golden.tsv) measures the null return only for unregistered streams, not the packet contents of a registered one. PPSA29866 calls sceAgcDcbSetWorkloadsActive while building its command buffers (sceAgcDcbSetWorkloadComplete was not observed); nothing else was observed.
 - [sceAgcDcbSetWorkloadStreamInactive](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) and [sceAgcAcbSetWorkloadsActive, sceAgcAcbSetWorkloadComplete, sceAgcAcbSetWorkloadStreamInactive](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - return null without writing to the buffer for a null command buffer or a stream that is not registered (out-of-range ids included), and throw for a registered stream. The console oracle in prosper measured only that null return, with no stream registered, three argument patterns each and nothing written ([ACB](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L48-L56), [DCB](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L196-L204)); the packet a registered stream gets is not measured. KytyPS5 has no body for these four, and its `IT_NOP` layout for the DCB active and complete calls differs from the SET_UCONFIG_REG, WRITE_DATA and SET_WORKLOAD sequence [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/agc_workload_packet.c) derives from the driver, so neither is taken. The `(buf, streamId)`, `(buf, streamId, workloadId)` and `(buf, streamId, workloadIds, workloadCount)` signatures are those of the DCB calls in [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L2317-L2384), which says the ACB calls use the same driver builders; no ACB declaration was found. `sceAgcDcbSetWorkloadsActive` checks the stream before it reads the workload ids, as OpenAGC does: the console returned null for stream 1 with the ids at address 2 ([measured](https://github.com/mattias800/prosper/blob/df074498e56c0df22d74f9c6622e4709bc1c9a19/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L203)) without faulting
+- [sceAgcDcbSetWorkload*](../../../core/libs/prx/libSceAgc/DcbState/src/Workload.cpp) and [sceAgcAcbSetWorkload*](../../../core/libs/prx/libSceAgc/Acb/src/Control.cpp) (libSceAgc) - the console's packets are not written: the executor has no ATOMIC_MEM or mask table. In `libSceAgc.sprx` (firmware 12.00, read from disassembly) all six write a SET_UCONFIG_REG to 0x342 (tag `0xCC000000 | stream`, or `0xCD000000 + workload * 32 + stream` for complete) and a WRITE_DATA to 0xC343, and active and complete add an ATOMIC_MEM (header `0xC0071E00`) on the stream's 64-bit mask. [Measured on a PS5](https://gist.github.com/orezraey/befe7632b827421988b47a6c04e89e1d) (firmware 13.60): WRITE_DATA dwords 5 to 8 are `0x06010000`, `0xC343`, 0 and the mask's high half (0 for inactive); the header low byte is 0x04 on the DCB SET_UCONFIG_REG and WRITE_DATA and 0x00 on the ACB ones; the table was at `0xFE003A000 + 8 * stream`; the pointer passed to `sceAgcDriverRegisterWorkloadStream` is never written
 - [sceAgcCreatePrimState](../../../core/libs/prx/libSceAgc/Shader/src/PrimState.cpp) (libSceAgc) - the `ge_user_vgpr_en` special is passed to the user configuration registers at whatever offset the shader header stores, as the SPRX does according to [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L1181-L1252), which copies all four specials verbatim (KytyPS5 stops on any other offset). PPSA99039, PPSA99505, PPSA99515 and PPSA99997 build their headers by hand with it at 0x25c (`GE_USER_VGPR1`) instead of 0x262 (`GE_USER_VGPR_EN`), value 0, and run on the console; it is not moved to 0x262, and the driver reads neither register. `ge_cntl`, `vgt_shader_stages_en` and a used `vgt_gs_out_prim_type` must still be at their own offsets, since the driver reads those registers there, so a header that stores one elsewhere throws naming the offset, although by OpenAGC the SPRX would copy it as well
 - [sceAgcDcbEventWrite](../../../core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp) (libSceAgc) - non-sample-dump event types (any event other than 0x38 and 0x39) emit a 2-dword PM4 packet 0x46 without address dwords; the address argument is ignored for these events. Void Terrarium (PPSA03061, #5055) passes a non-null address buffer (0x00000002d2a10000) with event type 0x16 (cache flush).
+
+- This pending declaration has an unverified signature and behavior; it is a parameterless import-resolution declaration that throws through `NotImplemented_nid_no_patch`: [`sceAgcAcbInitializeDefaultHardwareState`](../../../core/libs/prx/libSceAgc/Unimplemented.cpp).
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index baec5ded56..36535fa9b4 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -9,7 +9,11 @@
 
 - [sceAgcDriverSubmitCommandBuffer, sceAgcDriverSubmitMultiCommandBuffers](../../../core/libs/prx/libSceAgcDriver/Submit/src/CommandBuffer.cpp) (libSceAgcDriver) - `queue_context` is treated as a pointer to context whose queue identifier is stored 4 bytes in, matching KytyPS5 (`src/libs/agc.cpp` `AgcDriverSubmitCommandBuffer` / `get_driver_queue`). A null context returns `EINVAL` (22). Whether the console validates other context fields before queue dispatch is unverified
 
-- [sceAgcDriverAcquireHDRScopesACQ, sceAgcDriverGetCoredumpAddress, sceAgcDriverHp3dLockEnd, sceAgcDriverHp3dLockStart, sceAgcDriverIsEsvmProcess, sceAgcDriverNopDataWritePacket, sceAgcDriverReleaseHDRScopesACQ, sceAgcDriverSetTargetRingForDiag, sceAgcDriverSetValueToSharedGds, sceAgcDriverSetWorkloadStreamInactive, sceAgcDriverSubmitReprojectionAcb, sceAgcDriverSuspendPointSubmitCdbg, sceAgcDriverSysGetGfxAppGpuResetStatus](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - signatures and behavior are unverified; these parameterless declarations only resolve imports and throw through `NotImplemented_nid_no_patch`.
+- [sceAgcDriverSubmitAcb, sceAgcDriverSubmitMultiAcbs](../../../core/libs/prx/libSceAgcDriver/Submit/src/Acb.cpp) (libSceAgcDriver) accept compute queues 0x20 to 0x57 and throw for any other. On a PS5 (firmware 13.40, measured 2026-10-19 from inside a retail title) `sceAgcDriverSubmitAcb` returned 0 and ran a label-only buffer on queues 0x20, 0x30, 0x40, 0x50, 0x57 and also 0x58, which throws here; queue 0x1F faulted inside the console's driver (SIGSEGV in libkernel on the calling thread), which throws here too. Queues above 0x58 and `sceAgcDriverSubmitMultiAcbs` were not measured. Closes when: the console's highest accepted compute queue is measured
+
+- [sceAgcDriverAcquireHDRScopesACQ, sceAgcDriverHp3dLockEnd, sceAgcDriverHp3dLockStart, sceAgcDriverIsEsvmProcess, sceAgcDriverNopDataWritePacket, sceAgcDriverReleaseHDRScopesACQ, sceAgcDriverSetValueToSharedGds, sceAgcDriverSetWorkloadStreamInactive, sceAgcDriverSubmitReprojectionAcb, sceAgcDriverSuspendPointSubmitCdbg, sceAgcDriverSysGetGfxAppGpuResetStatus](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - signatures and behavior are unverified; these parameterless declarations only resolve imports and throw through `NotImplemented_nid_no_patch`.
+- [sceAgcDriverGetCoredumpAddress](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) returns the driver's shared coredump-area pointer, which is null when no coredump area is allocated. AnyPS5 reports coredump mode disabled and does not allocate this area; the export returns null. Enabling and populating an AGC coredump area is not implemented.
+- [sceAgcDriverSetTargetRingForDiag](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) returns `0x8A6D0001` (`DRIVER_FEATURE_UNAVAILABLE`), matching the retail PS5 export. The retail diagnostic log message is not reproduced.
 
 - [Initial point context](../../../core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp) - new queues and CLEAR_STATE seed PA_SU_POINT_SIZE 0x00080008 and PA_SU_POINT_MINMAX 0xffff0000, matching every public context table in libSceAgc/Command/include/RegisterDefaultsData.hpp. Cocoon (PPSA08766) reaches geometry point output without writing these registers in the observed startup. Applying the SDK context defaults to initial/CLEAR_STATE driver context is inferred; GPU power-on reset state is not measured and is not the source of these values. Explicit writes and pushed/restored contexts retain their own values.
 
@@ -17,29 +21,32 @@
 - [Multisampled R_X and Z_X layouts](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTextureLayout.cpp) implement single-mip 2D arrays with 2, 4 or 8 equal samples and fragments, using the non-RB+ 16-pipe GFX10 equations from [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10SwizzlePattern.h). R_X accepts 1/2/4/8/16-byte elements and Z_X accepts 1/2/4-byte elements. Tile and detile preserve element bytes and leave padding untouched; they do not synchronize resident images or publish compression metadata. Other modes, sample counts, element sizes and pipe/bank XOR bits outside the supported configuration throw. PS5 address-layout equivalence has not been measured.
 - [Optional BMP frame dumps](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) use checked host stdio. An open, header, pixel or close failure prints one diagnostic and disables subsequent BMP dumps for the process; queued frames drain without more file I/O. Pixel validation and allocation failures retain the existing fatal path. The CPU fixture checks identical BMP bytes and real pipe failures. VideoOut flips on an RTX 3060 continue after a first dump that cannot be opened; header, pixel and close failures during presentation are unmeasured.
 
-- [Inactive vertex point size](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) - `PA_CL_VS_OUT_CNTL.USE_VTX_POINT_SIZE` is accepted for lines, triangles and rectangles with `GS_EN` and `HS_EN` clear, when polygon mode is disabled or both faces are filled. Points, patches and absent routing or rasterization registers still throw. Bit 16 selects the misc export's X component as PointSize ([AMD CIK register reference](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/programmer-references/CIK_3D_registers_v2.pdf), PA_CL_VS_OUT_CNTL); ignoring it for non-point rasterization follows [Vulkan PointSize](https://docs.vulkan.org/refpages/latest/refpages/source/PointSize.html). This is inferred, not measured on console hardware. XashPS5 (PPSA19111 v1.3) sets `0x01210000` on a filled triangle draw.
+- [Inactive vertex point size](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) - `PA_CL_VS_OUT_CNTL.USE_VTX_POINT_SIZE` is accepted for lines, triangles and rectangles with `GS_EN` and `HS_EN` clear, when polygon mode is disabled or both faces are filled. Patches and absent routing or rasterization registers still throw; point lists on that routing use it (next entry). Bit 16 selects the misc export's X component as PointSize ([AMD CIK register reference](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/programmer-references/CIK_3D_registers_v2.pdf), PA_CL_VS_OUT_CNTL); ignoring it for non-point rasterization follows [Vulkan PointSize](https://docs.vulkan.org/refpages/latest/refpages/source/PointSize.html). This is inferred, not measured on console hardware. XashPS5 (PPSA19111 v1.3) sets `0x01210000` on a filled triangle draw.
+- [Vertex-path point lists](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - throws for a register size of 0, a clamp maximum of 0 with `USE_VTX_POINT_SIZE`, unequal register width and height, a clamp minimum above its maximum, `USE_VTX_POINT_SIZE` without `VS_OUT_MISC_VEC_ENA`, and point sprite coordinates; sizes above one pixel need `largePoints`. Inferred, not measured: that `PA_SU_POINT_MINMAX` clamps the exported size and not the register size ([radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state.c#L1047-1064)), and that an exported size of 0 or less covers nothing (here: the smallest point). A point list with `GS_EN` and `HS_EN` clear draws as Vulkan points, and the vertex program [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `PointSize`: the misc export's X, clamped, under `USE_VTX_POINT_SIZE`, else the `PA_SU_POINT_SIZE` height (12.4 fixed-point half sizes).
+- [MEM_SEMAPHORE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (AGC driver) - the semaphore is taken as a 64-bit word, as the 8-byte address alignment `sceAgcAcbMemSemaphore` checks suggests: a signal (operation 6) writes 1 with signal type 1 and adds 1 with signal type 0, and a wait (operation 7) polls until the word is non-zero and then subtracts 1. Signals and the decrement of a wait are atomic 64-bit operations on the guest word, so CPU threads and other queues updating it concurrently are not lost. Mailbox waits throw. The width and both signal types are inferred from the AMD PM4 field names, not measured on hardware; PPSA03396 signals with type 1 after compute dispatches.
 - [RELEASE_MEM of the system counter](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (AGC driver) - a `RELEASE_MEM` with `DATA_SEL = 4` throws: the frequency and epoch of the console's 64-bit system counter are not known. [amdgpu's GFX10 packet header](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/amdgpu/nvd.h) names the value "send 64bit sys counter value", beside 3, the GPU counter, which the driver writes as a 100 MHz count of the host's steady clock. An older KFD header names 4 a CP performance counter instead. A PS4 title through #6977 writes it at the end of each frame.
 - [Point and line polygon modes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - front and back polygon types that differ while both faces are drawn throw, as Vulkan has one `polygonMode` per draw. Points are drawn only one pixel wide (`PA_SU_POINT_SIZE = 0x00080008` inside `PA_SU_POINT_MINMAX`, the `VK_KHR_maintenance5` size of a point whose shader does not write `PointSize`); other sizes, a per-vertex size and devices without `maintenance5` throw. Lines must be one pixel wide (`PA_SU_LINE_CNTL`) and use Vulkan's default line rasterization. Depth bias with a point or line polygon mode, and such a mode on a rectangle list, throw. The fields follow the [AMD CIK register reference](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/programmer-references/CIK_3D_registers_v2.pdf); the console's rasterization of these points and lines is not measured.
 - [Native multisampled depth clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) accept the recognized HTILE mask kernel's direct full-range dispatch after its GPU writes complete. Every metadata byte needs tracked driver-store coverage since notification, no intervening CPU or depth write, and HTILE words proving the current clear value of zero or one. Partial, overlapping, indirect and unproven producers remain unsupported. Existing sampled views retain the native image; guest depth publication and metadata-fill transitions remain unimplemented. Windows shared imports retain write tracking through separate aliases; private host imports that lose tracking and copied or mirrored HTILE uploads remain unsupported. Clear-word encoding and console equivalence remain unmeasured on PS5 hardware.
 - [Native depth allocation retirement](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) covers sampling-eligible multisampled owners only. Successful release notifications must cumulatively cover both complete depth and HTILE ranges; protection changes, failed releases and partial coverage keep the original guards. Retired owners leave lookup and metadata routing, while held views and recorded work retain their images. Retirement of single-sample or sampling-ineligible depth attachments and console equivalence remain unimplemented or unmeasured. The regression uses real allocation-registry operations with a no-op host-release callback, so it does not validate the host unmap backend.
 - [Native MSAA depth attachment feedback](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) is not implemented. A draw sampling a native multisampled depth view while attaching its source image throws before pipeline creation or render-pass recording, including read-only attachment feedback. Sampling that image in a separate draw or dispatch remains supported. The refusal compares the held native image views and their device and attachment identity; single-sample depth behavior is retained.
-- [Native multisampled depth sampling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) accepts numeric D16 or D32, two/four/eight samples, one Z_X slice and mip, and pipe-aligned HTILE without stencil or VRS, with ITERATE_256 on or off: the initial import reads no compressed Z planes, and Mesa's HTILE clear words (`radv_get_htile_fast_clear_value`) and Addrlib's HTILE footprint do not depend on ITERATE_256, which `ac_descriptors.c` ties to TC reads of compressed MSAA HTILE. Sampling eligibility is recorded before the attachment's first host clear: every HTILE word must prove the same initial clear of zero or one, and the complete sample-aware depth and HTILE ranges must be accessible and write-watched. Unsupported initial state or device sampling support retains attachment rendering but sampling throws; eligibility is never retried. Sampling rejects later guest writes, queued external GPU writes, and unproven HTILE clear/fill transitions. Guest publication, arbitrary guest depth import, stencil/raw-bit sampling, arrays and storage access remain unimplemented. The block footprint follows main's AMD Addrlib thin-block rule; the accepted HTILE clear words and PS5 equivalence are not measured on console hardware. PPSA99902's historical resident eight-sample D32 reader is documented in [#419](https://github.com/boykopovar/AnyPS5/pull/419#issuecomment-6105597729).
+- [Native multisampled depth sampling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) accepts numeric D16 or D32, two/four/eight samples, one Z_X slice and mip, and pipe-aligned HTILE without stencil or VRS, with ITERATE_256 on or off: the initial import reads no compressed Z planes, and Mesa's HTILE clear words (`radv_get_htile_fast_clear_value`) and Addrlib's HTILE footprint do not depend on ITERATE_256, which `ac_descriptors.c` ties to TC reads of compressed MSAA HTILE. Sampling eligibility is recorded before the attachment's first host clear: every HTILE word must prove the same initial clear of zero or one, and the complete sample-aware depth and HTILE ranges must be accessible and write-watched. Unsupported initial state or device sampling support retains attachment rendering but sampling throws; eligibility is never retried. Sampling rejects later guest writes, queued external GPU writes, and unproven HTILE clear/fill transitions. A guest read over the depth or HTILE range of a surface the host has not written since import (draws with depth or stencil writes, depth/stencil copies, storage write-back; not clears after a proven HTILE clear) retires it instead of throwing; that a draw without those writes leaves the console's Z planes and HTILE unchanged is inferred, not measured. Guest publication of a written surface, arbitrary guest depth import, stencil/raw-bit sampling, arrays and storage access remain unimplemented. The block footprint follows main's AMD Addrlib thin-block rule; the accepted HTILE clear words and PS5 equivalence are not measured on console hardware. PPSA99902's historical resident eight-sample D32 reader is documented in [#419](https://github.com/boykopovar/AnyPS5/pull/419#issuecomment-6105597729).
 - [sceAgcDriverSetSubmitValidationMode, sceAgcDriverGetSubmitValidationMode, sceAgcDriverSetSubmitValidationConfig, sceAgcDriverGetSubmitValidationConfig, sceAgcDriverSetValidationErrorOutputFrequency, sceAgcDriverGetShaderDebuggingStatus](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - the five validation calls return `0x8A6C1000` without reading their arguments or writing caller memory, and `sceAgcDriverGetShaderDebuggingStatus` returns 1, as [OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/3c7e8072f0d7684e930454794fd5c02056946d73/src/game_compat.c#L250-L291) reads them from Sony's libSceAgcDriver.sprx: each validation export is `mov eax, 0x8a6c1000; ret` in the copy Dragon Quest VII Reimagined bundles (0x7bb0-0x7bf0), and the debugging status is 1 in the firmware 5.50 library (0x6740). The parameters (a 32-bit mode or frequency, a mode output, a configuration pointer) follow OpenAGC and are never read. Whether later retail firmware enables submit validation or shader debugging is unverified; no title in this repository is known to call them
 - [sceAgcDriver retail constant results](../../../core/libs/prx/libSceAgcDriver/Unimplemented.cpp) (libSceAgcDriver) - the debug, capture, GPU printf, register access, GPU reset, suspend point and user data exports taken from the retail `libSceAgcDriver.sprx`, and `sceAgcDriverRegisterOwnerForSystem`, `sceAgcDriverInitResourceRegistrationInterface` and `sceAgcDriverSetResourceRegistrationInfo` in [Registration.cpp](../../../core/libs/prx/libSceAgcDriver/Resource/src/Registration.cpp), are declared without parameters: the console bodies return a constant without reading any argument, so their signatures are unknown. `sceAgcDriverAllocateToolMemoryForGpuReset` and `sceAgcDriverGetAllocatedToolMemoryForGpuReset` read only the output pointer (fourth and second argument, a 12-byte range the console zeroes); the other arguments are declared as `uint64_t`.
 - [Indices far past every vertex fetch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - when a draw's highest index is at least 64Ki vertices past the largest per-vertex record count, every index past that count is moved to it in a copy of the indices, so the zero-padded vertex copies are not sized to the original index (PPSA04159 draws a list of `0xffffffff` with primitive restart off, which asked for 160 GiB). Each attribute fetched by vertex index reads zeros there as at the original index (out-of-bounds select 0 or 1); a draw with another out-of-bounds select keeps its indices. The vertex index the shader sees changes for the moved indices, which a shader that reads it directly would notice
 - [Depth clear draws](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a draw with `DB_RENDER_CONTROL.DEPTH_CLEAR_ENABLE` is taken to write `DB_DEPTH_CLEAR` to every pixel it covers whatever the depth test, depth bounds and depth bias say: it is drawn with an always-passing depth write and the viewport depth range pinned to the clear value. The draw is rasterized as submitted, so its coverage is the draw's own. Whether the DB still applies the depth test or HiZ to such a draw is not measured
 - [GS_FAST_LAUNCH geometry](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_SHADER_STAGES_EN.GS_FAST_LAUNCH = 1` with a point list and `GE_CNTL` groups of one vertex and one primitive decodes as one point per subgroup, with the primitive limit taken from `GE_NGG_SUBGRP_CNTL.PRIM_AMP_FACTOR` and the GS/ES VGPR counts not required. Follows how RADV drives mesh shaders on gfx10.3 (`ac_nir_lower_ngg.c`, the workgroup index comes from the vertex id of the first thread), not measured on the console. Fast launch 2, other group sizes or input primitives and indexed fast-launch draws still throw. PPSA03671's fast-launch draws decode, but the title stops earlier in a wave64 vertex program, so they have not reached the GPU yet.
-- [Point-list geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 0` (point list) runs as a mesh shader with `OutputPoints` and scalar `PrimitivePointIndicesEXT`. Each primitive export emits one point whose vertex index is extracted from bits [8:0] of the packed word. A subgroup gets up to `maxVertices` points, with provoking vertex 0 and point raster primitive topology. Rectangle lists, per-stream types and point or line strips from a vertex program on the mesh path still throw.
+- [Point geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 0` emits mesh points with `OutputPoints` and scalar `PrimitivePointIndicesEXT` as required by [SPV_EXT_mesh_shader](https://github.khronos.org/SPIRV-Registry/extensions/EXT/SPV_EXT_mesh_shader.html). Each packed primitive export contributes its first 9-bit vertex index and its null bit, using the same NGG primitive packing as line and triangle outputs. The subgroup reserves at least `GE_MAX_OUTPUT_PER_SUBGROUP` point slots, as the line path does; the console budget is not measured. Points use the register size or the misc-X point-size export and clamp interpreted by the vertex-point path; those register, clamp and rasterization inferences remain unmeasured on the console. Point sprites remain unsupported. Point output from a vertex workgroup still throws. Cocoon (PPSA08766) reaches this path with triangle-strip input.
 - [Line-strip geometry output](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a geometry program with `VGT_GS_OUT_PRIM_TYPE = 1` (line strip) runs as a mesh shader with `OutputLinesEXT`: each primitive export is one line whose two vertex indices are packed like the three of a triangle, as Mesa's NGG lowering exports line strips (`ac_nir_lower_ngg_gs.c`), and each input primitive gets `VGT_GS_MAX_VERT_OUT - 1` lines where a triangle strip gets `- 2` triangles. A subgroup gets at least `GE_MAX_OUTPUT_PER_SUBGROUP` line slots; whether the console does the same is unmeasured. A fast-launch subgroup takes its line count from `GE_NGG_SUBGRP_CNTL.PRIM_AMP_FACTOR`. Line output counts as lines for polygon offset decode. The lines are drawn 1 pixel wide with Vulkan default rasterization; `PA_SU_LINE_CNTL` is not read, and console line rules are not measured.
-- [Alpha-to-coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - only `DB_ALPHA_TO_MASK = 0xaa01` is accepted: the enable bit with the four quad offsets at 2 and no `OFFSET_ROUND`, the undithered setting [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/gallium/drivers/radeonsi/si_state.c#L371-L381) programs. Draws are single-sampled, so the pixel shader [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `SampleMask` 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with `RADV_DEBUG=noatocdithering`, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in [AlphaToCoverage.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp); it is not measured on gfx1013. Vulkan's `alphaToCoverageEnable` is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, `OFFSET_ROUND`, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw. A draw without a color target on MRT0 keeps alpha-to-coverage from its MRT0 export, as [radeonsi exports MRT0 as `32_AR` for alpha-to-coverage without a color buffer](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state_shaders.cpp#L2425-L2431). A draw that enables alpha-to-coverage with no MRT0 export still throws: what the console covers then is not measured. Default dithered `DB_ALPHA_TO_MASK = 0x18701` additionally uses a per-quad sample-mask table [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/4451#issuecomment-6124848921) for eight standard samples with FP16_ABGR or 32_ABGR exports; other sample counts, custom locations, EQAA combinations and dithered UNORM16/SNORM16 exports throw. The dithered rule is not measured on gfx1013.
-- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs, and so does `PS_ITER_SAMPLE` with one-sample color targets and no depth target, because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. With a one-sample depth target, a pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. Points, lines and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA` Z interpolation (`INTERPOLATE_COMP_Z`, `INTERPOLATE_SRC_Z`) or overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) also throws. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration.
+- [Alpha-to-coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `DB_ALPHA_TO_MASK = 0xaa01` is accepted: the enable bit with the four quad offsets at 2 and no `OFFSET_ROUND`, the undithered setting [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/gallium/drivers/radeonsi/si_state.c#L371-L381) programs. Draws are single-sampled, so the pixel shader [writes](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) `SampleMask` 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with `RADV_DEBUG=noatocdithering`, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in [AlphaToCoverage.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/AlphaToCoverage.cpp); it is not measured on gfx1013. Vulkan's `alphaToCoverageEnable` is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, `OFFSET_ROUND`, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw. A draw without a color target on MRT0 keeps alpha-to-coverage from its MRT0 export, as [radeonsi exports MRT0 as `32_AR` for alpha-to-coverage without a color buffer](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state_shaders.cpp#L2425-L2431). A draw that enables alpha-to-coverage with no MRT0 export still throws: what the console covers then is not measured. Default dithered `DB_ALPHA_TO_MASK = 0x18701` additionally uses a per-quad sample-mask table [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/4451#issuecomment-6124848921) for eight standard samples with FP16_ABGR or 32_ABGR exports; other sample counts, custom locations, EQAA combinations and dithered UNORM16/SNORM16 exports throw. The dithered rule is not measured on gfx1013.
+- [A one-sample target under a multisampled rasterizer without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear, one-sample color targets and no depth target, or a one-sample depth target with no color target or one-sample color targets, is drawn as a one-sample draw at the pixel center. Without the bit every sample is taken to be at the pixel center (see the entry for a multisampled target rasterized without MSAA_ENABLE below), and a one-sample target is taken to keep the coverage of sample 0, so a one-sample depth target is tested and written once per pixel with the depth at the pixel center. That is the rule [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516) gives a color target with fewer samples than the rasterizer, but Vulkan reaches it only beside a depth or stencil target with the rasterizer's sample count ([VUID-VkGraphicsPipelineCreateInfo-subpass-01505](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/pipelines.adoc#L3033-L3041)), so here it is an analogy, and for a one-sample depth target an extension of it. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_graphics_pipeline.cpp#L127-L128) also rasterizes with the largest sample count of the bound depth and color targets ([L416-L417](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L416-L417), [L477-L480](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L477-L480)), and reads `PA_SC_AA_CONFIG` only for a `SAMPLE_COVERAGE` input ([L174-L177](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/video_core/renderer_vulkan/vk_pipeline_cache.cpp#L174-L177)). This is not measured on hardware. An `ANCILLARY` or `SAMPLE_COVERAGE` pixel input and a sample-mask export throw in a pixel program that runs (with a one-sample depth target, `ANCILLARY` only under `PS_ITER_SAMPLE`), because what the console gives them under a multisampled configuration is not known; a depth-only draw that skips its pixel program is drawn with the null program, and its `PS_ITER_SAMPLE` and pixel input bits are ignored. A pixel program with `PS_ITER_SAMPLE` and neither input runs once per pixel; if the console runs it once per sample, its atomics and append or consume counters count differently. With a one-sample depth target and without `PS_ITER_SAMPLE`, the [packed ancillary word](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) gives a program that reads `ANCILLARY` sample index 0, inferred for a pixel the guest does not iterate, and that is the sample the one-sample draw keeps. Points and alpha-to-coverage throw as for a multisampled target. With a one-sample depth target, `DB_EQAA.INTERPOLATE_COMP_Z` is accepted: with every sample at the pixel center, Z interpolated to any sample position is the center's Z, which the one-sample draw tests. That rests on the same inference; neither [PAL](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MsaaState.cpp#L117-L118) nor [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/761d5c8a54f93b3d43608f718910ed742983dd0b/src/gallium/drivers/radeonsi/si_state.c#L3314-L3316) sets the bit, and its meaning is not documented. Line and point lists (`VGT_PRIMITIVE_TYPE` 1-3, even when a geometry program turns them into triangles), `INTERPOLATE_SRC_Z` and overrasterization (`OVERRASTERIZATION_AMOUNT`, `ENABLE_POSTZ_OVERRASTERIZATION`) still throw. METAL GEAR SOLID: Peace Walker (PPSA18216) draws a one-sample color target under a 4x configuration this way; the first draw of its opening movie binds a one-sample depth target and no color target under the same configuration. Gran Turismo 7 (PPSA01317) draws its main pass with a one-sample depth target, `DB_EQAA` 0x00050000 and a 4x configuration.
+- [One-fragment multisampled color target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a color target with `CB_COLOR_ATTRIB` 4 samples and 1 fragment is decoded as one sample that keeps its coverage sample count and draws sample 0's coverage. Measured only on radeonsi GL (Radeon 610M and 680M); console behaviour is not measured. It requires static `DB_EQAA` anchors at the depth target's sample count and CMASK code 0 or 0xc-0xf. More than one but fewer fragments than samples, more fragments than samples, other CMASK codes and any guest read of the FMASK of a target the host drew still throw.
 - [MSAA_ENABLE on a single-sample target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_MODE_CNTL_0.MSAA_ENABLE` with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES = 0` is drawn like the same state without the bit when sample 0 of the four `PA_SC_AA_SAMPLE_LOCS_PIXEL_*_0` registers is at the pixel center and the draw rasterizes filled triangles or rectangles (`VGT_PRIMITIVE_TYPE` 7 or 17 as well as the triangle types) with alpha-to-coverage and conservative rasterization off. [RADV](https://gitlab.freedesktop.org/mesa/mesa/-/blob/745709a000482a4a24c91faef5c5a40bd653a863/src/amd/vulkan/radv_cmd_buffer.c#L13606-13609) programs this state for one-sample custom sample locations on GFX10 and later, where the bit makes the rasterizer use the programmed location of sample 0 ([061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11597f720535f00e79a5752e24aff6)); that the bit changes nothing else for such a draw is inferred from that and is not measured on hardware. EA Sports UFC 5 (PPSA03541) reaches a rect-list draw in this state. Other locations of sample 0, absent location registers, points, lines, alpha-to-coverage and conservative rasterization throw
-- [A multisampled target rasterized without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear is drawn with the target's sample count and every sample at the pixel center, as a single-sample scan into a multisampled target already is. On GFX10 and later the bit is what makes the rasterizer use the programmed sample locations ([RADV 061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11597f720535f00e79a5752e24aff6)), and with multisampling disabled GL rasterizes at the pixel center and gives the fragment full coverage, which radeonsi programs by clearing the bit; that the hardware does the same with `MSAA_NUM_SAMPLES` > 0 is inferred from these and is not measured on hardware. A depth target with the same sample count also has every sample at the pixel center, so each depth and stencil sample is tested and written with the depth at the pixel center, as GL allows when multisampling is disabled ([L185-L190](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L185-L190), [L422-L425](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L422-L425)). GL also lets an implementation test only a centermost sample and set every sample from it ([L425-L434](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L425-L434)), which differs when a pixel's stored samples differ; which one the console does, and how its occlusion queries count such a draw, is not measured on hardware. `DB_EQAA` Z interpolation or overrasterization and a sample-mask export with a depth target throw. Points, lines and alpha-to-coverage throw. SONIC SUPERSTARS (PPSA06888) draws such a 2x target, and METAL GEAR SOLID: Peace Walker (PPSA18216) a 4x depth and color pair.
+- [A multisampled target rasterized without MSAA_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - not measured on hardware: `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` > 0 with `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear puts every color, depth and stencil sample at the pixel center, as in GL without multisampling ([ARB_multisample](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089/extensions/ARB/ARB_multisample.txt#L185), [RADV 061bc615](https://gitlab.freedesktop.org/mesa/mesa/-/commit/061bc6151a11)). Lines cover whole pixels by the host's line rule, not the console's aliased one ([D3D11.3](https://github.com/microsoft/DirectX-Specs/blob/f37b0d6033a1/d3d/archive/D3D11_3_FunctionalSpec.htm#L13705)). Depth sample tests and occlusion counts are unknown. Rasterized points, alpha-to-coverage, and Z interpolation, overrasterization or a sample-mask export with depth throw. PPSA06888 draws a 2x target, PPSA18216 a 4x depth and color pair and 4x lines.
 - [sceAgcDriverGetEqContextId](../../../core/libs/prx/libSceAgcDriver/Eq/src/Query.cpp) (libSceAgcDriver) - returns `ident`: an end-of-pipe interrupt is delivered only to the registration whose id equals the raising queue, so `ident` is that context's id (titles register 0 or 1 for graphics and `0x20 + 8 * pipe + queue` for compute). The console's value is not known; KytyPS5 returns the event's `data`, which it fills with the interrupt's context id, whereas `data` here is the EV_CLEAR trigger count. Other event filters throw
 - [User data registers](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Diagnostics.cpp) (AGC driver) - a `SPI_SHADER_USER_DATA_*` or `COMPUTE_USER_DATA_*` register the title never wrote reads as 0 when a stage's RSRC2 count covers it, as Kyty (zeroed `UserSgprInfo`) and SharpEmu (missing registers read 0) do, and as AMD PAL and Mesa initialize them; the console's value is not confirmed
 - [SET_PREDICATION](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (AGC driver) - boolean predication follows the AMD PM4 encoding [Mesa](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/common/sid.h) uses: operation 3 reads 64 bits and 4 reads 32 bits, and bit 8 runs predicated packets when the value is non-zero (clear: when it is zero); the bit 12 hint is ignored. The address must have its low 4 bits clear, as `sceAgcDcbSetPredication` writes it. Query predication (Z-pass, primitive count), a predicated COND_EXEC, predicated command buffer chains and flips in predicated command buffers throw
 - [Barycentrics without mesh shaders](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp) (AGC driver) - a pixel shader that reads barycentrics on the mesh path is emulated only on a device with `VK_EXT_mesh_shader`; a device with neither it nor `VK_KHR_fragment_shader_barycentric` (reported on Linux RADV with a GCN 5 GPU) throws that the device has neither the barycentric extension nor mesh shaders, because a geometry stage cannot follow a mesh stage and no other route is implemented. `VK_AMD_shader_explicit_vertex_parameter`, which a GCN 5 device on RADV exposes, is an unexplored option.
-- [NGG vertex programs on the mesh path](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - an unregistered vertex program with `PRIMGEN_EN` that uses LDS or `s_barrier` runs on the geometry (mesh) path. Each input primitive is assumed to yield at most one output primitive, the subgroup is bounded by `GE_MAX_OUTPUT_PER_SUBGROUP` as a vertex budget, and the GS/ES VGPR count checks are skipped, because the merged inputs keep their positions. Taken from the code Mesa's ACO emits for NGG culling and from PPSA59322 and PPSA99010 draws, not measured on hardware. Registered programs keep the vertex path
+- [NGG vertex programs on the mesh path](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - a vertex program with `PRIMGEN_EN` that uses LDS or `s_barrier` runs on the geometry (mesh) path. Each input primitive is assumed to yield at most one output primitive, the subgroup is bounded by `GE_MAX_OUTPUT_PER_SUBGROUP` as a vertex budget, and the GS/ES VGPR count checks are skipped, because the merged inputs keep their positions. Taken from the code Mesa's ACO emits for NGG culling and from PPSA59322 and PPSA99010 draws, not measured on hardware.
 - [VGT_SHADER_STAGES_EN 0x02002008](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - this one value, `ES_EN` = 1 without `HS_EN` on a non-patch draw, is drawn as the vertex path. AMD's CIK register reference calls `ES_EN` = 1 `ES_STAGE_DS` (the ES stage runs the tessellation evaluation shader), which does not explain it on a non-patch draw. Seen only on PPSA29413 and not verified on the console; other vertex-path values with `ES_EN` set still throw.
 - [Strided buffer overhang](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - a strided buffer descriptor that ends less than one stride past the end of the readable registered allocation holding its base is bound only up to that allocation's end, even when another readable allocation starts right there. This assumes the bytes past the end are the rounded-up `num_records` of the last record (RADV rounds it up), which no fetch inside the buffer reads; a guest that really keeps a vertex split across two adjacent allocations would read zeros for the cut tail. The same holds for a read-only strided buffer that starts below the render target and runs less than one stride into it: it is bound only up to the target, as a vertex fetch whose attribute descriptor starts at the attribute's offset reaches that far past the attribute's last bytes. Taken from the RetroArch Dolphin core case in #2912, not measured on hardware.
 - [Buffer descriptor CACHE_SWIZZLE hint](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - bit 30 of word 1 in a buffer resource descriptor (`words[1] & 0x40000000u`) is normalized to zero when binding guest buffers in `ShaderResources::addGuestBuffer`. On GFX10 (gfx1013), bit 30 of V# word 1 is `CACHE_SWIZZLE` (Mesa's `gfx10-rsrc.json`: STRIDE [29:16], CACHE_SWIZZLE [30], SWIZZLE_ENABLE [31]), a cache-bank hint with no effect on the address or data, which is dropped here.
@@ -62,23 +69,31 @@
 
 ### Functional
 
+- [Written staging window on discrete GPUs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) - a written buffer element of a dispatch that is not swept is staged device-local up to 8 MiB on a discrete GPU (`Context::discreteGpu`) and up to 2 MiB otherwise; `APS5_WRITTEN_SHADOW_MAX_KIB` replaces either bound. The 8 MiB figure comes from one title on one NVIDIA Windows system (PPSA09911: a 2.5 and a 3.3 MiB skin-cache output written in place cost 55 ms of GPU time per frame, 1.8 ms of extra staging copies once staged); the point where the two copies of a larger element cost more than its in-place stores, and whether AMD or Linux drivers move it, has not been measured. The window is per element and per use, so a kernel that streams once through an element inside the window pays the copy-in and the copy-back on every dispatch.
+- [Frame capture](../../../core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp) (libSceAgcDriver) records guest memory on Windows only (a VirtualQuery walk of the registry allocations and the Windows write tracker); elsewhere a capture throws when it starts. Ranges are captured by allocation and protection, not by mapping: section views, aliases of one direct memory block and file views are snapshotted and replayed as separate private memory, so a store through one alias is not seen through another, and CPU stores to them during the captured frames are not recorded (only write-watched private memory is). Pages of the title's image are recorded during the frames only when a shader header or an array it points to lies in them and their content changed. A capture starts only at a frame boundary where the driver goes idle within 10 s, and gives up after five boundaries that do not.
+- [Frame replay](../../../core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp) (libSceAgcDriver) orders the calls of different captured threads only by their start (a call starts once every earlier call has started), so the driver sees a schedule the title could have produced, not necessarily the one it did. CPU stores a title made from threads that never call the driver are known only by the next recorded call, so the replay applies them early or late when a GPU wait needs them and derives a value from the wait's reference when no recorded store satisfies it (`of_them_synthesized`). Pacing compares the number of submissions in flight, not what they hold. Prologue registrations of shaders whose memory the title reused after registering them fail and are counted (`stale_registrations`). The title's image range must be free in the replaying process, so the tool is linked at a high image base on Windows.
 - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch.
+- [Experimental submission progress](../../../core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp) (AGC driver) - the opt-in two-millisecond pacing budget is not derived from console hardware. Cross-title performance remains unvalidated; host scheduling can overshoot the timeout and pacing can reduce CPU/GPU overlap.
+- [GPU allocation recovery](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - recovery may free too little and still throw: caller-held sampled images, pending storage results and recorder references stay alive. Budgets remain floors rather than hard device limits. Image and buffer allocation failures trim idle buffers, then sampled and clean storage cache entries. A held cache lock is reused only for a new image's allocation after lookup iterators are no longer used; hit refreshes and flushes skip that cache. Other cache, resource and device locks are tried without waiting.
 - [Scan-resistant sampled texture admission](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - while the sampled texture cache is over its budget but within a quarter over it, the first use of a texture it does not hold in a present is refused (used for its draw, then released, never cached) when its least recently used entry was used in the current or previous present, and a later use in the same present is refused when that entry was used in the current present. So a working set larger than the budget keeps a stable subset: a texture used more than once in a present still evicts an entry not yet used in that present, so a working set with interleaved multi-use textures rotates as on main, and the textures that arrive after the cache fills are created again at each use for as long as the least recently used entry is from the current present, including in the transition present after a scene change. Past a quarter over the budget the entries are evicted as before, so after the budget falls the cache can sit at up to 125% of the reduced budget until entries stop being used. Entries unused for two presents are evicted as before. A later use can evict an entry from the previous present and then be refused when the next least recently used entry is from the current present, so that entry is created again in the next present. The "current or previous present" window is an unmeasured threshold: it was chosen, not derived. Measured once, as one A-B-A series on one title (loading phase about 33000 textures per frame against a 5.4 GiB budget) on one RTX 4090, 3600 s each: 932 / 968 / 941 frames, evictions after frame 620 2.72M -> 1.17M, texture creations unchanged (about 5.8M). Nothing is measured on other titles or GPUs, and a title whose per-present working set only slightly exceeds the budget now re-creates the excess textures at every use.
-- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache's budget is what the reported heap budget leaves after the heap's use other than the cached storage images (at least the sampled textures alive) and an eighth of the budget, capped at a quarter of the budget and at `TextureCacheBudget` (a quarter of the heap's size, at least 2 GiB), never below 512 MiB; the sampled cache's budget reserves `TextureCacheBudget` for the storage cache and never falls below 2 GiB. The storage budget keeps no room for the part of that 2 GiB floor the sampled textures alive do not use: it gives room back as they grow, at its next read. As the heap's other use grows the sampled budget reaches its floor first, then the storage budget falls. Each cache trims only at its next insert, a storage image is allocated before its insert reads the budget, and both budgets read the heap at most once a second, so a burst between two reads, sampled textures included, can still exceed the reported budget. The eighth is the sampled formula's value reused and the 512 MiB floor and the caps the earlier ones; none was measured beyond PPSA11386 on one 10 GB GPU and PPSA16064 on one 8 GB GPU, and a title whose storage working set exceeds the shrunk budget re-creates storage images at each use.
+- [Texture cache budgets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - the storage image cache gets what the reported heap budget leaves after the heap's other use, the live sampled textures and an eighth of the budget, capped at half of the budget and of the heap, at least 512 MiB; the sampled cache reserves the larger of `TextureCacheBudget` and the storage images held, and keeps at least 2 GiB; above the floors neither budget plus the other cache's bytes exceeds the budget less its eighth. Both read the heap at most once a second and trim at their next insert, so a burst can exceed the budget. The storage budget gives back the part of the sampled floor not in use. The eighth and the floors were checked only on PPSA11386 (10 GB GPU) and PPSA16064 (8 GB GPU); the halves come from PPSA25636 on one 8 GB GPU (a 3.5-4 GiB storage working set). A title whose storage working set exceeds its budget re-creates storage images at each use.
 - [Polygon primitive type](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (AGC driver) - `VGT_PRIMITIVE_TYPE` 21 (`PrimitiveType::Polygon`) decodes to `VK_PRIMITIVE_TOPOLOGY_TRIANGLE_FAN` and is treated as inactive for vertex point size, like triangle fans and strips. PPSA01317 (Gran Turismo 7) submits polygon draws; whether the console performs polygon-mode decomposition or custom vertex routing is unverified.
 - [Native multisampled DCC fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) import uniform 0000/0001/1110/1111 keys into a single-layer, level-zero SW_64KB_R_X color image with 2, 4 or 8 fragments. Color and DCC/CMASK ranges must stay write-watched and unchanged; expanded or mixed initial DCC, register CMASK clears, compressed payloads, color transforms, lossy modes, other metadata changes, guest publication and writes over a live owner throw. A whole-range DCC fill with one of those keys, landed or still recorded, is taken as its fast clear; a partial fill, or a CMASK changed without a whole fill, throws. Driver-mediated reads of the color and metadata stay guarded. The metadata extent follows [AMD Addrlib](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L347-L454) with the [PS5 Mesa model](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/winsys/ps5/radv_ps5_winsys.c): GFX10.1, 16 pipes, 256-byte interleave, two maximum compressed fragments. Console geometry, concurrent guest mutation and transitions outside this subset are unverified.
 
 - [Initial stencil state](../../../core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp) uses zero for `DB_STENCIL_CONTROL`, `DB_STENCILREFMASK` and `DB_STENCILREFMASK_BF` (context `0x10b`-`0x10d`), including after `CLEAR_STATE`. The public V0, V4, V5 and V7-V11 [register-default tables](../../../core/libs/prx/libSceAgc/Command/include/RegisterDefaultsData.hpp) supply these values. Linux's [GFX10 clear-state table](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/amdgpu/clearstate_gfx10.h) agrees on the control register but uses `0x01000000` for the reference masks; the console reset values have not been measured. Planet Coaster (PPSA01736 v01.017) enables stencil tests without writing the control register.
 - [Multisampled DCC comp-to-single clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (AGC driver) - RADV's multisampled comp-to-single clear dispatch ([`radv_clear_dcc_comp_to_single`](https://github.com/mihawk-99/PS5_Mesa/blob/1ba9874f478657ccf6da72ce55f0260164cc0bd0/src/amd/vulkan/meta/radv_meta_clear.c#L954)) is recognized by its code and not run. Its clear color (user data 5 to 8, which the shader stores as the four dwords of sample 0's texel) is recorded for the surface its image descriptor names, and DCC keys of 0x10 on a multisampled target of that surface, pipe-bank XOR, size and sample count import as a clear to it, for texels of 8 to 128 bits. A record is dropped when an unmap or allocation removal covers its surface's base. The guest's color memory doesn't get the color at the blocks' first pixels, and the recorded color is assumed to be the one the keys refer to: RADV writes 0x10 keys only in a fast clear that runs this dispatch for the same image right after, and initializes DCC to 0x00 or 0xff on an image's first use ([`radv_init_color_image_metadata`](https://github.com/mihawk-99/PS5_Mesa/blob/1ba9874f478657ccf6da72ce55f0260164cc0bd0/src/amd/vulkan/radv_cmd_buffer.c#L16894)). A new image on memory reused within one mapping, with the same address, XOR, size and sample count, whose clear runs a comp-to-single shader other than the recognized one, would still import the old color.
+- [Initial depth and stencil planes](../../../core/libs/prx/libSceAgcDriver/Execution/include/QueueState.hpp) - the console's reset values of `DB_Z_INFO` and `DB_STENCIL_INFO` (context `0x010`-`0x011`) are not measured. Both start, and return after `CLEAR_STATE`, at zero (formats `INVALID`), the value of Linux's [GFX10 clear-state table](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/amdgpu/clearstate_gfx10.h). The public [register-default tables](../../../core/libs/prx/libSceAgc/Command/include/RegisterDefaultsData.hpp) write `0x80000180` and `0x20000180` instead, also with formats `INVALID`; of their other bits, only `TILE_STENCIL_DISABLE` would change a result: the HTILE layout of a multisampled depth plane whose `DB_STENCIL_INFO` was never written.
 - [Type-0 and type-1 texture descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) (`TYPE` = 0 or 1 in dword 3) with a nonzero base are bound as null images, like a zero base. TYPE 0 comes from a gfx1036 (RDNA2) measurement in issue #4139 (image sample, load and resinfo return zero, no fault). TYPE 1 comes from a gfx1010 (RDNA1) measurement in #4139 and #5828 (`image_sample_lz`, `image_sample_b`, `image_load` and `image_get_resinfo` return zero, no fault) with format 22 only; TYPE 1 is not measured on RDNA2, with other formats or with depth-compare reads (`image_sample_c*`). Neither type was measured on the console's gfx1013.
 - [Multisampled color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) lose their guest-read guards and cannot be reused after a successful allocation removal or unmap covers their full guarded range. The next target, sampled or storage lookup removes retired cache owners; recorded work and sampled views keep their images alive until their last reference is released. Partial unmaps keep the guard; partial allocation reuse and guest access to live multisampled data remain unsupported.
-- [Stencil reference export replay](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) on devices without `VK_EXT_shader_stencil_export` replays the low eight bits of the values proved from constant, select and phi exports, with an export proved on every kept path. An export the prover cannot bound replays all 256 eight-bit values, one pass per value per triangle (logged once per process). It records instances, then their triangles, then the reference classes of each triangle. One pipeline filters fragments at shader termination against a dynamic push value before late stencil and depth tests. The [Vulkan stencil-reference replacement rule](https://docs.vulkan.org/refpages/latest/refpages/source/FragStencilRefEXT.html) discards bits above the attachment's stencil width; supported stencil attachments have eight bits. Numeric subgroup observations throw except bounded own-lane mask plumbing and group control with kept-lane and derivative-helper coverage proved. WQM inputs must exclude helper contributions, since [non-quad subgroup operations may treat helpers as inactive](https://docs.vulkan.org/glslext/latest/glslext/khr/GL_KHR_shader_subgroup.html). Readonly guarded SRT reads may report internal host faults; these draws wait and check faults before publishing results, and loops throw. Indirect draws, restart, strips, fans, tessellation, mesh, multisampling, early tests, ordered pixel execution, guest shader memory writes, other fault-producing memory access, clocks, primitive ID inputs, attachment feedback and pipeline face/channel splits throw. An exhausted stage push range throws. Equivalence to console ordering has not been measured on console hardware.
+- [Stencil reference export replay](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) on devices without `VK_EXT_shader_stencil_export` replays the low eight bits of the values proved from constant, select and phi exports, with an export proved on every kept path. An export the prover cannot bound replays all 256 eight-bit values, one pass per value per triangle (logged once per process). It records instances, then their triangles, then the reference classes of each triangle. One pipeline filters fragments at shader termination against a dynamic push value before late stencil and depth tests. The [Vulkan stencil-reference replacement rule](https://docs.vulkan.org/refpages/latest/refpages/source/FragStencilRefEXT.html) discards bits above the attachment's stencil width; supported stencil attachments have eight bits. Numeric subgroup observations throw except bounded own-lane mask plumbing and group control with kept-lane and derivative-helper coverage proved. WQM inputs must exclude helper contributions (a ballot of the active lanes, as in an EXEC copy, covers whole quads and is accepted), since [non-quad subgroup operations may treat helpers as inactive](https://docs.vulkan.org/glslext/latest/glslext/khr/GL_KHR_shader_subgroup.html). Readonly guarded SRT reads may report internal host faults, and read-only BDA reads may report faults; these draws wait and check faults before publishing results, and loops throw. Indirect draws, restart, strips, fans, tessellation, mesh, multisampling, early tests, ordered pixel execution, guest shader memory writes, other fault-producing memory access, clocks, primitive ID inputs, attachment feedback and pipeline face/channel splits throw. An exhausted stage push range throws. Equivalence to console ordering has not been measured on console hardware.
 
 - [32-bit depth-bits reads of guest memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): a sampled 32_UINT or 32_SINT T# with a depth swizzle mode that no live depth surface matches reads the guest bytes through an R32_SFLOAT image, as the recompiler's depth-bits read expects, and the shader casts the fetched value back to the stored dword. On RX 6700 XT (gfx1031, AMD Windows driver 32.0.21045.5002) the read keeps float denormals, the sign bit alone and quiet and signaling NaN payloads bit for bit. A host that canonicalizes NaNs or flushes denormals on a 32-bit float fetch would change those dwords, and other drivers are not measured. A live depth surface whose extent or base level differs from the T# is not used; the read takes the guest bytes, as the 32-bit float and 16-bit views already do.
-- [Reused depth storage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp): a storage view with another extent or a format that cannot hold the cached depth plane uses guest memory. Depth rendering is not written back to those guest bytes; this admission rule does not prove allocation reuse or preserve a depth writer through an incompatible view. A 2D storage view, or a one-layer 2D array view of layer 0, of level 0 with the plane's extent and format (32-bit float or the 32-bit depth-bits layout for the depth plane, 16-bit unorm for D16, 8-bit uint for the stencil plane) is a storage image that is [filled](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) from the depth image before every use and, when the shader writes it, copied back after the work: a whole-plane copy through a staging buffer each way. A dispatch of the 15-word 8x8x1 image clear kernel ([`MatchStorageImageClear`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp): one colour read from the V# in `user[8..11]` stored to every texel of the T# in `user[0..7]`) that covers the whole plane and stores 0 or 1 through a 16-bit unorm view, 0 or 0xffff through a 16-bit uint view, or 0 or a normal float in (0, 1] through a 32-bit float or integer view leaves out the copy-in and replaces the copy-out by a clear of the depth image to that value; the dispatch still writes the storage image. The colour is read again when the copy-out is replaced, and a changed value keeps the copy-out. Indirect dispatches, partial last groups, dispatches that queue on the draw pipeline, other values and formats, a plane the kernel covers only partly and stencil planes keep both copies. A written view is also left pending like any other storage image, so the plane's content, drawn depth included, reaches guest memory on the next flush of that range. A 2D array view of more than one slice of the depth plane, or of a later slice, is a storage image over the slices from 0 to its last (`LayeredDepthStorage`); only the slices from its base slice to its last are copied: a slice that has a depth surface at the plane's address plus a whole depth slice per layer (`DepthSliceBytes`, as for the depth plane copies below) is copied from that surface before every use and back to it after the work, every bound slice each time, through a staging buffer; the other slices hold guest memory like any storage image. These images are kept per address, extent, slice count, base slice, format and tile mode until the device goes away, outside the storage cache's budget. Such a view needs a layer pitch equal to that slice size, and another view of the same memory (the 2D view of its first slice, a view from another base slice, or a sampled copy) is a separate image, copied in before and out after each use, so views that are written before a flush and share a slice do not merge: the later copy-out wins, so their results are not merged. A matching view still throws when it is a cube, a 2D array of more than one layer of the stencil plane or from a later slice, or another level, when the surface is multisampled, when it names the depth plane of a 16-bit depth with stencil surface the device stores in a wider format, and when it was written after another view of the same plane (another format, tile mode, address or dimension) replaced it, as two such views bound in one dispatch are. Stored depth values outside 0..1 are not clamped, and Vulkan leaves that copy undefined without `VK_EXT_depth_range_unrestricted`. `agc_driver_depth_storage_dispatch` pins these paths; none is measured on the console.
+- [Reused depth storage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp): a storage view with another extent or a format that cannot hold the cached depth plane uses guest memory. Depth rendering is not written back to those guest bytes; this admission rule does not prove allocation reuse or preserve a depth writer through an incompatible view. A 2D storage view, or a one-layer 2D array view of layer 0, of level 0 with the plane's extent and format (32-bit float or the 32-bit depth-bits layout for the depth plane, 16-bit unorm for D16, 8-bit uint for the stencil plane) is a storage image that is [filled](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) from the depth image before every use and, when the shader writes it, copied back after the work: a whole-plane copy through a staging buffer each way. A dispatch of the 15-word 8x8x1 image clear kernel ([`MatchStorageImageClear`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp): one colour read from the V# in `user[8..11]` stored to every texel of the T# in `user[0..7]`) that covers the whole plane and stores 0 or 1 through a 16-bit unorm view, 0 or 0xffff through a 16-bit uint view, or 0 or a normal float in (0, 1] through a 32-bit float or integer view leaves out the copy-in and replaces the copy-out by a clear of the depth image to that value; the dispatch still writes the storage image. The colour is read again when the copy-out is replaced, and a changed value keeps the copy-out. Indirect dispatches, partial last groups, dispatches that queue on the draw pipeline, other values and formats, a plane the kernel covers only partly and stencil planes keep both copies. A written view is also left pending like any other storage image, so the plane's content, drawn depth included, reaches guest memory on the next flush of that range. A 2D array view of more than one slice of the depth plane, or of a later slice, is a storage image over the slices from 0 to its last (`LayeredDepthStorage`); only the slices from its base slice to its last are copied: a slice that has a depth surface at the plane's address plus a whole depth slice per layer (`DepthSliceBytes`, as for the depth plane copies below) is copied from that surface before every use and back to it after the work, every bound slice each time, through a staging buffer; the other slices hold guest memory like any storage image. These images are kept per address, extent, slice count, base slice, format and tile mode until the device goes away, outside the storage cache's budget. Such a view needs a layer pitch equal to that slice size, and another view of the same memory (the 2D view of its first slice, a view from another base slice, or a sampled copy) is a separate image, copied in before and out after each use, so views that are written before a flush and share a slice do not merge: the later copy-out wins, so their results are not merged. A matching view still throws when it is a cube or a 2D array of more than one layer of the stencil plane or from a later slice, when the surface is multisampled, when it names the depth plane of a 16-bit depth with stencil surface the device stores in a wider format, and when it was written after another view of the same plane (another format, tile mode, address or dimension) replaced it, as two such views bound in one dispatch are. Stored depth values outside 0..1 are not clamped, and Vulkan leaves that copy undefined without `VK_EXT_depth_range_unrestricted`. `agc_driver_depth_storage_dispatch` pins these paths; none is measured on the console.
 - [Collapsed color array views](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) preserve the selected slice in the XOR address equation when the view is represented as a shifted 2D surface. Native Vulkan coverage checks R_X draws, array reads, publication and re-upload for slices 1-3; Lost Soul Aside PPSA26358 validates the RGBA16F cube mip chain on Windows/NVIDIA. Other devices and console comparisons remain unverified. Full-array views retain their layer addressing.
-- A [depth surface](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) is retired when a color target or a written storage image it does not serve overlaps it, or when it is sampled through a view it cannot serve and guest memory over it was written since it was last bound; lookups then skip it, so sampling reads the memory like any texture. Bound again, it keeps its own depth instead of the bytes written over it, except for the depth planes the next entry keeps in guest memory. Without write watching, a view it cannot serve still throws. A retired surface also gives up its depth and stencil planes, so another surface sharing them no longer copies from it.
+- A [depth surface](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) is retired when a color target overlaps it, an unserved storage view writes a whole plane, or it is sampled through a view it cannot serve and guest memory over it was written since it was last bound; lookups then skip it, so sampling reads the memory like any texture. Bound again, it keeps its own depth instead of the bytes written over it, except for the depth planes the next entry keeps in guest memory. Without write watching, a view it cannot serve still throws. A retired surface also gives up its depth and stencil planes, so another surface sharing them no longer copies from it.
 - [Depth planes in guest memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): only single-sample `D32_SFLOAT` and `D32_SFLOAT_S8_UINT` planes with the 64 KiB Z swizzle (`SW_MODE` 24) reach guest memory; D16, other swizzles, stencil and multisampled planes keep depth in the host image only. A plane drawn since its last store is stored, uncompressed, in 64 KiB units (128x128 tiles): a buffer upload, a `GuestBuffers` V#, an image lookup or a pending-store flush stores the units it overlaps, a color target or written storage image over the plane all of them. CPU reads and reads through address-based heaps are not caught. Guest writes are ordered when collected (bind, flush, collect epoch), not when made: a collected write reloads the units it touched unless an HTILE clear is pending. A store outside a recorder waits for the GPU. The console keeps HTILE-compressed tiles compressed in memory until a decompress (Mesa `ac_descriptors.h`).
+- [Depth surfaces over compared shared memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth surface over Windows direct memory that is compared once it is shared sees CPU writes made after the sharing no more than one over unwatched memory does. Its generations come from refused collects (0) or `TrackerGeneration()`, and nothing stamps compared memory after the one report at the sharing.
+- [Unmapped depth planes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a drawn depth plane whose guest memory the title unmapped before it was stored is not stored; its pending depth is dropped with a one-time warning. What the console does with such a store is not known. Readable planes without write permission retain the unsupported-store failure and their pending results.
 - [Depth plane copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth plane sampled as a 2D array or a cube, or a D16 plane read as `R16_UINT`, is copied into an image of its own (`DepthPlaneCopy`), kept per base address, extent, format and slice count; a slice comes from the live depth surface when one is bound at the slice's address and from guest memory (detiled) otherwise. A draw or dispatch that binds the plane copies again only the slices that changed and records nothing when none did: a surface slice when its image or write serial differs from the one copied (the serial is bumped when the surface is created, when a draw binds it as its depth target, when a pending fast clear is applied and when a written storage view of the plane is copied back), a guest-memory slice when its bytes were written since they were last read (`GuestMemory::UnchangedSince`), a snapshot write overlaps them, or its address, size or tile mode changed. The surface of the latest depth draw is copied at every use until another depth target is bound, since that draw may still be recorded after the copy. A slice's address is the base plus a whole 64 KiB-block depth slice per layer (`DepthSliceBytes`), and the cube face order is the array order; both are inferred from the titles' use, not measured on hardware. A 2D-array T# whose `BASE_ARRAY` is past slice 0 reads slices `BASE_ARRAY` to `LAST_ARRAY` of the copy, which holds slices 0 to `LAST_ARRAY`, and a 2D binding of it reads slice `BASE_ARRAY`; that follows the colour 2D-array semantics and the titles that hit it (PPSA01556, PPSA03912), and was not measured on hardware for depth surfaces. Planes with mips, a cube or a 2D T# with a base slice other than 0, a `BASE_ARRAY` past `LAST_ARRAY`, a cube with other than 1 or 6 slices, and other views of the planes still throw, and so do these copies of a 16-bit plane with stencil that the device stores as D24 or D32 (16-bit depth with stencil, below).
 - [Repacked format-43 copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver): a sampled texture of format 43 (10-bit R, 11-bit G and B unsigned floats from bit 0) is uploaded into a `B10G11R11_UFLOAT` image with its R and B fields swapped (`RepackTextureWord`) and viewed with R and B swapped back. A texture whose results a storage image still holds is copied from it again, whole, whenever the image changed (`RefreshDepthCopy`); a 3D one is flushed to guest memory and uploaded instead. Storage reads and writes of format 43 keep the packed `R32_UINT` path.
 - [SW_64KB_Z_X color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ColorTargetLayout.cpp) (libSceAgcDriver) use the texture equations and 64 KiB block geometry of `SW_64KB_Z_X`, whose addresses are checked against [AMD addrlib GFX10](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp) in the texture tiling tests. Any 256-byte pipe/bank XOR below the block size is accepted, as for `SW_64KB_R_X` targets and Z_X textures; which of those bits the console honours, and the render results, are not measured.
@@ -89,26 +104,29 @@
 - [8_8 UINT color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) decode as `R8G8_UINT` with the same component-swap mapping as 8_8 UNORM/SNORM (`0xe4` / `0xec`). Follows the existing 8 and 8_8_8_8 UINT paths; not measured on the console. RetroArch (PPSA99169) uses it during menu startup.
 - [Quad-list primitives](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver): primitive type 19 (DI_PT_QUADLIST, 0x13) translates to Vulkan triangle lists by generating 6 indices per 4-vertex quad in a synthetic 32-bit index buffer during draw input preparation (triangles (0, 1, 2) and (0, 2, 3) for first provoking vertex; (0, 1, 3) and (1, 2, 3) for last provoking vertex). Incomplete trailing vertices (< 4) are discarded. Indirect draws, primitive restart and draw recipes are unsupported for quad-list primitives. Console behavior for incomplete quads has not been measured on hardware.
 - [Separate alpha blend into 8_8 SWAP_ALT targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver): the second channel of a two-channel target with `COMP_SWAP` 1 holds the alpha export, but Vulkan blends it with the color equation of the R8G8 attachment, so a draw whose alpha equation differs from its color equation is recorded twice, the first channel with the color equation and the second with the alpha factors and operation moved into the color equation. The vertex stages run twice, so a vertex shader that writes memory writes twice, and occlusion counts include both passes. Draws that write depth or stencil, pixel shaders that write memory and factors of the destination alpha throw. That the hardware blends the second channel with the alpha equation is taken from Mesa's `si_translate_colorswap` and radeonsi's use of it for luminance-alpha formats, not measured on hardware.
+- [Color logic operations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): `CB_COLOR_CONTROL.ROP3` accepts the 28 codes of the source and destination form (`pqrspqrs`) or the brush and destination form (`pqpqrsrs`, the brush is the shader color), as the R6xx 3D register reference describes the field and Mesa's `gfx10.json` `ROP3` enum lists. A code that combines source and brush, which the console emulates in software, throws.
 - [Unexported pixel inputs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver): a pixel input whose `SPI_PS_INPUT_CNTL` parameter the previous stage does not export is programmed as a default-value input (`OFFSET` bit 5, `DEFAULT_VAL` 0, FP16 high half too) and reads (0, 0, 0, 0), as radeonsi's `SI_PS_INPUT_CNTL_UNUSED` does and as rect-list draws already do. The console's value for an unwritten parameter cache entry is not measured on hardware.
 - [Per-sample pixel shading](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): `PA_SC_MODE_CNTL_1.PS_ITER_SAMPLE` (bit 16, [PS5_Mesa GFX10.3 registers](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json)) on a multisampled draw enables Vulkan sample shading with a minimum rate of 1.0, so the pixel program runs once per sample. The draw throws when the device lacks `sampleRateShading`. On a single-sample draw the bit has no effect and is dropped. That the console runs the pixel program once per covered sample, and what it does with the other multisample registers in that mode, is taken from the register name and Vulkan's definition, not measured on hardware. Without the bit the pixel program runs once per pixel: the recompile request carries the mode (`iteratesSamples`), the ancillary's sample number reads 0 instead of `SampleId`, whose use would make Vulkan shade per sample, and the sample barycentrics and positions are evaluated at sample 0, whose locations the request carries (`sampleLocations`, every sample's in an iterated draw). `DB_EQAA.PS_ITER_SAMPLES`, the number of samples an iterated shader covers, is not read: an iterated draw runs once per sample.
 - [Unused pixel programs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): a bound pixel program is skipped when color masks have no intersection and DB export and execution enables are clear, regardless of retained SPI_SHADER_Z_FORMAT. This follows [AMD PAL DbShaderControl](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9AbiToPipelineRegisters.h) and its [GFX10 register definitions](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/chip/gfx9_plus_merged_registers.h), not a hardware measurement. Enabled DB_ALPHA_TO_MASK conservatively retains the program even with ALPHA_TO_MASK_DISABLE, because DecodeState currently enables Vulkan alpha-to-coverage without applying that override. Console behavior for these combinations has not been measured.
 - [Sample masks](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `PA_SC_AA_MASK_X0Y0_X1Y0` and `PA_SC_AA_MASK_X0Y1_X1Y1` hold one 16-bit sample mask for each pixel of the aligned 2x2 quad ([Mesa gfx10.json](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/registers/gfx10.json#L13512)); only the bits of the `MSAA_NUM_SAMPLES` rasterized samples count, and at one sample bit 0 of a pixel's field covers every sample of the target the draw is raised to. A mask equal for the four pixels is the Vulkan `pSampleMask`, the case [radv](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_cmd_buffer.c#L13633) and [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/gallium/drivers/radeonsi/si_state.c#L4218) program; with early fragment tests it needs `earlyFragmentSampleMaskTestBeforeSampleCounting` ([radv](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_physical_device.c#L2079) reports it). A mask that differs between the pixels is applied in the pixel shader without early fragment tests: a pixel whose mask covers all or none of its samples is demoted to a helper invocation by `gl_FragCoord` parity and killed when the program returns (the Radeon 860M's Windows driver 32.0.13058.8001 writes undefined colour for a demoted pixel whose export leaves its output unwritten), and otherwise the pixel's mask is ANDed into `gl_SampleMask` (with alpha-to-coverage and the mask export) after demoting invocations whose `SampleMask` input it leaves empty. A pixel program with early Z that writes memory under depth, stencil or depth-bounds tests is therefore refused. That XnYm is the pixel at (x mod 2, y mod 2) = (n, m) is read from the field names; that the mask removes samples before the depth and stencil tests and occlusion counting is inferred from radv implementing the Vulkan sample mask test with it; and that it takes no part in the centroid (`AA_MASK_CENTROID_DTMN` 0) is inferred from radv setting that bit only for conservative rasterization. None of it is measured on gfx1013. A mask equal for the four pixels that removes some but not all samples of a pixel is refused with active centroid inputs, since where Vulkan puts the centroid relative to `pSampleMask` is implementation-defined, and any partial mask is refused with conservative rasterization (radv sets `PREZ_AA_MASK_ENABLE` and `POSTZ_AA_MASK_ENABLE` [there](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_cmd_buffer.c#L13653), which 0x6001 leaves clear).
 - [Covered-centroid raster state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) accepts PA_SC_AA_CONFIG.COVERED_CENTROID_IS_CENTER only when the pixel program is skipped or SPI_PS_INPUT_ENA and SPI_PS_INPUT_ADDR have no active perspective or linear centroid input. Bit 29 follows [PS5_Mesa GFX10.3 registers](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json); [RADV](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/radv_cmd_buffer.c) sets it on GFX10.3 and later. Active centroid interpolation and unspecified input registers still throw. Console covered-pixel centroid results were not measured.
 - [Compute LDS beyond the device's shared-memory limit](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) lives in a coherent storage buffer with one slice of `LDS bytes / 4 + 1` dwords, rounded up to an even count so that 64-bit atomics stay 8-byte aligned, per workgroup (the dword after the LDS is the atomic lock on a device without `shaderBufferInt64Atomics`), shared by all such dispatches and grown in 1 MiB steps up to `maxStorageBufferRange`; a dispatch whose slices do not fit throws. It is slower than shared memory and its cost was not measured. An indirect dispatch of such a program always reads its group counts on the CPU. Its results are pinned against the in-limit semantics in `agc_driver_lds_beyond_device_limit`, not measured on hardware.
-- [AGC buffer allocations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) retry host/device out-of-memory once after reclaiming idle pool buffers and fully unused slab blocks. Live buffers and blocks with live slots are retained. Live images and other retained resources have no global memory bound; allocation failure still throws when reclaim cannot satisfy the request.
+- [AGC buffer allocations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) retry host/device out-of-memory once after reclaiming idle pool buffers and fully unused slab blocks. Live buffers and blocks with live slots are retained. Live images and other retained resources have no global memory bound; allocation failure still throws when reclaim cannot satisfy the request, except for the device buffers and images that the "Host placement after a device-memory refusal" entry places in host memory.
+- [Storage-cache pressure and idle device buffers](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp): the one-second idle observation interval is a retention choice, not a console rule; buffers reused less often can be recreated under pressure. Before a storage-cache eviction, independently allocated device-tier buffers unused throughout that interval can be released, oldest first, for the cache's shortfall below its existing ceiling. Live buffers, host tiers and slab allocations are not reclaimed this way. Reclamation requires exactly one device-local heap because retained buffers do not record their heap. The heap budget is read again after an actual release; a delayed driver report can still cause an eviction. This is not a shared budget for all retained GPU resources, and its effect on titles with intermittent large buffer use is unmeasured.
 - [Host placement after a device-memory refusal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) (libSceAgcDriver): when the driver refuses a device-local allocation with `VK_ERROR_OUT_OF_DEVICE_MEMORY` after the pool's trim and the texture-cache release, device buffers and images (textures, storage textures, block, repacked, depth, depth plane and stencil copies, render, depth and multisampled targets and attachment proxies) are allocated in a host memory type their requirements allow. A host-placed device buffer leaves the pool on release. A host-placed image keeps that placement until it is destroyed and is never moved back to device memory, so every access to it crosses PCIe for its lifetime. The placements are counted in a rate-limited `[bufferpool]` line with the cumulative MiB, not the resident bytes. The 1x1 denormal clear probe still allocates device memory directly and throws on a refusal.
-- [Pipeline journal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp) (libSceAgcDriver): the journal is append-only and never compacted, so a module a later run no longer builds pipelines from stays in the file until it is deleted, and the whole file is read into memory while the replay runs (its modules reference that buffer until the last replayed pipeline was built). Only the first `APS5_PIPELINE_JOURNAL_ENTRIES` pipelines recorded are replayed (a record is never rewritten, so a pipeline past the bound stays past it), and the pipeline store evicts the least recently used entry past `APS5_PIPELINE_STORE_ENTRIES` (1024 each): a title with more configurations rebuilds the rest at the draw as before. A compute pipeline is replayed over the set layout `DescribeSetLayouts` derives from the result's bindings, which a dispatch that finds it resident checks against its `ShaderResources` layout only under `APS5_VERIFY_SET_LAYOUTS=1`. Recording and replay are best effort: a record whose write fails is lost, an entry whose build fails is skipped, and both are counted in the `[pipeline-journal]` line rather than stopping the run. A replayed pipeline that the title never asks for again costs its build time and its driver memory (its optimized relink is deferred to its first draw, so a run whose first frames bind many replayed pipelines queues their relinks then); nothing ages recipes out of the file. Two runs sharing the file take turns under its lock file, but each only knows the modules it loaded or wrote itself, so a module the other run appended meanwhile may be appended again (the loader keeps the first copy). Records a run appends after another run's load are replayed by that run only after its next start. The file header's format number is the only guard against a change of the recipe codec, `CanonicalPipelineState` or the store key that keeps the structures' sizes (the recompiler's source version does not cover the driver's sources).
+- [Pipeline journal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp) (libSceAgcDriver): the journal is append-only until it reaches `APS5_PIPELINE_JOURNAL_MAX_MIB`, when it is rewritten to three quarters of the cap with the newest pipelines and their modules; the rewrite streams kept records; a replay thread reads an entry's modules when it builds that entry. Only the last `APS5_PIPELINE_JOURNAL_ENTRIES` pipelines are replayed, and the store evicts the least recently used entry past `APS5_PIPELINE_STORE_ENTRIES`: a title with more configurations rebuilds the rest at the draw. A compute pipeline is replayed over the set layout `DescribeSetLayouts` derives from the result's bindings, checked against its `ShaderResources` layout only under `APS5_VERIFY_SET_LAYOUTS=1`. Recording and replay are best effort: a record whose write fails is lost and an entry whose build fails is skipped, both counted in the `[pipeline-journal]` line. The file header's format number guards the recipe codec and the store key.
 - [Graphics pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp) (libSceAgcDriver): a pipeline is fast-linked at the draw and relinked with `VK_PIPELINE_CREATE_LINK_TIME_OPTIMIZATION_BIT_EXT` on a background thread, and binds the optimized one from the next draw on. Draws recorded before that use the fast link, whose vertex stage keeps the outputs the fragment stage does not read: on RADV (Radeon 660M, Mesa 26.2.4) 346 of 483 Astro's Playroom vertex shaders paired with a fragment stage that reads none of them used more VGPRs (median 8 more, up to 2.5 times), and on an RTX 4090 13 of 15 PPSA36082 vertex shaders up to 68 instead of 38 (#2242). The optimized link compiles to the same code as a whole pipeline
+- [Fragment shader interlock pipelines](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver): a pipeline whose fragment shader declares a fragment shader interlock capability is never built from graphics pipeline libraries, on every driver, so it is compiled whole at the draw with no fast link to bridge the compile. RADV's fast link ([mesa#16653](https://gitlab.freedesktop.org/mesa/mesa/-/work_items/16653), Mesa 26.2.5, RX 7900 GRE) jumps to the PS epilog without waiting for the shader's stores, and the epilog's `done` export ends the GFX11 primitive-ordered section, so the next overlapping wave reads the old value: `agc_driver_pixel_interlock` lost read-modify-writes in 108 of 120 loaded runs under `APS5_NO_PIPELINE_LTO=1`. On an RTX 4090 (NVIDIA 617.42, Windows) the fast link kept the ordering in 240 of 240 loaded runs; other drivers are not measured.
 - [Prebuilt pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver): each registered vertex or pixel shader in registration form gets its pre-rasterization or fragment-shader library built on one background thread, with a fixed state the draw may not use: triangle list, counter-clockwise front face, no depth clamp, depth bias or conservative rasterization, first provoking vertex, one sample. Libraries are kept until the device is torn down; on Astro's Playroom 1948 of them added 0.44 GB of peak memory on RADV.
 - [`APS5_THREAD_PRIORITY=rt`](../../../core/libs/prx/libSceAgcDriver/Execution/src/ThreadPriority.cpp) (libSceAgcDriver) lowers the process's hard `RLIMIT_RTTIME` when it is above `APS5_THREAD_RTTIME_US` or rtkit's `RTTimeUSecMax`, because [rtkit](https://github.com/heftig/rtkit/blob/c295fa849f52b487be6433e69e08b46251950399/rtkit-daemon.c#L592-L637) (`verify_process_rttime`) reads the hard limit from `/proc/<pid>/limits` and refuses real-time scheduling when it is higher. An unprivileged process cannot raise the hard limit again, so it stays lowered for the process and its threads even when rtkit then refuses the request (burst limit, user or start-time checks) and the thread throws. rtkit's `MaxRealtimePriority` and `RTTimeUSecMax` are read first, so an unreachable rtkit or a priority above its maximum leaves the limit untouched. The lowered limit only matters for threads that later run under a real-time policy
-- AMD image descriptors with `TYPE=0` are treated as null for read-only image slots even when the base and other words are nonzero: `image_load` on a gfx1035 with such a T# returns 0,0,0,0, and the same descriptors were seen in direct reads in PPSA01341 on an RTX 4070. Writable and atomic image slots and entries of an image table keep faulting because there is no hardware measurement for them, and the reserved types 2-7 also fault. `TYPE=1` is treated as null in the same read-only slots: gfx1035 reads it as zeros too, and gfx1010 returns zeros for `image_sample_lz`, `image_sample_b`, `image_load` and `image_get_resinfo` with format 22 (#5828); it is not measured on RDNA2, with other formats or with depth-compare reads (`image_sample_c*`). gfx1013 behavior is unverified
 - On a device without VK_EXT_robustness2's `nullDescriptor`, such as MoltenVK, a null image descriptor in a typed heap is a [placeholder image](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PlaceholderImages.cpp) of that heap's type, 1×1 and cleared to zero, which every null descriptor of the heap shares. Reads give zeros, as `nullDescriptor` allows, but stores and atomics to it are kept, so a later read of a null storage image can return them, and a depth comparison compares against depth 0. A heap whose placeholder the device cannot create, for example 1D or 3D depth, 64-bit atomics without 64-bit image atomics, or multisampled storage without `shaderStorageImageMultisample`, throws when a null descriptor reaches it.
 - [Draw input snapshots](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): `PrepareDrawBindings` caps read-only input buffer snapshots at 64 MiB (overridable via `APS5_DRAW_SNAPSHOT_MAX_MIB`). Larger inputs (streaming heaps, bindless pools) or draws exceeding the cumulative budget skip the per-draw snapshot and bind in place, avoiding multi-gigabyte CPU copy stalls (such as Ratchet & Clank: Rift Apart PPSA01474 stalling at frame ~380 copying 36 GB every 5 s). If the title rewrites those large ranges on the CPU before GPU completion, the in-place binding observes the modification, as verified by `drawSnapshotCapTests`.
 - [Pending storage-image results](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) are stored when something reads their memory, not when the GPU work that wrote them completes. A title that waits for that work, frees the image and reuses its memory can have the new data overwritten by the late store (#1970). A title's own CPU reads are not seen either, so a title that reads the results after waiting for a label reads stale memory. Explicit-size file writes (`write`, `pwrite`, `writev`, `pwritev`, AIO and `fwrite`) synchronize their source ranges through the [host-read hook](../../../core/libs/prx/libc/src/GuestArena.cpp); other host readers are not covered. `APS5_STORE_AT_FLIP=1` stores every pending result at each flip and `APS5_STORE_AT_LABEL=1` before each label the GPU writes; both store every pending image, not only the ones the waited-for work wrote, and neither is on by default.
 - [`APS5_SKIP_REFUSED_DRAWS`](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp) (libSceAgcDriver) drops a draw whose graphics stage the recompiler refuses instead of failing the queue, so the frame lacks that draw, and the stage is compiled and refused again at each such draw. Compute refusals still fail.
 - [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending saves its bytes through the unwatch hook, which also runs when a failed collect takes a range out of the watch. A range that leaves the watch without the hook running over it (an import fallback that unwatched without saving) leaves its pending results without saved bytes; storing such results throws. A unit whose results were stored while its blocks were watched keeps only a generation; when its blocks leave the watch while nothing is pending, the hook saves nothing, and results that land in it afterwards have neither saved bytes nor a watch, so storing them throws too.
 - Windows host-pointer imports of the guest mapping itself are compared instead of write-watched, except writable imports of private `MEM_WRITE_WATCH` memory when the import probe keeps the write watch and a settle queue exists: those of 1 MiB or more stay watched, and smaller ones return to the watch once their settle has completed, unless a storage image overlaps them (see Pages under an import window): a driver can mark imported pages dirty after the synchronous import window. Shared memory imported through a separate writable alias retains protection-based tracking on the guest views; driver access to the import alias does not disarm those views. [GuestMemory](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) excludes every overlapping 64 KiB tracker block while its backing is retained. A full block replaced by fresh private backing regains tracking and gets a new generation; protection changes, partial replacements and shared remappings do not restore it. Excluded blocks keep their write-watch marks as a hint only (`UntrackedHint`): a storage image or a sampled texture snapshot over them compares its bytes again after a mark in its range, a driver store, a mapping change or a recorded GPU write instead of at every collect epoch or lookup, and a mark the driver makes without a CPU store costs one comparison. This preserves CPU edits through byte comparisons but limits snapshot reuse on excluded blocks to draws of one collect epoch and disables unit shadows for them; restoring tracking on import retirement without replacing the backing remains unimplemented.
-- [Pages under an import window](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) (libSceAgcDriver) whose write protection was resolved while a host import that leaves its range watched was made are compared with the bytes they held before the import and count as stored over only when those differ. A CPU store of the bytes already there within the window cannot be told apart from an import that resolves the write protection without storing, as the NVIDIA driver (610.57.04) does for every imported page, so such a store does not win over pending results. Where host-pointer and dma-buf imports differ in whether they stay watched, a failed host-pointer import and the dma-buf import after it are two windows, and the pages the failed one resolved count as stored over. On Windows, the NVIDIA driver (617.42) marks every page of a host import of private `MEM_WRITE_WATCH` memory written, asynchronously, until a GPU use of the import completes; a 4-byte read of it on the settle queue ends that even while main-queue work that used the import first is still running, and an earlier import of the same pages whose first use runs after that read marks none of them (`agc_import_settle_first_use`, `agc_import_settle_earlier_import`). Such an import stays watched only after a 4-byte read of it on the settle queue has completed inside the window. Each one waits for that read, which keeps its window open for one round trip on the settle queue, so a same-value CPU store from another thread in that time counts as unchanged too. An import made where no settle queue exists is compared instead. An import of under 1 MiB is not settled inside its window, because the settle blocks the importing thread and a title that imports a 64 KiB buffer around every submission lost about 19 % of its frame rate to that wait (Dripl1x, #6060). It is compared until its read, submitted in a batch by a later import lookup under `GpuMutex` while the imports match the registry, has completed; a later lookup then returns its whole blocks to the write watch, each stamped as a CPU store, so whatever was derived from them while they were compared reads as changed once. Its blocks stay compared while storage results are pending over them, and those of an import retired before that stay compared.
+- [Pages under an import window](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) whose protection an import resolves count as stored only when their bytes change. A same-value CPU store during that window cannot be distinguished from driver activity and does not win over pending results. On Windows, NVIDIA 617.42 marks every private MEM_WRITE_WATCH page after import until a GPU use completes. The driver behavior was measured on this driver; other drivers are unverified. Imports of at least 1 MiB wait for a four-byte read on the separate settle queue inside the window. Smaller imports stay compared until a deferred read completes; a later lookup returns whole blocks to write watching with a new CPU-store stamp. Blocks overlapping a live storage image, blocks of an import retired before rewatching, and imports without a settle queue stay compared. Shared-memory imports retain their separate-alias tracking.
+- [Deferred host-import reads](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) use the main queue with barriers ordering earlier and later writes around the reads. Submission does not wait on the CPU. The latency cost of placing batches behind main-queue work is unmeasured. The first-use test now checks that earlier main-queue reads finish before the import returns to write watching; the original two-queue canary measured driver marking while those reads were still in flight. The earlier-import canary still checks later use of another import of the same pages.
 - [Settled dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a dma-buf import of 1 MiB or more is read by a 4-byte copy on the settle queue right after it is made (`settleImport`), so the kernel maps its pages for the GPU there and not in the first submission that uses it (about 2 s for a 3 GiB import on RADV). The import's buffer is shared with the settle queue's family. An import made at map time settles on the guest thread that maps the range, inside its map call, so that thread waits while the kernel maps the pages: 0.47 to 2.2 s for the 3 GiB range of Hades (PPSA03355) and 0.49 to 4.3 s for the 4.5 GiB range of ASTRO BOT (PPSA21567) on RADV. Both titles map these ranges at start-up; a title that maps large ranges during gameplay stalls its mapping thread for as long. An import made from a submission settles under the GPU mutex, so its frame still pays for it; a smaller import, and every import on a device with no settle queue (one without a copy-capable queue besides the main one), pays in its first submission. A range imported through a host pointer, as lavapipe imports shared memory, is not settled
 - [Sparse dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a shared-backed range larger than one 64 MiB udmabuf buffer is imported as one sparse buffer bound to the 64 MiB buffers, on a queue of its own when the device has a second family that binds sparse memory. The path is decided before anything is imported, and a failure after that throws. A range whose offset in the backing file is not a multiple of 64 KiB starts its sparse buffer at the 64 KiB block below it (`HostImport::lead`). A range takes the single udmabuf import instead, which udmabuf's `size_limit_mb` refuses above 64 MiB by default so the range is copied, when the buffer's sparse block size is larger than 64 KiB (it is 64 KiB on RADV), when the sparse buffer does not accept every memory type a chunk import can have, when the backing file ends inside its last chunk, or when it is imported at map time on a device with no second family (the bind then needs the GPU mutex); the NVIDIA proprietary driver imports no dma-buf memory
 - [Unnormalized S# coordinates](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) - `FORCE_UNNORMALIZED` uses a Vulkan `unnormalizedCoordinates` sampler, so the S# LOD range, LOD bias and mip filter are not applied, which is exact only on a one-level view.
@@ -125,17 +143,19 @@
 - A [COND_EXEC range](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) must hold whole packets and end inside its command buffer. A chained INDIRECT_BUFFER or a REWIND inside a range throws, as what the CP does with the skipped dwords then is unknown.
 - A [COND_INDIRECT_BUFFER](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) (`sceAgcCbBranch`) runs only with the always-pass compare function; a comparison or a predicated packet throws. Modes 1 and 2 run the first buffer, assumed to be the if-then and if-then-else modes of AMD's PM4 packet. [sceAgcCbBranch](../../../core/libs/prx/libSceAgc/Cb/src/Branch.cpp) does not check the compare address of an always-pass branch or the address of an empty buffer, as PPSA14632 passes an uninitialised compare address and a null else buffer of 0 dwords.
 - A [label or store](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (`RELEASE_MEM`, `WRITE_DATA`, `DMA_DATA`) into guest memory the device has no host import of waits for all recorded work and is then written by the CPU, so the queue worker stalls once per such label. The console's CP stores it in stream order without that stall.
+- A [label](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) of 8 bytes or less recorded while a copied writer is listed, or while an earlier completion store is pending, is stored by the CPU when its batch is reaped, after the write-backs, so it becomes visible up to one reap later than on the console, also after GPU writes recorded behind it. Larger stores (DUMP_CONST_RAM, COPY_DATA, DMA_DATA) and DMA_DATA copies the GPU makes stay on the GPU unless they cover a copied writer's range or a pending completion store, so they can be visible before an unrelated earlier write-back. The order also breaks when a write-back's guest store syncs a pending storage image from inside the completion: that nested sync finishes later batches, whose completion stores land first. `APS5_DRAIN_COMPLETION_LABELS=1` drains instead (reason 2).
 - [WRITE_DATA to thread-trace user-data registers](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver) updates the queue's UCONFIG values for register destinations `0xc340..0xc347`, including repeated writes to one address; these are not guest-memory labels. The range follows AMD's GFX10 `SQ_THREAD_TRACE_USERDATA_0..7` definitions in [the Linux register header](https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/amd/include/asic_reg/gc/gc_10_1_0_offset.h) and the packets emitted by PPSA21564's bundled AGC driver before its EOP flip. Other register destinations throw. GPU thread-trace capture and its user-data stream are not emitted; only the final register state is retained. Console trace behavior is unverified.
-- [WRITE_DATA with DST_SEL 3](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver) writes guest memory like DST_SEL 5. AMD's GFX10 header names 3 the GDS, but Killzone: Liberation (PPSA11142) writes its frame fence with `sceAgcDcbWriteData(dst 6, cache policy 3, write confirm)`, which the SPRX-confirmed encoding ([OpenAGC](https://github.com/OpenAGC/OpenAGC/blob/main/src/cb_builders.c)) turns into DST_SEL 3 with a 40-bit label address in the title's own memory that `RELEASE_MEM` and `WAIT_REG_MEM` then use; the console must write that label or the title would wait on it forever. Whether the console routes it through the GDS or a cache is unknown
+- [WRITE_DATA with DST_SEL 3](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver) writes guest memory like DST_SEL 5, which a PS5 does not: on firmware 13.40 (measured 2026-10-19 with buffers submitted through `sceAgcDriverSubmitDcb` inside a retail title) a DST_SEL 3 `WRITE_DATA` (control 0x00100300, or 0x06100300 with cache policy 3) left its label in direct memory unwritten, also after a `RELEASE_MEM` with GL2 write-back and invalidate (0x00300514), and a GDS `COPY_DATA` (SRC_SEL 3) at that address read 0. The console's own `sceAgcDcbWriteData(dst 6)` builds DST_SEL 3 (0x00110300) as here, and Killzone: Liberation (PPSA11142) fences its frame with it and waits on that label with `WAIT_REG_MEM`, so the write is kept until the path that lands the label is known. Closes when: that path is measured
 - [SET_*_REG_INDIRECT](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) (libSceAgcDriver) reads its register list when the command buffer is submitted, with the packets. The console's graphics PFP reads it when it reaches the packet, so a list written after the submission (by the CPU, or by GPU work ahead of the packet behind PFP_SYNC_ME) is read here before that write. When the list read at submission holds an offset dword that is not a register offset (bits 16-27 set, or the 0xffffffff sentinel), the worker reads the list again where the packet executes and writes that copy. PPSA23566 (UFC 6) intermittently submits a SET_CONTEXT_REG_INDIRECT whose first entry is 0x038f038f or 0x03900390 in both copies; what the PFP does with such an entry is unknown, so a copy that still holds one throws unless `APS5_SKIP_INVALID_INDIRECT_REGISTERS=1`, which skips its invalid entries and writes its valid ones.
-- The [shader float mode](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (`FLOAT_MODE`, `DX10_CLAMP`, `IEEE_MODE` and `FP16_OVFL` of `COMPUTE_PGM_RSRC1` and `SPI_SHADER_PGM_RSRC1_PS/GS/HS`, bit positions from Mesa's `gfx10.json` and `gfx103.json`) is decoded into `GuestContext::floatMode` and is part of the shader cache keys and the serialized request (#981). `IEEE_MODE` is read by `v_min_f32`, `v_max_f32`, `v_min3_f32`, `v_max3_f32` and `v_med3_f32`, their f16 forms, `v_min_f64` and `v_max_f64`, `IEEE_MODE` and the `FLOAT_MODE` output denormal bits by the output modifier, `DX10_CLAMP` by the clamp modifier, `FP16_OVFL` by every instruction with an f16 result (see its entry), and the whole mode by the 16-bit interpolation instructions (see their entries). With IEEE=1 a signaling NaN operand returns that NaN quieted (the first operand checked first, min3/max3 as two nested pairs, med3 as min3 when any operand is NaN), measured on RDNA2 (gfx1035) over every combination of ±0, ±1, ±inf, denormals, quiet and signaling NaNs with f32 denormals kept and flushed. IEEE=0 and unknown modes keep the previous f32 lowering, which matches IEEE=0. The f16 forms choose their NaN results on the bits: a NaN operand returns the other operand unchanged (src0 when both are NaN), and with IEEE=1 a signaling NaN operand returns that NaN quieted, in the same order as f32. `v_min_f64` and `v_max_f64` quiet a signaling NaN operand the same way with IEEE=1; with IEEE=0 they return src0 unchanged when src1 is NaN, otherwise src1 when src0 is NaN. Both were measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1 with f32 denormals kept and flushed and f16/f64 denormals kept; RDNA2 has no f64 min3, max3 or med3. Unknown modes follow IEEE=0. `v_min_f16` and `v_max_f16` flush each denormal input to its signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3 preserve inputs, even when output flushing is enabled. Measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1, including signed zeros, NaNs and neg/abs modifiers. Unknown modes keep f16 denormals. `v_min_f64` and `v_max_f64` flush subnormal inputs to signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3, and an unknown mode, preserve inputs. The fully flushed and preserved f64 behavior was [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/2036); split-mode selection follows [LLVM's denormal-mode enumeration](https://llvm.org/docs/AMDGPUUsage.html#floating-point-denorm-mode-enumeration-values). Other f64 arithmetic does not model these denormal controls. NaN quieting in f16 arithmetic (the unary instructions and the f32 arithmetic follow it, see below) and `FLOAT_MODE` (f32 denormals flushed before the min/max compare in Astro's Playroom's 0xc0) still follow a single mode, as the entries below record. The mode comes from the registered shader header's `sh_registers`, the same source at registration and at draw/dispatch so the prepared artifact keys match. A title that rewrites RSRC1 at run time, or a raw compute program with no header, compiles with that mode or none.
+- The [shader float mode](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (`FLOAT_MODE`, `DX10_CLAMP`, `IEEE_MODE` and `FP16_OVFL` of `COMPUTE_PGM_RSRC1` and `SPI_SHADER_PGM_RSRC1_PS/GS/HS`, bit positions from Mesa's `gfx10.json` and `gfx103.json`) is decoded into `GuestContext::floatMode` and is part of the shader cache keys and the serialized request (#981). `IEEE_MODE` is read by `v_min_f32`, `v_max_f32`, `v_min3_f32`, `v_max3_f32` and `v_med3_f32`, their f16 forms, `v_min_f64` and `v_max_f64`, `IEEE_MODE` and the `FLOAT_MODE` output denormal bits by the output modifier, `DX10_CLAMP` by the clamp modifier, `FP16_OVFL` by every instruction with an f16 result (see its entry), and the whole mode by the 16-bit interpolation instructions (see their entries). With IEEE=1 a signaling NaN operand returns that NaN quieted (the first operand checked first, min3/max3 as two nested pairs, med3 as min3 when any operand is NaN), measured on RDNA2 (gfx1035) over every combination of ±0, ±1, ±inf, denormals, quiet and signaling NaNs with f32 denormals kept and flushed. IEEE=0 and unknown modes keep the previous f32 lowering, which matches IEEE=0. The f16 forms choose their NaN results on the bits: a NaN operand returns the other operand unchanged (src0 when both are NaN), and with IEEE=1 a signaling NaN operand returns that NaN quieted, in the same order as f32. `v_min_f64` and `v_max_f64` quiet a signaling NaN operand the same way with IEEE=1; with IEEE=0 they return src0 unchanged when src1 is NaN, otherwise src1 when src0 is NaN. Both were measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1 with f32 denormals kept and flushed and f16/f64 denormals kept; RDNA2 has no f64 min3, max3 or med3. Unknown modes follow IEEE=0. `v_min_f16` and `v_max_f16` flush each denormal input to its signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3 preserve inputs, even when output flushing is enabled. Measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1, including signed zeros, NaNs and neg/abs modifiers. Unknown modes keep f16 denormals. `v_min_f64` and `v_max_f64` flush subnormal inputs to signed zero when bit 0 of the f16/f64 denormal field is clear (0 and 2); fields 1 and 3, and an unknown mode, preserve inputs. The fully flushed and preserved f64 behavior was [measured on gfx1036](https://github.com/boykopovar/AnyPS5/pull/2036); split-mode selection follows [LLVM's denormal-mode enumeration](https://llvm.org/docs/AMDGPUUsage.html#floating-point-denorm-mode-enumeration-values). `v_fma_f64`, `v_div_fmas_f64`, `v_div_scale_f64`, `v_ldexp_f64`, `v_rcp_f64`, `v_rsq_f64`, `v_sqrt_f64` and `v_trig_preop_f64` do not model these denormal controls. NaN quieting in f16 arithmetic (the unary instructions and the f32 arithmetic follow it, see below) and `FLOAT_MODE` (f32 denormals flushed before the min/max compare in Astro's Playroom's 0xc0) still follow a single mode, as the entries below record. The mode comes from the registered shader header's `sh_registers`, the same source at registration and at draw/dispatch so the prepared artifact keys match. A registered shader keeps that mode when a title rewrites RSRC1; a raw compute program takes the live RSRC1.
 - A [WAIT_REG_MEM](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Synchronization/WaitMemory.cpp) (libSceAgcDriver) that a compute queue passes on another queue's recorded label store, before the GPU has executed it, is landed before the queue's next dispatch, draw, COND_EXEC or predicated packet reads guest memory: the worker polls until memory satisfies the wait or no unfinished batch writes the label. The graphics queue (queue 0) is exempt, as landing its waits costs PPSA01341 about a quarter of its frame rate; a title that fills memory a graphics command buffer reads after it submits the buffer behind such a wait reads it early there. `APS5_LAND_WAITS_ALL_QUEUES=1` lands the graphics queue's waits too.
 - [CPU reads behind an address-based build](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp) (libSceAgcDriver) - an address-based store (FLAT/GLOBAL, or through a descriptor the recompiler cannot resolve to a static buffer) is not recorded as a pending write: its batch holds a lease on the registered allocations instead, and the flush hook does not wait for it. A DISPATCH_INDIRECT whose arguments are read on the CPU first finishes the batches recorded with a lease (`Graphics::FinishLeaseWork`). These reads do not, so they can see guest memory from before such a build ran: the indirect draw arguments and draw count of a draw resolved on the CPU (`Pm4::ReadDrawArguments`, `Pm4::ReadDrawCount`), the count record of the [copy kernel](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp) HLE (guarded only by its shape check), and the checks in [Submission.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) that decide whether a queue awaits a label only the title writes (`awaitsTitle`, `orderReleased`). No test covers them and no title has been seen to read such memory there.
 - The [dispatches that follow a compute queue's wait](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp) (libSceAgcDriver), up to the next wait that memory does not satisfy, a packet that writes guest memory other than a label, or a conditional packet, are resolved (memory captured, shader recompiled) when the wait passes, as the CP reads them right after it; the graphics queue is exempt (`APS5_GROUP_CAPTURE_ALL_QUEUES=1` includes it). The device still reads guest memory when the dispatch is issued; when that memory no longer matches the capture, the dispatch is resolved again from current memory.
 - [PA_CL_CLIP_CNTL](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `CLIP_DISABLE` (bit 16) and `DX_LINEAR_ATTR_CLIP_ENA` (bit 24) are accepted without changing pipeline state: Vulkan clips primitives against viewport guard bands and clips `NoPerspective` outputs linearly; what clearing bit 24 or setting bit 16 changes on the console beyond standard clipping is undocumented.
 - [10_11_11 unorm color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R32_UINT attachments: the pixel shader packs each export, rounded to nearest even like format-30 image stores, which is assumed to match the CB's conversion.
-- [11_11_10 float color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R32_UINT attachments: the pixel shader packs each export toward zero like format-43 image stores (overflow to the largest finite value, negatives to zero, NaN kept), which is assumed to match the CB's conversion; only the reversed component order (COMP_SWAP 2) is accepted.
-- [PA_SU_SC_MODE_CNTL.PROVOKING_VTX_LAST](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver) is not measured on the console: bit 19 follows opengnm's `flatshade_first` and Vulkan's vertex selection; rect lists take flat inputs from the third vertex (first mode: first); a geometry program gets odd strip triangle i as (i+1, i, i+2) in both modes (an RX 6700 XT, first mode: (i, i+2, i+1)); in last mode its primitives take flat inputs and layer from the last index, per-vertex ones in first-mode order; a flat input without pass-through read only through `v_interp_mov_f32` P10 gives the provoking vertex's value (ps5-opengl, #1413; first mode throws). Barycentric tessellation stages give each corner the last vertex's flat values. Else last mode throws without `VK_EXT_provoking_vertex`, for tessellation, geometry-program fans, explicit per-vertex flat inputs, and strips whose pixel shader reads a vertex slot (`v_interp_mov_f32`; 16-bit interpolation unchecked).
+- [11_11_10 float color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R32_UINT attachments: the pixel shader packs each export toward zero like format-43 image stores (overflow to the largest finite value, negatives to zero, NaN kept), which is assumed to match the CB's conversion; only the standard (COMP_SWAP 0) and reversed (COMP_SWAP 2) component orders are accepted, putting red and blue in the 10-bit low field. That follows from the format's layout and from the standard swap Mesa pairs with COLOR_10_11_11 for R11G11B10_FLOAT (ac_formats.c); it was not measured on the console.
+- [PA_SU_SC_MODE_CNTL.PROVOKING_VTX_LAST](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Pipeline.cpp) (libSceAgcDriver) is not measured on the console: bit 19 follows opengnm's `flatshade_first` and Vulkan's vertex selection; rect lists take flat inputs from the third vertex (first mode: first); a geometry program gets odd strip triangle i as (i+1, i, i+2) in both modes (an RX 6700 XT, first mode: (i, i+2, i+1)); in last mode its primitives take flat inputs and layer from the last index, per-vertex ones in first-mode order; a flat input without pass-through read only via `v_interp_mov_f32` P10 (P20) is the provoking vertex's (ps5-opengl, #1413; first (last) mode throws). Barycentric tessellation stages give each corner the last vertex's flat values. Without `VK_EXT_provoking_vertex`, last mode throws only when a pixel shader input could show which vertex provokes (a flat input, a P10 flat read, a per-vertex or custom per-vertex input, or a `Flat` or `PerVertexKHR` decoration in its SPIR-V, ignoring built-ins the pixel stage generates) or another stage's SPIR-V decorates a `Layer` or `ViewportIndex` built-in that is not `PerPrimitiveEXT`; otherwise the draw uses first mode, since the provoking vertex then selects nothing it reads or writes. With the extension, last mode throws for tessellation, geometry-program fans, explicit per-vertex flat inputs, and strips whose pixel shader reads a vertex slot (`v_interp_mov_f32`; 16-bit interpolation unchecked).
+- [Triangle strips through the barycentric tessellation stages](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - without `geometryShader`, a triangle strip without primitive restart is expanded on the CPU into one three-point patch per triangle in Vulkan's strip order: (i, i+1, i+2), and for odd triangles (i, i+2, i+1), or (i+1, i, i+2) with `PROVOKING_VTX_LAST`. That is the order the geometry stage receives, so both routes give the same weights and per-vertex values; which order the console uses for odd triangles is not measured. Indirect strips throw.
 - [Dual-source blending](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) takes the MRT1 export as the second source of the MRT0 blend, as RADV and radeonsi program it; what the CB does with other export or target layouts is unknown, so they throw.
 - [Blending into reversed-order color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 8_8_8_8 and 16_16_16_16 targets with `COMP_SWAP` 2 or 3 keep the exported alpha in their first channel and red or blue in their fourth, which Vulkan would blend with the color and the alpha equation respectively. The color block is taken to blend in shader export order and apply `COMP_SWAP` afterwards: the alpha equation and every source-alpha factor use the exported alpha, and the destination alpha is the first channel. This follows the `CB_TARGET_MASK` text of the AMD [SI](https://xorg.freedesktop.org/docs/AMD/old/SI_3D_registers.pdf) (p. 229) and [CIK](https://xorg.freedesktop.org/docs/AMD/old/CIK_3D_registers_v2.pdf) (p. 238) register references ("the order of components after blending and before COMP_SWAP is applied"). RADV builds `CB_BLENDn_CONTROL` without regard to the swap ([radv_pipeline_graphics.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/vulkan/radv_pipeline_graphics.c#L650-L709)) and renders R4G4B4A4, B4G4R4A4, R5G5B5A1 and B5G5R5A1 with `SWAP_STD_REV` and `SWAP_ALT_REV` ([vk_format.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/vulkan/util/vk_format.c#L43-L48), [ac_formats.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/common/ac_formats.c#L609-L624)). Mesa CI's Navi10 (gfx1010) CTS run ([job 112381553](https://gitlab.freedesktop.org/mesa/mesa/-/jobs/112381553), [112381554](https://gitlab.freedesktop.org/mesa/mesa/-/jobs/112381554)) passes all 400 `blend.format.<format>.states` cases of each of those formats, including separate alpha and destination-alpha factors. It is not measured on gfx1013 or on 8_8_8_8 and 16_16_16_16 targets. Factor pairs Vulkan applies per channel are used directly. Otherwise the pixel shader only copies values: it writes the exported alpha, each channel's own export or the constants 0 and 1 into a second color at location 0 index 1 (and 1 into a channel of the first color whose source factor is ONE, moving its export into the factor), and the blend forms every factor, `1 -` and product from those copies through `SRC1_COLOR`/`SRC1_ALPHA` factors. The blend unit therefore rounds them as it rounds a plain Vulkan blend of the same export; Vulkan does not require a second-source color to be converted like the first, but on an RTX 5080 and lavapipe every reversed-order case of the execution test is bit-identical to the same draw into a `SWAP_STD` target, which the test checks. Factor combinations that copies cannot express (for example `ONE_MINUS_SRC_ALPHA` in the alpha equation with `SRC_COLOR` in the color equation), sRGB, SNORM and integer targets, constant and second-source factors, destination-alpha and `SRC_ALPHA_SATURATE` factors in the color equation, different color and alpha operations, MIN or MAX with factors other than ONE, other color exports when the blend needs the second color, and devices without `dualSrcBlend` throw. Gran Turismo 7 (PPSA01317) blends `CB_BLEND0_CONTROL` 0x65010504 into such a target (#4782).
 - [DB_SHADER_CONTROL.CONSERVATIVE_Z_EXPORT](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver) becomes `DepthLess`/`DepthGreater`. For a pixel shader that breaks the promise, the host driver decides whether its interpolated Z is depth-tested before shading; what the console does then was not measured.
@@ -145,23 +165,26 @@
 - [PA_SC_CONSERVATIVE_RASTERIZATION_CNTL](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 0x6001 uses Vulkan overestimation on devices that add at most 1/256 pixel and keep degenerate triangles; the console's uncertainty region and degenerate handling are unmeasured. A value with `OVER_RAST_ENABLE` and `UNDER_RAST_ENABLE` clear is decoded as disabled even when `UNCERTAINTY_REGION_MODE` or the `OUTER_`/`INNER_UNCERTAINTY_EDGERULE_OVERRIDE` bits (19:16) are set, as PPSA01474 writes 0xe6000; that these fields have no effect without over- or underestimation is assumed from their names, not measured. With `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` = 0 the `PERSP_CENTROID` and `LINEAR_CENTROID` inputs get the pixel-centre barycentrics, as without conservative rasterization ([shader debt](shader.md)): the one rasterized sample sits at the pixel centre, so every centroid the rasterizer could pick for an overestimated pixel is that point; that it does not move the centroid towards the primitive when the sample is uncovered is inferred, not measured. With more rasterized samples, and when a single-sample draw is raised to a multisampled color target, centroid inputs throw.
 - [Descriptor pool chain](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - each pool holds two storage buffer descriptors more than a set can take, as a workaround: RADV (Mesa 26.0 and later) lets a `FREE_DESCRIPTOR_SET` pool place a set up to 32 bytes past the pool's buffer ([`util_vma_heap_init`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/vulkan/radv_descriptor_pool.c) is given `bo_size + RADV_POOL_HEAP_OFFSET` as a size), and with a page-multiple pool size those bytes are an unmapped page
 - [CMASK fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - each fast-cleared CMASK tile (code 0) is stored as `CB_COLOR_CLEAR_WORD` into its 8x8 texels at the first draw into the target or at its fast-clear eliminate or DCC decompress pass, not as the color block writes the tile, and the CMASK is then stored as expanded (0xF): a texture or copy read of the target after that draw and before the title's eliminate sees the clear value in tiles no draw wrote, where the console keeps their previous bytes. Tile addresses follow the pipe-aligned SW_64KB_Z_X CMASK equation for 16 pipes; other CMASK swizzle modes, a cleared tile of a DCC target and a fast clear of a 3D or array color target throw; base mip 0 of a 2D mipmapped color target is supported (offset follows AMD Addrlib `Gfx10Lib::HwlComputeCmaskInfo` reverse mip-chain ordering preceding base mip 0, unverified on PS5 hardware; mipmapped targets with 8 or 16 bpp throw until `dsMipmapHtileFix` mip-tail shrinkage is modelled). A tile with a code other than 0 and 0xF keeps its texels like an expanded tile: PPSA18391 (engine: Clickteam Fusion) fast clears a target whose CMASK it never initialized, so some of its nibbles hold leftover values such as 1 and 10; what the console does with such codes on a single-sample target is unverified on hardware. Single-sample views with `viewMip > 0` skip CMASK fast-clear decoding since CMASK metadata only covers base mip 0 on AMD hardware (Mesa `si_state.c` similarly clears `FAST_CLEAR` for level > 0).
-- [CMASK clear pass on AMD without pipeline libraries](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureDetiler.cpp) (libSceAgcDriver) - the compute pass that stores a fast-cleared CMASK into a resident render target (`DispatchCmaskClear`) is unverified on AMD's Windows driver with `APS5_NO_GPL=1`: on a Radeon 860M (driver 32.0.13058.8001, Windows 11) `agc_driver_cmask_fast_clear` keeps the stale 0x5A5A5A5A in its `SW_64KB_R_X` pass instead of the clear value, while it passes with pipeline libraries on and on an NVIDIA RTX 4080 SUPER in both modes. An RX 6400 (driver 32.0.21033.3005) lost the device (read invalid at 0xbeefdeadc000) in an earlier build tree, but clean rebuilds of four main commits of 19 October pass there (three of three runs each), so that failure is not reproduced. The cause is not found (#5150). Closes when: the cause is found, or `ctest -R '^agc_driver_cmask_fast_clear$' --repeat until-fail:5` passes with `ANYPS5_GPU=Radeon` and `APS5_NO_GPL=1` on AMD.
-- [HTILE depth fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - HTILE is not modeled. Only RADV's `clear_htile_mask` compute kernel (17 GFX10 words, 64x1x1 groups) is recognized, and only when it leaves ZMASK at 0 (`user[4]` and `user[5]` low nibbles both 0); the dispatch still runs, and the host depth image is cleared to `DB_DEPTH_CLEAR` the next time the surface with that `DB_HTILE_DATA_BASE` address is bound. The address match is exact, so a clear of a different HTILE range does not hit. HTILE initialization, the stencil-only update, and fast clears made by the SDK's own paths, CP DMA fills or other kernels are not covered and leave the depth image as it was. The kernel words are the ones the PR author saw RADV submit; they are not compared with Mesa's source. A second kernel, the 9-word dword fill PPSA01802 (Kena: Bridge of Spirits) clears its depth HTILE with (64x1x1 groups, one `buffer_store_format_x` per thread through the stride-4 V# in `user[0..3]`, the value read by `s_buffer_load_dword` through the V# in `user[4..7]`), is taken as a fill of that range when the store format is 32_UINT, 32_SINT or 32_FLOAT and the value V# covers the dword (NUM_RECORDS times its stride, or NUM_RECORDS bytes when the stride is 0) ([`MatchMemoryValueFill`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp), then the whole-HTILE and ZMask rules of `NoteDepthMetadataFill`). The value is read from guest memory when the dispatch is decoded, so a value that earlier GPU work in the same submission has not written back yet is not seen. When the [fill HLE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) takes the dispatch instead (an output descriptor of one 32-bit value per element, a value descriptor that covers the loaded dword, a 16-byte aligned range), the value is read again when the fill is recorded, after the labels queued before it, and the HTILE fill is noted with that value.
+- [HTILE depth fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - HTILE is not modeled. Only RADV's `clear_htile_mask` compute kernel (17 GFX10 words, 64x1x1 groups) is recognized, and only when it leaves ZMASK at 0 (`user[4]` and `user[5]` low nibbles both 0); the dispatch still runs, and the host depth image is cleared to `DB_DEPTH_CLEAR` the next time the surface with that `DB_HTILE_DATA_BASE` address is bound. A clear hits a surface only when its range covers that surface's whole HTILE, which need not start where the clear does. Fast clears that other writers leave in HTILE are taken at bind as the next entry describes. The kernel words are the ones the PR author saw RADV submit; they are not compared with Mesa's source. A second kernel, the 9-word dword fill PPSA01802 (Kena: Bridge of Spirits) clears its depth HTILE with (64x1x1 groups, one `buffer_store_format_x` per thread through the stride-4 V# in `user[0..3]`, the value read by `s_buffer_load_dword` through the V# in `user[4..7]`), is taken as a fill of that range when the store format is 32_UINT, 32_SINT or 32_FLOAT and the value V# covers the dword (NUM_RECORDS times its stride, or NUM_RECORDS bytes when the stride is 0) ([`MatchMemoryValueFill`](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp), then the whole-HTILE and ZMask rules of `NoteDepthMetadataFill`). The value is read from guest memory when the dispatch is decoded, so a value that earlier GPU work in the same submission has not written back yet is not seen. When the [fill HLE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) takes the dispatch instead (an output descriptor of one 32-bit value per element, a value descriptor that covers the loaded dword, a 16-byte aligned range), the value is read again when the fill is recorded, after the labels queued before it, and the HTILE fill is noted with that value.
 - [HTILE written by other kernels](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - when a depth target is bound and its HTILE was written since it was last read, the words over its whole pipe-aligned metadata (`HtileMetadataBytes`, the extent `HtileFillCovers` takes) are read, outside the surfaces mutex since the read waits for recorded work: when every one marks the depth (ZMask 0) or the stencil (SMem 0) cleared, the surface takes that fast clear and the words are stored back as expanded (depth only: ZMask 15 over the full Z range; with stencil: ZMask 15, Z range and SMem, SR1 and SR0 3), so only the title's next clear clears it again. PPSA29141 clears its depth every frame with a compute kernel the fill hooks do not recognize (`InvokeHTileClearComputeShader` in its `ClearMRT` pass); without this its depth kept every earlier frame and moving objects left black trails. PPSA25344 (Unreal Engine 5) reads its HTILE after the depth prepass in its Nanite depth export, which takes a tile with ZMask 0 as holding the clear value; without the expanded words the export put Nanite depth over the prepass and the Nanite material pass painted over the meshes in front. The word layouts are Mesa radv's for GFX10. Metadata with some tiles cleared is not modelled, and the compression state draws leave in HTILE is not tracked, so a title reading its HTILE after a draw sees the stored expanded words. A recognized HTILE fill or clear makes the next bind read the words again. A slice other than 0 of a depth array is read at its own HTILE (`DB_HTILE_DATA_BASE` plus the slice times `HtileMetadataBytes`) but the HTILE word layout of slices 1 and up is not modelled (PPSA05684's tile masks need X8 and Y8 to take Z0 and Z1 as well, slices 4 and up unmeasured), which neither the check that every word is cleared nor the store-back of each word in place needs, so such a slice takes the clear like slice 0. A depth-only HTILE whose tiles all have ZMask 0 but different Min/Max Z (per-tile clear values, PPSA05684's cascades) is taken as a whole-surface clear to `DB_DEPTH_CLEAR`, the value the DB's depth test reads for a cleared tile (`HTILE_Z_CLEAR_REG` in Mesa's `src/amd/common/ac_descriptors.h`: the clear word "only clears HiZ", "the DB register contain[s] the full clear values"); the HiZ test before it, which rejects against each tile's own Min/Max Z range (the HTILE definitions in the same file), is not modelled, so a draw that HiZ would reject over a tile cleared with Min/Max Z 0 is tested against `DB_DEPTH_CLEAR` instead. A multisampled depth target, and any target whose HTILE overlaps a resident native depth guard, skips this read and store-back and goes to the native multisample depth owner, which keeps its own refusal for a fast-clear transition.
 - [RADV fill-memory kernel](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) (libSceAgcDriver) - the [fill HLE](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferFill.cpp) takes RADV's 16-byte `fill_memory` compute kernel (`MatchClampedGlobalFill`: 11 GFX10.3 words, 64x1x1 groups, six user SGPRs with the address in `user[2..3]`, the largest store offset in `user[4]` and the value in `user[5]`; each thread stores 16 bytes at `min(thread * 16, user[4])`) as a fill of `min(threads * 16, user[4] + 16)` bytes. RADV initializes and fast-clears DCC keys and other metadata with it, so the key and metadata tracking sees such a fill where it is in the command stream; run as a dispatch, its global stores name no range, and a key fill was only seen once it had landed, after later writes to the surface. Only a 16-byte aligned address and largest offset are taken. RADV's 4-byte variant (fills below 16 bytes), other Mesa versions' encodings and other compilers still run as dispatches. The kernel words are the ones vkQuake's PS5 RADV build (Mesa 25.2) submitted; they are not compared with the NIR builder's output for other targets.
-- [Host imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) on Linux skip ranges that are not mapped read-write, which are copied instead. The NVIDIA driver (595.91.07) refuses `VK_EXT_external_memory_host` imports of read-only or executable mappings (and shared mappings of regular files) with `VK_ERROR_OUT_OF_DEVICE_MEMORY`, after which every `vkAllocateMemory` on the device fails the same way. Read-only ranges are never imported, even on drivers that accept them. Shared mappings of regular files are not checked for. On Windows, an alias of adjacent registered ranges is refused if any page is not a shared view; a range made entirely of shared views is aliased run by run, including across sections or nonconsecutive section offsets. Adjacent registered ranges are joined into one import: the largest aligned power-of-two block, from twice the import alignment up to the 8 MiB window, that holds the requested address and that they fill exactly, so a block only grows by doubling as its window fills. A block that would exceed the budget, would replace an import a build holds, or fails (a refused Windows alias, `vkAllocateMemory`) steps down to the next smaller block; a failed block is not tried again until one of its ranges changes. Ranges larger than the window are imported one at a time. A buffer bound across adjacent ranges that are each larger than the window, or bound exactly over adjacent ranges of any size (from the first one's start to the last one's end), joins them into one import when it is bound, and their own imports are retired; a buffer that crosses any other two imports is copied. A heap grown in pieces re-imports its joined run only when a buffer is bound exactly over all of its pieces, or when a sparse descriptor heap over it is bound: a heap a shader binds whole while only the pieces from its base are mapped is bound in place from the import of that run, its views ending at the import's end as the copy's do, once the previous bind of that address saw the same last mapped byte (a heap that grows between every two of its binds stays copied; one bound more often than it grows is joined again after each growth) and at most 64 times per joined run base; past that, with a message, it is not joined again: it is bound in place while an existing import covers its run and copied otherwise, until no registered range starts at that base or the device changes. Ranges larger than the window are taken to be registered whole and never grown in pieces: a title that grows a heap in pieces larger than 8 MiB re-imports the joined run each time a bound buffer crosses into a new piece. The 8 MiB window is a choice: unbounded runs were re-imported whole on every growth of a heap mapped in small pieces, and the NVIDIA driver (610.57.04, 615.78.08) then refused imports or lost the device. Not measured on RADV.
+- [Host imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) on Linux skip ranges that are not mapped read-write, which are copied instead. The NVIDIA driver (595.91.07) refuses `VK_EXT_external_memory_host` imports of read-only or executable mappings (and shared mappings of regular files) with `VK_ERROR_OUT_OF_DEVICE_MEMORY`, after which every `vkAllocateMemory` on the device fails the same way. Read-only ranges are never imported, even on drivers that accept them. Shared mappings of regular files are not checked for. On Windows, an alias of adjacent registered ranges is refused if any page is not a shared view; a range made entirely of shared views is aliased run by run, including across sections or nonconsecutive section offsets. Adjacent registered ranges are joined into one import: the largest aligned power-of-two block, from twice the import alignment up to the 8 MiB window, that holds the requested address and that they fill exactly, so a block only grows by doubling as its window fills. A block that would exceed the budget, would replace an import a build holds, or fails (a refused Windows alias, `vkAllocateMemory`) steps down to the next smaller block; a failed block is not tried again until one of its ranges changes. Ranges larger than the window are imported one at a time. A buffer bound across adjacent ranges that are each larger than the window, or bound over adjacent ranges of any size from the first one's start (ending anywhere in the last range it crosses), joins the ranges it crosses into one import when it is bound, and their own imports are retired; a buffer that crosses any other two imports is copied. A heap grown in pieces re-imports its joined run only when a buffer bound from its first piece's start crosses into a piece the joined import does not cover, or when a sparse descriptor heap over it is bound: a heap a shader binds whole while only the pieces from its base are mapped is bound in place from the import of that run, its views ending at the import's end as the copy's do, once the previous bind of that address saw the same last mapped byte (a heap that grows between every two of its binds stays copied; one bound more often than it grows is joined again after each growth) and at most 64 times per joined run base; past that, with a message, it is not joined again: it is bound in place while an existing import covers its run and copied otherwise, until no registered range starts at that base or the device changes. Ranges larger than the window are taken to be registered whole and never grown in pieces: a title that grows a heap in pieces larger than 8 MiB re-imports the joined run each time a bound buffer crosses into a new piece. The 8 MiB window is a choice: unbounded runs were re-imported whole on every growth of a heap mapped in small pieces, and the NVIDIA driver (610.57.04, 615.78.08) then refused imports or lost the device. Not measured on RADV.
 - [Cube texture descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) with equal `BASE_ARRAY` and `DEPTH` expose six faces starting at `BASE_ARRAY`. Measured with `image_load`, `image_sample` and `image_get_resinfo` on RX 6600 (gfx1032), using 64x64 R32_UINT faces and base slices 0, 5 and 6. Other ranges containing fewer than six faces still throw: hardware load bounds and filtered-sample addressing differ. A range of six faces or more that does not end on a whole cube keeps every slice up to `DEPTH`, the bound loads use on hardware; sampling the cube it cuts short is out-of-range cube-array sampling. Out-of-range cube-array sampling remains unimplemented. Samplers with `DISABLE_CUBE_WRAP` are created with `VK_SAMPLER_CREATE_NON_SEAMLESS_CUBE_MAP_BIT_EXT`, the flag RADV maps to that bit (Mesa `src/amd/vulkan/radv_sampler.c`, `src/amd/common/ac_descriptors.c`); without `VK_EXT_non_seamless_cube_map` a cube texture sampled through such a sampler throws. PS5 equivalence has not been measured on console hardware.
 - [Array layer views](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestTextureResource.cpp) (libSceAgcDriver) - `ArrayLayersServeView` lets a 2D texture at a 2D array image's base address, or a 2D array texture over its first layers, view that image (`Texture::CanCopyFrom`). Mesa-built homebrew (ps5-opengl) writes the view's last slice plus one to `CB_COLOR_ATTRIB3.MIP0_DEPTH`, so a slice-0 render target is a two-layer array image, and the title samples it as a plain 2D texture (SuperTuxKart PPSA69421 drew a black 3D scene and minimap without this). The per-layer layout of a mipmapped array is assumed equal to a standalone surface's; it is not measured on the console. A 2D texture at a later slice's address still gets an image of its own.
 - [Multisampled CMASK](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a multisampled color target's CMASK is decoded under CB_COLOR_INFO FAST_CLEAR (bit 13, as for a single-sample target) or COMPRESSION (bit 14). Which bit a multisampled target sets is inferred: its fast clears were seen on GTA V's multisampled targets through their CMASK fills, not in a register dump. A COMPRESSION-only target's zero CMASK is not read as cleared (inferred: zero means cleared only under FAST_CLEAR), so only a fill after its first use clears it. A slice of a multisampled array is its own image at its own address with its own CB_COLOR0_CMASK (inferred from the register layout). Its CMASK is main's whole-metablock size.
-- [Multisampled CMASK state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - a multisampled target has no guest texels, so its CMASK state comes from fills rather than from a read at each draw as a single-sample target's does. A fill of the whole CMASK with 0 clears the host image at the target's next use, one with 0xffffffff marks it expanded, and any other pattern, or a fill that covers only part of the CMASK, throws at the next use (inferred: main's rule that a mixed CMASK is unmodeled, applied to the one host image). A FAST_CLEAR target starts from its CMASK keys at its first use, and a COMPRESSION-only target starts expanded. Copies by DMA into the CMASK are not seen, and a later use with another CMASK address throws. The clear does not rewrite the CMASK bytes as expanded, so a new target over the same CMASK (a different extent, so a different image) seeds from them again and clears once more.
+- [Compressed FMASK reads](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) without an exact resident native owner throw. Native reads require eight fragments, one slice and mip, pipe-aligned DCC/CMASK, Z_64KB_X FMASK and unchanged, disjoint watched planes. The host stores independent samples and exposes their expanded indices (`0x76543210`, AMD PAL `c5e80007`, `Gfx9Fmask::GetPackedExpandedValue`); console equivalence is unmeasured. Other layouts, standalone compressed decoding, guest publication and recipe reuse remain unsupported. Metadata writes invalidate the native view, including same-value stores.
+- [Multisampled CMASK state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - a multisampled target has no guest texels, so its CMASK state comes from fills rather than from a read at each draw as a single-sample target's does. A fill of the whole CMASK with 0 clears the host image at the target's next use, one with 0xcccccccc, 0xdddddddd, 0xeeeeeeee or 0xffffffff marks it expanded, and any other pattern, or a fill that covers only part of the CMASK, throws at the next use (inferred: main's rule that a mixed CMASK is unmodeled, applied to the one host image). A FAST_CLEAR target starts from its CMASK keys at its first use, and a COMPRESSION-only target starts expanded. Copies by DMA into the CMASK are not seen, and a later use with another CMASK address throws. The clear does not rewrite the CMASK bytes as expanded, so a new target over the same CMASK (a different extent, so a different image) seeds from them again and clears once more.
+- [Multisampled DCC CMASK without fast clears](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - the initial CMASK of a multisampled DCC target is not checked when CB_COLOR_INFO enables COMPRESSION but not FAST_CLEAR: it then holds only FMASK compression, and a uniform DCC clear sets every fragment, so the target imports as that clear. What the console reads where such an FMASK names no fragment, as an uninitialized CMASK can, is unverified.
 - [Multisampled color fills](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - a multisampled target's samples are on the host, so a fill of its color memory is applied at its next use: a uniform fill over the whole of it clears the host image to that value, and a pending CMASK fast clear takes precedence over the fill and over a fill that would throw. Its color memory is a single mip and slice of addrlib's block dimensions for its sample count (ComputeThinBlockDimension). A fill over part of it, a fill reaching the start of a target whose footprint is not computed (linear), and a fill value with no exact clear value in the format (sRGB channels other than 0 and 1) throw at the next use. A fill before the target's first use is not seen (the host image starts at 0), nor are copies or shader writes into its color memory. A uniform compute fill over exactly the whole color memory with an exact clear value is not stored into guest memory, since only the host image holds the samples. A target is retired only when its whole guarded range is unmapped or its allocation removed, so if a title reuses that memory for other data while it stays mapped, a read the guard does not check (a buffer read through a V# or a pointer) sees the bytes from before the fill.
-- [Multisampled texture no draw rendered to](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - sampling a multisampled texture whose surface no draw rendered to creates the host target from the T# and clears it to the color a single 32-bit value repeated over the whole footprint encodes, padding up to whole tile blocks included. Inferred, not measured on the console: that the samples of such a surface are the guest color memory, as a title that clears its canvas on the CPU (ps5-opengl `ps5_clear_msaa4_color`) relies on. Memory that is not one repeated value, tile modes other than Standard4KB, Standard64KB and RenderTarget, unmapped memory and values with no exact clear color throw. CPU writes to the surface after its host target exists are not seen by the host.
+- [Multisampled texture no draw rendered to](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - sampling a multisampled texture whose surface no draw rendered to creates the host target from the T# and clears it to the color a single 32-bit value repeated over the whole footprint encodes, padding up to whole tile blocks included. Inferred, not measured on the console: that the samples of such a surface are the guest color memory, as a title that clears its canvas on the CPU (ps5-opengl `ps5_clear_msaa4_color`) relies on. Memory that is not one repeated value, tile modes other than Standard4KB, Standard64KB, Z64KBX, D64KBX and RenderTarget, unmapped memory and values with no exact clear color throw. CPU writes to the surface after its host target exists are not seen by the host.
+- [Sample 0 of a multisampled color target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/FirstSampleCopy.cpp) (libSceAgcDriver) - a 2D image read of a multisampled color target returns its float, UNORM, SNORM or sRGB sample 0 exactly only where the driver keeps those values through a shader and a color attachment, which Vulkan does not require, and one of a multisampled depth surface throws. The read binds a one-sample copy that a fragment pass (`texelFetch` of sample 0) draws before every such binding; integer formats copy exactly.
 - [Multisampled targets in CB passes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a CB eliminate or DCC pass over a multisampled target throws, since its texels are on the host and only a CB resolve and an FMASK decompress (`CB_COLOR_CONTROL` mode 5) are modeled. The FMASK decompress only applies the pending CMASK fast clear to the host image; it requires a CMASK address, and the target's DCC and FMASK contents are not interpreted. DCC over a multisampled target is accepted only in that pass and throws everywhere else. A CB resolve into a fast-clear destination throws: the resolve writes the destination's texels but not its CMASK, which would still read as cleared.
-- [Multisampled target guest access](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - the memory a multisampled color target throws on (CPU read, index buffer read, fixed-function vertex buffer read, DMA copy, texture or storage image read) uses fragment-aware 64 KiB render-target blocks. [AMD Addrlib's GFX10 thin-block rule](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L1680-L1712) gives the block width and height from element bytes and fragment count; its [surface-size calculation](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L4000-L4005) rounds both extents to those blocks and multiplies by element bytes and fragments. Thus a 1920x1080 4x RGBA8 surface occupies 0x1fe0000 bytes, leaving the next allocation at +0x2000000 outside the guard. The 2x and 8x block orientations differ from treating the fragments as a larger element. Console address-layout equivalence has not been measured. Other tile modes retain the conservative `max(CB bytes * samples, width * height * element bytes * samples)` bound, which may still reject a distinct allocation. Live targets remain cached per device, surface address, format, extent and sample count. Retired cache owners are removed on the next target, sampled or storage lookup; outstanding recorded work and sampled views retain their images. Ordinary sampled and storage bindings check the color-target guard before resource reuse, including precollected sampled lookups. Reused image tables do not invalidate on multisample color-target registration yet; their per-element fault handling and native multisample sampling require a separate reuse proof.
-- [DB depth copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with `DB_RENDER_CONTROL.DEPTH_COPY` is run as a compute pass that copies one sample of the `Z_32_FLOAT` depth surface into a single-sample R32 float color target over the whole surface. With `COPY_CENTROID` the sample is the first one the draw covers, which is sample 0 under the full `PA_SC_AA_MASK` the driver requires: [radeonsi copies one sample per draw with `COPY_CENTROID` and a one-sample mask](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state.c#L1679-1681); the console is not measured. Stencil copies, depth tests, other depth formats, multisampled or other-format targets and copies over part of the surface throw.
+- [Multisampled target guest access](../../../core/libs/prx/libSceAgcDriver/Graphics/src/MultisampleTarget.cpp) (libSceAgcDriver) - the memory a multisampled color target throws on (CPU read, index buffer read, fixed-function vertex buffer read, DMA copy, texture or storage image read) uses fragment-aware 64 KiB blocks for the RenderTarget, Z64KBX and D64KBX tile modes. [AMD Addrlib's GFX10 thin-block rule](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L1680-L1712) gives the block width and height from element bytes and fragment count; its [surface-size calculation](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp#L4000-L4005) rounds both extents to those blocks and multiplies by element bytes and fragments. Thus a 1920x1080 4x RGBA8 surface occupies 0x1fe0000 bytes, leaving the next allocation at +0x2000000 outside the guard. The 2x and 8x block orientations differ from treating the fragments as a larger element. Console address-layout equivalence has not been measured. Other tile modes retain the conservative `max(CB bytes * samples, width * height * element bytes * samples)` bound, which may still reject a distinct allocation. Live targets remain cached per device, surface address, format, extent and sample count. Retired cache owners are removed on the next target, sampled or storage lookup; outstanding recorded work and sampled views retain their images. Ordinary sampled and storage bindings check the color-target guard before resource reuse, including precollected sampled lookups. Reused image tables do not invalidate on multisample color-target registration yet; their per-element fault handling and native multisample sampling require a separate reuse proof.
+- [DB depth copies](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPrecheck.cpp) (libSceAgcDriver) - with `COPY_CENTROID` the copied sample is sample 0, as [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-24.0.0/src/gallium/drivers/radeonsi/si_state.c#L1679-1681) programs it under a full sample mask, so an edge pixel whose sample 0 the draw doesn't cover can differ from the console's first covered sample; not measured on the console. The copy runs as the title's draw with a driver-authored guest pixel program (hand-encoded RDNA2) that loads the sample through a driver-built T# and exports it as `32_R`. A multisampled plane is read without the native multisample import checks. Stencil copies, depth tests, planes other than `Z_32_FLOAT`, mips, a partial sample mask, blending, indirect draws and other targets throw.
 - [CB resolve sample count](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with CB_COLOR_CONTROL in resolve mode is a CB resolve when either PA_SC_AA_CONFIG or CB_COLOR0_ATTRIB.NUM_SAMPLES is multisampled, and takes its sample count from CB0. Inferred, not from documentation: PPSA36082 resolves its 4x targets with no sample count in PA_SC_AA_CONFIG, and radeonsi sets PA_SC_AA_CONFIG to 0 for a multisampled framebuffer when rasterizer multisampling and line smoothing are off. PA_SC_AA_CONFIG is only compared with CB0 while PA_SC_MODE_CNTL_0.MSAA_ENABLE is set: PPSA08270 resolves a 4x 512x512 target with MSAA_ENABLE off and PA_SC_AA_CONFIG still at 2x (0x00108001) from earlier draws.
 - [Custom MSAA sample locations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) support a uniform 1x1 pattern for 2, 4 or 8 samples through VK_EXT_sample_locations. Patterns varying across the guest's 2x2 pixel grid use a 2x2 sample location grid, anchored at the framebuffer origin like the guest's while the window offset is zero, on devices whose `maxSampleLocationGridSize` for the sample count is a multiple of 2x2. On other devices every pixel takes the pattern's pixel (0,0) locations (`PA_SC_AA_SAMPLE_LOCS_PIXEL_X0Y0_*`, its first registers and the corner the grid is anchored at), and the first such pipeline of each sample count logs `[gpu] no 2x2 sample location grid`. The RTX 5070 reports 2x4 for 2 samples, 2x2 for 4 and 1x2 for 8; an AMD Radeon integrated GPU reports 2x2 for each count, per count and for every count; an RTX 3070 Laptop GPU (driver 617.42) reports `maxSampleLocationGridSize` 1x1 for every count (`VkPhysicalDeviceSampleLocationsPropertiesEXT`), but per count (`VkMultisamplePropertiesEXT`, which the device setup reads and logs) a 2x4 grid at 2 samples, 2x2 at 4 and 1x2 at 8. So the 3070's 2x patterns, the 2x checkerboard among them, take the native grid, and the stand-in plus the exact path serve its 8-sample patterns and devices without a grid. A pattern that only reorders one set of positions between pixels, as a 2x checkerboard pattern puts its samples at x = +4/16 and -4/16 and swaps them on odd rows, is drawn exactly through that stand-in: before every render pass that draws with it each pixel's samples are put in the stand-in's order and after it back in the guest's, through a storage view of a multisampled color target and through a copy and a per-sample pass for depth (writing stencil through VK_EXT_shader_stencil_export, or one pass per bit without it), while the pixel shader reads SampleID, applies the sample mask and exports coverage in the guest's order, and the second log line names the reordering. A uniform partial sample mask that the order moves is applied in the pixel shader. With early Z, a depth or stencil test and memory writes in the pixel program, the draw throws, where #6451's stand-in alone ran it with odd rows' sample indices swapped. A fix would choose the stand-in after compilation. That costs two passes over each multisampled attachment per render pass, and on those devices every multisampled color target is created with a mutable format and storage usage for its view, which a driver may answer by not compressing it. It needs shaderStorageImageMultisample with a storage view of the color format at the sample count, sampleRateShading, and a depth format a FragDepth write gives back exactly (16-bit, or 32-bit float; not 24-bit depth, the stand-in for 16-bit depth with stencil where the device has neither); without them, and for patterns whose pixels hold different positions, the stand-in alone is used, and the log line says why. A device without shaderStorageImageMultisample takes the stand-in alone for every pass, depth-only passes included, so a depth target that a depth-only pass and a color pass both draw keeps one order. On a device that has it, a pass is still refused for a color format without a storage view at its sample count, while a depth-only pass on the same depth target is reordered, so that target's samples change order between those passes; a fix would decide the order per target. Then the top-left pixel of every 2x2 quad matches the console and the other three use its positions. A same-set pattern keeps every position and the number of samples a primitive covers in each pixel, so a resolve that averages a pixel's samples, or takes their minimum or maximum, sees the console's values, but sample i of an odd row holds what the console stores in sample 1 - i: a pass that reads the samples by index, as checkerboard reconstruction does, exchanges the two half-pixels of odd rows, which can show as combing along vertical edges, and per-sample shading, sample-mask exports and coverage inputs see the swapped indices too. A pattern whose pixels hold different positions draws pixel (0,0)'s positions in each pixel whose own differ. A device's pipelines and render pass begins take the same stand-in for a given pattern, so a sample-location-compatible depth image is not drawn with one set of locations and transitioned or tested with another. A multisampled rasterizer drawing into one-sample color targets, and a one-sample depth target if any, with MSAA_ENABLE set, no alpha-to-coverage and no coverage pixel input is drawn with one sample at sample 0's location in each pixel of the grid, as the targets keep only sample 0's coverage. Without PS_ITER_SAMPLE such a draw also refuses centroid inputs, and keeps PERSP_SAMPLE, LINEAR_SAMPLE and ANCILLARY: a pixel shaded once is taken to get sample 0's barycentrics and sample index 0. With PS_ITER_SAMPLE only sample 0's invocation reaches the targets, so its sample and centroid barycentrics are taken to be sample 0's and the draw is shaded once. Both are inferred, not measured. The pixel shader runs once per pixel with sample number 0, so ANCILLARY reads sample 0 and POS_X_FLOAT and POS_Y_FLOAT keep the position `SPI_BARYC_CNTL` names. PERSP_CENTER and LINEAR_CENTER inputs on this path are interpolated at sample 0's location on the host, where the console uses the pixel center; one-sample depth images are created with `SAMPLE_LOCATIONS_COMPATIBLE_DEPTH` when the device supports it, as multisampled ones already were; this is how VK_AMD_mixed_attachment_samples defines the case, and it is not measured on PS5 hardware. Other mixed sample counts throw. Devices without the required sample count, four subpixel bits or the full guest coordinate range refuse custom patterns. Depth images remain in GENERAL between draws, and render passes cannot continue across pattern changes. A pass that draws depth at custom sample locations ends with a transition to TRANSFER_SRC_OPTIMAL and back that names them. Guest offsets retain the existing decoder's signed four-bit, sixteenth-pixel interpretation; PS5 coverage and interpolation equivalence have not been measured on hardware.
-- [Single-sample scan into a multisampled depth target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` = 0 and `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear into a multisampled depth target rasterizes the depth target's sample count with every sample at the pixel center, as a single-sample scan into a multisampled color target already does. radeonsi programs this `MSAA_ENABLE` and `PA_SC_AA_CONFIG` with the depth buffer's own sample count when GL multisampling is disabled on a multisampled framebuffer ([L1066-L1068](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L1066-L1068), [L3485-L3512](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L3485-L3512)), although its comment lists Z samples as at most the coverage samples ([L3439](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L3439)) and it sets `DB_EQAA.MAX_ANCHOR_SAMPLES` to the Z sample count, where PPSA18216 sets `DB_EQAA` to 0. GL then lets every sample take the single-sample depth ([L185-L190](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L185-L190)) and the fragment be treated as in multisampling with full coverage ([L422-L425](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L422-L425)), which is what this draws: each depth and stencil sample is tested and written with the depth at the pixel center. GL also lets an implementation test only a centermost sample and set every sample from it ([L425-L434](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L425-L434)), which differs when a pixel's stored samples differ; which one the console does, whether it instead evaluates the depth plane at each sample position, and how its occlusion queries count such a draw, is not measured on hardware. Points, lines, alpha-to-coverage, `DB_EQAA` Z interpolation or overrasterization, a pixel program reading the sample index, a sample-mask export and a single-sample color target next to the multisampled depth target throw
+- [Single-sample scan into a multisampled depth target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a draw with `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` = 0 and `PA_SC_MODE_CNTL_0.MSAA_ENABLE` clear into a multisampled depth target rasterizes the depth target's sample count with every sample at the pixel center, as a single-sample scan into a multisampled color target already does. radeonsi programs this `MSAA_ENABLE` and `PA_SC_AA_CONFIG` with the depth buffer's own sample count when GL multisampling is disabled on a multisampled framebuffer ([L1066-L1068](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L1066-L1068), [L3485-L3512](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L3485-L3512)), although its comment lists Z samples as at most the coverage samples ([L3439](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/gallium/drivers/radeonsi/si_state.c#L3439)) and it sets `DB_EQAA.MAX_ANCHOR_SAMPLES` to the Z sample count, where PPSA18216 sets `DB_EQAA` to 0. GL then lets every sample take the single-sample depth ([L185-L190](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L185-L190)) and the fragment be treated as in multisampling with full coverage ([L422-L425](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L422-L425)), which is what this draws: each depth and stencil sample is tested and written with the depth at the pixel center. GL also lets an implementation test only a centermost sample and set every sample from it ([L425-L434](https://github.com/KhronosGroup/OpenGL-Registry/blob/6af574a14089ccfee87efe230ebcdd8742859813/extensions/ARB/ARB_multisample.txt#L425-L434)), which differs when a pixel's stored samples differ; which one the console does, whether it instead evaluates the depth plane at each sample position, and how its occlusion queries count such a draw, is not measured on hardware. Points, lines, alpha-to-coverage, `DB_EQAA` Z interpolation or overrasterization, a pixel program reading the sample index and a sample-mask export throw
+- [One-sample color targets beside a multisampled depth target](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a one-sample color target drawn with a depth target of the rasterizer's sample count is taken to keep the coverage of sample 0 after the depth and stencil tests. That is the rule of [`VK_AMD_mixed_attachment_samples`](https://github.com/KhronosGroup/Vulkan-Docs/blob/193ebe195f47ffc5004683d1659e71c725658c4d/chapters/fragops.adoc#L2510-L2516), and it is not measured on hardware. The draw needs `VK_AMD_mixed_attachment_samples`, or `VK_NV_framebuffer_mixed_samples` with truncated coverage reduction, for its sample count and throws without them. With `PS_ITER_SAMPLE` the color is the output of sample 0's invocation. Overrasterization and color targets of different sample counts throw.
 - [DCC display buffers](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) are presented only when all keys of the console's DCC extent agree on uncompressed or a fast-clear code, padding keys included; other keys, and register-clear keys over a pending image, throw.
 - [Storage image write-back](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) stores the GPU results over a CPU-stamped range whose guest bytes equal the copy taken when the image's layers got their generation (images up to 1 MiB whose guest bytes were settled at that point, with no unit shadow, pending image results or recorded GPU store over them; other images keep the previous rule: the CPU's bytes win). A CPU store that rewrites the baseline value after the GPU changed it is not told apart from no store, and the GPU result wins there. The 1 MiB limit is a choice, not a console value. A range a queued draw commit still has to read is left pending whatever the stamps say ([`DrawPipeline::HeldReads`](../../../core/libs/prx/libSceAgcDriver/Execution/include/Driver/Draw/DrawPipeline.hpp)), so a title that recycles one allocation between an index buffer and a storage image sees the draw's own indices; the trade is a title that reads a surface as index data and means the image gets the pre-image bytes instead, since the reservation does not compare the command-stream positions of the draw and of the image's write. `APS5_NO_QUEUED_DRAW_READ_ORDER=1` restores the old behaviour, and the `[storage]` line counts the listings the hold turned away (`held for a queued draw read`) and the `[draw] pipelined` line the stores it held. The hold covers what the commit reads of guest memory: the index range, the vertex input ranges as their descriptor extents ([`QueuedDrawReadRanges`](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/WrittenBuffers.cpp), since the bytes a draw fetches depend on the highest index, which only the commit knows) and the source of a queued DMA copy. Every other commit-time read goes through the flush hook, so it sees the bytes the hold protects. Two commit-time reads are outside the hold: the texels a register or cmask clear materialization reads from the draw's own colour target (through the hook, so ordered, but the hold does not cover a render target), and a CPU read whose store the hold turned away, which sees the pre-image bytes. Nothing retries a refused store: the image reaches guest memory with the next flush of that range (the queue worker's idle store, a `WAIT_REG_MEM` poll over it, a later read or write of it). A kept 64 KiB unit that lies outside every (slice, level) window stores nothing: the tracking grid is flat over the guest range while 3D slices taper in depth with the mip level (`HasLayer`), so the higher depth slices' higher-level blocks belong to no window. The console's tracking of such units is not measured.
 - [16-bit float display buffers](../../../core/libs/prx/libSceAgcDriver/Execution/src/DisplayBuffer.cpp) (libSceAgcDriver, libSceVideoOut) - pixel formats `0xC001000622000000` and `0xC001000600000000` are taken as R16G16B16A16 and B16G16R16A16 float, eight bytes per texel, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/59183dbfa81ed7efdff6069177fed50de0552725/src/graphics/host_gpu/renderer/image/imageInfo.h) maps them and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/VideoOut/VideoOutTypes.cs) names them (`Rgba16Float`, `Bgra16Float`); PPSA11386 registers 3840x2160 tiled buffers of the first. The tiled layout is assumed to be the 8-byte SW_64KB_R_X equation of `TextureSwizzleEquations.hpp` applied to full coordinates, as addrlib applies it, by analogy with the 32-bit scanout; `ColorTargetLayout` applies the equations to in-block coordinates, which for 8-byte texels differs in every odd 64-row block row (address bit 11 takes y bit 6) and for 16-byte texels also differs, so a float display buffer written through `WriteColorTarget` and presented from guest memory would show those rows misplaced. The values are assumed to be linear light and are encoded with the sRGB curve for the 8-bit output. Bits 32-39 of these formats are `0x06`, as in the 10-bit formats SharpProspero lists without sRGB transfer, while its sRGB formats have `0x00`, its 10-bit PQ formats `0x04` (with `0x07` in bits 40-47) and its float BT.2100 PQ formats `0x07`: they show only that these formats are not the sRGB ones. NaN and negative values give 0, values of 1 and above give 255, alpha is linear. Neither the layout nor the transfer is verified against console or title frames, and HDR output is not modelled. DCC metadata on a float buffer throws.
@@ -174,19 +197,24 @@
 - [8_SRGB color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) on such a device throw unless they are single-mip 2D surfaces with a resident image; linear targets have none.
 - [5_6_5 color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into R5G6B5. The field holding X is in bits 0-4, Y in 5-10 and Z in 11-15, as for the other AMD formats; the component swap picks which export fills them, following `ac_translate_colorswap` in [Mesa 26.2.2 ac_formats.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/common/ac_formats.c), which programs `SWAP_STD_REV` (2) for a surface with red in bits 11-15. With `SWAP_STD_REV` red goes to bits 11-15, R5G6B5's red, so the exports are written as they are; with `SWAP_STD` (0) red goes to bits 0-4 and the exports are written with X and Z exchanged, as for 1_5_5_5. The decoded format, component mapping and write mask are tested, and an execution test draws 32_ABGR exports into tiled and linear targets in both orders and compares every stored texel with that layout on the host device; the export direction is not measured on a PS5. Only UNORM with those two component orders is accepted; `SWAP_ALT` and `SWAP_ALT_REV` keep throwing. Destination alpha reads as 1, as Vulkan defines it for a format without alpha, which is not measured on the console. Constant blend colors with `SWAP_STD` go through the `0xc6` component-swap handling, which is not tested for this format. R5G6B5 has no entry in the DCC and multisample clear-encoding tables, so a CB DCC decompress or eliminate of DCC clear codes other than 0000 and a fast clear of a multisampled 5_6_5 target throw, as for 1_5_5_5. PPSA27305 renders into this format with `SWAP_STD_REV` (discussion #6434).
 - [1_5_5_5 color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) render into A1R5G5B5. AMD formats keep the first component in the least significant bits (X in bits 0-4, Y in 5-9, Z in 10-14, W in bit 15, as in the [fpPS4](https://github.com/red-prig/fpPS4) `kSurfaceFormat1_5_5_5` doc comment and as measured for textures in the packed 16-bit textures entry), while A1R5G5B5 keeps R in bits 10-14 and B in bits 0-4, so the pixel exports are written with X and Z exchanged, which makes the stored bits follow the guest layout. The decoded format, component mapping and write mask are tested, and an execution test draws 32_ABGR exports into tiled and linear targets and compares every stored texel with the guest layout on the host device; the export direction is not measured on a PS5. Only UNORM with the standard component swap is accepted. Constant blend colors go through the same component-swap handling as other targets with that export mapping (`0xc6`), which is not tested for this format. PPSA06699 renders into this format.
-- [COPY_DATA from the GPU clock](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, `SRC_SEL` 9) writes the host steady clock in 10 ns ticks when the packet runs, the same counter as the `RELEASE_MEM` timestamp, not the console's GPU clock. The `COPY_DATA` cache policy fields are accepted and have no effect.
+- [4_4_4_4 partial writes, sample positions](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a partial write of a multisampled 4_4_4_4 UNORM target runs the pixel shader once per sample. For a shader the guest runs per pixel it throws on inputs that would follow the invocation's sample: the ancillary word and, unless every sample sits at the pixel centre, centroid, sample-located or pull-model barycentrics, Z, 1/W and positions at the centroid or a sample; off-centre samples make centre barycentrics throw without interpolation functions and fragment shader barycentrics. Centre barycentrics and positions, upper-left and fixed-point positions and the front face are kept, so each invocation reaches the console's colour and kill decision. A shader that writes guest memory throws, as each covered sample would repeat the writes, also when the guest iterates it itself (the request does not say). Not measured on a PS5.
+- [4_4_4_4 CB resolves](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a CB resolve from a packed color target throws, so a 2-sample 4_4_4_4 target cannot be resolved by the color block.
+- [4_4_4_4 partial writes, merged coverage](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a partial write of a one-sample 4_4_4_4 UNORM target drawn with merged coverage (a multisampled rasterizer over a one-sample target, as radeonsi line and polygon smoothing does) throws: the merge leaves the target out of the colour attachments, so such a draw would rasterize the extra samples with no one-sample attachment for `VK_NV_framebuffer_mixed_samples` coverage reduction, a combination that is not tested.
+- [4_4_4_4 partial writes, measured hardware](../../../core/libs/prx/libSceAgcDriver/tests/execution/PackedUnorm4444MultisamplePartialWrite.cpp) (libSceAgcDriver) - the single-sample merges and the 2-, 4- and 8-sample merges are measured only on an NVIDIA RTX 4070 SUPER, not on other host GPUs or a PS5.
+- [COPY_DATA from the GPU clock](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, `SRC_SEL` 9) writes the host steady clock in 10 ns ticks when the packet runs, the same counter as the `RELEASE_MEM` timestamp. On a PS5 (firmware 13.40, measured 2026-10-19 on the GPU through `sceAgcDriverSubmitDcb` from inside a retail title) `SRC_SEL` 9 and the `RELEASE_MEM` DATA_SEL 3 timestamp were the same counter (0x1C and 0x5C ticks apart within one buffer), and it ran at 98.0 and 99.8 MHz over two 1.1 s intervals timed by the CPU, i.e. 100 MHz within the submission jitter, as the 10 ns ticks here; only its starting value is the host's. The `COPY_DATA` cache policy fields are accepted and have no effect.
 - [COPY_DATA from a register](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, `SRC_SEL` 0) copies the value the queue holds for a shader, context or user config register (`COUNT_SEL` two consecutive ones) and throws for a register with no value. A dispatch records `COMPUTE_DISPATCH_INITIATOR` and, for `DISPATCH_DIRECT`, `COMPUTE_DIM_X/Y/Z` in the shader registers; `DISPATCH_INDIRECT` clears the three counts. Neither the register values the CP writes nor the copy's ordering against in-flight dispatches have been measured on hardware.
 - [EVENT_WRITE stream-out statistics events](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, opcode 0x46) - `SAMPLE_STREAMOUTSTATS1`-`3` and `SAMPLE_STREAMOUTSTATS` (event types 0x01-0x03 and 0x20 in [navi10_enum.h](https://github.com/torvalds/linux/blob/0fcb05b72344f40806cbe810de8872f1698bf053/drivers/gpu/drm/amd/include/navi10_enum.h#L14155-L14188)) are accepted on the graphics queue as a 2-dword packet with event index 0 and do nothing. [nvd.h](https://github.com/torvalds/linux/blob/0fcb05b72344f40806cbe810de8872f1698bf053/drivers/gpu/drm/amd/amdgpu/nvd.h#L326-L347) documents these events only with the sampling index (3, or `EVENT_INDEX__SAMPLE_STREAMOUTSTATS*` 8-11 on gfx10); the index-0 packet has no destination dwords, and what the CP does with it is neither documented nor measured on hardware. AnyPS5 does not emulate the VGT stream-out counters, so there is nothing to sample. The sampling indices throw that sampling to memory is not implemented, and other indices, other sizes and the compute queue throw. [sceAgcDcbEventWrite](../../../core/libs/prx/libSceAgc/DcbFlow/src/Sync.cpp) ignores the address for every event type except 0x38 and 0x39, so a call with one of these event types and an address builds the index-0 packet: nothing is written and nothing throws. Whether the console's builder emits a sampling packet for an address is not known.
 - [INDEX_ATTRIBUTES_INDIRECT](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, opcode 0x91) loads INDEX_BASE, INDEX_BUFFER_SIZE (in indices) and INDEX_TYPE from the 16-byte record at `attribute_base + attribute_index * 16`, read when the packet runs. The record layout (address low, address high, size, type) is PAL's [`IndexAttribIndirect`](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9Chip.h#L60-L67) and the packet is the one [`BuildIndexAttributesIndirect`](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9CmdUtil.cpp#L2586-L2613) writes. The console's `sceAgcDcbSetIndexIndirectArgs` writes this packet, with `indirect_mode` 0, the attribute base in the address dwords and the attribute index in bits 0-15 ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/agcbuild.golden.tsv#L172-L174) by the prosper console oracle); the record layout is not measured on a PS5, and neither is seen in a title. `indirect_mode` 1 (`addr_offset`, which only PAL's ExecuteIndirect path emits) throws, and so does a record whose index type is above 3, as INDEX_TYPE does.
+- [Indexed indirect draws without an index limit](../../../core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp) (libSceAgcDriver, opcodes 0x25 and 0x38) - on a queue that has received neither INDEX_BUFFER_SIZE (0x13) nor INDEX_ATTRIBUTES_INDIRECT (0x91) since its last reset, the draw has no index limit: it takes the CPU record path ([IndirectDraw.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/IndirectDraw.cpp)), and [Draw.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/Draw.cpp) reads each record's firstIndex and indexCount range as written, without clamping, and refuses a range that overflows or is not readable. An INDEX_BUFFER_SIZE of 0 that was written still throws. The console's initial INDEX_BUFFER_SIZE and whether DRAW_INDEX_2 or DRAW_INDEX_OFFSET_2 MAX_SIZE changes it are not measured. The suspend-point queue reset also clears a written size. PPSA08338 issues DRAW_INDEX_INDIRECT_MULTI this way without ever emitting either packet.
 - [16-bit RGBA color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) support the standard and the alternate (`COMP_SWAP` 1) component order. Alternate swaps red and blue in shader exports, write masks and constant-color blend factors, following `ac_translate_colorswap` in [Mesa 26.2.2 ac_formats.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/common/ac_formats.c). Blending into the reverse orders (`COMP_SWAP` 2 and 3) is covered by the reversed-order blending entry, and simultaneous targets requiring conflicting blend constants throw. Console equivalence has not been measured on hardware.
 - [UINT16_ABGR color exports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - export format 7 is accepted only into an unsigned integer target, and each 16-bit value reaches the target unchanged; a value beyond a narrower target's range (`R8_UINT`) is undefined in Vulkan, and whether the console clamps or truncates it is not confirmed. SINT16_ABGR (8) throws
 - [Layered color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 3D color targets with 64 KiB render-target or 4 KiB standard tiling render several slices, and so does a `CB_COLOR_VIEW` slice range on a 2D array target through the array's resident image, or on a surface of one slice as an array of the view's last slice + 1 slices, one slice pitch apart: a layered draw into an array without its resident image, a layered draw with a depth target, and color targets of different slice counts throw. The vertex layer export (`PA_CL_VS_OUT_CNTL` USE_VTX_RENDER_TARGET_INDX) reaches the shader only for a layered draw and is otherwise ignored, as before; a layer beyond the view's last slice is undefined in Vulkan, while the console's handling (clamping to `SLICE_MAX`) is not modeled, and a view whose last slice lies past the surface is clamped to its last slice. DCC keys of a 3D color target are taken as one key per 256 bytes over the whole surface, every slice included, and only uniform keys (all uncompressed, or one fast-clear code) are interpreted, as for 2D targets; mixed keys leave the stored texels as they are. The console's DCC key layout for 3D surfaces is not checked (LEGO Horizon Adventures' (PPSA14632) lighting volumes are DCC)
 - [VGT_TF_PARAM](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - DISTRIBUTION_MODE is taken as scheduling only; the host tessellator decides the order of a patch's triangles.
 - [Local programs](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) that the hull header leaves at address 0 are prepared at their first draw, one artifact per tessellation configuration, instead of at registration.
-- [Packed 16-bit textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp) (libSceAgcDriver) - `5_6_5`, `1_5_5_5` and `4_4_4_4` are viewed as R5G6B5, A1R5G5B5 and B4G4R4A4 (the 4-bit format every Vulkan device can sample; R4G4B4A4 is optional and lavapipe lacks it) with a swizzle that reads X from the low bits, and a DST_SEL of the missing W of `5_6_5` reads X. Measured on RDNA2 (gfx1035), not on the console: through `image_load` and `image_sample_lz`, X, Y, Z (and W of `1_5_5_5` and `4_4_4_4`) come from the low, middle and high fields, and W of `5_6_5` returns X (the low 5 bits), not 1.
+- [Packed 16-bit textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/TextureFormat.cpp) (libSceAgcDriver) - `5_6_5`, `1_5_5_5` and `4_4_4_4` are viewed as R5G6B5, A1R5G5B5 and B4G4R4A4 (the 4-bit format every Vulkan device can sample; R4G4B4A4 is optional and lavapipe lacks it) with a swizzle that reads X from the low bits, and a DST_SEL of the missing W of `5_6_5` reads X. Measured on RDNA2 (gfx1035), not on the console: through `image_load` and `image_sample_lz`, X, Y, Z (and W of `1_5_5_5` and `4_4_4_4`) come from the low, middle and high fields, and W of `5_6_5` returns X (the low 5 bits), not 1. Storage images use compatible R16_UINT views with the [buffer UNORM store conversion](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp); quantization uses nearest even and maps NaN to zero. Rounding ties and NaN handling for packed stores have not been checked on AMD or PS5 hardware.
 - [Min/max S# reduction](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) - `FILTER_MODE` 1 and 2 use Vulkan's min and max reduction (the same `SQ_IMG_FILTER_MODE` values RADV programs). Measured on RDNA2 (gfx1035), not on the console: only texels of non-zero weight are reduced, and the weight is taken after rounding to the 8-bit subtexel grid (a sample within 1/512 texel of a centre reduces that texel alone); a driver with other `subTexelPrecisionBits` reduces a different set there. Gathers ignore the mode.
 - [Min/max S#](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver, shader recompiler) - throws with a linear mip filter, depth or color-texture compare, or bilinear or anisotropic filtering of an image the recompiler point-samples (sint, converted, depth-bits). With anisotropy the host sampler reduces over its own footprint; [RADV](https://github.com/openbsd/xenocara/blob/1b39033df8d928ec247ca64448c4a63c72302db7/lib/mesa/src/amd/vulkan/radv_sampler.c#L185-L232) programs the same S# for such a Vulkan sampler. Measured on RDNA2 (gfx1030 in [#5156](https://github.com/boykopovar/AnyPS5/pull/5156#issuecomment-6155265616), gfx1035 in #5821), not on the console: without derivatives (`image_sample_lz`), min or max with anisotropic bilinear returns the bilinear minimum or maximum and with anisotropic point the point result, at every ratio field 0 to 4; with derivatives (`image_sample_d`, a 4:1 footprint), anisotropic bilinear at ratio field 2 or 4 reduces over the texels of all its anisotropic taps (the minimum or maximum along the major axis), not one bilinear footprint. A host that is not AMD reduces over its own anisotropic footprint, and Vulkan leaves nearest filtering with anisotropy to the host driver.
-- [FORCE_DEGAMMA](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Sampler.cpp) (libSceAgcDriver) - not measured on the console. A sampler that forces sRGB decoding throws for an SNORM `8`, `8_8` or `8_8_8_8` texture, which RDNA2 (gfx1031) reads bit for bit as the sRGB format of the same bytes, and for a format not measured on RDNA2. The rest follows gfx1035 and gfx1031 (point and bilinear): sRGB textures sample as without the bit, as in shadPS4 (PS4); UNORM `8`, `8_8`, `8_8_8_8`, BC1, BC2, BC3 and BC7 sample through their sRGB view (decoded before filtering); `16`, `16_16` and `16_16_16_16` UNORM, SNORM and FLOAT, `32`, `32_32` and `32_32_32_32` FLOAT, `10_11_11`, `2_10_10_10`, `5_9_9_9`, `5_6_5`, `1_5_5_5`, `4_4_4_4`, BC4, BC5 and BC6H sample as without the bit, as gfx1031 does.
+- [FORCE_DEGAMMA](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Sampler.cpp) (libSceAgcDriver) - not measured on the console. A sampler that forces sRGB decoding throws for a format not measured on RDNA2. The rest follows gfx1035 and gfx1031 (point and bilinear): sRGB textures sample as without the bit, as in shadPS4 (PS4); UNORM `8`, `8_8`, `8_8_8_8`, BC1, BC2, BC3 and BC7 sample through their sRGB view (decoded before filtering), and SNORM `8`, `8_8` and `8_8_8_8` through the sRGB view of their bytes, as gfx1031 reads them; `16`, `16_16` and `16_16_16_16` UNORM, SNORM and FLOAT, `32`, `32_32` and `32_32_32_32` FLOAT, `10_11_11`, `2_10_10_10`, `5_9_9_9`, `5_6_5`, `1_5_5_5`, `4_4_4_4`, BC4, BC5 and BC6H sample as without the bit, as gfx1031 does.
 - [Tessellation factor ring](../../../core/libs/prx/libSceAgcDriver/State/src/Configuration.cpp) (libSceAgcDriver) - `sceAgcDriverSetTFRing` records the ring and `sceAgcDriverGetTFRing` reports it. Before a title sets one, it reports the console's default, 0xFF0000000 and 128 KiB, as measured in [PS5_Vulkan's hardware findings](https://github.com/mihawk-99/PS5_Vulkan/blob/fde9e3798c2ec1d8fccc90d5067cd6060490607f/docs/HARDWARE_FINDINGS.md). Nothing is written to the recorded ring: tessellated draws run as Vulkan tessellation stages, which keep their factors on the host, so a title that reads tessellation factors from the ring finds none. A null base or a zero size throws; [ps5-opengl's AGC runtime](https://github.com/blackbearreloaded/ps5-opengl/blob/67c873f985eaefe0a72f713529e5632eaa01139c/src/platform/ps5_agc_native_runtime.c) calls `sceAgcDriverSetTFRing(0, 0)` in its cleanup, and what that does on the console is unknown.
 - [VertexBufferReadSize](../../../core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp) and the [vertex staging copy](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Draw.cpp) (libSceAgcDriver) - a vertex fetch whose index is at or past the descriptor's `num_records` no longer throws for `OOB_SELECT` 0 and 1. The copy still spans the whole fetch, but the bytes from `num_records * stride` onward read as zeros, so the out-of-range vertex is `(0, 0, 0, 0)`. Measured with `buffer_load_format_xyzw` (`idxen`) through the [hardware oracle](../HW_ORACLE.md) on RDNA2 gfx1036 for PPSA01325's word 3 `0x0004dfac` (`OOB_SELECT` 0) in #2241: indices 3, 4 and 5 over 3 records each return `00000000 00000000 00000000 00000000`, W included, unlike Vulkan `robustBufferAccess`, which returns `(0, 0, 0, 1)`. The zeros come from the record check, not from memory: stored values placed past the records are ignored, and a `num_records` 6 control returns them. `RESOURCE_LEVEL` 1, `OOB_SELECT` 1 and FORMAT 74 `32_32_32_FLOAT` give the same zeros, in wave32 and wave64; gfx1013 (the console) is not measured. `OOB_SELECT` 2 returns the stored values past the records and `OOB_SELECT` 3 compares `num_records` against the byte offset, both measured on the same setup in #2241; the two keep throwing past `num_records` here, since each needs its own rule. Zero-stride descriptors (`stride` 0) keep their separate byte-count check and are not covered here. Each out-of-range fetch is copied alone and outside the draw-snapshot cache, which is neither read nor written for it: a reused snapshot would carry another draw's bytes into the zero region, and a stored zero-padded copy would hand zeros to a later in-range draw at the same address. The valid prefix is still flushed for GPU writes before it is read.
 - [Draw snapshot buffer descriptors](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) rewrite each affected array from element zero, preserving unchanged descriptors. MoltenVK 1.4.2 writes auxiliary buffer lengths at index `i` instead of `start + i` for partial array updates ([MVKDescriptorSet.mm, BufferAuxSize](https://github.com/KhronosGroup/MoltenVK/blob/v1.4.2/MoltenVK/MoltenVK/GPUObjects/MVKDescriptorSet.mm#L1051)). Per-element writes therefore let one buffer length replace another even when Vulkan buffer handles and ranges are correct.
@@ -200,16 +228,17 @@
 - An [image table](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) whose record range overlaps a buffer or storage image written by its own dispatch faults (`table written by its dispatch`) when any entry is selected, even if the write misses the selected record. A selected column's range is its record and the bytes of the record before the descriptor.
 - An [image table](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) T# whose surface has no mapped byte faults when selected instead of becoming a zero texture as a direct T# does; what the console returns for it is not measured.
 - [User-data callees](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) - a compute shader's `s_swappc_b64` whose source pair is a user-data pair, or a copy of one made with `s_mov_b32` or `s_mov_b64` in the same block, calls the code at the address that user data holds. At dispatch the callee is read from guest memory up to its `s_setpc_b64` on the link pair, one copy of it is appended per call after the caller's last instruction, and the call is rewritten to `s_call_b64` to that copy. The words after the caller's last instruction are dropped from the recompiled code; in the shaders seen they are metadata or constants the caller reads relative to its program counter, and those reads go to the captured guest code, which linking does not change. A caller that jumps through a table among those words, which the control flow analysis reads from the recompiled code, throws. A copy runs at another program counter than the callee, so a callee that reads its program counter, makes a call, ends the program, jumps through another pair, returns before code it branches to, spans more than 64 KiB or is not readable throws. Callees are read again whenever a dispatch misses the dispatch cache; a dispatch that hits it reuses the linked program, so a title that rewrote a callee in place at the same address would keep running the old code.
-- [Table callees](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) - a compute shader's `s_swappc_b64` whose source pair is two consecutive dwords of an `s_buffer_load_dword*`, or a copy of them made with `s_mov_b32` or `s_mov_b64` in the same block (a conditional branch forward past the call between them is crossed), calls one of the targets that buffer holds when the load's buffer descriptor comes from an `s_load_dwordx4` without SOFFSET from a user-data pointer, or from a pointer pair that two `s_mov_b32` of a literal or inline constant set, and the load's SOFFSET from an `s_lshl_b32` by 2 to 24 bits. The descriptor load may be in an earlier block, such as before a per-lane loop around the call, when it is the only write of the descriptor registers that reaches the buffer load on every path back from it, and no `s_call_b64` or statically resolved call lies on those paths; the paths may run through any `s_swappc_b64` that is not resolved statically, the table call itself included, whose callee is assumed to keep the descriptor registers. The chain compares the target each iteration actually loads, so a callee that changes them can only make a later target miss the chain and fault as an unlinked call. Paths follow fall-through, direct branches and the `s_setpc_b64` jumps whose target the control flow analysis resolves. A path that reaches, before a write of the descriptor registers, the program's first instruction, the entry of an in-program function (an `s_call_b64` target, whose callers are not followed), or an instruction that nothing modelled jumps or falls into fails the search. At dispatch the descriptor and the buffer are read from guest memory, and every non-zero 64-bit value at the loaded offset plus a multiple of the shift's stride, below the descriptor's size (stride times num_records, or num_records bytes with stride 0), is read as a user-data callee and appended once per call. The call becomes a branch to a chain that compares the source pair with each target (`s_cmp_lg_u32` with a literal and `s_cbranch_scc1` per dword) and `s_call_b64`s the copy that matches; no match runs the original `s_swappc_b64` as an unlinked call. There is one chain for each value SCC has at the call, and the chain sets SCC back to that value (`s_cmp_eq_u32 0, 0` or `s_cmp_lg_u32 0, 0`) before the callee or the unlinked call runs. The searched range is the descriptor's whole size, which covers the range the load can reach whether it is checked in bytes or in strides; which one the PS5 uses for `s_buffer_load` was not measured. More than 64 distinct targets, a buffer above 64 MiB or a copy out of `s_call_b64` range throws. As with user-data callees, the buffer is read again only when a dispatch misses the dispatch cache, so a target a title adds to the buffer later is an unlinked call when a cached program runs.
+- [Table callees](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp) (libSceAgcDriver) - a compute shader's `s_swappc_b64` whose source pair is two consecutive dwords of an `s_buffer_load_dword*`, or a copy of them made with `s_mov_b32` or `s_mov_b64` in the same block (a conditional branch forward past the call between them is crossed), calls one of the targets that buffer holds when the load's buffer descriptor comes from an `s_load_dwordx4`, or a 4-dword-aligned slice of an `s_load_dwordx8` or `s_load_dwordx16`, without SOFFSET from a user-data pointer, or from a pointer pair that two `s_mov_b32` of a literal or inline constant set, and the load's SOFFSET from an `s_lshl_b32` by 2 to 24 bits. The descriptor load may be in an earlier block, such as before a per-lane loop around the call, when it is the only write of the descriptor registers that reaches the buffer load on every path back from it, and no `s_call_b64` or statically resolved call lies on those paths; the paths may run through any `s_swappc_b64` that is not resolved statically, the table call itself included, whose callee is assumed to keep the descriptor registers. The chain compares the target each iteration actually loads, so a callee that changes them can only make a later target miss the chain and fault as an unlinked call. Paths follow fall-through, direct branches and the `s_setpc_b64` jumps whose target the control flow analysis resolves. A path that reaches, before a write of the descriptor registers, the program's first instruction, the entry of an in-program function (an `s_call_b64` target, whose callers are not followed), or an instruction that nothing modelled jumps or falls into fails the search. At dispatch the descriptor and the buffer are read from guest memory, and every non-zero 64-bit value at the loaded offset plus a multiple of the shift's stride, below the descriptor's size (stride times num_records, or num_records bytes with stride 0), is read as a user-data callee and appended once per call. The call becomes a branch to a chain that compares the source pair with each target (`s_cmp_lg_u32` with a literal and `s_cbranch_scc1` per dword) and `s_call_b64`s the copy that matches; no match runs the original `s_swappc_b64` as an unlinked call. There is one chain for each value SCC has at the call, and the chain sets SCC back to that value (`s_cmp_eq_u32 0, 0` or `s_cmp_lg_u32 0, 0`) before the callee or the unlinked call runs. Each copy follows its own compares and call, so no branch spans more than one copy. A later call's branch to its chain and its return cross earlier calls' copies through a pair of `s_branch` relays before the first of those copies and after each one, so they don't span more than one copy either. The searched range is the descriptor's whole size, which covers the range the load can reach whether it is checked in bytes or in strides; which one the PS5 uses for `s_buffer_load` was not measured. More than 64 distinct targets, a buffer above 64 MiB, or a call more than 0x7fff dwords before the end of the program and its user-data callees throws. As with user-data callees, the buffer is read again only when a dispatch misses the dispatch cache, so a target a title adds to the buffer later is an unlinked call when a cached program runs.
 - [AGC FS table](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Lifecycle.cpp) (libSceAgcDriver) - the driver maps 2 MiB at 0xF_E0000000 when it is created and fills the table that libSceAgc keeps at 0xF_E0040000 (six 16-byte V# slots, slot 0 describing eight 16-byte records) the way PS5 12.00 libSceAgcDriver and libSceAgc do, but every record points at one AnyPS5 routine that only returns (`s_setpc_b64` on the link pair). Sony's routines, which order work before a title's `ds_ordered_count`, are not modeled.
 - [DB_RENDER_CONTROL resummarize draws](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - HTILE is not modeled, so a RESUMMARIZE_ENABLE draw without depth or stencil tests and without color writes changes no modeled state and draws nothing. A pure resummarize with pass-through D16/D32 depth, no depth writes or bounds test, no stencil plane, no color writes and no running pixel stage also draws nothing; other resummarize, copy or decompress draws throw.
 - [Comparison-sampled R32 float and R16 unorm textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) whose surface a storage image holds are sampled from a D32_SFLOAT or D16_UNORM image that the GPU refills from the storage image whenever its version moves, because Vulkan compares only depth formats. Only surfaces of at least 1 MiB (`APS5_DEPTH_COPY_MIN_KIB`) that are not 3D take the copy; smaller ones stay CPU snapshots compared against guest memory. With copies of small surfaces, one title hit an intermittent boot-time crash that was not explained.
 - [Null vertex buffer V#](../../../core/libs/prx/libSceAgcDriver/Graphics/include/VertexInput.hpp) (libSceAgcDriver) - a V# whose four dwords are all zero is bound to a zeroed vertex buffer of the attribute's size with stride 0, so every component of its attribute reads 0. This follows the V# fields in the [AMD RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) (`NUM_RECORDS` 0, `DST_SEL` 0 selects 0), not measured on hardware.
-- [Descriptor pool recycling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) avoids individually freed sets: [RADV 26.2.2](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/vulkan/radv_descriptor_pool.c) initializes its free-set heap with 32 bytes beyond the backing allocation. An allocation-only RX 6600 test reproduces acceptance of a 4,128-byte set in a 4,096-byte pool; the path without individual frees rejects it. Pools reset after their last set is released. A cached set can retain unused slots in an exhausted pool until eviction; peak gameplay pool memory remains unmeasured.
+- [Descriptor pool recycling](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) frees sets individually only on lavapipe: [RADV 26.2.2](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.2.2/src/amd/vulkan/radv_descriptor_pool.c) initializes its free-set heap with 32 bytes beyond the backing allocation. An allocation-only RX 6600 test reproduces acceptance of a 4,128-byte set in a 4,096-byte pool; the reset-only path rejects it. Pools reset after their last set is released. A cached set can retain unused slots in an exhausted pool until eviction; peak gameplay pool memory remains unmeasured.
 - [16-bit depth with stencil](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) is stored as `D24_UNORM_S8_UINT`, or `D32_SFLOAT_S8_UINT`, on a device without `D16_UNORM_S8_UINT` as an attachment. Depth comparisons, clears and the depth image see the wider format's precision, so results at the 16-bit quantization boundary can differ from the console; the constant depth bias is scaled by 256 for D24, and a non-zero constant on the D32 float fallback throws. Not measured on console hardware.
 - [Depth surfaces created over storage writes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth surface created without HTILE copies its depth plane from the storage image at the plane's address, a pending one first, when that image has the plane's extent, one level, a 2D view or a 2D array view (its layer 0 is copied) and a 16-bit format for a 16-bit plane or a 32-bit format for a 32-bit plane. A multisampled surface, a surface the device stores in another format, a surface with HTILE and a surface without such an image start from `DB_DEPTH_CLEAR`, and the stencil plane from `DB_STENCIL_CLEAR`; CPU writes to the plane's memory are not read. Not measured on the console, where the plane is that memory.
 - [Flip packets raise the graphics end-of-pipe event](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Packets/PacketExecution.cpp) (libSceAgcDriver) - a flip delivers the queue's end-of-pipe event (`sceAgcDriverAddEqEvent`) once the work recorded before it completes, as a `RELEASE_MEM` with `INT_SEL` does, but only on a queue that has never delivered an interrupt from such a release: the queue is latched the first time a release interrupt reaches the event queue, and flips on that queue deliver nothing while its own release interrupts keep arriving. The latch is cleared when the queue has flipped five times without another interrupt from its own releases: the fifth flip delivers the event and unlatched the queue, so a title that waits on the flip event after latching recovers only if it submits further flips. The bound cannot be by time: the next release interrupt can arrive seconds later than a suppressed flip across loading stalls, and delivering an unexpected flip event on a queue that pairs flips with releases can crash; no fixed window short enough to unblock a waiting title keeps such a title alive. Whether the console raises the event from the flip itself or from an interrupt its flip sequence contains is not measured; nor is how the console behaves for a title that waits on the flip event and also raises release interrupts on the same queue.
 - [Host import windows and budget](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): a registered range larger than 64 MiB is imported one 64 MiB window at a time for buffer and fill accesses; an access across window edges imports the cells it touches, grown to the union of the range's imports it overlaps. An address-based build (`AcquireRegistered`) imports the range whole and replaces its windows. Live imports stay under a budget: `APS5_HOST_IMPORT_MIB`, else the larger of 6 GiB and half the physical memory, at most the largest host heap less the larger of 2 GiB and half that heap (imports, type-3 mirrors and buffers and textures placed in host memory share it; on a 16 GiB machine whose host heap is half the memory, a 2 GiB reserve left too little for the rest). Where the device enables `VK_EXT_memory_budget`, that host heap's reported budget less its other usage and an eighth, in 64 MiB steps, read at most once a second, also bounds the default budget once an import's `vkAllocateMemory` has failed; a set `APS5_HOST_IMPORT_MIB` is never lowered by the report. The report's other usage includes the host-visible copies and heap mirrors that stand in for refused imports, so it grows with the refusals; the first time the report would lower the budget, `[gpu] host import budget: host heap ...` prints the heap's reported budget and usage and the live imports. An import's `vkAllocateMemory` failure within an eighth of the budget, or the third in a row, lowers the budget to the live imports until the device or the configured budget changes; an isolated failure further below only marks its range failed. Live imports are not capped by `maxMemoryAllocationCount`: NVIDIA's Windows driver reports 4096, while Village held 27,167 live imports without a failure. A new import beyond it retires the least recently used imports not used in the last 256 lookups; one that would not fit even then is refused before anything is retired, and imports made when a range is mapped never evict. A heap mirror, sparse or not, whose range has left the write watch is refreshed in full at each use, every block counted as written; a build plans its range again only once the import path takes the range. A request that may not evict (an address-based build, an import when a range is mapped) remembers a refused range or block, with the live bytes and the budget at the refusal, and is answered from that memory, still counted as refused, until live imports drop below those bytes, the budget changes or one of its ranges changes. A request that may evict remembers its refusal too, answering later requests for the same run from memory with the room the refusal left (a request whose range fits in that room steps down to a smaller block without scanning the imports again, and a refusal that stepped down is remembered for each block it tried), while no import was made or retired, the budget has not grown, the import window and the run are unchanged, and no import can have become evictable since: the use count stays below the first use at which an import that was neither evictable nor held could leave the 256-lookup protection, and either the build floor has not risen or no held import could leave it yet. A join remembers its refusal the same way, apart from other requests for the same run, so a buffer bound across refused ranges does not try the join again at every upload. The shutdown line `[gpu] host imports at shutdown` gives the live, made, refused (and remembered) and failed counts per requester. The 64 MiB window, the 256-lookup protection, the 2 GiB reserve, the eighth, the 64 MiB steps and the three failures are choices, not measured.
+- [Device-local staging](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) - a written or atomic buffer element inside a host import, including one an address-based compute build reaches through its pointers, is copied to device memory before the dispatch and copied back whole after it, so a CPU store into that range in between is rolled back.
 - [Periodic pipeline cache saves skip busy intervals](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp) (libSceAgcDriver) - the saver thread snapshots the Vulkan pipeline cache only when no pipeline creation holds it (`TryLockForSnapshot`); otherwise it skips that 10 s interval. A blocking snapshot queued behind a long creation (an NVIDIA compile of a 1.5M-word compute pipeline runs for minutes) makes the writer-preferring `shared_mutex` hold every later pipeline creation on every queue until that compile ends, which froze Yōtei's (PPSA26344) loading at frame 797-799 for the whole compile. While creations overlap without a gap, no periodic save happens, so a crash in that stretch loses the pipelines built since the last save; `SaveNow` and the teardown save still wait for the lock. How often busy stretches skip saves in practice is not measured.
 - [Registration preparation at submit](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp) (libSceAgcDriver) - `Driver::Submit` waits for every registration-time shader preparation queued before the call, not only those of the shaders the commands use, so a submission behind a long queue of unrelated preparations waits for all of them on the submitting thread. Waiting there instead of in the queue worker keeps the GPU side of a submission short: a title that sees a submission take seconds treats the GPU as hung (Goat Simulator 3, PPSA04159, then stops submitting and its garbage collector fails a 10 s timeout). On the console shaders are compiled ahead of time, so neither wait exists; how long a title tolerates a slow submit call is not known.
 - [Resource cache entries holding released textures](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - a sampled texture the texture cache drops while something else holds it, or makes without caching (`admitTexture` refusing a first use), is marked released, and `ResourceCache::Insert` refuses descriptor sets that hold one and removes the entries that do. The removal waits for the next insert: until then `Find` still returns those entries and their textures stay alive. One process-wide flag starts the sweep, so while the sampled cache is over its budget every insert scans all entries (1,024 at start, up to 16,384 after growth, or `APS5_RESOURCE_CACHE_ENTRIES`, each with its textures); that cost is not measured. When `ReleaseTextureCaches` runs on device memory exhaustion, the sampled textures these entries hold are only marked released and are freed at the next insert, so the immediate allocation retry gets no memory back from them. A draw or dispatch whose textures the cache refused builds its descriptor sets again on each use for as long as the cache stays full; the count bounds (`APS5_RESOURCE_CACHE_ENTRIES`, `APS5_RESOURCE_CACHE_TABLE_ELEMENTS`) still bound nothing by bytes, and sampled textures made outside the texture cache (the disabled cache, depth-surface copies) are never marked. Measured on one title on one RTX 4090: with the default bounds, sampled textures held outside the cache peaked at 2,836 MiB (7,830 MiB before) and device-local heap 0 stayed under its 22.9 GB budget for the whole run (26,357 MiB before, which aborted with `VK_ERROR_OUT_OF_DEVICE_MEMORY` at the wolf scene). Whether the extra descriptor-set builds cost frame time elsewhere is not measured.
@@ -230,3 +259,8 @@
 - [Depth mip levels](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - a depth view of mip `DB_DEPTH_VIEW.MIPID` in a chain of `DB_Z_INFO.MAXMIP` levels renders into that level as a surface of its own, at the level's offset and extent from `ComputeElementMipLayout` for the 64 KiB Z_X swizzle, the layout color target mips and sampled depth already use; slices of a chain step by the size of the whole chain. Taken from LEGO Builder's Journey (PPSA05496), which renders depth mip 1 of 64 KiB Z_X surfaces without HTILE; the placement was not compared with a console capture. Multisampled depth mips, other swizzle modes, levels in the packed mip tail and HTILE on a mip chain throw
 
 - [Long Windows pipeline-cache paths](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PipelineCache.cpp): `readHeader` and the failed-read existence check still use ordinary paths. A filename beyond MAX_PATH can prevent header reuse or be reported missing; the shared content reader and journal normalization do not cover these calls.
+- [DB_RENDER_CONTROL.STENCIL_CLEAR_ENABLE without a stencil plane](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): a stencil clear on a depth target whose `DB_STENCIL_INFO` format is `STENCIL_INVALID` is dropped; the depth clear and color writes proceed. AMD PAL ([`gfx9RsrcProcMgr.cpp`](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32/src/core/hw/gfxip/rpm/gfx9/gfx9RsrcProcMgr.cpp)) and radeonsi (`si_clear.c`) never set the bit without a stencil plane, and shadPS4 drops it the same way (`vk_rasterizer.cpp`, `StencilValid`). No source states what the hardware does with the bit then; the console was not measured. A read-only stencil plane still throws
+
+### Opt-in draw paths
+
+- [Draw finisher](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawPipeline.cpp) (`APS5_DRAW_PIPELINE`) - opt-in. The Linux main-image page table it adds matches what Windows already does by default.
diff --git a/docs/dev/debt/libSceAgcVsh.md b/docs/dev/debt/libSceAgcVsh.md
new file mode 100644
index 0000000000..c2fb6a18d8
--- /dev/null
+++ b/docs/dev/debt/libSceAgcVsh.md
@@ -0,0 +1,5 @@
+# libSceAgcVsh technical debt
+
+### Unknown function info
+
+- The 150 declarations in [Export.cpp](../../../core/libs/prx/libSceAgcVsh/Export.cpp) are present in the PS5 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAgcVsh.c) and the local import-stub table. Their signatures and behavior are unverified; the parameterless declarations are for import resolution only and throw through NotImplemented_nid_no_patch.
diff --git a/docs/dev/debt/libSceAjm.native.md b/docs/dev/debt/libSceAjm.native.md
index 2f7798c679..fa1c55df74 100644
--- a/docs/dev/debt/libSceAjm.native.md
+++ b/docs/dev/debt/libSceAjm.native.md
@@ -3,16 +3,16 @@
 ### Unknown function info
 
 - [sceAjmBatchGetLog, sceAjmInstanceAvailable](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjm.native) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAjm.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
-- [sceAjmInstanceExtend, sceAjmInstanceSwitch](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjm.native) - their signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/ajm/ajm.h#L19-L20) and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ajm.cs#L100-L104), not measured on a console; these throwing declarations only resolve imports.
+- [sceAjmInstanceExtend, sceAjmInstanceSwitch](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjm.native) - their four-argument signatures come only from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ajm.cs#L98-L104), whose comments do not describe them; shadPS4 [declares both without parameters](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ajm/ajm.h#L222-L223). Neither is measured on a console; these throwing declarations only resolve imports.
 - [sceAjmInstanceCreate](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - a full 14-bit instance slot namespace returns `0x80930007` (`OUT_OF_RESOURCES`), as [shadPS4's InstanceCreate](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ajm/ajm_context.cpp) does for its own instance pool (PS4). The 16384 slots per codec prefix are this runtime's existing ID layout, not a measured console capacity; the PS5 capacity and exhaustion result are unverified.
 - [ATRAC9 vibration decoding](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native): channel configurations 6 (mono) and 7 (dual mono) use the pinned [vgmstream decoder](https://github.com/vgmstream/vgmstream/blob/7c520e8f9b078dfde2f84f1b5bcbad0c6c415806/src/coding/libs/atrac9_dec.c), including its 12/24/48 kHz profile limits. Synthetic fixtures cover interleaving, reset after malformed input, partial superframes and PCM16/PCM32/float output; console PCM rounding and physical haptic output are unverified. Ordinary channel configurations and discrete multichannel streams still use LibAtrac9. Decoder creation and decoding run under the existing AJM instance lock because the dependency rebuilds shared Huffman tables during initialization.
 - [sceAjmBatchJobGetInfo](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - writes the result and format sideband of a run job without buffers with the `SIDEBAND_FORMAT` flag (0x400000000000), as [KytyPS5](https://github.com/KytyPS5/KytyPS5) does, not confirmed on a PS5 title; the format reports bitrate 0 for ATRAC9 as in KytyPS5, while [shadPS4](https://github.com/shadps4-emu/shadPS4) derives it from the superframe size; before the instance is initialized it returns the not-initialized result (1) and no format, like the other run jobs here, while KytyPS5 returns result 0 with the format of the uninitialized decoder
-- [sceAjmDecMp3ParseFrame](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - signature, result layout and rate tables taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation of the PS4 library, not confirmed on a PS5 title: the layer field is not checked and MPEG-2.5 stops at 64 kbps; the original file length (`parse_ofl`) layout (Xing/Info + LAME tag, VBRI, Fraunhofer `0xB4` block with its CRC, encoder delay = samples per frame + LAME delay + 529) also comes from shadPS4 only, and the Fraunhofer block has no other public description
-- [sceAjmBatchJobGetCodecInfo, sceAjmBatchJobGetGaplessDecode](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - the `RUN_GET_CODEC_INFO` flag (0x800), the ATRAC9 codec info layout and its next frame size are taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [RPCSX](https://github.com/RPCSX/rpcsx) reimplementations, not confirmed on a PS5 title; a run job without buffers returns result 0, as in shadPS4. The gapless sideband reports the total and skip counts the title set and does not count them down: RPCSX does the same, shadPS4 counts them down and BryKytyPS5 returns its current counts
+- [sceAjmDecMp3ParseFrame](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - signature, result layout and rate tables taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation of the PS4 library, not confirmed on a PS5 title: Layer I/II headers are accepted when no original-file-length (`parse_ofl`) lookup is requested, which is supported only for Layer III; MPEG-2.5 stops at 64 kbps. The `parse_ofl` layout (Xing/Info + LAME tag after side information, with the standard fixed Xing/Info offset retained for encoders such as [LAME](https://github.com/lameproject/lame/blob/master/libmp3lame/VbrTag.c#L854-L862), VBRI at byte 36 or after side information, Fraunhofer `0xB4` block with its CRC, encoder delay = samples per frame + LAME delay + 529) also comes from shadPS4 only, and the Fraunhofer block has no other public description.
+- [sceAjmBatchJobGetCodecInfo, sceAjmBatchJobGetGaplessDecode](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - the `RUN_GET_CODEC_INFO` flag (0x800), the ATRAC9 codec info layout and its next frame size are taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [RPCSX](https://github.com/RPCSX/rpcsx) reimplementations, not confirmed on a PS5 title (the one call in PPSA04354 passes a 24-byte result buffer, the 8-byte result plus the 16-byte ATRAC9 codec info written here; the call does not show the codec or the fields); a run job without buffers returns result 0, as in shadPS4. The gapless sideband reports the total and skip counts the title set and does not count them down: RPCSX does the same, shadPS4 counts them down and BryKytyPS5 returns its current counts
 - [AJM Opus decoder](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native, codec 24) - the initialize parameter layout and little-endian `u16` packet byte count come from The Smurfs Dreams (`2, 48000, 0`) and Lost Soul Aside (`4, 48000, 1`). The third word is interpreted as the mapping family, as in [KytyPS5's initialize structure](https://github.com/KytyPS5/KytyPS5/blob/984cfcebd141b211aa9e0a8cde63b0ebe652d07a/src/libs/ajm/opus_decoder.h#L11-L15). Family 1 uses the conventional stream counts, coupled counts and channel map from [libopus 1.5.2's surround layout](https://github.com/xiph/opus/blob/v1.5.2/src/opus_multistream_encoder.c#L47-L55), passed to FFmpeg through an [RFC 7845 section 5.1](https://datatracker.ietf.org/doc/html/rfc7845#section-5.1) header with zero pre-skip and gain; gapless skipping remains controlled by AJM sideband parameters. FFmpeg returns PCM in its native speaker order. The implicit stream layout, PCM channel order and invalid family-0 channel count result are not verified on a console. NHL 27 (PPSA34063) passes `1, 48000, 255`. Family 255 with one channel is decoded as one mono stream, the same as family 0; this is assumed, since the stream count, coupled stream count and channel mapping that a family-255 Opus header carries ([RFC 7845 section 5.1.1](https://datatracker.ietf.org/doc/html/rfc7845#section-5.1.1)) are not passed. Only 48000 Hz, mapping families 0 and 1, and family 255 with one channel are implemented; other rates and families, and family 255 with more channels, throw
 - [AJM codec 23](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - taken as interleaved `s16` PCM that only passes through the resampler, from Broken Sword - Shadow of the Templars: Reforged (PPSA21480); no source names a codec 23 ([shadPS4's PS4 header](https://github.com/shadps4-emu/shadPS4/blob/5aa7ffa3f4f21bba827d7865ed8f69f98f993542/src/core/libraries/ajm/ajm.h#L19-L25) ends its codec list with `Max = 23`) and the name `CODEC_PCM` is ours. The title decodes its Ogg Opus and Vorbis audio itself and, for every block, initializes the instance (flags 0x1002) with `0, 2, 44100`, sets the ratio 0.91875 (44100/48000) and decodes 235 stereo frames into a 256-frame output. The 12 initialize bytes are taken as input format (0 is `s16`, other values throw), channel count and sample rate; the rate is only reported in the format sideband; other sizes throw; zero or more than 8 channels or a zero rate return the invalid-parameter result as for Opus, not verified. A run consumes its whole input and emits every output frame whose position (output index × ratio) is below the input frame count, with the 4-point Catmull-Rom of the other codecs' resampler and the first and last input frames repeated past the edges, so each run restarts at position 0; `totalDecodedSamples` counts input frames; `s32` and float outputs are accepted although only `s16` was seen. Throwing because the console's behaviour is unknown: a run after a resampled run without an initialize or context clear in between (whether the console carries the resampler position across runs), a ratio change per sample, gapless counts, an empty input or one that is not a whole number of frames, an output that cannot hold the resampled input, run flags other than `SIDEBAND_STREAM` and initialization through `sceAjmBatchJobControl`
-- [sceAjmBatchJobSetResampleParametersEx](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - the `(info, instance, float ratio_start, float ratio_change_per_sample, flags, result)` signature is inferred from the name and from `sceAjmBatchJobSetResampleParameters`; with a zero change per sample it sets the ratio as `sceAjmBatchJobSetResampleParameters` does (Watch Dogs: Legion, PPSA01500, calls it so). How a non-zero change ramps the ratio is not confirmed on a console (no source: KytyPS5 ignores it, prosper stubs it, the PS5 firmware does not export the batch builders to a payload): it is assumed to be added to the ratio after each emitted output frame, clamped at zero, and kept across batches. RIDE 4 (PPSA01599) passes one call with a change of 4.6e-7, so the exact rule matters little there.
-- [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - RESET (bit 13), INITIALIZE (bit 14) and the sideband input order (gapless decode, then initialize parameters) come from [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4); other flags throw
+- [sceAjmBatchJobSetResampleParametersEx](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - the `(info, instance, float ratio_start, float ratio_change_per_sample, flags, result)` signature is inferred from the name and from `sceAjmBatchJobSetResampleParameters`, and PPSA02225's one call agrees with that layout (`rdi`, `esi`, `xmm0` and `xmm1` as two single floats, `edx`, `rcx`) without showing `flags` or the float roles. With a zero change per sample it sets the ratio as `sceAjmBatchJobSetResampleParameters` does (Watch Dogs: Legion, PPSA01500, calls it so). How a non-zero change ramps the ratio is not confirmed on a console (no source: KytyPS5 ignores it, prosper stubs it, the PS5 firmware does not export the batch builders to a payload): it is assumed to be added to the ratio after each emitted output frame, clamped at zero, and kept across batches. RIDE 4 (PPSA01599) passes one call with a change of 4.6e-7, so the exact rule matters little there.
+- [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - RESET (bit 13), INITIALIZE (bit 14) and the sideband input order (gapless decode, then initialize parameters) come from [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4); the one call in PPSA25936 passes the flags 0x4000 (bit 14 only), an 8-byte input and an 8-byte output, which agrees with INITIALIZE alone and the 8-byte parameters, without showing the codec or the meaning of the words; other flags throw
 - [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - RESET is assumed to clear the context as sceAjmBatchJobClearContext does
 - [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - initialize parameters are 8 bytes for ATRAC9 and M4AAC, 12 for Opus and none for MP3, as one title passes them; other codecs and sizes, and an output other than the 8-byte result, throw
 - [sceAjmBatchJobControl](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - SIDEBAND_GAPLESS_DECODE with RESET overwrites both counts as in [RPCSX](https://github.com/RPCSX/rpcsx); shadPS4 ignores a zero count when the other is nonzero. Without RESET they differ, so it throws
@@ -20,9 +20,9 @@
 
 ### Functional
 
+- [sceAjmDecWVorbisCreateHeaderPacket](../../../core/libs/prx/libSceAjm.native/Export.cpp) (libSceAjmWVorbis, implemented in libSceAjm.native) - refuses an output smaller than the whole packet (56 bytes plus the setup packet) with `0x8A6E0003`. The PS5 12.00 bit writer only checks that each write starts inside the buffer, so the console can accept a buffer a few bytes short and write past it
 - [AJM batch contexts](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native): start, wait and cancel reject context IDs not allocated by initialization; batches belong to their creating context, as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0ebea15c24253b60f514fc37a348dabc8d0bcb90/src/core/libraries/ajm/ajm.cpp). This is not verified on PS5. Finalization still does not invalidate contexts or release their instances and outstanding batches; jobs execute synchronously and cancellation does not interrupt them.
 
-- [sceAjmDecMp3ParseFrame](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) throws when the original file length is requested (`parse_ofl` non-zero) for a layer other than III, for a CRC-protected frame, or for a VBRI header outside MPEG-1 stereo: shadPS4 looks for the tag after the CRC and after the side information, while LAME and FFmpeg place it without the CRC and VBRI always at byte 36.
 - [ATRAC9 gapless segments](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native) - a run job stops after the gapless total of output samples counted from the start of the segment, leaving the rest of its input unconsumed, and the next run starts the next segment with the decoder as it is and without a second skip. FMOD in PPSA29141 sets a total shorter than a sound's frames and reads the frames after it on later runs; with the output held at the total its stream reader waited for them forever and the last buffer repeated. The console's handling of the frames after the total is not documented; a reset (`SetGaplessDecode` with the reset flag, `ClearContext`, initialization) starts a new segment. An ATRAC9 run job without `RUN_MULTIPLE_FRAMES` decodes its whole input as one with it: FMOD in PPSA29141 puts two run jobs in one batch with the second's input right after the whole of the first's. Whether the console stops after one frame there is not verified; MP3 and Opus run jobs still stop after one frame
 - [AJM M4AAC decoder](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp) (libSceAjm.native, codec 2) - Ghost of Yotei (PPSA26344) initializes it through `sceAjmBatchJobControl`. The initialize parameters (`u32` config type, 1 ADTS or 2 raw, then `u32` sampling frequency index), instance flags (channels in bits 3-6, `ENABLE_SBR_DECODE` bit 32, `ENABLE_NONDELAY_OUTPUT` bit 33, surround interleave order bits 34-35), `{heaac, reserved}` codec info and decoder error result (`CODEC_ERROR | FATAL`) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/443f022450f6857256e780daa3d5a14029a748f7/src/core/libraries/ajm/ajm_aac.cpp) (PS4, fdk-aac) and are unverified on PS5; decoding uses FFmpeg's AAC decoder. Without `ENABLE_NONDELAY_OUTPUT`, the first two frames after initialization or reset are consumed without output. Raw input takes its channel configuration from the instance (0 means stereo) and is decoded as one access unit per run job. The format reports the last frame's bitrate. Invalid config type or raw sampling frequency index above 11 returns invalid-parameter result 4. The implementation throws for ADTS without a frame header, profiles other than AAC LC, multiple raw data blocks per ADTS frame, unsupported channel configurations, more channels than the instance supports, HE-AAC without `ENABLE_SBR_DECODE`, raw input with `RUN_MULTIPLE_FRAMES`, output room smaller than the previous frame length, and unknown codec flags.
 - [AJM](../../../core/libs/prx/libSceAjm.native/src/Ajm.cpp), [APR](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) and [NGS2](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) state is allocated with `new` and never freed on purpose: title threads still call into these libraries while `std::exit` runs static destructors, so ordinary statics would be destroyed under them. Keep them leaked; `guest_ajm_teardown` covers the AJM case on Unix.
diff --git a/docs/dev/debt/libSceAppContent.md b/docs/dev/debt/libSceAppContent.md
index 371a027f51..1780d0bde0 100644
--- a/docs/dev/debt/libSceAppContent.md
+++ b/docs/dev/debt/libSceAppContent.md
@@ -2,14 +2,14 @@
 
 ### Unknown function info
 
-- [sceAppContentDownloadDataGetAvailableSpaceKb](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - a title whose `param.json` declares `downloadDataSize` 0 gets 0 KB and OK; the console's behaviour for a title without a download data area is unverified (it may return an error instead). KytyPS5 does not special-case it, and shadPS4 stubs 1048576 KB
+- [sceAppContentDownloadDataGetAvailableSpaceKb](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - a title whose `param.json` declares `downloadDataSize` 0 gets 0 KB and OK; the console's behaviour for a title without a download data area is unverified (it may return an error instead). KytyPS5 does not special-case it, and shadPS4 stubs 1048576 KB. One disassembled title (PPSA15246) calls it with the `/download0` mount point and a zeroed 64-bit output, ignores the return value and multiplies the output by 1024, so for that title an error that leaves the output untouched and an OK with 0 KB look the same
 - [sceAppContentDownloadDataFormat](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) - empties the `/download0` directory, creating it if needed. Imported by PPSA01317. A null mount point returns `PARAMETER` and another mount point returns `NOT_MOUNTED` as in `sceAppContentTemporaryDataFormat` and `sceAppContentDownloadDataGetAvailableSpaceKb`; the console's error codes for both and its behaviour with files still open are unverified
 
 
-- [libSceAppContent pending exports](../../../core/libs/prx/libSceAppContent/Export.cpp) - 17 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAppContent.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceAppContent pending exports](../../../core/libs/prx/libSceAppContent/Export.cpp) - 16 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceAppContent.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
 ### Functional
 
 - [Initialization](../../../core/libs/prx/libSceAppContent/Export.cpp) - service readiness and boot attributes are not modeled; successful initialization returns a zero boot record. Initialization-state guards, SDK 0x01500000 repeated-initialization errors and reserved-field checks are recovered. SDK-dependent service-error translation remains incomplete.
 
 - [Additional content](../../../core/libs/prx/libSceAppContent/Export.cpp) (libSceAppContent) is not installed or mounted: `sceAppContentAddcontMount` answers `NOT_FOUND` for every entitlement label and `sceAppContentAddcontUnmount` for every mount point, as no add-content mount is ever handed out; `sceAppContentGetAddcontInfo` answers `DRM_NO_ENTITLEMENT` for every label and `sceAppContentGetAddcontInfoList` reports 0 entries; `sceAppContentAddcontEnqueueDownload` answers `PARAMETER` for a null label and `NOT_FOUND` otherwise, since no download is ever queued; `sceAppContentAddcontDelete` answers `PARAMETER` for a null label and `NOT_FOUND` otherwise, since no additional content is ever installed. `sceAppContentGetAddcontDownloadProgress` answers `PARAMETER` for a null label or progress and `NOT_FOUND` otherwise, as [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.cpp#L2328-L2341) does for a label that is not installed additional content, and never writes the progress. Its 16-byte layout (`DataSize`, then `DownloadedSize`, both 64-bit) follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/AppContent/AppContent.cs#L45-L54) and is unused here. The signatures of `sceAppContentAddcontEnqueueDownload` and `sceAppContentGetAddcontDownloadProgress` follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/AppContent/AppContent.cs#L140-L148), and the signature of `sceAppContentAddcontDelete` follows [dlc_emu](https://github.com/drakmor/dlc_emu/blob/fcf69b16d46a9850578bce19dc2c1b4dc867cbb5/src/dlc_modules/dlc_content.h#L91-L92); dlc_emu is not a console measurement and no console source gives the error codes, so the signatures and the error codes are unverified
-- [Temporary app-content storage](../../../core/libs/prx/libSceAppContent/Export.cpp) tracks one `/temp0` mount, preserves its files on unmount, and rejects new path resolutions until remount. Mount, format, space-query and unmount errors follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_path.pas); the pointer ABI is also declared by [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/AppContent/AppContent.cs). Existing open host descriptors remain usable after unmount; console behaviour with open files is unverified. Host filesystem failures still throw.
+- [Temporary app-content storage](../../../core/libs/prx/libSceAppContent/Export.cpp) console behaviour and hardware return values are unverified, including behaviour with open files across unmount; host filesystem failures throw. Storage models one `/temp0` mount, preserving files on unmount while rejecting new path resolutions until remount, and leaving existing open host descriptors usable. `sceAppContentTemporaryDataMount` delegates to `sceAppContentTemporaryDataMount2` with option 1 (`TEMPORARY_DATA_OPTION_FORMAT`) to format on mount as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/app_content/app_content.cpp#L550-L553) does. Mount, format, space-query and unmount errors follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_path.pas); pointer ABI follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/AppContent/AppContent.cs).
diff --git a/docs/dev/debt/libSceAppInstUtil.md b/docs/dev/debt/libSceAppInstUtil.md
index 92d88fb4a6..28ed171a11 100644
--- a/docs/dev/debt/libSceAppInstUtil.md
+++ b/docs/dev/debt/libSceAppInstUtil.md
@@ -5,3 +5,101 @@
 - [sceAppInstUtilAppInstallPkg](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) - the package path is followed by an opaque 64-bit value sent to the install service; its meaning and pointer-versus-integer type remain unresolved.
 - [sceAppInstUtilGetInstallProgressInfo, sceAppInstUtilGetInstallProgress and sceAppInstUtilGetPrimaryAppSlot](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) - take a title-id string and an output pointer. The IPC replies contain 48, 4 and 4 bytes respectively; callers and reply producers are needed to establish the field types.
 - [sceAppInstUtilAppPrepareOverwritePkg, sceAppInstUtilAppRecoverApp and sceAppInstUtilAppUnInstallTheme](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) - absent from the supplied system module and from the supplied decompiled callers; the old export inventory establishes names but not prototypes.
+- [sceAppInstUtilAppGetAppInstallStatusByAppInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstall2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstallForRemote](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstallForRemote2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontListTotalSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontInfoByContentId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddcontInstalledStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetInsertedDiscTitleId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUpdateStartTime](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallSharePlayLink](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallSharePlayLinkByUser](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAddcontNum](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelUnInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppDestroyMetadata](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCheckAppSystemVer](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppConvertAppDownloadToDisc](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetMainAppTitleIdForSP](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetSubAppTitleIdForSP](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetMainAppTitleId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetSubAppTitleId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAppInstallStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppDestroyPkg](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilJson](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInsertedDiscRoleType](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRequestInstallDiscGame](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRequestDataDiscCopy](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelDataDiscCopy](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetDataDiscCopyProgress](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilSetPrimaryAppSlot](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAppSlotInfoList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAppEmptySlot](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallGetLinkState](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppUnInstallForMultiInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallPs4CloudGame](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppStoreCompilationDiscInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetCompilationDiscInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetStoreCompilationDiscInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetInsertedDiscTitleIdList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallRequestCompilationDiscApp](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetNoRelatedAddcontTitleList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetIrremovableAppList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppRequestMoveApps](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppProhibitDownloadInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppAllowDownloadInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAppMoveProgressInfo](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelMoveApps](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetMoveErrorAppList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAllAppSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelGetAllAppSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetInsertedDiscMasterDataId](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetAppOtherSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppCancelGetAppOtherSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInsertedDiscTotal](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppSetRemasterInstallType](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInstallProgressInfoForMultiDisc](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilMountBdEmu](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilUnmountBdEmu](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInstallStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilResumeInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilPauseInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRegisterDownload](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilStartInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstallPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetPatchInstallStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilResumePatchInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilPausePatchInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelInstallPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelInstallAddcont](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelForMultiInstall](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstallByPackage](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilIsRestoreState](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetRestoreState](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddons](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetInstallOptions](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetContentSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelGetInformation](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetWorkspaceStatus](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilDeleteWorkspace](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetParentalControlLevel](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCheckLatestPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilCancelCheckPatch](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallPsNowIcon](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddcontInfoList2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAddcontInfoList3](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilClearAddcontInfoCache](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetContentSize2](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppInstallContentPush](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetAvailableStorage](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilSwitchInstallLocation](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetConfigList](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilSwitchConfig](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilRestoreDataSource](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilGetNeededStorageSize](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilAppGetStorageDestType](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
+- [sceAppInstUtilInstallAddons](../../../core/libs/prx/libSceAppInstUtil/Export.cpp) (libSceAppInstUtil) - unknown signature
diff --git a/docs/dev/debt/libSceAudio3d.md b/docs/dev/debt/libSceAudio3d.md
index e83c9da9a2..9c17a838c6 100644
--- a/docs/dev/debt/libSceAudio3d.md
+++ b/docs/dev/debt/libSceAudio3d.md
@@ -20,11 +20,7 @@
 - [sceAudio3dPortGetStatus](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
 - [sceAudio3dReportRegisterHandler](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
 - [sceAudio3dReportUnregisterHandler](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
-- [sceAudio3dGetSpeakerArrayMemorySize](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
-- [sceAudio3dCreateSpeakerArray](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
-- [sceAudio3dDeleteSpeakerArray](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
-- [sceAudio3dGetSpeakerArrayMixCoefficients](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
-- [sceAudio3dGetSpeakerArrayMixCoefficients2](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - unknown signature
+- [sceAudio3dCreateSpeakerArray](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - the speaker-array calls return the AudioOut2 result unchanged: the console translates AudioOut2 speaker-array errors into Audio3d codes, but this project's AudioOut2 speaker-array calls throw instead of returning error codes, so there is nothing to translate yet
 - [Audio3d bed downmix coefficients](../../../core/libs/prx/libSceAudio3d/Mixer.hpp) (libSceAudio3d) - the centre and the surrounds fold into stereo with a 0.7071 gain and the LFE channel is dropped, which follows [shadPS4](https://github.com/shadps4-emu/shadPS4) (PS4): its `DOWNMIX_CENTER` and `DOWNMIX_SURROUND` are 0.7071 and its `DOWNMIX_LFE` is 0, so the `if constexpr` that adds the LFE is compiled out. [prosper](https://github.com/mattias800/prosper) disagrees on the LFE only: it folds it into both sides with a 0.5 gain, in its AudioOut2 main bed path, which is not an Audio3d path. KytyPS5 has no Audio3d mixing at all. The absolute level is unmeasured: fpPS4 scales the front by 1 + 3/sqrt(2) instead of 1
 - [Audio3d bed channel order](../../../core/libs/prx/libSceAudio3d/Mixer.hpp) (libSceAudio3d) - the buffer is read as L, R, C, LFE, Ls, Rs, Lrs, Rrs, the standard order, which three references agree on: [shadPS4](https://github.com/shadps4-emu/shadPS4) reads the front, centre, LFE and surround samples at those indices, [prosper](https://github.com/mattias800/prosper) documents FL, FR, FC, LFE and then surround pairs, and fpPS4 names them `_FL=0 _FR=1 _FC=2 _LF=3 _SL=4 _SR=5 _BL=6 _BR=7`. fpPS4's `STD` layout swaps the side and back pairs, which this library does not model
 - [sceAudio3dAudioOutOutput](../../../core/libs/prx/libSceAudio3d/Export.cpp) (libSceAudio3d) - the return is the number of frames per channel in the queued block, which follows [KytyPS5](https://github.com/KytyPS5/KytyPS5) and [prosper](https://github.com/mattias800/prosper), whose `sceAudioOutOutput` returns the grain, and this project's own `sceAudioOutOutput`, which returns the port's `samplesNum` (the buffer length in frames). [shadPS4](https://github.com/shadps4-emu/shadPS4) returns the total samples instead (`len * channels`) and fpPS4 returns 0; no console measurement settles it
diff --git a/docs/dev/debt/libSceAudioIn.md b/docs/dev/debt/libSceAudioIn.md
index 5f2f688821..abb06131ee 100644
--- a/docs/dev/debt/libSceAudioIn.md
+++ b/docs/dev/debt/libSceAudioIn.md
@@ -6,7 +6,6 @@
 
 ### Unknown function info
 
-- [sceAudioInIsPadEmbeddedMic](../../../core/libs/prx/libSceAudioIn/Export.cpp) - the PS5 module uses the low handle byte as a port index and returns whether its resolved device type equals 8, propagating negative device errors. Host capture devices have no corresponding controller-microphone classification; the protected throwing body remains unchanged.
 - [sceAudioInDeviceIdOpen](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInDeviceIdAsyncOpen](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInSetUsbGain](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
@@ -17,14 +16,12 @@
 - [sceAudioInSetPortConnections](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInSetPortStatuses](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInGetHandleStatusInfo](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
-- [sceAudioInOpenEx](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
-- [sceAudioInHqOpenEx](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInDeviceOpenEx](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInChangeAppModuleState](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInSetSparkParam](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInSetSparkSideTone](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
-- [sceAudioInSetCompressorPreGain](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
-- [sceAudioInSetNoiseGateThreshold](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
+- [sceAudioInSetCompressorPreGain](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature; the PS5 12.00 module returns 0 without reading any argument, and so does this one
+- [sceAudioInSetNoiseGateThreshold](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature; the PS5 12.00 module returns 0 without reading any argument, and so does this one
 - [sceAudioInSetMicLevel](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInSetDeviceMuteStatus](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
 - [sceAudioInSetDevConnection](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - unknown signature
@@ -42,5 +39,6 @@
 
 ### Functional
 
+- [sceAudioInIsPadEmbeddedMic](../../../core/libs/prx/libSceAudioIn/Export.cpp) (libSceAudioIn) - returns 0 for every open port: on the console it returns 1 when the port captures from the controller's built-in microphone and 0 for another input device, but ports here capture from the host's default input device
 - [sceAudioInHqOpen, sceAudioInAsyncOpen](../../../core/libs/prx/libSceAudioIn/Export.cpp) - PS5 wrapper validation requires 48000 Hz followed by exactly 128 samples for both calls; HqOpen then requires format 2. The host uses the same SDL capture path for both, so native asynchronous scheduling and high-quality processing are not reproduced. Common port validation, device selection and host capture pacing remain incomplete.
 - [sceAudioInGetGain, sceAudioInGetRerouteCount](../../../core/libs/prx/libSceAudioIn/Export.cpp) - GetGain writes 1.0f before handle validation and returns 0x80260105 for a null output, as confirmed by the PS5 module. Native handle bit checks and uninitialized/inactive port errors differ from the host port table. Native reroute counters follow device reassignment; the host opens each SDL device once and reports zero.
diff --git a/docs/dev/debt/libSceAudioOut.md b/docs/dev/debt/libSceAudioOut.md
index 792d6e1a9e..edab686a12 100644
--- a/docs/dev/debt/libSceAudioOut.md
+++ b/docs/dev/debt/libSceAudioOut.md
@@ -1,5 +1,10 @@
 # libSceAudioOut technical debt
 
+### Silent stubs
+
+- [sceAudioOut2LoTerminate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Low.cpp) (libSceAudioOut) - returns 0, as the PS5 12.00 module (0x248d0) does whether or not the low-latency service runs. The module disconnects from the audio server and clears the service tables; here `sceAudioOut2LoInit` starts no service and open contexts and ports are left as they are
+- [sceAudioOutMasteringTerm](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - returns 0 without doing anything: there is no mastering stage to tear down, and `sceAudioOutMasteringInit` keeps no state. Whether the console fails a Term without a matching Init is unknown
+
 ### Unknown function info
 
 - [sceAudioOut2ContextAdvance and sceAudioOut2ContextPush](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp) (libSceAudioOut) - with an SDL device, Advance snapshots each port's PCM and gain; Push consumes completed grains in order and a blocking Push waits for Advance when none is ready. Inferred from PPSA26358, which rewrites the same 512-frame, 12-channel float buffer on a producer thread and pushes on another thread. Console buffer ownership, snapshot timing and empty-queue errors are unverified. Completed grains remain queued until Push consumes them, so memory use grows with an unconsumed PCM backlog. The console backlog limit is unverified. A nonblocking Push without a completed grain throws; this is a runtime restriction, not a console measurement. Context destruction concurrent with active calls remains unsupported. Without an SDL device the existing wall-clock path remains.
@@ -8,12 +13,13 @@
 - [sceAudioOutExOpen, sceAudioOutExConfigureOutput, sceAudioOutExClose](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the HDMI bitstream calls follow [PS5-Audio-Passthrough-Research](https://github.com/sainsaji/PS5-Audio-Passthrough-Research/blob/cf3c921d79bf00db4847f31b68a7bd95a8037cd7/docs/FINDINGS.md#L31-L80), which disassembles firmware 12.70's libSceAudioOut and logs the calls on a console. `sceAudioOutExOpen(user, mode)` returns `0x80260015` for a mode above 10 or outside mask `0x61F`; otherwise it opens a port of internal type 6 in S16 stereo, 256 frames at 48000 Hz for modes 0, 1, 2 and 9 and 1024 frames at 192000 Hz for modes 3, 4 and 10. `sceAudioOutExConfigureOutput(control, flags, mode, target, option)` returns `0x80268009` when `control` is not 0, takes modes 0 to 10 and 0xFF and targets 1 to 3 and 0xFF, and returned 0 on the console; `sceAudioOutExClose` returned 0. The argument registers match [Jelly5](https://github.com/02dnot/Jelly5/blob/552b866d89b2a58b27f7f7b0484dc743ce235526/app/src/jelly5_bitstream.cpp#L26-L28) and PPSA99051's [bitstream_out.cpp](https://github.com/sainsaji/PS5-Audio-Passthrough-Research/blob/cf3c921d79bf00db4847f31b68a7bd95a8037cd7/sample-app/src/platform/ps5/bitstream_out.cpp#L29-L32). Audio reaches the host through SDL as PCM and the host has no HDMI bitstream output, so an Ex port has no host device: `sceAudioOutOutput` paces it at its own rate and drops its IEC 61937 bursts, and `sceAudioOutExConfigureOutput` changes nothing. Nonzero `flags` or `option`, other modes or targets, `sceAudioOutExClose` of a handle that is not an Ex port, and `sceAudioOutGetPortState` on an Ex port throw, since the console's answers are unknown
 - [sceAudioOutExGetMonitorInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) - native validation requires first argument zero, a non-null buffer and exactly 1024 bytes, in that order (errors 0x80260003/04/06); the second argument is ignored. The host still reports no audio descriptors by zeroing the record. Native content comes from monitor/device services and system audio configuration, which the SDL backend does not reproduce.
 - [sceAudioOut2Set3DLatency](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - the two 32-bit arguments and selector validation match the system library: selector 0 accepts outputs 0 through 2; selector 255 accepts outputs 1 and 2. No third latency argument exists. The host has no system 3D rendering stage, so the call still does not apply latency and does not reproduce the system initialization and output-availability checks.
-- [sceAudioOut2MasteringInit](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) - native initialization requires AudioOut2 initialization (0x80268006 otherwise), returns success immediately when already initialized, and otherwise rejects nonzero flags with 0x80268201. Term returns 0x80268203 without mastering initialization and clears the mastering state after a successful service call. The protected Init body remains unchanged; host Term still returns success without this lifecycle or native mastering allocations.
-- [sceAudioOut2MasteringGetState and sceAudioOut2MasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the state layout, the states ids 1 (default) and 2 (V2), the descriptor ids `0x01010001`, `0x01020001` and `0x01010003` and the errors `0x80268201` and `0x80268204` follow [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp), not a console measurement. GetState zeroes the states and writes the two descriptors; with no mastering stage the compressor and limiter values stay zero. SetParam accepts any parameter set and records nothing, as KytyPS5 does; a null parameter returns `0x80268201`, the mastering invalid-API-parameter error KytyPS5 returns for a null state, which is an inference rather than a measurement. The meaning of `output` and `user` is unknown and both are ignored
-- [sceAudioOut2SetSystemDebugState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - records the debug state id in the trace and returns 0, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) does; the host has no system mix to apply it to. The debug state ids are unknown, so every id is accepted, and a null param returns `0x80260502` like the other AudioOut2 calls. Not measured on a console
+- [sceAudioOut2MasteringInit and sceAudioOut2MasteringInitEx](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the initialized flag and the flag checks follow the PS5 12.00 module (0x22360): a repeated initialization returns 0, other flags return `0x80268201`, and InitEx also accepts bit 31, which the console passes to the audio server as a mastering mode. Nothing is sent to an audio server, and `sceAudioOut2MasteringInit` does not return the `0x80268006` the console returns before `sceAudioOut2Initialize`, which is a missing state check of its own. PPSA01289 calls Init twice before Term twice; by the module its second Term gets `0x80268203`, and the title only logs a non-zero result
+- [sceAudioOut2MasteringGetState and sceAudioOut2MasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the state layout, the states ids 1 (default) and 2 (V2), the descriptor ids `0x01010001`, `0x01020001` and `0x01010003` and the error `0x80268204` follow [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp), not a console measurement. GetState zeroes the states and writes the two descriptors; with no mastering stage the compressor and limiter values stay zero. SetParam accepts any parameter set and records nothing, as KytyPS5 does. The checks before them follow the PS5 12.00 module: both return `0x80268203` before mastering is initialized, GetState returns `0x8026800C` for a null state, SetParam returns `0x80268201` for a null parameter and `0x80268205` for flags above 1. The console's checks of `output` and `user` are not reproduced; both are ignored
+- [sceAudioOut2SetSystemDebugState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - records the debug state id in the trace and returns 0, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) does; the host has no system mix to apply it to. Id `0x20` with a 4-byte param throws, and the not-initialized error is not returned. Not measured on a console
 - [sceAudioOut2GetSpeakerArrayCoefficients](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - validates the handle and the coefficient count like the ambisonics call, then writes the front pair at full gain and silence for every other speaker, ignoring the position, spread, height awareness and downmix spread radius: [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/libAudio2.cpp) and [prosper](https://github.com/mattias800/prosper/blob/main/prosper/src/hle/audio/hle_audio.cpp) both return that pair. The console's VBAP gains over the array's directions are not measured
 - [sceAudioOutSetMixLevelPadSpk](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - no source applies the level (shadPS4 only stores it); it is assumed to be a linear gain on the port's own output, and the -9 dB default (11626) is applied to every pad speaker port, including those of titles that never call the function
 - [sceAudioOutGetLastOutputTime](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - signature and behaviour taken from the [shadPS4](https://github.com/shadps4-emu/shadPS4) and [fpPS4](https://github.com/red-prig/fpPS4) reimplementations of the PS4 library, not confirmed on a PS5 title: the time is the process time at which `sceAudioOutOutput` or `sceAudioOutOutputs` accepted the port's last block, not the time the block reached the device
+- [sceAudioOutGetSystemState](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the 32-byte layout (`float loudness`, 4 reserved bytes, 3 reserved 64-bit words) follows shadPS4's `OrbisAudioOutSystemState` and SharpProspero's `SceAudioOutSystemState` (`Size = 32`); it is not confirmed on a console. Loudness is reported as a constant 0.0f, although SharpProspero documents it in LKFS, so the value is unconfirmed. shadPS4 returns NOT_INIT before `sceAudioOutInit`; that check is not modelled. Imported by PPSA30528, which fails to load without it
 - [sceAudioOutSysOpen, sceAudioOutSysConfigureOutput, sceAudioOutSysClose](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - imported by PPSA99051 and PPSA99997, which fail to load without them; the signatures follow [EVO-PLAYER-PS5](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/da0c0451333bab82e79fffd2de4718e917f9dcb0/projects/evoplayer/core/src/audio/evo_pt.cpp#L24-L29), whose audio code both titles share, and are not confirmed on a console. `sceAudioOutSysOpen(user, mode)` opens a port only for mode 5, the TrueHD MAT route: [the same project's carrier table](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/da0c0451333bab82e79fffd2de4718e917f9dcb0/projects/evoplayer/core/src/audio/iec61937.cpp#L125-L140), read from sceAudioOutExOpen's own tables in firmware 12.70, describes it as a 768 kHz port of 1024 S16 8-channel frames whose 16-byte frames are consumed at 192 kHz; every other mode throws. Audio reaches the host through SDL as PCM and the host has no HDMI bitstream output, so like an Ex port a Sys port has no host device: `sceAudioOutOutput` paces it at its own rate and drops the MAT bursts. `sceAudioOutSysConfigureOutput(type, flags, mode, target, option)` accepts only the observed `(1, 0, 5, 1, 0)` HDMI MAT switch and changes nothing; other arguments throw. `sceAudioOutSysClose` closes a Sys port and throws for any other handle. The restore path EVO-PLAYER-PS5 takes after a Sys port calls `sceAudioOutExConfigureOutput(0, 0, 0xFF, 0xFF, 0)`, so no Sys reset combination is known
 - [sceAudioOut2PortCreate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - MAIN (type 0) format validation follows PS5 firmware 13.60 measurements: bits 8-11 accept 1, 2, 8 or 12, bits 0-6 accept 0 or 1, bit 7 requires 8 channels, and bits 12-31 do not affect validation. The sample types are still read as float and int16; bit 7's layout, the PCM effect of bits 12-31 and the port `flags` are unverified. Other port types retain unverified format validation, including 6 channels and rejection of bits 12-31
 - [sceAudioOut2PortCreate](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - 12 channels are assumed to be L R C LFE Ls Rs Lb Rb Ltf Rtf Ltb Rtb as in KytyPS5's 12-to-8 fold, and 6 and 8 channels to be its first 6 and 8; no title or SDK header confirms the order
@@ -22,7 +28,10 @@
 - [Legacy vibration ports](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp): PPSA99902's [public input wrapper](https://github.com/Nazky/UnleashedRecomp-Prospero/blob/2ce067a1d51bb58670c7ee4a3aed893c504da805/UnleashedRecomp/hid/driver/sdl_hid.cpp#L316) opens type 10 with 256 stereo S16 or F32 frames at 48000 Hz. Mono duplicates its channel as AudioOut2 does; wider vibration layouts throw. Native controller output uses AudioOut2's four-channel layout, or its six-channel PulseAudio mapping. Without a controller sound card the existing RMS motor transform is applied to segments of at most 256 frames, scheduled by the legacy queue's frame count and rate; drain and close remove only that port's segments. Concurrent sources combine by the maximum per motor, and the pad consumer uses this approximation only for controllers other than DualSense. This host timing and motor model is not a console measurement or waveform reproduction; legacy native output is unmeasured on hardware, and user routing retains the single-controller limitation. AudioOut2 retains its separate 80 ms peak hold.
 
 - [sceAudioOutDeviceIdOpen](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - the native wrapper consumes a 64-bit device ID, port type, sample count, frequency and format from argument slots 1, 2, 4, 5 and 6. Slot 3 is discarded, with the common open API index position preserved. Device enumeration and mapping to host outputs remain unimplemented; the throwing body is unchanged.
-- [sceAudioOut2PortGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) and [sceAudioOut2GetSpeakerInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - the port state reports the channel count of the port's data format, output main, volume 127 and a zero reroute counter and flags. Taking the channel count from the data format follows [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/Audio/AudioOut2Exports.cs), another emulator. A payload process on a PS5 (firmware 13.60), which is not the foreground application, read output 0, volume -1 and reroute counter 5 for its main ports, and 6 channels for an 8-channel port on a 5.1 system, so a title's values are unverified, including the output of a pad port, the volume after `sceAudioOut2PortSetAttributes` and the reroute counter on a device change. The speaker info reports type 0 with available bits `0x3`, the front left speaker at +30 degrees and the front right one at -30, and -360 for the azimuth and elevation of every other slot. On that console the type followed the HDMI device type and the available bits its channels: type 0 with the device set to TV, 1 to AV amplifier and 2 to sound bar, which [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut2.cs) names television, AV receiver and sound bar (3 is headphones there), and available bits `0x3` for 2 channels and `0x3F` for 5.1 (centre at 0, surround pair at +110 and -110, -360 for the LFE). The front pair and the empty slots read the same in every setting; 7.1 on the AV amplifier reported 2 channels on that console's HDMI chain. The host output is always reported as a stereo television here. The console also returns `0x80268006` before `sceAudioOut2Initialize`, `0x80268001` for flags above 1 and `0x8026800C` for a null pointer, which are not modelled. ASTRO BOT and ASTRO's PLAYROOM reportedly stop on an assertion that depends on these values (#4317), but which field matters has not been isolated
+- [sceAudioOut2PortGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Port.cpp) (libSceAudioOut) - the port state reports the channel count of the port's data format, output main, volume 127 and a zero reroute counter and flags. Taking the channel count from the data format follows [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/Audio/AudioOut2Exports.cs), another emulator. A payload process on a PS5 (firmware 13.60), which is not the foreground application, read output 0, volume -1 and reroute counter 5 for its main ports, and 6 channels for an 8-channel port on a 5.1 system, so a title's values are unverified, including the output of a pad port, the volume after `sceAudioOut2PortSetAttributes` and the reroute counter on a device change.
+- [sceAudioOut2GetSpeakerInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - The speaker info reports type 0 with available bits `0x3`, the front left speaker at +30 degrees and the front right one at -30, and -360 for the azimuth and elevation of every other slot. On that console the type followed the HDMI device type and the available bits its channels: type 0 with the device set to TV, 1 to AV amplifier and 2 to sound bar, which [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut2.cs) names television, AV receiver and sound bar (3 is headphones there), and available bits `0x3` for 2 channels and `0x3F` for 5.1 (centre at 0, surround pair at +110 and -110, -360 for the LFE).
+- [sceAudioOut2GetSpeakerInfo](../../../core/libs/prx/libSceAudioOut/src/AudioOut2SpeakerArray.cpp) (libSceAudioOut) - The front pair and the empty slots read the same in every setting; 7.1 on the AV amplifier reported 2 channels on that console's HDMI chain. The host output is always reported as a stereo television here. The console also refuses flag 1 below a per-process libkernel value whose source is unidentified; BunnyFl measured the boundary between `0x14FFFFF` and `0x1500000`, and it is not modelled here. ASTRO BOT and ASTRO's PLAYROOM reportedly stop on an assertion that depends on these values (#4317), but which field matters has not been isolated
+- [sceAudioOutInit and sceAudioOut2Initialize repeats](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - a repeated `sceAudioOutInit` returns 0 here, while the firmware returns `0x8026000e` on the second call; whether a repeated `sceAudioOut2Initialize` returns 0 is unmeasured. That `sceAudioOutInit` initializes AudioOut2, and that `sceAudioOut2GetSpeakerInfo` then succeeds, follow the firmware and are covered by tests.
 - [sceAudioOut2UserCreateEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutOpenEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetSystemDebugState](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
@@ -42,10 +51,6 @@
 - [sceAudioOutExGetLastOutputTime](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutGetInfoOpenNum](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutGetInfo](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringInit](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringGetState](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutMasteringTerm](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetPadSpkVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetPadJackVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetUsbVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
@@ -90,18 +95,16 @@
 - [sceAudioOut2MbusSetSparkParam](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2AllAudioMainToHeadphoneForDiag](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2LoPortGetStateEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOut2LoTerminate](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) throws. It takes no arguments and returns an int, and stops the low-latency service ([SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut2.cs#L497-L498)), but what it does to open contexts and ports and what it returns when the service is not started are unknown, and its counterpart `sceAudioOut2Terminate` is unimplemented.
 - [sceAudioOut2ReportRegisterHandler](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2ReportUnregisterHandler](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2GetTvCorrectionInfo](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2GetIpcHandle](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2GetSystemStateEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOut2MasteringInitEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2SetDebugHeadphoneMode](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2DebugStateCtrl](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2ContextBedWrite](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2PortCreateEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOut2InitializeEx](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
+- [sceAudioOut2InitializeEx](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - the PS5 12.00 module (0x2a640) stores its 32-bit argument and runs `sceAudioOut2Initialize`; the argument's meaning is unknown and it is ignored
 - [sceAudioOut2Terminate](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2PortRegister](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOut2PortUnregister](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
@@ -110,6 +113,8 @@
 
 ### Functional
 
+- [sceAudioOutMasteringInit, sceAudioOutMasteringTerm and sceAudioOutMasteringSetParam](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - non-zero flags, a null pointer and a params id other than 1 throw; a repeated Init, a Term without Init and a SetParam or GetState before Init are unknown. There is no mastering stage, so Init and Term keep no state and SetParam reads only the id. The signatures and the default params id 1 follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/AudioOut.cs#L312-L344), not a console measurement. SharpProspero documents flag bit 0 as `SwapEqCompressor`, and shadPS4's PS4 stub [rejects any non-zero Init flags](https://github.com/shadps4-emu/shadPS4/blob/8d50471b7dc141dd700b51276b8edd1f293bce26/src/core/libraries/audio/audioout.cpp#L956-L962) with 0x80260201
+- [sceAudioOutMasteringGetState](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Mastering.cpp) (libSceAudioOut) - the states id 1 and the meter offsets 32, 128, 240, 272 and 304 in a 336-byte struct follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Audio/AudioOutMastering.cs#L97-L110), not a console measurement. With no mastering stage it zeroes the compressor input RMS and gain, and the limiter input, output and gain peaks, and leaves the other bytes, including the descriptors the AudioOut2 call writes, untouched; zero is not known to be what the console reports for an idle chain. A null pointer and a states id other than 1 throw; the console error codes are unknown
 - [sceAudioOut2EnableChat and sceAudioOut2DisableChat](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) - both PS5 exports take no arguments, return 0x80268006 before AudioOut2 initialization, and invoke the system chat service with selector 3. A negative service result maps to 0x80268000, otherwise they return zero. The host only records a local enabled flag, without initialization validation or a chat service; repeated-call and no-session behavior therefore still depends on the missing service.
 - [sceAudioOut2Set3DLatency](../../../core/libs/prx/libSceAudioOut/src/AudioOut2System.cpp) (libSceAudioOut) - the two 32-bit arguments and selector validation match the system library: selector 0 accepts outputs 0 through 2; selector 255 accepts outputs 1 and 2. No third latency argument exists. The host has no system 3D rendering stage, so the call still does not apply latency and does not reproduce the system initialization and output-availability checks.
 - [AudioOut2 contexts](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp) (libSceAudioOut) with an SDL device and no `sceAudioOut2ContextAdvance` calls read a grain's port buffers at the next push, at least 100 us after the grain was pushed, and play the mix behind a 40 ms cushion that the queue level leaves out. When the hardware reads the buffers is not known. The timing follows a title whose mixer fills a buffer after pushing it, reuses it two pushes later, and may still be writing it when the next push follows within microseconds. The last grain pushed before a title stops pushing is never read or played.
diff --git a/docs/dev/debt/libSceAudioPropagation.md b/docs/dev/debt/libSceAudioPropagation.md
index cff417667f..66ebc2c6f3 100644
--- a/docs/dev/debt/libSceAudioPropagation.md
+++ b/docs/dev/debt/libSceAudioPropagation.md
@@ -2,10 +2,10 @@
 
 ### Silent stubs
 
-- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) lacks acoustic propagation: attributes have no effect, sources expose no paths or rays, rendering preserves the destination mix without adding path contributions, and allocated CPU work memory is mostly unused. Ray results and audio paths accept empty lists and throw otherwise; calculation returns initial native validation errors and throws for unsupported propagation. Room, portal, source and material handles are tracked, but destruction after their system is destroyed silently succeeds without native lifetime semantics being confirmed. Occlusion, reflections and reverb are absent.
+- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) lacks acoustic propagation: attributes have no effect, sources expose 36 initially empty, invalid path slots and no rays, rendering preserves the destination mix without adding path contributions, and allocated CPU work memory is mostly unused. Ray results and audio paths accept empty lists and throw otherwise; calculation returns initial native validation errors and throws for unsupported propagation. Room, portal, source and material handles are tracked, but destruction after their system is destroyed silently succeeds without native lifetime semantics being confirmed. Occlusion, reflections and reverb are absent.
 
 ### Unknown function info
 
-- [sceAudioPropagationSourceSetAudioPath](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): the native path lookup and update confirm a 64-bit path handle, a read-only 224-byte path description and a float gain in XMM0. The description contains four 48-byte points, a point count and flags; each point contains a descriptor, room handle, gain and three position floats. The last eight bytes of each point and of the description are not consumed by these paths and remain opaque. Protected implementation remains unchanged; allocation, ownership and rendering are not implemented.
-- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): system options use a recovered 56-byte record; the field at byte 24 and final eight bytes remain semantically unresolved. CPU memory requirements and option limits are recovered; GPU memory queries throw because their platform-specific runtime condition is unresolved. Descriptor validation, ray ownership and path generation are unimplemented. Native rendering accepts multiple mutable records; the host supports only format 2 and writes one silent frame without native accumulation. Frame capacity and source-count limits follow the recovered options. Other formats and native validation precedence remain unimplemented.
-- [Initialization exports](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) ending in `Init`, plus `sceAudioPropagationSystem`, are absent from the supplied native module and retain unresolved signatures. Query, locking, enumeration and report callback signatures are recovered; diagnostic layouts are recovered, but source attributes 2/3 and the constant-one fields still lack semantic names. The final system word and the fourth position/direction words have no confirmed semantics.
+- [sceAudioPropagationSourceSetAudioPath](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): native evidence establishes a 64-bit path handle, a read-only 224-byte path description and a float gain. The four 48-byte points contain a room handle, gain and position; trailing eight-byte fields remain opaque. Updates copy the description and validate room ownership. Each source owns 36 initially invalid, empty slots, following public SharpProspero MaxPaths and SAROS's immediate lookup of slot 0. Allocation before calculation, the count of 36 and update validation precedence are inferred, not measured on a console. Native lookup error codes and their handle/null/index precedence are retained. Source/system destruction invalidates owned slots. Active nonempty path rendering still throws.
+- [libSceAudioPropagation](../../../core/libs/prx/libSceAudioPropagation/Export.cpp): system options use a recovered 56-byte record; the field at byte 24 and final eight bytes remain semantically unresolved. CPU memory requirements and option limits are recovered; GPU memory queries throw because their platform-specific runtime condition is unresolved. Descriptor validation, ray ownership and path generation are unimplemented. Native rendering accepts multiple mutable records; the host accepts public formats 0/1/2/4/5 (4/9/16/8/8 float channels), preserves the output mix without path contributions and clears the returned channel count; non-format-2 behavior remains unverified on a console. Frame capacity and source-count limits follow the recovered options. Other formats throw; native validation precedence remains unimplemented.
+- [Initialization exports](../../../core/libs/prx/libSceAudioPropagation/Export.cpp) ending in `Init`, plus `sceAudioPropagationSystem`, are not exported: the SDK declares the helpers `static inline` and none is in the SDK stub library or the supplied native module. Query, locking, enumeration and report callback signatures are recovered; diagnostic layouts are recovered, but source attributes 2/3 and the constant-one fields still lack semantic names. The final system word and the fourth position/direction words have no confirmed semantics.
diff --git a/docs/dev/debt/libSceBgft.md b/docs/dev/debt/libSceBgft.md
index 385f701d0f..2240209a4d 100644
--- a/docs/dev/debt/libSceBgft.md
+++ b/docs/dev/debt/libSceBgft.md
@@ -5,3 +5,13 @@
 - [sceBgftServiceDownloadGetProgress](../../../core/libs/prx/libSceBgft/Export.cpp), `sceBgftServiceIntDownloadGetProgress`, `sceBgftServiceIntDownloadGetGameAndGameAcProgress` and `sceBgftServiceIntDownloadGetPlayGoProgress`: signatures and the shared 88-byte output are confirmed. The library forwards the output through IPC without accessing individual fields; their types remain unresolved.
 - [sceBgftServiceIntDownloadRegisterTaskByStorageEx](../../../core/libs/prx/libSceBgft/Export.cpp): confirmed parameter pointer and 32-bit task ID output. The input contains 32-bit scalars at offsets 0, 4, 56 and 104, strings at offsets 8, 16, 32, 40, 48, 64, 72, 80 and 88, and a 64-bit scalar at offset 96. The typed layout preserves the unused eight bytes at offset 24; scalar meanings and several string roles remain unresolved.
 - [sceBgftServiceIntDownloadGetPatchProgress](../../../core/libs/prx/libSceBgft/Export.cpp) and `sceBgftServiceIntDownloadGetTaskInfo`: neither export nor a caller was found in the supplied decompiled library corpus. Their signatures remain unresolved.
+
+- [sceBgftServiceIntDebugPlayGoClearSetFreeZone](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - It is in the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDebugPlayGoIsSetFreeZone](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - It is in the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadCheckPatchUpdateState and sceBgftServiceIntDownloadClearStats](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadGetApplicationDataSize](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - It is in the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadGetPatchGoProgress and sceBgftServiceIntDownloadHideTask](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntDownloadSetResumeState and sceBgftServiceIntDownloadSetStartState](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntPlayGoCheckDiscIniChunksInstall and sceBgftServiceIntPlayGoStartDataDiscInstall](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntSetTaskVisible, sceBgftServiceIntUploadGetAvailableTaskCount, sceBgftServiceIntUploadGetTaskInfo and sceBgftServiceIntUploadHideTask](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceBgftServiceIntUploadSetStartState and sceBgftServiceIntUploadSetUploadError](../../../core/libs/prx/libSceBgft/Export.cpp) (libSceBgft) - The list is the intersection of the export table of the console's libSceBgft (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceBgft.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
diff --git a/docs/dev/debt/libSceCamera.md b/docs/dev/debt/libSceCamera.md
new file mode 100644
index 0000000000..955b1e157c
--- /dev/null
+++ b/docs/dev/debt/libSceCamera.md
@@ -0,0 +1,118 @@
+# libSceCamera technical debt
+
+### Unknown function info
+
+- [sceCameraOpen, sceCameraClose, sceCameraStart, sceCameraStop, sceCameraGetConfig, sceCameraSetConfig, sceCameraSetAttribute, sceCameraGetDeviceInfo, sceCameraGetFrameData, sceCameraIsValidFrameData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera) - imported by PS4 titles and added without an implementation, declared without parameters. What the console returns from them while no camera is attached is not known, so every call throws.
+
+### Functional
+
+- [sceCameraIsAttached](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera) - no camera is ever attached: index 0 returns 0 (not attached) and any other index returns `SCE_CAMERA_ERROR_PARAM` (0x802E0000), as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/9a8ae4417bbfc79b1a43eb8a2eb0bb602148261e/src/core/libraries/camera/camera.cpp#L187-L200) does without a configured camera, with the error value from its [camera_error.h](https://github.com/shadps4-emu/shadPS4/blob/9a8ae4417bbfc79b1a43eb8a2eb0bb602148261e/src/core/libraries/camera/camera_error.h). Not measured on a console. Closes when: a host camera is exposed to guests.
+
+### Additional PS5 3.20 imports
+
+- [sceCameraStopByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `+X1Kgnn3bzg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceIDWithoutOpen](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `-H3UwGQvNZI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetAttribute](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `0btIPD5hg5A`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraInitializeRegistryCalibData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `0wnf2a60FqI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `1-IJHxzRJGw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Finalize](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `186Jz869gsc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetConnectedDeviceAndDriverMode](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `2dBOiluwiMw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2IsAttached](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `2v21-m4gljU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `2zCd8XDOe-Y`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetTrackerMode](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `3VJOpzKoIeM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `3i5MEzrC1pg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibDataForEve](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `4IGO2LPD3h8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibDataFromDevice](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `5Oie5RArfWs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `66IVWcdNHyI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraIsConnectedForSystem](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `68S3GKWhY6o`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `8MEjogxPrv0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetRegister](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `8MjO05qk5hA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetVideoSyncInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `8WtmqmE4edw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetConfigInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `9+SNhbctk64`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAttributeInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `96F7zp1Xo+k`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `AfIDd+2ycTs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetMmapConnectedCount](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `B260o9pSzM8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `DAycoVmY3Mw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceConfig](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `DSOLCrc3Kh8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioOpen](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `DhqqFiBU+6g`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `FZkD-E6MNTQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibDataFromDeviceForEve](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `H-7tWq8gfKs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `HX5524E5tMY`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetVrCaptureInfo](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `IAz2HgZQWzE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetCalibDataForEve](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `Jkz3xxMeyIM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetAttribute](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `JtD7ZG45rdw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetLensCorrection](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `K7W7H4ZRwbc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetCalibData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `LEMk5cTHKEA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetProcessFocusByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `NVITuK83Z7o`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetConfig](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `O5x-G9Rqwx4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ObIste7hqdk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `P-7MVfzvpsM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Initialize](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `PFRl8SmSW+4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `QI8GVJUy2ZY`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAccGetData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `QhjrPkRPUZQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetAttribute](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `Qk6kEJ0RJlM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibrationData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `RHYJ7GKOSMg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `RTDOsWWqdME`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `T8jy0JWa210`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Stop](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `TZWR3p6XxXk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `TzkL-nUWfaQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `U8oNsRef+jI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioClose](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `UFonL7xopFM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetProductInfo](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ULxbwqiYYuU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `WVox2rwGuSc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetLensCorrection](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `XqYRHc4aw3w`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraChangeAppModuleState](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `Y0pCDajzkVQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetFrameData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `YlFCMjbyzh8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetContrast](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `a5xFueMZIMs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetSaturation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `bSKEi2PzzXI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `c6Fp9M1EXXc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `c9XZGDF1OcM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraStartByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `cLxF1QtHch0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Open](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `dmLUJh3bVTc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Start](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `eGkcUia48ts`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetLensCorrectionInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `eHa3vhGu2rQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraOpenByModuleId](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `eTywOSWsEiI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetCalibrationData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `emZBXv7cuAI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioGetData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `fkZE7Hup2ro`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `gB+OkFvkSXE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `gJqqsinextg`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetCalibData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hHA1frlMxYE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraWaitForEveReady](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hPVradh5wpo`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetRegistryInfo](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hawKak+Auw4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioGetData2](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `hftC5A1C8OQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAppModuleFocus](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `j5isFVIlZLk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetDefectivePixelCancellation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `jMv40y2A23g`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceID](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `jTJCdyv9GLU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetForceActivate](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `jeTpU0MqKU0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `k3zPIcgFNv0`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetFieldOfView](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `kVWBITsSB3o`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2IsValidFrameData](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `lQ7rWWlOArI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetProcessFocus](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `lS0tM6n+Q5E`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `lhEIsHzB8r4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetConfig](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `mLRzKdIDwiU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `n+R7PGJa6MI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDeviceConfigWithoutHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `n+rFeP1XXyM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraDeviceOpen](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `nBH6i2s4Glc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetUacModeInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `nnR7KAIDPv8`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `oEi6vM-3E2c`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetRegister](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `olojYZKYiYs`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetGamma](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `pfiqU2f6PQY`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraRemoveAppModuleFocus](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `py8p6kZcHmA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `qTPRMh4eY60`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetDefectivePixelCancellation](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `tslCukqFE+E`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2Close](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `uBRW3tEoWWM`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetVideoSync](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ubD+FitjqhA`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraWaitForLukeReady](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `v9XTZHXoJyQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetDefectivePixelCancellationInternal](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vER3cIMBHqI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2GetSharpness](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vPi3gSzw79M`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vS20kteXHdw`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetDebugStop](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vejouEusC7g`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCamera2SetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `vx9MQYicBVQ`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraIsConfigChangeDone](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wQfd7kfRZvo`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wgBMXJJA6K4`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetVideoSync](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wpeyFwJ+UEI`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraAudioReset](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `wyU98EXAYxU`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAutoExposureGain](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `yfSdswDaElo`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraSetAutoWhiteBalance](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `zIKL4kZleuc`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraGetHue](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `zrIUDKZx0iE`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
+- [sceCameraCloseByHandle](../../../core/libs/prx/libSceCamera/Export.cpp) (libSceCamera, NID `ztqH5qNTpTk`) - listed in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCamera.c); signature and behavior are unverified, so this parameterless declaration is for import resolution only and throws through `NotImplemented_nid_no_patch`
diff --git a/docs/dev/debt/libSceCesCs.md b/docs/dev/debt/libSceCesCs.md
index 14cef5e67e..f0af2576a1 100644
--- a/docs/dev/debt/libSceCesCs.md
+++ b/docs/dev/debt/libSceCesCs.md
@@ -10,6 +10,13 @@
 
 - [Unicode scalar conversions](../../../core/libs/prx/libSceCesCs/Unicode.cpp) (libSceCesCs) - console error precedence, optional length pointers and length units are unverified. Signatures follow the [Orbital type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); names are in the aerolib table pinned by `tools/nid_names.py`. Encoding follows [Unicode section 3.9](https://www.unicode.org/versions/Unicode17.0.0/core-spec/chapter-3/). Each call converts one scalar, including zero and U+FEFF, without a terminator or byte-order detection; lengths count bytes for UTF-8 and 16-bit units for UTF-16. Native forms use host byte order (supported hosts are little-endian). Errors follow the existing CES converters, not console measurements, and failure leaves outputs unchanged. No console or title comparison has been run
 - [sceCesEucJpToUtf8](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the scalar conversion's errors and optional length pointers are unverified against the console. Its signature follows the Orbital type database linked above; it uses the existing CP51932 profile and JIS tables, with their mapping and profile-layout assumptions listed above, converts one character (including zero), and writes no terminator. Failure leaves the output and length pointers unchanged
+- [Shift-JIS and EUC-JP scalar conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSJisTo*`, `sceCesEucJpTo{Utf16,Utf32}*` and `sceCes{Ucs2,Utf8,Utf16,Utf32}*To{SJis,EucJp}` are unverified against the console. Signatures follow the Orbital type database linked above; the CP932 and CP51932 table and profile assumptions above apply. A profile of another encoding answers `INVALID_PARAMETER`, a surrogate or a value above U+10FFFF `INVALID_ENCODE`, a code point outside the BMP `UNASSIGNED_CODE`. `sceCesSJisCodeToJisX0208` and `sceCesJisX0208ToSJisCode` do not check that the cell is assigned; their `INVALID_ENCODE` for rows or cells outside 1-94 and `INVALID_DST_BUFFER` for a null output are not console measurements
+- [Strict JIS X 0208 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - cell `0x2140` and U+FF3C throw: JIS0208.TXT gives U+005C, glibc 2.39 and Python's `euc_jp` U+FF3C. In `sceCesUcsProfileInitSJis1997X0208`, bytes `0x5C` and `0x7E` and U+005C, U+007E, U+00A5 and U+203E throw: SHIFTJIS.TXT gives JIS X 0201 Roman, CP932 and Python's `shift_jis` ASCII; the console's is unknown. The table, [JIS0208.TXT](https://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/JIS0208.TXT), is CP932's without rows 13 and 89-92 and with six cells changed, not measured. Per [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Text/Ces.cs#L57-L67), the `X0208Ss2` profile adds SS2 katakana and `X0208Ss2Ss3` SS3 JIS X 0212. Signatures follow Orbital; the conversions above take these profiles with the same errors, a missing SS2 or SS3 answering `INVALID_ENCODE` and Shift-JIS leads `0xF0`-`0xFC` `UNASSIGNED_CODE`
+- [UTF-16 and UTF-32 forms of the single-byte and MBCS string conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSbcTo{Ucs2,Utf16,Utf32}*`, `sceCes{Ucs2,Utf16,Utf32}*ToSbc`, `sceCesMbcsStr{To,Get}{Utf16,Utf32}*` and `sceCes{Utf16,Utf32}Str{To,Get}Mbcs*` are unverified against the console. Signatures follow the Orbital type database linked above. They follow `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the UTF-8 MBCS string forms with the profiles and tables listed above. A surrogate or a value above U+10FFFF answers `INVALID_ENCODE`, a valid code point no profile maps `UNASSIGNED_CODE`. The string forms stop at a zero code unit, write no terminator and count code units
+- [GBK (CP936) and EUC-CN conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesUcsProfileInitGbkCp936` and `sceCesUcsProfileInitEucCnGb2312` mark the caller's sheet with an 8-byte tag; the console's profile layout is not known. Both use one table ([Cp936.hpp](../../../core/libs/prx/libSceCesCs/Cp936.hpp)) read from Microsoft's [CP936.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP936.TXT); the EUC-CN profile accepts only its `0xA1`-`0xFE` lead and trail bytes, so it includes the GBK cells inside that range and the CP936 forms of `0xA1A4` (U+00B7) and `0xA1AA` (U+2014) instead of GB 2312's. That the console's GB 2312 and CP936 tables equal it is not measured. User-defined areas and `sceCesGbUcsProfileSet*` are not handled. Errors, their precedence and the length pointers follow the Shift-JIS forms above and are unverified
+- [GB 18030 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the console's tables are not measured, and the sources disagree on 26 sequences. The 2000 profile follows ICU's `gb-18030-2000.ucm` at icu-data d9d3a6ed (before ICU-8427), which matches Python's codec: `0xA8BC` is U+E7C7 and `0x8135F437` U+1E3F. The 2005 profile follows `gb-18030-2005.ucm` (91850aec), which swaps those two and maps 24 PUA cells to U+FE10-U+FE19, U+9FB4-U+9FBB and six supplementary ideographs, keeping the PUA code points as encode fallbacks. Two-byte cells are CP936 plus [Gb18030.hpp](../../../core/libs/prx/libSceCesCs/Gb18030.hpp); four-byte runs include ICU's `gb18030Ranges`. The inits tag the sheet like GBK's; the `sceCesGb*`, `sceCesMbc*` and MBCS string forms accept them. The full mapping is assumed as the default of `sceCesGbUcsProfileSetUdaMapping` and `Set4ByteCharRange`, which throw. Supplementary characters to UCS-2 answer `UNASSIGNED_CODE`; other errors follow the GBK forms
 - [sceCesRefersUcsProfileCp1250](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with the Windows-1250 table of Microsoft's [bestfit1250.txt](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/bestfit1250.txt), where the unassigned bytes map to their Latin-1 control characters as the Cp1252 and Cp1251 tables do; the console behavior for those bytes and the whole profile is not verified. PPSA34501 fails to start without this export (`qYu6y1E0Qbg`)
-- [libSceCesCs firmware 3.20 pending exports](../../../core/libs/prx/libSceCesCs/PendingExports.cpp) - 249 symbol names are present in [the PS5 3.20 libSceCesCs export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCesCs.c). Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through `NotImplemented_nid_no_patch`.
-- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables, errors and Big5 duplicate choices are assumed, not measured. `sceCesUcsProfileInitEucKr`, `sceCesUcsProfileInitUhc` and `sceCesUcsProfileInitBig5Cp950` tag the caller's sheet like the EUC-JP profile. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 single-byte profile (`sceCesEucKrUcsProfileSetSbcs`) is not implemented. The user-defined areas, which Windows maps to the Private Use Area, answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+2550, U+255E, U+2561, U+256A, U+5341 and U+5345, as Windows code page 950 does. The `*ToUtf8` calls convert one character and leave their outputs unchanged on failure
+- [Generic MBCS character and Shift-JIS code helpers](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesMbcTo*` convert one character with any profile the MBCS context accepts, as the per-encoding forms above do. `sceCesSJisGetCode` and `sceCesSJisPutCode` read and write one raw Shift-JIS code (one byte for ASCII and `0xA1`-`0xDF`) without checking that it is assigned. `sceCesSJisCodeToJisX0213` and `sceCesJisX0213ToSJisCode` use the Shift_JIS-2004 arithmetic of JIS X 0213 annex 1 (plane 2 rows 1, 3-5, 8, 12-15 and 78-94 on leads `0xF0`-`0xFC`). `sceCesMbcsUcsContextInitCopy` copies the stored profile pointer. Signatures follow the Orbital type database linked above; errors, their precedence and the optional size pointers follow the other converters and are unverified against the console
+- [Single-byte profiles](../../../core/libs/prx/libSceCesCs/SingleByte.hpp) (libSceCesCs) - the console's tables for these 27 profiles are not verified. Each returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with bytes 0x00-0x7F unchanged and the high half of a public table: ISO 8859-1, -2, -4, -5, -9, -10, -13, -14, -15 and -16 from [unicode.org](https://unicode.org/Public/MAPPINGS/ISO8859/), code pages 437, 737, 775, 850, 852, 855, 860-863, 865 and 866 from [Microsoft's PC tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/), KOI8-R and KOI8-U from [unicode.org](https://unicode.org/Public/MAPPINGS/VENDORS/MISC/), and 1254, 1256 and 1258 from Microsoft's [best-fit tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/), whose unassigned bytes map to C1 controls as in Cp1250. Profiles whose public table leaves bytes undefined or maps them to private use still throw
+- [libSceCesCs firmware 3.20 pending exports](../../../core/libs/prx/libSceCesCs/PendingExports.cpp) - 70 symbol names are present in [the PS5 3.20 libSceCesCs export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCesCs.c). Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through `NotImplemented_nid_no_patch`.
+- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables, errors and Big5 duplicate choices are assumed, not measured. `sceCesUcsProfileInitEucKr`, `sceCesUcsProfileInitUhc` and `sceCesUcsProfileInitBig5Cp950` tag the caller's sheet like the EUC-JP profile. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 profile (`sceCes*UcsProfileSetSbcs`) is not implemented. User-defined areas (Private Use Area on Windows) answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+2550, U+255E, U+2561, U+256A, U+5341 and U+5345, as code page 950 does. The scalar calls to and from UCS-2 and UTF-8/16/32 convert one character as the Shift-JIS and EUC-JP scalar conversions do
diff --git a/docs/dev/debt/libSceCommonDialog.md b/docs/dev/debt/libSceCommonDialog.md
index 0e7ac021bf..f46aaf0394 100644
--- a/docs/dev/debt/libSceCommonDialog.md
+++ b/docs/dev/debt/libSceCommonDialog.md
@@ -3,3 +3,7 @@
 ### Silent stubs
 
 - [libSceCommonDialog](../../../core/libs/prx/libSceCommonDialog/Export.cpp)
+
+### Functional
+
+- [sceCommonDialogInitialize](../../../core/libs/prx/libSceCommonDialog/Export.cpp) (libSceCommonDialog) - returning `ALREADY_SYSTEM_INITIALIZED` (`0x80B80002`) from a repeated call is not measured on a console by the project. A third-party PS5 log ([obSCEne](https://github.com/project-oops/obSCEne/blob/67b4c529eb3c271184117e26bb54330531ef2cf6/reports/hardware/report-20261014-004800.log#L260-L261), firmware 12.40) records two calls, `0x0` and then `0x80b80002`; a third call is not covered. The SDK error names, shadPS4 (a PS4 emulator) and SharpProspero give the same value; PPSA09695 compares the result with `0x80b80002` (call site 0x5F7BD0) and PPSA06327 stops on `0x80b80004`. Closes when: measured on a PS5, including a third call.
diff --git a/docs/dev/debt/libSceCompanionHttpd.md b/docs/dev/debt/libSceCompanionHttpd.md
index 2738a6bd6d..3ed7d72d8c 100644
--- a/docs/dev/debt/libSceCompanionHttpd.md
+++ b/docs/dev/debt/libSceCompanionHttpd.md
@@ -2,4 +2,10 @@
 
 ### Unknown function info
 
-- [sceCompanionHttpdAddHeader, sceCompanionHttpdGet2ndScreenStatus, sceCompanionHttpdGetEvent, sceCompanionHttpdGetUserId, sceCompanionHttpdInitialize, sceCompanionHttpdInitialize2, sceCompanionHttpdOptParamInitialize, sceCompanionHttpdRegisterRequestBodyReceptionCallback, sceCompanionHttpdRegisterRequestCallback, sceCompanionHttpdRegisterRequestCallback2, sceCompanionHttpdSetBody, sceCompanionHttpdSetStatus, sceCompanionHttpdStart, sceCompanionHttpdStop, sceCompanionHttpdTerminate, sceCompanionHttpdUnregisterRequestBodyReceptionCallback and sceCompanionHttpdUnregisterRequestCallback](../../../core/libs/prx/libSceCompanionHttpd/Export.cpp) (libSceCompanionHttpd) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCompanionHttpd.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceCompanionHttpdOptParamInitialize, sceCompanionHttpdInitialize](../../../core/libs/prx/libSceCompanionHttpd/Export.cpp) (libSceCompanionHttpd) - the option block is taken as 0x60 bytes: titles fill a work memory pointer at +0x08, its size at +0x10 and a temporary data mount point at +0x58 after `sceCompanionHttpdOptParamInitialize`. Its other fields and the defaults the console writes are unknown, so `sceCompanionHttpdOptParamInitialize` zeroes the 0x60 bytes and `sceCompanionHttpdInitialize` reads none of them; both reject a null block with `INVALID_PARAM`
+- [sceCompanionHttpdAddHeader, sceCompanionHttpdSetStatus, sceCompanionHttpdSetBody](../../../core/libs/prx/libSceCompanionHttpd/Export.cpp) (libSceCompanionHttpd) - imported by PS4 titles and added without an implementation. They fill the response of a request callback, which is never called here, so every call throws
+- [sceCompanionHttpdGet2ndScreenStatus, sceCompanionHttpdGetUserId, sceCompanionHttpdInitialize2, sceCompanionHttpdRegisterRequestBodyReceptionCallback, sceCompanionHttpdRegisterRequestCallback2, sceCompanionHttpdUnregisterRequestBodyReceptionCallback](../../../core/libs/prx/libSceCompanionHttpd/Export.cpp) (libSceCompanionHttpd) - the rest of the library's exports, declared without parameters and without an implementation; their signatures are not verified, so every call throws
+
+### Functional
+
+- [Companion server state](../../../core/libs/prx/libSceCompanionHttpd/Export.cpp) (libSceCompanionHttpd) - no HTTP server listens, so no companion device ever connects: `sceCompanionHttpdGetEvent` returns `NO_EVENT` without writing the event and the request callback is never called. Initialization, callback registration and start and stop are tracked with the errors of shadPS4's [companion_error.h](https://github.com/shadps4-emu/shadPS4/blob/eb9f66c349ae7c8fef780f4f55e98b8065947e14/src/core/libraries/companion/companion_error.h) (`ALREADY_REGISTERED` is 0x80E4000C, between `NOT_STARTED` and `NOT_CONNECTED`; the header has 0x80E4000, one digit short). Unregistering with no callback and terminating a started server throw, since the console's answers are unknown. Not measured on a console. Closes when: a companion server is hosted
diff --git a/docs/dev/debt/libSceCompanionUtil.md b/docs/dev/debt/libSceCompanionUtil.md
index 48d3c1cb47..652949f2b7 100644
--- a/docs/dev/debt/libSceCompanionUtil.md
+++ b/docs/dev/debt/libSceCompanionUtil.md
@@ -2,4 +2,5 @@
 
 ### Unknown function info
 
-- [sceCompanionUtilGetEvent, sceCompanionUtilGetRemoteOskEvent, sceCompanionUtilInitialize, sceCompanionUtilOptParamInitialize and sceCompanionUtilTerminate](../../../core/libs/prx/libSceCompanionUtil/Export.cpp) (libSceCompanionUtil) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCompanionUtil.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceCompanionUtilGetEvent](../../../core/libs/prx/libSceCompanionUtil/Export.cpp) - the PS5 argument contract, event size and alignment remain unverified for the output pointer. The supplied `libSceCompanionUtil.sprx` export `cE5Msy11WhU` at 0x100 only returns `0x80AD0008`, without reading argument registers or memory. The implementation preserves that return and does not access the buffer.
+- [sceCompanionUtilGetRemoteOskEvent, sceCompanionUtilInitialize, sceCompanionUtilOptParamInitialize and sceCompanionUtilTerminate](../../../core/libs/prx/libSceCompanionUtil/Export.cpp) (libSceCompanionUtil) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCompanionUtil.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceConvertKeycode.md b/docs/dev/debt/libSceConvertKeycode.md
index 5c01a3cabc..ca16750daf 100644
--- a/docs/dev/debt/libSceConvertKeycode.md
+++ b/docs/dev/debt/libSceConvertKeycode.md
@@ -3,4 +3,4 @@
 ### Functional
 
 - [sceConvertKeycodeGetVirtualKeycode](../../../core/libs/prx/libSceConvertKeycode/Export.cpp) and `sceConvertKeycodeGetCharacter`: layouts 31–39 throw until the guest platform and compiled SDK version are exposed. `GetVirtualKeycode` also throws for version-dependent Y/Z mappings in layouts 2, 3 and 12. Mapping tables and modifier behavior are recovered; no SDK version is guessed.
-- [sceConvertKeycodeGetImeKeyboardType](../../../core/libs/prx/libSceConvertKeycode/Export.cpp): user keyboard language and Japanese/Chinese keyboard variants are not exposed by the current UserService implementation. Valid-user queries throw instead of returning a fabricated keyboard type. The confirmed language/variant mapping and SDK compatibility rules still need integration with those settings.
+- [sceConvertKeycodeGetImeKeyboardType](../../../core/libs/prx/libSceConvertKeycode/Export.cpp): implemented exactly as the repository owner (boykopovar) specified the UserService keyboard type (plus the Japanese variant for type 37 and the Traditional Chinese variant for type 39) to IME keyboard type table, the SDK compatibility rules (38 becomes 4 for PS5 SDK below 0x06000000 or PS4 SDK below 0x10000000; 39 becomes 29 for PS5 SDK below 0x08000000 and for every PS4 client), the error codes and the unmatched-type result (success, IME type 0). The PS4/PS5 client rule reads the title ID prefix from `param.sfo` or `param.json` (`CUSA` is PS4); a missing, malformed or oversized ID or title, as in homebrew, is treated as PS5. Reliable detection inspects the original `eboot.bin`, which only the relinker reads, so it is not done. UserService reports the keyboard type of the configured system language, so the function returns the owner's IME type for that language (see libSceUserService.md).
diff --git a/docs/dev/debt/libSceFiber.md b/docs/dev/debt/libSceFiber.md
index 9ad010851f..f1c33e85c3 100644
--- a/docs/dev/debt/libSceFiber.md
+++ b/docs/dev/debt/libSceFiber.md
@@ -6,7 +6,8 @@
 
 ### Unknown function info
 
-- [_sceFiberInitializeWithInternalOptionImpl](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - its signature follows shadPS4's [initialize implementations](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L150-L153); its export alias is mapped at [RegisterLib](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L548-L551). Not measured on a console; the throwing declaration only resolves the import.
-- [_sceFiberAttachContextAndRun, _sceFiberAttachContextAndSwitch](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - signatures follow shadPS4's [run implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L260-L261) and [switch implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L336-L337); their export aliases are mapped at [RegisterLib](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L555-L563). Not measured on a console; the throwing declarations only resolve imports.
+- [_sceFiberInitializeWithInternalOptionImpl](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - its signature and the flag values `0x1` (no ulobjmgr registration), `0x10` (context size check) and `0x100` (start with MXCSR `0x9fc0` and x87 control word `0x037f`) follow shadPS4's [initialize implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L150-L153) and [flags](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.h#L27-L32). Not measured on a console. `0x1` has no effect because no ulobjmgr exists; other flag bits throw. shadPS4 also sets `0x100` for `build_version` 3.50 and later in every initialize; `opt_param` and `build_version` are ignored.
+- [_sceFiberAttachContextAndRun, _sceFiberAttachContextAndSwitch](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - signatures and behaviour follow shadPS4's [run](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L260-L261), [switch](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L336-L337) and [attach](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L46-L79) implementations, not measured on a console. A context is attached only to an idle fiber initialized without one; a fiber that already has a context, or is not idle, returns `SCE_FIBER_ERROR_INVALID`. A size that is not a multiple of 16 returns `SCE_FIBER_ERROR_ALIGNMENT` as in initialize, where shadPS4 returns `SCE_FIBER_ERROR_INVALID`.
+- [Fibers without a context](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - running or switching to a fiber initialized without a context, before one is attached, throws. On the console such a fiber runs on the stack of its caller, per shadPS4's [run implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L297-L313).
 - [_sceFiberGetThreadFramePointerAddress](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber, NID `0dy4JtMUcMQ`) forwards to `sceFiberGetThreadFramePointerAddress`; that the argument list matches is inferred from the export without the underscore, as for the underscore Ult exports, not measured
 - [Fiber stacks](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - a fiber whose context is smaller than 64 KiB runs on an mmap'd host stack of its context size plus 1 MiB, so host calls made from it (21 KiB deep when PPSA01341 reaches SPIRV-Tools from a 16 KiB context) do not overwrite the contexts packed next to it; a larger context is the stack, as on the console. PPSA05684 needs the second: its job fibers have 64 KiB and 512 KiB contexts, the 512 KiB ones at 1 MiB-aligned addresses, and find their job record by masking the stack pointer (`~0xfffff` for the 512 KiB ones), which a host stack breaks (the game waits forever in GameInit, or faults later in a 64 KiB fiber). The 64 KiB limit is chosen between these two titles, not measured: a title with small contexts that also derives state from the stack pointer, or one whose host calls exceed what is left of a large context, is not covered
diff --git a/docs/dev/debt/libSceFont.md b/docs/dev/debt/libSceFont.md
index b1b5e56398..3158492e1f 100644
--- a/docs/dev/debt/libSceFont.md
+++ b/docs/dev/debt/libSceFont.md
@@ -2,6 +2,8 @@
 
 ### Unknown function info
 
+- [sceFontRenderCharGlyphImage, sceFontRenderCharGlyphImageHorizontal, sceFontRenderCharGlyphImageVertical](../../../core/libs/prx/libSceFont/src/Layout.cpp) (libSceFont) accept a surface whose width or height is 0, with any row stride, and return the glyph metrics and an empty update rectangle without writing to the surface. A negative width, height or stride, a zero stride on a surface with pixels, a null buffer and a pixel size other than 1 or 4 bytes still return `SCE_FONT_ERROR_NO_SUPPORT_SURFACE`; those cases and the exact console result for a zero-extent surface are not measured. The extent-0 behaviour is inferred from the Tekken Dark Resurrection PSP emulator which, to measure a string, initialises the surface with width 0 and height 31 and an unbound stride, renders each character and sums the returned advances.
+
 - [Typographic design](../../../core/libs/prx/libSceFont/src/Style.cpp): native selector, feature, font-set eligibility and output-clearing rules are recovered. Driver typography selection and queries, feature-cache updates and glyph substitution remain unimplemented and throw instead of storing arbitrary selector/value pairs.
 - [sceFontSetScriptLanguage and sceFontGetScriptLanguage](../../../core/libs/prx/libSceFont/src/Style.cpp): native script/language ranges, handle-error precedence and clearing of failed getter outputs are implemented. Valid driver queries and updates throw; the previous arbitrary-value map and fabricated zero default are no longer used. Driver selection and actual language-dependent shaping remain unimplemented.
 - [sceFontGetRenderScaledKerning](../../../core/libs/prx/libSceFont/src/Render.cpp) (libSceFont) - arguments, the cleared output and the bound renderer check taken from `cellFontGetRenderScaledKerning` in [RPCS3](https://github.com/RPCS3/rpcs3/blob/master/rpcs3/Emu/Cell/Modules/cellFont.cpp) (PS3 predecessor of the library), not confirmed on a title. The kerning is the `sceFontGetKerning` one at the render scale
diff --git a/docs/dev/debt/libSceFontFt.md b/docs/dev/debt/libSceFontFt.md
index 3aa05e385d..c5c609e43f 100644
--- a/docs/dev/debt/libSceFontFt.md
+++ b/docs/dev/debt/libSceFontFt.md
@@ -3,6 +3,7 @@
 ### Functional
 
 - [Font format support](../../../core/libs/prx/libSceFontFt/Export.cpp): format queries now take the font library, validate its magic and lock it while checking its actual FreeType modules. The host registers its default modules at creation rather than enabling formats individually, so format-selection state and guest allocator failures during format registration are not reproduced. Unsupported foreign drivers throw.
+- [TrueType GX support](../../../core/libs/prx/libSceFontFt/Export.cpp): the GX query checks the bundled FreeType TrueType module, whose configuration enables GX variation support. The console's response for a FreeType build without GX variation support has not been measured.
 
 ### Unknown function info
 
diff --git a/docs/dev/debt/libSceFreeType.md b/docs/dev/debt/libSceFreeType.md
index 6d4f98438d..5fd44fd1d1 100644
--- a/docs/dev/debt/libSceFreeType.md
+++ b/docs/dev/debt/libSceFreeType.md
@@ -2,14 +2,42 @@
 
 ### Unknown function info
 
-- [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char and FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures and errors are unverified; the LP64 guest adapter follows the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Character iteration uses the low 32 bits of the input code, as that version does internally, and updates the guest's selected charmap pointer without refreshing unrelated glyph or outline data. Guest charmap fields are treated as read-only copies of the native records.
+- [FT_Get_Sfnt_Name_Count, FT_Get_Sfnt_Name](../../../core/libs/prx/libSceFreeType/src/Names.cpp) (libSceFreeType) - console signatures, record layout and errors are unverified; the adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftsnames.c) and assumes the public LP64 `FT_SfntName` layout (24 bytes, string pointer at 8, byte length at 16). Strings retain their original encoding, borrow native face storage and remain valid only while the face is alive
+
+- [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char, FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp), [FT_Get_Glyph_Name, FT_Get_Name_Index, FT_Get_Postscript_Name](../../../core/libs/prx/libSceFreeType/src/Names.cpp) (libSceFreeType) - console signatures, naming rules and errors are unverified; the LP64 adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Iteration uses the low 32 input bits and updates only the selected guest charmap; charmap fields are read-only copies. Naming preserves LP64 invalid-index errors on Windows. PostScript names borrow native face storage and remain valid only while the face is alive
+
+- [FT_Cos, FT_Sin, FT_Tan, FT_Vector_Unit and FT_Angle_Diff](../../../core/libs/prx/libSceFreeType/src/Trigonometry.cpp) (libSceFreeType) - console ABI/version and CORDIC equivalence are unverified; the LP64 adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/fttrigon.c). Tangent retains the 64-bit quotient near poles instead of Windows FT_Long truncation. Angle differences whose signed 64-bit subtraction overflows throw; the bundled source's subtraction is undefined there.
 
 - [FT_Init_FreeType, FT_New_Face, FT_Set_Pixel_Sizes, FT_Get_Char_Index, FT_Load_Glyph, FT_Render_Glyph](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - the PS4 library is taken to be FreeType 2 built for LP64: the face, size, charmap, glyph slot, bitmap and outline layouts follow the public headers of the bundled FreeType 2.13.3 with a 64-bit `long`, which matches the offsets the OpenOrbis samples read (`face->glyph` at 0x98, `slot->advance` at 0x80, `slot->bitmap` at 0x98, `slot->bitmap_left` at 0xc0). Which FreeType version and options the console library is built with is unknown, so the behaviour and error codes are those of FreeType 2.13.3. The OpenOrbis font, keyboard, threading, system and SDL2 samples import these six functions
 
+- [FT_Bitmap_New, FT_Bitmap_Copy, FT_Bitmap_Convert, FT_Bitmap_Done](../../../core/libs/prx/libSceFreeType/src/Bitmap.cpp) (libSceFreeType) - console behaviour and error codes are unmeasured; these follow bundled FreeType 2.13.3. Copy and Convert throw when source and target share a non-null buffer; Convert also throws when they are the same object. Other overlapping storage remains forbidden by the native API contract
+
+- [FT_Request_Size](../../../core/libs/prx/libSceFreeType/src/SizeRequest.cpp) (libSceFreeType) - console signature, request layout and errors are unverified; the guest request follows the LP64 public headers of the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/include/freetype/freetype.h). Host overflow behavior remains that of the bundled build. On Windows, native `FT_Long` is 32 bits; valid requests whose width or height exceeds that range throw before changing the size.
+
 - [FT_New_Memory_Face, FT_Done_Face and FT_Done_FreeType](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures, errors and generic-finalizer ordering are unverified; they follow the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/include/freetype/freetype.h) with LP64 guest arguments. Caller-owned font bytes must remain valid until the face is freed.
 
+- [FT_Outline_Check, FT_Outline_Get_CBox](../../../core/libs/prx/libSceFreeType/src/Outline.cpp) (libSceFreeType) - console signatures, count signedness and errors are unverified; the adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c), including its unsigned 16-bit counts and contour endpoints. Control-box coordinates use the existing guest LP64 layout and retain their full 64-bit range on Windows; contour checking does not validate point tags
+
+- [FT_Get_Charmap_Index, FT_Get_CMap_Language_ID, FT_Get_CMap_Format](../../../core/libs/prx/libSceFreeType/src/Charmap.cpp) (libSceFreeType) - console signatures and return values are unverified; the adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c) and the existing guest LP64 model. Charmaps must be the face's original read-only guest records; copied or otherwise unregistered records with a non-null face throw instead of reading private native cmap fields from guest memory
+
+- [FT_Outline_Reverse, FT_Outline_Translate](../../../core/libs/prx/libSceFreeType/src/Outline.cpp) (libSceFreeType) - console signatures, count signedness and overflow behavior are unverified; the adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) with LP64 coordinates. Translation uses 64-bit modular addition to match that build's `ADD_LONG`; reversal preserves each contour's first point and toggles the reverse-fill flag. Coordinates outside the host `FT_Pos` range still throw if the modified outline is later rendered on Windows
+
+- [FT_Get_X11_Font_Format, FT_Get_FSType_Flags](../../../core/libs/prx/libSceFreeType/src/FaceInfo.cpp) (libSceFreeType) - console signatures, format labels and embedding-flag behavior are unverified; the adapter follows bundled FreeType 2.13.3's [format](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftfntfmt.c) and [FSType](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftfstype.c) services. Format strings borrow native driver storage; the console's string lifetime has not been measured
+- [FT_Get_Kerning](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - the name and NID `LPtlB241JSg` occur in the [PS5 3.20 libSceFreeTypeOt inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFreeTypeOt.c), but the console signature and kerning results are unverified. The adapter assumes the existing LP64 guest layout and follows bundled FreeType 2.13.3 for scaling, rounding and errors
+
 ### Functional
 
+- [FT_Set_Transform](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI, transform arithmetic and FreeType-version equivalence are unverified. The name and NID `bcM5xfX2SeA` come from the [PS5 3.20 inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFreeTypeOt.c); the 32-byte LP64 matrix, 16-byte vector, null defaults and glyph behavior follow bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Input components outside the native `FT_Long` range throw without changing the transform; on Windows this rejects values outside signed 32 bits. Native arithmetic limits remain those of the host library.
+
 - [libSceFreeType](../../../core/libs/prx/libSceFreeType/src/GuestObjects.cpp) (libSceFreeType) - private fields (`driver`, `memory`, `stream`, `sizes_list`, `extensions`) and `subglyphs` stay null. Face, size and glyph-slot records are copies. Only edits to outline points and flags are written back before `FT_Render_Glyph`; replacing arrays or exceeding the host `FT_Pos` range throws. `FT_New_Face` reads the whole file into memory and throws for files of 2 GiB or more on Windows. On macOS, native FreeType symbols remain exported and could resolve guest imports without adaptation; Windows and Linux hide them with `--exclude-libs`.
 
+- [FT_List_Add, FT_List_Insert, FT_List_Find, FT_List_Remove, FT_List_Up, FT_List_Iterate and FT_List_Finalize](../../../core/libs/prx/libSceFreeType/src/List.cpp) - console signatures, callback ordering and error compatibility are unverified. Names and NIDs follow the [PS5 3.20 inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFreeTypeOt.c); the pointer-only 16-byte list, 24-byte node and operations follow bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftutil.c). The 32-byte allocator record uses LP64 guest callbacks, and finalization calls its guest `free` callback for each node. Native list-membership and callback preconditions still apply; malformed lists and callbacks that invalidate a later node are not validated.
+
 - [FT_New_Memory_Face](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - on Windows, the host FT_Long is 32 bits, so buffer sizes of 2 GiB or more or below -2 GiB throw before the font buffer is read
+
+- [FT_Outline_Get_Orientation](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI/version and large-outline equivalence are unverified. The adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) with the existing unsigned guest counts and an LP64 area accumulator, including on Windows.
+- [FT_Set_Char_Size](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI, FreeType version and error compatibility are unverified. The name and NID `xuY99Qcb108` are in the [PS5 3.20 inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceFreeTypeOt.c); the LP64 signature and behavior follow bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c), not a console measurement. After applying its defaults and minimum-size clamp, requests whose `dimension * dpi + 36` exceeds the host's signed `FT_Long` range throw before the native call. This is a 32-bit limit on Windows; larger console requests remain unsupported.
+
+- [FT_Get_Gasp](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console FreeType version and query-result compatibility are unverified. The guest face adapter follows bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftgasp.c) and its existing LP64 face bridge.
+
+- [FT_Get_CID_Registry_Ordering_Supplement, FT_Get_CID_Is_Internally_CID_Keyed and FT_Get_CID_From_Glyph_Index](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console ABI/version and CID metadata equivalence are unverified. The adapters follow bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftcid.c) through the existing face bridge; returned registry/ordering strings have the native face's lifetime.
diff --git a/docs/dev/debt/libSceGameCustomDataDialog.md b/docs/dev/debt/libSceGameCustomDataDialog.md
new file mode 100644
index 0000000000..09743a0781
--- /dev/null
+++ b/docs/dev/debt/libSceGameCustomDataDialog.md
@@ -0,0 +1,9 @@
+# libSceGameCustomDataDialog technical debt
+
+### Silent stubs
+
+- [libSceGameCustomDataDialog](../../../core/libs/prx/libSceGameCustomDataDialog/Export.cpp) - the game custom data dialog (`sceGameCustomDataDialogOpenA` and `sceGameCustomDataDialogGetResultA`) runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no PSN game custom data. The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
+
+### Unknown function info
+
+- [sceGameCustomDataDialogGetResult and sceGameCustomDataDialogOpen](../../../core/libs/prx/libSceGameCustomDataDialog/Export.cpp) (libSceGameCustomDataDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceGameCustomDataDialog.c), but Orbital has prototypes only for the `A` variants and no credible prototypes were found for these. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceGameLiveStreaming.md b/docs/dev/debt/libSceGameLiveStreaming.md
index e85a882199..b52bed6644 100644
--- a/docs/dev/debt/libSceGameLiveStreaming.md
+++ b/docs/dev/debt/libSceGameLiveStreaming.md
@@ -2,10 +2,10 @@
 
 ### Functional
 
-- [sceGameLiveStreamingEnableLiveStreaming](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - imported by PS4 titles, which do not load without it, and added without an implementation: declared without parameters, every call throws
+- [sceGameLiveStreamingEnableLiveStreaming](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) - a call outside `sceGameLiveStreamingInitialize` and `sceGameLiveStreamingTerminate` throws, as the module's error for it is not confirmed (`sceGameLiveStreamingTerminate` and `sceGameLiveStreamingGetCurrentStatus2` return `0x80A00004`; [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/src/ps4_libscegamelivestreaming.pas#L18) does not return its `SCE_GAME_LIVE_STREAMING_ERROR_NOT_INITIALIZED` from this call). Otherwise both values are accepted and change nothing, as no broadcast is ever on air. The signature, `int sceGameLiveStreamingEnableLiveStreaming(const bool)`, follows [Orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L810) and [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/src/ps4_libscegamelivestreaming.pas#L111)
 - [libSceGameLiveStreaming](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) - native initialization requires exactly 0x4000 heap bytes before checking repeated initialization. Host lifecycle and pointer errors now match the wrapper, but service registration, allocation failures and asynchronous service readiness are not modelled. The host becomes ready immediately after initialization.
 - [sceGameLiveStreamingGetCurrentStatus2](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) - the supplied module confirms the 72-byte layout and inactive status (user -1, remaining bytes zero). Live service counters, active-user changes and broadcast-resolution conversion are unimplemented.
-- [sceGameLiveStreamingGetProgramInfo](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) - consumes one output pointer and uses a 4940-byte record. Field semantics remain unresolved; the protected body remains unimplemented.
+- [sceGameLiveStreamingGetProgramInfo](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - the PS5 12.00 module clears the 0x134C-byte program info, asks the system service for its first 0xFD4 bytes and returns `0x80A00002` for a null pointer and `0x80A00004` before initialization. With nothing broadcast here the info stays zero, which assumes the service reports an empty program when nothing is on air; the field layout is unknown
 
 ### Unknown function info
 
@@ -18,7 +18,7 @@
 - [sceGameLiveStreamingScreenSetMode](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingPermitLiveStreaming](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingSetMaxBitrate](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
-- [sceGameLiveStreamingGetCurrentStatus](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
+- [sceGameLiveStreamingGetCurrentStatus](../../../core/libs/prx/libSceGameLiveStreaming/include/Api.hpp) - still throws; the meaning, division and SDK types of the first 12 bytes remain unknown. In the supplied `libSceGameLiveStreaming.sprx`, export `CoPMx369EqM` at 0x1810 takes one output pointer, clears 72 bytes, obtains service command 9's status, copies its first 12 bytes and clears bytes 0x0C..0x47. `GameLiveStreamingStatus` exposes this byte storage without assuming the `GetCurrentStatus2` field layout or SDK alignment. The decompiler's extra SIMD parameter is not an input: the assembly initializes the register before use.
 - [sceGameLiveStreamingEnableSocialFeedback](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingGetSocialFeedbackMessagesCount](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
 - [sceGameLiveStreamingGetSocialFeedbackMessages](../../../core/libs/prx/libSceGameLiveStreaming/Export.cpp) (libSceGameLiveStreaming) - unknown signature
diff --git a/docs/dev/debt/libSceGnmDriverForNeoMode.md b/docs/dev/debt/libSceGnmDriverForNeoMode.md
index 46f92c14e9..507eeee80f 100644
--- a/docs/dev/debt/libSceGnmDriverForNeoMode.md
+++ b/docs/dev/debt/libSceGnmDriverForNeoMode.md
@@ -2,8 +2,14 @@
 
 ### Unknown function info
 
-- [libSceGnmDriverForNeoMode pending exports](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) - 70 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceGnmDriverForNeoMode.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceGnmDriverForNeoMode pending exports](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) - 34 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceGnmDriverForNeoMode.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
 
 ### Functional
 
 - [retail-only answers](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - the debug resets, the resource and owner registration calls, the SDMA calls and the SQ counter calls return `0x8EEE00FF`, the five `sceGnmDriverInternalRetrieveGnmInterface*` calls return `0x80000000`, `sceGnmGetDbgGcHandle` returns -1, `sceGnmDriverTraceInProgress` and `sceGnmValidateOnSubmitEnabled` return 0 and the other validation calls return `0x80D13FFF`. These are the values [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp) returns for calls it marks as not available in retail firmware; they are not measured on a console, and the arguments are not read
+- [default state packets](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmDrawInitDefaultHardwareState`, `sceGnmDrawInitDefaultHardwareState200`, `sceGnmDrawInitDefaultHardwareState350`, `sceGnmDrawInitToDefaultContextState` and `sceGnmDrawInitToDefaultContextState400` write the sequences in [InitSequences.hpp](../../../core/libs/prx/libSceGnmDriverForNeoMode/include/InitSequences.hpp), taken from [shadPS4's gnmdriver_init.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver_init.h): its Neo sequences, except the plain hardware state, which shadPS4 also writes unchanged in Neo mode. The size checks and returned sizes are shadPS4's. Not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [draw, dispatch, wait and VGT packets](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - the signatures, size checks, PM4 words and refusals (-1) of the 17 command writers follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp) on its Neo-mode path, since this module is the Neo-mode driver: draw initiators keep flag bits 29 to 31, and `sceGnmSetVgtControl` and `sceGnmResetVgtControl` write `IA_MULTI_VGT_PARAM` through `SET_UCONFIG_REG` (shadPS4's `UseNeoCompatSequences` is false). The packets are not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [embedded shaders](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmSetEmbeddedVsShader` (id 0, a fullscreen triangle) and `sceGnmSetEmbeddedPsShader` (id 0 writes black, id 1 exports depth only) write the register packets of [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp), pointing at the shader code in [EmbeddedShaders.hpp](../../../core/libs/prx/libSceGnmDriverForNeoMode/include/EmbeddedShaders.hpp) in this module's memory instead of the console's `0xfe000f00` area. That code is shadPS4's instruction listing assembled with LLVM 19 `llvm-mc -arch=amdgcn -mcpu=bonaire`, without the binary header and register block that follow it on the console, since nothing here reads them; another id returns `0x8EEE00FF`. The size and modifier arguments are not checked, as in shadPS4. Not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [shader register packets](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmUpdateVsShader`, `sceGnmUpdatePsShader`, `sceGnmUpdatePsShader350`, `sceGnmSetPsShader350`, `sceGnmUpdateGsShader`, `sceGnmUpdateHsShader` and `sceGnmSetCsShaderWithModifier` write the packets, size checks and -1 refusals of [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/gnmdriver/gnmdriver.cpp); the update forms carry context registers inside NOP packets as there. Not compared with console output, and nothing in AnyPS5 consumes a GNM command buffer yet
+- [workloads](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - `sceGnmCreateWorkloadStream`, `sceGnmBeginWorkload` and `sceGnmEndWorkload` return shadPS4's values (3 for a null output or name, 1 for a stream above 15, 2 for workload 0 or one with a top byte above 15) and keep no state; not measured on a console
+- [sceGnmGetGpuCoreClockFrequency](../../../core/libs/prx/libSceGnmDriverForNeoMode/Export.cpp) (libSceGnmDriverForNeoMode) - returns 911 MHz, shadPS4's Neo-mode value, which it derives from Neo mode instead of the console's ioctl. `sceGnmGetOffChipTessellationBufferSize` returns shadPS4's `0x800000`
diff --git a/docs/dev/debt/libSceHmd.md b/docs/dev/debt/libSceHmd.md
index 3af366507e..cf169b2329 100644
--- a/docs/dev/debt/libSceHmd.md
+++ b/docs/dev/debt/libSceHmd.md
@@ -9,6 +9,7 @@
 - [libSceHmd internal and capture exports](../../../core/libs/prx/libSceHmd/Export.cpp) - input/output directions and argument registers are recovered for shared VR2D data, device binding, optical and serial queries, screen status and capture operations. VR2D records are 128 bytes, optical output 16, serial output 16, PU position output 20, crash-dump output 68, audio/video status 32, and reprojection debug outputs 216 or 1136. Payload field meanings and capture callback contracts remain incomplete; these structures use forward declarations.
 
 - [libSceHmd queries without a headset](../../../core/libs/prx/libSceHmd/Export.cpp) (libSceHmd) - the signatures, the distortion work memory (`0x20000`, aligned to `0x400`) and reprojection buffer sizes (garlic `0x100000`, onion `0x810`, both aligned to `0x100`), and the results of `sceHmdGetFieldOfView`, `sceHmdGet2DEyeOffset`, `sceHmdGetInertialSensorData` (`HANDLE_INVALID` once initialized; field of view checks its output for null first) and `sceHmdGetAssyError` (null output, then `DEVICE_DISCONNECTED` once initialized) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/hmd/hmd.cpp) (PS4) with no headset, not a PS5 measurement. Before initialization `sceHmdGetFieldOfView` returns `NOT_INITIALIZED` for a non-null output, where shadPS4 checks the handle first and returns `HANDLE_INVALID`. The third argument of `sceHmdGetInertialSensorData` is unnamed there and taken as a count
+- [libSceHmd VR2D queries](../../../core/libs/prx/libSceHmd/Export.cpp) (libSceHmd) - `sceHmdInternalIsGameVr2d`, `sceHmdInternalIsMiniAppVr2d`, `sceHmdInternalIsCommonDlgVr2d` and `sceHmdInternalIsCommonDlgMiniAppVr2d` return false: nothing runs in VR2D without a headset, and the console answers 0 to the same four queries in libSceHmd2 (`Hmd2BeforeInitializeZero` in [libSceHmd2](libSceHmd2.md)). The libSceHmd answers themselves are not measured.
 - [sceHmdDistortionGetCompoundEyeCorrectionCommand](../../../core/libs/prx/libSceHmd/Export.cpp) returns a constant error without consuming arguments in the supplied module; unused argument types remain unresolved.
 - [sceHmdInternalGetDefaultLedData](../../../core/libs/prx/libSceHmd/Export.cpp) takes an unused handle, a 32-bit mask output and a nine-byte LED output. Output sizes match the paired setter; mask bits and LED payload semantics remain unresolved. The protected body is unchanged.
 
@@ -20,6 +21,6 @@
 
 [Reprojection start signatures](../../../core/libs/prx/libSceHmd/Export.cpp) are recovered, including the five arguments of `StartMultilayer2` hidden by an incomplete decompilation. Standard and wide-near starts take frame parameters, pose, 64-bit flip argument and reserved pointer; overlay variants add an overlay descriptor. The 2D variant takes parameters, flip argument and reserved pointer. Multilayer takes a layer array/count, submission parameters, pose, flip argument and reserved pointer. Frame, pose, overlay and submission field semantics remain incomplete. Protected bodies are unchanged.
 
-[Distortion and 2D VR command queries](../../../core/libs/prx/libSceHmd/Export.cpp) take a 32-bit HMD handle, input descriptor and command-buffer output. The output contains a command pointer at offset zero and a 32-bit dword count at offset eight. Descriptor fields and GPU resource types remain incomplete; the standard, wide-near and 2D descriptors are distinct. Protected bodies are unchanged.
+[Distortion and 2D VR command queries](../../../core/libs/prx/libSceHmd/Export.cpp) take a 32-bit HMD handle, input descriptor and command-buffer output. The output contains a command pointer at offset zero and a 32-bit dword count at offset eight. Descriptor fields and GPU resource types remain incomplete; the standard, wide-near and 2D descriptors are distinct. Without a headset `sceHmdOpen` never issues a handle, so the stored handle stays 0. As firmware 13.42's libSceHmd does when its exports are run under an emulator ([#9577](https://github.com/boykopovar/AnyPS5/pull/9577#issuecomment-6336871370)), the distortion queries return `HANDLE_INVALID` for any other handle before checking initialization, and `NOT_INITIALIZED` for handle 0 before it when the title's compiled SDK version is below 4.50. The 2D VR query first returns `PARAMETER_NULL` for a null descriptor or output or a null pointer at descriptor offset 0, 8 or 0x20, and `PARAMETER_INVALID` for a non-zero field at 0x34 (32-bit) or 0x38 (64-bit). None writes the output. From SDK 4.50 the firmware first checks state the library sets up when it starts, which is not measured ([#9577](https://github.com/boykopovar/AnyPS5/pull/9577#issuecomment-6343495321)), and what handle 0 gets after initialization is not measured either, so both throw.
 
-The ELF export table aliases the [Distortion correction/2D command and work-memory queries](../../../core/libs/prx/libSceHmd/Export.cpp) to their corresponding HMD queries, confirming identical signatures. Distortion initialization consumes only a work-memory pointer. No shader code or calibration constants are copied; protected bodies remain unchanged.
+The ELF export table aliases the [Distortion correction/2D command and work-memory queries](../../../core/libs/prx/libSceHmd/Export.cpp) to their corresponding HMD queries, confirming identical signatures. Distortion initialization consumes only a work-memory pointer. No shader code or calibration constants are copied; each aliased command query answers as its twin, and distortion initialization keeps its protected body.
diff --git a/docs/dev/debt/libSceHmdSetupDialog.md b/docs/dev/debt/libSceHmdSetupDialog.md
index cd9e1a5ae2..1566cbc62a 100644
--- a/docs/dev/debt/libSceHmdSetupDialog.md
+++ b/docs/dev/debt/libSceHmdSetupDialog.md
@@ -1,5 +1,5 @@
 # libSceHmdSetupDialog technical debt
 
-### Unknown function info
+### Silent stubs
 
-- [sceHmdSetupDialogClose, sceHmdSetupDialogGetResult, sceHmdSetupDialogGetStatus, sceHmdSetupDialogInitialize, sceHmdSetupDialogOpen, sceHmdSetupDialogTerminate and sceHmdSetupDialogUpdateStatus](../../../core/libs/prx/libSceHmdSetupDialog/Export.cpp) (libSceHmdSetupDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceHmdSetupDialog.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [libSceHmdSetupDialog](../../../core/libs/prx/libSceHmdSetupDialog/Export.cpp) - the HMD setup dialog runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as no headset is supported (see libSceHmd2). The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
diff --git a/docs/dev/debt/libSceHttp.md b/docs/dev/debt/libSceHttp.md
index 6cc44f2301..e58f4e6694 100644
--- a/docs/dev/debt/libSceHttp.md
+++ b/docs/dev/debt/libSceHttp.md
@@ -13,25 +13,27 @@
 
 - [sceHttpSetCookieEnabled](../../../core/libs/prx/libSceHttp/Export.cpp) - the two-argument signature and 0/1 enable values follow [VitaSDK](https://github.com/vitasdk/vita-headers/blob/master/include/psp2/net/http.h) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.cpp); PPSA01521 passes 0 to disable cookies. Disabling succeeds because the offline HTTP backend has no cookie engine; enabling throws. Invalid enable values use the same error as `sceHttpSetInflateGZIPEnabled`. Like the existing offline HTTP setters, the handle is not validated; requests still fail with the network error. Console behavior is unverified
 - [sceHttpParseResponseHeader](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - signature follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Net/Http.cs); the result, value bounds and error codes follow a payload process on a PS5 (firmware 13.60). Unmeasured there: a bare carriage return, and vertical tab or form feed around the value, which are skipped as blanks before it as before. A value end above `INT_MAX` throws instead of wrapping
-- [sceHttpParseStatusLine](../../../core/libs/prx/libSceHttp/src/Parse.cpp) (libSceHttp) - behaviour and error codes follow the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation of the PS4 library, not confirmed on a PS5 title; unlike it, no byte past `lineLen` is read
-- [sceHttpUriMerge](../../../core/libs/prx/libSceHttp/src/Uri.cpp) (libSceHttp) - signature follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Net/Http.cs); validation, size formula, absolute/relative split and path join follow the disassembly-like body in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.cpp), not confirmed on a PS5 title or hardware. The base URL goes through our `sceHttpUriParse`, which removes dot segments from the base path, while the relative part is appended unswept; base query and fragment are dropped. The relative reference is only classified by its scheme and a leading `//`, and only references with `//` are validated; as in shadPS4, `//host/x` is returned unchanged instead of taking the base scheme, a reference with a scheme but no `//` (`mailto:x`) is joined onto the base directory, and `?q` and `#f` are appended to the base directory instead of the base path.
+- [sceHttpParseStatusLine](../../../core/libs/prx/libSceHttp/src/Parse.cpp) (libSceHttp) - follows a payload process on a PS5 (firmware 13.60) for 124 lines and lengths. As on the console, `lineLen` is only checked to be at least 8 and to leave the 3 code digits (`lineLen - index < 3` in unsigned arithmetic): the version digits and the `.` and space after them are read past `lineLen`, and the line feed is searched up to and including the byte at `lineLen`, so a length that stops right before the line feed still parses. When the version ends past `lineLen` both subtractions wrap and the search goes on until a line feed; what the console does when none follows in readable memory was not measured
+- [sceHttpUriMerge](../../../core/libs/prx/libSceHttp/src/Uri.cpp) (libSceHttp) - signature follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Net/Http.cs); results, errors and `require` (the base's `sceHttpUriParse` size plus 2 and twice the two string lengths, also for a reference copied unchanged) follow a payload process on a PS5 (firmware 13.60). A reference with an authority (`//` after an optional scheme) is copied unchanged; any other, including `mailto:x`, `http:d`, `?q` and `#f`, is appended unswept to the base path up to its last `/`, and the base query and fragment are dropped. A reference that `sceHttpUriParse` rejects returns that error, which was not measured.
+- [sceHttpUriParse](../../../core/libs/prx/libSceHttp/src/Uri.cpp) (libSceHttp) - follows a payload process on a PS5 (firmware 13.60) for every ASCII byte inside a scheme, userinfo and hostname, and for letters, digits, `+`, `-` and `.` at the start of a scheme, where a digit ends it; other bytes at the start of a scheme are taken as they are inside one. The userinfo ends at the first `@` after bytes from the RFC 3986 userinfo set; a hostname is letters, digits, `-`, `_` and `.` without a leading `.`, and the first byte outside it starts the path instead of failing (`http://bad host/` has the host `bad` and the path ` host/`). A port is up to 5 digits that end at `/` or the end, at most 65536, which reads as 0; an empty port takes 443 for a scheme starting with `https`, 80 for one starting with `http` (case-insensitive) and 0 otherwise. The path is swept as `sceHttpUriSweepPath` does, while the pool keeps room for the unswept path. With a pool too small the console returns `ERROR_OUT_OF_MEMORY`, leaves `require` alone and has already written part of the pool; how much is not known, so nothing is written here.
 - [sceHttpUriSweepPath](../../../core/libs/prx/libSceHttp/src/Uri.cpp) (libSceHttp) - follows a payload process on a PS5 (firmware 13.60), which agrees with the [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.cpp) reimplementation of the PS4 library: it is not RFC 3986 5.2.4, a path that doesn't start with `/` is copied unchanged and a trailing `.` or `..` is kept. Like the console, the byte at `srcSize - 1` is read as the `/` that ends a `..` segment, and `srcSize == 1` with a leading `/` writes `/`; whether it also ends a `.` segment was not measured, so a `.` there is still kept as before
 - [sceHttpSetResponseHeaderMaxSize, sceHttpRedirectCacheFlush, sceHttpsUnloadCert](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.cpp) (PS4); no PS5 reference has them
 - [sceHttpSetRequestStatusCallback](../../../core/libs/prx/libSceHttp/Export.cpp) - the three-argument ABI follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.cpp). Registrations and user data are retained and removed on request deletion; the offline backend never dispatches callbacks. Invalid ids return `0x80431100`, an uncited assumption, not a verified console error. Handle hierarchy, inheritance and deleted-handle validation remain incomplete; callback statuses and dispatch timing are unknown.
 - [sceHttpSetRedirectCallback, sceHttpSetCookieRecvCallback, sceHttpsSetSslVersion, sceHttpsGetSslError](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.cpp) (PS4), which only logs and returns 0; a null `errNum` or `detail` in `sceHttpsGetSslError` is assumed to return `SCE_HTTP_ERROR_INVALID_VALUE` like `sceHttpGetLastErrno`
 - [sceHttpSetAuthInfoCallback](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - signature and callback type follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/http.h) (PS4); no PS5 reference has them. The `id` is not checked, as in the other libSceHttp setters
 - [sceHttpWaitRequest](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the timeout is assumed to be in microseconds and a negative timeout to wait without limit; the invalid-value error for a null handle or event array or a non-positive event count is assumed, not measured. No request is ever pending, so a wait returns 0 events when its timeout passes
-- [sceHttpUriCopy](../../../core/libs/prx/libSceHttp/src/Uri.cpp) (libSceHttp) - read from the disassembly of libSceHttp.sprx on firmware 13.60, not measured on a console and not compared with other emulators. The arguments are (out, src, pool, prepare, require), `prepare` before `require`, the reverse of `sceHttpUriParse`. A null source returns `ERROR_INVALID_URL`; without an output or a pool, a null `require` returns `ERROR_INVALID_VALUE`, otherwise the size is only reported. Only the scheme, hostname, path, username and password are copied, in that order, each with its terminator (a missing one becomes an empty string and takes one byte), and the port; the query, the fragment and the opaque flag stay 0. A pool that is too small clears the output and the pool and returns `ERROR_OUT_OF_MEMORY` (0x80431022, the console's out-of-size error)
+- [sceHttpUriCopy](../../../core/libs/prx/libSceHttp/src/Uri.cpp) (libSceHttp) - unverified: whether the strings are written before the size check, which a short pool hides by ending cleared. The rest follows a payload process on a PS5 (firmware 13.60): the arguments are (out, src, pool, prepare, require) as in the disassembly; the whole output and all `prepare` pool bytes are cleared before the source is read, so a source that is the output or lies in the pool copies as empty; the scheme, hostname, path, username and password are copied in that order with terminators, a null one as empty, and the port, while the query, fragment and opaque flag stay 0; a short pool returns 0x80431022 and leaves `require` alone; a null source returns 0x80433060, and no output or pool with a null `require` 0x804311FE
 - [sceHttpDbgEnableProfile](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the export is absent from the supplied native module; its signature remains unresolved.
 - [sceHttpDbgSetPrintf](../../../core/libs/prx/libSceHttp/Export.cpp) returns constant success without consuming arguments in the supplied module; the callback contract remains unresolved.
 - [sceHttpDbgShowStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
 - [sceHttpDbgShowConnectionStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
 - [sceHttpDbgShowRequestStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
 - [sceHttpDbgShowMemoryPoolStat](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - the native diagnostic consumes no arguments; it prints library state. The throwing implementation remains unchanged.
+- [sceHttpGetMemoryPoolStats](../../../core/libs/prx/libSceHttp/Export.cpp) (libSceHttp) - not measured on a console. The library takes nothing from the pool given to `sceHttpInit`, so it reports that size with peak and current use 0, where a console already holds bytes for a live context (0x1640 for Http2, see libSceNet). No live context returns `BEFORE_INIT` (0x80431001) and an unknown or terminated id `INVALID_ID` (0x80431100), as in `sceHttpCookieFlush`, with the output untouched; both codes are unmeasured. A null output throws, as its error code is unknown. Only the 24 bytes of the declared layout are written; [SharpProspero's struct](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs#L398-L413) adds a 32-bit reserved field after them
 
 ### Functional
 
-- [sceHttpUriParse, sceHttpUriBuild, sceHttpUriMerge](../../../core/libs/prx/libSceHttp/src/Uri.cpp) - console behavior for non-ASCII scheme and hostname bytes remains unmeasured. ASCII character classification and scheme case folding follow [RFC 3986 sections 3.1 and 3.2](https://www.rfc-editor.org/rfc/rfc3986#section-3.1), independently of the host locale; parsing retains the existing C-locale rejection of those bytes.
+- [sceHttpUriParse, sceHttpUriBuild, sceHttpUriMerge](../../../core/libs/prx/libSceHttp/src/Uri.cpp) - bytes 0x80 to 0xFF were measured only as 0x80, 0xC3 and 0xFF in a hostname; the others, and any of them in a scheme or userinfo, are taken as the measured ASCII bytes outside those sets are. ASCII classification and scheme case folding are independent of the host locale. A bracketed host such as `[::1]` is parsed, merged and built without its brackets, as a PS5 (firmware 13.60) does; a PS4 (firmware 10.71) takes no bracketed host (`http://[::1]x/` has an empty host and the path `[::1]x/`) and keeps `[::1]:80` in a merge, as measured in #9058, so this follows the PS5 only.
 
 - [sceHttpUriEscape](../../../core/libs/prx/libSceHttp/src/Uri.cpp) escapes every byte except the ASCII unreserved set in [RFC 3986 section 2.3](https://www.rfc-editor.org/rfc/rfc3986#section-2.3), independently of the host locale. Console behaviour for non-ASCII input remains unmeasured.
 
diff --git a/docs/dev/debt/libSceImeDialog.md b/docs/dev/debt/libSceImeDialog.md
index 58f32f8d68..84726f50bc 100644
--- a/docs/dev/debt/libSceImeDialog.md
+++ b/docs/dev/debt/libSceImeDialog.md
@@ -6,7 +6,8 @@
 
 ### Unknown function info
 
-- [sceImeDialogForTestFunction, sceImeDialogGetCurrentStarState, sceImeDialogInitInternal, sceImeDialogSetPanelPosition](../../../core/libs/prx/libSceImeDialog/Export.cpp) (libSceImeDialog) - their signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/ime/ime_dialog.h#L34-L51), not measured on a console. They are declared solely to resolve known imports, `sceImeDialogForTestFunction` without parameters and the others with shadPS4's parameters; this is not an ABI claim, and every call throws.
+- [sceImeDialogForTestFunction](../../../core/libs/prx/libSceImeDialog/Export.cpp) (libSceImeDialog) - declared without parameters to resolve a known import, following [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/ime/ime_dialog.h#L34-L51); not measured on a console and not an ABI claim.
+- [sceImeDialogGetCurrentStarState, sceImeDialogInitInternal, sceImeDialogSetPanelPosition](../../../core/libs/prx/libSceImeDialog/Export.cpp) (libSceImeDialog) - not measured on a console; signatures and checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/ime/ime_dialog.cpp). `sceImeDialogInitInternal` runs `sceImeDialogInit`, as shadPS4's two share one path apart from user flags this library does not keep. There is no movable panel, so `sceImeDialogSetPanelPosition` never succeeds: `DIALOG_NOT_IN_USE` without a dialog and `IME_SUSPENDING` while one is running or finished, the states in which shadPS4 refuses it too. The star state is always 0
 - [sceImeDialogForceClose](../../../core/libs/prx/libSceImeDialog/Export.cpp) (libSceImeDialog) - not measured on a PS5: its `int (void)` signature and behaviour follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/ime/ime_dialog.cpp#L571-L601) (PS4). It closes a running or finished dialog, as `sceImeDialogTerm` does, without writing the typed text to the title's buffer, which shadPS4 updates while typing and this library only on Enter, and returns `0x80bc0107` with no dialog open, the `NotInUse` code of [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Dialog/ImeDialog.cs#L224-L225), while this library's `sceImeDialogTerm` returns `0x80bc0002` in the same state. Closes when: measured on a PS5
 - [sceImeDialogInit, sceImeDialogGetStatus, sceImeDialogGetResult, sceImeDialogAbort, sceImeDialogTerm](../../../core/libs/prx/libSceImeDialog/Export.cpp) (libSceImeDialog) - the statuses (none 0, running 1, finished 2), the end statuses (ok 0, user canceled 1, aborted 2) and the errors of `sceImeDialogInit` for an open dialog (`0x80bc0001`), a null parameter (`0x80bc0031`), a maximum text length outside 1 to 2048 (`0x80bc0016`) and a null text buffer (`0x80bc0017`) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/b2d7ec7d31f9ad9426db93afe079db8679b3e1e0/src/core/libraries/ime/ime_dialog.cpp); none is measured on a PS5. A result, abort or term on a dialog that is not finished, running or open returns `0x80bc0002`, where shadPS4 returns `0x80bc0105` to `0x80bc0107`, and `sceImeDialogTerm` also closes a running dialog, which shadPS4 refuses. The text reaches the title's buffer only when Enter accepts it
 
diff --git a/docs/dev/debt/libSceInvitationDialog.md b/docs/dev/debt/libSceInvitationDialog.md
new file mode 100644
index 0000000000..9038d9da62
--- /dev/null
+++ b/docs/dev/debt/libSceInvitationDialog.md
@@ -0,0 +1,6 @@
+# libSceInvitationDialog technical debt
+
+### Unknown function info
+
+- [sceInvitationDialogGetResult](../../../core/libs/prx/libSceInvitationDialog/include/Api.hpp) - still throws; SDK field names and types at offsets 0x00 and 0x0C are unknown. In the supplied `libSceInvitationDialog.sprx`, export `8XKR6wa64iQ` at 0xFF0 takes one result pointer, checks reserved bytes 0x18..0x37 and writes the returned status at 0x08. The helper at 0x410 copies eight bytes from the saved open parameter to 0x00 and eight result bytes to 0x08, then copies 20-byte online IDs through the pointer at 0x10, after a four-byte count. Validation at 0xC20 limits recipients to 1..16. `InvitationDialogRecipients` provides the accessed 324-byte storage; any unused SDK tail is unverified. `InvitationDialogResult` provides the accessed 56 bytes, with unknown fields kept opaque; this is not a recovered SDK source declaration.
+- [sceInvitationDialogClose](../../../core/libs/prx/libSceInvitationDialog/Export.cpp) (libSceInvitationDialog) - imported by PS4 titles, which do not load without it, and added without an implementation: declared without parameters, every call throws
diff --git a/docs/dev/debt/libSceIpmi.md b/docs/dev/debt/libSceIpmi.md
index 09625b0ec9..e1d0461397 100644
--- a/docs/dev/debt/libSceIpmi.md
+++ b/docs/dev/debt/libSceIpmi.md
@@ -2,4 +2,6 @@
 
 ### Unknown function info
 
+- [libSceIpmi pending exports](../../../core/libs/prx/libSceIpmi/PendingExports.cpp) - 49 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceIpmi.c). Their signatures and behavior are unverified; the no-parameter declarations exist for import resolution and throw through `NotImplemented_nid_no_patch`.
+
 - [libSceIpmi pending exports](../../../core/libs/prx/libSceIpmi/Export.cpp) - 5 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceIpmi.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
diff --git a/docs/dev/debt/libSceJemspace.md b/docs/dev/debt/libSceJemspace.md
new file mode 100644
index 0000000000..c0baf800a1
--- /dev/null
+++ b/docs/dev/debt/libSceJemspace.md
@@ -0,0 +1,5 @@
+# libSceJemspace technical debt
+
+### Unknown function info
+
+- The thirteen exports in [Export.cpp](../../../core/libs/prx/libSceJemspace/Export.cpp) resolve imports only and throw through `NotImplemented_nid_no_patch`. Each declared name hashes to a defined function NID in the `libSceJemspace` ELF export table. The module firmware version is unverified. The no-parameter declarations do not establish argument layouts or return types. No allocator behavior, memory ownership, allocation failure handling, statistics layout, or console compatibility is implemented or verified.
diff --git a/docs/dev/debt/libSceJobManager.md b/docs/dev/debt/libSceJobManager.md
index 123977e935..06f7ba4aac 100644
--- a/docs/dev/debt/libSceJobManager.md
+++ b/docs/dev/debt/libSceJobManager.md
@@ -2,4 +2,8 @@
 
 ### Functional
 
-- [sce::Job::JobManager](../../../core/libs/prx/libSceJobManager/Export.cpp) (libSceJobManager) is written from the disassembly of the copies PPSA01474 and PPSA36082 ship in `sce_module`, and `guest_job_manager_tests` passes against both of those modules as well: the memory size formula, the error codes, sync point ordering, the per-sequence limits and the priority order are the original's. Compute sequences submit through `sceAgcDriverSubmitAcb` on the queue their mask bit selects and are checked the same way by `agc_driver_job_manager_compute_tests`: results, ordering against CPU dispatches and sync points, limits and sizes match the two modules. The command stream is simpler than the original's: every compute dispatch is submitted with its own label write and interrupt, where the original batches the label write and rewinds commands it encoded ahead, and the command buffers and labels live on the host heap. The per-queue command size in `calculateRequiredMemorySize` is a constant (104, 148 and 32 bytes per dispatch, sync point and wait), which is what the original measures by running the builders of this project's libSceAgc. A compute dispatch on a CPU sequence throws (the original does not check), and a failing `sceAgcDriverAddEqEvent` throws. `shutdown` throws while a compute sequence has work in flight, a sequence's label total is written as 32 bits, and since the label is host memory no GPU import covers, the driver drains recorded work before each label write. The manager's state lives on the host heap, with only the block header written to the title's memory; the original keeps everything in that block, and a block smaller than 0x2d8 bytes throws here. The worker sleep policy, the spin count and the persistent thread count are validated and stored but change nothing, a factory priority above 1 throws, `shutdown` throws while a thread is blocked in a sequence wait, and using a sequence after its `destroy` throws. `initialize` returns 0 where the original returns the result of its last import (`BG26hBGiNlw`, not resolved to a name), the `sceRazorCpuJobManager*` profiler calls are not made, and a worker thread that cannot be created or configured throws where the original does not check. The order of the sequence and factory virtual functions is read from the modules' vtables only, since no title that calls them has been run
+- [sce::Job::JobManager](../../../core/libs/prx/libSceJobManager/Export.cpp) submits commands as work becomes runnable rather than encoding ahead with the rewind protocol recovered from PPSA06888's module (offsets 0x2210 and 0x2650). Commands are recycled after a completed wait. Command capacity is a separate bound from the dispatch count: the native size query measures one register and a 31-character marker, then its exhaustion callback at 0x29d0 traps instead of growing storage. The fallback throws. Original-module execution with the host AGC builders accepts two dispatches with 255 registers and 65,535-character markers, then traps on a third. Console timing equivalence remains unverified.
+- The [manager](../../../core/libs/prx/libSceJobManager/Export.cpp) keeps scheduling state and nodes on the host heap; only the header, compute commands and completion labels occupy the caller's block. Blocks smaller than 0x2d8 bytes throw. Worker parking uses host mutexes and condition variables instead of native atomic queues and semaphores; console scheduling and spin timing are unverified. Spin intervals use unscaled host TSC, while the original module reads scaled guest TSC under the host-only `APS5_TIME_SCALE` diagnostic.
+- [Sequence and manager operations](../../../core/libs/prx/libSceJobManager/Export.cpp) throw on a compute dispatch on a CPU sequence, a failing `sceAgcDriverAddEqEvent`, a factory priority above 1, and use of a destroyed sequence. `shutdown` throws while compute work is in flight or a caller is blocked in a sequence wait. Worker creation and attribute failures throw where the original does not check.
+- [`initialize`](../../../core/libs/prx/libSceJobManager/Export.cpp) returns 0 instead of the result of the final object-registration import (`BG26hBGiNlw`, `_sceUlobjmgrRegisterObject`). The `sceRazorCpuJobManager*` profiler calls are not made. Sequence and factory virtual-function order is recovered from module vtables; no calling title has been run.
+- The [fallback](../../../core/libs/prx/libSceJobManager/Export.cpp) differs from the owned module under host kernel services. Native Wait can stall allocating from an exhausted global node pool; the fallback deliberately needs no Wait node and recycles nodes. The owned module also stalls in the zero-spin, zero-persistence `worker_wait` fixture on Windows and Linux, while the fallback wakes a spare worker and completes the child. Console behavior for these cases is unverified. The [reference runner](../../../tools/run_job_manager_reference.py) on this branch supports Windows only; failures remain failures, and Linux runner support follows in #10272.
diff --git a/docs/dev/debt/libSceJpegEnc.md b/docs/dev/debt/libSceJpegEnc.md
index d64816c332..28c35b84a2 100644
--- a/docs/dev/debt/libSceJpegEnc.md
+++ b/docs/dev/debt/libSceJpegEnc.md
@@ -2,4 +2,4 @@
 
 ### Unimplemented functionality
 
-- [sceJpegEncEncode](../../../core/libs/prx/libSceJpegEnc/Export.cpp) (libSceJpegEnc) - MJPEG mode throws; its encoding path is not implemented. Restart intervals are confirmed by the native validator, MCU counter and DRI writer: 0 disables restart markers, -1 selects one MCU row, and 1 through 65535 specify an MCU count. Other values return the invalid-parameter error.
+- [sceJpegEncEncode](../../../core/libs/prx/libSceJpegEnc/Export.cpp) (libSceJpegEnc) - MJPEG mode throws; its encoding path is not implemented. Restart intervals are confirmed by the native validator, MCU counter and DRI writer: 0 disables restart markers, -1 selects one MCU row, and 1 through 65535 specify an MCU count. Other values return the invalid-parameter error. A successful call returns the JPEG's size, as a PS4 Pro (firmware 10.71) does; this is not confirmed on a PS5; the size itself comes from this encoder, so it differs from the console's for the same image (the console 633 bytes, this encoder 650, for an 8x8 RGBA image at 4:2:0).
diff --git a/docs/dev/debt/libSceJson2.md b/docs/dev/debt/libSceJson2.md
index 4868db14d0..bb2d163782 100644
--- a/docs/dev/debt/libSceJson2.md
+++ b/docs/dev/debt/libSceJson2.md
@@ -2,11 +2,83 @@
 
 ### Unknown function info
 
+- [JSON real-number conversion](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) uses locale-independent `to_chars` with 17 significant digits and `from_chars`, following JSON's decimal-point grammar in RFC 8259 section 6. Out-of-range input falls back to a classic-locale stream so underflow retains the prior signed-zero behavior and overflow throws. Console rounding and formatting are unverified.
+- [sce::Json::Array::pop_front](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - removes and destroys the first element; on an empty array it throws `std::out_of_range`, as `front` and `back` do here. The console's result for an empty array is unverified.
 - [sce::Json::Parser::parse](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - a null text pointer with nonzero size throws instead of being dereferenced. A number that overflows a double (e.g. `1e309`) throws: whether the console rejects the document or stores an infinite real is unknown. Syntax validation for number tokens and destination state after a failed parse still differ from the system parser
 - [sce::Json::InitParameter2, InitParameterRtti and InitParameterRtti2](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - RTTI allocator adaptation and the `InitParameterRtti` layout remain unverified. `setAllocatorRtti` stores the raw allocation-parameter pointer as the allocator; `initialize` ignores allocator, buffer-size and special-float settings. Special-float enum meanings and parser support for non-finite numbers remain unresolved; serialization of non-finite values throws. Setter return types remain unverified.
 - [sce::Json::Object::Pair, sce::Json::Array::iterator and sce::Json::Object::iterator members](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the signatures follow the mangled names, with `Array::iterator::operator++(int)` and `Object::iterator::operator++(int)` returning their copy through a result pointer before `this` as `begin` does, since the iterators have non-trivial destructors. `Pair(const String&, const Value&)` and default `Pair()` deep-copy or initialize into the layout `Object` iteration already hands out (key at 0, value at 0x10) and zeroes the 8 bytes between them; what the console keeps there is unknown.
 - [sce::Json::Value::setTypeMismatchHandler, setElementAccessFailureHandler and setSpecialFloatHandler](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - members of `Value` that return an int, inferred from a caller that registers them on its root `Value` before parsing into it, with the handler and its context, and accepts 0 or 0x80848104 as success; they return 0. The PS Vita library's `Value::setNullAccessCallback` is such a member too ([vitasdk](https://github.com/vitasdk/vita-headers/blob/15605617cbbb23d266f88af28899fdb573e2355e/include/psp2/json.h#L638)). The handler signatures follow the mangled names. A handler applies to the `Value` it is set on and to the values that `Value` holds then, and `Parser::parse` gives the values it creates the handlers of the `Value` it parses into, since the title reads the errors its handlers record after accessing parsed members; copies, `push_back` and `Object::operator[]` do not carry them, and how the console finds the handler of an accessed value is unknown. A typed getter on a non-null value of another type calls the type mismatch handler with the requested type, the value, null and the context, and returns the value the handler returns if it has the requested type, else the getter's default; passing null as the third handler argument (the second `Value` pointer), and the order of the two `Value` pointers, remain unverified against the console. The element access failure handler is not called: a failed `operator[]` or `getValue` on a value carrying it throws, as the error code the console passes, which the title records as its error, is unknown; without one the access still reaches the null-access callback. The special float handler is not called: serializing a non-finite real throws with or without it, as the `FunctionType` values and the `bool*` output are unknown, and the title's handler returns a different replacement for each of its two types
 - [sce::Json::MemAllocator::notifyError](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the base class's virtual does nothing. A title's allocator that does not override it calls it through its own vtable; the library never calls the title's allocator, so it never reports an allocation failure. Whether the console's base implementation logs anything is unknown
 - [sce::Json::String size, capacity, resize, append(const char*, size_t), operator+=](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - storage uses `std::string`; capacity and allocation growth do not match the system 32-bit capacity and allocator settings. Appending null text with a nonzero length throws instead of dereferencing it.
+- [sce::Json::String at, find and rfind](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the return types follow the PS Vita library's `String` ([vitasdk](https://github.com/vitasdk/vita-headers/blob/15605617cbbb23d266f88af28899fdb573e2355e/include/psp2/json.h#L338)) and the search follows `std::string`. `at` past the end and a null text or `String` throw; what the console returns or does there is unverified.
 - [sce::Json::Array::iterator::advance and Object::iterator members](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - the return type of `advance` remains unverified. Object iterator advancement past the end throws instead of asserting. Dereferencing an empty array iterator throws instead of returning the system null-value pointer or an invalid address.
 - [sce::Json::Value::operator bool](../../../core/libs/prx/libSceJson2/Export.cpp) (libSceJson2) - callback dispatch before conversion is not implemented. The system library invokes the applicable type mismatch handler before converting a non-boolean value, with SDK-dependent global callback handling.
+
+### Unknown 3.20 import declarations
+
+- [_ZN3sce4Json11Initializer24setAllocatorInfoCallBackEPFviNS0_9ValueTypeEPvES3_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `R996H0YIhiQ` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json11Initializer28setGlobalSpecialFloatHandlerEPFKNS0_5ValueENS0_12FunctionTypeEdPS3_PvPbES6_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `i1393UBWu1U` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json11Initializer28setGlobalTypeMismatchHandlerEPFRKNS0_5ValueENS0_9ValueTypeEPS3_S6_PvES7_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `tck9g-yOqPg` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json11Initializer36setGlobalElementAccessFailureHandlerEPFviPKNS0_6StringEPKmPKNS0_5ValueES9_PvESA_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `j8Q7SBgMm28` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json11InitializerC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `6qFqND4iwPA` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json11InitializerD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `qQZGdYkEytk` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json12MemAllocatorD0Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `ypazoTrKYhE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json12MemAllocatorD1Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `O1uwoqazS2A` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json17InitParameterRttiC2EPNS0_14AllocParamRttiEPvm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Mp8DPb3M4I0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json19InternalInitializer19terminate_staticlibEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `dvp2zGSQzMs` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json19InternalInitializer20initialize_staticlibEPKNS0_13InitParameterENS1_10InitOptionE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `BPSPc3pUMJo` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json19InternalInitializerC1Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `WntRKhYTmZw` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json19InternalInitializerC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `2n+fxNdSZfs` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json19InternalInitializerD1Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `yudT4-bglko` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json19InternalInitializerD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `caP-y4fH-zQ` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json4FreeEPv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `bnk+edDbqMk` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array10push_frontERKNS0_5ValueE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `MQxDxBzWz40` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array5eraseERKNS1_8iteratorE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `2mbVAtshWRI` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array6insertERKNS1_8iteratorERKNS0_5ValueE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `ixJAz92H1uE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array8iteratorC2ERKS2_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Hdc3DSIsG2I` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array8iteratorC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `JSg1MSo7NKE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array8iteratorD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `9niNrXsF3Bc` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array8pop_backEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `woec1toi4Xw` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Array9pop_frontEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `pPs3qZTZQvQ` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ArrayC2ERKS1_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `6NlbpyIfUuY` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ArrayC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `t6AHhkWu4mY` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ArrayD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `MIyMPw7YTGM` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value11referStringEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `m5J28iw-QPs` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value12referBooleanEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `QxjfcfBhEdc` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value12referIntegerEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `R0ac5QOdlpo` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value13referUIntegerEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Nx5tez4siL4` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value9referRealEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `t7UEJrhojhk` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value9serializeEPFiRNS0_6StringEPvES4_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `PyMbL9F2oBY` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5Value9serializeERNS0_6StringEPFiS3_PvES4_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `l1URiQJlSoU` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2ENS0_9ValueTypeE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `PWm9MyJJVqU` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2EPKc](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `+hHa4QYtLY8` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2ERKNS0_5ArrayE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `VH9dsKpQTmk` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2ERKNS0_6ObjectE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `JXlrCLLCLmc` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2ERKNS0_6StringE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `veNviXt6wC0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2ERKS1_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `TZyuFeGuw9Y` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2Eb](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `OK4Ot0ue7J0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2Ed](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `23nm4oXHlfI` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2El](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `EjxUpzR2Yx8` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2Em](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `cqucBPSeVDA` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `-wa17B7TGnw` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json5ValueD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `0eUrW9JAxM0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6MallocEm](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Xzy0onDzSAc` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Object4PairC2ERKNS0_6StringERKNS0_5ValueE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `lt3J4dPvEtM` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Object4PairC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Wu-urs6MMpQ` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Object4PairD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `TM0Sj+Ebins` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Object8iteratorC2ERKS2_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `r5CShmcua+M` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Object8iteratorC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `OxO+V0ouoS4` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Object8iteratorD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `patTzc7zBjw` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6ObjectC2ERKS1_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `tSRqQ-+Y4PE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6ObjectC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `SkKczWHdklc` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6ObjectD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `1siRBursJjw` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6Parser5parseERNS0_5ValueEPKc](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `LB3jxppxyKU` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6StringC2EPKc](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `N78gkQzXRL4` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6StringC2ERKS1_](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `gALFgNfF+9I` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6StringC2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `eG9E9M6XvTM` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZN3sce4Json6StringD2Ev](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Ui7YFnSTCBw` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZNK3sce4Json14InitParameter211getUserDataEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `GWtzpTKbZ+0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZNK3sce4Json14InitParameter212getAllocatorEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `BykPm1ajcM0` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZNK3sce4Json14InitParameter217getFileBufferSizeEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `Pcg6xQUhq9E` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZNK3sce4Json14InitParameter225getSpecialFloatFormatTypeEv](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `PDkib0zyABg` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
+- [_ZNK3sce4Json5ValueixERKNS0_6StringE](../../../core/libs/prx/libSceJson2/InventoryExports.cpp) (libSceJson2) - NID `clF7J7N9xXE` from the PS5 3.20 export inventory; prototype and behavior are unverified. Declaration is for import resolution only.
diff --git a/docs/dev/debt/libSceJxr.md b/docs/dev/debt/libSceJxr.md
index 20faabeefb..0fbc29eb6c 100644
--- a/docs/dev/debt/libSceJxr.md
+++ b/docs/dev/debt/libSceJxr.md
@@ -2,4 +2,8 @@
 
 ### Unknown function info
 
-- [libSceJxr pending exports](../../../core/libs/prx/libSceJxr/Export.cpp) - 4 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceJxr.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceJxr pending exports](../../../core/libs/prx/libSceJxr/Export.cpp) - 4 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceJxr.c) and were cross-checked against the same module in PS5 firmware 13.60. `PixelFormatLookup`, `readIS` and `writeIS` have unverified signatures and behaviour; their declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+
+### Functional
+
+- [PKFree](../../../core/libs/prx/libSceJxr/Export.cpp) (libSceJxr) follows Microsoft's jxrlib [JXRGlue.c](https://github.com/4creators/jxrlib/blob/f7521879862b9085318e814c6157490dd9dbbdb4/jxrgluelib/JXRGlue.c#L53-L62), whose four exported names the module shares: a non-null `ppv` has `*ppv` released with the guest `free` and set to null, and the result is always `WMP_errSuccess` (0) as a 64-bit `ERR` (`long`). That the console's module is built from jxrlib, and that its `PKFree` releases through libc's `free`, is inferred from the export names and not checked against the console's code. Closes when: the console's `PKFree` is disassembled or measured on a PS5
diff --git a/docs/dev/debt/libSceKeyboard.md b/docs/dev/debt/libSceKeyboard.md
index 60edc36b24..ba3dcb499f 100644
--- a/docs/dev/debt/libSceKeyboard.md
+++ b/docs/dev/debt/libSceKeyboard.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): the original validates HID usages 4 through 231 before the handle and preserves unconverted HID usages in the output with `processed == 0`. The host instead accepts out-of-range usages and writes zero for unconverted keys. The original ignores the Kana LED, while the host throws for it. This partially implemented function contains `NotImplemented_nid_no_patch(__func__)`; its body is preserved under the requested restriction.
+- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): the original validates HID usages 4 through 231 before the handle and preserves unconverted HID usages in the output with `processed == 0`. The host instead accepts out-of-range usages and writes zero for unconverted keys. The original ignores the Kana LED, while the host throws for it. This partially implemented function contains `NotImplemented_nid_no_patch(__func__)`; its body is preserved under the requested restriction. One title (PPSA15246) disassembled for this entry calls it once with an output buffer cleared to 24 bytes, uses a character only when the result is 0 and the first output byte is nonzero, and then reads the 16-bit value at offset 8, which agrees with `processed` and `char_code` as laid out here. Which other output fields it reads and what its other arguments mean are not shown.
 
 ### Unknown function info
 
diff --git a/docs/dev/debt/libSceLibcInternal.md b/docs/dev/debt/libSceLibcInternal.md
index ff8c271f1f..b1cb33da7a 100644
--- a/docs/dev/debt/libSceLibcInternal.md
+++ b/docs/dev/debt/libSceLibcInternal.md
@@ -7,6 +7,7 @@
 
 ### Functional
 
+- [std::filesystem::_Xfilesystem_error](../../../core/libs/prx/libSceLibcInternal/Filesystem.cpp) (libSceLibcInternal, NIDs `B0CeIhQty7Y` and `C6-7Mo5WbwU`) - both overloads still throw `NotImplemented`: on the console they throw `std::filesystem::filesystem_error`, whose guest type information and layout this library does not provide yet. The filesystem primitives beside them follow the PS5 13.60 module
 - [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) follows FreeBSD 11's `lib/libc/amd64/gen/makecontext.c`: at most six arguments, a stack of at least `MINSIGSTKSZ` (2048) bytes, and `exit(0)` when the function returns with no `uc_link`. The console's version is not verified
 - [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) on Windows pins its stack writable until a later `makecontext` stack overlaps it, since nothing tells the library when the guest frees the stack
 - [Thread exit destructors](../../../core/libs/prx/libSceLibcInternal/Export.cpp) (libSceLibcInternal) run when a libkernel thread finishes; on the main or a host thread only `_sceLibcInternalThreadDtors` runs them, as `exit` does, else they are dropped
@@ -16,4 +17,6 @@
 - [getopt, getopt_long](../../../core/libs/prx/libSceLibcInternal/Getopt.cpp) (libSceLibcInternal) follow FreeBSD 11 [getopt.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/getopt.c) and [getopt_long.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/getopt_long.c) with `GNU_COMPATIBLE`: `getopt` does not permute, `getopt_long` permutes unless `POSIXLY_CORRECT` is set in the guest environment or the option string starts with `+`, and the exported `opterr`, `optind`, `optopt`, `optreset` and `optarg` start at 1, 1, 0, 0 and null. Warnings go to the guest's current `stderr` prefixed with `__progname`, where FreeBSD's `warnx` keeps the `stderr` of its first call. A null `getopt` option string, a null argument vector or argument, a negative `optind` and an `optind` moved inside a pending permutation throw where FreeBSD faults. `getopt_long_only` is not exported. That the console's `libSceLibcInternal` uses this FreeBSD code is unverified
 - [posix_spawnattr_getflags, getpgroup, getschedparam, getschedpolicy, getsigdefault, getsigmask, setpgroup, setschedparam, setschedpolicy and setsigmask](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp) (libSceLibcInternal) read and write the 0x30-byte attribute object at the offsets of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x8D860 to 0x8D910: flags at 0, process group at 4, scheduling parameter at 8, policy at 0xC, default and masked signal sets at 0x10 and 0x20), which never fail there and return 0; the layout matched on a PS5 (firmware 13.60). Uninitialized attributes and null pointers, which the console dereferences, throw as the existing setters do
 - [sys_siglist and sys_nsig](../../../core/libs/prx/libSceLibcInternal/SignalList.cpp) (libSceLibcInternal) hold the 32 descriptions and the count of [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/siglist.c#L73-L107) `siglist.c` (`NSIG` 32, signal 0 to `SIGUSR2`); the console's table was not read
+- [_err, _warn](../../../core/libs/prx/libSceLibcInternal/Err.cpp) and [_getprogname](../../../core/libs/prx/libSceLibcInternal/Export.cpp) (libSceLibcInternal) are assumed to be the same functions as `err`, `warn` and `getprogname` and run their code; the console's module was not read. FreeBSD 11.4 defines the underscore names and makes the public names weak references to them ([`_err`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/err.c#L70-L79), [`_warn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/err.c#L135-L144), [`_getprogname`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/getprogname.c#L10-L17))
 - [inet_aton, inet_addr, inet_ntoa and inet_ntoa_r](../../../core/libs/prx/libSceLibcInternal/Inet.cpp) (libSceLibcInternal) follow the FreeBSD code in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x8ADE0 to 0x8B3D0) and matched it on a PS5 (firmware 13.60) for 20 `inet_aton` inputs; a null text, which the console dereferences, throws. `inet_ntoa_r` formats through libkernel's `__inet_ntop`, so a null buffer with room for the text throws and a null buffer that is too small sets `ENOSPC`, as `__inet_ntop` does for a null destination; the console's `inet_ntoa_r` was not measured with a null buffer
+- [__inet_ntoa_r](../../../core/libs/prx/libSceLibcInternal/Inet.cpp) (libSceLibcInternal) was not measured on the console: it runs `inet_ntoa_r`, as FreeBSD 11.4 names the function `__inet_ntoa_r` ([arpa/inet.h](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/include/arpa/inet.h#L129)) and makes `inet_ntoa_r` a weak alias of it ([inet_ntoa.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/inet/inet_ntoa.c#L62-L76))
diff --git a/docs/dev/debt/libSceLibreSsl.md b/docs/dev/debt/libSceLibreSsl.md
index b8330484a5..f0d6d1c3bb 100644
--- a/docs/dev/debt/libSceLibreSsl.md
+++ b/docs/dev/debt/libSceLibreSsl.md
@@ -2,4 +2,9 @@
 
 ### Unknown function info
 
-- [libSceLibreSsl pending exports](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - 399 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceLibreSsl pending exports](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - 357 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [MD4, MD5, SHA1, SHA224, SHA256, SHA384 and SHA512 Init/Update/Final and SHA256](../../../core/libs/prx/libSceLibreSsl/src/Digest.cpp) (libSceLibreSsl) - signatures and context layouts follow the [LibreSSL headers](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha/sha.h), and buffering and `Final` follow its [sources](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha); the module's LibreSSL version is unknown and nothing is checked on the console. Behaviour that differs between LibreSSL versions throws: `SHA256` with a null digest buffer (older versions return a static buffer) and `SHA512_Final` with the SHA-512/224 or SHA-512/256 digest length. Null contexts, null input with a nonzero length, null digest buffers in the 32-bit `Final` functions and a buffered byte count that is not below the block size, which LibreSSL does not check, throw
+- [DES_set_key, DES_ecb_encrypt, DES_set_odd_parity](../../../core/libs/prx/libSceLibreSsl/Export.cpp) (libSceLibreSsl) - the 128-byte `DES_key_schedule` holds the 8-byte key followed by zeros instead of LibreSSL's precomputed subkeys, so a title reading its contents sees different bytes; `DES_ecb_encrypt` derives the subkeys through mbedtls on each call. Not compared with the console. Results follow LibreSSL [des_key.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/des/des_key.c) and [des.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/des/des.c): `DES_set_key` skips the parity and weak-key checks and returns 0, as it does while `DES_check_key` is 0 (that variable is not in the PS5 export inventory), a nonzero `enc` encrypts, and `DES_set_odd_parity` sets each byte's low bit for odd parity. Null pointers throw where LibreSSL faults
+- [X509_verify_cert_error_string](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - no console call is verified. The 64-bit argument, low-32-bit lookup, messages and shared numeric fallback follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/x509/x509_txt.c), the version identified in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). Console modifications and other firmware versions remain unverified. Unknown-code results share an overwritten static buffer and are not safe for concurrent use, as in that release; code 1 and codes above 54 use the numeric fallback.
+- [RAND_add, RAND_bytes, RAND_status, RAND_load_file, RAND_file_name, CRYPTO_malloc, CRYPTO_free, CRYPTO_set_mem_functions](../../../core/libs/prx/libSceLibreSsl/src/Runtime.cpp) (libSceLibreSsl) - follow LibreSSL's [rand_lib.c, randfile.c](https://github.com/libressl/openbsd/tree/0f0b16dc977f6ca499f0f4540078d992c96da597/src/lib/libcrypto/rand) and [malloc-wrapper.c](https://github.com/libressl/openbsd/blob/0f0b16dc977f6ca499f0f4540078d992c96da597/src/lib/libcrypto/malloc-wrapper.c), which are the same in 2.6.5 (3.4.3 linked); nothing is checked on the console. `RAND_bytes` reads host entropy and `CRYPTO_malloc` and `CRYPTO_free` use the guest heap. `CRYPTO_malloc` returns null for a size of zero or less, as LibreSSL 2.5.4 to 3.4 do; later versions take a `size_t` size and call `malloc`. A null buffer with a positive length throws
+- [AES_set_encrypt_key, AES_set_decrypt_key, AES_encrypt, AES_decrypt, AES_ecb_encrypt, AES_cbc_encrypt, AES_cfb128_encrypt, AES_ctr128_encrypt](../../../core/libs/prx/libSceLibreSsl/src/Aes.cpp) (libSceLibreSsl) - follow LibreSSL's [aes.h](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/aes/aes.h) and [mode code](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/modes). Nothing is checked on the console. Key setup follows [LibreSSL 2.5.4's aes_core.c](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/aes/aes_core.c), the version the `X509_verify_cert_error_string` entry names: a null pointer returns -1 and a key length other than 128, 192 or 256 bits returns -2 before the key is written, and only the 44, 52 or 60 words the key length needs are written. The `AES_KEY` schedule uses that file's generic C layout (big-endian words, `rounds` 10, 12 or 14). The 2.5.4 amd64 build uses [aes-x86_64](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/aes/asm/aes-x86_64.pl) instead, which copies the key bytes without swapping, so each word is byte-reversed compared with the C layout (OpenSSL 3.0.13's x86-64 code gives the same schedules byte-reversed); the console's build options are unknown, so a schedule the title reads or fills is unverified. CTR leaves the last keystream block in `ecount_buf` even at a block boundary. Null pointers in the cipher and mode functions, other `rounds` values and a CFB or CTR position outside 0-15 throw
diff --git a/docs/dev/debt/libSceLibreSsl3.md b/docs/dev/debt/libSceLibreSsl3.md
index 3fbd00e901..dba672f91f 100644
--- a/docs/dev/debt/libSceLibreSsl3.md
+++ b/docs/dev/debt/libSceLibreSsl3.md
@@ -2,4 +2,9 @@
 
 ### Unknown function info
 
-- [libSceLibreSsl3 pending exports](../../../core/libs/prx/libSceLibreSsl3/Export.cpp) - 87 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl3.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+- [libSceLibreSsl3 pending exports](../../../core/libs/prx/libSceLibreSsl3/Export.cpp) - 84 named callable exports, excluding `CRYPTO_memcmp`, `MD5` and `SHA1`, remain unimplemented from the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl3.c), cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`.
+
+### Functional
+
+- [CRYPTO_memcmp](../../../core/libs/prx/libSceLibreSsl3/Export.cpp) follows the public [LibreSSL signature and equality contract](https://man.openbsd.org/CRYPTO_memcmp.3), without PS5 verification. The exact nonzero result for unequal buffers is unspecified by that contract. Content-independent execution of its volatile byte reads still depends on the compiler; inspect optimized code when changing toolchains. Closes when: measured on a PS5 and the supported toolchains' generated code is checked.
+- [MD5 and SHA1](../../../core/libs/prx/libSceLibreSsl3/src/Digest.cpp) (libSceLibreSsl3) - follow LibreSSL's [md5.c, sha1.c](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto) and hash through libSceLibreSsl's `MD5_*` and `SHA1_*`. A null digest buffer throws: LibreSSL up to 3.8 returns a static buffer, later versions do not check it. Nothing is checked on the console
diff --git a/docs/dev/debt/libSceNKWebKit.md b/docs/dev/debt/libSceNKWebKit.md
new file mode 100644
index 0000000000..e515ec10a7
--- /dev/null
+++ b/docs/dev/debt/libSceNKWebKit.md
@@ -0,0 +1,5 @@
+# libSceNKWebKit technical debt
+
+### Known export names; ABI prototypes unverified
+
+- The 150 `sceNKWebKitUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceNKWebKit/Export.cpp) are present in the PS5 3.20 `libSceNKWebKit` export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their NIDs are derived from exported mangled symbols. Prototypes and behavior are unverified; each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`. These declarations make no ABI or behavior claim.
diff --git a/docs/dev/debt/libSceNet.md b/docs/dev/debt/libSceNet.md
index eba8fd607d..611efe6936 100644
--- a/docs/dev/debt/libSceNet.md
+++ b/docs/dev/debt/libSceNet.md
@@ -2,22 +2,25 @@
 
 ### Silent stubs
 
+- [sceNetShowRouteWithMemory](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - validates memory pool ID and returns success without printing anything: the `(poolId)` signature and pool validation follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp) and `sceNetShowNetstatWithMemory`. What the console prints and where is unverified
 - [sceNetShowIfconfig, sceNetShowNetstat](../../../core/libs/prx/libSceNet/Export.cpp) return the native not-initialized error and set errno before initialization. Initialized calls throw because native diagnostic collection and formatting are not implemented.
-- [sceNetShowRoute, sceNetShowRoute6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - return success without printing anything: the `()` signatures and the success return follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/net.cpp), which stubs each the same way. PPSA01530 fails to load without the `sceNetShowIfconfig` export (#3177); PPSA11386 imports `sceNetShowNetstat` but does not call it during start-up. What the console prints and where is unverified
+- [sceNetShowPolicy, sceNetShowNetstatEx, sceNetShowRoute, sceNetShowRoute6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - return success without printing anything: the `()` signatures and the success return follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/net.cpp), which stubs each the same way. PPSA01530 fails to load without the `sceNetShowIfconfig` export (#3177); PPSA11386 imports `sceNetShowNetstat` but does not call it during start-up. What the console prints and where is unverified
 
 ### Unknown function info
 
+- [sceNetRecv, sceNetRecvfrom and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - zero-length TCP receives while connecting, after disconnect, or with a pending host error still use the host receive path. Error and output precedence in those states is unmeasured on a console. The established, error-free case follows FreeBSD 11.4's [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1568-L1583).
+
 - [sceNetConfigAddIfaddr](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - disassembly confirms the same interface/address/broadcast/netmask arguments as SetIfaddr, entering its shared handler with add mode selected. GetIfaddr copies up to two 16-byte interface-address records. GetRouteInfo uses a family, record buffer, signed capacity and byte flags; internal statistics output is 16 bytes. The address-record and internal-statistics fields remain incomplete.
 
-- [Resolver-connect, thread creation, interface and diagnostic queries, WLAN configuration and DHCP queries](../../../core/libs/prx/libSceNet/Export.cpp) retain unsupported implementations. Their restored argument lists still reference incomplete connection, thread, interface, route, WLAN and statistics types. Kernel ioctl payloads need reconstruction from their handlers or consumers; buffer lengths alone do not establish field types.
+- [Resolver-connect, interface and diagnostic queries, WLAN configuration and DHCP queries](../../../core/libs/prx/libSceNet/Export.cpp) retain unsupported implementations. Their restored argument lists still reference incomplete connection, interface, route, WLAN and statistics types. Kernel ioctl payloads need reconstruction from their handlers or consumers; buffer lengths alone do not establish field types.
+- [sceNetThreadCreate, sceNetThreadExit, sceNetThreadJoin, sceNetEmulationGet and sceNetEmulationSet](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the signatures, the `{ entry, arg, reserved, flags }` parameter block and the `EOPNOTSUPP` of the two emulation calls ("not available on retail units") follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/net/net.cpp) (PS4), not a PS5 measurement. The block is read on the new thread, so it must stay valid until the thread starts, `flags` is ignored (shadPS4 ends the thread with `pthread_exit` when bit 0 is set, which ends it the same way), and a failing `scePthreadCreate` or `scePthreadJoin` result is returned as it is, where shadPS4 also sets the net errno from it
 - [sceHttp2GetMemoryPoolStats, sceSslGetMemoryPoolStats, sceNetGetMemoryPoolStats](../../../core/libs/prx/libSceNet/Export.cpp) (libSceHttp2, libSceSsl, libSceNet) - the signatures `(int id, stats*)`, the layouts (pool size, peak and current use, and for Http2 and Ssl a 32-bit reserved field) and the error codes were measured on a PS5 (firmware 13.60). The pool size is the one given at init or pool creation. Http2 and Net allocate nothing from these pools. Ssl counts its certificate backend allocations and returned data against its pool; C++ bookkeeping is outside that budget. All three initially report zero use, where the console already reports 0x15C0 bytes for Ssl, 0x1640 for Http2 and 4 for a Net pool. Ssl's allocation sizes and peak usage do not reproduce the console allocator
 - [sceNetClearDnsCache](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the library has no DNS cache to clear because lookups use the host resolver. The host resolver cache is left unchanged.
 - [sceNetEtherStrton](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - strings shorter than 17 bytes return EINVAL without changing the output, rather than reading past the terminating NUL as in the [firmware 13.60 probe](https://gist.github.com/orezraey/789290577123af3c45b340d6db6f395c/71e0a6215c7ee86f49fdb31de989dd2b50720b7a). Non-ASCII digit bytes throw because their decoding is unmeasured; other firmware versions remain unverified. Fixed character pairs, ignored separators, alphabetic values beyond f, non-alphanumeric ASCII values of 0x7f, and null-pointer EINVAL follow those measurements, not the strict [shadPS4 parser](https://github.com/shadps4-emu/shadPS4/blob/d615b3887ba29025a59242e1a26f5b68bb176158/src/core/libraries/net/net.cpp#L1274-L1297)
 - [sceNetGetDnsInfo](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the `(info, int flags)` signature, the two IPv4 server slots in network byte order and the server count as the return value follow the PS4 [OpenOrbis musl resolver](https://github.com/OpenOrbis/musl/blob/2b0bb8ce2fa64ac255cb656785729d159a5f074c/src/network/resolvconf.c) and [OpenOrbis Net.h](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/0a1aaf9dd4a92695538bdeb09fb056d06dd11725/include/orbis/Net.h); unverified on PS5 hardware. It reports the host DNS servers of the interface `sceNetCtlGetInfo` reports, never servers set through `sceNetSetDnsInfo`. Zeroing the unused slots and returning 0 without a host IPv4 interface are unverified. Nonzero flags and a null info throw because their console results are unknown
 - [sceNetGetRandom](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - generates values with the host random device; the system library maintains its own seeded PRNG state.
-- [sceNetInetPtonEx](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the `(int af, const char* src, void* dst, int flags)` signature follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp); IPv4 conversion and the ignored flags follow PS4 firmware 10.71, not yet confirmed on PS5. There IPv4 text is read as `inet_aton` reads it (`a`, `a.b`, `a.b.c`, hex and octal parts, values wrapping at 32 bits, the text ending at the first space, tab or VT), except that a part starting with `09` is decimal (`"0989"` is 989) and an octal part with `8` or `9` fails. Flags 0, each single bit up to 0x100, 0x10000, 0x80000000 and -1 gave the same results; other values were not measured. LF, FF and CR as terminators, and `NET_EINVAL` for a null `src` or `dst`, follow `sceNetInetPton` and were not measured for this function. IPv6 converts as `sceNetInetPton` does.
-- [sceNetMemoryAllocate and sceNetMemoryFree](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - allocations use the guest heap instead of the system network pool. Pool limits, its allocation accounting and free-time fill are not reproduced. Allocation flag 4 bypasses the system pool reserve threshold; it throws here because the pool reserve is not implemented. Flag 2 zero-fills and other bits are ignored, matching the system allocator.
-- [sceNetThreadExit](../../../core/libs/prx/libSceNet/Export.cpp) is a zero-argument, non-returning void export in the native module. The protected host stub still declares int and contains `return 0`; changing it to void requires changing that protected body, so the return-type mismatch is retained.
+- [sceNetInetPtonEx](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - for IPv6 a null `dst` returns `NET_EINVAL` here, where it crashed a payload process on a PS5 (firmware 13.60). The `(int af, const char* src, void* dst, int flags)` signature follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp). On PS4 firmware 10.71 and on that PS5, IPv4 text is read as `inet_aton` reads it (`a`, `a.b`, `a.b.c`, hex and octal parts, values wrapping at 32 bits, the text ending at a space, tab or VT), except that a part starting with `09` is decimal (`"0989"` is 989) and an octal part with `8` or `9` fails; flags were ignored (PS4: 0, single bits up to 0x100, 0x10000, 0x80000000, -1; PS5: 1, 2, 4, 0x100, 0x10000, -1). On the PS5 only: LF, FF and CR also end the text, a null `src` returns `NET_EINVAL`, and a null `dst` returns 1 or 0 without writing or setting errno. IPv6 converts as `sceNetInetPton` does
+- [sceNetMemoryAllocate and sceNetMemoryFree](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - allocations use the guest heap instead of the system network pool. Pool limits, its allocation accounting and free-time fill are not reproduced: a reused block allocated without flag 2 holds 0xdd bytes on the console and its previous contents here. Flag 4 bypasses the system pool reserve threshold; with no pool there is no threshold, so it allocates as other flags do. What the console returns once the pool is exhausted is unmeasured; AnyPS5 returns null without setting an errno. Measured on a PS5 (firmware 13.60): a size of 0 or less returns null and leaves `sceNetErrnoLoc` unchanged, flag 2 zero-fills, flags 1, 4, 8, 0x10, 0x100 and 0x80000000 had no visible effect, and every block of 1 to 65536 bytes was 64-byte aligned
 - [sceNetConfigCleanUpAllInterfaces](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - the native routine consumes no arguments; the throwing implementation remains unchanged.
 - [sceNetDhcpdStart](../../../core/libs/prx/libSceNet/Export.cpp): six arguments and the three-argument address callback are confirmed. The 24-byte parameter contains five network-order addresses and a client limit. Individual address roles and the two unused thread-option meanings remain unresolved.
 - [sceNetPppoeStart](../../../core/libs/prx/libSceNet/Export.cpp): seven arguments are confirmed, including the parameter pointer on the stack. The 272-byte parameter contains two DNS addresses, two 128-byte credential arrays, MTU and flags. Callback arguments are user data, event and error; the two unused thread-option meanings remain unresolved.
@@ -26,22 +29,27 @@
 
 ### Functional
 
+- [sceNetRecv/sceNetRecvfrom](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) translate Windows WSAEMSGSIZE into the copied byte count for datagram sockets, including MSG_PEEK, and retain the sender address. This follows FreeBSD 11.4 recv(2) and Winsock's documented truncated-datagram behavior; the console measurement covered only libkernel_sys `recv` and `recvfrom`, not libSceNet.
+- [sceNetUsleep](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) prints nothing for a negative count, where the console prints `[LIBNET] usleep <count>` to standard output before failing with `EINVAL`. What an interrupted sleep returns is unmeasured: AnyPS5 returns the result of libkernel's `sceKernelUsleep`, a cancellation point. The signed 32-bit count (the upper half of the register is ignored) and the 0 result were measured on a PS5 (firmware 13.60)
+- [sceNetIoctl](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - on a `sceNetSocket` socket only `FIONBIO` and `FIONREAD` are handled and other requests fail with `ENOTTY`, as in libkernel's `ioctl`, though FreeBSD 11.4's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L156-L262) handles more; not measured on a console. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/60c42b925c3d1e00008621b8587819999260ec31/src/core/libraries/net/net.cpp#L1839) (PS4) returns `EINVAL` for other requests. `FIONBIO` sets `SO_NBIO`, assumed to be `soo_ioctl`'s `SS_NBIO`. `FIONREAD` asks the host, which on Linux counts only the next datagram where `soo_ioctl` counts all. Libkernel's own sockets go to its `ioctl`; other descriptors get `EBADF`.
 - [sceNetResolverStartAton6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reverse-resolves a 16-byte IPv6 address through the host resolver (`getnameinfo` with `NI_NAMEREQD`) into the caller's buffer of `len` bytes, as `sceNetResolverStartAton` does for IPv4. The `(rid, addr, hostname, len, timeout, retry, flags)` signature comes from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs#L992-L997). An address with no name, or a name longer than `len - 1` bytes, fails with `RESOLVER_ENODNS` (`0x804101E1`) and leaves the buffer untouched; whether the console truncates instead is not verified. Abort flag 2 (ATON preservation) fails the next call with `EINTR` as it does `sceNetResolverStartAton`. Timeout and retry are ignored, and any nonzero flags throw because their meaning is unknown
 - [sceNetAccept](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) inherits the listener's non-blocking mode through the existing `SO_NBIO` setter, as the libkernel socket path does and FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L571) copies the socket state. The mode is sampled when accept starts; changes between connection creation and accept are not modelled. Not measured on a console.
 
 - [sceNetConnect to AF_UNSPEC](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again; one bound to port 0 is bound again to the wildcard address with the port it had
-- [sceNetSetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) sets `SO_RCVTIMEO` and `SO_SNDTIMEO` as the host socket's timeouts. Windows sockets stay non-blocking and the library waits for readiness until the stored timeout. A stream receive that times out still reports `ETIMEDOUT` rather than FreeBSD's `EAGAIN`; a datagram receive reports `EAGAIN`. Blocking stream sends return the queued byte count on timeout, or `EAGAIN` when no bytes were queued.
+- [sceNetSetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) sets `SO_RCVTIMEO` and `SO_SNDTIMEO` as the host socket's timeouts. Windows sockets stay non-blocking and the library waits for readiness until the stored timeout. Blocking stream sends return the queued byte count on timeout, or `EAGAIN` when no bytes were queued.
 - [sceNetSetsockopt, sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) take `SO_SNDTIMEO` and `SO_RCVTIMEO` (0x1005, 0x1006) as a 16-byte `struct timeval`, as FreeBSD 11.4's [`sosetopt` and `sogetopt`](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/uipc_socket.c#L2657-L2690) do, and Sony's 0x1105 and 0x1106 as an `int` of microseconds. A [console log of ProsperoLight](https://github.com/blackbearreloaded/ProsperoLight/issues/49) (firmware 12.20) shows receives timing out every 100 ms after it gave 0x1006 a `{0, 100000}` timeval. The errors for a value shorter than a timeval (`EINVAL`) or out of range (`EDOM`), and `sceNetGetsockopt` cutting the timeval to the caller's length, follow FreeBSD's `sooptcopyin` and `sooptcopyout` and are not measured on a console
 - [sceNetSetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) stores `SO_ONESBCAST` (`0x10000`, [shadPS4's `ORBIS_NET_SO_ONESBCAST`](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net_types.h)) per socket and `sceNetGetsockopt` reads back the value that was set, as shadPS4 does; PPSA34501 sets it and crashes later when it fails with `EOPNOTSUPP`. Sends ignore it. FreeBSD 11.4's [ip(4)](https://man.freebsd.org/cgi/man.cgi?manpath=FreeBSD+11.4-RELEASE&query=ip&sektion=4) documents the like-named `IPPROTO_IP` option `IP_ONESBCAST`: a datagram sent to an interface's directed broadcast address, such as 192.168.2.255, leaves through that interface with its destination rewritten to 255.255.255.255, and only on a socket allowed to set `SO_BROADCAST`. Here host routing selects the outgoing interface and the destination is not rewritten. shadPS4 also leaves sends unchanged, and its [TODO](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/net/net.cpp#L2467-L2470) reads the option the other way round: a send to 255.255.255.255 would be converted to the interface's broadcast address. Whether the console's `SOL_SOCKET` option behaves like `IP_ONESBCAST`, and what it reads back, is not verified on hardware. FreeBSD 11.4's `sogetopt()` reads several boolean socket options back as their flag bit (`so_options & optname`, `sys/kern/uipc_socket.c`), not as the value set; whether the console does so for `0x10000` is unknown
 - [sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reads `SO_ERROR` from the host socket. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `sceNetConnect`; a second failure with the same code on the same socket without a `sceNetConnect` in between would be hidden.
 - [sceNetSetsockopt, sceNetGetsockopt](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) set `TCP_NODELAY` (`IPPROTO_TCP`, 1) on the host socket of a stream socket and read it back as `TF_NODELAY` (4) or 0, as FreeBSD 11.4's [`tcp_default_ctloutput`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/tcp_usrreq.c#L1626-L1650) does. Every other `IPPROTO_TCP` option (`TCP_MAXSEG`, `TCP_NOPUSH` and `TCP_KEEPIDLE` among them, which FreeBSD implements) fails with `ENOPROTOOPT`, and the `IPPROTO_TCP` level on a socket that is not a stream socket fails with `EINVAL`, as [`ip_ctloutput`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/ip_output.c#L943-L944) answers it. A set on a connection that FreeBSD's [`tcp_ctloutput`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/netinet/tcp_usrreq.c#L1498-L1502) refuses with `ECONNRESET` (refused, reset or in `TIME_WAIT`) succeeds here because the host accepts it. A null value with a nonzero length fails with `EINVAL`, where FreeBSD's `kern_setsockopt` returns `EFAULT`, and a get into less than an `int` fails with `EINVAL`, where `sooptcopyout` truncates. None of this was measured on a console.
 - [sceNetGetSockInfo](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) reports 0 for the name, pid, policy, priority, queue lengths, virtual ports, state, bandwidth, drops and waits, sets no status flag except `SELF` (0x1) and `NONBLOCK` (0x200000), and reports the host's buffer sizes where none was set. An IPv6 socket fails with `EAFNOSUPPORT` and is not counted or listed; shadPS4 lists it with zero addresses. `flags` bits other than 0x40 fail with `EINVAL`, where shadPS4 ignores `flags`; 0x40 adds sockets in TIME_WAIT ([SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs)), but closed sockets are not kept. Otherwise the `s` below 0 count and list, the return value and `EINVAL` for a null `info` or an `n` below 1 follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/06e813ff8c8e2a6d81b02cabfcc9543c3debf78e/src/core/libraries/net/net.cpp#L1498-L1522). Not measured on a console.
+- [SO_SNDBUF and SO_RCVBUF validation](../../../core/libs/prx/libSceNet/Export.cpp) remains unverified on PS5, and positive sizes remain subject to host buffer limits. Nonpositive sizes fail with `EINVAL` before changing the native socket, following FreeBSD 11.4 [sosetopt](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/kern/uipc_socket.c#L2494-L2509).
 - [sceNetSendmsg and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) copy the scatter/gather list through one host buffer and accept only the flags `sceNetSend`/`sceNetRecv` accept. Sending control data throws; a receive never returns control data (`msg_controllen` 0), since no socket option that queues it is supported
+- [sceNetGetSockInfo6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) is not measured on a console; shadPS4 stubs it. It lists only IPv6 sockets and `flags` 0x1000 adds IPv4 sockets, reported with the IPv4 addresses, all-zero IPv6 addresses and no `F_IPV6` (0x400000), which every IPv6 socket sets ([SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs#L251-L343), [flags](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs#L698-L705), [docs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/docs/net.md#L301-L304)). The default of leaving IPv4 sockets out, the zero IPv6 addresses of an IPv4 socket and accepting 0x40 are inferred from those names, not documented. An IPv4 socket without 0x1000 fails with `EAFNOSUPPORT`. The other gaps are those of `sceNetGetSockInfo`.
 - [sceNetSocketClose, sceNetEpollControl and sceNetEpollWait](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - close and concurrent registration ordering are unmeasured on a console. Closed descriptors retire their registrations, and a wait discards snapshots invalidated by close, DEL or MOD; descriptor identity follows [Linux epoll(7)](https://man7.org/linux/man-pages/man7/epoll.7.html). ADD, MOD and DEL reject closed or invalid socket descriptors with `EBADF`, as [Linux epoll_ctl(2)](https://man7.org/linux/man-pages/man2/epoll_ctl.2.html) does; this error ordering is unmeasured on a console. Duplicate-descriptor alias lifetime is not modeled by this epoll backend.
 - [MSG_DONTWAIT](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - console ordering between competing readers and writers is unmeasured. The per-call behavior follows FreeBSD 11.4's `soreceive_generic` and `sosend_generic` (`sys/kern/uipc_socket.c`); `0x80` is FreeBSD's flag value (`sys/sys/socket.h`). On Windows native sockets stay non-blocking. `MSG_DONTWAIT` and guest `SO_NBIO` return one host transfer's result. Blocking stream sends queue the whole buffer with one deadline and return progress after a timeout or host error. SSL uses this path through the native owner, retaining the socket, its mode and timeouts. Readiness waits poll at most every 10 ms for local close, so idle blocked operations wake periodically.
-- [sceNetRecv, sceNetRecvfrom and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) on a datagram socket with no local address wait on Windows until a bind, connect or send gives it one, checking the host socket every 10 ms. Winsock fails such a receive with `WSAEINVAL`, where FreeBSD 11.4's `soreceive_dgram` waits for a datagram (`sys/kern/uipc_socket.c`). A non-blocking socket fails with `EAGAIN` at once, and the receive timeout ends the wait with `EAGAIN`; when the address comes first, the call waits for a datagram only for what is left of the timeout. A `sceNetShutdown` of the receive side ends the wait and the receive returns 0, and a zero-length receive returns 0 without waiting, as `soreceive_dgram` does when the socket can't receive more or nothing was asked for. An abort or close ends the wait, and the host receive then fails as it did before
+- [sceNetRecv, sceNetRecvfrom and sceNetRecvmsg](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) on a datagram socket with no local address wait on Windows and macOS until a bind, connect or send gives it one, checking the host socket every 10 ms. Winsock fails such a receive with `WSAEINVAL`, where FreeBSD 11.4's `soreceive_dgram` waits for a datagram (`sys/kern/uipc_socket.c`). On macOS the host receive waits, but a receive-side `shutdown` does not wake it. A non-blocking socket fails with `EAGAIN` at once, and the receive timeout ends the wait with `EAGAIN`; when the address comes first, the call waits for a datagram only for what is left of the timeout. A `sceNetShutdown` of the receive side ends the wait and the receive returns 0, and a zero-length receive returns 0 without waiting, as `soreceive_dgram` does when the socket can't receive more or nothing was asked for. An abort or close ends the wait, and the host receive then fails as it did before
 - [sceNetResolverAbort and sceNetResolverStartNtoaMultipleRecords](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) follow shadPS4 ([net.cpp](https://github.com/shadps4-emu/shadPS4/blob/811bfcd7d17ed8ae975c477d9ff28abc744e1ca8/src/core/libraries/net/net.cpp), [net_resolver.cpp](https://github.com/shadps4-emu/shadPS4/blob/811bfcd7d17ed8ae975c477d9ff28abc744e1ca8/src/core/libraries/net/net_resolver.cpp)); the `(int rid, int flags)` signature of the abort also matches [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Socket.cs). Unverified on hardware. Lookups run synchronously over the host resolver, which cannot be interrupted: an abort while a lookup runs on another thread returns at once, and that lookup fails with `EINTR` without writing its output only when the host call returns; the abort flags are then ignored, as shadPS4 does for a running lookup. With nothing running, abort flag 1 (NTOA preservation) or 2 (ATON preservation) makes the next `sceNetResolverStartNtoa*` or `sceNetResolverStartAton` call on that resolver fail with `EINTR`, reported by `sceNetResolverGetError`, after its arguments are checked. Unlike shadPS4, which ignores them, other abort flag bits throw, and `sceNetResolverStartNtoaMultipleRecords` throws for any flag, including async (1) and 0x10000 (IP address literals disabled), as `sceNetResolverStartNtoaMultipleRecordsEx` does
 - [sceNetResolverStartNtoa6](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) resolves a host name to its first IPv6 address through the host resolver (`getaddrinfo` with `AF_INET6`) and writes the 16-byte address; the `(rid, hostname, addr, timeout, retry, flags)` signature follows `sceNetResolverStartNtoa`. A name with no IPv6 address fails with `RESOLVER_ENODNS` (`0x804101E1`) like a failed lookup; whether the console returns IPv4-mapped addresses instead is not verified. Timeout and retry are ignored as in `sceNetResolverStartNtoa`, and any nonzero flags throw because their meaning for this call is not known. Unverified on hardware.
-- [sceNetInetPton](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) ends an IPv4 address at the first space, tab, LF, VT, FF or CR and ignores the rest (`"1.2.3.4 x"` converts), leaves the destination and `sceNetErrnoLoc` unchanged when a conversion fails, as PS4 firmware 10.71 does; not yet confirmed on PS5. Leading whitespace, any other trailing byte (`0x01`, `0xa0`) and IPv6 text with whitespace fail.
+- [sceNetInetPton](../../../core/libs/prx/libSceNet/Export.cpp) (libSceNet) - an IPv6 conversion with a null `dst` returns `NET_EINVAL` here, where it crashed a payload process on a PS5 (firmware 13.60). On that PS5 and on PS4 firmware 10.71 an IPv4 address ends at the first space, tab, LF, VT, FF or CR and the rest is ignored (`"1.2.3.4 x"` converts), and a failed conversion leaves the destination and `sceNetErrnoLoc` unchanged. On the PS5 the dotted IPv4 part of IPv6 text is read the same way (`"::ffff:1.2.3.4 x"` converts, `"::ffff:01.2.3.4"` fails), and an IPv4 conversion with a null `dst` returns 1 or 0 without writing. Leading whitespace, any other trailing byte (`0x01`, `0xa0`) and whitespace after hexadecimal IPv6 text fail
 
 - [sceNetDhcpStart, sceNetAddrConfig6Start, sceNetDuplicateIpStart and sceNetInfoDumpStart](../../../core/libs/prx/libSceNet/Export.cpp) - argument widths and callback ABI are recovered. Address callbacks receive user data, a 32-bit event and a 32-bit error. DHCP configuration is mutable; the 512-byte IPv6 configuration is read-only. Their complete field layouts remain unknown. The two 32-bit thread parameters are stored but not consumed by this firmware thread wrapper, so their original names and units are unconfirmed. Information-dump options contain flags, an interval in seconds and a 64-byte path. All four exports remain unimplemented.
diff --git a/docs/dev/debt/libSceNetCtl.md b/docs/dev/debt/libSceNetCtl.md
index 96b0e7ed58..add05f78df 100644
--- a/docs/dev/debt/libSceNetCtl.md
+++ b/docs/dev/debt/libSceNetCtl.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [sceNetCtlGetNatInfo and sceNetCtlGetResult](../../../core/libs/prx/libSceNetCtl/Export.cpp) - NAT discovery and service event results are not implemented and throw after native initialization and argument checks. NAT information is 16 bytes with a 32-bit size prefix; the remaining fields are unresolved.
+- [sceNetCtlGetNatInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) - NAT discovery is not implemented and throws after native initialization and argument checks. NAT information is 16 bytes with a 32-bit size prefix; the remaining fields are unresolved.
 
 ### Unknown function info
 
@@ -10,7 +10,9 @@
 
 - [sceNetCtlGetInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - answers from the host interface that holds an IPv4 address, preferring the one that carries the default route: its address, netmask, gateway, MTU and first two IPv4 DNS servers. The device is reported as wired, the link as connected, the IP configuration as DHCP and the HTTP proxy as off, whatever the host uses, and the Ethernet address is the one `sceNetGetMacAddress` reports. A gateway or DNS server the interface does not have is reported as `0.0.0.0`; what a console reports then is unknown. The DHCP host name (12), the PPPoE user name (13), the HTTP proxy server (20) and the Wi-Fi BSSID and SSID (5, 6) are empty strings, as that configuration sets none of them; the remaining Wi-Fi codes (7-10) and the HTTP proxy port (21) report 0; this follows [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/main/src/libs/network.cpp) and is not measured on hardware
 - [sceNetCtlGetInfoV6](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl, NID `Jy1EO5GdlcM`) - imported by PPSA08587. `(int code, SceNetCtlInfoV6* info)` with codes 1-5 (IP address, link-local address, default route, primary and secondary DNS) comes only from [SharpProspero](https://github.com/SvenGDK/SharpProspero), whose source is unknown; shadPS4 and fpPS4 only stub it. A null `info` answers `INVALID_ADDR`, a code outside 1-5 `INVALID_CODE`, and a host without an IPv6 address `NOT_CONNECTED`, as `sceNetCtlGetStateV6` reports it. The layout of each answer is unverified, so every code throws on a host with an IPv6 address
+- [sceNetCtlGetResult](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - `(int eventType, int* errorCode)` reports no error: event types 1-3 (disconnected to IP obtained, the numbering `sceNetCtlCheckCallback` delivers) write 0 to `errorCode`, as `sceNetCtlGetResultV6` does. The error code a console reports for each event, a disconnection's cause in particular, is unconfirmed. Callers found: PPSA20052 (Worms Armageddon: Anniversary Edition 01.003.000) calls it 2 s into boot, and PPSA24191 (Monster Hunter Wilds) without a network, with event 1 (disconnected) as its first call. A null `errorCode` answers `INVALID_ADDR` and other event types throw, as their error code on a console is unknown
 - [sceNetCtlGetResultV6](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl, NID `H5yARg37U5g`) - `(int eventType, int* errorCode)` comes only from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/NetCtl.cs#L246-L251), whose source is unknown; shadPS4 only stubs it. Callbacks registered with `sceNetCtlRegisterCallbackV6` receive no event, so event types 1-3 write 0 to `errorCode`; what a console writes before the first event is unmeasured. A null `errorCode` answers `INVALID_ADDR`, as `sceNetCtlGetResult` does, and other event types throw, as their error code on a console is unknown
+- [sceNetCtlRegisterCallbackForNpToolkit, sceNetCtlUnregisterCallbackForNpToolkit, sceNetCtlCheckCallbackForNpToolkit](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - a table of eight callbacks apart from the IPv4 and IPv6 ones, with the `(int eventType, void* arg)` callback, follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/network/net_ctl_obj.h), whose NpToolkit check delivers the same events to that table. The three share the register, unregister and dispatch of `sceNetCtlRegisterCallback`, `sceNetCtlUnregisterCallback` and `sceNetCtlCheckCallback`, so they return the same initialization, address, slot-limit and ID errors, and the check reports the state `sceNetCtlCheckCallback` does. Whether the console keeps this table apart, and what `sceNetCtlCheckCallback` does with it, is unverified on hardware
 - [ApRp exports](../../../core/libs/prx/libSceNetCtl/Export.cpp) are constant-success functions in the supplied native module and consume no arguments. No callers were found in the supplied system-library decompilations, so unused callback, output and configuration argument types remain unresolved. Protected stub bodies are unchanged.
 
 ### Functional
@@ -19,3 +21,4 @@
 - [libSceNetCtl initialization](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - the library starts initialized, as titles find it: it is the internal sysmodule `0x80000009`, and PPSA11386, PPSA20049, PPSA02530, PPSA14632 and PPSA15878 register and check NetCtl callbacks without importing `sceNetCtlInit`. PPSA11386 executes `int 0x42` at start-up unless `sceNetCtlRegisterCallback` returns 0. So the supplied module's `SCE_NET_CTL_ERROR_NOT_INITIALIZED` answers are unreachable, since Term is a no-op. Whether the console's process start or the module's start sets that state is not measured.
 - [sceNetCtlGetInfo](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) finds the host's default route in `/proc/net/route` on Linux and, on macOS, in the routing table read with `sysctl(NET_RT_FLAGS, RTF_GATEWAY)`, where an interface-scoped default route ranks after the unscoped one
 - [sceNetCtlGetIfStat](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) throws on macOS: an unprivileged process reads the interface byte counters (`getifaddrs` and `sysctl(NET_RT_IFLIST2)` alike) reduced to their low 32 bits, so a total would wrap every 4 GiB
+- [Host interface cache](../../../core/libs/prx/libSceNetCtl/Export.cpp) (libSceNetCtl) - on Windows, `sceNetCtlGetState`, `sceNetCtlGetStateV6`, `sceNetCtlCheckCallback`, `sceNetCtlGetIfStat` and `sceNetCtlGetInfo` reuse the last host interface query until `NotifyUnicastIpAddressChange`, `NotifyIpInterfaceChange` or `NotifyRouteChange2` reports a change, instead of calling `GetAdaptersAddresses` on every call. A DNS server change with no address, interface or route change is seen only at the next such change. If the notifications cannot be registered, every call queries the host as before.
diff --git a/docs/dev/debt/libSceNetCtlAp.md b/docs/dev/debt/libSceNetCtlAp.md
index 94b54af330..59dab4dfd7 100644
--- a/docs/dev/debt/libSceNetCtlAp.md
+++ b/docs/dev/debt/libSceNetCtlAp.md
@@ -6,6 +6,8 @@
 
 ### Unknown function info
 
+- [sceNetCtlApRegisterCallback](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) (libSceNetCtlAp) - writing `InvalidCid` (`-1`) to `cid` when all eight slots are taken (`CALLBACK_MAX`) is unmeasured and interprets [SharpProspero's comment](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/NetCtlAp.cs#L117-L118) that it is the value written into an unclaimed callback id, which does not name this path. [`libSceNetCtl`](https://github.com/boykopovar/AnyPS5/blob/aeeaefad98613c63a49ea2daae4d4558304b14cd/core/libs/prx/libSceNetCtl/Export.cpp#L103-L115) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/network/netctl.cpp#L381-L390) leave `cid` unchanged on a full table
+
 - [sceNetCtlApInit, sceNetCtlApTerm](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) (libSceNetCtlAp) - every other call returns `NOT_INITIALIZED` (`0x80412994`) before `sceNetCtlApInit` and after `sceNetCtlApTerm`, which also drops the registered callbacks. A second `sceNetCtlApInit` throws, as no error for it is documented
 - [sceNetCtlApGetInfo, sceNetCtlApGetConnectInfo, sceNetCtlApStop](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) - stopped-state results come from a service on the console and remain unverified. Wrapper validation is recovered: initialization precedes arguments, the optional connection string is at most eight bytes, then output pointers and exact 152/184-byte sizes are checked. The service interpretation of the option string remains unresolved.
 - [sceNetCtlApGetResult](../../../core/libs/prx/libSceNetCtlAp/Export.cpp) - with no event delivered, the host writes zero; the service result before the first event remains unknown. Wrapper validation checks initialization, output pointer and event type in that order. Event types 1 through 4 and lowest-free callback IDs 0 through 7 are confirmed.
diff --git a/docs/dev/debt/libSceNgs2.md b/docs/dev/debt/libSceNgs2.md
index 50b1203e89..f25b3c941d 100644
--- a/docs/dev/debt/libSceNgs2.md
+++ b/docs/dev/debt/libSceNgs2.md
@@ -3,4 +3,4 @@
 ### Unknown function info
 
 - [sceNgs2FftInit, sceNgs2FftProcess, sceNgs2FftQuerySize](../../../core/libs/prx/libSceNgs2/PendingExports.cpp) (libSceNgs2) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNgs2.c), but no credible prototypes were found in the cited sources. They are declared without parameters solely to resolve known imports and make no ABI claim.
-- [sceNgs2CustomRackGetModuleInfo, sceNgs2GetWaveformFrameInfo, sceNgs2ParseWaveformUser, sceNgs2SystemEnumHandles, sceNgs2SystemEnumRackHandles, sceNgs2VoiceGetMatrixInfo](../../../core/libs/prx/libSceNgs2/PendingExports.cpp) (libSceNgs2) - names and NIDs are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNgs2.c); signatures follow [SharpProspero's Ngs2 bindings](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs), not measured on a console. Opaque structure pointers use `void*`; these stubs throw for import resolution.
+- [sceNgs2ParseWaveformUser, sceNgs2SystemEnumHandles, sceNgs2SystemEnumRackHandles](../../../core/libs/prx/libSceNgs2/PendingExports.cpp) (libSceNgs2) - names and NIDs are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNgs2.c); signatures follow [SharpProspero's Ngs2 bindings](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs), not measured on a console. Opaque structure pointers use `void*`; these stubs throw for import resolution.
diff --git a/docs/dev/debt/libSceNgs2.native.md b/docs/dev/debt/libSceNgs2.native.md
index f5a4bd1856..5997a09d48 100644
--- a/docs/dev/debt/libSceNgs2.native.md
+++ b/docs/dev/debt/libSceNgs2.native.md
@@ -6,8 +6,11 @@
 
 - [NGS2 system and rack handle errors](../../../core/libs/prx/libSceNgs2.native/include/Ngs2Types.hpp) use `0x804A8201` and `0x804A8202`, following the native handle-type error helper recorded in [prosper's PS5 module analysis](https://github.com/mattias800/prosper/blob/d61eb2c0ad2de879ef74df9c4aa050c512804a18/prosper/src/hle/audio/hle_audio.cpp). [sceNgs2RackGetVoiceHandle](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) resolves the rack before checking the output pointer, matching the export in firmware 1.00 through 12.70 reported in [#5916](https://github.com/boykopovar/AnyPS5/pull/5916#issuecomment-6172832590). Other exports retain their existing validation order; complete invalid-input precedence and console execution remain unverified.
 
-- [NGS2 render buffer capacity](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) is treated as available storage for one configured grain. PPSA01880 passes 303104 bytes for 256 stereo float frames (2048 bytes); rendering writes or clears only those frames and preserves the remaining capacity. Non-null silent outputs now undergo the same supported-format and minimum-size checks as audible outputs, with channel counts limited to 1 through 8. Unused null outputs remain ignored. The console's handling of surplus capacity and invalid silent output descriptors has not been measured; invalid descriptors throw rather than return guessed SDK errors.
-- [NGS2 ATRAC9 waveform loops](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) accepts one integer forward `smpl` loop. Inclusive RIFF endpoints and encoder-delay adjustment follow [vgmstream riff.c](https://github.com/vgmstream/vgmstream/blob/7dc938fa2f210943b37c7b6511852b516ef432ab/src/meta/riff.c). PPSA03747 supplies a 60-byte sampler chunk with one loop, `samplerData` 24, start 256, inclusive end 299224 and delay 256 for 298969 audible samples. The chunk size and loop count bound the records; `samplerData` is not interpreted. Output positions are assumed to use audible samples and an exclusive end. Blocks split into an optional intro, a repeated range and an optional tail; zero play count means infinite repeats, positive play count includes the first pass. ATRAC9 ranges include a preceding codec frame for decoder history. The output block layout, repeat-count mapping and error codes are unverified on hardware. Multiple, reverse, alternating and fractional loops throw.
+- [NGS2 system option flags](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - `sceNgs2SystemQueryBufferSize`, `sceNgs2SystemCreate` and `sceNgs2SystemCreateWithAllocator` accept `flags` 2 (bit 1) and ignore it. PPSA04540 (Rise of the Ronin) passes it when creating its system. The firmware's shared option validator, as read in [prosper](https://github.com/mattias800/prosper/blob/9b0698b1f51258a52dc2c0d9640e02caa9fcc0fa/prosper/src/hle/audio/hle_audio.cpp#L4155-L4188), checks the size and the fields from +0x6c on but not `flags` at +0x68. What bit 1 selects is unknown. Every other bit still throws, including bit 31, which shadPS4 reads.
+
+- [NGS2 render buffer capacity](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) is treated as available storage for one configured grain. PPSA01880 passes 303104 bytes for 256 stereo float frames (2048 bytes); rendering writes or clears only those frames and preserves the remaining capacity. Non-null silent outputs now undergo the same supported-format and minimum-size checks as audible outputs, with channel counts limited to 1 through 8. A zero buffer count throws: the module accepts it, but whether it renders voices is unknown. Before rendering, over 31 buffers return `0x804A830B`, a type other than 0x12, 0x13, 0x18 or 0x19 `0x804A8050` and a NULL buffer `0x804A8251`, per [prosper's reading](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/hle_audio.cpp#L4582-L4606); 0x13 and 0x19 then throw. Surplus capacity is unmeasured; channel and size refusals throw.
+- [NGS2 ATRAC9 waveform loops](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - unmeasured on a console. A loop starting inside the decoder delay or ending past the last sample, a loop block past the `data` chunk, a `smpl` chunk too short for its first loop and a looped file at a rate with no module frame size throw: the module wraps or does not bound these, and what it then decodes is unknown. As [prosper reads the module](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/ngs2_waveform.cpp#L249-L346), only the first loop's start and inclusive end are used, less the one-frame decoder delay, and type, fraction, play count and other loops are ignored; an end not after the start keeps one block, else an intro, the loop repeating forever and a tail. PPSA03747 (start 256, inclusive end 299224, 298969 samples) gets one block repeating forever
+- [NGS2 ATRAC9 parsed delay](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - `sceNgs2ParseWaveformData` reports one codec frame as `num_delay_samples` whatever the `fact` chunk's delay word holds, as [prosper's reading of `libSceNgs2.native.sprx`](https://github.com/mattias800/prosper/blob/30572df43ae20ff28f995db56149f7af42235741/prosper/src/hle/audio/ngs2_waveform.cpp#L224-L231) sets it for ATRAC9 (its [test](https://github.com/mattias800/prosper/blob/30572df43ae20ff28f995db56149f7af42235741/prosper/tests/hle/test_ngs2_waveform.cpp#L326-L342) expects 256 for a `fact` of 900 and 0). Not measured on a console. The block skip still comes from the `fact` chunk's third word, where prosper uses the same one-frame delay
 - [NGS2 submixer UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (control `0x20000004`) invokes the title's callback after input mixing on every playing grain, including silence. The 40-byte control and 48-byte process context follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/libraries/ngs2/ngs2_submixer.h). PPSA03747 installs a peak-meter callback; its code confirms the channel pointers, user data 0, channel count, grain size and sample-rate offsets and returns 0. Other user data words are preserved. Flags are assumed to be 1 after registration/restart and 0 thereafter, following UserFx2's first-process convention; this callback does not inspect them. Null handlers disable the effect, setup clears it, and nonzero callback results throw. These lifecycle and error semantics are unverified on console hardware.
 - [NGS2 voice callback after setup](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler or mixer setup clears the voice callback with the rest of the voice state. PPSA18216 registers a block-end callback for a streamed music voice, later sets the same voice up again for one-shot ATRAC9 blocks with user data 0, and registers the callback again before it streams again; its callback dereferences the block's user data, so it must not run for the one-shot blocks. A setup made from inside the voice's own callback clears that callback as well, so a callback that sets its voice up again and queues the next block runs once instead of for every block; PPSA18216 never sets a voice up from inside its callback, so that ordering is unverified. Unverified on console hardware.
 - [NGS2 ATRAC9 streaming](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) keeps waveform duration and skip counts across compressed input blocks. The shared `APPEND` flag (2), called `ONLY_DATA` in the compressed-data reference, ignores an ATRAC9 continuation block's sample, skip and repeat counts, following [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/bb98f26433fa9e711c219aac1711fe8ecba5bf3a/src/libs/ngs2.cpp); PPSA03747 confirms a 262044-byte initial buffer declaring 11310532 samples, followed by 16384-byte buffers with flags 3. Incomplete superframes are retained until more input arrives. Input-block completion callbacks allow refills; the final callback of a logical waveform waits for its buffered PCM to drain, preserving the existing complete-block repeat behaviour. This buffering, callback timing, decoded-byte accounting and starvation silence are unverified on hardware. A closed ATRAC9 stream ending before its declared samples throws; fragmented ATRAC9 waveforms with repeats are unsupported. PCM streaming retains its existing append validation and early-close behaviour.
@@ -18,25 +21,37 @@
 - [NGS2 streaming PCM waveforms](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - PPSA21402 streams its music by adding one block whose `num_samples` is the whole track and whose `data_size` is a 16 KiB first piece, with `CONTINUE`, and then adds each following piece with flag `0x2` (called `APPEND` here) and the same `num_samples`. No reference describes flag `0x2`. A 16-bit PCM block without skipped samples or repeats whose `num_samples` exceed its data is assumed to start such a stream; flag `0x2` is assumed to append the block's data to the last streaming block, ignoring its `num_samples`; the voice is assumed to output silence without advancing while it has played all appended data and `CONTINUE` is set; and the waveform is assumed to end at `num_samples` or, once `CONTINUE` is cleared, at the end of the appended data. `sceNgs2VoiceGetState` reports the bytes played as `decoded_data_size`, which the title uses to release its queued data, and the read position as `waveform_data`. Appending to a block that is not a stream, or other formats, skipped samples, repeats and partial frames, throw
 - [NGS2 matrix levels](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - levels are clamped to -4..4 and NaN is kept, as the PS4 firmware 11.00 `libSceNgs2.sprx` stores them; not yet confirmed on the PS5 library. That library rejects a level count of 0 and keeps the matrix; the PS5 error code is unknown, so a count of 0 throws, except on a sampler voice without a format, where it clears the matrix (see NGS2 voices without a format). `sceNgs2VoiceRunCommands` is not in that library, so its matrix levels command is assumed to clamp the same way
 - [NGS2 sampler voice state flag EMPTY](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - a playing sampler voice that still accepts blocks (`CONTINUE`) and has played all queued blocks reports `INUSE|PLAYING|EMPTY` (0x20) and keeps playing, so blocks added later play on. PPSA18391 (engine: Clickteam Fusion) reads `state_flags & 0x22 != 2` from `sceNgs2VoiceGetState` as the end of a sound and only then reuses the voice. When the console sets and clears EMPTY, and whether it also reports it for other voice types, is unverified on hardware.
+- [NGS2 reverb channel conversion](../../../core/libs/prx/libSceNgs2.native/src/Reverb.cpp) (libSceNgs2.native) - a reverb voice whose `num_input_channels` differs from `num_output_channels` (PPSA03747 sets up 2 inputs and 8 outputs) mixes its ports in the input layout and folds that to mono with the input count's gains, as an equal-count voice does, and runs the comb and allpass stages per output channel. The PS4 library's handling of the dry signal in this case is not checked: here it reaches the output layout through the default channel map, so a stereo input keeps its dry signal on the front left and right and the other outputs carry only the reverb
 - [NGS2 port matrix](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - a port without a matrix, or with a selected matrix whose levels were never set, mixes through a default channel map: mono reaches both stereo channels at -3 dB and the 5.1 and 7.1 centre, stereo folds to mono at -3 dB per side, and wider sources fold down with 0.5 and -3 dB gains. The map and the equivalence of an unset matrix with no matrix were measured from the PS4 firmware 11.00 `libSceNgs2.sprx`, not yet from the PS5 library. That library only accepts submixer and mastering voices with 1, 2, 6 or 8 channels, so the map into 3, 4, 5 or 7 channels throws. A matrix set with fewer levels than the destination needs still mixes only the rows it has
-- [NGS2 custom submixer rack](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - structure layouts from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_custom.h`; module id 0x1f for UserFx2 and 0x1d for UserFx, voice parameter ids `0x40001f00 | module index` and `0x40001d00 | module index`, the process flags (1 on the first process call after setup, 2 after a parameter change, 0 otherwise) and the call order (setup per voice at rack creation, process after the inputs are mixed, cleanup at destruction) come only from [KytyPS5](https://github.com/KytyPS5/KytyPS5) and shadPS4. Only UserFx and UserFx2 modules on a single buffer are accepted: other module ids, more buffers, a module control handler, different input and output channel counts, setup flags and default rack options throw. Each module's state is a separate buffer, not the `state_offset` slice of the voice state, and `sceNgs2VoiceGetState` still throws for this rack. As in KytyPS5, UserFx2 process runs only on grains where an input produced samples, so an effect tail stops with the input and a pending flag 2 waits for the next audible grain
-- [NGS2 custom module ids](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - a custom rack with a module id other than 0x13 (sampler rack), 0x1d and 0x1f (submixer rack) throws. Trails in the Sky 2nd Chapter (PPSA35169) creates a rack with module id 0x20 (`NGS2: custom module id 0x20 is not implemented`, #4246); which module it is, and its structure, are unknown.
+- [NGS2 custom submixer rack](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - UserFx2 process flags and setup/process/cleanup order follow only [KytyPS5](https://github.com/KytyPS5/KytyPS5), not a console measurement; layouts follow [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_custom.h`. A module control handler, unequal input and output channels, setup flags and default rack options throw. Module state is a separate buffer, not the `state_offset` slice of voice state; `sceNgs2VoiceGetState` throws for this rack. UserFx2 runs only on grains with input samples, so an effect tail stops with the input
+- [NGS2 custom UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - the 48-byte process context, process flags, callback error handling and null-handler behavior retain the existing submixer callback model and are not console-verified. Non-null module options throw because their console error is unknown. UserFx on custom sampler rack 0x4001 throws: its parameter indexing and routing are not implemented. Module id 0x19, the 40-byte voice parameter (handler and three user-data words), parameter id `0x40001900 | index`, and lack of option and module state follow [fma-rc's PS5 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943), including parameter dispatch at 0x25ec4.
+- [NGS2 custom Delay](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, 0x1d) - processing and defaults remain unverified on PS5. The [agreed compatibility path](https://github.com/boykopovar/AnyPS5/pull/9337#issuecomment-6351205140) preserves main's PCM pass-through for Void Terrarium (PPSA03061) until any Delay parameter is set; every `0x40001dxx` parameter throws. Only one-buffer custom submixers with no module state and a 20-byte option are accepted. Option type 0/1, taps 1..8, length 1..20000 and reserved 0 follow [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943). Other shapes and values throw because their console errors are unknown. This preserves host behavior, not console-equivalent Delay processing
+- [NGS2 custom module ids](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native) - Reverb (0x1b), PitchShift (0x20) and Convolution (0x23) are not processed: a rack that passes their creation checks throws. Gain (0x15) on custom sampler racks also throws. Per [fma-rc's 12.70 module reading](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A8302` for a wrong non-zero state size, and `0x804A8013`, `0x804A8099` and `0x804A8098` for a bad Reverb option size or word and PitchShift word. Unknown: check order, errors for a Gain option, missing Reverb or PitchShift options, other PitchShift and Convolution option sizes, and Convolution's state (64 bytes from SDK 3.0). PPSA04540 uses 0x15, 0x19, 0x1b and 0x23 (#8039), PPSA35169 0x20 (#4246) and PPSA33655 0x15, 0x19 and 0x1b
+- [NGS2 custom Gain module](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4002) - follows [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943): parameter `0x40001500 | module index` holds 37 linear levels, one per channel, default 0, and the module writes source × level into dest, ramping linearly over the grain from the previous level. Unverified: where the ramp starts and ends (here the grain's first sample is one step past the previous level and its last sample is at the new level), whether stopping or setting up the voice again resets the levels, and what the library does with a level outside -32 to 32 (here it throws). On a custom sampler rack, whose parameter index is one higher per fma-rc, Gain throws. A Gain module with an option throws: fma-rc reads Gain as taking none, and the error the library returns for one is unknown. The extra buffer is ignored, as fma-rc reads it
+- [NGS2 custom mastering rack](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native, rack 0x4003) - follows [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6319332943): option size is 0x508, matching the custom submixer rack layout. Creation returns `0x804A8052` above 37 channels; channels 9 to 37 throw because voices hold at most 8 channels. Mastering racks with modules throw: attached modules and non-default option fields are unverified on PS5. Voice control parameters 0x40030000 (setup), 0x40030004 (gain) and 0x40030005 (output) configure channels, levels and destination buffer. `sceNgs2VoiceGetState` fills common voice state flags. PPSA10278 and PPSA04540 create rack 0x4003 without modules (#8039)
+- [NGS2 custom rack buffers and channels](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, racks 0x4001 and 0x4002) - racks with 2 to 4 buffers, custom submixers with 9 to 37 channels and submixer `max_inputs` other than 1 or 2 throw: how modules and ports route several buffers is unknown, and voices hold at most 8 channels. Per [fma-rc's reading of the 12.70 module](https://github.com/boykopovar/AnyPS5/issues/8039#issuecomment-6294323150), creation returns `0x804A830B` for a buffer count outside 1 to 4 or below the submixer's `max_inputs`, `0x804A8306` for a module source, extra or dest buffer id at or above the count, and `0x804A8052` for more than 37 submixer channels; the check order is not known. `sceNgs2RackQueryBufferSize` throws for these options, as no source says whether it checks them. A port buffer id other than 0 throws. PPSA04540 creates racks with up to 4 buffers and a 16-channel custom submixer (#8039)
 - [NGS2 reverb rack](../../../core/libs/prx/libSceNgs2.native/src/Reverb.cpp) (libSceNgs2.native, rack 0x2001) - follows the PS4 firmware 11.00 `libSceNgs2.sprx`, read and checked against its output at 11.025 to 48 kHz, including parameter changes during playback (differences at float rounding level); not yet compared with the PS5 library. Structure layouts come from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_reverb.h` and the param ids 0x20010000 (setup) and 0x20010001 (I3DL2) from PPSA22520. Only the default `reverb_size` of 1 is handled, with its 14400-sample reflection buffer; other sizes and the library's half-rate mode throw. System sample rates below about 7.5 kHz, where an allpass delay would have no samples, throw. Setup only accepts equal input and output channel counts
 - [sceNgs2ReportRegisterHandler, sceNgs2ReportUnregisterHandler](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native, NIDs `uBIN24Tv2MI`, `nPzb7Ly-VjE`) keep a registry of report handlers. Register rejects a null handler with an invalid argument and returns `INVALID_OUT_ADDRESS` for a null out handle, then stores the report type, handler and user data under a freshly allocated opaque handle; unregister removes and frees the matching record and throws for a handle that is not registered. The signatures (report type, handler, user data, out handle) and (report handle) follow [SharpProspero](https://github.com/SvenGDK/SharpProspero) and [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_report.h`, and the 24-byte `Ngs2ReportDataHeader` passed to a handler is its `OrbisNgs2ReportDataHeader`. No report is produced yet, so no registered handler is ever invoked and PPSA04540, which imports both and registers a CPU load handler (type 5), still receives none.
-- [sceNgs2SystemSetSampleRate, sceNgs2SystemSetUserData, sceNgs2SystemGetUserData, sceNgs2SystemLock, sceNgs2SystemUnlock](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - shadPS4 only checks the system handle (`INVALID_SYSTEM_HANDLE`) and SharpProspero names what each call does; neither gives the other limits. A sample rate of 0 and a null user data pointer throw, any other rate is accepted, and changing the rate while a sampler filter is enabled throws because the filter coefficients were computed for the old rate. `sceNgs2SystemLock` and `sceNgs2SystemUnlock` follow [prosper's notes](https://github.com/mattias800/prosper/blob/d61eb2c0ad2de879ef74df9c4aa050c512804a18/prosper/src/hle/audio/hle_audio.cpp#L4367-L4384) on the PS5 module: Lock takes a per-system lock and counts nested holds, Unlock releases one hold from any thread and returns 0 without a hold, and `sceNgs2SystemRender` only tries the lock: while another thread holds it, Render clears one grain of each output, leaves the render count and voices unchanged and returns 0. The other calls do not wait for the system lock. Peace Walker (PPSA18216) holds it while it spins on a flag that its audio thread clears only after `sceNgs2SystemRender` and eight `sceNgs2VoiceGetStateFlags` calls, so on the console neither can wait for it. Whether the console's voice and rack calls take the lock at all is not known. `sceNgs2RackLock` still holds the library's lock until `sceNgs2RackUnlock`, as before
+- [sceNgs2SystemSetUserData, sceNgs2SystemGetUserData, sceNgs2SystemLock, sceNgs2SystemUnlock](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - shadPS4 only checks the system handle (`INVALID_SYSTEM_HANDLE`) and SharpProspero names what each call does; neither gives the other limits. A null user data pointer throws. `sceNgs2SystemLock` and `sceNgs2SystemUnlock` follow [prosper's notes](https://github.com/mattias800/prosper/blob/d61eb2c0ad2de879ef74df9c4aa050c512804a18/prosper/src/hle/audio/hle_audio.cpp#L4367-L4384) on the PS5 module: Lock takes a per-system lock and counts nested holds, Unlock releases one hold from any thread and returns 0 without a hold, and `sceNgs2SystemRender` only tries the lock: while another thread holds it, Render clears one grain of each output, leaves the render count and voices unchanged and returns 0. The other calls do not wait for the system lock. Peace Walker (PPSA18216) holds it while it spins on a flag that its audio thread clears only after `sceNgs2SystemRender` and eight `sceNgs2VoiceGetStateFlags` calls, so on the console neither can wait for it. Whether the console's voice and rack calls take the lock at all is not known. `sceNgs2RackLock` still holds the library's lock until `sceNgs2RackUnlock`, as before
+- [sceNgs2GetWaveformFrameInfo](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - not measured on a console; shadPS4 only stubs it, and prosper does not cover the call. The outputs are taken to be the frame fields of the parsed waveform info, which [prosper's reading of `libSceNgs2.native.sprx`](https://github.com/mattias800/prosper/blob/30572df43ae20ff28f995db56149f7af42235741/prosper/src/hle/audio/ngs2_waveform.cpp#L224-L231) fills for ATRAC9 with the superframe bytes and samples, the frames per superframe and a one-frame delay, whatever the `fact` chunk says. `PCM_I16L` answers channels * 2 bytes, 1 sample, 1 unit and no delay, as for parsed 16-bit PCM, itself assumed. Other types throw. Null outputs return `INVALID_OUT_ADDRESS` and an ATRAC9 format the codec does not accept `INVALID_WAVEFORM_FORMAT`; the codes are unverified
 - [sceNgs2RackSetUserData, sceNgs2RackGetUserData](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - the signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L418-L421) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2.cpp#L86-L111), which only logs them; neither gives an error. A handle that is not a live rack answers `INVALID_RACK_HANDLE` before a null user data pointer is checked, and the null pointer throws, as in `sceNgs2SystemGetUserData`. A new rack starts with 0. Not measured on a console
 - [sceNgs2RackGetInfo](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - field order from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `OrbisNgs2RackInfo` with the 64-byte name of the other info structures (216 bytes); `type` is assumed to be the rack id divided by 0x1000, `min_grain_samples` 64 (the system minimum) and `state_flags` 1; `uid` comes from a per-process rack counter, `render_count` is the owning system's render count and `active_voice_count` counts voices that are not empty (paused and stopped voices included). The last process ratio and tick and `active_channel_work_count` are left zero
+- [NGS2 system option checks](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - not verified on a console. `sceNgs2SystemQueryBufferSize`, `sceNgs2SystemCreate` and `sceNgs2SystemCreateWithAllocator` return `0x804A8013` (size), `0x804A8311` (max grain, a multiple of 64 up to 2048), `0x804A8310` (grain, a multiple of 64 up to the max), `0x804A8051` (one of ten sample rates) and `0x804A8052` (1 to 37 channels) in that order, following [prosper's PS5 module analysis](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/hle_audio.cpp#L4151-L4226). The four job scheduler pointers are neither inspected nor used.
+- [sceNgs2SystemSetGrainSamples, sceNgs2SystemSetSampleRate](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - a grain that is not a multiple of 64 is accepted, where the module returns `0x804A8310`, because the NGS2 tests render 8-sample grains. Changing the rate while a sampler filter is enabled throws, as the filter coefficients were computed for the old rate. After the handle check, a grain of 0 or above the system's maximum returns `0x804A8310`, and a rate other than 11025, 12000, 22050, 24000, 44100, 48000, 88200, 96000, 176400 or 192000 returns `0x804A8051`, per [prosper's reading of the module's command validators](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/hle_audio.cpp#L4355-L4399); not measured on a console
 - [sceNgs2VoiceQueryInfo](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - only info id 0x4001 is known: PPSA22520 passes an 8-byte buffer and branches on the first word being 1 or 2, so it is assumed to be the voice channel count (0 before the voice is set up); the second word is zeroed and other ids throw
+- [sceNgs2SystemCreateWithAllocator free handler](../../../core/libs/prx/libSceNgs2.native/src/System.cpp) (libSceNgs2.native) - an allocator with an `alloc_handler` but no `free_handler` throws after the option checks: the module only checks the `alloc_handler`, and what it does without a free handler is unknown. Otherwise `sceNgs2SystemCreate` returns `0x804A8020` for a null buffer info or host buffer, and `sceNgs2SystemCreateWithAllocator` `0x804A8023` for a null allocator or `alloc_handler`, before the null-handle `0x804A8010` and the option checks, per [prosper's reading of the module](https://github.com/mattias800/prosper/blob/8dcb5dfdb9997ede7c76783995010d6abd1222f8/prosper/src/hle/audio/hle_audio.cpp#L4246-L4334); not measured on a console
 - [sceNgs2VoiceGetOwner](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - the signature `(voiceHandle, outOwnerRack, outVoiceIndex)` follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L439-L440) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2.cpp#L322-L326), which only logs it; neither gives an error. The errors are unmeasured: a handle that is not a live voice answers `INVALID_VOICE_HANDLE` before the outputs are checked, as in `sceNgs2RackGetVoiceHandle`, and either output pointer null answers `INVALID_OUT_ADDRESS` without writing the other
+- [sceNgs2VoiceGetMatrixInfo](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a matrix id past the rack's `max_matrices` throws, as the PS5 code for shadPS4's PS4 [`INVALID_MATRIX_INDEX`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2_error.h#L92) is unknown. A matrix without levels reports 0 levels, though it mixes through the default channel map. Signature from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L442), layout (a count and 64 levels) from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2.h#L263-L266); levels are the stored, clamped ones. Unmeasured: a null info answers `INVALID_OUT_ADDRESS` and a size other than 260 `INVALID_OUT_SIZE` before the voice is checked, as in `sceNgs2VoiceGetPortInfo`
+- [sceNgs2CustomRackGetModuleInfo](../../../core/libs/prx/libSceNgs2.native/src/Rack.cpp) (libSceNgs2.native) - a size over 32 bytes throws, as the longer per-module info in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2_custom.h#L419-L442) is not kept. A size under 32 and an index past the rack's modules (any on a non-custom rack) also throw: the PS5 codes for shadPS4's PS4 [`INVALID_MODULE_INDEX` and `INVALID_MODULE_INFO_SIZE`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/ngs2/ngs2_error.h#L117-L118) are unknown. It repeats the ids, state offset and size from rack creation, reserved words 0, as [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Audio/Ngs2.cs#L323-L341) lays it out. Unmeasured: a null info gives `INVALID_OUT_ADDRESS`, then a bad handle `INVALID_RACK_HANDLE`
 - [sceNgs2VoiceControl patch](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a destination rack handle with input id 0 resolves to that rack's first voice; this matches the Dead Cells call in #4334, but selection for racks with multiple voices has not been checked against a console. Nonzero destination input ids still throw. `sceNgs2VoiceGetPortInfo` reports the resolved voice handle and zero delay.
 - [sceNgs2ParseWaveformFile](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - the signature `(path, offset, info)` is taken from the call site of PPSA21402, which sets only three argument registers; the file is read from `offset` to its end, the data and block offsets are taken to be relative to the start of the file, not of `offset`, and an unreadable file throws. The audio unit fields of a 16-bit PCM waveform are assumed to be one sample frame per unit and per frame; `INVALID_WAVEFORM_DATA` for a `data` chunk that runs past the buffer or ends inside a frame is assumed, and looped PCM and other PCM formats throw
 - [sceNgs2VoiceControl sampler filter](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - param `0x1000000a`, its layout and meaning follow KytyPS5 only: location 1 type 1 is an RBJ low-pass biquad at the system sample rate after resampling, scaled by `level`, a set `channel_mask` bit bypasses that channel, type 0 turns the filter off. Other locations and types throw. The voice keeps playing a filter tail after its last block until the history is zero, with outputs below 1e-20 flushed to zero (a KytyPS5 choice); the console's tail length is unknown
-- [sceNgs2PanInit / sceNgs2PanGetVolumeMatrix](../../../core/libs/prx/libSceNgs2.native/src/Pan.cpp) (libSceNgs2.native) - follow the PS4 firmware 11.00 `libSceNgs2.sprx`, read and checked against its output for 2, 4, 5 and 7 speakers into 1, 2, 6 and 8 channels; not yet confirmed on the PS5 library. Speakers are taken in the order L R, L R Ls Rs, L R C Ls Rs or L R C Ls Rs Lb Rb and kept in a fixed circular order, not sorted; without angles the defaults are 90/270, 40/110/250/320, 0/40/110/250/320 and 0/40/110/150/210/250/320 degrees. As in that library, defaults converted to radians keep the wrap-around entry in degrees, so angles past the last speaker pan almost fully to it. Error codes are not known for the PS5, so invalid arguments throw, including a speaker angle equal to the unit angle, on which that library loops forever. Angles so large that adding or subtracting a turn leaves them unchanged throw for the same reason
+- [sceNgs2PanInit / sceNgs2PanGetVolumeMatrix](../../../core/libs/prx/libSceNgs2.native/src/Pan.cpp) (libSceNgs2.native) - follow the PS4 firmware 11.00 `libSceNgs2.sprx`, read and checked against its output for 2, 4, 5 and 7 speakers into 1, 2, 6 and 8 channels; not yet confirmed on the PS5 library. Speakers are taken in the order L R, L R Ls Rs, L R C Ls Rs or L R C Ls Rs Lb Rb and kept in a fixed circular order, not sorted; without angles the defaults are 90/270, 40/110/250/320, 0/40/110/250/320 and 0/40/110/150/210/250/320 degrees. As in that library, defaults converted to radians keep the wrap-around entry in degrees, so angles past the last speaker pan almost fully to it. A speaker count of 0 without angles, which the firmware accepts, a non-finite speaker angle and a speaker angle equal to the unit angle, on which that library loops forever, throw. Angles so large that adding or subtracting a turn leaves them unchanged throw for the same reason
 - [sceNgs2GeomResetListenerParam, sceNgs2GeomResetSourceParam](../../../core/libs/prx/libSceNgs2.native/src/Geom.cpp) (libSceNgs2.native) - the structures (12, 16, 16, 60, 96, 108, 32 and 308 bytes) come from [KytyPS5](https://github.com/KytyPS5/KytyPS5)'s `ngs2.cpp` and match [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `ngs2_geom.h` field for field, but only KytyPS5 gives the behaviour - shadPS4 logs and returns success without writing the output. The defaults (orient front +Z, orient up +Y, sound speed 343, cone 1/360/1/360, rolloff 0/1000000/1/1, doppler factor, full-band, LFE and maximum level 1, two speakers and matrix format 2) are unverified on a PS5 title; KytyPS5 and iStark/PS5PCEM agree on them. PPSA15552 (Dead Cells) calls `sceNgs2GeomResetSourceParam` after creating its racks. A null output address returns `INVALID_OUT_ADDRESS` as elsewhere in the library rather than throwing as KytyPS5 does. `sceNgs2GeomApply` is now a minimal pass-through that follows [KytyPS5](https://github.com/KytyPS5/KytyPS5)'s `Ngs2GeomApply` (shadPS4 only stubs it): pitch 1, source position, volume the larger of the source minimum and maximum level, and a diagonal of the source maximum level (1 when it is not positive) over `matrix_format` channels (0 is two, at most 8). The listener and `flags` are ignored, so source attenuation, distance rolloff, panning and Doppler stay unimplemented; neither KytyPS5 nor this has been measured on a PS5, and a null output address returns `INVALID_OUT_ADDRESS` where KytyPS5 exits
-- [sceNgs2GeomCalcListener](../../../core/libs/prx/libSceNgs2.native/src/Geom.cpp) builds an orthonormal world-to-listener transform. The row-major matrix, front-axis priority and flag 1 for right-handed input follow [PS5PCEM](https://github.com/iStark/PS5PCEM/blob/d2534bac6325a2c61c0fa88977e5321074304484/src/hle/ngs2_geom.zig); they have not been measured on PS5 hardware. Velocity stays in world coordinates and positive finite sound speed is preserved. Orientation vectors are normalised and up is made perpendicular to front, so non-unit and slightly tilted vectors are accepted. When front and up are parallel, up is replaced by `(0,1,0)` or `(1,0,0)` so the basis stays defined: PPSA15552 (Dead Cells) passes `orient_front={0,0,1}` with `orient_up={0,0,1}` after moving the listener, which PS5PCEM rejects; the console error code is unknown. Unknown flags, zero orientation vectors, nonfinite input and an unrepresentable translation still throw without changing the output; console error codes are unknown, and a nonpositive sound speed throws where PS5PCEM and [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/ngs2.cpp) default it to 343. KytyPS5 always writes the identity matrix, so the transform rests on PS5PCEM plus that Dead Cells case. Dead Cells (PPSA15552) reaches this call after the custom sampler rack in #4334. This does not implement source attenuation, panning or Doppler in `sceNgs2GeomApply`.
+- [sceNgs2GeomCalcListener](../../../core/libs/prx/libSceNgs2.native/src/Geom.cpp) builds an orthonormal world-to-listener transform. The row-major matrix, front-axis priority and flag 1 for right-handed input follow [PS5PCEM](https://github.com/iStark/PS5PCEM/blob/d2534bac6325a2c61c0fa88977e5321074304484/src/hle/ngs2_geom.zig); they have not been measured on PS5 hardware. Velocity stays in world coordinates and positive finite sound speed is preserved. Orientation vectors are normalised and up is made perpendicular to front, so non-unit and slightly tilted vectors are accepted. When front and up are parallel, up is replaced by `(0,1,0)` or `(1,0,0)` so the basis stays defined: PPSA15552 (Dead Cells) passes `orient_front={0,0,1}` with `orient_up={0,0,1}` after moving the listener, which PS5PCEM rejects; the console error code is unknown. Zero orientation vectors, nonfinite input and an unrepresentable translation still throw without changing the output; console error codes are unknown, and a nonpositive sound speed throws where PS5PCEM and [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/df5b9b92be7dfd463b47756b707d6d356a9f0550/src/libs/ngs2.cpp) default it to 343. KytyPS5 always writes the identity matrix, so the transform rests on PS5PCEM plus that Dead Cells case. Dead Cells (PPSA15552) reaches this call after the custom sampler rack in #4334. This does not implement source attenuation, panning or Doppler in `sceNgs2GeomApply`.
 - [NGS2 custom sampler rack](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (libSceNgs2.native, rack 0x4001) - implements bounded support for the custom sampler rack and its built-in module 0x13 (Custom Voice Filter), unblocking PPSA15552 (Dead Cells) startup. Structure layouts come from [shadPS4's ngs2_custom.h](https://raw.githubusercontent.com/shadps4-emu/shadPS4/main/src/core/libraries/ngs2/ngs2_custom.h) (OrbisNgs2CustomVoiceFilterParam, 40 bytes) and live trace correlation from [prosper's hle_audio.cpp](https://raw.githubusercontent.com/mattias800/prosper/main/prosper/src/hle/audio/hle_audio.cpp) (0x40001300 command and parameters like 10000.0f and 0.707f). Routes parameter updates via the 0x40001300 command family into the Biquad filter engine. Filter type 0 clears the destination filter; type 1 configures the RBJ low-pass biquad frequency, Q and level. Other filter types and unmodeled configurations throw.
 - [sceNgs2VoiceGetState custom sampler](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native, rack 0x4001) - only the size and one field come from a title. PPSA15552 (Dead Cells) calls it on custom sampler voices with a 48-byte buffer at two sites (eboot `0x1740f90`, `0x1741009`) and reads only the 64-bit value at offset 16: the first site keeps it and the second subtracts the kept value, so it is filled with the voice's decoded sample count. Other sizes return `INVALID_OUT_SIZE` as for the other racks. The state flags fill the common voice state; the remaining fields stay zero. shadPS4's `OrbisNgs2CustomSamplerVoiceState` is about 80 bytes and does not match the size this title passes, so the field names and the console's value are unverified
-- [sceNgs2CalcWaveformBlock](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - VAG (0x1c) throws. ATRAC9 keeps AnyPS5's own mapping: it checks the config against the channels and rate (0x804A8431), leaves out the decoder delay from the skip and size, leaves both 0 for zero samples and computes the size in 64 bits, while [prosper reads the PS5 module](https://github.com/mattias800/prosper/blob/40d95db32efe1ad00106a5b9a84e018fffa9ecff/prosper/src/hle/audio/ngs2_waveform.cpp#L348-L396) without the check, with the delay, filling both and modulo 2^32. Linear PCM and float (0x10 to 0x1b), the null checks and the 0x804A8432 of other types follow that reading and [its entry point](https://github.com/mattias800/prosper/blob/40d95db32efe1ad00106a5b9a84e018fffa9ecff/prosper/src/hle/audio/ngs2_waveform.cpp#L444-L466). Closes when: VAG is mapped and ATRAC9 follows the module
+- [sceNgs2CalcWaveformBlock](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) (libSceNgs2.native) - an ATRAC9 config whose sampling-rate index (bits 20 to 23) is not 1, 4 or 7 throws, where the module reads 0 frame samples from its table and divides by zero. Every type follows [prosper's reading of the PS5 module](https://github.com/mattias800/prosper/blob/40d95db32efe1ad00106a5b9a84e018fffa9ecff/prosper/src/hle/audio/ngs2_waveform.cpp#L348-L396) and [its entry point](https://github.com/mattias800/prosper/blob/40d95db32efe1ad00106a5b9a84e018fffa9ecff/prosper/src/hle/audio/ngs2_waveform.cpp#L444-L466): linear PCM and float (0x10 to 0x1b), VAG (0x1c) and ATRAC9 (whole superframes from the config alone, a skip of one frame of decoder delay plus the position in the superframe, modulo 2^32), the null checks and the 0x804A8432 of other types. Closes when: the other sampling rates are known
 
 ### Functional
 
diff --git a/docs/dev/debt/libSceNpAuth.md b/docs/dev/debt/libSceNpAuth.md
index 9f41ec750a..e918766151 100644
--- a/docs/dev/debt/libSceNpAuth.md
+++ b/docs/dev/debt/libSceNpAuth.md
@@ -2,7 +2,9 @@
 
 ### Unknown function info
 
-- [sceNpAuthAbortRequest, sceNpAuthGetAuthorizationCode, sceNpAuthGetAuthorizationCodeA, sceNpAuthGetAuthorizationCodeV3, sceNpAuthGetIdToken, sceNpAuthGetIdTokenA, sceNpAuthGetIdTokenV3, sceNpAuthPollAsync, sceNpAuthWaitAsync](../../../core/libs/prx/libSceNpAuth/Export.cpp) (libSceNpAuth) - request tracking, `ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND` (0x80550306) on unknown IDs, `ORBIS_NP_AUTH_ERROR_INVALID_ID` (0x80550307) on non-async or unprocessed requests in Poll/Wait, `ORBIS_NP_AUTH_ERROR_INVALID_ARGUMENT` (0x80550301) on null arguments, and `ORBIS_NP_AUTH_ERROR_ABORTED` (0x80550304) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp) (PS4); the A calls forward to their V3 counterparts, which in shadPS4 ([AuthorizationCode A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L189-L193), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L195-L199); [IdToken A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L375-L378), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L380-L383)) call the same helper and differ only in a version flag; async requests defer `SCE_NP_ERROR_SIGNED_OUT` to Poll/Wait while sync requests fail immediately; PSN is not contacted. Parameter size validation and PS5 behavior are unverified
+- [sceNpAuthAbortRequest, sceNpAuthGetAuthorizationCode, sceNpAuthGetAuthorizationCodeA, sceNpAuthGetAuthorizationCodeV3, sceNpAuthGetIdToken, sceNpAuthGetIdTokenA, sceNpAuthGetIdTokenV3, sceNpAuthPollAsync, sceNpAuthWaitAsync](../../../core/libs/prx/libSceNpAuth/Export.cpp) (libSceNpAuth) - request tracking, `ORBIS_NP_AUTH_ERROR_REQUEST_NOT_FOUND` (0x80550306) on unknown IDs, `ORBIS_NP_AUTH_ERROR_INVALID_ID` (0x80550307) on non-async or unprocessed requests in Poll/Wait, `ORBIS_NP_AUTH_ERROR_INVALID_ARGUMENT` (0x80550301) on null arguments, and `ORBIS_NP_AUTH_ERROR_ABORTED` (0x80550304) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp) (PS4); the A calls forward to their V3 counterparts, which in shadPS4 ([AuthorizationCode A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L189-L193), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L195-L199); [IdToken A](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L375-L378), [V3](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp#L380-L383)) call the same helper and differ only in a version flag; async requests defer `SCE_NP_ERROR_SIGNED_OUT` to Poll/Wait while sync requests fail immediately; PSN is not contacted. Call sites in three disassembled titles (PPSA02225, PPSA15246, PPSA30601; static reading only) show the V3 parameter layouts: the code request parameter is 0x20 bytes (size, a 32-bit value that the titles take from their user object, a pointer to a client-ID-like string, a pointer to a constant string) and the call is `(reqId, param, code[128], int* issuerId)`; the ID token request parameter is 0x28 bytes (size, the same kind of 32-bit value, a pointer to a client-ID-like string, a pointer to a second buffer (256 bytes in one title) and a pointer to a constant string) and the call is `(reqId, param, token)`. The client-ID-like string is 36 characters plus a terminator in one title and a 128-byte buffer in two. In two titles the calls follow `sceNpAuthCreateAsyncRequest` (whose parameter holds only a size of 0x18) and are polled with `sceNpAuthPollAsync` (one title once per frame, one in a blocking loop of up to 40 polls 100 ms apart); the third title is a synchronous caller that takes the request ID from an argument-less call. All three call `sceNpAuthDeleteRequest` once the request has finished or failed (immediately after the call in the synchronous title, after a poll return of 0 in the per-frame title, on every path in the blocking one). The titles treat a poll return of 0 as finished and any negative result as a failure without looking at the specific code; one title, after 40 polls that still return non-zero, treats a return of exactly 1 as a timeout and calls `sceNpAuthAbortRequest`, and reports 0x80550301 and 0x80550306 from Poll as an invalid result pointer and an unknown request ID. The size fields are not checked here; the console's size checks and the behaviour of the calls on a console are unverified
+
+- [sceNpAuthPollAsync and sceNpAuthWaitAsync](../../../core/libs/prx/libSceNpAuth/Export.cpp) (libSceNpAuth) - PS5 abort-before-start behavior is unmeasured. Poll/Wait keep returning `ORBIS_NP_AUTH_ERROR_INVALID_ID` without changing output after a pre-start abort, including subsequent rejected getter calls, following [shadPS4 StartRequest and FindAsyncRequest](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_auth/np_auth.cpp).
 
 ### Functional
 
diff --git a/docs/dev/debt/libSceNpCommerce.md b/docs/dev/debt/libSceNpCommerce.md
index 02559d2c86..762eed1207 100644
--- a/docs/dev/debt/libSceNpCommerce.md
+++ b/docs/dev/debt/libSceNpCommerce.md
@@ -6,7 +6,7 @@
 
 ### Unknown function info
 
-- [sceNpCommerceDialogInitializeInternal](../../../core/libs/prx/libSceNpCommerce/Export.cpp) (libSceNpCommerce) - its name and NID are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpCommerce.c); the no-parameter prototype follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_commerce/np_commerce.cpp#L61) and is not measured on a console. It is declared without parameters solely to resolve known imports; this is not an ABI claim, and every call throws.
+- [sceNpCommerceDialogInitializeInternal](../../../core/libs/prx/libSceNpCommerce/Export.cpp) (libSceNpCommerce) - its name and NID are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpCommerce.c); the no-parameter prototype follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/np/np_commerce/np_commerce.cpp#L61) and delegates to `sceNpCommerceDialogInitialize()`, sharing dialog status and returning `COMMON_DIALOG_ERROR_ALREADY_INITIALIZED` (0x80B80004) when already initialized. Any internal options, parameter structs, or console error returns remain unmeasured on hardware.
 - [sceNpCommerceDialogOpen2](../../../core/libs/prx/libSceNpCommerce/Export.cpp): extended content combinations outside content mode 0 and content mode 1 with dialog mode 1 throw when otherwise valid. The native restriction reads process sysctl field 68; its relation to host process metadata is unresolved. Mode-specific meanings of the option and 64-bit argument remain unresolved.
 
 - [sceNpCommerceDialogOpen](../../../core/libs/prx/libSceNpCommerce/Export.cpp): Product copying and service submission remain part of the cancelled UI stub.
diff --git a/docs/dev/debt/libSceNpCommon.md b/docs/dev/debt/libSceNpCommon.md
index 2a8900021d..da67369967 100644
--- a/docs/dev/debt/libSceNpCommon.md
+++ b/docs/dev/debt/libSceNpCommon.md
@@ -2,134 +2,28 @@
 
 ### Unknown function info
 
-The 150 declarations below use names mapped from the local `libSceNpCommon.sprx` export table. Each NID was verified against that table and recomputed from its name with `tools/nid_names.py`. The public [PS5 3.20 libSceNpCommon export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/main/libSceNpCommon.c) contains all 150 symbol names. No prototype or behavior is claimed. Each declaration uses the no-parameter unknown-signature convention solely for import resolution and throws if called.
+The 35 declarations below use names mapped from the local `libSceNpCommon.sprx` export table. Each NID was verified against that table and recomputed from its name with `tools/nid_names.py`. The public [PS5 3.20 libSceNpCommon export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/main/libSceNpCommon.c) contains all 150 symbol names. No prototype or behavior is claimed. Each declaration uses the no-parameter unknown-signature convention solely for import resolution and throws if called.
 
-- [sceNpAllocateKernelMemoryNoAlignment](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `MWPOkqzYss0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAllocateKernelMemoryWithAlignment](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `gMlY6eewr-c`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpArchInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `jGF+MaB4b-M`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpArchTerm](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `UskWpVWxSvg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAtomicCas32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `+9+kKMY9YIw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAtomicDec32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Yohe0MMDfj0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpAtomicInc32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pfJgSA4jO3M`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64Decoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `l67qBmMmKP4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64Encoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pu39pU8UgCo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64GetDecodeSize](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `a5IfPlpchXI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64UrlDecoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `moGcgMNTHvQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64UrlEncoder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `IeNj+OcWgU8`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpBase64UrlGetDecodeSize](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `7BjZKcN+oZ4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutInitCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `9+m5nRdJ-wQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutStartOnCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fClnlkZmA6k`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutStartOnCtx64](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `lpr66Gby8dQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutStopOnCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `in19gH7G040`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCalloutTermCtx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `AqJ4xkWsV+I`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCancelEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kb2thTuS8t8`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpClearEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `9pLoHoPMxeg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpCloseEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `+nmn+Z0nWDo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpCloseSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `8hPzfjZzV88`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCmpNpIdInOrder](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `TcwEFnakiSc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCmpOnlineId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `dj+O5aD2a0Q`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `1a+iY5YUJcI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `q2tsVO3lM4A`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondSignal](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `uMJFOA62mVU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondSignalAll](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `bsjWg59A7aE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondSignalTo](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `bAHIOyNnx5Y`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondTimedwait](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ss2xO9IJxKQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCondWait](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fZShld2PQ7w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCreateEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `6jFWpAfqAcc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCreateSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `LHZtCT2W1Pw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpCreateThread](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fhJ5uKzcn0w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDbgAssignDebugId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `90pmGqDK4BI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDbgDumpBinary](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Etq15-l9yko`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDbgDumpText](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ZaKa5x61hGA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDeleteEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `sjnIeFCuTD0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpDeleteSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xPrF2nGPBXQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpFreeKernelMemory](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `vjwlDmsGtME`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpGetNavSdkVersion](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `QmDEFikd3VA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `sXVQUIGmk2U`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetProcessId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Z3mnqcGmf8E`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetRandom](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pJlGhXEt5CU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetSdkVersion](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Pglk7zFj0DI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetSdkVersionUInt](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ljqnF0hmLjo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGetSystemClockUsec](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `PVVsRmMkO1g`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocator](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `-gN6uE+zWng`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocatorEx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `VUHUasztbUY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocatorExPtr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `P4YpPziLBd4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpGlobalHeapGetAllocatorPtr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `DI5n4aOdxmk`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `wVdn78HKc30`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapGetAllocator](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `lvek8w7yqyE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapGetStat](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `2jdHoPpS+W0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `B+yGIX1+BTI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHeapShowStat](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `evz0-93ucJc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpHexToInt](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Hvpr+otU4bo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpInt32ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `5y0wMPQkaeU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpInt64ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `HoPC33siDD4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpIntGetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `G6qytFoBJ-w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIntIsOnlineIdString](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fY4XQoA20i8`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIntIsValidOnlineId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `hkeX9iuCwlI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpIntSetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `X6emt+LbSEI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIntToHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `TWPY1x1Atys`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIpc2ClientInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kgDwlmy78k0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpIpc2ClientTerm](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `CI2p6Viee9w`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpJoinThread](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `EjMsfO3GCIA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParse](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `vJGDnNh4I0g`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseBuf](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `RgfCYkjW7As`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseBufInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `SnAdybtBK3o`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseEx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `p5ZkSMRR7AU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseExInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `nhgjiwPUIzI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpJsonParseInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `teVnFAL6GNY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `zNb6IxegrCE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `++eqYdzB8Go`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondSignal](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Xkn6VoN-wuQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondSignalAll](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `FJ4DCt8VzVE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondSignalTo](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Bwi+EP8VQ+g`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwCondWait](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ExeLuE3EQCQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwMutexDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4zxevggtYrQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwMutexInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `1CiXI-MyEKs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwMutexLock](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `18j+qk6dRwk`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwMutexTryLock](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `hp0kVgu5Fxw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpLwMutexUnlock](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `CQG2oyx1-nM`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `dfXSH2Tsjkw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapGetAllocator](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `FaMNvjMA6to`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapGetAllocatorEx](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xHAiSVEEjSI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMemoryHeapInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kZizwrFvWZY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMutexDestroy](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `lQ11BpMM4LU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMutexInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `uEwag-0YZPc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMutexLock](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `r9Bet+s6fKc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMutexTryLock](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `DuslmoqQ+nk`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpMutexUnlock](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `oZyb9ktuCpA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpOpenEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `5DkyduAF2rs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpOpenSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `-blITIdtUd0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpPanic](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ZoXUrTiwKNw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpPollEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `9YmBJ8KF9eI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpPollSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xmF0yIF4iXc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpRtcConvertToPosixTime](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `VMjIo2Z-aW0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpRtcFormatRFC3339](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `W0YWLVDndx0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpRtcParseRFC3339](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `LtkeQwMIEWY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonGetErrorCode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `0lZHbA-HRD0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonMultiGetErrorCode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `cRabutqUG7c`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonParse](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `WSQxnAVLKgw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonParseInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `UbStlMKTBeU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpServerErrorJsonParseMultiInit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `hbe+DdooIi4`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpSetEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `29ftOGIrUCo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpSetPlatformType](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `m9JzZSoDVFY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpSignalSema](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `-W28+9p1CKI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrBuildHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `i5TP5NLmkoQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrParseHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `DUHzVPNlugg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToInt32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fElyBSn-l24`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToInt64](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `CwqYdG4TrjA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToUInt32](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `uj86YxCYid0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrToUInt64](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Ted2YU9lv94`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrcpyToBuf](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ivnnssCwjGI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrnParseHex](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `h1SWCcBdImo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpStrncpyToBuf](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `PHrpHMSU8Cs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpThreadGetId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `yvaNTRiKXmo`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUInt32ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `rRN89jBArEM`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUInt64ToStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `QjNUYQbGoHA`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUserGetUserIdList](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Gh74vNl06sg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilBuildTitleId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `N3tAHlBnowE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilCanonicalizeNpIdForPs4](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4mEAk-UKVNw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilCanonicalizeNpIdForPsp2](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `N3FB4r8JoRE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilCmpAccountId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `xPRHNaD3kTc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetDateSetAuto](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `owm52JoZ8uc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetDbgCommerce](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `1Gfhi+tZ9IE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetEnv](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `kBON3bAtfGs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
@@ -137,20 +31,29 @@ The 150 declarations below use names mapped from the local `libSceNpCommon.sprx`
 - [sceNpUtilGetFakeRateLimit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `O86rgZ2azfg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetIgnoreNpTitleId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `FrxliFYAO8Y`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetNpDebug](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `GRvK1ZE+FEQ`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `OFiFmfsADas`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCode2](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `X9CqyP164Hc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCode2Str](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `Fxux7Ob+Ynk`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNpLanguageCodeStr](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `RfiA17kV+xs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetNpTestPatch](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `OA8f3KF9JsM`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilGetNthChar](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `KCk4OGu8+sc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetShareTitleCheck](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `fB5hE65pzbU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetSystemLanguage](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `SXUNKr9Zkv0`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetTrcNotify](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `AjzLvR0g5Zs`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetWebApi2FakeRateLimit](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `pmHBFJyju9E`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetWebApi2FakeRateLimitTarget](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ZRxKp9vjcNc`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilGetWebTraceSetting](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4CqfNm3pisU`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilHttpUrlEncode](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `ajoqGz0D9Dw`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
 - [sceNpUtilJidToNpId](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `458yjI+OECI`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilJsonEscape](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `EftEB4kmkSg`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilJsonGetOneChar](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `vj04qzp7uKY`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
-- [sceNpUtilJsonUnescape](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) (NID `4YJ5gYtRAAE`) - the signature and behavior are unknown. The no-parameter declaration only resolves the import; it makes no ABI claim. Calls throw through `NotImplemented_nid_no_patch`.
+
+### Functional
+
+- [Online ID and NpId utilities](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - `sceNpCmpOnlineId`, `sceNpCmpNpIdInOrder`, `sceNpGetPlatformType` and `sceNpIntIsValidOnlineId` are not measured on a console; their signatures, checks and results follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_common.cpp), including the platform tags read from `opt[4..7]` and the 3 to 16 character online ID rule.
+- [Mutex, condition and thread wrappers](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - the `sceNpMutex*`, `sceNpLwMutex*`, `sceNpCond*` and `sceNpJoinThread` wrappers forward to the libkernel `scePthread*` calls as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_common.cpp) and are not measured on a console. Only `EBUSY` from try-lock and `ETIMEDOUT` from a timed wait are mapped to NP errors; every other kernel error is returned unchanged. The `flags` argument of `sceNpCondInit` is ignored.
+- [sceNpGetSdkVersion](../../../core/libs/prx/libSceNpCommon/Export.cpp) (libSceNpCommon) - writes the libkernel system software version as `major.minor` into an 8-byte buffer without checking it, as shadPS4 does; that version is the fixed `1.00`, not the SDK version a title was built with.
+- [The exports in Runtime.cpp](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) and [Strings.cpp](../../../core/libs/prx/libSceNpCommon/Strings.cpp) follow `libSceNpCommon.sprx` from firmware 13.60, read from disassembly and not measured on a console.
+- [sceNpCreateThread](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) always applies an explicit priority when one is given; the firmware picks between explicit and inherited scheduling from the title's compiled SDK version, which is not available here.
+- [sceNpCalloutStartOnCtx and sceNpCalloutStartOnCtx64](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) look for the callout in the queue before writing it and return `0x80558006` with the entry and the queue unchanged. Firmware 13.60, read from disassembly and not measured on a console, clears and fills the entry before it takes the lock and checks the queue, so restarting a queued callout returns the same error but drops every callout queued after it.
+- [sceNpArchInit and sceNpArchTerm](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) keep a reference count under a lock and create the global heap once. Firmware 13.60, read from disassembly and not measured on a console, uses no lock and never sets its count on the first call, so every call made while the count is zero creates the heap again, and a call to sceNpArchTerm at zero destroys the heap and leaves the count negative.
+- [sceNpGetRandom](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) draws from a 32-bit Mersenne Twister seeded once per process; the console uses SFMT-19937 with a seed set inside the module, so the sequences differ.
+- [sceNpHeapShowStat](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) and [sceNpDbgDumpBinary](../../../core/libs/prx/libSceNpCommon/Runtime.cpp) print the same information as the console in a different layout.
+- [The string-to-integer exports](../../../core/libs/prx/libSceNpCommon/Strings.cpp) clear `errno` before parsing; the firmware reads whatever `errno` held before the call when the result saturates.
+- [The integer-to-string exports](../../../core/libs/prx/libSceNpCommon/Strings.cpp) return `0x80558008` when the hexadecimal prefix does not fit; the firmware writes the prefix without checking the size. [The base64 decoders](../../../core/libs/prx/libSceNpCommon/Strings.cpp) treat bytes above 0x7F as invalid; the firmware indexes its table with them as signed values. [sceNpUtilJsonGetOneChar](../../../core/libs/prx/libSceNpCommon/Strings.cpp) checks that a `\u` escape and a surrogate pair fit in the input; the firmware reads past it.
+- [sceNpUtilGetNpDebug, sceNpUtilGetNpTestPatch, sceNpUtilGetTrcNotify, sceNpUtilGetIgnoreNpTitleId, sceNpUtilGetFakeDisplayNameMode, sceNpUtilGetWebTraceSetting, sceNpUtilGetWebApi2FakeRateLimit, sceNpUtilGetWebApi2FakeRateLimitTarget, sceNpUtilGetFakeRateLimit, sceNpUtilGetDbgCommerce, sceNpUtilGetSystemLanguage, sceNpUtilGetEnv, sceNpUtilGetDateSetAuto and sceNpUtilGetShareTitleCheck](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) read system and debug registry keys through libSceRegMgr, whose `sceRegMgrNonSysGetInt` and string reads still throw; they throw until those exist.
+- [sceNpOpenSema, sceNpCloseSema and sceNpCloseEventFlag](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) forward to the libkernel open and close calls for named semaphores and event flags, which still throw.
+- [sceNpSetPlatformType, sceNpIntGetPlatformType, sceNpIntSetPlatformType, sceNpUtilCanonicalizeNpIdForPs4, sceNpUtilCanonicalizeNpIdForPsp2, sceNpUtilJidToNpId and sceNpGetNavSdkVersion](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) depend on console platform tags, network domain names or a version string of the console; they throw.
+- [sceNpJsonParse, sceNpJsonParseInit, sceNpJsonParseBuf, sceNpJsonParseBufInit, sceNpJsonParseEx, sceNpJsonParseExInit and the sceNpServerErrorJson exports](../../../core/libs/prx/libSceNpCommon/PendingExports.cpp) are a streaming, schema-checked JSON parser whose event and error rules are not yet specified; they throw.
diff --git a/docs/dev/debt/libSceNpCppWebApi.md b/docs/dev/debt/libSceNpCppWebApi.md
index be7f650ac6..ee3994c483 100644
--- a/docs/dev/debt/libSceNpCppWebApi.md
+++ b/docs/dev/debt/libSceNpCppWebApi.md
@@ -2,16 +2,19 @@
 
 ### Silent stubs
 
-- [sce::Np::CppWebApi::Common](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the `finish` overrides of `TransactionBase<...>` (8 instantiations), `DownStreamTransaction<...>` (2 instantiations) and `Vector<IntrusivePtr<Leaderboards::V1::User>>::pushBack` return success without doing work; a failed request never produces a transaction to finish
+- [sce::Np::CppWebApi::Common](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the `finish` overrides of `TransactionBase<...>` (13 instantiations), `DownStreamTransaction<...>` (2 instantiations) and `Vector<IntrusivePtr<Leaderboards::V1::User>>::pushBack` return success without doing work; a failed request never produces a transaction to finish. `Transaction<...>::setOnFinishedCallback` and `TransactionBase<...>::setResponseInformationOption` (5 instantiations each, the `UserProfile::V1`, `ProfanityFilter::V2` and `CommunicationRestrictionStatus::V3` responses) return success without storing the callback or the option: `start` fails, so neither is ever used. The constructors and destructors of the same five `Transaction<...>` instantiations succeed without keeping state
 - [sce::Np::CppWebApi::Leaderboards::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - request-body and parameter bookkeeping succeeds without storing state: `GetRankingRequestBody::set{StartSerialRank,Group,Limit,Users,Offset}`, `RecordScoreRequestBody::set{Comment,SmallData,NeedsTmpRank,ComparedDateTime,PcId}`, `User::{setAccountId,setPcId}`, `BoardsApi::ParameterToGetBoardDefinition::{initialize,terminate}`, `RecordApi::ParameterToRecordLargeData::{initialize,terminate}`, `RecordApi::ParameterToRecordScore::{initialize,setxPsnAtomicOperation,terminate}`, `ViewApi::ParameterToGetLargeDataByObjectId::{initialize,terminate}`, `ViewApi::ParameterToGetRanking::{initialize,setgetRankingRequestBody,terminate}`
 - [sce::Np::CppWebApi::SessionManager::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - parameter bookkeeping succeeds without storing state: `PlayerSessionsApi::ParameterToCreatePlayerSessions::{ctor,dtor,initialize}`, `PlayerSessionsApi::ParameterToGetPlayerSessionInvitations::{ctor,dtor,initialize,setfields,setinvitationInvalidFilter}`, `PlayerSessionsApi::ParameterToJoinPlayerSessionAsPlayer::{ctor,dtor,initialize,terminate}`, `PlayerSessionsApi::ParameterToLeavePlayerSession::{ctor,dtor,initialize}`, `RequestPlayerSession::set{MaxSpectators,InvitableUserType,JoinableUserType,ExclusiveLeaderPrivileges}`, `RequestPlayerSessionPlayer::setPushContexts`
 - [sce::Np::CppWebApi::TitleCloudStorage::V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - `DataApi::ParameterToDownloadData::{initialize,terminate}` succeed without storing state
+- [sce::Np::CppWebApi::UserProfile::V1, ProfanityFilter::V2, CommunicationRestrictionStatus::V3](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - parameter bookkeeping succeeds without storing state: `FriendsApi::ParameterToGetFriends`, `PresenceApi::ParameterToGetBasicPresences`, `BlocksApi::ParameterToGetBlockingUsers`, `ProfanityApi::ParameterToFilterProfanity` and `CommunicationRestrictionStatusApi::ParameterToGetCommunicationRestrictionStatus`, each `{ctor,dtor,initialize,terminate}`
 
 ### Unknown function info
 
 - [sce::Np::CppWebApi](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - every request entry point (API calls, transaction `start`/`getResponse`/`readData`, the `*Factory::create`s) returns `SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN` offline. The constant's name and value follow the reference tables in shadPS4 `np_error.h` and fpPS4 `np_error.pas`, where `0x80552907` is `ORBIS_NP_WEBAPI_ERROR_NOT_SIGNED_IN` and `0x80552901` is `OUT_OF_MEMORY` (no `UNAVAILABLE` exists in the `0x80552901`-`0x8055291F` range); it is the code a signed-out console returns from these entry points. The earlier `0x80552901` value came from the module the previous implementation shipped, which used the same incorrect constant
 - [sce::Np::CppWebApi::Common::IntrusivePtr](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the 0x18-byte layout (object, deleter, `LibContext*`) and the offset of the 32-bit reference count in the pointee (0x00, 0x30 for `Vector`) come from the module bundled with one title (PPSA21564); other SDK versions are not checked. The destructor throws on the last reference of a pointer without a deleter: destroying the object needs its destructor and the `LibContext` allocator, which are not implemented
 - [sce::Np::CppWebApi::Common::String](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - the 0x20-byte layout (32-bit reference count, buffer at 0x08, buffer size at 0x10, `LibContext*` at 0x18) comes from the module bundled with one title (PPSA21564); other SDK versions are not checked. `append` grows the buffer with the host allocator and the destructor frees it, instead of going through the `LibContext` allocator. `pushBack` into `Vector<String>` stores a deep copy, so a destroyed temporary cannot invalidate the stored element; a title that byte-copies a `String` with a live buffer would still double-free, as nothing increments the reference count
-- [sce::Np::CppWebApi::Common::Vector](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - imported by PPSA03671, whose dump ships no `libSceNpCppWebApi.prx`. A `Vector` handle is an `IntrusivePtr` over a shared body; bodies created by `pushBack` use a host-side layout with the reference count at 0x30, matching the adopted-body convention measured on PPSA21564. The pointer/deleter constructor adopts a title-provided body released through the stored deleter; `pushBack` on such a body throws, since its element layout is unknown. `begin`, `end`, iterators and `operator[]` throw: the only `Vector`s the title reads back come from failed transactions, which never produce one
+- [sce::Np::CppWebApi::Common::Vector](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - imported by PPSA03671, whose dump ships no `libSceNpCppWebApi.prx`. A `Vector` handle is an `IntrusivePtr` over a shared body; bodies created by `pushBack` use a host-side layout with the reference count at 0x30, matching the adopted-body convention measured on PPSA21564. The pointer/deleter constructor adopts a title-provided body released through the stored deleter; `pushBack` on such a body throws, since its element layout is unknown. `begin`, `end`, iterators and `copyFrom` throw: the only `Vector`s the title reads back come from failed transactions, which never produce one. `empty`, `size` and `operator[]` read the host-created body honestly and throw on title-provided bodies
 - [sce::Np::CppWebApi::SessionManager2V1](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - imported by PPSA03671. Offline, the factories, `PlayerSessionsApi` calls and transaction `start`/`getResponse`/`readData` fail with `SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN`; parameter setters, `initialize`, `terminate`, constructors and destructors succeed without keeping state, as no request is ever sent. Response-body accessors (`getSessionId`, `getPlayerSessions`, `getInvitations`, the `IsSet` queries) throw: a failed request never produces a response object
+- [sce::Np::CppWebApi::UserProfile::V1, ProfanityFilter::V2, CommunicationRestrictionStatus::V3](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - imported by an Epic Online Services module whose dump ships no `libSceNpCppWebApi.prx`. The reference-count offset 0x00 of `ResponseHeaderBase` and `WebApiFilterRequest` is assumed from the other objects, not measured. Offline, the five API calls, `WebApiFilterRequestFactory::create` and the transactions' `start`/`getResponseHeaders` fail with `SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN`. Response accessors, `ResponseHeaderBase::getHeaderValue` and the `Vector`/`Iterator` members over `IntrusivePtr<UserProfile::V1::BasicPresence>` and `unsigned long` throw: a failed request never produces a response
 - [libSceNpCppWebApi](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - unimplemented stubs have their parameter lists, const qualifiers and return types aligned with the demangled symbols confirmed by NID matching in [#8143](https://github.com/boykopovar/AnyPS5/issues/8143). They cover response-body accessors, iterators, and uninstantiated transactions in Leaderboards::V1, SessionManager::V1, InGameCatalog::V5, TitleCloudStorage::V1, and Common templates: each mangled name gives the method and parameter types, but the runtime layout of response objects and errors are unverified on console, so each call continues to throw NotImplemented_nid_no_patch. No call site is recorded for them
+- [sce::Np::CppWebApi::SessionManager2V1 and sce::Np::CppWebApi::InGameCatalog2V5](../../../core/libs/prx/libSceNpCppWebApi/Export.cpp) (libSceNpCppWebApi) - 198 further exports imported by PPSA20397, named from aerolib. API calls, factories and transaction `start`/`getResponse*` fail `SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN`; parameter bookkeeping succeeds without state; `IntrusivePtr`/`Vector` helpers follow the layouts above, with `Vector::empty`/`size`/`operator[]` reading host-created bodies and throwing on title-provided ones. Response accessors, iterators, `Vector::begin`/`end`/`copyFrom` and transaction `abort`/`getId`/`operator=` throw: a failed request produces no response object, and aborting or renumbering a transaction that never ran has no defined outcome
diff --git a/docs/dev/debt/libSceNpFriendListDialog.md b/docs/dev/debt/libSceNpFriendListDialog.md
index 1c3824ba59..2d5b73e230 100644
--- a/docs/dev/debt/libSceNpFriendListDialog.md
+++ b/docs/dev/debt/libSceNpFriendListDialog.md
@@ -1,5 +1,9 @@
 # libSceNpFriendListDialog technical debt
 
+### Silent stubs
+
+- [libSceNpFriendListDialog](../../../core/libs/prx/libSceNpFriendListDialog/Export.cpp) - the friend list dialog (`sceNpFriendListDialogOpenA` and `sceNpFriendListDialogGetResultA`) runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no PSN friend list. The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
+
 ### Unknown function info
 
-- [sceNpFriendListDialogClose, sceNpFriendListDialogGetResult, sceNpFriendListDialogGetResultA, sceNpFriendListDialogGetStatus, sceNpFriendListDialogInitialize, sceNpFriendListDialogOpen, sceNpFriendListDialogOpenA, sceNpFriendListDialogTerminate and sceNpFriendListDialogUpdateStatus](../../../core/libs/prx/libSceNpFriendListDialog/Export.cpp) (libSceNpFriendListDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpFriendListDialog.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpFriendListDialogGetResult and sceNpFriendListDialogOpen](../../../core/libs/prx/libSceNpFriendListDialog/Export.cpp) (libSceNpFriendListDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpFriendListDialog.c), but Orbital has prototypes only for the `A` variants and no credible prototypes were found for these. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceNpManager.md b/docs/dev/debt/libSceNpManager.md
index 96633c6c2b..0595fc92c4 100644
--- a/docs/dev/debt/libSceNpManager.md
+++ b/docs/dev/debt/libSceNpManager.md
@@ -6,7 +6,7 @@
 
 ### Unknown function info
 
-- [libSceNpManager pending exports](../../../core/libs/prx/libSceNpManager/Export.cpp) - 149 named callable exports are present in the local `libSceNpManager.sprx` export table and the public PS5 3.20 symbol list. Their signatures and behavior are unverified; each declaration uses the no-parameter unknown-signature convention and throws through `NotImplemented_nid_no_patch`.
+- [libSceNpManager pending exports](../../../core/libs/prx/libSceNpManager/Export.cpp) - 143 named callable exports are present in the local `libSceNpManager.sprx` export table and the public PS5 3.20 symbol list. Their signatures and behavior are unverified; each declaration uses the no-parameter unknown-signature convention and throws through `NotImplemented_nid_no_patch`.
 
 - [sceNpGetSandboxInfo](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager, NID `ZVZ++68nNI8`) - the name hashes to the imported NID (found with nidhunt, confirmed with `tools/nid_names.py`). STAR WARS: Galactic Racer (PPSA28416) imports it; its OnlineSubsystemPS5 calls it with one pointer to a 0x50-byte stack buffer and reads the buffer as a string (discussions/3086). The returned string, the exact parameter struct and console errors are unknown, so every call throws without reading or writing caller memory. A working implementation belongs with that title's bring-up.
 - [sceNpUnknown_8weiQyIdI3A](../../../core/libs/prx/libSceNpManager/Export.cpp): the original name remains unknown. The native wrapper takes a user ID and a read-only 20-byte online-ID record, validates its first byte and sends the record through IPC. The implementation remains a throwing stub.
@@ -18,6 +18,7 @@
 ### Functional
 
 - [sceNpGetAccountCountry, sceNpGetAccountDateOfBirth, sceNpGetAccountLanguage, sceNpGetParentalControlInfo](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - PS4 forms taking an online id, not measured on a console. Signatures and checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp): a null pointer is `INVALID_ARGUMENT`; no user is signed in, so no online id matches one and the rest return `USER_NOT_FOUND` without writing, like `sceNpCheckNpAvailability`. Request ids are not checked
+- [sceNpCheckNpAvailabilityA, sceNpGetAccountDateOfBirthA, sceNpGetAccountLanguageA, sceNpGetGamePresenceStatus, sceNpGetGamePresenceStatusA, sceNpGetParentalControlInfoA](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - answer as if no PSN account is signed in; the signed-in behaviour is not implemented and none of it is measured on a console. Checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c2814041e546bf75c12756dbec9da911c721ce1c/src/core/libraries/np/np_manager.cpp): a null pointer or user id -1 is `INVALID_ARGUMENT`, then request id 0 is `INVALID_ARGUMENT` and an unknown one `REQUEST_NOT_FOUND`. Other users get `SIGNED_OUT` with nothing written, as from `sceNpGetAccountCountryA`; shadPS4's `sceNpGetAccountDateOfBirthA` returns `USER_NOT_FOUND` for a user it does not know. An async request gets `SIGNED_OUT` from the call; shadPS4 returns 0 and leaves it to `sceNpPollAsync`. The presence queries write `OFFLINE` (0) and return 0
 - [sceNpGetUserIdByOnlineId](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the `(online id, user id output)` signature follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp#L703): a null online id or output returns `SCE_NP_ERROR_INVALID_ARGUMENT`, and a signed-out NP returns `SCE_NP_ERROR_SIGNED_OUT` without writing the output, as `sceNpGetUserIdByAccountId` does
 - [sceNpCheckPlus](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the `(request id, parameter, result)` signature follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp#L246): request id 0 or a null parameter or result returns `SCE_NP_ERROR_INVALID_ARGUMENT`, and every other call returns `SCE_NP_ERROR_SIGNED_OUT` without writing the result, as `sceNpCheckPremium` does. The parameter's size and feature fields, which shadPS4 checks, are not read: the errors the console returns for them are not known
 - [sceNpGetAccountId, sceNpSetGamePresenceOnline](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - PS4 forms; the `(online id, account id output)` and `(request id, online id, presence)` signatures follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp#L1092-L1096). A null online id or output, or request id 0 for `sceNpSetGamePresenceOnline`, returns `SCE_NP_ERROR_INVALID_ARGUMENT`. `sceNpSetGamePresenceOnline` then returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` for a request that was never created or was deleted, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c1b26558352b863f80142256e4df38585aa7d727/src/core/libraries/np/np_manager.cpp#L1098-L1104) does. Otherwise both return `SCE_NP_ERROR_SIGNED_OUT` without writing, as `sceNpGetAccountIdA` does. The console's result for a signed-out user is not measured
@@ -28,3 +29,8 @@
 - [sceNpIsPlusMember and sceNpSetContentRestriction](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the signatures and checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_manager.cpp): a null output or restriction is `INVALID_ARGUMENT`, a restriction size other than 0x18 is `INVALID_SIZE` (0x80550011), and a negative default age, more than 256 age restrictions or a count without an array is `INVALID_ARGUMENT`. Any user is reported as not a Plus member, and a valid restriction is accepted and not stored. Not measured on a PS5
 
 - [sceNpCheckCallbackForLib](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - not measured on a PS5: it delivers the pending state callbacks like `sceNpCheckCallback`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_manager.cpp) does with its pending state events; shadPS4's `sceNpCheckCallback` also runs other registered NP callbacks, which this library does not keep
+
+- [sceNpAbortRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` and a live request returns 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpAbortRequest`; shadPS4 there also moves the request into an `Aborted` state that its later requests read as `ABORTED`, and whether aborting on the console changes a live request's completion is not measured on a PS5 ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)), so nothing in this library reads an abort state and the id stays live
+- [sceNpDeleteRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND`, and a live request is removed and returns 0, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpDeleteRequest` ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277))
+- [sceNpPollAsync](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - a null result pointer returns `SCE_NP_ERROR_INVALID_ARGUMENT` before the id is read, a request id that was never created or was deleted returns `SCE_NP_ERROR_REQUEST_NOT_FOUND` without writing the caller's result, and a live request keeps its signed-out completion `0` with `SCE_NP_ERROR_SIGNED_OUT`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp) does in `sceNpPollAsync` ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)). The parts of that model beyond the validation are not implemented: shadPS4 keeps a per-request state machine decorated by `sceNpCheckNpAvailability` and neighbors and refuses `InvalidId` for a ready async request in wait/poll, whose completion publication, poll-versus-wait precedence and already-complete errors remain unattributable to the PS5
+- [sceNpCreateAsyncRequest](../../../core/libs/prx/libSceNpManager/Export.cpp) (libSceNpManager) - the parameter is not read ([NpCreateAsyncRequestParameter](../../../core/libs/SceTypes.hpp) is a 0x40-byte opaque blob, so shadPS4's nonnull check and `size == sizeof` reject ([81be949167d0060b08f26dc3e055a0b640d129c8](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_manager.cpp)) cannot be applied without inventing a layout) and no async kind or completion state is stored until the console's contract for them is evidenced ([#9277](https://github.com/boykopovar/AnyPS5/issues/9277)); `sceNpWaitAsync` (`jyi5p9XWUSs`) has no export here yet and stays with [PR #9282](https://github.com/boykopovar/AnyPS5/pull/9282)
diff --git a/docs/dev/debt/libSceNpMatching2.md b/docs/dev/debt/libSceNpMatching2.md
new file mode 100644
index 0000000000..edbc279625
--- /dev/null
+++ b/docs/dev/debt/libSceNpMatching2.md
@@ -0,0 +1,6 @@
+# libSceNpMatching2 technical debt
+
+### Functional
+
+- [sceNpMatching2Initialize, sceNpMatching2Terminate](../../../core/libs/prx/libSceNpMatching2/Export.cpp) (libSceNpMatching2) - only the library state is kept: initialization checks the parameter's `size` field (0x28, or 0x30 with an SSL pool) as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/81be949167d0060b08f26dc3e055a0b640d129c8/src/core/libraries/np/np_matching2/np_matching2.cpp) does and starts no thread; a second initialization returns `ALREADY_INITIALIZED` and a termination without one `NOT_INITIALIZED`. The pool, thread and SSL settings are not used: no matching server is reached. Not measured on a console
+- [sceNpMatching2CreateContext and the context calls](../../../core/libs/prx/libSceNpMatching2/Export.cpp) (libSceNpMatching2) - offline only, not measured on a PS5: the checks follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_matching2/np_matching2.cpp#L26-L349) and its [context manager](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_matching2/np_matching2_internal.cpp#L1348-L1457) (a `0x28`-byte parameter, ten ids handed out round-robin). `sceNpMatching2ContextStart` returns `0x804101E2` (`SCE_NET_ERROR_RESOLVER_ETIMEDOUT`), which shadPS4 says was confirmed on a console disconnected from the internet, so no context starts and `sceNpMatching2ContextStop` answers `CONTEXT_NOT_STARTED`. Callbacks and the default request option are checked but never used. The room, user, world, server-id and signaling-info calls still throw
diff --git a/docs/dev/debt/libSceNpParty.md b/docs/dev/debt/libSceNpParty.md
index 45d68abf16..e88c71d92d 100644
--- a/docs/dev/debt/libSceNpParty.md
+++ b/docs/dev/debt/libSceNpParty.md
@@ -2,4 +2,7 @@
 
 ### Unknown function info
 
-- [sceNpPartyGetState](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the 16-bit state, its `NOT_IN_PARTY` value 2 and the `INVALID_ARGUMENT` (`0x80552504`) error follow shadPS4's [np_party.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_party.h) and [np_error.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_error.h) (PS4); shadPS4 does not check for a null state, and whether the console needs an initialized party library first is not known. Not measured on a PS5
+- [sceNpPartyGetState and sceNpPartyGetStateAsUserA](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the 16-bit state, its `NOT_IN_PARTY` value 2 and the `INVALID_ARGUMENT` (`0x80552504`) error follow shadPS4's [np_party.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_party.h) and [np_error.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_error.h) (PS4); shadPS4 does not check for a null state, and whether the console needs an initialized party library first is not known. Not measured on a PS5
+- [sceNpPartyGetId, sceNpPartyGetMembersA, sceNpPartyGetMemberInfoA, sceNpPartyGetMemberSessionInfo, sceNpPartyGetMemberVoiceInfo and sceNpPartySendBinaryMessage](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the user is never in a party, so these return `NOT_IN_PARTY` (`0x80552506`, shadPS4's np_error.h) and write nothing, or `INVALID_ARGUMENT` for a null pointer; the signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json). Like `sceNpPartyGetState` they do not require `sceNpPartyInitialize`, and the order of the null and party checks on the console is not known. Not measured on a PS5
+- [sceNpPartyInitialize, sceNpPartyTerminate, sceNpPartyCheckCallback and sceNpPartyRegisterHandlerA](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - an initialized flag with `ALREADY_INITIALIZED` (`0x80552502`) and `NOT_INITIALIZED` (`0x80552503`) from shadPS4's np_error.h; the handlers are accepted but never called, since no party event can happen. Whether the console refuses a null initialize parameter, and which check comes first, is not known
+- [sceNpPartyCreate, sceNpPartyCreateA, sceNpPartyGetMemberInfo, sceNpPartyGetMembers, sceNpPartyGetStateAsUser, sceNpPartyGetVoiceChatPriority, sceNpPartyJoin, sceNpPartyLeave, sceNpPartyRegisterHandler, sceNpPartyRegisterPrivateHandler, sceNpPartySetVoiceChatPriority, sceNpPartyShowInvitationList, sceNpPartyShowInvitationListA and sceNpPartyUnregisterPrivateHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - Orbital has no prototypes for these and no credible ones were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceNpProfileDialog.md b/docs/dev/debt/libSceNpProfileDialog.md
index 2755456503..54a1f1b591 100644
--- a/docs/dev/debt/libSceNpProfileDialog.md
+++ b/docs/dev/debt/libSceNpProfileDialog.md
@@ -1,5 +1,14 @@
 # libSceNpProfileDialog technical debt
 
+### Silent stubs
+
+- [sceNpProfileDialogOpen, sceNpProfileDialogOpenA, sceNpProfileDialogGetResult](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - no profile is shown: `Open` and `OpenA` move the dialog straight to `FINISHED`, and `GetResult` reports `result` 0, `userAction` `USER_CANCELED` (1) and the caller's `userData`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c2814041e546bf75c12756dbec9da911c721ce1c/src/core/libraries/np/np_profile_dialog/np_profile_dialog.cpp#L21-L180) does when its window is dismissed. Not measured on a console.
+
 ### Unknown function info
 
-- [sceNpProfileDialogClose, sceNpProfileDialogGetResult, sceNpProfileDialogGetStatus, sceNpProfileDialogInitialize, sceNpProfileDialogOpen, sceNpProfileDialogOpenA, sceNpProfileDialogTerminate and sceNpProfileDialogUpdateStatus](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpProfileDialog.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpProfileDialogOpen, sceNpProfileDialogOpenA, sceNpProfileDialogGetResult](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - the layouts come from the [shadPS4 header](https://github.com/shadps4-emu/shadPS4/blob/c2814041e546bf75c12756dbec9da911c721ce1c/src/core/libraries/np/np_profile_dialog/np_profile_dialog.h#L31-L66) alone: `SceNpProfileDialogParam` 128 bytes with `userData` at 88, `SceNpProfileDialogParamA` 120 bytes with 4 unnamed bytes after `targetAccountId` and `userData` at 80, the result 48 bytes. A param whose `size` is not that size, or whose `mode` is not 1 to 4, throws. `baseParam` (size, magic), `userId` and the target ID are not checked.
+- [sceNpProfileDialogOpen, sceNpProfileDialogOpenA, sceNpProfileDialogClose, sceNpProfileDialogGetResult](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - these paths throw because shadPS4 and the other common dialogs here return different errors: `Open` or `OpenA` before `Initialize` (shadPS4 `INVALID_STATE`, the Signin family `NOT_INITIALIZED`); `Close` on a dialog that is not running, which is every `Close` after `Initialize` here (shadPS4 `NOT_RUNNING`, the Signin family 0 and `FINISHED`); `GetResult` with a null result before the dialog finishes (shadPS4 `ARG_NULL`, Signin and NetCtlAp `NOT_FINISHED`).
+
+### Functional
+
+- [sceNpProfileDialogInitialize](../../../core/libs/prx/libSceNpProfileDialog/Export.cpp) (libSceNpProfileDialog) - never returns shadPS4's `NOT_SYSTEM_INITIALIZED` (`sceCommonDialogInitialize` not called) or `BUSY` (another common dialog in use): libSceCommonDialog shares neither state here.
diff --git a/docs/dev/debt/libSceNpScoreRanking.md b/docs/dev/debt/libSceNpScoreRanking.md
new file mode 100644
index 0000000000..d373e91695
--- /dev/null
+++ b/docs/dev/debt/libSceNpScoreRanking.md
@@ -0,0 +1,5 @@
+# libSceNpScoreRanking technical debt
+
+### Functional
+
+- [libSceNpScoreRanking](../../../core/libs/prx/libSceNpScoreRanking/Export.cpp) (libSceNpScoreRanking) - offline only, not measured on a PS5: the argument checks, their order, the limit of 32 title contexts and 32 requests and the array sizes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_score/np_score.cpp#L64-L1210), and a valid call then returns `SCE_NP_ERROR_SIGNED_OUT` and finishes its request with it, as shadPS4 does when the user [has no connection](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_handler/np_handler_score.cpp#L18-L26). No output is written, where shadPS4 first clears the rank, comment and info arrays. A null `boardInfo` throws: shadPS4 answers it by the title's SDK version
diff --git a/docs/dev/debt/libSceNpSessionSignaling.md b/docs/dev/debt/libSceNpSessionSignaling.md
index f6a89b9950..33ed1372ba 100644
--- a/docs/dev/debt/libSceNpSessionSignaling.md
+++ b/docs/dev/debt/libSceNpSessionSignaling.md
@@ -5,4 +5,8 @@
 - [sceNpSessionSignalingInitialize, sceNpSessionSignalingCreateContext and sceNpSessionSignalingCreateContext2](../../../core/libs/prx/libSceNpSessionSignaling/Export.cpp) - the initialization layout is 40 bytes; both context layouts are 56 bytes with callback and user-data pairs. The second context variant adds a group identifier to its connection callback. Pool allocation, callback delivery and underlying NP account validation are not implemented; priority and affinity settings do not affect host scheduling.
 
 - [sceNpSessionSignalingGetConnectionStatus, sceNpSessionSignalingActivateSession and sceNpSessionSignalingActivateUser](../../../core/libs/prx/libSceNpSessionSignaling/Export.cpp) - initialization, context lookup and output validation follow the system library. Connections never activate in the offline runtime; activation returns unavailable and a connection query on a valid context returns connection-not-found without writing outputs. SDK-dependent peer-address validation and local-network discovery remain incomplete.
-- [sceNpSessionSignalingCreateJoinActivate, sceNpSessionSignalingGetConnectionFromNetAddress, sceNpSessionSignalingGetCustomProperty, sceNpSessionSignalingGetGroupFromPeerAddress, sceNpSessionSignalingInitializeWithPort, sceNpSessionSignalingJoinActivate and sceNpSessionSignalingSetCustomProperty](../../../core/libs/prx/libSceNpSessionSignaling/Export.cpp) (libSceNpSessionSignaling) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpSessionSignaling.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
+- [sceNpSessionSignalingCreateJoinActivate, sceNpSessionSignalingGetCustomProperty, sceNpSessionSignalingGetGroupFromPeerAddress, sceNpSessionSignalingInitializeWithPort, sceNpSessionSignalingJoinActivate and sceNpSessionSignalingSetCustomProperty](../../../core/libs/prx/libSceNpSessionSignaling/Export.cpp) (libSceNpSessionSignaling) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpSessionSignaling.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
+
+### Functional
+
+- [sceNpSessionSignalingGetGroupInfo, sceNpSessionSignalingGetGroupFromSessionId, sceNpSessionSignalingGetConnectionFromNetAddress, sceNpSessionSignalingGetConnectionFromNetAddress2, sceNpSessionSignalingGetConnectionFromPeerAddress, sceNpSessionSignalingGetConnectionFromPeerAddress2](../../../core/libs/prx/libSceNpSessionSignaling/Export.cpp) (libSceNpSessionSignaling) - no session ever activates here, so every lookup on a valid context ends at not-found (group 0x8055330A, connection 0x8055330C). The signatures and the checks before it are the PS5 12.00 module's, read from disassembly: 0x80553301 before initialization, 0x80553303 for a null pointer, then 0x80553308 for an unknown context
diff --git a/docs/dev/debt/libSceNpSignaling.md b/docs/dev/debt/libSceNpSignaling.md
new file mode 100644
index 0000000000..c0dba40607
--- /dev/null
+++ b/docs/dev/debt/libSceNpSignaling.md
@@ -0,0 +1,9 @@
+# libSceNpSignaling technical debt
+
+### Unknown function info
+
+- [sceNpSignalingDeactivateConnection](../../../core/libs/prx/libSceNpSignaling/Export.cpp) (libSceNpSignaling) - imported by PS4 titles, which do not load without it, and added without an implementation: declared without parameters, every call throws
+
+### Functional
+
+- [libSceNpSignaling](../../../core/libs/prx/libSceNpSignaling/Export.cpp) (libSceNpSignaling) - offline only, not measured on a PS5: the checks, their order, context ids 1 to 8 and the NpId rule (`term` 0, 3 to 16 characters, the first an ASCII letter or digit, the rest ASCII letters, digits, `_` or `-`) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_signaling/np_signaling.cpp#L118-L170) and its [state helpers](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_signaling/np_signaling_state.cpp#L120-L170). `sceNpSignalingInitialize` reserves no heap and starts no thread, so its arguments are not checked, and callbacks are never called. `sceNpSignalingActivateConnection` returns `SCE_NP_ERROR_SIGNED_OUT` after shadPS4's checks up to `OWN_NP_ID`, without its rate limit, and creates no connection, so the connection calls answer `CONN_NOT_FOUND`
diff --git a/docs/dev/debt/libSceNpSnsFacebookDialog.md b/docs/dev/debt/libSceNpSnsFacebookDialog.md
index 3009c1d373..5ec4954b21 100644
--- a/docs/dev/debt/libSceNpSnsFacebookDialog.md
+++ b/docs/dev/debt/libSceNpSnsFacebookDialog.md
@@ -1,5 +1,5 @@
 # libSceNpSnsFacebookDialog technical debt
 
-### Unknown function info
+### Silent stubs
 
-- The following pending declarations have unverified signatures and behavior; they are parameterless import-resolution declarations and throw through `NotImplemented_nid_no_patch`: [`sceNpSnsFacebookDialogClose`](../../../core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp), [`sceNpSnsFacebookDialogGetStatus`](../../../core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp).
+- [libSceNpSnsFacebookDialog](../../../core/libs/prx/libSceNpSnsFacebookDialog/Export.cpp) - the Facebook dialog runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no Facebook account link. The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
diff --git a/docs/dev/debt/libSceNpTrophy.md b/docs/dev/debt/libSceNpTrophy.md
index c445f4e8d8..82ca475ea5 100644
--- a/docs/dev/debt/libSceNpTrophy.md
+++ b/docs/dev/debt/libSceNpTrophy.md
@@ -2,4 +2,10 @@
 
 ### Unknown function info
 
-- [sceNpTrophyRegisterContext, sceNpTrophyGetTrophyUnlockState, sceNpTrophyUnlockTrophy](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy, PS4) - the trophy definitions in `TROPCONF.ESFM` are encrypted, so the trophy count is the number of consecutive `TROPnnn.PNG` icons in the title's `/app0/sce_sys/trophy/trophyNN.trp`, and the calls that return names and details (`sceNpTrophyGetGameInfo`, `sceNpTrophyGetGroupInfo`, `sceNpTrophyGetTrophyInfo`) throw. Unlocks are kept per user and service label in `_trophy/trophyNN.<user id>` under the working directory, no platinum trophy is reported (`platinumId` is -1), and a locked trophy's icon fails with `TROPHY_NOT_UNLOCKED`. None of it is checked on a console.
+- [sceNpTrophyRegisterContext, sceNpTrophyGetTrophyUnlockState, sceNpTrophyUnlockTrophy](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy, PS4) - the trophy definitions in `TROPCONF.ESFM` are encrypted, so the trophy count is the number of consecutive `TROPnnn.PNG` icons in the title's `/app0/sce_sys/trophy/trophyNN.trp`. Unlocks are kept per user and service label in `_trophy/trophyNN.<user id>` under the working directory, no platinum trophy is reported (`platinumId` is -1), and a locked trophy's icon fails with `TROPHY_NOT_UNLOCKED`. None of it is checked on a console.
+
+### Functional
+
+- [sceNpTrophyGetGameInfo](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy) - the trophy configuration `TROPCONF.ESFM` is encrypted and not read, so the game details report the trophy count taken from the `TROPnnn.PNG` icons and the group count taken from the `GRnnn.PNG` icons of the trophy package; the per-grade counts are 0, the title and description are empty, and the progress percentage is unlocked trophies over all trophies instead of the console's grade-weighted points
+- [sceNpTrophyGetGroupInfo](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy) - only the base game group (id -1) is answered, with the same counts as the game; an id past the `GRnnn.PNG` icons returns `INVALID_GROUP_ID`, and an existing group throws because the trophies of a group are listed only in the encrypted configuration
+- [sceNpTrophyGetTrophyInfo](../../../core/libs/prx/libSceNpTrophy/Export.cpp) (libSceNpTrophy) - the grade is reported as unknown, the trophy is never hidden, the name and description are empty and the unlock timestamp is 0; a package with groups throws, since a trophy's group is listed only in the encrypted configuration
diff --git a/docs/dev/debt/libSceNpTrophy2.md b/docs/dev/debt/libSceNpTrophy2.md
index 4576f12de6..189c214f1d 100644
--- a/docs/dev/debt/libSceNpTrophy2.md
+++ b/docs/dev/debt/libSceNpTrophy2.md
@@ -2,19 +2,18 @@
 
 ### Silent stubs
 
+- [sceNpTrophy2GetRewardIcon](../../../core/libs/prx/libSceNpTrophy2/src/Context.cpp) (libSceNpTrophy2) - zeroes size and returns `SCE_NP_TROPHY2_ERROR_ICON_FILE_NOT_FOUND` (-2141898479): the `(int context, int handle, int reward_id, void* buffer, size_t* size)` signature and two-stage query pattern follow the bundled `Media/Plugins/PSNCore.prx` of PPSA06888 and SharpProspero; returning -2141898479 (0x80553911) when icons are unavailable is inferred from sibling calls (sceNpTrophy2GetGameIcon, sceNpTrophy2GetGroupIcon, sceNpTrophy2GetTrophyIcon) in KytyPS5 (libTrophy.cpp:464/483/502)
 - [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/GameInfo.cpp): `sceNpTrophy2RegisterUnlockCallback` accepts a callback that is never called, as the callback's signature and when the console calls it are not known, `sceNpTrophy2UnregisterUnlockCallback` only returns success, and `sceNpTrophy2ShowTrophyList` returns success without showing a list (there is no system trophy UI; seen on PPSA15552).
 
 ### Unknown function info
 
 - [Query structures](../../../core/libs/prx/libSceNpTrophy2/include/NpTrophy2Types.hpp): a progress value is a 16-byte `{int32 type, 4 reserved bytes, uint64 value}` and the game, group and trophy structures are 152, 24, 152, 32, 1312 and 32 bytes, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/libTrophy.cpp) asserts; no other public source confirms the layout. Progress type 1 marks a progressive trophy's target and progress, as in KytyPS5. Trophies without a `groupId` belong to group -1, KytyPS5's base game group.
 
-- [sceNpTrophy2GetRewardIcon](../../../core/libs/prx/libSceNpTrophy2/src/Context.cpp) (libSceNpTrophy2) takes `(int context, int handle, int reward_id, void* buffer, size_t* size)`, from the call sites in the bundled `Media/Plugins/PSNCore.prx` of PPSA06888, the same shape as `sceNpTrophy2GetTrophyIcon`. The title calls it twice: first with a null buffer to read the size, then with a buffer of that size allocated with `malloc`. The meaning of the third argument is unverified, and the reward icon data is unknown, so every call throws
-
-
 - [libSceNpTrophy2 pending exports](../../../core/libs/prx/libSceNpTrophy2/Export.cpp) - 23 named callable exports were identified in the PS5 3.20 export table and cross-checked against firmware 13.60. Signatures and behavior remain unverified; declarations use the unknown-signature convention and throw through `NotImplemented_nid_no_patch`. Evidence: [3.20 export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpTrophy2.c).
+
 ### Functional
 
-- [Trophy queries](../../../core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp) report the title's [trophy data](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp) (`sce_sys/trophy2/trophyNN.ucp`) and the unlocks in the [trophy store](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp). Without the file, or when it is malformed, they report the old placeholders and `sceNpTrophy2GetTrophyInfoArray` lists only trophy 0. Icons are not read. Hidden trophies report their names and descriptions; whether the console blanks them before the unlock is not known. `progress_percentage` weighs gold 6, silver 2 and bronze 1 and leaves the platinum out, as KytyPS5 does (the ratio of the published PSN trophy points); the console's formula is not known. A trophy or group that is not in the file throws. A context that was not created or was destroyed reports placeholders and no unlocks and returns success; the console's errors for it are unknown.
+- [Trophy queries](../../../core/libs/prx/libSceNpTrophy2/src/TrophyInfo.cpp) - not confirmed on the console: `sceNpTrophy2GetTrophyInfo` of a trophy id that is not in the title's [trophy data](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp) (`sce_sys/trophy2/trophyNN.ucp`) returns `0x8055390A` (KytyPS5's `NP_TROPHY2_ERROR_INVALID_TROPHY_ID`) and writes nothing; a context not created or destroyed reports placeholders and no unlocks and returns success; hidden trophies report their names and descriptions before the unlock; `progress_percentage` weighs gold 6, silver 2 and bronze 1 and leaves the platinum out, as KytyPS5 does (the ratio of the published PSN trophy points). A group that is not in the data throws. Without the file, or when it is malformed, the queries report the old placeholders and `sceNpTrophy2GetTrophyInfoArray` lists only trophy 0. Icons are not read. Unlocks come from the [trophy store](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp).
 - [Trophy data limits](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp): a `trophyNN.ucp` or `udsNN.ucp` larger than 256 MiB or listing more than 4096 files, and a JSON file in it that nests deeper than 64 levels or holds more than 1048576 values, are not used, and the title runs as without that file. The limits keep the memory the reader takes to the file and about 140 MiB of parsed JSON; the console's limits are not known.
 - [Text language](../../../core/libs/prx/libSceNpTrophy2/src/TrophyPackage.cpp): texts come from `tropmeta_<tag>.json` for the console language, then `en-US`, then the file's `defaultLanguage`. The tags for languages 0 to 29 are KytyPS5's; `uk-UA` for 30 (Ukrainian) is an assumption.
 - [Platinum](../../../core/libs/prx/libSceNpTrophy2/src/TitleTrophies.cpp): an unlock through any path unlocks the platinum that the trophy names in `platinumTrophyId` once every trophy naming that platinum is unlocked, as KytyPS5 does; trophies without `platinumTrophyId` are not required. With the title's trophy data loaded, a posted `_UnlockTrophy` of a trophy that is not in the data, of a platinum or of a progressive trophy is not stored and prints a `[trophy] ignored` line, as KytyPS5 refuses them, so a progressive trophy unlocks only through its statistic; without trophy data any id of 0 or more is stored, including ids the data would make the platinum, a progressive trophy or no trophy, and the platinum is not unlocked when the trophies it needs are. The console's behaviour is not known.
diff --git a/docs/dev/debt/libSceNpTus.md b/docs/dev/debt/libSceNpTus.md
index f21274d8ab..cb413bbf34 100644
--- a/docs/dev/debt/libSceNpTus.md
+++ b/docs/dev/debt/libSceNpTus.md
@@ -6,8 +6,6 @@
 - [Multi-slot variable calls](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - the argument checks of the multi-slot get, set and delete calls are not measured on a console; they follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c1b26558352b863f80142256e4df38585aa7d727/src/core/libraries/np/np_tus/np_tus.cpp), where they differ between functions: `arrayLen < 1` is `INSUFFICIENT_ARGUMENT` in the NpId and virtual-user delete calls and in `sceNpTusGetMultiSlotVariableVUserAsync`, and `INVALID_ARGUMENT` in the others; a null NpId is accepted except in delete; an empty virtual user ID is `INVALID_ARGUMENT`. RPCS3's [PS3 module](https://github.com/RPCS3/rpcs3/blob/1a9dca3a3a84a18df866e3021918322bd295160a/rpcs3/Emu/Cell/Modules/sceNpTus.cpp) has only the NpId and virtual-user calls; it returns `INVALID_ARGUMENT` for an empty array in all of them, rejects a null target in get and set and does not check for an empty virtual user ID.
 - [Variable, data, data status and TSS requests](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - the argument checks of the 82 add-and-get, try-and-set, data, data status, multi-user, friends and `sceNpTssGetSmallStorage` calls are not measured on a console; their signatures, checks and order follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_tus/np_tus.cpp), including its differences between forms: the NpId try-and-set calls return `INVALID_ARGUMENT` for an operation type outside 1-6 where the others return `INVALID_TYPE`, and the NpId and virtual-user multi-slot data status calls return `TOO_MANY_NPID` for more than 64 slots. As for the calls above, the output and structure sizes are not checked, and every request finishes with `SCE_NP_ERROR_SIGNED_OUT`
 - [sceNpTusSetThreadParam](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
-- [sceNpTssCreateNpTitleCtx](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
-- [sceNpTssCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusCreateTitleCtx](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusSetTimeout](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusChangeModeForOtherSaveDataOwners](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
@@ -32,4 +30,5 @@
 ### Functional
 
 - [sceNpTusCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - creates a title context without checking sign-in, up to 32 contexts (`TOO_MANY_OBJECTS` beyond); shadPS4 returns the `sceNpGetNpId` error instead. Requests are limited to 256, and the limits are not measured on a console.
+- [sceNpTssCreateNpTitleCtx and sceNpTssCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - that TSS title contexts share the TUS context table and its 32-context limit is inferred from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/np/np_tus/np_tus.cpp#L146-L168), which redirects both to the TUS creators, and from TSS requests coming from `sceNpTusCreateRequest`; nothing is measured on a console. The `A` form is `sceNpTusCreateNpTitleCtxA`. The `NpId` form returns `INSUFFICIENT_ARGUMENT` for a null `npId` and `INVALID_ARGUMENT` for service label `0xFFFFFFFF` before the limit, as shadPS4's [sceNpTusCreateNpTitleCtx](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/np/np_tus/np_tus.cpp#L122-L143) does; the signatures are shadPS4's and fpPS4's, and Orbital's for the `A` form.
 - [sceNpTusPollAsync, sceNpTusWaitAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - there is no PSN, so every implemented `*Async` call whose arguments pass the checks starts a request that finishes at once with `SCE_NP_ERROR_SIGNED_OUT`, which poll and wait report and the blocking calls return; shadPS4 returns `SIGNED_OUT` from the `*Async` call itself when no shadNet client is signed in, and RPCS3 returns `INVALID_ONLINE_ID` while offline, marked there as probable behaviour. An abort stays set, so every later operation on the request, blocking ones included, finishes with `ABORTED`; in shadPS4 an abort only ends the operation in progress. Until an operation has started, poll returns 1 and wait returns `INVALID_ARGUMENT` as in shadPS4; RPCS3 [blocks until a result is set](https://github.com/RPCS3/rpcs3/blob/1a9dca3a3a84a18df866e3021918322bd295160a/rpcs3/Emu/NP/np_contexts.cpp#L40-L52).
diff --git a/docs/dev/debt/libSceNpUniversalDataSystem.md b/docs/dev/debt/libSceNpUniversalDataSystem.md
index 6c8a996278..2e07cb9901 100644
--- a/docs/dev/debt/libSceNpUniversalDataSystem.md
+++ b/docs/dev/debt/libSceNpUniversalDataSystem.md
@@ -4,6 +4,19 @@
 
 - [Events](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): `sceNpUniversalDataSystemCreateEvent` copies `prop` and returns the event's own property object through `prop_ptr`, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/9e41d8320a2774b303fbad344c2347e8d0292e83/src/libs/libTrophy.cpp) does; `sceNpUniversalDataSystemEventPropertyObjectSetObject`, `SetArray` and the array setters for objects and arrays store a copy of `value` and return the stored copy through `value_ptr`. Destroying a property object or array that its Create function did not return (an event's property object or a stored copy) does nothing, as its owner frees it. These ownership rules are not verified on a console, nor are the output of `sceNpUniversalDataSystemEventToString` (still `{}`) and `sceNpUniversalDataSystemEventEstimateSize` (still 3).
 
+- [sceNpUniversalDataSystemIntCreateRecordArray, sceNpUniversalDataSystemIntCreateRecordData and sceNpUniversalDataSystemIntCreateRecordObject](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntDeleteAllRecord](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - It is in the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. It is declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntDestroyRecordArray and sceNpUniversalDataSystemIntDestroyRecordData](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntDestroyRecordObject and sceNpUniversalDataSystemIntGetMemoryStat](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntPostRecordData, sceNpUniversalDataSystemIntRecordArraySetArray and sceNpUniversalDataSystemIntRecordArraySetBinary](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordArraySetBool, sceNpUniversalDataSystemIntRecordArraySetFloat32 and sceNpUniversalDataSystemIntRecordArraySetFloat64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordArraySetInt32, sceNpUniversalDataSystemIntRecordArraySetInt64 and sceNpUniversalDataSystemIntRecordArraySetObject](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordArraySetString, sceNpUniversalDataSystemIntRecordArraySetUInt32 and sceNpUniversalDataSystemIntRecordArraySetUInt64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordDataEstimateSize, sceNpUniversalDataSystemIntRecordObjectSetArray and sceNpUniversalDataSystemIntRecordObjectSetBinary](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordObjectSetBool, sceNpUniversalDataSystemIntRecordObjectSetFloat32 and sceNpUniversalDataSystemIntRecordObjectSetFloat64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordObjectSetInt32, sceNpUniversalDataSystemIntRecordObjectSetInt64 and sceNpUniversalDataSystemIntRecordObjectSetObject](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUniversalDataSystemIntRecordObjectSetString, sceNpUniversalDataSystemIntRecordObjectSetUInt32 and sceNpUniversalDataSystemIntRecordObjectSetUInt64](../../../core/libs/prx/libSceNpUniversalDataSystem/PendingExports.cpp) (libSceNpUniversalDataSystem) - The list is the intersection of the export table of the console's libSceNpUniversalDataSystem (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUniversalDataSystem.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+
 ### Functional
 
 - [Trophy events](../../../core/libs/prx/libSceNpUniversalDataSystem/src/Event.cpp): `sceNpUniversalDataSystemPostEvent` stores an `_UnlockTrophy` event with an int32 `_trophy_id` of 0 or more as an unlock for the user and service label of its context, as KytyPS5 does, except an id that [libSceNpTrophy2](../../../core/libs/prx/libSceNpTrophy2/src/TrophyStore.cpp) refuses when the title's trophy data is loaded (one not in the data, a platinum or a progressive trophy). `_UpdateTrophyProgress`, named only by a third-party unlocker, is logged once per trophy and not interpreted. A context need not be registered, and every post of an event that `sceNpUniversalDataSystemCreateEvent` returned and that is not yet destroyed returns success (a null or any other event pointer stops the game): KytyPS5's errors for an unknown or unregistered context and for a malformed unlock are not verified. The storage statistics stay zero.
diff --git a/docs/dev/debt/libSceNpUtility.md b/docs/dev/debt/libSceNpUtility.md
new file mode 100644
index 0000000000..642d6ab2bd
--- /dev/null
+++ b/docs/dev/debt/libSceNpUtility.md
@@ -0,0 +1,22 @@
+# libSceNpUtility technical debt
+
+### Unknown function info
+
+- [sceNpAppInfoIntAbortRequest, sceNpAppInfoIntCheckAvailability, sceNpAppInfoIntCheckAvailabilityA, sceNpAppInfoIntCheckAvailabilityAll, sceNpAppInfoIntCheckAvailabilityAllA and sceNpAppInfoIntCheckServiceAvailability](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppInfoIntCheckServiceAvailabilityA, sceNpAppInfoIntCheckServiceAvailabilityAll, sceNpAppInfoIntCheckServiceAvailabilityAllA, sceNpAppInfoIntCreateRequest, sceNpAppInfoIntDestroyRequest and sceNpAppInfoIntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppInfoIntInitialize, sceNpAppLaunchLink2IntAbortRequest, sceNpAppLaunchLink2IntCreateRequest, sceNpAppLaunchLink2IntDestroyRequest, sceNpAppLaunchLink2IntFinalize and sceNpAppLaunchLink2IntGetCompatibleTitleIdList](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppLaunchLink2IntGetCompatibleTitleIdNum, sceNpAppLaunchLink2IntInitialize, sceNpAppLaunchLinkIntAbortRequest, sceNpAppLaunchLinkIntCreateRequest, sceNpAppLaunchLinkIntDestroyRequest and sceNpAppLaunchLinkIntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppLaunchLinkIntGetCompatibleTitleIdList, sceNpAppLaunchLinkIntGetCompatibleTitleIdNum, sceNpAppLaunchLinkIntInitialize, sceNpBandwidthTestShutdownWithDetailedInfo and sceNpLookupAbortRequest](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupCreateAsyncRequest, sceNpLookupCreateTitleCtxA, sceNpLookupNetAbortRequest and sceNpLookupNetCensorComment](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupNetConvertJidToNpId, sceNpLookupNetConvertNpIdToJid, sceNpLookupNetCreateRequest, sceNpLookupNetCreateTitleCtx, sceNpLookupNetDeleteRequest, sceNpLookupNetDeleteTitleCtx and sceNpLookupNetInit](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupNetInitWithFunctionPointer, sceNpLookupNetInitWithMemoryPool, sceNpLookupNetIsInit, sceNpLookupNetNpId, sceNpLookupNetSanitizeComment, sceNpLookupNetSetTimeout, sceNpLookupNetTerm and sceNpLookupPollAsync](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupSetTimeout, sceNpLookupWaitAsync, sceNpServiceChecker2IntAbortRequest, sceNpServiceChecker2IntCreateRequest, sceNpServiceChecker2IntDestroyRequest and sceNpServiceChecker2IntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceChecker2IntGetServiceAvailability, sceNpServiceChecker2IntGetServiceAvailabilityA, sceNpServiceChecker2IntInitialize, sceNpServiceChecker2IntIsSetServiceType and sceNpServiceCheckerIntAbortRequest](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceCheckerIntCreateRequest, sceNpServiceCheckerIntDestroyRequest, sceNpServiceCheckerIntFinalize, sceNpServiceCheckerIntGetAvailability, sceNpServiceCheckerIntGetAvailabilityList and sceNpServiceCheckerIntInitialize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceCheckerIntIsCached, sceNpTitleMetadataIntAbortRequest, sceNpTitleMetadataIntCreateRequest, sceNpTitleMetadataIntDeleteRequest, sceNpTitleMetadataIntGetInfo, sceNpTitleMetadataIntGetNpTitleId and sceNpUtilityInit](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpUtilityTerm and sceNpWordFilterCreateTitleCtxA](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpWordFilterSetTimeout and sceNpWordFilterWaitAsync](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+
+### Functional
+
+- [NpLookup and NpWordFilter](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline only, not measured on a PS5: the argument checks and their order, the limit of 32 title contexts and 32 requests, the word filter id bases `0x01000001` and `0x02000001`, the 0x400-byte comment limit and single-use requests (`INVALID_TYPE`) follow shadPS4's [lookup](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L41-L222) and [word filter](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L705-L909) calls. `sceNpLookupNpId`, `sceNpWordFilterCensorComment` and `sceNpWordFilterSanitizeComment` then finish with `SCE_NP_ERROR_SIGNED_OUT` and write no NpId or comment; shadPS4's word filter accepts every comment as a stand-in for the server, so its result is not used
diff --git a/docs/dev/debt/libSceOpusCeltDec.md b/docs/dev/debt/libSceOpusCeltDec.md
index 2b3827fa86..4ba1fc6999 100644
--- a/docs/dev/debt/libSceOpusCeltDec.md
+++ b/docs/dev/debt/libSceOpusCeltDec.md
@@ -8,4 +8,4 @@
 ### Functional
 
 - [libSceOpusCeltDec](../../../core/libs/prx/libSceOpusCeltDec/Export.cpp): the supplied module confirms the six exported argument lists, read-only context inputs, 640-byte state allocation, mono/stereo channels, five sample rates, byte-sized decode capacity and byte-count return. The implementation still keeps decoder state outside guest memory and uses host contexts instead of AJM contexts. AJM error propagation, resource ownership and termination with live decoders are not implemented. Wrapper validation errors and their precedence are recovered.
-- [sceOpusCeltDecDecode](../../../core/libs/prx/libSceOpusCeltDec/Export.cpp): the original forwards packets to AJM codec 16 without a local CELT-only check. The backend response to SILK/hybrid packets is unresolved; these inputs still throw. Packet loss concealment, asynchronous AJM execution, exact PCM conversion and resampler buffering remain outside the verified behavior of the FFmpeg implementation in [OpusDecoderLibrary](../../../core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp).
+- [sceOpusCeltDecDecode](../../../core/libs/prx/libSceOpusCeltDec/Export.cpp): the original forwards packets to AJM codec 16 without a local CELT-only check. The backend response to SILK/hybrid packets is unresolved; packets whose TOC configuration is below 16 still throw. Decoding uses the bundled libopus decoder of [OpusDecoderLibrary](../../../core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp) and shares its limits. Packet loss concealment and asynchronous AJM execution are not implemented.
diff --git a/docs/dev/debt/libSceOpusDec.md b/docs/dev/debt/libSceOpusDec.md
index 6dbf108315..d98513d94b 100644
--- a/docs/dev/debt/libSceOpusDec.md
+++ b/docs/dev/debt/libSceOpusDec.md
@@ -6,6 +6,4 @@
 
 ### Functional
 
-- [libSceOpusDec](../../../core/libs/prx/libSceOpusDec/Export.cpp) uses FFmpeg for mono/stereo signed-16 decoding at the creation rates the research lists: 8000, 12000, 16000, 24000 and 48000 Hz. The supplied module confirms the exported arguments, read-only context inputs, 640-byte state size and creation rates. Validation errors and their precedence are recovered. Console PCM equivalence, AJM failures, context ownership and termination with live decoders remain unimplemented. Packet loss concealment still throws; decoder state is kept in host registries instead of the native guest state layout.
-- [sceOpusDecDecode](../../../core/libs/prx/libSceOpusDec/Export.cpp) (libSceOpusDec) returns exactly the packet's duration, as libopus does. FFmpeg resamples narrowband SILK from 8 kHz and holds back 24 samples of the first narrowband packet after the decoder starts or after a packet of another bandwidth, releasing them with the next packet that is not narrowband. The decoder keeps FFmpeg's output in order and pads the start with silence, so such a packet begins with 24 samples (0.5 ms) of silence and the output after it is 24 samples late; libopus has no such gap
-- [sceOpusDecDecode](../../../core/libs/prx/libSceOpusDec/include/OpusDecoder.hpp) (libSceOpusDec, libSceOpusCeltDec) decodes at 48000 Hz and converts to a lower creation rate with FFmpeg's resampler, where libopus decodes at that rate directly. The resampler's filter delay is padded with silence at the start of the stream like the narrowband delay above, so the output is late by that delay and is not sample-identical to libopus; which of the two the console matches is not measured
+- [libSceOpusDec](../../../core/libs/prx/libSceOpusDec/Export.cpp) uses bundled libopus 1.6.1 for mono/stereo signed-16 decoding at the creation rates the research lists: 8000, 12000, 16000, 24000 and 48000 Hz. The supplied module confirms the exported arguments, read-only context inputs, 640-byte state size and creation rates. Validation errors and their precedence are recovered. Console PCM equivalence, AJM failures, context ownership and termination with live decoders remain unimplemented. Packet loss concealment still throws; decoder state is kept in host registries instead of the native guest state layout.
diff --git a/docs/dev/debt/libScePad.md b/docs/dev/debt/libScePad.md
index d533ccb116..000b382ce7 100644
--- a/docs/dev/debt/libScePad.md
+++ b/docs/dev/debt/libScePad.md
@@ -11,19 +11,22 @@
 - [libScePad report and tracking exports](../../../core/libs/prx/libScePad/Export.cpp) - read, extended-read, tracker, UI, VR-controller and report argument registers are recovered. Feature reports use a byte report ID and 64-bit byte count, capped at 64. VR trigger effects consume a 56-byte record; the dual-controller call uses two handles and a mask with records at offsets 8 and 64. Remaining payload field layouts use incomplete declarations, including extended samples and kernel-owned extension reports.
 
 - [scePadUnknown_n3kSX62fgNo](../../../core/libs/prx/libScePad/Export.cpp) (libScePad, NID `n3kSX62fgNo`) - the name is unknown, and the 0 returned after `scePadInit` is inferred, not measured. In the OS 10.01 system module the function takes no arguments, returns `0x80920005` before `scePadInit`, and otherwise sends a per-process value of 1 to ShellCore over Mbus, returning `0x809200ff` if that call fails and 0 if it succeeds, with or without an open handle. The #3177 probe measured `0x809200ff` in a process that is not a game; a game process is assumed to get 0. The ShellCore setting it changes is unknown and not modelled
-- [scePadSetAngularVelocityDeadbandState](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - with the deadband on, each angular velocity axis whose magnitude is below 0.017453292 rad/s (1 degree per second) reads as 0, before the orientation is integrated; it starts off. Threshold, per-axis test and default follow [duaLib](https://github.com/WujekFoliarz/duaLib/blob/03bad1bea2a36561b520846776f2a07ced6773e0/src/source/duaLib.cpp#L44), which reimplements the PC `libScePad.dll`; the console's threshold is not measured, and the deadband is kept per library rather than per handle since one pad handle exists
-- [scePadOpen and scePadOpenExt](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - special ports (type 2) return `DEVICE_NOT_CONNECTED` (0x80920007) because the host has no special controller, and `scePadGetHandle` has no handle for them; whether the console opens a handle and reports the device as disconnected later is unknown. scePadOpenExt handles only special ports. PPSA01317 passes a 16-byte param that names the device by vendor and product id (`b7 0e 04 0e ...` for 0x0eb7:0x0e04) and skips the user on any negative result. Other port types throw
+- [scePadSetAngularVelocityDeadbandState](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - with the deadband on, each angular velocity axis whose magnitude is below 0.017453292 rad/s (1 degree per second) reads as 0, before the orientation is integrated; it starts off. Threshold, per-axis test and default follow [duaLib](https://github.com/WujekFoliarz/duaLib/blob/03bad1bea2a36561b520846776f2a07ced6773e0/src/source/duaLib.cpp#L44), which reimplements the PC `libScePad.dll`; the console's threshold is not measured, and the deadband is kept per port slot
+- [PadQueueLegacyAudioHaptics, PadClearLegacyAudioHaptics](../../../core/libs/prx/libScePad/src/PadState.cpp) (libScePad) - PadQueueLegacyAudioHaptics and PadClearLegacyAudioHaptics route legacy audio haptics only to port 0; multi-port queueing is not modelled
+- [scePadGetControllerInformation](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - scePadGetControllerInformation always reports connectedCount = 1 and connected = true; behaviour across multiple open controller handles is not measured on hardware
+- [scePadOpen and scePadOpenExt](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the special port (type 2) opens a handle per user (`PAD_SPECIAL_HANDLE` + slot, 16 slots for the console's 16 accounts, a 17th user gets the unknown-user code 0x809b0081) that every pad call accepts: reads give the rest record (sticks 0x80, orientation w 1, acceleration y 1, `connected` false), information is zeroed, extended information has device class -1, setters succeed without effect. Not measured: the console's own handle values (fresh per open), a PS5, and the calls the PS4 Pro survey (firmware 10.71, no special controller) did not cover; it measured open, `ALREADY_OPENED`, `scePadGetHandle`, both reads, both informations, the five setters above, close, and that two logged-in users get independent handles. `scePadOpenExt` returns `DEVICE_NOT_CONNECTED` (0x80920007) for special ports, unmeasured; PPSA01317 skips a user on any negative result. Other port types throw
+- [scePadOpen, scePadGetHandle, scePadRead and scePadReadState for the remote control port](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - whether a console without a media remote opens the system user's remote control port (type 16), returns `DEVICE_NOT_CONNECTED` or fills other fields is not measured. The host has no remote, so the port opens its own handle (`PAD_REMOTE_HANDLE`) that reads one zeroed entry with no buttons and `connected` false; the other pad calls reject it with `INVALID_HANDLE`. SDL's PS5 video driver maps this port's buttons to keys, so a remote that read the DualSense turned Cross into Return (Raptor PPSA94002).
 - [scePadVrControllerReadState](../../../core/libs/prx/libScePad/Export.cpp) - the 104-byte output layout is recovered, including buttons, stick, triggers, touch fields, motion, connection state and timestamp. Touch-value semantics and kernel report production remain incomplete; the export still throws.
 - [scePadVrControllerReadCombinedState](../../../core/libs/prx/libScePad/Export.cpp) - the two handle arguments and 128-byte output are recovered; output field semantics remain incomplete.
 - [scePadSetVibrationMode](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - modes 1 to 3 and 5 are accepted and stored. On a PS5 (firmware 13.60) the call returns `0x80920005` before `scePadInit`, then rejects a mode of 0 or below with `INVALID_ARG` before it checks the handle, and returns `INVALID_HANDLE` for a bad handle with any higher mode; whether an open handle accepts modes above 3 was not measured, since the payload could not open a pad; 5 is accepted because PPSA25286 passes it on its open handle at start-up; the meanings of modes 3 and 5 are unknown (PPSA21480 calls it with 3 right after `scePadOpen` and aborts on failure; [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Pad/Pad.cs) names only 1 and 2). The stored mode has no other effect
 - [scePadIsRemoteController](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the name hashes to NID `fCWdlnmB1Ks`; the signature `(int handle, bool* remote)` comes from PPSA16064, which zeroes a byte, passes its address after `scePadGetControllerInformation` and ignores the result. The error codes follow the other pad calls. Controllers are local devices, so the answer is always false
+- [scePadIsDS4Connected, scePadIsBlasterConnected and scePadIsMoveConnected](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the `bool (int handle)` signatures are recovered; the library reports one DualSense to every title (see Touchpad resolution below), so no DualShock 4, Blaster or Move controller is ever behind a handle and each call answers false for any handle. The console's answer for an invalid handle is not measured
 - [scePadSetAngularVelocityBiasCorrectionState](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - inferred signature `(int handle, bool enabled)` follows `scePadSetTiltCorrectionState` and `scePadSetAngularVelocityDeadbandState`; an invalid handle returns `PAD_ERROR_INVALID_HANDLE`, disabling is a no-op, and enabling throws because bias correction is not modelled
 - [scePadGetAccessibilityControllerState](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the value a console reports for a DualSense is not measured; the emulated pad, which is not an Access controller, reports 0. The name hashes to NID `zBsgF0q8DIM`. In the OS 10.01 system module the `(int handle, uint32_t* state)` function returns `0x80920005` before `scePadInit`, then `INVALID_ARG` for a NULL `state` and `INVALID_HANDLE` for a bad handle, and otherwise asks the pad driver for a per-device value of the device behind the handle: 0 when no device is behind it, 1 when the driver has no answer, else the driver's value. What the values mean is unknown
-
+- [scePadGetControllerType](../../../core/libs/prx/libScePad/Export.cpp) (libScePad) - the value a console reports for a DualSense is not measured; the emulated pad reports `PAD_CONTROLLER_TYPE_DUAL_SENSE` (2), following [duaLib](https://github.com/WujekFoliarz/duaLib/blob/master/src/include/duaLib.h)'s `s_SceControllerType` enum where `DUALSENSE = 2`. The signature `(int handle, int32_t* type)` follows duaLib, while the validation order (checking initialization, null pointer, then handle) follows the library's other pad queries; duaLib does not validate null pointers and returns `PAD_ERROR_DEVICE_NOT_CONNECTED` for an invalid pad.
 - [libScePad internal data and device control](../../../core/libs/prx/libScePad/Export.cpp) - kernel-owned version, telemetry, Lotus-button and update payload fields remain unresolved. Lotus-button parameter units and the three blinking byte meanings are unknown. Port information occupies 152 bytes; history records occupy 72 bytes; Leonardo unique data occupies 24 bytes. Their complete field semantics remain unresolved.
-
 - [libScePad profile writes and virtual devices](../../../core/libs/prx/libScePad/Export.cpp) - profile writes take a handle, profile ID, profile pointer and a 32-bit result pointer; the profile payload direction and fields remain unresolved. Virtual-device creation takes an input record and an output ID pointer, whose width is not exposed by the wrapper. Component information copies 16 bytes; field meanings remain unknown. Virtual trigger state contains two 32-bit states and three control bytes, but the control semantics remain incomplete.
 
 ### Functional
 
-- [Touchpad resolution](../../../core/libs/prx/libScePad/include/PadState.hpp) (libScePad) - the library reports a DualSense to every title, so the controller information reports its touchpad, 1920 by 1080 at 44.86 pixels per cm, and the host controller's fingers and the keyboard touch contacts are placed in that range. [duaLib](https://github.com/WujekFoliarz/duaLib/blob/0b39f92261e2ff0e77eb0dac00943be6970e0dbf/src/source/duaLib.cpp#L847-L849) reports these values for a DualSense and 1920 by 943 at 44 for a DualShock 4, and the Linux kernel's [hid-playstation](https://github.com/torvalds/linux/blob/cd4f494ba535e848e2d299707d363de84e61a518/drivers/hid/hid-playstation.c#L177-L178) holds 1920 by 1080 against 1920 by 942 for the DualShock 4. A DualShock 4 on the host reports through the DualSense range too, so its last touchpad rows are never reached. The console's values are not measured
+- [Touchpad resolution](../../../core/libs/prx/libScePad/include/PadState.hpp) (libScePad) - the library reports a DualSense to every title, so the controller information reports its touchpad, 1920 by 1080 at 44.86 pixels per cm, and the host controller's fingers and the keyboard touch contacts are placed in that range. [duaLib](https://github.com/WujekFoliarz/duaLib/blob/0b39f92261e2ff0e77eb0dac00943be6970e0dbf/src/source/duaLib.cpp#L847-L849) reports these values for a DualSense and 1920 by 943 at 44 for a DualShock 4, and the Linux kernel's [hid-playstation](https://github.com/torvalds/linux/blob/cd4f494ba535e848e2d299707d363de84e61a518/drivers/hid/hid-playstation.c#L177-L178) holds 1920 by 1080 against 1920 by 942 for the DualShock 4. A DualShock 4 on the host reports through the DualSense range too, so its last touchpad rows are never reached. A PS5 on firmware 13.40 reported 1920 by 1080 at 44.86 and stick dead zones of 13 to a retail title
diff --git a/docs/dev/debt/libScePosixForWebKit.md b/docs/dev/debt/libScePosixForWebKit.md
index 681a24a3d5..efe3b429e8 100644
--- a/docs/dev/debt/libScePosixForWebKit.md
+++ b/docs/dev/debt/libScePosixForWebKit.md
@@ -3,11 +3,14 @@
 ### Unknown function info
 
 - [gethostbyname](../../../core/libs/prx/libScePosixForWebKit/Resolver.cpp) (libScePosixForWebKit) - numeric IPv4 forms, trailing whitespace and 64-bit accumulation follow FreeBSD 11.4 [inet_aton](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/inet/inet_addr.c); clearing the resolver error on numeric success follows [fakeaddr](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/net/gethostnamadr.c). Exact PS5 behavior is unverified; hostname lookup still uses the host resolver
-- [__wrap_access, __wrap_clock_gettime, __wrap_fchown, __wrap_getcwd, __wrap_getenv, __wrap_link, __wrap_lstat, __wrap_mmap, __wrap_readlink, __wrap_statvfs, __wrap_symlink, clock_gettime_np, getenv_np, gethostbyname_r (`scePosixForWebKit_gethostbyname_r`), mmap_np, msetname, pthread_setschedparam_np, setenv_np, sysinfo (`scePosixForWebKit_sysinfo`)](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - names/NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePosixForWebKit.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); credible prototypes are unknown. These exports use renamed helpers; defining `gethostbyname_r` would interpose on the host function this library calls itself. All are parameterless import stubs, not ABI claims; callers must not use them until signatures are verified.
+- [clock_gettime_np, getenv_np, gethostbyname_r (`scePosixForWebKit_gethostbyname_r`), mmap_np, msetname, pthread_setschedparam_np, setenv_np, sysinfo (`scePosixForWebKit_sysinfo`)](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - names/NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libScePosixForWebKit.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); credible prototypes are unknown. These exports use renamed helpers; defining `gethostbyname_r` would interpose on the host function this library calls itself. All are parameterless import stubs, not ABI claims; callers must not use them until signatures are verified.
+- [__wrap_fchown, __wrap_link, __wrap_readlink, __wrap_statvfs, __wrap_symlink](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - parameterless throwing stubs. Under the `--wrap` convention assumed for the forwarding wrappers (see Functional) each would take the POSIX signature of the function it wraps, but the targets are in libkernel_sys (`fchown`, `link`, `readlink`, `symlink`) and libSceLibcInternal (`statvfs`), which no prx links; libkernel_sys's `fchown`, `readlink` and `symlink` also still throw for some arguments
 
 ### Functional
 
+- [strcasestr](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) - console locale behavior is unmeasured. It follows FreeBSD 11.4's [strcasestr.c](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/string/strcasestr.c) in the guest's supported C locale; other guest locales are not implemented.
 - [mkstemp and isatty](../../../core/libs/prx/libScePosixForWebKit/Filesystem.cpp) (libScePosixForWebKit) follow FreeBSD's [temporary-file API](https://github.com/freebsd/freebsd-src/blob/stable/9/lib/libc/stdio/mktemp.c) and [terminal check](https://github.com/freebsd/freebsd-src/blob/stable/9/lib/libc/gen/isatty.c), without console verification. `mkstemp` replaces all trailing `X` characters, accepts a fixed name, and creates files through the guest path resolver with exclusive read/write access and mode 0600. Windows file permissions follow the existing kernel file implementation. `isatty` tests Windows console handles rather than all character devices; files, pipes and guest sockets return `ENOTTY`, closed descriptors return `EBADF`.
 - [arc4random](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) returns four bytes of host OS entropy (`getentropy`, `rand_s` on Windows), as `arc4random_buf` does, uniform over the 32-bit range like FreeBSD 11.4's RC4 keystream in [arc4random.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/arc4random.c). The console's generator and its reseeding are unknown; `arc4random_uniform`, `arc4random_stir` and `arc4random_addrandom` are not in the module's export set and are absent
 - [fnmatch](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) follows FreeBSD 11 [fnmatch.c](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/libc/gen/fnmatch.c) in the C locale: each byte is one character, `FNM_CASEFOLD` folds ASCII letters only, and bracket ranges compare byte values. `[:class:]` names are not character classes: as in FreeBSD 11 through 14, `[[:digit:]]` is the set of `[`, `:`, `d`, `i`, `g`, `t` followed by a literal `]` (classes were added to `fnmatch.c` after 14). Multibyte characters and locale collation are not modelled. A null pattern or string throws
 - [getservbyname](../../../core/libs/prx/libScePosixForWebKit/Resolver.cpp) (libScePosixForWebKit) searches a built-in copy of 37 lines of FreeBSD 11.4's [etc/services](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/etc/services) (ftp-data, ftp, ssh, telnet, smtp, domain, tftp, http, pop3, ntp, imap, https, rtsp, submission, imaps, pop3s with their aliases and protocols, in file order) the way [getservent.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/net/getservent.c) searches the file: case-sensitive name or alias, a null protocol takes the first match, the port in network byte order, the result in per-thread storage. The console's `/etc/services` is unknown, so any other service returns null without setting `errno`, as for a name the file lacks. `getaddrinfo` still resolves service names through the host's service database
+- [__wrap_access, __wrap_clock_gettime, __wrap_getcwd, __wrap_getenv, __wrap_lstat and __wrap_mmap](../../../core/libs/prx/libScePosixForWebKit/Export.cpp) (libScePosixForWebKit) assume, from the export names alone, the GNU ld [`--wrap`](https://sourceware.org/binutils/docs/ld/Options.html) convention (a reference to `<name>` resolves to `__wrap_<name>`): each takes its target's POSIX signature and forwards to libc's (`access`, `getcwd`, `getenv`) or libkernel's (`clock_gettime`, `lstat`, `mmap`) implementation, which sets `errno`. No PS5 module or WebKit call site was read to confirm that WebKit imports `__wrap_<name>` in place of `<name>` or that the console wrappers only forward. Any sandbox or path handling the console module adds is not modelled, and how the wrappers relate to `getenv_np`, `setenv_np`, `mmap_np` and `clock_gettime_np` (such as a separate environment that `setenv_np` fills) is unknown
diff --git a/docs/dev/debt/libSceRnpsAppMgr.md b/docs/dev/debt/libSceRnpsAppMgr.md
new file mode 100644
index 0000000000..b430381f91
--- /dev/null
+++ b/docs/dev/debt/libSceRnpsAppMgr.md
@@ -0,0 +1,5 @@
+# libSceRnpsAppMgr technical debt
+
+### Unknown function info
+
+- [sceRnpsAppMgrBlockAppInstall, sceRnpsAppMgrCreateUpdateRequest, sceRnpsAppMgrCreateUrlRequest, sceRnpsAppMgrDestroyBundle, sceRnpsAppMgrDestroyUpdateRequest, sceRnpsAppMgrFinishUrlRequest, sceRnpsAppMgrGetAppInfo, sceRnpsAppMgrGetAppInfoDebugString, sceRnpsAppMgrGetAppInfoList, sceRnpsAppMgrGetEventForShellUI, sceRnpsAppMgrGetUpdateProgress, sceRnpsAppMgrHasEventForShellUI, sceRnpsAppMgrInitialize, sceRnpsAppMgrPushEventForShellUI, sceRnpsAppMgrRecoverUfsImage, sceRnpsAppMgrRegisterShellUI, sceRnpsAppMgrRemoveApp, sceRnpsAppMgrRemoveAppOnSystemShutdown, sceRnpsAppMgrRemoveUfsImageOnSystemShutdown, sceRnpsAppMgrRequestUpdateCheck, sceRnpsAppMgrSetCrlUrl, sceRnpsAppMgrSetEventFlagForClients, sceRnpsAppMgrSetUpdateUrl, sceRnpsAppMgrStartService, sceRnpsAppMgrTerminate, sceRnpsAppMgrUnblockAppInstall and sceRnpsAppMgrUnregisterShellUI](../../../core/libs/prx/libSceRnpsAppMgr/Export.cpp) (libSceRnpsAppMgr) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceRnpsAppMgr.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceRtc.md b/docs/dev/debt/libSceRtc.md
index 56985f25a2..12645457b4 100644
--- a/docs/dev/debt/libSceRtc.md
+++ b/docs/dev/debt/libSceRtc.md
@@ -7,6 +7,8 @@
 ### Unknown function info
 
 - [sceRtcParseDateTime](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - a blank zone after seconds is accepted. With fully allocated input storage on PS5 firmware 13.42 and again on 13.60, the same NUL-terminated text returned `BAD_PARSE` when the byte after its terminator was zero and succeeded when that byte was uppercase `T`. This dependence on storage after the terminator is not modeled; controlled backing-byte measurements in a title process are unavailable.
+- [sceRtcFormatRFC2822, sceRtcFormatRFC2822LocalTime, sceRtcFormatRFC3339LocalTime](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - measured on PS4 firmware 10.71, not on a PS5: the RFC 2822 text, `INVALID_YEAR` when the zone-shifted tick is past 9999 as a signed value, otherwise `INVALID_VALUE` when the source tick or the zone-shifted tick is negative as a signed value, and the local-time variants using the offset in effect at the given instant (+01:00 in January, +02:00 in July on a Central European console). A null tick formatting the current time and the ±1439 minute offset limit come from the PS5 measurement in the next entry and are not measured on the PS4
+- [sceRtcFormatRFC3339, sceRtcGetDayOfWeek, sceRtcSetTime_t](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - measured on PS4 firmware 10.71 from processes compiled with SDK versions 0x01000051, 0x02ffffff, 0x03000000 and 0x05050001, not on a PS5. From 0x03000000 on: `FormatRFC3339` returns `INVALID_VALUE` when adding the zone shift to the tick overflows or underflows 64 bits (earlier SDKs wrap); `GetDayOfWeek` checks the month before the year and rejects a year past 9999 (earlier SDKs check the year first, with no upper bound); `SetTime_t` rejects negative seconds with `INVALID_VALUE` and converts all 64 bits (earlier SDKs take the low 32 bits). 0x02ffffff still behaves the earlier way and 0x03000000 the later way. The earlier rules apply only to a PS4 title (a CUSA title ID): a PS5 title has its own SDK numbering, so it always gets the later rules, the behaviour main had before; those are not measured on a PS5.
 - [sceRtcGetDosTime, sceRtcSetDosTime](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - bit layout from shadPS4 (PS4, the standard FAT date/time). A year outside 1980-2107 makes `GetDosTime` return `INVALID_YEAR` after writing 0 for an earlier one and `0xff9fbf7d` (2107-12-31 23:59:58, the largest encodable time) for a later one, and `SetDosTime` decodes the year as the unsigned 7-bit FAT field (1980-2107) without validating the fields, as the disassembly-derived [fpPS4](https://github.com/red-prig/fpPS4) reimplementation of the PS4 library does; not confirmed on a PS5 title, and shadPS4 instead masks out-of-range years into the packed value and sign-extends the 16-bit date
 - [sceRtcFormatRFC2822LocalTime, sceRtcFormatRFC3339LocalTime](../../../core/libs/prx/libSceRtc/Export.cpp): the native wrappers obtain the zone from a kernel timezone query, while the host uses the offset at the supplied instant. The kernel timezone configuration and its failure paths are not modeled. Native formatting confirms that null tick pointers select current time, RFC3339 uses two fractional digits, and explicit offsets are limited to -1439 through 1439 minutes.
 - [sceRtcGetCurrentRawNetworkTick](../../../core/libs/prx/libSceRtc/Export.cpp) (libSceRtc) - the console reads clock 0x13 and returns its time plus the Unix epoch in ticks, or `0x80B50001` when the clock is unsupported (errno 5). The raw network clock is not modelled; this returns the host clock. Read from the disassembly of libSceRtc.sprx on firmware 13.60, not measured on a console
diff --git a/docs/dev/debt/libSceSaveData.native.md b/docs/dev/debt/libSceSaveData.native.md
index ba886396d2..5dd2782a8b 100644
--- a/docs/dev/debt/libSceSaveData.native.md
+++ b/docs/dev/debt/libSceSaveData.native.md
@@ -5,7 +5,7 @@
 - [sceSaveDataCreateTransactionResource, sceSaveDataDeleteTransactionResource](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - transaction resources return synthetic positive identifiers and validate initialization state; resource parameter validation and transactional rollback semantics on host filesystem storage are unknown
 - [sceSaveDataPrepareForTransferring](../../../core/libs/prx/libSceSaveData.native/Export.cpp): the native wrapper confirms the same 16-byte mount point and 40-byte preparation parameter transport as `sceSaveDataPrepare`. Transfer preparation still requires the save-data service backend; its protected stub is unchanged.
 - [sceSaveDataTransferringMountPs4, sceSaveDataDirNameSearchPs4](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - arguments assumed to be those of `sceSaveDataTransferringMount` and `sceSaveDataDirNameSearch`: KytyPS5 binds both NIDs to the PS5 functions, and [prosper](https://github.com/mattias800/prosper) captured the same result layout on a title for the search. There is no PS4 save area, so the mount returns `NOT_FOUND` and the search reports zero hits
-- [sceSaveDataConvert](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - the parameter block (user id at `+0x00`, `SceSaveDataDirName` pointer at `+0x08`, 48 opaque bytes after it) is read from PPSA28416's single call, not confirmed by KytyPS5, shadPS4, fpPS4 or SharpProspero, which have no body for it. Host saves have no size limit, so an existing save returns `SCE_OK` without touching its files and no event is queued; what the console returns for a save that is mounted, already converted or needs no conversion is unknown. The directory name is validated as `sceSaveDataDelete` does
+- [sceSaveDataConvert](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - the parameter block (user id at `+0x00`, `SceSaveDataDirName` pointer at `+0x08`, 48 opaque bytes after it) is read from PPSA28416's single call, not confirmed by KytyPS5, shadPS4, fpPS4 or SharpProspero, which have no body for it. Host saves have no size limit, so an existing save returns `SCE_OK` without touching its files and queues a successful type-5 completion event with the user and directory; PPSA03671 polls for this event after conversion. What the console returns for a save that is mounted, already converted or needs no conversion is unknown. The directory name is validated as `sceSaveDataDelete` does
 - [sceSaveDataGetConvertProgress](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - imported by PPSA16064; signature and error codes follow the [SDK 12.000 reference](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-get-convert-progress.md) (`float* progress`). Save data conversion on host filesystems completes synchronously, so the progress query returns `SAVE_DATA_OK` with the last conversion's progress (`0.0f` before any conversion or when conversion fails, `1.0f` after successful conversion), `SAVE_DATA_ERROR_PARAMETER` if `progress` is null, or `SAVE_DATA_ERROR_NOT_INITIALIZED` when the library is uninitialized; intermediate asynchronous conversion progress on console is unmeasured
 - [sceSaveDataCancel](../../../core/libs/prx/libSceSaveData.native/Export.cpp): the native wrapper forwards one 32-bit argument to the save-data service. Its meaning and cancellation results require the service handler; the protected stub is unchanged.
 - [sceSaveDataDirNameSearch](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - the sort keys (0 directory name, 1 user parameter, 2 blocks, 3 modification time, 5 free blocks) and orders (0 ascending, 1 descending) follow shadPS4, not a hardware run; saves with equal keys keep directory-name order before a descending reverse. The search infos (blocks, free blocks and 32 reserved bytes per returned name) follow shadPS4's `OrbisSaveDataSearchInfo`. Keys other than 0, 1, 2, 3 and 5 (including 4) and orders above 1 return `SCE_SAVE_DATA_ERROR_PARAMETER`; shadPS4 and KytyPS5 only reject keys above 5, so key 4 is rejected here because no source names it. In the directory name pattern `%` matches any run of characters, none included, and `_` exactly one, as the comments of shadPS4's matcher describe; also not confirmed on hardware
@@ -19,6 +19,6 @@
 - [sceSaveDataDirNameSearch2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) runs the same search as `sceSaveDataDirNameSearch` with the same condition and result structures, as [SharpEmu](https://github.com/sharpemu/sharpemu/blob/main/src/SharpEmu.Libs/SaveData/SaveDataExports.cs) does, its only source; what distinguishes it on the console is unknown.
 - [sceSaveDataMount3](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - a failed mount (BUSY, EXISTS, NOT_FOUND, MOUNT_FULL) leaves the result as it was, as shadPS4 does; not checked on hardware. Animal Well (PPSA22520) depends on it: it checks for its save with a mount it never unmounts, then saves with a second mount of the same directory, ignores its BUSY and keeps using the first mount point for `sceSaveDataPrepare`, its file and `sceSaveDataUmount2`
 - [sceSaveDataMount3](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - an unterminated or empty directory name, `.`, `..`, or a name containing `/`, `\` or `:` returns `SAVE_DATA_ERROR_PARAMETER`, which the [SDK 12.000 reference](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-mount3.md#L196-L204) lists for an invalid parameter, and leaves the result as it was, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L652-L658) does. The [SDK](https://github.com/peterpuppy/bm/blob/3f9d1ba6b896a53080460c903f5c15af8affb80d/features/ps5/document/output/psn_12/System/Save_Data/SaveData-Reference/sce-save-data-dir-name.md#L32-L36) lets an application use only letters, digits, `-`, `.` and `@` in a name, and KytyPS5 also accepts `_` ([`valid_path_component`](https://github.com/KytyPS5/KytyPS5/blob/569ec04d1a77127c601eed522ad5bba187173f9d/src/libs/libSaveData.cpp#L276-L287)); which other names the console's mount rejects is not checked on hardware
-- [sceSaveDataGetMountInfo, sceSaveDataGetParam, sceSaveDataLoadIcon, sceSaveDataSaveIcon, sceSaveDataSetParam, sceSaveDataUmount2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - null pointer arguments return `SAVE_DATA_ERROR_PARAMETER` instead of throwing C++ exceptions; unmounted targets return `SAVE_DATA_ERROR_NOT_MOUNTED`, and parameter type or buffer size violations return `SAVE_DATA_ERROR_PARAMETER` after slot lookup
+- [sceSaveDataBackup, sceSaveDataGetEventResult, sceSaveDataGetMountInfo, sceSaveDataGetParam, sceSaveDataLoadIcon, sceSaveDataSaveIcon, sceSaveDataSetParam, sceSaveDataUmount2](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - null pointer arguments return `SAVE_DATA_ERROR_PARAMETER` instead of throwing C++ exceptions; unmounted targets return `SAVE_DATA_ERROR_NOT_MOUNTED`, and parameter type or buffer size violations return `SAVE_DATA_ERROR_PARAMETER` after slot lookup
 
 - [sceSaveDataSyncSaveDataMemory](../../../core/libs/prx/libSceSaveData.native/Export.cpp) (libSceSaveData.native) - validates library initialization and parameters; since in-memory saves flush synchronously on write, sync confirms existence and readiness of the memory blob
diff --git a/docs/dev/debt/libSceScreenShot.md b/docs/dev/debt/libSceScreenShot.md
index 2e1f886b38..a109ca5bb9 100644
--- a/docs/dev/debt/libSceScreenShot.md
+++ b/docs/dev/debt/libSceScreenShot.md
@@ -1,5 +1,11 @@
 # libSceScreenShot technical debt
 
+### Silent stubs
+
+- [sceScreenShotEnableNotification and sceScreenShotDisableNotification](../../../core/libs/prx/libSceScreenShot/Export.cpp) (libSceScreenShot) - return 0 without effect: on the console they ask the system software to show or hide the capture notification, which this project does not display
+- [sceScreenShotSetOverlayImage and sceScreenShotSetOverlayImageWithOrigin](../../../core/libs/prx/libSceScreenShot/Export.cpp) (libSceScreenShot) - check the arguments and the file as the PS5 module does, then return 0 without keeping the image, since this project takes no screenshots to overlay
+- [sceScreenShotIsDisabled](../../../core/libs/prx/libSceScreenShot/Export.cpp) (libSceScreenShot) - reports one process-wide flag set by sceScreenShotDisable and cleared by sceScreenShotEnable for any id other than -1; on the console the system software answers, and what the id selects is unknown
+
 ### Unknown function info
 
-- [sceScreenShotCapture, sceScreenShotDisable, sceScreenShotDisableNotification, sceScreenShotEnable, sceScreenShotEnableNotification, sceScreenShotGetAppInfo, sceScreenShotGetDrcParam, sceScreenShotIsDisabled, sceScreenShotIsVshScreenCaptureDisabled, sceScreenShotSetDrcParam and sceScreenShotSetParam](../../../core/libs/prx/libSceScreenShot/Export.cpp) (libSceScreenShot) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceScreenShot.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceScreenShotCapture, sceScreenShotGetAppInfo, sceScreenShotGetDrcParam, sceScreenShotIsVshScreenCaptureDisabled, sceScreenShotSetDrcParam and sceScreenShotSetParam](../../../core/libs/prx/libSceScreenShot/Export.cpp) (libSceScreenShot) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceScreenShot.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
diff --git a/docs/dev/debt/libSceSharePlay.md b/docs/dev/debt/libSceSharePlay.md
index cd999b7fab..f7255df0d8 100644
--- a/docs/dev/debt/libSceSharePlay.md
+++ b/docs/dev/debt/libSceSharePlay.md
@@ -9,4 +9,4 @@
 
 - [sceSharePlayInitialize and sceSharePlayTerminate](../../../core/libs/prx/libSceSharePlay/Export.cpp) - native heap validation and initialization state are recovered: a null heap ignores the supplied size, a supplied heap requires at least 0x1800 bytes, repeated initialization returns 0x810E0003 and termination before initialization returns 0x810E0004. The host does not allocate the native internal heap, connect to the Share Play service or reproduce its failures.
 - [sceSharePlayGetCurrentConnectionInfoA](../../../core/libs/prx/libSceSharePlay/Export.cpp) - the native module confirms a 72-byte result, initial zero fields and both user IDs -1. Initialization is checked before the output pointer. The host retains this initial disconnected state; native event draining, cached updates and service reconnection are unimplemented.
-- [sceSharePlayProhibitController](../../../core/libs/prx/libSceSharePlay/Export.cpp) - the argument is one byte, forwarded unchanged to the service. The host checks initialization and accepts 0/1 without a visitor controller; other byte values still throw because their handling belongs to the unimplemented service.
+- [sceSharePlayProhibitController](../../../core/libs/prx/libSceSharePlay/Export.cpp) - the argument is one byte, forwarded unchanged to the service. The host checks initialization, accepts 0/1 without a visitor controller, and returns 0x810E0001 (SCE_SHARE_PLAY_ERROR_INVALID_ARGS) for other values; dynamic service communication and controller state remain unimplemented.
diff --git a/docs/dev/debt/libSceShareUtility.md b/docs/dev/debt/libSceShareUtility.md
new file mode 100644
index 0000000000..c953b5f180
--- /dev/null
+++ b/docs/dev/debt/libSceShareUtility.md
@@ -0,0 +1,5 @@
+# libSceShareUtility technical debt
+
+### Unknown function info
+
+- [sceShareUtilityAdvanceFromFileWithContentIdList, sceShareUtilityAdvanceFromFileWithTitleIdList, sceShareUtilityAdvanceGetServiceInfo, sceShareUtilityAdvanceInitialize, sceShareUtilityAdvanceQueryServiceInfo, sceShareUtilityAdvanceQueryServiceInfoA, sceShareUtilityAdvanceResetPlayingContent, sceShareUtilityAdvanceSetPlayingContent, sceShareUtilityAdvanceSetUploadContentData, sceShareUtilityAdvanceTerminate, sceShareUtilityAdvanceValidateContents, sceShareUtilityAdvanceWakeUpShareMenu, sceShareUtilityAdvanceWakeUpShareMenuBroadcast, sceShareUtilityAdvanceWakeUpShareMenuDefault, sceShareUtilityAdvanceWakeUpShareMenuForShareContent, sceShareUtilityInitialize, sceShareUtilityInitializeEx2, sceShareUtilityOpenShareMenu, sceShareUtilityOpenShareMenuBroadcast, sceShareUtilityOpenShareMenuDefault, sceShareUtilityOpenShareMenuForShareContent and sceShareUtilityTerminate](../../../core/libs/prx/libSceShareUtility/Export.cpp) (libSceShareUtility) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceShareUtility.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceSocialScreenDialog.md b/docs/dev/debt/libSceSocialScreenDialog.md
index a1b39f0af9..b1b16a216d 100644
--- a/docs/dev/debt/libSceSocialScreenDialog.md
+++ b/docs/dev/debt/libSceSocialScreenDialog.md
@@ -1,5 +1,5 @@
 # libSceSocialScreenDialog technical debt
 
-### Unknown function info
+### Silent stubs
 
-- [sceSocialScreenDialogClose, sceSocialScreenDialogGetResult, sceSocialScreenDialogGetStatus, sceSocialScreenDialogInitialize, sceSocialScreenDialogOpen, sceSocialScreenDialogTerminate and sceSocialScreenDialogUpdateStatus](../../../core/libs/prx/libSceSocialScreenDialog/Export.cpp) (libSceSocialScreenDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSocialScreenDialog.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [libSceSocialScreenDialog](../../../core/libs/prx/libSceSocialScreenDialog/Export.cpp) - the social screen dialog runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as there is no second-screen viewer. The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
diff --git a/docs/dev/debt/libSceSsl.md b/docs/dev/debt/libSceSsl.md
index 23190fe3ef..20e9e19b1d 100644
--- a/docs/dev/debt/libSceSsl.md
+++ b/docs/dev/debt/libSceSsl.md
@@ -4,7 +4,7 @@
 
 - [CA_MGMT_extractKeyBlobEx, CA_MGMT_extractPublicKeyInfo, CA_MGMT_freeKeyBlob, CRYPTO_initAsymmetricKey, CRYPTO_uninitAsymmetricKey, RSA_verifySignature, VLONG_freeVlongQueue, sceSslCheckRecvPending, sceSslCreateSslConnection and sceSslDeleteSslConnection](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - the list is the intersection of the export table of the console's libSceSsl (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); no credible prototypes were found. They are declared without parameters solely to resolve known imports, not as an ABI claim; callers must not call them until signatures are verified.
 - [sceSslDisableOption, sceSslDisableOptionInternal, sceSslDisableOptionInternalInsecure, sceSslEnableOption, sceSslEnableOptionInternal, sceSslGetNanoSSLModuleId, sceSslGetPeerCert, sceSslGetSslError, sceSslLoadRootCACert and sceSslSetSslVersion](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - the list is the intersection of the export table of the console's libSceSsl (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); no credible prototypes were found. They are declared without parameters solely to resolve known imports, not as an ABI claim; callers must not call them until signatures are verified.
-- [sceSslRecv, sceSslReuseConnection and sceSslSend](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - the list is the intersection of the export table of the console's libSceSsl (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). Their parameter shapes follow [SharpProspero's pinned bindings](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs#L222-L262), and are not measured on a PS5.
+- [sceSslReuseConnection](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - its name and NID appear in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSsl.c) and [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv); its parameter shape follows [SharpProspero's pinned binding](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs#L2231-L2235). No console observation or reliable implementation source for session reuse was found.
 
 - [sceSslCreateConnection, sceSslDeleteConnection, sceSslSetVerifyCallback, sceSslConnect, sceSslRead, sceSslWrite](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - imported by `ffmpeg.prx`. Signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/Net/Http.cs#L195-L252), which also says the socket stays open after `sceSslDeleteConnection`. The behaviour below was measured on a PS5 on system software 13.40 with a ps5-payload-dev payload (every call printed with its return, a TLS 1.2 test server on the LAN presenting leaves issued by the test fixture root loaded with `sceSslLoadCert`, from an elfldr process rather than a title); what differs for a title process is unknown. An unknown context returns `SSL_ERROR_INVALID_ID` (0x8095F006) from `sceSslCreateConnection`, and every connection call on an unknown or deleted connection id or on a connection whose context was terminated returns `SSL_ERROR_INVALID_ID`. `sceSslCreateConnection` returns `SSL_ERROR_INVALID_VALUE` (0x8095F007) for a null host and does not check the socket: `sceSslConnect` on a descriptor that is not a socket returns `SCE_NET_ERROR_EBADF` (0x80410109). `sceSslConnect` runs a TLS 1.2 client handshake with Mbed TLS 3.6.7 over the host socket that the guest number maps to in the libkernel or libSceNet socket table, and `sceSslRead` and `sceSslWrite` carry application data over it. TLS 1.3 is compiled out: the console offers TLS 1.2 only (its ClientHello carries 12 suites and no supported_versions extension) and a TLS 1.3-only server gets `SSL_ERROR_FATAL_ALERT` (0x8095F010) from it, as from this build. Connection state is allocated from the context's pool and returned to it by `sceSslDeleteConnection`; a connection keeps the pool alive after `sceSslTerm`, whose connections return `SSL_ERROR_INVALID_ID` from then on. The console's pool use for one connection with a two-certificate chain peaked at 80,544 bytes in a 256 KiB pool (5,568 after `sceSslInit`, 12,000 after loading one CA); a 16 KiB pool fails the connect with `SSL_ERROR_OUT_OF_MEMORY` (0x809517D5) there and here. The server's chain is checked against the CAs loaded with `sceSslLoadCert`, the host name the connection was created with (case-insensitively; an IP literal sends no SNI and matches an IP subject alternative name; an empty host sends an empty SNI and fails `CN_CHECK`) and, when enabled, its validity dates, and `sceSslConnect` returns the first failure the connection's verify options select (the verify option entry below lists the bits, codes and initial options); no root bundle is shipped and the console's built-in roots are unknown, so with no CA loaded a connection with the initial options returns `SSL_ERROR_UNKNOWN_CA` (0x8095F00C), as on the console. A client certificate loaded with `sceSslLoadCert` is sent when the server asks for one. A failed verification is final: close_notify is sent, later `sceSslConnect` calls return the same code (also after the `WANT_POLLIN` rounds of a non-blocking socket), and `sceSslRead` and `sceSslWrite` throw, as the console's codes for them were not measured. With a verify callback set it is called once after the handshake, outside the connection's lock, with the context id, the bits of the enabled checks that failed (`KNOWN_CA_CHECK` 0x20, `CN_CHECK` 0x4, the date checks when enabled, 0 when the chain passed), handles to a copy of the peer chain as received (the leaf first, the root last when the server sent it) that the certificate readers of the connection's context accept until the connection is deleted (the handles stay registered in the context until it is terminated; the console frees them at the delete), the chain length and the user argument. A chain fault that no option names (`SSL_ERROR_INVALID_CERT` without a callback) throws when a callback is set, as the bits the console passes for it were not measured. A non-negative return accepts the connection whatever the bits were; a negative return fails the connect with `SSL_ERROR_APPLICATION_VERIFICATION_CALLBACK_CHECK` (0x8095F0FD) and the callback runs again, with the same chain, from every later `sceSslConnect`, `sceSslRead` and `sceSslWrite` of the connection, which return 0x8095F0FD while it keeps refusing and proceed once it accepts. A `sceSslConnect` from inside the callback, or from another thread while it runs, throws. `sceSslRead` and `sceSslWrite` before `sceSslConnect` run the handshake and verification themselves and return its code when it fails. A non-blocking socket that would block returns `SSL_ERROR_WANT_POLLIN` (0x8095F013) or `SSL_ERROR_WANT_POLLOUT` (0x8095F014) from `sceSslConnect`, `sceSslRead` and `sceSslWrite`; the next `sceSslConnect` resumes the handshake, and `sceSslWrite` returns the part it sent before blocking (the console returned 32 KiB of a 64 KiB write). A blocking libSceNet socket whose `SO_RCVTIMEO` expires returns `SSL_ERROR_WANT_POLLIN` as well, and the call can be repeated; `SSL_ERROR_READ_TIMEOUT` (0x80951710) is never returned. libkernel keeps its timeouts above the host socket, so they do not bound SSL reads and writes on a libkernel socket. `sceSslRead` with flags 0 reads until `len` bytes arrived or the stream ended and with flags 1 or 2 returns what the first record delivers. Native flags 3 peek without consuming data; values outside 0 through 3 return `SSL_ERROR_INVALID_VALUE` before connection lookup. A non-blocking read that got some bytes returns them. It returns 0 after the server's close_notify and after a transport that ends without one, every later read 0 again, and `SSL_ERROR_EOF` (0x8095177C) and `SSL_ERROR_SOCKET_CLOSED` (0x8095170D) never from a read. A reset (`ECONNRESET`, `EPIPE`, `WSAECONNRESET`, `WSAECONNABORTED`, `WSAENETRESET`) returns `SCE_NET_ERROR_ECONNRESET` (0x80410136) from `sceSslRead` and `SCE_NET_ERROR_EPIPE` (0x80410120) from `sceSslWrite`, on every later call too; a record that fails its MAC returns 0x80951D55 from `sceSslRead` after the fatal alert goes out. `sceSslWrite` accepts flags 0 only, `SSL_ERROR_INVALID_VALUE` otherwise, sends all of `len`, capped at `INT_MAX`, and returns the count; it keeps writing after the peer's close_notify or a stream that ended without one, as the console does. A fatal alert during the handshake returns `SSL_ERROR_FATAL_ALERT` and ends the transport: later `sceSslConnect` calls return 0, `sceSslRead` 0 and `sceSslWrite` `SSL_ERROR_SOCKET_CLOSED`, as measured. A transport that ends without close_notify or a reset during the handshake returns `SSL_ERROR_SOCKET_CLOSED`, the session is dropped and the next `sceSslConnect` starts over; those two handshake cases and `SSL_ERROR_INVALID_CERT` (0x8095F00A) for a verification failure no option names were not measured. Other handshake and socket failures, a read or write after a failed verification, a write after `sceSslClose`, a null buffer and a read or write from inside the callback throw, as their console codes are unknown. A connection serializes its reads and writes, so a read blocked in one thread holds back a write on the same connection from another. `sceSslDeleteConnection` sends no close_notify and returns `SSL_ERROR_INVALID_ID` when repeated. `sceSslTerm` leaves the context's connections to `sceSslDeleteConnection`, which then returns `SSL_ERROR_INVALID_ID`; a second `sceSslTerm` returns `SSL_ERROR_INVALID_ID` and `sceSslInit` with a pool size of 0 returns `SCE_KERNEL_ERROR_EINVAL` (0x80020016). `sceSslSetVerifyCallback` accepts any callback, null included, and returns 0. The console's first `sceSslConnect` in a process took 23.8 s before its ClientHello left, a one-time initialisation not emulated. `SSL_ERROR_BEFORE_INIT` (0x8095F001) is never returned, as the library keeps no state apart from its contexts
 - [sceSslClose](../../../core/libs/prx/libSceSsl/Export.cpp) (libSceSsl) - takes the connection id, as in [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/Net/Http.cs#L195-L252). Measured on 13.40 as the connection entry describes: it sends close_notify once if the handshake completed and returns 0, 0 again when repeated and 0 on a connection that never connected, already failed verification or lost its transport to a fatal alert; a close before the handshake changes nothing, so the connection can still connect. After the close `sceSslConnect` returns 0 and `sceSslRead` 0, as on the console; `sceSslWrite` after it throws, as the console's code was not measured. A close_notify that a non-blocking socket cannot take at once returns `SSL_ERROR_WANT_POLLOUT` (0x8095F014) and the close can be repeated; after a reset it returns `SCE_NET_ERROR_ECONNRESET` (0x80410136) every time. The socket is left to the title; an unknown connection returns `SSL_ERROR_INVALID_ID` (0x8095F006). Whether the console closes the socket is unknown
diff --git a/docs/dev/debt/libSceSysCore.md b/docs/dev/debt/libSceSysCore.md
index 969d61b1fe..386b64d98d 100644
--- a/docs/dev/debt/libSceSysCore.md
+++ b/docs/dev/debt/libSceSysCore.md
@@ -3,3 +3,15 @@
 ### Unknown function info
 
 - [sceApplicationGetAppInfoByAppId](../../../core/libs/prx/libSceSysCore/Export.cpp) takes a 32-bit application ID and a writable 152-byte record. The service fills the record through IPC; its complete field layout remains unresolved. The SystemService caller consumes a subrecord beginning at byte 48.
+
+- [_sceApplicationGetAppId, sceApplicationAddProcess2, sceApplicationBeginSclkChange, sceApplicationBlockingKill2, sceApplicationBlockingKill3, sceApplicationContinue, sceApplicationCrashSyscore, sceApplicationCrashSystemProcess](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationEndSclkChange, sceApplicationExitSpawn, sceApplicationExitSpawn2, sceApplicationFinalize, sceApplicationGetAppPackageInfoForCoredump, sceApplicationGetCompiledSdkVersionByAppId and sceApplicationGetCoredumpDirAndFileName](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationGetCoredumpState, sceApplicationGetCpuUsage, sceApplicationGetCpuUsage2, sceApplicationGetDbgExecutablePath, sceApplicationGetMode, sceApplicationGetProcs and sceApplicationGetShellCoreAppId](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationGetStateForDebugger, sceApplicationInitialize, sceApplicationInitializeForShellCore, sceApplicationIsCrashReportBeingProcessed, sceApplicationIsPrimaryProcess, sceApplicationIsResumable and sceApplicationIsSuspendable](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationKickCoredump, sceApplicationKickCoredump2, sceApplicationKill, sceApplicationLocalProcessKill, sceApplicationLocalProcessKill2, sceApplicationLocalProcessResume and sceApplicationLocalProcessSuspend](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationNotifyCoredumpRequestEnd, sceApplicationNotifyCoredumpRequestProgress, sceApplicationNotifyVshMainOnStandby, sceApplicationNotifyVshReady, sceApplicationOnAllResourceReleased and sceApplicationRaiseException](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationRaiseExceptionToLocalPid, sceApplicationRaiseExceptionToPid, sceApplicationRequestToChangeRenderingMode, sceApplicationRestore, sceApplicationResume, sceApplicationSave and sceApplicationSendDebugSpawnResult2](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSendResultOfDebuggerKillRequest, sceApplicationSendResultOfDebuggerResumeRequest, sceApplicationSendResultOfDebuggerSuspendRequest, sceApplicationSendResultOfDebuggerTitleIdLaunchRequest and sceApplicationSetApplicationFocus](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSetControllerFocus, sceApplicationSetControllerFocusPermissionToSubProcess, sceApplicationSetMemoryPstate, sceApplicationSignalShellCoreHeartBeat, sceApplicationSpawn2 and sceApplicationSuspend](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSuspendSystemForDebugger, sceApplicationSwitchToBaseMode, sceApplicationSwitchToNeoMode, sceApplicationSwitchToNeoMode2, sceApplicationSystemReboot and sceApplicationSystemShutdown2](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceApplicationSystemSuspend, sceApplicationSystemSuspend2, sceApplictionGetStateForDebugger, sceSysCoreGetEventCount and sceSysCoreReceiveEvent](../../../core/libs/prx/libSceSysCore/Export.cpp) (libSceSysCore) - The list is the intersection of the export table of the console's libSceSysCore (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo. Names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSysCore.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
diff --git a/docs/dev/debt/libSceSystemLogger2.md b/docs/dev/debt/libSceSystemLogger2.md
new file mode 100644
index 0000000000..3d17ac6069
--- /dev/null
+++ b/docs/dev/debt/libSceSystemLogger2.md
@@ -0,0 +1,5 @@
+# libSceSystemLogger2 technical debt
+
+### Unknown function info
+
+- [sceSystemLogger2GetTimestamp, sceSystemLogger2Initialize, sceSystemLogger2SetEventAsync, sceSystemLogger2SetEventAsyncEx and sceSystemLogger2Terminate](../../../core/libs/prx/libSceSystemLogger2/Export.cpp) (libSceSystemLogger2) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceSystemLogger2.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceSystemService.md b/docs/dev/debt/libSceSystemService.md
index 35d98361d3..40dfa92cfa 100644
--- a/docs/dev/debt/libSceSystemService.md
+++ b/docs/dev/debt/libSceSystemService.md
@@ -14,10 +14,12 @@
 ### Unknown function info
 
 - [sceSystemServiceAddLocalProcessForPsmKit, sceSystemServiceKillLocalProcessForPsmKit](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - AnyPS5 runs one process and starts or stops no other, so both throw without reading their arguments. The parameters follow Forever Launcher's own firmware 5.50 probes (`ps5/probes/localproc` in [bizkut/ps5-forever](https://github.com/bizkut/ps5-forever)): a path, a null-terminated argv and a 0x90-byte parameter block in, a handle out; the kill takes that handle. Their results on the console are unknown. Forever Launcher (PPSA99030) imports both and stops at load without them.
+- [sceSystemServiceGetAppId, sceSystemServiceGetAppTitleId, sceLncUtilGetAppTitleId](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - the console's results for a title ID or app ID other than the running title are unknown, and so are its errors for null pointers, so those calls throw. `sceSystemServiceGetAppId` compares the title ID exactly with the one in `param.json` or `param.sfo`. The title ID buffer is 10 bytes, so a running title ID of 10 or more characters throws too. The signatures follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/SystemService/SystemService.cs#L236-L260), except that `sceLncUtilGetAppTitleId` returns an `int`, as declared in the pending exports, and 0 on success like `sceSystemServiceGetAppTitleId`; SharpProspero names `ErrorNoAppInfo` (0x80A10009) only for `sceSystemServiceGetAppFocusedAppStatus`.
 - [sceSystemServiceLaunchApp](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - AnyPS5 runs one title and cannot start another, so every call throws without reading its arguments. The (title ID, null-terminated argv, launch parameters) signature follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/SystemService/SystemService.cs#L141-L148), whose `AppLauncher` Prospero Explorer (PPSA99109) and Prospero Multi Tools (PPSA99110) import it through and which passes a 0x20-byte launch context or null; the console's argument checks and errors are unknown
 - [sceSystemServiceLaunchWebBrowser](../../../core/libs/prx/libSceSystemService/Export.cpp): the native export takes one URI argument. Null input, the 6015-byte length limit and supported scheme checks are recovered. The host still returns kernel `EOPNOTSUPP` for valid input; a missing browser service's native error is unresolved.
 - [sceSystemServiceParamGetString](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - the system name (parameter 6) is the fixed `PS5`, not the console's name. As in a payload process on a PS5 (firmware 13.60), the name is written NUL-padded to the whole buffer, and a buffer under 65 bytes, a null buffer or any other parameter returns `SYSTEM_SERVICE_ERROR_PARAMETER` without writing. Parameters 0 to 40, 100 to 110, 1000 to 1010, -1 and `INT_MAX` were tried there; the others are assumed to fail the same way. PPSA26344 at `0xA87935` passes parameter 6 with a 65-byte buffer
-- [sceSystemServiceParamGetInt](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - console language numbers 0 to 29 follow the PS4 SDK enum in [OpenOrbis](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/06fcf7fd108fa080035cdd3259ed22eb07e0508c/include/orbis/_types/sys_service.h#L54-L83) (21 Arabic). 30 (Ukrainian) is not in it and follows PPSA99505 ([Jelly5](https://github.com/02dnot/Jelly5/blob/552b866d89b2a58b27f7f7b0484dc743ce235526/app/src/app/i18n.cpp#L29-L60)) and PPSA99002 ([ProsperoLight](https://github.com/blackbearreloaded/ProsperoLight/blob/b708bbde3457bef1073a9ab6959957cb691e8e2f/include/i18n.hpp#L252-L309)), whose numbers agree with the enum. Not confirmed on a console, and neither title starts on `main` yet. Parameter 400 returns the same number as parameter 1: PPSA01325 asks for 400 first, asks for 1 when that fails, and uses either answer as an index into the same 31 languages; in the PS5 10.01 and 12.60 `libSceSystemService` modules parameter 400 reads the same registry value as parameter 1, without parameter 1's mapping of newer language numbers by SDK version, and returns 0x80a10003 when an imported check that is not identified returns 1; the 4.03 module has no parameter 400. Neither the mapping nor that error is modelled, and the parameter's name is not known. Without `ANYPS5_LANGUAGE` the language is English (United States); the date format, time format and enter button stay fixed
+- [sceSystemServiceParamGetInt](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - console language numbers 0 to 29 follow the PS4 SDK enum in [OpenOrbis](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/06fcf7fd108fa080035cdd3259ed22eb07e0508c/include/orbis/_types/sys_service.h#L54-L83) (21 Arabic). 30 (Ukrainian) is not in it and follows PPSA99505 ([Jelly5](https://github.com/02dnot/Jelly5/blob/552b866d89b2a58b27f7f7b0484dc743ce235526/app/src/app/i18n.cpp#L29-L60)) and PPSA99002 ([ProsperoLight](https://github.com/blackbearreloaded/ProsperoLight/blob/b708bbde3457bef1073a9ab6959957cb691e8e2f/include/i18n.hpp#L252-L309)), whose numbers agree with the enum. Not confirmed on a console, and neither title starts on `main` yet. Parameter 400 returns the same number as parameter 1: PPSA01325 asks for 400 first, asks for 1 when that fails, and uses either answer as an index into the same 31 languages; in the PS5 10.01 and 12.60 `libSceSystemService` modules parameter 400 reads the same registry value as parameter 1, without parameter 1's mapping of newer language numbers by SDK version, and returns 0x80a10003 when an imported check that is not identified returns 1; the 4.03 module has no parameter 400. Neither the mapping nor that error is modelled, and the parameter's name is not known. Without `ANYPS5_LANGUAGE` the language is English (United States); the date format and time format stay fixed
+- [sceSystemServiceParamGetInt](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - parameters 1 to 5, 100 to 111, 200 to 213, 300 and 400 answer (see the integer system parameters entry); every other parameter, and a null value pointer, returns 0x80A10003 without writing the value. Inside a retail title on a PS5 (firmware 13.40, measured 2026-10-19 through ptrace remote calls in the game process) parameters 0, 6, 7 (game parental level), 8 to 20, 401, 999, 1000 (enter button assignment) and 1001 to 1008 returned 0x80A10003, as did a null value pointer; 1 to 5 and 400 answered, and 100 answered the value 0. A sweep of parameters 0 to 2048 in the same way on 2026-10-23 also found 101 to 111, 200 to 213 and 300 answering, each writing 4 bytes; every other parameter, and a null value pointer for 100 to 111, returned 0x80A10003 and left the value as it was
 - [sceSystemServiceParamGetInt](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - the time zone (parameter 4) and summer time (parameter 5) follow the host's local time zone at the moment of the call. Titles compute the local time as UTC plus the time zone in minutes plus 60 minutes when summer time is 1 ([Apollo](https://github.com/bucanero/apollo-ps4/blob/252a9d5a187c463994263009851a179f4f910c49/source/exec_cmd.c#L70-L92), [GoldHEN's frame logger](https://github.com/GoldHEN/GoldHEN_Plugins_Repository/blob/6c3a06f53d9caebadfb0aeed9bb94119012010a7/plugin_src/frame_logger/source/main.c#L60-L82), and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/413d2e3518fb435f40971d238fe0ecae7ee551da/src/SharpProspero/Platform/SystemParameters.cs#L75-L79) calls them the offset from UTC in minutes and whether summer time is in effect), so the time zone is the host's current offset east of UTC less the summer time shift while summer time is in effect: 60 minutes on Linux, and on Windows the C runtime's own summer time bias (`_get_dstbias`), which is also what shifted its local time. For a host zone whose summer time is not one hour, Linux keeps the sum right and the standard offset wrong, and Windows the opposite; how the console reports such a zone is unknown. libkernel's `sceKernelConvertUtcToLocaltime`, `sceKernelConvertLocaltimeToUtc` and `sceKernelGettimezone` still use UTC
 - [sceSystemServiceInitializePlayerDialogParam](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - a null param throws: what the console does with it is not measured. The console run in [prosper](https://github.com/mattias800/prosper/blob/40d95db32efe1ad00106a5b9a84e018fffa9ecff/prosper/tests/data/console_oracle/nethttp.golden.tsv#L46) shows only the 0x40 bytes written (size 0x40, user ID -1 at 0xC, zeros), so the field names and the mode and target account fields follow [SharpProspero's struct](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/SystemService/SystemService.cs#L637-L655), and the `void` return [its declaration](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/SystemService/SystemService.cs#L419-L426); the console left 0x800693020 in `rax`, not an SCE error code. Closes when: the null case is measured on a PS5
 
@@ -149,7 +151,7 @@
 
 - [Assembly-only shell and clock queries](../../../core/libs/prx/libSceSystemService/PendingExports.cpp): format/fsck progress returns a float in XMM0. Impose-menu, accessibility-zoom and suspend-confirmation queries take an application ID and return a boolean. Suspend-blacklist lookup forwards a 32-bit ID to SysCore. Clock changes take a string and 32-bit value; CPU pstate takes a 32-byte input structure whose fields remain unresolved, and memory pstate takes one 32-bit value.
 
-- [Integer system parameters](../../../core/libs/prx/libSceSystemService/Export.cpp): registry-backed parameters 100–111, 200–213 and 300 throw because their settings are not modeled. Language results omit the console SDK-version compatibility remapping, and parameters 7, 400 and 1000 do not reproduce platform-dependent availability.
+- [Integer system parameters](../../../core/libs/prx/libSceSystemService/Export.cpp): registry-backed parameters 100–111, 200–213 and 300 answer the values a PS5 (firmware 13.40, measured 2026-10-23 inside a retail title) returned with its settings at the time: 101 is 1, 102 is 2, 103, 107 and 109 are 100, 104 and 110 are 0x20202, 209 is 1, 210 is 71 and the others are 0. What each parameter means, and which of them follow a user setting, is not known, so every title gets that one console's values. Language results omit the console SDK-version compatibility remapping, and parameter 400 does not reproduce platform-dependent availability.
 
 - [Tournament launch parameters](../../../core/libs/prx/libSceSystemService/Export.cpp): occurrence parameters occupy 32 bytes and contain two string pointers and a user ID. The final string semantics are unresolved. Event-details and team-profile launches retain an unused first argument slot of unknown declared type. The daemon blocking-event receive argument is passed unchanged as 64 bits to IPC; its meaning remains unresolved. Protected bodies in [PendingExports.cpp](../../../core/libs/prx/libSceSystemService/PendingExports.cpp) remain unchanged.
 - [sceSystemServiceIsBgmPlaying, sceShellCoreUtilIsBgmPlaying](../../../core/libs/prx/libSceSystemService/Export.cpp) (libSceSystemService) - not measured on a PS5: both return 0. In [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/system/systemservice.cpp) they report whether its libSceMusicPlayerService is playing; there is no libSceMusicPlayerService here, so no background music can be playing
diff --git a/docs/dev/debt/libSceUlt.md b/docs/dev/debt/libSceUlt.md
index 12002369d2..d539ce9772 100644
--- a/docs/dev/debt/libSceUlt.md
+++ b/docs/dev/debt/libSceUlt.md
@@ -6,6 +6,7 @@
 
 - [libSceUlt ulthreads](../../../core/libs/prx/libSceUlt/Export.cpp) - Runtime option defaults still omit the native header, stack size, worker affinity and priority fields; affinity depends on unresolved process configuration queries. Concurrent join ownership is not modeled: the native runtime distinguishes an ordinary running thread from one with another joiner. Host threads do not use the guest context or worker scheduler.
 - [libSceUlt queues](../../../core/libs/prx/libSceUlt/Export.cpp) - Queue-data pool destruction and shared slot limits still require comparison with the native node allocator.
+- [`sceUltConditionVariableCreate` and `sceUltConditionVariableOptParamInitialize`](../../../core/libs/prx/libSceUlt/Export.cpp) (libSceUlt) are absent from the console export list, where only the underscored variants `_sceUltConditionVariableCreate` and `_sceUltConditionVariableOptParamInitialize` appear; their non-underscored signatures are assumed. Condition variable option parameter initialization only zeroes 128 bytes, and its layout without the common header remains unverified on hardware.
 - [Ult factory and creation exports](../../../core/libs/prx/libSceUlt/Export.cpp) without a leading underscore are absent from the supplied module; their signatures remain unresolved. Diagnostic signatures and synchronization argument lists are recovered.
 
 - [sceUltMutexTryLock, the reader-writer lock and sceUltUlthreadGetSelf, sceUltUlthreadYield and sceUltUlthreadExit](../../../core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp) (libSceUlt) - the signatures follow the PS Vita libult in [RPCS3](https://github.com/RPCS3/rpcs3/blob/13aa88c3c4d66ea8799e987f7d762d90943ab17b/rpcs3/Emu/PSP2/Modules/sceUlt.cpp) (a 256-byte lock and 128-byte option structures), not a PS5 binary. The rules are assumed: readers may take the lock while a writer waits, a thread that holds the write lock gets `ULT_ERROR_STATE` for any further lock instead of waiting on itself, a reader asking for the write lock waits on its own read lock, and the try forms return `ULT_ERROR_BUSY`. Outside an ulthread, `sceUltUlthreadGetSelf`, `sceUltUlthreadYield` and `sceUltUlthreadExit` return `ULT_ERROR_STATE`; inside one they act on the guest thread it runs on, since ulthreads are not scheduled cooperatively here
@@ -13,4 +14,3 @@
 
 - [libSceUlt queues](../../../core/libs/prx/libSceUlt/Export.cpp) use preallocated host storage instead of the supplied guest work area; the guest object layouts remain incomplete. Waiting-queue pool thread limits and waiter priority ordering are not implemented. Finalization wakes blocked queue callers with `ULT_ERROR_STATE`.
 - [sceUltWaitingQueueResourcePoolDestroy](../../../core/libs/prx/libSceUlt/Export.cpp) refuses with `ULT_ERROR_STATE` only when a thread is currently waiting on a pool-backed mutex, semaphore or queue, matching the PS5 libSceUlt disassembly (0x473a in or55417wcDk); bound but idle objects do not block pool destruction. Waiting-queue pool guest work area node accounting is not implemented.
-- The following pending declarations have unverified signatures and behavior; they are parameterless import-resolution declarations and throw through `NotImplemented_nid_no_patch`: [`_sceUltConditionVariableOptParamInitialize`](../../../core/libs/prx/libSceUlt/Export.cpp).
diff --git a/docs/dev/debt/libSceUsbStorage.md b/docs/dev/debt/libSceUsbStorage.md
index e1bc7fc86b..c901faca35 100644
--- a/docs/dev/debt/libSceUsbStorage.md
+++ b/docs/dev/debt/libSceUsbStorage.md
@@ -1,6 +1,19 @@
 # libSceUsbStorage technical debt
 
+### Silent stubs
+
+- [sceUsbStorageInit, sceUsbStorageTerm](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - no USB mass-storage device is ever attached, so there is nothing to initialize or tear down: both accept every call and keep no state, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L91-L99) does with its plain ORBIS_OK returns. A passthrough that lists devices must build its list in `Init` and free it in `Term`.
+
 ### Unknown function info
 
+- [sceUsbStorageRegisterCallback, sceUsbStorageUnregisterCallback, sceUsbStorageRegisterCallbackForMapAvailable, sceUsbStorageUnregisterCallbackForMapAvailable, sceUsbStorageRegisterCallbackForMapUnavailable, sceUsbStorageUnregisterCallbackForMapUnavailable](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - what a successful registration stores, what unregistering a never-registered callback answers, and when any callback fires is unverified: no device is ever attached, and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L110-L174) logs all six as `(STUBBED)` and returns 0 without storing anything, the success-without-a-reference pattern #6288 was closed for. The argument validation is implemented (0x80f40002 for a null callback, an event type outside 1 and 2, or a null directory); past it they keep the marker until a reference or a measurement says what success does.
+- [sceUsbStorageRequestUnmap, sceUsbStorageGetdentsClose](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - what the console answers for a directory that was never mapped and a getdents descriptor that was never opened is unknown: nothing can be mapped or opened in this model, shadPS4's [unmap](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L281-L288) only logs without keeping state and its [close](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L378-L383) succeeds only because `erase` ignores a missing key, and the no-device libraries throw on this path (`sceMoveClose` for a handle that was never opened, `sceContentSearchCloseMetadata` because no metadata id is ever handed out). Both keep the marker after their argument validation.
 - [sceUsbStorageClearFakeWriteProtection, sceUsbStorageSetFakeMapLockForDebug, sceUsbStorageSetFakeWriteProtection](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceUsbStorage.c), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim.
-- [sceUsbStorageRequestMapWSB](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - its prototype follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L245-L246), not measured on a console; the throwing declaration only resolves imports.
+- [sceUsbStorageGetMountPointOfShellCore](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the prototype is known, but no reference says what a console without a mapped device writes into the mount-point buffer or returns; it keeps the marker until a reference or a console measurement answers it.
+
+### Functional
+
+- [the argument validation](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the null-pointer, null-callback, event-type and null-directory refusals with 0x80f40002, and the getdents read of a never-opened descriptor answering 0x80f40005 with zero bytes, follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L176-L383); the validation runs before the markers the register, unregister, unmap and getdents-close exports keep above. None of this is measured on a console.
+- [the no-device answers](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - AnyPS5 has no USB mass-storage passthrough, so no device is ever attached: the device list is empty, `sceUsbStorageIsExist` succeeds and reports non-existence for every device id and directory, and the device-info query and the map and getdents-open requests answer 0x80f40004 for every device id. A passthrough that lists devices follows shadPS4's virtual-device model at the same commit for the filled paths, including its packed dirent.
+- [the device-info record](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the 0x338-byte record a passthrough fills for `sceUsbStorageGetDeviceInfo` is unverified on hardware; its layout follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Platform/UsbStorage.cs#L34-L45), which recovered it from the module's own export and was checked against #6288's "volume size at 0x0": the u64 volume size at offset 0, the vendor, product and serial strings at 0x16, 0x120 and 0x228, and the flags field the service masks with 0xd0 at 0x330. shadPS4's record starts with a u32 device id at offset 0; filling it that way puts a device id where a title reads the volume size.
+- [the prototypes of sceUsbStorageRequestMap and sceUsbStorageGetDeviceList](../../../core/libs/prx/libSceUsbStorage/Export.cpp) (libSceUsbStorage) - the signatures follow the ABI restored on `main` (the firmware-database sweep of 2026-10-21), which matches [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/usbd/usbstorage.cpp#L176-L383): `RequestMap`'s six parameters, the typed `UsbStorageCallback` of the register/unregister family, `IsExist`'s three-argument bool form and `GetDeviceList`'s `std::int32_t*` count (the count also follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Platform/UsbStorage.cs#L233-L235), whose earlier eight-parameter `RequestMap` reading carried the trailing reserved pair the restored ABI drops).
diff --git a/docs/dev/debt/libSceUsbd.md b/docs/dev/debt/libSceUsbd.md
index f23c18fd72..3f234ef7b4 100644
--- a/docs/dev/debt/libSceUsbd.md
+++ b/docs/dev/debt/libSceUsbd.md
@@ -6,4 +6,8 @@
 
 ### Unknown function info
 
-- [sceUsbdClearHalt, sceUsbdDetachKernelDriver, sceUsbdEventHandlerActive, sceUsbdGetConfigDescriptorByValue, sceUsbdGetConfiguration, sceUsbdGetDescriptor, sceUsbdGetDevice, sceUsbdGetDeviceSpeed, sceUsbdGetMaxIsoPacketSize, sceUsbdGetMaxPacketSize, sceUsbdGetStringDescriptorAscii, sceUsbdHandleEvents, sceUsbdHandleEventsLocked, sceUsbdLockEventWaiters, sceUsbdLockEvents, sceUsbdOpenDeviceWithVidPid, sceUsbdSetInterfaceAltSetting, sceUsbdTryLockEvents, sceUsbdUnlockEventWaiters, sceUsbdUnlockEvents, sceUsbdWaitForEvent](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - signatures follow the console type database in [orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L2268-L2322), but their behavior is unknown and each call throws; not measured on a console
+- [sceUsbdClearHalt, sceUsbdDetachKernelDriver, sceUsbdEventHandlerActive, sceUsbdGetDevice, sceUsbdGetDeviceSpeed, sceUsbdGetMaxIsoPacketSize, sceUsbdGetMaxPacketSize, sceUsbdHandleEvents, sceUsbdHandleEventsLocked, sceUsbdLockEventWaiters, sceUsbdLockEvents, sceUsbdOpenDeviceWithVidPid, sceUsbdSetInterfaceAltSetting, sceUsbdTryLockEvents, sceUsbdUnlockEventWaiters, sceUsbdUnlockEvents, sceUsbdWaitForEvent](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - signatures follow the console type database in [orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L2268-L2322), but their behavior is unknown and each call throws; not measured on a console
+
+### Functional
+
+- [sceUsbdGetConfiguration, sceUsbdGetConfigDescriptorByValue, sceUsbdGetDescriptor, sceUsbdGetStringDescriptorAscii](../../../core/libs/prx/libSceUsbd/Export.cpp) (libSceUsbd) - not measured on a console; they follow FreeBSD 11.4 ([libusb10_desc.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libusb/libusb10_desc.c), [libusb20.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libusb/libusb20.c)). The configuration and descriptor queries return host libusb errors. `sceUsbdGetStringDescriptorAscii` rebuilds `libusb20_dev_req_string_simple_sync` with only its 255-byte read: libusb's Windows HID backend reports the requested length as `bLength`, cutting a 4-byte header read to one character. Unlike the host `libusb_get_string_descriptor_ascii` it accepts index 0, drops non-printable characters and `<>` instead of writing `?`, and fails with `0x802400FF`. Closes when: measured on a PS5
diff --git a/docs/dev/debt/libSceUserService.md b/docs/dev/debt/libSceUserService.md
index e320add914..f1cb7b914e 100644
--- a/docs/dev/debt/libSceUserService.md
+++ b/docs/dev/debt/libSceUserService.md
@@ -4,7 +4,9 @@
 
 - [sceUserServiceGetNpAccountId](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the account id for a user with no linked PSN account is assumed to be 0 with success; libSceNpManager's `sceNpGetAccountIdA` answers the same question with `SCE_NP_ERROR_SIGNED_OUT`
 - [sceUserServiceInitialize and sceUserServiceInitialize2](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - event delivery has no background service thread, so the confirmed priority and Initialize2 CPU affinity mask do not affect host scheduling.
-- [sceUserServiceGetUserColor](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the default profile colour is assumed to be blue (0)
-- [sceUserServiceGetUserName](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - `0x80960105`, which a PS5 (firmware 13.60) returns for a user id it does not know, has no known name; it is `USER_SERVICE_ERROR_UNKNOWN_USER` here. On the console a registered user who is not logged in still gets their name; here only the initial user exists
+- [sceUserServiceGetUserColor](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - the profile colour corresponds to user index (0: blue, 1: red, 2: green, 3: pink); colours 1, 2 and 3 are assumed, not measured
+- [sceUserServiceGetUserName](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - `0x80960105`, which a PS5 (firmware 13.60) returns for a user id it does not know, has no known name; it is `USER_SERVICE_ERROR_UNKNOWN_USER` here. On the console a registered user who is not logged in still gets their name; here up to 4 users ("Player", "Player2", "Player3", "Player4") are supported; user names "Player2", "Player3" and "Player4" are assumed, not measured
+- [sceUserServiceGetEvent](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - login and logout events queued dynamically on controller hotplug have no source and are assumed, not measured
 - [sceUserServiceGetAgeLevel](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - on a PS5 (firmware 13.60) the value is the age set in the user's parental restriction (0, 7, 12 and 15 were measured) and `0xFFFFFFFF` without one; a user who is not logged in returns `0x80960009` with or without an output. Parental restrictions are not modelled, so the initial user is always reported as unrestricted. PPSA12544 (Unity) only stores the value for its user profile
 - [sceUserServiceGetAccessibilityChatTranscription, PressAndHoldDelay, TriggerEffect, Vibration, ZoomEnabled, ZoomFollowFocus](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - report 0, 0, 1, 1, 0 and 1, what a PS5 (firmware 13.60) reports for a user whose accessibility settings are all at their defaults; the console reports the user's own settings (a changed vibration intensity read 3), which are not modelled. What each number means is unknown. A user who is not logged in returns `0x80960009` with or without an output
+- [sceUserServiceGetKeyboardType, sceUserServiceGetJapaneseInputType, sceUserServiceGetTraditionalChineseInputType](../../../core/libs/prx/libSceUserService/Export.cpp) (libSceUserService) - AnyPS5 stores no per-user keyboard setting, so the initial user reports the keyboard type of the configured system language (`ANYPS5_LANGUAGE`, English US by default) and 0 for the two input variants, and any other user id returns `USER_SERVICE_ERROR_UNKNOWN_USER`. The language-to-keyboard-type table is the repository owner's (languages 0 to 29); a valid language outside it, such as Ukrainian (30), reports 20 (US English). A value that is not a console language number is rejected by `sceSystemServiceParamGetInt` with an error naming `ANYPS5_LANGUAGE`; the call throws it and leaves the output untouched. The input variant is 0 because the owner's table gives 0 for Japanese and Traditional Chinese, the only languages needing one. `sceConvertKeycodeGetImeKeyboardType` consumes these values.
diff --git a/docs/dev/debt/libSceVdecCore.md b/docs/dev/debt/libSceVdecCore.md
new file mode 100644
index 0000000000..a6803142e3
--- /dev/null
+++ b/docs/dev/debt/libSceVdecCore.md
@@ -0,0 +1,5 @@
+# libSceVdecCore technical debt
+
+### Unknown function info
+
+- [sceVdecCoreAnalyzeStream, sceVdecCoreCreateDecoder, sceVdecCoreDeleteDecoder, sceVdecCoreFinalizeComputeResource, sceVdecCoreFlushDecodeOutput, sceVdecCoreGetDecodeOutput, sceVdecCoreInitializeComputeResource, sceVdecCoreMapMemoryBlock, sceVdecCoreQueryComputeResourceInfo, sceVdecCoreQueryFrameBufferInfo, sceVdecCoreQueryInstanceSize, sceVdecCoreResetDecoder, sceVdecCoreSetDecodeInput, sceVdecCoreSetDecodeOutputSw, sceVdecCoreSyncDecode, sceVdecCoreSyncDecodeOutputSw, sceVdecCoreSyncDecodeWptr, sceVdecCoreTrySyncDecode, sceVdecCoreTrySyncDecodeOutputSw and sceVdecCoreTrySyncDecodeWptr](../../../core/libs/prx/libSceVdecCore/Export.cpp) (libSceVdecCore) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVdecCore.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceVdecsw.md b/docs/dev/debt/libSceVdecsw.md
index 0bf65cb433..4818e0bfea 100644
--- a/docs/dev/debt/libSceVdecsw.md
+++ b/docs/dev/debt/libSceVdecsw.md
@@ -2,10 +2,6 @@
 
 ### Unknown function info
 
-- [libSceVdecsw](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - structure layouts follow shadPS4's `vdecsw.h` and were checked against PPSA05684's movie decoder (`movie-decoder-vdecsw.cpp`), which asserts `pictureCount == 1` at offset 0xb of `OutputInfo` and reads `InputResult` offset 0x10 as the number of frames an access unit produced. The compute, decoder memory and decode input structures and the first 0x28 bytes of the 0x50-byte decoder config are those of libSceVideodec2, and decoding goes through it. The 0x78-byte AVC picture info is filled with Videodec2's leading fields and the cropping fields only. OUTPUT_PENDING (0x81510115), INPUT_QUEUE_EMPTY (0x81510116) and DECODE_PENDING (0x81510117) follow from the codes each call's assert accepts. At most four decoded pictures are queued and the last one is held until `sceVdecswFinalizeDecodeSequence`; the console's queue depth is unknown. `sceVdecswSyncDecodeInput` / `sceVdecswSyncDecodeOutput` retry the TrySync variants until they stop returning DECODE_PENDING / OUTPUT_PENDING; they do not sleep beyond a yield, so another thread must drain outputs when the picture queue is full. `sceVdecswGetHevcPictureInfo` still throws: the 0xb8-byte HEVC picture layout is in shadPS4's `vdecsw.h`, but this wrapper only keeps AVC picture info from Videodec2
+- [libSceVdecsw](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - structure layouts follow shadPS4's `vdecsw.h` and were checked against PPSA05684's movie decoder (`movie-decoder-vdecsw.cpp`), which asserts `pictureCount == 1` at offset 0xb of `OutputInfo` and reads `InputResult` offset 0x10 as the number of frames an access unit produced. The compute, decoder memory and decode input structures and the first 0x28 bytes of the 0x50-byte decoder config are those of libSceVideodec2, and decoding goes through it. The 0x78-byte AVC picture info is filled with Videodec2's leading fields and the cropping fields only. OUTPUT_PENDING (0x81510115), INPUT_QUEUE_EMPTY (0x81510116) and DECODE_PENDING (0x81510117) follow from the codes each call's assert accepts. At most four decoded pictures are queued and the last one is held until `sceVdecswFinalizeDecodeSequence`; the console's queue depth is unknown. `sceVdecswSyncDecodeInput` / `sceVdecswSyncDecodeOutput` retry the TrySync variants until they stop returning DECODE_PENDING / OUTPUT_PENDING; they do not sleep beyond a yield, so another thread must drain outputs when the picture queue is full. The 0xb8-byte HEVC picture info (shadPS4's `vdecsw.h`) carries only the timestamps, coded size, bit depth, IDR and IRAP flags, profile, level and conformance window (in chroma samples, repeated in the frame cropping fields, whose console unit is unknown)
 
 - [sceVdecswGetVp9PictureInfo](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - no console behaviour is recorded; the signature and 0x58-byte layout come from [SharpProspero's Vdecsw.cs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/Vdecsw.cs#L892-L952), and shadPS4 has no VP9 getter. It copies the leading `thisSize - 8` bytes of the picture's info, as [shadPS4's `sceVdecswGetPictureInfo`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/videodec/vdecsw.cpp#L303-L334) does for AVC and HEVC, from Videodec2's VP9 info (`level` is 0 there). An output with no picture returns 0 and writes nothing. Null pointers, `thisSize` below 8, two pictures and a frame buffer no VP9 decoder returned (an H.264 picture too) throw; console error codes are unknown. VP9 decoding goes through Videodec2 and rejects pictures deeper than 10 bits
-
-### Functional
-
-- [sceVdecswGetHevcPictureInfo](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - throws until HEVC picture info is filled from the decoder
diff --git a/docs/dev/debt/libSceVenc.md b/docs/dev/debt/libSceVenc.md
new file mode 100644
index 0000000000..92c6460425
--- /dev/null
+++ b/docs/dev/debt/libSceVenc.md
@@ -0,0 +1,5 @@
+# libSceVenc technical debt
+
+### Unknown function info
+
+- [sceVencCreateEncoder, sceVencDeleteEncoder, sceVencGetConfig, sceVencMapMemory, sceVencQueryHeader, sceVencQueryMemorySize, sceVencQueryPreset, sceVencSetConfig, sceVencSetDecodedFrame, sceVencSetPictureConfig, sceVencSetRateControlConfig, sceVencSetReferenceFrameInvalidationConfig, sceVencStartEncode and sceVencStopEncode](../../../core/libs/prx/libSceVenc/Export.cpp) (libSceVenc) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVenc.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
diff --git a/docs/dev/debt/libSceVideoOut.md b/docs/dev/debt/libSceVideoOut.md
index 56dce0b93f..48a3bade68 100644
--- a/docs/dev/debt/libSceVideoOut.md
+++ b/docs/dev/debt/libSceVideoOut.md
@@ -12,16 +12,18 @@
 - [sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_, sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_, sceVideoOutAdjustColorSpaceConversion_, sceVideoOutSetGlobalBlendSpace](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - PPSA30630 imports these to configure color space conversion and global blend space. Color space conversion settings are accepted with size validation (32 bytes) but conversion blocks and blend space parameters are not applied to the presentation swapchain
 - [sceVideoOutDeleteVrrActiveStatusEvent](../../../core/libs/prx/libSceVideoOut/src/Event.cpp) (libSceVideoOut, NID `-q-vbO859Tw`) - the name hashes to the NID PPSA02530 imports and is listed in [sce_symbols](https://github.com/zecoxao/sce_symbols) `aerolib.csv` at `fe2cc2948e`. The signature `(eq, handle)` and the behaviour, removing the handle's VRR status registration from the queue as the other `Delete*Event` calls do, follow sceVideoOutAddVrrActiveStatusEvent; no title has been observed calling it
 - [sceVideoOutCursorEnable, sceVideoOutCursorDisable, sceVideoOutCursorSetImageAddress, sceVideoOutCursorSetPosition](../../../core/libs/prx/libSceVideoOut/Unimplemented.cpp) (libSceVideoOut, NIDs `UPZWCH8qTM4`, `fEPEwROdCwM`, `u-9bhWQApq8`, `N17AK88NdD0`) - the names hash to the NIDs Prospero Win (PPSA99995) imports, and the parameter lists `(handle, index, address)`, `(handle, index)`, `(handle, index, address)` and `(handle, index, x, y)` follow its [declarations](https://github.com/mpereiraesaa/prospero-win/blob/644e32e400c555e340d507383398c5d21b39b0b0/wine/ps5/pw_vulkan_radv.c#L65-L68). The cursor image's format and size and the console's return values are not known; the functions report that they are not implemented.
-- [sceVideoOutGetOutputStatusWithVrr](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut, NID `gWT7X8H0bYs`) - `(int handle, void* status)`, the 80-byte layout and the return codes follow the clean-room description in #2746. Bytes 0-47 are `sceVideoOutGetOutputStatus`'s; bytes 48-53, which the console copies from an internal query whose fields are not established, are written as zero, as are the rest, so the 16-bit value at byte 52 never adjusts `refreshRate`. A null `status` returns `0x80290002` and an unknown handle `0x8029000B`. The console's earlier global-flag check (`0x8029001C`) and its object-field check (`0x8029001B`) test states that are not modelled and are never reported.
+- [sceVideoOutGetOutputStatusWithVrr](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut, NID `gWT7X8H0bYs`) - bytes 48-53 are written as zero, where a PS5 (firmware 13.40, measured 2026-10-19 inside a retail title) with a 4K TV that takes 120 Hz returned the 16-bit values 48, 60 and 60 (0x30, 0x3C, 0x3C); their meaning is not established, so the value at byte 52 never adjusts `refreshRate`. `(int handle, void* status)`, the 80-byte layout and the return codes follow the clean-room description in #2746: bytes 0-47 are `sceVideoOutGetOutputStatus`'s and the rest 0, a null `status` returns `0x80290002` and an unknown handle `0x8029000B`, all as that console answered. The console's earlier global-flag check (`0x8029001C`) and its object-field check (`0x8029001B`) test states that are not modelled and are never reported.
 - [sceVideoOutRegisterBuffers2](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) (libSceVideoOut) - buffer option 8 (STRICT_COLORIMETRY) is presented as option 0, with the stored values unchanged; what the console changes for it is unknown. Only options 0 and 8 are accepted
 - [sceVideoOutAddBufferAttributeOption](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) (libSceVideoOut, NID `MBlv8YWoyOk`) - the signature `(VideoOutBufferAttribute2*, uint64_t option)` comes from [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/60977b29103452b9681ae10c7a9011d44965bf16/src/SharpProspero/Interop/VideoOut/VideoOut.cs#L174-L176) and the call site in PPSA25380, which passes 0x20 and ignores the result. The option is ORed into `attribute->option`; whether the console validates the bits, keeps them elsewhere or fails on an unknown option is unknown. A null attribute throws. Option 0x20 makes `sceVideoOutRegisterBuffers2` throw, as every option other than 0 and 8; what it selects for an overlay buffer is unknown
 - [sceVideoOutRegisterBuffers2](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) (libSceVideoOut) - DCC buffers (category 1): `dcc_control` is taken as the CB_DCC_CONTROL block layout, only bits 0x10026c are accepted; `dcc_cb_register_clear_color` as the register-clear texel, only 32-bit values are presented
-- [sceVideoOutIsOutputSupported](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - mode 1 is supported; mode 15 is supported when the current host display runs at 120 Hz or above. Configuring mode 15 requires attribute3 bit 0x40; this single-bit mask is inferred from the measured full value 0x80040, not isolated by a console measurement. Vblanks run at 119.88 Hz until mode 1 restores 59.94 Hz. Display modes are read through SDL; a move to a slower display falls back the configured output mode to mode 1, fires the output-mode event and continues at 59.94 Hz. The console's exact fallback behaviour when a 120 Hz display is lost has not been measured; this fallback avoids the abort in #7877 and matches the HDMI output mode renegotiation that a display change requires. Selecting another host display mode and VRR are not implemented. The console answers per display and per title: with a 120 Hz TV it also answers 1 for mode 15 (119.88 Hz), and [PS5_Vulkan](https://github.com/mihawk-99/PS5_Vulkan/blob/5b5e4fc2d80fdb67a4f61ba9e6a8a424026bb8a5/docs/HARDWARE_FINDINGS.md) measured that `sceVideoOutConfigureOutput` accepts 15 only from a title whose param.json declares high-frame-rate output (attribute3 0x80040). Modes 4, 7, 8, 12-14, 16-17 and 19 return `VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE` here, as they did on the measured display. Mode 18 throws, because one console answered 0x80290016 and another 0x8029001E. The name `VIDEO_OUT_ERROR_UNKNOWN_OUTPUT_MODE` for 0x8029001E is ours. Word 3 of the output options is accepted with any value, as on the console, and its meaning is unknown. PPSA12544 probes `0xd000000a`, which the console answers with 0x8029001E, so the title selects 3840 pixels; PPSA26344 at `0xCD0946` passes `(handle, 0xf, nullptr, nullptr, 0)` and branches on the result equalling 1
-- [sceVideoOutGetResolutionStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the 48-byte layout follows the declarations in ps5-opengl and EVO-PLAYER-PS5 (#1578), which agree; not confirmed on a console. `screenSizeInInch` is 0, the value EDID uses for an undefined size, since the host display's size is not read; `flags` is 0, its bits are unknown. The pane equals the full size because `sceVideoOutSetWindowModeMargins` applies no margins
+- [sceVideoOutIsOutputSupported](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - mode 1 is supported; mode 15 is supported when the current host display runs at 120 Hz or above. Configuring mode 15 requires attribute3 bit 0x40; this single-bit mask is inferred from the measured full value 0x80040, not isolated by a console measurement. Vblanks run at 119.88 Hz until mode 1 restores 59.94 Hz. Display modes are read through SDL; a move to a slower display falls back the configured output mode to mode 1, fires the output-mode event and continues at 59.94 Hz. The console's exact fallback behaviour when a 120 Hz display is lost has not been measured; this fallback avoids the abort in #7877 and matches the HDMI output mode renegotiation that a display change requires. Selecting another host display mode and VRR are not implemented. The console answers per display and per title: with a 120 Hz TV it also answers 1 for mode 15 (119.88 Hz), and [PS5_Vulkan](https://github.com/mihawk-99/PS5_Vulkan/blob/5b5e4fc2d80fdb67a4f61ba9e6a8a424026bb8a5/docs/HARDWARE_FINDINGS.md) measured that `sceVideoOutConfigureOutput` accepts 15 only from a title whose param.json declares high-frame-rate output (attribute3 0x80040). Modes 4, 7, 8, 12-14, 16-17 and 19 return `VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE` here, as they did on the measured display. Mode 18 throws, because one console answered 0x80290016 and two others 0x8029001E, the last a PS5 on 13.40 with a 120 Hz TV (measured 2026-10-19 inside a retail title), whose answers for every other mode match the ones here. The name `VIDEO_OUT_ERROR_UNKNOWN_OUTPUT_MODE` for 0x8029001E is ours. Word 3 of the output options is accepted with any value, as on the console, and its meaning is unknown. PPSA12544 probes `0xd000000a`, which the console answers with 0x8029001E, so the title selects 3840 pixels; PPSA26344 at `0xCD0946` passes `(handle, 0xf, nullptr, nullptr, 0)` and branches on the result equalling 1
+- [sceVideoOutGetResolutionStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - `screenSizeInInch` is 0, the value EDID uses for an undefined size, since the host display's size is not read; a PS5 (firmware 13.40, measured 2026-10-19 inside a retail title) reported its TV's 60.0f. The 48-byte layout, from the declarations in ps5-opengl and EVO-PLAYER-PS5 (#1578), is confirmed there: full size and pane 3840 x 2160, `refreshRate` 3, `flags` 0 and the rest 0 on the title's handle, 0x8029000B for handles 0 to 8. `flags` is 0 here too; its bits are unknown. The pane equals the full size because `sceVideoOutSetWindowModeMargins` applies no margins
+- [sceVideoOutGetOutputStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the status after a buffer is registered, a 1440p output and a display below 4K with the console's resolution on Automatic were not measured. A payload process on a PS5 (firmware 12.70) with no buffer registered reported `resolution` 2 right after `sceVideoOutOpen(0xff, 0, 0, NULL)` with the console's resolution on Automatic on a 4K display and 1 with it set to 1080p, and `dynamicRange` 2 with `flags` 0 on an HDR display with HDR on, while this code sets flag bit 0 whenever it reports dynamic range 2. `resolution` is 2 when the current display mode SDL reports for the window's display is at least 3840 pixels wide or 2160 high and 1 otherwise, read with the refresh rate and independent of the registered buffers; on Wayland SDL's mode is the output's logical size (from SDL's source, not run), so a scaled 3840x2160 output reports 1. `APS5_OUTPUT_RESOLUTION` replaces that size
 - [sceVideoOutOpen](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the open param's first word is unknown (PPSA21564 passes 16; it is not the byte size, since the affinity mask is at offset 16); only 16 is accepted. PPSA26344's only call at `0xCCF5EA` passes `(0xFF, 0, 0, nullptr)`. Whether a non-null param continues past offset 24 is also unknown
-- [sceVideoOutGetBufferLabelAddress](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) exposes a port-owned contiguous array of 16 aligned 64-bit labels and returns its count. Astro Bot PPSA21564's bundled AGC driver passes a pointer output and addresses each label at `base + index * 8`. The count, zero initialization on registration, and release of the previous displayed buffer when its replacement completes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/23c41333822fe8eca4c609b43119180af63ae4ac/src/core/libraries/videoout/video_out.cpp) and its driver; PS5 console equivalence has not been measured. Labels live until the port closes, and reopening creates a new array. Error precedence follows the reference for null output and the existing open-port policy for handles. Exact scanout release timing, repeated same-buffer flips and concurrent guest label stores remain unverified. EOP-flip registration and interrupt tokens remain unimplemented; exposing these labels does not implement that separate API.
+- [sceVideoOutGetBufferLabelAddress](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) exposes a port-owned contiguous array of 16 aligned 64-bit labels and returns its count. Astro Bot PPSA21564's bundled AGC driver passes a pointer output and addresses each label at `base + index * 8`. The count, zero initialization on registration, and release of the previous displayed buffer when its replacement completes follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/23c41333822fe8eca4c609b43119180af63ae4ac/src/core/libraries/videoout/video_out.cpp) and its driver; PS5 console equivalence has not been measured. Labels live until the port closes, and reopening creates a new array. Error precedence follows the reference for null output and the existing open-port policy for handles. Exact scanout release timing, repeated same-buffer flips and concurrent guest label stores remain unverified. EOP-flip registration and interrupt tokens are the separate `sceVideoOutSubmitEopFlip` API.
 - [GPU flips](../../../core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp) (libSceVideoOut) - a command-buffer flip of a buffer index with no registered buffer when the GPU reaches it presents black and completes like any flip (flip event, count, `flipPendingNum`). The console's behaviour is unknown; PPSA05684 requires that it completes: its renderer submits a flip of buffer 0 while another thread waits for `sceVideoOutIsFlipPending` to reach 0 before registering the buffers, and `flipPendingNum` counts that flip from its submission as in shadPS4
 - [sceVideoOutSubmitFlip](../../../core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp) (libSceVideoOut, libSceAgcDriver) - in the [AGC driver](../../../core/libs/prx/libSceAgcDriver/Execution/src/Driver/Queues/Submission.cpp), a CPU flip waits for the graphics-queue submissions ahead of it when the calling thread has submitted graphics-queue work itself: a title that submits a frame and flips it without waiting relies on that order, since emulated GPU work finishes later than the console's. A flip from a thread that has never submitted graphics-queue work is presented without waiting for queued submissions, unless a command-buffer or EOP flip ahead of it has not been reached. Such a thread can only know its frame is finished by waiting for it, as the PS5 RADV WSI's flip thread waits on the frame's fence. Whether the console ever orders a CPU flip behind the graphics queue is not measured; `APS5_CPU_FLIP_IN_ORDER=1` orders every CPU flip
+- [sceVideoOutGetVblankStatus](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - the third 64-bit word of the PS5 status (`reserved` in [SceTypes.hpp](../../../core/libs/SceTypes.hpp)) is written 0. On a PS5 (firmware 13.40, measured 2026-10-19) a retail title's own call, caught inside it, got count 0xb16b, `processTime` 0x381a8790 (941 s), third word 0x1c485ffaadc, `processTimeCounter` 0x15dd63c364b, flags 0x04 and phase 0: the third word is a running counter, about 970 s at ~2 GHz, consistent with a TSC, not zero. Its clock and what it counts from are not established. Closes when: the third word's source is measured and written
 - [sceVideoOutAddPreVblankStartEvent](../../../core/libs/prx/libSceVideoOut/src/Event.cpp) (libSceVideoOut) - how long before the vblank the console signals pre-vblank start is unknown. The event is triggered on each emulated vblank tick immediately before the vblank event, with its own count as the event data
 - [sceVideoOutRegisterBuffers, sceVideoOutGetFlipStatus, sceVideoOutGetVblankStatus](../../../core/libs/prx/libSceVideoOut/src/Buffer.cpp) (libSceVideoOut) - PS4 callers. A handle is treated as PS4 once buffers are registered through the PS4 `sceVideoOutRegisterBuffers`; from then on its flip and vblank status are written in the PS4 64- and 32-byte layouts, with `tsc` and `submitTsc` 0. A PS4 title that reads a status before it registers buffers gets the larger PS5 layout. The PS4 function accepts only linear A8R8G8B8_SRGB (0x80000000) and A8B8G8R8_SRGB (0x80002200) buffers without options; tiled PS4 buffers throw, as their layout differs from the PS5 tiling. Linear PS4 buffers may be 4 KiB aligned: the OpenOrbis graphics sample registers its second 1920x1080 buffer 8,294,400 bytes after the first. The PS4 alignment rule is not known
 
diff --git a/docs/dev/debt/libSceVideodec.md b/docs/dev/debt/libSceVideodec.md
index c24087ab78..8abac004cf 100644
--- a/docs/dev/debt/libSceVideodec.md
+++ b/docs/dev/debt/libSceVideodec.md
@@ -2,14 +2,14 @@
 
 ### Unknown function info
 
-- [sceVideodecCreateDecoder, sceVideodecDecode, sceVideodecDeleteDecoder, sceVideodecFlush and sceVideodecReset](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - the structure layouts and the error codes follow [shadPS4's PS4 library](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/videodec/videodec.h) and its [implementation](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/videodec/videodec.cpp), not measured on a PS5: the console's error for a rejected argument and its own version of the structures are unknown. The decoder runs through libSceVideodec2, which decodes H.264 with FFmpeg, and the picture is copied into the caller's frame buffer with the pitch aligned to 64 and the coded height, as the reference writes it
-
-- [libSceVideodec](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - the module's other two exports, `sceVideodecMapMemory` and `sceVideodecQueryResourceInfo`, are not provided, so a title that imports them fails to start
+- [sceVideodecCreateDecoder, sceVideodecDecode, sceVideodecDeleteDecoder, sceVideodecFlush, sceVideodecQueryResourceInfo and sceVideodecReset](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - the structure layouts and the error codes follow [shadPS4's PS4 library](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/videodec/videodec.h) and its [implementation](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/videodec/videodec.cpp), not measured on a PS5: the console's error for a rejected argument and its own version of the structures are unknown. The decoder runs through libSceVideodec2, which decodes H.264 with FFmpeg, and the picture is copied into the caller's frame buffer with the pitch aligned to 64 and the coded height, as the reference writes it
 
 ### Functional
 
 - [sceVideodecCreateDecoder](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - the codec type is not checked and the decoder always decodes H.264, as the PS4 library does; the console's codec ids are not documented. A configuration without a maximum frame size is refused with the configuration error, and the resource information the caller passes is not used
 
+- [sceVideodecQueryResourceInfo](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - the sizes it reports are libSceVideodec2's, not the console's: the CPU memory, CPU-GPU memory and frame buffer sizes and the frame buffer alignment that `sceVideodec2QueryDecoderMemoryInfo` gives for the configuration mapped as `sceVideodecCreateDecoder` maps it. The GPU memory size that query also gives has no field in this structure and is dropped. The memory pointers and `thisSize` are left as the caller passed them, where [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c2814041e546bf75c12756dbec9da911c721ce1c/src/core/libraries/videodec/videodec.cpp#L137-L187) clears the pointers; what the console writes there is not known. A larger structure is accepted, as by the module's other exports, where shadPS4 requires the exact size, and a configuration without a maximum frame size is refused with the configuration error, where shadPS4 assumes 1920x1080 or 3840x2160
+
 - [sceVideodecDecode and sceVideodecFlush](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - the picture information's video usability information (the tick rate, the sample aspect ratio and the colour description) stays zero, as the decoder does not report it, and the crop offsets are the decoded picture's crop halved, the unit the H.264 offsets use. The frame buffer holds the coded picture the decoder reports, so the rows the crop covers are in it and the caller crops them
 
-- [sceVideodecMapMemory and sceVideodecQueryResourceInfo](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - their names are listed in the PS5 3.20 export table and cross-checked against PS5 13.60. Their signatures and behaviour are unverified; these no-parameter declarations only resolve imports and throw through NotImplemented_nid_no_patch.
+- [sceVideodecMapMemory](../../../core/libs/prx/libSceVideodec/Export.cpp) (libSceVideodec) - its name is listed in the PS5 3.20 export table and cross-checked against PS5 13.60. Its signature and behaviour are unverified; this no-parameter declaration only resolves the import and throws through NotImplemented_nid_no_patch.
diff --git a/docs/dev/debt/libSceVideodec2.md b/docs/dev/debt/libSceVideodec2.md
index 411c4b2885..74a8f81c0f 100644
--- a/docs/dev/debt/libSceVideodec2.md
+++ b/docs/dev/debt/libSceVideodec2.md
@@ -2,6 +2,7 @@
 
 ### Unknown function info
 
+- [sceVideodec2InitLibrary](../../../core/libs/prx/libSceVideodec2/Unimplemented.cpp) (libSceVideodec2) throws: the FFmpeg decoders this module creates need no library-level initialisation, and neither SharpProspero nor EVO-PLAYER-PS5 declares this call, so its arguments and result are unknown. A title imports it from this module
 - [sceVideodec2GetAvcPictureInfo](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) - runs the `sceVideodec2GetPictureInfo` body (KytyPS5 binds both NIDs to one function; SharpProspero gives both the same `outputInfo, first, second` signature); the second (bottom field) picture info is never written, since only progressive H.264 output is modelled. prosper calls the AVC layout unestablished (no title observed calling it)
 
 - [sceVideodec2TermLibrary and twelve other exports](../../../core/libs/prx/libSceVideodec2/Unimplemented.cpp) (libSceVideodec2) - report that they are not implemented; what they do on the console is not known. The others are `QueryLibraryInfo`, `QueryDecoderInfo`, `MapMemory`, `MapDirectMemory`, `PresetDecoderConfigInfo` (plain, `Avc`, `Hevc`, `Vp9`), `CreateDecoderBid`, `CreateHevcDecoder`, `QueryHevcDecoderMemoryInfo` and `GetHevcPictureInfo`. They are exported so that a title which imports them with `sceVideodec2InitLibrary` and calls none of them directly loads. Only `sceVideodec2MapDirectMemory` has a known parameter list, `(decoder, memory)`, from [EVO-PLAYER-PS5's `sce_videodec2.h`](https://github.com/sainsaji/EVO-PLAYER-PS5/blob/9715f6ee9bf9b53461d6fdf9a2e11b4c48357783/projects/evoplayer/media/include/sce/sce_videodec2.h#L173); the others take none here
@@ -13,6 +14,6 @@
 - [sceVideodec2CreateDecoder](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) decodes HEVC (codec type 974921) and VP9 (2382845) through FFmpeg, besides H.264. The tags come from SharpProspero's `Videodec2CodecType` and EVO-PLAYER-PS5's `sce_videodec2.h`, which records them from hardware runs. HEVC input is converted from length-prefixed NAL units to Annex B as for H.264, and VP9 frames are passed through. Output is NV12 for 8-bit pictures. A 10-bit picture is written as 16-bit little-endian words with the sample in the low 10 bits, Y rows then interleaved UV rows at `framePitchInBytes` times the picture height, with `framePitch` in samples and `framePitchInBytes` in bytes (twice the width, aligned to 256), and `QueryDecoderMemoryInfo` sizes a frame of an HEVC or VP9 profile 2 configuration with two bytes per sample. Evidence is from [EVO-PLAYER-PS5](https://github.com/sainsaji/EVO-PLAYER-PS5/tree/9715f6ee9bf9b53461d6fdf9a2e11b4c48357783), which decodes and presents 1080p HEVC Main10 on hardware through this path (`docs/evo-pro/on-demand-decoder-handoff.md`): it takes a picture as 10-bit when `pitch_bytes >= pitch * 2`, puts UV at `pitch_bytes` times the height and samples with a low-bit factor (`projects/evoplayer/media/src/evo_vdec_native.c`, `ro_harvest`), and its hardware logs give 6128 KB and 24496 KB frame buffers for 1920x1088 and 3840x2176 Main10 decoders after rounding to 16 KiB. The 1080p size is what this formula gives; at 3840x2176 it gives 16 KiB less, so the console's size there has another term that is not known. Unverified: `frameFormat` (still 0; no consumer found reads it), VP9 profile 2 output (no hardware evidence), and the layout of 12-bit pictures and of decoded formats other than yuv420p10le, which throw. `sceVideodec2GetPictureInfo` and `sceVideodec2GetAvcPictureInfo` throw for HEVC pictures (`SceVideodec2HevcPictureInfo` is not filled), and `sceVideodec2GetHevcPictureInfo` reports that it is not implemented
 
 - [sceVideodec2GetVp9PictureInfo](../../../core/libs/prx/libSceVideodec2/Export.cpp) uses the 88-byte layout and two-pointer signature from [SharpProspero Videodec2.cs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/Videodec2.cs). Frame metadata follows the [VP9 specification](https://storage.googleapis.com/downloads.webmproject.org/docs/vp9/vp9-bitstream-specification-v0.7-20170222-draft.pdf), sections 5.26 and 6.2: profile, key/intra-only flags, bit depth, color space/range, coded/render dimensions and superframe count are retained per emitted buffer. Level is 0 because the elementary stream does not signal a level; the console value is unverified. Null pointers, undersized structures and querying another codec throw; console error codes and support for other structure sizes are unknown. Pictures deeper than 10 bits are rejected. Superframes are submitted as individual coded frames to keep each output associated with its input metadata. `sceVideodec2GetPictureInfo` writes this layout for a VP9 picture, as shadPS4's `videodec2.cpp` writes the decoder's own layout; Mortal Shell 2 (PPSA34008) calls it with `thisSize` 88.
-- [sceVideodec2Decode after sceVideodec2Flush](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) without `sceVideodec2Reset` restarts FFmpeg's decoder (`avcodec_flush_buffers`) and decodes the unit, where it threw before. TEKKEN DARK RESURRECTION (PPSA31371), which runs in Sony's PSP emulator, decodes after a flush without a reset (#7118), so the console accepts the call. Pictures the flush decoded but has not returned yet are returned before the new ones. What the console returns for them, and for a stream that continues across the flush without a new IDR picture, is not measured.
+- [sceVideodec2Decode after sceVideodec2Flush](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) without `sceVideodec2Reset` restarts FFmpeg's decoder (`avcodec_flush_buffers`) and decodes the unit, where it threw before. TEKKEN DARK RESURRECTION (PPSA31371), which runs in Sony's PSP emulator, decodes after a flush without a reset (#7118), so the console accepts the call. Pictures the flush decoded but has not returned yet are returned before the new ones. A flush with no picture pending (each decoded unit has returned its picture) leaves the decoder and its reference pictures as they are, so a stream that continues without a new IDR picture keeps decoding: Daxter (PPSA09695), also in the PSP emulator, flushes after every access unit of its H.264 movies, and restarting the decoder there lost every P picture until the next keyframe. What the console returns for pending pictures, and for a stream that continues across a flush that had pictures pending, is not measured.
 - [sceVideodec2Decode](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) and `sceVideodec2Flush` output the coded picture, with the chroma plane after its luma rows, as the console does for 1080p H.264 and HEVC streams coded at 1920x1088. An HEVC or VP9 picture whose size is not a multiple of 16, such as HEVC coded at 1920x1080, is output at that size; whether the console pads it is unverified. `sceVideodec2GetPictureInfo` reports no frame cropping
 - [sceVideodec2Decode of an empty access unit](../../../core/libs/prx/libSceVideodec2/Export.cpp) (libSceVideodec2) returns `0x811D010E` for a null `auData` and `0x811D010D` for an `auSize` of 0, with no picture, where it threw before. The values are `ACCESS_UNIT_POINTER` and `ACCESS_UNIT_SIZE` in the error table of [shadPS4's videodec_error.h](https://github.com/shadps4-emu/shadPS4/blob/f3f0c14c1350a768558dfd1fd058d259ccecaca2/src/core/libraries/videodec/videodec_error.h), whose libSceVdecsw codes this repository already uses; they are not measured on a PS5, and neither is whether the console leaves the decoder's state alone on that call, as this does. Media Player Classic PS5 (PPSA99015) submits empty units: its own converter reads a 4-byte length prefix of `00 00 01 xx` as a start code and drops the rest as a non-base HEVC layer. It goes on after the error.
diff --git a/docs/dev/debt/libSceVoice.md b/docs/dev/debt/libSceVoice.md
index 9e8d8fc46e..3dcdeae2a9 100644
--- a/docs/dev/debt/libSceVoice.md
+++ b/docs/dev/debt/libSceVoice.md
@@ -8,19 +8,16 @@
 ### Unknown function info
 
 - [sceVoiceInit, sceVoiceStart, sceVoiceCreatePort, sceVoiceGetPortInfo](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - a second `sceVoiceInit` returns 0x804E0802, and Start, CreatePort and GetPortInfo return 0x804E0801 before checking any argument while the library is not initialized, as [prosper](https://github.com/mattias800/prosper/blob/ed42e499888d5a86792c3e1b2df3aebd8ca1a681/prosper/src/hle/audio/hle_audio.cpp#L4697-L4713) reads them from the shipped module. The other port and lifecycle calls still throw when the library is not initialized, since prosper gives no module address for them. Whether `sceVoiceInit` checks a null param before its state is unknown, so a null param still throws first, and that `sceVoiceEnd` returns the library to the not-initialized state is assumed. Closes when: the other entry points are read from the module or measured on a PS5
+- [sceVoiceInitHQ, sceVoiceVADSetVersion](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - not measured on a PS5: the signatures and rules follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/voice/voice.cpp). `sceVoiceInitHQ` runs `sceVoiceInit`, as shadPS4's two share one path. `sceVoiceVADSetVersion` accepts versions 0 and 1 and returns `0x804E0805` for any other; nothing uses the version, as no voice activity detection runs
 - [sceVoicePausePortAll, sceVoiceResumePortAll](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - not measured on a PS5: both return 0x804E0801 while the library is not initialized and 0 otherwise, as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c1b26558352b863f80142256e4df38585aa7d727/src/core/libraries/voice/voice.cpp#L356-L437); prosper reads the same code for `sceVoiceStart`, and the PS3 calls in [RPCS3](https://github.com/RPCS3/rpcs3/blob/be69c054eeac57e2e671697a463473d37fe5a7b2/rpcs3/Emu/Cell/Modules/cellVoice.cpp#L462-L543) make the same check. Like `sceVoicePausePort` they change nothing that is reported: [VitaSDK](https://github.com/vitasdk/vita-headers/blob/ae5808f3105c42fa3373ba4ab64ab54e2e3ca848/include/psp2/voice.h#L540-L557) documents that pausing every port keeps the buffered data and the reported state, and nothing here processes port data
-- [sceVoiceInitHQ](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceGetMemorySize](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceDeviceInCustomerData](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceQAEnableRecording](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceVADAdjustment](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
 - [sceVoiceVADPVTAdjustment](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
-- [sceVoiceVADSetVersion](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
-- [sceVoiceSetMuteFlagAll](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
-- [sceVoiceSetBitRate](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
-- [sceVoiceUpdatePort](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - unknown signature
+- [sceVoiceSetMuteFlagAll, sceVoiceSetBitRate, sceVoiceUpdatePort](../../../core/libs/prx/libSceVoice/Export.cpp) (libSceVoice) - not measured on a PS5; signatures follow [Orbital](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json), behaviour the Vita's [VitaSDK](https://github.com/vitasdk/vita-headers/blob/ae5808f3105c42fa3373ba4ab64ab54e2e3ca848/include/psp2/voice.h#L250-L557). They return the not-initialized, port-range and missing-port codes the other port calls return. The mute-all flag makes `sceVoiceGetMuteFlag` report every port muted without changing port flags. A non-voice port, a bitrate `sceVoiceCreatePort` rejects, a null param or a different port type throw, since the console's codes for them are unknown
 - [sceVoiceGetPortAttr](../../../core/libs/prx/libSceVoice/Export.cpp): native initialization, port-range, pointer, attribute-size and port-type validation is implemented. Supported device attributes throw because the host has no device state or voice-activity processing. The former constant-zero voice-activity fallback is removed; failed calls leave output untouched.
 
-- [sceVoiceSetThreadsParams](../../../core/libs/prx/libSceVoice/Export.cpp): the 48-byte mode/priority/affinity layout and initialization, null, started-state and mode validation are recovered. Mode 1 throws because worker scheduling is not implemented; mode 0 is the native no-op. The 32-byte event callback union is recovered, but callback delivery and device-state byte semantics remain unimplemented.
+- [sceVoiceSetThreadsParams](../../../core/libs/prx/libSceVoice/Export.cpp): the priorities and affinity masks that mode 1 sets reach no host scheduling, because no voice worker threads run (see sceVoiceStart below). Mode 1 returns 0 for priorities 256-767 with non-zero masks within 0x1fff, the values a PS5 thread takes; the native result for other values is unverified, so they throw. The 32-byte event callback union is recovered, but callback delivery and device-state byte semantics remain unimplemented.
 
 - [sceVoiceStart, sceVoiceStop and sceVoiceEnd](../../../core/libs/prx/libSceVoice/Export.cpp) validate initialization, container presence and native mode-dependent memory sizes, but do not partition guest working memory or run the audio workers. Start/stop currently change software state only; backend failures and active-stream shutdown are not reproduced.
diff --git a/docs/dev/debt/libSceVorbisDec.md b/docs/dev/debt/libSceVorbisDec.md
index f0c2ddc877..45ad9e2d0e 100644
--- a/docs/dev/debt/libSceVorbisDec.md
+++ b/docs/dev/debt/libSceVorbisDec.md
@@ -2,37 +2,13 @@
 
 ### Unknown function info
 
-- [sceVorbisDecBitrate](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecBitrateInstant](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecClear](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecComment](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecCrossLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
+- [sceVorbisDecOpenCallbacks, sceVorbisDecRead and the other libvorbisfile exports](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - the 31 exports named after libvorbisfile functions are taken to be the libvorbisfile API with a `sceVorbisDec` prefix (`Read` is `ov_read`, `CrossLap` is `ov_crosslap`, `HalfrateP` is `ov_halfrate_p`). `ReadFilter`, `ReadFloat` and `Halfrate` exist in libvorbis (`ov_read_filter` since 1.2.2, with the same `vorbisfile.h` signatures through 1.3.7 apart from `const`) but not in Tremor, so times are `double` and `ov_read` takes `bigendianp`, `word` and `sgned`. Guest `long` arguments and results are 64-bit. They run the bundled libvorbis 1.3.7 and libogg 1.3.6; the console's libvorbis version, any Sony changes to its behaviour or error codes, and the signatures themselves are unverified on a PS5.
 - [sceVorbisDecGetDecodePriority](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
 - [sceVorbisDecGetLastDecodeError](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecHalfrate](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecHalfrateP](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecInfo](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecOpenCallbacks](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecPcmSeek](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecPcmSeekLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecPcmSeekPage](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecPcmSeekPageLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecPcmTell](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecPcmTotal](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecRawSeek](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecRawSeekLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecRawTell](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecRawTotal](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecRead](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecReadFilter](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecReadFloat](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecSeekable](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecSerialNumber](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
 - [sceVorbisDecSetDecodePriority](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecStreams](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecTimeSeek](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecTimeSeekLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecTimeSeekPage](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecTimeSeekPageLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecTimeTell](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
-- [sceVorbisDecTimeTotal](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - declared without parameters, signature unknown; name from the NID database
+
+### Functional
+
+- [libSceVorbisDec](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - the guest `OggVorbis_File` is never written: the decoder state lives on the host, keyed by the struct's address, so fields a title reads directly keep what it stored, and a struct never opened, cleared or failed to open behaves as libvorbisfile's zeroed struct. `sceVorbisDecInfo` returns a copy of each link's `vorbis_info` with 64-bit `long` fields, refreshed after every call on the struct and valid until `sceVorbisDecClear`. Reopening a struct that is still open frees its old state without calling its close callback; libvorbisfile leaks it.
+- [sceVorbisDecClear and sceVorbisDecCrossLap](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - a null `vf` throws, as libvorbisfile dereferences it, except that `sceVorbisDecClear` and `sceVorbisDecCrossLap` with the same pointer twice return 0, and `sceVorbisDecCrossLap` with a null second pointer after a first that is not open returns `OV_EINVAL`, as libvorbisfile does. `sceVorbisDecClear` frees the state before it calls the close callback, as `ov_clear` does, so when that callback throws the struct is already cleared, where libvorbisfile leaves it freed but not zeroed.
+- [sceVorbisDecOpenCallbacks and sceVorbisDecBitrate](../../../core/libs/prx/libSceVorbisDec/Export.cpp) (libSceVorbisDec) - on Windows the host `long` is 32-bit: a tell result outside it, or an initial byte count outside it with a non-null `initial`, throws; a sample rate of 2^31 Hz or more is rejected as a bad header; and `sceVorbisDecBitrate` rounds halves up instead of to even.
diff --git a/docs/dev/debt/libSceVrServiceDialog.md b/docs/dev/debt/libSceVrServiceDialog.md
index f6be543e6d..fe48267534 100644
--- a/docs/dev/debt/libSceVrServiceDialog.md
+++ b/docs/dev/debt/libSceVrServiceDialog.md
@@ -1,5 +1,5 @@
 # libSceVrServiceDialog technical debt
 
-### Unknown function info
+### Silent stubs
 
-- [sceVrServiceDialogClose, sceVrServiceDialogGetResult, sceVrServiceDialogGetStatus, sceVrServiceDialogInitialize, sceVrServiceDialogOpen, sceVrServiceDialogTerminate and sceVrServiceDialogUpdateStatus](../../../core/libs/prx/libSceVrServiceDialog/Export.cpp) (libSceVrServiceDialog) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrServiceDialog.c), but no credible prototypes were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [libSceVrServiceDialog](../../../core/libs/prx/libSceVrServiceDialog/Export.cpp) - the VR service dialog runs the common-dialog state machine but shows nothing and reports the user as having cancelled, as no headset is supported (see libSceHmd2). The signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); the result layout beyond the leading `int32_t` result code is not known, so nothing else is written.
diff --git a/docs/dev/debt/libSceVrTracker.md b/docs/dev/debt/libSceVrTracker.md
index 138b88a370..a3e50959cb 100644
--- a/docs/dev/debt/libSceVrTracker.md
+++ b/docs/dev/debt/libSceVrTracker.md
@@ -3,7 +3,11 @@
 ### Unknown function info
 
 - [VrTracker parameters](../../../core/libs/prx/libSceVrTracker/Export.cpp): argument slots are recovered. CPU processing and GPU waiting consume 32-byte records, result queries consume 56-byte records, and time queries write 64 bits. Initialization accepts 128-byte and 144-byte versions; the 144-byte layout includes three address/size/alignment records, but configuration selector semantics and the older field layout remain unresolved. GPU submission accepts 552-byte and 648-byte versions; submission and result records still require field recovery; result storage has 1520-byte and 3640-byte variants. Result-query records have a signed handle, 64-bit time, 32-bit selectors and an extended-result flag; selector meanings and the four-byte value copied unchanged to result offset 448 remain unresolved. CPU mode/argument semantics are unresolved. Protected bodies remain unchanged.
-- [sceVrTrackerCpuPopMarker, sceVrTrackerCpuPushMarker, sceVrTrackerGetLiveCaptureId, sceVrTrackerGpuWaitAndCpuProcess, sceVrTrackerResetAll, sceVrTrackerSaveInternalBuffers and sceVrTrackerSetDeviceRejection](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). No credible prototypes were found; these no-parameter declarations only resolve imports, make no ABI claim and must not be called until signatures are verified.
-- [sceVrTrackerSetExtendedMode, sceVrTrackerSetLEDBrightness, sceVrTrackerSetRestingMode, sceVrTrackerStartLiveCapture, sceVrTrackerStopLiveCapture and sceVrTrackerTerm](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). No credible prototypes were found; these no-parameter declarations only resolve imports, make no ABI claim and must not be called until signatures are verified.
-- [sceVrTrackerGetPlayAreaWarningInfo, sceVrTrackerNotifyEndOfCpuProcess, sceVrTrackerQueryMemory, sceVrTrackerRecalibrate, sceVrTrackerRegisterDevice and sceVrTrackerRegisterDevice2](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). Parameter shapes follow the [pinned shadPS4 declarations](https://github.com/shadps4-emu/shadPS4/blob/f9d07487dd85bb7dc522df6de109b8ad4b9b7175/src/core/libraries/vr_tracker/vr_tracker.h), not measured on a PS5.
-- [sceVrTrackerRegisterDeviceInternal, sceVrTrackerResetOrientationRelative, sceVrTrackerSetDurationUntilStatusNotTracking, sceVrTrackerUnregisterDevice and sceVrTrackerUpdateMotionSensorData](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). Parameter shapes follow the [pinned shadPS4 declarations](https://github.com/shadps4-emu/shadPS4/blob/f9d07487dd85bb7dc522df6de109b8ad4b9b7175/src/core/libraries/vr_tracker/vr_tracker.h), not measured on a PS5.
+- [sceVrTrackerCpuPopMarker, sceVrTrackerCpuPushMarker, sceVrTrackerGetLiveCaptureId, sceVrTrackerResetAll, sceVrTrackerSaveInternalBuffers and sceVrTrackerSetDeviceRejection](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). No credible prototypes were found; these no-parameter declarations only resolve imports, make no ABI claim and must not be called until signatures are verified.
+- [sceVrTrackerSetExtendedMode, sceVrTrackerSetLEDBrightness, sceVrTrackerSetRestingMode, sceVrTrackerStartLiveCapture and sceVrTrackerStopLiveCapture](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). No credible prototypes were found; these no-parameter declarations only resolve imports, make no ABI claim and must not be called until signatures are verified.
+- [sceVrTrackerGetPlayAreaWarningInfo and sceVrTrackerNotifyEndOfCpuProcess](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). Parameter shapes follow the [pinned shadPS4 declarations](https://github.com/shadps4-emu/shadPS4/blob/f9d07487dd85bb7dc522df6de109b8ad4b9b7175/src/core/libraries/vr_tracker/vr_tracker.h), not measured on a PS5.
+- [sceVrTrackerResetOrientationRelative and sceVrTrackerUpdateMotionSensorData](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - the list is the intersection of the export table of the console's libSceVrTracker (function symbols only), pinned aerolib names and functions not yet defined anywhere in the repo. [Inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceVrTracker.c); [aerolib](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv). Parameter shapes follow the [pinned shadPS4 declarations](https://github.com/shadps4-emu/shadPS4/blob/f9d07487dd85bb7dc522df6de109b8ad4b9b7175/src/core/libraries/vr_tracker/vr_tracker.h), not measured on a PS5.
+
+### Functional
+
+- [tracker lifecycle and devices](../../../core/libs/prx/libSceVrTracker/Export.cpp) (libSceVrTracker) - `sceVrTrackerQueryMemory`, `sceVrTrackerInit`, `sceVrTrackerTerm`, the three `sceVrTrackerRegisterDevice*` calls, `sceVrTrackerUnregisterDevice`, `sceVrTrackerRecalibrate`, `sceVrTrackerSetDurationUntilStatusNotTracking` and `sceVrTrackerGpuWaitAndCpuProcess` follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/vr_tracker/vr_tracker.cpp), a PS4 implementation: its struct layouts, memory sizes, argument checks, one handle per device type and `DEVICE_NOT_REGISTERED` for an HMD recalibration. Only the 128-byte init parameter is read; the 144-byte one throws. Unlike shadPS4, the init memory ranges are not looked up, a null init parameter and negative device types are refused. Terminating keeps the registered handles, as there. With no camera there is no GPU submission, so the GPU wait returns `NOT_EXECUTE_GPU_SUBMIT`. Not measured on a PS5
diff --git a/docs/dev/debt/libSceWebBrowserDialog.md b/docs/dev/debt/libSceWebBrowserDialog.md
index f86ba5ae8f..c057cc3710 100644
--- a/docs/dev/debt/libSceWebBrowserDialog.md
+++ b/docs/dev/debt/libSceWebBrowserDialog.md
@@ -3,6 +3,7 @@
 ### Silent stubs
 
 - [libSceWebBrowserDialog](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) - `sceWebBrowserDialogOpen` and `sceWebBrowserDialogOpenForPredeterminedContent` run the common-dialog state machine without displaying an interactive browser, and `sceWebBrowserDialogGetResult` reports that the user cancelled. Minecraft Bedrock (PPSA17221) imports `sceWebBrowserDialogOpenForPredeterminedContent` (#5744). The 424-byte allow-list parameter and its twenty optional address pointers are validated, but address filtering is not modelled without an interactive browser. Main open-parameter validation remains incomplete.
+- [sceWebBrowserDialogSetCookie, sceWebBrowserDialogResetCookie](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) (libSceWebBrowserDialog) - there is no browser cookie store. Both calls check their parameters in the same order and with the same codes as the PS5 12.00 module, then return 0 without storing or clearing anything. On the console they then forward the request to the browser service. While an opened dialog has not been updated to finished, closed or terminated, they return `0x80B80006` (the console's open-dialog flag).
 ### Unknown function info
 
 - [sceWebBrowserDialogGetEvent, sceWebBrowserDialogNavigate, sceWebBrowserDialogSetZoom](../../../core/libs/prx/libSceWebBrowserDialog/Export.cpp) (libSceWebBrowserDialog) - their names and NIDs are in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceWebBrowserDialog.c); the no-parameter prototypes follow [shadPS4 `webbrowserdialog.cpp`](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/web_browser_dialog/webbrowserdialog.cpp#L23-L85) and are not measured on a console. They are declared without parameters solely to resolve known imports; this is not an ABI claim, and every call throws.
diff --git a/docs/dev/debt/libSceZlib.md b/docs/dev/debt/libSceZlib.md
index 8cbfd2864e..85bd381724 100644
--- a/docs/dev/debt/libSceZlib.md
+++ b/docs/dev/debt/libSceZlib.md
@@ -2,4 +2,4 @@
 
 ### Functional
 
-- [libSceZlib](../../../core/libs/prx/libSceZlib/Export.cpp) decompresses synchronously and supports one outstanding request. Timed waits, multiple outstanding requests and repeated retrieval throw. Work-memory registration and driver-side destination alignment validation remain unsupported; non-null work memory and unaligned destinations throw. Native user-space validation confirms the 64-bit initialization length, 2 KiB output-length granularity up to 64 KiB, null-argument errors and initialization precedence. Finalization discards the host's completed result. Driver scheduling, completion consumption, cancellation, scratch-memory requirements and decompression error details remain unverified; host decoding maps malformed streams to 0x811200FF and exhausted output to 0x8112001C.
+- [libSceZlib](../../../core/libs/prx/libSceZlib/Export.cpp) is unverified on PS5 for several outstanding requests in submission order, repeated `sceZlibGetResult`, `0x81120002` for an unknown ID, `0x81120027` on timeout and results dropped by `sceZlibFinalize`: they follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/libraries/zlib/zlib.cpp) (PS4), and the microsecond timeout follows SharpProspero. `0x8112000B` (not ready) is never returned: requests finish at submission. A wait interrupted by `sceZlibFinalize`, non-null work memory and an unaligned destination throw. Native validation confirms the 64-bit initialization length, 2 KiB output granularity up to 64 KiB, null-argument errors and initialization precedence. Driver scheduling, cancellation and scratch memory are unverified; malformed streams map to `0x811200FF`, exhausted output to `0x8112001C`.
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index 5014c4dd6f..2d4e0fc01d 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -3,6 +3,7 @@
 ### Unknown function info
 
 - [strtonum](../../../core/libs/prx/libc/src/StringExtensions.cpp) (libc) is unverified on the console. Its signature, decimal parsing, inclusive bounds, error strings, error precedence and errno preservation follow [FreeBSD 11.4 strtonum.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/strtonum.c). Parsing uses the host `strtoll` with base 10.
+- [fegetexcept](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) has not been read from the PS5 library or measured on a console. It follows FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h#L121-L133), reporting the six unmasked x87 exceptions independently of MXCSR; whether the PS5 uses the same rule when the units disagree is unverified.
 
 - [sceLibcBacktraceGetBufferSize, sceLibcBacktraceSelf](../../../core/libs/prx/libc/src/Backtrace.cpp) (libc) - signatures and frame record layout inferred from a title (next pointer, u32 module offset, module name at +0x10); the u32 at +0xC is unknown and written as 0. Module names are host file names without the `.guest.prx` suffix, so their case may differ from the PS5 module name. On Windows, unwinding uses `_Unwind_Backtrace` and stops at a frame without `.ehmeta` or `.ehfram` tables whose PE unwind data has an exception or termination handler, leaving the trace empty or cut short while still returning 0. Implemented only on Linux and Windows; other platforms throw
 - [ApplicationGuestHeapApi](../../../core/libs/prx/libc/src/ApplicationProcessParameters.cpp) (libc) - on Linux, HLE application allocation uses a loaded guest SDK's ten allocator exports when the title's replacement table has an allocator entry and the exports belong to one native module. With an empty table it keeps the default heap, since a bundled `libc.prx` may export the allocator NIDs while forwarding them to HLE. Its CRT owns application allocator initialization and finalization; HLE retains the module until process exit. Partial or mixed providers throw. This avoids reinitializing an allocator already used by SDK startup; console behavior and other host platforms remain unverified.
@@ -15,36 +16,44 @@
 - [_Thrd_sleep](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `jfRI3snge3o`) follows the Dinkumware threads library shipped with [Visual C++ 2013](https://github.com/adityaramesh/concurrency_runtime/tree/master/VS2013_SP2/crt/src/thr) (`xtime.c`) and C11 Annex K, without console verification. It reads a 16-byte xtime (64-bit seconds and nanoseconds) on the guest `CLOCK_REALTIME`, normalizes the nanoseconds and sleeps through `nanosleep` on POSIX, retrying on `EINTR`, or high-resolution waitable timers on Windows; a null xtime or one whose normalization overflows throws. Guest thread cancellation is not integrated with this wait. The console's `_Thrd_sleep` (disassembled from a title's `libc.prx`) also takes an optional `xtime*` of remaining time and returns `int`; here the sleep is never cut short, so it returns 0 and leaves the remaining time untouched.
 - [_Mtx_init_with_name](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `tgioGpKtmbE`) forwards to `_Mtx_init` and ignores the mutex name parameter.
 - [_Cnd_timedwait](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `McaImWKXong`) follows the console's `_Cnd_timedwait` (disassembled from a title's `libc.prx`), where xtime is an absolute deadline converted against the current time: it returns `_Thrd_timedout` (2) on expiration and `_Thrd_success` (0) on notification. The console returns 4 for other internal pthread errors while this implementation throws.
-- [fegetround, fesetround, fetestexcept, feclearexcept, fegetexceptflag and fesetexceptflag](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) follow FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h): rounding modes use x87 control bits 10-11, exception flags include denormals (`0x3f`), and `fexcept_t` is 16 bits. They access the current host thread's x87 and MXCSR state. This console ABI is assumed, as for `fegetenv`, not measured on hardware. Null flag pointers throw instead of faulting.
+- [fegetround, fesetround, fetestexcept, feclearexcept, fegetexceptflag and fesetexceptflag](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libSceLibcInternal, implemented in libc) follow FreeBSD 11.4 amd64 [fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h): rounding modes use x87 control bits 10-11, exception flags include denormals (`0x3f`), and `fexcept_t` is 16 bits. They access the current host thread's x87 and MXCSR state. Under Rosetta 2 the six MXCSR exception masks always read back set, so an SSE exception the guest unmasks stays masked; the x87 masks and the other MXCSR bits are kept. This console ABI is assumed, as for `fegetenv`, not measured on hardware. Null flag pointers throw instead of faulting.
+- [feenableexcept, fedisableexcept, __feenableexcept, __fedisableexcept, fegettrapenable and fesettrapenable](../../../core/libs/prx/libc/src/FloatingPoint.cpp) (libc) change only the x87 masks under Rosetta 2: MXCSR keeps its six exception masks set there, so no SSE trap is enabled, and the enable and disable results, which report the traps enabled on both units, report none
 - [fegetenv](../../../core/libs/prx/libc/src/Math.cpp) (libSceLibcInternal, implemented in libc, NID `psx0YiAKm7k`) follows FreeBSD 11 amd64 [fenv.c](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/amd64/fenv.c) with the 32-byte `fenv_t` of [x86/fenv.h](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/x86/fenv.h): `fnstenv` fills the 28-byte x87 part, MXCSR follows at 0x1c, and the x87 control word is reloaded because `fnstenv` masks every x87 exception. That the console's `libSceLibcInternal` has the same code and layout is assumed, not read from its binary. A null pointer throws instead of faulting
-- [Guest arena](../../../core/libs/prx/libc/src/GuestArena.cpp) (libc) - the application map area is assumed to end at 0xFC_0000_0000, as `SCE_KERNEL_APP_MAP_AREA_END_ADDR` does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws
+- [feholdexcept](../../../core/libs/prx/libc/src/Math.cpp) (libSceLibcInternal, implemented in libc, NID `1kduKXMqx7k`) - console equivalence and module/library versions are unverified. The signature and 32-byte amd64 environment layout follow the public SDK [fenv.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/fenv.h); saving both units, masking exceptions and clearing pending flags follows FreeBSD 11 amd64 [fenv.c](https://github.com/freebsd/freebsd-src/blob/4554bee35405b36ea19e9e60d6abe6ea534e36e0/lib/msun/amd64/fenv.c). The NID comes from the public 3.20 stub inventory, not a module examined here. Null storage throws before modifying the environment, where the reference dereferences it
+- [feupdateenv](../../../core/libs/prx/libc/src/Math.cpp) (libSceLibcInternal, implemented in libc, NID `YXQ4gXamCrY`) follows FreeBSD 11.4 amd64 [fenv.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/msun/amd64/fenv.c): capture the old x87/MXCSR exception union (`0x3f`), restore the saved 32-byte environment, raise those flags in both units, then `fwait`. The console's layout, behavior and module versions are unmeasured; state belongs to the current host thread. A null input or MXCSR bits unsupported by the host's `FXSAVE` mask throw before changing floating-point state; the mask's architectural zero fallback is `0xffbf`. Console fault behavior for malformed environments is unknown. The separate `__fe_dfl_env` object remains unimplemented; no host `FE_DFL_ENV` sentinel is substituted.
+- [Guest arena](../../../core/libs/prx/libc/src/GuestArena.cpp) (libc) - the application map area is assumed to end at 0xFC_0000_0000, as `SCE_KERNEL_APP_MAP_AREA_END_ADDR` does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws. The console's low-address layout is not measured. Linux and Windows reserve free addresses from 64 KiB, except host mappings and low chunks the Linux address policy refuses; null hints still allocate from 8 GiB. macOS and ASan builds still start the arena at 8 GiB and cannot supply low 32-bit addresses. Guest thread creation ignores a stack address set in its attributes. A host-loaded executable is not moved, so a PIE above the arena gets no memory within 2 GiB of its code ([#5217](https://github.com/boykopovar/AnyPS5/issues/5217))
 - [sceLibcInternalBacktraceForGame](../../../core/libs/prx/libc/src/HeapDiagnostics.cpp) (libSceLibcInternal, implemented in libc) - `(const char* heapName)` and its return follow the `libc.prx` ASTRO BOT (PPSA21564 01.007.000) bundles: its four calls (0x6801, 0x7F46, 0xE75E, 0xEE02) are in the `malloc_stats` and `sceLibcMspaceMallocStats` paths, each after a `[%s] ...` line printed with the same heap name buffer, and the caller ignores the result and continues. The console's backtrace output is not reproduced: the heap name and the guest return address are written to the host standard error
-- [sceLibcInternalHeapErrorReportForGame](../../../core/libs/prx/libc/src/HeapDiagnostics.cpp) (libSceLibcInternal, implemented in libc) - `(void* heap, void* block, uint32 error)` follows the same `libc.prx` (call at 0xF634): it passes the heap, the block and the nonzero result of its block check, and then calls a function that never returns, so the report only has to return. The meaning of the error values is unknown; the three values and the guest return address are written to the host standard error
+- [sceLibcInternalHeapErrorReportForGame](../../../core/libs/prx/libc/src/HeapDiagnostics.cpp) (libSceLibcInternal, implemented in libc) - `(void* heap, void* block, uint32 error)` writes to the guest's standard output what a payload process on a PS5 (firmware 13.60) wrote: `[SceLibc] A heap error is detected.`, `[SceLibc] -- Mspace Name --`, then the C string at heap+0x3B0 followed by ` (%2u)` of the 32-bit value at heap+0x3F4 when it is not 0, the reason `segment out of range.` for error 1 only (38 other measured values print none), and `pid:<0x..> tid:<0x..>`, and returns. The pid and tid are the host's, where the console prints its own process and kernel thread ids. The block's contents did not change the console's output and it is not read here; the values and the guest return address also go to the host's standard error. A null heap faulted on the console and throws here. What the other heap fields and error values mean is unknown
 - [sceLibcPafMspaceCreate, Destroy, Malloc, Memalign, PosixMemalign, Free, Calloc, Realloc, Reallocalign, MallocStats and MallocStatsFast](../../../core/libs/prx/libc/src/Mspace.cpp) - PAF exports delegate to `sceLibcMspace` without malloc hooks; `Memalign` and `PosixMemalign` forward to their `Mspace` counterparts with owner ignored and are unverified on console. `Create`'s options block (version, type 1 or 2 at +2, field at +0x10) throws when non-null as its meaning is unknown. Block footers are not modelled, so owners are ignored: on PS5 firmware 13.60 mismatched owners in `Reallocalign` or in-place `Realloc` kill the process and `MallocStats` returns 1 if non-heap-owned blocks exist, which is not reproduced. `MallocUsableSize`, `Trim`, `IsHeapEmpty`, `CheckMemoryBounds`, `ReportMemoryBlocks` and `GetFooterValue` are not implemented.
 - [malloc_usable_size](../../../core/libs/prx/libc/src/ApplicationHeap.cpp) (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (`malloc_usable_size` in KytyPS5's `MallocReplace` order) and throws when the table leaves it null, like `malloc_stats_fast`
 - [malloc_stats_fast](../../../core/libs/prx/libc/src/GuestHeap.cpp) (libc) - with the default allocator it fills the 0x28-byte managed-size block as `sceLibcMspaceMallocStatsFast` does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up.
-- [malloc, calloc, realloc, memalign, aligned_alloc and reallocalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - follow FreeBSD 11.4 `contrib/jemalloc/src/jemalloc.c` for failures, not measured on the console: a size the default heap rejects or the guest arena cannot place (including a `calloc` product that overflows) returns null with `errno` `ENOMEM`, and `memalign` and `aligned_alloc` return null with `EINVAL` for an alignment that is zero or not a power of two. FreeBSD's libc has no `memalign`, so setting `errno` there is assumed. A host commit failure for a block that fits in the arena (Windows `ERROR_NOT_ENOUGH_MEMORY`, `ERROR_OUTOFMEMORY` or `ERROR_COMMITMENT_LIMIT`, Linux `ENOMEM`) resets and releases the reserved range and returns null with `ENOMEM`; any other commit failure releases the range and throws. `reallocalign` returns null with `EINVAL` for an invalid alignment and `ENOMEM` like the others, which is an assumption as it is not in FreeBSD. `realloc(ptr, 0)` frees the block and returns null, where FreeBSD 11.4's jemalloc 4.5 resizes it to one byte and returns a block
-- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, not measured on the console: size 0 frees the block and returns null as `realloc` does here, so the block is not freed twice; when `realloc` fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, `errno` is `ENOMEM` and null is returned. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc`
+- [malloc, calloc, realloc, memalign, aligned_alloc, reallocalign and posix_memalign](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - the console's own heap was measured in a payload process on firmware 13.60, not in a title. A heap a title replaces was not measured and keeps the FreeBSD jemalloc behaviour: `ENOMEM` on failure, `EINVAL` for an alignment that is zero or not a power of two, and `realloc(ptr, 0)` frees the block. With the console's heap, failures set `EINVAL`, and `errno` is left alone for a size above `SIZE_MAX - 0x1008f` (`SIZE_MAX - (A + 0x100af)` for an alignment over 32 rounded up to A), a `calloc` overflow or an alignment of 2^63 or more. Alignments round up to a power of two, and `realloc(ptr, 0)` keeps the block with 0 usable bytes. `reallocalign(ptr, 0, alignment)` for a block without that alignment was not measured and throws
+- [reallocf](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 `lib/libc/stdlib/reallocf.c` on top of this libc's `realloc`, as a payload process on a PS5 (firmware 13.60) does with the default heap (null and 0, size 0, 2^40 with `errno` 22 and the block freed, `SIZE_MAX` with `errno` untouched): size 0 does what `realloc` does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when `realloc` fails, the block is freed through the same allocator and null is returned with the `errno` that `realloc` left. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for `realloc`
 - [sceLibcMspaceReallocalign](../../../core/libs/prx/libc/src/Mspace.cpp) (libSceLibcInternal, implemented in libc) takes `(void* heap, void* block, size_t alignment, size_t size)`, the order of the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine `sceLibcMspaceMemalign` uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves `errno` alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does
 - [acosl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's `libc.prx`): results can differ from the console's in the last bit, and on Linux glibc sets `errno` to `EDOM` for `acosl` outside [-1, 1] where msun only raises the floating-point exception. `long double` is the x87 80-bit format, as Sony's `frexpl` uses it (`fldt 0x8(%rsp)`, result in `st(0)`)
 - [atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, as `acosl` is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's `log10l(1000)` is not exactly 3), and on Linux glibc sets `errno` to `EDOM` or `ERANGE` where msun only raises the floating-point exception. `ldexpl` and `truncl` are exact operations and give the console's result; `logb` and `remainder` give the console's value too, but on Linux glibc sets `errno` (`ERANGE` for `logb(0)`, `EDOM` for `remainder` by zero or of an infinity) where msun only raises the floating-point exception
 - [Dinkumware atomics](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) - every operation is sequentially consistent whatever memory order it is given, which is never weaker than the console. Matching the `libc.prx` bundled with PPSA08427 (that binary run side by side on every order from 0 to 7), `_Atomic_load_8` returns 0 for a release, acq_rel or invalid order and the 8-byte exchange and fetch operations return 0 without touching memory for an order above `memory_order_seq_cst`; the generic `_Atomic_copy`, `_Atomic_exchange` and `_Atomic_compare_exchange_*` lock the byte flag passed first, as the console does
 - [std_execute_once](../../../core/libs/prx/libc/Export.cpp) (libc) - assumed to be the plain-named twin of `std::_Execute_once` (`_ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1_`, the callee of Dinkumware `call_once`): it delegates there and gets the [thread.once.callonce] semantics already verified for that symbol (one invocation per flag, concurrent callers block until it completes, and a failing or throwing invocation leaves the flag unready so the next caller runs it). The name equivalence is not confirmed on a title, and the callback convention (called with (null, arg, null), non-zero return meaning success) is the twin's, unverified for this symbol
 - [__atomic_load, __atomic_store, __atomic_exchange and __atomic_compare_exchange](../../../core/libs/prx/libc/src/AtomicBuiltins.cpp) (libc) - the generic, size-parameterised libatomic entry points are a single `ud2` in the `libc.prx` bundled with PPSA08427 (disassembly), so the console traps on any call; these throw instead
+- [Sized __atomic calls](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) - the 36 `__atomic_load_N`, `__atomic_store_N`, `__atomic_exchange_N`, `__atomic_compare_exchange_N` and `__atomic_fetch_{add,sub,and,or,xor}_N` calls (N = 1, 2, 4, 8) are sequentially consistent whatever order they are given. The `libc.prx` bundled with PPSA08427, run side by side on random values and on every order from -1 to 7, switches on the order but always uses a locked instruction or CAS loop, except that a store with an order other than `memory_order_seq_cst` is a plain store, so these are never weaker than the console. Unlike `_Atomic_load_8` and the 8-byte `_Atomic_*` exchange and fetch calls above, the console accepts every order here, including release, acq_rel and invalid ones, and these do the same
 - [Dinkumware mutexes and conditions](../../../core/libs/prx/libc/src/Threads.cpp) (libc) use pointer-to-handle arguments, matching the console aerolib signatures reported in [#3079](https://github.com/boykopovar/AnyPS5/pull/3079). The title's `_Mtx_lock` maps `0` to `_Thrd_success` (0), `0x8002000b` to `_Thrd_busy` (3), and other failures to `_Thrd_error` (4); its internal mutex init recognizes recursive flag `0x100`, while every other type uses default attributes. The observed relock failure for a plain mutex suggests those defaults are error-checking, but that has not been confirmed on hardware. The title's `_Mtx_unlock` and `_Cnd_wait` return success regardless of their internal result. The host implementation treats invalid ownership preconditions as no-ops, and throws for invalid handles, host wait errors and destroying a locked mutex as debug guards; those cases are not confirmed against the console.
 - [Floating-point compiler-rt builtins](../../../core/libs/prx/libc/src/FloatBuiltins.cpp) (libc) follow the `libc.prx` bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs) where it differs from current compiler-rt: the soft-float `__add`, `__sub`, `__mul` and `__div` (`sf3`, `df3`) round to nearest, raise no exception flags and ignore MXCSR, here done with SSE under a default MXCSR that is restored afterwards; division flushes a quotient below the smallest normal to a signed zero; `__extendsfdf2` and `__truncdfsf2` copy NaN payloads unshifted; float-to-integer conversions do not saturate but shift the significand by a count masked to the shift width. `__mulsc3`, `__muldc3`, `__divsc3` and `__divdc3` fuse the same products as the console with `fma` and scale through the x87 like its `scalbn`, so their values match, but NaN payloads and exception flags can differ, as the host `fma` and `logb` are not the console's VEX FMA code and libm
-- [random, srandom, initstate, setstate](../../../core/libs/prx/libc/src/Random.cpp) (libc) follow FreeBSD 11 [random.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdlib/random.c): the additive feedback generator on a default 128-byte `TYPE_3` table, `good_rand` seeding, state sizes rounded down to 8, 32, 64, 128 or 256 bytes, and `setstate` returning the previous state or null for a rear position past the degree. `initstate` below 8 bytes returns null without setting errno, as that file and its manual do (glibc sets `EINVAL`). FreeBSD does not lock the generator; here every call is serialised by one lock, so concurrent callers draw the serial sequence between them. A null state throws, where FreeBSD faults. That the console's `libSceLibcInternal` uses this FreeBSD code and not another generator is unverified
+- [random, srandom, initstate, setstate](../../../core/libs/prx/libc/src/Random.cpp) (libc) - not measured: the state `setstate` returns and its null return for a rear position past the degree, `errno` after `initstate` below 8 bytes, a null state (throws here), an `initstate` seed other than 1, concurrent callers (one lock serialises every call here) and a title's own libc. Measured in a payload process on a PS5 (firmware 12.70): a fresh process draws the `srandom(1)` sequence; `srandom` seeds an additive feedback generator through a `good_rand` that reads its argument as an int32, turns 0 into 123459876 and applies `x = 16807 * (x % 127773) - 2836 * (x / 127773)`, adding 0x7fffffff to a negative result, which reproduces seeds 0, 1, 2, 12345, 0xffffffff and 0x80000000; `initstate` returns null at 0 and 7 bytes and selects types 0 to 4 by size as measured at 8, 15, 31, 32, 63, 64, 127, 128, 129, 255, 256, 257 and 1000 bytes.
+- [srandomdev](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) is not verified against the console. The firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibcInternal.c) names NID `a2MOZf++Wjg`; it follows FreeBSD 11 [random.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdlib/random.c), filling every active generator word from host OS entropy instead of `KERN_ARND`, then resetting additive feedback positions without warming up. An entropy failure throws rather than leaving `sysctl`'s failure unchecked. Calls share the generator lock.
 - [Integer compiler-rt builtins](../../../core/libs/prx/libc/src/IntegerBuiltins.cpp) (libc) - the console traps in `__divsi3`, `__modsi3` and the 64- and 128-bit divisions on a zero divisor (`div`) and in `__negv*`, `__absv*` and `__mulv*` on overflow (an abort helper, then `ud2`); these throw instead. As in the `libc.prx` bundled with PPSA08427 (disassembly), `__addv*` and `__subv*` wrap without an overflow check, and `__udivsi3`, `__umodsi3` and `__udivmodsi4` divide in software, giving a quotient of 0 and the dividend as remainder for a zero divisor; `__clzdi2` and `__ctzdi2` of 0 return 32 and `__clzti2` and `__ctzti2` of 0 return 64
 - [qsort](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) follows FreeBSD 11 [qsort.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libc/stdlib/qsort.c): Bentley and McIlroy's quicksort, with insertion sort below 7 elements and after a partition pass that swaps nothing, so elements that compare equal end in FreeBSD's order and the comparator is called in the same sequence. That the console's libc uses this FreeBSD code is unverified
 - [memcpy_s, memmove_s, strcpy_s, strncpy_s, strcat_s, strncat_s, wmemcpy_s, wmemmove_s, wcsncpy_s, wcscat_s, wcsncat_s](../../../core/libs/prx/libc/src/Strings.cpp) (libc) use the C11 Annex K destination size constraints, with RSIZE_MAX taken as (SIZE_MAX >> 1) / sizeof(char16_t) for wide operations and SIZE_MAX >> 1 for byte operations. An oversized destination size returns ERANGE (34) without touching the destination; the console's RSIZE_MAX and exact error value are unverified. Constraint violations return an error without invoking the registered constraint handler, as before.
+- [wcsncat_s and wcscat_s](../../../core/libs/prx/libc/src/Strings.cpp) (libc) refuse a copy as overlapping only when the written range `[dest + len1, dest + len1 + len2)` meets the read range `[src, src + len2)`. The rule comes from a static reading of the console's `wcsncat_s` in `libc.prx` (not run on a console); `wcscat_s` gets it through `wcsncat_s`, and its own console code was not read. The narrow `strncat_s` keeps a wider rule, `[dest, dest + used + length + 1)` against `[src, src + length + 1)`, whose console code was not read either, so it refuses some copies whose wide equivalent proceeds.
 - [snwprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - follows C11 K.3.9.1.3 with `RSIZE_MAX` assumed to be `SIZE_MAX >> 1`. A runtime-constraint violation only returns a negative value: the handler installed with `set_constraint_handler_s` is not invoked, and the console's default handler is unknown. An invalid multibyte `%s` argument is copied byte by byte instead of being reported as an encoding error, as in `vswprintf`
 - [swprintf_s and vswprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - follow C11 K.3.9.1.4 with `RSIZE_MAX` assumed to be `SIZE_MAX >> 1`: the complete output, including the terminating null, must fit in the buffer, otherwise it is a runtime-constraint violation that sets `buffer[0]` to zero and returns a negative value, and the buffer is not partially written. Argument and encoding checks match `snwprintf_s`
+- [strerror](../../../core/libs/prx/libc/src/Errors.cpp) (libc) - follows the `libc.prx` that CUSA04865 and CUSA12435 ship, loaded on a PS4 Pro (firmware 10.71): 0 gives "No error", 1 to 94 the FreeBSD texts, any other number "error_code=0x%08x", and errno is left alone. The console's system libc, which homebrew without a bundled `libc.prx` uses, answers differently ("No error information" for 0 and unknown numbers, 95 and 96 named). `strerror_r` and `perror` keep "No error: 0" and "Unknown error: %d"; they are not measured.
 - [strerror_s and strerrorlen_s](../../../core/libs/prx/libc/src/WideConversion.cpp) (libc) follow [C11 K.3.7.4.2 and K.3.7.4.3](https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1570.pdf), using the existing FreeBSD error messages and unknown-error formatting. Truncation writes an ellipsis when capacity exceeds 3; constraint failures leave the destination untouched and invoke the registered guest-ABI handler. The console's `RSIZE_MAX` (`SIZE_MAX >> 1` here), nonzero returns (`EINVAL` 22 for constraints, `ERANGE` 34 for truncation), handler arguments and default abort behavior are unverified. Messages remain in the C locale, and guest errno is preserved.
 - [getw and putw](../../../core/libs/prx/libc/src/BinaryWordIo.cpp) (libc) follow FreeBSD 11.4 [getw.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/getw.c) and [putw.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/putw.c): one 32-bit little-endian word, `getw` returns -1 for EOF or an error, and `putw` returns 0 on success or -1 on error while holding the stream lock. They use the existing host-backed streams, so buffering and error timing follow the host CRT. Null streams throw and closed streams return -1 with `EBADF`, as existing byte I/O does. Console behavior is unverified.
 - [vsnwprintf_s](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - `va_list` counterpart of `snwprintf_s` (C11 K.3.9.1.3): truncates to the buffer and returns the full length, with the same constraints and argument checks
 - [strndup and strdup](../../../core/libs/prx/libc/src/AllocatingStrings.cpp) (libc) return null with `errno` set to `EINVAL` (22) when `source` is null, preventing a host segfault on invalid guest input. POSIX.1-2008 and FreeBSD 11.4 libc leave `strndup(NULL)` and `strdup(NULL)` undefined (faulting); exact console behavior on hardware is unverified.
 - [snprintf_s and vsnprintf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) - follow C11 K.3.5.3.5 and K.3.5.3.12 with `RSIZE_MAX` assumed to be `SIZE_MAX >> 1`, as `snwprintf_s` does: a null buffer or format, `size` of 0 or above `RSIZE_MAX`, any `%n` and a null `%s`, `%ls` or `%S` argument return a negative value and set `buffer[0]` to zero when the buffer and size allow it; otherwise the output is truncated to the buffer and the full length is returned. A violation only returns: the constraint handler is not invoked, and the console's error value is unverified. Not confirmed on a PS5 title
 - [vsscanf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) - returns the count of items converted before an undersized `%s`/`%c`/`%[` destination (0 when it is the first), not EOF. Not confirmed on a PS5 title
+- [setlocale](../../../core/libs/prx/libc/src/StdioExtras.cpp) (libc) knows only the "C" locale, as the `libc.prx` that titles ship does: it ignores the category, returns "C" for a null, empty or "C" name and a null pointer for any other, "POSIX" included, without setting `errno`. Checked by running the copies bundled with PPSA07923 and PPSA13934 side by side for categories -40 to 79 and 2^30, not measured on a console.
 - [localeconv](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, re-exported by libSceAmpr) - the 0x90-byte Dinkumware struct (empty monetary strings, `CHAR_MAX` for the 14 `char` fields, `decimal_point` ".", `_False`/`_True` "false"/"true") is read from the `libc.prx` that Astro's Playroom ships. It is a fixed C-locale table: whether the console changes it with `setlocale` is not known, and `_Frac_grouping`, `_Frac_sep`, `_No`, `_Yes` are empty strings as in that dump
 - [set_constraint_handler_s](../../../core/libs/prx/libc/src/WideConversion.cpp) (libc, re-exported by libSceAmpr) - the default handler is assumed to abort; each module keeps its own handler state, so a handler set through one library is not seen by the other. Within a module every `_s` function calls the installed handler, with the guest's calling convention. `ctime_s` and `asctime_s` follow the Dinkumware 26-byte format with `EINVAL` for a buffer under 26 bytes, a null pointer or an out-of-range weekday/month; `ctime_s` uses the guest time zone of `localtime_s`, and the console's exact checks are not verified
 - [qsort_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) sorts as `qsort` does and passes its context as the comparator's third argument, as FreeBSD 13's [`qsort_s`](https://github.com/freebsd/freebsd-src/blob/release/13.0.0/lib/libc/stdlib/qsort.c#L97-L127) (C11 Annex K) does. It returns `EINVAL` after calling the constraint handler when `n` or `es` exceeds `RSIZE_MAX`, or when `n` is not 0 and `a` or `cmp` is null; FreeBSD 11, which the rest of libc follows, has no `qsort_s`. An element size of 0 sorts nothing, where FreeBSD loops over the same address. The console's behaviour is unverified; the Quake homebrew (#6698) imports it from its `libOSMesa.so.8`
@@ -52,40 +61,58 @@
 - [__umodti3](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - the hardware traps on a zero divisor; this throws instead
 - [__modti3](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - the hardware traps on a zero divisor; this throws instead
 
+- [snprintf and vsnprintf](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) accept any size up to `SIZE_MAX`, as a payload process on a PS5 (firmware 13.60) does. A null buffer with a nonzero size throws here, where the console writes through it, and a result longer than `INT_MAX` throws, which was not measured
+
 ### Functional
 
+- [_Cosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the two-argument Dinkumware CRT helper used by `std::complex`, including a scaled large-finite-input path; the signature, exact result and floating-point exception behavior are not verified against the console.
+- [std::thread::hardware_concurrency](../../../core/libs/prx/libc/src/Threads.cpp) (libc, NID `CHrhwd8QSBs`) returns the host's `std::thread::hardware_concurrency()` (which may be 0 when unknown) instead of the console's processor count; no reference implements it and the value a title expects (PPSA34015 imports it) is unverified.
+- [fmodf](../../../core/libs/prx/libc/src/Math.cpp) (libc) - console `errno`, exception flags and NaN payloads remain unverified. The wrapper preserves `errno` like the existing double `fmod`, following FreeBSD 11.4 [`e_fmodf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_fmodf.c); host `std::fmod` still supplies the result and exception flags.
 - [_FSinh and _FCosh](../../../core/libs/prx/libc/src/Math.cpp) (libc) finite results are not verified bit for bit against the console: the scaled product uses the host's binary64 hyperbolic function before rounding to binary32, rather than the float rational and `_FExp` sequence in PRAGMATA's bundled `libc.prx`. NaN preference and payloads, signed zeros, infinite operands and the range-error thresholds follow that binary's instructions; the system `libSceLibcInternal` implementation and nondefault flush-to-zero modes are unverified.
 
 - [sscanf_s and vsscanf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) return `EOF` when a reached conversion has a null destination, stopping before further assignments, following C11 K.3.5.3.7 and K.3.5.3.14. Earlier assignments are retained. The constraint handler is not invoked, and console behaviour is unverified.
 - [memmem and memccpy](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `memmem` searches for needle occurrences in memory buffers and `memccpy` copies buffers until a character match, following FreeBSD and POSIX specifications; behavior is unverified on console.
+- [strtof and wcstof](../../../core/libs/prx/libc/src/Strings.cpp) (libc) round to the nearest float, where the console's `_Stof` in `libSceLibcInternal.sprx` (0x734a0) does not always: about a third of decimal inputs within a relative 2^-51 of a point halfway between two floats, and some hexadecimal inputs with more than 24 significant bits, come out one unit apart in the last place (`1e-40` is `0x1.16c3p-133` there and `0x1.16c2p-133` here). The console's own rounding is not reproduced
+- [strtof and wcstof](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `ERANGE` follows the `libc.prx` bundled with PPSA08427 (J03547016) and PPSA03671 (J03848509), both run side by side with this libc on a Linux host: a decimal input whose result is a nonzero subnormal sets it only when inexact, a hexadecimal one only when it lies below the smallest subnormal and rounds up to it, and underflow to zero and overflow set it. Both builds also take a `NAN(...)` payload in `strtof` from the sequence's leading digits (`nan(0x123)` is `0x7fc00123`, `-nan(5)` is `0xffc00005`); the sign is kept here, the payload is not. `libSceLibcInternal`'s `_Stof` differs: no `ERANGE` for hexadecimal input, a positive `nan`, and after a minus sign a failed parse is `-0.0` for a lone sign and `+0.0` before an `inf`/`nan` spelling, the reverse of `libc.prx`. Decimal `strtod` sets `ERANGE` for a nonzero subnormal in J03547016 but not in J03848509 or `libSceLibcInternal`, whose result is kept.
 
 - [Guest time conversions](../../../core/libs/prx/libc/src/Time.cpp) rewrite the host process `TZ` when a guest changes its own `TZ`, so other host consumers of that variable (including libSceRtc local time) shift too; code outside libc does not take the zone lock. Zone syntax follows the host C runtime, not FreeBSD: Windows only accepts the `std offset [dst]` form, treats an empty guest `TZ` as `UTC0` and reads `:Europe/Berlin` as an abbreviation (for example `rop`); only Linux honours zone file names. If the guest accepts a `TZ` value that the host rejects (on Windows, for example, one longer than the host environment limit), conversions throw `std::runtime_error`. A `tm_zone` saved before a `TZ` change can refer to storage now holding the new zone name, changing `%Z` output.
+- [cbrtf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_cbrtf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_cbrtf.c): a 5-bit first guess from the exponent bits, then two Newton steps in double precision. It sets no `errno`, as the `libc.prx` that titles ship does not. Floating-point exceptions are not compared. It gives the same bits as the `cbrtf` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.
 - [__isfinitel](../../../core/libs/prx/libc/src/Math.cpp) - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following [FreeBSD msun](https://github.com/freebsd/freebsd-src/blob/main/lib/msun/src/s_isfinite.c). The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does.
+- [logf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`e_logf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_logf.c), with `vzero` read at run time as msun's `volatile` read does. As in the `libc.prx` that titles ship, `errno` is set to `ERANGE` for ±0 and to `EDOM` for every argument with the sign bit set, negative NaNs and -inf included; positive NaNs and +inf leave it unchanged. Floating-point exceptions are not compared. It gives the same bits and `errno` as the `logf` of the `libc.prx` bundled with PPSA07923 and PPSA05916 for all 2^32 arguments, run on a Windows host. The FMA-contracted build bundled with PPSA13934 differs from it by 1 ulp on 961,881 arguments, so no single port matches every title's last bit.
 
 - Windows direct-memory backing reserves a paging-file section. A [direct memory page](../../../core/libs/prx/libc/include/WindowsMappings.hpp) mapped at one guest address is private write-watched memory at that address and is not committed in the section; a page mapped at a second address moves its whole resident run into the section (committed there) and every address becomes a view of it, tracked by write protection. An unmapped resident page that is not all zeros is kept in a private reservation until it is mapped again. Committed section contents remain across unmap/remap and are released when the backing and its remaining views are destroyed. A host import alias over part of a resident run is refused. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified.
 - Stable Windows resident runs of at least 256 KiB use temporary read-only protection for clean write-watch proofs. The first CPU write restores the logical protection of the whole run; that run remains on native write watching until it is remapped, so repeatedly rewritten runs stay writable. Native kernel writes into guest buffers must hold [GuestArena::HostWrite](../../../core/libs/prx/libc/include/GuestArena.hpp), as shared views already require: an unbracketed WinAPI ReadFile can fail with ERROR_NOACCESS while the resident proof is armed. Guest read, pread and socket receive paths already bracket their destinations. GPU host-import access suppresses resident rearming without inventing shared-page stores. This is a host integration requirement, not a change to guest logical protection.
 - [getc_unlocked, putc_unlocked, getchar_unlocked, putchar_unlocked](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - byte I/O uses the host unlocked operations; guest EOF/error flags and macro counters follow `FileStream`. Linux status queries use `feof_unlocked`/`ferror_unlocked` because [glibc `feof`](https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/libio/feof.c) and [`ferror`](https://github.com/bminor/glibc/blob/d2097651cc57834dbfcaa102ddfacae0d86cfb66/libio/ferror.c) can acquire the stream lock. Windows uses [the CRT no-lock byte operations](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/fgetc-nolock-fgetwc-nolock) and `feof`/`ferror`, verified under a held stream lock on UCRT. Console behavior and other host CRTs remain unverified.
+- [strcasecmp and strncasecmp](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - console locale behavior is unmeasured. They use the guest's C-locale case conversion and return -1, 0 or 1, the sign of the folded unsigned-byte difference, as the `libc.prx` bundled with eleven titles does (FreeBSD 11.4's [strcasecmp.c](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/string/strcasecmp.c) returns the difference itself); other guest locales are not implemented.
 - [feof_unlocked and ferror_unlocked](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc) have no console measurement. The firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibcInternal.c) names NIDs `NuydofHcR1w` and `yxbGzBQC5xA`. They follow FreeBSD 11 [feof.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/stdio/feof.c) and [ferror.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/stdio/ferror.c), returning 0 or 1 from the stream status without acquiring the stream lock. They inherit the host CRT limitations of the unlocked byte operations above.
-- [fgetws, getwc, getwchar, putwc, putwchar](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; `fgetws` reads characters into the destination buffer until newline or EOF and null-terminates, returning null on stream error. Console wide stream buffering and encoding details remain unverified.
-- [Closed standard descriptors](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - on Linux and macOS, a descriptor 0, 1 or 2 that is closed when libc loads is opened on `/dev/null` (read-only for 0, write-only for 1 and 2) by a static initializer of libc, which runs before the libraries that depend on libc initialize and before the title starts. Within libc this relies on no static initializer opening a descriptor before it, which `guest_closed_standard_descriptors` checks. glibc does the same for set-user-ID programs ([`check_fds.c`](https://sourceware.org/git/?p=glibc.git;a=blob;f=csu/check_fds.c)). Without it the first descriptor a library opens, the write watch's `userfaultfd` for one, becomes the guest's standard input or output. What the console gives a title as its standard descriptors is not measured, and on Windows a process started without standard handles is not handled.
+- [gets](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc, NID `Ok+SYcoL19Y`) follows [FreeBSD 11.4 gets.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/gets.c) for byte input, newline removal and EOF, without PS5 verification or known module/library versions. It reads the guest stdin under its stream lock and preserves the destination when EOF or a read error precedes any byte; a partial line is terminated and returned. A null destination throws; its console behavior is unverified. It emits no diagnostic; FreeBSD writes a warning once, and the console's diagnostic behavior and stream orientation are unverified.
+- [fgetws, getwc, getwchar, putwc, putwchar](../../../core/libs/prx/libc/src/FormattingWide.cpp) (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; `fgetws` follows the `libc.prx` that titles ship (read from disassembly of three titles' copies, PPSA13934, PPSA07923 and PPSA05916, not measured on a console): it returns null for a size below 2 without writing the buffer, `errno` or the stream, stores each `fgetwc` result as its low 16 bits until a newline (compared on all 32 bits), `-1` or a full buffer, and null-terminates and returns the buffer whenever it stored a character, also after a read error. A null buffer or stream, which the console dereferences, sets `errno` to 22 here. The calls the console makes before and after reading, and the one it makes when bits 0xC of the stream's second flag byte are set, are not reproduced. Console wide stream buffering and `fgetwc`'s decoding remain unverified.
+- [Closed standard descriptors](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libc) - console startup descriptors remain unmeasured. [Halo: Combat Evolved's PS5 host](https://github.com/thelinkin3000/halo-ce-universal/blob/201e0f18011a30ea6d098ad249bf17eba005d653/port/ps5/host/host_main.c#L407-L429) expects 0 to 2 closed and opens its eboot on them; here it leaves them open. Missing descriptors are opened on `/dev/null` on Linux/macOS or `NUL` on Windows, read-only for 0 and write-only for 1 and 2. Windows also reattaches the UCRT streams before any guest `FileStream` captures their descriptor. Initialization runs before libraries depending on libc; no earlier libc initializer may consume a missing standard descriptor. The `guest_closed_standard_descriptors` and `guest_closed_standard_descriptors_windows` tests cover startup.
 - [Guest path names](../../../core/libs/prx/libc/src/General.cpp) (libc) are checked against FreeBSD 11.4's `NAME_MAX` (255 bytes per component) and `MAXPATHLEN` (1024 bytes with the terminating NUL) before they are resolved, and a longer name fails with `ENAMETOOLONG`, as `namei` does. The host's own limit still applies below that: on Windows a path whose host form exceeds `MAX_PATH` fails with `ENOENT`. A backslash counts as a path separator for the component length, because the guest path resolver turns it into `/` before the host call, while FreeBSD treats it as an ordinary name character, so a 301-byte name that contains one is accepted here. `sceNgs2ParseWaveformFile` resolves its path without a try block, so a long component ends in an uncaught `filesystem_error` there where a missing file ended in a `runtime_error` (both end the title). A path through a regular file (`file/x`, `file/`) is not always `ENOTDIR` on the calls that resolve it. None of this was measured on a console.
+- [Guest path names](../../../core/libs/prx/libc/src/General.cpp) (libc) fail on macOS with `ENAMETOOLONG` once their host form, the root directory followed by the guest path, reaches 1024 bytes, so a guest path of 1023 bytes, which FreeBSD accepts, fails there under any root directory
 - [ftrylockfile](../../../core/libs/prx/libc/src/RuntimeSupport.cpp) (libc) - tries the host CRT stream lock that `flockfile`, `funlockfile` and each locking host stdio call on the stream take, so it returns -1 while another thread holds the stream through `flockfile` or is inside such a call, and 0 when it acquires the lock or already owns it (recursively, released by as many `funlockfile` calls), as FreeBSD 11 [`_ftrylockfile`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdio/_flock_stub.c#L89-L104) does. A libc export holds the lock only for each host call it makes, not across several host calls or while it updates the guest `FILE` prefix. Linux uses glibc `ftrylockfile`. UCRT has no try variant of `_lock_file`, so Windows calls `TryEnterCriticalSection` on the `CRITICAL_SECTION` that `_lock_file` enters, found through the private UCRT stream layout (`__crt_stdio_stream_data` in `ucrt/inc/corecrt_internal_stdio.h`, unchanged from Windows SDK 10.0.19041 to 10.0.26100); another CRT or a change of that layout breaks it. A null or closed stream throws where FreeBSD dereferences it
+- [sinf, cosf, tanf and sincosf](../../../core/libs/prx/libc/src/Math.cpp) (libc) are FreeBSD msun's [`s_sinf.c`, `s_cosf.c` and `s_tanf.c`](https://github.com/freebsd/freebsd-src/tree/release/11.4.0/lib/msun/src) over its double-precision kernels and `e_rem_pio2f.c`, with `k_rem_pio2.c` (for `|x| >= 2^28 * pi/2`) ported only for one input word and `prec` 0; `sincosf` returns the two. As in the `libc.prx` that titles ship, only an infinite argument sets `errno` (`EDOM`); NaN leaves it unchanged. Floating-point exceptions are not compared. All four give the same bits and `errno` as the copies bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.
 - [fgetln](../../../core/libs/prx/libc/src/StandardStreams.cpp) (libSceLibcInternal, implemented in libc) throws: in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x5FE80) the export is a `hlt` instruction, which faults in user mode and ends the process
-- [Wide-character conversions](../../../core/libs/prx/libc/src/Multibyte.cpp) (libc) - The wide `wcsto*` functions parse the ASCII prefix of the guest string, as the C locale accepts only ASCII white space and digits. [`wcsrtombs`](../../../core/libs/prx/libc/src/Multibyte.cpp) uses the guest's single-byte C locale through `wcrtomb`; other encodings and shift states are not supported
+- [Wide-character conversions](../../../core/libs/prx/libc/src/Multibyte.cpp) (libc) - The wide `wcsto*` functions parse the ASCII prefix of the guest string, as the C locale accepts only ASCII white space and digits. The multibyte conversions follow the C locale of the console's `libSceLibcInternal.sprx`: UTF-8 of at most three bytes, so `_Getmbcurmax` returns 3, overlong forms and encoded surrogates decode, and four-byte forms are invalid. `__mb_cur_max` stays 1 like the console's variable; `___mb_cur_max` is not in that module and also stays 1, unverified. Other locales are not supported. With a null destination, `wcstombs` returns the byte count; the console's count is wrong when the capacity argument equals the running count, because it reads past the terminator
 - [realpath](../../../core/libs/prx/libc/src/RealPath.cpp) (libc) follows FreeBSD 11's [`realpath.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/libc/stdlib/realpath.c) except for symlinks. The console's guest filesystem has none, so a host symlink under the guest root is followed for existence and type but not expanded, and `..` drops the previous component lexically, as `Resolve` does for every guest path. Through a host link `linkdir -> sub/deep`, `linkdir/../x` gives `x` beside the link, not beside its target.
 - [strtod, strtof, strtold](../../../core/libs/prx/libc/src/Strings.cpp) (libc) - `strtod` and `wcstod` (and `atof`, which calls `strtod` here) read a `NAN(...)` sequence as FreeBSD 11's gdtoa [`hexnan`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/contrib/gdtoa/hexnan.c) does: hexadecimal digits with an optional `0x`, blanks starting a new 32-bit word, the first 16 digits kept and the payload cut to 52 bits, a zero payload made 1, any other character giving the default NaN but consuming up to the closing parenthesis, and an unterminated sequence keeping its payload while consuming only `nan`. The payload goes under the quiet bit with the sign, as in gdtoa's [`strtod`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/contrib/gdtoa/strtod.c#L316-L328). `strtof`, `wcstof`, `strtold` and `wcstold` return the positive default quiet NaN (`0x7fc00000`; exponent `0x7fff`, significand `0xc000000000000000`) whatever the sign and the sequence, and consume a sequence of letters, digits and underscores up to its closing parenthesis. The console's `libSceLibcInternal.sprx`, called from a payload process on a PS5 (firmware 12.70), gives these results for the 64 NaN inputs tried through `strtod` and `strtof`, 50 of them also through `strtold` and `wcstod`, and 18 through `wcstof` and `wcstold`, and, through `strtod`, for `nan(1 2)` and for `nan( ` followed by NUL and `)`; that a title's own `libc.prx` does the same is assumed. In `hexnan`, a blank after a payload digit, while a 32-bit word of the payload is still free, starts a blank skip that has no NUL check, so when only blanks follow up to the terminating NUL the console's `strtod` reads past it: `nan(1 ` followed by NUL and `)` consumes the `)` after the NUL, so the result depends on the bytes after the string, and here that case throws. A blank right after `nan(` is skipped with a NUL check, and the console stopped at the NUL there
 - [remquol](../../../core/libs/prx/libc/src/MathExact.cpp) (libc) leaves `*quo` unchanged when the result is NaN; the `libc.prx` bundled with PPSA08427 writes a value that depends on earlier x87 state (`remquol(1, 0)` stored 0 on a first call and 4 on later ones)
+- [_Stod, _Stodx, _Stofx, _Stoldx, _Stof and _Stold](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libSceLibcInternal, implemented in libc) throw for hexadecimal text with a non-zero power-of-ten scale. The console's result there does not follow a simple rule: `0x3` with a scale of -1 gives 0.29999999999999999. A nonzero subnormal result sets neither `errno` nor the error argument, as measured in firmware 13.60's `libSceLibcInternal.sprx` run in a Linux host process, not on a console; there about a fifth of decimal inputs with a subnormal result come out one unit apart in the last place (`_Stodx("2.2250738585072014e-308", 0)` is the largest subnormal), which is not reproduced
 - [Long double math in MathExact.cpp](../../../core/libs/prx/libc/src/MathExact.cpp) (libc) was compared with the `libc.prx` bundled with PPSA08427 only for canonical 80-bit encodings; unnormals, pseudo-denormals and pseudo-infinities passed to arithmetic functions (not the classifiers) follow the host x87 instead of the console
+- [atanf](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_atanf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_atanf.c), with `atanlo[3]` read at run time as msun's `volatile` does. Tiny arguments return `x` without raising `FE_INEXACT`. It gives the same bits as the `atanf` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host, and none of those sets `errno`. Whether other titles' builds differ is unverified.
 - [rename, sceKernelRename](../../../core/libs/prx/libc/include/RenameDot.hpp) (libc, libkernel) fail a last path component of `.` or `..` with `EINVAL`, after FreeBSD 11.4's [`lookup`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_lookup.c), which refuses `.` and, through its `ISDOTDOT` and `ISLASTCN` flags, `..` as the last component for the `DELETE` and `RENAME` operations. `rmdir("dir/.")`, `unlink("dir/.")` and the same calls with `..` follow the same lookup rule in FreeBSD but are not changed here: the guest still resolves the dot component away and acts on `dir` or its parent. Both arguments are checked before any host access, so `rename` of a missing source onto `dir/.` answers `EINVAL`, where FreeBSD's [`kern_renameat`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_syscalls.c) looks the source up first and answers `ENOENT`. A backslash counts as a path separator here (the guest path resolver turns it into `/`); FreeBSD treats it as an ordinary name character. None of this was measured on a console.
 - [nan and nanf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return fixed quiet NaN values (`0x7fc00000` and `0x7ff8000000000000`), ignoring the tag argument as observed in the console's `libc.prx` (both exports load a global constant via `mov rax,[rip+..]; vmovsd xmm0,[rax]; ret`); VLC (PPSA85300) stops on nanf at start-up after strsep.
 - [jrand48 and mrand48](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) return the high 32 bits of the new 48-bit state zero-extended to 64 bits, as the console's `libSceLibcInternal.sprx` does when called from a homebrew payload process on a PS5 (firmware 12.70): a result with bit 31 set comes back between 0x80000000 and 0xFFFFFFFF, as FreeBSD 11.0's [`jrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/gen/jrand48.c#L23) and [`mrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/lib/libc/gen/mrand48.c#L25) return it; FreeBSD 11.1 and later cast it to `int32_t` ([`jrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.1.0/lib/libc/gen/jrand48.c#L26), [`mrand48`](https://github.com/freebsd/freebsd-src/blob/release/11.1.0/lib/libc/gen/mrand48.c#L28)), which makes it negative. `lrand48` and `nrand48` matched FreeBSD there. Whether a title's own libc does the same is unverified
 - [seed48 and lcong48](../../../core/libs/prx/libc/src/Random.cpp) (libSceLibcInternal, implemented in libc) follow the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x6F460 and 0x6F420): the multiplier and addend are shared by the whole `rand48` family, including `erand48`, `nrand48` and `jrand48` on a caller's seed; `lcong48` sets them with the seed, and `srand48` and `seed48` restore 0x5DEECE66D and 0xB. Unlike FreeBSD, `seed48` returns a static copy of the new seed rather than the previous one. A null argument, which the console dereferences, throws
 - [lgamma and signgam](../../../core/libs/prx/libc/src/Math.cpp) (libc) - `lgamma` returns the host's `lgamma` and stores the sign of Γ(x) in the exported `signgam` (NID `5gOOC0kzW0c`, starting at 0 as in FreeBSD 11's [`s_signgam.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/s_signgam.c)) by the rules of [`e_lgamma_r.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/e_lgamma_r.c): -1 for -0 and for a negative non-integer whose floor is odd, 1 otherwise, including poles, infinities and NaN. Taken from the FreeBSD source, not measured on the console. The NID is in the aerolib symbol list; no title is known to read `signgam`. PPSA99004 imports `lgamma`
+- [coshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows FreeBSD msun's [`e_coshf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_coshf.c), using the `expm1f` and `expf` paths already inlined for `sinhf` below; the Windows UCRT differed from the `libc.prx` copies in PPSA07923 and PPSA13934 on 500,554 and 500,614 of 20 million inputs in the #9707 survey. The exact system `libSceLibcInternal` behavior and the FMA-contracted `libc.prx` results remain unverified
+- [expm1](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_expm1.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_expm1.c) with `huge` read at run time, and sets `ERANGE` only when a finite argument overflows to infinity, as the titles' `libc.prx` does. It gives the same bits and `errno` as the `expm1` bundled with PPSA07923 and PPSA05916 on 320 million random and 47,222 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 43,433 of the random ones.
 - [sinhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `sinhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_sinhf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_sinhf.c) from before `__ldexp_expf`, which squares `expf(|x| / 2)` between `logf(FLT_MAX)` and the overflow threshold, calling msun's [`expm1f`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_expm1f.c) and [`expf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_expf.c), whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets `errno` to `ERANGE` before returning `x * 1e37`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system `libSceLibcInternal`, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return `libc.prx`, has the same code is assumed
+- [acoshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) uses FreeBSD msun's [`e_acoshf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_acoshf.c) range handling; the Windows UCRT differed from the `libc.prx` copies in PPSA07923 and PPSA13934 on 216,017 and 216,024 of 20 million inputs in the #9707 survey. The invalid-domain path raises `FE_INVALID` without setting `errno` as the source does. The exact system `libSceLibcInternal` behavior and FMA-contracted results remain unverified
 - [acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (`y0f`, `y1f`, `ynf` follow the console at `+-0`). As in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x56410), `lgammal` does not store the sign in `signgam`; `hypotl` returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. [hypot3, hypot3f and hypot3l](../../../core/libs/prx/libc/src/Math.cpp) follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two
 - [asinl](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `asinl` of the `libc.prx` bundled with PPSA28319 (disassembly), FreeBSD msun's [`e_asinl.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/src/e_asinl.c) with the ld80 [`invtrig.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/ld80/invtrig.c) coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, so a NaN argument also sets `EDOM`; msun itself sets no `errno`. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word `0x37f`), but guest threads do not set it: on Windows a thread started by `_beginthreadex` runs at 53 bits (`0x27f`), where `asinl(0.75)` returns mantissa `0xd91a98ae3406e000` instead of `0xd91a98ae3406e041`. The system `libSceLibcInternal` that RetroArch (PPSA99169) imports is assumed to have the same code
 - [atanhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `atanhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_atanhf.c`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_atanhf.c) calling msun's [`log1pf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_log1pf.c), whose paths for the positive arguments it passes are inlined here; the exported `log1pf` is still the host's. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, and for |x| = 1 it raises `FE_DIVBYZERO` and sets `errno` to `ERANGE` before returning `x / 0`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits, `errno` and floating-point exceptions as this implementation for all 2^32 arguments; it was not run on Linux. That the system `libSceLibcInternal`, which Dusklight (PPSA99305) imports while bundling a zero-return `libc.prx`, has the same code is assumed
-- [j0, j1, jn, y0, y1 and yn](../../../core/libs/prx/libc/src/Bessel.cpp) (libc) call the host's `sin`, `cos`, `sincos` and `log`, so the last bits can differ from the console. The rest follows the system `libc.prx` built as `J03093718` (disassembly), which given the console's own `sin`, `cos`, `sincos` and `log` gave the same bits and exception flags for 90 million arguments: msun's [`e_j0.c`, `e_j1.c` and `e_jn.c`](https://github.com/freebsd/freebsd-src/tree/release/10.0.0/lib/msun/src) with each multiply-add the console fuses done as one FMA. As in that release, before FreeBSD commit `186f620727`, `y0`, `y1` and `yn` return `-inf` for ±0 and `0x7ff8000000000000` for a negative argument without raising an exception. The console's `y0f`, `y1f` and `ynf` raise none either, unlike [ours](../../../core/libs/prx/libc/src/Math.cpp), which raise `FE_DIVBYZERO` at ±0. The order wraps at 32 bits as on the console: `jn(1 << 30, x)` never returns for 2^-29 <= |x| < 2^30
+- [j0, j1, jn, y0, y1 and yn](../../../core/libs/prx/libc/src/Bessel.cpp) (libc) call the host's `sin`, `cos`, `sincos` and `log`, so the last bits can differ from the console. The rest follows the system `libc.prx` built as `J03093718` (disassembly), which given the console's own `sin`, `cos`, `sincos` and `log` gave the same bits and exception flags for 90 million arguments: msun's [`e_j0.c`, `e_j1.c` and `e_jn.c`](https://github.com/freebsd/freebsd-src/tree/release/10.0.0/lib/msun/src) with each multiply-add the console fuses done as one FMA. As in that release, before FreeBSD commit `186f620727`, `y0`, `y1` and `yn` return `-inf` for ±0 and `0x7ff8000000000000` for a negative argument without raising an exception. The order wraps at 32 bits as on the console: `jn(1 << 30, x)` never returns for 2^-29 <= |x| < 2^30
 - [getenv, setenv, unsetenv, putenv](../../../core/libs/prx/libc/src/Environment.cpp) (libc) keep one guest environment that starts empty, like the `environ` libkernel exports, and never reads or changes the host's. A title sees only the variables it sets itself; host variables such as `HOME` and `PATH` name host paths a guest cannot use (PS5MC, PPSA99420, exits with `XBMC_Run returned -1` when it gets the host's `HOME`). Whether the console starts a title with any variables set is not measured
 - [mergesort](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libSceLibcInternal, implemented in libc) checks its arguments like the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x762D0): an element size under 4 sets `errno` to `EINVAL` (22) and returns -1, an empty array returns 0, and a failed `malloc` of the count times the size plus 8 bytes returns -1. The sort is a stable bottom-up merge, not FreeBSD's natural merge with its insertion sort for short runs, so the comparator is called in a different order and number of times; the result is the same for a consistent comparator. A null base or comparator and a size product that overflows, which the console does not check, throw
 - On macOS the [write watch](../../../core/libs/prx/libc/src/GuestWriteWatch.cpp) write-protects watched pages and records the first write to each from a SIGBUS/SIGSEGV handler, because macOS has no counterpart to `userfaultfd` write-protect or `MEM_WRITE_WATCH`. The protection is real, so:
@@ -103,34 +130,40 @@
 - The [`_Unwind_Context`](../../../core/libs/prx/libc/include/exceptions/Unwind.hpp) that `_Unwind_Backtrace` passes to its callback starts with a table laid out like LLVM libunwind's `AbstractUnwindCursor` virtual table, because homebrew built with the ps5-payload-dev SDK links libunwind statically and reads the frames with its own `_Unwind_GetIP` (`__unw_get_reg`), which calls through that table. Only register reads and writes (`validReg`, `getReg`, `setReg`, with `UNW_REG_IP` and `UNW_REG_SP`), `validFloatReg` (always false) and `isSignalFrame` are answered; the other slots throw. The layout follows libunwind's `UnwindCursor.hpp`, not the console's own `libSceLibcInternal`, which is not checked
 - The Windows libc [exception unwinder](../../../core/libs/prx/libc/src/exception/Unwind.cpp) cannot run arbitrary Windows exception or termination handlers. It accepts GCC C and C++ handlers identified by a project's `.sehgcc` section and interprets their LSDA with the guest personalities. A handler in an unmarked module, such as a C++ cleanup through `__gxx_personality_seh0` in `libstdc++-6.dll` or a system DLL function like `qsort` in `ucrtbase.dll` (Windows 10 22H2), still stops unwinding and the exception is reported as unhandled. SjLj exceptions are unsupported; Scoop GCC 15.2.0 selects them when SEH is disabled and lacks the System V ABI SEH compiler fix carried by MSYS2.
 - The libc [SSE4a trap emulation](../../../core/libs/prx/libc/src/specifics/windows/Sse4aEmulation.hpp) on Windows is superseded by `--to-intel` and remains only until the relinked title has been verified without it.
-- [getifaddrs](../../../core/libs/prx/libc/src/Interfaces.cpp) (libc) lists host interfaces and IPv4/IPv6 addresses in FreeBSD's layouts. Windows omits per-interface AF_LINK entries and interfaces without an address; its flags are only `IFF_UP`, `IFF_RUNNING`, `IFF_LOOPBACK`, `IFF_BROADCAST` and `IFF_MULTICAST` (PPP/tunnel adapters omit broadcast and point-to-point, and an unspecified prefix length gets a host mask). On Linux, `AF_LINK` `if_data` maps non-Ethernet/loopback/PPP types to `IFT_OTHER` (1) and leaves `ifi_omcasts`, `ifi_noproto`, `ifi_hwassist`, `ifi_metric`, `ifi_epoch`, `ifi_lastchange`, unknown baud rates and address-entry `ifa_data` as 0/null; a point-to-point address without a peer loses `IFF_POINTOPOINT`, and an omitted IPv4 broadcast is derived from the netmask. Interface names are the host's (`if<index>` on Windows above 15 bytes).
+- [getifaddrs](../../../core/libs/prx/libc/src/Interfaces.cpp) (libc) lists host interfaces and IPv4/IPv6 addresses in FreeBSD's layouts. Windows and macOS omit per-interface AF_LINK entries and interfaces without an address; on Windows the flags are only `IFF_UP`, `IFF_RUNNING`, `IFF_LOOPBACK`, `IFF_BROADCAST` and `IFF_MULTICAST` (PPP/tunnel adapters omit broadcast and point-to-point, and an unspecified prefix length gets a host mask). On Linux, `AF_LINK` `if_data` maps non-Ethernet/loopback/PPP types to `IFT_OTHER` (1) and leaves `ifi_omcasts`, `ifi_noproto`, `ifi_hwassist`, `ifi_metric`, `ifi_epoch`, `ifi_lastchange`, unknown baud rates and address-entry `ifa_data` as 0/null; a point-to-point address without a peer loses `IFF_POINTOPOINT`, and an omitted IPv4 broadcast is derived from the netmask. Interface names are the host's (`if<index>` on Windows above 15 bytes).
 - [gethostname](../../../core/libs/prx/libc/src/Hostname.cpp) (libc) reports the fixed guest name `AnyPS5` without querying the host machine name. Buffer copying, null queries and `ENAMETOOLONG` follow [FreeBSD gethostname](https://github.com/freebsd/freebsd-src/blob/main/lib/libc/gen/gethostname.c); the console's configurable hostname and its integration with `sysctl` and name resolution are unverified and not implemented.
 - [wctomb_s, wcrtomb_s, mbstowcs_s and mbsrtowcs_s](../../../core/libs/prx/libc/src/BoundsChecking.cpp) (libc) follow the console's `libc.prx`, but convert in the single-byte C locale of `wctomb`, `wcrtomb` and `mbrtowc` (`MB_CUR_MAX` 1): a character above 0xFF is `EILSEQ` in `wctomb_s` and `wcrtomb_s`, and each byte is one wide character in `mbstowcs_s` and `mbsrtowcs_s`. The locale of a title's `libc.prx` was not measured. The `wcrtomb_s` path where a character does not fit `smax` and the `EILSEQ` paths of `mbstowcs_s` and `mbsrtowcs_s` are not reached
 - [wcsrtombs_s](../../../core/libs/prx/libc/src/Multibyte.cpp) (libc) follows the console's `libc.prx`, but a runtime-constraint violation only returns its error: the default handler there writes the message and a newline to `stderr` before returning, which is not done here. Conversion uses the C locale of `wcrtomb` (`MB_CUR_MAX` 1), so the path where a multibyte character does not fit the remaining space is not reached
-- [c16rtomb, c32rtomb, mbrtoc16 and mbrtoc32](../../../core/libs/prx/libc/src/Multibyte.cpp) (libSceLibcInternal, implemented in libc) follow the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x7D480 to 0x7D920), which converts to and from UTF-8 whatever the locale, with the original sequences of up to six bytes and no check for surrogates or for values above 0x10FFFF when encoding. The conversion state keeps the value in its first eight bytes and the count of bytes still expected (or 0x10 for a pending low surrogate, 1 for a stored high surrogate) as 16 bits at offset 0xA; a null state, which the console dereferences, throws. As on the console, `mbrtoc16` does not store the complete code point when it returns a high surrogate, so the low surrogate of the next call is built from the value the state last held, which is the partial value of an earlier incomplete call or whatever the caller initialised it to, `c16rtomb` returns -1 without setting `errno` when a high surrogate is not followed by a low one, and `mbrtoc16` and `mbrtoc32` report `EILSEQ` as 86. Measured on a PS5 (firmware 13.60) from a homebrew payload, the system `libSceLibcInternal`'s default locale also converts UTF-8 in `wcrtomb`, `wctomb`, `mbrtowc` and `mblen` (`wctomb` of U+263A gives `E2 98 BA`, `mblen` of a lone 0xE9 gives -1); this libc keeps its single-byte C locale, so [wctomb and mblen](../../../core/libs/prx/libc/src/Multibyte.cpp), which call `wcrtomb` and `mbtowc` here as they call the same internal routines on the console, share that difference. Titles bundle their own `libc.prx`, whose locale was not measured
-- [The narrow printf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) converts 16-bit guest wide arguments to UTF-8 on both platforms, independently of the host locale. It does not use the guest's single-byte `wcrtomb`; the console's treatment of invalid UTF-16 and locale-specific encoding remains unverified. Linux retains host formatting for formats without wide arguments, `%m` or `%p`, so a NaN there still follows the host (glibc prints its sign, `-nan`, and honors the `+` and space flags, where FreeBSD prints `nan`); argument positions above 99 (FreeBSD's `NL_ARGMAX`) throw when a format requires the guest formatter
+- [c16rtomb, c32rtomb, mbrtoc16 and mbrtoc32](../../../core/libs/prx/libc/src/Multibyte.cpp) (libSceLibcInternal, implemented in libc) - a null state, which the console dereferences, throws. Otherwise they follow the console's `libSceLibcInternal.sprx` (0x7D480 to 0x7D920), read from disassembly: UTF-8 whatever the locale, up to six bytes per sequence, with no surrogate or 0x10FFFF check when encoding. The state holds the value in its first eight bytes and the expected byte count (0x10 for a pending low surrogate, 1 for a stored high one) as 16 bits at 0xA. `mbrtoc16` builds a low surrogate from the value the state last held, `c16rtomb` returns -1 without `errno` for an unpaired high surrogate, and `EILSEQ` is 86. On a PS5 (13.60) the system library's default locale converts UTF-8 in `wcrtomb`, `wctomb`, `mbrtowc` and `mblen`; a title's bundled `libc.prx` does too until `setlocale` installs a table ([disassembly](https://github.com/boykopovar/AnyPS5/pull/8855#issuecomment-6335267758))
+- [The narrow printf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) follows a payload process on a PS5 (firmware 13.60): each 16-bit unit of a `%ls` or `%lc` argument is encoded alone, so a surrogate pair gives two 3-byte sequences; a NaN keeps its sign and the `+` and space flags, and `0` pads it with spaces; argument positions above 99 work (up to 400 measured; above 65535 throw here); an unknown conversion such as `%m` or `%k` prints `%` and its letter, padded to the width, without taking an argument. The guest's `wcrtomb` and locales are not used. On Linux the formats without those conversions go to glibc, which prints NaN the same way. The `_s` forms throw for an unknown conversion, `%m` included, which was not measured
 - [%p and %lp](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) follow the console's `libSceLibcInternal.sprx` measured from a homebrew payload on firmware 12.70 ([#7549](https://github.com/boykopovar/AnyPS5/issues/7549)), not FreeBSD: bare lowercase hex with no `0x` prefix even under `#`, `0` for a null pointer, `+` and the space flag ignored, the width counting only the digits, `-` padding on the right, `0` padding with zeros when there is no precision, the precision as the minimum number of digits, nothing for a null pointer under `%.0p`, and `l` accepted. Only `snprintf` and `swprintf` of that module were measured, from a payload process rather than a title process, so a width beside `%.0p`, the `0` flag beside a precision (which C17 ignores) and `%.0p` of a non-null pointer follow this formatter's own rules and are not measured; `swprintf` was not run with `%lp`, so the wide family still refuses that conversion and returns -1. Linux routes `%p` and `%lp` to this formatter because glibc prints the FreeBSD form and `(nil)` for a null pointer, which means a format that combines `%p` with a conversion this formatter refuses, such as an argument position above 99, throws there instead of reaching glibc
 - [collate<char> and collate<wchar_t> _Getcat](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) build the facet for the C locale only and throw for any other locale name, the wide entry point following the narrow one it sits next to. The wide facet carries its own vtable, whose `compare`, `transform` and `hash` take the guest's 16-bit characters, so the length of a range is a count of characters: `compare` orders by 16-bit value (the C locale, as Dinkumware's `char_traits<wchar_t>::compare` does), `transform` copies the characters into the result and records size and capacity in 16-bit elements (inline capacity 7, heap capacity `length | 7`, `(capacity + 1) * 2` bytes including the terminator), following Dinkumware's [VC12 `basic_string`](https://github.com/ganboing/crt.vc12/blob/f1d47126bf13d1c9dccaa6c53b72217fd0474968/src/xstring#L500-L531), and `hash` mixes one whole character per round, so wide text below 0x100 hashes like its narrow spelling and a character above 0xff hashes as one value instead of the two bytes it holds. The console's `libc.prx` exports both `_Getcat` (NIDs BSVJqITGCyI and 2wz4rthdiy8) with identical 0x19d-byte bodies, believed to build the same 0x20-byte facet; the console bodies themselves are unreadable (obfuscated dynsym, and the text of the relinked `libc.prx` is zeroed), so the wide entries follow the narrow algorithm and the C locale instead of the console's wide code, and no console run checks the two. The console's `libc.prx` stores pointers to its collation state tables at offsets 0x10 and 0x18 of the facet; ours leaves them null, as only the facet's own functions read them. `do_transform` throws for input with embedded null characters, which the console drops depending on the output buffer size. The narrow result capacity (`length | 15`) and the over-aligned storage of results of 4080 characters or more follow the console's `libc.prx` code and are not checked on hardware. No module of the PPSA59322, PPSA76677 or PPSA97358 dumps in this tree imports either `_Getcat`, so neither has been exercised by a title.
+- [codecvt, numpunct, num_put and time_put _Getcat](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) build facets matching a bundled console `libc.prx` (dynsym decoded by NID, vtables disassembled): categories 2, 4, 4 and 5, sizes 0x10, 0x30, 0x10 and 0xb8. `codecvt<char>` reproduces the console virtuals (`noconv` conversions, `length` the shorter range); `numpunct<char>` copies its C-locale table (`""`, `.`, `,`, `false`, `true`). `num_put`/`time_put` formatting virtuals throw rather than fabricate output, and `time_put`'s `_Locinfo` table is unpopulated — the console's `do_put` bodies were not mirrored. The facets share the no-op `destroy`/`deleteObject`/`retain`/`release` base used for `collate`, so `numpunct`'s static C-locale strings are never freed. Unlike `collate`, these `_Getcat` entries ignore the locale argument and always build the C-locale facet; the console's behaviour for a non-C name is unverified. `std::clog` and `std::wclog` are 0x400-byte zeroed objects like the rest of the `NSTDSTR` stream set (the console's `libc.prx` sizes `std::clog` at 96 bytes, measured from its dynsym `st_size`), and the `numpunct<char>::id` and `time_put<char>::id` objects are 8-byte zeros like the other facet ids.
 - [std::__throw_bad_variant_access](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) throws `std::bad_variant_access` with the `what()` string `bad_variant_access`, the one [LLVM libc++](https://github.com/llvm/llvm-project/blob/main/libcxx/src/variant.cpp) returns, since the export carries libc++'s `__throw_bad_variant_access` name; the console's string is unverified. Onimusha: Way of the Sword (PPSA27836 01.000.001) imports it from `libc`, and its bundled `libc.prx` does not export it.
 - [std::bad_optional_access and std::_Throw_bad_optional_access](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) provide the exception type, constructor, destructor, and `what()` exports alongside `_Throw_bad_optional_access`, returning the `what()` string `bad_optional_access` matching Dinkumware and libc++ conventions; the console libc.prx string is unverified. PPSA26578 (issue #7624) and PPSA34015 import `_ZSt26_Throw_bad_optional_accessv` (`KwzEip7m6TM`) from `libc`, and fail to load on main with unresolved import (0xC0000139).
 - [The scanf family](../../../core/libs/prx/libc/src/Formatting.cpp) (libc), the `_s` forms included, decodes the input of the 16-bit wide conversions (`%ls`, `%lc`, `%l[`, `%S`, `%C`) on Linux as UTF-8, mirroring the narrow printf family, where FreeBSD uses the locale's `mbrtowc` (one byte per character in the C locale); the console's locale encoding is unverified. Input that is not UTF-8, a character outside the BMP, a scanset member outside ASCII, positional arguments next to a wide conversion and wide conversions in `fscanf` throw. Each character is stored as one 16-bit unit, widths and `_s` sizes count characters, and a `%lc` field cut short by the end of the input keeps what it read, as FreeBSD's `convert_wchar` does. Windows hands `%ls`, `%lc` and `%l[` to the host, whose `wchar_t` is 16 bits
 - [The scanf family](../../../core/libs/prx/libc/include/WindowsScanning.hpp) (libc) on Windows returns 0, as C17 and FreeBSD do, when input fails after only suppressed conversions have completed (`sscanf("12", "%*d%d", &value)`). Linux hands the format to glibc, which returns `EOF` there. On Windows the host stops a `%x`, `%X`, `%i` or `%p` after the `x` of a `0x` that no hex digit follows (or that the width cuts off), and a float conversion (`%e`, `%f`, `%g`, `%a`) after the `e` of an exponent with no digits (`1e`), where C17 and FreeBSD stop before the `x` or the `e`
 - [Guest path resolution](../../../core/libs/prx/libc/src/General.cpp) falls back to ASCII case-insensitive component lookup, following [shadPS4's host filesystem](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/file_sys/backends/host_fs.cpp). PPSA03747 requests `Skyrim.INI`, `Data/Video` and lowercase archive/plugin names that differ from the dump's filenames. Exact host names take precedence; multiple fallback matches throw instead of selecting an arbitrary file. Existing parent names are resolved when creating a new file, and guest mount aliases use the same ASCII comparison. Results are not cached, so renames and newly created files remain visible. Unicode case folding and PS5 behaviour for case-colliding host entries are unverified; host roots are used as supplied. Explicit native Windows drive and UNC paths bypass guest parent-component validation.. A relinked module's `<name>.guest.prx` is matched the same way when the original module is not beside it: Borderlands 4 (PPSA01494) loads `/app0/prx/libRenoirCore.PS5.prx`, which it ships as `librenoircore.ps5.prx`. A relinked module request that misses both the exact and the case-insensitive `<name>.guest.prx` takes the sibling whose stem (the name without its last extension, ASCII case ignored) equals the requested stem and that ends with `.guest.prx`, shortest name first: Unity IL2CPP titles load `Media/Modules/<name>.prx` and `Media/Plugins/<name>.prx`, and the relinker names the converted module after the ELF it was built from, `<name>.elf.guest.prx`. The console's module namespace is assumed to ignore case and the extension; several stem matches pick the shortest name instead of throwing, which is not measured on a console
 - [Colons in guest names](../../../core/libs/prx/libc/src/General.cpp) (libc) - on Windows (NTFS) a guest name containing `:` is not a plain file name: `name:stream` opens or creates the alternate data stream `stream` of the file `name`. Creating `/savedata0/C:file` makes an empty file `C` whose stream `file` holds the data, and `stat` of `/savedata0/C` then reports a regular file. `mkdir` of a name containing `:`, such as `C:` or `dir:x`, fails with EINVAL. `name:stream` already behaved this way before drive-letter components were kept under their mount
-- [tzname](../../../core/libs/prx/libc/src/Time.cpp) (libc) points at the host's zone names, read at load and again by `tzset`: the abbreviations a `TZ` string gives (`EST5EDT` is `EST` and `EDT` on both hosts), but on Windows without `TZ` the CRT's full names such as `GMT Standard Time`, which ICU's [uprv_tzname](https://github.com/unicode-org/icu/blob/457157a92aa053e632cc7fcfd0e12f8a943b2d11/icu4c/source/common/putil.cpp#L1244-L1264) (ES-DE in PPSA99169) cannot map to a zone ID. A zone with no daylight-saving time has `tzname[1]` empty on Windows and equal to `tzname[0]` on Linux, where FreeBSD leaves three spaces. The console's names are not known
-- [Trailing slash on a mount alias](../../../core/libs/prx/libc/src/General.cpp) (libc) - on Windows a trailing slash after a file name under a mount alias such as `/savedata0` is still dropped, so `unlink`, `rename`, `open` and the other path calls act on the file where FreeBSD 11.4's `lookup()` fails with `ENOTDIR`; Linux and macOS pass the slash to the host, as for paths outside an alias
+- [tzname](../../../core/libs/prx/libc/src/Time.cpp) (libc) points at the host's zone names, read at load and again by `tzset`: the abbreviations a `TZ` string gives (`EST5EDT` is `EST` and `EDT` on both hosts), but on Windows without `TZ` the CRT's full names such as `GMT Standard Time`, which ICU's [uprv_tzname](https://github.com/unicode-org/icu/blob/457157a92aa053e632cc7fcfd0e12f8a943b2d11/icu4c/source/common/putil.cpp#L1244-L1264) (ES-DE in PPSA99169) cannot map to a zone ID. The console's names are not known
 - [localtime, mktime](../../../core/libs/prx/libc/src/Time.cpp) (libc) on Windows convert through the CRT's `localtime_s` and `mktime`, which accept about 1970 to January 3001 UTC and apply the CRT's daylight-saving rule. A time outside that range is converted a whole number of 400-year Gregorian cycles away, where the calendar repeats, so it gets the rule the CRT applies to that year and not the zone's historical one. On macOS `mktime` converts through the host's `mktime`, which refuses every year before 1900. A local time before 1900 is instead solved for directly: the offset `localtime_r` gives for a candidate time, which follows the zone's history (local mean time before its first transition), is subtracted from the local fields, and the step is repeated until the offset holds. `tm_isdst` is not consulted there, so a time with `tm_isdst` set where the zone had no daylight offset is taken as standard time. FreeBSD's [`time1`](https://github.com/freebsd/freebsd-src/blob/stable/11/contrib/tzcode/stdtime/localtime.c#L2036) would instead shift it by the difference between one of the zone's daylight types and a standard one. `gmtime` converts every time whose year fits an `int` on both hosts.
 - [strftime and asctime](../../../core/libs/prx/libc/src/Time.cpp) (libc) follow FreeBSD 11 [strftime.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libc/stdtime/strftime.c) and [asctime.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/contrib/tzcode/stdtime/asctime.c) with the C locale on every host, not measured on the console; other locales are not implemented. `%s` follows FreeBSD 9 and 11 and is the local-time `mktime` of the broken-down time (current FreeBSD uses `tm_gmtoff`), which is -1 on Windows outside the range above. `%Z` is `tm_zone`, or `tzname[tm_isdst != 0]` when it is null and `tm_isdst` is not negative. The two-digit year warning FreeBSD writes to `stderr` when `CHECK_STRFTIME_FORMATS_FOR_TWO_DIGIT_YEARS` is set is not written
-- [wcsftime](../../../core/libs/prx/libc/src/Time.cpp) (libc) follows FreeBSD 11.4's [wcsftime.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/locale/wcsftime.c) over this library's `wcsrtombs`, `strftime` and `mbsrtowcs` in the single-byte C locale of [none.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/locale/none.c), with the guest's 16-bit `wchar_t`, without console verification. It has the `strftime` gaps above. A format unit above 255 returns 0 with `EILSEQ`; an empty result, a result that does not fit and a null buffer return 0 with `errno` unchanged, discarding the `ERANGE` or `EINVAL` that the Windows CRT's `strftime` sets. A null format or `tm` throws, where FreeBSD dereferences it (a null `tm` is read there only when the format has a conversion that needs it)
+- [wcsftime](../../../core/libs/prx/libc/src/Time.cpp) (libc) converts the format to UTF-8, runs this library's `strftime` and converts the result back, where the console's `libSceLibcInternal.sprx` (0x854e0) copies literal wide characters and expands each conversion straight into the buffer; the results match for the formats tried, and it has the `strftime` gaps above. A result that does not fit returns 0 with the buffer untouched, where the console leaves the characters written so far. A null buffer returns 0, where the console writes through it, and a size too large for the narrow buffer returns 0 with `EINVAL`, where the console formats as usual. A null format or `tm` throws
 - [syslog](../../../core/libs/prx/libc/src/Syslog.cpp) (libc) writes each message to `stderr` as `[syslog:<priority>] <message>`, with a newline added when missing, instead of sending it to the console's system log. Priority and facility handling follow FreeBSD's `vsyslog`: `%m` expands to the guest errno's message, unknown bits are reported (as priority 0x23, since FreeBSD passes `LOG_ERR|LOG_CONS|LOG_PERROR|LOG_PID` as the priority) and masked, a missing facility becomes `LOG_USER` or the facility set by `openlog`, and errno is preserved. `openlog` applies its identity and `LOG_PID`; a null identity retains the previous one, and a valid nonzero facility replaces the default. `closelog` clears the identity but retains the options and facility, as in FreeBSD 11; when no identity is set, FreeBSD falls back to the program name, which this backend does not emit. `LOG_PERROR` has no extra effect because stderr is the emulated log sink; `LOG_NDELAY`/`LOG_ODELAY`, `LOG_NOWAIT` and `LOG_CONS` have no daemon, child or console backend to control. `setlogmask` follows [FreeBSD 11](https://github.com/freebsd/freebsd-src/blob/8d2708de5d6112a492744d367cfdfb8fd219227a/lib/libc/gen/syslog.c): the process-wide mask defaults to 0xff, zero queries it, and nonzero values replace it; masked messages are skipped before formatting, including the unknown-priority diagnostic. The console's mask behaviour is unverified
 - [fwscanf, vfwscanf, wscanf, vwscanf and their `_s` forms](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) run the `swscanf` scanner on characters read with `fgetwc`, so everything listed for `swscanf` in this file applies to them. As in the console's `libc.prx`, a field takes characters while they can still begin a valid item, so a failed field such as `0x` for `%x` stays consumed, and only the character that ended the scan goes back to the stream. That character is pushed back as its UTF-8 bytes with `ungetc`, because `ungetwc` takes single bytes only; the Windows C runtime guarantees one byte of push-back, so a non-ASCII lookahead can be lost there. A null stream or format returns `EOF`; the console checks them only in the `_s` forms.
 - [daemon](../../../core/libs/prx/libc/src/Process.cpp) (libc) throws: forking into the background is not supported. PPSA85300 imports it and fails to load without it. VLC 3.0 calls it only when its `daemon` option is set ([libvlc.c](https://github.com/videolan/vlc/blob/6de05adcbaf2e8b85fe86aad4169393098628119/src/libvlc.c#L190-L197)), and the title starts libVLC with `--ignore-config` and without `--daemon` ([player.cc](https://github.com/ZiZc3/VLC/blob/f3253020a64368153233ede29183014c0b6c8979/src/player.cc#L960-L981))
-- [_WStoul](../../../core/libs/prx/libc/src/Strings.cpp), [_Iswctype](../../../core/libs/prx/libc/src/RuneLocale.cpp), [swscanf_s and swscanf](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) - `_WStoul` is `wcstoul` and throws for a base other than 0 or 2 to 36. `_Iswctype` takes the class numbers of Dinkumware's [xwcc.h](https://github.com/superna9999/ti-cgt6x/blob/cgt6x_7_3_4/include/xwcc.h) (1 `alnum` to 11 `xdigit`, 12 `blank`) and throws for any other value, including the FreeBSD masks `wctype` returns; the numbering is not confirmed on the console's `libc.prx`. `swscanf_s` follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as `unsigned int` like `sscanf_s` where K.3.9.1.5 specifies `rsize_t`; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns `EOF`, and a too small array gets a null first element as in `sscanf_s`. A literal mismatch is a matching failure and a field that is only a prefix, such as `0x` or `1e`, does not convert, as C11 requires; FreeBSD's `vfwscanf` reports an input failure for the first and converts the second. Integers out of range are truncated from `strtoll`/`strtoull`. `%p` follows FreeBSD 11's [vfwscanf.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdio/vfwscanf.c#L610-L615): a hexadecimal integer with an optional `0x`, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. It throws for `%S`, `%C`, unknown length modifiers, scanset ranges, `%n` with suppression or width, and narrow `%s`, `%c` or `%[` input that the C-locale `wcrtomb` cannot convert. `swscanf` runs the same scanner without the size arguments of `%s`, `%c` and `%[`, as FreeBSD's [swscanf.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/swscanf.c) passes its arguments to `vswscanf`, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning `EOF`, where C leaves those undefined. Neither variant is confirmed on a PS5 title
+- [_WStoul](../../../core/libs/prx/libc/src/Strings.cpp), [_Iswctype](../../../core/libs/prx/libc/src/RuneLocale.cpp), [swscanf_s and swscanf](../../../core/libs/prx/libc/src/ScanningWide.cpp) (libc) - `_WStoul` is `wcstoul` and throws for a base other than 0 or 2 to 36. `_Iswctype` takes the class numbers of Dinkumware's [xwcc.h](https://github.com/superna9999/ti-cgt6x/blob/cgt6x_7_3_4/include/xwcc.h) (1 `alnum` to 11 `xdigit`, 12 `blank`) and throws for any other value, including the FreeBSD masks `wctype` returns; the numbering is not confirmed on the console's `libc.prx`. `swscanf_s` follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as `unsigned int` like `sscanf_s` where K.3.9.1.5 specifies `rsize_t`; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns `EOF`, and a too small array gets a null first element as in `sscanf_s`. A literal at end of input returns the number of assignments, including zero, rather than `EOF` as FreeBSD does, as reported from the console scanner in #8479; `%%` at end of input still returns `EOF`. A literal mismatch is a matching failure, where FreeBSD's `vfwscanf` reports an input failure. An incomplete floating exponent such as `1e+` converts its mantissa, as reported from the console scanner in #8479; other incomplete exponent forms are not separately verified. A short `%c` field is currently a matching failure without storing its available prefix, while #9321 reports that the console stores a short `%3lc` field; its return count, partial-output extent and precedence are unverified. An integer field that is only a prefix, such as `0x`, does not convert; FreeBSD's `vfwscanf` pushes back the `x` and converts the `0`. Integers out of range are truncated from `strtoll`/`strtoull`. `%p` follows FreeBSD 11's [vfwscanf.c](https://github.com/freebsd/freebsd-src/blob/4ab2e064d7950be84256d671a7ae93f87cc6aa36/lib/libc/stdio/vfwscanf.c#L610-L615): a hexadecimal integer with an optional `0x`, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. `%S` and `%C`, with any length modifier or `*`, end the scan as a matching failure, as the console's Dinkumware scanner in PPSA21564's `libc.prx` treats them as invalid conversions; this was read from the module, not run on a console, and whether input ending before them is an input failure instead is unverified. It throws for unknown length modifiers, scanset ranges, `%n` with suppression or width, and narrow `%s`, `%c` or `%[` input that the C-locale `wcrtomb` cannot convert. `swscanf` runs the same scanner without the size arguments of `%s`, `%c` and `%[`, as FreeBSD's [swscanf.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/stdio/swscanf.c) passes its arguments to `vswscanf`, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning `EOF`, where C leaves those undefined. Neither variant is confirmed on a PS5 title
 - [flock](../../../core/libs/prx/libc/src/FileLock.cpp) (libkernel) on Windows shares one lock state between duplicated descriptors, following FreeBSD 11.4's [flock(2)](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libc/sys/flock.2). Independent opens have separate states; closing a descriptor or reopening a stream drops only its reference. Lock transitions on one open file description are serialized. The lock is a host [LockFileEx](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-lockfileex) lock on one byte at offset 2^63 - 2, which no file reaches, so it excludes other `flock` calls and leaves reads, writes and mapped views alone, like FreeBSD's advisory locks. Console behavior, signal interruption and concurrent closure of a descriptor while its lock call is pending are unverified.
 - [std::_Throw_Cpp_error](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) follows Dinkumware `thread0.cpp` ([VC12](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/thread0.cpp), [STL](https://github.com/microsoft/STL/blob/da52dc0f/stl/src/thread0.cpp)), without console verification. Codes outside 0..6 throw `std::out_of_range`, the deleting destructor throws, and STREAMS errnos absent from FreeBSD 11.4 [`errno.h`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/sys/errno.h) (`ENODATA`, `ENOSR`, `ENOSTR`, `ETIME`) are omitted. Codes 0..6 throw a 32-byte [VC12 `system_error`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/system_error) with FreeBSD errnos (16, 22, 3, 12, 1, 11, 35), a static `generic_category` (not `_Generic_object`), and unverified 40-byte [GuestLocale::String](../../../core/libs/prx/libc/include/GuestLocale.hpp) messages from [`syserror.cpp`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/syserror.cpp)
 - [Call tracing](../../../core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp) (`--trace-imports`, `APS5_TRACE_CALLS`) is missing on macOS and records only the entry of a call, not its arguments or result. One process-wide ring keeps the last 65536 calls, so a busy thread pushes the others out; the reporting thread's own calls are listed only while they are still in that ring. Calls are counted per traced target; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and `xmm0` to `xmm7`; wider vector arguments survive only while the recording code avoids AVX, which is untested. Linux has no crash report, so it prints the trace only on `SIGABRT` (guest or host `abort()`), not on `SIGSEGV`; a caller in a module loaded after the last traced import prints without a module name, and a thread aborting while another writes the report waits for it at most 2 seconds
 - [_Dtest](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows Dinkumware double classification matching _FDtest: finite values return -1, subnormals -2, zeros 0, infinities 1, and NaNs 2.
 - [app0.zar](../../../core/libs/prx/libc/src/AppArchive.cpp) (libc) - a [ZArchive](https://github.com/Exzap/ZArchive) beside `app0/` is a read-only layer under it: a path missing from `app0/` is looked up in the archive, case-insensitively. It is not a console format; titles ship their files in a PFS image instead. Resolving an archive-only path through any call other than the archive-aware libkernel ones throws, so `fopen`, `stat`, `access`, `opendir` and the rest do not read the archive yet, and `opendir` of a directory that exists in both places, `app0/` itself included, and `fdopen` of an archived descriptor throw instead of missing its entries or reading the null device. A damaged compressed block throws instead of returning `EIO`
 - [fopen_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - returns the errno of the failed open, as C11 K.3.5.2.1 leaves the nonzero value open and Microsoft's CRT returns errno; the console's Dinkumware `fopen_s` is not verified
+- [codecvt<wchar_t,char,_Mbstatet> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `H-TDszhsYuY`) is thirteen zeroed `uintptr_t` slots matching `st_size` 104 on title `libc.prx` from PPSA26344 and on `libSceLibcInternal.sprx` (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and seven conversion virtuals). Facet calls through the object fault until those methods are wired.
+- [num_put<wchar_t> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `59oywaaZbJk`) is fourteen zeroed `uintptr_t` slots matching `st_size` 112 on the title `libc.prx` from PPSA16833 (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and eight `do_put` virtuals). Facet calls through the object fault until those methods are wired.
 - [ios_base standard streams](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) `_Addstd` queues the stream in the standard stream table of Dinkumware [ios.cpp](https://github.com/ganboing/crt.vc12/blob/master/src/ios.cpp) (`stdstr`, `stdopens`, `_Addstd`, `_Ios_base_dtor`): it takes the first of slots 1 to 7 that is free or already holds the stream, and slot 8 (`NSTDSTR`) when none is, so slot 8 is shared by every stream past the first seven and registration never fails. It stores the 1-based slot index in the guest `IosBase::standardStream` (Dinkumware's `_Stdstr`, where 0 means not a standard stream) and counts the stream objects registered per slot; registering the same stream again reuses its slot and raises its count. Measured on a PS5 (firmware 13.60) from a homebrew payload calling the system `libSceLibcInternal` export: in a process whose own standard streams already hold slots 1 to 7, twelve distinct streams and a repeated one all get 8, written as a 64-bit value at offset 0x8 with no other byte of the object touched; the assignment of slots 1 to 7 to fresh streams is not observable there and follows VC12. The counts are `int`, not VC12's `char`, and the registration and the destructor lock the table where VC12 locks only `_Addstd`; a slot index past the table throws in the destructor instead of indexing out of bounds. The destructor decrements its slot's count and suppresses the rest of the destruction while the count stays positive, as `_Ios_base_dtor` does, and the slots of destroyed streams keep their pointer and stay reserved for that stream, as `stdstr` does. The streams themselves are destroyed by the title's own code as it registers them through `__cxa_atexit`; when the last reference closes, the unsupported stream storage and callback cleanup is still the throw it was and the locale is released as for a non-standard stream.
 - [std::_Pad, _Thrd_join, _Thrd_detach, _Thrd_id](../../../core/libs/prx/libc/src/Threads.cpp) (libc) follow Dinkumware V6.00 `thr/xthread` and `thr/threadcall.cpp` ([crt.vc12 `f1d47126`](https://github.com/ganboing/crt.vc12/tree/f1d47126/src/thr)), without console verification. `_Thrd_id` throws because whether the console returns `pthread_t` or a kernel thread ID and at what width is unknown; `_Launch` omits `_Cnd_do_broadcast_at_thread_exit` and calls `pthread_create` registered by libkernel with default attributes. The 32-byte pad layout (`_Go()` vtable at 0x0, `_Cnd_t` at 0x8, `_Mtx_t` at 0x10, `bool _Started` at 0x18) is assumed from VC12, unverified. Failing primitives or thread start throw the guest `std::system_error`; null arguments throw. `_Thrd_join` returns `_Thrd_error` (4) on `pthread_join` failure and truncates the exit code to `int`; `_Thrd_detach` returns `_Thrd_error` (4) on `pthread_detach` failure and throws when none is registered
+- [siginterrupt](../../../core/libs/prx/libc/src/Process.cpp) (libc) runs FreeBSD 11.4's `siginterrupt.c` sequence through the `sigaction` and the `_sigintr` set that libkernel registers at load: it reads the signal's disposition, sets or clears the signal's bit and `SA_RESTART`, and installs the disposition again. The set is written outside libkernel's registration lock, as FreeBSD's libc writes it without one; a call before libkernel has registered throws.
+- [collate<char> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `ruZtIwbCFjk`) is nine zeroed `uintptr_t` slots matching `st_size` 72 on the title `libc.prx` from PPSA16833 (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and three `do_*` virtuals). Facet calls through the object fault until those methods are wired; `_Getcat` still installs the host `g_collateVtable` for facets it builds.
+- [num_get<char>::id, time_get<char>::id and the num_get<char> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) are data objects, as the public SDK's libSceLibcInternal table declares them and as the other facet ids and the `num_put` and `codecvt` vtables are kept: the ids start at zero and the vtable is 17 zeroed slots, the 136-byte size of `KfcTPbeaOqg` in the console's libSceLibcInternal, whose relocations fill the offset-to-top and typeinfo entries, the two destructors, `locale::facet::_Incref` and `_Decref`, and the eleven `do_get` of Dinkumware's crt.vc12 `xlocnum`, so a guest resolves the symbols and reads data, and a facet call through the vtable faults. libSceAmpr exported the three as throwing functions, which a data consumer reads as code; its qualified imports fall back to libc.
+- [printf family conversions](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) - Windows `FormatWindows` follows the title `libc.prx` `_Printf` measured from PPSA13934, PPSA07923, PPSA05916 and PPSA04158: `%q`, `%D`, `%O` and `%U` are unknown conversions; an unknown character is printed with its leading `%`, and width, `-` and discarded length modifiers behave as measured (`%5y` is `   %y`, `%hhz` is `%z`). `%%` takes a width. A trailing `%` reads past the format's NUL and is not reproduced; it throws. `#`, precision and a `0` without a width are ignored, as a payload process on a PS5 (firmware 13.60) printed `%#k` and `%.2k` as `%k`; `+`, space, `'` and `0` with a width on an unknown conversion are unverified and throw. On Linux a format with an unknown conversion also goes to this formatter
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 655556be0f..93435a1916 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -2,9 +2,11 @@
 
 ### Silent stubs
 
+- [SO_TIMESTAMP, SO_BINTIME](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - set and read back as their bits, as a payload process on a PS5 (firmware 13.60) answered them, but `recvmsg` adds no `SCM_TIMESTAMP` or `SCM_BINTIME` control message, which FreeBSD 11.4's `ip_savecontrol` and `ip6_savecontrol` add to a received datagram while the option is set; what the console's `recvmsg` returns was not measured
 - [sceKernelGetSocPowerConsumption](../../../core/libs/prx/libkernel/System/src/ThermalSensors.cpp) (libkernel) - returns `EINVAL` and writes nothing, as `sceKernelGetSocSensorTemperature` does when the host has no sensor: the host's package power is not read (Linux RAPL `energy_uj` is readable by root only, and Windows has no general source). The prototype is not documented. PS5LM Plus (PPSA99581) passes a zeroed 128-byte buffer and, on success, reads its first 32-bit word as milliwatts, accepting 1000 to 350000; on failure it shows 0 W
-- [scePthreadMutexattrSetprotocol](../../../core/libs/prx/libkernel/Pthread/src/Mutex.cpp) (libkernel) - accepts 0 to 2 as a PS5 (firmware 13.60) does and returns `EINVAL` otherwise, but the protocol is not stored or applied: priority inheritance and protection are not modelled. On the console a null or uninitialized mutex attribute returns `EINVAL` from the SCE attribute calls, `scePthreadMutexInit` takes an uninitialized attribute as the default one, and a destroyed mutex returns `EINVAL` from `scePthreadMutexDestroy`; a null mutex pointer crashed the payload and still throws
+- [scePthreadMutexattrSetprotocol, scePthreadMutexattrGetprotocol, scePthreadMutexattrSetprioceiling, scePthreadMutexattrGetprioceiling](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) - `scePthreadMutexattrSetprotocol` accepts 0 to 2 as a PS5 (firmware 13.60) does and returns `EINVAL` otherwise, but the protocol is not applied: priority inheritance and protection are not modelled. On the console a null or uninitialized mutex attribute returns `EINVAL` from the SCE attribute calls, `scePthreadMutexInit` takes an uninitialized attribute as the default one, and a destroyed mutex returns `EINVAL` from `scePthreadMutexDestroy`; a null mutex pointer crashed the payload and still throws
 - [pthread_mutexattr_setprotocol, pthread_mutexattr_getprotocol, pthread_mutexattr_setprioceiling, pthread_mutexattr_getprioceiling](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) - the protocol and the priority ceiling are stored and reported as in [FreeBSD 11 libthr](https://github.com/freebsd/freebsd-src/blob/releng/11.0/lib/libthr/thread/thr_mutexattr.c#L192-L245) (the ceiling is set or read only under `PTHREAD_PRIO_PROTECT`, and setting a protocol resets it to the highest `SCHED_RR` priority). A null, uninitialized or destroyed attribute returns `EINVAL` before the other arguments are checked; this error behavior is unverified on the console. Mutexes do not apply the protocol or ceiling: a priority-inherit or priority-protect mutex locks like a normal one and does not change its owner's priority
+- [sceCoredumpSetUserDataType](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `Uxqkdta7wEg`) - `(int type)` follows the PS5 12.00 `libkernel.sprx` at 0x138B0: the sign-extended `type` goes to syscall 601 (command 29, third argument 0), and the raw result comes back with no SCE code mapping, so a kernel error is -1 with `errno` set. Which types the kernel accepts is not measured. No dump is produced here, so every type returns 0. Palworld (PPSA23126, #2598) and Hello Neighbor (PPSA35154, discussion #6991) import it; #4144 left it throwing because no signature was known
 - [sceKernelGetMainSocId and sceKernelGetCpumode](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) both return 0, and [sceKernelGetCpuFrequency](../../../core/libs/prx/libkernel/Time/Time.cpp) returns the host TSC frequency measured for `sceKernelGetTscFrequency`, not the console CPU clock. The PS5's SoC id and CPU mode are unknown; shadPS4's PS4 values are [0x710f10/0x740f30 and 0, 2 or 5 from the param.sfo CPU-mode flags](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1a/src/core/libraries/kernel/process.cpp). PPSA99203 only logs them (`[console] main SoC id: result=%#x out=%#x`, `CPU: %llu Hz, cpumode %d`), passing a pointer that `sceKernelGetMainSocId` leaves untouched
 - [sceKernelEnableDmemAliasing](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) returns 0 and changes nothing: direct memory can always be mapped more than once here, as `DoMapDirect` in [DirectMemory.cpp](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) only checks that the physical pages are allocated, so there is no aliasing to turn on. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/libraries/kernel/memory.cpp#L39-L43) (PS4) sets a flag there that lifts the `EBUSY` its [`sceKernelMapDirectMemory2`](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/libraries/kernel/memory.cpp#L299-L301), and [`sceKernelMapDirectMemory` for SDK 2.50 and later](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/libraries/kernel/memory.cpp#L237-L242), return for direct memory that is [already mapped](https://github.com/shadps4-emu/shadPS4/blob/e0a466753a1aacbc8db8253be685bf7ab4d9daae/src/core/memory.cpp#L548-L553); that check is not applied here. The no-argument `int` signature follows shadPS4 and ProsperoEden (PPSA99008), which calls it before mapping the same direct memory again. Whether the PS5 refuses such a mapping without the call is unverified
 - [sceKernelInternalMemoryGetAvailableSize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - internal pool allocation and statistics are not implemented, so a non-null query throws without changing its output. Native null output returns -1; an absent pool returns -2, a failed statistics query returns -3, and success writes total pool bytes minus used bytes.
@@ -25,55 +27,60 @@
 - [kern.sdk_version](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctlbyname` reports the system software version as the 4-byte value `0x01000000` (1.00), the value `sceKernelGetSystemSwVersion` reports; a write returns -1 with `EPERM`. The major version is byte 3 and the minor version byte 2, in hex digits that read as decimal (13.60 is `0x1360xxxx`), as [Capy Mobile](https://github.com/khalifa007/CapyMobile/blob/2758c016/src/ps5/platform.c#L64-L71) (PPSA92280), [remote_lua_loader](https://github.com/n0llptr/remote_lua_loader/blob/7c2840e475/savedata/misc.lua#L195-L209) and the [lapse payload](https://github.com/NetflixNHack/Netflix-N-Hack/blob/605eb93ba5/PS4/payloads/lapse.js#L436-L450) read it. Capy Mobile only displays it. The console's firmware version is not modeled and the low two bytes are unknown
 - [kern.ostype, kern.osrelease, kern.version, kern.hostname, hw.machine](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctl` (1.1, 1.2, 1.4, 1.10, 6.1), `sysctlbyname` and `sysctlnametomib` serve the names `uname` reads as read-only strings: "FreeBSD", "11.4-RELEASE" and "FreeBSD 11.4-RELEASE\n", the values FreeBSD 11.4-RELEASE builds without source control information ([newvers.sh](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/conf/newvers.sh#L45-L52), [L293-L294](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/conf/newvers.sh#L293-L294)), the host name `gethostname` reports ("AnyPS5") and "amd64"; a short buffer returns `ENOMEM` and a write `EPERM`. The console's strings are not measured
 - [kern.osreldate](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - reports MIB `{CTL_KERN, KERN_OSRELDATE}` as `1104001`, FreeBSD 11.4's `__FreeBSD_version` in `sys/sys/param.h`; this is consistent with `kern.osrelease` and `kern.version` above, but the value reported by a PS5 title has not been measured.
+- [kern.boottime](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctl` {`CTL_KERN`, `KERN_BOOTTIME`} and `sysctlbyname` report a read-only 16-byte `struct timeval`, as FreeBSD 11.4's [`sysctl_kern_boottime`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_tc.c#L144-L163) does: the guest's `CLOCK_REALTIME` minus its `CLOCK_UPTIME`, taken at the first read and kept, so a later step of the host clock does not move it as FreeBSD's `tc_setclock` would. The value a PS5 title gets has not been measured.
 - [sceKernelGetProsperoSystemSwVersion](../../../core/libs/prx/libkernel/System/src/SoftwareVersion.cpp) (libkernel) reports system software version `0x01000000` ("01.000.000"); the console's firmware version is not modeled. The 0x28-byte block (a 64-bit size at 0, the version string at 8 and the packed version at 0x24) follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Kernel/KernelSystem.cs), which Prospero Multi Tools (PPSA99110) and Prospero Explorer (PPSA99109) are built with and which sets the size to 40, and the same fields in [etaHEN](https://github.com/etaHEN/etaHEN/blob/main/Source%20Code/daemon/include/ipc.hpp) and [shsrv](https://github.com/ps5-payload-dev/shsrv/blob/master/sh.c). A size other than 0x28 returns `SCE_KERNEL_ERROR_EINVAL` without writing; whether the console checks the size is unverified, since etaHEN and shsrv declare a 0x30-byte block and do not set it
 - [sceKernelGetAllowedSdkVersionOnSystem](../../../core/libs/prx/libkernel/System/src/SoftwareVersion.cpp) (libkernel) reports the system software version with the 12 patch bits set, `0x01000fff`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/98fd0689/src/core/libraries/kernel/kernel.cpp) does on the PS4 and as [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Kernel/KernelSystem.cs) describes it, which Prospero Explorer (PPSA99109) reads it through; a null pointer returns `SCE_KERNEL_ERROR_EINVAL`. The console's value and its errors are unverified
 - [sceKernelConvertUtcToLocaltime, sceKernelConvertLocaltimeToUtc](../../../core/libs/prx/libkernel/Time/Time.cpp) (libkernel) convert with the host time zone at the given instant, as libc `localtime` does, instead of the console's time zone setting. `west_sec` holds the standard-time offset in seconds east of UTC, despite its name, and `dst_sec` the daylight saving seconds in effect. This follows PPSA99203 ([PS5SX2](https://github.com/Swordpdf/PS5SX2/blob/b4cf55e87c34e8a2a1cd9302df4373e5a94d28f4/ps5/frontend/fe_ps5.cpp#L54-L63)), whose author saw a console write 7200 and 3600 into the 16-byte block; which zone that console was set to is not recorded, so whether `west_sec` includes daylight saving is not settled. [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/23c41333/src/core/libraries/kernel/time.cpp) also stores seconds east. PPSA99203 declares the last argument of `sceKernelConvertUtcToLocaltime` as `uint64_t*`; 32 bits are written. On Windows the standard offset and the daylight saving amount are the C runtime's current `_get_timezone` and `_get_dstbias` for every instant, as libc `localtime_s` uses them, so instants under a zone's earlier rules get today's offsets; a `TZ` variable does not set `_dstbias`, which keeps the value an earlier `_tzset` read from the system (0 when the system zone has no daylight saving), and summer time then adds nothing. In a repeated or skipped local hour, `sceKernelConvertLocaltimeToUtc` takes the offset in effect one standard offset earlier. Its last argument receives the zone's daylight saving amount whether or not it is in effect, found by sampling the host zone over the year around the result, while `dst_sec` is the amount in effect: the libc `mktime` that PPSA99109 bundles (text 0x70ebb-0x70ee5) subtracts that amount when `tm_isdst` is set outside summer time. That `mktime` passes `tm_isdst` as the second argument, which is ignored, so it does not choose the offset in a repeated hour. `sceKernelGettimezone` and the `gettimeofday` time zone still report no offset and no daylight saving. A host time the C runtime cannot convert throws
-- [getuid, geteuid, getgid, getegid and issetugid](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) report the root identity (0) and a process that never changed credentials (`issetugid` 0), as a jailbroken process has; the host user and group are not exposed to the guest. The values a title sees on a console are unverified
+- [getuid, geteuid, getgid, getegid, getresuid, getresgid and issetugid](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) report the root identity (0) and a process that never changed credentials (`issetugid` 0), as a jailbroken process has; the host user and group are not exposed to the guest. `getresuid` and `getresgid` follow FreeBSD 11.4's `sys_getresuid` and `sys_getresgid`, writing 0 to non-null pointers and leaving errno untouched on success. The values a title sees on a console are unverified
 - [sceKernelGetAppInfo](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - only `app_id` and the title ID (offset 0x10, up to 9 characters plus a terminator) are written; callers declare the structure with different sizes, so the rest is left alone. `app_id` is 1, the running title's id in libSceSystemService, which is a guess, not something measured. The error codes follow shadPS4: `EPERM` for another process, and 0 without writing anything for a null pointer.
 - [AMPR object layout and compact gathers](../../../core/libs/prx/libkernel/Apr/include/AprCommandBuffer.hpp) - the 24-byte object and offsets (type 0, cursor 4, count 8, capacity 12, pointer 16) follow [ampr_emu assertions](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_emu_command_buffer_types.h#L138-L143) and its [C declaration](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr.h#L41-L47). AnyPS5 represents the 32-bit type word as low 16-bit type and high 16-bit recording flags. Command encoding is AnyPS5 internal: opcode 29 and three 32-bit words encode the high offset byte, length minus one and low offset word. The 12-byte size reduces HFW's 1 MiB buffer pressure; it is not a claim about console opcode encoding. Existing 40-bit offsets and lengths 1 through 2^32 are retained; console behavior outside those limits is unverified.
 - [APR resolve ForEach result](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libkernel) - `sceKernelAprResolveFilepathsToIdsAndFileSizesForEach` returns the number of paths that resolved, with the per-path status in `results` and the failed ids/sizes set to the invalid id and 0. The [ampr_emu](https://github.com/drakmor/ampr_emu) bridge passes the count of its resolver through and does not show what is counted; counting successes is not confirmed on a title. The guest errno of the failing non-`ForEach` resolves is set through `__error_nid_postfix`
 - [APR reads past the end of a file](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libkernel) - a read that reaches the current end of the file on disk copies the bytes the file has and fills the rest of the destination with zeros; a read that comes back short before that end still throws. PPSA18605 resolves its settings file once, rewrites it one byte shorter and reads it again with the size that resolve returned. The console's behaviour for a read past the end of a file is unverified: it may zero-fill, leave the destination untouched or fail the command
 - [AMPR counter access](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and checks of `WaitOnCounter_04_00`, `WriteCounter_04_00`, `ConstructNop` and `ConstructMarker` taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, which hands counter commands to the console and does not show their effect. The counters are taken as 32 bits each: the 8-byte access of counter n spans n (low) and n + 1 (high), the 2- and 1-byte accesses select a half or a byte of the counter by its offset, waits compare at the access width (signed and wrapped compares included), the AND mask applies to both sides and the atomic writes wrap within the access. The `ConstructNop` type is not recorded
 - [APR gather and scatter reads](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures, argument checks and the read cursor taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, not confirmed on a title: each read leaves the file, the next file offset and the next destination; a gather reads that file at a new offset into the next destination, a scatter continues in the file into a new destination, a gather-scatter takes both. Recording one needs a read file since the last `ResetGatherScatterState`; like ampr_emu, `sceAmprCommandBufferReset` keeps that state, and a gather or scatter with no read before it in the submitted buffer throws instead of returning `SCE_AMPR_ERROR_APR_INVALIDGATHERSCATTERSTATE`
-- [AMM map, map direct and unmap](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and the protection mask (CPU, GPU, AMPR and ACP read and write) taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, which hands the remaining checks and the mapping to the console kernel; the mapper model taken from [PS5PCEM](https://github.com/iStark/PS5PCEM): `sceAmprAmmGiveDirectMemory` usage 1 gives the allocated direct memory to the pool plain maps take pages from, usage 0 only allocates it. Not confirmed on a title. The AMM virtual address ranges are a 256 GiB range (PPSA02015 places its heaps 64 GiB above the start of the range, so 32 GiB is too small, and reached 84 GiB above it in its first 159 s; KytyPS5 reports 512 GiB, but every 64 GiB-aligned 544 GiB window in the guest arena covers 448 to 608 GiB, and on Windows one host thread stack there is enough to block it) and a 32 GiB multimap range reserved on first use at the top of the guest arena with the start on a 64 GiB boundary (PPSA02015 tells its pool pointers from its heap pointers by address bits 28 to 35, which needs such a start for its layout), above the addresses that maps without `MAP_FIXED` are given lowest first and that titles derive their next hints from; the console's addresses are not known (ampr_emu takes them from `sceKernelMapperGetParam`), and a reservation that cannot be made there throws. Maps outside them throw. Addresses, sizes and direct offsets must be 16 KiB aligned. The memory type and the GPU mask are ignored, AMPR and ACP access maps as CPU access, unmapped pages go back to the pool and stay reserved. Submission runs the buffer before returning, the submit result is always 0 and a failing command throws; the AMM measures return errors sign-extended, as ampr_emu does. A map returns its target to the reservation before releasing the old pages, so pool exhaustion leaves that target reserved; mapping failure also restores the reservation before returning newly taken pages to the pool. The console's map failure and rollback behavior is unverified. `sceAmprAmmGetVirtualAddressRanges` throws for a null output
+- [AMM map, map direct and unmap](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and the protection mask (CPU, GPU, AMPR and ACP read and write) taken from the [ampr_emu](https://github.com/drakmor/ampr_emu) reimplementation, which hands the remaining checks and the mapping to the console kernel; the mapper model taken from [PS5PCEM](https://github.com/iStark/PS5PCEM): `sceAmprAmmGiveDirectMemory` usage 1 gives the allocated direct memory to the pool plain maps take pages from, usage 0 only allocates it. Not confirmed on a title. The AMM virtual address ranges are a 256 GiB range (PPSA02015 places its heaps 64 GiB above the start of the range, so 32 GiB is too small, and reached 84 GiB above it in its first 159 s; KytyPS5 reports 512 GiB, but every 64 GiB-aligned 544 GiB window in the guest arena covers 448 to 608 GiB, and on Windows one host thread stack there is enough to block it) and a 32 GiB multimap range reserved on first use at the top of the guest arena with the start on a 64 GiB boundary (PPSA02015 tells its pool pointers from its heap pointers by address bits 28 to 35, which needs such a start for its layout), above the addresses that maps without `MAP_FIXED` are given lowest first and that titles derive their next hints from; the console's addresses are not known (ampr_emu takes them from `sceKernelMapperGetParam`), and a reservation that cannot be made there throws. Maps outside them throw. Addresses, sizes and direct offsets must be 16 KiB aligned. The memory type and the GPU mask are ignored, AMPR and ACP access maps as CPU access, unmapped pages go back to the pool and stay reserved. A buffer may run after submission returns, the submit result is always 0 and a failing command throws; the AMM measures return errors sign-extended, as ampr_emu does. A map returns its target to the reservation before releasing the old pages, so pool exhaustion leaves that target reserved; mapping failure also restores the reservation before returning newly taken pages to the pool. The console's map failure and rollback behavior is unverified. `sceAmprAmmGetVirtualAddressRanges` throws for a null output
 - [AMM remap, multimap and protection changes](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures and the protection and mask checks taken from ampr_emu; the effects are inferred from the names, not confirmed on a title. A remap moves every page of a fully mapped range to the new address with the given protection and leaves the old range reserved; a multimap maps the same pages at a second address, anywhere in the AMM ranges, and a pool page goes back to the pool once its last mapping is unmapped; a multimap onto its own source range throws. A protection change sets the masked bits on every page of a fully mapped range; the memory type is recorded and ignored. A command on a range that is not fully mapped throws
 - [AMM PRT ranges](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libSceAmpr) - signatures, checks and their order taken from ampr_emu, where `MapAsPrt` is a map with the PRT flag and protection 0 and `AllocatePaForPrt` a memory type and protection change with mask 1019, both checking the buffer memory after its size; the effects are inferred from the names, not confirmed on a title. Unbacked PRT pages are zero-filled pages with GPU read access, so CPU reads see zeros instead of faulting and GPU writes fault instead of being dropped. `AllocatePaForPrt` backs each unbacked page with a pool page and sets the type and protection of backed ones; `RemapIntoPrt` moves a fully mapped range into a PRT range, its opcode argument (1011 when 0, as in ampr_emu) is recorded and ignored; `UnmapToPrt` returns the pages to the pool and zero-fills them again. A plain map, unmap or remap over a PRT range ends it; `AllocatePaForPrt`, `RemapIntoPrt` or `UnmapToPrt` outside a PRT range throws
 - [AMM kernel write commands](../../../core/libs/prx/libkernel/Apr/src/Apr.cpp) (libkernel) - signatures of `sceKernelWriteModifyMtypeProtectCommand` and `sceKernelWriteRemapIntoPrtCommand` taken from [ampr_emu's libkernel hook targets](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/include/ampr_libkernel_hook_targets.h), which forward to the real kernel; the measure mode (`dst` null reports the size, `outSize` null skips the report) follows ampr_emu's measure-then-record calls, not confirmed on a title. The range, protection and mask checks mirror the `libSceAmpr` siblings, and the recorded bytes match them exactly so the submitted buffer executes on the existing paths
 - [sceCoredumpWriteUserString](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `32KQRUK13kI`) - `(uint32_t, const char* text, int)` follows the console's `libkernel.sprx` (SDK 4.5x build of `J03950001`) at 0x13050: a null `text` returns `0x81180000`; otherwise the three arguments go to syscall 601 (command 10), whose `EPERM` becomes `SCE_COREDUMP_ERROR_NOT_IN_COREDUMP_HANDLER` (0x81180003), `EINVAL` `0x81180000`, and a success returns the value the kernel wrote back. Measured on a PS5 (firmware 13.60) from a homebrew payload with no core dump handler: the call succeeds with 0, the kernel rejects a first argument above 15 or a third outside 0 to 256 with `0x81180000`, and a 2047-character text is accepted. Those checks are reproduced and anything else returns 0; nothing is recorded, as there is no dump, and what the two numbers mean is unknown. PPSA16064 imports it
 - [sceCoredumpConfigDumpMode](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `gzLt9Qrauk0`) - `(int mode)` follows the same `libkernel.sprx` at 0x134D0: a mode other than 1 returns `0x81180000`; mode 1 issues syscall 601 (command 16, arguments 0 and 1) and returns 0 whether or not it fails, since only a raw return of 22 would map to `0x81180000`. No dump is produced here, so mode 1 returns 0 without the syscall. PPSA16833 imports it
 - [sceCoredumpGetStopInfoGpu_Agc](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `Jrs7UUkGOFo`) - `(void* info, size_t size)` follows the same `libkernel.sprx` at 0x137E0: a null `info` returns `0x81180000`; syscall 601 (command 21) failing with `EPERM` returns `NOT_IN_COREDUMP_HANDLER`; otherwise two `libSceAgcDriver` imports (NIDs `+NIAY3DWpOw` and `LgctzJSGy7s`, names unknown) decide between `0x81180005` and, for a `size` of 8, storing the second one's 64-bit result and returning 0, with any other size returning `0x81180000`. The handler is never invoked here, so a non-null `info` returns `NOT_IN_COREDUMP_HANDLER` without writing, assuming `EPERM` outside the handler as above; the AGC branch is not reached
-- [sceKernelInternalMemoryGetModuleSegmentInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the `(InternalSegmentInfo* result)` signature, the 16-byte `{address, size}` result and the choice of the main program's first segment follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L343-L355) only, which fills it through its `sceKernelGetLibkernelTextLocation` from the first segment of `eboot.bin`; whether the console reports that segment, the text of libkernel itself or the calling module's is unknown. The segment is the first one `sceKernelGetModuleInfo` reports for the main program, and 0 is returned. A null result throws. 44 audited titles that bundle their own `libc.prx` import it; no call has been observed
+- [sceKernelInternalMemoryGetModuleSegmentInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - returns the main program's first segment, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L343-L355) does through its `sceKernelGetLibkernelTextLocation`. In a payload process on a PS5 (firmware 13.60) both returned 0 with address and size 0, and a null result faulted (here it throws); what a title process gets is not known. 44 audited titles that bundle their own `libc.prx` import it; no call has been observed
 - [sceKernelGetModuleInfoForUnwind](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) - on Linux the tables come from `sceKernelGetModuleInfoFromAddr`, whose `eh_frame_size` includes the zero terminator, as measured on firmware 13.60 (reported in [#2419](https://github.com/boykopovar/AnyPS5/issues/2419), not reproduced here); on Windows it is assumed to stop before the terminator. LLVM libunwind's `CFI_Parser::findFDE` stops at the terminator or the length, whichever comes first, so it finds the same FDEs either way. Only the main executable and `.guest.prx` images report tables; other host images report none, as on Windows
 - [sceKernelGetModuleInfoForUnwind](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) - on Windows the `.ehmeta` tables and the image file name are cached per allocation base and dropped after a loader free (`dlclose`, `sceKernelStopUnloadModule`, the thread atexit release) when the module is no longer loaded. A table changed in place, or an image freed by anything other than the loader, is not noticed. An address inside an image of the Windows loader's module list whose tables are cached is resolved with `RtlPcToFileHeader` and no `VirtualQuery`; other addresses, and images without tables, still use `VirtualQuery`. The `.eh_frame` walk that finds its end is done once per image instead of once per call
-- [sceKernelGetModuleInfoFromAddr](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the 0x1A8-byte info layout follows the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation; a title's `libc.prx` reads only `id` (PPSA14632). The meaning of `flags` is unknown; only 2 is accepted. The input `st_size` is ignored, because PPSA21703's `libc.prx` passes an uninitialized 0x1A8-byte buffer; the full size is written back. The id is the `sceKernelLoadStartModule` handle of an image opened through the loader and otherwise a stable id from the same range. The name is the host file name without `.guest.prx`. An image with more than 4 load segments (the converted executable has 7) reports its first 4. `tls_offset` is 0 and `ref_count` is 1, as the host loader exposes neither. On Windows the module is the PE image holding the address: a relinked image reports its `.elf` sections as segments and the eh_frame_hdr recorded in `.ehmeta`, any other image its first 4 sections with memory access and the `.ehfram` section without an eh_frame_hdr; the TLS fields and `init_proc_addr`/`fini_proc_addr` are 0
+- [sceKernelGetModuleInfoFromAddr](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - as in a payload process on a PS5 (firmware 13.60), flags 1 finds any module and flags 2 refuses the system ones (`ESRCH`), here the host libraries; other flags clear the 0x1A8 bytes and return `EINVAL`, any failure clears them, `st_size` is left 0, and a null info returns `EFAULT` (with other flags the console faulted; here it throws). Flags 2 finding a title module was not measured. The layout follows [shadPS4](https://github.com/shadps4-emu/shadPS4). The id is the loader handle or a stable id from that range, and the name is the host file name without `.guest.prx`, where the console keeps `.sprx`. Only the first 4 load segments are reported. `tls_offset` is 0 and `ref_count` 1 (the console gave 5 for system modules). On Windows a relinked image reports its `.elf` sections and the `.ehmeta` eh_frame_hdr; the TLS fields and init/fini are 0
 - [sceKernelGetModuleList](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - lists the main program and every loaded `.prx` image in load order; host runtime libraries are left out. The handles are the ids `sceKernelGetModuleInfoFromAddr` reports, not the console's. The `(int32_t* handles, size_t count, size_t* actual)` signature and returning `ENOMEM` without writing `actual` after filling the first `count` handles when more images are loaded follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/libraries/kernel/process.cpp#L244-L264); whether the console writes any handles in that case is unknown
 - [sceKernelGetModuleInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the 0x160-byte layout (`st_size`, `name[256]`, 4 segments, `segment_count`, `fingerprint[20]`) follows [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_types.pas#L319-L337) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/module.h#L15-L31). Only that `st_size` is accepted, as in shadPS4; other sizes return `EINVAL`, a null pointer `EFAULT` and a handle `sceKernelGetModuleList` does not list `ESRCH`. Name and segments are the ones `sceKernelGetModuleInfoFromAddr` reports, on Windows from the same PE sections, so `prot` uses the read/write/execute bits 1/2/4, while fpPS4 and shadPS4 store the ELF `p_flags`. The fingerprint is left zero, as the host image does not carry it
 - [sceKernelGetModuleList2 and sceKernelGetModuleInfo2](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the title-module variants follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/kernel/process.cpp): `sceKernelGetModuleList2` lists what `sceKernelGetModuleList` lists without system libraries, and `sceKernelGetModuleInfo2` answers `EPERM` for a system library after the `EFAULT`, `EINVAL` and `ESRCH` checks of `sceKernelGetModuleInfo`. A system library here is a loaded `.prx` image that is not a relinked title module (`.guest.prx`); the main program and the title's own modules are listed. Not verified on the console. PPSA34063 imports both and fails to load without them
 - [sceKernelGetLibkernelTextLocation](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the `(void** address, std::size_t* size)` signature and the choice of the main program's first segment follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L338-L348); whether the console reports that segment, the text of libkernel itself or the calling module's is unverified. The segment is the first one `sceKernelGetModuleInfo` reports for the main program, and 0 is returned. A null argument throws.
-- [sceKernelReleaseFlexibleMemory](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - unmaps the range like sceKernelMunmap, as fpPS4 and prosper do; whether the console keeps the virtual range reserved after releasing its pages is unverified
+- [sceKernelReleaseFlexibleMemory](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - on a PS5 (firmware 13.60) the released range stays mapped, with its protection and contents (64 MiB checked after 0.5 s), and a fixed no-overwrite map over it fails with `ENOMEM`, as here. What it does to the flexible budget was not measured, because a payload process has none (`sceKernelAvailableFlexibleMemorySize` did not change on map or release); here the released bytes return to the budget while the pages stay mapped, and a later map over them charges them again. The host pages behind a released range stay committed until `sceKernelMunmap`, as `madvise` keeps them for every advice; freeing them would lose the contents the console still returns.
 - [sceKernelAvailableFlexibleMemorySize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - the segments of the title's executable and of its `.guest.prx` modules count against the configured flexible-memory budget (448 MiB by default) while loaded, for this size and for flexible maps. A title may declare a larger budget through `kernel.flexibleMemorySize` in `param.json`; this does not reduce the 13.5 GiB direct-memory size. Rejection of zero or a value not aligned to 16 KiB has not been measured on a console. This segment-accounting model follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/module.cpp#L165), which maps every segment of a module outside its system module directory as flexible memory on the PS4. [Counted](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) are the segments the title's ELF gives permissions, each rounded to 16 KiB pages; not counted are segments without permissions, the relinker's own blocks (on Linux both are the read/write/execute `PT_LOAD`s, plus the header block at file offset 0; on Windows everything outside the `.elf` sections) and the host system libraries. The Linux image carries no marker for the relinker's blocks, so they are told apart by those flags and that offset only: a title segment that is writable and executable, or starts at file offset 0, is not counted. A module whose segments exceed what is left still loads, and the available size then reads 0; shadPS4 fails the segment map instead ([memory.cpp](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/memory.cpp#L519-L524) returns `EINVAL`, [module.cpp](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/module.cpp#L168-L169) asserts). Which segments the PS5 charges, its rounding, whether system modules use the title's budget and when an unload releases the charge are not measured. PPSA15508 subtracts the reported size and a 10 MiB module allowance from its own 448 MiB budget at start-up and stops when the result exceeds its 146 MiB code and data limit ([#2883](https://github.com/boykopovar/AnyPS5/issues/2883))
-- [sceKernelAvailableDirectMemorySize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - how the console handles invalid arguments is not measured. A negative `search_start`, a `search_end` at or below `search_start` and an alignment that overflows when rounded up to 16 KiB return `EAGAIN` (`0x80020023`); bounds that are not multiples of 16 KiB are rounded inward, the alignment is raised to a multiple of 16 KiB and need not be a power of two, and a `search_end` past the pool is cut to it. fpPS4's HLE wrapper on its trunk branch refuses all of these with `EINVAL` ([ps4_map_mm.pas](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_map_mm.pas#L558-L570))
+- [sceKernelAvailableDirectMemorySize](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - its arguments follow a payload process on a PS5 (firmware 13.60) ([probes](https://gist.github.com/orezraey/42a06a7ea0d9fb57ac9c06eaf9e6756c)). One answer is not modelled: in a process that had not yet called `sceKernelGetDirectMemorySize` or otherwise touched direct memory, the console returned `EBADF` (`0x80020009`); here the call always searches the pool. Titles open the direct-memory device during start-up, so they are not expected to see it
+- [sceKernelReleaseDirectMemory](../../../core/libs/prx/libkernel/DirectMemory/MemoryPool.cpp) (libkernel) - releases the allocated pages of the range and skips pages that are not allocated, returning 0, while `sceKernelCheckedReleaseDirectMemory` returns `ENOENT` for them, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/c206f35a546230d9c9808b823c0f36f5850cd4af/src/core/memory.cpp#L295-L313) does; not measured on a console. Absolum (PPSA28311) releases such a range when it disposes of its video logos
 - [Memory protection bits 0x100 and 0x200](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - taken as audio coprocessor (ACP) read and write, as in the [KytyPS5](https://github.com/KytyPS5/KytyPS5) and [etaHEN](https://github.com/etaHEN/etaHEN) headers; the coprocessor work runs on the host CPU, so they grant host read and read/write access like the GPU bits
 - [Protecting a host thread's stack](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - on Windows `sceKernelIsStack` reports a host thread's whole stack reservation, which Windows commits on demand from the top down behind a guard page. A protect over that range changes only the pages above the guard; the guard page and the reserved pages below it are left as they are, so the stack still grows and an overflow still raises a stack overflow. A protect that starts at the bottom of the reservation and stops short of the guard page, as HotSpot makes its stack guard zones, is committed and protected. Windows moves the guard page down by committing the pages below it as read/write guard pages, whether they were reserved or committed, so those pages come in read/write as the stack grows to within one guard region of them (three pages on GitHub's runners). A protection other than read/write on them, `PROT_NONE` included, does not hold once the stack is that close, where on the console every page of the reported range takes the protection. Holding it would mean removing the thread's guard page and keeping the stack limit in its TEB by hand. On Linux the reported range of the main thread is mostly unmapped; the unmapped pages from the bottom of a protect up to the top of the stack are mapped read/write in place, then the protect is applied, so the stack never has to grow down to the protected pages, which Linux refuses within its stack guard gap (1 MiB by default) above a readable mapping. The pages below a protect stay unmapped and out of the stack's reach, where on the console the stack goes on below them
 - [Foreign guest module image protection on Windows](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMprotect` on Windows allows protection mutations on mapped PE images containing a `.elf0` section (as relinked guest modules produce, such as NVIDIA Real-time Denoisers `libNRD.prx` bundled in Dying Light 2: Stay Human PPSA02262), registering their sections into `GuestAllocations`. Host libraries and system DLLs (such as `libkernel.prx` and `kernel32.dll`) without a `.elf0` section continue to be rejected
 - [_umtx_op](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the mutex, condition variable, read-write lock, legacy lock and `SEM2` operations throw, and so does a misaligned object. Implemented as FreeBSD 11's [kern_umtx.c](https://github.com/freebsd/freebsd-src/blob/stable/11/sys/kern/kern_umtx.c): `UMTX_OP_WAIT`, `UMTX_OP_WAKE`, `UMTX_OP_WAIT_UINT`, `UMTX_OP_WAIT_UINT_PRIVATE`, `UMTX_OP_WAKE_PRIVATE`, `UMTX_OP_NWAKE_PRIVATE`, `UMTX_OP_SEM_WAIT` and `UMTX_OP_SEM_WAKE` (the last two built under `COMPAT_FREEBSD9`/`10`). Operations 0 and 1 fail with `EOPNOTSUPP`, as measured on a PS5 (firmware 12.70). The `SEM2` operations, 23 and 24, were measured on the console and returned `0` for a count of 0 where FreeBSD would time out, so they stay unimplemented.
+- [sceKernelCreateSema, sceKernelPollSema, sceKernelSignalSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - a poll, a signal or a second delete of a deleted semaphore reads freed memory here, where the console returns `0x80020003` (ESRCH) ([measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L17-L19)). A null output pointer to `sceKernelCreateSema`, an attribute above 2, a negative maximum and a negative signal count throw, as they were not measured. `SCE_KERNEL_ERROR_EINVAL` for an initial count above the maximum or negative, a maximum of 0, a null name, a poll of 0 or above the maximum and a signal of 0 is [measured](https://github.com/mattias800/prosper/blob/3ea5cb9a846b6dcd00f5073360462bbda4f72288/prosper/tests/data/console_oracle/kernel.golden.tsv#L10-L23).
 - [sceKernelSyncOnAddressWait](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the only known caller passes a null timeout and a name string as the fourth argument; the timeout is assumed to point to microseconds like the other kernel waits, and the name is ignored
 - [sceKernelSyncOnAddressWait8 / sceKernelSyncOnAddressWait16 / sceKernelSyncOnAddressWait32 / sceKernelSyncOnAddressWait64](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - libc's `__std_atomic_wait_direct_8/16/32/64` pass a microsecond timeout or null and ignore the result; the by-value comparand, return values and the 2- and 8-byte alignment of Wait16 and Wait64 are assumed
 - [scePthreadRwlockDestroy, pthread_rwlock_destroy](../../../core/libs/prx/libkernel/Pthread/src/Rwlock.cpp) (libkernel) - measured on a PS5 (firmware 13.60): destroying a rwlock returns 0 whether it is free or held for reading or writing, and leaves 1 in the handle; every call on that handle then returns `EINVAL` until it is initialized again, and a zero handle is initialized on first use by the `scePthreadRwlock` calls as by the POSIX ones. A rwlock destroyed while held is not freed, so its memory leaks. Destroying a rwlock while another thread is acquiring it is not guarded
 - [scePthreadCondWait / scePthreadCondTimedwait](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) - before waiting, FreeBSD libthr's [`cond_wait_common`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_cond.c#L1992-L2029) checks ownership through [`_mutex_owned`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_mutex.c#L1166-L1178): an unowned mutex returns `EPERM`, while its destroyed marker returns `EINVAL`. An untouched adaptive static initializer (slot value 1) therefore returns `EPERM`; the test covers this, an uninitialized slot, a mutex owned by another thread, and the destroyed marker for both timed and untimed sce and POSIX waits. A recursive mutex locked several times is released completely for the wait and relocked to the same depth afterwards, as FreeBSD libthr does (`_mutex_cv_unlock`, `_mutex_cv_lock`). These FreeBSD-derived behaviors remain unverified on console hardware. Cancellation follows the [POSIX condition wait contract](https://pubs.opengroup.org/onlinepubs/9799919799/functions/pthread_cond_clockwait.html): the original mutex and recursive depth are restored before cleanup, and a canceled waiter forwards a wake to the remaining waiters. The host condition state is retained across mutex reacquisition so the guest can destroy and free its condition after notification; cancellation ordering and signal replacement are not measured on a console
-- [sceKernelSetEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - multi-waiter satisfaction follows fpPS4 in-order evaluation: registered waiters are evaluated in FIFO order and each satisfied waiter's clear mode is applied immediately to the pattern before evaluating subsequent waiters; this ordering is unverified on PS5 console hardware
-- [sceKernelOpenEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - returns the handle of an undeleted event flag this process created with the same name, and `SCE_KERNEL_ERROR_ENOENT` otherwise. Flags owned by other processes, such as the shell's `SceShellCoreUtilAppFocus`, do not exist here, and which attribute makes a flag openable on the console is not modelled. The error code for a missing name and the choice between flags sharing a name are unverified.
-- [sceKernelAioSubmitReadCommandsMultiple / sceKernelAioSubmitWriteCommandsMultiple / sceKernelAioWaitRequests / sceKernelAioPollRequests / sceKernelAioCancelRequest / sceKernelAioCancelRequests / sceKernelAioDeleteRequests](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - behaviour from shadPS4 (one id per request for the Multiple submits, cancel turns any request aborted and id 0 reports processing, wait mode 2 returns once one request completed, poll copies every state without waiting); the 128 requests or ids per batch limit is from SharpProspero, with an unknown error, so larger batches throw; wait modes other than 1 (and) and 2 (or) throw; null pointers, negative counts and invalid ids return the codes the single-request siblings use, checked before any state is written
+- [sceKernelOpenEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - opens only flags this process created with attribute 0x100. On the console, other processes' 0x100 flags, such as the shell's `SceShellCoreUtilAppFocus`, can be opened too. They do not exist here, so opening them returns `SCE_KERNEL_ERROR_ESRCH`. A null output with the name of an openable flag returns `SCE_KERNEL_ERROR_EFAULT`, the host's answer to the console's fault there, not a measured code. With a plain flag's name it returns `SCE_KERNEL_ERROR_ESRCH`, as measured; with a missing name it also returns `SCE_KERNEL_ERROR_ESRCH`, which was not measured.
+- [sceKernelCreateEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - when a call has both an invalid attribute and a name of 32 bytes or more, `SCE_KERNEL_ERROR_EINVAL` is returned, because the attribute checks run before the name length check. The console was only measured with long names and valid attributes (0x20 and 0x120), so which error it returns first is not known. Event flag handles are host addresses here, while the console returns small IDs.
+- [sceKernelAioSubmitReadCommandsMultiple / sceKernelAioSubmitWriteCommandsMultiple / sceKernelAioWaitRequests / sceKernelAioPollRequests / sceKernelAioCancelRequest / sceKernelAioCancelRequests / sceKernelAioDeleteRequests](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - one id per request for the Multiple submits and wait mode 2 returning once one request completed follow shadPS4. Requests run synchronously on submit, so cancel never finds one processing. The console's ids are not the small numbers used here (it returned 33, 0x2021, 0x4021)
+- [sceKernelWaitSema, sceKernelPollSema, sceKernelSignalSema, sceKernelCancelSema, sceKernelDeleteSema](../../../core/libs/prx/libkernel/Semaphore/src/Semaphore.cpp) (libkernel) - `SCE_KERNEL_ERROR_ESRCH` for a null handle follows [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/60c42b925c3d1e00008621b8587819999260ec31/src/core/libraries/kernel/threads/semaphore.cpp#L329-L366) (PS4), unverified on PS5. Handles are pointers, so a non-null handle that is not a live semaphore is not detected; shadPS4 returns `ESRCH` for any unallocated handle.
 - [scePthreadAttr setters and getters](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) (libkernel) - measured on a PS5 (firmware 13.60): a null or uninitialized attribute returns `EINVAL`, as does a null output of the stack size, detach state and scheduling parameter getters; a policy other than 1 and 3, an inheritance other than 0 and 4, or a priority outside 256 to 767 (or a null parameter) returns `ENOTSUP` (`0x8002002D`); a detach state other than 0 and 1 and a stack size below 16384 return `EINVAL`; any affinity mask is accepted. A null attribute pointer to `scePthreadAttrInit` and a null output of `scePthreadAttrGetaffinity` crashed the payload, so they still throw. A new attribute holds a 64 KiB stack size on the console and 1 MiB here, which the host code that runs on guest threads needs. `scePthreadAttrGetschedpolicy` and `scePthreadAttrGetinheritsched` were not measured and follow [FreeBSD 11.4 libthr](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L216-L262); a null output of `scePthreadAttrGetinheritsched` throws, since libthr writes through it unchecked
 - [scePthreadAttrGet](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) and [pthread_attr_get_np](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) - the returned scheduling policy is unmeasured on a console. Both report the recorded guest policy, following [FreeBSD 11.4 libthr](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L134-L164)
 - [pthread_getprio](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) is unmeasured on the console. NID `aO+WS2xWuo4` is named in the firmware 3.20 [export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libkernel.c). Its return and errno contract follows FreeBSD 11 [thr_getprio.c](https://github.com/freebsd/freebsd-src/blob/671fb7df97631020c42ce55527dc49fffe0656b7/lib/libthr/thread/thr_getprio.c): return the recorded guest priority, or -1 with `ESRCH` for an unknown or finished thread. The live-thread registry lock protects the read from a concurrent join. This reports guest scheduler state, not the host scheduling priority.
+- [pthread_rwlock_reltimedrdlock_np, pthread_rwlock_reltimedwrlock_np](../../../core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp) (libkernel) take `(rwlock, usec)`, a relative timeout in microseconds, and are `scePthreadRwlockTimedrdlock` and `scePthreadRwlockTimedwrlock` with POSIX error numbers, so they return what those return (`ETIMEDOUT` when the time runs out, at once for 0 while another thread holds the lock, and `EINVAL` for a destroyed lock); a zero lock is initialized as by `pthread_rwlock_rdlock`. FreeBSD 11.4 libthr has no such functions; the signature comes only from shadPS4, which registers one function for each NID and its `scePthreadRwlockTimed*` twin ([`rwlock.cpp`](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/libraries/kernel/threads/rwlock.cpp#L167-L179), 32-bit `usec`). Unverified on the console
 - [sceKernelGetAvailableCpumask](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - returns the default thread affinity, 0x1FFF (CPUs 0 to 12), as KytyPS5 does. Titles pin threads within it (PPSA02664 passes 0x1FFB, Hades II PPSA36082 0x3 and 0x3F); whether CPU 13 is available to a title is not confirmed
 - [sceKernelGetCurrentCpu](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - guest affinities are not applied to host threads, so the host CPU index is mapped into the calling thread's affinity clipped to `sceKernelGetAvailableCpumask` (the available mask when they do not overlap): host CPU n reports the (n modulo the CPU count)-th CPU of that mask, so a thread pinned to one CPU reports that CPU, as a FreeBSD `cpuset` guarantees on the console. Which CPU the console reports for a thread allowed on several is not known; shadPS4 returns 0
 - [pthread_attr_setsolosched_np](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) takes `(attr, int)` and stores the value through `scePthreadAttrSetsolosched`, returning `EINVAL` (22) for a null or uninitialized attribute like the other POSIX attribute setters. Only the name is public (aerolib `2+pVfgiEd7A`); the signature and behaviour follow the SCE twin, which [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/947627d10d4ef4b68ba3c0189aab6c368e70a8d2/src/kernel/pthread.cpp#L2188-L2199) and [sharpemu](https://github.com/sharpemu/sharpemu/blob/a2983692930564815a77f81e74c151268f5b935f/src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs#L891-L913) store as an `int` without a range check, and [PS5PCEM](https://github.com/iStark/PS5PCEM/blob/71de7681f06c5db59a1120a3bb554c86780c3f5f/src/hle/libs/kernel_threading.zig#L1396-L1398) implements this alias over it. On a PS5 (firmware 13.60) only 0 and 16 are accepted; every other value returns `ENOTSUP` (45, `0x8002002D` from the SCE call) and keeps the stored one, and the SCE calls return `EINVAL` for a null or uninitialized attribute. PPSA15878 passes 16. Threads created from the attribute are not scheduled differently; what solo scheduling does on the console is unknown. Returnal (PPSA01285 v03.000.005) stopped on it with `what(): pthread_attr_setsolosched_np_nid_postfix not implemented` (#2872, #1155); LEGO Horizon Adventures (PPSA14632, #734) and Palworld (PPSA23126, #2598) import it
 - [sceKernelMapFlexibleMemory / sceKernelMapNamedFlexibleMemoryInternal](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - flag 0x8000 is accepted and ignored; its meaning is not established. KytyPS5 (`GUEST_MAP_UNKNOWN_8000`) and sharpemu accept it without reading it. Every known caller is an SDK 9 `libc.prx` heap, which passes it with read/write protection and uses the mapping as an older `libc.prx` uses `sceKernelMapNamedFlexibleMemory` with flags 0: through the Internal variant in PPSA21564, through `sceKernelMapFlexibleMemory` in PPSA22520 01.000.011
 - [sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - sets the memory type of the direct mappings in the page-rounded range and of the direct memory behind them, as shadPS4 and prosper do (KytyPS5 ignores the type); the type is not validated, flexible pages in the range only get the protection, and a later map of the retyped direct memory reports the type it was allocated with. `sceKernelBatchMap2` operation 4 takes the same path with the entry type
 - [Map hints inside a reservation](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMapDirectMemory` and the flexible and anonymous maps place a mapping without `MAP_FIXED` at its hint address when the whole range lies in a range still reserved by `sceKernelReserveVirtualRange`, as if `MAP_FIXED` were set. Taken from PPSA01474, which reserves 64 GiB and then maps its heaps inside it with hints and no `MAP_FIXED`, and uses the hint addresses afterwards; not measured on the console. Hints outside a reservation, or over a range that is partly mapped, stay hints
-- [Fixed anonymous mmap](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `MAP_PRIVATE | MAP_ANON | MAP_FIXED` replaces the requested range through the existing guest mapping machinery and zeroes the new memory. `MAP_EXCL` is checked under the allocation-registry mutation lock, including virtual reservations, and returns `ENOMEM` without changing an occupied range; without `MAP_FIXED` it is `EINVAL`. Lengths are rounded to 16 KiB and fixed addresses must be aligned. The complete rounded range must lie inside the guest arena or, for POSIX fixed anonymous `mmap` on Windows, one current or registered native thread stack; other mapping APIs do not opt into stack replacement. Native stack replacement keeps the reservation, decommits and recommits fresh pages, and rejects foreign allocations, ranges spanning reservations and host `PAGE_GUARD` pages before mutation. Current-stack ranges must end at least 64 KiB below the active host frame; callers replacing another thread's stack must coordinate with that thread. If recommitting fails, the call returns `ENOMEM` with the range still reserved; thread cleanup attempts to recommit it before restoring write access. This follows FreeBSD 11.4 [argument validation and rounding](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L226-L299), [fixed replacement](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1455-L1464), and [collision errno](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1604-L1613). The console behaviour has not been measured. AnyPS5 starts the guest arena at 0x200000000, so the fixed path rejects the low 0x400000 address requested by PICO-8 PPSA99808. The console address-space layout is unmeasured; executable placement outside the host arena is tracked in #5217. Static catalog disassembly finds `0x1012` in PPSA98001/PPSA99808 and `0x5012` in PPSA99808; these titles were not run.
+- [Fixed anonymous mmap](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `MAP_PRIVATE | MAP_ANON | MAP_FIXED` replaces the requested range through the existing guest mapping machinery and zeroes the new memory. `MAP_EXCL` is checked under the allocation-registry mutation lock, including virtual reservations, and returns `ENOMEM` without changing an occupied range; without `MAP_FIXED` it is `EINVAL`. Lengths are rounded to 16 KiB and fixed addresses must be aligned. The complete rounded range must lie inside the guest arena or, for POSIX fixed anonymous `mmap` on Windows, one current or registered native thread stack; other mapping APIs do not opt into stack replacement. Native stack replacement keeps the reservation, decommits and recommits fresh pages, and rejects foreign allocations, ranges spanning reservations and host `PAGE_GUARD` pages before mutation. Current-stack ranges must end at least 64 KiB below the active host frame; callers replacing another thread's stack must coordinate with that thread. If recommitting fails, the call returns `ENOMEM` with the range still reserved; thread cleanup attempts to recommit it before restoring write access. This follows FreeBSD 11.4 [argument validation and rounding](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L226-L299), [fixed replacement](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1455-L1464), and [collision errno](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1604-L1613). The console behaviour has not been measured. Linux and Windows accept addresses from 64 KiB that no host mapping occupies, such as the 0x400000 imported by PICO-8 PPSA99808; macOS keeps the 0x200000000 start. Non-fixed private anonymous mappings keep their hint; null hints still use the 8 GiB area. On Windows the host's `KUSER_SHARED_DATA` always occupies 0x7ffe0000, so Wine's shared user data page (Forever Launcher PPSA99030) cannot be placed there. The console address-space layout is unmeasured; executable placement outside the host arena is tracked in #5217. Static catalog disassembly finds `0x1012` in PPSA98001/PPSA99808 and `0x5012` in PPSA99808; these titles were not run.
 - [Mapping hints with no room above them](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - a mapping without `MAP_FIXED` whose hint lies above the guest address space, or has no free range at or above it, is placed from the bottom of the guest arena, as FreeBSD 11.4's [`vm_mmap_object`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1569) retries through [`vm_map_find_min`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1555-L1584) from its minimum address. FreeBSD's minimum is the end of the largest possible data segment rather than the start of the arena, and the console's address-space layout is not measured. PS5CEMU-HAR (PPSA99360) gives `sceKernelReserveVirtualRange` a hint near its own code, which is a host address here because the relinked executable lies outside the guest arena, so its JIT gets memory more than 2 GiB from its code and does not start
 - [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in the [fpPS4](https://github.com/red-prig/fpPS4) reimplementation, Increment takes a reference on the loaded image containing the address and Decrement releases one; the variants without the leading underscore are assumed to match
 - [tcgetattr, tcsetattr](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel) - every file and pipe descriptor is taken as not a terminal (`ENOTTY`), and a socket gets `EADDRNOTAVAIL` for `AF_INET` and `EOPNOTSUPP` otherwise, as FreeBSD's `in_control` and `pru_control_notsupp` answer a termios ioctl; what descriptors 0 to 2 of a title are on the console, and whether any of them is a terminal there, is unknown
@@ -82,7 +89,7 @@
 - [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - a descriptor the socket poller reports as unknown that is below `GuestSockets::FirstDescriptor` is polled on the host instead of throwing (on Windows only a pipe, as above); an invalid host descriptor fails with `EBADF`, and mixed host and socket sets are polled in short alternating slices so neither side waits out the full slice alone. A descriptor that stops being a socket, a kqueue or a pipe during the wait fails the call with `EBADF` when it is closed and is selected again with the rest of the timeout when its number was reused, as FreeBSD 11.4's [`kern_select`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1129-L1140) looks every descriptor up again in each pass. A close that has already removed the descriptor from the guest's kqueue, pipe or file tables but not yet closed its host descriptor is seen by that new look-up as a descriptor of unknown kind, which throws on Windows and is polled through the host on Linux. Wobbly Life (PPSA29413) selects on file descriptors while streaming its bundles
 - [__progname](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - unknown data export
 - [environ](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - data export pointing to a fixed empty environment so titles that import it load; it is not the environment libc's `getenv` reads, so it lists none of those variables and `setenv`/`putenv` changes do not appear in it
-- [seteuid, setegid, setuid, setgid, setreuid, setregid, setgroups, getgroups](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - the guest process is assumed to run as root, with real, effective and saved user and group ids 0. As in FreeBSD's `sys_seteuid`, `sys_setegid`, `sys_setuid`, `sys_setgid`, `sys_setreuid` and `sys_setregid`, id 0 (or -1 for an unchanged `setreuid`/`setregid` id) is then accepted without a privilege check and changes no credential, so 0 is returned; any other id would change an id, which is not modelled, and throws. `setgroups` keeps the supplementary group list as `kern_setgroups` does (`NGROUPS_MAX` 1023, an empty list leaves the effective group as the only entry, a first entry other than 0 would change the effective group and throws) and `getgroups` reports it. The ids and privileges a title has on a console are unverified
+- [seteuid, setegid, setuid, setgid, setreuid, setregid, setresuid, setresgid, setgroups, getgroups](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - the guest process is assumed to run as root, with real, effective and saved user and group ids 0. As in FreeBSD's `sys_seteuid`, `sys_setegid`, `sys_setuid`, `sys_setgid`, `sys_setreuid`, `sys_setregid`, `sys_setresuid` and `sys_setresgid`, id 0 (or -1 for an unchanged `setreuid`/`setregid`/`setresuid`/`setresgid` id) is then accepted without a privilege check and changes no credential, so 0 is returned; any other id would change an id, which is not modelled, and throws. `setgroups` keeps the supplementary group list as `kern_setgroups` does (`NGROUPS_MAX` 1023, an empty list leaves the effective group as the only entry, a first entry other than 0 would change the effective group and throws) and `getgroups` reports it. The ids and privileges a title has on a console are unverified
 - [pthread_getname_np](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - a thread that has already been joined returns `ESRCH` (3) and its output buffer is left untouched, as measured on a PS5 (firmware 13.60) by the author of this entry; since [#4481](https://github.com/boykopovar/AnyPS5/pull/4481) the joined thread's object is retained, so the posix wrapper answers `ESRCH` for it instead of reading the retained name. A null name buffer is answered with `EFAULT` before that, an order the console table does not measure. The SCE sibling `scePthreadGetname` has no measured joined-thread behaviour on the console and still reads the retained object's name, so it is unchanged, as is the pre-existing dangling case of a thread that ended detached (its object is released at exit; see the scePthreadJoin entry)
 - [sceKernelGetOperationMode](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - the signature `(int* mode, int* submode)` comes from PPSA12544, which logs both values after the call and ignores the result. A homebrew payload on a PS5 (firmware 13.60) reads mode 2 and submode 0, nothing else is written, and the result register holds no status, so the function is taken to return nothing. Whether a title process reads the same values is unverified. Null outputs throw
 - [sceCoredumpGetStopInfoCpu](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) has no active coredump context. Native null/size validation is recovered, including both 8-byte and 16-byte records; valid requests return `NOT_IN_COREDUMP_HANDLER` without accessing the output. Active-handler data retrieval remains unimplemented.
@@ -91,7 +98,7 @@
 - [sceCoredumpWriteUserData, sceCoredumpDebugTextOut](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) have no active coredump report. WriteUserData validates a nonnull buffer and size at most `INT32_MAX`, including zero; accepted requests return the sign-extended outside-handler error. DebugTextOut still prints to stderr instead of a report; its validation and report integration remain unverified.
 - [sceCoredumpAttachUserFile, sceCoredumpAttachMemoryRegionAsUserFile](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) cannot write files to an active coredump. Native null-name checks, the signed 32-bit memory length and SDK 6.50 flag validation are recovered. Nonnegative requests return the outside-handler error; negative memory lengths are ignored after name/flag validation. Kernel-side path handling and capture limits remain unimplemented.
 - [sceKernelAddTimerEvent](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) - `usec` is taken as the period in microseconds; re-adding an existing timer keeps its pending expiration count and restarts the period from the time of the call, where FreeBSD 12+ `filt_timertouch` clears pending expirations on `EV_ADD`; `usec == 0` fires on every wait. None of this is confirmed on a PS5 title
-- [sceKernelWaitEqueue](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) - a level-triggered user event (`sceKernelAddUserEvent`) is reported at most once per call, as in FreeBSD `kqueue_scan` (`sys/kern/kern_event.c`), which re-queues a reported knote without `EV_CLEAR` or `EV_DISPATCH` behind the scan marker, and kevent(2), where several triggers do not produce several kevents. Not measured on a console. Events are scanned in list order and the list is not rotated, so when `num` is smaller than the number of ready level events the later ones can starve, where FreeBSD moves a reported level knote to the tail. Several completions of one AMPR or VideoOut event within one call are returned as separate entries, where FreeBSD would aggregate them; the Orbis behaviour is unconfirmed
+- [sceKernelWaitEqueue](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) - a level-triggered user event (`sceKernelAddUserEvent`) is reported at most once per call, as in FreeBSD `kqueue_scan` (`sys/kern/kern_event.c`), which re-queues a reported knote without `EV_CLEAR` or `EV_DISPATCH` behind the scan marker, and kevent(2), where several triggers do not produce several kevents. Not measured on a console. A reported event moves to the end of the list, so events are reported in the order they were last reported, and those never reported come first in registration order. FreeBSD `knote_enqueue` queues them in the order they fire. Several completions of one AMPR or VideoOut event within one call are returned as separate entries, where FreeBSD would aggregate them; the Orbis behaviour is unconfirmed
 - [AC1FtjqMCL0](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
 - [0iEKNAvT600](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
 - [2cELEBPdYQ0](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - unknown name, signature
@@ -112,21 +119,28 @@
 - [sceKernelGetCpuTemperature, sceKernelGetSocSensorTemperature](../../../core/libs/prx/libkernel/System/src/ThermalSensors.cpp) (libkernel) - read the host's thermal sensors: on Linux from `/sys/class/hwmon` and `/sys/class/thermal`, on Windows from the ACPI thermal zones (`MSAcpi_ThermalZoneTemperature` over WMI) and the storage temperature property of the first physical drive. Sensor 0 is the CPU/package value, 1 the first other value and 2 an NVMe value; a host that exposes none reports every sensor as unsupported (`EINVAL`). The console's SoC channel count and meanings are hardware-dependent and differ from the host's, the host sensors are not the console's, the ACPI reading is unavailable on many machines, and the storage temperature property is numbered 52 on Windows 10 2004 and later and 22 before it, so the mapping, the values and the unsupported-input error are unverified; the storage channel was checked against the drive's own SMART composite temperature on one NVMe host (`StorageDeviceTemperatureProperty`, 36 °C on a WD_BLACK SN7100). `sceKernelGetCpuTemperature` reports sensor 0. PPSA99058 and PPSA99420 call both
 - [LinuxProtFromSce](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - protection bits 0x100 and 0x200 are accepted and assumed not to affect host CPU access; host protection is derived only from the read, write and execute bits
 - [getdtablesize](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - returns the smaller of the `RLIMIT_NOFILE` soft limit of `getrlimit` and the host's `getdtablesize()`, capped at `INT_MAX`: FreeBSD returns the smaller of the `RLIMIT_NOFILE` soft limit and `maxfilesperproc` ([`sys_getdtablesize`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L338-L355)), and the host call supplies that bound on macOS, where the soft limit alone is not one (`setrlimit` accepts soft limits above `maxfilesperproc`, `RLIM_INFINITY` included); `maxfilesperproc` is not measured on the console. The guest limit is the host's soft limit, raised to the hard limit when libkernel loads only on Linux: `core/libs/prx/libkernel/File/src/OpenFileLimit.cpp` is `__linux__`-only, so on macOS the guest gets whatever soft limit the host process inherited. VLC (PPSA85300) imports it for a `closefrom` loop in the child of its spawn helper ([libc_stubs.c](https://github.com/ZiZc3/VLC/blob/d46be6a68f4244466b041c2dc1b640915ac1a983/ps5/compat/libc_stubs.c#L66-L72)), which never runs because its `fork` fails with `ENOSYS`
-- [close, sceKernelClose](../../../core/libs/prx/libkernel/File/src/HostStreams.cpp) (libkernel) - descriptors 0 to 2 that are open when libkernel loads belong to the host process: closing one fails with `EBADF` and leaves it open. The console's result is unknown. PPSA21703 calls `sceKernelClose(0)` repeatedly; closing the host stream let the host C runtime give descriptor 0 to the next file opened, which the next call then closed
+- [close, sceKernelClose](../../../core/libs/prx/libkernel/File/src/HostStreams.cpp) (libkernel) - descriptors 0 to 2 that are open when libkernel loads belong to the host process: closing one fails with `EPERM` (`sceKernelClose`: `0x80020001`) and leaves it open, as closing the open descriptors 0 to 2 of a payload process did on a PS5 (firmware 13.60); whether a title process can close them is unverified. PPSA21703 calls `sceKernelClose(0)` repeatedly; closing the host stream let the host C runtime give descriptor 0 to the next file opened, which the next call then closed
 - [sceKernelPrintBacktraceWithModuleInfo](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) - imported by PS4 titles, which do not load without it, and added without an implementation: declared without parameters, every call throws
 
+- [pthread_timedjoin_np](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel, NID `PkS44IGrDkM`) - the signature follows [ps5-payload-dev/sdk](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/pthread_np.h#L71); deadline validation, absolute realtime deadlines, error precedence and join ownership follow [FreeBSD libthr](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libthr/thread/thr_join.c). The [public 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libkernel.c) lists this NID, but PS5 behavior and module/library versions have not been measured. Realtime is rechecked at most two seconds apart while waiting. After guest cleanup completes, final native thread teardown uses the existing unbounded join and may finish after the deadline; host teardown is not bounded by this implementation.
+
 ### Functional
 
 - [scePthreadYield](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) on Windows calls Sleep(1) after 512 consecutive yields that find no other thread ready on the current processor and arrive less than ~10,000 TSC ticks apart (so the span varies with host CPU TSC rate); FreeBSD sched_yield never sleeps.
 - [Guest thread scheduling](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - the policies and priorities that `sched_get_priority_max`, `sched_get_priority_min`, `pthread_setschedparam` and `scePthreadSetschedparam` accept, and those a created thread takes, follow a PS5 (firmware 13.60), but they are only recorded and reported: they are not applied to host threads, so a title's priority order has no effect on host scheduling
+- [Linux runtime module initialization](../../../core/libs/prx/libkernel/Module/src/DynamicLoader.cpp) (libkernel) - modules in explicit runtime directories can be mapped for bindings before an explicit guest load runs their entry and init array once with the caller arguments. Finalizers run only after initialization completed. Console dependency-start and finalization ordering are unmeasured. Windows and macOS use their existing lifecycle paths.
+
 - [sceKernelMprotect, sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) over a range with a gap that is not registered in the allocation tracker protect the registered parts and skip the gap, and return 0, as FreeBSD 11.4's [`vm_map_protect`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/vm/vm_map.c) does (it has no check for holes); a range whose start is unmapped (also when later pages are mapped) returns `SCE_KERNEL_ERROR_EINVAL` (`mprotect`: `EINVAL`) because an existing test pins that for an unmapped start; FreeBSD answers 0 there too (`vm_map_protect` takes the next entry), so this errno is not taken from the source and was not changed. `sceKernelMprotect` threw for a gap before, which ended the title. Every part is checked for a GPU or image pin before the first one is protected; the parts are then protected one after the other, so a host protection failure in a later part leaves the earlier parts changed (FreeBSD's `vm_map_protect` cannot fail in its second pass). The behaviour on the console is not known. None of this was measured on a console.
 - [sceKernelMprotect protection bits](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - bits outside `0x3F7` are dropped instead of refused, in the POSIX `mprotect` as well (FreeBSD 11.4 masks the argument, `sys/vm/vm_mmap.c:613`; the console was measured only through `sceKernelMprotect`), as a PS5 (firmware 13.60) drops them: Onimusha: Way of the Sword (PPSA27836 01.000.001) maps direct memory with `0xf2` and then protects it with `0xfffffff2`, which the console reports as `0xf3` and then `0x3f3`. In a payload process the console also drops the CPU execute bit (`0x4`) of flexible, direct and JIT memory, and POSIX `mprotect` with write and execute reports write only (`0x2`). A title process may keep execute, so it is kept here. The map calls and `sceKernelMtypeprotect` refuse undefined bits on the console with `EINVAL` (`0x80020016`), and the direct map calls refuse execute; here both throw for undefined bits, and the direct map calls map execute
+- [JIT shared memory on macOS](../../../core/libs/prx/libkernel/DirectMemory/Jit.cpp) (libkernel) - the object is an unlinked `mkstemp` file in the temporary directory, as `shm_open` makes its anonymous objects. macOS refuses an executable shared file mapping (`EPERM`), so an executable view is mapped without execute and then given it with `mprotect`. Under Rosetta 2 (Apple M2, macOS 26), code rewritten through one view after it ran from another keeps its old translation until the executable view's protection changes; first writes and a single read-write-execute view, as XPSemu PPSA97358 and VLC PPSA85300 map, are seen. `mmap` of a JIT descriptor is not supported, as file-backed guest `mmap` throws on macOS.
 - [JIT shared memory](../../../core/libs/prx/libkernel/DirectMemory/Jit.cpp) (libkernel) - `sceKernelJitCreateSharedMemory`, `sceKernelJitCreateAliasOfSharedMemory` and `sceKernelJitMapSharedMemory` take the signatures of [Orbital](https://github.com/AlexAltea/orbital)'s `tools/ida/db_types.json` (name, length, maximum protection, descriptor out; descriptor, maximum protection, descriptor out; descriptor, protection, address in and out), which ps4sdk, ps5-jar-loader and the call sites in RetroArch PPSA99169, XPSemu PPSA97358 and VLC PPSA85300 match; SharpProspero declares the alias as returning the descriptor. The object is a host anonymous file shared by its descriptors (a `memfd` on Linux, a delete-on-close temporary file mapped as an executable section on Windows), the alias is a duplicate descriptor, and every map maps the whole object, so writes through one view show through the others; a non-null address is a hint, as in `mmap` without `MAP_FIXED`. Not measured on the console: a length that is zero or not a multiple of 16 KiB and protection bits other than CPU read, write and execute are `EINVAL`; an alias or a map asking for more than the descriptor's maximum protection (write and execute counting as read) is `EACCES`, as FreeBSD 11's `vm_map_protect` treats a protection past `max_protection`; a descriptor that is not a JIT object is `EBADF`. The name is ignored, the objects do not count against the flexible memory budget, `mprotect` of a view is not limited to the maximum protection, and `mmap` of the descriptors maps the object as a [regular file](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp), so its views and the JIT views see each other's writes. On Linux the `memfd` is created without `MFD_EXEC`, which Linux 6.3 added and older kernels reject with `EINVAL`, and relies on the protection of the mapping: the flag only sets the file's execute permission bits, and the direct memory `memfd` is mapped executable the same way; a host with `vm.memfd_noexec` set to 2 refuses the creation and the call throws
-- [kqueue and kevent](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) follow FreeBSD 11's [`kern_event.c`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/kern_event.c) (`kqueue_kevent`, `kqueue_register`, `kqueue_scan`, the timer and user filters) over the event queue; nothing is measured on a console. The descriptor is a host null device registered as the kqueue: `close` and `sceKernelClose` close the queue and `dup`/`dup2` of it throw, but `read`, `write` and `fstat` act on the null device instead of failing with `EOPNOTSUPP` or reporting `S_IFIFO`. Read and write events are supported on guest sockets only, plus `EVFILT_READ` on the read end and `EVFILT_WRITE` on the write end of a pipe (see the kevent on a pipe entry) and the timer, user and [vnode](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) filters and a read event on the host stream on descriptor 0, which never triggers, as `select` never reports descriptor 0 readable; PPSA34015 registers descriptor 0 for reading in a new kqueue at start-up and does not check the result; other filters, `EV_CLEAR` on a socket or a pipe off Linux (see the kevent EV_CLEAR entry), a `NOTE_NSECONDS` period above one second with a fraction (11.0 converts the fraction with the microsecond macro) and any change to an existing timer (11.0 keeps the armed expiry and applies the new period after it, 11.4's `filt_timertouch` restarts it) throw. `EV_DISABLE`, `EV_DISPATCH` and `EV_FORCEONESHOT` follow kern_event.c: a disabled knote stays registered, stops polling or firing and is not reported, a trigger raised while it is disabled is kept and reported after `EV_ENABLE`, where `knote` would drop it, `EV_DISPATCH` reports once and then disables the knote, and `EV_FORCEONESHOT` is ignored on a new knote while on an existing one it sets `EV_ONESHOT` and fires the knote; a negative `nevents` fails with `EINVAL`. A new user event keeps its `fflags` unmasked and is not triggered by `NOTE_TRIGGER`, because `filt_userattach` reads the already cleared `kn_fflags`. The timer limit `kq_calloutmax` (`ENOMEM`) is not enforced, and closing a kqueue wakes a thread waiting on it in `kevent` with `EBADF`, where `kqueue_drain` makes the close wait for that thread. A level-triggered event is reported once per call and moved behind the other events, as in `kqueue_scan`; the `sceKernel*Equeue` calls keep their own collection loop. `NOTE_LOWAT` on a socket sets the low-water mark as FreeBSD 11's [`filt_soread` and `filt_sowrite`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/uipc_socket.c) do, and a later change of the knote replaces it as `kqueue_register` replaces `kn_sdata`: a read event fires once the buffered bytes reach the mark, or at end of file or on a listening socket. A read mark above 1 is taken on stream sockets only: on a datagram socket Linux's `FIONREAD` reports the next datagram where FreeBSD's `sbavail` counts every queued byte, so it throws. A write event fires once the send buffer's free space reaches the mark, as `filt_sowrite` does with `sbspace`; the host reports that space as `SO_SNDBUF` less `SIOCOUTQ` on Linux and as `SO_SNDBUF` alone elsewhere, so off Linux it does not shrink while data is queued. Marks below 1, which make FreeBSD's read filter always fire, throw
+- [kqueue and kevent](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) follow FreeBSD 11's [`kern_event.c`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/kern_event.c) (`kqueue_kevent`, `kqueue_register`, `kqueue_scan`, the timer and user filters) over the event queue; nothing here is taken from a console except what the kevent measurements entry lists. The descriptor is a host null device registered as the kqueue: `close` and `sceKernelClose` close the queue and `dup`/`dup2` of it throw, but `read`, `write` and `fstat` act on the null device instead of failing with `EOPNOTSUPP` or reporting `S_IFIFO`. Read and write events are supported on guest sockets only, plus `EVFILT_READ` on the read end and `EVFILT_WRITE` on the write end of a pipe (see the kevent on a pipe entry) and the timer, user and [vnode](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) filters and a read event on the host stream on descriptor 0, which never triggers, as `select` never reports descriptor 0 readable; PPSA34015 registers descriptor 0 for reading in a new kqueue at start-up and does not check the result; other filters except `EVFILT_AIO`, `EVFILT_LIO`, `EVFILT_SENDFILE` and `EVFILT_PROCDESC` (see the kevent measurements entry), `EV_CLEAR` on a socket or a pipe off Linux (see the kevent EV_CLEAR entry) and every change to an existing timer except `EV_DELETE` and the `EV_ADD` re-adds that the kevent measurements entry describes throw. A `NOTE_NSECONDS` period above one second with a fraction is kept to the nanosecond, where 11.0 converts the fraction with the microsecond macro. `EV_DISABLE`, `EV_DISPATCH` and `EV_FORCEONESHOT` follow kern_event.c: a disabled knote stays registered, stops polling or firing and is not reported, a trigger raised while it is disabled is kept and reported after `EV_ENABLE`, where `knote` would drop it, `EV_DISPATCH` reports once and then disables the knote, and `EV_FORCEONESHOT` is ignored on a new knote while on an existing one it sets `EV_ONESHOT` and fires the knote; a negative `nevents` fails with `EINVAL`. A new user event keeps its `fflags` unmasked and is not triggered by `NOTE_TRIGGER`, because `filt_userattach` reads the already cleared `kn_fflags`. The timer limit `kq_calloutmax` (`ENOMEM`) is not enforced, and closing a kqueue wakes a thread waiting on it in `kevent` with `EBADF`, where `kqueue_drain` makes the close wait for that thread. A level-triggered event is reported once per call and moved behind the other events, as in `kqueue_scan`; the `sceKernel*Equeue` calls keep their own collection loop. `NOTE_LOWAT` on a socket sets the low-water mark as FreeBSD 11's [`filt_soread` and `filt_sowrite`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/uipc_socket.c) do, and a later change of the knote replaces it as `kqueue_register` replaces `kn_sdata`: a read event fires once the buffered bytes reach the mark, or at end of file or on a listening socket. A read mark above 1 is taken on stream sockets only: on a datagram socket Linux's `FIONREAD` reports the next datagram where FreeBSD's `sbavail` counts every queued byte, so it throws. A write event fires once the send buffer's free space reaches the mark, as `filt_sowrite` does with `sbspace`; the host reports that space as `SO_SNDBUF` less `SIOCOUTQ` on Linux and as `SO_SNDBUF` alone elsewhere, so off Linux it does not shrink while data is queued. Marks below 1, which make FreeBSD's read filter always fire, throw
 - [EVFILT_VNODE, sceKernelAddFileEvent and sceKernelDeleteFileEvent](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) (libkernel) watch the host file or directory behind the descriptor and turn host changes into FreeBSD 11 vnode hints, which [`filt_vfsvnode`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/vfs_subr.c#L5032) adds whole when they share a bit with the requested `fflags`: a write that grows a file is `NOTE_WRITE | NOTE_EXTEND`, another write `NOTE_WRITE`, a shrinking truncate or an attribute change `NOTE_ATTRIB`, a higher link count `NOTE_LINK`, a lower one or a pending delete `NOTE_DELETE`, a new path `NOTE_RENAME`; in a directory, an entry created, removed or renamed is `NOTE_WRITE`, with `NOTE_LINK` for a subdirectory, and on Linux an entry moved from or to another directory adds `NOTE_EXTEND`; inotify queues the two halves of a rename one after the other, so a watcher woken by the first can read it alone, and a half read without the other is classified only after a `getdents64` on the watched directory, which takes the directory lock that `rename` holds until both halves are queued ([`do_renameat2`](https://github.com/torvalds/linux/blob/v6.8/fs/namei.c#L4975) around `vfs_rename` and its `fsnotify_move`, [`iterate_dir`](https://github.com/torvalds/linux/blob/v6.8/fs/readdir.c#L103)), an ordering taken from the kernel source, not from inotify(7), which promises none; a directory registered with `NOTE_EXTEND` on Windows is accepted, as `vfs_kqfilter` does not check it, but never receives it, because the directory handle cannot tell a move between directories from a removal plus an addition. FreeBSD's hints depend on the filesystem and the console's filesystems are not known: a growing `ftruncate` reports `NOTE_WRITE | NOTE_EXTEND` where `vop_setattr_post` reports `NOTE_ATTRIB`, and on Windows `utimes` on a file reports `NOTE_WRITE`. The three Windows notifications are told apart in the error, which names the `parent`, `entries` or `subdirectories` watch, the path it was given and `GetLastError`, but a `FindFirstChangeNotification` that fails still throws rather than returning an error to the guest: the EVFILT_VNODE attach path is [`vfs_kqfilter`](https://github.com/freebsd/freebsd-src/blob/34bd34750187bae02a0086402c78c031c59dd8b3/sys/kern/vfs_subr.c#L4936), which returns `EINVAL`, `ENOMEM` or 0 after `fget` has turned a descriptor that is not open into `EBADF`, and consults no directory permission, so no FreeBSD errno stands for a host that refuses to notify, and what the console does on such a host is not measured. Only the `parent` watch can fail this way in practice: `entries` and `subdirectories` need the `FILE_LIST_DIRECTORY` that opening the watched directory already took. The parent handle produces no hint of its own, as `RunHostWatch` only calls `FindNextChangeNotification` on it, so a later change may leave the watch on its 50 ms poll instead of throwing; that is not done here. Windows uses `FindFirstChangeNotification` on the parent directory (and on a watched directory itself) and compares `GetFileInformationByHandleEx` snapshots at least every 50 ms, because a write through an open handle is reported only when the handle is flushed or closed, so file hints can arrive 50 ms late, and a file deleted while watched, which the POSIX delete of Windows 10 1903 moves into `$Extend\$Deleted` until its last handle closes, reports `NOTE_DELETE` without `NOTE_RENAME` and keeps its handle without a parent directory watch, as that directory cannot be watched; Linux uses inotify on the file and is not run. `NOTE_REVOKE`, `NOTE_OPEN`, `NOTE_CLOSE`, `NOTE_CLOSE_WRITE`, `NOTE_READ`, unknown bits and descriptors other than files, directories, pipes and sockets throw. `sceKernelAddFileEvent(eq, fd, watch, udata)` and `sceKernelDeleteFileEvent(eq, fd)` take the [OpenOrbis](https://github.com/OpenOrbis/OpenOrbis-PS4-Toolchain/blob/0a1aaf9d/include/orbis/libkernel.h#L35) and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0/src/SharpProspero/Interop/Kernel/KernelEqueue.cs#L164) signatures; `watch` is taken as the `fflags` and the event is added with `EV_CLEAR`, neither confirmed on a title (feat(libkernel): implement kevent EV_DISABLE, EV_DISPATCH and EV_FORCEONESHOT) (fix(libkernel): follow kqueue_register for EV_FORCEONESHOT and modify flags)
+- [sem_open, sem_close, sem_unlink](../../../core/libs/prx/libkernel/Pthread/Posix/Sem.cpp) (libkernel) keep named semaphores in a table inside the process; FreeBSD 11.4's [`sem_new.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/sem_new.c#L138-L308) backs each with a file `/tmp/SEMD<name>`. A semaphore lasts until `sem_unlink` and its last `sem_close` but is not shared with other processes, and the mode is ignored (no permission errors, as for a root caller). Whether a title can create files under `/tmp` on the console is unverified. A name with a further `/` throws, as it would resolve below `/tmp`, and so does an initial value above `SEM_VALUE_MAX`, which FreeBSD stores unchecked.
 - [sem_timedwait](../../../core/libs/prx/libkernel/Pthread/Posix/Sem.cpp) (libkernel) consumes an available count before checking the timeout and waits indefinitely for a null timeout, following FreeBSD 11's `sem_timedwait`. Console behavior for null and invalid timeouts when a count is available is unverified.
+- [kevent measurements](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - in payload processes on a PS5 (firmware 12.70), re-adding an existing periodic `EVFILT_TIMER` with `EV_ADD`, `fflags` 0 and a positive period kept the armed expiry and the expirations already counted and applied the new period after that expiry, as FreeBSD 11.0 does, where 11.4's `filt_timertouch` restarts the timer: a 50 ms timer re-added with 10 ms fired first 46 ms after the re-add and then every 10 ms, a 10 ms timer re-added with 100 ms fired first 5 ms after the re-add and then every 100 ms, the 12 expirations counted before a re-add were reported after it, and `EV_ONESHOT` in the re-add left the timer periodic. Here such a re-add does the same; re-adding a one-shot or disabled timer, a re-add with nonzero `fflags` (`NOTE_MSECONDS` included), a period of 0 or less, a period too large to add to the armed expiry or flags other than `EV_ONESHOT` were not measured and throw here, and the other changes to an existing timer except `EV_DELETE` throw here too. There `EV_ADD` failed with `EPERM` for `EVFILT_AIO`, `EVFILT_LIO` and `EVFILT_SENDFILE` at every ident tried (0, 5, 999, 2^40 and an open pipe) and, at ident 5, also with `EV_CLEAR`, `EV_ONESHOT` or `EV_DISABLE` added, and `EV_DELETE` and `EV_ENABLE` without `EV_ADD` failed with `ENOENT`. `EVFILT_PROCDESC` failed with `EBADF` on a descriptor that is not open and on an ident above `INT_MAX`, and with `EINVAL` on every open descriptor tried: Unix-domain stream and datagram sockets, descriptor 0 (a socket), an `AF_INET` UDP socket, both ends of a pipe, a regular file, a directory, another kqueue and the kqueue itself; `EV_DELETE` on a socket failed with `ENOENT`. Here these four filters answer the same way. `EV_ADD` of `EVFILT_PROCDESC` fails with `EINVAL` on the kinds of descriptor tried, since there are no process descriptors here, and also on shared memory and JIT shared memory, which are host files here: FreeBSD 11.0 gives `shm_open` objects [`invfo_kqfilter`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/uipc_shm.c#L136), which answers `EINVAL`, but neither was measured. It throws on any other kind, such as `/dev/random` and `/dev/urandom`, and on descriptors 0 to 2 that are not sockets or kqueues, whatever they hold: the host's standard streams, a pipe or file that `dup2` put on one of them, or a descriptor opened on a number that was free when libkernel loaded. A change of any of the four without `EV_ADD` fails with `ENOENT`, for `EVFILT_PROCDESC` after the descriptor check, as `kqueue_register` finds no knote. When `EV_ADD` of one of the four fails with `EPERM`, or with `EINVAL` on a descriptor other than the kqueue itself, the error event has `fflags` 0 and the errno in `data`, as FreeBSD 11.0's [`kqueue_register`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_event.c#L1302-L1316) clears `fflags` and `data` before the attach and [`kqueue_kevent`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_event.c#L1005-L1006) then stores the error in `data`; a descriptor that is not open, the kqueue itself and `EV_ENABLE` with `EV_DISABLE` fail before that and keep their `fflags`. That error event was not measured. `EVFILT_PROC` on the process itself with `NOTE_EXIT`, `EVFILT_SIGNAL` for `SIGUSR1` and `EVFILT_FS` at ident 0 were accepted there and still throw here. Also measured there on Unix-domain socketpairs, and still throwing here: a `NOTE_LOWAT` mark of 0 on an empty stream socket gave a read event at once (`data` 0), and so did re-adding that knote with a mark of -1 once the socket was drained; a write mark of 2 on the other end of that stream socketpair gave an event (`data` 8192), and re-adding that knote with 2^30 gave none; a mark of 5 on a datagram socket gave no read event after one 1-byte datagram and a read event (`data` 11) after a second, 10-byte datagram. `EVFILT_READ` on another kqueue reported the number of events pending in it there (1, then 2) and throws here; `EVFILT_WRITE` on a kqueue and a kqueue registered on itself failed with `EINVAL` there, as they do here
 - [tcsendbreak, tcdrain, tcflush, tcflow, tcgetpgrp, tcsetpgrp](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel) follow FreeBSD 11.4's [`termios.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/gen/termios.c): `tcflush` answers `EINVAL` for a queue other than `TCIFLUSH`, `TCOFLUSH` or `TCIOFLUSH` and `tcflow` for an action outside `TCOOFF`..`TCION` before the descriptor is looked at, and every other call fails as its terminal ioctl does on a descriptor that is not a terminal, with the errors `tcgetattr` gives, so `tcsendbreak` never reaches its 0.4 s pause. FreeBSD's `pipe_ioctl` answers `TIOCGPGRP` and `TIOCSPGRP` on a pipe or FIFO with the descriptor's SIGIO owner, which is not modelled, so `tcgetpgrp` and `tcsetpgrp` throw on a host pipe or FIFO above descriptor 2; descriptors 0 to 2 are taken as non-terminals that are not pipes, whatever the host attaches to them, so a pipe the guest creates on a freed descriptor 0 to 2 gets `ENOTTY` there. The PS5 `libkernel` is assumed to use this FreeBSD code, and `tcdrain` is not a cancellation point here
-- [Windows file timestamps](../../../core/libs/prx/libkernel/File/include/WindowsFileTime.hpp) use the host filesystem's timestamp range and resolution. `utimes`, `futimes`, and `lutimes` reject timestamps outside nonnegative signed 64-bit Windows file-time ticks with `EINVAL`, including exactly 1601-01-01 00:00:00 UTC, whose zero value means "leave unchanged" to `SetFileTime`. Directory timestamp updates resolve the current path of the opened handle. Filesystems with coarser timestamp resolution cannot retain every guest microsecond
+- [Windows file timestamps](../../../core/libs/prx/libkernel/File/include/WindowsFileTime.hpp) use the host filesystem's timestamp range and resolution. `utimes`, `futimes`, and `lutimes` reject timestamps outside nonnegative signed 64-bit Windows file-time ticks with `EINVAL`, including exactly 1601-01-01 00:00:00 UTC, whose zero value means "leave unchanged" to `SetFileTime`. Directory timestamp updates resolve the current path of the opened handle. Filesystems with coarser timestamp resolution cannot retain every guest microsecond. Birth-time clamping is not atomic with concurrent host timestamp updates and has not been measured on a console
 - [EVFILT_VNODE on macOS](../../../core/libs/prx/libkernel/Equeue/src/FileEvent.cpp) (libkernel) registers `EVFILT_VNODE` on a duplicate of the descriptor in a host kqueue, whose notes have FreeBSD's values, and drops the `NOTE_LINK` that XNU adds to `NOTE_DELETE` when the watched file or directory is removed, since FreeBSD's `vop_remove_post` and `vop_rmdir_post` report `NOTE_DELETE` alone. As on Windows, a directory registered with `NOTE_EXTEND` is accepted but never receives it: XNU reports a move between directories as `NOTE_WRITE` alone, with `NOTE_LINK` for a subdirectory
 - [Windows file identity](../../../core/libs/prx/libkernel/File/src/NativeStat.cpp) (libkernel) - `stat` and `fstat` report the volume serial number as `st_dev` and the 64-bit file index folded into the guest's 32-bit `st_ino` (never 0), so two different files can in principle share an `st_ino`; the fold is not taken from a reference. `st_nlink` is clamped to 65535, the width of the guest field. The call keeps the `_wstat64` values when `GetFileInformationByHandle` fails
 - [lstat of a Windows symbolic link](../../../core/libs/prx/libkernel/File/src/NativeStat.cpp) (libkernel) reports a link whose target is relative, as `symlink` creates them, with the link's own times, `st_dev` and `st_ino`, mode `S_IFLNK | 0777` and the length of the target `readlink` returns as `st_size`. FreeBSD gives a new link `0777` less the creating process's umask, which the host does not keep, so the permission bits are not the console's. A link with an absolute target is reported the same way, using its print name, or its substitute name when the print name is empty, without a `\??\` or `\\?\` prefix. A directory junction is reported the same way when the name left after that prefix is a drive path (`X:\...`): the print name when that name is a drive path, otherwise the substitute name. `open` with `O_NOFOLLOW` returns `EMLINK` for that junction and does not open the target
@@ -136,101 +150,127 @@
 - [system](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) runs no command. It follows FreeBSD 11's `lib/libc/stdlib/system.c` for a sandbox without `/bin/sh`: a null command returns 1 unconditionally, as that version does, and any command returns the wait status of a child that could not exec the shell and called `_exit(127)` (`0x7f00`). Whether the console's application sandbox has no shell, and whether `vfork` succeeds there (FreeBSD returns -1 when it fails), is unverified
 - [sceKernelWriteThrottlingStatus](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) reports no write throttling: the host SSD has no write budget, so the first qword of the 32-byte status is set to `UINT32_MAX` and the rest is zeroed; returns `EFAULT` (`0x8002000e`) when passed a null status buffer pointer. PPSA17221 reads only that qword: it multiplies it by 64 KiB and compares the product with byte thresholds up to 0x4AF00000 to pick one of five tiers. When the call fails the title assumes 0x4B000001 bytes, which selects the same top tier as `UINT32_MAX`. What the value measures on hardware (a remaining budget or a rate) and the meaning of the other three qwords are unknown
 - [Windows directory descriptors](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) take one snapshot of the directory, on the first `getdents`, `getdirentries` or non-zero `lseek` (`SEEK_SET` or `SEEK_CUR`), and keep it until it is discarded; `lseek` to offset 0 only discards the snapshot, and the next read lists the directory again, so every rewind costs O(entries) on the next read. `lseek` takes the offset as an entry index and `SEEK_CUR` with offset 0 only reports the index. `SEEK_END` throws because FreeBSD defines it relative to the directory size, which is not modelled. A negative result returns `EINVAL` and a `SEEK_CUR` offset that overflows returns `EOVERFLOW`, as FreeBSD `vn_seek` reports them. Names whose UTF-8 encoding exceeds the one-byte `d_namlen` limit are not representable in this guest directory-record layout: `getdents` returns `ENAMETOOLONG` without consuming the entry. Repeated calls therefore report the same error and entries after that name cannot be reached through this descriptor; FreeBSD's `getdents` behavior for host filenames that exceed its `MAXNAMLEN` is not verified. `getdirentries` still reports 0 through `basep` instead of the position of the block it read, so only 0 and values returned by `lseek` are valid offsets; FreeBSD offsets are filesystem cookies. Descriptors retain the opened directory's native handle across renames. Enumeration reloads and `*at` operations resolve its current path, so a concurrent rename between resolution and the operation is not atomic. Enumeration of a removed directory and network-share path queries have not been verified
+- [Linux directory entry types](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) - `sceKernelGetdirentries` reports a host symlink inside the app0 tree as the type of its target (directory or regular file), since a console app0 has no links and links there come from how the title was unpacked; a link elsewhere, or a dangling one, stays a link. A directory opened through an app0 link resolves to its target's host path, so links nested inside that target keep the link type.
 - [ftruncate, truncate, sceKernelFtruncate](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) extend a file on Windows with `SetFileInformationByHandle` (`FileEndOfFileInfo`), which reserves the clusters but writes no zero bytes, and report `EFBIG` for a length the volume cannot hold (`ERROR_INVALID_PARAMETER` on a disk file; seen with a length of `INT64_MAX`, the size from which NTFS refuses it was not measured) and `ENOSPC` when the free space is smaller. FreeBSD 11.4 makes the extension a hole on a file system that has them ([`ffs_truncate`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/ufs/ffs/ffs_inode.c) writes only the last block), so a length above the free space succeeds there. A write behind the end of the file still makes NTFS write zero bytes over the gap, as the file is not sparse. None of this was measured on a console.
 - [Windows directory entry types](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) - types other than regular files, directories and symbolic links, and reparse points unsupported by `lstat`, throw. If the host cannot stat an entry, its type is `DT_UNKNOWN`. Console directory-entry types have not been measured; the host `lstat` modes map to `DT_REG`, `DT_DIR` and `DT_LNK` following [FreeBSD 11.4 dirent.h](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/sys/dirent.h). A host link inside canonical app0 is reported as its target's type (directory or regular file); a link elsewhere, or a dangling one, stays a link. A directory opened through an app0 link resolves to its target's host path, so links nested inside a target outside app0 keep the link type.
 - [readv, writev, preadv, pwritev and their sceKernel forms](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) - unreadable iovec-table errors follow FreeBSD 11.4's [`copyinuio`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/subr_uio.c#L401-L434), not console measurements. The table is copied before inspecting its entries; payload-buffer validation is unchanged. A Linux `process_vm_readv` failure other than `EFAULT` throws, including when the host denies that API.
 - [/dev/random and /dev/urandom](../../../core/libs/prx/libkernel/File/src/RandomDevice.cpp) (libkernel) opened for reading return a descriptor backed by the host null device whose reads are filled with host OS entropy (`getentropy`, `rand_s` on Windows); both paths behave the same, never block, and positioned reads ignore the offset (FreeBSD `random(4)`). Only the exact paths are recognised, `fstat`, `lseek` and `mmap` see the null device, and opening them for writing throws
 - [pthread_attr_getinheritsched, pthread_attr_setinheritsched, pthread_attr_getscope, pthread_attr_setscope, pthread_attr_getstackaddr](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) follow FreeBSD 11 libthr ([thr_attr.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libthr/thread/thr_attr.c), [thr_create.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libthr/thread/thr_create.c)), not measured on the console: the scope defaults to `PTHREAD_SCOPE_SYSTEM` (2), only it and `PTHREAD_SCOPE_PROCESS` (0) are accepted and other values return `EINVAL`, and an inherit value other than `PTHREAD_INHERIT_SCHED` (4) or `PTHREAD_EXPLICIT_SCHED` (0) returns `ENOTSUP`. `pthread_attr_getstackaddr` returns the configured stack address pointer (null by default). A null output of `pthread_attr_getinheritsched` throws, since libthr writes through it unchecked. A thread keeps the scope it was created with, taken from the creating thread under `PTHREAD_INHERIT_SCHED`, and `pthread_attr_get_np` and `scePthreadAttrGet` report it, but every guest thread is a host thread at system scope, so process scope changes nothing
-- [Shared memory](../../../core/libs/prx/libkernel/File/src/SharedMemory.cpp) (libkernel) on Linux implements anonymous and named objects, bounded descriptor writes and seeks, and `shm_unlink` with effective read/write permission checks from FreeBSD 11. Named paths up to 1023 bytes use `/anyps5-shm-` plus SHA-1; collisions are not detected, and the namespace is shared across processes in the host mount namespace. Named creation applies the guest umask without changing the host mask. Linux procfs and `/dev/shm` are required. Operations use an advisory directory lock; external host operations bypass it, unrelated objects serialize, and descriptor operations require two spare host descriptors and compare device/inode with the initial descriptor identity on both the pinned-object and ordinary-file fallback paths. [Guest mappings](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) support shared and private mappings of these descriptors through the allocation tracker and pin a duplicate descriptor during validation and mapping; mapping requires one spare host descriptor; file-backed mappings use the write-watch scan fallback because aliases and descriptor writes bypass per-mapping tracking. On Windows, anonymous objects are delete-on-close temporary files and `mmap` maps them as [regular files](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp); named objects remain unsupported. Invalid non-null name pointers, console behaviour and title compatibility remain unverified.
+- [Shared memory](../../../core/libs/prx/libkernel/File/src/SharedMemory.cpp) (libkernel) on Linux implements anonymous and named objects, bounded descriptor writes and seeks, and `shm_unlink` with effective read/write permission checks from FreeBSD 11. Named paths up to 1023 bytes use `/anyps5-shm-` plus SHA-1; collisions are not detected, and the namespace is shared across processes in the host mount namespace. Named creation applies the guest umask without changing the host mask. Linux procfs and `/dev/shm` are required. Operations use an advisory directory lock; external host operations bypass it, unrelated objects serialize, and descriptor operations require two spare host descriptors and compare device/inode with the initial descriptor identity on both the pinned-object and ordinary-file fallback paths. [Guest mappings](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) support shared and private mappings of these descriptors through the allocation tracker and pin a duplicate descriptor during validation and mapping; mapping requires one spare host descriptor; file-backed mappings use the write-watch scan fallback because aliases and descriptor writes bypass per-mapping tracking. On Windows, anonymous objects are delete-on-close temporary files and `mmap` maps them as [regular files](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp); named objects are described in the next entry. Invalid non-null name pointers, console behaviour and title compatibility remain unverified.
+- [shm_open, shm_unlink](../../../core/libs/prx/libkernel/File/src/SharedMemory.cpp) (libkernel, Windows) - named objects are regular files in the current user's temporary directory under `AnyPS5/shm`, identified by SHA-1 of the exact guest name. The namespace is per host user and shared by every AnyPS5 process using that temporary root, so two titles using the same name share the object. Namespace operations use a cross-session named mutex, while file-size changes and writes use a mutex keyed by the host file identity; unlink renames the visible object to a unique internal name so already-open handles remain usable while the guest name can be recreated. Orphaned files are reaped when the last tracked guest descriptor closes or opportunistically during a later open. Closing through host stdio wrappers does not update this bookkeeping or reap immediately. The namespace directory has a protected ACL for the owner, SYSTEM and Administrators; newly created objects map the guest owner read/write bits after applying the guest creation mask. `fchmod` updates those owner permissions on the descriptor's file object. Guest group/other permission classes are not represented independently on Windows. Mapping a named object uses the same Windows file mapper as anonymous objects and no test covers it, and no behavior here has been measured on PS5. Lifecycle, cross-process resize/write, and mode behavior are exercised by Windows tests. See Microsoft's [file sharing modes](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea), [DeleteFile](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-deletefilew) and [mutex objects](https://learn.microsoft.com/en-us/windows/win32/sync/mutex-objects).
 - [sceKernelAddReadEvent and sceKernelAddWriteEvent](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel): a read event on a listening socket, here and in `kevent`, reports the number of completed connections waiting to be accepted in `data`, as FreeBSD 11.4's [`filt_solisten`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L3384-L3392) reports `so_qlen`: on Linux a TCP listener's accept queue from `TCP_INFO` (`tcpi_unacked`, which Linux fills with the accept backlog for a listening socket), and elsewhere, or for a listener that is not TCP, 1 while a connection is waiting, as no host call reports that count. A write event reports the free space of the socket's send buffer in `data`, as FreeBSD 11.4's [`filt_sowrite`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L3358-L3382) reports `sbspace`: on Linux the host's `SO_SNDBUF` less the bytes `SIOCOUTQ` counts as queued, which include the host's per-packet overhead, so the space shrinks by somewhat more than the bytes sent. Windows has no query for that space and macOS is not wired up, so both report the whole `SO_SNDBUF`, which does not shrink as data is queued. Only guest sockets are supported; other descriptors and a low watermark above 1 throw
-- [sceKernelAddReadEvent on pipes](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) is the one exception to the sockets-only rule above: it also takes the read end of a pipe, as `kevent` does through FreeBSD's `filt_piperead`, and ignores the size argument there. Host streams, other descriptors and a write event on a pipe throw
+- [sceKernelAddReadEvent on pipes](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) is an exception to the sockets-only rule above: it also takes the read end of a pipe, as `kevent` does through FreeBSD's `filt_piperead`, and ignores the size argument there. Host streams, other descriptors and a write event on a pipe throw
+- [sceKernelAddReadEvent and sceKernelAddWriteEvent on regular files](../../../core/libs/prx/libkernel/Equeue/Equeue.cpp) (libkernel) are the other exception: a size argument above 1, directories and other vnode types throw, and whether the console's file systems answer as `vfs_kqfilter` does was not measured. A wait holding one of these events polls it every millisecond, as no host call reports every file change, so a write through another descriptor shows up to 1 ms late. Unlike FreeBSD, a seek can make a read event fire again: FreeBSD 11.4's [`kqueue_scan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c) deactivates a level-triggered read knote once `filt_vfsread` reports `data` 0, and only a vnode `KNOTE` (a write, an extend or a truncate) activates it again; `lseek` posts none, so after a file read to its end is seeked back, the 1 ms poll here reports the new `data` (10 for a 10-byte file seeked to 0) where FreeBSD keeps waiting until the file changes. Otherwise they follow FreeBSD 11.4's [`filt_vfsread` and `filt_vfswrite`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_subr.c#L5122-L5168): a read event reports the size less the descriptor's offset in `data` and fires while that is not 0; a write event always fires with `data` 0
 - [close](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) and [setsockopt](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) reach a [libSceNet](../../../core/libs/prx/libSceNet/Export.cpp) socket through hooks libSceNet registers, as `select` polls them; the other libkernel socket calls do not. libSceNet numbers its sockets from 32 in its own table, so a CRT file descriptor and a socket can share a number; `close` then closes the socket. On the console both are one kernel descriptor space
-- [sceKernelPread, sceKernelPwrite, sceKernelPreadv, sceKernelPwritev](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) on Windows transfer at the given offset with an overlapped `ReadFile`/`WriteFile` and restore the descriptor's file pointer afterwards. Guest scalar transfers, positioned transfers, vectored transfers and seeks share a position lock across duplicated descriptors; a vector holds it for the whole operation. Independently opened descriptors and other processes do not share that lock, so vector transfers over their overlapping file ranges are not coordinated. Handles that are not disk files return `ESPIPE`. A pipe or console `readv` can return a short read when no more input is available; each iovec is transferred separately, so a failure after the first transfer returns the bytes already done
+- [sceKernelPread, sceKernelPwrite, sceKernelPreadv, sceKernelPwritev](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) on Windows transfer with an overlapped `ReadFile`/`WriteFile` and restore the descriptor's file pointer afterwards. Guest scalar transfers, positioned transfers, vectored transfers and seeks share a position lock across duplicated descriptors; a vector holds it for the whole operation. Independently opened descriptors and other processes do not share that lock, so vector transfers over their overlapping file ranges are not coordinated. Handles that are not disk files return `ESPIPE`. A pipe or console `readv` can return a short read when no more input is available; each iovec is transferred separately, so a failure after the first transfer returns the bytes already done
 - [sceKernelAioSubmitReadCommands, sceKernelAioSubmitWriteCommands and their Multiple variants](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) on Windows transfer through the same positioned path as `sceKernelPread`/`sceKernelPwrite` and restore the descriptor's file pointer afterwards; positioned transfers, plain transfers and seeks of one descriptor are serialized per descriptor (shared across duplicated descriptors), so a concurrent transfer observes a stable file pointer
-- [sceKernelAioSetParam](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) writes the five values into the 20-byte scheduling struct the first argument points to, following the declarations in [Orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json), [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Kernel/KernelAio.cs) and [ampr_emu](https://github.com/drakmor/ampr_emu/blob/cfa85df379f6eeeb165d7badf9b648e266fe77b7/ps5/include/sce/_fs.h). Whether the console checks the values is unknown, so a null struct, a scheduling window or delayed count limit outside 0..128, a split flag other than 0 or 1 and a split size or chunk size above 0x1000000 (SharpProspero's maximums) throw. The scheduling settings are not used: `sceKernelAioInitializeImpl` ignores the struct and requests run synchronously on submit
+- [sceKernelAioSetParam](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - the limits and `sceKernelAioInitializeParam`'s defaults (three 20-byte scheduling structs, the last without split) are measured on a PS5 (firmware 13.60), where a null struct crashes both calls; here both throw. The scheduling settings are not used: `sceKernelAioInitializeImpl` ignores the struct and requests run synchronously on submit
 - [sceKernelGetFsSandboxRandomWord](../../../core/libs/prx/libkernel/System/src/Sandbox.cpp) (libkernel) returns a fixed directory name, `gkbHtXc3Wq`. On the console the name is the process's randomized path (syscall 602, `randomized_path`), and the sandbox exposes system files under it, such as `common/lib` and `common/cert`. Nothing is mounted under the name here, so `/gkbHtXc3Wq/common/...` resolves under the guest root like any other path and does not exist, except `/gkbHtXc3Wq/common/cert/CA_LIST.cer`, which [SandboxCertificates.cpp](../../../core/libs/prx/libkernel/File/src/SandboxCertificates.cpp) serves from the host trust store
+- [ktimer_create, ktimer_settime, ktimer_gettime, ktimer_getoverrun, ktimer_delete](../../../core/libs/prx/libkernel/Time/Ktimer.cpp) (libkernel) - a `SIGEV_SIGNAL` or `SIGEV_THREAD_ID` timer, and one created with a null `sigevent` (FreeBSD defaults it to `SIGEV_SIGNAL`), throws, because delivering a guest signal from a timer is not modelled. A non-zero value under one tick rounds up to 1 ms, as FreeBSD 11 does at hz 1000; the console's hz is not measured (`kern.clockrate` is unanswered). `SIGEV_NONE` timers on `CLOCK_REALTIME` and `CLOCK_MONOTONIC` follow `kern_time.c`: ids 3 to 31 (`EAGAIN` when full), `EINVAL` for another clock, a bad notify type or signal, an id that is not live or a bad `itimerspec` field, and `TIMER_ABSTIME` (1). Expiry is worked out from the guest clock when the timer is read, and `ktimer_getoverrun` returns 0, as FreeBSD only updates it when a signal is accepted
 - [The sandbox CA list](../../../core/libs/prx/libkernel/File/src/SandboxCertificates.cpp) (libkernel), `/<sandbox word>/common/cert/CA_LIST.cer`, is a PEM bundle of the host's trust anchors, written once per process to `cert_cache/CA_LIST.cer` in the run directory with the owner write bit cleared: on Windows the current user's `ROOT` store, filtered through Disallowed and the combined EKU extension/property for TLS server authentication (Windows fetches missing roots on demand, so a root that was never fetched is absent), elsewhere `SSL_CERT_FILE` or the first of `/etc/ssl/certs/ca-certificates.crt`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/ssl/ca-bundle.pem` and `/etc/ssl/cert.pem` that exists. On macOS, `/etc/ssl/cert.pem` is a static snapshot and does not reflect roots added to or distrusted in the Keychain. Existing guest files, explicit aliases and blocked mounts take precedence over the provider. The PEM snapshot does not carry Windows CTL restrictions beyond EKU, native revocation policy or later trust-store changes. Without any certificate the path does not exist. The console file's format is unverified: only that bundled OpenSSL accepts a PEM bundle there is shown (ProsperoRadio PPSA99001 and SwanStation PPSA98510, #5001). The other entries of the console's `common/cert` directory, the directory itself (it does not exist here) and the error a write open gets (`EACCES` from the host here) are unverified
+- [pselect](../../../core/libs/prx/libkernel/Socket/src/Pselect.cpp) (libkernel) sets the signal mask with `sigprocmask`, calls `select` and restores the mask, as FreeBSD 11 `kern_pselect` does, but the swap is not atomic with the wait: a signal that becomes deliverable between the swap and the wait is not guaranteed to interrupt it
 - [getcontext and setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) and [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) use FreeBSD 11's amd64 `ucontext_t` (`mcontext` at 0x10, `mc_len` 800, `uc_link` at 0x330, `uc_stack` at 0x338, 0x370 bytes), the layout homebrew built against FreeBSD's headers passes: PPSA99039's OpenSSL `ASYNC` (`crypto/async/arch/async_posix.c`) captures into a 0x370-byte stack buffer. `getcontext` writes the 0x330 bytes before `uc_link`, as FreeBSD's `UC_COPY_SIZE`. The console's own layout for these functions is not verified; the exception handler's context is a different one (see `sceKernelRaiseException`)
 - [getcontext and setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) keep the 512-byte FXSAVE image in `mc_fpstate` (x87, MXCSR, XMM0-15), so the upper halves of YMM0-15 are neither saved nor restored, and `getcontext` leaves `mc_xfpustate` and `mc_xfpustate_len` 0. `getcontext` sets `mc_fpformat` and `mc_ownedfp` to FreeBSD's `_MC_FPFMT_XMM` and `_MC_FPOWNED_FPU`, `mc_cs` and `mc_ss` to the host selectors, and `mc_flags`, `mc_fsbase` and `mc_gsbase` to 0. `setcontext` loads `mc_fpstate` whatever `mc_fpformat` and `mc_ownedfp` say, and restores neither the segment selectors, `mc_fsbase` and `mc_gsbase` nor the extended state, which FreeBSD restores when `mc_flags` asks for them
 - [setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) and [longjmp](../../../core/libs/prx/libc/src/JumpBuffer.cpp) (libc) on Windows set the thread's stack bounds in the TEB to the stack they switch to: a `makecontext` stack, or else the committed region around the target stack pointer. A switch to any other guest stack, such as a context built by hand, gets the bounds of that region only
 - [scePthreadAttrGet](../../../core/libs/prx/libkernel/Pthread/src/Attr.cpp) (libkernel) - the answer for a thread that has ended is not measured on the console, and [`pthread_attr_get_np`](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) still returns 0 for such a thread, reading a detached one's object after it is freed. `scePthreadAttrGet` returns `ESRCH` (`0x80020003`) for a thread that has ended, joined or not and detached or not, as FreeBSD 11.4's [`_pthread_attr_get_np`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_attr.c#L139-L172) does through `_thr_find_thread`; a thread counts as ended once its thread-specific data destructors have run, where FreeBSD marks it `PS_DEAD`. On Windows a host thread adopted by `scePthreadSelf` that ends without `scePthreadExit` keeps answering 0. Monster Hunter Wilds (PPSA24191) reuses a slot of its thread table only when `scePthreadAttrGet` returns `0x80020003`
 - [scePthreadAttrGet, pthread_attr_get_np and sceKernelIsStack](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) report the stack of a host thread the library did not create, on Windows, from one allocation granule (64 KiB) above the bottom of its reservation when everything above that is committed read-write, as in a relinked executable's main thread and its default-size host threads (0x200000 committed of 0x210000 reserved), so the guest can protect the lowest reported pages, as HotSpot does for its stack guard pages in Java 25 LAN / DNS (PPSA99869). Any other such thread, and every such thread on Linux, gets its whole host stack: on Windows `mprotect` commits its reserved lower pages before protecting them and drops the guard flag of Windows' guard pages, and on Linux it cannot change the unmapped lower pages
 - [sceKernelInstallExceptionHandler](../../../core/libs/prx/libkernel/System/src/Exception.cpp) records the handler, but a host fault still ends the process: only signals raised with `sceKernelRaiseException` are delivered. Unity's PS5Util module installs a SIGUSR1 handler that reads `uc_mcontext.mc_rsp` (offset 0xf8 of the context) and raises SIGUSR1 on other threads to stop them for garbage collection
-- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Linux sends the host SIGUSR1, which the library takes over, to the target thread, so the handler runs wherever the thread was interrupted, emulator code included. On the console kernel objects are system calls and libthr defers signals while a thread holds its internal locks; here a handler that needs a host lock the interrupted code holds deadlocks, and a thread that the handler keeps waiting keeps its host locks. Host waits resume after the handler. The host calls Linux does not restart end early: sleeps that do not retry return before their time, and the poll of `sceNetEpollWait` and socket calls with a send or receive timeout return `EINTR` to the guest
-- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows suspends the target and redirects it to the handler. A target running host code (any module other than the executable and the `*.guest.prx` modules, so libkernel, libc and the other HLE modules count too) is resumed and sampled again until it is back in guest code, since a handler that waits there would keep the host locks that code holds; a target blocked in an ntdll wait is redirected in place, as are NtContinue and winpthreads after their retry limit. A target that stays in host code without waiting for 50 ms after the raise began, such as a long HLE or driver call, is then redirected in host code anyway, with the same hazard. A target seen right after a `syscall` instruction in ntdll, inside a system call that is not a wait such as the `NtWriteFile` of an `fwrite` holding its stream lock, restarts those 50 ms, so a raise can cost the raising thread up to the 1 s retry limit. While the target is suspended only `VirtualQuery` and a lock-free cache of image bases are consulted; an image not yet in the cache is classified with `GetModuleFileNameW` after the target is resumed. An APC queued at the first host-code sample, which an alertable guest wait would run sooner, is not implemented
+- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Linux sends the host SIGUSR1, which the library takes over, to the target thread, so the handler runs wherever the thread was interrupted, emulator code included. On the console kernel objects are system calls and libthr defers signals while a thread holds its internal locks; here a handler that needs a host lock the interrupted code holds deadlocks, and a thread that the handler keeps waiting keeps its host locks. A thread holding the address-wait lock (`sceKernelSyncOnAddressWait`, `sceKernelSyncOnAddressWake`, `_umtx_op`) records the signal and runs the handler once it releases the lock or while it waits; other emulator locks are not deferred. Host waits resume after the handler. The host calls Linux does not restart end early: sleeps that do not retry return before their time, and the poll of `sceNetEpollWait` and socket calls with a send or receive timeout return `EINTR` to the guest
+- [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows suspends the target and redirects it to the handler. A target running host code (any module other than the executable and the `*.guest.prx` modules, so libkernel, libc and the other HLE modules count too) is resumed and sampled again until it is back in guest code, since a handler that waits there would keep the host locks that code holds. The raising thread spins for 20 µs before each new host-code sample: suspended again at once, the target could stay at the same instruction for every sample until the 50 ms below ran out (on a 16-core Ryzen 9 5950X, `guest_raise_in_host_code` then raised into `fwrite` and deadlocked on its stream lock), and the 20 µs is a measured choice, not a console value; a target blocked in an ntdll wait is redirected in place, as are NtContinue and winpthreads after their retry limit. A target that stays in host code without waiting for 50 ms after the raise began, such as a long HLE or driver call, is then redirected in host code anyway, with the same hazard. A target seen right after a `syscall` instruction in ntdll, inside a system call that is not a wait such as the `NtWriteFile` of an `fwrite` holding its stream lock, restarts those 50 ms, so a raise can cost the raising thread up to the 1 s retry limit. While the target is suspended only `VirtualQuery` and a lock-free cache of image bases are consulted; an image not yet in the cache is classified with `GetModuleFileNameW` after the target is resumed. An APC queued at the first host-code sample, which an alertable guest wait would run sooner, is not implemented
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) builds the handler's `ucontext` with FreeBSD's amd64 layout (16-byte sigmask, `mcontext` at 0x40, `mc_rsp` at 0xf8); the console's layout is not verified beyond the fields PS5Util reads
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) does not consult the target thread's signal mask
 - [pthread_sigmask](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) shares the process-wide mask of `sigprocmask` and `_sigprocmask`, which keeps only the first 32 signals; FreeBSD keeps a mask per thread
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) reaches a thread that waits in an alertable `TimedWait` wait through an APC. A thread blocked anywhere else, including all waits under `APS5_COARSE_TIMED_WAITS` and host waits inside the emulator, is redirected and runs the handler only when that wait returns
 - [sceKernelRaiseException](../../../core/libs/prx/libkernel/System/src/Exception.cpp) on Windows runs the handler wherever the target thread was interrupted. It waits only while the thread is inside winpthreads or restoring a context through `NtContinue`, and throws if that lasts 1 s, so a handler that calls into other host code the thread was interrupted in, such as the C runtime's heap or a lock of the emulator, can deadlock on it or reenter it. A thread that holds the address-wait lock of `sceKernelSyncOnAddressWait`, `sceKernelSyncOnAddressWake` and `_umtx_op`, or the park queue lock of the guest mutexes, gets the raise as an APC instead, which runs once it has released the lock or while it waits; the other locks of the emulator are not deferred this way
 - [sigaltstack](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records each thread's alternate signal stack and reports it back, following FreeBSD's `kern_sigaltstack` (`EINVAL` for flags other than `SS_DISABLE`, `ENOMEM` below `MINSIGSTKSZ` 2048), but handlers never run on it, so `SS_ONSTACK` and `EPERM` are never reported
-- [sigpending](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) reports the intersection of the process-wide pending set of `sigtimedwait` and the blocked mask of `_sigprocmask`, as FreeBSD's `sys_sigpending` intersects the pending list with `td_sigmask`, and returns -1 with `EFAULT` for a null set. Because `_sigprocmask` keeps only the first 32 signals, signals 33 to 128 are never blocked and never appear in the set, and setting `SIG_IGN` (or `SIG_DFL` on a signal whose default action is to ignore) does not clear a signal that was already marked pending. PPSA99420 imports it
-- [scePthreadJoin, scePthreadCreate](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - on a PS5 (firmware 13.60) joining a thread a second time returns `ESRCH` (`0x80020003`), as it does here, but a joined thread is kept until `scePthreadCreate` publishes over the same handle storage, so one host object and its handle are retained per distinct guest handle storage location for the lifetime of the process; a guest that joins into a fresh storage location every time keeps every one of them. A null entry crashed the payload and still throws. Joining the calling thread returns `EDEADLK` and a zeroed attribute creates a default thread, as on the console. `scePthreadDetach` on a joined thread answers `EINVAL`, as FreeBSD does on a thread that is not joinable; the console answer for a detach after a join is unverified. Detaching a thread while another thread waits to join it returns `EINVAL`, and a second concurrent join returns `EOPNOTSUPP`, as FreeBSD 11.4's [`thr_detach.c`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_detach.c) and [`thr_join.c`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_join.c) check `joiner`; before this PPSA34015 stopped once with `Joining guest thread: Access is denied` when a thread it was joining was released under the join, and which of the two calls released it was not captured. A detached thread is still released when it ends, so joining it after it ended reads freed memory. A handle value copied to a second storage and joined there retains the object under the original storage key, so a later `scePthreadCreate` over that original storage releases an object the copy still points at, and the copy reads freed memory
+- [sigpending](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) reports the intersection of the process-wide pending set of `sigtimedwait` and the blocked mask of `_sigprocmask`, as FreeBSD's `sys_sigpending` intersects the pending list with `td_sigmask`, and returns -1 with `EFAULT` for a null set. PPSA99420 imports it
+- [scePthreadJoin, scePthreadCreate](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - a joined thread is kept until `scePthreadCreate` publishes over the same handle storage, so one host object and its handle are retained per distinct guest storage location for the life of the process; a guest that joins into a fresh location every time keeps every one. A handle copied to a second storage and joined there retains the object under the original storage key, so a later `scePthreadCreate` over the original storage releases an object the copy still points at, and the copy reads freed memory. A detached thread is released when it ends, so joining it after it ended reads freed memory. A null entry crashed the payload and throws. Joining the calling thread returns `EDEADLK` and a zeroed attribute creates a default thread, as on the console. PPSA34015 once stopped with `Joining guest thread: Access is denied` before the join and detach checks followed the console
+- [scePthreadCreate and scePthreadDetach, measured](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - as in a payload process on a PS5 (firmware 13.60): a name of 32 bytes or more returns `ENAMETOOLONG` (`0x8002003f`) without creating a thread, 31 is kept whole, and a null name gives an empty one; detaching a joined thread returns `ESRCH`; detaching a thread another thread is joining, or a detached one, returns `EINVAL`, as does joining a detached one; a second concurrent join returns `EOPNOTSUPP`; a null thread returns `EINVAL` from both; a null handle pointer to `scePthreadCreate` faulted and throws here. Whether the handle is written before the name check was not measured; here it is left alone
 - [Thread cancellation](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) follows FreeBSD libthr (states and types 0/1 and 0/2, `PTHREAD_CANCELED` 1, the `_pthread_cleanup_info` node layout), not measured on the console. A request is acted on only in `scePthreadTestcancel`, the condition variable, `sem` and `scePthreadSem` waits, `scePthreadJoin` and the sleeps, and their POSIX names; file and socket calls are not cancellation points. An enabled cancellation request wakes POSIX `sleep` and exits the thread. `usleep`, `sceKernelUsleep`, `nanosleep`, `_nanosleep`, `sceKernelNanosleep` and `sceKernelSleep` check cancellation only before and after the host sleep, so an enabled request during those waits is delivered when the sleep ends. The asynchronous type acts like the deferred one, except at the two set calls.
 - [cpuset_setaffinity](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the calling thread, another live guest thread selected by its guest TID, or the calling process is handled; other levels (ROOT/CPUSET) and other scopes (CPUSET/JAIL) throw as unmodelled, invalid levels or scopes return `EINVAL` and unknown thread or process IDs return `ESRCH`, following [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L1281-L1286) thread selection. Bits outside `sceKernelGetAvailableCpumask` are dropped, and a mask with none of those bits fails with `EDEADLK`, as FreeBSD does when the new set has no CPU in common with the parent set. Guest-TID lookup and the update hold the thread registry lock so a join cannot release the target during access. Affinity is recorded for guest CPU reporting and child inheritance, not applied to host scheduling; PS5 behaviour has not been measured
 - [cpuset_getaffinity](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - the calling thread, another live guest thread selected by its guest TID, or the calling process is handled; other levels (ROOT/CPUSET) and other scopes (CPUSET/JAIL) throw as unmodelled, invalid levels or scopes return `EINVAL` and unknown thread or process IDs return `ESRCH`, following [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L426-L437) guest-TID selection, not measured on PS5. For the process the mask is the union of the affinities of the live guest threads, as [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/sys/kern/kern_cpuset.c#L1150-L1156) ORs the mask of every thread in the process; threads the guest did not create through libkernel are not included, and the console result is unverified
 - [pthread_setaffinity_np](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - follows [FreeBSD 11.4](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_affinity.c#L41-L62) libthr over `kern_cpuset_setaffinity` for the calling thread and any live guest thread: a size other than the 32-byte `cpuset_t` returns `ERANGE`, an unknown or finished thread `ESRCH`. Bits outside `sceKernelGetAvailableCpumask` are dropped and a mask with none of those bits returns `EDEADLK`, as `cpuset_setaffinity` does; the affinity is recorded on the guest thread and not applied to the host thread, and the console result is unverified
-- [dup and dup2](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) throw for the combinations they do not model: `dup2` of a guest socket onto descriptors 0 to 2, whose host streams libc writes without the socket table, and on Windows duplicating a directory descriptor. Guest sockets share one socket object between the duplicates; the numbers come from the host descriptor table like those of files. The errno values for descriptor exhaustion are not verified against the console. On Windows a guest `dup2` onto descriptor 1 or 2 keeps host logging on an `_fdopen` of a duplicate, and the guest `FILE` stays on the descriptor that was replaced; opening that duplicate throws (#7791)
+- [dup and dup2](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) throw for the combinations they do not model: `dup2` of a guest socket onto descriptors 0 to 2, whose host streams libc writes without the socket table. Guest sockets share one socket object between the duplicates; the numbers come from the host descriptor table like those of files. The errno values for descriptor exhaustion are not verified against the console. On Windows a guest `dup2` onto descriptor 1 or 2 keeps host logging on an `_fdopen` of a duplicate, and the guest `FILE` stays on the descriptor that was replaced; opening that duplicate throws (#7791)
 - [waitpid](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) returns -1 with `ECHILD` (`EINVAL` for unknown options): nothing here creates a child process; child processes would need a real `waitpid`.
 - [execv](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) throws: replacing the process image is not supported, the same as `execvp`. PPSA97358 imports it and fails to load without it.
 - [execve](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) throws like `execvp`: replacing the process image is not supported. The console behavior for invalid arguments and executable path lookups is not modeled.
 - [sysarch](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - `AMD64_GET_FSBASE`, `AMD64_GET_GSBASE` and `AMD64_SET_GSBASE` follow FreeBSD 11's amd64 [`sysarch`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/amd64/amd64/sys_machdep.c) on Linux x86-64 hosts, through the host's `arch_prctl`. The GS base belongs to the calling thread, a base at or above `0x800000000000` (`VM_MAXUSER_ADDRESS`) returns `EINVAL`, and a null argument returns `EFAULT`. `AMD64_SET_FSBASE` throws, since guest and host code share the thread's FS base for their TLS. In a payload process on a PS5 (firmware 12.70), `I386_GET_FSBASE` (7) and `I386_GET_GSBASE` (9) wrote 4 bytes, the low 32 bits of the FS and GS bases, and failed with `EFAULT` for a null argument; here they do the same on Linux x86-64 hosts. There a GS base set by one thread left the main thread's unchanged, and threads made with `pthread_create` and `scePthreadCreate` started with their creator's GS base; here a guest thread's host thread is created by the creating thread, and Linux's [`copy_thread`](https://github.com/torvalds/linux/blob/v6.6/arch/x86/kernel/process.c#L182-L186) gives a new thread its creator's GS base. The operation numbers FreeBSD 11's amd64 `sysarch` has no case for returned `EINVAL` there for the nine tried, each with a null argument (2, 5, 6, 12, 127, 133, 134, 1000 and -1; 6 is `I386_VM86`, which its header names), as its [default case](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/amd64/amd64/sys_machdep.c#L324-L325) does; here every such number returns `EINVAL` on every host; the numbers other than those nine follow that default case and were not measured. `AMD64_GET_XFPUSTATE` (132) returned 0 there for lengths 0, 64, 128, 256 and 512 (512 was also the largest length a search accepted) and failed with `EINVAL` for 1024, 2048, 4096 and 8192 and with `EFAULT` for a null argument or address, and `I386_GET_XFPUSTATE` (11) failed with `EFAULT` for a null argument; both throw here. The other operations FreeBSD 11's amd64 `sysarch` handles, and every operation it handles on other hosts (Windows keeps its TEB in GS), throw.
 - [kern.proc.pathname](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) returns `/app0/eboot.bin` for pid -1 and the calling process, following FreeBSD's `sysctl_kern_proc_pathname`; the exact pathname on retail consoles remains unverified.
+- [kern.proc.env](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - which variables, if any, the console starts an application with is unverified; `sysctl` {`CTL_KERN`, `KERN_PROC`, `KERN_PROC_ENV`, pid} returns 0 bytes, the empty start-up environment `environ` and libc's `getenv` also begin with, as FreeBSD 11's [`sysctl_kern_proc_env`](https://github.com/freebsd/freebsd-src/blob/releng/11.0/sys/kern/kern_proc.c) copies a process's start-up strings, not later `setenv` changes. Only the calling process's pid is accepted (`ESRCH` otherwise, -1 included); a write returns `EPERM`. PS5VR (PPSA99177) reads it for its own pid at start-up.
 - [kern.proc.vmmap](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctl` {`CTL_KERN`, `KERN_PROC`, `KERN_PROC_VMMAP`, pid} returns packed FreeBSD 11 `kinfo_vmentry` records (144 bytes each, an empty path) for the used ranges of the guest address-space arena, in address order, as [`kinfo_getvmmap`](https://github.com/freebsd/freebsd-src/blob/releng/11.0/lib/libutil/kinfo_getvmmap.c) reads them. A range is one record: the type is always `KVME_TYPE_DEFAULT`, the protection is `sceKernelVirtualQuery`'s for the range's first page (0 where it reports none), and offset, object, resident page counts, flags and path are 0. Only the calling process's pid is accepted (`ESRCH` otherwise, -1 included, as FreeBSD's `pget` gives); a write returns `EPERM` and a short buffer `ENOMEM`. Ranges outside the arena, which guest code cannot map, are not reported. The walk takes the arena lock once per range, not for the whole walk as FreeBSD holds the map lock, so an `mmap` or `munmap` on another thread can change the list between two records. Whether a PS5 application may read its own map, and what types and paths the console reports, is unverified
-- [sysctl names a PS5 payload process gets ENOENT for](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - `sysctlbyname` returns -1 with `ENOENT` for `hw.byteorder`, `hw.cacheline_size`, `hw.machine_arch`, `hw.usermem`, `kern.clockrate`, `kern.maxfiles`, `kern.maxfilesperproc`, `kern.maxproc`, `kern.ps_strings`, `kern.sched.name`, `kern.smp.maxcpus`, `kern.stackprot`, `kern.timecounter.hardware` and `machdep.cacheline_size`, and `sysctl` does the same for the MIBs {1, 6}, {1, 7}, {1, 12}, {1, 27}, {1, 32}, {6, 4} and {6, 11}. The buffer and the length are left alone. A payload process on a PS5 (firmware 12.70) gets this for a read, a size query, a null length and a null buffer with a null length, by name and by MIB. `sysctlnametomib` gives those seven MIBs, and returns `ENOENT` for `hw.cacheline_size`, `hw.usermem` and `machdep.cacheline_size` without touching the count or the first three words of the MIB, as the console does. A write to these names and MIBs throws, except for `machdep.cacheline_size`, which returns `ENOENT` as FreeBSD amd64 does for an OID it does not define; the console's answer to a write was not tried. The console's `sysctlnametomib` gives `kern.smp.maxcpus`, `kern.stackprot`, `kern.sched.name` and `kern.timecounter.hardware` the MIBs {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}, and its `sysctl` returns `ENOENT` for them; here `sysctlnametomib` throws for them. `hw.physmem`, `hw.realmem` and `vm.overcommit` return `ENOENT` on the console too but report values here, as the `hw.realmem` and `vm.overcommit` entries say. A payload process also gets `ENOENT` for `kern.anyps5_no_such_name`, which its `sysctlnametomib` does not resolve; other names still throw here. A title process was not measured
+- [sysctl names measured absent on a PS5 payload](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - On firmware 12.70, a payload gets `ENOENT` for `hw.byteorder`, `hw.cacheline_size`, `hw.machine_arch`, `hw.usermem`, `kern.clockrate`, `kern.maxfiles`, `kern.maxfilesperproc`, `kern.maxproc`, `kern.ps_strings`, `kern.sched.name`, `kern.smp.maxcpus`, `kern.stackprot`, `kern.timecounter.hardware` and `machdep.cacheline_size`. `sysctl` returns `ENOENT` for MIBs {1, 6}, {1, 7}, {1, 12}, {1, 27}, {1, 32}, {6, 4} and {6, 11}; reads and size queries leave output buffers and lengths untouched. `sysctlnametomib` resolves the seven corresponding MIB names and returns `ENOENT` for `hw.cacheline_size`, `hw.usermem` and `machdep.cacheline_size`. Writes and title behavior are unmeasured.
+- [Unknown sysctl names](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - A payload process on firmware 12.70 gets `ENOENT` for `kern.anyps5_no_such_name` through `sysctlbyname` and `sysctlnametomib`; here both name-based calls return `ENOENT` for unrecognized names, following FreeBSD name lookup. This is one payload measurement; title behavior for other unknown names is unverified. Numeric MIBs with no implementation still throw.
 - [hw.pagesize](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports the system page size (16384 bytes, PS5_PAGE_SIZE) as an integer through sysctl MIB {6, 7} (CTL_HW, HW_PAGESIZE) and the "hw.pagesize" sysctlbyname lookup, following FreeBSD's [`hw.pagesize`](https://github.com/freebsd/freebsd-src/blob/main/sys/kern/kern_mib.c#L177), a read-only `SYSCTL_INT` of `PAGE_SIZE`. The value on a PS5 follows the 16 KiB page size the rest of libkernel uses and is unmeasured. A write returns -1 with EPERM.
 - [hw.model](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports the [host CPU's name](../../../core/libs/prx/libkernel/System/src/HostCpu.cpp), built as FreeBSD 11 builds `hw.model`: the CPUID brand string (leaves 0x80000002 to 0x80000004) without leading spaces ([identcpu.c](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/x86/x86/identcpu.c#L683-L691)). Trailing padding stays, as it does there, so an AMD host's name ends in spaces. The name a PS5 reports is unknown. A write returns -1 with `EPERM`. A host without an x86 CPUID brand string, such as an Apple Silicon Mac, throws. PPSA99203 only prints it (`[console] hw.model: %s`)
 - [Host CPU check](../../../core/libs/prx/libkernel/System/src/HostCpu.cpp) (libkernel) - when libkernel loads on a Linux or Windows x86-64 host, it logs which of the PS5 CPU's user-mode extensions CPUID reports and throws, naming the host CPU, if any extension is missing that LLVM selects from plain C/C++ for the PS5's Zen 2 (`-march=znver2`, [feature list](https://github.com/llvm/llvm-project/blob/llvmorg-19.1.7/llvm/lib/Target/X86/X86.td#L1459-L1513)): SSE to SSE4.2, SSSE3, POPCNT, LZCNT, BMI1, BMI2, MOVBE, CMPXCHG16B, LAHF/SAHF, AVX, AVX2, FMA, F16C, and the operating system's AVX state in XCR0 (#3719). SSE4A, CLZERO and SHA, which `--to-intel` converts, and AES, PCLMULQDQ, RDRAND, RDSEED, ADX, CLFLUSHOPT, CLWB, RDPID, XSAVEOPT, XSAVEC and PREFETCHW, which compilers emit only for intrinsics or explicit prefetches, are logged but not required: a title that executes one of them on a host without it still stops with an illegal instruction. macOS hosts are not checked: some Rosetta versions execute extensions without reporting them through CPUID, but support differs by host. ANDN and RDRAND fault on an M1 with macOS 15.3.1; see the [Rosetta conversion limits](relinker.md)
+- [sceKernelGetSystemExVersion, sysKernelGetLowerLimitSysexVersion, sysKernelGetLowerLimitUpdVersion](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) and [sceKernelGetTraceMemoryStats](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - follow libkernel.sprx, libkernel_sys.sprx and libkernel_web.sprx of firmware 13.42, read from disassembly and not measured on a console. None of them asks the kernel: the first writes an empty string to both outputs and returns a plain 22, not `SCE_KERNEL_ERROR_EINVAL`, when either is null; the lower limits write an empty string and a 32-bit 0; the trace memory statistics write 0 to each output that is not null. The meaning of the outputs is not known
 - [machdep.tsc_freq](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) reports the host TSC frequency that `sceKernelGetTscFrequency` measures, as a 64-bit value like FreeBSD 11's [`sysctl_machdep_tsc_freq`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/x86/x86/tsc.c#L658-L676). FreeBSD lets root write it to change the TSC timecounter's frequency; a write here returns -1 with `EPERM`. PPSA99203 reads it at start-up and measures the TSC itself when the value is 100 MHz or less
 - [getrlimit](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - `RLIMIT_CPU`, `RLIMIT_FSIZE`, `RLIMIT_CORE`, `RLIMIT_SBSIZE`, `RLIMIT_VMEM`/`AS`, `RLIMIT_NPTS`, `RLIMIT_SWAP`, `RLIMIT_KQUEUES` and `RLIMIT_UMTXP` report infinity as in FreeBSD's process-0 defaults, and `RLIMIT_DATA` mirrors the host limit; a payload process on a PS5 (firmware 12.70) reads 0x800000000 for both limits. `RLIMIT_NOFILE` reports, as both soft and hard limit, the number of descriptors after which AnyPS5 itself fails with `EMFILE`: on Windows the C runtime's 8192 low-level descriptors, which guest files, pipes and sockets all take, and as many stdio streams, which libkernel raises from 512 at load with [`_setmaxstdio`](https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/setmaxstdio), on Linux the host's `RLIMIT_NOFILE`, whose soft limit libkernel raises to the hard limit at load, and on macOS the smaller of the host's hard limit and `kern.maxfilesperproc`, which libkernel sets as both limits at load, since macOS fails with `EMFILE` at `kern.maxfilesperproc` whatever the soft limit. A payload process on a PS5 (firmware 12.70) reads 13952 for both limits, while `getdtablesize` returns 12555 and the process can open descriptors up to 12554. XPSemu (PPSA97358) reads `RLIMIT_NOFILE` in QEMU's `os_setup_limits` and raises the soft limit to the hard one when they differ. `RLIMIT_STACK` (0x200000), `RLIMIT_RSS` and `RLIMIT_MEMLOCK` (infinity) and `RLIMIT_NPROC` (1604) report the soft and hard limits a payload process reads on a PS5 (firmware 12.70). Guest locking still follows the host: `mlock` and `sceKernelMlock` fail at the host's hard `RLIMIT_MEMLOCK` on Linux, and on Windows when the process working set cannot grow, although `RLIMIT_MEMLOCK` reports infinity. There the main thread's stack is 0x200000 as well (`pthread_attr_get_np`); here the main thread runs on the host thread's stack, whose size can differ. Whether a title process reads the same limits is unverified.
-- [setrlimit](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) validates the resource and input in FreeBSD order, maps negative limits to infinity, and lowers a soft limit above the hard limit. A request other than `RLIMIT_NPROC` succeeds when its normalized values match `getrlimit`, or, for `RLIMIT_NOFILE`, when `rlim_max` does not exceed the current hard limit and `rlim_cur` does not exceed `rlim_max`, storing the updated limits for subsequent `getrlimit` queries; `RLIMIT_NPROC` always throws; descriptor allocation enforcement of the lowered soft limit is not implemented, and changing other limits throws because guest limit state is not stored. In a payload process on a PS5 (firmware 12.70), `setrlimit(RLIMIT_NOFILE)` lowers a requested 13952 to 12555, as the hard and as the soft limit; here a request within the current hard limit is stored as given and one above it throws; setting `RLIMIT_STACK`, `RLIMIT_RSS` and `RLIMIT_MEMLOCK` to their current values succeeds and changes nothing, as here; setting `RLIMIT_NPROC` to its current 1604 also succeeds but leaves 1443, as FreeBSD 11 would if the console's `maxproc` were 1604: process 0's limit starts at `maxproc` ([`init_main.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/init_main.c#L550-L551)), `maxprocperuid` starts at nine tenths of it ([`subr_param.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/subr_param.c#L258)), and `setrlimit` lowers an `RLIMIT_NPROC` limit above `maxprocperuid` to it ([`kern_resource.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_resource.c#L714-L718)); 1604 × 9 / 10 gives 1443. Neither value is measured: `kern.maxproc` fails with `ENOENT` in the payload process. Here that call throws, because the limit is not stored. Java 25 LAN / DNS (PPSA99869) sets `rlim_cur = MIN(0x100000, rlim_max)` during VM initialization
+- [setrlimit](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) validates the resource and input in FreeBSD order, maps negative limits to infinity, and lowers a soft limit above the hard limit. A request other than `RLIMIT_NPROC` succeeds when its normalized values match `getrlimit`, or, for `RLIMIT_NOFILE`, when `rlim_max` does not exceed the current hard limit and `rlim_cur` does not exceed `rlim_max`, storing the updated limits for subsequent `getrlimit` queries; descriptor allocation enforcement of the lowered soft limit is not implemented, and changing other limits throws because guest limit state is not stored. In a payload process on a PS5 (firmware 12.70), `setrlimit(RLIMIT_NOFILE)` lowers a requested 13952 to 12555, as the hard and as the soft limit; here a request within the current hard limit is stored as given and one above it throws; setting `RLIMIT_STACK`, `RLIMIT_RSS` and `RLIMIT_MEMLOCK` to their current values succeeds and changes nothing, as here; setting `RLIMIT_NPROC` to its current 1604 also succeeds but leaves 1443. `RLIMIT_NPROC` follows FreeBSD 11 by clamping both values to 1 through `maxprocperuid`, stores the result and returns it from `getrlimit`. The initial 1604 and `maxprocperuid` 1443 follow that measurement: process 0's limit starts at `maxproc` ([`init_main.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/init_main.c#L550-L551)), `maxprocperuid` starts at nine tenths of it ([`subr_param.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/subr_param.c#L258)), and `setrlimit` applies that bound ([`kern_resource.c`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_resource.c#L714-L718)). `kern.maxproc` fails with `ENOENT` in the payload process, so the values cannot be queried independently, and process creation does not enforce the stored limit. Java 25 LAN / DNS (PPSA99869) sets `rlim_cur = MIN(0x100000, rlim_max)` during VM initialization
 - [execvp](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) throws: replacing the process image is not supported. PPSA85300 imports it and fails to load without it; its `fork` and `vfork` fail with `ENOSYS` ([libc_missing.c](https://github.com/ZiZc3/VLC/blob/f3253020a64368153233ede29183014c0b6c8979/ps5/compat/libc_missing.c#L290-L292)), so the child process that would call it is never created.
 - [nmount](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) throws: mounting file systems is not supported. Prospero Themes (PPSA90210) imports it and fails to load without it; it opens its theme library without calling it, and its strings (`/dev/ssd0.system_ex`, `/system_ex`, `exfatfs`, `fstype`, `fspath`, `from`, `ignoreacl`) point to remounting the console's `/system_ex` partition to write theme files there.
-- [socketpair](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - the pair is the host's `AF_UNIX` pair on Linux and macOS and, on Windows, a loopback TCP connection for `SOCK_STREAM` or two connected UDP sockets for `SOCK_DGRAM`; `SOCK_SEQPACKET` throws on Windows and macOS, which has no such `AF_UNIX` pair. A datagram sent to a full receiver gets `ENOBUFS` on the console, waits or gets `EAGAIN` on Linux and is dropped on Windows, and on Windows a datagram `recv` after the peer closed reports `ECONNRESET` instead of the console's `ENOTCONN`, and a stream `send` after the peer closed reports `ECONNABORTED` instead of the console's `EPIPE`. `read` and `write` on a pair end go to the host like on every guest socket. `getpeername` on a pair end succeeds after the peer closed, where the console returns `ENOTCONN`, and `connect`, `bind` and `sendto` with an address on a pair end report an address-family error instead of the console's `EISCONN`. On Windows `poll` on a stream end reports `POLLHUP` without `POLLIN` after the peer's `shutdown(SHUT_WR)` or `close`, where the console reports `POLLIN`, with `POLLHUP` only after `close`
+- [socketpair](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - the pair is the host's `AF_UNIX` pair on Linux and macOS and, on Windows, a loopback TCP connection for `SOCK_STREAM` or two connected UDP sockets for `SOCK_DGRAM`; `SOCK_SEQPACKET` throws on Windows and macOS, which has no such `AF_UNIX` pair. A datagram sent to a full receiver gets `ENOBUFS` on the console, waits or gets `EAGAIN` on Linux and is dropped on Windows, and on Windows a datagram `recv` after the peer closed reports `ECONNRESET` instead of the console's `ENOTCONN`, and the first stream `send` after the peer closed succeeds on the loopback connection, where the console returns `EPIPE`; the sends after it report `EPIPE`. `read` and `write` on a pair end go to the host like on every guest socket. `getpeername` on a pair end succeeds after the peer closed, where the console returns `ENOTCONN`, and `connect`, `bind` and `sendto` with an address on a pair end report an address-family error instead of the console's `EISCONN`. On Windows `poll` on a stream end reports `POLLIN` after the peer's `shutdown(SHUT_WR)` or `close`, as the console does after a `shutdown(SHUT_WR)`; after the peer's `close` the console reports `POLLIN` with `POLLHUP`, because `unp_drop` disconnects the other end, and the loopback connection cannot tell that from a shutdown, so no `POLLHUP` is reported
 - Guest sockets on macOS ([the equeue wait, kevent, fstat and ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp), [gethostbyname](../../../core/libs/prx/libScePosixForWebKit/Resolver.cpp)): macOS has no `ppoll`, so the wait uses `poll` with the timeout rounded up to a millisecond; it has no `POLLRDHUP`, so a stream that the peer closed is found by peeking one byte when it is readable; `FIONREAD` on a datagram socket, and the byte count that `fstat` and `kevent` report for it, is `SO_NREAD`, the size of the next datagram, because macOS adds the source address to `FIONREAD`; and `gethostbyname` replaces `gethostbyname_r`, which macOS lacks.
-- [UDP recv/recvfrom](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) and [sceNetRecv/sceNetRecvfrom](../../../core/libs/prx/libSceNet/Export.cpp) translate Windows WSAEMSGSIZE into the copied byte count for datagram sockets, including MSG_PEEK, and retain the sender address. This follows FreeBSD 11.4 recv(2) and Winsock's documented truncated-datagram behavior; console behavior and existing title impact are unverified.
 - [recvmsg](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) loses received stream data on an output copy fault: outputs are checked after the host receive. FreeBSD 11.4 leaves unread stream data queued, though it also drops a datagram on a copy fault ([`soreceive_dgram`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L2308-L2312), [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1758-L1774)). A Linux `process_vm_readv` or `process_vm_writev` failure other than `EFAULT` throws
 - [MSG_DONTWAIT](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) in `send`, `sendto`, `sendmsg`, `recv`, `recvfrom` and `recvmsg` makes that one call non-blocking through the host's `MSG_DONTWAIT`, as FreeBSD 11.4's `soreceive_generic` returns `EWOULDBLOCK` for it (`sys/kern/uipc_socket.c`). Winsock has no per-call non-blocking flag, so on Windows the call first asks `WSAPoll` with a zero timeout whether the socket is ready and fails with `EAGAIN` when it is not. The check and the transfer are two host calls: a second thread that takes the data in between can leave a `recv` blocked, and a `send` of more bytes than the socket buffer holds can still block until it has sent them, where FreeBSD's `sosend_generic` returns a partial count
 - [MSG_WAITALL](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) in `recv`, `recvfrom` and `recvmsg` on a stream socket is passed to the host, which returns when the buffer is full, the peer closes or an error occurs, as FreeBSD 11.4's [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1855-L1860) does; a datagram socket ignores it. It is not measured on a console, a nonblocking socket and a call that also passes `MSG_PEEK` follow the host's rules, and `SO_RCVTIMEO` bounds only the wait for the first data. Any other flag still fails with `EOPNOTSUPP`.
-- [recv and recvfrom](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answer without the host a zero-length receive on a stream socket (0, or `ENOTCONN` when it is not connected, [L1566-L1578](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1566-L1578)) and, on Windows only, a receive on a socket whose read side `shutdown` closed (0, as [`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1556-L1562) returns at `SBS_CANTRCVMORE`); Winsock fails the second with `EPIPE` and blocks on the first. Linux and macOS still return data buffered before the `shutdown`, where FreeBSD discards it. `recvmsg` still asks the host in both cases. Not measured on a console.
+- [recv and recvfrom](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answer some cases without the host. A zero-length receive on a stream socket returns 0, or `ENOTCONN` when it is not connected ([L1566-L1578](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1566-L1578)), as on a PS5 (firmware 13.60). On an empty datagram socket it returns 0 at once; the console was measured only with `MSG_DONTWAIT`, and the blocking case follows FreeBSD 11.4's `soreceive_dgram`, which returns 0 before waiting. `recvmsg` answers the empty datagram socket the same way but asks the host in the stream cases. A datagram another thread takes after the check makes a zero-length receive wait
+- [recv and recvfrom after `shutdown(SHUT_RD)`](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) return 0 on Windows ([`soreceive_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L1556-L1562)) where Winsock fails with `EPIPE`; Linux and macOS still return data buffered before it, which the console discards.
 - [send, sendto](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - send and sendto without an address on an unconnected datagram socket map Windows `WSAENOTCONN` to FreeBSD's `EDESTADDRREQ` (39).
-- [bind, connect, sendto](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) check a socket address length as FreeBSD 11.4's [`getsockaddr`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_syscalls.c) and the `sa_len` test of `tcp_usr_connect` and `in_pcbconnect` do: below 2 or an `AF_INET` address below 16 or an `AF_INET6` address below 28 bytes fails with `EINVAL`, above 255 with `ENAMETOOLONG`. An address longer than `sockaddr_in` or `sockaddr_in6` is still accepted where FreeBSD answers `EINVAL`, and an address of another family still fails with `EAFNOSUPPORT`, as the console's behaviour for these is not known. None of this was measured on a console.
+- [bind, connect, sendto](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) check a socket address length as FreeBSD 11.4's [`getsockaddr`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_syscalls.c) and the `sa_len` test of `tcp_usr_connect` and `in_pcbconnect` do: below 2 or an `AF_INET` address below 16 or an `AF_INET6` address below 28 bytes fails with `EINVAL`, above 255 with `ENAMETOOLONG`. `sendto` does not check an address longer than `sockaddr_in` on an `AF_INET` datagram socket, where `udp_output` answers `EINVAL` unless the socket has a local address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, nor on an unconnected stream socket, which FreeBSD connects implicitly through `tcp_connect` and its length test. An address of another family still fails with `EAFNOSUPPORT`, as the console's behaviour for it is not known. None of this was measured on a console.
 - [read, write and vector I/O](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) on a guest socket use `recv` and `send` without flags; `sceKernelReadv` and `sceKernelWritev` gather or scatter through one socket operation, preserving stream short reads and datagram boundaries. The positioned `pread`, `pwrite`, `preadv` and `pwritev` forms, and their `sceKernel` forms, return `ESPIPE` for an open guest socket and `EBADF` for a closed one. `EPIPE` from a write raises the host's `SIGPIPE` on Linux unless the socket has `SO_NOSIGPIPE` set, and the guest cannot ignore it: `signal(SIGPIPE, SIG_IGN)` and `sigaction` record the disposition, as they do for every number from 1 to 128, but only the six signals with host equivalents (2, 4, 6, 8, 11 and 15) take effect on the host or are delivered, so the host `SIGPIPE` is not stopped; nothing is raised on Windows; a `write` longer than `INT_MAX` bytes is `EMSGSIZE` where the console sends it. AIO on a guest socket still goes to the host, which has no such descriptor
 - [Socket descriptor numbers](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel, libSceNet) - `socket`, `accept`, `socketpair`, `dup`, `sceNetSocket` and `sceNetAccept` take the lowest free number of the host descriptor table that files use, as FreeBSD 11.4 `fdalloc` takes the lowest free entry of the one process table (`kern_descrip.c`), so every number stays below `FD_SETSIZE` (1024) while fewer than 1024 descriptors are open. The number holds a zero-access `NUL` handle on Windows and a duplicate of the host socket on Linux, and the socket tables map it to the socket. The host table also holds the runtime's own files, so the numbers differ from the console's; the first number `socket` and `sceNetSocket` return on a console and its `getdtablesize` are not measured. Paths that bypass the socket tables see the placeholder: libc `fdopen` on a socket opens it, and libkernel `close` of a libSceNet socket releases the number but leaves the libSceNet socket open. Palworld (PPSA23126), The Mound (PPSA26223) and Dying Light 2 (PPSA02262) set socket bits in a 1024-bit `fd_set`
 - [fstat on a guest socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) fills the fields FreeBSD 11's soo_stat and pru_sense_null fill and zeroes the rest: S_IFSOCK, the read bits while the receive side is open or data is queued, the write bits while the send side is open, st_size and st_blksize. Only this process's shutdown closes a side here; a peer's shutdown, close or reset does not clear the bits as FreeBSD's socantrcvmore and socantsendmore do. st_size is the host's FIONREAD, which for a Linux datagram socket is the size of the next datagram where FreeBSD counts every queued byte, and st_blksize is the host's SO_SNDBUF, which Linux reports as twice the size that was set. A socketpair end reports st_dev and st_ino 0, where FreeBSD's uipc_sense reports NODEV and a per-socket number
-- [poll](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) waits on guest sockets and pipes, through `WSAPoll` on Windows and `poll` on Linux; the `pollfd` layout and flag values are FreeBSD's. A libSceNet socket joins the same host wait through the native socket libSceNet lends to libkernel. `WSAPoll` rejects `POLLPRI`, so on Windows a socket's `POLLPRI` is asked as `POLLRDBAND` and `POLLIN` as `POLLRDNORM`; Winsock reports urgent data until it is read with `MSG_OOB`, where FreeBSD 11.4's `sopoll_generic` stops once the normal stream passes the mark. Guest `send` and `recv` refuse `MSG_OOB` with `EOPNOTSUPP`, so urgent data can only come from an outside peer and Windows keeps reporting `POLLPRI` after the stream passes the mark. A pipe follows FreeBSD's `pipe_poll`: the read end is readable when data is buffered, either end reports `POLLHUP` once the other end is closed, with the requested `POLLIN` and `POLLRDNORM` bits and without `POLLOUT`, which `pollscan` clears, and the write end is writable when `PIPE_BUF` (512) bytes are free on Windows, or when the host kernel says so on Linux. `POLLOUT` on a read end throws: FreeBSD opens both ends for reading and writing and reports it writable, and host pipes are one-way. Windows pipes cannot be waited on, so while a pipe is polled `poll` checks it with `NtQueryInformationFile` and waits on the sockets in slices of 1 ms. A regular file, a directory or a file read from app0.zar is always ready for `POLLIN`, `POLLRDNORM` and `POLLOUT` and never for `POLLPRI`, `POLLRDBAND` or `POLLWRBAND`, as FreeBSD 11.4's [`vop_stdpoll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_default.c#L563-L574) and `vop_nopoll` answer every event `poll` accepts; which of the two the console's filesystems use is not known, and they agree on these events. `/dev/random` and `/dev/urandom` follow FreeBSD 11.4's [`randomdev_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/dev/random/randomdev.c#L274-L285) for a seeded device: a request with `POLLIN` or `POLLRDNORM` gets only those bits back, and any other request gets every requested bit. Open descriptors 0 to 2 follow the console model `select` uses: descriptor 0 never reports an event and descriptors 1 and 2 report `POLLOUT`, whatever the host attaches to them. A closed descriptor reports `POLLNVAL`, and an open descriptor that is neither a guest socket, a libSceNet socket, a pipe, a file, a directory, the random device nor descriptor 0 to 2 (other devices, a kqueue) throws, as do event bits other than `POLLIN`, `POLLPRI`, `POLLOUT`, `POLLRDNORM`, `POLLRDBAND` and `POLLWRBAND` (the `POLLERR`, `POLLHUP` and `POLLNVAL` bits are ignored in `events`), an infinite timeout with no socket or pipe to wait on. A closed socket descriptor reports `POLLNVAL`; the console's limit on the descriptor count is unknown and not checked
+- [poll](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) waits on guest sockets and pipes, through `WSAPoll` on Windows and `poll` on Linux; the `pollfd` layout and flag values are FreeBSD's. A libSceNet socket joins the same host wait through the native socket libSceNet lends to libkernel. `WSAPoll` rejects `POLLPRI`, so on Windows a socket's `POLLPRI` is asked as `POLLRDBAND` and `POLLIN` as `POLLRDNORM`; Winsock reports urgent data until it is read with `MSG_OOB`, where FreeBSD 11.4's `sopoll_generic` stops once the normal stream passes the mark. Guest `send` and `recv` refuse `MSG_OOB` with `EOPNOTSUPP`, so urgent data can only come from an outside peer and Windows keeps reporting `POLLPRI` after the stream passes the mark. A pipe follows FreeBSD's `pipe_poll`: the read end is readable when data is buffered, either end reports `POLLHUP` once the other end is closed, with the requested `POLLIN` and `POLLRDNORM` bits and without `POLLOUT`, which `pollscan` clears, and the write end is writable when `PIPE_BUF` (512) bytes are free on Windows, or when the host kernel says so on Linux. `POLLOUT` on a read end throws: FreeBSD opens both ends for reading and writing and reports it writable, and host pipes are one-way. Windows pipes cannot be waited on, so while a pipe is polled `poll` checks it with `NtQueryInformationFile` and waits on the sockets in slices of 1 ms. A kqueue is ready for `POLLIN` and `POLLRDNORM` while one of its events is triggered and for no other event, as FreeBSD 11.4's [`kqueue_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c#L1900-L1924) answers. A kqueue cannot be waited on either, so on every host `poll` checks it every millisecond and waits on the other descriptors in slices of 1 ms. A kqueue closed during the wait reports `POLLNVAL`, and one whose number was reused is polled again with the rest of the timeout, as FreeBSD 11.4's [`pollrescan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1499-L1519) looks the descriptor up again. A close that has already removed the kqueue but not yet closed its host descriptor is seen as a descriptor of unknown kind, which throws. A regular file, a directory or a file read from app0.zar is always ready for `POLLIN`, `POLLRDNORM` and `POLLOUT` and never for `POLLPRI`, `POLLRDBAND` or `POLLWRBAND`, as FreeBSD 11.4's [`vop_stdpoll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/vfs_default.c#L563-L574) and `vop_nopoll` answer every event `poll` accepts; which of the two the console's filesystems use is not known, and they agree on these events. `/dev/random` and `/dev/urandom` follow FreeBSD 11.4's [`randomdev_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/dev/random/randomdev.c#L274-L285) for a seeded device: a request with `POLLIN` or `POLLRDNORM` gets only those bits back, and any other request gets every requested bit. Open descriptors 0 to 2 follow the console model `select` uses: descriptor 0 never reports an event and descriptors 1 and 2 report `POLLOUT`, whatever the host attaches to them. A closed descriptor reports `POLLNVAL`, and an open descriptor that is neither a guest socket, a libSceNet socket, a pipe, a file, a directory, the random device nor descriptor 0 to 2 (other devices) throws, as do event bits other than `POLLIN`, `POLLPRI`, `POLLOUT`, `POLLRDNORM`, `POLLRDBAND` and `POLLWRBAND` (the `POLLERR`, `POLLHUP` and `POLLNVAL` bits are ignored in `events`), an infinite timeout with no socket, pipe or kqueue to wait on. A closed socket descriptor reports `POLLNVAL`; the console's limit on the descriptor count is unknown and not checked
+- [poll](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) on Windows reports a guest stream socket whose peer closed as readable and adds `POLLHUP` only once the socket has shut its own sending side, as FreeBSD 11.4's [`sopoll_generic`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c#L3080-L3086) does; `WSAPoll` reports `POLLHUP` alone in both cases. A reset or refused connection (`POLLHUP` with `POLLERR`) keeps `WSAPoll`'s flags, a libSceNet socket keeps them too, and a call that asks for no event still returns early on the peer's close with nothing reported. Not measured on a console.
 - [kevent EV_CLEAR on a socket or a pipe](../../../core/libs/prx/libkernel/Equeue/src/EdgeWatch.cpp) (libkernel) - FreeBSD 11 activates an `EV_CLEAR` knote when `kqueue_register` finds it ready, which every `EV_ADD` or `EV_ENABLE` of an enabled knote does again, and on each `KNOTE` the socket or pipe raises (`sorwakeup`, `sowwakeup`, `pipeselwakeup`); [`kqueue_scan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c) checks the filter again before reporting, drops a knote that is no longer ready and deactivates a reported one until the next activation. On Linux each such knote registers the host socket or pipe with its own epoll instance in edge-triggered mode (`EPOLLIN | EPOLLRDHUP` for `EVFILT_READ`, `EPOLLOUT` for `EVFILT_WRITE`), and a wakeup of the host descriptor with that mask stands for a `KNOTE`: the knote is then checked with the same readiness test as a level-triggered one, `NOTE_LOWAT` mark included, and a wait blocks on the epoll descriptor instead of the socket, so a socket that stays readable does not wake it. The host's wakeups are not FreeBSD's: FreeBSD raises `sowwakeup` whenever send buffer space is freed, while Linux TCP wakes `EPOLLOUT` waiters only once the socket is writable again after a write found it full (`SOCK_NOSPACE`, [`tcp_check_space`](https://github.com/torvalds/linux/blob/v6.8/net/ipv4/tcp_input.c#L5639)), so a TCP writer that never fills its buffer sees fewer `EVFILT_WRITE` events than on FreeBSD; a host stack may also coalesce data wakeups, so the number of times a busy socket fires can differ. Windows and macOS throw, as the host there has no edge-triggered wait over these descriptors that is wired up; `EV_CLEAR` on the timer, user and vnode filters does not use this and works everywhere.
 - [kevent on a pipe](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - host pipes are one-way, where FreeBSD's [`kern_pipe`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/sys_pipe.c#L422) opens both ends for reading and writing, so `EVFILT_READ` on the write end and `EVFILT_WRITE` on the read end throw; on macOS `EVFILT_WRITE` on a pipe throws, as the host has no call for a pipe's capacity. `EVFILT_WRITE` reports the free space of the host buffer, not of FreeBSD's 16 KiB one, and on Linux fires when the host says the pipe is writable rather than at `PIPE_BUF` (512) free bytes. Windows pipes cannot be waited on, so a kqueue waiting on one checks it every 1 ms. Otherwise [`filt_piperead`](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/sys_pipe.c#L1787-L1828) and `filt_pipewrite` are followed: `EV_EOF` once the other end closes, `EPIPE` for a write event added after the read end closed, and `NOTE_LOWAT` ignored. On Windows `fcntl` cannot make a pipe write end non-blocking, so the full-pipe and drain case of `EVFILT_WRITE` is tested on Linux only and the `NtQueryInformationFile` write quota is checked there only for the free space, `EV_EOF` and `EPIPE`.
 - [kevent on a kqueue](../../../core/libs/prx/libkernel/Equeue/src/Kqueue.cpp) (libkernel) - `EVFILT_READ` on a kqueue counts the watched queue's enabled notes that are ready when it is evaluated, where [`filt_kqueue`](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/sys/kern/kern_event.c#L363-L370) reports `kq_count`, the queued notes: a queued note counts until that kqueue is scanned, even once disabled or no longer ready (a socket or pipe read empty, a user note cleared, a watched kqueue drained), so FreeBSD can report it readable where this reports nothing. A queued `EV_ONESHOT` note is reported there with its last count and deleted; here it is evaluated again and, if the watched queue is empty by then, neither reported nor deleted. `EV_CLEAR` throws, as FreeBSD re-arms it only when the watched kqueue queues a note. A cycle of watches throws; a note on the queue itself is `EINVAL`. Not measured on a console
-- [Socket error numbers](../../../core/libs/prx/libkernel/Socket/include/SocketError.hpp) (libkernel) - a host socket error becomes the FreeBSD 11 `errno.h` number of the same name; the numbers are not checked on the console. Winsock `WSAESHUTDOWN` becomes `EPIPE`, as a send after `shutdown` does on FreeBSD, and a host error with no FreeBSD socket counterpart becomes `EIO`. A nonblocking `connect` in progress reports `EINPROGRESS` on Linux but `EAGAIN` on Windows (`WSAEWOULDBLOCK`), where FreeBSD reports `EINPROGRESS`. On Windows a refused nonblocking `connect` is never reported (`SO_ERROR` is unsupported), so a repeated one keeps reporting `EALREADY` where FreeBSD reports `ECONNREFUSED`. A receive after `shutdown(SHUT_RD)` reports `EPIPE` on Windows where FreeBSD returns 0
-- [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) on a guest socket handle the SOL_SOCKET level, `TCP_NODELAY` and `IPV6_V6ONLY`, after FreeBSD 11.4's [`sosetopt` and `sogetopt`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c): `SO_REUSEADDR`, `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and `SO_ERROR`, `SO_TYPE`, `SO_ACCEPTCONN`, `SO_SNDBUF` and `SO_RCVBUF` are read. A boolean option reads back as its own bit, as FreeBSD returns `so_options & option`. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new `connect`; a second failure with the same code on the same socket without a `connect` in between would be hidden. `SO_SNDBUF` and `SO_RCVBUF` read the host's value, which is not the size FreeBSD reports (Linux doubles it). `SO_NOSIGPIPE` is kept per socket and reads back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal. An accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. `SO_NBIO` (`0x1200`) is the console's own option, not FreeBSD's. It switches the socket between blocking and non-blocking as `FIONBIO` does and reads back as 0 or 1, as `sceNetSetsockopt` and `sceNetGetsockopt` treat it here; what the console reads back for it is not measured. `TCP_NODELAY` (`IPPROTO_TCP`, 1) is set on the host socket and reads back as `TF_NODELAY` (4), as [`tcp_default_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/tcp_usrreq.c#L1860-L1861) returns it. The `IPPROTO_TCP` level on a datagram or `AF_UNIX` socket fails with `EINVAL`, as [`ip_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet/ip_output.c#L943-L944) and [`uipc_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_usrreq.c#L1228-L1229) answer it, and an accepted socket takes `TCP_NODELAY` through the host. `SO_SNDTIMEO` and `SO_RCVTIMEO` follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689) and [`sogetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2846-L2850). A 16-byte `timeval` with a negative field or 1000000 microseconds or more fails with `EDOM`, and more than `INT32_MAX` seconds becomes the longest wait. The value is kept and read back through FreeBSD's 32.32 fixed-point conversion ([`tvtosbt`, `sbttotv`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/sys/time.h#L178-L286)), so half a second reads back as 499999 microseconds and one microsecond as 0. A `recv`, `recvfrom`, `recvmsg`, `read` or `readv`, and a `send`, `sendto`, `sendmsg`, `write` or `writev`, on a blocking socket then waits that long for the host to report the socket readable or writable, and fails with `EWOULDBLOCK`; a call with `MSG_DONTWAIT` does not wait. An accepted socket takes both from its listener ([`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L629-L630)). The wait covers only the first transfer: once the socket is writable the host send runs without a limit, where FreeBSD stops a send that cannot finish and returns the bytes sent so far, and a receive whose data another thread takes between the wait and the host call blocks again. `sendfile` ignores the send timeout. The host wait has millisecond steps, so a shorter timeout lasts up to a millisecond longer. A null value fails with `EINVAL`, where FreeBSD's [`kern_setsockopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L1414-L1415) returns `EFAULT`. `IPV6_V6ONLY` (`IPPROTO_IPV6`, 27) on an `AF_INET6` socket is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL` ([L1572](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1572)), as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as FreeBSD's default `net.inet6.ip6.v6only` does, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The `IPPROTO_IPV6` level on an `AF_INET` or `AF_UNIX` socket fails with `EINVAL`, as `ip_ctloutput` and `uipc_ctloutput` answer it. Every other SOL_SOCKET option (`SO_DEBUG`, `SO_USELOOPBACK`, `SO_REUSEPORT` and `SO_TIMESTAMP`, which FreeBSD stores, the low-water marks among them; PPSA99871 sets `SO_REUSEPORT` and carries on when it fails), every other `IPPROTO_TCP` option (`TCP_MAXSEG`, `TCP_KEEPIDLE`, `TCP_KEEPINTVL` and `TCP_KEEPCNT` among them), every other `IPPROTO_IPV6` option ([L1928-L1929](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1928-L1929), [L2158-L2159](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L2158-L2159)) and the `IPPROTO_IP` level fail with `ENOPROTOOPT`. None of this was measured on a console.
-- [connect to AF_UNSPEC](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again; one bound to port 0 is bound again to the wildcard address with the port it had
-- [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an unconnected `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), as FreeBSD 11.4's `in_pcbconnect_setup()` and `in6_pcbconnect()` do. A connected stream socket keeps its host `EISCONN` answer. Known gaps: on an already connected datagram socket `connect` to port 0 keeps the old peer, where FreeBSD's `soconnect()` disconnects first and then fails with 49; `sendto` and `sendmsg` to port 0 are sent, where `udp_output()` fails with 49 on the unbound path but FreeBSD can send to port 0 from a socket bound to a specific address and port. The answers are taken from the FreeBSD source and are not measured on a console. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed
-- [msync](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `kern_msync` and `vm_map_sync`, not measured on the console: the address is rounded down to the page, a range that wraps is `EINVAL`, as is `MS_ASYNC` with `MS_INVALIDATE`, and a range whose start or any page is not mapped (as `sceKernelVirtualQuery` reports it, reservations included) is `ENOMEM`; a page unmapped from inside a larger mapping still counts as mapped there, since `sceKernelVirtualQuery` keeps reporting the whole mapping. The guest has no file mappings, so a successful call writes nothing back. `MS_INVALIDATE` on a mapped range throws: FreeBSD returns `EBUSY` when the range holds `mlock`ed pages, and locked pages are not tracked
+- [Socket error numbers](../../../core/libs/prx/libkernel/Socket/include/SocketError.hpp) (libkernel) - a host socket error becomes the FreeBSD 11 `errno.h` number of the same name; the numbers are not checked on the console. Winsock `WSAESHUTDOWN` becomes `EPIPE`, as a send after `shutdown` does on FreeBSD, and a host error with no FreeBSD socket counterpart becomes `EIO`. On Windows a refused nonblocking `connect` is never reported (`SO_ERROR` is unsupported), so a repeated one keeps reporting `EALREADY` where FreeBSD reports `ECONNREFUSED`. A receive after `shutdown(SHUT_RD)` reports `EPIPE` on Windows where FreeBSD returns 0
+- [getsockopt, setsockopt](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - a guest socket has the SOL_SOCKET level, five `IPPROTO_TCP` options, `IPV6_V6ONLY` and seven `IPPROTO_IP` options. `TCP_NOPUSH`, `TCP_NOOPT` and `TCP_KEEPINIT` fail with `ENOPROTOOPT` (42), where a payload process on a PS5 (firmware 13.60) read them as 0, and so does `SO_ACCEPTFILTER` (0x1000), which the console fails with `EINVAL` for a set and a get on a non-listening socket, as FreeBSD 11.4 does; the other options of these levels fail with `ENOPROTOOPT` and were not all measured. `SO_KEEPALIVE`, `SO_DONTROUTE`, `SO_BROADCAST`, `SO_OOBINLINE` and `SO_LINGER` act on the host socket, and a boolean one reads back as its own bit, as there. Winsock does not clear a pending error when `SO_ERROR` reads it, so on Windows a pending error is reported once and again only after a new `connect`; a second failure with the same code without a `connect` in between is hidden
+- [SO_DEBUG, SO_REUSEADDR, SO_USELOOPBACK, SO_REUSEPORT, SO_TIMESTAMP, SO_BINTIME and option 0x10000](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept as bits that read back as on a PS5 (firmware 13.60, payload process), and options 0x4000 and 0x8000 are accepted and cannot be read, as there; only `SO_REUSEADDR` and `SO_REUSEPORT` change what the socket does. Both are set on the host, `SO_REUSEPORT` as `SO_REUSEADDR` on Windows, which has no `SO_REUSEPORT` and there also lets the socket bind over one that did not set it; Linux spreads unicast datagrams across the sockets, where FreeBSD gives each to one. Option 0x10000 is only kept: if the console treats it as FreeBSD 12's `SO_REUSEPORT_LB`, two sockets that set it share a port there, where the second `bind` here fails with `EADDRINUSE`. An accepted socket takes the bits from its listener, as FreeBSD 11.4's `sonewconn` copies `so_options`; that was not measured
+- [IP_ADD_MEMBERSHIP, IP_DROP_MEMBERSHIP, IP_MULTICAST_IF](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - set on the host socket after the checks a PS5 (firmware 13.60, payload process) showed: `EOPNOTSUPP` on a stream socket, `EINVAL` for a short value or a group outside 224.0.0.0/4, `EADDRINUSE` for a group joined twice and `EADDRNOTAVAIL` for one not joined, tracked per socket. An interface the host lacks fails with the host's error (`EADDRNOTAVAIL` on the console). A group joined through `INADDR_ANY` and through that interface's address counts as two here. Not measured, after FreeBSD 11.4: a drop through `INADDR_ANY` leaves the first such group on any interface (`inp_leave_group`), and the other multicast options fail with `EOPNOTSUPP` on a stream socket (`inp_setmoptions`). An `ip_mreqn` with a non-zero index or address throws, as only a zeroed one was measured, and so does reading `IP_MULTICAST_IF` into 12 bytes, where FreeBSD returns an `ip_mreqn`
+- [TCP_MAXSEG](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per stream socket, read as 536 at first and failing with `EINVAL` for 1000, 70000 and 100, as a payload process on a PS5 (firmware 13.60) did. No segment set succeeded there, so the rule here, `EINVAL` above the current segment or below 176 and any segment between accepted, follows FreeBSD 11.4's `tcp_default_ctloutput` (`optval + 40 >= V_tcp_minmss`) and is not measured. An `AF_INET6` socket also starts at 536 here, where FreeBSD's `tcp_newtcpcb` uses 1220; not measured. The segment is not set on the host socket, so the host's segment size is its own, and a connected socket still reads the segment it was given instead of the negotiated one
+- [TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per stream socket and read back as a payload process on a PS5 (firmware 13.60) did: 7200, 75 and 8 at first, 0 restoring a keepalive default, and a count stored as an unsigned value. They are not set on the host socket, so the host's keepalive timers are its own while `SO_KEEPALIVE` is applied there. An interval above 4294967 seconds fails with `EINVAL`, after FreeBSD 11.4's `tcp_default_ctloutput` with `hz` taken as 1000, and an accepted socket takes the keepalive values from its listener as `syncache_socket` copies them; neither was measured
+- [IP_TTL, IP_TOS, IP_MULTICAST_TTL, IP_MULTICAST_LOOP](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per `AF_INET` socket with the defaults (64, 0, 1, 1), the low-byte storage of `IP_TTL` and `IP_TOS`, the one-byte forms and the `EINVAL` above 255 of the multicast options that a payload process on a PS5 (firmware 13.60) showed. `IP_TTL` and the multicast options are also set on the host socket, except a time to live of 0, which hosts refuse; `IP_TOS` is only kept, so the host's packets carry its own type of service, and the host's default time to live (128 on Windows) is not changed to 64. An accepted socket takes `IP_TTL` and `IP_TOS` from its listener, as FreeBSD's `syncache_socket` does, and an `int` `IP_MULTICAST_LOOP` keeps only its low byte, as FreeBSD 11.4's `inp_setmoptions` does; neither was measured. Winsock applies `IP_MULTICAST_LOOP` on the receiving socket, not the sender, so on Windows the receiver's setting decides loopback
+- [SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT, SO_RCVLOWAT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket with the defaults, the 524288-byte limit, the `ENOBUFS` above 5592405 bytes and the low-water clipping of a payload process on a PS5 (firmware 13.60); the host socket gets the size asked for, so a request above the limit still enlarges the host's buffer. The host's real buffering, FreeBSD's automatic growth of a connected TCP socket's buffers, and a low-water mark's effect on `select`, `poll` and a receive are not reproduced. An accepted socket takes all four from its listener, as FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) does; that was not measured
+- [SO_NOSIGPIPE](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket and read back as its bit. On Linux a `send`, `sendto`, `sendmsg` or `write` on that socket passes `MSG_NOSIGNAL` to the host, as [`kern_sendit`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_syscalls.c#L890-L895) and [`soo_write`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_socket.c#L147-L151) leave out the signal, and an accepted socket takes it from its listener, as [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) copies the options. Not measured on a console
+- [SO_SNDTIMEO, SO_RCVTIMEO](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the value checks and the 32.32 fixed-point read-back follow [`sosetopt`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L2657-L2689), as a payload process on a PS5 (firmware 13.60) answered them. A receive or send on a blocking socket waits that long for the host to report the socket readable or writable and fails with `EWOULDBLOCK`, but only before the first transfer: once writable the host send has no limit, where FreeBSD returns the bytes sent so far, and a receive whose data another thread takes after the wait blocks again. `sendfile` ignores the send timeout, the host wait has millisecond steps, and an accepted socket takes both from its listener
+- [IPV6_V6ONLY](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - the `IPPROTO_IPV6` option 27 is set on the host socket and reads back as 0 or 1, after FreeBSD's [`ip6_ctloutput`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/netinet6/ip6_output.c#L1716-L1732): a value that is not exactly an `int` fails with `EINVAL`, as does setting it on a bound socket, which the host refuses too. `socket` turns it on for every `AF_INET6` socket, as a payload process on a PS5 (firmware 13.60) reported, and Java turns it off on the sockets it opens: Java 25 Advanced Network (PPSA99871) stops at `java.net.SocketException: Protocol not available` without it. The value checks and the bound-socket answer were not measured
+- [connect to AF_UNSPEC](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) dissolves a datagram association as FreeBSD 11.4's `udp_disconnect()` does, which resets the local address to the wildcard address and keeps the port. On Linux and on Windows a socket bound to an explicit port keeps its local address as well (`127.0.0.1:<port>` stays `127.0.0.1:<port>`), because a bound socket cannot be bound again, and `getsockname` reports that host address. On Windows a `sendto` to a non-loopback address from such a socket then fails with `ENETUNREACH` (Winsock 10051, measured on Windows 10), where FreeBSD sends it from the wildcard address. One bound to port 0 is bound again to the wildcard address with the port it had
+- [connect](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) - `connect` to port 0 on an unconnected `AF_INET` or `AF_INET6` stream or datagram socket fails with `EADDRNOTAVAIL` (49), as FreeBSD 11.4's `in_pcbconnect_setup()` and `in6_pcbconnect()` do; a connected datagram socket is disconnected first, as `soconnect()` does, and then fails with 49. A connected stream socket keeps its host `EISCONN` answer. Known gap: `sendto` and `sendmsg` to port 0 on an `AF_INET` datagram socket fail with 49 unless the socket is bound to a specific address and port and the destination is neither `INADDR_ANY` nor `INADDR_BROADCAST`, which is the path where `udp_output()` skips `in_pcbconnect_setup()` and FreeBSD sends to port 0. There nothing can receive on port 0, so the call returns the length without the host, because Linux's `udp_sendmsg` refuses port 0 with `EINVAL`; an `AF_INET6` socket still goes to the host. The answers are taken from the FreeBSD source and are not measured on a console. [sceNetConnect](../../../core/libs/prx/libSceNet/Export.cpp) is not changed
+- [msync](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `kern_msync` and `vm_map_sync`: the address is rounded down to the page, a range that wraps is `EINVAL`, as is `MS_ASYNC` with `MS_INVALIDATE`, and a range whose start or any page is not mapped (as `sceKernelVirtualQuery` reports it, reservations included) is `ENOMEM`; a page unmapped from inside a larger mapping still counts as mapped there, since `sceKernelVirtualQuery` keeps reporting the whole mapping. The guest has no file mappings, so a successful call writes nothing back. `MS_INVALIDATE` on a mapped range fails with `EBUSY`, as it did in a payload process on a PS5 (firmware 13.60) for anonymous memory, locked or not, also with a hole unmapped inside it; a title process, reservations, direct memory and flexible memory were not measured
 - [madvise](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) accepts `MADV_PROTECT` (10) as a no-op hint without modifying process protection. FreeBSD 11's `kern_madvise` (`sys/vm/vm_mmap.c`) handles it before the address check, ignores the address and length, and calls `kern_procctl(..., PROC_SPROTECT, PPROT_SET)`, which requires `PRIV_VM_MADV_PROTECT` and fails with `EPERM` without it. Returning 0 unconditionally assumes the calling process is privileged. Console behaviour is unverified
 - [mincore](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) follows FreeBSD 11's `sys_mincore` (`sys/vm/vm_mmap.c`), not measured on the console: the address is rounded down to the page, length 0 returns 0, a null vector over a mapped range returns `EFAULT`, an overflowing range or any unmapped page in the range (as reported by `sceKernelVirtualQuery`) returns `ENOMEM`. For valid ranges, a page reports `MINCORE_INCORE` (0x1) when `sceKernelVirtualQuery` reports it committed and 0 when it is only reserved; actual residency, referenced and modified bits are not modelled. Length 0 returns 0 when the start page is mapped and `ENOMEM` otherwise, and the range and mapping checks come before the null vector `EFAULT`, as in `kern_mincore` Java 25 LAN / DNS (PPSA99869) imports it
 - [mlockall, munlockall](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `mlockall` returns `EINVAL` for zero or unknown flags. Valid `MCL_CURRENT` throws because it would lock host stacks, heaps, modules and driver mappings along with guest memory; `MCL_FUTURE` throws because later mappings are not tracked for locking. FreeBSD 11.4's `sys_munlockall` (`sys/vm/vm_mmap.c`:1133-1165) checks `priv_check(td, PRIV_VM_MUNLOCK)` first (returning `EPERM` without it) and unwires the user map (`vm_map_unwire` over `vm_map_min`...`vm_map_max` with `VM_MAP_WIRE_HOLESOK`). Returning 0 unconditionally assumes the calling process is privileged. `munlockall` unlocks memory locked by `mlock` (`VirtualUnlock` on Windows, tolerating `ERROR_NOT_LOCKED` for pages never locked, and `munlockall` on Linux). On main, XPSemu (PPSA97358) fails to load at these imports (mlockall #4386, munlockall); their calls in QEMU `os-posix.c` execute only when `-overcommit mem-lock=on` is enabled. The call has not been observed in a run with this implementation.
 - [socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) creates only `SOCK_STREAM` and `SOCK_DGRAM` sockets in `AF_INET` and `AF_INET6`. A type that FreeBSD 11.4's inet domain has no protocol for in any configuration ([`in_proto.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/netinet/in_proto.c) has no `SOCK_RDM` entry and no unknown type) fails with `EPROTOTYPE` when the protocol is 0 and `EPROTONOSUPPORT` otherwise, as [`socreate`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/uipc_socket.c) does. `SOCK_RAW`, which `in_proto.c` always has (`socreate` creates it for a privileged process), and `SOCK_SEQPACKET`, which it has only in a kernel built with `SCTP`, fail with `EPROTONOSUPPORT`; whether the console allows either is not known. `SOCK_DGRAM` with `IPPROTO_UDPLITE` and `AF_UNIX` (`socketpair` supports it) fail with `EPROTONOSUPPORT` and `EAFNOSUPPORT` where FreeBSD creates the socket
 - [sigtimedwait](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) waits on a process-wide pending set instead of throwing: a signal raised while blocked stays pending and is taken by `sigwait`, `sigwaitinfo` or `sigtimedwait`, delivered to the handler when `_sigprocmask` unblocks it, or delivered by `pause`. The set covers all 128 signals and the lowest number that is pending and in the set is selected (FreeBSD specifies the lowest number only among real-time signals). Selection, `EAGAIN` on timeout, `EINVAL` for a `tv_nsec` outside 0 to 1000000000 while nothing is pending and `NULL` timeout blocking indefinitely follow FreeBSD's [sigtimedwait(2)](https://man.freebsd.org/cgi/man.cgi?query=sigtimedwait). `sigwait` returns 0 with the number in its output, as POSIX specifies, and `sigwaitinfo` and `sigtimedwait` return the number, as FreeBSD does. The guest `siginfo_t` follows FreeBSD 11's `sys/sys/siginfo.h`: 80 bytes, `si_signo` at 0, `si_code` at 8, `si_pid` at 12, `si_uid` at 16, `si_addr` at 24, `si_value` at 32 and `si_band` at 40; only `si_signo`, `si_code` (`SI_USER`) and `si_pid` (the guest pid) are written, `si_uid` stays 0 because no uid is modelled, and the console's layout is not verified. PPSA85300 imports `sigtimedwait` and fails to load without it; its only call site is VLC's `vlc_writev` ([filesystem.c](https://github.com/videolan/vlc/blob/6de05adcbaf2e8b85fe86aad4169393098628119/src/posix/filesystem.c#L243-L278)), which polls with a zero timeout to drain a `SIGPIPE` only after `writev` fails with `EPIPE`. The waits are not cancellation points and an unblocked caught signal does not interrupt them with `EINTR`, where FreeBSD's `sigwaitinfo` and `sigtimedwait` may return it. `SIGPIPE` has no host equivalent and is never raised by a host write here (see `read, write and vector I/O`), so VLC's drain finds nothing
 - [pause, sigsuspend, sigwait, sigwaitinfo](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) take the pending set of `sigtimedwait` instead of throwing. `pause` waits for a pending signal that is not blocked and whose disposition can be delivered, runs its handler on the calling thread and returns -1 with `EINTR`; an ignored signal is discarded and the wait continues, and it never returns for a signal whose handler cannot run. A signal whose registered handler has `SA_SIGINFO` still throws, and one whose disposition is the default action and that has no host equivalent (every signal except 2, 4, 6, 8, 11 and 15) is neither delivered nor discarded: it stays pending until a wait takes it, where FreeBSD runs the default action, which terminates the process for most of them. A pending `SIGALRM` with the default disposition exits the process with status 142 once it is unblocked, as FreeBSD's default action does. PPSA68091, PPSA99169, PPSA99420 and PPSA97358 import them and fail to load without them. PPSA68091 calls `pause` at one site (0x8F7266), in a loop that waits while a global holds another thread's `errno` address. PPSA99169 only stores the address of `pause` in a table of symbol addresses (0x30DB1). PPSA99420 calls `pause` at 0x3BD80F6 and 0x3C9E220, `sigwait` at 0x3C9E4C7 and `sigwaitinfo` at 0x3C9E588. PPSA97358 calls `sigwait` from QEMU's `sigwait_compat` thread ([compatfd.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/util/compatfd.c#L28-L53)), which `qemu_signal_init` ([main-loop.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/util/main-loop.c#L110-L147)) starts for `SIGIO`, `SIGALRM` and `SIGBUS` when the main loop is created, so it reaches the wait at start-up, and from the vCPU thread of the dummy accelerator ([dummy-cpus.c](https://github.com/ZiZc3/XPSemu/blob/8eec07b4e31f66dce8e0b05c1ca1281af303e933/accel/dummy-cpus.c#L48-L56)). `sigsuspend` swaps the process-wide mask of `_sigprocmask` for its argument, waits as `pause` does through the same helper, then restores the mask through `_sigprocmask`, and returns -1 with `EINTR`; a null set throws, as the console faults in libthr instead of returning `EFAULT`. All four words of the argument replace the mask and are restored afterwards, as in `_sigprocmask`. Java 25 LAN / DNS (PPSA99869, #5501) imports it and fails to load without it, after `sysctlnametomib`, `fegetenv` and `mincore`. None of the five waits is a cancellation point
-- [getsid](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) returns the calling process ID for pid 0 and the calling process, and `ESRCH` for other process IDs, assuming the single guest process is its own session leader. PPSA74126 imports it and fails to load without it
+- [getsid, setpgid, setpgrp](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - getsid returns the calling process ID for pid 0 and the calling process, and `ESRCH` for other process IDs, assuming the single guest process is its own session leader. setpgid and setpgrp follow FreeBSD 11.4's `sys_setpgid` for the only guest process: a negative group ID fails with `EINVAL`, a process ID other than 0 or the caller's PID (including a negative PID) fails with `ESRCH`, and because the single guest process is modeled as its own session leader, `SESS_LEADER(targp)` fails with `EPERM` before normalizing the process group or reaching the same-process-group no-op. PPSA74126 imports `getsid` and fails to load without it
 - [sigaction](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records the handler, flags and mask of every signal from 1 to 128 and reports them back, following FreeBSD's `sigaction` (`EINVAL` for other signals, and for a handler on `SIGKILL` or `SIGSTOP`); `signal` records its handler with `SA_RESTART`, as FreeBSD's libc does. Only handlers without `SA_SIGINFO` on the signals `signal` already delivers (`SIGINT`, `SIGILL`, `SIGABRT`, `SIGFPE`, `SIGSEGV`, `SIGTERM`) run, the same way `signal` handlers do; their mask and flags are not applied. `SA_SIGINFO` handlers are recorded but never called, since that needs FreeBSD's `siginfo_t` and `ucontext_t`, and neither are the handlers of other signals (`SIGBUS`, `SIGHUP`, ...), whether they are set by `sigaction` or by `signal`, which records them too (every number from 1 to 128, with `SA_RESTART` and an empty mask replacing what `sigaction` stored; `SIGKILL` and `SIGSTOP` accept only the default handler in both calls, as in FreeBSD's `kern_sigaction`). `raise` and `kill` accept every number from 1 to 128 now: a blocked one stays pending on the set of `sigtimedwait`, an unblocked one whose handler is registered runs it on the calling thread, and an unblocked one that has no host equivalent and no handler still fails with `EINVAL`, where FreeBSD runs its default action. `raise` of an `SA_SIGINFO` handler still throws instead of terminating
+- [signal](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) records its handler with `SA_RESTART` unless the signal is in the exported `_sigintr` set, as FreeBSD's libc does (`lib/libc/gen/signal.c`). `siginterrupt`, which fills that set, is a libSceLibcInternal export that libc serves through the `sigaction` and the set libkernel registers at load (see libc).
 - [kill, killpg](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) follow FreeBSD's `kern_kill` and `killpg1` for the only guest process: `EINVAL` for signals outside 0 to 128 and for negative `killpg` process groups, signal 0 only checks that the target exists, and its own pid, 0 and minus its own pid (the guest is taken to lead its own process group) signal it through `raise`, so they share `raise`'s limits above. Any other pid, and -1, which skips the caller, report `ESRCH`, so `EPERM` is never reported
 - [sceKernelFcntl](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) runs the POSIX `fcntl` below and returns its guest errno as `SCE_KERNEL_ERROR_*`, the form the other `sceKernel` file exports use. The return values and error codes are unverified on a console
-- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_GETFL` takes the access mode from the host (the granted access of the handle on Windows), so pipe ends report `O_RDONLY` and `O_WRONLY` where FreeBSD's bidirectional pipes report `O_RDWR`. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. Changing `O_APPEND` on a Windows file, changing `O_FSYNC` on a file, `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console
+- [Creating through a trailing slash](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) - `open` and `sceKernelOpen` with `O_CREAT` on a missing name followed by a slash (`new/`) fail with `EINVAL` on Windows and with the host's `EISDIR` on Linux, where FreeBSD 11.4's `lookup()` (sys/kern/vfs_lookup.c) fails with `ENOENT` because only a directory may be created through a trailing slash
+- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. Changing `O_FSYNC` on a file, `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console
 - [fcntl on a guest socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answers `F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFD`, `F_SETFD`, `F_GETFL` and `F_SETFL` and fails every other command with `EINVAL`; FreeBSD 11.4's `kern_fcntl` also handles `F_GETOWN` and `F_SETOWN` on a socket. `FD_CLOEXEC` is only recorded (there is no `exec`): `dup`, `dup2`, `F_DUPFD`, `F_DUP2FD` onto another descriptor and an accepted socket start without it, `F_DUP2FD` onto the same descriptor keeps it, and `SOCK_CLOEXEC`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC` and `F_SETFD` set it. None of this was measured on a console.
 - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) handle only `FIONBIO` and `FIONREAD` on a socket, and any other request there fails with `ENOTTY`. On the other descriptors they follow FreeBSD's [`kern_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L758), [`vn_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_vnops.c#L1488) and [`pipe_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_pipe.c#L1346): `FIONBIO` sets `O_NONBLOCK` as `fcntl` does, `FIOCLEX` and `FIONCLEX` set and clear the close-on-exec flag `F_GETFD` reports, and `FIONREAD` reports the size past the offset of a file, the queued bytes of a pipe's read end, 0 on its write end and `ENOTTY` on the random device, while it throws on a directory or another character device. Every termios request (group `t`, `TIOCGWINSZ` included) fails with `ENOTTY`, since those descriptors are taken as not a terminal, as in `tcgetattr`, and any other well-formed request throws. An input request with length 0 is not rejected as malformed: [`sys_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L703-L718) rejects it only in a kernel built without `COMPAT_FREEBSD4`, `COMPAT_FREEBSD5` and `COMPAT_43`, and which of these the PS5 kernel has is unknown. Stremio Plus (PPSA74126) imports `_ioctl` for its statically linked `tc*` functions, which send `TIOCGETA`, `TIOCSETA`, `TIOCSPGRP` and the other termios requests
+- [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) do not pass a `sceNetSocket` socket to libSceNet as `fcntl` does. On Linux its number duplicates the host socket, so `FIONBIO` switches the host `O_NONBLOCK` but not the library's `SO_NBIO` state; on Windows it is a `NUL` placeholder, so `FIONREAD` and enabling `FIONBIO` throw as on a character device. `sceNetIoctl` handles both requests on such a socket.
+- [_accept, _bind, _connect, _getpeername, _getsockname, _getsockopt, _listen, _recvfrom, _recvmsg, _sendmsg, _sendto, _setsockopt](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp), [_getdirentries](../../../core/libs/prx/libkernel/File/src/Stdio.cpp), [_sigaction, _sigsuspend](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) are not measured on the console. They forward to the calls without the underscore, which have no libthr layer here, as FreeBSD 11.4 makes the underscore names the plain system calls. `_sigaction` and `sigaction` share one handler table, where FreeBSD's `__thr_sigaction` hands its own wrapper to the system call `_sigaction` reads back, and rejects `SIGCANCEL` (32). A null set throws in `_sigsuspend` as in `sigsuspend`, while the system call FreeBSD 11.4 exports as `_sigsuspend` ([`Symbol.map`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/sys/Symbol.map#L961)) returns `EFAULT`
 - [Regular file mappings](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - on Linux `mmap` maps a regular file's descriptor shared or private like a shared memory object, with the same access checks; SQLite's WAL index (`-shm`) in Dusklight PPSA99305 needs it. FreeBSD 11 `mmap(2)` and shadPS4's `MemoryManager::MapFile` map regular files; the console's behaviour is not measured. Other descriptors (pipes, sockets, directories, devices) still fail with `EOPNOTSUPP`. On Windows a shared mapping is a view of a file section (`CreateFileMappingW` on the descriptor's handle, read-write when the descriptor is, otherwise read-only), so writes through the descriptor and the mapping see each other. This also maps anonymous `shm_open` objects and JIT shared memory descriptors, which are temporary files on Windows. A shared mapping may end inside the 16 KiB page that holds the end of the file, as POSIX [`mmap`](https://pubs.opengroup.org/onlinepubs/9799919799/functions/mmap.html) allows (llama.cpp in PS5LM Plus PPSA99581 maps a whole model file this way): the section keeps the file's size, so the file never grows, the view ends with the 4 KiB host page that holds the end of the file, which Windows fills with zeros past it, and the rest of the guest page is private zero pages. As POSIX requires, the bytes past the end read zero and are never written to the file; bytes written to those private pages are seen only through that mapping, not through other mappings of the file, and a file that grows later does not show its new bytes there. A shared mapping that reaches a whole page past the end of the file fails with `EOPNOTSUPP`, where POSIX maps it and delivers `SIGBUS` on access, as do `PROT_EXEC` and a write-only descriptor. A read-write alias (`GuestArenaMapAlias`) of a mapped page that holds the end of the file throws. `mprotect` above the view's protection (writing through a read-only descriptor, or adding `PROT_EXEC`) fails with `EACCES` before anything changes; FreeBSD allows `PROT_EXEC` on a readable descriptor. Shrinking the file with `ftruncate` fails with `EINVAL` while any shared mapping of it exists, even one that does not cover the removed part, because the section keeps the file's size at `mmap`; FreeBSD truncates. A read-write alias of a view (`GuestArenaMapAlias`, used when the GPU imports guest memory) of a read-only file section fails, as the alias is mapped `PAGE_READWRITE`. Views of the same file made by separate `mmap` calls are separate sections, so write tracking does not treat them as aliases of each other. A private mapping on Windows is a copy of the file read at `mmap`, which POSIX allows (later changes to the file need not show); pages wholly past the end of the file fail with `EOPNOTSUPP` instead of faulting on access, and a write-only descriptor fails with `EOPNOTSUPP`.
 - [File mappings on macOS](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `mmap` of a regular file, of an anonymous `shm_open` object (an unlinked temporary file on macOS) or of a JIT shared memory descriptor maps the descriptor shared or private as on Linux, with the same access checks. macOS refuses to create an executable file mapping (`EPERM`), so an executable mapping is made without execute and then given it with `mprotect`. Under Rosetta 2 (Apple M2, macOS 26), code rewritten through one view of a file after it ran from another view keeps its old translation until the executable view's protection changes. Named `shm_open` objects still throw on macOS.
-- [sendfile](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) follows FreeBSD 11's `sendfile` for a connected stream socket: headers, the file from `offset` (to its end when `nbytes` is 0) and trailers, the file offset left unchanged, `EAGAIN` with `*sbytes` set after a partial send on a non-blocking socket. It reads the file through `sceKernelPread` in 64 KiB blocks and sends each with `send`. A socket as the file fails with `EINVAL`, as on FreeBSD, but any other descriptor `sceKernelPread` reads, such as `/dev/urandom`, is sent where FreeBSD requires a regular file or shared memory, and a file descriptor as the socket fails with `EBADF`, as for `send`, where FreeBSD answers `ENOTSOCK`. `flags` are ignored: reads complete before sending, so `SF_NODISKIO` never fails with `EBUSY`, and `SF_SYNC` returns once the data is queued on the socket rather than sent. PS5MC (PPSA99420) imports it
+- [sendfile](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) follows FreeBSD 11's `sendfile` for a connected stream socket: headers, the file from `offset` (to its end when `nbytes` is 0) and trailers, the file offset left unchanged, `EAGAIN` with `*sbytes` set after a partial send on a non-blocking socket. It reads the file through `sceKernelPread` in 64 KiB blocks and sends each with `send`. A socket as the file fails with `EINVAL`, as on FreeBSD, but any other descriptor `sceKernelPread` reads, such as `/dev/urandom`, is sent where FreeBSD requires a regular file or shared memory. `flags` are ignored: reads complete before sending, so `SF_NODISKIO` never fails with `EBUSY`, and `SF_SYNC` returns once the data is queued on the socket rather than sent. PS5MC (PPSA99420) imports it
 - [pthread_kill](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) returns the error number like FreeBSD's `pthread_kill`: `EINVAL` for signals outside 0 to 128 and `ESRCH` for a null thread. A signal to the calling thread goes through `raise`, so it shares `raise`'s limits; a signal to another thread is left on the pending set for whichever thread waits for or unblocks it, since it is not delivered to the chosen thread, and a handle that is not a live guest thread returns `ESRCH` without touching it
 - [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) validates `tv_usec` but saturates a valid timeout beyond the remaining `steady_clock` range at `time_point::max()`, so the wait can continue effectively indefinitely. The console's behavior for a valid timeout outside the host clock's range is unknown.
 - [inet_ntop, inet_pton](../../../core/libs/prx/libkernel/Socket/src/AddressConversion.cpp) (libkernel) - an `AF_INET6` result of `inet_ntop` is followed by zero bytes up to `size`. In a payload process on a PS5 (firmware 12.70), the text forms, the order of the checks and this padding were measured through both exports. The padding was sampled at sizes from 3 to 65536, above 64 only at 65, 128, 256, 1024, 4096 and 65536; the sizes that were not sampled, sizes above 65536 and a title process are assumed to behave the same
-- [_fstatfs](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) fills the FreeBSD 11 `struct statfs` of the PS5 payload SDK with the host volume that holds the file: block size, transfer size, total, free and available blocks, maximum name length and the read-only, `nosuid` and `noexec` flags (on Windows only read-only, and `f_files` and `f_ffree` are 0, as NTFS has no fixed number of files). The filesystem type number and name, mount paths, owner, filesystem id and I/O counters are left 0 or empty, since they would describe a host mount, not a console one. Sockets and pipes return `EINVAL`, as FreeBSD's `getvnode` does; a Windows descriptor that is neither a file nor a pipe throws. Stremio Plus (PPSA74126) reads the free space before a download and only logs the other fields
+- [_fstatfs](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) reports the host volume of a file, not a console mount: block sizes, block counts, name length and the read-only, `nosuid` and `noexec` flags (on Windows only read-only, and `f_files` and `f_ffree` are 0). The type, mount names, owner, filesystem id and I/O counters are 0 or empty. Sockets, pipes and kqueues return `EINVAL`, as FreeBSD's `getvnode` does. A character device, including `/dev/random` and `/dev/urandom`, reports FreeBSD 11.4's [`devfs_statfs`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/fs/devfs/devfs_vfsops.c#L225-L237) values on every host: no flags, 512-byte blocks, 2 blocks, nothing free and a 255-byte name limit. A Windows descriptor that is none of these throws. Stremio Plus (PPSA74126) reads the free space before a download and only logs the other fields
 - [pthread_spin_lock](../../../core/libs/prx/libkernel/Pthread/Posix/Spinlock.cpp) (libkernel) - a lock taken again by the thread that holds it throws here. On a PS5 (firmware 12.70) that call had not returned after 2 s, as FreeBSD 11.4 libthr [`thr_pspinlock.c`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_pspinlock.c) spins forever
 - [pthread_mutex_getspinloops_np, pthread_mutex_setspinloops_np, pthread_mutex_getyieldloops_np, pthread_mutex_setyieldloops_np and their scePthreadMutex counterparts](../../../core/libs/prx/libkernel/Pthread/src/Mutex.cpp) (libkernel) store and report the counts, but host mutexes do not spin or yield by them. The defaults follow FreeBSD 11.4's [`mutex_init_body`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L236-L272) without `LIBPTHREAD_SPINLOOPS` and `LIBPTHREAD_YIELDLOOPS`: 2000 spins for an adaptive mutex, 0 otherwise; the console's defaults are unverified. Setting the yield count of a destroyed mutex returns 0 as FreeBSD's [`__pthread_mutex_setyieldloops_np`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L1125-L1135) does; the console's result is unverified
 - [pthread_rwlockattr_getpshared, pthread_rwlockattr_setpshared](../../../core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp) (libkernel) - `pthread_rwlockattr_destroy` clears the attribute here, so a later get, or a set of 0, throws. On a PS5 (firmware 12.70) destroy leaves the attribute set; a get afterwards returned 0 with a stale value and a set of 0 returned 0
-- [sceKernelGetEventError](../../../core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp) (libkernel) returns the event's `data` as an `int` when `EV_ERROR` (0x4000) is set in `flags` and 0 otherwise, as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/947627d10d4ef4b68ba3c0189aab6c368e70a8d2/src/kernel/eventQueue.cpp#L663) does and as FreeBSD 11's [kevent](https://github.com/freebsd/freebsd-src/blob/release/11.0.0/sys/kern/kern_event.c#L1005) reports a failed change (`flags = EV_ERROR`, errno in `data`). [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_queue.pas#L643) instead returns `fflags` plus `0x80020000` when `fflags` is nonzero. Whether the console reads `data` or `fflags` and returns the raw errno or an SCE error code is unverified. No event delivered by the equeue here carries `EV_ERROR`, so the call returns 0 for every event `sceKernelWaitEqueue` reports
+- [pthread_mutexattr_setkind_np](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) throws for a kind outside 1 to 4. FreeBSD 11.4's [`_pthread_mutexattr_setkind_np`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutexattr.c#L108-L120) stores any kind and [`mutex_check_attr`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libthr/thread/thr_mutex.c#L207-L218) then makes `pthread_mutex_init` fail with `EINVAL`, but `pthread_mutex_init` here does not check the type
+- [pthread_cond_signalto_np, scePthreadCondSignalto](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) wake every waiter of the condition variable, not only the given thread, and do not check the thread; the other waiters see a spurious wakeup. Which waiters the console wakes, and its result for a thread that is not waiting, are unverified
+- [pthread_rwlockattr_gettype_np, scePthreadRwlockattrGettype](../../../core/libs/prx/libkernel/Pthread/Posix/Rwlock.cpp) (libkernel) report the type stored by `scePthreadRwlockattrSettype`, which accepts any value and which read-write locks do not apply; the console's valid types and their effect are unverified. A null or uninitialized attribute throws, as for `pthread_rwlockattr_getpshared`
+- [sceKernelGetEventError](../../../core/libs/prx/libkernel/Equeue/src/EventAccessors.cpp) (libkernel) throws for `fflags` above 0xFFFF, where OR and addition of 0x80020000 differ and the console was not measured. Otherwise it returns 0 for `fflags` 0 and `0x80020000 | fflags`, whatever `flags` and `data` hold, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_queue.pas#L643) does and a PS5 (firmware 13.40, measured 2026-10-19 in a payload process) answered: `{flags 0x4000, fflags 0, data 22}`, `{0x4000, 0, -1}`, `{0x4000, 0, 0x80020016}` and `{0, 0, 0}` gave 0, `{0x4000, 5, 0}` and `{0x4000, 5, 22}` 0x80020005, `{0, 7, 22}` 0x80020007, `{0x8000, 3, 9}` 0x80020003. Video-out events carry their count in `fflags`, so they get 0x80020001 and up; only events built by the caller were measured. Closes when: `fflags` above 0xFFFF is measured
 - [pthread_cond_reltimedwait_np](../../../core/libs/prx/libkernel/Pthread/Posix/Cond.cpp) (libkernel) takes `(cond, mutex, usec)`, a relative timeout in microseconds, and is `scePthreadCondTimedwait` with POSIX error numbers. FreeBSD 11.4 has no such function; the signature comes only from shadPS4, which registers one function for this NID and for `scePthreadCondTimedwait` ([`condvar.cpp`](https://github.com/shadps4-emu/shadPS4/blob/3a9f57265d28975658f1ca941daa5c879c7a74bd/src/core/libraries/kernel/threads/condvar.cpp#L229-L234)). shadPS4 reads a 64-bit count; here it is the 32-bit `SceKernelUseconds` of the SCE twin, as for `sem_reltimedwait_np`. Unverified on the console
 - [pthread_mutex_reltimedlock_np](../../../core/libs/prx/libkernel/Pthread/Posix/Mutex.cpp) (libkernel) takes `(mutex, usec)`, a relative timeout in microseconds, and is `scePthreadMutexTimedlock` with POSIX error numbers. FreeBSD 11.4 has no such function; the signature comes only from shadPS4, which registers one function for this NID and for `scePthreadMutexTimedlock` ([`mutex.cpp`](https://github.com/shadps4-emu/shadPS4/blob/7c960eae136b956cf4c1d72aacd2426b650330df/src/core/libraries/kernel/threads/mutex.cpp#L284-L287)). shadPS4 reads a 64-bit count; here it is the 32-bit `SceKernelUseconds` of the SCE twin, as for `pthread_cond_reltimedwait_np`, so a count of 2^32 microseconds or more would be truncated if the console reads 64 bits. Unverified on the console
 - [sysctl kern.arandom](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) serves FreeBSD 11's MIB {1, 37} (CTL_KERN, KERN_ARANDOM) and the "kern.arandom" sysctlbyname lookup through std::random_device, returning min(*oldLength, 256) random bytes. Following FreeBSD's sysctl_kern_arnd, a null buffer reports min(*oldLength, 256) without writing, a null length returns 0 without writing, and requests with a new value return EPERM (1) as the node is read-only. Cryptographic quality depends on the host's random device implementation.
@@ -241,10 +281,11 @@
 - [chflags](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) follows FreeBSD 11.4's [`kern_chflagsat`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L2366-L2383) and UFS's [`ufs_setattr`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/ufs/ufs/ufs_vnops.c#L509-L556) for a root caller: the path lookup reports `EFAULT`, `ENOENT` and `ENOTDIR`, a flag outside the 17 UFS stores (`VNOVAL` included) `EOPNOTSUPP`, and `SF_SNAPSHOT` `EPERM`. Neither host keeps BSD file flags, so every file is taken to have none (`stat` reports `st_flags` 0): flags 0 succeed without touching the file, and any other flag throws, naming the flags. `UF_READONLY`, `UF_HIDDEN`, `UF_SYSTEM` and `UF_ARCHIVE` are FreeBSD's names for the Windows attributes but are not mapped to them: UFS stores them without enforcing them, `FILE_ATTRIBUTE_READONLY` already carries the owner write bit of `chmod` on Windows, and Linux has no equivalent a process can set without `CAP_LINUX_IMMUTABLE`. The console's filesystem types, `EROFS` on read-only mounts and the change-time update are not modelled
 - [fchflags](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) has the gaps of `chflags`: a valid non-zero flag throws, and the console's filesystem types, `EROFS` and the change-time update are not modelled. Character devices, the random device, other host descriptors and files read from app0.zar throw, since their console filesystems and the privilege check for devices are not modelled. On Windows, anonymous shared memory objects are temporary files that are not told apart from regular files, so they are treated as files instead of reporting `EINVAL` as FreeBSD 11.4's [`getvnode`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L3850-L3877) does.
 - [getpriority](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) follows FreeBSD 11.4's [`sys_getpriority`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_resource.c#L93-L165) for the only guest process, which is taken to run at nice 0: `PRIO_PROCESS` and `PRIO_PGRP` with 0 or its own pid (the guest is taken to lead its own process group, see `kill`) and `PRIO_USER` with 0 or its user id 0 return 0, any other id fails with `ESRCH` and any other `which` with `EINVAL`. As in FreeBSD's libc, where `getpriority` is the bare system call, errno is left unchanged on success. The nice value of a title process on the console is unverified, and the host nice of the process or of the threads `APS5_THREAD_PRIORITY=high` raises is not reported. `setpriority` accepts the same target ids (any other id fails with `ESRCH`, any other `which` with `EINVAL`), clamps the value to FreeBSD's `PRIO_MIN`-`PRIO_MAX` (-20 to 20) and stores it as the guest process's nice value, which `getpriority` returns; the host scheduling class is not changed, and whether a title process may lower the value without privilege is unverified
-- [rtprio_thread, pthread_setconcurrency, pthread_getconcurrency](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - `rtprio_thread` follows FreeBSD 11.4's `rtprio_thread(2)`. Every guest thread here runs under `SCHED_FIFO` or `SCHED_RR` (priority 256-767), whose rtprio class is real-time; the console's mapping from that priority to the rtprio `prio` range (0-31) is unmeasured, so `RTP_LOOKUP` and `RTP_SET` throw for such a thread rather than report an impossible priority. A thread that is not real-time reports `RTP_PRIO_NORMAL` (3) with 0, and `RTP_SET` accepts only that value. Another function fails with `EINVAL`, a null `rtprio` with `EFAULT`, a thread other than the calling one throws, and an id that is not a live guest thread with `ESRCH`. `pthread_setconcurrency` stores 0 or more and returns `EINVAL` for a negative level (the error itself, as FreeBSD's libthr does, with errno untouched); `pthread_getconcurrency` returns the level, which is a hint and changes nothing about the host's concurrency. Morrowind (`mshivam019/morrowind-ps5`) imports all three at start-up
+- [rtprio_thread, pthread_setconcurrency, pthread_getconcurrency](../../../core/libs/prx/libkernel/Pthread/Posix/Thread.cpp) (libkernel) - `RTP_SET` throws for a real-time thread (sce attributes allow only `SCHED_FIFO`/`SCHED_RR`) and for another thread: a payload process on a PS5 (firmware 12.70) answered type 2, prio 0/15/31 on the calling thread with `EINVAL`; no accepted value or set by another thread's id measured. A non-real-time thread (POSIX attributes store `SCHED_OTHER`), unmeasured, reports 3 with 0, and `RTP_SET` accepts only that. `RTP_LOOKUP` reports the policy's type (10 or 2) and the scheduling priority, as measured, not FreeBSD's 0-31; another function fails with `ESRCH` (2 measured), a null `rtprio` with `EFAULT`, an id of no live thread with `ESRCH` (unknown ids measured). `pthread_setconcurrency` stores 0 or more, returns `EINVAL` (not errno) below 0, as libthr does; `pthread_getconcurrency` returns it, a hint. Morrowind (`mshivam019/morrowind-ps5`) imports them
 - [sceKernelVirtualQuery](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) returns [VirtualQueryInfo](../../../core/libs/SceTypes.hpp) with a one-byte flag allocation unit so Windows and SysV hosts return the same 72-byte representation, with the name at byte 33 and GPU mask at byte 65. This preserves the existing SysV representation; the console offsets beyond the address, protection and size fields observed in Astro Bot's AGC calls are not hardware-measured. Size and offset assertions plus a raw-byte named-mapping regression guard the host ABI.
 - [app0.zar files](../../../core/libs/prx/libkernel/File/src/ArchivedFile.cpp) (libkernel) - `sceKernelOpen`, `open`, `sceKernelStat` and `sceKernelCheckReachability` resolve a path missing from `app0/` in `app0.zar`. An archived file is a read-only host null device whose reads, positioned and vectored reads, AIO reads, seeks, `fstat` and `FIONREAD` are served from the archive, with the position shared by `dup`, `dup2` and `F_DUPFD`; writes fail with `EBADF` as on a read-only descriptor, opening one for writing or truncation fails with `EROFS` and `O_CREAT | O_EXCL` with `EEXIST`. `fstat` and `sceKernelStat` report mode `0444` (`0555` for a directory), the node index as inode and the archive file's device and times. Opening an archived directory or a directory present both on disk and in the archive throws, as `getdents` would miss entries. On an archived descriptor `mmap`, `flock`, record locks, `fstatfs`, `ftruncate`, `fsync`, `fdatasync`, `getdirentries`, `fchmod` and `futimes` throw instead of acting on the null device; `mmap` is `noexcept`, so its refusal terminates the process. `lstat` and the other path calls on archived files are not implemented
 - [sceKernelLoadStartModule](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) loads a system library named by its console path, `/system/common/lib/<name>.sprx` or the sandboxed `/<sandbox word>/common/lib/<name>.sprx` that `sceKernelGetFsSandboxRandomWord` names, from the host `libs/<name>.prx`, as libSceSysmodule loads modules by ID; a host library has no `module_start`, so `res` is 0. Other system directories, such as `/system/priv/lib`, are not mapped. The OpenOrbis piglet sample loads `libScePigletv2VSH.sprx` and `libScePrecompiledShaders.sprx` this way
 - [param.sfo](../../../core/libs/prx/libkernel/AppMetadata/src/ParamSfoParser.cpp) (libkernel) is read when `param.json` is absent, for `TITLE`, `TITLE_ID`, `DOWNLOAD_DATA_SIZE` and `USER_DEFINED_PARAM_1` to `_4`, and mounts `/data` and `/download0` like `param.json`; the localized `TITLE_00` to `TITLE_30` are not selected by the console language.
 - [sysctl MIBs for kern.smp.maxcpus, kern.stackprot, kern.sched.name and kern.timecounter.hardware](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - on a PS5 (firmware 12.70), a payload process resolves these names to {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}; `sysctl` returns -1 with `ENOENT` for reads and size queries by those exact MIBs, leaving the buffer and length unchanged, including when either or both output pointers are null. Writes were not measured and throw. `sysctlnametomib` still throws for these four names; #7541 implements the mappings for nine of the other names.
 - [sceKernelGetProcessAbiType](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) throws: no measured value, prototype or documented consumer of the process ABI type was found, and PS5_MihawkOS (`mihawk-99/PS5_MihawkOS`, PPSA99170) is the only title known to import it. Returning a guessed constant would let a title branch on a value the console never answered with, so the declaration only resolves the import until the console value is measured
+- [flock on a directory descriptor](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) returns 0 on Windows without taking a lock, as FreeBSD 11.4's `sys_flock` accepts any vnode descriptor and so succeeds on a directory; Windows `LockFileEx` rejects a directory handle, which used to abort the process. Two descriptors of the same directory therefore never conflict: a second `LOCK_EX | LOCK_NB` succeeds where FreeBSD fails with `EWOULDBLOCK`. Linux and macOS use the host `flock`. Not measured on a console
diff --git a/docs/dev/debt/libkernel_sys.md b/docs/dev/debt/libkernel_sys.md
index 0d634c1296..5f015be839 100644
--- a/docs/dev/debt/libkernel_sys.md
+++ b/docs/dev/debt/libkernel_sys.md
@@ -3,19 +3,38 @@
 ### Silent stubs
 - [fchmodat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - `AT_SYMLINK_NOFOLLOW` on a symbolic link (on Windows and Linux)
 
+### Unknown function info
+
+- [sceKernelGetCompiledSdkVersion](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - which SDK version the console returns is unmeasured. The [PS5 payload SDK](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/crt/kernel.c#L257-L275) declares the process parameters with a 32-bit PS4 SDK version at offset `0x10` and a 32-bit PS5 SDK version at `0x14`; this export returns the field at `0x10`, the one [libSceHmd2](../../../core/libs/prx/libSceHmd2/Export.cpp) reads and the one [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/emulator.cpp#L110-L138) (PS4, a single 64-bit `sdk_version` there) reads from the eboot. The `int (int32_t*)` signature and `EINVAL` (`0x80020016`) for a null output follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/kernel/process.cpp#L56-L62). Closes when: measured on a PS5
+- [scePthreadCondattrGetclock](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - the `int (const PthreadCondattr*, KernelClockid*)` signature and checks follow FreeBSD 11.4 libthr's [`_pthread_condattr_getclock`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/lib/libthr/thread/thr_condattr.c#L82-L90) with the error code of libkernel's `scePthreadCondattrSetclock`: a null or destroyed attribute returns `SCE_KERNEL_ERROR_EINVAL`, and a null clock pointer throws, since libthr writes through it unchecked. Console behaviour is unverified
+
 ### Functional
 
-- [fchdir](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) changes the guest working directory to the descriptor's directory: on Windows through the path recorded when the descriptor was opened, on Linux through the `/proc/self/fd` link target. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Outside Windows it checks search permission on the directory with `faccessat`, which fails with `EACCES` as FreeBSD `change_dir` does; on Windows that check is not modelled. A directory renamed after it was opened is still reached through the recorded path. Console behaviour is unverified
-- [openat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `open`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. As with `open`, `O_NOFOLLOW` and `O_NONBLOCK` are ignored. PPSA99003 opens directory entries this way. Console behaviour is unverified
+- [sched_rr_get_interval](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) accepts pid 0 or the host-backed guest pid and reports the FreeBSD 11 ULE default time slice for the usual AMD64 clock rates (94 ms); other pids return `ESRCH`, and a null interval returns `EFAULT`. AnyPS5 does not run a guest ULE scheduler or track a per-process configured quantum, so this reports the modeled default and does not reflect runtime scheduling. Console-specific clock rates and quantum configuration are unverified
+- [fchdir](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) changes the guest working directory to the descriptor's directory: on Windows through the path recorded when the descriptor was opened, on Linux through the `/proc/self/fd` link target. It returns `EBADF` for a descriptor that is not open, `EINVAL` for a pipe or socket, as FreeBSD `getvnode` does for a descriptor without a vnode, and `ENOTDIR` for any other descriptor that is not a directory. Outside Windows it checks search permission on the directory with `faccessat`, which fails with `EACCES` as FreeBSD `change_dir` does; on Windows that check is not modelled. A directory renamed after it was opened is still reached through the recorded path. Console behaviour is unverified
+- [openat, _openat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) pass `AT_FDCWD` (-100) and absolute paths to `open`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. They return `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. As with `open`, `O_NONBLOCK` is ignored. PPSA99003 opens directory entries through `openat`. Console behaviour is unverified
 - [fchmodat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `chmod`; any other relative path is joined to the descriptor's host directory the same way as for `openat`, so guest path aliases and case-insensitive name matching do not apply to it and a `..` component is not kept inside the guest root. A flag other than `0` or `AT_SYMLINK_NOFOLLOW` (0x200) returns `EINVAL`; the mode is masked to `07777`. With `AT_SYMLINK_NOFOLLOW` a symbolic link returns success silently on Windows and Linux, since the host cannot change a link's own mode, while a regular file is changed either way. The mode maps to the host file mode, which on Windows is only the CRT's read-only bit. PPSA99621 calls it through `std::filesystem::permissions`. Console behaviour is unverified
-- [pathconf](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) looks the path up as FreeBSD 11's `kern_pathconf` does (links followed, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255) and returns the constants of FreeBSD 11's UFS `ufs_pathconf` for files and directories alike: `_PC_LINK_MAX` 32767, `_PC_NAME_MAX` 255, `_PC_PATH_MAX` and `_PC_SYMLINK_MAX` 1024, `_PC_PIPE_BUF` 512, `_PC_CHOWN_RESTRICTED` and `_PC_NO_TRUNC` 1, `_PC_FILESIZEBITS` 64, `_PC_REC_MAX_XFER_SIZE` -1, `_PC_PRIO_IO` and `_PC_SYNC_IO` 0. Whether the console's filesystems report the same is not verified. It throws for the names whose UFS value depends on the mount (`_PC_ALLOC_SIZE_MIN`, `_PC_REC_INCR_XFER_SIZE`, `_PC_REC_MIN_XFER_SIZE`, `_PC_MIN_HOLE_SIZE`), the kernel options (`_PC_ACL_EXTENDED`, `_PC_ACL_PATH_MAX`, `_PC_ACL_NFS4`, `_PC_MAC_PRESENT`) or the page size (`_PC_REC_XFER_ALIGN`), and on which UFS and `vop_stdpathconf` disagree (`_PC_MAX_CANON`, `_PC_MAX_INPUT`, `_PC_VDISABLE`, `_PC_ASYNC_IO`); other names fail with `EINVAL`
+- [lchmod](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws for a symbolic link on Windows and Linux, whose hosts cannot change a link's own mode; on macOS the link's mode is changed. Anything else goes to `fchmodat(AT_FDCWD, path, mode, AT_SYMLINK_NOFOLLOW)`, as FreeBSD 11.4's [`sys_lchmod`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L2490-L2496) does, so a file or directory is changed as by `chmod`, with `fchmodat`'s path lookup and Windows mode mapping. On Windows any reparse point counts as a link. Console behaviour is unverified
+- [pathconf, fpathconf, _fpathconf](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) report FreeBSD 11's `ufs_pathconf` constants for files and directories alike (`_PC_LINK_MAX` 32767, `_PC_NAME_MAX` 255, `_PC_PATH_MAX` and `_PC_SYMLINK_MAX` 1024, `_PC_PIPE_BUF` 512, `_PC_CHOWN_RESTRICTED` and `_PC_NO_TRUNC` 1, `_PC_FILESIZEBITS` 64, `_PC_REC_MAX_XFER_SIZE` -1, `_PC_PRIO_IO` and `_PC_SYNC_IO` 0); whether the console's filesystems report the same is not verified. They throw for names whose UFS value depends on the mount, the kernel options or the page size, and where UFS and `vop_stdpathconf` disagree (`_PC_MAX_CANON`, `_PC_MAX_INPUT`, `_PC_VDISABLE`, and `_PC_ASYNC_IO` in `pathconf`); other names fail with `EINVAL`. `fpathconf` and `_fpathconf` answer `_PC_ASYNC_IO` 200112 and, for a pipe, `_PC_PIPE_BUF` 512 and `EINVAL` otherwise, as FreeBSD 11's `kern_fpathconf` does; a guest socket is not a host descriptor, so the `fstat` check reports it as `EBADF`, as in `fchown`
 - [mkdirat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `mkdir`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. On Windows, `mode` is ignored. Console behaviour is unverified
 - [readlink](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) on Windows reads a symbolic link's target from its reparse data and returns it with `/` separators, only when the target is relative, as `symlink` creates them. A symbolic link with an absolute target returns its print name, or its substitute name when the print name is empty, without a `\??\` or `\\?\` prefix. A directory junction returns the same kind of name when it is a drive path (`X:\...`), using the print name when that is a drive path and the substitute name otherwise. A mounted volume (`\??\Volume{GUID}\`), any other name surrogate and every reparse point without the name surrogate bit (WOF compression, deduplication, cloud files) return `EINVAL`, as FreeBSD does for a file that is not a link and as CPython's `os.readlink`, which reads only symbolic links and junctions, does
+- [aio_read, aio_write, aio_fsync, aio_error, aio_return, aio_suspend, aio_waitcomplete, aio_cancel](../../../core/libs/prx/libkernel_sys/Aio.cpp) (libkernel_sys) - a request with `SIGEV_SIGNAL`, `SIGEV_THREAD_ID` or `SIGEV_KEVENT` completion, or on a socket, throws, because delivering a guest signal or kevent and socket aio are not modelled. One worker thread runs the process's requests one at a time in submission order, so a request is cancellable only until that thread takes it. A queued request keeps the descriptor number, not the open file: closing or reusing the descriptor before it runs changes what it reaches. Pipes fail with `EOPNOTSUPP`, as FreeBSD 11 does with `vfs.aio.enable_unsafe` 0; the console's setting is unverified. Waits are not interrupted by signals (`EINTR`), and timeouts under 1 ms round up to 1 ms (hz 1000). Otherwise the rules follow FreeBSD 11 `vfs_aio.c`
 - [readlinkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `readlink`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Console behaviour is unverified
+- [link](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) on Windows resolves a symbolic link source through the host, which follows longer chains than FreeBSD: a chain of 40 links is linked, where FreeBSD 11.4 returns `ELOOP` after 32 (`MAXSYMLINKS`). A loop returns `ELOOP` as on FreeBSD
 - [fstatat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `stat`, or to `lstat` with `AT_SYMLINK_NOFOLLOW` (0x200). Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory, and flags other than `AT_SYMLINK_NOFOLLOW` return `EINVAL`. PPSA74126 imports it. Console behaviour is unverified
 - [unlinkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `rmdir` (with `AT_REMOVEDIR`, 0x800) or `unlink`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Removing a directory without `AT_REMOVEDIR` fails with `EPERM`, removing `.` or `..` with `AT_REMOVEDIR` fails with `EINVAL`, and flags other than `AT_REMOVEDIR` fail with `EINVAL`. Console behaviour is unverified
 - [renameat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `rename`. Any other relative path is joined to its descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to relative descriptors, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Console behaviour is unverified
 - [fork](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws: creating a child process is not supported. PPSA19111 imports it and fails to load without it. Its engine calls `fork` in `Posix_Daemonize`, only with `-daemonize`, and in `Platform_ShellExecute` before `execvp("xdg-open")`, which the main menu's Previews button reaches, so pressing Previews ends in this throw. [setsid](../../../core/libs/prx/libkernel_sys/Export.cpp) fails with `EPERM`, as FreeBSD's does for a process group leader, since the guest is taken to lead its own process group (see `kill`). [umask](../../../core/libs/prx/libkernel_sys/Export.cpp) keeps the guest's mask (initially 022, masked to 07777) and returns the previous one, Linux named shared-memory creation applies it, but ordinary files are still created with the host process's mask
+- [sceKernelGetModuleInfoInternal and sceKernelGetModuleListInternal](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5
 - [chroot](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L776-L807) and [`pwd_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L3059-L3085) for a root caller: `EFAULT` for a null path, `ENOENT` for an empty or missing one, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255, and `ENOTDIR` for a path that is not a directory or passes through a file. A directory that is the guest root (`/`, `/..`, or `.` after `fchdir` to a descriptor of `/`) succeeds and changes nothing, as the root stays the same directory; the guest is taken never to have changed its root, so open directory descriptors do not make it fail with `EPERM` (`kern.chroot_allow_open_directories` 1). Any other directory throws, naming the path: the guest path resolver has a fixed root and mount aliases (`/app0`, `/savedata0`) that do not move with it. On the console a title starts in a sandbox root, where `pwd_chroot` refuses with `EPERM` while a directory is open; whether that holds for titles, and whether a title holds `PRIV_VFS_CHROOT`, are unverified. Porpoise (PPSA99764) weak-imports it and calls it only as `fchdir` to its saved descriptor of `/` then `chroot(".")`, to put its sandbox root back after a jailbreak daemon replaced it ([`put_root_back`](https://github.com/elripalda/Porpoise-Dolphin-Emulator-for-PS5/blob/2ed1ab5a06995aa198f7bccd4da0f90c3fc29d39/src/porpoise_jailbreak.cpp#L303-L331))
 - [fchown](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled: the guest's own owner and group (0) and the unchanged value (-1) are accepted, a descriptor that is not open fails with `EBADF`, and any other owner or group throws, naming it. The check reads the descriptor with `fstat`, ignoring the CRT's invalid-parameter handler on Windows as `DescriptorControl` does. The console's ownership rules are unverified. Morrowind (`mshivam019/morrowind-ps5`) imports it
+- [chown, lchown and fchownat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled, as for `fchown`: owner and group 0 and the unchanged value (-1) are accepted, and any other owner or group throws, naming it. The path is looked up first, as in FreeBSD 11's `kern_fchownat`, with `stat`, with `lstat` for `lchown`, and with `fstatat` for `fchownat`, so a lookup error is returned before the owner is checked and nothing is changed on the host. `fchownat` flags other than `AT_SYMLINK_NOFOLLOW` (0x200) return `EINVAL`, as in FreeBSD 11. The console's ownership rules are unverified
+- [linkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `link`, and flags other than `AT_SYMLINK_FOLLOW` (0x400) return `EINVAL`, as in FreeBSD 11. A relative path with a directory descriptor throws, and so does a symbolic link as the source without `AT_SYMLINK_FOLLOW`, where FreeBSD links the symbolic link itself. Console behaviour is unverified
 - [pthread_set_defaultstacksize_np and scePthreadSetDefaultstacksize](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) set the stack size that `scePthreadAttrInit` and a thread created without attributes use, as [fpPS4's `pthread_set_defaultstacksize_np`](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_pthread_attr.pas#L89-L102) does: a size of 16384 bytes or less fails with `EINVAL` (`0x80020016` from the sce form) and there is no upper limit, so a default the host cannot allocate fails only when a thread is created. Attributes initialised earlier keep their size. Not checked on a PS5
+- [sceKernelTitleWorkaroundIsEnabled](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - not measured on a console; the `{version, align, ids[2]}` layout, the bit test and the limit of 0x3A bits follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/kernel.cpp), which notes that the limit changes between firmwares. A negative bit is `EINVAL` here; shadPS4 compares it signed and reads outside `ids`. Titles usually pass the `title_workaround` block of `sceKernelGetAppInfo`, which does not write that block here, so the bits read are whatever the caller's memory held
+- [sceKernelGetProcessType](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - not measured on a console; as in shadPS4, the title's own pid, -1 and 0 are type 0 (big application) and any other pid is `ESRCH`
+
+### Unknown function info
+
+- [scePthreadBarrier*, scePthreadBarrierattr*, scePthreadGetcpuclockid, scePthreadGetconcurrency and sceKernelMsync](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) call libkernel's `pthread_barrier*`, `pthread_getcpuclockid`, `pthread_getconcurrency` and `msync` and turn a POSIX error into `0x80020000 | errno`; that the console's `sce` forms do the same is not measured. Signatures follow the [Orbital type database](https://github.com/AlexAltea/orbital/blob/master/tools/ida/db_types.json); `scePthreadBarrierInit` ignores its name, and `scePthreadBarrierWait` returns -1 to the serial thread, both as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/kernel/threads/barrier.cpp) (PS4). `scePthreadGetconcurrency` returns the level unchanged
+- [scePthreadAttrGetscope, scePthreadAttrSetscope, scePthreadAtfork and scePthreadSetconcurrency](../../../core/libs/prx/libkernel_sys/Export.Discovery.cpp) (libkernel_sys) call libkernel's `pthread_attr_getscope`, `pthread_attr_setscope`, `pthread_atfork` and `pthread_setconcurrency` and turn a POSIX error into `0x80020000 | errno`, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/kernel/threads/pthread_attr.cpp#L392) exports `scePthreadAttrGetscope` as `ORBIS(posix_pthread_attr_getscope)`; shadPS4 has no export for the other three, whose names and NIDs are in the [symbol database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv) and whose signatures follow the same POSIX forms. Not measured on a console. As in libkernel, the scope is 0 (process) or 2 (system), and `scePthreadAtfork` handlers are only recorded, as no process forks
diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md
index 7096954ef8..241d10f16f 100644
--- a/docs/dev/debt/relinker.md
+++ b/docs/dev/debt/relinker.md
@@ -2,19 +2,26 @@
 
 ### Functional
 
+- The [syscall scanner](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) decodes executable ranges linearly without code/data boundaries. Embedded data between routines can fail decoding or be reported as a forbidden syscall ([#7547](https://github.com/boykopovar/AnyPS5/issues/7547)). Unwind ranges alone omit real code. The [synthetic fixture](../../../core/relinker/relinker/tests/CodeDataScanningTests.cpp) characterizes these rejections and checks a reachable routine beyond the gap; it does not resolve the boundary problem.
+
 - [Executable guest imports](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) - on Linux and macOS, a relocated executable import resolved to one guest provider requires that module and its dependencies at startup, even when it was discovered through `--module-dir` without a DT_NEEDED entry. Unreferenced symbols and no-op relocations do not require an otherwise deferred module. Console module-start ordering is unmeasured.
 
-- [Runtime-loaded modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) that another module needs are initialized at startup with no start arguments, before the module that needs them is loaded; the console is assumed to start them when that module is loaded.
-- [Runtime-loaded modules the executable needs](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) are mapped at startup on Windows and started when the title loads them with `sceKernelLoadStartModule`, with their start arguments, as a Unity player loads `mono-ps4.sprx`. A title that calls such a module before loading it finds its initializers not run; whether the console starts it earlier is not measured. A module the executable only imports from and the title never loads itself gets no `module_start` and no initializers at all under this deferral, and nothing reports it. Linux and macOS still start it at startup.
+- [Runtime-loaded modules](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) can be mapped early for bindings. Linux defers their initialization to an explicit load of each module; standard SDK folders keep their mapping initializer, including through the browser conversion API. On Windows and macOS, a module another module needs is initialized at startup without start arguments; console dependency-start ordering is unmeasured.
+- [Runtime-loaded modules the executable needs](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) (`--module-dir`) are mapped at startup on Windows and started when the title loads them with `sceKernelLoadStartModule`, with their start arguments, as a Unity player loads `mono-ps4.sprx`. A title that calls such a module before loading it finds its initializers not run; whether the console starts it earlier is not measured. A module the executable only imports from and the title never loads itself gets no `module_start` and no initializers at all under this deferral. The [entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) prints `Deferred module <path>` at startup for each such module that an import of the executable names, whether or not the title loads it later; an import without a module name is not reported. macOS still starts it at startup.
 - The executable file that [relinker](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) generates opens a console when launched, unless it is relinked with `--windows-gui`, which selects the GUI subsystem. A GUI build started from Explorer has no standard output or error handle; the [entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) gives each missing one `anyps5.log` beside the executable, replacing the previous run's file (#3282). Errors about the executable path or about waiting for the previous LoadExec process are written before the log is opened and are lost when the standard error handle is missing. If the log cannot be created, output to the missing handles is lost.
 - [Guest import registries](../../../core/relinker/relinker/src/guest/GuestModuleBuilder.cpp) - declared host imports of bundled modules are recorded with their module name and relocation target, even when another guest module exports the same stripped NID. No-op relocations are omitted. Registries describe import bindings, not implementation correctness or runtime reachability.
 - Converted Windows main executables [omit `DYNAMIC_BASE`](../../../core/relinker/elfpatcher/src/windows/WindowsPeWriter.cpp) by default, not only with `--windows-fixed-base`: on the console the executable lies inside the 40-bit window that the title's own `sceLibcMspaceCreate` checks (#3043). Relocations are kept, so if `0x140000000` is taken Windows relocates the image, possibly above that window. Verified only on Windows 10.
 - [SDK memory-management syscall traps](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) under `--trap-sdk-syscall-stubs` recognize three exact instruction sequences from [ps5-payload-dev SDK libc/mman.c](https://github.com/ps5-payload-dev/sdk/blob/12cf3dda40/libc/mman.c), observed in Nuvio Maxd 0.5.15 (PPSA99288): syscall 74 and the two syscall 477 paths, with their argument preparation and carry-flag error handling. Matching requires a decoded instruction boundary and the complete sequence inside the scanned code range. Other SDK/compiler output remains rejected. The matched syscall becomes `UD2`; this does not implement mmap or mprotect and a call still faults.
 - The [instruction decoder](../../../core/relinker/codegen/src/x86/X64InstructionDecoder.cpp) reads a 16-bit displacement for `66 E8`, `66 E9` and `66 0F 80`-`8F` without REX.W, as AMD processors, the console included, do (binutils `objdump -M amd64`; REX.W selects the 32-bit form). AMD also truncates the target of every near relative branch with that prefix, rel8, LOOP and JRCXZ forms included, to 16 bits. Instruction metadata marks these branches as truncated and reports no branch target for them, and stubs refuse to move them. Compilers do not emit these forms.
 - Converted Linux main executables are [placed at `0x400000`](../../../core/relinker/relinker/src/pipeline/Conversion.cpp) by default, as `ET_EXEC` without ASLR, not only with `--linux-fixed-base`: the console executable lies inside the 40-bit window that the title's own `sceLibcMspaceCreate` checks (#3043). Where the console loads an executable that does not require an address is not measured; `0x400000` is the base that executables reading their GOT through `app0/imports.txt` assume (#4013). The relinker refuses an image that spans 2 GiB or more, so the executable ends below the guest arena at `0x200000000`. With `--lazy-binding` the executable stays position independent.
+- `--frame-red-zone` frames only leaf functions that start with a chain of pushes of at least five bytes (`push rbp; mov rbp, rsp; push ...`, or pushes alone, which may be followed by `sub $n, %rsp` or `lea -n(%rsp), %rsp`) and leave through exits of at least five bytes that undo that allocation with `add` or `lea`, pop the same registers and `ret` ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)). Leaves with a frame pointer that allocate, leaves with neither pushes nor an allocation, shorter prologues and exits, exits that free another size, and functions with indirect jumps or other RSP arithmetic keep their red zone.
+- In a red-zone leaf without a frame pointer, `--frame-red-zone` lowers RSP after the prologue by the deepest displacement below RSP, rounded up to 16, and moves every RSP operand by the same amount ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)). A leaf that takes the address of a slot below RSP, or uses an RSP operand with an index register, is lowered by the whole 128 bytes, since a pointer or an index can reach deeper than any displacement; values below RSP reached through any other register are not seen. Leaves with a frame pointer are lowered by 128 bytes. Inside a moved frame the CFA rules of the guest's unwind tables are off by the shift.
+- An RSP operand that `--frame-red-zone` cannot move in place, an 8-bit displacement the shift takes past 0x7f or one without a displacement, moves to a stub with the instructions after it up to five bytes and is re-encoded there with the moved displacement ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)). The leaf is skipped when that site would take in a branch target, a branch, ret or RIP-relative instruction, or another site, and when the operand is EVEX, whose 8-bit displacement is scaled. A game patch over a framed site or a moved displacement is refused.
+- In `--frame-red-zone`, function bounds come from the executable's `.eh_frame` FDEs: each function is decoded from its FDE start to its FDE end, or to int3 padding before it, and the relinker stops with an error when the executable has none. Code outside every FDE, such as a function without unwind information, is not framed ([framer](../../../core/relinker/codegen/src/x86/RedZoneFramer.cpp)).
 - `--to-intel` lowers MCOMMIT to STC plus NOP padding and RDPRU through a runtime-checked stub in the [matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp): AMD APM Vol. 3 defines RDPRU ECX 0 as MPERF and ECX 1 as APERF, neither readable on Intel hosts, so both selectors return the host TSC as a disclosed monotonic-counter approximation (their ratio always reads 1.0) while other selectors yield zero EDX:EAX. STC asserts CF=1 because under x86-TSO prior stores are already ordered and guest memory is host-DRAM-backed, leaving the commit-success case as the only observable one. Non-zero RDPRU selectors, the TSC-for-MPERF/APERF substitution, and any console path reporting MCOMMIT CF=0 are unverified.
-- [Unscoped imports on Windows](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) - an import without a module that no searched library exports under its name is searched again under the NID of that name, because homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) imports by symbol name (Quake, from the websrv homebrew launcher; Mari0, #6239) while the libraries in `libs/` export NIDs. A dependency named with `.sprx`, `.suprx` or `.debug_prx` loads the `.prx` library of the same stem from `libs/`, and `libkernel_web` also loads `libkernel.prx`, as `libSceLibcInternal` already loads `libc.prx`: AnyPS5's `libkernel_web.prx` exports only two functions, where the console's `libkernel_web.sprx` is a libkernel variant. A name that matches a library's export as written still binds to that export first. Linux and macOS resolve these imports through the host loader by name and are unchanged.
-- The length-changing path of the [instruction rewriter](../../../core/relinker/codegen/src/x86/X64InstructionRewriter.cpp) is not used by the [converter](../../../core/relinker/codegen/src/Amd64OnlyConverter.cpp): it does not adjust data-to-code references (relocations, FDEs, jump tables) or segment sizes, so every substitution keeps the instruction length.
+- [Unscoped imports on Windows](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp) - an import without a module that no searched library exports under its name is searched again under the NID of that name, because homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) imports by symbol name (Quake, from the websrv homebrew launcher; Mari0, #6239) while the libraries in `libs/` export NIDs. A dependency named with `.sprx`, `.suprx` or `.debug_prx` loads the `.prx` library of the same stem from `libs/`, and `libkernel_web` also loads `libkernel.prx`, as `libSceLibcInternal` already loads `libc.prx`: AnyPS5's `libkernel_web.prx` exports only two functions, where the console's `libkernel_web.sprx` is a libkernel variant. A name that matches a library's export as written still binds to that export first. macOS resolves these imports through the host loader by name and is unchanged.
+- [Unscoped imports on Linux](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp) - in an executable or bundled module that names a dependency with `.sprx`, `.suprx` or `.debug_prx`, as homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) does, an import without a module that is named by symbol is bound to the NID of that name only. Unlike Windows, the name as written is not tried first, because the host loader also searches the host C library, which exports `malloc` or `pthread_create` under their names. A name that a bundled module exports still binds to that module, as does a bundled module's import of a name the executable exports, and such a dependency loads the `.prx` library of the same stem. Unqualified imports of other executables and bundled modules are still bound by name.
+- The length-changing path of the [instruction rewriter](../../../core/relinker/codegen/src/x86/X64InstructionRewriter.cpp) is not used by the [converter](../../../core/relinker/codegen/src/Amd64OnlyConverter.cpp): it does not adjust data-to-code references (relocations, FDEs, jump tables) or segment sizes, so every substitution keeps the instruction length. The rewriter conservatively rejects length-changing edits when a surviving truncated relative branch would move relative to its target (only one of the two lies after the cut) or when its section-relative target falls outside the 16-bit range, because the runtime address base needed to resolve a wrapped destination is unavailable; truncated branches that keep their distance and stay in range are accepted.
 - The [converter](../../../core/relinker/codegen/src/Amd64OnlyConverter.cpp) takes the branch targets that keep an instruction in place from a linear scan of the code segment, so data in that segment decodes as branches too: OpenSSL's x86-64 assembly keeps strings such as "SHA1 block transform for x86_64, CRYPTOGAMS by <appro@openssl.org>" in its code, and in SuperTuxKart (PPSA69421) and Mortalfin (PPSA99141) the `jae` read from "sf" points into the VEX prefix of a 256-bit store. A direct branch target inside a scanned instruction counts only where every byte before it is a legacy prefix or REX, which a real branch can skip (a `lock` prefix, for example); a target in a VEX prefix, opcode or operand is ignored, as a jump-table entry that starts no instruction already is. A real branch to such a target, overlapping instructions as hand-written code can, is not seen, and the instruction it enters can be moved.
 - A `PT_SCE_RELRO` segment that no `PT_LOAD` covers, the PS4 layout, is [loaded](../../../core/relinker/relinker/src/parsing/ElfReader.cpp) as a read-write `PT_LOAD` and stays writable after relocation; FreeBSD rtld makes `PT_GNU_RELRO` read-only once relocation is done, and what the console does with `PT_SCE_RELRO` is not checked.
 - In Windows output, a guest instruction that addresses memory through GS becomes `UD2` and NOP padding of its own length ([TLS builder](../../../core/relinker/elfpatcher/src/windows/WindowsTlsBuilder.cpp)): the host owns GS, and the guest GS base that FreeBSD's `sysarch(AMD64_SET_GSBASE)` would set is not emulated. A converted module runs until such an instruction is reached, which then faults. Prospero Win (PPSA99995) has six in its Wine `ntdll`.
@@ -24,11 +31,14 @@
 - Read-only data can also sit between the unwind functions of such images. There, a `syscall`, `sysenter` or `int 0x80` pattern fails the [syscall scan](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) only when a constant syscall number is set before it; the others, and every `sysret`, are skipped and counted in one message. The number is looked for in the decoded instructions and, whatever alignment the decoding took, in the bytes before the pattern: a `mov eax, imm32`, `mov rax, imm32`, `mov rax, imm64` or `xor eax, eax`, optionally followed by `mov al, imm8` or `mov ax, imm16`, then by any number of register moves or zeroings that leave `rax` alone. A real syscall without an unwind entry whose number is set otherwise is not refused and runs on the host: from memory or another register (`mov eax, ecx`), by `push`/`pop` or arithmetic (`or eax, imm32`), or with any other instruction between the load and the pattern.
 - In the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs for such images, a relocation or `lea` target outside every unwind function is followed as code only when its linear decoding, up to the first jump, return or trap, the next unwind function or 256 instructions, holds an `fs:[disp32]` access, or when it is 16-byte aligned, starts less than 256 bytes after an unwind function and ends in a jump, return or trap. Every other such target is taken as data and counted in one message, and the Windows TLS rewrite fails instead of overwriting one. A TLS access of another form, such as `mov rax, fs:[rax]`, or a `gs` instruction in code reached only through such a target is therefore not rewritten or trapped. Other fs and gs instructions do not tell code from data there: string bytes decode as these prefixes, and in two measured titles about 2,500 of about 5,500 such targets decode to one before their first jump.
 - In executables and guest modules with a `PT_SCE_DYNLIBDATA` segment, the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs follows code only from the end of `PT_INTERP`, or of the `/libexec/ld-elf.so.1` string that begins the segment when no `PT_INTERP` covers it, as in OpenOrbis modules, to the end of the PLT after the last function of the unwind table, or to the end of that function when the PLT comes before the code, as in the `libSceFios2.prx` and `libc.prx` that CUSA02636 bundles (PLT at 0xc8); the pipeline's scans of executables above stop at this same end, also when the PLT comes before the code. A guest module with PLT relocations and no PLT before or after its unwind functions, or with a PLT that overlaps one, fails as the executable does. Code after that end is not analyzed, such as the `DT_FINI` routine without an unwind entry that follows the last unwind function in both modules and that the Windows and macOS outputs call when the program exits: a TLS access in it is not rewritten, the ELF entry point, `DT_INIT`, `DT_FINI`, a branch or a pointer into it is ignored, and a function symbol or init/fini array entry pointing into it fails the conversion.
+- Under Rosetta (M5, macOS 27.0.1), a VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store or load that faults on an element other than an active first one ends the process (`unexpectedly need to EmulateForward on a synchronous exception`) instead of raising SIGSEGV or SIGBUS, so a masked store into a page the macOS write watch keeps read-only ends the title. `--to-rosetta` moves each masked store to a [stub](../../../core/relinker/codegen/src/x86/MaskedStoreLowering.cpp) that first writes to the first and last byte of every active element with `LOCK OR` of 0, which faults normally and changes nothing; each store then costs up to 16 locked byte writes. A page made read-only again by another thread between those writes and the store still ends the process. A stack-relative displacement that exceeds signed disp32 after the spill frame throws. Masked loads are not converted.
 - A relocation against a dynamic symbol entry that is all zero, like the null symbol, takes the value 0 plus its addend, as the gABI defines for `STN_UNDEF` ([pipeline](../../../core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp)). The Linux output imports such an entry as an unnamed weak symbol, which the host loader resolves to 0; the Windows and macOS outputs write the value into the slot ([relocation builder](../../../core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp)). What the console's loader does with such an entry is not measured. OliSe Player (PPSA01153) has seven of them, and its code calls through those slots only when they are not 0 ([#4437](https://github.com/boykopovar/AnyPS5/issues/4437)).
 - In macOS output, a guest instruction that addresses memory through GS becomes `UD2` and NOP padding of its own length ([macOS image writer](../../../core/relinker/elfpatcher/src/macos/MacOsImage.cpp)): the host owns GS, which holds the pthread TSD base the guest TLS stubs read, and the guest GS base that FreeBSD's `sysarch(AMD64_SET_GSBASE)` would set is not emulated. A converted module runs until such an instruction is reached, which then faults. Prospero Win (PPSA99995) has six in its Wine `ntdll`.
 - The Linux placement of the `--to-intel` stubs in the [ELF patcher](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp) is covered only by a synthetic test.
 - `--to-rosetta` lowers what Rosetta lacks on top of `--to-intel` ([matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp)). AVX2, FMA, BMI1/2, F16C and MOVBE were observed to execute on an M5 Max without being reported through CPUID; this is not a guarantee for other Rosetta hosts. ANDN and RDRAND fault on an M1 running macOS 15.3.1 and execute on an M1 running macOS 26.6.2, so on the M1 the difference follows the macOS version; on that host BEXTR, BLSI, BLSMSK, BLSR, TZCNT, LZCNT, POPCNT, BZHI, MULX, PDEP, PEXT, RORX, SARX, SHLX, SHRX, MOVBE, FMA, AVX2 and F16C execute as well, its CPUID leaf 1 reports none of MOVBE, FMA, AVX or F16C, and RDSEED, RDPID, CLWB, ADCX and ADOX raise SIGILL. They also execute on an M5 running macOS 26.4, where the rest of BMI1 and BMI2, LZCNT, PREFETCHW, CLFLUSHOPT, AVX, AVX2, FMA, F16C and MOVBE execute as well although CPUID leaf 7 reads zero and leaves 1 and 0x80000001 report none of them, and where RDSEED, CLWB, RDPID, ADCX and ADOX raise an illegal instruction. ANDN is lowered, but RDRAND and other BMI instructions still depend on the host. RDSEED becomes RDRAND and CLWB a NOP. RDPID returns processor 0, and RDTSCP runs unchanged with ECX set to 0 after it, because Rosetta's TSC_AUX is the constant 0xAAAAAAAB (also measured on an M5, macOS 27.0.1). An RDPID or RDTSCP site with no movable instruction after it for the jump is kept; a kept RDTSCP reports 0xAAAAAAAB. ADCX/ADOX fault under Rosetta and are not converted: compilers do not emit them, and code that checks CPUID sees no ADX. The conversions are covered by the converter tests. ANDN lowering is also executed by an x86-64 test build under Rosetta on the M1; the other conversions were originally checked on an M5 Max, outside this repository's CI.
+- `--to-rosetta` output faults on an M2 running macOS 14.8.9 when it reaches AVX, AVX2, FMA, F16C, RDRAND or a BMI1/BMI2 instruction other than ANDN, TZCNT and LZCNT: Rosetta on that host raises SIGILL for them and for RDSEED, RDPID, CLWB, ADCX and ADOX ([matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp)). Only TZCNT, LZCNT, POPCNT, MOVBE, CLFLUSHOPT, PREFETCHW and RDTSCP execute, and RDTSCP sets ECX to 0xAAAAAAAB. CPUID leaf 1 reports POPCNT and none of MOVBE, AVX, FMA, F16C or RDRAND, leaf 7 reads zero, and leaf 0x80000001 reports RDTSCP but neither LZCNT nor PREFETCHW. An M2 Max on macOS 27.2 reports the same CPUID but executes everything except RDSEED, RDPID, CLWB, ADCX and ADOX, so the faults follow the macOS version, not the chip.
 - `--to-intel` replaces the approximate legacy SSE and VEX.128 register forms of RSQRTPS/RCPPS and VRSQRTPS/VRCPPS with [correctly rounded](../../../core/relinker/codegen/src/x86/ReciprocalLowering.cpp) 1/sqrt(x) and 1/x, not with the AMD approximation: its tables are not public. Intel's approximation of 1/sqrt(1.0) is 0x3F7FF000, and two Newton-Raphson steps on it settle on 0.99999994 instead of 1.0; a renormalised identity quaternion then turns into a NaN axis in PPSA21564, which the console does not show. Refined results now reach the exact value; unrefined ones can still differ from the console in the low bits. Each site costs an out-of-line stub (two jumps, a spill below the red zone, SQRTPS/DIVPS). Legacy SSE forms preserve the destination's upper YMM bits; VEX forms clear them. The 256-bit, scalar and memory forms keep the native instruction, as does a site shorter than 5 bytes with no movable instruction after it for the jump (5 sites in PPSA21564, counted before a following RIP-relative instruction could move into the stub; not recounted).
+- XSAVEC raises an illegal instruction under Rosetta and is not converted, because it writes the compacted format. XSAVEOPT, which also faults there, is rewritten to XSAVE in place by the [matcher](../../../core/relinker/codegen/src/x86/Amd64OnlyInstructionMatcher.cpp) under `--to-rosetta` (`0F AE /6` becomes `/4`; prefixes and operand are kept). The two differ only in the init and modified optimizations, which let XSAVEOPT skip writing unchanged or initial state ([Intel SDM volume 1](https://cdrdv2-public.intel.com/812382/253665-sdm-vol-1.pdf), chapter 13), so XRSTOR restores the same state from either area. Measured on one M5 with macOS 27.0.1: XSAVE and XRSTOR handle x87, SSE and AVX state in the standard format, although CPUID leaf 1 reports neither XSAVE nor OSXSAVE and leaf 0xD sub-leaf 1 reports neither XSAVEOPT nor XSAVEC. The converter tests' x86-64 build executes the replacement XSAVE under Rosetta on that host.
 - `--trace-imports` ([Windows entry stub](../../../core/relinker/elfpatcher/src/windows/WindowsEntryStubBuilder.cpp), [Linux entry stub](../../../core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp)) exists for Windows and Linux output, not macOS. Only imports bound through a PLT slot, or through a GOT slot whose symbol is a function, are traced; a function reached through any other relocation, or looked up at run time with `sceKernelDlsym`, is not, and neither are weak imports or the imports of modules loaded at run time. On Linux the entry stub makes the page of every traced slot readable, writable and executable with `mprotect` before it stores the thunk, so a slot inside `PT_GNU_RELRO` can be replaced; those pages stay writable, and data pages become executable, while tracing is on
 
 - [ANDN lowering](../../../core/relinker/codegen/src/x86/AndnLowering.cpp) uses scalar NOT and AND for 32- and 64-bit register and memory operands under `--to-rosetta`, following the ANDN entry in [Intel SDM volume 2A](https://cdrdv2-public.intel.com/812383/253666-sdm-vol-2a.pdf). SF and ZF follow the result, CF and OF clear, and AF and PF are undefined. The scratch register is saved below the 128-byte red zone. A 64-bit stack-relative displacement that exceeds signed disp32 after reserving the spill frame throws; other BMI instructions are not lowered. The M1 test covers register overlap, RSP operands, memory addressing, RIP relocation, flags and red-zone preservation; precise fault delivery inside a spill sequence has not been verified.
diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md
index 551838eb6d..6919cefeed 100644
--- a/docs/dev/debt/shader.md
+++ b/docs/dev/debt/shader.md
@@ -2,6 +2,8 @@
 
 ### Build
 
+- [GuestContext memory](../../../core/shader/recompiler/Recompiler.hpp) rejects direct construction from temporary owning ranges. The view does not own the region array or its referenced bytes. That storage must outlive the request and its consumers, including when supplied through named containers, existing spans or pointers.
+
 - winpthreads initializes a statically initialized rwlock on its first lock and fails a concurrent first lock with `EINVAL`, which `std::shared_mutex` and `std::shared_timed_mutex` ignore, so that lock does not exclude. The host `std::shared_mutex` objects in [Recompiler.cpp](../../../core/shader/recompiler/Recompiler.cpp) are locked once when created. A new host `std::shared_mutex` used on Windows needs the same.
 
 - The bundled [SPIRV-Tools build](../../../core/shader/recompiler/PatchSpirvTools.cmake) replaces the redundancy-elimination source with a build-directory copy. A depth-first traversal keeps one value map and removes each subtree's added values on return, avoiding growing map copies and preventing sibling values from leaking into one another. This extends the processed-map release fix in [SPIRV-Tools #6962](https://github.com/KhronosGroup/SPIRV-Tools/pull/6962). Remove the patch when the pinned dependency has equivalent copy-free traversal; #6962 alone still copies maps for sibling branches. System-dependency builds need an equivalent fix in their installed package. Optimization passes and validation remain unchanged; wider shader and game performance measurement is needed.
@@ -12,7 +14,7 @@
 - [MSAA-address image loads on 2D textures](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) - 32-bit `image_load` with DIM 2D_MSAA reads a non-multisampled 2D T# as the same DIM 2D load, ignoring the sample index. Measured on RX 6650 XT (gfx1032), wave32 and wave64, for R32_UINT, R32_FLOAT, RGBA8_UNORM and RGBA8_SRGB, sample indices 0/1/2/7/31/0xffffffff and in-range/out-of-range coordinates; IEEE 0, DX10 clamp 1, denorm32 0, denorm16 3, round32/16 0, fp16 overflow 0. Pinned in ImageMsaaAddressOnPlane.cpp. Not measured on gfx1013. Stores, atomics, mip-bearing or A16 addresses, packed accesses, converted formats, depth-bit views, array-MSAA addresses and image-table accesses are not enabled by this compatibility mode.
 
 - [MUBUF/MTBUF descriptors ending in VCC](../../../core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp): the four dword descriptor at s104 is s104, s105, vcc_lo and vcc_hi, as LLVM's [VCCTuple/SReg_128](https://github.com/llvm/llvm-project/blob/d8219b47422f7322db252ad29ca8ea87993fb433/llvm/lib/Target/AMDGPU/SIRegisterInfo.td#L422) and [buffer resource operands](https://github.com/llvm/llvm-project/blob/d8219b47422f7322db252ad29ca8ea87993fb433/llvm/lib/Target/AMDGPU/BUFInstructions.td) describe. Existing translation maps scalar codes106/107 to the raw VCC words. Recompiled loads/stores, both words, bounds, formats and wave32/wave64 execute on NVIDIA and AMD Vulkan; raw gfx10/gfx1013 hardware is not measured. Higher descriptor bases remain refused; the normal SGPR bound is unchanged.
-- [Packed pixel ancillary word](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) (shader recompiler) - the sample index at bits 8-11 and the render target index at bits 16-28 follow #295. The sample index is the SampleId builtin in a pixel shader the guest iterates per sample (`PS_ITER_SAMPLE` on a multisampled draw), an equality inferred, not measured. In any other pixel shader it is 0, the iterated sample number of a pixel the hardware does not iterate (also inferred), so reading it does not make the host shade per sample. The render target index is the Layer builtin when the draw exports it (a layered draw, `PA_CL_VS_OUT_CNTL` bit 18; the pipeline specialization constant `LayerExported`) and 0 otherwise, the first layer Vulkan renders when no pre-rasterization stage writes Layer. Reading the unwritten Layer builtin instead makes AMD's Windows driver drop the fragment's writes (#4800); with the constant at 0 the load is folded away. Mesa reads both fields from those bits, with the layer 14 bits wide only from GFX12 on ([ac_nir_lower_intrinsics_to_args.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/amd/common/nir/ac_nir_lower_intrinsics_to_args.c#L342-L368)). A value passed through a select, move or phi whose every read is an extract inside one of those fields is rebuilt from the two fields alone. Any other read the masked-select pass cannot drop gets the whole word: the primitive class at bits 0-1 (0 point, 1 line, 2 triangle, 3 rectangle), which the draw sets as a pipeline specialization constant ([RasterPrimitiveOf](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp)) in the shaders that read it, plus the sample field, with every other bit zero. That layout comes from the RDNA 3 and 3.5 ISA guides (prim type 1:0, VRS rates 3:2 and 5:4, eye id 7, sample 11:8, render target index 28:16). The GCN register guides give the same prim type and sample fields and put the render target index at 26:16, so the two sources agree for layers below 2048. AMD's LLPC reads the primitive class from bits 1:0 with the same encoding ([LowerGlCompatibility.cpp](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/llpc/lowering/LowerGlCompatibility.cpp#L830-L836)) and without a GFX-level check ([getPrimType](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/LowerInOut.cpp#L5307-L5315)). Nobody has checked it on gfx1013. In the whole word only bits 0-1 and 8-11 have a source. Bits 2-7, 12-15 and 29-31 are assumed zero, not measured: the VRS rates (2-5) and the eye id (7) because the driver supports neither variable-rate shading nor multiview, so a title that enables either would read other bits on the console, and bits 6, 12-15 and 29-31 because no source gives them a meaning. The sample field reads SampleId only in iterated shaders. The whole word has the same 0 at bits 16-28. A change that makes draws export a layer must restore the Layer read in both places
+- [Packed pixel ancillary word](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) (shader recompiler) - the sample index at bits 8-11 and the render target index at bits 16-28 follow #295. The sample index is the SampleId builtin in a pixel shader the guest iterates per sample (`PS_ITER_SAMPLE` on a multisampled draw), an equality inferred, not measured. In any other pixel shader it is 0, the iterated sample number of a pixel the hardware does not iterate (also inferred), so reading it does not make the host shade per sample. The render target index is the Layer builtin when the draw exports it (a layered draw, `PA_CL_VS_OUT_CNTL` bit 18; the pipeline specialization constant `LayerExported`) and 0 otherwise, the first layer Vulkan renders when no pre-rasterization stage writes Layer. Reading the unwritten Layer builtin instead makes AMD's Windows driver drop the fragment's writes (#4800); with the constant at 0 the load is folded away. Mesa reads both fields from those bits, with the layer 14 bits wide only from GFX12 on ([ac_nir_lower_intrinsics_to_args.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/amd/common/nir/ac_nir_lower_intrinsics_to_args.c#L342-L368)). A value passed through a select, move or phi whose every read is an extract inside one of those fields is rebuilt from the two fields alone. Any other read the masked-select pass cannot drop gets the whole word: the primitive class at bits 0-1 (0 point, 1 line, 2 triangle, 3 rectangle), which the draw sets as a pipeline specialization constant ([RasterPrimitiveOf](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp)) in the shaders that read it, plus the two fields, with every other bit zero. That layout comes from the RDNA 3 and 3.5 ISA guides (prim type 1:0, VRS rates 3:2 and 5:4, eye id 7, sample 11:8, render target index 28:16). The GCN register guides give the same prim type and sample fields and put the render target index at 26:16, so the two sources agree for layers below 2048. AMD's LLPC reads the primitive class from bits 1:0 with the same encoding ([LowerGlCompatibility.cpp](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/llpc/lowering/LowerGlCompatibility.cpp#L830-L836)) and without a GFX-level check ([getPrimType](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/LowerInOut.cpp#L5307-L5315)). Nobody has checked it on gfx1013. In the whole word only bits 0-1, 8-11 and 16-28 have a source. Bits 2-7, 12-15 and 29-31 are assumed zero, not measured: the VRS rates (2-5) and the eye id (7) because the driver supports neither variable-rate shading nor multiview, so a title that enables either would read other bits on the console, and bits 6, 12-15 and 29-31 because no source gives them a meaning. The sample field reads SampleId only in iterated shaders. The whole word has the same render target index at bits 16-28
 - [Front-face input with `FRONT_FACE_ALL_BITS`](../../../core/shader/recompiler/Translation/src/InstructionTranslator.cpp) (shader recompiler) - with `SPI_BARYC_CNTL.FRONT_FACE_ALL_BITS` set, a back face reads 0 and a front face 0xffffffff. Mesa 22.0 RADV sets the bit ([radv_pipeline.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-22.0.0/src/amd/vulkan/radv_pipeline.c#L5953)) and ACO tests the input with `v_cmp_lg_u32 0` ([aco_instruction_selection.cpp](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-22.0.0/src/amd/compiler/aco_instruction_selection.cpp#L8123-L8128)), so only back = 0 and front ≠ 0 are sourced; PPSA05684's two-sided cloth shaders test it with `v_cmp_lt_u32 0`. The exact front value is not measured. Without the bit the input is ±1.0, as current Mesa reads it (`fgt 0`, `fsign`; [ac_nir_lower_intrinsics_to_args.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/bffd91947efc1932da99aca69fc540d6d4201b0c/src/amd/common/nir/ac_nir_lower_intrinsics_to_args.c))
 - [Color comparison descriptor forms](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp): for formats AnyPS5 can sample as floating-point from GFX10 codes 1–77, `image_sample_c*` returns 0 for every comparison function except codes 7 (`16_UNORM`) and 22 (`32_FLOAT`), which use the native comparison path. The split was measured with point sampling on RDNA2 (gfx1031 and gfx1036) and with point and bilinear sampling on RDNA3 (gfx1100); the PS5's gfx1013 and 2D-array/cube comparisons across these formats remain unverified. Codes 128–130 (8-bit sRGB) also return 0, measured on gfx1035 over references -0.5..1.5 and texel codes 0..255. Scaled, integer and formats requiring converted sampling remain unsupported, although the tested hardware formats also return 0 for them. Anisotropic comparison of the remaining formats has not been measured.
 - [s_setkill](../../../core/shader/recompiler/RdnaDecoder/src/RdnaScalarOpDecoder.cpp) (core/shader/recompiler) - decoded as `s_endpgm` for any immediate: measured on RDNA2 hardware (gfx1035), a store before it is visible and nothing after it runs ([#771](https://github.com/boykopovar/AnyPS5/pull/771)); whether the KILL status bit it sets is observable differently from `s_endpgm` is unverified
@@ -22,6 +24,10 @@
 - [s_barrier in vertex-path programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp) (recompiler) - emits no instruction when the program has no LDS or GDS access and no memory write or atomic, so no wave of the subgroup can observe another, or when the barrier runs before every memory access of the program (it is on the entry's straight-line path with no load, store, atomic, image or LDS access ahead of it), so it orders nothing; the `GS_ALLOC_REQ` such a barrier orders on NGG passthrough programs is already dropped on the vertex path. The Vertex execution model has no workgroup barrier. Other programs with LDS, GDS or memory writes throw. Not measured on hardware
 - [Vertex clip and cull distances](../../../core/shader/recompiler/Translation/src/ShaderInputInfoBuilder.cpp) (libSceAgcDriver) - `PA_CL_VS_OUT_CNTL` enable bit `s` of `CLIP_DIST_ENA`/`CULL_DIST_ENA` is taken to select component `s` of the `pos1`/`pos2` exports, with the Vulkan array index counted by the enabled bits below it, and `VS_OUT_CCDIST0_VEC_ENA` as bit 22; this follows the recompiler's existing position-export mapping, not hardware or documentation. The guest clip distances share one `gl_ClipDistance` array with the all-zero clip position distance, which takes the index after them. A vertex program whose own code has no `pos1`..`pos3` export is compiled and prepared without these bits (`PositionExportLayout`), so registration and draws agree on its artifact; an export in a subroutine it calls is not seen by that scan
 - [32_AR color exports](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - with `SPI_SHADER_COL_FORMAT` 3 the red value is export channel 0 and the alpha is export channel 1, the GFX10 layout of Mesa's [`emit_ps_color_export`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/3e32b0e1f132231b7a972c1b0b5b06c7e16cf8b9/src/amd/common/nir/ac_nir_lower_ps_late.c#L400-L411), ACO and radeonsi in Mesa 22.0 ([aco_instruction_selection.cpp](https://gitlab.freedesktop.org/mesa/mesa/-/blob/a82920af6efa4a7a66919885c6477fbd8fdc7b9d/src/amd/compiler/aco_instruction_selection.cpp#L11087-L11096), [si_shader_llvm_ps.c](https://gitlab.freedesktop.org/mesa/mesa/-/blob/a82920af6efa4a7a66919885c6477fbd8fdc7b9d/src/gallium/drivers/radeonsi/si_shader_llvm_ps.c#L323-L333)) and AMD's [LLPC](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/FragmentColorExport.cpp#L157-L168); before GFX10 the alpha was channel 3. Channels 2 and 3, which none of these compilers enables, are ignored; green and blue are 0 and the alpha of an export without channel 1 is 1.0, the defaults of the other formats, which no source gives. Not measured on hardware, neither on gfx1013 nor on a PC RDNA 2 GPU; pinned in [Pixel32ArExport.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/Pixel32ArExport.cpp)
+- [GCN instructions](../../../core/shader/recompiler/RdnaDecoder/src/GcnInstructionDecoder.cpp) (shader, PS4) - PS4 (Sea Islands) instructions are re-encoded to their RDNA encodings with opcode tables built from shadPS4's `opcodes.h` and decoded by the RDNA decoder; an encoding without an RDNA counterpart throws. MIMG has no DIM field on GCN: the dimension is taken as 2D, or 2D array when DA is set, and the [materializer](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) rejects a T# whose type needs another address count. MIMG word 1 bits [31:26] are reserved on GCN (A16 and D16 on RDNA).
+- [GCN buffer and image descriptors](../../../core/shader/recompiler/RdnaDecoder/src/RdnaDescriptorFormat.cpp) (shader, PS4) - a GCN V# word 3 (DATA_FORMAT [18:15], NUM_FORMAT [14:12], names read from the most significant field) is rewritten to the unified format of the PS5 layout with OOB_SELECT 1 for a strided buffer and 3 otherwise, following the GFX6-7 NUM_RECORDS rules in Mesa's `ac_descriptors`; ATC, HASH, HEAP and MTYPE are dropped. The V# base is 44 bits, as in shadPS4's `AmdGpu::Buffer`: Limbo leaves 0x7 in word 1 bits [15:12]. A GCN T# is rewritten to the PS5 layout with SW_MODE linear, keeping TILING_INDEX [4:0], POW2_PAD [5] and PITCH - 1 [19:6] in word 7. None of it is checked on a console.
+- [PS4 legacy vertex shaders](../../../core/shader/recompiler/Recompiler.cpp) (shader, PS4) - a PS4 vertex program at the VS slot takes its user data from s0, its vertex index in v0 and its instance index in v1-v3, and a fetch shader it calls through the user pair (`s_swappc_b64 s[0:1], s[0:1]`) returns through the same pair. These rules apply only while GCN shaders are decoded.
+- [4_4_4_4 partial writes, refused draws](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp) (shader recompiler) - a merge throws when its shader exports depth, stencil or a sample mask, uses alpha-to-coverage or a quad sample mask, kills pixels under late tests in a draw that writes depth or stencil (a depth write, or a stencil test with a nonzero write mask and a non-keep operation), writes guest memory (stores, atomics, GDS writes) under late tests in a draw with a depth, stencil or depth-bounds test, as the forced early tests would drop the writes of rejected pixels, or kills pixels under late tests after the game has read an occlusion counter, as the early tests would count them. On an RTX 4070 SUPER (driver 610.88) a fragment killed after early tests still wrote depth, and `FragDepth` was ignored with `EarlyFragmentTests`, so the depth write cannot move after the shader there.
 
 ### Functional
 
@@ -29,8 +35,11 @@
 - [Windows cache housekeeping](../../../core/shader/recompiler/ShaderDiskCache.cpp): eviction of old versions and temporary files is skipped for `\\?\` and `\\.\` cache roots because the supported WinLibs directory iterator can enumerate the process working directory for long prefixed paths. The active version's `last-used` stamp update still runs; it fails for long `\\.\` aliases with the supported toolchain. Ordinary Windows directory enumeration remains subject to MAX_PATH.
 
 - [f64 compares](../../../core/shader/recompiler/Translation/src/CompareInstructions.cpp) flush denormal inputs to signed zero when bit 0 of the `FLOAT_MODE` f16/f64 denormal field is clear (modes 0 and 2); modes 1 and 3 and an unknown mode keep them. This follows the RDNA2 ISA section 6.4 and LLVM's sign-preserving AMDGPU denormal modes. The gfx1036 audit in [#981](https://github.com/boykopovar/AnyPS5/issues/981#issuecomment-6070046381) reports mode-sensitive `VopcCompareF64` results. Class compares still inspect the original bits. The full four-mode matrix has not been newly measured on AMD hardware or the PS5's gfx1013.
+- [Shader disk cache source version](../../../core/shader/recompiler/ShaderCacheVersion.cmake) - the version that names `shader_cache/<version>` and stamps `pipelines.journal` hashes every file under `core/shader/recompiler` (line endings normalized), `HostThreadLocal.hpp`, the SPIR-V and glslang submodule commits, and the compiler, build type and flags. Any edit there changes it and empties the cache, including edits that cannot change a translation (logging, the disk cache's own I/O, the recompiler's tests), and so does a rebuild with another compiler or flags. Driver sources outside the recompiler are not hashed: their recompiler calls are only checked against `shaderCacheReviewedNames`, so a driver change that alters a `RecompileRequest` field's meaning without changing its value keeps a stale cache.
 - [Unlinked calls](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) - the `s_swappc_b64` a table call's compare chain falls back to, when its target matches no linked copy, records the `UnlinkedCall` fault with the target and the program counter and stops the invocation, or continues after the call in programs whose faults do not stop invocations (see `bdaStopsInvocations`). The driver lists those calls in the request (`linkedCallFallbacks`), and it reports the fault like a BDA fault, naming the target: a dispatch that checks its faults when it completes throws, one whose check runs in a deferred write-back logs it and continues. The hardware would jump to the target, which is not modelled. Any other `s_swappc_b64` whose target is not resolved still throws when the shader is compiled.
 - [Cached source IR](../../../core/shader/recompiler/Recompiler.cpp) releases lazily allocated SSA construction tables after resource preparation and reclaims values unreachable from instructions, metadata and resource plans when retaining a pending source program. Immediate shader preparation skips reclamation because compilation consumes the program. Reclamation must account for every new IR pointer owner; a remaining external use throws. Live IDs are retained. Source and variant entries remain cached without an eviction bound. A pending source program is released after its first variant is obtained; memory beyond the measured title checkpoint and Linux performance remain unmeasured.
+
+- Cycles through non-phi instructions are not removed by [unobserved phi elimination](../../../core/shader/recompiler/Optimization/src/UnobservedPhiEliminator.cpp). The pass removes phi-only cycles before resource planning when no transitive user is a non-phi instruction.
 - [Vertex user-data tail jumps](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) link a linear raw vertex prolog's terminal `s_setpc_b64` through an unchanged user-data pair to its continuation. The instruction semantics follow AMD RDNA2 ISA section 12.3; the prolog convention follows Mesa `aco_select_vs_prolog.cpp` at `0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8`. Console hardware has not been measured. Branching prologs, computed low pointers and continuations reading `s_getpc_b64` remain unsupported
 - [Raw fragment user-data tails](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) also link a terminal `s_setpc_b64` when the low half is unchanged user data and the last high-half writer is an unconditional immediate `s_mov_b32`. Other computed high halves remain unsupported. This follows AMD RDNA2 ISA section 12.3 and Mesa `aco_select_nir.cpp` (`create_fs_jump_to_epilog`), `aco_isel_helpers.cpp` (`convert_pointer_to_64_bit`) and `aco_lower_to_hw_instr.cpp` (`p_jump_to_epilog`) at `0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8`; console hardware has not been measured
 
@@ -43,8 +52,9 @@
 - An [image table](../../../core/shader/recompiler/Optimization/src/ResourceTracker.cpp) whose key is neither a V#-relative scalar read nor a value the SRT walker evaluates (for example a shifted or masked runtime-offset V# read, a per-lane value made uniform by `v_readfirstlane`, or a loop-carried phi) binds every record of the snapshot domain instead of the selected ones. So does a table read at `(key << n) & mask` with such a key: a key domain would select records by the unmasked key, so that key is not narrowed. A key the walker evaluates selects its one record instead, unless the shader may write the memory the key is read from at run time (the same buffer, or any memory when the read or a write goes through a pointer or a GPU-only descriptor); then the column binds the whole domain too. A write to the key's memory through another V# over the same bytes is not detected. A shader whose selected records would pass 64 images or 64 sampled image/sampler pairs binds, for the heaps with the most such reads, the union of their keys in one table instead.
 - [Image table pointer indexing](../../../core/shader/recompiler/Optimization/src/ResourceTracker.cpp) propagates 32-bit value bounds through `ReadFirstLane` and `SelectU32` so waterfall key masks keep their bit domain. The SRT walker validates runtime select conditions whose active lane mask implies the condition through `LogicalAnd` conjunctions, assuming unselected inactive lanes need not be uniform across the full wave. The same assumption lets the two `s_load`s of one T# record match when one offset is added before `v_readfirstlane` and the other after (`ReadFirstLane(Select(mask, (key << 5) + 16, old), mask)` against `ReadFirstLane(key, mask) << 5`): with no active lane the hardware reads lane 0 of the inactive arm, and the table still binds the whole record.
 - An [image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) T# of an MSAA or FMASK image, or of a color format under a depth compare, faults when selected: tables have no multisampled descriptors and no emulated color compare.
-- Direct [FMASK image loads](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) read uncompressed `Fmask32_S8_F8` through a single-mip 2D or 2D-array `R32_UINT` snapshot with `Z_64KB_X` addressing. Destination selectors may name X, zero or one. Other FMASK formats, CMASK compression, packed accesses and other layouts throw. The layout follows PAL's [FMASK-to-surface conversion](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L877) and [32-bit view selectors](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9Device.cpp#L4973). Native RDNA/PS5 image-load results and title rendering are unmeasured; compressed color sampling remains unsupported.
-- `image_store`, image atomics, PCK2/PCK4 and MIMG BY2/BY4 through an [image table](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) T# fault (`unsupported operation`) when an active lane executes them; the store is dropped and the load reads zeros. A T# whose words the SRT walker evaluates is bound directly instead, for every operation of the shader on it (`DirectImageHandles`), so only T#s keyed per lane or by a value the walker cannot evaluate reach a table with these operations; such a direct T# is read when the work is recorded, so a key its own dispatch writes is read before that write.
+- Direct [FMASK image loads](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) of 16 samples, CMASK compression (bar the 8-fragment native owner path), packed accesses and other layouts throw. Uncompressed FMASK of up to 8 samples reads a single-mip 2D or 2D-array 8-, 16- or 32-bit `UINT` snapshot with `Z_64KB_X` addressing; selectors may name X, zero or one. `Fmask32_S8_F8` returns the stored word; others expand to 4 bits per sample, an index at or past the fragment count reading 8 (unknown), samples past the count 0. Layouts follow PAL's [expanded values](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9MaskRam.cpp#L5005) and [FMASK surfaces](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/core/addrlib2.cpp#L877). Console results, unused nibbles included, are unmeasured; compressed color sampling is unsupported.
+- A [DIM 2D read of a 2D MSAA T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) returns sample 0, which is not measured on the console's gfx1013, at an implicit LOD above 0, at an explicit one for texels over 16 bits except formats 22 and 56 in SW_64KB_R_X, or for other formats and swizzle modes; 64- and 128-bit SW_64KB_Z_X texels are not covered: gfx1031 does not address their samples. Such a read is an `image_load` without a mip, `image_sample`, `image_sample_lz` or `image_sample_l` of a direct sampled image; other accesses (gathers, bias, gradients, offsets, LOD clamps, depth compares, `image_load_mip`, `image_get_resinfo`, `image_get_lod`, PCK, BY2/BY4) throw, as does a depth-bits T# (16_UINT, 32_UINT or 32_SINT in a Z swizzle mode). On gfx1031 (RX 6700 XT, HIP), such reads return sample 0 at 2x, 4x and 8x for 8- to 128-bit texels in SW_64KB_R_X and 8- to 32-bit ones in SW_64KB_Z_X (formats 1, 5, 7, 11, 13, 14, 18, 22, 29, 56, 60, 64, 71, 77, 133).
+- `image_store_mip`, `image_store_pck`, PCK2/PCK4 and MIMG BY2/BY4 through an [image table](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) T# fault (`unsupported operation`) when an active lane executes them; the store is dropped and the load reads zeros. 32-bit image atomics through a table lower to `OpAtomic*` on the table `AtomicView` (`Device` scope, relaxed, `AcquireRelease`/`UniformMemory` barrier, as the direct path) instead of faulting; 64-bit atomics still fault (no `Atomic64View` on the table path).
 - An [image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) S# with a min or max reduction or FORCE_UNNORMALIZED faults when selected, as does an integer, converted or depth-bits table T# paired with a direct min or max S# that filters between texels.
 - Uint and Sint [image table](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvDescriptors.cpp) entries and direct T#s under a table S# sample through a point-filtered copy of the S#: Vulkan leaves linear filtering of integer formats undefined; the console is assumed to point-sample.
 - Comparison sampling of a color texture through an [image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) S# throws at the first dispatch or draw that binds it.
@@ -59,14 +69,16 @@
 - [MIMG BY2/BY4 loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_load[_mip]_by2/by4`, opcodes 0x42, 0x43, 0x4a and 0x4b) were measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md) for 2D images with identity swizzle. They read N texels (BY2: 2, BY4: 4) from `x & ~(N - 1)` on row y, texel by texel and component by component within each texel, with each texel converted like `image_load`. Every register is zero when the mip level is past the last level, `x + N - 1` is outside the level's width (unaligned x, unsigned), or y is outside its height. Data only comes back when the N texels fit in one dword: R8 and R16 (DMASK 0x3) or RG8 (0xf) for BY2, and R8 (0xf) for BY4. With 32-bit texels (R32, RG32, RG16, RGBA8) the hardware returns zeros. Other formats, masks, dimensions, swizzles, D16/A16 and indirect descriptors throw. The stores (0x52, 0x53, 0x5a and 0x5b) decode but throw at translation. Measured on hardware, they write from the unaligned x up to the end of its dword, which is not implemented.
 - [2D stores to 1D storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp): an `image_store` with DIM 2D through a 1D T# writes texel x and ignores y, as measured on RDNA2 (gfx1035) for y from 0 to 4 and 0xffffffff, single- and four-component formats and a 1x1 8_8_8_8_UNORM T#: the T# type decides the addressing, DIM only how many address VGPRs are read. Storage loads, atomics and `image_store_mip` through such a pair still throw
 - [MIMG PCK2/PCK4 loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_load[_mip]_pck2/pck4`, opcodes 0x70, 0x71, 0x73 and 0x74) were measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md) for 2D images with identity swizzle. With data mask 0x1, they write one dword: the raw bits of the N texels (PCK2: 2, PCK4: 4) from `x & ~(N - 1)` on row y, concatenated (element k at bit `k * texel bits`) and zero-extended. The dword is zero when the mip level is past the last level, `x + N - 1` is outside the level's width (unaligned x, unsigned), or y is outside its height. Data only comes back when N texels fit in 32 bits: R8, R16 or RG8 for PCK2, R8 for PCK4. Wider texels (R32, RG16, RGBA8) and masks other than 0x1 write zeros on hardware. Those masks throw at decode, and formats outside UNORM/UINT/SINT R8, R16 and RG8 throw. #1314's earlier measurement saw only zeros because it used masks 0x3 and 0xf. The stores (0x76, 0x77, 0x79 and 0x7a) decode but throw at translation. They are not measured, and opcode 0x76 on 32_32_32_32_FLOAT hung the GPU (#1314).
+- [`image_get_resinfo` through DIM 1D on a cube, 2D-array or 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follows thuanquang's measurement on RDNA2 (RX 6700 XT, gfx1031, #7550), not the PS5's gfx1013: width, height and the level count come from the T#, and the third component is the 3D T#'s depth, or 0 for a cube or 2D array, as for every DIM without layers (1D, 2D, 2D MSAA). Such a query on a 1D-array T# still reads it as its first layer, whose height is not measured. On a 2D MSAA or 2D MSAA-array T# it throws: gfx1031 was measured only with one fragment, which the driver cannot bind, and the level component for 2, 4 or 8 fragments is not measured.
 - [3D image accesses bound to a 2D or 2D-array T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follow CouchRiv's [hardware oracle](../HW_ORACLE.md) measurement on RDNA2 (gfx1036, #2023) and adriadam10's (gfx1035, #2140), not the PS5's gfx1013. On a 2D T#, `image_sample_lz` ignores r and reads the (u,v) texel, `image_load` and `image_load_mip` read the (x,y) texel when z is 0 and return zero otherwise, and `image_get_resinfo` returns (width, height, 1, levels). On a 2D-array T#, these accesses behave like dim 2D-array: r or z is the layer, and `image_get_resinfo` returns the layer count as its third component. Every other access of such an image, including samples with an LOD, bias, derivatives, offset or comparison, gathers, `image_get_lod` and stores, keeps throwing because it is not measured.
-- [2D-array samples through a 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) (`image_sample`, `image_sample_l` and `image_sample_lz` with DIM 2D_ARRAY) sample the volume as DIM 3D does: the third address VGPR is the normalized r coordinate, addressed by the sampler's Z mode (only wrap was measured), not a layer index, and a plain sample in a pixel shader takes its LOD from the derivatives of all three coordinates. Measured on RDNA2 (RX 6700 XT, gfx1031, driver 32.0.21045.5002, Windows 11) with the [hardware oracle](../HW_ORACLE.md) template run through the driver's comgr and HIP runtime, not on the PS5's gfx1013: on 16x16x4 R32_FLOAT 3D T#s with one and three levels, the three instructions with DIM 2D_ARRAY returned the same value as with DIM 3D in all 256 lanes of 66 cases (point, bilinear and z-linear filters, wrap addressing, r from -0.125 to 3, quad steps of 1 to 4 texels in u and v and of 0 to 4 slices in r, LOD 1). Other samples of such a pair (bias, LOD clamp, derivatives, offsets, comparison, 16-bit addresses), gathers, `image_get_lod` and a sample mixed with a load of the same image keep throwing because they are not measured. The host sampler ignores `Z_FILTER`, as for every 3D sample, so r is filtered with the XY filter.
+- [2D-array samples through a 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) (`image_sample`, `image_sample_l` and `image_sample_lz` with DIM 2D_ARRAY) are measured only on RDNA2 (gfx1031, [hardware oracle](../HW_ORACLE.md)), not on the PS5's gfx1013, and only with wrap addressing. They sample the volume as DIM 3D does: the third address VGPR is the normalized r coordinate, addressed by the S#'s `CLAMP_Z`, not a layer index. The host sampler ignores `Z_FILTER`, as for every 3D sample, so r is filtered with the XY filter. Other samples through such a pair (bias, LOD clamp, derivatives, offsets, comparison, `_a`, 16-bit addresses), gathers, `image_get_lod` and `image_get_resinfo` throw, as do the three samples of a T# selected from an image table, of a T# the program also loads with DIM 2D_ARRAY, and of an 11_11_10_UNORM, 11_11_10_UINT or depth-bits T#.
+- AMD image descriptors with `TYPE=0` are treated as null for [read-only image slots](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) even when the base and other words are nonzero: `image_load` on a gfx1035 with such a T# returns 0,0,0,0, and the same descriptors were seen in direct reads in PPSA01341 on an RTX 4070. Writable and atomic image slots and entries of an image table keep faulting because there is no hardware measurement for them, and the reserved types 2-7 also fault. `TYPE=1` is treated as null in the same read-only slots: gfx1035 reads it as zeros too, and gfx1010 returns zeros for `image_sample_lz`, `image_sample_b`, `image_load` and `image_get_resinfo` with format 22 (#5828); it is not measured on RDNA2, with other formats or with depth-compare reads (`image_sample_c*`). gfx1013 behavior is unverified
 - [2D accesses through a cube T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) (#4139) read the T#'s `BASE_ARRAY` face as a cube access with face coordinate 0 does, measured on RDNA1 (gfx1010, RX 5700 XT) with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime on 8x8 and 32x32 32_FLOAT cubes (`DEPTH` 5 and 11, `BASE_ARRAY` 0 and 6): `image_sample_lz`, plain `image_sample` (one level, and six levels in 2x2 compute quads) and `image_sample_l` (the third address VGPR is the LOD, integer and fractional) with DIM 2D equal DIM CUBE with face 0 on every row, with point and bilinear filters, wrap, clamp and mirror addressing and `DISABLE_CUBE_WRAP` 0 and 1, and the VGPR after the two coordinates is not read; `image_load` with DIM 2D reads texel (x, y) of the `BASE_ARRAY` face. So the face coordinates are cube coordinates in [1, 2]: the texel is `floor((u - 1) * width)`. They are translated through the cube mode DIM CUBE accesses use, which samples the face of the 2D-array view at (u - 1, v - 1) with the S# addressing. That matches the hardware inside the face, except within half a texel of its edges with a bilinear filter and `DISABLE_CUBE_WRAP` 0, where the hardware blends texels of the neighbouring faces (also measured on RDNA2, gfx1035, 8x8 cubes with `BASE_ARRAY` 0 and 6). Outside it the hardware clamps a coordinate below 1 to the first texel under every filter, wrap mode and `DISABLE_CUBE_WRAP` setting measured, clamps a coordinate of 2 or more to the last texel when `DISABLE_CUBE_WRAP` is 0 (point filter) and applies the S# addressing to it when it is 1; the translation does none of this, as for DIM CUBE. Only `image_sample_lz`, plain `image_sample`, `image_sample_l`, mip-less `image_load`, and mip-less `image_store` to an image the program only stores to take this mode. Such a store writes texel (x, y) of the `BASE_ARRAY` face, measured on RDNA2 (gfx1036, [by simonbbby](https://github.com/boykopovar/AnyPS5/pull/6799#issuecomment-6217609589), not the PS5's gfx1013) with the [hardware oracle](../HW_ORACLE.md) on 8x8 mip-less cube arrays (`DEPTH` 11) of 32_UINT, 32_FLOAT and 16_16_16_16_FLOAT ([the last also by simonbbby](https://github.com/boykopovar/AnyPS5/pull/6799#issuecomment-6224023050), with exactly representable half values) with `BASE_ARRAY` 0 and 6, wave32 and wave64: the 64 stored texels land on that face and every other byte of the 64 KiB backing is unchanged. Other formats, and Crimson Desert's own 256x256 tiled descriptor, are not measured. Other DIM 2D accesses through a cube T# (gathers, bias, comparison, offsets, derivatives, atomics, stores to an image the program also reads, stores of formats written through a conversion such as 32_SINT, mip loads and stores) still throw.
-- [Unnormalized S#s](../../../core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp) are accepted only when direct and used only by explicit-LOD `image_sample` without comparison, derivatives or `_a`, on a single-level, single-layer 1D or 2D view of mip 0, even when the image is also sampled through a normalized S#.
+- [Unnormalized S#s](../../../core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp) are accepted only when direct and used only by `image_sample` without comparison or `_a`, on a single-layer 1D or 2D view that is one level at mip 0 (even when the image is also sampled through a normalized S#), or that only unnormalized S#s sample, each without a mip filter or only by `image_sample_lz` without minimum LOD or bias.
 - [Unnormalized texel offsets](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) are added to the f32 coordinates: exact on RDNA2 (gfx1035), which applies the offset before the clamp ([measured by adriadam10](https://github.com/boykopovar/AnyPS5/pull/822#issuecomment-6033192725)).
 - [Cube image gradients](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (shader recompiler) - `image_sample_d` and `image_sample_cd` on a cube pass their gradients to the host sample without the -1.0 that moves the face coordinates from [1, 2] to [0, 1], as Mesa's AMD lowering builds them (`src/amd/common/nir/ac_nir_lower_tex_coords.c`, `prepare_cube_coords`: face-space derivatives with no offset, coordinates offset by 1.5). Measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md): on a 16x16 32_FLOAT cube with five levels, point mip filter, `image_sample_d` reads the level of `round(log2(16 * max(|ddx|, |ddy|)))` for gradients of 2^(level ± 0.3) texels on each of the four components, both signs, mixed components, every face and two coordinates (1032 rows). `image_sample_cd` takes one level per quad of lanes, from the gradients of its first lane; the host sample computes it per lane.
 - [Image atomics](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) on 32_SINT and 32_FLOAT surfaces act on the raw dword through an R32_UINT storage view. On gfx1100 (RDNA3, [hardware oracle](../HW_ORACLE.md), wave32 and wave64), all 13 integer image atomics, `swap` to `dec`, return the old dword and store the raw-dword result identically on 32_UINT, 32_SINT and 32_FLOAT T#s, over 121 old/data pairs per op, among them 0x80000000, 0xffffffff, 1.0, -1.0 and NaN: `add` adds the bits and `umin` is unsigned on every format. A 16_UINT control differs, so the format is read. gfx1031 (RDNA2) gives the same rows, and its `fmin`, `fmax` and `fcmpswap`, which gfx1100 lacks, also match on the three formats ([measured by thuanquang](https://github.com/boykopovar/AnyPS5/pull/7939#issuecomment-6275099482)). The console's gfx1013 is unmeasured. Other formats throw.
-- [`s_memtime`](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) on RADV with a GFX10.3 to GFX11.7 GPU (RDNA 2, RDNA 3, RDNA 3.5) reads the Vulkan device clock instead of the subgroup clock, which [ACO](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/compiler/instruction_selection/aco_select_nir_intrinsics.cpp) reads from the 20-bit `SHADER_CYCLES` register there and which wraps every 2^20 cycles. The device clock is a monotonic 64-bit counter, but it counts the 100 MHz reference clock (the same one as `s_memrealtime`), not shader cycles, so `s_memtime` deltas are about 20 times smaller than on hardware. The families are matched by the name RADV reports ([`NarrowSubgroupClock`](../../../core/libs/prx/libSceAgcDriver/Execution/src/SubgroupClock.cpp)); a family added to Mesa later reads the subgroup clock until it is listed. AMD's proprietary Windows driver also exposes a 20-bit subgroup clock on device 0x1114 (Radeon 860M, measured in #1615), device 0x744c (Radeon RX 7900 XT, measured in #1632), and device 0x747e (Radeon RX 7800 XT, measured in #1632); other AMD proprietary devices remain unverified.
+- [`s_memtime`](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) on RADV with a GFX10.3 to GFX11.7 GPU (RDNA 2, RDNA 3, RDNA 3.5) reads the Vulkan device clock instead of the subgroup clock, which [ACO](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/compiler/instruction_selection/aco_select_nir_intrinsics.cpp) reads from the 20-bit `SHADER_CYCLES` register there and which wraps every 2^20 cycles. The device clock is a monotonic 64-bit counter, but it counts the 100 MHz reference clock (the same one as `s_memrealtime`), not shader cycles, so `s_memtime` deltas are 22.35 times smaller than on a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title), where it counts the ~2.23 GHz core clock (44,041,632 against 1,970,792 `s_memrealtime` ticks). The families are matched by the name RADV reports ([`NarrowSubgroupClock`](../../../core/libs/prx/libSceAgcDriver/Execution/src/SubgroupClock.cpp)); a family added to Mesa later reads the subgroup clock until it is listed. AMD's proprietary Windows driver also exposes a 20-bit subgroup clock on device 0x1114 (Radeon 860M, measured in #1615), device 0x744c (Radeon RX 7900 XT, measured in #1632), and device 0x747e (Radeon RX 7800 XT, measured in #1632); other AMD proprietary devices remain unverified.
 - [`s_memtime` and `s_memrealtime`](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) on llvmpipe read only the low 32 bits of the host's nanosecond clock at either scope: Mesa's [`emit_clock`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/gallium/auxiliary/gallivm/lp_bld_nir_soa.c) builds the high dword with a left shift by 32, so it is always 0 and both counters wrap every 2^32 ns (about 4.3 s). The [shader clock test](../../../core/libs/prx/libSceAgcDriver/tests/execution/ShaderClock.cpp) compares them modulo 2^32 there
 - [`ds_wrxchg2_rtn_b32`, `ds_wrxchg2st64_rtn_b32`, `ds_wrxchg2_rtn_b64` and `ds_wrxchg2st64_rtn_b64`](../../../core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp) are translated as two separate 32-bit or 64-bit atomic swaps per invocation. RDNA2 hardware (measured on gfx1035) performs every lane's first exchange before any lane's second one, so when lanes of the same wave or of different waves overlap addresses, the result can differ from hardware. `offset0 == offset1` throws, although on hardware it is two exchanges in order.
 - [`ds_condxchg32_rtn_b64`](../../../core/shader/recompiler/Translation/src/MemoryInstructions/SharedMemoryInstructions.cpp) uses two 32-bit atomic conditional exchanges. RDNA2 (gfx1035) measurements confirmed aligned return values, conditional bit clearing and 16-bit offsets; out-of-range accesses return zero without modifying LDS. Misaligned accesses fault the wave on gfx1035; the recompiler does not model this fault. Radeon 780M (gfx1103, RDNA3) measurements confirmed aligned return values, conditional bit clearing, EXEC masking and operand overlap in wave32 and wave64; contended cases passed per-dword conservation checks. Contended lane ordering and gfx1013 remain unmeasured; pair-wide indivisibility is not assumed, and concurrent 64-bit LDS atomics use a separate lock. GDS throws. VGPR pairs extending beyond v255 throw; allocated-VGPR EXEC nullification is not emulated.
@@ -76,6 +88,7 @@
 - [Bindless image table](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) entries of 8_SRGB and 8_8_SRGB textures read zeros, like converted formats, on a device that cannot sample R8_SRGB or R8G8_SRGB.
 - [Shader MODE register access](../../../core/shader/recompiler/Translation/src/RoundingMode.cpp) starts from the rounding fields of `GuestContext::floatMode` and follows immediate rounding writes (`s_round_mode`, `s_setreg_imm32_b32` on MODE bits 0-3) through the control flow graph; `s_getreg_b32` of those bits returns the tracked value. Only `v_cvt_f32_i32`, `v_cvt_f32_u32`, `v_ldexp_f32`, the f16 conversions and `v_ldexp_f16` (with f16 denormals kept) and the instructions that already read `FLOAT_MODE` follow a rounding mode set at run time; any other float instruction that runs while a directed rounding mode differs from the initial one throws at that instruction. Rounding bits written from an SGPR (`s_setreg_b32`) or that differ between the paths reaching an instruction throw where they are read or used. A shader without `FLOAT_MODE` metadata throws on any rounding change. Non-rounding register reads still throw; `s_setreg_b32` writes to other hardware registers are still ignored. Tests follow the public RDNA2/LLVM contract, not console measurements.
 - [Flat scalar-read reachability](../../../core/shader/recompiler/Optimization/src/ResourceTracker.cpp) keeps both successors active for non-clean predicates and loop headers, so an inaccessible direct root on such a path still refuses capture. Skipping a read under a clean, evaluable scalar branch follows RDNA2 conditional PC semantics and synthetic fixtures; console execution and title behavior are unverified.
+- [v_cvt_pk_u8_f32](../../../core/shader/recompiler/Translation/src/ConvertInstructions.cpp) throws in f32 denormal modes 1 and 2 and with a directed round mode set at run time (see the previous entry); the PS5's gfx1013 is not measured. Otherwise it rounds its source in the `FLOAT_MODE` f32 round mode (ties to even, toward +infinity, -infinity or zero), clamps it to 0..255 (a NaN gives 0) and flushes a denormal source when f32 denormals are flushed. A kept positive denormal gives 1 toward +infinity, decided on the bits, as a driver without `DenormPreserve 32` may flush it. Measured on RDNA2 (gfx1030, RX 6800, AMD Windows driver 32.0.21045.5002) over 2,133 sources (k/8 for k = -16 to 2,099, values next to 0.5 and 255.5, ±1e10, denormals, infinities, NaNs) at IEEE 0 and 1, f32 denormal modes 0 and 3 and f32 round modes 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even, FP16_OVFL=0.
 - A [flat SRT read](../../../core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp) through a null or unmapped pointer loaded from memory raises a [BDA fault](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BdaResources.cpp) only if the program executes it, then stops or reads zero like a BDA read.
 - Repeated `s_load`s of one [flat SRT](../../../core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp) dword through a null or unmapped pointer report one of their pcs, and an `s_load` whose inaccessible dwords are all unused, or only address repeated loads, reports no fault of its own.
 - A value read through a null or unmapped pointer still throws at record time if a [uniform fill or table base](../../../core/shader/recompiler/Optimization/src/SrtWalker/SrtDescriptorEvaluation.cpp) needs it, or if the pointer comes from user data and is not null, even if the console skips the read.
@@ -84,7 +97,7 @@
 - [2D accesses through a 1D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) read the texel the 1D addressing selects and ignore the second coordinate, as simonbbby measured on RDNA2 (gfx1036) in #2237 for `image_sample_lz` and mip-less `image_load` with point filtering and wrap, clamp and border addressing; `image_sample_l` was measured the same way on gfx1036 against `image_sample_l` with DIM 1D through the same T#, for u inside, on and past the edges, v of 0, 0.5, 1, -0.25 and 3, LOD -1 to 6 on a 5-level R32_FLOAT texture, point, linear and linear-mip filtering, wrap, clamp and border addressing and HEIGHT or DEPTH 3: all 4725 rows matched. The PS5's gfx1013 is not measured. A plain `image_sample` (implicit LOD) through such a pair takes its LOD from the derivatives of the first coordinate alone, measured on RDNA2 (gfx1036) with the [hardware oracle](../HW_ORACLE.md) on the quads of a compute kernel (wave32 and wave64, IEEE off, DX10 clamp on, denormals preserved, round to nearest even): on a 16-texel, 5-mip 32_UINT T# with point filters it picks the same mip and texel as DIM 1D for first-coordinate steps of 0, 1, 2, 4 and 8 texels per lane along x or along y, whatever the second coordinate does (normalised steps up to 16 per lane), while the same rows on a 16x16 2D T# move the mip with the second coordinate. Outside the pixel stage a plain `image_sample` is emitted with LOD 0 for every image type, so this pair reads mip 0 there, where the kernel measurement shows the quad's derivatives being used. `image_sample_c_lz` and plain `image_sample_c` through such a pair compare against the texel the DIM 1D comparison with the same reference and first coordinate reads, measured on RDNA1 (gfx1010, RX 5700 XT) with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime (wave32 and wave64, IEEE off, DX10 clamp on, denormals preserved, round to nearest even): 8-texel 32_FLOAT and 16_UNORM T#s, also with HEIGHT 3, point and bilinear filters, wrap, clamp and opaque-white border addressing, less and gequal functions, second coordinates 0, 0.5, 1, 1.5, -0.25 and 3; on a 64-texel, 7-mip 32_FLOAT T# `image_sample_c` picks its LOD from the first coordinate's steps alone (1, 4 and 16 texels per lane give mips 0, 2 and 4; second-coordinate steps up to 64 texels leave it unchanged). Only comparisons the runtime does natively (32_FLOAT, 16_UNORM) reach the 1D view; comparisons the runtime emulates for other color formats still throw through such a pair. 2D-array `image_sample_l` and `image_sample_lz` through a 1D T# read as DIM 1D too, ignoring v and the slice: measured on gfx1036 with the hardware oracle (template assembled by the AMD Windows driver's `amd_comgr_2.dll` and launched through its `amdhip64_6.dll`) against the same sample with DIM 1D on a 16-texel 8_8_8_8 UNORM T# with 1 or 5 levels, HEIGHT or DEPTH 3, for u inside, on and past the edges, v of 0, 0.5, 1, -0.25 and 3, slices 0, 1, 2.7, -1 and 5, LOD -1 to 6, and the five filter and address cases above: all 48000 rows matched. A 2D-array `image_load` through a 1D T# is not the same: on gfx1036 it returns the DIM 1D texel only at slice 0, and zeros at slices 1, 2, 5 and -1 even with DEPTH 3, so it, the plain `image_sample` and the other 2D-array accesses still throw. Other 2D accesses through a 1D T# (storage, depth, packed, BY loads, mips other than explicit LOD, explicit LOD with comparison, bias, offsets, derivatives) still throw.
 - [3D image accesses bound to a 1D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follow a [hardware oracle](../HW_ORACLE.md) measurement on RDNA1 (RX 5700 XT, gfx1010; wave32 and wave64, IEEE off, DX10 clamp on, denormals preserved, round to nearest even), not the PS5's gfx1013, on 8x1 R8G8B8A8_UNORM linear 1D T#s with HEIGHT and DEPTH 0 or 3 and point filters. `image_sample_lz` reads the texel u selects for v and r in {0, 0.5, 1, 1.5, -0.25, 3}, with wrap, clamp and border addressing, and v and r never produce the border; u wraps, clamps and borders as with DIM 1D. Mip-less `image_load` reads the x texel for any y in {0, 1, 2, 3, -1} when z is 0, returns zero for z in {1, 2, 3, -1}, whatever DEPTH says, and returns zero for x past the width. A plain `image_sample` (implicit LOD) on the quads of a compute kernel takes its texel and LOD from u alone: on a 64-texel, 7-mip 1D T# steps of 1, 4 and 16 texels per lane pick mips 0, 2 and 4, as DIM 1D `image_sample_l` does, and steps in v or r alone stay at mip 0. Outside the pixel stage a plain `image_sample` is emitted with LOD 0, as for 2D accesses through a 1D T#. Every other 3D access of such an image (`image_load` with mips, storage, explicit LOD, bias, derivatives, offsets, comparison, gathers, queries) keeps throwing. SONIC SUPERSTARS (PPSA06888) samples a 1x1 1D T# this way with plain `image_sample` and `image_load`.
 - [Emulated comparison of a 2D-array access through a 2D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) samples the 2D image and ignores the slice, as the native modes of a 2D-array access through a 2D T# already do. This follows the T# type deciding the addressing; it is not measured on hardware for comparison samples
-- [Flat aperture bases](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (core/shader/recompiler) - the layout follows the gfx9+ one in the AMD KFD driver's `kfd_flat_memory.c` (`MAKE_LDS_APP_BASE_V9`, `MAKE_LDS_APP_LIMIT`): each aperture is a 4 GB window whose base is the high dword, so a flat address is routed by its whole high dword, as measured on RDNA2 (gfx1035: `src_shared_base` 0x00010000_00000000, `src_shared_limit` 0x00010000_ffffffff). The PS5's base values, high dwords 0x80000000 (shared, `SharedApertureHigh`) and 0x70000000 (private, `PrivateApertureHigh`), are inferred from PPSA04263's traversal addresses, not measured on a console or read from SH_MEM_BASES. The scalar aperture sources read the same two values
+- [Flat aperture bases](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (core/shader/recompiler) - the layout follows the gfx9+ one in the AMD KFD driver's `kfd_flat_memory.c` (`MAKE_LDS_APP_BASE_V9`, `MAKE_LDS_APP_LIMIT`): each aperture is a 4 GB window whose base is the high dword, so a flat address is routed by its whole high dword, as measured on RDNA2 (gfx1035). How the console routes a flat address was not measured. Its bases, high dwords 0x80000000 (shared, `SharedApertureHigh`) and 0x70000000 (private, `PrivateApertureHigh`), first inferred from PPSA04263's traversal addresses, are measured: on a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title) `src_shared_base` / `src_shared_limit` read 0x80000000_00000000 / 0x80000000_FFFFFFFF and `src_private_base` / `src_private_limit` 0x70000000_00000000 / 0x70000000_FFFFFFFF. The scalar aperture sources read the same two values
 - [Flat accesses outside the aperture routing](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (core/shader/recompiler) - only compute stages route flat accesses, so graphics-stage flat accesses to the shared or private aperture still go to BDA. In compute, a 64-bit flat atomic whose address is in the shared aperture takes the workgroup lock (`ldsLock`) for its two-dword update, and every such atomic requests that lock, so a shader with one pays for it even on global addresses (the path is exercised by `agc_driver_global_atomics_float`). Inferred, not measured on LDS or scratch: an aperture access that is not inside one dword is done byte by byte, an unaligned aperture atomic records the BDA unaligned fault, and LDS or scratch accesses past their end are dropped or read zero.
 - On a host subgroup narrower than 32 lanes, [`threadBit`](../../../core/shader/recompiler/Translation/src/TranslationContext/ExecMask.cpp) reads an EXEC written as a value (`s_mov_b32`/`s_mov_b64`) at bit (subgroup invocation id) of EXEC_LO, so lanes at or above the subgroup size read a lower lane's bit.
 - [EXEC read as a value](../../../core/shader/recompiler/Translation/src/TranslationContext/ExecMask.cpp) (`s_mov_b64 sN, exec`, the `s_*_saveexec` copy, ALU sources) is limited to host lanes. Pixel reads retain helper bits in quads with an active fragment, preserving whole-quad masks across copies. Quad expansion follows the [RDNA 2 ISA, section 12.3, S_WQM_B32/B64, page 111](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf#page=119); save/restore followed by implicit-LOD sampling is checked on an RX 6700 XT, not on a console. The console also holds lanes the host lacks, e.g. 32-63 of a wave64 on 32 host lanes.
@@ -95,16 +108,16 @@
 - [Mesh shader grid size](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - every mesh shader loads `NumWorkgroups.x` and declares no vertices when it is 0, which no dispatch produces. The read is a workaround for RADV (Mesa 26.2.4, seen on an RX 9070 XT, GFX12): binding a mesh pipeline whose shader reads neither `NumWorkgroups` nor `DrawIndex` keeps the user SGPR count and draw-id flag of the vertex pipeline bound before it in the same command buffer (`radv_bind_pre_rast_shader` updates them only when the shader has the `AC_UD_VS_BASE_VERTEX_START_INSTANCE` slot), so `radv_emit_userdata_mesh` opens a 3-register `SET_SH_REG` and writes one value, the CP takes the following `DISPATCH_MESH_DIRECT` as register data and the GPU hangs (gfx ring timeout, MODE1 reset). Kena: Bridge of Spirits (PPSA01802) hits it on its layered volume draws. Reading `NumWorkgroups` gives every mesh shader the grid-size slot, so the count and the values match; drop the read once a fixed Mesa is the minimum
 - [Mesh layer output](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - a mesh shader writes each primitive's layer through a one-member `Block` struct array whose member is decorated `BuiltIn Layer` and `PerPrimitiveEXT`, as glslang declares `gl_Layer` inside `gl_MeshPerPrimitiveEXT`, not through a standalone `PerPrimitiveEXT` `Layer` array. Both forms pass `spirv-val`, but AMD's Windows driver (32.0.21045.5002, RX 6700 XT) crashes in `amdvlk64.dll` creating a pipeline whose mesh shader writes the standalone form, whether the layer is signed or unsigned and whatever the target, while the block form draws, also with a pixel shader that reads the layer.
 - [Shader recompilation](../../../core/shader/recompiler/Recompiler.cpp) currently occurs right before it was transferred to Vulkan with caching, but should be moved to the [relinker](../../../core/relinker/main.cpp) stage. For this purpose, [shader/recompiler](../../../core/shader/recompiler) was written completely independently from [libs/prx](../../../core/libs/prx).
-- [v_interp_p1ll_f16, v_interp_p1lv_f16 and v_interp_p2_f16](../../../core/shader/recompiler/Translation/src/AttributeInstructions.cpp) read the 16-bit halves of each vertex's parameter through `VK_KHR_fragment_shader_barycentric`, as fixed-function interpolation cannot split a 32-bit attribute. Without the extension the pixel shader takes the [barycentric emulation](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), whose generated geometry stage passes each vertex's parameter to it as a flat input, so the halves arrive bit for bit; a device without geometry shaders takes the tessellation stages of the same emulation instead, which no 16-bit interpolation test has run through yet. P10 and P20 are the vertex differences rounded to f16 to nearest even, which is not confirmed on hardware. v_interp_p1ll_f16 and v_interp_p1lv_f16 round the exact `P10 * I + P0` once to f32 and v_interp_p2_f16 rounds the exact `P20 * J + S2` once to f16, as measured on RDNA2 (#697); the exact sums are computed in f64 or, on a device without the Float64 capability, in 64-bit integers: the exact product is added with a sticky bit and rounded once. They follow the shader's float mode, measured on RDNA2 (gfx1035) in all eight combinations of `IEEE_MODE` and kept/flushed f32 and f16 denormals over 768 special and 1,024 random rows. With IEEE=1 a NaN operand is returned quieted; with IEEE=0 it is returned unquieted, except that v_interp_p2_f16's f16 result is always quiet. Flushed f32 denormals flush I/J, v_interp_p2_f16's f32 S2 and the f32 result; flushed f16 denormals flush P0, P10/P20, v_interp_p1lv_f16's f16 S2 and the f16 result. Denormal modes 1 and 2 (flush only inputs or only outputs) and rounding other than to nearest even are not measured and throw. An unknown mode follows IEEE=0 with denormals kept. Lavapipe has no barycentrics, so the draw test is skipped in CI; `agc_driver_interpolation_modes` checks the integer arithmetic on every device, and the f64 arithmetic on devices with Float64. It checks both against the hardware rows in every mode, and against a CPU reference on random rows in every mode and f16 rounding.
-- Without `VK_KHR_fragment_shader_barycentric`, a pixel shader whose I/J VGPRs [only feed `v_interp_p1_f32`/`v_interp_p2_f32` of their own pair](../../../core/shader/recompiler/Optimization/src/HostInterpolationChecker.cpp) reads the attribute Vulkan interpolated. Any other read of them or of a raw vertex parameter takes the weights and the three vertex values from a [generated geometry stage](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), which needs `geometryShader` and a vertex shader before it. On a device with `tessellationShader` but no `geometryShader` (MoltenVK), a triangle list without primitive restart takes them from [generated tessellation stages](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp) instead: each triangle is one three-point patch at tessellation level 1, the evaluation stage writes the corner `gl_TessCoord` points at as the weights, and the vertex clip distances are forwarded: the control stage reads them as the separate `ClipDistance` array the vertex shader writes, so the vertex-to-control interfaces match, and passes them on inside its per-vertex block, which the evaluation stage reads and writes. MoltenVK 1.4.2 (SPIRV-Cross) cannot translate a separate `ClipDistance` array in a tessellation evaluation stage (`no member named 'gl_ClipDistance' in 'main0_out'`), so the two generated stages keep it in their blocks. A flat parameter takes the provoking vertex's value there, the first or with `PROVOKING_VTX_LAST` the last, and every corner of the patch writes it, so the host's own provoking vertex does not matter and `VK_EXT_provoking_vertex` is not needed; a flat per-vertex parameter with the last provoking vertex still throws. The patch keeps the triangle's facing with `VertexOrderCw`, checked with face culling on MoltenVK 1.4.2 (Apple M2) only. Tessellation, mesh and rect-list pipelines, primitives other than triangles, triangle strips and fans without `geometryShader`, more than 32 fragment input locations and interfaces beyond the device's geometry or tessellation limits throw.
-- [v_fma_f64 and v_div_fmas_f64](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp) with a subnormal operand or result round once, as IEEE 754 fusedMultiplyAdd does with f64 denormals kept, measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1, `v_div_fmas_f64` with VCC clear and set. The f16/f64 denormal field of `FLOAT_MODE` (bits 7:6) is not read: when it flushes, the hardware flushes the operands and the result of `v_fma_f64` (tininess before rounding) and only the result of `v_div_fmas_f64`, while these keep them. Shaders with f64 instructions declare `DenormPreserve` for 64-bit floats only when `shaderDenormPreserveFloat64` is true and Vulkan reports `denormBehaviorIndependence` as `ALL`; other independence modes are not handled by the current backend because they require coupled execution modes. See [VkShaderFloatControlsIndependence](https://docs.vulkan.org/refpages/latest/refpages/source/VkShaderFloatControlsIndependence.html). Elsewhere (including lavapipe), the driver may flush f64 subnormals, and `agc_driver_f64_fma_subnormals` is skipped.
-- [v_floor_f64, v_ceil_f64, v_fract_f64, v_frexp_mant_f64 and v_frexp_exp_i32_f64](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) follow the `FLOAT_MODE` f16/f64 denormal field: a denormal input is flushed to a zero of its sign when bit 0 is clear (0 and 2), and `v_fract_f64` flushes a denormal result, the fraction of a positive denormal input, to +0 when bit 1 is clear (0 and 1). `v_trunc_f64` and `v_rndne_f64` give the same results either way and are unchanged. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3 over 23 f64 values (zeros, denormals, minimum normals, ±0.5, ±1, values next to 1, the largest finite value, infinities and quiet and signaling NaNs) and 16 of them with neg and abs modifiers. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
+- [v_interp_p1ll_f16, v_interp_p1lv_f16 and v_interp_p2_f16](../../../core/shader/recompiler/Translation/src/AttributeInstructions.cpp) read the 16-bit halves of each vertex's parameter through `VK_KHR_fragment_shader_barycentric`, as fixed-function interpolation cannot split a 32-bit attribute. Without the extension the pixel shader takes the [barycentric emulation](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), whose generated geometry stage passes each vertex's parameter to it as a flat input, so the halves arrive bit for bit; a device without geometry shaders takes the tessellation stages of the same emulation instead, which no 16-bit interpolation test has run through yet. P10 and P20 are the vertex differences rounded to f16 to nearest even, which is not confirmed on hardware. v_interp_p1ll_f16 and v_interp_p1lv_f16 round the exact `P10 * I + P0` once to f32 and v_interp_p2_f16 rounds the exact `P20 * J + S2` once to f16, as measured on RDNA2 (#697); the exact sums are computed in f64 or, on a device without the Float64 capability, in 64-bit integers: the exact product is added with a sticky bit and rounded once. They follow the shader's float mode, measured on RDNA2 (gfx1035) in all eight combinations of `IEEE_MODE` and kept/flushed f32 and f16 denormals over 768 special and 1,024 random rows. With IEEE=1 a NaN operand is returned quieted; with IEEE=0 it is returned unquieted, except that v_interp_p2_f16's f16 result is always quiet. Flushed f32 denormals flush I/J, v_interp_p2_f16's f32 S2 and the f32 result; flushed f16 denormals flush P0, P10/P20, v_interp_p1lv_f16's f16 S2 and the f16 result. Denormal modes 1 and 2 (flush only inputs or only outputs) and rounding other than to nearest even are not measured and throw. An unknown mode follows IEEE=0 with denormals kept. `agc_driver_interpolation_modes` checks the integer arithmetic on every device, and the f64 arithmetic on devices with Float64. It checks both against the hardware rows in every mode, and against a CPU reference on random rows in every mode and f16 rounding.
+- Without `VK_KHR_fragment_shader_barycentric`, a pixel shader whose I/J VGPRs [only feed `v_interp_p1_f32`/`v_interp_p2_f32` of their own pair](../../../core/shader/recompiler/Optimization/src/HostInterpolationChecker.cpp) reads the attribute Vulkan interpolated. Any other read of them or of a raw vertex parameter takes the weights and the three vertex values from a [generated geometry stage](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp), which needs `geometryShader` and a vertex shader before it. On a device with `tessellationShader` but no `geometryShader` (MoltenVK), a triangle list without primitive restart takes them from [generated tessellation stages](../../../core/shader/recompiler/SpirvBackend/src/BarycentricGeometryShader.cpp) instead: each triangle is one three-point patch at tessellation level 1, the evaluation stage writes the corner `gl_TessCoord` points at as the weights, and the vertex clip distances are forwarded: the control stage reads them as the separate `ClipDistance` array the vertex shader writes, so the vertex-to-control interfaces match, and passes them on inside its per-vertex block, which the evaluation stage reads and writes. MoltenVK 1.4.2 (SPIRV-Cross) cannot translate a separate `ClipDistance` array in a tessellation evaluation stage (`no member named 'gl_ClipDistance' in 'main0_out'`), so the two generated stages keep it in their blocks. A flat parameter takes the provoking vertex's value there, the first or with `PROVOKING_VTX_LAST` the last, and every corner of the patch writes it, so the host's own provoking vertex does not matter and `VK_EXT_provoking_vertex` is not needed; a flat per-vertex parameter with the last provoking vertex still throws. The patch keeps the triangle's facing with `VertexOrderCw`, checked with face culling on MoltenVK 1.4.2 (Apple M2) only. A rect-list draw takes them from its own generated tessellation stages; its test passes on MoltenVK 1.4.2 (Apple M2), RADV (Radeon RX 7900 XT, Mesa 25.2.8), lavapipe, and on Windows on an RTX 3080 (NVIDIA 617.42) and Radeon RDNA 2 iGPUs (AMD 32.0.21045 and 32.0.21030); no title was run through it except Ruffle PPSA68091 on the M2. Tessellation and mesh pipelines, primitives other than triangles, triangle fans and primitive restart without `geometryShader`, more than 32 fragment input locations and interfaces beyond the device's geometry or tessellation limits throw.
+- [v_fma_f64 and v_div_fmas_f64](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterFloat64.cpp) with a subnormal operand or result round once, as IEEE 754 fusedMultiplyAdd does with f64 denormals kept, measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1, `v_div_fmas_f64` with VCC clear and set. The f16/f64 denormal field of `FLOAT_MODE` (bits 7:6) is not read: when it flushes, the hardware flushes the operands and the result of `v_fma_f64` (tininess before rounding) and only the result of `v_div_fmas_f64`, while these keep them. Shaders with f64 instructions declare `DenormPreserve` for 64-bit floats only when `shaderDenormPreserveFloat64` is true and Vulkan reports `denormBehaviorIndependence` as `ALL`; other independence modes are not handled by the current backend because they require coupled execution modes. See [VkShaderFloatControlsIndependence](https://docs.vulkan.org/refpages/latest/refpages/source/VkShaderFloatControlsIndependence.html). Elsewhere the driver may flush f64 subnormals, and `agc_driver_f64_fma_subnormals` skips if it does.
+- [v_floor_f64, v_ceil_f64, v_fract_f64, v_frexp_mant_f64 and v_frexp_exp_i32_f64](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) follow the `FLOAT_MODE` f16/f64 denormal field: a denormal input is flushed to a zero of its sign when bit 0 is clear (0 and 2), and `v_fract_f64` flushes a denormal result, the fraction of a positive denormal input, to +0 when bit 1 is clear (0 and 1). `v_trunc_f64` and `v_rndne_f64` give the same results either way and are unchanged. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3 over 23 f64 values (zeros, denormals, minimum normals, ±0.5, ±1, values next to 1, the largest finite value, infinities and quiet and signaling NaNs), and with neg and abs modifiers over 16 values (13 of those, -1.5, 2.75 and 1 - 2^-53). Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
 - [v_add_f64 and v_mul_f64 denormals](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) follow the `FLOAT_MODE` f16/f64 denormal field; the PS5's gfx1013 is not measured. Inputs flush to a zero of their sign when bit 0 is clear (0 and 2). When bit 1 is clear (0 and 1), a sum below 2^-1022, or a product whose exact value rounded to 53 significant bits with an unbounded exponent is below 2^-1022, flushes to a zero of its sign, so `0x2000000000000001 * 0x1ffffffffffffffe` (exactly 2^-1022 - 2^-1126) rounds to 2^-1022 and is kept. Measured on RDNA2 (gfx1031, RX 6700 XT, AMD Windows driver 32.0.21045.5002, HIP) at IEEE=0 and 1, denorm16 0..3, over 576 pairs of 24 f64 values (zeros, denormals, minimum normals, values next to 1 and to 2^-1022, products just below 2^-1022, the largest finite value, infinities), with neg, abs and clamp. `v_fma_f64`, `v_div_fmas_f64` and shaders without a known float mode keep the previous lowering.
 - [SINT storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) of 8- and 16-bit components saturate each stored 32-bit value to the component range, as adriadam10 measured for image stores on RDNA2 (gfx1035) in #944 (448 rows match); the PS5's gfx1013 is not measured. A D16 store sign-extends each 16-bit half before that saturation, as measured on RDNA2 (gfx1035) for `image_store d16` to all eight SINT formats with DMASK 0xf, 0x7, 0x5, 0x3, 0x2, 0xa and 0x1 (1792 rows match).
 - [`StoreTexel`](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) writes channel 1 of a two-channel format from the data slot whose DST_SEL is Y, for SINT and UINT alike. With DST_SEL X,Y,Z,W, gfx1035 writes it from the W slot, as adriadam10 measured in #944.
 - [v_ldexp_f16](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f16 denormal field: bit 0 preserves the half input and bit 1 the half result. Otherwise a denormal input is flushed to its signed zero, and a result whose exact scaled value is below the minimum normal (2^-14) is flushed to its signed zero before rounding, so `v_ldexp_f16 0x07ff, -1` gives +0 instead of 0x0400. Measured on RDNA2 (gfx1036) with round to nearest, IEEE 0 and 1 and denorm16 0..3, over every half magnitude 0x0000..0x0fff of both signs scaled by 2^-1 and 2^0 (16384 rows per mode): no mismatch. NaN and infinity handling and destination high-half preservation are unchanged. Shaders without a known float mode keep the previous lowering.
 - [v_div_fixup_f64](../../../core/shader/recompiler/Translation/src/Float64Instructions.cpp) flushes its src1 and src2 to a zero of the same sign when bit 0 of the `FLOAT_MODE` f16/f64 denormal field is clear (0 and 2) and keeps a denormal src0 and result in every mode, as `v_div_fixup_f32` does with the f32 field. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) over 1728 triples of 12 f64 values (zeros, denormals, the minimum normal, ±1, the largest finite value, infinity and quiet and signaling NaNs) at IEEE=0 and IEEE=1 with denorm16 0..3. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
-- [v_mullit_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the hardware measured with the MODE register at IEEE=1 and denormals kept (a signaling NaN src0 is quieted only with IEEE=1, as measured at IEEE=0 too; a positive denormal src2 counts as positive); with f32 denormals flushed it follows the f32 denormals entry below, and denormal modes 1 and 2 throw.
+- [v_mullit_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the hardware measured with the MODE register at IEEE=1 and denormals kept (a signaling NaN src0 is quieted only with IEEE=1, as measured at IEEE=0 too; a positive denormal src2 counts as positive); with f32 denormals flushed it follows the f32 denormals entry below. Denormal mode 2 flushes only the sources, and mode 1 only the result: a result below 2^-126 after rounding becomes a zero of its sign, also when a preserved denormal source produced it. Measured on RDNA2 (gfx1030) over 13,824 operand sets, and 1,632 with an inline or literal constant factor, in all four modes at IEEE=0 and IEEE=1 with f32 round to nearest even. Modes 1 and 2 throw when the module cannot declare `DenormPreserve 32` (no `shaderDenormPreserveFloat32`, or the hardware f32 flush in use), and mode 1 also with another f32 rounding.
 - [v_mad_legacy_f32 and v_mac_legacy_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (VOP3 0x140, VOP2 0x06) round the product to f32 before the add, give a +0 product for a zero factor, and flush their f32 denormal sources, their product and their result to a zero of the same sign in every f32 denormal mode, an exception to the `FLOAT_MODE` model in [f32DenormalFlushFor](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp). Measured on gfx1010 (RX 5700 XT) with `tools/hw-oracle/template.s`, assembled by the AMD Windows driver's `amd_comgr_2.dll` and launched through its `amdhip64_6.dll` instead of `oracle.c` and ROCr, over the 32 rows of the five `FmaLegacy.cpp` and the four `MacLegacy.cpp` encodings: identical in wave32 and wave64 at IEEE 0 and 1 with f32 denormal modes 0 to 3, except that the two signaling NaN rows are quieted only with IEEE=1 (#1281, #1290). A sum of two zeros takes its sign on the bits (+0 unless both are -0), as lavapipe returned -0 for +0 + -0. The PS5's gfx1013 is not measured; LLVM decodes the encoding as `v_mad_legacy_f32` there, as on gfx1010. RDNA2 differs: on gfx1031 (RX 6700 XT, measured by pandather in #1281) the encoding is `v_fma_legacy_f32` and fused, with the same zero rule and denormal-source flush, so an RDNA2 measurement is not evidence for the console.
 - [v_mad_f32, v_mac_f32, v_madak_f32 and v_madmk_f32](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (gfx10.1 only) leave f32 denormals and NaN bits to the driver, unlike the console. Measured on gfx1010 (RX 5700 XT, #5782): the product is rounded before the add; f32 sources, product and result are flushed to a zero of the same sign in every f32 denormal mode; the product is flushed when tiny after rounding to 24 bits with an unbounded exponent; NaN results follow the fma rule, an invalid product beating a NaN src2; in round mode 2 a sum of zeros of opposite signs is -0. Translating this cost 15× `main` on a `v_mac_f32` chain on the RX 5700 XT and 23× on an RTX 3070, and a never-taken branch around it 6×, so it waits for the SPIR-V float controls of #981.
 - [v_fma_mixlo_f16 and v_fma_mixhi_f16](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) round the exact product-sum once to f16 with the arithmetic of v_interp_p2_f16, in f64 or, without the Float64 capability, in 64-bit integers. On RDNA2 (gfx1036) they follow the `FLOAT_MODE` f16 round and denormal fields, not the f32 round field: -1.5 * 2^-24 + 2^-126 from f32 sources (0xbfc00000, 0x33800000, 0x00800000) gives 0x8001 with f16 denormals kept and round to nearest even, 0x8000 with f16 denormals flushed and 0x8002 with f16 round toward -infinity. With f16 denormals kept, every f16 rounding mode is translated: the exact product-sum is rounded once in the mode's direction. All four modes match RDNA2 (gfx1036) on the 2,233 rows of the #2631 sweep, including `FLOAT_MODE` 0xcc (toward zero, used by ps5-opengl) and the exact cancellations toward -infinity; the PS5's gfx1013 is not measured. A result beyond 65504 becomes infinity or 65504 as IEEE 754 gives for the mode. Flushed f16 denormals still throw, and packed f16 throws with any f16 rounding but nearest even. `FP16_OVFL` set is not measured.
@@ -113,10 +126,14 @@
 - [f16 unary, frexp and conversion denormals](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follow the `FLOAT_MODE` f16 denormal field: `v_ceil_f16`, `v_floor_f16`, `v_fract_f16`, `v_rcp_f16`, `v_rsq_f16`, `v_sqrt_f16`, `v_log_f16`, `v_exp_f16`, `v_sin_f16`, `v_frexp_mant_f16`, `v_frexp_exp_i16_f16`, `v_cvt_norm_i16_f16`, `v_cvt_norm_u16_f16` and `v_cvt_f32_f16` flush a denormal half input to its signed zero when bit 0 is clear (0 and 2), and the f16-result ones flush a denormal half result to its signed zero when bit 1 is clear (0 and 1), after the host rounds it to half. Measured on RDNA2 (gfx1036) at IEEE=0 and IEEE=1 with denorm16 0..3 over every non-NaN f16 input (63,490 rows per mode and instruction): the only mismatches are the 1-ULP driver differences of `v_exp_f16` (2 inputs) and `v_sin_f16` (14), which are the same with denormals kept. NaN inputs are not compared. `v_ldexp_f16` shares the input rule. `v_cvt_pknorm_i16_f16` and `v_cvt_pknorm_u16_f16` flush both half inputs by the same bit, measured on RDNA2 (gfx1030) over every f16 input (each half also negated in the other source) at IEEE=0 and IEEE=1 with denorm16 0..3 and at f16 rounding 1..3: every row matches. Shaders without a known float mode keep the previous lowering.
 - [v_div_fixup_f16](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) flushes its src1 and src2 to a zero of the same sign when bit 0 of the `FLOAT_MODE` f16 denormal field is clear (0 and 2) and keeps a denormal src0 and result in every mode, as `v_div_fixup_f32` does with the f32 field. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) over 6859 triples of 19 halves (zeros, denormals, minimum normals, ±0.5, ±1, the largest finite value, infinities and quiet and signaling NaNs) at IEEE=0 and IEEE=1 with denorm16 0..3 and FP16_OVFL 0 and 1, also with neg and abs source modifiers and with op_sel high halves. Shaders without a known float mode keep the previous lowering. The PS5's gfx1013 is not measured.
 - [Packed f16 NaN results](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (`v_pk_add/mul/fma/min/max_f16`) follow the hardware measured on RDNA2 (gfx1035) at IEEE=0 and IEEE=1 with f16 round-to-nearest-even and f16 denormals kept: with IEEE=1 a signaling NaN input is quieted and min/max return the other operand only for a quiet NaN; with IEEE=0 NaN inputs pass through unquieted and min/max ignore signaling. In `v_pk_fma_f16` an invalid product (inf * 0) gives the default NaN even when src2 is a NaN. A shader without a known float mode is translated as IEEE=0, the mode titles use; a mode with another f16 rounding throws. In the f16 denormal modes that flush, each denormal input lane is flushed to a zero of its sign when bit 0 of the field is clear (0 and 2), so `inf * 0x0001` is an invalid product there, and when bit 1 is clear (0 and 1) a `v_pk_add_f16` result below 2^-14, or a `v_pk_mul_f16`, `v_pk_fma_f16` or `v_pk_fmac_f16` result whose exact value rounded to 11 significant bits with an unbounded exponent is below 2^-14, is flushed to a zero of its sign; `v_pk_min/max_f16` flush only their inputs. The native f16x2 add and multiply is not used while results are flushed. Measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with denorm16 0..3, over 19,192 to 162,204 lanes per instruction with op_sel, op_sel_hi, neg_lo, neg_hi and clamp variants and products and sums at the 2^-14 boundary.
-- [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` flush both operands by the field, see the LDS float atomics entry. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device.
+- [f32 denormals](../../../core/shader/recompiler/Translation/src/TranslationContext/OperandAccess.cpp) follow the shader's `FLOAT_MODE` f32 denormal field (bits 5:4) when it flushes them (0, and shaders without a known float mode, as in the 0xc0 most titles use), measured on RDNA2 (gfx1035) over 1444 rows per instruction at IEEE=0 and IEEE=1. `v_add/sub/subrev/mul/mul_legacy/mullit/fma/fmac/fmamk/fmaak/min/max/min3/max3/med3/fract/floor/ceil/frexp_mant/sin/cos_f32` flush their f32 inputs and their result to a zero of the same sign (`v_mullit_f32` measured on RDNA2 (gfx1036) over 6907 rows per mode at IEEE=0 and IEEE=1, so a positive denormal src2 counts as zero); the f32 compares, `v_cvt_i32/u32/rpi_i32/flr_i32_f32`, `v_frexp_exp_i32_f32`, `v_cvt_f64_f32`, `v_cvt_f16_f32`, `v_cvt_pkrtz_f16_f32`, `v_cvt_pknorm_i16/u16_f32` and `v_cvt_pk_u8_f32` flush their f32 inputs. `v_div_scale_f32` flushes all three inputs to signed zeros, measured on RDNA2 (gfx1036) over 2744 operand triples per mode at IEEE=0 and IEEE=1 with f32 denormals flushed and kept; its scale-down behaviour and host denormal preservation remain incomplete. `v_div_fixup_f32` flushes its src1 and src2 and keeps a denormal src0 and result, measured on RDNA2 (gfx1036) over 6859 rows per mode at IEEE=0 and IEEE=1. Tininess is detected after rounding, measured on RDNA2 (gfx1036) for `v_mul_f32` and `v_mullit_f32` at IEEE=0 and IEEE=1: a product is flushed when its value rounded to 24 bits with an unbounded exponent is below 2^-126, so `0x3f7ffffe * 0x00800001` (2^-126 * (1 - 2^-46)) gives `0x00800000` and `0x3f7fffff * 0x00800000` (2^-126 * (1 - 2^-24)) gives zero. The check rounds in the f32 round mode of `FLOAT_MODE` (bits 1:0), measured in all four modes, while the products themselves are still rounded to nearest even. This applies to `v_mul_f32`, `v_mul_legacy_f32`, `v_mullit_f32`, and to `v_fma_f32`, `v_fmac_f32`, `v_fmamk_f32`, `v_fmaak_f32` and `v_fma_mix_f32` when the addend is zero; with a nonzero addend the fused result is kept, so an exact result just below 2^-126 that rounds to it is not flushed. In the three directed modes the check is computed exactly from the significands. To nearest even (0, the mode of shaders without a known float mode) one factor is multiplied by 2^64, which is exact below 2^64, and the product with the other factor is compared with 2^-62. That multiply is a plain `OpFMul` like the product, and no f32 rounding mode is requested in the SPIR-V, so the check relies on the driver rounding f32 to nearest even by default, as the products do, and a product that rounds up to 2^-126 is the emitted product. `v_fma_mix_f32` follows this rule with mixed f16/f32 sources too, measured on RDNA2 (gfx1036) with f16 in either multiplicand slot, low and high half selection, and an f32 or f16 zero addend: f32 `0x00801002` times f16 `0x3bff` gives `0x00800000` to nearest at IEEE=0 and IEEE=1, while the neighbours `0x00801001` and `0x00801003` give zero and `0x00800001`. The tiny-product boundary was also measured for both signs in all four f32 round modes at IEEE=0; Its f16 sources are flushed to a zero of their sign when bit 0 of the f16/f64 denormal field is clear (0 and 2), whatever the f32 field, measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) at IEEE=0 and IEEE=1 with f32 denormal modes 0 and 3 and f16 denormal modes 0 to 3, over 2744 triples of 14 halves with all three sources f16 and 1960 rows with an f32 multiplicand. `v_fma_mixlo_f16` and `v_fma_mixhi_f16` flush their f32 sources too and keep a product below 2^-126, measured on RDNA2 (gfx1036). `v_mad_legacy_f32` and `v_mac_legacy_f32` flush their inputs, their product and their result in every mode, see its entry; their product is still checked for tininess on its exact value, so one below 2^-126 gives zero even when it rounds to 2^-126, as the console's separately rounded encoding is not measured at this boundary. Denormal modes 1 and 2 throw for the other instructions except the f32 compares. Not covered, and not measurable on RDNA2 (no such opcodes) or not measured: `v_mac_f32`, `v_mad_f32`, `v_madak_f32` and `v_madmk_f32` (rounded separately), `v_dot2_f32_f16` and `v_div_fmas_f32` (on hardware `v_div_fmas_f32` flushes only its result), f32 interpolation and `ds_add_f32` keep the previous lowering; `ds_min/max/cmpst_f32` and the image, buffer, global and flat `fmin/fmax/fcmpswap` flush both operands by the field, see the float atomics entries. With f32 denormals kept (3) the results depend on the driver's default denormal behaviour, as no `DenormPreserve` execution mode is requested; `v_ldexp_f32` and the f32 compares are the exceptions. `v_cmp_X_f32` and `v_cmpx_X_f32` compare the operands as sign-magnitude integers with the NaN cases handled apart, so a denormal is not read as zero, measured on RDNA2 (gfx1036) over 256 operand pairs per opcode at IEEE=0 and IEEE=1 with f32 denormals kept and flushed. `v_ldexp_f32` preserves subnormal inputs and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, measured on RDNA2 (gfx1036) over 2163 rows in each of the four round modes at IEEE=0 and IEEE=1. An overflow rounds like any other result (infinity, or the largest finite value when the mode rounds that sign toward zero). With f32 denormals flushed it flushes a subnormal input and result, measured over the same rows in each round mode at IEEE=0 only. A device whose driver splits `Fma` into a multiply and an add flushes a product below 2^-126 before adding a non-zero addend in `v_fma_f32` and `v_fmac_f32`: `0x1fffffff * 0x1fffffff + 0x00800000` gives `0x00800000` instead of the fused `0x00ffffff` on RADV RENOIR (Mesa 26.2.4), whose compiled shader has `v_mad_f32` and no `v_fma_f32`. [F32DenormalFlush](../../../core/libs/prx/libSceAgcDriver/tests/execution/F32DenormalFlush.cpp) accepts that sum on such a device.
 - [v_rcp, v_rsq, v_sqrt, v_log, v_exp, v_sin and v_cos](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) (f32 and f16) use the driver's approximation for finite results, not the console's: the low bits can differ. Only NaN, invalid, zero and infinite results and the exact sin/cos zeros are chosen on the bits. Measured on RDNA2 (gfx1036) over every f16 input and 32,832 f32 inputs: RADV returns the hardware's bits for every input of rcp, rsq, sqrt and log and all but one of exp (f16 0x11c5, 1 ULP); NVIDIA (615.71.09) stays within 2 ULP except `v_log_f32` near 1.0 (next entry). [v_sin and v_cos](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) take the driver's sine or cosine of the radians of the exact cycle, except within 2^-12 of a turn from a zero of the function, where the result is the linear term of the exact distance to the zero: the hardware's constant 6.2831826 (0x40c90fd5) at the integers, which the hardware applies exactly to inputs below 2^-12 of a turn, and the f32 2π at the half and quarter turns, where the hardware is within 7 ULP of it. Outside those bands, a driver result more than 4 ULP from a Taylor series in turns of the exact cycle is replaced by the series, which is within 2 ULP of the true sine and cosine; the hardware is up to 9 ULP from them (gfx1035, 243,092 f32 inputs), so results stay within 13 ULP of the hardware on any driver. RADV returns the hardware's bits for every f16 input and for 32,422 sine and 32,486 cosine results of the 32,832 f32 inputs; the rest are 1 ULP off, except up to 14 ULP on either side of non-zero integers and up to 15 ULP beyond ±256 cycles, where the hardware's own reduction differs from the exact fraction, and up to 6 ULP inside the half- and quarter-turn bands. NVIDIA's own sine is within 1 ULP on 93% of the f32 inputs and up to 1,166 ULP off just outside the bands, its cosine within 163 ULP; the series replaces those results. A denormal f32 input with f32 denormals kept gives the hardware the input times 6.2831826; both hosts flush it.
+- [v_rcp_f32 and v_rcp_iflag_f32 with `APS5_EXACT_RCP`](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterReciprocal.cpp) return the hardware reciprocal for normal inputs with normal results: a cubic over 32 mantissa segments, the linear term rounded to nearest even, plus 2,761 one-ULP corrections. It matches all 2^23 mantissas of an RDNA2 (gfx1031) sweep; inputs or results that are not normal keep the driver's 1/x. It is off by default because the coefficient and correction tables add about 13k SPIR-V words to each shader that uses it. The switch also reaches v_rcp_f16 (rounded from the f32 reciprocal) and the pixel shader's position W input.
 - [v_ldexp_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/FloatInstructions.cpp) follows the `FLOAT_MODE` f32 denormal field: mode 1 keeps a subnormal input and flushes a result below 2^-126 to a zero of its sign in every f32 round mode, also one that rounds to 2^-126 at subnormal precision (`0x3fffffff` scaled by 2^-127); mode 2 flushes a subnormal input to a zero of its sign and rounds a subnormal result in the f32 round mode of `FLOAT_MODE`, as mode 3 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 10,260 rows (54 inputs of both signs: zeros, subnormals, normals near 2^-126 and 1.0, the largest finite value, infinities and NaNs, each scaled by 190 exponents from -2^31 to 2^31-1) at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3 and f32 round mode 0 to 3, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0; with the `clamp` modifier the result is clamped as in the other modes. The PS5's gfx1013 is not measured.
+- [32-bit denormal execution mode](../../../core/shader/recompiler/Recompiler.cpp) (shader recompiler) - the hardware f32 flush that the startup probe chooses (`DenormFlushToZero 32`) is declared only in shaders whose `FLOAT_MODE` flushes f32 denormals (field 0, or no known float mode). A shader that keeps them on either side (field 1, 2 or 3) declares `DenormPreserve 32` when the device has `shaderDenormPreserveFloat32` with a `denormBehaviorIndependence` other than NONE; on other devices it gets the driver's default f32 denormal handling, which flushes the denormals it keeps on MoltenVK.
 - [v_log_f32 and v_log_f16](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) keep the driver's log2 unless, for inputs within 1/8 of 1.0, it is more than 4 ULP from an eight-term series in x - 1, which then replaces it. `v_log_f16` goes through the same f32 lowering and is rounded to half. The series is evaluated for every `v_log` and chosen with `OpSelect` rather than a branch, so its seven fused multiply-adds and two multiplies are an unconditional cost. Measured on RDNA2 over all 3,145,728 f32 inputs within 1/8 of 1.0 (gfx1035, IEEE 0, f32 denormals flushed), the hardware is within 1 ULP of the correctly rounded log2 and the series within 2 ULP of it and within 3 ULP of the hardware (2 except at 0x3f752e47, 0x3f7baab0 and 0x3f7bc4fb), so a kept driver value is within 7 ULP of the hardware and a driver that returns the hardware's bits never triggers the gate; RADV (Mesa 26.2.4) returns the hardware's bits on the 9,280 such inputs measured on gfx1036; NVIDIA (615.71.09) was up to 23,947,836 ULP off at 1 - 2^-24 and is within 6 ULP inside the band after the change; outside it its own log2 stays up to 9 ULP off (measured up to 1.375). Over every f16 input, the change moves one `v_log_f16` result on NVIDIA (0x3bed, 1 ULP, onto the hardware's bits) and none on RADV.
+- [v_add_f32, v_sub_f32, v_subrev_f32, v_mul_f32 and v_mul_legacy_f32 in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) throw with a directed f32 round mode, as the host rounds these sums and products to nearest even (a difference that modes 0 and 3 also have then), and when the module cannot declare `DenormPreserve 32` (no `shaderDenormPreserveFloat32`, or the hardware f32 flush in use); the PS5's gfx1013 is not measured. Otherwise mode 1 keeps denormal inputs and flushes a result below 2^-126 to a zero of its sign (a product only when it stays below 2^-126 after rounding to 24 bits with an unbounded exponent), and mode 2 flushes denormal inputs and keeps a denormal result. Measured on RDNA2 (gfx1030, RX 6800) over 1,296 operand pairs, 896 products around 2^-126 and 1,632 with a constant factor, at IEEE 0 and 1 in every f32 denormal mode, with DX10_CLAMP=1, f16 denormals kept and FP16_OVFL=0.
+- [f32 min and max in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) (`v_min_f32`, `v_max_f32`, `v_min3_f32`, `v_max3_f32`, `v_med3_f32`) throw in mode 1 when the module cannot declare `DenormPreserve 32` (no `shaderDenormPreserveFloat32`, or the hardware f32 flush in use), and mode 3 keeps depending on the driver there; the PS5's gfx1013 is not measured. They follow only bit 0 of the `FLOAT_MODE` f32 denormal field: mode 2 flushes denormal inputs to zeros of their sign as mode 0 does, and mode 1 keeps them and returns a selected denormal unflushed as mode 3 does. Measured on RDNA2 (gfx1030, RX 6800) over the 2,744 operand triples of ±0, ±2^-149, ±0x007fffff, ±2^-126, ±1, ±infinity, a quiet and a signaling NaN at IEEE 0 and 1 in each f32 denormal mode, round to nearest even, DX10_CLAMP=1, f16 denormals kept, FP16_OVFL=0: modes 1 and 3 give identical results, and so do modes 2 and 0.
 - [Ordered not-equal, less-than and greater-than compares](../../../core/shader/recompiler/SpirvBackend/src/SpirvAlu/SpirvAluEmitterMath.cpp) (shader recompiler) - `FPOrdNotEqual32` is emitted as `OpFUnordNotEqual`, and `FPOrdLessThan32` and `FPOrdGreaterThan32` as their ordered forms, each with both operands checked for NaN on their bits; the results are the same for every input. The AMD Windows driver 32.0.13058.8001 (Radeon 860M, RDNA 3.5) returns 1 for a NaN operand when any float form of not-equal feeds a ballot on a 32-wide subgroup (#825), and so does a less-than or greater-than against an infinity the driver sees as a constant (#3536), presumably rewritten into a not-equal by its compiler
 - [16-bit integer multiplies](../../../core/shader/recompiler/Translation/src/IntegerInstructions.cpp) (`v_mul_lo_u16`, `v_pk_mul_lo_u16`) (shader recompiler) - a factor taken from the low half of its source is read as the low 24 bits of the register, not the low 16; the low 16 bits of the product are the same for every input. The AMD Windows driver 32.0.21045.5002 (RX 6700 XT, RDNA 2) stores the full 32-bit product when two values it knows fit in 16 bits are multiplied, the product is reduced to 16 bits and nothing else is merged into the stored value: `v_mul_lo_u16` into a register whose high half is zero, also with factors masked to 16 bits by the program, and `v_pk_mul_lo_u16` whose high lanes are zero wrote 0xfffe0001 for 0xffff * 0xffff where the GPU writes 0x00000001. Reducing the product with `v_and_b32`, `v_bfe_u32` or a shift pair loses the same bits; factors read as 24-bit fields do not. The [constant folder](../../../core/shader/recompiler/Optimization/src/ConstantFolder.cpp) keeps a field read that a multiply uses, even when the program already masked the factor to 16 bits, since folding it away brings the full product back (#8271). Measured against the same instructions run through the [hardware oracle](../HW_ORACLE.md) on that GPU; other drivers are not checked
 - [f32 compares in denormal modes 1 and 2](../../../core/shader/recompiler/Translation/src/VectorInstructions.cpp) (`v_cmp_X_f32` and `v_cmpx_X_f32` with X = eq, ge, gt, le, lg, lt, neq, nge, ngt, nle, nlg, nlt) flush their f32 denormal inputs by bit 0 of the `FLOAT_MODE` f32 denormal field: mode 1 keeps them as mode 3 does, and mode 2 flushes them as mode 0 does. Measured on RDNA2 (gfx1030, Radeon RX 6800, AMD Windows driver 32.0.21045.5002 through HIP) over 484 operand pairs of zeros, denormals, minimum normals, ones, the largest finite value, infinities and quiet and signaling NaNs of both signs, in VOPC form, at IEEE=0 and IEEE=1 with each f32 denormal mode 0 to 3, f32 round to nearest even, DX10_CLAMP=1, f16 denormals kept, f16 round to nearest even and FP16_OVFL=0. The PS5's gfx1013 is not measured.
@@ -142,12 +159,13 @@
 - [Comparison sampling of a color texture](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_sample_c`/`image_sample_c_lz` on a texture that is not R32 float or R16 unorm) returns 0 for every comparison function on formats AnyPS5 can sample as floating-point measured on GFX10 (codes 1–77 except native comparison codes 7 and 22) and on the corresponding GFX11 formats measured on gfx1100. The current Vulkan path still lowers these formats through the shader; the compare result is constant zero. Scaled, integer and formats requiring converted sampling remain refused. Only 2D, 2D-array and cube views are accepted; image tables, min/max reduction, unnormalized coordinates and unsupported addressing remain refused. Point and bilinear results match on gfx1100. The PS5's gfx1013, array/cube behavior for the measured formats, and anisotropic comparisons remain unverified. Bilinear weights are full float, not the hardware's fixed-point subtexel weights
 - [Negative color-texture comparison wrap indices](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (libSceAgcDriver) use explicit `OpSRem` normalization to implement modulo; the negative-offset point-wrap regression fails with direct `OpSMod` and passes with normalization on Mesa 22.3.6 llvmpipe (LLVM 15.0.6), but negative-index wrap has not been measured on PS5 hardware.
 - [Converted unorm images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (10_11_11_UNORM, read and written through an R32_UINT view) are sampled in the shader, the way color comparisons are emulated: `image_sample` of a 2D or 2D array view fetches the one or four texels at LOD 0, decodes them and blends them, for point or bilinear filtering with equal minification and magnification filters and wrap or clamp-to-edge addressing. A shader gets these sample modes only once a converted descriptor reaches one of its sampled images: that capture throws `ConvertedSampleRequired`, the driver records the program and prepares it again with `GuestContext::convertedSamples`, so such a shader is prepared twice per run and its first capture is repeated. The record lives with the registered program and is not kept across runs. Bilinear weights are rounded to the hardware's 8-bit grid (`roundEven(fraction * 256) / 256`, ties to even), as measured with `image_sample_lz` on RDNA2 (gfx1035) for 10_11_11 UNORM texels by adriadam10 in #5958; point sampling, decoding, swizzles and wrap and clamp-to-edge addressing matched the same measurement. A sample that is not `_lz` needs an image with one mip level; gathers, LOD queries, clamp-to-border and mirrored addressing, other filters, min/max reduction, unnormalized coordinates, images selected at run time, 16-bit data and a DST_SEL of the missing W channel throw.
-- [Converted unorm image loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) divide by 2^n - 1 with the buffer format path's `OpFDiv`, which Vulkan allows to be up to 2.5 ULP off, so some drivers are not bit-exact.
-- [64-bit LDS atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_*_u64`, `ds_*_b64`, `ds_*_f64`) read and write the two dwords under a workgroup lock stored after the guest LDS, as LDS is a 32-bit array without 64-bit atomics. On RDNA2 (gfx1036) the LDS serialises a 32-bit atomic on a slot's high dword and a 64-bit atomic on that slot: 128 lanes of `ds_add_u32` and 128 lanes of `ds_add_u64` on one slot sum exactly. Only that pair was measured. Every 32-bit LDS atomic of a program that contains a 64-bit LDS atomic therefore takes the same lock, including a 32-bit `flat_atomic_*` whose address lands in the LDS aperture (a 64-bit one takes it already); the flat forms were not measured against a 64-bit atomic either (the other 32-bit LDS atomics, `ds_min/max`, `ds_cmpst`, the float forms, `ds_inc/dec`, `ds_mskor` and `ds_wrxchg`, are extrapolated from `ds_add_u32` and were not measured against a 64-bit atomic); a program without a 64-bit LDS atomic keeps its native 32-bit atomics. `ds_condxchg32_rtn_b64` is two `ds_mskor` halves, each under the lock but not atomic as a pair, so a 64-bit atomic between the two halves is not excluded. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms) and plain `ds_read_*`, `ds_write_*`, `ds_append_u32` and `ds_consume_u32` are not taken under the lock, so a plain access racing a 64-bit atomic on the same dwords can see or overwrite one half of it; whether the hardware orders them was not measured. The lock serialises the workgroup's LDS atomics of such a program; the throughput cost was not measured. `VK_KHR_workgroup_memory_explicit_layout` with `shaderSharedInt64Atomics` would make both widths native and is not used. A 64-bit atomic at an address that is 4-byte but not 8-byte aligned faults the wave on gfx1036, as on gfx1035. When the LDS lives in device memory (compute LDS beyond the device's shared-memory limit) and the device has `shaderBufferInt64Atomics`, no lock is used: a 64-bit atomic is a compare-exchange loop on a 64-bit view of the storage buffer and a 32-bit atomic is a native buffer atomic, a misaligned 64-bit atomic records the `Unaligned` shader fault with the LDS byte address instead of updating, so a mixed-width pair on one slot relies on the device ordering both widths on one buffer address; only `ds_add_u32` against `ds_add_u64` was measured, on gfx1036 (AMD Windows driver 32.0.21042.62) and an RTX 4070 SUPER. The lock is not used there because AMD's Windows driver compiles an acquire or release on a storage buffer, at workgroup scope or wider, to `s_barrier`, and those barriers inside the lock's divergent loop pair with the program's own `s_barrier`s. The fence after each LDS atomic compiles to `s_barrier` on that driver as well, so a wave that skips an LDS atomic that other waves of its workgroup execute misses a barrier they reach; its effect was not measured. On that path a 64-bit atomic at an address that is 4-byte but not 8-byte aligned is skipped and returns 0.
-- [LDS float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_min/max/cmpst_f32`, `ds_min/max/cmpst_f64` and their `_rtn` forms) follow the hardware measured on RDNA2 (gfx1036) over 14 x 14 operand sets (zeros, ones, infinities, denormals, quiet and signalling NaNs of both signs and with payloads) in IEEE 0 and 1 with every value 0-3 of the type's denormal field: both operands are flushed to a signed zero when bit 0 of the field is clear (0 and 2; 1 and 3 keep them; the f32 field for the f32 forms, the f16/f64 field for the f64 forms; a shader without a known float mode flushes f32 and keeps f64), then a signalling-NaN data operand is stored quieted, else a signalling-NaN old value is stored quieted, else a quiet-NaN old value is replaced by the data, else a quiet-NaN data operand loses, else the ordered compare with -0 below +0 decides, and the flushed value is what is written, also when the old value wins. `cmpst` compares the flushed bits (both zeros equal, NaN never equal) and leaves memory unchanged when they differ. The returned value is always the old value as it was in memory. `IEEE_MODE` has no effect. The same bit rule serves the buffer float atomics (`AtomicFloatBits`). Not measured: a denormal or signalling-NaN `data1` of `cmpst` (stored as given). `ds_add_f32` and `ds_add_rtn_f32` follow RDNA1 (gfx1010, RX 5700 XT), measured with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime over 1574 operand pairs (signed zeros, denormals, the smallest normals, infinities, quiet and signalling NaNs with payloads, the largest normals, random pairs near the denormal range and pairs that nearly cancel) in all 16 combinations of the f32 denormal field and the f32 round mode, and at IEEE 1 and DX10 clamp 0: both operands are flushed to a signed zero when bit 0 of the field is clear and the result when bit 1 is clear, the sum is rounded to nearest even whatever the round mode, a NaN data operand is stored quieted, else a NaN old value is stored quieted, `+inf + -inf` stores 0xffc00000, and `IEEE_MODE` and `DX10_CLAMP` have no effect. The sum is the host's `OpFAdd` between those flushes, so where the field keeps f32 denormals the result also depends on the host preserving them, which the module does not request. thuanquang measured the same rule on RDNA2 (gfx1031, RX 6700 XT) in #5492, with the same operand classes and 18 modes in wave32 and wave64; the PS5's gfx1013 is not measured.
-- [LDS in pixel, vertex-path and fetch programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvAnalysis.cpp) (shader recompiler) - is an array private to each host invocation, in `Function` storage, as only compute and mesh programs get workgroup memory; on the console one LDS region is shared by the wave (RDNA 2 ISA sections 3.6.6 and 10.4), so a lane does not see another lane's LDS writes. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms), the 32-bit LDS atomics, `ds_append` and `ds_consume` load, update and store the invocation's own dword without an atomic, as Vulkan allows atomics only on `Uniform`, `Workgroup`, `Image`, `StorageBuffer`, `PhysicalStorageBuffer` and `TaskPayloadWorkgroupEXT` pointers (VUID-StandaloneSpirv-None-04686). `ds_append` and `ds_consume` update only the first active lane's copy and return its old value to every lane, so a second append after the first active lane changes, or a read of the counter by another lane, differs from the hardware. Not measured on hardware.
-- [V# bases off a DWORD boundary](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (shader recompiler) - raw accesses use the exact bytes and `s_buffer_load` reads `(base & ~3) + (offset & ~3)`, as measured on gfx1035 (Linux, alignment mode UNALIGNED; the console's mode is unknown). Formatted accesses off their element's alignment throw. Atomics use the byte address `base + offset`, base's low two bits included: measured on RDNA2 (gfx1031, Radeon RX 6700 XT, AMD Windows driver 32.0.21045.5002 through HIP) with `buffer_atomic_add`, `buffer_atomic_swap` and `buffer_atomic_cmpswap` and bases 0 to 3 bytes past a DWORD boundary with offsets 0 to 7, an address on a DWORD boundary updates that DWORD and returns its old value, and any other address stops the dispatch, which the recompiler reports as an unaligned access fault.
-- [Unaligned 32-bit buffer atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp) (shader recompiler) act on the dword that holds their address, as section 8.1.7 of the [RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) describes for alignment mode DWORD ("the two LSBs of the byte-address are ignored, thus forcing Dword alignment"). The mode comes from `SH_MEM_CONFIG.alignment_mode`, and the console's mode is unknown. MXGP 26 (PPSA30839) sets bits with `buffer_atomic_or` at odd byte offsets, so the console is not in a strict mode, where section 3.11 reports a memory violation for a misaligned atomic. In mode UNALIGNED, which Linux KFD sets, a misaligned atomic stops the dispatch (measured on gfx1031 and gfx1036), so the console is not in that mode either. A 64-bit buffer atomic off an 8-byte boundary still records an unaligned BDA fault: mode DWORD would align it only to 4 bytes, which a host 64-bit atomic cannot address. When the V# base itself is off a DWORD boundary and the containing dword lies before the first aligned dword the buffer view binds to, that atomic is out of bounds and returns 0 without writing. Covered by [BufferAtomicUnaligned.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicUnaligned.cpp).
+- [64-bit LDS atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_*_u64`, `ds_*_b64`, `ds_*_f64`) read and write the two dwords under a workgroup lock stored after the guest LDS, as LDS is a 32-bit array without 64-bit atomics. On RDNA2 (gfx1036) the LDS serialises a 32-bit atomic on a slot's high dword and a 64-bit atomic on that slot: 128 lanes of `ds_add_u32` and 128 lanes of `ds_add_u64` on one slot sum exactly. Only that pair was measured. Every 32-bit LDS atomic of a program that contains a 64-bit LDS atomic therefore takes the same lock, including a 32-bit `flat_atomic_*` whose address lands in the LDS aperture (a 64-bit one takes it already); the flat forms were not measured against a 64-bit atomic either (the other 32-bit LDS atomics, `ds_min/max`, `ds_cmpst`, the float forms, `ds_inc/dec`, `ds_mskor` and `ds_wrxchg`, are extrapolated from `ds_add_u32` and were not measured against a 64-bit atomic); a program without a 64-bit LDS atomic keeps its native 32-bit atomics. `ds_condxchg32_rtn_b64` is two `ds_mskor` halves, each under the lock but not atomic as a pair, so a 64-bit atomic between the two halves is not excluded. Sub-dword writes (`ds_write_b8`, `ds_write_b16` and their `_d16_hi` forms) and plain `ds_read_*`, `ds_write_*`, `ds_append_u32` and `ds_consume_u32` are not taken under the lock, so a plain access racing a 64-bit atomic on the same dwords can see or overwrite one half of it; whether the hardware orders them was not measured. The lock serialises the workgroup's LDS atomics of such a program; the throughput cost was not measured. `VK_KHR_workgroup_memory_explicit_layout` with `shaderSharedInt64Atomics` would make both widths native and is not used. A 64-bit atomic at an address that is 4-byte but not 8-byte aligned faults the wave on gfx1036, as on gfx1035; with the workgroup lock, in device memory and in the invocation-private LDS of other stages alike, the recompiler records the `Unaligned` shader fault with the LDS byte address, leaves both dwords unchanged and returns 0, but the lane and the rest of its wave keep running. When the LDS lives in device memory (compute LDS beyond the device's shared-memory limit) and the device has `shaderBufferInt64Atomics`, no lock is used: a 64-bit atomic is a compare-exchange loop on a 64-bit view of the storage buffer and a 32-bit atomic is a native buffer atomic, so a mixed-width pair on one slot relies on the device ordering both widths on one buffer address; only `ds_add_u32` against `ds_add_u64` was measured, on gfx1036 (AMD Windows driver 32.0.21042.62) and an RTX 4070 SUPER. The lock is not used there because AMD's Windows driver compiles an acquire or release on a storage buffer, at workgroup scope or wider, to `s_barrier`, and those barriers inside the lock's divergent loop pair with the program's own `s_barrier`s. The fence after each LDS atomic compiles to `s_barrier` on that driver as well, so a wave that skips an LDS atomic that other waves of its workgroup execute misses a barrier they reach; its effect was not measured.
+- [Image, buffer and global float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`image_atomic_fmin/fmax/fcmpswap`, the same three `buffer_atomic_*` and `global_atomic_*` forms and their `_x2` forms) follow the rule of the LDS float atomics below, including its operand flush: the 32-bit forms flush both operands to a signed zero when bit 0 of the f32 denormal field is clear, the `_x2` forms by the f16/f64 field, and `fcmpswap` stores a denormal source as given. The `flat_atomic_*` forms take the same path and are not measured. Measured on RDNA2 (gfx1031, RX 6700 XT) with the [hardware oracle](../HW_ORACLE.md) over 20 x 20 f32 and 18 x 18 f64 operand pairs in every value of both fields, at IEEE 0 and 1, in wave32 and wave64, and for the image forms on 32_UINT, 32_SINT and 32_FLOAT surfaces. The console's gfx1013 is not measured.
+- [LDS float atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (`ds_min/max/cmpst_f32`, `ds_min/max/cmpst_f64` and their `_rtn` forms) follow the hardware measured on RDNA2 (gfx1036) over 14 x 14 operand sets (zeros, ones, infinities, denormals, quiet and signalling NaNs of both signs and with payloads) in IEEE 0 and 1 with every value 0-3 of the type's denormal field: both operands are flushed to a signed zero when bit 0 of the field is clear (0 and 2; 1 and 3 keep them; the f32 field for the f32 forms, the f16/f64 field for the f64 forms; a shader without a known float mode flushes f32 and keeps f64), then a signalling-NaN data operand is stored quieted, else a signalling-NaN old value is stored quieted, else a quiet-NaN old value is replaced by the data, else a quiet-NaN data operand loses, else the ordered compare with -0 below +0 decides, and the flushed value is what is written, also when the old value wins. `cmpst` compares the flushed bits (both zeros equal, NaN never equal) and leaves memory unchanged when they differ. The returned value is always the old value as it was in memory. `IEEE_MODE` has no effect. Not measured: a denormal or signalling-NaN `data1` of `cmpst` (stored as given). `ds_add_f32` and `ds_add_rtn_f32` follow RDNA1 (gfx1010, RX 5700 XT), measured with the [hardware oracle](../HW_ORACLE.md) template run through the Windows driver's comgr and HIP runtime over 1574 operand pairs (signed zeros, denormals, the smallest normals, infinities, quiet and signalling NaNs with payloads, the largest normals, random pairs near the denormal range and pairs that nearly cancel) in all 16 combinations of the f32 denormal field and the f32 round mode, and at IEEE 1 and DX10 clamp 0: both operands are flushed to a signed zero when bit 0 of the field is clear and the result when bit 1 is clear, the sum is rounded to nearest even whatever the round mode, a NaN data operand is stored quieted, else a NaN old value is stored quieted, `+inf + -inf` stores 0xffc00000, and `IEEE_MODE` and `DX10_CLAMP` have no effect. The sum is the host's `OpFAdd` between those flushes, so where the field keeps f32 denormals the result also depends on the host preserving them, which the module does not request. thuanquang measured the same rule on RDNA2 (gfx1031, RX 6700 XT) in #5492, with the same operand classes and 18 modes in wave32 and wave64; the PS5's gfx1013 is not measured.
+- [LDS in pixel, vertex-path and fetch programs](../../../core/shader/recompiler/SpirvBackend/src/SpirvAnalysis.cpp) (shader recompiler) - console waves share one LDS region; the host uses a private `Function` array (8192 dwords when unbounded). On NVIDIA proprietary, past about 4 GiB of private memory over every resident invocation that array fails (4090 on 617.42: 5456 ok, 5472 fault at 128×48×32 from `VK_NV_shader_sm_builtins`; 5090: 4096 ok, 6144 timeout). Above `min(4096, 4 GiB / (SMs × warps/SM × subgroup × 4))` it is a storage buffer per lane; other drivers keep `Function`. Only the 4090 sizes are measured. The NVIDIA-only pool fits subgroups in min(2 GiB, storage range) until teardown; excess slots sticky-flag and `WaitIdle` throws (no recycle). Header mapped host-visible/coherent (prefer device-local). Sub-dword writes, 32-bit atomics, `ds_append` and `ds_consume` are non-atomic on the lane's copy; append/consume update only the first active lane. Not measured on hardware.
+
+- [V# bases off a DWORD boundary](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (shader recompiler) - raw accesses use the exact bytes, as measured on gfx1035 (Linux, alignment mode UNALIGNED), which differs from the console's mode DWORD: on a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title) a raw `buffer_load_dword` with the V# base 1 byte past a dword, or an aligned base and `voffset` 1, returned the aligned dword (0x44332211, not 0x55443322). `s_buffer_load` reads `(base & ~3) + (offset & ~3)`, as on the console. Formatted accesses off their element's alignment throw. Atomics use the byte address `base + offset`, base's low two bits included: measured on RDNA2 (gfx1031, AMD Windows driver 32.0.21045.5002, HIP) with `buffer_atomic_add`, `_swap` and `_cmpswap`, bases 0 to 3 bytes past a DWORD boundary and offsets 0 to 7, an aligned address updates that DWORD and any other stops the dispatch, which the recompiler reports as an unaligned access fault. Closes when: raw buffer accesses drop the two low address bits as on the console
+- [Unaligned 32-bit buffer atomics](../../../core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp) (shader recompiler) act on the dword that holds their address, as section 8.1.7 of the [RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) describes for alignment mode DWORD, the mode `SH_MEM_CONFIG.alignment_mode` selects on the console: on a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title) a `buffer_atomic_add` of 1 at byte offset 0x0D incremented the dword at 0x0C and left its neighbours unchanged. A 64-bit buffer atomic off an 8-byte boundary still records an unaligned BDA fault: mode DWORD would align it only to 4 bytes, which a host 64-bit atomic cannot address. When the V# base itself is off a DWORD boundary and the containing dword lies before the first aligned dword the buffer view binds to, that atomic is out of bounds and returns 0 without writing. Covered by [BufferAtomicUnaligned.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/BufferAtomicUnaligned.cpp).
 - [32-bit bitfield masks](../../../core/shader/recompiler/Translation/src/IntegerInstructions.cpp) (`S_BFM_B32`, `V_BFM_B32`) use the truncating 32-bit shift specified by the [RDNA 1.0 ISA](https://www.amd.com/content/dam/amd/en/documents/radeon-tech-docs/instruction-set-architectures/rdna-shader-instruction-set-architecture.pdf), sections 12.1 (opcode 36) and 12.12 (opcode 867). Width and offset use their low five bits. This matches gfx1035 (Linux) for every width/offset pair, with and without upper operand bits set, and both leave SCC unchanged; not measured on the console.
 - [Vector buffer offsets that are not a multiple of 4](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (shader recompiler) - dword accesses count whole dwords from the V# base, where the hardware reads the exact bytes at base + offset.
 - [Raw `buffer_load_dwordx2`](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) is one 64-bit access on the hardware (with or without glc), so it never sees half of a `buffer_atomic_swap_x2`. Only a glc load that is 8-byte aligned and in bounds, in a program that has the 64-bit storage view (it uses 64-bit buffer atomics), is read with one 64-bit atomic load; every other dwordx2 load is two dword loads and can tear against a concurrent 64-bit write: loads without glc, and loads in a program without 64-bit buffer atomics while another shader writes the pair with `swap_x2`.
@@ -158,7 +176,7 @@
 - [2D biased sampling through a one-slice, single-level 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) supplies a zero third coordinate and retains the bias operation, with normalized point minification and magnification and no linear mip filtering. Measured on RDNA2 (AMD integrated gfx1036, driver 32.0.21036.18, Windows 11) by running an OpenCL-loaded native kernel with `image_sample_b` DIM 2D against 16x16x1 R32_UINT and RGBA8_UNORM 3D images: biases -16, -0.5, 0, 0.5 and 16 read the (u,v) texel in slice zero, including wrapped coordinates, point min/max reduction and the title's sampler with Z border addressing. Wave32, IEEE off, DX10 clamp on, denormals preserved, round to nearest even, FP16 overflow off; wave64 and the PS5's gfx1013 are not measured. Pixel-stage, direct, non-depth, unpacked samples whose only use is the plain 32-bit bias form are accepted; extra slices, any nonzero mip range, linear or anisotropic filtering and unnormalized coordinates throw. Vulkan readback is checked on NVIDIA RTX 5070 and AMD integrated graphics for positive and negative bias and point weighted-average/min/max reduction.
 - [FORCE_DEGAMMA on RGBA8_UINT](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) materializes a direct image sampled only by plain biased pixel accesses as RGBA8_SRGB when every paired sampler forces degamma. Measured on AMD integrated RDNA2 gfx1036 (driver 32.0.21036.18, Windows 11, wave32, IEEE off, DX10 clamp on, denormals preserved, round to nearest even, FP16 overflow off): a native `image_sample_b` DIM 2D on a 16x16x1 RGBA8_UINT 3D T# returns integer channels without the bit, but the same floating-point decoded values as RGBA8_UNORM with it, including point min/max reduction and the title's exact sampler. The metadata and image view must both become floating-point sRGB; ignoring the sampler bit or retaining a UINT heap is incorrect. The accepted case requires one slice, mip zero, normalized point sampling and uniform FORCE_DEGAMMA across its samplers. Other image accesses, mixed sampler states, indirect descriptors and other integer formats remain refused. Wave64, other filtering modes and the PS5's gfx1013 are not measured.
 - The [s_swappc_b64 fetch-shader call at vertex/local/tessellation/mesh entry](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) assumes the called fetch-shader blob ends in `s_setpc_b64` to the link pair (the GNM fetch-shader shape shadPS4's `EmitFetch` copies); the blob is not part of the shader program, so its return closes the pairing by assumption and any in-program reader of the link pair throws. Attribute fetches are inlined from the request's parsed fetch-shader plan through the same `GetAttribute` path as the embedded fetch analyzer, honoring the buffer resource `dst_sel`; an attribute writing more than four registers, or an entry call without a parsed plan, throws. The vertex/instance offset accumulator inside the fetch blob is not replayed for external blobs.
-- The scalar aperture sources [src_shared_base, src_shared_limit, src_private_base, src_private_limit](../../../core/shader/recompiler/RdnaDecoder/src/RdnaInstructionDecoder.cpp) (core/shader/recompiler, scalar source codes 235 to 238) read as the 64-bit apertures the flat routing uses: a base is the aperture's high dword (`SharedApertureHigh`, `PrivateApertureHigh`) over a low dword of 0, a limit is the same high dword over 0xffffffff. A 64-bit read (`s_mov_b64`, a 64-bit VALU source, a wave64 lane mask) gets the whole value and a 32-bit read gets the low dword. This follows LLVM's `SIRegisterInfo.td` (aperture registers are 64-bit, their low 32 bits are always 0 for a base and -1 for a limit) and `getSegmentAperture` (`AMDGPULegalizerInfo.cpp`, `SIISelLowering.cpp`: a 64-bit read whose high half is the aperture), the KFD's `MAKE_LDS_APP_LIMIT` (limit = base | 0xffffffff) and the gfx1030 and gfx1035 readouts on [#1190](https://github.com/boykopovar/AnyPS5/pull/1190) and [#3803](https://github.com/boykopovar/AnyPS5/issues/3803). Not measured on a console: the PS5's high dwords are the inferred values of the flat aperture bases entry, and the wave is taken to be in 64-bit address mode (PTR32 clear)
+- The scalar aperture sources [src_shared_base, src_shared_limit, src_private_base, src_private_limit](../../../core/shader/recompiler/RdnaDecoder/src/RdnaInstructionDecoder.cpp) (core/shader/recompiler, scalar source codes 235 to 238) read as the 64-bit apertures the flat routing uses: a base is the aperture's high dword (`SharedApertureHigh`, `PrivateApertureHigh`) over a low dword of 0, a limit is the same high dword over 0xffffffff, as a PS5 (13.40, measured 2026-10-19 by a gfx1013 kernel run from inside a retail title) read them (0x80000000_00000000 / 0x80000000_FFFFFFFF shared, 0x70000000_00000000 / 0x70000000_FFFFFFFF private). A 64-bit read (`s_mov_b64`, a 64-bit VALU source, a wave64 lane mask) gets the whole value and a 32-bit read the low dword, after LLVM's `SIRegisterInfo.td` and `getSegmentAperture` and the gfx1030 and gfx1035 readouts on [#1190](https://github.com/boykopovar/AnyPS5/pull/1190) and [#3803](https://github.com/boykopovar/AnyPS5/issues/3803). The 32-bit read and the wave's address mode (taken to be 64-bit, PTR32 clear) were not measured on the console
 - [EmitSetAttribute](../../../core/shader/recompiler/SpirvBackend/src/SpirvModuleEmitter.cpp) (shader recompiler) - a primitive with a vertex whose clip position is (0,0,0,0) is clipped away through an extra `gl_ClipDistance` element on vertex and tessellation evaluation shaders, matching what a Radeon 610M (RDNA2, RADV) and llvmpipe rasterise; NVIDIA 615.78.08 without it draws the vertex at the viewport centre. Measured for triangles (strip and list) and for a point at (0,0,0,0), which the Radeon 610M does not draw, NVIDIA draws at the viewport centre and llvmpipe at the top-left corner; lines with such a vertex are clipped by the same element and were not measured. Mesh, geometry and the generated barycentric geometry stage do not write it, the generated rect-list and barycentric tessellation stages forward the vertex shader's array, and a vertex or tessellation evaluation shader whose guest clip and cull distances already take all eight does not write it either, so NVIDIA 615.78.08 draws such a vertex at the viewport centre; a device without `shaderClipDistance` cannot compile vertex shaders that write it (the compile throws). The PS5 rasteriser was not measured.
 - [PERSP_SAMPLE and LINEAR_SAMPLE](../../../core/shader/recompiler/Translation/src/InstructionTranslator.cpp) (recompiler) are the barycentrics at the iterated sample, which in a pixel shader the guest does not iterate is taken to be sample 0, inferred from the ancillary's iterated sample number and not measured. They are interpolated with `InterpolateAtOffset`, which [GLSL_EXT_fragment_shader_barycentric](https://github.com/KhronosGroup/GLSL/blob/0099bf83b0288469917fc2e2972cb0a2b74d6711/extensions/ext/GLSL_EXT_fragment_shader_barycentric.txt#L286-L299) names for barycentrics away from the default position, at the sample's offset from the pixel centre, read per pixel of the 2x2 quad from `PA_SC_AA_SAMPLE_LOCS` (the standard pattern unless the draw sets its own): sample 0's in a shader the guest does not iterate, and in an iterated shader the offset of the host's `SampleId` from a table of the guest's locations, because Vulkan leaves the position of plain barycentrics under sample shading implementation-defined (lavapipe uses the pixel centre). That needs the device's `sampleRateShading`; without it, and when every location is the pixel centre (a single-sample draw), they keep the host's default position, the pixel centre once per pixel and an implementation-defined position under sample shading. PERSP_CENTER and LINEAR_CENTER are interpolated at offset 0 in an iterated shader, so they stay at the pixel centre as on the console; the centroid pairs keep the host's default position. With barycentric emulation the offsets apply to the emulated barycentrics. Devices that interpolate attributes on the host instead (no usable fragment-shader barycentrics, as on MoltenVK) keep the default position for all four pairs.
 - [Pixel positions](../../../core/shader/recompiler/Translation/src/InstructionTranslator.cpp) (recompiler) - POS_X_FLOAT and POS_Y_FLOAT follow `SPI_BARYC_CNTL.POS_FLOAT_LOCATION` (bits 17:16) and `POS_FLOAT_ULC` (bit 20), whose positions come from [PAL's GFX9+ register header](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/chip/gfx9_plus_merged_registers.h) and whose meanings from [LLPC](https://github.com/GPUOpen-Drivers/llpc/blob/40cb8d95ad8d6f7f1652e3fd47d39667594cce08/lgc/lowering/RegisterMetadataBuilder.cpp#L767-L779): the pixel centre (0), the iterated sample (2), or the upper-left corner (ULC). Under host sample shading the centre is `floor(FragCoord) + 0.5`, and a non-iterated shader's sample is the centre plus sample 0's offset. The centroid (1) keeps `FragCoord`, the pixel centre or under sample shading the sample, not the centroid of the covered samples. A missing `SPI_BARYC_CNTL` reads as the pixel centre and the reserved location 3 throws. POS_Z_FLOAT and POS_W_FLOAT keep `FragCoord`'s depth and 1/w at the host's position. `PERSP_CENTER_CNTL`, `PERSP_CENTROID_CNTL`, `LINEAR_CENTER_CNTL` and `LINEAR_CENTROID_CNTL` (bits 0, 4, 8 and 12) are not read: PAL and LLPC never set them.
@@ -166,13 +184,17 @@
 - [Static scalar calls](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) (`s_call_b64` and `s_swappc_b64`) require an ordinary even-aligned SGPR link pair (s0:s1 through s104:s105) and a later `s_setpc_b64` return reading that exact pair. Outside every region of its calls the pair is free to use wherever no return address can reach: a dataflow over the decoded instructions follows each dword of the pair from the calls that write it until a scalar load, SALU or VALU result is known to overwrite it, and an instruction there that may read a dword still holding a return address throws; SOPC compares are exempt, as they only set SCC. A VALU mask covers one SGPR in wave32 and a pair in wave64. When the graph is built without the wave size, the dataflow runs for both: a program that escapes under both throws there, and one that escapes under only one throws when it is translated at that size.
 - [Static scalar call link pairs](../../../core/shader/recompiler/ControlFlow/src/GraphBuilder.cpp) each serve one call, or several calls whose regions are disjoint, each call closed by the first return reading the pair after its target. Regions must nest or be disjoint; recursion, other shared links, escaping link values (including overlapping tuples and resource descriptors), invalid targets, interleaved regions, cross-region branches or fall-through, relative SGPR reads and dynamic `s_setpc_b64` in a program with calls throw. The analysis checks all decoded instructions, including unreachable code. Arbitrary indirect calls and general call frames are not implemented.
 - [Relative vector addressing](../../../core/shader/recompiler/Translation/src/ControlFlowInstructions.cpp) (`v_movrels_b32`, `v_movreld_b32`, `v_movrelsd_b32`, `v_movrelsd_2_b32`, `v_swaprel_b32`) keeps every vector register from the lowest base register the program addresses relatively up to the last register the program names in zero-initialised function-scope storage per invocation (`LoadVectorWindow`/`StoreVectorWindow`, one element per register), so an indexed access is one load or store instead of a compare-and-select chain over the window. [`IndexedWindowSlots`](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvModuleSetup.cpp) bounds each relative index through the IR (bit-field extracts, masks, shifts, adds, selects, phis, `ReadFirstLane` and the window stores that reach a load); the storage is an array of the slots below the largest bound that is under half the window, and one function variable per slot after it. A constant index uses the array element or the slot's variable; a relative access whose index has no such bound, or lands past the array at run time, indexes the array below its size and otherwise branches through an `OpSwitch` over the slot variables, so the bound only decides speed. When no index has a bound under half the window, the whole window is the array, as with `APS5_NO_WINDOW_NARROWING=1` (a recompiler switch in the shader cache key). Measured on an NVIDIA GeForce RTX 3060 (driver 615.78.08, Linux) with a compute program whose 167-register window an ALU loop reads and writes in full and whose relative accesses take `m0 = s8 & 3`: a 2048-group dispatch took 70.2 ms in wave32 and 123.3 ms in wave64 with the whole window in the array (as before narrowing) and 1.9-2.1 ms and 7.8 ms narrowed; with a second relative access whose index has no bound and lands past the array at run time (index 50 or 166), 113 ms and 5.8-6.0 ms in wave32. In the PPSA08427 (Killing Floor 3) hub it made no measurable difference to presents or to the GPU time of the eight most expensive programs. Whether the host compiler keeps the array and the slot variables in registers or spills them to scratch is not measured. A register in the window the program never wrote reads 0, as an unwritten SSA register does; the console's value is undefined. M0 is unsigned: an index at or past the window reads `v0` and drops its write, and `v_swaprel_b32` writes neither side when either is out of range, as measured on RDNA2 (gfx1035, `agc_driver_relative_indexing`). The window ends at the last register the program names rather than at the shader's VGPR allocation, which the recompiler does not receive, so a relative write past the named registers but inside the allocation is dropped where the hardware keeps it for a later relative read. Killzone: Liberation's PSP vertex program (PPSA11142, 3176 ISA words, 104 relative accesses over 154 registers) went from 649,515 to 392,333 SPIR-V words with this. Pixel programs whose relative span contains the packed ancillary input instead keep that span in SSA and implement indexed operations with compare/select chains. This keeps ancillary definitions visible to field lowering and masked-write proofs; storing the unmodelled whole word in a private array would require composing unknown bits. A fold after masked-select elimination lowers fields whose consumers become visible only after redundant copies are removed. A whole-word use that the masked-select pass keeps gets the composed word described under the packed pixel ancillary word. Both representations include implicit entry inputs in the inferred register limit and retain unsigned M0, inactive-write and DPP update rules; wave32/wave64 native Vulkan readbacks cover relative reads, writes, split-offset swaps, inactive writes, DPP masks and out-of-range accesses, but console comparison and the performance cost of selecting over this span are unverified.
+- [Lane spills read back with `v_readlane_b32`](../../../core/shader/recompiler/Optimization/src/ReadLaneEliminator.cpp) (shader recompiler) - not verified for the guest compiler: a relative write (`v_movreld_b32`, `v_movrelsd_b32`, `v_movrelsd_2_b32`, `v_swaprel_b32`) with a computed index is taken to miss a register between a `v_writelane_b32` of a lane and a later `v_readlane_b32` of it, so the read becomes the spilled scalar. That holds when the compiler keeps spill registers out of its relatively indexed arrays. Each such write that a replaced read depends on is checked at run time: one that changes that lane of that register records a fault, and the dispatch or draw fails with `which holds a scalar spilled with v_writelane_b32`, where the console would read the new value ([m0 = 1 counterexample](https://github.com/boykopovar/AnyPS5/pull/6277#issuecomment-6215244790)). An inactive or out-of-range lane writes nothing. A constant-index write of the register still ends the spill.
 - [s_call_b64](../../../core/shader/recompiler/Translation/src/ScalarInstructions.cpp) saves `PC + 4` over `GetShaderBase` and branches to `PC + 4 + signext(SIMM16) * 4`, following [AMD RDNA2 ISA](https://gpuopen.com/download/rdna2-shader-instruction-set-architecture.pdf) sections 3.6.3, 12.2 and 12.3. Forward callees after `s_endpgm` are decoded. Measured on RDNA2 (gfx1036) in wave32 and wave64 with SIMM16 = 3: the link pair receives `PC + 4`, the branch goes to `PC + 4 + signext(SIMM16) * 4`, and `s_setpc_b64` of the link returns to the instruction after the call. Execution on the PS5 (gfx1013) and title compatibility for these bounded scalar calls remain unverified; `s_rfe_b64` still throws in translation.
 - [BDA anchor halfword reads](../../../core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp) retain volatile byte loads even for noncoherent memory. On RX 6650 XT / RADV Mesa 26.2.4, the valid SPIR-V for two adjacent nonvolatile byte loads returned `0x80a0` for bytes `0xa0, 0xa1`, where lookup-based reads returned `0xa1a0`. Adding the volatile operand makes the same GPU exactness fixture pass, including mixed direct/fallback lanes. The driver transformation responsible has not been isolated; removing this restriction needs equivalent readback coverage on the affected driver. Single-byte reads keep their original access mask.
 - [BDA span reads](../../../core/shader/recompiler/SpirvBackend/src/SpirvBdaRead.cpp) (shader recompiler) - `read_bda_span` is one selection: one arm calls `load_bda_span`, a `DontInline` function that holds the in-place dword loads and calls nothing, and the other arm is the per-dword byte fallback. Two other shapes of the same reads each hang a group of NVIDIA drivers, where a dispatch never finishes and the device is lost. With the loads emitted in the arm itself, a dispatch whose lanes took both arms hung on an RTX 3060 and an RTX 4060 Laptop GPU (Windows, driver 591.86) and an RTX 5060 (Linux, driver 590.48.01) ([#3291](https://github.com/boykopovar/AnyPS5/issues/3291)). With the loads and the fallback as two selections, the first under the span's condition and the second under its negation, it hung on an RTX 4070 Laptop GPU (Windows, drivers 595.97 and 596.36), an RTX 5080 (Windows, driver 610.62) and an RTX 4090 (Linux, driver 610.57.04) ([#4975](https://github.com/boykopovar/AnyPS5/issues/4975)). The current shape is measured on the RTX 4090 with driver 610.57.04 only, where it does not hang with or without SPIRV-Tools; a shape with the loads in their own `DontInline` function was reported passing on driver 591.86 in #3291. The cause inside the driver is not known.
+- [GFX10 scratch address operands](../../../core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp) (shader recompiler) - `core/shader/recompiler/RdnaDecoder/src/RdnaMemoryOpDecoder.cpp` and `core/shader/recompiler/Translation/src/MemoryInstructions/MemoryResourceHelpers.cpp` use the SV/SS/ST scratch operand widths described by LLVM FLATInstructions.td at 3eb867f9b63ae2881bbe3c25d3c12842f2bdc55e (operand pseudos L557-L630, GFX10 encoding L2973-L3038). Decoding and IR tests cover the one-dword VGPR offset; PS5 hardware address-result validation remains outstanding. Unsupported scalar registers still throw.
 - [SDWA source selects on `v_cvt_f32_ubyte1`, `v_cvt_f32_ubyte2` and `v_cvt_f32_ubyte3`](../../../core/shader/recompiler/RdnaDecoder/src/RdnaVectorOpDecoder.cpp) (shader recompiler) - byte N is taken from source 0 after `SRC0_SEL` and `SRC0_SEXT` select and extend it, since SDWA supplies source 0 (RDNA 2 ISA guide 6.8 and 13.3.7) and the opcode reads `S0.u[8N+7:8N]` (12.8). Not measured on hardware.
 - [Flag structurization](../../../core/shader/recompiler/ControlFlow/src/Structurizer.cpp) (shader recompiler) - a graph that every structurizer attempt refuses, irreducible and non-terminating graphs included, is rebuilt with one reach flag per block and one again flag per loop (`structurizeWithFlags`): each block keeps one copy and runs behind a guard on its flag, and each strongly connected component becomes a loop whose single latch repeats it while a back edge set its flag. The output has about 8 times the input's blocks and one route variable per block, and ends in an empty Return that never runs. Only blocks that start the top-level order unconditionally run unguarded, so resource planning also sees the static paths that skip a guarded block and can plan extra descriptor candidates for them. The attempts still run first. Shared merge splitting refuses an attempt once the graph has grown past 16 times its block count at the start of splitting (at least 64 blocks); succeeding attempts grew at most 10.6 times on random graphs of up to 128 blocks, and an attempt that would succeed only beyond the budget leaves the graph to a later attempt or to this construction. Splitting that adds one block per round stays within that budget until its 4 rounds per block run out, so the attempts can still take more than 10 s (9 of 2,000 random graphs of up to 128 blocks, 63 s at most). `APS5_FORCE_STRUCTURIZER_FALLBACK=1` builds every graph this way, for tests
+- [Shared loop latches](../../../core/shader/recompiler/ControlFlow/src/Structurizer.cpp) (shader recompiler) - a loop whose single latch holds instructions and is reached by one edge gets an empty continue block, so its continue construct is that one block. A latch that several `continue` paths share keeps its instructions in the continue construct, since isolating it would clone them into each path. When such a latch emits more than one SPIR-V block, as a memory or image access does, SPIRV-Cross (MoltenVK) folds the construct into a `for` increment and drops the header's `OpPhi` updates, so the loop never advances on Metal. No title is known to reach this case.
 - [Scalar buffer descriptors](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) use only the base address, stride and record count for resources accessed exclusively by scalar loads; their fourth word is normalized to zero, following AMD RDNA2 ISA section 7.2.2. Vector and mixed accesses retain descriptor validation. Native Vulkan readbacks cover ignored fourth-word fields on Windows/NVIDIA; their console behavior has not been measured.
 - [Spanned wave64 compute](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvSubgroup.cpp) (shader recompiler) - `APS5_SPANNED_WAVE=1`, off by default, runs a single-wave wave64 compute program at one lane per invocation on a 32-lane host subgroup and exchanges ballots, shuffles and reductions between the two host subgroups through workgroup memory and barriers. The driver turns it on only where compute subgroups can be pinned at 32 full lanes (`subgroupSizeControl` and `computeFullSubgroups`), passes it as `SpirvTarget::spannedWaves` (part of the cache key and the serialized request), and creates the pipelines of spanned programs with `REQUIRE_FULL_SUBGROUPS`, since the lane number `SubgroupId * 32 + SubgroupLocalInvocationId` needs two full subgroups. Those barriers are correct only where every invocation of the workgroup reaches them, which holds for the guest's wave-uniform control flow. The emulated 64-bit LDS atomics ([LockedLdsUpdate](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp)) run only on the lanes the exec mask keeps, so their lock loop ballots within its own host subgroup, as its elect already does. Any other cross-lane exchange emitted inside per-lane control flow would hang a spanned wave in the same way, and the emitter does not reject one: there is no uniformity check. The only check so far is manual: disassemble the module (`spirv-dis`), list the selection and loop constructs that enclose each `OpControlBarrier`, and read the condition of each enclosing selection. In Ghost of Yōtei's program 0x80003af600 (PPSA26344), 108 of 111 barriers sat only in loops on wave-uniform conditions and 3 inside per-invocation conditionals, all in the lock loop. Other programs and titles have not been scanned. An earlier, cheaper ballot (one barrier instead of three) also lost the device for a reason that is not understood, which may be another barrier placement problem. Measured on an RTX 4090 (Windows): an offline replay of that program and two Yōtei runs that previously lost the device (NVIDIA TDR) now run past it, and [LdsMaskWaterfall.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/LdsMaskWaterfall.cpp) runs both modes and covers a half-inactive wave. Stray (PPSA02101) on Intel ANV and a Demon's Souls (PPSA01342) request replay showed no fault, before this fix
 - [Guest memory load guards](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvMemoryInstructions.cpp) (shader recompiler) - a guest load whose lane is inactive or whose address is out of bounds is still performed and its result replaced by 0 with `OpSelect`, instead of a selection per guard, when the load can be pointed at a location nothing writes: scratch reads its own element 0; storage buffers (direct buffers, GDS) read element 0xfffffffe, which `robustBufferAccess2` turns into a zero load with no memory access, so the extra read cannot race with a write the guarded program would not have raced with ([Vulkan memory model](https://docs.vulkan.org/spec/latest/appendices/memorymodel.html#data-race)). Without `robustBufferAccess2` ([VulkanDevice.cpp](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) enables it when the device has it) those loads keep their selections; LDS loads, stores, atomics, formatted and physical-address (BDA) accesses always do. LDS keeps the branch because NVIDIA's compiler predicates a branched LDS load at no cost, while the select form costs about 2.5 instructions per dword and splits a `ds_read_b128` into four loads (RTX 4060 measurements by @karanvora2599 in #4048); Intel's static counts favour the select only for wide reads, and run time was not measured on either. The aligned high word of a misaligned-capable buffer read re-reads the low word's own element. A selection guard costs four blocks per lane half and the host compiler's time grows with the block count: PPSA11142's merged PSP vertex program (3176 ISA words, wave64) emitted 16,983 blocks and 1,710 conditional branches, 5,907 and 868 with the selects. `agc_guarded_memory_loads` traces the emitted loads in both device modes.
 - [Merged hull programs](../../../core/shader/recompiler/Optimization/src/TessellationLowering.cpp) (registered binary type 3) run whole in the hull stage, one invocation per output control point. On the console hull lane i keeps local lane i's registers, which with fewer input than output control points stop matching the patch's control points from i = inputs on; here invocation i holds control point min(i, inputs - 1) of its own patch. A wave-mask branch (`s_cbranch_exec[n]z`, `s_cbranch_vcc[n]z`) tests the invocation's own lane, so it can skip a block, scalar instructions included, that the console runs for the wave; `v_readfirstlane_b32` returns the invocation's own value, not the first active lane's, and another lane's register throws. The register layout (`s3`, `v0`-`v5`, as for the separate halves) is not measured on hardware. s[0:1] hold the hull user-data address (SH 0x102/0x103) when a draw sets it and zero otherwise, so a program reading it unset faults at the null address.
 - [Wave LDS ordering on AMD's proprietary driver](../../../core/shader/recompiler/SpirvBackend/src/SpirvFlowEmitter.cpp) (shader recompiler) - there ([SubgroupBarrier.hpp](../../../core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp)) one guest wave's LDS accesses are ordered by a subgroup-scope `OpMemoryBarrier` with no control barrier, relying on a 32-lane subgroup being one hardware wave whose lanes run in lockstep and issue LDS instructions in order, which Vulkan does not guarantee; for LDS kept in device memory the same is assumed of global loads and stores, unmeasured. Driver 32.0.21042.62 (Radeon 0x13c0, RDNA 2) compiled the subgroup-scope `OpControlBarrier` to `s_barrier`, which waves in a branch paired with other waves' barriers (PS5LM Plus). Measured on that driver only ([LdsTreeReduction.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/LdsTreeReduction.cpp)); a Radeon 860M on 32.0.13058.8001 reportedly did not show the fault.
+- [LDS atomic fences on AMD's proprietary driver](../../../core/shader/recompiler/SpirvBackend/src/SpirvMemory/SpirvBufferAccess.cpp) (shader recompiler) - there ([SubgroupBarrier.hpp](../../../core/libs/prx/libSceAgcDriver/Execution/include/SubgroupBarrier.hpp)) the fence after an LDS atomic or a sub-dword or misaligned LDS store is a device-scope `OpMemoryBarrier`, which that driver compiles to GL0 and GL1 cache invalidations; the cost is unmeasured. Driver 32.0.21042.62 (Radeon 0x13c0, RDNA 2) compiled the workgroup-scope fence to `s_barrier`, which waves in a branch paired with other waves' barriers (PS5LM Plus with flash attention). Measured on that driver only ([LdsSubwordStoreBranch.cpp](../../../core/libs/prx/libSceAgcDriver/tests/execution/LdsSubwordStoreBranch.cpp)); a Radeon 860M (RDNA 3.5, 32.0.13058.8001) reportedly gave correct flash-attention output, but the gate covers every version.
diff --git a/docs/user/INPUT_MAPPING.md b/docs/user/INPUT_MAPPING.md
index 7ab80c3d4f..98970b5163 100644
--- a/docs/user/INPUT_MAPPING.md
+++ b/docs/user/INPUT_MAPPING.md
@@ -1,6 +1,6 @@
 # Controller, keyboard and mouse input
 
-AnyPS5 accepts SDL-mapped game controllers as well as its built-in keyboard and mouse bindings. Xbox-style controllers and PlayStation controllers recognized by SDL use the standard PS button layout; sticks and analog triggers are passed through, and controllers can be connected or disconnected while the game is running. The first recognized controller is used. AnyPS5 uses its built-in keyboard and mouse bindings when no configuration file is present. To change selected keyboard and mouse bindings, create `anyps5-input.ini` beside the generated game executable. Set `ANYPS5_INPUT_CONFIG` to use a file at another path. Both the game directory and that path may contain any characters, such as `ü` or `日本`.
+AnyPS5 accepts SDL-mapped game controllers as well as its built-in keyboard and mouse bindings. Up to 4 controllers are supported simultaneously. The first connected controller is assigned to Player 1 and composed with keyboard and mouse input; additional controllers are sequentially assigned to Players 2, 3, and 4 (matching `libSceUserService` users). Xbox-style controllers and PlayStation controllers recognized by SDL use the standard PS button layout; sticks and analog triggers are passed through, and controllers can be connected or disconnected dynamically while the game is running. AnyPS5 uses its built-in keyboard and mouse bindings when no configuration file is present. To change selected keyboard and mouse bindings, create `anyps5-input.ini` beside the generated game executable. Set `ANYPS5_INPUT_CONFIG` to use a file at another path. Both the game directory and that path may contain any characters, such as `ü` or `日本`.
 
 For an Xbox-layout controller, A/B/X/Y map to Cross/Circle/Square/Triangle, LB/RB map to L1/R1, and LT/RT map to analog L2/R2. Start maps to Options. D-pad and stick-click buttons are supported. On a PlayStation controller, touchpad clicks and the positions of up to two fingers on the touchpad are forwarded. On other controllers, View (Back) presses the touchpad at its center.
 
@@ -42,6 +42,7 @@ Without an `anyps5-input.ini`, or for actions the file does not mention, these b
 | `Shake` | X (reports a swinging acceleration and angular velocity while held) |
 | `ToggleMouse` | Middle mouse button, F7 |
 | `ToggleFullscreen` | F11 |
+| `TogglePerformanceOverlay` | F10 |
 | `Screenshot` | F12 |
 
 For example, this changes Cross to F or Space, moves the left stick to IJKL, uses the mouse buttons for Square and R2, and keeps all other built-in bindings:
diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md
index 191adfd77d..3a4dc187ee 100644
--- a/docs/user/USAGE.md
+++ b/docs/user/USAGE.md
@@ -12,6 +12,8 @@ Select or drop multiple app ZIP archives to convert them into one ZIP bundle. Th
 
 ## Input and conversion
 
+The SELF unwrapper refuses containers requiring more than 64 MiB of total alignment padding before allocating the output buffer. This limit counts padding across file-backed and empty segments, not segment data; a refusal preserves the input and any existing output file.
+
 Use a clean ELF executable. Place its bundled ELF modules in `sce_module/`, `sce_modules/`, or `prx/` beside the input executable, or under the parent directory selected with `--sce-module-path <path>`. The option accepts absolute paths and paths relative to the current working directory; do not include the `sce_module` directory itself. Only files directly inside the module directories are processed. SELF/fSELF containers are skipped with a warning; unwrap them before relinking if they need to be included. `tools/unwrap_self.py <input.self> <output.elf>` does that for a decrypted container: it places the segments at the offsets of the SELF segment records and restores `p_offset % p_align == p_vaddr % p_align`, and it refuses a container whose load segments all look encrypted. The command-line relinker skips an ELF module as a backup copy, with a message, when its file name extends the name of another ELF module in the same directory and both have the same SONAME, such as a dumper's `libX.prx.esbak` or `libX.prxbak` beside an ELF `libX.prx`; a single backup beside a SELF container is still relinked. `prx/` can coexist with either `sce_module/` or `sce_modules/`. Both `sce_module/` and `sce_modules/` present is an error. All three absent is an error unless an explicit `--module-dir` is supplied.
 
 ```text
@@ -67,7 +69,7 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath`
 | `--linux-fixed-base <address>` | Load the Linux executable at this fixed address instead of the default `0x400000`, given in decimal or hexadecimal (`0x`): every virtual address of the image is offset by it, so virtual address 0 is placed at the address, as the console places an executable. Requires a 64 KiB-aligned address from `0x10000` through `0x7fffffff0000` that is a multiple of every `PT_LOAD` alignment, and an image that ends in the user address space. The executable is written as `ET_EXEC`, without ASLR, as it is at the default address. Bundled modules keep their normal placement. Conflicts with `--windows`, `--macos` and `--lazy-binding`. |
 | `--macos-fixed-base <address>` | Map the lowest ELF load page of the macOS executable at this fixed address, given in decimal or hexadecimal (`0x`). Requires `--macos`, a 64 KiB-aligned address from `0x20000` through `0x7fffffff0000`, and an image that ends in the macOS user address space. `__PAGEZERO` ends 64 KiB below the address and the Mach-O header occupies those 64 KiB. The executable has no ASLR; an address the process cannot map fails to load. Bundled modules keep their normal placement. |
 | `--to-intel`                  | Convert supported AMD-only instructions in the executable and bundled modules. Unsupported instructions or unreachable conversion stubs cause an error.                                                                                                                                                                                                                                                                                                                     |
-| `--to-rosetta`                | Convert as `--to-intel` does and also lower what Rosetta lacks: ANDN becomes scalar NOT/AND, RDSEED becomes RDRAND, CLWB a NOP, and RDPID and the ECX of RDTSCP return processor 0. Implies `--to-intel`. Independent of `--macos`: `--macos` alone leaves these instructions as they are. Conflicts with `--windows`.                                                    |
+| `--to-rosetta`                | Convert as `--to-intel` does and also lower what Rosetta lacks: ANDN becomes scalar NOT/AND, RDSEED becomes RDRAND, CLWB a NOP, XSAVEOPT becomes XSAVE, and RDPID and the ECX of RDTSCP return processor 0. Implies `--to-intel`. Independent of `--macos`: `--macos` alone leaves these instructions as they are. Conflicts with `--windows`.                                                    |
 | `unused-filter=0`             | Keep all imported NID references.                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | `unused-filter=1`             | Filter unused non-PLT imports using control-flow and GOT access analysis, treating address-taken code as reachable; preserve PLT imports.                                                                                                                                                                                                                                                                                                                                   |
 | `unused-filter=2`             | Apply strict unused-import analysis and compact the PLT. Unsupported analysis cases cause an error.                                                                                                                                                                                                                                                                                                                                                                         |
@@ -75,7 +77,7 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath`
 | `--rpath <path>`              | Set the system library search path. Quote `$ORIGIN` to prevent shell expansion, for example `--rpath '$ORIGIN/libs'` in Bash or PowerShell. Linux guest modules require an absolute path or a path beginning with `$ORIGIN`. Windows requires a nonempty ASCII path and supports `$ORIGIN` as the executable directory.                                                                                                                                                     |
 | `--autorun`                   | Run the output after conversion, print its exit code, and wait for Enter. Adds executable permissions for Linux output. Requires the target OS and prepared runtime layout.                                                                                                                                                                                                                                                                                                 |
 | `--sce-module-path <path>`    | Parent of the module directories, not the module directory itself. Default: input ELF parent; relative input paths resolve from the process working directory. Explicit absolute path: used directly. Explicit relative path (including `.` and `..`): relative to the process working directory. Output path has no effect. Requires one nonempty value; repeats, nonexistent or nondirectory paths, access failures, and combination with `--skip-sce-module` are errors. |
-| `--module-dir <dir>`          | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. A module another module needs is initialized at startup, and on Linux and macOS also one the executable needs; any other when the title loads it with `sceKernelLoadStartModule`, with its start arguments (for example Unity plugins in `Media/Plugins`, or `mono-ps4.sprx` on Windows). Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`.  |
+| `--module-dir <dir>`          | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. Needed modules are mapped at startup. On Linux, modules in these extra directories initialize only when explicitly loaded, with the arguments from `sceKernelLoadStartModule` (for example Unity plugins in `Media/Plugins`). A module another module needs initializes at startup on Windows and macOS; one only the executable needs initializes when explicitly loaded on Windows and at startup on macOS. Other modules initialize when loaded. Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`.  |
 | `--executable <path>`         | Also convert another executable of the title, which it starts with `sceSystemServiceLoadExec`; the path is relative to the module parent directory, for example `picker/picker.bin`. It is written beside the output, named after the path with `/` replaced by `.` and given the output's extension (`picker.picker.bin.exe`), and uses the same `libs/`, `app0/` and guest modules. It is an error if a guest module converts differently for it. Repeatable. Conflicts with `--skip-sce-module`. |
 | `--patches <file>`            | Apply the byte patches of this file during conversion, see [game patches](#game-patches). Overrides `relinker-patches.toml` discovery. Conflicts with `--no-patches`. |
 | `--no-patches`                | Do not apply patches, and do not load `relinker-patches.toml` from the input directory. |
@@ -85,6 +87,7 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath`
 | `--exclude-sce-module <file>` | Deprecated. Exclude a bundled module by exact filename, not path. Repeat for multiple files; a missing filename is an error. Conflicts with `--skip-sce-module`.                                                                                                                                                                                                                                                                                                            |
 | `--skip-syscall-check`        | Deprecated. Disable syscall scanning in the executable and bundled modules.                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `--trap-sdk-syscall-stubs`    | Replace the exact ps5-payload-dev generic and numbered syscall wrapper stubs and the recognized inline mmap/mprotect sequences from SDK libc/mman.c with `UD2`, so unused wrappers do not block relinking. Other syscall instructions still cause an error. If a trapped wrapper runs, it raises an illegal-instruction exception. For debugging only.                                                                                                                                                                    |
+| `--frame-red-zone`            | Windows only: give leaf functions that keep values below RSP (the System V red zone) a frame, so an exception Windows delivers on a guest thread cannot overwrite them. Covers leaves with a `push rbp; mov rbp, rsp; push ...` prologue and leaves that only push registers, with or without a `sub` allocation after the pushes; in those, RSP is lowered only as far as the leaf reaches below it and their RSP operands are moved with it, in place or, when their encoding cannot hold the moved displacement, in a stub. Function bounds come from the executable's `.eh_frame`, and the relinker stops with an error when it has none. The relinker prints how many it framed and why it skipped the others, and refuses a game patch over a framed site. |
 | `--lazy-binding`              | Deprecated. Enable lazy symbol binding instead of eager binding. Incompatible with bundled ELF modules. The Linux executable stays position independent (`ET_DYN`) instead of being placed at `0x400000`. |
 
 Specify `unused-filter=0|1|2` without `--`, at most once. Unknown options and extra positional arguments are errors. Use `relinker --help` to print the usage syntax to stdout and exit with code `0` without converting files. Invoking `relinker` without arguments prints the usage syntax to stderr and exits with code `1`.
@@ -97,6 +100,32 @@ The `--skip-sce-module`, `--exclude-sce-module <file>`, `--skip-syscall-check`,
 
 A patch file changes bytes of the input executable or of a bundled module before conversion, for a title that hard-codes a value the host cannot meet. The relinker checks the bytes it replaces, so a patch for another version of the title fails instead of corrupting it. With no patch file the output is unchanged.
 
+The advisor requires Python 3.11 or newer. To check a local patch catalog, run:
+
+```sh
+python3 tools/suggest_patches.py --catalog <directory> --param-json <sce_sys/param.json> --input <input.elf> --relinker <relinker> [--sce-module-path <directory>] [--module-dir <directory>]... [--executable <path>]... [--skip-sce-module] [--timeout-seconds <seconds>]
+```
+
+The advisor reads `titleId` and `contentVersion` from the specified `param.json`, checks the SHA-256 of every file targeted by a candidate patch, then calls the relinker specified by `--relinker` to run `--verify-patches`. A relative path such as `--relinker ./relinker` resolves to that local file. The explicit metadata path also works when `param.json` and the unwrapped ELF files are stored separately. The catalog directory must contain an `index.json` with `format: 1` and an `entries` array. Each entry has `titleId`, `contentVersion`, a relative `patch` path, and `targets` mapping every patch target to its SHA-256. Hexadecimal digests are case-insensitive. For example:
+
+```json
+{
+  "format": 1,
+  "entries": [{
+    "titleId": "TEST00001",
+    "contentVersion": "01.000.000",
+    "patch": "patch.toml",
+    "targets": {"Media/Modules/module.prx": "<SHA-256 in hexadecimal>"}
+  }]
+}
+```
+
+The advisor validates patch files only for entries matching the requested title and version. It reports and skips a malformed matching entry or a relinker verification error, so another valid entry can still be recommended. Verification times out after 120 seconds per entry by default; use `--timeout-seconds <positive integer>` to change the limit. For synthetic inputs without system modules, use `--skip-sce-module` if conversion also uses it; this option conflicts with `--sce-module-path`. No matching entry or no verified patch exits `1`; invalid input or no verified patch after a relinker error exits `2`. If multiple entries verify, the advisor recommends none because it cannot choose or combine them. The tool does not fetch or apply patches. A recommendation prints `--patches` and the module and executable options to use when converting. Keep catalog patch files outside the input executable's directory to avoid automatic `relinker-patches.toml` discovery.
+
+The target hashes identify the exact unwrapped files changed by a patch, which might not include the main executable. Different dump tools could produce different bytes for the same title version; the advisor then rejects a patch even if it would work. It has not been confirmed that all dump tools produce identical files. The hashes do not authenticate a catalog or establish that a patch is safe or that the title is fully playable. Use catalogs from sources you trust and review the patch before applying it.
+
+If the patch targets another title executable, pass `--executable <path>` to the advisor for each additional executable, using paths relative to the module parent directory, such as `picker/picker.bin`. The advisor hashes those target files and forwards the same options to `relinker --verify-patches`. Use the same `--executable` options when converting with `--patches`.
+
 `relinker-patches.toml` in the directory of the input executable is loaded automatically and announced as `Patches: <path>`. `--patches <file>` names another file, and `--no-patches` loads none. Each applied patch is reported:
 
 ```
@@ -166,15 +195,15 @@ app0/
         <converted modules>
 ```
 
-Use `sce_modules/` or `prx/` instead of `sce_module/` if that is the input directory name. Relinker preserves each module's directory under `app0/` and prints its exact path. Place app resources in `app0/` separately, including the title's original `eboot.bin`: titles test `/app0/eboot.bin` to find their own directory, as it is always present on the console (ProsperoTV, ProsperoRadio, ProsperoLight and ProsperoLichess fall back to an empty `/data/homebrew/<title id>` and fail to load their fonts without it). Only the converted executable runs. On Linux, `app0/` must not contain symbolic links: a directory listing gives the title the link's own type, not the type of the file or directory it points to, so a title that walks its directories skips a linked directory. Use copies or hard links. Copy the built system libraries from `build/core/libs/libs/*.prx` into `libs/`; use libraries built for the target OS. A custom `--rpath` changes the system library location.
+Use `sce_modules/` or `prx/` instead of `sce_module/` if that is the input directory name. Relinker preserves each module's directory under `app0/` and prints its exact path. Place app resources in `app0/` separately, including the title's original `eboot.bin`: titles test `/app0/eboot.bin` to find their own directory, as it is always present on the console (ProsperoTV, ProsperoRadio, ProsperoLight and ProsperoLichess fall back to an empty `/data/homebrew/<title id>` and fail to load their fonts without it). Only the converted executable runs. On Linux, a symbolic link inside the `app0/` tree is listed with the type of the file or directory it points to, so a linked directory is walked like a real one. Links inside a linked directory whose target is outside `app0/` keep the link type; for nested trees, link only the top-level entries or use copies or hard links. Copy the built system libraries from `build/core/libs/libs/*.prx` into `libs/`; use libraries built for the target OS. A custom `--rpath` changes the system library location.
 
 Some applications also need their original `app0/sce_sys/param.json` at runtime. AnyPS5 reads this file for the title ID and display name; it must contain a non-empty `titleId` string and a non-empty `localizedParameters` object with a language entry that has a non-empty `titleName`. It selects the entry named by `defaultLanguage` (inside `localizedParameters`, or at the top level); if that entry is absent, it tries `en-US`, then the first object-valued language entry. Preserve the values from the title's own metadata and place the file under the same `app0/` directory as the other app resources. At startup, its presence in the working directory creates `data/`; a non-zero `downloadDataSize` also creates `download0/`. Without the file, neither directory is created. If it is missing or invalid, metadata calls such as title/window setup can fail with a `param.json` error.
 
 Resources can also be packed into `app0.zar` beside `app0/`, a [ZArchive](https://github.com/Exzap/ZArchive) whose root is the `app0/` directory. A file present in `app0/` is read from there and any other file from the archive; the executable, `sce_module/` and `sce_sys/` stay in `app0/`. The archive is read only through `sceKernelOpen`/`open`, the read, seek and stat calls on its descriptors and `sceKernelStat`; other calls on an archived path, listing a directory that the archive also contains and opening a file in it for writing fail as described in [technical debt](../dev/debt/libkernel.md). An archive that cannot be opened stops the title at its first file access.
 
-Use the generated files printed as `Guest module:` for bundled title modules. `libs/` is for AnyPS5 system libraries, not the original PS5 `.prx` files. Placing an original PS5 module in `libs/` on Windows makes Windows try to load it as a DLL and can fail with error 193 (not a valid Win32 application).
+Use the generated files printed as `Guest module:` for bundled title modules. `libs/` is for AnyPS5 system libraries, not the original PS5 `.prx` files. Placing an original PS5 module in `libs/` on Windows makes Windows try to load it as a DLL and can fail with error 193 (not a valid Win32 application). A module the title loads while it runs that was not relinked, such as one in a directory not given to `--module-dir`, is not loaded either: the title gets an error and continues, and the runtime prints `[module] dlopen: <path> was not relinked: ...` once for each file. Relink that module's directory with `--module-dir <dir>`.
 
-On Windows, a self-built `libs/` also needs `libgcc_s_seh-1.dll`, `libstdc++-6.dll` and `libwinpthread-1.dll` from the `mingw64/bin` directory of the toolchain that built the libraries; the release archives already contain them. The libraries are loaded without searching `PATH`, so a copy elsewhere on the system is not used, and a library that needs one of them fails with error 126 (the specified module could not be found) although its `.prx` file is present.
+On Windows, a self-built `libs/` also needs `libgcc_s_seh-1.dll`, `libstdc++-6.dll` and `libwinpthread-1.dll` from the `mingw64/bin` directory of the toolchain that built the libraries; the release archives already contain them. The libraries are loaded without searching `PATH`, so a copy elsewhere on the system is not used, and a library that needs one of them fails with error 126 (the specified module could not be found) although its `.prx` file is present. With `APS5_MIMALLOC` set, the title loads `mimalloc.dll` and `mimalloc-redirect.dll` from `libs/` and allocates through mimalloc. Copy both from `build/core/libs/libs`; the release archives contain them. Without them the title keeps the C runtime's heap and prints nothing.
 
 On Windows, direct memory (`sceKernelAllocateDirectMemory`, up to 13824 MiB per title) is committed when the title maps it, not when the title allocates it or first uses its pages. The system commit limit (installed memory plus page file size, the second value of Committed in Task Manager) must cover the mapped direct memory together with all other committed memory. Otherwise `sceKernelMapDirectMemory` throws `replace guest placeholder with resident direct memory` with the Windows error (`commit direct memory pages` when a page is mapped at a second address, `keep unmapped direct memory` when it is unmapped); enlarge the page file or close other applications.
 
@@ -216,11 +245,12 @@ python3 tools/pad_input.py /tmp/anyps5-pad release
 python3 tools/pad_input.py /tmp/anyps5-pad release --left-stick 128 0 --hold-ms 2000
 python3 tools/pad_input.py /tmp/anyps5-pad cross --left-stick 255 128 --right-stick 0 128
 python3 tools/pad_input.py /tmp/anyps5-pad touch-right
+python3 tools/pad_input.py /tmp/anyps5-pad l1+r1
 ```
 
 For timed button sequences, see [Controller timelines](INPUT_MAPPING.md#controller-timelines).
 
-Run the helper in a second terminal. Commands are polled at most every 100 ms during controller reads, and their buttons add to physical controller input. A press lasts 300 ms by default, starting when the application reads it, and releases automatically; `--hold-ms` accepts 1–5000 ms. `--left-stick X Y` and `--right-stick X Y` hold the sticks for the same time: each axis is 0-255, 128 is the centre, X grows to the right and Y grows downward. While such a command is active both sticks come from it instead of the physical controller, and a stick that was not named stays centred. `touch-left` and `touch-right` press the touchpad with a finger on its left or right half, as the `TouchLeft` and `TouchRight` keys do; in the command file they are bits `0x200000` and `0x400000` of the button field. Wait for the application to observe a release before sending another press. The file holds only the latest command; rapid commands can replace one another. On POSIX, replacing an existing command file retains its permission mode; a privileged helper also retains its owner and group so the game user can still read it. Commands left over when the application first reads the controller are ignored. Without the environment variable, file input is disabled.
+Run the helper in a second terminal. Commands are polled at most every 100 ms during controller reads, and their buttons add to physical controller input. A press lasts 300 ms by default, starting when the application reads it, and releases automatically; `--hold-ms` accepts 1–5000 ms. `--left-stick X Y` and `--right-stick X Y` hold the sticks for the same time: each axis is 0-255, 128 is the centre, X grows to the right and Y grows downward. While such a command is active both sticks come from it instead of the physical controller, and a stick that was not named stays centred. `touch-left` and `touch-right` press the touchpad with a finger on its left or right half, as the `TouchLeft` and `TouchRight` keys do; in the command file they are bits `0x200000` and `0x400000` of the button field. Button names joined by `+`, such as `l1+r1`, are pressed together in one command; `release` cannot be joined. Wait for the application to observe a release before sending another press. The file holds only the latest command; rapid commands can replace one another. On POSIX, replacing an existing command file retains its permission mode; a privileged helper also retains its owner and group so the game user can still read it. Commands left over when the application first reads the controller are ignored. Without the environment variable, file input is disabled.
 
 ### Video-out and pad telemetry
 
@@ -290,8 +320,14 @@ Recompiled shaders and the Vulkan pipeline cache are kept in a `shader_cache/` d
 
 Besides the recompiled shaders, the shader cache directory holds `pipelines.journal`: every Vulkan graphics pipeline the pipeline store kept and every compute pipeline a run built, with the specialized shader modules they were built from. The next run of the title builds those pipelines on background threads while it loads, so a draw or dispatch the earlier run already made does not compile its pipeline when it is first reached. The journal belongs to the GPU and driver that wrote it, like the driver's pipeline cache file next to it: a run on another GPU or driver version starts it over, and the driver's own pipeline cache decides how fast each pipeline is rebuilt. Two runs sharing the directory take turns on `pipelines.journal.lock`; a run that cannot lock it records nothing. `APS5_NO_PIPELINE_JOURNAL=1` disables recording and replay; `APS5_PIPELINE_JOURNAL_THREADS` sets the replay threads (half the CPU threads by default; `0` records without replaying), `APS5_PIPELINE_JOURNAL_ENTRIES` how many pipelines are replayed (the first recorded, which a run reaches first) and `APS5_PIPELINE_STORE_ENTRIES` how many graphics pipelines stay resident (1024 each), and `APS5_PIPELINE_JOURNAL_MAX_MIB` (1024) the file size at which recording stops. Deleting the file loses nothing but the head start. With `APS5_PROFILE_DRAW=1` a `[pipeline-journal]` line reports what was loaded, replayed and recorded.
 
+### Draw pipeline
+
+`APS5_DRAW_PIPELINE=1` (off by default) moves more of each draw off the thread that reads the title's command buffers: a second thread finishes each draw while the next one is read, the thread that records draws skips work whose inputs did not change, and checks that a draw's resources are still current are reused until the title or the GPU writes memory. It is meant with `APS5_PIPELINED_DRAWS=32 APS5_PIPELINE_DISPATCH=1`. The picture does not change; if it does, that is a bug, and a run without the switch shows whether it is the cause. `APS5_VERIFY_DRAW_PIPELINE=1` runs the full checks next to the reused ones, at a cost in speed, and prints `[epoch-proofs]` lines with how many differed (any nonzero count is a bug). `APS5_PROFILE_DRAW=1` finishes every draw on the reading thread, so a run with it does not measure this switch. To see the hand-off without that, set `APS5_PIPELINE_STATS` (any value; `1` also turns on Vulkan pipeline statistics, which cost time): every 10 s a `[finisher]` line counts the draws handed to the second thread and those finished on the reading thread, and `[finisher-held]` lines count the draws held back by why their writes are not known.
+
 ### Texture cache budget
 
+Image and buffer memory allocations retry after releasing unused pooled buffers and reclaimable texture cache entries. Recovery preserves storage images with pending GPU results and resources retained by recorded work. `[bufferpool]` recovery and failure lines report the requested allocation, memory released and retry count. An allocation still fails if recovery cannot free enough memory.
+
 Sampled textures and storage images stay in device memory in two caches that evict their least recently used entries when they grow past their budgets. The storage image budget is what the `VK_EXT_memory_budget` budget of the largest device-local heap leaves after the heap's use other than the cached storage images themselves and an eighth of the budget; it is capped at a quarter of that budget, at most a quarter of the heap's size or 2 GiB, whichever is larger, and never below 512 MiB. The sampled texture budget is what the reported budget leaves after the heap's use other than cached textures, a quarter of the heap's size (at least 2 GiB) and an eighth of the budget, and never below 2 GiB. As the heap's other use grows the sampled budget falls first, to that floor, then the storage budget; the storage budget also gives back what the sampled textures alive take as they grow. Each cache trims at its next insert. Both budgets are read again every second; `[gpu] sampled texture cache budget` lines report them at start-up and when either moves by more than a tenth, at most every 10 s. `APS5_TEXTURE_CACHE_MIB=<n>` fixes both budgets at `n` MiB, and the lines are then not printed.
 
 A fixed budget above the automatic one can exceed what the card holds next to the rest of the frame. Allocations then go to host memory (`[gpu] ... placed in host memory` lines), where the GPU reads them over PCIe. PPSA16064 on an RTX 4060 8 GB, whose automatic storage image budget was 1797 MiB under the earlier rule, placed 868 and 878 MiB in host memory with `APS5_TEXTURE_CACHE_MIB=3072` and walked through its first level at 4.46 and 4.83 FPS; with the variable unset it placed none and ran the same walk at 6.48 and 6.07 FPS. Leave it unset unless a measurement on the card shows otherwise.
@@ -380,6 +416,8 @@ python3 tools/import_audit.py app.registry.json app.libc.prx.guest.prx.registry.
 | `absent` | No built library exports the NID: the loader fails. |
 | `module` | The import names a file found in `--modules` (the title's own library), which is trusted to provide it. |
 
+An import that names a library requires the literal export name. If its implementation is found only by hashing the import name, it still counts as `implemented` or `stub`, but the report lists the name mismatch, sets `symbol_mismatch` on the JSON import record and counts it in the summary, and exits with code 1. A strong import with a name mismatch is a current stop. Imports without a library retain the audit's name-to-NID fallback.
+
 Module registries mark ELF weak imports with `"weak": true`, allowing the audit's current-stop selection to skip them. Strong imports omit the field. Older module registries do not preserve weak bindings; regenerate them to distinguish optional imports.
 
 ELF modules in `--modules` are audited regardless of filename: their undefined symbols are classified against the built libraries and the other modules' exports, with the module file named in the report, and the libraries they need must have a file in `--libs` or `--modules`. Ordinary non-module sidecars are ignored; malformed ELF, PE/SELF containers and non-ELF files with module extensions remain errors. The audit reads dynamic tables from ELF section headers or, for sectionless files, from `PT_DYNAMIC` and a SysV or GNU hash table.
diff --git a/tools/build_web.py b/tools/build_web.py
index 66798820d2..8a5e555bf0 100644
--- a/tools/build_web.py
+++ b/tools/build_web.py
@@ -4,6 +4,7 @@ import io
 import json
 import os
 from pathlib import Path
+import sys
 import re
 import shutil
 import tempfile
@@ -141,7 +142,7 @@ def publish_release(output):
                 target.parent.mkdir(parents=True, exist_ok=True)
                 target.write_bytes(archive.read(file))
         publish_libraries(staging, release)
-        manifest = json.loads((staging / "release.json").read_text(encoding="utf-8"))
+        manifest = json.loads((staging / "release.json").read_text(encoding="utf-8-sig"))
         manifest["revision"] = metadata["revision"]
         (staging / "release.json").write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
         (staging / ".nojekyll").touch()
@@ -163,23 +164,30 @@ def publish_release(output):
     print(f"Published web converter and libraries from {tag} ({metadata['revision']})")
 
 
-def main():
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser()
     parser.add_argument("--build", type=Path, required=True)
     parser.add_argument("--release", "--libraries", dest="release", action="store_true",
                         help="Download the matching converter and libraries from the latest release")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     output = args.build.resolve() / "web"
-    if args.release:
-        publish_release(output)
+    try:
+        if args.release:
+            publish_release(output)
+            print(output)
+            return 0
+        for name in ("relinker_wasm.mjs", "relinker_wasm.wasm"):
+            if not (output / "native" / name).is_file():
+                parser.error(f"Build relinker_wasm first: missing {name}")
+        copy_sources(output)
         print(output)
-        return
-    for name in ("relinker_wasm.mjs", "relinker_wasm.wasm"):
-        if not (output / "native" / name).is_file():
-            raise ValueError(f"Build relinker_wasm first: missing {name}")
-    copy_sources(output)
-    print(output)
+        return 0
+    except (OSError, ValueError) as error:
+        parser.error(str(error))
 
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main())
diff --git a/tools/check_compile.py b/tools/check_compile.py
index a251673abf..c2c0befc3a 100644
--- a/tools/check_compile.py
+++ b/tools/check_compile.py
@@ -40,19 +40,53 @@ def repository():
     return Path(result.stdout.strip())
 
 
+def validate_arguments(arguments):
+    if not isinstance(arguments, list) or not arguments or any(not isinstance(argument, str) for argument in arguments) or not arguments[0]:
+        raise ValueError("arguments must be a nonempty list of strings with an executable")
+
+
+def compilation_database(text, source, skip_empty_commands=False):
+    database = json.loads(text)
+    if not isinstance(database, list):
+        raise ValueError(f"{source}: expected an array of command objects")
+    commands = []
+    for index, entry in enumerate(database):
+        context = f"{source}: entry {index}"
+        if not isinstance(entry, dict):
+            raise ValueError(f"{context}: expected a command object")
+        for field in ("directory", "file"):
+            if field not in entry:
+                raise ValueError(f"{context}: missing {field}")
+            if not isinstance(entry[field], str) or not entry[field]:
+                raise ValueError(f"{context}: {field} must be a nonempty string")
+        if skip_empty_commands and "arguments" not in entry and entry.get("command") == "":
+            continue
+        if "arguments" in entry:
+            try:
+                validate_arguments(entry["arguments"])
+            except ValueError as error:
+                raise ValueError(f"{context}: {error}") from error
+        elif "command" not in entry:
+            raise ValueError(f"{context}: expected arguments or command")
+        elif not isinstance(entry["command"], str) or not entry["command"].strip():
+            raise ValueError(f"{context}: command must be a nonempty string")
+        commands.append(entry)
+    return commands
+
+
 def entries(build):
     if not build.is_dir():
         raise ValueError(f"{build} is not a directory; configure the build first")
     manifest = build / "compile_commands.json"
     if manifest.is_file():
-        return json.loads(manifest.read_text(encoding="utf-8"))
+        return compilation_database(manifest.read_text(encoding="utf-8-sig"), manifest)
     ninja = shutil.which("ninja")
     if ninja is None:
         raise ValueError(f"no {manifest} and ninja is not on PATH")
     result = capture([ninja, "-C", str(build), "-t", "compdb", "-x"], encoding=ninja_encoding(ninja))
     if result.returncode != 0:
         raise ValueError(f"ninja -t compdb: {result.stderr.strip()}")
-    return json.loads(result.stdout)
+    return compilation_database(result.stdout, "ninja -t compdb", skip_empty_commands=True)
 
 
 def entry_key(entry, root):
@@ -116,8 +150,7 @@ def syntax_only(entry, source):
 
 
 def syntax_arguments(arguments, directory, source):
-    if not isinstance(arguments, list) or not arguments or any(not isinstance(argument, str) for argument in arguments) or not arguments[0]:
-        raise ValueError("arguments must be a nonempty list of strings with an executable")
+    validate_arguments(arguments)
     for argument in arguments[1:]:
         if argument.startswith("@"):
             raise ValueError(f"unexpanded response file {argument[1:]}; provide expanded compile arguments before checking syntax")
diff --git a/tools/check_conventions.py b/tools/check_conventions.py
index bc985e1480..fb378cda0d 100644
--- a/tools/check_conventions.py
+++ b/tools/check_conventions.py
@@ -171,6 +171,7 @@ class Check:
             core = path.startswith("core/") and "tests" not in PurePosixPath(path).parts
             source = self.show(path).split("\n")
             masked = cpp_text("\n".join(source), preserve_comments=True).split("\n")
+            assembly = asm_exports("\n".join(source)) if core and path.startswith("core/libs/prx/") else {}
             for number, text in lines:
                 bare = masked[number - 1]
                 if ("//" in bare or "/*" in bare) and not ALLOWED_COMMENT.match(bare):
@@ -182,6 +183,7 @@ class Check:
                 if core and path.startswith("core/libs/prx/"):
                     unknowns.extend((nid, name, path, number) for nid, name in source_aliases(text) if "unknown" in name.lower())
                     symbols.extend((symbol, path, number) for symbol in nid_symbols(text))
+                exports.update((name, (path, number)) for name in assembly.get(number, ()) if not name.endswith(("_nid_no_patch", "_nid_no_patch_cut")))
                 match = EXPORT.search(bare)
                 if match and core and path.startswith("core/libs/prx/") and not match.group(1).endswith(("_nid_no_patch", "_nid_no_patch_cut")):
                     source = source or self.show(path).splitlines()
@@ -212,17 +214,18 @@ class Check:
         self.read(paths)
         for path in paths:
             text = self.show(path)
-            if "APS5_VABI" not in text:
+            if "APS5_VABI" not in text and "ASM_FUNCTION" not in text:
                 continue
             source = cpp_text(text).split("\n")
+            assembly = asm_exports(text)
             for number, line in enumerate(source):
-                for match in EXPORT.finditer(line):
-                    name = match.group(1)
-                    if name not in exports:
-                        continue
+                names = [match.group(1) for match in EXPORT.finditer(line)
+                         if match.group(1) in exports and library(path) != library(exports[match.group(1)][0])
+                         and function_body(source, number) is not None]
+                names += [name for name in assembly.get(number + 1, ()) if name in exports and library(path) != library(exports[name][0])]
+                for name in names:
                     own, own_number = exports[name]
-                    if library(path) != library(own) and function_body(source, number) is not None:
-                        self.report("duplicate-export", own, own_number, f"{name} is also in {library(path)}")
+                    self.report("duplicate-export", own, own_number, f"{name} is also in {library(path)}")
 
     def unknown_nids(self, unknowns, symbols):
         if not unknowns and not symbols:
@@ -340,7 +343,7 @@ class Check:
         doc = "docs/dev/ENVIRONMENT.md"
         added, removed, dropped = {}, set(), set()
         path, number, in_hunk = "", 0, False
-        for line in git("diff", "-U0", self.base, self.head, "--", "core", doc).splitlines():
+        for line in git("diff", "-U0", self.base, self.head, "--", ":(top)core", f":(top){doc}").splitlines():
             if line.startswith("diff --git"):
                 path, in_hunk = "", False
             elif line.startswith("@@"):
@@ -358,14 +361,14 @@ class Check:
                     removed.update(match.group("name") for _, match in env_reference.line_reads(line[1:]))
             elif line.startswith("+++ b/"):
                 path = line[6:]
-        result = subprocess.run(["git", "grep", "-nE", env_reference.GREP, self.head, "--", "core"],
+        result = subprocess.run(["git", "grep", "-nE", "--full-name", env_reference.GREP, self.head, "--", ":(top)core"],
                                 capture_output=True, encoding="utf-8", errors="replace")
         reads = set()
         for line in result.stdout.splitlines():
             reads.update(match.group("name") for _, match in env_reference.line_reads(line))
         pattern = env_reference.documented_pattern(env_reference.PREFIXES)
         documented = set(pattern.findall(self.show(doc))) if doc in self.tree else set()
-        if git("ls-tree", "--name-only", self.target, "--", doc).strip() == doc:
+        if git("ls-tree", "--full-tree", "--name-only", self.target, "--", doc).strip() == doc:
             documented |= set(pattern.findall(git("show", f"{self.target}:{doc}"))) - dropped
         for name, (source, line) in sorted(added.items()):
             if name not in documented:
@@ -517,6 +520,16 @@ def symbol_nid(name):
     return compute_nid(base) if base else None
 
 
+def asm_exports(text):
+    tokens = [match for match in CPP_TOKEN.finditer(text) if match.group("comment") is None]
+    exports = defaultdict(list)
+    for index, match in enumerate(tokens[:-2]):
+        name = tokens[index + 2].group()[1:-1]
+        if match.group() in ("APS5_ASM_FUNCTION", "APS5_SIGNAL_ASM_FUNCTION") and tokens[index + 1].group() == "(" and tokens[index + 2].group("string") is not None and IDENTIFIER.fullmatch(name):
+            exports[text.count("\n", 0, tokens[index + 2].start()) + 1].append(name)
+    return exports
+
+
 def nid_symbols(text):
     tokens = [match for match in CPP_TOKEN.finditer(text) if match.group("comment") is None]
     names = []
diff --git a/tools/check_main_sync.py b/tools/check_main_sync.py
index e1f41677d7..f6d7532082 100644
--- a/tools/check_main_sync.py
+++ b/tools/check_main_sync.py
@@ -52,6 +52,7 @@ def merged_pull_requests(repo, mergebase, base, paths):
 
 
 def report(repo, base, head):
+    repo = git(repo, "rev-parse", "--show-toplevel").stdout.strip()
     found = git(repo, "merge-base", base, head, check=False)
     if found.returncode:
         raise RuntimeError(f"{head} and {base} have no common ancestor")
@@ -88,14 +89,17 @@ def render(data):
     return "\n".join(out)
 
 
-if __name__ == "__main__":
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(errors="backslashreplace")
     parser = argparse.ArgumentParser(description="report whether a branch is in step with the upstream main before you push or test")
     parser.add_argument("--base", help="the main ref to compare against (default: upstream/main, then origin/main, then main)")
     parser.add_argument("--head", default="HEAD", help="the branch or commit to check (default: HEAD)")
     parser.add_argument("--repo", type=Path, default=Path("."), help="the repository to check (default: the current directory)")
     parser.add_argument("--fetch", action="store_true", help="fetch the base's remote first")
     parser.add_argument("--strict", action="store_true", help="also fail when the branch is behind the base")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     try:
         def fetch(ref):
             remote, _, branch = ref.partition("/")
@@ -117,9 +121,11 @@ if __name__ == "__main__":
         data = report(args.repo, base, args.head)
     except RuntimeError as error:
         parser.error(str(error))
-    sys.stdout.reconfigure(errors="backslashreplace")
     print(render(data))
-    if data["conflicts"]:
-        raise SystemExit(1)
-    if args.strict and data["behind"]:
-        raise SystemExit(1)
+    if data["conflicts"] or (args.strict and data["behind"]):
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/check_skips.py b/tools/check_skips.py
index 99628018e3..d29c91b065 100644
--- a/tools/check_skips.py
+++ b/tools/check_skips.py
@@ -1,3 +1,4 @@
+import sys
 import argparse
 import re
 import xml.etree.ElementTree as ET
@@ -26,7 +27,10 @@ def high_refresh_limitation(output):
 
 
 def skips(path):
-    for case in ET.parse(path).getroot().iter("testcase"):
+    root = ET.parse(path).getroot()
+    if root.tag not in ("testsuite", "testsuites"):
+        raise ValueError(f"{path}: expected a JUnit testsuite or testsuites root, got {root.tag!r}")
+    for case in root.iter("testcase"):
         if case.get("status") == "disabled":
             raise ValueError(f"{path}: testcase {case.get('name')!r} is disabled and was not run")
         skipped = case.find("skipped")
@@ -40,12 +44,15 @@ def skips(path):
         yield name, "\n".join(output)
 
 
-if __name__ == "__main__":
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="fail when a test is skipped that the job's device is not expected to skip")
     parser.add_argument("junit", type=Path, help="the file written by ctest --output-junit")
     parser.add_argument("--job", choices=("linux", "windows"), default="linux")
     parser.add_argument("--list", action="store_true", help="print the skipped tests and why the file says they skipped")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     try:
         found = sorted(skips(args.junit))
     except (OSError, ET.ParseError, ValueError) as error:
@@ -54,7 +61,7 @@ if __name__ == "__main__":
         for name, output in found:
             reason = next((line.strip() for line in output.splitlines() if line.strip().lower().startswith("skipped")), "")
             print(f"{name}: {reason}")
-        raise SystemExit
+        return 0
     if args.job == "windows":
         unexpected = [name for name, output in found if not name.startswith(WINDOWS_PREFIX) and not NO_DISPLAY.search(output) and not NO_VULKAN_DEVICE.search(output) and not high_refresh_limitation(output)]
         expected = f"any {WINDOWS_PREFIX}* test, which the runner has no Vulkan driver for, or a test that reports no display or Vulkan device or a display without a 120 Hz mode"
@@ -65,5 +72,10 @@ if __name__ == "__main__":
         print(f"error: {name} skipped")
     if unexpected:
         print(f"{len(unexpected)} test(s) skipped for a reason that is not expected: the job lost that coverage and ctest still reports every test as passed")
-        raise SystemExit(1)
+        return 1
     print(f"{len(found)} test(s) skipped, all expected ({expected})")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/check_test_registration.py b/tools/check_test_registration.py
index fcce86cbd1..e74e2f72e6 100644
--- a/tools/check_test_registration.py
+++ b/tools/check_test_registration.py
@@ -16,7 +16,7 @@ SCRIPT = re.compile(r"(?:[\w.-]+/)*test_\w+\.py")
 
 def built(build):
     program, generator = None, None
-    for line in (Path(build) / "CMakeCache.txt").read_text(encoding="utf-8").splitlines():
+    for line in (Path(build) / "CMakeCache.txt").read_text(encoding="utf-8-sig").splitlines():
         if line.startswith("CMAKE_MAKE_PROGRAM:"):
             program = line.partition("=")[2]
         elif line.startswith("CMAKE_GENERATOR:"):
@@ -81,7 +81,7 @@ def commands(content):
                 argument = re.sub(r"\\(.)", lambda match: {"n": "\n", "r": "\r", "t": "\t"}.get(match[1], match[1]), argument[1:-1], flags=re.S)
             elif token.group("equals") is not None:
                 width = len(token.group("equals")) + 2
-                argument = argument[width:-width]
+                argument = argument[width:-width].removeprefix("\n")
             arguments.append(argument)
             position = token.end()
 
@@ -157,21 +157,24 @@ def unrun_scripts(root):
     return scripts, [name for name in scripts if not any(name == path or name.endswith("/" + path) for path in run)]
 
 
-if __name__ == "__main__":
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="fail when a test executable is built that no ctest test runs")
     parser.add_argument("build", type=Path, nargs="?", default=Path("build"), help="configured build directory")
     parser.add_argument("--list", action="store_true", help="print every test executable and whether ctest runs it")
     parser.add_argument("--scripts", action="store_true", help="instead check that an add_test or a workflow runs every test_*.py of the source tree")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     if args.scripts:
         scripts, unrun = unrun_scripts(Path(__file__).resolve().parents[1])
         for name in unrun:
             print(f"error: {name} is a test script that no add_test or workflow runs")
         if unrun:
             print(f"{len(unrun)} test script(s) would never run: register each with add_test, or run it from a workflow")
-            raise SystemExit(1)
+            return 1
         print(f"{len(scripts)} test script(s), each run by an add_test or a workflow")
-        raise SystemExit
+        return 0
     try:
         every = sorted(built(args.build))
         run = registered(args.build)
@@ -180,11 +183,11 @@ if __name__ == "__main__":
     if args.list:
         for name in every:
             print(f"{'run' if name in run else 'NOT RUN'}  {name}")
-        raise SystemExit
+        return 0
     unrun = sorted(set(every) - run)
     if not every:
         print(f"no test executables found under {args.build}; is it configured with -DBUILD_TESTING=ON?")
-        raise SystemExit(1)
+        return 1
     for name in sorted(set(unrun) & KNOWN_UNRUN):
         print(f"note: {name} is built and not run, as recorded")
     stale = sorted(KNOWN_UNRUN & run)
@@ -196,5 +199,10 @@ if __name__ == "__main__":
     if fresh:
         print(f"{len(fresh)} test executable(s) would never run: ctest reports a full pass over what it knows, so a test nobody registered is invisible in CI")
     if stale or fresh:
-        raise SystemExit(1)
+        return 1
     print(f"{len(every)} test executable(s), {len(unrun)} built and not run as recorded, none new")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/configure_seed.py b/tools/configure_seed.py
index d1936ae21a..1dd9e52f29 100644
--- a/tools/configure_seed.py
+++ b/tools/configure_seed.py
@@ -4,7 +4,7 @@ import re
 import sys
 from pathlib import Path
 
-CHECK = re.compile(r"^//(Have (include|includes|function|symbol|library) |Test |Result of (TRY_COMPILE|TRY_RUN|TEST_BIG_ENDIAN|check_))")
+CHECK = re.compile(r"^//(Have (include|includes|function|symbol|library) |Test |Result of (TRY_COMPILE|TRY_RUN|TEST_BIG_ENDIAN|check_)|CHECK_TYPE_SIZE: )")
 ENTRY = re.compile(r"^([^#/:][^:]*):([A-Z]+)=(.*)$")
 
 
@@ -25,7 +25,10 @@ def quote(value):
     return '"' + value.replace("\\", "\\\\").replace('"', '\\"').replace("$", "\\$") + '"'
 
 
-def main():
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Write the configure check results of a CMake cache as an initial cache file")
     parser.add_argument("cache", help="CMakeCache.txt of a configured tree")
     parser.add_argument("seed", help="file to pass to cmake -C")
@@ -33,7 +36,7 @@ def main():
                         help="seed matching check names only; repeat to include several patterns")
     parser.add_argument("--exclude", action="append", default=[], metavar="GLOB",
                         help="omit matching check names after inclusion; patterns are case-sensitive")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     cache, seed = Path(args.cache), Path(args.seed)
     if cache.resolve() == seed.resolve() or (cache.exists() and seed.exists() and cache.samefile(seed)):
         parser.error("seed output would overwrite the input cache")
@@ -44,9 +47,12 @@ def main():
     found = {name: entry for name, entry in results.items()
              if (not args.include or any(fnmatch.fnmatchcase(name, pattern) for pattern in args.include))
              and not any(fnmatch.fnmatchcase(name, pattern) for pattern in args.exclude)}
-    seed.parent.mkdir(parents=True, exist_ok=True)
-    seed.write_text("".join(f"set({quote(name)} {quote(value)} CACHE INTERNAL {quote(doc)})\n"
-                           for name, (value, doc) in sorted(found.items())), encoding="utf-8")
+    try:
+        seed.parent.mkdir(parents=True, exist_ok=True)
+        seed.write_text("".join(f"set({quote(name)} {quote(value)} CACHE INTERNAL {quote(doc)})\n"
+                               for name, (value, doc) in sorted(found.items())), encoding="utf-8")
+    except OSError as error:
+        parser.error(f"{seed}: {error}")
     print(f"{len(found)} check results")
     return 0
 
diff --git a/tools/env_reference.py b/tools/env_reference.py
index 683b1e9168..2cfe032b71 100644
--- a/tools/env_reference.py
+++ b/tools/env_reference.py
@@ -10,13 +10,14 @@ ROOTS = ("core",)
 EXTENSIONS = {".c", ".cc", ".cpp", ".cxx", ".h", ".hh", ".hpp", ".hxx", ".inl", ".ipp", ".py"}
 SKIP = {"build", "build-linux", "build-relinker", "3rdparty", ".git"}
 
-INTEGER_READERS = {"kibSetting", "MaskFromEnvironment", "EnvInt", "configured", "environmentCount"}
+INTEGER_READERS = {"kibSetting", "MaskFromEnvironment", "EnvInt", "configured", "environmentCount", "EnvironmentNumber"}
 STRING_READERS = {"GetEnvironmentVariableA", "GetEnvironmentVariableW", "addWideString"}
-NULL_TEST = re.compile(r"[!=]=\s*(nullptr|NULL|0)\b|!\s*(?:std::)?_?w?getenv\(")
+NULL_TEST = re.compile(r"[!=]=\s*(nullptr|NULL|0)\b|!\s*(?:std::)?_?w?getenv\s*\(")
 INTEGER_TEST = re.compile(r"\b(atoi|strtol|strtoul|strtoll|strtoull|stoi|stol|stoul|from_chars|atoi64|_wtoi|_wtol|_wtoi64)\s*\(")
 GREP = (r'(getenv|_wgetenv|wgetenv|IsEnvironmentSet|kibSetting|MaskFromEnvironment|EnvInt|GetEnvironmentVariable[AW]'
-        r'|configured|PipelineSwitch|environmentCount|addWideString)'
+        r'|configured|PipelineSwitch|environmentCount|EnvironmentNumber|addWideString)'
         r'\([[:space:]]*(u|L)?"(APS5|ANYPS5)_[A-Za-z0-9_]+"')
+GREP = GREP.replace(r"\(", r"[[:space:]]*\(")
 
 
 def _name(prefixes):
@@ -26,7 +27,7 @@ def _name(prefixes):
 @functools.lru_cache(maxsize=None)
 def forms(prefixes=PREFIXES):
     name = _name(prefixes)
-    return (
+    readers = (
         ("getenv", re.compile(r'(?:std::)?getenv\(\s*"(?P<name>' + name + r')"\s*\)')),
         ("_wgetenv", re.compile(r'(?:std::)?_?wgetenv\(\s*L"(?P<name>' + name + r')"\s*\)')),
         ("IsEnvironmentSet", re.compile(r'IsEnvironmentSet\(\s*"(?P<name>' + name + r')"\s*\)')),
@@ -36,10 +37,12 @@ def forms(prefixes=PREFIXES):
         ("configured", re.compile(r'\b(?:configured|PipelineSwitch)\(\s*"(?P<name>' + name + r')"'
                                   r'(?:\s*,\s*(?P<default>[0-9]+)[uUlL]*)?')),
         ("environmentCount", re.compile(r'\benvironmentCount\(\s*"(?P<name>' + name + r')"\s*,\s*(?P<default>[0-9]+)')),
+        ("EnvironmentNumber", re.compile(r'\bEnvironmentNumber\(\s*"(?P<name>' + name + r')"\s*\)')),
         ("GetEnvironmentVariableA", re.compile(r'GetEnvironmentVariableA\(\s*"(?P<name>' + name + r')"')),
         ("GetEnvironmentVariableW", re.compile(r'GetEnvironmentVariableW\(\s*L"(?P<name>' + name + r')"')),
         ("addWideString", re.compile(r'\baddWideString\(\s*u"(?P<name>' + name + r')"\s*\)')),
     )
+    return tuple((reader, re.compile(form.pattern.replace(r"\(", r"\s*\(", 1), form.flags)) for reader, form in readers)
 
 
 def line_reads(line, prefixes=PREFIXES):
@@ -92,10 +95,12 @@ def reads(roots, prefixes=PREFIXES):
                 continue
             lines = text.splitlines()
             for number, line in enumerate(lines, 1):
-                if not any(prefix in line for prefix in prefixes):
-                    continue
                 window = "\n".join(lines[number - 1:number + 2])
-                for reader, match in line_reads(line, prefixes):
+                if not any(prefix in window for prefix in prefixes):
+                    continue
+                for reader, match in line_reads(window, prefixes):
+                    if match.start() >= len(line):
+                        continue
                     found.setdefault(match.group("name"), []).append(
                         (path.as_posix(), number, kind_of(reader, window), default_of(match, window)))
     for sites in found.values():
@@ -158,6 +163,9 @@ def check(found, doc, prefixes, out):
 
 
 def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(
         description="list the environment names the code reads, or check them against a reference document")
     parser.add_argument("--check", action="store_true",
diff --git a/tools/hw-oracle/hw_oracle.py b/tools/hw-oracle/hw_oracle.py
index ffac30f5c7..f1dc2da856 100644
--- a/tools/hw-oracle/hw_oracle.py
+++ b/tools/hw-oracle/hw_oracle.py
@@ -1,5 +1,6 @@
 import argparse
 import hashlib
+import importlib.util
 import json
 import os
 import operator
@@ -17,6 +18,22 @@ CACHE = Path(os.environ.get("HW_ORACLE_CACHE") or Path(os.environ.get("XDG_CACHE
 ROWS_PER_DISPATCH = 1024
 DEFAULT_LDS = 4096
 MAX_LDS = 65536
+RUNTIMES = ("hsa", "hip")
+
+
+def runtime():
+    selected = os.environ.get("HW_ORACLE_RUNTIME") or ("hip" if os.name == "nt" else "hsa")
+    if selected not in RUNTIMES:
+        raise ValueError(f"HW_ORACLE_RUNTIME must be one of {', '.join(RUNTIMES)}")
+    return selected
+
+
+@cache
+def hip_runtime():
+    spec = importlib.util.spec_from_file_location("oracle_hip", HERE / "oracle_hip.py")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
 
 
 def rocm_root():
@@ -78,7 +95,11 @@ def detected_target(binary, visible_devices):
 
 
 def target():
-    return os.environ.get("HW_ORACLE_TARGET") or detected_target(oracle(), os.environ.get("ROCR_VISIBLE_DEVICES"))
+    if os.environ.get("HW_ORACLE_TARGET"):
+        return os.environ["HW_ORACLE_TARGET"]
+    if runtime() == "hip":
+        return hip_runtime().target()
+    return detected_target(oracle(), os.environ.get("ROCR_VISIBLE_DEVICES"))
 
 
 def assemble(body, work, wave64, *, ieee, denorm32, denorm16, dx10_clamp, round32, round16, fp16_overflow, lds=DEFAULT_LDS):
@@ -97,6 +118,9 @@ def assemble(body, work, wave64, *, ieee, denorm32, denorm16, dx10_clamp, round3
                        ("@FP16_OVERFLOW@", str(int(fp16_overflow))), ("@LDS@", str(lds)), ("@BODY@", body)):
         text = text.replace(key, value)
     (work / "k.s").write_text(text)
+    if runtime() == "hip":
+        (work / "k.co").write_bytes(hip_runtime().assemble(text.encode("utf-8"), target(), wave64))
+        return work / "k.co"
     subprocess.run([tool("clang"), "-x", "assembler", "-target", "amdgcn-amd-amdhsa", f"-mcpu={target()}", *(["-mwavefrontsize64"] if wave64 else []), "-c", str(work / "k.s"), "-o", str(work / "k.o")], check=True, stdout=sys.stderr)
     subprocess.run([tool("ld.lld"), "-m", "elf64_amdgpu", "-shared", str(work / "k.o"), "-o", str(work / "k.co")], check=True, stdout=sys.stderr)
     return work / "k.co"
@@ -131,10 +155,14 @@ def run(body, rows, extra=b"", wave64=False, coarse=False, *, ieee, denorm32, de
         rows_per_dispatch = ROWS_PER_DISPATCH // 2 if wave64 else ROWS_PER_DISPATCH
         for start in range(0, len(padded), rows_per_dispatch):
             chunk = padded[start:start + rows_per_dispatch]
-            (work / "in.bin").write_bytes(b"".join(struct.pack("<4I", *r) for r in chunk) + extra)
-            (work / "out.bin").unlink(missing_ok=True)
-            subprocess.run([oracle(), str(code), str(len(chunk)), str(work / "in.bin"), str(work / "out.bin"), "16"], check=True, env=env, stdout=sys.stderr)
-            data = (work / "out.bin").read_bytes()
+            payload = b"".join(struct.pack("<4I", *r) for r in chunk) + extra
+            if runtime() == "hip":
+                data = hip_runtime().dispatch(Path(code).read_bytes(), len(chunk), payload, 16, coarse)
+            else:
+                (work / "in.bin").write_bytes(payload)
+                (work / "out.bin").unlink(missing_ok=True)
+                subprocess.run([oracle(), str(code), str(len(chunk)), str(work / "in.bin"), str(work / "out.bin"), "16"], check=True, env=env, stdout=sys.stderr)
+                data = (work / "out.bin").read_bytes()
             expected = len(chunk) * 64
             if len(data) != expected:
                 raise ValueError(f"Oracle output size: expected {expected} bytes, got {len(data)}")
diff --git a/tools/hw-oracle/oracle_hip.py b/tools/hw-oracle/oracle_hip.py
new file mode 100644
index 0000000000..596b82a8f7
--- /dev/null
+++ b/tools/hw-oracle/oracle_hip.py
@@ -0,0 +1,235 @@
+import argparse
+import ctypes
+import os
+import sys
+from functools import cache
+from pathlib import Path
+
+HIP_LIBRARIES = ("amdhip64_7.dll", "amdhip64_6.dll", "amdhip64.dll")
+COMGR_LIBRARIES = ("amd_comgr_3.dll", "amd_comgr_2.dll", "amd_comgr.dll")
+DATA_SOURCE = 0x1
+DATA_LOG = 0x5
+DATA_RELOCATABLE = 0x7
+DATA_EXECUTABLE = 0x8
+ASSEMBLE_ACTIONS = (0x8, 0xA)
+LINK_ACTIONS = (0x7, 0x9)
+HIP_MEMCPY_HOST_TO_DEVICE = 1
+HIP_MEMCPY_DEVICE_TO_HOST = 2
+DEVICE_PROPERTIES_SIZE = 8192
+DEVICE_NAME_SIZE = 256
+
+
+class OracleError(Exception):
+    pass
+
+
+class Handle(ctypes.Structure):
+    _fields_ = [("handle", ctypes.c_uint64)]
+
+
+def check(status, what):
+    if status != 0:
+        raise OracleError(f"{what} failed with status {status}")
+
+
+def load(variable, names):
+    candidates = (os.environ[variable],) if os.environ.get(variable) else names
+    errors = []
+    for name in candidates:
+        try:
+            return ctypes.WinDLL(name)
+        except OSError as error:
+            errors.append(f"{name}: {error}")
+    raise OracleError(f"no library found ({variable} overrides it): " + "; ".join(errors))
+
+
+@cache
+def hip():
+    if os.environ.get("ROCR_VISIBLE_DEVICES") is not None and "HIP_VISIBLE_DEVICES" not in os.environ:
+        os.environ["HIP_VISIBLE_DEVICES"] = os.environ["ROCR_VISIBLE_DEVICES"]
+    library = load("HW_ORACLE_HIP", HIP_LIBRARIES)
+    library.hipModuleLoadData.argtypes = [ctypes.POINTER(ctypes.c_void_p), ctypes.c_char_p]
+    library.hipModuleGetFunction.argtypes = [ctypes.POINTER(ctypes.c_void_p), ctypes.c_void_p, ctypes.c_char_p]
+    library.hipMemcpy.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.c_int]
+    library.hipMemset.argtypes = [ctypes.c_void_p, ctypes.c_int, ctypes.c_size_t]
+    library.hipModuleLaunchKernel.argtypes = [ctypes.c_void_p, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint, ctypes.c_uint,
+                                              ctypes.c_uint, ctypes.c_uint, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p]
+    library.hipModuleUnload.argtypes = [ctypes.c_void_p]
+    library.hipFree.argtypes = [ctypes.c_void_p]
+    library.hipHostFree.argtypes = [ctypes.c_void_p]
+    check(library.hipInit(0), "hipInit")
+    count = ctypes.c_int()
+    check(library.hipGetDeviceCount(ctypes.byref(count)), "hipGetDeviceCount")
+    if count.value == 0:
+        raise OracleError("no HIP device")
+    return library
+
+
+@cache
+def comgr():
+    library = load("HW_ORACLE_COMGR", COMGR_LIBRARIES)
+    library.amd_comgr_create_data.argtypes = [ctypes.c_int, ctypes.POINTER(Handle)]
+    library.amd_comgr_create_data_set.argtypes = [ctypes.POINTER(Handle)]
+    library.amd_comgr_create_action_info.argtypes = [ctypes.POINTER(Handle)]
+    library.amd_comgr_set_data.argtypes = [Handle, ctypes.c_size_t, ctypes.c_char_p]
+    library.amd_comgr_set_data_name.argtypes = [Handle, ctypes.c_char_p]
+    library.amd_comgr_data_set_add.argtypes = [Handle, Handle]
+    library.amd_comgr_action_info_set_isa_name.argtypes = [Handle, ctypes.c_char_p]
+    library.amd_comgr_action_info_set_option_list.argtypes = [Handle, ctypes.POINTER(ctypes.c_char_p), ctypes.c_size_t]
+    library.amd_comgr_action_info_set_logging.argtypes = [Handle, ctypes.c_bool]
+    library.amd_comgr_do_action.argtypes = [ctypes.c_int, Handle, Handle, Handle]
+    library.amd_comgr_action_data_count.argtypes = [Handle, ctypes.c_int, ctypes.POINTER(ctypes.c_size_t)]
+    library.amd_comgr_action_data_get_data.argtypes = [Handle, ctypes.c_int, ctypes.c_size_t, ctypes.POINTER(Handle)]
+    library.amd_comgr_get_data.argtypes = [Handle, ctypes.POINTER(ctypes.c_size_t), ctypes.c_char_p]
+    library.amd_comgr_release_data.argtypes = [Handle]
+    library.amd_comgr_destroy_data_set.argtypes = [Handle]
+    library.amd_comgr_destroy_action_info.argtypes = [Handle]
+    return library
+
+
+@cache
+def target():
+    properties = ctypes.create_string_buffer(DEVICE_PROPERTIES_SIZE)
+    library = hip()
+    getter = getattr(library, "hipGetDevicePropertiesR0600", None) or library.hipGetDeviceProperties
+    check(getter(properties, 0), "hipGetDeviceProperties")
+    start = properties.raw.find(b"gfx", DEVICE_NAME_SIZE)
+    if start < 0:
+        raise OracleError("the HIP device properties name no gfx target")
+    return properties.raw[start:properties.raw.index(b"\0", start)].decode("ascii").split(":")[0]
+
+
+def data_bytes(data_set, kind):
+    library = comgr()
+    count = ctypes.c_size_t()
+    check(library.amd_comgr_action_data_count(data_set, kind, ctypes.byref(count)), "amd_comgr_action_data_count")
+    chunks = []
+    for index in range(count.value):
+        data = Handle()
+        check(library.amd_comgr_action_data_get_data(data_set, kind, index, ctypes.byref(data)), "amd_comgr_action_data_get_data")
+        size = ctypes.c_size_t()
+        check(library.amd_comgr_get_data(data, ctypes.byref(size), None), "amd_comgr_get_data")
+        buffer = ctypes.create_string_buffer(size.value)
+        check(library.amd_comgr_get_data(data, ctypes.byref(size), buffer), "amd_comgr_get_data")
+        chunks.append(buffer.raw[:size.value])
+        library.amd_comgr_release_data(data)
+    return chunks
+
+
+def data_set(kind, name, payload):
+    library = comgr()
+    data = Handle()
+    check(library.amd_comgr_create_data(kind, ctypes.byref(data)), "amd_comgr_create_data")
+    check(library.amd_comgr_set_data(data, len(payload), payload), "amd_comgr_set_data")
+    check(library.amd_comgr_set_data_name(data, name), "amd_comgr_set_data_name")
+    result = Handle()
+    check(library.amd_comgr_create_data_set(ctypes.byref(result)), "amd_comgr_create_data_set")
+    check(library.amd_comgr_data_set_add(result, data), "amd_comgr_data_set_add")
+    library.amd_comgr_release_data(data)
+    return result
+
+
+def comgr_step(actions, isa, options, inputs, kind):
+    library = comgr()
+    logs = []
+    for action in actions:
+        info = Handle()
+        check(library.amd_comgr_create_action_info(ctypes.byref(info)), "amd_comgr_create_action_info")
+        outputs = Handle()
+        try:
+            check(library.amd_comgr_action_info_set_isa_name(info, isa.encode("ascii")), "amd_comgr_action_info_set_isa_name")
+            check(library.amd_comgr_action_info_set_logging(info, True), "amd_comgr_action_info_set_logging")
+            if options:
+                check(library.amd_comgr_action_info_set_option_list(info, (ctypes.c_char_p * len(options))(*options), len(options)),
+                      "amd_comgr_action_info_set_option_list")
+            check(library.amd_comgr_create_data_set(ctypes.byref(outputs)), "amd_comgr_create_data_set")
+            status = library.amd_comgr_do_action(action, info, inputs, outputs)
+            result = data_bytes(outputs, kind)
+            log = b"".join(data_bytes(outputs, DATA_LOG)).decode("utf-8", errors="replace").strip()
+            library.amd_comgr_destroy_data_set(outputs)
+        finally:
+            library.amd_comgr_destroy_action_info(info)
+        if status == 0 and len(result) == 1:
+            return result[0]
+        logs.append(f"action {action:#x} status {status}" + (f": {log}" if log else ""))
+    raise OracleError("comgr produced no output\n" + "\n".join(logs))
+
+
+def assemble(source, isa_target, wave64):
+    isa = f"amdgcn-amd-amdhsa--{isa_target}"
+    inputs = data_set(DATA_SOURCE, b"k.s", source)
+    try:
+        relocatable = comgr_step(ASSEMBLE_ACTIONS, isa, [b"-mwavefrontsize64"] if wave64 else [], inputs, DATA_RELOCATABLE)
+    finally:
+        comgr().amd_comgr_destroy_data_set(inputs)
+    objects = data_set(DATA_RELOCATABLE, b"k.o", relocatable)
+    try:
+        return comgr_step(LINK_ACTIONS, isa, [], objects, DATA_EXECUTABLE)
+    finally:
+        comgr().amd_comgr_destroy_data_set(objects)
+
+
+def dispatch(code, threads, payload, out_dwords, coarse):
+    library = hip()
+    module = ctypes.c_void_p()
+    check(library.hipModuleLoadData(ctypes.byref(module), code), "hipModuleLoadData")
+    try:
+        function = ctypes.c_void_p()
+        check(library.hipModuleGetFunction(ctypes.byref(function), module, b"probe"), "hipModuleGetFunction")
+        out_size = threads * out_dwords * 4
+        buffers = []
+        try:
+            for size in (len(payload), out_size):
+                pointer = ctypes.c_void_p()
+                if coarse:
+                    check(library.hipMalloc(ctypes.byref(pointer), ctypes.c_size_t(size)), "hipMalloc")
+                else:
+                    check(library.hipHostMalloc(ctypes.byref(pointer), ctypes.c_size_t(size), 0), "hipHostMalloc")
+                buffers.append(pointer)
+            device_in, device_out = buffers
+            check(library.hipMemcpy(device_in, payload, len(payload), HIP_MEMCPY_HOST_TO_DEVICE), "hipMemcpy")
+            check(library.hipMemset(device_out, 0xee, out_size), "hipMemset")
+            arguments = (ctypes.c_void_p * 2)(ctypes.addressof(device_in), ctypes.addressof(device_out))
+            check(library.hipModuleLaunchKernel(function, 1, 1, 1, min(threads, 1024), 1, 1, 0, None, arguments, None), "hipModuleLaunchKernel")
+            check(library.hipDeviceSynchronize(), "hipDeviceSynchronize")
+            output = ctypes.create_string_buffer(out_size)
+            check(library.hipMemcpy(output, device_out, out_size, HIP_MEMCPY_DEVICE_TO_HOST), "hipMemcpy")
+            return output.raw
+        finally:
+            for pointer in buffers:
+                (library.hipFree if coarse else library.hipHostFree)(pointer)
+    finally:
+        library.hipModuleUnload(module)
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description="Assemble and run hw-oracle kernels through the HIP runtime and comgr of AMD's Windows driver.")
+    parser.add_argument("--target", action="store_true", help="print the gfx target of the HIP device")
+    parser.add_argument("--assemble", nargs=3, metavar=("SOURCE", "OUTPUT", "TARGET"), help="assemble and link SOURCE for TARGET into OUTPUT")
+    parser.add_argument("--wave64", action="store_true", help="assemble for wave64")
+    parser.add_argument("dispatch", nargs="*", metavar="CODE THREADS IN OUT OUT_DWORDS", help="run CODE as oracle does")
+    args = parser.parse_args(argv)
+    try:
+        if args.target and not args.assemble and not args.dispatch:
+            print(target())
+            return 0
+        if args.assemble and not args.target and not args.dispatch:
+            source, output, isa_target = args.assemble
+            Path(output).write_bytes(assemble(Path(source).read_bytes(), isa_target, args.wave64))
+            return 0
+        if len(args.dispatch) != 5 or args.target or args.assemble or args.wave64:
+            parser.error("give --target, --assemble SOURCE OUTPUT TARGET, or CODE THREADS IN OUT OUT_DWORDS")
+        code, threads, inputs, output, out_dwords = args.dispatch
+        threads, out_dwords = int(threads), int(out_dwords)
+        if threads not in range(1, 1025) or out_dwords not in range(1, 17):
+            parser.error("THREADS must be 1 to 1024 and OUT_DWORDS 1 to 16")
+        result = dispatch(Path(code).read_bytes(), threads, Path(inputs).read_bytes(), out_dwords, os.environ.get("COARSE") is not None)
+        Path(output).write_bytes(result)
+        return 0
+    except (OSError, OracleError) as error:
+        print(error, file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tools/hw-oracle/test_hw_oracle.py b/tools/hw-oracle/test_hw_oracle.py
index 58f66cf38c..e234145299 100644
--- a/tools/hw-oracle/test_hw_oracle.py
+++ b/tools/hw-oracle/test_hw_oracle.py
@@ -10,6 +10,7 @@ import sys
 import tempfile
 import unittest
 from pathlib import Path
+import unittest.mock
 from unittest.mock import patch
 
 import hw_oracle
@@ -18,6 +19,10 @@ import hw_oracle
 MODES = dict(ieee=0, denorm32=0, denorm16=3, dx10_clamp=1, round32=0, round16=0, fp16_overflow=0)
 
 
+def setUpModule():
+    os.environ["HW_ORACLE_RUNTIME"] = "hsa"
+
+
 class OracleCacheTests(unittest.TestCase):
     def test_failed_build_is_not_cached_and_can_be_retried(self):
         for previous in (None, b"old executable"):
@@ -642,5 +647,136 @@ class AssemblyTests(unittest.TestCase):
                 self.assertTrue(code.is_file())
 
 
+class HipRuntimeTests(unittest.TestCase):
+    def test_runtime_defaults_to_hip_on_windows_only(self):
+        environment = {key: value for key, value in os.environ.items() if key != "HW_ORACLE_RUNTIME"}
+        with patch.dict(os.environ, environment, clear=True):
+            self.assertEqual(hw_oracle.runtime(), "hip" if os.name == "nt" else "hsa")
+        for selected in hw_oracle.RUNTIMES:
+            with patch.dict(os.environ, {"HW_ORACLE_RUNTIME": selected}):
+                self.assertEqual(hw_oracle.runtime(), selected)
+        with patch.dict(os.environ, {"HW_ORACLE_RUNTIME": "rocm"}), self.assertRaises(ValueError):
+            hw_oracle.runtime()
+
+    def test_hip_run_assembles_and_dispatches_in_process(self):
+        calls = []
+
+        class Runtime:
+            @staticmethod
+            def target():
+                calls.append(("target",))
+                return "gfx1010"
+
+            @staticmethod
+            def assemble(source, isa_target, wave64):
+                calls.append(("assemble", isa_target, wave64, b"v_mov_b32 v10, v4" in source))
+                return b"code"
+
+            @staticmethod
+            def dispatch(code, threads, payload, out_dwords, coarse):
+                calls.append(("dispatch", code, threads, len(payload), out_dwords, coarse))
+                return bytes(threads * out_dwords * 4)
+
+        environment = {key: value for key, value in os.environ.items() if key != "HW_ORACLE_TARGET"}
+        for wave64, coarse in ((False, False), (True, True)):
+            calls.clear()
+            with self.subTest(wave64=wave64), patch.dict(os.environ, {**environment, "HW_ORACLE_RUNTIME": "hip"}, clear=True),                     patch.object(hw_oracle, "hip_runtime", return_value=Runtime),                     patch.object(hw_oracle.subprocess, "run", side_effect=AssertionError("subprocess called")),                     patch.object(hw_oracle, "oracle", side_effect=AssertionError("oracle built")):
+                results = hw_oracle.run("  v_mov_b32 v10, v4", [(1, 2, 3, 4)], b"xy", wave64, coarse, **MODES)
+            wave = 64 if wave64 else 32
+            self.assertEqual(results, [(0,) * 16])
+            self.assertIn(("target",), calls)
+            self.assertEqual([call for call in calls if call != ("target",)],
+                             [("assemble", "gfx1010", wave64, True), ("dispatch", b"code", wave, wave * 16 + 2, 16, coarse)])
+
+    def test_hip_output_must_match_the_padded_dispatch_size(self):
+        class Runtime:
+            @staticmethod
+            def assemble(source, isa_target, wave64):
+                return b"code"
+
+            @staticmethod
+            def dispatch(code, threads, payload, out_dwords, coarse):
+                return bytes(threads * out_dwords * 4 - 4)
+
+        with patch.dict(os.environ, {"HW_ORACLE_RUNTIME": "hip", "HW_ORACLE_TARGET": "gfx1010"}),                 patch.object(hw_oracle, "hip_runtime", return_value=Runtime), self.assertRaises(ValueError):
+            hw_oracle.run("  s_nop 0", [(0, 0, 0, 0)], **MODES)
+
+    def test_hip_runtime_loads_the_script_next_to_the_tool(self):
+        self.assertEqual(Path(hw_oracle.hip_runtime().__file__), hw_oracle.HERE / "oracle_hip.py")
+
+
+class HipOracleTests(unittest.TestCase):
+    def setUp(self):
+        import oracle_hip
+        self.oracle_hip = oracle_hip
+
+    def test_cli_rejects_mixed_or_incomplete_requests(self):
+        for argv in ([], ["--target", "code", "32", "in", "out", "16"], ["--wave64", "code", "32", "in", "out", "16"],
+                     ["code", "32", "in", "out"], ["code", "0", "in", "out", "16"], ["code", "1025", "in", "out", "16"],
+                     ["code", "32", "in", "out", "17"]):
+            with self.subTest(argv=argv), contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as exit:
+                self.oracle_hip.main(argv)
+            self.assertEqual(exit.exception.code, 2)
+
+    def test_comgr_step_tries_each_action_until_one_produces_output(self):
+        library = unittest.mock.MagicMock()
+        for name in ("amd_comgr_create_action_info", "amd_comgr_create_data_set", "amd_comgr_action_info_set_isa_name",
+                     "amd_comgr_action_info_set_logging", "amd_comgr_action_info_set_option_list"):
+            getattr(library, name).return_value = 0
+        outputs = {0x8: [], 0xA: [b"object"]}
+        actions = []
+        library.amd_comgr_do_action.side_effect = lambda action, *args: actions.append(action) or (0 if action == 0xA else 1)
+
+        def data_bytes(data_set, kind):
+            return [b"log"] if kind == self.oracle_hip.DATA_LOG else outputs[actions[-1]]
+
+        isa = "amdgcn-amd-amdhsa--gfx1010"
+        with patch.object(self.oracle_hip, "comgr", return_value=library), patch.object(self.oracle_hip, "data_bytes", side_effect=data_bytes):
+            self.assertEqual(self.oracle_hip.comgr_step((0x8, 0xA), isa, [b"-mwavefrontsize64"], self.oracle_hip.Handle(),
+                                                        self.oracle_hip.DATA_RELOCATABLE), b"object")
+            self.assertEqual(actions, [0x8, 0xA])
+            outputs[0xA] = []
+            with self.assertRaises(self.oracle_hip.OracleError) as error:
+                self.oracle_hip.comgr_step((0x8, 0xA), isa, [], self.oracle_hip.Handle(), self.oracle_hip.DATA_RELOCATABLE)
+        self.assertIn("action 0x8 status 1: log", str(error.exception))
+        self.assertIn("action 0xa status 0: log", str(error.exception))
+
+    def test_device_selection_follows_rocr_visible_devices(self):
+        library = unittest.mock.MagicMock()
+        library.hipInit.return_value = 0
+
+        def count(pointer):
+            pointer._obj.value = 1
+            return 0
+
+        library.hipGetDeviceCount.side_effect = count
+        base = {key: value for key, value in os.environ.items() if key not in ("ROCR_VISIBLE_DEVICES", "HIP_VISIBLE_DEVICES")}
+        for environment, expected in (({"ROCR_VISIBLE_DEVICES": "1"}, "1"), ({"ROCR_VISIBLE_DEVICES": "1", "HIP_VISIBLE_DEVICES": "0"}, "0")):
+            self.oracle_hip.hip.cache_clear()
+            with self.subTest(environment=environment), patch.dict(os.environ, {**base, **environment}, clear=True), \
+                    patch.object(self.oracle_hip, "load", return_value=library):
+                self.oracle_hip.hip()
+                self.assertEqual(os.environ["HIP_VISIBLE_DEVICES"], expected)
+        self.oracle_hip.hip.cache_clear()
+
+    def test_assembles_both_wave_sizes_with_the_driver_comgr(self):
+        if os.name != "nt":
+            self.skipTest("comgr from AMD's Windows driver")
+        try:
+            self.oracle_hip.comgr()
+        except self.oracle_hip.OracleError as error:
+            self.skipTest(str(error))
+        template = (hw_oracle.HERE / "template.s").read_text()
+        for wave64, mask in ((False, "s8"), (True, "s[8:9]")):
+            text = template
+            for key, value in (("@TARGET@", "gfx1010"), ("@WAVE32@", "0" if wave64 else "1"), ("@WAVESIZE@", "64" if wave64 else "32"),
+                               ("@DENORM@", "0"), ("@DENORM16@", "3"), ("@IEEE@", "0"), ("@DX10_CLAMP@", "1"), ("@ROUND32@", "0"),
+                               ("@ROUND16@", "0"), ("@FP16_OVERFLOW@", "0"), ("@LDS@", "4096"),
+                               ("@BODY@", f"  v_cmp_lt_f32 {mask}, v4, v5\n  v_cndmask_b32 v10, v6, v7, {mask}\n")):
+                text = text.replace(key, value)
+            with self.subTest(wave64=wave64):
+                self.assertEqual(self.oracle_hip.assemble(text.encode(), "gfx1010", wave64)[:4], b"\x7fELF")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/import_audit.py b/tools/import_audit.py
index 6ee58ad673..5d43653497 100644
--- a/tools/import_audit.py
+++ b/tools/import_audit.py
@@ -86,14 +86,18 @@ def elf_program_dynamic_symbols(path, data):
         raise AuditError(f"{path}: dynamic segment size {dynamic_size} is not a multiple of 16")
     dynamic = {}
     needed_offsets = []
+    terminated = False
     for position in range(0, dynamic_size, 16):
         tag, value = unpack("<qQ", data, dynamic_offset + position, path, "dynamic entry")
         if tag == 0:
+            terminated = True
             break
         if tag == 1:
             needed_offsets.append(value)
         else:
             dynamic[tag] = value
+    if not terminated:
+        raise AuditError(f"{path}: dynamic segment is not terminated by DT_NULL")
     string_address = dynamic.get(5)
     string_size = dynamic.get(10)
     symbol_address = dynamic.get(6)
@@ -134,7 +138,7 @@ def elf_program_dynamic_symbols(path, data):
     if symbol_count is None:
         raise AuditError(f"{path}: dynamic symbol table has no supported hash table")
     symbol_offset = file_offset(symbol_address, symbol_count * symbol_size, "dynamic symbol table")
-    imports = set()
+    imports = {}
     exports = set()
     for index in range(symbol_count):
         name, info, other, section_index, _, _ = unpack("<IBBHQQ", data, symbol_offset + index * symbol_size, path, "dynamic symbol")
@@ -142,7 +146,7 @@ def elf_program_dynamic_symbols(path, data):
             continue
         symbol = cstring(data, string_offset + name, string_offset + string_size, path, "dynamic symbol name").split(MODULE_SUFFIX, 1)[0]
         if section_index == 0:
-            imports.add(symbol)
+            imports[symbol] = imports.get(symbol, True) and info >> 4 == 2
         elif info >> 4 in (1, 2, 10) and other & 3 in (0, 3):
             exports.add(symbol)
     needed = {cstring(data, string_offset + value, string_offset + string_size, path, "needed library name") for value in needed_offsets}
@@ -190,7 +194,7 @@ def elf_imports(path, data):
         imports, _, needed = elf_program_dynamic_symbols(path, data)
         return imports, needed
     sections = elf_sections(path, data)
-    symbols = set()
+    symbols = {}
     needed = set()
     for section in sections:
         kind, offset, size, link, entry = section[1], section[4], section[5], section[6], section[9]
@@ -200,21 +204,26 @@ def elf_imports(path, data):
             strings_offset, strings_size = sections[link][4], sections[link][5]
             take(data, strings_offset, strings_size, path, "dynamic string table")
             for position in range(0, size, 24):
-                name, _, _, index, _, _ = unpack("<IBBHQQ", data, offset + position, path, "dynamic symbol")
+                name, info, _, index, _, _ = unpack("<IBBHQQ", data, offset + position, path, "dynamic symbol")
                 if name and index == 0:
                     symbol = cstring(data, strings_offset + name, strings_offset + strings_size, path, "import name")
-                    symbols.add(symbol.split(MODULE_SUFFIX, 1)[0])
+                    symbol = symbol.split(MODULE_SUFFIX, 1)[0]
+                    symbols[symbol] = symbols.get(symbol, True) and info >> 4 == 2
         elif kind == 6:
             if entry != 16 or size % 16 or link >= len(sections) or sections[link][1] != 3:
                 raise AuditError(f"{path}: invalid dynamic section (entry size {entry}, size {size}, string table section {link})")
             strings_offset, strings_size = sections[link][4], sections[link][5]
             take(data, strings_offset, strings_size, path, "dynamic string table")
+            terminated = False
             for position in range(0, size, 16):
                 tag, value = unpack("<qQ", data, offset + position, path, "dynamic entry")
                 if tag == 0:
+                    terminated = True
                     break
                 if tag == 1:
                     needed.add(cstring(data, strings_offset + value, strings_offset + strings_size, path, "needed library name"))
+            if not terminated:
+                raise AuditError(f"{path}: dynamic section is not terminated by DT_NULL")
     return symbols, needed
 
 
@@ -449,7 +458,7 @@ def read_modules(directories):
                 names = pe_exports(file, data)
             else:
                 symbols, needed = elf_imports(file, data)
-                imports[file.name] = (sorted(symbols), sorted(needed))
+                imports[file.name] = (sorted(symbols.items()), sorted(needed))
                 names = elf_exports(file, data)
             for name in names:
                 exports[name.split(MODULE_SUFFIX, 1)[0]].add(file.name)
@@ -538,11 +547,13 @@ MODULE_FILE_SUFFIXES = (".debug_prx", ".suprx", ".sprx", ".prx")
 
 
 def module_stem(name, fold):
+    if fold:
+        name = name.lower()
     for suffix in MODULE_FILE_SUFFIXES:
         if len(name) > len(suffix) and name.endswith(suffix):
             name = name[:-len(suffix)]
             break
-    return name.lower() if fold else name
+    return name
 
 
 class ModuleNames(set):
@@ -568,45 +579,67 @@ def classify(nid, library, providers, stubs, modules):
     return "implemented"
 
 
-def audit(imports, exports, stubs, libraries, modules, module_imports=None, module_exports=None, *, needed_libraries=()):
+def audit(imports, exports, stubs, libraries, modules, module_imports=None, module_exports=None, *, needed_libraries=(), windows_libraries=()):
+    windows_names = {}
+    for library in windows_libraries:
+        windows_names.setdefault(library.casefold(), set()).add(library)
+
+    def system_library(name):
+        if name:
+            for suffix in (".sprx", ".suprx", ".debug_prx"):
+                if name.endswith(suffix):
+                    normalized = name.removesuffix(suffix) + ".prx"
+                    candidates = windows_names.get(normalized.casefold(), ())
+                    if normalized in candidates:
+                        return normalized
+                    if len(candidates) == 1:
+                        return next(iter(candidates))
+        return name
+
+    def available(name):
+        return name in modules or system_library(name) in libraries
+
     records = {}
     for nid, library, weak in imports:
         record = records.setdefault((nid, library), {"nid": nid, "library": library, "references": 0, "weak": weak})
         record["references"] += 1
         record["weak"] = record["weak"] and weak
     for module, (symbols, needed) in (module_imports or {}).items():
-        for nid in symbols:
-            record = records.setdefault((nid, None, module), {"nid": nid, "library": None, "module": module, "references": 0, "weak": False})
+        for nid, weak in symbols:
+            record = records.setdefault((nid, None, module), {"nid": nid, "library": None, "module": module, "references": 0, "weak": weak})
             record["references"] += 1
+            record["weak"] = record["weak"] and weak
     for record in records.values():
         nid, library = record["nid"], record["library"]
         providers = exports.get(nid, [])
         if not library:
             providers = sorted(set(providers) | set((module_exports or {}).get(nid, [])))
         resolved_nid = nid
+        record["symbol_mismatch"] = False
         if not providers:
             resolved_nid = nid_names.compute_nid(nid)
             providers = exports.get(resolved_nid, [])
+            record["symbol_mismatch"] = bool(library) and library not in modules and bool(providers) and resolved_nid != nid
             if not library:
                 providers = sorted(set(providers) | set((module_exports or {}).get(resolved_nid, [])))
         kind = classify(resolved_nid, library, providers, stubs, modules)
         record["class"] = kind
         record["providers"] = providers
-        record["library_mismatch"] = kind in ("implemented", "stub") and bool(library) and library not in providers and "libc.prx" not in providers
+        record["library_mismatch"] = kind in ("implemented", "stub") and bool(library) and system_library(library) not in providers and "libc.prx" not in providers
         record["name"] = next((stubs[(provider, resolved_nid)] for provider in providers if (provider, resolved_nid) in stubs), None) if kind == "stub" else None
     ordered = sorted(records.values(), key=lambda record: (record["class"], record["library"] or "", record.get("module") or "", record["nid"]))
     check_conservation(len(imports) + sum(len(symbols) for symbols, _ in (module_imports or {}).values()), ordered)
     missing = defaultdict(int)
     for library in needed_libraries:
-        if library not in libraries and library not in modules:
+        if not available(library):
             missing[library] = 0
     for record in ordered:
         library = record["library"]
-        if library and library not in libraries and library not in modules:
+        if library and not available(library):
             missing[library] += 1
     for _, needed in (module_imports or {}).values():
         for library in needed:
-            if library not in libraries and library not in modules:
+            if not available(library):
                 missing[library] += 1
     return ordered, dict(sorted(missing.items()))
 
@@ -618,7 +651,7 @@ def current_stop(imports, records):
         if weak:
             continue
         record = classes.get((nid, library))
-        if record is not None and record["class"] == "absent":
+        if record is not None and (record["class"] == "absent" or record["symbol_mismatch"]):
             return record
     return None
 
@@ -677,6 +710,7 @@ def summarize(records, references, missing, missing_hosts=()):
         "missing_libraries": missing,
         "missing_host_dependencies": [{"importer": entry["importer"], "chain": list(entry["chain"])} for entry in missing_hosts],
         "library_mismatch": sum(1 for record in records if record["library_mismatch"]),
+        "symbol_mismatch": sum(1 for record in records if record["symbol_mismatch"]),
     }
 
 
@@ -686,6 +720,8 @@ def label(record):
     else:
         mark = "" if record.get("name_verified", True) else " (name does not hash to this NID)"
         text = f"{record['nid']}  {record['name']}{mark}"
+    if record["weak"]:
+        text += "  (weak import)"
     return f"{text}  (imported by {record['module']})" if record.get("module") else text
 
 
@@ -711,7 +747,7 @@ def render(summary, records, missing, stops, missing_hosts=(), located=None):
     lines = [f"{summary['references']} references, {summary['unique_imports']} unique imports"]
     for kind in CLASSES:
         lines.append(f"  {kind:<12}{summary['unique_by_class'][kind]:>6} imports  {summary['references_by_class'][kind]:>6} references")
-    for title, kind in (("Absent: no built library exports these, so the loader fails", "absent"), ("Stub: exported but throws when called", "stub")):
+    for title, kind in (("Absent: no built library exports these", "absent"), ("Stub: exported but throws when called", "stub")):
         selected = [record for record in records if record["class"] == kind]
         if selected:
             lines.append("")
@@ -722,6 +758,10 @@ def render(summary, records, missing, stops, missing_hosts=(), located=None):
                     current = record["library"]
                     lines.append(f"  [{current or 'library not named'}]")
                 lines.append(f"    {label(record)}")
+    mismatched = [record for record in records if record["symbol_mismatch"]]
+    if mismatched:
+        lines.extend(["", f"Qualified import names exported only as their NID ({len(mismatched)}): the loader cannot resolve these names"])
+        lines.extend(f"  {label(record)} -> {nid_names.compute_nid(record['nid'])}" for record in mismatched)
     if stops:
         lines.append("")
         lines.append("Current stop (first unresolved import, in registry order)")
@@ -766,6 +806,7 @@ def main(argv=None):
             inputs += [file for directory in args.libs for file in directory_files(directory, "*.prx")]
             inputs += [file for directory in args.modules for file in directory_files(directory, "*")]
             inputs += list(Path(args.source).rglob("*.cpp"))
+            inputs += [file for file in Path(args.source).glob("*/CMakeLists.txt") if file.is_file()]
             output = args.json.resolve()
             if any(output == path.resolve() or (args.json.exists() and args.json.samefile(path)) for path in inputs):
                 raise AuditError(f"{args.json}: JSON output would overwrite an input file")
@@ -778,7 +819,7 @@ def main(argv=None):
         modules = set(module_imports)
         modules |= {name.removesuffix(".guest.prx") for name in modules if name.endswith(".guest.prx")}
         modules = ModuleNames(modules, fold=bool(windows))
-        records, missing = audit(imports, exports, source_stubs(args.source), libraries, modules, module_imports, module_exports, needed_libraries=needed)
+        records, missing = audit(imports, exports, source_stubs(args.source), libraries, modules, module_imports, module_exports, needed_libraries=needed, windows_libraries=windows)
         missing_hosts = audit_host_dependencies(host_dependencies, libraries, modules, windows)
         if args.names:
             attach_names(records, load_names(args.names))
@@ -800,7 +841,7 @@ def main(argv=None):
         return 2
     located = locate_missing(missing, {path.resolve().parent for path in args.registries}) if missing else None
     print(render(summary, records, missing, stops, missing_hosts, located))
-    return 1 if summary["unique_by_class"]["absent"] or missing or missing_hosts or (args.strict_providers and summary["library_mismatch"]) or (args.strict_stubs and summary["unique_by_class"]["stub"]) else 0
+    return 1 if summary["unique_by_class"]["absent"] or summary["symbol_mismatch"] or missing or missing_hosts or (args.strict_providers and summary["library_mismatch"]) or (args.strict_stubs and summary["unique_by_class"]["stub"]) else 0
 
 
 if __name__ == "__main__":
diff --git a/tools/nid_names.py b/tools/nid_names.py
index 1818f593c9..a7d1841005 100644
--- a/tools/nid_names.py
+++ b/tools/nid_names.py
@@ -181,10 +181,13 @@ def symbol_file(path):
 
 
 def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(
         description="Suggest real names for Unknown NID stubs")
     parser.add_argument("--db", default=os.environ.get("ANYPS5_NID_DB"),
-                        help="NID database CSV (downloaded to a cache dir by default)")
+                        help="NID database CSV; defaults to $ANYPS5_NID_DB, then to a copy downloaded to a cache dir")
     parser.add_argument("--nid", action="append", default=None,
                         help="resolve only these NIDs instead of scanning the tree")
     parser.add_argument("--name", "--symbol", dest="name", action="append", default=None,
@@ -261,7 +264,4 @@ def main(argv=None):
 
 
 if __name__ == "__main__":
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
     sys.exit(main())
diff --git a/tools/package_release.py b/tools/package_release.py
index 88558908a6..c32336f6d8 100644
--- a/tools/package_release.py
+++ b/tools/package_release.py
@@ -4,6 +4,7 @@ import os
 import re
 import shutil
 import stat
+import sys
 import tarfile
 import tempfile
 import zipfile
@@ -15,12 +16,15 @@ WEB_FILES = ("index.html", "app.css", "app.mjs", "archive.mjs", "batch.mjs", "ou
 
 
 def windows_runtime(build):
-    for line in (build / "CMakeCache.txt").read_text(encoding="utf-8-sig").splitlines():
+    cache = build / "CMakeCache.txt"
+    if not cache.is_file():
+        raise RuntimeError(f"Missing CMakeCache.txt in build directory: {build}")
+    for line in cache.read_text(encoding="utf-8-sig").splitlines():
         if line.startswith("CMAKE_CXX_COMPILER:"):
             compiler = line.partition("=")[2]
             if compiler and not compiler.endswith("-NOTFOUND"):
                 return Path(compiler).parent
-    raise RuntimeError(f"CMAKE_CXX_COMPILER is not configured in {build / 'CMakeCache.txt'}")
+    raise RuntimeError(f"CMAKE_CXX_COMPILER is not configured in {cache}")
 
 
 def tracy_runtime(platform, build):
@@ -52,6 +56,11 @@ def package(platform, build, output, version):
     licenses = []
     if "libSceAjm.native.prx" in expected:
         licenses.append((ROOT / "3rdparty/vgmstream/COPYING", "libs/licenses/vgmstream.txt"))
+    if "libSceVorbisDec.prx" in expected:
+        licenses.append((ROOT / "3rdparty/ogg/COPYING", "libs/licenses/ogg.txt"))
+        licenses.append((ROOT / "3rdparty/vorbis/COPYING", "libs/licenses/vorbis.txt"))
+    if expected & {"libSceOpusDec.prx", "libSceOpusCeltDec.prx"}:
+        licenses.append((ROOT / "3rdparty/opus/COPYING", "libs/licenses/opus.txt"))
     if platform == "windows":
         runtime = windows_runtime(build)
         files.extend(runtime / name for name in ("libgcc_s_seh-1.dll", "libstdc++-6.dll", "libwinpthread-1.dll"))
@@ -92,6 +101,8 @@ def package(platform, build, output, version):
 
 
 def collect_docs(source, output):
+    if not source.is_dir():
+        raise RuntimeError(f"Documentation source is not a directory: {source}")
     documents = sorted(document for document in source.rglob("*.md") if document.is_file())
     if not documents:
         raise RuntimeError(f"No Markdown documents found in {source}")
@@ -129,7 +140,11 @@ def package_web(build, output, version, revision):
         asset.replace(destination)
 
 
-def main():
+def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser()
     parser.add_argument("--platform", choices=("linux", "windows", "web"))
     parser.add_argument("--build", type=Path)
@@ -137,23 +152,27 @@ def main():
     parser.add_argument("--revision")
     parser.add_argument("--docs", type=Path)
     parser.add_argument("--output", required=True, type=Path)
-    args = parser.parse_args()
-    if args.docs is not None:
-        if args.platform is not None or args.build is not None or args.version is not None or args.revision is not None:
-            parser.error("--docs cannot be combined with --platform, --build, --version or --revision")
-        collect_docs(args.docs, args.output)
-    else:
-        if args.platform is None or args.build is None or args.version is None:
-            parser.error("--platform, --build and --version are required when --docs is not specified")
-        if args.platform == "web":
-            if args.revision is None:
-                parser.error("--revision is required for --platform web")
-            package_web(args.build, args.output, args.version, args.revision)
+    args = parser.parse_args(argv)
+    try:
+        if args.docs is not None:
+            if args.platform is not None or args.build is not None or args.version is not None or args.revision is not None:
+                parser.error("--docs cannot be combined with --platform, --build, --version or --revision")
+            collect_docs(args.docs, args.output)
         else:
-            if args.revision is not None:
-                parser.error("--revision requires --platform web")
-            package(args.platform, args.build, args.output, args.version)
+            if args.platform is None or args.build is None or args.version is None:
+                parser.error("--platform, --build and --version are required when --docs is not specified")
+            if args.platform == "web":
+                if args.revision is None:
+                    parser.error("--revision is required for --platform web")
+                package_web(args.build, args.output, args.version, args.revision)
+            else:
+                if args.revision is not None:
+                    parser.error("--revision requires --platform web")
+                package(args.platform, args.build, args.output, args.version)
+    except (RuntimeError, ValueError, OSError) as error:
+        parser.error(str(error))
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main())
diff --git a/tools/pad_input.py b/tools/pad_input.py
index ab93227072..69b1d64579 100644
--- a/tools/pad_input.py
+++ b/tools/pad_input.py
@@ -52,14 +52,28 @@ def next_sequence(path):
     return sequence
 
 
+def button_mask(value):
+    names = value.split("+")
+    if any(name not in BUTTONS for name in names) or ("release" in names and len(names) > 1) or len(set(names)) != len(names):
+        raise argparse.ArgumentTypeError(f"invalid button {value!r}: use one of {', '.join(BUTTONS)}, or several joined by '+'")
+    mask = 0
+    for name in names:
+        mask |= BUTTONS[name]
+    return mask
+
+
 def main():
     parser = argparse.ArgumentParser(description="Queue a controller pulse for APS5_PAD_INPUT_FILE.")
     parser.add_argument("path", type=Path)
-    parser.add_argument("button", choices=BUTTONS)
+    parser.add_argument("button", help=f"a button name ({', '.join(BUTTONS)}), or several joined by '+' to press them together (for example l1+r1); release must be used alone")
     parser.add_argument("--hold-ms", type=int, default=300)
     parser.add_argument("--left-stick", type=int, nargs=2, metavar=("X", "Y"))
     parser.add_argument("--right-stick", type=int, nargs=2, metavar=("X", "Y"))
     args = parser.parse_args()
+    try:
+        mask = button_mask(args.button)
+    except argparse.ArgumentTypeError as error:
+        parser.error(str(error))
     if not 1 <= args.hold_ms <= 5000:
         parser.error("--hold-ms must be between 1 and 5000")
     sticks = ""
@@ -86,7 +100,7 @@ def main():
                 if os.geteuid() == 0:
                     os.fchown(output.fileno(), metadata.st_uid, metadata.st_gid)
                 os.fchmod(output.fileno(), stat.S_IMODE(metadata.st_mode))
-            output.write(f"{sequence} {BUTTONS[args.button]} {args.hold_ms}{sticks}\n")
+            output.write(f"{sequence} {mask} {args.hold_ms}{sticks}\n")
         os.replace(temporary, args.path)
     finally:
         if temporary is not None:
diff --git a/tools/performance_compare.py b/tools/performance_compare.py
index 4642a983ff..6a6c599351 100644
--- a/tools/performance_compare.py
+++ b/tools/performance_compare.py
@@ -166,7 +166,7 @@ def markdown(report):
 def main(argv=None):
     for stream in (sys.stdout, sys.stderr):
         if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8")
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Compare two aps5-summary.jsonl captures. "
                                      "Reports numerical differences, not statistical significance or an automatic pass/fail verdict.")
     parser.add_argument("baseline", type=Path, help="Baseline summary JSONL file")
diff --git a/tools/pr_labels.py b/tools/pr_labels.py
index 4ca5c70a9b..f6f0039090 100644
--- a/tools/pr_labels.py
+++ b/tools/pr_labels.py
@@ -121,18 +121,25 @@ def process(repo, pr, dry_run, comment=True):
     return add, remove, post
 
 
-def main():
+def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Label pull requests from their title and template fields.")
     which = parser.add_mutually_exclusive_group(required=True)
     which.add_argument("--pr", type=int, help="label one pull request")
     which.add_argument("--all", action="store_true", help="label every open pull request")
     parser.add_argument("--dry-run", action="store_true", help="print the planned changes and write nothing")
-    args = parser.parse_args()
-    repo = repository()
-    if args.pr is not None:
-        prs = [pull(json.loads(gh("api", f"repos/{repo}/pulls/{args.pr}")))]
-    else:
-        prs = [pull(data) for data in decode_pages(gh("api", "--paginate", f"repos/{repo}/pulls?state=open&base=main&per_page=100"))]
+    args = parser.parse_args(argv)
+    try:
+        repo = repository()
+        if args.pr is not None:
+            prs = [pull(json.loads(gh("api", f"repos/{repo}/pulls/{args.pr}")))]
+        else:
+            prs = [pull(data) for data in decode_pages(gh("api", "--paginate", f"repos/{repo}/pulls?state=open&base=main&per_page=100"))]
+    except subprocess.CalledProcessError as error:
+        parser.error((error.stderr or str(error)).strip())
     failed = []
     for pr in prs:
         try:
@@ -148,7 +155,8 @@ def main():
                 time.sleep(WRITE_PAUSE)
     if failed:
         sys.exit(f"{len(failed)} pull requests not labeled: {', '.join(f'#{number}' for number in failed)}")
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main())
diff --git a/tools/pr_overlap.py b/tools/pr_overlap.py
index 6699df9ebf..eadcf79576 100644
--- a/tools/pr_overlap.py
+++ b/tools/pr_overlap.py
@@ -1,13 +1,18 @@
 import argparse
+import io
 import json
 import os
 import re
 import subprocess
+import sys
 from concurrent.futures import ThreadPoolExecutor
 from itertools import combinations
 from pathlib import Path
+import tarfile
 from urllib.parse import quote, urlencode
 
+import nid_names
+
 PARENT = 'if .parent then "\\(.parent.owner.login)/\\(.parent.name)" else .nameWithOwner end'
 EXPORT = re.compile(r"^\+.*\bAPS5_VABI\s+(\w+)\s*\(")
 NID_DISAMBIG = re.compile(r"_nid_disambig[0-9]+$")
@@ -16,10 +21,33 @@ PLAIN_DEPENDS = re.compile(r'Depends on[ \t]+(#\d+\b(?:(?:[ \t]*,[ \t]*(?:and[ \
 HUNK = re.compile(r"^@@ -(\d+)(?:,(\d+))?", re.M)
 MARKER = "<!-- pr-overlap -->"
 FETCH_REFS = 100
+_REPO_ROOTS = {}
 
 
 def git(*args):
-    result = subprocess.run(["git", "-c", "core.quotePath=false", *args], capture_output=True)
+    cwd = Path.cwd()
+    root = _REPO_ROOTS.get(cwd)
+    if root is None:
+        root = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"], cwd=cwd, capture_output=True, check=True
+        ).stdout.decode("utf-8", errors="replace").strip()
+        _REPO_ROOTS[cwd] = root
+    args = list(args)
+    if "--" in args:
+        separator = args.index("--")
+        for index in range(separator + 1, len(args)):
+            pathspec = args[index]
+            if pathspec.startswith(("../", "..\\")):
+                absolute = (cwd / pathspec).resolve()
+                try:
+                    args[index] = absolute.relative_to(Path(root)).as_posix()
+                except ValueError:
+                    pass
+    result = subprocess.run(
+        ["git", "-c", "core.quotePath=false", *args],
+        cwd=root,
+        capture_output=True,
+    )
     result.stdout = result.stdout.decode("utf-8", errors="replace")
     result.stderr = result.stderr.decode("utf-8", errors="replace")
     result.check_returncode()
@@ -88,8 +116,15 @@ def fetch(base, prs):
 
 
 def merge(*args):
+    cwd = Path.cwd()
+    root = _REPO_ROOTS.get(cwd)
+    if root is None:
+        root = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"], cwd=cwd, capture_output=True, check=True
+        ).stdout.decode("utf-8", errors="replace").strip()
+        _REPO_ROOTS[cwd] = root
     result = subprocess.run(["git", "-c", "core.quotePath=false", "merge-tree", "--write-tree", "--name-only", "--no-messages", "-z", *args],
-                            capture_output=True)
+                            cwd=root, capture_output=True)
     lines = result.stdout.decode("utf-8", errors="replace").rstrip("\0").split("\0")
     if result.returncode not in (0, 1) or not lines[0]:
         error = result.stderr.decode("utf-8", errors="replace").strip()
@@ -102,16 +137,18 @@ def commit(tree):
                "-p", "refs/pr/base", "-m", "pr_overlap").strip()
 
 
-def exports(diff):
+def exports(diff, prefix="+"):
     found = set()
     lines = diff.splitlines()
     for i, line in enumerate(lines):
-        m = EXPORT.match(line)
+        if not line.startswith(prefix) or line.startswith(prefix * 3):
+            continue
+        m = EXPORT.match(prefix + line[1:])
         if not m or m.group(1).endswith(("_nid_no_patch", "_nid_no_patch_cut")):
             continue
         text = line[1:]
         for nxt in lines[i + 1:]:
-            if ";" in text or "{" in text or not nxt.startswith("+") or nxt.startswith("+++"):
+            if ";" in text or "{" in text or not nxt.startswith(prefix) or nxt.startswith(prefix * 3):
                 break
             text += nxt[1:]
         semi, brace = text.find(";"), text.find("{")
@@ -121,6 +158,73 @@ def exports(diff):
     return found
 
 
+def changed_source(diff, prefix):
+    files, current, path = [], [], None
+    for line in diff.splitlines():
+        if line.startswith("diff --git "):
+            if current and path:
+                files.append((path, "\n".join(current)))
+            path = line.split(" b/", 1)[1] if " b/" in line else None
+            current = []
+        elif line.startswith(prefix) and not line.startswith(prefix * 3):
+            current.append(line[1:])
+    if current and path:
+        files.append((path, "\n".join(current)))
+    return files
+
+
+def library_for_path(path):
+    parts = Path(path).parts
+    return "/".join(parts[:4]) if len(parts) > 3 and parts[:3] == ("core", "libs", "prx") else ""
+
+
+def source_exports(text, library=""):
+    found = {}
+    for match in nid_names.source_definitions(text):
+        name = nid_names.strip_nid_postfix(match.group(1))
+        if not name.endswith(("_nid_no_patch", "_nid_no_patch_cut")):
+            found.setdefault((library, nid_names.compute_nid(name)), set()).add(name)
+    for name in nid_names.source_assembly_definitions(text):
+        name = nid_names.strip_nid_postfix(name)
+        if not name.endswith(("_nid_no_patch", "_nid_no_patch_cut")):
+            found.setdefault((library, nid_names.compute_nid(name)), set()).add(name)
+    for nid, name in nid_names.source_aliases(text):
+        found.setdefault((library, nid), set()).add(name)
+    return found
+
+
+def source_changed_exports(diff, prefix):
+    found = {}
+    for path, text in changed_source(diff, prefix):
+        library = library_for_path(path)
+        for key, names in source_exports(text, library).items():
+            found.setdefault(key, set()).update(names)
+        file_diff = "\n".join(prefix + line for line in text.splitlines())
+        for name in exports(file_diff, prefix):
+            canonical = nid_names.strip_nid_postfix(name)
+            found.setdefault((library, nid_names.compute_nid(canonical)), set()).add(canonical)
+    return found
+
+
+def base_exports(ref):
+    root = git("rev-parse", "--show-toplevel").strip()
+    archive = subprocess.run(
+        ["git", "-C", root, "archive", "--format=tar", ref, "core/libs"], capture_output=True, check=True
+    ).stdout
+    found = {}
+    with tarfile.open(fileobj=io.BytesIO(archive), mode="r:") as source:
+        for entry in source:
+            path = Path(entry.name)
+            if not entry.isfile() or path.suffix != ".cpp" or any(
+                    part.lower() in {"test", "tests"} for part in path.parts[2:-1]):
+                continue
+            text = source.extractfile(entry).read().decode("utf-8", errors="replace")
+            library = library_for_path(entry.name)
+            for key, names in source_exports(text, library).items():
+                found.setdefault(key, set()).update(names)
+    return found
+
+
 def scan(pr):
     tree, conflicted = merge("refs/pr/base", pr["ref"])
     pr["tree"] = None if conflicted else commit(tree)
@@ -133,6 +237,8 @@ def scan(pr):
             pr["added"].add(path)
     diff = git("diff", "-U0", "--no-color", old, new, "--", "core/libs/prx/*.cpp")
     pr["exports"] = exports(diff)
+    pr["added_exports"] = source_changed_exports(diff, "+")
+    pr["removed_exports"] = source_changed_exports(diff, "-")
 
 
 def scan_all(prs, jobs):
@@ -208,9 +314,10 @@ def pull(blob, number):
     return f'[PR {number}]({blob.split("/blob/", 1)[0].replace("https://github.com/", "https://www.github.com/", 1)}/pull/{number})'
 
 
-def report(rows, blob):
+def report(rows, blob, main_exports=None):
     if not rows:
-        return ""
+        if not main_exports:
+            return ""
     confirmed = {number: found for number, found in rows.items()
                  if found.get("conflicts") or found.get("exports") or found["added"]}
     uncompared = {number: found["uncompared"] for number, found in rows.items() if found.get("uncompared")}
@@ -225,6 +332,12 @@ def report(rows, blob):
         ])
         for number, found in sorted(confirmed.items()):
             lines.append(f'| {pull(blob, number)} | {spans(found.get("conflicts"), blob)} | {cell(found.get("exports"))} | {cell(found["added"])} |')
+    if main_exports:
+        if confirmed:
+            lines.append("")
+        lines.append("Exports introduced here that are already present in `main`:")
+        lines.append("")
+        lines.append(f"- {cell(main_exports)}")
     if uncompared:
         if confirmed:
             lines.append("")
@@ -240,10 +353,24 @@ def report(rows, blob):
     return "\n".join(lines) + "\n"
 
 
-def write_reports(out, rows, blob):
+def write_reports(out, rows, blob, main_exports=None):
+    main_exports = main_exports or {}
     out.mkdir(parents=True, exist_ok=True)
     for number, found in rows.items():
-        (out / f"{number}.md").write_text(report(found, blob), encoding="utf-8")
+        (out / f"{number}.md").write_text(report(found, blob, main_exports.get(number)), encoding="utf-8")
+
+
+def main_export_findings(prs, current_exports):
+    findings = {}
+    for number, pr in prs.items():
+        candidates = set(pr.get("added_exports", {})) - set(pr.get("removed_exports", {}))
+        names = set()
+        for key in candidates & set(current_exports):
+            names.update(pr["added_exports"][key])
+            names.update(current_exports[key])
+        if names:
+            findings[number] = names
+    return findings
 
 
 def describe_failure(error):
@@ -252,18 +379,23 @@ def describe_failure(error):
     return f"pr_overlap: {command} failed with exit code {error.returncode}: {message}"
 
 
-if __name__ == "__main__":
+def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="report open pull requests that overlap each other")
     parser.add_argument("--base", default="main")
     parser.add_argument("--out", type=Path, help="write <number>.md for every open pull request (empty when clean)")
     parser.add_argument("--branch", help="check a local branch against the open pull requests instead")
     parser.add_argument("--repo", help="owner/name; defaults to the upstream of the current checkout")
     parser.add_argument("--jobs", type=int, default=4, help="number of pull request comparisons to run at once")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     if bool(args.out) == bool(args.branch):
         parser.error("pass exactly one of --out or --branch")
     if args.jobs < 1:
         parser.error("--jobs must be at least 1")
+    global REPO
     try:
         REPO = args.repo or upstream()
         prs = open_prs(args.base)
@@ -273,7 +405,9 @@ if __name__ == "__main__":
             prs = own(prs, sha)
             prs[0] = {"ref": sha, "author": None, "depends": set()}
         scan_all(prs, args.jobs)
+        current_exports = base_exports("refs/pr/base")
         rows = {n: {} for n in prs}
+        main_exports = main_export_findings(prs, current_exports)
         pairs = [(0, n) for n in prs if n] if args.branch else combinations(prs, 2)
         for a, b in pairs:
             if found := overlaps(prs, a, b):
@@ -282,6 +416,11 @@ if __name__ == "__main__":
     except subprocess.CalledProcessError as error:
         raise SystemExit(describe_failure(error))
     if args.branch:
-        print(report(rows[0], blob) or "No overlap with open pull requests.", end="")
-        raise SystemExit
-    write_reports(args.out, rows, blob)
+        print(report(rows[0], blob, main_exports.get(0)) or "No overlap with open pull requests.", end="")
+        return 0
+    write_reports(args.out, rows, blob, main_exports)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/progress.py b/tools/progress.py
index 944ba4170b..a3c38e1e83 100644
--- a/tools/progress.py
+++ b/tools/progress.py
@@ -441,8 +441,46 @@ def compare(title, column, unit, base, head):
     return lines + [""]
 
 
+def library_progress(group):
+    if group is None:
+        return "Not present", None
+    if "shared_sources" in group:
+        return f'Shared sources: `{group["shared_sources"]}`', None
+    if "done" not in group or "todo" not in group:
+        return "Counts unavailable", None
+    total = group["done"] + group["todo"]
+    if not total:
+        return "No exports", None
+    percent = 100 * group["done"] / total
+    return f'{group["done"]}/{total} ({percent:.2f}%)', percent
+
+
+def library_report(base, head):
+    before, after = ({group["name"]: group for group in data["groups"]} for data in (base, head))
+    fields = ("done", "todo", "done_names", "todo_names", "shared_sources")
+    rows = []
+    for name in sorted(before.keys() | after.keys(), key=str.casefold):
+        old, new = before.get(name), after.get(name)
+        if old is not None and new is not None and all(old.get(field) == new.get(field) for field in fields):
+            continue
+        old_text, old_percent = library_progress(old)
+        new_text, new_percent = library_progress(new)
+        delta = "n/a"
+        if old_percent is not None and new_percent is not None:
+            delta = f'{round(new_percent - old_percent, 2) or 0:+.2f} pp'
+        rows.append(f"| {name} | {old_text} | {new_text} | {delta} |")
+    if not rows:
+        return []
+    lines = ["#### Changed libraries (implemented exports)", "",
+             "| Library | Before | After | Change |", "| - | - | - | - |"] + rows[:REPORT_ROWS]
+    if len(rows) > REPORT_ROWS:
+        lines.append(f"| ... | {len(rows) - REPORT_ROWS} more libraries | | |")
+    return lines + [""]
+
+
 def report(base, head):
     lines = compare("System libraries", "Library", "functions", base["libraries"], head["libraries"])
+    lines += library_report(base["libraries"], head["libraries"])
     lines += compare("GPU shader instructions", "Encoding", "instructions", base["shaders"], head["shaders"])
     return "\n".join(lines)
 
@@ -526,7 +564,10 @@ def main(argv=None):
         except ValueError as error:
             parser.error(str(error))
         if args.output:
-            write_site(args.output, libraries, shaders)
+            try:
+                write_site(args.output, libraries, shaders)
+            except OSError as error:
+                parser.error(f"{args.output}: {error.strerror or error}")
         if args.json:
             print(json.dumps({"libraries": libraries, "shaders": shaders}, indent=2))
         else:
diff --git a/tools/progress_history.py b/tools/progress_history.py
index ca8460652a..b223ab7c58 100644
--- a/tools/progress_history.py
+++ b/tools/progress_history.py
@@ -26,7 +26,7 @@ def git(*args):
 
 def daily_commits(ref):
     seen = {}
-    for line in git("log", "--first-parent", "--format=%H %ct", ref).decode().splitlines():
+    for line in git("log", "--first-parent", "--format=%H %ct", ref).decode("utf-8").splitlines():
         sha, timestamp = line.split()
         seen.setdefault(datetime.fromtimestamp(int(timestamp), timezone.utc).date().isoformat(), sha)
     return sorted(seen.items())
@@ -221,12 +221,12 @@ def page(points):
     ]) + "\n"
 
 
-if __name__ == "__main__":
+def main(argv=None):
     parser = argparse.ArgumentParser()
     parser.add_argument("output", type=Path)
     parser.add_argument("--ref", default="HEAD", help="branch or commit whose first-parent history is measured")
     parser.add_argument("--cache", type=Path, help="reuse per-commit counts while the scanner, ISA list and Python version match")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     try:
         if args.cache:
             outputs = [args.output / name for name in ("history.json", "history.svg", "history.html")]
@@ -239,7 +239,11 @@ if __name__ == "__main__":
     if not points:
         parser.error("no commit with a measurable tree")
     args.output.mkdir(parents=True, exist_ok=True)
-    (args.output / "history.json").write_text(json.dumps(points, indent=2))
-    (args.output / "history.svg").write_text(chart(points) + "\n")
-    (args.output / "history.html").write_text(page(points))
+    (args.output / "history.json").write_text(json.dumps(points, indent=2), encoding="utf-8")
+    (args.output / "history.svg").write_text(chart(points) + "\n", encoding="utf-8")
+    (args.output / "history.html").write_text(page(points), encoding="utf-8")
     print(f"{len(points)} days, {points[0]['date']} .. {points[-1]['date']}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/run_job_manager_reference.py b/tools/run_job_manager_reference.py
new file mode 100644
index 0000000000..d804f3e573
--- /dev/null
+++ b/tools/run_job_manager_reference.py
@@ -0,0 +1,135 @@
+import argparse
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+from import_audit import read_host_imports
+from unwrap_self import unwrap
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "core/relinker/relinker/tests"))
+from guest_import_fixtures import executable
+
+CASES = ("memory", "validation", "dispatch", "ordering", "nested", "limits", "node_pool", "priority", "shutdown", "worker_policy", "worker_wake", "worker_wait", "worker_count", "worker_spin")
+
+
+def stage_libraries(directory, build, toolchain, dependencies):
+    providers = {path.name.lower(): path for path in (build / "core/libs/libs").glob("*.prx")}
+    providers.update({path.name.lower(): path for path in toolchain.glob("*.dll")})
+    pending = list(dependencies)
+    staged = set()
+    while pending:
+        name = pending.pop().lower()
+        if name in staged:
+            continue
+        staged.add(name)
+        source = providers.get(name)
+        if source is None:
+            if name.endswith(".prx"):
+                raise RuntimeError(f"Missing patched runtime {name}; build core/libs/libs/{name}")
+            continue
+        shutil.copy2(source, directory / source.name)
+        pending.extend(read_host_imports(source))
+
+
+def run(args, directory):
+    libraries = directory / "libs"
+    libraries.mkdir()
+    helper = args.build / "tests/job_manager_reference.prx"
+    if not helper.is_file():
+        raise RuntimeError("Build the job_manager_reference target first")
+    shutil.copy2(helper, libraries / "jobref.prx")
+    subprocess.run([str(args.build / "core/libs/nid_patcher.exe"), "jobref", "--preserve-export-list",
+                    str(args.build / "core/libs/libc.exports"), str(libraries / "jobref.prx")], check=True, capture_output=True)
+    module_hash = None
+    if args.module:
+        module_data = args.module.read_bytes()
+        module_hash = hashlib.sha256(module_data).hexdigest()
+        modules = directory / "sce_module"
+        modules.mkdir()
+        target = modules / "libSceJobManager.prx"
+        if module_data[:4] == b"\x7fELF":
+            shutil.copy2(args.module, target)
+        else:
+            unwrap(args.module, target)
+    source = directory / "input.elf"
+    source.write_bytes(executable("jobref.prx", symbol="Run_nid_no_patch"))
+    output = directory / "reference.exe"
+    options = ["--skip-sce-module"] if args.host else []
+    result = subprocess.run([str(args.relinker), "--windows", "--registry", *options, str(source), str(output)],
+                            cwd=directory, capture_output=True, timeout=60)
+    (directory / "relink.log").write_bytes(result.stdout + result.stderr)
+    if result.returncode:
+        raise RuntimeError(f"Relinker failed ({result.returncode}); see {directory / 'relink.log'}")
+    dependencies = set(read_host_imports(helper)) | {"libc.prx"}
+    for registry in directory.glob("*.registry.json"):
+        dependencies.update(entry["library"] for entry in json.loads(registry.read_text())
+                            if entry.get("library") not in ("jobref.prx", "libSceJobManager.prx"))
+    if args.host:
+        dependencies.add("libSceJobManager.prx")
+    stage_libraries(libraries, args.build, args.toolchain, dependencies)
+    environment = os.environ.copy()
+    environment["PATH"] = str(libraries) + os.pathsep + environment.get("PATH", "")
+    environment.pop("ANYPS5_JOB_MANAGER_HOST", None)
+    if args.host:
+        environment["ANYPS5_JOB_MANAGER_HOST"] = "1"
+    results = []
+    for case in args.cases:
+        environment["ANYPS5_JOB_MANAGER_CASE"] = case
+        try:
+            result = subprocess.run([str(output)], cwd=directory, env=environment,
+                                    capture_output=True, timeout=args.timeout)
+            log = result.stdout + result.stderr
+            status = "passed" if result.returncode == 0 else "failed"
+            code = result.returncode
+        except subprocess.TimeoutExpired as error:
+            log = (error.stdout or b"") + (error.stderr or b"")
+            status, code = "timeout", None
+        (directory / f"{case}.log").write_bytes(log)
+        results.append({"case": case, "status": status, "returncode": code})
+        print(json.dumps(results[-1]), flush=True)
+    summary = {"provider": "host" if args.host else "guest", "module_sha256": module_hash, "cases": results}
+    (directory / "results.json").write_text(json.dumps(summary, indent=2) + "\n")
+    return 0 if all(result["status"] == "passed" for result in results) else 1
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Run the CPU JobManager fixtures through Windows relinker startup using an owned module or the host fallback.")
+    provider = parser.add_mutually_exclusive_group(required=True)
+    provider.add_argument("--module", type=Path, help="Owned decrypted SELF or ELF libSceJobManager.prx")
+    provider.add_argument("--host", action="store_true", help="Validate the runner against the built host fallback")
+    parser.add_argument("--build", type=Path, required=True)
+    parser.add_argument("--relinker", type=Path, required=True)
+    parser.add_argument("--toolchain", type=Path, required=True, help="Directory containing the matching compiler runtime DLLs")
+    parser.add_argument("--output", type=Path, help="New directory for staged modules, per-case logs and results.json; defaults to a temporary directory")
+    parser.add_argument("--cases", nargs="+", choices=CASES, default=list(CASES))
+    parser.add_argument("--timeout", type=float, default=20)
+    args = parser.parse_args()
+    if sys.platform != "win32":
+        parser.error("The reference adapter currently supports Windows only")
+    if args.timeout <= 0 or args.timeout > 30:
+        parser.error("--timeout must be greater than zero and at most 30 seconds")
+    try:
+        for name in ("build", "relinker", "toolchain", "module"):
+            value = getattr(args, name)
+            if value is not None:
+                setattr(args, name, value.resolve(strict=True))
+        directory = args.output.resolve() if args.output else Path(tempfile.mkdtemp(prefix="anyps5-jobmanager-"))
+        if args.output:
+            directory.mkdir(parents=True, exist_ok=False)
+        print(f"Artifacts: {directory}", flush=True)
+        return run(args, directory)
+    except (OSError, RuntimeError, subprocess.SubprocessError) as error:
+        print(str(error), file=sys.stderr)
+        if isinstance(error, subprocess.CalledProcessError) and error.stderr:
+            print(error.stderr.decode(errors="replace"), file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/select_tests.py b/tools/select_tests.py
index efb972d0a1..02b15cfbbe 100644
--- a/tools/select_tests.py
+++ b/tools/select_tests.py
@@ -1,5 +1,6 @@
 import argparse
 import collections
+import importlib.util
 import json
 import os
 import re
@@ -7,6 +8,10 @@ import subprocess
 import sys
 from pathlib import Path
 
+REGISTRATION_SPEC = importlib.util.spec_from_file_location("check_test_registration", Path(__file__).with_name("check_test_registration.py"))
+REGISTRATION = importlib.util.module_from_spec(REGISTRATION_SPEC)
+REGISTRATION_SPEC.loader.exec_module(REGISTRATION)
+
 FULL = re.compile(r"^CMakeLists\.txt$|^core/CMakeLists\.txt$|^core/libs/CMakeLists\.txt$|^\.github/workflows/build\.yml$"
                   r"|^3rdparty/|^cmake/|^\.gitmodules$|^tools/select_tests\.py$")
 LOCAL = re.compile(r"(^|/)CMakeLists\.txt$|\.cmake$")
@@ -16,7 +21,7 @@ BATCH = 20000
 class Build:
     def __init__(self, path):
         cache = {}
-        for line in (Path(path) / "CMakeCache.txt").read_text(encoding="utf-8").splitlines():
+        for line in (Path(path) / "CMakeCache.txt").read_text(encoding="utf-8-sig").splitlines():
             name, _, value = line.partition("=")
             cache[name.partition(":")[0]] = value
         self.path = os.path.normpath(cache["CMAKE_CACHEFILE_DIR"])
@@ -84,11 +89,43 @@ class Build:
                 leaves.add(name)
         return sorted(leaves)
 
+    def outputs(self, paths):
+        built = {line.rpartition(": ")[0] for line in self.run("-t", "targets", "all").splitlines()}
+        return [path for path in paths if path in built]
+
     def tests(self, *arguments):
         listing = json.loads(subprocess.run(["ctest", "--test-dir", self.path, "--show-only=json-v1", *arguments],
                                             capture_output=True, text=True, check=True).stdout)
+        missing = {test["name"] for test in listing["tests"] if not test.get("command")}
+        if missing:
+            commands = self.test_commands(missing)
+            for test in listing["tests"]:
+                candidates = commands.get(test["name"], set())
+                if test["name"] in missing and len(candidates) == 1:
+                    command = next(iter(candidates))
+                    if command and os.path.isabs(command[0]):
+                        test["command"] = list(command)
         return listing, listing["tests"]
 
+    def test_commands(self, names):
+        found, visited, pending = collections.defaultdict(set), set(), [Path(self.path)]
+        while pending:
+            directory = pending.pop().resolve()
+            file = directory / "CTestTestfile.cmake"
+            if directory in visited or not file.is_file():
+                continue
+            visited.add(directory)
+            try:
+                commands = list(REGISTRATION.commands(file.read_text(encoding="utf-8-sig")))
+            except (OSError, UnicodeError, ValueError):
+                continue
+            for command, arguments in commands:
+                if command == "subdirs":
+                    pending.extend(directory / argument for argument in arguments)
+                elif command == "add_test" and arguments and arguments[0] in names:
+                    found[arguments[0]].add(tuple(arguments[1:]))
+        return found
+
     def output(self, path):
         absolute = self.absolute(path)
         if not inside(absolute, self.path):
@@ -110,14 +147,24 @@ def relative(path, root):
     return path[root_len + 1:].replace(os.sep, "/")
 
 
+def paths(arguments):
+    for argument in arguments:
+        value = argument.partition("=")[2] if argument.startswith("-D") else argument
+        if os.path.isabs(value):
+            yield value
+
+
 def chunks(names):
     batch, size = [], 0
     for name in names:
-        if batch and size + len(name) + 1 > BATCH:
+        length = len(name) + 1
+        if sys.platform == "win32":
+            length = len(subprocess.list2cmdline([name]).encode("utf-16-le", "surrogatepass")) // 2 + 1
+        if batch and size + length > BATCH:
             yield batch
             batch, size = [], 0
         batch.append(name)
-        size += len(name) + 1
+        size += length
     if batch:
         yield batch
 
@@ -157,7 +204,7 @@ def dump(build, out):
             registered.add(build.repo(graph["files"][graph["nodes"][node]["file"]]))
             node = graph["nodes"][node].get("parent")
         props = {p["name"]: p["value"] for p in test.get("properties", [])}
-        arguments = sorted({build.repo(a) for a in (test.get("command") or [])[1:] if os.path.isabs(a)} - {None})
+        arguments = sorted({build.repo(a) for a in paths((test.get("command") or [])[1:])} - {None})
         tests[test["name"]] = {"registered": sorted(registered - {None}), "arguments": arguments,
                                "requires": props.get("FIXTURES_REQUIRED", []), "sets": props.get("FIXTURES_SETUP", []),
                                "depends": props.get("DEPENDS", []), "target": build.target(test)}
@@ -216,16 +263,22 @@ def plan(build, graph, picked):
     _, selected = build.tests("-I", "0,0,0," + ",".join(map(str, run)))
     names = {t["name"] for t in selected}
     run = [i for i, t in enumerate(listed, 1) if t["name"] in names]
-    keep = {build.output(a) for t in listed if t["name"] in names for a in t.get("command") or [] if os.path.isabs(a)}
+    if any(not t.get("command") for t in listed if t["name"] in names):
+        return run, build.leaves(), len(listed)
+    keep = {build.output(a) for t in listed if t["name"] in names for a in paths(t.get("command") or [])}
     skip = {build.target(t) for t in listed if t["name"] not in names} - keep - {None}
-    return run, [t for t in build.leaves() if t not in skip], len(listed)
+    targets = [t for t in build.leaves() if t not in skip]
+    return run, targets + build.outputs(sorted(keep - set(targets) - {None})), len(listed)
 
 
 def escape(name):
     return name.replace("$", "$$").replace(":", "$:").replace(" ", "$ ")
 
 
-def main():
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Select the tests whose build inputs a change touches")
     sub = parser.add_subparsers(dest="command", required=True)
     d = sub.add_parser("dump", help="write the test graph of a built tree")
@@ -241,15 +294,15 @@ def main():
     c = sub.add_parser("ctest", help="run ctest on a tree, limited to the selected tests if select wrote any")
     c.add_argument("build")
     c.add_argument("arguments", nargs=argparse.REMAINDER, help="ctest arguments")
-    args = parser.parse_args()
+    args = parser.parse_args(argv)
     if args.command == "ctest":
         selected = Path(args.build, "select.tests")
-        extra = ["-I", selected.read_text(encoding="utf-8").strip()] if selected.exists() else []
+        extra = ["-I", selected.read_text(encoding="utf-8-sig").strip()] if selected.exists() else []
         return subprocess.run(["ctest", "--test-dir", args.build, *args.arguments, *extra]).returncode
     if args.command == "explain":
         try:
-            graph = json.loads(args.graph.read_text(encoding="utf-8"))
-            changed = [line.strip() for line in args.changed.read_text(encoding="utf-8").splitlines() if line.strip()]
+            graph = json.loads(args.graph.read_text(encoding="utf-8-sig"))
+            changed = [line.strip() for line in args.changed.read_text(encoding="utf-8-sig").splitlines() if line.strip()]
             reasons = {}
             picked, full = select(graph, changed, reasons)
         except (OSError, ValueError) as error:
@@ -270,7 +323,7 @@ def main():
     if not os.path.exists(args.graph):
         print("full run: no test graph")
         return 0
-    graph = json.loads(Path(args.graph).read_text(encoding="utf-8"))
+    graph = json.loads(Path(args.graph).read_text(encoding="utf-8-sig"))
     changed = [line.strip() for line in Path(args.changed).read_text(encoding="utf-8-sig").splitlines() if line.strip()]
     picked, full = select(graph, changed)
     if picked is None:
diff --git a/tools/stubgen.py b/tools/stubgen.py
index a701cb5472..7426cd8aa2 100644
--- a/tools/stubgen.py
+++ b/tools/stubgen.py
@@ -211,6 +211,9 @@ def write_outputs(outputs):
 
 
 def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace", newline="\n")
     ap = argparse.ArgumentParser(description="Generate AnyPS5 Export.cpp skeletons and TechnicalDebt lines")
     ap.add_argument("--module", required=True, help="target module name, e.g. libSceAmpr, used for UnknownNN prefix and default TechnicalDebt path core/libs/prx/MODULE/Export.cpp")
     ap.add_argument("--nids", required=True, help="path to missing-NIDs file, one 11-char NID per line")
@@ -221,9 +224,6 @@ def main(argv=None):
     ap.add_argument("--td-out", required=False, default=None, help="output file for TechnicalDebt lines, which go in docs/dev/debt/MODULE.md, default stderr when code uses stdout, otherwise stdout")
     ap.add_argument("--td-only", action="store_true", help="print only TechnicalDebt lines, no code")
     args = ap.parse_args(argv)
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8", newline="\n")
     try:
         if not args.td_only and args.out and args.td_out and same_file(args.out, args.td_out):
             ap.error("--out and --td-out must name different files")
diff --git a/tools/suggest_patches.py b/tools/suggest_patches.py
new file mode 100644
index 0000000000..51d91d85a1
--- /dev/null
+++ b/tools/suggest_patches.py
@@ -0,0 +1,190 @@
+import argparse
+import hashlib
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+import tomllib
+from pathlib import Path, PurePosixPath
+
+
+SHA256 = re.compile(r"[0-9a-fA-F]{64}\Z")
+VERIFY_SUMMARY = re.compile(r"^Verified (\d+) patches: (\d+) ok, (\d+) not-checked, (\d+) mismatch$", re.MULTILINE)
+
+
+def confined(root, name):
+    if not isinstance(name, str) or not name or "\\" in name:
+        raise ValueError(f"invalid relative path: {name!r}")
+    path = PurePosixPath(name)
+    if path.is_absolute() or any(part in (".", "..") for part in name.split("/")):
+        raise ValueError(f"invalid relative path: {name!r}")
+    resolved = (root / Path(*path.parts)).resolve()
+    if not resolved.is_relative_to(root.resolve()) or not resolved.is_file():
+        raise ValueError(f"file missing or outside directory: {name}")
+    return resolved
+
+
+def sha256(path):
+    digest = hashlib.sha256()
+    with path.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def command_line(arguments):
+    return subprocess.list2cmdline(arguments) if os.name == "nt" else shlex.join(arguments)
+
+
+def load_catalog(directory, title, version):
+    data = json.loads(confined(directory, "index.json").read_text(encoding="utf-8"))
+    if not isinstance(data, dict) or set(data) != {"format", "entries"} or type(data["format"]) is not int or data["format"] != 1 or not isinstance(data["entries"], list):
+        raise ValueError("catalog must have format 1 and an entries array")
+    entries = []
+    for number, entry in enumerate(data["entries"], 1):
+        if not isinstance(entry, dict) or (entry.get("titleId"), entry.get("contentVersion")) != (title, version):
+            continue
+        entries.append((number, entry))
+    return entries
+
+
+def validate_entry(directory, entry):
+    if set(entry) != {"titleId", "contentVersion", "patch", "targets"}:
+        raise ValueError("invalid fields")
+    patch = confined(directory, entry["patch"])
+    targets = entry["targets"]
+    if not isinstance(targets, dict) or not targets:
+        raise ValueError("targets must be a nonempty object")
+    if any(not isinstance(name, str) or not isinstance(digest, str) or not SHA256.fullmatch(digest) for name, digest in targets.items()):
+        raise ValueError("invalid target digest")
+    parsed = tomllib.loads(patch.read_text(encoding="utf-8"))
+    patches = parsed.get("patch")
+    if not isinstance(patches, list) or not patches or any(not isinstance(item, dict) or not isinstance(item.get("target"), str) for item in patches):
+        raise ValueError("patch file has no valid targets")
+    if set(targets) != {item["target"] for item in patches}:
+        raise ValueError("target hashes must cover exactly the patch targets")
+    return patch, {name: digest.lower() for name, digest in targets.items()}
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description="Recommend a local patch only after metadata, hashes and relinker verification match")
+    parser.add_argument("--catalog", required=True, type=Path, help="directory containing index.json and patch files")
+    parser.add_argument("--param-json", required=True, type=Path, help="title metadata file")
+    parser.add_argument("--input", required=True, type=Path, help="unwrapped main ELF")
+    parser.add_argument("--relinker", required=True, type=Path, help="relinker executable to run")
+    parser.add_argument("--sce-module-path", type=Path, help="parent directory of bundled modules")
+    parser.add_argument("--module-dir", action="append", default=[], help="module directory relative to the module parent; repeatable")
+    parser.add_argument("--executable", action="append", default=[], help="additional title executable relative to the module parent; repeatable")
+    parser.add_argument("--skip-sce-module", action="store_true", help="skip bundled modules during verification")
+    parser.add_argument("--timeout-seconds", type=int, default=120, help="maximum seconds per relinker verification (default: 120)")
+    args = parser.parse_args(argv)
+    try:
+        metadata = json.loads(args.param_json.read_text(encoding="utf-8"))
+        if not isinstance(metadata, dict):
+            raise ValueError("param.json must be an object")
+        title = metadata.get("titleId")
+        version = metadata.get("contentVersion")
+        if not isinstance(title, str) or not title or not isinstance(version, str) or not version:
+            raise ValueError("param.json needs nonempty titleId and contentVersion")
+        if not args.input.is_file() or not args.relinker.is_file():
+            raise ValueError("input and relinker must be files")
+        if args.skip_sce_module and args.sce_module_path:
+            raise ValueError("--skip-sce-module conflicts with --sce-module-path")
+        if args.timeout_seconds <= 0:
+            raise ValueError("timeout-seconds must be positive")
+        root = (args.sce_module_path or args.input.parent).resolve()
+        if not root.is_dir():
+            raise ValueError("module parent must be a directory")
+        for executable in args.executable:
+            confined(root, executable)
+        matches = []
+        entries = load_catalog(args.catalog.resolve(), title, version)
+        if not entries:
+            print(f"No recommendation: no catalog entry for {title} {version}.")
+            return 1
+        relinker_errors = False
+        for number, entry in entries:
+            label = f"Catalog entry {number} ({entry.get('patch')!r})"
+            try:
+                patch, targets = validate_entry(args.catalog.resolve(), entry)
+            except (OSError, ValueError, tomllib.TOMLDecodeError) as error:
+                print(f"{label}: rejected: {error}")
+                continue
+            errors = []
+            for name, expected in targets.items():
+                try:
+                    source = args.input.resolve() if name == args.input.name else confined(root, name)
+                    actual = sha256(source)
+                    if actual != expected:
+                        errors.append(f"{name}: SHA-256 mismatch ({actual})")
+                except (OSError, ValueError) as error:
+                    errors.append(f"{name}: {error}")
+            if errors:
+                print(f"{label}: rejected: {'; '.join(errors)}")
+                continue
+            command = [str(args.relinker.resolve()), "--verify-patches", str(patch)]
+            if args.skip_sce_module:
+                command.append("--skip-sce-module")
+            if args.sce_module_path:
+                command.extend(("--sce-module-path", str(args.sce_module_path)))
+            for module_dir in args.module_dir:
+                command.extend(("--module-dir", module_dir))
+            for executable in args.executable:
+                command.extend(("--executable", executable))
+            command.append(str(args.input))
+            try:
+                result = subprocess.run(command, capture_output=True, text=True, timeout=args.timeout_seconds)
+            except subprocess.TimeoutExpired:
+                print(f"{label}: rejected: relinker verification exceeded {args.timeout_seconds} seconds")
+                continue
+            summary = VERIFY_SUMMARY.search(result.stdout)
+            verified = tuple(map(int, summary.groups())) if summary else None
+            if result.returncode:
+                detail = (result.stdout + result.stderr).strip()
+                if result.returncode == 1 and verified and verified[3] > 0:
+                    print(f"{label}: rejected by relinker: {detail}")
+                    continue
+                if result.returncode == 2:
+                    print(f"{label}: relinker error (exit 2): {detail}")
+                    relinker_errors = True
+                    continue
+                raise ValueError(f"{label}: relinker error (exit {result.returncode}): {detail}")
+            if not verified:
+                raise ValueError(f"{label}: relinker produced no verification summary")
+            if verified[0] == 0 or verified[1] != verified[0] or verified[2] or verified[3]:
+                print(f"{label}: rejected: relinker did not confirm every patch")
+                continue
+            matches.append((number, entry, patch, targets))
+        if len(matches) == 1:
+            number, entry, patch, targets = matches[0]
+            print(f"Recommended: {patch} (catalog entry {number})")
+            for name, digest in targets.items():
+                print(f"  {name} SHA-256 {digest}")
+            conversion = ["--patches", str(patch)]
+            if args.skip_sce_module:
+                conversion.append("--skip-sce-module")
+            if args.sce_module_path:
+                conversion.extend(("--sce-module-path", str(args.sce_module_path)))
+            for module_dir in args.module_dir:
+                conversion.extend(("--module-dir", module_dir))
+            for executable in args.executable:
+                conversion.extend(("--executable", executable))
+            print(f"Use these options when converting:\n  {command_line(conversion)}")
+            return 0
+        if len(matches) > 1:
+            print("No recommendation: multiple verified catalog entries match.")
+            return 1
+        if relinker_errors:
+            print("No recommendation: relinker errors occurred; see catalog entries above.", file=sys.stderr)
+            return 2
+        print("No recommendation: no catalog entry passed all checks.")
+        return 1
+    except (OSError, ValueError, json.JSONDecodeError, tomllib.TOMLDecodeError) as error:
+        print(f"Patch advisor: {error}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tools/test_web.py b/tools/test_web.py
index 245e6b4eac..9da700335f 100644
--- a/tools/test_web.py
+++ b/tools/test_web.py
@@ -5,6 +5,7 @@ import re
 import subprocess
 import sys
 import tempfile
+import urllib.error
 import urllib.request
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -13,25 +14,39 @@ from test_guest_intel_trampolines import main_fixture
 from test_guest_module_directories import module_with_symbol
 
 
-def main():
+def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser()
     parser.add_argument("--build", type=Path, required=True)
-    args = parser.parse_args()
-    subprocess.run(["node", "--test", str(ROOT / "demo/web/tests/output-directory.test.mjs")], check=True)
-    with tempfile.TemporaryDirectory(prefix="anyps5-web-") as directory:
-        fixture = Path(directory)
-        (fixture / "main.elf").write_bytes(main_fixture())
-        (fixture / "module.elf").write_bytes(module_with_symbol(True))
-        source = (args.build / "web/archive.mjs").read_text(encoding="utf-8")
-        url = re.search(r'from "(https://cdn.jsdelivr.net/[^"\n]+)"', source).group(1)
-        library = fixture / "zip.mjs"
-        with urllib.request.urlopen(url, timeout=30) as response:
-            library.write_bytes(response.read())
-        environment = dict(os.environ, ANYPS5_TEST_ZIP_URL=url, ANYPS5_TEST_ZIP_PATH=library.as_uri())
-        subprocess.run(["node", str(ROOT / "demo/web/tests/archive-root.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
-        subprocess.run(["node", str(ROOT / "demo/web/tests/archive-windows.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
-        subprocess.run(["node", str(ROOT / "demo/web/tests/archive.test.mjs"), str(args.build.resolve() / "web"), str(fixture)], env=environment, check=True)
+    args = parser.parse_args(argv)
+    archive = args.build / "web/archive.mjs"
+    if not archive.is_file():
+        parser.error(f"archive module does not exist: {archive}")
+    try:
+        subprocess.run(["node", "--test", str(ROOT / "demo/web/tests/output-directory.test.mjs")], check=True)
+        with tempfile.TemporaryDirectory(prefix="anyps5-web-") as directory:
+            fixture = Path(directory)
+            (fixture / "main.elf").write_bytes(main_fixture())
+            (fixture / "module.elf").write_bytes(module_with_symbol(True))
+            source = archive.read_text(encoding="utf-8-sig")
+            match = re.search(r'from "(https://cdn.jsdelivr.net/[^"\n]+)"', source)
+            if not match:
+                parser.error(f"zip library URL not found in {archive}")
+            url = match.group(1)
+            library = fixture / "zip.mjs"
+            with urllib.request.urlopen(url, timeout=30) as response:
+                library.write_bytes(response.read())
+            environment = dict(os.environ, ANYPS5_TEST_ZIP_URL=url, ANYPS5_TEST_ZIP_PATH=library.as_uri())
+            subprocess.run(["node", str(ROOT / "demo/web/tests/archive-root.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
+            subprocess.run(["node", str(ROOT / "demo/web/tests/archive-windows.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
+            subprocess.run(["node", str(ROOT / "demo/web/tests/archive.test.mjs"), str(args.build.resolve() / "web"), str(fixture)], env=environment, check=True)
+    except (subprocess.CalledProcessError, urllib.error.URLError, OSError) as error:
+        parser.error(str(error))
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    sys.exit(main())
diff --git a/tools/tests/test_build_web.py b/tools/tests/test_build_web.py
index 3a56e49429..11c38bfdd4 100644
--- a/tools/tests/test_build_web.py
+++ b/tools/tests/test_build_web.py
@@ -1,8 +1,10 @@
+import os
 import contextlib
 import hashlib
 import io
 import json
 from pathlib import Path
+import subprocess
 import sys
 import tempfile
 import unittest
@@ -125,5 +127,55 @@ class LibraryPublicationTests(unittest.TestCase):
         self.assertFalse(any(file.suffix == ".download" for file in self.libraries.iterdir()))
 
 
+class BuildWebCliTests(unittest.TestCase):
+    def test_missing_relinker_wasm_reports_error_without_traceback(self):
+        with tempfile.TemporaryDirectory() as directory:
+            build = Path(directory)
+            result = subprocess.run([sys.executable, str(Path(build_web.__file__)), "--build", str(build)],
+                                    capture_output=True, text=True,
+                                    env={**os.environ, "PYTHONPATH": str(Path(__file__).resolve().parents[1])})
+            self.assertEqual(result.returncode, 2)
+            self.assertIn("Build relinker_wasm first: missing", result.stderr)
+            self.assertNotIn("Traceback", result.stderr)
+
+    def test_main_with_explicit_argv(self):
+        with tempfile.TemporaryDirectory() as directory:
+            build = Path(directory)
+            native = build / "web" / "native"
+            native.mkdir(parents=True)
+            (native / "relinker_wasm.mjs").touch()
+            (native / "relinker_wasm.wasm").touch()
+            with contextlib.redirect_stdout(io.StringIO()):
+                code = build_web.main(["--build", str(build)])
+            self.assertEqual(code, 0)
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(build_web.sys, "stdout", out), patch.object(build_web.sys, "stderr", err):
+            try:
+                build_web.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_check_compile.py b/tools/tests/test_check_compile.py
index 3dcc4b1d43..c2f6f77643 100644
--- a/tools/tests/test_check_compile.py
+++ b/tools/tests/test_check_compile.py
@@ -88,7 +88,7 @@ class CheckCompileTests(unittest.TestCase):
         (self.build / "build.ninja").write_text(
             "rule cc\n  command = " + command + " @$out.rsp\n"
             "  rspfile = $out.rsp\n  rspfile_content = -DREQUIRED -c $in -o $out -MD -MF $out.d\n"
-            "build unit.o: cc ../unit.c\n", encoding="utf-8")
+            "build order: phony\nbuild unit.o: cc ../unit.c || order\n", encoding="utf-8")
         self.assertFalse((self.build / "unit.o.rsp").exists())
         result = self.tool("unit.c")
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
@@ -216,6 +216,15 @@ class CheckCompileTests(unittest.TestCase):
         self.assertEqual(result.returncode, 0)
         self.assertEqual(json.loads(seen.read_text(encoding="utf-8")), ["-fsyntax-only", str(source)])
 
+    def test_compile_commands_accepts_utf8_bom(self):
+        source = self.source("unit.cpp")
+        script = self.compiler("import sys\nsys.exit(0)\n")
+        entry = self.entry("unit.cpp", f'"{sys.executable}" "{script}" "{source}"')
+        (self.build / "compile_commands.json").write_text("\ufeff" + json.dumps([entry]), encoding="utf-8")
+        result = self.tool("unit.cpp")
+        self.assertEqual(result.returncode, 0)
+        self.assertIn("1 translation units compile", result.stdout)
+
     def test_every_configuration_is_checked_and_each_source_is_counted_once(self):
         source = self.source("unit.cpp")
         script = self.compiler(
@@ -506,6 +515,57 @@ class CheckCompileTests(unittest.TestCase):
                 self.assertIn("arguments must be a nonempty list of strings with an executable", result.stderr)
                 self.assertNotIn("Traceback", result.stderr)
 
+    def test_invalid_compilation_databases_are_rejected_without_a_traceback(self):
+        for database in ({}, {"file": "unit.cpp"}, None, 42, "commands"):
+            with self.subTest(database=database):
+                self.manifest(database)
+                result = self.tool("unit.cpp")
+                self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                self.assertIn("compile_commands.json: expected an array of command objects", result.stderr)
+                self.assertNotIn("Traceback", result.stderr)
+
+    def test_invalid_entries_are_rejected_before_any_compiler_runs(self):
+        source = self.source("unit.cpp")
+        invoked = self.root / "invoked"
+        script = self.compiler("import sys\nfrom pathlib import Path\nPath(sys.argv[1]).touch()\n")
+        valid = self.entry("unit.cpp", f'"{sys.executable}" "{script}" "{invoked}" "{source}"')
+        cases = [(value, "expected a command object") for value in (None, [], 42, "command")]
+        for field in ("directory", "file"):
+            missing = dict(valid)
+            del missing[field]
+            cases.append((missing, f"missing {field}"))
+            cases.extend(({**valid, field: value}, f"{field} must be a nonempty string")
+                         for value in (None, [], 42, ""))
+        cases.append(({key: value for key, value in valid.items() if key != "command"},
+                      "expected arguments or command"))
+        cases.extend(({**valid, "command": value}, "command must be a nonempty string")
+                     for value in (None, [], 42, "", " \t"))
+        cases.append(({**valid, "arguments": []},
+                      "arguments must be a nonempty list of strings with an executable"))
+        for invalid, message in cases:
+            with self.subTest(invalid=invalid):
+                self.manifest([valid, invalid])
+                result = self.tool("--jobs", "2", "unit.cpp")
+                self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                self.assertIn(f"compile_commands.json: entry 1: {message}", result.stderr)
+                self.assertNotIn("Traceback", result.stderr)
+                self.assertFalse(invoked.exists(), result.stdout + result.stderr)
+
+    def test_invalid_ninja_databases_are_validated_before_compilation(self):
+        source = self.source("unit.cpp")
+        cases = (({}, "expected an array of command objects"),
+                 ([self.entry("unit.cpp", "compiler"), None], "entry 1: expected a command object"))
+        for database, message in cases:
+            with self.subTest(database=database), \
+                    patch.object(check_compile.shutil, "which", return_value="ninja"), \
+                    patch.object(check_compile, "ninja_encoding", return_value="utf-8"), \
+                    patch.object(check_compile, "capture", return_value=subprocess.CompletedProcess(
+                        [], 0, json.dumps(database), "")), \
+                    patch.object(check_compile.subprocess, "run") as compiler:
+                with self.assertRaisesRegex(ValueError, "ninja -t compdb: " + message):
+                    check_compile.check(self.root, self.build, [source])
+                compiler.assert_not_called()
+
     def test_parallel_checks_overlap_but_diagnostics_keep_source_order(self):
         barrier = self.root / "barrier"
         barrier.mkdir()
diff --git a/tools/tests/test_check_conventions_comments.py b/tools/tests/test_check_conventions_comments.py
index 95aa949321..6bc843e5d2 100644
--- a/tools/tests/test_check_conventions_comments.py
+++ b/tools/tests/test_check_conventions_comments.py
@@ -399,7 +399,7 @@ class SilentStubSectionTests(unittest.TestCase):
 
 
 class TestFixtureExportTests(unittest.TestCase):
-    def check(self, path, text=None):
+    def check(self, path, text=None, base=None):
         files = path if text is None else {path: text}
         checker = Path(__file__).resolve().parents[1] / "check_conventions.py"
         with tempfile.TemporaryDirectory() as directory:
@@ -420,6 +420,8 @@ class TestFixtureExportTests(unittest.TestCase):
             git("init", "-q")
             write("core/libs/prx/libkernel/src/Time.cpp", "std::uint64_t APS5_VABI sceKernelGetProcessTime() { return now(); }\n")
             write("core/libs/prx/libSceNgs2/tests/Render.cpp", "static int APS5_VABI Process(int value) { return value; }\n")
+            for relative, content in (base or {}).items():
+                write(relative, content)
             git("add", ".")
             git("commit", "-qm", "feat: add libraries")
             for relative, content in files.items():
@@ -451,6 +453,63 @@ class TestFixtureExportTests(unittest.TestCase):
         self.assertIn("core/libs/prx/libSceAudioOut/src/Clock.cpp:1: error: [duplicate-export]", result.stdout)
         self.assertIn("sceKernelGetProcessTime is also in libkernel", result.stdout)
 
+    def test_large_export_set_uses_a_file_backed_pattern(self):
+        names = [f"ConventionExport{index:08d}LongName" for index in range(1100)]
+        self.assertGreater(len("|".join(names)), 32767)
+        source = "\n".join(f"int APS5_VABI {name}(void) {{ return 0; }}" for name in names)
+        source += "\nstd::uint64_t APS5_VABI sceKernelGetProcessTime() { return now(); }\n"
+        result = self.check("core/libs/prx/libSceAudioOut/src/Exports.cpp", source)
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("core/libs/prx/libSceAudioOut/src/Exports.cpp:1101: error: [duplicate-export]", result.stdout)
+        self.assertIn("sceKernelGetProcessTime is also in libkernel", result.stdout)
+
+    def test_export_shadowing_an_assembly_export_is_a_duplicate(self):
+        result = self.check("core/libs/prx/libSceLibcInternal/Export.cpp",
+                            "int APS5_VABI setjmp_nid_postfix(void) {\n    NotImplemented_nid_no_patch(__func__);\n    return 0;\n}\n",
+                            base={"core/libs/prx/libc/src/JumpBuffer.cpp": 'asm(".text\\n"\n    APS5_ASM_FUNCTION("setjmp_nid_postfix")\n    "    ret\\n");\n'})
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("core/libs/prx/libSceLibcInternal/Export.cpp:1: error: [duplicate-export]", result.stdout)
+        self.assertIn("setjmp_nid_postfix is also in libc", result.stdout)
+
+    def test_export_shadowing_a_spaced_or_split_assembly_export_is_a_duplicate(self):
+        for macro, call in (("APS5_ASM_FUNCTION", ' ("setjmp_nid_postfix")'),
+                            ("APS5_ASM_FUNCTION", '(\n        "setjmp_nid_postfix")'),
+                            ("APS5_SIGNAL_ASM_FUNCTION", ' (\n        "setjmp_nid_postfix")')):
+            with self.subTest(macro=macro, call=call):
+                result = self.check("core/libs/prx/libSceLibcInternal/Export.cpp",
+                                    "int APS5_VABI setjmp_nid_postfix(void) {\n    NotImplemented_nid_no_patch(__func__);\n    return 0;\n}\n",
+                                    base={"core/libs/prx/libc/src/JumpBuffer.cpp": 'asm(".text\\n"\n    ' + macro + call + '\n    "    ret\\n");\n'})
+                self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                self.assertIn("core/libs/prx/libSceLibcInternal/Export.cpp:1: error: [duplicate-export]", result.stdout)
+                self.assertIn("setjmp_nid_postfix is also in libc", result.stdout)
+
+    def test_assembly_export_in_another_library_is_a_duplicate(self):
+        result = self.check("core/libs/prx/libSceAudioOut/src/Clock.cpp",
+                            'asm(".text\\n"\n    APS5_SIGNAL_ASM_FUNCTION("sceKernelGetProcessTime")\n    "    ret\\n");\n')
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("core/libs/prx/libSceAudioOut/src/Clock.cpp:2: error: [duplicate-export]", result.stdout)
+        self.assertIn("sceKernelGetProcessTime is also in libkernel", result.stdout)
+
+    def test_assembly_export_after_a_raw_string_is_a_duplicate(self):
+        result = self.check("core/libs/prx/libSceAudioOut/src/Jump.cpp",
+                            'asm(R"(\n    .text\n)" APS5_ASM_FUNCTION("setjmp_nid_postfix") R"(\n    ret\n)");\n',
+                            base={"core/libs/prx/libc/src/JumpBuffer.cpp": 'asm(".text\\n"\n    APS5_ASM_FUNCTION("setjmp_nid_postfix")\n    "    ret\\n");\n'})
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("core/libs/prx/libSceAudioOut/src/Jump.cpp:3: error: [duplicate-export]", result.stdout)
+        self.assertIn("setjmp_nid_postfix is also in libc", result.stdout)
+
+    def test_assembly_export_in_a_block_comment_is_not_an_export(self):
+        result = self.check("core/libs/prx/libSceLibcInternal/Export.cpp",
+                            "int APS5_VABI setjmp_nid_postfix(void) {\n    NotImplemented_nid_no_patch(__func__);\n    return 0;\n}\n",
+                            base={"core/libs/prx/libc/src/JumpBuffer.cpp": '/*\n    APS5_ASM_FUNCTION("setjmp_nid_postfix")\n*/\n'})
+        self.assertNotIn("duplicate-export", result.stdout, result.stdout + result.stderr)
+
+    def test_assembly_name_that_is_not_an_identifier_keeps_the_check(self):
+        result = self.check("core/libs/prx/libSceAudioOut/src/Clock.cpp",
+                            'asm(".text\\n"\n    APS5_ASM_FUNCTION("x(y")\n    "    ret\\n");\nstd::uint64_t APS5_VABI sceKernelGetProcessTime() {\n    return 1;\n}\n')
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("sceKernelGetProcessTime is also in libkernel", result.stdout)
+
     def test_comment_in_a_shader_is_reported(self):
         shaders = {}
         for path in ("core/libs/prx/libSceAgcDriver/Graphics/shaders/Fill.comp", "core/libs/prx/libSceAgcDriver/tests/shaders/Fill.frag", "core/libs/prx/libSceAgcDriver/Graphics/shaders/Fill.glsl"):
diff --git a/tools/tests/test_check_conventions_env_reference.py b/tools/tests/test_check_conventions_env_reference.py
index b217e80247..ce341ce439 100644
--- a/tools/tests/test_check_conventions_env_reference.py
+++ b/tools/tests/test_check_conventions_env_reference.py
@@ -46,9 +46,9 @@ def repository(root, base, head, target=None):
     git("commit", "-qm", "feat: read a new name")
 
 
-def findings_of(root, base, head, ref="base"):
+def findings_of(root, base, head, ref="base", directory="."):
     previous = os.getcwd()
-    os.chdir(root)
+    os.chdir(root / directory)
     try:
         check = Check(ref, "HEAD")
         check.env_reference()
@@ -58,12 +58,57 @@ def findings_of(root, base, head, ref="base"):
 
 
 class EnvReferenceDiffTests(unittest.TestCase):
-    def run_case(self, base, head, target=None):
-        directory = tempfile.TemporaryDirectory()
-        self.addCleanup(directory.cleanup)
-        root = Path(directory.name)
+    def create_repository(self, base, head, target=None):
+        temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(temporary.cleanup)
+        root = Path(temporary.name)
         repository(root, base, head, target)
-        return findings_of(root, base, head, "base" if target is None else "target")
+        return root
+
+    def run_case(self, base, head, target=None, directory="."):
+        root = self.create_repository(base, head, target)
+        return findings_of(root, base, head, "base" if target is None else "target", directory)
+
+    def test_a_check_from_a_subdirectory_reports_the_same_findings(self):
+        other = "core/libs/prx/libSceExample/Other.cpp"
+        base = {
+            DOC: DOC_TEXT,
+            SAMPLE: 'static bool a = std::getenv("APS5_DOCUMENTED") != nullptr;\n',
+            other: 'static bool b = std::getenv("APS5_DOCUMENTED") != nullptr;\n',
+        }
+        target = {DOC: DOC_TEXT + "| `APS5_TARGET_ROW` | presence |\n"}
+        head = {
+            DOC: "| `APS5_DOCUMENTED` | presence |\n",
+            SAMPLE: base[SAMPLE] + 'static bool c = std::getenv("APS5_NEW_READ") != nullptr;\n'
+                    'static bool d = std::getenv("APS5_TARGET_ROW") != nullptr;\n',
+            other: None,
+        }
+        expected = [("env-reference", SAMPLE, 2, f"APS5_NEW_READ is read here but has no row in {DOC}")]
+        root = self.create_repository(base, head, target)
+        for directory in (".", "core", "core/libs/prx/libSceExample", "docs/dev"):
+            with self.subTest(directory=directory):
+                self.assertEqual(findings_of(root, base, head, "target", directory), expected)
+
+    def test_a_new_spaced_read_is_reported_at_its_line(self):
+        base = {DOC: DOC_TEXT, SAMPLE: "int unrelated;\n"}
+        head = {SAMPLE: base[SAMPLE] + 'auto value = !std::getenv \t("APS5_NEW_READ");\n'}
+        self.assertEqual(self.run_case(base, head), [("env-reference", SAMPLE, 2,
+                                                    f"APS5_NEW_READ is read here but has no row in {DOC}")])
+
+    def test_removing_a_compact_read_keeps_a_row_still_used_by_a_spaced_read(self):
+        other = "core/libs/prx/libSceExample/Other.cpp"
+        base = {
+            DOC: DOC_TEXT,
+            SAMPLE: 'auto a = std::getenv("APS5_DOCUMENTED");\n',
+            other: 'auto b = _wgetenv \t(L"APS5_DOCUMENTED");\n',
+        }
+        self.assertEqual(self.run_case(base, {SAMPLE: "int unrelated;\n"}), [])
+
+    def test_a_removed_row_is_reported_when_a_spaced_read_remains(self):
+        base = {DOC: DOC_TEXT, SAMPLE: 'auto value = std::getenv \t("APS5_DOCUMENTED");\n'}
+        head = {DOC: "| `APS5_GONE` | presence |\n"}
+        self.assertEqual(self.run_case(base, head), [("env-reference", DOC, 0,
+                                                    "APS5_DOCUMENTED is still read by the code but this pull request removes its row")])
 
     def test_only_a_name_the_pull_request_adds_is_reported_at_its_line(self):
         base = {
diff --git a/tools/tests/test_check_main_sync.py b/tools/tests/test_check_main_sync.py
index a4590a60e5..a82463563e 100644
--- a/tools/tests/test_check_main_sync.py
+++ b/tools/tests/test_check_main_sync.py
@@ -1,4 +1,6 @@
 from pathlib import Path
+import contextlib
+import io
 import os
 import subprocess
 import sys
@@ -65,6 +67,14 @@ class CheckMainSyncTests(unittest.TestCase):
         self.assertEqual((data["behind"], data["ahead"], data["conflicts"], data["shared"]), (0, 1, [], []))
         self.assertEqual(run_tool(self.repo.path, "--head", "feature", "--strict").returncode, 0)
 
+    def test_main_with_explicit_argv(self):
+        self.branch("feature")
+        self.repo.write("other.txt", "y\n")
+        self.repo.commit("feature change")
+        with contextlib.redirect_stdout(io.StringIO()):
+            code = check_main_sync.main(["--repo", str(self.repo.path), "--base", "main", "--head", "feature"])
+        self.assertEqual(code, 0)
+
     def test_behind_main_is_reported_and_only_fails_when_strict(self):
         self.branch("feature")
         self.repo.write("other.txt", "y\n")
@@ -111,6 +121,26 @@ class CheckMainSyncTests(unittest.TestCase):
         self.assertIn("1 file(s) changed on both sides", result.stdout)
         self.assertIn("#77", result.stdout)
 
+    def test_a_subdirectory_reports_the_same_conflicts_and_pull_requests(self):
+        (self.repo.path / "docs").mkdir()
+        self.repo.write("docs/notes.txt", "x\n")
+        self.repo.commit("add docs")
+        self.branch("feature")
+        self.repo.write("shared.txt", "one\nmine\nthree\n")
+        self.repo.commit("feature edit")
+        self.repo.git("checkout", "-q", "main")
+        self.repo.git("checkout", "-q", "-b", "theirs")
+        self.repo.write("shared.txt", "one\ntheirs\nthree\n")
+        self.repo.commit("their edit")
+        self.repo.git("checkout", "-q", "main")
+        self.repo.merge_pull(77, "theirs")
+        from_root = check_main_sync.report(self.repo.path, "main", "feature")
+        self.assertEqual((from_root["conflicts"], from_root["pulls"].keys()), (["shared.txt"], {77}))
+        self.assertEqual(check_main_sync.report(self.repo.path / "docs", "main", "feature"), from_root)
+        result = run_tool(self.repo.path / "docs", "--head", "feature")
+        self.assertEqual(result.returncode, 1, result.stderr)
+        self.assertEqual(result.stdout, run_tool(self.repo.path, "--head", "feature").stdout)
+
     def test_paths_with_spaces_and_unicode_are_reported_verbatim(self):
         name = "sp ace \u00e9.txt"
         self.repo.write(name, "one\ntwo\n")
diff --git a/tools/tests/test_check_skips.py b/tools/tests/test_check_skips.py
index f4de797f05..6e3871733b 100644
--- a/tools/tests/test_check_skips.py
+++ b/tools/tests/test_check_skips.py
@@ -1,8 +1,11 @@
 from pathlib import Path
+import contextlib
+import io
 import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import check_skips
@@ -34,6 +37,21 @@ OTHER = [
 
 
 class CheckSkipsTests(unittest.TestCase):
+    def test_non_junit_xml_fails_in_every_cli_mode(self):
+        reports = ('<config/>', '<Site><Testing><Test Status="notrun"><Name>coverage</Name></Test></Testing></Site>')
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "ctest.xml"
+            for report in reports:
+                junit.write_text(report, encoding="utf-8")
+                for arguments in (("--job", "linux"), ("--job", "windows"), ("--list",)):
+                    with self.subTest(report=report, arguments=arguments):
+                        result = subprocess.run([sys.executable, "-I", str(TOOL), str(junit), *arguments],
+                                                capture_output=True, text=True, timeout=5)
+                        self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                        self.assertIn("expected a JUnit", result.stderr)
+                        self.assertNotIn("Traceback", result.stderr)
+                        self.assertNotIn("all expected", result.stdout)
+
     def test_missing_high_refresh_display_is_expected_in_both_jobs(self):
         reason = "current display does not provide 120 Hz"
         reports = (
@@ -192,6 +210,42 @@ class CheckSkipsTests(unittest.TestCase):
             self.assertIn("indented: skipped, host imports are unavailable", result.stdout)
             self.assertIn("capitalized: Skipped, no display", result.stdout)
 
+    def test_main_with_explicit_argv(self):
+        xml = '<testsuite><testcase name="normal"><skipped message="the device lacks geometryShader"/></testcase></testsuite>'
+        with tempfile.TemporaryDirectory() as directory:
+            junit = Path(directory) / "junit.xml"
+            junit.write_text(xml, encoding="utf-8")
+            with contextlib.redirect_stdout(io.StringIO()):
+                code = check_skips.main([str(junit), "--job", "linux"])
+            self.assertEqual(code, 0)
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(check_skips.sys, "stdout", out), mock.patch.object(check_skips.sys, "stderr", err):
+            try:
+                check_skips.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 
 
@@ -202,6 +256,18 @@ class SkipReportTests(unittest.TestCase):
             path.write_text(content, encoding="utf-8")
             return list(check_skips.skips(path))
 
+    def test_non_junit_roots_are_rejected_even_with_testcases(self):
+        for content in ('<report/>', '<testcase name="passed"/>',
+                        '<report><testcase name="passed"/></report>',
+                        '<report><testcase name="gpu"><skipped message="no display"/></testcase></report>'):
+            with self.subTest(content=content), self.assertRaisesRegex(ValueError, "expected a JUnit"):
+                self.skipped(content)
+
+    def test_empty_junit_suites_remain_valid(self):
+        for content in ('<testsuite/>', '<testsuites/>', '<testsuites><testsuite/></testsuites>'):
+            with self.subTest(content=content):
+                self.assertEqual(self.skipped(content), [])
+
     def test_ctest_disabled_status_is_not_silently_ignored(self):
         with self.assertRaisesRegex(ValueError, "disabled.*not run"):
             self.skipped('<testsuite><testcase name="coverage" status="disabled"/></testsuite>')
diff --git a/tools/tests/test_configure_seed.py b/tools/tests/test_configure_seed.py
index 2cff72cd94..36d6c6a66d 100644
--- a/tools/tests/test_configure_seed.py
+++ b/tools/tests/test_configure_seed.py
@@ -1,9 +1,11 @@
+import ctypes
 import os
 import shutil
 import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from pathlib import Path
 
 TOOL = Path(__file__).resolve().parents[1] / "configure_seed.py"
@@ -16,11 +18,20 @@ project(mini C)
 include(CheckIncludeFile)
 include(CheckSymbolExists)
 include(CheckCSourceCompiles)
+include(CheckTypeSize)
 check_include_file(stdio.h MINI_HAVE_STDIO_H)
 check_include_file(mini_missing_header.h MINI_HAVE_MISSING_H)
 check_symbol_exists(printf stdio.h MINI_HAVE_PRINTF)
 check_c_source_compiles("int main(void) { return 0; }" MINI_COMPILES)
 check_c_source_compiles("int main(void) { return undefined_name; }" MINI_FAILS)
+check_type_size(int MINI_SIZEOF_INT)
+check_type_size(mini_no_such_type_t MINI_SIZEOF_NONE)
+if(NOT HAVE_MINI_SIZEOF_INT OR NOT MINI_SIZEOF_INT)
+    message(FATAL_ERROR "Unsupported integer size: int")
+endif()
+if(HAVE_MINI_SIZEOF_NONE OR NOT "${MINI_SIZEOF_NONE}" STREQUAL "")
+    message(FATAL_ERROR "A missing type has a size")
+endif()
 set(MINI_OPTION "value" CACHE STRING "An option, not a check result")
 """
 
@@ -62,6 +73,14 @@ class ConfigureSeedPathTests(unittest.TestCase):
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertIn("HAVE_FEATURE", seed.read_text(encoding="utf-8"))
 
+    def test_unwritable_seed_is_reported_without_a_traceback(self):
+        seed_dir = self.root / "seed_dir"
+        seed_dir.mkdir()
+        result = self.run_seed(seed_dir)
+        self.assertEqual(result.returncode, 2, result.stderr)
+        self.assertIn(str(seed_dir), result.stderr)
+        self.assertNotIn("Traceback", result.stderr)
+
     def test_same_path_preserves_cache(self):
         self.assert_rejected(self.cache)
 
@@ -149,8 +168,9 @@ class ConfigureSeedProject(unittest.TestCase):
 class ConfigureSeedTests(ConfigureSeedProject):
     def test_only_check_results_are_seeded(self):
         found = configure_seed.checks(self.root / "fresh" / "CMakeCache.txt")
-        self.assertEqual({n for n in found if n.startswith("MINI_")},
-                         {"MINI_HAVE_STDIO_H", "MINI_HAVE_MISSING_H", "MINI_HAVE_PRINTF", "MINI_COMPILES", "MINI_FAILS"})
+        self.assertEqual({n for n in found if "MINI_" in n},
+                         {"MINI_HAVE_STDIO_H", "MINI_HAVE_MISSING_H", "MINI_HAVE_PRINTF", "MINI_COMPILES", "MINI_FAILS",
+                          "HAVE_MINI_SIZEOF_INT", "MINI_SIZEOF_INT", "HAVE_MINI_SIZEOF_NONE", "MINI_SIZEOF_NONE"})
         self.assertNotIn("CMAKE_C_COMPILER", found)
 
     def test_cache_without_checks_writes_an_empty_seed(self):
@@ -193,13 +213,17 @@ class ConfigureSeedRoundTripTests(ConfigureSeedProject):
         self.assertNotIn("HAVE:INTERNAL=", seeded.read_text(encoding="utf-8"))
 
     def test_seeded_configure_runs_no_check_and_gets_the_same_results(self):
-        self.assertRegex(self.fresh, r"Looking for|Performing Test")
+        self.assertRegex(self.fresh, r"Looking for|Performing Test|Check size of")
         output = self.configure("seeded", "-C", str(self.seed(self.root / "fresh" / "CMakeCache.txt", "seed.cmake")))
-        self.assertNotRegex(output, r"Looking for|Performing Test")
+        self.assertNotRegex(output, r"Looking for|Performing Test|Check size of")
         fresh = configure_seed.checks(self.root / "fresh" / "CMakeCache.txt")
         self.assertEqual(configure_seed.checks(self.root / "seeded" / "CMakeCache.txt"), fresh)
         self.assertEqual(fresh["MINI_HAVE_STDIO_H"][0], "1")
         self.assertEqual(fresh["MINI_FAILS"][0], "")
+        self.assertEqual(fresh["HAVE_MINI_SIZEOF_INT"][0], "TRUE")
+        self.assertEqual(fresh["MINI_SIZEOF_INT"][0], str(ctypes.sizeof(ctypes.c_int)))
+        self.assertEqual(fresh["HAVE_MINI_SIZEOF_NONE"][0], "FALSE")
+        self.assertEqual(fresh["MINI_SIZEOF_NONE"][0], "")
 
     def test_values_with_cmake_syntax_round_trip(self):
         cache = self.root / "odd" / "CMakeCache.txt"
@@ -221,6 +245,33 @@ class ChecksParsingTests(unittest.TestCase):
             found = configure_seed.checks(cache)
             self.assertEqual(found, {"FIRST_CHECK": ("1", "Test FIRST_CHECK")})
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(configure_seed.sys, "stdout", out), mock.patch.object(configure_seed.sys, "stderr", err):
+            try:
+                configure_seed.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_env_reference.py b/tools/tests/test_env_reference.py
index c414e314c0..c19bb714c9 100644
--- a/tools/tests/test_env_reference.py
+++ b/tools/tests/test_env_reference.py
@@ -3,7 +3,9 @@ import io
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from pathlib import Path
+from unittest.mock import patch
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import env_reference
@@ -30,6 +32,8 @@ static bool q = _wgetenv(L"APS5_WIDE_PRESENT") != nullptr;
 static int r = _wtoi(_wgetenv(L"APS5_WIDE_INT"));
 static const wchar_t* s = _wgetenv(L"ANYPS5_WIDE_CONFIG");
 static const char* t = std::getenv("NOT_AN_ENV");
+static std::uint64_t u = std::min<std::uint64_t>(EnvironmentNumber("APS5_CRASH_STACK_BYTES"), std::uint64_t{1} << 20);
+static std::uint64_t v = MyEnvironmentNumber("APS5_NOT_A_NUMBER_READ");
 """
 
 
@@ -52,7 +56,8 @@ class EnvReferenceTests(unittest.TestCase):
              "APS5_CRASH_INDIRECT_MEMORY", "APS5_PIPELINE_JOURNAL_MAX_MIB",
              "APS5_PIPELINE_STORE_ENTRIES", "APS5_PIPELINE_JOURNAL_THREADS", "APS5_PM4_RING",
              "ANYPS5_LOADEXEC_ARGV_SKIP", "ANYPS5_LOADEXEC_PARENT",
-             "ANYPS5_WIDE_CONFIG", "APS5_WIDE_PRESENT", "APS5_WIDE_INT"})
+             "ANYPS5_WIDE_CONFIG", "APS5_WIDE_PRESENT", "APS5_WIDE_INT",
+             "APS5_CRASH_STACK_BYTES"})
         self.assertEqual(found["APS5_PROFILE_DRAW"][0][1], 1)
         self.assertEqual(found["APS5_THREAD_NICE"][0][2:], ("integer", "-10"))
         self.assertEqual(found["APS5_HOST_IMPORT_MIB"][0][2:], ("integer", "6144"))
@@ -65,6 +70,97 @@ class EnvReferenceTests(unittest.TestCase):
         self.assertEqual(found["ANYPS5_WIDE_CONFIG"][0][2:], ("string", ""))
         self.assertEqual(found["APS5_WIDE_PRESENT"][0][2:], ("presence", ""))
         self.assertEqual(found["APS5_WIDE_INT"][0][2:], ("integer", ""))
+        self.assertEqual(found["APS5_CRASH_STACK_BYTES"][0][2:], ("integer", ""))
+
+    def test_reads_environmental_variable_with_multiline_getenv(self):
+        root = self.fixture()
+        source = root / "core" / "Sample.cpp"
+        source.write_text(
+            'static const char* value = std::getenv(\n'
+            '    "APS5_MULTILINE");\n',
+            encoding="utf-8"
+        )
+
+        found = env_reference.reads([root / "core"])
+        self.assertIn("APS5_MULTILINE", found)
+
+    def test_whitespace_before_parentheses_preserves_names_kinds_and_defaults(self):
+        root = self.fixture()
+        source = root / "core" / "Sample.cpp"
+        expected = env_reference.reads([root / "core"])
+        for separator in (" ", "\t", " \t "):
+            with self.subTest(separator=separator):
+                source.write_text(CODE.replace("(", separator + "("), encoding="utf-8")
+                self.assertEqual(env_reference.reads([root / "core"]), expected)
+
+    def test_reader_and_parenthesis_on_separate_lines_keep_line_numbers_and_kinds(self):
+        root = self.fixture()
+        source = root / "core" / "Sample.cpp"
+        source.write_text('auto a = !std::getenv\n    ("APS5_PRESENT");\n'
+                          'auto b = _wtoi(_wgetenv\n    (L"ANYPS5_INTEGER"));\n', encoding="utf-8")
+        found = env_reference.reads([root / "core"])
+        self.assertEqual(set(found), {"APS5_PRESENT", "ANYPS5_INTEGER"})
+        self.assertEqual(found["APS5_PRESENT"], [(source.as_posix(), 1, "presence", "")])
+        self.assertEqual(found["ANYPS5_INTEGER"], [(source.as_posix(), 3, "integer", "")])
+
+    def test_main_check_rejects_an_undocumented_spaced_read(self):
+        root = self.fixture()
+        (root / "core" / "Sample.cpp").write_text('auto value = !std::getenv \t("APS5_UNDOCUMENTED");\n', encoding="utf-8")
+        doc = root / "ENVIRONMENT.md"
+        doc.write_text("", encoding="utf-8")
+        with contextlib.redirect_stdout(io.StringIO()) as out:
+            code = env_reference.main(["--check", "--root", str(root / "core"), "--doc", str(doc)])
+        self.assertEqual(code, 1)
+        self.assertIn("APS5_UNDOCUMENTED is read", out.getvalue())
+        self.assertNotIn("all documented", out.getvalue())
+
+    def test_negated_spaced_getenv_is_a_presence_read(self):
+        root = self.fixture()
+        (root / "core" / "Sample.cpp").write_text('auto a = !std::getenv ("APS5_PRESENT");\n'
+                                                  'auto b = !_wgetenv\t(L"ANYPS5_PRESENT");\n', encoding="utf-8")
+        found = env_reference.reads([root / "core"])
+        self.assertEqual(set(found), {"APS5_PRESENT", "ANYPS5_PRESENT"})
+        self.assertEqual([sites[0][2] for sites in found.values()], ["presence", "presence"])
+
+    def test_spacing_does_not_change_literal_parentheses_in_a_custom_prefix(self):
+        for separator in ("", " ", "\t"):
+            with self.subTest(separator=separator):
+                source = f'getenv{separator}("CUSTOM(NAME"); getenv{separator}("CUSTOM (WRONG");'
+                found = env_reference.line_reads(source, ("CUSTOM(",))
+                self.assertEqual([match.group("name") for _, match in found], ["CUSTOM(NAME"])
+
+    def test_multiline_reads_keep_line_numbers_and_do_not_duplicate(self):
+        root = self.fixture()
+        source = root / "core" / "Sample.cpp"
+        source.write_text(
+            'auto a = std::getenv("APS5_SINGLE");\n'
+            'auto b = std::getenv(\n'
+            '    "APS5_MULTI");\n'
+            'auto c = EnvInt(\n'
+            '\n'
+            '    "APS5_INT", 42);\n'
+            'auto d = std::getenv("APS5_SINGLE");\n',
+            encoding="utf-8"
+        )
+
+        found = env_reference.reads([root / "core"])
+
+        self.assertEqual(
+            set(found),
+            {"APS5_SINGLE", "APS5_MULTI", "APS5_INT"}
+        )
+        self.assertEqual(
+            [site[1] for site in found["APS5_SINGLE"]], [1, 7]
+        )
+        self.assertEqual(
+            [site[1] for site in found["APS5_MULTI"]], [2]
+        )
+        self.assertEqual(
+            [site[1] for site in found["APS5_INT"]], [4]
+        )
+        self.assertEqual(
+            found["APS5_INT"][0][2:], ("integer", "42")
+        )
 
     def test_the_default_prefixes_cover_both(self):
         root = self.fixture()
@@ -119,6 +215,64 @@ class EnvReferenceTests(unittest.TestCase):
         (core / "3rdparty" / "Ignored.cpp").write_text('static bool b = IsEnvironmentSet("APS5_IGNORED");\n', encoding="utf-8")
         self.assertEqual(set(env_reference.reads([core], BOTH)), {"APS5_TRACE_GPU"})
 
+    def test_main_reconfigures_streams_for_unicode_report_paths(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = "ascii"
+                self.errors = "strict"
+                self.text = ""
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                text.encode(self.encoding, self.errors)
+                self.text += text
+                return len(text)
+
+            def flush(self):
+                pass
+
+        root = self.fixture() / "source-Ж"
+        root.mkdir()
+        core = root / "core"
+        core.mkdir()
+        (core / "Sample.cpp").write_text('static bool a = std::getenv("APS5_TRACE_GPU") != nullptr;\n', encoding="utf-8")
+        out, err = Stream(), Stream()
+        with mock.patch.object(env_reference.sys, "stdout", out), mock.patch.object(env_reference.sys, "stderr", err):
+            self.assertEqual(env_reference.main(["--root", str(core)]), 0)
+        self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace"))
+        self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace"))
+        self.assertIn((core / "Sample.cpp").as_posix(), out.text)
+
+    def test_main_reports_unicode_scan_root_with_non_utf8_stderr(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = "ascii"
+                self.errors = "strict"
+                self.text = ""
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                text.encode(self.encoding, self.errors)
+                self.text += text
+                return len(text)
+
+            def flush(self):
+                pass
+
+        root = Path(tempfile.gettempdir()) / "missing-source-Ж"
+        out, err = Stream(), Stream()
+        with mock.patch.object(env_reference.sys, "stdout", out), mock.patch.object(env_reference.sys, "stderr", err):
+            self.assertEqual(env_reference.main(["--root", str(root)]), 1)
+        self.assertEqual((out.encoding, out.errors), ("utf-8", "backslashreplace"))
+        self.assertEqual((err.encoding, err.errors), ("utf-8", "backslashreplace"))
+        self.assertIn(str(root), err.text)
+
     def test_main_rejects_a_scan_root_that_is_not_a_directory(self):
         root = self.fixture()
         for name in ("missing", "core/Sample.cpp"):
@@ -131,5 +285,33 @@ class EnvReferenceTests(unittest.TestCase):
                 self.assertNotIn("no longer reads", out.getvalue())
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(env_reference.sys, "stdout", out), patch.object(env_reference.sys, "stderr", err):
+            try:
+                env_reference.main(["--root", "nonexistent"])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_import_audit.py b/tools/tests/test_import_audit.py
index a29775c13b..c1acc164c6 100644
--- a/tools/tests/test_import_audit.py
+++ b/tools/tests/test_import_audit.py
@@ -219,6 +219,63 @@ class ImportAuditTests(unittest.TestCase):
         self.assertEqual(result.stdout, b"")
 
 
+    def test_windows_guest_dependencies_use_host_prx_suffixes(self):
+        work = self.work
+        (work.libs / "libSceA.prx").write_bytes(build_pe(["AAAAAAAAAAA"]))
+        (work.modules / "guest.so").write_bytes(build_elf([], ["libSceA.sprx"]))
+        registry, result = work.root / "game.registry.json", work.root / "audit.json"
+        for suffix in (".sprx", ".suprx", ".debug_prx"):
+            with self.subTest(suffix=suffix):
+                name = "libSceA" + suffix
+                write_registry(registry, [("AAAAAAAAAAA", name)])
+                registry.with_name("game.needed.json").write_text(json.dumps([name]))
+                code, out, err = work.run(registry, "--strict-providers", "--json", str(result))
+                self.assertEqual((code, err), (0, ""))
+                data = json.loads(result.read_text())
+                self.assertEqual(data["missing_libraries"], {})
+                self.assertEqual(data["library_mismatch"], 0)
+                self.assertEqual(data["imports"][0]["providers"], ["libSceA.prx"])
+
+    def test_windows_suffix_lookup_matches_provider_case_insensitively(self):
+        work = self.work
+        (work.libs / "LibSceA.prx").write_bytes(build_pe(["AAAAAAAAAAA"]))
+        (work.modules / "guest.so").write_bytes(build_elf([], ["libscea.sprx"]))
+        registry, result = work.root / "game.registry.json", work.root / "audit.json"
+        write_registry(registry, [("AAAAAAAAAAA", "libscea.sprx")])
+        registry.with_name("game.needed.json").write_text(json.dumps(["libscea.sprx"]))
+        code, _, err = work.run(registry, "--strict-providers", "--json", str(result))
+        self.assertEqual((code, err), (0, ""))
+        data = json.loads(result.read_text())
+        self.assertEqual(data["missing_libraries"], {})
+        self.assertEqual(data["library_mismatch"], 0)
+        self.assertEqual(data["imports"][0]["providers"], ["LibSceA.prx"])
+
+    def test_elf_guest_dependencies_keep_literal_host_names(self):
+        work = self.work
+        (work.libs / "libSceA.prx").write_bytes(exporting("AAAAAAAAAAA"))
+        registry, result = work.root / "game.registry.json", work.root / "audit.json"
+        write_registry(registry, [("AAAAAAAAAAA", "libSceA.sprx")])
+        registry.with_name("game.needed.json").write_text(json.dumps(["libSceA.sprx"]))
+        code, _, err = work.run(registry, "--json", str(result))
+        self.assertEqual((code, err), (1, ""))
+        data = json.loads(result.read_text())
+        self.assertEqual(data["missing_libraries"], {"libSceA.sprx": 1})
+        self.assertEqual(data["library_mismatch"], 1)
+
+    def test_windows_suffix_lookup_preserves_guest_and_missing_libraries(self):
+        work = self.work
+        (work.libs / "libSceA.prx").write_bytes(build_pe(["AAAAAAAAAAA"]))
+        (work.modules / "libSceA.sprx").write_bytes(exporting("BBBBBBBBBBB"))
+        registry, result = work.root / "game.registry.json", work.root / "audit.json"
+        write_registry(registry, [("BBBBBBBBBBB", "libSceA.sprx")])
+        registry.with_name("game.needed.json").write_text(json.dumps(["libSceA.sprx", "libMissing.sprx"]))
+        code, _, err = work.run(registry, "--json", str(result))
+        self.assertEqual((code, err), (1, ""))
+        data = json.loads(result.read_text())
+        self.assertEqual(data["missing_libraries"], {"libMissing.sprx": 0})
+        self.assertEqual(data["imports"][0]["class"], "module")
+        self.assertEqual(data["library_mismatch"], 0)
+
     def test_registry_weak_flags_are_booleans(self):
         registry = self.work.root / "game.json"
         output = self.work.root / "audit.json"
@@ -290,6 +347,68 @@ class ImportAuditTests(unittest.TestCase):
         self.assertTrue(records["missing_function"]["weak"])
         self.assertIsNone(data["stops"][0]["nid"])
 
+    def test_nid_only_exports_do_not_resolve_literal_import_names(self):
+        work = self.work
+        name, nid = "strlen", nid_names.compute_nid("strlen")
+        registry, report = work.root / "sdk.registry.json", work.root / "audit.json"
+        for image in (exporting(nid), build_pe([nid])):
+            (work.libs / "libc.prx").write_bytes(image)
+            for stub in (False, True):
+                write_source(work.source, "libc", (STUB_SOURCE if stub else DONE_SOURCE).format(name=name))
+                for weak in (False, True):
+                    with self.subTest(pe=image.startswith(b"MZ"), stub=stub, weak=weak):
+                        write_registry(registry, [(name, "libc.prx", weak)])
+                        code, out, err = work.run(registry, "--json", str(report))
+                        self.assertEqual((code, err), (1, ""))
+                        data = json.loads(report.read_text(encoding="utf-8"))
+                        record, = data["imports"]
+                        self.assertEqual(record["class"], "stub" if stub else "implemented")
+                        self.assertEqual(record["providers"], ["libc.prx"])
+                        self.assertTrue(record["symbol_mismatch"])
+                        self.assertEqual(data["symbol_mismatch"], 1)
+                        self.assertEqual(data["stops"][0]["nid"], None if weak else name)
+                        self.assertIn("Qualified import names exported only as their NID", out)
+                        self.assertIn(f"-> {nid}", out)
+
+    def test_name_mismatch_requires_a_resolved_host_fallback(self):
+        name, library = "strlen", "libc.prx"
+        exports = {nid_names.compute_nid(name): [library]}
+        for providers, modules, kind, mismatch in (({}, set(), "absent", False),
+                                                   (exports, {library}, "module", False),
+                                                   (exports, set(), "implemented", True)):
+            with self.subTest(kind=kind):
+                records, _ = import_audit.audit([(name, library, False)], providers, {}, {library}, modules)
+                self.assertEqual(records[0]["class"], kind)
+                self.assertEqual(records[0]["symbol_mismatch"], mismatch)
+
+    def test_literal_exports_resolve_without_a_name_mismatch(self):
+        work = self.work
+        name, nid = "strlen", nid_names.compute_nid("strlen")
+        registry, report = work.root / "sdk.registry.json", work.root / "audit.json"
+        for image in (exporting(name, nid), build_pe(sorted([name, nid]))):
+            with self.subTest(pe=image.startswith(b"MZ")):
+                (work.libs / "libc.prx").write_bytes(image)
+                write_registry(registry, [(name, "libc.prx"), (nid, "libc.prx")])
+                code, out, err = work.run(registry, "--json", str(report))
+                self.assertEqual((code, err), (0, ""))
+                data = json.loads(report.read_text(encoding="utf-8"))
+                self.assertEqual(data["symbol_mismatch"], 0)
+                self.assertTrue(all(not record["symbol_mismatch"] for record in data["imports"]))
+                self.assertIsNone(data["stops"][0]["nid"])
+                self.assertNotIn("Qualified import names exported only as their NID", out)
+
+    def test_unscoped_windows_imports_keep_the_loaders_nid_fallback(self):
+        work = self.work
+        name, nid = "strlen", nid_names.compute_nid("strlen")
+        registry, report = work.root / "sdk.registry.json", work.root / "audit.json"
+        write_registry(registry, [(name, "")])
+        (work.libs / "libc.prx").write_bytes(build_pe([nid]))
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (0, ""))
+        data = json.loads(report.read_text(encoding="utf-8"))
+        self.assertEqual(data["symbol_mismatch"], 0)
+        self.assertIsNone(data["stops"][0]["nid"])
+
     def test_named_nid_fallback_preserves_stub_and_library_classification(self):
         nid = nid_names.compute_nid(MESSAGE_NAME)
         imports = [(MESSAGE_NAME, "libSceOther.prx", False)]
@@ -309,7 +428,7 @@ class ImportAuditTests(unittest.TestCase):
         records, _ = import_audit.audit(imports, exports, stubs, set(exports), set())
         self.assertEqual(records[0]["class"], "stub")
         self.assertEqual(records[0]["providers"], ["literal.prx"])
-        module_imports = {"guest.so": (["strlen"], [])}
+        module_imports = {"guest.so": ([("strlen", False)], [])}
         records, _ = import_audit.audit([], {"j4ViWNHEgww": ["libc.prx"]}, {},
                                        {"libc.prx"}, set(module_imports), module_imports,
                                        {"strlen": ["other.so"]})
@@ -538,6 +657,28 @@ class ImportAuditTests(unittest.TestCase):
         self.assertIn("[library not named]", out)
         self.assertIn("EEEEEEEEEEE  (imported by main.prx)", out)
 
+    def test_module_import_bindings_survive_the_audit(self):
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(exporting())
+        registry, result = work.root / "game.json", work.root / "audit.json"
+        write_registry(registry, [])
+        symbols = [("optional", 0, 0x22), ("required", 0, GLOBAL_FUNCTION),
+                   ("mixed#first", 0, 0x22), ("mixed#second", 0, GLOBAL_FUNCTION)]
+        images = [build_elf(symbols), build_sectionless_elf(symbols),
+                  build_sectionless_elf(symbols, gnu_hash=True)]
+        for index, image in enumerate(images):
+            with self.subTest(image=index):
+                (work.modules / "guest.so").write_bytes(image)
+                code, out, err = work.run(registry, "--json", str(result))
+                self.assertEqual((code, err), (1, ""))
+                data = json.loads(result.read_text())
+                records = {record["nid"]: record for record in data["imports"]}
+                self.assertTrue(records["optional"]["weak"])
+                self.assertFalse(records["required"]["weak"])
+                self.assertFalse(records["mixed"]["weak"])
+                self.assertEqual(data["references"], 3)
+                self.assertIn("optional  (weak import)", out)
+
     def test_module_sidecars_do_not_change_the_audit(self):
         work = self.work
         (work.libs / "libSceA.prx").write_bytes(exporting("AAAAAAAAAAA"))
@@ -605,6 +746,46 @@ class ImportAuditTests(unittest.TestCase):
         records, missing = import_audit.audit(imports, {}, {}, set(), import_audit.ModuleNames({"sdk-shipping.prx"}))
         self.assertEqual((records[0]["class"], missing), ("absent", {"SDK-Shipping.debug_prx": 1}))
 
+    def test_windows_module_suffix_case_does_not_report_existing_modules_as_missing(self):
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(build_pe([]))
+        registry, report = work.root / "game.registry.json", work.root / "audit.json"
+        cases = (("sdk-shipping.prx", "SDK-Shipping.DEBUG_PRX"),
+                 ("SDK-SHIPPING.PRX", "sdk-shipping.sprx"),
+                 ("Sdk-Shipping.SuPrX", "SDK-SHIPPING.debug_prx"),
+                 ("SDK-SHIPPING.DEBUG_PRX", "sdk-shipping.PRX"))
+        for filename, needed in cases:
+            with self.subTest(filename=filename, needed=needed):
+                module = work.modules / filename
+                module.write_bytes(exporting("AAAAAAAAAAA"))
+                try:
+                    write_registry(registry, [("AAAAAAAAAAA", needed)])
+                    import_audit.needed_registry_path(registry).write_text(json.dumps([needed]), encoding="utf-8")
+                    code, _, err = work.run(registry, "--json", str(report), "--strict-providers")
+                    self.assertEqual((code, err), (0, ""))
+                    data = json.loads(report.read_text(encoding="utf-8"))
+                    self.assertEqual(data["missing_libraries"], {})
+                    self.assertEqual(data["unique_by_class"], {"implemented": 0, "stub": 0, "absent": 0, "module": 1})
+                    self.assertEqual(data["references"], 1)
+                    self.assertEqual(data["imports"][0]["library"], needed)
+                finally:
+                    module.unlink()
+
+    def test_elf_module_suffix_case_stays_significant(self):
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(exporting())
+        (work.modules / "sdk-shipping.prx").write_bytes(exporting("AAAAAAAAAAA"))
+        registry, report = work.root / "game.registry.json", work.root / "audit.json"
+        for suffix in ("PRX", "SPRX", "SUPRX", "DEBUG_PRX"):
+            needed = "sdk-shipping." + suffix
+            with self.subTest(needed=needed):
+                write_registry(registry, [("AAAAAAAAAAA", needed)])
+                code, _, err = work.run(registry, "--json", str(report))
+                self.assertEqual((code, err), (1, ""))
+                data = json.loads(report.read_text(encoding="utf-8"))
+                self.assertEqual(data["missing_libraries"], {needed: 1})
+                self.assertEqual(data["unique_by_class"], {"implemented": 0, "stub": 0, "absent": 1, "module": 0})
+
     def test_converted_module_matches_imports_of_its_base_name(self):
         work = self.work
         (work.libs / "libc.prx").write_bytes(exporting())
@@ -792,7 +973,7 @@ class ImportAuditTests(unittest.TestCase):
             ("AAAAAAAAAAA", 0, GLOBAL_FUNCTION), ("BBBBBBBBBBB", 1, GLOBAL_FUNCTION)], ["libSceA.prx"])
         expected_imports = import_audit.elf_imports(path, image)
         expected_exports = import_audit.elf_exports(path, image)
-        self.assertEqual(expected_imports, ({"AAAAAAAAAAA"}, {"libSceA.prx"}))
+        self.assertEqual(expected_imports, ({"AAAAAAAAAAA": False}, {"libSceA.prx"}))
         self.assertEqual(expected_exports, {"BBBBBBBBBBB"})
         for section_offset in (len(image), len(image) + 64):
             for section_count in (1, 0):
@@ -857,7 +1038,7 @@ class ImportAuditTests(unittest.TestCase):
             ("AAAAAAAAAAA", 0, GLOBAL_FUNCTION), ("BBBBBBBBBBB", 1, GLOBAL_FUNCTION)],
             ["libSceA.prx"], gnu_hash=True)
         self.assertEqual(import_audit.elf_program_dynamic_symbols(Path("module.prx"), image),
-                         ({"AAAAAAAAAAA"}, {"BBBBBBBBBBB"}, {"libSceA.prx"}))
+                         ({"AAAAAAAAAAA": False}, {"BBBBBBBBBBB"}, {"libSceA.prx"}))
 
     def test_sectionless_hash_metadata_must_be_file_backed(self):
         for gnu_hash in (False, True):
@@ -1314,8 +1495,8 @@ class ImportAuditTests(unittest.TestCase):
     def test_elf_imports_reader(self):
         image = build_elf([("one", 1, GLOBAL_FUNCTION), ("two", 0, GLOBAL_FUNCTION), ("three", 0, 0x22)], ["libc.prx", "libSceZip.prx"])
         path = Path("mod.prx")
-        self.assertEqual(import_audit.elf_imports(path, image), ({"two", "three"}, {"libc.prx", "libSceZip.prx"}))
-        self.assertEqual(import_audit.elf_imports(path, exporting()), (set(), set()))
+        self.assertEqual(import_audit.elf_imports(path, image), ({"two": False, "three": True}, {"libc.prx", "libSceZip.prx"}))
+        self.assertEqual(import_audit.elf_imports(path, exporting()), ({}, set()))
         for cut in (10, 64, len(image) - 5):
             with self.assertRaisesRegex(import_audit.AuditError, "mod.prx"):
                 import_audit.elf_imports(path, image[:cut])
@@ -1422,6 +1603,58 @@ class ImportAuditTests(unittest.TestCase):
         struct.pack_into("<H", image, 0x200 + 56 + 2, 0)
         self.assertEqual(import_audit.pe_exports(Path("lib.prx"), image), {"alpha", "beta"})
 
+    def test_elf_dynamic_tables_require_dt_null(self):
+        sectionless = bytearray(build_sectionless_elf(
+            [("alpha", 0, GLOBAL_FUNCTION)], ["libc.prx"]))
+        phoff = struct.unpack_from("<Q", sectionless, 32)[0]
+        phnum = struct.unpack_from("<H", sectionless, 56)[0]
+        dynamic = next(struct.unpack_from("<IIQQQQQQ", sectionless, phoff + index * 56)
+                       for index in range(phnum)
+                       if struct.unpack_from("<IIQQQQQQ", sectionless, phoff + index * 56)[0] == 2)
+        struct.pack_into("<qQ", sectionless, dynamic[2] + dynamic[5] - 16, 0x70000000, 0)
+        with self.assertRaisesRegex(import_audit.AuditError, "not terminated by DT_NULL"):
+            import_audit.elf_program_dynamic_symbols(Path("sectionless.prx"), sectionless)
+
+        work = self.work
+        (work.libs / "libc.prx").write_bytes(build_elf([("alpha", 1, GLOBAL_FUNCTION)]))
+        (work.modules / "module.prx").write_bytes(sectionless)
+        registry = work.root / "malformed.registry.json"
+        report = work.root / "malformed.json"
+        write_registry(registry, [])
+        code, _, error = work.run(registry, "--json", str(report))
+        self.assertEqual(code, 2)
+        self.assertIn("not terminated by DT_NULL", error)
+        self.assertFalse(report.exists())
+
+        sectioned = bytearray(build_elf(
+            [("alpha", 0, GLOBAL_FUNCTION)], ["libc.prx"]))
+        shoff = struct.unpack_from("<Q", sectioned, 40)[0]
+        shnum = struct.unpack_from("<H", sectioned, 60)[0]
+        dynamic = next(struct.unpack_from("<IIQQQQIIQQ", sectioned, shoff + index * 64)
+                       for index in range(shnum)
+                       if struct.unpack_from("<IIQQQQIIQQ", sectioned, shoff + index * 64)[1] == 6)
+        struct.pack_into("<qQ", sectioned, dynamic[4] + dynamic[5] - 16, 0x70000000, 0)
+        with self.assertRaisesRegex(import_audit.AuditError, "not terminated by DT_NULL"):
+            import_audit.elf_imports(Path("sectioned.prx"), sectioned)
+
+    def test_sectionless_dynamic_padding_after_dt_null_is_ignored(self):
+        image = bytearray(build_sectionless_elf(
+            [("alpha", 0, GLOBAL_FUNCTION)], ["libc.prx"]))
+        phoff = struct.unpack_from("<Q", image, 32)[0]
+        phnum = struct.unpack_from("<H", image, 56)[0]
+        headers = [struct.unpack_from("<IIQQQQQQ", image, phoff + index * 56)
+                   for index in range(phnum)]
+        dynamic = next(header for header in headers if header[0] == 2)
+        image.extend(struct.pack("<qQ", 1, 0xFFFFFFFF))
+        for index, header in enumerate(headers):
+            if header[0] == 2 or header[0] == 1:
+                updated = list(header)
+                updated[5] += 16
+                updated[6] += 16
+                struct.pack_into("<IIQQQQQQ", image, phoff + index * 56, *updated)
+        self.assertEqual(import_audit.elf_program_dynamic_symbols(Path("padded.prx"), image),
+                         ({"alpha": False}, set(), {"libc.prx"}))
+
     def test_module_dependencies_stop_at_dynamic_terminator(self):
         work = self.work
         (work.libs / "libc.prx").write_bytes(exporting())
@@ -1743,6 +1976,44 @@ class ImportAuditTests(unittest.TestCase):
         self.assertIn("input", err)
         self.assertEqual(registry.read_bytes(), before)
 
+    def test_json_output_preserves_shared_source_cmake_inputs(self):
+        work = self.work
+        name = "scePending"
+        nid = nid_names.compute_nid(name)
+        write_source(work.source, "libOwner", STUB_SOURCE.format(name=name))
+        shared = work.source / "libShared"
+        shared.mkdir()
+        cmake = shared / "CMakeLists.txt"
+        cmake.write_text('include(${CMAKE_CURRENT_SOURCE_DIR}/../libOwner/OwnerLibrary.cmake)\n', encoding="utf-8")
+        before = cmake.read_bytes()
+        (work.libs / "libShared.prx").write_bytes(exporting(nid))
+        registry = work.root / "game.json"
+        write_registry(registry, [(nid, "libShared.prx")])
+        outputs = [cmake]
+        for kind in ("symlink", "hardlink"):
+            alias = work.root / (kind + ".json")
+            try:
+                if kind == "symlink":
+                    alias.symlink_to(cmake)
+                else:
+                    os.link(cmake, alias)
+            except (OSError, NotImplementedError):
+                continue
+            outputs.append(alias)
+        for output in outputs:
+            with self.subTest(output=output):
+                code, out, err = work.run(registry, "--json", str(output))
+                self.assertEqual((code, out), (2, ""))
+                self.assertIn("JSON output would overwrite an input file", err)
+                self.assertEqual(cmake.read_bytes(), before)
+                self.assertEqual(output.read_bytes(), before)
+        report = work.root / "audit.json"
+        code, _, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (0, ""))
+        record, = json.loads(report.read_text(encoding="utf-8"))["imports"]
+        self.assertEqual((record["class"], record["name"]), ("stub", name))
+        self.assertEqual(cmake.read_bytes(), before)
+
     def test_git_stamp_uses_selected_source_tree(self):
         completed = type("Completed", (), {"stdout": "abcdef\n"})()
         with patch.object(import_audit.subprocess, "run", return_value=completed) as run:
diff --git a/tools/tests/test_nid_names.py b/tools/tests/test_nid_names.py
index 8445352ecd..f5ccf2945d 100644
--- a/tools/tests/test_nid_names.py
+++ b/tools/tests/test_nid_names.py
@@ -30,6 +30,25 @@ class DatabaseCacheTests(unittest.TestCase):
                         else:
                             self.assertEqual(result.stdout.split(), ["NAME", "NID"])
 
+    def test_environment_variable_selects_the_database_and_help_names_it(self):
+        script = str(Path(nid_names.__file__))
+        helped = subprocess.run([sys.executable, script, "--help"], capture_output=True, text=True, timeout=60)
+        self.assertEqual(helped.returncode, 0, helped.stderr)
+        self.assertIn("ANYPS5_NID_DB", " ".join(helped.stdout.split()))
+        with tempfile.TemporaryDirectory() as directory:
+            database = Path(directory) / "nid database.csv"
+            nid = nid_names.compute_nid("sceExample")
+            database.write_text(f"{nid} sceExample\n", encoding="utf-8")
+            scratch = str(Path(directory) / "scratch")
+            Path(scratch).mkdir()
+            environment = {**os.environ, "ANYPS5_NID_DB": str(database), "TEMP": scratch, "TMP": scratch, "TMPDIR": scratch}
+            result = subprocess.run([sys.executable, script, "--nid", nid, "--json"], capture_output=True, text=True,
+                                    env=environment, timeout=20)
+            self.assertEqual(list(Path(scratch).iterdir()), [])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertNotIn("downloading", result.stderr)
+        self.assertIn("sceExample", result.stdout)
+
     def test_interrupted_download_does_not_publish_a_partial_cache(self):
         with tempfile.TemporaryDirectory() as directory:
             cache = Path(directory) / "cache" / "aerolib.csv"
@@ -406,6 +425,33 @@ int APS5_VABI sceReal() { return 0; }
         self.write_source('// continued \\\nAPS5_EXPORT("AAAAAAAAAAA", exampleUnknown00);\nAPS5_EX\\\nPORT("BBBBBBBBBBB", exampleUnknown01);\n')
         self.assertEqual(nid_names.collect_unknowns(), {"BBBBBBBBBBB": "core/libs/prx/libSceExample/Export.cpp:exampleUnknown01"})
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(nid_names.sys, "stdout", out), patch.object(nid_names.sys, "stderr", err):
+            try:
+                nid_names.main(["--invalid-argument"])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 
 if __name__ == "__main__":
diff --git a/tools/tests/test_package_release.py b/tools/tests/test_package_release.py
index 4abcb1f37b..fb0ec3cd62 100644
--- a/tools/tests/test_package_release.py
+++ b/tools/tests/test_package_release.py
@@ -61,6 +61,21 @@ class ReleasePackageTests(unittest.TestCase):
         with tarfile.open(self.output / "prx-linux-v1.tar.gz") as archive:
             self.assertEqual(archive.extractfile("libs/licenses/vgmstream.txt").read(), b"decoder license")
 
+    def test_vorbis_decoder_licenses_in_archives(self):
+        (self.source / "core/libs/prx/libSceVorbisDec").mkdir()
+        (self.build / "core/libs/libs/libSceVorbisDec.prx").write_bytes(b"vorbis")
+        for name in ("ogg", "vorbis"):
+            license_file = self.source / f"3rdparty/{name}/COPYING"
+            license_file.parent.mkdir(parents=True)
+            license_file.write_bytes(f"{name} license".encode())
+        package_release.package("linux", self.build, self.output, "v1")
+        with zipfile.ZipFile(self.output / "prx-linux-v1.zip") as archive:
+            self.assertEqual(archive.read("libs/licenses/ogg.txt"), b"ogg license")
+            self.assertEqual(archive.read("libs/licenses/vorbis.txt"), b"vorbis license")
+        with tarfile.open(self.output / "prx-linux-v1.tar.gz") as archive:
+            self.assertEqual(archive.extractfile("libs/licenses/ogg.txt").read(), b"ogg license")
+            self.assertEqual(archive.extractfile("libs/licenses/vorbis.txt").read(), b"vorbis license")
+
     def test_windows_runtime_follows_the_configured_compiler_directory(self):
         runtime = self.root / "custom toolchain" / "bin"
         runtime.mkdir(parents=True)
@@ -83,6 +98,25 @@ class ReleasePackageTests(unittest.TestCase):
                 self.assertEqual(archive.extractfile("libs/" + name).read(), name.encode())
         self.assertEqual((self.output / "relinker-v1.exe").read_bytes(), b"Windows executable")
 
+    def test_opus_library_archives_include_the_bundled_license(self):
+        (self.source / "core/libs/prx/libSceOpusDec").mkdir()
+        (self.library.parent / "libSceOpusDec.prx").write_bytes(b"Opus library bytes")
+        license_file = self.source / "3rdparty/opus/COPYING"
+        license_file.parent.mkdir(parents=True)
+        license_file.write_bytes(b"Opus redistribution notice\n")
+        package_release.package("linux", self.build, self.output, "v1")
+        with zipfile.ZipFile(self.output / "prx-linux-v1.zip") as archive:
+            self.assertEqual(archive.read("libs/licenses/opus.txt"), license_file.read_bytes())
+        with tarfile.open(self.output / "prx-linux-v1.tar.gz") as archive:
+            self.assertEqual(archive.extractfile("libs/licenses/opus.txt").read(), license_file.read_bytes())
+
+    def test_opus_release_without_its_license_is_rejected(self):
+        (self.source / "core/libs/prx/libSceOpusCeltDec").mkdir()
+        (self.library.parent / "libSceOpusCeltDec.prx").write_bytes(b"CELT library bytes")
+        with self.assertRaisesRegex(RuntimeError, "COPYING"):
+            package_release.package("linux", self.build, self.output, "v1")
+        self.assertFalse(self.output.exists())
+
     def test_windows_package_without_configured_compiler_preserves_existing_output(self):
         (self.build / "CMakeCache.txt").write_text("CMAKE_CXX_COMPILER:FILEPATH=compiler-NOTFOUND\n", encoding="utf-8")
         (self.build / "core/relinker/relinker.exe").write_bytes(b"Windows executable")
@@ -350,9 +384,19 @@ class ReleasePackageTests(unittest.TestCase):
             package_release.package("linux", self.build, self.output, "../v1.0")
         self.assertFalse(self.output.exists())
 
+    def test_windows_runtime_missing_cmake_cache_raises_runtime_error(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            with self.assertRaisesRegex(RuntimeError, "Missing CMakeCache.txt"):
+                package_release.windows_runtime(Path(tmp))
+
 
 
 class DocumentationAssetsTests(unittest.TestCase):
+    def test_source_not_directory_raises_runtime_error(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            with self.assertRaisesRegex(RuntimeError, "not a directory"):
+                package_release.collect_docs(Path(tmp) / "nonexistent", Path(tmp) / "assets")
+
     def test_unique_nested_documents_are_flattened(self):
         with tempfile.TemporaryDirectory() as tmp:
             source = Path(tmp) / "source"
@@ -601,5 +645,48 @@ class ReleaseNotesEdgeCaseTests(unittest.TestCase):
         self.assertIn("Full Changelog", result)
 
 
+class ReleaseMainTests(unittest.TestCase):
+    def test_main_with_docs_arguments(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            docs = Path(tmp) / "docs"
+            docs.mkdir()
+            (docs / "guide.md").write_text("# Guide", encoding="utf-8")
+            output = Path(tmp) / "out"
+            result = package_release.main(["--docs", str(docs), "--output", str(output)])
+            self.assertEqual(result, 0)
+            self.assertEqual((output / "guide.md").read_text(encoding="utf-8"), "# Guide")
+
+    def test_main_reports_packaging_error_via_parser_error(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            output = Path(tmp) / "out"
+            stderr = io.StringIO()
+            with contextlib.redirect_stderr(stderr), self.assertRaises(SystemExit) as error:
+                package_release.main(["--docs", str(Path(tmp) / "nonexistent"), "--output", str(output)])
+            self.assertEqual(error.exception.code, 2)
+            self.assertIn("not a directory", stderr.getvalue())
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+        out, err = Stream(), Stream()
+        with patch.object(package_release.sys, "stdout", out), patch.object(package_release.sys, "stderr", err):
+            with tempfile.TemporaryDirectory() as tmp:
+                docs = Path(tmp) / "docs"
+                docs.mkdir()
+                (docs / "doc.md").write_text("text", encoding="utf-8")
+                package_release.main(["--docs", str(docs), "--output", str(Path(tmp) / "out")])
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_pad_input.py b/tools/tests/test_pad_input.py
index 76e820c325..bb557866d4 100644
--- a/tools/tests/test_pad_input.py
+++ b/tools/tests/test_pad_input.py
@@ -85,6 +85,22 @@ class PadInputTests(unittest.TestCase):
         self.assertEqual(self.queue(1000, "touch-left"), [1000, 0x200000, 300])
         self.assertEqual(self.queue(1000, "touch-right"), [1001, 0x400000, 300])
 
+    def test_joined_buttons_are_pressed_together(self):
+        self.assertEqual(self.queue(1000, "l1+r1"), [1000, 0x400 | 0x800, 300])
+        self.assertEqual(self.queue(1000, "cross+square+up", "--hold-ms", "40"), [1001, 0x4000 | 0x8000 | 0x10, 40])
+
+    def test_invalid_joined_buttons_report_error_and_preserve_command(self):
+        original = "2000 16384 300\n"
+        for button in ["l1+nothing", "l1+release", "l1+l1", "l1+", "+r1"]:
+            with self.subTest(button=button):
+                self.path.write_text(original, encoding="utf-8")
+                errors = io.StringIO()
+                with contextlib.redirect_stderr(errors), self.assertRaises(SystemExit) as error:
+                    self.queue(1000, button)
+                self.assertEqual(error.exception.code, 2)
+                self.assertIn("invalid button", errors.getvalue())
+                self.assertEqual(self.path.read_text(encoding="utf-8"), original)
+
     def test_valid_stick_command_and_unsigned_tokens_preserve_sequence(self):
         self.path.write_text("+2000 +16384 +300 +0 +255 +128 +128\n", encoding="utf-8")
         self.assertEqual(self.queue(1000, "release"), [2001, 0, 300])
diff --git a/tools/tests/test_pad_timeline.py b/tools/tests/test_pad_timeline.py
index cc40a5b7d8..b7a91f3d96 100644
--- a/tools/tests/test_pad_timeline.py
+++ b/tools/tests/test_pad_timeline.py
@@ -74,6 +74,26 @@ class TimelineTests(unittest.TestCase):
             with self.assertRaises(ValueError):
                 pad_timeline.compile_timeline(self.document, 1, repeat, gap)
 
+    def test_repeated_event_count_at_capacity(self):
+        rows = pad_timeline.compile_timeline(self.document, 42, 2048, 0).splitlines()
+        self.assertEqual(rows[0], "APS5_PAD_TIMELINE 1 42 4096")
+        self.assertEqual(len(rows) - 1, 4096)
+        self.assertEqual(rows[1:3], ["200 100 18432", "500 200 64"])
+        self.assertEqual(rows[2047:2051], [
+            "716300 100 18432", "716600 200 64", "717000 100 18432", "717300 200 64",
+        ])
+        self.assertEqual(rows[-2:], ["1433100 100 18432", "1433400 200 64"])
+        with self.assertRaisesRegex(ValueError, "1 to 4096 events after repetition"):
+            pad_timeline.compile_timeline(self.document, 42, 2049, 0)
+
+    def test_repeated_duration_includes_inter_iteration_gaps_only(self):
+        document = {"version": 1, "events": [{"at_ms": 0, "hold_ms": 5000, "buttons": ["cross"]}]}
+        self.assertEqual(
+            pad_timeline.compile_timeline(document, 42, 2, 3590000),
+            "APS5_PAD_TIMELINE 1 42 2\n0 5000 16384\n3595000 5000 16384\n")
+        with self.assertRaisesRegex(ValueError, "repeated timeline exceeds one hour"):
+            pad_timeline.compile_timeline(document, 42, 2, 3590001)
+
     def test_sequence_bounds(self):
         for sequence in [0, -1, True, 2**64]:
             with self.assertRaises(ValueError):
diff --git a/tools/tests/test_performance_compare.py b/tools/tests/test_performance_compare.py
index 1cabac3fe2..4016f14439 100644
--- a/tools/tests/test_performance_compare.py
+++ b/tools/tests/test_performance_compare.py
@@ -5,6 +5,7 @@ import subprocess
 import sys
 import tempfile
 import unittest
+from unittest.mock import patch
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
@@ -317,5 +318,33 @@ class PerformanceCompareTests(unittest.TestCase):
 
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(performance_compare.sys, "stdout", out), patch.object(performance_compare.sys, "stderr", err):
+            try:
+                performance_compare.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_pr_labels.py b/tools/tests/test_pr_labels.py
index eec489a51a..76298e7657 100644
--- a/tools/tests/test_pr_labels.py
+++ b/tools/tests/test_pr_labels.py
@@ -1,4 +1,6 @@
+import contextlib
 import copy
+import io
 import json
 import sys
 import unittest
@@ -174,12 +176,50 @@ class MainTests(unittest.TestCase):
             return ""
 
         with patch.object(pr_labels, "gh", side_effect=fake), patch.object(pr_labels, "WRITE_PAUSE", 0), \
-                patch.object(sys, "argv", ["pr_labels.py", "--all"]), patch.dict(pr_labels.os.environ, {"GITHUB_REPOSITORY": "o/r"}):
+                patch.dict(pr_labels.os.environ, {"GITHUB_REPOSITORY": "o/r"}):
             with self.assertRaises(SystemExit) as raised:
-                pr_labels.main()
+                pr_labels.main(["--all"])
         self.assertEqual(edited, ["1", "2"])
         self.assertIn("#1", str(raised.exception.code))
 
+    def test_main_handles_called_process_error_when_fetching_pr(self):
+        def fake(*args):
+            raise pr_labels.subprocess.CalledProcessError(1, "gh", stderr="PR not found")
+
+        with patch.object(pr_labels, "gh", side_effect=fake), \
+                patch.dict(pr_labels.os.environ, {"GITHUB_REPOSITORY": "o/r"}), \
+                contextlib.redirect_stderr(io.StringIO()):
+            with self.assertRaises(SystemExit) as raised:
+                pr_labels.main(["--pr", "999"])
+        self.assertEqual(raised.exception.code, 2)
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(pr_labels.sys, "stdout", out), patch.object(pr_labels.sys, "stderr", err):
+            try:
+                pr_labels.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_pr_overlap.py b/tools/tests/test_pr_overlap.py
index 520620c8a3..4017ab3718 100644
--- a/tools/tests/test_pr_overlap.py
+++ b/tools/tests/test_pr_overlap.py
@@ -312,6 +312,62 @@ class UnicodePathTests(unittest.TestCase):
                 os.chdir(previous)
 
 
+class SubdirectoryTests(unittest.TestCase):
+    @unittest.skipIf(os.name == "nt", "fake gh is a shell script")
+    def test_branch_report_from_a_subdirectory_matches_the_root(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory).resolve() / "repo"
+            fake = Path(directory) / "bin"
+            fake.mkdir()
+
+            def git(*args):
+                return subprocess.run(
+                    ["git", "-c", "user.name=Overlap Test", "-c", "user.email=test@example.com",
+                     "-c", "commit.gpgsign=false", *args], cwd=root,
+                    capture_output=True, text=True, encoding="utf-8", check=True).stdout.strip()
+
+            filename = "core/libs/prx/libSceExample/Export.cpp"
+            source = root / filename
+            source.parent.mkdir(parents=True)
+            source.write_text("int value = 0;\n", encoding="utf-8")
+            (root / "tools").mkdir()
+            (root / "tools" / "tool.py").write_text("print()\n", encoding="utf-8")
+            git("init", "-q", "-b", "main")
+            git("add", ".")
+            git("commit", "-qm", "test: create base")
+            heads = {}
+            for branch, value in (("theirs", 1), ("mine", 2)):
+                git("checkout", "-qb", branch, "main")
+                source.write_text(f"int value = {value};\nint APS5_VABI sceExample() {{ return {value}; }}\n", encoding="utf-8")
+                git("add", ".")
+                git("commit", "-qm", "fix: change value")
+                heads[branch] = git("rev-parse", "HEAD")
+            pulls = [{"number": 7, "user": {"login": "someone"}, "head": {"sha": heads["theirs"]}, "body": "Depends on: none"}]
+            (fake / "pulls.json").write_text(json.dumps(pulls), encoding="utf-8")
+            (fake / "gh").write_text(f"#!/bin/sh\ncat '{fake / 'pulls.json'}'\n", encoding="utf-8")
+            (fake / "gh").chmod(0o755)
+            environment = {**os.environ, "PATH": f"{fake}{os.pathsep}{os.environ['PATH']}", "GIT_CONFIG_COUNT": "1",
+                           "GIT_CONFIG_KEY_0": f"url.{root.as_uri()}.insteadOf", "GIT_CONFIG_VALUE_0": "https://github.com/owner/project.git"}
+            environment.pop("GITHUB_REPOSITORY", None)
+            script = Path(pr_overlap.__file__).resolve()
+            outputs = {}
+            for subdirectory in (".", "tools", "core/libs/prx"):
+                result = subprocess.run([sys.executable, str(script), "--repo", "owner/project", "--branch", "mine"],
+                                        cwd=root / subdirectory, env=environment, capture_output=True, text=True,
+                                        encoding="utf-8", timeout=60)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                outputs[subdirectory] = result.stdout
+            self.assertIn(f"`{filename}` [L1](", outputs["."])
+            self.assertIn("| `sceExample` |", outputs["."])
+            self.assertEqual(outputs["tools"], outputs["."])
+            self.assertEqual(outputs["core/libs/prx"], outputs["."])
+            result = subprocess.run([sys.executable, str(script), "--repo", "owner/project", "--out", "reports"],
+                                    cwd=root / "tools", env=environment, capture_output=True, text=True,
+                                    encoding="utf-8", timeout=60)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertTrue((root / "tools" / "reports" / "7.md").is_file())
+
+
 class CommentStateTests(unittest.TestCase):
     def setUp(self):
         if os.name == "nt" or not all(shutil.which(tool) for tool in ("bash", "jq", "sed", "sha256sum")):
diff --git a/tools/tests/test_pr_overlap_encoding.py b/tools/tests/test_pr_overlap_encoding.py
index 1dad26c746..ea60e5b076 100644
--- a/tools/tests/test_pr_overlap_encoding.py
+++ b/tools/tests/test_pr_overlap_encoding.py
@@ -42,6 +42,8 @@ def command_output(stdout, stderr="", returncode=0):
             f"sys.exit({returncode})\n")
 
     def run(command, **kwargs):
+        if command[:3] == ["git", "rev-parse", "--show-toplevel"]:
+            return RUN(command, **kwargs)
         return RUN([sys.executable, "-c", code], **kwargs)
 
     with simulated_cp1252(), \
diff --git a/tools/tests/test_pr_overlap_errors.py b/tools/tests/test_pr_overlap_errors.py
index c5bb5e0b8e..f85c7c3267 100644
--- a/tools/tests/test_pr_overlap_errors.py
+++ b/tools/tests/test_pr_overlap_errors.py
@@ -37,5 +37,33 @@ class ErrorReportTests(unittest.TestCase):
         self.assertIn(MISSING_REF, str(raised.exception.code))
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(pr_overlap.sys, "stdout", out), patch.object(pr_overlap.sys, "stderr", err):
+            try:
+                pr_overlap.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_pr_overlap_exports.py b/tools/tests/test_pr_overlap_exports.py
index d326656d8b..fbdb824013 100644
--- a/tools/tests/test_pr_overlap_exports.py
+++ b/tools/tests/test_pr_overlap_exports.py
@@ -4,6 +4,7 @@ from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import pr_overlap
+import nid_names
 
 TRAILING = "+extern \"C\" std::int64_t APS5_VABI recv_nid_postfix(int, void*, std::uint64_t, int) noexcept;   \n"
 DIFF = """diff --git a/core/libs/prx/libkernel/File/src/Open.cpp b/core/libs/prx/libkernel/File/src/Open.cpp
@@ -52,6 +53,81 @@ class ExportTests(unittest.TestCase):
         self.assertNotIn("context_nid_postfix", found)
         self.assertNotIn("Helper_nid_no_patch", found)
 
+    def test_added_definitions_match_base_names_with_nid_postfix(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        base = {("core/libs/prx/libkernel", nid): {"sceKernelRead_nid_postfix"}}
+        added = pr_overlap.source_changed_exports(
+            "diff --git a/core/libs/prx/libkernel/a.cpp b/core/libs/prx/libkernel/a.cpp\n+int APS5_VABI sceKernelRead(int fd) { return fd; }\n", "+")
+        self.assertEqual(set(added) & set(base), {("core/libs/prx/libkernel", nid)})
+
+    def test_added_assembly_export_matches_base_definition(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        added = pr_overlap.source_changed_exports(
+            'diff --git a/a.cpp b/a.cpp\n+APS5_ASM_FUNCTION("sceKernelRead")\n', "+")
+        self.assertIn(("", nid), added)
+
+    def test_added_raw_export_matches_base_definition(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        added = pr_overlap.source_changed_exports(
+            f'diff --git a/a.cpp b/a.cpp\n+APS5_EXPORT("{nid}", sceKernelReadAlias);\n', "+")
+        self.assertEqual(added[("", nid)], {"sceKernelReadAlias"})
+
+    def test_raw_main_export_is_preserved_as_literal_nid(self):
+        nid = "123456789ab"
+        self.assertEqual(pr_overlap.source_exports(f'APS5_EXPORT("{nid}", alias);'), {("", nid): {"alias"}})
+
+    def test_replacing_an_export_in_place_cancels_the_same_nid(self):
+        diff = """diff --git a/a.cpp b/a.cpp
+-int APS5_VABI sceKernelRead_nid_postfix(int fd) { throw std::runtime_error("not implemented"); }
++int APS5_VABI sceKernelRead(int fd) { return fd; }
+"""
+        added = pr_overlap.source_changed_exports(diff, "+")
+        removed = pr_overlap.source_changed_exports(diff, "-")
+        self.assertEqual(set(added) - set(removed), set())
+
+    def test_exports_with_same_nid_in_different_libraries_do_not_overlap(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        added = pr_overlap.source_changed_exports(
+            "diff --git a/core/libs/prx/libSceAmpr/a.cpp b/core/libs/prx/libSceAmpr/a.cpp\n"
+            "+int APS5_VABI sceKernelRead(int fd) { return fd; }\n", "+")
+        base = {("core/libs/prx/libkernel", nid): {"sceKernelRead"}}
+        self.assertFalse(set(added) & set(base))
+
+    def test_main_exports_have_a_separate_report_section_not_a_fake_pr(self):
+        nid = nid_names.compute_nid("sceKernelRead")
+        prs = {9: {"added_exports": {("core/libs/prx/libkernel", nid): {"sceKernelRead"}}, "removed_exports": {}}}
+        findings = pr_overlap.main_export_findings(prs, {("core/libs/prx/libkernel", nid): {"sceKernelRead"}})
+        rows = {9: {"added": set()}}
+        report = pr_overlap.report(rows, "https://example.invalid/blob/base", findings[9])
+        self.assertIn("Exports introduced here that are already present in `main`", report)
+        self.assertNotIn("PR 0", report)
+        self.assertNotIn("PR 9", report)
+        self.assertNotIn("Already on `main` |", report)
+        self.assertEqual(rows, {9: {"added": set()}})
+
+
+    def test_explicit_export_aliases_are_collected_by_library_and_nid(self):
+        source = ('int APS5_VABI placeholder_nid_no_patch() {\n'
+                  '    NotImplemented_nid_no_patch(__func__);\n'
+                  '}\n'
+                  'APS5_EXPORT("Pz262plj20w", placeholder_nid_no_patch);\n')
+        self.assertEqual(
+            pr_overlap.source_exports(source, "core/libs/prx/libSceExample"),
+            {("core/libs/prx/libSceExample", "Pz262plj20w"): {"placeholder_nid_no_patch"}},
+        )
+
+    def test_explicit_alias_and_named_export_share_a_key_in_the_same_library(self):
+        explicit = pr_overlap.source_exports(
+            'APS5_EXPORT("Pz262plj20w", placeholder_nid_no_patch);',
+            "core/libs/prx/libSceExample",
+        )
+        named = pr_overlap.source_changed_exports(
+            "diff --git a/core/libs/prx/libSceExample/a.cpp b/core/libs/prx/libSceExample/a.cpp\n"
+            "+int APS5_VABI FT_Outline_GetInsideBorder() { return 0; }\n",
+            "+",
+        )
+        self.assertEqual(set(explicit) & set(named), {("core/libs/prx/libSceExample", "Pz262plj20w")})
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_progress.py b/tools/tests/test_progress.py
index 1db231c27f..397f8494dd 100644
--- a/tools/tests/test_progress.py
+++ b/tools/tests/test_progress.py
@@ -107,6 +107,105 @@ class ProgressSnapshotTests(unittest.TestCase):
 
 
 class ProgressTests(unittest.TestCase):
+    def report_library(self, name, done=(), todo=(), **extra):
+        return {"name": name, "label": name, "done": len(done), "todo": len(todo),
+                "done_names": list(done), "todo_names": list(todo), **extra}
+
+    def report_snapshot(self, *groups):
+        return {"libraries": progress.summarize(list(groups)), "shaders": progress.summarize([])}
+
+    def test_report_shows_each_changed_library_and_keeps_global_details(self):
+        pad = self.report_library("libScePad", ["Ready"], ["Pending"])
+        video = self.report_library("libSceVideoOut", ["A", "B", "C"], ["D"])
+        unchanged = self.report_library("libSceUnused", ["Keep"])
+        base = self.report_snapshot(video, unchanged, pad)
+        head = self.report_snapshot(self.report_library("libScePad", ["Ready", "Pending"]), unchanged,
+                                    self.report_library("libSceVideoOut", ["A", "B"], ["C", "D"]))
+        report = progress.report(base, head)
+        self.assertIn("**System libraries**", report)
+        self.assertIn("| Library | Name |", report)
+        self.assertIn("| libScePad | 1/2 (50.00%) | 2/2 (100.00%) | +50.00 pp |", report)
+        self.assertIn("| libSceVideoOut | 3/4 (75.00%) | 2/4 (50.00%) | -25.00 pp |", report)
+        table = report.split("#### Changed libraries (implemented exports)")[1]
+        self.assertNotIn("libSceUnused", table)
+        self.assertLess(table.index("libScePad"), table.index("libSceVideoOut"))
+
+    def test_report_includes_changed_function_names_when_counts_stay_equal(self):
+        base = self.report_snapshot(self.report_library("libScePad", ["Old"], ["Pending"]))
+        head = self.report_snapshot(self.report_library("libScePad", ["New"], ["Pending"]))
+        self.assertIn("| libScePad | 1/2 (50.00%) | 1/2 (50.00%) | +0.00 pp |", progress.report(base, head))
+
+    def test_report_marks_new_removed_and_empty_libraries_without_percentages(self):
+        base = self.report_snapshot(self.report_library("libSceRemoved", ["Ready"]),
+                                    self.report_library("libSceEmptied", ["Old"]))
+        head = self.report_snapshot(self.report_library("libSceAdded", ["New"], ["Pending"]),
+                                    self.report_library("libSceEmpty"), self.report_library("libSceEmptied"))
+        report = progress.report(base, head)
+        self.assertIn("| libSceAdded | Not present | 1/2 (50.00%) | n/a |", report)
+        self.assertIn("| libSceRemoved | 1/1 (100.00%) | Not present | n/a |", report)
+        self.assertIn("| libSceEmpty | Not present | No exports | n/a |", report)
+        self.assertIn("| libSceEmptied | 1/1 (100.00%) | No exports | n/a |", report)
+
+    def test_report_marks_missing_counts_unavailable_with_no_delta(self):
+        complete = {"name": "libSceLegacy", "done": 1, "todo": 0, "done_names": ["Current"]}
+        for missing in ({"done_names": ["Legacy"]}, {"done": 0}, {"todo": 0}, {}):
+            minimal = {"name": "libSceLegacy", **missing}
+            for before, after in ((minimal, complete), (complete, minimal)):
+                with self.subTest(before=before, after=after):
+                    base = {"libraries": {"groups": [before], "percent": 0},
+                            "shaders": {"groups": [], "percent": 0}}
+                    head = {"libraries": {"groups": [after], "percent": 0},
+                            "shaders": {"groups": [], "percent": 0}}
+                    report = progress.report(base, head)
+                    self.assertIn("Counts unavailable", report)
+                    self.assertIn("| n/a |", report)
+                    self.assertNotIn("No exports", report)
+
+    def test_report_omits_unchanged_minimal_snapshots(self):
+        minimal = {"name": "libSceLegacy"}
+        snapshot = {"libraries": {"groups": [minimal], "percent": 0},
+                    "shaders": {"groups": [], "percent": 0}}
+        self.assertEqual(progress.report(snapshot, snapshot), "")
+
+    def test_report_labels_shared_sources_without_duplicate_counts(self):
+        owner = self.report_library("libScePad", ["Ready"], ["Pending"])
+        alias = self.report_library("libScePad.native", ["Ready"], ["Pending"])
+        shared = self.report_library("libScePad.native", shared_sources="libScePad")
+        base, head = self.report_snapshot(owner, alias), self.report_snapshot(owner, shared)
+        report = progress.report(base, head)
+        self.assertIn("| libScePad.native | 1/2 (50.00%) | Shared sources: `libScePad` | n/a |", report)
+        self.assertNotIn("removed", report)
+        reverse = progress.report(head, base)
+        self.assertIn("| libScePad.native | Shared sources: `libScePad` | 1/2 (50.00%) | n/a |", reverse)
+        changed = self.report_snapshot(owner, self.report_library("libScePad.native", shared_sources="libSceOther"))
+        self.assertIn("| libScePad.native | Shared sources: `libScePad` | Shared sources: `libSceOther` | n/a |",
+                      progress.report(head, changed))
+
+    def test_report_omits_unchanged_libraries_and_preserves_shader_report(self):
+        library = self.report_library("libScePad", ["Ready"])
+        base, head = self.report_snapshot(library), self.report_snapshot(dict(library, inert_names=["Ready"]))
+        self.assertEqual(progress.report(base, head), "")
+        head["shaders"] = progress.summarize([self.report_library("VOP1", ["V_MOV_B32"])])
+        report = progress.report(base, head)
+        self.assertEqual(report, "\n".join(progress.compare("GPU shader instructions", "Encoding", "instructions",
+                                                          base["shaders"], head["shaders"])))
+        self.assertNotIn("Changed libraries", report)
+
+    def test_report_rounds_percentage_point_change_without_negative_zero(self):
+        base = self.report_snapshot(self.report_library("libScePad", ["Ready"], ["A", "B"]))
+        head = self.report_snapshot(self.report_library("libScePad", ["Ready", "A"], ["B"]))
+        self.assertIn("| libScePad | 1/3 (33.33%) | 2/3 (66.67%) | +33.33 pp |", progress.report(base, head))
+        before = dict(self.report_library("libSceLarge", ["Ready"]), todo=100000)
+        after = dict(before, todo=100001)
+        self.assertIn("| +0.00 pp |", progress.report(self.report_snapshot(before), self.report_snapshot(after)))
+
+    def test_report_limits_library_rows(self):
+        head = self.report_snapshot(*(self.report_library(f"libSce{i:03}", ["Ready"]) for i in range(103)))
+        report = progress.report(self.report_snapshot(), head)
+        table = report.split("#### Changed libraries (implemented exports)")[1]
+        self.assertEqual(sum(line.startswith("| libSce") for line in table.splitlines()), progress.REPORT_ROWS)
+        self.assertIn("3 more libraries", table)
+
     def test_raw_string_example_does_not_declare_an_export(self):
         source = 'const char* example = R"help(\nint APS5_VABI Fake() { return 0; }\n)help";\n'
         source += 'int APS5_VABI Real() { return 7; }\n'
@@ -497,6 +596,17 @@ class ProgressTests(unittest.TestCase):
                     self.assertEqual(raised.exception.code, 2)
                     self.assertIn(str(path), stderr.getvalue())
 
+    def test_output_directory_that_cannot_be_written_is_named(self):
+        with tempfile.TemporaryDirectory() as directory:
+            blocked = Path(directory) / "blocked output"
+            blocked.write_text("a file, not a directory", encoding="utf-8")
+            stderr = io.StringIO()
+            with patch("sys.stderr", stderr), self.assertRaises(SystemExit) as raised:
+                progress.main([str(blocked)])
+            self.assertEqual(raised.exception.code, 2)
+            self.assertIn(str(blocked), stderr.getvalue())
+            self.assertNotIn("Traceback", stderr.getvalue())
+
     def test_root_must_be_a_source_tree(self):
         with tempfile.TemporaryDirectory() as directory:
             empty = Path(directory) / "empty tree"
diff --git a/tools/tests/test_progress_history.py b/tools/tests/test_progress_history.py
index 813b596990..38b9f5de86 100644
--- a/tools/tests/test_progress_history.py
+++ b/tools/tests/test_progress_history.py
@@ -1,3 +1,4 @@
+import json
 import os
 import subprocess
 import sys
@@ -17,9 +18,9 @@ OPCODES = Path("core/shader/recompiler/RdnaDecoder/include/RdnaDecoder/RdnaOpcod
 def commit(root, day, message, body, time="12:00:00Z"):
     library = root / "core/libs/prx/libSceExample"
     library.mkdir(parents=True, exist_ok=True)
-    (library / "Export.cpp").write_text(body)
+    (library / "Export.cpp").write_text(body, encoding="utf-8")
     (root / OPCODES).parent.mkdir(parents=True, exist_ok=True)
-    (root / OPCODES).write_text("enum class RdnaOpcode : int {\n    SEndpgm,\n};\n")
+    (root / OPCODES).write_text("enum class RdnaOpcode : int {\n    SEndpgm,\n};\n", encoding="utf-8")
     env = {**os.environ, "GIT_AUTHOR_DATE": f"{day}T{time}", "GIT_COMMITTER_DATE": f"{day}T{time}"}
     subprocess.run(["git", "-C", str(root), "add", "-A"], check=True)
     subprocess.run(["git", "-C", str(root), "-c", "user.name=t", "-c", "user.email=t@t", "commit", "-q", "-m", message],
@@ -140,6 +141,21 @@ class ProgressHistoryTests(unittest.TestCase):
         for label in ("Aug 3", "Aug 10", "Aug 17", "Aug 24", "Aug 31"):
             self.assertIn(f">{label}<", svg)
 
+    def test_main_writes_utf8_output_files(self):
+        point = {"date": "2026-01-01", "commit": "abc1234",
+                 "libraries": {"done": 1, "total": 2, "percent": 50.0},
+                 "shaders": {"done": 3, "total": 4, "percent": 75.0}}
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "site"
+            with patch.object(progress_history, "collect", return_value=[point]):
+                progress_history.main([str(output)])
+            svg = (output / "history.svg").read_text(encoding="utf-8")
+            self.assertIn("\u25cf", svg)
+            html = (output / "history.html").read_text(encoding="utf-8")
+            self.assertIn("<!DOCTYPE html>", html)
+            data = json.loads((output / "history.json").read_text(encoding="utf-8"))
+            self.assertEqual(data, [point])
+
 
 
 if __name__ == "__main__":
diff --git a/tools/tests/test_select_tests.py b/tools/tests/test_select_tests.py
index e86b16ccad..a34bf96c11 100644
--- a/tools/tests/test_select_tests.py
+++ b/tools/tests/test_select_tests.py
@@ -119,13 +119,108 @@ class SelectTests(unittest.TestCase):
         self.assertEqual(self.select("alpha/alpha.h", graph=older)[1], {"alpha", "alpha_data", "beta", "beta_setup", "script"})
 
     def test_selected_target_skips_unselected_executables(self):
-        self.select("alpha/main.c")
         subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+        self.select("alpha/main.c")
         subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
         built = {p.stem for p in self.build.rglob("*_tests*") if p.is_file() and os.access(p, os.X_OK)}
         subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
         self.assertEqual(built, {"alpha_tests"})
 
+    def test_fresh_build_keeps_a_shared_selected_executable(self):
+        with tempfile.TemporaryDirectory() as directory:
+            build = Path(directory) / "fresh"
+            compiler = shutil.which("gcc") or shutil.which("cc")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(build), "-G", "Ninja", f"-DCMAKE_C_COMPILER={compiler}"],
+                           check=True, capture_output=True)
+            changed = build / "changed.txt"
+            changed.write_text("data/input.txt\n", encoding="utf-8")
+            self.tool("select", build, self.graph, changed)
+            subprocess.run(["ninja", "-C", str(build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            built = {path.stem for path in build.rglob("*_tests*") if path.is_file() and os.access(path, os.X_OK)}
+            self.assertEqual(built, {"alpha_tests"})
+            output = self.tool("ctest", build, "--output-on-failure")
+            self.assertEqual(set(re.findall(r"Test +#\d+: (\S+)", output)), {"alpha_data", "script"})
+
+    def test_empty_selection_does_not_build_unselected_executables(self):
+        cmake = self.source / "CMakeLists.txt"
+        original = cmake.read_text(encoding="utf-8")
+        try:
+            cmake.write_text(original.replace('add_test(NAME script COMMAND ${CMAKE_COMMAND} -E true)\n', ''), encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+            self.assertEqual(self.select("README.md")[1], set())
+            subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            self.assertFalse(any(path.is_file() and os.access(path, os.X_OK) for path in self.build.rglob("*_tests*")))
+        finally:
+            cmake.write_text(original, encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
+
+    def test_script_test_builds_the_executable_it_gets_as_a_definition(self):
+        cmake, script = self.source / "alpha/CMakeLists.txt", self.source / "data/run.cmake"
+        original = cmake.read_text(encoding="utf-8")
+        try:
+            script.write_text('execute_process(COMMAND "${FIXTURE}" RESULT_VARIABLE result)\n'
+                              'if(NOT result STREQUAL "0")\n  message(FATAL_ERROR "fixture: ${result}")\nendif()\n',
+                              encoding="utf-8")
+            cmake.write_text(original + "add_test(NAME alpha_run COMMAND ${CMAKE_COMMAND} -DFIXTURE=$<TARGET_FILE:alpha_tests>"
+                                        " -P ${CMAKE_SOURCE_DIR}/data/run.cmake)\n", encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+            graph = self.build / "run-graph.json"
+            self.tool("dump", self.build, graph)
+            self.assertEqual(self.select("beta/main.c", graph=graph)[1], {"alpha_run", "beta", "beta_setup", "script"})
+            subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            output = self.tool("ctest", self.build, "-R", "alpha_run", "--output-on-failure")
+            self.assertIn("100% tests passed", output)
+        finally:
+            cmake.write_text(original, encoding="utf-8")
+            script.unlink(missing_ok=True)
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
+
+    def test_script_test_builds_an_excluded_executable_it_gets_as_a_definition(self):
+        cmake, script = self.source / "alpha/CMakeLists.txt", self.source / "data/run.cmake"
+        original = cmake.read_text(encoding="utf-8")
+        try:
+            script.write_text('execute_process(COMMAND "${TOOL}" RESULT_VARIABLE result)\n'
+                              'if(NOT result STREQUAL "0")\n  message(FATAL_ERROR "tool: ${result}")\nendif()\n',
+                              encoding="utf-8")
+            cmake.write_text(original + "add_executable(alpha_tool EXCLUDE_FROM_ALL main.c)\n"
+                                        "add_test(NAME alpha_run COMMAND ${CMAKE_COMMAND} -DTOOL=$<TARGET_FILE:alpha_tool>"
+                                        " -P ${CMAKE_SOURCE_DIR}/data/run.cmake)\n", encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+            graph = self.build / "run-graph.json"
+            self.tool("dump", self.build, graph)
+            self.assertEqual(self.select("beta/main.c", graph=graph)[1], {"alpha_run", "beta", "beta_setup", "script"})
+            subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            output = self.tool("ctest", self.build, "-R", "alpha_run", "--output-on-failure")
+            self.assertIn("100% tests passed", output)
+        finally:
+            cmake.write_text(original, encoding="utf-8")
+            script.unlink(missing_ok=True)
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
+
+    def test_retargeted_test_does_not_prune_its_previous_executable(self):
+        cmake = self.source / "alpha/CMakeLists.txt"
+        original = cmake.read_text(encoding="utf-8")
+        try:
+            cmake.write_text(original.replace("add_executable(alpha_tests main.c)",
+                                             "add_executable(alpha_tests main.c)\nadd_executable(replacement_tests main.c)")
+                             .replace("COMMAND alpha_tests", "COMMAND replacement_tests"), encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+            self.select("beta/main.c")
+            subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
+            built = {path.stem for path in self.build.rglob("*_tests*") if path.is_file() and os.access(path, os.X_OK)}
+            self.assertEqual(built, {"alpha_tests", "beta_tests", "setup_tests"})
+        finally:
+            cmake.write_text(original, encoding="utf-8")
+            subprocess.run(["cmake", "-S", str(self.source), "-B", str(self.build)], check=True, capture_output=True)
+            subprocess.run(["cmake", "--build", str(self.build)], check=True, capture_output=True)
+
     def test_explain_reports_input_and_fixture_reasons_without_a_build_cache(self):
         changed = self.build / "explain-changed.txt"
         cache = self.build / "CMakeCache.txt"
@@ -182,8 +277,8 @@ class FixtureBuildTests(unittest.TestCase):
         marker.unlink(missing_ok=True)
         listed = self.build / "changed.txt"
         listed.write_text(changed + "\n", encoding="utf-8")
-        SelectTests.tool("select", self.build, graph, listed)
         subprocess.run(["ninja", "-C", str(self.build), "-t", "clean"], check=True, capture_output=True)
+        SelectTests.tool("select", self.build, graph, listed)
         subprocess.run(["ninja", "-C", str(self.build), "-f", "select.ninja", "selected"], check=True, capture_output=True)
         result = subprocess.run([sys.executable, str(TOOL), "ctest", str(self.build), "--output-on-failure"],
                                 capture_output=True, text=True)
@@ -230,6 +325,40 @@ class BuildErrorTests(unittest.TestCase):
         self.assertIn("CMAKE_CACHEFILE_DIR", result.stderr)
         self.assertNotIn("Traceback", result.stderr)
 
+    def test_cache_with_utf8_bom_is_read(self):
+        with tempfile.TemporaryDirectory() as directory:
+            cache = Path(directory) / "CMakeCache.txt"
+            cache.write_text("\ufeffCMAKE_CACHEFILE_DIR:INTERNAL=C:/work/build\nCMAKE_HOME_DIRECTORY:INTERNAL=C:/work/source\n", encoding="utf-8")
+            with mock.patch.object(select_tests.Build, "run", return_value="Build file encoding: UTF-8"):
+                build = select_tests.Build(directory)
+                self.assertEqual(build.path, os.path.normpath("C:/work/build"))
+                self.assertEqual(build.source, os.path.normpath("C:/work/source"))
+
+    def test_explain_accepts_utf8_bom_in_graph_and_changed(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            graph_path = root / "graph.json"
+            graph = {
+                "tests": {
+                    "unit": {
+                        "target": "tests/unit",
+                        "arguments": [],
+                        "registered": [],
+                        "sets": [],
+                        "requires": [],
+                        "depends": [],
+                    }
+                },
+                "closures": {"tests/unit": ["src/main.c"]},
+            }
+            graph_path.write_text("\ufeff" + json.dumps(graph), encoding="utf-8")
+            changed_path = root / "changed.txt"
+            changed_path.write_text("\ufeffsrc/main.c\n", encoding="utf-8")
+            result = self.run_tool("explain", graph_path, changed_path)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            data = json.loads(result.stdout)
+            self.assertEqual(data["tests"], ["unit"])
+
 
 class CaseInsensitivePathTests(unittest.TestCase):
     def build(self):
@@ -257,7 +386,61 @@ class CaseInsensitivePathTests(unittest.TestCase):
             self.assertIsNone(build.repo(os.path.join(os.sep, "WORK", "SOURCE", "BUILD", "Generated.h")))
 
 
+class ChunkTests(unittest.TestCase):
+    def test_windows_batches_fit_the_serialized_utf16_budget(self):
+        cases = (
+            (20000, ["\U0001f600" * 50 + f"/{index}.obj" for index in range(400)]),
+            (64, ['space name\\', 'embedded"quote', "\t", "", 'both \\" slash\\'] * 20),
+            (64, ["\ud800" * 10, "\U0001f600" * 10] * 20),
+        )
+        for budget, names in cases:
+            with self.subTest(budget=budget, first=names[0]), mock.patch.object(select_tests.sys, "platform", "win32"), \
+                    mock.patch.object(select_tests, "BATCH", budget):
+                batches = list(select_tests.chunks(iter(names)))
+                self.assertEqual([name for batch in batches for name in batch], names)
+                self.assertGreater(len(batches), 1)
+                for batch in batches:
+                    self.assertTrue(batch)
+                    command = subprocess.list2cmdline(batch)
+                    self.assertLessEqual(len(command.encode("utf-16-le", "surrogatepass")) // 2 + 1, budget)
+
+    def test_windows_batch_keeps_an_exact_boundary(self):
+        with mock.patch.object(select_tests.sys, "platform", "win32"), mock.patch.object(select_tests, "BATCH", 8):
+            self.assertEqual(list(select_tests.chunks(["a b", "c", "d"])), [["a b", "c"], ["d"]])
+
+    def test_other_platforms_keep_the_existing_character_budget(self):
+        names = ["\U0001f600" * 3, "abc", "\udcff"]
+        for platform in ("linux", "darwin"):
+            with self.subTest(platform=platform), mock.patch.object(select_tests.sys, "platform", platform), \
+                    mock.patch.object(select_tests, "BATCH", 8):
+                self.assertEqual(list(select_tests.chunks(iter(names))), [names[:2], names[2:]])
+
+    def test_empty_input_and_an_oversized_single_argument_are_preserved(self):
+        for platform in ("win32", "linux"):
+            with self.subTest(platform=platform), mock.patch.object(select_tests.sys, "platform", platform), \
+                    mock.patch.object(select_tests, "BATCH", 4):
+                self.assertEqual(list(select_tests.chunks(iter([]))), [])
+                self.assertEqual(list(select_tests.chunks(["long target", "x"])), [["long target"], ["x"]])
+
+    @unittest.skipUnless(sys.platform == "win32", "needs the Windows command line limit")
+    def test_windows_batches_launch_without_losing_arguments(self):
+        names = ["\U0001f600" * 50 + f"/{index}.obj" for index in range(400)]
+        for batch in select_tests.chunks(names):
+            result = subprocess.run([sys.executable, "-I", "-c", "import json,sys; print(json.dumps(sys.argv[1:]))", *batch],
+                                    capture_output=True, text=True, check=True, timeout=5)
+            self.assertEqual(json.loads(result.stdout), batch)
+
+
 class PlanTests(unittest.TestCase):
+    def test_unresolved_selected_command_keeps_unselected_build_targets(self):
+        build = mock.Mock()
+        listed = [{"name": "selected"}, {"name": "other", "command": ["/build/tests/shared_tests"]}]
+        build.tests.side_effect = [({}, listed), ({}, [listed[0]])]
+        build.leaves.return_value = ["tests/shared_tests", "helper"]
+        build.target.side_effect = lambda test: "tests/shared_tests" if test.get("command") else None
+        graph = {"tests": {"selected": {}, "other": {}}}
+        self.assertEqual(select_tests.plan(build, graph, {"selected"}), ([1], ["tests/shared_tests", "helper"], 2))
+
     def test_plan_empty_run_avoids_invoking_ctest(self):
         build = mock.Mock()
         build.tests.return_value = ({}, [{"name": "alpha", "command": ["/build/alpha_tests"]}])
@@ -271,5 +454,63 @@ class PlanTests(unittest.TestCase):
         build.tests.assert_called_once_with()
 
 
+class MissingCommandTests(unittest.TestCase):
+    def test_only_unambiguous_absolute_commands_in_reachable_files_are_recovered(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            active, stale = root / "active tests", root / "stale"
+            active.mkdir()
+            stale.mkdir()
+            executable = (root / "tests/unit_tests").as_posix()
+            helper = (root / "tests/helper_tests").as_posix()
+            (root / "CTestTestfile.cmake").write_text('subdirs("active tests")\n', encoding="utf-8")
+            (active / "CTestTestfile.cmake").write_text(
+                f'add_test([=[absolute]=] "{executable}" "{helper}")\n'
+                'add_test(relative tests/relative_tests)\n'
+                'add_test(path unit_tests)\n'
+                f'if(CONFIG)\nadd_test(ambiguous "{executable}")\nelse()\nadd_test(ambiguous "{helper}")\nendif()\n'
+                f'add_test(existing "{executable}")\n'
+                'subdirs("..")\n', encoding="utf-8")
+            (stale / "CTestTestfile.cmake").write_text(f'add_test(stale "{executable}")\n', encoding="utf-8")
+            names = ("absolute", "relative", "path", "ambiguous", "existing", "stale")
+            listed = [{"name": name} for name in names]
+            listed[4]["command"] = [helper]
+            build = object.__new__(select_tests.Build)
+            build.path = str(root)
+            with mock.patch.object(select_tests.subprocess, "run", return_value=mock.Mock(stdout=json.dumps({"tests": listed}))):
+                _, recovered = build.tests()
+            commands = {test["name"]: test.get("command") for test in recovered}
+            self.assertEqual(commands, {"absolute": [executable, helper], "relative": None, "path": None,
+                                        "ambiguous": None, "existing": [helper], "stale": None})
+
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(select_tests.sys, "stdout", out), mock.patch.object(select_tests.sys, "stderr", err):
+            try:
+                select_tests.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_shader_cache_runtime_sources.py b/tools/tests/test_shader_cache_runtime_sources.py
index d4d43946e7..a0442a6d52 100644
--- a/tools/tests/test_shader_cache_runtime_sources.py
+++ b/tools/tests/test_shader_cache_runtime_sources.py
@@ -34,6 +34,9 @@ class Fixture:
         header = root / 'core/libs/prx/libc/include/HostThreadLocal.hpp'
         header.parent.mkdir(parents=True)
         header.write_text('struct FixtureThreadLocal {};\n', encoding='utf-8')
+        shared = root / 'core/libs/prx/libc/include/general/AtomicSharedPtr.hpp'
+        shared.parent.mkdir(parents=True)
+        shared.write_text('struct FixtureAtomicSharedPtr {};\n', encoding='utf-8')
         self.guard = root / 'driver.cpp'
         self.guard.write_text('int fixture_driver;\n', encoding='utf-8')
         compiler = root / ('compiler.cmd' if os.name == 'nt' else 'compiler')
@@ -75,7 +78,7 @@ file(WRITE "${{CMAKE_CURRENT_BINARY_DIR}}/runtime-sources.txt" "${{runtimeSource
 
     def configure(self, flags=''):
         result = subprocess.run([CMAKE, '-S', str(self.root), '-B', str(self.build), '-G', 'Ninja', f'-DCMAKE_CXX_FLAGS={flags}'],
-                                capture_output=True, encoding='utf-8', errors='replace', timeout=15)
+                                capture_output=True, encoding='utf-8', errors='replace', timeout=120)
         if result.returncode:
             raise AssertionError(result.stdout + result.stderr)
         if (self.root / 'compiler-invoked').exists():
@@ -98,7 +101,7 @@ file(WRITE "${{CMAKE_CURRENT_BINARY_DIR}}/runtime-sources.txt" "${{runtimeSource
                                  f'-DRECOMPILER_DIR={self.recompiler.as_posix()}',
                                  f'-DLIST_FILE={self.listing.as_posix()}', f'-DOUTPUT={output.as_posix()}',
                                  f'-DEXTRA={self.extra}', '-P', str(self.recompiler / 'ShaderCacheVersion.cmake')],
-                                capture_output=True, encoding='utf-8', errors='replace', timeout=10)
+                                capture_output=True, encoding='utf-8', errors='replace', timeout=60)
         if not success:
             if result.returncode == 0 or output.exists():
                 raise AssertionError('The generator accepted an unkeyed dependency')
@@ -144,7 +147,7 @@ class ShaderCacheRuntimeSourceTests(unittest.TestCase):
                       'if(NOT result EQUAL 99)', 'message(FATAL_ERROR "Unexpected compiler arguments were accepted")', 'endif()']
         script.write_text('\n'.join(lines) + '\n', encoding='utf-8')
         result = subprocess.run([CMAKE, '-P', str(script)], capture_output=True,
-                                encoding='utf-8', errors='replace', timeout=10)
+                                encoding='utf-8', errors='replace', timeout=60)
         self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
         self.assertEqual(len(marker.read_text(encoding='utf-8').splitlines()), len(rejected))
 
diff --git a/tools/tests/test_stubgen.py b/tools/tests/test_stubgen.py
index bc4bf37488..eedd1e3a09 100644
--- a/tools/tests/test_stubgen.py
+++ b/tools/tests/test_stubgen.py
@@ -6,6 +6,7 @@ import tempfile
 from pathlib import Path
 import sys
 import unittest
+from unittest.mock import patch
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import check_conventions
@@ -200,5 +201,37 @@ class ReadOnlyOutputTests(unittest.TestCase):
             self.assertEqual(sorted(path.name for path in root.iterdir()), ["Export.cpp", "nids.txt"])
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+                self.newline = None
+
+            def reconfigure(self, encoding=None, errors=None, newline=None):
+                self.encoding = encoding
+                self.errors = errors
+                self.newline = newline
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(stubgen.sys, "stdout", out), patch.object(stubgen.sys, "stderr", err):
+            try:
+                stubgen.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(out.newline, "\n")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+        self.assertEqual(err.newline, "\n")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_suggest_patches.py b/tools/tests/test_suggest_patches.py
new file mode 100644
index 0000000000..0da25c6f5d
--- /dev/null
+++ b/tools/tests/test_suggest_patches.py
@@ -0,0 +1,250 @@
+import contextlib
+import hashlib
+import io
+import json
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+import suggest_patches
+
+VERIFIED = "Verified 1 patches: 1 ok, 0 not-checked, 0 mismatch\n"
+
+
+class PatchAdvisorTests(unittest.TestCase):
+    def setUp(self):
+        self.directory = tempfile.TemporaryDirectory()
+        self.addCleanup(self.directory.cleanup)
+        self.root = Path(self.directory.name)
+        self.catalog = self.root / "catalog"
+        self.catalog.mkdir()
+        self.input = self.root / "eboot.bin"
+        self.input.write_bytes(b"main executable")
+        self.module = self.root / "Media" / "Modules" / "module.prx"
+        self.module.parent.mkdir(parents=True)
+        self.module.write_bytes(b"module version one")
+        self.param = self.root / "param.json"
+        self.param.write_text(json.dumps({"titleId": "TEST00001", "contentVersion": "01.000.000"}))
+        self.relinker = self.root / "relinker"
+        self.relinker.write_bytes(b"fixture")
+        (self.catalog / "patch.toml").write_text('format = 1\n[[patch]]\ntarget = "Media/Modules/module.prx"\nva = 0x1000\nexpected = "00"\nvalue = "01"\n')
+        self.entry = {"titleId": "TEST00001", "contentVersion": "01.000.000", "patch": "patch.toml",
+                      "targets": {"Media/Modules/module.prx": hashlib.sha256(self.module.read_bytes()).hexdigest()}}
+        self.write_index()
+
+    def write_index(self, entries=None):
+        (self.catalog / "index.json").write_text(json.dumps({"format": 1, "entries": entries if entries is not None else [self.entry]}))
+
+    def advise(self, *extra):
+        return suggest_patches.main(["--catalog", str(self.catalog), "--param-json", str(self.param),
+                                     "--input", str(self.input), "--relinker", str(self.relinker),
+                                     "--module-dir", "Media/Modules", *extra])
+
+    def additional_executable(self):
+        executable = self.root / "picker" / "picker.bin"
+        executable.parent.mkdir()
+        executable.write_bytes(b"secondary executable")
+        (self.catalog / "patch.toml").write_text('format = 1\n[[patch]]\ntarget = "picker/picker.bin"\nva = 0x1000\nexpected = "00"\nvalue = "01"\n')
+        self.entry["targets"] = {"picker/picker.bin": hashlib.sha256(executable.read_bytes()).hexdigest()}
+        self.write_index()
+        return executable
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_verified_match_requires_explicit_application(self, run):
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        self.assertEqual(self.advise(), 0)
+        self.assertEqual(run.call_args.args[0], [str(self.relinker), "--verify-patches",
+                                                 str(self.catalog / "patch.toml"), "--module-dir", "Media/Modules",
+                                                 str(self.input)])
+        self.assertFalse((self.root / "relinker-patches.toml").exists())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_changed_module_is_not_sent_to_relinker(self, run):
+        self.module.write_bytes(b"module version two")
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_rejection_is_not_a_recommendation(self, run):
+        run.return_value.returncode = 1
+        run.return_value.stdout = "Mismatch: patch\nVerified 1 patches: 0 ok, 0 not-checked, 1 mismatch\n"
+        run.return_value.stderr = ""
+        self.assertEqual(self.advise(), 1)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_catalog_cannot_escape_directory(self, run):
+        self.entry["patch"] = "../outside.toml"
+        self.write_index()
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_hashes_cover_all_patch_targets(self, run):
+        self.entry["targets"] = {"eboot.bin": hashlib.sha256(self.input.read_bytes()).hexdigest()}
+        self.write_index()
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_additional_executable_is_hashed_and_verified(self, run):
+        self.additional_executable()
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        self.assertEqual(self.advise("--executable", "picker/picker.bin"), 0)
+        self.assertEqual(run.call_args.args[0], [str(self.relinker), "--verify-patches",
+                                                 str(self.catalog / "patch.toml"), "--module-dir", "Media/Modules",
+                                                 "--executable", "picker/picker.bin", str(self.input)])
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_changed_additional_executable_is_not_verified(self, run):
+        executable = self.additional_executable()
+        executable.write_bytes(b"different executable")
+        self.assertEqual(self.advise("--executable", "picker/picker.bin"), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_additional_executable_cannot_escape_module_parent(self, run):
+        self.assertEqual(self.advise("--executable", "../outside.bin"), 2)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_unrelated_malformed_patch_does_not_block_recommendation(self, run):
+        bad = {"titleId": "OTHER0001", "contentVersion": "01.000.000", "patch": "missing.toml", "targets": {}}
+        (self.catalog / "index.json").write_text(json.dumps({"format": 1, "entries": [bad, self.entry]}))
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        self.assertEqual(self.advise(), 0)
+        run.assert_called_once()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_matching_malformed_patch_is_rejected(self, run):
+        self.entry["patch"] = "missing.toml"
+        self.write_index()
+        self.assertEqual(self.advise(), 1)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_timeout_is_not_a_recommendation(self, run):
+        run.side_effect = subprocess.TimeoutExpired([str(self.relinker)], 7)
+        self.assertEqual(self.advise("--timeout-seconds", "7"), 1)
+        self.assertEqual(run.call_args.kwargs["timeout"], 7)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_broken_matching_entry_does_not_block_valid_entry(self, run):
+        bad = dict(self.entry, patch="broken.toml")
+        (self.catalog / "broken.toml").write_text("format = @")
+        self.write_index([bad, self.entry])
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 0)
+        self.assertIn("Catalog entry 1 ('broken.toml'): rejected", output.getvalue())
+        self.assertIn("Recommended:", output.getvalue())
+        run.assert_called_once()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_timeout_does_not_block_valid_entry(self, run):
+        self.write_index([self.entry, self.entry])
+        run.side_effect = [subprocess.TimeoutExpired([str(self.relinker)], 7), subprocess.CompletedProcess([], 0, VERIFIED, "")]
+        self.assertEqual(self.advise("--timeout-seconds", "7"), 0)
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_error_without_verified_entries_exits_two(self, run):
+        run.return_value.returncode = 2
+        run.return_value.stdout = ""
+        run.return_value.stderr = "FAIL: broken input"
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_error_does_not_block_verified_entry(self, run):
+        self.write_index([self.entry, self.entry])
+        run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 0, VERIFIED, "")]
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 0)
+        self.assertIn("Catalog entry 1 ('patch.toml'): relinker error (exit 2)", output.getvalue())
+        self.assertIn("Recommended:", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_error_and_mismatch_exit_two(self, run):
+        self.write_index([self.entry, self.entry])
+        run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 1, "Verified 1 patches: 0 ok, 0 not-checked, 1 mismatch\n", "")]
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_multiple_verified_entries_are_ambiguous(self, run):
+        self.write_index([self.entry, self.entry])
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 1)
+        self.assertIn("multiple verified catalog entries", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_not_checked_patch_is_not_recommended(self, run):
+        run.return_value.returncode = 0
+        run.return_value.stdout = "Verified 1 patches: 0 ok, 1 not-checked, 0 mismatch\n"
+        self.assertEqual(self.advise(), 1)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_success_without_verification_summary_is_an_error(self, run):
+        run.return_value.returncode = 0
+        run.return_value.stdout = "unrecognized verifier"
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_relinker_argument_error_is_not_a_patch_rejection(self, run):
+        run.return_value.returncode = 1
+        run.return_value.stdout = ""
+        run.return_value.stderr = "FAIL: invalid option"
+        self.assertEqual(self.advise(), 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_conflicting_module_options_are_rejected_before_relinker(self, run):
+        self.assertEqual(self.advise("--skip-sce-module", "--sce-module-path", str(self.root)), 2)
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_uppercase_digest_and_conversion_options(self, run):
+        self.additional_executable()
+        self.entry["targets"]["picker/picker.bin"] = self.entry["targets"]["picker/picker.bin"].upper()
+        self.write_index()
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--executable", "picker/picker.bin", "--sce-module-path", str(self.root)), 0)
+        self.assertIn("--patches", output.getvalue())
+        self.assertIn("--module-dir Media/Modules", output.getvalue())
+        self.assertIn("--executable picker/picker.bin", output.getvalue())
+        self.assertIn(f"--sce-module-path {self.root}", output.getvalue())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_no_entries_for_title_is_distinct(self, run):
+        self.write_index([])
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise(), 1)
+        self.assertIn("no catalog entry for TEST00001 01.000.000", output.getvalue())
+        run.assert_not_called()
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_invalid_timeout_is_rejected_before_relinker(self, run):
+        self.assertEqual(self.advise("--timeout-seconds", "0"), 2)
+        run.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/tests/test_test_registration.py b/tools/tests/test_test_registration.py
index 106d3bc3ae..34cf8c65d5 100644
--- a/tools/tests/test_test_registration.py
+++ b/tools/tests/test_test_registration.py
@@ -1,4 +1,6 @@
 from pathlib import Path
+import contextlib
+import io
 import os
 import shutil
 import subprocess
@@ -13,6 +15,32 @@ import check_test_registration
 
 
 class RegistrationTests(unittest.TestCase):
+    def test_bracket_arguments_ignore_only_one_initial_newline(self):
+        values = (("path", "path"), ("\npath", "path"), ("\n\npath", "\npath"),
+                  ("\n path", " path"), (" \npath", " \npath"), ("\\npath", "\\npath"),
+                  ("\n", ""), ("\npath\n", "path\n"))
+        for equals in ("", "=", "==="):
+            for content, expected in values:
+                with self.subTest(equals=equals, content=content):
+                    command = f"subdirs([{equals}[{content}]{equals}])\n"
+                    self.assertEqual(list(check_test_registration.commands(command)), [("subdirs", [expected])])
+        self.assertEqual(list(check_test_registration.commands('subdirs("\npath")\n')),
+                         [("subdirs", ["\npath"])])
+
+    def test_bracket_initial_newlines_do_not_hide_disabled_tests(self):
+        content = ('add_test([=[\nbounds]=] "/build/tests/buffer_bounds_tests")\n'
+                   'set_tests_properties(bounds PROPERTIES DISABLED [=[\nTRUE]=])\n')
+        self.assertNotIn("buffer_bounds_tests", self.registered(content))
+
+    def test_bracket_initial_newline_in_subdirectory_is_ignored(self):
+        with tempfile.TemporaryDirectory() as directory:
+            build = Path(directory)
+            (build / "nested").mkdir()
+            (build / "CTestTestfile.cmake").write_text('subdirs([=[\nnested]=])\n', encoding="utf-8")
+            (build / "nested/CTestTestfile.cmake").write_text(
+                'add_test(bounds "/build/tests/buffer_bounds_tests")\n', encoding="utf-8")
+            self.assertEqual(check_test_registration.registered(build), {"buffer_bounds_tests"})
+
     def test_literal_prefixes_cannot_expose_commands_inside_arguments(self):
         prefixes = (r"\#", r"\(", '"prefix" ', '"" ', '"line\nprefix" ', "[[prefix]] ",
                     "[=[prefix]=] ", "[===[line\nprefix]===] ")
@@ -309,6 +337,11 @@ class ScriptRegistrationTests(unittest.TestCase):
             "core/relinker/CMakeLists.txt": "if(WIN32)\n    add_test(NAME a COMMAND ${Python3_EXECUTABLE}\n        ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_a.py)\nendif()\n",
             "core/relinker/relinker/tests/test_a.py": ""}), [])
 
+    def test_script_in_bracket_argument_with_initial_newline_is_registered(self):
+        self.assertEqual(self.unrun({
+            "CMakeLists.txt": "add_test(NAME a COMMAND python [=[\ntools/tests/test_a.py]=])\n",
+            "tools/tests/test_a.py": ""}), [])
+
     def test_unregistered_script_is_reported(self):
         self.assertEqual(self.unrun({
             "CMakeLists.txt": "add_test(NAME a COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_a.py)\n",
@@ -343,5 +376,51 @@ class ScriptRegistrationTests(unittest.TestCase):
              "tools/tests/test_f.py"])
 
 
+class CheckRegistrationCliTests(unittest.TestCase):
+    def test_cache_with_utf8_bom_is_read(self):
+        with tempfile.TemporaryDirectory() as directory:
+            build = Path(directory)
+            cache = build / "CMakeCache.txt"
+            cache.write_text("\ufeffCMAKE_MAKE_PROGRAM:FILEPATH=ninja\nCMAKE_GENERATOR:INTERNAL=Ninja\n", encoding="utf-8")
+            output = "tests/dummy_tests: EXECUTABLE\n"
+            with patch.object(check_test_registration.subprocess, "run", side_effect=lambda command, **kwargs: SimpleNamespace(
+                    stdout="Build file encoding: UTF-8\n" if command[-1] == "wincodepage" else output)):
+                names = check_test_registration.built(build)
+                self.assertEqual(names, {"dummy_tests"})
+
+    def test_main_scripts_with_explicit_argv(self):
+        with patch.object(check_test_registration, "unrun_scripts", return_value=(["test_a.py"], [])):
+            with contextlib.redirect_stdout(io.StringIO()):
+                code = check_test_registration.main(["--scripts"])
+            self.assertEqual(code, 0)
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(check_test_registration.sys, "stdout", out), patch.object(check_test_registration.sys, "stderr", err):
+            try:
+                check_test_registration.main(["--invalid-argument"])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_trace_digest.py b/tools/tests/test_trace_digest.py
index a7fa3619db..8099ca9eee 100644
--- a/tools/tests/test_trace_digest.py
+++ b/tools/tests/test_trace_digest.py
@@ -7,6 +7,7 @@ import subprocess
 import sys
 import tempfile
 import unittest
+from unittest import mock
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
@@ -46,6 +47,25 @@ STACKS = "# samples=5 depth=64 truncated=1\n# module a.prx 0x1000 0x1\nntdll.dll
 
 
 class TraceDigestTests(unittest.TestCase):
+    def test_cli_rejects_invalid_event_container_shapes_without_partial_output(self):
+        cases = [(value, "trace must be an event array or object") for value in (None, True, 7, "trace")]
+        cases += [({"traceEvents": value}, "traceEvents must be an array")
+                  for value in (None, False, 0, "", {}, "events")]
+        cases += [([value], "trace event 0 must be an object") for value in (None, True, 7, "event", [])]
+        cases.append(({"traceEvents": [{}, None]}, "trace event 1 must be an object"))
+        for document, message in cases:
+            for compressed in (False, True):
+                with self.subTest(document=document, compressed=compressed):
+                    path = Path(self.directory.name) / ("invalid.json.gz" if compressed else "invalid.json")
+                    data = json.dumps(document).encode("utf-8")
+                    path.write_bytes(gzip.compress(data) if compressed else data)
+                    result = subprocess.run([sys.executable, trace_digest.__file__, str(path), "--json"],
+                                            capture_output=True, text=True, encoding="utf-8", timeout=20)
+                    self.assertEqual(result.returncode, 2, result.stderr)
+                    self.assertIn("FAIL: " + message, result.stderr)
+                    self.assertNotIn("Traceback", result.stderr)
+                    self.assertEqual(result.stdout, "")
+
     def test_cli_reports_unreadable_inputs_without_partial_output(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
@@ -123,6 +143,8 @@ class TraceDigestTests(unittest.TestCase):
         self.assertEqual(empty_dict.presents, [])
         empty_list = trace_digest.Trace([])
         self.assertEqual(empty_list.presents, [])
+        empty_events = trace_digest.Trace({"traceEvents": []})
+        self.assertEqual(empty_events.presents, [])
 
     def result(self):
         return trace_digest.digest(trace_digest.load_trace(self.trace), trace_digest.load_summary(None, self.trace),
@@ -723,6 +745,33 @@ class IntervalDigestTests(unittest.TestCase):
             loaded = trace_digest.load_summary(str(summary_file), SUMMARY["trace"])
             self.assertEqual(loaded["commit"], SUMMARY["commit"])
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(trace_digest.sys, "stdout", out), mock.patch.object(trace_digest.sys, "stderr", err):
+            try:
+                trace_digest.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_unwrap_self.py b/tools/tests/test_unwrap_self.py
index 6ee6d2095e..035a38e71f 100644
--- a/tools/tests/test_unwrap_self.py
+++ b/tools/tests/test_unwrap_self.py
@@ -1,4 +1,5 @@
 import contextlib
+import errno
 import io
 import os
 import struct
@@ -106,6 +107,249 @@ class UnwrapTest(unittest.TestCase):
                 self.assertEqual(source.read_bytes(), container)
                 self.assertEqual(alias.read_bytes(), container)
 
+    def test_main_with_explicit_argv(self):
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source = Path(self.directory) / "input.self"
+        output = Path(self.directory) / "output.elf"
+        source.write_bytes(container)
+        with contextlib.redirect_stdout(io.StringIO()):
+            code = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(code, 0)
+        self.assertTrue(output.exists())
+
+    def test_write_failure_preserves_output_and_removes_temporary_files(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        real_open = io.open
+
+        def failing_open(path, mode="r", *args, **kwargs):
+            stream = real_open(path, mode, *args, **kwargs)
+            if "w" not in mode and "x" not in mode:
+                return stream
+            writer = mock.MagicMock(wraps=stream)
+            writer.__enter__.return_value = writer
+            writer.__exit__.side_effect = lambda *args: stream.close()
+
+            def fail_after_partial_write(data):
+                stream.write(data[:16])
+                stream.flush()
+                raise OSError(errno.ENOSPC, "simulated write failure")
+
+            writer.write.side_effect = fail_after_partial_write
+            return writer
+
+        for previous in (None, b"previous output"):
+            with self.subTest(previous=previous):
+                output.unlink(missing_ok=True)
+                if previous is not None:
+                    output.write_bytes(previous)
+                before = set(directory.iterdir())
+                errors = io.StringIO()
+                with mock.patch("io.open", side_effect=failing_open), contextlib.redirect_stderr(errors):
+                    status = unwrap_self.main([str(source), str(output)])
+                self.assertEqual(status, 2)
+                self.assertIn("simulated write failure", errors.getvalue())
+                self.assertEqual(set(directory.iterdir()), before)
+                if previous is not None:
+                    self.assertEqual(output.read_bytes(), previous)
+                self.assertEqual(source.read_bytes(), container)
+
+    def test_replace_failure_preserves_output_and_removes_temporary_files(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        output.write_bytes(b"previous output")
+        before = set(directory.iterdir())
+        errors = io.StringIO()
+        with mock.patch.object(Path, "replace", side_effect=OSError("simulated replacement failure")), \
+                contextlib.redirect_stderr(errors), contextlib.redirect_stdout(io.StringIO()):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertIn("simulated replacement failure", errors.getvalue())
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(source.read_bytes(), container)
+        self.assertEqual(set(directory.iterdir()), before)
+
+    def test_successful_conversion_replaces_existing_output_without_temporary_files(self):
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        expected = output.read_bytes()
+        before = set(Path(self.directory).iterdir())
+        output.write_bytes(b"previous output")
+        with contextlib.redirect_stdout(io.StringIO()):
+            status = unwrap_self.main([str(Path(self.directory) / "input.self"), str(output)])
+        self.assertEqual(status, 0)
+        self.assertEqual(output.read_bytes(), expected)
+        self.assertEqual(set(Path(self.directory).iterdir()), before)
+
+    def test_close_failure_preserves_existing_output(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        source.write_bytes(build_container(default_segments(), default_records(), default_payloads()))
+        output.write_bytes(b"previous output")
+        before = set(directory.iterdir())
+        real_open = io.open
+
+        def failing_open(path, mode="r", *args, **kwargs):
+            stream = real_open(path, mode, *args, **kwargs)
+            if "w" not in mode and "x" not in mode:
+                return stream
+            writer = mock.MagicMock(wraps=stream)
+            writer.__enter__.return_value = writer
+
+            def fail_on_close(*args):
+                stream.close()
+                raise OSError("simulated close failure")
+
+            writer.__exit__.side_effect = fail_on_close
+            return writer
+
+        errors = io.StringIO()
+        with mock.patch("io.open", side_effect=failing_open), contextlib.redirect_stderr(errors):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertIn("simulated close failure", errors.getvalue())
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(set(directory.iterdir()), before)
+
+    def test_temporary_file_creation_failure_preserves_existing_output(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        source.write_bytes(build_container(default_segments(), default_records(), default_payloads()))
+        output.write_bytes(b"previous output")
+        before = set(directory.iterdir())
+        errors = io.StringIO()
+        real_open = io.open
+
+        def failing_open(path, mode="r", *args, **kwargs):
+            if "x" in mode:
+                raise OSError("simulated creation failure")
+            return real_open(path, mode, *args, **kwargs)
+
+        with mock.patch("io.open", side_effect=failing_open), contextlib.redirect_stderr(errors):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertIn("simulated creation failure", errors.getvalue())
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(set(directory.iterdir()), before)
+
+    def test_temporary_name_collision_preserves_all_existing_files(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        collision = directory / ".unwrap-self-collision"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        output.write_bytes(b"previous output")
+        collision.write_bytes(b"unrelated file")
+        before = set(directory.iterdir())
+        errors = io.StringIO()
+        with mock.patch.object(unwrap_self.secrets, "token_hex", return_value="collision"), \
+                contextlib.redirect_stderr(errors):
+            status = unwrap_self.main([str(source), str(output)])
+        self.assertEqual(status, 2)
+        self.assertEqual(output.read_bytes(), b"previous output")
+        self.assertEqual(collision.read_bytes(), b"unrelated file")
+        self.assertEqual(source.read_bytes(), container)
+        self.assertEqual(set(directory.iterdir()), before)
+
+    @unittest.skipUnless(sys.platform == "win32", "Windows ACL inheritance")
+    def test_new_output_inherits_the_destination_directory_acl(self):
+        directory = Path(self.directory)
+        grant = subprocess.run(["icacls.exe", str(directory), "/grant", "*S-1-1-0:(OI)(CI)(RX)"],
+                               capture_output=True, text=True, timeout=30)
+        self.assertEqual(grant.returncode, 0, grant.stdout + grant.stderr)
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        permissions = directory / "output-acl.txt"
+        saved = subprocess.run(["icacls.exe", str(output), "/save", str(permissions)],
+                               capture_output=True, text=True, timeout=30)
+        self.assertEqual(saved.returncode, 0, saved.stdout + saved.stderr)
+        self.assertIn(";;;WD)", permissions.read_text(encoding="utf-16-le"))
+        self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+        self.assertEqual((directory / "input.self").read_bytes(), container)
+        self.assertFalse(any(path.name.startswith(".unwrap-self-") for path in directory.iterdir()))
+
+    @unittest.skipUnless(os.name == "posix", "POSIX permission bits")
+    def test_new_output_permissions_follow_the_process_umask(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        container = build_container(default_segments(), default_records(), default_payloads())
+        source.write_bytes(container)
+        for mask in (0o000, 0o022, 0o027, 0o077, 0o200, 0o777):
+            with self.subTest(umask=oct(mask)):
+                output = directory / f"output-{mask:o}.elf"
+                result = subprocess.run([sys.executable, str(Path(unwrap_self.__file__)), str(source), str(output)],
+                                        capture_output=True, text=True, timeout=30, umask=mask)
+                self.assertEqual(result.returncode, 0, result.stderr)
+                mode = output.stat().st_mode & 0o777
+                self.assertEqual(mode, 0o666 & ~mask)
+                output.chmod(mode | 0o400)
+                self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+                self.assertFalse(any(path.name.startswith(".unwrap-self-") for path in directory.iterdir()))
+        self.assertEqual(source.read_bytes(), container)
+
+    @unittest.skipUnless(os.name == "posix", "POSIX group inheritance")
+    def test_new_output_inherits_the_destination_directory_group(self):
+        groups = [group for group in os.getgroups() if group != os.getegid()]
+        if not groups:
+            self.skipTest("requires a supplementary group")
+        directory = Path(self.directory)
+        group = groups[0]
+        try:
+            os.chown(directory, -1, group)
+            directory.chmod(0o2700)
+        except PermissionError as error:
+            self.skipTest(str(error))
+        if not directory.stat().st_mode & 0o2000:
+            self.skipTest("filesystem does not retain the setgid bit")
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(output.stat().st_gid, group)
+        self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+        self.assertEqual((directory / "input.self").read_bytes(), container)
+        self.assertEqual(set(directory.iterdir()), {directory / "input.self", output})
+
+    @unittest.skipUnless(os.name == "posix", "POSIX permission bits")
+    def test_replacing_output_preserves_existing_permissions(self):
+        directory = Path(self.directory)
+        source = directory / "input.self"
+        output = directory / "output.elf"
+        source.write_bytes(build_container(default_segments(), default_records(), default_payloads()))
+        output.write_bytes(b"previous output")
+        output.chmod(0o640)
+        unwrap_self.unwrap(source, output)
+        self.assertTrue(output.read_bytes().startswith(b"\x7fELF"))
+        self.assertEqual(output.stat().st_mode & 0o777, 0o640)
+
+    def test_output_symlink_is_kept_and_its_target_is_replaced(self):
+        container = build_container(default_segments(), default_records(), default_payloads())
+        result, output = self.convert(container)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        expected = output.read_bytes()
+        output.unlink()
+        target = Path(self.directory) / "target.elf"
+        target.write_bytes(b"previous output")
+        try:
+            output.symlink_to(target.name)
+        except OSError as error:
+            self.skipTest(str(error))
+        before = set(Path(self.directory).iterdir())
+        unwrap_self.unwrap(Path(self.directory) / "input.self", output)
+        self.assertTrue(output.is_symlink())
+        self.assertEqual(target.read_bytes(), expected)
+        self.assertEqual(set(Path(self.directory).iterdir()), before)
+
     def convert(self, container, name="input.self"):
         directory = Path(self.directory)
         source = directory / name
@@ -122,6 +366,27 @@ class UnwrapTest(unittest.TestCase):
     def tearDown(self):
         self.temporary.cleanup()
 
+    def test_program_table_overlapping_elf_header_preserves_output(self):
+        for offset in (0, 8, 32, 63):
+            for previous in (None, b"previous output"):
+                with self.subTest(offset=offset, previous=previous):
+                    container = bytearray(build_container(default_segments(), default_records(), default_payloads()))
+                    struct.pack_into("<Q", container, ELF_HEADER_OFFSET + 0x20, offset)
+                    output = Path(self.directory) / "output.elf"
+                    if previous is not None:
+                        output.write_bytes(previous)
+                    else:
+                        output.unlink(missing_ok=True)
+                    result, output = self.convert(container)
+                    self.assertEqual(result.returncode, 2, result.stderr)
+                    self.assertIn("ELF program header table overlaps the ELF header", result.stderr)
+                    self.assertNotIn("Traceback", result.stderr)
+                    self.assertEqual((Path(self.directory) / "input.self").read_bytes(), container)
+                    if previous is None:
+                        self.assertFalse(output.exists())
+                    else:
+                        self.assertEqual(output.read_bytes(), previous)
+
     def test_record_table_places_the_segments_and_keeps_the_alignment(self):
         container = build_container(default_segments(), default_records(), default_payloads())
         result, output = self.convert(container)
@@ -473,7 +738,7 @@ class UnwrapTest(unittest.TestCase):
 
         def allocate(value):
             if isinstance(value, int):
-                self.assertLessEqual(value, len(container) + unwrap_self.MAX_EMPTY_LOAD_PADDING)
+                self.assertLessEqual(value, len(container) + unwrap_self.MAX_ALIGNMENT_PADDING)
             return bytearray(value)
 
         for previous in (None, b"previous output"):
@@ -486,7 +751,7 @@ class UnwrapTest(unittest.TestCase):
                         contextlib.redirect_stderr(io.StringIO()) as stderr:
                     self.assertEqual(unwrap_self.main(), 2)
                 self.assertEqual(stdout.getvalue(), "")
-                self.assertIn("empty load alignment requires more than", stderr.getvalue())
+                self.assertIn("segment alignment requires more than", stderr.getvalue())
                 self.assertNotIn("Traceback", stderr.getvalue())
                 if previous is not None:
                     self.assertEqual(output.read_bytes(), previous)
@@ -494,20 +759,104 @@ class UnwrapTest(unittest.TestCase):
                     self.assertFalse(output.exists())
                 self.assertEqual(source.read_bytes(), container)
 
+    def test_excessive_file_backed_padding_is_refused_before_allocation(self):
+        cases = [
+            ([(PT_LOAD, 5, 0x1234, (1 << 40) - 1, 0x100, 1 << 40)],
+             [(0x2804, 0x800, 0x100)], {0x800: b"x" * 0x100}),
+            ([(PT_LOAD, 5, 0x1234, 0, 0x100, PAGE),
+              (SCE_COMMENT, 0, 0xB00, 0, 0x20, 1 << 40)],
+             [(0x2804, 0x800, 0x100)], {0x800: b"x" * 0x100, 0xB00: pattern(9, 0x20)}),
+        ]
+        source = Path(self.directory) / "input.self"
+        output = Path(self.directory) / "output.elf"
+        for segments, records, payloads in cases:
+            container = build_container(segments, records, payloads)
+            source.write_bytes(container)
+
+            def allocate(value):
+                if isinstance(value, int):
+                    self.assertLessEqual(value, len(container) + 64 * 1024 * 1024)
+                return bytearray(value)
+
+            for previous in (None, b"previous output"):
+                with self.subTest(segments=segments, previous=previous):
+                    output.unlink(missing_ok=True)
+                    if previous is not None:
+                        output.write_bytes(previous)
+                    with mock.patch.object(unwrap_self, "bytearray", side_effect=allocate, create=True), \
+                            mock.patch.object(sys, "argv", ["unwrap_self.py", str(source), str(output)]), \
+                            contextlib.redirect_stdout(io.StringIO()) as stdout, \
+                            contextlib.redirect_stderr(io.StringIO()) as stderr:
+                        self.assertEqual(unwrap_self.main(), 2)
+                    self.assertEqual(stdout.getvalue(), "")
+                    self.assertIn("alignment requires more than", stderr.getvalue())
+                    self.assertNotIn("Traceback", stderr.getvalue())
+                    self.assertEqual(source.read_bytes(), container)
+                    if previous is None:
+                        self.assertFalse(output.exists())
+                    else:
+                        self.assertEqual(output.read_bytes(), previous)
+
+    def test_alignment_padding_limit_is_cumulative(self):
+        for empty in (False, True):
+            with self.subTest(empty=empty):
+                segments = [(PT_LOAD, 5, 0x1234, 0x80, 0x20, 0x100),
+                            (PT_LOAD, 6, 0x5678, 0x580, 0 if empty else 0x10, 0x1000)]
+                records = [(0x800, 0x800, 0x20)]
+                payloads = {0x800: pattern(1, 0x20)}
+                if not empty:
+                    records.append((0x100800, 0xA00, 0x10))
+                    payloads[0xA00] = pattern(9, 0x10)
+                source = Path(self.directory) / "input.self"
+                output = Path(self.directory) / "output.elf"
+                container = build_container(segments, records, payloads)
+                source.write_bytes(container)
+                output.write_bytes(b"previous output")
+                with mock.patch.object(unwrap_self, "MAX_ALIGNMENT_PADDING", 0x15F):
+                    with self.assertRaisesRegex(unwrap_self.Refused, "alignment requires more than"):
+                        unwrap_self.unwrap(source, output)
+                self.assertEqual(output.read_bytes(), b"previous output")
+                self.assertEqual(source.read_bytes(), container)
+                with mock.patch.object(unwrap_self, "MAX_ALIGNMENT_PADDING", 0x160):
+                    unwrap_self.unwrap(source, output)
+                data, headers = read_program_headers(output)
+                for header in headers:
+                    self.assertEqual(header[2] % header[7], header[3] % header[7])
+                self.assertEqual(data[headers[0][2]:headers[0][2] + 0x20], payloads[0x800])
+                if not empty:
+                    self.assertEqual(data[headers[1][2]:headers[1][2] + 0x10], payloads[0xA00])
+
+    def test_large_alignment_with_small_padding_remains_supported(self):
+        payload = b"x" * 0x100
+        segments = [(PT_LOAD, 5, 0x1234, FIRST_REGION + 0x10, len(payload), 1 << 40)]
+        container = build_container(segments, [(0x2804, 0x800, len(payload))], {0x800: payload})
+        source = Path(self.directory) / "input.self"
+        output = Path(self.directory) / "output.elf"
+        source.write_bytes(container)
+        with mock.patch.object(unwrap_self, "MAX_ALIGNMENT_PADDING", 0x10):
+            unwrap_self.unwrap(source, output)
+        data, headers = read_program_headers(output)
+        load = headers[0]
+        self.assertEqual(load[2] % load[7], load[3] % load[7])
+        self.assertEqual(load[2], FIRST_REGION + 0x10)
+        self.assertEqual(data[load[2]:load[2] + load[5]], payload)
+        self.assertEqual(source.read_bytes(), container)
+
     def test_empty_load_padding_limit_counts_only_added_bytes(self):
-        baseline, output = self.convert(build_container(default_segments(), default_records(), default_payloads()))
+        backed = [(*segment[:5], 1) for segment in default_segments()]
+        baseline, output = self.convert(build_container(backed, default_records(), default_payloads()))
         self.assertEqual(baseline.returncode, 0, baseline.stderr)
         baseline_size = output.stat().st_size
         limit = 0x100
         for extra in (-1, limit, limit + 1):
             with self.subTest(extra=extra):
                 address = 0x10000 + baseline_size + extra
-                segments = default_segments() + [(PT_LOAD, 6, 0, address, 0, 0x10000)]
+                segments = backed + [(PT_LOAD, 6, 0, address, 0, 0x10000)]
                 container = build_container(segments, default_records(), default_payloads())
                 source = Path(self.directory) / "input.self"
                 source.write_bytes(container)
                 previous = output.read_bytes()
-                with mock.patch.object(unwrap_self, "MAX_EMPTY_LOAD_PADDING", limit):
+                with mock.patch.object(unwrap_self, "MAX_ALIGNMENT_PADDING", limit):
                     if extra <= limit:
                         unwrap_self.unwrap(source, output)
                         data, headers = read_program_headers(output)
@@ -515,7 +864,7 @@ class UnwrapTest(unittest.TestCase):
                         self.assertEqual(headers[3][2], baseline_size + extra)
                         self.assertEqual(headers[3][2] % headers[3][7], address % headers[3][7])
                     else:
-                        with self.assertRaisesRegex(unwrap_self.Refused, "empty load alignment requires more than"):
+                        with self.assertRaisesRegex(unwrap_self.Refused, "segment alignment requires more than"):
                             unwrap_self.unwrap(source, output)
                         self.assertEqual(output.read_bytes(), previous)
 
@@ -664,5 +1013,33 @@ class UnwrapTest(unittest.TestCase):
         self.assertTrue(output.exists())
 
 
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with mock.patch.object(unwrap_self.sys, "stdout", out), mock.patch.object(unwrap_self.sys, "stderr", err):
+            try:
+                unwrap_self.main([])
+            except SystemExit:
+                pass
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/tests/test_web_release.py b/tools/tests/test_web_release.py
index 5fbc00dc65..d67632e117 100644
--- a/tools/tests/test_web_release.py
+++ b/tools/tests/test_web_release.py
@@ -1,3 +1,4 @@
+import contextlib
 import hashlib
 import io
 import json
@@ -12,6 +13,7 @@ from unittest.mock import patch
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 import build_web
 import package_release
+import test_web
 
 FILES = ("index.html", "app.css", "app.mjs", "archive.mjs", "batch.mjs", "output-directory.mjs", "worker.mjs",
          "native/relinker_wasm.mjs", "native/relinker_wasm.wasm")
@@ -375,5 +377,65 @@ class WebPackageTests(unittest.TestCase):
                 self.assertEqual(self.asset.read_bytes(), b"previous asset")
 
 
+class TestWebRunnerTests(unittest.TestCase):
+    def test_main_rejects_missing_archive_file_without_traceback(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            build = Path(tmp) / "build"
+            build.mkdir()
+            with self.assertRaises(SystemExit) as error, contextlib.redirect_stderr(io.StringIO()) as err:
+                test_web.main(["--build", str(build)])
+            self.assertEqual(error.exception.code, 2)
+            self.assertIn("archive module does not exist", err.getvalue())
+
+    def test_main_rejects_archive_missing_zip_url(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            build = Path(tmp) / "build"
+            (build / "web").mkdir(parents=True)
+            (build / "web/archive.mjs").write_text("const x = 1;\n", encoding="utf-8")
+            with patch("subprocess.run"):
+                with self.assertRaises(SystemExit) as error, contextlib.redirect_stderr(io.StringIO()) as err:
+                    test_web.main(["--build", str(build)])
+            self.assertEqual(error.exception.code, 2)
+            self.assertIn("zip library URL not found", err.getvalue())
+
+    def test_main_decodes_archive_with_utf8_bom(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            build = Path(tmp) / "build"
+            (build / "web").mkdir(parents=True)
+            (build / "web/archive.mjs").write_text('\ufefffrom "https://cdn.jsdelivr.net/example/zip.mjs";\n', encoding="utf-8")
+            with patch("subprocess.run"), \
+                    patch("urllib.request.urlopen") as mock_url:
+                mock_resp = mock_url.return_value.__enter__.return_value
+                mock_resp.read.return_value = b"zip-content"
+                result = test_web.main(["--build", str(build)])
+                self.assertEqual(result, 0)
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, text):
+                return len(text)
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(test_web.sys, "stdout", out), patch.object(test_web.sys, "stderr", err):
+            with self.assertRaises(SystemExit) as error:
+                test_web.main([])
+        self.assertEqual(error.exception.code, 2)
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/tools/trace_digest.py b/tools/trace_digest.py
index 6d03d2200c..59c9fb3bf9 100644
--- a/tools/trace_digest.py
+++ b/tools/trace_digest.py
@@ -33,8 +33,14 @@ class Trace:
         self.presents = []
         self.folded = collections.defaultdict(float)
         self.batched = []
-        events = document if isinstance(document, list) else (document.get("traceEvents") or [])
-        for event in events:
+        if not isinstance(document, (list, dict)):
+            raise ValueError("trace must be an event array or object")
+        events = document if isinstance(document, list) else document.get("traceEvents", [])
+        if not isinstance(events, list):
+            raise ValueError("traceEvents must be an array")
+        for index, event in enumerate(events):
+            if not isinstance(event, dict):
+                raise ValueError(f"trace event {index} must be an object")
             phase = event.get("ph")
             if phase == "M" and event.get("name") == "thread_name":
                 self.threads[event["tid"]] = event["args"]["name"]
@@ -338,6 +344,9 @@ def nonnegative_integer(value):
 
 
 def main(arguments=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description=DESCRIPTION)
     parser.add_argument("trace", help="aps5-trace-*.json.gz (or .json), or a .jsonl summary file with APS5_TRACE_SUMMARY_EVERY lines")
     parser.add_argument("--summary", help="file with the summary line (default: aps5-summary.jsonl next to the trace)")
@@ -372,9 +381,6 @@ def main(arguments=None):
 
 
 if __name__ == "__main__":
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(encoding="utf-8", errors="replace")
     try:
         sys.exit(main())
     except (EOFError, OSError, ValueError, zlib.error) as error:
diff --git a/tools/unwrap_self.py b/tools/unwrap_self.py
index 1ce81f2e12..8181e49ddc 100644
--- a/tools/unwrap_self.py
+++ b/tools/unwrap_self.py
@@ -31,6 +31,7 @@ usage: unwrap_self.py <input.self> <output.elf> [--verbose]
 
 import argparse
 import math
+import secrets
 import struct
 import sys
 from collections import Counter
@@ -43,7 +44,7 @@ RECORD_SIZE = 0x20
 RECORD_HAS_SEGMENT = 0x800
 RECORD_SEGMENT_SHIFT = 20
 FIRST_REGION = 0x400
-MAX_EMPTY_LOAD_PADDING = 64 * 1024 * 1024
+MAX_ALIGNMENT_PADDING = 64 * 1024 * 1024
 PT_LOAD = 1
 PT_NOTE = 4
 ENTROPY_LIMIT = 7.5
@@ -109,6 +110,8 @@ def parse_elf(data):
     count = struct.unpack_from("<H", header, 0x38)[0]
     if entry_size != 56 or count == 0:
         raise Refused("program header table is %d entries of %d bytes" % (count, entry_size))
+    if program_offset < len(header):
+        raise Refused("ELF program header table overlaps the ELF header")
     if inner + program_offset + count * entry_size > len(data):
         raise Refused("ELF program header table does not fit the file")
     headers = []
@@ -233,8 +236,8 @@ def check_decrypted(data, headers):
 
 
 def unwrap(path, output, verbose=False):
-    source, destination = Path(path), Path(output)
-    if source.resolve() == destination.resolve() or (destination.exists() and source.samefile(destination)):
+    source, destination = Path(path), Path(output).resolve()
+    if source.resolve() == destination or (destination.exists() and source.samefile(destination)):
         raise Refused("output aliases the input container")
     data = bytes(source.read_bytes())
     if len(data) < FIRST_REGION:
@@ -273,9 +276,11 @@ def unwrap(path, output, verbose=False):
     regions.sort(key=lambda region: region["old"])
     program_offset = struct.unpack_from("<Q", elf_header, 0x20)[0]
     cursor = max(FIRST_REGION, program_offset + len(headers) * 56)
+    padding = 0
     for region in regions:
         alignment = region["align"] if region["align"] and (region["align"] & (region["align"] - 1)) == 0 else 1
         placed = cursor + (region["vaddr"] - cursor) % alignment
+        padding += placed - cursor
         region["new"] = placed
         cursor = placed + region["size"]
 
@@ -283,8 +288,9 @@ def unwrap(path, output, verbose=False):
     for header in headers:
         if header["type"] == PT_LOAD and header["size"] == 0:
             empty_end = max(empty_end, header["vaddr"] % max(header["align"], 1))
-    if empty_end - cursor > MAX_EMPTY_LOAD_PADDING:
-        raise Refused("empty load alignment requires more than %d bytes of output padding" % MAX_EMPTY_LOAD_PADDING)
+    padding += empty_end - cursor
+    if padding > MAX_ALIGNMENT_PADDING:
+        raise Refused("segment alignment requires more than %d bytes of output padding" % MAX_ALIGNMENT_PADDING)
     cursor = empty_end
 
     result = bytearray(cursor)
@@ -321,19 +327,29 @@ def unwrap(path, output, verbose=False):
             print("  [%2d] %-18s vaddr=%#011x filesz=%#010x offset=%#010x%s"
                   % (item["index"], name, item["vaddr"], item["size"], item["new"], moved))
 
-    destination = Path(output)
-    if destination.parent != Path(""):
-        destination.parent.mkdir(parents=True, exist_ok=True)
-    destination.write_bytes(result)
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    temporary_path = destination.parent / (".unwrap-self-" + secrets.token_hex(16))
+    temporary = temporary_path.open("xb")
+    try:
+        with temporary:
+            temporary.write(result)
+        if sys.platform != "win32" and destination.exists():
+            temporary_path.chmod(destination.stat().st_mode)
+        temporary_path.replace(destination)
+    finally:
+        temporary_path.unlink(missing_ok=True)
     return len(result)
 
 
-def main():
+def main(argv=None):
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="unwrap a decrypted SELF or fSELF container into a clean ELF")
     parser.add_argument("input", help="SELF container to read")
     parser.add_argument("output", help="ELF executable to write")
     parser.add_argument("--verbose", action="store_true", help="print the program header mapping")
-    arguments = parser.parse_args()
+    arguments = parser.parse_args(argv)
     try:
         size = unwrap(arguments.input, arguments.output, arguments.verbose)
     except Refused as error:
@@ -347,6 +363,4 @@ def main():
 
 
 if __name__ == "__main__":
-    if hasattr(sys.stdout, "reconfigure"):
-        sys.stdout.reconfigure(encoding="utf-8")
     sys.exit(main())